41a9f62be5fbb928018aab5f7500bef51a2fd74d4fffb4a20a946733820bdc1b485afa417cdbcfdfbc54f58c9c3edffe240c36f4ab8a16613814e226b6d20d98010ab1ace49fa76dce337a5a5f1dcff9e5d533b12475e33b971b15b69cd591cd9059759f0f04ba5468a34b98915033debb3e87f048e8601712659d47d8687eb6be5e650068d88000000000000") preadv(r0, &(0x7f0000000480), 0x100000000000018d, 0x0) msgget$private(0x0, 0x22) [ 445.413188] binder: 23331:23345 Acquire 1 refcount change on invalid ref 0 ret -22 [ 445.420957] binder: 23331:23345 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 12:33:42 executing program 5: r0 = openat$autofs(0xffffffffffffff9c, &(0x7f0000000000)='/dev/autofs\x00', 0x0, 0x0) write$P9_RWALK(r0, &(0x7f0000000040)={0x4a, 0x6f, 0x2, {0x5, [{0x1, 0x2, 0x4}, {0x30, 0x2, 0x2}, {0x82, 0x1, 0x5}, {0x80, 0x3, 0x4}, {0x8, 0x2, 0x2}]}}, 0x4a) preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f0000000180)=""/148, 0x13d}], 0x1, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000340)="696f001b66408225aaa3af068fffebb8a490c47dda6586f1b58895b94a78037dd3714e7198820a7a709e2d30d25e6d846cd5c62a648a598668a8263b752b0b622b115112b5ad8e0425c0b784bbdb89eb8f4da0dd73dd01fe35694c2f78600badf8a0e237dba40713bac9e053b41a9f62be5fbb928018aab5f7500bef51a2fd74d4fffb4a20a946733820bdc1b485afa417cdbcfdfbc54f58c9c3edffe240c36f4ab8a16613814e226b6d20d98010ab1ace49fa76dce337a5a5f1dcff9e5d533b12475e33b971b15b69cd591cd9059759f0f04ba5468a34b98915033debb3e87f048e8601712659d47d8687eb6be5e650068d88000000000000") preadv(r1, &(0x7f0000000480), 0x10000000000002a1, 0x0) ioctl$KVM_HYPERV_EVENTFD(r0, 0x4018aebd, &(0x7f00000000c0)={0x4, r1}) 12:33:42 executing program 3: r0 = socket$inet6(0xa, 0x400000000001, 0x0) r1 = dup(r0) setsockopt$inet6_tcp_int(r1, 0x6, 0x20000000000002, &(0x7f00007b1000)=0x81, 0x4) bind$inet6(r0, &(0x7f00000000c0)={0xa, 0x4e20}, 0x1c) setsockopt$inet6_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000440)='vegas\x00', 0x6) sendto$inet6(r0, &(0x7f0000e77fff), 0x2bd, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) listen(0xffffffffffffffff, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) clone(0x0, &(0x7f0000000240), &(0x7f0000000100), &(0x7f0000000140), &(0x7f0000000180)) r2 = open(&(0x7f0000000040)='./bus\x00', 0x141042, 0x0) ftruncate(r2, 0x7fff) sendfile(r1, r2, &(0x7f0000d83ff8), 0x8000fffffffe) setsockopt$inet_mreq(r2, 0x0, 0x23, &(0x7f0000000000), 0x8) ioctl$EVIOCSABS20(r1, 0x401845e0, &(0x7f0000000080)={0x81, 0x7, 0x0, 0x0, 0x7, 0x93b6}) [ 445.532487] binder: 23331:23356 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 12:33:43 executing program 5: preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f0000000180)=""/148, 0x13d}], 0x1, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000340)="696f001b66408225aaa3af068fffebb8a490c47dda6586f1b58895b94a78037dd3714e7198820a7a709e2d30d25e6d846cd5c62a648a598668a8263b752b0b622b115112b5ad8e0425c0b784bbdb89eb8f4da0dd73dd01fe35694c2f78600badf8a0e237dba40713bac9e053b41a9f62be5fbb928018aab5f7500bef51a2fd74d4fffb4a20a946733820bdc1b485afa417cdbcfdfbc54f58c9c3edffe240c36f4ab8a16613814e226b6d20d98010ab1ace49fa76dce337a5a5f1dcff9e5d533b12475e33b971b15b69cd591cd9059759f0f04ba5468a34b98915033debb3e87f048e8601712659d47d8687eb6be5e650068d88000000000000") r1 = syz_open_dev$midi(&(0x7f0000000000)='/dev/midi#\x00', 0x3f, 0x200000) preadv(r0, &(0x7f0000000480), 0x10000000000002a1, 0x0) ioctl$TIOCGSID(r1, 0x5429, &(0x7f0000000040)) 12:33:43 executing program 1: preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f0000000180)=""/148, 0x13d}], 0x1, 0x0) r0 = syz_open_dev$sndpcmc(&(0x7f0000000340)='/dev/snd/pcmC#D#c\x00', 0xf14e, 0x100) ioctl$TIOCGPGRP(r0, 0x540f, &(0x7f0000000080)=0x0) r2 = syz_open_procfs(r1, &(0x7f0000000240)="696f001b66408225aaa3af068fc47dda6586f1b58895b94a78037dd3714e7198820a7a709e2d30d25e6d846cd5c62a648a598668a8263b752b0b622b115112b5ad8e0425c0b784bbdb89eb8f4da0dd73dd01fe35694c2f78600badf8a2e237dba40713bac9e053b41a9f62be5fbb928018aab5f7500bef51a2fd74d4fffb4a20a946733820bdfdfbc54f58c9c3edffe240c36f4ab8a16613814e226b6d20d98010ab1ace49fa76dce337a5a5f1dcff9e5d533b12475e33b971b15b69cd591cd9059759f0f04bbca5468a34b98915033debb3e87f0a81c2001b54048e8601712659d47d8687eb6be5e650068d8800000000000000") connect$l2tp(r2, &(0x7f0000000040)=@pppol2tpv3in6={0x18, 0x1, {0x0, r2, 0x4, 0x2, 0x3, 0x3, {0xa, 0x4e20, 0x3, @ipv4={[], [], @remote}, 0x5}}}, 0x3a) ioctl$DRM_IOCTL_SET_CLIENT_CAP(r2, 0x4010640d, &(0x7f0000000000)={0x18c, 0x72}) getsockopt$sock_linger(r2, 0x1, 0xd, &(0x7f0000000380), &(0x7f00000003c0)=0x8) ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(r2, 0xc08c5332, &(0x7f00000000c0)={0xff, 0x7, 0x100000001, 'queue0\x00', 0x400}) preadv(r2, &(0x7f0000000480), 0x10000000000002a1, 0x0) r3 = add_key$keyring(&(0x7f0000000500)='keyring\x00', &(0x7f0000000540)={0x73, 0x79, 0x7a, 0x1}, 0x0, 0x0, 0xfffffffffffffff8) add_key$user(&(0x7f0000000400)='user\x00', &(0x7f0000000440)={0x73, 0x79, 0x7a, 0x3}, &(0x7f0000000480)="988195aec07f5e3cc71b5fd6e13ad01c4e64b5c3a3be24cc05b068d4c21b8226cbaff46569dc0d8f47a605dce6a06157f15357643952aa4600de06adeca80b2ed27d6e92f33da73d74fc2a36a1844d585c69026000f6ce4d45fae5c4710c29cb4ca98c793981f5c8aae2fdb6fc99445f93ec48ba375a30a04f8fc7", 0x7b, r3) 12:33:43 executing program 2: perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f0000000180)=""/148, 0x13d}], 0x1, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000340)="696f001b66408225aaa3af068fffebb8a490c47dda6586f1b58895b94a78037dd3714e7198820a7a709e2d30d25e6d846cd5c62a648a598668a8263b752b0b622b115112b5ad8e0425c0b784bbdb89eb8f4da0dd73dd01fe35694c2f78600badf8a0e237dba40713bac9e053b41a9f62be5fbb928018aab5f7500bef51a2fd74d4fffb4a20a946733820bdc1b485afa417cdbcfdfbc54f58c9c3edffe240c36f4ab8a16613814e226b6d20d98010ab1ace49fa76dce337a5a5f1dcff9e5d533b12475e33b971b15b69cd591cd9059759f0f04ba5468a34b98915033debb3e87f048e8601712659d47d8687eb6be5e650068d88000000000000") preadv(r0, &(0x7f0000000480), 0x100000000000026b, 0x0) msgget$private(0x0, 0x22) 12:33:43 executing program 0: syz_open_dev$sndctrl(&(0x7f0000000140)='/dev/snd/controlC#\x00', 0x0, 0x0) sched_setaffinity(0x0, 0x7, &(0x7f00000000c0)=0x9) r0 = perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0) fcntl$setflags(r0, 0x2, 0x1) getsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER_VALUE(0xffffffffffffffff, 0x84, 0x7c, &(0x7f00000001c0), &(0x7f0000000240)=0x8) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(0xffffffffffffffff, 0x84, 0x9, &(0x7f0000000280)={0x0, @in={{0x2, 0x4e23, @remote}}, 0xfffffffffffffff7, 0x0, 0x400, 0x97df, 0xc1}, 0x98) sendto$inet6(0xffffffffffffffff, &(0x7f00000004c0), 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) setsockopt$SO_BINDTODEVICE(0xffffffffffffffff, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x4) socket$inet6(0xa, 0x1000000000002, 0x0) r1 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x4, 0x0, &(0x7f0000000100)=[@enter_looper], 0x1, 0x0, &(0x7f0000000180)='T'}) r2 = gettid() timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, &(0x7f0000040000)) tkill(r2, 0x1004000000016) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0xfffffffffffffced, 0x0, &(0x7f0000000040)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x400c630f}], 0x0, 0x0, &(0x7f0000000f4d)}) 12:33:43 executing program 4: socket$inet6(0xa, 0x0, 0x80000000) syz_open_dev$sndctrl(&(0x7f0000000140)='/dev/snd/controlC#\x00', 0x9, 0x400000) sched_setaffinity(0x0, 0x7, &(0x7f00000000c0)=0x9) r0 = perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0) fcntl$setflags(r0, 0x2, 0x1) r1 = socket$inet6(0xa, 0x400000000001, 0x0) r2 = dup(r1) setsockopt$inet6_tcp_int(r2, 0x6, 0x12, &(0x7f0000000000)=0x7f, 0x4) bind$inet6(r1, &(0x7f0000000040)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) getsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER_VALUE(r1, 0x84, 0x7c, &(0x7f00000001c0)={0x0, 0x100000001, 0x6}, &(0x7f0000000240)=0x8) sendto$inet6(r1, &(0x7f00000004c0), 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) setsockopt$SO_BINDTODEVICE(r1, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x4) socket$inet6(0xa, 0x1000000000002, 0x0) r3 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r3, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000200)={0x4, 0x0, &(0x7f0000000100)=[@enter_looper], 0x1, 0x0, &(0x7f0000000180)='T'}) r4 = gettid() timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, &(0x7f0000040000)) tkill(r4, 0x1004000000016) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0xfffffffffffffced, 0x0, &(0x7f0000000040)}) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x400c630f}], 0x0, 0x0, &(0x7f0000000f4d)}) 12:33:43 executing program 3: r0 = socket$inet6(0xa, 0x400000000001, 0x0) r1 = dup(r0) setsockopt$inet6_tcp_int(r1, 0x6, 0x20000000000002, &(0x7f00007b1000)=0x81, 0x4) bind$inet6(r0, &(0x7f00000000c0)={0xa, 0x4e20}, 0x1c) setsockopt$inet6_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000440)='vegas\x00', 0x6) sendto$inet6(r0, &(0x7f0000e77fff), 0x2bd, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) listen(0xffffffffffffffff, 0x0) getsockopt$inet6_IPV6_XFRM_POLICY(r1, 0x29, 0x23, &(0x7f00000001c0)={{{@in6=@dev, @in=@multicast2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@remote}, 0x0, @in=@multicast2}}, &(0x7f00000002c0)=0xe8) r3 = getegid() getgroups(0x1, &(0x7f0000000300)=[0xee00]) r5 = getgid() getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000000340)={0x0, 0x0, 0x0}, &(0x7f0000000380)=0xc) getgroups(0x1, &(0x7f00000003c0)=[0xee01]) setxattr$system_posix_acl(&(0x7f0000000000)='./bus\x00', &(0x7f0000000180)='system.posix_acl_access\x00', &(0x7f0000000480)={{}, {0x1, 0x1}, [{0x2, 0x2, r2}], {0x4, 0x7}, [{0x8, 0x1, r3}, {0x8, 0x1, r4}, {0x8, 0x0, r5}, {0x8, 0x1, r6}, {0x8, 0x7, r7}], {0x10, 0x7}, {0x20, 0x4}}, 0x54, 0x2) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) clone(0x0, &(0x7f0000000240), &(0x7f0000000100), &(0x7f0000000140), &(0x7f0000000180)) r8 = open(&(0x7f0000000040)='./bus\x00', 0x141042, 0x0) ftruncate(r8, 0x7fff) ioctl$EVIOCGBITSW(r1, 0x80404525, &(0x7f0000000400)=""/29) sendfile(r1, r8, &(0x7f0000d83ff8), 0x8000fffffffe) ioctl$EVIOCSABS20(r1, 0x401845e0, &(0x7f0000000080)={0x81, 0x7, 0x0, 0x0, 0x7, 0x93b6}) 12:33:43 executing program 1: preadv(0xffffffffffffffff, &(0x7f0000000440)=[{&(0x7f0000000040)=""/32}, {&(0x7f0000000080)=""/98}, {&(0x7f0000000240)=""/232}, {&(0x7f0000000100)=""/88}], 0x1000000000000122, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000340)="696f001b66408225aaa3af068fffebb8a490c47dda6586f1b58895b94a78037dd3714e7198820a7a709e2d30d25e6d846cd5c62a648a598668a8263b752b0b622b115112b5ad8e0425c0b784bbdb89eb8f4da0dd73dd01fe35694c2f78600badf8a0e237dba40713bac9e053b41a9f62be5fbb928018aab5f7500bef51a2fd74d4fffb4a20a946733820bdc1b485afa417cdbcfdfbc54f58c9c3edffe240c36f4ab8a16613814e226b6d20d98010ab1ace49fa76dce337a5a5f1dcff9e5d533b12475e33b971b15b69cd591cd9059759f0f04ba5468a34b98915033debb3e87f048e8601712659d47d8687eb6be5e650068d88000000000000") preadv(r0, &(0x7f0000000480), 0x10000000000002a1, 0x0) 12:33:43 executing program 2: perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f0000000180)=""/148, 0x13d}], 0x1, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000340)="696f001b66408225aaa3af068fffebb8a490c47dda6586f1b58895b94a78037dd3714e7198820a7a709e2d30d25e6d846cd5c62a648a598668a8263b752b0b622b115112b5ad8e0425c0b784bbdb89eb8f4da0dd73dd01fe35694c2f78600badf8a0e237dba40713bac9e053b41a9f62be5fbb928018aab5f7500bef51a2fd74d4fffb4a20a946733820bdc1b485afa417cdbcfdfbc54f58c9c3edffe240c36f4ab8a16613814e226b6d20d98010ab1ace49fa76dce337a5a5f1dcff9e5d533b12475e33b971b15b69cd591cd9059759f0f04ba5468a34b98915033debb3e87f048e8601712659d47d8687eb6be5e650068d88000000000000") preadv(r0, &(0x7f0000000480), 0x1000000000000037, 0x0) msgget$private(0x0, 0x22) [ 446.216302] binder: BINDER_SET_CONTEXT_MGR already set 12:33:43 executing program 5: preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f0000000180)=""/148, 0x13d}], 0x1, 0x0) r0 = fcntl$getown(0xffffffffffffff9c, 0x9) r1 = syz_open_procfs(r0, &(0x7f0000000340)='fdinfo\x00') preadv(r1, &(0x7f0000000480), 0x10000000000002a1, 0x0) 12:33:43 executing program 4: socket$inet6(0xa, 0x0, 0x80000000) syz_open_dev$sndctrl(&(0x7f0000000140)='/dev/snd/controlC#\x00', 0x9, 0x400000) sched_setaffinity(0x0, 0x7, &(0x7f00000000c0)=0x9) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x400000000001, 0x0) r1 = dup(r0) setsockopt$inet6_tcp_int(r1, 0x6, 0x12, &(0x7f0000000000)=0x7f, 0x4) bind$inet6(r0, &(0x7f0000000040)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) getsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER_VALUE(r0, 0x84, 0x7c, &(0x7f00000001c0)={0x0, 0x100000001, 0x6}, &(0x7f0000000240)=0x8) sendto$inet6(r0, &(0x7f00000004c0), 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x4) socket$inet6(0xa, 0x1000000000002, 0x0) r2 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000200)={0x4, 0x0, &(0x7f0000000100)=[@enter_looper], 0x1, 0x0, &(0x7f0000000180)='T'}) r3 = gettid() timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, &(0x7f0000040000)) tkill(r3, 0x1004000000016) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0xfffffffffffffced, 0x0, &(0x7f0000000040)}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x400c630f}], 0x0, 0x0, &(0x7f0000000f4d)}) [ 446.248992] binder: 23387:23389 ioctl 40046207 0 returned -16 [ 446.273139] binder: 23387:23395 Acquire 1 refcount change on invalid ref 0 ret -22 [ 446.280902] binder: 23387:23395 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 12:33:43 executing program 5: preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f0000000180)=""/148, 0x13d}], 0x1, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000340)="696f001b66408225aaa3af068fffebb8a490c47dda6586f1b58895b94a78037dd3714e7198820a7a709e2d30d25e6d846cd5c62a648a598668a8263b752b0b622b115112b5ad8e0425c0b784bbdb89eb8f4da0dd73dd01fe35694c2f78600badf8a0e237dba40713bac9e053b41a9f62be5fbb928018aab5f7500bef51a2fd74d4fffb4a20a946733820bdc1b485afa417cdbcfdfbc54f58c9c3edffe240c36f4ab8a16613814e226b6d20d98010ab1ace49fa76dce337a5a5f1dcff9e5d533b12475e33b971b15b69cd591cd9059759f0f04ba5468a34b98915033debb3e87f048e8601712659d47d8687eb6be5e650068d88000000000000") ioctl$KVM_GET_VCPU_MMAP_SIZE(r0, 0xae04) preadv(r0, &(0x7f0000000480), 0x10000000000002a1, 0x0) ioctl$FS_IOC_FSSETXATTR(r0, 0x401c5820, &(0x7f0000000000)={0xff, 0x496, 0x0, 0x0, 0x8001}) 12:33:43 executing program 1: preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f0000000180)=""/148, 0x13d}], 0x1, 0x0) r0 = semget(0x0, 0x2, 0x4000128) socketpair(0xd, 0x7, 0xffffffffffff7fff, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$ASHMEM_GET_PROT_MASK(r1, 0x7706, &(0x7f00000000c0)) semctl$IPC_INFO(r0, 0x4, 0x3, &(0x7f0000000000)=""/94) r2 = syz_open_procfs(0x0, &(0x7f0000000340)="696f001b66408225aaa3af068fffebb8a490c47dda6586f1b58895b94a78037dd3714e7198820a7a709e2d30d25e6d846cd5c62a648a598668a8263b752b0b622b115112b5ad8e0425c0b784bbdb89eb8f4da0dd73dd01fe35694c2f78600badf8a0e237dba40713bac9e053b41a9f62be5fbb928018aab5f7500bef51a2fd74d4fffb4a20a946733820bdc1b485afa417cdbcfdfbc54f58c9c3edffe240c36f4ab8a16613814e226b6d20d98010ab1ace49fa76dce337a5a5f1dcff9e5d533b12475e33b971b15b69cd591cd9059759f0f04ba5468a34b98915033debb3e87f048e8601712659d47d8687eb6be5e650068d88000000000000") preadv(r2, &(0x7f0000000480), 0x10000000000002a1, 0x0) [ 446.412669] binder: 23387:23389 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 12:33:43 executing program 2: perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f0000000180)=""/148, 0x13d}], 0x1, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000340)="696f001b66408225aaa3af068fffebb8a490c47dda6586f1b58895b94a78037dd3714e7198820a7a709e2d30d25e6d846cd5c62a648a598668a8263b752b0b622b115112b5ad8e0425c0b784bbdb89eb8f4da0dd73dd01fe35694c2f78600badf8a0e237dba40713bac9e053b41a9f62be5fbb928018aab5f7500bef51a2fd74d4fffb4a20a946733820bdc1b485afa417cdbcfdfbc54f58c9c3edffe240c36f4ab8a16613814e226b6d20d98010ab1ace49fa76dce337a5a5f1dcff9e5d533b12475e33b971b15b69cd591cd9059759f0f04ba5468a34b98915033debb3e87f048e8601712659d47d8687eb6be5e650068d88000000000000") preadv(r0, &(0x7f0000000480), 0x100000000000028e, 0x0) msgget$private(0x0, 0x22) 12:33:43 executing program 4: socket$inet6(0xa, 0x0, 0x80000000) syz_open_dev$sndctrl(&(0x7f0000000140)='/dev/snd/controlC#\x00', 0x9, 0x400000) sched_setaffinity(0x0, 0x7, &(0x7f00000000c0)=0x9) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x400000000001, 0x0) r1 = dup(r0) setsockopt$inet6_tcp_int(r1, 0x6, 0x12, &(0x7f0000000000)=0x7f, 0x4) bind$inet6(r0, &(0x7f0000000040)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) getsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER_VALUE(r0, 0x84, 0x7c, &(0x7f00000001c0)={0x0, 0x100000001, 0x6}, &(0x7f0000000240)=0x8) sendto$inet6(r0, &(0x7f00000004c0), 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x4) socket$inet6(0xa, 0x1000000000002, 0x0) r2 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000200)={0x4, 0x0, &(0x7f0000000100)=[@enter_looper], 0x1, 0x0, &(0x7f0000000180)='T'}) r3 = gettid() timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, &(0x7f0000040000)) tkill(r3, 0x1004000000016) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0xfffffffffffffced, 0x0, &(0x7f0000000040)}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x400c630f}], 0x0, 0x0, &(0x7f0000000f4d)}) 12:33:44 executing program 5: preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f0000000180)=""/148, 0x13d}], 0x1, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000340)="696f001b66408225aaa3af068fffebb8a490c47dda6586f1b58895b94a78037dd3714e7198820a7a709e2d30d25e6d846cd5c62a648a598668a8263b752b0b622b115112b5ad8e0425c0b784bbdb89eb8f4da0dd73dd01fe35694c2f78600badf8a0e237dba40713bac9e053b41a9f62be5fbb928018aab5f7500bef51a2fd74d4fffb4a20a946733820bdc1b485afa417cdbcfdfbc54f58c9c3edffe240c36f4ab8a16613814e226b6d20d98010ab1ace49fa76dce337a5a5f1dcff9e5d533b12475e33b971b15b69cd591cd9059759f0f04ba5468a34b98915033debb3e87f048e8601712659d47d8687eb6be5e650068d88000000000000") preadv(r0, &(0x7f0000000480), 0x10000000000002a1, 0x0) getsockopt$inet_sctp6_SCTP_DELAYED_SACK(r0, 0x84, 0x10, &(0x7f0000000000)=@assoc_value={0x0}, &(0x7f0000000040)=0x8) getsockopt$inet_sctp_SCTP_DEFAULT_SNDINFO(r0, 0x84, 0x22, &(0x7f0000000080)={0x6d79, 0x8005, 0x80000000, 0x2950, r1}, &(0x7f00000000c0)=0x10) write$binfmt_elf64(r0, &(0x7f0000000440)={{0x7f, 0x45, 0x4c, 0x46, 0x4, 0x5, 0x100, 0x92, 0xfffffffffffffffe, 0x2, 0x3, 0x3, 0x236, 0x40, 0x40, 0x6, 0x4, 0x38, 0x1, 0x80, 0x0, 0x1}, [{0x7, 0x8, 0x6, 0xfffffffffffffffb, 0x5, 0x9c, 0x4, 0x4}, {0x4, 0x1ee3, 0x10001, 0x4, 0x461f56fd, 0x6, 0x4, 0x4}], "d91966f47876bd265f09343d1b78fa681f234af5ab9593c5385906a52ec451ef3d2d35516304d061", [[], [], [], [], [], [], [], []]}, 0x8d8) 12:33:44 executing program 0: syz_open_dev$sndctrl(&(0x7f0000000140)='/dev/snd/controlC#\x00', 0x0, 0x0) sched_setaffinity(0x0, 0x7, &(0x7f00000000c0)=0x9) r0 = perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0) fcntl$setflags(r0, 0x2, 0x1) getsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER_VALUE(0xffffffffffffffff, 0x84, 0x7c, &(0x7f00000001c0), &(0x7f0000000240)=0x8) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(0xffffffffffffffff, 0x84, 0x9, &(0x7f0000000280)={0x0, @in={{0x2, 0x4e23, @remote}}, 0xfffffffffffffff7, 0x0, 0x400, 0x97df, 0xc1}, 0x98) sendto$inet6(0xffffffffffffffff, &(0x7f00000004c0), 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) setsockopt$SO_BINDTODEVICE(0xffffffffffffffff, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x4) socket$inet6(0xa, 0x1000000000002, 0x0) r1 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x4, 0x0, &(0x7f0000000100)=[@enter_looper], 0x1, 0x0, &(0x7f0000000180)='T'}) r2 = gettid() timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, &(0x7f0000040000)) tkill(r2, 0x1004000000016) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0xfffffffffffffced, 0x0, &(0x7f0000000040)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x400c630f}], 0x0, 0x0, &(0x7f0000000f4d)}) 12:33:44 executing program 1: preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f0000000180)=""/148, 0x13d}], 0x1, 0x0) r0 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000100)='/dev/sequencer\x00', 0x400000, 0x0) fstat(0xffffffffffffff9c, &(0x7f0000000240)={0x0, 0x0, 0x0, 0x0, 0x0}) getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, &(0x7f0000000440)={{{@in6=@dev, @in6=@ipv4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@remote}, 0x0, @in=@remote}}, &(0x7f00000002c0)=0xe8) lstat(&(0x7f0000000300)='./file0\x00', &(0x7f0000000540)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) getgroups(0x9, &(0x7f00000005c0)=[0xee00, 0xffffffffffffffff, 0xee01, 0xee01, 0xffffffffffffffff, 0xee00, 0x0, 0xffffffffffffffff, 0xee01]) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000f40)=@broute={'broute\x00', 0x20, 0x5, 0x940, [0x0, 0x0, 0x0, 0x0, 0x0, 0x20000600], 0x0, &(0x7f0000000140), &(0x7f0000000600)=[{0x0, '\x00', 0x0, 0xfffffffffffffffe, 0x2, [{{{0xb, 0x28, 0x8aff, 'ip_vti0\x00', 'veth1_to_bond\x00', 'dummy0\x00', 'yam0\x00', @dev={[], 0xd}, [0xff, 0xff, 0x0, 0xff, 0xff, 0xff], @local, [0x0, 0x0, 0xff, 0x98a03eb9b1d14dc6, 0xff, 0xff], 0x2f8, 0x2f8, 0x328, [@bpf0={'bpf\x00', 0x210, {{0x2b, [{0x8001, 0x9, 0x3ff, 0x200}, {0x5, 0x81, 0x6b18, 0x1}, {0x7, 0xb30, 0x0, 0xd41a}, {0x3, 0xfffffffffffffffc, 0x800, 0x5}, {0x100000000, 0x401, 0x4, 0x6}, {0x100, 0xfca}, {0x33cc, 0x7, 0x20, 0x8}, {0x7fffffff, 0xffff, 0x1ff, 0x7f}, {0x4, 0x2, 0x6eea, 0xffffffff80000001}, {0xffffffff, 0xff, 0x401, 0x5}, {0x5, 0x200, 0x5, 0x5}, {0x7, 0x8001, 0x1, 0x5c}, {0x9, 0x0, 0x56, 0x7fff}, {0x5, 0x1770, 0x9049, 0xda05}, {0x9, 0x5, 0x0, 0x9}, {0x6, 0x69, 0x6, 0x2}, {0x2aab, 0x415, 0x5, 0xfffffffffffffff9}, {0x0, 0x5, 0x58, 0x5}, {0x7fff, 0x8, 0x5593, 0x5}, {0x8, 0x5, 0x9, 0x8}, {0x353234cf, 0x3ff, 0x5e, 0x80000000}, {0xf1, 0x10000, 0x2ea4, 0x1}, {0x0, 0x100, 0x100000001, 0x7}, {0x25, 0x1, 0x6, 0x800}, {0x81, 0x4, 0x6, 0x80}, {0x80000001, 0x10000, 0x8, 0x6}, {0x100, 0x7fff, 0x1000, 0x1000}, {0x2, 0x2, 0x7fffffff, 0x400}, {0x7, 0x76d8e110, 0x6, 0xfffffffffffffe00}, {0x1, 0x1000, 0x4, 0x1}, {0x2, 0x2, 0x200, 0x5e}, {0x3ff, 0xa5, 0x19, 0x6}, {0x61, 0x800, 0x10000, 0xfffffffffffffeff}, {0x6, 0x1, 0xccb0, 0xfb83}, {0x8, 0x8001, 0x4, 0x1c000}, {0x4fa, 0x7, 0xed, 0x100}, {0x1, 0x1a23, 0x6, 0x5}, {0x8cda, 0x3, 0x0, 0xb3}, {0x8, 0x7, 0x7, 0x4}, {0xfffffffffffffffa, 0x5, 0x8, 0x5}, {0x0, 0x40, 0x1, 0x5}, {0xfffffffffffffffb, 0xbe, 0x5, 0x7}, {0xe74, 0x5, 0x7}, {0x9, 0x3ff, 0x7f, 0x80000001}, {0x3, 0x6, 0x1, 0x401}, {0xa1, 0x2, 0x4, 0x80000000}, {0x0, 0x2, 0x0, 0x3}, {0x1, 0x3, 0x80}, {0x1, 0xffffffffffffffff, 0x34, 0x4}, {0x2, 0x50, 0x7, 0x3}, {0xfff, 0x2, 0x20, 0x4}, {0x4, 0x5, 0xfffffffffffffffb, 0x800}, {0x2, 0x3f, 0x800, 0x12c}, {0x10001, 0x763f, 0x200, 0x1f}, {0x7f, 0xffffffffffffffc1, 0x2, 0xfffffffffffffffe}, {0x80, 0x4a95, 0x768c}, {0x401, 0x5, 0x3}, {0x3, 0x0, 0x7, 0x9}, {0x4, 0x6, 0x800, 0x8}, {0xffffffffffffffa6, 0xffffffff7fffffff, 0xfffffffffffff000, 0x800}, {0x5, 0x4, 0x10001, 0x6}, {0x1004000000000000, 0xfffffffffffffffb, 0x1, 0x40}, {0x200, 0x20, 0x2, 0x10000}, {0x3, 0xf35, 0x10000, 0x100000001}], 0x100000001}}}, @ipvs={'ipvs\x00', 0x28, {{@ipv6=@local, [0xffffffff, 0xff000000, 0xff0000ff, 0xffffffff], 0x4e20, 0x87, 0x0, 0x4e23, 0x4, 0x7}}}]}}, @common=@CONNSECMARK={'CONNSECMARK\x00', 0x8, {{0x2}}}}, {{{0x17, 0x41, 0x8808, 'yam0\x00', 'team_slave_0\x00', 'veth0_to_team\x00', 'syz_tun\x00', @random="2a2afc505282", [0xff, 0xff, 0xff, 0x0, 0x0, 0xff], @empty, [0x0, 0xff, 0x0, 0xff, 0x0, 0xff], 0xf8, 0x148, 0x178, [@mac={'mac\x00', 0x10, {{@local}}}, @nfacct={'nfacct\x00', 0x28, {{'syz0\x00', 0x1}}}]}, [@common=@LED={'LED\x00', 0x28, {{'syz0\x00', 0x1, 0x101, 0x6}}}]}, @common=@AUDIT={'AUDIT\x00', 0x8, {{0x2}}}}]}, {0x0, '\x00', 0x2, 0xffffffffffffffff, 0x2, [{{{0x3, 0x3c, 0x600, 'syzkaller1\x00', 'rose0\x00', 'gretap0\x00', 'veth0_to_bond\x00', @dev={[], 0x1a}, [0xff, 0x0, 0xff, 0x0, 0x0, 0xff], @remote, [0xff, 0xff, 0x0, 0xff, 0xff, 0xff], 0xf8, 0xf8, 0x148, [@ip={'ip\x00', 0x20, {{@broadcast, @local, 0xff000000, 0xffffffff, 0x2, 0x2, 0x21, 0x1d, 0x4e22, 0x4e21, 0x4e20, 0x4e23}}}, @owner={'owner\x00', 0x18, {{r1, r2, r3, r4, 0x4, 0x2}}}]}}, @common=@LED={'LED\x00', 0x28, {{'syz0\x00', 0x0, 0x74d0d80, 0x5}}}}, {{{0x1f, 0x2, 0x6807, 'bcsf0\x00', 'vcan0\x00', 'ifb0\x00', 'team_slave_1\x00', @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x3}, [0xff, 0x0, 0xff, 0xff, 0xff], @local, [0x0, 0x0, 0x0, 0xff], 0xe0, 0x150, 0x180, [@time={'time\x00', 0x18, {{0x100, 0x0, 0x147c4, 0xe803, 0x6, 0x7400000000000000, 0x2}}}, @connlabel={'connlabel\x00', 0x8, {{0x5, 0x2}}}]}, [@common=@dnat={'dnat\x00', 0x10, {{@empty, 0xfffffffffffffffd}}}, @common=@mark={'mark\x00', 0x10, {{0xfffffff0, 0xffffffffffffffff}}}]}, @common=@CONNSECMARK={'CONNSECMARK\x00', 0x8, {{0x2}}}}]}, {0x0, '\x00', 0x4, 0xfffffffffffffffc, 0x1, [{{{0x5, 0x2, 0x8bf7, 'gretap0\x00', 'rose0\x00', 'ifb0\x00', 'eql\x00', @random="bdf9ac0948e1", [0x0, 0xff, 0xff, 0xff, 0xff], @empty, [0xff, 0xff, 0x0, 0xff, 0xff, 0xff], 0x100, 0x100, 0x148, [@nfacct={'nfacct\x00', 0x28, {{'syz0\x00', 0x14c65f80}}}, @mark_m={'mark_m\x00', 0x18, {{0x6, 0x400, 0x3, 0x3}}}]}}, @common=@ERROR={'ERROR\x00', 0x20, {"875eb2b851a4dceba006f3cf83c5a20912762e96d0a36abb24a721ff951d"}}}]}]}, 0x9b8) r5 = syz_open_procfs(0x0, &(0x7f0000000340)="696f001b66408225aaa3af068fffebb8a490c47dda6586f1b58895b94a78037dd3714e7198820a7a709e2d30d25e6d846cd5c62a648a598668a8263b752b0b622b115112b5ad8e0425c0b784bbdb89eb8f4da0dd73dd01fe35694c2f78600badf8a0e237dba40713bac9e053b41a9f62be5fbb928018aab5f7500bef51a2fd74d4fffb4a20a946733820bdc1b485afa417cdbcfdfbc54f58c9c3edffe240c36f4ab8a16613814e226b6d20d98010ab1ace49fa76dce337a5a5f1dcff9e5d533b12475e33b971b15b69cd591cd9059759f0f04ba5468a34b98915033debb3e87f048e8601712659d47d8687eb6be5e650068d88000000000000") preadv(r5, &(0x7f0000000480), 0x10000000000002a1, 0x0) ioctl$UFFDIO_REGISTER(r5, 0xc020aa00, &(0x7f0000000000)={{&(0x7f0000ffb000/0x3000)=nil, 0x3000}}) 12:33:44 executing program 5: socketpair$packet(0x11, 0x3, 0x300, &(0x7f0000000100)={0xffffffffffffffff}) preadv(r0, &(0x7f0000001380)=[{&(0x7f0000000180)=""/148, 0x384}], 0x1, 0x0) r1 = syz_open_dev$adsp(&(0x7f0000000840)='/dev/adsp#\x00', 0x401, 0x4480) getsockopt$bt_l2cap_L2CAP_CONNINFO(r1, 0x6, 0x2, &(0x7f0000000880), &(0x7f00000008c0)=0x6) r2 = syz_open_procfs(0x0, &(0x7f0000000340)="696f001b66408225aaa3af068fffebb8a490c47dda6586f1b58895b94a78037dd3714e7198820a7a709e2d30d25e6d846cd5c62a648a598668a8263b752b0b622b115112b5ad8e0425c0b784bbdb89eb8f4da0dd73dd01fe35694c2f78600badf8a0e237dba40713bac9e053b41a9f62be5fbb928018aab5f7500bef51a2fd74d4fffb4a20a946733820bdc1b485afa417cdbcfdfbc54f58c9c3edffe240c36f4ab8a16613814e226b6d20d98010ab1ace49fa76dce337a5a5f1dcff9e5d533b12475e33b971b15b69cd591cd9059759f0f04ba5468a34b98915033debb3e87f048e8601712659d47d8687eb6be5e650068d88000000000000") preadv(r2, &(0x7f00000000c0)=[{&(0x7f0000000000)=""/132, 0x84}], 0x0, 0x0) 12:33:44 executing program 2: perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f0000000180)=""/148, 0x13d}], 0x1, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000340)="696f001b66408225aaa3af068fffebb8a490c47dda6586f1b58895b94a78037dd3714e7198820a7a709e2d30d25e6d846cd5c62a648a598668a8263b752b0b622b115112b5ad8e0425c0b784bbdb89eb8f4da0dd73dd01fe35694c2f78600badf8a0e237dba40713bac9e053b41a9f62be5fbb928018aab5f7500bef51a2fd74d4fffb4a20a946733820bdc1b485afa417cdbcfdfbc54f58c9c3edffe240c36f4ab8a16613814e226b6d20d98010ab1ace49fa76dce337a5a5f1dcff9e5d533b12475e33b971b15b69cd591cd9059759f0f04ba5468a34b98915033debb3e87f048e8601712659d47d8687eb6be5e650068d88000000000000") preadv(r0, &(0x7f0000000480), 0x1000000000000175, 0x0) msgget$private(0x0, 0x22) 12:33:44 executing program 4: socket$inet6(0xa, 0x0, 0x80000000) syz_open_dev$sndctrl(&(0x7f0000000140)='/dev/snd/controlC#\x00', 0x9, 0x400000) sched_setaffinity(0x0, 0x7, &(0x7f00000000c0)=0x9) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x400000000001, 0x0) r1 = dup(r0) setsockopt$inet6_tcp_int(r1, 0x6, 0x12, &(0x7f0000000000)=0x7f, 0x4) bind$inet6(r0, &(0x7f0000000040)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) getsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER_VALUE(r0, 0x84, 0x7c, &(0x7f00000001c0)={0x0, 0x100000001, 0x6}, &(0x7f0000000240)=0x8) sendto$inet6(r0, &(0x7f00000004c0), 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x4) socket$inet6(0xa, 0x1000000000002, 0x0) r2 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000200)={0x4, 0x0, &(0x7f0000000100)=[@enter_looper], 0x1, 0x0, &(0x7f0000000180)='T'}) r3 = gettid() timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, &(0x7f0000040000)) tkill(r3, 0x1004000000016) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0xfffffffffffffced, 0x0, &(0x7f0000000040)}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x400c630f}], 0x0, 0x0, &(0x7f0000000f4d)}) 12:33:44 executing program 3: r0 = socket$inet6(0xa, 0x400000000001, 0x0) r1 = dup(r0) setsockopt$inet6_tcp_int(r1, 0x6, 0x20000000000002, &(0x7f00007b1000)=0x81, 0x4) bind$inet6(r0, &(0x7f00000000c0)={0xa, 0x4e20}, 0x1c) getsockopt$inet_sctp_SCTP_DEFAULT_SEND_PARAM(r1, 0x84, 0xa, &(0x7f00000001c0)={0x2, 0x8, 0xc, 0x74, 0xdb, 0x9138, 0xffffffff, 0x15, 0x0}, &(0x7f0000000200)=0x20) getsockopt$inet_sctp6_SCTP_DEFAULT_PRINFO(r1, 0x84, 0x72, &(0x7f0000000240)={r2, 0x7c, 0x30}, &(0x7f0000000280)=0xc) setsockopt$inet6_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000440)='vegas\x00', 0x6) sendto$inet6(r0, &(0x7f0000e77fff), 0x2bd, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) listen(0xffffffffffffffff, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) clone(0x0, &(0x7f0000000240), &(0x7f0000000100), &(0x7f0000000140), &(0x7f0000000180)) r3 = open(&(0x7f0000000040)='./bus\x00', 0x141042, 0x0) write$binfmt_misc(r3, &(0x7f00000002c0)={'syz1', "6f4f485e65fa0151600742b912c42f8d5d6c2fbc66b697d5eda02c5b2a85aba4132060757f61f7c7c0e72118d31af0caaae9bdda5067a380fa5e2932a72574f18400426146d66ff80f988d976c9900c6eff0088ea64ee8330f837db31763d45b0d4f1676b5464c8977221f1e4887dd901e8f53e02202d47061c3ed3df55ca3c254ade4f6b1ecdb51a36b161dd4e3714401a174fc40498900c1fe13d2baa08b06b604004c41aa2195e3806af56b64cccf"}, 0xb4) ftruncate(r3, 0x7fff) sendfile(r1, r3, &(0x7f0000d83ff8), 0x8000fffffffe) ioctl$EVIOCSABS20(r1, 0x401845e0, &(0x7f0000000080)={0x81, 0x7, 0x0, 0x0, 0x7, 0x93b6}) 12:33:44 executing program 1: r0 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000000)='/dev/sequencer2\x00', 0x200, 0x0) setsockopt$inet_sctp_SCTP_ADAPTATION_LAYER(r0, 0x84, 0x7, &(0x7f0000000040)={0x4}, 0x4) getsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(r0, 0x84, 0x9, &(0x7f00000000c0)={0x0, @in={{0x2, 0x4e24, @multicast1}}, 0xff, 0x1cbf, 0xb3, 0xffffffffffff1452, 0x4}, &(0x7f0000000240)=0x98) getsockopt$inet_sctp_SCTP_ENABLE_STREAM_RESET(r0, 0x84, 0x76, &(0x7f0000000280)={r1, 0x2714}, &(0x7f00000002c0)=0x8) preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f0000000180)=""/148, 0x13d}], 0x1, 0x0) r2 = shmget(0x0, 0x2000, 0x1000, &(0x7f0000ffc000/0x2000)=nil) setsockopt$inet6_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f0000000580)='scalable\x00', 0xbdb6a863365d7250) shmctl$IPC_RMID(r2, 0x0) lstat(&(0x7f0000000300)='./file0\x00', &(0x7f0000000440)) ioctl$BLKSECTGET(r0, 0x1267, &(0x7f0000000080)) r3 = syz_open_procfs(0x0, &(0x7f0000000340)="696f001b66408225aaa3af068fffebb8a490c47dda6586f1b58895b94a78037dd3714e7198820a7a709e2d30d25e6d846cd5c62a648a598668a8263b752b0b622b115112b5ad8e0425c0b784bbdb89eb8f4da0dd73dd01fe35694c2f78600badf8a0e237dba40713bac9e053b41a9f62be5fbb928018aab5f7500bef51a2fd74d4fffb4a20a946733820bdc1b485afa417cdbcfdfbc54f58c9c3edffe240c36f4ab8a16613814e226b6d20d98010ab1ace49fa76dce337a5a5f1dcff9e5d533b12475e33b971b15b69cd591cd9059759f0f04ba5468a34b98915033debb3e87f048e8601712659d47d8687eb6be5e650068d88000000000000") preadv(r3, &(0x7f0000000480), 0x10000000000002a1, 0x0) [ 447.101935] binder: BINDER_SET_CONTEXT_MGR already set [ 447.112208] binder: 23444:23451 ioctl 40046207 0 returned -16 12:33:44 executing program 2: perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f0000000180)=""/148, 0x13d}], 0x1, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000340)="696f001b66408225aaa3af068fffebb8a490c47dda6586f1b58895b94a78037dd3714e7198820a7a709e2d30d25e6d846cd5c62a648a598668a8263b752b0b622b115112b5ad8e0425c0b784bbdb89eb8f4da0dd73dd01fe35694c2f78600badf8a0e237dba40713bac9e053b41a9f62be5fbb928018aab5f7500bef51a2fd74d4fffb4a20a946733820bdc1b485afa417cdbcfdfbc54f58c9c3edffe240c36f4ab8a16613814e226b6d20d98010ab1ace49fa76dce337a5a5f1dcff9e5d533b12475e33b971b15b69cd591cd9059759f0f04ba5468a34b98915033debb3e87f048e8601712659d47d8687eb6be5e650068d88000000000000") preadv(r0, &(0x7f0000000480), 0x1000000000000117, 0x0) msgget$private(0x0, 0x22) 12:33:44 executing program 1: preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f0000000180)=""/148, 0x13d}], 0x1, 0x0) r0 = getpid() syz_open_procfs(r0, &(0x7f0000000340)="696f001b66408225aaa3af068fffebb8a490c47dda6586f1b58895b94a78037dd3714e7198820a7a709e2d30d25e6d846cd5c62a648a598668a8263b752b0b622b115112b5ad8e0425c0b784bbdb89eb8f4da0dd73dd01fe35694c2f78600badf8a0e237dba40713bac9e053b41a9f62be5fbb928018aab5f7500bef51a2fd74d4fffb4a20a946733820bdc1b485afa417cdbcfdfbc54f58c9c3edffe240c36f4ab8a16613814e226b6d20d98010ab1ace49fa76dce337a5a5f1dcff9e5d533b12475e33b971b15b69cd591cd9059759f0f04ba5468a34b98915033debb3e87f048e8601712659d47d8687eb6be5e650068d88000000000000") 12:33:44 executing program 0: syz_open_dev$sndctrl(&(0x7f0000000140)='/dev/snd/controlC#\x00', 0x0, 0x0) sched_setaffinity(0x0, 0x7, &(0x7f00000000c0)=0x9) r0 = perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0) fcntl$setflags(r0, 0x2, 0x1) getsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER_VALUE(0xffffffffffffffff, 0x84, 0x7c, &(0x7f00000001c0), &(0x7f0000000240)=0x8) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(0xffffffffffffffff, 0x84, 0x9, &(0x7f0000000280)={0x0, @in={{0x2, 0x4e23, @remote}}, 0xfffffffffffffff7, 0x0, 0x0, 0x97df, 0xc1}, 0x98) sendto$inet6(0xffffffffffffffff, &(0x7f00000004c0), 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) setsockopt$SO_BINDTODEVICE(0xffffffffffffffff, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x4) socket$inet6(0xa, 0x1000000000002, 0x0) r1 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x4, 0x0, &(0x7f0000000100)=[@enter_looper], 0x1, 0x0, &(0x7f0000000180)='T'}) r2 = gettid() timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, &(0x7f0000040000)) tkill(r2, 0x1004000000016) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0xfffffffffffffced, 0x0, &(0x7f0000000040)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x400c630f}], 0x0, 0x0, &(0x7f0000000f4d)}) [ 447.186408] binder: 23444:23467 Acquire 1 refcount change on invalid ref 0 ret -22 [ 447.213094] binder: 23444:23467 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 12:33:44 executing program 5: r0 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000100)='/dev/rtc0\x00', 0x80, 0x0) preadv(r0, &(0x7f0000000000)=[{&(0x7f0000000240)=""/148, 0xfffffcc3}], 0x0, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000340)="696f001b66408225aaa3af068fffebb8a490c47dda6586f1b58895b94a78037dd3714e7198820a7a709e2d30d25e6d846cd5c62a648a598668a8263b752b0b622b115112b5ad8e0425c0b784bbdb89eb8f4da0dd73dd01fe35694c2f78600badf8a0e237dba40713bac9e053b41a9f62be5fbb928018aab5f7500bef51a2fd74d4fffb4a20a946733820bdc1b485afa417cdbcfdfbc54f58c9c3edffe240c36f4ab8a16613814e226b6d20d98010ab1ace49fa76dce337a5a5f1dcff9e5d533b12475e33b971b15b69cd591cd9059759f0f04ba5468a34b98915033debb3e87f048e8601712659d47d8687eb6be5e650068d88000000000000") preadv(r1, &(0x7f0000000000), 0x0, 0x2) 12:33:44 executing program 3: r0 = socket$inet6(0xa, 0x400000000001, 0x0) r1 = dup(r0) setsockopt$inet6_tcp_int(r1, 0x6, 0x20000000000002, &(0x7f00007b1000)=0x81, 0x4) bind$inet6(r0, &(0x7f00000000c0)={0xa, 0x4e20}, 0x1c) setsockopt$inet6_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000440)='vegas\x00', 0x6) sendto$inet6(r0, &(0x7f0000e77fff), 0x2bd, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) listen(0xffffffffffffffff, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r1, &(0x7f00000001c0)={0x0, 0x18, 0xfa00, {0x1, &(0x7f0000000180)={0xffffffffffffffff}, 0x2}}, 0x20) write$RDMA_USER_CM_CMD_SET_OPTION(r1, &(0x7f0000000200)={0xe, 0x18, 0xfa00, @id_tos={&(0x7f0000000000)=0xfffffffffffffff8, r2, 0x0, 0x0, 0x1}}, 0x20) clone(0x0, &(0x7f0000000240), &(0x7f0000000100), &(0x7f0000000140), &(0x7f0000000180)) r3 = open(&(0x7f0000000040)='./bus\x00', 0x141042, 0x0) ftruncate(r3, 0x7fff) sendfile(r1, r3, &(0x7f0000d83ff8), 0x8000fffffffe) ioctl$EVIOCSABS20(r1, 0x401845e0, &(0x7f0000000080)={0x81, 0x7, 0x0, 0x0, 0x7, 0x93b6}) [ 447.248753] binder: 23444:23473 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 12:33:44 executing program 1: preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f0000000180)=""/148, 0x13d}], 0x1, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000340)="696f001b66408225aaa3af068fffebb8a490c47dda6586f1b58895b94a78037dd3714e7198820a7a709e2d30d25e6d846cd5c62a648a598668a8263b752b0b622b115112b5ad8e0425c0b784bbdb89eb8f4da0dd73dd01fe35694c2f78600badf8a0e237dba40713bac9e053b41a9f62be5fbb928018aab5f7500bef51a2fd74d4fffb4a20a946733820bdc1b485afa417cdbcfdfbc54f58c9c3edffe240c36f4ab8a16613814e226b6d20d98010ab1ace49fa76dce337a5a5f1dcff9e5d533b12475e33b971b15b69cd591cd9059759f0f04ba5468a34b98915033debb3e87f048e8601712659d47d8687eb6be5e650068d88000000000000") preadv(r0, &(0x7f0000000000), 0x0, 0xe) 12:33:44 executing program 5: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) preadv(r0, &(0x7f0000000040)=[{&(0x7f0000000180)=""/148, 0x94}], 0x0, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000340)="696f001b66408225aaa3af068fffebb8a490c47dda6586f1b58895b94a78037dd3714e7198820a7a709e2d30d25e6d846cd5c62a648a598668a8263b752b0b622b115112b5ad8e0425c0b784bbdb89eb8f4da0dd73dd01fe35694c2f78600badf8a0e237dba40713bac9e053b41a9f62be5fbb928018aab5f7500bef51a2fd74d4fffb4a20a946733820bdc1b485afa417cdbcfdfbc54f58c9c3edffe240c36f4ab8a16613814e226b6d20d98010ab1ace49fa76dce337a5a5f1dcff9e5d533b12475e33b971b15b69cd591cd9059759f0f04ba5468a34b98915033debb3e87f048e8601712659d47d8687eb6be5e650068d88000000000000") preadv(r1, &(0x7f0000000480), 0x10000000000002a1, 0x0) 12:33:44 executing program 1: preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f0000000180)=""/148, 0x13d}], 0x1, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000340)="696f001b66408225aaa3af068fffebb8a490c47dda6586f1b58895b94a78037dd3714e7198820a7a709e2d30d25e6d846cd5c62a648a598668a8263b752b0b622b115112b5ad8e0425c0b784bbdb89eb8f4da0dd73dd01fe35694c2f78600badf8a0e237dba40713bac9e053b41a9f62be5fbb928018aab5f7500bef51a2fd74d4fffb4a20a946733820bdc1b485afa417cdbcfdfbc54f58c9c3edffe240c36f4ab8a16613814e226b6d20d98010ab1ace49fa76dce337a5a5f1dcff9e5d533b12475e33b971b15b69cd591cd9059759f0f04ba5468a34b98915033debb3e87f048e8601712659d47d8687eb6be5e650068d88000000000000") fsetxattr$trusted_overlay_upper(r0, &(0x7f0000000040)='trusted.overlay.upper\x00', &(0x7f0000000080)={0x0, 0xfb, 0x1b, 0x2, 0x7, "749858f6c48f2df0f0cd8bbe896ddded", "fb082de5d7e6"}, 0x1b, 0x3) preadv(r0, &(0x7f0000000480), 0x10000000000002a1, 0x0) ioctl$KDSETKEYCODE(r0, 0x4b4d, &(0x7f0000000000)={0x2189, 0x5}) 12:33:44 executing program 2: perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f0000000180)=""/148, 0x13d}], 0x1, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000340)="696f001b66408225aaa3af068fffebb8a490c47dda6586f1b58895b94a78037dd3714e7198820a7a709e2d30d25e6d846cd5c62a648a598668a8263b752b0b622b115112b5ad8e0425c0b784bbdb89eb8f4da0dd73dd01fe35694c2f78600badf8a0e237dba40713bac9e053b41a9f62be5fbb928018aab5f7500bef51a2fd74d4fffb4a20a946733820bdc1b485afa417cdbcfdfbc54f58c9c3edffe240c36f4ab8a16613814e226b6d20d98010ab1ace49fa76dce337a5a5f1dcff9e5d533b12475e33b971b15b69cd591cd9059759f0f04ba5468a34b98915033debb3e87f048e8601712659d47d8687eb6be5e650068d88000000000000") preadv(r0, &(0x7f0000000480), 0x1000000000000009, 0x0) msgget$private(0x0, 0x22) 12:33:45 executing program 5: preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f0000000180)=""/148, 0xfffffffffffffdbd}], 0x1, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000340)="696f001b66408225aaa3af068fffebb8a490c47dda6586f1b58895b94a78037dd3714e7198820a7a709e2d30d25e6d846cd5c62a648a598668a8263b752b0b622b115112b5ad8e0425c0b784bbdb89eb8f4da0dd73dd01fe35694c2f78600badf8a0e237dba40713bac9e053b41a9f62be5fbb928018aab5f7500bef51a2fd74d4fffb4a20a946733820bdc1b485afa417cdbcfdfbc54f58c9c3edffe240c36f4ab8a16613814e226b6d20d98010ab1ace49fa76dce337a5a5f1dcff9e5d533b12475e33b971b15b69cd591cd9059759f0f04ba5468a34b98915033debb3e87f048e8601712659d47d8687eb6be5e650068d88000000000000") preadv(r0, &(0x7f0000000680)=[{&(0x7f0000000000)=""/129, 0x81}, {&(0x7f0000000800)=""/148, 0xd}, {&(0x7f0000000240)=""/205, 0xcd}, {&(0x7f0000000440)=""/34, 0x22}, {&(0x7f0000000700)=""/212, 0xd4}, {&(0x7f0000000580)=""/81, 0x51}, {&(0x7f0000000600)=""/80, 0x50}], 0x63, 0x0) 12:33:45 executing program 0: syz_open_dev$sndctrl(&(0x7f0000000140)='/dev/snd/controlC#\x00', 0x0, 0x0) sched_setaffinity(0x0, 0x7, &(0x7f00000000c0)=0x9) r0 = perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0) fcntl$setflags(r0, 0x2, 0x1) getsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER_VALUE(0xffffffffffffffff, 0x84, 0x7c, &(0x7f00000001c0), &(0x7f0000000240)=0x8) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(0xffffffffffffffff, 0x84, 0x9, &(0x7f0000000280)={0x0, @in={{0x2, 0x4e23, @remote}}, 0xfffffffffffffff7, 0x0, 0x0, 0x97df, 0xc1}, 0x98) sendto$inet6(0xffffffffffffffff, &(0x7f00000004c0), 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) setsockopt$SO_BINDTODEVICE(0xffffffffffffffff, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x4) socket$inet6(0xa, 0x1000000000002, 0x0) r1 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x4, 0x0, &(0x7f0000000100)=[@enter_looper], 0x1, 0x0, &(0x7f0000000180)='T'}) r2 = gettid() timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, &(0x7f0000040000)) tkill(r2, 0x1004000000016) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0xfffffffffffffced, 0x0, &(0x7f0000000040)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x400c630f}], 0x0, 0x0, &(0x7f0000000f4d)}) 12:33:45 executing program 1: preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f0000000180)=""/148, 0x13d}], 0x1, 0x0) ioctl$sock_SIOCGPGRP(0xffffffffffffff9c, 0x8904, &(0x7f0000000080)=0x0) r1 = syz_open_procfs(r0, &(0x7f0000000140)='net/ptype\x00') socketpair$inet6_udp(0xa, 0x2, 0x0, &(0x7f00000000c0)) ioctl$TIOCSLCKTRMIOS(r1, 0x5457, &(0x7f0000000000)) ioctl$EXT4_IOC_SWAP_BOOT(r1, 0x6611) preadv(r1, &(0x7f0000000480), 0x10000000000002a1, 0x0) ioctl$BLKBSZSET(r1, 0x40081271, &(0x7f0000000040)) 12:33:45 executing program 3: r0 = socket$inet6(0xa, 0x400000000001, 0x0) r1 = dup(r0) setsockopt$inet6_tcp_int(r1, 0x6, 0x20000000000002, &(0x7f00007b1000)=0x81, 0x4) bind$inet6(r0, &(0x7f00000000c0)={0xa, 0x4e20}, 0x1c) fcntl$getownex(r0, 0x10, &(0x7f00000001c0)) setsockopt$inet6_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000440)='vegas\x00', 0x6) sendto$inet6(r0, &(0x7f0000e77fff), 0x2bd, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) listen(0xffffffffffffffff, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) pipe2$9p(&(0x7f0000000180), 0x4000) clone(0x0, &(0x7f0000000240), &(0x7f0000000100), &(0x7f0000000140), &(0x7f0000000180)) syz_open_dev$midi(&(0x7f0000000000)='/dev/midi#\x00', 0x2, 0x400000) r2 = open(&(0x7f0000000040)='./bus\x00', 0x141042, 0x0) ftruncate(r2, 0x7fff) sendfile(r1, r2, &(0x7f0000d83ff8), 0x8000fffffffe) ioctl$EVIOCSABS20(r1, 0x401845e0, &(0x7f0000000080)={0x81, 0x7, 0x0, 0x0, 0x7, 0x93b6}) 12:33:45 executing program 4: socket$inet6(0xa, 0x0, 0x80000000) syz_open_dev$sndctrl(&(0x7f0000000140)='/dev/snd/controlC#\x00', 0x9, 0x400000) sched_setaffinity(0x0, 0x7, &(0x7f00000000c0)=0x9) fcntl$setflags(0xffffffffffffffff, 0x2, 0x1) r0 = socket$inet6(0xa, 0x400000000001, 0x0) r1 = dup(r0) setsockopt$inet6_tcp_int(r1, 0x6, 0x12, &(0x7f0000000000)=0x7f, 0x4) bind$inet6(r0, &(0x7f0000000040)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) getsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER_VALUE(r0, 0x84, 0x7c, &(0x7f00000001c0)={0x0, 0x100000001, 0x6}, &(0x7f0000000240)=0x8) sendto$inet6(r0, &(0x7f00000004c0), 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x4) socket$inet6(0xa, 0x1000000000002, 0x0) r2 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000200)={0x4, 0x0, &(0x7f0000000100)=[@enter_looper], 0x1, 0x0, &(0x7f0000000180)='T'}) r3 = gettid() timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, &(0x7f0000040000)) tkill(r3, 0x1004000000016) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0xfffffffffffffced, 0x0, &(0x7f0000000040)}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x400c630f}], 0x0, 0x0, &(0x7f0000000f4d)}) 12:33:45 executing program 2: perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f0000000180)=""/148, 0x13d}], 0x1, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000340)="696f001b66408225aaa3af068fffebb8a490c47dda6586f1b58895b94a78037dd3714e7198820a7a709e2d30d25e6d846cd5c62a648a598668a8263b752b0b622b115112b5ad8e0425c0b784bbdb89eb8f4da0dd73dd01fe35694c2f78600badf8a0e237dba40713bac9e053b41a9f62be5fbb928018aab5f7500bef51a2fd74d4fffb4a20a946733820bdc1b485afa417cdbcfdfbc54f58c9c3edffe240c36f4ab8a16613814e226b6d20d98010ab1ace49fa76dce337a5a5f1dcff9e5d533b12475e33b971b15b69cd591cd9059759f0f04ba5468a34b98915033debb3e87f048e8601712659d47d8687eb6be5e650068d88000000000000") preadv(r0, &(0x7f0000000480), 0x1000000000000167, 0x0) msgget$private(0x0, 0x22) 12:33:45 executing program 5: preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f0000000180)=""/148, 0x13d}], 0x1, 0x0) r0 = syz_open_dev$adsp(&(0x7f0000000000)='/dev/adsp#\x00', 0x2, 0x8002) r1 = syz_genetlink_get_family_id$nbd(&(0x7f0000000080)='nbd\x00') r2 = openat$vcs(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/vcs\x00', 0x0, 0x0) sendmsg$NBD_CMD_RECONFIGURE(r0, &(0x7f0000000280)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x8}, 0xc, &(0x7f0000000240)={&(0x7f0000000100)={0x4c, r1, 0x602, 0x70bd2d, 0x25dfdbfe, {}, [@NBD_ATTR_CLIENT_FLAGS={0xc, 0x6, 0x3}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_SOCKETS={0xc, 0x7, [{0x8, 0x1, r2}]}, @NBD_ATTR_TIMEOUT={0xc, 0x4, 0x76}, @NBD_ATTR_BLOCK_SIZE_BYTES={0xc, 0x3, 0x8}]}, 0x4c}, 0x1, 0x0, 0x0, 0x880}, 0x4000001) r3 = syz_open_procfs(0x0, &(0x7f0000000340)="696f001b66408225aaa3af068fffebb8a490c47dda6586f1b58895b94a78037dd3714e7198820a7a709e2d30d25e6d846cd5c62a648a598668a8263b752b0b622b115112b5ad8e0425c0b784bbdb89eb8f4da0dd73dd01fe35694c2f78600badf8a0e237dba40713bac9e053b41a9f62be5fbb928018aab5f7500bef51a2fd74d4fffb4a20a946733820bdc1b485afa417cdbcfdfbc54f58c9c3edffe240c36f4ab8a16613814e226b6d20d98010ab1ace49fa76dce337a5a5f1dcff9e5d533b12475e33b971b15b69cd591cd9059759f0f04ba5468a34b98915033debb3e87f048e8601712659d47d8687eb6be5e650068d88000000000000") preadv(r3, &(0x7f0000000480), 0x10000000000002a1, 0x0) 12:33:45 executing program 1: preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f0000000180)=""/148, 0x13d}], 0x1, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000340)="696f001b66408225aaa3af068fffebb8a490c47dda6586f1b58895b94a78037dd3714e7198820a7a709e2d30d25e6d846cd5c62a648a598668a8263b752b0b622b115112b5ad8e0425c0b784bbdb89eb8f4da0dd73dd01fe35694c2f78600badf8a0e237dba40713bac9e053b41a9f62be5fbb928018aab5f7500bef51a2fd74d4fffb4a20a946733820bdc1b485afa417cdbcfdfbc54f58c9c3edffe240c36f4ab8a16613814e226b6d20d98010ab1ace49fa76dce337a5a5f1dcff9e5d533b12475e33b971b15b69cd591cd9059759f0f04ba5468a34b98915033debb3e87f048e8601712659d47d8687eb6be5e650068d88000000000000") preadv(r0, &(0x7f0000000480), 0x10000000000002a1, 0x0) r1 = semget$private(0x0, 0x4, 0x200) semctl$GETNCNT(r1, 0x0, 0xe, &(0x7f0000000000)=""/10) [ 447.920162] binder: BINDER_SET_CONTEXT_MGR already set [ 447.948046] binder: 23528:23529 ioctl 40046207 0 returned -16 12:33:45 executing program 0: syz_open_dev$sndctrl(&(0x7f0000000140)='/dev/snd/controlC#\x00', 0x0, 0x0) sched_setaffinity(0x0, 0x7, &(0x7f00000000c0)=0x9) r0 = perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0) fcntl$setflags(r0, 0x2, 0x1) getsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER_VALUE(0xffffffffffffffff, 0x84, 0x7c, &(0x7f00000001c0), &(0x7f0000000240)=0x8) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(0xffffffffffffffff, 0x84, 0x9, &(0x7f0000000280)={0x0, @in={{0x2, 0x4e23, @remote}}, 0xfffffffffffffff7, 0x0, 0x0, 0x97df, 0xc1}, 0x98) sendto$inet6(0xffffffffffffffff, &(0x7f00000004c0), 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) setsockopt$SO_BINDTODEVICE(0xffffffffffffffff, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x4) socket$inet6(0xa, 0x1000000000002, 0x0) r1 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x4, 0x0, &(0x7f0000000100)=[@enter_looper], 0x1, 0x0, &(0x7f0000000180)='T'}) r2 = gettid() timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, &(0x7f0000040000)) tkill(r2, 0x1004000000016) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0xfffffffffffffced, 0x0, &(0x7f0000000040)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x400c630f}], 0x0, 0x0, &(0x7f0000000f4d)}) 12:33:45 executing program 2: perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f0000000180)=""/148, 0x13d}], 0x1, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000340)="696f001b66408225aaa3af068fffebb8a490c47dda6586f1b58895b94a78037dd3714e7198820a7a709e2d30d25e6d846cd5c62a648a598668a8263b752b0b622b115112b5ad8e0425c0b784bbdb89eb8f4da0dd73dd01fe35694c2f78600badf8a0e237dba40713bac9e053b41a9f62be5fbb928018aab5f7500bef51a2fd74d4fffb4a20a946733820bdc1b485afa417cdbcfdfbc54f58c9c3edffe240c36f4ab8a16613814e226b6d20d98010ab1ace49fa76dce337a5a5f1dcff9e5d533b12475e33b971b15b69cd591cd9059759f0f04ba5468a34b98915033debb3e87f048e8601712659d47d8687eb6be5e650068d88000000000000") preadv(r0, &(0x7f0000000480), 0x1000000000000099, 0x0) msgget$private(0x0, 0x22) [ 448.003185] binder: 23528:23529 Acquire 1 refcount change on invalid ref 0 ret -22 [ 448.065691] binder: 23528:23537 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 12:33:45 executing program 3: r0 = socket$inet6(0xa, 0x400000000001, 0x0) r1 = dup(r0) setsockopt$inet6_tcp_int(r1, 0x6, 0x20000000000002, &(0x7f00007b1000)=0x81, 0x4) bind$inet6(r0, &(0x7f00000000c0)={0xa, 0x4e20}, 0x1c) setsockopt$inet6_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000440)='vegas\x00', 0x6) sendto$inet6(r0, &(0x7f0000e77fff), 0x0, 0x20000008, &(0x7f0000000300)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) ioctl$PPPIOCGFLAGS(r1, 0x8004745a, &(0x7f0000000000)) listen(0xffffffffffffffff, 0x0) r2 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) clone(0x0, &(0x7f0000000240), &(0x7f0000000100), &(0x7f0000000140), &(0x7f0000000180)) r3 = open(&(0x7f0000000040)='./bus\x00', 0x141042, 0x0) ftruncate(r3, 0x7fff) sendfile(r1, r3, &(0x7f0000d83ff8), 0x8000fffffffe) ioctl$EVIOCSABS20(r1, 0x401845e0, &(0x7f0000000080)={0x81, 0x7, 0x0, 0x0, 0x7, 0x93b6}) r4 = syz_genetlink_get_family_id$team(&(0x7f00000001c0)='team\x00') getsockopt$inet_pktinfo(r3, 0x0, 0x8, &(0x7f0000000200)={0x0, @rand_addr, @rand_addr}, &(0x7f0000000240)=0xc) getsockopt$inet6_mreq(r3, 0x29, 0x1c, &(0x7f0000000280)={@ipv4={[], [], @multicast2}, 0x0}, &(0x7f00000002c0)=0x14) getsockopt$inet_mreqn(r1, 0x0, 0x23, &(0x7f00000003c0)={@remote, @broadcast, 0x0}, &(0x7f0000000400)=0xc) getsockopt$inet_mreqn(r3, 0x0, 0x23, &(0x7f0000001ec0)={@multicast1, @empty, 0x0}, &(0x7f0000001f00)=0xc) getsockopt$inet6_IPV6_IPSEC_POLICY(r0, 0x29, 0x22, &(0x7f0000001f40)={{{@in6=@mcast2, @in=@dev, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6}, 0x0, @in=@rand_addr}}, &(0x7f0000002040)=0xe8) getsockopt$inet_mreqn(r3, 0x0, 0x23, &(0x7f0000002080)={@dev, @multicast2, 0x0}, &(0x7f00000020c0)=0xc) getsockopt$inet_IP_IPSEC_POLICY(r3, 0x0, 0x10, &(0x7f0000002100)={{{@in=@broadcast, @in6=@local, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@ipv4={[], [], @multicast1}}, 0x0, @in6=@ipv4}}, &(0x7f0000002200)=0xe8) getpeername(r3, &(0x7f0000002240)=@xdp={0x2c, 0x0, 0x0}, &(0x7f00000022c0)=0x80) recvmsg$kcm(r1, &(0x7f0000002540)={&(0x7f0000002300)=@can={0x1d, 0x0}, 0x80, &(0x7f00000024c0)=[{&(0x7f0000002380)=""/220, 0xdc}, {&(0x7f0000002480)=""/10, 0xa}], 0x2, &(0x7f0000002500)=""/41, 0x29, 0x10000}, 0x100) recvmmsg(r3, &(0x7f0000004c40)=[{{0x0, 0x0, &(0x7f00000036c0)=[{&(0x7f0000002580)=""/4096, 0x1000}, {&(0x7f0000003580)=""/153, 0x99}, {&(0x7f0000003640)=""/89, 0x59}], 0x3, &(0x7f0000003700)=""/109, 0x6d, 0x93}, 0x73}, {{&(0x7f0000003780)=@xdp={0x2c, 0x0, 0x0}, 0x80, &(0x7f0000003940)=[{&(0x7f0000003800)=""/88, 0x58}, {&(0x7f0000003880)=""/159, 0x9f}], 0x2, &(0x7f0000003980)=""/218, 0xda, 0x5}, 0x8}, {{0x0, 0x0, &(0x7f0000004b80)=[{&(0x7f0000003a80)=""/4096, 0x1000}, {&(0x7f0000004a80)=""/148, 0x94}, {&(0x7f0000004b40)=""/38, 0x26}], 0x3, &(0x7f0000004bc0)=""/84, 0x54, 0x8000}, 0x3}], 0x3, 0x40, &(0x7f0000004d00)) getsockname$packet(r1, &(0x7f0000006380)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @remote}, &(0x7f00000063c0)=0x14) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000006440)={'tunl0\x00', 0x0}) getpeername$packet(r2, &(0x7f0000006480)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000064c0)=0x14) recvmmsg(r0, &(0x7f000000a480)=[{{&(0x7f0000006800)=@alg, 0x80, &(0x7f0000006980)=[{&(0x7f0000006880)=""/247, 0xf7}], 0x1, 0x0, 0x0, 0x5}, 0x7}, {{&(0x7f00000069c0)=@nfc_llcp, 0x80, &(0x7f0000007e00)=[{&(0x7f0000006a40)}, {&(0x7f0000006a80)=""/152, 0x98}, {&(0x7f0000006b40)=""/202, 0xca}, {&(0x7f0000006c40)=""/149, 0x95}, {&(0x7f0000006d00)=""/202, 0xca}, {&(0x7f0000006e00)=""/4096, 0x1000}], 0x6, &(0x7f0000007e80)=""/224, 0xe0, 0x40}, 0x3}, {{&(0x7f0000007f80)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @rand_addr}}}, 0x80, &(0x7f0000009440)=[{&(0x7f0000008000)=""/80, 0x50}, {&(0x7f0000008080)=""/4096, 0x1000}, {&(0x7f0000009080)=""/254, 0xfe}, {&(0x7f0000009180)=""/76, 0x4c}, {&(0x7f0000009200)=""/35, 0x23}, {&(0x7f0000009240)=""/61, 0x3d}, {&(0x7f0000009280)=""/177, 0xb1}, {&(0x7f0000009340)=""/3, 0x3}, {&(0x7f0000009380)=""/188, 0xbc}], 0x9, &(0x7f0000009500)=""/98, 0x62, 0x3ff}, 0xffffffffffff8001}, {{&(0x7f0000009580)=@llc={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @broadcast}, 0x80, &(0x7f0000009940)=[{&(0x7f0000009600)=""/39, 0x27}, {&(0x7f0000009640)=""/118, 0x76}, {&(0x7f00000096c0)=""/33, 0x21}, {&(0x7f0000009700)=""/69, 0x45}, {&(0x7f0000009780)=""/251, 0xfb}, {&(0x7f0000009880)=""/153, 0x99}], 0x6, &(0x7f00000099c0)=""/116, 0x74, 0x1e8}, 0x5}, {{&(0x7f0000009a40)=@can, 0x80, &(0x7f0000009cc0)=[{&(0x7f0000009ac0)=""/120, 0x78}, {&(0x7f0000009b40)=""/199, 0xc7}, {&(0x7f0000009c40)=""/124, 0x7c}], 0x3, 0x0, 0x0, 0x3}, 0x7fffffff}, {{&(0x7f0000009d00)=@hci={0x1f, 0x0}, 0x80, &(0x7f000000a380)=[{&(0x7f0000009d80)=""/102, 0x66}, {&(0x7f0000009e00)=""/105, 0x69}, {&(0x7f0000009e80)=""/174, 0xae}, {&(0x7f0000009f40)=""/87, 0x57}, {&(0x7f0000009fc0)=""/51, 0x33}, {&(0x7f000000a000)=""/210, 0xd2}, {&(0x7f000000a100)=""/181, 0xb5}, {&(0x7f000000a1c0)=""/70, 0x46}, {&(0x7f000000a240)=""/74, 0x4a}, {&(0x7f000000a2c0)=""/180, 0xb4}], 0xa, &(0x7f000000a440)=""/16, 0x10, 0x2}, 0x81}], 0x6, 0x10022, &(0x7f000000a600)={0x77359400}) getpeername$packet(r3, &(0x7f000000bac0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f000000bb00)=0x14) sendmsg$TEAM_CMD_OPTIONS_GET(r1, &(0x7f000000c200)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f000000c1c0)={&(0x7f0000000480)=ANY=[@ANYBLOB="78060000", @ANYRES16=r4, @ANYBLOB="00032cbd7000fddbdf250200000008000100", @ANYRES32=r5, @ANYBLOB="540102003800010024000100616374697665706f727400000000000000000000000000000000000000000000080003000300000008000400", @ANYRES32=r6, @ANYBLOB="38000100240001006e6f746966795f70656572735f636f756e7400000000000000000000000000000800030003000000080004000900000038000100240001006e6f746966795f70656572735f636f756e7400000000000000000000000000000800030003000000080004000600000038000100240001006d636173745f72656a6f696e5f696e74657276616c0000000000000000000000080003000300000008000400ffffffff38000100240001006d636173745f72656a6f696e5f636f756e740000000000000000000000000000080003000300000008000400010000003800010024000100616374697665706f727400000000000000000000000000000000000000000000080003000300000008000400", @ANYRES32=r7, @ANYBLOB="ecd5063c9d3dec14bbf089f7ab13b702a016f3", @ANYRES32=r8, @ANYBLOB="ac0002003800010024000100616374697665706f727400000000000000000000000000000000000000000000080003000300000008000400", @ANYRES32=r9, @ANYBLOB="38000100240001006e6f746966795f70656572735f636f756e740000000000000000000000000000080003000300000008000400150e00003800010024000100616374697665706f727400000000000000000000000000000000000000000000080003000300000008000400", @ANYRES32=r10, @ANYBLOB="08000100", @ANYRES32=r11, @ANYBLOB="f00002003800010024000100616374697665706f727400000000000000000000000000000000000000000000080003000300000008000400", @ANYRES32=r12, @ANYBLOB="3c000100240001006270665f686173685f66756e6300000000000000000000000000000000000000080003000b0000000c00040006000608010001003c000100240001006d6f64650000000000000000000000000000000000000000000000000000000008000300050000000c00040072616e646f6d00003c00010024000100656e61626c65640000000000000000000000000000000000000000000000000008000300060000000400040008000600", @ANYRES32=r13, @ANYBLOB="08000100", @ANYRES32=r14, @ANYBLOB="f801020040000100240001006c625f706f72745f737461747300000000000000000000000000000000000000080003000b000000080004000000000008000600", @ANYRES32=r15, @ANYBLOB="40000100240001007072696f72697479000000000000000000000000000000000000000000000000080003000e000000080004000200000008000600", @ANYRES32=r16, @ANYBLOB="38000100240001006c625f73746174735f726566726573685f696e74657276616c000000000000000800030003000000080004009808000040000100240001006d6f6465000000000000000000000000000000000000000000000000000000000800030005000000100004006c6f616462616c616e63650040000100240001006c625f706f72745f737461747300000000000000000000000000000000000000080003000b000000080004000600000008000600", @ANYRES32=r17, @ANYBLOB="84000100240001006270665f686173685f66756e6300000000000000000000000000000000000000080003000b0000005400040004000500bd0000002a053c00010000800600000438050000060007051200000000000905020000000001050057ba8877d90706ffedffffff05000001080000004c00000504000000b400c9000000000038000100240001006d636173745f72656a6f696e5f696e74657276616c00000000000000000000000800030003000000080004000100000008000100", @ANYRES32=r18, @ANYBLOB="5401020040000100240001007072696f72697479000000000000000000000000000000000000000000000000080003000e00000008000400401c000008000600", @ANYRES32=r19, @ANYBLOB="38000100240001006d636173745f72656a6f696e5f696e74657276616c0000000000000000000000080003000300000008000400020000003c000100240001006c625f74785f6d6574686f64000000000000000000000000000000000000000008000300050000000c000400686173680000000064000100240001006270665f686173685f66756e6300000000000000000000000000000000000000080003000b0000003400040000000905ffffff7f08000601f9ffffff05000804bd0f00000000800704000000ff03060501000000000001010002000038000100240001006e6f746966795f70656572735f636f756e74000000000000000000000000000008000300030000000800040000010000"], 0x678}, 0x1, 0x0, 0x0, 0x800}, 0x4040010) 12:33:45 executing program 5: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000140)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) preadv(r0, &(0x7f0000001380)=[{&(0x7f0000000080)=""/148, 0x94}], 0x1, 0x0) r1 = bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000040)={&(0x7f0000000000)=']systemnodev#ppp1-\'[em0$md5sum\x00', 0xffffffffffffff9c}, 0x10) r2 = openat$audio(0xffffffffffffff9c, &(0x7f0000000180)='/dev/audio\x00', 0x64002, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) r4 = getpgid(0xffffffffffffffff) syz_open_procfs(r4, &(0x7f00000001c0)='net/netfilter\x00') r5 = memfd_create(&(0x7f0000000200)='/dev/audio\x00', 0x4) getsockopt$inet6_IPV6_XFRM_POLICY(r2, 0x29, 0x23, &(0x7f0000000240)={{{@in6=@dev, @in=@multicast2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@mcast1}, 0x0, @in=@dev}}, &(0x7f0000000440)=0xe8) lstat(&(0x7f0000000480)='./file0\x00', &(0x7f00000004c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) write$P9_RGETATTR(r2, &(0x7f0000000540)={0xa0, 0x19, 0x2, {0x0, {0x42, 0x0, 0x2}, 0x1a1, r6, r7, 0x5, 0x400, 0x4, 0x4, 0x6, 0x80000001, 0x0, 0xed14, 0xfff, 0x100000000, 0x9, 0x1, 0x4, 0x1a, 0x2}}, 0xa0) r8 = dup3(r1, r3, 0x80000) getsockopt$inet_sctp6_SCTP_GET_LOCAL_ADDRS(r5, 0x84, 0x6d, &(0x7f00000013c0)={0x0, 0x1000, "ec467e562c3b1d0fd22926e6f85d79e1e62f6fb72aa4afc579c14c7e239778774f73ebbe0a8448c080257e08260150caa0e4c99f60b56e81d2f28aa09da3ed51fee18d7ec2e4cd2df55a241e5238fa06ddad2fd77ef2181dbe02dcd5a15b4053d91d5650f9d27363652cfcf36b6276102088253fd5e3260c49c75fbdede45bc8850cc530f035b9bc9025aaccba98849e37820e05c356975f9478132eda389051c7d0534ddec9d8187b9b04efbe15c4c7be140e1e2f45631718b2adc4f474c8641224709fe48d3248cb1c747a177ea397593ce20f3fe24b2612d50ecc050c03671ad9c44d215d88ac171060cb2ff51949d95f54fd7ac810dcc07a787a58ab0b9c59f86a8c09ebdbe9d81aa5c2d5a978b753bcbc3a1a37159cb35912ca550df10b4332a20fad1bc37d74a2f68033155f607c1771641030b33df5432d692c2d48ae0bf2c2472d39af6d99f2aff161d125f9a902effc25f413358984a3e17e4a92dc35a81bf2d30e3e0d55ab7ca110a97879fe9f0952d248e3813579810748f981de29d213c3a7e82fb390eef1dcd9dfe8cf8261e0d3ea37895d246762b445cd179d906d33266abe41026754711d4654c183933299d62ab391e9b3b53626bdb967c0d1ba675b3e5d91f15d5c40f5300723728abf68159443d8b12f1e37c397a33dce59ae1e193dfdecafbc18d7fffbb6e096fd7383b743360d6436623539efecd7276092b0e446e1057cee008b030609406423f96a1b0757f4eef3c19fe43aa4dccb5f61ef6fcce62c7c878f6657db8e2e80b04b66b35e0f052e1f7ebadd6f49ca504e29be31dfd94b575f0061e768d9a0d70cc18e1c89d4d5c452711cb14a71fc113f27581c384303e55faf6a9c3ff82c790ba460459682d3b7cfa12a9f388921c7ede95d13d71b0863a7b481a80899c322c2f3717478156a02a51b8e8f80c630e7b00fdfa2b7b8657eb74886b4ed3fd4f44abf45b21982dc00044329137986a79ba1ea8293a99d17f615afa8a18933ca8848f6f93c3e6569dab9bc192eda8bd0a87e50ef594b4d0069d7d9eaf15b1b42755068b3e270d45d8128cf47b1378b07a76650c061811b4f89003a52f44eb3b4963c6eb0df2aaaf81e2e9bc47f78cf6d538894994fa9399fc00a673bb662dd3c350742712f51170c3f52965b6b64def5485975998711e7bb1d3f7f4aead28893a3b0a32638f9efb50cd2d87ab9927475facf774e970765beaddff734f15ac2284fcdfc6173534edfb63f717ac0a930036fabaeb40d605a00485ac6215eb597e99dde5e4e6d448a58fea6d41eaed55147cf15853a9fad288303f5550df060a5c0d9e99f0c0597caeeee035b2a05ff7f1c099c66b119c0579031ac81e43abdf100a53baa3c55db8c1f4c7097b6f19a0b12f45a5cb9a1256e18fac9ab99f30dc25a530a5f23da91d4aa25d1398e30bf72b9d3e3848f1da1b2d7c4d599ec8d06f90f9bda0027eb151204023f366110adb6738551a3c9ef3dbb9c557a6f91f4879b41f812f1a92d9382ebcfdf422ad259a0ab95e3265cae2d3dc7c957299557224574f3bcdd2ddcbe1f4cf28074b839d6aab0f33560876d19ff6ca30c5ddb81c2d3d999f43a9355effc53b16f7edb6e95368d88b1bd6b2e5980cb6745a5c9554fd8b0b4ba1162121d66891fc715a391a77fe838c79c902e4690e1b8ff07bb878776285490a3a2c37482edd575110657615db6000142bc45489ab04d9e6ef769fd2bf827adfdab489c940f5fd2d7211cc3deb8ed8f98bd1470e4f0c700f13fbe8b5e2ed5e7ccd032b68f71bd16583a19b93da90a62ea01db93f653626e58ee7b70936704922937a9a07db2db07ffad6514ae95b0855d93d0892c081ab1e8d7eb43783ebc7b4be00854a7965611949d6b7f5744bf48024af47b94ecc3a8ca3386ee9c15fcfe9708cc838abfef989edbcde22aecdb447d3eaef80ea94c2dd26907ed8b40ed61e640b118121d9a3fd1dc53502f26622d8e8a3c8f8fbc5e18aa343e4cd16c95ca22edbc4666bf1dfda1112d3345210a2a549973fad983c89f11ff761a3b2398dbeed5891efc9cb49079c14efcfd71f8cbdf3ba9293230cccda902601989ad84fc63b50f932851f0bf182fa19a019ba3d5610b0ca39cdd6a25f335d7b4ad7c974cde05029ec9e3979b1fa0150fd22e435a226c7e5a3a93661223489bbe791793aa6fef99a682e557be985dedfb8c9c036a4442f70130af5e5dec396b571453d05ac2b26f5da87879b168da72f6566c991835ec06766ca15f01aa87aa2ed9ab4e1e6cdddcc926b9bdfd37faf3f9a86ff8808eb5a97e5a4f9589852ce1c7f2c5c7dc6b6854c0fd10e8828ee316be601092912ad57d6cb4679809d0c563ef91283953d7bb1dbf7b5e9ca0437d8edef7674fbb26d11afa0d30174693f83472a838dee75730589346cb043d584ad620cb2e58f9625bef888aa0a8116cfa8322d59666325e352aa67ce3a04ba9189897a7125e4267910f8f5e8f9795886e7e7a4bb556b5377428732dbca47fc985dd569de54334dc0c4c928081e29f57a6278c3727bfe6fce6e10147100977197aa9f9757a19d566b5383356cf83c5b6025b19f4b34a01168dde8c118f81367e09fd4a0f02e36818d623534d6f796af12665d1242b5466e967a396e829b8b73cc341e8d8e40e38204870d21d882716ebb36a8760ac0221b73855273036579436eb408f5ca24a24703cf180c917c2d15a79278ffd1d8cdd72332925030a792da73b45bb3350713c9ecc37b1ab3f0766d4c96c2bf3f466e7c3f254a5bafcc9b52260db5e5f847d5b260629663c92f8d6a660376161b88f3f39137401a624df7aedc04bb34837c4f4bc9bc4b963dbfc4a7fe76469033cdc812f24d7764f7c8c38a7b6a1c49c55e0aa4eab6e01f7f55cb57e3f9f187a35c13209662a492e34125b60a6a224fd30f29e22a60f133214ddb37a7a9433a7fa767c8b76496084478f9cf4589d5cb59889ac0c23307a697bb5756b55bdaac6a74ec16e1a75ed36e50b990b073638ff678576d367c1dd294e3cdb00d882bb006b8e7d27b9eef2b87447c073d9aef72464174764af3985d68f9343cea24254e32cfc0dd7df999af942c92babcd707dfc9636c1ca78aa96c7620c24b451691f66816fdd197a965d6a693c3e61c8c3149bec74f49c6d70aff44f864ee10328ce232660e8c47ac72677241487b9bd1e9871f349ba15b78029693f2db04051afdcdb818b9cb0da5b4018ff7c3fc80ec65cd053f703524a1fe5a666c31f31db284afc7a3d37daa63eb4ccfb33b40054606a47d32e238ef9eeb4e9d7467e56e3c878bb646251d34c4c8cf7d25f87cb12113b45053cde0e9a05a7ef1bdc170a73d2e8120b4dc02034965e370dfa7ffa48ac5a8f0adb2bcebbacf66f1884633f32936e5fbf4e815cb46809ee33c65556a9d2f7351940f53360ed45c23b3afdc3cef3a2aa6e652ed4423b4b1558c5124ccbec5257c79514e3fb33e70a73adba51119e95a850fd1f286d0e92bf7f1a49e8f63a410374ba90268a4db3e6927f27f2cc4f23c19e0e2c2cf295a1e54be4bd3a229384706e4bd025b6fb903e3af66e01e14c1bb5fdd1bcee3edc8334e26cd5eb850ce22d4dbe2968e78b067f1f665109343ab950363abbf6a6efd9e26f1ce5800d3987ce7ad6633e040d7a47c5d1d91537b5c123d612683702fa95d9c951333ea29611af80581fed9806af67f41ddf6f307c157722876c02e61055247b5483cdac376e3ef2b59c6c8f358e5393c378be9a612790503ce591f804db2b8174e409e257919e525d70286bc89b1ecce641cfeadd79f1ab96cb6b7cc0718c52d82e55602ba83a341b725205bda5c6cbcd31680a75b2f9a688042f59e86acc160cb8c288499efc2ec6d086ea4b38e1fc5a1a226ab13aad92f2e24a147d05282d52f301a0c37387d9e572dc66776b31798eb35f7c7676b16d7c22b0bf51f4d30765a23b725e49b2ecbe9b3498d5a3e64006212655a573649c2ad7a4ff44f66fbb5ec719cc49d5a6c52bd7286756e42968befee8a8db5dae2e629add052a849f5b4c8b9733d027b56d91281fb82b64d507799185ee7e72933a1c08fa48d81eafe434e5ee358d4c696e25d9b722cbb7bbe79b855ff6f634e97b2a9043aa4402898648c3cd1f05a8fabf74cade80adeeb37100cbc8d25a13f501a430bd74f7c06d7d53b253e125237f2e8aa4667124af8d6969e2a228493db388f43ba6e863f4b3c14ac87a156505bdd5d157bfdc4f578250794beb55f6a95d4bb02284eff4396ba851b0c4f561e654ed872542375a4041622b15c2f5436ee2ed07b9b518b18dc4f68cdb7f4bcfce3d46825f1de3a65b6880c2b6b3da070699b00be709432b9422008aee176196a9e81f2d5162f1b32a88efe3509368f00a73b5f258c9be083b2f0e25f8207b2d4cccfaff8850d89668be95ca4e6de44f862487298067fb3b5f4641dc651792d1abbf516485ef864e583d15353d1928efde83a42a1b80a7fbae27d7cc1c93987ec4aebfde689450248bc75b605dfa82e0287f0d27accdd91686b804a53f6d5fe30a934e2191c9c3245fb48a5dc3e3cff69c45069a8c8b77c6482be1ed378fd997882f692461cbdc76b78876390963db3cf556fabb634fc4b77ad9f735832d43e795fbbbbbd88d4d8a120552e9219aa16e5392eab9f2a102a9e69219918176ed9d7ea2fd5f59bf72bd78589228f4e6f4fec974c64ab1b8064d73727439843ffd7903355f8092d1547c0c917c1bad59c89c433bda017765dff7db57dbe2e5f157dc78e35828cebe412a3ab5bec1857597f2deb9481caf47a1cd6970243706c0cb2d0272e3225d183c9e22a04d6203babc053648ea280884347cbe139cdd4e0a63fe96a4af7b5383d68b2516e5d5b4c56ef52df31159bc6dbfd5c4e714e7f891cbaa969511354664f83deb8d32962a2decd27644af561bdaa1e1d444e86f4cf8701c5f0b6be052af572e812fc7674c2e850e810359f9670b10df003ed0390728688436b4cac599e4fdb26aecd9c3fe568856dd969feb784d850df89059043d02c0c5ed811c8f2063c6b23650fcfc33a9c02a51079739064223677039a25ba20a4bfabc9f451d0a8d085ed0c3ecc024da35a6d64ee5810582c58ee8b4e22ddfa3baaff031c30043aec020383d82f0a4da35c5be65eb12dde670ceee31419a40d045652f243ba83a92eefd36ea32dbebe1c7d2c6b27dca2ba143d1c1232b3c7a645166ee55753b8bfa375e05aef7ec71b7fb6d714b960745118b12bb333cdef630f2bac227f299aa950428945ab26354dce051ce1dbf919c42a058842d6a97aebcff9791c8a93546a129f91fea79268974e84ea003368760f9aa055559fbe4fae4ac4abc40e2c28eb8309ba75b9f2d348a09910344dc769273fa846b6f9118315d3a92e92bb731b43c72e5c182ed1ce70cf95c0af41ca91a972a0ede183d348c0d41485abb2bf805e3b9daefe673acbe7e464150b65aa96dce458337c8f970ee67c2caa2910abd0f520cd8933a9e04c881110e41dbebb6a24658a7b252cf03679278b467bcc544d250a4e8268059368135cf0ed9f66fec6141e0616faa23b71ae85acb0725330f9c801d50623e3ed995430095a2c956eda16bf113b6e090dcdec8937351ca7465c6873bc6c77af4c1548d22d0740a44a2e14c636d98b892b8241f09e3c3b2401daad8e0c2f8d1906d526bc235e07cf1b1b97a1ee70dbbc7c831ec727ef24f7f890a3784d01c3b2fb0a969dad93ece9a9e304d8df483bc4297beff349f27157922"}, &(0x7f0000000600)=0x1008) setsockopt$inet_sctp6_SCTP_AUTH_DELETE_KEY(r8, 0x84, 0x19, &(0x7f0000000640)={r9, 0x180000}, 0x8) r10 = syz_open_procfs(0x0, &(0x7f0000000340)="696f001b66408225aaa3af068fffebb8a490c47dda6586f1b58895b94a78037dd3714e7198820a7a709e2d30d25e6d846cd5c62a648a598668a8263b752b0b622b115112b5ad8e0425c0b784bbdb89eb8f4da0dd73dd01fe35694c2f78600badf8a0e237dba40713bac9e053b41a9f62be5fbb928018aab5f7500bef51a2fd74d4fffb4a20a946733820bdc1b485afa417cdbcfdfbc54f58c9c3edffe240c36f4ab8a16613814e226b6d20d98010ab1ace49fa76dce337a5a5f1dcff9e5d533b12475e33b971b15b69cd591cd9059759f0f04ba5468a34b98915033debb3e87f048e8601712659d47d8687eb6be5e650068d88000000000000") preadv(r10, &(0x7f0000000480), 0x10000000000002a1, 0x0) [ 448.107454] binder: 23528:23529 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 12:33:45 executing program 1: preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f0000000180)=""/148, 0x13d}], 0x1, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000340)="696f001b66408225aaa3af068fffebb8a490c47dda6586f1b58895b94a78037dd3714e7198820a7a709e2d30d25e6d846cd5c62a648a598668a8263b752b0b622b115112b5ad8e0425c0b784bbdb89eb8f4da0dd73dd01fe35694c2f78600badf8a0e237dba40713bac9e053b41a9f62be5fbb928018aab5f7500bef51a2fd74d4fffb4a20a946733820bdc1b485afa417cdbcfdfbc54f58c9c3edffe240c36f4ab8a16613814e226b6d20d98010ab1ace49fa76dce337a5a5f1dcff9e5d533b12475e33b971b15b69cd591cd9059759f0f04ba5468a34b98915033debb3e87f048e8601712659d47d8687eb6be5e650068d88000000000000") preadv(r0, &(0x7f0000000480), 0x723, 0x0) 12:33:45 executing program 0: syz_open_dev$sndctrl(&(0x7f0000000140)='/dev/snd/controlC#\x00', 0x0, 0x0) sched_setaffinity(0x0, 0x7, &(0x7f00000000c0)=0x9) r0 = perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0) fcntl$setflags(r0, 0x2, 0x1) getsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER_VALUE(0xffffffffffffffff, 0x84, 0x7c, &(0x7f00000001c0), &(0x7f0000000240)=0x8) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(0xffffffffffffffff, 0x84, 0x9, &(0x7f0000000280)={0x0, @in={{0x2, 0x4e23, @remote}}, 0xfffffffffffffff7, 0x0, 0x400, 0x0, 0xc1}, 0x98) sendto$inet6(0xffffffffffffffff, &(0x7f00000004c0), 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) setsockopt$SO_BINDTODEVICE(0xffffffffffffffff, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x4) socket$inet6(0xa, 0x1000000000002, 0x0) r1 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x4, 0x0, &(0x7f0000000100)=[@enter_looper], 0x1, 0x0, &(0x7f0000000180)='T'}) r2 = gettid() timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, &(0x7f0000040000)) tkill(r2, 0x1004000000016) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0xfffffffffffffced, 0x0, &(0x7f0000000040)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x400c630f}], 0x0, 0x0, &(0x7f0000000f4d)}) 12:33:45 executing program 2: perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f0000000180)=""/148, 0x13d}], 0x1, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000340)="696f001b66408225aaa3af068fffebb8a490c47dda6586f1b58895b94a78037dd3714e7198820a7a709e2d30d25e6d846cd5c62a648a598668a8263b752b0b622b115112b5ad8e0425c0b784bbdb89eb8f4da0dd73dd01fe35694c2f78600badf8a0e237dba40713bac9e053b41a9f62be5fbb928018aab5f7500bef51a2fd74d4fffb4a20a946733820bdc1b485afa417cdbcfdfbc54f58c9c3edffe240c36f4ab8a16613814e226b6d20d98010ab1ace49fa76dce337a5a5f1dcff9e5d533b12475e33b971b15b69cd591cd9059759f0f04ba5468a34b98915033debb3e87f048e8601712659d47d8687eb6be5e650068d88000000000000") preadv(r0, &(0x7f0000000480), 0x100000000000013e, 0x0) msgget$private(0x0, 0x22) 12:33:45 executing program 1: preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f0000000180)=""/148, 0x13d}], 0x1, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000340)="696f001b66408225aaa3af068fffebb8a490c47dda6586f1b58895b94a78037dd3714e7198820a7a709e2d30d25e6d846cd5c62a648a598668a8263b752b0b622b115112b5ad8e0425c0b784bbdb89eb8f4da0dd73dd01fe35694c2f78600badf8a0e237dba40713bac9e053b41a9f62be5fbb928018aab5f7500bef51a2fd74d4fffb4a20a946733820bdc1b485afa417cdbcfdfbc54f58c9c3edffe240c36f4ab8a16613814e226b6d20d98010ab1ace49fa76dce337a5a5f1dcff9e5d533b12475e33b971b15b69cd591cd9059759f0f04ba5468a34b98915033debb3e87f048e8601712659d47d8687eb6be5e650068d88000000000000") preadv(r0, &(0x7f0000000480), 0x10000000000002a1, 0x0) socket$inet(0x2, 0x0, 0x3f) 12:33:46 executing program 5: preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f0000000180)=""/148, 0x13d}], 0x1, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000340)="696f001b66408225aaa3af068fffebb8a490c47dda6586f1b58895b94a78037dd3714e7198820a7a709e2d30d25e6d846cd5c62a648a598668a8263b752b0b622b115112b5ad8e0425c0b784bbdb89eb8f4da0dd73dd01fe35694c2f78600badf8a0e237dba40713bac9e053b41a9f62be5fbb928018aab5f7500bef51a2fd74d4fffb4a20a946733820bdc1b485afa417cdbcfdfbc54f58c9c3edffe240c36f4ab8a16613814e226b6d20d98010ab1ace49fa76dce337a5a5f1dcff9e5d533b12475e33b971b15b69cd591cd9059759f0f04ba5468a34b98915033debb3e87f048e8601712659d47d8687eb6be5e650068d88000000000000") clock_gettime(0x0, &(0x7f0000000040)={0x0, 0x0}) ppoll(&(0x7f0000000000)=[{r0, 0x2000}, {r0, 0x5}], 0x2, &(0x7f0000000080)={r1, r2+30000000}, &(0x7f00000000c0), 0x8) preadv(r0, &(0x7f0000000480), 0x10000000000002a1, 0x0) 12:33:46 executing program 3: r0 = socket$inet6(0xa, 0x400000000001, 0x0) r1 = dup(r0) setsockopt$inet6_tcp_int(r1, 0x6, 0x20000000000002, &(0x7f00007b1000)=0x81, 0x4) ioctl$KVM_ARM_SET_DEVICE_ADDR(r1, 0x4010aeab, &(0x7f0000000200)={0x3, 0x101000}) bind$inet6(r0, &(0x7f00000000c0)={0xa, 0x4e20}, 0x1c) setsockopt$inet6_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000440)='vegas\x00', 0x6) sendto$inet6(r0, &(0x7f0000e77fff), 0x2bd, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) ioctl$PIO_SCRNMAP(r1, 0x4b41, &(0x7f0000000240)="e2a00e8517cd0a09d3402e3b395d0728c80f4f4410e626827f729e22bf12cad7a95027c99115486b4bf8cbb64071") listen(0xffffffffffffffff, 0x0) r2 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) clone(0x0, &(0x7f0000000240), &(0x7f0000000100), &(0x7f0000000140), &(0x7f0000000180)) getsockopt$inet_sctp6_SCTP_PEER_AUTH_CHUNKS(r1, 0x84, 0x1a, &(0x7f0000000280)={0x0, 0x7f, "fde4e6c4fca0792883e41bc78320fd026d89a73c5d3a49e00670a479dc9cb95ddb3bbd8f7c352c104dfc3c4de6b392c0f308faa83685afc2c3260cdb1145314cc6fd8dd4f6fdf68db8d4fc95a41dd11a22235bd0a0a3c7d20d56f65340c5a47ed90f5687e9b3c6b53432d5b71e7f00859b7861ff9d666de1edff4db03bda9b"}, &(0x7f0000000340)=0x87) setsockopt$inet_sctp_SCTP_STREAM_SCHEDULER(r1, 0x84, 0x7b, &(0x7f0000000380)={r3, 0x1ff}, 0x8) ioctl$TIOCGSOFTCAR(r2, 0x5419, &(0x7f0000000000)) r4 = open(&(0x7f0000000040)='./bus\x00', 0x141042, 0x0) ftruncate(r4, 0x7fff) sendfile(r1, r4, &(0x7f0000d83ff8), 0x8000fffffffe) ioctl$EVIOCSABS20(r1, 0x401845e0, &(0x7f0000000080)={0x81, 0x7, 0x0, 0x0, 0x7, 0x93b6}) ioctl$FICLONE(r1, 0x40049409, r0) getsockopt$inet6_udp_int(r4, 0x11, 0xb, &(0x7f0000000180), &(0x7f00000001c0)=0x4) 12:33:46 executing program 0: syz_open_dev$sndctrl(&(0x7f0000000140)='/dev/snd/controlC#\x00', 0x0, 0x0) sched_setaffinity(0x0, 0x7, &(0x7f00000000c0)=0x9) r0 = perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0) fcntl$setflags(r0, 0x2, 0x1) getsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER_VALUE(0xffffffffffffffff, 0x84, 0x7c, &(0x7f00000001c0), &(0x7f0000000240)=0x8) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(0xffffffffffffffff, 0x84, 0x9, &(0x7f0000000280)={0x0, @in={{0x2, 0x4e23, @remote}}, 0xfffffffffffffff7, 0x0, 0x400, 0x0, 0xc1}, 0x98) sendto$inet6(0xffffffffffffffff, &(0x7f00000004c0), 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) setsockopt$SO_BINDTODEVICE(0xffffffffffffffff, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x4) socket$inet6(0xa, 0x1000000000002, 0x0) r1 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x4, 0x0, &(0x7f0000000100)=[@enter_looper], 0x1, 0x0, &(0x7f0000000180)='T'}) r2 = gettid() timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, &(0x7f0000040000)) tkill(r2, 0x1004000000016) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0xfffffffffffffced, 0x0, &(0x7f0000000040)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x400c630f}], 0x0, 0x0, &(0x7f0000000f4d)}) 12:33:46 executing program 2: perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f0000000180)=""/148, 0x13d}], 0x1, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000340)="696f001b66408225aaa3af068fffebb8a490c47dda6586f1b58895b94a78037dd3714e7198820a7a709e2d30d25e6d846cd5c62a648a598668a8263b752b0b622b115112b5ad8e0425c0b784bbdb89eb8f4da0dd73dd01fe35694c2f78600badf8a0e237dba40713bac9e053b41a9f62be5fbb928018aab5f7500bef51a2fd74d4fffb4a20a946733820bdc1b485afa417cdbcfdfbc54f58c9c3edffe240c36f4ab8a16613814e226b6d20d98010ab1ace49fa76dce337a5a5f1dcff9e5d533b12475e33b971b15b69cd591cd9059759f0f04ba5468a34b98915033debb3e87f048e8601712659d47d8687eb6be5e650068d88000000000000") preadv(r0, &(0x7f0000000480), 0x10000000000001a3, 0x0) msgget$private(0x0, 0x22) 12:33:46 executing program 4: socket$inet6(0xa, 0x0, 0x80000000) syz_open_dev$sndctrl(&(0x7f0000000140)='/dev/snd/controlC#\x00', 0x9, 0x400000) r0 = perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0) fcntl$setflags(r0, 0x2, 0x1) r1 = socket$inet6(0xa, 0x400000000001, 0x0) r2 = dup(r1) setsockopt$inet6_tcp_int(r2, 0x6, 0x12, &(0x7f0000000000)=0x7f, 0x4) bind$inet6(r1, &(0x7f0000000040)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) getsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER_VALUE(r1, 0x84, 0x7c, &(0x7f00000001c0)={0x0, 0x100000001, 0x6}, &(0x7f0000000240)=0x8) sendto$inet6(r1, &(0x7f00000004c0), 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) setsockopt$SO_BINDTODEVICE(r1, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x4) socket$inet6(0xa, 0x1000000000002, 0x0) r3 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r3, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000200)={0x4, 0x0, &(0x7f0000000100)=[@enter_looper], 0x1, 0x0, &(0x7f0000000180)='T'}) r4 = gettid() timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, &(0x7f0000040000)) tkill(r4, 0x1004000000016) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0xfffffffffffffced, 0x0, &(0x7f0000000040)}) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x400c630f}], 0x0, 0x0, &(0x7f0000000f4d)}) 12:33:46 executing program 1: preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f0000000180)=""/148, 0x13d}], 0x1, 0x0) r0 = gettid() bpf$BPF_GET_MAP_INFO(0xf, &(0x7f0000000080)={0xffffffffffffffff, 0x28, &(0x7f0000000000)={0x0, 0x0}}, 0x10) bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f00000000c0)={r1, 0xe395, 0x18}, 0xc) r2 = syz_open_procfs(r0, &(0x7f0000000040)='uid_map\x00') preadv(r2, &(0x7f0000000480), 0x10000000000002a1, 0x0) 12:33:46 executing program 1: preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f0000000180)=""/148, 0x13d}], 0x1, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000340)="696f001b66408225aaa3af068fffebb8a490c47dda6586f1b58895b94a78037dd3714e7198820a7a709e2d30d25e6d846cd5c62a648a598668a8263b752b0b622b115112b5ad8e0425c0b784bbdb89eb8f4da0dd73dd01fe35694c2f78600badf8a0e237dba40713bac9e053b41a9f62be5fbb928018aab5f7500bef51a2fd74d4fffb4a20a946733820bdc1b485afa417cdbcfdfbc54f58c9c3edffe240c36f4ab8a16613814e226b6d20d98010ab1ace49fa76dce337a5a5f1dcff9e5d533b12475e33b971b15b69cd591cd9059759f0f04ba5468a34b98915033debb3e87f048e8601712659d47d8687eb6be5e650068d88000000000000") fsync(r0) preadv(r0, &(0x7f0000000480), 0x10000000000002a1, 0x0) r1 = getpgrp(0x0) r2 = getpid() getsockopt$inet6_IPV6_XFRM_POLICY(r0, 0x29, 0x23, &(0x7f00000007c0)={{{@in6=@mcast1, @in=@multicast1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@loopback}, 0x0, @in=@dev}}, &(0x7f0000000140)=0x67) sendmsg$nl_generic(r0, &(0x7f0000000740)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x40209}, 0xc, &(0x7f0000000700)={&(0x7f0000000440)=ANY=[@ANYBLOB="9c0200002800000826bd7000ffdbdf25100000001c013800dd9cd4dfe5858707194bf7d4120073475cfe0d8c5b6bd2ba7e925a7dfe003d7314c925e1f4f9aa97b0a00fbbe9a78ac97974fd022ec44d8963ab1b5af2c6d1c24fcd4ab64c86e88eec455905b03852a98f31347c4845477aba3415b1e37aaf1a5ad1af301158a6bb10a42e31d1ae428ff4b1cb9eced9863bc5a008685b56be3aa2ac5ed2ff4e7ec4ff1fba33b605f0eb45740e06431b7b7b3c1547aa9c9a57b002660ce28bb06aeaabfad484e6ea613ebddbd7294a1d3010f56142e4123b238b0f5708002400", @ANYRES32=r0, @ANYBLOB='\b\x00q\x00', @ANYRES32=r0, @ANYBLOB="2c00170073797374656d5d7bcb73656375726974796e6f646576766d6e65743173656375726974790000000008000d00ac1414aa080085000500000001801700", @ANYRES32=r1, @ANYBLOB="00006c0177000c008d007766646e6f000000586e4d20766abd7054834607aebaff73d9df9f95e20e5c3ce23ff78dc86e379561d6e5ab1eca280f14cdaa1fd7481ff9ff0e0c3038b7c76f8968a536054244f2aaf8abf9e1dc7a23f17f899cb0d834efd352eaac79373f7af9731285874cf9250218b43e00d5b74c4f4e758ff162158daf477a3d53ad6bd87ea71492a57d4aaf42d9c8277e9782ea9e1f379e68ab7f0c0b5e7db3f45c42908ca8eca70ef1369d9103a256d0582108002700ffffff7f08004500", @ANYRES32=r2, @ANYBLOB="08008b00", @ANYRES32=r0, @ANYBLOB='\b\x00l\x00', @ANYRES32=r3, @ANYBLOB="08004500080000003424e134839ed4a3fdd7539fd94f151a865ee496d71ed657a3bb2b2f4624a38399d98521068d24d673a8e381a398e04d84e83440f214f33062a91f089c23ddf38b14d0f3b7aaa01dc819e04190e9fe65a765ca8fce55551406eba8ae3c72beca40e837c1c3db19abf05db289e90a2ba78fcecc9374df372d66227a84d2a621fda5a04a08d09e5476ab0f01f0fa"], 0x29c}, 0x1, 0x0, 0x0, 0x54}, 0x40000c0) ioctl$VT_RESIZEX(r0, 0x560a, &(0x7f0000000780)={0x0, 0x7fffffff, 0xc00000000000, 0x7, 0x401, 0xfffffffffffffffc}) mount$9p_fd(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040)='9p\x00', 0x400, &(0x7f0000000080)=ANY=[@ANYBLOB='traLs=fd,rfdno=', @ANYRESHEX=r0, @ANYBLOB=',wfdno=', @ANYRESHEX=r0, @ANYBLOB=',cache=mmap,privport,fscache,mmap,noextend,debug=0x00000000000000c6,\x00']) 12:33:46 executing program 2: perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f0000000180)=""/148, 0x13d}], 0x1, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000340)="696f001b66408225aaa3af068fffebb8a490c47dda6586f1b58895b94a78037dd3714e7198820a7a709e2d30d25e6d846cd5c62a648a598668a8263b752b0b622b115112b5ad8e0425c0b784bbdb89eb8f4da0dd73dd01fe35694c2f78600badf8a0e237dba40713bac9e053b41a9f62be5fbb928018aab5f7500bef51a2fd74d4fffb4a20a946733820bdc1b485afa417cdbcfdfbc54f58c9c3edffe240c36f4ab8a16613814e226b6d20d98010ab1ace49fa76dce337a5a5f1dcff9e5d533b12475e33b971b15b69cd591cd9059759f0f04ba5468a34b98915033debb3e87f048e8601712659d47d8687eb6be5e650068d88000000000000") preadv(r0, &(0x7f0000000480), 0x1000000000000062, 0x0) msgget$private(0x0, 0x22) 12:33:46 executing program 5: preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f0000000180)=""/148, 0x13d}], 0x1, 0x0) r0 = syz_open_dev$sndpcmp(&(0x7f0000000d80)='/dev/snd/pcmC#D#p\x00', 0x0, 0x10000) fstat(0xffffffffffffffff, &(0x7f0000000dc0)={0x0, 0x0, 0x0, 0x0, 0x0}) r2 = getegid() mount$fuse(0x0, &(0x7f0000000d00)='./file0\x00', &(0x7f0000000d40)='fuse\x00', 0x0, &(0x7f0000000e40)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r0, @ANYBLOB="2c726f6f746d6f64653d30303030303030303030303030303030303018693c322c721e36303030302c75", @ANYRESDEC=r1, @ANYBLOB=',group_id=', @ANYRESDEC=r2, @ANYBLOB=',\x00']) r3 = gettid() r4 = syz_open_procfs(r3, &(0x7f0000000000)="696f001b66408225aaa3af068fffebb8a490c47dda6586f1b58895b94a78037dd3714e7198820a7a709e2d30d25e6d846cd5c62a648a598668a8263b752b0b622b115112b5ad8e0425c0b784bbdb89eb8f4da0dd73dd01fe35694c2f78600badf8a0e237dba40713bac9e053b41a9f62be5fbb928018aab5f7500bef51a2fd74d4fffb4a20a946733820bdc1b485afa417cdbcfdfbc54f58c9c3edffe240c36f4ab8a16613814e226b6d20d98010ab1ace49fa76dce337a5a5f1dcff9e5d533b12475e33b971b15b69cd591cd9059759f0f04ba5468a34b98915033debb3e87f048e8601712659d47d8687eb6be5e650068d88000000000000") readv(r4, &(0x7f0000000c40)=[{&(0x7f0000000640)=""/168, 0xa8}, {&(0x7f0000000700)=""/161, 0xa1}, {&(0x7f00000007c0)=""/155, 0x9b}, {&(0x7f0000000880)=""/97, 0x61}, {&(0x7f0000000900)=""/178, 0xb2}, {&(0x7f00000013c0)=""/4096, 0x1000}, {&(0x7f00000009c0)=""/217, 0xd9}, {&(0x7f0000000ac0)=""/127, 0x7f}, {&(0x7f0000000b40)=""/254, 0xfe}], 0x9) pwritev(r4, &(0x7f00000005c0)=[{&(0x7f0000000240)="f7c676be9f61427d830a94600568ed3fdb068847ff8f5e6a0b1a68f98ef7af4f02ad27bdcabbfef5cb87f5b71422c9dbfb40cd2f8bad1f13797a699fb0255b6b4891508f311aeca73992620e0605456b1e7c50f2f1c765ca9a9c618b2a5139d135b7138e52d93cdd514c365529f70815359299f252f5afb37e34cf499957cb937d99ebf2d096407c6cbeee", 0x8b}, {&(0x7f0000000300)="240e0ad1a4d1b18a56b87cabf1d9239505a8397f2c5ae4c98956c59a96494003581925e19b249d01306745343475214f351f96739f5003bde6a616647be334137c34b47845b4c17980cec97434503d30a3d17baefda7c95c9efd356803771b053a897a6e0f5cd8032d77434b34b16a14b7ed5404ddb906c1d2910e6787eeec200029bc550009a7cb197332bf7d7a2187560a27e8ffe551f4ac0785a34477d7a635e3db10ef6f1785e6f7faaf40d0a7fb95759a7a870e804207c88048bfecd6781fcc59b0531b31c325aab68c9e3aa240a34934a08d5e34ccb21c6ce1f4083e7c203d38c730c7", 0xe6}, {&(0x7f0000000400)="81b0a2f01f7caa503f966a61a7cc48649c14c01431b9447a82ad66f4b7f9f5ca5019ecdc3e0be025fda44dd239737ae14359e79d048f0326e2860113a0abae3dee1c4cd65c10bbf81a6db3036b98a745d2499197a10ed9e1ee43b67d8214b5fd0351ee453ddc06a3e9871f3b7a953e6a328844931c5ef8f86b0267217b9919dc28076cecd3935734ea33e349e99aa69dcca790d9283426574eac54397de0", 0x9e}, {&(0x7f00000004c0)="6c99176d008926bc70d985b2e0414eec7e89ddc3a3cc7990208011584ec7c81b60f769f0b57d26bf45ed2bb1bbcc3a7afa0f71fae9671b0f49c17c04059bbefb55ebc9705ce7041692d06ef37c7441a8b54beca3a290807e50bce78dee9237be36d5db8200edcb22ea6084fa82f5036a08a55a054145854c7f639aed55eb5cde167e5fc55615afc314fdf525d1e69d03e27bfae244514c4379f440c301d9447ce0bb73c755c9d55b99998f6679e88c8f3b53a2005319d02dac07a55561485bc40719db30f9d96c5e872fa84d1955326ac23f98e8230015adbb2bf0ec05ebf6e7de791db6b163a031eb2fc20545236fa2c29db52dd6", 0xf5}, {&(0x7f0000000100)="cbce08e6eacb0ee201db06fa786a46edc24ca53c3ac7c2515ae77d4c817cbeda35b58e462b61101761b2da1af4479df43e1d27dbb5ecc5fe83636e84f5ef07a02d554a04b4e9437dc52ec0db0fa0557014277a83c6d82ccc62dd", 0x5a}], 0x5, 0x0) preadv(r4, &(0x7f0000000480), 0x10000000000002a1, 0x0) [ 448.836711] binder: BINDER_SET_CONTEXT_MGR already set [ 448.851918] binder: 23599:23602 ioctl 40046207 0 returned -16 12:33:46 executing program 0: syz_open_dev$sndctrl(&(0x7f0000000140)='/dev/snd/controlC#\x00', 0x0, 0x0) sched_setaffinity(0x0, 0x7, &(0x7f00000000c0)=0x9) r0 = perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0) fcntl$setflags(r0, 0x2, 0x1) getsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER_VALUE(0xffffffffffffffff, 0x84, 0x7c, &(0x7f00000001c0), &(0x7f0000000240)=0x8) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(0xffffffffffffffff, 0x84, 0x9, &(0x7f0000000280)={0x0, @in={{0x2, 0x4e23, @remote}}, 0xfffffffffffffff7, 0x0, 0x400, 0x0, 0xc1}, 0x98) sendto$inet6(0xffffffffffffffff, &(0x7f00000004c0), 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) setsockopt$SO_BINDTODEVICE(0xffffffffffffffff, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x4) socket$inet6(0xa, 0x1000000000002, 0x0) r1 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x4, 0x0, &(0x7f0000000100)=[@enter_looper], 0x1, 0x0, &(0x7f0000000180)='T'}) r2 = gettid() timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, &(0x7f0000040000)) tkill(r2, 0x1004000000016) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0xfffffffffffffced, 0x0, &(0x7f0000000040)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x400c630f}], 0x0, 0x0, &(0x7f0000000f4d)}) 12:33:46 executing program 3: r0 = socket$inet6(0xa, 0x400000000001, 0x0) r1 = dup(r0) setsockopt$inet6_tcp_int(r1, 0x6, 0x20000000000002, &(0x7f00007b1000)=0x81, 0x4) bind$inet6(r0, &(0x7f00000000c0)={0xa, 0x4e20}, 0x1c) setsockopt$inet6_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000440)='vegas\x00', 0x6) sendto$inet6(r0, &(0x7f0000e77fff), 0x2bd, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) listen(0xffffffffffffffff, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$KVM_SET_DEVICE_ATTR(r1, 0x4018aee1, &(0x7f0000000180)={0x0, 0x2c9, 0x200000000, &(0x7f0000000000)=0x2}) clone(0x0, &(0x7f0000000240), &(0x7f0000000100), &(0x7f0000000140), &(0x7f0000000180)) r2 = open(&(0x7f0000000040)='./bus\x00', 0x141042, 0x0) ftruncate(r2, 0x7fff) sendfile(r1, r2, &(0x7f0000d83ff8), 0x8000fffffffe) ioctl$EVIOCSABS20(r1, 0x401845e0, &(0x7f0000000080)={0x81, 0x7, 0x0, 0x0, 0x7, 0x93b6}) [ 448.951583] binder: 23599:23613 Acquire 1 refcount change on invalid ref 0 ret -22 [ 448.960563] binder: 23599:23613 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 448.984222] binder: 23599:23613 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 12:33:46 executing program 1: preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f0000000180)=""/148, 0x13d}], 0x1, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000340)="696f001b66408225aaa3af068fffebb8a490c47dda6586f1b58895b94a78037dd3714e7198820a7a709e2d30d25e6d846cd5c62a648a598668a8263b752b0b622b115112b5ad8e0425c0b784bbdb89eb8f4da0dd73dd01fe35694c2f78600badf8a0e237dba40713bac9e053b41a9f62be5fbb928018aab5f7500bef51a2fd74d4fffb4a20a946733820bdc1b485afa417cdbcfdfbc54f58c9c3edffe240c36f4ab8a16613814e226b6d20d98010ab1ace49fa76dce337a5a5f1dcff9e5d533b12475e33b971b15b69cd591cd9059759f0f04ba5468a34b98915033debb3e87f048e8601712659d47d8687eb6be5e650068d88000000000000") preadv(r0, &(0x7f0000000480), 0x10000000000002a1, 0x0) r1 = syz_genetlink_get_family_id$team(&(0x7f0000000040)='team\x00') getpeername$packet(r0, &(0x7f0000000080)={0x11, 0x0, 0x0}, &(0x7f00000000c0)=0x14) setsockopt$bt_BT_CHANNEL_POLICY(r0, 0x112, 0xa, &(0x7f0000000480)=0xed4, 0x4) getsockopt$inet6_mreq(r0, 0x29, 0x1c, &(0x7f0000000100)={@mcast2, 0x0}, &(0x7f0000000140)=0x14) getsockopt$inet_IP_IPSEC_POLICY(r0, 0x0, 0x10, &(0x7f0000000240)={{{@in=@loopback, @in6=@dev, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{}, 0x0, @in=@multicast1}}, &(0x7f0000000440)=0xe8) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000700)={'vcan0\x00', r4}) syz_mount_image$nfs4(&(0x7f00000004c0)='nfs4\x00', &(0x7f0000000500)='./file0\x00', 0x5a, 0x1, &(0x7f0000000640)=[{&(0x7f0000000540)="98e47ffe9fb525fa0b28914bf3ece672cd56c9589389a08141f47cf8cbf8f8a8f05bef491bd02a3cd3521da72079262f52403b981c3469f7db19425db8cc9c616f2ce3a01282bd70e778224150c30d2d332e893980928eb62ca4b580456969dd20025306baa4b5aa2cff4ddbe623069ca428029b767459cd1d237d95a4b3812feae0cdfab81526fd3d199f5b33b887171780385a712598bad031b9103f37fcc6d1e5ed33dcbb8129ba765a6cc7a4f5894326524f3f1eaf62f35d4a5c93c69344c01b5ef3b8eda423f34f1f450c25fd00ecec29c764ee889a92c51d7d4b9a832ab47bdf59394fab4dade896904495adaeccb5be", 0xf3, 0x7ff}], 0x20, &(0x7f0000000680)='\x00') ioctl$BLKBSZGET(r0, 0x80081270, &(0x7f00000006c0)) getsockopt$inet6_IPV6_XFRM_POLICY(r0, 0x29, 0x23, &(0x7f0000000800)={{{@in=@broadcast, @in=@rand_addr, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@local}, 0x0, @in=@remote}}, &(0x7f0000000900)=0xe8) getsockopt$inet6_mreq(r0, 0x29, 0x1c, &(0x7f0000000940)={@empty, 0x0}, &(0x7f0000000980)=0x14) ioctl$sock_ifreq(r0, 0x891d, &(0x7f00000009c0)={'veth0_to_bridge\x00', @ifru_addrs=@can={0x1d, 0x0}}) getsockopt$inet_mreqn(r0, 0x0, 0x27, &(0x7f0000000a00)={@remote, @loopback, 0x0}, &(0x7f0000000a40)=0xc) ioctl$TIOCSSOFTCAR(r0, 0x541a, &(0x7f0000000740)=0x9) getsockopt$inet_IP_IPSEC_POLICY(r0, 0x0, 0x10, &(0x7f0000002780)={{{@in6, @in6=@mcast1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6}, 0x0, @in6=@dev}}, &(0x7f0000002880)=0xe8) accept4$packet(r0, &(0x7f0000002d80)={0x11, 0x0, 0x0}, &(0x7f0000002dc0)=0x14, 0x80800) getsockname$packet(r0, &(0x7f0000002e00)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @remote}, &(0x7f0000002e40)=0x14) sendmsg$TEAM_CMD_PORT_LIST_GET(r0, &(0x7f00000031c0)={&(0x7f0000000000), 0xc, &(0x7f0000003180)={&(0x7f0000000a80)=ANY=[@ANYBLOB="d8020000", @ANYRES16=r1, @ANYBLOB="000128bd7000fddbdf250300000008000100", @ANYRES32=r2, @ANYBLOB="0400020008000100", @ANYRES32=r3, @ANYBLOB="680102003800010024000100616374697665706f727400000000000000000000000000000000000000000000080003000300000008000400", @ANYRES32=r4, @ANYBLOB="3c00010024000100757365725f6c696e6b757000000000000000000000000000000000000000000008000300060000000400040008000600", @ANYRES32=r5, @ANYBLOB="3c00010024000100757365725f6c696e6b757000000000000000000000000000000000000000000008000300060000000400040008000600", @ANYRES32=r6, @ANYBLOB="40000100240001007072696f72697479000000000000000000000000000000000000000000000000080003000e000000080004000400000008000600", @ANYRES32=r7, @ANYBLOB="3c00010024000100656e61626c65640000000000000000000000000000000000000000000000000008000300060000000400040008000600", @ANYRES32=r8, @ANYBLOB="38000100240001006d636173745f72656a6f696e5f696e74657276616c00000000000000000000000800030003000000080004000101000008000100", @ANYRES32=r9, @ANYBLOB="3c00020038000100240001006e6f746966795f70656572735f636f756e7400000000000000000000000000000800030003000000080004004000000008000100", @ANYRES32=r10, @ANYBLOB="fc00020040000100240001006c625f74785f0000008000000000706f72745f6d617070696e67000000000000080003000300000008000400b35d73d6b61e4b406796a80dc01b023e187810d772d8aa9923a2b7baefc0ff7c61a6b24f1cf2fcb9d35cc2c61e6c8b3cda6ff5cf68aff86f2f360de8a504fab75417a78d15c1a90ecd46269953b24abafa5ea08d943b09afef92690d2ca88a1eef81d1d104c400a322573b5e4260ad02318f3a4a8a9e28243b93128c2cecd5b5e1de78e196b04a92ba54ebe5c60aee6dca946048202da948ffb1eb1e43654aba283207ca60b451e2b0201c15ae5f39fdb5b28cb79940c24a3cc207e24fc0c64e31b7beef37d3930c10b824c958a864326cf4e06bf769b2ff63de", @ANYRES32=r11, @ANYBLOB="080007000000000040000100240001007072696f72697479000000000000000000000000000000000000000000000000080003000e00000008000400ffff000008000600", @ANYRES32=r12, @ANYBLOB="40000100240001006c625f686173685f737461747300000000000000000000000000000000000000080003000b0000000800040006000000080007000000000038000100240001006e6f746966795f70656572735f636f756e74000000000000000000000000000008000300030000000800040000000100"], 0x2d8}, 0x1, 0x0, 0x0, 0x4040095}, 0x4000000) 12:33:46 executing program 5: preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f0000000180)=""/148, 0x13d}], 0x1, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000340)="696f001b66408225aaa3af068fffebb8a490c47dda6586f1b58895b94a78037dd3714e7198820a7a709e2d30d25e6d846cd5c62a648a598668a8263b752b0b622b115112b5ad8e0425c0b784bbdb89eb8f4da0dd73dd01fe35694c2f78600badf8a0e237dba40713bac9e053b41a9f62be5fbb928018aab5f7500bef51a2fd74d4fffb4a20a946733820bdc1b485afa417cdbcfdfbc54f58c9c3edffe240c36f4ab8a16613814e226b6d20d98010ab1ace49fa76dce337a5a5f1dcff9e5d533b12475e33b971b15b69cd591cd9059759f0f04ba5468a34b98915033debb3e87f048e8601712659d47d8687eb6be5e650068d88000000000000") preadv(r0, &(0x7f0000000000), 0x0, 0x0) 12:33:46 executing program 2: perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f0000000180)=""/148, 0x13d}], 0x1, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000340)="696f001b66408225aaa3af068fffebb8a490c47dda6586f1b58895b94a78037dd3714e7198820a7a709e2d30d25e6d846cd5c62a648a598668a8263b752b0b622b115112b5ad8e0425c0b784bbdb89eb8f4da0dd73dd01fe35694c2f78600badf8a0e237dba40713bac9e053b41a9f62be5fbb928018aab5f7500bef51a2fd74d4fffb4a20a946733820bdc1b485afa417cdbcfdfbc54f58c9c3edffe240c36f4ab8a16613814e226b6d20d98010ab1ace49fa76dce337a5a5f1dcff9e5d533b12475e33b971b15b69cd591cd9059759f0f04ba5468a34b98915033debb3e87f048e8601712659d47d8687eb6be5e650068d88000000000000") preadv(r0, &(0x7f0000000480), 0x100000000000029f, 0x0) msgget$private(0x0, 0x22) 12:33:46 executing program 0: syz_open_dev$sndctrl(&(0x7f0000000140)='/dev/snd/controlC#\x00', 0x0, 0x0) sched_setaffinity(0x0, 0x7, &(0x7f00000000c0)=0x9) r0 = perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0) fcntl$setflags(r0, 0x2, 0x1) getsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER_VALUE(0xffffffffffffffff, 0x84, 0x7c, &(0x7f00000001c0), &(0x7f0000000240)=0x8) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(0xffffffffffffffff, 0x84, 0x9, &(0x7f0000000280)={0x0, @in={{0x2, 0x4e23, @remote}}, 0xfffffffffffffff7, 0x0, 0x400}, 0x98) sendto$inet6(0xffffffffffffffff, &(0x7f00000004c0), 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) setsockopt$SO_BINDTODEVICE(0xffffffffffffffff, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x4) socket$inet6(0xa, 0x1000000000002, 0x0) r1 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x4, 0x0, &(0x7f0000000100)=[@enter_looper], 0x1, 0x0, &(0x7f0000000180)='T'}) r2 = gettid() timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, &(0x7f0000040000)) tkill(r2, 0x1004000000016) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0xfffffffffffffced, 0x0, &(0x7f0000000040)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x400c630f}], 0x0, 0x0, &(0x7f0000000f4d)}) 12:33:46 executing program 1: r0 = syz_open_dev$sndpcmc(&(0x7f00000000c0)='/dev/snd/pcmC#D#c\x00', 0x0, 0x0) ioctl$TCSETSW(r0, 0x5403, &(0x7f0000000100)={0x79, 0x0, 0x3, 0x7fffffff, 0x0, 0x200, 0x1, 0x4, 0x200, 0x713f, 0x40, 0x7}) preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f0000000180)=""/148, 0x13d}], 0x1, 0x0) r1 = timerfd_create(0x7, 0x800) ioctl$EXT4_IOC_PRECACHE_EXTENTS(r1, 0x6612) pipe2(&(0x7f0000000040)={0xffffffffffffffff}, 0x4800) ioctl$TCGETA(r2, 0x5405, &(0x7f0000000080)) r3 = syz_open_procfs(0x0, &(0x7f0000000340)="696f001b66408225aaa3af068fffebb8a490c47dda6586f1b58895b94a78037dd3714e7198820a7a709e2d30d25e6d846cd5c62a648a598668a8263b752b0b622b115112b5ad8e0425c0b784bbdb89eb8f4da0dd73dd01fe35694c2f78600badf8a0e237dba40713bac9e053b41a9f62be5fbb928018aab5f7500bef51a2fd74d4fffb4a20a946733820bdc1b485afa417cdbcfdfbc54f58c9c3edffe240c36f4ab8a16613814e226b6d20d98010ab1ace49fa76dce337a5a5f1dcff9e5d533b12475e33b971b15b69cd591cd9059759f0f04ba5468a34b98915033debb3e87f048e8601712659d47d8687eb6be5e650068d88000000000000") ioctl$VT_GETSTATE(r3, 0x5603, &(0x7f0000000000)={0x2, 0x20d7, 0x7}) preadv(r3, &(0x7f0000000480), 0x10000000000002a1, 0x0) 12:33:46 executing program 5: preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f0000000180)=""/148, 0x13d}], 0x1, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000340)="696f001b66408225aaa3af068fffebb8a490c47dda6586f1b58895b94a78037dd3714e7198820a7a709e2d30d25e6d846cd5c62a648a598668a8263b752b0b622b115112b5ad8e0425c0b784bbdb89eb8f4da0dd73dd01fe35694c2f78600badf8a0e237dba40713bac9e053b41a9f62be5fbb928018aab5f7500bef51a2fd74d4fffb4a20a946733820bdc1b485afa417cdbcfdfbc54f58c9c3edffe240c36f4ab8a16613814e226b6d20d98010ab1ace49fa76dce337a5a5f1dcff9e5d533b12475e33b971b15b69cd591cd9059759f0f04ba5468a34b98915033debb3e87f048e8601712659d47d8687eb6be5e650068d88000000000000") preadv(r0, &(0x7f0000000480), 0x10000000000002a1, 0x0) r1 = openat$zero(0xffffffffffffff9c, &(0x7f0000000000)='/dev/zero\x00', 0x40000, 0x0) ioctl$TIOCSCTTY(r0, 0x540e, 0xffffffff00000000) ioctl$SNDRV_SEQ_IOCTL_UNSUBSCRIBE_PORT(r1, 0x40505331, &(0x7f0000000040)={{0x2, 0x80000000}, {0x800, 0x1f00000000}, 0x8, 0x4, 0x1}) 12:33:46 executing program 2: perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f0000000180)=""/148, 0x13d}], 0x1, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000340)="696f001b66408225aaa3af068fffebb8a490c47dda6586f1b58895b94a78037dd3714e7198820a7a709e2d30d25e6d846cd5c62a648a598668a8263b752b0b622b115112b5ad8e0425c0b784bbdb89eb8f4da0dd73dd01fe35694c2f78600badf8a0e237dba40713bac9e053b41a9f62be5fbb928018aab5f7500bef51a2fd74d4fffb4a20a946733820bdc1b485afa417cdbcfdfbc54f58c9c3edffe240c36f4ab8a16613814e226b6d20d98010ab1ace49fa76dce337a5a5f1dcff9e5d533b12475e33b971b15b69cd591cd9059759f0f04ba5468a34b98915033debb3e87f048e8601712659d47d8687eb6be5e650068d88000000000000") preadv(r0, &(0x7f0000000480), 0x100000000000014f, 0x0) msgget$private(0x0, 0x22) 12:33:46 executing program 0: syz_open_dev$sndctrl(&(0x7f0000000140)='/dev/snd/controlC#\x00', 0x0, 0x0) sched_setaffinity(0x0, 0x7, &(0x7f00000000c0)=0x9) r0 = perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0) fcntl$setflags(r0, 0x2, 0x1) getsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER_VALUE(0xffffffffffffffff, 0x84, 0x7c, &(0x7f00000001c0), &(0x7f0000000240)=0x8) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(0xffffffffffffffff, 0x84, 0x9, &(0x7f0000000280)={0x0, @in={{0x2, 0x4e23, @remote}}, 0xfffffffffffffff7, 0x0, 0x400}, 0x98) sendto$inet6(0xffffffffffffffff, &(0x7f00000004c0), 0x0, 0x0, &(0x7f00008d4fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) setsockopt$SO_BINDTODEVICE(0xffffffffffffffff, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x4) socket$inet6(0xa, 0x1000000000002, 0x0) r1 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x4, 0x0, &(0x7f0000000100)=[@enter_looper], 0x1, 0x0, &(0x7f0000000180)='T'}) r2 = gettid() timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, &(0x7f0000040000)) tkill(r2, 0x1004000000016) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0xfffffffffffffced, 0x0, &(0x7f0000000040)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x400c630f}], 0x0, 0x0, &(0x7f0000000f4d)}) 12:33:46 executing program 4: socket$inet6(0xa, 0x0, 0x80000000) sched_setaffinity(0x0, 0x7, &(0x7f00000000c0)=0x9) r0 = perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0) fcntl$setflags(r0, 0x2, 0x1) r1 = socket$inet6(0xa, 0x400000000001, 0x0) r2 = dup(r1) setsockopt$inet6_tcp_int(r2, 0x6, 0x12, &(0x7f0000000000)=0x7f, 0x4) bind$inet6(r1, &(0x7f0000000040)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) getsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER_VALUE(r1, 0x84, 0x7c, &(0x7f00000001c0)={0x0, 0x100000001, 0x6}, &(0x7f0000000240)=0x8) sendto$inet6(r1, &(0x7f00000004c0), 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) setsockopt$SO_BINDTODEVICE(r1, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x4) socket$inet6(0xa, 0x1000000000002, 0x0) r3 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r3, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000200)={0x4, 0x0, &(0x7f0000000100)=[@enter_looper], 0x1, 0x0, &(0x7f0000000180)='T'}) r4 = gettid() timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, &(0x7f0000040000)) tkill(r4, 0x1004000000016) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0xfffffffffffffced, 0x0, &(0x7f0000000040)}) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x400c630f}], 0x0, 0x0, &(0x7f0000000f4d)}) 12:33:46 executing program 3: r0 = socket$inet6(0xa, 0x400000000001, 0x0) r1 = dup(r0) getsockopt$inet_sctp6_SCTP_AUTH_ACTIVE_KEY(r1, 0x84, 0x18, &(0x7f0000000000)={0x0, 0x7a}, &(0x7f0000000180)=0x8) setsockopt$inet_sctp6_SCTP_SET_PEER_PRIMARY_ADDR(r1, 0x84, 0x5, &(0x7f00000001c0)={r2, @in6={{0xa, 0x4e21, 0x0, @ipv4={[], [], @remote}, 0x6}}}, 0x84) setsockopt$inet6_tcp_int(r1, 0x6, 0x1d, &(0x7f00007b1000)=0x81, 0xfffffca0) bind$inet6(r0, &(0x7f00000000c0)={0xa, 0x4e20}, 0x1c) setsockopt$inet6_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000440)='vegas\x00', 0x6) sendto$inet6(r0, &(0x7f0000e77fff), 0x2bd, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) listen(r1, 0x6) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) clone(0x0, &(0x7f0000000240), &(0x7f0000000100), &(0x7f0000000140), &(0x7f0000000180)) r3 = open(&(0x7f0000000040)='./bus\x00', 0x141042, 0x0) ftruncate(r3, 0x7fff) sendfile(r1, r3, &(0x7f0000d83ff8), 0x8000fffffffe) ioctl$EVIOCSABS20(r1, 0x401845e0, &(0x7f0000000080)={0x81, 0x7, 0x0, 0x0, 0x7, 0x93b6}) 12:33:47 executing program 5: r0 = bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f0000000000), 0x4) preadv(r0, &(0x7f0000001380)=[{&(0x7f0000000180)=""/148, 0xffffffa2}], 0x1, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000040)='attr/current\x00', r0}, 0x10) r1 = syz_open_procfs(0x0, &(0x7f0000000240)='attr/current\x00') preadv(r1, &(0x7f0000000480), 0x10000000000002a1, 0x0) 12:33:47 executing program 2: perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f0000000180)=""/148, 0x13d}], 0x1, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000340)="696f001b66408225aaa3af068fffebb8a490c47dda6586f1b58895b94a78037dd3714e7198820a7a709e2d30d25e6d846cd5c62a648a598668a8263b752b0b622b115112b5ad8e0425c0b784bbdb89eb8f4da0dd73dd01fe35694c2f78600badf8a0e237dba40713bac9e053b41a9f62be5fbb928018aab5f7500bef51a2fd74d4fffb4a20a946733820bdc1b485afa417cdbcfdfbc54f58c9c3edffe240c36f4ab8a16613814e226b6d20d98010ab1ace49fa76dce337a5a5f1dcff9e5d533b12475e33b971b15b69cd591cd9059759f0f04ba5468a34b98915033debb3e87f048e8601712659d47d8687eb6be5e650068d88000000000000") preadv(r0, &(0x7f0000000480), 0x1000000000000051, 0x0) msgget$private(0x0, 0x22) 12:33:47 executing program 1: preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f0000000180)=""/148, 0x13d}], 0x1, 0x0) r0 = openat$autofs(0xffffffffffffff9c, &(0x7f0000000000)='/dev/autofs\x00', 0x400080, 0x0) accept$nfc_llcp(r0, &(0x7f0000000040), &(0x7f00000000c0)=0x60) r1 = syz_open_procfs(0x0, &(0x7f0000000340)="696f001b66408225aaa3af068fffebb8a490c47dda6586f1b58895b94a78037dd3714e7198820a7a709e2d30d25e6d846cd5c62a648a598668a8263b752b0b622b115112b5ad8e0425c0b784bbdb89eb8f4da0dd73dd01fe35694c2f78600badf8a0e237dba40713bac9e053b41a9f62be5fbb928018aab5f7500bef51a2fd74d4fffb4a20a946733820bdc1b485afa417cdbcfdfbc54f58c9c3edffe240c36f4ab8a16613814e226b6d20d98010ab1ace49fa76dce337a5a5f1dcff9e5d533b12475e33b971b15b69cd591cd9059759f0f04ba5468a34b98915033debb3e87f048e8601712659d47d8687eb6be5e650068d88000000000000") preadv(r1, &(0x7f0000000480), 0x10000000000002a1, 0x0) 12:33:47 executing program 0: syz_open_dev$sndctrl(&(0x7f0000000140)='/dev/snd/controlC#\x00', 0x0, 0x0) sched_setaffinity(0x0, 0x7, &(0x7f00000000c0)=0x9) r0 = perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0) fcntl$setflags(r0, 0x2, 0x1) getsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER_VALUE(0xffffffffffffffff, 0x84, 0x7c, &(0x7f00000001c0), &(0x7f0000000240)=0x8) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(0xffffffffffffffff, 0x84, 0x9, &(0x7f0000000280)={0x0, @in={{0x2, 0x4e23, @remote}}, 0xfffffffffffffff7, 0x0, 0x400}, 0x98) sendto$inet6(0xffffffffffffffff, &(0x7f00000004c0), 0x0, 0x0, &(0x7f00008d4fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) setsockopt$SO_BINDTODEVICE(0xffffffffffffffff, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x4) socket$inet6(0xa, 0x1000000000002, 0x0) r1 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x4, 0x0, &(0x7f0000000100)=[@enter_looper], 0x1, 0x0, &(0x7f0000000180)='T'}) r2 = gettid() timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, &(0x7f0000040000)) tkill(r2, 0x1004000000016) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0xfffffffffffffced, 0x0, &(0x7f0000000040)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x400c630f}], 0x0, 0x0, &(0x7f0000000f4d)}) 12:33:47 executing program 4: sched_setaffinity(0x0, 0x7, &(0x7f00000000c0)=0x9) r0 = perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0) fcntl$setflags(r0, 0x2, 0x1) r1 = socket$inet6(0xa, 0x400000000001, 0x0) r2 = dup(r1) setsockopt$inet6_tcp_int(r2, 0x6, 0x12, &(0x7f0000000000)=0x7f, 0x4) bind$inet6(r1, &(0x7f0000000040)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) getsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER_VALUE(r1, 0x84, 0x7c, &(0x7f00000001c0)={0x0, 0x100000001, 0x6}, &(0x7f0000000240)=0x8) sendto$inet6(r1, &(0x7f00000004c0), 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) setsockopt$SO_BINDTODEVICE(r1, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x4) socket$inet6(0xa, 0x1000000000002, 0x0) r3 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r3, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000200)={0x4, 0x0, &(0x7f0000000100)=[@enter_looper], 0x1, 0x0, &(0x7f0000000180)='T'}) r4 = gettid() timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, &(0x7f0000040000)) tkill(r4, 0x1004000000016) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0xfffffffffffffced, 0x0, &(0x7f0000000040)}) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x400c630f}], 0x0, 0x0, &(0x7f0000000f4d)}) 12:33:47 executing program 1: preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f0000000180)=""/148, 0x13d}], 0x1, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000340)="696f001b66408225aaa3af068fffebb8a490c47dda6586f1b58895b94a78037dd3714e7198820a7a709e2d30d25e6d846cd5c62a648a598668a8263b752b0b622b115112b5ad8e0425c0b784bbdb89eb8f4da0dd73dd01fe35694c2f78600badf8a0e237dba40713bac9e053b41a9f62be5fbb928018aab5f7500bef51a2fd74d4fffb4a20a946733820bdc1b485afa417cdbcfdfbc54f58c9c3edffe240c36f4ab8a16613814e226b6d20d98010ab1ace49fa76dce337a5a5f1dcff9e5d533b12475e33b971b15b69cd591cd9059759f0f04ba5468a34b98915033debb3e87f048e8601712659d47d8687eb6be5e650068d88000000000000") getsockopt$inet_sctp_SCTP_SOCKOPT_CONNECTX3(r0, 0x84, 0x6f, &(0x7f00000000c0)={0x0, 0xa0, &(0x7f0000000000)=[@in6={0xa, 0x4e23, 0x3, @remote, 0x6}, @in={0x2, 0x4e21, @dev={0xac, 0x14, 0x14, 0x16}}, @in6={0xa, 0x4e20, 0x4748, @empty, 0x6}, @in6={0xa, 0x4e24, 0x0, @remote, 0x1}, @in6={0xa, 0x4e22, 0x0, @mcast2, 0x5}, @in={0x2, 0x4e21, @dev={0xac, 0x14, 0x14, 0xf}}, @in={0x2, 0x4e22, @dev={0xac, 0x14, 0x14, 0x13}}]}, &(0x7f0000000100)=0x10) setsockopt$inet_sctp6_SCTP_AUTH_ACTIVE_KEY(r0, 0x84, 0x18, &(0x7f0000000140)={r1, 0x3f}, 0x8) preadv(r0, &(0x7f0000000480), 0x10000000000002a1, 0x0) 12:33:47 executing program 2: perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f0000000180)=""/148, 0x13d}], 0x1, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000340)="696f001b66408225aaa3af068fffebb8a490c47dda6586f1b58895b94a78037dd3714e7198820a7a709e2d30d25e6d846cd5c62a648a598668a8263b752b0b622b115112b5ad8e0425c0b784bbdb89eb8f4da0dd73dd01fe35694c2f78600badf8a0e237dba40713bac9e053b41a9f62be5fbb928018aab5f7500bef51a2fd74d4fffb4a20a946733820bdc1b485afa417cdbcfdfbc54f58c9c3edffe240c36f4ab8a16613814e226b6d20d98010ab1ace49fa76dce337a5a5f1dcff9e5d533b12475e33b971b15b69cd591cd9059759f0f04ba5468a34b98915033debb3e87f048e8601712659d47d8687eb6be5e650068d88000000000000") preadv(r0, &(0x7f0000000480), 0x100000000000016f, 0x0) msgget$private(0x0, 0x22) 12:33:47 executing program 5: preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f0000000000)=""/148, 0x94}], 0x1, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000340)="696f001b66408225aaa3af068fffebb8a490c47dda6586f1b58895b94a78037dd3714e7198820a7a709e2d30d25e6d846cd5c62a648a598668a8263b752b0b622b115112b5ad8e0425c0b784bbdb89eb8f4da0dd73dd01fe35694c2f78600badf8a0e237dba40713bac9e053b41a9f62be5fbb928018aab5f7500bef51a2fd74d4fffb4a20a946733820bdc1b485afa417cdbcfdfbc54f58c9c3edffe240c36f4ab8a16613814e226b6d20d98010ab1ace49fa76dce337a5a5f1dcff9e5d533b12475e33b971b15b69cd591cd9059759f0f04ba5468a34b98915033debb3e87f048e8601712659d47d8687eb6be5e650068d88000000000000") preadv(r0, &(0x7f0000000480), 0x10000000000002a1, 0x0) 12:33:47 executing program 3: r0 = socket$inet6(0xa, 0x400000000001, 0x0) r1 = dup(r0) setsockopt$inet6_tcp_int(r1, 0x6, 0x20000000000002, &(0x7f00007b1000)=0x81, 0x4) sendto$inet6(r0, &(0x7f0000e77fff), 0x2bd, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) listen(0xffffffffffffffff, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) clone(0x0, &(0x7f0000000240), &(0x7f0000000100), &(0x7f0000000140), &(0x7f0000000180)) r2 = open(&(0x7f0000000040)='./bus\x00', 0x141042, 0x0) ftruncate(r2, 0x7fff) sendfile(r1, r2, &(0x7f0000d83ff8), 0x8000fffffffe) ioctl$EVIOCSABS20(r1, 0x401845e0, &(0x7f0000000080)={0x81, 0x7, 0x0, 0x0, 0x7, 0x93b6}) [ 450.038170] binder: BINDER_SET_CONTEXT_MGR already set [ 450.060328] binder: 23694:23695 ioctl 40046207 0 returned -16 12:33:47 executing program 0: syz_open_dev$sndctrl(&(0x7f0000000140)='/dev/snd/controlC#\x00', 0x0, 0x0) sched_setaffinity(0x0, 0x7, &(0x7f00000000c0)=0x9) r0 = perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0) fcntl$setflags(r0, 0x2, 0x1) getsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER_VALUE(0xffffffffffffffff, 0x84, 0x7c, &(0x7f00000001c0), &(0x7f0000000240)=0x8) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(0xffffffffffffffff, 0x84, 0x9, &(0x7f0000000280)={0x0, @in={{0x2, 0x4e23, @remote}}, 0xfffffffffffffff7, 0x0, 0x400}, 0x98) sendto$inet6(0xffffffffffffffff, &(0x7f00000004c0), 0x0, 0x0, &(0x7f00008d4fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) setsockopt$SO_BINDTODEVICE(0xffffffffffffffff, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x4) socket$inet6(0xa, 0x1000000000002, 0x0) r1 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x4, 0x0, &(0x7f0000000100)=[@enter_looper], 0x1, 0x0, &(0x7f0000000180)='T'}) r2 = gettid() timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, &(0x7f0000040000)) tkill(r2, 0x1004000000016) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0xfffffffffffffced, 0x0, &(0x7f0000000040)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x400c630f}], 0x0, 0x0, &(0x7f0000000f4d)}) [ 450.099826] binder: 23694:23695 Acquire 1 refcount change on invalid ref 0 ret -22 [ 450.130192] binder: 23694:23695 