30c4435529fbbe899e78e387b0a09aec43928233b86ef395ae548ae7faae1195f1eac425ebf8c5b0876aa30be38a6a8a61be8e625c0940f15014cf4c8457118fc5a0ec320b4a9be372b2560d126aaa40812b387d7e6a19155698f0fd5da3eda8d3b2eb680e5fdce4440cb591bdbd6225a8586de9c63e1330da78c1402424e0cf8c841acce83c629eb24395d6bcb6faf26d8b26e4ee4a730bf78ffb6621f875bb3227566704102acde82badd4f3869fe234395edc5e439ab526eca234e4c281b9e7cc801d2d7225210c0147ee02f6f99171cb60bf90f178c5ce942ca5134d002131474d15b48ad4abffcc6c735a30a4a5a8350357aeb785b5ee8eedede91fae7ba04df471a4217a741790f1836b7925aa6471c2e253c1c5d4e1ddf948331895e21d802459ecacdbc385e52b2e69490172926d43fd1f1daa40b226881753039bd734ba897abed5167f345eebf83d2ae2c201ad4488f42e4584d3daef11840a8b5464794561e157cd3f9db8640b61dc4c15dd382bd170f579f8e4c9c1373175e49da846f6212a78169858ab2380fef4d4d7aaff395e17a1d66e23a89a4cbe1254a298e7b969efd051713450ff14a9e5cf1d10b95318696bccff62ec7f730700ad8134e43f0b175cde8c4752f996783ab569cc8bfca76dc699d3cc124e9088917ffc23c8b361789e8d2b557a217d2b02a77db6c18ca068a11c83781ce1cf6fc25c1cbd564e22920e3d7790e169b2c4e87515ab90e55fe7f759868c975631f12f03be55f870d1b26b119f177e6d6bbc5ae9f2b67393f0feb783981e13d9a709d77d98e59a0c0af9fc5ecd3b3e5d1003e98f6d742cf62d6f15884fcd3e48a6263dd8138645036e83b3b7e3fcb6619fb11ef6cee6e6adfdd0d5ed7c9427a05fb973713dffa25d17c935a6006387d5a4c29b00455b36a8532a6a6a67ac28f7a8d70f849a77973145a9b28548207ab5acb66952d5cdd06437d309e5a809254d5cb7968ea2d0fc2162774550100c177e3d31692656d9a1ce054a2b8db80408931eba590941eee757e4e3cf644c1762e80a478283ec8849aca2aceba984ba50e04376a1bedaa50c2891b0926e04af25f1d5550fa491551c32ac652dc3636333164e7445a25ce22cad13d20c196687d4855928ebc17489b6b800c22b31df33432481b9bd7b1b390389487bd36283648b8633d7ad7c25cee9f1bac17eb14c5c292b462fb26430ba699e9b4fea8aa0e0bec2b31f4be73c854927562f498799c0f6fe94b84701134e0b3f99aaab987361bf5609a8bbe604ab42a07d3574765927eb9f29a85d7335ffe5b1672841ea9ec5982035d2bad18548bc202673ee365822108c3ab642bdb64f1232468fa14983606d30af3804ab6cdbfccd9258f13e34dacd4eafb21507cf9cd0c3f87e61c4e663288891128f30b44127456f86ba3e88f4b1aea71d9b251bd442b29c72fe5dded5b965892846bfce93f92492fd7c92d0f12e99f9d60390d87594284a0943b90bb65dc98e882aaf6fe7ded31bd96bdfe578d6650deaa8e7e43c3c17309e5057875a55c15084603a31ddc6a3f1ea9756dba0465af5f534ca3a7b1c0b84c9fef5422dc6dbef2fa4c810c0a0c98592a870173736f0b3e322093c35f51bdac241e89f182e61bbefa139b887e2fb3d512e44b7863a665fe12653cb9eb74c99799442b29784fca31238cae861f613217db190b7dc0e3f4772aace58ca4b2aa4d92bd2330f84af3d59ad10a49dfd10021b7d1dddab01cde922aa41ab0e381497c8fff2a1bcaf72104bb25a63064523ee63e8c8710e5bd160a1972aa84c726cee220b025e03a95e65116f71f2ec387986a557a6670322161d1fb6e890cbb55c9cd84d8d9ee86f6bca63fc59697a449a727696fcbe14497b84e7926c9d563fc3b7eb3eb8f74761e1ad906e95702de9dec41b48d511d83a9838f2423ae03d06575384589c0601911bb0059ac51f57aec970b18c62597544145035d101aa3d6eb39b91ab0ef8ebbc8f189ea49792f2edf6de05f4211ce33cb01b786abd73bb102a7610b3b2a9420c6e3e0d5d4b22b48f720e182be09edbc2ca2b55776984510092620b075270769ec25f925ae753a2f2a25aee61c593290e1968845ac15fafdc97bbadb3f07f9d010b75a408aeeceeafb6490b3e58198c5cd81a6dbee75a48b7ac4c2f4d868e092f90a31b721d72646d99e0dd5864256f8fe414a7cf25c1051f7f0928efda07d534d24f21cb23c38c9847b48e1682676b361f1edf6acbf53a3e3d18d33a7c5fe69dda8d141846adc49bae497129c7aca8f608fe48b58a69b2e08551c27927aacb3dc3c17eb211cdd9629854d016298e349a8af2b495723bb47ff8d2b46b9818b63fd29d7be440e989108a8d07719186ce50c979c18688d4cf0a1d952e5c7b7b72a58d347bb39c9a395f01140e678f52ef9d026473d798c73ebf143b0d0d6e0e64b7b2fad01d872a241b85240b7c1f89a66652a5829c971c48bdcc649bd601ddc18bc90809be124841ab1ae8eaf16b76ba0461ec9bf8d44ca43b482fde4df1ef9d8800eb5338a749515cd929febf05639c4977034ee9cbe7be8f11730baf8c74aa1ecc3dc2b773c2be16219a8745cd8508a21ef5f9637731fca02f0fb480b73e17de476bd13acdd13a5d2ca0019bab8bbbb7fd7c253ec09320318ad0557487ca56075b196dbaa777a22c672ba868e02bcde25be3786742dc8235ff70a15db512fea064eeee0dffed804ef16f69b02aac6231c4ba2fe78297284cc775ccbf69d9e7affd59e756f6b6bdaecf39de036e53b50add7f76b693daa090b3866dab6d90e40b4e07fe39f7ef750730c5c86f67e3527907e8ccd1c8c498d8b617d019750a46367ff14a192f8a0a3f9bd258bcf3e41a71a64273c732ce596c222b9c9c9aad8228436f4ae71a89dc1749605bbeecccb268b45562bcbcf94ae3bee53150307b015ea8095e363c6eda60eaffd4d042b582c38751978417239f56d1cf4e78c46a871318c3fea85065e1b2ea3b4e0c99449bf0f8b42ab9951689e6aa5bee8829b5bb4b5b19ef42b12500b9116729ba99f65a3a1c02e8927cac9621368f1a836fb55f9f317daf9b2acf74caea8d8723c521481ebf4458ba033a2bbd67c4a9e61010493dbfd8d376954633d695399e936b12cff0ad460e71c0a99642ff91b206ad3a9179cc5b3187836d3d39e5839c9739a22a6ffd039d7175ab6e6ddae43161881d22251682cc0dba51d52266bd8962a0445b10af4078d2eeff9527d5ca2fd4386689a7a622f510616c2d5b8131922bef8a4b858db647e2ae5948f053566ec9cd518365628473eae6e114d008c96250dad7e254042ba6f552852ca6c486d6d6ae04414bcc9110aacd59ceb93ebcc0b9ee7f6fe9ffb3bbd2f5f4a029e2c8893ffc36cd9bdb4cecd103e6726310a81bf4ebc6fe324faa02ba2a6fb5112c1d17b52e43152778deba5c553ac3b7bbbdd5e80878577e952be026cd276fa4da9e0e3f62dcff8f89907f268c3d98585e68605571cbc847b9e4179409b578bda7eaad265ec2192b0a1a01b6e862d5fe6ea8fa93327a1cec5d44c2746406a33ca986e151a937428f5dec109c5ff5fa5fdd43955b0dea4fe6e0456a4fa4e29d9d98327cf23b88f3596997976f89abad6461b4cd9d28ee7167271cd889ea02fde0e1eedc00bcd3969a8c8cef3ed1236179b61cc6d5ad20ca8b4d2e563cae7fbacae7d9e3d75a200d61454e44d5805cc5c8791d43cabac876e78e4058437826c5f1e5da595b6771a7b258499bd65bd10cea8a3e87750caf9f82f13d08a9ca4dca314841f94b70ed25a73caee03e2904cfa01101ee596bb0079c790f63d17ff490948609359a52908b6f4193d3308baeda5ae028aba783fecdf844b449143c152442b44cf08a0b2d172460a826c8ba096e8a25d0a4461db8fd352df3ad7d637f840b8d892b6a49921a4e690ddfed43d8d18dca31aaa673f25502d3b6a613d68bb361248629a56c57280ebfb4bbff95d7b933d636c6e8040b79a1a0780957181feeadf614ba7bd8b9683dc358a45cf7283be2647e8615a2e643939d29fd65e93f913b5ee87d4ef3d046e00e1a3c108d84a22188703b841bb630bca2be2133d515849a92a8f17b3044701c0a8350baafa6824622770648e6b2", [[], [], []]}, 0x1320) syz_kvm_setup_cpu$x86(r3, 0xffffffffffffffff, &(0x7f0000fe5000/0x18000)=nil, &(0x7f0000000000)=[@text64={0x40, &(0x7f0000000500)="0f0866b8ed008ec066ba4000b000eed2a807000000410f01cab98e0b0000b862000000ba000000000f30b90b0800000f320fc72a8f2a60128f00000000003000000fc7aa00100000", 0x48}], 0x1, 0x0, &(0x7f0000000040), 0x0) 13:29:31 executing program 0: r0 = socket$inet(0x2, 0x4000000803, 0x4) bind$inet(r0, &(0x7f0000000000)={0x2, 0x0, @broadcast}, 0x10) getsockname(r0, &(0x7f00000036c0)=@xdp={0x2c, 0x0, 0x0}, &(0x7f0000000080)=0x80) setsockopt$inet_pktinfo(r0, 0x0, 0x8, &(0x7f0000003780)={r1, @rand_addr, @dev}, 0xc) syz_emit_ethernet(0x4a, &(0x7f0000000240)={@link_local, @empty=[0x0, 0x88470000], [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x3c, 0x0, 0x0, 0x0, 0x4, 0x0, @empty=0x9000000, @broadcast}, @udp={0x0, 0x0, 0x28}}}}}, &(0x7f0000000380)) 13:29:31 executing program 3: r0 = socket$inet(0xa, 0x801, 0x84) connect$inet(r0, &(0x7f0000000180)={0x2, 0x4e21, @remote={0xac, 0x14, 0xffffffffffffffff}}, 0x10) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) listen(r0, 0xfc0004) r3 = accept4(r0, &(0x7f0000000000)=@ethernet={0x0, @local}, &(0x7f0000000040)=0x10, 0x0) setsockopt$inet_sctp6_SCTP_EVENTS(r3, 0x84, 0xb, &(0x7f0000000440)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xf4}, 0xb) ppoll(&(0x7f0000000240)=[{r3}, {r1}, {r2}], 0x3, &(0x7f0000000340), &(0x7f0000000380), 0x8) [ 529.868040] binder: 25046:25051 Release 1 refcount change on invalid ref 0 ret -22 13:29:31 executing program 1: socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x1000004, 0x4010, r0, 0x0) r2 = creat(&(0x7f0000000040)='./file0\x00', 0x34) ioctl$PERF_EVENT_IOC_ID(r2, 0x80082407, &(0x7f0000000080)) r3 = add_key$user(&(0x7f00000001c0)='user\x00', &(0x7f0000000200)={'syz', 0x0}, &(0x7f0000000240)="9871cecfc7166d51086f6edbf43bc7c74b7d108058aff67685ea30dfe54d7d53b632eaf6533ee827cc2eca954cf63c7658901b4702ee453c54c9f8ba983045841d44c403d54120231bc8f5cbecc2baadb88dd093a715cb89f58468970eebc4fe4a34b4a3a81327d9a50622f59f5e86b14b13ce137304a2de8667de00725227d89b6c1d57b2ae914731c319ecdbb0d327f50a324d98efb9ec50db4f215a6369f36b66e393b380a327f57ff102fd6a0e5a7a2009aa022df67b4825bd59ee0ae6333cdc", 0xc2, 0x0) r4 = request_key(&(0x7f0000000340)='keyring\x00', &(0x7f0000000380)={'syz', 0x3}, &(0x7f00000003c0)="3a887070703100", 0xfffffffffffffff8) r5 = add_key$user(&(0x7f0000000400)='user\x00', &(0x7f0000000440)={'syz', 0x1}, &(0x7f0000000580)="df22819ab1fd2a18dbaf1b1ddc41de7dc3ec02de683c1a47182cc594d0bf2cfe8b4aa4bbc64d7bd8d3b3f0fa0e5d82f4ff8a8ea3165eead3a63242961c3219a9bf335a44b876343aca8a20d18668735ad59787996d596a42c338906a802e8f5932eb8575a6708e6a9da3af942de5d35c2034b397709b076360f6b3d73225f9e57e291584cf8a676734215ae9d42c49ac0ce743501cbeb8702382fc3f0a01c6642fb41fe4c839c4461ab4dc6c8df27fb1c903891b94a8ec4d7c20b27ee21838d5ddfcbfbd5a3bf93dd0fcd1dc6984c0d6833b5d53d66c03", 0xd7, 0xfffffffffffffffb) keyctl$dh_compute(0x17, &(0x7f0000000480)={r3, r4, r5}, &(0x7f0000000680)=""/123, 0x7b, &(0x7f0000000780)={&(0x7f00000004c0)={'sha384-ssse3\x00'}, &(0x7f0000000700)="80414a78e2875601923fbb129ca0a1f05e2d604922aca01a5252f80c9ff33503e02515fbd108070e13ce697fb6fe97b89316b8f0b7695a4503e456a8ad5890ae98509525b7e8bbecf774f5", 0x4b}) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000000)=[@text64={0x40, &(0x7f0000000500)="0f0866b8ed008ec066ba4000b000eed2a807000000410f01cab98e0b0000b862000000ba000000000f30b90b0800000f320fc72a8f2a60128f00000000003000000fc7aa00100000", 0x48}], 0x1, 0x0, &(0x7f0000000040), 0x0) getpeername$unix(r2, &(0x7f0000000100)=@abs, &(0x7f0000000180)=0x6e) 13:29:31 executing program 2: socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)) syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0xe1, 0x400100) creat(&(0x7f00000001c0)='./file0\x00', 0x2) openat$dsp(0xffffffffffffff9c, &(0x7f0000000200)='/dev/dsp\x00', 0x8000, 0x0) syz_open_dev$mouse(&(0x7f0000000240)='/dev/input/mouse#\x00', 0x100, 0x10000) syz_open_dev$amidi(&(0x7f0000000280)='/dev/amidi#\x00', 0x8000, 0xc0000) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000007000)={0x8, 0x0, &(0x7f0000000140)=[@acquire], 0x0, 0x0, &(0x7f00000001c0)}) r1 = dup2(0xffffffffffffffff, r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000002c0)={0x8, 0x0, &(0x7f00000000c0)=[@release], 0x0, 0x0, &(0x7f0000000300)}) 13:29:31 executing program 0: r0 = socket$inet(0x2, 0x4000000803, 0x4) bind$inet(r0, &(0x7f0000000000)={0x2, 0x0, @broadcast}, 0x10) getsockname(r0, &(0x7f00000036c0)=@xdp={0x2c, 0x0, 0x0}, &(0x7f0000000080)=0x80) setsockopt$inet_pktinfo(r0, 0x0, 0x8, &(0x7f0000003780)={r1, @rand_addr, @dev}, 0xc) syz_emit_ethernet(0x4a, &(0x7f0000000240)={@link_local, @empty=[0x0, 0x800e0000], [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x3c, 0x0, 0x0, 0x0, 0x4, 0x0, @empty=0x9000000, @broadcast}, @udp={0x0, 0x0, 0x28}}}}}, &(0x7f0000000380)) 13:29:31 executing program 4: preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f00000000c0)=""/148, 0x94}], 0x1, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000080)='io\x00') preadv(r0, &(0x7f0000000480), 0x1000000000000283, 0x0) 13:29:31 executing program 5: socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = memfd_create(&(0x7f0000000080)="70726f63ae6d696d655f74797065776c616e316e6f64657600", 0x6) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x2000003, 0x5011, r1, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000000)=[@text64={0x40, &(0x7f0000000500)="0f0866b8ed008ec066ba4000b000eed2a807000000410f01cab98e0b0000b862000000ba000000000f30b90b0800000f320fc72a8f2a60128f00000000003000000fc7aa00100000", 0x48}], 0x1, 0x0, &(0x7f0000000040), 0x0) ioctl$SNDRV_CTL_IOCTL_HWDEP_NEXT_DEVICE(r1, 0xc0045520, &(0x7f0000000040)=0xa) 13:29:31 executing program 1: socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = memfd_create(&(0x7f0000000080)="70726f63ae6d696d655f74797065776c616e316e6f64657600", 0x6) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x2000003, 0x5011, r2, 0x0) ioctl$sock_kcm_SIOCKCMUNATTACH(r2, 0x89e1, &(0x7f0000000040)={r0}) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000000)=[@text64={0x40, &(0x7f0000000500)="0f0866b8ed008ec066ba4000b000eed2a807000000410f01cab98e0b0000b862000000ba000000000f30b90b0800000f320fc72a8f2a60128f00000000003000000fc7aa00100000", 0x48}], 0x1, 0x0, &(0x7f0000000040), 0x0) 13:29:31 executing program 3: r0 = socket$inet(0xa, 0x801, 0x84) connect$inet(r0, &(0x7f0000000180)={0x2, 0x4e21, @remote={0xac, 0x14, 0xffffffffffffffff}}, 0x10) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) connect$unix(r2, &(0x7f0000000100)=@abs={0x0, 0x0, 0x4e21}, 0x6e) listen(r0, 0xfc0004) io_setup(0x521, &(0x7f00000000c0)) r3 = accept4(r0, &(0x7f0000000000)=@ethernet={0x0, @local}, &(0x7f0000000040)=0x10, 0x0) setsockopt$inet_sctp6_SCTP_EVENTS(r3, 0x84, 0xb, &(0x7f0000000440)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xf4}, 0xb) r4 = openat$autofs(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/autofs\x00', 0x40, 0x0) ioctl$SNDRV_RAWMIDI_IOCTL_INFO(r4, 0x810c5701, &(0x7f0000000480)) ppoll(&(0x7f0000000240)=[{r3}, {r1}, {r2}], 0x3, &(0x7f0000000340), &(0x7f0000000380), 0x8) 13:29:31 executing program 2: socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)) syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0xe1, 0x400100) creat(&(0x7f00000001c0)='./file0\x00', 0x2) openat$dsp(0xffffffffffffff9c, &(0x7f0000000200)='/dev/dsp\x00', 0x8000, 0x0) syz_open_dev$mouse(&(0x7f0000000240)='/dev/input/mouse#\x00', 0x100, 0x10000) syz_open_dev$amidi(&(0x7f0000000280)='/dev/amidi#\x00', 0x8000, 0xc0000) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000007000)={0x8, 0x0, &(0x7f0000000140)=[@acquire], 0x0, 0x0, &(0x7f00000001c0)}) r2 = dup2(r1, r0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000002c0)={0x8, 0x0, &(0x7f00000000c0)=[@release], 0x0, 0x0, &(0x7f0000000300)}) 13:29:31 executing program 0: r0 = socket$inet(0x2, 0x4000000803, 0x4) bind$inet(r0, &(0x7f0000000000)={0x2, 0x0, @broadcast}, 0x10) getsockname(r0, &(0x7f00000036c0)=@xdp={0x2c, 0x0, 0x0}, &(0x7f0000000080)=0x80) setsockopt$inet_pktinfo(r0, 0x0, 0x8, &(0x7f0000003780)={r1, @rand_addr, @dev}, 0xc) syz_emit_ethernet(0x4a, &(0x7f0000000240)={@link_local, @empty=[0x0, 0x3e8], [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x3c, 0x0, 0x0, 0x0, 0x4, 0x0, @empty=0x9000000, @broadcast}, @udp={0x0, 0x0, 0x28}}}}}, &(0x7f0000000380)) 13:29:31 executing program 5: socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)) openat$mixer(0xffffffffffffff9c, &(0x7f0000000040)='/dev/mixer\x00', 0x200a01, 0x0) pipe(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = memfd_create(&(0x7f0000000080)="70726f63ae6d696d655f74797065776c616e316e6f64657600", 0x6) ioctl$sock_bt(r0, 0xdd17, &(0x7f0000000140)="66ce626350386f1b9ba83c85d38a33e07514e84f02b8263640c9637134e2a010af7a4a33ac15b37dab2cd8700d837281df9253dc32516ee311ca84dc9b70359ee1f2d648c5b40e95601e835c24aa1d3683bca12ff2baee1e5d55f0a7ecf5f4a6") mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x2000003, 0x5011, r2, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000000)=[@text64={0x40, &(0x7f0000000500)="0f0866b8ed008ec066ba4000b000eed2a807000000410f01cab98e0b0000b862000000ba000000000f30b90b0800000f320fc72a8f2a60128f00000000003000000fc7aa00100000", 0x48}], 0x1, 0x0, &(0x7f0000000040), 0x0) 13:29:31 executing program 4: preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f00000000c0)=""/148, 0x94}], 0x1, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000080)='io\x00') preadv(r0, &(0x7f0000000480), 0x1000000000000006, 0x0) 13:29:31 executing program 1: socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = memfd_create(&(0x7f0000000080)="70726f63ae6d696d655f74797065776c616e316e6f64657600", 0x6) times(&(0x7f0000000040)) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x2000003, 0x5011, r1, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000000)=[@text64={0x40, &(0x7f0000000500)="0f0866b8ed008ec066ba4000b000eed2a807000000410f01cab98e0b0000b862000000ba000000000f30b90b0800000f320fc72a8f2a60128f00000000003000000fc7aa00100000", 0x48}], 0x1, 0x0, &(0x7f0000000040), 0x0) [ 530.340506] binder: 25091:25098 Acquire 1 refcount change on invalid ref 0 ret -22 13:29:31 executing program 3: r0 = openat$full(0xffffffffffffff9c, &(0x7f0000000600)='/dev/full\x00', 0x0, 0x0) write$P9_ROPEN(r0, &(0x7f0000000640)={0x18, 0x71, 0x1, {{0x2, 0x3, 0x7}, 0x1}}, 0x18) stat(&(0x7f0000000680)='./file0\x00', &(0x7f00000006c0)={0x0, 0x0, 0x0, 0x0, 0x0}) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000000740)={0x0, 0x0, 0x0}, &(0x7f0000000780)) write$FUSE_CREATE_OPEN(r0, &(0x7f00000007c0)={0xa0, 0x0, 0x5, {{0x1, 0x2, 0x1, 0x6b, 0x0, 0xab5, {0x1, 0x100, 0x0, 0x7, 0x10001, 0x94a, 0x10001, 0x3, 0x3, 0x0, 0x7, r1, r2, 0x8, 0x4}}, {0x0, 0x2}}}, 0xa0) r3 = socket$inet(0xa, 0x801, 0x84) connect$inet(r3, &(0x7f0000000180)={0x2, 0x4e21, @remote={0xac, 0x14, 0xffffffffffffffff}}, 0x10) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r6 = syz_open_dev$mice(&(0x7f00000001c0)='/dev/input/mice\x00', 0x0, 0x1) r7 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000200)='/dev/dsp\x00', 0x490000, 0x0) ioctl$DRM_IOCTL_INFO_BUFS(r6, 0xc0106418, &(0x7f0000000400)={0x0, 0x2, 0x718e, 0x1, 0x10}) ioctl$PERF_EVENT_IOC_ENABLE(r7, 0x8912, 0x6) listen(r3, 0xfc0004) ioctl$KVM_ENABLE_CAP_CPU(r7, 0x4068aea3, &(0x7f00000004c0)={0x7b, 0x0, [0x1ff, 0x10000, 0xffffffff80000001, 0xc000000000]}) r8 = accept4(r3, &(0x7f0000000000)=@ethernet={0x0, @local}, &(0x7f0000000040)=0x10, 0x0) setsockopt$inet_sctp6_SCTP_EVENTS(r8, 0x84, 0xb, &(0x7f0000000440)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xf4}, 0xb) ppoll(&(0x7f0000000240)=[{r8}, {r4}, {r5}], 0x3, &(0x7f0000000340), &(0x7f0000000380), 0x8) r9 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000480)='/dev/ppp\x00', 0x0, 0x0) getsockopt$inet6_IPV6_IPSEC_POLICY(r8, 0x29, 0x22, &(0x7f0000000900)={{{@in6, @in6=@mcast2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@loopback}, 0x0, @in6=@remote}}, &(0x7f0000000a00)=0xe8) connect$can_bcm(r6, &(0x7f0000000a40)={0x1d, r10}, 0x10) ioctl$SNDRV_SEQ_IOCTL_GET_CLIENT_POOL(r9, 0xc058534b, &(0x7f0000000100)={0x7, 0x400000000000000, 0x8001, 0x2, 0x7, 0x4}) ioctl$SNDRV_SEQ_IOCTL_RUNNING_MODE(r7, 0xc0105303, &(0x7f0000000540)={0x8, 0x800, 0x6}) io_setup(0x7, &(0x7f00000000c0)=0x0) io_cancel(r11, &(0x7f0000000300)={0x0, 0x0, 0x0, 0x8, 0x100000001, r4, &(0x7f0000000280)="4efb66e1702c96c5bd3dd99e1dd919c984377d0e6051c27f9aaa3db8a5d1e7649c7d34d7a26b1cc5e0e87a05b4c252c4f337efed4ec98766eef5a880ca98c8b40c63c5b3fa0a9a5fcadb08a964d79bd5a4ad5fb98afb763a293a0048", 0x5c, 0x6, 0x0, 0x2, r6}, &(0x7f00000003c0)) bind(r8, &(0x7f0000000580)=@ethernet={0x1, @remote}, 0x80) 13:29:31 executing program 0: r0 = socket$inet(0x2, 0x4000000803, 0x4) bind$inet(r0, &(0x7f0000000000)={0x2, 0x0, @broadcast}, 0x10) getsockname(r0, &(0x7f00000036c0)=@xdp={0x2c, 0x0, 0x0}, &(0x7f0000000080)=0x80) setsockopt$inet_pktinfo(r0, 0x0, 0x8, &(0x7f0000003780)={r1, @rand_addr, @dev}, 0xc) syz_emit_ethernet(0x4a, &(0x7f0000000240)={@link_local, @empty=[0x0, 0x3000000], [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x3c, 0x0, 0x0, 0x0, 0x4, 0x0, @empty=0x9000000, @broadcast}, @udp={0x0, 0x0, 0x28}}}}}, &(0x7f0000000380)) [ 530.385273] binder: 25091:25098 Release 1 refcount change on invalid ref 0 ret -22 13:29:31 executing program 2: socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)) syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0xe1, 0x400100) creat(&(0x7f00000001c0)='./file0\x00', 0x2) openat$dsp(0xffffffffffffff9c, &(0x7f0000000200)='/dev/dsp\x00', 0x8000, 0x0) syz_open_dev$mouse(&(0x7f0000000240)='/dev/input/mouse#\x00', 0x100, 0x10000) syz_open_dev$amidi(&(0x7f0000000280)='/dev/amidi#\x00', 0x8000, 0xc0000) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000007000)={0x8, 0x0, &(0x7f0000000140)=[@acquire], 0x0, 0x0, &(0x7f00000001c0)}) r2 = dup2(r1, r0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000002c0)={0x8, 0x0, &(0x7f00000000c0)=[@release], 0x0, 0x0, &(0x7f0000000300)}) 13:29:31 executing program 5: socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = creat(&(0x7f0000000100)='./file0\x00', 0x20) ioctl$TCSBRKP(r1, 0x5425, 0x400) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r2 = memfd_create(&(0x7f0000000080)="70726f63ae6d696d655f74797065776c616e316e6f64657600", 0x6) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x2000003, 0x5011, r2, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000000)=[@text64={0x40, &(0x7f0000000500)="0f0866b8ed008ec066ba4000b000eed2a807000000410f01cab98e0b0000b862000000ba000000000f30b90b0800000f320fc72a8f2a60128f00000000003000000fc7aa00100000", 0x48}], 0x1, 0x0, &(0x7f0000000040), 0x0) ioctl$DRM_IOCTL_AGP_ALLOC(r2, 0xc0206434, &(0x7f0000000040)={0xf01f, 0x0, 0x10001, 0x6}) ioctl$DRM_IOCTL_AGP_UNBIND(r2, 0x40106437, &(0x7f0000000140)={r3, 0x37e}) ioctl$KVM_GET_VCPU_EVENTS(r2, 0x8040ae9f, &(0x7f0000000180)) 13:29:31 executing program 4: preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f00000000c0)=""/148, 0x94}], 0x1, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000080)='io\x00') preadv(r0, &(0x7f0000000480), 0x10000000000001f3, 0x0) 13:29:31 executing program 1: socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$FS_IOC_FSGETXATTR(r0, 0x801c581f, &(0x7f0000000100)={0xfffffffffffffe01, 0x85, 0x6, 0x80000001, 0x6}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000040)='/dev/snapshot\x00', 0x0, 0x0) ioctl$PERF_EVENT_IOC_RESET(r1, 0x2403, 0x4) r2 = memfd_create(&(0x7f0000000080)="70726f63ae6d696d655f74797065776c616e316e6f64657600", 0x6) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x2000003, 0x5011, r2, 0x0) fchmod(r0, 0x8) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000000)=[@text64={0x40, &(0x7f0000000500)="0f0866b8ed008ec066ba4000b000eed2a807000000410f01cab98e0b0000b862000000ba000000000f30b90b0800000f320fc72a8f2a60128f00000000003000000fc7aa00100000", 0x48}], 0x1, 0x0, &(0x7f0000000040), 0x0) 13:29:31 executing program 0: r0 = socket$inet(0x2, 0x4000000803, 0x4) bind$inet(r0, &(0x7f0000000000)={0x2, 0x0, @broadcast}, 0x10) getsockname(r0, &(0x7f00000036c0)=@xdp={0x2c, 0x0, 0x0}, &(0x7f0000000080)=0x80) setsockopt$inet_pktinfo(r0, 0x0, 0x8, &(0x7f0000003780)={r1, @rand_addr, @dev}, 0xc) syz_emit_ethernet(0x4a, &(0x7f0000000240)={@link_local, @empty=[0x0, 0x8847], [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x3c, 0x0, 0x0, 0x0, 0x4, 0x0, @empty=0x9000000, @broadcast}, @udp={0x0, 0x0, 0x28}}}}}, &(0x7f0000000380)) [ 530.632118] binder: 25120:25125 Acquire 1 refcount change on invalid ref 0 ret -22 13:29:32 executing program 1: socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = memfd_create(&(0x7f0000000200)="70726fa72629f6af4c0bc58c5301565180d1e9e7e27a1a79c363ae6d696d655f74", 0x40007) r2 = accept4(r0, &(0x7f0000000100)=@ax25, &(0x7f0000000040)=0x80, 0x80000) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x2000003, 0x5011, r1, 0x0) ioctl$KDGKBDIACR(r1, 0x4b4a, &(0x7f0000000580)=""/4096) syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000007000/0x18000)=nil, &(0x7f0000000000)=[@text64={0x40, &(0x7f0000000500)="0f0866b8ed008ec066ba4000b000eed2a807000000410f01cab98e0b0000b862000000ba000000000f30b90b0800000f320fc72a8f2a60128f00000000003000000fc7aa00100000", 0x48}], 0x1, 0x0, &(0x7f0000000040), 0x0) ioctl$FIGETBSZ(r2, 0x2, &(0x7f0000000080)) 13:29:32 executing program 5: socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = memfd_create(&(0x7f0000000080)="70726f63ae6d696d655f74797065776c616e316e6f64657600", 0x6) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x2000003, 0x5011, r1, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000000)=[@text64={0x40, &(0x7f0000000500)="0f0866b8ed008ec066ba4000b000eed2a807000000410f01cab98e0b0000b862000000ba000000000f30b90b0800000f320fc72a8f2a60128f00000000003000000fc7aa00100000", 0x48}], 0x1, 0x0, &(0x7f0000000040), 0x0) [ 530.678102] binder: 25120:25138 Release 1 refcount change on invalid ref 0 ret -22 13:29:32 executing program 4: preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f00000000c0)=""/148, 0x94}], 0x1, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000080)='io\x00') preadv(r0, &(0x7f0000000480), 0x100000000000022c, 0x0) 13:29:32 executing program 2: socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)) syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0xe1, 0x400100) creat(&(0x7f00000001c0)='./file0\x00', 0x2) openat$dsp(0xffffffffffffff9c, &(0x7f0000000200)='/dev/dsp\x00', 0x8000, 0x0) syz_open_dev$mouse(&(0x7f0000000240)='/dev/input/mouse#\x00', 0x100, 0x10000) syz_open_dev$amidi(&(0x7f0000000280)='/dev/amidi#\x00', 0x8000, 0xc0000) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000007000)={0x8, 0x0, &(0x7f0000000140)=[@acquire], 0x0, 0x0, &(0x7f00000001c0)}) r2 = dup2(r1, r0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000002c0)={0x8, 0x0, &(0x7f00000000c0)=[@release], 0x0, 0x0, &(0x7f0000000300)}) 13:29:32 executing program 3: r0 = socket$inet(0xa, 0x801, 0x84) connect$inet(r0, &(0x7f0000000180)={0x2, 0x4e21, @remote={0xac, 0x14, 0xffffffffffffffff}}, 0x10) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) socketpair$inet_tcp(0x2, 0x1, 0x0, &(0x7f0000000140)) listen(r0, 0xfc0004) getsockopt$IP_VS_SO_GET_INFO(r0, 0x0, 0x481, &(0x7f00000000c0), &(0x7f0000000100)=0xc) r3 = accept4(r0, &(0x7f0000000000)=@ethernet={0x0, @local}, &(0x7f0000000040)=0x10, 0x0) setsockopt$inet_sctp6_SCTP_EVENTS(r3, 0x84, 0xb, &(0x7f0000000440)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xf4}, 0xb) ppoll(&(0x7f0000000240)=[{r3}, {r1}, {r2}], 0x3, &(0x7f0000000340), &(0x7f0000000380), 0x8) 13:29:32 executing program 0: r0 = socket$inet(0x2, 0x4000000803, 0x4) bind$inet(r0, &(0x7f0000000000)={0x2, 0x0, @broadcast}, 0x10) getsockname(r0, &(0x7f00000036c0)=@xdp={0x2c, 0x0, 0x0}, &(0x7f0000000080)=0x80) setsockopt$inet_pktinfo(r0, 0x0, 0x8, &(0x7f0000003780)={r1, @rand_addr, @dev}, 0xc) syz_emit_ethernet(0x4a, &(0x7f0000000240)={@link_local, @empty=[0x0, 0xf0], [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x3c, 0x0, 0x0, 0x0, 0x4, 0x0, @empty=0x9000000, @broadcast}, @udp={0x0, 0x0, 0x28}}}}}, &(0x7f0000000380)) 13:29:32 executing program 5: socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = dup(r0) ioctl$RTC_UIE_ON(r2, 0x7003) r3 = openat$rfkill(0xffffffffffffff9c, &(0x7f0000000580)='/dev/rfkill\x00', 0x101ff, 0x0) setsockopt$SO_RDS_TRANSPORT(r3, 0x114, 0x8, &(0x7f0000000380)=0x2, 0x4) pipe2(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}, 0x800) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000002c0)={r5, 0x0, 0x9a, 0xe2, &(0x7f0000000100)="311663fcaadf74577dd38be64cda509ac6e0c176e41bb0c975b19d14afa18c55070f2d9d9796f08392d0598577b9cff749bbbd4afffdc4c46d1051424d7abf5bf00e5ed4d780f30b506ac693dc67194875b1975ebb0fe7c88759fe8a199f02ce2399ba30c3c979dda8536477691f92713ef9abe6815af07e104310d3617310e134282f1613ec4322a3e7495626c29de70e45c3f5a898b0e16250", &(0x7f00000001c0)=""/226, 0x3}, 0x28) getsockopt$inet_pktinfo(r3, 0x0, 0x8, &(0x7f0000000480)={0x0, @remote, @multicast1}, &(0x7f00000004c0)=0xc) recvfrom$packet(r3, &(0x7f00000003c0)=""/134, 0x86, 0x40000000, &(0x7f00000005c0)={0x11, 0x9, r6, 0x1, 0x3ff}, 0x14) socket$kcm(0x29, 0x2, 0x0) r7 = memfd_create(&(0x7f0000000300)="70726f63ae6d696d655f74797065776c616e316e6f64657600", 0x8) setsockopt$inet6_tcp_TCP_FASTOPEN_KEY(r4, 0x6, 0x21, &(0x7f0000000080)="5f10eaacbebdc83cffcd7c61f855c185", 0x10) setsockopt$inet6_tcp_TCP_FASTOPEN_KEY(r7, 0x6, 0x21, &(0x7f0000000340)="3c662fb899dc6c08b83e030b9f8480b8", 0x10) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x2000003, 0x5011, r7, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000000)=[@text64={0x40, &(0x7f0000000500)="0f0866b8ed008ec066ba4000b000eed2a807000000410f01cab98e0b0000b862000000ba000000000f30b90b0800000f320fc72a8f2a60128f00000000003000000fc7aa00100000", 0x48}], 0x1, 0x0, &(0x7f0000000040), 0x0) 13:29:32 executing program 1: socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = memfd_create(&(0x7f0000000080)="70726f63ae6d696d655f74797065776c616e316e6f64657600", 0x6) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x2000003, 0x5011, r1, 0x0) ioctl$ION_IOC_HEAP_QUERY(r0, 0xc0184908, &(0x7f0000000100)={0x34, 0x0, &(0x7f0000000040)}) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000000)=[@text64={0x40, &(0x7f0000000500)="0f0866b8ed008ec066ba4000b000eed2a807000000410f01cab98e0b0000b862000000ba000000000f30b90b0800000f320fc72a8f2a60128f00000000003000000fc7aa00100000", 0x48}], 0x1, 0x0, &(0x7f0000000040), 0x0) 13:29:32 executing program 0: r0 = socket$inet(0x2, 0x4000000803, 0x4) bind$inet(r0, &(0x7f0000000000)={0x2, 0x0, @broadcast}, 0x10) getsockname(r0, &(0x7f00000036c0)=@xdp={0x2c, 0x0, 0x0}, &(0x7f0000000080)=0x80) setsockopt$inet_pktinfo(r0, 0x0, 0x8, &(0x7f0000003780)={r1, @rand_addr, @dev}, 0xc) syz_emit_ethernet(0x4a, &(0x7f0000000240)={@link_local, @empty=[0x0, 0x1f4], [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x3c, 0x0, 0x0, 0x0, 0x4, 0x0, @empty=0x9000000, @broadcast}, @udp={0x0, 0x0, 0x28}}}}}, &(0x7f0000000380)) [ 530.991221] binder: 25149:25163 Acquire 1 refcount change on invalid ref 0 ret -22 13:29:32 executing program 3: r0 = socket$inet(0xa, 0x801, 0x84) connect$inet(r0, &(0x7f0000000180)={0x2, 0x4e21, @remote={0xac, 0x14, 0xffffffffffffffff}}, 0x10) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) listen(r0, 0xfc0004) r3 = accept4(r0, &(0x7f0000000000)=@ethernet={0x0, @local}, &(0x7f0000000040)=0x10, 0x0) setsockopt$inet_sctp6_SCTP_EVENTS(r3, 0x84, 0xb, &(0x7f0000000440)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xf4}, 0xb) ppoll(&(0x7f0000000240)=[{r3}, {r1}, {r2}], 0x3, &(0x7f0000000340), &(0x7f0000000380), 0x8) r4 = syz_open_dev$dspn(&(0x7f00000000c0)='/dev/dsp#\x00', 0x8ea, 0x40001) ioctl$EVIOCGID(r4, 0x80084502, &(0x7f0000000280)=""/156) 13:29:32 executing program 4: preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f00000000c0)=""/148, 0x94}], 0x1, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000080)='io\x00') preadv(r0, &(0x7f0000000480), 0x10000000000000cd, 0x0) [ 531.035392] binder: 25149:25163 Release 1 refcount change on invalid ref 0 ret -22 13:29:32 executing program 5: socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = syz_open_dev$usbmon(&(0x7f0000000140)='/dev/usbmon#\x00', 0x4f18, 0x0) ioctl$KVM_ENABLE_CAP(r1, 0x4068aea3, &(0x7f0000000180)={0x74, 0x0, [0x40, 0x4, 0x3, 0x9]}) r2 = memfd_create(&(0x7f0000000080)="70726f63ae6d696d655f74797065776c616e316e6f64657600", 0x6) getsockopt$inet_sctp_SCTP_SOCKOPT_PEELOFF(r2, 0x84, 0x66, &(0x7f0000000200)={0x0, 0x81}, &(0x7f0000000240)=0x8) getsockopt$inet_sctp6_SCTP_PEER_AUTH_CHUNKS(r1, 0x84, 0x1a, &(0x7f0000000280)=ANY=[@ANYRES32=r3, @ANYBLOB="7a0000009760f4bde6a29ec8dcf831b2ec62001f009099721b18abdc6e4c70a5838f043de298a2e54d615a7c4cba37d95f6fadb3be419172432910b3fb720f12bd6c61837310062a10b73550fd769685d60c5e2bba753720cdb03792e5abacd9bd45baeef5ac6eb792179b39dc73eeff244e000000000000000000000000"], &(0x7f0000000340)=0x82) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x2000003, 0x5011, r2, 0x0) ioctl$DRM_IOCTL_RES_CTX(r2, 