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 12:33:47 executing program 1: r0 = accept$unix(0xffffffffffffffff, &(0x7f0000000080)=@abs, &(0x7f0000000100)=0x6e) preadv(r0, &(0x7f0000000040)=[{&(0x7f0000000180)=""/148, 0x94}], 0x1, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000000)='gap\x00\x00\x00\x00\x00') preadv(r1, &(0x7f0000000480), 0x10000000000002a1, 0x0) [ 450.158368] binder: 23694:23703 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 12:33:47 executing program 2: perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f0000000180)=""/148, 0x13d}], 0x1, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000340)="696f001b66408225aaa3af068fffebb8a490c47dda6586f1b58895b94a78037dd3714e7198820a7a709e2d30d25e6d846cd5c62a648a598668a8263b752b0b622b115112b5ad8e0425c0b784bbdb89eb8f4da0dd73dd01fe35694c2f78600badf8a0e237dba40713bac9e053b41a9f62be5fbb928018aab5f7500bef51a2fd74d4fffb4a20a946733820bdc1b485afa417cdbcfdfbc54f58c9c3edffe240c36f4ab8a16613814e226b6d20d98010ab1ace49fa76dce337a5a5f1dcff9e5d533b12475e33b971b15b69cd591cd9059759f0f04ba5468a34b98915033debb3e87f048e8601712659d47d8687eb6be5e650068d88000000000000") preadv(r0, &(0x7f0000000480), 0x1000000000000042, 0x0) msgget$private(0x0, 0x22) 12:33:47 executing program 1: preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f0000000180)=""/148, 0x13d}], 0x1, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000340)="696f001b66408225aaa3af068fffebb8a490c47dda6586f1b58895b94a78037dd3714e7198820a7a709e2d30d25e6d846cd5c62a648a598668a8263b752b0b622b115112b5ad8e0425c0b784bbdb89eb8f4da0dd73dd01fe35694c2f78600badf8a0e237dba40713bac9e053b41a9f62be5fbb928018aab5f7500bef51a2fd74d4fffb4a20a946733820bdc1b485afa417cdbcfdfbc54f58c9c3edffe240c36f4ab8a16613814e226b6d20d98010ab1ace49fa76dce337a5a5f1dcff9e5d533b12475e33b971b15b69cd591cd9059759f0f04ba5468a34b98915033debb3e87f048e8601712659d47d8687eb6be5e650068d88000000000000") preadv(r0, &(0x7f0000000480), 0x10000000000002a1, 0x0) getsockopt$inet_sctp_SCTP_GET_PEER_ADDR_INFO(r0, 0x84, 0xf, &(0x7f0000000000)={0x0, @in={{0x2, 0x4e21, @broadcast}}, 0x1000, 0xd0ba, 0x245, 0x170ca7d5, 0x7c1}, &(0x7f00000000c0)=0x98) setsockopt$inet_sctp_SCTP_DEFAULT_SEND_PARAM(r0, 0x84, 0xa, &(0x7f0000000100)={0x61c9, 0x3, 0x8, 0x3, 0x18, 0x4, 0x8001, 0x7fffffff, r1}, 0x20) setsockopt$netlink_NETLINK_CAP_ACK(r0, 0x10e, 0xa, &(0x7f0000000140)=0x401, 0x4) 12:33:47 executing program 5: preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f0000000180)=""/148, 0x13d}], 0x1, 0x0) r0 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x1) ioctl$SNDRV_SEQ_IOCTL_GET_NAMED_QUEUE(r0, 0xc08c5336, &(0x7f0000000080)={0x6a69, 0x6, 0x5c, 'queue1\x00', 0x100}) r1 = syz_open_procfs(0x0, &(0x7f0000000340)="696f001b66408225aaa3af068fffebb8a490c47dda6586f1b58895b94a78037dd3714e7198820a7a709e2d30d25e6d846cd5c62a648a598668a8263b752b0b622b115112b5ad8e0425c0b784bbdb89eb8f4da0dd73dd01fe35694c2f78600badf8a0e237dba40713bac9e053b41a9f62be5fbb928018aab5f7500bef51a2fd74d4fffb4a20a946733820bdc1b485afa417cdbcfdfbc54f58c9c3edffe240c36f4ab8a16613814e226b6d20d98010ab1ace49fa76dce337a5a5f1dcff9e5d533b12475e33b971b15b69cd591cd9059759f0f04ba5468a34b98915033debb3e87f048e8601712659d47d8687eb6be5e650068d88000000000000") ioctl$sock_inet6_tcp_SIOCINQ(r0, 0x541b, &(0x7f0000000140)) preadv(r1, &(0x7f0000000480), 0x10000000000002a1, 0x0) ioctl$sock_inet_SIOCGIFBRDADDR(r1, 0x8919, &(0x7f0000000000)={'teql0\x00', {0x2, 0x4e22, @local}}) write$cgroup_int(r1, &(0x7f0000000240)=0x3, 0x12) 12:33:47 executing program 0: syz_open_dev$sndctrl(&(0x7f0000000140)='/dev/snd/controlC#\x00', 0x0, 0x0) sched_setaffinity(0x0, 0x7, &(0x7f00000000c0)=0x9) r0 = perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0) fcntl$setflags(r0, 0x2, 0x1) getsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER_VALUE(0xffffffffffffffff, 0x84, 0x7c, &(0x7f00000001c0), &(0x7f0000000240)=0x8) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(0xffffffffffffffff, 0x84, 0x9, &(0x7f0000000280)={0x0, @in={{0x2, 0x4e23, @remote}}, 0xfffffffffffffff7, 0x0, 0x400}, 0x98) sendto$inet6(0xffffffffffffffff, &(0x7f00000004c0), 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x0, 0x0, @loopback}, 0x1c) setsockopt$SO_BINDTODEVICE(0xffffffffffffffff, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x4) socket$inet6(0xa, 0x1000000000002, 0x0) r1 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x4, 0x0, &(0x7f0000000100)=[@enter_looper], 0x1, 0x0, &(0x7f0000000180)='T'}) r2 = gettid() timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, &(0x7f0000040000)) tkill(r2, 0x1004000000016) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0xfffffffffffffced, 0x0, &(0x7f0000000040)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x400c630f}], 0x0, 0x0, &(0x7f0000000f4d)}) 12:33:47 executing program 2: perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f0000000180)=""/148, 0x13d}], 0x1, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000340)="696f001b66408225aaa3af068fffebb8a490c47dda6586f1b58895b94a78037dd3714e7198820a7a709e2d30d25e6d846cd5c62a648a598668a8263b752b0b622b115112b5ad8e0425c0b784bbdb89eb8f4da0dd73dd01fe35694c2f78600badf8a0e237dba40713bac9e053b41a9f62be5fbb928018aab5f7500bef51a2fd74d4fffb4a20a946733820bdc1b485afa417cdbcfdfbc54f58c9c3edffe240c36f4ab8a16613814e226b6d20d98010ab1ace49fa76dce337a5a5f1dcff9e5d533b12475e33b971b15b69cd591cd9059759f0f04ba5468a34b98915033debb3e87f048e8601712659d47d8687eb6be5e650068d88000000000000") preadv(r0, &(0x7f0000000480), 0x100000000000026f, 0x0) msgget$private(0x0, 0x22) 12:33:48 executing program 4: socket$inet6(0xa, 0x0, 0x0) sched_setaffinity(0x0, 0x7, &(0x7f00000000c0)=0x9) r0 = perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0) fcntl$setflags(r0, 0x2, 0x1) r1 = socket$inet6(0xa, 0x400000000001, 0x0) r2 = dup(r1) setsockopt$inet6_tcp_int(r2, 0x6, 0x12, &(0x7f0000000000)=0x7f, 0x4) bind$inet6(r1, &(0x7f0000000040)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) getsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER_VALUE(r1, 0x84, 0x7c, &(0x7f00000001c0)={0x0, 0x100000001, 0x6}, &(0x7f0000000240)=0x8) sendto$inet6(r1, &(0x7f00000004c0), 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) setsockopt$SO_BINDTODEVICE(r1, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x4) socket$inet6(0xa, 0x1000000000002, 0x0) r3 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r3, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000200)={0x4, 0x0, &(0x7f0000000100)=[@enter_looper], 0x1, 0x0, &(0x7f0000000180)='T'}) r4 = gettid() timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, &(0x7f0000040000)) tkill(r4, 0x1004000000016) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0xfffffffffffffced, 0x0, &(0x7f0000000040)}) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x400c630f}], 0x0, 0x0, &(0x7f0000000f4d)}) 12:33:48 executing program 3: r0 = bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f0000000000), 0x4) preadv(r0, &(0x7f0000001380)=[{&(0x7f0000000180)=""/148, 0xffffffa2}], 0x1, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000040)='attr/current\x00', r0}, 0x10) r1 = syz_open_procfs(0x0, &(0x7f0000000240)='attr/current\x00') preadv(r1, &(0x7f0000000480), 0x10000000000002a1, 0x0) 12:33:48 executing program 1: preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f0000000180)=""/148, 0x13d}], 0x1, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000340)="696f001b66408225aaa3af068fffebb8a490c47dda6586f1b58895b94a78037dd3714e7198820a7a709e2d30d25e6d846cd5c62a648a598668a8263b752b0b622b115112b5ad8e0425c0b784bbdb89eb8f4da0dd73dd01fe35694c2f78600badf8a0e237dba40713bac9e053b41a9f62be5fbb928018aab5f7500bef51a2fd74d4fffb4a20a946733820bdc1b485afa417cdbcfdfbc54f58c9c3edffe240c36f4ab8a16613814e226b6d20d98010ab1ace49fa76dce337a5a5f1dcff9e5d533b12475e33b971b15b69cd591cd9059759f0f04ba5468a34b98915033debb3e87f048e8601712659d47d8687eb6be5e650068d88000000000000") preadv(r0, &(0x7f0000000480), 0x0, 0x0) 12:33:48 executing program 5: preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f0000000180)=""/148, 0x13d}], 0x1, 0x0) r0 = getpgid(0x0) r1 = syz_open_procfs(r0, &(0x7f0000000440)="696f001b66408225aaa3af068fffebb8a490c4a2da6586f1b58895b94a78037dd3714e7198820a7a709e2d30d25e6d846cd5c62a648a598668a8263b752b0b622b115112b5ad8e0425c03784bbdb89eb8f4da0dd73dd01fe35694c2f78600badf8a0e237dba40713bac9e053b41a9f62be5fbb928018aab5f7500bef51a2fd74d4fffb4a20a94673380600000000000000cdbc0800000000000000ffe2404d6a89df23c36f4ab8a166138b4e226b6d20d98010ab1ace49fa76dce337a5a5f1dcff9e5d533b12475e33b971b15b69cd591cd9059759f0f05ba5468a34b98915033debb3e87f448e86011a6467376785e2946be5e650068d8800db3b4139e3dbcb3057859e0f98f06ea7d4e47b788272e28c31b46330efd8c932fcd888495a68d22171ea5d35107b7d045dfaa4faeee3e1a1aa24367017baa0b888e0e788c64681c1f5158c77ad3c51663dab630f0c4243d3768f33dfc0c365495540134ddf90994de0b8fcb3e6b325d84f545edcc648395d224f5ff238ef226bde624075ab36a915cf6653ffbe8dfb2c5cc6d150e2bbbbe7a2a5d6242f03f808b3f71a2a829d0879658c5150c74ccd3ade0516dda285d4a6d3eb80fa6eb7cbca578e338a1e50b6de3c4d2c6211d8cad0591a20178b2daad730e189af1a34770a7cefa4a99096717e01b2e21a325cc1e4d0f386487c9d56a92249d961bf7d457952af43f1391f94c19525c461cc5977c1bbe33eea4a5b6ff92cd07d51925721ceafd64ec41c3fcb4ded90276558e1da") preadv(r1, &(0x7f0000000480), 0x10000000000002a1, 0x0) 12:33:48 executing program 0: syz_open_dev$sndctrl(&(0x7f0000000140)='/dev/snd/controlC#\x00', 0x0, 0x0) sched_setaffinity(0x0, 0x7, &(0x7f00000000c0)=0x9) r0 = perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0) fcntl$setflags(r0, 0x2, 0x1) getsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER_VALUE(0xffffffffffffffff, 0x84, 0x7c, &(0x7f00000001c0), &(0x7f0000000240)=0x8) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(0xffffffffffffffff, 0x84, 0x9, &(0x7f0000000280)={0x0, @in={{0x2, 0x4e23, @remote}}, 0xfffffffffffffff7, 0x0, 0x400}, 0x98) sendto$inet6(0xffffffffffffffff, &(0x7f00000004c0), 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x0, 0x0, @loopback}, 0x1c) setsockopt$SO_BINDTODEVICE(0xffffffffffffffff, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x4) socket$inet6(0xa, 0x1000000000002, 0x0) r1 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x4, 0x0, &(0x7f0000000100)=[@enter_looper], 0x1, 0x0, &(0x7f0000000180)='T'}) r2 = gettid() timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, &(0x7f0000040000)) tkill(r2, 0x1004000000016) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0xfffffffffffffced, 0x0, &(0x7f0000000040)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x400c630f}], 0x0, 0x0, &(0x7f0000000f4d)}) 12:33:48 executing program 2: perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f0000000180)=""/148, 0x13d}], 0x1, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000340)="696f001b66408225aaa3af068fffebb8a490c47dda6586f1b58895b94a78037dd3714e7198820a7a709e2d30d25e6d846cd5c62a648a598668a8263b752b0b622b115112b5ad8e0425c0b784bbdb89eb8f4da0dd73dd01fe35694c2f78600badf8a0e237dba40713bac9e053b41a9f62be5fbb928018aab5f7500bef51a2fd74d4fffb4a20a946733820bdc1b485afa417cdbcfdfbc54f58c9c3edffe240c36f4ab8a16613814e226b6d20d98010ab1ace49fa76dce337a5a5f1dcff9e5d533b12475e33b971b15b69cd591cd9059759f0f04ba5468a34b98915033debb3e87f048e8601712659d47d8687eb6be5e650068d88000000000000") preadv(r0, &(0x7f0000000480), 0x100000000000012c, 0x0) msgget$private(0x0, 0x22) 12:33:48 executing program 1: openat$audio(0xffffffffffffff9c, &(0x7f0000000080)='/dev/audio\x00', 0x40, 0x0) r0 = openat(0xffffffffffffffff, &(0x7f00000002c0)='./file0\x00', 0x4000, 0x104) preadv(r0, &(0x7f0000000280)=[{&(0x7f00000000c0)=""/90, 0x5a}, {&(0x7f0000000140)=""/21, 0xa}, {&(0x7f00000013c0)=""/4096, 0x1000}], 0x3, 0x0) setsockopt$bt_BT_CHANNEL_POLICY(0xffffffffffffffff, 0x112, 0xa, &(0x7f0000000040)=0x7, 0x4) r1 = syz_open_procfs(0x0, &(0x7f0000000340)="696f001b66408225aaa3af068fffebb8a490c47dda6586f1b58895b94a78037dd3714e7198820a7a709e2d30d25e6d846cd5c62a648a598668a8263b752b0b622b115112b5ad8e0425c0b784bbdb89eb8f4da0dd73dd01fe35694c2f78600badf8a0e237dba40713bac9e053b41a9f62be5fbb928018aab5f7500bef51a2fd74d4fffb4a20a946733820bdc1b485afa417cdbcfdfbc54f58c9c3edffe240c36f4ab8a16613814e226b6d20d98010ab1ace49fa76dce337a5a5f1dcff9e5d533b12475e33b971b15b69cd591cd9059759f0f04ba5468a34b98915033debb3e87f048e8601712659d47d8687eb6be5e650068d88000000000000") preadv(r1, &(0x7f0000000480), 0x10000000000002a1, 0x0) 12:33:48 executing program 5: preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f0000000180)=""/148, 0x13d}], 0x1, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000340)="696f001b66408225aaa3af068fffebb8a490c47dda6586f1b58895b94a78037dd3714e7198820a7a709e2d30d25e6d846cd5c62a648a598668a8263b752b0b622b115112b5ad8e0425c0b784bbdb89eb8f4da0dd73dd01fe35694c2f78600badf8a0e237dba40713bac9e053b41a9f62be5fbb928018aab5f7500bef51a2fd74d4fffb4a20a946733820bdc1b485afa417cdbcfdfbc54f58c9c3edffe240c36f4ab8a16613814e226b6d20d98010ab1ace49fa76dce337a5a5f1dcff9e5d533b12475e33b971b15b69cd591cd9059759f0f04ba5468a34b98915033debb3e87f048e8601712659d47d8687eb6be5e650068d88000000000000") preadv(r0, &(0x7f0000000480), 0x10000000000002a1, 0x0) openat$md(0xffffffffffffff9c, &(0x7f0000000000)='/dev/md0\x00', 0x0, 0x0) [ 450.875817] binder: BINDER_SET_CONTEXT_MGR already set 12:33:48 executing program 3: syz_open_dev$sndctrl(&(0x7f0000000140)='/dev/snd/controlC#\x00', 0x0, 0x0) sched_setaffinity(0x0, 0x7, &(0x7f00000000c0)=0x9) r0 = perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0) fcntl$setflags(r0, 0x2, 0x1) getsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER_VALUE(0xffffffffffffffff, 0x84, 0x7c, &(0x7f00000001c0), &(0x7f0000000240)=0x8) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(0xffffffffffffffff, 0x84, 0x9, &(0x7f0000000280)={0x0, @in={{0x2, 0x4e23, @remote}}, 0xfffffffffffffff7, 0x0, 0x400, 0x0, 0xc1}, 0x98) sendto$inet6(0xffffffffffffffff, &(0x7f00000004c0), 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) setsockopt$SO_BINDTODEVICE(0xffffffffffffffff, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x4) socket$inet6(0xa, 0x1000000000002, 0x0) r1 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x4, 0x0, &(0x7f0000000100)=[@enter_looper], 0x1, 0x0, &(0x7f0000000180)='T'}) r2 = gettid() timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, &(0x7f0000040000)) tkill(r2, 0x1004000000016) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0xfffffffffffffced, 0x0, &(0x7f0000000040)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x400c630f}], 0x0, 0x0, &(0x7f0000000f4d)}) 12:33:48 executing program 0: syz_open_dev$sndctrl(&(0x7f0000000140)='/dev/snd/controlC#\x00', 0x0, 0x0) sched_setaffinity(0x0, 0x7, &(0x7f00000000c0)=0x9) r0 = perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0) fcntl$setflags(r0, 0x2, 0x1) getsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER_VALUE(0xffffffffffffffff, 0x84, 0x7c, &(0x7f00000001c0), &(0x7f0000000240)=0x8) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(0xffffffffffffffff, 0x84, 0x9, &(0x7f0000000280)={0x0, @in={{0x2, 0x4e23, @remote}}, 0xfffffffffffffff7, 0x0, 0x400}, 0x98) sendto$inet6(0xffffffffffffffff, &(0x7f00000004c0), 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x0, 0x0, @loopback}, 0x1c) setsockopt$SO_BINDTODEVICE(0xffffffffffffffff, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x4) socket$inet6(0xa, 0x1000000000002, 0x0) r1 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x4, 0x0, &(0x7f0000000100)=[@enter_looper], 0x1, 0x0, &(0x7f0000000180)='T'}) r2 = gettid() timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, &(0x7f0000040000)) tkill(r2, 0x1004000000016) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0xfffffffffffffced, 0x0, &(0x7f0000000040)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x400c630f}], 0x0, 0x0, &(0x7f0000000f4d)}) 12:33:48 executing program 1: preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f0000000180)=""/148, 0x13d}], 0x1, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000440)="696f001b66408225aaa3af068fffebb8a490c47dda6586f1b58895b94a78037dd3714e7198820a7a709e2d30d25e6d846cd5c62a648a598668a8263b752b0b622b115112b5ad8e0425c0b784bbdb89eb8f4da0dd73dd01fe35694c2f78600badf8a0e237dba40713bac9e053b41a9f62be5fbb928018aab5f7500bef51a2fd74d4fffb4a20a946733820bdc1b485afa417cdbcfdfbc54f58c9c3edffe240c36f4ab8a16613814e226b6d20d98010341ace49fa76dce337a5a5f1dcff9e5d533b12475e33b971b15b69cd591cd9059759f0f04ba5468a34b98915033debb3e87f048e8601712659d47d8687eb6be5e650068d88000000000000b51759a9fac0ee4be71a61a392eafe3b6843db0e6743e588118d1601803118e24709f7f927e0e7755956b13cc464940faf91a81077a044e324a7b930a9e65b41a55214be0c1e68a6d4dd72ad80de136389e6c4aa28997d963a701c65df306c86b1e102856ed4ba3dd58656c4bf67b6efe9c4ee7f7a19a1c8ffef38d5dd3e3f481e887e3bbc8108fe8c509a2774fac2c910b87f11d39db76ad38083733650427c46d86c5513dd9cf9936ace1ec0e2d2430e34de21c9f950c67e81fbf59e26d6e7a7b2c43b807ac9d389779fc08399470491ce0e3b548cd7fed592df08cf9628f38ea5a55d7d8caab7e2b3ce8b5188e93520de99d56d2454f18021ae14cc2577483885") ioctl$KVM_ENABLE_CAP_CPU(r0, 0x4068aea3, &(0x7f0000000000)={0x7b, 0x0, [0x9, 0x400, 0xcd, 0x3]}) preadv(r0, &(0x7f0000000480), 0x10000000000002a1, 0x0) 12:33:48 executing program 2: perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f0000000180)=""/148, 0x13d}], 0x1, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000340)="696f001b66408225aaa3af068fffebb8a490c47dda6586f1b58895b94a78037dd3714e7198820a7a709e2d30d25e6d846cd5c62a648a598668a8263b752b0b622b115112b5ad8e0425c0b784bbdb89eb8f4da0dd73dd01fe35694c2f78600badf8a0e237dba40713bac9e053b41a9f62be5fbb928018aab5f7500bef51a2fd74d4fffb4a20a946733820bdc1b485afa417cdbcfdfbc54f58c9c3edffe240c36f4ab8a16613814e226b6d20d98010ab1ace49fa76dce337a5a5f1dcff9e5d533b12475e33b971b15b69cd591cd9059759f0f04ba5468a34b98915033debb3e87f048e8601712659d47d8687eb6be5e650068d88000000000000") preadv(r0, &(0x7f0000000480), 0x10000000000001d9, 0x0) msgget$private(0x0, 0x22) [ 450.927212] binder: 23754:23763 ioctl 40046207 0 returned -16 [ 450.954739] binder: 23754:23767 Acquire 1 refcount change on invalid ref 0 ret -22 [ 451.071447] binder: BINDER_SET_CONTEXT_MGR already set [ 451.080756] binder: 23784:23785 ioctl 40046207 0 returned -16 [ 451.151816] binder: 23784:23795 Acquire 1 refcount change on invalid ref 0 ret -22 12:33:48 executing program 4: socket$inet6(0xa, 0x0, 0x80000000) sched_setaffinity(0x0, 0x7, &(0x7f00000000c0)) r0 = perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0) fcntl$setflags(r0, 0x2, 0x1) r1 = socket$inet6(0xa, 0x400000000001, 0x0) r2 = dup(r1) setsockopt$inet6_tcp_int(r2, 0x6, 0x12, &(0x7f0000000000)=0x7f, 0x4) bind$inet6(r1, &(0x7f0000000040)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) getsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER_VALUE(r1, 0x84, 0x7c, &(0x7f00000001c0)={0x0, 0x100000001, 0x6}, &(0x7f0000000240)=0x8) sendto$inet6(r1, &(0x7f00000004c0), 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) setsockopt$SO_BINDTODEVICE(r1, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x4) socket$inet6(0xa, 0x1000000000002, 0x0) r3 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r3, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000200)={0x4, 0x0, &(0x7f0000000100)=[@enter_looper], 0x1, 0x0, &(0x7f0000000180)='T'}) r4 = gettid() timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, &(0x7f0000040000)) tkill(r4, 0x1004000000016) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0xfffffffffffffced, 0x0, &(0x7f0000000040)}) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x400c630f}], 0x0, 0x0, &(0x7f0000000f4d)}) 12:33:48 executing program 5: preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f0000000180)=""/148, 0x1e0}], 0x1, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000340)="696f001b66408225aaa3af068fffebb8a490c47dda6586f1b58895b94a78037dd3714e7198820a7a709e2d30d25e6d846cd5c62a648a598668a8263b752b0b622b115112b5ad8e0425c0b784bbdb89eb8f4da0dd73dd01fe35694c2f78600badf8a0e237dba40713bac9e053b41a9f62be5fbb928018aab5f7500bef51a2fd74d4fffb4a20a946733820bdc1b485afa417cdbcfdfbc54f58c9c3edffe240c36f4ab8a16613814e226b6d20d98010ab1ace49fa76dce337a5a5f1dcff9e5d533b12475e33b971b15b69cd591cd9059759f0f04ba5468a34b98915033debb3e87f048e8601712659d47d8687eb6be5e650068d88000000000000") preadv(r0, &(0x7f0000000480), 0x0, 0x0) 12:33:48 executing program 1: preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f0000000180)=""/148, 0x13d}], 0x1, 0x0) fcntl$getownex(0xffffffffffffffff, 0x10, &(0x7f0000000240)) r0 = memfd_create(&(0x7f0000000040)='&#[(\x00', 0x1) getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(0xffffffffffffff9c, 0x84, 0x73, &(0x7f0000000080)={0x0, 0x4, 0x30, 0xcd, 0xaaed}, &(0x7f00000000c0)=0x18) setsockopt$inet_sctp6_SCTP_RESET_STREAMS(r0, 0x84, 0x77, &(0x7f0000000100)={r1, 0x1e, 0x2, [0x1, 0xfff]}, 0xc) r2 = gettid() getpgid(0x0) ioctl$TIOCGSID(0xffffffffffffff9c, 0x5429, &(0x7f0000000140)) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000580)={0x0, 0xffffffffffffff9c, 0x0, 0x5, &(0x7f0000000540)='&#[(\x00', 0xffffffffffffffff}, 0x30) r3 = syz_open_procfs(r2, &(0x7f0000000440)="696f001b66408225aaa3af068fffebb8a490c47dda6586f1b58895b94a78037dd3714e7198820a7a709e2d30d25e6d846cd5c62a648a598668a8263b752b0b622b115112b5ad8e0425c0b784bbdb89eb8f4da0dd73dd01fe35694c2f78600badf8a0e237dba40713bac9e053b41a9f62be5fbb928018aab5f7500bef51a2fd74d4fffb4a20a946733820bdc1b485afa417cdbcfdfbc54f58c9c3edffe240c36f4ab8a16613814e226b6d20d98010ab1ace49fa76dce337a5a5f1dcff9e5d533b12475e33b971b15b69cd591cd9059759f0f04ba5468a34b98915033debb3e87f048e8601712659d47d8687eb6be5e650068d88000000000000") preadv(r3, &(0x7f0000000480), 0x10000000000002a1, 0x0) 12:33:48 executing program 3: socket$inet6(0xa, 0x0, 0x80000000) syz_open_dev$sndctrl(&(0x7f0000000140)='/dev/snd/controlC#\x00', 0x9, 0x400000) sched_setaffinity(0x0, 0x7, &(0x7f00000000c0)=0x9) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x400000000001, 0x0) r1 = dup(r0) setsockopt$inet6_tcp_int(r1, 0x6, 0x12, &(0x7f0000000000)=0x7f, 0x4) bind$inet6(r0, &(0x7f0000000040)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) getsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER_VALUE(r0, 0x84, 0x7c, &(0x7f00000001c0)={0x0, 0x100000001, 0x6}, &(0x7f0000000240)=0x8) sendto$inet6(r0, &(0x7f00000004c0), 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x4) socket$inet6(0xa, 0x1000000000002, 0x0) r2 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000200)={0x4, 0x0, &(0x7f0000000100)=[@enter_looper], 0x1, 0x0, &(0x7f0000000180)='T'}) r3 = gettid() timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, &(0x7f0000040000)) tkill(r3, 0x1004000000016) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0xfffffffffffffced, 0x0, &(0x7f0000000040)}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x400c630f}], 0x0, 0x0, &(0x7f0000000f4d)}) 12:33:48 executing program 2: perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f0000000180)=""/148, 0x13d}], 0x1, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000340)="696f001b66408225aaa3af068fffebb8a490c47dda6586f1b58895b94a78037dd3714e7198820a7a709e2d30d25e6d846cd5c62a648a598668a8263b752b0b622b115112b5ad8e0425c0b784bbdb89eb8f4da0dd73dd01fe35694c2f78600badf8a0e237dba40713bac9e053b41a9f62be5fbb928018aab5f7500bef51a2fd74d4fffb4a20a946733820bdc1b485afa417cdbcfdfbc54f58c9c3edffe240c36f4ab8a16613814e226b6d20d98010ab1ace49fa76dce337a5a5f1dcff9e5d533b12475e33b971b15b69cd591cd9059759f0f04ba5468a34b98915033debb3e87f048e8601712659d47d8687eb6be5e650068d88000000000000") preadv(r0, &(0x7f0000000480), 0x1000000000000102, 0x0) msgget$private(0x0, 0x22) 12:33:49 executing program 5: r0 = socket(0x1f, 0x8000000, 0x95f) preadv(r0, &(0x7f0000000000), 0x0, 0x7ffd) getpgrp(0x0) r1 = getpgrp(0x0) syz_open_procfs(r1, &(0x7f0000000540)='net/rfcomm\x00') 12:33:49 executing program 1: r0 = syz_open_dev$usbmon(&(0x7f0000000000)='/dev/usbmon#\x00', 0x10001, 0x0) ioctl$TIOCLINUX6(r0, 0x541c, &(0x7f0000000040)={0x6, 0xfc5000000000}) preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f0000000180)=""/148, 0x13d}], 0x1, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000340)="696f001b66408225aaa3af068fffebb8a490c47dda6586f1b58895b94a78037dd3714e7198820a7a709e2d30d25e6d846cd5c62a648a598668a8263b752b0b622b115112b5ad8e0425c0b784bbdb89eb8f4da0dd73dd01fe35694c2f78600badf8a0e237dba40713bac9e053b41a9f62be5fbb928018aab5f7500bef51a2fd74d4fffb4a20a946733820bdc1b485afa417cdbcfdfbc54f58c9c3edffe240c36f4ab8a16613814e226b6d20d98010ab1ace49fa76dce337a5a5f1dcff9e5d533b12475e33b971b15b69cd591cd9059759f0f04ba5468a34b98915033debb3e87f048e8601712659d47d8687eb6be5e650068d88000000000000") preadv(r1, &(0x7f0000000480), 0x10000000000002a1, 0x0) 12:33:49 executing program 2: perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f0000000180)=""/148, 0x13d}], 0x1, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000340)="696f001b66408225aaa3af068fffebb8a490c47dda6586f1b58895b94a78037dd3714e7198820a7a709e2d30d25e6d846cd5c62a648a598668a8263b752b0b622b115112b5ad8e0425c0b784bbdb89eb8f4da0dd73dd01fe35694c2f78600badf8a0e237dba40713bac9e053b41a9f62be5fbb928018aab5f7500bef51a2fd74d4fffb4a20a946733820bdc1b485afa417cdbcfdfbc54f58c9c3edffe240c36f4ab8a16613814e226b6d20d98010ab1ace49fa76dce337a5a5f1dcff9e5d533b12475e33b971b15b69cd591cd9059759f0f04ba5468a34b98915033debb3e87f048e8601712659d47d8687eb6be5e650068d88000000000000") preadv(r0, &(0x7f0000000480), 0x1000000000000277, 0x0) msgget$private(0x0, 0x22) [ 451.743397] binder: BINDER_SET_CONTEXT_MGR already set [ 451.757089] binder: 23809:23810 ioctl 40046207 0 returned -16 12:33:49 executing program 3: socket$inet6(0xa, 0x0, 0x80000000) syz_open_dev$sndctrl(&(0x7f0000000140)='/dev/snd/controlC#\x00', 0x9, 0x400000) sched_setaffinity(0x0, 0x7, &(0x7f00000000c0)=0x9) r0 = perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0) fcntl$setflags(r0, 0x2, 0x1) r1 = socket$inet6(0xa, 0x400000000001, 0x0) r2 = dup(r1) setsockopt$inet6_tcp_int(r2, 0x6, 0x12, &(0x7f0000000000)=0x7f, 0x4) bind$inet6(r1, &(0x7f0000000040)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) getsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER_VALUE(r1, 0x84, 0x7c, &(0x7f00000001c0)={0x0, 0x100000001, 0x6}, &(0x7f0000000240)=0x8) sendto$inet6(r1, &(0x7f00000004c0), 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) setsockopt$SO_BINDTODEVICE(r1, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x4) socket$inet6(0xa, 0x1000000000002, 0x0) r3 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r3, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000200)={0x4, 0x0, &(0x7f0000000100)=[@enter_looper], 0x1, 0x0, &(0x7f0000000180)='T'}) r4 = gettid() timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, &(0x7f0000040000)) tkill(r4, 0x1004000000016) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0xfffffffffffffced, 0x0, &(0x7f0000000040)}) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x400c630f}], 0x0, 0x0, &(0x7f0000000f4d)}) [ 451.842595] binder: 23809:23822 Acquire 1 refcount change on invalid ref 0 ret -22 [ 451.873984] binder_thread_write: 4 callbacks suppressed [ 451.873997] binder: 23809:23822 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 12:33:49 executing program 0: syz_open_dev$sndctrl(&(0x7f0000000140)='/dev/snd/controlC#\x00', 0x0, 0x0) sched_setaffinity(0x0, 0x7, &(0x7f00000000c0)=0x9) r0 = perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0) fcntl$setflags(r0, 0x2, 0x1) getsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER_VALUE(0xffffffffffffffff, 0x84, 0x7c, &(0x7f00000001c0), &(0x7f0000000240)=0x8) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(0xffffffffffffffff, 0x84, 0x9, &(0x7f0000000280)={0x0, @in={{0x2, 0x4e23, @remote}}, 0xfffffffffffffff7, 0x0, 0x400}, 0x98) sendto$inet6(0xffffffffffffffff, &(0x7f00000004c0), 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) setsockopt$SO_BINDTODEVICE(0xffffffffffffffff, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x4) socket$inet6(0xa, 0x0, 0x0) r1 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x4, 0x0, &(0x7f0000000100)=[@enter_looper], 0x1, 0x0, &(0x7f0000000180)='T'}) r2 = gettid() timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, &(0x7f0000040000)) tkill(r2, 0x1004000000016) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0xfffffffffffffced, 0x0, &(0x7f0000000040)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x400c630f}], 0x0, 0x0, &(0x7f0000000f4d)}) 12:33:49 executing program 5: preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f0000000180)=""/148, 0x13d}], 0x1, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000340)="696f001b66408225aaa3af068fffebb8a490c47dda6586f1b58895b94a78037dd3714e7198820a7a709e2d30d25e6d846cd5c62a648a598668a8263b752b0b622b115112b5ad8e0425c0b784bbdb89eb8f4da0dd73dd01fe35694c2f78600badf8a0e237dba40713bac9e053b41a9f62be5fbb928018aab5f7500bef51a2fd74d4fffb4a20a946733820bdc1b485afa417cdbcfdfbc54f58c9c3edffe240c36f4ab8a16613814e226b6d20d98010ab1ace49fa76dce337a5a5f1dcff9e5d533b12475e33b971b15b69cd591cd9059759f0f04ba5468a34b98915033debb3e87f048e8601712659d47d8687eb6be5e650068d88000000000000") preadv(r0, &(0x7f0000000480), 0x10000000000002a1, 0x0) getsockopt$inet_IP_IPSEC_POLICY(r0, 0x0, 0x10, &(0x7f0000000000)={{{@in=@dev, @in=@local}}, {{@in6=@dev}, 0x0, @in=@multicast1}}, &(0x7f0000000100)=0xe8) preadv(r0, &(0x7f0000000580)=[{&(0x7f0000000240)=""/228, 0xe4}, {&(0x7f0000000440)=""/209, 0xd1}, {&(0x7f0000000140)=""/18, 0x12}, {&(0x7f0000000540)=""/17, 0x11}], 0x4, 0x0) 12:33:49 executing program 1: preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f0000000180)=""/148, 0x13d}], 0x1, 0x0) pipe2$9p(&(0x7f0000000000), 0x84800) r0 = syz_open_procfs(0x0, &(0x7f0000000340)="696f001b66408225aaa3af068fffebb8a490c47dda6586f1b58895b94a78037dd3714e7198820a7a709e2d30d25e6d846cd5c62a648a598668a8263b752b0b622b115112b5ad8e0425c0b784bbdb89eb8f4da0dd73dd01fe35694c2f78600badf8a0e237dba40713bac9e053b41a9f62be5fbb928018aab5f7500bef51a2fd74d4fffb4a20a946733820bdc1b485afa417cdbcfdfbc54f58c9c3edffe240c36f4ab8a16613814e226b6d20d98010ab1ace49fa76dce337a5a5f1dcff9e5d533b12475e33b971b15b69cd591cd9059759f0f04ba5468a34b98915033debb3e87f048e8601712659d47d8687eb6be5e650068d88000000000000") preadv(r0, &(0x7f0000000480), 0x10000000000002a1, 0x0) [ 451.908524] binder: 23809:23830 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 12:33:49 executing program 5: preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f0000000180)=""/148, 0x13d}], 0x1, 0x0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000000)={0x0}, &(0x7f0000000040)=0xc) r1 = fcntl$getown(0xffffffffffffff9c, 0x9) r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000080)={0xc, 0xba6, 0x7, 0x1f, 0x4, 0xffffffffffffff9c, 0x103115af}, 0x2c) r3 = syz_open_dev$audion(&(0x7f00000000c0)='/dev/audio#\x00', 0x1ff, 0x8000) r4 = socket$inet_udplite(0x2, 0x2, 0x88) kcmp$KCMP_EPOLL_TFD(r0, r1, 0x7, r2, &(0x7f0000000100)={r3, r4, 0x100000000}) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000140)={r3, 0x0, 0xf6, 0xb3, &(0x7f0000000240)="01e8158c4ff5ae26c9fdd347a211780e737cfff7d273c5c8e45d59e03d23b00fa20dbdd3b0dcc72746fd06fcffd4e31c8ee7c721bf88b74d8f0172af5b7fdf8fa15ac59a41abcda9ccfb5cef70c854bf11f02a8b96415734da63548e54b6b5de6d4f8fbfbc03e5d676024360ec4567669c08bb834def005057db39818125e495ddb5b2432a205d306104b6e6bb90004dac384a40b1542bc981ecb75fde9131c497f02514eafc9496d198a175c3741990cb92a218850891e62a48b23a513c03fc904dd1bde357becc4134a883b7ac1b91e36bbd5edc4aa1d7b9be23634ea3015e6d69a76b5f41e130c3b53ddc58a562095df22c3350d0", &(0x7f0000000440)=""/179, 0x4}, 0x28) r5 = syz_open_procfs(0x0, &(0x7f0000000340)="696f001b66408225aaa3af068fffebb8a490c47dda6586f1b58895b94a78037dd3714e7198820a7a709e2d30d25e6d846cd5c62a648a598668a8263b752b0b622b115112b5ad8e0425c0b784bbdb89eb8f4da0dd73dd01fe35694c2f78600badf8a0e237dba40713bac9e053b41a9f62be5fbb928018aab5f7500bef51a2fd74d4fffb4a20a946733820bdc1b485afa417cdbcfdfbc54f58c9c3edffe240c36f4ab8a16613814e226b6d20d98010ab1ace49fa76dce337a5a5f1dcff9e5d533b12475e33b971b15b69cd591cd9059759f0f04ba5468a34b98915033debb3e87f048e8601712659d47d8687eb6be5e650068d88000000000000") preadv(r5, &(0x7f0000000480), 0x10000000000002a1, 0x0) 12:33:49 executing program 2: perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f0000000180)=""/148, 0x13d}], 0x1, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000340)="696f001b66408225aaa3af068fffebb8a490c47dda6586f1b58895b94a78037dd3714e7198820a7a709e2d30d25e6d846cd5c62a648a598668a8263b752b0b622b115112b5ad8e0425c0b784bbdb89eb8f4da0dd73dd01fe35694c2f78600badf8a0e237dba40713bac9e053b41a9f62be5fbb928018aab5f7500bef51a2fd74d4fffb4a20a946733820bdc1b485afa417cdbcfdfbc54f58c9c3edffe240c36f4ab8a16613814e226b6d20d98010ab1ace49fa76dce337a5a5f1dcff9e5d533b12475e33b971b15b69cd591cd9059759f0f04ba5468a34b98915033debb3e87f048e8601712659d47d8687eb6be5e650068d88000000000000") preadv(r0, &(0x7f0000000480), 0x1000000000000276, 0x0) msgget$private(0x0, 0x22) 12:33:49 executing program 3: r0 = socket$inet6(0xa, 0x400000000001, 0x0) r1 = dup(r0) setsockopt$inet6_tcp_int(r1, 0x6, 0x20000000000002, &(0x7f00007b1000)=0x81, 0x4) bind$inet6(r0, &(0x7f00000000c0)={0xa, 0x4e20}, 0x1c) setsockopt$inet6_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000440)='vegas\x00', 0x6) sendto$inet6(r0, &(0x7f0000e77fff), 0x2bd, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) listen(0xffffffffffffffff, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) clone(0x0, &(0x7f0000000240), &(0x7f0000000100), &(0x7f0000000140), &(0x7f0000000180)) r2 = open(&(0x7f0000000040)='./bus\x00', 0x141042, 0x0) ftruncate(r2, 0x7fff) sendfile(r1, r2, &(0x7f0000d83ff8), 0x8000fffffffe) ioctl$EVIOCSABS20(r1, 0x401845e0, &(0x7f0000000080)={0x81, 0x7, 0x0, 0x0, 0x7, 0x93b6}) getsockname$inet6(r0, &(0x7f0000000000)={0xa, 0x0, 0x0, @remote}, &(0x7f0000000180)=0x1c) 12:33:49 executing program 1: preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f0000000180)=""/148, 0x13d}], 0x1, 0x0) r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_buf(r0, 0x6, 0x1c, &(0x7f0000000000)="ed8ccbdf768a96f9032666a2ce118c78c467c2d0ea8c17b77ccd0daefd58e3c40c5722bbfcfe32e16076b709b36e66e40dce37d6b0fe7833efb0fd9d7b9b3d2a6b70948b664a640b81", 0x49) r1 = syz_open_procfs(0x0, &(0x7f0000000340)="696f001b66408225aaa3af068fffebb8a490c47dda6586f1b58895b94a78037dd3714e7198820a7a709e2d30d25e6d846cd5c62a648a598668a8263b752b0b622b115112b5ad8e0425c0b784bbdb89eb8f4da0dd73dd01fe35694c2f78600badf8a0e237dba40713bac9e053b41a9f62be5fbb928018aab5f7500bef51a2fd74d4fffb4a20a946733820bdc1b485afa417cdbcfdfbc54f58c9c3edffe240c36f4ab8a16613814e226b6d20d98010ab1ace49fa76dce337a5a5f1dcff9e5d533b12475e33b971b15b69cd591cd9059759f0f04ba5468a34b98915033debb3e87f048e8601712659d47d8687eb6be5e650068d88000000000000") preadv(r1, &(0x7f00000000c0), 0x1153, 0x1200000000000) 12:33:49 executing program 4: socket$inet6(0xa, 0x0, 0x80000000) sched_setaffinity(0x0, 0x7, &(0x7f00000000c0)=0x9) r0 = perf_event_open(&(0x7f0000000040)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0) fcntl$setflags(r0, 0x2, 0x1) r1 = socket$inet6(0xa, 0x400000000001, 0x0) r2 = dup(r1) setsockopt$inet6_tcp_int(r2, 0x6, 0x12, &(0x7f0000000000)=0x7f, 0x4) bind$inet6(r1, &(0x7f0000000040)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) getsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER_VALUE(r1, 0x84, 0x7c, &(0x7f00000001c0)={0x0, 0x100000001, 0x6}, &(0x7f0000000240)=0x8) sendto$inet6(r1, &(0x7f00000004c0), 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) setsockopt$SO_BINDTODEVICE(r1, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x4) socket$inet6(0xa, 0x1000000000002, 0x0) r3 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r3, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000200)={0x4, 0x0, &(0x7f0000000100)=[@enter_looper], 0x1, 0x0, &(0x7f0000000180)='T'}) r4 = gettid() timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, &(0x7f0000040000)) tkill(r4, 0x1004000000016) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0xfffffffffffffced, 0x0, &(0x7f0000000040)}) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x400c630f}], 0x0, 0x0, &(0x7f0000000f4d)}) 12:33:49 executing program 0: syz_open_dev$sndctrl(&(0x7f0000000140)='/dev/snd/controlC#\x00', 0x0, 0x0) sched_setaffinity(0x0, 0x7, &(0x7f00000000c0)=0x9) r0 = perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0) fcntl$setflags(r0, 0x2, 0x1) getsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER_VALUE(0xffffffffffffffff, 0x84, 0x7c, &(0x7f00000001c0), &(0x7f0000000240)=0x8) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(0xffffffffffffffff, 0x84, 0x9, &(0x7f0000000280)={0x0, @in={{0x2, 0x4e23, @remote}}, 0xfffffffffffffff7, 0x0, 0x400}, 0x98) sendto$inet6(0xffffffffffffffff, &(0x7f00000004c0), 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) setsockopt$SO_BINDTODEVICE(0xffffffffffffffff, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x4) socket$inet6(0xa, 0x0, 0x0) r1 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x4, 0x0, &(0x7f0000000100)=[@enter_looper], 0x1, 0x0, &(0x7f0000000180)='T'}) r2 = gettid() timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, &(0x7f0000040000)) tkill(r2, 0x1004000000016) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0xfffffffffffffced, 0x0, &(0x7f0000000040)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x400c630f}], 0x0, 0x0, &(0x7f0000000f4d)}) [ 452.597233] binder: BINDER_SET_CONTEXT_MGR already set 12:33:49 executing program 5: preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f0000000180)=""/148, 0x13d}], 0x1, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000340)="696f001b66408225aaa3af068fffebb8a490c47dda6586f1b58895b94a78037dd3714e7198820a7a709e2d30d25e6d846cd5c62a648a598668a8263b752b0b622b115112b5ad8e0425c0b784bbdb89eb8f4da0dd73dd01fe35694c2f78600badf8a0e237dba40713bac9e053b41a9f62be5fbb928018aab5f7500bef51a2fd74d4fffb4a20a946733820bdc1b485afa417cdbcfdfbc54f58c9c3edffe240c36f4ab8a16613814e226b6d20d98010ab1ace49fa76dce337a5a5f1dcff9e5d533b12475e33b971b15b69cd591cd9059759f0f04ba5468a34b98915033debb3e87f048e8601712659d47d8687eb6be5e650068d88000000000000") preadv(r0, &(0x7f0000000040), 0x0, 0x4) 12:33:50 executing program 1: preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f0000000180)=""/148, 0x13d}], 0x1, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000000)="696f001b66408225aaa3af068fffebb8a490c47dda6586f1b58895b94a78037dd3714e7198820a7a709e2d30d25e6d846cd5c62a648a598668a8263b752b0b622b115112b5ad8e0425c0b784bbdb89eb8f4da0dd73dd01fe35694c2f78600bdba40713bac9e053b41a9f62be5fbb928018aab5f7500bef51a2fd74d4fffb4a20a946733820bdc1b485afa417cdbcfdfbc54f58c9c3edffe240c36f4ab8a16613814e226b6d20d98010ab1ace49fa76dce337a5a5f1dcff9e5d533b12475e33b971b15b69cd591cd9059759f0f04ba5468a34b98915033debb3e850068d88000000000000000000000000000000000000000000000000000000") preadv(r0, &(0x7f0000000480), 0x10000000000002a1, 0x0) 12:33:50 executing program 2: perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f0000000180)=""/148, 0x13d}], 0x1, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000340)="696f001b66408225aaa3af068fffebb8a490c47dda6586f1b58895b94a78037dd3714e7198820a7a709e2d30d25e6d846cd5c62a648a598668a8263b752b0b622b115112b5ad8e0425c0b784bbdb89eb8f4da0dd73dd01fe35694c2f78600badf8a0e237dba40713bac9e053b41a9f62be5fbb928018aab5f7500bef51a2fd74d4fffb4a20a946733820bdc1b485afa417cdbcfdfbc54f58c9c3edffe240c36f4ab8a16613814e226b6d20d98010ab1ace49fa76dce337a5a5f1dcff9e5d533b12475e33b971b15b69cd591cd9059759f0f04ba5468a34b98915033debb3e87f048e8601712659d47d8687eb6be5e650068d88000000000000") preadv(r0, &(0x7f0000000480), 0x100000000000019f, 0x0) msgget$private(0x0, 0x22) [ 452.648353] binder: 23863:23866 ioctl 40046207 0 returned -16 12:33:50 executing program 0: syz_open_dev$sndctrl(&(0x7f0000000140)='/dev/snd/controlC#\x00', 0x0, 0x0) sched_setaffinity(0x0, 0x7, &(0x7f00000000c0)=0x9) r0 = perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0) fcntl$setflags(r0, 0x2, 0x1) getsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER_VALUE(0xffffffffffffffff, 0x84, 0x7c, &(0x7f00000001c0), &(0x7f0000000240)=0x8) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(0xffffffffffffffff, 0x84, 0x9, &(0x7f0000000280)={0x0, @in={{0x2, 0x4e23, @remote}}, 0xfffffffffffffff7, 0x0, 0x400}, 0x98) sendto$inet6(0xffffffffffffffff, &(0x7f00000004c0), 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) setsockopt$SO_BINDTODEVICE(0xffffffffffffffff, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x4) socket$inet6(0xa, 0x0, 0x0) r1 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x4, 0x0, &(0x7f0000000100)=[@enter_looper], 0x1, 0x0, &(0x7f0000000180)='T'}) r2 = gettid() timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, &(0x7f0000040000)) tkill(r2, 0x1004000000016) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0xfffffffffffffced, 0x0, &(0x7f0000000040)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x400c630f}], 0x0, 0x0, &(0x7f0000000f4d)}) [ 452.714020] binder: 23863:23866 Acquire 1 refcount change on invalid ref 0 ret -22 [ 452.741152] binder: 23863:23866 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 452.774072] binder: 23863:23872 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 12:33:50 executing program 3: r0 = socket$inet6(0xa, 0x400000000001, 0x0) r1 = dup(r0) setsockopt$inet6_tcp_int(r1, 0x6, 0x20000000000002, &(0x7f00007b1000)=0x81, 0x4) bind$inet6(r0, &(0x7f00000000c0)={0xa, 0x4e20}, 0x1c) setsockopt$inet6_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000440)='vegas\x00', 0x6) sendto$inet6(r0, &(0x7f0000e77fff), 0x2bd, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) listen(0xffffffffffffffff, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) clone(0x0, &(0x7f0000000240), &(0x7f0000000100), &(0x7f0000000140), &(0x7f0000000180)) r2 = open(&(0x7f0000000040)='./bus\x00', 0x141042, 0x0) ftruncate(r2, 0x7fff) sendfile(r1, r2, &(0x7f0000d83ff8), 0x8000fffffffe) ioctl$EVIOCSABS20(r1, 0x401845e0, &(0x7f0000000080)={0x81, 0x7, 0x0, 0x0, 0x7, 0x93b6}) getsockname$inet6(r0, &(0x7f0000000000)={0xa, 0x0, 0x0, @remote}, &(0x7f0000000180)=0x1c) 12:33:50 executing program 1: ioctl$KVM_CREATE_DEVICE(0xffffffffffffffff, 0xc00caee0, &(0x7f0000000100)={0x3, 0xffffffffffffff9c, 0x1}) preadv(r0, &(0x7f00000000c0), 0x0, 0x47) socket$l2tp(0x18, 0x1, 0x1) r1 = syz_open_procfs(0x0, &(0x7f0000000340)="696f001b66408225aaa3af068fffebb8a490c47dda6586f1b58895b94a78037dd3714e7198820a7a709e2d30d25e6d846cd5c62a648a598668a8263b752b0b622b115112b5ad8e0425c0b784bbdb89eb8f4da0dd73dd01fe35694c2f78600badf8a0e237dba40713bac9e053b41a9f62be5fbb928018aab5f7500bef51a2fd74d4fffb4a20a946733820bdc1b485afa417cdbcfdfbc54f58c9c3edffe240c36f4ab8a16613814e226b6d20d98010ab1ace49fa76dce337a5a5f1dcff9e5d533b12475e33b971b15b69cd591cd9059759f0f04ba5468a34b98915033debb3e87f048e8601712659d47d8687eb6be5e650068d88000000000000") preadv(r1, &(0x7f0000000480), 0x10000000000002a1, 0x0) 12:33:50 executing program 5: preadv(0xffffffffffffffff, &(0x7f0000001380), 0x0, 0x0) r0 = openat$vhci(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/vhci\x00', 0x105400, 0x0) preadv(r0, &(0x7f00000001c0)=[{&(0x7f0000000100)=""/133, 0x85}], 0x1, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000340)="696f001b66408225aaa3af068fffebb8a490c47dda6586f1b58895b94a78037dd3714e7198820a7a709e2d30d25e6d846cd5c62a648a598668a8263b752b0b622b115112b5ad8e0425c0b784bbdb89eb8f4da0dd73dd01fe35694c2f78600badf8a0e237dba40713bac9e053b41a9f62be5fbb928018aab5f7500bef51a2fd74d4fffb4a20a946733820bdc1b485afa417cdbcfdfbc54f58c9c3edffe240c36f4ab8a16613814e226b6d20d98010ab1ace49fa76dce337a5a5f1dcff9e5d533b12475e33b971b15b69cd591cd9059759f0f04ba5468a34b98915033debb3e87f048e8601712659d47d8687eb6be5e650068d88000000000000") preadv(r1, &(0x7f0000000480), 0x10000000000002a1, 0x0) ioctl$SNDRV_SEQ_IOCTL_GET_QUEUE_INFO(r1, 0xc08c5334, &(0x7f0000000000)={0x81, 0x1, 0xff, 'queue0\x00', 0xc5}) 12:33:50 executing program 2: perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f0000000180)=""/148, 0x13d}], 0x1, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000340)="696f001b66408225aaa3af068fffebb8a490c47dda6586f1b58895b94a78037dd3714e7198820a7a709e2d30d25e6d846cd5c62a648a598668a8263b752b0b622b115112b5ad8e0425c0b784bbdb89eb8f4da0dd73dd01fe35694c2f78600badf8a0e237dba40713bac9e053b41a9f62be5fbb928018aab5f7500bef51a2fd74d4fffb4a20a946733820bdc1b485afa417cdbcfdfbc54f58c9c3edffe240c36f4ab8a16613814e226b6d20d98010ab1ace49fa76dce337a5a5f1dcff9e5d533b12475e33b971b15b69cd591cd9059759f0f04ba5468a34b98915033debb3e87f048e8601712659d47d8687eb6be5e650068d88000000000000") preadv(r0, &(0x7f0000000480), 0x1000000000000144, 0x0) msgget$private(0x0, 0x22) 12:33:50 executing program 0: syz_open_dev$sndctrl(&(0x7f0000000140)='/dev/snd/controlC#\x00', 0x0, 0x0) sched_setaffinity(0x0, 0x7, &(0x7f00000000c0)=0x9) r0 = perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0) fcntl$setflags(r0, 0x2, 0x1) getsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER_VALUE(0xffffffffffffffff, 0x84, 0x7c, &(0x7f00000001c0), &(0x7f0000000240)=0x8) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(0xffffffffffffffff, 0x84, 0x9, &(0x7f0000000280)={0x0, @in={{0x2, 0x4e23, @remote}}, 0xfffffffffffffff7, 0x0, 0x400}, 0x98) sendto$inet6(0xffffffffffffffff, &(0x7f00000004c0), 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) setsockopt$SO_BINDTODEVICE(0xffffffffffffffff, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x4) socket$inet6(0xa, 0x1000000000002, 0x0) r1 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x4, 0x0, &(0x7f0000000100)=[@enter_looper], 0x1, 0x0, &(0x7f0000000180)='T'}) r2 = gettid() timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, &(0x7f0000040000)) tkill(r2, 0x1004000000016) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0xfffffffffffffced, 0x0, &(0x7f0000000040)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x400c630f}], 0x0, 0x0, &(0x7f0000000f4d)}) 12:33:50 executing program 1: r0 = syz_open_dev$usbmon(&(0x7f0000000000)='/dev/usbmon#\x00', 0x3, 0x400) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffff9c, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x2, &(0x7f0000000040)={0xffffffffffffffff}, 0x13f, 0x1009}}, 0x20) write$RDMA_USER_CM_CMD_REJECT(r0, &(0x7f0000000440)={0x9, 0x108, 0xfa00, {r1, 0x81, "eefc7d", "594cbae2e43d4a6cf33b9115740a681749e6a16c41501839c03abbf6783d549137e54ca2fa1eedf022185a8829b019d48e99ce9a6036c24fe98b91a12fed545c459cdbc318baa714acaa12916510df1a6540d79abe6fa308c68418697a3d4c436404daf1787ea749c8ace1493cd8606106e9605399e0105f6d934151dd6f6952b8fc21e6f70bae63bc3fa885ffd25248686291b450c2785579ece551930dea4db0ceb3adc94230c1774aeae78ab32529aeaa47a356dd9bbe0274e715362b3202991be26c40518505bbebb389e6a67d52523f309c1d464fb24300b5a6f1b04b88cef1b24a13ab60a9480903f5804b2fca0dedbdc9a4c621e1ed22b949765b4d37"}}, 0x110) preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f0000000180)=""/148, 0x13d}], 0x1, 0x0) sendmsg$unix(r0, &(0x7f0000000a40)={&(0x7f00000000c0)=@file={0x1, './file0\x00'}, 0x6e, &(0x7f00000009c0)=[{&(0x7f0000000140)="03840dfd3f2e499e74c66cc94f1d25a37e7274a41b0455ecee6473", 0x1b}, {&(0x7f0000000240)="906cdab3bc6bb0d4011e2226eb1ae86fd7ce1b751748cc84487848775cba54001cc2a06dd2a1e30804f6d62a0efabce52326e998b782b16e58e92cb9f158871ee8f11148a6d5d680d6bbe39538d90336e5367450275cf51e9772ab7cf10fd4c95e0db9127796ba0a394c1ecb083e466327ea3e35571a416f6bcbb2e0aba3a77880fe594d", 0x84}, {&(0x7f0000000580)="61855a461b89cc4bbba0f083536096a29624812cd04cd339813c844f8a6ebe2570d01e7f3e5f391e2727290deb5a6981d2588827ad2d91986aacd45005a3cc0f6e79b6fec8233638946d02567d91e9e0e26cd801f8e2cd313d3d7efe665f627a868722754322a9292498d4976f8711be34042b298b2fcc21a7cb835d076df207d8169aca77cd9ee2fc98798a2e68c5c4076a8ddff94bbe029f5ed34bf8d5d5a1193f2a5d85c1c9ae8f913137abd5e9eac9aa7037264347bbf7a11a9f26ec48b996bafae34ba6e27aa078701bc2627b636f4f701c1a5887c38ec8866561a484a292f95b8a652305bb7fdcef73c9f192fcfbe1d4", 0xf3}, {&(0x7f0000000680)="1005ca7b91647b819b7e464a5c433088f46c535aca3b31add1c7ddc2d9f4272ce93adefdf1cef2bcb34e9eb80a79387eaf8f782ac28422dcb6278701856f41b7b4b20b0d79bc1bd5a71a5086065269deee09e355945f032bcc7ab9b61c0cdb64e238ad7b833981af9382fcc4d91853", 0x6f}, {&(0x7f0000000700)="1df1c665a4e3b2b5b9b7233fbc93d5ec29da3fc647ba10dfafe74f3fd5ebd9152baac104a83737fff496df3f9099af8c05b5e2efe57c9fc6e052cc3c4a3ef4dce79fd498fbe20edc365800893702cec223ab95b544a8141834681e37a4f09265e09a1f8c13cb084d0f83a85f57697e660b0d5324d72e1250658e7196083440f79a5ce3fb7ca97109", 0x88}, {&(0x7f00000007c0)="d2e7207705d7427d5d456bd59b00f1b8fe19882cf529f1652a1cfe3309d73077163488101254456c12e10784519d98a66e2c002f1f1f147141f54eb2d1e51163876a", 0x42}, {&(0x7f0000000840)="ee86e3d4fbb897c061d420507780fd18daf64baf13361717851b38e7fd0c86678ae1afe1cec41f2e0014fd3895a8af9ed89dfed69918522aa67df1a96426b769c5a24050d463092286d836629ef6b1fd1452e72a20b13ce338380efd6c678344c200fbc6a77446a579aa94a863c7d143fa080c6080ce5c8233", 0x79}, {&(0x7f00000008c0)="1e17703219659d3af75e5d956359ce43ace12cf25bf842043d5667491c6091a9667012393164f827f906d2e063a94d202cf64c7aff8597828c9df21abaf26d6be2c636e0566ea8dbd0524b8a481468c793b1ce0797097928322f569e457029de416144239744908b1664b8c9c4d114c2bc1603b08bc5612e755d6bf4a10eb4c0c7b4c4bee7a57ad3e679f044ca419bc9ab7002d356def9adc68eb492a235dfadc08886c8946c5bc731aeb55e61e25e686ff279d9c1541ce18e9f8cfcf0d90824657ee28e9b", 0xc5}], 0x8, &(0x7f0000000300)=[@rights={0x38, 0x1, 0x1, [r0, r0, r0, r0, r0, r0, r0, r0, r0, r0]}], 0x38, 0x40000c0}, 0x4000000) r2 = syz_open_procfs(0x0, &(0x7f0000000340)="696f001b66408225aaa3af068fffebb8a490c47dda6586f1b58895b94a78037dd3714e7198820a7a709e2d30d25e6d846cd5c62a648a598668a8263b752b0b622b115112b5ad8e0425c0b784bbdb89eb8f4da0dd73dd01fe35694c2f78600badf8a0e237dba40713bac9e053b41a9f62be5fbb928018aab5f7500bef51a2fd74d4fffb4a20a946733820bdc1b485afa417cdbcfdfbc54f58c9c3edffe240c36f4ab8a16613814e226b6d20d98010ab1ace49fa76dce337a5a5f1dcff9e5d533b12475e33b971b15b69cd591cd9059759f0f04ba5468a34b98915033debb3e87f048e8601712659d47d8687eb6be5e650068d88000000000000") preadv(r2, &(0x7f0000000480), 0x10000000000002a1, 0x0) getsockname$packet(r2, &(0x7f0000000b40)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @local}, &(0x7f0000000b80)=0x14) ioctl$ifreq_SIOCGIFINDEX_team(r0, 0x8933, &(0x7f0000000bc0)={'team0\x00', r3}) [ 453.024657] binder: 23902:23905 Acquire 1 refcount change on invalid ref 0 ret -22 [ 453.061762] binder: 23902:23905 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 453.070794] binder: 23902:23913 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 12:33:50 executing program 3: r0 = socket$inet6(0xa, 0x400000000001, 0x0) r1 = dup(r0) setsockopt$inet6_tcp_int(r1, 0x6, 0x20000000000002, &(0x7f00007b1000)=0x81, 0x4) bind$inet6(r0, &(0x7f00000000c0)={0xa, 0x4e20}, 0x1c) setsockopt$inet6_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000440)='vegas\x00', 0x6) sendto$inet6(r0, &(0x7f0000e77fff), 0x2bd, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) listen(0xffffffffffffffff, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) clone(0x0, &(0x7f0000000240), &(0x7f0000000100), &(0x7f0000000140), &(0x7f0000000180)) r2 = open(&(0x7f0000000040)='./bus\x00', 0x141042, 0x0) ftruncate(r2, 0x7fff) sendfile(r1, r2, &(0x7f0000d83ff8), 0x8000fffffffe) ioctl$EVIOCSABS20(r1, 0x401845e0, &(0x7f0000000080)={0x81, 0x7, 0x0, 0x0, 0x7, 0x93b6}) getsockname$inet6(r0, &(0x7f0000000000)={0xa, 0x0, 0x0, @remote}, &(0x7f0000000180)=0x1c) 12:33:50 executing program 5: preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f0000000180)=""/148, 0x13d}], 0x1, 0x0) r0 = syz_open_dev$dmmidi(&(0x7f0000000900)='/dev/dmmidi#\x00', 0x5f3, 0x400) getsockopt$XDP_MMAP_OFFSETS(r0, 0x11b, 0x1, &(0x7f0000000940), &(0x7f00000009c0)=0x60) r1 = syz_open_procfs(0x0, &(0x7f0000000340)="696f001b66408225aaa3af068fffebb8a490c47dda6586f1b58895b94a78037dd3714e7198820a7a709e2d30d25e6d846cd5c62a648a598668a8263b752b0b622b115112b5ad8e0425c0b784bbdb89eb8f4da0dd73dd01fe35694c2f78600badf8a0e237dba40713bac9e053b41a9f62be5fbb928018aab5f7500bef51a2fd74d4fffb4a20a946733820bdc1b485afa417cdbcfdfbc54f58c9c3edffe240c36f4ab8a16613814e226b6d20d98010ab1ace49fa76dce337a5a5f1dcff9e5d533b12475e33b971b15b69cd591cd9059759f0f04ba5468a34b98915033debb3e87f048e8601712659d47d8687eb6be5e650068d88000000000000") preadv(r1, &(0x7f0000000480), 0x1000000000000070, 0x0) ioctl$VHOST_SET_VRING_ERR(r1, 0x4008af22, &(0x7f0000000000)={0x2, r1}) 12:33:50 executing program 1: openat$kvm(0xffffffffffffff9c, &(0x7f0000000000)='/dev/kvm\x00', 0x200, 0x0) pipe(&(0x7f0000000040)) r0 = accept4(0xffffffffffffffff, &(0x7f0000000080)=@vsock={0x28, 0x0, 0x0, @reserved}, &(0x7f0000000100)=0x80, 0x0) preadv(r0, &(0x7f0000000140), 0x1af, 0xffffffffffffffff) r1 = syz_open_procfs(0x0, &(0x7f0000000340)="696f001b66408225aaa3af068fffebb8a490c47dda6586f1b58895b94a78037dd3714e7198820a7a709e2d30d25e6d846cd5c62a648a598668a8263b752b0b622b115112b5ad8e0425c0b784bbdb89eb8f4da0dd73dd01fe35694c2f78600badf8a0e237dba40713bac9e053b41a9f62be5fbb928018aab5f7500bef51a2fd74d4fffb4a20a946733820bdc1b485afa417cdbcfdfbc54f58c9c3edffe240c36f4ab8a16613814e226b6d20d98010ab1ace49fa76dce337a5a5f1dcff9e5d533b12475e33b971b15b69cd591cd9059759f0f04ba5468a34b98915033debb3e87f048e8601712659d47d8687eb6be5e650068d88000000000000") preadv(r1, &(0x7f0000000480), 0x10000000000002a1, 0x0) getsockopt$inet_IP_XFRM_POLICY(r1, 0x0, 0x11, &(0x7f00000007c0)={{{@in=@loopback, @in=@multicast1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@loopback}, 0x0, @in6=@loopback}}, &(0x7f00000008c0)=0xe8) ioctl$sock_inet6_SIOCDIFADDR(r1, 0x8936, &(0x7f0000000900)={@remote, 0x53, r2}) 12:33:50 executing program 4: socket$inet6(0xa, 0x0, 0x80000000) sched_setaffinity(0x0, 0x7, &(0x7f00000000c0)=0x9) r0 = perf_event_open(&(0x7f0000000040)={0x1, 0x70}, 0x0, 0x0, 0xffffffffffffffff, 0x0) fcntl$setflags(r0, 0x2, 0x1) r1 = socket$inet6(0xa, 0x400000000001, 0x0) r2 = dup(r1) setsockopt$inet6_tcp_int(r2, 0x6, 0x12, &(0x7f0000000000)=0x7f, 0x4) bind$inet6(r1, &(0x7f0000000040)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) getsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER_VALUE(r1, 0x84, 0x7c, &(0x7f00000001c0)={0x0, 0x100000001, 0x6}, &(0x7f0000000240)=0x8) sendto$inet6(r1, &(0x7f00000004c0), 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) setsockopt$SO_BINDTODEVICE(r1, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x4) socket$inet6(0xa, 0x1000000000002, 0x0) r3 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r3, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000200)={0x4, 0x0, &(0x7f0000000100)=[@enter_looper], 0x1, 0x0, &(0x7f0000000180)='T'}) r4 = gettid() timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, &(0x7f0000040000)) tkill(r4, 0x1004000000016) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0xfffffffffffffced, 0x0, &(0x7f0000000040)}) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x400c630f}], 0x0, 0x0, &(0x7f0000000f4d)}) 12:33:50 executing program 2: perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f0000000180)=""/148, 0x13d}], 0x1, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000340)="696f001b66408225aaa3af068fffebb8a490c47dda6586f1b58895b94a78037dd3714e7198820a7a709e2d30d25e6d846cd5c62a648a598668a8263b752b0b622b115112b5ad8e0425c0b784bbdb89eb8f4da0dd73dd01fe35694c2f78600badf8a0e237dba40713bac9e053b41a9f62be5fbb928018aab5f7500bef51a2fd74d4fffb4a20a946733820bdc1b485afa417cdbcfdfbc54f58c9c3edffe240c36f4ab8a16613814e226b6d20d98010ab1ace49fa76dce337a5a5f1dcff9e5d533b12475e33b971b15b69cd591cd9059759f0f04ba5468a34b98915033debb3e87f048e8601712659d47d8687eb6be5e650068d88000000000000") preadv(r0, &(0x7f0000000480), 0x1000000000000056, 0x0) msgget$private(0x0, 0x22) 12:33:50 executing program 5: r0 = syz_open_procfs(0x0, &(0x7f0000000340)="696f001b66408225aaa3af068fffebb8a490c47dda6586f1b58895b94a78037dd3714e7198820a7a709e2d30d25e6d846cd5c62a648a598668a8263b752b0b622b115112b5ad8e0425c0b784bbdb89eb8f4da0dd73dd01fe35694c2f78600badf8a0e237dba40713bac9e053b41a9f62be5fbb928018aab5f7500bef51a2fd74d4fffb4a20a946733820bdc1b485afa417cdbcfdfbc54f58c9c3edffe240c36f4ab8a16613814e226b6d20d98010ab1ace49fa76dce337a5a5f1dcff9e5d533b12475e33b971b15b69cd591cd9059759f0f04ba5468a34b98915033debb3e87f048e8601712659d47d8687eb6be5e650068d88000000000000") socket$vsock_stream(0x28, 0x1, 0x0) ioctl$EVIOCSKEYCODE_V2(r0, 0x40284504, &(0x7f0000000000)={0xffffffff, 0x7, 0x0, 0x5, "94ef85aa02832544fe552c5d09a2bf749c8ec94f5439edda623f06c2dc4d4e9d"}) preadv(r0, &(0x7f0000000000), 0x0, 0x0) getresuid(&(0x7f0000000040), &(0x7f0000000080)=0x0, &(0x7f00000000c0)) setsockopt$inet_IP_IPSEC_POLICY(r0, 0x0, 0x10, &(0x7f0000000100)={{{@in6=@loopback, @in6=@ipv4={[], [], @dev={0xac, 0x14, 0x14, 0xb}}, 0x4e22, 0x9, 0x4e24, 0x4, 0x0, 0x20, 0x20, 0x7b, 0x0, r1}, {0x8001, 0x3, 0x2, 0x3476, 0x1, 0x1f, 0x3f, 0x7f}, {0x8, 0x2, 0x1, 0x4}, 0xfffffffffffffffe, 0x6e6bbb, 0x0, 0x0, 0x3, 0x3}, {{@in6=@loopback, 0x4d4, 0x7c}, 0x0, @in=@multicast1, 0x34ff, 0x1, 0x1, 0x0, 0x1, 0x8, 0x9}}, 0xe8) 12:33:50 executing program 1: preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f0000000180)=""/148, 0x13d}], 0x1, 0x0) r0 = syz_open_dev$midi(&(0x7f00000000c0)='/dev/midi#\x00', 0x6, 0xa0000) getsockopt$inet_sctp6_SCTP_GET_ASSOC_STATS(0xffffffffffffffff, 0x84, 0x70, &(0x7f0000000240)={0x0, @in={{0x2, 0x4e24, @rand_addr=0x7fff}}, [0xfffffffffffffefb, 0x80000001, 0x5, 0x7, 0x79e3, 0x101, 0x3, 0x5, 0x3c, 0x518, 0x8, 0x4, 0x5, 0x5, 0x80000000]}, &(0x7f0000000100)=0x100) setsockopt$inet_sctp6_SCTP_ENABLE_STREAM_RESET(r0, 0x84, 0x76, &(0x7f0000000140)={r1}, 0x8) r2 = syz_open_procfs(0x0, &(0x7f0000000000)='nche\x00') r3 = fcntl$dupfd(r2, 0x406, r2) ioctl$PIO_UNISCRNMAP(r0, 0x4b6a, &(0x7f0000000340)="c8e1cbf0b8d4a634b82a0de38ffc6e6e6f3a7025ad39755b7a1015f44a85acdc7d2d7c5ea29bb5a9f5309092805cdc5c5407923849570fe9e95385a71ee0f1db3089e98d9e10e3d2734f") getsockopt$inet6_dccp_buf(r3, 0x21, 0xd, &(0x7f0000000040)=""/28, &(0x7f0000000080)=0x1c) ioctl$KVM_SET_LAPIC(r3, 0x4400ae8f, &(0x7f00000003c0)={"7fdfffef0e1e6ed1ef764133060b9579fe3c824f652ac6cd4f0d93c91c7e32cafb4a7ea187afe7280c5321a8cd61de4c842902ec57c75d2a30b8f0a537fb038b29468b70b7b8c5a708899aacd9b846653e7f1e9e9ddfab8404a53315287bf791a509dffa9cca53099db4f5a55f6890526ea92d9d4f5f84a81733c21a743c63cd4f4c2169a980f04b4a50c2d189ffa24fc41ff3eaf2573cfbb0f176585a784639e4c9e55e09d360a23b230eeff1a8285d2648672dd4696551794ac5148e589f08a8aadd39a24dceb6b5f941d4cd7b084a229fceccc5eedccb8e4479e98f0dc7f02604ef707cb8b864092489a5dc054c1796486f5048165d495e0cd9f6a021fa06484e65b7beed3ebedb85db48553f2809c52f99f98586e3d2897b041a2c9afc157ecb5bafb66412d9bf79a22a1252a4c769fdee8cade8ef2c47595668e12fd25ada29df794979e221761d1e3501f7f41bf6adf9e1addaf2dd8759323dd3613ea92739c767d6cba2bc27f4b98de27593b3747d269e4f786fb648958b2c5c97368ac2d3da91cdee05ab75b1234603acbdeb4d32f5d62e88bced7cb89f033b94cdbad40c5dd3a3026ce1d230638143a61ed159612422a0fe1fbb50d3b0d03c3e774467e4cc8492d26c81c70c2676a0dada965d7794d36a9f61074719e3dae1ddb9e9581a2884aa8f9806cba3b51476ed6f3fa5a39945d2f28f080671e77923638977fe981633f7b960252b2afc91cb4755b2315532f4b42c5cadf94bab8982cb9aa219db24e37e3262610006daa6b5e143f2450f5edb0b93c066e051b1eb81213c8e1beea40c6c9fc320b530e6f478c40145aabeac8e9e6c2ab379643f64271d3f73faf69d08ff1cabe153c88d384868db3ce5a9882d929c98f1cabbbed60c15408ffef31ead4e36a07c0a6a3e598e3ae3bbb4c4c031592b19366466565a410737e731d8a2ac8ff430c476176579bb81fa0c39f3aafab24e87718606458cfc3a37c3db395cc0ecf408bd7045791038cc91e6ed94811be4167b83b489269ab304a72ae27fe03e535aeaac570aea6dda832d7d094b051bdce78b49f841fb0f8cbc2753098b01a2193294ca2c1560d8214cc1b0c066c5ea9c5c0bd970f03e8bea6a50fd5d0f8ed44182e311a73b1f78048a15bd42e7a7e9d25afef1a67aef69b47cd16af7357fda94c4f8c98b6af68ef1ce38d2d78a3fec22cae8212c8f26871573cb49940f756a7cdc2a053854ac94a34f2605a294ef238ee3ef355d58e2b9d3457e5a0840593f91a576576b6ce5d028b1dda98cec7fcb963e62e8d560d21f896095bde4943d09ab3b4d8f53839b575236222d952bba508781d1b81ea85438daf92a2145015b80c5550baf664093280190edac4001d8ab385baa5152fc72d5a76f5753b9c8264f0ae9c2f035d7d02a4671eff55cd8550fc710476764f70d2602a83e01"}) ioctl$DRM_IOCTL_GEM_OPEN(0xffffffffffffffff, 0xc010640b, &(0x7f00000007c0)={0x0, 0x0, 0x100}) ioctl$DRM_IOCTL_GEM_OPEN(r3, 0xc010640b, &(0x7f0000000800)={r4, 0x0, 0x7}) preadv(r2, &(0x7f0000000480), 0x10000000000002a1, 0x0) ioctl$VT_WAITACTIVE(r2, 0x5607) 12:33:50 executing program 2: perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f0000000180)=""/148, 0x13d}], 0x1, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000340)="696f001b66408225aaa3af068fffebb8a490c47dda6586f1b58895b94a78037dd3714e7198820a7a709e2d30d25e6d846cd5c62a648a598668a8263b752b0b622b115112b5ad8e0425c0b784bbdb89eb8f4da0dd73dd01fe35694c2f78600badf8a0e237dba40713bac9e053b41a9f62be5fbb928018aab5f7500bef51a2fd74d4fffb4a20a946733820bdc1b485afa417cdbcfdfbc54f58c9c3edffe240c36f4ab8a16613814e226b6d20d98010ab1ace49fa76dce337a5a5f1dcff9e5d533b12475e33b971b15b69cd591cd9059759f0f04ba5468a34b98915033debb3e87f048e8601712659d47d8687eb6be5e650068d88000000000000") preadv(r0, &(0x7f0000000480), 0x1000000000000151, 0x0) msgget$private(0x0, 0x22) 12:33:50 executing program 5: preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f0000000180)=""/148, 0x13d}], 0x1, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000340)="696f001b66408225aaa3af068fffebb8a490c47dda6586f1b58895b94a78037dd3714e7198820a7a709e2d30d25e6d846cd5c62a648a598668a8263b752b0b622b115112b5ad8e0425c0b784bbdb89eb8f4da0dd73dd01fe35694c2f78600badf8a0e237dba40713bac9e053b41a9f62be5fbb928018aab5f7500bef51a2fd74d4fffb4a20a946733820bdc1b485afa417cdbcfdfbc54f58c9c3edffe240c36f4ab8a16613814e226b6d20d98010ab1ace49fa76dce337a5a5f1dcff9e5d533b12475e33b971b15b69cd591cd9059759f0f04ba5468a34b98915033debb3e87f048e8601712659d47d8687eb6be5e650068d88000000000000") clone(0x42008000, &(0x7f0000000040)="06330d455a71210e207a2182e5f7b3de6d30ba5abb7ebb25d8e0f0946293b9846ac5165d52e4e022ea39699648a703fb05a5653a8064fefbfb36ef9f110318ce3e46ff69df52a6101821676defd111bb4b7284683cfccdb831a2a1c1ec8ab098", &(0x7f00000000c0), &(0x7f0000000100), &(0x7f0000000240)="879723346386ed535174182b26dcabcfd89aef2872780444c02628503d614fe286dde9429392d2df77da6bbf8c698da5a20dc97992f786460a80eb1f7c3d10b3fa4ec4305b83aebc2f4fca803e27c5cf7427ff5fd3dbe83c31148b2e") setsockopt$inet6_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f0000000000)='reno\x00', 0x5) preadv(r0, &(0x7f0000000480), 0x10000000000002a1, 0x0) 12:33:50 executing program 4: socket$inet6(0xa, 0x0, 0x80000000) sched_setaffinity(0x0, 0x7, &(0x7f00000000c0)=0x9) r0 = perf_event_open(&(0x7f0000000040)={0x1, 0x70}, 0x0, 0x0, 0xffffffffffffffff, 0x0) fcntl$setflags(r0, 0x2, 0x1) r1 = socket$inet6(0xa, 0x400000000001, 0x0) r2 = dup(r1) setsockopt$inet6_tcp_int(r2, 0x6, 0x12, &(0x7f0000000000)=0x7f, 0x4) bind$inet6(r1, &(0x7f0000000040)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) getsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER_VALUE(r1, 0x84, 0x7c, &(0x7f00000001c0)={0x0, 0x100000001, 0x6}, &(0x7f0000000240)=0x8) sendto$inet6(r1, &(0x7f00000004c0), 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) setsockopt$SO_BINDTODEVICE(r1, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x4) socket$inet6(0xa, 0x1000000000002, 0x0) r3 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r3, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000200)={0x4, 0x0, &(0x7f0000000100)=[@enter_looper], 0x1, 0x0, &(0x7f0000000180)='T'}) r4 = gettid() timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, &(0x7f0000040000)) tkill(r4, 0x1004000000016) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0xfffffffffffffced, 0x0, &(0x7f0000000040)}) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x400c630f}], 0x0, 0x0, &(0x7f0000000f4d)}) [ 453.695840] IPVS: ftp: loaded support on port[0] = 21 12:33:51 executing program 0: syz_open_dev$sndctrl(&(0x7f0000000140)='/dev/snd/controlC#\x00', 0x0, 0x0) sched_setaffinity(0x0, 0x7, &(0x7f00000000c0)=0x9) r0 = perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0) fcntl$setflags(r0, 0x2, 0x1) getsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER_VALUE(0xffffffffffffffff, 0x84, 0x7c, &(0x7f00000001c0), &(0x7f0000000240)=0x8) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(0xffffffffffffffff, 0x84, 0x9, &(0x7f0000000280)={0x0, @in={{0x2, 0x4e23, @remote}}, 0xfffffffffffffff7, 0x0, 0x400}, 0x98) sendto$inet6(0xffffffffffffffff, &(0x7f00000004c0), 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) setsockopt$SO_BINDTODEVICE(0xffffffffffffffff, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x4) socket$inet6(0xa, 0x1000000000002, 0x0) r1 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x4, 0x0, &(0x7f0000000100)=[@enter_looper], 0x1, 0x0, &(0x7f0000000180)='T'}) r2 = gettid() timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, &(0x7f0000040000)) tkill(r2, 0x1004000000016) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0xfffffffffffffced, 0x0, &(0x7f0000000040)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x400c630f}], 0x0, 0x0, &(0x7f0000000f4d)}) 12:33:51 executing program 1: preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f0000000180)=""/148, 0x13d}], 0x1, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000340)="696f001b66408225aaa3af068fffebb8a490c47dda6586f1b58895b94a78037dd3714e7198820a7a709e2d30d25e6d846cd5c62a648a598668a8263b752b0b622b115112b5ad8e0425c0b784bbdb89eb8f4da0dd73dd01fe35694c2f78600badf8a0e237dba40713bac9e053b41a9f62be5fbb928018aab5f7500bef51a2fd74d4fffb4a20a946733820bdc1b485afa417cdbcfdfbc54f58c9c3edffe240c36f4ab8a16613814e226b6d20d98010ab1ace49fa76dce337a5a5f1dcff9e5d533b12475e33b971b15b69cd591cd9059759f0f04ba5468a34b98915033debb3e87f048e8601712659d47d8687eb6be5e650068d88000000000000") preadv(r0, &(0x7f0000000480), 0x10000000000002a1, 0x0) ioctl$KVM_SET_FPU(r0, 0x41a0ae8d, &(0x7f0000000440)={[], 0x6136, 0xffff, 0x8, 0x0, 0x0, 0x5000, 0x4001, [], 0x6da3}) 12:33:51 executing program 3: syz_open_dev$sndctrl(&(0x7f0000000140)='/dev/snd/controlC#\x00', 0x0, 0x0) sched_setaffinity(0x0, 0x7, &(0x7f00000000c0)=0x9) r0 = perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0) fcntl$setflags(r0, 0x2, 0x1) getsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER_VALUE(0xffffffffffffffff, 0x84, 0x7c, &(0x7f00000001c0), &(0x7f0000000240)=0x8) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(0xffffffffffffffff, 0x84, 0x9, &(0x7f0000000280)={0x0, @in={{0x2, 0x4e23, @remote}}, 0xfffffffffffffff7, 0x0, 0x400}, 0x98) sendto$inet6(0xffffffffffffffff, &(0x7f00000004c0), 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) setsockopt$SO_BINDTODEVICE(0xffffffffffffffff, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x4) socket$inet6(0xa, 0x0, 0x0) r1 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x4, 0x0, &(0x7f0000000100)=[@enter_looper], 0x1, 0x0, &(0x7f0000000180)='T'}) r2 = gettid() timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, &(0x7f0000040000)) tkill(r2, 0x1004000000016) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0xfffffffffffffced, 0x0, &(0x7f0000000040)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x400c630f}], 0x0, 0x0, &(0x7f0000000f4d)}) 12:33:51 executing program 2: perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f0000000180)=""/148, 0x13d}], 0x1, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000340)="696f001b66408225aaa3af068fffebb8a490c47dda6586f1b58895b94a78037dd3714e7198820a7a709e2d30d25e6d846cd5c62a648a598668a8263b752b0b622b115112b5ad8e0425c0b784bbdb89eb8f4da0dd73dd01fe35694c2f78600badf8a0e237dba40713bac9e053b41a9f62be5fbb928018aab5f7500bef51a2fd74d4fffb4a20a946733820bdc1b485afa417cdbcfdfbc54f58c9c3edffe240c36f4ab8a16613814e226b6d20d98010ab1ace49fa76dce337a5a5f1dcff9e5d533b12475e33b971b15b69cd591cd9059759f0f04ba5468a34b98915033debb3e87f048e8601712659d47d8687eb6be5e650068d88000000000000") preadv(r0, &(0x7f0000000480), 0x1000000000000106, 0x0) msgget$private(0x0, 0x22) 12:33:51 executing program 4: socket$inet6(0xa, 0x0, 0x80000000) sched_setaffinity(0x0, 0x7, &(0x7f00000000c0)=0x9) r0 = perf_event_open(&(0x7f0000000040)={0x1, 0x70}, 0x0, 0x0, 0xffffffffffffffff, 0x0) fcntl$setflags(r0, 0x2, 0x1) r1 = socket$inet6(0xa, 0x400000000001, 0x0) r2 = dup(r1) setsockopt$inet6_tcp_int(r2, 0x6, 0x12, &(0x7f0000000000)=0x7f, 0x4) bind$inet6(r1, &(0x7f0000000040)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) getsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER_VALUE(r1, 0x84, 0x7c, &(0x7f00000001c0)={0x0, 0x100000001, 0x6}, &(0x7f0000000240)=0x8) sendto$inet6(r1, &(0x7f00000004c0), 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) setsockopt$SO_BINDTODEVICE(r1, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x4) socket$inet6(0xa, 0x1000000000002, 0x0) r3 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r3, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000200)={0x4, 0x0, &(0x7f0000000100)=[@enter_looper], 0x1, 0x0, &(0x7f0000000180)='T'}) r4 = gettid() timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, &(0x7f0000040000)) tkill(r4, 0x1004000000016) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0xfffffffffffffced, 0x0, &(0x7f0000000040)}) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x400c630f}], 0x0, 0x0, &(0x7f0000000f4d)}) [ 453.881026] binder: BINDER_SET_CONTEXT_MGR already set [ 453.889584] binder: 23963:23974 ioctl 40046207 0 returned -16 12:33:51 executing program 2: perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f0000000180)=""/148, 0x13d}], 0x1, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000340)="696f001b66408225aaa3af068fffebb8a490c47dda6586f1b58895b94a78037dd3714e7198820a7a709e2d30d25e6d846cd5c62a648a598668a8263b752b0b622b115112b5ad8e0425c0b784bbdb89eb8f4da0dd73dd01fe35694c2f78600badf8a0e237dba40713bac9e053b41a9f62be5fbb928018aab5f7500bef51a2fd74d4fffb4a20a946733820bdc1b485afa417cdbcfdfbc54f58c9c3edffe240c36f4ab8a16613814e226b6d20d98010ab1ace49fa76dce337a5a5f1dcff9e5d533b12475e33b971b15b69cd591cd9059759f0f04ba5468a34b98915033debb3e87f048e8601712659d47d8687eb6be5e650068d88000000000000") preadv(r0, &(0x7f0000000480), 0x100000000000006f, 0x0) msgget$private(0x0, 0x22) 12:33:51 executing program 1: preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f0000000180)=""/148, 0x94}], 0x1, 0x0) r0 = fcntl$getown(0xffffffffffffff9c, 0x9) r1 = syz_open_procfs(r0, &(0x7f0000000340)='attr/current\x00') getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @link_local}, &(0x7f0000000040)=0xfffffffffffffeee) connect$can_bcm(r1, &(0x7f0000000240)={0x1d, r2}, 0x10) preadv(r1, &(0x7f0000000480), 0x10000000000002a1, 0x0) ioctl$TIOCPKT(r1, 0x5420, &(0x7f0000000000)=0x8) r3 = add_key$keyring(&(0x7f0000000080)='keyring\x00', &(0x7f00000000c0)={0x73, 0x79, 0x7a, 0x2}, 0x0, 0x0, 0xfffffffffffffffd) r4 = add_key(&(0x7f0000000140)='rxrpc\x00', &(0x7f0000000280)={0x73, 0x79, 0x7a, 0x3}, 0x0, 0x0, 0xfffffffffffffffc) keyctl$reject(0x13, r3, 0x6, 0x3, r4) [ 453.921721] binder: undelivered death notification, 0000000000000000 [ 453.944774] binder: 23963:23964 Acquire 1 refcount change on invalid ref 0 ret -22 12:33:51 executing program 0: syz_open_dev$sndctrl(&(0x7f0000000140)='/dev/snd/controlC#\x00', 0x0, 0x0) sched_setaffinity(0x0, 0x7, &(0x7f00000000c0)=0x9) r0 = perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0) fcntl$setflags(r0, 0x2, 0x1) getsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER_VALUE(0xffffffffffffffff, 0x84, 0x7c, &(0x7f00000001c0), &(0x7f0000000240)=0x8) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(0xffffffffffffffff, 0x84, 0x9, &(0x7f0000000280)={0x0, @in={{0x2, 0x4e23, @remote}}, 0xfffffffffffffff7, 0x0, 0x400}, 0x98) sendto$inet6(0xffffffffffffffff, &(0x7f00000004c0), 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) setsockopt$SO_BINDTODEVICE(0xffffffffffffffff, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x4) socket$inet6(0xa, 0x1000000000002, 0x0) r1 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x4, 0x0, &(0x7f0000000100)=[@enter_looper], 0x1, 0x0, &(0x7f0000000180)='T'}) r2 = gettid() timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, &(0x7f0000040000)) tkill(r2, 0x1004000000016) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0xfffffffffffffced, 0x0, &(0x7f0000000040)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x400c630f}], 0x0, 0x0, &(0x7f0000000f4d)}) 12:33:51 executing program 4: socket$inet6(0xa, 0x0, 0x80000000) sched_setaffinity(0x0, 0x7, &(0x7f00000000c0)=0x9) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0) fcntl$setflags(0xffffffffffffffff, 0x2, 0x1) r0 = socket$inet6(0xa, 0x400000000001, 0x0) r1 = dup(r0) setsockopt$inet6_tcp_int(r1, 0x6, 0x12, &(0x7f0000000000)=0x7f, 0x4) bind$inet6(r0, &(0x7f0000000040)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) getsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER_VALUE(r0, 0x84, 0x7c, &(0x7f00000001c0)={0x0, 0x100000001, 0x6}, &(0x7f0000000240)=0x8) sendto$inet6(r0, &(0x7f00000004c0), 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x4) socket$inet6(0xa, 0x1000000000002, 0x0) r2 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000200)={0x4, 0x0, &(0x7f0000000100)=[@enter_looper], 0x1, 0x0, &(0x7f0000000180)='T'}) r3 = gettid() timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, &(0x7f0000040000)) tkill(r3, 0x1004000000016) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0xfffffffffffffced, 0x0, &(0x7f0000000040)}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x400c630f}], 0x0, 0x0, &(0x7f0000000f4d)}) [ 453.980932] binder: 23963:23964 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 453.989982] IPVS: ftp: loaded support on port[0] = 21 [ 454.034492] binder: 23963:23974 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 12:33:51 executing program 1: r0 = getpid() waitid(0x3, r0, &(0x7f0000000000), 0x8, 0x0) preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f0000000180)=""/148, 0x13d}], 0x1, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000340)="696f001b66408225aaa3af068fffebb8a490c47dda6586f1b58895b94a78037dd3714e7198820a7a709e2d30d25e6d846cd5c62a648a598668a8263b752b0b622b115112b5ad8e0425c0b784bbdb89eb8f4da0dd73dd01fe35694c2f78600badf8a0e237dba40713bac9e053b41a9f62be5fbb928018aab5f7500bef51a2fd74d4fffb4a20a946733820bdc1b485afa417cdbcfdfbc54f58c9c3edffe240c36f4ab8a16613814e226b6d20d98010ab1ace49fa76dce337a5a5f1dcff9e5d533b12475e33b971b15b69cd591cd9059759f0f04ba5468a34b98915033debb3e87f048e8601712659d47d8687eb6be5e650068d88000000000000") preadv(r1, &(0x7f0000000480), 0x10000000000002a1, 0x0) [ 454.100269] binder: 23984:23989 Acquire 1 refcount change on invalid ref 0 ret -22 [ 454.134951] binder: 23984:23989 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 454.155502] binder: 23984:23992 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 12:33:53 executing program 5: r0 = syz_open_dev$dmmidi(&(0x7f0000000000)='/dev/dmmidi#\x00', 0x4, 0x200000) ioctl$TUNGETIFF(r0, 0x800454d2, &(0x7f0000000040)) preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f0000000180)=""/148, 0x13d}], 0x1, 0x0) mkdir(&(0x7f0000000080)='./file0\x00', 0x2) r1 = syz_open_procfs(0x0, &(0x7f0000000340)="696f001b66408225aaa3af068fffebb8a490c47dda6586f1b58895b94a78037dd3714e7198820a7a709e2d30d25e6d846cd5c62a648a598668a8263b752b0b622b115112b5ad8e0425c0b784bbdb89eb8f4da0dd73dd01fe35694c2f78600badf8a0e237dba40713bac9e053b41a9f62be5fbb928018aab5f7500bef51a2fd74d4fffb4a20a946733820bdc1b485afa417cdbcfdfbc54f58c9c3edffe240c36f4ab8a16613814e226b6d20d98010ab1ace49fa76dce337a5a5f1dcff9e5d533b12475e33b971b15b69cd591cd9059759f0f04ba5468a34b98915033debb3e87f048e8601712659d47d8687eb6be5e650068d88000000000000") preadv(r1, &(0x7f0000000480), 0x10000000000002a1, 0x0) 12:33:53 executing program 2: perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f0000000180)=""/148, 0x13d}], 0x1, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000340)="696f001b66408225aaa3af068fffebb8a490c47dda6586f1b58895b94a78037dd3714e7198820a7a709e2d30d25e6d846cd5c62a648a598668a8263b752b0b622b115112b5ad8e0425c0b784bbdb89eb8f4da0dd73dd01fe35694c2f78600badf8a0e237dba40713bac9e053b41a9f62be5fbb928018aab5f7500bef51a2fd74d4fffb4a20a946733820bdc1b485afa417cdbcfdfbc54f58c9c3edffe240c36f4ab8a16613814e226b6d20d98010ab1ace49fa76dce337a5a5f1dcff9e5d533b12475e33b971b15b69cd591cd9059759f0f04ba5468a34b98915033debb3e87f048e8601712659d47d8687eb6be5e650068d88000000000000") preadv(r0, &(0x7f0000000480), 0x100000000000008b, 0x0) msgget$private(0x0, 0x22) 12:33:53 executing program 4: socket$inet6(0xa, 0x0, 0x80000000) sched_setaffinity(0x0, 0x7, &(0x7f00000000c0)=0x9) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0) fcntl$setflags(0xffffffffffffffff, 0x2, 0x0) r0 = socket$inet6(0xa, 0x400000000001, 0x0) r1 = dup(r0) setsockopt$inet6_tcp_int(r1, 0x6, 0x12, &(0x7f0000000000)=0x7f, 0x4) bind$inet6(r0, &(0x7f0000000040)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) getsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER_VALUE(r0, 0x84, 0x7c, &(0x7f00000001c0)={0x0, 0x100000001, 0x6}, &(0x7f0000000240)=0x8) sendto$inet6(r0, &(0x7f00000004c0), 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x4) socket$inet6(0xa, 0x1000000000002, 0x0) r2 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000200)={0x4, 0x0, &(0x7f0000000100)=[@enter_looper], 0x1, 0x0, &(0x7f0000000180)='T'}) r3 = gettid() timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, &(0x7f0000040000)) tkill(r3, 0x1004000000016) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0xfffffffffffffced, 0x0, &(0x7f0000000040)}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x400c630f}], 0x0, 0x0, &(0x7f0000000f4d)}) 12:33:53 executing program 1: stat(&(0x7f0000000200)='./file0\x00', &(0x7f0000000240)) r0 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vhost-vsock\x00', 0x2, 0x0) preadv(r0, &(0x7f0000001380)=[{&(0x7f0000000040)=""/148, 0x3d3}], 0x1, 0x0) gettid() r1 = creat(&(0x7f0000000400)='./file0\x00', 0x0) ioctl$TIOCGPGRP(r1, 0x540f, &(0x7f00000003c0)) r2 = gettid() r3 = syz_open_procfs(r2, &(0x7f0000000100)="696f001b66408225aaa3af068fffebb8a490c47dda6586f1b58895b94a78037dd3714e7198820a7a709e2d30d25e6d846cd5c62a648a598668a8263b752b0b622b115112b5ad8e0425c0b784bbdb89eb8f4da0dd73dd01fe35694c2f78600badf8a0e237dba40713bac9e053b41a9f62be5fbb928018aab5f7500bef51a2fd74d4fffb4a20a946733820bdc1b4858bd617cdbcfdfbc54f58c9c3edffe240c36f4ab8a16613814e226b6d20d98010ab1ace49fa76dce337a5a5f1dcff9e5d533b12475e33b971b15b69cd591cd9059759f0f04ba5468a34b98915033debb3e87f048e8601712659d47d8687eb6be5e650068d88000000000000") preadv(r3, &(0x7f0000000480), 0x10000000000002a1, 0x0) 12:33:53 executing program 3: syz_open_dev$sndctrl(&(0x7f0000000140)='/dev/snd/controlC#\x00', 0x0, 0x0) sched_setaffinity(0x0, 0x7, &(0x7f00000000c0)=0x9) r0 = perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0) fcntl$setflags(r0, 0x2, 0x1) getsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER_VALUE(0xffffffffffffffff, 0x84, 0x7c, &(0x7f00000001c0), &(0x7f0000000240)=0x8) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(0xffffffffffffffff, 0x84, 0x9, &(0x7f0000000280)={0x0, @in={{0x2, 0x4e23, @remote}}, 0xfffffffffffffff7, 0x0, 0x400}, 0x98) sendto$inet6(0xffffffffffffffff, &(0x7f00000004c0), 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) setsockopt$SO_BINDTODEVICE(0xffffffffffffffff, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x4) socket$inet6(0xa, 0x1000000000002, 0x0) r1 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x4, 0x0, &(0x7f0000000100)=[@enter_looper], 0x1, 0x0, &(0x7f0000000180)='T'}) r2 = gettid() timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, &(0x7f0000040000)) tkill(r2, 0x1004000000016) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0xfffffffffffffced, 0x0, &(0x7f0000000040)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x400c630f}], 0x0, 0x0, &(0x7f0000000f4d)}) 12:33:53 executing program 0: syz_open_dev$sndctrl(&(0x7f0000000140)='/dev/snd/controlC#\x00', 0x0, 0x0) sched_setaffinity(0x0, 0x7, &(0x7f00000000c0)=0x9) r0 = perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0) fcntl$setflags(r0, 0x2, 0x1) getsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER_VALUE(0xffffffffffffffff, 0x84, 0x7c, &(0x7f00000001c0), &(0x7f0000000240)=0x8) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(0xffffffffffffffff, 0x84, 0x9, &(0x7f0000000280)={0x0, @in={{0x2, 0x4e23, @remote}}, 0xfffffffffffffff7, 0x0, 0x400}, 0x98) sendto$inet6(0xffffffffffffffff, &(0x7f00000004c0), 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) setsockopt$SO_BINDTODEVICE(0xffffffffffffffff, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x4) socket$inet6(0xa, 0x1000000000002, 0x0) r1 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000200)={0x4, 0x0, &(0x7f0000000100)=[@enter_looper], 0x1, 0x0, &(0x7f0000000180)='T'}) r2 = gettid() timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, &(0x7f0000040000)) tkill(r2, 0x1004000000016) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0xfffffffffffffced, 0x0, &(0x7f0000000040)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x400c630f}], 0x0, 0x0, &(0x7f0000000f4d)}) 12:33:53 executing program 1: preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f0000000180)=""/148, 0x13d}], 0x1, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000340)="696f001b66408225aaa3af068fffebb8a490c47dda6586f1b58895b94a78037dd3714e7198820a7a709e2d30d25e6d846cd5c62a648a598668a8263b752b0b622b115112b5ad8e0425c0b784bbdb89eb8f4da0dd73dd01fe35694c2f78600badf8a0e237dba40713bac9e053b41a9f62be5fbb928018aab5f7500bef51a2fd74d4fffb4a20a946733820bdc1b485afa417cdbcfdfbc54f58c9c3edffe240c36f4ab8a16613814e226b6d20d98010ab1ace49fa76dce337a5a5f1dcff9e5d533b12475e33b971b15b69cd591cd9059759f0f04ba5468a34b98915033debb3e87f048e8601712659d47d8687eb6be5e650068d88000000000000") preadv(r0, &(0x7f0000000480), 0x10000000000002a1, 0x0) fcntl$F_SET_RW_HINT(r0, 0x40c, &(0x7f0000000000)=0x1) ioctl$sock_inet_tcp_SIOCINQ(r0, 0x541b, &(0x7f0000000040)) r1 = syz_genetlink_get_family_id$ipvs(&(0x7f00000000c0)='IPVS\x00') sendmsg$IPVS_CMD_NEW_DAEMON(r0, &(0x7f0000000240)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x20000008}, 0xc, &(0x7f0000000140)={&(0x7f0000000100)={0x40, r1, 0x0, 0x70bd2c, 0x25dfdbfd, {}, [@IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0x328}, @IPVS_CMD_ATTR_SERVICE={0x24, 0x1, [@IPVS_SVC_ATTR_PE_NAME={0x8, 0xb, 'sip\x00'}, @IPVS_SVC_ATTR_PORT={0x8, 0x4, 0x4e20}, @IPVS_SVC_ATTR_PROTOCOL={0x8, 0x2, 0xaf}, @IPVS_SVC_ATTR_TIMEOUT={0x8, 0x8, 0x6}]}]}, 0x40}, 0x1, 0x0, 0x0, 0x4000010}, 0x40) 12:33:53 executing program 2: perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f0000000180)=""/148, 0x13d}], 0x1, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000340)="696f001b66408225aaa3af068fffebb8a490c47dda6586f1b58895b94a78037dd3714e7198820a7a709e2d30d25e6d846cd5c62a648a598668a8263b752b0b622b115112b5ad8e0425c0b784bbdb89eb8f4da0dd73dd01fe35694c2f78600badf8a0e237dba40713bac9e053b41a9f62be5fbb928018aab5f7500bef51a2fd74d4fffb4a20a946733820bdc1b485afa417cdbcfdfbc54f58c9c3edffe240c36f4ab8a16613814e226b6d20d98010ab1ace49fa76dce337a5a5f1dcff9e5d533b12475e33b971b15b69cd591cd9059759f0f04ba5468a34b98915033debb3e87f048e8601712659d47d8687eb6be5e650068d88000000000000") preadv(r0, &(0x7f0000000480), 0x1000000000000073, 0x0) msgget$private(0x0, 0x22) 12:33:53 executing program 5: preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f0000000180)=""/148, 0x13d}], 0x1, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000340)="696f001b66408225aaa3af068fffebb8a490c47dda6586f1b58895b94a78037dd3714e7198820a7a709e2d30d25e6d846cd5c62a648a598668a8263b752b0b622b115112b5ad8e0425c0b784bbdb89eb8f4da0dd73dd01fe35694c2f78600badf8a0e237dba40713bac9e053b41a9f62be5fbb928018aab5f7500bef51a2fd74d4fffb4a20a946733820bdc1b485afa417cdbcfdfbc54f58c9c3edffe240c36f4ab8a16613814e226b6d20d98010ab1ace49fa76dce337a5a5f1dcff9e5d533b12475e33b971b15b69cd591cd9059759f0f04ba5468a34b98915033debb3e87f048e8601712659d47d8687eb6be5e650068d88000000000000") preadv(r0, &(0x7f0000000480), 0x0, 0x0) [ 456.175305] binder: BINDER_SET_CONTEXT_MGR already set [ 456.189525] binder: 24005:24010 ioctl 40046207 0 returned -16 12:33:53 executing program 4: socket$inet6(0xa, 0x0, 0x80000000) sched_setaffinity(0x0, 0x7, &(0x7f00000000c0)=0x9) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0) fcntl$setflags(0xffffffffffffffff, 0x2, 0x1) r0 = socket$inet6(0xa, 0x0, 0x0) r1 = dup(r0) setsockopt$inet6_tcp_int(r1, 0x6, 0x12, &(0x7f0000000000)=0x7f, 0x4) bind$inet6(r0, &(0x7f0000000040)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) getsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER_VALUE(r0, 0x84, 0x7c, &(0x7f00000001c0)={0x0, 0x100000001, 0x6}, &(0x7f0000000240)=0x8) sendto$inet6(r0, &(0x7f00000004c0), 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x4) socket$inet6(0xa, 0x1000000000002, 0x0) r2 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000200)={0x4, 0x0, &(0x7f0000000100)=[@enter_looper], 0x1, 0x0, &(0x7f0000000180)='T'}) r3 = gettid() timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, &(0x7f0000040000)) tkill(r3, 0x1004000000016) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0xfffffffffffffced, 0x0, &(0x7f0000000040)}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x400c630f}], 0x0, 0x0, &(0x7f0000000f4d)}) 12:33:53 executing program 3: socket$inet6(0xa, 0x0, 0x80000000) syz_open_dev$sndctrl(&(0x7f0000000140)='/dev/snd/controlC#\x00', 0x9, 0x400000) sched_setaffinity(0x0, 0x7, &(0x7f00000000c0)=0x9) r0 = perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0) fcntl$setflags(r0, 0x2, 0x1) pipe(&(0x7f0000000100)) r1 = dup(0xffffffffffffffff) setsockopt$inet6_tcp_int(r1, 0x6, 0x12, &(0x7f0000000000)=0x7f, 0x4) bind$inet6(0xffffffffffffffff, &(0x7f0000000040)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) getsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER_VALUE(0xffffffffffffffff, 0x84, 0x7c, &(0x7f00000001c0)={0x0, 0x100000001, 0x6}, &(0x7f0000000240)=0x8) sendto$inet6(0xffffffffffffffff, &(0x7f00000004c0), 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) setsockopt$SO_BINDTODEVICE(0xffffffffffffffff, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x4) socket$inet6(0xa, 0x1000000000002, 0x0) r2 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000200)={0x4, 0x0, &(0x7f0000000100)=[@enter_looper], 0x1, 0x0, &(0x7f0000000180)='T'}) r3 = gettid() timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, &(0x7f0000040000)) tkill(r3, 0x1004000000016) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0xfffffffffffffced, 0x0, &(0x7f0000000040)}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x400c630f}], 0x0, 0x0, &(0x7f0000000f4d)}) 12:33:53 executing program 1: preadv(0xffffffffffffffff, &(0x7f0000000040)=[{&(0x7f0000000180)=""/148, 0x94}], 0x1, 0x0) r0 = syz_open_dev$adsp(&(0x7f0000000100)='/dev/adsp#\x00', 0x5, 0x400) ioctl$KVM_SET_MP_STATE(r0, 0x4004ae99, &(0x7f0000000240)=0x7) r1 = syz_open_procfs(0x0, &(0x7f0000000340)="696f001b66408225aaa3af068fffebb8a490c47dda6586f1b58895b94a78037dd3714e7198820a7a709e2d30d25e6d846cd5c62a648a598668a8263b752b0b622b115112b5ad8e0425c0b784bbdb89eb8f4da0dd73dd01fe35694c2f78600badf8a0e237dba40713bac9e053b41a9f62be5fbb928018aab5f7500bef51a2fd74d4fffb4a20a946733820bdc1b485afa417cdbcfdfbc54f58c9c3edffe240c36f4ab8a16613814e226b6d20d98010ab1ace49fa76dce337a5a5f1dcff9e5d533b12475e33b971b15b69cd591cd9059759f0f04ba546fa98c28a34b98915033debb3e87f048e8601712659d47d8687eb6be5e650068d88000000") preadv(r1, &(0x7f0000000480), 0x10000000000002a1, 0x0) write$FUSE_LSEEK(r1, &(0x7f0000000000)={0x18, 0x0, 0x4, {0x5}}, 0x18) ioctl$TIOCGSID(r1, 0x5429, &(0x7f0000000080)=0x0) syz_open_procfs(r2, &(0x7f00000000c0)='loginuid\x00') ioctl$EVIOCGKEYCODE(r0, 0x80084504, &(0x7f0000000280)=""/177) 12:33:53 executing program 5: r0 = openat$pfkey(0xffffffffffffff9c, &(0x7f0000000080)='/proc/self/net/pfkey\x00', 0x8041, 0x0) ioctl$TIOCSSOFTCAR(r0, 0x541a, &(0x7f00000000c0)=0x7) preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f0000000180)=""/148, 0x13d}], 0x1, 0x0) r1 = syz_open_dev$dspn(&(0x7f0000000000)='/dev/dsp#\x00', 0x1e9d, 0x400200) ioctl$SCSI_IOCTL_START_UNIT(r1, 0x5) r2 = syz_open_procfs(0x0, &(0x7f0000000340)="696f001b66408225aaa3af068fffebb8a490c47dda6586f1b58895b94a78037dd3714e7198820a7a709e2d30d25e6d846cd5c62a648a598668a8263b752b0b622b115112b5ad8e0425c0b784bbdb89eb8f4da0dd73dd01fe35694c2f78600badf8a0e237dba40713bac9e053b41a9f62be5fbb928018aab5f7500bef51a2fd74d4fffb4a20a946733820bdc1b485afa417cdbcfdfbc54f58c9c3edffe240c36f4ab8a16613814e226b6d20d98010ab1ace49fa76dce337a5a5f1dcff9e5d533b12475e33b971b15b69cd591cd9059759f0f04ba5468a34b98915033debb3e87f048e8601712659d47d8687eb6be5e650068d88000000000000") preadv(r2, &(0x7f0000000480), 0x10000000000002a1, 0x0) syz_extract_tcp_res(&(0x7f0000000040), 0x80000001, 0x6) 12:33:53 executing program 2: perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f0000000180)=""/148, 0x13d}], 0x1, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000340)="696f001b66408225aaa3af068fffebb8a490c47dda6586f1b58895b94a78037dd3714e7198820a7a709e2d30d25e6d846cd5c62a648a598668a8263b752b0b622b115112b5ad8e0425c0b784bbdb89eb8f4da0dd73dd01fe35694c2f78600badf8a0e237dba40713bac9e053b41a9f62be5fbb928018aab5f7500bef51a2fd74d4fffb4a20a946733820bdc1b485afa417cdbcfdfbc54f58c9c3edffe240c36f4ab8a16613814e226b6d20d98010ab1ace49fa76dce337a5a5f1dcff9e5d533b12475e33b971b15b69cd591cd9059759f0f04ba5468a34b98915033debb3e87f048e8601712659d47d8687eb6be5e650068d88000000000000") preadv(r0, &(0x7f0000000480), 0x10000000000000ae, 0x0) msgget$private(0x0, 0x22) [ 456.453152] binder: BINDER_SET_CONTEXT_MGR already set 12:33:53 executing program 1: preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f0000000180)=""/148, 0x13d}], 0x1, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000340)="696f001b66408225aaa3af068fffebb8a490c47dda6586f1b58895b94a78037dd3714e7198820a7a709e2d30d25e6d846cd5c62a648a598668a8263b752b0b622b115112b5ad8e0425c0b784bbdb89eb8f4da0dd73dd01fe35694c2f78600badf8a0e237dba40713bac9e053b41a9f62be5fbb928018aab5f7500bef51a2fd74d4fffb4a20a946733820bdc1b485afa417cdbcfdfbc54f58c9c3edffe240c36f4ab8a16613814e226b6d20d98010ab1ace49fa76dce337a5a5f1dcff9e5d533b12475e33b971b15b69cd591cd9059759f0f04ba5468a34b98915033debb3e87f048e8601712659d47d8687eb6be5e650068d88000000000000") preadv(r0, &(0x7f0000000000), 0x166, 0x20000) [ 456.476780] binder: 24037:24046 ioctl 40046207 0 returned -16 [ 456.487776] binder: BINDER_SET_CONTEXT_MGR already set [ 456.525825] binder: 24042:24043 ioctl 40046207 0 returned -16 12:33:53 executing program 5: preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f0000000180)=""/148, 0x13d}], 0x1, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000340)="696f001b66408225aaa3af068fffebb8a490c47dda6586f1b58895b94a78037dd3714e7198820a7a709e2d30d25e6d846cd5c62a648a598668a8263b752b0b622b115112b5ad8e0425c0b784bbdb89eb8f4da0dd73dd01fe35694c2f78600badf8a0e237dba40713bac9e053b41a9f62be5fbb928018aab5f7500bef51a2fd74d4fffb4a20a946733820bdc1b485afa417cdbcfdfbc54f58c9c3edffe240c36f4ab8a16613814e226b6d20d98010ab1ace49fa76dce337a5a5f1dcff9e5d533b12475e33b971b15b69cd591cd9059759f0f04ba5468a34b98915033debb3e87f048e8601712659d47d8687eb6be5e650068d88000000000000") preadv(r0, &(0x7f0000000480), 0x10000000000002a1, 0x0) ioctl$SNDRV_RAWMIDI_IOCTL_PVERSION(r0, 0x80045700, &(0x7f0000000000)) 12:33:53 executing program 2: perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f0000000180)=""/148, 0x13d}], 0x1, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000340)="696f001b66408225aaa3af068fffebb8a490c47dda6586f1b58895b94a78037dd3714e7198820a7a709e2d30d25e6d846cd5c62a648a598668a8263b752b0b622b115112b5ad8e0425c0b784bbdb89eb8f4da0dd73dd01fe35694c2f78600badf8a0e237dba40713bac9e053b41a9f62be5fbb928018aab5f7500bef51a2fd74d4fffb4a20a946733820bdc1b485afa417cdbcfdfbc54f58c9c3edffe240c36f4ab8a16613814e226b6d20d98010ab1ace49fa76dce337a5a5f1dcff9e5d533b12475e33b971b15b69cd591cd9059759f0f04ba5468a34b98915033debb3e87f048e8601712659d47d8687eb6be5e650068d88000000000000") preadv(r0, &(0x7f0000000480), 0x100000000000014a, 0x0) msgget$private(0x0, 0x22) 12:33:54 executing program 0: syz_open_dev$sndctrl(&(0x7f0000000140)='/dev/snd/controlC#\x00', 0x0, 0x0) sched_setaffinity(0x0, 0x7, &(0x7f00000000c0)=0x9) r0 = perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0) fcntl$setflags(r0, 0x2, 0x1) getsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER_VALUE(0xffffffffffffffff, 0x84, 0x7c, &(0x7f00000001c0), &(0x7f0000000240)=0x8) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(0xffffffffffffffff, 0x84, 0x9, &(0x7f0000000280)={0x0, @in={{0x2, 0x4e23, @remote}}, 0xfffffffffffffff7, 0x0, 0x400}, 0x98) sendto$inet6(0xffffffffffffffff, &(0x7f00000004c0), 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) setsockopt$SO_BINDTODEVICE(0xffffffffffffffff, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x4) socket$inet6(0xa, 0x1000000000002, 0x0) r1 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000100), 0x1, 0x0, &(0x7f0000000180)='T'}) r2 = gettid() timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, &(0x7f0000040000)) tkill(r2, 0x1004000000016) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0xfffffffffffffced, 0x0, &(0x7f0000000040)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x400c630f}], 0x0, 0x0, &(0x7f0000000f4d)}) 12:33:54 executing program 1: preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f0000000180)=""/148, 0x13d}], 0x1, 0x0) r0 = syz_open_dev$amidi(&(0x7f0000000100)='/dev/amidi#\x00', 0x16, 0x300c0) setsockopt$XDP_TX_RING(r0, 0x11b, 0x3, &(0x7f0000000140)=0x80, 0x4) r1 = syz_open_procfs(0x0, &(0x7f0000000000)="696f001b66408225aaa3af068fffebb8a490c47dda6586f1b58895b94a78037dd3714e7198820a7a709e2d30d25e6d846cd5c62a648a598668a8263b752b0b622b115112b5ad8e0425c0b784bbdb89eb8f4da0dd73dd01fe35694c2f78600badf8a0e237dba40713bac9e053b41a9f62be5fbb928018aab5f7500bef51a2fd74d4fffb4a20a946733820bdc1b485afa417cdbcfdfbc54f58c9c3edffe240c36f4ab8a16613814e226b6d20d98010ab1ace49fa76dce337a5a5f1dcff9e5d533b12475e33b971b15b69cd591cd9059759f0f04ba5468a34b98915033debb3e87f048e8601712659d47d8687eb6be5e650068d88000000000000") getsockopt$EBT_SO_GET_INIT_ENTRIES(r1, 0x0, 0x83, &(0x7f0000000300)={'nat\x00', 0x0, 0x4, 0x1, [], 0x7, &(0x7f0000000240)=[{}, {}, {}, {}, {}, {}, {}], &(0x7f00000002c0)=""/1}, &(0x7f0000000380)=0x78) preadv(r1, &(0x7f0000000480), 0x10000000000002a1, 0x0) fcntl$setflags(r0, 0x2, 0x1) inotify_add_watch(r1, &(0x7f00000003c0)='./file0\x00', 0x0) socketpair$inet_icmp_raw(0x2, 0x3, 0x1, &(0x7f0000000400)) 12:33:54 executing program 4: socket$inet6(0xa, 0x0, 0x80000000) sched_setaffinity(0x0, 0x7, &(0x7f00000000c0)=0x9) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0) fcntl$setflags(0xffffffffffffffff, 0x2, 0x1) r0 = socket$inet6(0xa, 0x400000000001, 0x0) r1 = dup(0xffffffffffffffff) setsockopt$inet6_tcp_int(r1, 0x6, 0x12, &(0x7f0000000000)=0x7f, 0x4) bind$inet6(r0, &(0x7f0000000040)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) getsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER_VALUE(r0, 0x84, 0x7c, &(0x7f00000001c0)={0x0, 0x100000001, 0x6}, &(0x7f0000000240)=0x8) sendto$inet6(r0, &(0x7f00000004c0), 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x4) socket$inet6(0xa, 0x1000000000002, 0x0) r2 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000200)={0x4, 0x0, &(0x7f0000000100)=[@enter_looper], 0x1, 0x0, &(0x7f0000000180)='T'}) r3 = gettid() timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, &(0x7f0000040000)) tkill(r3, 0x1004000000016) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0xfffffffffffffced, 0x0, &(0x7f0000000040)}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x400c630f}], 0x0, 0x0, &(0x7f0000000f4d)}) 12:33:54 executing program 3: syz_open_dev$sndctrl(&(0x7f0000000140)='/dev/snd/controlC#\x00', 0x0, 0x0) sched_setaffinity(0x0, 0x7, &(0x7f00000000c0)=0x9) r0 = perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0) fcntl$setflags(r0, 0x2, 0x1) getsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER_VALUE(0xffffffffffffffff, 0x84, 0x7c, &(0x7f00000001c0), &(0x7f0000000240)=0x8) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(0xffffffffffffffff, 0x84, 0x9, &(0x7f0000000280)={0x0, @in={{0x2, 0x0, @remote}}, 0xfffffffffffffff7, 0x7850, 0x400, 0x97df, 0xc1}, 0x98) sendto$inet6(0xffffffffffffffff, &(0x7f00000004c0), 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) setsockopt$SO_BINDTODEVICE(0xffffffffffffffff, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x4) socket$inet6(0xa, 0x1000000000002, 0x0) r1 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x4, 0x0, &(0x7f0000000100)=[@enter_looper], 0x1, 0x0, &(0x7f0000000180)='T'}) r2 = gettid() timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, &(0x7f0000040000)) tkill(r2, 0x1004000000016) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0xfffffffffffffced, 0x0, &(0x7f0000000040)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x400c630f}], 0x0, 0x0, &(0x7f0000000f4d)}) 12:33:54 executing program 5: preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f0000000000)=""/148, 0x13d}], 0x10000000000000d2, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000340)="696f001b66408225aaa3af068fffebb8a490c47dda6586f1b58895b94a78037dd3714e7198820a7a709e2d30d25e6d846cd5c62a648a598668a8263b752b0b622b115112b5ad8e0425c0b784bbdb89eb8f4da0dd73dd01fe35694c2f78600badf8a0e237dba40713bac9e053b41a9f62be5fbb928018aab5f7500bef51a2fd74d4fffb4a20a946733820bdc1b485afa417cdbcfdfbc54f58c9c3edffe240c36f4ab8a16613814e226b6d20d98010ab1ace49fa76dce337a5a5f1dcff9e5d533b12475e33b971b15b69cd591cd9059759f0f04ba5468a34b98915033debb3e87f048e8601712659d47d8687eb6be5e650068d88000000000000") preadv(r0, &(0x7f0000000480), 0x10000000000002a1, 0x0) 12:33:54 executing program 2: perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f0000000180)=""/148, 0x13d}], 0x1, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000340)="696f001b66408225aaa3af068fffebb8a490c47dda6586f1b58895b94a78037dd3714e7198820a7a709e2d30d25e6d846cd5c62a648a598668a8263b752b0b622b115112b5ad8e0425c0b784bbdb89eb8f4da0dd73dd01fe35694c2f78600badf8a0e237dba40713bac9e053b41a9f62be5fbb928018aab5f7500bef51a2fd74d4fffb4a20a946733820bdc1b485afa417cdbcfdfbc54f58c9c3edffe240c36f4ab8a16613814e226b6d20d98010ab1ace49fa76dce337a5a5f1dcff9e5d533b12475e33b971b15b69cd591cd9059759f0f04ba5468a34b98915033debb3e87f048e8601712659d47d8687eb6be5e650068d88000000000000") preadv(r0, &(0x7f0000000480), 0x1000000000000068, 0x0) msgget$private(0x0, 0x22) [ 456.904063] binder: undelivered death notification, 0000000000000000 12:33:54 executing program 1: preadv(0xffffffffffffffff, &(0x7f0000000500), 0x0, 0x0) r0 = socket$pptp(0x18, 0x1, 0x2) getsockopt$sock_timeval(r0, 0x1, 0x14, &(0x7f0000000440), &(0x7f0000000480)=0x10) r1 = syz_open_procfs(0x0, &(0x7f0000000340)="696f001b66408225aaa3af068fffebb8a490c47dda6586f1b58895b94a78037dd3714e7198820a7a709e2d30d25e6d846cd5c62a648a598668a8263b752b0b622b115112b5ad8e0425c0b784bbdb89eb8f4da0dd73dd01fe35694c2f78600badf8a0e237dba40713bac9e053b41a9f62be5fbb928018aab5f7500bef51a2fd74d4fffb4a20a946733820bdc1b485afa417cdbcfdfbc54f58c9c3edffe240c36f4ab8a16613814e226b6d20d98010ab1ace49fa76dce337a5a5f1dcff9e5d533b12475e33b971b15b69cd591cd9059759f0f04ba5468a34b98915033debb3e87f048e8601712659d47d8687eb6be5e650068d88000000000000") preadv(r1, &(0x7f0000000140)=[{&(0x7f0000000040)=""/194, 0xc2}, {&(0x7f0000000240)=""/124, 0x7c}, {&(0x7f00000013c0)=""/4096, 0x1000}], 0x3, 0x0) ioctl$IOC_PR_RELEASE(r1, 0x401070ca, &(0x7f00000004c0)={0x9, 0xff}) r2 = syz_open_dev$midi(&(0x7f0000000180)='/dev/midi#\x00', 0xfffffffffffff800, 0x6000) ioctl$SNDRV_RAWMIDI_IOCTL_PVERSION(r1, 0x80045700, &(0x7f0000000200)) bind$rds(r2, &(0x7f00000001c0)={0x2, 0x4e21, @remote}, 0x10) openat$cuse(0xffffffffffffff9c, &(0x7f0000000000)='/dev/cuse\x00', 0x2, 0x0) ioctl$RNDCLEARPOOL(r1, 0x5206, &(0x7f0000000300)=0xa) ioctl$sock_kcm_SIOCKCMATTACH(r1, 0x89e0, &(0x7f00000002c0)={r1, r1}) [ 457.003182] binder: BINDER_SET_CONTEXT_MGR already set [ 457.008678] binder: 24077:24078 ioctl 40046207 0 returned -16 12:33:54 executing program 5: preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f0000000180)=""/148, 0x13d}], 0x1, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000340)="696f001b66408225aaa3af068fffebb8a490c47dda6586f1b58895b94a78037dd3714e7198820a7a709e2d30d25e6d846cd5c62a648a598668a8263b752b0b622b115112b5ad8e0425c0b784bbdb89eb8f4da0dd73dd01fe35694c2f78600badf8a0e237dba40713bac9e053b41a9f62be5fbb928018aab5f7500bef51a2fd74d4fffb4a20a946733820bdc1b485afa417cdbcfdfbc54f58c9c3edffe240c36f4ab8a16613814e226b6d20d98010ab1ace49fa76dce337a5a5f1dcff9e5d533b12475e33b971b15b69cd591cd9059759f0f04ba5468a34b98915033debb3e87f048e8601712659d47d8687eb6be5e650068d88000000000000") getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r0, 0x84, 0x6f, &(0x7f0000000040)={0x0, 0x30, &(0x7f0000000000)=[@in={0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x1a}}, @in={0x2, 0x4e20, @rand_addr=0x3}, @in={0x2, 0x4e22, @multicast1}]}, &(0x7f0000000080)=0x10) getsockopt$inet_sctp_SCTP_DEFAULT_SNDINFO(r0, 0x84, 0x22, &(0x7f00000000c0)={0x4, 0x0, 0x100, 0x8, r1}, &(0x7f0000000100)=0x10) preadv(r0, &(0x7f0000000480), 0x10000000000002a1, 0x0) 12:33:54 executing program 2: perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f0000000180)=""/148, 0x13d}], 0x1, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000340)="696f001b66408225aaa3af068fffebb8a490c47dda6586f1b58895b94a78037dd3714e7198820a7a709e2d30d25e6d846cd5c62a648a598668a8263b752b0b622b115112b5ad8e0425c0b784bbdb89eb8f4da0dd73dd01fe35694c2f78600badf8a0e237dba40713bac9e053b41a9f62be5fbb928018aab5f7500bef51a2fd74d4fffb4a20a946733820bdc1b485afa417cdbcfdfbc54f58c9c3edffe240c36f4ab8a16613814e226b6d20d98010ab1ace49fa76dce337a5a5f1dcff9e5d533b12475e33b971b15b69cd591cd9059759f0f04ba5468a34b98915033debb3e87f048e8601712659d47d8687eb6be5e650068d88000000000000") preadv(r0, &(0x7f0000000480), 0x1000000000000190, 0x0) msgget$private(0x0, 0x22) 12:33:54 executing program 3: syz_open_dev$sndctrl(&(0x7f0000000140)='/dev/snd/controlC#\x00', 0x0, 0x0) sched_setaffinity(0x0, 0x7, &(0x7f00000000c0)=0x9) r0 = perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0) fcntl$setflags(r0, 0x2, 0x1) getsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER_VALUE(0xffffffffffffffff, 0x84, 0x7c, &(0x7f00000001c0), &(0x7f0000000240)=0x8) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(0xffffffffffffffff, 0x84, 0x9, &(0x7f0000000280)={0x0, @in={{0x2, 0x0, @remote}}, 0xfffffffffffffff7, 0x7850, 0x400, 0x97df, 0xc1}, 0x98) sendto$inet6(0xffffffffffffffff, &(0x7f00000004c0), 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) setsockopt$SO_BINDTODEVICE(0xffffffffffffffff, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x4) socket$inet6(0xa, 0x1000000000002, 0x0) r1 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x4, 0x0, &(0x7f0000000100)=[@enter_looper], 0x1, 0x0, &(0x7f0000000180)='T'}) r2 = gettid() timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, &(0x7f0000040000)) tkill(r2, 0x1004000000016) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0xfffffffffffffced, 0x0, &(0x7f0000000040)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x400c630f}], 0x0, 0x0, &(0x7f0000000f4d)}) 12:33:54 executing program 4: socket$inet6(0xa, 0x0, 0x80000000) sched_setaffinity(0x0, 0x7, &(0x7f00000000c0)=0x9) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0) fcntl$setflags(0xffffffffffffffff, 0x2, 0x1) r0 = socket$inet6(0xa, 0x400000000001, 0x0) dup(r0) setsockopt$inet6_tcp_int(0xffffffffffffffff, 0x6, 0x12, &(0x7f0000000000)=0x7f, 0x4) bind$inet6(r0, &(0x7f0000000040)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) getsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER_VALUE(r0, 0x84, 0x7c, &(0x7f00000001c0)={0x0, 0x100000001, 0x6}, &(0x7f0000000240)=0x8) sendto$inet6(r0, &(0x7f00000004c0), 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x4) socket$inet6(0xa, 0x1000000000002, 0x0) r1 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x4, 0x0, &(0x7f0000000100)=[@enter_looper], 0x1, 0x0, &(0x7f0000000180)='T'}) r2 = gettid() timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, &(0x7f0000040000)) tkill(r2, 0x1004000000016) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0xfffffffffffffced, 0x0, &(0x7f0000000040)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x400c630f}], 0x0, 0x0, &(0x7f0000000f4d)}) 12:33:54 executing program 1: preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f0000000180)=""/148, 0x13d}], 0x1, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000340)="696f001b66408225aaa3af068fffebb8a490c47dda6586f1b58895b94a78037dd3714e7198820a7a709e2d30d25e6d846cd5c62a648a598668a8263b752b0b622b115112b5ad8e0425c0b784bbdb89eb8f4da0dd73dd01fe35694c2f78600badf8a0e237dba40713bac9e053b41a9f62be5fbb928018aab5f7500bef51a2fd74d4fffb4a20a946733820bdc1b485afa417cdbcfdfbc54f58c9c3edffe240c36f4ab8a16613814e226b6d20d98010ab1ace49fa76dce337a5a5f1dcff9e5d533b12475e33b971b15b69cd591cd9059759f0f04ba5468a34b98915033debb3e87f048e8601712659d47d8687eb6be5e650068d88000000000000") preadv(r0, &(0x7f0000000480), 0x10000000000002a1, 0x0) lseek(r0, 0x0, 0x2) [ 457.185617] binder: BINDER_SET_CONTEXT_MGR already set [ 457.202535] binder: 24101:24102 ioctl 40046207 0 returned -16 [ 457.271253] binder: BINDER_SET_CONTEXT_MGR already set [ 457.303462] binder: 24107:24109 ioctl 40046207 0 returned -16 12:33:55 executing program 0: syz_open_dev$sndctrl(&(0x7f0000000140)='/dev/snd/controlC#\x00', 0x0, 0x0) sched_setaffinity(0x0, 0x7, &(0x7f00000000c0)=0x9) r0 = perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0) fcntl$setflags(r0, 0x2, 0x1) getsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER_VALUE(0xffffffffffffffff, 0x84, 0x7c, &(0x7f00000001c0), &(0x7f0000000240)=0x8) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(0xffffffffffffffff, 0x84, 0x9, &(0x7f0000000280)={0x0, @in={{0x2, 0x4e23, @remote}}, 0xfffffffffffffff7, 0x0, 0x400}, 0x98) sendto$inet6(0xffffffffffffffff, &(0x7f00000004c0), 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) setsockopt$SO_BINDTODEVICE(0xffffffffffffffff, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x4) socket$inet6(0xa, 0x1000000000002, 0x0) r1 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x4, 0x0, &(0x7f0000000100)=[@enter_looper], 0x0, 0x0, &(0x7f0000000180)}) r2 = gettid() timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, &(0x7f0000040000)) tkill(r2, 0x1004000000016) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0xfffffffffffffced, 0x0, &(0x7f0000000040)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x400c630f}], 0x0, 0x0, &(0x7f0000000f4d)}) 12:33:55 executing program 5: preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f0000000180)=""/148, 0x13d}], 0x1, 0x0) r0 = getpid() syz_open_procfs(r0, &(0x7f0000000240)="696f001b66408225aaa3af068fffebb8a490c47dda6586f1b58895b94a78037dd3714e7198820a7a709e2d30d25e6d846cd5c62a648a598668a8263b752b0b622b115112b5ad8e0425c0b784bbdb89eb8f4da0dd73dd01fe35694c2f78600badf8a0e237dba40713bac9e053b41a9f62be5fbb928018aab5f7500bef51a2fd74d4fffb4a20a946733820bdc1b485afa417cdbcfdfbc54f58c9c3edffe240c36f4ab8a16613814e226b6d20d98010ab1ace49fa76dce337a5a5f1dcff9e5d533b12475e33b971b15b69cd591cd9059759f0f04ba5468a34b98915033debb3e87f048e8601712659d47d8687eb6be5e650068d88000000000000") 12:33:55 executing program 2: perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f0000000180)=""/148, 0x13d}], 0x1, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000340)="696f001b66408225aaa3af068fffebb8a490c47dda6586f1b58895b94a78037dd3714e7198820a7a709e2d30d25e6d846cd5c62a648a598668a8263b752b0b622b115112b5ad8e0425c0b784bbdb89eb8f4da0dd73dd01fe35694c2f78600badf8a0e237dba40713bac9e053b41a9f62be5fbb928018aab5f7500bef51a2fd74d4fffb4a20a946733820bdc1b485afa417cdbcfdfbc54f58c9c3edffe240c36f4ab8a16613814e226b6d20d98010ab1ace49fa76dce337a5a5f1dcff9e5d533b12475e33b971b15b69cd591cd9059759f0f04ba5468a34b98915033debb3e87f048e8601712659d47d8687eb6be5e650068d88000000000000") preadv(r0, &(0x7f0000000480), 0x100000000000000d, 0x0) msgget$private(0x0, 0x22) 12:33:55 executing program 1: preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f0000000180)=""/148, 0x13d}], 0x1, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000340)="696f001b66408225aaa3af068fffebb8a490c47dda6586f1b58895b94a78037dd3714e7198820a7a709e2d30d25e6d846cd5c62a648a598668a8263b752b0b622b115112b5ad8e0425c0b784bbdb89eb8f4da0dd73dd01fe35694c2f78600badf8a0e237dba40713bac9e053b41a9f62be5fbb928018aab5f7500bef51a2fd74d4fffb4a20a946733820bdc1b485afa417cdbcfdfbc54f58c9c3edffe240c36f4ab8a16613814e226b6d20d98010ab1ace49fa76dce337a5a5f1dcff9e5d533b12475e33b971b15b69cd591cd9059759f0f04ba5468a34b98915033debb3e87f048e8601712659d47d8687eb6be5e650068d88000000000000") preadv(r0, &(0x7f0000000480), 0x10000000000002a1, 0x0) getsockopt$SO_TIMESTAMPING(r0, 0x1, 0x25, &(0x7f0000000000), &(0x7f0000000040)=0x4) 12:33:55 executing program 4: socket$inet6(0xa, 0x0, 0x80000000) sched_setaffinity(0x0, 0x7, &(0x7f00000000c0)=0x9) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0) fcntl$setflags(0xffffffffffffffff, 0x2, 0x1) r0 = socket$inet6(0xa, 0x400000000001, 0x0) r1 = dup(r0) setsockopt$inet6_tcp_int(r1, 0x6, 0x0, &(0x7f0000000000)=0x7f, 0x4) bind$inet6(r0, &(0x7f0000000040)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) getsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER_VALUE(r0, 0x84, 0x7c, &(0x7f00000001c0)={0x0, 0x100000001, 0x6}, &(0x7f0000000240)=0x8) sendto$inet6(r0, &(0x7f00000004c0), 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x4) socket$inet6(0xa, 0x1000000000002, 0x0) r2 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000200)={0x4, 0x0, &(0x7f0000000100)=[@enter_looper], 0x1, 0x0, &(0x7f0000000180)='T'}) r3 = gettid() timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, &(0x7f0000040000)) tkill(r3, 0x1004000000016) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0xfffffffffffffced, 0x0, &(0x7f0000000040)}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x400c630f}], 0x0, 0x0, &(0x7f0000000f4d)}) [ 457.763952] binder: undelivered death notification, 0000000000000000 12:33:55 executing program 2: perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f0000000180)=""/148, 0x13d}], 0x1, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000340)="696f001b66408225aaa3af068fffebb8a490c47dda6586f1b58895b94a78037dd3714e7198820a7a709e2d30d25e6d846cd5c62a648a598668a8263b752b0b622b115112b5ad8e0425c0b784bbdb89eb8f4da0dd73dd01fe35694c2f78600badf8a0e237dba40713bac9e053b41a9f62be5fbb928018aab5f7500bef51a2fd74d4fffb4a20a946733820bdc1b485afa417cdbcfdfbc54f58c9c3edffe240c36f4ab8a16613814e226b6d20d98010ab1ace49fa76dce337a5a5f1dcff9e5d533b12475e33b971b15b69cd591cd9059759f0f04ba5468a34b98915033debb3e87f048e8601712659d47d8687eb6be5e650068d88000000000000") preadv(r0, &(0x7f0000000480), 0x10000000000000d0, 0x0) msgget$private(0x0, 0x22) 12:33:55 executing program 1: preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f0000000180)=""/148, 0x13d}], 0x1, 0x0) preadv(0xffffffffffffffff, &(0x7f0000000480), 0x10000000000002a1, 0x0) 12:33:55 executing program 5: preadv(0xffffffffffffffff, &(0x7f0000000000)=[{&(0x7f0000000180)=""/148, 0xfffffffffffffff2}], 0x1, 0x0) preadv(0xffffffffffffffff, &(0x7f0000000480), 0x10000000000002a1, 0x0) [ 457.875338] binder: BINDER_SET_CONTEXT_MGR already set [ 457.881132] binder: 24134:24135 ioctl 40046207 0 returned -16 [ 457.933526] binder: undelivered death notification, 0000000000000000 12:33:55 executing program 0: syz_open_dev$sndctrl(&(0x7f0000000140)='/dev/snd/controlC#\x00', 0x0, 0x0) sched_setaffinity(0x0, 0x7, &(0x7f00000000c0)=0x9) r0 = perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0) fcntl$setflags(r0, 0x2, 0x1) getsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER_VALUE(0xffffffffffffffff, 0x84, 0x7c, &(0x7f00000001c0), &(0x7f0000000240)=0x8) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(0xffffffffffffffff, 0x84, 0x9, &(0x7f0000000280)={0x0, @in={{0x2, 0x4e23, @remote}}, 0xfffffffffffffff7, 0x0, 0x400}, 0x98) sendto$inet6(0xffffffffffffffff, &(0x7f00000004c0), 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) setsockopt$SO_BINDTODEVICE(0xffffffffffffffff, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x4) socket$inet6(0xa, 0x1000000000002, 0x0) r1 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x4, 0x0, &(0x7f0000000100)=[@enter_looper], 0x0, 0x0, &(0x7f0000000180)}) r2 = gettid() timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, &(0x7f0000040000)) tkill(r2, 0x1004000000016) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0xfffffffffffffced, 0x0, &(0x7f0000000040)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x400c630f}], 0x0, 0x0, &(0x7f0000000f4d)}) 12:33:55 executing program 3: syz_open_dev$sndctrl(&(0x7f0000000140)='/dev/snd/controlC#\x00', 0x0, 0x0) sched_setaffinity(0x0, 0x7, &(0x7f00000000c0)=0x9) r0 = perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0) fcntl$setflags(r0, 0x2, 0x1) getsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER_VALUE(0xffffffffffffffff, 0x84, 0x7c, &(0x7f00000001c0), &(0x7f0000000240)=0x8) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(0xffffffffffffffff, 0x84, 0x9, &(0x7f0000000280)={0x0, @in={{0x2, 0x4e23, @remote}}, 0xfffffffffffffff7, 0x0, 0x400}, 0x98) sendto$inet6(0xffffffffffffffff, &(0x7f00000004c0), 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) setsockopt$SO_BINDTODEVICE(0xffffffffffffffff, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x4) socket$inet6(0xa, 0x1000000000002, 0x0) r1 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x4, 0x0, &(0x7f0000000100)=[@enter_looper], 0x0, 0x0, &(0x7f0000000180)}) r2 = gettid() timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, &(0x7f0000040000)) tkill(r2, 0x1004000000016) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0xfffffffffffffced, 0x0, &(0x7f0000000040)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x400c630f}], 0x0, 0x0, &(0x7f0000000f4d)}) [ 457.976218] binder: undelivered death notification, 0000000000000000 12:33:55 executing program 5: preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f0000000180)=""/148, 0x13d}], 0x1, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000340)="696f001b66408225aaa3af068fffebb8a490c47dda6586f1b58895b94a78037dd3714e7198820a7a709e2d30d25e6d846cd5c62a648a598668a8263b752b0b622b115112b5ad8e0425c0b784bbdb89eb8f4da0dd73dd01fe35694c2f78600badf8a0e237dba40713bac9e053b41a9f62be5fbb928018aab5f7500bef51a2fd74d4fffb4a20a946733820bdc1b485afa417cdbcfdfbc54f58c9c3edffe240c36f4ab8a16613814e226b6d20d98010ab1ace49fa76dce337a5a5f1dcff9e5d533b12475e33b971b15b69cd591cd9059759f0f04ba5468a34b98915033debb3e87f048e8601712659d47d8687eb6be5e650068d88000000000000") rt_sigpending(&(0x7f0000000000), 0x8) preadv(r0, &(0x7f0000000480), 0x10000000000002a1, 0x0) 12:33:55 executing program 1: preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f0000000180)=""/148, 0x13d}], 0x1, 0x0) ioctl$LOOP_GET_STATUS(0xffffffffffffffff, 0x4c03, &(0x7f0000000040)) r0 = syz_open_procfs(0x0, &(0x7f0000000340)="696f001b66408225aaa3af068fffebb8a490c47dda6586f1b58895b94a78037dd3714e7198820a7a709e2d30d25e6d846cd5c62a648a598668a8263b752b0b622b115112b5ad8e0425c0b784bbdb89eb8f4da0dd73dd01fe35694c2f78600badf8a0e237dba40713bac9e053b41a9f62be5fbb928018aab5f7500bef51a2fd74d4fffb4a20a946733820bdc1b485afa417cdbcfdfbc54f58c9c3edffe240c36f4ab8a16613814e226b6d20d98010ab1ace49fa76dce337a5a5f1dcff9e5d533b12475e33b971b15b69cd591cd9059759f0f04ba5468a34b98915033debb3e87f048e8601712659d47d8687eb6be5e650068d88000000000000") fcntl$notify(r0, 0x402, 0x8) fcntl$setpipe(r0, 0x407, 0x0) ioctl$sock_SIOCBRADDBR(r0, 0x89a0, &(0x7f0000000000)='ip6tnl0\x00') preadv(r0, &(0x7f0000000480), 0x10000000000002a1, 0x0) 12:33:55 executing program 4: socket$inet6(0xa, 0x0, 0x80000000) sched_setaffinity(0x0, 0x7, &(0x7f00000000c0)=0x9) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0) fcntl$setflags(0xffffffffffffffff, 0x2, 0x1) r0 = socket$inet6(0xa, 0x400000000001, 0x0) r1 = dup(r0) setsockopt$inet6_tcp_int(r1, 0x6, 0x0, &(0x7f0000000000)=0x7f, 0x4) bind$inet6(r0, &(0x7f0000000040)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) getsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER_VALUE(r0, 0x84, 0x7c, &(0x7f00000001c0)={0x0, 0x100000001, 0x6}, &(0x7f0000000240)=0x8) sendto$inet6(r0, &(0x7f00000004c0), 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x4) socket$inet6(0xa, 0x1000000000002, 0x0) r2 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000200)={0x4, 0x0, &(0x7f0000000100)=[@enter_looper], 0x1, 0x0, &(0x7f0000000180)='T'}) r3 = gettid() timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, &(0x7f0000040000)) tkill(r3, 0x1004000000016) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0xfffffffffffffced, 0x0, &(0x7f0000000040)}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x400c630f}], 0x0, 0x0, &(0x7f0000000f4d)}) 12:33:55 executing program 2: perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f0000000180)=""/148, 0x13d}], 0x1, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000340)="696f001b66408225aaa3af068fffebb8a490c47dda6586f1b58895b94a78037dd3714e7198820a7a709e2d30d25e6d846cd5c62a648a598668a8263b752b0b622b115112b5ad8e0425c0b784bbdb89eb8f4da0dd73dd01fe35694c2f78600badf8a0e237dba40713bac9e053b41a9f62be5fbb928018aab5f7500bef51a2fd74d4fffb4a20a946733820bdc1b485afa417cdbcfdfbc54f58c9c3edffe240c36f4ab8a16613814e226b6d20d98010ab1ace49fa76dce337a5a5f1dcff9e5d533b12475e33b971b15b69cd591cd9059759f0f04ba5468a34b98915033debb3e87f048e8601712659d47d8687eb6be5e650068d88000000000000") preadv(r0, &(0x7f0000000480), 0x10000000000000d3, 0x0) msgget$private(0x0, 0x22) [ 458.126443] binder: BINDER_SET_CONTEXT_MGR already set [ 458.152536] binder: 24152:24153 ioctl 40046207 0 returned -16 12:33:55 executing program 5: r0 = syz_open_dev$usb(&(0x7f0000000440)='/dev/bus/usb/00#/00#\x00', 0x7, 0x800) r1 = accept4$vsock_stream(r0, &(0x7f0000000000)={0x28, 0x0, 0xffffffff, @host}, 0x10, 0x800) ioctl$sock_inet_SIOCSIFADDR(r1, 0x8916, &(0x7f0000000140)={'eql\x00', {0x2, 0x4e24, @broadcast}}) socketpair$inet_smc(0x2b, 0x1, 0x0, &(0x7f0000000100)) r2 = syz_open_dev$dmmidi(&(0x7f0000000040)='/dev/dmmidi#\x00', 0x9, 0x2002) bpf$BPF_PROG_ATTACH(0x8, &(0x7f00000000c0)={r2, 0xffffffffffffffff, 0x2, 0x1}, 0x10) pread64(0xffffffffffffffff, &(0x7f0000000340)=""/250, 0xfa, 0x0) preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f0000000180)=""/148, 0x13d}], 0x1, 0x0) fstat(0xffffffffffffffff, &(0x7f00000002c0)) preadv(0xffffffffffffffff, &(0x7f0000000480), 0x10000000000002a1, 0x0) fchmod(0xffffffffffffffff, 0x74) 12:33:55 executing program 0: syz_open_dev$sndctrl(&(0x7f0000000140)='/dev/snd/controlC#\x00', 0x0, 0x0) sched_setaffinity(0x0, 0x7, &(0x7f00000000c0)=0x9) r0 = perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0) fcntl$setflags(r0, 0x2, 0x1) getsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER_VALUE(0xffffffffffffffff, 0x84, 0x7c, &(0x7f00000001c0), &(0x7f0000000240)=0x8) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(0xffffffffffffffff, 0x84, 0x9, &(0x7f0000000280)={0x0, @in={{0x2, 0x4e23, @remote}}, 0xfffffffffffffff7, 0x0, 0x400}, 0x98) sendto$inet6(0xffffffffffffffff, &(0x7f00000004c0), 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) setsockopt$SO_BINDTODEVICE(0xffffffffffffffff, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x4) socket$inet6(0xa, 0x1000000000002, 0x0) r1 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x4, 0x0, &(0x7f0000000100)=[@enter_looper], 0x0, 0x0, &(0x7f0000000180)}) r2 = gettid() timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, &(0x7f0000040000)) tkill(r2, 0x1004000000016) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0xfffffffffffffced, 0x0, &(0x7f0000000040)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x400c630f}], 0x0, 0x0, &(0x7f0000000f4d)}) 12:33:55 executing program 2: perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f0000000180)=""/148, 0x13d}], 0x1, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000340)="696f001b66408225aaa3af068fffebb8a490c47dda6586f1b58895b94a78037dd3714e7198820a7a709e2d30d25e6d846cd5c62a648a598668a8263b752b0b622b115112b5ad8e0425c0b784bbdb89eb8f4da0dd73dd01fe35694c2f78600badf8a0e237dba40713bac9e053b41a9f62be5fbb928018aab5f7500bef51a2fd74d4fffb4a20a946733820bdc1b485afa417cdbcfdfbc54f58c9c3edffe240c36f4ab8a16613814e226b6d20d98010ab1ace49fa76dce337a5a5f1dcff9e5d533b12475e33b971b15b69cd591cd9059759f0f04ba5468a34b98915033debb3e87f048e8601712659d47d8687eb6be5e650068d88000000000000") preadv(r0, &(0x7f0000000480), 0x1000000000000204, 0x0) msgget$private(0x0, 0x22) 12:33:55 executing program 1: preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f0000000180)=""/148, 0x13d}], 0x1, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000340)="696f001b66408225aaa3af068fffebb8a490c47dda6586f1b58895b94a78037dd3714e7198820a7a709e2d30d25e6d846cd5c62a648a598668a8263b752b0b622b115112b5ad8e0425c0b784bbdb89eb8f4da0dd73dd01fe35694c2f78600badf8a0e237dba40713bac9e053b41a9f62be5fbb928018aab5f7500bef51a2fd74d4fffb4a20a946733820bdc1b485afa417cdbcfdfbc54f58c9c3edffe240c36f4ab8a16613814e226b6d20d98010ab1ace49fa76dce337a5a5f1dcff9e5d533b12475e33b971b15b69cd591cd9059759f0f04ba5468a34b98915033debb3e87f048e8601712659d47d8687eb6be5e650068d88000000000000") setsockopt$inet_MCAST_MSFILTER(r0, 0x0, 0x30, &(0x7f0000000440)={0xe276, {{0x2, 0x4e20, @local}}, 0x0, 0x1, [{{0x2, 0x3, @dev={0xac, 0x14, 0x14, 0x16}}}]}, 0x110) preadv(r0, &(0x7f0000000480), 0x10000000000002a1, 0x0) splice(r0, &(0x7f0000000000), r0, &(0x7f0000000040), 0x8, 0x1) ioctl$KVM_ASSIGN_SET_INTX_MASK(r0, 0x4040aea4, &(0x7f0000000080)={0x5, 0x7, 0x4, 0x0, 0x10001}) [ 458.265268] binder: BINDER_SET_CONTEXT_MGR already set [ 458.278926] binder: 24170:24172 ioctl 40046207 0 returned -16 12:33:55 executing program 4: socket$inet6(0xa, 0x0, 0x80000000) sched_setaffinity(0x0, 0x7, &(0x7f00000000c0)=0x9) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0) fcntl$setflags(0xffffffffffffffff, 0x2, 0x1) r0 = socket$inet6(0xa, 0x400000000001, 0x0) r1 = dup(r0) setsockopt$inet6_tcp_int(r1, 0x6, 0x0, &(0x7f0000000000)=0x7f, 0x4) bind$inet6(r0, &(0x7f0000000040)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) getsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER_VALUE(r0, 0x84, 0x7c, &(0x7f00000001c0)={0x0, 0x100000001, 0x6}, &(0x7f0000000240)=0x8) sendto$inet6(r0, &(0x7f00000004c0), 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x4) socket$inet6(0xa, 0x1000000000002, 0x0) r2 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000200)={0x4, 0x0, &(0x7f0000000100)=[@enter_looper], 0x1, 0x0, &(0x7f0000000180)='T'}) r3 = gettid() timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, &(0x7f0000040000)) tkill(r3, 0x1004000000016) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0xfffffffffffffced, 0x0, &(0x7f0000000040)}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x400c630f}], 0x0, 0x0, &(0x7f0000000f4d)}) [ 458.330843] binder: 24170:24172 Acquire 1 refcount change on invalid ref 0 ret -22 [ 458.361802] binder: 24170:24172 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 12:33:55 executing program 5: preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f0000000180)=""/148, 0x13d}], 0x1, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000340)="696f001b66408225aaa3af068fffebb8a490c47dda6586f1b58895b94a78037dd3714e7198820a7a709e2d30d25e6d846cd5c62a648a598668a8263b752b0b622b115112b5ad8e0425c0b784bbdb89eb8f4da0dd73dd01fe35694c2f78600badf8a0e237dba40713bac9e053b41a9f62be5fbb928018aab5f7500bef51a2fd74d4fffb4a20a946733820bdc1b485afa417cdbcfdfbc54f58c9c3edffe240c36f4ab8a16613814e226b6d20d98010ab1ace49fa76dce337a5a5f1dcff9e5d533b12475e33b971b15b69cd591cd9059759f0f04ba5468a34b98915033debb3e87f048e8601712659d47d8687eb6be5e650068d88000000000000") ioctl$FITRIM(r0, 0xc0185879, &(0x7f0000000000)={0x6, 0x8001, 0x4}) preadv(r0, &(0x7f00000009c0), 0x1000000000000474, 0x0) 12:33:55 executing program 1: preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f0000000180)=""/148, 0x13d}], 0x1, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000340)="696f001b66408225aaa3af068fffebb8a490c47dda6586f1b58895b94a78037dd3714e7198820a7a709e2d30d25e6d846cd5c62a648a598668a8263b752b0b622b115112b5ad8e0425c0b784bbdb89eb8f4da0dd73dd01fe35694c2f78600badf8a0e237dba40713bac9e053b41a9f62be5fbb928018aab5f7500bef51a2fd74d4fffb4a20a946733820bdc1b485afa417cdbcfdfbc54f58c9c3edffe240c36f4ab8a16613814e226b6d20d98010ab1ace49fa76dce337a5a5f1dcff9e5d533b12475e33b971b15b69cd591cd9059759f0f04ba5468a34b98915033debb3e87f048e8601712659d47d8687eb6be5e650068d88000000000000") syz_open_dev$mouse(&(0x7f0000000000)='/dev/input/mouse#\x00', 0x3, 0x0) preadv(r0, &(0x7f0000000480), 0x10000000000002a1, 0x0) [ 458.390509] binder: 24170:24177 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 12:33:56 executing program 1: r0 = syz_open_dev$midi(&(0x7f0000000000)='/dev/midi#\x00', 0x7ff, 0x2) getsockopt$XDP_MMAP_OFFSETS(r0, 0x11b, 0x1, &(0x7f0000000040), &(0x7f00000000c0)=0x60) r1 = dup2(0xffffffffffffffff, 0xffffffffffffffff) getsockopt$inet_mreq(r1, 0x0, 0x24, &(0x7f0000000100)={@rand_addr, @rand_addr}, &(0x7f0000000140)=0x8) preadv(r1, &(0x7f0000001380)=[{&(0x7f0000000180)=""/148, 0x94}], 0x1, 0x0) r2 = syz_open_procfs(0x0, &(0x7f0000000340)="696f001b66408225aaa3af068fffebb8a490c47dda6586f1b58895b94a78037dd3714e7198820a7a709e2d30d25e6d846cd5c62a648a598668a8263b752b0b622b115112b5ad8e0425c0b784bbdb89eb8f4da0dd73dd01fe35694c2f78600badf8a0e237dba40713bac9e053b41a9f62be5fbb928018aab5f7500bef51a2fd74d4fffb4a20a946733820bdc1b485afa417cdbcfdfbc54f58c9c3edffe240c36f4ab8a16613814e226b6d20d98010ab1ace49fa76dce337a5a5f1dcff9e5d533b12475e33b971b15b69cd591cd9059759f0f04ba5468a34b98915033debb3e87f048e8601712659d47d8687eb6be5e650068d88000000000000") preadv(r2, &(0x7f0000000480), 0x10000000000002a1, 0x0) 12:33:56 executing program 3: syz_open_dev$sndctrl(&(0x7f0000000140)='/dev/snd/controlC#\x00', 0x0, 0x0) sched_setaffinity(0x0, 0x7, &(0x7f00000000c0)=0x9) r0 = perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0) fcntl$setflags(r0, 0x2, 0x1) getsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER_VALUE(0xffffffffffffffff, 0x84, 0x7c, &(0x7f00000001c0), &(0x7f0000000240)=0x8) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(0xffffffffffffffff, 0x84, 0x9, &(0x7f0000000280)={0x0, @in={{0x2, 0x4e23, @remote}}, 0xfffffffffffffff7, 0x0, 0x400}, 0x98) sendto$inet6(0xffffffffffffffff, &(0x7f00000004c0), 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) setsockopt$SO_BINDTODEVICE(0xffffffffffffffff, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x4) socket$inet6(0xa, 0x1000000000002, 0x0) r1 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x4, 0x0, &(0x7f0000000100)=[@enter_looper], 0x0, 0x0, &(0x7f0000000180)}) r2 = gettid() timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, &(0x7f0000040000)) tkill(r2, 0x1004000000016) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0xfffffffffffffced, 0x0, &(0x7f0000000040)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x400c630f}], 0x0, 0x0, &(0x7f0000000f4d)}) 12:33:56 executing program 2: perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f0000000180)=""/148, 0x13d}], 0x1, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000340)="696f001b66408225aaa3af068fffebb8a490c47dda6586f1b58895b94a78037dd3714e7198820a7a709e2d30d25e6d846cd5c62a648a598668a8263b752b0b622b115112b5ad8e0425c0b784bbdb89eb8f4da0dd73dd01fe35694c2f78600badf8a0e237dba40713bac9e053b41a9f62be5fbb928018aab5f7500bef51a2fd74d4fffb4a20a946733820bdc1b485afa417cdbcfdfbc54f58c9c3edffe240c36f4ab8a16613814e226b6d20d98010ab1ace49fa76dce337a5a5f1dcff9e5d533b12475e33b971b15b69cd591cd9059759f0f04ba5468a34b98915033debb3e87f048e8601712659d47d8687eb6be5e650068d88000000000000") preadv(r0, &(0x7f0000000480), 0x10000000000000ee, 0x0) msgget$private(0x0, 0x22) 12:33:56 executing program 5: preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f0000000180)=""/148, 0x13d}], 0x1, 0x0) r0 = socket(0xa, 0x4, 0x3) setsockopt$inet6_tcp_TCP_MD5SIG(r0, 0x6, 0xe, &(0x7f0000000000)={@in={{0x2, 0x4e24, @multicast2}}, 0x2, 0x40, 0x7, "179215249739d29e750a8e3ded3fae340112d63e1411adb88b68d46b523e8aef01587a4e8db1fb3660be10a53d849894102a39402d707cf19e00bae4040290799589f21516b99030104c4a24fd634f56"}, 0xd8) r1 = syz_open_procfs(0x0, &(0x7f0000000340)="696f001b66408225aaa3af068fffebb8a490c47dda6586f1b58895b94a78037dd3714e7198820a7a709e2d30d25e6d846cd5c62a648a598668a8263b752b0b622b115112b5ad8e0425c0b784bbdb89eb8f4da0dd73dd01fe35694c2f78600badf8a0e237dba40713bac9e053b41a9f62be5fbb928018aab5f7500bef51a2fd74d4fffb4a20a946733820bdc1b485afa417cdbcfdfbc54f58c9c3edffe240c36f4ab8a16613814e226b6d20d98010ab1ace49fa76dce337a5a5f1dcff9e5d533b12475e33b971b15b69cd591cd9059759f0f04ba5468a34b98915033debb3e87f048e8601712659d47d8687eb6be5e650068d88000000000000") preadv(r1, &(0x7f0000000a40)=[{&(0x7f00000023c0)=""/4096, 0x1000}, {&(0x7f0000000ac0)=""/107, 0x6b}, {&(0x7f0000000840)=""/198, 0xc6}, {&(0x7f0000000140)=""/24, 0x18}, {&(0x7f0000000940)=""/153, 0x99}, {&(0x7f0000000a00)=""/25, 0x19}], 0x6, 0x0) 12:33:56 executing program 4: socket$inet6(0xa, 0x0, 0x80000000) sched_setaffinity(0x0, 0x7, &(0x7f00000000c0)=0x9) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0) fcntl$setflags(0xffffffffffffffff, 0x2, 0x1) r0 = socket$inet6(0xa, 0x400000000001, 0x0) r1 = dup(r0) setsockopt$inet6_tcp_int(r1, 0x6, 0x12, &(0x7f0000000000), 0x4) bind$inet6(r0, &(0x7f0000000040)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) getsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER_VALUE(r0, 0x84, 0x7c, &(0x7f00000001c0)={0x0, 0x100000001, 0x6}, &(0x7f0000000240)=0x8) sendto$inet6(r0, &(0x7f00000004c0), 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x4) socket$inet6(0xa, 0x1000000000002, 0x0) r2 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000200)={0x4, 0x0, &(0x7f0000000100)=[@enter_looper], 0x1, 0x0, &(0x7f0000000180)='T'}) r3 = gettid() timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, &(0x7f0000040000)) tkill(r3, 0x1004000000016) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0xfffffffffffffced, 0x0, &(0x7f0000000040)}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x400c630f}], 0x0, 0x0, &(0x7f0000000f4d)}) [ 458.875450] binder: undelivered death notification, 0000000000000000 12:33:56 executing program 1: preadv(0xffffffffffffffff, &(0x7f0000001380), 0x1, 0x400000) bpf$PROG_LOAD(0x5, &(0x7f00000001c0)={0xf, 0xb, &(0x7f0000000000)=@framed={{0x18, 0x0, 0x0, 0x0, 0x3400000000000, 0x0, 0x0, 0x0, 0x9}, [@generic={0x80000000, 0x46df, 0xa27, 0x8}, @initr0={0x18, 0x0, 0x0, 0x0, 0x50, 0x0, 0x0, 0x0, 0x6}, @ldst={0x1, 0x3, 0x1, 0x3, 0x7, 0xfffffffffffffffe}, @generic={0xb226, 0x9af, 0x6, 0x100000000}]}, &(0x7f0000000080)='syzkaller\x00', 0xfffffffffffffff9, 0xdc, &(0x7f00000000c0)=""/220, 0x41100, 0x1, [], 0x0, 0x3}, 0x48) r0 = syz_open_dev$sndpcmc(&(0x7f0000000240)='/dev/snd/pcmC#D#c\x00', 0x5, 0x224922e6f4f1e97c) ioctl$PIO_FONT(r0, 0x4b61, &(0x7f0000000280)="bdd239035921b3aad2aa646468b38d3678a653d5437a2e9fc910efad1d97ca81d15548fd8bc949bd9f9dba8e34fec12e3276c1094c49a25c75928026ea1b78af3f2b98fb36753ebdf0fc2d7a52ce8ce418e3aa21a200be6b01760c16c8ad8bcbce1424ec6433e7f411a49d52441e2443d40e7fb62c16684455b5a2ce5426354f1c3488d6a7acbf8bfbe7b6251159bedf6b4f0edbd01ecf16f470e8c81a708b0f305f658ae36234633b3874bc8ac28d036f11a628c23f04e6f6a3") r1 = syz_open_procfs(0x0, &(0x7f0000000340)="696f001b66408225aaa3af068fffebb8a490c47dda6586f1b58895b94a78037dd3714e7198820a7a709e2d30d25e6d846cd5c62a648a598668a8263b752b0b622b115112b5ad8e0425c0b784bbdb89eb8f4da0dd73dd01fe35694c2f78600badf8a0e237dba40713bac9e053b41a9f62be5fbb928018aab5f7500bef51a2fd74d4fffb4a20a946733820bdc1b485afa417cdbcfdfbc54f58c9c3edffe240c36f4ab8a16613814e226b6d20d98010ab1ace49fa76dce337a5a5f1dcff9e5d533b12475e33b971b15b69cd591cd9059759f0f04ba5468a34b98915033debb3e87f048e8601712659d47d8687eb6be5e650068d88000000000000") write$UHID_INPUT(r1, &(0x7f0000000440)={0x8, "09509df6f2ad77813f51ba15a669757caada69bc8b6a51e105cd4ac0a77af1b44387d22cda2c5f84dda416b7e6cad125514c6623f9c2624b83f48f04c86ca58cdea09ab7766e5199edb4c6218879539bf6fd67d1fee4419ce4721e1cfb08892c642e993163c8382e5397268c39772e71f3c49b558c9638d0af0a872297c899ff0f5a0781f03e5a5aaf8b54f8b74a04e5f6a1069b080e7e31e2deaf90775e2d190bfee11dbee88475040c4bef94f517fb553fe5018d8970796b38294ca74af3349cd621b412b76d5385d98423e411812eba68e19846960229f58cf3ccc1688fc9834adf553bf517d98d255c09ab632efd4f82ce421bb9138da3e5ff04515b658148ff72ef1993fa4919c6c213085775367cfc575c66b59f577394fcdb6694e9765085780b308671bc336fa1d8f3e5e2aa56e01f99393c9f83214581a0b6aa03d42414c1b124918f17191d249f7016b582efc5bd4f64a1a4fd986697b4346320ebf6efea2bbb183446b59145b5603b4bbee2fe9083cbbb9ae37582b5ec82e7b5515569097c6c3421b064b307d9e4a901cd0ee6c0d7e82b5d7569e9703c38cf6530403101257fc98987776b6faf34e024998142e6ffc7463589e7372fd1ac35c75954ef8db23f2c993191eacdf803bc91a6fe4b42f235ae225110596360d48ff7087ab6702121c1a02e3988e4992ec7bf4c48c035ef8031aa86e514c46d2bd56e2c7be8203b5951a602aa0b95fdbd0cfdf6f97fc9de08a82b3440f39a9d797dd3fdcdcdc42b8d1e0668319e4b46f49442fbffadf47c1e29c46e93eff245c4f502bf531e8da097ecb3d01d2f60ff589942dc6bff01eb2744a2a3c579af2c7fc0f3bfd28dbbb0fddc23e34f537b3d1daadfcbc55fab75950dfa3a140051ed3051f08e45b42a6baf2a3f78878b3a9bb6540c079ebc8d023ece7fa4a4f4b8d0468a35df6da89d364539c44a2a300bf8b68c6a5b2da803000ac0666efa96876ab8be0c88c81a744ac7007489210dc46849dba6ba1ef044194978fd493b190d64c19cbba00105cd33308f09d1dd64521babd874edaa805178309ff2830de9185cf75ce0ca4a2addf3d805a6af933103596242d1c46c60eaadc5c9cb123ad4573c47b1409acc1a34db9675fbb10ec5167faefbac8e66af660bc18f47fcf5246a0cae845ec646de02307136025294eff89ea9f2f252422261a959aa7a57b51d34b25bbd1b8bdbddee1a7f218dbc69878db884f4f770bb2ae922659d3396784b2ee1d2072030513e6adcfc06ca2da9b5d845d212fc466f654e64a74eae61be082bf046b928311c5f6eb194cee699c1c99329e6fb0d25a42bf802d8ea375db1c1e43f5cd777604b17d3be183f071bff3f4be7a6037cef86599d400562e3e90bd6f94750ff2cfc24276cb14e6b2861fd43f2f20ec26aca86c1ddb55e8d0573bb4da18bea1109b51faba6d042b9276aee7c994c3c1bf5610d312aa53a0d8e8ee6c202b08e2a9c25b3f9132ada5ffb5cfc08cc5af8d9583fe50f0d698ab8c70c0a7226ea0fa6032644d6d187cc61be8184d9bd99d46dd0a6867bce83611cbde866595c2474181f6e3b625ebafa00ad25634a1af1be59b4140ba4bcf7c2ab56ceaf0324073657f1c53d805577406c066535c391237615031fdd46ba8906c0755d1d9cfb9d3ad5d25065fd05e5515b1ecc901f088489899693301d4b95f53671ac1271f612e9dabbe0b260dbf6defccd86b02cff01ea3ba33dc0f78d68cc13791c1b512c7b399692c2a3b1c44d6a45da6b754571b09b5c06cab8b22aab80cd0fcd56b513397d44a1d77224f823ef23d82fa3c6465717546d375d22abb191a827220076e6510a49a4be7c817bf2a5af97b09bab2b4c8b35e5ba16f8135da2d7a837750a6c8df7b4795944b3423df9948aa4705c8dd1c38394ada7954f0127bfe5cb6a9d36b5f5b4381bd1646fa78808cb501969b2bf6645dc8bce250f2384c512e7f9ba8662a3fef3802f3f80526cbe5c6593c683d302e2e55874a38b17078868fb89a0d03fa7d4db4afedf762cbf0813094c163ba4902d271472c6a65f90cbb2d4e9c5d16342a51571711f38cab783f2da339f2a7a07e14a760a9c834194119346d2df0ed2090a6cf47c2bd4896f964123d1f496ff8e35dd0227f2156b9c19a69874a136b869c48e222a2663be796666d196e9defa348a6946026b26d10d268089f08706a22e8fb5b84f31e1c4f099c427614b5d8d5587382b171ac281548999a38695f37b4cb8310ae282a961c8ca39a67a68fc7a4f617e001b2268a0cbfe0745f211e778e2cc39b4594e6692bb4f29d44703ea73d0eb16464cfb0aaab51796b2131c1a40ea026b8f85e250e98380220fefc6157f3bfb3dd9903ca80a0b34ca66d8b9b1927a06092a2f462b5779c609edd54739a4ad787b62c5cd63d8497cf17962a93aafbcaf9b6276d081a1603df1151e04b78fbcf6b920162d16fb750e51a2de58a760d2f9a687f66013c4ad9a77c809630384e70c2a493b37b4da4ae4f35ec0cd92d1d5608542ff2dd867c7bae637b87d26bf410058bf4075bc59f5eb1278428dfcc8d4ef6a1ba7de6105cddbad31b6f089f1ded1cc75b0dc99add76ab5e0788ec79724e74adcdcdc672cc72ff50ee9f7458ed85283eabc0c2e292fd8978f5b8ea179bff139f125134558c3a32daa0c3869ffcc4f0497d604fff83be3712a4a2e55f4bc75a993c8c8edaf594cc7315e3f69a676d0bd81889840f2c02bb798195c530d33b555828cd27aa29e95d83bc3668b74160fb4b0bf7e4852165e92748a0bfc2e59e6934cc73574ece015cd0be31568a0f5993b6a8886f406667325ead0a5665a8eb077e95f968083bad173e569622ca943b8511b2a82771a4c16960068daa3ab59c3562929b26373e35dee4074fb7222fefc74f809a58c6833798fd0fd89e068645671cade783f74dce8c646186c0703a91f6674b82a1ff51761217f11c4c292fb4ac649a084660843198d87d40f8e56cd01e972cff24703466dc76aaf1fb0af536675ad1120cba89095a92e783a88d60428373c5c4ce5527f442d1e3212db978e820853c8b7c9ef91ff0ad376a8bcaa7cf5a0c0ad8a494139f2ef4ec651bab55ea7da9f0431fa09bdf9d1320016d7a36fb2b570a4f57345a0a6daca4dabde6e414fc30dff261103a14032da78747fcd19702cdf47d1e0290477c7e127fd5653a26029c04dd8707786898215b0e624a155cc89072508a18bb785384b9f1af4a7af4de2806256daf0e156046b48a27f5023d4261cf68c8aacf0d5d651e9aeab2fd2995eebc88b46eca6248fadd4b4199d5e1e7688f7f574b5822e8aa49fc0cddafc50a65dd5cbefcd908e292be31449a99e26930280545fb0ed37774e5467e063b75343e89fa75a0ebe2da580e7d5def1afac26b523cd79c093a30eebbb74035dc66e44de1abd51b32e2c76e30ebc03b9695bf8b82f6165a15946df83623d3fe092c6d27d9d15b710702f01d8460ce09308e19197ab335b29e155892dc0a2909694a9a3db83ea4d37e9cd51e703b6aaaabd45e69a12fe1e4ce7136a7d09ce693c43c303f4a834813a75cca8262090a3cc235fe2b1588dca31a33e219c7104f45856aa4e15daa0aa402190c0fbb12b8e0ab664fea1feaaa8f14f73cb8e7744d0d836b620ed526a796bc1bde0ba66524fa0c80d03e671bd91ad5fcb0e60533b0ea74dd608d61e78792e86f514f306cb6911924d6bd1df4ce63be4268e920586bfa26df54fbdb4e3c8430edb77eb4ac78ade602c4b4c8e2b108d884dfda209c83e43482176052e634256a859e92758c378ad7c2de3fc093ab368144fac87a8d14fff0430a4983d966aa9bae7ceb492f1940ce17c38a170e419fd7e3899b1f7f6bb34fa7d8fa2b777dbecbe8b830168487894bfcbe50027693dcc7c16ec83fade4e392dc698ae52dbeeaf4bf1e6e125c578e531e483b17ef176bb2d651a6f78db460273feffe7e35297882b757022b349a7630b0c1af30a4ee54ae6fb5b0da78f99d05a7a71fdc810ae4a31814d4303f712ea48639668bf32937de2899e07b7bca5f101f1cd50bee1341836e2e1bf4777dd6373d6de2ddec00330b3be41b40dfb72195e74cecd27ba3dc792e892d73484d7e276931145493f90b818e52c609af6f65c78be1714d7d518b6b118fbd25622659d62bfa96efaa218c48533fe88e7269d75fd238ab8c8f80843f73d7a8f9bf17bed26983224ed9d4758e03136221b72544b602465d748caf3d82b24b88087d6e86ae02033b27031376f8fcc773f766ba63f0304aa00bd791c6bf9f2fafb40fd98b794257ec810b77c48f62a74481f64a50bac046121c63502e7ea2e3d607b586e4ee40595ab1a3e7b79ddb4a330c443e03c0cafe89ede5786cf1837e35fc4523a5715411483fce65c955d9cff56116c3355ad4c573e9c406c09498bb0bf985b88c851e4a325de8912d856587e53c33bd0340ec2ecb8ce880024c174baf3df9c06297d5c16cd78d0ab8c3b5d770a1b055d0e99978063b0c3ab5276f89f92b2e996be697ba589d169827882c0794e0e65cab3736a95c8e673d09fba9a27055450372fc369f46a05af34ed6a85d080155b94e8e37555e707b6e05533581d80e9a551b477ab71f30358587c2628c7c249c51a308c56256115b288e0c879f4cf02ee19226ce600b43b71e230baa57aa3cc8ffd9ce838bdbc5f7b603630c4df0739b3718687e4a5d205e033811f84df3557378d69cc73a84c22f62a3a0461b50b793cd89f08f2af10071b2402e604bbdd3d128b671daef0665eeb96a786447d241c8a52653931fdd53013fc996e64fb289adf5efcc651cb867875123d4dc67a329c6b9fdb4129b5f707b3d3e6201c826183786c60a3ef59dedd261adc0e89a17a012ef0a6712fff409543408edc1500574e57db98b037cc646b0681b95a637fc0c6ebc93d8a51987389eaa4845efc4e3500c76a96a391371c244277c7d5fd5d0504ed3e0b7bf4bb9f26986ef93b5fb8b876e002c9738fc048c81c0f099521fb1ee5af627def35c420042e770d14c702dbf69f641645f69ec9ad43b5d96e35351694477d23341b5cab59a6d3416866e7fa7a8effd1abecbcee9df9b85ea5d805660b3fa16d89ff26187e5a65ba077ba02c771f7bdba3b2f26c8923861df5e000fbdad6ca1f8c9c77011eda338cd2fb8c9d88c195ff699b52c40b33fae6c8acc47781092d42015cfce6c5f4efeff2f0f73e757da7ac8a29c8934f8d83eb1e037b46b4becf82a2b87256c439bb78790de0b2e735849df2c86e9c80024d8a1a8cd499b2d7202d7c535dabee7dded811d9b743fc971fd7ff770a66fc890f65f818f02dd206f0e8f2b95eafedcfceb2244d08790b62fbd7a2fc576b62d1eae5f2daf26ba10d9e6b45191891b24b9492c90e700983af62d6e784feab93d5cd31a83bcc562c2ecf27803a61a478e231205f3eb54b7128306099890264623afb079985e7d1a0cb43767d1ce0c047f576de876d9b4e2c266f2dc4af613ccb063a2d33fb4ba21a9042e7c1a4672ede6b5441c36f83cc8ad872b2584a58d67d7f116351b102c650fa471ce30e6e58a43eb41a6ba7e11bae0e72f9b5a9a81edcf02ef350a7fc717b4d1caf9e3939d0af739069f0dae0b9583f26ed30921ed1415ae042bcf731fc3d3a9abecfef9e9eb07d9cbcee15b46f7811d3e77e47dad52100bb2c9f8b0b54ae9b726101b56e121acf7030827a7a73a63e6794d74c973bd608acdd3bc6c70aa7fb086d07a13cedafa360c6faf33241c37da54fa2127d83", 0x1000}, 0x1006) preadv(r1, &(0x7f0000000480), 0x0, 0x0) [ 458.971082] binder: BINDER_SET_CONTEXT_MGR already set [ 458.977556] binder: 24212:24214 ioctl 40046207 0 returned -16 [ 459.031105] binder: undelivered death notification, 0000000000000000 12:33:56 executing program 0: syz_open_dev$sndctrl(&(0x7f0000000140)='/dev/snd/controlC#\x00', 0x0, 0x0) sched_setaffinity(0x0, 0x7, &(0x7f00000000c0)=0x9) r0 = perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0) fcntl$setflags(r0, 0x2, 0x1) getsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER_VALUE(0xffffffffffffffff, 0x84, 0x7c, &(0x7f00000001c0), &(0x7f0000000240)=0x8) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(0xffffffffffffffff, 0x84, 0x9, &(0x7f0000000280)={0x0, @in={{0x2, 0x4e23, @remote}}, 0xfffffffffffffff7, 0x0, 0x400}, 0x98) sendto$inet6(0xffffffffffffffff, &(0x7f00000004c0), 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) setsockopt$SO_BINDTODEVICE(0xffffffffffffffff, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x4) socket$inet6(0xa, 0x1000000000002, 0x0) r1 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x4, 0x0, &(0x7f0000000100)=[@enter_looper], 0x1, 0x0, &(0x7f0000000180)='T'}) r2 = gettid() timer_create(0x0, &(0x7f0000044000), &(0x7f0000044000)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, &(0x7f0000040000)) tkill(r2, 0x1004000000016) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0xfffffffffffffced, 0x0, &(0x7f0000000040)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x400c630f}], 0x0, 0x0, &(0x7f0000000f4d)}) 12:33:56 executing program 2: perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f0000000180)=""/148, 0x13d}], 0x1, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000340)="696f001b66408225aaa3af068fffebb8a490c47dda6586f1b58895b94a78037dd3714e7198820a7a709e2d30d25e6d846cd5c62a648a598668a8263b752b0b622b115112b5ad8e0425c0b784bbdb89eb8f4da0dd73dd01fe35694c2f78600badf8a0e237dba40713bac9e053b41a9f62be5fbb928018aab5f7500bef51a2fd74d4fffb4a20a946733820bdc1b485afa417cdbcfdfbc54f58c9c3edffe240c36f4ab8a16613814e226b6d20d98010ab1ace49fa76dce337a5a5f1dcff9e5d533b12475e33b971b15b69cd591cd9059759f0f04ba5468a34b98915033debb3e87f048e8601712659d47d8687eb6be5e650068d88000000000000") preadv(r0, &(0x7f0000000480), 0x1000000000000150, 0x0) msgget$private(0x0, 0x22) 12:33:56 executing program 3: syz_open_dev$sndctrl(&(0x7f0000000140)='/dev/snd/controlC#\x00', 0x0, 0x0) sched_setaffinity(0x0, 0x7, &(0x7f00000000c0)=0x9) r0 = perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0) fcntl$setflags(r0, 0x2, 0x1) getsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER_VALUE(0xffffffffffffffff, 0x84, 0x7c, &(0x7f00000001c0), &(0x7f0000000240)=0x8) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(0xffffffffffffffff, 0x84, 0x9, &(0x7f0000000280)={0x0, @in={{0x2, 0x4e23, @remote}}, 0xfffffffffffffff7, 0x0, 0x400}, 0x98) sendto$inet6(0xffffffffffffffff, &(0x7f00000004c0), 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) setsockopt$SO_BINDTODEVICE(0xffffffffffffffff, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x4) socket$inet6(0xa, 0x1000000000002, 0x0) r1 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x4, 0x0, &(0x7f0000000100)=[@enter_looper], 0x0, 0x0, &(0x7f0000000180)}) r2 = gettid() timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, &(0x7f0000040000)) tkill(r2, 0x1004000000016) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0xfffffffffffffced, 0x0, &(0x7f0000000040)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x400c630f}], 0x0, 0x0, &(0x7f0000000f4d)}) 12:33:56 executing program 4: socket$inet6(0xa, 0x0, 0x80000000) sched_setaffinity(0x0, 0x7, &(0x7f00000000c0)=0x9) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0) fcntl$setflags(0xffffffffffffffff, 0x2, 0x1) r0 = socket$inet6(0xa, 0x400000000001, 0x0) r1 = dup(r0) setsockopt$inet6_tcp_int(r1, 0x6, 0x12, &(0x7f0000000000), 0x4) bind$inet6(r0, &(0x7f0000000040)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) getsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER_VALUE(r0, 0x84, 0x7c, &(0x7f00000001c0)={0x0, 0x100000001, 0x6}, &(0x7f0000000240)=0x8) sendto$inet6(r0, &(0x7f00000004c0), 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x4) socket$inet6(0xa, 0x1000000000002, 0x0) r2 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000200)={0x4, 0x0, &(0x7f0000000100)=[@enter_looper], 0x1, 0x0, &(0x7f0000000180)='T'}) r3 = gettid() timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, &(0x7f0000040000)) tkill(r3, 0x1004000000016) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0xfffffffffffffced, 0x0, &(0x7f0000000040)}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x400c630f}], 0x0, 0x0, &(0x7f0000000f4d)}) 12:33:56 executing program 1: preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f0000000180)=""/148, 0x13d}], 0x1, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000340)="696f001b66408225aaa3af068fffebb8a490c47dda6586f1b58895b94a78037dd3714e7198820a7a709e2d30d25e6d846cd5c62a648a598668a8263b752b0b622b115112b5ad8e0425c0b784bbdb89eb8f4da0dd73dd01fe35694c2f78600badf8a0e237dba40713bac9e053b41a9f62be5fbb928018aab5f7500bef51a2fd74d4fffb4a20a946733820bdc1b485afa417cdbcfdfbc54f58c9c3edffe240c36f4ab8a16613814e226b6d20d98010ab1ace49fa76dce337a5a5f1dcff9e5d533b12475e33b971b15b69cd591cd9059759f0f04ba5468a34b98915033debb3e87f048e8601712659d47d8687eb6be5e650068d88000000000000") setsockopt$IP_VS_SO_SET_STOPDAEMON(r0, 0x0, 0x48c, &(0x7f0000000000)={0x0, 'yam0\x00', 0x4}, 0x18) preadv(r0, &(0x7f0000000480), 0x10000000000002a1, 0x0) ioctl$PPPIOCSFLAGS(r0, 0x40047459, &(0x7f0000000040)=0x80) 12:33:56 executing program 5: preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f0000000180)=""/148, 0x13d}], 0x1, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000340)="696f001b66408225aaa3af068fffebb8a490c47dda6586f1b58895b94a78037dd3714e7198820a7a709e2d30d25e6d846cd5c62a648a598668a8263b752b0b622b115112b5ad8e0425c0b784bbdb89eb8f4da0dd73dd01fe35694c2f78600badf8a0e237dba40713bac9e053b41a9f62be5fbb928018aab5f7500bef51a2fd74d4fffb4a20a946733820bdc1b485afa417cdbcfdfbc54f58c9c3edffe240c36f4ab8a16613814e226b6d20d98010ab1ace49fa76dce337a5a5f1dcff9e5d533b12475e33b971b15b69cd591cd9059759f0f04ba5468a34b98915033debb3e87f048e8601712659d47d8687eb6be5e650068d88000000000000") preadv(r0, &(0x7f00000004c0)=[{&(0x7f0000000040)=""/49, 0x31}, {&(0x7f0000000080)=""/65, 0x41}, {&(0x7f0000000100)=""/51, 0x33}, {&(0x7f0000000140)=""/12, 0xc}, {&(0x7f0000000240)=""/210, 0xd2}], 0x5, 0x0) ioctl$BLKFRASET(r0, 0x1264, &(0x7f0000000000)=0xffffffffffffff91) preadv(r0, &(0x7f0000000480), 0x10000118, 0x0) ioctl$KVM_RUN(r0, 0xae80, 0x0) [ 459.234698] binder: BINDER_SET_CONTEXT_MGR already set [ 459.271973] binder: 24238:24239 ioctl 40046207 0 returned -16 12:33:56 executing program 5: preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f0000000180)=""/148, 0x13d}], 0x1, 0x0) fcntl$getownex(0xffffffffffffffff, 0x10, &(0x7f0000000100)) r0 = getpgrp(0xffffffffffffffff) r1 = syz_open_procfs(r0, &(0x7f0000000440)="696f001b66408225aaa3af068fffebb8a490c47dda6586f1b58895b94a78037dd3714e7198820a7a709e2d30d25e6d846cd5c62a648a598668a8263b752b0b622b115112b5ad8e0425c0b784bbdb89eb8f4da0dd73dd01fe35694c2f78600badf8a0e237dba40713bac9e053b41a9f62be5fbb928018aab5f7500bef51a2fd74d4fffb4a20a946733820bdc1b485afa417cdbcfd5db79f2264acaf34fbc54f58c9c3edffe240c36f4ab8a16613814e226b6d20d98010ab1ace49fa76dce337a5a5f1dcff9e5d533b12475e33b971b15b69cd591cd9059759f0f04ba5468a34b98915033debb3e87f048e8601712659d47d8687eb6be5e650068d88000000000000") preadv(r1, &(0x7f0000000480), 0x10000000000002a1, 0x0) getsockopt$inet_sctp_SCTP_PR_SUPPORTED(r1, 0x84, 0x71, &(0x7f0000000000)={0x0, 0x40}, &(0x7f0000000040)=0x8) setsockopt$inet_sctp_SCTP_PRIMARY_ADDR(r1, 0x84, 0x6, &(0x7f0000000240)={r2, @in={{0x2, 0x4e21, @dev={0xac, 0x14, 0x14, 0x1b}}}}, 0x84) 12:33:56 executing program 1: preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f0000000180)=""/148, 0x94}], 0x1, 0x200) fcntl$getownex(0xffffffffffffff9c, 0x10, &(0x7f0000000000)={0x0, 0x0}) r1 = syz_open_procfs(r0, &(0x7f0000000340)="696f001b66408225aaa3af068fffebb8a490c47dda6586f1b58895b94a78037dd3714e7198820a7a709e2d30d25e6d846cd5c62a648a598668a8263b752b0b622b115112b5ad8e0425c0b784bbdb89eb8f4da0dd73dd01fe35694c2f78600badf8a0e237dba40713bac9e053b41a9f62be5fbb928018aab5f7500bef51a2fd74d4fffb4a20a946733820bdc1b485afa417cdbcfdfbc54f58c9c3edffe240c36f4ab8a16613814e226b6d20d98010ab1ace49fa76dce337a5a5f1dcff9e5d533b12475e33b971b15b69cd591cd9059759f0f04ba5468a34b98915033debb3e87f048e8601712659d47d8687eb6be5e650068d88000000000000") getsockopt$sock_cred(r1, 0x1, 0x11, &(0x7f0000000040)={0x0, 0x0}, &(0x7f0000000080)=0xc) getsockopt$sock_cred(r1, 0x1, 0x11, &(0x7f00000000c0)={0x0, 0x0, 0x0}, &(0x7f0000000100)=0xc) fchown(r1, r2, r3) preadv(r1, &(0x7f0000000480), 0x10000000000002a1, 0x0) [ 459.280459] binder: BINDER_SET_CONTEXT_MGR already set [ 459.286913] binder: 24241:24244 ioctl 40046207 0 returned -16 12:33:56 executing program 3: syz_open_dev$sndctrl(&(0x7f0000000140)='/dev/snd/controlC#\x00', 0x0, 0x0) sched_setaffinity(0x0, 0x7, &(0x7f00000000c0)=0x9) r0 = perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0) fcntl$setflags(r0, 0x2, 0x1) getsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER_VALUE(0xffffffffffffffff, 0x84, 0x7c, &(0x7f00000001c0), &(0x7f0000000240)=0x8) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(0xffffffffffffffff, 0x84, 0x9, &(0x7f0000000280)={0x0, @in={{0x2, 0x4e23, @remote}}, 0xfffffffffffffff7, 0x0, 0x400}, 0x98) sendto$inet6(0xffffffffffffffff, &(0x7f00000004c0), 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) setsockopt$SO_BINDTODEVICE(0xffffffffffffffff, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x4) socket$inet6(0xa, 0x1000000000002, 0x0) r1 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x4, 0x0, &(0x7f0000000100)=[@enter_looper], 0x0, 0x0, &(0x7f0000000180)}) r2 = gettid() timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, &(0x7f0000040000)) tkill(r2, 0x1004000000016) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0xfffffffffffffced, 0x0, &(0x7f0000000040)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x400c630f}], 0x0, 0x0, &(0x7f0000000f4d)}) 12:33:56 executing program 2: perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f0000000180)=""/148, 0x13d}], 0x1, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000340)="696f001b66408225aaa3af068fffebb8a490c47dda6586f1b58895b94a78037dd3714e7198820a7a709e2d30d25e6d846cd5c62a648a598668a8263b752b0b622b115112b5ad8e0425c0b784bbdb89eb8f4da0dd73dd01fe35694c2f78600badf8a0e237dba40713bac9e053b41a9f62be5fbb928018aab5f7500bef51a2fd74d4fffb4a20a946733820bdc1b485afa417cdbcfdfbc54f58c9c3edffe240c36f4ab8a16613814e226b6d20d98010ab1ace49fa76dce337a5a5f1dcff9e5d533b12475e33b971b15b69cd591cd9059759f0f04ba5468a34b98915033debb3e87f048e8601712659d47d8687eb6be5e650068d88000000000000") preadv(r0, &(0x7f0000000480), 0x10000000000000aa, 0x0) msgget$private(0x0, 0x22) 12:33:56 executing program 5: preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f0000000000)=""/148, 0x94}], 0x1, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000340)="696f001b66408225aaa3af068fffebb8a490c47dda6586f1b58895b94a78037dd3714e7198820a7a709e2d30d25e6d846cd5c62a648a598668a8263b752b0b622b115112b5ad8e0425c0b784bbdb89eb8f4da0dd73dd01fe35694c2f78600badf8a0e237dba40713bac9e053b41a9f62be5fbb928018aab5f7500bef51a2fd74d4fffb4a20a946733820bdc1b485afa417cdbcfdfbc54f58c9c3edffe240c36f4ab8a16613814e226b6d20d98010ab1ace49fa76dce337a5a5f1dcff9e5d533b12475e33b971b15b69cd591cd9059759f0f04ba5468a34b98915033debb3e87f048e8601712659d47d8687eb6be5e650068d88000000000000") preadv(r0, &(0x7f0000000480), 0x10000000000002a1, 0x0) [ 459.379746] binder: 24241:24255 Acquire 1 refcount change on invalid ref 0 ret -22 [ 459.401777] binder: 24241:24255 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 459.429172] binder: 24241:24263 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 12:33:56 executing program 2: perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f0000000180)=""/148, 0x13d}], 0x1, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000340)="696f001b66408225aaa3af068fffebb8a490c47dda6586f1b58895b94a78037dd3714e7198820a7a709e2d30d25e6d846cd5c62a648a598668a8263b752b0b622b115112b5ad8e0425c0b784bbdb89eb8f4da0dd73dd01fe35694c2f78600badf8a0e237dba40713bac9e053b41a9f62be5fbb928018aab5f7500bef51a2fd74d4fffb4a20a946733820bdc1b485afa417cdbcfdfbc54f58c9c3edffe240c36f4ab8a16613814e226b6d20d98010ab1ace49fa76dce337a5a5f1dcff9e5d533b12475e33b971b15b69cd591cd9059759f0f04ba5468a34b98915033debb3e87f048e8601712659d47d8687eb6be5e650068d88000000000000") preadv(r0, &(0x7f0000000480), 0x10000000000001cf, 0x0) msgget$private(0x0, 0x22) 12:33:59 executing program 0: syz_open_dev$sndctrl(&(0x7f0000000140)='/dev/snd/controlC#\x00', 0x0, 0x0) sched_setaffinity(0x0, 0x7, &(0x7f00000000c0)=0x9) r0 = perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0) fcntl$setflags(r0, 0x2, 0x1) getsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER_VALUE(0xffffffffffffffff, 0x84, 0x7c, &(0x7f00000001c0), &(0x7f0000000240)=0x8) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(0xffffffffffffffff, 0x84, 0x9, &(0x7f0000000280)={0x0, @in={{0x2, 0x4e23, @remote}}, 0xfffffffffffffff7, 0x0, 0x400}, 0x98) sendto$inet6(0xffffffffffffffff, &(0x7f00000004c0), 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) setsockopt$SO_BINDTODEVICE(0xffffffffffffffff, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x4) socket$inet6(0xa, 0x1000000000002, 0x0) r1 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x4, 0x0, &(0x7f0000000100)=[@enter_looper], 0x1, 0x0, &(0x7f0000000180)='T'}) r2 = gettid() timer_create(0x0, &(0x7f0000044000), &(0x7f0000044000)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, &(0x7f0000040000)) tkill(r2, 0x1004000000016) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0xfffffffffffffced, 0x0, &(0x7f0000000040)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x400c630f}], 0x0, 0x0, &(0x7f0000000f4d)}) 12:33:59 executing program 1: preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f0000000180)=""/148, 0x13d}], 0x1, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000340)="696f001b66408225aaa3af068fffebb8a490c47dda6586f1b58895b94a78037dd3714e7198820a7a709e2d30d25e6d846cd5c62a648a598668a8263b752b0b622b115112b5ad8e0425c0b784bbdb89eb8f4da0dd73dd01fe35694c2f78600badf8a0e237dba40713bac9e053b41a9f62be5fbb928018aab5f7500bef51a2fd74d4fffb4a20a946733820bdc1b485afa417cdbcfdfbc54f58c9c3edffe240c36f4ab8a16613814e226b6d20d98010ab1ace49fa76dce337a5a5f1dcff9e5d533b12475e33b971b15b69cd591cd9059759f0f04ba5468a34b98915033debb3e87f048e8601712659d47d8687eb6be5e650068d88000000000000") preadv(r0, &(0x7f0000000480), 0x10000000000002a1, 0x0) ioctl$DRM_IOCTL_AGP_ALLOC(r0, 0xc0206434, &(0x7f0000000000)={0x1, 0x0, 0x10002, 0x9}) ioctl$DRM_IOCTL_AGP_BIND(r0, 0x40106436, &(0x7f0000000040)={r1, 0xfffffffffffffffe}) 12:33:59 executing program 3: syz_open_dev$sndctrl(&(0x7f0000000140)='/dev/snd/controlC#\x00', 0x0, 0x0) sched_setaffinity(0x0, 0x7, &(0x7f00000000c0)=0x9) r0 = perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0) fcntl$setflags(r0, 0x2, 0x1) getsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER_VALUE(0xffffffffffffffff, 0x84, 0x7c, &(0x7f00000001c0), &(0x7f0000000240)=0x8) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(0xffffffffffffffff, 0x84, 0x9, &(0x7f0000000280)={0x0, @in={{0x2, 0x4e23, @remote}}, 0xfffffffffffffff7, 0x7850, 0x400, 0x97df, 0xc1}, 0x98) sendto$inet6(0xffffffffffffffff, &(0x7f00000004c0), 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) setsockopt$SO_BINDTODEVICE(0xffffffffffffffff, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x4) socket$inet6(0xa, 0x1000000000002, 0x0) r1 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x4, 0x0, &(0x7f0000000100)=[@enter_looper], 0x1, 0x0, &(0x7f0000000180)='T'}) r2 = gettid() timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, &(0x7f0000040000)) tkill(r2, 0x1004000000016) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0xfffffffffffffced, 0x0, &(0x7f0000000040)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x400c630f}], 0x0, 0x0, &(0x7f0000000f4d)}) 12:33:59 executing program 5: preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f0000000180)=""/148, 0x13d}], 0x1, 0x0) socketpair(0x1b, 0x7, 0x100000001, &(0x7f0000000000)) r0 = openat$audio(0xffffffffffffff9c, &(0x7f0000000040)='/dev/audio\x00', 0x381001, 0x0) ioctl$TIOCGSID(r0, 0x5429, &(0x7f0000000080)=0x0) r2 = syz_open_procfs(r1, &(0x7f0000000340)='setgroups\x00') preadv(r2, &(0x7f0000000480), 0x10000000000002a1, 0x0) 12:33:59 executing program 2: perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f0000000180)=""/148, 0x13d}], 0x1, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000340)="696f001b66408225aaa3af068fffebb8a490c47dda6586f1b58895b94a78037dd3714e7198820a7a709e2d30d25e6d846cd5c62a648a598668a8263b752b0b622b115112b5ad8e0425c0b784bbdb89eb8f4da0dd73dd01fe35694c2f78600badf8a0e237dba40713bac9e053b41a9f62be5fbb928018aab5f7500bef51a2fd74d4fffb4a20a946733820bdc1b485afa417cdbcfdfbc54f58c9c3edffe240c36f4ab8a16613814e226b6d20d98010ab1ace49fa76dce337a5a5f1dcff9e5d533b12475e33b971b15b69cd591cd9059759f0f04ba5468a34b98915033debb3e87f048e8601712659d47d8687eb6be5e650068d88000000000000") preadv(r0, &(0x7f0000000480), 0x100000000000024d, 0x0) msgget$private(0x0, 0x22) 12:33:59 executing program 4: socket$inet6(0xa, 0x0, 0x80000000) sched_setaffinity(0x0, 0x7, &(0x7f00000000c0)=0x9) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0) fcntl$setflags(0xffffffffffffffff, 0x2, 0x1) r0 = socket$inet6(0xa, 0x400000000001, 0x0) r1 = dup(r0) setsockopt$inet6_tcp_int(r1, 0x6, 0x12, &(0x7f0000000000)=0x7f, 0x4) bind$inet6(0xffffffffffffffff, &(0x7f0000000040)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) getsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER_VALUE(r0, 0x84, 0x7c, &(0x7f00000001c0)={0x0, 0x100000001, 0x6}, &(0x7f0000000240)=0x8) sendto$inet6(r0, &(0x7f00000004c0), 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x4) socket$inet6(0xa, 0x1000000000002, 0x0) r2 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000200)={0x4, 0x0, &(0x7f0000000100)=[@enter_looper], 0x1, 0x0, &(0x7f0000000180)='T'}) r3 = gettid() timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, &(0x7f0000040000)) tkill(r3, 0x1004000000016) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0xfffffffffffffced, 0x0, &(0x7f0000000040)}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x400c630f}], 0x0, 0x0, &(0x7f0000000f4d)}) 12:33:59 executing program 5: preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f0000000180)=""/148, 0x13d}], 0x1, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000000)="696f001b66408225aaa3af068fffebb8a490c47dda6586f1b58895b94a78037dd3714e7198820a7a709e2d30d25e6d846cd5c62a648a598668a8263b752b0b622b115112b5ad8e0425c0b784bbdb89eb8f4da0dd73f1a36ac85aae82ccdd01fe35694c2f78600badf8a0e237dba40713bac9e053b41a9f62be5fbb928018aab5f7500bef51a2fd74d4fffb4a20a946733820bdc1b485afa417cdbcfdfbc54f58c9c3edffe240c36f4ab8a16613814e226b6d20d98010ab1ace49fa76dce337a5a50a0147598bc654afa1dd5f96f1dcff9e5d533b12475e33b971b15b69cd591cd9059759f0f04ba5468a34b98915033debb3e87f048e8601712659d47d8687eb6be5e65006") preadv(r0, &(0x7f0000000480), 0x10000000000002a1, 0x0) 12:33:59 executing program 1: r0 = syz_init_net_socket$llc(0x1a, 0x3, 0x0) preadv(r0, &(0x7f0000001380), 0x0, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000340)="696f001b66408225aaa3af068fffebb8a490c47dda6586f1b58895b94a78037dd3714e7198820a7a709e2d30d25e6d846cd5c62a648a598668a8263b752b0b622b115112b5ad8e0425c0b784bbdb89eb8f4da0dd73dd01fe35694c2f78600badf8a0e237dba40713bac9e053b41a9f62be5fbb928018aab5f7500bef51a2fd74d4fffb4a20a946733820bdc1b485afa417cdbcfdfbc54f58c9c3edffe240c36f4ab8a16613814e226b6d20d98010ab1ace49fa76dce337a5a5f1dcff9e5d533b12475e33b971b15b69cd591cd9059759f0f04ba5468a34b98915033debb3e87f048e8601712659d47d8687eb6be5e650068d88000000000000") preadv(r1, &(0x7f0000000480), 0x10000000000002a1, 0x0) [ 462.401945] binder: BINDER_SET_CONTEXT_MGR already set [ 462.409223] binder: BINDER_SET_CONTEXT_MGR already set [ 462.418128] binder: 24286:24288 ioctl 40046207 0 returned -16 [ 462.427173] binder: 24293:24294 ioctl 40046207 0 returned -16 12:33:59 executing program 3: syz_open_dev$sndctrl(&(0x7f0000000140)='/dev/snd/controlC#\x00', 0x0, 0x0) sched_setaffinity(0x0, 0x7, &(0x7f00000000c0)=0x9) r0 = perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0) fcntl$setflags(r0, 0x2, 0x1) getsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER_VALUE(0xffffffffffffffff, 0x84, 0x7c, &(0x7f00000001c0)={0x0}, &(0x7f0000000240)=0x8) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(0xffffffffffffffff, 0x84, 0x9, &(0x7f0000000280)={r1, @in={{0x2, 0x4e23, @remote}}, 0xfffffffffffffff7, 0x7850, 0x400, 0x97df, 0xc1}, 0x98) sendto$inet6(0xffffffffffffffff, &(0x7f00000004c0), 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) setsockopt$SO_BINDTODEVICE(0xffffffffffffffff, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x4) socket$inet6(0xa, 0x1000000000002, 0x0) r2 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000200)={0x4, 0x0, &(0x7f0000000100)=[@enter_looper], 0x1, 0x0, &(0x7f0000000180)='T'}) r3 = gettid() timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, &(0x7f0000040000)) tkill(r3, 0x1004000000016) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0xfffffffffffffced, 0x0, &(0x7f0000000040)}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x400c630f}], 0x0, 0x0, &(0x7f0000000f4d)}) 12:33:59 executing program 1: preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f0000000000)=""/148, 0x94}], 0x1, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000100)='comm\x00') preadv(r0, &(0x7f0000000480), 0x10000000000002a1, 0x0) 12:33:59 executing program 2: perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f0000000180)=""/148, 0x13d}], 0x1, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000340)="696f001b66408225aaa3af068fffebb8a490c47dda6586f1b58895b94a78037dd3714e7198820a7a709e2d30d25e6d846cd5c62a648a598668a8263b752b0b622b115112b5ad8e0425c0b784bbdb89eb8f4da0dd73dd01fe35694c2f78600badf8a0e237dba40713bac9e053b41a9f62be5fbb928018aab5f7500bef51a2fd74d4fffb4a20a946733820bdc1b485afa417cdbcfdfbc54f58c9c3edffe240c36f4ab8a16613814e226b6d20d98010ab1ace49fa76dce337a5a5f1dcff9e5d533b12475e33b971b15b69cd591cd9059759f0f04ba5468a34b98915033debb3e87f048e8601712659d47d8687eb6be5e650068d88000000000000") preadv(r0, &(0x7f0000000480), 0x1000000000000279, 0x0) msgget$private(0x0, 0x22) [ 462.494560] binder: 24286:24305 Acquire 1 refcount change on invalid ref 0 ret -22 [ 462.520724] binder: 24286:24305 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 462.557178] binder: 24286:24312 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 12:33:59 executing program 5: preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f0000000180)=""/148, 0x13d}], 0x1, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000340)="696f001b66408225aaa3af068fffebb8a490c47dda6586f1b58895b94a78037dd3714e7198820a7a709e2d30d25e6d846cd5c62a648a598668a8263b752b0b622b115112b5ad8e0425c0b784bbdb89eb8f4da0dd73dd01fe35694c2f78600badf8a0e237dba40713bac9e053b41a9f62be5fbb928018aab5f7500bef51a2fd74d4fffb4a20a946733820bdc1b485afa417cdbcfdfbc54f58c9c3edffe240c36f4ab8a16613814e226b6d20d98010ab1ace49fa76dce337a5a5f1dcff9e5d533b12475e33b971b15b69cd591cd9059759f0f04ba5468a34b98915033debb3e87f048e8601712659d47d8687eb6be5e650068d88000000000000") ioctl$EVIOCSMASK(r0, 0x40104593, &(0x7f00000002c0)={0x0, 0x1000, &(0x7f00000013c0)="f04209248a4ef4232faf0fbf78b74e937debd77f031e498b7226f848e1435eada82f1bed837bdd884466678ef028009454b7af14a58f3112f3cd8fa325ac5eb11246f37e922064c391776ad71179ac052db605909f42df765340348382635c72b2473ad2767cd101485db4a9a2d99f7c6545c59922aac6fe28bbc569537b661b1109df4a064ea0c36e0760ac34b28a077c0ef40e733f42c0b8d841acb021a00e3bd8dc34c2fcda7b9fb01f6a6dc38767798a494a5c569e3c7c4aa57b0a923841b15a0676f3706cfbc1c242d441895afbe9fd7ac33879d84a5daa2ba45dcb1b7b8b3eee50beb92d6791bde9609ee6fc21cd5b42252e884c2b6517671fb003cf4d34217fa3395d22e75ddaa5d69a70ad19d890138bafc513e2bf6ca003a9ea3470c707f0a71e8d24f988463c303c4350b540fdff3448d364b06e5d5a234b0258a7b208352dbd29d4864ed888f0078861b2a3a4bb1ddb7b7d755d4661e438644864da9be3e5c61a074ce2334d0b8ff1819b8b475067224dc50008173d366db294c21b4fb0149dc421a2f0cc268dc402fd327905a9ea98104fe71df9ceb55bd690ea9d8ff839dd865c1d404007fb3bbdad04095bb418b64455a5fe9efa299fa97701fda1e4bf032575f5d0e777df42277087b4ef078143f7769121e81eb816b8ff5e72515cca29196e47d7ab4b65eb7f88afc89c4f8466b42367f8516c90f25cae4a406ca43f679c7f16f80ac79da05192c5a7fce1a22094827011d6e78cf75e64c5b7f5a6acf25c1aab45f43f8711293d476a6ceda1a2e3e834934e036957c8afebf0685360c46c9ad091d6f95b6a954b82a39ea8ae0680f15c04aa64d26fee0a52f4acc8456bcf9eac256d06d99b86f8c54fb11ae7030fa67a72da7c2f4fee9f29cba635d4e200d50a6770a52d5f6e47e879cb6455a4cfd614707f6f4b3a22b310796d843b0afcd4e15f87d1df2e08dcbda0a320987cbcfcb05d74c38a5f972f604c442e2a9588459d03b3489c023e26dc47c33a0669ca239eb19551cb5aa843819093390dcfe3bae4988195536ba1c07b6c675fd00a6cda271f1957fc868b8ec387a4d01180402fc31818bbd9537ac327d589b6009506d8fb619e86d12fd993441fae72d4138c8f433254aa291552594dc231b9df25caa7775570999c532ca4c88559bcab5bd04a7af27dafa24f53e97d46328d82e9109800e8f8f5a95e3ae380a42342e10b28674f36a981ff431c07e3e20837780b7fb25d19c570b0c4d0f6bfcd3f59397428092fc0af0ab8729fa3df26cadb7ea847b04468c193f02fb715f9f0aff8227f785625edf86f76d49bd556b5348a5fb788723228c06b0944766cb6588488e6b28309dee3ab80537ce032bba89dac50775a884eb540eab54f9600422cf7d7d8ca8b6d136ad72315ce57dbbc87397dd21e1fcbd7dd6736f02afb8b5e0b64a13d5766891a67261592b93490971f3bbd8756d6e62e6112425a83cb7cc0c9b949ba250afba9e3d97dc8f9a06047342630b5cb891db02c510cc1e214b0cc9e1ffce2f894117e22a1d5841cdbdb6c64d5dd23607e3743cb5e0da2fefd9e2ae9eb71f51e6927900baf9596fbf0ff8a7c85c562758e9979251e36785da7e1bfd889b529d5252af752584d82d90217612cbae1fb1c5d5d9c7dc4186280228a93487a2ba0ea4317411a611cfe867b3ab998985dfea271d55ad052cbde65dfedc9037e79f62e5535979f2f9a078f3c3cbc68736b8cf659fe7bb960dacf411b0afe62dd718e514d65f0be5a6d4923967f7a0d914d7ca7a1a0de93d9235d38826854290b7588cef2002a5fae4664f806b82c012bfd1df95316e78f2bb1752ae995dcdc4d65520f9c73e9e1aaae4499a9a8c38303bfb28449a8ad3e34a4d7703c22f1da6e340099866eb632c1a57762a2901d33fdf0064ed2bb30987a9d5c0faa9f631135e75e6490424f5b8638611cc12573b49fec06fbf764892e9181c56f8e351f39ee5ad9ee05d1cccdd0474bcab7f4a4f19168dbf47c9c8067ebf4a0af7ecb9dbbe9663ccc66d84f192c6668b56a9fd1c5d5fc14b08243ff39100b7b3869fbdfdcda7a69270ac10b0451520efb6cc2d0d23af68476e1b34e5d10df5fd886fc09fcc2ace0b5ff88bf2bc4184d6fe4fb30c83e5c19d60191cdb1524b9d0039906f2906b3cdf4fec68ed70250f7f80dd91e89b46a2c11412428ebcbb88bdb65bd11b08912afa10232fa930f7e2d555da43d79889eddad98ea282acb5ffedb9aecd4bb5bdc8a3ef25d1285614a732f4cf9a92b5840521f645e4c1e68b2cf73ed019b81d53a476dd8ed2257ad0d57919f42be9ecfbd3d354bbea4619de1bb2c9882ee2dfd591211f7a04862ac5a7a65cfd669466aa426630cb5fe1dda9229607b8393c3ed74606f05fabf223d6f107c8beb3073980dc6bb03aaa4ad27ce6566539488bc37ca1a7dd8134fafcfa6076c37f47865a23ceff7c183e72a3ac9afb5dc2c9b598864cbaaa1d805a6aa92b961f0e728c4ddbec83e129c06834426986ff97843aaf3de475dee42ac2fce50d2183bf228088705563fc95896e0a2e1b5d6e6d7dc9c02ab998246d8c35785d347c7182126841c1609099f7eec5a6edfc048605b061beb17ef2b1288a883971482945a14f96608d7832bded0f0eca8be82f598a022b5a0e10f45208fbdfb64cdabd62c1902c77ff2349b84c07d4d08223740267c1e0c0421ccd9a8359f4e10e27a65d55c06f2edb0de5cb9a4df7d0784cab788c0b1d77a6a3eacd2c3e8c0c352f4ccf098b791b4f4c2332b36923ac09a7fbb1ceefc665af77156fd52052ae688eb278bc74927a83ec612e26142e030941596a1562e67bf7c2bf5c98d51b871869467aa801d2cc1635847462140f19b4b41372d8ea2122a1a8a2f1661b633eaacdc020eca3d19a6088ec9a0ed7cbc3b49883c141bcf0282f12d6000d55ce833b1dc2299b6a9179387217a359436d437e5abcdc3221ee831fdcb09915faab073bb4fa5439023447704edf1bde03aface3515bb24ca3e0019d6cc81f26ca8f33c9fb78fceb629d71fccf25069487a89b3efa910943dca8cd92e9337ce7f538dcc367894e563f5a6aae1ce64c4d15f6bad0ebe1551aa1762ce77eed0b9cc2940c77ab417b031eb0918cd89a30b1ee1507293c5e2cd8c1a8ccbfb619a214e8e4047182b1ffdda8ccc23972cbd14a1b4a30ca2b583aa7af54781ba4fbdb22bc3ef3aabfae56c0b9d980ce5df37abc7ab2b4a9be60fea3e440aa122d35e4206447e60acc8cc225e013b1ff1d58ddaba0fdd0250132f97978775e4c18667ddf09d4c6342b5c0308d80713f72e9eee4e80097b1e366b84e3410327c5e31c2533b3be167f0479cb5ece6fca6f93bdda598e3eed70b2a491d863b1722be61db336910084ba14e51ae4dd2c606701596da884d4ad5f2769d66ab532c82b94e38292da0005cfab7c132bac2e6a2e23733b6badac16c8d7ed8f0ec7ee0bd9a0de1ed6c55f77f30a319294b10203952a3cda1aab9d1ff496f4db7d3e68cea2712aa32c919461d1e69f1fcd053997f0097e65b9e9b97637f59519b1be790edef71d5f2b4efc48587078ae0b06ce2f85f16096191a8ca73056282a51de217024a92b1fb93876e7d3f68d7a8a2cff8fe6355fe94d5400418e067e4ba1fc45b339147d2e0dfe5f666ed779ff7e1be2fb4aad469c81fd1cde078d956165ff53fed6a67b27c35a0711d464a11396b61d195d5a678e4932dd72da827742a58fe11163029523f5bcbcd9bb30e39135b9fe21fb18802c9b0264b51d3dd626c7d4f55b733d0166c377080fbb1140f5410c2e6b4a33484cd5f01d7e508c87ae351a2f3e46debc992606a4d7dbc32c2691330f6e5aa8bcac12767242c95ecc7e3684c29f606d49539499ef571b6d93e03e1ab0658dd777cf3ad52cd36c62ffd2fc65c2dc812386566ae2b68cddb143eb591c19272bc5435a651209dd2439c5935f7123b5ae730d0d68bd26f44281c13b49127fbe58ced9dd0dce3fa0143213563c22e9bf360fe774c2315881c43ff65bf47ebe7f35f4e5c739482f2981c712119ec2840ea046787948b0e0c78db5d4562b4f70125cda1127a2761ea0d0455344f7d7502f46933e97e28128e84f5754ad22b931d02ebbe030d4f39cd1dafe2a6d09bd083a4a51865f366fc898e06930ef0ecee8ec8a022b4fe6cce2263626a634364433f45e66687c0084068c72ca47d66ca4d49ec204b9161754f4159a7054f48a52a53b44786bf34d12fb3c57ae69a15b62e529a0b9cae1e879473e8e75440e9560e2dbfa715a0a993adafc7ed8861b8f1adfe0f0046ee1f407098f54bb4042a34727f2c7f9d42a2fb499fcd765cc6a545174c8dfdb4d27b8f5cd1b9b475d4e79b1d1222f8372067e92301186b351e05b65cad9b8a475915e8ba790875959a80a7d7d9d66434411162580879a0a751d186cf219f010dc8183c568211db5e036344cbfa4cb87f9da50196de2a76dbfed61e7574654968c8bebf2d2a6eecda306a9687c6ae4abd9ee3f2459fba954eda878fcb852d780fe185c433dd02675daa6de52cdcf92f539eea9edeec68ad74a4cea436d914eb5e4a1bede06d11efa1cfd564db637a16728aec2c43ebf467e119aae8874a053c4a4f6f5a1d8187a2dd5317640ce5856a2109e68f079025fcf7a951ac3dc3d1f42ce2ffaa6b92b790686bb35be4916cfbcad94f898eed54280d1d185b2a5729b8495f690a1f7535b93d402ef16f0d526292ee1c1985ce8893f378b692a176ef9a742acdb9b759c8476964e562e324c0d3f0ad08415187541cb44b2c42394a952b9adb9331002b4c16f9dc48e4c22908d0d1e453ebac9baa2eef12958b40b1873a564f7989fc98224bab3ec005ba69d564c1b5ebd4474a6e6d519a77567d7a26fda6303366e5ddbb2cb668c7b0cfb58994ffa36c93d0acb960adbf5e65e752aa9b42cdc64b89ecf0bee2c42144a62a4247d5dd732d7b6463873a73fa6982de4e391a7fda25fa619ad70db1b47b6c2cef1ea23db56ce4ab881ab0ce4006f3d486a71f2075b4b16bf390603a0e94eb82a9377bedeb401333bf5c0ecf3600a4d1b1b78d2b4f9fcbe795597756c343afdf9faf777d3099bde5f01c5452f65c430919ee11b175b18d6db6dcd3dccfc5c0611e043a1dbd7b687f4750a921569260f32407c20fed78da47d30821df7f9ec265c9336d3cd7dcd1cda1a8dc9e215f305027bca24d73b0bd65501f03d7adb39d62a9be5abd399c8b1403576ab1f51cb355f41cbed79ea54d50c00308d2414f3054de5b3eb8938c6e5e7d627d88ef97d16fb7965d18e0c315e288176311042a60330a2938e8cf5c2ab362cbbcb9e397b90c74ab10949ca057ea503db8a50a823031280bd8fd721fc5b4f6e9b295407f009aa4feff2701e94ae713e6c51eb36ce3ed04da460abe53a01a1868342edf446d006d078297dacbad2523602be43311631fe824427958928ac04f7672223f4a8db41ce9ffe7d84d1a4487ce6f6bb70342c9733bf8f7407d41b26aad8624890c8891554ae73ac8290d200fafbc5c7c3a24cdefeee011997c662f6fe126393aaaf6eb1d1392d747f7520687dfe90a90906d82b2baaabe66f97f45f84398ba694f298cfc1de82877f0f6535c6dbc4f13d8417429e4c9c618ef2da26c744f34157a99c5807937d1e993b8ba74773ec66cb1c0d93f887bb1048c5ec0107829f99c45dbe86d6179b271cbf54cff0e0a7dbf9d008e703560fb68e4eac557a1d82ffc88fc572ece3c0b6357fd80e0ad527a450f35"}) preadv(r0, &(0x7f0000000480), 0x10000000000002a1, 0x0) getsockopt$inet6_IPV6_IPSEC_POLICY(r0, 0x29, 0x22, &(0x7f0000000000)={{{@in=@local, @in, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6}, 0x0, @in=@dev}}, &(0x7f0000000100)=0xe8) getgroups(0x4, &(0x7f0000000140)=[0x0, 0xee01, 0xee01, 0xee01]) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000000240)={0x0, 0x0}, &(0x7f0000000280)=0xc) write$P9_RSTATu(r0, &(0x7f0000000440)={0x251, 0x7d, 0x2, {{0x0, 0x23a, 0x10000000, 0x4, {0x70, 0x2, 0x7}, 0x0, 0x67, 0x6, 0x8, 0x2, '.#', 0xf4, "696f001b66408225aaa3af068fffebb8a490c47dda6586f1b58895b94a78037dd3714e7198820a7a709e2d30d25e6d846cd5c62a648a598668a8263b752b0b622b115112b5ad8e0425c0b784bbdb89eb8f4da0dd73dd01fe35694c2f78600badf8a0e237dba40713bac9e053b41a9f62be5fbb928018aab5f7500bef51a2fd74d4fffb4a20a946733820bdc1b485afa417cdbcfdfbc54f58c9c3edffe240c36f4ab8a16613814e226b6d20d98010ab1ace49fa76dce337a5a5f1dcff9e5d533b12475e33b971b15b69cd591cd9059759f0f04ba5468a34b98915033debb3e87f048e8601712659d47d8687eb6be5e650068d8800", 0x1d, '.nodev[em1procppp0em1.selinux', 0xf4, "696f001b66408225aaa3af068fffebb8a490c47dda6586f1b58895b94a78037dd3714e7198820a7a709e2d30d25e6d846cd5c62a648a598668a8263b752b0b622b115112b5ad8e0425c0b784bbdb89eb8f4da0dd73dd01fe35694c2f78600badf8a0e237dba40713bac9e053b41a9f62be5fbb928018aab5f7500bef51a2fd74d4fffb4a20a946733820bdc1b485afa417cdbcfdfbc54f58c9c3edffe240c36f4ab8a16613814e226b6d20d98010ab1ace49fa76dce337a5a5f1dcff9e5d533b12475e33b971b15b69cd591cd9059759f0f04ba5468a34b98915033debb3e87f048e8601712659d47d8687eb6be5e650068d8800"}, 0x2, ',%', r1, r2, r3}}, 0x251) 12:34:02 executing program 1: preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f0000000180)=""/148, 0xffffffffffffff29}], 0x1, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000340)="696f001b66408225aaa3af068fffebb8a490c47dda6586f1b58895b94a78037dd3714e7198820a7a709e2d30d25e6d846cd5c62a648a598668a8263b752b0b622b115112b5ad8e0425c0b784bbdb89eb8f4da0dd73dd01fe35694c2f78600badf8a0e237dba40713bac9e053b41a9f62be5fbb928018aab5f7500bef51a2fd74d4fffb4a20a946733820bdc1b485afa417cdbcfdfbc54f58c9c3edffe240c36f4ab8a16613814e226b6d20d98010ab1ace49fa76dce337a5a5f1dcff9e5d533b12475e33b971b15b69cd591cd9059759f0f04ba5468a34b98915033debb3e87f048e8601712659d47d8687eb6be5e650068d88000000000000") preadv(r0, &(0x7f0000000480), 0x10000000000002a1, 0x0) ioctl$SNDRV_TIMER_IOCTL_TREAD(r0, 0x40045402, &(0x7f0000000000)) 12:34:02 executing program 2: perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f0000000180)=""/148, 0x13d}], 0x1, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000340)="696f001b66408225aaa3af068fffebb8a490c47dda6586f1b58895b94a78037dd3714e7198820a7a709e2d30d25e6d846cd5c62a648a598668a8263b752b0b622b115112b5ad8e0425c0b784bbdb89eb8f4da0dd73dd01fe35694c2f78600badf8a0e237dba40713bac9e053b41a9f62be5fbb928018aab5f7500bef51a2fd74d4fffb4a20a946733820bdc1b485afa417cdbcfdfbc54f58c9c3edffe240c36f4ab8a16613814e226b6d20d98010ab1ace49fa76dce337a5a5f1dcff9e5d533b12475e33b971b15b69cd591cd9059759f0f04ba5468a34b98915033debb3e87f048e8601712659d47d8687eb6be5e650068d88000000000000") preadv(r0, &(0x7f0000000480), 0x10000000000000b1, 0x0) msgget$private(0x0, 0x22) 12:34:02 executing program 5: preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f0000000180)=""/148, 0x13d}], 0x1, 0x0) r0 = openat$null(0xffffffffffffff9c, &(0x7f0000000000)='/dev/null\x00', 0x0, 0x0) getsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x11, &(0x7f0000000040)={{{@in=@remote, @in6=@loopback}}, {{@in6}, 0x0, @in=@multicast1}}, &(0x7f0000000140)=0xe8) r1 = syz_open_procfs(0x0, &(0x7f0000000340)="696f001b66408225aaa3af068fffebb8a490c47dda6586f1b58895b94a78037dd3714e7198820a7a709e2d30d25e6d846cd5c62a648a598668a8263b752b0b622b115112b5ad8e0425c0b784bbdb89eb8f4da0dd73dd01fe35694c2f78600badf8a0e237dba40713bac9e053b41a9f62be5fbb928018aab5f7500bef51a2fd74d4fffb4a20a946733820bdc1b485afa417cdbcfdfbc54f58c9c3edffe240c36f4ab8a16613814e226b6d20d98010ab1ace49fa76dce337a5a5f1dcff9e5d533b12475e33b971b15b69cd591cd9059759f0f04ba5468a34b98915033debb3e87f048e8601712659d47d8687eb6be5e650068d88000000000000") preadv(r1, &(0x7f0000000480), 0x10000000000002a1, 0x0) 12:34:02 executing program 0: syz_open_dev$sndctrl(&(0x7f0000000140)='/dev/snd/controlC#\x00', 0x0, 0x0) sched_setaffinity(0x0, 0x7, &(0x7f00000000c0)=0x9) r0 = perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0) fcntl$setflags(r0, 0x2, 0x1) getsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER_VALUE(0xffffffffffffffff, 0x84, 0x7c, &(0x7f00000001c0), &(0x7f0000000240)=0x8) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(0xffffffffffffffff, 0x84, 0x9, &(0x7f0000000280)={0x0, @in={{0x2, 0x4e23, @remote}}, 0xfffffffffffffff7, 0x0, 0x400}, 0x98) sendto$inet6(0xffffffffffffffff, &(0x7f00000004c0), 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) setsockopt$SO_BINDTODEVICE(0xffffffffffffffff, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x4) socket$inet6(0xa, 0x1000000000002, 0x0) r1 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x4, 0x0, &(0x7f0000000100)=[@enter_looper], 0x1, 0x0, &(0x7f0000000180)='T'}) r2 = gettid() timer_create(0x0, &(0x7f0000044000), &(0x7f0000044000)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, &(0x7f0000040000)) tkill(r2, 0x1004000000016) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0xfffffffffffffced, 0x0, &(0x7f0000000040)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x400c630f}], 0x0, 0x0, &(0x7f0000000f4d)}) 12:34:02 executing program 3: syz_open_dev$sndctrl(&(0x7f0000000140)='/dev/snd/controlC#\x00', 0x0, 0x0) sched_setaffinity(0x0, 0x7, &(0x7f00000000c0)=0x9) r0 = perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0) fcntl$setflags(r0, 0x2, 0x1) getsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER_VALUE(0xffffffffffffffff, 0x84, 0x7c, &(0x7f00000001c0)={0x0}, &(0x7f0000000240)=0x8) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(0xffffffffffffffff, 0x84, 0x9, &(0x7f0000000280)={r1, @in={{0x2, 0x4e23, @remote}}, 0xfffffffffffffff7, 0x7850, 0x400, 0x97df, 0xc1}, 0x98) sendto$inet6(0xffffffffffffffff, &(0x7f00000004c0), 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) setsockopt$SO_BINDTODEVICE(0xffffffffffffffff, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x4) socket$inet6(0xa, 0x1000000000002, 0x0) r2 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000200)={0x4, 0x0, &(0x7f0000000100)=[@enter_looper], 0x1, 0x0, &(0x7f0000000180)='T'}) r3 = gettid() timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, &(0x7f0000040000)) tkill(r3, 0x1004000000016) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0xfffffffffffffced, 0x0, &(0x7f0000000040)}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x400c630f}], 0x0, 0x0, &(0x7f0000000f4d)}) 12:34:02 executing program 4: socket$inet6(0xa, 0x0, 0x80000000) sched_setaffinity(0x0, 0x7, &(0x7f00000000c0)=0x9) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0) fcntl$setflags(0xffffffffffffffff, 0x2, 0x1) r0 = socket$inet6(0xa, 0x400000000001, 0x0) r1 = dup(r0) setsockopt$inet6_tcp_int(r1, 0x6, 0x12, &(0x7f0000000000)=0x7f, 0x4) bind$inet6(r0, &(0x7f0000000040)={0xa, 0x0, 0x0, @loopback}, 0x1c) getsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER_VALUE(r0, 0x84, 0x7c, &(0x7f00000001c0)={0x0, 0x100000001, 0x6}, &(0x7f0000000240)=0x8) sendto$inet6(r0, &(0x7f00000004c0), 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x4) socket$inet6(0xa, 0x1000000000002, 0x0) r2 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000200)={0x4, 0x0, &(0x7f0000000100)=[@enter_looper], 0x1, 0x0, &(0x7f0000000180)='T'}) r3 = gettid() timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, &(0x7f0000040000)) tkill(r3, 0x1004000000016) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0xfffffffffffffced, 0x0, &(0x7f0000000040)}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x400c630f}], 0x0, 0x0, &(0x7f0000000f4d)}) 12:34:02 executing program 1: preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f0000000180)=""/148, 0x13d}], 0x1, 0x0) r0 = openat$null(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/null\x00', 0x28040, 0x0) ioctl$SNDRV_SEQ_IOCTL_DELETE_PORT(r0, 0x40a85321, &(0x7f0000000240)={{0x0, 0xffffffffffffff30}, 'port0\x00', 0x4, 0x100030, 0x8bc, 0x1, 0x4, 0xc5a, 0x2, 0x0, 0x5, 0x5}) chdir(&(0x7f0000000080)='.\x00') r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) ioctl$UI_BEGIN_FF_UPLOAD(r0, 0xc06855c8, &(0x7f0000000440)={0x1, 0x7fffffff, {0x57, 0x8001, 0xfffffffffffffff7, {0x0, 0xc8}, {0x3f, 0xfffffffffffffffe}, @const={0x2, {0x8, 0x3, 0x1, 0x1}}}, {0x57, 0xffff, 0x5, {0x0, 0x8}, {0x2, 0x4}, @rumble={0x8000, 0x200}}}) ioctl(r2, 0x101, &(0x7f0000000540)="e3c015a629791dd7a85c1ca435e15bbb88d61da60a469911c3b548f24b0aac1aa4db1625786509bdaa1e9f30309dbe878b25608102b2fb8dd71cb70ba6ab8306f3947c425ab56852a1c19f5d70ed75c886aa1d325502192871de2651c0c47c021a1351ad915f04b2ec798da9b0a66d8bbdd5810d62d9d954b3be5d68bb4de82ec67a911fe6af8ab64d") ioctl$KVM_CHECK_EXTENSION_VM(r0, 0xae03, 0x8) r3 = openat$qat_adf_ctl(0xffffffffffffff9c, &(0x7f0000000000)='/dev/qat_adf_ctl\x00', 0x82, 0x0) ioctl$RTC_ALM_SET(r3, 0x40247007, &(0x7f0000000040)={0x1, 0x1e, 0x7, 0xb, 0x4, 0x2, 0x5, 0xea, 0xffffffffffffffff}) personality(0xc00000a) r4 = gettid() r5 = syz_open_procfs(r4, &(0x7f0000000680)="696f001b664082259ca3af068fffebb8a490c47dda6586f1b58895b94a78037dd3714e7198820a7a709e2d30d25e6d846cd5c62a648a598668a8263b752b0b622b115112b5ad8e0425c0b784bbdb89eb8f4da0dd73dd01fe35694c2f78600badf8a0e237dba40713bac9e053b41a9f62be5fbb928018aab5f7500bef51a2fd74d4fefb4a20a946733820bdc1b485afa417cdbcfdfbc50500c9c3edffe240c36f4ab8a16613814e226b6d20d98010ab1ace49fa76dce337a5a5f1dcff9e5d533b12475e33b971b15b69cd591cd9059759f0f04ba5468a34b98915033debb3e87f048e8601712659d47d8687eb6be5e650068d88000000000000") ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0x4020ae46, &(0x7f0000000600)={0x1, 0x0, 0x2000, 0x1000, &(0x7f0000ffd000/0x1000)=nil}) mknod(&(0x7f0000000300)='./file0\x00', 0x6, 0x7fffffff) preadv(r5, &(0x7f0000000480), 0x10000000000002a1, 0x0) ioctl$NBD_SET_SIZE(r3, 0xab02, 0x7) ioctl$SNDRV_SEQ_IOCTL_GET_QUEUE_TIMER(r0, 0xc0605345, &(0x7f00000004c0)={0x10001, 0x1, {0x0, 0x2, 0xffffffff, 0x3, 0x40}}) r6 = semget$private(0x0, 0x1, 0x7) semctl$GETALL(r6, 0x0, 0xd, &(0x7f0000000640)=""/42) semctl$GETALL(r6, 0x0, 0xd, &(0x7f0000000100)=""/107) 12:34:02 executing program 5: preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f0000000180)=""/148, 0x13d}], 0x1, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000340)="696f001b66408225aaa3af068fffebb8a490c47dda6586f1b58895b94a78037dd3714e7198820a7a709e2d30d25e6d846cd5c62a648a598668a8263b752b0b622b115112b5ad8e0425c0b784bbdb89eb8f4da0dd73dd01fe35694c2f78600badf8a0e237dba40713bac9e053b41a9f62be5fbb928018aab5f7500bef51a2fd74d4fffb4a20a946733820bdc1b485afa417cdbcfdfbc54f58c9c3edffe240c36f4ab8a16613814e226b6d20d98010ab1ace49fa76dce337a5a5f1dcff9e5d533b12475e33b971b15b69cd591cd9059759f0f04ba5468a34b98915033debb3e87f048e8601712659d47d8687eb6be5e650068d88000000000000") preadv(r0, &(0x7f0000000000), 0x0, 0x0) [ 465.598630] binder: BINDER_SET_CONTEXT_MGR already set [ 465.615851] binder: BINDER_SET_CONTEXT_MGR already set [ 465.622321] binder: 24336:24344 ioctl 40046207 0 returned -16 [ 465.630708] binder: 24337:24348 ioctl 40046207 0 returned -16 12:34:03 executing program 2: perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f0000000180)=""/148, 0x13d}], 0x1, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000340)="696f001b66408225aaa3af068fffebb8a490c47dda6586f1b58895b94a78037dd3714e7198820a7a709e2d30d25e6d846cd5c62a648a598668a8263b752b0b622b115112b5ad8e0425c0b784bbdb89eb8f4da0dd73dd01fe35694c2f78600badf8a0e237dba40713bac9e053b41a9f62be5fbb928018aab5f7500bef51a2fd74d4fffb4a20a946733820bdc1b485afa417cdbcfdfbc54f58c9c3edffe240c36f4ab8a16613814e226b6d20d98010ab1ace49fa76dce337a5a5f1dcff9e5d533b12475e33b971b15b69cd591cd9059759f0f04ba5468a34b98915033debb3e87f048e8601712659d47d8687eb6be5e650068d88000000000000") preadv(r0, &(0x7f0000000480), 0x1000000000000072, 0x0) msgget$private(0x0, 0x22) 12:34:03 executing program 3: syz_open_dev$sndctrl(&(0x7f0000000140)='/dev/snd/controlC#\x00', 0x0, 0x0) sched_setaffinity(0x0, 0x7, &(0x7f00000000c0)=0x9) r0 = perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0) fcntl$setflags(r0, 0x2, 0x1) getsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER_VALUE(0xffffffffffffffff, 0x84, 0x7c, &(0x7f00000001c0)={0x0}, &(0x7f0000000240)=0x8) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(0xffffffffffffffff, 0x84, 0x9, &(0x7f0000000280)={r1, @in={{0x2, 0x4e23, @remote}}, 0xfffffffffffffff7, 0x7850, 0x400, 0x97df, 0xc1}, 0x98) sendto$inet6(0xffffffffffffffff, &(0x7f00000004c0), 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) setsockopt$SO_BINDTODEVICE(0xffffffffffffffff, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x4) socket$inet6(0xa, 0x1000000000002, 0x0) r2 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000200)={0x4, 0x0, &(0x7f0000000100)=[@enter_looper], 0x1, 0x0, &(0x7f0000000180)='T'}) r3 = gettid() timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, &(0x7f0000040000)) tkill(r3, 0x1004000000016) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0xfffffffffffffced, 0x0, &(0x7f0000000040)}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x400c630f}], 0x0, 0x0, &(0x7f0000000f4d)}) [ 465.656644] QAT: Invalid ioctl [ 465.674193] binder: 24336:24344 Acquire 1 refcount change on invalid ref 0 ret -22 [ 465.689607] QAT: Invalid ioctl 12:34:03 executing program 5: preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f0000000180)=""/148, 0x13d}], 0x1, 0x0) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000140)={0x0, 0xffffffffffffffff, 0x0, 0xf4, &(0x7f0000000040)="696f001b66408225aaa3af068fffebb8a490c47dda6586f1b58895b94a78037dd3714e7198820a7a709e2d30d25e6d846cd5c62a648a598668a8263b752b0b622b115112b5ad8e0425c0b784bbdb89eb8f4da0dd73dd01fe35694c2f78600badf8a0e237dba40713bac9e053b41a9f62be5fbb928018aab5f7500bef51a2fd74d4fffb4a20a946733820bdc1b485afa417cdbcfdfbc54f58c9c3edffe240c36f4ab8a16613814e226b6d20d98010ab1ace49fa76dce337a5a5f1dcff9e5d533b12475e33b971b15b69cd591cd9059759f0f04ba5468a34b98915033debb3e87f048e8601712659d47d8687eb6be5e650068d8800"}, 0x30) r1 = syz_open_procfs(r0, &(0x7f0000000340)='wchan\x00') ioctl$void(r1, 0xc0045c79) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000240)='/dev/sequencer2\x00', 0x20000, 0x0) r2 = perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) close(r2) socket$inet6_udp(0xa, 0x2, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = open(&(0x7f0000000000)='.\x00', 0x0, 0x0) mknodat(r3, &(0x7f0000000280)='./file0\x00', 0x0, 0x0) statx(r3, &(0x7f0000000100)='./file0\x00', 0x1000, 0x0, &(0x7f00000002c0)) r4 = gettid() mq_notify(r1, &(0x7f0000000000)={0x0, 0x31, 0x6, @tid=r4}) preadv(r1, &(0x7f0000000480), 0x10000000000002a1, 0x0) 12:34:03 executing program 1: preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f0000000180)=""/148, 0x13d}], 0xc3, 0x0) r0 = accept$nfc_llcp(0xffffffffffffff9c, 0x0, &(0x7f0000000000)) ioctl$EXT4_IOC_SETFLAGS(r0, 0x40086602, &(0x7f0000000040)=0x2) r1 = syz_open_procfs(0x0, &(0x7f0000000240)="696f001b66408225aaa3af068fffebb8a490c47dda6586f1b58895b94a78037dd3714e7198820a7a709e2d30d25e6d846cd5c62a648a598668a8263b752b0b622b115112b5ad8e0425c0b784bbdb89eb8f4da0dd73dd01fe35694c2f78600badf8a0e237dba40713bac9e053b41a9f62be5fbb928018aab5f7500bef51a2fd74d4fffb4a20a946733820bdc1b485afa417cdbcfdfbc54f58c9c3edffe240c36f4ab8a16613814e226b6d20d98010ab1ace49fa76dce337a5a5f1dcff9e5d533b12475e33b971b15b69cd591cd9059759f0f04ba5468a34b98915033debb3e87f048e8601712659d47d8687eb6be5e650068d88000000000000") preadv(r1, &(0x7f0000000480), 0x10000000000002a1, 0x0) [ 465.701289] binder: 24336:24344 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 465.712440] QAT: Invalid ioctl [ 465.721016] binder: 24336:24356 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 [ 465.737042] QAT: Invalid ioctl 12:34:03 executing program 3: syz_open_dev$sndctrl(&(0x7f0000000140)='/dev/snd/controlC#\x00', 0x0, 0x0) sched_setaffinity(0x0, 0x7, &(0x7f00000000c0)=0x9) r0 = perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0) fcntl$setflags(r0, 0x2, 0x0) getsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER_VALUE(0xffffffffffffffff, 0x84, 0x7c, &(0x7f00000001c0)={0x0, 0x100000001, 0x6}, &(0x7f0000000240)=0x8) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(0xffffffffffffffff, 0x84, 0x9, &(0x7f0000000280)={r1, @in={{0x2, 0x4e23, @remote}}, 0xfffffffffffffff7, 0x7850, 0x400, 0x97df, 0xc1}, 0x98) sendto$inet6(0xffffffffffffffff, &(0x7f00000004c0), 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) setsockopt$SO_BINDTODEVICE(0xffffffffffffffff, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x4) socket$inet6(0xa, 0x1000000000002, 0x0) r2 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000200)={0x4, 0x0, &(0x7f0000000100)=[@enter_looper], 0x1, 0x0, &(0x7f0000000180)='T'}) r3 = gettid() timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, &(0x7f0000040000)) tkill(r3, 0x1004000000016) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0xfffffffffffffced, 0x0, &(0x7f0000000040)}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x400c630f}], 0x0, 0x0, &(0x7f0000000f4d)}) 12:34:03 executing program 2: perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f0000000180)=""/148, 0x13d}], 0x1, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000340)="696f001b66408225aaa3af068fffebb8a490c47dda6586f1b58895b94a78037dd3714e7198820a7a709e2d30d25e6d846cd5c62a648a598668a8263b752b0b622b115112b5ad8e0425c0b784bbdb89eb8f4da0dd73dd01fe35694c2f78600badf8a0e237dba40713bac9e053b41a9f62be5fbb928018aab5f7500bef51a2fd74d4fffb4a20a946733820bdc1b485afa417cdbcfdfbc54f58c9c3edffe240c36f4ab8a16613814e226b6d20d98010ab1ace49fa76dce337a5a5f1dcff9e5d533b12475e33b971b15b69cd591cd9059759f0f04ba5468a34b98915033debb3e87f048e8601712659d47d8687eb6be5e650068d88000000000000") preadv(r0, &(0x7f0000000480), 0x10000000000000f6, 0x0) msgget$private(0x0, 0x22) 12:34:03 executing program 1: r0 = syz_open_procfs(0x0, &(0x7f0000000340)="696f001b66408225aaa3af068fffebb8a490c47dda6586f1b58895b94a78037dd3714e7198820a7a709e2d30d25e6d846cd5c62a648a598668a8263b752b0b622b115112b5ad8e0425c0b784bbdb89eb8f4da0dd73dd01fe35694c2f78600badf8a0e237dba40713bac9e053b41a9f62be5fbb928018aab5f7500bef51a2fd74d4fffb4a20a946733820bdc1b485afa417cdbcfdfbc54f58c9c3edffe240c36f4ab8a16613814e226b6d20d98010ab1ace49fa76dce337a5a5f1dcff9e5d533b12475e33b971b15b69cd591cd9059759f0f04ba5468a34b98915033debb3e87f048e8601712659d47d8687eb6be5e650068d88000000000000") preadv(r0, &(0x7f0000000480), 0x10000000000002a1, 0x0) 12:34:05 executing program 0: syz_open_dev$sndctrl(&(0x7f0000000140)='/dev/snd/controlC#\x00', 0x0, 0x0) sched_setaffinity(0x0, 0x7, &(0x7f00000000c0)=0x9) r0 = perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0) fcntl$setflags(r0, 0x2, 0x1) getsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER_VALUE(0xffffffffffffffff, 0x84, 0x7c, &(0x7f00000001c0), &(0x7f0000000240)=0x8) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(0xffffffffffffffff, 0x84, 0x9, &(0x7f0000000280)={0x0, @in={{0x2, 0x4e23, @remote}}, 0xfffffffffffffff7, 0x0, 0x400}, 0x98) sendto$inet6(0xffffffffffffffff, &(0x7f00000004c0), 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) setsockopt$SO_BINDTODEVICE(0xffffffffffffffff, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x4) socket$inet6(0xa, 0x1000000000002, 0x0) r1 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x4, 0x0, &(0x7f0000000100)=[@enter_looper], 0x1, 0x0, &(0x7f0000000180)='T'}) gettid() timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, &(0x7f0000040000)) tkill(0x0, 0x1004000000016) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0xfffffffffffffced, 0x0, &(0x7f0000000040)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x400c630f}], 0x0, 0x0, &(0x7f0000000f4d)}) 12:34:05 executing program 5: preadv(0xffffffffffffffff, &(0x7f0000001380), 0x0, 0x0) socket$rds(0x15, 0x5, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000340)="696f001b66408225aaa3af068fffebb8a490c47dda6586f1b58895b94a78037dd3714e7198820a7a709e2d30d25e6d846cd5c62a648a598668a8263b752b0b622b115112b5ad8e0425c0b784bbdb89eb8f4da0dd73dd01fe35694c2f78600badf8a0e237dba40713bac9e053b41a9f62be5fbb928018aab5f7500bef51a2fd74d4fffb4a20a946733820bdc1b485afa417cdbcfdfbc54f58c9c3edffe240c36f4ab8a16613814e226b6d20d98010ab1ace49fa76dce337a5a5f1dcff9e5d533b12475e33b971b15b69cd591cd9059759f0f04ba5468a34b98915033debb3e87f048e8601712659d47d8687eb6be5e650068d88000000000000") preadv(r0, &(0x7f0000000000), 0x0, 0x6) ioctl$KVM_SET_LAPIC(r0, 0x4400ae8f, &(0x7f0000000440)={"aee0144fd7ac39a785a7c81fb34ffde0f9a469c0ff9a72f3f5ab2e0cffa1b635aac96074197f2cdcdbb26c86d098d2b67be35e354111177fec218dbd822fd1b41e1aabd2aa4ee4cec9b7c02e766980fba25c96b410ed2c92e45b58d782961c407f4e6503dea87ee717bd3000163b6407ea0f4af268a69f461b7bd3e6299e9ea40c882557501c5698dba3b79d1ac14c0d019e78f9c6d92675fc394b68129e28017f2ca801b204c040f4fbc6f673c23b25b372fb0a77340a9fa67f9a7c69108b4a64119247eae3a99d0dc169bbac9db1a6d1e2a8f1a97508bb0692797103cfb1007fec61620a4c0742bb545cfd8d33a621a6e1d2c88e79c9c3fe768bc5fd0600c1e8394c5ba6f0931fb4a141a13ce7e106eaf178ceb826d6c6a4a390f196a445503d6660b9d4d8dbe61dd974f525eecf59a21f1994899418f25d54e93e7064508d2bf22224a2f3d1f1bf759c3ec10e8e91c49644a46ff02acc3c2b3172a0425ecdfbb0661373aeeebb0219bb54406781e298212794ff66a5d615e6fa3c646e39e5e89861c43878db2976c01e3fa1fb34a1ebcd2e49daebdbe320214ac4f36201dde6fccbce6c4c49d6bd401f412d69cd39aedd00cf4f68f47199f69fe295c5b761bd109a23a823ab877264a64fd026092eaa9dae42b996ba720fa11dd7679e86e7e99bca3daa1e043a84d7ca4becdf2c7e7d9d6b54bf2b59dec6376e8caef197a2aa8d19bc4578025e5f93074e3603e343e4c46c2cc27b8a1a91780d6110304e1629b711e14ee2d71e57dbde3695761383f543f4729c49a4406209cd2b341826cf043072e76760747beb4b0bf8ec2ac6aaf07c09824a3ff4b987a14b8ba082003d71d8e51c51a897b073044ae4c19d235871657065ade6a1e3663126baf6f69c2bacf89540142b438088826dcad43625b4c947cda2d54ff7c74a037da06f72af53bc96a0d998bfb9a49be150c12e735ea3397cb1dbbc99de2d321517a1d749aa4d8814e0de77ce500c2fc9f6b61efacda171070302c9486ac702454bcfee6fca15b7cff4fe5e0f2e9616c73e3798b3ac878561959117d1930174d040dcea15e1abaa259e1d587f6c4dd98d2de14fea164a14a69790f14f17a9defa10705ec24e4755760b560f6b1897dcfb33b9ffc2d61ff9d1a8bb56569dddb0d04de1064677937057a6ffbfa38b5f94bf075a5fdb3accb1d7f90161302472f1771109feedecaee33cd7b073de5fa95bc94287738288eb2eeaa79e42276f3c5303f6e08807ee60bed11e453e88cdbebdda274ca9c5503e4bc58d1ed42d1ea0d572c0dd2f24c350a7eb6b7096a740b73ce7413eaffd0473ea003b0fc9c38bf5cfcc53f1048d4059549f902589aa54e147ee695708582c426eb0a9e0451ca465f229065b2557e0b639d2cc3b7aa572e0872085edcb2210b5e3e519cfe939f34fb8618b32999a9093"}) getsockopt$inet_sctp6_SCTP_RESET_STREAMS(r0, 0x84, 0x77, &(0x7f0000000000)=ANY=[@ANYRES32=0x0, @ANYBLOB="000101005900"], &(0x7f0000000040)=0xa) getsockopt$inet_sctp6_SCTP_ASSOCINFO(r0, 0x84, 0x1, &(0x7f0000000100)={r1, 0x2767dde1, 0x2, 0x0, 0x100000000, 0x6}, &(0x7f0000000140)=0x14) getsockopt$inet_sctp_SCTP_DELAYED_SACK(r0, 0x84, 0x10, &(0x7f0000000080)=@sack_info={r1, 0x1, 0x1}, &(0x7f00000000c0)=0xc) 12:34:05 executing program 1: socketpair$inet_udp(0x2, 0x2, 0x0, &(0x7f0000000ac0)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = syz_open_dev$audion(&(0x7f0000000400)='/dev/audio#\x00', 0x100000001, 0x2c0200) ioctl$SG_GET_VERSION_NUM(r2, 0x2282, &(0x7f0000000bc0)) getsockopt$bt_BT_SNDMTU(r2, 0x112, 0xc, &(0x7f0000000b00)=0x6, &(0x7f0000000b80)=0x2) preadv(r0, &(0x7f0000000a00)=[{&(0x7f0000000040)=""/173, 0xad}, {&(0x7f0000000240)=""/141, 0x8d}, {&(0x7f0000000300)=""/210, 0xd2}, {&(0x7f0000000100)=""/108, 0x6c}, {&(0x7f0000000640)=""/214, 0xd6}, {&(0x7f0000000740)=""/248, 0xf8}, {&(0x7f0000000400)}, {&(0x7f0000000840)=""/206, 0xce}, {&(0x7f0000000940)=""/6, 0x6}, {&(0x7f0000000980)=""/94, 0x5e}], 0xa, 0x52) preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f0000000180)=""/148, 0x13d}], 0x1, 0x0) getpgrp(0x0) r3 = getpgrp(0xffffffffffffffff) r4 = syz_open_procfs(r3, &(0x7f0000000c00)='net/rt_acct\x00') setsockopt$bt_BT_SECURITY(r2, 0x112, 0x4, &(0x7f0000000440)={0x1ff, 0x1}, 0x2) preadv(r1, &(0x7f0000000b40)=[{&(0x7f0000000480)=""/132, 0x84}, {&(0x7f0000000540)=""/137, 0x89}], 0x2, 0x0) epoll_ctl$EPOLL_CTL_ADD(r4, 0x1, r1, &(0x7f0000000000)={0xa0000000}) gettid() 12:34:05 executing program 3: socket$inet6(0xa, 0x0, 0x80000000) syz_open_dev$sndctrl(&(0x7f0000000140)='/dev/snd/controlC#\x00', 0x9, 0x400000) sched_setaffinity(0x0, 0x7, &(0x7f00000000c0)=0x9) r0 = perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0) fcntl$setflags(r0, 0x2, 0x1) pipe(&(0x7f0000000100)) r1 = socket$inet6(0xa, 0x400000000001, 0x0) r2 = dup(r1) setsockopt$inet6_tcp_int(r2, 0x6, 0x12, &(0x7f0000000000)=0x7f, 0x4) getsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER_VALUE(r1, 0x84, 0x7c, &(0x7f00000001c0)={0x0, 0x100000001, 0x6}, &(0x7f0000000240)=0x8) sendto$inet6(r1, &(0x7f00000004c0), 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) setsockopt$SO_BINDTODEVICE(r1, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x4) socket$inet6(0xa, 0x1000000000002, 0x0) r3 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r3, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000200)={0x4, 0x0, &(0x7f0000000100)=[@enter_looper], 0x1, 0x0, &(0x7f0000000180)='T'}) r4 = gettid() timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, &(0x7f0000040000)) tkill(r4, 0x1004000000016) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0xfffffffffffffced, 0x0, &(0x7f0000000040)}) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x400c630f}], 0x0, 0x0, &(0x7f0000000f4d)}) 12:34:05 executing program 2: perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f0000000180)=""/148, 0x13d}], 0x1, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000340)="696f001b66408225aaa3af068fffebb8a490c47dda6586f1b58895b94a78037dd3714e7198820a7a709e2d30d25e6d846cd5c62a648a598668a8263b752b0b622b115112b5ad8e0425c0b784bbdb89eb8f4da0dd73dd01fe35694c2f78600badf8a0e237dba40713bac9e053b41a9f62be5fbb928018aab5f7500bef51a2fd74d4fffb4a20a946733820bdc1b485afa417cdbcfdfbc54f58c9c3edffe240c36f4ab8a16613814e226b6d20d98010ab1ace49fa76dce337a5a5f1dcff9e5d533b12475e33b971b15b69cd591cd9059759f0f04ba5468a34b98915033debb3e87f048e8601712659d47d8687eb6be5e650068d88000000000000") preadv(r0, &(0x7f0000000480), 0x10000000000000a3, 0x0) msgget$private(0x0, 0x22) 12:34:05 executing program 4: socket$inet6(0xa, 0x0, 0x80000000) sched_setaffinity(0x0, 0x7, &(0x7f00000000c0)=0x9) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0) fcntl$setflags(0xffffffffffffffff, 0x2, 0x1) r0 = socket$inet6(0xa, 0x400000000001, 0x0) r1 = dup(r0) setsockopt$inet6_tcp_int(r1, 0x6, 0x12, &(0x7f0000000000)=0x7f, 0x4) bind$inet6(r0, &(0x7f0000000040)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) getsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER_VALUE(0xffffffffffffffff, 0x84, 0x7c, &(0x7f00000001c0)={0x0, 0x100000001, 0x6}, &(0x7f0000000240)=0x8) sendto$inet6(r0, &(0x7f00000004c0), 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x4) socket$inet6(0xa, 0x1000000000002, 0x0) r2 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000200)={0x4, 0x0, &(0x7f0000000100)=[@enter_looper], 0x1, 0x0, &(0x7f0000000180)='T'}) r3 = gettid() timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, &(0x7f0000040000)) tkill(r3, 0x1004000000016) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0xfffffffffffffced, 0x0, &(0x7f0000000040)}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x400c630f}], 0x0, 0x0, &(0x7f0000000f4d)}) 12:34:06 executing program 5: preadv(0xffffffffffffffff, &(0x7f0000000680)=[{&(0x7f0000000000)=""/135, 0x87}, {&(0x7f00000000c0)=""/192, 0xc0}, {&(0x7f0000000180)=""/118, 0x76}, {&(0x7f0000000200)=""/28, 0x1c}, {&(0x7f0000000240)=""/97, 0x61}, {&(0x7f0000000380)=""/250, 0xfa}, {&(0x7f0000000300)=""/21, 0x5}, {&(0x7f0000000480)=""/229, 0xe5}, {&(0x7f0000000580)=""/197, 0xfea6}], 0x9, 0x2) r0 = syz_open_procfs(0x0, &(0x7f0000000340)='net/psched\x00') preadv(r0, &(0x7f0000000480), 0x10000000000002a1, 0x0) 12:34:06 executing program 1: preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f0000000180)=""/148, 0x13d}], 0x1, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000340)="696f001b66408225aaa3af068fffebb8a490c47dda6586f1b58895b94a78037dd3714e7198820a7a709e2d30d25e6d846cd5c62a648a598668a8263b752b0b622b115112b5ad8e0425c0b784bbdb89eb8f4da0dd73dd01fe35694c2f78600badf8a0e237dba40713bac9e053b41a9f62be5fbb928018aab5f7500bef51a2fd74d4fffb4a20a946733820bdc1b485afa417cdbcfdfbc54f58c9c3edffe240c36f4ab8a16613814e226b6d20d98010ab1ace49fa76dce337a5a5f1dcff9e5d533b12475e33b971b15b69cd591cd9059759f0f04ba5468a34b98915033debb3e87f048e8601712659d47d8687eb6be5e650068d88000000000000") setsockopt$inet_tcp_buf(r0, 0x6, 0x1f, &(0x7f0000000000)="224efbbbaa0d25f27e70b9f1f3374c883f6929d32179ad7f5607b30f4ff4411b25de708a3460d20ee61db2163f874971af51b65f277495787068a76c80797fc4cc911729bc7a252242ef43491e19abd8c890897cf12d18560e2a6bcb3c18b409e48b18e3ba99964ffa59ada616e9c956a66e0afb996b0bcdc8ede57b0135f6feb1dae53299248370019b392ad8613d4093ca645b0f2793eeda3bcf060ec816356393be0fb148312a088168b4c9fb62b0b13d8e", 0xb3) preadv(r0, &(0x7f0000000480), 0x10000000000002a1, 0x0) [ 468.730186] binder: BINDER_SET_CONTEXT_MGR already set 12:34:06 executing program 2: perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f0000000180)=""/148, 0x13d}], 0x1, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000340)="696f001b66408225aaa3af068fffebb8a490c47dda6586f1b58895b94a78037dd3714e7198820a7a709e2d30d25e6d846cd5c62a648a598668a8263b752b0b622b115112b5ad8e0425c0b784bbdb89eb8f4da0dd73dd01fe35694c2f78600badf8a0e237dba40713bac9e053b41a9f62be5fbb928018aab5f7500bef51a2fd74d4fffb4a20a946733820bdc1b485afa417cdbcfdfbc54f58c9c3edffe240c36f4ab8a16613814e226b6d20d98010ab1ace49fa76dce337a5a5f1dcff9e5d533b12475e33b971b15b69cd591cd9059759f0f04ba5468a34b98915033debb3e87f048e8601712659d47d8687eb6be5e650068d88000000000000") preadv(r0, &(0x7f0000000480), 0x1000000000000245, 0x0) msgget$private(0x0, 0x22) [ 468.759076] binder: 24399:24407 ioctl 40046207 0 returned -16 [ 468.765286] binder: BINDER_SET_CONTEXT_MGR already set [ 468.770998] binder: 24397:24405 ioctl 40046207 0 returned -16 12:34:06 executing program 4: socket$inet6(0xa, 0x0, 0x80000000) sched_setaffinity(0x0, 0x7, &(0x7f00000000c0)=0x9) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0) fcntl$setflags(0xffffffffffffffff, 0x2, 0x1) r0 = socket$inet6(0xa, 0x400000000001, 0x0) r1 = dup(r0) setsockopt$inet6_tcp_int(r1, 0x6, 0x12, &(0x7f0000000000)=0x7f, 0x4) bind$inet6(r0, &(0x7f0000000040)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) getsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER_VALUE(0xffffffffffffffff, 0x84, 0x7c, &(0x7f00000001c0)={0x0, 0x100000001, 0x6}, &(0x7f0000000240)=0x8) sendto$inet6(r0, &(0x7f00000004c0), 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x4) socket$inet6(0xa, 0x1000000000002, 0x0) r2 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000200)={0x4, 0x0, &(0x7f0000000100)=[@enter_looper], 0x1, 0x0, &(0x7f0000000180)='T'}) r3 = gettid() timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, &(0x7f0000040000)) tkill(r3, 0x1004000000016) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0xfffffffffffffced, 0x0, &(0x7f0000000040)}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x400c630f}], 0x0, 0x0, &(0x7f0000000f4d)}) 12:34:06 executing program 5: preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f0000000180)=""/148, 0x13d}], 0x1, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000340)="696f001b66408225aaa3af068fffebb8a490c47dda6586f1b58895b94a78037dd3714e7198820a7a709e2d30d25e6d846cd5c62a648a598668a8263b752b0b622b115112b5ad8e0425c0b784bbdb89eb8f4da0dd73dd01fe35694c2f78600badf8a0e237dba40713bac9e053b41a9f62be5fbb928018aab5f7500bef51a2fd74d4fffb4a20a946733820bdc1b485afa417cdbcfdfbc54f58c9c3edffe240c36f4ab8a16613814e226b6d20d98010ab1ace49fa76dce337a5a5f1dcff9e5d533b12475e33b971b15b69cd591cd9059759f0f04ba5468a34b98915033debb3e87f048e8601712659d47d8687eb6be5e650068d88000000000000") getsockopt$inet_sctp_SCTP_GET_ASSOC_ID_LIST(r0, 0x84, 0x1d, &(0x7f0000000000)={0x9, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}, &(0x7f0000000040)=0x28) setsockopt$inet_sctp6_SCTP_DELAYED_SACK(r0, 0x84, 0x10, &(0x7f0000000080)=@assoc_value={r1, 0x100}, 0x8) preadv(r0, &(0x7f0000000480), 0x10000000000002a1, 0x0) 12:34:06 executing program 1: preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f0000000180)=""/148, 0x13d}], 0x1, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000340)="696f001b66408225aaa3af068fffebb8a490c47dda6586f1b58895b94a78037dd3714e7198820a7a709e2d30d25e6d846cd5c62a648a598668a8263b752b0b622b115112b5ad8e0425c0b784bbdb89eb8f4da0dd73dd01fe35694c2f78600badf8a0e237dba40713bac9e053b41a9f62be5fbb928018aab5f7500bef51a2fd74d4fffb4a20a946733820bdc1b485afa417cdbcfdfbc54f58c9c3edffe240c36f4ab8a16613814e226b6d20d98010ab1ace49fa76dce337a5a5f1dcff9e5d533b12475e33b971b15b69cd591cd9059759f0f04ba5468a34b98915033debb3e87f048e8601712659d47d8687eb6be5e650068d88000000000000") preadv(r0, &(0x7f0000000480), 0x10000000000002a1, 0x0) finit_module(r0, &(0x7f0000000000)="696f001b66408225aaa3af068fffebb8a490c47dda6586f1b58895b94a78037dd3714e7198820a7a709e2d30d25e6d846cd5c62a648a598668a8263b752b0b622b115112b5ad8e0425c0b784bbdb89eb8f4da0dd73dd01fe35694c2f78600badf8a0e237dba40713bac9e053b41a9f62be5fbb928018aab5f7500bef51a2fd74d4fffb4a20a946733820bdc1b485afa417cdbcfdfbc54f58c9c3edffe240c36f4ab8a16613814e226b6d20d98010ab1ace49fa76dce337a5a5f1dcff9e5d533b12475e33b971b15b69cd591cd9059759f0f04ba5468a34b98915033debb3e87f048e8601712659d47d8687eb6be5e650068d8800", 0x2) [ 468.847788] binder: 24397:24422 Acquire 1 refcount change on invalid ref 0 ret -22 [ 468.861599] binder: 24397:24422 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 468.886143] binder: 24397:24422 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 12:34:06 executing program 0: syz_open_dev$sndctrl(&(0x7f0000000140)='/dev/snd/controlC#\x00', 0x0, 0x0) sched_setaffinity(0x0, 0x7, &(0x7f00000000c0)=0x9) r0 = perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0) fcntl$setflags(r0, 0x2, 0x1) getsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER_VALUE(0xffffffffffffffff, 0x84, 0x7c, &(0x7f00000001c0), &(0x7f0000000240)=0x8) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(0xffffffffffffffff, 0x84, 0x9, &(0x7f0000000280)={0x0, @in={{0x2, 0x4e23, @remote}}, 0xfffffffffffffff7, 0x0, 0x400}, 0x98) sendto$inet6(0xffffffffffffffff, &(0x7f00000004c0), 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) setsockopt$SO_BINDTODEVICE(0xffffffffffffffff, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x4) socket$inet6(0xa, 0x1000000000002, 0x0) r1 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x4, 0x0, &(0x7f0000000100)=[@enter_looper], 0x1, 0x0, &(0x7f0000000180)='T'}) gettid() timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, &(0x7f0000040000)) tkill(0x0, 0x1004000000016) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0xfffffffffffffced, 0x0, &(0x7f0000000040)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x400c630f}], 0x0, 0x0, &(0x7f0000000f4d)}) 12:34:06 executing program 2: perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f0000000180)=""/148, 0x13d}], 0x1, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000340)="696f001b66408225aaa3af068fffebb8a490c47dda6586f1b58895b94a78037dd3714e7198820a7a709e2d30d25e6d846cd5c62a648a598668a8263b752b0b622b115112b5ad8e0425c0b784bbdb89eb8f4da0dd73dd01fe35694c2f78600badf8a0e237dba40713bac9e053b41a9f62be5fbb928018aab5f7500bef51a2fd74d4fffb4a20a946733820bdc1b485afa417cdbcfdfbc54f58c9c3edffe240c36f4ab8a16613814e226b6d20d98010ab1ace49fa76dce337a5a5f1dcff9e5d533b12475e33b971b15b69cd591cd9059759f0f04ba5468a34b98915033debb3e87f048e8601712659d47d8687eb6be5e650068d88000000000000") preadv(r0, &(0x7f0000000480), 0x10000000000001e8, 0x0) msgget$private(0x0, 0x22) 12:34:06 executing program 1: r0 = openat$sequencer(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/sequencer\x00', 0x40180, 0x0) preadv(r0, &(0x7f0000001380)=[{&(0x7f0000000180)=""/148, 0x13d}], 0x3d3, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000340)="696f001b66408225aaa3af068fffebb8a490c47dda6586f1b58895b94a78037dd3714e7198820a7a709e2d30d25e6d846cd5c62a648a598668a8263b752b0b622b115112b5ad8e0425c0b784bbdb89eb8f4da0dd73dd01fe35694c2f78600badf8a0e237dba40713bac9e053b41a9f62be5fbb928018aab5f7500bef51a2fd74d4fffb4a20a946733820bdc1b485afa417cdbcfdfbc54f58c9c3edffe240c36f4ab8a16613814e226b6d20d98010ab1ace49fa76dce337a5a5f1dcff9e5d533b12475e33b971b15b69cd591cd9059759f0f04ba5468a34b98915033debb3e87f048e8601712659d47d8687eb6be5e650068d88000000000000") ioctl$PIO_UNIMAP(r1, 0x4b67, &(0x7f0000000080)={0x1, &(0x7f0000000040)=[{0x1, 0x5}]}) ioctl$TIOCGSID(r1, 0x5429, &(0x7f0000000000)) getsockopt$inet_sctp_SCTP_RECONFIG_SUPPORTED(r0, 0x84, 0x75, &(0x7f0000000100)={0x0, 0x800000000000}, &(0x7f0000000140)=0x8) setsockopt$inet_sctp6_SCTP_RESET_ASSOC(r0, 0x84, 0x78, &(0x7f0000000240)=r2, 0x4) preadv(r1, &(0x7f0000000480), 0x10000000000002a1, 0x0) 12:34:06 executing program 5: perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet(0x10, 0x3, 0xc) select(0x40, &(0x7f00000000c0)={0x0, 0x0, 0xafc2, 0x0, 0xcfe, 0x4}, &(0x7f0000000100)={0x8001, 0x0, 0x101, 0x5, 0x7fff, 0xffff}, &(0x7f0000000140)={0x7ff, 0x200, 0x20, 0x0, 0x0, 0x1c}, &(0x7f0000000180)={0x0, 0x2710}) sendmsg(r0, &(0x7f0000011fc8)={0x0, 0x0, &(0x7f0000000240)=[{&(0x7f0000000280)="24000000010207031dfffd946fa2830020200a0009000200001d85680c1baba20400ff7e", 0x24}], 0x1}, 0x0) preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f00000002c0)=""/148, 0x94}], 0x1, 0x0) preadv(0xffffffffffffffff, &(0x7f0000000480), 0x10000000000002a1, 0x0) 12:34:06 executing program 4: socket$inet6(0xa, 0x0, 0x80000000) sched_setaffinity(0x0, 0x7, &(0x7f00000000c0)=0x9) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0) fcntl$setflags(0xffffffffffffffff, 0x2, 0x1) r0 = socket$inet6(0xa, 0x400000000001, 0x0) r1 = dup(r0) setsockopt$inet6_tcp_int(r1, 0x6, 0x12, &(0x7f0000000000)=0x7f, 0x4) bind$inet6(r0, &(0x7f0000000040)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) getsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER_VALUE(0xffffffffffffffff, 0x84, 0x7c, &(0x7f00000001c0)={0x0, 0x100000001, 0x6}, &(0x7f0000000240)=0x8) sendto$inet6(r0, &(0x7f00000004c0), 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x4) socket$inet6(0xa, 0x1000000000002, 0x0) r2 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000200)={0x4, 0x0, &(0x7f0000000100)=[@enter_looper], 0x1, 0x0, &(0x7f0000000180)='T'}) r3 = gettid() timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, &(0x7f0000040000)) tkill(r3, 0x1004000000016) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0xfffffffffffffced, 0x0, &(0x7f0000000040)}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x400c630f}], 0x0, 0x0, &(0x7f0000000f4d)}) 12:34:06 executing program 3: socket$inet6(0xa, 0x0, 0x80000000) syz_open_dev$sndctrl(&(0x7f0000000140)='/dev/snd/controlC#\x00', 0x9, 0x400000) sched_setaffinity(0x0, 0x7, &(0x7f00000000c0)=0x9) r0 = perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0) fcntl$setflags(r0, 0x2, 0x1) pipe(&(0x7f0000000100)) r1 = socket$inet6(0xa, 0x400000000001, 0x0) r2 = dup(r1) setsockopt$inet6_tcp_int(r2, 0x6, 0x12, &(0x7f0000000000)=0x7f, 0x4) getsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER_VALUE(r1, 0x84, 0x7c, &(0x7f00000001c0)={0x0, 0x100000001, 0x6}, &(0x7f0000000240)=0x8) sendto$inet6(r1, &(0x7f00000004c0), 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) setsockopt$SO_BINDTODEVICE(r1, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x4) socket$inet6(0xa, 0x1000000000002, 0x0) r3 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r3, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000200)={0x4, 0x0, &(0x7f0000000100)=[@enter_looper], 0x1, 0x0, &(0x7f0000000180)='T'}) r4 = gettid() timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, &(0x7f0000040000)) tkill(r4, 0x1004000000016) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0xfffffffffffffced, 0x0, &(0x7f0000000040)}) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x400c630f}], 0x0, 0x0, &(0x7f0000000f4d)}) [ 469.478850] binder: undelivered death notification, 0000000000000000 12:34:06 executing program 1: preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f0000000180)=""/148, 0x13d}], 0x1, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000340)="696f001b66408225aaa3af068fffebb8a490c47dda6586f1b58895b94a78037dd3714e7198820a7a709e2d30d25e6d846cd5c62a648a598668a8263b752b0b622b115112b5ad8e0425c0b784bbdb89eb8f4da0dd73dd01fe35694c2f78600badf8a0e237dba40713bac9e053b41a9f62be5fbb928018aab5f7500bef51a2fd74d4fffb4a20a946733820bdc1b485afa417cdbcfdfbc54f58c9c3edffe240c36f4ab8a16613814e226b6d20d98010ab1ace49fa76dce337a5a5f1dcff9e5d533b12475e33b971b15b69cd591cd9059759f0f04ba5468a34b98915033debb3e87f048e8601712659d47d8687eb6be5e650068d88000000000000") preadv(r0, &(0x7f0000000480), 0x10000000000002a1, 0x0) recvfrom(r0, &(0x7f0000000040)=""/238, 0xee, 0x1, &(0x7f0000000240)=@in6={0xa, 0x4e23, 0x6, @local, 0x8}, 0x80) write$P9_RWSTAT(r0, &(0x7f0000000000)={0x7, 0x7f, 0x1}, 0x7) 12:34:07 executing program 5: syz_open_dev$admmidi(&(0x7f0000000000)='/dev/admmidi#\x00', 0x400, 0x80) preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f0000000180)=""/148, 0x13d}], 0x1, 0x0) syz_open_procfs(0x0, &(0x7f0000000340)="696f001b66408225aaa3af068fffebb8a490c47dda6586f1b58895b94a78037dd3714e7198820a7a709e2d30d25e6d846cd5c62a648a598668a8263b752b0b622b115112b5ad8e0425c0b784bbdb89eb8f4da0dd73dd01fe35694c2f78600badf8a0e237dba40713bac9e053b41a9f62be5fbb928018aab5f7500bef51a2fd74d4fffb4a20a946733820bdc1b485afa417cdbcfdfbc54f58c9c3edffe240c36f4ab8a16613814e226b6d20d98010ab1ace49fa76dce337a5a5f1dcff9e5d533b12475e33b971b15b69cd591cd9059759f0f04ba5468a34b98915033debb3e87f048e8601712659d47d8687eb6be5e650068d88000000000000") 12:34:07 executing program 4: socket$inet6(0xa, 0x0, 0x80000000) sched_setaffinity(0x0, 0x7, &(0x7f00000000c0)=0x9) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0) fcntl$setflags(0xffffffffffffffff, 0x2, 0x1) r0 = socket$inet6(0xa, 0x400000000001, 0x0) r1 = dup(r0) setsockopt$inet6_tcp_int(r1, 0x6, 0x12, &(0x7f0000000000)=0x7f, 0x4) bind$inet6(r0, &(0x7f0000000040)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) getsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER_VALUE(r0, 0x84, 0x7c, &(0x7f00000001c0)={0x0, 0x0, 0x6}, &(0x7f0000000240)=0x8) sendto$inet6(r0, &(0x7f00000004c0), 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x4) socket$inet6(0xa, 0x1000000000002, 0x0) r2 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000200)={0x4, 0x0, &(0x7f0000000100)=[@enter_looper], 0x1, 0x0, &(0x7f0000000180)='T'}) r3 = gettid() timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, &(0x7f0000040000)) tkill(r3, 0x1004000000016) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0xfffffffffffffced, 0x0, &(0x7f0000000040)}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x400c630f}], 0x0, 0x0, &(0x7f0000000f4d)}) [ 469.663703] binder: BINDER_SET_CONTEXT_MGR already set [ 469.669217] binder: 24454:24456 ioctl 40046207 0 returned -16 12:34:07 executing program 1: preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f0000000180)=""/148, 0x13d}], 0x1, 0x0) r0 = syz_open_dev$sndpcmp(&(0x7f0000000000)='/dev/snd/pcmC#D#p\x00', 0xffff, 0x4002) ioctl$VT_GETSTATE(r0, 0x5603, &(0x7f0000000040)={0x100000001, 0x8000, 0xe2}) r1 = syz_open_procfs(0x0, &(0x7f0000000340)="696f001b66408225aaa3af068fffebb8a490c47dda6586f1b58895b94a78037dd3714e7198820a7a709e2d30d25e6d846cd5c62a648a598668a8263b752b0b622b115112b5ad8e0425c0b784bbdb89eb8f4da0dd73dd01fe35694c2f78600badf8a0e237dba40713bac9e053b41a9f62be5fbb928018aab5f7500bef51a2fd74d4fffb4a20a946733820bdc1b485afa417cdbcfdfbc54f58c9c3edffe240c36f4ab8a16613814e226b6d20d98010ab1ace49fa76dce337a5a5f1dcff9e5d533b12475e33b971b15b69cd591cd9059759f0f04ba5468a34b98915033debb3e87f048e8601712659d47d8687eb6be5e650068d88000000000000") preadv(r1, &(0x7f0000000480), 0x10000000000002a1, 0x0) 12:34:07 executing program 3: 12:34:07 executing program 2: perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f0000000180)=""/148, 0x13d}], 0x1, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000340)="696f001b66408225aaa3af068fffebb8a490c47dda6586f1b58895b94a78037dd3714e7198820a7a709e2d30d25e6d846cd5c62a648a598668a8263b752b0b622b115112b5ad8e0425c0b784bbdb89eb8f4da0dd73dd01fe35694c2f78600badf8a0e237dba40713bac9e053b41a9f62be5fbb928018aab5f7500bef51a2fd74d4fffb4a20a946733820bdc1b485afa417cdbcfdfbc54f58c9c3edffe240c36f4ab8a16613814e226b6d20d98010ab1ace49fa76dce337a5a5f1dcff9e5d533b12475e33b971b15b69cd591cd9059759f0f04ba5468a34b98915033debb3e87f048e8601712659d47d8687eb6be5e650068d88000000000000") preadv(r0, &(0x7f0000000480), 0x1000000000000149, 0x0) msgget$private(0x0, 0x22) [ 469.745034] binder: undelivered death notification, 0000000000000000 12:34:07 executing program 0: syz_open_dev$sndctrl(&(0x7f0000000140)='/dev/snd/controlC#\x00', 0x0, 0x0) sched_setaffinity(0x0, 0x7, &(0x7f00000000c0)=0x9) r0 = perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0) fcntl$setflags(r0, 0x2, 0x1) getsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER_VALUE(0xffffffffffffffff, 0x84, 0x7c, &(0x7f00000001c0), &(0x7f0000000240)=0x8) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(0xffffffffffffffff, 0x84, 0x9, &(0x7f0000000280)={0x0, @in={{0x2, 0x4e23, @remote}}, 0xfffffffffffffff7, 0x0, 0x400}, 0x98) sendto$inet6(0xffffffffffffffff, &(0x7f00000004c0), 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) setsockopt$SO_BINDTODEVICE(0xffffffffffffffff, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x4) socket$inet6(0xa, 0x1000000000002, 0x0) r1 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x4, 0x0, &(0x7f0000000100)=[@enter_looper], 0x1, 0x0, &(0x7f0000000180)='T'}) gettid() timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, &(0x7f0000040000)) tkill(0x0, 0x1004000000016) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0xfffffffffffffced, 0x0, &(0x7f0000000040)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x400c630f}], 0x0, 0x0, &(0x7f0000000f4d)}) 12:34:07 executing program 5: preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f0000000180)=""/148, 0x13d}], 0x1, 0x0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000000)={0x0}, &(0x7f0000000040)=0xc) r1 = syz_open_procfs(r0, &(0x7f0000000080)='net/tcp6\x00') preadv(r1, &(0x7f0000000480), 0x10000000000002a1, 0x0) openat$zero(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/zero\x00', 0x10000, 0x0) 12:34:07 executing program 3: r0 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x80000000000002, &(0x7f0000000140)=0x78, 0x4) ioctl$EVIOCSKEYCODE(0xffffffffffffffff, 0x40084504, &(0x7f0000000200)=[0x140000000, 0xfffffffffffffffc]) bind$inet(r0, &(0x7f0000000000)={0x2, 0x4e23, @broadcast}, 0x10) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) setsockopt$SO_ATTACH_FILTER(r0, 0x1, 0x1a, &(0x7f0000b86000)={0x1, &(0x7f00000000c0)=[{0x6, 0x0, 0x0, 0xe8}]}, 0x10) sendto$inet(r0, &(0x7f0000a88f88), 0x29f, 0x200007fd, &(0x7f0000e68000)={0x2, 0x4e23, @loopback}, 0x10) setsockopt$sock_int(r0, 0x1, 0x8, &(0x7f0000000100), 0x921b527a62bfd8af) r1 = syz_open_dev$amidi(&(0x7f0000000180)='/dev/amidi#\x00', 0x0, 0x0) ioctl$KVM_GET_REGS(r1, 0x8090ae81, &(0x7f0000000940)) accept$alg(r1, 0x0, 0x0) gettid() recvmsg(r0, &(0x7f0000000240)={&(0x7f0000000040)=@nfc, 0x80, &(0x7f00000001c0)=[{&(0x7f0000003ac0)=""/4096, 0x1000}], 0x1, &(0x7f00000002c0)=""/20, 0x14}, 0x100) socket$inet6_tcp(0xa, 0x1, 0x0) write$binfmt_elf64(r0, &(0x7f0000000400)=ANY=[@ANYBLOB="7f454c4600706a5ce1a2ee467d3bca22f507643a066104010000000000000200000000000040000000000000000c02000000000000a6d10000030038000200ffffffff468051e57464030000000300000000000000bc08000000000000f9ffffffffffffffff7f0000000000000600000000000000000800000000000005000000020000006f000000000000000000000000000000ea2b000000000000080000000000000003000000000000000800000000000000f8d1cf6bc8252c025b5f92a84bb4d5efd7201c0b3858f135eeae2dc7f0e87b4cb7c2ebe8e1bf26d90204e8796ae2234ab4507f89e0a927c56e06ac8486242f23306477b3ced713f3ccd7a0f1572c2cfeceaf21bfb67974157e7a4e10510b1d74ca0f796a92f62c8102c33ef139e0cf2ccd4388e8404194afc7dcb3c0580904a76736e493f5c3e2c8d91d510485793916f26e041f6b30857e8c9b55fe64259328116a71513c065b05319d42f98f000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000000000000000000000000000000000008f0000000000000000000000000000000000000000000000000000000000000000000000000000001e00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000400000000000000040000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000400000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000e1ff00000000000000000000000000000000000000000000000000db0000000000000000000000000000000000000000bb4243dbcbc2188b0017487b2e533a58643fe24b175f8e919e52849e39389043525d3ddd494ae985e53468473c711971a0f1c6201ef789867a6a6a43da1331e65f4e1a7c88aea52f23a6494510e240ed0b839a8ffb1e95afe210cd60467c1192a1c88027aed995e0b380cfde5b43203edc98da95e2a230873df201f1d2c5b9afa2a163e85dd75b2733d7061889089388ca552942e1daf09ced67f63454488474926f7c215986"], 0x44f) write$binfmt_elf64(r0, &(0x7f0000001400)=ANY=[@ANYBLOB="7f454c4600250000050000000000000003003e00060000002c010000000000004000000000000000e1000000000000000500000087003800020002000700ea000200007001000000ea0a000000000000f7ffffffffffffff00000000ffffffff00000000000000000100000001000400010000000000000001000070040000000500000000000000000000000000000005000000000000000100000001000000ff0f00000000000000fcfffffffffffff423273d395b5dfe49a633eb0eb0263328129db30c89d614ca312379424593d1149401363a977a2b10bc8394762bab422771360aa38dc889b26829f721e3098b0f80c2f4ee55bcf0df04911af0a6a16e0ab5b5bb1e2227df0cb7b403be567ea3b9adef738dd4b7efbd9e56dfc0dc488a064d4ad246d477bc8fedb6c1fbcdb1469e544a6ac9afa9987b94c8d1209a41a79416931a8f43bd761418a2c47221a2a4d6bee2592cd6eab8fa3ac582965b48d68fb1dde708c9901874b0f1628c0adf0dc15872d102a327e9f073a52942892de4cc87c25e76cde841dd1e09db3f59955450018b682981af9bf3133a11fbf7915b41105bd663e6f7116777b3cb43f260d25a06d22119ca7674f7d9eeb496cccae5ea73758600072b6f0c2a040000002001cb9377fbc132be60c8b0bf6ac0a892b355685d62cb7077a1e889c359d7bfc544111c6ca232e6c6593a0b8f085567b065536d649fea6d4e202255fc1a0dedba780af208b0457ed33958cfd97c0155f59b06d997423bb3b6f3d5e01c8b74030434cacb0e508ef261aff03a72021b6011f6ff05f6070f0bcb7d75cbf1668562cd6599dcf1eac792c47370ac83b2730215d9955f6fa81f59d3209fbaf52f41f8c413432d976fe6eb3ae98661de6250e09bcf7b82d0492b349ca022abe346a443d41aa83ba7d2ed5193dda7e9c78769b1430e5a171e12e0fa1d057e1aef4b856ab0f2dabc8b207f09d78e1f83461ccac0b2558732ea70d369973971d2c6d94081f33308b1e4b27a2ce6f45838809407045aa63b07372728d2aabbb752eb506219d82564c7323f73bfc2260fd95e5e8eeca550b29adcca477de69469764858d7aa3ab8afd99e883c43dacae12ac88e7fea5a99df90755e5caf59185794ed6419a22fe36d9070ed6558b090cb871914491e2a135047b729107896b784bf87c941f7b993033898b993c83b8bcec93aed20e900921e8c8e65939b23a0f84c837a71633aad5664665e7f89839258d1477a2e8fceaa9280b9c9dc53b5ed4bd907c3948f04ac1eff961bf3040ae0faed3985bccc355506dfcd52907750828fc988e60aec5b577af9769cebc8d6e87a826826f8362c84fe7ec9e6d3cc39c1b6b6b9005eaaf0d9037fa576757018d3f60fbab576284cd7343e70a4b8143dc67e94c1090b7376eec330f5995c4b3a119646b4a953cf0669d6e52264827bbbae2c7565529a68f46f5e1a23137059867d0192caf6b22e2d74f8fbe12a139bc90a0d12b6acc0a106ba4fd2baf87c254bb540835206fc5f63dbc82581cec68813c331af00086cae971610587c4683d5f1b0dd68b8a419f581f0387cc9d1a435e329a0595d73a4489b1ea23c331ca752bfd46de13faee26e7e2e9b11dd7151883ac8112c0ba049070bcf00881cc0a37395f1a102cddda4b0b903b0233461e70254e6a75b9c29c02fce51b630d5cd58867e5f8e5b47fdb2fb53e0b9485f1079ddb39d7b3ef5d8d37be9a08714575e454274581a8ad758ba53da32d2c893e8a40de0febf31f84016558a9db7c53dec27895d69fa1a34e4b5b856f4d0974a9dd4031e28632a245b921a576f1a19f47d7ba08e9ca94a7ae46c89b379d90e0dfdcffb790586d920ea79f94af735aa51695dfe0c9c73a44b277e877b473b43f5c3a960d7c5e22678ab3f7cf46bdf23cbbd31df613827f8e23f7b2c71be25eab7dbd56f7b426b78f8e5afe72366ffcd05c29b92ad591e35a19df805a2b89b9b87a13109c19ea941e9b9f6ee1c47708870abfda2debce7eae0f356bc896a5a207f6bc3ed4186117e1ae9b861d3a9a94520a6df99fd700c6fc3b82467a1257c2040dd34b2fb30c032224e6b864900f93168e387edaeeedaebf8b7b40d4caaa97c85229e63770ced3382013fd11010d0ee46333666aaec98aacc511c92be9e55eee400c74ab4614552624ad88f5d63b6f87e85826ee7cf6f15418f9712c6d07f36a54f097d9bc48b3035ae569af4753e7831dc520fe4726d0c96d0cb7b45e5ca5002884d38ed8e8ead8d4a7da76f9bcfd848fd27345bec7dd4356ef7b11a0cd3113bd9c581e7e647eddd060553fd6e9194bc07ffc5ca9eb6e9ce36aa545ac0f6e242e381282522481668f05909a69db9c8f417ce2406fb727c11fa8ed3ec6f097fed51414f3286075c414753979f58a70d97539c1215ad15f4f24e9921c3fc4636f4fb616d5b871cbdc9cb27e00245bb2291f767d4c581387a63022c727026043c0180a848edd1c3fffff21c3fe0b11c65caca8941959536882277e3dc9e61da52527a24e2d79a497a80b33b24f1ca184d56ad13194867d7a0a424977b5f256a4643460a03007ccf2abb042c6a8f357e8c67298f4ee68fa10d82aeec9c63884f43927692db04bfa6651a630ff1e945d5c2ceb1552d0cd69830f257e5d2b500e4447f03edc78938d82871b7075be875dee546cd23ae617356f51fe8f1fb11417e63a436d7ca0ecd22fab3719ab5b4a4fa0ac2b6a44002fdddb61f7d6fe2beac291455b144cff1da4cb487c430a42cd6dee2b0752536175bdeb3abf2a393823dddf4567d7a6ac785662eb272ea9ea223e0d63a2d027fc3bfa6da9c1537a5c207c9f2495bd45ee28be938ad3dbdadee778875ba641ceb20f3fb23d57269a4e40e0baea56d0b4247f12ebb7cf6ee0e64b0d521c8636ca845287f752adfde004e37bee0451540bcabf455b43233e287e4ce36ebbf2cf0aa8325b72b90c40cc5bdf77f66b07bf5423a80409e1e95424e2d63c09e621354d87d29d28758c290f29746e00e72e1f6ee9fc93841a7a4ec7420c1d78c09f9355b41c5b6a2e94d84218428a4e4e40bcab84f0cdc9a230101146a11e1f36367b4b5f21e76b5e58c31aec27a47e7ce6c22d29c553f03d0515199b541750e92718c53542cb8c0e4202c89b5bc2a4e3cd4fd1e33ba846b2d2d1c94d2e73327b1d327fe80ff1113634e2e94769b97a1088c2f00001fd26ffbf3b4b82036e960a01efd1eecb0e4cff79c5943cb7f3390757f2ebaa20ac131cddf19065dad03237cca7406b5c30228494fe25d9d26631795f3b0a16ac6c8c27e37a75bce127c592beed29fe6137efe5ac28a2a89597db794c570055e318e92f17f36e3fcbc68c8233d2f0c433f9e11b2819ade8026682c9c966d13605ba9cfa66d91f8203260ed06d8c53912b2c25be01165ebda24e3b70c4fa4a99c56470ee400000092272d6ba4a0906d5b8df7039b82bf83378b78ce124aca8b7944fffdd65bfca51e33614282fb1738dd43c6b95f2bc5e9b24605ff3fb5a06ece40c2c4a86b93acdde534777d47c5196e7ef7d65ff45606324b402aa6b81afa463f63f96bc442cd25a033b7b6feed08de0f00bccb16c439813c6c4b1d1733bb55a6245a9180ec71a7f31631613c60af161f5ef64493b859a6c4baa9e3811250984db538169178a4f4cb4141f74e366a28b4fdeef59bb22f6f525c493912a044bd99a3b4b86b2834a40437d58d4292a22a730b6a2e5ec7bf358c2016326fff4889d5d5e1beec898a3888d0f4a450d86548a1a9b1cc1bee45e6a4e2c4e0c8d69a51d46190755bd42c1e53d4a1f80010da651d6c500a066afa9c98755acf643ff381af66742c6e091746c77e0f14f2583d6d70339ed50e9da34a0aa8820359872132179f087f16cdaf3636688927e39a857a99f911d08406b6addefa9f895f3b29812234eaf4d5a93b9363fa02a4ee9fe8676811004fabc8121f7639e9f92c0d7f796a6355e984d7a85aadc638b3b17d74fa96eb571516eb1a9fc487e918956411823e1edef555a61ba7d45931457b221bdcc8aaad58e8007497a8846278e0aed68926d3ea9fd96a89ccc89627c86da315c3eb5445bf799df613befe958390660f6c9f7ac02e3187100f18eb3bfacf9662601fc9868329b3524cb8c07850726355bd748f7c51b32e6c4341676cef6af55351e599d196d38d63bf0cd20b85f4bc79a2895b9c5c4d46090b4e1a10394f8ba7201d"], 0xbb8) 12:34:07 executing program 4: socket$inet6(0xa, 0x0, 0x80000000) sched_setaffinity(0x0, 