0xc0106426, &(0x7f0000000100)={0x5, &(0x7f0000000040)=[{}, {}, {}, {}, {}]}) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000000)=[@text64={0x40, &(0x7f0000000500)="0f0866b8ed008ec066ba4000b000eed2a807000000410f01cab98e0b0000b862000000ba000000000f30b90b0800000f320fc72a8f2a60128f00000000003000000fc7aa00100000", 0x48}], 0x1, 0x0, &(0x7f0000000040), 0x0) 13:29:32 executing program 1: socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = memfd_create(&(0x7f0000000080)="70726f63ae6d696d655f74797065776c616e316e6f64657600", 0x6) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x2000003, 0x5011, r1, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000040)=[@text64={0x40, &(0x7f0000000500)="0f0866b8ed008ec066ba4000b000eed2a807000000410f01cab98e0b0000b862000000ba000000000f30b90b0800000f320fc72a8f2a60128f00000000003000000fc7aa00100000", 0x48}], 0x1, 0xfffffffffffffffd, &(0x7f0000000040), 0x10000000000001a4) 13:29:32 executing program 2: socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)) syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0xe1, 0x400100) creat(&(0x7f00000001c0)='./file0\x00', 0x2) openat$dsp(0xffffffffffffff9c, &(0x7f0000000200)='/dev/dsp\x00', 0x8000, 0x0) syz_open_dev$mouse(&(0x7f0000000240)='/dev/input/mouse#\x00', 0x100, 0x10000) syz_open_dev$amidi(&(0x7f0000000280)='/dev/amidi#\x00', 0x8000, 0xc0000) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) r0 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x8, 0x0, &(0x7f0000000140)=[@acquire], 0x0, 0x0, &(0x7f00000001c0)}) r1 = dup2(r0, 0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000002c0)={0x8, 0x0, &(0x7f00000000c0)=[@release], 0x0, 0x0, &(0x7f0000000300)}) 13:29:32 executing program 3: r0 = socket$inet(0xa, 0x801, 0x84) connect$inet(r0, &(0x7f0000000180)={0x2, 0x4e21, @remote={0xac, 0x14, 0xffffffffffffffff}}, 0x10) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) listen(r0, 0xfc0004) r3 = accept4(r0, &(0x7f0000000000)=@ethernet={0x0, @local}, &(0x7f0000000040)=0x10, 0x0) setsockopt$inet_sctp6_SCTP_EVENTS(r3, 0x84, 0xb, &(0x7f0000000440)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xf4}, 0xb) clock_gettime(0x0, &(0x7f00000001c0)={0x0, 0x0}) ppoll(&(0x7f0000000280)=[{r0, 0x9}, {r2, 0x8}, {r2, 0x4}, {r1, 0x8000}, {r0, 0x100}, {r3, 0x8}, {r0, 0x8}, {r3}, {r1, 0x20}], 0x20000000000001cc, &(0x7f0000000340)={r4, r5+10000000}, &(0x7f0000000140)={0x200}, 0xfffffdbf) 13:29:32 executing program 5: socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = memfd_create(&(0x7f0000000100)="70726f63ae6d696d655f74797065776c616e316e6f64657600", 0x6) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x2000003, 0x5011, r1, 0x0) syz_kvm_setup_cpu$x86(r1, r1, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000000)=[@text16={0x10, &(0x7f0000000140)="660f01300f01cb0f0158f5b867000f00d86766c74424000e0000006766c7442402d40000006766c744240600000000670f0114242e0f01cb660f5ecb67f26fd9f40f5223"}], 0x33b, 0x0, &(0x7f0000000080), 0x2f4) 13:29:32 executing program 0: r0 = socket$inet(0x2, 0x4000000803, 0x4) bind$inet(r0, &(0x7f0000000000)={0x2, 0x0, @broadcast}, 0x10) getsockname(r0, &(0x7f00000036c0)=@xdp={0x2c, 0x0, 0x0}, &(0x7f0000000080)=0x80) setsockopt$inet_pktinfo(r0, 0x0, 0x8, &(0x7f0000003780)={r1, @rand_addr, @dev}, 0xc) syz_emit_ethernet(0x4a, &(0x7f0000000240)={@link_local, @empty=[0x0, 0x89060000], [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x3c, 0x0, 0x0, 0x0, 0x4, 0x0, @empty=0x9000000, @broadcast}, @udp={0x0, 0x0, 0x28}}}}}, &(0x7f0000000380)) 13:29:32 executing program 4: preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f00000000c0)=""/148, 0x94}], 0x1, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000080)='io\x00') preadv(r0, &(0x7f0000000480), 0x100000000000013c, 0x0) 13:29:32 executing program 1: socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = memfd_create(&(0x7f0000000080)="70726f63ae6d696d655f74797065776c616e316e6f64657600", 0x6) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x2000003, 0x5011, r1, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000000)=[@text64={0x40, &(0x7f0000000500)="0f0866b8ed008ec066ba4000b000eed2a807000000410f01cab98e0b0000b862000000ba000000000f30b90b0800000f320fc72a8f2a60128f00000000003000000fc7aa00100000", 0x48}], 0x1, 0x0, &(0x7f0000000040), 0x0) setsockopt$SO_VM_SOCKETS_BUFFER_MAX_SIZE(r1, 0x28, 0x2, &(0x7f0000000100)=0x101, 0x8) openat$cgroup_subtree(r1, &(0x7f0000000040)='cgroup.subtree_control\x00', 0x2, 0x0) 13:29:32 executing program 2: socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)) syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0xe1, 0x400100) creat(&(0x7f00000001c0)='./file0\x00', 0x2) openat$dsp(0xffffffffffffff9c, &(0x7f0000000200)='/dev/dsp\x00', 0x8000, 0x0) syz_open_dev$mouse(&(0x7f0000000240)='/dev/input/mouse#\x00', 0x100, 0x10000) syz_open_dev$amidi(&(0x7f0000000280)='/dev/amidi#\x00', 0x8000, 0xc0000) r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000007000)={0x8, 0x0, &(0x7f0000000140)=[@acquire], 0x0, 0x0, &(0x7f00000001c0)}) r2 = dup2(r1, r0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000002c0)={0x8, 0x0, &(0x7f00000000c0)=[@release], 0x0, 0x0, &(0x7f0000000300)}) [ 531.352629] binder: 25187:25192 Acquire 1 refcount change on invalid ref 0 ret -22 13:29:32 executing program 5: socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) memfd_create(&(0x7f0000000080)="70726f63ae6d696d655f74797065776c616e316e6f64657600", 0x6) mmap(&(0x7f0000010000/0x2000)=nil, 0x2000, 0x4, 0x80010, r0, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000000)=[@text64={0x40, &(0x7f0000000500)="0f0866b8ed008ec066ba4000b000eed2a807000000410f01cab98e0b0000b862000000ba000000000f30b90b0800000f320fc72a8f2a60128f00000000003000000fc7aa00100000", 0x48}], 0x1, 0x0, &(0x7f0000000040), 0x0) 13:29:32 executing program 0: r0 = socket$inet(0x2, 0x4000000803, 0x4) bind$inet(r0, &(0x7f0000000000)={0x2, 0x0, @broadcast}, 0x10) getsockname(r0, &(0x7f00000036c0)=@xdp={0x2c, 0x0, 0x0}, &(0x7f0000000080)=0x80) setsockopt$inet_pktinfo(r0, 0x0, 0x8, &(0x7f0000003780)={r1, @rand_addr, @dev}, 0xc) syz_emit_ethernet(0x4a, &(0x7f0000000240)={@link_local, @empty=[0x0, 0xe0000000], [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x3c, 0x0, 0x0, 0x0, 0x4, 0x0, @empty=0x9000000, @broadcast}, @udp={0x0, 0x0, 0x28}}}}}, &(0x7f0000000380)) 13:29:32 executing program 3: r0 = socket$inet(0xa, 0x801, 0x84) connect$inet(r0, &(0x7f0000000180)={0x2, 0x4e21, @remote={0xac, 0x14, 0xffffffffffffffff}}, 0x10) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$inet_sctp_SCTP_DISABLE_FRAGMENTS(r0, 0x84, 0x8, &(0x7f0000000140)=0x2, 0x4) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) listen(r0, 0x400) openat$smack_task_current(0xffffffffffffff9c, &(0x7f00000000c0)='/proc/self/attr/current\x00', 0x2, 0x0) r3 = accept4(r0, &(0x7f0000000000)=@ethernet={0x0, @local}, &(0x7f0000000040)=0x10, 0x0) setsockopt$inet_sctp6_SCTP_EVENTS(r3, 0x84, 0xb, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xf4}, 0xb) ppoll(&(0x7f0000000240)=[{r3}, {r1}, {r2}], 0x3, &(0x7f0000000340), &(0x7f0000000380), 0x8) 13:29:32 executing program 4: preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f00000000c0)=""/148, 0x94}], 0x1, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000080)='io\x00') preadv(r0, &(0x7f0000000480), 0x10000000000001e7, 0x0) 13:29:32 executing program 2: socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)) syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0xe1, 0x400100) creat(&(0x7f00000001c0)='./file0\x00', 0x2) openat$dsp(0xffffffffffffff9c, &(0x7f0000000200)='/dev/dsp\x00', 0x8000, 0x0) syz_open_dev$mouse(&(0x7f0000000240)='/dev/input/mouse#\x00', 0x100, 0x10000) r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000007000)={0x8, 0x0, &(0x7f0000000140)=[@acquire], 0x0, 0x0, &(0x7f00000001c0)}) r2 = dup2(r1, r0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000002c0)={0x8, 0x0, &(0x7f00000000c0)=[@release], 0x0, 0x0, &(0x7f0000000300)}) 13:29:32 executing program 1: socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = memfd_create(&(0x7f0000000080)="70726f63ae6d696d655f74797065776c616e316e6f64657600", 0x6) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x2000003, 0x5011, r1, 0x0) r2 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) close(r2) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000000)=[@text64={0x40, &(0x7f0000000500)="0f0866b8ed008ec066ba4000b000eed2a807000000410f01cab98e0b0000b862000000ba000000000f30b90b0800000f320fc72a8f2a60128f00000000003000000fc7aa00100000", 0x48}], 0x1, 0x0, &(0x7f0000000040), 0x0) 13:29:32 executing program 3: r0 = socket$inet(0xa, 0x801, 0x84) connect$inet(r0, &(0x7f0000000180)={0x2, 0x4e21, @remote={0xac, 0x14, 0xffffffffffffffff}}, 0x10) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) listen(r0, 0xfc0004) r3 = accept4(r0, &(0x7f0000000000)=@ethernet={0x0, @local}, &(0x7f0000000040)=0x10, 0x0) setsockopt$inet_sctp6_SCTP_EVENTS(r3, 0x84, 0xb, &(0x7f0000000440)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xf4}, 0xb) r4 = syz_open_dev$adsp(&(0x7f00000000c0)='/dev/adsp#\x00', 0x80, 0x22f00) ioctl$KVM_ENABLE_CAP(r4, 0x4068aea3, &(0x7f0000000100)={0x79, 0x0, [0x10000, 0x100000001, 0x9]}) ppoll(&(0x7f0000000240)=[{r3}, {r1}, {r2}], 0x3, &(0x7f0000000340), &(0x7f0000000380), 0x8) 13:29:32 executing program 5: socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = memfd_create(&(0x7f0000000080)="70726f63ae6d696d655f74797065776c616e316e6f64657600", 0x6) mmap(&(0x7f0000002000/0x4000)=nil, 0x4000, 0x2000000, 0x10a833, r1, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000000)=[@text64={0x40, &(0x7f0000000500)="0f0866b8ed008ec066ba4000b000eed2a807000000410f01cab98e0b0000b862000000ba000000000f30b90b0800000f320fc72a8f2a60128f00000000003000000fc7aa00100000", 0x48}], 0x1, 0x0, &(0x7f0000000040), 0x0) 13:29:33 executing program 0: r0 = socket$inet(0x2, 0x4000000803, 0x4) bind$inet(r0, &(0x7f0000000000)={0x2, 0x0, @broadcast}, 0x10) getsockname(r0, &(0x7f00000036c0)=@xdp={0x2c, 0x0, 0x0}, &(0x7f0000000080)=0x80) setsockopt$inet_pktinfo(r0, 0x0, 0x8, &(0x7f0000003780)={r1, @rand_addr, @dev}, 0xc) syz_emit_ethernet(0x4a, &(0x7f0000000240)={@link_local, @empty=[0x0, 0x88640000], [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x3c, 0x0, 0x0, 0x0, 0x4, 0x0, @empty=0x9000000, @broadcast}, @udp={0x0, 0x0, 0x28}}}}}, &(0x7f0000000380)) 13:29:33 executing program 2: socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)) syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0xe1, 0x400100) creat(&(0x7f00000001c0)='./file0\x00', 0x2) openat$dsp(0xffffffffffffff9c, &(0x7f0000000200)='/dev/dsp\x00', 0x8000, 0x0) r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000007000)={0x8, 0x0, &(0x7f0000000140)=[@acquire], 0x0, 0x0, &(0x7f00000001c0)}) r2 = dup2(r1, r0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000002c0)={0x8, 0x0, &(0x7f00000000c0)=[@release], 0x0, 0x0, &(0x7f0000000300)}) 13:29:33 executing program 4: preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f00000000c0)=""/148, 0x94}], 0x1, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000080)='io\x00') preadv(r0, &(0x7f0000000480), 0x10000000000000ad, 0x0) 13:29:33 executing program 3: connect$inet(0xffffffffffffffff, &(0x7f0000000180)={0x2, 0x4e21, @remote={0xac, 0x14, 0xffffffffffffffff}}, 0x10) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) listen(0xffffffffffffffff, 0xfc0004) r2 = accept4(0xffffffffffffffff, &(0x7f0000000000)=@ethernet={0x0, @local}, &(0x7f0000000040)=0x10, 0x0) setsockopt$inet_sctp6_SCTP_EVENTS(r2, 0x84, 0xb, &(0x7f0000000440)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xf4}, 0xb) ppoll(&(0x7f00000000c0)=[{r1}, {r0}, {r1}], 0x374, &(0x7f0000000100), &(0x7f0000000380), 0x8) 13:29:33 executing program 5: socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = memfd_create(&(0x7f0000000080)="70726f63ae6d696d655f74797065776c616e316e6f64657600", 0x6) setsockopt$inet_sctp_SCTP_RECVRCVINFO(r1, 0x84, 0x20, &(0x7f0000000040)=0x1, 0x4) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x2000003, 0x5011, r1, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000000)=[@text64={0x40, &(0x7f0000000500)="0f0866b8ed008ec066ba4000b000eed2a807000000410f01cab98e0b0000b862000000ba000000000f30b90b0800000f320fc72a8f2a60128f00000000003000000fc7aa00100000", 0x48}], 0x1, 0x0, &(0x7f0000000040), 0x0) 13:29:33 executing program 0: r0 = socket$inet(0x2, 0x4000000803, 0x4) bind$inet(r0, &(0x7f0000000000)={0x2, 0x0, @broadcast}, 0x10) getsockname(r0, &(0x7f00000036c0)=@xdp={0x2c, 0x0, 0x0}, &(0x7f0000000080)=0x80) setsockopt$inet_pktinfo(r0, 0x0, 0x8, &(0x7f0000003780)={r1, @rand_addr, @dev}, 0xc) syz_emit_ethernet(0x4a, &(0x7f0000000240)={@link_local, @empty=[0x0, 0x800e], [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x3c, 0x0, 0x0, 0x0, 0x4, 0x0, @empty=0x9000000, @broadcast}, @udp={0x0, 0x0, 0x28}}}}}, &(0x7f0000000380)) 13:29:33 executing program 1: socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = memfd_create(&(0x7f0000000080)="70726f63ae6d696d655f74797065776c616e316e6f64657600", 0x6) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x2000003, 0x5011, r1, 0x0) write$P9_RXATTRWALK(r1, &(0x7f0000000040)={0xf, 0x1f, 0x1, 0x2}, 0xf) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000000)=[@text64={0x40, &(0x7f0000000500)="0f0866b8ed008ec066ba4000b000eed2a807000000410f01cab98e0b0000b862000000ba000000000f30b90b0800000f320fc72a8f2a60128f00000000003000000fc7aa00100000", 0x48}], 0x1, 0x0, &(0x7f0000000040), 0x0) 13:29:33 executing program 2: socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)) syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0xe1, 0x400100) creat(&(0x7f00000001c0)='./file0\x00', 0x2) r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000007000)={0x8, 0x0, &(0x7f0000000140)=[@acquire], 0x0, 0x0, &(0x7f00000001c0)}) r2 = dup2(r1, r0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000002c0)={0x8, 0x0, &(0x7f00000000c0)=[@release], 0x0, 0x0, &(0x7f0000000300)}) 13:29:33 executing program 4: preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f00000000c0)=""/148, 0x94}], 0x1, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000080)='io\x00') preadv(r0, &(0x7f0000000480), 0x100000000000012e, 0x0) 13:29:33 executing program 3: r0 = socket$inet(0xa, 0x801, 0x84) connect$inet(r0, &(0x7f0000000180)={0x2, 0x4e21, @remote={0xac, 0x14, 0xffffffffffffffff}}, 0x10) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000001840)='/dev/snapshot\x00', 0x8000, 0x0) setsockopt$inet_sctp6_SCTP_HMAC_IDENT(r3, 0x84, 0x16, &(0x7f0000001880)={0x4, [0x0, 0x0, 0x2, 0x8bb]}, 0xc) listen(r0, 0xfc0004) r4 = bpf$OBJ_GET_MAP(0x7, &(0x7f0000000100)={&(0x7f00000000c0)='./file0\x00', 0x0, 0x8}, 0x10) bpf$MAP_DELETE_ELEM(0x3, &(0x7f00000001c0)={r4, &(0x7f0000000140)="7094c4c31d6e9f84d29151be15f56185ae3e2771c87cd7f5ba"}, 0x10) r5 = accept4(r0, &(0x7f0000000000)=@ethernet={0x0, @local}, &(0x7f0000000040)=0x10, 0x0) setsockopt$inet_sctp6_SCTP_EVENTS(r5, 0x84, 0xb, &(0x7f0000000440)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xf4}, 0xb) ppoll(&(0x7f0000000240)=[{r5}, {r1}, {r2}], 0x3, &(0x7f0000000340), &(0x7f0000000380), 0x8) 13:29:33 executing program 5: socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)) openat$ipvs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000140)={0x0, 0xffffffffffffff9c, 0x0, 0xa, &(0x7f0000000100)='mime_type\x00'}, 0x30) r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180)='/dev/hwrng\x00', 0x8000, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x0) r1 = memfd_create(&(0x7f0000000080)="70726f63ae6d696d655f74797065776c616e316e6f64657600", 0x6) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x2000003, 0x5011, r1, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000000)=[@text32={0x20, &(0x7f00000001c0)="c7442400cf400000c744240200000000c7442406000000000f0114242e0f01cb66bad00466ed80689247440f20c03501000000440f22c00fc71e640f06c4c219a6dac7f8e6420000d898d02c0000", 0x4e}], 0x1, 0x0, &(0x7f0000000240), 0x0) 13:29:33 executing program 0: r0 = socket$inet(0x2, 0x4000000803, 0x4) bind$inet(r0, &(0x7f0000000000)={0x2, 0x0, @broadcast}, 0x10) getsockname(r0, &(0x7f00000036c0)=@xdp={0x2c, 0x0, 0x0}, &(0x7f0000000080)=0x80) setsockopt$inet_pktinfo(r0, 0x0, 0x8, &(0x7f0000003780)={r1, @rand_addr, @dev}, 0xc) syz_emit_ethernet(0x4a, &(0x7f0000000240)={@link_local, @empty=[0x0, 0x60], [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x3c, 0x0, 0x0, 0x0, 0x4, 0x0, @empty=0x9000000, @broadcast}, @udp={0x0, 0x0, 0x28}}}}}, &(0x7f0000000380)) 13:29:33 executing program 1: socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = openat$autofs(0xffffffffffffff9c, &(0x7f0000000200)='/dev/autofs\x00', 0x111440, 0x0) ioctl$KVM_GET_PIT2(r1, 0x8070ae9f, &(0x7f0000000240)) r2 = memfd_create(&(0x7f0000000080)="70726f63ae6d696d655f74797065776c616e316e6f64657600", 0x6) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x2000003, 0x5011, r2, 0x0) setxattr$security_ima(&(0x7f0000000040)='./file0\x00', &(0x7f0000000100)='security.ima\x00', &(0x7f0000000140)=ANY=[@ANYBLOB="030305004bfcb0baa06eb7af9bced24c46e123987af299be48afeba8f8b5bee57bb38dddba3cd963d30fc63d8efbcd33e272197c727a0f3f16d6c2fd4c059275f322cbc8920f371856af71295ebb8dd8fafa92ae6e86a3908ad3b04c122e3a5e8b580300b5e2029643a2cbbc8f90dc1cea36de1a2a6f6c2b6e05000000e36b499d5725c1a223e44249e74205a0b4c900000000000000000000"], 0x84, 0x2) syz_kvm_setup_cpu$x86(r2, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000000)=[@text64={0x40, &(0x7f0000000500)="0f0866b8ed008ec066ba4000b000eed2a807000000410f01cab98e0b0000b862000000ba000000000f30b90b0800000f320fc72a8f2a60128f00000000003000000fc7aa00100000", 0x48}], 0x1, 0x0, &(0x7f0000000040), 0x0) 13:29:33 executing program 5: socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = memfd_create(&(0x7f0000000140)="10010000000000e75a7db6b37dc80200000000000000000000000000000000000000000000000000006bc08b9cf07f70f1001e72dea76c01ced3b3af8438a2c7e5a41fb938396b64e46c4789f3594ecb1d9db909d6c4cd40ed46a37b6403f5ed0698979859597732d230fd9fbc80a126e9affb1a8b32cf3e2ae89b999624864eebb63a86c4c2bc9cc623dd88a4c75d0a409633b6b747a57b33ee354531d1bc08127014d62fc6a2674d708299ae613bc303030619ed7901a73200000000", 0x1) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x2000003, 0x5011, r1, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000000)=[@text64={0x40, &(0x7f0000000500)="0f0866b8ed008ec066ba4000b000eed2a807000000410f01cab98e0b0000b862000000ba000000000f30b90b0800000f320fc72a8f2a60128f00000000003000000fc7aa00100000", 0x48}], 0x1, 0x0, &(0x7f0000000040), 0x0) 13:29:33 executing program 4: preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f00000000c0)=""/148, 0x94}], 0x1, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000080)='io\x00') preadv(r0, &(0x7f0000000480), 0x100000000000028c, 0x0) 13:29:33 executing program 2: socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)) syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0xe1, 0x400100) r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000007000)={0x8, 0x0, &(0x7f0000000140)=[@acquire], 0x0, 0x0, &(0x7f00000001c0)}) r2 = dup2(r1, r0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000002c0)={0x8, 0x0, &(0x7f00000000c0)=[@release], 0x0, 0x0, &(0x7f0000000300)}) 13:29:33 executing program 3: r0 = socket$inet(0xa, 0x801, 0x84) connect$inet(r0, &(0x7f0000000180)={0x2, 0x4e21, @remote={0xac, 0x14, 0xffffffffffffffff}}, 0x10) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = openat$autofs(0xffffffffffffff9c, &(0x7f0000000140)='/dev/autofs\x00', 0x200, 0x0) fstat(r1, &(0x7f0000000640)={0x0, 0x0, 0x0, 0x0, 0x0}) stat(&(0x7f0000000280)='./file0\x00', &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) write$FUSE_ENTRY(r3, &(0x7f0000000480)={0x90, 0x0, 0x8, {0x3, 0x1, 0xb5, 0xff, 0x401, 0x2bf67765, {0x1, 0xede, 0x8001, 0x7, 0x1, 0x5, 0x5, 0xb8d, 0x101, 0x23496e6e, 0x4, r4, r5, 0x3b2c, 0x8}}}, 0x90) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) getsockopt$IPT_SO_GET_REVISION_MATCH(r0, 0x0, 0x42, &(0x7f00000000c0)={'HL\x00'}, &(0x7f0000000100)=0x1e) listen(r0, 0xfc0004) r6 = accept4(r0, &(0x7f0000000000)=@ethernet={0x0, @local}, &(0x7f0000000040)=0x10, 0x0) setsockopt$inet_sctp6_SCTP_EVENTS(r6, 0x84, 0xb, &(0x7f0000000440)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xf4}, 0xb) ppoll(&(0x7f0000000240)=[{r6}, {r1}, {r2}], 0x3, &(0x7f0000000340), &(0x7f0000000380), 0x8) 13:29:33 executing program 0: r0 = socket$inet(0x2, 0x4000000803, 0x4) bind$inet(r0, &(0x7f0000000000)={0x2, 0x0, @broadcast}, 0x10) getsockname(r0, &(0x7f00000036c0)=@xdp={0x2c, 0x0, 0x0}, &(0x7f0000000080)=0x80) setsockopt$inet_pktinfo(r0, 0x0, 0x8, &(0x7f0000003780)={r1, @rand_addr, @dev}, 0xc) syz_emit_ethernet(0x4a, &(0x7f0000000240)={@link_local, @empty=[0x0, 0x700000000000000], [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x3c, 0x0, 0x0, 0x0, 0x4, 0x0, @empty=0x9000000, @broadcast}, @udp={0x0, 0x0, 0x28}}}}}, &(0x7f0000000380)) 13:29:33 executing program 1: socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = memfd_create(&(0x7f0000000080)="70726f63ae6d696d655f74797065776c616e316e6f64657600", 0x6) fcntl$getown(r0, 0x9) ioctl$KVM_ENABLE_CAP(r2, 0x4068aea3, &(0x7f0000000100)={0x79, 0x0, [0x1, 0x6, 0x1, 0x7]}) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x2000003, 0x5011, r2, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000000)=[@text64={0x40, &(0x7f0000000500)="0f0866b8ed008ec066ba4000b000eed2a807000000410f01cab98e0b0000b862000000ba000000000f30b90b0800000f320fc72a8f2a60128f00000000003000000fc7aa00100000", 0x48}], 0x1, 0x0, &(0x7f0000000040), 0x0) 13:29:33 executing program 5: socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)) r0 = open(&(0x7f0000000200)='./file0\x00', 0x10000, 0x1) ioctl$KVM_UNREGISTER_COALESCED_MMIO(r0, 0x4010ae68, &(0x7f0000000240)={0xf004, 0x10000}) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000100)='/dev/sequencer\x00', 0x2000, 0x0) openat$ipvs(0xffffffffffffff9c, &(0x7f0000000140)='/proc/sys/net/ipv4/vs/cache_bypass\x00', 0x2, 0x0) socketpair(0x1b, 0x7, 0x54, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x2000c8e) r3 = memfd_create(&(0x7f00000001c0)="70726f63ae6d696d655f74797065776c616e316e6f64657600", 0x4) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x2000003, 0x5011, r3, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000000)=[@text64={0x40, &(0x7f0000000500)="0f0866b8ed008ec066ba4000b000eed2a807000000410f01cab98e0b0000b862000000ba000000000f30b90b0800000f320fc72a8f2a60128f00000000003000000fc7aa00100000", 0x48}], 0x1, 0x0, &(0x7f0000000040), 0x0) setsockopt$inet_sctp_SCTP_AUTOCLOSE(r2, 0x84, 0x4, &(0x7f0000000080)=0x4, 0x4) syz_open_dev$midi(&(0x7f0000000040)='/dev/midi#\x00', 0x3, 0x4000) 13:29:33 executing program 2: socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)) r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000007000)={0x8, 0x0, &(0x7f0000000140)=[@acquire], 0x0, 0x0, &(0x7f00000001c0)}) r2 = dup2(r1, r0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000002c0)={0x8, 0x0, &(0x7f00000000c0)=[@release], 0x0, 0x0, &(0x7f0000000300)}) 13:29:33 executing program 0: r0 = socket$inet(0x2, 0x4000000803, 0x4) bind$inet(r0, &(0x7f0000000000)={0x2, 0x0, @broadcast}, 0x10) getsockname(r0, &(0x7f00000036c0)=@xdp={0x2c, 0x0, 0x0}, &(0x7f0000000080)=0x80) setsockopt$inet_pktinfo(r0, 0x0, 0x8, &(0x7f0000003780)={r1, @rand_addr, @dev}, 0xc) syz_emit_ethernet(0x4a, &(0x7f0000000240)={@link_local, @empty=[0x0, 0x8848000000000000], [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x3c, 0x0, 0x0, 0x0, 0x4, 0x0, @empty=0x9000000, @broadcast}, @udp={0x0, 0x0, 0x28}}}}}, &(0x7f0000000380)) 13:29:33 executing program 1: socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = memfd_create(&(0x7f0000000080)="70726f63ae6d696d655f74797065776c616e316e6f64657600", 0x6) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x2000003, 0x5011, r1, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000000)=[@text64={0x40, &(0x7f0000000500)="0f0866b8ed008ec066ba4000b000eed2a807000000410f01cab98e0b0000b862000000ba000000000f30b90b0800000f320fc72a8f2a60128f00000000003000000fc7aa00100000", 0x48}], 0x1, 0x0, &(0x7f0000000040), 0x0) ioctl$VT_WAITACTIVE(r1, 0x5607) 13:29:33 executing program 4: preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f00000000c0)=""/148, 0x94}], 0x1, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000080)='io\x00') preadv(r0, &(0x7f0000000480), 0x100000000000022d, 0x0) 13:29:33 executing program 3: r0 = socket$inet(0xa, 0x801, 0x84) connect$inet(r0, &(0x7f0000000180)={0x2, 0x4e21, @remote={0xac, 0x14, 0xffffffffffffffff}}, 0x10) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = openat$qat_adf_ctl(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/qat_adf_ctl\x00', 0x400482, 0x0) ioctl$TIOCGPTPEER(r3, 0x5441, 0x80000000) listen(r0, 0xfc0004) r4 = accept4(r0, &(0x7f0000000000)=@ethernet={0x0, @local}, &(0x7f0000000040)=0x10, 0x0) setsockopt$inet_sctp6_SCTP_EVENTS(r4, 0x84, 0xb, &(0x7f0000000440)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xf4}, 0xb) ppoll(&(0x7f0000000240)=[{r4}, {r1}, {r2}], 0x3, &(0x7f0000000340), &(0x7f0000000380), 0x8) 13:29:33 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000007000)={0x8, 0x0, &(0x7f0000000140)=[@acquire], 0x0, 0x0, &(0x7f00000001c0)}) r2 = dup2(r1, r0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000002c0)={0x8, 0x0, &(0x7f00000000c0)=[@release], 0x0, 0x0, &(0x7f0000000300)}) 13:29:34 executing program 5: r0 = openat$qat_adf_ctl(0xffffffffffffff9c, &(0x7f0000000040)='/dev/qat_adf_ctl\x00', 0x0, 0x0) write$P9_RSTATFS(r0, &(0x7f0000000100)={0x43, 0x9, 0x1, {0x1, 0x7, 0x70, 0x7, 0x0, 0x80, 0xc6, 0xff, 0x2}}, 0x43) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = memfd_create(&(0x7f0000000080)="70726f63ae6d696d655f74797065776c616e316e6f64657600", 0x6) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x2000003, 0x5011, r2, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000000)=[@text64={0x40, &(0x7f0000000500)="0f0866b8ed008ec066ba4000b000eed2a807000000410f01cab98e0b0000b862000000ba000000000f30b90b0800000f320fc72a8f2a60128f00000000003000000fc7aa00100000", 0x48}], 0x1, 0x0, &(0x7f0000000040), 0x0) 13:29:34 executing program 0: r0 = socket$inet(0x2, 0x4000000803, 0x4) bind$inet(r0, &(0x7f0000000000)={0x2, 0x0, @broadcast}, 0x10) getsockname(r0, &(0x7f00000036c0)=@xdp={0x2c, 0x0, 0x0}, &(0x7f0000000080)=0x80) setsockopt$inet_pktinfo(r0, 0x0, 0x8, &(0x7f0000003780)={r1, @rand_addr, @dev}, 0xc) syz_emit_ethernet(0x4a, &(0x7f0000000240)={@link_local, @empty=[0x0, 0x100000000000000], [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x3c, 0x0, 0x0, 0x0, 0x4, 0x0, @empty=0x9000000, @broadcast}, @udp={0x0, 0x0, 0x28}}}}}, &(0x7f0000000380)) 13:29:34 executing program 1: times(&(0x7f0000000040)) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) socketpair(0x3, 0x80006, 0x9, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$EVIOCGBITSND(r1, 0x80404532, &(0x7f0000000140)=""/124) r2 = memfd_create(&(0x7f0000000080)="70726f63ae6d696d655f74797065776c616e316e6f64657600", 0x6) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x2000005, 0x5011, r2, 0x21) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000000)=[@text64={0x40, &(0x7f0000000500)="0f0866b8ed008ec066ba4000b000eed2a807000000410f01cab98e0b0000b862000000ba000000000f30b90b0800000f320fc72a8f2a60128f00000000003000000fc7aa00100000", 0x48}], 0x1, 0x0, &(0x7f00000001c0), 0x0) 13:29:34 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) r1 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000007000)={0x8, 0x0, &(0x7f0000000140)=[@acquire], 0x0, 0x0, &(0x7f00000001c0)}) r2 = dup2(r1, r0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000002c0)={0x8, 0x0, &(0x7f00000000c0)=[@release], 0x0, 0x0, &(0x7f0000000300)}) 13:29:34 executing program 4: preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f00000000c0)=""/148, 0x94}], 0x1, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000080)='io\x00') preadv(r0, &(0x7f0000000480), 0x1000000000000025, 0x0) 13:29:34 executing program 5: socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = memfd_create(&(0x7f0000000080)="70726f63ae6d696d655f74797065776c616e316e6f64657600", 0x6) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x2000003, 0x5011, r1, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000000)=[@text64={0x40, &(0x7f0000000500)="0f0866b8ed008ec066ba4000b000eed2a807000000410f01cab98e0b0000b862000000ba000000000f30b90b0800000f320fc72a8f2a60128f00000000003000000fc7aa00100000", 0x48}], 0x1, 0x0, &(0x7f0000000040), 0x0) lseek(r0, 0x0, 0x7) 13:29:34 executing program 3: r0 = socket$inet(0xa, 0x801, 0x84) connect$inet(r0, &(0x7f0000000180)={0x2, 0x4e21, @remote={0xac, 0x14, 0xffffffffffffffff}}, 0x10) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) listen(r2, 0xfc0004) r3 = accept4(r0, &(0x7f0000000000)=@ethernet={0x0, @local}, &(0x7f0000000040)=0x10, 0x0) setsockopt$inet_sctp6_SCTP_EVENTS(r3, 0x84, 0xb, &(0x7f0000000440)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xf4}, 0xb) ppoll(&(0x7f0000000240)=[{r3}, {r1}, {r2}], 0x3, &(0x7f0000000340), &(0x7f0000000380), 0x8) accept4$inet(r3, 0x0, &(0x7f00000000c0), 0x800) 13:29:34 executing program 0: r0 = socket$inet(0x2, 0x4000000803, 0x4) bind$inet(r0, &(0x7f0000000000)={0x2, 0x0, @broadcast}, 0x10) getsockname(r0, &(0x7f00000036c0)=@xdp={0x2c, 0x0, 0x0}, &(0x7f0000000080)=0x80) setsockopt$inet_pktinfo(r0, 0x0, 0x8, &(0x7f0000003780)={r1, @rand_addr, @dev}, 0xc) syz_emit_ethernet(0x4a, &(0x7f0000000240)={@link_local, @empty=[0x0, 0x6000000000000000], [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x3c, 0x0, 0x0, 0x0, 0x4, 0x0, @empty=0x9000000, @broadcast}, @udp={0x0, 0x0, 0x28}}}}}, &(0x7f0000000380)) 13:29:34 executing program 1: socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = accept(r0, &(0x7f0000000100)=@nl=@unspec, &(0x7f0000000040)=0x80) r3 = syz_genetlink_get_family_id$fou(&(0x7f00000001c0)='fou\x00') sendmsg$FOU_CMD_DEL(r2, &(0x7f0000000280)={&(0x7f0000000180), 0xc, &(0x7f0000000240)={&(0x7f00000002c0)=ANY=[@ANYBLOB='<\x00\x00\x00', @ANYRES16=r3, @ANYBLOB="000425bd7000fedbdf250200000004000500040005000800040001000000080001004e22000004000500080003007f00000004000500acb6e6bca7b213610744ad4edf8d44142f76749d2ecc8102f8cf72c715282cfb0398fff22b35f38f462cb85c7f4514a9"], 0x3c}, 0x1, 0x0, 0x0, 0x8000}, 0x20000010) r4 = memfd_create(&(0x7f0000000080)="70726f63ae6d696d655f74797065776c616e316e6f64657600", 0x6) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x2000003, 0x5011, r4, 0x0) syz_kvm_setup_cpu$x86(r4, 0xffffffffffffffff, &(0x7f0000fd5000/0x18000)=nil, &(0x7f0000000000)=[@text64={0x40, &(0x7f0000000500)="0f0866b8ed008ec066ba4000b000eed2a807000000410f01cab98e0b0000b862000000ba000000000f30b90b0800000f320fc72a8f2a60128f00000000003000000fc7aa00100000", 0x48}], 0x1, 0x40, &(0x7f0000000040), 0x0) 13:29:34 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) r1 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000007000)={0x8, 0x0, &(0x7f0000000140)=[@acquire], 0x0, 0x0, &(0x7f00000001c0)}) r2 = dup2(r1, r0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000002c0)={0x8, 