0x7, &(0x7f00000000c0)=0x9) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0) fcntl$setflags(0xffffffffffffffff, 0x2, 0x1) r0 = socket$inet6(0xa, 0x400000000001, 0x0) r1 = dup(r0) setsockopt$inet6_tcp_int(r1, 0x6, 0x12, &(0x7f0000000000)=0x7f, 0x4) bind$inet6(r0, &(0x7f0000000040)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) getsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER_VALUE(r0, 0x84, 0x7c, &(0x7f00000001c0)={0x0, 0x0, 0x6}, &(0x7f0000000240)=0x8) sendto$inet6(r0, &(0x7f00000004c0), 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x4) socket$inet6(0xa, 0x1000000000002, 0x0) r2 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000200)={0x4, 0x0, &(0x7f0000000100)=[@enter_looper], 0x1, 0x0, &(0x7f0000000180)='T'}) r3 = gettid() timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, &(0x7f0000040000)) tkill(r3, 0x1004000000016) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0xfffffffffffffced, 0x0, &(0x7f0000000040)}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x400c630f}], 0x0, 0x0, &(0x7f0000000f4d)}) 12:34:07 executing program 1: preadv(0xffffffffffffffff, &(0x7f00000009c0)=[{&(0x7f00000008c0)=""/148, 0x94}], 0x1, 0x2) r0 = syz_open_dev$dmmidi(&(0x7f0000000a40)='/dev/dmmidi#\x00', 0x4, 0x80000) fchmodat(r0, &(0x7f0000000a80)='./file0\x00', 0x1) r1 = getpid() ptrace$peek(0xffffffffffffffff, r1, &(0x7f0000000080)) fremovexattr(r0, &(0x7f0000000ac0)=@random={'system.', '/dev/rfkill\x00'}) getsockopt$inet_sctp_SCTP_PR_SUPPORTED(r0, 0x84, 0x71, &(0x7f0000000b00)={0x0, 0x7}, &(0x7f0000000b40)=0x8) getsockopt$inet_sctp_SCTP_PARTIAL_DELIVERY_POINT(r0, 0x84, 0x13, &(0x7f0000000b80)={r2, 0x6}, &(0x7f0000000bc0)=0x8) syz_genetlink_get_family_id$nbd(&(0x7f0000000140)='nbd\x00') r3 = openat$rfkill(0xffffffffffffff9c, &(0x7f0000000200)='/dev/rfkill\x00', 0x80000, 0x0) r4 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000980)='/dev/vga_arbiter\x00', 0x801, 0x0) ioctl$TUNSETSTEERINGEBPF(r3, 0x800454e0, &(0x7f0000000a00)=r4) r5 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_ADD_COUNTERS(r5, 0x29, 0x41, &(0x7f00000000c0)={'raw\x00', 0x0, [{}, {}, {}]}, 0xfffffd2a) r6 = syz_open_procfs(0x0, &(0x7f0000000340)="696f001b66408225aaa3af068fffebb8a490c47dda6586f1b58895b94a78037dd3714e7198820a7a709e2d30d25e6d846cd5c62a648a598668a8263b752b0b622b115112b5ad8e0425c0b784bbdb89eb8f4da0dd73dd01fe35694c2f78600badf8a0e237dba40713bac9e053b41a9f62be5fbb928018aab5f7500bef51a2fd74d4fffb4a20a946733820bdc1b485afa417cdbcfdfbc54f58c9c3edffe240c36f4ab8a16613814e226b6d20d98010ab1ace49fa76dce337a5a5f1dcff9e5d533b12475e33b971b15b69cd591cd9059759f0f04ba5468a34b98915033debb3e87f048e8601712659d47d8687eb6be5e650068d88000000000000") ioctl$ASHMEM_SET_PROT_MASK(r6, 0x40087705, &(0x7f0000000040)={0x7fffffff, 0x3f}) preadv(r6, &(0x7f0000000580)=[{&(0x7f0000000700)=""/147, 0x93}, {&(0x7f0000000600)=""/212, 0xd4}, {&(0x7f0000000440)=""/118, 0x76}, {&(0x7f0000000140), 0x159}, {&(0x7f00000004c0)=""/115, 0xffffff78}, {&(0x7f0000000540)=""/4, 0x4}], 0x1000000000000322, 0x0) setxattr$trusted_overlay_redirect(&(0x7f0000000240)='./file0\x00', &(0x7f0000000280)='trusted.overlay.redirect\x00', &(0x7f00000002c0)='./file0\x00', 0x8, 0x3) ioctl$RTC_RD_TIME(r6, 0x80247009, &(0x7f0000000000)) getsockopt$inet_sctp6_SCTP_GET_ASSOC_NUMBER(r6, 0x84, 0x1c, &(0x7f0000000180), &(0x7f00000001c0)=0x4) ioctl$sock_SIOCETHTOOL(r4, 0x8946, &(0x7f0000000300)={'ip6tnl0\x00', &(0x7f00000007c0)=ANY=[@ANYBLOB="1b00000009000000f200000024e0e877579a37f22fce33b2904b8b307e632407d86b68918e622dc5a97be018b4edbc605e465831f06a7b6bcb030975317b9b9a0fa6d78ad572ca36bfc62c50483a5928a98c88a3d973a3dff80c5bd57e39c219a7d40a2178f0f2c8807dba112e1ffcad2429c66b21b5329f2e608d6e735fcc1454e93051a8e2a0fd81a1c75f7e62a785236f5d8d0f26970c38f6aae516005d5c23458507ef9615c6a06e065ece12e8b77dec9335c1ef50ea4aa0900854559c278ac21ab77b91d2955a6c5ad2ffe2876551e264c79a01f91692d66d0c2c60f5b9cafeea0aedc59e7220f1dfdd4d77a26e84be8a41070219c86aa4ff2764c1"]}) 12:34:07 executing program 2: perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f0000000180)=""/148, 0x13d}], 0x1, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000340)="696f001b66408225aaa3af068fffebb8a490c47dda6586f1b58895b94a78037dd3714e7198820a7a709e2d30d25e6d846cd5c62a648a598668a8263b752b0b622b115112b5ad8e0425c0b784bbdb89eb8f4da0dd73dd01fe35694c2f78600badf8a0e237dba40713bac9e053b41a9f62be5fbb928018aab5f7500bef51a2fd74d4fffb4a20a946733820bdc1b485afa417cdbcfdfbc54f58c9c3edffe240c36f4ab8a16613814e226b6d20d98010ab1ace49fa76dce337a5a5f1dcff9e5d533b12475e33b971b15b69cd591cd9059759f0f04ba5468a34b98915033debb3e87f048e8601712659d47d8687eb6be5e650068d88000000000000") preadv(r0, &(0x7f0000000480), 0x1000000000000035, 0x0) msgget$private(0x0, 0x22) 12:34:07 executing program 5: preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f0000000180)=""/148, 0x13d}], 0x1, 0x0) r0 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000000)='/dev/snapshot\x00', 0x4000, 0x0) ioctl$UI_SET_KEYBIT(r0, 0x40045565, 0x14a) r1 = syz_open_procfs(0x0, &(0x7f0000000340)="696f001b66408225aaa3af068fffebb8a490c47dda6586f1b58895b94a78037dd3714e7198820a7a709e2d30d25e6d846cd5c62a648a598668a8263b752b0b622b115112b5ad8e0425c0b784bbdb89eb8f4da0dd73dd01fe35694c2f78600badf8a0e237dba40713bac9e053b41a9f62be5fbb928018aab5f7500bef51a2fd74d4fffb4a20a946733820bdc1b485afa417cdbcfdfbc54f58c9c3edffe240c36f4ab8a16613814e226b6d20d98010ab1ace49fa76dce337a5a5f1dcff9e5d533b12475e33b971b15b69cd591cd9059759f0f04ba5468a34b98915033debb3e87f048e8601712659d47d8687eb6be5e650068d88000000000000") preadv(r1, &(0x7f0000000480), 0x10000000000002a1, 0x0) 12:34:07 executing program 0: syz_open_dev$sndctrl(&(0x7f0000000140)='/dev/snd/controlC#\x00', 0x0, 0x0) sched_setaffinity(0x0, 0x7, &(0x7f00000000c0)=0x9) r0 = perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0) fcntl$setflags(r0, 0x2, 0x1) getsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER_VALUE(0xffffffffffffffff, 0x84, 0x7c, &(0x7f00000001c0), &(0x7f0000000240)=0x8) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(0xffffffffffffffff, 0x84, 0x9, &(0x7f0000000280)={0x0, @in={{0x2, 0x4e23, @remote}}, 0xfffffffffffffff7, 0x0, 0x400}, 0x98) sendto$inet6(0xffffffffffffffff, &(0x7f00000004c0), 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) setsockopt$SO_BINDTODEVICE(0xffffffffffffffff, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x4) socket$inet6(0xa, 0x1000000000002, 0x0) r1 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x4, 0x0, &(0x7f0000000100)=[@enter_looper], 0x1, 0x0, &(0x7f0000000180)='T'}) r2 = gettid() timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, &(0x7f0000040000)) tkill(r2, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0xfffffffffffffced, 0x0, &(0x7f0000000040)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x400c630f}], 0x0, 0x0, &(0x7f0000000f4d)}) 12:34:07 executing program 4: socket$inet6(0xa, 0x0, 0x80000000) sched_setaffinity(0x0, 0x7, &(0x7f00000000c0)=0x9) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0) fcntl$setflags(0xffffffffffffffff, 0x2, 0x1) r0 = socket$inet6(0xa, 0x400000000001, 0x0) r1 = dup(r0) setsockopt$inet6_tcp_int(r1, 0x6, 0x12, &(0x7f0000000000)=0x7f, 0x4) bind$inet6(r0, &(0x7f0000000040)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) getsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER_VALUE(r0, 0x84, 0x7c, &(0x7f00000001c0), &(0x7f0000000240)=0x8) sendto$inet6(r0, &(0x7f00000004c0), 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x4) socket$inet6(0xa, 0x1000000000002, 0x0) r2 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000200)={0x4, 0x0, &(0x7f0000000100)=[@enter_looper], 0x1, 0x0, &(0x7f0000000180)='T'}) r3 = gettid() timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, &(0x7f0000040000)) tkill(r3, 0x1004000000016) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0xfffffffffffffced, 0x0, &(0x7f0000000040)}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x400c630f}], 0x0, 0x0, &(0x7f0000000f4d)}) 12:34:07 executing program 2: perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f0000000180)=""/148, 0x13d}], 0x1, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000340)="696f001b66408225aaa3af068fffebb8a490c47dda6586f1b58895b94a78037dd3714e7198820a7a709e2d30d25e6d846cd5c62a648a598668a8263b752b0b622b115112b5ad8e0425c0b784bbdb89eb8f4da0dd73dd01fe35694c2f78600badf8a0e237dba40713bac9e053b41a9f62be5fbb928018aab5f7500bef51a2fd74d4fffb4a20a946733820bdc1b485afa417cdbcfdfbc54f58c9c3edffe240c36f4ab8a16613814e226b6d20d98010ab1ace49fa76dce337a5a5f1dcff9e5d533b12475e33b971b15b69cd591cd9059759f0f04ba5468a34b98915033debb3e87f048e8601712659d47d8687eb6be5e650068d88000000000000") preadv(r0, &(0x7f0000000480), 0x1000000000000166, 0x0) msgget$private(0x0, 0x22) 12:34:07 executing program 5: preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f0000000180)=""/148, 0x13d}], 0x1, 0x0) r0 = openat$full(0xffffffffffffff9c, &(0x7f0000000400)='/dev/full\x00', 0x220000, 0x0) fcntl$getownex(r0, 0x10, &(0x7f00000000c0)={0x0, 0x0}) syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0x0, 0x2) r2 = syz_open_procfs(r1, &(0x7f0000000100)='task\x00') ioctl$SNDRV_SEQ_IOCTL_SET_CLIENT_POOL(r0, 0x4058534c, &(0x7f0000000040)={0x45, 0x7, 0x7d5, 0x8, 0x2, 0x5}) r3 = syz_open_procfs(r1, &(0x7f0000000240)='statm\x00') getsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(r3, 0x84, 0x9, &(0x7f0000000280)={0x0, @in6={{0xa, 0x4e23, 0x3, @loopback, 0x7f}}, 0xfffffffffffffe08, 0x1, 0xd173, 0x1ff, 0x24}, &(0x7f0000000140)=0x98) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r0, 0x84, 0x9, &(0x7f0000000340)={r4, @in={{0x2, 0x4e20, @remote}}, 0x7fff, 0x2, 0x9, 0x2, 0x18}, 0x98) openat$cgroup(r2, &(0x7f0000000000)='syz0\x00', 0x200002, 0x0) setsockopt$inet_sctp6_SCTP_AUTH_ACTIVE_KEY(r2, 0x84, 0x18, &(0x7f0000000440)={r4, 0xa56b}, 0x8) preadv(r3, &(0x7f0000000480), 0xffffffffffffdb2, 0x0) 12:34:07 executing program 1: preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f0000000180)=""/148, 0x13d}], 0x1, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000340)="696f001b66408225aaa3af068fffebb8a490c47dda6586f1b58895b94a78037dd3714e7198820a7a709e2d30d25e6d846cd5c62a648a598668a8263b752b0b622b115112b5ad8e0425c0b784bbdb89eb8f4da0dd73dd01fe35694c2f78600badf8a0e237dba40713bac9e053b41a9f62be5fbb928018aab5f7500bef51a2fd74d4fffb4a20a946733820bdc1b485afa417cdbcfdfbc54f58c9c3edffe240c36f4ab8a16613814e226b6d20d98010ab1ace49fa76dce337a5a5f1dcff9e5d533b12475e33b971b15b69cd591cd9059759f0f04ba5468a34b98915033debb3e87f048e8601712659d47d8687eb6be5e650068d88000000000000") preadv(r0, &(0x7f0000000480), 0x0, 0x0) setsockopt$inet_sctp_SCTP_AUTOCLOSE(r0, 0x84, 0x4, &(0x7f0000000000)=0x101, 0x4) 12:34:07 executing program 0: syz_open_dev$sndctrl(&(0x7f0000000140)='/dev/snd/controlC#\x00', 0x0, 0x0) sched_setaffinity(0x0, 0x7, &(0x7f00000000c0)=0x9) r0 = perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0) fcntl$setflags(r0, 0x2, 0x1) getsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER_VALUE(0xffffffffffffffff, 0x84, 0x7c, &(0x7f00000001c0), &(0x7f0000000240)=0x8) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(0xffffffffffffffff, 0x84, 0x9, &(0x7f0000000280)={0x0, @in={{0x2, 0x4e23, @remote}}, 0xfffffffffffffff7, 0x0, 0x400}, 0x98) sendto$inet6(0xffffffffffffffff, &(0x7f00000004c0), 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) setsockopt$SO_BINDTODEVICE(0xffffffffffffffff, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x4) socket$inet6(0xa, 0x1000000000002, 0x0) r1 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x4, 0x0, &(0x7f0000000100)=[@enter_looper], 0x1, 0x0, &(0x7f0000000180)='T'}) r2 = gettid() timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, &(0x7f0000040000)) tkill(r2, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0xfffffffffffffced, 0x0, &(0x7f0000000040)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x400c630f}], 0x0, 0x0, &(0x7f0000000f4d)}) 12:34:07 executing program 1: preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f0000000180)=""/148, 0x13d}], 0x1, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000340)="696f001b66408225aaa3af068fffebb8a490c47dda6586f1b58895b94a78037dd3714e7198820a7a709e2d30d25e6d846cd5c62a648a598668a8263b752b0b622b115112b5ad8e0425c0b784bbdb89eb8f4da0dd73dd01fe35694c2f78600badf8a0e237dba40713bac9e053b41a9f62be5fbb928018aab5f7500bef51a2fd74d4fffb4a20a946733820bdc1b485afa417cdbcfdfbc54f58c9c3edffe240c36f4ab8a16613814e226b6d20d98010ab1ace49fa76dce337a5a5f1dcff9e5d533b12475e33b971b15b69cd591cd9059759f0f04ba5468a34b98915033debb3e87f048e8601712659d47d8687eb6be5e650068d88000000000000") preadv(r0, &(0x7f0000000480), 0x10000000000002a1, 0x0) ioctl$PERF_EVENT_IOC_DISABLE(r0, 0x2401, 0x5) 12:34:08 executing program 3: ioctl$IOC_PR_RELEASE(0xffffffffffffffff, 0x401070ca, &(0x7f0000000080)) sched_setattr(0x0, &(0x7f00000003c0), 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000000400)={{'fd', 0x3d, r0}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}}) lstat(&(0x7f00000003c0)='./file0/file0\x00', &(0x7f00000009c0)) read$FUSE(r0, &(0x7f00000030c0), 0x1000) read$FUSE(r0, &(0x7f0000001000), 0x1000) write$FUSE_INIT(r0, &(0x7f0000000100)={0x50, 0x0, 0x1}, 0x50) write$FUSE_DIRENT(r0, &(0x7f0000000500)=ANY=[@ANYBLOB="90000000000000000200000000000000010000000045000000000000000000000b000000000066ce656d316e6f246576656d310000000000000000000000000000002c000000000000000000000000001c000000000000002b7379737465746a48be1b31486dcc6370757365746367726f7570246367726f000000000000000000000000000000000000000000000000"], 0x90) 12:34:08 executing program 5: preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f0000000180)=""/148, 0x13d}], 0x1, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000340)="696f001b66408225aaa3af068fffebb8a490c47dda6586f1b58895b94a78037dd3714e7198820a7a709e2d30d25e6d846cd5c62a648a598668a8263b752b0b622b115112b5ad8e0425c0b784bbdb89eb8f4da0dd73dd01fe35694c2f78600badf8a0e237dba40713bac9e053b41a9f62be5fbb928018aab5f7500bef51a2fd74d4fffb4a20a946733820bdc1b485afa417cdbcfdfbc54f58c9c3edffe240c36f4ab8a16613814e226b6d20d98010ab1ace49fa76dce337a5a5f1dcff9e5d533b12475e33b971b15b69cd591cd9059759f0f04ba5468a34b98915033debb3e87f048e8601712659d47d8687eb6be5e650068d88000000000000") preadv(r0, &(0x7f0000000480), 0x10000000000002a1, 0x0) ioctl$SNDRV_TIMER_IOCTL_PAUSE(r0, 0x54a3) 12:34:08 executing program 4: socket$inet6(0xa, 0x0, 0x80000000) sched_setaffinity(0x0, 0x7, &(0x7f00000000c0)=0x9) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0) fcntl$setflags(0xffffffffffffffff, 0x2, 0x1) r0 = socket$inet6(0xa, 0x400000000001, 0x0) r1 = dup(r0) setsockopt$inet6_tcp_int(r1, 0x6, 0x12, &(0x7f0000000000)=0x7f, 0x4) bind$inet6(r0, &(0x7f0000000040)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) getsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER_VALUE(r0, 0x84, 0x7c, &(0x7f00000001c0), &(0x7f0000000240)=0x8) sendto$inet6(r0, &(0x7f00000004c0), 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x4) socket$inet6(0xa, 0x1000000000002, 0x0) r2 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000200)={0x4, 0x0, &(0x7f0000000100)=[@enter_looper], 0x1, 0x0, &(0x7f0000000180)='T'}) r3 = gettid() timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, &(0x7f0000040000)) tkill(r3, 0x1004000000016) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0xfffffffffffffced, 0x0, &(0x7f0000000040)}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x400c630f}], 0x0, 0x0, &(0x7f0000000f4d)}) 12:34:08 executing program 2: perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f0000000180)=""/148, 0x13d}], 0x1, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000340)="696f001b66408225aaa3af068fffebb8a490c47dda6586f1b58895b94a78037dd3714e7198820a7a709e2d30d25e6d846cd5c62a648a598668a8263b752b0b622b115112b5ad8e0425c0b784bbdb89eb8f4da0dd73dd01fe35694c2f78600badf8a0e237dba40713bac9e053b41a9f62be5fbb928018aab5f7500bef51a2fd74d4fffb4a20a946733820bdc1b485afa417cdbcfdfbc54f58c9c3edffe240c36f4ab8a16613814e226b6d20d98010ab1ace49fa76dce337a5a5f1dcff9e5d533b12475e33b971b15b69cd591cd9059759f0f04ba5468a34b98915033debb3e87f048e8601712659d47d8687eb6be5e650068d88000000000000") preadv(r0, &(0x7f0000000480), 0x100000000000017a, 0x0) msgget$private(0x0, 0x22) 12:34:08 executing program 1: bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffff9c, 0x0, 0x2, &(0x7f0000000000)='#\x00', 0xffffffffffffffff}, 0x30) r1 = getpgid(r0) r2 = syz_open_procfs(r1, &(0x7f0000000180)="696f001b66408225aaa3af068fffebb8a490c47dda6586f1b58895b94a78037dd3714e7198820a7a709e2d30d25e6d846cd5c62a648a598668a8263b752b0b622b115112b5ad8e0425c0b784bbdb89eb8f4da0dd73dd01fe35694c2f78600badf8a0e237dba40713bac9e053b41a9f62be5fbb928018aab5f7500bef51a2fd74d4fffb4a20a946733820bdc1b485afa417cdbcfdfbc54f58c9c3edffe240c36f4ab8a16613814e226b6d20d98010ab1ace49fa76dce337a5a5f1dcff9e5d533b12475e33b971b15b69cd591cd9059759f0f04ba5468a34b98915033debb3e87f048e8601712659d47d8687eb6be5e650068d88000000000000") preadv(r2, &(0x7f0000000480), 0x10000000000002a1, 0x0) 12:34:08 executing program 0: syz_open_dev$sndctrl(&(0x7f0000000140)='/dev/snd/controlC#\x00', 0x0, 0x0) sched_setaffinity(0x0, 0x7, &(0x7f00000000c0)=0x9) r0 = perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0) fcntl$setflags(r0, 0x2, 0x1) getsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER_VALUE(0xffffffffffffffff, 0x84, 0x7c, &(0x7f00000001c0), &(0x7f0000000240)=0x8) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(0xffffffffffffffff, 0x84, 0x9, &(0x7f0000000280)={0x0, @in={{0x2, 0x4e23, @remote}}, 0xfffffffffffffff7, 0x0, 0x400}, 0x98) sendto$inet6(0xffffffffffffffff, &(0x7f00000004c0), 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) setsockopt$SO_BINDTODEVICE(0xffffffffffffffff, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x4) socket$inet6(0xa, 0x1000000000002, 0x0) r1 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x4, 0x0, &(0x7f0000000100)=[@enter_looper], 0x1, 0x0, &(0x7f0000000180)='T'}) r2 = gettid() timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, &(0x7f0000040000)) tkill(r2, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0xfffffffffffffced, 0x0, &(0x7f0000000040)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x400c630f}], 0x0, 0x0, &(0x7f0000000f4d)}) 12:34:08 executing program 1: r0 = socket$alg(0x26, 0x5, 0x0) getsockopt$sock_buf(r0, 0x1, 0x0, &(0x7f0000000000)=""/52, &(0x7f0000000040)=0x34) preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f0000000180)=""/148, 0x13d}], 0x1, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000340)="696f001b66408225aaa3af068fffebb8a490c47dda6586f1b58895b94a78037dd3714e7198820a7a709e2d30d25e6d846cd5c62a648a598668a8263b752b0b622b115112b5ad8e0425c0b784bbdb89eb8f4da0dd73dd01fe35694c2f78600badf8a0e237dba40713bac9e053b41a9f62be5fbb928018aab5f7500bef51a2fd74d4fffb4a20a946733820bdc1b485afa417cdbcfdfbc54f58c9c3edffe240c36f4ab8a16613814e226b6d20d98010ab1ace49fa76dce337a5a5f1dcff9e5d533b12475e33b971b15b69cd591cd9059759f0f04ba5468a34b98915033debb3e87f048e8601712659d47d8687eb6be5e650068d88000000000000") preadv(r1, &(0x7f0000000480), 0x10000000000002a1, 0x0) 12:34:08 executing program 5: preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f0000000180)=""/148, 0x13d}], 0x1, 0x0) r0 = accept4$inet6(0xffffffffffffffff, 0x0, &(0x7f0000000000), 0x80800) ioctl$sock_SIOCBRDELBR(r0, 0x89a1, &(0x7f0000000040)='bond0\x00') r1 = syz_open_procfs(0x0, &(0x7f0000000340)="696f001b66408225aaa3af068fffebb8a490c47dda6586f1b58895b94a78037dd3714e7198820a7a709e2d30d25e6d846cd5c62a648a598668a8263b752b0b622b115112b5ad8e0425c0b784bbdb89eb8f4da0dd73dd01fe35694c2f78600badf8a0e237dba40713bac9e053b41a9f62be5fbb928018aab5f7500bef51a2fd74d4fffb4a20a946733820bdc1b485afa417cdbcfdfbc54f58c9c3edffe240c36f4ab8a16613814e226b6d20d98010ab1ace49fa76dce337a5a5f1dcff9e5d533b12475e33b971b15b69cd591cd9059759f0f04ba5468a34b98915033debb3e87f048e8601712659d47d8687eb6be5e650068d88000000000000") preadv(r1, &(0x7f0000000480), 0x10000000000002a1, 0x0) 12:34:08 executing program 0: syz_open_dev$sndctrl(&(0x7f0000000140)='/dev/snd/controlC#\x00', 0x0, 0x0) sched_setaffinity(0x0, 0x7, &(0x7f00000000c0)=0x9) r0 = perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0) fcntl$setflags(r0, 0x2, 0x1) getsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER_VALUE(0xffffffffffffffff, 0x84, 0x7c, &(0x7f00000001c0), &(0x7f0000000240)=0x8) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(0xffffffffffffffff, 0x84, 0x9, &(0x7f0000000280)={0x0, @in={{0x2, 0x4e23, @remote}}, 0xfffffffffffffff7, 0x0, 0x400}, 0x98) sendto$inet6(0xffffffffffffffff, &(0x7f00000004c0), 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) setsockopt$SO_BINDTODEVICE(0xffffffffffffffff, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x4) socket$inet6(0xa, 0x1000000000002, 0x0) r1 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x4, 0x0, &(0x7f0000000100)=[@enter_looper], 0x1, 0x0, &(0x7f0000000180)='T'}) r2 = gettid() timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, &(0x7f0000040000)) tkill(r2, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0xfffffffffffffced, 0x0, &(0x7f0000000040)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x400c630f}], 0x0, 0x0, &(0x7f0000000f4d)}) 12:34:08 executing program 2: perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f0000000180)=""/148, 0x13d}], 0x1, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000340)="696f001b66408225aaa3af068fffebb8a490c47dda6586f1b58895b94a78037dd3714e7198820a7a709e2d30d25e6d846cd5c62a648a598668a8263b752b0b622b115112b5ad8e0425c0b784bbdb89eb8f4da0dd73dd01fe35694c2f78600badf8a0e237dba40713bac9e053b41a9f62be5fbb928018aab5f7500bef51a2fd74d4fffb4a20a946733820bdc1b485afa417cdbcfdfbc54f58c9c3edffe240c36f4ab8a16613814e226b6d20d98010ab1ace49fa76dce337a5a5f1dcff9e5d533b12475e33b971b15b69cd591cd9059759f0f04ba5468a34b98915033debb3e87f048e8601712659d47d8687eb6be5e650068d88000000000000") preadv(r0, &(0x7f0000000480), 0x1000000000000267, 0x0) msgget$private(0x0, 0x22) 12:34:08 executing program 4: socket$inet6(0xa, 0x0, 0x80000000) sched_setaffinity(0x0, 0x7, &(0x7f00000000c0)=0x9) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0) fcntl$setflags(0xffffffffffffffff, 0x2, 0x1) r0 = socket$inet6(0xa, 0x400000000001, 0x0) r1 = dup(r0) setsockopt$inet6_tcp_int(r1, 0x6, 0x12, &(0x7f0000000000)=0x7f, 0x4) bind$inet6(r0, &(0x7f0000000040)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) getsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER_VALUE(r0, 0x84, 0x7c, &(0x7f00000001c0), &(0x7f0000000240)=0x8) sendto$inet6(r0, &(0x7f00000004c0), 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x4) socket$inet6(0xa, 0x1000000000002, 0x0) r2 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000200)={0x4, 0x0, &(0x7f0000000100)=[@enter_looper], 0x1, 0x0, &(0x7f0000000180)='T'}) r3 = gettid() timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, &(0x7f0000040000)) tkill(r3, 0x1004000000016) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0xfffffffffffffced, 0x0, &(0x7f0000000040)}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x400c630f}], 0x0, 0x0, &(0x7f0000000f4d)}) 12:34:08 executing program 3: r0 = syz_open_dev$loop(&(0x7f0000000040)='/dev/loop#\x00', 0x0, 0x0) clone(0x2102011ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000001340), 0xffffffffffffffff) r1 = getpid() sched_setscheduler(r1, 0x5, &(0x7f00000000c0)) ioctl$BLKTRACESETUP(r0, 0xc0481273, &(0x7f0000000100)={[], 0x0, 0x6, 0x8000200}) msgget(0xffffffffffffffff, 0x80) [ 471.175166] binder: 24575:24587 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 12:34:08 executing program 1: preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f0000000180)=""/148, 0x13d}], 0x1, 0x0) openat$vsock(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vsock\x00', 0x800, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000340)="696f001b66408225aaa3af068fffebb8a490c47dda6586f1b58895b94a78037dd3714e7198820a7a709e2d30d25e6d846cd5c62a648a598668a8263b752b0b622b115112b5ad8e0425c0b784bbdb89eb8f4da0dd73dd01fe35694c2f78600badf8a0e237dba40713bac9e053b41a9f62be5fbb928018aab5f7500bef51a2fd74d4fffb4a20a946733820bdc1b485afa417cdbcfdfbc54f58c9c3edffe240c36f4ab8a16613814e226b6d20d98010ab1ace49fa76dce337a5a5f1dcff9e5d533b12475e33b971b15b69cd591cd9059759f0f04ba5468a34b98915033debb3e87f048e8601712659d47d8687eb6be5e650068d88000000000000") preadv(r0, &(0x7f0000000480), 0x10000000000002a1, 0x0) 12:34:08 executing program 5: socketpair(0x1d, 0x8000b, 0x7, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) write$UHID_INPUT2(r0, &(0x7f0000000440)=ANY=[@ANYBLOB="0c000000a900b143712ffee1c5bc6e77790b5758278f24ac3fb1279ff14828e9054a259ea6b8e1f0bb49869ad12c64e64d93368f30589c2179354fc243a8a8c7ac3fedee15a524f6cdec1b8dc478d8d2a57c7b57aaf86be405dc450149aa13fbf1e8bc2e853eeb7447ff46610ba11be78c1818afa2da5a45ff2a3d80bdee714b00000042d9e333a3c9bbf0775305dd2fcfeb9673803d499d46d526949945a64e360f71f0861b0c7e4d2004a19e780ee96b4335cb"], 0xaf) preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f0000000180)=""/148, 0x13d}], 0x1, 0x0) r1 = getpid() r2 = syz_open_procfs(r1, &(0x7f0000000340)='net/stat\x00') preadv(r2, &(0x7f0000000100)=[{&(0x7f0000000000)=""/100, 0x64}, {&(0x7f0000000080)=""/40, 0x28}], 0x2, 0x0) 12:34:08 executing program 2: perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f0000000180)=""/148, 0x13d}], 0x1, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000340)="696f001b66408225aaa3af068fffebb8a490c47dda6586f1b58895b94a78037dd3714e7198820a7a709e2d30d25e6d846cd5c62a648a598668a8263b752b0b622b115112b5ad8e0425c0b784bbdb89eb8f4da0dd73dd01fe35694c2f78600badf8a0e237dba40713bac9e053b41a9f62be5fbb928018aab5f7500bef51a2fd74d4fffb4a20a946733820bdc1b485afa417cdbcfdfbc54f58c9c3edffe240c36f4ab8a16613814e226b6d20d98010ab1ace49fa76dce337a5a5f1dcff9e5d533b12475e33b971b15b69cd591cd9059759f0f04ba5468a34b98915033debb3e87f048e8601712659d47d8687eb6be5e650068d88000000000000") preadv(r0, &(0x7f0000000480), 0x1000000000000048, 0x0) msgget$private(0x0, 0x22) [ 471.219758] binder: BINDER_SET_CONTEXT_MGR already set [ 471.226140] binder: 24588:24589 ioctl 40046207 0 returned -16 12:34:08 executing program 5: preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f0000000180)=""/148, 0x13d}], 0x1, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000340)="696f001b66408225aaa3af068fffebb8a490c47dda6586f1b58895b94a78037dd3714e7198820a7a709e2d30d25e6d846cd5c62a648a598668a8263b752b0b622b115112b5ad8e0425c0b784bbdb89eb8f4da0dd73dd01fe35694c2f78600badf8a0e237dba40713bac9e053b41a9f62be5fbb928018aab5f7500bef51a2fd74d4fffb4a20a946733820bdc1b485afa417cdbcfdfbc54f58c9c3edffe240c36f4ab8a16613814e226b6d20d98010ab1ace49fa76dce337a5a5f1dcff9e5d533b12475e33b971b15b69cd591cd9059759f0f04ba5468a34b98915033debb3e87f048e8601712659d47d8687eb6be5e650068d88000000000000") preadv(r0, &(0x7f0000000480), 0x10000000000002a1, 0x0) write$FUSE_NOTIFY_INVAL_ENTRY(r0, &(0x7f0000000000)={0x37, 0x3, 0x0, {0x3, 0x16, 0x0, '}ppp1*c+vmnet0%-\'}&(\\-'}}, 0x37) 12:34:08 executing program 4: socket$inet6(0xa, 0x0, 0x80000000) sched_setaffinity(0x0, 0x7, &(0x7f00000000c0)=0x9) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0) fcntl$setflags(0xffffffffffffffff, 0x2, 0x1) r0 = socket$inet6(0xa, 0x400000000001, 0x0) r1 = dup(r0) setsockopt$inet6_tcp_int(r1, 0x6, 0x12, &(0x7f0000000000)=0x7f, 0x4) bind$inet6(r0, &(0x7f0000000040)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) getsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER_VALUE(r0, 0x84, 0x7c, &(0x7f00000001c0)={0x0, 0x0, 0x6}, &(0x7f0000000240)=0x8) sendto$inet6(0xffffffffffffffff, &(0x7f00000004c0), 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x4) socket$inet6(0xa, 0x1000000000002, 0x0) r2 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000200)={0x4, 0x0, &(0x7f0000000100)=[@enter_looper], 0x1, 0x0, &(0x7f0000000180)='T'}) r3 = gettid() timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, &(0x7f0000040000)) tkill(r3, 0x1004000000016) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0xfffffffffffffced, 0x0, &(0x7f0000000040)}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x400c630f}], 0x0, 0x0, &(0x7f0000000f4d)}) 12:34:08 executing program 3: r0 = socket$inet_sctp(0x2, 0x5, 0x84) sendto$inet(r0, &(0x7f00000002c0)='D', 0x1, 0x0, &(0x7f0000000240)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x1d}}, 0x10) 12:34:08 executing program 1: r0 = socket$nl_generic(0x10, 0x3, 0x10) setsockopt$netlink_NETLINK_TX_RING(r0, 0x10e, 0x7, &(0x7f0000000180)={0x6, 0x1ff, 0x9, 0x7f}, 0x10) r1 = syz_open_pts(0xffffffffffffffff, 0x20000) preadv(r1, &(0x7f0000000300)=[{&(0x7f0000000000)=""/241, 0xf1}, {&(0x7f0000000100)=""/99, 0x63}, {&(0x7f0000000240)=""/105, 0x69}, {&(0x7f00000002c0)=""/14, 0xe}], 0x4, 0x0) preadv(r1, &(0x7f0000000480), 0x1000000000000036, 0x3) r2 = syz_open_procfs(0x0, &(0x7f0000000340)="696f001b66408225aaa3af068fffebb8a490c47dda6586f1b58895b94a78037dd3714e7198820a7a709e2d30d25e6d846cd5c62a648a598668a8263b752b0b622b115112b5ad8e0425c0b784bbdb89eb8f4da0dd73dd01fe35694c2f78600badf8a0e237dba40713bac9e053b41a9f62be5fbb928018aab5f7500bef51a2fd74d4fffb4a20a946733820bdc1b485afa417cdbcfdfbc54f58c9c3edffe240c36f4ab8a16613814e226b6d20d98010ab1ace49fa76dce337a5a5f1dcff9e5d533b12475e33b971b15b69cd591cd9059759f0f04ba5468a34b98915033debb3e87f048e8601712659d47d8687eb6be5e650068d88000000000000") preadv(r2, &(0x7f0000000480), 0x10000000000002a1, 0x0) accept4$inet(r2, 0x0, &(0x7f0000000440), 0x800) 12:34:08 executing program 2: perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f0000000180)=""/148, 0x13d}], 0x1, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000340)="696f001b66408225aaa3af068fffebb8a490c47dda6586f1b58895b94a78037dd3714e7198820a7a709e2d30d25e6d846cd5c62a648a598668a8263b752b0b622b115112b5ad8e0425c0b784bbdb89eb8f4da0dd73dd01fe35694c2f78600badf8a0e237dba40713bac9e053b41a9f62be5fbb928018aab5f7500bef51a2fd74d4fffb4a20a946733820bdc1b485afa417cdbcfdfbc54f58c9c3edffe240c36f4ab8a16613814e226b6d20d98010ab1ace49fa76dce337a5a5f1dcff9e5d533b12475e33b971b15b69cd591cd9059759f0f04ba5468a34b98915033debb3e87f048e8601712659d47d8687eb6be5e650068d88000000000000") preadv(r0, &(0x7f0000000480), 0x10000000000001be, 0x0) msgget$private(0x0, 0x22) [ 471.520700] binder: BINDER_SET_CONTEXT_MGR already set [ 471.544583] binder: 24616:24617 ioctl 40046207 0 returned -16 12:34:09 executing program 0: syz_open_dev$sndctrl(&(0x7f0000000140)='/dev/snd/controlC#\x00', 0x0, 0x0) sched_setaffinity(0x0, 0x7, &(0x7f00000000c0)=0x9) r0 = perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0) fcntl$setflags(r0, 0x2, 0x1) getsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER_VALUE(0xffffffffffffffff, 0x84, 0x7c, &(0x7f00000001c0), &(0x7f0000000240)=0x8) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(0xffffffffffffffff, 0x84, 0x9, &(0x7f0000000280)={0x0, @in={{0x2, 0x4e23, @remote}}, 0xfffffffffffffff7, 0x0, 0x400}, 0x98) sendto$inet6(0xffffffffffffffff, &(0x7f00000004c0), 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) setsockopt$SO_BINDTODEVICE(0xffffffffffffffff, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x4) socket$inet6(0xa, 0x1000000000002, 0x0) r1 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x4, 0x0, &(0x7f0000000100)=[@enter_looper], 0x1, 0x0, &(0x7f0000000180)='T'}) r2 = gettid() timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, &(0x7f0000040000)) tkill(r2, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, &(0x7f0000000040)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x400c630f}], 0x0, 0x0, &(0x7f0000000f4d)}) 12:34:09 executing program 3: perf_event_open(&(0x7f000001d000)={0x2, 0x70, 0x71}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ppp\x00', 0x0, 0x0) ioctl$EVIOCGPROP(r0, 0xc004743e, &(0x7f0000000540)=""/246) r1 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ppp\x00', 0x0, 0x0) ioctl$EVIOCGPROP(r1, 0x4004743d, &(0x7f0000000440)=""/246) 12:34:09 executing program 5: preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f0000000180)=""/148, 0x13d}], 0x1, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000340)="696f001b66408225aaa3af068fffebb8a490c47dda6586f1b58895b94a78037dd3714e7198820a7a709e2d30d25e6d846cd5c62a648a598668a8263b752b0b622b115112b5ad8e0425c0b784bbdb89eb8f4da0dd73dd01fe35694c2f78600badf8a0e237dba40713bac9e053b41a9f62be5fbb928018aab5f7500bef51a2fd74d4fffb4a20a946733820bdc1b485afa417cdbcfdfbc54f58c9c3edffe240c36f4ab8a16613814e226b6d20d98010ab1ace49fa76dce337a5a5f1dcff9e5d533b12475e33b971b15b69cd591cd9059759f0f04ba5468a34b98915033debb3e87f048e8601712659d47d8687eb6be5e650068d88000000000000") ioctl$sock_inet_SIOCGIFNETMASK(r0, 0x891b, &(0x7f0000000000)={'bcsh0\x00', {0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0x19}}}) preadv(r0, &(0x7f0000000480), 0x10000000000002a1, 0x0) ioctl$PERF_EVENT_IOC_PAUSE_OUTPUT(r0, 0x40042409, 0x0) 12:34:09 executing program 1: preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f0000000180)=""/148, 0x13d}], 0x1, 0x0) r0 = syz_open_dev$usbmon(&(0x7f0000000000)='/dev/usbmon#\x00', 0x9, 0x64200) write$P9_RREADDIR(r0, &(0x7f0000000040)={0x2a, 0x29, 0x1, {0x1, [{{0x40, 0x2, 0x6}, 0x3, 0x6, 0x7, './file0'}]}}, 0x2a) r1 = syz_open_procfs(0x0, &(0x7f0000000340)="696f001b66408225aaa3af068fffebb8a490c47dda6586f1b58895b94a78037dd3714e7198820a7a709e2d30d25e6d846cd5c62a648a598668a8263b752b0b622b115112b5ad8e0425c0b784bbdb89eb8f4da0dd73dd01fe35694c2f78600badf8a0e237dba40713bac9e053b41a9f62be5fbb928018aab5f7500bef51a2fd74d4fffb4a20a946733820bdc1b485afa417cdbcfdfbc54f58c9c3edffe240c36f4ab8a16613814e226b6d20d98010ab1ace49fa76dce337a5a5f1dcff9e5d533b12475e33b971b15b69cd591cd9059759f0f04ba5468a34b98915033debb3e87f048e8601712659d47d8687eb6be5e650068d88000000000000") preadv(r1, &(0x7f0000000480), 0x10000000000002a1, 0x0) 12:34:09 executing program 2: perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f0000000180)=""/148, 0x13d}], 0x1, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000340)="696f001b66408225aaa3af068fffebb8a490c47dda6586f1b58895b94a78037dd3714e7198820a7a709e2d30d25e6d846cd5c62a648a598668a8263b752b0b622b115112b5ad8e0425c0b784bbdb89eb8f4da0dd73dd01fe35694c2f78600badf8a0e237dba40713bac9e053b41a9f62be5fbb928018aab5f7500bef51a2fd74d4fffb4a20a946733820bdc1b485afa417cdbcfdfbc54f58c9c3edffe240c36f4ab8a16613814e226b6d20d98010ab1ace49fa76dce337a5a5f1dcff9e5d533b12475e33b971b15b69cd591cd9059759f0f04ba5468a34b98915033debb3e87f048e8601712659d47d8687eb6be5e650068d88000000000000") preadv(r0, &(0x7f0000000480), 0x10000000000001cd, 0x0) msgget$private(0x0, 0x22) 12:34:09 executing program 5: preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f00000000c0)=""/148, 0x15e}], 0x0, 0x800000000000000) r0 = syz_open_procfs(0x0, &(0x7f0000000340)="696f001b66408225aaa3af068fffebb8a490c47dda6586f1b58895b94a78037dd3714e7198820a7a709e2d30d25e6d846cd5c62a648a598668a8263b752b0b622b115112b5ad8e0425c0b784bbdb89eb8f4da0dd73dd01fe35694c2f78600badf8a0e237dba40713bac9e053b41a9f62be5fbb928018aab5f7500bef51a2fd74d4fffb4a20a946733820bdc1b485afa417cdbcfdfbc54f58c9c3edffe240c36f4ab8a16613814e226b6d20d98010ab1ace49fa76dce337a5a5f1dcff9e5d533b12475e33b971b15b69cd591cd9059759f0f04ba5468a34b98915033debb3e87f048e8601712659d47d8687eb6be5e650068d88000000000000") preadv(r0, &(0x7f0000000480), 0x10000000000002a1, 0x0) 12:34:09 executing program 1: preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f0000000180)=""/148, 0x13d}], 0x1, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000340)="696f001b66408225aaa3af068fffebb8a490c47dda6586f1b58895b94a78037dd3714e7198820a7a709e2d30d25e6d846cd5c62a648a598668a8263b752b0b622b115112b5ad8e0425c0b784bbdb89eb8f4da0dd73dd01fe35694c2f78600badf8a0e237dba40713bac9e053b41a9f62be5fbb928018aab5f7500bef51a2fd74d4fffb4a20a946733820bdc1b485afa417cdbcfdfbc54f58c9c3edffe240c36f4ab8a16613814e226b6d20d98010ab1ace49fa76dce337a5a5f1dcff9e5d533b12475e33b971b15b69cd591cd9059759f0f04ba5468a34b98915033debb3e87f048e8601712659d47d8687eb6be5e650068d88000000000000") fcntl$getflags(r0, 0x3) preadv(r0, &(0x7f0000000100)=[{&(0x7f0000000000)=""/160, 0xa0}, {&(0x7f00000000c0)=""/28, 0x1c}], 0x2, 0x0) 12:34:09 executing program 2: perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f0000000180)=""/148, 0x13d}], 0x1, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000340)="696f001b66408225aaa3af068fffebb8a490c47dda6586f1b58895b94a78037dd3714e7198820a7a709e2d30d25e6d846cd5c62a648a598668a8263b752b0b622b115112b5ad8e0425c0b784bbdb89eb8f4da0dd73dd01fe35694c2f78600badf8a0e237dba40713bac9e053b41a9f62be5fbb928018aab5f7500bef51a2fd74d4fffb4a20a946733820bdc1b485afa417cdbcfdfbc54f58c9c3edffe240c36f4ab8a16613814e226b6d20d98010ab1ace49fa76dce337a5a5f1dcff9e5d533b12475e33b971b15b69cd591cd9059759f0f04ba5468a34b98915033debb3e87f048e8601712659d47d8687eb6be5e650068d88000000000000") preadv(r0, &(0x7f0000000480), 0x1000000000000171, 0x0) msgget$private(0x0, 0x22) [ 472.015324] binder: 24641:24650 BC_CLEAR_DEATH_NOTIFICATION death notification not active 12:34:09 executing program 4: socket$inet6(0xa, 0x0, 0x80000000) sched_setaffinity(0x0, 0x7, &(0x7f00000000c0)=0x9) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0) fcntl$setflags(0xffffffffffffffff, 0x2, 0x1) r0 = socket$inet6(0xa, 0x400000000001, 0x0) r1 = dup(r0) setsockopt$inet6_tcp_int(r1, 0x6, 0x12, &(0x7f0000000000)=0x7f, 0x4) bind$inet6(r0, &(0x7f0000000040)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) getsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER_VALUE(r0, 0x84, 0x7c, &(0x7f00000001c0)={0x0, 0x0, 0x6}, &(0x7f0000000240)=0x8) sendto$inet6(r0, &(0x7f00000004c0), 0x0, 0x0, &(0x7f00008d4fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x4) socket$inet6(0xa, 0x1000000000002, 0x0) r2 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000200)={0x4, 0x0, &(0x7f0000000100)=[@enter_looper], 0x1, 0x0, &(0x7f0000000180)='T'}) r3 = gettid() timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, &(0x7f0000040000)) tkill(r3, 0x1004000000016) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0xfffffffffffffced, 0x0, &(0x7f0000000040)}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x400c630f}], 0x0, 0x0, &(0x7f0000000f4d)}) 12:34:09 executing program 5: preadv(0xffffffffffffffff, &(0x7f0000001380), 0x0, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000340)="696f001b66408225aaa3af068fffebb8a490c47dda6586f1b58895b94a78037dd3714e7198820a7a709e2d30d25e6d846cd5c62a648a598668a8263b752b0b622b115112b5ad8e0425c0b784bbdb89eb8f4da0dd73dd01fe35694c2f78600badf8a0e237dba40713bac9e053b41a9f62be5fbb928018aab5f7500bef51a2fd74d4fffb4a20a946733820bdc1b485afa417cdbcfdfbc54f58c9c3edffe240c36f4ab8a16613814e226b6d20d98010ab1ace49fa76dce337a5a5f1dcff9e5d533b12475e33b971b15b69cd591cd9059759f0f04ba5468a34b98915033debb3e87f048e8601712659d47d8687eb6be5e650068d88000000000000") preadv(r0, &(0x7f0000000480), 0x10000000000002a1, 0x0) clock_settime(0x1, &(0x7f0000000000)={0x77359400}) 12:34:09 executing program 3: socket$inet6(0xa, 0x0, 0x80000000) sched_setaffinity(0x0, 0x7, &(0x7f00000000c0)=0x9) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0) fcntl$setflags(0xffffffffffffffff, 0x2, 0x1) r0 = socket$inet6(0xa, 0x400000000001, 0x0) r1 = dup(r0) setsockopt$inet6_tcp_int(r1, 0x6, 0x12, &(0x7f0000000000)=0x7f, 0x4) bind$inet6(r0, &(0x7f0000000040)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) getsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER_VALUE(r0, 0x84, 0x7c, &(0x7f00000001c0), &(0x7f0000000240)=0x8) sendto$inet6(r0, &(0x7f00000004c0), 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x4) socket$inet6(0xa, 0x1000000000002, 0x0) r2 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000200)={0x4, 0x0, &(0x7f0000000100)=[@enter_looper], 0x1, 0x0, &(0x7f0000000180)='T'}) r3 = gettid() timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, &(0x7f0000040000)) tkill(r3, 0x1004000000016) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0xfffffffffffffced, 0x0, &(0x7f0000000040)}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x400c630f}], 0x0, 0x0, &(0x7f0000000f4d)}) 12:34:09 executing program 1: preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f0000000180)=""/148, 0x13d}], 0x1, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000340)="696f001b66408225aaa3af068fffebb8a490c47dda6586f1b58895b94a78037dd3714e7198820a7a709e2d30d25e6d846cd5c62a648a598668a8263b752b0b622b115112b5ad8e0425c0b784bbdb89eb8f4da0dd73dd01fe35694c2f78600badf8a0e237dba40713bac9e053b41a9f62be5fbb928018aab5f7500bef51a2fd74d4fffb4a20a946733820bdc1b485afa417cdbcfdfbc54f58c9c3edffe240c36f4ab8a16613814e226b6d20d98010ab1ace49fa76dce337a5a5f1dcff9e5d533b12475e33b971b15b69cd591cd9059759f0f04ba5468a34b98915033debb3e87f048e8601712659d47d8687eb6be5e650068d88000000000000") preadv(r0, &(0x7f0000000480), 0x10000000000002a1, 0x0) ioctl$FICLONERANGE(r0, 0x4020940d, &(0x7f0000000000)={r0, 0x0, 0x7, 0xf9b5, 0x6}) [ 472.266593] binder: undelivered death notification, 0000000000000000 [ 472.355411] binder: BINDER_SET_CONTEXT_MGR already set [ 472.396746] binder: 24666:24669 ioctl 40046207 0 returned -16 12:34:10 executing program 0: syz_open_dev$sndctrl(&(0x7f0000000140)='/dev/snd/controlC#\x00', 0x0, 0x0) sched_setaffinity(0x0, 0x7, &(0x7f00000000c0)=0x9) r0 = perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0) fcntl$setflags(r0, 0x2, 0x1) getsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER_VALUE(0xffffffffffffffff, 0x84, 0x7c, &(0x7f00000001c0), &(0x7f0000000240)=0x8) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(0xffffffffffffffff, 0x84, 0x9, &(0x7f0000000280)={0x0, @in={{0x2, 0x4e23, @remote}}, 0xfffffffffffffff7, 0x0, 0x400}, 0x98) sendto$inet6(0xffffffffffffffff, &(0x7f00000004c0), 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) setsockopt$SO_BINDTODEVICE(0xffffffffffffffff, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x4) socket$inet6(0xa, 0x1000000000002, 0x0) r1 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x4, 0x0, &(0x7f0000000100)=[@enter_looper], 0x1, 0x0, &(0x7f0000000180)='T'}) r2 = gettid() timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, &(0x7f0000040000)) tkill(r2, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire={0x400c630e}], 0x0, 0x0, &(0x7f0000000040)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x400c630f}], 0x0, 0x0, &(0x7f0000000f4d)}) 12:34:10 executing program 2: perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f0000000180)=""/148, 0x13d}], 0x1, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000340)="696f001b66408225aaa3af068fffebb8a490c47dda6586f1b58895b94a78037dd3714e7198820a7a709e2d30d25e6d846cd5c62a648a598668a8263b752b0b622b115112b5ad8e0425c0b784bbdb89eb8f4da0dd73dd01fe35694c2f78600badf8a0e237dba40713bac9e053b41a9f62be5fbb928018aab5f7500bef51a2fd74d4fffb4a20a946733820bdc1b485afa417cdbcfdfbc54f58c9c3edffe240c36f4ab8a16613814e226b6d20d98010ab1ace49fa76dce337a5a5f1dcff9e5d533b12475e33b971b15b69cd591cd9059759f0f04ba5468a34b98915033debb3e87f048e8601712659d47d8687eb6be5e650068d88000000000000") preadv(r0, &(0x7f0000000480), 0x10000000000001ab, 0x0) msgget$private(0x0, 0x22) 12:34:10 executing program 5: preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f0000000180)=""/148, 0x13d}], 0x1, 0x0) r0 = openat$null(0xffffffffffffff9c, &(0x7f0000000240)='/dev/null\x00', 0x8002, 0x0) getsockopt$inet_sctp6_SCTP_GET_ASSOC_STATS(0xffffffffffffffff, 0x84, 0x70, &(0x7f0000000280)={0x0, @in6={{0xa, 0x4e23, 0xe6, @dev={0xfe, 0x80, [], 0x11}, 0xc0}}, [0xffffffff, 0x9, 0x2, 0x120, 0x7, 0x8, 0xfffffffffffffff7, 0x1, 0x5, 0xffffffff, 0x80, 0x5a1, 0x5, 0x1, 0x9]}, &(0x7f0000000380)=0x100) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r0, 0x84, 0x6f, &(0x7f0000000440)={r1, 0x74, &(0x7f00000003c0)=[@in6={0xa, 0x4e24, 0x1, @empty, 0xcb93}, @in={0x2, 0x4e24, @dev={0xac, 0x14, 0x14, 0xc}}, @in6={0xa, 0x4e23, 0x5, @dev={0xfe, 0x80, [], 0x16}, 0x4}, @in={0x2, 0x4e21, @multicast1}, @in6={0xa, 0x4e24, 0x80000001, @remote, 0x1}]}, &(0x7f0000000480)=0x10) r2 = syz_open_procfs(0x0, &(0x7f0000000080)='net/ipv6_route\x00') preadv(r2, &(0x7f0000000480), 0x10000000000002a1, 0x0) getsockopt$inet_mtu(r2, 0x0, 0xa, &(0x7f0000000000), &(0x7f0000000040)=0x4) socket$vsock_stream(0x28, 0x1, 0x0) bpf$BPF_GET_MAP_INFO(0xf, &(0x7f0000000500)={r2, 0x28, &(0x7f00000004c0)}, 0x10) getsockopt$inet_sctp_SCTP_PR_SUPPORTED(r2, 0x84, 0x71, &(0x7f00000000c0)={0x0, 0xff}, &(0x7f0000000100)=0x8) setsockopt$inet_sctp_SCTP_RTOINFO(r2, 0x84, 0x0, &(0x7f0000000140)={r3, 0x1f, 0x4, 0x4}, 0x10) 12:34:10 executing program 1: preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f0000000180)=""/148, 0x13d}], 0x1, 0x0) ioctl$sock_SIOCGPGRP(0xffffffffffffff9c, 0x8904, &(0x7f0000000000)) ioctl$sock_FIOGETOWN(0xffffffffffffffff, 0x8903, &(0x7f0000000040)=0x0) r1 = syz_open_procfs(r0, &(0x7f0000000440)="696f001b66408225aaa3af068fffebb8a490c47dda6586f1b58895b94a78037dd3714e7198820a7a709e2d30d25e6d846cd5c62a648a598668a8263b752b0b622b115112b5ad8e0425c0b784bbdb89eb8f4da0dd73dd01fe35694c2f78600badf8a0e237dba40713bac9e053b41a9f62be5fbb928018aab5f7500bef51a2fd74d4fffb4a20a946733820bdc1b485afa417cdbcfdfbc54f58c9c3edffe240c36f4ab8a16613814e226b6d20d98010ab1ace49fa76dce3de5e7287f30d614e36a2a13a0637a5a5f1dcff9e5d533b12475e33b971b15b69cd591cd9059759f0f04ba5468a34b98915033debb3e87f048e8601712659d47d8687eb6be5e650068d88000000000000793911afe9fd6f54470586dcd5fbca9842d69b7b4f41ab6f18707b5c927102f25e8005638835fd4562c752bfdf0c453de9c77445ac30c9057fbad4763a3991f76ff9ad6a69d3408f7a6c9784410e0b168ef2fdb4ea26e560933b8d6730639ae94139bc33ce47f4f09abb462f57c33d13de6f618146aa5c7a9ce7f6c695187534c7d9032b00") preadv(r1, &(0x7f0000000480), 0x10000000000002a1, 0x0) 12:34:10 executing program 3: socket$inet6(0xa, 0x0, 0x80000000) sched_setaffinity(0x0, 0x7, &(0x7f00000000c0)=0x9) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0) fcntl$setflags(0xffffffffffffffff, 0x2, 0x1) r0 = socket$inet6(0xa, 0x400000000001, 0x0) r1 = dup(r0) setsockopt$inet6_tcp_int(r1, 0x6, 0x12, &(0x7f0000000000)=0x7f, 0x4) bind$inet6(r0, &(0x7f0000000040)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) getsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER_VALUE(r0, 0x84, 0x7c, &(0x7f00000001c0)={0x0, 0x0, 0x6}, &(0x7f0000000240)=0x8) sendto$inet6(0xffffffffffffffff, &(0x7f00000004c0), 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x4) socket$inet6(0xa, 0x1000000000002, 0x0) r2 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000200)={0x4, 0x0, &(0x7f0000000100)=[@enter_looper], 0x1, 0x0, &(0x7f0000000180)='T'}) r3 = gettid() timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, &(0x7f0000040000)) tkill(r3, 0x1004000000016) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0xfffffffffffffced, 0x0, &(0x7f0000000040)}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x400c630f}], 0x0, 0x0, &(0x7f0000000f4d)}) 12:34:10 executing program 4: socket$inet6(0xa, 0x0, 0x80000000) sched_setaffinity(0x0, 0x7, &(0x7f00000000c0)=0x9) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0) fcntl$setflags(0xffffffffffffffff, 0x2, 0x1) r0 = socket$inet6(0xa, 0x400000000001, 0x0) r1 = dup(r0) setsockopt$inet6_tcp_int(r1, 0x6, 0x12, &(0x7f0000000000)=0x7f, 0x4) bind$inet6(r0, &(0x7f0000000040)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) getsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER_VALUE(r0, 0x84, 0x7c, &(0x7f00000001c0)={0x0, 0x0, 0x6}, &(0x7f0000000240)=0x8) sendto$inet6(r0, &(0x7f00000004c0), 0x0, 0x0, &(0x7f00008d4fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x4) socket$inet6(0xa, 0x1000000000002, 0x0) r2 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000200)={0x4, 0x0, &(0x7f0000000100)=[@enter_looper], 0x1, 0x0, &(0x7f0000000180)='T'}) r3 = gettid() timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, &(0x7f0000040000)) tkill(r3, 0x1004000000016) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0xfffffffffffffced, 0x0, &(0x7f0000000040)}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x400c630f}], 0x0, 0x0, &(0x7f0000000f4d)}) 12:34:10 executing program 1: r0 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000000)='/dev/snapshot\x00', 0xff, 0x0) preadv(r0, &(0x7f0000001380)=[{&(0x7f0000000240)=""/148, 0x94}], 0x1, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000340)="696f001b66408225aaa3af068fffebb8a490c47dda6586f1b58895b94a78037dd3714e7198820a7a709e2d30d25e6d846cd5c62a648a598668a8263b752b0b622b115112b5ad8e0425c0b784bbdb89eb8f4da0dd73dd01fe35694c2f78600badf8a0e237dba40713bac9e053b41a9f62be5fbb928018aab5f7500bef51a2fd74d4fffb4a20a946733820bdc1b485afa417cdbcfdfbc54f58c9c3edffe240c36f4ab8a16613814e226b6d20d98010ab1ace49fa76dce337a5a5f1dcff9e5d533b12475e33b971b15b69cd591cd9059759f0f04ba5468a34b98915033debb3e87f048e8601712659d47d8687eb6be5e650068d88000000000000") preadv(r1, &(0x7f0000000480), 0x10000000000002a1, 0x0) ioctl$EXT4_IOC_SWAP_BOOT(r1, 0x6611) ioctl$SNDRV_CTL_IOCTL_RAWMIDI_PREFER_SUBDEVICE(r0, 0x40045542, &(0x7f0000000040)=0x8000) 12:34:10 executing program 4: socket$inet6(0xa, 0x0, 0x80000000) sched_setaffinity(0x0, 0x7, &(0x7f00000000c0)=0x9) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0) fcntl$setflags(0xffffffffffffffff, 0x2, 0x1) r0 = socket$inet6(0xa, 0x400000000001, 0x0) r1 = dup(r0) setsockopt$inet6_tcp_int(r1, 0x6, 0x12, &(0x7f0000000000)=0x7f, 0x4) bind$inet6(r0, &(0x7f0000000040)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) getsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER_VALUE(r0, 0x84, 0x7c, &(0x7f00000001c0)={0x0, 0x0, 0x6}, &(0x7f0000000240)=0x8) sendto$inet6(r0, &(0x7f00000004c0), 0x0, 0x0, &(0x7f00008d4fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x4) socket$inet6(0xa, 0x1000000000002, 0x0) r2 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000200)={0x4, 0x0, &(0x7f0000000100)=[@enter_looper], 0x1, 0x0, &(0x7f0000000180)='T'}) r3 = gettid() timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, &(0x7f0000040000)) tkill(r3, 0x1004000000016) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0xfffffffffffffced, 0x0, &(0x7f0000000040)}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x400c630f}], 0x0, 0x0, &(0x7f0000000f4d)}) [ 472.866574] binder: BINDER_SET_CONTEXT_MGR already set 12:34:10 executing program 2: perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f0000000180)=""/148, 0x13d}], 0x1, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000340)="696f001b66408225aaa3af068fffebb8a490c47dda6586f1b58895b94a78037dd3714e7198820a7a709e2d30d25e6d846cd5c62a648a598668a8263b752b0b622b115112b5ad8e0425c0b784bbdb89eb8f4da0dd73dd01fe35694c2f78600badf8a0e237dba40713bac9e053b41a9f62be5fbb928018aab5f7500bef51a2fd74d4fffb4a20a946733820bdc1b485afa417cdbcfdfbc54f58c9c3edffe240c36f4ab8a16613814e226b6d20d98010ab1ace49fa76dce337a5a5f1dcff9e5d533b12475e33b971b15b69cd591cd9059759f0f04ba5468a34b98915033debb3e87f048e8601712659d47d8687eb6be5e650068d88000000000000") preadv(r0, &(0x7f0000000480), 0x1000000000000005, 0x0) msgget$private(0x0, 0x22) 12:34:10 executing program 3: syz_open_dev$sndctrl(&(0x7f0000000140)='/dev/snd/controlC#\x00', 0x0, 0x0) sched_setaffinity(0x0, 0x7, &(0x7f00000000c0)=0x9) r0 = perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0) fcntl$setflags(r0, 0x2, 0x1) getsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER_VALUE(0xffffffffffffffff, 0x84, 0x7c, &(0x7f00000001c0), &(0x7f0000000240)=0x8) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(0xffffffffffffffff, 0x84, 0x9, &(0x7f0000000280)={0x0, @in={{0x2, 0x4e23, @remote}}, 0xfffffffffffffff7, 0x0, 0x400}, 0x98) sendto$inet6(0xffffffffffffffff, &(0x7f00000004c0), 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) setsockopt$SO_BINDTODEVICE(0xffffffffffffffff, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x4) socket$inet6(0xa, 0x1000000000002, 0x0) r1 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x4, 0x0, &(0x7f0000000100)=[@enter_looper], 0x1, 0x0, &(0x7f0000000180)='T'}) r2 = gettid() timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, &(0x7f0000040000)) tkill(r2, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0xfffffffffffffced, 0x0, &(0x7f0000000040)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x400c630f}], 0x0, 0x0, &(0x7f0000000f4d)}) [ 472.922609] binder: 24691:24692 ioctl 40046207 0 returned -16 [ 472.970437] binder: 24691:24692 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 12:34:10 executing program 5: preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f0000000180)=""/148, 0x13d}], 0x1, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000340)="696f001b66408225aaa3af068fffebb8a490c47dda6586f1b58895b94a78037dd3714e7198820a7a709e2d30d25e6d846cd5c62a648a598668a8263b752b0b622b115112b5ad8e0425c0b784bbdb89eb8f4da0dd73dd01fe35694c2f78600badf8a0e237dba40713bac9e053b41a9f62be5fbb928018aab5f7500bef51a2fd74d4fffb4a20a946733820bdc1b485afa417cdbcfdfbc54f58c9c3edffe240c36f4ab8a16613814e226b6d20d98010ab1ace49fa76dce337a5a5f1dcff9e5d533b12475e33b971b15b69cd591cd9059759f0f04ba5468a34b98915033debb3e87f048e8601712659d47d8687eb6be5e650068d88000000000000") ioctl$ASHMEM_GET_PIN_STATUS(r0, 0x7709, 0x0) preadv(r0, &(0x7f0000000480), 0x10000000000002a1, 0x0) 12:34:10 executing program 1: preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f0000000180)=""/148, 0x13d}], 0x1, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000340)="696f001b66408225aaa3af068fffebb8a490c47dda6586f1b58895b94a78037dd3714e7198820a7a709e2d30d25e6d846cd5c62a648a598668a8263b752b0b622b115112b5ad8e0425c0b784bbdb89eb8f4da0dd73dd01fe35694c2f78600badf8a0e237dba40713bac9e053b41a9f62be5fbb928018aab5f7500bef51a2fd74d4fffb4a20a946733820bdc1b485afa417cdbcfdfbc54f58c9c3edffe240c36f4ab8a16613814e226b6d20d98010ab1ace49fa76dce337a5a5f1dcff9e5d533b12475e33b971b15b69cd591cd9059759f0f04ba5468a34b98915033debb3e87f048e8601712659d47d8687eb6be5e650068d88000000000000") preadv(r0, &(0x7f0000000480), 0x10000000000002a1, 0x0) ioctl$DRM_IOCTL_FREE_BUFS(r0, 0x4010641a, &(0x7f0000000040)={0x6, &(0x7f0000000000)=[0x6, 0x1, 0xbd, 0xffffffff, 0x7, 0x3f]}) 12:34:10 executing program 0: syz_open_dev$sndctrl(&(0x7f0000000140)='/dev/snd/controlC#\x00', 0x0, 0x0) sched_setaffinity(0x0, 0x7, &(0x7f00000000c0)=0x9) r0 = perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0) fcntl$setflags(r0, 0x2, 0x1) getsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER_VALUE(0xffffffffffffffff, 0x84, 0x7c, &(0x7f00000001c0), &(0x7f0000000240)=0x8) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(0xffffffffffffffff, 0x84, 0x9, &(0x7f0000000280)={0x0, @in={{0x2, 0x4e23, @remote}}, 0xfffffffffffffff7, 0x0, 0x400}, 0x98) sendto$inet6(0xffffffffffffffff, &(0x7f00000004c0), 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) setsockopt$SO_BINDTODEVICE(0xffffffffffffffff, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x4) socket$inet6(0xa, 0x1000000000002, 0x0) r1 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x4, 0x0, &(0x7f0000000100)=[@enter_looper], 0x1, 0x0, &(0x7f0000000180)='T'}) r2 = gettid() timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, &(0x7f0000040000)) tkill(r2, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire={0x400c630e}], 0x0, 0x0, &(0x7f0000000040)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x400c630f}], 0x0, 0x0, &(0x7f0000000f4d)}) [ 473.019488] binder: 24691:24700 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 12:34:10 executing program 2: perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f0000000180)=""/148, 0x13d}], 0x1, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000340)="696f001b66408225aaa3af068fffebb8a490c47dda6586f1b58895b94a78037dd3714e7198820a7a709e2d30d25e6d846cd5c62a648a598668a8263b752b0b622b115112b5ad8e0425c0b784bbdb89eb8f4da0dd73dd01fe35694c2f78600badf8a0e237dba40713bac9e053b41a9f62be5fbb928018aab5f7500bef51a2fd74d4fffb4a20a946733820bdc1b485afa417cdbcfdfbc54f58c9c3edffe240c36f4ab8a16613814e226b6d20d98010ab1ace49fa76dce337a5a5f1dcff9e5d533b12475e33b971b15b69cd591cd9059759f0f04ba5468a34b98915033debb3e87f048e8601712659d47d8687eb6be5e650068d88000000000000") preadv(r0, &(0x7f0000000480), 0x1000000000000046, 0x0) msgget$private(0x0, 0x22) 12:34:10 executing program 4: socket$inet6(0xa, 0x0, 0x80000000) sched_setaffinity(0x0, 0x7, &(0x7f00000000c0)=0x9) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0) fcntl$setflags(0xffffffffffffffff, 0x2, 0x1) r0 = socket$inet6(0xa, 0x400000000001, 0x0) r1 = dup(r0) setsockopt$inet6_tcp_int(r1, 0x6, 0x12, &(0x7f0000000000)=0x7f, 0x4) bind$inet6(r0, &(0x7f0000000040)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) getsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER_VALUE(r0, 0x84, 0x7c, &(0x7f00000001c0)={0x0, 0x0, 0x6}, &(0x7f0000000240)=0x8) sendto$inet6(r0, &(0x7f00000004c0), 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x0, 0x0, @loopback}, 0x1c) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x4) socket$inet6(0xa, 0x1000000000002, 0x0) r2 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000200)={0x4, 0x0, &(0x7f0000000100)=[@enter_looper], 0x1, 0x0, &(0x7f0000000180)='T'}) r3 = gettid() timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, &(0x7f0000040000)) tkill(r3, 0x1004000000016) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0xfffffffffffffced, 0x0, &(0x7f0000000040)}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x400c630f}], 0x0, 0x0, &(0x7f0000000f4d)}) 12:34:10 executing program 3: socket$inet6(0xa, 0x0, 0x80000000) sched_setaffinity(0x0, 0x7, &(0x7f00000000c0)=0x9) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0) fcntl$setflags(0xffffffffffffffff, 0x2, 0x1) r0 = socket$inet6(0xa, 0x400000000001, 0x0) r1 = dup(r0) setsockopt$inet6_tcp_int(r1, 0x6, 0x12, &(0x7f0000000000)=0x7f, 0x4) bind$inet6(r0, &(0x7f0000000040)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) getsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER_VALUE(r0, 0x84, 0x7c, &(0x7f00000001c0), &(0x7f0000000240)=0x8) sendto$inet6(r0, &(0x7f00000004c0), 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x4) socket$inet6(0xa, 0x1000000000002, 0x0) r2 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000200)={0x4, 0x0, &(0x7f0000000100)=[@enter_looper], 0x1, 0x0, &(0x7f0000000180)='T'}) r3 = gettid() timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, &(0x7f0000040000)) tkill(r3, 0x1004000000016) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0xfffffffffffffced, 0x0, &(0x7f0000000040)}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x400c630f}], 0x0, 0x0, &(0x7f0000000f4d)}) 12:34:10 executing program 5: preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f0000000180)=""/148, 0x13d}], 0x10000206, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000340)="696f001b66408225aaa3af068fffebb8a490c47dda6586f1b58895b94a78037dd3714e7198820a7a709e2d30d25e6d846cd5c62a648a598668a8263b752b0b622b115112b5ad8e0425c0b784bbdb89eb8f4da0dd73dd01fe35694c2f78600badf8a0e237dba40713bac9e053b41a9f62be5fbb928018aab5f7500bef51a2fd74d4fffb4a20a946733820bdc1b485afa417cdbcfdfbc54f58c9c3edffe240c36f4ab8a16613814e226b6d20d98010ab1ace49fa76dce337a5a5f1dcff9e5d533b12475e33b971b15b69cd591cd9059759f0f04ba5468a34b98915033debb3e87f048e8601712659d47d8687eb6be5e650068d88000000000000") ioctl$sock_SIOCGPGRP(r0, 0x8904, &(0x7f0000000000)=0x0) r2 = gettid() rt_tgsigqueueinfo(r1, r2, 0x25, &(0x7f0000000040)={0x3, 0x5, 0x5, 0x400}) getsockopt$bt_BT_SECURITY(r0, 0x112, 0x4, &(0x7f0000000080), 0x2) preadv(r0, &(0x7f0000000480), 0x10000000000002a1, 0x0) [ 473.243427] binder: 24720:24735 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 473.251224] binder: 24720:24735 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 12:34:10 executing program 1: preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f0000000180)=""/148, 0x13d}], 0x1, 0x0) ioctl$TIOCGSID(0xffffffffffffff9c, 0x5429, &(0x7f0000000040)) ioctl$sock_SIOCGPGRP(0xffffffffffffffff, 0x8904, &(0x7f0000000440)=0x0) openat$random(0xffffffffffffff9c, &(0x7f0000000080)='/dev/urandom\x00', 0x10000, 0x0) r1 = syz_open_procfs(r0, &(0x7f0000000240)="696f001b66408225aaa3af068fffebb8a490c47dda6586f1b58895b94a78037dd3714e7198820a7a709e2d30d25e6d846cd5c62a648a598668a8263b752b0b622b115112b5ad8e0425c0b784bbdb89eb8f4da0dd73dd01fe35694c2f78600badf8a0e237dba40713bac9e053b41a9f62be5fbb928018aab5f7500bef51a2fd74d4fffb4a20a946733820bdc1b485afa417cdbcfdfbc54f58c9c3edffe240c36f4ab8a16613814e226b6d20d98010ab1ace49fa76dce337a5a5f1dcff9e5d533b12475e33b971b15b69cd591cd9059759f0f04ba5468a34b98915033debb3e87f048e8601712659d47d8687eb6be5e650068d88000000000000") ioctl$FS_IOC_FSGETXATTR(r1, 0x801c581f, &(0x7f0000000000)={0x8001, 0x7ff, 0x1000, 0x7fffffff, 0x7}) preadv(r1, &(0x7f0000000080), 0x10000000000001a8, 0x0) [ 473.294550] binder: BINDER_SET_CONTEXT_MGR already set 12:34:10 executing program 2: perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f0000000180)=""/148, 0x13d}], 0x1, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000340)="696f001b66408225aaa3af068fffebb8a490c47dda6586f1b58895b94a78037dd3714e7198820a7a709e2d30d25e6d846cd5c62a648a598668a8263b752b0b622b115112b5ad8e0425c0b784bbdb89eb8f4da0dd73dd01fe35694c2f78600badf8a0e237dba40713bac9e053b41a9f62be5fbb928018aab5f7500bef51a2fd74d4fffb4a20a946733820bdc1b485afa417cdbcfdfbc54f58c9c3edffe240c36f4ab8a16613814e226b6d20d98010ab1ace49fa76dce337a5a5f1dcff9e5d533b12475e33b971b15b69cd591cd9059759f0f04ba5468a34b98915033debb3e87f048e8601712659d47d8687eb6be5e650068d88000000000000") preadv(r0, &(0x7f0000000480), 0x100000000000021a, 0x0) msgget$private(0x0, 0x22) [ 473.316039] binder: 24728:24729 ioctl 40046207 0 returned -16 [ 473.322825] binder: BINDER_SET_CONTEXT_MGR already set [ 473.334051] binder: 24732:24733 ioctl 40046207 0 returned -16 12:34:10 executing program 1: preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f0000000180)=""/148, 0x13d}], 0x1, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000340)="696f001b66408225aaa3af068fffebb8a490c47dda6586f1b58895b94a78037dd3714e7198820a7a709e2d30d25e6d846cd5c62a648a598668a8263b752b0b622b115112b5ad8e0425c0b784bbdb89eb8f4da0dd73dd01fe35694c2f78600badf8a0e237dba40713bac9e053b41a9f62be5fbb928018aab5f7500bef51a2fd74d4fffb4a20a946733820bdc1b485afa417cdbcfdfbc54f58c9c3edffe240c36f4ab8a16613814e226b6d20d98010ab1ace49fa76dce337a5a5f1dcff9e5d533b12475e33b971b15b69cd591cd9059759f0f04ba5468a34b98915033debb3e87f048e8601712659d47d8687eb6be5e650068d88000000000000") preadv(r0, &(0x7f0000000480), 0x10000000000002a1, 0x0) getsockopt$inet_sctp_SCTP_GET_LOCAL_ADDRS(r0, 0x84, 0x6d, &(0x7f0000000240)=ANY=[@ANYRES32=0x0, @ANYBLOB="b2016c6a0f173a011d12e6c6acf8274a18ca0d00e707f150a6694eedd9fd3c395bd91536ffaec9d1800b250bcc8565b30154a73f8f35c05f9df5344034886ee8866950ace5a7cf22d73ee24793d13740005b89fdbd45edaef6712fd3ad09ad4fb472261fe6de740f00df2dff78f9062145c3897cc315b82159aba05aa1c70366db6cf2dd60aced6674547f7c5d1dd53d69c8c65e3bff66f3656724e61a95a75aaf8a4e23eae5573cd9fbef7198ed358b483998bac2035f0214a56182ff"], &(0x7f00000000c0)=0xba) setsockopt$inet_sctp_SCTP_STREAM_SCHEDULER(r0, 0x84, 0x7b, &(0x7f0000000100)={r1, 0x100}, 0x8) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000040)={0x0, 0x18, 0xfa00, {0x1, &(0x7f0000000000)={0xffffffffffffffff}, 0x13f, 0x1000}}, 0x20) write$RDMA_USER_CM_CMD_DISCONNECT(r0, &(0x7f0000000080)={0xa, 0x4, 0xfa00, {r2}}, 0xc) 12:34:10 executing program 5: preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f0000000180)=""/148, 0x13d}], 0x1, 0x0) r0 = fanotify_init(0x0, 0x1) open_by_handle_at(r0, &(0x7f00000014c0)={0x97, 0x98c, "d55a1213cac5c4bad87119bcfbe090d30972366b77fc06f35ea421d8556c0f76bf1c73bac791703d030109ae8098ac2d698f27fe046780414d354fb2bbf6863139e5d37a2fbb61ee28bbe71a446b39bf5c79d8d3659a63d60151deddac638163f05116241697cc321a83788fa9159253ca826f7508ec3ad4185d1c8d33f5cb75eca37768015e70cf691186d2001f89"}, 0x400000) r1 = syz_open_procfs(0x0, &(0x7f0000000000)='net/ip_vs_stats_percpu\x00') pipe(&(0x7f0000001480)) openat$vcs(0xffffffffffffff9c, &(0x7f0000001440)='/dev/vcs\x00', 0x200, 0x0) preadv(r1, &(0x7f0000000480), 0x10000000000002a1, 0x0) preadv(r1, &(0x7f00000013c0)=[{&(0x7f0000000040)=""/231, 0xe7}, {&(0x7f0000000240)=""/152, 0x98}, {&(0x7f0000000140)=""/23, 0x17}, {&(0x7f0000000300)=""/4096, 0x1000}, {&(0x7f0000001300)=""/108, 0x6c}], 0x5, 0x0) 12:34:10 executing program 3: socket$inet6(0xa, 0x0, 0x80000000) sched_setaffinity(0x0, 0x7, &(0x7f00000000c0)=0x9) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0) fcntl$setflags(0xffffffffffffffff, 0x2, 0x1) r0 = socket$inet6(0xa, 0x400000000001, 0x0) r1 = dup(r0) setsockopt$inet6_tcp_int(r1, 0x6, 0x12, &(0x7f0000000000)=0x7f, 0x4) bind$inet6(r0, &(0x7f0000000040)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) getsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER_VALUE(r0, 0x84, 0x7c, &(0x7f00000001c0)={0x0, 0x0, 0x6}, &(0x7f0000000240)=0x8) sendto$inet6(r0, &(0x7f00000004c0), 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x4) socket$inet6(0xa, 0x1000000000002, 0x0) r2 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000200)={0x4, 0x0, &(0x7f0000000100)=[@enter_looper], 0x1, 0x0, &(0x7f0000000180)='T'}) r3 = gettid() timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, &(0x7f0000040000)) tkill(r3, 0x1004000000016) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0xfffffffffffffced, 0x0, &(0x7f0000000040)}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x400c630f}], 0x0, 0x0, &(0x7f0000000f4d)}) 12:34:10 executing program 5: preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f0000000180)=""/148, 0x13d}], 0x1, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000340)="696f001b66408225aaa3af068fffebb8a490c47dda6586f1b58895b94a78037dd3714e7198820a7a709e2d30d25e6d846cd5c62a648a598668a8263b752b0b622b115112b5ad8e0425c0b784bbdb89eb8f4da0dd73dd01fe35694c2f78600badf8a0e237dba40713bac9e053b41a9f62be5fbb928018aab5f7500bef51a2fd74d4fffb4a20a946733820bdc1b485afa417cdbcfdfbc54f58c9c3edffe240c36f4ab8a16613814e226b6d20d98010ab1ace49fa76dce337a5a5f1dcff9e5d533b12475e33b971b15b69cd591cd9059759f0f04ba5468a34b98915033debb3e87f048e8601712659d47d8687eb6be5e650068d88000000000000") preadv(r0, &(0x7f0000000480), 0xfb0b9adfbc4d7ea, 0x0) ioctl$SCSI_IOCTL_SEND_COMMAND(r0, 0x1, &(0x7f0000000040)={0x2e, 0x6, 0x55, "514dc1b1ca94158d82ec1fae969d3d3246c3755730c6c3d591976e813db73f43dde12684d921079cb2f3802bb02d"}) ioctl$IOC_PR_PREEMPT_ABORT(r0, 0x401870cc, &(0x7f0000000000)={0x100, 0x100, 0xfffffffffffffffb, 0x200}) 12:34:10 executing program 1: io_setup(0x7fffffff, &(0x7f0000000000)=0x0) r1 = bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f0000000040)={0xffffffffffffffff, 0x5, 0x10}, 0xc) r2 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000240)='/dev/rtc0\x00', 0x1c1040, 0x0) r3 = eventfd2(0xac, 0x801) r4 = syz_open_dev$sg(&(0x7f0000000480)='/dev/sg#\x00', 0x7fffffff, 0x800) r5 = openat$cgroup_subtree(0xffffffffffffffff, &(0x7f0000000600)='cgroup.subtree_control\x00', 0x2, 0x0) r6 = syz_open_dev$sndpcmc(&(0x7f0000000740)='/dev/snd/pcmC#D#c\x00', 0xffff, 0x240) r7 = eventfd(0x6) r8 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000840)='/dev/ppp\x00', 0x480200, 0x0) r9 = openat(0xffffffffffffff9c, &(0x7f00000008c0)='./file0\x00', 0x800, 0x1) r10 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000940)='/proc/sys/net/ipv4/vs/conn_reuse_mode\x00', 0x2, 0x0) ioctl$KVM_CREATE_DEVICE(0xffffffffffffff9c, 0xc00caee0, &(0x7f00000009c0)={0x1, 0xffffffffffffff9c, 0x1}) r12 = syz_open_dev$vcsn(&(0x7f0000000a00)='/dev/vcs#\x00', 0x40, 0x1) r13 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000d80)='/dev/dsp\x00', 0x10000, 0x0) r14 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000ac0)='/dev/ppp\x00', 0x400100, 0x0) r15 = socket$inet_udp(0x2, 0x2, 0x0) r16 = openat$pfkey(0xffffffffffffff9c, &(0x7f0000000b40)='/proc/self/net/pfkey\x00', 0x10242, 0x0) r17 = semget$private(0x0, 0x0, 0x2) semctl$IPC_RMID(r17, 0x0, 0x0) r18 = accept4$vsock_stream(0xffffffffffffffff, &(0x7f0000000bc0)={0x28, 0x0, 0xffffffff, @host}, 0x10, 0x80000) r19 = syz_open_dev$sndpcmc(&(0x7f0000000c80)='/dev/snd/pcmC#D#c\x00', 0x2, 0x4000) io_submit(r0, 0xa, &(0x7f0000000d00)=[&(0x7f0000000280)={0x0, 0x0, 0x0, 0x1, 0x3, r1, &(0x7f0000000080)="b51e3c98257b9596480547a3ba6b3b5255638fc2799170b5288639923bfb84ebfbd64cfda2b05f6d7bad413f9c37b69d55cf87df998946fe2a37c3be4852d5d69449a7db5edbee211849470a4aa46e7844e7e2bdd76dc00872e8bece77993674910d261e7d7fe9fb65a5ede0bebc75c88acc13350fbd54c7a2ec30eed5e198d539d448d8363017556ff1e76efb604ea1cac98593ab4e0c6b8ac379736c9d4e0c3ffe331eea97c7a8bb5b554a0b9395e1da2c33b8cb42f3bd1fa1958d30bf4389173fbabf969c201b197e43e6bf10da9d6436540f33b2f8fc1221c0188bfdb5a419c8c3e96ddb829fe7e0f18e7967ce6282d6076db13b2c", 0xf7, 0xfffffffffffffffa, 0x0, 0x2, r2}, &(0x7f0000000440)={0x0, 0x0, 0x0, 0x7, 0x3, r3, &(0x7f00000002c0)="83823941113c92e7435cae1d7c4a4df6d2f8639647e531291465b2a1c2af9185e13738f12421c613188b55ca7a44ca4c95be2c140097a8a81d6c6cce77a8197c0ea4e7d096e00d7510b8fd9fbc5c5b034d456b465184e8dadee446116b824381978ca857363c4d65f76fda8e4e19c3d0a7b404fa", 0x74, 0x1f, 0x0, 0x1}, &(0x7f00000005c0)={0x0, 0x0, 0x0, 0x8, 0x8, r4, &(0x7f00000004c0)="4a91ac012512fb6f97108cb26c7872084a7258273ab31248585a7f11871f4890333478f5656cb8482e607c3f9e4e0f796163c191019d2075f36289d211d952d86f0f17c156bbe2bce6f8c4d8bfe3bc582fa31ac5f09723e3456062925cca1e1dda05ece47a2e85e29f7d7b3f27273c0ab2bfda19ba0a28007d3c2dddeab2bfe7598883065234ab032b5932f21e7bf847a956e0eb29aa5cccce392a686acd84c7a81fded48dc6272fe23c86d13be319f158c94ef5161ebf03554b43224c11486e9bf48ce33a9dd78b69718948a62331b91da6b42a1ee0737aca6f808358af9cdd", 0xe0, 0x6e, 0x0, 0x3, 0xffffffffffffff9c}, &(0x7f0000000780)={0x0, 0x0, 0x0, 0x3, 0x6, r5, &(0x7f0000000640)="27524b3b5701f84c05d3290c1e80b68366f4da5b4213c50601742067d9c0aa143cdebae5021eb3e21ef984f3bc979d7233ac14500380f1e9bcd18aa9e2a45a3c90f54acddf143213041f5f42989661864fd280ed5803d7007708be7ff496f694da6ed4244a1ce0588122abe7c7d3c2f4cdb0cee80a0781875d6dcda08f0a6c3495e2866c465490098b7db4ff0b164e90049933c7f85643594461cb897e8d7ccea8426c275d9803c78defeae7eeddebbd6408eafb188cce447f5a4c2cef3c033d5cc3789857001591de2b65a9c065ebe54282b632016ed24ea3b25d0cd5d27bcc373a0b551865", 0xe6, 0x1, 0x0, 0x1, r6}, &(0x7f0000000880)={0x0, 0x0, 0x0, 0x2, 0x40, r7, &(0x7f00000007c0)="34dfb20d5230eb38c7e88c660499490154676c8f41670ec4d80d856eeafccb790ea8775e3cc6d88713ddcc9aafefc6160335fc121e3e009952bb8ff6fd892cd64e3a5c4823e2270d8874e47c5cef1364b2e38130873e094fbb1422e66ca2765f6a0941f478fb083bea331c87303868fdc7fcbbdd19f06e2ec6977fa7", 0x7c, 0x0, 0x0, 0x2, r8}, &(0x7f0000000980)={0x0, 0x0, 0x0, 0x2, 0x2, r9, &(0x7f0000000900)="6fddb80a4984a7828936a2fbde5716cda199d53c426ec8dd249019ee6feb94b661352cc70541c22e55537e285cb861e46821e69ec953a0", 0x37, 0x101, 0x0, 0x0, r10}, &(0x7f0000000a40)={0x0, 0x0, 0x0, 0x5, 0x1, r11, &(0x7f00000013c0)="02e3c770d6a062e5c800e1ce08ca85ad16086d943a44c05ab69ae3f76860fd09aa8e6ff9622798d1056d090940b229fc6ee4105b2427ec9ef7e6f8f5d531aa77477bc8d9668e0262cf278f22f615d9d34a5af13253462e76fa240520859458effcfe8b166e3be7ff831f07222224cf52a69d81742dfe2310645ebb144ebb393cdfef9d38017538d248ac185adfc611f182391ed8430b0668bd23adebfb7a8705d181dcc7bdaf8870c741775e4067b752481194a2d691c0dd8313f529dec8c022c7e93bdfaaf3081f5bafb879860b670c4bace3d04dd09e2589420025ae2bb93d874ffd966aea3e552661463efce455c37c11f75b040b99d46341de7cf59a75c35333d10db6bcc933aecae5ef5eb38f22e7d7b6423d0eda6e3be16581b93e5d21901b6ec52cd8c6529a8bc2589c7e9d9f6f1974f75f16f2b73414dd10449e144dafa36acbf465538c2e9e854b7209115c859aabb4112d768fc9d4c0d9234a7c45638cc200f62b53b3e4e520d09a933dcf4d38c4649e8119b499320fcd39255acc64c4db820e7fbab20762e7e8ea9cf6958402d1c54689e91d4ea59c2cbf92aa92220a772727fe20284f29c6234a6683c9fa497ce502a8e3a4f7f879df5b0764722f620202d19d283f85654ead43bb6416299e636045fc4f5d35de8e0881b80eac942d5b1467e06978b694e5f98a081572468c19df6f0cc976c4031a5188818bd74cb3b3f3395c226775fc161bbf646253e7e44dc07ca2517f95e4f7adf49f75bd773b56de9ff56fbfd65cc7044b0ddebf413bc8f4fb97030f0c0942275312cebf5ac7e023cebae1db969b79995aa24987b8d074e51172e11c044bae952837e413404c0a825574133e90aba2c9a3a9f7924ed021fd44b685094ec8dc8930979de85ebc32268c36521e21a33c4f806222c8b0751f00a9fa1db199ff58bc1a95143e104cdb385348ecb944ddc792429865f5ed133cca6e56751a4d544a4bb8a35580c78660ea21e9a766c4fe1a9c042b5a0a10b1d62f01f4ad8d9d41799c697cf74405c6d664d57dce980a4e396ecf92a991e5b2069e206d49279c6380e174120ee6f32353d68ff77c91b83c625ab93fd3d4e8e0568a84f93aa57b6b26f5e37f872a3c22c3f8b485c1ac2e4d5d7db85bacc06a5a0ba3af3e1bf902d6827630044b660e3fd232de3aec297053473f0ba8d54bd05223e52e678e441d74186f33d0659dbb8add2ba2dba590e7ea3a0c48b75acbebf68f479030e24e1ff62c5c0700cb88aebc964dd50b09209410207908ce370d02d2b4913d7eee8733feb381ee94afd16c1b401466fd874c4f1f4acbc62bf19ad8bc01ed66c9d8b58d04b6ebddbedec981b01332f6c10a5aff6e24e4dff673a3b98ceafe6b3a9d4099d4cc53c15ff7bfceec33e4afbca7b4ef8529643860127b46d78c1ceebf9a1d3ea67af8007925cb9c5cda2e9d409698506287cb47f8dc08307008557f729c748a311cbe621db10336ebe32727ad39bf0ac9186ab04896b1c8a08309f403e2f78bbd56de36c70740eec56f738419b6d18de7d00d7e467692f2281f413fa7b1b12d8ba4cfc0978022fe83455c4150cf03413390d7d496244d81084a5acdf35a3b74de972eacbd74d10642d52f3dfff0b9abe7fa776ae6bf0dc476b092e4d81a1529d737738bd68d92d4e2f5824c1e5a8422ac980d23371c68a2e000528648198b97feb47202aa3f31e6e23e56627908686030ce5995d5512d99a3ad58e97ccb5822dcf7557b7cded25febb37734be58bfe3d6234db6e327a734eeecdddecc6d41b3484243f94d9e22c82110df65da78dffa0638bc91666e13dfd9274884125be3ed9bae3f6e9c78a38f905a293f26d96172a4cd20e9bc28c2b50c1ae51bd53ad700846582e7a78c9b789f055986c39cec45c42b2571e059ecf3f56490e1cd4053350dc8451f8d2c6ab545ffae38bb3969ed8fe55d0f936b6902540dca567bf64a6f682973575bc061704500ffdf8fa08989d15c4f8a587ede2c12e5846d58f8f28f2d5d2b7bb54cce4c96a98fcdd1028b697116431c61225de4f8c824eada6277f93a1cccde89d5d7f3800ca32d2cd80076d20afc295d752b28752ace8645c7285f8c8cd65a605d00e930f18363f29d606842550024b389e0a4147df0f523458cbe975712e266b494c2750352da6619bd60fe13096febe776dfc90f76a93d9005e4b1f2167b702ff0c4f30c1e0a8e6c5b51127f8d35e23f322f7a8fc664dd6673353ff88f80e07cf6aee9f1c9a1c2892a5d29e99ee2f923d27304bcf41821e0da93c0bd2c9e96abf549ce2301d0776591b5bcd80f3dfb965ddabe9b7e21d530c39b0a4e487bc197a154e67b3577903b011387d2d9bced0c8901f44ff502c1872b47dfb0921792996da49c86699e242a86d9603adc71f2473ff76bd7e8367e832f160d41d7db9c8321e12a540a75b9dea4ab8912f06202d657df3edad99788674cde0d01b7b99e2e7c6dfda467ce77fe720f5904f6bc1a6d22769ac2d65b7e08c637a0b6e1d6b2455ec39a97c90e50a7683956a57a4afecf5675c3c7899af4f1b1bc147016b3ae1dce591d2071efb1a6f035b20b87ebcc9dc993714bf59bd5e68f374967fa0914b49f1ee2f1c385bd9c4a49588caf72a888b0e59bc7cf960f033d729f6de3eb811cebf483e322ce9000dbe1cc7c4f920caa8bcf7117a7142c5a532c64fc47acb69f25ee35e8dba4fb36a368692a3705a3834dae6fcb970ab2673b86780ab98148898528074dd5b89faeccf072042172707e8c62082c6737df775f94a2a55a699e5cfd85f61a10a470e770bffc6b506b46058675eff4ab866c044d0cd4fd694b2263479ce03db9693712f01e3b5d8b10387d5b8f538212c0c7698e9f6d857fac09e9b9b820298fa75e0971374ee4d343f90f29568cbf81a471c8a0a3552283031fd5c2d68166f5b673f46883c6119a7329da454483eba7b6b6da057dc28865e749cc87f984f4afe838354fd18d498cae92f459b39bd2e7e7ca495ae1a06b6e16273c4a26e8eea136b0cd643c86a8dccfd3f8fbb503f98d5f5f96e48dd3e2f8c0c2fc6e7edb9021368087ac65acf1322aebe9ce9f7dfc4cb90a6f6be261f8ab18819a31369f396d5a94dcc4657017edb3a41bfc89e5fb65f7997a428cad9ea2b81e66c85b8509fdde9c712d1c6db2e356fffc37bb21743ce5d433827a0d45e61102e85a6cf1246b3bc16d17d5deaeb95658ac653bebd5407bf06359d0cecd741ea9a521f815bd2036ea4e42eed949f771f448e0259009600d2a8d207e7925bf70c71af153ab96353b82157329b5458586da76b500b15bfd7d1ec0d375857eca39a2a54842e9ebba1eb429e95f81b94580556b4322bc5b502df0ff6def886f203ef3f0b8f34b64e1378e3382b1861bb56de57db10eed72899628618978ad9c5c8beca15219d575e93e0650cc97985acdc55d8b90e0cad02bf71d0fbef6cca7fb46de8a07b1904181095555b9c46f106a53a0327fcdfd6fd07c5ed14f64d254036ecf90107f6d07caf6f8755b0e09fd31af62aa3539722d1d2939f09e9118b55e9af524ea6ca4fc18371b779ceba5454a89944f97c938882e1da3fcf490e0982f02dfded46c88c18edf2abd53cbd4f040e59c360729247cf4ffad4ae2e59434b295cef1ced63fa0add1f59b4d1ceac99105764d90e048561ca140d02148271e91a8e92113953d6bc4358f0fde0ed2118e03b6fd349bc4fbab818742c957e501654e6a0e24644c4b03ae376137bcd45cb21a4e1c4744b2cc0852ff2fd6d8d40a1fd542a8543274e328fc8a90e5508a470f856632e6d6057d2ba0180ccd8e1ffe421692e58515d57ab9642c6ce14c4058558e3b373ea28477284c53b0365a2fdd27918feb5868bb9fa58049c20ed50caf23d667cb451479fa67298ddd022ef001bdf3acd12810ca93649eb0e6554a824adf4a83c4c36869f0b523a7875afde4505ecb23c6863602a5e2c3fa676264a7cd4bd41edc67b968eeb928596c49016a77a85f4b65918d33215a9171da675097788ab29105adef4b7c86820478165a61d0db93eed0ba8104b392dd0e57a600f6e075ea544f5cff6b7de6b598e8dfaddc472f37a8d7f54a58e53196d0ca31a3a0dc7359974a34b46dad592d3c57e0b0e293cc7a343f70f2dae7088b6773598b1d5990fa4bf8a8068e726047bc5e056bce5581b22aae74cfc1bf9be0c9026c4f48647f9781d607417026a8a9639a5c6abb6197487ff32b890666afb77fd662bd75e54b0c0f40f946da4435cde2d33bbb72693b0f78b9e41b8962396d7959749b89bec61b7f3db2f3e1f58a81ae6fdc22f17e91bed58a7654a9eafa0b78604bc90e4fa4fffea39383a6d222409449cb35b8aa3c1b652e5cd5c032e5b29db57a53fe9c260b09809f03ba514b94810f6c7f05f5127fd77c7251eb64b3a2faa164bca0ac596fe38599f30a33d135da02e8869826e355c829bce5c1fa5d1072ecb4b49d1c2ccc6eaf011ac64de5dfe1b2afc6d75371414b652174551b7e4fc98974ca7a739942c7c41fb848f789485c89bc80a9af017a1b5e8ee67152a8f0569a6dd87c5d5837af5f4a39ca6d412323925a5151adb3e9a6a53a548c73d5df0a9b5630c76d7be564c638de560fb8afe655ae36c795ba8db564736e290340c05dc823c50282eea2425e8fe998b402527a47e89399cbd559000452876d9a5ab7ed90bb1d7b460cccf5132cfacbd2364dbcafba7ba735e033ea560b4e234c536b03a21fd8e4db81a3e7aa42d5d0275c728f9fe46b54bc8fd3dd329169971feffc7ad659efcae53f95449be4db42a1875b29549e480dff787d3669bc9c99edf6cb9d3c679053e4fb013130e224d47a22b77dbced1f2b467c7731ff3d343c21de56ba4803473e61060347f8546cf0db9e83c7e0e4d69a550787138246246cdbd598a00289b3601f9955c9785ef964570840d936484a20ab94000fa5aaa31efc0311ed5435fa2dc4074a34da5aa701e6a11137eb4b39c393e8af24d5b812c65f9a20223fe0cc8f588f06855e6a01e08a4bfd1f6333f21a84341950b62e51a93495cc55e69630f81863572f0845c3ad1644be514afb767e128e8bc0219d33607a8ab5241e6d3061f242f074e39ce6925819353f3e5e924120ebfa5dcbc6cc380995d5cb043a6d2a1bd70e108f25725f22a09e6b57f84a6d5ba3141fbaef8ec63cac00bb751eac97b1fe7620c9ed626fbb2e8b1569711f3b8f0060308d05a356b92cbf6cf80fecbb525185f8d103f78587b55f6526c8083d50e1dd80b94a40d0a47d98242b9d8582f4c5ea0dad7650583e11af9b888922d94474627f855e1ff3c1687b2d8eeae5664c7803b011c070f003dbe5c49d1b0d4e9f0553b0554fafc380356b9babb5c6ac5cd6af74448e010a4fa8f6a9dfbf8a7b90d2ab641444db54897aa1988c3bb04f72bce4799bf0f8beea57b85faf37e7deab0209fd695dd23782f54e59a87ac2e4f9f7f351f8fff4431929700ad25434c51b80f754e852c5ead31977fe6204601430c22d59ecb55f803b5c0f1cb397d438ff75d8126216930dbada8e2e27747490792898284cb5bb61fc8a68b076f0c5e278e5e8cd2c1810aec226312e354156fbbd33e70b7363d5cbb32bbc5f506464a84a252eb78a3a9b1675833036bf1693ed7de6267865958ce158ffa7edc274aa84fb71fb53c94a0f3d4f0aaeec0219dd07d446a69262aa329a1679e6371aad162be3c4a902ed46fc91cf5a962ec7e5596f54a34d4c05c23f8a6103fd4c7f824f1bb3e4ea32ba69", 0x1000, 0xfff, 0x0, 0x1, r12}, &(0x7f0000000b00)={0x0, 0x0, 0x0, 0x3, 0xffffffffffff8700, r13, &(0x7f00000023c0)="d8942d39a5e13e55cca81bc9090bc553dd3a4cb0eb9ee38d55210655bfe9324f35d038db32541ee5494913e4873d5e931608b1f6b3e490ed9b56a4e05826c4a951782cd8299ef2861f04e9bac6801635ebb2ae861da651b8246859cc6913ab68c8f8666f8cc88377e7b790b2d13f9cdf6188f7c099bd8e807f5935beddfd9abeb713ef872f0983ef919206e067f35bc88e59ba1c0b6f0b5c827192c5402cb9ca6bdb20175e22546d07357733970501ebc7d5e5de470668687d68bd7b06e5cc83472fbfbdf6d022aa50312306964593e308f92728e9040544e09df197a80ac139ed8f82d183566b641e77652282e2016b9cd8f7e2c2c53da8d4e724dd4a932f12d0a7c0e228a2f805b239a68b3307d4dfee442fd8ef6c8e9a2c7c1c5f570a1515fcd4e32b707519745f00861a9a9b3ebccad768c517e2a391a12dc2afd480fc49eace67602e9bc23befa5540d3e2a5d479fa0d2d452eb83eb7d1255e1b9bac42f5f5cbd80db526b6d381bbd411e2ffd7f8240f7c874edddb33a15117d6830c0d73b71a5ab586ef68ef5586c98d4700a5498454216fca39afc172abb529622555853f709310dd15283416a3ebfdd50db7cf19d095659b51d11a0ee40ea976dd1b41783343642abaeb38dac2047b6a2fc410778657fd389bea09077aa899b2227ece2afe7ea9c948900b6dcf1bbe1b74811449c7b85ea605d40abc409c7ccb57c17e4820f118fd8f1206d7eea11234625fe6c67d588c882114ca8ff85ab4e729136e2eb90af5b3e87417f16afd6c953e7f4fc45ce17be901f2e5bfb24492843ce9b861eaf499c733f88056db8e6eee375be452fdbfc0a9348a8312589ab1f9de336dbccda78b69041509499db5fed7e0ea269ac0ca81fbedfc08f3e717c2b517f324fba1b291d92d226fd4ef999bac6c3d6dfed67598fe85b92e59939c4be991a5ccdc41d6cb4ef29ba0101e481d3ac58410a017e26d75f8977ec9b37a8d289b9a475570d961edc2d05c930a1112a334d333d0f44cef3d02c2e0dc36afd445060b355f600948856794f329657117df7ebb6459dccf25aa8f00b7249a131e89b82b4ec64b4daa73fcd647522f7a1cdcda143edca605618f8416e892af9f0f7efca6d2d2c24cc58ea2c627ecc051bf1e2559a300a1479b4608368df71ae58e18a8cd5837f16516d2af53da5c11ea72c2aae6b747d01720ed91b136f294a027a1df546650612049f0399fae1d8b1bcb2f47cd17a0ba5c9e4442b6eccb1f9336a03940b764dd87c1e39333fc115590b186a0d490ab880320cc1247454c0fdce19b710aea5474d95f551244a3739a777ee1ce0b9fd9f996f5837dba7cd57e29d3c97dcb89dc882597843ccc192a9dc55d7d0083be46c1f8184fb90671adaad0942ea0b89a4e2ba9c3cea5f2186795c3f6d4fa5f9f8980cfc3823529079ede9ee34d24f3ead4eced9c3ad2c3276b1087f82c3187351f5ba0d8fc5506e52b50c8f0f9f81b8c72200a202c6abcf1aa972b092f331d1e593abf755178abdd92856a13e18ce384a17f5b10d3d613945d02c90102a9bd171ff0401b2cb6aa001af88ea5da84293ed838f904a00fa8992593a6e499f1c62ad3b8fda86b14f42f96683ff2f442a5ebd0bbb00086b86aa847c88c28651f890504565960d3d688e3be65f814ee6069368b9011ca54b4929e10da6ebb28f7556dd814458293df9566fc1e5c614d152bb86d717500099876f40a9b6d01c4b394664aa70a11758045b00042608a7570258f600963d1457228db6137368d005c1eb760c3c4985977d44bbbf3d1ad888ab72bd1604c1eb62dd53915e6fbd9a8d135a402b74a6384c2418cdad59db093c688dca5e8cd8eabdca199ff4c736c35cd2bfc80bf0f4732ef5b89285a6b600f3a687c7e628344ece66bd53313ad39829ce13d61609505afe49d382e702152b92de883525d9ab41802fe0c3f95056b8feec2f5d4edaa7888c6e84b48c49315e130d4a8ed107e7c5b313ce0fff8174e185df5a69d2856f618bd4661c32d46a4d13267c0f6797d3c0027b0e4f598e8babfd527a116a2c10f6c15fb8522c0f2009a7d5db5df085e35bc237da2e207e97bb90a3cdc62ba1fb952b07542039dc20d3b056b0943c268eda4a97c571590f3f72b4a10d117632a2fe38cb774eb4e28d1fe0b46632c3a2319ba9e2b47e62362c36b841a81157855cf9c609abaa74fbab547745b122c284ede9050eb7c2a90331ab11784cfaeae010d47a24e4f34cfd0921cee577a182a82ddfd2507c32eec41406a5ec9f20d4e36058a15fe0aa3d1f6ea5e8687c62a5efcdfd8630bf848b6685d84305307eef32697091ee8296d0895ff639b7b3515ef1dd6d345b892d263cdc2590e4f3dd3ac95dfe4f70edf765a1bf8db0bd29725f8493adc2c5193648c3e594e8e4977b14694a9e2ba37dbdd843eb34ed913ffea0fa7710f04bf1118d9a58c0250a8216ecca0c94ab043140b120addce5ef61d8822ca9671bd68cd1a9fc6372cb41a6f6fad334cc42d9d2acd0da5e26794809c71292d8ed4761ad84f49f941c953792e7761ccb6f95ff517663294bfe8974c78029a886f680364a54614518f78ebdaa5b92649c45ed600ebbe9b2ab88ae6a6e4c9027f468f708dbf867b5cd0fe2ba5b84decc2dc55c170b3b70099c9cb117aab52595cec236f5f13e1afabafcb942a9a7d74b2819219ffd6ddd666fc240d1d08f0ac81d263aaa8d765e074cbcc9f87fbf4252640b63eded0ed4dd3cd0cb17abd9056e172c650dc41f31383ae95cc4943f7bafde91f6954800395dee77737019bd55bfaacacd0c66760d2ffbe9211dee8ed94783037f75ff7d5bbef96bcd6f99531ed38fbfa87a1331c2260232bb4058335ef18d353c81f2bfa51349779847510e8ecd93374750282b3a5b865b78f35974f32389994cffb4d99414a93cf17094826d5a788ea6702e72f4fae4dba2563af321243db2fed55784308218c84e3f52e782213ee6ddb3d267ca28255f29bb7be57f32252c336e568fdaf5d5aec448ed1f260f68d7a710956e729c4054de5a29023b818e95cce1a0663ac64f32416a646b2bc5342d28d962a7710f11813a8dcbba6f1b9d974b1f9eda7468281ba1409a02676f31375cdf1fdcd2e8e3e2bc6b377fbc66c6b88b46b8023fa0dd2252d826392f49ad65c2b619d367bf36327da3ef09f0be303bb950a237006d2535a0d56f4c7fb6b5b85e09a226b938e3894fc14dd31d7bd2df30967178d282b3b2f0e4b2b8b8f19e4ffa56b83b828aa7325b30c26577d86bbfdac40e016e259073ecb8f1fa6e6a3479e43e114174ecd5ce467387804d79ee2392d8b1df92a1d6caca032fbd1fca8c58888aa6008094f4e309f4354cbab6ee81c0af5fa242284e9ea833828d7857206c8ee0f34a2f6f116be65630643bf17efdd7f987f897bd9bcac8a6da52aac1780fcc163501ab52bddeefebc6f7cfc80a228e36944c5a1c97bfeba9da5be26383949f2617069042770bd6fdc479ce94348d4f671b8fe66f8595fa66215c158b28fcad7d85d2fdf99c9764fb7ffe845763cf04bf23f739d78177034d32f9d20de56be646c6013e4c29ee2e1f94b19fe4c218a54c177704f608afa0fb9b534234a738edf5b5a2b10c6b0f7785242e67978295e54257f29971021aa375ee182521a239cb413b1c306a0fb191db46ca41f26db3efe4bb6c006d58a33ee0c7a554dd39979da609730594d4920a23378daead00c8da7b494c13c90b8d2a5a02c3194eed36d2e8db9afec884c79202a776b101f06c6c43ba875fd8ab03db7ad89dbeb380256d056b7bf37c993d200399fc77e77376e4239a6683c31a0b1e42d348180eafe8d6609e5f757f7cc17b668f598e0790b703f6b6f2fb66f03c54c31ceb88376bdc9ee5d58d2c26c463f024685cdea421f5dd4de4bf984d2bdd02c866abc3b9858ba8676795064b59bc05cf08a2146fa4308a85213a696668cb2fc921fb21d11c1ef7c529ea5fe7d9c41bd87b57b909ed337ea5f7f4428f2ebde79dbe547714fc444bff15beb2d0a37fbe927fded7555c5b8a6e783b89559faf860028c581f6abccbc910a75a4e4f6a8648cb3e52127bd6a2d0e1fdcf5b947c577bddbef7e4dfcfa1e93b7ccd7bbfb66bdedc07a9c850dc8fbe0e949bf8e3c707f84fc16e0e57bd5ab7e842e7335a7f27763fb2517add713fe1ee5fe1dca46644050c0b9c7033ffc018b241bfa78a72400538e8dff07906f973603e187c31e24f4fdf407b0ae741e98f640e5610dd1d792842758dd073443d525dd6d4bc7f08d09cb76121e57b3ee0b134f8f11562b1bc9c8bf3673cedc13c23cb3c1b19e0a4565df2bea0598044457a18bb27ce1713ec9f442f090565e6b8512540f5ae57dd32b3c3590e3e2059ab10377f5eede2693b9669c42acdae301046ff64f963348a7ccf18b51ebbcc142a2506fb788b343cecf1ab2c7a9430e5118d4090e6bad9397a3ffdff619c95faa5fe3b0d0e961c8be4a9beb438601e3e23d7585503dd9d59edcab06e59b3ebfd90a36fc1ab4cf40cd4cc54e3e094e986ab966ea849cccd8e6d23f094f03504575b90892ea93f25c518878de6f66c7cc1a774ad737e50505d27f0317a8dced3d625872d001aa0b8bb0279c73a509a11be161527da0bd0c11ac516a21e60c5d2da24840a1d1e9e5041191a3c7edfa92cd9811a679d3532c61495e9c10d84522b6b274619b28412d5f85abf439baf1954f073a0e9387186d1dc501e6dfcb27fc32fd505ba081361e486ef79499143504d7e3e895c310421abc285b20125ffc31668c686c04fd9af0ef4d77d493a0c190ed4bc7c48bd91df07f7397f116d398c561061641be69f64471af701f5798ff07fdde4f57d8f35f171fb05c09f0635883462ee153343721e05894315b8add3bf79a49478372866f547fc6ce748ad034b41a55fcc3db8f6893743c7286242b76c0ba7383d8e488a4dab8d30e64675dbd63c2eaad2e16aef2e06cc3c03f7db42eeab5384242bc9090e67c0a3424b2548a8476c65fe681f1d565fe88104d903894e4702cc12d3fbe9b2f494562525d8ef13a8ecf2336c2734bfb51629dec2a10dfd5914ee8774223ec5f525383a0fce96866b4e7fe7bf3f595e944af4a293ebcd25c3f07232ec8ec4827ab52396ea7b76be8f2e3f63725d4666d3686f11b56852ed84428c81c2db59ba535552da2be9838c5d545ed537608ba8f2e4867d9e2a62af731e7196b50184e73189deba5b03a7a05a1aee2c64cc7d286aad817f84b9c3e3c844b9ed7a3cb6b69882585bcad769afc3a3d9ab73afb3ab3224ee1803b34134306332905d2473cfc2a183c527c3ef4d66a1a5634a9cdea6c99026ff9a7ee5ea045ff60337f5488c87f486fc62418f3eec3c06f3f5c705fd1b4c8cf8362bba323ef302d4a6b1dbeae4bd1c81a9c9389d95929345318d2b1f881d1bd40c1c355bd540619fb6da77951cdd065b59506fd1c37e9c0b879ec2f77107af0f746058b8447153a7c1cb101a696961a6c104b1900fe8848c4ffb1d14d383df6005ca1493981048a700a7901c7b7942302f39ca8e48bb98a64456ee3fb2be149665cb02e88cd105381da8e76d855302e46a40aa35cf48142baec873797e1103184b9e53f52e88a44a5d78ee28eae06f8295848cda4c8edb7a2d53dbb5bb6fffa195d6e0687480202269058ebb926b940f853d4fa754a1c74e86ec88caeab9a3793eb7b45f1b5b9712f2808e5091df50b605d0071a5ce2653956aa034e15db0a4f9a360108d380b44e2c5cbc5de98823d5a53", 0x1000, 0x1, 0x0, 0x3, r14}, &(0x7f0000000b80)={0x0, 0x0, 0x0, 0x7, 0x2, r15, &(0x7f00000033c0)="8e10e269c4f0b3557a2c7d490ad3ac82449ea24bd08a024aa6fcbb6ef216002fa6e4aba5a4308a2cc0b588839be11b939b8f538f4edbd708a43a4ce35674522955814d12d3713a327430cc8832ce364fae814550c516e270cb8c47767077bb889f5a6d037766e26418af0aa635aee3ea1b7fd83c24cd3235dfc2697a3dfc18159f214faf862112cd910ae55871e3f1b0e4a1b9b29634dccd3556782e4be71a028d93239e7dcb2b5c6388c501bd3ca54b9740e7ce6680e7a09780bef6fa8e90e234ee57fc9b3cf6f06cfef660d609bc07e36d526f3e5c4bcbd2c27fddff7ee72d7902798f67db76f1a2f1c65016d0db4a2710d42a39eabe5ea311ace7c629456b3b89dd14fc1f6c170834b4843229082e845435fb5cb2b473c4b988eea8db877551c8015eeff4793278f167d92ca062d2f7c0813f2e7e89b46113cd5a349362ed51db5117e50b2fde22a0a8f35da742228f0a16540ff0a924f32da9b9b8aadeb03fa5c74bdb495ef8aa47a8f878160d51a20b6ab91d78656baddcafbc7883e720e01cdb79855d4e37bf4fcde37b05b3ad38a115ec576aadcb57f64f533c6c0ed2fa4afe69e01e01ec21b73107a4243d4b31d4382d42dac0ad9f1d744d38541eb57d1bf9cc0eb86971e43d574cd8893d96db5d46a0ca3f05e3a80fd3341c31c0bc01fccac076c6a44dcdf853d7c9b9a5a16d71564d89dc2593658b608eddc57c7681bbfc506f2ba077d0d239b5ccd0463b779be6dd86a1ed926a9e9f54b91487b8d37df8950beaeabfb8a67e53b3867309b2ac1c98cead6d652681cb3a8a5e8b2129e305959372cb66b77af08a069d5ff1237679d03dfcb43112534a097b42bcd0337274db45c24523507076b48c642c234fe1f198d5de9404f465b59b0f7945b4364eb10fe9a7a5252035604a9d931682af34ab29545d66f3720b332358cd2f082e86b4e95e929d21fc247f812172bbbd543f9bc380c38ecd78682ea17f5facdca59ed7b093253fd85ca9c4aafb1c3e393455581d9941ee49334eb89549f19eddb82b0dcdc1dc0d96ed8d6744170ee2a45dbbae61f55293daa446279fbfe3bb33359110d419b439891b2b8c1eca821113b6688a62d156cb37f88ec934445cb27a29cf98811a7c925a9161ff765e761b6a2625ed36f157b6bd8137837ed29bb4ed0b2b3b8473459e0f57ecd2e10b66a9b332fe0e3f7f51d16f786361b6b34c099b7b008b75efa914bd66c7d87d3384714125686dd18df93609dcd85f1e8f13da7eeb503fe18d4f100cf55b3ee23b724b3d75b78ddf8e725b0639ee8f94dd0080675e004b9035843b88931bff90cb9af0be1345dac3d907b6904ea5de372c0023fa621c8a760ddebc38152161a6b88db14fe80f58f429f990ecb50c663c2de23c1e5510cede7be878ad980031339afc9ed77fce1765376fa8648d3de0a3b126e1dcef5c248f80f73fb492d54eccc3fc2eec076dbe53aed961d8a79078c572e8388e2faf35981b3ac8af7550dba1bd81f38ed86f6f62c11f603a6a65951ca81f321d66f1e664fc96a584b6d50e4d37783c225e6179c56198d9049ab87bb0a787dc2b6f2e4e7d6a1fc9a142b2182d86f987813761de1117dd3c7f5b061b9191ba3d44bf1dfd79bc78b8eeb05b2c12a5031d8c2a08e80e8efab4378ec096c940c79375207a4c20525ad91280297896323df2a3ded7d1898de9b54edbde257bd3886b233088201f861e2b0601c55a6a9b582372dc54b46055a1e3b09ecbbc7120fd41e79d991f419cce1eb022155704d04465ec530039233be1dcebb9cc248901ca05cd5d33b775f7d590a4890cbf02166ce3351c8a1fa5520ec4b81dc076ce2c6fd9d38bde1e5278edb2be826b3a74e1b0226ce487cdcfd90983fcfd2de524935c5fabb9e53c313fceb64dc7d2a9ad2a8ac490d81552dbb68f7049cade74cd30f3ab71b36f36927a9a21f42f27d64632b99a9394f9911fd43557c2300be65c8a3974b051cfe2f88da938cde05a7c7a08ad25636aac53efd072363a2534d9fead5af028b8668c5b542c0a0c2460a2a12fea7ac6732ebacb7224c95176e1df2ce23cd86da4694dc033a1a61b15b35b58ff45c9908b9e59ae19bc2807df60e3e97e76d60fc21c3542af66aed90cddadf8e36b3bb79e2b79adb4f7d4589fb1aa340451abc3ed9e916fa7776a6f06b95def24f288181337f7907dae66df4a6743eb0239674651a7012c830f47dad97e672e5bddbfc1e3e3d3474b08da68cbe8a868571ecf777db26549b752b61cfd2e6180213133de7ad14b74a0e733438ba8755bd30b66b3ecfda4d2d2f644021e19aa37ca5fdfb2df71c2e46cdb73c984a8ed492e6b48ca42c992ac5a9de5cd120bada4de7ec74d20c031a318ede3a232757724993bca8b555010508575f6ec0f34811176ea7c4f8a322bedf42d30a4c59f104a290c15eaf4c1ac24eb3cc60c048e0f66266abd0fcf827a649d6f2102223145ed133c8a88ad89171527d2abd8630b7389ec9b020118ab2ac43c649d3d9aa2a6eebf77e05b32ea4bcc078e0a55811848dd71f7f58a9bbe271e585cc6454d2b3431788f16b9a134577dafa8b568a4a4d2df4326ab439b060756ce66bfe6a596ef872c9dc55c5b02256f166ab9fc7d22ec78acbc0a2378b7d6a12b933d70e921b8634a26ff91123147424a318bbc504aaa8bc7b641833e0ca2f7e197ae61c295e7d6a7a3336a91fec43ad21f9af534bf1ccefa51d82c5110986cb5de99e2fbf83040013e2981325df27172ce3bab74dc22a1af5ecba3a0a72bc7dff5bec1ca8402b204215c2fbec1c4a588162260cc9ce54304c49fa9e386e1815a43fef617eaeb9a9f9a1b0edeb17b080ed63d015d9eac4d9a38a0f4350178e7885d0cd00c3c0a21e4dcc4bb67a4077ff04671c19d3d44d5d83a3d538aecb6bef0d1e0803661442b194a6499f3e87e5ac0ff78dcf9a9843476411fa257fae3713ad7af94c9888d51551a356e5fd148b6bc7d40ccc3528ed3f267546487d5afd967eac259ae2857f1ca5880f7c109267d18950344294611dc55d33f12c909c1c4f1b010d6239435adc52efc932a40392506297188e02ac442b46664164e64460f43ac8766dddc2773edcac855dfb65a50bf6cfa96115c785171351da4527ed29358a512c653ea37f5ad1611b8a0457afebd24f8dddb75bccc11e3d43ba180a53181fbdfa609b9e614ae4c8ee27276323b1e3f111002c48fca1866e73bcf105593f6f1787076d4c3458865c4f5454651fd5d7e491c058e4d810b602b4fed9292fcac20eb3761ae876ee2ee2432153711a2fab7dde40f46c76a95d759341c6e4d1ccae1029a0d3e97987000cacd2b6f100a43e5b013a03d127aec581b4d1a8a95851b5abada6f69414e4bd2c3864fd3a1b768723f4371f605c9e8bfe21bb5e9287fdadfdb516f5d77896b6c8ce0462087716ca619b47af67379d3717297993197088cc60f161ecfb1f1e079c3c01973d45c79fda90588ca55d430f7ed410cb55885e3fcdce4b8c9bfc37771c62fd599c01cc4e4616210fd76ffacef9950c5423d5c956c86bb73c24b6370454e653a65bb78501cf014662588e0658678e0f30be2e819b8220c093205910942e71a99c281c761319ced4c997672a35408659c710e31f31b4014a1074052a36790ea10b2381b12ce81b7d346f28b32819708b8f7b86be6f9adf4cffbe16605b1e638e698775bf207e25f39b98c32d110f5ffcea45798674fb6bd50aa5ef657b11483f2220a85cb8c1b5817b43f198988264e720592928848f276a4b5221f134d59d6043443e97f53bbd5faf491eecb8b0ee4da2992c1481c3be23c0847c99309e0d268e2e85385cc92d269ada2a35935dd4a95c94d3c463c56582ddfbb1f2cb0efae4a3232711be740062ac9a61596b7838f39975db2cdd4ba85f646ab3b2ea882c390ff68438507f466e53705ffcad45c9cca8075ff25d782cef18e9975aa2edc57974d5ba154144e3368818477c626e639986b55da6d74f8efd7848f2388b50da8ab176fcc55ebf91b895dd4513577a3316bb6e4ba16f2758a71b95aa1d7c1630a7eeb32d7abf70ab0b95fc6faccedecb6483b2b6d4d6b785933fcff159795053a4620a1b416b16cbc4b9e2c6a5683010216851eb6a6b7c37c079f222107adbb3c8584a88c49652c02bd6b1fb8f76c81764452510ecb81eec814918c02ef95583a54eb34d5a7f92fdb1f4e833422af57fa5cfd6803ae40a7023caafbed761dbb2c1e3680b5ae8680c74f33a9a3df0ecca59873b20d50f738b064a25311812397cab0c008ca58e689357c6abf7faca13f1cf52707f50a951e12359629e5788d9575109fdceffccedc0a984662ca6d986fe80cefd33f9e31f807fd2845fce88c55bcd359881abecfd608ed4d843b122106d3ebe8730538dca76cddd5c1449684dddd97272e35d60706dcaff99ac02850a1571661d34c8fcd0313e3bef0cf3cb4078679ca038d9fea58c5f3a96fa36aa0fba2ab545195d057c50dc38bf0cfd1e66d11b54ea03185276f97c3fa2a55a39fb674343eef8e85f75afbfe9ed12569dea4670ebcae4416ade02782a0c35d13e49527deab839b255eb67f867e44dae536324a1d66823390ca98beb67bc485769d6b2e32b0c908fda1fd247d7153bcf038e4d1dadc5c31600bcd33a4f6901e9d900772f4428251e693c9c63dc33453898d73a8ffde7b8dc29d6787c0d83a831a56d82a3e5ddb232b53270aea53668f7b5d47ba1b3f60ee26df3823d0a33edbb36b1c8e53310b55ef7854cd4f9989b3e395e596d2532cf90c2c428ca4e3d48b19f321a75e0c26540c58d5f86b496f45ef04a738a471032861de016c956735b6f523eda0f1cea4700197da2f4982cdf7597749a6ba1b21a780c9724f6b97dd25477518d9c89908b723fbb1e0511e9b021607aa346066159b868fa8135ac4989e125594eda33929fbaf8e07132482b55bf3191fdc47805f9a4c911a021db2e89b5ee73948cf3b1d28eb5347a05dd89dcc3232daf1b2db3d136e29a4ba909d294a2972ae29232bea27b24fd4e1c531f87fb4f6ca5b5d2817294a166fe915c1f75702e088d0a667e229cd699fa431bcc6b1a0d683f761be1289aaab1a763d94f7459d4702df2ecd4db1e65e8f9cc524b5c0fe4b36cd4f5bfb643c78add0380e18355423b1dabeda48368e2a3f7823cdc84d19ae6831473afb2323e9636e3ece14dddd5eecb42777b0a25a59e5ff94da631e434bdfc1fa7ae96240d8a0c87dcebde0195f4b348e2d20598328354f242cdc74aa2452af00f7cedebf2ad861daebdfc353b85ec09634b3a56989a38bd24a93d5521adc0db8a6c7c9e50753fbbd93251ffbeebccb30991530f1129fdd8d0d81b981ccf9ee96706ca34f5aeb0a9a882e416ce8a70e2fa26ac30ac825a25962c29229ced9bce5d16f00d593765781888f0c64491ea907e1c33d880196f5675a9bdd8d342aa536289b72f466275520f6413d4f0b04b5a72ac7102ba7d097e79150e87e8218dcbb8affaebcb39134925642525006be2a0fd1ade2f8063feb946d61a2c3c7ccb0b93a670ad4f6b2ff515e50e3a4f2d9a78e225e27764af34ec2a55d8f3a241908f38866d781937db5a2d2b5178a5fd932f206d0d8db94a6ef610681a175fff61d88ba272d85c5b5da33f9b8f567cbccb1bb264bdb37952343aa4930cec8faf002329a5d14836af538f3080188f840bbcddc5c17c860c0379d7d8a8b7e97449476e6524096f963610b756a33c82f9aa5c1889f28909f003a3c29368b4548161d07", 0x1000, 0x73c, 0x0, 0x0, r16}, &(0x7f0000000cc0)={0x0, 0x0, 0x0, 0x7, 0xe8, r18, &(0x7f0000000c00)="29fdb791e53e353acf61613410db795a2cac3c08a5b2b2fd919456668bd6f6491b621c5327fbf7f867ef54ad8bc463824b9772179b643574739ae4bb170ff1ba27e93a66a1ac08d291c031e2b9ebfbd63c0447d540394d35112f43da5893b462c02c288eee6a0c518965defe7a3cd5c5", 0x70, 0x1, 0x0, 0x3, r19}]) preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f0000000180)=""/148, 0x13d}], 0x1, 0x0) r20 = syz_open_procfs(0x0, &(0x7f0000000a80)="6e65742f53705f7461626c65735f6d617463686807000000000000008149a5b8577ee7bb00") preadv(r20, &(0x7f0000000480), 0x10000000000002a1, 0x0) [ 473.621252] binder: BINDER_SET_CONTEXT_MGR already set [ 473.638546] binder: 24760:24763 ioctl 40046207 0 returned -16 12:34:11 executing program 0: syz_open_dev$sndctrl(&(0x7f0000000140)='/dev/snd/controlC#\x00', 0x0, 0x0) sched_setaffinity(0x0, 0x7, &(0x7f00000000c0)=0x9) r0 = perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0) fcntl$setflags(r0, 0x2, 0x1) getsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER_VALUE(0xffffffffffffffff, 0x84, 0x7c, &(0x7f00000001c0), &(0x7f0000000240)=0x8) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(0xffffffffffffffff, 0x84, 0x9, &(0x7f0000000280)={0x0, @in={{0x2, 0x4e23, @remote}}, 0xfffffffffffffff7, 0x0, 0x400}, 0x98) sendto$inet6(0xffffffffffffffff, &(0x7f00000004c0), 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) setsockopt$SO_BINDTODEVICE(0xffffffffffffffff, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x4) socket$inet6(0xa, 0x1000000000002, 0x0) r1 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x4, 0x0, &(0x7f0000000100)=[@enter_looper], 0x1, 0x0, &(0x7f0000000180)='T'}) r2 = gettid() timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, &(0x7f0000040000)) tkill(r2, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0xfffffffffffffced, 0x0, &(0x7f0000000040)}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x400c630f}], 0x0, 0x0, &(0x7f0000000f4d)}) 12:34:11 executing program 2: perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f0000000180)=""/148, 0x13d}], 0x1, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000340)="696f001b66408225aaa3af068fffebb8a490c47dda6586f1b58895b94a78037dd3714e7198820a7a709e2d30d25e6d846cd5c62a648a598668a8263b752b0b622b115112b5ad8e0425c0b784bbdb89eb8f4da0dd73dd01fe35694c2f78600badf8a0e237dba40713bac9e053b41a9f62be5fbb928018aab5f7500bef51a2fd74d4fffb4a20a946733820bdc1b485afa417cdbcfdfbc54f58c9c3edffe240c36f4ab8a16613814e226b6d20d98010ab1ace49fa76dce337a5a5f1dcff9e5d533b12475e33b971b15b69cd591cd9059759f0f04ba5468a34b98915033debb3e87f048e8601712659d47d8687eb6be5e650068d88000000000000") preadv(r0, &(0x7f0000000480), 0x1000000000000189, 0x0) msgget$private(0x0, 0x22) 12:34:11 executing program 4: socket$inet6(0xa, 0x0, 0x80000000) sched_setaffinity(0x0, 0x7, &(0x7f00000000c0)=0x9) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0) fcntl$setflags(0xffffffffffffffff, 0x2, 0x1) r0 = socket$inet6(0xa, 0x400000000001, 0x0) r1 = dup(r0) setsockopt$inet6_tcp_int(r1, 0x6, 0x12, &(0x7f0000000000)=0x7f, 0x4) bind$inet6(r0, &(0x7f0000000040)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) getsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER_VALUE(r0, 0x84, 0x7c, &(0x7f00000001c0)={0x0, 0x0, 0x6}, &(0x7f0000000240)=0x8) sendto$inet6(r0, &(0x7f00000004c0), 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) setsockopt$SO_BINDTODEVICE(0xffffffffffffffff, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x4) socket$inet6(0xa, 0x1000000000002, 0x0) r2 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000200)={0x4, 0x0, &(0x7f0000000100)=[@enter_looper], 0x1, 0x0, &(0x7f0000000180)='T'}) r3 = gettid() timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, &(0x7f0000040000)) tkill(r3, 0x1004000000016) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0xfffffffffffffced, 0x0, &(0x7f0000000040)}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x400c630f}], 0x0, 0x0, &(0x7f0000000f4d)}) 12:34:11 executing program 5: preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f0000000180)=""/148, 0x13d}], 0x1, 0x0) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r0 = openat$full(0xffffffffffffff9c, &(0x7f0000000000)='/dev/full\x00', 0x0, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x2400, 0x6) r1 = syz_open_procfs(0x0, &(0x7f0000000340)="696f001b66408225aaa3af068fffebb8a490c47dda6586f1b58895b94a78037dd3714e7198820a7a709e2d30d25e6d846cd5c62a648a598668a8263b752b0b622b115112b5ad8e0425c0b784bbdb89eb8f4da0dd73dd01fe35694c2f78600badf8a0e237dba40713bac9e053b41a9f62be5fbb928018aab5f7500bef51a2fd74d4fffb4a20a946733820bdc1b485afa417cdbcfdfbc54f58c9c3edffe240c36f4ab8a16613814e226b6d20d98010ab1ace49fa76dce337a5a5f1dcff9e5d533b12475e33b971b15b69cd591cd9059759f0f04ba5468a34b98915033debb3e87f048e8601712659d47d8687eb6be5e650068d88000000000000") preadv(r1, &(0x7f0000000480), 0x10000000000002a1, 0x0) fchmod(r1, 0x70) 12:34:11 executing program 1: r0 = accept$unix(0xffffffffffffffff, &(0x7f0000000000)=@abs, &(0x7f0000000080)=0x6e) ioctl$FS_IOC_GET_ENCRYPTION_PWSALT(r0, 0x40106614, &(0x7f00000000c0)) preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f0000000180)=""/148, 0x13d}], 0x1, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000340)="696f001b66408225aaa3af068fffebb8a490c47dda6586f1b58895b94a78037dd3714e7198820a7a709e2d30d25e6d846cd5c62a648a598668a8263b752b0b622b115112b5ad8e0425c0b784bbdb89eb8f4da0dd73dd01fe35694c2f78600badf8a0e237dba40713bac9e053b41a9f62be5fbb928018aab5f7500bef51a2fd74d4fffb4a20a946733820bdc1b485afa417cdbcfdfbc54f58c9c3edffe240c36f4ab8a16613814e226b6d20d98010ab1ace49fa76dce337a5a5f1dcff9e5d533b12475e33b971b15b69cd591cd9059759f0f04ba5468a34b98915033debb3e87f048e8601712659d47d8687eb6be5e650068d88000000000000") ioctl$EXT4_IOC_MIGRATE(r1, 0x6609) preadv(r1, &(0x7f0000000480), 0x10000000000002a1, 0x0) 12:34:11 executing program 3: socket$inet6(0xa, 0x0, 0x80000000) sched_setaffinity(0x0, 0x7, &(0x7f00000000c0)=0x9) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0) fcntl$setflags(0xffffffffffffffff, 0x2, 0x1) r0 = socket$inet6(0xa, 0x400000000001, 0x0) r1 = dup(r0) setsockopt$inet6_tcp_int(r1, 0x6, 0x12, &(0x7f0000000000)=0x7f, 0x4) bind$inet6(r0, &(0x7f0000000040)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) getsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER_VALUE(r0, 0x84, 0x7c, &(0x7f00000001c0)={0x0, 0x0, 0x6}, &(0x7f0000000240)=0x8) sendto$inet6(r0, &(0x7f00000004c0), 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x4) socket$inet6(0xa, 0x1000000000002, 0x0) r2 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000200)={0x4, 0x0, &(0x7f0000000100)=[@enter_looper], 0x1, 0x0, &(0x7f0000000180)='T'}) r3 = gettid() timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, &(0x7f0000040000)) tkill(r3, 0x1004000000016) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0xfffffffffffffced, 0x0, &(0x7f0000000040)}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x400c630f}], 0x0, 0x0, &(0x7f0000000f4d)}) 12:34:11 executing program 2: perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f0000000180)=""/148, 0x13d}], 0x1, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000340)="696f001b66408225aaa3af068fffebb8a490c47dda6586f1b58895b94a78037dd3714e7198820a7a709e2d30d25e6d846cd5c62a648a598668a8263b752b0b622b115112b5ad8e0425c0b784bbdb89eb8f4da0dd73dd01fe35694c2f78600badf8a0e237dba40713bac9e053b41a9f62be5fbb928018aab5f7500bef51a2fd74d4fffb4a20a946733820bdc1b485afa417cdbcfdfbc54f58c9c3edffe240c36f4ab8a16613814e226b6d20d98010ab1ace49fa76dce337a5a5f1dcff9e5d533b12475e33b971b15b69cd591cd9059759f0f04ba5468a34b98915033debb3e87f048e8601712659d47d8687eb6be5e650068d88000000000000") preadv(r0, &(0x7f0000000480), 0x1000000000000196, 0x0) msgget$private(0x0, 0x22) [ 474.011328] binder: undelivered death notification, 0000000000000000 12:34:11 executing program 1: preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f0000000180)=""/148, 0x13d}], 0x1, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000340)="696f001b66408225aaa3af068fffebb8a490c47dda6586f1b58895b94a78037dd3714e7198820a7a709e2d30d25e6d846cd5c62a648a598668a8263b752b0b622b115112b5ad8e0425c0b784bbdb89eb8f4da0dd73dd01fe35694c2f78600badf8a0e237dba40713bac9e053b41a9f62be5fbb928018aab5f7500bef51a2fd74d4fffb4a20a946733820bdc1b485afa417cdbcfdfbc54f58c9c3edffe240c36f4ab8a16613814e226b6d20d98010ab1ace49fa76dce337a5a5f1dcff9e5d533b12475e33b971b15b69cd591cd9059759f0f04ba5468a34b98915033debb3e87f048e8601712659d47d8687eb6be5e650068d88000000000000") preadv(r0, &(0x7f0000000140)=[{&(0x7f0000000000)=""/223}, {&(0x7f0000000100)=""/59}], 0xb2d48a672ae8f10, 0x0) 12:34:11 executing program 5: r0 = syz_open_dev$amidi(&(0x7f0000000140)='/dev/amidi#\x00', 0x6, 0x701080) lstat(&(0x7f0000000200)='./file0\x00', &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$TUNSETOWNER(r0, 0x400454cc, r1) socketpair$inet6_icmp_raw(0xa, 0x3, 0x3a, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) preadv(r3, &(0x7f0000000540)=[{&(0x7f0000000040)=""/26, 0x1a}, {&(0x7f00000005c0)=""/231, 0xe7}, {&(0x7f00000001c0)=""/64, 0x41e}, {&(0x7f0000000440)=""/241, 0xf1}, {&(0x7f0000000280)=""/1, 0x36e}, {&(0x7f0000000180)=""/60, 0x383e390e}], 0x6, 0x0) r4 = openat$vcs(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/vcs\x00', 0x40900, 0x0) ioctl$EVIOCRMFF(r4, 0x40044581, &(0x7f0000000100)=0x7) r5 = syz_open_procfs(0x0, &(0x7f0000000340)="696f001b66408225aaa3af068fffebb8a490c47dda6586f1b58895b94a78037dd3714e7198820a7a709e2d30d25e6d846cd5c62a648a598668a8263b752b0b622b115112b5ad8e0425c0b784bbdb89eb8f4da0dd73dd01fe35694c2f78600badf8a0e237dba40713bac9e053b41a9f62be5fbb928018aab5f7500bef51a2fd74d4fffb4a20a946733820bdc1b485afa417cdbcfdfbc54f58c9c3edffe240c36f4ab8a16613814e226b6d20d98010ab1ace49fa76dce337a5a5f1dcff9e5d533b12475e33b971b15b69cd591cd9059759f0f04ba5468a34b98915033debb3e87f048e8601712659d47d8687eb6be5e650068d88000000000000") ioctl$DRM_IOCTL_RM_MAP(r5, 0x4028641b, &(0x7f0000000240)={&(0x7f0000ffc000/0x3000)=nil, 0x2, 0x7, 0x4, &(0x7f0000ffc000/0x1000)=nil, 0x8}) preadv(r2, &(0x7f0000000180), 0x0, 0x0) ioctl$EXT4_IOC_SETFLAGS(r5, 0x40086602, &(0x7f0000000080)=0x8080) [ 474.127374] binder: BINDER_SET_CONTEXT_MGR already set [ 474.137575] binder: 24785:24786 ioctl 40046207 0 returned -16 12:34:11 executing program 2: perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f0000000180)=""/148, 0x13d}], 0x1, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000340)="696f001b66408225aaa3af068fffebb8a490c47dda6586f1b58895b94a78037dd3714e7198820a7a709e2d30d25e6d846cd5c62a648a598668a8263b752b0b622b115112b5ad8e0425c0b784bbdb89eb8f4da0dd73dd01fe35694c2f78600badf8a0e237dba40713bac9e053b41a9f62be5fbb928018aab5f7500bef51a2fd74d4fffb4a20a946733820bdc1b485afa417cdbcfdfbc54f58c9c3edffe240c36f4ab8a16613814e226b6d20d98010ab1ace49fa76dce337a5a5f1dcff9e5d533b12475e33b971b15b69cd591cd9059759f0f04ba5468a34b98915033debb3e87f048e8601712659d47d8687eb6be5e650068d88000000000000") preadv(r0, &(0x7f0000000480), 0x10000000000000d9, 0x0) msgget$private(0x0, 0x22) [ 474.175027] binder: BINDER_SET_CONTEXT_MGR already set [ 474.180839] binder: 24792:24794 ioctl 40046207 0 returned -16 12:34:11 executing program 3: socket$inet6(0xa, 0x0, 0x80000000) sched_setaffinity(0x0, 0x7, &(0x7f00000000c0)=0x9) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0) fcntl$setflags(0xffffffffffffffff, 0x2, 0x1) r0 = socket$inet6(0xa, 0x400000000001, 0x0) r1 = dup(r0) setsockopt$inet6_tcp_int(r1, 0x6, 0x12, &(0x7f0000000000)=0x7f, 0x4) bind$inet6(r0, &(0x7f0000000040)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) getsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER_VALUE(r0, 0x84, 0x7c, &(0x7f00000001c0)={0x0, 0x0, 0x6}, &(0x7f0000000240)=0x8) sendto$inet6(r0, &(0x7f00000004c0), 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x4) socket$inet6(0xa, 0x1000000000002, 0x0) r2 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000200)={0x4, 0x0, &(0x7f0000000100)=[@enter_looper], 0x1, 0x0, &(0x7f0000000180)='T'}) r3 = gettid() timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, &(0x7f0000040000)) tkill(r3, 0x1004000000016) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0xfffffffffffffced, 0x0, &(0x7f0000000040)}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x400c630f}], 0x0, 0x0, &(0x7f0000000f4d)}) 12:34:11 executing program 1: preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f0000000180)=""/148, 0x13d}], 0x1, 0x0) r0 = syz_open_dev$dmmidi(&(0x7f0000000000)='/dev/dmmidi#\x00', 0x2, 0x2) r1 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000040)='/dev/rtc0\x00', 0x2000, 0x0) ioctl$TUNSETSTEERINGEBPF(r1, 0x800454e0, &(0x7f0000000140)=r0) r2 = syz_open_procfs(0x0, &(0x7f0000000340)="696f001b66408225aaa3af068fffebb8a490c47dda6586f1b58895b94a78037dd3714e7198820a7a709e2d30d25e6d846cd5c62a648a598668a8263b752b0b622b115112b5ad8e0425c0b784bbdb89eb8f4da0dd73dd01fe35694c2f78600badf8a0e237dba40713bac9e053b41a9f62be5fbb928018aab5f7500bef51a2fd74d4fffb4a20a946733820bdc1b485afa417cdbcfdfbc54f58c9c3edffe240c36f4ab8a16613814e226b6d20d98010ab1ace49fa76dce337a5a5f1dcff9e5d533b12475e33b971b15b69cd591cd9059759f0f04ba5468a34b98915033debb3e87f048e8601712659d47d8687eb6be5e650068d88000000000000") preadv(r2, &(0x7f0000000480), 0x10000000000002a1, 0x0) [ 474.399568] binder: BINDER_SET_CONTEXT_MGR already set [ 474.405564] binder: 24811:24812 ioctl 40046207 0 returned -16 12:34:12 executing program 0: syz_open_dev$sndctrl(&(0x7f0000000140)='/dev/snd/controlC#\x00', 0x0, 0x0) sched_setaffinity(0x0, 0x7, &(0x7f00000000c0)=0x9) r0 = perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0) fcntl$setflags(r0, 0x2, 0x1) getsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER_VALUE(0xffffffffffffffff, 0x84, 0x7c, &(0x7f00000001c0), &(0x7f0000000240)=0x8) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(0xffffffffffffffff, 0x84, 0x9, &(0x7f0000000280)={0x0, @in={{0x2, 0x4e23, @remote}}, 0xfffffffffffffff7, 0x0, 0x400}, 0x98) sendto$inet6(0xffffffffffffffff, &(0x7f00000004c0), 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) setsockopt$SO_BINDTODEVICE(0xffffffffffffffff, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x4) socket$inet6(0xa, 0x1000000000002, 0x0) r1 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x4, 0x0, &(0x7f0000000100)=[@enter_looper], 0x1, 0x0, &(0x7f0000000180)='T'}) r2 = gettid() timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, &(0x7f0000040000)) tkill(r2, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0xfffffffffffffced, 0x0, &(0x7f0000000040)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x0, 0x0, &(0x7f00000000c0), 0x0, 0x0, &(0x7f0000000f4d)}) 12:34:12 executing program 5: r0 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000240)='/dev/vhost-vsock\x00', 0x2, 0x0) preadv(r0, &(0x7f0000001380)=[{&(0x7f00000000c0)=""/148, 0x74}], 0x0, 0x0) pipe2(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80000) ioctl$KVM_DEASSIGN_DEV_IRQ(r2, 0x4040ae75, &(0x7f0000000040)={0x1f, 0xadd0, 0x5}) r3 = syz_open_procfs(0x0, &(0x7f0000000340)="696f001b66408225aaa3af068fffebb8a490c47dda6586f1b58895b94a78037dd3714e7198820a7a709e2d30d25e6d846cd5c62a648a598668a8263b752b0b622b115112b5ad8e0425c0b784bbdb89eb8f4da0dd73dd01fe35694c2f78600badf8a0e237dba40713bac9e053b41a9f62be5fbb928018aab5f7500bef51a2fd74d4fffb4a20a946733820bdc1b485afa417cdbcfdfbc54f58c9c3edffe240c36f4ab8a16613814e226b6d20d98010ab1ace49fa76dce337a5a5f1dcff9e5d533b12475e33b971b15b69cd591cd9059759f0f04ba5468a34b98915033debb3e87f048e8601712659d47d8687eb6be5e650068d88000000000000") preadv(r3, &(0x7f0000000480), 0x10000000000002a1, 0x0) setsockopt$inet6_udp_int(r1, 0x11, 0x6f, &(0x7f0000000080)=0x3, 0x159) 12:34:12 executing program 4: socket$inet6(0xa, 0x0, 0x80000000) sched_setaffinity(0x0, 0x7, &(0x7f00000000c0)=0x9) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0) fcntl$setflags(0xffffffffffffffff, 0x2, 0x1) r0 = socket$inet6(0xa, 0x400000000001, 0x0) r1 = dup(r0) setsockopt$inet6_tcp_int(r1, 0x6, 0x12, &(0x7f0000000000)=0x7f, 0x4) bind$inet6(r0, &(0x7f0000000040)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) getsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER_VALUE(r0, 0x84, 0x7c, &(0x7f00000001c0)={0x0, 0x0, 0x6}, &(0x7f0000000240)=0x8) sendto$inet6(r0, &(0x7f00000004c0), 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x4) socket$inet6(0xa, 0x0, 0x0) r2 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000200)={0x4, 0x0, &(0x7f0000000100)=[@enter_looper], 0x1, 0x0, &(0x7f0000000180)='T'}) r3 = gettid() timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, &(0x7f0000040000)) tkill(r3, 0x1004000000016) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0xfffffffffffffced, 0x0, &(0x7f0000000040)}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x400c630f}], 0x0, 0x0, &(0x7f0000000f4d)}) 12:34:12 executing program 2: perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f0000000180)=""/148, 0x13d}], 0x1, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000340)="696f001b66408225aaa3af068fffebb8a490c47dda6586f1b58895b94a78037dd3714e7198820a7a709e2d30d25e6d846cd5c62a648a598668a8263b752b0b622b115112b5ad8e0425c0b784bbdb89eb8f4da0dd73dd01fe35694c2f78600badf8a0e237dba40713bac9e053b41a9f62be5fbb928018aab5f7500bef51a2fd74d4fffb4a20a946733820bdc1b485afa417cdbcfdfbc54f58c9c3edffe240c36f4ab8a16613814e226b6d20d98010ab1ace49fa76dce337a5a5f1dcff9e5d533b12475e33b971b15b69cd591cd9059759f0f04ba5468a34b98915033debb3e87f048e8601712659d47d8687eb6be5e650068d88000000000000") preadv(r0, &(0x7f0000000480), 0x100000000000012d, 0x0) msgget$private(0x0, 0x22) 12:34:12 executing program 1: preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f0000000180)=""/148, 0x13d}], 0x1, 0x0) r0 = openat$vsock(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vsock\x00', 0x0, 0x0) setsockopt$XDP_RX_RING(r0, 0x11b, 0x2, &(0x7f0000000040)=0x80, 0x4) r1 = syz_open_procfs(0x0, &(0x7f0000000340)="696f001b66408225aaa3af068fffebb8a490c47dda6586f1b58895b94a78037dd3714e7198820a7a709e2d30d25e6d846cd5c62a648a598668a8263b752b0b622b115112b5ad8e0425c0b784bbdb89eb8f4da0dd73dd01fe35694c2f78600badf8a0e237dba40713bac9e053b41a9f62be5fbb928018aab5f7500bef51a2fd74d4fffb4a20a946733820bdc1b485afa417cdbcfdfbc54f58c9c3edffe240c36f4ab8a16613814e226b6d20d98010ab1ace49fa76dce337a5a5f1dcff9e5d533b12475e33b971b15b69cd591cd9059759f0f04ba5468a34b98915033debb3e87f048e8601712659d47d8687eb6be5e650068d88000000000000") read$FUSE(r1, &(0x7f00000013c0), 