0x0, &(0x7f00000000c0)=[@release], 0x0, 0x0, &(0x7f0000000300)}) 13:29:34 executing program 5: socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = memfd_create(&(0x7f0000000080)="70726f63ae6d696d655f74797065776c616e316e6f64657600", 0x6) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x2000003, 0x5011, r1, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000000)=[@text64={0x40, &(0x7f0000000500)="0f0866b8ed008ec066ba4000b000eed2a807000000410f01cab98e0b0000b862000000ba000000000f30b90b0800000f320fc72a8f2a60128f00000000003000000fc7aa00100000", 0x48}], 0x1, 0x0, &(0x7f0000000040), 0x0) ioctl$FS_IOC_GET_ENCRYPTION_PWSALT(r1, 0x40106614, &(0x7f0000000040)={0x0, @speck128}) 13:29:34 executing program 4: preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f00000000c0)=""/148, 0x94}], 0x1, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000080)='io\x00') preadv(r0, &(0x7f0000000480), 0x100000000000019b, 0x0) 13:29:34 executing program 3: r0 = socket$inet(0xa, 0x801, 0x84) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) listen(r0, 0xfc0004) r3 = accept4(r0, &(0x7f0000000000)=@ethernet={0x0, @local}, &(0x7f0000000040)=0x10, 0x0) setsockopt$inet_sctp6_SCTP_EVENTS(r3, 0x84, 0xb, &(0x7f0000000440)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xf4}, 0xb) ppoll(&(0x7f0000000240)=[{r3}, {r1}, {r2}], 0x3, &(0x7f0000000340), &(0x7f0000000380), 0x8) 13:29:34 executing program 0: r0 = socket$inet(0x2, 0x4000000803, 0x4) bind$inet(r0, &(0x7f0000000000)={0x2, 0x0, @broadcast}, 0x10) getsockname(r0, &(0x7f00000036c0)=@xdp={0x2c, 0x0, 0x0}, &(0x7f0000000080)=0x80) setsockopt$inet_pktinfo(r0, 0x0, 0x8, &(0x7f0000003780)={r1, @rand_addr, @dev}, 0xc) syz_emit_ethernet(0x4a, &(0x7f0000000240)={@link_local, @empty=[0x0, 0x8864000000000000], [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x3c, 0x0, 0x0, 0x0, 0x4, 0x0, @empty=0x9000000, @broadcast}, @udp={0x0, 0x0, 0x28}}}}}, &(0x7f0000000380)) 13:29:34 executing program 1: socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = memfd_create(&(0x7f0000000080)="70726f63ae6d696d655f74797065776c616e316e6f64657600", 0x6) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x2000003, 0x5011, r2, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000000)=[@text64={0x40, &(0x7f0000000500)="0f0866b8ed008ec066ba4000b000eed2a807000000410f01cab98e0b0000b862000000ba000000000f30b90b0800000f320fc72a8f2a60128f00000000003000000fc7aa00100000", 0x48}], 0x1, 0x0, &(0x7f0000000040), 0x0) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000480)={0xffffffffffffffff, r2, 0x0, 0x2, &(0x7f0000000440)=']\x00', 0xffffffffffffffff}, 0x30) r4 = fcntl$getown(r0, 0x9) rt_tgsigqueueinfo(r3, r4, 0xf, &(0x7f00000004c0)={0x23, 0x1000, 0xce7a, 0x5}) getsockopt$inet_sctp_SCTP_SOCKOPT_CONNECTX3(r2, 0x84, 0x6f, &(0x7f0000001600)={0x0, 0x30, &(0x7f00000015c0)=[@in={0x2, 0x4e23, @multicast2}, @in={0x2, 0x4e23, @loopback}, @in={0x2, 0x4e24, @broadcast}]}, &(0x7f0000001640)=0x10) getsockopt$inet_sctp_SCTP_PARTIAL_DELIVERY_POINT(r2, 0x84, 0x13, &(0x7f0000001680)={r5, 0x5}, &(0x7f00000016c0)=0x8) getsockopt$inet_sctp6_SCTP_MAXSEG(r2, 0x84, 0xd, &(0x7f0000000300)=@assoc_id=0x0, &(0x7f0000000340)=0x4) getsockopt$inet_sctp_SCTP_ENABLE_STREAM_RESET(r2, 0x84, 0x76, &(0x7f0000000380)={r6, 0x100000000}, &(0x7f00000003c0)=0x8) getsockopt$inet_buf(r2, 0x0, 0x2f, &(0x7f0000000200)=""/146, &(0x7f00000002c0)=0x92) getsockopt$inet_IP_IPSEC_POLICY(r2, 0x0, 0x10, &(0x7f0000000100)={{{@in=@remote, @in=@dev}}, {{@in6=@remote}, 0x0, @in=@loopback}}, &(0x7f0000000040)=0xe8) write$UHID_INPUT(r2, &(0x7f0000000580)={0x8, "fb2678c74823d5e9fc16dcf198d2dc008dff6d6e9f6d5d31d245e34c5662de74dc558aa02974fcd0bf8f22bf8f8c074b7e79276d98c1595b5ee67ad4de66e6a92db932670dc5eae3eeabc33e1904afa413a5c5131ddabc4cc89ea80655bcfa8585e638e8c6b63046daf0276e9f67f083a66bc5ad89ea7f82ae100893b793bcf5ea3cdb9e4a2aa414b613bc379e96596329c14ec2e79fe46b8b6049b33b2436b483ee7e049b1339837dee8617a2bf3c7cf0fbfd6c4c134acc6936c9d84d04197cf5803088e79e882f12aed54181532eec9fa9b35744b1e1d5961c63345a2e74c50e38da9336a0eb3d43d17f234bd33cd9cc0fc4e471fb33c55633630300fb96577a38174844dbca9da0e6db68badc3d353eed9e40450590de43b80ddfc9f1bbe97d6db1732562bb811eacde5dd2d9665bd2f9ddec28bcc68a8c1df400d4feebf67a82c189e42a157750e46c9ba8e16de9562c6f4505de6b514db5e5da8d4197b57ed4d6accebd222e7fc9e3dcaa6b0df73ed05acae100331d9eddf02499cdfc33ccf9da1799b9daacb82ddc8a0e16221f0291a77da4ebcf6895ee8c0b1d422619452a8e60ddea4f2259081978d0156e438998a56ff7d7f6ef3b1560b052cfe0e73e6c02835ea3c4c4382e1b104e60ccbddda18e96ccfe4a3e16ce558755e25a7299ee89409b58e05849334a2fb55c274338d54e02bf31a3843c35fdb416da1a6991288e09f91b754bf40a19bf307122491516000462964149ec156f913c85e91eb68918369197bfe2205232200bd9df3fcf0875dc2476e35253f72d708c1642e48dbf11328194c1b38741f23d25f6e58a94c1017b666afc806c06673fc10e596810cef3b769dbc768682aa67eac694124b4ec4375192beef5736215393f88dfe94cc870843eddd0f3adc19d80b0a0197badf36772d8f21438933302baf1f4bf4fd834f9b5428ecebe14592da510cce63abe0b3eab3a9a3718c0020f6f35ca9bf42ac1806c26271dd0e06383ff184352875304198c6edd2573d541c2d2a30b56b7fab940d9c170130052d206f41daf468433e8b071e080c46cb892e78554ec11aa31b7daea16f9b52172c34da07452560a648f95da1c44e7de82bde366c44aee18ca469ee8a2eac553f7c157f1e46a7189c86ae05de7726c55fe84878c4f7f9fed78a99bab7d10b42724d21a7944c8f00ef451a4832eb45a18e7eb45f338bb4e5fc3ab0a465730079d66486e221cfe439756ae0f39bcfab90b20750970706753be91665f69d7d5ac0ca152c0e713a5e4b1e329b5994005685c10a2c1727f9c9793fd6e7c4b9dee6a641cffceaa9b5ede167b477afe94aee01c73fa33bae7a781650e95b70c695dc8b7e1a3debada42c1d9c4858c616d5945bbadd1871dcd14771e812d1cb345488adea0b1cbd0e9c52a5848a236e4c490d8a8efdede233644c88cafc2498e5c2fa21e75d10bb79bc22f9a43d726d1c10ce8f036d373a06f543995766613f47ee008200d9dcd31c79007ccba59dc6ae6ed29db224d49add43fdd0b7751ab7cb5c8cab68949b33de976c2d7c2c6ac5bdd2094f05c218730535e318237835a9d9ea3ff4e2301ab75645b056376c3af6cdc987af4b3d6daaba7051dfa206fe5a0d07bdcda5e5396154a4fa722c7074384dfbb270003cfc34cfe568a7271f45c362e01b8ef9e03dfe76864262b55ffeae2b69a6ed76b843f90b9f5c7eee46ffee3d95c1649461a78df2428cb3651520ad03857523c1af6dd1d43b92c0da23509ca3f3d4df37d4a5138bde68f2412e89ff5a65a801d11a36cbdc5a815038d41577873934fed021c84eef01d7f8797ee6e8328934763208540418237b65a5cc3444cf8dfddc854bad28be3c2db8d9a90f281d1a453de61cf6f703d1d470185fa329ddaf9ee7bae2841675c1ac411f327c38bfd7a35824971cf0829fa21f48f9db1c354934207b4aac1fb82aa699611cd5e77e28582820b066770bf5274cfa914ac5256a2ec72b50ac7be15198fe56501cccd133dd1da5ee5e0e694e93c1fcc63b3c09593e24cd31d480814ee647fc315778aea881aa0dbe3f618a2b6c4e9d75f454113be37d520daa75b8ffd8c1e9df4a8bbde936737bf508be84777e75d9cb1bbe2a5e564f38fdadef1c3286b0f3757ce4ad0a79a5d953ebcd1d4557a8d938f343de311be9d1ddf4d071ba3be914a0740ec2754b0c3e735d76b9571828e1d4ffbd7e0f04a2907fe3f1b8443107bdfe825b1a63e9b8b9adcd79fa05ae15cbab64438c95c82f48f2da05836677690a4bbdff72eb3a2dd598d4c78ab25a773d43cb61fbba098aa5455286aca599564ccb56e72d03c8378da284a3150bc3fe0fc24c1dc57eba58f1fd9372f00c71e2e29867e923f807e0fc0ffb89cfef3240637107e8295ddf45b241223c95d57c1ffe678be90e129843f6e5a4e9b6746709c021eb3152eead63da186595a73a81a3aad87cc22da8eb2eaacfa854f61acf8ad8d82947937ba6dc58a5665d537ee99af64e0359a9ecde567c25226dd474e9adc04938efd4b8897396174262535fb81cf8c7e72ead752e82a225c7007fde392a30049eb1a483d9ef6dd5f15fb9461a8d4e02820332e332d6520e51c83d4b051b3b0e9b365eff33118d5eb149585307ff3455aabea924a799397fcea65014c6a03d2fc34538a7da1a4fadd7b3c952aad3f6142c0deb20304b8309596aaa181b3f12810026652ad05d832acb42ef32c49d971efa59380abc9075e8f49744c48c9a3285b23598c2dfb2c37016614b7c205182efa9b7bfccb603dccf31a4dc47e4b509c973c1223233139ea2f56d146d0dc82696096959ab06ce24309f719ade878c34e59d923c5c70068f574b89b68f0925daf5a4fa7b60995cbab6b3cf9bf730d661217a0ca2e8119b8850b5b3bcbaccd5ef27b1d78856529721c578cc9dbfae5592fd2c085a80e280804c9b7ff048a012f97a905c9adaf755d4669485c727bbf45859b0bc5189326bc3ffed6dfab40c0880a7f33830c8a51c65792bde8ea00bd128279978efb51e89773e5030509c0ddb50b12e85ba73a4088dad24911ae18b8ca8f5c19a1cffd2c0cb670b01aeeb2fd93da4dc2a9a5ed38a0b40a4c5488d489038fb5286fef03a05934fee880dcc2d96d5f0853520d2f0b55b9847a113a5e35d955e419571c9476b592f55ee5a659e318060a0a0c4fa79c0c613561a78d85b1d9a62b3dee80403f8cbb7b38f8e0cc16a14acdec18a343d6c067ad10b78f8df6c96d2ddce585aa65b9ddce3499518173f4dfd1a881f4b3c08713d4a7c2813c48cf7da6904b635ba3cbf975b20071f63492e0fbf59b135bf9d4028a1819acfc378fb22c223d841b7500b4ac3f804a0c2b2325bb36a993fefbe90e65db1d2e461dc51b987c7f0ca4c3b23a7db8f2e36cd04a91f4636ee1e47b0af3e3ed01e99c63ddfef62d309945311ee8efcddd7357ec98f2af9048d4fc634cf1d3f385cb3f65ae7c8db2b29cd6060e8bc89fd18507c8ce5e3ba0baba699638551e64eacc47c5ab69935bddd0aed4053335c00f3ce89e971b15c2cc5a204ca64a299f00665a4a0b2809705cba5580ceb9166354d4d65f22c94cbebe9949479d1c05f08540a9703ffd6e2779459f700ec2cdc2c77994a624c409a8d9b0e6e831adf71bf8189cd20f8b1be3cca526ecabb769a5ed935ebeb230133b2bfcd03ee7d5f08f5fe8e9ba83ecb91eba6214c3ee48bb2581093e5ae6e901d4d84619e6206bf0a6fef458723d3bc685642aacb680f469a0a7c9fba51040391102e53617e009c74694ecc8c5ff1d517a0c7d09ec80d3abe3f18beaccfb8704c0dae00ea37888314c4059329c7234fd75a9dbfbb8a24bc8b29fc68cc8702db011bf3cee9c5da148b18ad2421a4a48f5ca9c0ba2000a1e59246daaa9fcd0be52ee03181037aed87d466e27f5b22df435b792ca872d0316fb438db264ee2558ebb2164af3f534d9056beb295ddaefd8f1bbadc13aa37c9c0485cc471a17cf4750c035a850f529923cdffc26af6dfb08de60c56d279b7b270bdcc251fbb5d8199527337441324ee018113273443864dd6d01bc6c3b5cf9620de96f2bfe8b0451d9d2c1fe38d42a9b5872b50eff08c713c6e75983acd3c4ee9f8af780674c510ee4487a18eb34ca559c2c22e412cb22b6d185745d88011156bbc7b78a215ba5fa12ec8e6776ddef0becc48feec3797e28a94145f5550e5724c7b1974c8456c22d6aa708a7d6e4c70827e6e1e6e351e309aa2f1d64ffa0d7da593b94f6a28dab3fac64ab8087acf4ed0b5a0d0a0e87fbc7eb8287494a2f1f9ea55ab9c5148ea5dd857e8b8e2dd31fd60a810ecd18126ab30b9d4fec500181fd78d7f0f3f12c382a78ac75175773f89a00ee52130dc68162a32e90e37c56295f524c1be4c4478911cbabbbe6bacde6a4c60b431c9c06dee28af2e289f410eb64436de509d36701b09b2c9b06b4d978fe529329199c3e8872785217616e4796f85e20ec49b424cdd1bc9f98406cde80bc0a98a2945276d86df2b0eda00596ec34fa89bf81a2c4fc35f1fd81459b6fd602e51bafa144a5485f19cd4ea22b6426ab316dcece49a96380fc82885fdc757948cac6a5f0bfc29189b3cfd2b55e57d931a9ceb0dc8bf4911d1bac14547be0aa9e21ed285dbca1aafcb9b8e1b56d0880a0d1fde5f8d60a0eff88c66395ecc2b750ebe6b4ec6286c2a3522e5a8747d01ee789aa479a9589401ac4cbda3d89aea3caae03a9330d3b742ef514b81818629151be6e99fc10de84d351a647a11a2a2ea6a6c1741097f23bbfc95d754213bde4e1e854bea70ac25fc995a03dd57e29e9f1cf2f9643e4c23ff36c49edd5a930757d841fda44316b85d832aefa685698d9d3d75a469bb7b02dab32820dbfdbe7058c99ccea9e492b8f6e9526242ed2537704452dfd04b907a16a37ad6abca195d2e4eb5447ae2c48f62131dbcb877756007f1ee67cced610bd296756053432a16419d3c2460c3c11d176d12de7bde928ac765dccb2c3a8aeaa63a2900a9c558c366665d9784ab9619cbce9482057935d136c6461eca8715432b741cdbbb8a444e77f018233384225b42c4a5ad6316c0ed846ce6a912bec7992ea4ae22fdade6088fc0643f94bc0b97b2192a1953fc40c4f9caccc78a8830ba66f56d8ef91d13ac9d4006087889f3dcfc13d54eca3163294ef62f722d6ba75756b67e48d8dd6002762c8c022876f1dedb79fe2604548a1cb756cd633e80ab2ce2907c39177bf7ff72c1ff33f0be340c2f856ed68c88dc18ccc97dce987a5270d1a6077af193ebeb8ba712a37d06bbbb83d96d2b41e951a932477156ee3ecb4bb6f74493c3ace0e4e5e9f0a2f31f2a4e27ac900967113b35d6eb276569882147ec326beceec54d65da7ff1d4d5587a4e49b6023d5a60c2c8f1b81157abcef01c1b58938eb4cbcb90844da332f3552d5d42e3aca2d982d1e8db245a772f2fbd4ae68fc1c0f3588454082147f471c1f7d96ad975e36aaba89ffaaea2fa1b5ed6ab635d97356024845ac219992c44fb2920b2f35b96edc54888ab4bbb54ce90f61e021f097dc3373351a1d9aaa92b75ffa903a364122163b7acbd66571f330c3e44ce3cc57fa78a7daf38ae405d244c68e861fcf4e65aca2ee269ded9304d7fd1f008b56cc2f7b8672a374205584f44904f0a3ba9d4c2e4227af88e9086d1b93aaae248683a85d4f0b97174452599f4e728dee1d6fb193d2a7e125b9e5a6e6e1204f14fcd7bf7159183ff63b9c149fc4128313e94beda040cbdaa2d4fd21065c290e", 0x1000}, 0x1006) mq_unlink(&(0x7f0000000400)='\x00') ioctl$SNDRV_TIMER_IOCTL_STOP(r2, 0x54a1) ioctl$DRM_IOCTL_AGP_RELEASE(r2, 0x6431) ioctl$UI_SET_KEYBIT(r2, 0x40045565, 0x29f) 13:29:34 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) r1 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000007000)={0x8, 0x0, &(0x7f0000000140)=[@acquire], 0x0, 0x0, &(0x7f00000001c0)}) r2 = dup2(r1, r0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000002c0)={0x8, 0x0, &(0x7f00000000c0)=[@release], 0x0, 0x0, &(0x7f0000000300)}) 13:29:34 executing program 5: socketpair$unix(0x1, 0xb54463d7a9927714, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = syz_open_procfs(0x0, &(0x7f0000000040)='net/snmp6\x00') ioctl$DRM_IOCTL_AGP_ALLOC(0xffffffffffffffff, 0xc0206434, &(0x7f0000000100)={0x7ff, 0x0, 0x2, 0x8}) ioctl$DRM_IOCTL_AGP_BIND(r1, 0x40106436, &(0x7f0000000140)={r2, 0x9}) r3 = memfd_create(&(0x7f0000000080)="70726f63ae6d696d655f74797065776c616e316e6f64657600", 0x6) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x2000003, 0x5011, r3, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000000)=[@text64={0x40, &(0x7f0000000500)="0f0866b8ed008ec066ba4000b000eed2a807000000410f01cab98e0b0000b862000000ba000000000f30b90b0800000f320fc72a8f2a60128f00000000003000000fc7aa00100000", 0x48}], 0x1, 0x0, &(0x7f0000000040), 0x0) 13:29:34 executing program 3: r0 = socket$inet(0xa, 0x801, 0x84) connect$inet(r0, &(0x7f0000000180)={0x2, 0x4e21, @remote={0xac, 0x14, 0xffffffffffffffff}}, 0x10) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) listen(r0, 0xfc0004) r3 = accept4(r0, &(0x7f0000000000)=@ethernet={0x0, @local}, &(0x7f0000000040)=0x10, 0x0) setsockopt$inet_sctp6_SCTP_EVENTS(r3, 0x84, 0xb, &(0x7f0000000440)={0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xf4}, 0xb) r4 = syz_open_dev$mouse(&(0x7f00000000c0)='/dev/input/mouse#\x00', 0x12000000000000, 0xc0100) ioctl$EVIOCGID(r4, 0x80084502, &(0x7f0000000140)) ioctl$TIOCNOTTY(r4, 0x5422) ppoll(&(0x7f0000000240)=[{r3}, {r1}, {r2}], 0x3, &(0x7f0000000340), &(0x7f0000000380), 0x8) 13:29:34 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000007000)={0x8, 0x0, &(0x7f0000000140)=[@acquire], 0x0, 0x0, &(0x7f00000001c0)}) r2 = dup2(r1, r0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000002c0)={0x8, 0x0, &(0x7f00000000c0)=[@release], 0x0, 0x0, &(0x7f0000000300)}) 13:29:34 executing program 0: r0 = socket$inet(0x2, 0x4000000803, 0x4) bind$inet(r0, &(0x7f0000000000)={0x2, 0x0, @broadcast}, 0x10) getsockname(r0, &(0x7f00000036c0)=@xdp={0x2c, 0x0, 0x0}, &(0x7f0000000080)=0x80) setsockopt$inet_pktinfo(r0, 0x0, 0x8, &(0x7f0000003780)={r1, @rand_addr, @dev}, 0xc) syz_emit_ethernet(0x4a, &(0x7f0000000240)={@link_local, @empty=[0x0, 0xd000000], [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x3c, 0x0, 0x0, 0x0, 0x4, 0x0, @empty=0x9000000, @broadcast}, @udp={0x0, 0x0, 0x28}}}}}, &(0x7f0000000380)) 13:29:34 executing program 5: socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = memfd_create(&(0x7f0000000080)="70726f63ae6d696d655f74797065776c616e316e6f64657600", 0x6) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x2000003, 0x5011, r2, 0x0) io_setup(0x7, &(0x7f0000000040)=0x0) r4 = syz_open_dev$mouse(&(0x7f0000000280)='/dev/input/mouse#\x00', 0x2, 0x0) io_submit(r3, 0x8, &(0x7f00000026c0)=[&(0x7f0000000200)={0x0, 0x0, 0x0, 0x1, 0x401, r2, &(0x7f0000000100)="2cf5d85ae553a5f95f83b69efa3aca309135c4d82ca3ec2ce6289a177555573196ea9637291ba5f4a5b94cb739ccc1bcb56965671575a10c6647950075358b2da264b5647e04a900820e474df787e379a6252af54553b7711241e2ea3e4b37fc5cfe9aa68bdc77e6d8bedd1fc4d816d2e0cd34ce8face2c25de84f2e42793cf302a4b328217134973e85e0692431ea396ed31fb976e89d1b88845023e622b3c903058a5fda2e0a855bb0b03a5dfd0ee3d3de8a4690af9b16477a14c9d94d8fe464540c85254067d41376472dece44259692c1899", 0xd4, 0x5, 0x0, 0x3, r2}, &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x7, 0x6, r2, &(0x7f0000000240)="3a45a2e18eb65dcacfb4554b800e0f23569ce58c345296922b532d57c34e6e854b246696e12256b0c4e307cfdd0c88e40df601a2053ad08e57", 0x39, 0x1, 0x0, 0x3, r4}, &(0x7f0000000340)={0x0, 0x0, 0x0, 0xb, 0x7, r2, &(0x7f0000000300)="8a56bde62276878c708817500feecbca1822e73fa2f6393c83f91f8158af45b61db4e7300f63ba663f", 0x29, 0x8000, 0x0, 0x1, r2}, &(0x7f0000000380)={0x0, 0x0, 0x0, 0x0, 0xb6, r1, &(0x7f0000000580)="d057708f1e73d7d21be9f07e92f1cbe9fbd6f23315b3f63de7894a39bc5e6934cac36ea03ddc83643e3aafb27a8db6c385e18bba1f749055d59cc04f1f8c1c0a699dc718761cc01d4ed942efa3161d8baf1431e71bd9c563cf7ff956bbab92aa1e6101bff8bda697febd9d66c6b79bdb8dbf2def2768df89e44ebf2a9a64b4ec98e13d2e11e5de5acbc95af6ea9d2902952c021ffbbcd80db709ec873c36e66a339a24f5256fcb713b113961e4b52bfc6a1494bf36787bd4120b8c0f814b2a844d773b38ba708fa11c8ed75a1b8b81be4e1a74b857b1b267844323fbaf0d7e77cc11de3029b36b38927b0672d31e4d9825d95b73a592c1bb51f56c9a243a29335c2abc392175da6cae60e41afbf4a923d5230fe2a15f56c2116620ecdb908b7274d84dd90bd4911602bfa01d1a899338c376a630fe262bb2a6b877a3b41f41dee4f71622f8a555f97a0686fabdf3abd681513be3a1fb6de303708c0cf3a8a17d65de1fb643cc8a00c1cc8edd299935d83acefd180673d170704c4d81ca1bc32001cd2601039eaf0d76c9901894c77d4df1814a3d9d780fa49039080c9e4b1a4e3954666ad4ea2ae3b95e6d5cbe0ddf321a6dd56a9707fd82ce05e0eeb73035390c8d6a30a4c2adcd6ba436e03cd80f78f3d2c35f9e5051b1f7cd53bb62eb698e4732276abaf9b7ec37139bc1ecefbbeb4e51f657ac4150fd11b3113c7cc64e2bea1df70ca78e96cf168c4ac3ec4ea24dc99b85a91124982e79d8eb3ad7e21620ab629498f9f26f448edb7f43d41b3382abb05c47f98c2d405bb8dd55044b99f7f22ab6f05cb902eb93143a4d1783fe67f21e967db6175c2efa1b5c5579eb837b2ef1e0595778ce88cdf4ef1ffebf919c535811356a3909718a0b064a3b92cd009ca96f3af48ad710aa20fec80e81de49018c87457693f484aa3618b0a5b0d2e6ebb99ac05a5d965d7ed329ac22bcd7ca626b3b8244994efa62b3b5280750b8fe931c2cce273e9ffc3f6b6ba7a5520bc2f8397d9298844c911c2bced144f0c5a85a3000d4457dab1d7a52c43d588beefebb4a52222792076ef5239ad7f7d35aef8673461cc677b28b0f4b15f5f1a7c3b83f7fdd2e842263a8dba29bcc0e16d3efc505d44019a0c5b5bd513207c659a0653a201beb49ab59f488b1d72f505292ff948ae185fa65c5bfbc622ab17351e4bed04d9d5c821e7554e000af5f8841b65b91ae57b8f391840b8fdf355849220f599f3dd482b8ad3adfefede1caaf8a310674a1321c0afb500b312a2921d4ceca917742d96d601f3c7ec922c4b3e85060c34118af80eacb8d6e8b3030d6a350875337269d3bbcc7419acd0bdf1c54c4393ca882227e4ecf9a0fc7f090dfc23d28f3cd91343241f8ae10488dec36c269720d901f3b80314892c35aad446398c13eb72aa46d9e4d54223b56835e628873d9285321b5270d5275c0cd638058e5d706755c5bddde24c4f98090f039cc2627e1cf46aaaf82f132f0cf4d1283d7a51e8fc6c1886573916b52bd82100c94f32fe7e898628bd5e5009891072373c41f0c3ee1518ae18dc64b62d773cd9ea677c17dcfdcc85a45ea18ee8ce02bc39bad2a8e80f6175769dc8bbffee37b1a0d3a6042bbbb33d5cd7428f2c8bb6f31b6e6e20cddb7d1e82ba9373babc30f802e6c6dc5bdbc2d323627630bcf92036fdb37e6b752e1d795659847fa888ae786aac227ccb545177ff5b48a4f0e8ebd2adedbe6608d95b9b78cb85840241bcd3bcb71903ec59c3ccb28bd190959304755fbb7a1b274991765b11425cc3cf9735de9136ba72970c464c7fce3b2a00f7f2f811f5f3d3c938fa4fac15c4cd874838c88a99dd69a918829041cc3c139ecfc97df1e32eada09c33c48073ec30cfa1ce3c7c86ac6e9f7c25caaf03c89cd0f474d651fe12ea232ea85b268ed6f8db5a2fb6b977afbc45497a7a80578d6722288c38f4e3b7abc4ebaf7df684ec1c92e7cf7d2b280195386cb58710aa2407d4f1683e067dbc67ddbd71e1e79cd1c7a7a929e810879e2a0679956e3906ff7f80deec0f380512c960b5a89b5559db7ecd04163f71ced414901389089f61c538a68c03fd0ccd1816bf21a9938a2ee6a3ffc6f87d9680dedd52ec7d6c1880863724f45ef109a3c22b50775a92c47f997d27bf4fb3d4c1864f38c49974f7ca293586d2a4901399bbfde500eff218f3d7d80abef9c8445599ce5beb50df2c95b6b14c904624ec6d290a32bc6bb6bfdcad309c6d9325a48913f7af945446d9199011db93e7f7c880621f08e6560a9ff1378e0516eaad6d9f90981c4e8129305dead3df135fbe0429def57203176cb6dfff967625c55e9b62f0ac166fe3ce811581d0fdcb1549cf04247dbdbeb3ee9dd5c5fc38e5caa760f4ec35ee066ac041f115e249eed56be8e475a332b49261d2ef3466ac5ac9438b5fd20095f659f74ce4329981793dd1022ab6e386158a26d15b61b370582cd79310f8d3d9ec7e80d6094b726ae2d256ebc75eaa4a617f37ff8c4b42781cf735c7e60fadee23aacd18f52c92ad6ead03224036a46cb22af3097762b1d3ff3d40c28065005f6cf03b3abde4c0b3dd6cd786ba6e6319f7542c64a097f87e105d0d4df04972ce0f6ee7884062404501cd5eafbfa06d9925ef659925dd5fb90172793e7303092b4f22d5c8db1b3876080efc93516369d1068e2d3ef52b621c07dbea47e193781df4936928e2e39e663f93b741ca0091485a3464326d465172cbf791c06b62c3e9e38962e26662a6e0bdcc2ca583df1f649651914f18f9f14c69959ee38890cafcbd2f12c96056668f3893be37330ba6ec3564408c28f0d58140e658f913cfff404b9caac0f55346b4d89623454f78d6814bde661db7d0f32b84daf2ee79f16523dfdfa84eeefbcc21541c2f4adabf705396cf0016e463f996c39e2ed20654c6b7f5baba54cea0193dd7fc4a1dea971421f9008a6a2161e497bc5b03685587b14f97537cacfae7cceccd0156a1101b99fa28a2336711cd89ff84c59210260ee92222aae73fc26b64225da18612ea60f80a1b414bc9a0a325f76fc053522d2fcf4531e5bab2e5a66802623cc84760fbd63479ab4335d623700bf965483055b1b0359c911d7dc28f21f56ac3c022328a7baa3ffe296429f477bddb5b29bc462bfb6de5bf81ff29fcc9149c17a9c8c28e12ce1419d5f2c906cc8c54873f2127ef1216d003f5561df9fe90a68ab55d2d918dbdf42a2a7096e19c3c7f800728318566dcec0c206733aa1ae200f0b3d7642d3419b641a2978345a816eaa7a78f2cdb4566ad8e1be4597de562d494a05988e9eadc421c8c15c68220615abf9f5b16be6100a079e683b5a3ccc76a1336dab70fd222cecf42f8e84d6fd9d402c93cb0be09cda4f5bb2893a46ae8ac97e7d246da6b9b5d25a45ea2744f635fae741677eab054fa468c09ae7166f36447470db09039b6a95e4a6b5aee24885f6f7ab880e3c9d593613393a8166881c94804f7e0b35ad615023a435b12383377d3f243253ba5badd05c6f47f526a7fccc7ee8b1fa00cf1fc12fe771a9c18d0e0765f9b5c4aac07617d42c8d6576d0c200bc8f931c9276c4b343652ac6f7cba98385b20cfe17b6137671c90e33dd249f8ac358b0750fa0d3e8d5b496134e674779fe44c682f19e148d91b12fde9d4d0baa8deda8ad3c78acafe0a34e52eff36592d9dc419782a2678fcdd71791d36f9078e04ded3fd3fbcef16979e54b8df51a25d01b0cc1c33b1f2671e31f4b46ec3f6035da3ec2101909ca50c9f9c8d4b2e76cb69ee371d925146177a730ebbb2275fa9cc5ebd9c1cb95584b0ad6b8309234e67afac9571efd10a160b455317dae199a6008ad42addf277c6c845512215fd476b583b06c9e58d710c41fcaecf4495e50de6eca41d45b10c18cf67a7a559da40201a1bbaeef53ed7a6d5d42d829e7b0da8cdc087327f25b2a4b328ec56535661684c2ebae1fec40d68b208e1ce64d77e585a9dab3b8bab5f60cb36855afbad9522587bb6f2bedfccc07c85362a49828c2158a6da7afd3e0b2ecbd419ca662967e9da06b9acea978ec054283ed3cf95c10e8abb55a7262e50a36d64630549b6790ea636643aca2bc90f8ddb486f9ad052663465ddf035ea03a50e91879cdb596b9d827a8f3187bf2ea899561d71e01fc32724f2c821f9e46dd22d40f52f2d0cd6eef4d30d2e9ccd233c086651385a7336753256ac6794aea05d1ee382b2f1aef452e2b148ede882e822ff6bf9cc1ab2853f4daf05725542a3256af460fe22a44459146ed76472400788127dd91e98be21872ddabbf495ae8d221230c2520aedda88614ea451080286e6385b4f54e81cae66603ce205c813d637ac1d2b1a01dcbb709b8fd950f658b116554a98ffdac87583bd781bb3f4aaf2bb3797215f0b3a08ebbcb4e176825eab5de7a22b76c6863530d30bcfe11935dbc5230087bb9e57de1c3f5a9cc1086d856d3450a2455f3252be99ad875e4808a92458ef003ee4127036a29c94f7e18ec31eb80c7b6c7d85f24a780d4e46bc52bd38dd7e851cb8494d50eb4e7af25862d14b43965e3c28249aebcdc8d04ceb8be3bada6d1f2099fcd04825fe72d0298715be8f0397f176f7b24206ced25a7e7527f4c28be944ea918dff1d74bca7c3ab5a2d9879a02315824e00a7d1faf41dd7c4b8358e00e241d725c123c34c9bc59fb4887775589d339493eb03356982438fd95f3b998d55423f87f6a166f6c783492018345aec6fbfe6daa26d4fad1f11f271708e0cefe2ca1ae89faf685710f2dc51c89f6519bfca08d2c6bc33e750ac45036e76d4088edd27fe815f9dfdceb5169e9dce04cefc931cb038b9ea86287c67ce4093b9bbadf2f464bb2a50a0463e04c915a99f1959b17033c8ed7d179225fcad9ee2c1c6e195d56fcc5131ba38ee4b1311511c5254b27947c80c30e5a120a9064ebfb6aba7e2a133311232039a68a48b618612dcaa00ec5304ae03feb8ca2d2c245016a0634ae28534cc86006a19ad1db15ae00dd954bdb8a2e1e5a6a68c317d876e8d98dd3ffc6132e3b50097b13103dd1e86b65b55885c5827d02ad13a75fcd37bfa284a4c37f776ac5c1352152bb2c8cb3555a807d76ec595a6d95c1a366e8b0ca5490f03f43fff1134b42f5f197a83fe672b78a0fb92166a5b5cfcbf7ffe63f951b724ada48144156094ff63332b4bc9b628f09b7b9e5ebe3193c5e29b5e3abaf92ec0d94e9d5bc8833b7c812d8e239b3ca9866668881233460494e120b000accaee1483ca6be08dcef3a9e0d14a95311e388d77cb0642d82122c36eca003611e8c7e0ac90858712a901ee1eb6163a9f61fbfaea455fdceea9804ba311c8d4509651c0bc712305a132fbe0378d3bd420db732df94d3d0d421accbcccc6d5fb3fdffcb612920ea3e16cd7ff095d8cc11dccc9c101cad83f0bb3f1ec1394fbee4a3db7505825c08256aab0546840247be713fbaf31fe89fe457ea691c74d208554a47a403985c68c3a525ead077453f6f4bcc86e8151f4e7d10c28c1f713d1a011ff496d5fc6bcc5d9b6e7229c640875e941eefac9318f94797ef2d88f3c8266d5570b7b2013623fc5b509270f02a392959758deb7b3f0fa9b65924d7f02ae0c307b2f73915ef8278a9a57077142f95f65c68ab82d66911824751f9feef43fc179399d05b5665c65d0d5efd7ea0d67de3ae0e55b0d6cc93f61a8d18e55dd06b9e44b0feeff4ef07a2d9effbe406c37726369f01330f04a0082b8c511ece51c2ea5e7bd08f359098e3efc43baf7d", 0x1000, 0x1, 0x0, 0x1, r2}, &(0x7f00000003c0)={0x0, 0x0, 0x0, 0x0, 0x1447, r1, &(0x7f0000001580)="f5e6a80af06820116d7c84cbb2a6e8645537a718474849287873681c723467445e8b04ee50e7b65528ddefdf238b861e0f8daee84fbc2849d89f85af294e89cd1a3da030ae0e036d85aaee5ac2ee4a60488219889478460019c2b32b0b83be09cc1080432054d9c2aff13429ee907e6af11135d6d8db037dea66cc2e7b3022f4f84e166e9869c735be3c06f33656282d78706776fb6f2a12ceb285cbeaaa678b96482c31a400987a22a387153b51aa7649bc263484822c759a1be999ab881b29d2552bbd40091e69dd17657776133b03233d0ef006ce44d518e73dd9cd0c7df7652b5e3378a5d4cee7524d4099be1af51cfb2850815fa1fdf72e14fb4e18cc3f6b52cbebe4a3b9e73c45ee1b201fa93f15af18c4983571852e794397fb0cba182359b07bd68955005a57073bec475614102a58714e03e5b620890710ca61a1549e002286b56198f4e5e8bc32331909c9ebdc77f0ee93b2dfe28a2c4a62e758f5658e071cd052ea85ba0de29bcbefdaa973e984524b759f2167b3899092b135a355c2887b164827cf03d27beb7cf841e48117c053899a88bccb933971c094f196a0a137a8fe590349017a469ec5324156b91e3cf55711550931d5a5be3837adfa09b9ad516daddba203869729a8553f754ea945559e0310d060172c55faeebce1739a513d86fd2aac809bbea7eb5053cff1631ba22f8f396e9f43a8b307f6cb78f39a9cfece650daf52a704e08e44325a5750af9b5783e86ae62b39de23c3f8983afab5db3cbf6c108661884737043847694127013dc0e8d0d1ea8d98d3d0371a50c0a856f4bf7c08021280adb278ae123528811c497ddd2f3fac0c0cf2d92afeb094e668580ea41f5b6656dff14b4cae2d0ca74e64197b62f9232955d03333393477d8d43902cbc7fe5693ad1c18d0443003aad8373f92ff6f8882a53906c65b2222476f628d070e66baeefb600af43a19b929cb2045591d0cb4a65121843b0e6739625d4a31d405fa65ff934fb7a29e0c3f90862d702bc509cfb41259cb4a37c46417debf6638cf0d660b63ab221c3551db114dacb00ff95e0666a85152dcea171e95bfa3c8095c112758e404b16d153519cf2181fadba8cb3c41b069aa6e04b0820eefa475edc5824ba3b0f25fc71cd649ebbca9809485f8c43b5654b5fc9e73c874a0a7128fd0231f2b2656eec55316781029b596bc7336160dcec67eb71a64001465c0036519742ec82d2b9c1840aec8597e9dca94d3999ffd52ebab636f07dd887ed7b91ad6ba005f169c264744638de926d81eb9eb5105665d0fbe6d6e4453896039cf3377e82bbbb5be43cfb1379a133602146ce998930451e2b8005ac920d5f91d0bca142aee507140fc2daff7eb8baed3ea523bb984f69145845bf76095baa7ce54402e9885bb310a9ab0cc4f84b8a1794822036247d8cbf79db9bcd689830fa6b0fa1174a5a52cda93a995095313ecd1f9d13a31b7e5911cb1ac77cee36b3cce5c9dde2e6265ea05a820bcadf6d8acf2b5464dddaea19d9fae403ab6288671b9d42c1520b66b26a7a784ed028e6ba42fe0802e13cbd2321d2266b8eeb377de8ec3450e1b3bf79c13f8d90e6b149c6be9a86e4c45ae0cecf02435533a63a3953d0adb1a3422e7355624f3cdb12fdfc53fc08aecc0479932e6d44198040be3dde55426bbfed1b319d6bdd1a296c670d3dd17ff7324f437ad8fe9427f461d026b45a734c850ef72f69c2e662d67716e3913986dc438544320a574366226d0bfc4b09eb250924d3113aa15c98bfa0b6ef1e66053b0b71a2af537d1f5d2ee97f41a2e805689be514238d6ebd8d2750055a454ffce06c51af6c7b016a210ce6bb05e1da5ffcba0314a3448be50b9b65f6998adf922a6ade374beb550e0e421c5d597122a8454b4e8114dbfbbe39216c8753322c8ce8b1b875fbc7983929b0b974e0e6c383c92556cb0d6e38a379cd2bdd4f8d96a6b104a5deb614781fd8991790440e1d66ef098e85eff4bb7410b9c251f4d15d28fd4df70793bea52c2669625cf86d8ce90ad0bec6ef020ac27581114359974a2c75dd20ca079988dd836a3ab2c30d7433174a1ec22634aa829f0479f9ca036d97acd674e415ea1009e6e0aefef46f32d6e27c5976be047edb89aef0ff697e26a8a0456f9ab40d118830edf846ba7c11ad83cdb73d0e93806832d6d02cef62e9a6aef1dc2a225f1d646a1f24bfa73af1f14f8f5168c37c4ddc59afc591a83486fe1b84f97c290b9a3b5b14f710637ecee28bb2c68147f58651c3069d9674edf352ee79b8db408ea7978ba1c9ad71be41cd94230c1b3395023199bef1f831f083d736e493afdcc889002067f3df9a25576489a73b047f109683eab7f6925f6f628244b9f3986fdad8cf2f7342396d82242e7af8b4a9720e36f40c4f502cafe6658fca379dd1e8b128765160b88f3c35dbab1e398c9a9b372719c434a3f1715d9468f7622aed812887ffc6353eb34daaa12f3aff04e84978395ce4f9de9b52f067d192f6f5ec951b48885bca5d3eddcec092688d5091281fea2bb1ad4505749bfc18dfc31132160d27a86c94a6f6e139e6362bbde90b83f545803ad1361840d0c1de34c4d383731acfa3fec6abc1ecb22fbc0730680aa6da5822fb0bcbd63ec98409ee0d6565d4b504e380bc85df495ce35bfec38dec68af4c34beeba713f2c1bb2239f5c27886350f233e807a07ea1c40709139f946f468ad849b965e8d5a79c781df67de76efc41ea4c6071540138217b7cd834b18645b9911f08c0aa57b8a1f0cd0236ea0710a4750a4c5b43103637a3ea511029b402164a2437d3df81cc2ec9cbfb40832bf1356ffa2ebc4f80f9ec4736275f81ad24cac98a988973384aac39e6d21f69896fea45fc65756d6f8dfd962b251cdd4eeafedce096d1db6d617eb366f8957683aa0fd6d85ec500802f8cf0352ee953776b08fc6ace68e70fa4ec1831ca0a1fef5a40f3c60d9c02a7773b7a45a9e3b8197e1e65942ffb60540135acff176cb1c17b8529910f3428652406717c7a53a6409652d37ba50d965323303925dcafdb04b7603a653e39b5e4ee4b30ab18b5e95e4c40168c30422123c710a6c059aa622529ea4089982a6b20c195c5334a5e9166c7615e1bb53ad8a2e16e50621865e8b971bf324c3ba297c63bd47a32fec3e9245733be11fa6bde621974aa11348c0df63d931850a375cd82d64376633eab87743559731b7998e24676211093d660e57f5bb0bdc1bfbc1f4c5b8c93e8711db78a6dde2a09f1673f6bd6e6fa3aa5033b69617264f2ec1ec49fcb1c2f97fec23e29f51cac19239ddd1659751c6658dcc26600ea0460beb99dc1bab7e0c821188eb772f00e4364f75131adf555aab407ad0acd07a4213a03e93d400a5b34d4207f32bf1d404466608c7224e6946ead8e75061310d89cc6157ba9f18693f5036d681a590f64e7789fbec3f00c2f7cf851ed1b0b478002f6ec60ed46c2d119c6da54cfcbac1af046558d58b90134a509a1bcddb715996ae3132e6e71172d3d9bf62b73ae340a2007ade1c4e1edf81a8f254c4c744a67a6199aea7f27207dbeb1c9fc548015dcd2b68c4a751e4e616ce1251a83b61fa6d38cce9a1a67f19ee8c787e62b38ecd0c6816913d8ee4b5a961f5c24c72fe3e97664357876a379d14c4acfb83e7fab969cc6cba091cd94e72bd782ed305e6416dad5721dd602a1ac43c5da8ae631c9759de932f2e76df39eb3e88ba2fea1b7ec73b8d167de2f43217ac692559809aae83af315714bbcf37154ca4ba3294295f69e0966e0bbfe141cc3570106e00f0f7ba605ad2420950ab75dff235cc35a4cd671847b4636fe6b52d860b16a6b3a70dbb0fe57406122f2c1e886779bd055f43d2a246ebab25f2a7eaef9b0e1522f8a903f777966529eab3c0aed76fae3d3e999485abc91d00f129910d07984998d8ad697e83bbeb190cde0d66814ee253fc19f74fc22ad0c0ae482abcb738ce1e5153b5c0d65707b89b854b64eb04157ea6b390b69192f4ead687e595a09807cfbeef4e3e1439791eb4d8b05d958c5f5d198fc3a11944d77d543f725d75ef7228ad2809073b8b894f8133482a3aa59e597ee8a345a087e4d7400dc10d09f160fdccbc1dddbf83d3dc5297ec67e01fbb70a6d9cd459b8b43c67ec8b701609749945eeaf1a3ce77d3a311a7a749f196706cb146f3960a26eded875d2d9768edbceb4698f3a69d5adf32b541606e00ebb3773de9216b3e794806c7e26960905aa5aee9538a38ab1e1de98f3982c3d6eb7f46308275654f32258d832a04077569053f337d111e7197f82dd3f8f9261bd948fe00e8dcd834928047362e7a6b0bde4b9d15ab1e5ca8a7a660e3f898b4d875043f67f7f1e6f3cd3e292b6f6efad7a23ef8cf48c40b94add113ca5830d7ea656f5c663940e7eccc3bfb1680c3dced5ad450bad6ab2c75c096cc537afd94bf2e2ae4230a50c5e0dd3208696fcfb098ad592d268b40c9e6de06d99cf97fb6cf56745f2c6412612536fe0b79676c89536407b62a10963a0f94a81d04f1862f30439d3fe5cc9848d5abd7fdcdd5e404f2a0099cf40b1586b528adcd27628bb64198c7c86a0dd480bd0b4dc374ccedd9936a6c4e15b18852b25335174ddd2f1e1ad2eedf0e434420a6b6cdff3b5b6ef2d434ec604deaf2c047814b863908f9f63d31aeba0c9a9558d2e4f7eee2f18ef43cb28ceffbcbf8b24c4aa4bf6344b6d1e4c8d39ad0f84d654853dda908cee823b2eda80ce87bef798d68e728dcfc0e366a75df6d9253de6fd4a1bed23d6b553860340e3809cfb7d493c7d548d913f7552bcfbec06ab2267d57469145047e37b4cd8d3c8c37d8db372cf885cd9da4c4aab4ae2c0fd0b741e25cebc8dd51728f104ec716234e7aa2369aae45a2e429b4f205a2c11135fdb1bf7ed701fc5c875efc1ea26c3a57eec3d3d46efb593105f02eba80f98875a750c61eaa0ffdcae86f95a7a286948477eb840480d7906b5134ddf94edb0327e30723de0619b3dff4ee9fa554674dc9fff702987a69dfa6e295609954919da74180fcf7257ec2e3669062d3ea2ce542f03122b3a217bd20436f8fdff039bad91d37373b94416c91dcb5572c9a77bcfe6b30f873664d6cd29b92bf0f3233e88f6de12ebbb2e66a42e0f383af7fb502eaa3725007ccdf92cb36816101b9320f20d6a7fc67241f0b67538f0323675cd46b890ecf150db7753dad330039c1bca47429bfcef45b21b12d0cafac4cf3a6eb4894b2d6802dff9325924a7985ae237c6c9f528f02d6a95c23a806a25cda037be7d11a377005a365775a1c0e2a49969f44a8b4b4a1067754c8f0c688dc13ae1003c671379425739ce74aaf2eec1c01b2f8a6d910baf29c40f7d7ea8831f0f50513be1d06b886231ea556241ee332945d1a5248dcbe707827b59ae78800a2e195a8ccd84615a4e2a6357f1cd1fbabb286e32770fe2e01659c8a1e1cf2fa4c4e5f7c617fe98a60ab8f49c0eac02a1b697600329bd7af415578b8418e76f3fb9281c3723e28bff7392f634cd720b54e29c19d800c4534ffbbb2845a2ace239ea93ddb1988e4371bd382502e2573dc07023dccb8fe5712e2a6c04415c0f5fdd1cea52063934d27db840ead3b331a222c51394f270487884ef03d0e8acabaad83e62d4c1463f656d81f82702afd22721baa7e2e0e5e718e014aa7e3af0ed98b56c5ce681fdfd1bd36c415099dab8b36f8137ec745a8ce236d02d50f665afdf5f24f403daaed63cf0095707abcc9e02af3023af2d56d8bd", 