0x1000) preadv(r1, &(0x7f0000000480), 0x10000000000002a1, 0x0) 12:34:12 executing program 3: socket$inet6(0xa, 0x0, 0x80000000) sched_setaffinity(0x0, 0x7, &(0x7f00000000c0)=0x9) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0) fcntl$setflags(0xffffffffffffffff, 0x2, 0x1) r0 = socket$inet6(0xa, 0x400000000001, 0x0) r1 = dup(r0) setsockopt$inet6_tcp_int(r1, 0x6, 0x12, &(0x7f0000000000)=0x7f, 0x4) bind$inet6(r0, &(0x7f0000000040)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) getsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER_VALUE(r0, 0x84, 0x7c, &(0x7f00000001c0)={0x0, 0x0, 0x6}, &(0x7f0000000240)=0x8) sendto$inet6(r0, &(0x7f00000004c0), 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) setsockopt$SO_BINDTODEVICE(0xffffffffffffffff, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x4) socket$inet6(0xa, 0x1000000000002, 0x0) r2 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000200)={0x4, 0x0, &(0x7f0000000100)=[@enter_looper], 0x1, 0x0, &(0x7f0000000180)='T'}) r3 = gettid() timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, &(0x7f0000040000)) tkill(r3, 0x1004000000016) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0xfffffffffffffced, 0x0, &(0x7f0000000040)}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x400c630f}], 0x0, 0x0, &(0x7f0000000f4d)}) 12:34:12 executing program 1: preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f0000000180)=""/148, 0x13d}], 0x1, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000340)="696f001b66408225aaa3af068fffebb8a490c47dda6586f1b58895b94a78037dd3714e7198820a7a709e2d30d25e6d846cd5c62a648a598668a8263b752b0b622b115112b5ad8e0425c0b784bbdb89eb8f4da0dd73dd01fe35694c2f78600badf8a0e237dba40713bac9e053b41a9f62be5fbb928018aab5f7500bef51a2fd74d4fffb4a20a946733820bdc1b485afa417cdbcfdfbc54f58c9c3edffe240c36f4ab8a16613814e226b6d20d98010ab1ace49fa76dce337a5a5f1dcff9e5d533b12475e33b971b15b69cd591cd9059759f0f04ba5468a34b98915033debb3e87f048e8601712659d47d8687eb6be5e650068d88000000000000") preadv(r0, &(0x7f0000000000), 0x0, 0x0) [ 474.875503] binder: BINDER_SET_CONTEXT_MGR already set [ 474.882324] binder: 24835:24836 ioctl 40046207 0 returned -16 [ 474.906179] binder: BINDER_SET_CONTEXT_MGR already set 12:34:12 executing program 2: perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f0000000180)=""/148, 0x13d}], 0x1, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000340)="696f001b66408225aaa3af068fffebb8a490c47dda6586f1b58895b94a78037dd3714e7198820a7a709e2d30d25e6d846cd5c62a648a598668a8263b752b0b622b115112b5ad8e0425c0b784bbdb89eb8f4da0dd73dd01fe35694c2f78600badf8a0e237dba40713bac9e053b41a9f62be5fbb928018aab5f7500bef51a2fd74d4fffb4a20a946733820bdc1b485afa417cdbcfdfbc54f58c9c3edffe240c36f4ab8a16613814e226b6d20d98010ab1ace49fa76dce337a5a5f1dcff9e5d533b12475e33b971b15b69cd591cd9059759f0f04ba5468a34b98915033debb3e87f048e8601712659d47d8687eb6be5e650068d88000000000000") preadv(r0, &(0x7f0000000480), 0x1000000000000097, 0x0) msgget$private(0x0, 0x22) [ 474.921256] binder: 24827:24843 ioctl 40046207 0 returned -16 [ 474.935971] binder: 24835:24846 Acquire 1 refcount change on invalid ref 0 ret -22 [ 474.954309] binder: 24835:24846 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 474.966106] binder: 24827:24829 Acquire 1 refcount change on invalid ref 0 ret -22 12:34:12 executing program 1: preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f0000000180)=""/148, 0x13d}], 0x1, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000340)="696f001b66408225aaa3af068fffebb8a490c47dda6586f1b58895b94a78037dd3714e7198820a7a709e2d30d25e6d846cd5c62a648a598668a8263b752b0b622b115112b5ad8e0425c0b784bbdb89eb8f4da0dd73dd01fe35694c2f78600badf8a0e237dba40713bac9e053b41a9f62be5fbb928018aab5f7500bef51a2fd74d4fffb4a20a946733820bdc1b485afa417cdbcfdfbc54f58c9c3edffe240c36f4ab8a16613814e226b6d20d98010ab1ace49fa76dce337a5a5f1dcff9e5d533b12475e33b971b15b69cd591cd9059759f0f04ba5468a34b98915033debb3e87f048e8601712659d47d8687eb6be5e650068d88000000000000") preadv(r0, &(0x7f0000000600)=[{&(0x7f0000000680)=""/240}, {&(0x7f0000000240)=""/236, 0xffffffffffffff6e}, {&(0x7f0000000440)=""/164}, {&(0x7f0000000100)=""/1}, {&(0x7f0000000140)=""/53}, {&(0x7f0000000500)=""/115}, {&(0x7f0000000580)=""/127}], 0xbabf4a3daf85dd8, 0x0) 12:34:12 executing program 5: preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f0000000180)=""/148, 0x13d}], 0x196, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000340)="696f001b66408225aaa3af068fffebb8a490c47dda6586f1b58895b94a78037dd3714e7198820a7a709e2d30d25e6d846cd5c62a648a598668a8263b752b0b622b115112b5ad8e0425c0b784bbdb89eb8f4da0dd73dd01fe35694c2f78600badf8a0e237dba40713bac9e053b41a9f62be5fbb928018aab5f7500bef51a2fd74d4fffb4a20a946733820bdc1b485afa417cdbcfdfbc54f58c9c3edffe240c36f4ab8a16613814e226b6d20d98010ab1ace49fa76dce337a5a5f1dcff9e5d533b12475e33b971b15b69cd591cd9059759f0f04ba5468a34b98915033debb3e87f048e8601712659d47d8687eb6be5e650068d88000000000000") preadv(r0, &(0x7f0000000480), 0x10000000000002a1, 0x0) 12:34:12 executing program 3: syz_open_dev$sndctrl(&(0x7f0000000140)='/dev/snd/controlC#\x00', 0x0, 0x0) sched_setaffinity(0x0, 0x7, &(0x7f00000000c0)=0x9) r0 = perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0) fcntl$setflags(r0, 0x2, 0x1) getsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER_VALUE(0xffffffffffffffff, 0x84, 0x7c, &(0x7f00000001c0), &(0x7f0000000240)=0x8) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(0xffffffffffffffff, 0x84, 0x9, &(0x7f0000000280)={0x0, @in={{0x2, 0x4e23, @remote}}, 0xfffffffffffffff7, 0x0, 0x400}, 0x98) sendto$inet6(0xffffffffffffffff, &(0x7f00000004c0), 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) setsockopt$SO_BINDTODEVICE(0xffffffffffffffff, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x4) socket$inet6(0xa, 0x1000000000002, 0x0) r1 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x4, 0x0, &(0x7f0000000100)=[@enter_looper], 0x1, 0x0, &(0x7f0000000180)='T'}) r2 = gettid() timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, &(0x7f0000040000)) tkill(r2, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0xfffffffffffffced, 0x0, &(0x7f0000000040)}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x400c630f}], 0x0, 0x0, &(0x7f0000000f4d)}) [ 474.974315] binder: 24827:24829 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 475.011885] binder: 24827:24843 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 12:34:12 executing program 1: preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f0000000180)=""/148, 0x13d}], 0x1, 0x0) r0 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000040)='attr\x00') getsockopt$bt_sco_SCO_OPTIONS(r0, 0x11, 0x1, &(0x7f0000000080)=""/173, &(0x7f0000000140)=0xad) r1 = syz_open_procfs(0x0, &(0x7f0000000340)="696f001b66408225aaa3af068fffebb8a490c47dda6586f1b58895b94a78037dd3714e7198820a7a709e2d30d25e6d846cd5c62a648a598668a8263b752b0b622b115112b5ad8e0425c0b784bbdb89eb8f4da0dd73dd01fe35694c2f78600badf8a0e237dba40713bac9e053b41a9f62be5fbb928018aab5f7500bef51a2fd74d4fffb4a20a946733820bdc1b485afa417cdbcfdfbc54f58c9c3edffe240c36f4ab8a16613814e226b6d20d98010ab1ace49fa76dce337a5a5f1dcff9e5d533b12475e33b971b15b69cd591cd9059759f0f04ba5468a34b98915033debb3e87f048e8601712659d47d8687eb6be5e650068d88000000000000") ioctl$RTC_PLL_SET(r1, 0x40207012, &(0x7f0000000000)={0x4, 0x6, 0xf768, 0x5, 0x7ff, 0xffffffffffff7ffd, 0x3}) preadv(r1, &(0x7f0000000480), 0x10000000000002a1, 0x0) 12:34:13 executing program 4: socket$inet6(0xa, 0x0, 0x80000000) sched_setaffinity(0x0, 0x7, &(0x7f00000000c0)=0x9) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0) fcntl$setflags(0xffffffffffffffff, 0x2, 0x1) r0 = socket$inet6(0xa, 0x400000000001, 0x0) r1 = dup(r0) setsockopt$inet6_tcp_int(r1, 0x6, 0x12, &(0x7f0000000000)=0x7f, 0x4) bind$inet6(r0, &(0x7f0000000040)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) getsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER_VALUE(r0, 0x84, 0x7c, &(0x7f00000001c0)={0x0, 0x0, 0x6}, &(0x7f0000000240)=0x8) sendto$inet6(r0, &(0x7f00000004c0), 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x4) socket$inet6(0xa, 0x1000000000002, 0x0) r2 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000200)={0x4, 0x0, &(0x7f0000000100)=[@enter_looper], 0x1, 0x0, &(0x7f0000000180)='T'}) r3 = gettid() timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, &(0x7f0000040000)) tkill(r3, 0x1004000000016) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0xfffffffffffffced, 0x0, &(0x7f0000000040)}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x400c630f}], 0x0, 0x0, &(0x7f0000000f4d)}) 12:34:13 executing program 2: perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f0000000180)=""/148, 0x13d}], 0x1, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000340)="696f001b66408225aaa3af068fffebb8a490c47dda6586f1b58895b94a78037dd3714e7198820a7a709e2d30d25e6d846cd5c62a648a598668a8263b752b0b622b115112b5ad8e0425c0b784bbdb89eb8f4da0dd73dd01fe35694c2f78600badf8a0e237dba40713bac9e053b41a9f62be5fbb928018aab5f7500bef51a2fd74d4fffb4a20a946733820bdc1b485afa417cdbcfdfbc54f58c9c3edffe240c36f4ab8a16613814e226b6d20d98010ab1ace49fa76dce337a5a5f1dcff9e5d533b12475e33b971b15b69cd591cd9059759f0f04ba5468a34b98915033debb3e87f048e8601712659d47d8687eb6be5e650068d88000000000000") preadv(r0, &(0x7f0000000480), 0x10000000000000ea, 0x0) msgget$private(0x0, 0x22) 12:34:13 executing program 1: preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f0000000180)=""/148, 0x13d}], 0x1, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000340)="696f001b66408225aaa3af068fffebb8a490c47dda6586f1b58895b94a78037dd3714e7198820a7a709e2d30d25e6d846cd5c62a648a598668a8263b752b0b622b115112b5ad8e0425c0b784bbdb89eb8f4da0dd73dd01fe35694c2f78600badf8a0e237dba40713bac9e053b41a9f62be5fbb928018aab5f7500bef51a2fd74d4fffb4a20a946733820bdc1b485afa417cdbcfdfbc54f58c9c3edffe240c36f4ab8a16613814e226b6d20d98010ab1ace49fa76dce337a5a5f1dcff9e5d533b12475e33b971b15b69cd591cd9059759f0f04ba5468a34b98915033debb3e87f048e8601712659d47d8687eb6be5e650068d88000000000000") preadv(r0, &(0x7f0000000480), 0x10000000000002a1, 0x0) fcntl$setlease(r0, 0x400, 0x0) getpid() ioctl$TUNSETFILTEREBPF(r0, 0x800454e1, &(0x7f0000000000)=r0) 12:34:13 executing program 5: preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f0000000180)=""/148, 0x13d}], 0x1, 0x0) r0 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000840)='/dev/rtc0\x00', 0x201, 0x0) fsetxattr$trusted_overlay_upper(r0, &(0x7f0000000040)='trusted.overlay.upper\x00', &(0x7f00000006c0)=ANY=[@ANYRESOCT=r0], 0x1, 0xfffffffffffffffe) ioctl$SCSI_IOCTL_GET_IDLUN(r0, 0x5382, &(0x7f0000000800)) r1 = getpid() r2 = syz_open_procfs(r1, &(0x7f0000000340)='loginuid\x00') epoll_ctl$EPOLL_CTL_MOD(r2, 0x3, r2, &(0x7f0000000700)={0xa}) pwritev(r0, &(0x7f00000007c0)=[{&(0x7f0000000240)="3f3cdd60bd12087668862fe80079a8a4c3d7bfcfaeb89ef188ecf152d74d228312e6e6292d73d8be319f11bff706d25db7ea738a10a282cea4c701c6679b3ad0905f99a8e0ff27b012b367", 0x4b}, {&(0x7f00000002c0)="4c94e56f6eaf0d10836fa57123adae310374fe6e6295ad42a102da8712efb6374e2ec4d49432b204e0d79127e8c9626c52bf81b10536736460fd2e8d5d659a004947c7575db648d8f196d698e867fb0287cf2c012f95ed8122752f371cd41c5f88947e95183d3820f564b564bba2c82234c093d9fa3d2b0f8be1d0bda5cd913f", 0x80}, {&(0x7f0000000000)="7b8553229df588f324f0645e399e727ec04b1099265a7c01e73db58d6b86399d882d562b2fb70263492655a2593219944d32a6", 0x33}, {&(0x7f0000000600)="4ef7b8bc6b5b8da83013", 0xa}], 0x4, 0x0) ioctl$KVM_REINJECT_CONTROL(r2, 0xae71, &(0x7f0000000080)={0x5}) preadv(r0, &(0x7f0000000640)=[{&(0x7f00000000c0)=""/156, 0x9c}, {&(0x7f0000000380)=""/219, 0xffffffffffffff22}, {&(0x7f0000000480)=""/102, 0x66}, {&(0x7f0000000500)=""/205, 0xcd}, {&(0x7f0000000600)}], 0x5, 0x0) 12:34:13 executing program 0: socket$inet6(0xa, 0x0, 0x80000000) sched_setaffinity(0x0, 0x7, &(0x7f00000000c0)=0x9) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0) fcntl$setflags(0xffffffffffffffff, 0x2, 0x1) r0 = socket$inet6(0xa, 0x400000000001, 0x0) r1 = dup(r0) setsockopt$inet6_tcp_int(r1, 0x6, 0x12, &(0x7f0000000000)=0x7f, 0x4) bind$inet6(r0, &(0x7f0000000040)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) getsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER_VALUE(r0, 0x84, 0x7c, &(0x7f00000001c0)={0x0, 0x0, 0x6}, &(0x7f0000000240)=0x8) sendto$inet6(r0, &(0x7f00000004c0), 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x0, 0x0, @loopback}, 0x1c) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x4) socket$inet6(0xa, 0x1000000000002, 0x0) r2 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000200)={0x4, 0x0, &(0x7f0000000100)=[@enter_looper], 0x1, 0x0, &(0x7f0000000180)='T'}) r3 = gettid() timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, &(0x7f0000040000)) tkill(r3, 0x1004000000016) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0xfffffffffffffced, 0x0, &(0x7f0000000040)}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x400c630f}], 0x0, 0x0, &(0x7f0000000f4d)}) 12:34:13 executing program 1: preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f0000000180)=""/148, 0x94}], 0x1, 0x2) r0 = syz_open_procfs(0x0, &(0x7f0000000340)="696f001b66408225aaa3af068fffebb8a490c47dda6586f1b58895b94a78037dd3714e7198820a7a709e2d30d25e6d846cd5c62a648a598668a8263b752b0b622b115112b5ad8e0425c0b784bbdb89eb8f4da0dd73dd01fe35694c2f78600badf8a0e237dba40713bac9e053b41a9f62be5fbb928018aab5f7500bef51a2fd74d4fffb4a20a946733820bdc1b485afa417cdbcfdfbc54f58c9c3edffe240c36f4ab8a16613814e226b6d20d98010ab1ace49fa76dce337a5a5f1dcff9e5d533b12475e33b971b15b69cd591cd9059759f0f04ba5468a34b98915033debb3e87f048e8601712659d47d8687eb6be5e650068d88000000000000") preadv(r0, &(0x7f0000000480), 0x10000000000002a1, 0x0) 12:34:13 executing program 5: preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f0000000180)=""/148, 0x13d}], 0x1, 0x0) r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000680)='/dev/hwrng\x00', 0x40000, 0x0) write$FUSE_GETXATTR(r0, &(0x7f00000006c0)={0x18, 0x0, 0x7, {0x80000000}}, 0xffffffffffffff7e) r1 = syz_open_procfs(0x0, &(0x7f0000000340)="696f001b66408225aaa3af068fffebb8a490c47dda6586f1b58895b94a78037dd3714e7198820a7a709e2d30d25e6d846cd5c62a648a598668a8263b752b0b622b115112b5ad8e0425c0b784bbdb89eb8f4da0dd73dd01fe35694c2f78600badf8a0e237dba40713bac9e053b41a9f62be5fbb928018aab5f7500bef51a2fd74d4fffb4a20a946733820bdc1b485afa417cdbcfdfbc54f58c9c3edffe240c36f4ab8a16613814e226b6d20d98010ab1ace49fa76dce337a5a5f1dcff9e5d533b12475e33b971b15b69cd591cd9059759f0f04ba5468a34b98915033debb3e87f048e8601712659d47d8687eb6be5e650068d88000000000000") setsockopt$inet6_int(r1, 0x29, 0x8, &(0x7f0000000700)=0x9, 0x4) preadv(r1, &(0x7f0000000480), 0x10000000000002a1, 0x0) socketpair$inet6_sctp(0xa, 0x1, 0x84, &(0x7f0000000140)) syz_mount_image$bfs(&(0x7f0000000000)='bfs\x00', &(0x7f0000000040)='./file0\x00', 0x6, 0x6, &(0x7f00000005c0)=[{&(0x7f0000000080)="23ed7cfef218018e59f373d627c48c08fb55fad7", 0x14, 0x10000}, {&(0x7f00000000c0)="a989beb02d11cd9407979d638821c2720d1e3f1d8c4265e5fa458ec0744d721be4ff7dc08c426303cfda7e4feb556986b0d09f40b406f1916591af06f23919614a13b8d00bce0ebbf3936ae3eb01b8975a3cdd84ecac00bbb75671e141f87fc2be8a97608bc38dd1bea7665817abff", 0x6f, 0x8}, {&(0x7f0000000240)="24a79cf565f7af5dddcc8a91035a4b41fcdfb3b9cb1d719afbf0b9febfaf4d534f7a6f243b9e0f13c2276cf375ca93cadd5349d2f3826bb1182f09e2e275655ec73b1c73d964b68bc1f40629e896096881b9b379d0c168a748", 0x59, 0xffffffffffff0000}, {&(0x7f0000000440)="4a0f8551cf968e1c0381e5d1375e5e508a3c2bbd30f495437e6287aefe1f80c1bcc98f1f5b0e10f754eca1a335fafea50e548f4b02ad53038ef82c5f3b225104ac09c1113653c5e60b8da1b3398407e7d4cca1af2b85c149a8d311f23f4743db610166184ec1bc453181a476286b518e941e0d6b8c3a62a8126a168653a70052ca2c524ae6043f67863d0c1ad92e2331e78e8eb65e5708573d1fb09ec3e48236730b22fadfce3361b020c35ca768af896db30ac5419c0512be0d89ae", 0xbc, 0x3}, {&(0x7f0000000500)="81d0d39a6238be0bc0e67aaaf6700c79539c7f4861097ca220bef99556ac1b19d70d0b4a499e30151c912ed289132c96d01118692419209b250d1dd870f01e70147471357de1a535bded7d9063147ae186c0c67b438ab677d7458cd1ab6bc29fe5af0b6498142383df93cb408eaf88a65c2116f8bcb1fd971054730b48378ffb5effa94d33d1069aca7506e37598ab01097dd04461e5b3978d39cbdda400d2058e72124c395eccc18ef1315f4569baf4daee7586494d2cd79f4e1d", 0xbb, 0x6}, {&(0x7f00000002c0)="fce3ec66c2982754e8ae98ef2eb4740c58115ea7a4c94f80bf2868bfa703dc297a3b07d4feacf201c7b35cb4c3f77764657e0401f1d5ca4d39ce413973a544dea2e718cb8f1857bc29d286d28ac8bd3a682ed740bcabb8c1a1320168514e72d35f3ed2f86a0765ad90b83cbd0533c5d6ae2791", 0x73, 0x1000}], 0x8001, 0x0) 12:34:13 executing program 2: perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f0000000180)=""/148, 0x13d}], 0x1, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000340)="696f001b66408225aaa3af068fffebb8a490c47dda6586f1b58895b94a78037dd3714e7198820a7a709e2d30d25e6d846cd5c62a648a598668a8263b752b0b622b115112b5ad8e0425c0b784bbdb89eb8f4da0dd73dd01fe35694c2f78600badf8a0e237dba40713bac9e053b41a9f62be5fbb928018aab5f7500bef51a2fd74d4fffb4a20a946733820bdc1b485afa417cdbcfdfbc54f58c9c3edffe240c36f4ab8a16613814e226b6d20d98010ab1ace49fa76dce337a5a5f1dcff9e5d533b12475e33b971b15b69cd591cd9059759f0f04ba5468a34b98915033debb3e87f048e8601712659d47d8687eb6be5e650068d88000000000000") preadv(r0, &(0x7f0000000480), 0x10000000000000ab, 0x0) msgget$private(0x0, 0x22) [ 475.790183] binder: BINDER_SET_CONTEXT_MGR already set [ 475.826381] binder: 24884:24885 ioctl 40046207 0 returned -16 12:34:13 executing program 4: socket$inet6(0xa, 0x0, 0x80000000) sched_setaffinity(0x0, 0x7, &(0x7f00000000c0)=0x9) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0) fcntl$setflags(0xffffffffffffffff, 0x2, 0x1) r0 = socket$inet6(0xa, 0x400000000001, 0x0) r1 = dup(r0) setsockopt$inet6_tcp_int(r1, 0x6, 0x12, &(0x7f0000000000)=0x7f, 0x4) bind$inet6(r0, &(0x7f0000000040)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) getsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER_VALUE(r0, 0x84, 0x7c, &(0x7f00000001c0)={0x0, 0x0, 0x6}, &(0x7f0000000240)=0x8) sendto$inet6(r0, &(0x7f00000004c0), 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x4) socket$inet6(0xa, 0x1000000000002, 0x0) r2 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000200)={0x4, 0x0, &(0x7f0000000100)=[@enter_looper], 0x1, 0x0, &(0x7f0000000180)='T'}) r3 = gettid() timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, &(0x7f0000040000)) tkill(r3, 0x1004000000016) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0xfffffffffffffced, 0x0, &(0x7f0000000040)}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x400c630f}], 0x0, 0x0, &(0x7f0000000f4d)}) 12:34:13 executing program 1: ioctl$KVM_CREATE_DEVICE(0xffffffffffffff9c, 0xc00caee0, &(0x7f0000000040)={0x6, 0xffffffffffffff9c}) r0 = accept$inet6(0xffffffffffffffff, 0x0, &(0x7f0000000080)) preadv(r0, &(0x7f0000000000)=[{&(0x7f0000000180)=""/148, 0x94}], 0x1, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000340)="696f001b66408225aaa3af068fffebb8a490c47dda6586f1b58895b94a78037dd3714e7198820a7a709e2d30d25e6d846cd5c62a648a598668a8263b752b0b622b115112b5ad8e0425c0b784bbdb89eb8f4da0dd73dd01fe35694c2f78600badf8a0e237dba40713bac9e053b41a9f62be5fbb928018aab5f7500bef51a2fd74d4fffb4a20a946733820bdc1b485afa417cdbcfdfbc54f58c9c3edffe240c36f4ab8a16613814e226b6d20d98010ab1ace49fa76dce337a5a5f1dcff9e5d533b12475e33b971b15b69cd591cd9059759f0f04ba5468a34b98915033debb3e87f048e8601712659d47d8687eb6be5e650068d88000000000000") preadv(r1, &(0x7f0000000480), 0x10000000000002a1, 0x0) 12:34:13 executing program 3: socket$inet6(0xa, 0x0, 0x80000000) sched_setaffinity(0x0, 0x7, &(0x7f00000000c0)=0x9) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0) fcntl$setflags(0xffffffffffffffff, 0x2, 0x1) r0 = socket$inet6(0xa, 0x400000000001, 0x0) r1 = dup(r0) setsockopt$inet6_tcp_int(r1, 0x6, 0x12, &(0x7f0000000000)=0x7f, 0x4) bind$inet6(r0, &(0x7f0000000040)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) getsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER_VALUE(r0, 0x84, 0x7c, &(0x7f00000001c0)={0x0, 0x0, 0x6}, &(0x7f0000000240)=0x8) sendto$inet6(r0, &(0x7f00000004c0), 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x4) socket$inet6(0xa, 0x1000000000002, 0x0) r2 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000200)={0x4, 0x0, &(0x7f0000000100)=[@enter_looper], 0x1, 0x0, &(0x7f0000000180)='T'}) r3 = gettid() timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, &(0x7f0000040000)) tkill(r3, 0x1004000000016) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0xfffffffffffffced, 0x0, &(0x7f0000000040)}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x400c630f}], 0x0, 0x0, &(0x7f0000000f4d)}) 12:34:13 executing program 2: perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f0000000180)=""/148, 0x13d}], 0x1, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000340)="696f001b66408225aaa3af068fffebb8a490c47dda6586f1b58895b94a78037dd3714e7198820a7a709e2d30d25e6d846cd5c62a648a598668a8263b752b0b622b115112b5ad8e0425c0b784bbdb89eb8f4da0dd73dd01fe35694c2f78600badf8a0e237dba40713bac9e053b41a9f62be5fbb928018aab5f7500bef51a2fd74d4fffb4a20a946733820bdc1b485afa417cdbcfdfbc54f58c9c3edffe240c36f4ab8a16613814e226b6d20d98010ab1ace49fa76dce337a5a5f1dcff9e5d533b12475e33b971b15b69cd591cd9059759f0f04ba5468a34b98915033debb3e87f048e8601712659d47d8687eb6be5e650068d88000000000000") preadv(r0, &(0x7f0000000480), 0x100000000000003b, 0x0) msgget$private(0x0, 0x22) 12:34:13 executing program 0: socket$inet6(0xa, 0x0, 0x80000000) sched_setaffinity(0x0, 0x7, &(0x7f00000000c0)=0x9) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0) fcntl$setflags(0xffffffffffffffff, 0x2, 0x1) r0 = socket$inet6(0xa, 0x400000000001, 0x0) r1 = dup(r0) setsockopt$inet6_tcp_int(r1, 0x6, 0x12, &(0x7f0000000000)=0x7f, 0x4) bind$inet6(r0, &(0x7f0000000040)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) getsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER_VALUE(r0, 0x84, 0x7c, &(0x7f00000001c0)={0x0, 0x0, 0x6}, &(0x7f0000000240)=0x8) sendto$inet6(r0, &(0x7f00000004c0), 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x4) socket$inet6(0xa, 0x1000000000002, 0x0) r2 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000200)={0x4, 0x0, &(0x7f0000000100)=[@enter_looper], 0x1, 0x0, &(0x7f0000000180)='T'}) r3 = gettid() timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, &(0x7f0000040000)) tkill(r3, 0x1004000000016) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0xfffffffffffffced, 0x0, &(0x7f0000000040)}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x400c630f}], 0x0, 0x0, &(0x7f0000000f4d)}) 12:34:13 executing program 5: preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f0000000180)=""/148, 0x13d}], 0x1, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000340)="696f001b66408225aaa3af068fffebb8a490c47dda6586f1b58895b94a78037dd3714e7198820a7a709e2d30d25e6d846cd5c62a648a598668a8263b752b0b622b115112b5ad8e0425c0b784bbdb89eb8f4da0dd73dd01fe35694c2f78600badf8a0e237dba40713bac9e053b41a9f62be5fbb928018aab5f7500bef51a2fd74d4fffb4a20a946733820bdc1b485afa417cdbcfdfbc54f58c9c3edffe240c36f4ab8a16613814e226b6d20d98010ab1ace49fa76dce337a5a5f1dcff9e5d533b12475e33b971b15b69cd591cd9059759f0f04ba5468a34b98915033debb3e87f048e8601712659d47d8687eb6be5e650068d88000000000000") openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vhost-vsock\x00', 0x2, 0x0) preadv(r0, &(0x7f0000000480), 0x10000000000002a1, 0x0) 12:34:13 executing program 1: preadv(0xffffffffffffffff, &(0x7f0000000040)=[{&(0x7f0000000180)=""/148, 0x94}], 0x1, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000340)="696f001b66408225aaa3af068fffebb8a490c47dda6586f1b58895b94a78037dd3714e7198820a7a709e2d30d25e6d846cd5c62a648a598668a8263b752b0b622b115112b5ad8e0425c0b784bbdb89eb8f4da0dd73dd01fe35694c2f78600badf8a0e237dba40713bac9e053b41a9f62be5fbb928018aab5f7500bef51a2fd74d4fffb4a20a946733820bdc1b485afa417cdbcfdfbc54f58c9c3edffe240c36f4ab8a16613814e226b6d20d98010ab1ace49fa76dce337a5a5f1dcff9e5d533b12475e33b971b15b69cd591cd9059759f0f04ba5468a34b98915033debb3e87f048e8601712659d47d8687eb6be5e650068d88000000000000") preadv(r0, &(0x7f0000000480), 0x10000000000002a1, 0x0) 12:34:13 executing program 2: perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f0000000180)=""/148, 0x13d}], 0x1, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000340)="696f001b66408225aaa3af068fffebb8a490c47dda6586f1b58895b94a78037dd3714e7198820a7a709e2d30d25e6d846cd5c62a648a598668a8263b752b0b622b115112b5ad8e0425c0b784bbdb89eb8f4da0dd73dd01fe35694c2f78600badf8a0e237dba40713bac9e053b41a9f62be5fbb928018aab5f7500bef51a2fd74d4fffb4a20a946733820bdc1b485afa417cdbcfdfbc54f58c9c3edffe240c36f4ab8a16613814e226b6d20d98010ab1ace49fa76dce337a5a5f1dcff9e5d533b12475e33b971b15b69cd591cd9059759f0f04ba5468a34b98915033debb3e87f048e8601712659d47d8687eb6be5e650068d88000000000000") preadv(r0, &(0x7f0000000480), 0x100000000000016e, 0x0) msgget$private(0x0, 0x22) [ 476.134564] binder: BINDER_SET_CONTEXT_MGR already set [ 476.154406] binder: 24918:24923 ioctl 40046207 0 returned -16 12:34:13 executing program 1: preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f0000000180)=""/148, 0x13d}], 0x1, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000340)="696f001b66408225aaa3af068fffebb8a490c47dda6586f1b58895b94a78037dd3714e7198820a7a709e2d30d25e6d846cd5c62a648a598668a8263b752b0b622b115112b5ad8e0425c0b784bbdb89eb8f4da0dd73dd01fe35694c2f78600badf8a0e237dba40713bac9e053b41a9f62be5fbb928018aab5f7500bef51a2fd74d4fffb4a20a946733820bdc1b485afa417cdbcfdfbc54f58c9c3edffe240c36f4ab8a16613814e226b6d20d98010ab1ace49fa76dce337a5a5f1dcff9e5d533b12475e33b971b15b69cd591cd9059759f0f04ba5468a34b98915033debb3e87f048e8601712659d47d8687eb6be5e650068d88000000000000") preadv(r0, &(0x7f0000000480), 0x10000000000002a1, 0x0) getsockopt$IP6T_SO_GET_ENTRIES(r0, 0x29, 0x41, &(0x7f0000000000)={'nat\x00', 0x51, "79eacb80f269259d378e93e3da2ef0cf7a2ef864f07dd072d0d699e22625ef245226ef64f6c2a1067e89f7d2cf818df6c74cb1e2c6c3eb15a5cc1fbc1672f8508040cbcc85670377880623ed8b51abd57b"}, &(0x7f0000000080)=0x75) 12:34:13 executing program 5: socket$xdp(0x2c, 0x3, 0x0) r0 = socket$kcm(0x29, 0x2, 0x0) preadv(r0, &(0x7f0000001380)=[{&(0x7f0000000180)=""/148, 0x94}], 0x1, 0x4) r1 = syz_open_procfs(0x0, &(0x7f0000000340)="696f001b66408225aaa3af068fffebb8a490c47dda6586f1b58895b94a78037dd3714e7198820a7a709e2d30d25e6d846cd5c62a648a598668a8263b752b0b622b115112b5ad8e0425c0b784bbdb89eb8f4da0dd73dd01fe35694c2f78600badf8a0e237dba40713bac9e053b41a9f62be5fbb928018aab5f7500bef51a2fd74d4fffb4a20a946733820bdc1b485afa417cdbcfdfbc54f58c9c3edffe240c36f4ab8a16613814e226b6d20d98010ab1ace49fa76dce337a5a5f1dcff9e5d533b12475e33b971b15b69cd591cd9059759f0f04ba5468a34b98915033debb3e87f048e8601712659d47d8687eb6be5e650068d88000000000000") preadv(r1, &(0x7f0000000480), 0x10000000000002a1, 0x0) 12:34:13 executing program 3: syz_open_dev$sndctrl(&(0x7f0000000140)='/dev/snd/controlC#\x00', 0x0, 0x0) sched_setaffinity(0x0, 0x7, &(0x7f00000000c0)=0x9) r0 = perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0) fcntl$setflags(r0, 0x2, 0x1) getsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER_VALUE(0xffffffffffffffff, 0x84, 0x7c, &(0x7f00000001c0), &(0x7f0000000240)=0x8) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(0xffffffffffffffff, 0x84, 0x9, &(0x7f0000000280)={0x0, @in={{0x2, 0x4e23, @remote}}, 0xfffffffffffffff7, 0x0, 0x400}, 0x98) sendto$inet6(0xffffffffffffffff, &(0x7f00000004c0), 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) setsockopt$SO_BINDTODEVICE(0xffffffffffffffff, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x4) socket$inet6(0xa, 0x1000000000002, 0x0) r1 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x4, 0x0, &(0x7f0000000100)=[@enter_looper], 0x1, 0x0, &(0x7f0000000180)='T'}) gettid() timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, &(0x7f0000040000)) tkill(0x0, 0x1004000000016) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0xfffffffffffffced, 0x0, &(0x7f0000000040)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x400c630f}], 0x0, 0x0, &(0x7f0000000f4d)}) 12:34:13 executing program 0: syz_open_dev$sndctrl(&(0x7f0000000140)='/dev/snd/controlC#\x00', 0x0, 0x0) sched_setaffinity(0x0, 0x7, &(0x7f00000000c0)=0x9) r0 = perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0) fcntl$setflags(r0, 0x2, 0x1) getsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER_VALUE(0xffffffffffffffff, 0x84, 0x7c, &(0x7f00000001c0), &(0x7f0000000240)=0x8) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(0xffffffffffffffff, 0x84, 0x9, &(0x7f0000000280)={0x0, @in={{0x2, 0x4e23, @remote}}, 0xfffffffffffffff7, 0x0, 0x400}, 0x98) sendto$inet6(0xffffffffffffffff, &(0x7f00000004c0), 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) setsockopt$SO_BINDTODEVICE(0xffffffffffffffff, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x4) socket$inet6(0xa, 0x1000000000002, 0x0) r1 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x4, 0x0, &(0x7f0000000100)=[@enter_looper], 0x1, 0x0, &(0x7f0000000180)='T'}) gettid() timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, &(0x7f0000040000)) tkill(0x0, 0x1004000000016) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0xfffffffffffffced, 0x0, &(0x7f0000000040)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x400c630f}], 0x0, 0x0, &(0x7f0000000f4d)}) [ 476.360971] binder: BINDER_SET_CONTEXT_MGR already set [ 476.400362] binder: 24944:24945 ioctl 40046207 0 returned -16 [ 476.416880] binder: BINDER_SET_CONTEXT_MGR already set [ 476.427507] binder: 24948:24949 ioctl 40046207 0 returned -16 12:34:14 executing program 4: socket$inet6(0xa, 0x0, 0x80000000) sched_setaffinity(0x0, 0x7, &(0x7f00000000c0)=0x9) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0) fcntl$setflags(0xffffffffffffffff, 0x2, 0x1) r0 = socket$inet6(0xa, 0x400000000001, 0x0) r1 = dup(r0) setsockopt$inet6_tcp_int(r1, 0x6, 0x12, &(0x7f0000000000)=0x7f, 0x4) bind$inet6(r0, &(0x7f0000000040)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) getsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER_VALUE(r0, 0x84, 0x7c, &(0x7f00000001c0)={0x0, 0x0, 0x6}, &(0x7f0000000240)=0x8) sendto$inet6(r0, &(0x7f00000004c0), 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x4) socket$inet6(0xa, 0x1000000000002, 0x0) r2 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000200)={0x4, 0x0, &(0x7f0000000100)=[@enter_looper], 0x1, 0x0, &(0x7f0000000180)='T'}) r3 = gettid() timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, &(0x7f0000040000)) tkill(r3, 0x1004000000016) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0xfffffffffffffced, 0x0, &(0x7f0000000040)}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x400c630f}], 0x0, 0x0, &(0x7f0000000f4d)}) 12:34:14 executing program 1: pipe(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) getsockopt$inet_sctp6_SCTP_DEFAULT_SNDINFO(0xffffffffffffff9c, 0x84, 0x22, &(0x7f0000000140)={0x401, 0x8208, 0xfffffffffffffffe, 0x6, 0x0}, &(0x7f0000000240)=0x10) setsockopt$inet_sctp6_SCTP_PRIMARY_ADDR(r0, 0x84, 0x6, &(0x7f0000000280)={r2, @in={{0x2, 0x4e20, @multicast1}}}, 0x84) socketpair$packet(0x11, 0x2, 0x300, &(0x7f0000000000)={0xffffffffffffffff}) r4 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000040)='/dev/mixer\x00', 0x101200, 0x0) ioctl$FS_IOC_FSGETXATTR(r1, 0x801c581f, &(0x7f0000000440)={0x0, 0x8, 0x80000000, 0x2, 0x3d1}) epoll_ctl$EPOLL_CTL_ADD(r4, 0x1, r3, &(0x7f0000000480)={0x20000000}) preadv(r3, &(0x7f0000001380)=[{&(0x7f0000000180)=""/148, 0x94}], 0x1, 0x0) ioctl$void(r4, 0x5450) socketpair(0x9, 0x805, 0x9, &(0x7f0000000540)) fsetxattr$trusted_overlay_upper(r4, &(0x7f0000000080)='trusted.overlay.upper\x00', &(0x7f00000004c0)={0x0, 0xfb, 0x42, 0x1, 0x2, "8938809a4c724f81f55f33dd117857ae", "98ba5784a9c2b188678c3002699bd62bb13946483a1ae69a4a352ba804a7499c96f487570af690b503a38a1bf2"}, 0x42, 0x1) ioctl$SG_EMULATED_HOST(r4, 0x2203, &(0x7f00000000c0)) r5 = syz_open_procfs(0x0, &(0x7f0000000340)="696f001b66408225aaa3af068fffebb8a490c47dda6586f1b58895b94a78037dd3714e7198820a7a709e2d30d25e6d846cd5c62a648a598668a8263b752b0b622b115112b5ad8e0425c0b784bbdb89eb8f4da0dd73dd01fe35694c2f78600badf8a0e237dba40713bac9e053b41a9f62be5fbb928018aab5f7500bef51a2fd74d4fffb4a20a946733820bdc1b485afa417cdbcfdfbc54f58c9c3edffe240c36f4ab8a16613814e226b6d20d98010ab1ace49fa76dce337a5a5f1dcff9e5d533b12475e33b971b15b69cd591cd9059759f0f04ba5468a34b98915033debb3e87f048e8601712659d47d8687eb6be5e650068d88000000000000") preadv(r5, &(0x7f0000000480), 0x3e82c93b6face8e, 0x0) 12:34:14 executing program 2: perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f0000000180)=""/148, 0x13d}], 0x1, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000340)="696f001b66408225aaa3af068fffebb8a490c47dda6586f1b58895b94a78037dd3714e7198820a7a709e2d30d25e6d846cd5c62a648a598668a8263b752b0b622b115112b5ad8e0425c0b784bbdb89eb8f4da0dd73dd01fe35694c2f78600badf8a0e237dba40713bac9e053b41a9f62be5fbb928018aab5f7500bef51a2fd74d4fffb4a20a946733820bdc1b485afa417cdbcfdfbc54f58c9c3edffe240c36f4ab8a16613814e226b6d20d98010ab1ace49fa76dce337a5a5f1dcff9e5d533b12475e33b971b15b69cd591cd9059759f0f04ba5468a34b98915033debb3e87f048e8601712659d47d8687eb6be5e650068d88000000000000") preadv(r0, &(0x7f0000000480), 0x10000000000000d4, 0x0) msgget$private(0x0, 0x22) 12:34:14 executing program 5: r0 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/sync_ports\x00', 0x2, 0x0) preadv(r0, &(0x7f0000001380)=[{&(0x7f0000000180)=""/148, 0x3b6}], 0x1, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000340)="696f001b66408225aaa3af068fffebb8a490c47dda6586f1b58895b94a78037dd3714e7198820a7a709e2d30d25e6d846cd5c62a648a598668a8263b752b0b622b115112b5ad8e0425c0b784bbdb89eb8f4da0dd73dd01fe35694c2f78600badf8a0e237dba40713bac9e053b41a9f62be5fbb928018aab5f7500bef51a2fd74d4fffb4a20a946733820bdc1b485afa417cdbcfdfbc54f58c9c3edffe240c36f4ab8a16613814e226b6d20d98010ab1ace49fa76dce337a5a5f1dcff9e5d533b12475e33b971b15b69cd591cd9059759f0f04ba5468a34b98915033debb3e87f048e8601712659d47d8687eb6be5e650068d88000000000000") preadv(r1, &(0x7f0000000480), 0x10000000000002a1, 0x0) setsockopt$bt_BT_CHANNEL_POLICY(r1, 0x112, 0xa, &(0x7f0000000000)=0x5, 0x4) openat$vnet(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vhost-net\x00', 0x2, 0x0) 12:34:14 executing program 3: socket$inet6(0xa, 0x0, 0x80000000) sched_setaffinity(0x0, 0x7, &(0x7f00000000c0)=0x9) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0) fcntl$setflags(0xffffffffffffffff, 0x2, 0x1) r0 = socket$inet6(0xa, 0x400000000001, 0x0) r1 = dup(r0) setsockopt$inet6_tcp_int(r1, 0x6, 0x12, &(0x7f0000000000)=0x7f, 0x4) bind$inet6(r0, &(0x7f0000000040)={0xa, 0x0, 0x0, @loopback}, 0x1c) getsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER_VALUE(r0, 0x84, 0x7c, &(0x7f00000001c0)={0x0, 0x100000001, 0x6}, &(0x7f0000000240)=0x8) sendto$inet6(r0, &(0x7f00000004c0), 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x4) socket$inet6(0xa, 0x1000000000002, 0x0) r2 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000200)={0x4, 0x0, &(0x7f0000000100)=[@enter_looper], 0x1, 0x0, &(0x7f0000000180)='T'}) r3 = gettid() timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, &(0x7f0000040000)) tkill(r3, 0x1004000000016) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0xfffffffffffffced, 0x0, &(0x7f0000000040)}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x400c630f}], 0x0, 0x0, &(0x7f0000000f4d)}) 12:34:14 executing program 0: socket$inet6(0xa, 0x0, 0x80000000) syz_open_dev$sndctrl(&(0x7f0000000140)='/dev/snd/controlC#\x00', 0x9, 0x400000) sched_setaffinity(0x0, 0x7, &(0x7f00000000c0)=0x9) r0 = perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0) fcntl$setflags(r0, 0x2, 0x1) pipe(&(0x7f0000000100)) r1 = socket$inet6(0xa, 0x400000000001, 0x0) r2 = dup(r1) setsockopt$inet6_tcp_int(r2, 0x6, 0x12, &(0x7f0000000000)=0x7f, 0x4) getsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER_VALUE(r1, 0x84, 0x7c, &(0x7f00000001c0)={0x0, 0x100000001, 0x6}, &(0x7f0000000240)=0x8) sendto$inet6(r1, &(0x7f00000004c0), 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) setsockopt$SO_BINDTODEVICE(r1, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x4) socket$inet6(0xa, 0x1000000000002, 0x0) r3 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r3, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000200)={0x4, 0x0, &(0x7f0000000100)=[@enter_looper], 0x1, 0x0, &(0x7f0000000180)='T'}) r4 = gettid() timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, &(0x7f0000040000)) tkill(r4, 0x1004000000016) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0xfffffffffffffced, 0x0, &(0x7f0000000040)}) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x400c630f}], 0x0, 0x0, &(0x7f0000000f4d)}) [ 476.779552] binder: undelivered death notification, 0000000000000000 12:34:14 executing program 2: perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f0000000180)=""/148, 0x13d}], 0x1, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000340)="696f001b66408225aaa3af068fffebb8a490c47dda6586f1b58895b94a78037dd3714e7198820a7a709e2d30d25e6d846cd5c62a648a598668a8263b752b0b622b115112b5ad8e0425c0b784bbdb89eb8f4da0dd73dd01fe35694c2f78600badf8a0e237dba40713bac9e053b41a9f62be5fbb928018aab5f7500bef51a2fd74d4fffb4a20a946733820bdc1b485afa417cdbcfdfbc54f58c9c3edffe240c36f4ab8a16613814e226b6d20d98010ab1ace49fa76dce337a5a5f1dcff9e5d533b12475e33b971b15b69cd591cd9059759f0f04ba5468a34b98915033debb3e87f048e8601712659d47d8687eb6be5e650068d88000000000000") preadv(r0, &(0x7f0000000480), 0x100000000000023a, 0x0) msgget$private(0x0, 0x22) [ 476.898858] binder: BINDER_SET_CONTEXT_MGR already set [ 476.911188] binder: 24963:24964 ioctl 40046207 0 returned -16 [ 476.918915] binder: BINDER_SET_CONTEXT_MGR already set [ 476.924798] binder: 24969:24970 ioctl 40046207 0 returned -16 12:34:14 executing program 5: preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f0000000180)=""/148, 0x13d}], 0x1, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000340)="696f001b66408225aaa3af068fffebb8a490c47dda6586f1b58895b94a78037dd3714e7198820a7a709e2d30d25e6d846cd5c62a648a598668a8263b752b0b622b115112b5ad8e0425c0b784bbdb89eb8f4da0dd73dd01fe35694c2f78600badf8a0e237dba40713bac9e053b41a9f62be5fbb928018aab5f7500bef51a2fd74d4fffb4a20a946733820bdc1b485afa417cdbcfdfbc54f58c9c3edffe240c36f4ab8a16613814e226b6d20d98010ab1ace49fa76dce337a5a5f1dcff9e5d533b12475e33b971b15b69cd591cd9059759f0f04ba5468a34b98915033debb3e87f048e8601712659d47d8687eb6be5e650068d88000000000000") preadv(r0, &(0x7f0000000480), 0x10000000000002a1, 0x0) ioctl$SCSI_IOCTL_DOORLOCK(r0, 0x5380) ioctl$PERF_EVENT_IOC_SET_FILTER(r0, 0x40082406, &(0x7f0000000000)='\x00') 12:34:14 executing program 3: socket$inet6(0xa, 0x0, 0x80000000) sched_setaffinity(0x0, 0x7, &(0x7f00000000c0)=0x9) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0) fcntl$setflags(0xffffffffffffffff, 0x2, 0x1) r0 = socket$inet6(0xa, 0x400000000001, 0x0) r1 = dup(r0) setsockopt$inet6_tcp_int(r1, 0x6, 0x12, &(0x7f0000000000)=0x7f, 0x4) bind$inet6(r0, &(0x7f0000000040)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) getsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER_VALUE(r0, 0x84, 0x7c, &(0x7f00000001c0)={0x0, 0x0, 0x6}, &(0x7f0000000240)=0x8) sendto$inet6(r0, &(0x7f00000004c0), 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x4) socket$inet6(0xa, 0x1000000000002, 0x0) r2 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000200)={0x4, 0x0, &(0x7f0000000100)=[@enter_looper], 0x1, 0x0, &(0x7f0000000180)='T'}) r3 = gettid() timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, &(0x7f0000040000)) tkill(r3, 0x1004000000016) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0xfffffffffffffced, 0x0, &(0x7f0000000040)}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x400c630f}], 0x0, 0x0, &(0x7f0000000f4d)}) [ 476.964789] binder: 24969:24970 Acquire 1 refcount change on invalid ref 0 ret -22 12:34:14 executing program 1: preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f0000000180)=""/148, 0x13d}], 0x1, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000340)="696f001b66408225aaa3af068fffebb8a490c47dda6586f1b58895b94a78037dd3714e7198820a7a709e2d30d25e6d846cd5c62a648a598668a8263b752b0b622b115112b5ad8e0425c0b784bbdb89eb8f4da0dd73dd01fe35694c2f78600badf8a0e237dba40713bac9e053b41a9f62be5fbb928018aab5f7500bef51a2fd74d4fffb4a20a946733820bdc1b485afa417cdbcfdfbc54f58c9c3edffe240c36f4ab8a16613814e226b6d20d98010ab1ace49fa76dce337a5a5f1dcff9e5d533b12475e33b971b15b69cd591cd9059759f0f04ba5468a34b98915033debb3e87f048e8601712659d47d8687eb6be5e650068d88000000000000") preadv(r0, &(0x7f0000000600)=[{&(0x7f0000000000)=""/141, 0x8d}, {&(0x7f00000000c0)=""/125, 0x7d}, {&(0x7f0000000240)=""/203, 0xcb}, {&(0x7f0000000140)=""/32, 0x20}, {&(0x7f0000000680)=""/121, 0x79}, {&(0x7f00000004c0)=""/172, 0xac}, {&(0x7f0000000580)=""/55, 0x37}, {&(0x7f00000005c0)=""/35, 0x23}], 0x8, 0x20000) [ 477.009333] binder: 24963:24981 Acquire 1 refcount change on invalid ref 0 ret -22 [ 477.018205] binder: 24969:24970 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 477.025523] binder: 24969:24985 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 [ 477.032662] binder: 24963:24981 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 12:34:14 executing program 1: preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f0000000180)=""/148, 0x13d}], 0x1, 0x0) syz_open_dev$amidi(&(0x7f0000000100)='/dev/amidi#\x00', 0x7ff, 0x2001) r0 = syz_open_procfs(0x0, &(0x7f0000000340)="696f001b66408225aaa3af068fffebb8a490c47dda6586f1b58895b94a78037dd3714e7198820a7a709e2d30d25e6d846cd5c62a648a598668a8263b752b0b622b115112b5ad8e0425c0b784bbdb89eb8f4da0dd73dd01fe35694c2f78600badf8a0e237dba40713bac9e053b41a9f62be5fbb928018aab5f7500bef51a2fd74d4fffb4a20a946733820bdc1b485afa417cdbcfdfbc54f58c9c3edffe240c36f4ab8a16613814e226b6d20d98010ab1ace49fa76dce337a5a5f1dcff9e5d533b12475e33b971b15b69cd591cd9059759f0f04ba5468a34b98915033debb3e87f048e8601712659d47d8687eb6be5e650068d88000000000000") setsockopt$inet_sctp_SCTP_INITMSG(r0, 0x84, 0x2, &(0x7f00000000c0)={0x8, 0x5b86, 0x800, 0x6}, 0x8) preadv(r0, &(0x7f0000000480), 0x10000000000002a1, 0x0) bpf$BPF_GET_PROG_INFO(0xf, &(0x7f0000000080)={r0, 0x50}, 0x10) [ 477.066335] binder: 24963:24981 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 12:34:14 executing program 2: perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f0000000180)=""/148, 0x13d}], 0x1, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000340)="696f001b66408225aaa3af068fffebb8a490c47dda6586f1b58895b94a78037dd3714e7198820a7a709e2d30d25e6d846cd5c62a648a598668a8263b752b0b622b115112b5ad8e0425c0b784bbdb89eb8f4da0dd73dd01fe35694c2f78600badf8a0e237dba40713bac9e053b41a9f62be5fbb928018aab5f7500bef51a2fd74d4fffb4a20a946733820bdc1b485afa417cdbcfdfbc54f58c9c3edffe240c36f4ab8a16613814e226b6d20d98010ab1ace49fa76dce337a5a5f1dcff9e5d533b12475e33b971b15b69cd591cd9059759f0f04ba5468a34b98915033debb3e87f048e8601712659d47d8687eb6be5e650068d88000000000000") preadv(r0, &(0x7f0000000480), 0x1000000000000284, 0x0) msgget$private(0x0, 0x22) 12:34:15 executing program 4: socket$inet6(0xa, 0x0, 0x80000000) sched_setaffinity(0x0, 0x7, &(0x7f00000000c0)=0x9) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0) fcntl$setflags(0xffffffffffffffff, 0x2, 0x1) r0 = socket$inet6(0xa, 0x400000000001, 0x0) r1 = dup(r0) setsockopt$inet6_tcp_int(r1, 0x6, 0x12, &(0x7f0000000000)=0x7f, 0x4) bind$inet6(r0, &(0x7f0000000040)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) getsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER_VALUE(r0, 0x84, 0x7c, &(0x7f00000001c0)={0x0, 0x0, 0x6}, &(0x7f0000000240)=0x8) sendto$inet6(r0, &(0x7f00000004c0), 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x4) socket$inet6(0xa, 0x1000000000002, 0x0) r2 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000100), 0x1, 0x0, &(0x7f0000000180)='T'}) r3 = gettid() timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, &(0x7f0000040000)) tkill(r3, 0x1004000000016) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0xfffffffffffffced, 0x0, &(0x7f0000000040)}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x400c630f}], 0x0, 0x0, &(0x7f0000000f4d)}) 12:34:15 executing program 5: preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f0000000180)=""/148, 0x13d}], 0x1, 0x0) getpgrp(0xffffffffffffffff) ioctl$sock_SIOCGPGRP(0xffffffffffffffff, 0x8904, &(0x7f0000000000)) ioctl$sock_FIOGETOWN(0xffffffffffffff9c, 0x8903, &(0x7f0000000140)) ioctl$TIOCGPGRP(0xffffffffffffff9c, 0x540f, &(0x7f0000000240)) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffff9c, 0x0, 0xf4, &(0x7f0000000440)="696f001b66408225aaa3af068fffebb8a490c47dda6586f1b58895b94a78037dd3714e7198820a7a709e2d30d25e6d846cd5c62a648a598668a8263b752b0b622b115112b5ad8e0425c0b784bbdb89eb8f4da0dd73dd01fe35694c2f78600badf8a0e237dba40713bac9e053b41a9f62be5fbb928018aab5f7500bef51a2fd74d4fffb4a20a946733820bdc1b485afa417cdbcfdfbc54f58c9c3edffe240c36f4ab8a16613814e226b6d20d98010ab1ace49fa76dce337a5a5f1dcff9e5d533b12475e33b971b15b69cd591cd9059759f0f04ba5468a34b98915033debb3e87f048e8601712659d47d8687eb6be5e650068d8800", 0xffffffffffffffff}, 0x30) r1 = syz_open_procfs(r0, &(0x7f00000002c0)='net/sctp\x00') preadv(r1, &(0x7f0000000480), 0x10000000000002a1, 0x0) 12:34:15 executing program 1: preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f0000000180)=""/148, 0x13d}], 0x1, 0x0) ioctl$sock_FIOGETOWN(0xffffffffffffff9c, 0x8903, &(0x7f0000000080)) r0 = getpgid(0x0) r1 = syz_open_procfs(r0, &(0x7f0000000340)="696f001b66408225aaa3af068fffebb8a490c47dda6586f1b58895b94a78037dd3714e7198820a7a709e2d30d25e6d846cd5c62a648a598668a8263b752b0b622b115112b5ad8e0425c0b784bbdb89eb8f4da0dd73dd01fe35694c2f78600badf8a0e237dba40713bac9e053b41a9f62be5fbb928018aab5f7500bef51a2fd74d4fffb4a20a946733820bdc1b485afa417cdbcfdfbc54f58c9c3edffe240c36f4ab8a16613814e226b6d20d98010ab1ace49fa76dce337a5a5f1dcff9e5d533b12475e33b971b15b69cd591cd9059759f0f04ba5468a34b98915033debb3e87f048e8601712659d47d8687eb6be5e650068d88000000000000") preadv(r1, &(0x7f0000000480), 0x10000000000002a1, 0x0) ioctl$KVM_SET_GUEST_DEBUG(r1, 0x4048ae9b, &(0x7f0000000000)={0x0, 0x0, [0xfffffffffffeffff, 0xff7, 0x0, 0x2b75, 0xfffffffffffffff7, 0x5, 0x3, 0xb799]}) ioctl$DRM_IOCTL_CONTROL(r1, 0x40086414, &(0x7f00000000c0)={0x3, 0xc3}) 12:34:15 executing program 2: perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f0000000180)=""/148, 0x13d}], 0x1, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000340)="696f001b66408225aaa3af068fffebb8a490c47dda6586f1b58895b94a78037dd3714e7198820a7a709e2d30d25e6d846cd5c62a648a598668a8263b752b0b622b115112b5ad8e0425c0b784bbdb89eb8f4da0dd73dd01fe35694c2f78600badf8a0e237dba40713bac9e053b41a9f62be5fbb928018aab5f7500bef51a2fd74d4fffb4a20a946733820bdc1b485afa417cdbcfdfbc54f58c9c3edffe240c36f4ab8a16613814e226b6d20d98010ab1ace49fa76dce337a5a5f1dcff9e5d533b12475e33b971b15b69cd591cd9059759f0f04ba5468a34b98915033debb3e87f048e8601712659d47d8687eb6be5e650068d88000000000000") preadv(r0, &(0x7f0000000480), 0x10000000000001b4, 0x0) msgget$private(0x0, 0x22) 12:34:15 executing program 0: socket$inet6(0xa, 0x0, 0x80000000) syz_open_dev$sndctrl(&(0x7f0000000140)='/dev/snd/controlC#\x00', 0x9, 0x400000) sched_setaffinity(0x0, 0x7, &(0x7f00000000c0)=0x9) r0 = perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0) fcntl$setflags(r0, 0x2, 0x1) pipe(&(0x7f0000000100)) r1 = socket$inet6(0xa, 0x400000000001, 0x0) r2 = dup(r1) setsockopt$inet6_tcp_int(r2, 0x6, 0x12, &(0x7f0000000000)=0x7f, 0x4) getsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER_VALUE(r1, 0x84, 0x7c, &(0x7f00000001c0)={0x0, 0x100000001, 0x6}, &(0x7f0000000240)=0x8) sendto$inet6(r1, &(0x7f00000004c0), 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) setsockopt$SO_BINDTODEVICE(r1, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x4) socket$inet6(0xa, 0x1000000000002, 0x0) r3 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r3, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000200)={0x4, 0x0, &(0x7f0000000100)=[@enter_looper], 0x1, 0x0, &(0x7f0000000180)='T'}) r4 = gettid() timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, &(0x7f0000040000)) tkill(r4, 0x1004000000016) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0xfffffffffffffced, 0x0, &(0x7f0000000040)}) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x400c630f}], 0x0, 0x0, &(0x7f0000000f4d)}) 12:34:15 executing program 1: socket$inet6(0xa, 0x0, 0x80000000) sched_setaffinity(0x0, 0x7, &(0x7f00000000c0)=0x9) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0) fcntl$setflags(0xffffffffffffffff, 0x2, 0x1) r0 = socket$inet6(0xa, 0x400000000001, 0x0) r1 = dup(r0) setsockopt$inet6_tcp_int(r1, 0x6, 0x12, &(0x7f0000000000)=0x7f, 0x4) bind$inet6(r0, &(0x7f0000000040)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) getsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER_VALUE(r0, 0x84, 0x7c, &(0x7f00000001c0)={0x0, 0x0, 0x6}, &(0x7f0000000240)=0x8) sendto$inet6(r0, &(0x7f00000004c0), 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x4) socket$inet6(0xa, 0x1000000000002, 0x0) r2 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000200)={0x4, 0x0, &(0x7f0000000100)=[@enter_looper], 0x1, 0x0, &(0x7f0000000180)='T'}) r3 = gettid() timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, &(0x7f0000040000)) tkill(r3, 0x1004000000016) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0xfffffffffffffced, 0x0, &(0x7f0000000040)}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x400c630f}], 0x0, 0x0, &(0x7f0000000f4d)}) 12:34:15 executing program 5: preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f0000000180)=""/148, 0x13d}], 0x1, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000340)="696f001b66408225aaa3af068fffebb8a490c47dda6586f1b58895b94a78037dd3714e7198820a7a709e2d30d25e6d846cd5c62a648a598668a8263b752b0b622b115112b5ad8e0425c0b784bbdb89eb8f4da0dd73dd01fe35694c2f78600badf8a0e237dba40713bac9e053b41a9f62be5fbb928018aab5f7500bef51a2fd74d4fffb4a20a946733820bdc1b485afa417cdbcfdfbc54f58c9c3edffe240c36f4ab8a16613814e226b6d20d98010ab1ace49fa76dce337a5a5f1dcff9e5d533b12475e33b971b15b69cd591cd9059759f0f04ba5468a34b98915033debb3e87f048e8601712659d47d8687eb6be5e650068d88000000000000") preadv(r0, &(0x7f0000000480), 0x10000000000002a1, 0x0) ioctl$KVM_IRQFD(r0, 0x4020ae76, &(0x7f0000000000)={r0, 0x1, 0xe28, r0}) [ 477.765216] binder: BINDER_SET_CONTEXT_MGR already set 12:34:15 executing program 2: perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f0000000180)=""/148, 0x13d}], 0x1, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000340)="696f001b66408225aaa3af068fffebb8a490c47dda6586f1b58895b94a78037dd3714e7198820a7a709e2d30d25e6d846cd5c62a648a598668a8263b752b0b622b115112b5ad8e0425c0b784bbdb89eb8f4da0dd73dd01fe35694c2f78600badf8a0e237dba40713bac9e053b41a9f62be5fbb928018aab5f7500bef51a2fd74d4fffb4a20a946733820bdc1b485afa417cdbcfdfbc54f58c9c3edffe240c36f4ab8a16613814e226b6d20d98010ab1ace49fa76dce337a5a5f1dcff9e5d533b12475e33b971b15b69cd591cd9059759f0f04ba5468a34b98915033debb3e87f048e8601712659d47d8687eb6be5e650068d88000000000000") preadv(r0, &(0x7f0000000480), 0x1000000000000019, 0x0) msgget$private(0x0, 0x22) [ 477.817959] binder: 25012:25014 ioctl 40046207 0 returned -16 [ 477.828749] binder: BINDER_SET_CONTEXT_MGR already set [ 477.839949] binder: 25020:25021 ioctl 40046207 0 returned -16 [ 477.865616] nf_conntrack: default automatic helper assignment has been turned off for security reasons and CT-based firewall rule not found. Use the iptables CT target to attach helpers instead. 12:34:15 executing program 3: pipe(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) getsockopt$inet_sctp6_SCTP_DEFAULT_SNDINFO(0xffffffffffffff9c, 0x84, 0x22, &(0x7f0000000140)={0x401, 0x8208, 0xfffffffffffffffe, 0x6, 0x0}, &(0x7f0000000240)=0x10) setsockopt$inet_sctp6_SCTP_PRIMARY_ADDR(r0, 0x84, 0x6, &(0x7f0000000280)={r2, @in={{0x2, 0x4e20, @multicast1}}}, 0x84) socketpair$packet(0x11, 0x2, 0x300, &(0x7f0000000000)={0xffffffffffffffff}) r4 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000040)='/dev/mixer\x00', 0x101200, 0x0) ioctl$FS_IOC_FSGETXATTR(r1, 0x801c581f, &(0x7f0000000440)={0x0, 0x8, 0x80000000, 0x2, 0x3d1}) epoll_ctl$EPOLL_CTL_ADD(r4, 0x1, r3, &(0x7f0000000480)={0x20000000}) preadv(r3, &(0x7f0000001380)=[{&(0x7f0000000180)=""/148, 0x94}], 0x1, 0x0) ioctl$void(r4, 0x5450) socketpair(0x9, 0x805, 0x9, &(0x7f0000000540)) fsetxattr$trusted_overlay_upper(r4, &(0x7f0000000080)='trusted.overlay.upper\x00', &(0x7f00000004c0)={0x0, 0xfb, 0x42, 0x1, 0x2, "8938809a4c724f81f55f33dd117857ae", "98ba5784a9c2b188678c3002699bd62bb13946483a1ae69a4a352ba804a7499c96f487570af690b503a38a1bf2"}, 0x42, 0x1) ioctl$SG_EMULATED_HOST(r4, 0x2203, &(0x7f00000000c0)) r5 = syz_open_procfs(0x0, &(0x7f0000000340)="696f001b66408225aaa3af068fffebb8a490c47dda6586f1b58895b94a78037dd3714e7198820a7a709e2d30d25e6d846cd5c62a648a598668a8263b752b0b622b115112b5ad8e0425c0b784bbdb89eb8f4da0dd73dd01fe35694c2f78600badf8a0e237dba40713bac9e053b41a9f62be5fbb928018aab5f7500bef51a2fd74d4fffb4a20a946733820bdc1b485afa417cdbcfdfbc54f58c9c3edffe240c36f4ab8a16613814e226b6d20d98010ab1ace49fa76dce337a5a5f1dcff9e5d533b12475e33b971b15b69cd591cd9059759f0f04ba5468a34b98915033debb3e87f048e8601712659d47d8687eb6be5e650068d88000000000000") preadv(r5, &(0x7f0000000480), 0x3e82c93b6face8e, 0x0) [ 477.911756] binder: undelivered death notification, 0000000000000000 12:34:15 executing program 5: preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f0000000180)=""/148, 0x13d}], 0x10000000000000a0, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000340)="696f001b66408225aaa3af068fffebb8a490c47dda6586f1b58895b94a78037dd3714e7198820a7a709e2d30d25e6d846cd5c62a648a598668a8263b752b0b622b115112b5ad8e0425c0b784bbdb89eb8f4da0dd73dd01fe35694c2f78600badf8a0e237dba40713bac9e053b41a9f62be5fbb928018aab5f7500bef51a2fd74d4fffb4a20a946733820bdc1b485afa417cdbcfdfbc54f58c9c3edffe240c36f4ab8a16613814e226b6d20d98010ab1ace49fa76dce337a5a5f1dcff9e5d533b12475e33b971b15b69cd591cd9059759f0f04ba5468a34b98915033debb3e87f048e8601712659d47d8687eb6be5e650068d88000000000000") preadv(r0, &(0x7f0000000480), 0x10000000000002a1, 0x0) 12:34:15 executing program 2: perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f0000000180)=""/148, 0x13d}], 0x1, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000340)="696f001b66408225aaa3af068fffebb8a490c47dda6586f1b58895b94a78037dd3714e7198820a7a709e2d30d25e6d846cd5c62a648a598668a8263b752b0b622b115112b5ad8e0425c0b784bbdb89eb8f4da0dd73dd01fe35694c2f78600badf8a0e237dba40713bac9e053b41a9f62be5fbb928018aab5f7500bef51a2fd74d4fffb4a20a946733820bdc1b485afa417cdbcfdfbc54f58c9c3edffe240c36f4ab8a16613814e226b6d20d98010ab1ace49fa76dce337a5a5f1dcff9e5d533b12475e33b971b15b69cd591cd9059759f0f04ba5468a34b98915033debb3e87f048e8601712659d47d8687eb6be5e650068d88000000000000") preadv(r0, &(0x7f0000000480), 0x1000000000000140, 0x0) msgget$private(0x0, 0x22) [ 477.952641] binder: 25020:25035 Acquire 1 refcount change on invalid ref 0 ret -22 12:34:15 executing program 5: preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f0000000180)=""/148, 0x13d}], 0x1, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000340)="696f001b66408225aaa3af068fffebb8a490c47dda6586f1b58895b94a78037dd3714e7198820a7a709e2d30d25e6d846cd5c62a648a598668a8263b752b0b622b115112b5ad8e0425c0b784bbdb89eb8f4da0dd73dd01fe35694c2f78600badf8a0e237dba40713bac9e053b41a9f62be5fbb928018aab5f7500bef51a2fd74d4fffb4a20a946733820bdc1277490493cea5b7408b485afa417cdbcfdfbc54f58c9c3edffe240c36f4ab8a16613814e226b6d20d98010ab1ace49fa76dce337a5a5f1dcff9e5d533b12475e33b971b15b69cd591cd9059759f0f04ba5468a34b98915033debb3e87f048e8601712659d47d8687eb6be5e650") preadv(r0, &(0x7f00000006c0)=[{&(0x7f0000000000)=""/144, 0x90}, {&(0x7f00000000c0)=""/15, 0xf}, {&(0x7f0000000240)=""/250, 0xfa}, {&(0x7f00000013c0)=""/4096, 0x1000}, {&(0x7f0000000440)=""/136, 0x88}, {&(0x7f0000000100)=""/66, 0x42}, {&(0x7f0000000500)=""/21, 0x15}, {&(0x7f0000000540)=""/126, 0x7e}, {&(0x7f00000005c0)=""/137, 0x89}, {&(0x7f0000000680)=""/19, 0x13}], 0x100000000000005e, 0x0) [ 477.997874] binder: 25020:25035 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 478.020997] binder: 25020:25035 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 [ 478.492383] binder: undelivered death notification, 0000000000000000 12:34:15 executing program 2: perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f0000000180)=""/148, 0x13d}], 0x1, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000340)="696f001b66408225aaa3af068fffebb8a490c47dda6586f1b58895b94a78037dd3714e7198820a7a709e2d30d25e6d846cd5c62a648a598668a8263b752b0b622b115112b5ad8e0425c0b784bbdb89eb8f4da0dd73dd01fe35694c2f78600badf8a0e237dba40713bac9e053b41a9f62be5fbb928018aab5f7500bef51a2fd74d4fffb4a20a946733820bdc1b485afa417cdbcfdfbc54f58c9c3edffe240c36f4ab8a16613814e226b6d20d98010ab1ace49fa76dce337a5a5f1dcff9e5d533b12475e33b971b15b69cd591cd9059759f0f04ba5468a34b98915033debb3e87f048e8601712659d47d8687eb6be5e650068d88000000000000") preadv(r0, &(0x7f0000000480), 0x100000000000020c, 0x0) msgget$private(0x0, 0x22) 12:34:15 executing program 3: socket$inet6(0xa, 0x0, 0x80000000) syz_open_dev$sndctrl(&(0x7f0000000140)='/dev/snd/controlC#\x00', 0x9, 0x400000) sched_setaffinity(0x0, 0x7, &(0x7f00000000c0)=0x9) r0 = perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0) fcntl$setflags(r0, 0x2, 0x1) pipe(&(0x7f0000000100)) r1 = socket$inet6(0xa, 0x400000000001, 0x0) r2 = dup(r1) setsockopt$inet6_tcp_int(r2, 0x6, 0x12, &(0x7f0000000000)=0x7f, 0x4) bind$inet6(r1, &(0x7f0000000040)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) getsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER_VALUE(r1, 0x84, 0x7c, &(0x7f00000001c0)={0x0, 0x100000001, 0x6}, &(0x7f0000000240)=0x8) sendto$inet6(r1, &(0x7f00000004c0), 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) socket$inet6(0xa, 0x1000000000002, 0x0) r3 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r3, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000200)={0x4, 0x0, &(0x7f0000000100)=[@enter_looper], 0x1, 0x0, &(0x7f0000000180)='T'}) r4 = gettid() timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, &(0x7f0000040000)) tkill(r4, 0x1004000000016) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0xfffffffffffffced, 0x0, &(0x7f0000000040)}) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x400c630f}], 0x0, 0x0, &(0x7f0000000f4d)}) 12:34:15 executing program 5: preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f0000000180)=""/148, 0x13d}], 0x1, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000340)="696f001b66408225aaa3af068fffebb8a490c47dda6586f1b58895b94a78037dd3714e7198820a7a709e2d30d25e6d846cd5c62a648a598668a8263b752b0b622b115112b5ad8e0425c0b784bbdb89eb8f4da0dd73dd01fe35694c2f78600badf8a0e237dba40713bac9e053b41a9f62be5fbb928018aab5f7500bef51a2fd74d4fffb4a20a946733820bdc1b485afa417cdbcfdfbc54f58c9c3edffe240c36f4ab8a16613814e226b6d20d98010ab1ace49fa76dce337a5a5f1dcff9e5d533b12475e33b971b15b69cd591cd9059759f0f04ba5468a34b98915033debb3e87f048e8601712659d47d8687eb6be5e650068d88000000000000") preadv(r0, &(0x7f0000000480), 0x10000000000002a1, 0x0) syz_open_dev$vcsa(&(0x7f0000000000)='/dev/vcsa#\x00', 0xfffffffffffffffc, 0x1) 12:34:15 executing program 4: socket$inet6(0xa, 0x0, 0x80000000) sched_setaffinity(0x0, 0x7, &(0x7f00000000c0)=0x9) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0) fcntl$setflags(0xffffffffffffffff, 0x2, 0x1) r0 = socket$inet6(0xa, 0x400000000001, 0x0) r1 = dup(r0) setsockopt$inet6_tcp_int(r1, 0x6, 0x12, &(0x7f0000000000)=0x7f, 0x4) bind$inet6(r0, &(0x7f0000000040)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) getsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER_VALUE(r0, 0x84, 0x7c, &(0x7f00000001c0)={0x0, 0x0, 0x6}, &(0x7f0000000240)=0x8) sendto$inet6(r0, &(0x7f00000004c0), 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x4) socket$inet6(0xa, 0x1000000000002, 0x0) r2 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000200)={0x4, 0x0, &(0x7f0000000100)=[@enter_looper], 0x0, 0x0, &(0x7f0000000180)}) r3 = gettid() timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, &(0x7f0000040000)) tkill(r3, 0x1004000000016) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0xfffffffffffffced, 0x0, &(0x7f0000000040)}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x400c630f}], 0x0, 0x0, &(0x7f0000000f4d)}) 12:34:15 executing program 0: socket$inet6(0xa, 0x0, 0x80000000) syz_open_dev$sndctrl(&(0x7f0000000140)='/dev/snd/controlC#\x00', 0x9, 0x400000) sched_setaffinity(0x0, 0x7, &(0x7f00000000c0)=0x9) r0 = perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0) fcntl$setflags(r0, 0x2, 0x1) pipe(&(0x7f0000000100)) r1 = socket$inet6(0xa, 0x400000000001, 0x0) r2 = dup(r1) setsockopt$inet6_tcp_int(r2, 0x6, 0x12, &(0x7f0000000000)=0x7f, 0x4) bind$inet6(r1, &(0x7f0000000040)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) getsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER_VALUE(r1, 0x84, 0x7c, &(0x7f00000001c0)={0x0, 0x100000001, 0x6}, &(0x7f0000000240)=0x8) sendto$inet6(r1, &(0x7f00000004c0), 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) socket$inet6(0xa, 0x1000000000002, 0x0) r3 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r3, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000200)={0x4, 0x0, &(0x7f0000000100)=[@enter_looper], 0x1, 0x0, &(0x7f0000000180)='T'}) r4 = gettid() timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, &(0x7f0000040000)) tkill(r4, 0x1004000000016) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0xfffffffffffffced, 0x0, &(0x7f0000000040)}) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x400c630f}], 0x0, 0x0, &(0x7f0000000f4d)}) [ 478.584334] binder: undelivered death notification, 0000000000000000 12:34:15 executing program 1: socket$inet6(0xa, 0x0, 0x80000000) syz_open_dev$sndctrl(&(0x7f0000000140)='/dev/snd/controlC#\x00', 0x9, 0x400000) sched_setaffinity(0x0, 0x7, &(0x7f00000000c0)=0x9) r0 = perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0) fcntl$setflags(r0, 0x2, 0x1) pipe(&(0x7f0000000100)) r1 = socket$inet6(0xa, 0x400000000001, 0x0) r2 = dup(r1) setsockopt$inet6_tcp_int(r2, 0x6, 0x12, &(0x7f0000000000)=0x7f, 0x4) bind$inet6(r1, &(0x7f0000000040)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) getsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER_VALUE(r1, 0x84, 0x7c, &(0x7f00000001c0)={0x0, 0x100000001, 0x6}, &(0x7f0000000240)=0x8) sendto$inet6(r1, &(0x7f00000004c0), 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) socket$inet6(0xa, 0x1000000000002, 0x0) r3 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r3, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000200)={0x4, 0x0, &(0x7f0000000100)=[@enter_looper], 0x1, 0x0, &(0x7f0000000180)='T'}) r4 = gettid() timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, &(0x7f0000040000)) tkill(r4, 0x1004000000016) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0xfffffffffffffced, 0x0, &(0x7f0000000040)}) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x400c630f}], 0x0, 0x0, &(0x7f0000000f4d)}) [ 478.690816] binder: BINDER_SET_CONTEXT_MGR already set 12:34:16 executing program 2: perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f0000000180)=""/148, 0x13d}], 0x1, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000340)="696f001b66408225aaa3af068fffebb8a490c47dda6586f1b58895b94a78037dd3714e7198820a7a709e2d30d25e6d846cd5c62a648a598668a8263b752b0b622b115112b5ad8e0425c0b784bbdb89eb8f4da0dd73dd01fe35694c2f78600badf8a0e237dba40713bac9e053b41a9f62be5fbb928018aab5f7500bef51a2fd74d4fffb4a20a946733820bdc1b485afa417cdbcfdfbc54f58c9c3edffe240c36f4ab8a16613814e226b6d20d98010ab1ace49fa76dce337a5a5f1dcff9e5d533b12475e33b971b15b69cd591cd9059759f0f04ba5468a34b98915033debb3e87f048e8601712659d47d8687eb6be5e650068d88000000000000") preadv(r0, &(0x7f0000000480), 0x1000000000000239, 0x0) msgget$private(0x0, 0x22) 12:34:16 executing program 5: preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f0000000180)=""/148, 0x13d}], 0x1, 0x0) r0 = syz_open_dev$sndmidi(&(0x7f0000000000)='/dev/snd/midiC#D#\x00', 0xdc, 0x40040) fcntl$getflags(r0, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000340)="696f001b66408225aaa3af068fffebb8a490c47dda6586f1b58895b94a78037dd3714e7198820a7a709e2d30d25e6d846cd5c62a648a598668a8263b752b0b622b115112b5ad8e0425c0b784bbdb89eb8f4da0dd73dd01fe35694c2f78600badf8a0e237dba40713bac9e053b41a9f62be5fbb928018aab5f7500bef51a2fd74d4fffb4a20a946733820bdc1b485afa417cdbcfdfbc54f58c9c3edffe240c36f4ab8a16613814e226b6d20d98010ab1ace49fa76dce337a5a5f1dcff9e5d533b12475e33b971b15b69cd591cd9059759f0f04ba5468a34b98915033debb3e87f048e8601712659d47d8687eb6be5e650068d88000000000000") preadv(r1, &(0x7f0000000480), 0x0, 0x0) [ 478.711829] binder: BINDER_SET_CONTEXT_MGR already set [ 478.717271] binder: 25062:25065 ioctl 40046207 0 returned -16 [ 478.725761] binder: 25060:25063 ioctl 40046207 0 returned -16 12:34:16 executing program 4: socket$inet6(0xa, 0x0, 0x80000000) sched_setaffinity(0x0, 0x7, &(0x7f00000000c0)=0x9) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0) fcntl$setflags(0xffffffffffffffff, 0x2, 0x1) r0 = socket$inet6(0xa, 0x400000000001, 0x0) r1 = dup(r0) setsockopt$inet6_tcp_int(r1, 0x6, 0x12, &(0x7f0000000000)=0x7f, 0x4) bind$inet6(r0, &(0x7f0000000040)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) getsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER_VALUE(r0, 0x84, 0x7c, &(0x7f00000001c0)={0x0, 0x0, 0x6}, &(0x7f0000000240)=0x8) sendto$inet6(r0, &(0x7f00000004c0), 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x4) socket$inet6(0xa, 0x1000000000002, 0x0) r2 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000200)={0x4, 0x0, &(0x7f0000000100)=[@enter_looper], 0x0, 0x0, &(0x7f0000000180)}) r3 = gettid() timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, &(0x7f0000040000)) tkill(r3, 0x1004000000016) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0xfffffffffffffced, 0x0, &(0x7f0000000040)}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x400c630f}], 0x0, 0x0, &(0x7f0000000f4d)}) [ 478.797597] binder: 25060:25079 Acquire 1 refcount change on invalid ref 0 ret -22 [ 478.805813] binder: 25062:25078 Acquire 1 refcount change on invalid ref 0 ret -22 [ 478.841658] binder: 25062:25078 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 478.849451] binder: 25060:25079 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 478.878337] binder: 25060:25084 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 12:34:16 executing program 5: r0 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000640)="2f67726f75702e73746174003c23fb572a1f0294e6f378b41ad54b4d9d9a1f63f8785ad188a7e1c88875e05b18a4cb3a9cd12dcea440d899c22c652b3a471b4a7fa2f3fdf6e034d804e5f0df4b1dee483b157624c59c0100e89e6a357c000000", 0x2761, 0x0) write$cgroup_type(r0, &(0x7f0000001340)='threaded\x00', 0xfffffd63) writev(r0, &(0x7f00000000c0)=[{&(0x7f0000000140)="c1", 0x1}], 0x1) close(r0) mmap(&(0x7f0000532000/0x3000)=nil, 0x3000, 0x0, 0x32, 0xffffffffffffffff, 0x0) r1 = socket$inet6(0xa, 0x80003, 0x800000000000006) ioctl(r1, 0x8912, &(0x7f0000000000)="153f6234488dd25d766070") socketpair$inet6(0xa, 0x3, 0x5, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_FIOGETOWN(r3, 0x8903, &(0x7f0000000140)) preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f0000000180)=""/148, 0x13d}], 0x1, 0x0) getpid() ioctl$sock_FIOGETOWN(0xffffffffffffff9c, 0x8903, &(0x7f0000000080)=0x0) syz_open_dev$usb(&(0x7f0000000240)='/dev/bus/usb/00#/00#\x00', 0x6, 0x100) r5 = syz_open_procfs(r4, &(0x7f00000000c0)='net/raw6\x00') fcntl$addseals(r2, 0x409, 0x5) preadv(r5, &(0x7f0000000480), 0x0, 0x0) ioctl$FS_IOC_GET_ENCRYPTION_PWSALT(r3, 0x40106614, &(0x7f0000000000)={0x0, @aes256}) [ 478.887751] binder: 25062:25089 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 12:34:16 executing program 1: socket$inet6(0xa, 0x0, 0x80000000) sched_setaffinity(0x0, 0x7, &(0x7f00000000c0)=0x9) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0) fcntl$setflags(0xffffffffffffffff, 0x2, 0x1) r0 = socket$inet6(0xa, 0x400000000001, 0x0) r1 = dup(r0) setsockopt$inet6_tcp_int(r1, 0x6, 0x12, &(0x7f0000000000)=0x7f, 0x4) bind$inet6(r0, &(0x7f0000000040)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) getsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER_VALUE(r0, 0x84, 0x7c, &(0x7f00000001c0)={0x0, 0x0, 0x6}, &(0x7f0000000240)=0x8) sendto$inet6(r0, &(0x7f00000004c0), 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x4) socket$inet6(0xa, 0x1000000000002, 0x0) r2 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000200)={0x4, 0x0, &(0x7f0000000100)=[@enter_looper], 0x0, 0x0, &(0x7f0000000180)}) r3 = gettid() timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, &(0x7f0000040000)) tkill(r3, 0x1004000000016) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0xfffffffffffffced, 0x0, &(0x7f0000000040)}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x400c630f}], 0x0, 0x0, &(0x7f0000000f4d)}) 12:34:16 executing program 2: perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f0000000180)=""/148, 0x13d}], 0x1, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000340)="696f001b66408225aaa3af068fffebb8a490c47dda6586f1b58895b94a78037dd3714e7198820a7a709e2d30d25e6d846cd5c62a648a598668a8263b752b0b622b115112b5ad8e0425c0b784bbdb89eb8f4da0dd73dd01fe35694c2f78600badf8a0e237dba40713bac9e053b41a9f62be5fbb928018aab5f7500bef51a2fd74d4fffb4a20a946733820bdc1b485afa417cdbcfdfbc54f58c9c3edffe240c36f4ab8a16613814e226b6d20d98010ab1ace49fa76dce337a5a5f1dcff9e5d533b12475e33b971b15b69cd591cd9059759f0f04ba5468a34b98915033debb3e87f048e8601712659d47d8687eb6be5e650068d88000000000000") preadv(r0, &(0x7f0000000480), 0x10000000000000be, 0x0) msgget$private(0x0, 0x22) 12:34:16 executing program 4: socket$inet6(0xa, 0x0, 0x80000000) sched_setaffinity(0x0, 0x7, &(0x7f00000000c0)=0x9) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0) fcntl$setflags(0xffffffffffffffff, 0x2, 0x1) r0 = socket$inet6(0xa, 0x400000000001, 0x0) r1 = dup(r0) setsockopt$inet6_tcp_int(r1, 0x6, 0x12, &(0x7f0000000000)=0x7f, 0x4) bind$inet6(r0, &(0x7f0000000040)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) getsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER_VALUE(r0, 0x84, 0x7c, &(0x7f00000001c0)={0x0, 0x0, 0x6}, &(0x7f0000000240)=0x8) sendto$inet6(r0, &(0x7f00000004c0), 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x4) socket$inet6(0xa, 0x1000000000002, 0x0) r2 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000200)={0x4, 0x0, &(0x7f0000000100)=[@enter_looper], 0x0, 0x0, &(0x7f0000000180)}) r3 = gettid() timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, &(0x7f0000040000)) tkill(r3, 0x1004000000016) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0xfffffffffffffced, 0x0, &(0x7f0000000040)}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x400c630f}], 0x0, 0x0, &(0x7f0000000f4d)}) [ 479.094802] binder: BINDER_SET_CONTEXT_MGR already set [ 479.100813] binder: 25104:25105 ioctl 40046207 0 returned -16 [ 479.124803] binder: 25104:25105 Acquire 1 refcount change on invalid ref 0 ret -22 12:34:16 executing program 3: r0 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000640)="2f67726f75702e73746174003c23fb572a1f0294e6f378b41ad54b4d9d9a1f63f8785ad188a7e1c88875e05b18a4cb3a9cd12dcea440d899c22c652b3a471b4a7fa2f3fdf6e034d804e5f0df4b1dee483b157624c59c0100e89e6a357c000000", 0x2761, 0x0) write$cgroup_type(r0, &(0x7f0000001340)='threaded\x00', 0xfffffd63) writev(r0, &(0x7f00000000c0)=[{&(0x7f0000000140)="c1", 0x1}], 0x1) close(r0) mmap(&(0x7f0000532000/0x3000)=nil, 0x3000, 0x0, 0x32, 0xffffffffffffffff, 0x0) r1 = socket$inet6(0xa, 0x80003, 0x800000000000006) ioctl(r1, 0x8912, &(0x7f0000000000)="153f6234488dd25d766070") socketpair$inet6(0xa, 0x3, 0x5, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_FIOGETOWN(r3, 0x8903, &(0x7f0000000140)) preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f0000000180)=""/148, 0x13d}], 0x1, 0x0) getpid() ioctl$sock_FIOGETOWN(0xffffffffffffff9c, 0x8903, &(0x7f0000000080)=0x0) syz_open_dev$usb(&(0x7f0000000240)='/dev/bus/usb/00#/00#\x00', 0x6, 0x100) r5 = syz_open_procfs(r4, &(0x7f00000000c0)='net/raw6\x00') fcntl$addseals(r2, 0x409, 0x5) preadv(r5, &(0x7f0000000480), 0x0, 0x0) ioctl$FS_IOC_GET_ENCRYPTION_PWSALT(r3, 0x40106614, &(0x7f0000000000)={0x0, @aes256}) 12:34:16 executing program 2: perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f0000000180)=""/148, 0x13d}], 0x1, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000340)="696f001b66408225aaa3af068fffebb8a490c47dda6586f1b58895b94a78037dd3714e7198820a7a709e2d30d25e6d846cd5c62a648a598668a8263b752b0b622b115112b5ad8e0425c0b784bbdb89eb8f4da0dd73dd01fe35694c2f78600badf8a0e237dba40713bac9e053b41a9f62be5fbb928018aab5f7500bef51a2fd74d4fffb4a20a946733820bdc1b485afa417cdbcfdfbc54f58c9c3edffe240c36f4ab8a16613814e226b6d20d98010ab1ace49fa76dce337a5a5f1dcff9e5d533b12475e33b971b15b69cd591cd9059759f0f04ba5468a34b98915033debb3e87f048e8601712659d47d8687eb6be5e650068d88000000000000") preadv(r0, &(0x7f0000000480), 0x1000000000000191, 0x0) msgget$private(0x0, 0x22) 12:34:16 executing program 1: socket$inet6(0xa, 0x0, 0x80000000) sched_setaffinity(0x0, 0x7, &(0x7f00000000c0)=0x9) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0) fcntl$setflags(0xffffffffffffffff, 0x2, 0x1) r0 = socket$inet6(0xa, 0x400000000001, 0x0) r1 = dup(r0) setsockopt$inet6_tcp_int(r1, 0x6, 0x12, &(0x7f0000000000)=0x7f, 0x4) bind$inet6(r0, &(0x7f0000000040)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) getsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER_VALUE(r0, 0x84, 0x7c, &(0x7f00000001c0)={0x0, 0x0, 0x6}, &(0x7f0000000240)=0x8) sendto$inet6(r0, &(0x7f00000004c0), 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x4) socket$inet6(0xa, 0x1000000000002, 0x0) r2 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000200)={0x4, 0x0, &(0x7f0000000100)=[@enter_looper], 0x0, 0x0, &(0x7f0000000180)}) r3 = gettid() timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, &(0x7f0000040000)) tkill(r3, 0x1004000000016) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0xfffffffffffffced, 0x0, &(0x7f0000000040)}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x400c630f}], 0x0, 0x0, &(0x7f0000000f4d)}) 12:34:16 executing program 0: socket$inet6(0xa, 0x0, 0x80000000) syz_open_dev$sndctrl(&(0x7f0000000140)='/dev/snd/controlC#\x00', 0x9, 0x400000) sched_setaffinity(0x0, 0x7, &(0x7f00000000c0)=0x9) r0 = perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0) fcntl$setflags(r0, 0x2, 0x1) pipe(&(0x7f0000000100)) r1 = socket$inet6(0xa, 0x400000000001, 0x0) r2 = dup(r1) setsockopt$inet6_tcp_int(r2, 0x6, 0x12, &(0x7f0000000000)=0x7f, 0x4) bind$inet6(r1, &(0x7f0000000040)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) getsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER_VALUE(r1, 0x84, 0x7c, &(0x7f00000001c0)={0x0, 0x100000001, 0x6}, &(0x7f0000000240)=0x8) sendto$inet6(r1, &(0x7f00000004c0), 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) socket$inet6(0xa, 0x1000000000002, 0x0) r3 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r3, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000200)={0x4, 0x0, &(0x7f0000000100)=[@enter_looper], 0x1, 0x0, &(0x7f0000000180)='T'}) r4 = gettid() timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, &(0x7f0000040000)) tkill(r4, 0x1004000000016) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0xfffffffffffffced, 0x0, &(0x7f0000000040)}) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x400c630f}], 0x0, 0x0, &(0x7f0000000f4d)}) 12:34:16 executing program 5: preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f0000000180)=""/148, 0xfffffffffffffda4}], 0x1, 0x1) r0 = socket$inet6(0xa, 0x803, 0x3) ioctl(r0, 0x1000008912, &(0x7f0000000000)) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$nl_netfilter(r1, &(0x7f0000000180)={&(0x7f0000000040), 0xc, &(0x7f0000000080)={&(0x7f0000000280)=ANY=[@ANYBLOB="18000000060601000000000000c57c5cda00000024000100"], 0x18}}, 0x0) r2 = syz_open_procfs(0x0, &(0x7f0000000340)="696f001b66408225aaa3af068fffebb8a490c47dda6586f1b58895b94a78037dd3714e7198820a7a709e2d30d25e6d846cd5c62a648a598668a8263b752b0b622b115112b5ad8e0425c0b784bbdb89eb8f4da0dd73dd01fe35694c2f78600badf8a0e237dba40713bac9e053b41a9f62be5fbb928018aab5f7500bef51a2fd74d4fffb4a20a946733820bdc1b485afa417cdbcfdfbc54f58c9c3edffe240c36f4ab8a16613814e226b6d20d98010ab1ace49fa76dce337a5a5f1dcff9e5d533b12475e33b971b15b69cd591cd9059759f0f04ba5468a34b98915033debb3e87f048e8601712659d47d8687eb6be5e650068d88000000000000") r3 = request_key(&(0x7f0000000000)='asymmetric\x00', &(0x7f0000000040)={0x73, 0x79, 0x7a, 0x3}, &(0x7f0000000080)="696f001b66408225aaa3af068fffebb8a490c47dda6586f1b58895b94a78037dd3714e7198820a7a709e2d30d25e6d846cd5c62a648a598668a8263b752b0b622b115112b5ad8e0425c0b784bbdb89eb8f4da0dd73dd01fe35694c2f78600badf8a0e237dba40713bac9e053b41a9f62be5fbb928018aab5f7500bef51a2fd74d4fffb4a20a946733820bdc1b485afa417cdbcfdfbc54f58c9c3edffe240c36f4ab8a16613814e226b6d20d98010ab1ace49fa76dce337a5a5f1dcff9e5d533b12475e33b971b15b69cd591cd9059759f0f04ba5468a34b98915033debb3e87f048e8601712659d47d8687eb6be5e650068d8800", 0x0) keyctl$get_security(0x11, r3, &(0x7f0000000240)=""/97, 0x61) getsockopt$inet_tcp_TCP_ZEROCOPY_RECEIVE(r2, 0x6, 0x23, &(0x7f00000002c0)={&(0x7f0000fed000/0x11000)=nil, 0x11000}, &(0x7f0000000300)=0x10) preadv(r2, &(0x7f0000000480), 0x10000000000002a1, 0x0) 12:34:16 executing program 2: perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f0000000180)=""/148, 0x13d}], 0x1, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000340)="696f001b66408225aaa3af068fffebb8a490c47dda6586f1b58895b94a78037dd3714e7198820a7a709e2d30d25e6d846cd5c62a648a598668a8263b752b0b622b115112b5ad8e0425c0b784bbdb89eb8f4da0dd73dd01fe35694c2f78600badf8a0e237dba40713bac9e053b41a9f62be5fbb928018aab5f7500bef51a2fd74d4fffb4a20a946733820bdc1b485afa417cdbcfdfbc54f58c9c3edffe240c36f4ab8a16613814e226b6d20d98010ab1ace49fa76dce337a5a5f1dcff9e5d533b12475e33b971b15b69cd591cd9059759f0f04ba5468a34b98915033debb3e87f048e8601712659d47d8687eb6be5e650068d88000000000000") preadv(r0, &(0x7f0000000480), 0x10000000000002a1, 0xa00) msgget$private(0x0, 0x22) [ 479.479641] netlink: 4 bytes leftover after parsing attributes in process `syz-executor5'. 12:34:16 executing program 1: syz_open_dev$sndctrl(&(0x7f0000000140)='/dev/snd/controlC#\x00', 0x0, 0x0) sched_setaffinity(0x0, 0x7, &(0x7f00000000c0)=0x9) r0 = perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0) fcntl$setflags(r0, 0x2, 0x1) getsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER_VALUE(0xffffffffffffffff, 0x84, 0x7c, &(0x7f00000001c0)={0x0, 0x100000001, 0x6}, &(0x7f0000000240)=0x8) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(0xffffffffffffffff, 0x84, 0x9, &(0x7f0000000280)={r1, @in={{0x2, 0x4e23, @remote}}, 0xfffffffffffffff7, 0x7850, 0x400, 0x97df, 0xc1}, 0x98) sendto$inet6(0xffffffffffffffff, &(0x7f00000004c0), 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) setsockopt$SO_BINDTODEVICE(0xffffffffffffffff, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x4) socket$inet6(0xa, 0x1000000000002, 0x0) r2 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000200)={0x4, 0x0, &(0x7f0000000100)=[@enter_looper], 0x1, 0x0, &(0x7f0000000180)='T'}) r3 = gettid() timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, &(0x7f0000040000)) tkill(r3, 0x1004000000016) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0xfffffffffffffced, 0x0, &(0x7f0000000040)}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x400c630f}], 0x0, 0x0, &(0x7f0000000f4d)}) 12:34:16 executing program 5: preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f0000000180)=""/148, 0x13d}], 0x1, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='cpuacct.usage_percpu_sys\x00', 0x0, 0x0) ioctl$LOOP_SET_CAPACITY(r0, 0x4c07) r1 = syz_open_procfs(0x0, &(0x7f0000000340)="696f001b66408225aaa3af068fffebb8a490c47dda6586f1b58895b94a78037dd3714e7198820a7a709e2d30d25e6d846cd5c62a648a598668a8263b752b0b622b115112b5ad8e0425c0b784bbdb89eb8f4da0dd73dd01fe35694c2f78600badf8a0e237dba40713bac9e053b41a9f62be5fbb928018aab5f7500bef51a2fd74d4fffb4a20a946733820bdc1b485afa417cdbcfdfbc54f58c9c3edffe240c36f4ab8a16613814e226b6d20d98010ab1ace49fa76dce337a5a5f1dcff9e5d533b12475e33b971b15b69cd591cd9059759f0f04ba5468a34b98915033debb3e87f048e8601712659d47d8687eb6be5e650068d88000000000000") preadv(r1, &(0x7f0000000480), 0x10000000000002a1, 0x0) ioctl$TIOCSLCKTRMIOS(r1, 0x5457, &(0x7f0000000000)) [ 479.552328] netlink: 4 bytes leftover after parsing attributes in process `syz-executor5'. 12:34:17 executing program 0: syz_open_dev$sndctrl(&(0x7f0000000140)='/dev/snd/controlC#\x00', 0x0, 0x0) sched_setaffinity(0x0, 0x7, &(0x7f00000000c0)=0x9) r0 = perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0) fcntl$setflags(r0, 0x2, 0x1) getsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER_VALUE(0xffffffffffffffff, 0x84, 0x7c, &(0x7f00000001c0)={0x0, 0x100000001, 0x6}, &(0x7f0000000240)=0x8) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(0xffffffffffffffff, 0x84, 0x9, &(0x7f0000000280)={r1, @in={{0x2, 0x4e23, @remote}}, 0xfffffffffffffff7, 0x7850, 0x400, 0x97df, 0xc1}, 0x98) sendto$inet6(0xffffffffffffffff, &(0x7f00000004c0), 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) setsockopt$SO_BINDTODEVICE(0xffffffffffffffff, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x4) socket$inet6(0xa, 0x1000000000002, 0x0) r2 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000200)={0x4, 0x0, &(0x7f0000000100)=[@enter_looper], 0x1, 0x0, &(0x7f0000000180)='T'}) r3 = gettid() timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, &(0x7f0000040000)) tkill(r3, 0x1004000000016) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0xfffffffffffffced, 0x0, &(0x7f0000000040)}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x400c630f}], 0x0, 0x0, &(0x7f0000000f4d)}) 12:34:17 executing program 2: perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f0000000180)=""/148, 0x13d}], 0x1, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000340)="696f001b66408225aaa3af068fffebb8a490c47dda6586f1b58895b94a78037dd3714e7198820a7a709e2d30d25e6d846cd5c62a648a598668a8263b752b0b622b115112b5ad8e0425c0b784bbdb89eb8f4da0dd73dd01fe35694c2f78600badf8a0e237dba40713bac9e053b41a9f62be5fbb928018aab5f7500bef51a2fd74d4fffb4a20a946733820bdc1b485afa417cdbcfdfbc54f58c9c3edffe240c36f4ab8a16613814e226b6d20d98010ab1ace49fa76dce337a5a5f1dcff9e5d533b12475e33b971b15b69cd591cd9059759f0f04ba5468a34b98915033debb3e87f048e8601712659d47d8687eb6be5e650068d88000000000000") preadv(r0, &(0x7f0000000480), 0x10000000000002a1, 0xa000000) msgget$private(0x0, 0x22) 12:34:17 executing program 5: preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f0000000180)=""/148, 0x13d}], 0x1, 0x0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000000)={0x0}, &(0x7f0000000040)=0xc) waitid(0x0, r0, &(0x7f0000000080), 0x1000002, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000340)="696f001b66408225aaa3af068fffebb8a490c47dda6586f1b58895b94a78037dd3714e7198820a7a709e2d30d25e6d846cd5c62a648a598668a8263b752b0b622b115112b5ad8e0425c0b784bbdb89eb8f4da0dd73dd01fe35694c2f78600badf8a0e237dba40713bac9e053b41a9f62be5fbb928018aab5f7500bef51a2fd74d4fffb4a20a946733820bdc1b485afa417cdbcfdfbc54f58c9c3edffe240c36f4ab8a16613814e226b6d20d98010ab1ace49fa76dce337a5a5f1dcff9e5d533b12475e33b971b15b69cd591cd9059759f0f04ba5468a34b98915033debb3e87f048e8601712659d47d8687eb6be5e650068d88000000000000") preadv(r1, &(0x7f0000000480), 0x10000000000002a1, 0x0) [ 479.766378] binder: BINDER_SET_CONTEXT_MGR already set [ 479.786928] binder: 25143:25148 ioctl 40046207 0 returned -16 12:34:17 executing program 4: socket$inet6(0xa, 0x0, 0x80000000) sched_setaffinity(0x0, 0x7, &(0x7f00000000c0)=0x9) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0) fcntl$setflags(0xffffffffffffffff, 0x2, 0x1) r0 = socket$inet6(0xa, 0x400000000001, 0x0) r1 = dup(r0) setsockopt$inet6_tcp_int(r1, 0x6, 0x12, &(0x7f0000000000)=0x7f, 0x4) bind$inet6(r0, &(0x7f0000000040)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) getsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER_VALUE(r0, 0x84, 0x7c, &(0x7f00000001c0)={0x0, 0x0, 0x6}, &(0x7f0000000240)=0x8) sendto$inet6(r0, &(0x7f00000004c0), 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x4) socket$inet6(0xa, 0x1000000000002, 0x0) r2 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000200)={0x4, 0x0, &(0x7f0000000100)=[@enter_looper], 0x1, 0x0, &(0x7f0000000180)='T'}) r3 = gettid() timer_create(0x0, &(0x7f0000044000), &(0x7f0000044000)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, &(0x7f0000040000)) tkill(r3, 0x1004000000016) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0xfffffffffffffced, 0x0, &(0x7f0000000040)}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x400c630f}], 0x0, 0x0, &(0x7f0000000f4d)}) [ 479.884438] binder: 25143:25154 Acquire 1 refcount change on invalid ref 0 ret -22 12:34:17 executing program 3: socket$inet6(0xa, 0x0, 0x80000000) sched_setaffinity(0x0, 0x7, &(0x7f00000000c0)=0x9) r0 = perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0) fcntl$setflags(r0, 0x2, 0x1) getsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER_VALUE(0xffffffffffffffff, 0x84, 0x7c, &(0x7f00000001c0)={0x0, 0x100000001, 0x6}, &(0x7f0000000240)=0x8) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(0xffffffffffffffff, 0x84, 0x9, &(0x7f0000000280)={r1, @in={{0x2, 0x4e23, @remote}}, 0xfffffffffffffff7, 0x7850, 0x400, 0x97df, 0xc1}, 0x98) sendto$inet6(0xffffffffffffffff, &(0x7f00000004c0), 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) setsockopt$SO_BINDTODEVICE(0xffffffffffffffff, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x4) socket$inet6(0xa, 0x1000000000002, 0x0) r2 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000200)={0x4, 0x0, &(0x7f0000000100)=[@enter_looper], 0x1, 0x0, &(0x7f0000000180)='T'}) r3 = gettid() timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, &(0x7f0000040000)) tkill(r3, 0x1004000000016) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0xfffffffffffffced, 0x0, &(0x7f0000000040)}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x400c630f}], 0x0, 0x0, &(0x7f0000000f4d)}) 12:34:17 executing program 1: socket$inet6(0xa, 0x0, 0x80000000) syz_open_dev$sndctrl(&(0x7f0000000140)='/dev/snd/controlC#\x00', 0x9, 0x400000) sched_setaffinity(0x0, 0x7, &(0x7f00000000c0)=0x9) r0 = perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0) fcntl$setflags(r0, 0x2, 0x1) pipe(&(0x7f0000000100)) r1 = socket$inet6(0xa, 0x400000000001, 0x0) r2 = dup(r1) setsockopt$inet6_tcp_int(r2, 0x6, 0x12, &(0x7f0000000000)=0x7f, 0x4) bind$inet6(r1, &(0x7f0000000040)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) getsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER_VALUE(r1, 0x84, 0x7c, &(0x7f00000001c0)={0x0, 0x100000001, 0x6}, &(0x7f0000000240)=0x8) sendto$inet6(r1, &(0x7f00000004c0), 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) setsockopt$SO_BINDTODEVICE(r1, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x4) socket$inet6(0xa, 0x1000000000002, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000200)={0x4, 0x0, &(0x7f0000000100)=[@enter_looper], 0x1, 0x0, &(0x7f0000000180)='T'}) r3 = gettid() timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, &(0x7f0000040000)) tkill(r3, 0x1004000000016) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0xfffffffffffffced, 0x0, &(0x7f0000000040)}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x400c630f}], 0x0, 0x0, &(0x7f0000000f4d)}) 12:34:17 executing program 2: perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f0000000180)=""/148, 0x13d}], 0x1, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000340)="696f001b66408225aaa3af068fffebb8a490c47dda6586f1b58895b94a78037dd3714e7198820a7a709e2d30d25e6d846cd5c62a648a598668a8263b752b0b622b115112b5ad8e0425c0b784bbdb89eb8f4da0dd73dd01fe35694c2f78600badf8a0e237dba40713bac9e053b41a9f62be5fbb928018aab5f7500bef51a2fd74d4fffb4a20a946733820bdc1b485afa417cdbcfdfbc54f58c9c3edffe240c36f4ab8a16613814e226b6d20d98010ab1ace49fa76dce337a5a5f1dcff9e5d533b12475e33b971b15b69cd591cd9059759f0f04ba5468a34b98915033debb3e87f048e8601712659d47d8687eb6be5e650068d88000000000000") preadv(r0, &(0x7f0000000480), 0x10000000000002a1, 0x10000000000000) msgget$private(0x0, 0x22) 12:34:17 executing program 5: socket$inet6(0xa, 0x0, 0x80000000) sched_setaffinity(0x0, 0x7, &(0x7f00000000c0)=0x9) r0 = perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0) fcntl$setflags(r0, 0x2, 0x1) getsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER_VALUE(0xffffffffffffffff, 0x84, 0x7c, &(0x7f00000001c0)={0x0, 0x100000001, 0x6}, &(0x7f0000000240)=0x8) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(0xffffffffffffffff, 0x84, 0x9, &(0x7f0000000280)={r1, @in={{0x2, 0x4e23, @remote}}, 0xfffffffffffffff7, 0x7850, 0x400, 0x97df, 0xc1}, 0x98) sendto$inet6(0xffffffffffffffff, &(0x7f00000004c0), 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) setsockopt$SO_BINDTODEVICE(0xffffffffffffffff, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x4) socket$inet6(0xa, 0x1000000000002, 0x0) r2 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000200)={0x4, 0x0, &(0x7f0000000100)=[@enter_looper], 0x1, 0x0, &(0x7f0000000180)='T'}) r3 = gettid() timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, &(0x7f0000040000)) tkill(r3, 0x1004000000016) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0xfffffffffffffced, 0x0, &(0x7f0000000040)}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x400c630f}], 0x0, 0x0, &(0x7f0000000f4d)}) 12:34:17 executing program 1: socket$inet6(0xa, 0x0, 0x80000000) syz_open_dev$sndctrl(&(0x7f0000000140)='/dev/snd/controlC#\x00', 0x9, 0x400000) r0 = perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0) fcntl$setflags(r0, 0x2, 0x1) getsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER_VALUE(0xffffffffffffffff, 0x84, 0x7c, &(0x7f00000001c0)={0x0, 0x100000001, 0x6}, &(0x7f0000000240)=0x8) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(0xffffffffffffffff, 0x84, 0x9, &(0x7f0000000280)={r1, @in={{0x2, 0x4e23, @remote}}, 0xfffffffffffffff7, 0x7850, 0x400, 0x97df, 0xc1}, 0x98) sendto$inet6(0xffffffffffffffff, &(0x7f00000004c0), 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) setsockopt$SO_BINDTODEVICE(0xffffffffffffffff, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x4) socket$inet6(0xa, 0x1000000000002, 0x0) r2 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000200)={0x4, 0x0, &(0x7f0000000100)=[@enter_looper], 0x1, 0x0, &(0x7f0000000180)='T'}) r3 = gettid() timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, &(0x7f0000040000)) tkill(r3, 0x1004000000016) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0xfffffffffffffced, 0x0, &(0x7f0000000040)}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x400c630f}], 0x0, 0x0, &(0x7f0000000f4d)}) [ 480.083603] binder: BINDER_SET_CONTEXT_MGR already set [ 480.101071] binder: 25165:25169 ioctl 40046207 0 returned -16 12:34:17 executing program 2: perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f0000000180)=""/148, 0x13d}], 0x1, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000340)="696f001b66408225aaa3af068fffebb8a490c47dda6586f1b58895b94a78037dd3714e7198820a7a709e2d30d25e6d846cd5c62a648a598668a8263b752b0b622b115112b5ad8e0425c0b784bbdb89eb8f4da0dd73dd01fe35694c2f78600badf8a0e237dba40713bac9e053b41a9f62be5fbb928018aab5f7500bef51a2fd74d4fffb4a20a946733820bdc1b485afa417cdbcfdfbc54f58c9c3edffe240c36f4ab8a16613814e226b6d20d98010ab1ace49fa76dce337a5a5f1dcff9e5d533b12475e33b971b15b69cd591cd9059759f0f04ba5468a34b98915033debb3e87f048e8601712659d47d8687eb6be5e650068d88000000000000") preadv(r0, &(0x7f0000000480), 0x10000000000002a1, 0x7000000) msgget$private(0x0, 0x22) [ 480.137827] binder: BINDER_SET_CONTEXT_MGR already set [ 480.148287] binder: 25171:25172 ioctl 40046207 0 returned -16 [ 480.169193] binder: BINDER_SET_CONTEXT_MGR already set 12:34:17 executing program 5: preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f0000000180)=""/148, 0x13d}], 0x1, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000340)="696f001b66408225aaa3af068fffebb8a490c47dda6586f1b58895b94a78037dd3714e7198820a7a709e2d30d25e6d846cd5c62a648a598668a8263b752b0b622b115112b5ad8e0425c0b784bbdb89eb8f4da0dd73dd01fe35694c2f78600badf8a0e237dba40713bac9e053b41a9f62be5fbb928018aab5f7500bef51a2fd74d4fffb4a20a946733820bdc1b485afa417cdbcfdfbc54f58c9c3edffe240c36f4ab8a16613814e226b6d20d98010ab1ace49fa76dce337a5a5f1dcff9e5d533b12475e33b971b15b69cd591cd9059759f0f04ba5468a34b98915033debb3e87f048e8601712659d47d8687eb6be5e650068d88000000000000") preadv(r0, &(0x7f0000000480), 0x10000000000001d9, 0x0) [ 480.183236] binder: 25174:25175 ioctl 40046207 0 returned -16 12:34:17 executing program 2: perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f0000000180)=""/148, 0x13d}], 0x1, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000340)="696f001b66408225aaa3af068fffebb8a490c47dda6586f1b58895b94a78037dd3714e7198820a7a709e2d30d25e6d846cd5c62a648a598668a8263b752b0b622b115112b5ad8e0425c0b784bbdb89eb8f4da0dd73dd01fe35694c2f78600badf8a0e237dba40713bac9e053b41a9f62be5fbb928018aab5f7500bef51a2fd74d4fffb4a20a946733820bdc1b485afa417cdbcfdfbc54f58c9c3edffe240c36f4ab8a16613814e226b6d20d98010ab1ace49fa76dce337a5a5f1dcff9e5d533b12475e33b971b15b69cd591cd9059759f0f04ba5468a34b98915033debb3e87f048e8601712659d47d8687eb6be5e650068d88000000000000") preadv(r0, &(0x7f0000000480), 0x10000000000002a1, 0x5000000) msgget$private(0x0, 0x22) 12:34:17 executing program 0: syz_open_dev$sndctrl(&(0x7f0000000140)='/dev/snd/controlC#\x00', 0x0, 0x0) sched_setaffinity(0x0, 0x7, &(0x7f00000000c0)=0x9) r0 = perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0) fcntl$setflags(r0, 0x2, 0x1) getsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER_VALUE(0xffffffffffffffff, 0x84, 0x7c, &(0x7f00000001c0)={0x0, 0x100000001, 0x6}, &(0x7f0000000240)=0x8) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(0xffffffffffffffff, 0x84, 0x9, &(0x7f0000000280)={r1, @in={{0x2, 0x4e23, @remote}}, 0xfffffffffffffff7, 0x7850, 0x400, 0x97df, 0xc1}, 0x98) sendto$inet6(0xffffffffffffffff, &(0x7f00000004c0), 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) setsockopt$SO_BINDTODEVICE(0xffffffffffffffff, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x4) socket$inet6(0xa, 0x1000000000002, 0x0) r2 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000200)={0x4, 0x0, &(0x7f0000000100)=[@enter_looper], 0x1, 0x0, &(0x7f0000000180)='T'}) r3 = gettid() timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, &(0x7f0000040000)) tkill(r3, 0x1004000000016) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0xfffffffffffffced, 0x0, &(0x7f0000000040)}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x400c630f}], 0x0, 0x0, &(0x7f0000000f4d)}) 12:34:17 executing program 3: socket$inet6(0xa, 0x0, 0x80000000) sched_setaffinity(0x0, 0x7, &(0x7f00000000c0)=0x9) r0 = perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0) fcntl$setflags(r0, 0x2, 0x1) getsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER_VALUE(0xffffffffffffffff, 0x84, 0x7c, &(0x7f00000001c0)={0x0, 0x100000001, 0x6}, &(0x7f0000000240)=0x8) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(0xffffffffffffffff, 0x84, 0x9, &(0x7f0000000280)={r1, @in={{0x2, 0x4e23, @remote}}, 0xfffffffffffffff7, 0x7850, 0x400, 0x97df, 0xc1}, 0x98) sendto$inet6(0xffffffffffffffff, &(0x7f00000004c0), 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) setsockopt$SO_BINDTODEVICE(0xffffffffffffffff, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x4) socket$inet6(0xa, 0x1000000000002, 0x0) r2 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000200)={0x4, 0x0, &(0x7f0000000100)=[@enter_looper], 0x1, 0x0, &(0x7f0000000180)='T'}) r3 = gettid() timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, &(0x7f0000040000)) tkill(r3, 0x1004000000016) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0xfffffffffffffced, 0x0, &(0x7f0000000040)}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x400c630f}], 0x0, 0x0, &(0x7f0000000f4d)}) 12:34:17 executing program 5: socket$inet6(0xa, 0x0, 0x80000000) syz_open_dev$sndctrl(&(0x7f0000000140)='/dev/snd/controlC#\x00', 0x9, 0x400000) sched_setaffinity(0x0, 0x7, &(0x7f00000000c0)=0x9) r0 = perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0) fcntl$setflags(r0, 0x2, 0x1) pipe(&(0x7f0000000100)) r1 = socket$inet6(0xa, 0x400000000001, 0x0) getsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER_VALUE(r1, 0x84, 0x7c, &(0x7f00000001c0)={0x0, 0x100000001, 0x6}, &(0x7f0000000240)=0x8) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r1, 0x84, 0x9, &(0x7f0000000280)={r2, @in={{0x2, 0x4e23, @remote}}, 0xfffffffffffffff7, 0x7850, 0x400, 0x97df, 0xc1}, 0x98) sendto$inet6(r1, &(0x7f00000004c0), 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) setsockopt$SO_BINDTODEVICE(r1, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x4) socket$inet6(0xa, 0x1000000000002, 0x0) r3 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r3, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000200)={0x4, 0x0, &(0x7f0000000100)=[@enter_looper], 0x1, 0x0, &(0x7f0000000180)='T'}) r4 = gettid() timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, &(0x7f0000040000)) tkill(r4, 0x1004000000016) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0xfffffffffffffced, 0x0, &(0x7f0000000040)}) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x400c630f}], 0x0, 0x0, &(0x7f0000000f4d)}) [ 480.583890] nf_conntrack: default automatic helper assignment has been turned off for security reasons and CT-based firewall rule not found. Use the iptables CT target to attach helpers instead. [ 480.611111] binder: BINDER_SET_CONTEXT_MGR already set [ 480.626340] binder: BINDER_SET_CONTEXT_MGR already set [ 480.632931] binder: 25199:25200 ioctl 40046207 0 returned -16 [ 480.640555] binder: 25197:25198 ioctl 40046207 0 returned -16 [ 480.649251] binder: BINDER_SET_CONTEXT_MGR already set [ 480.655387] binder: 25195:25196 ioctl 40046207 0 returned -16 12:34:20 executing program 2: perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f0000000180)=""/148, 0x13d}], 0x1, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000340)="696f001b66408225aaa3af068fffebb8a490c47dda6586f1b58895b94a78037dd3714e7198820a7a709e2d30d25e6d846cd5c62a648a598668a8263b752b0b622b115112b5ad8e0425c0b784bbdb89eb8f4da0dd73dd01fe35694c2f78600badf8a0e237dba40713bac9e053b41a9f62be5fbb928018aab5f7500bef51a2fd74d4fffb4a20a946733820bdc1b485afa417cdbcfdfbc54f58c9c3edffe240c36f4ab8a16613814e226b6d20d98010ab1ace49fa76dce337a5a5f1dcff9e5d533b12475e33b971b15b69cd591cd9059759f0f04ba5468a34b98915033debb3e87f048e8601712659d47d8687eb6be5e650068d88000000000000") preadv(r0, &(0x7f0000000480), 0x10000000000002a1, 0x100000000000000) msgget$private(0x0, 0x22) 12:34:20 executing program 1: socket$inet6(0xa, 0x0, 0x80000000) syz_open_dev$sndctrl(&(0x7f0000000140)='/dev/snd/controlC#\x00', 0x9, 0x400000) sched_setaffinity(0x0, 0x7, &(0x7f00000000c0)=0x9) r0 = perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0) fcntl$setflags(r0, 0x2, 0x1) pipe(&(0x7f0000000100)) r1 = socket$inet6(0xa, 0x400000000001, 0x0) r2 = dup(r1) setsockopt$inet6_tcp_int(r2, 0x6, 0x12, &(0x7f0000000000)=0x7f, 0x4) bind$inet6(r1, &(0x7f0000000040)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r1, 0x84, 0x9, &(0x7f0000000280)={0x0, @in={{0x2, 0x4e23, @remote}}, 0xfffffffffffffff7, 0x7850, 0x400, 0x97df, 0xc1}, 0x98) sendto$inet6(r1, &(0x7f00000004c0), 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) setsockopt$SO_BINDTODEVICE(r1, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x4) socket$inet6(0xa, 0x1000000000002, 0x0) r3 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r3, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000200)={0x4, 0x0, &(0x7f0000000100)=[@enter_looper], 0x1, 0x0, &(0x7f0000000180)='T'}) r4 = gettid() timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, &(0x7f0000040000)) tkill(r4, 0x1004000000016) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0xfffffffffffffced, 0x0, &(0x7f0000000040)}) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x400c630f}], 0x0, 0x0, &(0x7f0000000f4d)}) 12:34:20 executing program 0: syz_open_dev$sndctrl(&(0x7f0000000140)='/dev/snd/controlC#\x00', 0x0, 0x0) sched_setaffinity(0x0, 0x7, &(0x7f00000000c0)=0x9) r0 = perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0) fcntl$setflags(r0, 0x2, 0x1) getsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER_VALUE(0xffffffffffffffff, 0x84, 0x7c, &(0x7f00000001c0)={0x0, 0x100000001, 0x6}, &(0x7f0000000240)=0x8) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(0xffffffffffffffff, 0x84, 0x9, &(0x7f0000000280)={r1, @in={{0x2, 0x4e23, @remote}}, 0xfffffffffffffff7, 0x7850, 0x400, 0x97df, 0xc1}, 0x98) sendto$inet6(0xffffffffffffffff, &(0x7f00000004c0), 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) setsockopt$SO_BINDTODEVICE(0xffffffffffffffff, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x4) socket$inet6(0xa, 0x1000000000002, 0x0) r2 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000200)={0x4, 0x0, &(0x7f0000000100)=[@enter_looper], 0x1, 0x0, &(0x7f0000000180)='T'}) r3 = gettid() timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, &(0x7f0000040000)) tkill(r3, 0x1004000000016) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0xfffffffffffffced, 0x0, &(0x7f0000000040)}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x400c630f}], 0x0, 0x0, &(0x7f0000000f4d)}) 12:34:20 executing program 3: socket$inet6(0xa, 0x0, 0x80000000) sched_setaffinity(0x0, 0x7, &(0x7f00000000c0)=0x9) r0 = perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0) fcntl$setflags(r0, 0x2, 0x1) getsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER_VALUE(0xffffffffffffffff, 0x84, 0x7c, &(0x7f00000001c0)={0x0, 0x100000001, 0x6}, &(0x7f0000000240)=0x8) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(0xffffffffffffffff, 0x84, 0x9, &(0x7f0000000280)={r1, @in={{0x2, 0x4e23, @remote}}, 0xfffffffffffffff7, 0x7850, 0x400, 0x97df, 0xc1}, 0x98) sendto$inet6(0xffffffffffffffff, &(0x7f00000004c0), 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) setsockopt$SO_BINDTODEVICE(0xffffffffffffffff, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x4) socket$inet6(0xa, 0x1000000000002, 0x0) r2 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000200)={0x4, 0x0, &(0x7f0000000100)=[@enter_looper], 0x1, 0x0, &(0x7f0000000180)='T'}) r3 = gettid() timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, &(0x7f0000040000)) tkill(r3, 0x1004000000016) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0xfffffffffffffced, 0x0, &(0x7f0000000040)}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x400c630f}], 0x0, 0x0, &(0x7f0000000f4d)}) 12:34:20 executing program 4: socket$inet6(0xa, 0x0, 0x80000000) sched_setaffinity(0x0, 0x7, &(0x7f00000000c0)=0x9) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0) fcntl$setflags(0xffffffffffffffff, 0x2, 0x1) r0 = socket$inet6(0xa, 0x400000000001, 0x0) r1 = dup(r0) setsockopt$inet6_tcp_int(r1, 0x6, 0x12, &(0x7f0000000000)=0x7f, 0x4) bind$inet6(r0, &(0x7f0000000040)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) getsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER_VALUE(r0, 0x84, 0x7c, &(0x7f00000001c0)={0x0, 0x0, 0x6}, &(0x7f0000000240)=0x8) sendto$inet6(r0, &(0x7f00000004c0), 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x4) socket$inet6(0xa, 0x1000000000002, 0x0) r2 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000200)={0x4, 0x0, &(0x7f0000000100)=[@enter_looper], 0x1, 0x0, &(0x7f0000000180)='T'}) r3 = gettid() timer_create(0x0, &(0x7f0000044000), &(0x7f0000044000)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, &(0x7f0000040000)) tkill(r3, 0x1004000000016) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0xfffffffffffffced, 0x0, &(0x7f0000000040)}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x400c630f}], 0x0, 0x0, &(0x7f0000000f4d)}) 12:34:20 executing program 5: preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f0000000180)=""/148, 0x13d}], 0x1, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000340)="696f001b66408225aaa3af068fffebb8a490c47dda6586f1b58895b94a78037dd3714e7198820a7a709e2d30d25e6d846cd5c62a648a598668a8263b752b0b622b115112b5ad8e0425c0b784bbdb89eb8f4da0dd73dd01fe35694c2f78600badf8a0e237dba40713bac9e053b41a9f62be5fbb928018aab5f7500bef51a2fd74d4fffb4a20a946733820bdc1b485afa417cdbcfdfbc54f58c9c3edffe240c36f4ab8a16613814e226b6d20d98010ab1ace49fa76dce337a5a5f1dcff9e5d533b12475e33b971b15b69cd591cd9059759f0f04ba5468a34b98915033debb3e87f048e8601712659d47d8687eb6be5e650068d88000000000000") preadv(r0, &(0x7f0000000480), 0x10000000000000fa, 0x0) 12:34:20 executing program 2: perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f0000000180)=""/148, 0x13d}], 0x1, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000340)="696f001b66408225aaa3af068fffebb8a490c47dda6586f1b58895b94a78037dd3714e7198820a7a709e2d30d25e6d846cd5c62a648a598668a8263b752b0b622b115112b5ad8e0425c0b784bbdb89eb8f4da0dd73dd01fe35694c2f78600badf8a0e237dba40713bac9e053b41a9f62be5fbb928018aab5f7500bef51a2fd74d4fffb4a20a946733820bdc1b485afa417cdbcfdfbc54f58c9c3edffe240c36f4ab8a16613814e226b6d20d98010ab1ace49fa76dce337a5a5f1dcff9e5d533b12475e33b971b15b69cd591cd9059759f0f04ba5468a34b98915033debb3e87f048e8601712659d47d8687eb6be5e650068d88000000000000") preadv(r0, &(0x7f0000000480), 0x10000000000002a1, 0x2000000) msgget$private(0x0, 0x22) [ 483.151611] binder: BINDER_SET_CONTEXT_MGR already set [ 483.157182] binder: BINDER_SET_CONTEXT_MGR already set [ 483.157219] binder: 25215:25219 ioctl 40046207 0 returned -16 [ 483.191494] binder: 25209:25221 ioctl 40046207 0 returned -16 [ 483.202211] binder: BINDER_SET_CONTEXT_MGR already set [ 483.211350] binder: 25216:25218 ioctl 40046207 0 returned -16 [ 483.242318] binder: 25209:25210 Acquire 1 refcount change on invalid ref 0 ret -22 12:34:20 executing program 3 (fault-call:11 fault-nth:0): syz_open_dev$sndctrl(&(0x7f0000000140)='/dev/snd/controlC#\x00', 0x0, 0x0) sched_setaffinity(0x0, 0x7, &(0x7f00000000c0)=0x9) r0 = perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0) fcntl$setflags(r0, 0x2, 0x1) getsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER_VALUE(0xffffffffffffffff, 0x84, 0x7c, &(0x7f00000001c0), &(0x7f0000000240)=0x8) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(0xffffffffffffffff, 0x84, 0x9, &(0x7f0000000280)={0x0, @in={{0x2, 0x4e23, @remote}}, 0xfffffffffffffff7, 0x0, 0x400}, 0x98) sendto$inet6(0xffffffffffffffff, &(0x7f00000004c0), 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) setsockopt$SO_BINDTODEVICE(0xffffffffffffffff, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x4) socket$inet6(0xa, 0x1000000000002, 0x0) r1 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x4, 0x0, &(0x7f0000000100)=[@enter_looper], 0x1, 0x0, &(0x7f0000000180)='T'}) r2 = gettid() timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, &(0x7f0000040000)) tkill(r2, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0xfffffffffffffced, 0x0, &(0x7f0000000040)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x400c630f}], 0x0, 0x0, &(0x7f0000000f4d)}) 12:34:20 executing program 5: mkdir(&(0x7f0000b0fff8)='./file0\x00', 0x101) capset(&(0x7f0000000000)={0x19980330}, &(0x7f0000001fe8)) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000200)='/dev/sequencer\x00', 0x40, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000012ff8)='./file0\x00', 0x0, 0x0) fchdir(r0) getsockopt$inet_sctp6_SCTP_GET_PEER_ADDR_INFO(r0, 0x84, 0xf, &(0x7f0000000040)={0x0, @in={{0x2, 0x4e23, @multicast1}}, 0x3e1488e2, 0x5, 0x8, 0xffffffffffffffff, 0x8}, &(0x7f0000000100)=0x98) getsockopt$inet_sctp_SCTP_GET_LOCAL_ADDRS(r0, 0x84, 0x6d, &(0x7f0000000140)={r1, 0x4f, "9d078d099c7e2b4d4cd6e7764498c29755f722e7f84e4f47beb6bc54b63e2f56eaaebe0b525e1ed08c880512a5f95b8b108977d4d61511bd42d6db82461f518c15cd88d9a456666cb1b49372c898a1"}, &(0x7f00000001c0)=0x57) [ 483.250517] binder: 25215:25226 Acquire 1 refcount change on invalid ref 0 ret -22 [ 483.257999] binder_thread_write: 4 callbacks suppressed [ 483.258050] binder: 25209:25210 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 483.272195] binder: 25215:25226 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 483.274353] binder: 25215:25226 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 12:34:20 executing program 2: perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f0000000180)=""/148, 0x13d}], 0x1, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000340)="696f001b66408225aaa3af068fffebb8a490c47dda6586f1b58895b94a78037dd3714e7198820a7a709e2d30d25e6d846cd5c62a648a598668a8263b752b0b622b115112b5ad8e0425c0b784bbdb89eb8f4da0dd73dd01fe35694c2f78600badf8a0e237dba40713bac9e053b41a9f62be5fbb928018aab5f7500bef51a2fd74d4fffb4a20a946733820bdc1b485afa417cdbcfdfbc54f58c9c3edffe240c36f4ab8a16613814e226b6d20d98010ab1ace49fa76dce337a5a5f1dcff9e5d533b12475e33b971b15b69cd591cd9059759f0f04ba5468a34b98915033debb3e87f048e8601712659d47d8687eb6be5e650068d88000000000000") preadv(r0, &(0x7f0000000480), 0x10000000000002a1, 0x100000) msgget$private(0x0, 0x22) [ 483.305839] binder: 25209:25221 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 12:34:20 executing program 5: add_key(&(0x7f00000001c0)='syzkaller\x00', &(0x7f0000000200)={0x73, 0x79, 0x7a, 0x1}, &(0x7f0000000240)="4e01d4314e730406", 0x8, 0xfffffffffffffffd) r0 = request_key(&(0x7f00000002c0)='cifs.spnego\x00', &(0x7f0000000300)={0x73, 0x79, 0x7a, 0x2}, &(0x7f0000000340)='drbg_pr_ctr_aes256\x00', 0xfffffffffffffff9) request_key(&(0x7f0000000280), &(0x7f0000000180)={0x73, 0x79, 0x7a, 0x2}, &(0x7f0000000140)='rng\x00', r0) r1 = socket$alg(0x26, 0x5, 0x0) clone(0x20002100, 0x0, 0xfffffffffffffffe, &(0x7f0000000100), 0xffffffffffffffff) r2 = getpid() sched_setscheduler(r2, 0x5, &(0x7f0000000000)) ioctl$EXT4_IOC_ALLOC_DA_BLKS(r1, 0x660c) bind$alg(r1, &(0x7f00000003c0)={0x26, 'rng\x00', 0x0, 0x0, 'drbg_pr_ctr_aes256\x00'}, 0x2c) 12:34:20 executing program 5: r0 = socket$l2tp(0x18, 0x1, 0x1) ioctl(r0, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070") setxattr$trusted_overlay_redirect(&(0x7f0000000080)='./file0\x00', &(0x7f00000000c0)='trusted.overlay.redirect\x00', &(0x7f0000000100)='./file0\x00', 0x8, 0x2) syz_emit_ethernet(0x7ffff, &(0x7f0000000000)={@local, @empty=[0x0, 0x8864000000000000], [], {@ipv4={0x8100, {{0x5, 0x4, 0x0, 0x0, 0x28, 0x0, 0x0, 0x0, 0x0, 0x0, @local, @rand_addr}, @tcp={{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x0, 0x5}}}}}}, &(0x7f0000000040)) 12:34:20 executing program 3: syz_open_dev$sndctrl(&(0x7f0000000140)='/dev/snd/controlC#\x00', 0x0, 0x0) sched_setaffinity(0x0, 0x7, &(0x7f00000000c0)=0x9) r0 = perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0) fcntl$setflags(r0, 0x2, 0x1) getsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER_VALUE(0xffffffffffffffff, 0x84, 0x7c, &(0x7f00000001c0), &(0x7f0000000240)=0x8) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(0xffffffffffffffff, 0x84, 0x9, &(0x7f0000000280)={0x0, @in={{0x2, 0x4e23, @remote}}, 0xfffffffffffffff7, 0x0, 0x400}, 0x98) sendto$inet6(0xffffffffffffffff, &(0x7f00000004c0), 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) setsockopt$SO_BINDTODEVICE(0xffffffffffffffff, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x4) socket$inet6(0xa, 0x1000000000002, 0x0) r1 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x4, 0x0, &(0x7f0000000100)=[@enter_looper], 0x1, 0x0, &(0x7f0000000180)='T'}) r2 = gettid() timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, &(0x7f0000040000)) tkill(r2, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0xfffffffffffffced, 0x0, &(0x7f0000000040)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x400c630f}], 0x0, 0x0, &(0x7f0000000f4d)}) 12:34:21 executing program 1: bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0x3, &(0x7f0000000040)=ANY=[@ANYBLOB="180000000000000000000000028000006a0a00fffffff6006118"], &(0x7f0000000080)='syzkalleP\x00', 0x0, 0xce, &(0x7f0000000180)=""/206}, 0x48) bpf$PROG_LOAD(0x5, &(0x7f0000000400)={0x6, 0x5, &(0x7f0000000040)=@framed={{}, [@jmp={0x5, 0x0, 0x7b}]}, &(0x7f0000000280)='GPL\x00', 0x9, 0x27d, &(0x7f0000000480)=""/187}, 0x48) r0 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ppp\x00', 0x100, 0x0) write$P9_RMKNOD(r0, &(0x7f0000000140)={0x14, 0x13, 0x1, {0x91, 0x1, 0x7}}, 0x14) 12:34:21 executing program 0: r0 = socket$inet6(0xa, 0x400000000001, 0x0) r1 = dup(r0) setsockopt$inet6_tcp_int(r1, 0x6, 0x20000000000002, &(0x7f00007b1000)=0x81, 0x4) bind$inet6(r0, &(0x7f00000000c0)={0xa, 0x4e20}, 0x1c) r2 = add_key$keyring(&(0x7f0000000080)='keyring\x00', &(0x7f0000000140)={0x73, 0x79, 0x7a, 0x1}, 0x0, 0x0, 0xfffffffffffffff9) r3 = request_key(&(0x7f00000001c0)='dns_resolver\x00', &(0x7f0000000200)={0x73, 0x79, 0x7a, 0x0}, &(0x7f0000000240)='-(md5sum\x00', 0xfffffffffffffff8) keyctl$instantiate(0xc, r2, &(0x7f0000000180)="bcd94d27de2101c0c0c9f2f412243aaf233f1a68f4824dc6413af57b8bc215c170", 0x21, r3) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) sendto$inet6(r0, &(0x7f0000e77fff), 0x2bd, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) r5 = open(&(0x7f0000000040)='./bus\x00', 0x141042, 0x0) ftruncate(r5, 0x7fff) bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x0, 0x2, &(0x7f0000001000)=ANY=[@ANYBLOB="7b1af8f70089e71148c95c671a4ee900000069a27fff"], &(0x7f0000000100)='GPL\x00'}, 0x48) setsockopt$inet_sctp_SCTP_RTOINFO(0xffffffffffffffff, 0x84, 0x0, &(0x7f0000001000)={0x10000, 0x4, 0x100, 0x400}, 0x6) r6 = socket(0x11, 0x3, 0x0) setsockopt$packet_int(r6, 0x107, 0xa, &(0x7f0000788000)=0x2, 0x4) bind$packet(r6, &(0x7f0000000480)={0x11, 0x3, 0x0, 0x1, 0x0, 0x6, @local}, 0x14) setsockopt(r6, 0x107, 0x5, &(0x7f0000001000), 0xc5) sendfile(r1, r5, &(0x7f0000d83ff8), 0x8000fffffffe) 12:34:23 executing program 4: socket$inet6(0xa, 0x0, 0x80000000) sched_setaffinity(0x0, 0x7, &(0x7f00000000c0)=0x9) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0) fcntl$setflags(0xffffffffffffffff, 0x2, 0x1) r0 = socket$inet6(0xa, 0x400000000001, 0x0) r1 = dup(r0) setsockopt$inet6_tcp_int(r1, 0x6, 0x12, &(0x7f0000000000)=0x7f, 0x4) bind$inet6(r0, &(0x7f0000000040)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) getsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER_VALUE(r0, 0x84, 0x7c, &(0x7f00000001c0)={0x0, 0x0, 0x6}, &(0x7f0000000240)=0x8) sendto$inet6(r0, &(0x7f00000004c0), 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x4) socket$inet6(0xa, 0x1000000000002, 0x0) r2 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000200)={0x4, 0x0, &(0x7f0000000100)=[@enter_looper], 0x1, 0x0, &(0x7f0000000180)='T'}) gettid() timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, &(0x7f0000040000)) tkill(0x0, 0x1004000000016) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0xfffffffffffffced, 0x0, &(0x7f0000000040)}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x400c630f}], 0x0, 0x0, &(0x7f0000000f4d)}) 12:34:23 executing program 2: perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f0000000180)=""/148, 0x13d}], 0x1, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000340)="696f001b66408225aaa3af068fffebb8a490c47dda6586f1b58895b94a78037dd3714e7198820a7a709e2d30d25e6d846cd5c62a648a598668a8263b752b0b622b115112b5ad8e0425c0b784bbdb89eb8f4da0dd73dd01fe35694c2f78600badf8a0e237dba40713bac9e053b41a9f62be5fbb928018aab5f7500bef51a2fd74d4fffb4a20a946733820bdc1b485afa417cdbcfdfbc54f58c9c3edffe240c36f4ab8a16613814e226b6d20d98010ab1ace49fa76dce337a5a5f1dcff9e5d533b12475e33b971b15b69cd591cd9059759f0f04ba5468a34b98915033debb3e87f048e8601712659d47d8687eb6be5e650068d88000000000000") preadv(r0, &(0x7f0000000480), 0x10000000000002a1, 0xf0ff7f) msgget$private(0x0, 0x22) 12:34:23 executing program 5: ioctl$ifreq_SIOCGIFINDEX_team(0xffffffffffffffff, 0x8933, &(0x7f0000000240)={'team0\x00', 0x0}) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000008000)={0x12, 0x1, &(0x7f0000000100)=ANY=[@ANYBLOB="00000095a60fa3ec7e"], &(0x7f0000003ff6)='syzkaller\x00', 0x0, 0xc3, &(0x7f0000000140)=""/195, 0x0, 0x0, [], r0}, 0x48) bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0x1, 0x5, &(0x7f0000001fd8)=@framed={{0xffffffb4, 0x0, 0x0, 0x0, 0x0, 0xffffff9f}, [@ldst={0x0, 0x0, 0xa}]}, &(0x7f0000003ff6)='GPL\x00', 0x5, 0x437, &(0x7f000000cf3d)=""/195}, 0x48) r2 = syz_open_dev$vcsa(&(0x7f0000000000)='/dev/vcsa#\x00', 0x4, 0xa8800) fcntl$F_SET_FILE_RW_HINT(r1, 0x40e, &(0x7f0000000280)=0x5) getresgid(&(0x7f0000000040), &(0x7f0000000080), &(0x7f00000000c0)) ioctl$LOOP_SET_BLOCK_SIZE(r2, 0x4c09, 0x8000) ioctl$sock_SIOCSIFBR(r2, 0x8941, &(0x7f00000002c0)=@generic={0x3, 0x3, 0x80000001}) 12:34:23 executing program 3: syz_open_dev$sndctrl(&(0x7f0000000140)='/dev/snd/controlC#\x00', 0x0, 0x0) sched_setaffinity(0x0, 0x7, &(0x7f00000000c0)=0x9) r0 = perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0) fcntl$setflags(r0, 0x2, 0x1) getsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER_VALUE(0xffffffffffffffff, 0x84, 0x7c, &(0x7f00000001c0), &(0x7f0000000240)=0x8) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(0xffffffffffffffff, 0x84, 0x9, &(0x7f0000000280)={0x0, @in={{0x2, 0x4e23, @remote}}, 0xfffffffffffffff7, 0x0, 0x400}, 0x98) sendto$inet6(0xffffffffffffffff, &(0x7f00000004c0), 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) setsockopt$SO_BINDTODEVICE(0xffffffffffffffff, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x4) socket$inet6(0xa, 0x1000000000002, 0x0) r1 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0046209, &(0x7f0000000200)={0x4, 0x0, &(0x7f0000000100)=[@enter_looper], 0x1, 0x0, &(0x7f0000000180)='T'}) r2 = gettid() timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, &(0x7f0000040000)) tkill(r2, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0xfffffffffffffced, 0x0, &(0x7f0000000040)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x400c630f}], 0x0, 0x0, &(0x7f0000000f4d)}) 12:34:23 executing program 1: perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp, 0x1}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) removexattr(&(0x7f00000001c0)='./file0\x00', &(0x7f00000002c0)=ANY=[@ANYBLOB="0b1902ae3a8d06ee6c40a2c39332b74507000000b0b91d3157de83d81319fc0200000000000000c69a08cdbd"]) bind$inet6(0xffffffffffffffff, &(0x7f0000000180), 0x1c) r0 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r0, &(0x7f0000000080)={0x2, 0x4e23, @dev}, 0x10) sendto$inet(r0, &(0x7f0000000000), 0xa4, 0x200007fe, &(0x7f0000e68000)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0x1e}}, 0x10) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f00000015c0)="766574683100000000ffffffffffef00", 0xb) ioctl$EVIOCGBITSW(0xffffffffffffffff, 0x80404525, &(0x7f0000001600)=""/4096) writev(r0, &(0x7f0000001400)=[{&(0x7f00000013c0)='8', 0x1}], 0x1) sendmsg(r0, &(0x7f0000000700)={&(0x7f0000000100)=@vsock={0x28, 0x0, 0x0, @reserved}, 0x80, &(0x7f0000000640), 0x0, &(0x7f0000002600)}, 0x0) pipe2(&(0x7f0000000200), 0x84800) r1 = getegid() r2 = syz_open_dev$dmmidi(&(0x7f0000000240)='/dev/dmmidi#\x00', 0x5, 0x20000) ioctl$TUNSETGROUP(r2, 0x400454ce, r1) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000040)='tunl0\x00', 0x10) sendto$inet(r0, &(0x7f0000000000), 0xfffffffffffffe4e, 0xc0, &(0x7f00000000c0), 0x6) 12:34:23 executing program 0: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) clone(0x802102001ffe, 0x0, 0xfffffffffffffffe, &(0x7f0000000000), 0xffffffffffffffff) r1 = getpid() sched_setscheduler(r1, 0x1000000005, &(0x7f0000000200)) get_thread_area(&(0x7f0000000180)={0x9, 0x20101800, 0x0, 0x3, 0x100000000, 0x1f, 0x2, 0x80, 0x3, 0x8}) ioctl$sock_SIOCETHTOOL(r0, 0x8994, &(0x7f0000000100)={'ip6gre0\x00', &(0x7f00000000c0)=ANY=[@ANYBLOB="000000000000000000000000000000000000b7ffffff0000007d0000000000000000000000000000"]}) r2 = creat(&(0x7f0000000040)='./file0\x00', 0x0) ioctl$SG_GET_COMMAND_Q(r2, 0x2270, &(0x7f0000000140)) 12:34:23 executing program 0: r0 = syz_open_dev$sndctrl(&(0x7f0000000100)='/dev/snd/controlC#\x00', 0x1fffffffff, 0x842) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000180), 0xffffffffffffffff) r1 = getpid() sched_setscheduler(r1, 0x5, &(0x7f0000000200)) r2 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000040)='/dev/snapshot\x00', 0x100, 0x0) write$P9_RATTACH(r2, &(0x7f00000000c0)={0xffffffffffffff75, 0x69, 0x1, {0x1, 0x0, 0xfffffffffffffffa}}, 0x100000160) ioctl$SNDRV_CTL_IOCTL_ELEM_ADD(r0, 0xc1105518, &(0x7f0000000240)={{0x0, 0x0, 0x0, 0x0, 'syz1\x00'}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'syz0\x00', &(0x7f0000000100)}) openat$userio(0xffffffffffffff9c, &(0x7f0000000000)='/dev/userio\x00', 0x4200, 0x0) getsockopt$inet_sctp_SCTP_GET_LOCAL_ADDRS(r2, 0x84, 0x6d, &(0x7f0000000380)=ANY=[@ANYRES32=0x0, @ANYBLOB="c5000000364fdce9179f1e7c51c123fb68a1a77a2e4999099a2bc68d0d6a53ce54aee1d95f68e180541654b1ed5d169ccab60b6cd10ab4da74cbbe2b77a4b6d8950c4528f6aeb6b200e417d0a5e0089590cad9f2a98a0b65a4be5ec3b862ed9752ac06776ad7cd8b1120af6703048821bb763613de333e347abb7e9f213d9f09bc537f6c99b8f7926caa6a057d438bf5e5d77dbd2a812a2ec7355ed274bedb55fefc91ce138de7b57c58974ec97de88389761f87bd55dd76bf8f64cf811503cef32d9eac022d5257d0"], &(0x7f0000000080)=0xcd) getsockopt$inet_sctp_SCTP_PEER_AUTH_CHUNKS(r2, 0x84, 0x1a, &(0x7f0000000480)={r3, 0xca, "b01e8f8746e2ea5aa9a69717087fea6f9eb9a72084027339d0712ae81213c25d5380a6689774c328a3ab82ae37b98cbed70a79b1fcb36d3e65a0b686ebaedd5ad1a26142aad658c4c6cbfa2b2c4aba61727dfc498f7fc87bef0a63fb8e3eebc7bd8e93e9bca3632726a91b76d0a116c7aece8f981b3bbd40bfba2b031c3a803a957469e0d4a99789ca2d4ff93f3617738e7fb7e0c3898d69ec410a0befc62e5476d2a31ae1db39a88d01d360d7eae1dffb4918810f24f3f58720aaaa8df18d9ef45b553c9769565d22fd"}, &(0x7f0000000140)=0xd2) prlimit64(r1, 0xa, &(0x7f00000001c0)={0x0, 0x6}, &(0x7f0000000580)) 12:34:23 executing program 5: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070") r1 = syz_open_dev$mouse(&(0x7f0000000000)='/dev/input/mouse#\x00', 0xffffffffffff9faa, 0x40) unshare(0x2000400) r2 = socket$inet_sctp(0x2, 0x800000000801, 0x84) getsockopt$inet_sctp_SCTP_RTOINFO(r2, 0x84, 0x0, &(0x7f00000010c0)={0x0}, &(0x7f0000001100)=0x10) getsockopt$inet_sctp6_SCTP_RESET_STREAMS(r1, 0x84, 0x77, &(0x7f0000000040)={r3, 0xff, 0xa, [0x3, 0x2, 0x100000001, 0x1, 0x7fff, 0x7bae, 0x4, 0x7f, 0x8ff, 0x200]}, &(0x7f0000000080)=0x1c) 12:34:23 executing program 2: perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f0000000180)=""/148, 0x13d}], 0x1, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000340)="696f001b66408225aaa3af068fffebb8a490c47dda6586f1b58895b94a78037dd3714e7198820a7a709e2d30d25e6d846cd5c62a648a598668a8263b752b0b622b115112b5ad8e0425c0b784bbdb89eb8f4da0dd73dd01fe35694c2f78600badf8a0e237dba40713bac9e053b41a9f62be5fbb928018aab5f7500bef51a2fd74d4fffb4a20a946733820bdc1b485afa417cdbcfdfbc54f58c9c3edffe240c36f4ab8a16613814e226b6d20d98010ab1ace49fa76dce337a5a5f1dcff9e5d533b12475e33b971b15b69cd591cd9059759f0f04ba5468a34b98915033debb3e87f048e8601712659d47d8687eb6be5e650068d88000000000000") preadv(r0, &(0x7f0000000480), 0x10000000000002a1, 0x500) msgget$private(0x0, 0x22) 12:34:23 executing program 5: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = socket$inet6(0xa, 0x2000000000000001, 0x8410000000000084) bind$inet6(r1, &(0x7f00002aafe4)={0xa, 0x4e23, 0x0, @ipv4}, 0x1c) r2 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000040)='/dev/sequencer\x00', 0x40, 0x0) getsockopt$inet_sctp6_SCTP_PARTIAL_DELIVERY_POINT(r1, 0x84, 0x13, &(0x7f00000000c0)={0x0, 0x7ca}, &(0x7f0000000140)=0x8) getsockopt$inet_sctp_SCTP_ASSOCINFO(r2, 0x84, 0x1, &(0x7f0000000180)={r3, 0x3, 0x6, 0x80, 0x4, 0x20}, &(0x7f00000001c0)=0x14) listen(r1, 0x5) r4 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt$SO_BINDTODEVICE(r4, 0x1, 0x19, &(0x7f0000000080)='lo\x00', 0x10) r5 = gettid() ioctl$sock_FIOSETOWN(r0, 0x8901, &(0x7f0000000000)=r5) sendto$inet6(r4, &(0x7f0000000100)='F', 0x1, 0x0, &(0x7f000005ffe4)={0xa, 0x4e23, 0x0, @loopback}, 0x1c) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r4, 0x84, 0x9, &(0x7f00000002c0)={0x0, @in={{0xa, 0x80fe, @dev, [0x0, 0x300000001000000, 0x0, 0x0, 0x4000000]}}, 0x0, 0x0, 0x0, 0x0, 0xd}, 0x98) [ 486.336782] binder: BINDER_SET_CONTEXT_MGR already set [ 486.342740] binder: 25281:25283 ioctl 40046207 0 returned -16 12:34:23 executing program 4: socket$inet6(0xa, 0x0, 0x80000000) sched_setaffinity(0x0, 0x7, &(0x7f00000000c0)=0x9) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0) fcntl$setflags(0xffffffffffffffff, 0x2, 0x1) r0 = socket$inet6(0xa, 0x400000000001, 0x0) r1 = dup(r0) setsockopt$inet6_tcp_int(r1, 0x6, 0x12, &(0x7f0000000000)=0x7f, 0x4) bind$inet6(r0, &(0x7f0000000040)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) getsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER_VALUE(r0, 0x84, 0x7c, &(0x7f00000001c0)={0x0, 0x0, 0x6}, &(0x7f0000000240)=0x8) sendto$inet6(r0, &(0x7f00000004c0), 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x4) socket$inet6(0xa, 0x1000000000002, 0x0) r2 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000200)={0x4, 0x0, &(0x7f0000000100)=[@enter_looper], 0x1, 0x0, &(0x7f0000000180)='T'}) r3 = gettid() timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, &(0x7f0000040000)) tkill(r3, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0xfffffffffffffced, 0x0, &(0x7f0000000040)}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x400c630f}], 0x0, 0x0, &(0x7f0000000f4d)}) 12:34:23 executing program 2: perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f0000000180)=""/148, 0x13d}], 0x1, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000340)="696f001b66408225aaa3af068fffebb8a490c47dda6586f1b58895b94a78037dd3714e7198820a7a709e2d30d25e6d846cd5c62a648a598668a8263b752b0b622b115112b5ad8e0425c0b784bbdb89eb8f4da0dd73dd01fe35694c2f78600badf8a0e237dba40713bac9e053b41a9f62be5fbb928018aab5f7500bef51a2fd74d4fffb4a20a946733820bdc1b485afa417cdbcfdfbc54f58c9c3edffe240c36f4ab8a16613814e226b6d20d98010ab1ace49fa76dce337a5a5f1dcff9e5d533b12475e33b971b15b69cd591cd9059759f0f04ba5468a34b98915033debb3e87f048e8601712659d47d8687eb6be5e650068d88000000000000") preadv(r0, &(0x7f0000000480), 0x10000000000002a1, 0x3) msgget$private(0x0, 0x22) [ 486.728475] binder: BINDER_SET_CONTEXT_MGR already set [ 486.770105] binder: 25303:25304 ioctl 40046207 0 returned -16 12:34:24 executing program 2: perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f0000000180)=""/148, 0x13d}], 0x1, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000340)="696f001b66408225aaa3af068fffebb8a490c47dda6586f1b58895b94a78037dd3714e7198820a7a709e2d30d25e6d846cd5c62a648a598668a8263b752b0b622b115112b5ad8e0425c0b784bbdb89eb8f4da0dd73dd01fe35694c2f78600badf8a0e237dba40713bac9e053b41a9f62be5fbb928018aab5f7500bef51a2fd74d4fffb4a20a946733820bdc1b485afa417cdbcfdfbc54f58c9c3edffe240c36f4ab8a16613814e226b6d20d98010ab1ace49fa76dce337a5a5f1dcff9e5d533b12475e33b971b15b69cd591cd9059759f0f04ba5468a34b98915033debb3e87f048e8601712659d47d8687eb6be5e650068d88000000000000") preadv(r0, &(0x7f0000000480), 0x10000000000002a1, 0x4) msgget$private(0x0, 0x22) 12:34:24 executing program 4: socket$inet6(0xa, 0x0, 0x80000000) sched_setaffinity(0x0, 0x7, &(0x7f00000000c0)=0x9) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0) fcntl$setflags(0xffffffffffffffff, 0x2, 0x1) r0 = socket$inet6(0xa, 0x400000000001, 0x0) r1 = dup(r0) setsockopt$inet6_tcp_int(r1, 0x6, 0x12, &(0x7f0000000000)=0x7f, 0x4) bind$inet6(r0, &(0x7f0000000040)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) getsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER_VALUE(r0, 0x84, 0x7c, &(0x7f00000001c0)={0x0, 0x0, 0x6}, &(0x7f0000000240)=0x8) sendto$inet6(r0, &(0x7f00000004c0), 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x4) socket$inet6(0xa, 0x1000000000002, 0x0) r2 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000200)={0x4, 0x0, &(0x7f0000000100)=[@enter_looper], 0x1, 0x0, &(0x7f0000000180)='T'}) r3 = gettid() timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, &(0x7f0000040000)) tkill(r3, 0x1004000000016) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0xfffffffffffffced, 0x0, &(0x7f0000000040)}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x400c630f}], 0x0, 0x0, &(0x7f0000000f4d)}) [ 487.045080] binder: BINDER_SET_CONTEXT_MGR already set [ 487.107451] binder: 25267:25287 ioctl 40046207 0 returned -16 [ 487.180149] binder: undelivered death notification, 0000000000000000 12:34:24 executing program 2: perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f0000000180)=""/148, 0x13d}], 0x1, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000340)="696f001b66408225aaa3af068fffebb8a490c47dda6586f1b58895b94a78037dd3714e7198820a7a709e2d30d25e6d846cd5c62a648a598668a8263b752b0b622b115112b5ad8e0425c0b784bbdb89eb8f4da0dd73dd01fe35694c2f78600badf8a0e237dba40713bac9e053b41a9f62be5fbb928018aab5f7500bef51a2fd74d4fffb4a20a946733820bdc1b485afa417cdbcfdfbc54f58c9c3edffe240c36f4ab8a16613814e226b6d20d98010ab1ace49fa76dce337a5a5f1dcff9e5d533b12475e33b971b15b69cd591cd9059759f0f04ba5468a34b98915033debb3e87f048e8601712659d47d8687eb6be5e650068d88000000000000") preadv(r0, &(0x7f0000000480), 0x10000000000002a1, 0xa) msgget$private(0x0, 0x22) 12:34:24 executing program 3: syz_open_dev$sndctrl(&(0x7f0000000140)='/dev/snd/controlC#\x00', 0x0, 0x0) sched_setaffinity(0x0, 0x7, &(0x7f00000000c0)=0x9) r0 = perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0) fcntl$setflags(r0, 0x2, 0x1) getsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER_VALUE(0xffffffffffffffff, 0x84, 0x7c, &(0x7f00000001c0), &(0x7f0000000240)=0x8) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(0xffffffffffffffff, 0x84, 0x9, &(0x7f0000000280)={0x0, @in={{0x2, 0x4e23, @remote}}, 0xfffffffffffffff7, 0x0, 0x400}, 0x98) sendto$inet6(0xffffffffffffffff, &(0x7f00000004c0), 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) setsockopt$SO_BINDTODEVICE(0xffffffffffffffff, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x4) socket$inet6(0xa, 0x1000000000002, 0x0) r1 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0189436, &(0x7f0000000200)={0x4, 0x0, &(0x7f0000000100)=[@enter_looper], 0x1, 0x0, &(0x7f0000000180)='T'}) r2 = gettid() timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, &(0x7f0000040000)) tkill(r2, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0xfffffffffffffced, 0x0, &(0x7f0000000040)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x400c630f}], 0x0, 0x0, &(0x7f0000000f4d)}) 12:34:25 executing program 0: socket$inet6(0xa, 0x0, 0x80000000) sched_setaffinity(0x0, 0x7, &(0x7f00000000c0)=0x9) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0) fcntl$setflags(0xffffffffffffffff, 0x2, 0x1) r0 = socket$inet6(0xa, 0x400000000001, 0x0) r1 = dup(r0) setsockopt$inet6_tcp_int(r1, 0x6, 0x12, &(0x7f0000000000)=0x7f, 0x4) bind$inet6(r0, &(0x7f0000000040)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) getsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER_VALUE(r0, 0x84, 0x7c, &(0x7f00000001c0)={0x0, 0x0, 0x6}, &(0x7f0000000240)=0x8) sendto$inet6(r0, &(0x7f00000004c0), 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x4) socket$inet6(0xa, 0x1000000000002, 0x0) r2 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000200)={0x4, 0x0, &(0x7f0000000100)=[@enter_looper], 0x1, 0x0, &(0x7f0000000180)='T'}) r3 = gettid() timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, &(0x7f0000040000)) tkill(r3, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0xfffffffffffffced, 0x0, &(0x7f0000000040)}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x400c630f}], 0x0, 0x0, &(0x7f0000000f4d)}) 12:34:25 executing program 5: r0 = openat$pfkey(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/net/pfkey\x00', 0x101000, 0x0) getsockopt$inet_sctp6_SCTP_PEER_AUTH_CHUNKS(0xffffffffffffff9c, 0x84, 0x1a, &(0x7f00000016c0)=ANY=[@ANYRES32=0x0, @ANYBLOB="00100000559789f55a809a5446323e78a66c62784939284809928dcb3e8cdcc3f442e1f5b9c247c6ed35e08817f4232221b2879d058ca242351a5c262fb447e9fa8bc5192d79750bbd91013f7e56f9fbe4c2491ddc7583730cc3337e97084e41671c96953ee7d2da3c7266aa6458a6dac0be8e9531ac57de75832ae9e689d29404ed1e308a4d05112c398f72ee214dc73c2505766bcb01470e8981492678b54f7f7dd083fce1993dbb047f15d35286d6ded3aed71ba6aad51373e83149dcda0d80a34adde1b02498c6dce5fca21df76b84c3a330e92ee7b060fcec1b4a608259a98f050a51c30ab042c8a3852174afead282dcca14b7549ef82a6612098236e2e086b8079caa44dcdbb4206227cce3cbfc06fc6fd6c762be843dbc3c37ff8e2f685f1723b55e98629ccd1dbb1bdf3af38941b2f67c25e0035e57e707273e0ccf45ba1affd87dbcea5b2aa01578379221f70b6fb297522e7f2fd042f144f75e0bb7c343cfb9d6885eb6b9e3df09ff48cca90c8215f1be31739cdcd133494af1703bf88efb78b58c878bdca78dd1b1b4d1d11808f3ad3a7f858af4e30f56d849cc3a7f7f35da8e4bafac0448e440027320328149efbd351badea42b8f7b9fcea00d41734e040f3a7cac0ac82cfb229bf2bf31d01409cea38b28da7ba2112fdd4b5d5c5fb72e576f5cf5eb437671fdc10c828c392bda6484205e056c7c5bd854e7b53e7910d5bca7954f60bc5c07fa4be4d471db60eb9330843f29f6e2a04e0f4581387e668d13fb4f1c2cf9c9726b68c00cafd2b411a6553cc63ab27143e3fa122f98b48fb62b15ec3d22daf48347842d5a46c55e103a7bf152570aafc1e00525b91d0a1e524393979408567cbe79e77f960fef682485f43ebd7fff30b281392d697e8995fd8e6001268559f18f9377fd1f852ecb21e9a67c1a2e703d641189aae5d9732366d23463d168b33626650d42e8f839d5bab5e015773df83dfed8f43da3dc81787d6900f581f51ed1c4f5fd7aabf63ac668c97d11c4dea95695985bdc419124e8b8da1fc65ec1c19a9425fc511dadb3c663de7be0358dffe5ee0d42c9045f9468f9f3f85fe0a606c9b17435c2d4f02bfadb305a08cc8de3d0e9c5ab23ff092fb97bfdecbcf1fd89b1148fb4b791cb6b7d097b9f014eeafebe7f7a810358fd0087c042415969407304889ed2973a4d5555cb2b74f56ed3940b9cb6a5a225c5d73f18c47839bca46d2d2c902cc4f618e4077ac86f8beb7fcc19ecb75cee0587821abe0e0c1e0b8f4ba0eeb62071b174adf1585b9e95f6a505cc7570606c48b1251c52fda85c2ec43fd7b0ed43a91b9cc49ca899ba2760e597d7759c55b8bf1d352563233bcb81156bf8ddf355cede6bfde09450803ab35f085376640cf12a34d5e251b191f5df8f477671b0d578fdd2205fbc60d278659d02b6f818c2cff90591017f489966b08a0c43f6053f45e118ee804c4f8ffffffc25725980243304484e2ffa05ad060394aaef0375c85a55cf2d29782f8905976daf9ae0e1db0203e17289d478c884ec925170ac3087039f8218eaec5462af6ed5ccceeced8697c5a35e2b1272b0b4662b3f9bf5d8ab8a140126b2d24958b763a3871d7b2be5adfd648f611b76078ba8d5393e855577599dd83b93b1034ad258be009f84d8c8500a7604541c6e37dbc8c1998903f99dbaa31e0f4556ceff0aa3296401c7c602fcb615ab16e04c215e3fb76256416d1bebc8ae7559bb5751f93b70462e8a1710bf3d6801fb7ef461b6c00d4097f6ee612c8658fff7cc083dac245fccbb980b5bcb4260f58721e0c4b3e118d3292c056babb822eb4bb75f6e10a4a8b80b1cea42d31272916bf94d3140bc22edfa68470ad0393f1ea6f9772771d4bceb40875f5209fb7ab7e5f397e5d7d7590843c0dd42e8bfb7b7e66840590e12ec884f7dff098b6323fb02ded4b45345659f8e4312a05b87f19e296b7c7b8d325a0c2961910c9a8333baa2b0bf064aa4fd64ab9d3fe3776968e188ecaa875666a783a8a90658c0569e500be6026ca422dbc2992e677ff29d6fcbcf8f8163a6bf5cdd264fb99bc3807a4d2809df08abaf005690a1e48b09159a1d25ef5fc81ccdfbc15f0dae4b11634ac92367b7756d88872124d4ba88d233db596a470d8a585bc5d9b608574ab9edab6552e574545c7054277d98dba4775816fd9e20ec18359978e048c571be1ab8fd584e6ef32aef2610a1860e72a9114f105325cc8977f49fc476546e754825050f2170688b7cf6f12c236cf16cd84fec1bca6446d6104b74ea10006c83ad3bfe40b9373ef1b709882f307e54bd44eaa451b4375e9dabb86f7ae7e90e7755b4a3c611983f18728f11ed490faf39fb5269b05d32c239b49db85488459d6841e768ebf2c5f1a52f63f8c8183fe93019e8526f794c5048b1cb89ef9aaf76a4ff45a5fb8aee424045d9d1eef8c30efb33afd4b73d1f6162866c5f261dc1cc8792886d950b28abf6db70e2072a46a474f7d8f99eee8a36a299de1b8926a60dad0a9348383f65c88ee95329f55eddafa611fdc7fcf0cc11d47ef785d465ff43abd86a8d032dedea423a47ecfbdf31a5e15d86c93e4703a5c0ec666f6c3f3bad1f21e689510bc21a2e303801e05c6d42dfa1ce7e0506fd7896379156bdd7cb685d281aa0d192fc451b89f16448033c05c82f655ed99c70869d026bb2403a5d589790576d35bdbd849fde67eb5d65503009478ef3c27d1b1f568a573c0d3dc06ef143e6cd119650dab8119bf6c0a85922d050f1af20c25b165aa342507117962ee2bb7d1c4d72582104abf731196dedb226f077374424f66acdcd8823de085a640b85c6e38f59fdce77ad3b59b3d1baf1a00efbf15f2de7d3235d421875bfd35cfd455e77599ac48c9356bca9de12450d7dafa7f31407bef73c2598aff72b9e974b7992780514faab1a801e07ec7507d3cea4fe04aa391d3da26ef833be4adcdff102c0d18261aecb1b3e64fd809113f625f165c1d2bb52dfa4768c0ddb9664b48d898f79e357ec61dcf2a7f58e3b70a70cc48021ae7fb3d85d41237a4480d8bdc3e2e852b7280b63b18c387c63c638c001b8ef77c05b7a36fc847e2c51b1d3c5783e4c9e1532d5968c4d8b735f6a3f2d374120029775ed26eaf3867606c104dcc00c4f426857f15ccd542b6180ef6c4363dd5fcec084d0e5cccd1b6219027c5517eba44d58ec540edd4cef756cedb7846f6dff7740c22c278315659fe2096f23438777e7e4152f9cf297461a30b5990366e5a7bde095fb1d3e6ee0ac447d98fa0cb345a38e0249ff4d05f77798ba2a89cafb4e49a524865d3186df4425ae319f665712930fd2d5041913510f6e04ff51d7d9fc5fc00ca85154f949fe1436aec0f0c9399df14883d1c8f790815cb9461ac68b417c6abf69c0e0c4888c5b7d7f1c7f6751835f9c5a0602953e2f498636ba1b4aac26a9bacddc4017eb94bb9f7357f1f83230839275986734865e78cf04a37746bc519512bb7bde1da4495b2ac29c4551f1f19583caf8b0ec57de8942c6cd0c356b28eed8ee9e6f39066b9bde47f3d3cb4a857c7e0960c424a878d7693275aca6df66ba63fbaa893478ecb33d4ca8c8563b011d919cd4492f0c26383b2c3f74353698aa4f2b7a3044e7c721d6d48bcee3f1e53038b6ffc935affa1a223fcffa83fa99c8746d07bcc539c58ff32e361f91dedda3a2f2fe0a6ce09315d0afd19e624861b0f7a5f8616b3bc6bf4151fca7264145fa84993bb81193280069442c60a8cc5da5b04fbff751a787acfb40919468f35681655a84410edc64f153414db17d6c0bbc6cca0c750ad8ec7a265637bcdc1c2e885885e90ab5157c35df85994957ba04ebd6621a1ef33251f4ed83822d06b09fa98174887e76132274cbc1df60c573a071596c2849d466ac6f51f08aaff4981240ea4c902a97a57a31c4ae59acb3430ad0f6a505e542410a3abb3ebaa3e934f4a9900a77f814b7c856e25a83f9e858d286fac887d7df9512e73d17fc4bc3879ee0ab9bf8ce6ba678b69e1a38691ea2c27a012e83bcd4a7c8fc868757ab9ec143762c834a44ac4aa6b337878da40f191fafcfca8613700cc29c74f3e369164a2c86d094a88fb7857c7c5854c8d24ee421ebe5a1c7aa98cde7a5995340efa64c4a5fefaf8cc5fed94041d7751b8cd2b2a87b17c28c1b2052f20322f2b794d4007bde8170e32fc60a36f169882e01b93bec2b20b9ead244a329a2d490866272f5bb4d7fb82b11af748f1b4af85a1d7e732b5f1342655cf6f26e9ff3d83146b258d33ccb6f7ecd8803b022a61c0bd55c1b31dd1eb69cb8163c6109a51c9041eef3c69d569f1c4a7b90c9c93f6eb601504ada07550bd8959c5e02f3298eafd5ebe9fe5651f389743fae2e55be0a1431a6ec6677cf49fb21d4d742470e81fe03a3942f307361f2b8655d7f323f0c23fe8af57bb761d71c7ebd88fdd3ffe04fe3df1026b14c9413a52fa634fdb8b468289faef46bb24ac4ed777ea74350d413acd434146aa2e56b0d5a92d809e5694dc4da4014cebcf76c520fc45933701d94ad5bb0564b6e05ccf8fbb368d2b3049119dd45b1738489e24e5b9cb98853562f54430f3660b46c61fc657cb382f6f0f13f2ec09b6b8d2fbf8cb937117a5bdc8cb300c50480a9a79364395bf3c1d13199aeb2ce154006d7d47996747de688ddd8e7f17a938a5307c141cd8262309f4e55f7fbe3efad0f60ae0f7ccd95a74cc19bbcc1ffe45b8bed7a4ea8bec2ceb4f8ef75598c5b57c27a4d6deadc1d804638ba08c9c93d40b45f6492d75f1916f5583eb146be7525e5895735096f883a70e9b01d338f9f1bb1e9df212685efd03e83da383ca1a71189d47be34a329d7215b4f03ba03e8fa007ab193093e035455d994d225f96ae259926924fa5239f5e913d04ec861db64141f74c089ca67790bafdb1a3b67b501615f4294cf5be5fedc6966da76409cc92082d0999d3d80911dd1c387e3874eb1c128c170aba5d125ce637e0a78b79108b1b19f5ae55f988f8ff77596f65b9302c4335b2c3b72b6f26b498d66dbf3eaca6c0e9f79a83dd65d76eb6df9213dda5c4343dda05f4f73546d125b0d8fdb7315f653a724d840be8d0afa6df0a3fed4ef7ade14a7141175ec6a6e63fa1ce3cb926c73137c5619b0eb3ac521e0613fb965c0741177acf3868ce2395aa1da50d4bcbb501c3c2d5d338b79926fb10580d96f4178a7f6b7f3979096ede69b6222b07f9050348ab9168984b8c29e6972806a65eea02dcfe17d63743c75b9ce0c68ed721979bef079d1455ce6ab53b8fd201c518186e75f9918a8a77810ae190b3ed3c9cba299958e33abc18923ecf0d4658757eecdd1a71188b1b69e5e0c91ca25cef8df17d89719d925707b6340cbae79047dd82776bf572bf2cf9069414b51fcbf4ae32102eae87200e222b45a2b3a370a22120a33853274d55b93d9e0b22914a3e6a30a63a4f82a88a2c47d254dfa99912ce8f14b73b84a58634bd2c59efcf447df89f315583cd34d93ff84094f26fe37cbffe9baace39df718781754a0f70b775f953c892e4fd3178f81c898da60184ba5b3c530140907b7a857924e3bd004c5912e191d9282a42082df24e43c3427d82ca6342712377aee8ee843622a06055576abe4e95a44d30ed2cac060cd3af4ba4ccaafed0e877155ed6b81ad27f0f712d8701e78fac8f716ab90b5b431e325afec661261ce39b70bcc1cd926a6f3bd6087d2a061dae615dc078f3230328b3508288b493cd2e952cf0f834bb1092d8add199c4ce8ff8abea4fe7f"], &(0x7f0000000040)=0x1008) setsockopt$inet_sctp6_SCTP_ASSOCINFO(r0, 0x84, 0x1, &(0x7f0000000080)={r1, 0x9, 0x16d, 0x7fff, 0xa1, 0xffffffffffffff44}, 0x14) r2 = syz_open_procfs(0x0, &(0x7f0000000100)="2f65786500000000000409004bddd9de91be10ee9ed554fa07424adee9cbc699ec2ca576e50000bcd7a071fb35331ce39c5ad0cf73770bd4246847a1914e4fb0aa9b15eaa94bcd0e700ed63b44338e84ad4ec2f11f6f2adb8dc2fdb18231446f43142ebe700b2231e8fceed6b22a373c9409675ac8d0b53033123fb3037d66241aafe0f880e7a51d1b036ade31d2544d2581fe8653d0cff54369df8c2fce21dcb1cb965669f9a75345ac3479cd51dc7de364c9c272c83ed9e666ca25aad2e7a26e3d6c62d0f8b9065cfca311c06d0744db265aa0e486707c51fd108c0c6ccae6ff42274af94d30fce8836ff9d00bdd") clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000640), 0xffffffffffffffff) r3 = getpid() sched_setscheduler(r3, 0x5, &(0x7f0000000200)) ioctl$EXT4_IOC_SETFLAGS(r2, 0x40086602, &(0x7f0000000340)=0x20014006) setsockopt$inet_mreqn(r2, 0x0, 0x0, &(0x7f0000000300)={@empty, @rand_addr=0x3}, 0xc) 12:34:25 executing program 4: socket$inet6(0xa, 0x0, 0x80000000) sched_setaffinity(0x0, 0x7, &(0x7f00000000c0)=0x9) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0) fcntl$setflags(0xffffffffffffffff, 0x2, 0x1) r0 = socket$inet6(0xa, 0x400000000001, 0x0) r1 = dup(r0) setsockopt$inet6_tcp_int(r1, 0x6, 0x12, &(0x7f0000000000)=0x7f, 0x4) bind$inet6(r0, &(0x7f0000000040)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) getsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER_VALUE(r0, 0x84, 0x7c, &(0x7f00000001c0)={0x0, 0x0, 0x6}, &(0x7f0000000240)=0x8) sendto$inet6(r0, &(0x7f00000004c0), 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x4) socket$inet6(0xa, 0x1000000000002, 0x0) r2 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000200)={0x4, 0x0, &(0x7f0000000100)=[@enter_looper], 0x1, 0x0, &(0x7f0000000180)='T'}) r3 = gettid() timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, &(0x7f0000040000)) tkill(r3, 0x1004000000016) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, &(0x7f0000000040)}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x400c630f}], 0x0, 0x0, &(0x7f0000000f4d)}) 12:34:25 executing program 1: syz_open_dev$sndctrl(&(0x7f0000000140)='/dev/snd/controlC#\x00', 0x0, 0x0) sched_setaffinity(0x0, 0x7, &(0x7f00000000c0)=0x9) r0 = perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0) fcntl$setflags(r0, 0x2, 0x1) getsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER_VALUE(0xffffffffffffffff, 0x84, 0x7c, &(0x7f00000001c0), &(0x7f0000000240)=0x8) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(0xffffffffffffffff, 0x84, 0x9, &(0x7f0000000280)={0x0, @in={{0x2, 0x4e23, @remote}}, 0xfffffffffffffff7, 0x0, 0x400}, 0x98) sendto$inet6(0xffffffffffffffff, &(0x7f00000004c0), 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) setsockopt$SO_BINDTODEVICE(0xffffffffffffffff, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x4) socket$inet6(0xa, 0x1000000000002, 0x0) r1 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0046209, &(0x7f0000000200)={0x4, 0x0, &(0x7f0000000100)=[@enter_looper], 0x1, 0x0, &(0x7f0000000180)='T'}) r2 = gettid() timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, &(0x7f0000040000)) tkill(r2, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0xfffffffffffffced, 0x0, &(0x7f0000000040)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x400c630f}], 0x0, 0x0, &(0x7f0000000f4d)}) 12:34:25 executing program 2: perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f0000000180)=""/148, 0x13d}], 0x1, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000340)="696f001b66408225aaa3af068fffebb8a490c47dda6586f1b58895b94a78037dd3714e7198820a7a709e2d30d25e6d846cd5c62a648a598668a8263b752b0b622b115112b5ad8e0425c0b784bbdb89eb8f4da0dd73dd01fe35694c2f78600badf8a0e237dba40713bac9e053b41a9f62be5fbb928018aab5f7500bef51a2fd74d4fffb4a20a946733820bdc1b485afa417cdbcfdfbc54f58c9c3edffe240c36f4ab8a16613814e226b6d20d98010ab1ace49fa76dce337a5a5f1dcff9e5d533b12475e33b971b15b69cd591cd9059759f0f04ba5468a34b98915033debb3e87f048e8601712659d47d8687eb6be5e650068d88000000000000") preadv(r0, &(0x7f0000000480), 0x10000000000002a1, 0x400000000000000) msgget$private(0x0, 0x22) 12:34:25 executing program 5: syz_open_dev$sndctrl(&(0x7f0000000140)='/dev/snd/controlC#\x00', 0x0, 0x0) sched_setaffinity(0x0, 0x7, &(0x7f00000000c0)=0x9) r0 = perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0) fcntl$setflags(r0, 0x2, 0x1) getsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER_VALUE(0xffffffffffffffff, 0x84, 0x7c, &(0x7f00000001c0), &(0x7f0000000240)=0x8) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(0xffffffffffffffff, 0x84, 0x9, &(0x7f0000000280)={0x0, @in={{0x2, 0x4e23, @remote}}, 0xfffffffffffffff7, 0x0, 0x400}, 0x98) sendto$inet6(0xffffffffffffffff, &(0x7f00000004c0), 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) setsockopt$SO_BINDTODEVICE(0xffffffffffffffff, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x4) socket$inet6(0xa, 0x1000000000002, 0x0) r1 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0046209, &(0x7f0000000200)={0x4, 0x0, &(0x7f0000000100)=[@enter_looper], 0x1, 0x0, &(0x7f0000000180)='T'}) r2 = gettid() timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, &(0x7f0000040000)) tkill(r2, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0xfffffffffffffced, 0x0, &(0x7f0000000040)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x400c630f}], 0x0, 0x0, &(0x7f0000000f4d)}) [ 487.759196] binder: BINDER_SET_CONTEXT_MGR already set [ 487.767205] binder: 25339:25340 ioctl 40046207 0 returned -16 12:34:25 executing program 2: perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f0000000180)=""/148, 0x13d}], 0x1, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000340)="696f001b66408225aaa3af068fffebb8a490c47dda6586f1b58895b94a78037dd3714e7198820a7a709e2d30d25e6d846cd5c62a648a598668a8263b752b0b622b115112b5ad8e0425c0b784bbdb89eb8f4da0dd73dd01fe35694c2f78600badf8a0e237dba40713bac9e053b41a9f62be5fbb928018aab5f7500bef51a2fd74d4fffb4a20a946733820bdc1b485afa417cdbcfdfbc54f58c9c3edffe240c36f4ab8a16613814e226b6d20d98010ab1ace49fa76dce337a5a5f1dcff9e5d533b12475e33b971b15b69cd591cd9059759f0f04ba5468a34b98915033debb3e87f048e8601712659d47d8687eb6be5e650068d88000000000000") preadv(r0, &(0x7f0000000480), 0x10000000000002a1, 0xf0ff7f00000000) msgget$private(0x0, 0x22) [ 487.801219] binder: BINDER_SET_CONTEXT_MGR already set [ 487.812752] binder: 25350:25352 ioctl 40046207 0 returned -16 [ 487.819467] binder: BINDER_SET_CONTEXT_MGR already set [ 487.829541] binder: 25343:25344 ioctl 40046207 0 returned -16 [ 487.844185] binder: BINDER_SET_CONTEXT_MGR already set [ 487.851198] binder: 25353:25356 ioctl 40046207 0 returned -16 12:34:25 executing program 2: perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f0000000180)=""/148, 0x13d}], 0x1, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000340)="696f001b66408225aaa3af068fffebb8a490c47dda6586f1b58895b94a78037dd3714e7198820a7a709e2d30d25e6d846cd5c62a648a598668a8263b752b0b622b115112b5ad8e0425c0b784bbdb89eb8f4da0dd73dd01fe35694c2f78600badf8a0e237dba40713bac9e053b41a9f62be5fbb928018aab5f7500bef51a2fd74d4fffb4a20a946733820bdc1b485afa417cdbcfdfbc54f58c9c3edffe240c36f4ab8a16613814e226b6d20d98010ab1ace49fa76dce337a5a5f1dcff9e5d533b12475e33b971b15b69cd591cd9059759f0f04ba5468a34b98915033debb3e87f048e8601712659d47d8687eb6be5e650068d88000000000000") preadv(r0, &(0x7f0000000480), 0x10000000000002a1, 0x600) msgget$private(0x0, 0x22) [ 487.907381] binder: 25343:25361 BC_CLEAR_DEATH_NOTIFICATION death notification not active 12:34:25 executing program 2: perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f0000000180)=""/148, 0x13d}], 0x1, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000340)="696f001b66408225aaa3af068fffebb8a490c47dda6586f1b58895b94a78037dd3714e7198820a7a709e2d30d25e6d846cd5c62a648a598668a8263b752b0b622b115112b5ad8e0425c0b784bbdb89eb8f4da0dd73dd01fe35694c2f78600badf8a0e237dba40713bac9e053b41a9f62be5fbb928018aab5f7500bef51a2fd74d4fffb4a20a946733820bdc1b485afa417cdbcfdfbc54f58c9c3edffe240c36f4ab8a16613814e226b6d20d98010ab1ace49fa76dce337a5a5f1dcff9e5d533b12475e33b971b15b69cd591cd9059759f0f04ba5468a34b98915033debb3e87f048e8601712659d47d8687eb6be5e650068d88000000000000") preadv(r0, &(0x7f0000000480), 0x10000000000002a1, 0x7) msgget$private(0x0, 0x22) 12:34:25 executing program 2: perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f0000000180)=""/148, 0x13d}], 0x1, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000340)="696f001b66408225aaa3af068fffebb8a490c47dda6586f1b58895b94a78037dd3714e7198820a7a709e2d30d25e6d846cd5c62a648a598668a8263b752b0b622b115112b5ad8e0425c0b784bbdb89eb8f4da0dd73dd01fe35694c2f78600badf8a0e237dba40713bac9e053b41a9f62be5fbb928018aab5f7500bef51a2fd74d4fffb4a20a946733820bdc1b485afa417cdbcfdfbc54f58c9c3edffe240c36f4ab8a16613814e226b6d20d98010ab1ace49fa76dce337a5a5f1dcff9e5d533b12475e33b971b15b69cd591cd9059759f0f04ba5468a34b98915033debb3e87f048e8601712659d47d8687eb6be5e650068d88000000000000") preadv(r0, &(0x7f0000000480), 0x10000000000002a1, 0x5) msgget$private(0x0, 0x22) 12:34:25 executing program 2: perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f0000000180)=""/148, 0x13d}], 0x1, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000340)="696f001b66408225aaa3af068fffebb8a490c47dda6586f1b58895b94a78037dd3714e7198820a7a709e2d30d25e6d846cd5c62a648a598668a8263b752b0b622b115112b5ad8e0425c0b784bbdb89eb8f4da0dd73dd01fe35694c2f78600badf8a0e237dba40713bac9e053b41a9f62be5fbb928018aab5f7500bef51a2fd74d4fffb4a20a946733820bdc1b485afa417cdbcfdfbc54f58c9c3edffe240c36f4ab8a16613814e226b6d20d98010ab1ace49fa76dce337a5a5f1dcff9e5d533b12475e33b971b15b69cd591cd9059759f0f04ba5468a34b98915033debb3e87f048e8601712659d47d8687eb6be5e650068d88000000000000") preadv(r0, &(0x7f0000000480), 0x10000000000002a1, 0x7ffffffff000) msgget$private(0x0, 0x22) 12:34:25 executing program 3: syz_open_dev$sndctrl(&(0x7f0000000140)='/dev/snd/controlC#\x00', 0x0, 0x0) sched_setaffinity(0x0, 0x7, &(0x7f00000000c0)=0x9) r0 = perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0) fcntl$setflags(r0, 0x2, 0x1) getsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER_VALUE(0xffffffffffffffff, 0x84, 0x7c, &(0x7f00000001c0), &(0x7f0000000240)=0x8) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(0xffffffffffffffff, 0x84, 0x9, &(0x7f0000000280)={0x0, @in={{0x2, 0x4e23, @remote}}, 0xfffffffffffffff7, 0x0, 0x400}, 0x98) sendto$inet6(0xffffffffffffffff, &(0x7f00000004c0), 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) setsockopt$SO_BINDTODEVICE(0xffffffffffffffff, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x4) socket$inet6(0xa, 0x1000000000002, 0x0) r1 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc018620c, &(0x7f0000000200)={0x4, 0x0, &(0x7f0000000100)=[@enter_looper], 0x1, 0x0, &(0x7f0000000180)='T'}) r2 = gettid() timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, &(0x7f0000040000)) tkill(r2, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0xfffffffffffffced, 0x0, &(0x7f0000000040)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x400c630f}], 0x0, 0x0, &(0x7f0000000f4d)}) [ 488.209358] binder: BINDER_SET_CONTEXT_MGR already set [ 488.215417] binder: 25333:25375 ioctl 40046207 0 returned -16 [ 488.223532] binder: undelivered death notification, 0000000000000000 [ 488.231576] binder: undelivered death notification, 0000000000000000 [ 488.309426] binder: 25381 BINDER_GET_NODE_INFO_FOR_REF: only handle may be non-zero. [ 488.309483] binder: 25381:25382 ioctl c018620c 20000200 returned -22 12:34:25 executing program 0: r0 = socket(0x6, 0x83, 0x0) uname(&(0x7f0000000000)=""/46) setsockopt$inet_int(r0, 0x0, 0x40, &(0x7f0000000080), 0x4) r1 = syz_open_dev$amidi(&(0x7f0000000040)='/dev/amidi#\x00', 0x100000000, 0x200000) ioctl$RTC_PLL_GET(r1, 0x80207011, &(0x7f00000000c0)) 12:34:25 executing program 2: perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f0000000180)=""/148, 0x13d}], 0x1, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000340)="696f001b66408225aaa3af068fffebb8a490c47dda6586f1b58895b94a78037dd3714e7198820a7a709e2d30d25e6d846cd5c62a648a598668a8263b752b0b622b115112b5ad8e0425c0b784bbdb89eb8f4da0dd73dd01fe35694c2f78600badf8a0e237dba40713bac9e053b41a9f62be5fbb928018aab5f7500bef51a2fd74d4fffb4a20a946733820bdc1b485afa417cdbcfdfbc54f58c9c3edffe240c36f4ab8a16613814e226b6d20d98010ab1ace49fa76dce337a5a5f1dcff9e5d533b12475e33b971b15b69cd591cd9059759f0f04ba5468a34b98915033debb3e87f048e8601712659d47d8687eb6be5e650068d88000000000000") preadv(r0, &(0x7f0000000480), 0x10000000000002a1, 0x1000000) msgget$private(0x0, 0x22) 12:34:25 executing program 4: socket$inet6(0xa, 0x0, 0x80000000) sched_setaffinity(0x0, 0x7, &(0x7f00000000c0)=0x9) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0) fcntl$setflags(0xffffffffffffffff, 0x2, 0x1) r0 = socket$inet6(0xa, 0x400000000001, 0x0) r1 = dup(r0) setsockopt$inet6_tcp_int(r1, 0x6, 0x12, &(0x7f0000000000)=0x7f, 0x4) bind$inet6(r0, &(0x7f0000000040)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) getsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER_VALUE(r0, 0x84, 0x7c, &(0x7f00000001c0)={0x0, 0x0, 0x6}, &(0x7f0000000240)=0x8) sendto$inet6(r0, &(0x7f00000004c0), 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x4) socket$inet6(0xa, 0x1000000000002, 0x0) r2 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000200)={0x4, 0x0, &(0x7f0000000100)=[@enter_looper], 0x1, 0x0, &(0x7f0000000180)='T'}) r3 = gettid() timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, &(0x7f0000040000)) tkill(r3, 0x1004000000016) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire={0x400c630e}], 0x0, 0x0, &(0x7f0000000040)}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x400c630f}], 0x0, 0x0, &(0x7f0000000f4d)}) [ 488.501781] binder: undelivered death notification, 0000000000000000 12:34:25 executing program 1: r0 = socket$inet_tcp(0x2, 0x1, 0x0) clone(0x20002100, 0x0, 0xfffffffffffffffe, &(0x7f0000000100), 0xffffffffffffffff) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000140)=0x6) r2 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040)='/dev/hwrng\x00', 0x20680, 0x0) ioctl$TIOCNXCL(r2, 0x540d) setsockopt$IP_VS_SO_SET_EDIT(r0, 0x0, 0x3, &(0x7f0000000080)={0x0, @rand_addr, 0x0, 0x0, 'wrr\x00'}, 0x12) [ 488.578932] binder: undelivered death notification, 0000000000000000 [ 488.610377] binder: undelivered death notification, 0000000000000000 12:34:25 executing program 5: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000180)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_SET_SIGNAL_MASK(0xffffffffffffffff, 0x4004ae8b, &(0x7f00000001c0)=ANY=[@ANYBLOB="ebbcf98ff60b12e52050cbf3c5b9dc8debe54210c8a3da9e6363eabafb6e04e61175ddd268baa373dde87dc32785a2dcd628b5d32d41f85bea0954c794c2a2c582f139a5f43f7043c032a3f7908bf1431e011f00ba449fb9e86528530923c469bf6b16eabc5b954eca60f10b24623a1e0eb0769ce7eb1a6bbafcce7fda32b2a7c9675351171530ed6087ac987651165494a53f3d9b9c1ae5c23cc38fbb4298275e224e27ff7043584989197c48013d9b79a821a14a3ab5a42fafb5bbd704af2a4adc5f9f83ac811732661c0e2d858fbb86d1c9c343ba4406f18efa0038796337f32feff9768bb558736aa4513ae82b"]) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r2, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000100)=[@textreal={0x8, &(0x7f0000000000)="0f01c8f20f35ba2000b000ee0f2336360fc76df20f2054440f20c0663504000000440f22c064f3e10a660f3a63a63c6700baf80c66b8bd08428766efbafc0cb066ee", 0x42}], 0x1, 0x0, &(0x7f0000000000), 0x0) ioctl$KVM_NMI(r2, 0xae9a) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f00000002c0)={0x0, 0x2, 0x0, 0x2000, &(0x7f0000001000/0x2000)=nil}) ioctl$KVM_RUN(r2, 0xae80, 0x0) [ 488.624456] binder: BINDER_SET_CONTEXT_MGR already set [ 488.630067] binder: 25387:25388 ioctl 40046207 0 returned -16 12:34:26 executing program 2: perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f0000000180)=""/148, 0x13d}], 0x1, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000340)="696f001b66408225aaa3af068fffebb8a490c47dda6586f1b58895b94a78037dd3714e7198820a7a709e2d30d25e6d846cd5c62a648a598668a8263b752b0b622b115112b5ad8e0425c0b784bbdb89eb8f4da0dd73dd01fe35694c2f78600badf8a0e237dba40713bac9e053b41a9f62be5fbb928018aab5f7500bef51a2fd74d4fffb4a20a946733820bdc1b485afa417cdbcfdfbc54f58c9c3edffe240c36f4ab8a16613814e226b6d20d98010ab1ace49fa76dce337a5a5f1dcff9e5d533b12475e33b971b15b69cd591cd9059759f0f04ba5468a34b98915033debb3e87f048e8601712659d47d8687eb6be5e650068d88000000000000") preadv(r0, &(0x7f0000000480), 0x10000000000002a1, 0xa00000000000000) msgget$private(0x0, 0x22) 12:34:26 executing program 0: fcntl$getownex(0xffffffffffffffff, 0x10, &(0x7f0000000040)={0x0, 0x0}) r1 = syz_open_procfs(r0, &(0x7f0000000000)='net/mcfilter\x00') fadvise64(r1, 0x0, 0x257, 0x1) 12:34:26 executing program 1: r0 = socket$inet6(0xa, 0x2, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000018c0)={&(0x7f00000002c0), 0xc, &(0x7f0000001880)={&(0x7f0000000280)=ANY=[]}}, 0x0) connect$inet6(r0, &(0x7f00000000c0)={0xa, 0x0, 0x0, @mcast1, 0xc}, 0x1c) fcntl$addseals(r0, 0x409, 0x2) connect$inet6(r0, &(0x7f00000001c0)={0xa, 0x0, 0x0, @mcast2}, 0x1c) sendmmsg(r0, &(0x7f00000002c0), 0x4000000000003b7, 0x0) [ 488.709331] *** Guest State *** [ 488.712837] CR0: actual=0x0000000000000030, shadow=0x0000000060000010, gh_mask=fffffffffffffff7 [ 488.725158] binder: 25387:25399 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 488.739774] binder: 25387:25399 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 [ 488.747467] CR4: actual=0x0000000000002040, shadow=0x0000000000000000, gh_mask=ffffffffffffe871 [ 488.757987] CR3 = 0x0000000000000000 [ 488.762454] RSP = 0x0000000000000f80 RIP = 0x0000000000000000 [ 488.768750] RFLAGS=0x00000002 DR7 = 0x0000000000000400 [ 488.780405] Sysenter RSP=0000000000000000 CS:RIP=0000:0000000000000000 [ 488.792545] CS: sel=0x0000, attr=0x0009b, limit=0x0000ffff, base=0x0000000000000000 [ 488.800550] DS: sel=0x0000, attr=0x00093, limit=0x0000ffff, base=0x0000000000000000 12:34:26 executing program 0: r0 = syz_open_dev$sndpcmc(&(0x7f0000004fee)='/dev/snd/pcmC#D#c\x00', 0x0, 0x0) creat(&(0x7f0000000200)='./bus\x00', 0x0) r1 = open(&(0x7f000000fffa)='./bus\x00', 0x0, 0x0) setsockopt$inet_sctp_SCTP_RECVRCVINFO(r0, 0x84, 0x20, &(0x7f0000000000)=0x1, 0x4) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x0, 0x1012, r1, 0x0) ioctl(r0, 0xdf3e, &(0x7f0000000080)="fd3b00bf49b475be141e19dc118d1aed14ac23d91d4193ddcf1951a087ae77a980553e8337721f86d7aa71cc2bca953f611fbc359959d530080000000000000000000000000000") [ 488.831757] SS: sel=0x0000, attr=0x00081, limit=0x0000ffff, base=0x0000000000000000 [ 488.852126] ES: sel=0x0000, attr=0x00093, limit=0x0000ffff, base=0x0000000000000000 [ 488.861518] FS: sel=0x0000, attr=0x00093, limit=0x0000ffff, base=0x0000000000000000 [ 488.869515] GS: sel=0x0000, attr=0x00093, limit=0x0000ffff, base=0x0000000000000000 12:34:26 executing program 2: perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f0000000180)=""/148, 0x13d}], 0x1, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000340)="696f001b66408225aaa3af068fffebb8a490c47dda6586f1b58895b94a78037dd3714e7198820a7a709e2d30d25e6d846cd5c62a648a598668a8263b752b0b622b115112b5ad8e0425c0b784bbdb89eb8f4da0dd73dd01fe35694c2f78600badf8a0e237dba40713bac9e053b41a9f62be5fbb928018aab5f7500bef51a2fd74d4fffb4a20a946733820bdc1b485afa417cdbcfdfbc54f58c9c3edffe240c36f4ab8a16613814e226b6d20d98010ab1ace49fa76dce337a5a5f1dcff9e5d533b12475e33b971b15b69cd591cd9059759f0f04ba5468a34b98915033debb3e87f048e8601712659d47d8687eb6be5e650068d88000000000000") preadv(r0, &(0x7f0000000480), 0x10000000000002a1, 0xf0ffffff7f0000) msgget$private(0x0, 0x22) [ 488.869535] GDTR: limit=0x000007ff, base=0x0000000000001000 [ 488.869556] LDTR: sel=0x0008, attr=0x04082, limit=0x000007ff, base=0x0000000000001800 [ 488.869574] IDTR: limit=0x0000ffff, base=0x0000000000000000 12:34:26 executing program 1: r0 = creat(&(0x7f0000000340)='./file0\x00', 0x0) r1 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000280)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000000080)={{'fd', 0x3d, r1}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}}) mount$fuseblk(&(0x7f0000000000)='/dev/loop0\x00', &(0x7f0000000040)='./file0\x00', &(0x7f0000000180)='fuseblk\x00', 0x0, &(0x7f0000000500)={{'fd', 0x3d, r1}, 0x2c, {'rootmode', 0x3d, 0xc000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}}) ioctl$KVM_SET_VAPIC_ADDR(r0, 0x4008ae93, &(0x7f0000000100)=0x100000) [ 488.941545] TR: sel=0x0000, attr=0x0008b, limit=0x0000ffff, base=0x0000000000000000 [ 488.951070] EFER = 0x0000000000000000 PAT = 0x0007040600070406 [ 488.968550] DebugCtl = 0x0000000000000000 DebugExceptions = 0x0000000000000000 [ 489.005418] Interruptibility = 00000000 ActivityState = 00000000 [ 489.019856] *** Host State *** [ 489.033112] RIP = 0xffffffff81212522 RSP = 0xffff8801ba1df350 [ 489.039144] CS=0010 SS=0018 DS=0000 ES=0000 FS=0000 GS=0000 TR=0040 [ 489.039160] FSBase=00007f131c486700 GSBase=ffff8801dac00000 TRBase=fffffe0000033000 [ 489.039174] GDTBase=fffffe0000031000 IDTBase=fffffe0000000000 [ 489.039192] CR0=0000000080050033 CR3=00000001d3008000 CR4=00000000001426f0 [ 489.039209] Sysenter RSP=fffffe0000032200 CS:RIP=0010:ffffffff87e01360 [ 489.039224] EFER = 0x0000000000000d01 PAT = 0x0407050600070106 [ 489.086443] *** Control State *** [ 489.089946] PinBased=0000003f CPUBased=b5986dfa SecondaryExec=000000ca [ 489.097433] EntryControls=0000d1ff ExitControls=002fefff [ 489.104733] binder: BINDER_SET_CONTEXT_MGR already set [ 489.110037] binder: 25381:25431 ioctl 40046207 0 returned -16 [ 489.124933] binder: 25381 BINDER_GET_NODE_INFO_FOR_REF: only handle may be non-zero. [ 489.124953] binder: 25381:25384 ioctl c018620c 20000200 returned -22 [ 489.125460] ExceptionBitmap=00060042 PFECmask=00000000 PFECmatch=00000000 [ 489.135744] binder: undelivered death notification, 0000000000000000 12:34:26 executing program 3: syz_open_dev$sndctrl(&(0x7f0000000140)='/dev/snd/controlC#\x00', 0x0, 0x0) sched_setaffinity(0x0, 0x7, &(0x7f00000000c0)=0x9) r0 = perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0) fcntl$setflags(r0, 0x2, 0x1) getsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER_VALUE(0xffffffffffffffff, 0x84, 0x7c, &(0x7f00000001c0), &(0x7f0000000240)=0x8) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(0xffffffffffffffff, 0x84, 0x9, &(0x7f0000000280)={0x0, @in={{0x2, 0x4e23, @remote}}, 0xfffffffffffffff7, 0x0, 0x400}, 0x98) sendto$inet6(0xffffffffffffffff, &(0x7f00000004c0), 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) setsockopt$SO_BINDTODEVICE(0xffffffffffffffff, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x4) socket$inet6(0xa, 0x1000000000002, 0x0) r1 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0x4020940d, &(0x7f0000000200)={0x4, 0x0, &(0x7f0000000100)=[@enter_looper], 0x1, 0x0, &(0x7f0000000180)='T'}) r2 = gettid() timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, &(0x7f0000040000)) tkill(r2, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0xfffffffffffffced, 0x0, &(0x7f0000000040)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x400c630f}], 0x0, 0x0, &(0x7f0000000f4d)}) 12:34:26 executing program 0: perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e5}, 0x0, 0x0, 0xffffffffffffffff, 0x0) pkey_free(0xffffffffffffffff) r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = socket$inet_tcp(0x2, 0x1, 0x0) getsockopt$inet_IP_IPSEC_POLICY(0xffffffffffffffff, 0x0, 0x10, &(0x7f00000008c0)={{{@in=@remote, @in6}}, {{@in6=@dev}, 0x0, @in6=@mcast2}}, &(0x7f00000009c0)=0xe8) bind$inet(0xffffffffffffffff, &(0x7f0000b9bff0)={0x2, 0x2004e21}, 0x10) fadvise64(r1, 0x0, 0x401, 0x3) mmap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x0, 0x8810, r1, 0x0) r2 = socket$nl_generic(0xa, 0x5, 0x84) ioctl$sock_SIOCETHTOOL(r2, 0x89f2, &(0x7f0000000180)={'ip6gre0\x00', &(0x7f0000000380)=ANY=[@ANYBLOB="000088992b021027f6b9253be4373d712bb1fe1a34903b00000000"]}) getsockopt$inet6_mreq(0xffffffffffffff9c, 0x29, 0x0, &(0x7f00000004c0)={@remote, 0x0}, &(0x7f0000000200)=0x14) r4 = dup2(r1, r1) setsockopt$inet_pktinfo(r2, 0x0, 0x8, &(0x7f0000000400)={r3, @loopback, @rand_addr=0x1cb}, 0xc) r5 = syz_open_procfs(0x0, &(0x7f0000000040)='ns\x00') fcntl$notify(r5, 0x402, 0x13) getsockopt$inet_sctp6_SCTP_RECVNXTINFO(0xffffffffffffffff, 0x84, 0x21, &(0x7f00000000c0), &(0x7f0000000100)=0x4) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x2400, 0x6) socket$bt_bnep(0x1f, 0x3, 0x4) exit(0x0) perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7fffffffffff}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$TIOCPKT(r4, 0x5420, &(0x7f0000000140)) close(r5) r6 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000240)='/proc/sys/net/ipv4/vs/snat_reroute\x00', 0x2, 0x0) getsockopt$inet_sctp_SCTP_GET_PEER_ADDR_INFO(r6, 0x84, 0xf, &(0x7f0000000280)={0x0, @in6={{0xa, 0x4e20, 0x1ff, @local, 0x1}}, 0x9, 0x7, 0x8, 0x5, 0x4}, &(0x7f0000000340)=0x98) getsockopt$inet_sctp6_SCTP_DEFAULT_PRINFO(r2, 0x84, 0x72, &(0x7f0000000080)={0x0, 0x9, 0x20}, &(0x7f00000000c0)=0xc) sendto$inet(r1, &(0x7f0000fa0fff), 0xffffffffffffffbb, 0x20020003, &(0x7f0000385ff0)={0x2, 0x4e21, @loopback}, 0x10) r7 = memfd_create(&(0x7f0000000100)='bdev$-\x00', 0x0) r8 = semget$private(0x0, 0x2, 0x10) semctl$IPC_RMID(r8, 0x0, 0x0) lseek(r7, 0x1, 0x1) 12:34:26 executing program 2: perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f0000000180)=""/148, 0x13d}], 0x1, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000340)="696f001b66408225aaa3af068fffebb8a490c47dda6586f1b58895b94a78037dd3714e7198820a7a709e2d30d25e6d846cd5c62a648a598668a8263b752b0b622b115112b5ad8e0425c0b784bbdb89eb8f4da0dd73dd01fe35694c2f78600badf8a0e237dba40713bac9e053b41a9f62be5fbb928018aab5f7500bef51a2fd74d4fffb4a20a946733820bdc1b485afa417cdbcfdfbc54f58c9c3edffe240c36f4ab8a16613814e226b6d20d98010ab1ace49fa76dce337a5a5f1dcff9e5d533b12475e33b971b15b69cd591cd9059759f0f04ba5468a34b98915033debb3e87f048e8601712659d47d8687eb6be5e650068d88000000000000") preadv(r0, &(0x7f0000000480), 0x10000000000002a1, 0xc3eeff7f00000000) msgget$private(0x0, 0x22) [ 489.140412] VMEntry: intr_info=80000202 errcode=00000000 ilen=00000000 [ 489.153302] VMExit: intr_info=00000000 errcode=00000000 ilen=00000000 [ 489.203545] reason=80000021 qualification=0000000000000000 [ 489.241966] IDTVectoring: info=00000000 errcode=00000000 [ 489.247467] TSC Offset = 0xfffffef80db0c144 [ 489.251949] EPT pointer = 0x00000001cd05c01e 12:34:26 executing program 4: socket$inet6(0xa, 0x0, 0x80000000) sched_setaffinity(0x0, 0x7, &(0x7f00000000c0)=0x9) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0) fcntl$setflags(0xffffffffffffffff, 0x2, 0x1) r0 = socket$inet6(0xa, 0x400000000001, 0x0) r1 = dup(r0) setsockopt$inet6_tcp_int(r1, 0x6, 0x12, &(0x7f0000000000)=0x7f, 0x4) bind$inet6(r0, &(0x7f0000000040)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) getsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER_VALUE(r0, 0x84, 0x7c, &(0x7f00000001c0)={0x0, 0x0, 0x6}, &(0x7f0000000240)=0x8) sendto$inet6(r0, &(0x7f00000004c0), 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x4) socket$inet6(0xa, 0x1000000000002, 0x0) r2 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000200)={0x4, 0x0, &(0x7f0000000100)=[@enter_looper], 0x1, 0x0, &(0x7f0000000180)='T'}) r3 = gettid() timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, &(0x7f0000040000)) tkill(r3, 0x1004000000016) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0xfffffffffffffced, 0x0, &(0x7f0000000040)}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x400c630f}], 0x0, 0x0, &(0x7f0000000f4d)}) 12:34:26 executing program 1: r0 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vga_arbiter\x00', 0x103, 0x0) pwritev(r0, &(0x7f00000014c0)=[{&(0x7f0000000100)="d0", 0x1}], 0x1, 0x0) 12:34:26 executing program 2: perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f0000000180)=""/148, 0x13d}], 0x1, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000340)="696f001b66408225aaa3af068fffebb8a490c47dda6586f1b58895b94a78037dd3714e7198820a7a709e2d30d25e6d846cd5c62a648a598668a8263b752b0b622b115112b5ad8e0425c0b784bbdb89eb8f4da0dd73dd01fe35694c2f78600badf8a0e237dba40713bac9e053b41a9f62be5fbb928018aab5f7500bef51a2fd74d4fffb4a20a946733820bdc1b485afa417cdbcfdfbc54f58c9c3edffe240c36f4ab8a16613814e226b6d20d98010ab1ace49fa76dce337a5a5f1dcff9e5d533b12475e33b971b15b69cd591cd9059759f0f04ba5468a34b98915033debb3e87f048e8601712659d47d8687eb6be5e650068d88000000000000") preadv(r0, &(0x7f0000000480), 0x10000000000002a1, 0x3000000) msgget$private(0x0, 0x22) 12:34:26 executing program 5: r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = socket(0x11, 0x4000000000080002, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000000)={'ip6_vti0\x00'}) setsockopt$packet_int(r1, 0x107, 0x14, &(0x7f0000003dc0)=0x4, 0x4) pwrite64(r0, &(0x7f0000000080)="1709097a6a5347a35bc52069529c0cbab8b9dad92d15cf08c3cbd5e86e36b8261c4c33dbae0e2396d7c0168f47e4983a8a81b80bc406", 0x36, 0x36) sendmmsg$inet_sctp(r1, &(0x7f0000871fc8)=[{&(0x7f000086c000)=@in6={0xa, 0x0, 0x2}, 0x1c, &(0x7f0000d1e000), 0x0, &(0x7f0000dda000)}], 0x492492492492510, 0x0) r2 = memfd_create(&(0x7f0000000040)='$eth0\x00', 0x5) getsockopt$sock_cred(r1, 0x1, 0x11, &(0x7f00000000c0)={0x0}, &(0x7f0000000100)=0xc) waitid(0x2, r3, &(0x7f0000000140), 0xc, &(0x7f0000000180)) ioctl$KVM_SET_NR_MMU_PAGES(r2, 0xae44, 0x8000) 12:34:26 executing program 1: r0 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r0, &(0x7f0000000080)={0x2, 0x4e23, @dev}, 0x10) sendto$inet(r0, &(0x7f0000000000), 0x0, 0x200007fa, &(0x7f0000000140)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0x1e}}, 0x10) r1 = syz_open_dev$loop(&(0x7f0000000000)='/dev/loop#\x00', 0x0, 0x0) getsockopt$inet_sctp_SCTP_PEER_AUTH_CHUNKS(r0, 0x84, 0x1a, &(0x7f0000000180)={0x0, 0x53, "8c01fb1bbfb96092ab101fcb507deb1f0769cbb9f9421c953320206b799936acd8250e01f0e2c3526776b8c9da7470bd03cff8fc6f9c41053cbfbb51e2549551256deab240ad72cce1afb20624ba1ae3fd5c93"}, &(0x7f0000000040)=0x5b) setsockopt$inet_sctp_SCTP_DEFAULT_PRINFO(r0, 0x84, 0x72, &(0x7f0000000200)={r2, 0x2, 0x20}, 0xc) r3 = memfd_create(&(0x7f00000000c0)="000000008c00000000000000000000", 0x0) pwritev(r3, &(0x7f0000f50f90)=[{&(0x7f0000000100)="a8", 0x1}], 0x1, 0x81003) ioctl$LOOP_CHANGE_FD(r1, 0x4c00, r3) r4 = socket$inet6(0xa, 0x1, 0x0) ioctl(r4, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070") sendfile(r0, r1, &(0x7f00000ddff8), 0x102000002) 12:34:26 executing program 2: perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f0000000180)=""/148, 0x13d}], 0x1, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000340)="696f001b66408225aaa3af068fffebb8a490c47dda6586f1b58895b94a78037dd3714e7198820a7a709e2d30d25e6d846cd5c62a648a598668a8263b752b0b622b115112b5ad8e0425c0b784bbdb89eb8f4da0dd73dd01fe35694c2f78600badf8a0e237dba40713bac9e053b41a9f62be5fbb928018aab5f7500bef51a2fd74d4fffb4a20a946733820bdc1b485afa417cdbcfdfbc54f58c9c3edffe240c36f4ab8a16613814e226b6d20d98010ab1ace49fa76dce337a5a5f1dcff9e5d533b12475e33b971b15b69cd591cd9059759f0f04ba5468a34b98915033debb3e87f048e8601712659d47d8687eb6be5e650068d88000000000000") preadv(r0, &(0x7f0000000480), 0x10000000000002a1, 0xc3eeff7f) msgget$private(0x0, 0x22) 12:34:26 executing program 5: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)="7374617409c0d2febcf9df2deac8c177ff171248e91193513049f831550d6f7de66cf637bdbf1311920c8a26eda4dcc3783f9db5116b34d31b0512a5608aaff01e7952340cd6fd00000000", 0x275a, 0x0) r1 = creat(&(0x7f0000000140)='./file0\x00', 0x0) write$P9_RREAD(r1, &(0x7f0000000180)={0x43, 0x75, 0x2, {0x38, "e82fbaaa6a6274aa5cee1a4ff98c3cfe2cebeb6a3b9f04dd2d42cc29d24f9aa8c1797debd1c869c7cc61a292a6f452459f84d837a445a23a"}}, 0x43) fallocate(r1, 0x0, 0x40000, 0xfff) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fallocate(r0, 0x0, 0x0, 0x10001) ioctl$EXT4_IOC_MOVE_EXT(r0, 0xc028660f, &(0x7f0000000040)={0x0, r1, 0x0, 0x8}) getsockopt$sock_cred(r1, 0x1, 0x11, &(0x7f0000000000)={0x0, 0x0}, &(0x7f0000000100)=0xc) stat(&(0x7f0000000280)='./file0/file0\x00', &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) getsockopt$inet_IP_XFRM_POLICY(r1, 0x0, 0x11, &(0x7f0000000340)={{{@in6=@dev, @in=@remote, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6}, 0x0, @in6=@ipv4={[], [], @loopback}}}, &(0x7f0000000440)=0xe8) lstat(&(0x7f0000000480)='./file0\x00', &(0x7f00000004c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) getresuid(&(0x7f0000000540)=0x0, &(0x7f0000000580), &(0x7f00000005c0)) r7 = getgid() r8 = geteuid() ioctl$LOOP_CLR_FD(r0, 0x4c01) fstat(0xffffffffffffffff, &(0x7f0000000600)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) getresuid(&(0x7f0000000680)=0x0, &(0x7f00000006c0), &(0x7f0000000700)) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000000740)={0x0, 0x0, 0x0}, &(0x7f0000000780)=0xc) write$FUSE_DIRENTPLUS(r0, &(0x7f00000007c0)={0x3c0, 0x0, 0x8, [{{0x0, 0x2, 0x3ff, 0x3f, 0x7, 0x81, {0x0, 0x1, 0x2, 0x7, 0x1, 0x4a, 0xffffffffffffb018, 0x4, 0x0, 0x7, 0x800, r2, r3, 0x8000, 0x3}}, {0x6, 0xa6, 0x48, 0x101, "7374617409c0d2febcf9df2deac8c177ff171248e91193513049f831550d6f7de66cf637bdbf1311920c8a26eda4dcc3783f9db5116b34d31b0512a5608aaff01e7952340cd6fd00"}}, {{0x5, 0x0, 0x4910, 0x12000000000000, 0x1, 0x5, {0x4, 0x7, 0x1ff, 0x100000001, 0x5, 0x9, 0x3, 0xffff, 0x0, 0x7, 0xf7, r4, r5, 0x0, 0x1000}}, {0x3, 0x1, 0x7, 0x7, 'eth1em1'}}, {{0x3, 0x0, 0x86, 0x40, 0xfffffffffffffc00, 0x9, {0x4, 0x7fff, 0x9, 0x1000000000000000, 0x3f, 0x5, 0xcb, 0x5, 0x100000000, 0x2, 0x3, r6, r7, 0x2, 0x20}}, {0x1, 0x8, 0x17, 0x20, "2821657468317d76626f786e6574315ca5766d6e657430"}}, {{0x3, 0x2, 0x15, 0x800, 0x7, 0x3c, {0x0, 0x193, 0x800, 0x8, 0x7, 0x0, 0x1, 0x400, 0x7, 0x5, 0x8, r8, r9, 0x8, 0x8}}, {0x3, 0x200, 0x48, 0xff, "7374617409c0d2febcf9df2deac8c177ff171248e91193513049f831550d6f7de66cf637bdbf1311920c8a26eda4dcc3783f9db5116b34d31b0512a5608aaff01e7952340cd6fd00"}}, {{0x5, 0x1, 0xffffffffffffff81, 0xfffffffffffffff9, 0x9, 0x80, {0x2, 0x1ff, 0x2, 0x0, 0xf33, 0xffffffffffffffff, 0x0, 0x6, 0xf7f, 0x2, 0xc0000, r10, r11, 0x4, 0xfff}}, {0x0, 0x2, 0x6, 0xffff, 'vmnet1'}}]}, 0x3c0) memfd_create(&(0x7f0000000200)="7374617409c0d2febcf9df2deac8c177ff171248e91193513049f831550d6f7de66cf637bdbf1311920c8a26eda4dcc3783f9db5116b34d31b0512a5608aaff01e7952340cd6fd00", 0x6) [ 489.517727] binder: BINDER_SET_CONTEXT_MGR already set [ 489.523571] binder: 25456:25458 ioctl 40046207 0 returned -16 12:34:26 executing program 2: perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f0000000180)=""/148, 0x13d}], 0x1, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000340)="696f001b66408225aaa3af068fffebb8a490c47dda6586f1b58895b94a78037dd3714e7198820a7a709e2d30d25e6d846cd5c62a648a598668a8263b752b0b622b115112b5ad8e0425c0b784bbdb89eb8f4da0dd73dd01fe35694c2f78600badf8a0e237dba40713bac9e053b41a9f62be5fbb928018aab5f7500bef51a2fd74d4fffb4a20a946733820bdc1b485afa417cdbcfdfbc54f58c9c3edffe240c36f4ab8a16613814e226b6d20d98010ab1ace49fa76dce337a5a5f1dcff9e5d533b12475e33b971b15b69cd591cd9059759f0f04ba5468a34b98915033debb3e87f048e8601712659d47d8687eb6be5e650068d88000000000000") preadv(r0, &(0x7f0000000480), 0x10000000000002a1, 0x200000000000000) msgget$private(0x0, 0x22) 12:34:27 executing program 1: r0 = socket$inet6(0xa, 0x1, 0x0) fcntl$getownex(0xffffffffffffffff, 0x10, &(0x7f0000000080)) r1 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000180)='/dev/vcs\x00', 0x0, 0x0) r2 = accept4$bt_l2cap(r1, 0x0, &(0x7f00000001c0), 0x0) clone(0x802102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f00000000c0), 0xffffffffffffffff) r3 = getpid() sched_setscheduler(r3, 0x5, &(0x7f0000000200)) setsockopt$inet6_int(r0, 0x29, 0x37, &(0x7f0000000040), 0x18b) r4 = openat$pfkey(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/net/pfkey\x00', 0x400000, 0x0) r5 = syz_genetlink_get_family_id$team(&(0x7f0000000140)='team\x00') ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000240)={'bpq0\x00', 0x0}) getsockopt$inet6_IPV6_IPSEC_POLICY(r1, 0x29, 0x22, &(0x7f0000000300)={{{@in6, @in6=@local, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6}, 0x0, @in=@dev}}, &(0x7f0000000400)=0xe8) getsockopt$inet6_IPV6_XFRM_POLICY(r1, 0x29, 0x23, &(0x7f0000001640)={{{@in=@dev, @in6=@local, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@rand_addr}, 0x0, @in6=@remote}}, &(0x7f0000001740)=0xe8) getsockopt$inet6_IPV6_IPSEC_POLICY(r0, 0x29, 0x22, &(0x7f00000017c0)={{{@in6=@local, @in6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@dev}, 0x0, @in6=@local}}, &(0x7f00000018c0)=0xe8) getsockopt$inet_mreqn(r4, 0x0, 0x23, &(0x7f0000002e00)={@multicast1, @empty, 0x0}, &(0x7f0000002e40)=0xc) getsockopt$inet_IP_IPSEC_POLICY(r1, 0x0, 0x10, &(0x7f0000002ec0)={{{@in=@broadcast, @in=@dev, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@local}, 0x0, @in6}}, &(0x7f0000002fc0)=0xe8) getsockopt$inet_mreqn(r4, 0x0, 0x0, &(0x7f0000003000)={@loopback, @multicast1, 0x0}, &(0x7f0000003040)=0xc) getsockopt$inet6_IPV6_IPSEC_POLICY(r1, 0x29, 0x22, &(0x7f0000003080)={{{@in=@broadcast, @in=@dev, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@rand_addr}, 0x0, @in6=@mcast2}}, &(0x7f0000003180)=0xe8) ioctl$ifreq_SIOCGIFINDEX_vcan(r1, 0x8933, &(0x7f00000031c0)={'vcan0\x00', 0x0}) ioctl$sock_SIOCGIFCONF(r1, 0x8910, &(0x7f0000003240)=@req={0x28, &(0x7f0000003200)={'bond0\x00', @ifru_addrs=@xdp={0x2c, 0x5, 0x0, 0x25}}}) getsockopt$inet_pktinfo(r4, 0x0, 0x8, &(0x7f0000003280)={0x0, @multicast2, @multicast2}, &(0x7f00000032c0)=0xc) accept4(r0, &(0x7f00000033c0)=@xdp={0x2c, 0x0, 0x0}, &(0x7f0000003440)=0x80, 0x80800) getsockname$packet(r1, &(0x7f0000003480)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000034c0)=0x14) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000003500)={'teql0\x00', 0x0}) getsockopt$inet_IP_IPSEC_POLICY(r2, 0x0, 0x10, &(0x7f0000004600)={{{@in6=@mcast2, @in=@dev, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@loopback}, 0x0, @in=@rand_addr}}, &(0x7f0000004700)=0xe8) getsockopt$inet_IP_XFRM_POLICY(r4, 0x0, 0x11, &(0x7f00000048c0)={{{@in=@local, @in6=@local, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@loopback}, 0x0, @in6=@mcast1}}, &(0x7f00000049c0)=0xe8) sendmsg$TEAM_CMD_NOOP(r4, &(0x7f0000005080)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f0000005040)={&(0x7f0000004a00)={0x618, r5, 0x305, 0x70bd27, 0x25dfdbfc, {}, [{{0x8, 0x1, r6}, {0x7c, 0x2, [{0x40, 0x1, @lb_port_stats={{{0x24, 0x1, 'lb_port_stats\x00'}, {0x8}, {0x8, 0x4, 0x8}}, {0x8, 0x6, r7}}}, {0x38, 0x1, @mcast_rejoin_count={{0x24, 0x1, 'mcast_rejoin_count\x00'}, {0x8}, {0x8, 0x4, 0x3ff}}}]}}, {{0x8, 0x1, r8}, {0x1fc, 0x2, [{0x38, 0x1, @mcast_rejoin_count={{0x24, 0x1, 'mcast_rejoin_count\x00'}, {0x8}, {0x8, 0x4, 0x2}}}, {0x38, 0x1, @mcast_rejoin_count={{0x24, 0x1, 'mcast_rejoin_count\x00'}, {0x8}, {0x8, 0x4, 0x76}}}, {0x40, 0x1, @priority={{{0x24, 0x1, 'priority\x00'}, {0x8}, {0x8, 0x4, 0x100000000}}, {0x8, 0x6, r9}}}, {0x3c, 0x1, @user_linkup={{{0x24, 0x1, 'user_linkup\x00'}, {0x8}, {0x4}}, {0x8, 0x6, r10}}}, {0x38, 0x1, @notify_peers_interval={{0x24, 0x1, 'notify_peers_interval\x00'}, {0x8}, {0x8, 0x4, 0x4}}}, {0x4c, 0x1, @lb_tx_method={{0x24, 0x1, 'lb_tx_method\x00'}, {0x8}, {0x1c, 0x4, 'hash_to_port_mapping\x00'}}}, {0x3c, 0x1, @user_linkup={{{0x24, 0x1, 'user_linkup\x00'}, {0x8}, {0x4}}, {0x8, 0x6, r11}}}, {0x4c, 0x1, @lb_tx_method={{0x24, 0x1, 'lb_tx_method\x00'}, {0x8}, {0x1c, 0x4, 'hash_to_port_mapping\x00'}}}]}}, {{0x8, 0x1, r12}, {0xbc, 0x2, [{0x40, 0x1, @priority={{{0x24, 0x1, 'priority\x00'}, {0x8}, {0x8, 0x4, 0x1}}, {0x8, 0x6, r13}}}, {0x38, 0x1, @notify_peers_interval={{0x24, 0x1, 'notify_peers_interval\x00'}, {0x8}, {0x8, 0x4, 0x7}}}, {0x40, 0x1, @queue_id={{{0x24, 0x1, 'queue_id\x00'}, {0x8}, {0x8, 0x4, 0x6}}, {0x8, 0x6, r14}}}]}}, {{0x8, 0x1, r15}, {0x234, 0x2, [{0x40, 0x1, @queue_id={{{0x24, 0x1, 'queue_id\x00'}, {0x8}, {0x8, 0x4, 0x100}}, {0x8, 0x6, r16}}}, {0x4c, 0x1, @bpf_hash_func={{0x24, 0x1, 'bpf_hash_func\x00'}, {0x8}, {0x1c, 0x4, [{0xe27c, 0x6, 0x3c}, {0x7, 0x7301, 0x6, 0x3}, {0x2, 0x1, 0x7, 0x8}]}}}, {0x38, 0x1, @mcast_rejoin_interval={{0x24, 0x1, 'mcast_rejoin_interval\x00'}, {0x8}, {0x8, 0x4, 0x101}}}, {0x3c, 0x1, @enabled={{{0x24, 0x1, 'enabled\x00'}, {0x8}, {0x4}}, {0x8, 0x6, r17}}}, {0x38, 0x1, @mcast_rejoin_count={{0x24, 0x1, 'mcast_rejoin_count\x00'}, {0x8}, {0x8, 0x4, 0x2}}}, {0x38, 0x1, @notify_peers_interval={{0x24, 0x1, 'notify_peers_interval\x00'}, {0x8}, {0x8, 0x4, 0x5}}}, {0x40, 0x1, @queue_id={{{0x24, 0x1, 'queue_id\x00'}, {0x8}, {0x8, 0x4, 0x3f}}, {0x8, 0x6, r18}}}, {0x40, 0x1, @lb_tx_hash_to_port_mapping={{{0x24, 0x1, 'lb_tx_hash_to_port_mapping\x00'}, {0x8}, {0x8, 0x4, r19}}, {0x8}}}, {0x40, 0x1, @priority={{{0x24, 0x1, 'priority\x00'}, {0x8}, {0x8, 0x4, 0xffff}}, {0x8, 0x6, r20}}}]}}, {{0x8, 0x1, r21}, {0x74, 0x2, [{0x38, 0x1, @lb_stats_refresh_interval={{0x24, 0x1, 'lb_stats_refresh_interval\x00'}, {0x8}, {0x8, 0x4, 0x7}}}, {0x38, 0x1, @notify_peers_count={{0x24, 0x1, 'notify_peers_count\x00'}, {0x8}, {0x8, 0x4, 0x100}}}]}}]}, 0x618}, 0x1, 0x0, 0x0, 0x800}, 0x0) 12:34:27 executing program 3: syz_open_dev$sndctrl(&(0x7f0000000140)='/dev/snd/controlC#\x00', 0x0, 0x0) sched_setaffinity(0x0, 0x7, &(0x7f00000000c0)=0x9) r0 = perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0) fcntl$setflags(r0, 0x2, 0x1) getsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER_VALUE(0xffffffffffffffff, 0x84, 0x7c, &(0x7f00000001c0), &(0x7f0000000240)=0x8) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(0xffffffffffffffff, 0x84, 0x9, &(0x7f0000000280)={0x0, @in={{0x2, 0x4e23, @remote}}, 0xfffffffffffffff7, 0x0, 0x400}, 0x98) sendto$inet6(0xffffffffffffffff, &(0x7f00000004c0), 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) setsockopt$SO_BINDTODEVICE(0xffffffffffffffff, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x4) socket$inet6(0xa, 0x1000000000002, 0x0) r1 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0045878, &(0x7f0000000200)={0x4, 0x0, &(0x7f0000000100)=[@enter_looper], 0x1, 0x0, &(0x7f0000000180)='T'}) r2 = gettid() timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, &(0x7f0000040000)) tkill(r2, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0xfffffffffffffced, 0x0, &(0x7f0000000040)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x400c630f}], 0x0, 0x0, &(0x7f0000000f4d)}) [ 490.066552] binder: BINDER_SET_CONTEXT_MGR already set [ 490.071907] binder: 25440:25445 ioctl 40046207 0 returned -16 [ 490.078770] binder: undelivered death notification, 0000000000000000 12:34:27 executing program 0: socket$inet6(0xa, 0x0, 0x80000000) sched_setaffinity(0x0, 0x7, &(0x7f00000000c0)=0x9) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0) fcntl$setflags(0xffffffffffffffff, 0x2, 0x1) r0 = socket$inet6(0xa, 0x400000000001, 0x0) r1 = dup(r0) setsockopt$inet6_tcp_int(r1, 0x6, 0x12, &(0x7f0000000000)=0x7f, 0x4) bind$inet6(r0, &(0x7f0000000040)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) getsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER_VALUE(r0, 0x84, 0x7c, &(0x7f00000001c0)={0x0, 0x0, 0x6}, &(0x7f0000000240)=0x8) sendto$inet6(r0, &(0x7f00000004c0), 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x4) socket$inet6(0xa, 0x1000000000002, 0x0) r2 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000200)={0x4, 0x0, &(0x7f0000000100)=[@enter_looper], 0x1, 0x0, &(0x7f0000000180)='T'}) r3 = gettid() timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, &(0x7f0000040000)) tkill(r3, 0x1004000000016) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0xfffffffffffffced, 0x0, &(0x7f0000000040)}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x400c630f}], 0x0, 0x0, &(0x7f0000000f4d)}) 12:34:27 executing program 2: perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f0000000180)=""/148, 0x13d}], 0x1, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000340)="696f001b66408225aaa3af068fffebb8a490c47dda6586f1b58895b94a78037dd3714e7198820a7a709e2d30d25e6d846cd5c62a648a598668a8263b752b0b622b115112b5ad8e0425c0b784bbdb89eb8f4da0dd73dd01fe35694c2f78600badf8a0e237dba40713bac9e053b41a9f62be5fbb928018aab5f7500bef51a2fd74d4fffb4a20a946733820bdc1b485afa417cdbcfdfbc54f58c9c3edffe240c36f4ab8a16613814e226b6d20d98010ab1ace49fa76dce337a5a5f1dcff9e5d533b12475e33b971b15b69cd591cd9059759f0f04ba5468a34b98915033debb3e87f048e8601712659d47d8687eb6be5e650068d88000000000000") preadv(r0, &(0x7f0000000480), 0x10000000000002a1, 0x700000000000000) msgget$private(0x0, 0x22) 12:34:27 executing program 1: socketpair(0x10000000000001, 0x1, 0x0, &(0x7f0000000140)={0x0, 0x0}) sendmsg(r0, &(0x7f0000000740)={0x0, 0x0, &(0x7f00000005c0)=[{&(0x7f0000000340)='8', 0x1}], 0x1, &(0x7f0000001180)=ANY=[]}, 0x0) sendmsg$kcm(r1, &(0x7f0000000fc0)={0x0, 0x0, &(0x7f0000000e40)=[{&(0x7f0000000780)='5', 0x1}], 0x1, &(0x7f0000000f00)}, 0x0) recvmsg$kcm(r0, &(0x7f0000000200)={&(0x7f0000000040)=@ax25, 0x2, &(0x7f0000000000)=[{&(0x7f0000000080)=""/151, 0xffffffb6}], 0x1, &(0x7f00000001c0)=""/17, 0xffda}, 0x3f00) close(r1) 12:34:27 executing program 5: bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x5, 0x81, 0x1, 0x4, 0x14, 0xffffffffffffff9c, 0xffffffff}, 0x2c) r0 = syz_open_dev$usb(&(0x7f0000000080)='/dev/bus/usb/00#/00#\x00', 0x1fe, 0x0) syz_open_dev$usb(&(0x7f0000000040)='/dev/bus/usb/00#/00#\x00', 0x6, 0x2) preadv(r0, &(0x7f00000004c0)=[{&(0x7f00000001c0)=""/21, 0x15}], 0x1, 0x0) 12:34:27 executing program 4: socket$inet6(0xa, 0x0, 0x80000000) sched_setaffinity(0x0, 0x7, &(0x7f00000000c0)=0x9) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0) fcntl$setflags(0xffffffffffffffff, 0x2, 0x1) r0 = socket$inet6(0xa, 0x400000000001, 0x0) r1 = dup(r0) setsockopt$inet6_tcp_int(r1, 0x6, 0x12, &(0x7f0000000000)=0x7f, 0x4) bind$inet6(r0, &(0x7f0000000040)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) getsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER_VALUE(r0, 0x84, 0x7c, &(0x7f00000001c0)={0x0, 0x0, 0x6}, &(0x7f0000000240)=0x8) sendto$inet6(r0, &(0x7f00000004c0), 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x4) socket$inet6(0xa, 0x1000000000002, 0x0) r2 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000200)={0x4, 0x0, &(0x7f0000000100)=[@enter_looper], 0x1, 0x0, &(0x7f0000000180)='T'}) r3 = gettid() timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, &(0x7f0000040000)) tkill(r3, 0x1004000000016) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0xfffffffffffffced, 0x0, &(0x7f0000000040)}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000008fd0)={0x0, 0x0, &(0x7f00000000c0), 0x0, 0x0, &(0x7f0000000f4d)}) 12:34:27 executing program 5: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200)='/dev/kvm\x00', 0x0, 0x0) r1 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000540)='/dev/rtc0\x00', 0x80000, 0x0) setsockopt$inet_sctp_SCTP_MAX_BURST(r1, 0x84, 0x14, &(0x7f0000000580)=@int=0x2, 0x4) r2 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) socketpair$inet6_udplite(0xa, 0x2, 0x88, &(0x7f00000002c0)) ioctl$KVM_CREATE_DEVICE(r2, 0xc00caee0, &(0x7f0000000340)={0x4, 0xffffffffffffffff}) ioctl$SG_GET_SCSI_ID(r1, 0x2276, &(0x7f0000000000)) unshare(0x24020400) r4 = openat$hwrng(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/hwrng\x00', 0x10840, 0x0) ioctl$KVM_SET_DEVICE_ATTR(r3, 0x4018aee1, &(0x7f0000000240)={0x0, 0x2000000001, 0x1, &(0x7f0000000080)}) getsockopt$inet_sctp6_SCTP_PR_STREAM_STATUS(r1, 0x84, 0x74, &(0x7f00000000c0)=""/223, &(0x7f0000000040)=0xdf) ioctl$sock_bt_hidp_HIDPCONNDEL(r4, 0x400448c9, &(0x7f0000000280)={{0x4, 0xfffffffffffff800, 0x7f, 0x5, 0x8, 0x200}, 0xfffffffffffffffc}) ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) 12:34:27 executing program 2: perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f0000000180)=""/148, 0x13d}], 0x1, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000340)="696f001b66408225aaa3af068fffebb8a490c47dda6586f1b58895b94a78037dd3714e7198820a7a709e2d30d25e6d846cd5c62a648a598668a8263b752b0b622b115112b5ad8e0425c0b784bbdb89eb8f4da0dd73dd01fe35694c2f78600badf8a0e237dba40713bac9e053b41a9f62be5fbb928018aab5f7500bef51a2fd74d4fffb4a20a946733820bdc1b485afa417cdbcfdfbc54f58c9c3edffe240c36f4ab8a16613814e226b6d20d98010ab1ace49fa76dce337a5a5f1dcff9e5d533b12475e33b971b15b69cd591cd9059759f0f04ba5468a34b98915033debb3e87f048e8601712659d47d8687eb6be5e650068d88000000000000") preadv(r0, &(0x7f0000000480), 0x10000000000002a1, 0x500000000000000) msgget$private(0x0, 0x22) [ 490.248112] binder: BINDER_SET_CONTEXT_MGR already set [ 490.255710] binder: 25501:25506 ioctl 40046207 0 returned -16 12:34:27 executing program 1: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000100)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00000000c0)) r1 = syz_open_pts(r0, 0x0) ioctl$TCSETSF(r1, 0x5412, &(0x7f0000000040)={0x7f}) r2 = syz_open_dev$mice(&(0x7f0000000000)='/dev/input/mice\x00', 0x0, 0x80) setsockopt$SO_VM_SOCKETS_CONNECT_TIMEOUT(r2, 0x28, 0x6, &(0x7f0000000080), 0x10) 12:34:27 executing program 2: perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f0000000180)=""/148, 0x13d}], 0x1, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000340)="696f001b66408225aaa3af068fffebb8a490c47dda6586f1b58895b94a78037dd3714e7198820a7a709e2d30d25e6d846cd5c62a648a598668a8263b752b0b622b115112b5ad8e0425c0b784bbdb89eb8f4da0dd73dd01fe35694c2f78600badf8a0e237dba40713bac9e053b41a9f62be5fbb928018aab5f7500bef51a2fd74d4fffb4a20a946733820bdc1b485afa417cdbcfdfbc54f58c9c3edffe240c36f4ab8a16613814e226b6d20d98010ab1ace49fa76dce337a5a5f1dcff9e5d533b12475e33b971b15b69cd591cd9059759f0f04ba5468a34b98915033debb3e87f048e8601712659d47d8687eb6be5e650068d88000000000000") preadv(r0, &(0x7f0000000480), 0x10000000000002a1, 0x6000000) msgget$private(0x0, 0x22) [ 490.370085] binder: BINDER_SET_CONTEXT_MGR already set [ 490.380612] binder: 25513:25514 ioctl 40046207 0 returned -16 12:34:27 executing program 5: perf_event_open(&(0x7f0000000180)={0x4000000000001, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) socket$kcm(0xa, 0x40122000000003, 0x11) socketpair(0x1, 0x1, 0x0, &(0x7f0000000240)={0x0, 0x0}) socket$kcm(0xa, 0x2, 0x11) socketpair(0x1, 0x1, 0x0, &(0x7f0000000740)={0xffffffffffffffff, 0xffffffffffffffff}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000140)) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000440)) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)) socket$kcm(0xa, 0x2, 0x11) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) socket$kcm(0xa, 0x40122000000003, 0x11) ioctl(r0, 0x8, &(0x7f0000000280)="04e4f1e439a75326ce7aa517803695d0ed7c91e4316ef15b371771be90c20be2280520eac4af3412e9cbad875a0ece6db96baffa1c1369d7042cb10a1b014e7c1be99b000525262b83289b94f631a4581949500f71cf2a41a5a239ef562c9dd779bb5e51ceee1b80c1f0dc17fef25bcaa806f8674a7ecb8f74fa9113e06a120e83") socketpair$unix(0x1, 0x0, 0x0, &(0x7f0000000100)) sendmsg(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000100), 0x28a, &(0x7f0000000000)}, 0x0) ioctl$PERF_EVENT_IOC_SET_FILTER(r1, 0x8946, &(0x7f00000001c0)='veth0\x00') 12:34:27 executing program 5: r0 = socket$netlink(0x10, 0x3, 0x0) writev(r0, &(0x7f00000000c0)=[{&(0x7f0000000040)="390000001300090468fe0704000f00000000ff3f03000000450001070000001419001a0015000a00040008000200000800005d14a4e91ee438", 0x39}], 0x1) setsockopt$inet_sctp6_SCTP_FRAGMENT_INTERLEAVE(r0, 0x84, 0x12, &(0x7f0000000000)=0xfff, 0x4) r1 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000080)='net/sockstat6\x00') accept4$inet6(r1, &(0x7f0000000100)={0xa, 0x0, 0x0, @mcast2}, &(0x7f0000000140)=0x1c, 0x0) [ 490.554803] netlink: 'syz-executor5': attribute type 8 has an invalid length. [ 490.567614] netlink: 'syz-executor5': attribute type 8 has an invalid length. [ 490.940893] binder: BINDER_SET_CONTEXT_MGR already set [ 490.946327] binder: 25494:25503 ioctl 40046207 0 returned -16 [ 490.953477] binder: undelivered death notification, 0000000000000000 12:34:28 executing program 3: syz_open_dev$sndctrl(&(0x7f0000000140)='/dev/snd/controlC#\x00', 0x0, 0x0) sched_setaffinity(0x0, 0x7, &(0x7f00000000c0)=0x9) r0 = perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0) fcntl$setflags(r0, 0x2, 0x1) getsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER_VALUE(0xffffffffffffffff, 0x84, 0x7c, &(0x7f00000001c0), &(0x7f0000000240)=0x8) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(0xffffffffffffffff, 0x84, 0x9, &(0x7f0000000280)={0x0, @in={{0x2, 0x4e23, @remote}}, 0xfffffffffffffff7, 0x0, 0x400}, 0x98) sendto$inet6(0xffffffffffffffff, &(0x7f00000004c0), 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) setsockopt$SO_BINDTODEVICE(0xffffffffffffffff, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x4) socket$inet6(0xa, 0x1000000000002, 0x0) r1 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0x2, &(0x7f0000000200)={0x4, 0x0, &(0x7f0000000100)=[@enter_looper], 0x1, 0x0, &(0x7f0000000180)='T'}) r2 = gettid() timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, &(0x7f0000040000)) tkill(r2, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0xfffffffffffffced, 0x0, &(0x7f0000000040)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x400c630f}], 0x0, 0x0, &(0x7f0000000f4d)}) 12:34:28 executing program 5: socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = socket$inet(0x2, 0x200000002, 0x0) setsockopt$IP_VS_SO_SET_ADD(r1, 0x0, 0x482, &(0x7f0000000180)={0x84, @rand_addr, 0x15, 0x0, 'rr\x00'}, 0x2c) setsockopt$IP_VS_SO_SET_FLUSH(r1, 0x0, 0x485, 0x0, 0x0) syz_genetlink_get_family_id$nbd(&(0x7f0000000000)='nbd\x00') 12:34:28 executing program 0: r0 = socket$netlink(0x10, 0x3, 0x0) writev(r0, &(0x7f00000000c0)=[{&(0x7f0000000040)="390000001300090468fe0704000000000000ff3f03000000450001070000001419001a0015000a00070008004000000800005d14a4e91ee438", 0x39}], 0x1) r1 = syz_open_dev$usb(&(0x7f0000000000)='/dev/bus/usb/00#/00#\x00', 0x8001, 0x0) setsockopt$inet6_dccp_int(r1, 0x21, 0x4, &(0x7f0000000080)=0x401, 0x4) 12:34:28 executing program 1: r0 = socket$inet(0x2, 0x3, 0x800000000000b) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f00000004c0)=@nat={'nat\x00', 0x19, 0x1, 0x160, [0x200002c0, 0x0, 0x0, 0x200002f0, 0x20000320], 0x0, &(0x7f0000000000), &(0x7f00000002c0)=[{0x0, '\x00', 0x0, 0xffffffffffffffff}, {0x0, '\x00', 0x0, 0xffffffffffffffff}, {0x0, '\x00', 0x0, 0xffffffffffffffff}, {0x0, '\x00', 0x0, 0xffffffffffffffff, 0x1, [{{{0x11, 0x0, 0x0, "030073663000001000", 'dummy0\x00', 'ifb0\x00', 'lo\x00', @broadcast, [], @broadcast, [], 0x70, 0x70, 0xa0}}, @common=@redirect={'redirect\x00', 0x8, {{0xffffffffffffffff}}}}]}]}, 0x1d8) r1 = dup2(r0, r0) r2 = syz_genetlink_get_family_id$team(&(0x7f0000000080)='team\x00') getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f00000008c0)={{{@in=@dev, @in=@broadcast, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@broadcast}, 0x0, @in=@remote}}, &(0x7f0000000480)=0xe8) getpeername$packet(0xffffffffffffffff, &(0x7f00000009c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @link_local}, &(0x7f0000000a00)=0x14) getsockopt$inet_pktinfo(r0, 0x0, 0x8, &(0x7f0000000a40)={0x0, @empty, @multicast1}, &(0x7f0000000a80)=0xc) getsockname(r0, &(0x7f0000000ac0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000b40)=0x80) ioctl$ifreq_SIOCGIFINDEX_team(r0, 0x8933, &(0x7f0000000b80)={'team0\x00', 0x0}) getsockopt$inet_IP_IPSEC_POLICY(r0, 0x0, 0x10, &(0x7f0000000c80)={{{@in6=@loopback, @in=@dev, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@remote}, 0x0, @in=@multicast2}}, &(0x7f0000000d80)=0xe8) getsockopt$inet_IP_IPSEC_POLICY(r0, 0x0, 0x10, &(0x7f0000000dc0)={{{@in=@multicast2, @in=@loopback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@dev}, 0x0, @in6}}, &(0x7f0000000ec0)=0xe8) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000f80)={'yam0\x00', 0x0}) getsockopt$inet_pktinfo(r0, 0x0, 0x8, &(0x7f0000001080)={0x0, @rand_addr, @loopback}, &(0x7f00000010c0)=0xc) accept4$packet(0xffffffffffffff9c, &(0x7f0000001200)={0x11, 0x0, 0x0}, &(0x7f0000001240)=0x14, 0x800) getsockname$packet(0xffffffffffffff9c, &(0x7f0000001280)={0x11, 0x0, 0x0}, &(0x7f00000012c0)=0x14) getsockopt$inet_pktinfo(r0, 0x0, 0x8, &(0x7f00000018c0)={0x0, @broadcast, @multicast1}, &(0x7f0000001900)=0xc) getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, &(0x7f0000001940)={{{@in, @in6=@ipv4={[], [], @multicast2}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@dev}, 0x0, @in6=@local}}, &(0x7f0000001a40)=0xe8) getsockname$packet(0xffffffffffffffff, &(0x7f0000001bc0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @remote}, &(0x7f0000001c00)=0x14) getsockname(r0, &(0x7f0000004dc0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @local}, &(0x7f0000004e40)=0x80) getsockopt$inet_IP_IPSEC_POLICY(r0, 0x0, 0x10, &(0x7f0000004e80)={{{@in6=@local, @in6=@local, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@mcast1}, 0x0, @in6=@mcast1}}, &(0x7f0000004f80)=0xe8) getsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x11, &(0x7f0000004fc0)={{{@in6=@mcast2, @in6=@loopback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@loopback}, 0x0, @in6=@remote}}, &(0x7f00000050c0)=0xe8) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000005100)={'team_slave_0\x00', 0x0}) ioctl$ifreq_SIOCGIFINDEX_team(r0, 0x8933, &(0x7f0000005200)={'team0\x00', 0x0}) getsockopt$inet_pktinfo(r0, 0x0, 0x8, &(0x7f00000056c0)={0x0, @loopback, @dev}, &(0x7f0000005700)=0xc) getsockopt$inet_IP_IPSEC_POLICY(r0, 0x0, 0x10, &(0x7f0000005740)={{{@in=@remote, @in6=@remote, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@rand_addr}, 0x0, @in6=@mcast1}}, &(0x7f0000005840)=0xe8) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000005880)={{{@in6=@ipv4={[], [], @remote}, @in=@loopback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@remote}, 0x0, @in6=@mcast2}}, &(0x7f0000005980)=0xe8) getpeername$packet(0xffffffffffffffff, &(0x7f00000059c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @local}, &(0x7f0000005a00)=0x14) getsockopt$inet_mreqn(r0, 0x0, 0x24, &(0x7f0000005a40)={@multicast2, @multicast1, 0x0}, &(0x7f0000005a80)=0xc) getsockname$packet(r0, &(0x7f0000005ac0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @local}, &(0x7f0000005b00)=0x14) ioctl$ifreq_SIOCGIFINDEX_team(r0, 0x8933, &(0x7f0000005b40)={'team0\x00', 0x0}) ioctl$sock_ifreq(r0, 0x8910, &(0x7f0000005b80)={'ipddp0\x00', @ifru_addrs=@hci={0x1f, 0x0}}) sendmsg$TEAM_CMD_PORT_LIST_GET(r1, &(0x7f0000006780)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f0000006740)={&(0x7f0000005bc0)={0xb7c, r2, 0x402, 0x70bd2d, 0x25dfdbfc, {}, [{{0x8, 0x1, r3}, {0xbc, 0x2, [{0x40, 0x1, @lb_port_stats={{{0x24, 0x1, 'lb_port_stats\x00'}, {0x8}, {0x8, 0x4, 0xa37}}, {0x8, 0x6, r4}}}, {0x40, 0x1, @lb_tx_hash_to_port_mapping={{{0x24, 0x1, 'lb_tx_hash_to_port_mapping\x00'}, {0x8}, {0x8, 0x4, r5}}, {0x8}}}, {0x38, 0x1, @lb_stats_refresh_interval={{0x24, 0x1, 'lb_stats_refresh_interval\x00'}, {0x8}, {0x8, 0x4, 0x1000}}}]}}, {{0x8, 0x1, r6}, {0x144, 0x2, [{0x38, 0x1, @lb_stats_refresh_interval={{0x24, 0x1, 'lb_stats_refresh_interval\x00'}, {0x8}, {0x8, 0x4, 0x7}}}, {0x44, 0x1, @name={{0x24, 0x1, 'mode\x00'}, {0x8}, {0x14, 0x4, 'activebackup\x00'}}}, {0x40, 0x1, @priority={{{0x24, 0x1, 'priority\x00'}, {0x8}, {0x8, 0x4, 0x7}}, {0x8, 0x6, r7}}}, {0x44, 0x1, @name={{0x24, 0x1, 'mode\x00'}, {0x8}, {0x14, 0x4, 'activebackup\x00'}}}, {0x40, 0x1, @lb_hash_stats={{{0x24, 0x1, 'lb_hash_stats\x00'}, {0x8}, {0x8, 0x4, 0x1}}, {0x8}}}]}}, {{0x8, 0x1, r8}, {0x1c0, 0x2, [{0x40, 0x1, @queue_id={{{0x24, 0x1, 'queue_id\x00'}, {0x8}, {0x8, 0x4, 0x9}}, {0x8, 0x6, r9}}}, {0x40, 0x1, @name={{0x24, 0x1, 'mode\x00'}, {0x8}, {0x10, 0x4, 'broadcast\x00'}}}, {0x40, 0x1, @queue_id={{{0x24, 0x1, 'queue_id\x00'}, {0x8}, {0x8, 0x4, 0x8}}, {0x8, 0x6, r10}}}, {0x40, 0x1, @priority={{{0x24, 0x1, 'priority\x00'}, {0x8}, {0x8, 0x4, 0x757}}, {0x8, 0x6, r11}}}, {0x38, 0x1, @lb_stats_refresh_interval={{0x24, 0x1, 'lb_stats_refresh_interval\x00'}, {0x8}, {0x8, 0x4, 0xfffffffffffffffe}}}, {0x4c, 0x1, @lb_tx_method={{0x24, 0x1, 'lb_tx_method\x00'}, {0x8}, {0x1c, 0x4, 'hash_to_port_mapping\x00'}}}, {0x38, 0x1, @mcast_rejoin_count={{0x24, 0x1, 'mcast_rejoin_count\x00'}, {0x8}, {0x8, 0x4, 0x2}}}]}}, {{0x8, 0x1, r12}, {0x1e8, 0x2, [{0x3c, 0x1, @user_linkup_enabled={{{0x24, 0x1, 'user_linkup_enabled\x00'}, {0x8}, {0x4}}, {0x8, 0x6, r13}}}, {0x40, 0x1, @priority={{{0x24, 0x1, 'priority\x00'}, {0x8}, {0x8, 0x4, 0x3}}, {0x8, 0x6, r14}}}, {0x38, 0x1, @mcast_rejoin_interval={{0x24, 0x1, 'mcast_rejoin_interval\x00'}, {0x8}, {0x8, 0x4, 0x6}}}, {0x40, 0x1, @lb_tx_hash_to_port_mapping={{{0x24, 0x1, 'lb_tx_hash_to_port_mapping\x00'}, {0x8}, {0x8, 0x4, r15}}, {0x8}}}, {0x38, 0x1, @notify_peers_count={{0x24, 0x1, 'notify_peers_count\x00'}, {0x8}, {0x8, 0x4, 0x800}}}, {0x40, 0x1, @queue_id={{{0x24, 0x1, 'queue_id\x00'}, {0x8}, {0x8, 0x4, 0xffffffffffff1f5d}}, {0x8, 0x6, r16}}}, {0x3c, 0x1, @lb_tx_method={{0x24, 0x1, 'lb_tx_method\x00'}, {0x8}, {0xc, 0x4, 'hash\x00'}}}, {0x3c, 0x1, @enabled={{{0x24, 0x1, 'enabled\x00'}, {0x8}, {0x4}}, {0x8, 0x6, r17}}}]}}, {{0x8, 0x1, r18}, {0x238, 0x2, [{0x38, 0x1, @notify_peers_interval={{0x24, 0x1, 'notify_peers_interval\x00'}, {0x8}, {0x8}}}, {0x3c, 0x1, @user_linkup_enabled={{{0x24, 0x1, 'user_linkup_enabled\x00'}, {0x8}, {0x4}}, {0x8, 0x6, r19}}}, {0x64, 0x1, @bpf_hash_func={{0x24, 0x1, 'bpf_hash_func\x00'}, {0x8}, {0x34, 0x4, [{0x0, 0x0, 0x1, 0x3}, {0x2, 0x7fffffff, 0x7f, 0xffffffff7fffffff}, {0xddf4, 0x8000, 0x3f}, {0x7, 0x4, 0x1, 0x4}, {0x800, 0xffffffff, 0x1, 0x7ff}, {0x911, 0x6, 0x4e77, 0x9}]}}}, {0x38, 0x1, @notify_peers_interval={{0x24, 0x1, 'notify_peers_interval\x00'}, {0x8}, {0x8, 0x4, 0xff}}}, {0x40, 0x1, @priority={{{0x24, 0x1, 'priority\x00'}, {0x8}, {0x8, 0x4, 0xfffffffffffffffc}}, {0x8, 0x6, r20}}}, {0x38, 0x1, @notify_peers_interval={{0x24, 0x1, 'notify_peers_interval\x00'}, {0x8}, {0x8, 0x4, 0x7}}}, {0x38, 0x1, @lb_stats_refresh_interval={{0x24, 0x1, 'lb_stats_refresh_interval\x00'}, {0x8}, {0x8, 0x4, 0x2}}}, {0x38, 0x1, @mcast_rejoin_count={{0x24, 0x1, 'mcast_rejoin_count\x00'}, {0x8}, {0x8, 0x4, 0xff}}}, {0x3c, 0x1, @enabled={{{0x24, 0x1, 'enabled\x00'}, {0x8}, {0x4}}, {0x8, 0x6, r21}}}]}}, {{0x8, 0x1, r22}, {0x178, 0x2, [{0x40, 0x1, @queue_id={{{0x24, 0x1, 'queue_id\x00'}, {0x8}, {0x8, 0x4, 0x49d5}}, {0x8, 0x6, r23}}}, {0x44, 0x1, @bpf_hash_func={{0x24, 0x1, 'bpf_hash_func\x00'}, {0x8}, {0x14, 0x4, [{0x40, 0x0, 0xfffffffffffffffc, 0xff}, {0x9, 0x7, 0x80, 0x100000001}]}}}, {0x38, 0x1, @notify_peers_count={{0x24, 0x1, 'notify_peers_count\x00'}, {0x8}, {0x8, 0x4, 0x100000001}}}, {0x38, 0x1, @notify_peers_count={{0x24, 0x1, 'notify_peers_count\x00'}, {0x8}, {0x8, 0x4, 0x75}}}, {0x40, 0x1, @lb_port_stats={{{0x24, 0x1, 'lb_port_stats\x00'}, {0x8}, {0x8, 0x4, 0x9}}, {0x8, 0x6, r24}}}, {0x40, 0x1, @name={{0x24, 0x1, 'mode\x00'}, {0x8}, {0x10, 0x4, 'loadbalance\x00'}}}]}}, {{0x8, 0x1, r25}, {0x1d8, 0x2, [{0x40, 0x1, @queue_id={{{0x24, 0x1, 'queue_id\x00'}, {0x8}, {0x8, 0x4, 0x800}}, {0x8, 0x6, r26}}}, {0x38, 0x1, @activeport={{0x24, 0x1, 'activeport\x00'}, {0x8}, {0x8, 0x4, r27}}}, {0x3c, 0x1, @enabled={{{0x24, 0x1, 'enabled\x00'}, {0x8}, {0x4}}, {0x8, 0x6, r28}}}, {0x4c, 0x1, @lb_tx_method={{0x24, 0x1, 'lb_tx_method\x00'}, {0x8}, {0x1c, 0x4, 'hash_to_port_mapping\x00'}}}, {0x4c, 0x1, @lb_tx_method={{0x24, 0x1, 'lb_tx_method\x00'}, {0x8}, {0x1c, 0x4, 'hash_to_port_mapping\x00'}}}, {0x3c, 0x1, @user_linkup={{{0x24, 0x1, 'user_linkup\x00'}, {0x8}, {0x4}}, {0x8, 0x6, r29}}}, {0x4c, 0x1, @lb_tx_method={{0x24, 0x1, 'lb_tx_method\x00'}, {0x8}, {0x1c, 0x4, 'hash_to_port_mapping\x00'}}}]}}]}, 0xb7c}, 0x1, 0x0, 0x0, 0x40085}, 0x10) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f00000001c0)=@nat={'nat\x00', 0x19, 0x1, 0x190, [0x20000540, 0x0, 0x0, 0x20000670, 0x200006a0], 0x0, &(0x7f0000000180), &(0x7f0000000540)=[{0x0, '\x00', 0x0, 0xfffffffffffffffe, 0x1, [{{{0x1b, 0x0, 0x0, 'nr0\x00', 'sit0\x00', "6272df0a00000000000076655f3000", 'rose0\x00', @link_local, [], @link_local, [], 0xb0, 0xb0, 0x100, [@time={'time\x00', 0x18}]}}, @common=@log={'log\x00', 0x28, {{0x0, "085c8830d25f52f01d341ff23dbdfe7eb254a6539781e07e20d624437901"}}}}]}, {0x0, '\x00', 0x1, 0xffffffffffffffff}, {0x0, '\x00', 0x1, 0xfffffffffffffffe}]}, 0x208) 12:34:28 executing program 4 (fault-call:13 fault-nth:0): socket$inet6(0xa, 0x0, 0x80000000) sched_setaffinity(0x0, 0x7, &(0x7f00000000c0)=0x9) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0) fcntl$setflags(0xffffffffffffffff, 0x2, 0x1) r0 = socket$inet6(0xa, 0x400000000001, 0x0) r1 = dup(r0) setsockopt$inet6_tcp_int(r1, 0x6, 0x12, &(0x7f0000000000)=0x7f, 0x4) bind$inet6(r0, &(0x7f0000000040)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) getsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER_VALUE(r0, 0x84, 0x7c, &(0x7f00000001c0)={0x0, 0x0, 0x6}, &(0x7f0000000240)=0x8) sendto$inet6(r0, &(0x7f00000004c0), 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x4) socket$inet6(0xa, 0x1000000000002, 0x0) r2 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000200)={0x4, 0x0, &(0x7f0000000100)=[@enter_looper], 0x1, 0x0, &(0x7f0000000180)='T'}) r3 = gettid() timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, &(0x7f0000040000)) tkill(r3, 0x1004000000016) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0xfffffffffffffced, 0x0, &(0x7f0000000040)}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x400c630f}], 0x0, 0x0, &(0x7f0000000f4d)}) 12:34:28 executing program 2: perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f0000000180)=""/148, 0x13d}], 0x1, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000340)="696f001b66408225aaa3af068fffebb8a490c47dda6586f1b58895b94a78037dd3714e7198820a7a709e2d30d25e6d846cd5c62a648a598668a8263b752b0b622b115112b5ad8e0425c0b784bbdb89eb8f4da0dd73dd01fe35694c2f78600badf8a0e237dba40713bac9e053b41a9f62be5fbb928018aab5f7500bef51a2fd74d4fffb4a20a946733820bdc1b485afa417cdbcfdfbc54f58c9c3edffe240c36f4ab8a16613814e226b6d20d98010ab1ace49fa76dce337a5a5f1dcff9e5d533b12475e33b971b15b69cd591cd9059759f0f04ba5468a34b98915033debb3e87f048e8601712659d47d8687eb6be5e650068d88000000000000") preadv(r0, &(0x7f0000000480), 0x10000000000002a1, 0x7fffeec3) msgget$private(0x0, 0x22) [ 491.048292] netlink: 'syz-executor0': attribute type 8 has an invalid length. [ 491.081464] netlink: 9 bytes leftover after parsing attributes in process `syz-executor0'. [ 491.107076] netlink: 9 bytes leftover after parsing attributes in process `syz-executor0'. [ 491.115854] FAULT_INJECTION: forcing a failure. [ 491.115854] name failslab, interval 1, probability 0, space 0, times 0 [ 491.127814] netlink: 'syz-executor0': attribute type 8 has an invalid length. [ 491.142792] CPU: 0 PID: 25557 Comm: syz-executor4 Not tainted 4.19.0-rc4-next-20180921+ #77 12:34:28 executing program 2: perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f0000000180)=""/148, 0x13d}], 0x1, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000340)="696f001b66408225aaa3af068fffebb8a490c47dda6586f1b58895b94a78037dd3714e7198820a7a709e2d30d25e6d846cd5c62a648a598668a8263b752b0b622b115112b5ad8e0425c0b784bbdb89eb8f4da0dd73dd01fe35694c2f78600badf8a0e237dba40713bac9e053b41a9f62be5fbb928018aab5f7500bef51a2fd74d4fffb4a20a946733820bdc1b485afa417cdbcfdfbc54f58c9c3edffe240c36f4ab8a16613814e226b6d20d98010ab1ace49fa76dce337a5a5f1dcff9e5d533b12475e33b971b15b69cd591cd9059759f0f04ba5468a34b98915033debb3e87f048e8601712659d47d8687eb6be5e650068d88000000000000") preadv(r0, &(0x7f0000000480), 0x10000000000002a1, 0x300000000000000) msgget$private(0x0, 0x22) 12:34:28 executing program 5: perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$netlink(0x10, 0x3, 0x1000000000004) readv(r0, &(0x7f0000000100)=[{&(0x7f0000000080)=""/77, 0x4d}], 0x1) r1 = socket$vsock_dgram(0x28, 0x2, 0x0) ioctl$EVIOCGABS20(r0, 0x80184560, &(0x7f0000000200)=""/4096) writev(r0, &(0x7f00000a8000)=[{&(0x7f0000aef000)="580000001400192300bb4b80040d8c562806f0ffffff04106a9643c218fe59a2e04a03ca8164243e890000000a215a0004fbf50dfff90003a5000004001ce1ed5e0000000000221f100001000700f8ffff0000ec6b0f536e", 0x58}], 0x1) sync_file_range(r1, 0x6, 0x7fb, 0x7) r2 = open(&(0x7f0000000000)='./file0\x00', 0x2, 0x0) ioctl$VHOST_RESET_OWNER(r2, 0xaf02, 0x0) [ 491.151305] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 491.160664] Call Trace: [ 491.163281] dump_stack+0x1d3/0x2c4 [ 491.166934] ? dump_stack_print_info.cold.2+0x52/0x52 [ 491.167963] netlink: 9 bytes leftover after parsing attributes in process `syz-executor0'. [ 491.172147] ? should_fail+0x19a/0xd01 [ 491.172174] should_fail.cold.4+0xa/0x17 [ 491.172191] ? retint_kernel+0x2d/0x2d [ 491.172212] ? fault_create_debugfs_attr+0x1f0/0x1f0 [ 491.172231] ? __bpf_trace_preemptirq_template+0x30/0x30 [ 491.172250] ? lockdep_hardirqs_on+0x421/0x5c0 [ 491.172272] ? retint_kernel+0x2d/0x2d [ 491.197583] ? trace_hardirqs_on_caller+0xc0/0x310 [ 491.207603] ? graph_lock+0x170/0x170 [ 491.207639] ? find_held_lock+0x36/0x1c0 [ 491.213269] netlink: 9 bytes leftover after parsing attributes in process `syz-executor0'. [ 491.216461] ? ttwu_stat+0x5c0/0x5c0 [ 491.216481] ? __bpf_trace_preemptirq_template+0x30/0x30 [ 491.216511] __should_failslab+0x124/0x180 [ 491.246121] should_failslab+0x9/0x14 [ 491.249945] kmem_cache_alloc_trace+0x2d7/0x750 [ 491.254629] ? _raw_spin_unlock+0x2c/0x50 [ 491.254714] binder_get_thread+0x255/0x880 [ 491.254734] ? binder_free_ref+0xa0/0xa0 [ 491.267189] ? ttwu_stat+0x5c0/0x5c0 [ 491.270911] ? rcu_lockdep_current_cpu_online+0x1a4/0x210 [ 491.276454] ? rcu_pm_notify+0xc0/0xc0 [ 491.276479] ? __might_sleep+0x95/0x190 [ 491.276500] ? binder_ioctl_write_read.isra.42+0xb90/0xb90 [ 491.276520] binder_ioctl+0x270/0x1940 [ 491.293888] ? binder_ioctl_write_read.isra.42+0xb90/0xb90 [ 491.299531] ? find_held_lock+0x36/0x1c0 [ 491.303618] ? __fget+0x4aa/0x740 [ 491.307085] ? lock_downgrade+0x900/0x900 [ 491.311241] ? check_preemption_disabled+0x48/0x200 [ 491.316272] ? rcu_read_unlock_special+0x1c0/0x1c0 [ 491.321208] ? kasan_check_read+0x11/0x20 [ 491.325363] ? rcu_dynticks_curr_cpu_in_eqs+0xa2/0x170 [ 491.330673] ? rcu_softirq_qs+0x20/0x20 [ 491.334663] ? lock_is_held_type+0x18b/0x210 [ 491.339099] ? __fget+0x4d1/0x740 [ 491.342587] ? ksys_dup3+0x680/0x680 [ 491.346312] ? lockdep_hardirqs_on+0x421/0x5c0 [ 491.350908] ? retint_kernel+0x2d/0x2d [ 491.354808] ? trace_hardirqs_on_thunk+0x1a/0x1c [ 491.359579] ? lockdep_hardirqs_on+0x421/0x5c0 [ 491.364197] ? retint_kernel+0x2d/0x2d [ 491.368099] ? trace_hardirqs_on_caller+0xc0/0x310 [ 491.373046] ? binder_ioctl_write_read.isra.42+0xb90/0xb90 [ 491.378684] do_vfs_ioctl+0x1de/0x1720 [ 491.382581] ? trace_hardirqs_on_thunk+0x1a/0x1c [ 491.387368] ? ioctl_preallocate+0x300/0x300 [ 491.391788] ? trace_hardirqs_on_thunk+0x1a/0x1c [ 491.396560] ? retint_kernel+0x2d/0x2d [ 491.400471] ? security_file_ioctl+0x20/0xc0 [ 491.404897] ? security_file_ioctl+0x27/0xc0 [ 491.409320] ? security_file_ioctl+0x94/0xc0 [ 491.413747] ksys_ioctl+0xa9/0xd0 [ 491.417215] __x64_sys_ioctl+0x73/0xb0 [ 491.421119] do_syscall_64+0x1b9/0x820 [ 491.425024] ? entry_SYSCALL_64_after_hwframe+0x3e/0xbe [ 491.430397] ? syscall_return_slowpath+0x5e0/0x5e0 [ 491.435333] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 491.440188] ? trace_hardirqs_off+0x310/0x310 [ 491.444696] ? prepare_exit_to_usermode+0x3b0/0x3b0 [ 491.449725] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 491.455273] ? prepare_exit_to_usermode+0x291/0x3b0 [ 491.460307] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 491.465186] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 491.470383] RIP: 0033:0x457679 [ 491.473584] Code: 1d b4 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 eb b3 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 491.492575] RSP: 002b:00007fe8be910c78 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 491.500291] RAX: ffffffffffffffda RBX: 00007fe8be9116d4 RCX: 0000000000457679 12:34:28 executing program 0: bpf$MAP_CREATE(0x0, &(0x7f0000346fd4)={0x0, 0x0, 0x0, 0x8d4, 0x20}, 0xfffffffffffffd03) bpf$PROG_LOAD(0x5, &(0x7f00000ba000)={0xd, 0x5, &(0x7f0000346fc8)=ANY=[@ANYBLOB="180000000000000000000000000000006118900000000000000000000000000095e2ff0000000000"], &(0x7f0000000000)='GPL\x00', 0x0, 0xfb, &(0x7f00001a7f05)=""/251}, 0x14) r0 = open(&(0x7f0000000100)='./file0\x00', 0x0, 0x16) getsockopt$inet_sctp6_SCTP_GET_ASSOC_STATS(0xffffffffffffff9c, 0x84, 0x70, &(0x7f0000000140)={0x0, @in={{0x2, 0x4e24, @remote}}, [0x1, 0x7, 0x80000000, 0x8, 0x7b, 0x8b73, 0xffffffff80000001, 0x0, 0x3, 0x7, 0x8, 0x0, 0x2f, 0xfcce, 0x71]}, &(0x7f0000000240)=0x100) setsockopt$inet_sctp_SCTP_PRIMARY_ADDR(r0, 0x84, 0x6, &(0x7f0000000280)={r1, @in={{0x2, 0x4e24, @multicast1}}}, 0x74) [ 491.507581] RDX: 0000000000000000 RSI: 0000000040046207 RDI: 0000000000000007 [ 491.514857] RBP: 000000000072bf00 R08: 0000000000000000 R09: 0000000000000000 [ 491.522357] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000008 [ 491.529632] R13: 00000000004ce3f8 R14: 00000000004be94b R15: 0000000000000000 [ 491.583545] binder: 25554:25557 ioctl 40046207 0 returned -12 12:34:28 executing program 4 (fault-call:13 fault-nth:1): socket$inet6(0xa, 0x0, 0x80000000) sched_setaffinity(0x0, 0x7, &(0x7f00000000c0)=0x9) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0) fcntl$setflags(0xffffffffffffffff, 0x2, 0x1) r0 = socket$inet6(0xa, 0x400000000001, 0x0) r1 = dup(r0) setsockopt$inet6_tcp_int(r1, 0x6, 0x12, &(0x7f0000000000)=0x7f, 0x4) bind$inet6(r0, &(0x7f0000000040)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) getsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER_VALUE(r0, 0x84, 0x7c, &(0x7f00000001c0)={0x0, 0x0, 0x6}, &(0x7f0000000240)=0x8) sendto$inet6(r0, &(0x7f00000004c0), 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x4) socket$inet6(0xa, 0x1000000000002, 0x0) r2 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000200)={0x4, 0x0, &(0x7f0000000100)=[@enter_looper], 0x1, 0x0, &(0x7f0000000180)='T'}) r3 = gettid() timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, &(0x7f0000040000)) tkill(r3, 0x1004000000016) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0xfffffffffffffced, 0x0, &(0x7f0000000040)}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x400c630f}], 0x0, 0x0, &(0x7f0000000f4d)}) 12:34:28 executing program 1: socketpair$unix(0x1, 0x0, 0x0, &(0x7f0000000200)) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000000), 0xffffffffffffffff) r0 = syz_open_dev$adsp(&(0x7f0000000080)='/dev/adsp#\x00', 0xa75f, 0x30000) accept4$inet6(r0, &(0x7f0000000180)={0xa, 0x0, 0x0, @remote}, &(0x7f00000001c0)=0x1c, 0x80000) r1 = getpid() sched_setscheduler(r1, 0x5, &(0x7f0000000200)) socket$pppoe(0x18, 0x1, 0xa00) accept4(0xffffffffffffffff, &(0x7f00000000c0)=@can, &(0x7f0000000140)=0x80, 0x0) r2 = ioctl$KVM_CREATE_VCPU(0xffffffffffffff9c, 0xae41, 0x2) ioctl$KVM_ARM_SET_DEVICE_ADDR(r2, 0x4010aeab, &(0x7f0000000040)={0x20000000000, 0x6000}) 12:34:28 executing program 2: perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f0000000180)=""/148, 0x13d}], 0x1, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000340)="696f001b66408225aaa3af068fffebb8a490c47dda6586f1b58895b94a78037dd3714e7198820a7a709e2d30d25e6d846cd5c62a648a598668a8263b752b0b622b115112b5ad8e0425c0b784bbdb89eb8f4da0dd73dd01fe35694c2f78600badf8a0e237dba40713bac9e053b41a9f62be5fbb928018aab5f7500bef51a2fd74d4fffb4a20a946733820bdc1b485afa417cdbcfdfbc54f58c9c3edffe240c36f4ab8a16613814e226b6d20d98010ab1ace49fa76dce337a5a5f1dcff9e5d533b12475e33b971b15b69cd591cd9059759f0f04ba5468a34b98915033debb3e87f048e8601712659d47d8687eb6be5e650068d88000000000000") preadv(r0, &(0x7f0000000480), 0x10000000000002a1, 0x4000000) msgget$private(0x0, 0x22) 12:34:29 executing program 0: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = socket$inet6(0xa, 0x1, 0x0) getsockopt$inet6_int(r1, 0x29, 0x10000000000013, &(0x7f0000534000), &(0x7f0000000040)=0x4) socketpair(0x9, 0x0, 0x800, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) write$USERIO_CMD_SET_PORT_TYPE(r2, &(0x7f00000000c0)={0x1, 0xb036}, 0x2) [ 491.799857] binder: BINDER_SET_CONTEXT_MGR already set [ 491.824965] binder: 25589:25595 ioctl 40046207 0 returned -16 12:34:29 executing program 3: syz_open_dev$sndctrl(&(0x7f0000000140)='/dev/snd/controlC#\x00', 0x0, 0x0) sched_setaffinity(0x0, 0x7, &(0x7f00000000c0)=0x9) r0 = perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0) fcntl$setflags(r0, 0x2, 0x1) getsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER_VALUE(0xffffffffffffffff, 0x84, 0x7c, &(0x7f00000001c0), &(0x7f0000000240)=0x8) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(0xffffffffffffffff, 0x84, 0x9, &(0x7f0000000280)={0x0, @in={{0x2, 0x4e23, @remote}}, 0xfffffffffffffff7, 0x0, 0x400}, 0x98) sendto$inet6(0xffffffffffffffff, &(0x7f00000004c0), 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) setsockopt$SO_BINDTODEVICE(0xffffffffffffffff, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x4) socket$inet6(0xa, 0x1000000000002, 0x0) r1 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0x5460, &(0x7f0000000200)={0x4, 0x0, &(0x7f0000000100)=[@enter_looper], 0x1, 0x0, &(0x7f0000000180)='T'}) r2 = gettid() timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, &(0x7f0000040000)) tkill(r2, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0xfffffffffffffced, 0x0, &(0x7f0000000040)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x400c630f}], 0x0, 0x0, &(0x7f0000000f4d)}) 12:34:29 executing program 5: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = socket$inet(0x10, 0x3, 0x0) sendmsg(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f000000d000)=[{&(0x7f0000008000)="4c0000001200ff09fffefd956fa283b724a6008000000000000000683540150024001d001fc41180b598bc593ab6821148a730de33a49868c62b2ca654a6613b6aabf35d0f1cbc882b079881", 0x4c}], 0x1}, 0x0) r2 = openat(0xffffffffffffffff, &(0x7f0000000040)='./file0\x00', 0x42080, 0x4) ioctl$NBD_DISCONNECT(r2, 0xab08) r3 = openat$ppp(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ppp\x00', 0x0, 0x0) ioctl$EVIOCGPROP(r3, 0xc004743e, &(0x7f0000000700)=""/246) r4 = syz_genetlink_get_family_id$nbd(&(0x7f00000004c0)='nbd\x00') sendmsg$NBD_CMD_DISCONNECT(r3, &(0x7f0000000240)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f00000001c0)={&(0x7f0000000180)={0x40, r4, 0x0, 0x70bd2a, 0x25dfdbff, {}, [@NBD_ATTR_DEAD_CONN_TIMEOUT={0xc, 0x8, 0x6}, @NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x7f}, @NBD_ATTR_DEAD_CONN_TIMEOUT={0xc, 0x8, 0x7}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}]}, 0x40}, 0x1, 0x0, 0x0, 0x40}, 0x4000) recvmmsg(r1, &(0x7f0000001b40)=[{{0x0, 0x118, &(0x7f0000000240), 0x0, 0x0, 0x26085d6cce6967cc}}], 0x4000056, 0x0, &(0x7f0000000200)={0x77359400}) 12:34:29 executing program 1: r0 = socket$inet6(0xa, 0x1, 0x8010000000000084) setsockopt$inet_sctp6_SCTP_SOCKOPT_BINDX_ADD(r0, 0x84, 0x64, &(0x7f0000000040)=[@in={0x2, 0x4e22, @broadcast}, @in={0x2, 0x4e21, @broadcast}, @in={0x2, 0x4e21}], 0x30) bind$inet6(r0, &(0x7f0000ef8cfd)={0xa, 0x4e23, 0x0, @loopback}, 0x1c) listen(r0, 0x5) r1 = socket$inet6_sctp(0xa, 0x800000000001, 0x84) pipe(&(0x7f00000000c0)={0xffffffffffffffff}) ioctl$DRM_IOCTL_SET_CLIENT_CAP(r2, 0x4010640d, &(0x7f0000000100)={0x3, 0xb0e}) sendto$inet6(r1, &(0x7f0000e33fe0)='X', 0x1, 0x0, &(0x7f000005ffe4)={0xa, 0x4e23, 0x0, @loopback}, 0x1c) setsockopt$SO_ATTACH_FILTER(r1, 0x1, 0x1a, &(0x7f0000000000)={0x1, &(0x7f0000000080)=[{0x6, 0x0, 0x0, 0x400000000000003}]}, 0x10) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000140)='erspan0\x00', 0x10) shutdown(r1, 0x1) 12:34:29 executing program 0: socket$inet6_udp(0xa, 0x2, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) connect$inet6(0xffffffffffffffff, &(0x7f00000000c0)={0xa, 0x0, 0x0, @mcast2, 0x7}, 0x1c) socket$l2tp(0x18, 0x1, 0x1) r0 = syz_open_dev$mice(&(0x7f0000000000)='/dev/input/mice\x00', 0x0, 0x0) getsockopt$inet_sctp6_SCTP_MAXSEG(0xffffffffffffffff, 0x84, 0xd, &(0x7f0000000040)=@assoc_value={0x0, 0x9000000000000000}, &(0x7f0000000080)=0x8) getsockopt$inet_sctp_SCTP_ASSOCINFO(r0, 0x84, 0x1, &(0x7f0000000100)={r1, 0x10000000000, 0x3ff, 0x6, 0xffffffff, 0xfffffffffffffffe}, &(0x7f0000000140)=0x14) msync(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x4) 12:34:29 executing program 2: perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f0000000180)=""/148, 0x13d}], 0x1, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000340)="696f001b66408225aaa3af068fffebb8a490c47dda6586f1b58895b94a78037dd3714e7198820a7a709e2d30d25e6d846cd5c62a648a598668a8263b752b0b622b115112b5ad8e0425c0b784bbdb89eb8f4da0dd73dd01fe35694c2f78600badf8a0e237dba40713bac9e053b41a9f62be5fbb928018aab5f7500bef51a2fd74d4fffb4a20a946733820bdc1b485afa417cdbcfdfbc54f58c9c3edffe240c36f4ab8a16613814e226b6d20d98010ab1ace49fa76dce337a5a5f1dcff9e5d533b12475e33b971b15b69cd591cd9059759f0f04ba5468a34b98915033debb3e87f048e8601712659d47d8687eb6be5e650068d88000000000000") preadv(r0, &(0x7f0000000480), 0x10000000000002a1, 0x600000000000000) msgget$private(0x0, 0x22) [ 491.883272] binder: BINDER_SET_CONTEXT_MGR already set [ 491.888683] binder: 25558:25573 ioctl 40046207 0 returned -16 [ 491.898277] binder: undelivered death notification, 0000000000000000 [ 491.947441] netlink: 'syz-executor5': attribute type 29 has an invalid length. [ 491.977055] netlink: 8 bytes leftover after parsing attributes in process `syz-executor5'. [ 491.997325] netlink: 'syz-executor5': attribute type 29 has an invalid length. [ 492.017706] netlink: 8 bytes leftover after parsing attributes in process `syz-executor5'. 12:34:29 executing program 2: perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f0000000180)=""/148, 0x13d}], 0x1, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000340)="696f001b66408225aaa3af068fffebb8a490c47dda6586f1b58895b94a78037dd3714e7198820a7a709e2d30d25e6d846cd5c62a648a598668a8263b752b0b622b115112b5ad8e0425c0b784bbdb89eb8f4da0dd73dd01fe35694c2f78600badf8a0e237dba40713bac9e053b41a9f62be5fbb928018aab5f7500bef51a2fd74d4fffb4a20a946733820bdc1b485afa417cdbcfdfbc54f58c9c3edffe240c36f4ab8a16613814e226b6d20d98010ab1ace49fa76dce337a5a5f1dcff9e5d533b12475e33b971b15b69cd591cd9059759f0f04ba5468a34b98915033debb3e87f048e8601712659d47d8687eb6be5e650068d88000000000000") preadv(r0, &(0x7f0000000480), 0x10000000000002a1, 0x700) msgget$private(0x0, 0x22) [ 492.042025] netlink: 'syz-executor5': attribute type 29 has an invalid length. [ 492.051926] netlink: 8 bytes leftover after parsing attributes in process `syz-executor5'. [ 492.066188] netlink: 'syz-executor5': attribute type 29 has an invalid length. [ 492.086409] netlink: 8 bytes leftover after parsing attributes in process `syz-executor5'. 