0x1000, 0x169, 0x0, 0x1, r2}, &(0x7f0000000480)={0x0, 0x0, 0x0, 0x3, 0xffffffff80000000, r0, &(0x7f0000000400)="2bd8e9504c484823036fedeab858f0591d0fdbeec0641c54f664273855dff94148b8438608024916923760745245209210c5b4da227cb859949c3547f255e3eca2c85f3afbb1ad2237cb1deb2bff75cbcdbf5f3ea0ace6d597", 0x59, 0x7ff, 0x0, 0x1}, &(0x7f0000002580)={0x0, 0x0, 0x0, 0x8, 0x200, r0, &(0x7f00000004c0)="1824ef01e45c6ef90bee289d72f4bdcc1770c5457e1cb638ffbcc73ef8316f3e400db1a75e386d60f3e2089dee005f73", 0x30, 0x9, 0x0, 0x0, r2}, &(0x7f0000002680)={0x0, 0x0, 0x0, 0x3, 0x2, r1, &(0x7f00000025c0)="87edde36c138a1c38ec1300286759efd09c197eabdf9039e04a686cc928716f26ca2e6eea1c0d1ced91713ff9d9b2027c7c57eec184e0a2d713b2fea2a9f43e85b5b71a3f3dbe31271c63b28a083dc3f0e0864538ddc7ef66781b4699a8d8371df746ca63245f7a4dd422a2c9e1a84743c2b8ee7385bed403a4da30d6a742d5b2dabd2b3206ab9a94da40d4ff9ba2d59b56cd5916a432dce0c16ce936ea1", 0x9e, 0x75d3, 0x0, 0x2, r2}]) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000000)=[@text64={0x40, &(0x7f0000000500)="0f0866b8ed008ec066ba4000b000eed2a807000000410f01cab98e0b0000b862000000ba000000000f30b90b0800000f320fc72a8f2a60128f00000000003000000fc7aa00100000", 0x48}], 0x1, 0x0, &(0x7f0000000040), 0x0) 13:29:34 executing program 4: preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f00000000c0)=""/148, 0x94}], 0x1, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000080)='io\x00') preadv(r0, &(0x7f0000000480), 0x100000000000024e, 0x0) 13:29:34 executing program 1: socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = memfd_create(&(0x7f0000000080)="70726f63ae6d696d655f74797065776c616e316e6f64657600", 0x6) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x2000003, 0x5011, r1, 0x0) syz_kvm_setup_cpu$x86(r1, r1, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000000)=[@text64={0x40, &(0x7f0000000500)="0f0866b8ed008ec066ba4000b000eed2a807000000410f01cab98e0b0000b862000000ba000000000f30b90b0800000f320fc72a8f2a60128f00000000003000000fc7aa00100000", 0x48}], 0x1, 0x0, &(0x7f0000000040), 0x0) 13:29:34 executing program 3: r0 = socket$inet(0xa, 0x801, 0x84) connect$inet(r0, &(0x7f0000000180)={0x2, 0x4e21, @remote={0xac, 0x14, 0xffffffffffffffff}}, 0x10) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) listen(r0, 0xfc0004) r3 = accept4(r0, &(0x7f0000000000)=@ethernet={0x0, @local}, &(0x7f0000000040)=0x10, 0x0) setsockopt$inet_sctp6_SCTP_EVENTS(r3, 0x84, 0xb, &(0x7f0000000440)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xf4}, 0xb) getsockopt$IP_VS_SO_GET_SERVICE(r0, 0x0, 0x483, &(0x7f0000000280), &(0x7f0000000200)=0x68) ppoll(&(0x7f0000000240)=[{r3}, {r1}, {r2}], 0x3, &(0x7f0000000340), &(0x7f0000000380), 0x8) ioctl$sock_SIOCGIFCONF(r0, 0x8910, &(0x7f00000001c0)=@buf={0xbf, &(0x7f00000000c0)="68a9c26dd6f22edca8461e7542e4c5bb78808babbb92ae771261e137a9534c99246f4daaada6d2fcedf0ba285d02d3be9a1ee7aba71dada399aee1aa86584f213e214c3151adccd81f4a23ac3ca0ef171bb0d0eb0ee832c71541e57b02ed90c42dd7283931732c86736bb390827a3f675f3d848cb35e91ef4d26dba410da2ad542986ebff2f1d21ae297e3e7df884f075c334aad600e98803101c76e8d654f5615433195cbfcbd04025ff18a5aa4bb69c209ae7314a8394abef7e8d185603d"}) 13:29:34 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000007000)={0x8, 0x0, &(0x7f0000000140)=[@acquire], 0x0, 0x0, &(0x7f00000001c0)}) r2 = dup2(r1, r0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000002c0)={0x8, 0x0, &(0x7f00000000c0)=[@release], 0x0, 0x0, &(0x7f0000000300)}) 13:29:34 executing program 0: r0 = socket$inet(0x2, 0x4000000803, 0x4) bind$inet(r0, &(0x7f0000000000)={0x2, 0x0, @broadcast}, 0x10) getsockname(r0, &(0x7f00000036c0)=@xdp={0x2c, 0x0, 0x0}, &(0x7f0000000080)=0x80) setsockopt$inet_pktinfo(r0, 0x0, 0x8, &(0x7f0000003780)={r1, @rand_addr, @dev}, 0xc) syz_emit_ethernet(0x4a, &(0x7f0000000240)={@link_local, @empty=[0x0, 0xf401], [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x3c, 0x0, 0x0, 0x0, 0x4, 0x0, @empty=0x9000000, @broadcast}, @udp={0x0, 0x0, 0x28}}}}}, &(0x7f0000000380)) 13:29:35 executing program 3: r0 = socket$inet(0xa, 0x801, 0x84) r1 = openat$tun(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/net/tun\x00', 0x4e080, 0x0) ioctl$TUNSETVNETHDRSZ(r1, 0x400454d8, &(0x7f0000000100)) connect$inet(r0, &(0x7f0000000180)={0x2, 0x4e21, @remote={0xac, 0x14, 0xffffffffffffffff}}, 0x10) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$EXT4_IOC_MIGRATE(r0, 0x6609) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) listen(r0, 0xfc0004) r3 = accept4(r0, &(0x7f0000000000)=@ethernet={0x0, @local}, &(0x7f0000000040)=0x10, 0x0) r4 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000140)='/dev/rtc0\x00', 0x400, 0x0) ioctl$KVM_GET_SUPPORTED_CPUID(r4, 0xc008ae05, &(0x7f00000001c0)=""/163) setsockopt$inet_sctp6_SCTP_EVENTS(r3, 0x84, 0xb, &(0x7f0000000440)={0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0xf4}, 0xb) 13:29:35 executing program 5: socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = syz_open_dev$sndpcmc(&(0x7f0000000040)='/dev/snd/pcmC#D#c\x00', 0x0, 0x185140) setsockopt$XDP_UMEM_COMPLETION_RING(r1, 0x11b, 0x6, &(0x7f0000000100)=0x12c000, 0x4) r2 = memfd_create(&(0x7f0000000080)="70726f63ae6d696d655f74797065776c616e316e6f64657600", 0x6) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x2000003, 0x5011, r2, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000000)=[@text64={0x40, &(0x7f0000000500)="0f0866b8ed008ec066ba4000b000eed2a807000000410f01cab98e0b0000b862000000ba000000000f30b90b0800000f320fc72a8f2a60128f00000000003000000fc7aa00100000", 0x48}], 0x1, 0x0, &(0x7f0000000040), 0x0) 13:29:35 executing program 1: socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = memfd_create(&(0x7f0000000080)="70726f63ae6d696d655f74797065776c616e316e6f64657600", 0x6) ioctl$LOOP_SET_BLOCK_SIZE(r1, 0x4c09, 0x5) r2 = gettid() ptrace$getregs(0xe, r2, 0x2, &(0x7f0000000100)=""/140) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x2000003, 0x5011, r1, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000000)=[@text64={0x40, &(0x7f0000000500)="0f0866b8ed008ec066ba4000b000eed2a807000000410f01cab98e0b0000b862000000ba000000000f30b90b0800000f320fc72a8f2a60128f00000000003000000fc7aa00100000", 0x48}], 0x1, 0x0, &(0x7f0000000040), 0x0) 13:29:35 executing program 4: preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f00000000c0)=""/148, 0x94}], 0x1, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000080)='io\x00') preadv(r0, &(0x7f0000000480), 0x1000000000000294, 0x0) 13:29:35 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000007000)={0x8, 0x0, &(0x7f0000000140)=[@acquire], 0x0, 0x0, &(0x7f00000001c0)}) r2 = dup2(r1, r0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000002c0)={0x8, 0x0, &(0x7f00000000c0)=[@release], 0x0, 0x0, &(0x7f0000000300)}) 13:29:35 executing program 0: r0 = socket$inet(0x2, 0x4000000803, 0x4) bind$inet(r0, &(0x7f0000000000)={0x2, 0x0, @broadcast}, 0x10) getsockname(r0, &(0x7f00000036c0)=@xdp={0x2c, 0x0, 0x0}, &(0x7f0000000080)=0x80) setsockopt$inet_pktinfo(r0, 0x0, 0x8, &(0x7f0000003780)={r1, @rand_addr, @dev}, 0xc) syz_emit_ethernet(0x4a, &(0x7f0000000240)={@link_local, @empty=[0x0, 0xd00], [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x3c, 0x0, 0x0, 0x0, 0x4, 0x0, @empty=0x9000000, @broadcast}, @udp={0x0, 0x0, 0x28}}}}}, &(0x7f0000000380)) 13:29:35 executing program 5: socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)) socketpair(0x1, 0x3, 0x0, &(0x7f0000000040)) openat$full(0xffffffffffffff9c, &(0x7f0000000100)='/dev/full\x00', 0x200143, 0x0) openat$qat_adf_ctl(0xffffffffffffff9c, &(0x7f0000000140)='/dev/qat_adf_ctl\x00', 0x0, 0x0) r0 = syz_open_dev$usb(&(0x7f0000000180)='/dev/bus/usb/00#/00#\x00', 0x1, 0x400) openat$sequencer2(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/sequencer2\x00', 0x200, 0x0) r1 = syz_open_dev$usbmon(&(0x7f0000000200)='/dev/usbmon#\x00', 0x5, 0x1) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x921) r2 = memfd_create(&(0x7f0000000080)="70726f63ae6d696d655f74797065776c616e316e6f64657600", 0x6) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x2000003, 0x5011, r2, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000000)=[@text64={0x40, &(0x7f0000000500)="0f0866b8ed008ec066ba4000b000eed2a807000000410f01cab98e0b0000b862000000ba000000000f30b90b0800000f320fc72a8f2a60128f00000000003000000fc7aa00100000", 0x48}], 0x1, 0x0, &(0x7f0000000040), 0x0) ioctl$sock_bt_bnep_BNEPCONNDEL(r0, 0x400442c9, &(0x7f0000000240)={0x2, @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x3}}) 13:29:35 executing program 1: socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0xe1, 0x400100) creat(&(0x7f00000001c0)='./file0\x00', 0x2) openat$dsp(0xffffffffffffff9c, &(0x7f0000000200)='/dev/dsp\x00', 0x8000, 0x0) syz_open_dev$mouse(&(0x7f0000000240)='/dev/input/mouse#\x00', 0x100, 0x10000) r1 = syz_open_dev$amidi(&(0x7f0000000280)='/dev/amidi#\x00', 0x8000, 0xc0000) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) r3 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000007000)={0x8, 0x0, &(0x7f0000000140)=[@acquire], 0x0, 0x0, &(0x7f00000001c0)}) r4 = dup2(r3, r2) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f00000002c0)={0x8, 0x0, &(0x7f00000000c0)=[@release], 0x0, 0x0, &(0x7f0000000300)}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x80000001f) ioctl$SCSI_IOCTL_GET_BUS_NUMBER(r1, 0x5386, &(0x7f0000000380)) r5 = memfd_create(&(0x7f0000000080)="70726f63ae6d696d655f74797065776c616e316e6f64657600", 0x6) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x2000003, 0x5011, r5, 0x0) ioctl$TIOCGSID(r5, 0x5429, &(0x7f0000000300)=0x0) ioctl$sock_FIOSETOWN(r0, 0x8901, &(0x7f0000000340)=r6) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000000)=[@text64={0x40, &(0x7f0000000500)="0f0866b8ed008ec066ba4000b000eed2a807000000410f01cab98e0b0000b862000000ba000000000f30b90b0800000f320fc72a8f2a60128f00000000003000000fc7aa00100000", 0x48}], 0x1, 0x0, &(0x7f0000000040), 0x0) 13:29:35 executing program 3: r0 = socket$inet(0xa, 0x801, 0x84) ioctl$sock_SIOCADDDLCI(r0, 0x8980, &(0x7f0000000140)={'erspan0\x00', 0x5}) connect$inet(r0, &(0x7f0000000180)={0x2, 0x4e21, @remote={0xac, 0x14, 0xffffffffffffffff}}, 0x10) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) listen(r0, 0xfc0004) r3 = accept4(r0, &(0x7f0000000000)=@ethernet={0x0, @local}, &(0x7f0000000040)=0x10, 0x0) setsockopt$inet_sctp6_SCTP_EVENTS(r3, 0x84, 0xb, &(0x7f0000000440)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xf4}, 0xb) ppoll(&(0x7f0000000240)=[{r3}, {r1}, {r2}], 0x3, &(0x7f0000000340), &(0x7f0000000380), 0x8) ioctl$sock_SIOCGPGRP(r0, 0x8904, &(0x7f00000000c0)=0x0) ptrace$poke(0x5, r4, &(0x7f0000000100), 0x7901) 13:29:35 executing program 4: preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f00000000c0)=""/148, 0x94}], 0x1, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000080)='io\x00') preadv(r0, &(0x7f0000000480), 0x1000000000000060, 0x0) 13:29:35 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000007000)={0x0, 0x0, &(0x7f0000000140), 0x0, 0x0, &(0x7f00000001c0)}) r2 = dup2(r1, r0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000002c0)={0x8, 0x0, &(0x7f00000000c0)=[@release], 0x0, 0x0, &(0x7f0000000300)}) 13:29:35 executing program 0: r0 = socket$inet(0x2, 0x4000000803, 0x4) bind$inet(r0, &(0x7f0000000000)={0x2, 0x0, @broadcast}, 0x10) getsockname(r0, &(0x7f00000036c0)=@xdp={0x2c, 0x0, 0x0}, &(0x7f0000000080)=0x80) setsockopt$inet_pktinfo(r0, 0x0, 0x8, &(0x7f0000003780)={r1, @rand_addr, @dev}, 0xc) syz_emit_ethernet(0x4a, &(0x7f0000000240)={@link_local, @empty=[0x0, 0x8], [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x3c, 0x0, 0x0, 0x0, 0x4, 0x0, @empty=0x9000000, @broadcast}, @udp={0x0, 0x0, 0x28}}}}}, &(0x7f0000000380)) 13:29:35 executing program 5: socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = memfd_create(&(0x7f0000000080)="70726f63ae6d696d655f74797065776c616e316e6f64657600", 0x6) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x2000003, 0x110, r0, 0x3) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000000)=[@text64={0x40, &(0x7f0000000500)="0f0866b8ed008ec066ba4000b000eed2a807000000410f01cab98e0b0000b862000000ba000000000f30b90b0800000f320fc72a8f2a60128f00000000003000000fc7aa00100000", 0x48}], 0x1, 0x0, &(0x7f0000000040), 0x12e) ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x1) write$RDMA_USER_CM_CMD_CREATE_ID(r2, &(0x7f0000000300)={0x0, 0x18, 0xfa00, {0x4, &(0x7f0000000040)={0xffffffffffffffff}, 0x13f, 0x9}}, 0x20) rt_sigpending(&(0x7f00000003c0), 0x8) write$RDMA_USER_CM_CMD_QUERY_ROUTE(r2, &(0x7f0000000340)={0x5, 0x10, 0xfa00, {&(0x7f0000000100), r3, 0x2}}, 0x18) setsockopt$bt_hci_HCI_DATA_DIR(r2, 0x0, 0x1, &(0x7f0000000380)=0xd786, 0x4) 13:29:35 executing program 4: preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f00000000c0)=""/148, 0x94}], 0x1, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000080)='io\x00') preadv(r0, &(0x7f0000000480), 0x100000000000011a, 0x0) 13:29:35 executing program 3: r0 = socket$inet(0xa, 0x801, 0x84) connect$inet(r0, &(0x7f0000000180)={0x2, 0x4e21, @remote={0xac, 0x14, 0xffffffffffffffff}}, 0x10) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = creat(&(0x7f00000001c0)='./file0\x00', 0x0) ioctl$KVM_GET_PIT(r3, 0xc048ae65, &(0x7f00000003c0)) listen(r0, 0xfc0004) r4 = syz_open_dev$sndpcmc(&(0x7f0000000140)='/dev/snd/pcmC#D#c\x00', 0x5, 0x800) mount$9p_fd(0x0, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000100)='9p\x00', 0x20, &(0x7f0000000280)=ANY=[@ANYBLOB='trans=fd,rfdno=', @ANYRESHEX=r4, @ANYBLOB="3b7709006e6f3d08a702cf3c30ddc57d579b49b462016366883b9ae193d3d85e003567b058eea038f76991d2bab8d4cf327cab786f1401ebb0c81a1618658fd7feeb57a80810baadd8cdd73db124ef66028e2619", @ANYRESHEX=r0, @ANYBLOB=',version=9p2000.u,\x00']) r5 = accept4(r0, &(0x7f0000000000)=@ethernet={0x0, @local}, &(0x7f0000000040)=0x10, 0x0) ioctl$FS_IOC_RESVSP(r4, 0x40305828, &(0x7f0000000200)={0x0, 0x4, 0xfffffffffffffffd, 0xf0f}) setsockopt$inet_sctp6_SCTP_EVENTS(r5, 0x84, 0xb, &(0x7f0000000440)={0x0, 0x0, 0x0, 0x1000, 0x0, 0x0, 0x0, 0x0, 0x0, 0xf4}, 0x120) ppoll(&(0x7f0000000240)=[{r5}, {r1}, {r2}], 0x3, &(0x7f0000000340), &(0x7f0000000380), 0x8) 13:29:35 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000007000)={0x0, 0x0, &(0x7f0000000140), 0x0, 0x0, &(0x7f00000001c0)}) r2 = dup2(r1, r0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000002c0)={0x8, 0x0, &(0x7f00000000c0)=[@release], 0x0, 0x0, &(0x7f0000000300)}) 13:29:35 executing program 0: r0 = socket$inet(0x2, 0x4000000803, 0x4) bind$inet(r0, &(0x7f0000000000)={0x2, 0x0, @broadcast}, 0x10) getsockname(r0, &(0x7f00000036c0)=@xdp={0x2c, 0x0, 0x0}, &(0x7f0000000080)=0x80) setsockopt$inet_pktinfo(r0, 0x0, 0x8, &(0x7f0000003780)={r1, @rand_addr, @dev}, 0xc) syz_emit_ethernet(0x4a, &(0x7f0000000240)={@link_local, @empty=[0x0, 0xe803000000000000], [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x3c, 0x0, 0x0, 0x0, 0x4, 0x0, @empty=0x9000000, @broadcast}, @udp={0x0, 0x0, 0x28}}}}}, &(0x7f0000000380)) 13:29:35 executing program 5: socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = memfd_create(&(0x7f0000000080)="70726f63ae6d696d655f74797065776c616e316e6f64657600", 0x6) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x2000003, 0x5011, r1, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000000)=[@text64={0x40, &(0x7f0000000500)="0f0866b8ed008ec066ba4000b000eed2a807000000410f01cab98e0b0000b862000000ba000000000f30b90b0800000f320fc72a8f2a60128f00000000003000000fc7aa00100000", 0x48}], 0x1, 0x0, &(0x7f0000000040)=[@cr0={0x0, 0x10000}], 0x1) 13:29:35 executing program 1: socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0xe1, 0x400100) creat(&(0x7f00000001c0)='./file0\x00', 0x2) openat$dsp(0xffffffffffffff9c, &(0x7f0000000200)='/dev/dsp\x00', 0x8000, 0x0) syz_open_dev$mouse(&(0x7f0000000240)='/dev/input/mouse#\x00', 0x100, 0x10000) r1 = syz_open_dev$amidi(&(0x7f0000000280)='/dev/amidi#\x00', 0x8000, 0xc0000) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) r3 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000007000)={0x8, 0x0, &(0x7f0000000140)=[@acquire], 0x0, 0x0, &(0x7f00000001c0)}) r4 = dup2(r3, r2) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f00000002c0)={0x8, 0x0, &(0x7f00000000c0)=[@release], 0x0, 0x0, &(0x7f0000000300)}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x80000001f) ioctl$SCSI_IOCTL_GET_BUS_NUMBER(r1, 0x5386, &(0x7f0000000380)) r5 = memfd_create(&(0x7f0000000080)="70726f63ae6d696d655f74797065776c616e316e6f64657600", 0x6) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x2000003, 0x5011, r5, 0x0) ioctl$TIOCGSID(r5, 0x5429, &(0x7f0000000300)=0x0) ioctl$sock_FIOSETOWN(r0, 0x8901, &(0x7f0000000340)=r6) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000000)=[@text64={0x40, &(0x7f0000000500)="0f0866b8ed008ec066ba4000b000eed2a807000000410f01cab98e0b0000b862000000ba000000000f30b90b0800000f320fc72a8f2a60128f00000000003000000fc7aa00100000", 0x48}], 0x1, 0x0, &(0x7f0000000040), 0x0) [ 534.440313] binder_thread_write: 10 callbacks suppressed [ 534.440327] binder: 25501:25507 Release 1 refcount change on invalid ref 0 ret -22 13:29:35 executing program 0: r0 = socket$inet(0x2, 0x4000000803, 0x4) bind$inet(r0, &(0x7f0000000000)={0x2, 0x0, @broadcast}, 0x10) getsockname(r0, &(0x7f00000036c0)=@xdp={0x2c, 0x0, 0x0}, &(0x7f0000000080)=0x80) setsockopt$inet_pktinfo(r0, 0x0, 0x8, &(0x7f0000003780)={r1, @rand_addr, @dev}, 0xc) syz_emit_ethernet(0x4a, &(0x7f0000000240)={@link_local, @empty=[0x0, 0x806000000000000], [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x3c, 0x0, 0x0, 0x0, 0x4, 0x0, @empty=0x9000000, @broadcast}, @udp={0x0, 0x0, 0x28}}}}}, &(0x7f0000000380)) 13:29:35 executing program 4: preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f00000000c0)=""/148, 0x94}], 0x1, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000080)='io\x00') preadv(r0, &(0x7f0000000480), 0x10000000000001e0, 0x0) 13:29:35 executing program 3: r0 = socket$inet(0xa, 0x801, 0x84) connect$inet(r0, &(0x7f0000000180)={0x2, 0x4e21, @remote={0xac, 0x14, 0xffffffffffffffff}}, 0x10) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = syz_open_dev$midi(&(0x7f00000000c0)='/dev/midi#\x00', 0x1, 0x200) ioctl$KVM_SET_NESTED_STATE(r3, 0x4080aebf, &(0x7f0000000480)={0x1, 0x0, 0x2080, {0x6001, 0x5004, 0x2}, [], "9fbdf4802fe60c9e79d57037c8426f974e467ea0c61daa7afa8ea023ecbbc3b19e491fad80fde00152c9f22c5fb40d79e14c7e5c139f8d51777f0f65b21731d5fac3f34bcf42c52c525565b7b7b8ac59a49dd7ac338e0c2f960ca7895d268aa9a2ead98f6b49457fc293223f527599a14e4f9685287cbe955f4fe1d17d7e99fe15848a187ade3a17e3f3c6bc7bdb45c9ec02f7bd6ded5a73085c65b4a07b1660d881ff2e4173218af0c7dfd3afc9032c5dbbb67e22a7adcdac4d02f46a855ee5ddf607a7154f799a3ee62bcafce8d2d30b0741d99ab94e03b8d5c10ce32c649df0f986622a10e2c656f5ac9f721c9427f7279b0cea69a13f5fd5d508c9fd3bd91221e45b85e83146759e83aba0a84829bfae4674d75fd78fadf6109d0e151b8b24bae8285cc39e6812efbf2313f26e8c7d03358ce9af46c7dca3e5335393a9160161b09d5350239296d6c11ac68fe603bb92c011422cd71f9a9b8de3fa78deb9a5d1386de343d50b4d3fb9faedd0414715f1dae72346c06a6014c7000b32e8272db8901b31e21056c53bb3f2a51e2eaf9153bb4daca46922ef365b2852914e4dd49c7881c73d92dcc0edfe227c406e8d25c0b3ffb5c94de327cfdc9669fe80060bd357bf262477eafd89f4804c05cf934db2c53a23c1c7e8ae3fd2dc9317ffea389bdf3fc4f2615613728299d9ba6a15c1df5f897b2b28ff86771e3bc64e316dc4c5e06116312790f4c2d6386f5238d6baa6f5bcb986e789eba5791c91ba9ff982ad4e7f6b41f1a94965c698630ad140525fcd5dcf05b0d94e06e6c4649e160901f086ce9cbf8b72593d4c5097b9e9ea50db8fdf946ad7ca4318d4f23d431b86c0b013f0f84eca50f40ad255256a102cff2372fe8a8ebed099ee63a5b5b182e090359e5be403471234524026b518abca73ab14a4babe3487d6d4a0660ad6f32972849f8b8f72d1bc7754ee13e1ffeaf3ebac48ab0fd36d29e867775b4806e91078ff4f1f48fa480f77490f2e0c03a0cf55a2597f3be5b9d639df5b71ffe504e518d7ca40195dd8abdb75fb4db7d8e0ebec2f584c2c1f656ab378272214f01b4396c10ea1fc9db519c6664bcd04c97b8f297b430208c4fed3def7b741becd3816ccc24d0a0b3320256f17707604638dab00c387e939b944a97e0b71a9c4c8a8c13ad9c1f86db2cb06cffba558e0f8c50e319dfd70373effeb472e45164dd292fc0b343614c7c5b04c68c7c4749b856ddb340724eb50cfde784705a7e16a40f635e7e84ccec129f7d0bf59117697243effe3c5c1880a2bcb24b5198694ba5e2fac2c234968f4dd50cb5d97ef66f5f1d9aebc3396e1b867916b570537e88cbfb88fc5231a2cefe5dfba69a162642c8a4dff0152e672650965a9243f4a1a60f52acd88e5bd8a624b3b7e11edd200902e949538d42477e58280c7e1379e4ede0625b58764b11f89bffb2558b19aa363837d40034ac1c46a4981dde8a2fcb4cb85cf8662803a6a277faefc5dd27703478e6185c892fc70cbd31bcf6442f3038d044dc546df034bdb9b0f571c01a44b642fdd6aa199633c2396b1527eed366ba712658ad311fe13a15fcef4ad1e67b46886a94da201f1f09aae4f9cf1e2e3552f3a7eef898386902c427827dd0d9d0beb3c814894b5451cd3720345d6a51d7515ae2e3fef6a935d48969d246102691d4da3487f88bb03ded2cba893e3328a2ca911789a5fd0238e3083b886762a5a5c539cecb8b33722a5bbadb578a9cc471816ae6add34a0adcb76ad1b99fc6565ff330cbf9d799d89784996d31153b153dcd78457061ad860b4eab63ff71ccf4b7f4dc8f91161d010c1f3f6e9e38dcf0de3a94c93f53f53690abeb359f826f7d009b76b542528bc00754fe055e8dcb84476e84b73795c93d215cea47ef744608faadb6eef3af59f2b306a4105c3cf4424b93b7f72742cb03b5fdad9af78b8c9ba3b3522a18e05171406d8a033aceb655f2582a09c750fef0cfc23bbd4beb36158e8b8bde67fb3106cbf4970ecf7334fb662d394febb2256adb3cf9f79d2417cfefe6edbbc5fdcecdacb9c4781e453a618b7f0dfa054b4becfcaa48217105ba8a725b117edada183bb745e0efbff8b1e0bc59d49d2d3a00006e4ceb27d75d1bb43df3c54ad4ea3f529b8f641d1d1b282f91f5e62b9ecc1c2057d56996231a9421848ceb1331439b0ba181b7b2296fc53b8d73e0658be347cfdffa6d2b15285ef34396ef74c954826c6cf13235d7e37701131fee139dc0ae64762c18a5f66d5aeb9d5a47ce1ac4e810bb7984e6b5f2fe2af6eb10123779fa6beb5ef66675d746ae7873cb9bf75beed74a6a95bb6971ab57e86c005a9040f3f813b86869c917f6368a7b4e32665070c60d7d03f8a3900a765e6ec06832d5eb65c485a59c809f9d79b1b91b1fe9f558593d04981f2f8bf78e8a611d3658f70db007c2a6a3b2f03ba5b813d992d4355a5af6a79f31f09f23efdd660300676302713e7b6d736d90d282af7011e926689e61dda56d1f8541bef30588d6a949db83653714e946632d41ca047c3a6e141a7c4a0d749fe2d4564336ec25a464b92e45d3eea9cd40298c157b00c742abe0cf65721b9ac5b4b5b1fcd074ae8d8d58036f6f13c7c2fbd59e39d70453dbe7fb279945e90f9959cb318298b9059fc83fb85ae36f56ed746872f7a62fd37aa128548af67b2abd949f42d824e91d4d0afffc928f733590353dc8febbf35f2142ad2c10fb5d01cdb6f794ac4da51f2285c82f9da222e7c4e36cf9a90524054dc4178cc89e7c78a601c984d1d90d79a03252a5090e56daaf9f9aac27ab31dc9b2626aa684e1d81c5e17279462e0dd22da0f3c3261a2d2254eb2d36b4b26b69347afba869de75d58a2ce6929c48bfe8b00d9b4bc3699ec79d0a439d019ed9e334aca71899302efb8d079b9d9ecd3912764fb9600778f445a600e88ee0b5920d947f3ec159fd19df997d38db6cc1c4d5546fe5f0dfc3bef6b29d01c1662ad449f952778765faee87e4e0170dcddbdcea7f7aa40757f12b42a5bc746f530725a428c10bdac3fc75271906e43dbe852a0039069460146af0d845d2ccfe361bbbc892066f7258ff70b57b7818b4da11dbd172bf135b90872775b7b42452703997fced4d5ab040592ba7de8ae65b249ff03427854e01f8b3ed72df1be910234a5cd915a79e417c4368ec8609014604000742373b771aa27bf685fb9ef978afd0994c04940174893397211b087b37ad03113bd16740e71e3e642b720abc741c4df1caf899f2e3a5007e36d6cc863b1b9c0ff7299d93a4c8a102d5af4ff7c73356e102a54a7513cafe209387a6901c7ece2ba51e0bd2414298788743071e0b6e0c31e6ce8ac87452ad691c1637eeb0c47ba3aaf3332e0aecad0fc7ce481d58c7c2481758938520516575bb358a12b7963f3cca08d1ef51aeb2a632673282f9a8cf4c6cbc19c609e23ff5c69d0b84b9cebaca3955ea19cee16cc743a14106428bde65a7c96de6bca17986c0df82e5b6eb394f27b51d05a593afa0092c46fdde0144636ae54fe9c90873deab077e6eb1351c6799d4059420d0ff890911c3d20001f76f3894d45788060f8db44ce32395b654efcbd1dcb39f16ac2b5c048802243cd1186efff8f419858aa70a2d4b8f8e5d29c7920d5b4efbf1fbdb1dc67168ade65d789b2d4047fbf2e622d8b721c94df541291eb3a90dab2de820858ea4dd44ceea27501019a44c1fb87df2b429a9aa441de4e1e459c69bedf165062659d4e05fae6ee8479a4bc74b1b989ccf59e5ac25f0d4be5701f39ca955bb1bcc2e09037d384cc1494793494ec8823fbf901dffcb7da4a0cca21a95cd9136a863aeccead49304b39bcd617fc9cff4ac23b84ec41e58b8d5227d753eaddccc2c8d43e248be00dd67f8c0e7c99208c6c9001074bc632b549c6179bffe34095c248dc46ca4dcf0d4f9a04387fd2051a4f4713a78bc11ddd8d1e7a83ff81f3d7535786135a3df5e41cd192c8d03e8325409d6fae336b42d053fe44e0aeccd72fd8626166bb2d8a9f2dd39abacbb4f6ae86126d7c77cbded9fafc6945afa77f96c1e67a09a792e9e9d3da2b51d96dec5094b8e09dc8a57d01608c760f0b28a83d3e00d60adb5f835e8ed8be74d7b9c5c284bc2ac94f07c5f958885eb4f14684de147ecc7212903070389f8cc15be8ac9f932c26c3a87c198dd5acd2b88e5d1b74fc546cdab7c0bfd64632b95166d3336bd4ce0426f9166884df7f6b9c85e1cd997b2f44101169666700178a7add694138801a6affb8887eadae649d822967c384b3dfb930a2d7bbf9800b62773923e29cfe920027e2b5f973a2ad3ba026969e7954645877d048a8785923fde54d16195fe44b86e1810ed1e8606ea1ec220b3983b8040d4c8e48b2797ea8fce170350ac1df4f484c7a0df3033d6e2dddc7dbad8640a2508d7c9641d1624742e2c60f9f5bda8f19b3650ce0e6a6f0a665424430a211dd3902e095b603f15f1cb7a763d318e013b8cfefaefbfd7f638cae34f677779fecd3b5a7b4de4fab2d8cde731fa8b269869b615166a2c25c723067743a6bb4f77d7afa0f961f8f8fd646177a8ae5fb9f3fee067ff89e0ef58ccf231046ea84cd3a6c522bf3fc570959232811369b576671cd9fd27176b14c7137c34473c4f3f542fbfa368b0c4bc142ded11616efe77face0982c5ab205054a2c0cd412364d22387fcfd42ce644ac5f84539dc395e83c90e945b9b6d436ca81fb50d02ae3dc27b989aa6d621ca867ed7d1d864398a514b90b5913c1fdfc3f9643fcc4b0cacd0abc95129a491a429e41a7acafccf5fdce534adb4e9974cff0ddcb4163b9e7f2b361a373f05af1fdb738b977a4c5697040808b6c6e23660902353fca847e92ab7a417974fd794d29d1191d58632aa5fd8a0c684b80868ed94c15733b85f2b56998e39042f33a4f769d88c309d4608b006dd81a429f8d977f1b05e6523f22c824fb7649ca6503572de6b401a6ddd6096f40f703bb5af1ec55df670d156e9514b0d533e4e02f03e2af51d93393acf012581f1b05a4765019e2f793fb6c2f328bec3beb879858ec31f837bf9c93e0087d0a1c265f79e63db1c6c318fc0a356a5d111880a1faae1f1dd54d55fbd8ba116363f791b94132ec0fca0c046fa6854ac74b85cdeaae31ceba7e07a20d7d1fa74dc9600be378c893bdbdf0dae2cd424e464a6127cb1a24f711cef2edc218587d19cc3e39432482c242516c5925db82de4922744dcd1ab4209ce4b2ff16b0008e4072fac28ef381f17d8b98fef7e53310b1e59fdb99e4e1c257f0218ef73a4b254e90f9b297f54fd420f66743ed064d04029ddda6dafbd8569089df37bc8db5123ba837b44638786100d6907262359d544da85c14acab70394197826c45813416477e3771943546d2c63e218140a7cd18a50ad59916143a95dfa8b93eaa75f6152d2b2b2af10691f7fb268407e2addaca8c4b4488798a6ce294ba1fe7400d40d1c1c382e61f736b25d1694684183f4b7f0558a5f38bf0cd3f37d00dead686bd753246f866651709e3d3c0c834aee29055f46f02e0dab8a5aed8691d752d7f91d73782db4a6c84d0f82ddc4fee3e93423b5a4185c8e4b0869e6ba93ee977ac1e1a835ddb80a7e1dcb21cdc7bf5fbdb61cb5c4a2f90d5283d9c341bcc3faaa7b1290d8038e9b6e87e569148cdecd05bf4321801f19c26885041d2d82e20bb92ccb775431e6813481f3f6093be1f02410c48bdb5eab12943b2c68bd2efaecbc65f4251d8b4c45f2d31fe128dadf6a7cb74", "62c7b48870964863c6e58a1508581812e2efdcb5a1d215faae9f90e998be3929a174f5570ae824e1db85adbf83e33acd424844d37c583773222dfcaea3558197f666c64f774dd422427a17c5305ed72473aa970240e7222f64085706b948616e327ffebe033adb0b7f65c88fea0e6010966159c0f656749c82197f63eaeee84f037c451ba4edcd7a314ac6f8a5a59f52d23e09179d966878aeae90fcf6e666092bc52fd8af9730247f89731b82ae95bc5513089dbcfa5a24f5af0dedf5f8746fa70404dadf90248436900428d90dff563a34c1a84b92923e3154fc3d7016d9e990eb83c868bc241292d5cf03d04cbbb87878a4aa342f5123d0e694fed61128f1b34da941f089ee331ca530f3f0c27a7a93f9bd035c918cb0a7b4ecd81a0bf5f5b9bdebb50c325bf4326b2d46fcd36771dde8ad6db90bbeb5543dbb4b13d18b96e2eff3b40dbef0badf67ae31c5ebd3b8088a9c0d213e8cf6a38321e5ddd569acbe89bfd1971f8fdb6d0e7e4e1be7738c9824868fb5fe6160126112a3597759a5990fecc5a38a119483c327bf34abb26b3523f0b040755713ff498a1277aafe44465e2fd757d567766385344d71282d5e6f90dc38bb8357f9592e6b0370771d989c30ccae4b94647799232e9ec42c7a4fba1488d4d30c6c737274234764344e841e1fe54846b73cd127a9001b58f473b56a38cc5f7b85989f088eb031cf2c97ea484ea1e247684b1e627b8d4628e49160da6a36289781d1bc1fed00242609c36b17b9820d442f69bbd16346b8908f4e135ecd050af46cc5191335ac3a8eb9895122062b5f3444ddae641f041a8e65a9405b411d24b21f4b9eb08733231b46cc3580bc130ca46aa252dc2e982a3df6e74c9c9b3f60a4ac1a3e7bfef8160c551015008d7b9177d9e03ce6c021958693449beddde3691edafd33c18072ca15b543a8d2fc7267fe15979a8d170fba714ecf72efdd606fbe7904cb7eba8ced95d2965fde6d4ee072978ed75f21bd5611d088b3f9f5f1c204bf30e7901886198dad7b7ecbff302dc2a0879dbd396dc8ed048621c3283682deaf2feb7fb7a5f702befd9e7b99107cf6aba918287ba933df64e8edfd51eb5edda18d41cd7068833e9c533964df4515b8bb06084d2415da322560fea0d861cea0d76d9b0fcda0b6ce6978dfffe1966ec6197e58efe3387c874a7102cac7b1608f8568ad95f81eda2bb6565d8e04830dada1536843e17a24e595c15f2f3dc06f9e301a4906c806b23533eba10987514c93ffa14ca9a944f5e973c6edfdaefb359c358f357aa10c3466122a268be192f0270f95dd9b70b138b5e96e4c336e0a93a68a0b3b1daffced8fdafb8efcaeaff88f4e5572dafd08a7d4095f2f8365fc04dfd3f7a13871c516cd6a7621c3e6bb944c1553b4aab7d8bbc53f18b1a1bbb070a319b486e7484ce473eb48cc7ff3008d5846259270b405171f2f1c6c2f58d1ccff4ea50346947e19aafdfc851dc9ff36f242192765fc0e2dafb8eb0d4eedb31822242e787c716b7a0e81a97f1d8521a885dda9954410e9f9aa421fe317cc4111f35fb886e6a01408a91e35ba506ca9f8c9daa4cb29233e46bfbd1731c7c42c1a8e7f5d72554305a02da801d818b24b059e08ecebac4d81964183474a6e0f9246b85919b48256e3d3ae73c5e8f3290d2f7a79e3f3557ebc9a9910528568a806441073ad4564ce93cd7e811fef08467baefd48dde769b5da39e3772697293c0f53a4a98cd071d31315fde41e60bdfff674dec00fde625a074baa110663ffa64fd96f494915351c82ee7008e7ebae1323ae853ab4429df602bd33425d38aae062be065c11a44dfca19beab68ffbda7e3943638e25042503ea90ea32b1f67a0f8c04f62329a940eb159bda2b36b70d7e1b76b8aac1ecb2ea39587e95a26da75308ff58b4c8284cea07ebb7a8e19a7c274838bc9d77e1018fd3f36c910b330b3bca869a571c713b91a67ce213f67c100cdae5d69587aa976b1e38c58ea7a2b17980ebdc0ca3fcb94d035000ba63462c047e585f36b10898bbd26a1e20758fafa58a9db5e22779eb7359e850ef6de18aebb6b4e563dbf027dff3786340e04f2cc9b61adf1892e3b070670f6dcf18301f7b88a25345f63679b5c8fd89c3d21c0eb93592aa6df589806e8e6e5ed5389245919777e80427e485e75437d7df541b59b8a7c9399176d1f199e392972fd05ae65ad8f10d5ccfeca155a476a449e61360d68218175b2f5e75ea1