12:34:29 executing program 1: syz_open_dev$sndctrl(&(0x7f0000000140)='/dev/snd/controlC#\x00', 0x0, 0x0) sched_setaffinity(0x0, 0x7, &(0x7f00000000c0)=0x9) r0 = perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0) fcntl$setflags(r0, 0x2, 0x1) getsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER_VALUE(0xffffffffffffffff, 0x84, 0x7c, &(0x7f00000001c0), &(0x7f0000000240)=0x8) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(0xffffffffffffffff, 0x84, 0x9, &(0x7f0000000280)={0x0, @in={{0x2, 0x4e23, @remote}}, 0xfffffffffffffff7, 0x0, 0x400}, 0x98) sendto$inet6(0xffffffffffffffff, &(0x7f00000004c0), 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) setsockopt$SO_BINDTODEVICE(0xffffffffffffffff, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x4) socket$inet6(0xa, 0x1000000000002, 0x0) r1 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0x2, &(0x7f0000000200)={0x4, 0x0, &(0x7f0000000100)=[@enter_looper], 0x1, 0x0, &(0x7f0000000180)='T'}) r2 = gettid() timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, &(0x7f0000040000)) tkill(r2, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0xfffffffffffffced, 0x0, &(0x7f0000000040)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x400c630f}], 0x0, 0x0, &(0x7f0000000f4d)}) 12:34:29 executing program 0: syz_open_dev$sndctrl(&(0x7f0000000140)='/dev/snd/controlC#\x00', 0x0, 0x0) sched_setaffinity(0x0, 0x7, &(0x7f00000000c0)=0x9) r0 = perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0) fcntl$setflags(r0, 0x2, 0x1) getsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER_VALUE(0xffffffffffffffff, 0x84, 0x7c, &(0x7f00000001c0), &(0x7f0000000240)=0x8) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(0xffffffffffffffff, 0x84, 0x9, &(0x7f0000000280)={0x0, @in={{0x2, 0x4e23, @remote}}, 0xfffffffffffffff7, 0x0, 0x400}, 0x98) sendto$inet6(0xffffffffffffffff, &(0x7f00000004c0), 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) setsockopt$SO_BINDTODEVICE(0xffffffffffffffff, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x4) socket$inet6(0xa, 0x1000000000002, 0x0) r1 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0x2, &(0x7f0000000200)={0x4, 0x0, &(0x7f0000000100)=[@enter_looper], 0x1, 0x0, &(0x7f0000000180)='T'}) r2 = gettid() timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, &(0x7f0000040000)) tkill(r2, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0xfffffffffffffced, 0x0, &(0x7f0000000040)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x400c630f}], 0x0, 0x0, &(0x7f0000000f4d)}) [ 492.104449] netlink: 'syz-executor5': attribute type 29 has an invalid length. [ 492.112112] netlink: 8 bytes leftover after parsing attributes in process `syz-executor5'. [ 492.125115] netlink: 'syz-executor5': attribute type 29 has an invalid length. [ 492.133209] netlink: 8 bytes leftover after parsing attributes in process `syz-executor5'. [ 492.196449] binder: BINDER_SET_CONTEXT_MGR already set [ 492.202415] binder: 25632:25633 ioctl 40046207 0 returned -16 [ 492.235215] binder: BINDER_SET_CONTEXT_MGR already set [ 492.242533] binder: 25634:25635 ioctl 40046207 0 returned -16 12:34:29 executing program 4: socket$inet6(0xa, 0x0, 0x80000000) sched_setaffinity(0x0, 0x7, &(0x7f00000000c0)=0x9) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0) fcntl$setflags(0xffffffffffffffff, 0x2, 0x1) r0 = socket$inet6(0xa, 0x400000000001, 0x0) r1 = dup(r0) setsockopt$inet6_tcp_int(r1, 0x6, 0x12, &(0x7f0000000000)=0x7f, 0x4) bind$inet6(r0, &(0x7f0000000040)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) getsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER_VALUE(r0, 0x84, 0x7c, &(0x7f00000001c0)={0x0, 0x0, 0x6}, &(0x7f0000000240)=0x8) sendto$inet6(r0, &(0x7f00000004c0), 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x4) socket$inet6(0xa, 0x1000000000002, 0x0) r2 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000200)={0x4, 0x0, &(0x7f0000000100)=[@enter_looper], 0x1, 0x0, &(0x7f0000000180)='T'}) r3 = gettid() timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, &(0x7f0000040000)) tkill(r3, 0x1004000000016) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0xfffffffffffffced, 0x0, &(0x7f0000000040)}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x400c630f}], 0x0, 0x0, &(0x7f0000000f4d)}) 12:34:29 executing program 2: perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f0000000180)=""/148, 0x13d}], 0x1, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000340)="696f001b66408225aaa3af068fffebb8a490c47dda6586f1b58895b94a78037dd3714e7198820a7a709e2d30d25e6d846cd5c62a648a598668a8263b752b0b622b115112b5ad8e0425c0b784bbdb89eb8f4da0dd73dd01fe35694c2f78600badf8a0e237dba40713bac9e053b41a9f62be5fbb928018aab5f7500bef51a2fd74d4fffb4a20a946733820bdc1b485afa417cdbcfdfbc54f58c9c3edffe240c36f4ab8a16613814e226b6d20d98010ab1ace49fa76dce337a5a5f1dcff9e5d533b12475e33b971b15b69cd591cd9059759f0f04ba5468a34b98915033debb3e87f048e8601712659d47d8687eb6be5e650068d88000000000000") preadv(r0, &(0x7f0000000480), 0x10000000000002a1, 0x300) msgget$private(0x0, 0x22) [ 492.554587] binder_release_work: 1 callbacks suppressed [ 492.554640] binder: undelivered death notification, 0000000000000000 12:34:29 executing program 2: perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f0000000180)=""/148, 0x13d}], 0x1, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000340)="696f001b66408225aaa3af068fffebb8a490c47dda6586f1b58895b94a78037dd3714e7198820a7a709e2d30d25e6d846cd5c62a648a598668a8263b752b0b622b115112b5ad8e0425c0b784bbdb89eb8f4da0dd73dd01fe35694c2f78600badf8a0e237dba40713bac9e053b41a9f62be5fbb928018aab5f7500bef51a2fd74d4fffb4a20a946733820bdc1b485afa417cdbcfdfbc54f58c9c3edffe240c36f4ab8a16613814e226b6d20d98010ab1ace49fa76dce337a5a5f1dcff9e5d533b12475e33b971b15b69cd591cd9059759f0f04ba5468a34b98915033debb3e87f048e8601712659d47d8687eb6be5e650068d88000000000000") preadv(r0, &(0x7f0000000480), 0x10000000000002a1, 0x10) msgget$private(0x0, 0x22) [ 492.627926] binder: BINDER_SET_CONTEXT_MGR already set [ 492.634260] binder: 25643:25644 ioctl 40046207 0 returned -16 12:34:30 executing program 4: socket$inet6(0xa, 0x0, 0x80000000) sched_setaffinity(0x0, 0x7, &(0x7f00000000c0)=0x9) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0) fcntl$setflags(0xffffffffffffffff, 0x2, 0x1) r0 = socket$inet6(0xa, 0x400000000001, 0x0) r1 = dup(r0) setsockopt$inet6_tcp_int(r1, 0x6, 0x12, &(0x7f0000000000)=0x7f, 0x4) bind$inet6(r0, &(0x7f0000000040)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) getsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER_VALUE(r0, 0x84, 0x7c, &(0x7f00000001c0)={0x0, 0x0, 0x6}, &(0x7f0000000240)=0x8) sendto$inet6(r0, &(0x7f00000004c0), 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x4) socket$inet6(0xa, 0x1000000000002, 0x0) r2 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0xc018620c, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000200)={0x4, 0x0, &(0x7f0000000100)=[@enter_looper], 0x1, 0x0, &(0x7f0000000180)='T'}) r3 = gettid() timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, &(0x7f0000040000)) tkill(r3, 0x1004000000016) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0xfffffffffffffced, 0x0, &(0x7f0000000040)}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x400c630f}], 0x0, 0x0, &(0x7f0000000f4d)}) 12:34:30 executing program 3: syz_open_dev$sndctrl(&(0x7f0000000140)='/dev/snd/controlC#\x00', 0x0, 0x0) sched_setaffinity(0x0, 0x7, &(0x7f00000000c0)=0x9) r0 = perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0) fcntl$setflags(r0, 0x2, 0x1) getsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER_VALUE(0xffffffffffffffff, 0x84, 0x7c, &(0x7f00000001c0), &(0x7f0000000240)=0x8) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(0xffffffffffffffff, 0x84, 0x9, &(0x7f0000000280)={0x0, @in={{0x2, 0x4e23, @remote}}, 0xfffffffffffffff7, 0x0, 0x400}, 0x98) sendto$inet6(0xffffffffffffffff, &(0x7f00000004c0), 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) setsockopt$SO_BINDTODEVICE(0xffffffffffffffff, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x4) socket$inet6(0xa, 0x1000000000002, 0x0) r1 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0045878, &(0x7f0000000200)={0x4, 0x0, &(0x7f0000000100)=[@enter_looper], 0x1, 0x0, &(0x7f0000000180)='T'}) r2 = gettid() timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, &(0x7f0000040000)) tkill(r2, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0xfffffffffffffced, 0x0, &(0x7f0000000040)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x400c630f}], 0x0, 0x0, &(0x7f0000000f4d)}) [ 492.782349] binder: 25651:25652 ioctl c018620c 0 returned -14 [ 492.794925] binder: BINDER_SET_CONTEXT_MGR already set [ 492.800383] binder: 25618:25625 ioctl 40046207 0 returned -16 [ 492.807601] binder: undelivered death notification, 0000000000000000 [ 492.815509] binder: undelivered death notification, 0000000000000000 12:34:30 executing program 5: r0 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000080)='/dev/rtc0\x00', 0x1a000, 0x0) ioctl$PIO_FONTX(r0, 0x4b6c, &(0x7f0000000240)="854ac24deb448fd5a5097cf48c1e4d6a67d84668a9d0e8ff462d75bf56fe1bf4b9b9f9ef3bf2008b4cb641d4774256e2814c57261817e2b68bbe78d7a960429ae3f9f25ec87b9707c9c345f7eaeef950dc80b49549af056c56dae0d06c88de188653f7bb04215fe103bb1371ff5a7d8a53578c660a5f94adf52ff1d923fbc70ca6f7735d3da0406a35bfffaa61db") getxattr(&(0x7f0000000000)='./file0\x00', &(0x7f0000000040)=@known='trusted.overlay.origin\x00', &(0x7f0000000140)=""/235, 0xeb) syz_mount_image$hfsplus(&(0x7f0000000300)='hfsplus\x00', &(0x7f0000000100)='./file0\x00', 0x0, 0x0, &(0x7f0000000380), 0x8, &(0x7f0000000340)=ANY=[@ANYBLOB="20c89da4b3567c751b73647bd2cd3236ccb0b40bddc5b156253a5b5f1c85a85a6c56007ddf4f65d7f8506d0fb301c82770cdcfb1875aaca093ce3d1680a5e9010322ad39b87124b7ae0994a25b47784f"]) write$P9_RREADLINK(r0, &(0x7f00000000c0)={0x10, 0x17, 0x2, {0x7, './file0'}}, 0x10) socket$inet6_icmp_raw(0xa, 0x3, 0x3a) 12:34:30 executing program 2: perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f0000000180)=""/148, 0x13d}], 0x1, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000340)="696f001b66408225aaa3af068fffebb8a490c47dda6586f1b58895b94a78037dd3714e7198820a7a709e2d30d25e6d846cd5c62a648a598668a8263b752b0b622b115112b5ad8e0425c0b784bbdb89eb8f4da0dd73dd01fe35694c2f78600badf8a0e237dba40713bac9e053b41a9f62be5fbb928018aab5f7500bef51a2fd74d4fffb4a20a946733820bdc1b485afa417cdbcfdfbc54f58c9c3edffe240c36f4ab8a16613814e226b6d20d98010ab1ace49fa76dce337a5a5f1dcff9e5d533b12475e33b971b15b69cd591cd9059759f0f04ba5468a34b98915033debb3e87f048e8601712659d47d8687eb6be5e650068d88000000000000") preadv(r0, &(0x7f0000000480), 0x10000000000002a1, 0x2) msgget$private(0x0, 0x22) [ 492.856891] binder: 25651:25655 Acquire 1 refcount change on invalid ref 0 ret -22 [ 492.869120] binder: 25651:25655 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 492.877953] binder: 25651:25655 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 [ 492.908130] hfsplus: unable to parse mount options 12:34:30 executing program 2: perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f0000000180)=""/148, 0x13d}], 0x1, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000340)="696f001b66408225aaa3af068fffebb8a490c47dda6586f1b58895b94a78037dd3714e7198820a7a709e2d30d25e6d846cd5c62a648a598668a8263b752b0b622b115112b5ad8e0425c0b784bbdb89eb8f4da0dd73dd01fe35694c2f78600badf8a0e237dba40713bac9e053b41a9f62be5fbb928018aab5f7500bef51a2fd74d4fffb4a20a946733820bdc1b485afa417cdbcfdfbc54f58c9c3edffe240c36f4ab8a16613814e226b6d20d98010ab1ace49fa76dce337a5a5f1dcff9e5d533b12475e33b971b15b69cd591cd9059759f0f04ba5468a34b98915033debb3e87f048e8601712659d47d8687eb6be5e650068d88000000000000") preadv(r0, &(0x7f0000000480), 0x10000000000002a1, 0x6) msgget$private(0x0, 0x22) 12:34:30 executing program 5: r0 = socket$inet6(0xa, 0x80003, 0x800001800000001) ioctl(r0, 0x8912, &(0x7f0000000100)="153f6234488dd24d766070") openat$full(0xffffffffffffff9c, &(0x7f0000000000)='/dev/full\x00', 0x200, 0x0) syz_emit_ethernet(0x3e, &(0x7f0000000140)={@local, @link_local={0x1, 0x80, 0xc2, 0xe80}, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x30, 0x0, 0x0, 0x0, 0x21, 0x0, @remote, @dev}, @icmp=@parameter_prob={0x3, 0xf, 0x0, 0x0, 0x0, 0x0, {0x5, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @local, @dev}}}}}}, &(0x7f00000000c0)) 12:34:30 executing program 0: syz_open_dev$sndctrl(&(0x7f0000000140)='/dev/snd/controlC#\x00', 0x0, 0x0) sched_setaffinity(0x0, 0x7, &(0x7f00000000c0)=0x9) r0 = perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0) fcntl$setflags(r0, 0x2, 0x1) getsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER_VALUE(0xffffffffffffffff, 0x84, 0x7c, &(0x7f00000001c0), &(0x7f0000000240)=0x8) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(0xffffffffffffffff, 0x84, 0x9, &(0x7f0000000280)={0x0, @in={{0x2, 0x4e23, @remote}}, 0xfffffffffffffff7, 0x0, 0x400}, 0x98) sendto$inet6(0xffffffffffffffff, &(0x7f00000004c0), 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) setsockopt$SO_BINDTODEVICE(0xffffffffffffffff, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x4) socket$inet6(0xa, 0x1000000000002, 0x0) r1 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0x2, &(0x7f0000000200)={0x4, 0x0, &(0x7f0000000100)=[@enter_looper], 0x1, 0x0, &(0x7f0000000180)='T'}) r2 = gettid() timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, &(0x7f0000040000)) tkill(r2, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0xfffffffffffffced, 0x0, &(0x7f0000000040)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x400c630f}], 0x0, 0x0, &(0x7f0000000f4d)}) 12:34:30 executing program 1: r0 = socket$inet6_sctp(0xa, 0x5, 0x84) getsockopt$inet_sctp6_SCTP_GET_ASSOC_ID_LIST(r0, 0x84, 0x3, &(0x7f00000002c0)={0x1, [0x0]}, &(0x7f0000000300)=0x3) bind$inet6(r0, &(0x7f0000000000)={0xa, 0x4e22, 0x100, @local, 0x1ff}, 0x1c) [ 492.992005] binder: undelivered death notification, 0000000000000000 [ 493.012297] binder: undelivered death notification, 0000000000000000 12:34:30 executing program 2: perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f0000000180)=""/148, 0x13d}], 0x1, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000340)="696f001b66408225aaa3af068fffebb8a490c47dda6586f1b58895b94a78037dd3714e7198820a7a709e2d30d25e6d846cd5c62a648a598668a8263b752b0b622b115112b5ad8e0425c0b784bbdb89eb8f4da0dd73dd01fe35694c2f78600badf8a0e237dba40713bac9e053b41a9f62be5fbb928018aab5f7500bef51a2fd74d4fffb4a20a946733820bdc1b485afa417cdbcfdfbc54f58c9c3edffe240c36f4ab8a16613814e226b6d20d98010ab1ace49fa76dce337a5a5f1dcff9e5d533b12475e33b971b15b69cd591cd9059759f0f04ba5468a34b98915033debb3e87f048e8601712659d47d8687eb6be5e650068d88000000000000") preadv(r0, &(0x7f0000000480), 0x10000000000002a1, 0x7ffff000) msgget$private(0x0, 0x22) 12:34:30 executing program 5: r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000280)={0x11, 0x4, 0x4, 0x400, 0x0, 0x1}, 0x3ef) r1 = syz_open_procfs(0xffffffffffffffff, &(0x7f00000003c0)='ns\x00') exit(0x0) getdents64(r1, &(0x7f0000000100)=""/211, 0xd3) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f00000000c0)={r0, &(0x7f0000000000), &(0x7f00000002c0), 0x4000000000000}, 0x20) mmap(&(0x7f0000ffe000/0x1000)=nil, 0x1000, 0x8, 0x110012, r0, 0x55) unshare(0x400) 12:34:30 executing program 1: r0 = perf_event_open(&(0x7f000001d000)={0x200000002, 0x70, 0x0, 0x108000001, 0x0, 0x0, 0x0, 0x0, 0x130}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = perf_event_open(&(0x7f000001d000)={0x2, 0x70, 0x59c, 0x0, 0x0, 0x0, 0x0, 0x0, 0x14020, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r2 = eventfd(0x0) r3 = syz_open_dev$usb(&(0x7f0000000040)='/dev/bus/usb/00#/00#\x00', 0x101, 0x2002) setsockopt$RDS_CONG_MONITOR(r3, 0x114, 0x6, &(0x7f0000000080)=0x1, 0x4) dup2(r2, r1) dup2(r2, r0) [ 493.099581] dccp_invalid_packet: P.Data Offset(0) too small [ 493.115196] binder: BINDER_SET_CONTEXT_MGR already set [ 493.134653] binder: 25677:25679 ioctl 40046207 0 returned -16 12:34:30 executing program 2: perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f0000000180)=""/148, 0x13d}], 0x1, 0x0) r0 = accept4$inet6(0xffffffffffffffff, &(0x7f0000000000)={0xa, 0x0, 0x0, @ipv4={[], [], @multicast1}}, &(0x7f0000000040)=0x1c, 0x800) getsockopt$inet_sctp6_SCTP_ADAPTATION_LAYER(r0, 0x84, 0x7, &(0x7f0000000080), &(0x7f00000000c0)=0x4) r1 = syz_open_procfs(0x0, &(0x7f0000000340)="696f001b66408225aaa3af068fffebb8a490c47dda6586f1b58895b94a78037dd3714e7198820a7a709e2d30d25e6d846cd5c62a648a598668a8263b752b0b622b115112b5ad8e0425c0b784bbdb89eb8f4da0dd73dd01fe35694c2f78600badf8a0e237dba40713bac9e053b41a9f62be5fbb928018aab5f7500bef51a2fd74d4fffb4a20a946733820bdc1b485afa417cdbcfdfbc54f58c9c3edffe240c36f4ab8a16613814e226b6d20d98010ab1ace49fa76dce337a5a5f1dcff9e5d533b12475e33b971b15b69cd591cd9059759f0f04ba5468a34b98915033debb3e87f048e8601712659d47d8687eb6be5e650068d88000000000000") preadv(r1, &(0x7f0000000480), 0x10000000000002a1, 0x0) ioctl$SCSI_IOCTL_PROBE_HOST(r1, 0x5385, &(0x7f0000000280)={0xb9, ""/185}) msgget$private(0x0, 0x22) 12:34:30 executing program 4: socket$inet6(0xa, 0x0, 0x80000000) sched_setaffinity(0x0, 0x7, &(0x7f00000000c0)=0x9) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0) fcntl$setflags(0xffffffffffffffff, 0x2, 0x1) r0 = socket$inet6(0xa, 0x400000000001, 0x0) r1 = dup(r0) setsockopt$inet6_tcp_int(r1, 0x6, 0x12, &(0x7f0000000000)=0x7f, 0x4) bind$inet6(r0, &(0x7f0000000040)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) getsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER_VALUE(r0, 0x84, 0x7c, &(0x7f00000001c0)={0x0, 0x0, 0x6}, &(0x7f0000000240)=0x8) sendto$inet6(r0, &(0x7f00000004c0), 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x4) socket$inet6(0xa, 0x1000000000002, 0x0) r2 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x10, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000200)={0x4, 0x0, &(0x7f0000000100)=[@enter_looper], 0x1, 0x0, &(0x7f0000000180)='T'}) r3 = gettid() timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, &(0x7f0000040000)) tkill(r3, 0x1004000000016) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0xfffffffffffffced, 0x0, &(0x7f0000000040)}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x400c630f}], 0x0, 0x0, &(0x7f0000000f4d)}) [ 493.560325] binder: 25651:25707 ioctl c018620c 0 returned -14 [ 493.570748] binder: 25651:25707 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 12:34:31 executing program 3: syz_open_dev$sndctrl(&(0x7f0000000140)='/dev/snd/controlC#\x00', 0x0, 0x0) sched_setaffinity(0x0, 0x7, &(0x7f00000000c0)=0x9) r0 = perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0) fcntl$setflags(r0, 0x2, 0x1) getsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER_VALUE(0xffffffffffffffff, 0x84, 0x7c, &(0x7f00000001c0), &(0x7f0000000240)=0x8) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(0xffffffffffffffff, 0x84, 0x9, &(0x7f0000000280)={0x0, @in={{0x2, 0x4e23, @remote}}, 0xfffffffffffffff7, 0x0, 0x400}, 0x98) sendto$inet6(0xffffffffffffffff, &(0x7f00000004c0), 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) setsockopt$SO_BINDTODEVICE(0xffffffffffffffff, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x4) socket$inet6(0xa, 0x1000000000002, 0x0) r1 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0x5421, &(0x7f0000000200)={0x4, 0x0, &(0x7f0000000100)=[@enter_looper], 0x1, 0x0, &(0x7f0000000180)='T'}) r2 = gettid() timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, &(0x7f0000040000)) tkill(r2, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0xfffffffffffffced, 0x0, &(0x7f0000000040)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x400c630f}], 0x0, 0x0, &(0x7f0000000f4d)}) 12:34:31 executing program 2: r0 = perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = openat$qat_adf_ctl(0xffffffffffffff9c, &(0x7f0000000000)='/dev/qat_adf_ctl\x00', 0x40000, 0x0) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000080)={0x0, r0, 0x0, 0x5, &(0x7f0000000040)=')[\'#\x00'}, 0xa2) ioctl$SNDRV_CTL_IOCTL_ELEM_REPLACE(r1, 0xc1105518, &(0x7f0000000440)={{0x7, 0x0, 0xffffffffffff0000, 0x80000000, '\x00', 0xdfe}, 0x6, 0x10000040, 0x30c2, r2, 0x1, 0x20, 'syz0\x00', &(0x7f00000000c0)=['system\'\x00'], 0x8, [], [0x400, 0x790, 0x55b9, 0x1000]}) preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f0000000180)=""/148, 0x13d}], 0x1, 0x0) r3 = syz_open_procfs(0x0, &(0x7f0000000340)="696f001b66408225aaa3af068fffebb8a490c47dda6586f1b58895b94a78037dd3714e7198820a7a709e2d30d25e6d846cd5c62a648a598668a8263b752b0b622b115112b5ad8e0425c0b784bbdb89eb8f4da0dd73dd01fe35694c2f78600badf8a0e237dba40713bac9e053b41a9f62be5fbb928018aab5f7500bef51a2fd74d4fffb4a20a946733820bdc1b485afa417cdbcfdfbc54f58c9c3edffe240c36f4ab8a16613814e226b6d20d98010ab1ace49fa76dce337a5a5f1dcff9e5d533b12475e33b971b15b69cd591cd9059759f0f04ba5468a34b98915033debb3e87f048e8601712659d47d8687eb6be5e650068d88000000000000") preadv(r3, &(0x7f0000000480), 0x10000000000002a1, 0x0) msgget$private(0x0, 0x22) 12:34:31 executing program 1: r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = dup(r0) ioctl$sock_inet_SIOCSIFDSTADDR(r1, 0x8918, &(0x7f0000000000)={'bcsf0\x00', {0x2, 0x4e23}}) getsockopt$inet_sctp6_SCTP_AUTH_ACTIVE_KEY(r1, 0x84, 0x18, &(0x7f0000000080)={0x0, 0xfffffffffffffff8}, &(0x7f00000000c0)=0x8) gettid() setsockopt$inet_sctp6_SCTP_AUTH_ACTIVE_KEY(r1, 0x84, 0x18, &(0x7f0000000340)={r2, 0x3}, 0x8) ioctl$VHOST_SET_VRING_BASE(r1, 0x4008af12, &(0x7f0000000040)={0x3, 0x613}) ioctl$BLKPG(r1, 0x1269, &(0x7f0000000200)={0x81, 0x0, 0x85, &(0x7f0000000140)="f54c31ab7330519901d38710ee0c5e0e2914e214c47bb425e3a5adba077443ef117b14df0152cb79d3e4b90efccf5710374b9f3d14edc2410c61b083225610225d9b5a9341a406e1121ff882bc01e284f87c96decbc2f874eec45ef0bb275c8cf58b7fdeff451763198626f3d5d95faabfd30ccec5062580a3e63706cc88f0f8cfd809c42a"}) openat$urandom(0xffffffffffffff9c, &(0x7f0000000100)='/dev/urandom\x00', 0x410080, 0x0) syz_open_dev$binder(&(0x7f0000000300)='/dev/binder#\x00', 0x0, 0x40802) mincore(&(0x7f00009ae000/0x1000)=nil, 0x1000, &(0x7f0000000240)=""/144) [ 493.656646] binder: 25710:25711 ioctl 10 0 returned -22 [ 493.665815] binder: BINDER_SET_CONTEXT_MGR already set [ 493.671280] binder: 25657:25712 ioctl 40046207 0 returned -16 [ 493.681457] binder: undelivered death notification, 0000000000000000 [ 493.688301] binder: undelivered death notification, 0000000000000000 [ 493.720863] QAT: Invalid ioctl [ 493.731922] QAT: Invalid ioctl [ 493.736727] binder: 25710:25718 Acquire 1 refcount change on invalid ref 0 ret -22 [ 493.748829] binder: 25710:25718 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 12:34:31 executing program 1: recvmmsg(0xffffffffffffffff, &(0x7f0000003140)=[{{&(0x7f0000001540)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @local}}}, 0x80, &(0x7f0000002900)}}], 0x1, 0x0, &(0x7f0000003280)) r1 = accept$nfc_llcp(r0, &(0x7f0000000040), &(0x7f00000000c0)=0x60) ioctl$TIOCGSID(r0, 0x5429, &(0x7f0000000200)=0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xb88, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, r2, 0x0, 0xffffffffffffffff, 0x0) umount2(&(0x7f0000000000)='./file0\x00', 0xe) ioctl$sock_FIOGETOWN(r1, 0x8903, &(0x7f00000001c0)) getpgid(0x0) socketpair(0x6, 0x8000e, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TIOCGSID(r3, 0x5429, &(0x7f0000000300)=0x0) r5 = syz_open_procfs(r4, &(0x7f0000000240)="6368696c64c5806c462a72656e0e") mkdirat$cgroup(r5, &(0x7f0000000140)='syz0\x00', 0x1ff) r6 = syz_open_procfs(0x0, &(0x7f0000000180)='environ\x00') ioctl$KVM_GET_NR_MMU_PAGES(r5, 0xae45, 0xa84) preadv(r6, &(0x7f00000017c0), 0x1d0, 0x0) 12:34:31 executing program 2: perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f0000000180)=""/148, 0x13d}], 0x1, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000340)="696f001b66408225aaa3af068fffebb8a490c47dda6586f1b58895b94a78037dd3714e7198820a7a709e2d30d25e6d846cd5c62a648a598668a8263b752b0b622b115112b5ad8e0425c0b784bbdb89eb8f4da0dd73dd01fe35694c2f78600badf8a0e237dba40713bac9e053b41a9f62be5fbb928018aab5f7500bef51a2fd74d4fffb4a20a946733820bdc1b485afa417cdbcfdfbc54f58c9c3edffe240c36f4ab8a16613814e226b6d20d98010ab1ace49fa76dce337a5a5f1dcff9e5d533b12475e33b971b15b69cd591cd9059759f0f04ba5468a34b98915033debb3e87f048e8601712659d47d8687eb6be5e650068d88000000000000") preadv(r0, &(0x7f0000000480), 0x10000000000002a1, 0x0) ioctl$KVM_RUN(r0, 0xae80, 0x0) msgget$private(0x0, 0x22) ioctl$KVM_SET_REGS(r0, 0x4090ae82, &(0x7f0000000000)={[0xe4, 0xf, 0x81, 0x2, 0xffffffff7fffffff, 0xed, 0x2, 0x2, 0x0, 0x1, 0x278, 0x7ff, 0x7, 0xfffffffffffffffb, 0x5, 0x6], 0x0, 0x1010}) [ 493.767437] binder: 25721:25722 ioctl c0306201 20000000 returned -11 [ 493.782358] binder: 25710:25718 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 [ 493.800978] binder: BINDER_SET_CONTEXT_MGR already set [ 493.807939] binder: 25721:25724 ioctl 40046207 0 returned -16 [ 493.839024] binder: undelivered death notification, 0000000000000000 [ 493.851700] binder: undelivered death notification, 0000000000000000 [ 493.877007] binder: undelivered death notification, 0000000000000000 12:34:31 executing program 0: syz_open_dev$sndctrl(&(0x7f0000000140)='/dev/snd/controlC#\x00', 0x0, 0x0) sched_setaffinity(0x0, 0x7, &(0x7f00000000c0)=0x9) r0 = perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0) fcntl$setflags(r0, 0x2, 0x1) getsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER_VALUE(0xffffffffffffffff, 0x84, 0x7c, &(0x7f00000001c0), &(0x7f0000000240)=0x8) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(0xffffffffffffffff, 0x84, 0x9, &(0x7f0000000280)={0x0, @in={{0x2, 0x4e23, @remote}}, 0xfffffffffffffff7, 0x0, 0x400}, 0x98) sendto$inet6(0xffffffffffffffff, &(0x7f00000004c0), 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) setsockopt$SO_BINDTODEVICE(0xffffffffffffffff, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x4) socket$inet6(0xa, 0x1000000000002, 0x0) r1 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0x2, &(0x7f0000000200)={0x4, 0x0, &(0x7f0000000100)=[@enter_looper], 0x1, 0x0, &(0x7f0000000180)='T'}) r2 = gettid() timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, &(0x7f0000040000)) tkill(r2, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0xfffffffffffffced, 0x0, &(0x7f0000000040)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x400c630f}], 0x0, 0x0, &(0x7f0000000f4d)}) 12:34:31 executing program 3: syz_open_dev$sndctrl(&(0x7f0000000140)='/dev/snd/controlC#\x00', 0x0, 0x0) sched_setaffinity(0x0, 0x7, &(0x7f00000000c0)=0x9) r0 = perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0) fcntl$setflags(r0, 0x2, 0x1) getsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER_VALUE(0xffffffffffffffff, 0x84, 0x7c, &(0x7f00000001c0), &(0x7f0000000240)=0x8) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(0xffffffffffffffff, 0x84, 0x9, &(0x7f0000000280)={0x0, @in={{0x2, 0x4e23, @remote}}, 0xfffffffffffffff7, 0x0, 0x400}, 0x98) sendto$inet6(0xffffffffffffffff, &(0x7f00000004c0), 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) setsockopt$SO_BINDTODEVICE(0xffffffffffffffff, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x4) socket$inet6(0xa, 0x1000000000002, 0x0) r1 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0x5452, &(0x7f0000000200)={0x4, 0x0, &(0x7f0000000100)=[@enter_looper], 0x1, 0x0, &(0x7f0000000180)='T'}) r2 = gettid() timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, &(0x7f0000040000)) tkill(r2, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0xfffffffffffffced, 0x0, &(0x7f0000000040)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x400c630f}], 0x0, 0x0, &(0x7f0000000f4d)}) 12:34:31 executing program 1: syz_open_dev$sndctrl(&(0x7f0000000140)='/dev/snd/controlC#\x00', 0x0, 0x0) sched_setaffinity(0x0, 0x7, &(0x7f00000000c0)=0x9) r0 = perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0) fcntl$setflags(r0, 0x2, 0x1) getsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER_VALUE(0xffffffffffffffff, 0x84, 0x7c, &(0x7f00000001c0), &(0x7f0000000240)=0x8) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(0xffffffffffffffff, 0x84, 0x9, &(0x7f0000000280)={0x0, @in={{0x2, 0x4e23, @remote}}, 0xfffffffffffffff7, 0x0, 0x400}, 0x98) sendto$inet6(0xffffffffffffffff, &(0x7f00000004c0), 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) setsockopt$SO_BINDTODEVICE(0xffffffffffffffff, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x4) socket$inet6(0xa, 0x1000000000002, 0x0) r1 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0x5421, &(0x7f0000000200)={0x4, 0x0, &(0x7f0000000100)=[@enter_looper], 0x1, 0x0, &(0x7f0000000180)='T'}) r2 = gettid() timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, &(0x7f0000040000)) tkill(r2, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0xfffffffffffffced, 0x0, &(0x7f0000000040)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x400c630f}], 0x0, 0x0, &(0x7f0000000f4d)}) [ 494.008692] binder: BINDER_SET_CONTEXT_MGR already set 12:34:31 executing program 5: prctl$getreaper(0x29, &(0x7f0000000000)) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0xa, 0x31, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8000000008912, &(0x7f0000000080)="0a5cc80700315f85715070") remap_file_pages(&(0x7f0000849000/0x400000)=nil, 0x400000, 0x0, 0x0, 0x0) r1 = msgget$private(0x0, 0x400) msgctl$IPC_STAT(r1, 0x2, &(0x7f00000000c0)=""/129) 12:34:31 executing program 2: r0 = perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) preadv(r0, &(0x7f00000000c0), 0x0, 0x800002) r1 = syz_open_procfs(0x0, &(0x7f0000000340)="696f001b66408225aaa3af068fffebb8a490c47dda6586f1b58895b94a78037dd3714e7198820a7a709e2d30d25e6d846cd5c62a648a598668a8263b752b0b622b115112b5ad8e0425c0b784bbdb89eb8f4da0dd73dd01fe35694c2f78600badf8a0e237dba40713bac9e053b41a9f62be5fbb928018aab5f7500bef51a2fd74d4fffb4a20a946733820bdc1b485afa417cdbcfdfbc54f58c9c3edffe240c36f4ab8a16613814e226b6d20d98010ab1ace49fa76dce337a5a5f1dcff9e5d533b12475e33b971b15b69cd591cd9059759f0f04ba5468a34b98915033debb3e87f048e8601712659d47d8687eb6be5e650068d88000000000000") preadv(r1, &(0x7f0000000480), 0x10000000000002a1, 0x0) msgget$private(0x0, 0x22) [ 494.030231] binder: 25738:25739 ioctl 40046207 0 returned -16 [ 494.052037] binder: BINDER_SET_CONTEXT_MGR already set [ 494.058105] binder: 25740:25741 ioctl 40046207 0 returned -16 12:34:31 executing program 1: r0 = socket$inet6(0xa, 0xfffffffffffffffe, 0xffffffffffffffff) sendto$inet6(r0, &(0x7f0000000840)="fa01a4df93a4b29bd73d14978c0fb094aef704e0f5c0859ddea09faa1a5dc4dcf706c11ecf01d3abdc1f31c9304643da618153efddedc972239a0d82a09958309cab1c9993da644e8f76fba4965cdb804dabe4082bf96ddbd426932fcc36ebb8027fa7c85750af4711a448aa589ac10cb9a35c3b6d6b8342e7744580caf8dda015f547a01b92052346f40ea6bdbe937d66608635a3fc78711956e8c59613f8083799380a9644cf5fdf2359745f4df4b0da7c62704f272cbe0513291c68e854cd66e693909e6428986c24ba0bee9dc988b080fa5ad122e952b26ceab2f42843f94e71fdeabe71705137dba38e6ff4012bf1d5a9af2027580fedf7995ed6d4bead8ecc1ebcac3149301caf90b4358b8d5c8e29b9a44662b2b59d04d98e60b1ed22e13f1ded27ec4556e38820c86ec4ad0577d7d391e3d7c1d6d4d8aef7bf59bba78508f7f4f3dce6ec41dcf02157ddffe542982510cb961a339766949529575e81d6a8a2686aa2e4650a8267ee276fc85252a51560870f16a0be72f6a90c104e3dd4bb60c35d984868ca833f086e7761a86c85272e583407fef58b521cc2ff6c52ddfa3b73b476ecf34bfa3447aad0c8bad7fe99d9a1546bdb48c49feee8e721dd3e0f7977ec26e281f5b31172a72c53ceafbf7dd3f3b87efedcfce910e97ff649c37714095e018980589e950fe410617e200e099c09fb1ebbb60d48486b4c7a13395b8e1abe48cdb7736a02242b6261e0bb1e33ed848fcc5a4b11de5dbcf1f1fe243e7703da898d8fac144ec99e915408a8a0d05378058865526cc627932e29c810b35327c947c834e9c47df5185fabf5b74d2bd3962ed865a869a3f295ed22f9e6e677b8b47e32f171acfe20a4daec0d79da889729ef40c306aa2c824bec4bbf5814c4e5625bbaf2bff03b27f050ebb0be28aa3eb0270b6b03d805e0a2c7a8fe54891ebb09bd829675f130e9799d7fb9fec102666c2151c119de29017e9689cb3a7fc7f129509c7c80906ef889aaf4db809b4be6e26f68caf63b33dc6b84cc68c3f7609866f8dbc5f3eba2a6cf7dfc5daa49adb806d672a3d740642b22dc1998185818a0e1d85afddf1081a89560fc548f9cccde42eb07d2cb9d866a0d7f30c8c64eafd151ac28387f051cccfb8679a17e1f984825c4dc3ffb96c742f1e18ba279a58b8fc5e956c041f5fb351b955a1b9db962744f2157b62c822253c9d60d39c1d50ad804e05ff514381dd97d224ab022a08bbd1b6733d0f64a3a5ed192fccd4c96c8b0836f46234c26729b46f8f1c3962ba5a7bc23328fca6ee8fb81acf871b8b61c9e1a97134c47f4f95cbea1acea967999ea5123f01afd09865940d71f5561a02a6d0851865c4381cd507046e8dc7150df4e003ff15bef76397b08d7e7c996e15ea87f2ad8334d3644a253cc2d39edea25b8cd6df7d151450865a53bcfd958e5bd612ef3c9bd9d0b870ffceb97f097b131baf54cb4a2c17ffe6a8fb73d3b640913b804246cfd86dc0f2d96604ee0874422a28ad0aa05346816064bf2d03d189228f64aae4434de91a6ac535260abb18342948be3a50ccd8a3d678196a894772bd421bd1cd9ca202ea64eb62ab7c858f5c28e67d03aab06f296d9cb6e206eee9aa36547a9f6dfe44414d9f0269aa56d1de941b50cd49990124d06ca70c00276ea536fef85581b544763005b2ca1afbee489b3cdf3fdbcb5ebe68f4ae09b93d10d324e68831461c7fb2a2b332de49830ea37535d49148c067003183dbc0641f0353541a9bb32b04b2a9d2accf487a6f140200fd08a96db0b5316e669fccb81c30ca52f754f046cc3812f820325f4ce9b5a4c2a8380b4e39cc60c05a586b7d2705ea35b0b91c83432307787148392bdd6afeff6276cef6338b9b87ab263c911d7e8dc899a66969ef0d70fe584484f7a87c64b2fcdbd511c7542bdc9896ceb7804ca24236ce5e1841d4f32d3c77eeb3830430a170cc4eea567a798b3cee7f27e1607c7143b9008b9b123bf916045109e8e87e3c82923e9f276ac8705bb7bc8144a", 0x5a1, 0x3c99830876959646, &(0x7f0000000000)={0xa, 0x4e21, 0x0, @mcast1}, 0x1c) sendto$inet6(r0, &(0x7f0000000040)="95", 0x1, 0x8000, 0x0, 0x0) msgget(0x2, 0x10) sendto$inet6(r0, &(0x7f00000002c0)="36e46d62111e0ee9780def", 0xb, 0x0, &(0x7f0000000080)={0xa, 0x0, 0x0, @local}, 0x1c) [ 494.088854] binder: 25740:25741 ioctl c0306201 20000000 returned -11 12:34:31 executing program 4: socket$inet6(0xa, 0x0, 0x80000000) sched_setaffinity(0x0, 0x7, &(0x7f00000000c0)=0x9) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0) fcntl$setflags(0xffffffffffffffff, 0x2, 0x1) r0 = socket$inet6(0xa, 0x400000000001, 0x0) r1 = dup(r0) setsockopt$inet6_tcp_int(r1, 0x6, 0x12, &(0x7f0000000000)=0x7f, 0x4) bind$inet6(r0, &(0x7f0000000040)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) getsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER_VALUE(r0, 0x84, 0x7c, &(0x7f00000001c0)={0x0, 0x0, 0x6}, &(0x7f0000000240)=0x8) sendto$inet6(r0, &(0x7f00000004c0), 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x4) socket$inet6(0xa, 0x1000000000002, 0x0) r2 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046208, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000200)={0x4, 0x0, &(0x7f0000000100)=[@enter_looper], 0x1, 0x0, &(0x7f0000000180)='T'}) r3 = gettid() timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, &(0x7f0000040000)) tkill(r3, 0x1004000000016) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0xfffffffffffffced, 0x0, &(0x7f0000000040)}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x400c630f}], 0x0, 0x0, &(0x7f0000000f4d)}) 12:34:31 executing program 2: perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f0000000180)=""/148, 0x13d}], 0x1, 0x0) r0 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000000)='stack\x00') ioctl$DRM_IOCTL_AUTH_MAGIC(r0, 0x40046411, &(0x7f0000000040)) r1 = syz_open_procfs(0x0, &(0x7f0000000340)="696f001b66408225aaa3af068fffebb8a490c47dda6586f1b58895b94a78037dd3714e7198820a7a709e2d30d25e6d846cd5c62a648a598668a8263b752b0b622b115112b5ad8e0425c0b784bbdb89eb8f4da0dd73dd01fe35694c2f78600badf8a0e237dba40713bac9e053b41a9f62be5fbb928018aab5f7500bef51a2fd74d4fffb4a20a946733820bdc1b485afa417cdbcfdfbc54f58c9c3edffe240c36f4ab8a16613814e226b6d20d98010ab1ace49fa76dce337a5a5f1dcff9e5d533b12475e33b971b15b69cd591cd9059759f0f04ba5468a34b98915033debb3e87f048e8601712659d47d8687eb6be5e650068d88000000000000") preadv(r1, &(0x7f0000000480), 0x10000000000002a1, 0x0) msgget$private(0x0, 0x22) 12:34:31 executing program 1: r0 = openat$full(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/full\x00', 0x2000000000207fff, 0x0) ioctl$SNDRV_TIMER_IOCTL_STATUS(r0, 0x80605414, &(0x7f0000000540)=""/220) r1 = socket$inet6(0xa, 0x1, 0x0) setsockopt$sock_int(r1, 0x1, 0x7, &(0x7f0000000300)=0xc8, 0x4) sched_setattr(0x0, &(0x7f0000000040)={0x0, 0x1, 0x0, 0x0, 0x8}, 0x0) sched_yield() perf_event_open(&(0x7f00000004c0)={0x2, 0x70, 0x72, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000100)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = syz_open_dev$loop(&(0x7f0000000200)='/dev/loop#\x00', 0x0, 0x0) ioctl$BLKTRACESTOP(r2, 0x1275, 0x0) r3 = dup(r1) stat(&(0x7f00000002c0)='./file0\x00', &(0x7f0000000100)) ioctl$sock_ifreq(r1, 0x0, &(0x7f0000000200)={'gretap0\x00', @ifru_mtu}) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) getpid() getpid() fcntl$getownex(r1, 0x10, &(0x7f0000000400)) sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000340), 0x0) bind$inet6(r1, &(0x7f0000000180)={0xa, 0x4e20}, 0x1c) ioctl$RNDADDENTROPY(r1, 0x40085203, &(0x7f0000000280)={0x4, 0x37, "8c10aec59c2da628f1f38e04dbf4bff73bef14b661e7b357da8a895712050d7cb0dc51a6ccbdfd0324f509dea819ecbb2afa4960f7ebf9"}) ioctl$ASHMEM_GET_PROT_MASK(0xffffffffffffffff, 0x7706, &(0x7f0000000240)) ioctl$TUNSETVNETHDRSZ(r3, 0x400454d8, &(0x7f00000000c0)=0x8001) sendto$inet6(r3, &(0x7f00000007c0), 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) fcntl$getown(r2, 0x9) r4 = open(&(0x7f00000008c0)='./file0\x00', 0x20141042, 0x0) ftruncate(r4, 0x80080) sendfile(r3, r4, &(0x7f0000d83ff8), 0x2008000fffffffe) 12:34:31 executing program 5: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000040)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000000400)={{'fd', 0x3d, r0}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}}) read$FUSE(r0, &(0x7f0000001000), 0x41e) write$FUSE_INIT(r0, &(0x7f0000000340)={0x50, 0x0, 0x1}, 0x50) r1 = open(&(0x7f0000000180)='./file0/file1\x00', 0x0, 0x0) read$FUSE(r0, &(0x7f0000001000), 0x1000) stat(&(0x7f00000001c0)='./file0/file1\x00', &(0x7f0000000480)) write$FUSE_ENTRY(r0, &(0x7f0000002000)={0x90, 0x0, 0x2}, 0x90) read$FUSE(r0, &(0x7f0000001000), 0x1000) write$FUSE_ENTRY(r0, &(0x7f0000000240)={0x90, 0x0, 0x3}, 0x90) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) close(r1) [ 494.414009] binder: 25710:25718 ioctl 10 0 returned -22 [ 494.429984] binder: 25710:25762 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 12:34:32 executing program 2: perf_event_open(&(0x7f0000000200)={0x2, 0xfffffffffffffed0, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, @perf_bp={&(0x7f0000000000), 0x4}, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x0, 0x0, 0xffffffffffffffff, 0x0) preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f0000000180)=""/148, 0x13d}], 0x1, 0x0) r0 = syz_open_dev$vcsn(&(0x7f0000000040)='/dev/vcs#\x00', 0x800, 0x80001) write$tun(r0, &(0x7f00000013c0)={@val={0x0, 0x2f9}, @void, @x25={0x6c74a8840c5e845c, 0x7ff, 0xff, "7ebc527d5a75189c6ab756ed8b63770bdcc420f6e518a41916b50322723cc00973e9f1897cbfd2d31fe6c91a07446389d8b895be00c8671c8570665f2610c2de64da5fedb0089d8877bd5f284ee0269ea269cf452fae086a66e4b4802371fd246f17903a2fb3d9494669664764dd76a7899f44c51e25f86f5c136989ad27914bc31c163eb4b22ff5b9861cdb82f27632513c69697204f93087c509c04482413165ea79e1357b025a91e824b7541d76029ee26d9fc960130333002462d21be341d759c15d43968793a4b0f07cd8c487fe8f7c9b78fb58b82bbb4138f0d16e01ac565a79c5c539197d2019c81d4b8e5c52467cbc4ee5b1a35315d9f9eb90d3ea3db6125523b9705caba6a020311f90a7915f528dcb7b6df3ad6cf45f5b52c895425187effc78ffd755bea60fde4812d14ae65ca43c7173664fd53add27b61f7d8ebc6c2e7922a9e8163c49ae59df6117f25813c2ae21156f6a6e55b09f129e9b757a2240c5fee67136b8afc9b316766cdd743fa3d461768a7480c15872c05037b5830e52276fcf36f7e9a04f650a360917aca15d8b13d30308c0df1814526ec0b0b05b1ffca4661b6c1b5633b6fb34ffbee287e45cd49067aa3aebaeb26e47c4127c33e2f3961ed5102a8b10ebbc52d9573b99b7895a4f803b548ad51dc03665f9153c3769f6c425a5332b7674db5d8d55786cb3454ab5863f3433e93130249a672299378abfbb9988fe64258ab2fab7ca651935dc3403c6a19f4d5aec51ae38fe19269dd2b85af035088a87bd5dac72131f28d98f2b3e7da546a3bffdc3ece0efb8b378da8f53ee52096948f163c4a39c91008f0b6e788985ae3b72d20c94b196afab911c2439b2da21c5423b028aaa77399a1825dda20088ecbcd13cf0d680e0c766c82093334aaa5a49db60b724da0f6d19cd52efd7ebbc674f007576cc146df10c8f0e94b05c7bc6200866f5780c621a80a14eaaacd18151cfd75727f9586ed672c1130faddaad14a133138fe5ef4db1c1f800188f8e32249414bd124e9e9c7351d86c3b8a443ac2716658103768b7367fa5aa6ef0f5ad6a3cecbaf71d8ef33ff24ee8c04c10182758ea3d4ea627384a8f3800ead3becc8823c6f7a6953b8f2427777972bb966b5290c933b1d8adc87bb49e992a7186ac76407b582c5f59c96e98ed9fc944bb9dbf0fc10b8c203e266c74025d8c32a7042b0254d9c54e015aafe724497bca242f26ce6d9263b32511e93d760d8a17e61ece8121950398ccfbff29979025b4f8bf2efc9a194ec121673c6ba23a94f98320e43870927f35b2977c9c92effcd7ee270516a9e0d78ebf6d81b4bbb023031bcbd076bf1a0590ee87845b45a0351ce28a311a83edce94d7cdae7a47228a9a225a6f6c13f464c69a725c04e868cf4f8677d374fa1ef41b654a3ed0ddeb403f920519da86b9c6d0e81813557b4910895c10039ef3e8eff6db707a234e227927f74b04d60b598513b8a36c2c83cf1fc0e4e957990e83497fec7728dcb0d2c8f2f7ebf628ad8a6916d2c304b21e945d5016b9d7edb556b6bab4d13522dd38555084f0d0a840f130268760c0a3fec21925baa568508c07d37d196773e4c3584d426cc47d80bbbe409cb13e37870f2f687b4defa8553f7e4176aceb23d9b9c3cfa25a3e63eef95e062fb1d91bb446318e824b8c892d29d45622d243970ca70068855d9d6378e8b57488246f1912d0dfead5dd3d9013b2c2a4af0828229d81224336a5cf46025673c44e749e33779ada56d4447ca44acccb183ed6078c2a57d73fbb0bedc7d4e970eb08895757cede719c9cba592522417c31d3330299b4a426f6e10aaee0dbf61be14765b2e33c375dd053d50bec37e99a3e74606a64642d9b5eadf3097d6c5620d1e71c60c90048ec5c0c2db95d5c80bdc1d1cd0942aa5c8c8453fd81f6c4a8ac7344adf4c4840b9e856569ac49bbe68f97575fd1f0f8a4e995d8f243c92f47329c0f0c3e8feb5d3513e4aebe5446b46c97ee642cf3d6203aa0ee27c42f24ae6cde9b401a83117883088a3f1a4d24f9857f45561d4e1e12d2643586778edd07ef22587c812abb5622cb8db5836cd00a4b689a9a0eac8f205af6d1f3acbfb1a8b65a70aa0851b92ea6d73bf5d3cbe11ca535e6b6b109d6b12ed4daf429b414dc4b01cad553a31f1953af2ee3110370b4c0feaa760a0b127e0175b8678bd0e43c460c205ab85ddf55da43d96b3bc863c9c4afb814142c2b5fc1f8f2ae4477002b4d61d9e7bd6e4cccfcebe425c77d778a4a3b37325a30a6ec882bef124794e415478ea9eae05ebef46d15e1640120e9ac97a34fb5281812a684c67cb16d8254146ba250facbfe73c7c4aa7ac14addd7b291b28987351a3fbe26280acfa4e601d11d8369b169df116a7e8bb7a8ffb1e57a6426936d763c6149ced38c7b10c28e1529ac07a616c14ce02cf71fdbefc81be4da6c3bbff066ee14a36538513204288e4be71ad9d195bcbf88d544c09c02fe30ea2d065ccee10b7dfd48327958c1c44023d5e7bfd2664f0740b120667d57dee8336dd30e6c604b2082d90dcb4689ec262949231a8f1ddbf168d753f6f89e82a6e1f515487c55de019810e8a8b23e1fd78e132456488bc705b6953c6f528f44cb438b38e073e7c6240cb7f6d2ec9b66e77653c48e89280e188924e6493769d660471ac1ac849503e4ea4e209044dc16048dde080299644f7077d89b889da46cef53e003ba5e302b0f26729e833eb633f78479cfea5035622c1b3255c42d0167be93ef5173f4143b9defd189389ec35991eea9d48731fa47ffce333c38c4cba91dad800cd9960f66367504ea63a41e0f4e81ea79794edcc323278813f6a579b99525394c47cca7b6f76076fc08efc0b06a0f856d21dfdf5a8e8588884cc77dbb4abf682b040df079226c753897f55b5ece0b8bea543928b66deb0f8e91381693388fc4e331c71f3d36e839caffb5aa47390152a01d9a368384d9d306bc73935bc50d74cad5601e3df6da908a6624666b8fcc0e618b84920119d43b9a07d65d5027e521cacf999ba7108d418c72191ca61c6d6875790963eadd27c3ba5c59a8a5dab446f31c2ec5c310686a86e0ff9dd0b9502cc7c029abfd28fa0a976600b6417e33bbab291af622ea580a449c591117ae4c3dda31d1b208a8b3d1358a59886ff0343e5ffca043a1ccc54be4a9bb18e015c0fd7ad8d70ad72ae1efc534407bd0a1010b71ae948e9aea4c3258b7dda64ad6188feab626dd123482171ffcbad43b1591a2f2e35e412928611203990f5592e4f6c60e42c65ad0a51a8b50275f1140393b474bdabb273c5ad32460c09560a5df20a99db5c783dec50b2cfa6701b3da316608ae6fffa5b381cd0b4d5f7e38d37e9bf4339c3cb0267da8faf708bd034f9ffda01dceebcfb283f2e107e190c2837970093b5aec748d10e7e03784119cc2871282b0f2cfe86583ee0f6b6c9a798033eed89d3ca8f6ca79a6a5dad86f43681445890d3aa8efcf0ae0f1dc8401679db7d2f8493552280eab0f3f537c062f715fc90ee95ec7d596f2f7d3617a676f8dfdcf3d40f961efb318a461d3824e270733f5c3b8d908031afd9c807304eb7373551ad0f5c1e4f6bbb51ca2f685b94565ddc66902deca627b02060b50bebf13662abf652a23dda540f85c9e4bc764b8724065039fa5512c9146a904eef5456f60c223b4c19ab67f4b64e2e61b05394ff5cb186cf1695d7e7a3e3c0835e928b21eeab6d4298e4e59333809565814dc398392e7c6f9418cb5d392f3e092ec641bd25b2ae7f556f6a23d9e9281723ff724fa123d543a02792aab754ab2e0ed2e58d5c3d9b2a04a28536d3e56f5cbdf00f63e8ea7b8aefe5be6eda50a300bff3fdbd33522a61591cda909a4457bf8b2e1528f83d89dc7e2d1fa399ced9cb16d98ac4bdec73f88f3c1b2b3beb5b230bb230d4a4143c35a6fbe24001c832b41d31f1ee0585fbd84e285052b140734e673ba2cf2a610c6fa10b806e113c0613e5097d0f3b11aa09bd491d20a2fd43c95a9462e049b691f62ca677e720644414706df45ce323de0db77af285773366e392e70161161ce94635528516997963a9ef8ac84250d5a0323174770b3fd565b04efbe64c8af8ca9b787cf7881954a0cef676a6f1e7959f509c09b5d5aed1e4407f2fea5540da375c2b07e33fd10c2f341089f9d031bbcdb09028658efb6a2441ae1a109893ccc88219fefdbd43a4aa4544a17d375da82db54eaae816495a00138c8028f7ad1d53f740161802dfc854c5c897565cb008c14f7b4575e0b207c2520c2095a335e61783157db2635a2cd211fca34a340381ae1ff0366899ea6c15d03b117883226e16cf72dd254100b05e4b9e8db58e4c59f5afc4d39c6b2f15314dd447f082fbdc004fe62a927c5020236b7fd19d42bd4d9aa18c3ba1a97166817c3962de778c3f6f6b9e37ac926f4f3a97324a2e36b2b32c456474ce40686398dc0573d1162ec775de2ee79c372b908a719c403258e8715b7cc952d1071de3396d3531fdcaf837cf99a5aec2da304f20c394d625e6777c2640f792fca97dff7ddf97b5794681c88ad44668100972cbfd72e4294bff44011f51670f92314dd90a2b930839a665ca07c1ce1a08114577532ed9de3d5eba5b9ca966ba39f1ec07df88c54ae70770954c71771de02d455d35c124f1bdf1e0d1101c259ab48648c9799001fc17331e8f1c9df5ae9532ea8d7cd5d438ceabd55cdf6fec5d6dbf85586fe979b3a6adcbd62673ccd477263a08d048176f1cbe7f7fc48f7c0155de57bb432f1da0a64166f97331ad7e8ba371a42aaebe2b40e3fd8817ad83fe9a5de2d29da1d2d50958a7cf22cd50e4e2df7c7e778dd572831c37d8d123273c184f247f69e5060f208c0f8a6788233149f16b51f7b9cb399ee0fec6358704a8344a0da732b3ba96373bf360c26b938ca98622e1a95d6a5007da2c31fabc58cd634feee88c4c7eda75c6f80e9c97de6e97bb85fea8009239fa114bf51aa3cb83ffa6f329b7d24eb4238e38e1a7b7b159ea0b0e1b3bf012bf1b28b34e45eca9dc9ceb9769aed3eb359a41cea9633a1b2358083af31ebe318f3364db4c445b38ddc4de8cea9109560d306bb939442f7604504d87ea2e3870d00066b69d15a1b942c5293dfc6aec78ad12529496f2da0d2e64affb39dd4fd257d4a9c3050963780608761f978465b026be735204478a7ab93f9b1e412e2c2f986355a2ad6ee790ed5011f4bdbc5bd5d6057ee83818b75dc9a8687f57dad9b6a341edc99a2bf3c3c4eabb67fcde311c99a11b205e31d3bea14a9399483e64fdd8dcf9ef1fb626d051cd11e9bbcdbec13b7626a192001993f4f49ee0695a288ca1236e48538b55eaaf65a59ebf5bdd429004e2491b8ec0429e5e3fe613ed4ca864aa9b0a5f22af5aadf3680a7bead3b59c059ce13e129c54b9e61fb794ec830d3734de42de0aca49ad64a5e1451ea1b67b35992ee30e027530ff0a55e0197ad7935beac745e2bad9bff63c455772e37367d7810bf30e8cbfa9701a8663cd9fee26af0323a4a32874b1b4bd7964d9ef3be98af338ef92ff120d48f2f39c6d589e7ec293c0217433e7e878c4f38e2aa7dfd6362f2bd9113bbc18038a1ac505c3bae28484febcb794b8a3980023c276e87a5ce4b8e73cdbc9724f785c6f829b8c5c6d8d9e93380bb5c2590f2d7626ea114a072184c901ed071bc3314980614993214457ae0f72c52745ac44190e4a4e5037bd2d32e8bfdbae9724a0d10786792716d170f3b88e92936886e"}}, 0x1007) r1 = syz_open_procfs(0x0, &(0x7f0000000340)="696f001b66408225aaa3af068fffebb8a490c47dda6586f1b58895b94a78037dd3714e7198820a7a709e2d30d25e6d846cd5c62a648a598668a8263b752b0b622b115112b5ad8e0425c0b784bbdb89eb8f4da0dd73dd01fe35694c2f78600badf8a0e237dba40713bac9e053b41a9f62be5fbb928018aab5f7500bef51a2fd74d4fffb4a20a946733820bdc1b485afa417cdbcfdfbc54f58c9c3edffe240c36f4ab8a16613814e226b6d20d98010ab1ace49fa76dce337a5a5f1dcff9e5d533b12475e33b971b15b69cd591cd9059759f0f04ba5468a34b98915033debb3e87f048e8601712659d47d8687eb6be5e650068d88000000000000") setsockopt$inet6_tcp_TCP_ULP(r0, 0x6, 0x1f, &(0x7f0000000080)='tls\x00', 0x4) preadv(r1, &(0x7f0000000040), 0x0, 0x0) msgget$private(0x0, 0x22) 12:34:32 executing program 2: perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f0000000180)=""/148, 0x13d}], 0x1, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000340)="696f001b66408225aaa3af068fffebb8a490c47dda6586f1b58895b94a78037dd3714e7198820a7a709e2d30d25e6d846cd5c62a648a598668a8263b752b0b622b115112b5ad8e0425c0b784bbdb89eb8f4da0dd73dd01fe35694c2f78600badf8a0e237dba40713bac9e053b41a9f62be5fbb928018aab5f7500bef51a2fd74d4fffb4a20a946733820bdc1b485afa417cdbcfdfbc54f58c9c3edffe240c36f4ab8a16613814e226b6d20d98010ab1ace49fa76dce337a5a5f1dcff9e5d533b12475e33b971b15b69cd591cd9059759f0f04ba5468a34b98915033debb3e87f048e8601712659d47d8687eb6be5e650068d88000000000000") write$P9_RVERSION(r0, &(0x7f0000000000)={0x15, 0x65, 0xffff, 0x8, 0x8, '9P2000.L'}, 0x15) preadv(r0, &(0x7f0000000480), 0x10000000000002a1, 0x0) msgget$private(0x0, 0x22) write$P9_RRENAMEAT(r0, &(0x7f0000000040)={0x1a7, 0x4b, 0x2}, 0x7) 12:34:32 executing program 1: r0 = socket$inet6(0xa, 0x80003, 0x800000000000006) ioctl(r0, 0x8912, &(0x7f0000000040)="153f6234488dd25d766070") r1 = socket$inet(0x10, 0x3, 0xc) sendmsg(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000000)="24000000010207041dfffd946fa2830020200a0009000100001d85680c1baba20400ff7e28000000110affffba010000000009b356da5a80d18be34c8546c8243929db2406b20cd37ed01cc0", 0x4c}], 0x1}, 0x0) ioctl$sock_SIOCGPGRP(r1, 0x8904, &(0x7f0000000080)=0x0) ptrace$getregs(0xffffffffffffffff, r2, 0x9, &(0x7f00000000c0)=""/38) [ 494.757560] binder: BINDER_SET_CONTEXT_MGR already set [ 494.764831] binder: 25734:25785 ioctl 40046207 0 returned -16 12:34:32 executing program 3: syz_open_dev$sndctrl(&(0x7f0000000140)='/dev/snd/controlC#\x00', 0x0, 0x0) sched_setaffinity(0x0, 0x7, &(0x7f00000000c0)=0x9) r0 = perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0) fcntl$setflags(r0, 0x2, 0x1) getsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER_VALUE(0xffffffffffffffff, 0x84, 0x7c, &(0x7f00000001c0), &(0x7f0000000240)=0x8) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(0xffffffffffffffff, 0x84, 0x9, &(0x7f0000000280)={0x0, @in={{0x2, 0x4e23, @remote}}, 0xfffffffffffffff7, 0x0, 0x400}, 0x98) sendto$inet6(0xffffffffffffffff, &(0x7f00000004c0), 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) setsockopt$SO_BINDTODEVICE(0xffffffffffffffff, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x4) socket$inet6(0xa, 0x1000000000002, 0x0) r1 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc018620b, &(0x7f0000000200)={0x4, 0x0, &(0x7f0000000100)=[@enter_looper], 0x1, 0x0, &(0x7f0000000180)='T'}) r2 = gettid() timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, &(0x7f0000040000)) tkill(r2, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0xfffffffffffffced, 0x0, &(0x7f0000000040)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x400c630f}], 0x0, 0x0, &(0x7f0000000f4d)}) 12:34:32 executing program 0: socketpair$unix(0x1, 0x3, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000040), 0xffffffffffffffff) r2 = getpid() sched_setscheduler(r2, 0x5, &(0x7f0000000200)) socketpair$inet_sctp(0x2, 0x1, 0x84, &(0x7f0000001c80)={0xffffffffffffffff, 0xffffffffffffffff}) getsockopt$inet_sctp6_SCTP_ASSOCINFO(0xffffffffffffffff, 0x84, 0x1, &(0x7f0000000180)={0x0, 0x4, 0x2, 0x0, 0x4, 0x8}, &(0x7f00000001c0)=0x14) getsockopt$inet_sctp6_SCTP_PEER_AUTH_CHUNKS(0xffffffffffffff9c, 0x84, 0x1a, &(0x7f0000001cc0)={r4, 0xa9, "c4fed77c8267da826889784437a8cba722c24063c5155864ff1be9436c0c5ebd92b10dbfe68eba15f5465d35915f77cf0761b1e615d087c4d9120f081f7c524f927679a72ac18b309f6c9ba656ba64399b4fc8d8c1d537329ee9e6e03148af4b65580090cc4462ff82f1aadf444973486706624c980cd997108dde4ff957679232e2a87e8d9df10592499639c8f812aadc6d3d57a39651dbd96c21a71a4f9a47aa473d59f85e3b66b3"}, &(0x7f0000001d80)=0xb1) getsockopt$inet_sctp_SCTP_DEFAULT_SNDINFO(r3, 0x84, 0x22, &(0x7f0000001dc0)={0x3f, 0x2, 0x200, 0x0, r5}, &(0x7f0000001e00)=0x10) listen(r1, 0x0) r6 = syz_open_dev$dmmidi(&(0x7f0000000280)='/dev/dmmidi#\x00', 0x4, 0x0) kcmp$KCMP_EPOLL_TFD(r2, r2, 0x7, r0, &(0x7f0000000140)={r6, r0}) r7 = dup2(0xffffffffffffffff, 0xffffffffffffffff) getsockopt$inet_int(r7, 0x0, 0x5, &(0x7f0000000000), &(0x7f0000000080)=0x4) 12:34:32 executing program 4: socket$inet6(0xa, 0x0, 0x80000000) sched_setaffinity(0x0, 0x7, &(0x7f00000000c0)=0x9) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0) fcntl$setflags(0xffffffffffffffff, 0x2, 0x1) r0 = socket$inet6(0xa, 0x400000000001, 0x0) r1 = dup(r0) setsockopt$inet6_tcp_int(r1, 0x6, 0x12, &(0x7f0000000000)=0x7f, 0x4) bind$inet6(r0, &(0x7f0000000040)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) getsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER_VALUE(r0, 0x84, 0x7c, &(0x7f00000001c0)={0x0, 0x0, 0x6}, &(0x7f0000000240)=0x8) sendto$inet6(r0, &(0x7f00000004c0), 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x4) socket$inet6(0xa, 0x1000000000002, 0x0) r2 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0xc0045878, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000200)={0x4, 0x0, &(0x7f0000000100)=[@enter_looper], 0x1, 0x0, &(0x7f0000000180)='T'}) r3 = gettid() timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, &(0x7f0000040000)) tkill(r3, 0x1004000000016) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0xfffffffffffffced, 0x0, &(0x7f0000000040)}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x400c630f}], 0x0, 0x0, &(0x7f0000000f4d)}) 12:34:32 executing program 1: r0 = syz_init_net_socket$nfc_llcp(0x27, 0x100000000000003, 0x1) bind$nfc_llcp(r0, &(0x7f0000000100)={0x27, 0x0, 0x0, 0x0, 0x0, 0x0, "8811e78754a539d39c2bd6a40fa8c8aa024d86cdc834bc921c0525fec2541e21ccf67e1d7b55cabe9e068dd58ce565aa9a9d325ebac7627ffe7a54cdbd77b3"}, 0x60) bind$nfc_llcp(r0, &(0x7f0000000080)={0x27, 0x0, 0x0, 0x0, 0xfffffffffffffffc, 0x4, "a199eb8c66a3bd611d14d47ee98fcc4897bc02f7cd385b1f076c397f4b549d8b49f947fc10401b8857f9d5797d854dee85e8b3e8aadf8916aa5c9b8313ebcc"}, 0x60) ioctl$sock_SIOCGIFCONF(r0, 0x8910, &(0x7f0000000040)=@req={0x28, &(0x7f0000000000)={'team_slave_0\x00', @ifru_addrs=@sco={0x1f, {0x1, 0x0, 0x9, 0x80000001, 0xd35, 0x81}}}}) 12:34:32 executing program 0: syz_open_dev$sndctrl(&(0x7f0000000140)='/dev/snd/controlC#\x00', 0x0, 0x0) sched_setaffinity(0x0, 0x7, &(0x7f00000000c0)=0x9) r0 = perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0) fcntl$setflags(r0, 0x2, 0x1) getsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER_VALUE(0xffffffffffffffff, 0x84, 0x7c, &(0x7f00000001c0), &(0x7f0000000240)=0x8) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(0xffffffffffffffff, 0x84, 0x9, &(0x7f0000000280)={0x0, @in={{0x2, 0x4e23, @remote}}, 0xfffffffffffffff7, 0x0, 0x400}, 0x98) sendto$inet6(0xffffffffffffffff, &(0x7f00000004c0), 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) setsockopt$SO_BINDTODEVICE(0xffffffffffffffff, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x4) socket$inet6(0xa, 0x1000000000002, 0x0) r1 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0x5452, &(0x7f0000000200)={0x4, 0x0, &(0x7f0000000100)=[@enter_looper], 0x1, 0x0, &(0x7f0000000180)='T'}) r2 = gettid() timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, &(0x7f0000040000)) tkill(r2, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0xfffffffffffffced, 0x0, &(0x7f0000000040)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x400c630f}], 0x0, 0x0, &(0x7f0000000f4d)}) 12:34:32 executing program 1: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount(&(0x7f0000000140), &(0x7f0000000240)='./file0\x00', &(0x7f00000000c0)='configfs\x00', 0x0, &(0x7f00000002c0)) r0 = open$dir(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) socketpair(0x2, 0x6d256e5fac2d118d, 0x57, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$SNDRV_CTL_IOCTL_ELEM_REMOVE(r1, 0xc0405519, &(0x7f0000000140)={0x9, 0x6, 0x5, 0x9, 'syz1\x00', 0x2}) open(&(0x7f0000000100)='./file0\x00', 0x0, 0x0) lseek(r0, 0x10000000000, 0x0) 12:34:32 executing program 2: r0 = perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) preadv(r0, &(0x7f0000001380), 0x1, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000340)="696f001b66408225aaa3af068fffebb8a490c47dda6586f1b58895b94a78037dd3714e7198820a7a709e2d30d25e6d846cd5c62a648a598668a8263b752b0b622b115112b5ad8e0425c0b784bbdb89eb8f4da0dd73dd01fe35694c2f78600badf8a0e237dba40713bac9e053b41a9f62be5fbb928018aab5f7500bef51a2fd74d4fffb4a20a946733820bdc1b485afa417cdbcfdfbc54f58c9c3edffe240c36f4ab8a16613814e226b6d20d98010ab1ace49fa76dce337a5a5f1dcff9e5d533b12475e33b971b15b69cd591cd9059759f0f04ba5468a34b98915033debb3e87f048e8601712659d47d8687eb6be5e650068d88000000000000") preadv(r1, &(0x7f0000000480), 0x10000000000002a1, 0x0) modify_ldt$write2(0x11, &(0x7f0000000000)={0x4, 0x20001000, 0xffffffffffffffff, 0x6, 0x80000001, 0x100000000, 0x7, 0x3, 0x0, 0x100000001}, 0x10) msgget$private(0x0, 0x9) fcntl$dupfd(r1, 0x406, r0) fcntl$setlease(r1, 0x400, 0x2) [ 495.027719] binder: BINDER_SET_CONTEXT_MGR already set 12:34:32 executing program 1: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) ioctl$EXT4_IOC_PRECACHE_EXTENTS(r0, 0x6612) syz_read_part_table(0x0, 0x1, &(0x7f0000000000)=[{&(0x7f0000000040)="0200a5ffffff01000000ff070000ffffffffffffffff", 0x16, 0x1c0}]) r1 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000080)='/dev/snapshot\x00', 0x103100, 0x0) ioctl$BLKSECTGET(r1, 0x1267, &(0x7f00000000c0)) ioctl$NBD_DISCONNECT(r1, 0xab08) [ 495.055091] binder: 25807:25808 ioctl 40046207 0 returned -16 [ 495.223178] Dev loop1: unable to read RDB block 1 [ 495.228112] loop1: AHDI p1 p2 [ 495.231331] loop1: partition table partially beyond EOD, truncated [ 495.238028] loop1: p1 start 4278648832 is beyond EOD, truncated 12:34:32 executing program 5: r0 = syz_open_dev$adsp(&(0x7f0000000040)='/dev/adsp#\x00', 0x8003, 0x1fe) epoll_pwait(0xffffffffffffffff, &(0x7f0000000080), 0x0, 0x8001, &(0x7f00000000c0), 0x8) r1 = socket$inet6_udp(0xa, 0x2, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$sock_inet6_SIOCSIFADDR(r1, 0x89a1, &(0x7f00000000c0)={@local={0xfe, 0x80, [0x0, 0x3ef, 0x0, 0x3f00000000000000, 0x0, 0x0, 0x1103, 0x0, 0x0, 0x0, 0x0, 0x6]}}) connect$l2tp(0xffffffffffffffff, &(0x7f00000002c0)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x4e22, @broadcast}, 0x4, 0x0, 0x2, 0x2}}, 0xffffffffffffffc2) syz_open_dev$dspn(&(0x7f0000000480)='/dev/dsp#\x00', 0x7fff, 0x20400) ioctl$sock_inet6_SIOCADDRT(r1, 0x89a0, &(0x7f0000000100)={@local, @empty, @loopback, 0x3}) getsockopt$inet_pktinfo(r0, 0x0, 0x8, &(0x7f0000000000)={0x0, @dev, @broadcast}, &(0x7f0000000080)=0xc) ioctl$sock_inet6_SIOCDIFADDR(r0, 0x8936, &(0x7f0000000240)={@mcast2, 0x43, r2}) perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10000003, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$KVM_ENABLE_CAP_CPU(r0, 0x4068aea3, &(0x7f0000000500)={0x0, 0x0, [0x2, 0xfffffffffffffffd, 0x5208, 0x1]}) r3 = socket$vsock_stream(0x28, 0x1, 0x0) setsockopt$inet6_int(0xffffffffffffffff, 0x29, 0x0, &(0x7f00000001c0), 0x4) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000040)={'bond_slave_0\x00'}) ioctl$sock_inet6_SIOCSIFADDR(0xffffffffffffffff, 0x8916, &(0x7f00000000c0)={@local={0xfe, 0x80, [0x0, 0x3ef]}}) ioctl$EXT4_IOC_RESIZE_FS(r3, 0x40086610, &(0x7f0000000200)=0x8) r4 = syz_open_dev$vcsa(&(0x7f0000000100)='/dev/vcsa#\x00', 0x0, 0x0) r5 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000340)='IPVS\x00') sendmsg$IPVS_CMD_FLUSH(r4, &(0x7f0000000440)={&(0x7f0000000300)={0x10, 0x0, 0x0, 0x8082000}, 0xc, &(0x7f0000000400)={&(0x7f0000000380)={0x48, r5, 0x0, 0x70bd28, 0x25dfdbfd, {}, [@IPVS_CMD_ATTR_DAEMON={0x14, 0x3, [@IPVS_DAEMON_ATTR_MCAST_TTL={0x8, 0x8, 0xffffffffffffffc0}, @IPVS_DAEMON_ATTR_SYNC_MAXLEN={0x8, 0x4, 0x6c7}]}, @IPVS_CMD_ATTR_SERVICE={0xc, 0x1, [@IPVS_SVC_ATTR_NETMASK={0x8, 0x9, 0x1}]}, @IPVS_CMD_ATTR_DAEMON={0x14, 0x3, [@IPVS_DAEMON_ATTR_MCAST_PORT={0x8, 0x7, 0x4e22}, @IPVS_DAEMON_ATTR_MCAST_GROUP={0x8, 0x5, @dev={0xac, 0x14, 0x14, 0x17}}]}]}, 0x48}, 0x1, 0x0, 0x0, 0x4}, 0x80) ioctl$KDGETLED(r4, 0x4b31, &(0x7f0000000280)) 12:34:32 executing program 0: r0 = socket$inet6(0xa, 0x201000000000002, 0x0) clone(0x802102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000040), 0xffffffffffffffff) r1 = getpid() sched_setscheduler(r1, 0x5, &(0x7f0000000200)) recvmmsg(r0, &(0x7f0000000e80)=[{{0x0, 0x0, &(0x7f0000000140)=[{&(0x7f00000000c0)=""/66, 0x42}, {&(0x7f0000000280)=""/220, 0xdc}, {&(0x7f0000000000)=""/21, 0x15}], 0x3, 0x0, 0x0, 0x8001}, 0x9}, {{&(0x7f0000000180)=@hci, 0x80, &(0x7f0000000a80)=[{&(0x7f0000000380)=""/255, 0xff}, {&(0x7f0000000480)=""/194, 0xc2}, {&(0x7f0000000580)=""/153, 0x99}, {&(0x7f0000000640)=""/199, 0xc7}, {&(0x7f0000000740)=""/246, 0xf6}, {&(0x7f0000000840)=""/200, 0xc8}, {&(0x7f0000000940)=""/39, 0x27}, {&(0x7f0000000980)=""/212, 0xd4}], 0x8, &(0x7f0000000b00)=""/118, 0x76, 0xffffffffffffffff}, 0x3f}, {{&(0x7f0000000b80)=@pppol2tpv3in6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @ipv4={[], [], @broadcast}}}}, 0x80, &(0x7f0000000c00), 0x0, &(0x7f0000000c40)=""/43, 0x2b, 0x3}, 0x2}, {{&(0x7f0000000c80)=@generic, 0x80, &(0x7f0000000dc0)=[{&(0x7f0000000d00)=""/153, 0x99}], 0x1, &(0x7f0000000e00)=""/68, 0x44, 0xfffffffffffffffd}, 0xfffffffffffffffd}], 0x4, 0x20, 0x0) accept$alg(r2, 0x0, 0x0) ioctl$sock_SIOCETHTOOL(r0, 0x8946, &(0x7f0000000080)={"73797a5f74756e0000000000ff00", &(0x7f0000000240)=ANY=[@ANYBLOB='(']}) 12:34:32 executing program 4: socket$inet6(0xa, 0x0, 0x80000000) sched_setaffinity(0x0, 0x7, &(0x7f00000000c0)=0x9) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0) fcntl$setflags(0xffffffffffffffff, 0x2, 0x1) r0 = socket$inet6(0xa, 0x400000000001, 0x0) r1 = dup(r0) setsockopt$inet6_tcp_int(r1, 0x6, 0x12, &(0x7f0000000000)=0x7f, 0x4) bind$inet6(r0, &(0x7f0000000040)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) getsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER_VALUE(r0, 0x84, 0x7c, &(0x7f00000001c0)={0x0, 0x0, 0x6}, &(0x7f0000000240)=0x8) sendto$inet6(r0, &(0x7f00000004c0), 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x4) socket$inet6(0xa, 0x1000000000002, 0x0) r2 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x5421, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000200)={0x4, 0x0, &(0x7f0000000100)=[@enter_looper], 0x1, 0x0, &(0x7f0000000180)='T'}) r3 = gettid() timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, &(0x7f0000040000)) tkill(r3, 0x1004000000016) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0xfffffffffffffced, 0x0, &(0x7f0000000040)}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x400c630f}], 0x0, 0x0, &(0x7f0000000f4d)}) 12:34:32 executing program 2: perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f0000000180)=""/148, 0x13d}], 0x1, 0x0) r0 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vcs\x00', 0x80, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000040)={0xffffffffffffffff}, 0x2, 0xb}}, 0x20) write$RDMA_USER_CM_CMD_BIND(r0, &(0x7f00000000c0)={0x14, 0x88, 0xfa00, {r1, 0x1c, 0x0, @in={0x2, 0x4e21, @multicast2}}}, 0x90) r2 = syz_open_procfs(0x0, &(0x7f0000000340)="696f001b66408225aaa3af068fffebb8a490c47dda6586f1b58895b94a78037dd3714e7198820a7a709e2d30d25e6d846cd5c62a648a598668a8263b752b0b622b115112b5ad8e0425c0b784bbdb89eb8f4da0dd73dd01fe35694c2f78600badf8a0e237dba40713bac9e053b41a9f62be5fbb928018aab5f7500bef51a2fd74d4fffb4a20a946733820bdc1b485afa417cdbcfdfbc54f58c9c3edffe240c36f4ab8a16613814e226b6d20d98010ab1ace49fa76dce337a5a5f1dcff9e5d533b12475e33b971b15b69cd591cd9059759f0f04ba5468a34b98915033debb3e87f048e8601712659d47d8687eb6be5e650068d88000000000000") preadv(r2, &(0x7f0000000480), 0x10000000000002a1, 0x0) msgget$private(0x0, 0x22) [ 495.372248] Dev loop1: unable to read RDB block 1 [ 495.378483] loop1: AHDI p1 p2 [ 495.387975] loop1: partition table partially beyond EOD, truncated [ 495.401925] loop1: p1 start 4278648832 is beyond EOD, truncated [ 495.473371] binder: 25837:25850 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 12:34:33 executing program 3: syz_open_dev$sndctrl(&(0x7f0000000140)='/dev/snd/controlC#\x00', 0x0, 0x0) sched_setaffinity(0x0, 0x7, &(0x7f00000000c0)=0x9) r0 = perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0) fcntl$setflags(r0, 0x2, 0x1) getsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER_VALUE(0xffffffffffffffff, 0x84, 0x7c, &(0x7f00000001c0), &(0x7f0000000240)=0x8) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(0xffffffffffffffff, 0x84, 0x9, &(0x7f0000000280)={0x0, @in={{0x2, 0x4e23, @remote}}, 0xfffffffffffffff7, 0x0, 0x400}, 0x98) sendto$inet6(0xffffffffffffffff, &(0x7f00000004c0), 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) setsockopt$SO_BINDTODEVICE(0xffffffffffffffff, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x4) socket$inet6(0xa, 0x1000000000002, 0x0) r1 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0x5450, &(0x7f0000000200)={0x4, 0x0, &(0x7f0000000100)=[@enter_looper], 0x1, 0x0, &(0x7f0000000180)='T'}) r2 = gettid() timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, &(0x7f0000040000)) tkill(r2, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0xfffffffffffffced, 0x0, &(0x7f0000000040)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x400c630f}], 0x0, 0x0, &(0x7f0000000f4d)}) 12:34:33 executing program 0: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc80700145f8f764070") r1 = socket$packet(0x11, 0x3, 0x300) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000001400)={'vcan0\x00', 0x0}) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000140)={&(0x7f0000000040), 0xca, &(0x7f0000000100)={&(0x7f0000000000)=@ipv6_newaddr={0x2c, 0x14, 0x3353cd1e187a4f97, 0x0, 0x0, {0xa, 0x0, 0x0, 0x0, r2}, [@IFA_LOCAL={0x14, 0x2, @loopback}]}, 0x2c}}, 0x0) r3 = syz_open_dev$usbmon(&(0x7f00000000c0)='/dev/usbmon#\x00', 0x1, 0x202002) ioctl$KVM_SET_DEBUGREGS(r3, 0x4080aea2, &(0x7f0000000180)={[0xf000, 0x0, 0x1, 0xd000], 0x9, 0x65c53308923d3cb1, 0x2}) fcntl$getownex(r1, 0x10, &(0x7f0000000080)) r4 = socket(0x10, 0x80002, 0x0) r5 = ioctl$LOOP_CTL_GET_FREE(r3, 0x4c82) ioctl$LOOP_CTL_REMOVE(r3, 0x4c81, r5) sendmmsg$alg(r4, &(0x7f0000000140), 0x6b7, 0x0) 12:34:33 executing program 1: r0 = add_key$keyring(&(0x7f0000000040)='keyring\x00', &(0x7f0000000000), 0x0, 0x0, 0xfffffffffffffffb) add_key(&(0x7f00000002c0)='dns_resolver\x00', &(0x7f00000000c0), &(0x7f0000000240)="1db510774375f47a05942c459e810c73fdf5623fb1eea51ac1e04c0907bc6c8326e016c477b652f66bcff5828246a8c69e7a40e2aa1197a1d13cb6162194e50a799882e500", 0x45, r0) r1 = syz_open_dev$audion(&(0x7f0000000340)='/dev/audio#\x00', 0x2, 0x400400) clock_gettime(0x6, &(0x7f00000004c0)={0x0, 0x0}) timerfd_settime(r1, 0x1, &(0x7f00000003c0)={{}, {r2, r3+30000000}}, &(0x7f0000000400)) r4 = syz_open_dev$vcsa(&(0x7f0000000100)='/dev/vcsa#\x00', 0x6, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffff9c, &(0x7f0000000200)={0x0, 0x18, 0xfa00, {0x1, &(0x7f0000000180)={0xffffffffffffffff}, 0x117, 0xa}}, 0x20) write$RDMA_USER_CM_CMD_JOIN_IP_MCAST(r4, &(0x7f0000000300)={0x10, 0x30, 0xfa00, {&(0x7f0000000140), 0x1, {0xa, 0x4e24, 0x100000001, @remote, 0x10001}, r5}}, 0x38) keyctl$search(0xa, r0, &(0x7f0000000080)='dns_resolver\x00', &(0x7f00000001c0), 0x0) 12:34:33 executing program 2: r0 = perf_event_open(&(0x7f0000000200)={0x7, 0x55, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x101, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f0000000180)=""/148, 0x13d}], 0x1, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x2400, 0x6d) r1 = syz_open_procfs(0x0, &(0x7f0000000340)="696f001b66408225aaa3af068fffebb8a490c47dda6586f1b58895b94a78037dd3714e7198820a7a709e2d30d25e6d846cd5c62a648a598668a8263b752b0b622b115112b5ad8e0425c0b784bbdb89eb8f4da0dd73dd01fe35694c2f78600badf8a0e237dba40713bac9e053b41a9f62be5fbb928018aab5f7500bef51a2fd74d4fffb4a20a946733820bdc1b485afa417cdbcfdfbc54f58c9c3edffe240c36f4ab8a16613814e226b6d20d98010ab1ace49fa76dce337a5a5f1dcff9e5d533b12475e33b971b15b69cd591cd9059759f0f04ba5468a34b98915033debb3e87f048e8601712659d47d8687eb6be5e650068d88000000000000") sysfs$1(0x1, &(0x7f0000000000)="696f001b66408225aaa3af068fffebb8a490c47dda6586f1b58895b94a78037dd3714e7198820a7a709e2d30d25e6d846cd5c62a648a598668a8263b752b0b622b115112b5ad8e0425c0b784bbdb89eb8f4da0dd73dd01fe35694c2f78600badf8a0e237dba40713bac9e053b41a9f62be5fbb928018aab5f7500bef51a2fd74d4fffb4a20a946733820bdc1b485afa417cdbcfdfbc54f58c9c3edffe240c36f4ab8a16613814e226b6d20d98010ab1ace49fa76dce337a5a5f1dcff9e5d533b12475e33b971b15b69cd591cd9059759f0f04ba5468a34b98915033debb3e87f048e8601712659d47d8687eb6be5e650068d8800") preadv(r1, &(0x7f0000000480), 0x10000000000002a1, 0x0) msgget$private(0x0, 0x22) 12:34:33 executing program 4: socket$inet6(0xa, 0x0, 0x80000000) sched_setaffinity(0x0, 0x7, &(0x7f00000000c0)=0x9) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0) fcntl$setflags(0xffffffffffffffff, 0x2, 0x1) r0 = socket$inet6(0xa, 0x400000000001, 0x0) r1 = dup(r0) setsockopt$inet6_tcp_int(r1, 0x6, 0x12, &(0x7f0000000000)=0x7f, 0x4) bind$inet6(r0, &(0x7f0000000040)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) getsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER_VALUE(r0, 0x84, 0x7c, &(0x7f00000001c0)={0x0, 0x0, 0x6}, &(0x7f0000000240)=0x8) sendto$inet6(r0, &(0x7f00000004c0), 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x4) socket$inet6(0xa, 0x1000000000002, 0x0) r2 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x2, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000200)={0x4, 0x0, &(0x7f0000000100)=[@enter_looper], 0x1, 0x0, &(0x7f0000000180)='T'}) r3 = gettid() timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, &(0x7f0000040000)) tkill(r3, 0x1004000000016) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0xfffffffffffffced, 0x0, &(0x7f0000000040)}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x400c630f}], 0x0, 0x0, &(0x7f0000000f4d)}) 12:34:33 executing program 5: mprotect(&(0x7f000004a000/0x4000)=nil, 0x4000, 0x0) perf_event_open(&(0x7f0000000140)={0x1, 0x70, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f0000000100)=0x9) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000180), 0xffffffffffffffff) r1 = syz_open_dev$audion(&(0x7f00000001c0)='/dev/audio#\x00', 0xf04, 0x8000) write$RDMA_USER_CM_CMD_JOIN_MCAST(0xffffffffffffffff, &(0x7f00000002c0)={0x16, 0x98, 0xfa00, {&(0x7f0000000280)={0xffffffffffffffff}, 0x1, 0xffffffffffffffff, 0x1c, 0x0, @ib={0x1b, 0x2, 0x80000001, {"9b38534be26f5314f30d4a953795973a"}, 0x40, 0x80000000, 0x400}}}, 0xa0) write$RDMA_USER_CM_CMD_LEAVE_MCAST(r1, &(0x7f0000000380)={0x11, 0x10, 0xfa00, {&(0x7f0000000240), r2}}, 0x18) r3 = getpid() sched_setscheduler(r3, 0x5, &(0x7f0000000200)) ioctl$SNDRV_CTL_IOCTL_ELEM_REMOVE(0xffffffffffffffff, 0xc4c85513, &(0x7f0000000080)={0x5, 0x0, 0x0, 0x0, 'syz0\x00'}) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r4 = creat(&(0x7f00000000c0)='./file0\x00', 0x0) write$cgroup_type(r4, &(0x7f00000009c0)='threaded\x00', 0xfffffc47) [ 495.742309] binder: BINDER_SET_CONTEXT_MGR already set [ 495.747621] binder: 25804:25812 ioctl 40046207 0 returned -16 12:34:33 executing program 5: syz_open_dev$sndctrl(&(0x7f0000000140)='/dev/snd/controlC#\x00', 0x0, 0x0) sched_setaffinity(0x0, 0x7, &(0x7f00000000c0)=0x9) r0 = perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0) fcntl$setflags(r0, 0x2, 0x1) getsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER_VALUE(0xffffffffffffffff, 0x84, 0x7c, &(0x7f00000001c0), &(0x7f0000000240)=0x8) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(0xffffffffffffffff, 0x84, 0x9, &(0x7f0000000280)={0x0, @in={{0x2, 0x4e23, @remote}}, 0xfffffffffffffff7, 0x0, 0x400}, 0x98) sendto$inet6(0xffffffffffffffff, &(0x7f00000004c0), 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) setsockopt$SO_BINDTODEVICE(0xffffffffffffffff, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x4) socket$inet6(0xa, 0x1000000000002, 0x0) r1 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc018620b, &(0x7f0000000200)={0x4, 0x0, &(0x7f0000000100)=[@enter_looper], 0x1, 0x0, &(0x7f0000000180)='T'}) r2 = gettid() timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, &(0x7f0000040000)) tkill(r2, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0xfffffffffffffced, 0x0, &(0x7f0000000040)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x400c630f}], 0x0, 0x0, &(0x7f0000000f4d)}) 12:34:33 executing program 1: r0 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000000)='pagemap\x00') socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) timer_create(0x4, &(0x7f0000000240)={0x0, 0x2a, 0x1, @thr={&(0x7f0000000140)="e4640c017a0ade20460e01e415caa1187aea7a433d586d8d869a6c2a55bd4a88bab95b3a9ccea21eca96fc0b169565f82d4f0e5084f971c5a95dd1de0f4b4da9bcb2a2b711b9722c224f3ca8f1b4b98857684b46ea4e663bedfa13c5c7ccab13567a35e8ad480b720782c3c09c70a4018577d70ee05c022a6a903eec0c874a31cee52cb6e06ef586f33e8472ee9899df6affb52af25dea574d952071e9c1b54d8387242670df9f8f18192c258d46", &(0x7f0000000200)="505c7b1207726d3d48fd2888ea62b12d707431a3ab01d9780b3aa72fdb9c2cf6a48c4415f737d949fb5cefb28ea46317f4c584d1c189195d"}}, &(0x7f0000000280)=0x0) timer_getoverrun(r3) close(r0) r4 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffe000/0x2000)=nil) ioctl$SNDRV_SEQ_IOCTL_GET_QUEUE_STATUS(r0, 0xc05c5340, &(0x7f0000000080)={0x3ff, 0x100, 0x0, {}, 0x2, 0x9}) ioctl$FS_IOC_FSGETXATTR(r1, 0x801c581f, &(0x7f0000000040)={0xfff, 0x7, 0x8, 0x6, 0x8}) shmat(r4, &(0x7f0000ffd000/0x2000)=nil, 0x1000) 12:34:33 executing program 2: r0 = perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x9535, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f0000000180)=""/148, 0x13d}], 0x1, 0x0) r1 = dup(r0) ioctl$PIO_CMAP(r1, 0x4b71, &(0x7f0000000040)={0x7, 0x81, 0x7, 0x0, 0x5, 0x8}) fcntl$getownex(r1, 0x10, &(0x7f00000000c0)={0x0, 0x0}) sched_getparam(r2, &(0x7f0000000100)) ioctl$TIOCGPGRP(0xffffffffffffffff, 0x540f, &(0x7f0000000080)=0x0) ioctl$ifreq_SIOCGIFINDEX_vcan(r1, 0x8933, &(0x7f00000002c0)={'vcan0\x00', 0x0}) clock_gettime(0x0, &(0x7f0000000340)={0x0, 0x0}) sendmsg$can_bcm(r0, &(0x7f0000000440)={&(0x7f0000000300)={0x1d, r4}, 0x10, &(0x7f0000000400)={&(0x7f0000000380)={0x38285cf9b0d65d78, 0x121, 0x9, {0x0, 0x7530}, {r5, r6/1000+30000}, {0x4, 0x5, 0x1000}, 0x1, @can={{0x1, 0x2, 0xfff, 0x90be}, 0x2, 0x3, 0x0, 0x0, "1e8aeb54a5c662e8"}}, 0x48}, 0x1, 0x0, 0x0, 0x20000800}, 0x81) r7 = syz_open_procfs(r3, &(0x7f0000000000)='net/sockstat6\x00') preadv(r7, &(0x7f0000000480), 0x10000000000002a1, 0x0) syslog(0x2, &(0x7f0000000280)=""/54, 0x36) msgget$private(0x0, 0x22) ioctl$ION_IOC_ALLOC(r1, 0xc0184900, &(0x7f0000000140)={0x101, 0x25, 0x1, r1}) 12:34:33 executing program 1: clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000240), 0xffffffffffffffff) r0 = getpid() sched_setscheduler(r0, 0x5, &(0x7f0000000200)) socketpair(0x11, 0x0, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) linkat(r1, &(0x7f0000000040)='./file0\x00', r2, &(0x7f0000000080)='./file0\x00', 0x400) [ 495.925175] binder: BINDER_SET_CONTEXT_MGR already set [ 495.939192] binder: 25884:25886 ioctl 40046207 0 returned -16 12:34:33 executing program 0: pipe(&(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) write(r1, &(0x7f00000001c0), 0xfffffef3) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffff7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp, 0x0, 0x0, 0x0, 0x0, 0x9}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = epoll_create(0x5) epoll_ctl$EPOLL_CTL_ADD(r2, 0x1, r1, &(0x7f0000000100)={0x60000008}) epoll_wait(r2, &(0x7f00000005c0)=[{}], 0x123b, 0x1ff) vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) 12:34:33 executing program 1: syz_emit_ethernet(0x6e, &(0x7f00000000c0)=ANY=[@ANYBLOB="aaaaaaaaaaaaffffffffffff8100030008004500005c1200000000019078ac1414bbac14141105029078000000004000000000000000002f0000ac5c14aaac141400082c00000000000000000000e000000200000000e000000188caffff000000007f0000010000000000000000"], &(0x7f0000000140)={0x1, 0xffffffffffffffff}) mount$9p_tcp(&(0x7f0000000040)='127.0.0.1\x00', &(0x7f0000000080)='./file0\x00', &(0x7f0000000280)='9p\x00', 0x0, &(0x7f0000000340)=ANY=[@ANYBLOB="7472616e733d7463702c706f72743d3078303030302e30303030303030346532332c706f73697861636c2c002036040555c52fe5fb4622a5ca21b8aa33189a0bbbc9441eaca46d1400e2a43eef58d41a948240d347bf76392e4dced6156f86efba313660ebed8bc21d0757e7b943"]) r0 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vhost-vsock\x00', 0x2, 0x0) chdir(&(0x7f00000002c0)='./file0\x00') write$P9_RLERROR(r0, &(0x7f0000000300)={0x18, 0x7, 0x1, {0xf, 'mime_type+wlan0'}}, 0x18) ioctl$FS_IOC_GETFSLABEL(r0, 0x81009431, &(0x7f0000000180)) 12:34:33 executing program 4: socket$inet6(0xa, 0x0, 0x80000000) sched_setaffinity(0x0, 0x7, &(0x7f00000000c0)=0x9) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0) fcntl$setflags(0xffffffffffffffff, 0x2, 0x1) r0 = socket$inet6(0xa, 0x400000000001, 0x0) r1 = dup(r0) setsockopt$inet6_tcp_int(r1, 0x6, 0x12, &(0x7f0000000000)=0x7f, 0x4) bind$inet6(r0, &(0x7f0000000040)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) getsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER_VALUE(r0, 0x84, 0x7c, &(0x7f00000001c0)={0x0, 0x0, 0x6}, &(0x7f0000000240)=0x8) sendto$inet6(r0, &(0x7f00000004c0), 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x4) socket$inet6(0xa, 0x1000000000002, 0x0) r2 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046206, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000200)={0x4, 0x0, &(0x7f0000000100)=[@enter_looper], 0x1, 0x0, &(0x7f0000000180)='T'}) r3 = gettid() timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, &(0x7f0000040000)) tkill(r3, 0x1004000000016) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0xfffffffffffffced, 0x0, &(0x7f0000000040)}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x400c630f}], 0x0, 0x0, &(0x7f0000000f4d)}) 12:34:33 executing program 3: syz_open_dev$sndctrl(&(0x7f0000000140)='/dev/snd/controlC#\x00', 0x0, 0x0) sched_setaffinity(0x0, 0x7, &(0x7f00000000c0)=0x9) r0 = perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0) fcntl$setflags(r0, 0x2, 0x1) getsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER_VALUE(0xffffffffffffffff, 0x84, 0x7c, &(0x7f00000001c0), &(0x7f0000000240)=0x8) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(0xffffffffffffffff, 0x84, 0x9, &(0x7f0000000280)={0x0, @in={{0x2, 0x4e23, @remote}}, 0xfffffffffffffff7, 0x0, 0x400}, 0x98) sendto$inet6(0xffffffffffffffff, &(0x7f00000004c0), 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) setsockopt$SO_BINDTODEVICE(0xffffffffffffffff, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x4) socket$inet6(0xa, 0x1000000000002, 0x0) r1 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0x40049409, &(0x7f0000000200)={0x4, 0x0, &(0x7f0000000100)=[@enter_looper], 0x1, 0x0, &(0x7f0000000180)='T'}) r2 = gettid() timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, &(0x7f0000040000)) tkill(r2, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0xfffffffffffffced, 0x0, &(0x7f0000000040)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x400c630f}], 0x0, 0x0, &(0x7f0000000f4d)}) 12:34:33 executing program 1: socket$inet6(0xa, 0x0, 0x80000000) sched_setaffinity(0x0, 0x7, &(0x7f00000000c0)=0x9) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0) fcntl$setflags(0xffffffffffffffff, 0x2, 0x1) r0 = socket$inet6(0xa, 0x400000000001, 0x0) r1 = dup(r0) setsockopt$inet6_tcp_int(r1, 0x6, 0x12, &(0x7f0000000000)=0x7f, 0x4) bind$inet6(r0, &(0x7f0000000040)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) getsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER_VALUE(r0, 0x84, 0x7c, &(0x7f00000001c0)={0x0, 0x0, 0x6}, &(0x7f0000000240)=0x8) sendto$inet6(r0, &(0x7f00000004c0), 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x4) socket$inet6(0xa, 0x1000000000002, 0x0) r2 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x2, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000200)={0x4, 0x0, &(0x7f0000000100)=[@enter_looper], 0x1, 0x0, &(0x7f0000000180)='T'}) r3 = gettid() timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, &(0x7f0000040000)) tkill(r3, 0x1004000000016) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0xfffffffffffffced, 0x0, &(0x7f0000000040)}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x400c630f}], 0x0, 0x0, &(0x7f0000000f4d)}) 12:34:33 executing program 2: perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f0000000180)=""/148, 0x13d}], 0x1, 0x0) getpid() ioctl$sock_SIOCGPGRP(0xffffffffffffffff, 0x8904, &(0x7f0000000100)) preadv(0xffffffffffffffff, &(0x7f0000000480), 0x10000000000002a1, 0x0) msgget$private(0x0, 0x22) [ 496.626033] binder: BINDER_SET_CONTEXT_MGR already set [ 496.632204] binder: 25879:25916 ioctl 40046207 0 returned -16 12:34:34 executing program 5: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000080)="0a5cc80700315f85715070") r1 = socket(0x10, 0x80002, 0x0) ioctl$ifreq_SIOCGIFINDEX_vcan(r1, 0x8933, &(0x7f0000000100)={'vcan0\x00', 0x0}) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000180)={&(0x7f0000000000), 0xc, &(0x7f0000000040)={&(0x7f00000002c0)=@ipv6_getnetconf={0x1c, 0x52, 0x1, 0x0, 0x0, {}, [@NETCONFA_IFINDEX={0x8, 0x1, r2}]}, 0x1c}}, 0x0) sendmmsg$alg(r1, &(0x7f0000000140)=[{0x0, 0x0, &(0x7f0000000100), 0x0, &(0x7f0000000100)}], 0x492492492492805, 0x0) r3 = syz_open_dev$sndpcmp(&(0x7f00000000c0)='/dev/snd/pcmC#D#p\x00', 0x8000000000, 0x14000) ioctl$RNDCLEARPOOL(r3, 0x5206, &(0x7f00000001c0)=0xfffffffffffffffb) 12:34:34 executing program 0: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r2, 0x8912, &(0x7f0000000280)='\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00') clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000640), 0xffffffffffffffff) r3 = getpid() sched_setscheduler(r3, 0x5, &(0x7f0000000200)) ioctl$KVM_DEASSIGN_DEV_IRQ(r1, 0x4020aea5, &(0x7f00000000c0)) [ 496.747350] binder: 25919:25921 ioctl 40046206 0 returned -22 [ 496.759118] binder: 25917:25918 Acquire 1 refcount change on invalid ref 0 ret -22 [ 496.769049] binder: 25917:25918 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 12:34:34 executing program 2: perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f0000000180)=""/148, 0x13d}], 0x1, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000340)="696f001b66408225aaa3af068fffebb8a490c47dda6586f1b58895b94a78037dd3714e7198820a7a709e2d30d25e6d846cd5c62a648a598668a8263b752b0b622b115112b5ad8e0425c0b784bbdb89eb8f4da0dd73dd01fe35694c2f78600badf8a0e237dba40713bac9e053b41a9f62be5fbb928018aab5f7500bef51a2fd74d4fffb4a20a946733820bdc1b485afa417cdbcfdfbc54f58c9c3edffe240c36f4ab8a16613814e226b6d20d98010ab1ace49fa76dce337a5a5f1dcff9e5d533b12475e33b971b15b69cd591cd9059759f0f04ba5468a34b98915033debb3e87f048e8601712659d47d8687eb6be5e650068d88000000000000") preadv(r0, &(0x7f0000000480), 0x10000000000002a1, 0x0) modify_ldt$write(0x1, &(0x7f0000000000)={0x7fffffff, 0x20000000, 0x0, 0x6, 0x8000, 0x0, 0x8, 0x4, 0x80, 0x401}, 0x10) msgget$private(0x0, 0x22) [ 496.808470] binder: 25917:25932 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 12:34:34 executing program 5: r0 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dsp\x00', 0x2, 0x0) fstat(r0, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) lstat(&(0x7f0000000040)='./file0\x00', &(0x7f0000000140)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) lstat(&(0x7f00000001c0)='./file0\x00', &(0x7f0000000200)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) getgroups(0x3, &(0x7f0000000280)=[0xffffffffffffffff, 0xee01, 0xffffffffffffffff]) getgroups(0x7, &(0x7f00000002c0)=[0xee01, 0xee01, 0xee00, 0xee01, 0x0, 0xee01, 0xee01]) getgroups(0x6, &(0x7f0000000300)=[r1, r2, r3, r4, r5, 0x0]) setgroups(0x9, &(0x7f0000000340)=[r8, r10, r7, r9, r7, r3, r1, r9, r6]) ioctl$int_in(r0, 0x80000080045017, &(0x7f0000000080)) [ 496.851696] binder: 25919:25934 ioctl 40046206 0 returned -22 [ 496.860959] binder: 25919:25940 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 12:34:34 executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000100)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000000400)={{'fd', 0x3d, r0}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}}) read$FUSE(r0, &(0x7f0000001000), 0x1000) write$FUSE_INIT(r0, &(0x7f0000000340)={0x50, 0x0, 0x1}, 0x50) open(&(0x7f00000000c0)='./file0/file0\x00', 0x0, 0x0) r1 = open$dir(&(0x7f0000000180)='./file0\x00', 0x0, 0x0) read$FUSE(r0, &(0x7f0000001000), 0x1000) write$FUSE_OPEN(r0, &(0x7f0000000140)={0x20, 0xfffffffffffffffe, 0x3}, 0x20) write$FUSE_ENTRY(r0, &(0x7f0000000580)={0x90, 0x0, 0x2}, 0x90) getdents(r1, &(0x7f0000000240)=""/185, 0xb9) read$FUSE(r0, &(0x7f0000002000), 0x1000) mount$fuse(0x0, &(0x7f00000004c0)='./file0/file0\x00', &(0x7f0000000500)='fuse\x00', 0x0, &(0x7f00000007c0)=ANY=[@ANYBLOB]) write$FUSE_POLL(r0, &(0x7f0000000080)={0x18, 0x0, 0x4}, 0x18) 12:34:34 executing program 2: perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f0000000180)=""/148, 0x13d}], 0x1, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000340)="696f001b66408225aaa3af068fffebb8a490c47dda6586f1b58895b94a78037dd3714e7198820a7a709e2d30d25e6d846cd5c62a648a598668a8263b752b0b622b115112b5ad8e0425c0b784bbdb89eb8f4da0dd73dd01fe35694c2f78600badf8a0e237dba40713bac9e053b41a9f62be5fbb928018aab5f7500bef51a2fd74d4fffb4a20a946733820bdc1b485afa417cdbcfdfbc54f58c9c3edffe240c36f4ab8a16613814e226b6d20d98010ab1ace49fa76dce337a5a5f1dcff9e5d533b12475e33b971b15b69cd591cd9059759f0f04ba5468a34b98915033debb3e87f048e8601712659d47d8687eb6be5e650068d88000000000000") getsockopt$inet_sctp_SCTP_PEER_AUTH_CHUNKS(r0, 0x84, 0x1a, &(0x7f0000000000)=ANY=[@ANYRES32=0x0, @ANYBLOB="df00000097a9bd41f36ae714f44eb97c065298686da8b28ad7b338f59d33c4b23cab2283e0bb4bbf7495f67e84e5871a60dc62090deaa0b7a4e45322d5435a8e83546634635c690f5157ac2047164933a1d240d2553dc39dd236283f09cdbe428429e9fbde95361cda6436632a6dcfbd8a6a924b7bbefe2192870ac45378b12c0f62d08e2a3c0898f1ab9c2c426a9c33c17fe941a653f2795ec2a3a930e61acc95003f5d30278f3e576f355a280a551dce57ee8b93450d4e9166adbac5a8ed4b5f2b61e6abf4c8239987a7e94625d377b540f56b32b847ccb85570020c7fe9c4823646"], &(0x7f0000000100)=0xe7) getsockopt$inet_sctp_SCTP_GET_PEER_ADDR_INFO(r0, 0x84, 0xf, &(0x7f0000000280)={r1, @in6={{0xa, 0x4e21, 0xb, @dev={0xfe, 0x80, [], 0x15}, 0x100000000}}, 0x62, 0xffff, 0x2, 0x7f, 0x5}, &(0x7f0000000140)=0x98) stat(&(0x7f0000000480)='./file0\x00', &(0x7f00000004c0)={0x0, 0x0, 0x0, 0x0, 0x0}) getresgid(&(0x7f0000000540)=0x0, &(0x7f0000000580), &(0x7f00000005c0)) fchownat(r0, &(0x7f0000000440)='./file0\x00', r2, r3, 0x1000) preadv(r0, &(0x7f0000000480), 0x10000000000002a1, 0x0) msgget$private(0x0, 0x22) 12:34:34 executing program 5: r0 = socket$vsock_stream(0x28, 0x1, 0x0) setsockopt$SO_VM_SOCKETS_BUFFER_SIZE(r0, 0x28, 0x0, &(0x7f0000000000)=0x1, 0x8) setsockopt$SO_VM_SOCKETS_BUFFER_SIZE(r0, 0x28, 0x0, &(0x7f0000000140), 0x7) setsockopt$SO_TIMESTAMPING(r0, 0x1, 0x25, &(0x7f0000000040)=0x800, 0x4) 12:34:34 executing program 4: socket$inet6(0xa, 0x0, 0x80000000) sched_setaffinity(0x0, 0x7, &(0x7f00000000c0)=0x9) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0) fcntl$setflags(0xffffffffffffffff, 0x2, 0x1) r0 = socket$inet6(0xa, 0x400000000001, 0x0) r1 = dup(r0) setsockopt$inet6_tcp_int(r1, 0x6, 0x12, &(0x7f0000000000)=0x7f, 0x4) bind$inet6(r0, &(0x7f0000000040)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) getsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER_VALUE(r0, 0x84, 0x7c, &(0x7f00000001c0)={0x0, 0x0, 0x6}, &(0x7f0000000240)=0x8) sendto$inet6(r0, &(0x7f00000004c0), 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x4) socket$inet6(0xa, 0x1000000000002, 0x0) r2 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0xc0045878, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000200)={0x4, 0x0, &(0x7f0000000100)=[@enter_looper], 0x1, 0x0, &(0x7f0000000180)='T'}) r3 = gettid() timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, &(0x7f0000040000)) tkill(r3, 0x1004000000016) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0xfffffffffffffced, 0x0, &(0x7f0000000040)}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x400c630f}], 0x0, 0x0, &(0x7f0000000f4d)}) 12:34:34 executing program 5: r0 = perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0xffa4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) close(r1) r2 = socket$kcm(0x2, 0x3, 0x2) ioctl$PERF_EVENT_IOC_SET_FILTER(r1, 0x8914, &(0x7f0000000380)="6e7230010060a19ef9d2c673d9a1571cb9e1369bcd61ef7e49793ae18712eceb1daa769497800b7fbbd35b170c10751d39aeb660d863e49b8c4f3b3cad48902b5b2d6cfd0abd372c63bcf5d70df3fd4d2e8d443c88c60fd7140fbc0e5637dd82fc3435bed4de5d693c9a781c863e05d8a6f8689a5be29216061f3ff53f8b6b396678e7ba155ef9152d7e43b1eccb2331eb8eb1ed5586dcf8b3b0b999361a44ff2c22c2abbef42dd24eabe6723346a6e46c0499a21442d8d00dcb57f013ff7595edd0ff076930de3675d34117a44eb0e4f832936da44e") r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000140)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f0000000040)={"6e72300100", 0x801}) ioctl$TUNSETLINK(r3, 0x400454cd, 0x308) recvmsg$kcm(r2, &(0x7f0000001880)={0x0, 0x0, &(0x7f00000017c0)=[{&(0x7f0000000540)=""/47, 0x2f}, {&(0x7f00000005c0)=""/9, 0x9}, {&(0x7f0000000600)=""/117, 0x75}, {&(0x7f00000006c0)=""/229, 0xe5}, {&(0x7f00000007c0)=""/4096, 0x1000}], 0x5, &(0x7f0000001840)=""/33, 0x21, 0x1}, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) r4 = fcntl$dupfd(r0, 0x0, r1) getsockname$netlink(r4, &(0x7f0000000000), &(0x7f0000000080)=0xc) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000040)='./cgroup.cpu/syz1\x00', 0x200002, 0x0) openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000300)='memory.stat\x00', 0x0, 0x0) bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f0000000500), 0xc) bpf$MAP_CREATE(0x0, &(0x7f0000000400), 0x2c) r5 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)={0x0, 0x82, 0x0, 0x200000080}, 0x2c) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f00000002c0)={r5, &(0x7f0000000300), &(0x7f0000000280)}, 0x20) bpf$BPF_PROG_QUERY(0x10, &(0x7f0000000380)={0xffffffffffffffff, 0x3, 0x1, 0x0, &(0x7f0000000340)=[0x0], 0x1}, 0x20) [ 497.201222] binder: 25965:25972 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 12:34:34 executing program 3: syz_open_dev$sndctrl(&(0x7f0000000140)='/dev/snd/controlC#\x00', 0x0, 0x0) sched_setaffinity(0x0, 0x7, &(0x7f00000000c0)=0x9) r0 = perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0) fcntl$setflags(r0, 0x2, 0x1) getsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER_VALUE(0xffffffffffffffff, 0x84, 0x7c, &(0x7f00000001c0), &(0x7f0000000240)=0x8) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(0xffffffffffffffff, 0x84, 0x9, &(0x7f0000000280)={0x0, @in={{0x2, 0x4e23, @remote}}, 0xfffffffffffffff7, 0x0, 0x400}, 0x98) sendto$inet6(0xffffffffffffffff, &(0x7f00000004c0), 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) setsockopt$SO_BINDTODEVICE(0xffffffffffffffff, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x4) socket$inet6(0xa, 0x1000000000002, 0x0) r1 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0x40046208, &(0x7f0000000200)={0x4, 0x0, &(0x7f0000000100)=[@enter_looper], 0x1, 0x0, &(0x7f0000000180)='T'}) r2 = gettid() timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, &(0x7f0000040000)) tkill(r2, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0xfffffffffffffced, 0x0, &(0x7f0000000040)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x400c630f}], 0x0, 0x0, &(0x7f0000000f4d)}) 12:34:34 executing program 2: perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f0000000180)=""/148, 0x13d}], 0x1, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000340)="696f001b66408225aaa3af068fffebb8a490c47dda6586f1b58895b94a78037dd3714e7198820a7a709e2d30d25e6d846cd5c62a648a598668a8263b752b0b622b115112b5ad8e0425c0b784bbdb89eb8f4da0dd73dd01fe35694c2f78600badf8a0e237dba40713bac9e053b41a9f62be5fbb928018aab5f7500bef51a2fd74d4fffb4a20a946733820bdc1b485afa417cdbcfdfbc54f58c9c3edffe240c36f4ab8a16613814e226b6d20d98010ab1ace49fa76dce337a5a5f1dcff9e5d533b12475e33b971b15b69cd591cd9059759f0f04ba5468a34b98915033debb3e87f048e8601712659d47d8687eb6be5e650068d88000000000000") preadv(r0, &(0x7f0000000480), 0x10000000000002a1, 0x0) ioctl$SG_GET_ACCESS_COUNT(r0, 0x2289, &(0x7f0000000000)) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(r0, 0x4040534e, &(0x7f0000000040)={0x8, @tick=0xffffffff, 0x3, {0x3f, 0x80}, 0x9ab2, 0x0, 0x2}) msgget$private(0x0, 0x22) 12:34:34 executing program 4: socket$inet6(0xa, 0x0, 0x80000000) sched_setaffinity(0x0, 0x7, &(0x7f00000000c0)=0x9) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0) fcntl$setflags(0xffffffffffffffff, 0x2, 0x1) r0 = socket$inet6(0xa, 0x400000000001, 0x0) r1 = dup(r0) setsockopt$inet6_tcp_int(r1, 0x6, 0x12, &(0x7f0000000000)=0x7f, 0x4) bind$inet6(r0, &(0x7f0000000040)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) getsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER_VALUE(r0, 0x84, 0x7c, &(0x7f00000001c0)={0x0, 0x0, 0x6}, &(0x7f0000000240)=0x8) sendto$inet6(r0, &(0x7f00000004c0), 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x4) socket$inet6(0xa, 0x1000000000002, 0x0) r2 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x5450, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000200)={0x4, 0x0, &(0x7f0000000100)=[@enter_looper], 0x1, 0x0, &(0x7f0000000180)='T'}) r3 = gettid() timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, &(0x7f0000040000)) tkill(r3, 0x1004000000016) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0xfffffffffffffced, 0x0, &(0x7f0000000040)}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x400c630f}], 0x0, 0x0, &(0x7f0000000f4d)}) 12:34:34 executing program 1: socket$inet6(0xa, 0x0, 0x80000000) sched_setaffinity(0x0, 0x7, &(0x7f00000000c0)=0x9) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0) fcntl$setflags(0xffffffffffffffff, 0x2, 0x1) r0 = socket$inet6(0xa, 0x400000000001, 0x0) r1 = dup(r0) setsockopt$inet6_tcp_int(r1, 0x6, 0x12, &(0x7f0000000000)=0x7f, 0x4) bind$inet6(r0, &(0x7f0000000040)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) getsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER_VALUE(r0, 0x84, 0x7c, &(0x7f00000001c0)={0x0, 0x0, 0x6}, &(0x7f0000000240)=0x8) sendto$inet6(r0, &(0x7f00000004c0), 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x4) socket$inet6(0xa, 0x1000000000002, 0x0) r2 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0xc0045878, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000200)={0x4, 0x0, &(0x7f0000000100)=[@enter_looper], 0x1, 0x0, &(0x7f0000000180)='T'}) r3 = gettid() timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, &(0x7f0000040000)) tkill(r3, 0x1004000000016) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0xfffffffffffffced, 0x0, &(0x7f0000000040)}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x400c630f}], 0x0, 0x0, &(0x7f0000000f4d)}) [ 497.559165] binder: BINDER_SET_CONTEXT_MGR already set [ 497.564586] binder: 25926:25939 ioctl 40046207 0 returned -16 [ 497.571477] binder_release_work: 13 callbacks suppressed [ 497.571486] binder: undelivered death notification, 0000000000000000 12:34:35 executing program 3: syz_open_dev$sndctrl(&(0x7f0000000140)='/dev/snd/controlC#\x00', 0x0, 0x0) sched_setaffinity(0x0, 0x7, &(0x7f00000000c0)=0x9) r0 = perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0) fcntl$setflags(r0, 0x2, 0x1) getsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER_VALUE(0xffffffffffffffff, 0x84, 0x7c, &(0x7f00000001c0), &(0x7f0000000240)=0x8) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(0xffffffffffffffff, 0x84, 0x9, &(0x7f0000000280)={0x0, @in={{0x2, 0x4e23, @remote}}, 0xfffffffffffffff7, 0x0, 0x400}, 0x98) sendto$inet6(0xffffffffffffffff, &(0x7f00000004c0), 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) setsockopt$SO_BINDTODEVICE(0xffffffffffffffff, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x4) socket$inet6(0xa, 0x1000000000002, 0x0) r1 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc020660b, &(0x7f0000000200)={0x4, 0x0, &(0x7f0000000100)=[@enter_looper], 0x1, 0x0, &(0x7f0000000180)='T'}) r2 = gettid() timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, &(0x7f0000040000)) tkill(r2, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0xfffffffffffffced, 0x0, &(0x7f0000000040)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x400c630f}], 0x0, 0x0, &(0x7f0000000f4d)}) [ 497.673452] binder: BINDER_SET_CONTEXT_MGR already set [ 497.679219] binder: 25987:25991 ioctl 40046207 0 returned -16 [ 497.701233] binder: undelivered death notification, 0000000000000000 12:34:35 executing program 1: r0 = syz_open_dev$dmmidi(&(0x7f0000000000)='/dev/dmmidi#\x00', 0xe000000000000, 0x280080) r1 = openat$vcs(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/vcs\x00', 0x40, 0x0) ioctl$VHOST_VSOCK_SET_RUNNING(r0, 0x4004af61, &(0x7f00000002c0)) getsockopt$inet6_IPV6_XFRM_POLICY(r1, 0x29, 0x23, &(0x7f0000000500)={{{@in6, @in, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@multicast1}, 0x0, @in=@multicast2}}, &(0x7f0000000600)=0xe8) ioctl$ifreq_SIOCGIFINDEX_team(r1, 0x8933, &(0x7f0000000640)={'team0\x00', r2}) ioctl$SG_GET_KEEP_ORPHAN(r0, 0x2288, &(0x7f0000000080)) r3 = syz_open_dev$sndseq(&(0x7f0000000040)='/dev/snd/seq\x00', 0x0, 0x0) dup2(r3, r0) perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xa96d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x6}, 0x0, 0x3, 0xffffffffffffffff, 0x0) getsockopt$inet6_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f00000000c0), &(0x7f0000000100)=0x14) ioctl$SNDRV_SEQ_IOCTL_GET_PORT_INFO(r0, 0xc0a85322, &(0x7f00000003c0)) [ 497.742305] binder: undelivered death notification, 0000000000000000 [ 497.747270] binder: 25980:25993 Acquire 1 refcount change on invalid ref 0 ret -22 [ 497.748930] binder: undelivered death notification, 0000000000000000 [ 497.782355] binder: 25980:25994 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 12:34:35 executing program 1: perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x10000000013, &(0x7f0000d06000)=0x1, 0x4) connect$inet(r0, &(0x7f0000000100)={0x2, 0x0, @loopback}, 0x6a) setsockopt$inet_tcp_int(r0, 0x6, 0x4000000000014, &(0x7f0000000180)=0x80000000005, 0x4) getsockopt$bt_l2cap_L2CAP_OPTIONS(0xffffffffffffffff, 0x6, 0x1, &(0x7f0000000140), &(0x7f00000001c0)=0xc) sendto$inet(r0, &(0x7f0000000100), 0x240, 0x0, &(0x7f0000000040)={0x2, 0x0, @multicast2}, 0x10) recvmmsg(r0, &(0x7f00000001c0), 0x315, 0xea225aec34b1dd0e, 0x0) ioctl$DRM_IOCTL_GET_MAGIC(0xffffffffffffffff, 0x80046402, &(0x7f0000000200)=0x7) [ 497.812789] binder: undelivered death notification, 0000000000000000 [ 497.821018] binder: 25980:25993 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 12:34:35 executing program 0: socket$inet6(0xa, 0x0, 0x80000000) sched_setaffinity(0x0, 0x7, &(0x7f00000000c0)=0x9) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0) fcntl$setflags(0xffffffffffffffff, 0x2, 0x1) r0 = socket$inet6(0xa, 0x400000000001, 0x0) r1 = dup(r0) setsockopt$inet6_tcp_int(r1, 0x6, 0x12, &(0x7f0000000000)=0x7f, 0x4) bind$inet6(r0, &(0x7f0000000040)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) getsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER_VALUE(r0, 0x84, 0x7c, &(0x7f00000001c0)={0x0, 0x0, 0x6}, &(0x7f0000000240)=0x8) sendto$inet6(r0, &(0x7f00000004c0), 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x4) socket$inet6(0xa, 0x1000000000002, 0x0) r2 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x5450, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000200)={0x4, 0x0, &(0x7f0000000100)=[@enter_looper], 0x1, 0x0, &(0x7f0000000180)='T'}) r3 = gettid() timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, &(0x7f0000040000)) tkill(r3, 0x1004000000016) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0xfffffffffffffced, 0x0, &(0x7f0000000040)}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x400c630f}], 0x0, 0x0, &(0x7f0000000f4d)}) 12:34:35 executing program 2: r0 = perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f0000000180)=""/148, 0x13d}], 0x1, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000340)="696f001b66408225aaa3af068fffebb8a490c47dda6586f1b58895b94a78037dd3714e7198820a7a709e2d30d25e6d846cd5c62a648a598668a8263b752b0b622b115112b5ad8e0425c0b784bbdb89eb8f4da0dd73dd01fe35694c2f78600badf8a0e237dba40713bac9e053b41a9f62be5fbb928018aab5f7500bef51a2fd74d4fffb4a20a946733820bdc1b485afa417cdbcfdfbc54f58c9c3edffe240c36f4ab8a16613814e226b6d20d98010ab1ace49fa76dce337a5a5f1dcff9e5d533b12475e33b971b15b69cd591cd9059759f0f04ba5468a34b98915033debb3e87f048e8601712659d47d8687eb6be5e650068d88000000000000") preadv(r1, &(0x7f0000000480), 0x10000000000002a1, 0x0) io_setup(0x1a9, &(0x7f0000000000)=0x0) io_cancel(r2, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x5, r0, &(0x7f0000000040)="3a66fc0e0618b57d6305ccb19ab1cc2935ac4eadeadb191f036da946ed9383cd51ac662a72e568fcdfcd19b9fe39a8567827f786b30b8131cc07fa664dc1d84f08bb6bfe9bae6f29bfbbd56645e2ea2bfc1142377096f864bff7b486434fea155096e4f2f9a9489ab6238226ff45c393a5141e018d7dfa38f7f3d6501947caa7c6bf8207795eefd9926c26509b4585e27a83e38b7ac7c7fc1561121d42c3e20db18465a608ed9eeb8511bab8870448540c877f531e9ba3560361a58919972f8a129e8ca66cbb5ffdc3f676b2a8538e89dcf02d6e80bda0606e3210f7edd22fb31d52f4cf", 0xe4, 0x7, 0x0, 0x1, 0xffffffffffffff9c}, &(0x7f0000000280)) msgget$private(0x0, 0x22) 12:34:35 executing program 4: socket$inet6(0xa, 0x0, 0x80000000) sched_setaffinity(0x0, 0x7, &(0x7f00000000c0)=0x9) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0) fcntl$setflags(0xffffffffffffffff, 0x2, 0x1) r0 = socket$inet6(0xa, 0x400000000001, 0x0) r1 = dup(r0) setsockopt$inet6_tcp_int(r1, 0x6, 0x12, &(0x7f0000000000)=0x7f, 0x4) bind$inet6(r0, &(0x7f0000000040)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) getsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER_VALUE(r0, 0x84, 0x7c, &(0x7f00000001c0)={0x0, 0x0, 0x6}, &(0x7f0000000240)=0x8) sendto$inet6(r0, &(0x7f00000004c0), 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x4) socket$inet6(0xa, 0x1000000000002, 0x0) r2 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40049409, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000200)={0x4, 0x0, &(0x7f0000000100)=[@enter_looper], 0x1, 0x0, &(0x7f0000000180)='T'}) r3 = gettid() timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, &(0x7f0000040000)) tkill(r3, 0x1004000000016) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0xfffffffffffffced, 0x0, &(0x7f0000000040)}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x400c630f}], 0x0, 0x0, &(0x7f0000000f4d)}) 12:34:35 executing program 1: socket$inet6(0xa, 0x0, 0x80000000) sched_setaffinity(0x0, 0x7, &(0x7f00000000c0)=0x9) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0) fcntl$setflags(0xffffffffffffffff, 0x2, 0x1) r0 = socket$inet6(0xa, 0x400000000001, 0x0) r1 = dup(r0) setsockopt$inet6_tcp_int(r1, 0x6, 0x12, &(0x7f0000000000)=0x7f, 0x4) bind$inet6(r0, &(0x7f0000000040)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) getsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER_VALUE(r0, 0x84, 0x7c, &(0x7f00000001c0)={0x0, 0x0, 0x6}, &(0x7f0000000240)=0x8) sendto$inet6(r0, &(0x7f00000004c0), 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x4) socket$inet6(0xa, 0x1000000000002, 0x0) r2 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x5450, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000200)={0x4, 0x0, &(0x7f0000000100)=[@enter_looper], 0x1, 0x0, &(0x7f0000000180)='T'}) r3 = gettid() timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, &(0x7f0000040000)) tkill(r3, 0x1004000000016) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0xfffffffffffffced, 0x0, &(0x7f0000000040)}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x400c630f}], 0x0, 0x0, &(0x7f0000000f4d)}) 12:34:35 executing program 5: r0 = socket$unix(0x1, 0x3, 0x0) r1 = socket(0x40000000015, 0x5, 0x0) getsockopt$sock_cred(r1, 0x1, 0x11, &(0x7f00000001c0)={0x0, 0x0}, &(0x7f0000000200)=0x5) setreuid(0x0, r2) bind$unix(r0, &(0x7f0000003000)=@file={0x1, "e91f7189591e9233614b00"}, 0xc) 12:34:35 executing program 4: socket$inet6(0xa, 0x0, 0x80000000) sched_setaffinity(0x0, 0x7, &(0x7f00000000c0)=0x9) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0) fcntl$setflags(0xffffffffffffffff, 0x2, 0x1) r0 = socket$inet6(0xa, 0x400000000001, 0x0) r1 = dup(r0) setsockopt$inet6_tcp_int(r1, 0x6, 0x12, &(0x7f0000000000)=0x7f, 0x4) bind$inet6(r0, &(0x7f0000000040)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) getsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER_VALUE(r0, 0x84, 0x7c, &(0x7f00000001c0)={0x0, 0x0, 0x6}, &(0x7f0000000240)=0x8) sendto$inet6(r0, &(0x7f00000004c0), 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x4) socket$inet6(0xa, 0x1000000000002, 0x0) r2 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x5460, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000200)={0x4, 0x0, &(0x7f0000000100)=[@enter_looper], 0x1, 0x0, &(0x7f0000000180)='T'}) r3 = gettid() timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, &(0x7f0000040000)) tkill(r3, 0x1004000000016) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0xfffffffffffffced, 0x0, &(0x7f0000000040)}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x400c630f}], 0x0, 0x0, &(0x7f0000000f4d)}) 12:34:35 executing program 5: r0 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vga_arbiter\x00', 0x400, 0x0) ioctl$EVIOCGKEY(r0, 0x80404518, &(0x7f0000000080)=""/65) r1 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000140)='IPVS\x00') sendmsg$IPVS_CMD_SET_CONFIG(r0, &(0x7f0000000280)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x40000000}, 0xc, &(0x7f0000000240)={&(0x7f0000000180)={0x98, r1, 0x300, 0x70bd25, 0x25dfdbfb, {}, [@IPVS_CMD_ATTR_DEST={0x78, 0x2, [@IPVS_DEST_ATTR_ADDR={0x14, 0x1, @ipv6=@remote}, @IPVS_DEST_ATTR_ADDR_FAMILY={0x8, 0xb, 0xa}, @IPVS_DEST_ATTR_PORT={0x8, 0x2, 0x4e21}, @IPVS_DEST_ATTR_PORT={0x8, 0x2, 0x4e21}, @IPVS_DEST_ATTR_ADDR={0x14, 0x1, @ipv6=@loopback}, @IPVS_DEST_ATTR_PORT={0x8, 0x2, 0x4e21}, @IPVS_DEST_ATTR_INACT_CONNS={0x8}, @IPVS_DEST_ATTR_PORT={0x8, 0x2, 0x4e22}, @IPVS_DEST_ATTR_ADDR={0x14, 0x1, @ipv6=@dev={0xfe, 0x80, [], 0x1c}}, @IPVS_DEST_ATTR_PORT={0x8, 0x2, 0x4e24}]}, @IPVS_CMD_ATTR_SERVICE={0xc, 0x1, [@IPVS_SVC_ATTR_AF={0x8, 0x1, 0xa}]}]}, 0x98}, 0x1, 0x0, 0x0, 0x4000}, 0x1) r2 = syz_init_net_socket$bt_l2cap(0x1f, 0x10000000000002, 0x0) bind$bt_l2cap(r2, &(0x7f0000000000)={0x1f, 0x1001}, 0xe) 12:34:35 executing program 0: r0 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f00000005c0)='/dev/vhost-vsock\x00', 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r0, 0xaf01, &(0x7f0000000000)) r1 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000140)='/dev/sequencer2\x00', 0x0, 0x0) unlinkat(r1, &(0x7f0000000300)='./file0\x00', 0x200) ioctl$VHOST_SET_VRING_ADDR(r0, 0x4028af11, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000180)=""/193, &(0x7f0000000280)=""/97, &(0x7f0000000840)=""/127}) ioctl$VHOST_SET_VRING_ADDR(r0, 0x4028af11, &(0x7f00000000c0)={0x1, 0x1, &(0x7f0000000040)=""/83, &(0x7f0000000380)=""/181, &(0x7f0000000440)=""/141}) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f0000001900)=ANY=[]) ioctl$VHOST_VSOCK_SET_RUNNING(r0, 0x4004af61, &(0x7f00000006c0)=0x1) ioctl$VHOST_SET_VRING_ADDR(r0, 0x4008af04, &(0x7f0000000900)={0x0, 0xfffffffffffffffd, &(0x7f0000000740)=""/184, &(0x7f0000000800)=""/27, &(0x7f0000000940)=""/129}) 12:34:35 executing program 1: r0 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f00000003c0)={0x2, 0x800004e20, @multicast1}, 0x10) connect$inet(r0, &(0x7f0000ccb000)={0x2, 0x4e20}, 0x10) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000340)={0x1, 0x3, &(0x7f00009ff000), &(0x7f00002bf000)='syzkaller\x00', 0x1, 0xb7, &(0x7f0000000440)=""/183}, 0x48) r2 = socket$kcm(0x29, 0x2, 0x0) ioctl$sock_kcm_SIOCKCMATTACH(r2, 0x89e0, &(0x7f000031aff8)={r0, r1}) sendmsg$IPVS_CMD_NEW_DAEMON(0xffffffffffffffff, &(0x7f00000002c0)={&(0x7f0000000140), 0xc, &(0x7f0000000280)={&(0x7f00000001c0)={0x14}, 0x14}}, 0x20040055) sendmsg$TEAM_CMD_PORT_LIST_GET(0xffffffffffffffff, &(0x7f0000000e40)={&(0x7f0000000000), 0xc, &(0x7f0000000e00)={&(0x7f0000001080)={0x14}, 0x14}}, 0x0) [ 498.340076] binder: undelivered death notification, 0000000000000000 12:34:35 executing program 3: syz_open_dev$sndctrl(&(0x7f0000000140)='/dev/snd/controlC#\x00', 0x0, 0x0) sched_setaffinity(0x0, 0x7, &(0x7f00000000c0)=0x9) r0 = perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0) fcntl$setflags(r0, 0x2, 0x1) getsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER_VALUE(0xffffffffffffffff, 0x84, 0x7c, &(0x7f00000001c0), &(0x7f0000000240)=0x8) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(0xffffffffffffffff, 0x84, 0x9, &(0x7f0000000280)={0x0, @in={{0x2, 0x4e23, @remote}}, 0xfffffffffffffff7, 0x0, 0x400}, 0x98) sendto$inet6(0xffffffffffffffff, &(0x7f00000004c0), 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) setsockopt$SO_BINDTODEVICE(0xffffffffffffffff, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x4) socket$inet6(0xa, 0x1000000000002, 0x0) r1 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0x5451, &(0x7f0000000200)={0x4, 0x0, &(0x7f0000000100)=[@enter_looper], 0x1, 0x0, &(0x7f0000000180)='T'}) r2 = gettid() timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, &(0x7f0000040000)) tkill(r2, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0xfffffffffffffced, 0x0, &(0x7f0000000040)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x400c630f}], 0x0, 0x0, &(0x7f0000000f4d)}) 12:34:35 executing program 5: r0 = syz_open_dev$ndb(&(0x7f0000000000)='/dev/nbd#\x00', 0x0, 0x301400) r1 = syz_open_dev$admmidi(&(0x7f0000000080)='/dev/admmidi#\x00', 0x401, 0x8001) ioctl$LOOP_SET_FD(r0, 0x4c00, r1) r2 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r3 = syz_open_dev$binder(&(0x7f0000001380)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r3, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r3, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="006340400000000000000000000000000000000000000000000000000000000000000000001200000000000012000000000000005c70ba5c7116a27e122446a1811e39ffd73178bbec957ebd2d4394af12bd5887843f931dcabaf9f30904641142e34f0e735aa85f763a915c498828e5ddc53f87f064a5bea1bff0bb58e35ce79eae7f3bec11f1e132c36357b5bb1f5aea172ccc23a599f90feaf62f49fc00b8fc0f24279063ec874e0c01027a0b1c6983a174bec16863b90c4f5aa01ca711c1515ed770f99646b53afbab0d0d3ff27b3f906f73e492183b573343e58218c9f0b0a8528b6e", @ANYPTR=&(0x7f0000000140)=ANY=[], @ANYPTR=&(0x7f00000001c0)=ANY=[]], 0x3f000000, 0x0, &(0x7f0000000300)}) 12:34:35 executing program 2: perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f0000000180)=""/148, 0x13d}], 0x1, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000340)="696f001b66408225aaa3af068fffebb8a490c47dda6586f1b58895b94a78037dd3714e7198820a7a709e2d30d25e6d846cd5c62a648a598668a8263b752b0b622b115112b5ad8e0425c0b784bbdb89eb8f4da0dd73dd01fe35694c2f78600badf8a0e237dba40713bac9e053b41a9f62be5fbb928018aab5f7500bef51a2fd74d4fffb4a20a946733820bdc1b485afa417cdbcfdfbc54f58c9c3edffe240c36f4ab8a16613814e226b6d20d98010ab1ace49fa76dce337a5a5f1dcff9e5d533b12475e33b971b15b69cd591cd9059759f0f04ba5468a34b98915033debb3e87f048e8601712659d47d8687eb6be5e650068d88000000000000") ioctl$SIOCSIFHWADDR(r0, 0x8924, &(0x7f0000000000)={'yam0\x00', @remote}) preadv(r0, &(0x7f0000000480), 0x10000000000002a1, 0x0) msgget$private(0x0, 0x22) ioctl$SNDRV_CTL_IOCTL_PCM_NEXT_DEVICE(r0, 0x80045530, &(0x7f00000013c0)=""/4096) 12:34:35 executing program 0: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f0000000040)) r1 = syz_open_pts(r0, 0x0) ioctl$TIOCEXCL(r1, 0x540c) r2 = syz_open_procfs(0xffffffffffffffff, &(0x7f00000000c0)='uid_map\x00') setsockopt$XDP_UMEM_REG(r2, 0x11b, 0x4, &(0x7f0000000140)={&(0x7f0000000100)=""/11, 0x110000, 0x1000, 0x2}, 0x18) ioctl$TCFLSH(r1, 0x5437, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) socket$vsock_dgram(0x28, 0x2, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$TIOCGPTPEER(r0, 0x5441, 0x0) 12:34:35 executing program 4: socket$inet6(0xa, 0x0, 0x80000000) sched_setaffinity(0x0, 0x7, &(0x7f00000000c0)=0x9) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0) fcntl$setflags(0xffffffffffffffff, 0x2, 0x1) r0 = socket$inet6(0xa, 0x400000000001, 0x0) r1 = dup(r0) setsockopt$inet6_tcp_int(r1, 0x6, 0x12, &(0x7f0000000000)=0x7f, 0x4) bind$inet6(r0, &(0x7f0000000040)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) getsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER_VALUE(r0, 0x84, 0x7c, &(0x7f00000001c0)={0x0, 0x0, 0x6}, &(0x7f0000000240)=0x8) sendto$inet6(r0, &(0x7f00000004c0), 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x4) socket$inet6(0xa, 0x1000000000002, 0x0) r2 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046205, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000200)={0x4, 0x0, &(0x7f0000000100)=[@enter_looper], 0x1, 0x0, &(0x7f0000000180)='T'}) r3 = gettid() timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, &(0x7f0000040000)) tkill(r3, 0x1004000000016) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0xfffffffffffffced, 0x0, &(0x7f0000000040)}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x400c630f}], 0x0, 0x0, &(0x7f0000000f4d)}) 12:34:35 executing program 1: socket$inet6(0xa, 0x0, 0x80000000) sched_setaffinity(0x0, 0x7, &(0x7f00000000c0)=0x9) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0) fcntl$setflags(0xffffffffffffffff, 0x2, 0x1) r0 = socket$inet6(0xa, 0x400000000001, 0x0) r1 = dup(r0) setsockopt$inet6_tcp_int(r1, 0x6, 0x12, &(0x7f0000000000)=0x7f, 0x4) bind$inet6(r0, &(0x7f0000000040)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) getsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER_VALUE(r0, 0x84, 0x7c, &(0x7f00000001c0)={0x0, 0x0, 0x6}, &(0x7f0000000240)=0x8) sendto$inet6(r0, &(0x7f00000004c0), 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x4) socket$inet6(0xa, 0x1000000000002, 0x0) r2 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x5460, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000200)={0x4, 0x0, &(0x7f0000000100)=[@enter_looper], 0x1, 0x0, &(0x7f0000000180)='T'}) r3 = gettid() timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, &(0x7f0000040000)) tkill(r3, 0x1004000000016) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0xfffffffffffffced, 0x0, &(0x7f0000000040)}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x400c630f}], 0x0, 0x0, &(0x7f0000000f4d)}) [ 498.626450] binder: BINDER_SET_CONTEXT_MGR already set [ 498.631854] binder: 26001:26012 ioctl 40046207 0 returned -16 [ 498.638630] binder: undelivered death notification, 0000000000000000 [ 498.679761] binder: 26067:26068 got transaction with invalid data ptr [ 498.712422] binder: 26067:26068 transaction failed 29201/-14, size 4608-18 line 2992 12:34:36 executing program 0: socket$inet6(0xa, 0x0, 0x80000000) sched_setaffinity(0x0, 0x7, &(0x7f00000000c0)=0x9) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0) fcntl$setflags(0xffffffffffffffff, 0x2, 0x1) r0 = socket$inet6(0xa, 0x400000000001, 0x0) r1 = dup(r0) setsockopt$inet6_tcp_int(r1, 0x6, 0x12, &(0x7f0000000000)=0x7f, 0x4) bind$inet6(r0, &(0x7f0000000040)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) getsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER_VALUE(r0, 0x84, 0x7c, &(0x7f00000001c0)={0x0, 0x0, 0x6}, &(0x7f0000000240)=0x8) sendto$inet6(r0, &(0x7f00000004c0), 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x4) socket$inet6(0xa, 0x1000000000002, 0x0) r2 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x5460, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000200)={0x4, 0x0, &(0x7f0000000100)=[@enter_looper], 0x1, 0x0, &(0x7f0000000180)='T'}) r3 = gettid() timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, &(0x7f0000040000)) tkill(r3, 0x1004000000016) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0xfffffffffffffced, 0x0, &(0x7f0000000040)}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x400c630f}], 0x0, 0x0, &(0x7f0000000f4d)}) [ 498.751866] binder_alloc: binder_alloc_mmap_handler: 26067 20001000-20004000 already mapped failed -16 [ 498.754375] binder: BINDER_SET_CONTEXT_MGR already set [ 498.777076] binder: 26071:26074 ioctl 40046205 0 returned -22 [ 498.787477] binder: BINDER_SET_CONTEXT_MGR already set [ 498.795104] binder: 26076:26079 ioctl 40046207 0 returned -16 12:34:36 executing program 2: r0 = perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f0000000180)=""/148, 0x13d}], 0x1, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000440)="696f001b66408225aaa3af068fffebb8a490c47dda6586f1b58895b94a78037dd3714e7198820a7a709e2d30d25e6d846cd5c62a648a598668a8263b752b0b622b115112b5ad8e0425c0b784bbdb89eb8f4da0dd73dd01fe35694c2f78600badf8a0e237dba40713bac9e053b41a9f62be5fbb928018aab5f7500bef51a2fd74d4fffb4a20a946733820bdc1b485afa417cdbcfdfbc54f58c9c3edffe240c36f4ab8a16613814e226b6d20d98010ab1ace49fa76dce337a5a5f1dcff9e5d533b12475e33b971b15b69cd591cd9059759f0f04ba5468a34b98915033debb3e87f048e8601712659d47d8687eb6be5e650068d88000000000000") preadv(r1, &(0x7f0000000480), 0x10000000000002a1, 0x0) msgget$private(0x0, 0x22) mmap(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x2000000, 0x12, r0, 0x0) [ 498.802899] binder: 26067:26080 ioctl 40046207 0 returned -16 [ 498.821515] binder: undelivered death notification, 0000000000000000 12:34:36 executing program 5: r0 = socket$inet6(0xa, 0x800000806, 0x0) setsockopt$inet6_int(r0, 0x29, 0x1a, &(0x7f0000000000)=0x9fd, 0x4) connect$inet6(r0, &(0x7f0000050fe4)={0xa, 0x0, 0x0, @ipv4={[], [], @local={0xac, 0x14, 0xffffffffffffffff}}}, 0x1c) setsockopt$inet6_tcp_TCP_ULP(r0, 0x6, 0x1f, &(0x7f0000000040)='tls\x00', 0x4) r1 = openat$zero(0xffffffffffffff9c, &(0x7f0000000080)='/dev/zero\x00', 0x1, 0x0) setsockopt$inet_MCAST_JOIN_GROUP(r1, 0x0, 0x2a, &(0x7f0000000100)={0x2, {{0x2, 0x4e23, @rand_addr=0x1}}}, 0x88) ioctl$KVM_DEASSIGN_DEV_IRQ(r1, 0x4040ae75, &(0x7f00000000c0)={0x10001, 0x7, 0x4, 0x1}) 12:34:36 executing program 1: socket$inet6(0xa, 0x0, 0x80000000) sched_setaffinity(0x0, 0x7, &(0x7f00000000c0)=0x9) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0) fcntl$setflags(0xffffffffffffffff, 0x2, 0x1) r0 = socket$inet6(0xa, 0x400000000001, 0x0) r1 = dup(r0) setsockopt$inet6_tcp_int(r1, 0x6, 0x12, &(0x7f0000000000)=0x7f, 0x4) bind$inet6(r0, &(0x7f0000000040)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) getsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER_VALUE(r0, 0x84, 0x7c, &(0x7f00000001c0)={0x0, 0x0, 0x6}, &(0x7f0000000240)=0x8) sendto$inet6(r0, &(0x7f00000004c0), 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x4) socket$inet6(0xa, 0x1000000000002, 0x0) r2 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x5460, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000200)={0x4, 0x0, &(0x7f0000000100)=[@enter_looper], 0x1, 0x0, &(0x7f0000000180)='T'}) r3 = gettid() timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, &(0x7f0000040000)) tkill(r3, 0x1004000000016) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0xfffffffffffffced, 0x0, &(0x7f0000000040)}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x400c630f}], 0x0, 0x0, &(0x7f0000000f4d)}) [ 498.859781] binder: 26071:26084 Acquire 1 refcount change on invalid ref 0 ret -22 [ 498.873910] binder_thread_write: 1 callbacks suppressed [ 498.873927] binder: 26071:26084 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 498.880166] binder: 26071:26084 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 12:34:36 executing program 5: perf_event_open(&(0x7f0000000300)={0x800000000002, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000080)}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_mount_image$gfs2(&(0x7f0000000080)='gfs2\x00', &(0x7f0000000180)='./file0\x00', 0x0, 0x0, &(0x7f0000000300), 0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="6c6f636b7461626c653d74727573746524656d312c0094106f2f13dea2de7804e9c3ec3eb63ce8d00e98169f73272ff45e48d81a1c3264febe8f03dad4b22adcb01be5b3662e06d4d60f19633d1d3c50809f4645afff20ed58808692132e7a18ddacc679ab9242e3a079cde60c25cc54ac8d1016b9052b06df1e059584729a834e467f5b6f7ace9dd4568025b3e8487ea3e19234fa6b85ba0a3a849526fc46514ea020"]) [ 498.951554] binder: 26086:26087 Acquire 1 refcount change on invalid ref 0 ret -22 [ 498.976079] binder: 26086:26087 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 499.010457] binder: 26086:26098 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 [ 499.019377] binder: 26094:26095 Acquire 1 refcount change on invalid ref 0 ret -22 [ 499.028710] binder: 26094:26095 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 12:34:36 executing program 2: perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f0000000180)=""/148, 0x13d}], 0x1, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000340)="696f001b66408225aaa3af068fffebb8a490c47dda6586f1b58895b94a78037dd3714e7198820a7a709e2d30d25e6d846cd5c62a648a598668a8263b752b0b622b115112b5ad8e0425c0b784bbdb89eb8f4da0dd73dd01fe35694c2f78600badf8a0e237dba40713bac9e053b41a9f62be5fbb928018aab5f7500bef51a2fd74d4fffb4a20a946733820bdc1b485afa417cdbcfdfbc54f58c9c3edffe240c36f4ab8a16613814e226b6d20d98010ab1ace49fa76dce337a5a5f1dcff9e5d533b12475e33b971b15b69cd591cd9059759f0f04ba5468a34b98915033debb3e87f048e8601712659d47d8687eb6be5e650068d88000000000000") preadv(r0, &(0x7f0000000480), 0x10000000000002a1, 0x0) openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x2, 0x0) msgget$private(0x0, 0x22) [ 499.053791] gfs2: not a GFS2 filesystem [ 499.065768] binder: 26094:26104 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 [ 499.123041] gfs2: not a GFS2 filesystem [ 499.496618] binder: 26071:26084 ioctl 40046205 0 returned -22 [ 499.504630] binder: 26071:26084 Acquire 1 refcount change on invalid ref 0 ret -22 [ 499.504649] binder: 26071:26114 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 [ 499.520899] binder: 26071:26084 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 499.534422] binder: undelivered death notification, 0000000000000000 12:34:36 executing program 3: syz_open_dev$sndctrl(&(0x7f0000000140)='/dev/snd/controlC#\x00', 0x0, 0x0) sched_setaffinity(0x0, 0x7, &(0x7f00000000c0)=0x9) r0 = perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0) fcntl$setflags(r0, 0x2, 0x1) getsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER_VALUE(0xffffffffffffffff, 0x84, 0x7c, &(0x7f00000001c0), &(0x7f0000000240)=0x8) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(0xffffffffffffffff, 0x84, 0x9, &(0x7f0000000280)={0x0, @in={{0x2, 0x4e23, @remote}}, 0xfffffffffffffff7, 0x0, 0x400}, 0x98) sendto$inet6(0xffffffffffffffff, &(0x7f00000004c0), 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) setsockopt$SO_BINDTODEVICE(0xffffffffffffffff, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x4) socket$inet6(0xa, 0x1000000000002, 0x0) r1 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0x40046205, &(0x7f0000000200)={0x4, 0x0, &(0x7f0000000100)=[@enter_looper], 0x1, 0x0, &(0x7f0000000180)='T'}) r2 = gettid() timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, &(0x7f0000040000)) tkill(r2, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0xfffffffffffffced, 0x0, &(0x7f0000000040)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x400c630f}], 0x0, 0x0, &(0x7f0000000f4d)}) 12:34:36 executing program 5: perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f0000005f80)=[{{0x0, 0x0, &(0x7f0000001080)=[{&(0x7f0000000fc0)=""/40, 0x28}], 0x1}}], 0x1, 0x0, &(0x7f0000006200)={0x77359400}) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r0, 0x29, 0x1b, &(0x7f0000e95fe0)={@remote={0xfe, 0x80, [], 0xffffffffffffffff}}, 0x20) r1 = syz_open_procfs(0x0, &(0x7f0000000000)='net/anycast6\x00') ioctl$EXT4_IOC_GROUP_ADD(r1, 0x40286608, &(0x7f0000000140)={0x3, 0x0, 0xfffffffffffffeff, 0x9caf, 0x400, 0xffffffff}) preadv(r1, &(0x7f0000000140), 0x391, 0x51) openat$random(0xffffffffffffff9c, &(0x7f0000000180)='/dev/urandom\x00', 0x400000, 0x0) setsockopt$inet6_tcp_TCP_ULP(r1, 0x6, 0x1f, &(0x7f00000000c0)='tls\x00', 0x4) ioctl$sock_inet6_SIOCDIFADDR(0xffffffffffffffff, 0x8936, &(0x7f0000000100)={@remote, 0x68}) 12:34:36 executing program 2: perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f0000000180)=""/148, 0x13d}], 0x1, 0x0) r0 = msgget(0x3, 0x4a2) msgsnd(r0, &(0x7f0000000000)={0x0, "336d7e710a60d39e1d51bd0cad4214b1a435960918b97d7aa1938fbf899b3767f4b1f64cede0d756fe8006b8e1b7588660a38ee04ce9a115a34ddbe1462f3063f645cf4d5470720b29370cbcb1ca4ff03c465624daea4108eec7212386b6b1655f553a5da0ebafc4f7fd72df1449208b35ba6c2ef6aa76fe7ff3046bfe3c48cb1096dc4567685572f93b7d616d9f49dbf357744ee9509a31731422c09a9bd6db98932c4743f0e923e7ffbf24f5a951675f8557511448b2e72cf832783df9"}, 0xc6, 0x800) r1 = syz_open_procfs(0x0, &(0x7f0000000340)="696f001b66408225aaa3af068fffebb8a490c47dda6586f1b58895b94a78037dd3714e7198820a7a709e2d30d25e6d846cd5c62a648a598668a8263b752b0b622b115112b5ad8e0425c0b784bbdb89eb8f4da0dd73dd01fe35694c2f78600badf8a0e237dba40713bac9e053b41a9f62be5fbb928018aab5f7500bef51a2fd74d4fffb4a20a946733820bdc1b485afa417cdbcfdfbc54f58c9c3edffe240c36f4ab8a16613814e226b6d20d98010ab1ace49fa76dce337a5a5f1dcff9e5d533b12475e33b971b15b69cd591cd9059759f0f04ba5468a34b98915033debb3e87f048e8601712659d47d8687eb6be5e650068d88000000000000") preadv(r1, &(0x7f0000000480), 0x10000000000002a1, 0x0) msgget$private(0x0, 0x22) 12:34:36 executing program 4: socket$inet6(0xa, 0x0, 0x80000000) sched_setaffinity(0x0, 0x7, &(0x7f00000000c0)=0x9) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0) fcntl$setflags(0xffffffffffffffff, 0x2, 0x1) r0 = socket$inet6(0xa, 0x400000000001, 0x0) r1 = dup(r0) setsockopt$inet6_tcp_int(r1, 0x6, 0x12, &(0x7f0000000000)=0x7f, 0x4) bind$inet6(r0, &(0x7f0000000040)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) getsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER_VALUE(r0, 0x84, 0x7c, &(0x7f00000001c0)={0x0, 0x0, 0x6}, &(0x7f0000000240)=0x8) sendto$inet6(r0, &(0x7f00000004c0), 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x4) socket$inet6(0xa, 0x1000000000002, 0x0) r2 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0xc020660b, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000200)={0x4, 0x0, &(0x7f0000000100)=[@enter_looper], 0x1, 0x0, &(0x7f0000000180)='T'}) r3 = gettid() timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, &(0x7f0000040000)) tkill(r3, 0x1004000000016) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0xfffffffffffffced, 0x0, &(0x7f0000000040)}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x400c630f}], 0x0, 0x0, &(0x7f0000000f4d)}) [ 499.540997] binder: undelivered death notification, 0000000000000000 12:34:37 executing program 2: perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) preadv(0xffffffffffffffff, &(0x7f0000001380), 0x1000000000000483, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000340)="696f001b66408225aaa3af068fffebb8a490c47dda6586f1b58895b94a78037dd3714e7198820a7a709e2d30d25e6d846cd5c62a648a598668a8263b752b0b622b115112b5ad8e0425c0b784bbdb89eb8f4da0dd73dd01fe35694c2f78600badf8a0e237dba40713bac9e053b41a9f62be5fbb928018aab5f7500bef51a2fd74d4fffb4a20a946733820bdc1b485afa417cdbcfdfbc54f58c9c3edffe240c36f4ab8a16613814e226b6d20d98010ab1ace49fa76dce337a5a5f1dcff9e5d533b12475e33b971b15b69cd591cd9059759f0f04ba5468a34b98915033debb3e87f048e8601712659d47d8687eb6be5e650068d88000000000000") preadv(r0, &(0x7f0000000480), 0x10000000000002a1, 0x0) socketpair$inet_tcp(0x2, 0x1, 0x0, &(0x7f0000000000)) write$FUSE_DIRENT(r0, &(0x7f0000000440)=ANY=[@ANYBLOB="58010000000000000800000000000000f4ff00000000000000000100000000001a00000007000000626465763a7b70726f63706f7369785f61636c5f6163636573730000000000000000000000000000b100000000000000f400000001800000696f001b66408225aaa3af068fffebb8a490c47dda6586f1b58895b94a78037dd3714e7198820a7a709e2d30d25e6d846cd5c62a648a598668a8263b752b0b622b115112b5ad8e0425c0b784bbdb89eb8f4da0dd73dd01fe35694c2f78600badf8a0e237dba40713bac9e053b41a9f62be5fbb92d418aab5f7500bef51a2fd74d4fffb4a20a946733820bdc1b485afa417cdbcfdfbc54f58c9c3edffe240c36f4ab8a16613814e226b6d20d90700ab1ace49fa76dce337a5a5f1dcff9e7287436f432c63e35d533b12475e33b971b15b69cd591cd9059759f0f04ba5468a34398915033debb3e87f048e8601712659d47d8687eb6be5e650068d880000000000"], 0x158) msgget$private(0x0, 0x22) 12:34:37 executing program 5: syz_open_dev$sndctrl(&(0x7f0000000140)='/dev/snd/controlC#\x00', 0x0, 0x0) sched_setaffinity(0x0, 0x7, &(0x7f00000000c0)=0x9) r0 = perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0) fcntl$setflags(r0, 0x2, 0x1) getsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER_VALUE(0xffffffffffffffff, 0x84, 0x7c, &(0x7f00000001c0), &(0x7f0000000240)=0x8) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(0xffffffffffffffff, 0x84, 0x9, &(0x7f0000000280)={0x0, @in={{0x2, 0x4e23, @remote}}, 0xfffffffffffffff7, 0x0, 0x400}, 0x98) sendto$inet6(0xffffffffffffffff, &(0x7f00000004c0), 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) setsockopt$SO_BINDTODEVICE(0xffffffffffffffff, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x4) socket$inet6(0xa, 0x1000000000002, 0x0) r1 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0x5451, &(0x7f0000000200)={0x4, 0x0, &(0x7f0000000100)=[@enter_looper], 0x1, 0x0, &(0x7f0000000180)='T'}) r2 = gettid() timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, &(0x7f0000040000)) tkill(r2, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0xfffffffffffffced, 0x0, &(0x7f0000000040)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x400c630f}], 0x0, 0x0, &(0x7f0000000f4d)}) 12:34:37 executing program 0: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = open(&(0x7f0000000000)='./file0\x00', 0x1, 0x148) setsockopt$bt_hci_HCI_DATA_DIR(r1, 0x0, 0x1, &(0x7f0000000040)=0x7, 0x4) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) socketpair$unix(0x1, 0x5, 0x0, &(0x7f000001a000)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$SO_ATTACH_FILTER(r2, 0x1, 0x1a, &(0x7f0000ab9ff0)={0x2, &(0x7f000039a000)=[{0x20, 0x0, 0x0, 0xfffffffffffff004}, {0x6}]}, 0x10) 12:34:37 executing program 0: pipe(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) getsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER(0xffffffffffffffff, 0x84, 0x7b, &(0x7f0000000400)={0x0, 0x10001}, &(0x7f0000000440)=0x8) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sched_setattr(0x0, &(0x7f0000000000)={0x0, 0x6, 0x0, 0x0, 0x0, 0x9917, 0xffff}, 0x0) ioctl$TIOCGSID(0xffffffffffffffff, 0x5429, &(0x7f0000000100)) ioctl$VT_OPENQRY(r1, 0x5600, &(0x7f0000000080)) openat$cgroup_procs(r1, &(0x7f0000000180)='tasks\x00', 0x2, 0x0) unshare(0x400) clock_gettime(0x200008, 0xfffffffffffffffe) r2 = openat$snapshot(0xffffffffffffff9c, &(0x7f00000004c0)='/dev/snapshot\x00', 0x0, 0x0) ioctl$sock_ifreq(0xffffffffffffffff, 0x0, &(0x7f0000000040)={'tunl0\x00', @ifru_names='bridge0\x00'}) ioctl$SNDRV_CTL_IOCTL_HWDEP_INFO(r0, 0x80dc5521, &(0x7f0000000bc0)=""/153) openat$vsock(0xffffffffffffff9c, &(0x7f0000000640)='/dev/vsock\x00', 0x7fffe, 0x0) setsockopt$packet_fanout(0xffffffffffffffff, 0x107, 0x12, &(0x7f00000000c0)={0x2, 0x0, 0x2000}, 0x4) ioctl$SNDRV_SEQ_IOCTL_GET_SUBSCRIPTION(0xffffffffffffffff, 0xc0505350, &(0x7f0000000500)={{0x0, 0xaf}, {0x0, 0x2}, 0x4, 0x0, 0x157c}) r3 = syz_open_dev$sg(&(0x7f0000000180)='/dev/sg#\x00', 0x0, 0x0) io_cancel(0x0, &(0x7f0000000380)={0x0, 0x0, 0x0, 0x3, 0x0, r1, &(0x7f0000000340)="3cee2841e733f9619b3cff2f2656faa2e742ec8c4af6291a4c12f6c9bfcf805991c0fae4be747c4edb68", 0x2a, 0x101, 0x0, 0x1, r0}, &(0x7f00000003c0)) ioctl$BLKTRACESETUP(r3, 0xc0481273, &(0x7f0000000000)={[], 0xfffffffffffffffd, 0x106, 0x279d}) accept4$packet(r0, &(0x7f0000000140)={0x11, 0x0, 0x0}, &(0x7f0000000240)=0x14, 0x80000) sendto$packet(r2, &(0x7f00000001c0)="32c806d8d8d52781b88092a42073b119aea1fcbefe0200dc20c1e0f57c3a1942eaeb89c9013b2b185497e71fae505c42d89d0a9c8ba7755ec44f40c514c8107085de0bfe", 0x44, 0x4000001, &(0x7f0000000280)={0x11, 0x2, r4, 0x1, 0x5, 0x6, @remote}, 0x14) ioctl$BLKTRACETEARDOWN(r3, 0x1276, 0x0) 12:34:37 executing program 1: socket$inet6(0xa, 0x0, 0x80000000) sched_setaffinity(0x0, 0x7, &(0x7f00000000c0)=0x9) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0) fcntl$setflags(0xffffffffffffffff, 0x2, 0x1) r0 = socket$inet6(0xa, 0x400000000001, 0x0) r1 = dup(r0) setsockopt$inet6_tcp_int(r1, 0x6, 0x12, &(0x7f0000000000)=0x7f, 0x4) bind$inet6(r0, &(0x7f0000000040)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) getsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER_VALUE(r0, 0x84, 0x7c, &(0x7f00000001c0)={0x0, 0x0, 0x6}, &(0x7f0000000240)=0x8) sendto$inet6(r0, &(0x7f00000004c0), 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x4) socket$inet6(0xa, 0x1000000000002, 0x0) r2 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x5460, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000200)={0x4, 0x0, &(0x7f0000000100)=[@enter_looper], 0x1, 0x0, &(0x7f0000000180)='T'}) r3 = gettid() timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, &(0x7f0000040000)) tkill(r3, 0x1004000000016) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0xfffffffffffffced, 0x0, &(0x7f0000000040)}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x400c630f}], 0x0, 0x0, &(0x7f0000000f4d)}) 12:34:37 executing program 4: socket$inet6(0xa, 0x0, 0x80000000) sched_setaffinity(0x0, 0x7, &(0x7f00000000c0)=0x9) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0) fcntl$setflags(0xffffffffffffffff, 0x2, 0x1) r0 = socket$inet6(0xa, 0x400000000001, 0x0) r1 = dup(r0) setsockopt$inet6_tcp_int(r1, 0x6, 0x12, &(0x7f0000000000)=0x7f, 0x4) bind$inet6(r0, &(0x7f0000000040)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) getsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER_VALUE(r0, 0x84, 0x7c, &(0x7f00000001c0)={0x0, 0x0, 0x6}, &(0x7f0000000240)=0x8) sendto$inet6(r0, &(0x7f00000004c0), 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x4) socket$inet6(0xa, 0x1000000000002, 0x0) r2 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046241, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000200)={0x4, 0x0, &(0x7f0000000100)=[@enter_looper], 0x1, 0x0, &(0x7f0000000180)='T'}) r3 = gettid() timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, &(0x7f0000040000)) tkill(r3, 0x1004000000016) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0xfffffffffffffced, 0x0, &(0x7f0000000040)}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x400c630f}], 0x0, 0x0, &(0x7f0000000f4d)}) [ 499.815756] binder: BINDER_SET_CONTEXT_MGR already set [ 499.834161] binder: 26134:26142 ioctl 40046207 0 returned -16 12:34:37 executing program 2: perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f0000000180)=""/148, 0x13d}], 0x1, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000340)="696f001b66408225aaa3af068fffebb8a490c47dda6586f1b58895b94a78037dd3714e7198820a7a709e2d30d25e6d846cd5c62a648a598668a8263b752b0b622b115112b5ad8e0425c0b784bbdb89eb8f4da0dd73dd01fe35694c2f78600badf8a0e237dba40713bac9e053b41a9f62be5fbb928018aab5f7500bef51a2fd74d4fffb4a20a946733820bdc1b485afa417cdbcfdfbc54f58c9c3edffe240c36f4ab8a16613814e226b6d20d98010ab1ace49fa76dce337a5a5f1dcff9e5d533b12475e33b971b15b69cd591cd9059759f0f04ba5468a34b98915033debb3e87f048e8601712659d47d8687eb6be5e650068d88000000000000") preadv(r0, &(0x7f0000000480), 0x10000000000002a1, 0x0) msgget$private(0x0, 0x22) socketpair$inet_icmp_raw(0x2, 0x3, 0x1, &(0x7f0000000000)) [ 499.990558] binder: 26155:26156 ioctl 40046241 0 returned -22 [ 500.087850] binder: 26155:26162 ioctl 40046241 0 returned -22 12:34:37 executing program 2: syz_open_dev$sndseq(&(0x7f0000000000)='/dev/snd/seq\x00', 0x0, 0x800) perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f0000000180)=""/148, 0x13d}], 0x1, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000340)="696f001b66408225aaa3af068fffebb8a490c47dda6586f1b58895b94a78037dd3714e7198820a7a709e2d30d25e6d846cd5c62a648a598668a8263b752b0b622b115112b5ad8e0425c0b784bbdb89eb8f4da0dd73dd01fe35694c2f78600badf8a0e237dba40713bac9e053b41a9f62be5fbb928018aab5f7500bef51a2fd74d4fffb4a20a946733820bdc1b485afa417cdbcfdfbc54f58c9c3edffe240c36f4ab8a16613814e226b6d20d98010ab1ace49fa76dce337a5a5f1dcff9e5d533b12475e33b971b15b69cd591cd9059759f0f04ba5468a34b98915033debb3e87f048e8601712659d47d8687eb6be5e650068d88000000000000") preadv(r0, &(0x7f0000000480), 0xbceb62c654d6fcb, 0x0) msgget$private(0x0, 0x22) 12:34:37 executing program 3: syz_open_dev$sndctrl(&(0x7f0000000140)='/dev/snd/controlC#\x00', 0x0, 0x0) sched_setaffinity(0x0, 0x7, &(0x7f00000000c0)=0x9) r0 = perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0) fcntl$setflags(r0, 0x2, 0x1) getsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER_VALUE(0xffffffffffffffff, 0x84, 0x7c, &(0x7f00000001c0), &(0x7f0000000240)=0x8) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(0xffffffffffffffff, 0x84, 0x9, &(0x7f0000000280)={0x0, @in={{0x2, 0x4e23, @remote}}, 0xfffffffffffffff7, 0x0, 0x400}, 0x98) sendto$inet6(0xffffffffffffffff, &(0x7f00000004c0), 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) setsockopt$SO_BINDTODEVICE(0xffffffffffffffff, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x4) socket$inet6(0xa, 0x1000000000002, 0x0) r1 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0x40046207, &(0x7f0000000200)={0x4, 0x0, &(0x7f0000000100)=[@enter_looper], 0x1, 0x0, &(0x7f0000000180)='T'}) r2 = gettid() timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, &(0x7f0000040000)) tkill(r2, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0xfffffffffffffced, 0x0, &(0x7f0000000040)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x400c630f}], 0x0, 0x0, &(0x7f0000000f4d)}) 12:34:37 executing program 1: r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x2, 0x4, 0x3, 0x80003, 0x0, 0xffffffffffffffff, 0x0, [0xa]}, 0x2c) fcntl$getownex(r0, 0x10, &(0x7f0000000040)={0x0, 0x0}) sched_getaffinity(r1, 0x8, &(0x7f0000000080)) 12:34:37 executing program 4: socket$inet6(0xa, 0x0, 0x80000000) sched_setaffinity(0x0, 0x7, &(0x7f00000000c0)=0x9) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0) fcntl$setflags(0xffffffffffffffff, 0x2, 0x1) r0 = socket$inet6(0xa, 0x400000000001, 0x0) r1 = dup(r0) setsockopt$inet6_tcp_int(r1, 0x6, 0x12, &(0x7f0000000000)=0x7f, 0x4) bind$inet6(r0, &(0x7f0000000040)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) getsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER_VALUE(r0, 0x84, 0x7c, &(0x7f00000001c0)={0x0, 0x0, 0x6}, &(0x7f0000000240)=0x8) sendto$inet6(r0, &(0x7f00000004c0), 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x4) socket$inet6(0xa, 0x1000000000002, 0x0) r2 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046203, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000200)={0x4, 0x0, &(0x7f0000000100)=[@enter_looper], 0x1, 0x0, &(0x7f0000000180)='T'}) r3 = gettid() timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, &(0x7f0000040000)) tkill(r3, 0x1004000000016) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0xfffffffffffffced, 0x0, &(0x7f0000000040)}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x400c630f}], 0x0, 0x0, &(0x7f0000000f4d)}) 12:34:37 executing program 0: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f00000000c0)='\nqPp\x00\x00\x00\x00\x00\x00\x00') r1 = socket(0x10, 0x2, 0x0) getsockopt$sock_cred(r1, 0x1, 0x11, &(0x7f0000caaffb)={0x0, 0x0}, &(0x7f0000cab000)=0xc) setresuid(r2, r2, 0x0) r3 = getpid() socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$int_in(r4, 0x5452, &(0x7f00005ebff8)=0x3f) fcntl$setownex(r4, 0xf, &(0x7f0000704000)={0x0, r3}) recvmsg(r5, &(0x7f000095cfc8)={&(0x7f0000893ff8)=@sco, 0x8, &(0x7f00000a4fb0), 0x0, &(0x7f0000b30000)}, 0x0) acct(&(0x7f0000000080)='./file0\x00') r6 = dup2(r4, r5) write$eventfd(r6, &(0x7f0000000040), 0x8) 12:34:37 executing program 2: r0 = openat$vsock(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vsock\x00', 0x6b0dc928eae4623c, 0x0) ioctl$TUNSETOFFLOAD(r0, 0x400454d0, 0x19) perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f0000000180)=""/148, 0x13d}], 0x1, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000340)="696f001b66408225aaa3af068fffebb8a490c47dda6586f1b58895b94a78037dd3714e7198820a7a709e2d30d25e6d846cd5c62a648a598668a8263b752b0b622b115112b5ad8e0425c0b784bbdb89eb8f4da0dd73dd01fe35694c2f78600badf8a0e237dba40713bac9e053b41a9f62be5fbb928018aab5f7500bef51a2fd74d4fffb4a20a946733820bdc1b485afa417cdbcfdfbc54f58c9c3edffe240c36f4ab8a16613814e226b6d20d98010ab1ace49fa76dce337a5a5f1dcff9e5d533b12475e33b971b15b69cd591cd9059759f0f04ba5468a34b98915033debb3e87f048e8601712659d47d8687eb6be5e650068d88000000000000") preadv(r1, &(0x7f0000000480), 0x10000000000002a1, 0x0) msgget$private(0x0, 0x22) [ 500.452607] binder: BINDER_SET_CONTEXT_MGR already set [ 500.458023] binder: 26126:26133 ioctl 40046207 0 returned -16 12:34:37 executing program 5: syz_open_dev$sndctrl(&(0x7f0000000140)='/dev/snd/controlC#\x00', 0x0, 0x0) sched_setaffinity(0x0, 0x7, &(0x7f00000000c0)=0x9) r0 = perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0) fcntl$setflags(r0, 0x2, 0x1) getsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER_VALUE(0xffffffffffffffff, 0x84, 0x7c, &(0x7f00000001c0), &(0x7f0000000240)=0x8) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(0xffffffffffffffff, 0x84, 0x9, &(0x7f0000000280)={0x0, @in={{0x2, 0x4e23, @remote}}, 0xfffffffffffffff7, 0x0, 0x400}, 0x98) sendto$inet6(0xffffffffffffffff, &(0x7f00000004c0), 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) setsockopt$SO_BINDTODEVICE(0xffffffffffffffff, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x4) socket$inet6(0xa, 0x1000000000002, 0x0) r1 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0x5451, &(0x7f0000000200)={0x4, 0x0, &(0x7f0000000100)=[@enter_looper], 0x1, 0x0, &(0x7f0000000180)='T'}) r2 = gettid() timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, &(0x7f0000040000)) tkill(r2, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0xfffffffffffffced, 0x0, &(0x7f0000000040)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x400c630f}], 0x0, 0x0, &(0x7f0000000f4d)}) 12:34:37 executing program 2: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x13, &(0x7f00000000c0)=0x100000001, 0x1d4) connect$inet6(r0, &(0x7f0000000080), 0x1c) setsockopt$inet6_tcp_TCP_ULP(r0, 0x6, 0x1f, &(0x7f0000006580)='tls\x00', 0x95d59845436eab44) setsockopt$inet6_tcp_TLS_TX(0xffffffffffffffff, 0x11a, 0x1, &(0x7f0000000100), 0x28) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = socket(0x1e, 0x4, 0x0) r2 = socket(0x1e, 0x4, 0x0) setsockopt$packet_tx_ring(r2, 0x10f, 0x87, &(0x7f0000000080)=@req={0x3fc}, 0x10) setsockopt$packet_tx_ring(r1, 0x10f, 0x87, &(0x7f0000265000)=@req={0x3fc}, 0x10) sendmmsg(r1, &(0x7f0000000a40), 0x400000000000224, 0x0) accept4(r0, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000047ffc)=0x80, 0x0) sendmmsg(r0, &(0x7f0000005f00)=[{{&(0x7f0000004980)=@in6={0xa, 0x0, 0x0, @mcast1}, 0x80, &(0x7f0000001500), 0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB="18000000000000001a010000010000007d0000000000000040f63309ca5a26bd538d3a3105fa8f8972bd60dd41b80638afabe90abbfa896120daaa624b245360d5122c6f5678fc5122219818583a12bbe1971b9cc285023a533a007e14ebcdb56c7ef637e49df78076dc86b9cccb33d2c91ced9f2f81a0be3205482fc03dd9d1d04f"], 0x82}}], 0x1, 0x0) connect(r0, &(0x7f0000000540)=@in6={0xa, 0x0, 0x0, @dev, 0x3}, 0x80) perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f0000000180)=""/148, 0x13d}], 0x1, 0x0) r3 = syz_open_procfs(0x0, &(0x7f0000000340)="696f001b66408225aaa3af068fffebb8a490c47dda6586f1b58895b94a78037dd3714e7198820a7a709e2d30d25e6d846cd5c62a648a598668a8263b752b0b622b115112b5ad8e0425c0b784bbdb89eb8f4da0dd73dd01fe35694c2f78600badf8a0e237dba40713bac9e053b41a9f62be5fbb928018aab5f7500bef51a2fd74d4fffb4a20a946733820bdc1b485afa417cdbcfdfbc54f58c9c3edffe240c36f4ab8a16613814e226b6d20d98010ab1ace49fa76dce337a5a5f1dcff9e5d533b12475e33b971b15b69cd591cd9059759f0f04ba5468a34b98915033debb3e87f048e8601712659d47d8687eb6be5e650068d88000000000000") preadv(r3, &(0x7f0000000480), 0x10000000000002a1, 0x0) msgget$private(0x0, 0x22) [ 500.539012] binder: BINDER_SET_CONTEXT_MGR already set [ 500.558079] binder: 26182:26184 ioctl 40046207 20000200 returned -16 [ 500.567414] binder: 26175:26181 ioctl 40046203 0 returned -22 12:34:38 executing program 1: syz_open_dev$sndctrl(&(0x7f0000000140)='/dev/snd/controlC#\x00', 0x0, 0x0) sched_setaffinity(0x0, 0x7, &(0x7f00000000c0)=0x9) r0 = perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0) fcntl$setflags(r0, 0x2, 0x1) getsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER_VALUE(0xffffffffffffffff, 0x84, 0x7c, &(0x7f00000001c0), &(0x7f0000000240)=0x8) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(0xffffffffffffffff, 0x84, 0x9, &(0x7f0000000280)={0x0, @in={{0x2, 0x4e23, @remote}}, 0xfffffffffffffff7, 0x0, 0x400}, 0x98) sendto$inet6(0xffffffffffffffff, &(0x7f00000004c0), 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) setsockopt$SO_BINDTODEVICE(0xffffffffffffffff, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x4) socket$inet6(0xa, 0x1000000000002, 0x0) r1 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0x40046205, &(0x7f0000000200)={0x4, 0x0, &(0x7f0000000100)=[@enter_looper], 0x1, 0x0, &(0x7f0000000180)='T'}) r2 = gettid() timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, &(0x7f0000040000)) tkill(r2, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0xfffffffffffffced, 0x0, &(0x7f0000000040)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x400c630f}], 0x0, 0x0, &(0x7f0000000f4d)}) 12:34:38 executing program 0: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = syz_open_procfs(0x0, &(0x7f0000000140)='ns\x00') getsockopt$bt_l2cap_L2CAP_CONNINFO(r1, 0x6, 0x2, &(0x7f0000000040), &(0x7f0000000080)=0x6) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x2) [ 500.651628] binder: 26175:26196 ioctl 40046203 0 returned -22 [ 500.665977] binder: BINDER_SET_CONTEXT_MGR already set [ 500.727383] binder: 26175:26197 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 [ 500.738319] binder: 26193:26195 ioctl 40046207 0 returned -16 [ 500.768249] binder: BINDER_SET_CONTEXT_MGR already set 12:34:38 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) getsockopt$sock_int(r0, 0x1, 0x6520e75ca2781154, &(0x7f0000000000), &(0x7f0000000040)=0x4) r1 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000080)='/dev/rtc0\x00', 0x404800, 0x0) ioctl$TUNGETFEATURES(r1, 0x800454cf, &(0x7f00000000c0)) write$uinput_user_dev(r1, &(0x7f0000000100)={'syz0\x00', {0x1, 0x1ff, 0x6, 0x400}, 0x14, [0x5, 0x42ea, 0x1, 0xb659, 0x0, 0x1, 0x2, 0x2, 0x7, 0x81, 0x3ff, 0x1ff, 0x8000, 0x4, 0x6, 0xfffffffffffffff9, 0xfffffffffffffff7, 0x9549, 0x33d6c807, 0xfffffffffffffffb, 0x3, 0x3, 0x101, 0xfffffffffffffff7, 0xf2f, 0x7, 0x5, 0x85c, 0x9, 0x2, 0x4, 0x8, 0x10000, 0x6bb, 0x1, 0x7b4, 0x5, 0xfffffffffffffff8, 0x4, 0x5, 0x7, 0x8, 0x9, 0x401, 0x4000400000, 0x6, 0x9, 0x100, 0x400, 0x71, 0x6a, 0x7ff, 0x7, 0xffffffff, 0x0, 0x3, 0x7, 0x4, 0x9, 0x7, 0xfffffffffffffff7, 0x100000001, 0x4b, 0x6], [0x8001, 0x0, 0xfffffffeffffffff, 0x1000, 0x2, 0x80000001, 0x1ff, 0x8, 0x8, 0x10001, 0x7, 0xf7, 0x65, 0x0, 0x1, 0x5, 0x79, 0x1, 0xb1, 0x2, 0xfffffffffffffb10, 0x5, 0x5ed5, 0x4563, 0x0, 0x8, 0x3f, 0x5, 0x100, 0x4, 0x5, 0x7, 0x7f, 0x7, 0x3, 0x1, 0x5, 0x100000000, 0x1, 0xfffffffffffffa1e, 0x7, 0x1, 0x3f, 0xe4, 0x4ea4, 0x6, 0x1, 0x0, 0x1, 0x1f, 0x5, 0x515, 0xf33, 0x437f, 0x800, 0x10001, 0x2, 0x7fffffff, 0x2, 0x5, 0x8, 0x10001, 0x5ed, 0xfffffffffffffeff], [0x9e, 0x8, 0x3, 0x3ff, 0x5, 0x5, 0x3183188a, 0x1, 0x0, 0x91, 0x6, 0x7c, 0xbe, 0x7, 0x3, 0x6, 0x0, 0x8000, 0xfffffffffffffff8, 0x3, 0x2, 0x8001, 0x1ff, 0x0, 0x6092, 0x7, 0x4, 0x8, 0x3, 0xf92, 0x3, 0x8b, 0x5, 0x80, 0xe4cb, 0x8e8a, 0x20, 0x3, 0x100000000, 0x100000001, 0x1f, 0x1200000000, 0x0, 0x5, 0x4, 0x8, 0x80, 0x1ff, 0x20d, 0xff, 0x7, 0x3, 0xfff, 0x6, 0x9, 0x3af, 0x6000000, 0x54, 0x80000000, 0x1, 0x5, 0x4ca4e90, 0x7c, 0xffff], [0x100000001, 0x401, 0x3, 0x9, 0x8001, 0x7, 0x80000000000000, 0x4, 0x7ff, 0x7, 0x7ff, 0x5, 0x0, 0xffffffffffffffff, 0x82, 0x1000, 0x5, 0x8, 0x2, 0x8, 0x9, 0x36, 0xffffffffffff8001, 0x7fffffff, 0x800, 0xdf47, 0x9, 0x5, 0xfffffffffffff647, 0x0, 0xfe9, 0xbe2, 0x7f, 0x1000, 0x7, 0xfffffffffffffc6c, 0x10001, 0x7, 0x2, 0x8, 0x1, 0x3ff, 0x8, 0x2, 0x8, 0xd23, 0x6, 0x1, 0x200, 0x1, 0x6, 0xfab, 0x7f, 0x0, 0x8, 0x5, 0x3, 0x4, 0x7, 0x81, 0x3, 0x20, 0x40, 0x400]}, 0x45c) get_mempolicy(&(0x7f0000000580), &(0x7f00000005c0), 0x4, &(0x7f0000fff000/0x1000)=nil, 0x4) ppoll(&(0x7f0000000600)=[{r0, 0x200}, {r1, 0x1}, {r1, 0x4}], 0x3, &(0x7f0000000640)={0x77359400}, &(0x7f0000000680)={0x7}, 0x8) openat$uhid(0xffffffffffffff9c, &(0x7f00000006c0)='/dev/uhid\x00', 0x2, 0x0) write$tun(r1, &(0x7f0000000700)={@val={0x0, 0xdafa}, @val={0x1, 0x81, 0x7, 0x2, 0x4e, 0x4}, @ipv4={{0x45, 0x4, 0xa8cc, 0x9, 0x199, 0x68, 0xffffffffffffffe3, 0x3, 0xdd, 0x0, @multicast2, @empty, {[@ssrr={0x89, 0x17, 0x8, [@empty, @broadcast, @multicast1, @empty, @multicast2]}, @cipso={0x86, 0x56, 0x100, [{0x2, 0x4, "d205"}, {0x7, 0x11, "15c41c4eef072cdbc81865a55946c0"}, {0x2, 0xc, "f3028ab519e43a24a309"}, {0x1, 0x5, "d7b2e6"}, {0x0, 0xe, "bcba370c223f75f1da8e4917"}, {0x6, 0x2}, {0x1, 0x3, '\b'}, {0x0, 0xb, "29fbcea269d6eccda4"}, {0x5, 0xc, "f36e12e7b6f8764349be"}]}, @rr={0x7, 0x1b, 0x4, [@broadcast, @local, @remote, @broadcast, @broadcast, @local]}, @ssrr={0x89, 0x23, 0x1, [@local, @loopback, @rand_addr=0x4, @loopback, @remote, @remote, @multicast1, @local]}, @ra={0x94, 0x6, 0x7}, @rr={0x7, 0x1f, 0x9, [@empty, @remote, @rand_addr=0x2, @empty, @rand_addr=0x7, @remote, @multicast2]}, @ssrr={0x89, 0x17, 0x7, [@empty, @dev={0xac, 0x14, 0x14, 0x1b}, @remote, @rand_addr=0x43d, @multicast1]}, @generic={0x0, 0x6, "b684858d"}, @ra={0x94, 0x6, 0x10001}, @rr={0x7, 0xb, 0x4, [@loopback, @dev={0xac, 0x14, 0x14, 0xc}]}]}}, @igmp={0x11, 0x100, 0x0, @loopback, "b5e02c25c140f67c26bf7788fe7efeef85d3a1293609511df7b888c760ab759eda6587d88c573f7e6bc262a1c530e4a05654445d0aac4b410f0824b5a88da8d389ae7e93e0b50d3b14b6b7c6d068a07b42d0074a350f56f28fb8685dc08b883468a127c99104fc944479076a75e616e14c4d0d7b118df9582390d23cec"}}}, 0x1a7) getsockopt$inet6_IPV6_XFRM_POLICY(r1, 0x29, 0x23, &(0x7f0000000900)={{{@in=@multicast1, @in=@multicast2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@remote}, 0x0, @in6=@ipv4={[], [], @local}}}, &(0x7f0000000a00)=0xe8) sendmsg$nl_generic(r1, &(0x7f0000000ac0)={&(0x7f00000008c0)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f0000000a80)={&(0x7f0000000a40)={0x1c, 0x38, 0xd1c, 0x70bd27, 0x25dfdbfc, {0xc}, [@typed={0x8, 0x63, @uid=r2}]}, 0x1c}, 0x1, 0x0, 0x0, 0x4090}, 0x40) ioctl$LOOP_CHANGE_FD(r1, 0x4c06, r1) ioctl$UFFDIO_COPY(r1, 0xc028aa03, &(0x7f0000000b00)={&(0x7f0000fff000/0x1000)=nil, &(0x7f0000fff000/0x1000)=nil, 0x1000, 0x1}) ioctl$ASHMEM_SET_NAME(r1, 0x41007701, &(0x7f0000000b40)='vboxnet0ppp0lo\x00') ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x2400, 0x7) r3 = semget$private(0x0, 0x1, 0x0) semctl$SETALL(r3, 0x0, 0x11, &(0x7f0000000b80)=[0x3, 0x1, 0xcf3e, 0x42, 0x6, 0x6, 0x9, 0x7ff0000]) ioctl$sock_bt_bnep_BNEPCONNADD(r1, 0x400442c8, &(0x7f0000000bc0)={r0, 0xb3, 0x7f, "94ce75eb1642fc3c84d5c7a1e905090dae6c9b41ad85e7d1b6ce7d643b3885e88de836a8f1d2a80e917f3c1b40c605969267aff404f2da644282bd736db2030ff4e453b1f8b4a627bd36bef10052483489f04ccb0b18cb341604e7a291848f95723fb60000652613a98d5970adbc27014d74431c6230e54a3da19d726c29ee50839bdee3dcfa360e4e1011b5ff52168f775ff2b6e3af6478beabdaba6a2f31566224c27c2f"}) ioctl$SNDRV_TIMER_IOCTL_GPARAMS(r1, 0x40485404, &(0x7f0000000c80)={{0x1, 0x1, 0x1f, 0x3, 0x20}, 0x5, 0x7fff}) r4 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000d40)='IPVS\x00') sendmsg$IPVS_CMD_GET_DAEMON(r1, &(0x7f0000000e40)={&(0x7f0000000d00)={0x10, 0x0, 0x0, 0x100201}, 0xc, &(0x7f0000000e00)={&(0x7f0000000d80)={0x54, r4, 0x1, 0x70bd2b, 0x25dfdbff, {}, [@IPVS_CMD_ATTR_SERVICE={0xc, 0x1, [@IPVS_SVC_ATTR_PE_NAME={0x8, 0xb, 'sip\x00'}]}, @IPVS_CMD_ATTR_SERVICE={0xc, 0x1, [@IPVS_SVC_ATTR_PE_NAME={0x8, 0xb, 'sip\x00'}]}, @IPVS_CMD_ATTR_DAEMON={0xc, 0x3, [@IPVS_DAEMON_ATTR_MCAST_GROUP={0x8}]}, @IPVS_CMD_ATTR_SERVICE={0xc, 0x1, [@IPVS_SVC_ATTR_FWMARK={0x8, 0x5, 0x2}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5, 0x5}, @IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0x20}]}, 0x54}, 0x1, 0x0, 0x0, 0x20000800}, 0x0) ioctl$UFFDIO_COPY(r1, 0xc028aa03, &(0x7f0000000e80)={&(0x7f0000ff9000/0x4000)=nil, &(0x7f0000ffe000/0x2000)=nil, 0x4000, 0x1}) getsockopt$packet_int(r1, 0x107, 0x12, &(0x7f0000000ec0), &(0x7f0000000f00)=0x4) accept4(r1, &(0x7f0000000f40)=@l2, &(0x7f0000000fc0)=0x80, 0x80000) mmap$xdp(&(0x7f0000ff3000/0xa000)=nil, 0xa000, 0x100000a, 0x40050, r1, 0x180000000) write$binfmt_script(r0, &(0x7f0000001000)={'#! ', './file0', [{0x20, '/dev/uhid\x00'}, {0x20, 'IPVS\x00'}], 0xa, "565d4ffbf79961cdf21c167f4c902cdab25428c8445ee503da8dfe34bc914673296c852196a0a872defc6fe94457f26c9e90449b5712b0f5f49c5e81abae8be1b6ce392d246612bc1d251fa5401ab0462940979345566ecb8898e97ee7c6bf30e6e6cd9b2c1f6dd189d106bdb58c9bcf4ba226d1"}, 0x90) ioctl$UI_SET_PROPBIT(r1, 0x4004556e, 0x16) ioctl$sock_inet6_tcp_SIOCATMARK(r1, 0x8905, &(0x7f00000010c0)) ioctl$DRM_IOCTL_RM_CTX(r1, 0xc0086421, 0xffffffffffffffff) ioctl$EVIOCGKEYCODE(r1, 0x80084504, &(0x7f0000001100)) 12:34:38 executing program 4: socket$inet6(0xa, 0x0, 0x80000000) sched_setaffinity(0x0, 0x7, &(0x7f00000000c0)=0x9) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0) fcntl$setflags(0xffffffffffffffff, 0x2, 0x1) r0 = socket$inet6(0xa, 0x400000000001, 0x0) r1 = dup(r0) setsockopt$inet6_tcp_int(r1, 0x6, 0x12, &(0x7f0000000000)=0x7f, 0x4) bind$inet6(r0, &(0x7f0000000040)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) getsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER_VALUE(r0, 0x84, 0x7c, &(0x7f00000001c0)={0x0, 0x0, 0x6}, &(0x7f0000000240)=0x8) sendto$inet6(r0, &(0x7f00000004c0), 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x4) socket$inet6(0xa, 0x1000000000002, 0x0) r2 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0xc0189436, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000200)={0x4, 0x0, &(0x7f0000000100)=[@enter_looper], 0x1, 0x0, &(0x7f0000000180)='T'}) r3 = gettid() timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, &(0x7f0000040000)) tkill(r3, 0x1004000000016) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0xfffffffffffffced, 0x0, &(0x7f0000000040)}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x400c630f}], 0x0, 0x0, &(0x7f0000000f4d)}) [ 500.805468] binder: 26202:26203 ioctl 40046207 0 returned -16 12:34:38 executing program 0: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8000008912, &(0x7f00000000c0)='`p\x00\x00\x00\x00\x00\x00\x00\x00\x00') mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0) r1 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000100)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000080)='fuse\x00', 0x0, &(0x7f0000000400)={{'fd', 0x3d, r1}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}}) write$FUSE_NOTIFY_STORE(r1, &(0x7f0000000040)={0x29, 0x4, 0x0, {0x1, 0x0, 0x1, 0x0, [0x0]}}, 0x29) 12:34:38 executing program 3: syz_open_dev$sndctrl(&(0x7f0000000140)='/dev/snd/controlC#\x00', 0x0, 0x0) sched_setaffinity(0x0, 0x7, &(0x7f00000000c0)=0x9) r0 = perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0) fcntl$setflags(r0, 0x2, 0x1) getsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER_VALUE(0xffffffffffffffff, 0x84, 0x7c, &(0x7f00000001c0), &(0x7f0000000240)=0x8) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(0xffffffffffffffff, 0x84, 0x9, &(0x7f0000000280)={0x0, @in={{0x2, 0x4e23, @remote}}, 0xfffffffffffffff7, 0x0, 0x400}, 0x98) sendto$inet6(0xffffffffffffffff, &(0x7f00000004c0), 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) setsockopt$SO_BINDTODEVICE(0xffffffffffffffff, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x4) socket$inet6(0xa, 0x1000000000002, 0x0) r1 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x4, 0xfdfdffff, &(0x7f0000000100)=[@enter_looper], 0x1, 0x0, &(0x7f0000000180)='T'}) r2 = gettid() timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, &(0x7f0000040000)) tkill(r2, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0xfffffffffffffced, 0x0, &(0x7f0000000040)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x400c630f}], 0x0, 0x0, &(0x7f0000000f4d)}) 12:34:38 executing program 0: bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000200)={0x0, 0xffffffffffffffff, 0x0, 0x6, &(0x7f00000001c0)='wlan0\x00', 0xffffffffffffffff}, 0x30) r1 = syz_open_procfs(r0, &(0x7f0000000500)='sessionid\x00') r2 = syz_open_procfs(0x0, &(0x7f00000004c0)='net/if_inet6\x00') socketpair$inet_udplite(0x2, 0x2, 0x88, &(0x7f0000000280)) preadv(r2, &(0x7f0000000000)=[{&(0x7f00000002c0)=""/169, 0xa9}], 0x1, 0x0) ioctl$SCSI_IOCTL_GET_BUS_NUMBER(r2, 0x5386, &(0x7f0000000140)) fchdir(r1) openat$cgroup_procs(r1, &(0x7f0000000240)='cgroup.threads\x00', 0x2, 0x0) accept$unix(r2, &(0x7f0000000040)=@abs, &(0x7f00000000c0)=0x6e) socketpair$inet_udplite(0x2, 0x2, 0x88, &(0x7f0000000180)) quotactl(0x2080000209, &(0x7f0000000100)='./file1\x00', 0x0, &(0x7f00000002c0)) sendmsg$kcm(r2, &(0x7f0000000480)={&(0x7f0000000380)=@pptp={0x18, 0x2, {0x2, @multicast1}}, 0x80, &(0x7f0000000440)=[{&(0x7f0000000400)="6f28775148be4304ae1480fec41b5815c1ef11d3ca8b7bc9ffda0f704c07a84e0214c378147f42730f9590b0adec328c727379b531194fec2f02", 0x3a}, {&(0x7f0000000540)="a8c04f7b93392620136fc13beea69c6b68ec812742069642bbe9021f0d51e67d9cb0aceb74df42610648c9a2fec6d31f8216b9d50744902653799bdd2c1807ec14016d7a06f269a0b25233793ed6bc21a561335bc11eadd9274bf5b19bc1639851979a3a10821751121433eb6680d1c0bb43019bd32597c32413e956c2e5a0f267c45e6c6748ac787c11bc5fe46fc51233f6b0701af2d9ea40b933dcc58194bf9d45c2ee3aa7b2074b62200e82613881dad23016709261af50b9271eaba2b02151538cfdc9636388f946561ef8ffb2255fbd28", 0xd3}], 0x2, &(0x7f0000000640)=[{0x88, 0x113, 0x32, "a811b98873a0bda791484b6a3b4bfe5bd1164772a97cee0d40a7cb26d724d758b8ae091321271015bed67459fdb5723804ebd2a6ea1c14afce42e79d317e223725af4ba919535fe009a76027012ca6dc484030cb4d0dea9e31488ac486040568e4550126b161af24805893b8b3d638b7273e9d3a4e31bc26"}, {0xd8, 0x3b, 0x6, "7b1a80460827f5fb21b4e2e7eba693d9b60858547360622e1be0860667b8f6e3cf58b126c6a5cff3e8d309960f572aa12cb429659126b3c7354a24a713f7a1f8a9f931b38ee580ccaa4b8bcbb6acc7444f1a2eb4ffabc1613a8f48bf7e19bc2ca8a409469bb7bc1636dc145b520f4c60d5ffa68cf056712a09211ed15d8a11bd0610faa6beced25b20ae42716123c319c9ed0a83b4ab4a5a1c8afd98f065f9dff1f6a12856f5ae8a44de1fe675095b32d09915d78faea12be29f40a5ada82d6324eea95f195ee2c3"}, {0xb8, 0x116, 0xc6, "ce29e0e3b7d07308d5f4df5c04a9dfcd505daec6d93a72723792da57ceb758cab09c548263dc8c5c978832bb78c45b61a17e61f96d1f6485b9f801ef325ebdd56a48273446e19e519294d71b721b180fa01e165f29013a629cbf3cbf3a74f5ab2ac2a3d1e7fad4e80b038a5d1c0acd677b990b648a8357ef86da6fb9c0a583207da84080412f429d2365f0bc4a5ca02c43e8eb114133fa4a8cc11aede2c46bc91d30f179a2"}, {0x90, 0x117, 0x5, "b8494f3be1ef1b541581cea50497f050b4da9a9453efe04c8834505d6acbd0386ca3c22eac929d65d0c907d58b41a0475b5075a1513a6630737372d2be9659935b2eada6a0de08fefdcdad08760842d79071c81c9f8a587cc57e49b29d35bf314c60712b4ef21c7164a60b26cead25ceda90057aedb05f4acbef40e4"}, {0x88, 0x195, 0x3f, "056162e06f116fc148969f9d86bddfa84d984bb11db673f0875b480d452edad407e6c02902aed266a024af0540cb81153ee6ecd5a5d0ab1b368a9bd10da0334227986b3c8a8d85608e5da650cdc932063734da26ca28a49e3ba1f6112988caf9c97253b5f5a0a44a192c22b900b244b8febc3a"}, {0xc8, 0x11f, 0xffffffffffffff1f, "0edefd17702b14c2680c23c74efdc9a4df995a663e9f7bab0234fb94ac84f98438176524683bda5de4ea86347d304be7e2120c8bd72d4fc28282bfd3a8be3ce583b2a0d7b0c2fcd95c88df6b0f8702e8955e43233d4ecdcadee942627b8a3f43e5f8abcb48d9f0b462c99feb17c54e4d24cf3f90bfccd045bfd44a73b40405b6f88d109eab7ca137ab3cc9d62a500c3f886f52852df8ec74beb6f46a6c0cf180469657a758cf51e2390d37d8b0c68d79605c993f"}, {0x108, 0x6, 0x1, "3eb68641242e7e1217f76895d2eebbebf3cddd08ee7fceaec12c0ac6cb213896f2b0911350d9e51c3f47a4bd5fe56be58a625613b703731b678556c0ee03f372b2e6a0543294e7df365eccc3dc8e016a6fb0b04d1942879ac71b9a9dd8c5e46cd21e464d20199c96803d9e10f3f146f14db13d6c2329a7576286671efed768f8e9f96917d48caf420071287c41f854dff73af42fd3ed81c7cc16125b2a2de40200d7b7c330f397131d9a55fe2e46ac2d4bc3ace6a826575ee63ec07e6a9e2b2db80caa9e9a7190ca25fc43b932a709090d9760e4a534b17cb37b9e0459453fdf6c289cb1518cf10f8675b2f30868929f2c3e3de0b8"}], 0x500}, 0x20000084) 12:34:38 executing program 4: socket$inet6(0xa, 0x0, 0x80000000) sched_setaffinity(0x0, 0x7, &(0x7f00000000c0)=0x9) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0) fcntl$setflags(0xffffffffffffffff, 0x2, 0x1) r0 = socket$inet6(0xa, 0x400000000001, 0x0) r1 = dup(r0) setsockopt$inet6_tcp_int(r1, 0x6, 0x12, &(0x7f0000000000)=0x7f, 0x4) bind$inet6(r0, &(0x7f0000000040)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) getsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER_VALUE(r0, 0x84, 0x7c, &(0x7f00000001c0)={0x0, 0x0, 0x6}, &(0x7f0000000240)=0x8) sendto$inet6(r0, &(0x7f00000004c0), 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x4) socket$inet6(0xa, 0x1000000000002, 0x0) r2 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0xc0306201, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000200)={0x4, 0x0, &(0x7f0000000100)=[@enter_looper], 0x1, 0x0, &(0x7f0000000180)='T'}) r3 = gettid() timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, &(0x7f0000040000)) tkill(r3, 0x1004000000016) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0xfffffffffffffced, 0x0, &(0x7f0000000040)}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x400c630f}], 0x0, 0x0, &(0x7f0000000f4d)}) 12:34:38 executing program 2: perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f0000000180)=""/148, 0x13d}], 0x1, 0x0) r0 = open(&(0x7f0000000000)='./file0\x00', 0x400802, 0x20) ioctl$KVM_ASSIGN_PCI_DEVICE(r0, 0x8040ae69, &(0x7f0000000040)={0x6, 0x3f, 0x7fff, 0x4, 0xeec}) r1 = syz_open_procfs(0x0, &(0x7f0000000340)="696f001b66408225aaa3af068fffebb8a490c47dda6586f1b58895b94a78037dd3714e7198820a7a709e2d30d25e6d846cd5c62a648a598668a8263b752b0b622b115112b5ad8e0425c0b784bbdb89eb8f4da0dd73dd01fe35694c2f78600badf8a0e237dba40713bac9e053b41a9f62be5fbb928018aab5f7500bef51a2fd74d4fffb4a20a946733820bdc1b485afa417cdbcfdfbc54f58c9c3edffe240c36f4ab8a16613814e226b6d20d98010ab1ace49fa76dce337a5a5f1dcff9e5d533b12475e33b971b15b69cd591cd9059759f0f04ba5468a34b98915033debb3e87f048e8601712659d47d8687eb6be5e650068d88000000000000") preadv(r1, &(0x7f0000000480), 0x10000000000002a1, 0x0) msgget$private(0x0, 0x22) ioctl$KVM_DEASSIGN_PCI_DEVICE(r1, 0x4040ae72, &(0x7f00000000c0)={0x5, 0x8, 0x8, 0x5, 0x101}) pipe(&(0x7f0000000080)) [ 501.319004] binder: BINDER_SET_CONTEXT_MGR already set [ 501.324814] binder: 26182:26192 ioctl 40046207 0 returned -16 [ 501.330917] binder: BINDER_SET_CONTEXT_MGR already set [ 501.336499] binder: 26182:26192 ioctl 40046207 20000200 returned -16 12:34:38 executing program 0: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$inet_udp(0x2, 0x2, 0x0) r1 = syz_open_dev$admmidi(&(0x7f0000000040)='/dev/admmidi#\x00', 0x0, 0x1) ioctl$BLKIOOPT(r1, 0x1279, &(0x7f00000000c0)) setsockopt$inet_mreqsrc(r0, 0x0, 0x27, &(0x7f0000000080)={@dev={0xac, 0x14, 0x14, 0xf}, @remote, @remote}, 0xc) r2 = shmget(0x2, 0x4000, 0x54000000, &(0x7f0000ff9000/0x4000)=nil) shmctl$IPC_STAT(r2, 0x2, &(0x7f0000000140)=""/170) setsockopt$netlink_NETLINK_PKTINFO(r1, 0x10e, 0x3, &(0x7f0000000100)=0x2, 0x4) preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f0000001200)=""/148, 0x94}], 0x100000c7, 0x0) r3 = syz_open_procfs(0x0, &(0x7f0000000280)='net/mcfilter\x00') preadv(r3, &(0x7f0000000480), 0x100000000000022c, 0x0) ioctl$BLKIOOPT(r3, 0x1279, &(0x7f0000000000)) 12:34:38 executing program 5: syz_open_dev$sndctrl(&(0x7f0000000140)='/dev/snd/controlC#\x00', 0x0, 0x0) sched_setaffinity(0x0, 0x7, &(0x7f00000000c0)=0x9) r0 = perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0) fcntl$setflags(r0, 0x2, 0x1) getsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER_VALUE(0xffffffffffffffff, 0x84, 0x7c, &(0x7f00000001c0), &(0x7f0000000240)=0x8) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(0xffffffffffffffff, 0x84, 0x9, &(0x7f0000000280)={0x0, @in={{0x2, 0x4e23, @remote}}, 0xfffffffffffffff7, 0x0, 0x400}, 0x98) sendto$inet6(0xffffffffffffffff, &(0x7f00000004c0), 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) setsockopt$SO_BINDTODEVICE(0xffffffffffffffff, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x4) socket$inet6(0xa, 0x1000000000002, 0x0) r1 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0x5451, &(0x7f0000000200)={0x4, 0x0, &(0x7f0000000100)=[@enter_looper], 0x1, 0x0, &(0x7f0000000180)='T'}) r2 = gettid() timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, &(0x7f0000040000)) tkill(r2, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0xfffffffffffffced, 0x0, &(0x7f0000000040)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x400c630f}], 0x0, 0x0, &(0x7f0000000f4d)}) [ 501.472245] binder: 26234:26235 ioctl c0306201 0 returned -14 12:34:38 executing program 2: pipe2(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}, 0x800) perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) fcntl$setstatus(r1, 0x4, 0x4000) preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f0000000180)=""/148, 0x13d}], 0x1, 0x0) r2 = syz_open_procfs(0x0, &(0x7f0000000340)="696f001b66408225aaa3af068fffebb8a490c47dda6586f1b58895b94a78037dd3714e7198820a7a709e2d30d25e6d846cd5c62a648a598668a8263b752b0b622b115112b5ad8e0425c0b784bbdb89eb8f4da0dd73dd01fe35694c2f78600badf8a0e237dba40713bac9e053b41a9f62be5fbb928018aab5f7500bef51a2fd74d4fffb4a20a946733820bdc1b485afa417cdbcfdfbc54f58c9c3edffe240c36f4ab8a16613814e226b6d20d98010ab1ace49fa76dce337a5a5f1dcff9e5d533b12475e33b971b15b69cd591cd9059759f0f04ba5468a34b98915033debb3e87f048e8601712659d47d8687eb6be5e650068d88000000000000") socket$key(0xf, 0x3, 0x2) getsockopt$bt_sco_SCO_CONNINFO(r0, 0x11, 0x2, &(0x7f0000000280)=""/134, &(0x7f0000000100)=0x86) preadv(r2, &(0x7f0000000480), 0x10000000000002a1, 0x0) getsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER(r2, 0x84, 0x7b, &(0x7f0000000040)={0x0, 0x2b}, &(0x7f0000000080)=0x8) setsockopt$inet_sctp6_SCTP_RTOINFO(r2, 0x84, 0x0, &(0x7f00000000c0)={r3, 0x40, 0x4, 0xffffffffffffff8f}, 0x10) msgget$private(0x0, 0x22) 12:34:38 executing program 1: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070") clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000000), 0xffffffffffffffff) fstat(0xffffffffffffffff, &(0x7f00000002c0)) r1 = getpid() sched_setscheduler(r1, 0x5, &(0x7f0000000200)) futex(&(0x7f0000000080), 0x100000004, 0x0, &(0x7f00000000c0), &(0x7f00000acffd), 0x0) getpid() pipe(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$GIO_FONTX(r2, 0x4b6b, &(0x7f0000000100)=""/13) [ 501.561930] binder: 26234:26252 ioctl c0306201 0 returned -14 [ 501.580176] binder: BINDER_SET_CONTEXT_MGR already set [ 501.596924] binder: 26248:26249 ioctl 40046207 0 returned -16 12:34:39 executing program 1: r0 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_int(r0, 0x107, 0x2040000000f, &(0x7f0000000000)=0x100, 0x4) r1 = syz_open_procfs(0x0, &(0x7f0000000100)='schedstat\x00') setsockopt$bt_BT_RCVMTU(r1, 0x112, 0xd, &(0x7f0000000140)=0x50000, 0x2) setsockopt$SO_TIMESTAMPING(r0, 0x1, 0x25, &(0x7f0000000040)=0x183, 0x4) sendto$inet6(r0, &(0x7f00000000c0)="04040000070000000000", 0xa, 0x0, &(0x7f0000000080)={0xa, 0x0, 0x20000000003, @remote}, 0x1c) 12:34:39 executing program 4: socket$inet6(0xa, 0x0, 0x80000000) sched_setaffinity(0x0, 0x7, &(0x7f00000000c0)=0x9) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0) fcntl$setflags(0xffffffffffffffff, 0x2, 0x1) r0 = socket$inet6(0xa, 0x400000000001, 0x0) r1 = dup(r0) setsockopt$inet6_tcp_int(r1, 0x6, 0x12, &(0x7f0000000000)=0x7f, 0x4) bind$inet6(r0, &(0x7f0000000040)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) getsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER_VALUE(r0, 0x84, 0x7c, &(0x7f00000001c0)={0x0, 0x0, 0x6}, &(0x7f0000000240)=0x8) sendto$inet6(r0, &(0x7f00000004c0), 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x4) socket$inet6(0xa, 0x1000000000002, 0x0) r2 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000200)={0x4, 0x0, &(0x7f0000000100)=[@enter_looper], 0x1, 0x0, &(0x7f0000000180)='T'}) r3 = gettid() timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, &(0x7f0000040000)) tkill(r3, 0x1004000000016) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0xfffffffffffffced, 0x0, &(0x7f0000000040)}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x400c630f}], 0x0, 0x0, &(0x7f0000000f4d)}) 12:34:39 executing program 2: r0 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x10b800, 0x0) ioctl$TIOCGPGRP(r0, 0x540f, &(0x7f0000000080)) perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f0000000180)=""/148, 0x13d}], 0x1, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000340)="696f001b66408225aaa3af068fffebb8a490c47dda6586f1b58895b94a78037dd3714e7198820a7a709e2d30d25e6d846cd5c62a648a598668a8263b752b0b622b115112b5ad8e0425c0b784bbdb89eb8f4da0dd73dd01fe35694c2f78600badf8a0e237dba40713bac9e053b41a9f62be5fbb928018aab5f7500bef51a2fd74d4fffb4a20a946733820bdc1b485afa417cdbcfdfbc54f58c9c3edffe240c36f4ab8a16613814e226b6d20d98010ab1ace49fa76dce337a5a5f1dcff9e5d533b12475e33b971b15b69cd591cd9059759f0f04ba5468a34b98915033debb3e87f048e8601712659d47d8687eb6be5e650068d88000000000000") preadv(r1, &(0x7f0000000480), 0x10000000000002a1, 0x0) msgget$private(0x0, 0x22) 12:34:39 executing program 1: mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount(&(0x7f0000000100), &(0x7f00000001c0)='./file0\x00', &(0x7f0000000140)='cgroup2\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x125c00000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000000, 0x0, 0xfffffffffffffffe, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfb90, 0x0, 0x2000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp, 0x0, 0x0, 0x0, 0x6}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mknod$loop(&(0x7f00000000c0)='./file0\x00', 0x0, 0x0) keyctl$session_to_parent(0x12) pivot_root(&(0x7f0000000040)='./file0\x00', &(0x7f0000000080)='./file0\x00') [ 501.882496] binder: 26271:26272 ioctl c018620b 0 returned -14 [ 501.970273] binder: 26271:26272 ioctl c018620b 0 returned -14 12:34:39 executing program 3: syz_open_dev$sndctrl(&(0x7f0000000140)='/dev/snd/controlC#\x00', 0x0, 0x0) sched_setaffinity(0x0, 0x7, &(0x7f00000000c0)=0x9) r0 = perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0) fcntl$setflags(r0, 0x2, 0x1) getsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER_VALUE(0xffffffffffffffff, 0x84, 0x7c, &(0x7f00000001c0), &(0x7f0000000240)=0x8) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(0xffffffffffffffff, 0x84, 0x9, &(0x7f0000000280)={0x0, @in={{0x2, 0x4e23, @remote}}, 0xfffffffffffffff7, 0x0, 0x400}, 0x98) sendto$inet6(0xffffffffffffffff, &(0x7f00000004c0), 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) setsockopt$SO_BINDTODEVICE(0xffffffffffffffff, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x4) socket$inet6(0xa, 0x1000000000002, 0x0) r1 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x4, 0x3f00, &(0x7f0000000100)=[@enter_looper], 0x1, 0x0, &(0x7f0000000180)='T'}) r2 = gettid() timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, &(0x7f0000040000)) tkill(r2, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0xfffffffffffffced, 0x0, &(0x7f0000000040)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x400c630f}], 0x0, 0x0, &(0x7f0000000f4d)}) 12:34:39 executing program 0: clone(0x20000, 0x0, 0xfffffffffffffffe, &(0x7f0000000080), 0xffffffffffffffff) r0 = getpid() sched_setscheduler(r0, 0x5, &(0x7f0000000200)) 12:34:39 executing program 2: r0 = perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f0000000180)=""/148, 0x13d}], 0x1, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000340)="696f001b66408225aaa3af068fffebb8a490c47dda6586f1b58895b94a78037dd3714e7198820a7a709e2d30d25e6d846cd5c62a648a598668a8263b752b0b622b115112b5ad8e0425c0b784bbdb89eb8f4da0dd73dd01fe35694c2f78600badf8a0e237dba40713bac9e053b41a9f62be5fbb928018aab5f7500bef51a2fd74d4fffb4a20a946733820bdc1b485afa417cdbcfdfbc54f58c9c3edffe240c36f4ab8a16613814e226b6d20d98010ab1ace49fa76dce337a5a5f1dcff9e5d533b12475e33b971b15b69cd591cd9059759f0f04ba5468a34b98915033debb3e87f048e8601712659d47d8687eb6be5e650068d88000000000000") ioctl$PPPIOCGCHAN(r1, 0x80047437, &(0x7f0000000000)) preadv(r1, &(0x7f0000000480), 0x10000000000002a1, 0x0) perf_event_open$cgroup(&(0x7f0000000040)={0x3, 0x70, 0x3, 0x5, 0x3ff, 0x100000000, 0x0, 0x4, 0x800, 0x0, 0x0, 0x1, 0x2, 0x100000001, 0x8000, 0x6, 0x3, 0x9, 0x0, 0x25, 0x0, 0x3, 0x8, 0x101, 0xfffffffffffffff8, 0x4, 0x9, 0x904, 0x5, 0x100000001, 0x7ff, 0x8, 0x0, 0x3, 0x10000, 0x7, 0x1000, 0x7, 0x0, 0x4, 0x0, @perf_config_ext={0xe60c, 0x100000000}, 0x908, 0x1, 0xa0, 0x0, 0x200, 0x4, 0x100000000}, r1, 0x3, r0, 0xa) msgget$private(0x0, 0x22) 12:34:39 executing program 4: socket$inet6(0xa, 0x0, 0x80000000) sched_setaffinity(0x0, 0x7, &(0x7f00000000c0)=0x9) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0) fcntl$setflags(0xffffffffffffffff, 0x2, 0x1) r0 = socket$inet6(0xa, 0x400000000001, 0x0) r1 = dup(r0) setsockopt$inet6_tcp_int(r1, 0x6, 0x12, &(0x7f0000000000)=0x7f, 0x4) bind$inet6(r0, &(0x7f0000000040)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) getsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER_VALUE(r0, 0x84, 0x7c, &(0x7f00000001c0)={0x0, 0x0, 0x6}, &(0x7f0000000240)=0x8) sendto$inet6(r0, &(0x7f00000004c0), 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x4) socket$inet6(0xa, 0x1000000000002, 0x0) r2 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0xc0046209, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000200)={0x4, 0x0, &(0x7f0000000100)=[@enter_looper], 0x1, 0x0, &(0x7f0000000180)='T'}) r3 = gettid() timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, &(0x7f0000040000)) tkill(r3, 0x1004000000016) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0xfffffffffffffced, 0x0, &(0x7f0000000040)}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x400c630f}], 0x0, 0x0, &(0x7f0000000f4d)}) 12:34:39 executing program 1: r0 = syz_open_dev$vcsa(&(0x7f0000000040)='/dev/vcsa#\x00', 0x7, 0xa00) write(r0, &(0x7f0000000100)="a74f9540ff07520c5a9ec05a2c8013d53fd7c66b678f11032ee52509e872ff8ea5b03f8cd09139bf9f3a73cfd3d2c4f69f7a298b7bdb6026717234d0d056b4058205d5911c487b9fcc3b5a024073766a6fe08393a51cdba75c4823eb0651bb901c18cc6c21e1bc3dc43b98b89ee8a89e24545fcc16262c4c84f140a8affde6fb84fddee1256d7d2c6b086d1617235500326816243113750afdc7f882e8de3d063bda0ceb265b49ac2a0672a3e9eb7766593f8d22e584b37fdfa5fb3a10391c2ec2a4c76bdcf8c5b0fd558705dff9e650a23c624979e7a811640e216cf6b7732c6d223843ddfe30446e9dd5a35d272934ed268af9e3d6b57ab97f9b29a70df83c32a8814895411e6512b6a8be7c2fa70c1a5cd2279bc6896ffbbe9f462d4510e691f5fd094d7213d649edbda81dbb869f39c41f788f36271c2cf6b4be00631eaef54f244c45378b0baba2c04cc390f161acaf5a90a9d06394369dbf27e333141cf3d31927d6fd0c29f2389b2135cf07f06184564b83a136b41f04b88888a3c71f702f4010f6ca20928e4a752e5ab216eb183682c9b803e3eb481cea86d4a9af14efdf6b5a6d5e7701f29bd87ddcf0aa1ae3c661b5ae8a701e4bbfe3b9ca71fd5ff86f388b77345b1d61ba9961deafdd69891398559decb58c0aa8cb5b088681cad47bbe22ccb2c89b95a56822cee3cbedb551a3fbf0bcc76524aeaac8997fb09bcbe1c354492c7df4fc8009fe10246192894c91364c93c587000000000000000177637a6ce93b1f09e7f2649bca710200000051c1bd7188231d8a05f3b1c05772c3f306187832940ed17798b19a8318d96eda700f4e3ec9d7e6edd56e50090b99b141f05a98fbddbe32f6f7eba7f70854f4b93f80b6e7013b0e18428494345dada1a11026ddbc61d5ee93d38b5b4d99669a99bbbcec57f09104c21a46840eb798f1eec89e1133a2af27a21f2af94a141ff5737211764906d44a160200000080c633af3383966bc7355ae37881a2731022b4573b4eb2a381e00ea262495fc4aa616767f5bec31a19209577bfe37f5d87b333eb9ff03641bcc5628e2750010cea07c8c23cca563968f16b975194b310e50adb5903a9d8fcab5d9af8ba1a372d52233651b76d2e1143c3ddc387c1d66ad4f563d9adf354914c8418085e5b523e9d0001cffb2fbfeeb6f6c0f22e631adaf444984eedeaee2dad4d8d6ca03fbf93c04a81f02306506ca4db8d8eab529df81526f583698b20226bd87cd23d2531b8de9a49f2c38cf3cabd4b29cbc05f3f1ad49671c019a05c04d88ecca252d4ee7afc8fb6bee501f378629c34c50fddd7767064484c7e726e75c7d84de6ca035e0e6707f30e9a480f8371f80de537bbadd688e24b89fbb624cc1fe739126b002469938051f5683218d335102a84d0bcfb75b0c398e930adc1a606613d7ffe938d2f7277939f450d4eae43af613b0c0340ab26cece2a77eb55c758b3b14e511c05b070dd7913e57ade34190d17345999c91597dc36cfa65559e39e4d6ba91e90485734a97022fc7aa51d2de22a802b2d3f1e2b53d982caebec8753dba46bbac7e2cb76c0255ca236166c22a9ce966ab16420254a9713266f9916f4e05d6f6c2fd6ef1e8d8a6ff052c7402c52cae16d08964d7575529bb480fe7beddad52ebf7220978c978a78d891d3f112aa056554ec5707536b6a27ce3340bd4f498909335fe6e20f21a638a6176d4b33facf45d272fb66635cc1338f513011beffff4f6acbf00a8329835cafd97386a20d7a0d9ec74ebed02d190db1558909643ad344ca55cbb30ea2b1618842e164562d045caaf8dea14e68ea06b0bc5654828ec5e719db9bc1725a7d01ad0d561cfcb2972ad0f39016d22534b461971d601428af797db95e7477fe432c8e6970730433c52a8c9dedd00b6895101232bc62e3907151d12c392925f415164d21255479bf72f6ff6ed8c7d5521929067b33c2c9bca189b0a2deb7435c9b4e805581dcd9d1a3e5314399abe58166376345e414c5445b293dc04634d654454dcb736fb571aecd0491d94d15db25e57862c7bf813f9f16a6a4137f1852d55c8d2d1ea0e598ddd7345cd057fc0805a410c4c739d923b0cd0c6a032ad900ad4e84c0821ced5ce84cd1afa9e6c4a1f5e99dfc0cdd4c146eb0cce18d414b4d86ecff0fa5cdeca598ffe221a2cb3b1857ee30d3f6b7a83ca313cf60080645a94277844fbf40c84d9074fda2c7b223a4bde379b8d2da750336c5032af55d2496241a9de77a6a53703ead8036792e0f370fe774d9500f76d541b3c3be1acc60479f07db1e61e0001244cb7e5511d860f8f31f8c01a2e97d082b0ec413051e49a54e65ffa3e4af4dd0e0f0fb227ab775937a2c42a4da381f2a457ac175799bcd5556a462b2096211f7efc487567cde7287afd71039b7fbc290161987cb74a5c3d5018188af7933e12a0d3681570933a562e9e883fcc63495c5f54c446433c07689937595628b07662cee923a1500519f4f52490205befd0ac832160b43cf40725b2c6dc22ed0fdf0f619d404b9399494b6b7aebb334f621d352ea233420884db5cbf8f94474142eaa30ce8e5415b6f6aa16a7606d67fd0fe485ddfdec992d2364c281993522b587c837e4363ca79b32d52b032ccf27083cf8d438378d5012d3db1e9706fb6bab465a3da9e5ebb9cbb1bc832a5b79775b6628ed72ce45af1d34aba76f5cc9a58bfe5309f55deb7a41bf16eda03c796c144c475805a6eb481ee2e74d6a6baab144d3c53ef6f075f624aa736ea66b6956e6c46a1684195b38fa604669dc624325e0c7582030c18f6a43c7a16ef2a8704e23cfd9ecc97e72335c07702fd3868d87da30e6668db7e87fddea5f8f0cad8da479fcdaa8817cffb5b3527f494a0147674746fb89536a8e590e41c9841a4d089ee513d8f0cbf79173951e66a1244dbd9d434fbfa0d63ff049a058de101cf545b811a669b701952e96c356f17f0ee3689f26c2ce6942e8f87af57732b36c5169f30776ceb344a25f00bc401b43fb04172bf5c28688d26a41aa13c45949f1a44666e63f109b6a9fe67c2e1645e40b6f577d73e03f202d5ceac0c2977089eefad9e74cec31cf5a280d314c8b1168977ea410114b402220091e7e390263e5b4b800abb8a227e07b22d212bc392463dc58518756e7e8a6de797a78cf09ef7862ac7c71bdc14a090c71f1e14ede1c97beece6cb32f0cde8fc7b961daab53f12e3fdc42109dcd53e12a50f823cb33fc9c537de23d5997bc6e0f6e4bd9cdbdd6cba5d9cc72370485d11d011d8a54b91e19ca5349bdd07b4bc68d17824bdeb3d0529541a10e69f9f14751c732c4118f20569632df63e747552dab2e533a0c84c260f2f4f586fc355ffda0725ec822b2a099f8f4e69d206e86bf38035e85a07bb862fae491d4dd91560bc069ad9f7d990524336185a95907fdf19bea5ad62c83cfd4478c7447d68661d2e09e617e4261a0223142d9f7f151425f586cfa86421a6249556a5ac4d1a2f8869ad6921421410fafcb023abf212dfc1d666dc9dc478cc4ecf45dfaced8fc56b65141887bd6aa14ed52c42087000cb4f66f7fc339065bbbcd42848fb078a58c39fd7c3b4f091f2a98e8ebf08f4df1bcc3e889b342ca011e6253e8eb4e83fbfffe04c2fef2dd345a9df0d738d8e7b90791ea13a659056aa949a1ce3685bb6e48e2adb14d42c2e1b108ba6ebf441ccf62ccc5d9c4116a0980eb2f71797f3091cf6dfca689896100196375686869f6b4ca95a6850243e5baf47e19f51c37daaf7b4638503caf6b0a8efd3dd4b8c5d0d79fba0bc504b32c5e9ad4788fe3a010f477174484568f464473be0ad07fe174bd1b8f61684eb8f26e976538d0725064dc868c854978be87f659128ac72ab7ed392f1e2ab477cf5ab6e029f332709eb02ae3a51bcd30ab41a5cc7be26b3438d2cbff2b85fd4d9cf2df48049af139ee4b1d01567642948ceb1de433b78486a4657bc78dcae560cb75477b7518f3a67ab2ccf96ef009b576d4113ee3e86b5e5acc0e68e695ac4eee91d5ba8465b7f214ed884acfb10828933bcfe697170d82659299fe109c0e8bf896b40ff1e4fd7f5c1270b08c1cbdfc8f4466a6d36911aed316ed00dedb4880574638cbbe3d41da9f6d7b86e897c40f57fd03d4bf98b33fb3b32576095eba9c1b633b5d243fdfe222bfc11ff1813d8915424db4300658f2cbe76521234697be621308a565b200577b16d3bbbb01c031706b92088f5a1f6d92bfeb9cbe90e3ce193a405854f61b9c07494345f088d853f5685fda148b79dbc9a5ae1b7f9075a35c2e1079130756b30bbf339edfcae77c90fe9301794673e92b408d7c5ac371c9d6a64d66399d124957475e0162635dfa810c85f6477753b2c7a8aee95fdcbae6fc0299fe3341e31e375623c5ba281d272598a5c20c49853ff320a17eb94e75422feef69c291ca7befa0b1ed2fc8cd75e9418c04df8ddd58ccd4ece339915cf00c79063c9f9bc546032ce16eb05a1d93a5d8ba1d5bb96751ac259750c71fb3d1d15c2a64c768dce39fb21fb0823baabfd5ffc15441792fe24fff2218de4ca464ef41fc339e3a180d8235cb6d21dc9d02020632d6c1ace1a694d30e16862410403162b60d772113d5748423a32d40fcd933a24c83e9628afe16cdee8fe50b58c8b8053023353a36f19ebbe1dc55f04e605e9a1a1ce84e4873828c8dbc3004818a06efe95f83a4ab9c44d07c61a02a33c2f51cc0060f101c7ca3690777c2b17db2c5437edafea79e8f263f28c53052c0c6628a2cf14e09e761c0c03564e4bb875ba1a04e1aa5cfe83738a1022f8f5fce3012d4cd32a54ada24c2375d3ac9de1eca2d4dc943666eb84503e99473c24a3ca46d5d8cf46b2651bae2d4136fd81b1f0c7cb3345253a73888a084aa345be7924d058e4a83d64830f34cb94200ca43245a493130c062814115b366fa3aea9a2c7d6935bc596a2f55053ef105d94ae664a2767582eeca95ca9bad7c8b6caff26505c0019001f702551f00b6eb843908face8f77681ec7e750ad1a12dfdd9808d3fa1cece08333aab963a0050df400cf7c34918f2460781843b024efb8497c4c079890c0006245359b84b8338a385aae672556a922554570c9dce137ad66804046bd094b412013a6354b297110d0ce47ad06994391ce31c365281db40a13619333406b8ad065bf0d0e7aeb4188d7cbc66c5b9a87bb30dc767f6f9938176350ffadc6eaf59d2dbaeba9e4cf8ed82a619de89c7486ed60288959f53055006f0259ed9156071f5526fbfb27cabaac95d9433cf53bf4f80d1590c410a40ea671c987b90dabc546104e4fea1deaa04a23cc479a38e67f625be53f755822205fc633587a1a8b2082dea821f776b134dd527c53d43661ea66676ad3f5f4c120776dbfd3b8d0be50cba987f7c990ac3c2bae2a4c6dc34c09108ebd5bb83ba96b723fd0adc18e3ad465f60d59bee89323064e6d8c9c390b56dd7783690b0008ebe6a7895777aac7932d1bb7c07ee09adfc78261d908fec2497e865a5a97c4070b4d76d10cb80ba0a3608a0c7a36e7a4ab703a17e32d4a2054da640a5aa9535b67a328f20f8961785a8dba40e8f312c8a0bfea24deb2631a59c08bc5496ac013e854187d32545b2691882b6a1feb1ac16d59db2c0c1d181a7186ebd096f9c26434d6a8f5e8d62d09068539bd5f8553e9137bfd5578707992691d3a14239cdab1df2a34fa8057b9a876670d88e4c8f0a2ffd9a908d6b1052a087f5a1843386155a84915a9ebfe70ad1d75b91ebdbb927b44ecf6958b930d1c6d4dc5eea471e9adb76e06330af018a7134237192e1ad40be7d6d5deb0ac38a7fc409b692f21a45844d657d6396bae5641d54bfb05f29afe94e7e3de8b2d2ef295dccaab1856b8bc6bbade602e2db54f3f148710d5430e5cd8e847e16b4a8cfa1aee81c17dc83cbd7e0f1646da8d71c66bd0ec93a39413535ad2d", 0x1086) write(r0, &(0x7f00000000c0)="90", 0x45df7d11cc6af12f) ioctl$VHOST_VSOCK_SET_RUNNING(r0, 0x4004af61, &(0x7f0000000080)=0x1) fcntl$F_SET_FILE_RW_HINT(r0, 0x40e, &(0x7f0000000000)=0x2) [ 502.237611] binder: BINDER_SET_CONTEXT_MGR already set [ 502.243076] binder: 26239:26287 ioctl 40046207 0 returned -16 12:34:39 executing program 5: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0) syz_mount_image$xfs(&(0x7f0000000040)='xfs\x00', &(0x7f0000000200)='./file0/../file0/file0\x00', 0x0, 0x0, &(0x7f00000005c0), 0x0, &(0x7f0000000640)=ANY=[@ANYBLOB="6e6f7265342238f8"]) r0 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000080)='/dev/rtc0\x00', 0x48800, 0x0) write$P9_RWSTAT(r0, &(0x7f00000000c0)={0x7, 0x7f, 0x2}, 0x7) 12:34:39 executing program 1: socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000012c0)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = getpgrp(0x0) r2 = getpgrp(r1) capset(&(0x7f0000000000)={0x20080522, r2}, &(0x7f0000000040)={0x0, 0x100000000, 0x0, 0x200, 0x8, 0xe7d}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r3 = semget$private(0x0, 0x7, 0x0) semtimedop(r3, &(0x7f00000000c0)=[{0x3, 0x8, 0x1000}, {0x3, 0x9, 0x1800}, {0x6, 0x0, 0x1000}, {0x0, 0x3, 0x800}, {0x0, 0x2}], 0x2b76, &(0x7f0000000140)) [ 502.338390] binder: 26289:26291 ioctl c0046209 0 returned -22 12:34:39 executing program 0: io_setup(0x0, &(0x7f0000000040)=0x0) io_destroy(r0) io_setup(0xb, &(0x7f0000000100)) r1 = syz_open_dev$adsp(&(0x7f0000000080)='/dev/adsp#\x00', 0x3398, 0x2) ioctl$DRM_IOCTL_RM_MAP(r1, 0x4028641b, &(0x7f0000000000)={&(0x7f0000ffc000/0x1000)=nil, 0xfd7e, 0x3, 0x88, &(0x7f0000ffc000/0x3000)=nil, 0x9}) ioctl$KDGKBLED(r1, 0x4b64, &(0x7f00000000c0)) io_getevents(r0, 0x0, 0x0, &(0x7f00000000c0), &(0x7f0000000140)) [ 502.400378] XFS (loop5): unknown mount option [nore4"8ø]. 12:34:39 executing program 2: perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f0000000180)=""/148, 0x13d}], 0x1, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000340)="696f001b66408225aaa3af068fffebb8a490c47dda6586f1b58895b94a78037dd3714e7198820a7a709e2d30d25e6d846cd5c62a648a598668a8263b752b0b622b115112b5ad8e0425c0b784bbdb89eb8f4da0dd73dd01fe35694c2f78600badf8a0e237dba40713bac9e053b41a9f62be5fbb928018aab5f7500bef51a2fd74d4fffb4a20a946733820bdc1b485afa417cdbcfdfbc54f58c9c3edffe240c36f4ab8a16613814e226b6d20d98010ab1ace49fa76dce337a5a5f1dcff9e5d533b12475e33b971b15b69cd591cd9059759f0f04ba5468a34b98915033debb3e87f048e8601712659d47d8687eb6be5e650068d88000000000000") preadv(r0, &(0x7f0000000140)=[{&(0x7f0000000040)=""/224, 0xe0}], 0x1, 0x0) ioctl$PPPIOCSMRU(r0, 0x40047452, &(0x7f0000000280)=0x7fffffff) setsockopt$inet_sctp_SCTP_HMAC_IDENT(r0, 0x84, 0x16, &(0x7f00000002c0)=ANY=[@ANYBLOB="0000ff0000010026093ec40c8c8eca95f6f9a2a5221325651a01800000e374b9a8450906b8"], 0xc) r1 = msgget$private(0x0, 0x22) msgsnd(r1, &(0x7f0000000440)={0x1, "800e8e410046dd1837d8be361597801a7d06d2377145fdac40dc1b5b5dbba0445aecc0aa7a967c2680ae746f0b320733aa07511666ebc75b547a8f1a1ccf9c3df05dcde6028342dddf671a57c88305c84af9f0f4f0ca620412b8b0be3465f704a13e3d920c0e60b927e09bd6c6fd3a84eb66fc1b1aafcc5ced2fb3dccdb563b39bf97218d0f0fdb5954fce4ce3bd54cd856141341ab1fec234ef93ab256b36c9cd98a8b4fa4b5fca17d21604e44aca00b513db19db8f50dd1d4cbee366925c4591f2451ba18c4c6fc7b25ce8bc0c972be59d890a"}, 0xdc, 0x800) 12:34:39 executing program 5: fcntl$getownex(0xffffffffffffff9c, 0x10, &(0x7f0000000000)={0x0, 0x0}) ptrace$peek(0x1, r0, &(0x7f0000000040)) r1 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000080)='/dev/mixer\x00', 0x0, 0x0) clone(0x2100, 0x0, 0xfffffffffffffffe, &(0x7f0000000240), 0xffffffffffffffff) ioctl$SNDRV_SEQ_IOCTL_GET_CLIENT_INFO(0xffffffffffffffff, 0xc0bc5310, &(0x7f0000000100)) r2 = getpid() sched_setscheduler(r2, 0x5, &(0x7f0000000200)) ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(r1, 0xc058534f, &(0x7f0000000280)={{}, 0x0, 0x0, 0x0, {}, 0x0, 0x6}) [ 502.442077] binder: 26289:26312 ioctl c0046209 0 returned -22 [ 502.472279] binder: 26289:26314 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 12:34:39 executing program 1: r0 = syz_init_net_socket$llc(0x1a, 0x1, 0x0) bind$llc(r0, &(0x7f0000000040)={0x1a, 0xffffffffffffffff, 0xfffffffffffffffc, 0x0, 0x0, 0x0, @link_local}, 0x10) getpeername(r0, &(0x7f0000000080)=@ipx, &(0x7f0000000100)=0x80) perf_event_open(&(0x7f0000000240)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = fcntl$dupfd(r0, 0x406, r0) getsockopt$IP6T_SO_GET_ENTRIES(r1, 0x29, 0x41, &(0x7f0000000140)={'mangle\x00', 0x1c, "ee44cf896700e7c59c7570f909644322cbfb910ab5e1d088cd3a6538"}, &(0x7f0000000180)=0x40) sendmmsg(r0, &(0x7f0000001380), 0x3fffff1, 0x40) epoll_wait(r1, &(0x7f00000001c0)=[{}, {}, {}, {}, {}, {}], 0x6, 0x3101) 12:34:39 executing program 5: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x100008912, &(0x7f0000000100)="025cc80700145f8f764070") r1 = dup(r0) epoll_ctl$EPOLL_CTL_DEL(r1, 0x2, r0) r2 = timerfd_create(0x3, 0x0) timerfd_settime(r2, 0x3, &(0x7f0000000140)={{0x4000000000000000}, {0x0, 0x989680}}, &(0x7f0000000100)) r3 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000080)='/dev/dsp\x00', 0x8000, 0x0) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000200)={r3, 0x0, 0x14, 0x3d, &(0x7f0000000180)="4f59030886a52cec9d514c0d22841c41be095cfb", &(0x7f00000001c0)=""/61, 0x6}, 0x28) timerfd_settime(r2, 0x0, &(0x7f0000000000)={{0x77359400}, {0x77359400}}, &(0x7f00000000c0)) setsockopt$inet6_tcp_TLS_TX(r0, 0x6, 0x1, &(0x7f0000000040), 0x4) ioctl$DRM_IOCTL_AGP_ENABLE(r2, 0x40086432, &(0x7f0000000240)=0xffffffff80000001) 12:34:40 executing program 3: syz_open_dev$sndctrl(&(0x7f0000000140)='/dev/snd/controlC#\x00', 0x0, 0x0) sched_setaffinity(0x0, 0x7, &(0x7f00000000c0)=0x9) r0 = perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0) fcntl$setflags(r0, 0x2, 0x1) getsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER_VALUE(0xffffffffffffffff, 0x84, 0x7c, &(0x7f00000001c0), &(0x7f0000000240)=0x8) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(0xffffffffffffffff, 0x84, 0x9, &(0x7f0000000280)={0x0, @in={{0x2, 0x4e23, @remote}}, 0xfffffffffffffff7, 0x0, 0x400}, 0x98) sendto$inet6(0xffffffffffffffff, &(0x7f00000004c0), 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) setsockopt$SO_BINDTODEVICE(0xffffffffffffffff, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x4) socket$inet6(0xa, 0x1000000000002, 0x0) r1 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x4, 0xfffffdfd, &(0x7f0000000100)=[@enter_looper], 0x1, 0x0, &(0x7f0000000180)='T'}) r2 = gettid() timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, &(0x7f0000040000)) tkill(r2, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0xfffffffffffffced, 0x0, &(0x7f0000000040)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x400c630f}], 0x0, 0x0, &(0x7f0000000f4d)}) 12:34:40 executing program 0: r0 = syz_open_procfs(0x0, &(0x7f0000000000)='cmdline\x00') getsockopt$nfc_llcp(r0, 0x118, 0x3, &(0x7f00000000c0)=""/127, 0x7f) ioctl$LOOP_SET_STATUS(r0, 0x4c02, &(0x7f0000000200)={0x0, 0x0, 0x0, 0x0, 0x8, 0x3, 0x1d, 0x0, "7b367b1ad9d2eec1ef1a3984032db57d55605af55cb0efdca6ec6e25af97c4d078fbda4b68254e76a2eefbfc560ae52a59be4e682327afca6f46890ecfbbc0fe", "d083a1e7630b0b4ec6f96215b48525c8762c57e4635e4e0011f1d76aba2db174", [0x6dd9, 0x401]}) r1 = perf_event_open(&(0x7f0000000180)={0x0, 0x70}, 0x0, 0x0, 0xffffffffffffffff, 0x0) preadv(r0, &(0x7f0000000040)=[{&(0x7f0000000080)=""/1, 0x1}], 0x2000000000000021, 0x0) ioctl$void(r1, 0xc0045c79) 12:34:40 executing program 4: socket$inet6(0xa, 0x0, 0x80000000) sched_setaffinity(0x0, 0x7, &(0x7f00000000c0)=0x9) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0) fcntl$setflags(0xffffffffffffffff, 0x2, 0x1) r0 = socket$inet6(0xa, 0x400000000001, 0x0) r1 = dup(r0) setsockopt$inet6_tcp_int(r1, 0x6, 0x12, &(0x7f0000000000)=0x7f, 0x4) bind$inet6(r0, &(0x7f0000000040)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) getsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER_VALUE(r0, 0x84, 0x7c, &(0x7f00000001c0)={0x0, 0x0, 0x6}, &(0x7f0000000240)=0x8) sendto$inet6(r0, &(0x7f00000004c0), 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x4) socket$inet6(0xa, 0x1000000000002, 0x0) r2 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x4004623a, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000200)={0x4, 0x0, &(0x7f0000000100)=[@enter_looper], 0x1, 0x0, &(0x7f0000000180)='T'}) r3 = gettid() timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, &(0x7f0000040000)) tkill(r3, 0x1004000000016) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0xfffffffffffffced, 0x0, &(0x7f0000000040)}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x400c630f}], 0x0, 0x0, &(0x7f0000000f4d)}) 12:34:40 executing program 2: perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f0000000180)=""/148, 0x13d}], 0x1, 0x0) r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000000)='/dev/hwrng\x00', 0x101000, 0x0) ioctl$VHOST_SET_OWNER(r0, 0xaf01, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000340)="696f001b66408225aaa3af068fffebb8a490c47dda6586f1b58895b94a78037dd3714e7198820a7a709e2d30d25e6d846cd5c62a648a598668a8263b752b0b622b115112b5ad8e0425c0b784bbdb89eb8f4da0dd73dd01fe35694c2f78600badf8a0e237dba40713bac9e053b41a9f62be5fbb928018aab5f7500bef51a2fd74d4fffb4a20a946733820bdc1b485afa417cdbcfdfbc54f58c9c3edffe240c36f4ab8a16613814e226b6d20d98010ab1ace49fa76dce337a5a5f1dcff9e5d533b12475e33b971b15b69cd591cd9059759f0f04ba5468a34b98915033debb3e87f048e8601712659d47d8687eb6be5e650068d88000000000000") preadv(r1, &(0x7f0000000480), 0x10000000000002a1, 0x0) msgget$private(0x0, 0x22) 12:34:40 executing program 5: socket$inet6(0xa, 0x0, 0x80000000) sched_setaffinity(0x0, 0x7, &(0x7f00000000c0)=0x9) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0) fcntl$setflags(0xffffffffffffffff, 0x2, 0x1) r0 = socket$inet6(0xa, 0x400000000001, 0x0) r1 = dup(r0) setsockopt$inet6_tcp_int(r1, 0x6, 0x12, &(0x7f0000000000)=0x7f, 0x4) bind$inet6(r0, &(0x7f0000000040)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) getsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER_VALUE(r0, 0x84, 0x7c, &(0x7f00000001c0)={0x0, 0x0, 0x6}, &(0x7f0000000240)=0x8) sendto$inet6(r0, &(0x7f00000004c0), 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x4) socket$inet6(0xa, 0x1000000000002, 0x0) r2 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0xc0046209, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000200)={0x4, 0x0, &(0x7f0000000100)=[@enter_looper], 0x1, 0x0, &(0x7f0000000180)='T'}) r3 = gettid() timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, &(0x7f0000040000)) tkill(r3, 0x1004000000016) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0xfffffffffffffced, 0x0, &(0x7f0000000040)}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x400c630f}], 0x0, 0x0, &(0x7f0000000f4d)}) 12:34:40 executing program 1: perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e5}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$nl_netfilter(r0, &(0x7f0000000140)={&(0x7f0000000040), 0xc, &(0x7f0000000100)={&(0x7f0000003300)=ANY=[@ANYBLOB="1400000004011903000000000000000000000000"], 0x14}}, 0x0) recvmmsg(r0, &(0x7f0000001cc0)=[{{&(0x7f0000001840)=@nfc, 0x80, &(0x7f0000001b40), 0x0, &(0x7f0000001bc0)=""/199, 0xc7}}], 0x24b, 0x0, 0x0) sendmsg$nl_netfilter(r0, &(0x7f0000000000)={&(0x7f0000000240), 0xc, &(0x7f00000000c0)={&(0x7f0000000080)={0x14, 0x1, 0x8, 0xffffffffffffffff}, 0x14}}, 0x0) [ 503.123160] binder: BINDER_SET_CONTEXT_MGR already set [ 503.128468] binder: 26298:26307 ioctl 40046207 0 returned -16 [ 503.135627] binder_release_work: 12 callbacks suppressed [ 503.135633] binder: undelivered death notification, 0000000000000000 12:34:40 executing program 0: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$inet6(0xa, 0x1000000000002, 0x0) r0 = gettid() timer_create(0x0, &(0x7f0000044000)={0x0, 0x12, 0x0, @thr={&(0x7f0000000040), &(0x7f0000000140)}}, &(0x7f0000044000)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, &(0x7f0000040000)) r1 = socket$inet(0x2, 0x1, 0x0) mmap(&(0x7f000092d000/0x400000)=nil, 0x400000, 0xfffffffffffffffc, 0x8972, 0xffffffffffffffff, 0x0) bind$inet(r1, &(0x7f0000134000)={0x2, 0x4e23, @broadcast}, 0x10) connect$inet(r1, &(0x7f00000e5000)={0x2, 0x0, @loopback}, 0x10) connect$inet(r1, &(0x7f00009322c4)={0x2, 0x0, @local={0xac, 0x14, 0xffffffffffffffff}}, 0x10) connect$inet(r1, &(0x7f0000000080)={0x2, 0x4e23, @loopback}, 0x10) r2 = dup2(0xffffffffffffffff, r1) tkill(r0, 0x1000000000016) ioctl$TIOCMBIS(r2, 0x5416, &(0x7f00000001c0)=0x664) sched_setattr(0x0, &(0x7f0000000000)={0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0xffff}, 0x0) 12:34:40 executing program 1: perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e5}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_emit_ethernet(0x7a, &(0x7f0000000200)={@link_local, @dev, [], {@ipv6={0x86dd, {0x0, 0x6, "81182e", 0x44, 0x0, 0x0, @local, @local, {[], @gre}}}}}, &(0x7f0000000040)) creat(&(0x7f0000000080)='./file0\x00', 0x1) [ 503.278916] binder: 26349:26352 ioctl c0046209 0 returned -22 [ 503.286076] binder: 26343:26351 ioctl 4004623a 0 returned -22 12:34:40 executing program 2: preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f0000000180)=""/148, 0x13d}], 0x1, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000340)="696f001b66408225aaa3af068fffebb8a490c47dda6586f1b58895b94a78037dd3714e7198820a7a709e2d30d25e6d846cd5c62a648a598668a8263b752b0b622b115112b5ad8e0425c0b784bbdb89eb8f4da0dd73dd01fe35694c2f78600badf8a0e237dba40713bac9e053b41a9f62be5fbb928018aab5f7500bef51a2fd74d4fffb4a20a946733820bdc1b485afa417cdbcfdfbc54f58c9c3edffe240c36f4ab8a16613814e226b6d20d98010ab1ace49fa76dce337a5a5f1dcff9e5d533b12475e33b971b15b69cd591cd9059759f0f04ba5468a34b98915033debb3e87f048e8601712659d47d8687eb6be5e650068d88000000000000") r1 = msgget(0x0, 0x24) msgctl$IPC_STAT(r1, 0x2, &(0x7f0000000840)=""/125) sendmsg$kcm(r0, &(0x7f0000000800)={&(0x7f0000000080)=@alg={0x26, 'aead\x00', 0x0, 0x0, 'aegis128l\x00'}, 0x80, &(0x7f00000005c0)=[{&(0x7f0000000240)="3d07f52514cc622d127caa635465eff405b150820b2b6b86c0b59b4aac2b6c840921a0c72c9e92eef81a71fdd8141f97b4bc6aa9a7a8b0b3801290bdd6ff77706bc532fd9dcbcdeb5763acf0ddc484baf68d37e3b803ab95c46f9635b1fed9c378c4d965cd47fbedacae84870ad94590927e988b7b9e256e5007391b905309419b3d37709f4ead364bb0b76be10cb10513739a0ae0be3a207acfb82b71bcbdfead2cb58e3bafb6952b21a2d359abff", 0xaf}, {&(0x7f0000000100)="78fbc34e7ac2b50a1ea93193a3ff1306aeeae381766e6fa828c081acb9c91c375932923067967703e2", 0x29}, {&(0x7f0000000140)="0ee2b6d98af90b8b249f", 0xa}, {&(0x7f0000000440)="05ae2b9f5f59bb58dc04812efb1c1bbc00c6b12faca9424dc83e297ea7efe940a0e136e013c56ab9fcf845ca882a868bf1eeab2cc47514409283520883be9874d26044ab87010ff3d839719c3e2fd535cc5b94b464f2a17d15243e24d7342f8600c80907aa1a731649638892283fd1f3c60cac61c2ab545a1ee53b4588742b89edfd3404a20d71b5ce5597aaff00645e43bb70d04932d0bb2a988afedf9631a310e28d8d8d2c0239528a4e1b09247b", 0xaf}, {&(0x7f0000000300)="977065a10de6b2dbd1bbefb6c99e050f2e118a830e6de9a9ecad79ca1bb44df8c4e2c83b11d22cf50fae44da8721238d7c5da3b527e1c8c5", 0x38}, {&(0x7f0000000500)="8bbc670b271309ff5a0f7d74d41e7cd75d295fca7e25a23ac7536295ae076cfa1cb98cf8adaabbc8aaa3b8c66cf76b02f2f7ad2dc250998894b00d2c26752286fb349c9bfad52fe7a36a38c0bd01d71144e260d1", 0x54}, {&(0x7f0000000580)="4ddfb9303f2858ddfdad976a635e9a394d67e668d923c0d50eb525952e006976cc49b8ae30c695ff", 0x28}], 0x7, &(0x7f0000000640)=[{0xc8, 0x1ff, 0x800, "a5a4ea34472bfca16674fcd7654951c1063e107636186ab90dc3ad39e16de785a21971623657db0884059d7a62d3483d7ff127ee79105afef9525fffd61e5839726dd06b4059bc5267f2d8f09eb58766805e4cff4f03e8f18a4f5d733a31a4da5a274ea2bf263d557546d39c4dcb1b7eff4c14a3b27696bdf9e1ec97801672aa1e0443274818d8181c72f41a5d330e3ff7a61554d0873b244f667ce29d44649d981bbe8ce5a4ac1834f2229e7c15e7ba210d10a1de"}, {0xf8, 0x108, 0x81, "922e23f41d48b49f4c1efc9ccaf025974e1526a379db010ddf2669b33bcb4cf8fee85c9c198efef99309bfc26d5a51bcf22971255cdf2f15200e9781ed59443defafe527f79ebd777eaf6c0d9171df4ee02b30dc22f258c0177bb48e5ab752d5809fb3e2d77ac4f2ba1db78672520925b5784f3ebdcb0c3ffa2583b39ea0f71f71af7827b7821705196c69a8635fb1807943609778edba7efdbb4df7d6d9fb10dbace73afd84088bfefb042bc9d2dca4dabf85925e2ff786874601fd34d7cafb1430ef2586400424eafc1b3f22cf327cce9968d860e0883eba2a58a7f52feefdf5c144"}], 0x1c0, 0x40}, 0x8001) preadv(r0, &(0x7f0000000000), 0x236, 0x8000008000000) msgget$private(0x0, 0x22) 12:34:40 executing program 5: r0 = socket$inet6_sctp(0xa, 0x10000000005, 0x84) setsockopt$inet_sctp6_SCTP_I_WANT_MAPPED_V4_ADDR(r0, 0x84, 0xc, &(0x7f0000000000), 0x4) setsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX(r0, 0x84, 0x6e, &(0x7f0000961fe4)=[@in={0x2, 0x0, @dev}], 0x10) getsockname(r0, &(0x7f0000000140)=@l2, &(0x7f00000002c0)=0x80) r1 = openat$zero(0xffffffffffffff9c, &(0x7f0000000080)='/dev/zero\x00', 0x688500, 0x0) r2 = syz_genetlink_get_family_id$team(&(0x7f0000000480)='team\x00') ioctl$KVM_SET_CPUID2(r1, 0x4008ae90, &(0x7f0000000500)={0x2, 0x0, [{0xc000000f, 0x6b, 0x6, 0x1, 0x5, 0x80, 0x1000}, {0x0, 0x3, 0x4, 0x9, 0x9, 0x4, 0xffffffff}]}) accept4$packet(0xffffffffffffffff, &(0x7f0000000800)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000840)=0x14, 0x80000) ioctl$ifreq_SIOCGIFINDEX_vcan(0xffffffffffffffff, 0x8933, &(0x7f0000000880)={'vcan0\x00', 0x0}) ioctl$ifreq_SIOCGIFINDEX_team(r0, 0x8933, &(0x7f00000008c0)={'team0\x00', 0x0}) getsockopt$inet_IP_XFRM_POLICY(0xffffffffffffff9c, 0x0, 0x11, &(0x7f0000000900)={{{@in=@remote, @in=@loopback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@dev}, 0x0, @in=@remote}}, &(0x7f0000000a00)=0xe8) ioctl$ifreq_SIOCGIFINDEX_team(r0, 0x8933, &(0x7f0000000a40)={'team0\x00', 0x0}) ioctl$ifreq_SIOCGIFINDEX_team(r0, 0x8933, &(0x7f0000000ac0)={'team0\x00', 0x0}) accept4$packet(0xffffffffffffff9c, &(0x7f0000000b00)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @local}, &(0x7f0000000b40)=0x14, 0x80800) clock_gettime(0x0, &(0x7f00000035c0)={0x0, 0x0}) recvmmsg(r0, &(0x7f0000003540)=[{{&(0x7f0000000b80)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000e00)=[{&(0x7f0000000c00)=""/225, 0xe1}, {&(0x7f0000000d00)=""/181, 0xb5}, {&(0x7f0000000dc0)=""/8, 0x8}], 0x3, &(0x7f0000000e40)=""/253, 0xfd, 0x100000000}, 0x800}, {{0x0, 0x0, &(0x7f0000003440)=[{&(0x7f0000000f40)=""/239, 0xef}, {&(0x7f0000001040)=""/39, 0x27}, {&(0x7f0000001080)=""/4096, 0x1000}, {&(0x7f0000002080)=""/249, 0xf9}, {&(0x7f0000002180)=""/4096, 0x1000}, {&(0x7f0000003180)=""/5, 0x5}, {&(0x7f00000031c0)=""/82, 0x52}, {&(0x7f0000003240)=""/209, 0xd1}, {&(0x7f0000003340)=""/241, 0xf1}], 0x9, &(0x7f0000003500)=""/13, 0xd, 0x200000}, 0x1000}], 0x2, 0x3, &(0x7f0000003600)={r10, r11+30000000}) getsockopt$inet6_IPV6_XFRM_POLICY(r0, 0x29, 0x23, &(0x7f0000003640)={{{@in6=@local, @in6=@remote, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@multicast1}, 0x0, @in6=@mcast2}}, &(0x7f0000003740)=0xe8) munmap(&(0x7f0000ffa000/0x3000)=nil, 0x3000) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000004d40)={'team_slave_0\x00', 0x0}) ioctl$TIOCLINUX4(r1, 0x541c, &(0x7f00000004c0)) sendmsg$TEAM_CMD_OPTIONS_SET(r1, &(0x7f0000005080)={&(0x7f00000000c0), 0xc, &(0x7f0000005040)={&(0x7f0000004d80)={0x2a0, r2, 0x100, 0x70bd26, 0x25dfdbff, {}, [{{0x8, 0x1, r3}, {0x23c, 0x2, [{0x40, 0x1, @priority={{{0x24, 0x1, 'priority\x00'}, {0x8}, {0x8, 0x4, 0x8}}, {0x8, 0x6, r4}}}, {0x3c, 0x1, @lb_tx_method={{0x24, 0x1, 'lb_tx_method\x00'}, {0x8}, {0xc, 0x4, 'hash\x00'}}}, {0x3c, 0x1, @user_linkup_enabled={{{0x24, 0x1, 'user_linkup_enabled\x00'}, {0x8}, {0x4}}, {0x8, 0x6, r5}}}, {0x3c, 0x1, @user_linkup_enabled={{{0x24, 0x1, 'user_linkup_enabled\x00'}, {0x8}, {0x4}}, {0x8, 0x6, r6}}}, {0x3c, 0x1, @user_linkup_enabled={{{0x24, 0x1, 'user_linkup_enabled\x00'}, {0x8}, {0x4}}, {0x8, 0x6, r7}}}, {0x4c, 0x1, @lb_tx_method={{0x24, 0x1, 'lb_tx_method\x00'}, {0x8}, {0x1c, 0x4, 'hash_to_port_mapping\x00'}}}, {0x40, 0x1, @queue_id={{{0x24, 0x1, 'queue_id\x00'}, {0x8}, {0x8, 0x4, 0xffffffff00000000}}, {0x8, 0x6, r8}}}, {0x3c, 0x1, @user_linkup_enabled={{{0x24, 0x1, 'user_linkup_enabled\x00'}, {0x8}, {0x4}}, {0x8, 0x6, r9}}}, {0x40, 0x1, @priority={{{0x24, 0x1, 'priority\x00'}, {0x8}, {0x8, 0x4, 0x1f}}, {0x8, 0x6, r12}}}]}}, {{0x8, 0x1, r13}, {0x40, 0x2, [{0x3c, 0x1, @user_linkup={{{0x24, 0x1, 'user_linkup\x00'}, {0x8}, {0x4}}, {0x8, 0x6, r14}}}]}}]}, 0x2a0}}, 0x24008000) getsockopt$inet_sctp6_SCTP_GET_ASSOC_ID_LIST(r0, 0x84, 0x1d, &(0x7f0000000400)=ANY=[@ANYBLOB="0100000035216de2b18ca8e6ea83b1d7e6a8337c46778caa3a647e4de1e58e7bc889e3a0ba3d4e5b73da613a05f6832dd4b464feafc3a3637c3ebf2a2da4931cb5079161e4e0f4a2", @ANYRES32=0x0], &(0x7f000095dffc)=0x2) getsockopt$inet_sctp6_SCTP_GET_LOCAL_ADDRS(r0, 0x84, 0x14, &(0x7f0000000040)={r15}, &(0x7f0000000100)=0x8) r17 = syz_open_dev$usb(&(0x7f0000000300)='/dev/bus/usb/00#/00#\x00', 0x2, 0x1) getsockopt$inet_sctp_SCTP_PR_SUPPORTED(r17, 0x84, 0x71, &(0x7f0000000340)={r16, 0x7}, &(0x7f0000000380)=0x8) ioctl$FS_IOC_GETFLAGS(r0, 0x80086601, &(0x7f00000003c0)) getsockopt$inet_sctp6_SCTP_PRIMARY_ADDR(r0, 0x84, 0x6c, &(0x7f00000001c0)={r16, @in={{0x2, 0x0, @multicast1}}}, &(0x7f0000000280)=0x13) [ 503.393337] binder: 26343:26365 ioctl 4004623a 0 returned -22 12:34:40 executing program 2: perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f0000000180)=""/148, 0x13d}], 0x1, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/rt_cache\x00') preadv(r0, &(0x7f0000000480), 0x10000000000005a8, 0x0) msgget$private(0x0, 0x100) 12:34:40 executing program 1: perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x4000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) poll(&(0x7f00000002c0)=[{}, {}], 0xd5, 0x6) r0 = open(&(0x7f00000000c0)='./file0\x00', 0x0, 0x9) ioctl$TIOCCBRK(r0, 0x5428) 12:34:41 executing program 3: syz_open_dev$sndctrl(&(0x7f0000000140)='/dev/snd/controlC#\x00', 0x0, 0x0) sched_setaffinity(0x0, 0x7, &(0x7f00000000c0)=0x9) r0 = perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0) fcntl$setflags(r0, 0x2, 0x1) getsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER_VALUE(0xffffffffffffffff, 0x84, 0x7c, &(0x7f00000001c0), &(0x7f0000000240)=0x8) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(0xffffffffffffffff, 0x84, 0x9, &(0x7f0000000280)={0x0, @in={{0x2, 0x4e23, @remote}}, 0xfffffffffffffff7, 0x0, 0x400}, 0x98) sendto$inet6(0xffffffffffffffff, &(0x7f00000004c0), 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) setsockopt$SO_BINDTODEVICE(0xffffffffffffffff, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x4) socket$inet6(0xa, 0x1000000000002, 0x0) r1 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x4, 0x100000000000000, &(0x7f0000000100)=[@enter_looper], 0x1, 0x0, &(0x7f0000000180)='T'}) r2 = gettid() timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, &(0x7f0000040000)) tkill(r2, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0xfffffffffffffced, 0x0, &(0x7f0000000040)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x400c630f}], 0x0, 0x0, &(0x7f0000000f4d)}) 12:34:41 executing program 4: socket$inet6(0xa, 0x0, 0x80000000) sched_setaffinity(0x0, 0x7, &(0x7f00000000c0)=0x9) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0) fcntl$setflags(0xffffffffffffffff, 0x2, 0x1) r0 = socket$inet6(0xa, 0x400000000001, 0x0) r1 = dup(r0) setsockopt$inet6_tcp_int(r1, 0x6, 0x12, &(0x7f0000000000)=0x7f, 0x4) bind$inet6(r0, &(0x7f0000000040)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) getsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER_VALUE(r0, 0x84, 0x7c, &(0x7f00000001c0)={0x0, 0x0, 0x6}, &(0x7f0000000240)=0x8) sendto$inet6(r0, &(0x7f00000004c0), 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x4) socket$inet6(0xa, 0x1000000000002, 0x0) r2 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x5451, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000200)={0x4, 0x0, &(0x7f0000000100)=[@enter_looper], 0x1, 0x0, &(0x7f0000000180)='T'}) r3 = gettid() timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, &(0x7f0000040000)) tkill(r3, 0x1004000000016) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0xfffffffffffffced, 0x0, &(0x7f0000000040)}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x400c630f}], 0x0, 0x0, &(0x7f0000000f4d)}) 12:34:41 executing program 2: perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f0000000180)=""/148, 0x13d}], 0x1, 0x0) r0 = accept(0xffffffffffffff9c, &(0x7f00000000c0)=@xdp, &(0x7f0000000140)=0x80) setsockopt$inet6_MCAST_MSFILTER(r0, 0x29, 0x30, &(0x7f0000000440)={0x5, {{0xa, 0x4e20, 0x4, @ipv4, 0x2}}, 0x0, 0x1, [{{0xa, 0x4e24, 0x8, @dev={0xfe, 0x80, [], 0x5}, 0x6}}]}, 0x110) r1 = syz_open_procfs(0x0, &(0x7f0000000340)="696f001b66408225aaa3af068fffebb8a490c47dda6586f1b58895b94a78037dd3714e7198820a7a709e2d30d25e6d846cd5c62a648a598668a8263b752b0b622b115112b5ad8e0425c0b784bbdb89eb8f4da0dd73dd01fe35694c2f78600badf8a0e237dba40713bac9e053b41a9f62be5fbb928018aab5f7500bef51a2fd74d4fffb4a20a946733820bdc1b485afa417cdbcfdfbc54f58c9c3edffe240c36f4ab8a16613814e226b6d20d98010ab1ace49fa76dce337a5a5f1dcff9e5d533b12475e33b971b15b69cd591cd9059759f0f04ba5468a34b98915033debb3e87f048e8601712659d47d8687eb6be5e650068d88000000000000") preadv(r1, &(0x7f0000000480), 0x10000000000002a1, 0x0) setsockopt$inet6_MCAST_LEAVE_GROUP(r1, 0x29, 0x2d, &(0x7f0000000000)={0x5, {{0xa, 0x4e20, 0x8, @mcast1, 0x6}}}, 0x88) msgget$private(0x0, 0x22) 12:34:41 executing program 1: socket$inet6(0xa, 0x0, 0x80000000) sched_setaffinity(0x0, 0x7, &(0x7f00000000c0)=0x9) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0) fcntl$setflags(0xffffffffffffffff, 0x2, 0x1) r0 = socket$inet6(0xa, 0x400000000001, 0x0) r1 = dup(r0) setsockopt$inet6_tcp_int(r1, 0x6, 0x12, &(0x7f0000000000)=0x7f, 0x4) bind$inet6(r0, &(0x7f0000000040)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) getsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER_VALUE(r0, 0x84, 0x7c, &(0x7f00000001c0)={0x0, 0x0, 0x6}, &(0x7f0000000240)=0x8) sendto$inet6(r0, &(0x7f00000004c0), 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x4) socket$inet6(0xa, 0x1000000000002, 0x0) r2 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x4004623a, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000200)={0x4, 0x0, &(0x7f0000000100)=[@enter_looper], 0x1, 0x0, &(0x7f0000000180)='T'}) r3 = gettid() timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, &(0x7f0000040000)) tkill(r3, 0x1004000000016) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0xfffffffffffffced, 0x0, &(0x7f0000000040)}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x400c630f}], 0x0, 0x0, &(0x7f0000000f4d)}) 12:34:41 executing program 0: sched_setaffinity(0x0, 0x7, &(0x7f00000000c0)=0x9) r0 = perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0) socketpair$inet6(0xa, 0x4, 0x7, &(0x7f00000003c0)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$inet6_MRT6_DEL_MFC_PROXY(r1, 0x29, 0xd3, &(0x7f0000000400)={{0xa, 0x4e22, 0xfffffffffffffffe, @empty, 0x1000}, {0xa, 0x4e21, 0x2711, @dev={0xfe, 0x80, [], 0x1c}, 0x3}, 0x1, [0x4, 0x4, 0x3, 0x8a7, 0x3ff, 0x416c, 0x84]}, 0x5c) r2 = dup3(r0, r0, 0x80000) bind$alg(r0, &(0x7f0000000140)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb(blowfish)\x00'}, 0x58) ioctl$TIOCSETD(r2, 0x5423, &(0x7f0000000240)=0x7) prctl$getname(0x10, &(0x7f0000000280)=""/153) r3 = syz_open_dev$mouse(&(0x7f0000000200)='/dev/input/mouse#\x00', 0xc8, 0x208000) ioctl$VHOST_SET_FEATURES(r2, 0x4008af00, &(0x7f0000000100)) r4 = socket$inet6(0xa, 0x7ffff, 0xffffffffffffffff) bind$inet6(r4, &(0x7f00000001c0)={0xa, 0x4e20, 0x0, @empty, 0x80000001}, 0xfffffffffffffe4b) listen(r4, 0x4) r5 = socket$inet6(0xa, 0x6, 0x0) connect$inet6(r5, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @dev={0xfe, 0x80, [], 0xf}, 0x3}, 0x1c) ioctl$BLKROSET(r3, 0x125d, &(0x7f0000000340)=0xfffffffffffff7c4) modify_ldt$write(0x1, &(0x7f0000000380)={0x4, 0x20001800, 0xffffffffffffffff, 0x400, 0x9, 0x4, 0x80000000, 0x37f, 0xff, 0x5}, 0x10) [ 504.021194] binder: BINDER_SET_CONTEXT_MGR already set [ 504.026686] binder: 26354:26355 ioctl 40046207 0 returned -16 [ 504.035257] binder: undelivered death notification, 0000000000000000 [ 504.042057] binder: undelivered death notification, 0000000000000000 12:34:41 executing program 2: r0 = perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f0000000180)=""/148, 0x13d}], 0x1, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000340)="696f001b66408225aaa3af068fffebb8a490c47dda6586f1b58895b94a78037dd3714e7198820a7a709e2d30d25e6d846cd5c62a648a598668a8263b752b0b622b115112b5ad8e0425c0b784bbdb89eb8f4da0dd73dd01fe35694c2f78600badf8a0e237dba40713bac9e053b41a9f62be5fbb928018aab5f7500bef51a2fd74d4fffb4a20a946733820bdc1b485afa417cdbcfdfbc54f58c9c3edffe240c36f4ab8a16613814e226b6d20d98010ab1ace49fa76dce337a5a5f1dcff9e5d533b12475e33b971b15b69cd591cd9059759f0f04ba5468a34b98915033debb3e87f048e8601712659d47d8687eb6be5e650068d88000000000000") preadv(r1, &(0x7f0000000480), 0x10000000000002a1, 0x0) ioctl$EXT4_IOC_GROUP_EXTEND(r0, 0x40086607, &(0x7f0000000000)=0x66c9) msgget$private(0x0, 0x22) 12:34:41 executing program 1: r0 = perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e1}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$PERF_EVENT_IOC_SET_BPF(r0, 0x40042408, 0xffffffffffffffff) ioctl$PERF_EVENT_IOC_QUERY_BPF(r0, 0xc008240a, &(0x7f0000000200)={0x400000000000002e}) 12:34:41 executing program 0: r0 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080)='/dev/sequencer2\x00', 0x0, 0x0) write$UHID_CREATE(r0, &(0x7f0000000300)={0x0, 'syz1\x00', 'syz1\x00', 'syz1\x00', &(0x7f0000000200)=""/209, 0xd1, 0x400, 0x7ff, 0x5, 0xfffffffffffff800, 0xaa98}, 0x120) perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff}, 0x0, 0x0, 0xffffffffffffffff, 0x0) statfs(&(0x7f0000000100)='./file0\x00', &(0x7f0000000140)=""/41) r1 = syz_open_procfs(0x0, &(0x7f00000000c0)="00000000e00000") getdents(r1, &(0x7f0000000040)=""/46, 0x2e) [ 504.221528] binder_thread_write: 1 callbacks suppressed [ 504.221542] binder: 26398:26412 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 12:34:41 executing program 2: perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f0000000180)=""/148, 0x13d}], 0x1, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000440)="696f001b66408225aaa3af068fffebb8a490c47dda6586f1b58895b94a78037dd3714e7198820a7a709e2d30d25e6d846cd5c62a648a598668a8263b752b0b622b115112b5ad8e0425c0b784bbdb89eb8f4da0dd73dd01fe35694c2f78600badf8a0e237dba40713bac9e053b41a9f62be5fbb928018aab5f7500bef51a2fd74d4fffb4a20a946733820bdc1b485afa417cdbcfdfbc54f58c9c3edffe240c36f4ab8a16613814e226b6d20d98010ab1ace49fa76dce337a5a5f1dcff9e5d533b12475e33b971b15b69cd591cd9059759f0f04ba5468a34b98915033debb3e87f048e8601712659d47d8687eb6be5e650068d88000000000000") preadv(r0, &(0x7f0000000480), 0x10000000000002a1, 0x0) io_setup(0x10000, &(0x7f0000000000)=0x0) io_cancel(r1, &(0x7f0000000080)={0x0, 0x0, 0x0, 0xf, 0x5d8, r0, &(0x7f0000000040)="634c04b6568e32c200fdbb27e1121baf0ac278a94ce1a9c61818eaf16bf122d30e9ef5b376de48f4496e25ee75f9a47f", 0x30, 0x2, 0x0, 0x2, 0xffffffffffffff9c}, &(0x7f00000000c0)) msgget$private(0x0, 0x22) 12:34:41 executing program 5: r0 = eventfd2(0x0, 0x1) r1 = syz_open_dev$amidi(&(0x7f0000000000)='/dev/amidi#\x00', 0x5, 0x40000) ioctl$VHOST_SET_VRING_KICK(r1, 0x4008af20, &(0x7f0000000040)={0x3, r0}) socketpair$unix(0x1, 0xfffffffffffd, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) read$eventfd(r0, &(0x7f0000354000), 0x8) write$eventfd(r0, &(0x7f0000951ff8)=0x3ff, 0x8) 12:34:41 executing program 4: socket$inet6(0xa, 0x0, 0x80000000) sched_setaffinity(0x0, 0x7, &(0x7f00000000c0)=0x9) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0) fcntl$setflags(0xffffffffffffffff, 0x2, 0x1) r0 = socket$inet6(0xa, 0x400000000001, 0x0) r1 = dup(r0) setsockopt$inet6_tcp_int(r1, 0x6, 0x12, &(0x7f0000000000)=0x7f, 0x4) bind$inet6(r0, &(0x7f0000000040)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) getsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER_VALUE(r0, 0x84, 0x7c, &(0x7f00000001c0)={0x0, 0x0, 0x6}, &(0x7f0000000240)=0x8) sendto$inet6(r0, &(0x7f00000004c0), 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x4) socket$inet6(0xa, 0x1000000000002, 0x0) r2 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x4020940d, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000200)={0x4, 0x0, &(0x7f0000000100)=[@enter_looper], 0x1, 0x0, &(0x7f0000000180)='T'}) r3 = gettid() timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, &(0x7f0000040000)) tkill(r3, 0x1004000000016) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0xfffffffffffffced, 0x0, &(0x7f0000000040)}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x400c630f}], 0x0, 0x0, &(0x7f0000000f4d)}) 12:34:41 executing program 1: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000300)={0x12, 0x5, &(0x7f0000000140)=@framed={{}, [@jmp={0x5, 0x0, 0x0, 0x0, 0x0, 0x80}]}, &(0x7f00000001c0)='GPL\x00', 0x0, 0x1000, &(0x7f0000000680)=""/4096}, 0x48) r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f00000004c0)={0x26, 'skcipher\x00', 0x0, 0x0, 'xts(tnepres)\x00'}, 0x58) r1 = syz_open_dev$vcsn(&(0x7f0000000180)='/dev/vcs#\x00', 0x6, 0x200) getsockname$llc(r1, &(0x7f0000000200)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @remote}, &(0x7f0000000280)=0x10) r2 = accept4(r0, 0x0, &(0x7f0000000000), 0x0) syz_open_dev$admmidi(&(0x7f0000000240)='/dev/admmidi#\x00', 0x0, 0x0) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000000100), 0x0) getsockopt$inet_IP_IPSEC_POLICY(r2, 0x0, 0x10, &(0x7f0000002840)={{{@in, @in=@multicast2}}, {{@in6=@local}, 0x0, @in=@loopback}}, &(0x7f00000000c0)=0xffffffffffffffb7) sendto$unix(r2, &(0x7f0000000400), 0xff26, 0x0, 0x0, 0x22) fcntl$getown(0xffffffffffffffff, 0x9) sched_setaffinity(0x0, 0x8, &(0x7f0000000100)) recvmsg$kcm(r2, &(0x7f0000000640)={&(0x7f0000000040)=@pppol2tpv3in6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @mcast2}}}, 0x80, &(0x7f00000005c0)=[{&(0x7f0000001840)=""/4096, 0xd006}], 0xe}, 0x0) inotify_init1(0x800) r3 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000440)='/dev/vcs\x00', 0x0, 0x0) ioctl$UI_SET_PROPBIT(r3, 0x4004556e, 0x19) [ 504.528044] binder: 26434:26444 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 12:34:42 executing program 3: syz_open_dev$sndctrl(&(0x7f0000000140)='/dev/snd/controlC#\x00', 0x0, 0x0) sched_setaffinity(0x0, 0x7, &(0x7f00000000c0)=0x9) r0 = perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0) fcntl$setflags(r0, 0x2, 0x1) getsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER_VALUE(0xffffffffffffffff, 0x84, 0x7c, &(0x7f00000001c0), &(0x7f0000000240)=0x8) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(0xffffffffffffffff, 0x84, 0x9, &(0x7f0000000280)={0x0, @in={{0x2, 0x4e23, @remote}}, 0xfffffffffffffff7, 0x0, 0x400}, 0x98) sendto$inet6(0xffffffffffffffff, &(0x7f00000004c0), 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) setsockopt$SO_BINDTODEVICE(0xffffffffffffffff, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x4) socket$inet6(0xa, 0x1000000000002, 0x0) r1 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x4, 0x3f00000000000000, &(0x7f0000000100)=[@enter_looper], 0x1, 0x0, &(0x7f0000000180)='T'}) r2 = gettid() timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, &(0x7f0000040000)) tkill(r2, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0xfffffffffffffced, 0x0, &(0x7f0000000040)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x400c630f}], 0x0, 0x0, &(0x7f0000000f4d)}) 12:34:42 executing program 0: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = gettid() timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) r1 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vhost-vsock\x00', 0x2, 0x0) ioctl$VHOST_VSOCK_SET_GUEST_CID(r1, 0x4008af60, &(0x7f0000000040)={@my=0x0}) r2 = socket$vsock_stream(0x28, 0x1, 0x0) connect$vsock_dgram(r2, &(0x7f0000000200)={0x28, 0x0, 0x0, @my=0x0}, 0x10) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x1c9c380}}, &(0x7f0000040000)) tkill(r0, 0x200008000034) 12:34:42 executing program 5: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$nl_netfilter(r0, &(0x7f0000d65000)={&(0x7f00000004c0), 0xc, &(0x7f0000000000)={&(0x7f0000000040)=ANY=[@ANYBLOB="140000000201ffff0000b735033d132835ca8905423973f3857000000000000000000000"], 0x24}}, 0x200000000) r1 = syz_open_dev$sndpcmc(&(0x7f0000000080)='/dev/snd/pcmC#D#c\x00', 0x80000000, 0x400) ioctl$RTC_EPOCH_READ(r1, 0x8008700d, &(0x7f00000000c0)) 12:34:42 executing program 2: r0 = perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f0000000180)=""/148, 0x13d}], 0x1, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000340)="696f001b66408225aaa3af068fffebb8a490c47dda6586f1b58895b94a78037dd3714e7198820a7a709e2d30d25e6d846cd5c62a648a598668a8263b752b0b622b115112b5ad8e0425c0b784bbdb89eb8f4da0dd73dd01fe35694c2f78600badf8a0e237dba40713bac9e053b41a9f62be5fbb928018aab5f7500bef51a2fd74d4fffb4a20a946733820bdc1b485afa417cdbcfdfbc54f58c9c3edffe240c36f4ab8a16613814e226b6d20d98010ab1ace49fa76dce337a5a5f1dcff9e5d533b12475e33b971b15b69cd591cd9059759f0f04ba5468a34b98915033debb3e87f048e8601712659d47d8687eb6be5e650068d88000000000000") preadv(r1, &(0x7f0000000480), 0x10000000000002a1, 0x0) msgget$private(0x0, 0x22) ioctl$EXT4_IOC_SETFLAGS(r0, 0x40086602, &(0x7f0000000000)=0x82) 12:34:42 executing program 4: socket$inet6(0xa, 0x0, 0x80000000) sched_setaffinity(0x0, 0x7, &(0x7f00000000c0)=0x9) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0) fcntl$setflags(0xffffffffffffffff, 0x2, 0x1) r0 = socket$inet6(0xa, 0x400000000001, 0x0) r1 = dup(r0) setsockopt$inet6_tcp_int(r1, 0x6, 0x12, &(0x7f0000000000)=0x7f, 0x4) bind$inet6(r0, &(0x7f0000000040)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) getsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER_VALUE(r0, 0x84, 0x7c, &(0x7f00000001c0)={0x0, 0x0, 0x6}, &(0x7f0000000240)=0x8) sendto$inet6(r0, &(0x7f00000004c0), 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x4) socket$inet6(0xa, 0x1000000000002, 0x0) r2 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x5452, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000200)={0x4, 0x0, &(0x7f0000000100)=[@enter_looper], 0x1, 0x0, &(0x7f0000000180)='T'}) r3 = gettid() timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, &(0x7f0000040000)) tkill(r3, 0x1004000000016) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0xfffffffffffffced, 0x0, &(0x7f0000000040)}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x400c630f}], 0x0, 0x0, &(0x7f0000000f4d)}) 12:34:42 executing program 1: r0 = socket(0x10, 0x3, 0x0) r1 = socket(0xc, 0x800, 0xffff) write(r0, &(0x7f00000015c0)="240000005a001f00ff010002010002080002800100000000000000000000000000000000", 0x24) r2 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000380)='/proc/sys/net/ipv4/vs/sync_sock_size\x00', 0x2, 0x0) ioctl$RTC_AIE_ON(r2, 0x7001) ioctl$DRM_IOCTL_GET_MAP(r2, 0xc0286404, &(0x7f0000000b80)={&(0x7f0000ffc000/0x4000)=nil, 0x7, 0x0, 0x85, &(0x7f0000ffe000/0x2000)=nil, 0x9}) r3 = openat$dir(0xffffffffffffff9c, &(0x7f0000000bc0)='./file0\x00', 0x123001, 0x7c) linkat(r2, &(0x7f00000003c0)='./file0\x00', r3, &(0x7f0000000440)='\x00', 0x400) r4 = getpgid(0x0) getsockopt$sock_cred(r1, 0x1, 0x11, &(0x7f0000000900)={0x0}, 0xfffffffffffffffd) kcmp$KCMP_EPOLL_TFD(r4, r5, 0x7, r2, &(0x7f0000000940)={r2, r1, 0x80000000}) getsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r1, 0x84, 0x9, &(0x7f0000000200)={0x0, @in={{0x2, 0x4e21, @local}}, 0x5cea, 0x3101, 0x4, 0x947, 0x57}, &(0x7f00000002c0)=0x98) r7 = syz_genetlink_get_family_id$team(&(0x7f0000000500)='team\x00') getsockopt$inet_IP_IPSEC_POLICY(r2, 0x0, 0x10, &(0x7f0000000600)={{{@in=@local, @in=@loopback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@loopback}, 0x0, @in=@multicast1}}, &(0x7f0000000700)=0xe8) sendmsg$TEAM_CMD_OPTIONS_SET(r2, &(0x7f0000000800)={&(0x7f00000004c0)={0x10, 0x0, 0x0, 0x2000020}, 0xc, &(0x7f00000007c0)={&(0x7f0000000740)={0x58, r7, 0x16, 0x70bd25, 0x25dfdbff, {}, [{{0x8, 0x1, r8}, {0x3c, 0x2, [{0x38, 0x1, @notify_peers_count={{0x24, 0x1, 'notify_peers_count\x00'}, {0x8}, {0x8, 0x4, 0x400}}}]}}]}, 0x58}, 0x1, 0x0, 0x0, 0x40010}, 0x800) getsockopt$inet_sctp_SCTP_SOCKOPT_PEELOFF(r0, 0x84, 0x66, &(0x7f0000000300)={r6, 0x3}, &(0x7f0000000340)=0x8) r9 = getpgrp(0xffffffffffffffff) setsockopt$IP_VS_SO_SET_ADD(r0, 0x0, 0x482, &(0x7f0000000980)={0xbf, @multicast1, 0x4e23, 0x2, 'sed\x00', 0x1, 0x8000, 0x7b}, 0x2c) setsockopt$inet6_tcp_TCP_REPAIR_WINDOW(r2, 0x6, 0x1d, &(0x7f0000000480)={0x7, 0x6, 0x3, 0x2, 0x1}, 0x14) r10 = openat$sequencer(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/sequencer\x00', 0x240000, 0x0) r11 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000580)='IPVS\x00') sendmsg$IPVS_CMD_FLUSH(r1, &(0x7f00000008c0)={&(0x7f0000000540)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f00000005c0)={&(0x7f0000000840)={0x50, r11, 0x0, 0x70bd27, 0x25dfdbfb, {}, [@IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0xaa}, @IPVS_CMD_ATTR_DEST={0x34, 0x2, [@IPVS_DEST_ATTR_PERSIST_CONNS={0x8, 0x9, 0x7ff}, @IPVS_DEST_ATTR_PORT={0x8, 0x2, 0x4e21}, @IPVS_DEST_ATTR_L_THRESH={0x8, 0x6, 0xa6a3}, @IPVS_DEST_ATTR_INACT_CONNS={0x8}, @IPVS_DEST_ATTR_ADDR_FAMILY={0x8, 0xb, 0xa}, @IPVS_DEST_ATTR_WEIGHT={0x8, 0x4, 0xfffffffffffffffd}]}]}, 0x50}, 0x1, 0x0, 0x0, 0x40}, 0x4000051) write$RDMA_USER_CM_CMD_CREATE_ID(r10, &(0x7f0000000a00)={0x0, 0x18, 0xfa00, {0x3, &(0x7f00000009c0)={0xffffffffffffffff}, 0x111, 0x1}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_ADDR(r2, &(0x7f0000000a40)={0x15, 0x110, 0xfa00, {r12, 0xffffffff, 0x0, 0x0, 0x0, @in6={0xa, 0x4e24, 0x7, @mcast1, 0xe504}, @in={0x2, 0x4e24, @dev={0xac, 0x14, 0x14, 0x20}}}}, 0x118) perf_event_open(&(0x7f0000000140)={0x7, 0x70, 0x1, 0x5, 0x8080, 0x101, 0x0, 0x6399c686, 0x28000, 0x0, 0x40, 0xfffffffffffffff7, 0x2d, 0x4, 0xb1f, 0x1, 0x6, 0x346, 0x7f, 0x40, 0x7, 0x3, 0x5, 0x8001, 0x7, 0x2, 0x450e, 0xffff, 0x6, 0x100, 0x2, 0x9, 0x10001, 0x7fffffff, 0x7dd, 0x3, 0x9, 0x7fffffff, 0x0, 0x6e, 0x1, @perf_bp={&(0x7f0000000100), 0x8}, 0x100, 0x10000, 0x7fffffff, 0x7, 0x3, 0x1, 0x3}, r9, 0x6, r10, 0xa) fstatfs(r0, &(0x7f0000000000)=""/223) [ 504.901581] binder: BINDER_SET_CONTEXT_MGR already set [ 504.906927] binder: 26401:26406 ioctl 40046207 0 returned -16 [ 504.914096] binder: undelivered death notification, 0000000000000000 [ 504.921317] binder: undelivered death notification, 0000000000000000 [ 505.002328] kasan: CONFIG_KASAN_INLINE enabled [ 505.019096] nla_parse: 24 callbacks suppressed [ 505.019106] netlink: 16 bytes leftover after parsing attributes in process `syz-executor1'. [ 505.023127] kasan: GPF could be caused by NULL-ptr deref or user memory access [ 505.044817] binder: 26466:26470 Acquire 1 refcount change on invalid ref 0 ret -22 [ 505.045839] netlink: 16 bytes leftover after parsing attributes in process `syz-executor1'. [ 505.053749] general protection fault: 0000 [#1] PREEMPT SMP KASAN [ 505.067526] CPU: 0 PID: 26472 Comm: syz-executor5 Not tainted 4.19.0-rc4-next-20180921+ #77 [ 505.076011] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 505.085457] RIP: 0010:ctnetlink_alloc_filter+0xb9/0x200 [ 505.090830] Code: 89 fa 48 c1 ea 03 80 3c 02 00 0f 85 57 01 00 00 48 b8 00 00 00 00 00 fc ff df 4d 8b 6c 24 40 49 8d 7d 04 48 89 fa 48 c1 ea 03 <0f> b6 14 02 48 89 f8 83 e0 07 83 c0 03 38 d0 7c 08 84 d2 0f 85 06 [ 505.109735] RSP: 0018:ffff880195a2f290 EFLAGS: 00010247 [ 505.115108] RAX: dffffc0000000000 RBX: ffff8801d36396c0 RCX: ffffc90007a8c000 [ 505.122385] RDX: 0000000000000000 RSI: ffffffff864e6f4d RDI: 0000000000000004 [ 505.129655] RBP: ffff880195a2f2a8 R08: ffff8801beca83c0 R09: ffffed003b585b57 [ 505.136930] R10: ffffed003b585b57 R11: ffff8801dac2dabb R12: ffff880195a2f500 [ 505.144201] R13: 0000000000000000 R14: 0000000000000ba7 R15: 0000000000000035 [ 505.151475] FS: 00007f131c486700(0000) GS:ffff8801dac00000(0000) knlGS:0000000000000000 [ 505.159700] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 505.165582] CR2: 0000001b30121000 CR3: 00000001c3c71000 CR4: 00000000001406f0 [ 505.172857] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 505.180134] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 505.187406] Call Trace: [ 505.190008] ctnetlink_del_conntrack+0x65d/0x840 [ 505.194774] ? ctnetlink_new_expect+0x6c0/0x6c0 [ 505.199452] ? rcu_read_unlock_special+0x1c0/0x1c0 [ 505.204395] ? __lock_is_held+0xb5/0x140 [ 505.208470] ? ctnetlink_new_expect+0x6c0/0x6c0 [ 505.213203] nfnetlink_rcv_msg+0xdd3/0x10c0 [ 505.217550] ? nfnetlink_bind+0x3b0/0x3b0 [ 505.221708] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 505.227256] ? refcount_sub_and_test_checked+0x203/0x310 [ 505.232726] ? refcount_inc_not_zero_checked+0x2f0/0x2f0 [ 505.238204] ? rcu_softirq_qs+0x20/0x20 [ 505.242200] ? apparmor_cred_transfer+0x590/0x590 [ 505.247066] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 505.252616] netlink_rcv_skb+0x172/0x440 [ 505.256686] ? nfnetlink_bind+0x3b0/0x3b0 [ 505.260841] ? netlink_ack+0xb80/0xb80 [ 505.264769] ? __netlink_ns_capable+0x100/0x130 [ 505.269453] nfnetlink_rcv+0x1c0/0x4d0 [ 505.273348] ? nfnetlink_rcv_batch+0x19b0/0x19b0 [ 505.278116] ? kasan_check_write+0x14/0x20 [ 505.282368] netlink_unicast+0x5a5/0x760 [ 505.286443] ? netlink_attachskb+0x9a0/0x9a0 [ 505.290862] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 505.296411] ? __sanitizer_cov_trace_cmp4+0x16/0x20 [ 505.301441] netlink_sendmsg+0xa18/0xfc0 [ 505.305519] ? netlink_unicast+0x760/0x760 [ 505.309759] ? aa_sock_msg_perm.isra.12+0xba/0x160 [ 505.314696] ? apparmor_socket_sendmsg+0x29/0x30 [ 505.319460] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 505.325006] ? security_socket_sendmsg+0x94/0xc0 [ 505.329768] ? netlink_unicast+0x760/0x760 [ 505.334063] sock_sendmsg+0xd5/0x120 [ 505.337791] ___sys_sendmsg+0x7fd/0x930 [ 505.341781] ? copy_msghdr_from_user+0x580/0x580 [ 505.346541] ? __fd_install+0x2b5/0x8f0 [ 505.350524] ? check_preemption_disabled+0x48/0x200 [ 505.355549] ? __fget_light+0x2e9/0x430 [ 505.359533] ? fget_raw+0x20/0x20 [ 505.362999] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 505.368538] ? __fd_install+0x2f9/0x8f0 [ 505.372520] ? get_unused_fd_flags+0x1a0/0x1a0 [ 505.377118] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 505.382662] ? sockfd_lookup_light+0xc5/0x160 [ 505.387170] __sys_sendmsg+0x11d/0x280 [ 505.391064] ? __ia32_sys_shutdown+0x80/0x80 [ 505.395497] ? __x64_sys_futex+0x47f/0x6a0 [ 505.399743] ? do_syscall_64+0x9a/0x820 [ 505.403722] ? do_syscall_64+0x9a/0x820 [ 505.407728] ? trace_hardirqs_off_caller+0x300/0x300 [ 505.412839] ? ksys_ioctl+0x81/0xd0 [ 505.416478] __x64_sys_sendmsg+0x78/0xb0 [ 505.420551] do_syscall_64+0x1b9/0x820 [ 505.424448] ? entry_SYSCALL_64_after_hwframe+0x3e/0xbe [ 505.429817] ? syscall_return_slowpath+0x5e0/0x5e0 [ 505.434754] ? trace_hardirqs_off+0x310/0x310 [ 505.439255] ? prepare_exit_to_usermode+0x3b0/0x3b0 [ 505.444283] ? recalc_sigpending_tsk+0x180/0x180 [ 505.449045] ? kasan_check_write+0x14/0x20 [ 505.453304] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 505.458166] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 505.463357] RIP: 0033:0x457679 [ 505.466555] Code: 1d b4 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 eb b3 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 505.485457] RSP: 002b:00007f131c485c78 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 505.493171] RAX: ffffffffffffffda RBX: 00007f131c4866d4 RCX: 0000000000457679 [ 505.500441] RDX: 0000000200000000 RSI: 0000000020d65000 RDI: 0000000000000003 [ 505.507708] RBP: 000000000072bf00 R08: 0000000000000000 R09: 0000000000000000 [ 505.514975] R10: 0000000000000000 R11: 0000000000000246 R12: 00000000ffffffff [ 505.522444] R13: 00000000004d5520 R14: 00000000004c38d2 R15: 0000000000000000 [ 505.529729] Modules linked in: [ 505.538119] binder: 26466:26470 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 505.545448] binder: 26466:26484 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 12:34:42 executing program 1: r0 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000100)='smaps_rollup\x00') exit(0x0) read(r0, &(0x7f0000000000)=""/56, 0x38) ioctl$PIO_UNISCRNMAP(r0, 0x4b6a, &(0x7f0000000040)="d1a128e92b55093e3dfe466b924ddba2c645ba6221e33530137d8cde7ce84cbec2ae255068a07d14ddb6aa077ec5729b4593866cc7027a3141d1f313572031d9feeeb9c38f7a593a9f2e1d143fad550b678b0af533c0f4fec233d1546f830a06b71feb29509b07b039127a64d5d8a8378513e7fe502da5c1da073663") [ 505.549171] ---[ end trace 426c27a78f22f6a3 ]--- [ 505.557599] RIP: 0010:ctnetlink_alloc_filter+0xb9/0x200 [ 505.570684] Code: 89 fa 48 c1 ea 03 80 3c 02 00 0f 85 57 01 00 00 48 b8 00 00 00 00 00 fc ff df 4d 8b 6c 24 40 49 8d 7d 04 48 89 fa 48 c1 ea 03 <0f> b6 14 02 48 89 f8 83 e0 07 83 c0 03 38 d0 7c 08 84 d2 0f 85 06 [ 505.590079] RSP: 0018:ffff880195a2f290 EFLAGS: 00010247 [ 505.596386] RAX: dffffc0000000000 RBX: ffff8801d36396c0 RCX: ffffc90007a8c000 12:34:42 executing program 2: perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f0000000180)=""/148, 0x13d}], 0x1, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000340)="696f001b66408225aaa3af068fffebb8a490c47dda6586f1b58895b94a78037dd3714e7198820a7a709e2d30d25e6d846cd5c62a648a598668a8263b752b0b622b115112b5ad8e0425c0b784bbdb89eb8f4da0dd73dd01fe35694c2f78600badf8a0e237dba40713bac9e053b41a9f62be5fbb928018aab5f7500bef51a2fd74d4fffb4a20a946733820bdc1b485afa417cdbcfdfbc54f58c9c3edffe240c36f4ab8a16613814e226b6d20d98010ab1ace49fa76dce337a5a5f1dcff9e5d533b12475e33b971b15b69cd591cd9059759f0f04ba5468a34b98915033debb3e87f048e8601712659d47d8687eb6be5e650068d88000000000000") ioctl$DRM_IOCTL_GET_CAP(r0, 0xc010640c, &(0x7f0000000000)={0xba6c, 0x5738b403}) preadv(r0, &(0x7f0000000040), 0x10000084, 0x0) preadv(r0, &(0x7f0000000500)=[{&(0x7f0000000040)=""/190, 0xbe}, {&(0x7f00000013c0)=""/4096, 0x1000}, {&(0x7f0000000280)=""/188, 0xbc}, {&(0x7f0000000440)=""/146, 0x92}, {&(0x7f0000000100)=""/35, 0x23}], 0x5, 0x6) msgget$private(0x0, 0x22) [ 505.603806] RDX: 0000000000000000 RSI: ffffffff864e6f4d RDI: 0000000000000004 [ 505.611156] RBP: ffff880195a2f2a8 R08: ffff8801beca83c0 R09: ffffed003b585b57 [ 505.618615] R10: ffffed003b585b57 R11: ffff8801dac2dabb R12: ffff880195a2f500 [ 505.626183] R13: 0000000000000000 R14: 0000000000000ba7 R15: 0000000000000035 [ 505.630999] kobject: 'loop2' (000000001b822f6c): kobject_uevent_env [ 505.634065] FS: 00007f131c486700(0000) GS:ffff8801dac00000(0000) knlGS:0000000000000000 [ 505.640592] kobject: 'loop2' (000000001b822f6c): fill_kobj_path: path = '/devices/virtual/block/loop2' [ 505.648356] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 505.648367] CR2: 0000001b2fe22000 CR3: 00000001c3c71000 CR4: 00000000001406f0 [ 505.648382] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 505.681179] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 505.688614] Kernel panic - not syncing: Fatal exception [ 505.694915] Kernel Offset: disabled [ 505.698547] Rebooting in 86400 seconds..