ab8fb605474dc35a3d81a4ad8d36118a6dadbf3dcd873bdeebe906c30a834fecfad44c7612260a7e160467d4639dd5201271bd41411f34ef4488661a0bd7580a97ef1691629fd0b71bdc9b37e816e4abe5535ce20446ac425fd09050d041b02e62cb96f0dc428d22205c985a1e80ca246ae92209d7a136d1572b717bd98a9acc37b8853dbc5fb599d53785aae509c2ab918a5672135a5b605443443d630342c8021216519f90178ce5522cb033e313107a993b4198640b1c140fb6cfa788c5d8977704eacc6451ce8af0b8d614a073c08287fb15aa03a4bd6a7ea964a8bb318b4d3b9f7ce5d62d566a5121679df87cbd3c709bec7fa96f5ae7d9a992c40bfb56ba15bc3a9a412564b61d8263992b87d35c5c901c4541b2c0f1322635f0df0e30717e3c3de8aeb976c74f944aece9f37bc02efa2000c02c366e8bd572294367fedebdeaacfee8f2c9257d6ab65c6c1601194b1a25f9138891068e0f25dbe6d83e599806c862ec2853adda7caf1c0ee555b64c15bddb41830d27aba91aeeed3148efe5674bb1aa25ca6d2102ff8bf287da02f0d9486e700c5e038aa94cceae142a79c2b9ce43141809bdcdabbee6d9c526546afc807ca728264ab61c6c7bc8c35810863f6fb468bbe0a2077ad7492335fc7a798e5de5b6bcfb99e9232064dbd61255918ec92e48bf100bc0ac686716aa69118139a46fb2618ef45bda4fa2950efdb409622efe6751e9801c290cfa6f688b3f4652ddfb75d47e8f5cfcdb0ba0047ec949a029309e6b2a4f8184948e4f5441bdff737de38439361a5056f16a06882c95332c0fce666dbb573448d44c4e9dbf59235c5bd2fc51244a9b20609dbb0dc180cf405163cc7dc612bb2b9c6bed7145ec18d5d45faebb144ca4ad87326bfbd029f2c237e3e5cfa9118f801cb8b40d53ba9d36b85ae6896a42c34b0ed6e40d2fb919924be83f27283a9ec29153a34a097dd6b4ce14ef5667da5e1e7c00a6f827f1eb6bc8d2f9d95882d3002afd45fd3e3142801710eb4a030c23835451e3ff6db50fb73abd9b5092331f84082a3777779cbc13921389b913634ffe0f7ba9eebc7b37d2c934874f46d1111c1e22b5b57986ff5b0a92f98365f936dbd095c038000234211f325d446f7f4833018b8f6096f6b45f4a2ce55bc598f8e63d5fbfdaa18d5d6c695400ea93873bc7e4e9d6c3c49d212f9bb92dc1558500d71ce047a557d5056de69d08610731dd0ec98c159e6a1e20db9593269d6f0838e11c7b6a2de2b41846be8319157263d0ff8a6125d7bc0f2412c308102c3e24e701a95010a2ec01954a35a15dafbed7ad79a77aece5166ac34f9b5f60c03da639c49e783be1a3a184af27aa4d32f442470d3a8af5fcbe7417a9371a560700f42bfdff082e8edd23a89e31b136a5a7340f131f46d9bdf26e8e5815aab9f9541cec5c42b64e51f14a567a56a63b8376d10efed4e930d0431767b85f706cad89fced8d87d6f60dd60fc65f0f634eda257d740e24f3cbbcb289809216d5ef58de489278a7dd5191c638857d8d92dbf5578635615d540a18fc22b701cc1bb59fdeff617b6a89f8c487de0f502e030b174161be1dd17c58c2d49e27e3696c6186e0543eb81a69808457a3ce4a1c33fe40ece08cdd7f6bcfbbebd237962a42bc4f2fd2bac25990f9527cff2b33d13975cb73727dcb4df7fdd00c1f6de12d220271fa4a080e076278be75d5ab24a357dd36e2e8d1d6208be971cdbc7768fec665518fa8efce3fa676d626a1465f9d2cd9ff18807438a6b31572397a5a60f9184aa0e86a7f1de9f343f9771bf0da3054d1e223f2df7dbff5f057dfc80f249f460ca35dc4ff7b0f8be168c22e73208b5949b5206d0d187addd4344f288fdd7ffaad51e648f0c86008e32961b230cb4fa226819bfddcaaa2df54d93e724c1791074bff58978444dcf742b69424058036535b0c60f00b7fae203f725b772909e317867100884d8ea391b458c518cf3715c6a0c0f63887303399da278b0c031867018fc3d9d5d6ca2d2f466139493e90ea3b2d5fd65baaafbc2054bdffae1ec6ed0f0acb5074498aab95ad45a5017d448e259319b3d758d18a2cf0d2cc96b130c7c9f53c3f2bd9ee419ab9cc35e5f335ec07dbe7c550987a3f658e22d55ab40957ad4918240f922d98c755f183deb4801246c7f98895d41688d6e86a644a5b8c39a1251f986db77de5ebd7a3f9646726dedc7900e5a4c22a05f5789fdcd9d7ba4ae1504ab95c5b0c10995cb157f7b6c19ea6a05485e56c101f49b6e597f00a467609ab8a9e784a2f50e121462394fca2cddc8ab2d06796692e1dd785cdfbdc54f0a2f0e5095e8d9356942e057211d6386d21f1bbfe748662826f5e66d255aad61d051f8f1998a12f0d953ba050008980ab4306e75a1f37241e27483293f04b0abcafdb0c4f37d71529a4f4dc8bfefe3cc9e8164c3d0e821b06f46871d3ccf4e6b0efac836de28f633b1ab148869ad0dd64c61ad22ccbf9495a015695ae6d8c2d88a8470bca7012e20b28b7fb12008e9542dd78bc8a91cae02586976200e1cfe1b214c8c2439093eb78f1855e300f6f0ee406d807f86a33e7f9df5da55070cd55fd343df8a9d56301d07cdbaf31132964d714d078db2d9501bf260b962ba258afe9e95798bef4f3560363432df188da4a9b57ebcf7d7de60a255149010e22c98be8ca7fd887cfe2a5e50f7699b4312c67ae4a5821421676f8613ad87d2e01ff46331a83d804ff4cf67b7598c0190310fa883386ab7ce633440e527e7a129c281a87e7426f8ede54142b50dddc569970715e07bc4c0c4ab7753559174053a508d154506926d47a9d25bcbb4d3d8aa3041aad61b0a2bbf512b30d15423c4489a347def489e4b80386266890728feeecfe7668a5f81d67651fdf126fe6a79930d76b944d98c920c42c7675c2cc3c738e364e07452e7c999c622e1879d451f4e14036d8e9431733c2587572b39b839b53b6b95dd92bf359324fa2675eafb109f52c8112103d04886d5b2dc915279f74e0326ae6a1e2d02e931b8c2cfbcda7685d1503ebc067743d24fbdbf60cf542656559986861db657d59f9e8ab6d9f53738beb67590e85117dad128791cdec2064d4c38dfcd36f09bd610f5c30325b20c0235986f423be2523c71594352f98920f1f4ef5f702aa12c725477221f2d69bc832ee71245efcb59a89ee1e19635e995229ed7603460c57ab6aed1f950b122f833589111fbce0ca3b5d24205838b5924cde1a4e9ae5ebe3f3ef27a44db0d3067029e7ab1633b247553e7a4974074c62a6977da153aa99d5d7b2ef236ade34a0096864e73db3c89c6f190f9d48c9b26aecd5beb4fce3bb7fe32d1ba286c95949f117713f61a4d4e6736c245adb2f49b1b1988a6f5e8adcb7a6534d70a45077387134c1f47faf742660c27e948db259fdb6d75bf91ac3c85fde611ce5ab43a255b332cb46dca66a754ae05bca65771cd076acf0c28c3987603f12aed1bd9d5417d2cd84ad77446c2e0eb0b712bf73505cb99a7df4deeff"}) listen(r0, 0xfc0004) setsockopt$inet_sctp6_SCTP_EVENTS(0xffffffffffffffff, 0x84, 0xb, &(0x7f0000000440)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xf4}, 0xb) ppoll(&(0x7f0000000240)=[{}, {r1}, {r2}], 0x3, &(0x7f0000000340), &(0x7f0000000380), 0x8) 13:29:35 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000007000)={0x0, 0x0, &(0x7f0000000140), 0x0, 0x0, &(0x7f00000001c0)}) r2 = dup2(r1, r0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000002c0)={0x8, 0x0, &(0x7f00000000c0)=[@release], 0x0, 0x0, &(0x7f0000000300)}) 13:29:35 executing program 5: socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup3(r1, r0, 0x80000) ioctl$RNDADDENTROPY(r2, 0x40085203, &(0x7f0000000580)={0x10000, 0x1000, "80136d5de7c0e8ec0390f3f05e8d9b16a3dfe437135596b912f68779447a00bd033c7d361dbb6130dab7616c3d6b442b59982908fe39dca556f7cc948506c0ac0c0576082012a0b0492ffd2ac213d52bae6aab5c73562365cb0aeee6cf70691589147e062cfd21fc4b640773cfce6af1cf4108f6409975eb3a6fd0e1213813441faaca32f5a30eebf8c0e118aaac6872b1fdcc679971b227ce440d9561fe166724ec899bf6ad49d786f6a7ae1efc62350d3f019397a73335c4c7674b821b9a12ec9cb1907dfcfea9fb11a7429ad5a2bef2bd21f9262a8316772208e628e8b73f76f6810dbf0f7dd1ab6107606dfdd51ecce69a59a55c9b77708f5aefeef95cc7f2c8dc9bcdf49996dc62403b63ff29466e52ba0d2fa1999e3d6d8b00cab153e84c642ce5aa3b8617d35b754c792fae2106d984a1a1cabf9a99e63d001a0dad9e686cc073d1cec0848e05e58f26be944965e939986d8e28edd54a0d79aa45182c2206473eba8ba48b2b144be271ee769bd128477b6e5a39d5b731d5e02fe4359778f051a112152193a0bcf53a06ad1d51f5a9dec3849bbfccacf398ca4e937276c29dcd2faf1b2b4b4f79ebde7b9a481cddc6c5f9e07502465c445cda8c8c59c3c997d969c38b3ec6c47abc024441c607b18faa1c437ab5843d70aee936df2b72df87a37241944f7a7ffe330d4263b3ee5c3b5bc51369c767628bec9621749dd0af93b1e3502b64b08c7c955125648b02a107a89566289a9e0bf16c9a307d1659aabc3f078c3174974490bbe47c9d10065e1f976ea4eb7c285f332210c8b3199e098ea8fe354cb7d184aa51fc0d29cfd201426ee81d0e6b1d646b0c3cd60b63155cd3462159557a2c7dc83a6b07465cbb0c073d5a945045b782b28e8f5d72ac79d74f5e6537cf8b148d199e134b73108f30a1f84fdaefbb788b6c507a41c65929566cb1fed6254b08fba91d5add23be20e16df94085d281f7563e5fbb4fe5b0d2315bcdf1f602724daa63b82ba9f77e2804d28e1a0238767836955cdd3b5886e6b17cc2a0c05265ad441e8959969e52dd70acee3ce4f4bc1ebf8d94950c59cbd8dae6d652725d404e5d093a0a9283aaab0fb127488b84612977f3c8176cbf76779f5297259164d196afb234076fd23c0816ccb565321047ebb94d76e4cc34dc86fcdf2d577e21bd27896794900d9ed1e584a3e84d5bd1c32860df9a3ff56af0c19bddde3bdcb6a5477fa4a7703bff51d16717e075c2f3f4b89909c9041c5a2fa81f38ede8961a681912f7fe08be0b93b3535cf1002ff66924faca19b920f91278fcf014ca1d9a734a7e71fc7739d50fbe128f041f8dff1221520823c8a0f550e12728abb4cc2a5dac0ba121d0aac58082fb78d63b4b30d7297f7f44e710df8ef6195573a02f24cc16352bd0628a58a97b909040463c7f1e12a1dce9d7ec0815147b3ddc9e580f400c97aa6b0f2f5575a89f9fdfb7c775a39d92b9e4c797ec477343e81aead4c94a26a434f50c5933c72807496fdba046e80f065e9c6ae69b451c90b93ef6fa828bc7eaed5bb948802239c258a441c045881fb376fdb604aa6e817935873879c0814fa4f630bfa4816c91c9437244647655b139ec3fd7ee5259fc8ea61f6da7378a394855ed46a22d618dc8b7a791d31243c74d3508c7bbd8aa9d42fb5b264ce6c7eecf4cc727e2efcc14bb6bd832d989b8d7b58aadd2839ceb6c9259b05e74072b8fea8d742b0ffcb15ce96583400411e1df5e9a317f43563f58d159dd0e0ad64564431e93905b206ebe9712a54e8feb9c578385a61228e381ffe7418f166c888719bcbe37c7fbab29f681747e6170da06964af665baf5e027a6036c91d6b939c24d014ae58ebe15154c46d1031d224a4280bc00113065df1a79a5c9ea302d05f42d2e90b732083979b5c97ff622ebb7a04a547e8267131359fc2099aa179e0193e629ee819039ae567e33a07e12bddbe9f9426c0e9d7f1af80be4606904a9360c05636df4aea92a5a6fc8430c527dee224486bf3aba7a7fb45d6df50e25b2913acd2ee1c515658cbd2e412a49b7f70f0f28cd698bbd91d2b167f199a6b4e87fd0387c5cfae9d2d46e528472cf735168c0c599b49291853ea5d195d64e195a6d2bf4d75da2f08ad60a92b5c35a0d0473fb402f5dd7b3896e996bafacdcc3e903351bc97ffddfe838a2948fec601c157ea9da22e087d7bd4c8c501f2d284a8ccd8712386cc70f807662221fdaa7dc06906342cd4532f66d4d0b2fa2ba723341ee6077ac8d629c890e5baa09e51026af4b18950a1768a43b1e4df4f2a51d4e322bc337f5c08eb2bd88bbf89cff50728c429e269f0eb5187d812299674e8b52dc08028d2d387967d046430055543b094a9145136300d8db49ee47eb28073907d409b60c32e279823b9cb976b51236ce6b3bb0ee432c97cac0d40e3664c863c277785fb31efd28303efd647aaa64de0b2b3e300a24bb33e83b2bd1fcf8a3df76aadca1091b86fa34bee6cc6e883d67222c9d357829df245dc835744c8d11eaa7f3cc61cb8cf684baa3558254d687deb64ca1dbeaa57651807bd3a434ed3f4bd523410e9467960b96d46ea975b5a26d2d5c6dade5ac69eb0a66bfcf347cfce8b1b34bf5a66060d58e16dc0ca3414809021ede46e4fd529f8a800a0d43eb98fb7cae3665d45441de644f6414cf6971078d2938c10e2e5a7b8392e42fbf642dd509ac4f8f9f71859c742d93cd686b6a6bad9d1e89bf8e3f69de47ebc0e8c93f84680f3fbe73a41b32e114c3a4106a1e2925be74530a8bb44a8c969499d910602ad5d0ff21dadcc4bcd178165241d7e3db209e6172a11f2d9ba84a370948db1368874138439378196add13969a9a3f05f55d65cd2128c8554175b372443a6396621ab3676a635aeef58aea8663b576d6c8e1b702f52f3418b4158c55bc73ee7d3bc7351dd95846a0602455ea2528a7bcb39d3de406a848fa2791d5793f3e4b04bcc89a886285434f5a76e1705184f7d609ed25af8b240338145ffcb047bb4f1d0bf20653f90f63fa3288c3239e9c304cb411fb571187b5db199bb0dcb534fc92bc935bb04bfa7af66afbf9f5074f9a0c0adc9a10925de5a47b09c239c27023dd9dad9cfd96354cf0dbf2eca395c9cdda6533b427d4c98a0cbf6dff62b797b6876d5b5081ac48ca19670715528c35d860d2b7176e25c1e992dc39529bb0b98f6235b728a1ef9fda99946cee8e375f9c161cb319864ca79350f4b4cc5a81c3a1790cca671bd9530b42d87c116de9fa4c9a65cd556456ae90f1b8b65ef8bdc87dd999405a16b6142d5d48f213f0d067d8cd8867056527fe147a899c5026e61ecc86325d7adfed212e422fe578a2e7c87bb326e966d0008b6568ac22ab55bddf96e17efdba877a181b88f2b8b57e051d422dd45894e13d9f86b57bae5b67578cdc7b21d8520aeb791ec072ed0a59526bd66abf18010896f8646601d1bac829834b83bebd2890b6f3bebb3291e6cedc03b82ce0bb8ce3e19388ec7b5bfcfae68162c957146a1afc290a69710fd214312108bd1497941290daa3459dfaeb4512f162ad6a7e06a70e974685070acc20041b23fb10d2d6b1607dde4377dc57af76019e207f2cf3d8faf0c2c6320877706bebe2cb9ecb3eba25650855cf6f10aa46f95a767035cc773e33724cc331cdb03a94ab59fa38a1ccb8d641c805932a1d39ab7b4154c99f49f99f177e579d32eac02624c2e4982a9b08b67770b8e358bcdc4b5edecdd951d1345a7a5af297a80e0a33b55fc33500afb6ae30d09e7f0d72f2f39a7ef509766e3a8440e6d9d0988190ff488f195fbd59b23473455247674a989e6f93325aa0638dd947bedce2410b4d215a5570e36db4b5ba2bd21a2f422d8a2b21c31fe60f86f2458eba753e7e9b9716cd17db526b7ba1b104240521ec87482eb3c4516f47df0c0bd10e4097eff394acfd6c8a058e9905f33bc18fc9438f9027f9c1a9add06ce7ad6db935647fec7844dc04543453c8a185fd8234316b2e0721735026ee4deb03f07f6f5ce4c19de01e5a2d2d88a4f23828c54f8515cc7d6acaf7e11023d9906c926fd634f421617cd5c298f56e50ebf08df00c3223f8b4ae629f308c4bb304ee13f950ecc95041b728e6c4ab233da77fc44c3311518f66d7880d4fa01e4bb6c4e30c78c3b270ddd9cbc123e5fa6e9d6d4efec98229f77fa05d867bed933faa7be077a22bcae94e121451957c982aa1eff341f4e08737ffeae403d8532a6be8ccd1431e8ad0ad474bcd59f51cb3c84c2578fa0968d0a6d6277392eff02e5c57f5bf727611107b3ef21f9873dd5278ddd87071d2dffb601977e02fbc2ab295458cc3af6e5376971f924853d97d3590b2ff6f99e815325e666edb0e3318be4e4ff1acee6e9207469d5010df87e7bb01ddc6a7351c69482ad38f42ccc5ac3430b2897eaecd595236d0998dc507b4e6d5390e4ad5e7b28ba398631bf642c4e8464adbb3532215a99463a0902d3efbcb06d96af669c8bffd74963b129f57fa789a7cdaf2100f65de02cafa82e1088742eb038d05ab110bedcfa989550c16ec8544673d85cc5666b514b8a5c41f6a13182e4861f3512f868387c69a71f21f6ecd695efc694e348b89964233a043c70e54da2197fca1e19d9842a03ae64b4eff922202d1665fd4d9005236d67003ac4fae880f8b6805c4bd785a14dc61b2cbcd7eb506b71f2e4db42107ae3bd136a09f98664a00b895ca9d95a3214ab40c72c08cbb82f88d290f2794cdf57d3bf3ea85843af001f5d0f48f7e8e8ecb03d530f72e9b0de897b576b3593bbe7f8daf56ca3bce35a6c53f3d969ce1c6f8924e6eb58453bce67b040a4b32781cdd3f1f4a7717b0e8cfd935885480d89c8513e0542d49b60ac9e966c5ad809a55b4953fcddf9f6bd2a4a0419625325c6c94f263f22c60d35795fcdbe0062d4f4c7e4bed01843d7034f52e91fe795e69c21a44f5abb6c61d1d5c5a433df9d6c53eef81369e42ac74e922489d5f851aef6dcb41f0e3e5590b9e05a37464930d761c6bfb0931496e308f51cf2fe1fed17ff2935cebf13f8f5803f0030b308fa7c76c282ef62e63f81fa4f9f9130fd5ec20f2923faa89cb0a80321b44d7209a4bdcefeea4aa282689d9e1fbf29692e0cd6bf569102be418e2dc2fb0736be1040bbc81ad6476b2826f0c737d596995711472b29eaf49da0960815af9553393b32dbb740f4c6ccba44537522c80641a3daa98e6f8ec733809c667a194be47c88f9b1d28ad649bc70f2e267cb2ff05d00dd7542a97815beb020f51f451526d9be95b03f5f959fa17d9019ae1a26be38e6ba9c5b367758eb1e9cb874ce74851a6a80ec20a534783f177bda08714c522033a6d6c00508ed83017dd284fdb3357023e87e5eaefac497726d15d98a3b1b5805163b7ff717811f6b68dd66d141d269696128924b7b3c7fe096dd7b9f7413292b4166d62de1b4d65fccd571b0e472e9e996b2e5393d606b8dda52c172ebd2574b8dcec17d53af3a9ba488baa475ac67093320441656dbc7b92a1f16898b638295a5e1f99e2602f44303875c392aca71eb678c2ae84d44fe8726fab81138e1fd128574f06291bbf2c5860c72fe0568f8bae0ba01522ebd6f9bc44b6699764b2d7461d29e92c829592f5aa3b0f136875b9294996d3b747d82526d045f8ba91900337ca22fb8848c8af9c2cbe805ca7762fc0e4c5a3f287bf05c99ab357251dd1a52780ab471d339cb03a2dc769707a8bd083d5c22196905cb7cf82afcdf01dc97d349bf479dd53"}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r3 = memfd_create(&(0x7f0000000080)="70726f63ae6d696d655f74797065776c616e316e6f64657600", 0x6) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x2000003, 0x5011, r3, 0x0) r4 = accept4$inet(r3, &(0x7f0000000040)={0x2, 0x0, @multicast1}, &(0x7f0000000100)=0x10, 0x80000) getsockopt$inet_buf(r4, 0x0, 0x25, &(0x7f0000000140)=""/135, &(0x7f0000000200)=0x87) ioctl$SG_SCSI_RESET(r3, 0x2284, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000000)=[@text64={0x40, &(0x7f0000000500)="0f0866b8ed008ec066ba4000b000eed2a807000000410f01cab98e0b0000b862000000ba000000000f30b90b0800000f320fc72a8f2a60128f00000000003000000fc7aa00100000", 0x48}], 0x1, 0x0, &(0x7f0000000040), 0x0) 13:29:36 executing program 0: r0 = socket$inet(0x2, 0x4000000803, 0x4) bind$inet(r0, &(0x7f0000000000)={0x2, 0x0, @broadcast}, 0x10) getsockname(r0, &(0x7f00000036c0)=@xdp={0x2c, 0x0, 0x0}, &(0x7f0000000080)=0x80) setsockopt$inet_pktinfo(r0, 0x0, 0x8, &(0x7f0000003780)={r1, @rand_addr, @dev}, 0xc) syz_emit_ethernet(0x4a, &(0x7f0000000240)={@link_local, @empty=[0x0, 0x4000000], [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x3c, 0x0, 0x0, 0x0, 0x4, 0x0, @empty=0x9000000, @broadcast}, @udp={0x0, 0x0, 0x28}}}}}, &(0x7f0000000380)) 13:29:36 executing program 1: socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0xe1, 0x400100) creat(&(0x7f00000001c0)='./file0\x00', 0x2) openat$dsp(0xffffffffffffff9c, &(0x7f0000000200)='/dev/dsp\x00', 0x8000, 0x0) syz_open_dev$mouse(&(0x7f0000000240)='/dev/input/mouse#\x00', 0x100, 0x10000) r1 = syz_open_dev$amidi(&(0x7f0000000280)='/dev/amidi#\x00', 0x8000, 0xc0000) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) r3 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000007000)={0x8, 0x0, &(0x7f0000000140)=[@acquire], 0x0, 0x0, &(0x7f00000001c0)}) r4 = dup2(r3, r2) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f00000002c0)={0x8, 0x0, &(0x7f00000000c0)=[@release], 0x0, 0x0, &(0x7f0000000300)}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x80000001f) ioctl$SCSI_IOCTL_GET_BUS_NUMBER(r1, 0x5386, &(0x7f0000000380)) r5 = memfd_create(&(0x7f0000000080)="70726f63ae6d696d655f74797065776c616e316e6f64657600", 0x6) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x2000003, 0x5011, r5, 0x0) ioctl$TIOCGSID(r5, 0x5429, &(0x7f0000000300)=0x0) ioctl$sock_FIOSETOWN(r0, 0x8901, &(0x7f0000000340)=r6) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000000)=[@text64={0x40, &(0x7f0000000500)="0f0866b8ed008ec066ba4000b000eed2a807000000410f01cab98e0b0000b862000000ba000000000f30b90b0800000f320fc72a8f2a60128f00000000003000000fc7aa00100000", 0x48}], 0x1, 0x0, &(0x7f0000000040), 0x0) 13:29:36 executing program 3: r0 = socket$inet(0xa, 0x801, 0x84) connect$inet(r0, &(0x7f0000000180)={0x2, 0x4e21, @remote={0xac, 0x14, 0xffffffffffffffff}}, 0x10) socketpair$unix(0x1, 0x4, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) listen(r0, 0xfc0004) r3 = accept4(r0, &(0x7f0000000000)=@ethernet={0x0, @local}, &(0x7f0000000040)=0x10, 0x0) setsockopt$inet_sctp6_SCTP_EVENTS(r3, 0x84, 0xb, &(0x7f0000000440)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xf4}, 0xb) ppoll(&(0x7f0000000240)=[{r3}, {r1}, {r2}], 0x3, &(0x7f0000000340), &(0x7f0000000380), 0x8) 13:29:36 executing program 4: preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f00000000c0)=""/148, 0x94}], 0x1, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000080)='io\x00') preadv(r0, &(0x7f0000000480), 0x1000000000000288, 0x0) [ 534.797842] binder: 25527:25533 Release 1 refcount change on invalid ref 0 ret -22 13:29:36 executing program 5: socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) memfd_create(&(0x7f0000000080)="70726f63ae6d696d655f74797065776c616e316e6f64657600", 0x6) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x2000003, 0x5011, r0, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000000)=[@text64={0x40, &(0x7f0000000500)="0f0866b8ed008ec066ba4000b000eed2a807000000410f01cab98e0b0000b862000000ba000000000f30b90b0800000f320fc72a8f2a60128f00000000003000000fc7aa00100000", 0x48}], 0x1, 0x0, &(0x7f0000000040), 0x0) 13:29:36 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000007000)={0x8, 0x0, &(0x7f0000000140)=[@acquire], 0x0, 0x0, &(0x7f00000001c0)}) r2 = dup2(0xffffffffffffffff, r0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000002c0)={0x8, 0x0, &(0x7f00000000c0)=[@release], 0x0, 0x0, &(0x7f0000000300)}) 13:29:36 executing program 0: r0 = socket$inet(0x2, 0x4000000803, 0x4) bind$inet(r0, &(0x7f0000000000)={0x2, 0x0, @broadcast}, 0x10) getsockname(r0, &(0x7f00000036c0)=@xdp={0x2c, 0x0, 0x0}, &(0x7f0000000080)=0x80) setsockopt$inet_pktinfo(r0, 0x0, 0x8, &(0x7f0000003780)={r1, @rand_addr, @dev}, 0xc) syz_emit_ethernet(0x4a, &(0x7f0000000240)={@link_local, @empty=[0x0, 0x86ddffff], [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x3c, 0x0, 0x0, 0x0, 0x4, 0x0, @empty=0x9000000, @broadcast}, @udp={0x0, 0x0, 0x28}}}}}, &(0x7f0000000380)) 13:29:36 executing program 3: r0 = socket$inet(0xa, 0x801, 0x84) connect$inet(r0, &(0x7f0000000180)={0x2, 0x4e21, @remote={0xac, 0x14, 0xffffffffffffffff}}, 0x10) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) listen(r0, 0xfc0004) r3 = accept4(r0, &(0x7f00000000c0)=@ethernet={0x0, @local}, &(0x7f0000000140)=0x80, 0x0) setsockopt$inet_sctp6_SCTP_EVENTS(r3, 0x84, 0xb, &(0x7f0000000440)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xf4}, 0xb) ppoll(&(0x7f0000000240)=[{r3}, {r1}, {r2}], 0x3, &(0x7f0000000340), &(0x7f0000000380), 0x8) fcntl$setflags(r1, 0x2, 0x1) 13:29:36 executing program 4: preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f00000000c0)=""/148, 0x94}], 0x1, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000080)='io\x00') preadv(r0, &(0x7f0000000480), 0x100000000000023a, 0x0) 13:29:36 executing program 5: socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x4001fc) r1 = memfd_create(&(0x7f0000000080)="70726f63ae6d696d655f74797065776c616e316e6f64657600", 0x6) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x2000003, 0x5011, r1, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000000)=[@text64={0x40, &(0x7f0000000500)="0f0866b8ed008ec066ba4000b000eed2a807000000410f01cab98e0b0000b862000000ba000000000f30b90b0800000f320fc72a8f2a60128f00000000003000000fc7aa00100000", 0x48}], 0x1, 0x0, &(0x7f0000000040), 0x0) 13:29:36 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000007000)={0x8, 0x0, &(0x7f0000000140)=[@acquire], 0x0, 0x0, &(0x7f00000001c0)}) r2 = dup2(r1, 0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000002c0)={0x8, 0x0, &(0x7f00000000c0)=[@release], 0x0, 0x0, &(0x7f0000000300)}) 13:29:36 executing program 0: r0 = socket$inet(0x2, 0x4000000803, 0x4) bind$inet(r0, &(0x7f0000000000)={0x2, 0x0, @broadcast}, 0x10) getsockname(r0, &(0x7f00000036c0)=@xdp={0x2c, 0x0, 0x0}, &(0x7f0000000080)=0x80) setsockopt$inet_pktinfo(r0, 0x0, 0x8, &(0x7f0000003780)={r1, @rand_addr, @dev}, 0xc) syz_emit_ethernet(0x4a, &(0x7f0000000240)={@link_local, @empty=[0x0, 0xf4010000], [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x3c, 0x0, 0x0, 0x0, 0x4, 0x0, @empty=0x9000000, @broadcast}, @udp={0x0, 0x0, 0x28}}}}}, &(0x7f0000000380)) 13:29:36 executing program 1: socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0xe1, 0x400100) creat(&(0x7f00000001c0)='./file0\x00', 0x2) openat$dsp(0xffffffffffffff9c, &(0x7f0000000200)='/dev/dsp\x00', 0x8000, 0x0) syz_open_dev$mouse(&(0x7f0000000240)='/dev/input/mouse#\x00', 0x100, 0x10000) r1 = syz_open_dev$amidi(&(0x7f0000000280)='/dev/amidi#\x00', 0x8000, 0xc0000) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) r3 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000007000)={0x8, 0x0, &(0x7f0000000140)=[@acquire], 0x0, 0x0, &(0x7f00000001c0)}) r4 = dup2(r3, r2) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f00000002c0)={0x8, 0x0, &(0x7f00000000c0)=[@release], 0x0, 0x0, &(0x7f0000000300)}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x80000001f) ioctl$SCSI_IOCTL_GET_BUS_NUMBER(r1, 0x5386, &(0x7f0000000380)) r5 = memfd_create(&(0x7f0000000080)="70726f63ae6d696d655f74797065776c616e316e6f64657600", 0x6) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x2000003, 0x5011, r5, 0x0) ioctl$TIOCGSID(r5, 0x5429, &(0x7f0000000300)=0x0) ioctl$sock_FIOSETOWN(r0, 0x8901, &(0x7f0000000340)=r6) 13:29:36 executing program 3: r0 = socket$inet(0xa, 0x801, 0x84) connect$inet(r0, &(0x7f0000000180)={0x2, 0x4e21, @remote={0xac, 0x14, 0xffffffffffffffff}}, 0x10) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) symlink(&(0x7f00000000c0)='./file0\x00', &(0x7f0000000100)='./file0\x00') listen(r0, 0xfc0004) r3 = accept4(r0, &(0x7f0000000000)=@ethernet={0x0, @local}, &(0x7f0000000040)=0x10, 0x0) setsockopt$inet_sctp6_SCTP_EVENTS(r3, 0x84, 0xb, &(0x7f0000000440)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xf4}, 0xb) ppoll(&(0x7f0000000240)=[{r3}, {r1}, {r2}], 0x3, &(0x7f0000000340), &(0x7f0000000380), 0x8) 13:29:36 executing program 4: preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f00000000c0)=""/148, 0x94}], 0x1, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000080)='io\x00') preadv(r0, &(0x7f0000000480), 0x100000000000017c, 0x0) [ 535.297572] binder: BINDER_SET_CONTEXT_MGR already set [ 535.310238] binder: 25575:25581 ioctl 40046207 0 returned -16 [ 535.333865] binder: 25575:25581 Acquire 1 refcount change on invalid ref 0 ret -22 13:29:36 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000007000)={0x8, 0x0, &(0x7f0000000140)=[@acquire], 0x0, 0x0, &(0x7f00000001c0)}) dup2(r1, r0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f00000002c0)={0x8, 0x0, &(0x7f00000000c0)=[@release], 0x0, 0x0, &(0x7f0000000300)}) 13:29:36 executing program 5: socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = memfd_create(&(0x7f0000000080)="70726f63ae6d696d655f74797065776c616e316e6f64657600", 0x6) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000100)={0x0, r2, 0x0, 0xc, &(0x7f0000000040)='-$mime_type\x00', 0xffffffffffffffff}, 0x30) ioctl$TIOCSPGRP(r0, 0x5410, &(0x7f0000000140)=r3) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x2000003, 0x5011, r2, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000000)=[@text64={0x40, &(0x7f0000000500)="0f0866b8ed008ec066ba4000b000eed2a807000000410f01cab98e0b0000b862000000ba000000000f30b90b0800000f320fc72a8f2a60128f00000000003000000fc7aa00100000", 0x48}], 0x1, 0x0, &(0x7f0000000040), 0x0) 13:29:36 executing program 0: r0 = socket$inet(0x2, 0x4000000803, 0x4) bind$inet(r0, &(0x7f0000000000)={0x2, 0x0, @broadcast}, 0x10) getsockname(r0, &(0x7f00000036c0)=@xdp={0x2c, 0x0, 0x0}, &(0x7f0000000080)=0x80) setsockopt$inet_pktinfo(r0, 0x0, 0x8, &(0x7f0000003780)={r1, @rand_addr, @dev}, 0xc) syz_emit_ethernet(0x4a, &(0x7f0000000240)={@link_local, @empty=[0x0, 0x2000000], [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x3c, 0x0, 0x0, 0x0, 0x4, 0x0, @empty=0x9000000, @broadcast}, @udp={0x0, 0x0, 0x28}}}}}, &(0x7f0000000380)) [ 535.357563] binder: 25575:25581 Release 1 refcount change on invalid ref 0 ret -22 13:29:36 executing program 1: socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0xe1, 0x400100) creat(&(0x7f00000001c0)='./file0\x00', 0x2) openat$dsp(0xffffffffffffff9c, &(0x7f0000000200)='/dev/dsp\x00', 0x8000, 0x0) syz_open_dev$mouse(&(0x7f0000000240)='/dev/input/mouse#\x00', 0x100, 0x10000) r1 = syz_open_dev$amidi(&(0x7f0000000280)='/dev/amidi#\x00', 0x8000, 0xc0000) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) r3 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000007000)={0x8, 0x0, &(0x7f0000000140)=[@acquire], 0x0, 0x0, &(0x7f00000001c0)}) r4 = dup2(r3, r2) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f00000002c0)={0x8, 0x0, &(0x7f00000000c0)=[@release], 0x0, 0x0, &(0x7f0000000300)}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x80000001f) ioctl$SCSI_IOCTL_GET_BUS_NUMBER(r1, 0x5386, &(0x7f0000000380)) r5 = memfd_create(&(0x7f0000000080)="70726f63ae6d696d655f74797065776c616e316e6f64657600", 0x6) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x2000003, 0x5011, r5, 0x0) ioctl$TIOCGSID(r5, 0x5429, &(0x7f0000000300)=0x0) ioctl$sock_FIOSETOWN(r0, 0x8901, &(0x7f0000000340)=r6) 13:29:36 executing program 4: preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f00000000c0)=""/148, 0x94}], 0x1, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000080)='io\x00') preadv(r0, &(0x7f0000000480), 0x10000000000000f6, 0x0) 13:29:36 executing program 3: r0 = socket$inet(0xa, 0x801, 0x84) connect$inet(r0, &(0x7f0000000180)={0x2, 0x4e21, @remote={0xac, 0x14, 0xffffffffffffffff}}, 0x10) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) listen(r0, 0xfc0004) r3 = accept4(r0, &(0x7f0000000000)=@ethernet={0x0, @local}, &(0x7f0000000040)=0x10, 0x0) setsockopt$inet_sctp6_SCTP_EVENTS(r3, 0x84, 0xb, &(0x7f0000000440)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xf4}, 0xb) ppoll(&(0x7f0000000240)=[{r3}, {r1}, {r2}], 0x3, &(0x7f0000000340), &(0x7f0000000380), 0x8) getsockopt$inet_sctp6_SCTP_GET_ASSOC_STATS(r3, 0x84, 0x70, &(0x7f0000000480)={0x0, @in6={{0xa, 0x4e20, 0x5, @loopback, 0x9}}, [0x8, 0x389c00000000000, 0x2, 0xf18f, 0x7f, 0x5, 0x0, 0x86dc, 0xed95, 0x5, 0x2, 0x44000000, 0xee, 0x7f, 0x8001]}, &(0x7f00000000c0)=0x100) setsockopt$inet_sctp6_SCTP_AUTH_ACTIVE_KEY(r3, 0x84, 0x18, &(0x7f0000000100)={r4, 0x101}, 0x8) 13:29:36 executing program 5: socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x2000003, 0x5011, 0xffffffffffffffff, 0x0) ioctl$PIO_FONTRESET(0xffffffffffffffff, 0x4b6d, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000000)=[@text64={0x40, &(0x7f0000000500)="0f0866b8ed008ec066ba4000b000eed2a807000000410f01cab98e0b0000b862000000ba000000000f30b90b0800000f320fc72a8f2a60128f00000000003000000fc7aa00100000", 0x48}], 0x1, 0x0, &(0x7f0000000040), 0x0) 13:29:36 executing program 0: r0 = socket$inet(0x2, 0x4000000803, 0x4) bind$inet(r0, &(0x7f0000000000)={0x2, 0x0, @broadcast}, 0x10) getsockname(r0, &(0x7f00000036c0)=@xdp={0x2c, 0x0, 0x0}, &(0x7f0000000080)=0x80) setsockopt$inet_pktinfo(r0, 0x0, 0x8, &(0x7f0000003780)={r1, @rand_addr, @dev}, 0xc) syz_emit_ethernet(0x4a, &(0x7f0000000240)={@link_local, @empty=[0x0, 0x6000], [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x3c, 0x0, 0x0, 0x0, 0x4, 0x0, @empty=0x9000000, @broadcast}, @udp={0x0, 0x0, 0x28}}}}}, &(0x7f0000000380)) 13:29:36 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000007000)={0x8, 0x0, &(0x7f0000000140)=[@acquire], 0x0, 0x0, &(0x7f00000001c0)}) r2 = dup2(r1, r0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000002c0)={0x0, 0x0, &(0x7f00000000c0), 0x0, 0x0, &(0x7f0000000300)}) 13:29:37 executing program 1: socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0xe1, 0x400100) creat(&(0x7f00000001c0)='./file0\x00', 0x2) openat$dsp(0xffffffffffffff9c, &(0x7f0000000200)='/dev/dsp\x00', 0x8000, 0x0) syz_open_dev$mouse(&(0x7f0000000240)='/dev/input/mouse#\x00', 0x100, 0x10000) r1 = syz_open_dev$amidi(&(0x7f0000000280)='/dev/amidi#\x00', 0x8000, 0xc0000) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) r3 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000007000)={0x8, 0x0, &(0x7f0000000140)=[@acquire], 0x0, 0x0, &(0x7f00000001c0)}) r4 = dup2(r3, r2) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f00000002c0)={0x8, 0x0, &(0x7f00000000c0)=[@release], 0x0, 0x0, &(0x7f0000000300)}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x80000001f) ioctl$SCSI_IOCTL_GET_BUS_NUMBER(r1, 0x5386, &(0x7f0000000380)) r5 = memfd_create(&(0x7f0000000080)="70726f63ae6d696d655f74797065776c616e316e6f64657600", 0x6) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x2000003, 0x5011, r5, 0x0) ioctl$TIOCGSID(r5, 0x5429, &(0x7f0000000300)) 13:29:37 executing program 4: preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f00000000c0)=""/148, 0x94}], 0x1, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000080)='io\x00') preadv(r0, &(0x7f0000000480), 0x100000000000003e, 0x0) 13:29:37 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000007000)={0x8, 0x0, &(0x7f0000000140)=[@acquire], 0x0, 0x0, &(0x7f00000001c0)}) r2 = dup2(r1, r0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000002c0)={0x0, 0x0, &(0x7f00000000c0), 0x0, 0x0, &(0x7f0000000300)}) 13:29:37 executing program 3: r0 = socket$inet(0xa, 0x801, 0x84) connect$inet(r0, &(0x7f0000000180)={0x2, 0x4e21, @remote={0xac, 0x14, 0xffffffffffffffff}}, 0x10) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = syz_open_dev$usb(&(0x7f0000000100)='/dev/bus/usb/00#/00#\x00', 0x9, 0x20000) ioctl$EVIOCGKEY(r3, 0x80404518, &(0x7f00000001c0)=""/73) listen(r0, 0xfc0004) ioctl$BLKFRASET(r3, 0x1264, &(0x7f0000000140)) r4 = accept4(r0, &(0x7f0000000000)=@ethernet={0x0, @local}, &(0x7f0000000040)=0x10, 0x0) setsockopt$inet_sctp6_SCTP_EVENTS(r4, 0x84, 0xb, &(0x7f0000000440)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xf4}, 0xb) setsockopt$bt_BT_FLUSHABLE(r4, 0x112, 0x8, &(0x7f00000000c0)=0x524, 0x4) ppoll(&(0x7f0000000240)=[{r4}, {r1}, {r2}], 0x3, &(0x7f0000000340), &(0x7f0000000380), 0x8) 13:29:37 executing program 0: r0 = socket$inet(0x2, 0x4000000803, 0x4) bind$inet(r0, &(0x7f0000000000)={0x2, 0x0, @broadcast}, 0x10) getsockname(r0, &(0x7f00000036c0)=@xdp={0x2c, 0x0, 0x0}, &(0x7f0000000080)=0x80) setsockopt$inet_pktinfo(r0, 0x0, 0x8, &(0x7f0000003780)={r1, @rand_addr, @dev}, 0xc) syz_emit_ethernet(0x4a, &(0x7f0000000240)={@link_local, @empty=[0x0, 0xd], [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x3c, 0x0, 0x0, 0x0, 0x4, 0x0, @empty=0x9000000, @broadcast}, @udp={0x0, 0x0, 0x28}}}}}, &(0x7f0000000380)) 13:29:37 executing program 5: socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = memfd_create(&(0x7f0000000080)="70726f63ae6d696d655f74797065776c616e316e6f64657600", 0x6) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x2000003, 0x5011, r1, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000000)=[@text64={0x40, &(0x7f0000000500)="0f0866b8ed008ec066ba4000b000eed2a807000000410f01cab98e0b0000b862000000ba000000000f30b90b0800000f320fc72a8f2a60128f00000000003000000fc7aa00100000", 0x48}], 0x1, 0x0, &(0x7f0000000040), 0x0) connect$inet(r1, &(0x7f0000000040)={0x2, 0x4e24, @multicast1}, 0x10) 13:29:37 executing program 4: preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f00000000c0)=""/148, 0x94}], 0x1, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000080)='io\x00') preadv(r0, &(0x7f0000000480), 0x1000000000000132, 0x0) [ 535.941596] binder: BINDER_SET_CONTEXT_MGR already set [ 535.968240] binder: 25634:25641 ioctl 40046207 0 returned -16 13:29:37 executing program 3: r0 = socket$inet(0xa, 0x801, 0x84) connect$inet(r0, &(0x7f0000000180)={0x2, 0x4e21, @remote={0xac, 0x14, 0xffffffffffffffff}}, 0x10) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) fcntl$F_GET_FILE_RW_HINT(r0, 0x40d, &(0x7f0000000200)) timer_create(0x0, &(0x7f0000000100)={0x0, 0xc, 0x1, @thr={&(0x7f00000000c0)="dfddbee99041d35024", &(0x7f0000000480)="f5cf3ff90db725634818ae05e8b6e8c3b243512cb8c24d612d6522b58a1e77d5aefa4efe02c8009da2545dbb7556c8e61cfa4af881a38703abd12f134a9b9f5158c180e246cc92d747da6f0e79f04dc3e92df49b891d1b5a22435681d52e50edeb883956acc52ab0d913515ffd9521eaaa41d9791277ac5dcbf4e07247d7a603a57b946cd1bb06af634917820a6532baec08d023a8b26c2604950c0ccf114adbc0b089dddbe293dd96d58f280d8652aa94dce04ef1d2febe56de272c6e9af40027c9dbf70d4631b0ae4c86e1dae0dca09a82ac380956d3fcebaa6587ac1aff5c7b91d8d9632917d84810aea407"}}, &(0x7f0000000140)=0x0) timer_gettime(r3, &(0x7f00000001c0)) listen(r0, 0xfc0004) r4 = accept4(r0, &(0x7f0000000000)=@ethernet={0x0, @local}, &(0x7f0000000040)=0x10, 0x0) setsockopt$inet_sctp6_SCTP_EVENTS(r4, 0x84, 0xb, &(0x7f0000000440)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xf4}, 0xb) ppoll(&(0x7f0000000240)=[{r4}, {r1}, {r2}], 0x3, &(0x7f0000000340), &(0x7f0000000380), 0x8) [ 536.003991] binder: 25634:25641 Acquire 1 refcount change on invalid ref 0 ret -22 13:29:37 executing program 1: socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0xe1, 0x400100) creat(&(0x7f00000001c0)='./file0\x00', 0x2) openat$dsp(0xffffffffffffff9c, &(0x7f0000000200)='/dev/dsp\x00', 0x8000, 0x0) syz_open_dev$mouse(&(0x7f0000000240)='/dev/input/mouse#\x00', 0x100, 0x10000) r1 = syz_open_dev$amidi(&(0x7f0000000280)='/dev/amidi#\x00', 0x8000, 0xc0000) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) r3 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000007000)={0x8, 0x0, &(0x7f0000000140)=[@acquire], 0x0, 0x0, &(0x7f00000001c0)}) r4 = dup2(r3, r2) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f00000002c0)={0x8, 0x0, &(0x7f00000000c0)=[@release], 0x0, 0x0, &(0x7f0000000300)}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x80000001f) ioctl$SCSI_IOCTL_GET_BUS_NUMBER(r1, 0x5386, &(0x7f0000000380)) r5 = memfd_create(&(0x7f0000000080)="70726f63ae6d696d655f74797065776c616e316e6f64657600", 0x6) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x2000003, 0x5011, r5, 0x0) ioctl$TIOCGSID(r5, 0x5429, &(0x7f0000000300)) 13:29:37 executing program 0: r0 = socket$inet(0x2, 0x4000000803, 0x4) bind$inet(r0, &(0x7f0000000000)={0x2, 0x0, @broadcast}, 0x10) getsockname(r0, &(0x7f00000036c0)=@xdp={0x2c, 0x0, 0x0}, &(0x7f0000000080)=0x80) setsockopt$inet_pktinfo(r0, 0x0, 0x8, &(0x7f0000003780)={r1, @rand_addr, @dev}, 0xc) syz_emit_ethernet(0x4a, &(0x7f0000000240)={@link_local, @empty=[0x0, 0xffffffff00000000], [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x3c, 0x0, 0x0, 0x0, 0x4, 0x0, @empty=0x9000000, @broadcast}, @udp={0x0, 0x0, 0x28}}}}}, &(0x7f0000000380)) 13:29:37 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000007000)={0x8, 0x0, &(0x7f0000000140)=[@acquire], 0x0, 0x0, &(0x7f00000001c0)}) r2 = dup2(r1, r0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000002c0)={0x0, 0x0, &(0x7f00000000c0), 0x0, 0x0, &(0x7f0000000300)}) 13:29:37 executing program 4: preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f00000000c0)=""/148, 0x94}], 0x1, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000080)='io\x00') preadv(r0, &(0x7f0000000480), 0x1000000000000091, 0x0) 13:29:37 executing program 5: socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000040)='/dev/sequencer\x00', 0x0, 0x0) ioctl$KDGKBTYPE(r1, 0x4b33, &(0x7f0000000100)) recvfrom(r0, &(0x7f0000000440)=""/11, 0xb, 0x10002, &(0x7f0000000480)=@ipx={0x4, 0x6, 0x876, "5d5b6677e2c9", 0x1}, 0x80) setsockopt$llc_int(r1, 0x10c, 0x400000000, &(0x7f0000000580)=0x5, 0xff14) r2 = memfd_create(&(0x7f0000000080)="70726f63ae6d696d655f74797065776c616e316e6f64657600", 0x6) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x2000003, 0x5011, r2, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000000)=[@text64={0x40, &(0x7f0000000500)="0f0866b8ed008ec066ba4000b000eed2a807000000410f01cab98e0b0000b862000000ba000000000f30b90b0800000f320fc72a8f2a60128f00000000003000000fc7aa00100000", 0x48}], 0x1, 0x0, &(0x7f0000000040), 0x0) getdents64(r1, &(0x7f0000000180)=""/193, 0xc1) r3 = syz_genetlink_get_family_id$ipvs(&(0x7f00000002c0)='IPVS\x00') ioctl$KDGETKEYCODE(r1, 0x4b4c, &(0x7f0000000140)={0x1, 0x2}) fsetxattr(r1, &(0x7f00000003c0)=@random={'osx.', 'trustedselinux\x00'}, &(0x7f0000000400)="70726f63ae6d696d655f74797065776c616e316e6f64657600", 0x19, 0x1) sendmsg$IPVS_CMD_GET_CONFIG(r2, &(0x7f0000000380)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f0000000340)={&(0x7f0000000300)={0x1c, r3, 0x1, 0x70bd2d, 0x25dfdbfc, {}, [@IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0xffffffffffffffff}]}, 0x1c}, 0x1, 0x0, 0x0, 0x8000}, 0x20000000) 13:29:37 executing program 3: r0 = socket$inet(0xa, 0x801, 0x84) connect$inet(r0, &(0x7f0000000180)={0x2, 0x4e21, @remote={0xac, 0x14, 0xffffffffffffffff}}, 0x10) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) openat$snapshot(0xffffffffffffff9c, &(0x7f0000000140)='/dev/snapshot\x00', 0x400002, 0x0) r3 = openat(0xffffffffffffffff, &(0x7f0000000100)='./file0\x00', 0xa00, 0x13) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0xfffffffeffffffff) listen(r0, 0xfc0004) r4 = accept4(r0, &(0x7f0000000000)=@ethernet={0x0, @local}, &(0x7f0000000040)=0x10, 0x0) setsockopt$inet_sctp6_SCTP_EVENTS(r4, 0x84, 0xb, &(0x7f0000000440)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xf4}, 0xb) ppoll(&(0x7f0000000240)=[{r4}, {r1}, {r2}], 0x3, &(0x7f0000000340), &(0x7f0000000380), 0x8) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) 13:29:37 executing program 0: r0 = socket$inet(0x2, 0x4000000803, 0x4) bind$inet(r0, &(0x7f0000000000)={0x2, 0x0, @broadcast}, 0x10) getsockname(r0, &(0x7f00000036c0)=@xdp={0x2c, 0x0, 0x0}, &(0x7f0000000080)=0x80) setsockopt$inet_pktinfo(r0, 0x0, 0x8, &(0x7f0000003780)={r1, @rand_addr, @dev}, 0xc) syz_emit_ethernet(0x4a, &(0x7f0000000240)={@link_local, @empty=[0x0, 0x3c000000], [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x3c, 0x0, 0x0, 0x0, 0x4, 0x0, @empty=0x9000000, @broadcast}, @udp={0x0, 0x0, 0x28}}}}}, &(0x7f0000000380)) 13:29:37 executing program 2: socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0xe1, 0x400100) creat(&(0x7f00000001c0)='./file0\x00', 0x2) openat$dsp(0xffffffffffffff9c, &(0x7f0000000200)='/dev/dsp\x00', 0x8000, 0x0) syz_open_dev$mouse(&(0x7f0000000240)='/dev/input/mouse#\x00', 0x100, 0x10000) r1 = syz_open_dev$amidi(&(0x7f0000000280)='/dev/amidi#\x00', 0x8000, 0xc0000) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) r3 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000007000)={0x8, 0x0, &(0x7f0000000140)=[@acquire], 0x0, 0x0, &(0x7f00000001c0)}) r4 = dup2(r3, r2) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f00000002c0)={0x8, 0x0, &(0x7f00000000c0)=[@release], 0x0, 0x0, &(0x7f0000000300)}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x80000001f) ioctl$SCSI_IOCTL_GET_BUS_NUMBER(r1, 0x5386, &(0x7f0000000380)) r5 = memfd_create(&(0x7f0000000080)="70726f63ae6d696d655f74797065776c616e316e6f64657600", 0x6) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x2000003, 0x5011, r5, 0x0) ioctl$TIOCGSID(r5, 0x5429, &(0x7f0000000300)=0x0) ioctl$sock_FIOSETOWN(r0, 0x8901, &(0x7f0000000340)=r6) 13:29:37 executing program 4: preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f00000000c0)=""/148, 0x94}], 0x1, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000080)='io\x00') preadv(r0, &(0x7f0000000480), 0x100000000000025c, 0x0) 13:29:37 executing program 1: socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0xe1, 0x400100) creat(&(0x7f00000001c0)='./file0\x00', 0x2) openat$dsp(0xffffffffffffff9c, &(0x7f0000000200)='/dev/dsp\x00', 0x8000, 0x0) syz_open_dev$mouse(&(0x7f0000000240)='/dev/input/mouse#\x00', 0x100, 0x10000) r1 = syz_open_dev$amidi(&(0x7f0000000280)='/dev/amidi#\x00', 0x8000, 0xc0000) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) r3 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000007000)={0x8, 0x0, &(0x7f0000000140)=[@acquire], 0x0, 0x0, &(0x7f00000001c0)}) r4 = dup2(r3, r2) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f00000002c0)={0x8, 0x0, &(0x7f00000000c0)=[@release], 0x0, 0x0, &(0x7f0000000300)}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x80000001f) ioctl$SCSI_IOCTL_GET_BUS_NUMBER(r1, 0x5386, &(0x7f0000000380)) r5 = memfd_create(&(0x7f0000000080)="70726f63ae6d696d655f74797065776c616e316e6f64657600", 0x6) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x2000003, 0x5011, r5, 0x0) 13:29:37 executing program 0: r0 = socket$inet(0x2, 0x4000000803, 0x4) bind$inet(r0, &(0x7f0000000000)={0x2, 0x0, @broadcast}, 0x10) getsockname(r0, &(0x7f00000036c0)=@xdp={0x2c, 0x0, 0x0}, &(0x7f0000000080)=0x80) setsockopt$inet_pktinfo(r0, 0x0, 0x8, &(0x7f0000003780)={r1, @rand_addr, @dev}, 0xc) syz_emit_ethernet(0x4a, &(0x7f0000000240)={@link_local, @empty=[0x0, 0xe8030000], [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x3c, 0x0, 0x0, 0x0, 0x4, 0x0, @empty=0x9000000, @broadcast}, @udp={0x0, 0x0, 0x28}}}}}, &(0x7f0000000380)) 13:29:37 executing program 3: r0 = socket$inet(0xa, 0x801, 0x84) connect$inet(r0, &(0x7f0000000180)={0x2, 0x4e21, @remote={0xac, 0x14, 0xffffffffffffffff}}, 0x10) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) listen(r0, 0xfc0004) r3 = accept4(r0, &(0x7f0000000000)=@ethernet={0x0, @local}, &(0x7f0000000040)=0x10, 0x0) getsockopt$inet_sctp6_SCTP_DELAYED_SACK(r3, 0x84, 0x10, &(0x7f0000000200)=@assoc_value={0x0, 0x3}, &(0x7f0000000280)=0x8) getsockopt$inet_sctp6_SCTP_ENABLE_STREAM_RESET(r3, 0x84, 0x76, &(0x7f00000000c0)={r4, 0x10000}, &(0x7f0000000100)=0x3) getsockopt$inet_sctp_SCTP_MAXSEG(r3, 0x84, 0xd, &(0x7f0000000140)=@assoc_value={r5, 0x6}, &(0x7f00000001c0)=0x8) setsockopt$inet_sctp6_SCTP_EVENTS(r3, 0x84, 0xb, &(0x7f0000000440)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xf4}, 0xb) ppoll(&(0x7f0000000240)=[{r3}, {r1}, {r2}], 0x3, &(0x7f0000000340), &(0x7f0000000380), 0x8) 13:29:37 executing program 4: preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f00000000c0)=""/148, 0x94}], 0x1, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000080)='io\x00') preadv(r0, &(0x7f0000000480), 0x1000000000000187, 0x0) 13:29:37 executing program 0: r0 = socket$inet(0x2, 0x4000000803, 0x4) bind$inet(r0, &(0x7f0000000000)={0x2, 0x0, @broadcast}, 0x10) getsockname(r0, &(0x7f00000036c0)=@xdp={0x2c, 0x0, 0x0}, &(0x7f0000000080)=0x80) setsockopt$inet_pktinfo(r0, 0x0, 0x8, &(0x7f0000003780)={r1, @rand_addr, @dev}, 0xc) syz_emit_ethernet(0x4a, &(0x7f0000000240)={@link_local, @empty=[0x0, 0x4], [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x3c, 0x0, 0x0, 0x0, 0x4, 0x0, @empty=0x9000000, @broadcast}, @udp={0x0, 0x0, 0x28}}}}}, &(0x7f0000000380)) 13:29:37 executing program 2 (fault-call:5 fault-nth:0): r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000007000)={0x8, 0x0, &(0x7f0000000140)=[@acquire], 0x0, 0x0, &(0x7f00000001c0)}) r2 = dup2(r1, r0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000002c0)={0x8, 0x0, &(0x7f00000000c0)=[@release], 0x0, 0x0, &(0x7f0000000300)}) [ 536.596361] sctp: [Deprecated]: syz-executor3 (pid 25696) Use of struct sctp_assoc_value in delayed_ack socket option. [ 536.596361] Use struct sctp_sack_info instead 13:29:38 executing program 1: socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0xe1, 0x400100) creat(&(0x7f00000001c0)='./file0\x00', 0x2) openat$dsp(0xffffffffffffff9c, &(0x7f0000000200)='/dev/dsp\x00', 0x8000, 0x0) syz_open_dev$mouse(&(0x7f0000000240)='/dev/input/mouse#\x00', 0x100, 0x10000) r1 = syz_open_dev$amidi(&(0x7f0000000280)='/dev/amidi#\x00', 0x8000, 0xc0000) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) r3 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000007000)={0x8, 0x0, &(0x7f0000000140)=[@acquire], 0x0, 0x0, &(0x7f00000001c0)}) r4 = dup2(r3, r2) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f00000002c0)={0x8, 0x0, &(0x7f00000000c0)=[@release], 0x0, 0x0, &(0x7f0000000300)}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x80000001f) ioctl$SCSI_IOCTL_GET_BUS_NUMBER(r1, 0x5386, &(0x7f0000000380)) memfd_create(&(0x7f0000000080)="70726f63ae6d696d655f74797065776c616e316e6f64657600", 0x6) [ 536.687672] sctp: [Deprecated]: syz-executor3 (pid 25702) Use of struct sctp_assoc_value in delayed_ack socket option. [ 536.687672] Use struct sctp_sack_info instead 13:29:38 executing program 5: socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = memfd_create(&(0x7f0000000080)="70726f63ae6d696d655f74797065776c616e316e6f64657600", 0x6) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x2000003, 0x5011, r2, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000000)=[@text64={0x40, &(0x7f0000000500)="0f0866b8ed008ec066ba4000b000eed2a807000000410f01cab98e0b0000b862000000ba000000000f30b90b0800000f320fc72a8f2a60128f00000000003000000fc7aa00100000", 0x48}], 0x1, 0x0, &(0x7f0000000040), 0x0) lseek(r0, 0x0, 0x3) 13:29:38 executing program 3: r0 = socket$inet(0xa, 0x801, 0x84) connect$inet(r0, &(0x7f0000000180)={0x2, 0x4e21, @remote={0xac, 0x14, 0xffffffffffffffff}}, 0x10) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) listen(r0, 0xfc0004) r3 = accept(r1, 0x0, &(0x7f00000000c0)) setsockopt$netlink_NETLINK_NO_ENOBUFS(r3, 0x10e, 0x5, &(0x7f0000000100)=0xc6dc, 0x4) r4 = accept4(r0, &(0x7f0000000000)=@ethernet={0x0, @local}, &(0x7f0000000040)=0x10, 0x0) setsockopt$inet_sctp6_SCTP_EVENTS(r4, 0x84, 0xb, &(0x7f0000000440)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xf4}, 0xb) ppoll(&(0x7f0000000240)=[{r4}, {r1}, {r2}], 0x3, &(0x7f0000000340), &(0x7f0000000380), 0x8) 13:29:38 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000007000)={0x8, 0x0, &(0x7f0000000140)=[@acquire], 0x0, 0x0, &(0x7f00000001c0)}) r2 = dup2(r1, r0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000002c0)={0x8, 0x0, &(0x7f00000000c0)=[@release], 0x0, 0x0, &(0x7f0000000300)}) 13:29:38 executing program 0: r0 = socket$inet(0x2, 0x4000000803, 0x4) bind$inet(r0, &(0x7f0000000000)={0x2, 0x0, @broadcast}, 0x10) getsockname(r0, &(0x7f00000036c0)=@xdp={0x2c, 0x0, 0x0}, &(0x7f0000000080)=0x80) setsockopt$inet_pktinfo(r0, 0x0, 0x8, &(0x7f0000003780)={r1, @rand_addr, @dev}, 0xc) syz_emit_ethernet(0x4a, &(0x7f0000000240)={@link_local, @empty=[0x0, 0x88caffff00000000], [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x3c, 0x0, 0x0, 0x0, 0x4, 0x0, @empty=0x9000000, @broadcast}, @udp={0x0, 0x0, 0x28}}}}}, &(0x7f0000000380)) 13:29:38 executing program 4: preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f00000000c0)=""/148, 0x94}], 0x1, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000080)='io\x00') preadv(r0, &(0x7f0000000480), 0x10000000000000ac, 0x0) 13:29:38 executing program 1: socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0xe1, 0x400100) creat(&(0x7f00000001c0)='./file0\x00', 0x2) openat$dsp(0xffffffffffffff9c, &(0x7f0000000200)='/dev/dsp\x00', 0x8000, 0x0) syz_open_dev$mouse(&(0x7f0000000240)='/dev/input/mouse#\x00', 0x100, 0x10000) r1 = syz_open_dev$amidi(&(0x7f0000000280)='/dev/amidi#\x00', 0x8000, 0xc0000) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) r3 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000007000)={0x8, 0x0, &(0x7f0000000140)=[@acquire], 0x0, 0x0, &(0x7f00000001c0)}) r4 = dup2(r3, r2) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f00000002c0)={0x8, 0x0, &(0x7f00000000c0)=[@release], 0x0, 0x0, &(0x7f0000000300)}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x80000001f) ioctl$SCSI_IOCTL_GET_BUS_NUMBER(r1, 0x5386, &(0x7f0000000380)) 13:29:38 executing program 4: preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f00000000c0)=""/148, 0x94}], 0x1, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000080)='io\x00') preadv(r0, &(0x7f0000000480), 0x10000000000001c7, 0x0) 13:29:38 executing program 0: r0 = socket$inet(0x2, 0x4000000803, 0x4) bind$inet(r0, &(0x7f0000000000)={0x2, 0x0, @broadcast}, 0x10) getsockname(r0, &(0x7f00000036c0)=@xdp={0x2c, 0x0, 0x0}, &(0x7f0000000080)=0x80) setsockopt$inet_pktinfo(r0, 0x0, 0x8, &(0x7f0000003780)={r1, @rand_addr, @dev}, 0xc) syz_emit_ethernet(0x4a, &(0x7f0000000240)={@link_local, @empty=[0x0, 0x1000000], [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x3c, 0x0, 0x0, 0x0, 0x4, 0x0, @empty=0x9000000, @broadcast}, @udp={0x0, 0x0, 0x28}}}}}, &(0x7f0000000380)) 13:29:38 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000007000)={0x8, 0x0, &(0x7f0000000140)=[@acquire], 0x0, 0x0, &(0x7f00000001c0)}) r2 = dup2(r1, r0) ioctl$BINDER_WRITE_READ(r2, 0x4020940d, &(0x7f00000002c0)={0x8, 0x0, &(0x7f00000000c0)=[@release], 0x0, 0x0, &(0x7f0000000300)}) 13:29:38 executing program 1: socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0xe1, 0x400100) creat(&(0x7f00000001c0)='./file0\x00', 0x2) openat$dsp(0xffffffffffffff9c, &(0x7f0000000200)='/dev/dsp\x00', 0x8000, 0x0) syz_open_dev$mouse(&(0x7f0000000240)='/dev/input/mouse#\x00', 0x100, 0x10000) syz_open_dev$amidi(&(0x7f0000000280)='/dev/amidi#\x00', 0x8000, 0xc0000) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000007000)={0x8, 0x0, &(0x7f0000000140)=[@acquire], 0x0, 0x0, &(0x7f00000001c0)}) r3 = dup2(r2, r1) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000002c0)={0x8, 0x0, &(0x7f00000000c0)=[@release], 0x0, 0x0, &(0x7f0000000300)}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x80000001f) 13:29:38 executing program 5: socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = memfd_create(&(0x7f0000000080)="70726f63ae6d696d655f74797065776c616e316e6f64657600", 0x6) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x2000003, 0x5011, r1, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000000)=[@text64={0x40, &(0x7f0000000500)="0f0866b8ed008ec066ba4000b000eed2a807000000410f01cab98e0b0000b862000000ba000000000f30b90b0800000f320fc72a8f2a60128f00000000003000000fc7aa00100000", 0x48}], 0x1, 0x0, &(0x7f0000000040), 0x0) connect$netlink(r1, &(0x7f0000000040)=@unspec, 0xc) 13:29:38 executing program 3: r0 = socket$inet(0xa, 0x801, 0x84) r1 = openat$vsock(0xffffffffffffff9c, &(0x7f0000000140)='/dev/vsock\x00', 0x2, 0x0) ioctl$sock_FIOGETOWN(r0, 0x8903, &(0x7f00000001c0)=0x0) write$FUSE_LK(r1, &(0x7f0000000200)={0x28, 0x0, 0x7, {{0xb5, 0xec3a, 0x2, r2}}}, 0x28) connect$inet(r0, &(0x7f0000000180)={0x2, 0x4e21, @remote={0xac, 0x14, 0xffffffffffffffff}}, 0x10) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) getsockopt$IP_VS_SO_GET_TIMEOUT(r0, 0x0, 0x486, &(0x7f00000000c0), &(0x7f0000000100)=0xc) listen(r0, 0xfc0004) r5 = accept4(r0, &(0x7f00000003c0)=@ethernet={0x0, @local}, &(0x7f0000000300)=0x217, 0x0) socket$inet6_sctp(0xa, 0x5, 0x84) setsockopt$inet_sctp6_SCTP_EVENTS(r5, 0x84, 0xb, &(0x7f0000000440)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xf4}, 0xb) ppoll(&(0x7f0000000240)=[{r5}, {r3}, {r4}], 0x3, &(0x7f0000000340), &(0x7f0000000380), 0x8) 13:29:38 executing program 4: preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f00000000c0)=""/148, 0x94}], 0x1, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000080)='io\x00') preadv(r0, &(0x7f0000000480), 0x100000000000002c, 0x0) [ 537.400221] binder: BINDER_SET_CONTEXT_MGR already set [ 537.417073] binder: 25743:25750 ioctl 40046207 0 returned -16 13:29:38 executing program 0: r0 = socket$inet(0x2, 0x4000000803, 0x4) bind$inet(r0, &(0x7f0000000000)={0x2, 0x0, @broadcast}, 0x10) getsockname(r0, &(0x7f00000036c0)=@xdp={0x2c, 0x0, 0x0}, &(0x7f0000000080)=0x80) setsockopt$inet_pktinfo(r0, 0x0, 0x8, &(0x7f0000003780)={r1, @rand_addr, @dev}, 0xc) syz_emit_ethernet(0x4a, &(0x7f0000000240)={@link_local, @empty=[0x0, 0xe803], [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x3c, 0x0, 0x0, 0x0, 0x4, 0x0, @empty=0x9000000, @broadcast}, @udp={0x0, 0x0, 0x28}}}}}, &(0x7f0000000380)) 13:29:38 executing program 1: socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)) syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0xe1, 0x400100) creat(&(0x7f00000001c0)='./file0\x00', 0x2) openat$dsp(0xffffffffffffff9c, &(0x7f0000000200)='/dev/dsp\x00', 0x8000, 0x0) syz_open_dev$mouse(&(0x7f0000000240)='/dev/input/mouse#\x00', 0x100, 0x10000) syz_open_dev$amidi(&(0x7f0000000280)='/dev/amidi#\x00', 0x8000, 0xc0000) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000007000)={0x8, 0x0, &(0x7f0000000140)=[@acquire], 0x0, 0x0, &(0x7f00000001c0)}) r2 = dup2(r1, r0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000002c0)={0x8, 0x0, &(0x7f00000000c0)=[@release], 0x0, 0x0, &(0x7f0000000300)}) [ 537.443108] binder: 25743:25751 Acquire 1 refcount change on invalid ref 0 ret -22 13:29:38 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000007000)={0x8, 0x0, &(0x7f0000000140)=[@acquire], 0x0, 0x0, &(0x7f00000001c0)}) r2 = dup2(r1, r0) ioctl$BINDER_WRITE_READ(r2, 0xc0046209, &(0x7f00000002c0)={0x8, 0x0, &(0x7f00000000c0)=[@release], 0x0, 0x0, &(0x7f0000000300)}) 13:29:38 executing program 0: r0 = socket$inet(0x2, 0x4000000803, 0x4) bind$inet(r0, &(0x7f0000000000)={0x2, 0x0, @broadcast}, 0x10) getsockname(r0, &(0x7f00000036c0)=@xdp={0x2c, 0x0, 0x0}, &(0x7f0000000080)=0x80) setsockopt$inet_pktinfo(r0, 0x0, 0x8, &(0x7f0000003780)={r1, @rand_addr, @dev}, 0xc) syz_emit_ethernet(0x4a, &(0x7f0000000240)={@link_local, @empty=[0x0, 0x2], [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x3c, 0x0, 0x0, 0x0, 0x4, 0x0, @empty=0x9000000, @broadcast}, @udp={0x0, 0x0, 0x28}}}}}, &(0x7f0000000380)) 13:29:38 executing program 5: socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = memfd_create(&(0x7f0000000080)="70726f63ae6d696d655f74797065776c616e316e6f64657600", 0x6) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x1000001, 0x5011, r1, 0x3) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000000)=[@text64={0x40, &(0x7f0000000500)="0f0866b8ed008ec066ba4000b000eed2a807000000410f01cab98e0b0000b862000000ba000000000f30b90b0800000f320fc72a8f2a60128f00000000003000000fc7aa00100000", 0x48}], 0x1, 0x0, &(0x7f0000000040), 0x0) 13:29:39 executing program 4: preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f00000000c0)=""/148, 0x94}], 0x1, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000080)='io\x00') preadv(r0, &(0x7f0000000480), 0x10000000000000f1, 0x0) 13:29:39 executing program 1: socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)) syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0xe1, 0x400100) creat(&(0x7f00000001c0)='./file0\x00', 0x2) openat$dsp(0xffffffffffffff9c, &(0x7f0000000200)='/dev/dsp\x00', 0x8000, 0x0) syz_open_dev$mouse(&(0x7f0000000240)='/dev/input/mouse#\x00', 0x100, 0x10000) syz_open_dev$amidi(&(0x7f0000000280)='/dev/amidi#\x00', 0x8000, 0xc0000) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000007000)={0x8, 0x0, &(0x7f0000000140)=[@acquire], 0x0, 0x0, &(0x7f00000001c0)}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f00000002c0)={0x8, 0x0, &(0x7f00000000c0)=[@release], 0x0, 0x0, &(0x7f0000000300)}) 13:29:39 executing program 3: r0 = socket$inet(0xa, 0x801, 0x84) connect$inet(r0, &(0x7f0000000180)={0x2, 0x4e21, @remote={0xac, 0x14, 0xffffffffffffffff}}, 0x10) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) listen(r0, 0xfc0004) setsockopt$inet_dccp_int(r0, 0x21, 0xf, &(0x7f00000000c0)=0x7f, 0x4) r3 = accept4(r0, &(0x7f0000000000)=@ethernet={0x0, @local}, &(0x7f0000000040)=0x10, 0x0) setsockopt$inet_sctp6_SCTP_EVENTS(r3, 0x84, 0xb, &(0x7f0000000440)={0xfffffffffffffffe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xf4}, 0xb) ppoll(&(0x7f0000000240)=[{r3}, {r1}, {r2}], 0x3, &(0x7f0000000340), &(0x7f0000000380), 0x8) 13:29:39 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000007000)={0x8, 0x0, &(0x7f0000000140)=[@acquire], 0x0, 0x0, &(0x7f00000001c0)}) r2 = dup2(r1, r0) ioctl$BINDER_WRITE_READ(r2, 0xc018620b, &(0x7f00000002c0)={0x8, 0x0, &(0x7f00000000c0)=[@release], 0x0, 0x0, &(0x7f0000000300)}) 13:29:39 executing program 0: r0 = socket$inet(0x2, 0x4000000803, 0x4) bind$inet(r0, &(0x7f0000000000)={0x2, 0x0, @broadcast}, 0x10) getsockname(r0, &(0x7f00000036c0)=@xdp={0x2c, 0x0, 0x0}, &(0x7f0000000080)=0x80) setsockopt$inet_pktinfo(r0, 0x0, 0x8, &(0x7f0000003780)={r1, @rand_addr, @dev}, 0xc) syz_emit_ethernet(0x4a, &(0x7f0000000240)={@link_local, @empty=[0x0, 0x8100000000000000], [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x3c, 0x0, 0x0, 0x0, 0x4, 0x0, @empty=0x9000000, @broadcast}, @udp={0x0, 0x0, 0x28}}}}}, &(0x7f0000000380)) 13:29:39 executing program 5: socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = memfd_create(&(0x7f0000000080)="70726f63ae6d696d655f74797065776c616e316e6f64657600", 0x6) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x2000003, 0x5011, r2, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000000)=[@text64={0x40, &(0x7f0000000500)="0f0866b8ed008ec066ba4000b000eed2a807000000410f01cab98e0b0000b862000000ba000000000f30b90b0800000f320fc72a8f2a60128f00000000003000000fc7aa00100000", 0x48}], 0x1, 0x0, &(0x7f0000000040), 0x0) 13:29:39 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000007000)={0x8, 0x0, &(0x7f0000000140)=[@acquire], 0x0, 0x0, &(0x7f00000001c0)}) r2 = dup2(r1, r0) ioctl$BINDER_WRITE_READ(r2, 0x2, &(0x7f00000002c0)={0x8, 0x0, &(0x7f00000000c0)=[@release], 0x0, 0x0, &(0x7f0000000300)}) 13:29:39 executing program 3: r0 = socket$inet(0xa, 0x801, 0x84) eventfd2(0x100, 0x0) connect$inet(r0, &(0x7f0000000180)={0x2, 0x4e21, @remote={0xac, 0x14, 0xffffffffffffffff}}, 0x10) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = syz_open_dev$midi(&(0x7f00000000c0)='/dev/midi#\x00', 0x1000, 0x10100) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) listen(r0, 0xfc0004) r4 = accept4(r0, &(0x7f0000000000)=@ethernet={0x0, @local}, &(0x7f0000000040)=0x10, 0x0) setsockopt$inet_sctp6_SCTP_EVENTS(r4, 0x84, 0xb, &(0x7f0000000440)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xf4}, 0xb) syz_open_dev$audion(&(0x7f0000000100)='/dev/audio#\x00', 0x9, 0x0) ppoll(&(0x7f0000000240)=[{r4}, {r1}, {r2}], 0x3, &(0x7f0000000340), &(0x7f0000000380), 0x8) 13:29:39 executing program 1: socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)) syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0xe1, 0x400100) creat(&(0x7f00000001c0)='./file0\x00', 0x2) openat$dsp(0xffffffffffffff9c, &(0x7f0000000200)='/dev/dsp\x00', 0x8000, 0x0) syz_open_dev$mouse(&(0x7f0000000240)='/dev/input/mouse#\x00', 0x100, 0x10000) syz_open_dev$amidi(&(0x7f0000000280)='/dev/amidi#\x00', 0x8000, 0xc0000) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = dup2(r1, r0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000002c0)={0x8, 0x0, &(0x7f00000000c0)=[@release], 0x0, 0x0, &(0x7f0000000300)}) 13:29:39 executing program 0: r0 = socket$inet(0x2, 0x4000000803, 0x4) bind$inet(r0, &(0x7f0000000000)={0x2, 0x0, @broadcast}, 0x10) getsockname(r0, &(0x7f00000036c0)=@xdp={0x2c, 0x0, 0x0}, &(0x7f0000000080)=0x80) setsockopt$inet_pktinfo(r0, 0x0, 0x8, &(0x7f0000003780)={r1, @rand_addr, @dev}, 0xc) syz_emit_ethernet(0x4a, &(0x7f0000000240)={@link_local, @empty=[0x0, 0x689], [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x3c, 0x0, 0x0, 0x0, 0x4, 0x0, @empty=0x9000000, @broadcast}, @udp={0x0, 0x0, 0x28}}}}}, &(0x7f0000000380)) 13:29:39 executing program 3: r0 = socket$inet(0xa, 0x801, 0x84) connect$inet(r0, &(0x7f0000000180)={0x2, 0x4e21, @remote={0xac, 0x14, 0xffffffffffffffff}}, 0x10) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) listen(r0, 0xfc0004) r3 = accept4(r0, &(0x7f0000000000)=@ethernet={0x0, @local}, &(0x7f0000000040)=0x10, 0x0) socketpair$inet_udp(0x2, 0x2, 0x0, &(0x7f00000000c0)) setsockopt$inet_sctp6_SCTP_EVENTS(r3, 0x84, 0xb, &(0x7f0000000440)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xf4}, 0xb) ppoll(&(0x7f0000000240)=[{r3}, {r1}, {r2}], 0x3, &(0x7f0000000340), &(0x7f0000000380), 0x8) 13:29:39 executing program 4: preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f00000000c0)=""/148, 0x94}], 0x1, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000080)='io\x00') preadv(r0, &(0x7f0000000480), 0x1000000000000095, 0x0) 13:29:39 executing program 5: socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = memfd_create(&(0x7f0000000080)="70726f63ae6d696d655f74797065776c616e316e6f64657600", 0x6) mmap(&(0x7f0000002000/0x3000)=nil, 0x3000, 0x2000003, 0x5011, r1, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000000)=[@text64={0x40, &(0x7f0000000500)="0f0866b8ed008ec066ba4000b000eed2a807000000410f01cab98e0b0000b862000000ba000000000f30b90b0800000f320fc72a8f2a60128f00000000003000000fc7aa00100000", 0x48}], 0x1, 0x0, &(0x7f0000000040), 0x0) bind$inet6(r1, &(0x7f0000000180)={0xa, 0x4e23, 0x4655, @mcast2, 0x5}, 0x1c) ioctl$sock_FIOGETOWN(r0, 0x8903, &(0x7f0000000040)=0x0) capset(&(0x7f0000000100)={0x19980330, r2}, &(0x7f0000000140)={0x5, 0x3, 0xffffffff, 0x1d, 0x3, 0xcacc}) 13:29:39 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000007000)={0x8, 0x0, &(0x7f0000000140)=[@acquire], 0x0, 0x0, &(0x7f00000001c0)}) r2 = dup2(r1, r0) ioctl$BINDER_WRITE_READ(r2, 0xc0045878, &(0x7f00000002c0)={0x8, 0x0, &(0x7f00000000c0)=[@release], 0x0, 0x0, &(0x7f0000000300)}) 13:29:39 executing program 0: r0 = socket$inet(0x2, 0x4000000803, 0x4) bind$inet(r0, &(0x7f0000000000)={0x2, 0x0, @broadcast}, 0x10) getsockname(r0, &(0x7f00000036c0)=@xdp={0x2c, 0x0, 0x0}, &(0x7f0000000080)=0x80) setsockopt$inet_pktinfo(r0, 0x0, 0x8, &(0x7f0000003780)={r1, @rand_addr, @dev}, 0xc) syz_emit_ethernet(0x4a, &(0x7f0000000240)={@link_local, @empty=[0x0, 0x8847000000000000], [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x3c, 0x0, 0x0, 0x0, 0x4, 0x0, @empty=0x9000000, @broadcast}, @udp={0x0, 0x0, 0x28}}}}}, &(0x7f0000000380)) [ 538.218088] binder: 25807:25812 Release 1 refcount change on invalid ref 0 ret -22 13:29:39 executing program 1: socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)) syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0xe1, 0x400100) creat(&(0x7f00000001c0)='./file0\x00', 0x2) openat$dsp(0xffffffffffffff9c, &(0x7f0000000200)='/dev/dsp\x00', 0x8000, 0x0) syz_open_dev$mouse(&(0x7f0000000240)='/dev/input/mouse#\x00', 0x100, 0x10000) syz_open_dev$amidi(&(0x7f0000000280)='/dev/amidi#\x00', 0x8000, 0xc0000) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = dup2(r1, r0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000002c0)={0x8, 0x0, &(0x7f00000000c0)=[@release], 0x0, 0x0, &(0x7f0000000300)}) 13:29:39 executing program 5: socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = openat$full(0xffffffffffffff9c, &(0x7f0000000080)='/dev/full\x00', 0x101000, 0x0) ioctl$SCSI_IOCTL_DOORUNLOCK(r1, 0x5381) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r2 = memfd_create(&(0x7f0000000440)="706e316e6f64657600f2d1d20ae9728118eee0e89172c2dfb4c9102d988f1c187ae508178f078e02949629cc9f7af95f74acc3b8243ae9d693248d5d607d029f3caecf749619d6de0400000000000000000000000000000000000000000000001000", 0x6) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x2000003, 0x5011, r2, 0x0) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r2, 0x84, 0x6f, &(0x7f0000000040)={0x0, 0x54, &(0x7f0000000100)=[@in6={0xa, 0x4e21, 0x36a9, @mcast2, 0x3}, @in6={0xa, 0x4e22, 0xb0, @local, 0x2}, @in6={0xa, 0x4e22, 0x4e3, @loopback}]}, &(0x7f0000000180)=0x10) getsockopt$inet_sctp6_SCTP_DEFAULT_SNDINFO(r2, 0x84, 0x22, &(0x7f00000001c0)={0x8, 0x4, 0x6, 0x6, r3}, &(0x7f0000000200)=0x10) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000380)='/dev/sequencer2\x00', 0x200, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000000)=[@text64={0x40, &(0x7f0000000500)="0f0866b8ed008ec066ba4000b000eed2a807000000410f01cab98e0b0000b862000000ba000000000f30b90b0800000f320fc72a8f2a60128f00000000003000000fc7aa00100000", 0x48}], 0x1, 0x0, &(0x7f0000000040), 0x0) getsockopt$inet_sctp_SCTP_GET_LOCAL_ADDRS(r2, 0x84, 0x6d, &(0x7f0000000240)=ANY=[@ANYRES32=r4, @ANYBLOB="bf000000a63b90edd69e0f7f26d52800a68abe85953b79553a1582e978d5f380262f1d427c770f5b4cf273d4d83bdfc5fd11df732fb7c35d9d4a584c681fb7f593e4bc2c7b0d4b097adb231ff5f734878228abe8a5ac5e34aa0b2494364452bb59af848532b33a5d2804ad45d4baedb2ace057327b38ae7c3894641eaf9a8fb69a02b2a53b36cc1e280f672a111b111deb2887beca47b3b1c08e7571904368e51a53d9ad1dc2bd38cde1e1dbefbcddd6598e26811d7b3b9310f0155a61748fd987e700"], &(0x7f0000000340)=0xc7) 13:29:39 executing program 4: preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f00000000c0)=""/148, 0x94}], 0x1, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000080)='io\x00') preadv(r0, &(0x7f0000000480), 0x10000000000000e1, 0x0) 13:29:39 executing program 3: r0 = socket$inet(0xa, 0x801, 0x84) connect$inet(r0, &(0x7f0000000180)={0x2, 0x4e21, @remote={0xac, 0x14, 0xffffffffffffffff}}, 0x10) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = creat(&(0x7f00000000c0)='./file0\x00', 0x148) write$RDMA_USER_CM_CMD_JOIN_MCAST(0xffffffffffffffff, &(0x7f0000000280)={0x16, 0x98, 0xfa00, {&(0x7f0000000140)={0xffffffffffffffff}, 0x0, 0xffffffffffffffff, 0x10, 0x0, @in6={0xa, 0x4e24, 0x3, @local, 0x3}}}, 0xa0) write$RDMA_USER_CM_CMD_LEAVE_MCAST(r3, &(0x7f00000001c0)={0x11, 0x10, 0xfa00, {&(0x7f0000000100), r4}}, 0x18) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) listen(r0, 0xfc0004) r5 = accept4(r0, &(0x7f0000000000)=@ethernet={0x0, @local}, &(0x7f0000000040)=0x10, 0x0) setsockopt$inet_sctp6_SCTP_EVENTS(r5, 0x84, 0xb, &(0x7f0000000440)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xf4}, 0xb) ppoll(&(0x7f0000000240)=[{r5}, {r1}, {r2}], 0x3, &(0x7f0000000340), &(0x7f0000000380), 0x8) [ 538.407537] binder: BINDER_SET_CONTEXT_MGR already set [ 538.412865] binder: 25833:25841 ioctl 40046207 0 returned -16 13:29:39 executing program 0: r0 = socket$inet(0x2, 0x4000000803, 0x4) bind$inet(r0, &(0x7f0000000000)={0x2, 0x0, @broadcast}, 0x10) getsockname(r0, &(0x7f00000036c0)=@xdp={0x2c, 0x0, 0x0}, &(0x7f0000000080)=0x80) setsockopt$inet_pktinfo(r0, 0x0, 0x8, &(0x7f0000003780)={r1, @rand_addr, @dev}, 0xc) syz_emit_ethernet(0x4a, &(0x7f0000000240)={@link_local, @empty=[0x0, 0x8035], [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x3c, 0x0, 0x0, 0x0, 0x4, 0x0, @empty=0x9000000, @broadcast}, @udp={0x0, 0x0, 0x28}}}}}, &(0x7f0000000380)) 13:29:39 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000007000)={0x8, 0x0, &(0x7f0000000140)=[@acquire], 0x0, 0x0, &(0x7f00000001c0)}) r2 = dup2(r1, r0) ioctl$BINDER_WRITE_READ(r2, 0x5421, &(0x7f00000002c0)={0x8, 0x0, &(0x7f00000000c0)=[@release], 0x0, 0x0, &(0x7f0000000300)}) [ 538.486742] binder: 25838:25845 Release 1 refcount change on invalid ref 0 ret -22 13:29:39 executing program 1: socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)) syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0xe1, 0x400100) creat(&(0x7f00000001c0)='./file0\x00', 0x2) openat$dsp(0xffffffffffffff9c, &(0x7f0000000200)='/dev/dsp\x00', 0x8000, 0x0) syz_open_dev$mouse(&(0x7f0000000240)='/dev/input/mouse#\x00', 0x100, 0x10000) syz_open_dev$amidi(&(0x7f0000000280)='/dev/amidi#\x00', 0x8000, 0xc0000) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = dup2(r1, r0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000002c0)={0x8, 0x0, &(0x7f00000000c0)=[@release], 0x0, 0x0, &(0x7f0000000300)}) 13:29:39 executing program 4: preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f00000000c0)=""/148, 0x94}], 0x1, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000080)='io\x00') preadv(r0, &(0x7f0000000480), 0x10000000000001ee, 0x0) 13:29:39 executing program 5: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = memfd_create(&(0x7f00000000c0)="70726f63ae6d696d655f74797065776c616e316e6f64657600", 0x6) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x2000003, 0x10, r1, 0x2) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000000)=[@text64={0x40, &(0x7f0000000500)="0f0866b8ed008ec066ba4000b000eed2a807000000410f01cab98e0b0000b862000000ba000000000f30b90b0800000f320fc72a8f2a60128f00000000003000000fc7aa00100000", 0x48}], 0x1, 0x0, &(0x7f0000000040), 0x0) 13:29:39 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000007000)={0x8, 0x0, &(0x7f0000000140)=[@acquire], 0x0, 0x0, &(0x7f00000001c0)}) r2 = dup2(r1, r0) ioctl$BINDER_WRITE_READ(r2, 0x40049409, &(0x7f00000002c0)={0x8, 0x0, &(0x7f00000000c0)=[@release], 0x0, 0x0, &(0x7f0000000300)}) 13:29:40 executing program 3: r0 = socket$inet(0xa, 0x801, 0xff) connect$inet(r0, &(0x7f0000000180)={0x2, 0x4e21, @remote={0xac, 0x14, 0xffffffffffffffff}}, 0x10) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) getsockopt$inet_sctp_SCTP_GET_ASSOC_NUMBER(r0, 0x84, 0x1c, &(0x7f0000000400), &(0x7f0000000480)=0x4) fgetxattr(r2, &(0x7f00000001c0)=@random={'os2.', 'md5sum\x00'}, &(0x7f0000000280)=""/114, 0x72) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000200)='/proc/sys/net/ipv4/vs/sloppy_sctp\x00', 0x2, 0x0) getsockopt$inet6_tcp_int(r3, 0x6, 0x0, &(0x7f0000000300), &(0x7f00000003c0)=0x4) listen(r0, 0xfc0004) r4 = accept4(r0, &(0x7f0000000000)=@ethernet={0x0, @local}, &(0x7f0000000040)=0x10, 0x0) setsockopt$inet_sctp6_SCTP_EVENTS(r4, 0x84, 0xb, &(0x7f0000000440)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xf4}, 0xb) ppoll(&(0x7f00000000c0)=[{r0, 0x2200}, {r2}, {r1, 0x80}], 0x3, &(0x7f0000000100)={0x0, 0x989680}, &(0x7f0000000140)={0x5}, 0x8) ppoll(&(0x7f0000000240)=[{r4}, {r1}, {r2}], 0x3, &(0x7f0000000340), &(0x7f0000000380), 0x8) accept4$vsock_stream(r4, &(0x7f00000004c0)={0x28, 0x0, 0x0, @my=0x0}, 0x10, 0x800) 13:29:40 executing program 0: r0 = socket$inet(0x2, 0x4000000803, 0x4) bind$inet(r0, &(0x7f0000000000)={0x2, 0x0, @broadcast}, 0x10) getsockname(r0, &(0x7f00000036c0)=@xdp={0x2c, 0x0, 0x0}, &(0x7f0000000080)=0x80) setsockopt$inet_pktinfo(r0, 0x0, 0x8, &(0x7f0000003780)={r1, @rand_addr, @dev}, 0xc) syz_emit_ethernet(0x4a, &(0x7f0000000240)={@link_local, @empty=[0x0, 0x3f000000], [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x3c, 0x0, 0x0, 0x0, 0x4, 0x0, @empty=0x9000000, @broadcast}, @udp={0x0, 0x0, 0x28}}}}}, &(0x7f0000000380)) [ 538.762009] binder: 25863:25870 Release 1 refcount change on invalid ref 0 ret -22 13:29:40 executing program 1: socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)) syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0xe1, 0x400100) creat(&(0x7f00000001c0)='./file0\x00', 0x2) openat$dsp(0xffffffffffffff9c, &(0x7f0000000200)='/dev/dsp\x00', 0x8000, 0x0) syz_open_dev$mouse(&(0x7f0000000240)='/dev/input/mouse#\x00', 0x100, 0x10000) syz_open_dev$amidi(&(0x7f0000000280)='/dev/amidi#\x00', 0x8000, 0xc0000) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000007000)={0x8, 0x0, &(0x7f0000000140)=[@acquire], 0x0, 0x0, &(0x7f00000001c0)}) r1 = dup2(0xffffffffffffffff, r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000002c0)={0x8, 0x0, &(0x7f00000000c0)=[@release], 0x0, 0x0, &(0x7f0000000300)}) 13:29:40 executing program 4: preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f00000000c0)=""/148, 0x94}], 0x1, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000080)='io\x00') preadv(r0, &(0x7f0000000480), 0x10000000000000f5, 0x0) 13:29:40 executing program 5: socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000080)='/dev/rtc0\x00', 0x1ff, 0x0) write$UHID_GET_REPORT_REPLY(r1, &(0x7f00000001c0)={0xa, 0x9, 0x1c0b, 0x145}, 0xd0176466734570d) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400204) openat(r1, &(0x7f0000000140)='./file0\x00', 0x80000, 0xa) r2 = memfd_create(&(0x7f0000000180)="70726f63ae6d696d655f74797065776c616e316e6f64657600", 0x6) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x2000003, 0x5011, r2, 0x0) ioctl$sock_bt_bnep_BNEPCONNDEL(r2, 0x400442c9, &(0x7f0000000040)={0x9f4, @random="a83edbc1ecdf"}) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000000)=[@text64={0x40, &(0x7f0000000500)="0f0866b8ed008ec066ba4000b000eed2a807000000410f01cab98e0b0000b862000000ba000000000f30b90b0800000f320fc72a8f2a60128f00000000003000000fc7aa00100000", 0x48}], 0x1, 0x0, &(0x7f0000000040), 0x0) ioctl$TIOCGPTPEER(r1, 0x5441, 0x0) 13:29:40 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000007000)={0x8, 0x0, &(0x7f0000000140)=[@acquire], 0x0, 0x0, &(0x7f00000001c0)}) r2 = dup2(r1, r0) ioctl$BINDER_WRITE_READ(r2, 0x5450, &(0x7f00000002c0)={0x8, 0x0, &(0x7f00000000c0)=[@release], 0x0, 0x0, &(0x7f0000000300)}) 13:29:40 executing program 0: r0 = socket$inet(0x2, 0x4000000803, 0x4) bind$inet(r0, &(0x7f0000000000)={0x2, 0x0, @broadcast}, 0x10) getsockname(r0, &(0x7f00000036c0)=@xdp={0x2c, 0x0, 0x0}, &(0x7f0000000080)=0x80) setsockopt$inet_pktinfo(r0, 0x0, 0x8, &(0x7f0000003780)={r1, @rand_addr, @dev}, 0xc) syz_emit_ethernet(0x4a, &(0x7f0000000240)={@link_local, @empty=[0x0, 0xffffdd86], [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x3c, 0x0, 0x0, 0x0, 0x4, 0x0, @empty=0x9000000, @broadcast}, @udp={0x0, 0x0, 0x28}}}}}, &(0x7f0000000380)) 13:29:40 executing program 3: r0 = socket$inet(0xa, 0x801, 0x84) connect$inet(r0, &(0x7f00000000c0)={0x2, 0x4e23, @remote={0xac, 0x14, 0xffffffffffffffff}}, 0x10) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) listen(r0, 0xfc0004) r3 = openat$zero(0xffffffffffffff9c, &(0x7f0000000100)='/dev/zero\x00', 0x20000, 0x0) write$P9_RWRITE(r3, &(0x7f0000000140)={0xb, 0x77, 0x2, 0x80000001}, 0xb) r4 = accept4(r0, &(0x7f0000000000)=@ethernet={0x0, @local}, &(0x7f0000000040)=0x10, 0x0) setsockopt$inet_sctp6_SCTP_EVENTS(r4, 0x84, 0xb, &(0x7f0000000440)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xf4}, 0xb) ppoll(&(0x7f0000000240)=[{r4}, {r1}, {r2}], 0x3, &(0x7f0000000340), &(0x7f0000000380), 0x8) [ 539.003020] binder: BINDER_SET_CONTEXT_MGR already set 13:29:40 executing program 5: socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = memfd_create(&(0x7f0000000040)="70726f63ae6d696d655f74797065776c616e316e6f64657600", 0x5) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x2000003, 0x5011, r1, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000000)=[@text64={0x40, &(0x7f0000000500)="0f0866b8ed008ec066ba4000b000eed2a807000000410f01cab98e0b0000b862000000ba000000000f30b90b0800000f320fc72a8f2a60128f00000000003000000fc7aa00100000", 0x48}], 0x1, 0x0, &(0x7f0000000040), 0x0) ioctl$EVIOCGSW(r1, 0x8040451b, &(0x7f0000000100)=""/152) 13:29:40 executing program 4: preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f00000000c0)=""/148, 0x94}], 0x1, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000080)='io\x00') preadv(r0, &(0x7f0000000480), 0x10000000000000c9, 0x0) [ 539.051630] binder: 25890:25899 ioctl 40046207 0 returned -16 13:29:40 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000007000)={0x8, 0x0, &(0x7f0000000140)=[@acquire], 0x0, 0x0, &(0x7f00000001c0)}) r2 = dup2(r1, r0) ioctl$BINDER_WRITE_READ(r2, 0x40046208, &(0x7f00000002c0)={0x8, 0x0, &(0x7f00000000c0)=[@release], 0x0, 0x0, &(0x7f0000000300)}) 13:29:40 executing program 1: socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)) syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0xe1, 0x400100) creat(&(0x7f00000001c0)='./file0\x00', 0x2) openat$dsp(0xffffffffffffff9c, &(0x7f0000000200)='/dev/dsp\x00', 0x8000, 0x0) syz_open_dev$mouse(&(0x7f0000000240)='/dev/input/mouse#\x00', 0x100, 0x10000) syz_open_dev$amidi(&(0x7f0000000280)='/dev/amidi#\x00', 0x8000, 0xc0000) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000007000)={0x8, 0x0, &(0x7f0000000140)=[@acquire], 0x0, 0x0, &(0x7f00000001c0)}) r2 = dup2(r1, r0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000002c0)={0x8, 0x0, &(0x7f00000000c0)=[@release], 0x0, 0x0, &(0x7f0000000300)}) 13:29:40 executing program 0: r0 = socket$inet(0x2, 0x4000000803, 0x4) bind$inet(r0, &(0x7f0000000000)={0x2, 0x0, @broadcast}, 0x10) getsockname(r0, &(0x7f00000036c0)=@xdp={0x2c, 0x0, 0x0}, &(0x7f0000000080)=0x80) setsockopt$inet_pktinfo(r0, 0x0, 0x8, &(0x7f0000003780)={r1, @rand_addr, @dev}, 0xc) syz_emit_ethernet(0x4a, &(0x7f0000000240)={@link_local, @empty=[0x0, 0xfffffffffffff000], [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x3c, 0x0, 0x0, 0x0, 0x4, 0x0, @empty=0x9000000, @broadcast}, @udp={0x0, 0x0, 0x28}}}}}, &(0x7f0000000380)) 13:29:40 executing program 4: preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f00000000c0)=""/148, 0x94}], 0x1, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000080)='io\x00') preadv(r0, &(0x7f0000000480), 0x10000000000001d1, 0x0) 13:29:40 executing program 5: socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vcs\x00', 0x60000, 0x0) ioctl$VHOST_SET_VRING_ENDIAN(r1, 0x4008af13, &(0x7f0000000100)={0x0, 0x1}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) setsockopt$inet6_tcp_TLS_TX(r1, 0x6, 0x1, &(0x7f0000000140), 0x4) r2 = memfd_create(&(0x7f0000000080)="70726f63ae6d696d655f74797065776c616e316e6f64657600", 0x6) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x2000003, 0x5011, r2, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000000)=[@text64={0x40, &(0x7f0000000500)="0f0866b8ed008ec066ba4000b000eed2a807000000410f01cab98e0b0000b862000000ba000000000f30b90b0800000f320fc72a8f2a60128f00000000003000000fc7aa00100000", 0x48}], 0x1, 0x0, &(0x7f0000000040), 0x0) 13:29:40 executing program 3: socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)) syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0xe1, 0x400100) creat(&(0x7f00000001c0)='./file0\x00', 0x2) openat$dsp(0xffffffffffffff9c, &(0x7f0000000200)='/dev/dsp\x00', 0x8000, 0x0) syz_open_dev$mouse(&(0x7f0000000240)='/dev/input/mouse#\x00', 0x100, 0x10000) syz_open_dev$amidi(&(0x7f0000000280)='/dev/amidi#\x00', 0x8000, 0xc0000) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000007000)={0x8, 0x0, &(0x7f0000000140)=[@acquire], 0x0, 0x0, &(0x7f00000001c0)}) r2 = dup2(r1, r0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000002c0)={0x8, 0x0, &(0x7f00000000c0)=[@release], 0x0, 0x0, &(0x7f0000000300)}) 13:29:40 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000007000)={0x8, 0x0, &(0x7f0000000140)=[@acquire], 0x0, 0x0, &(0x7f00000001c0)}) r2 = dup2(r1, r0) ioctl$BINDER_WRITE_READ(r2, 0xc0045878, &(0x7f00000002c0)={0x8, 0x0, &(0x7f00000000c0)=[@release], 0x0, 0x0, &(0x7f0000000300)}) 13:29:40 executing program 1: socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)) syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0xe1, 0x400100) creat(&(0x7f00000001c0)='./file0\x00', 0x2) openat$dsp(0xffffffffffffff9c, &(0x7f0000000200)='/dev/dsp\x00', 0x8000, 0x0) syz_open_dev$mouse(&(0x7f0000000240)='/dev/input/mouse#\x00', 0x100, 0x10000) syz_open_dev$amidi(&(0x7f0000000280)='/dev/amidi#\x00', 0x8000, 0xc0000) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x8, 0x0, &(0x7f0000000140)=[@acquire], 0x0, 0x0, &(0x7f00000001c0)}) r1 = dup2(r0, 0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000002c0)={0x8, 0x0, &(0x7f00000000c0)=[@release], 0x0, 0x0, &(0x7f0000000300)}) 13:29:40 executing program 4: preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f00000000c0)=""/148, 0x94}], 0x1, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000080)='io\x00') preadv(r0, &(0x7f0000000480), 0x10000000000000a5, 0x0) 13:29:40 executing program 0: r0 = socket$inet(0x2, 0x4000000803, 0x4) bind$inet(r0, &(0x7f0000000000)={0x2, 0x0, @broadcast}, 0x10) getsockname(r0, &(0x7f00000036c0)=@xdp={0x2c, 0x0, 0x0}, &(0x7f0000000080)=0x80) setsockopt$inet_pktinfo(r0, 0x0, 0x8, &(0x7f0000003780)={r1, @rand_addr, @dev}, 0xc) syz_emit_ethernet(0x4a, &(0x7f0000000240)={@link_local, @empty=[0x0, 0x8035000000000000], [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x3c, 0x0, 0x0, 0x0, 0x4, 0x0, @empty=0x9000000, @broadcast}, @udp={0x0, 0x0, 0x28}}}}}, &(0x7f0000000380)) [ 539.504109] binder: BINDER_SET_CONTEXT_MGR already set 13:29:40 executing program 5: socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x5) r1 = openat$audio(0xffffffffffffff9c, &(0x7f00000005c0)='/dev/audio\x00', 0x90940, 0x0) getsockopt$inet6_IPV6_XFRM_POLICY(r1, 0x29, 0x23, &(0x7f00000006c0)={{{@in=@local, @in=@local}}, {{@in=@dev}, 0x0, @in=@local}}, &(0x7f00000007c0)=0xe8) getsockopt$IP6T_SO_GET_INFO(r1, 0x29, 0x40, &(0x7f0000000600)={'raw\x00'}, &(0x7f0000000680)=0x54) r2 = memfd_create(&(0x7f0000000080)="70726f63ae6d696d655f74797065776c616e316e6f64657600", 0x6) kexec_load(0x1, 0x6, &(0x7f0000000440)=[{&(0x7f0000000100)="f0ca25c8d2b81850c8ab2344dbf80d3b3de2109d8e1aec8a8e2bad273ea00624ae95957d3d4af646a716d5eb5cd2b982c4a98b9c7872664540477cbc9ec3740bca1a998b1dd17f5214162c28ee16297ea5d9e6464e08541eade5900998d57ffc5f990ff73bf321a46a7fd1004f493fde789c7421", 0x74, 0x2, 0x8}, {&(0x7f0000000180)="b34d66586660490a7fb627fd61b50497360a67bffc0a65f398efa287bb87f9d0875811d29c3cdfa0fc99b2ecb493b8bfcc1bbe17471ca0100295ef1808e397fe7c267cbc42bbd33e5c20810e6caf0644fa2ac64ed45e70646cbc8bc02b6f8ce33e9d2151f27ee2617e719295b8f268e6d92f6d6706680a7c8cbd4127fff1eb50660d01185c35c92df12a", 0x8a, 0x6, 0x5}, {&(0x7f0000000240)="fc0eeda08100c023793e5f3a277efedcda5ac595fe62b46317175151f4d180e407073baa40b3b02c206e460378d33c554ec5cb9f68c1b0f90be25f6f28eb6811af55a31a49d2fd5e92e8f50551fbb10e61068c962a19e6e8820d077a3e6a1d39d2e52d9c01e1fceff0c1df50c4671854c3507882458db6", 0x77, 0x100, 0xf4a2}, {&(0x7f0000000040)="6537326c416aadb0c12084d59561118f9b095e0b23a2880d99a661483a7474d893f42ebce88e76b673b2592e6b", 0x2d, 0x10001, 0x3}, {&(0x7f00000002c0)="0320b53c397b6b5305a0dde5a40dbaee6ebe1ab3d4d0396af5cac8b1c889261b654f9024390732666e8a9ba341b619b9c6fb4d1d186fd3198b1e94ecbcb0b06d5578bb44e6e6fe48b417a6182d3e866918040a8c27900184fb558e95dc96e4ab366153cc97b1a8e07827a0b408f8f23b8eb7a67d9ae6d8e05b56cb348239c6ec485c70a404353c5357503a4db33bc9c7a56bc66c17d956a02433e862993f294e901bc2d74124898831b50fd4e75b83c92bd5b2d6cc58c1a944a4f94f0491c62996b8cac24a54854af76b0557498a80cb696479356501438eb6d8", 0xda, 0x2, 0x7fff}, {&(0x7f00000003c0)="1b06bda5339ac301bb4acbc70c75c322d3d2a6595caffecb3761e82ad9c50c6ff8d0af9e741d0671d45ab947b39def80038a10079ce2ae73ad865d60a16e5cc909f24ddb9b4e0568c618fe027dd8cdbff1338948b3eb5d5629bc5bea6526fb06d296b29a51", 0x65, 0xffff, 0x3}], 0x3e0000) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x5011, r2, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000000)=[@text64={0x40, &(0x7f0000000500)="0f0866b8ed008ec066ba4000b000eed2a807000000410f01cab98e0b0000b862000000ba000000000f30b90b0800000f320fc72a8f2a60128f00000000003000000fc7aa00100000", 0x48}], 0x1, 0x0, &(0x7f0000000580)=[@cstype3={0x5, 0x4}, @vmwrite={0x8, 0x0, 0x4, 0x0, 0x5, 0x0, 0x7}], 0x2) [ 539.529295] binder: 25942:25951 Acquire 1 refcount change on invalid ref 0 ret -22 [ 539.529319] binder: 25942:25947 ioctl 40046207 0 returned -16 [ 539.540059] binder: 25944:25948 Acquire 1 refcount change on invalid ref 0 ret -22 13:29:40 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000007000)={0x8, 0x0, &(0x7f0000000140)=[@acquire], 0x0, 0x0, &(0x7f00000001c0)}) r2 = dup2(r1, r0) ioctl$BINDER_WRITE_READ(r2, 0xc018620c, &(0x7f00000002c0)={0x8, 0x0, &(0x7f00000000c0)=[@release], 0x0, 0x0, &(0x7f0000000300)}) 13:29:40 executing program 1: socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)) syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0xe1, 0x400100) creat(&(0x7f00000001c0)='./file0\x00', 0x2) openat$dsp(0xffffffffffffff9c, &(0x7f0000000200)='/dev/dsp\x00', 0x8000, 0x0) syz_open_dev$mouse(&(0x7f0000000240)='/dev/input/mouse#\x00', 0x100, 0x10000) syz_open_dev$amidi(&(0x7f0000000280)='/dev/amidi#\x00', 0x8000, 0xc0000) r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000007000)={0x8, 0x0, &(0x7f0000000140)=[@acquire], 0x0, 0x0, &(0x7f00000001c0)}) r2 = dup2(r1, r0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000002c0)={0x8, 0x0, &(0x7f00000000c0)=[@release], 0x0, 0x0, &(0x7f0000000300)}) 13:29:40 executing program 4: preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f00000000c0)=""/148, 0x94}], 0x1, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000080)='io\x00') preadv(r0, &(0x7f0000000480), 0x100000000000020e, 0x0) 13:29:41 executing program 3: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000400)='/dev/sequencer\x00', 0x0, 0x0) setsockopt$inet6_tcp_TCP_ULP(r0, 0x6, 0x1f, &(0x7f0000000200)='tls\x00', 0x4) fsetxattr(0xffffffffffffffff, &(0x7f0000000040)=@known='security.ima\x00', &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x26, 0x0) r1 = getpid() socketpair$unix(0x1, 0x1, 0x0, &(0x7f000064e000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$int_in(r2, 0x5452, &(0x7f00005ebff8)=0x3f) fcntl$setsig(r2, 0xa, 0x12) fcntl$setownex(r2, 0xf, &(0x7f0000704000)={0x0, r1}) getsockopt$inet_sctp_SCTP_DISABLE_FRAGMENTS(r0, 0x84, 0x8, &(0x7f0000000240), &(0x7f0000000280)=0x4) recvmsg(r3, &(0x7f000095cfc8)={&(0x7f0000893ff8)=@sco, 0x80, &(0x7f0000001280), 0x0, &(0x7f0000b30000)}, 0x0) ioctl$KVM_ASSIGN_PCI_DEVICE(r0, 0x8040ae69, &(0x7f00000002c0)={0x1, 0x9, 0x10000, 0x6, 0x5}) ptrace$setregset(0x4205, r1, 0x206, &(0x7f00000001c0)={&(0x7f00000000c0)="f6c7bebea85fc75064e8053d35be93f92cb3e8e165e526e2d0e09bf822dfc1003dc4ceefad4fb6b7e859b4cee52fa4b045935de1fb86f4c083b10829029059a3edb500122b7378956987d722045e7bbb9fa1ed6c277b09b008e1de1d8b22729b2d064c3c5c565a07e6755ba01f758744c2daf046219afe4aa5b3d568696366f83ba70ec4d3ff65dc54515625abf555f831b7d0e6427ca573e785a7066f666b1ce74822d56c891fed0a00df8e7ad4dc8e5938360d58f992e92e5e0ace0309cf526dea3d844ad4db722f8a26507adffa6e330b59587e84fbb2bc4ad7", 0xdb}) ptrace(0x4208, r1) dup2(r2, r3) tkill(r1, 0x15) ioctl$SNDRV_CTL_IOCTL_ELEM_LOCK(r0, 0x40405514, &(0x7f0000000000)={0x7, 0x3, 0x20, 0x6, 'syz0\x00', 0x745c9950}) 13:29:41 executing program 0: r0 = socket$inet(0x2, 0x4000000803, 0x4) bind$inet(r0, &(0x7f0000000000)={0x2, 0x0, @broadcast}, 0x10) getsockname(r0, &(0x7f00000036c0)=@xdp={0x2c, 0x0, 0x0}, &(0x7f0000000080)=0x80) setsockopt$inet_pktinfo(r0, 0x0, 0x8, &(0x7f0000003780)={r1, @rand_addr, @dev}, 0xc) syz_emit_ethernet(0x4a, &(0x7f0000000240)={@link_local, @empty=[0x0, 0x4305000000000000], [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x3c, 0x0, 0x0, 0x0, 0x4, 0x0, @empty=0x9000000, @broadcast}, @udp={0x0, 0x0, 0x28}}}}}, &(0x7f0000000380)) 13:29:41 executing program 5: socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = getpgid(0xffffffffffffffff) syz_open_procfs(r1, &(0x7f0000000040)='net/udplite6\x00') ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r2 = memfd_create(&(0x7f0000000080)="70726f63ae6d696d655f74797065776c616e316e6f64657600", 0x6) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x2000003, 0x5011, r2, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000000)=[@text64={0x40, &(0x7f0000000500)="0f0866b8ed008ec066ba4000b000eed2a807000000410f01cab98e0b0000b862000000ba000000000f30b90b0800000f320fc72a8f2a60128f00000000003000000fc7aa00100000", 0x48}], 0x1, 0x0, &(0x7f0000000040), 0x0) [ 539.765353] binder: 25965 BINDER_GET_NODE_INFO_FOR_REF: only handle may be non-zero. [ 539.765367] binder: 25965:25972 ioctl c018620c 200002c0 returned -22 [ 539.813242] binder: 25966:25973 Acquire 1 refcount change on invalid ref 0 ret -22 [ 539.841707] binder: 25966:25973 Release 1 refcount change on invalid ref 0 ret -22 13:29:41 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000007000)={0x8, 0x0, &(0x7f0000000140)=[@acquire], 0x0, 0x0, &(0x7f00000001c0)}) r2 = dup2(r1, r0) ioctl$BINDER_WRITE_READ(r2, 0x5460, &(0x7f00000002c0)={0x8, 0x0, &(0x7f00000000c0)=[@release], 0x0, 0x0, &(0x7f0000000300)}) 13:29:41 executing program 0: r0 = socket$inet(0x2, 0x4000000803, 0x4) bind$inet(r0, &(0x7f0000000000)={0x2, 0x0, @broadcast}, 0x10) getsockname(r0, &(0x7f00000036c0)=@xdp={0x2c, 0x0, 0x0}, &(0x7f0000000080)=0x80) setsockopt$inet_pktinfo(r0, 0x0, 0x8, &(0x7f0000003780)={r1, @rand_addr, @dev}, 0xc) syz_emit_ethernet(0x4a, &(0x7f0000000240)={@link_local, @empty=[0x0, 0x6488], [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x3c, 0x0, 0x0, 0x0, 0x4, 0x0, @empty=0x9000000, @broadcast}, @udp={0x0, 0x0, 0x28}}}}}, &(0x7f0000000380)) 13:29:41 executing program 1: socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)) syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0xe1, 0x400100) creat(&(0x7f00000001c0)='./file0\x00', 0x2) openat$dsp(0xffffffffffffff9c, &(0x7f0000000200)='/dev/dsp\x00', 0x8000, 0x0) syz_open_dev$mouse(&(0x7f0000000240)='/dev/input/mouse#\x00', 0x100, 0x10000) syz_open_dev$amidi(&(0x7f0000000280)='/dev/amidi#\x00', 0x8000, 0xc0000) r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000007000)={0x8, 0x0, &(0x7f0000000140)=[@acquire], 0x0, 0x0, &(0x7f00000001c0)}) r2 = dup2(r1, r0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000002c0)={0x8, 0x0, &(0x7f00000000c0)=[@release], 0x0, 0x0, &(0x7f0000000300)}) 13:29:41 executing program 4: preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f00000000c0)=""/148, 0x94}], 0x1, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000080)='io\x00') preadv(r0, &(0x7f0000000480), 0x1000000000000151, 0x0) 13:29:41 executing program 5: ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) r0 = memfd_create(&(0x7f0000000080)="70726f63ae6d696d655f74797065776c616e316e6f64657600", 0x6) getsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040), &(0x7f00000001c0)=0x14) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x2000003, 0x5011, r0, 0x0) ioctl$SNDRV_SEQ_IOCTL_DELETE_QUEUE(r0, 0x408c5333, &(0x7f0000000100)={0x81, 0x3b, 0x10001, 'queue0\x00', 0x7}) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000000)=[@text64={0x40, &(0x7f0000000500)="0f0866b8ed008ec066ba4000b000eed2a807000000410f01cab98e0b0000b862000000ba000000000f30b90b0800000f320fc72a8f2a60128f00000000003000000fc7aa00100000", 0x48}], 0x1, 0x0, &(0x7f0000000040), 0x0) 13:29:41 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000007000)={0x8, 0x0, &(0x7f0000000140)=[@acquire], 0x0, 0x0, &(0x7f00000001c0)}) r2 = dup2(r1, r0) ioctl$BINDER_WRITE_READ(r2, 0x5451, &(0x7f00000002c0)={0x8, 0x0, &(0x7f00000000c0)=[@release], 0x0, 0x0, &(0x7f0000000300)}) 13:29:41 executing program 0: r0 = socket$inet(0x2, 0x4000000803, 0x4) bind$inet(r0, &(0x7f0000000000)={0x2, 0x0, @broadcast}, 0x10) getsockname(r0, &(0x7f00000036c0)=@xdp={0x2c, 0x0, 0x0}, &(0x7f0000000080)=0x80) setsockopt$inet_pktinfo(r0, 0x0, 0x8, &(0x7f0000003780)={r1, @rand_addr, @dev}, 0xc) syz_emit_ethernet(0x4a, &(0x7f0000000240)={@link_local, @empty=[0x0, 0xe80], [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x3c, 0x0, 0x0, 0x0, 0x4, 0x0, @empty=0x9000000, @broadcast}, @udp={0x0, 0x0, 0x28}}}}}, &(0x7f0000000380)) [ 540.086318] binder: 25993:25998 Acquire 1 refcount change on invalid ref 0 ret -22 [ 540.109383] binder: 25993:25998 Release 1 refcount change on invalid ref 0 ret -22 13:29:41 executing program 5: r0 = socket$inet6_udp(0xa, 0x2, 0x0) connect$inet6(r0, &(0x7f0000000040)={0xa, 0x0, 0x0, @loopback}, 0x1c) syz_mount_image$ext4(&(0x7f0000000000)='ext2\x00', &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f0000000380), 0x0, &(0x7f0000000400)={[], [{@fscontext={'fscontext', 0x3d, 'staff_u'}}]}) r1 = openat$pfkey(0xffffffffffffff9c, &(0x7f0000000100)='/proc/self/net/pfkey\x00', 0x8000, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./file0\x00', 0x400000, 0x10) ioctl$sock_kcm_SIOCKCMATTACH(r1, 0x89e0, &(0x7f0000000180)={r0, r2}) ioctl$sock_SIOCOUTQ(r0, 0x5411, &(0x7f00000000c0)) r3 = socket$l2tp(0x18, 0x1, 0x1) r4 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r4, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070") connect$l2tp(r3, &(0x7f00005fafd2)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x0, @multicast2}, 0x4}}, 0xffffffffffffffb1) setsockopt$inet6_udp_int(r0, 0x11, 0x65, &(0x7f0000000480)=0x1ff, 0x4) write(r3, &(0x7f0000000300), 0x0) 13:29:41 executing program 1: socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)) syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0xe1, 0x400100) creat(&(0x7f00000001c0)='./file0\x00', 0x2) openat$dsp(0xffffffffffffff9c, &(0x7f0000000200)='/dev/dsp\x00', 0x8000, 0x0) syz_open_dev$mouse(&(0x7f0000000240)='/dev/input/mouse#\x00', 0x100, 0x10000) syz_open_dev$amidi(&(0x7f0000000280)='/dev/amidi#\x00', 0x8000, 0xc0000) r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000007000)={0x8, 0x0, &(0x7f0000000140)=[@acquire], 0x0, 0x0, &(0x7f00000001c0)}) r2 = dup2(r1, r0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000002c0)={0x8, 0x0, &(0x7f00000000c0)=[@release], 0x0, 0x0, &(0x7f0000000300)}) [ 540.266512] EXT4-fs (loop5): VFS: Can't find ext4 filesystem [ 540.328267] EXT4-fs (loop5): VFS: Can't find ext4 filesystem [ 540.329325] binder: 26018:26021 Acquire 1 refcount change on invalid ref 0 ret -22 [ 540.356244] binder: 26018:26021 Release 1 refcount change on invalid ref 0 ret -22 13:29:44 executing program 3: getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000caaffb)={0x0}, &(0x7f0000cab000)=0xc) setresuid(0x0, 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = dup2(r2, r1) ioctl$SNDRV_CTL_IOCTL_ELEM_INFO(0xffffffffffffffff, 0xc1105511, &(0x7f0000000280)={{0xa, 0x4aecbed4801dc417, 0x0, 0x0, 'syz1\x00', 0x9}, 0x1, 0x100, 0x1, r0, 0x4, 0x91, 'syz0\x00', &(0x7f0000000100)=['posix_acl_accessvmnet0\x00', '\x00', "2581657468313a5b6b657972696e677d5c4000", '\x00'], 0x2c}) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) getsockopt$inet_sctp6_SCTP_ASSOCINFO(0xffffffffffffffff, 0x84, 0x1, &(0x7f0000000000)={0x0, 0x20, 0xd5, 0x98c5, 0x80}, &(0x7f0000000040)=0x14) setsockopt$inet_sctp_SCTP_RESET_STREAMS(0xffffffffffffffff, 0x84, 0x77, &(0x7f0000000080)={0x0, 0x0, 0x2, [0x2, 0x7]}, 0xc) openat$snapshot(0xffffffffffffff9c, &(0x7f0000003640)='/dev/snapshot\x00', 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000000c0)='./cgroup.net/syz0\x00', 0x200002, 0x0) getuid() getgroups(0x0, &(0x7f0000000380)) shmctl$IPC_SET(0x0, 0x1, &(0x7f00000003c0)) r4 = openat$ion(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r4, 0xc0184900, &(0x7f0000000500)={0x10000009, 0xffffffffffffffff, 0x0, 0xffffffffffffffff}) bpf$OBJ_GET_PROG(0x7, &(0x7f0000000280)={&(0x7f0000000200)='./file0\x00'}, 0x10) ioctl$SG_GET_PACK_ID(0xffffffffffffffff, 0x227c, &(0x7f00000001c0)) mmap(&(0x7f0000bfe000/0x400000)=nil, 0x400000, 0x100000, 0x811, r5, 0x0) syz_genetlink_get_family_id$team(&(0x7f0000001b40)='team\x00') getsockopt$inet_mreqn(0xffffffffffffffff, 0x0, 0x0, &(0x7f00000020c0)={@multicast1, @remote}, &(0x7f0000002100)=0xc) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f00000017c0)={{{@in=@rand_addr, @in=@multicast1}}, {{@in=@loopback}, 0x0, @in6=@remote}}, &(0x7f0000002500)=0xe8) 13:29:44 executing program 4: preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f00000000c0)=""/148, 0x94}], 0x1, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000080)='io\x00') preadv(r0, &(0x7f0000000480), 0x100000000000004b, 0x0) 13:29:44 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000007000)={0x8, 0x0, &(0x7f0000000140)=[@acquire], 0x0, 0x0, &(0x7f00000001c0)}) r2 = dup2(r1, r0) ioctl$BINDER_WRITE_READ(r2, 0x40046207, &(0x7f00000002c0)={0x8, 0x0, &(0x7f00000000c0)=[@release], 0x0, 0x0, &(0x7f0000000300)}) 13:29:44 executing program 0: r0 = socket$inet(0x2, 0x4000000803, 0x4) bind$inet(r0, &(0x7f0000000000)={0x2, 0x0, @broadcast}, 0x10) getsockname(r0, &(0x7f00000036c0)=@xdp={0x2c, 0x0, 0x0}, &(0x7f0000000080)=0x80) setsockopt$inet_pktinfo(r0, 0x0, 0x8, &(0x7f0000003780)={r1, @rand_addr, @dev}, 0xc) syz_emit_ethernet(0x4a, &(0x7f0000000240)={@link_local, @empty=[0x0, 0x14], [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x3c, 0x0, 0x0, 0x0, 0x4, 0x0, @empty=0x9000000, @broadcast}, @udp={0x0, 0x0, 0x28}}}}}, &(0x7f0000000380)) 13:29:44 executing program 1: socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)) syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0xe1, 0x400100) creat(&(0x7f00000001c0)='./file0\x00', 0x2) openat$dsp(0xffffffffffffff9c, &(0x7f0000000200)='/dev/dsp\x00', 0x8000, 0x0) syz_open_dev$mouse(&(0x7f0000000240)='/dev/input/mouse#\x00', 0x100, 0x10000) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000007000)={0x8, 0x0, &(0x7f0000000140)=[@acquire], 0x0, 0x0, &(0x7f00000001c0)}) r2 = dup2(r1, r0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000002c0)={0x8, 0x0, &(0x7f00000000c0)=[@release], 0x0, 0x0, &(0x7f0000000300)}) 13:29:44 executing program 5: r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000100)='net/tcp6\x00') ioctl$TCSETAW(r1, 0x5407, &(0x7f00000000c0)={0xfffffffffffffffd, 0x401, 0x0, 0x8, 0x6, 0x0, 0x7, 0x9, 0x300000000, 0x11b}) r2 = socket$inet6(0xa, 0x1, 0x8010000000000084) ioctl$sock_inet_SIOCGIFDSTADDR(r2, 0x8917, &(0x7f0000000000)={'bpq0\x00', {0x2, 0x4e23, @multicast2}}) bind$inet6(r2, &(0x7f0000ef8cfd)={0xa, 0x4e23}, 0x1c) listen(r2, 0x4) r3 = socket$inet6_sctp(0xa, 0x1, 0x84) socket$inet6(0xa, 0x0, 0x0) mmap(&(0x7f0000003000/0x2000)=nil, 0x2000, 0x0, 0x1012, 0xffffffffffffffff, 0x0) write$tun(0xffffffffffffffff, &(0x7f0000000040)=ANY=[@ANYBLOB="286db4276c7501ab5fbcff"], 0x1) r4 = perf_event_open(&(0x7f0000000180)={0x6, 0x70}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mlockall(0x3) close(r4) sendto$inet6(r3, &(0x7f0000e33fe0)='X', 0x1, 0x0, &(0x7f000005ffe4)={0xa, 0x4e23, 0x0, @loopback}, 0x1c) write$binfmt_misc(r3, &(0x7f0000000140)=ANY=[], 0x0) connect$inet(r1, &(0x7f0000000200)={0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x20}}, 0x10) setgid(0x0) r5 = accept4(r2, 0x0, &(0x7f0000000040), 0x0) inotify_add_watch(r0, &(0x7f0000000080)='./file0\x00', 0x10000000) r6 = syz_open_dev$sndpcmp(&(0x7f0000000140)='/dev/snd/pcmC#D#p\x00', 0x0, 0x40800) ioctl$TIOCOUTQ(0xffffffffffffffff, 0x5411, &(0x7f0000000240)) r7 = syz_open_dev$dspn(&(0x7f00000000c0)='/dev/dsp#\x00', 0x1, 0x2) ioctl$int_in(r7, 0x80000040045010, &(0x7f0000000000)) write$binfmt_misc(r7, &(0x7f0000000200)=ANY=[@ANYBLOB="7f"], 0x1) ioctl$int_in(r7, 0x80000000005001, &(0x7f0000000000)) dup3(r0, r5, 0x80000) ioctl$SG_SET_DEBUG(r6, 0x227e, &(0x7f0000000280)) ioctl$GIO_SCRNMAP(r6, 0x4b40, &(0x7f0000000300)=""/233) [ 542.839842] binder: BINDER_SET_CONTEXT_MGR already set 13:29:44 executing program 4: preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f00000000c0)=""/148, 0x94}], 0x1, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000080)='io\x00') preadv(r0, &(0x7f0000000480), 0x10000000000000f8, 0x0) 13:29:44 executing program 0: r0 = socket$inet(0x2, 0x4000000803, 0x4) bind$inet(r0, &(0x7f0000000000)={0x2, 0x0, @broadcast}, 0x10) getsockname(r0, &(0x7f00000036c0)=@xdp={0x2c, 0x0, 0x0}, &(0x7f0000000080)=0x80) setsockopt$inet_pktinfo(r0, 0x0, 0x8, &(0x7f0000003780)={r1, @rand_addr, @dev}, 0xc) syz_emit_ethernet(0x4a, &(0x7f0000000240)={@link_local, @empty=[0x0, 0x806], [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x3c, 0x0, 0x0, 0x0, 0x4, 0x0, @empty=0x9000000, @broadcast}, @udp={0x0, 0x0, 0x28}}}}}, &(0x7f0000000380)) [ 542.864605] binder: 26031:26038 ioctl 40046207 0 returned -16 [ 542.868970] binder: 26033:26039 Acquire 1 refcount change on invalid ref 0 ret -22 [ 542.902472] binder: 26033:26039 Release 1 refcount change on invalid ref 0 ret -22 13:29:44 executing program 1: socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)) syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0xe1, 0x400100) creat(&(0x7f00000001c0)='./file0\x00', 0x2) openat$dsp(0xffffffffffffff9c, &(0x7f0000000200)='/dev/dsp\x00', 0x8000, 0x0) syz_open_dev$mouse(&(0x7f0000000240)='/dev/input/mouse#\x00', 0x100, 0x10000) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000007000)={0x8, 0x0, &(0x7f0000000140)=[@acquire], 0x0, 0x0, &(0x7f00000001c0)}) r2 = dup2(r1, r0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000002c0)={0x8, 0x0, &(0x7f00000000c0)=[@release], 0x0, 0x0, &(0x7f0000000300)}) 13:29:44 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000007000)={0x8, 0x0, &(0x7f0000000140)=[@acquire], 0x0, 0x0, &(0x7f00000001c0)}) r2 = dup2(r1, r0) ioctl$BINDER_WRITE_READ(r2, 0xc020660b, &(0x7f00000002c0)={0x8, 0x0, &(0x7f00000000c0)=[@release], 0x0, 0x0, &(0x7f0000000300)}) 13:29:44 executing program 3: r0 = socket(0x40000000001e, 0x1, 0x0) setsockopt(r0, 0x10f, 0x80, &(0x7f0000000040)="198b514f", 0x4) ioctl$sock_SIOCGIFCONF(r0, 0x8910, &(0x7f0000000080)=@buf={0x26, &(0x7f0000000000)="95a5991eb3b3d878934de9e21e9865d38425bacc921f547b1bd32132dbf919293b7e6f5375b1"}) [ 543.276753] binder: BINDER_SET_CONTEXT_MGR already set [ 543.307679] binder: 26061:26067 ioctl 40046207 0 returned -16 13:29:44 executing program 0: r0 = socket$inet(0x2, 0x4000000803, 0x4) bind$inet(r0, &(0x7f0000000000)={0x2, 0x0, @broadcast}, 0x10) getsockname(r0, &(0x7f00000036c0)=@xdp={0x2c, 0x0, 0x0}, &(0x7f0000000080)=0x80) setsockopt$inet_pktinfo(r0, 0x0, 0x8, &(0x7f0000003780)={r1, @rand_addr, @dev}, 0xc) syz_emit_ethernet(0x4a, &(0x7f0000000240)={@link_local, @empty=[0x0, 0x7], [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x3c, 0x0, 0x0, 0x0, 0x4, 0x0, @empty=0x9000000, @broadcast}, @udp={0x0, 0x0, 0x28}}}}}, &(0x7f0000000380)) 13:29:44 executing program 4: preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f00000000c0)=""/148, 0x94}], 0x1, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000080)='io\x00') preadv(r0, &(0x7f0000000480), 0x100000000000014c, 0x0) 13:29:44 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000007000)={0x8, 0x0, &(0x7f0000000140)=[@acquire], 0x0, 0x0, &(0x7f00000001c0)}) r2 = dup2(r1, r0) ioctl$BINDER_WRITE_READ(r2, 0x40046205, &(0x7f00000002c0)={0x8, 0x0, &(0x7f00000000c0)=[@release], 0x0, 0x0, &(0x7f0000000300)}) 13:29:44 executing program 3: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r0, &(0x7f0000000080)={0x2, 0x4e23, @dev}, 0x10) sendto$inet(r0, &(0x7f0000000000), 0x0, 0x200007fa, &(0x7f0000000140)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0x1e}}, 0x10) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000200)='sit0\x00', 0x10) bind$inet(r0, &(0x7f0000000040)={0x2, 0x4e20}, 0x10) r1 = syz_open_dev$loop(&(0x7f0000000000)='/dev/loop#\x00', 0x0, 0x0) socketpair$unix(0x1, 0x0, 0x0, &(0x7f0000000280)) tgkill(0x0, 0x0, 0x0) r2 = memfd_create(&(0x7f00000000c0)="000000008c00000000000000000000", 0x0) pwritev(r2, &(0x7f0000f50f90)=[{&(0x7f0000000100)="a8", 0x1}], 0x1, 0x81003) ioctl$LOOP_CHANGE_FD(r1, 0x4c00, r2) sendfile(r0, r1, &(0x7f00000ddff8), 0x102000002) ioctl$KVM_GET_PIT2(0xffffffffffffffff, 0x8070ae9f, &(0x7f0000000540)) 13:29:44 executing program 1: socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)) syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0xe1, 0x400100) creat(&(0x7f00000001c0)='./file0\x00', 0x2) openat$dsp(0xffffffffffffff9c, &(0x7f0000000200)='/dev/dsp\x00', 0x8000, 0x0) syz_open_dev$mouse(&(0x7f0000000240)='/dev/input/mouse#\x00', 0x100, 0x10000) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000007000)={0x8, 0x0, &(0x7f0000000140)=[@acquire], 0x0, 0x0, &(0x7f00000001c0)}) r2 = dup2(r1, r0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000002c0)={0x8, 0x0, &(0x7f00000000c0)=[@release], 0x0, 0x0, &(0x7f0000000300)}) 13:29:44 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000007000)={0x8, 0x0, &(0x7f0000000140)=[@acquire], 0x0, 0x0, &(0x7f00000001c0)}) r2 = dup2(r1, r0) ioctl$BINDER_WRITE_READ(r2, 0xc0189436, &(0x7f00000002c0)={0x8, 0x0, &(0x7f00000000c0)=[@release], 0x0, 0x0, &(0x7f0000000300)}) 13:29:45 executing program 5: r0 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_int(r0, 0x107, 0x1a, &(0x7f0000210000)=0x2, 0x4) setsockopt$packet_rx_ring(r0, 0x107, 0x5, &(0x7f00000000c0)=@req3={0x1000, 0xffffffffffff8000, 0x0, 0x0, 0x0, 0x15c7}, 0x1c) 13:29:45 executing program 4: preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f00000000c0)=""/148, 0x94}], 0x1, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000080)='io\x00') preadv(r0, &(0x7f0000000480), 0x1000000000000099, 0x0) 13:29:45 executing program 0: r0 = socket$inet(0x2, 0x4000000803, 0x4) bind$inet(r0, &(0x7f0000000000)={0x2, 0x0, @broadcast}, 0x10) getsockname(r0, &(0x7f00000036c0)=@xdp={0x2c, 0x0, 0x0}, &(0x7f0000000080)=0x80) setsockopt$inet_pktinfo(r0, 0x0, 0x8, &(0x7f0000003780)={r1, @rand_addr, @dev}, 0xc) syz_emit_ethernet(0x4a, &(0x7f0000000240)={@link_local, @empty=[0x0, 0x3c00], [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x3c, 0x0, 0x0, 0x0, 0x4, 0x0, @empty=0x9000000, @broadcast}, @udp={0x0, 0x0, 0x28}}}}}, &(0x7f0000000380)) 13:29:45 executing program 1: socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)) syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0xe1, 0x400100) creat(&(0x7f00000001c0)='./file0\x00', 0x2) openat$dsp(0xffffffffffffff9c, &(0x7f0000000200)='/dev/dsp\x00', 0x8000, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000007000)={0x8, 0x0, &(0x7f0000000140)=[@acquire], 0x0, 0x0, &(0x7f00000001c0)}) r2 = dup2(r1, r0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000002c0)={0x8, 0x0, &(0x7f00000000c0)=[@release], 0x0, 0x0, &(0x7f0000000300)}) 13:29:45 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000007000)={0x8, 0x0, &(0x7f0000000140)=[@acquire], 0x0, 0x0, &(0x7f00000001c0)}) r2 = dup2(r1, r0) ioctl$BINDER_WRITE_READ(r2, 0x5452, &(0x7f00000002c0)={0x8, 0x0, &(0x7f00000000c0)=[@release], 0x0, 0x0, &(0x7f0000000300)}) 13:29:45 executing program 3: socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)) syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0xe1, 0x400100) creat(&(0x7f00000001c0)='./file0\x00', 0x2) openat$dsp(0xffffffffffffff9c, &(0x7f0000000200)='/dev/dsp\x00', 0x8000, 0x0) syz_open_dev$mouse(&(0x7f0000000240)='/dev/input/mouse#\x00', 0x100, 0x10000) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000007000)={0x8, 0x0, &(0x7f0000000140)=[@acquire], 0x0, 0x0, &(0x7f00000001c0)}) r2 = dup2(r1, r0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000002c0)={0x8, 0x0, &(0x7f00000000c0)=[@release], 0x0, 0x0, &(0x7f0000000300)}) 13:29:45 executing program 3: socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)) syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0xe1, 0x400100) creat(&(0x7f00000001c0)='./file0\x00', 0x2) openat$dsp(0xffffffffffffff9c, &(0x7f0000000200)='/dev/dsp\x00', 0x8000, 0x0) syz_open_dev$mouse(&(0x7f0000000240)='/dev/input/mouse#\x00', 0x100, 0x10000) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000007000)={0x8, 0x0, &(0x7f0000000140)=[@acquire], 0x0, 0x0, &(0x7f00000001c0)}) r2 = dup2(r1, r0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000002c0)={0x8, 0x0, &(0x7f00000000c0)=[@release], 0x0, 0x0, &(0x7f0000000300)}) 13:29:45 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000007000)={0x8, 0x0, &(0x7f0000000140)=[@acquire], 0x0, 0x0, &(0x7f00000001c0)}) r2 = dup2(r1, r0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000002c0)={0x8, 0xffffffffa0010000, &(0x7f00000000c0)=[@release], 0x0, 0x0, &(0x7f0000000300)}) 13:29:45 executing program 4: preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f00000000c0)=""/148, 0x94}], 0x1, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000080)='io\x00') preadv(r0, &(0x7f0000000480), 0x100000000000001d, 0x0) 13:29:45 executing program 0: r0 = socket$inet(0x2, 0x4000000803, 0x4) bind$inet(r0, &(0x7f0000000000)={0x2, 0x0, @broadcast}, 0x10) getsockname(r0, &(0x7f00000036c0)=@xdp={0x2c, 0x0, 0x0}, &(0x7f0000000080)=0x80) setsockopt$inet_pktinfo(r0, 0x0, 0x8, &(0x7f0000003780)={r1, @rand_addr, @dev}, 0xc) syz_emit_ethernet(0x4a, &(0x7f0000000240)={@link_local, @empty=[0x0, 0x608], [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x3c, 0x0, 0x0, 0x0, 0x4, 0x0, @empty=0x9000000, @broadcast}, @udp={0x0, 0x0, 0x28}}}}}, &(0x7f0000000380)) 13:29:45 executing program 1: socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)) syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0xe1, 0x400100) creat(&(0x7f00000001c0)='./file0\x00', 0x2) openat$dsp(0xffffffffffffff9c, &(0x7f0000000200)='/dev/dsp\x00', 0x8000, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000007000)={0x8, 0x0, &(0x7f0000000140)=[@acquire], 0x0, 0x0, &(0x7f00000001c0)}) r2 = dup2(r1, r0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000002c0)={0x8, 0x0, &(0x7f00000000c0)=[@release], 0x0, 0x0, &(0x7f0000000300)}) 13:29:45 executing program 5: socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)) syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0xe1, 0x400100) creat(&(0x7f00000001c0)='./file0\x00', 0x2) openat$dsp(0xffffffffffffff9c, &(0x7f0000000200)='/dev/dsp\x00', 0x8000, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000007000)={0x8, 0x0, &(0x7f0000000140)=[@acquire], 0x0, 0x0, &(0x7f00000001c0)}) r2 = dup2(r1, r0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000002c0)={0x8, 0x0, &(0x7f00000000c0)=[@release], 0x0, 0x0, &(0x7f0000000300)}) 13:29:45 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000007000)={0x8, 0x0, &(0x7f0000000140)=[@acquire], 0x0, 0x0, &(0x7f00000001c0)}) r2 = dup2(r1, r0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000002c0)={0x8, 0xa0010000, &(0x7f00000000c0)=[@release], 0x0, 0x0, &(0x7f0000000300)}) 13:29:45 executing program 4: preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f00000000c0)=""/148, 0x94}], 0x1, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000080)='io\x00') preadv(r0, &(0x7f0000000480), 0x100000000000000b, 0x0) 13:29:45 executing program 0: r0 = socket$inet(0x2, 0x4000000803, 0x4) bind$inet(r0, &(0x7f0000000000)={0x2, 0x0, @broadcast}, 0x10) getsockname(r0, &(0x7f00000036c0)=@xdp={0x2c, 0x0, 0x0}, &(0x7f0000000080)=0x80) setsockopt$inet_pktinfo(r0, 0x0, 0x8, &(0x7f0000003780)={r1, @rand_addr, @dev}, 0xc) syz_emit_ethernet(0x4a, &(0x7f0000000240)={@link_local, @empty=[0x0, 0x6], [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x3c, 0x0, 0x0, 0x0, 0x4, 0x0, @empty=0x9000000, @broadcast}, @udp={0x0, 0x0, 0x28}}}}}, &(0x7f0000000380)) 13:29:45 executing program 3: socketpair(0x8000000000001e, 0x5, 0x0, &(0x7f000000dff8)={0xffffffffffffffff, 0xffffffffffffffff}) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = socket(0x2, 0x802, 0x0) r3 = openat$qat_adf_ctl(0xffffffffffffff9c, &(0x7f0000000100)='/dev/qat_adf_ctl\x00', 0x40, 0x0) ioctl$KVM_GET_VCPU_EVENTS(r1, 0x8040ae9f, &(0x7f0000000140)) bind$inet(r2, &(0x7f0000000080)={0x2, 0x0, @local}, 0x10) connect$inet(r0, &(0x7f0000000000)={0x2, 0x0, @local}, 0x1) r4 = syz_open_dev$admmidi(&(0x7f0000000040)='/dev/admmidi#\x00', 0x6, 0x40) ioctl$KVM_GET_NR_MMU_PAGES(r4, 0xae45, 0x5) connect$inet(r4, &(0x7f00000001c0)={0x2, 0x4e20, @rand_addr=0x7}, 0x10) ioctl$EVIOCGABS3F(r0, 0x8018457f, &(0x7f0000000840)=""/163) clock_gettime(0x0, &(0x7f0000000740)={0x0, 0x0}) recvmmsg(r3, &(0x7f0000000700)=[{{0x0, 0x0, &(0x7f0000000640)=[{&(0x7f0000000580)=""/146, 0x92}], 0x1, &(0x7f0000000680)=""/113, 0x71, 0x1ff}, 0x8}], 0x1, 0x103, &(0x7f0000000780)={r5, r6+30000000}) setsockopt$IP_VS_SO_SET_STARTDAEMON(r2, 0x0, 0x48b, &(0x7f00000000c0)={0x1, 'ip6tnl0\x00', 0x2}, 0x18) getsockname(r4, &(0x7f00000004c0)=@pppol2tpv3in6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @dev}}}, &(0x7f0000000540)=0x80) r7 = open(&(0x7f0000074000)='./file0\x00', 0x141046, 0x0) openat$vnet(0xffffffffffffff9c, &(0x7f0000000180)='/dev/vhost-net\x00', 0x2, 0x0) setsockopt$sock_void(r4, 0x1, 0x24, 0x0, 0x0) getsockopt$inet_sctp_SCTP_GET_ASSOC_ID_LIST(r7, 0x84, 0x1d, &(0x7f00000007c0)=ANY=[@ANYBLOB="8200b82af76b0e30b8e3274d552ace47cfc919dc9eaad09c26529f2364b09fadafc576119e294d177ec3c49c4c89918800a4be47642acfa2ee6d912300000000000000000000a103000013a8c8deb376fef58f9b12", @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES32=0x0], &(0x7f0000000200)=0x5) getsockopt$inet_sctp6_SCTP_CONTEXT(r3, 0x84, 0x11, &(0x7f0000000240)={r8, 0xffff}, &(0x7f0000000280)=0x8) ioctl$SNDRV_SEQ_IOCTL_GET_PORT_INFO(r3, 0xc0a45322, &(0x7f00000002c0)) ftruncate(r7, 0x8007ffc) sendfile(r2, r7, 0x0, 0x45a3) writev(0xffffffffffffffff, &(0x7f0000000100), 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x0, 0x0, &(0x7f00000000c0)) writev(r0, &(0x7f000063e000)=[{&(0x7f0000a66000)="da", 0x1}], 0x1) setsockopt$sock_attach_bpf(0xffffffffffffffff, 0x1, 0x32, &(0x7f00000001c0)=r7, 0x4) sendmmsg$alg(0xffffffffffffffff, &(0x7f0000000180), 0x0, 0xfffffffffffffffd) read(r1, &(0x7f0000000000)=""/253, 0xfd) 13:29:45 executing program 1: socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)) syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0xe1, 0x400100) creat(&(0x7f00000001c0)='./file0\x00', 0x2) openat$dsp(0xffffffffffffff9c, &(0x7f0000000200)='/dev/dsp\x00', 0x8000, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000007000)={0x8, 0x0, &(0x7f0000000140)=[@acquire], 0x0, 0x0, &(0x7f00000001c0)}) r2 = dup2(r1, r0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000002c0)={0x8, 0x0, &(0x7f00000000c0)=[@release], 0x0, 0x0, &(0x7f0000000300)}) 13:29:45 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000007000)={0x8, 0x0, &(0x7f0000000140)=[@acquire], 0x0, 0x0, &(0x7f00000001c0)}) r2 = dup2(r1, r0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000002c0)={0x8, 0x1000000, &(0x7f00000000c0)=[@release], 0x0, 0x0, &(0x7f0000000300)}) [ 544.538376] binder_thread_write: 10 callbacks suppressed [ 544.538789] binder: 26139:26140 Release 1 refcount change on invalid ref 0 ret -22 13:29:45 executing program 5: setrlimit(0x400000000000007, &(0x7f0000000000)) epoll_create1(0x0) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000000580)={{{@in=@broadcast, @in6=@loopback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@local}, 0x0, @in=@dev}}, &(0x7f0000000680)=0xe8) socketpair(0xd, 0x4, 0x400, &(0x7f0000000740)={0xffffffffffffffff, 0xffffffffffffffff}) getsockopt$inet_sctp6_SCTP_PARTIAL_DELIVERY_POINT(0xffffffffffffffff, 0x84, 0x13, &(0x7f0000000780)={0x0, 0x12d}, &(0x7f00000007c0)=0x8) setsockopt$inet_sctp6_SCTP_ASSOCINFO(r1, 0x84, 0x1, &(0x7f0000000800)={r2, 0x6, 0xffffffff, 0x4, 0x3, 0x8}, 0x14) r3 = add_key(&(0x7f00000006c0)='cifs.spnego\x00', &(0x7f0000000700)={'syz', 0x0}, 0x0, 0x0, 0xfffffffffffffff8) r4 = request_key(&(0x7f00000008c0)='blacklist\x00', &(0x7f0000000900)={'syz', 0x0}, &(0x7f0000000940)='\x00', 0xfffffffffffffffe) keyctl$unlink(0x9, r3, r4) syz_mount_image$hfsplus(&(0x7f0000000040)='hfsplus\x00', &(0x7f0000000080)='./file0\x00', 0x698a, 0x6, &(0x7f00000004c0)=[{&(0x7f00000000c0)="49dbcd235e78f1fa706c3f9fee38a47eb0f8a98e36f36c0aa932bf858fad1e4e51eb980e", 0x24, 0x4}, {&(0x7f0000000100)="92606f418ec59875e822a6190f1eef36d4040a22791bbc0fc9a61ee61303779be5fc8469c03521e5ef7be9e5b594a4358625b0985b5a2591dd8ab4f42bb105ba0d2a3e42291a96266ce6ba488a27aaa3f795d65ee83a784093930678c6bd3596", 0x60, 0x7fffffff}, {&(0x7f0000000180)="17a8278647eaccad4156325022c4207403ebbca6307555017a0891f6c064fbf35e8a279845d1748edb9737a4faafa924126109373315ffe725557a8f0d44233c0fe12d848c182fefcf656169cb7e4f63d7b4f84c0aca35ef374b3d6b293375d8ac834969e9f56848774420e19e4172f35d968196008b1bf23d6fe966b01b04158cb65c82b273601c123de2b256f4b707d587d031baf3ea27acfb34addf69a1735a1e63a9e2cf4f4421dde57ce701744f0ea836d2fe81aeaa408e6c2565e3c4bc851d548b665a0a64e576fe25166b079f0ed2584ead73c81b385c282c53445e25e55eab2c3db34a6876", 0xe9, 0x7}, {&(0x7f0000000280)="b10e7db4f6d0d9fa43429a5a4ebf7a642aa2782a390c7950180f639c20e23a717783b24bf064ab031038b0145349778f417da1094aff6dd91d397ac201268d10094eeed081f19b83e14f0d8e11bc9c56402920739743c5570fe533342426ac2def7922a67cde9f3e6e8398a686b57133839b36fbf484e7dde0bfb0d85c2b452464f7c3b21760d2fd02437210988fca8c49a96c406b2b548607a78126b756784bf1e2caf0c3d7cccdb5ca7373be76ed8e0c3405ec7cd455a59a5f8e4b", 0xbc, 0x3}, {&(0x7f0000000340)="e0cb019ea07b7cf20d5f21b676c9e837bf7e287325c52ab3b601330623347718c4f7a5f9f99c89f4af1dc0fa3d937bdd01816df958c956ab7918eb53cba24fcce08c9d46aad7b805a4ea8bb92463ca1d9ca42da4de0465bbb6165d88208310b57ba2d4f275d481d098be06d2b65a5c3947f025ead0b4a8940b39e526024336a9520f040d97175f629558279273ca51d9157a24e8315940374806514f305db9f0dea92eb45fd9106a1e5eb10fc3", 0xad, 0x7f}, {&(0x7f0000000400)="a1d3ba6aa62a741f40416770498561e671b6703d581ea3ae8b9008848befad943ae76cbf42b3dcee53e19f566a127adc82378e6adb92882c1f665608f2c69c3216333ff10ed9c442058010b7b1c48df1d7cbb87eb3cd2a3125a596d5344916e59b5d914fd214140d4b7e374b991ab194ae9063d1054992d991f9ca3758c20b377f3b4ba3d5c8cfc564ad98f56b95a554fd048be3", 0x94, 0x9f}], 0x0, &(0x7f0000000840)=ANY=[@ANYBLOB='session=0xfffffffffffffffd,smackfsdef=@,euid<', @ANYRESDEC=r0, @ANYBLOB="ac009b6034b897ca6827f29d5c11fa1f0ed0fda2cff8295c99f3060fc679e21cc1215f10b75ba51708814c5957abf620195f5e014fc6e335a831351fcbbcba"]) ioctl$NBD_DISCONNECT(r1, 0xab08) 13:29:45 executing program 0: r0 = socket$inet(0x2, 0x4000000803, 0x4) bind$inet(r0, &(0x7f0000000000)={0x2, 0x0, @broadcast}, 0x10) getsockname(r0, &(0x7f00000036c0)=@xdp={0x2c, 0x0, 0x0}, &(0x7f0000000080)=0x80) setsockopt$inet_pktinfo(r0, 0x0, 0x8, &(0x7f0000003780)={r1, @rand_addr, @dev}, 0xc) syz_emit_ethernet(0x4a, &(0x7f0000000240)={@link_local, @empty=[0x0, 0x4000000000000000], [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x3c, 0x0, 0x0, 0x0, 0x4, 0x0, @empty=0x9000000, @broadcast}, @udp={0x0, 0x0, 0x28}}}}}, &(0x7f0000000380)) 13:29:46 executing program 4: preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f00000000c0)=""/148, 0x94}], 0x1, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000080)='io\x00') preadv(r0, &(0x7f0000000480), 0x1000000000000259, 0x0) [ 544.639353] binder: 26150:26154 Acquire 1 refcount change on invalid ref 0 ret -22 [ 544.656531] QAT: Invalid ioctl [ 544.674903] IPVS: sync thread started: state = MASTER, mcast_ifn = ip6tnl0, syncid = 2, id = 0 [ 544.709325] binder: 26150:26154 Release 1 refcount change on invalid ref 0 ret -22 13:29:46 executing program 5: perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x80003, 0x800000000000006) ioctl(r0, 0x8912, &(0x7f0000000040)="853f6234488dd25d766070") r1 = msgget$private(0x0, 0x0) msgrcv(r1, &(0x7f0000000100)=ANY=[@ANYBLOB="0000000004000000000000000000000000000000000000000000000000000000000000008a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000095cd00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000"], 0xc8, 0x1, 0x1000) msgsnd(r1, &(0x7f0000000200)=ANY=[@ANYBLOB="010061000000edd3a263ad5c2dcfef840000"], 0x2000, 0x0) [ 544.760794] QAT: Invalid ioctl 13:29:46 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000007000)={0x8, 0x0, &(0x7f0000000140)=[@acquire], 0x0, 0x0, &(0x7f00000001c0)}) r2 = dup2(r1, r0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000002c0)={0x8, 0x3f00, &(0x7f00000000c0)=[@release], 0x0, 0x0, &(0x7f0000000300)}) 13:29:46 executing program 1: socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)) syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0xe1, 0x400100) creat(&(0x7f00000001c0)='./file0\x00', 0x2) syz_open_dev$mouse(&(0x7f0000000240)='/dev/input/mouse#\x00', 0x100, 0x10000) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000007000)={0x8, 0x0, &(0x7f0000000140)=[@acquire], 0x0, 0x0, &(0x7f00000001c0)}) r2 = dup2(r1, r0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000002c0)={0x8, 0x0, &(0x7f00000000c0)=[@release], 0x0, 0x0, &(0x7f0000000300)}) 13:29:46 executing program 0: r0 = socket$inet(0x2, 0x4000000803, 0x4) bind$inet(r0, &(0x7f0000000000)={0x2, 0x0, @broadcast}, 0x10) getsockname(r0, &(0x7f00000036c0)=@xdp={0x2c, 0x0, 0x0}, &(0x7f0000000080)=0x80) setsockopt$inet_pktinfo(r0, 0x0, 0x8, &(0x7f0000003780)={r1, @rand_addr, @dev}, 0xc) syz_emit_ethernet(0x4a, &(0x7f0000000240)={@link_local, @empty=[0x0, 0x8848], [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x3c, 0x0, 0x0, 0x0, 0x4, 0x0, @empty=0x9000000, @broadcast}, @udp={0x0, 0x0, 0x28}}}}}, &(0x7f0000000380)) 13:29:46 executing program 3: mkdir(&(0x7f0000fd5ff8)='./file0\x00', 0x102) mount$bpf(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f0000000100)='bpf\x00', 0x0, &(0x7f0000000280)={[{@mode={'mode', 0x3d, 0xffffffff7fffffff}}]}) mount(&(0x7f0000000200), &(0x7f0000000040)='./file0\x00', &(0x7f0000000140)='tracefs\x00', 0x0, &(0x7f0000000280)) 13:29:46 executing program 4: preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f00000000c0)=""/148, 0x94}], 0x1, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000080)='io\x00') preadv(r0, &(0x7f0000000480), 0x1000000000000039, 0x0) 13:29:46 executing program 0: r0 = socket$inet(0x2, 0x4000000803, 0x4) bind$inet(r0, &(0x7f0000000000)={0x2, 0x0, @broadcast}, 0x10) getsockname(r0, &(0x7f00000036c0)=@xdp={0x2c, 0x0, 0x0}, &(0x7f0000000080)=0x80) setsockopt$inet_pktinfo(r0, 0x0, 0x8, &(0x7f0000003780)={r1, @rand_addr, @dev}, 0xc) syz_emit_ethernet(0x4a, &(0x7f0000000240)={@link_local, @empty=[0x0, 0x8060000], [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x3c, 0x0, 0x0, 0x0, 0x4, 0x0, @empty=0x9000000, @broadcast}, @udp={0x0, 0x0, 0x28}}}}}, &(0x7f0000000380)) 13:29:46 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000007000)={0x8, 0x0, &(0x7f0000000140)=[@acquire], 0x0, 0x0, &(0x7f00000001c0)}) r2 = dup2(r1, r0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000002c0)={0x8, 0xfffffdfd, &(0x7f00000000c0)=[@release], 0x0, 0x0, &(0x7f0000000300)}) [ 544.947774] binder: 26187:26188 Acquire 1 refcount change on invalid ref 0 ret -22 13:29:46 executing program 4: preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f00000000c0)=""/148, 0x94}], 0x1, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000080)='io\x00') preadv(r0, &(0x7f0000000480), 0x1000000000000109, 0x0) [ 545.003742] binder: 26187:26188 Release 1 refcount change on invalid ref 0 ret -22 13:29:46 executing program 3: r0 = socket$nl_xfrm(0x11, 0x3, 0x6) recvmsg(r0, &(0x7f00000001c0)={&(0x7f0000000000)=@nl=@unspec, 0x80, &(0x7f0000000140)=[{&(0x7f0000000080)=""/145, 0x91}], 0x1, &(0x7f0000000240)=""/201, 0xc9, 0xffffffffffffffc0}, 0x2000) setsockopt$packet_fanout(r0, 0x107, 0x12, &(0x7f0000000180)={0x0, 0x6}, 0x4) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x0, 0x32, 0xffffffffffffffff, 0x0) setsockopt$packet_fanout_data(r0, 0x107, 0x16, &(0x7f0000000200)={0x0, &(0x7f00000001c0)}, 0x10) 13:29:46 executing program 0: r0 = socket$inet(0x2, 0x4000000803, 0x4) bind$inet(r0, &(0x7f0000000000)={0x2, 0x0, @broadcast}, 0x10) getsockname(r0, &(0x7f00000036c0)=@xdp={0x2c, 0x0, 0x0}, &(0x7f0000000080)=0x80) setsockopt$inet_pktinfo(r0, 0x0, 0x8, &(0x7f0000003780)={r1, @rand_addr, @dev}, 0xc) syz_emit_ethernet(0x4a, &(0x7f0000000240)={@link_local, @empty=[0x0, 0x28000000], [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x3c, 0x0, 0x0, 0x0, 0x4, 0x0, @empty=0x9000000, @broadcast}, @udp={0x0, 0x0, 0x28}}}}}, &(0x7f0000000380)) 13:29:46 executing program 1: socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)) syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0xe1, 0x400100) creat(&(0x7f00000001c0)='./file0\x00', 0x2) syz_open_dev$mouse(&(0x7f0000000240)='/dev/input/mouse#\x00', 0x100, 0x10000) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000007000)={0x8, 0x0, &(0x7f0000000140)=[@acquire], 0x0, 0x0, &(0x7f00000001c0)}) r2 = dup2(r1, r0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000002c0)={0x8, 0x0, &(0x7f00000000c0)=[@release], 0x0, 0x0, &(0x7f0000000300)}) [ 545.210739] binder: 26215:26218 Acquire 1 refcount change on invalid ref 0 ret -22 [ 545.228971] binder: 26215:26218 Release 1 refcount change on invalid ref 0 ret -22 13:29:47 executing program 5: bpf$MAP_LOOKUP_ELEM(0x1, &(0x7f0000000100)={0xffffffffffffffff, &(0x7f00000002c0)="0091fe9af457bf310e4caff8df6c5ea31a8dbe033fda29909080ce8236b4034be54f6353a1ea86bce9019eb5056bed1eaa5afb68e6951941fa381febcde17bf673dcdb7913f73ff6fe3c920fb89dec8047279c1a031853571f8001f022b1ceb9b8ff4adc6c61238c0e565127abea4ab15e733f49b9cd5551fc6a580d541a3199b1e69f664e6d4968f39897c7808834b14c5c90fdd67f487c6bc7bf4cf6847f43e565ee4846777564d6cfeb95605fa42b5ff7b4cbb06cd99204692cb6457f54f43e036cefa0805fb30f57b58ecf47c937c493d3e8ed5eed4f70e98390ef0e7dcc6353aecfd9297359750caa3557bb283b2a99905726335ff68868d2adc01def5afbfebb718c641ba2e5a783296af7e528197b8d2b708ea2ee3642485beb8c3930887f79d5dcf4d97df272fc50f3e5f1d4379f1e1e16e19a53148bdc22b779f935511b566609b02e4aa371b73965d71fef95fa69cf6338af32c9117cc79226501e2401ee97163dec44f09ae4984b2ec721ea87679b56cb0f8ae3a59dbd55e820cef7234be935d4be5a574a1eb9d4d62264a03dc34cda8ffa24b4a068c91abdbe4f3c7db820117ebc95c78b63f0afcf8e04b918d9b64f9d001f8ff49453261acd5370a083fb99e21173af30442ca59fb1770f6e5e5d10b5a6121252e1e30ce5b4ce967988d5238af3f175e1673bcc826e53d874119ea82a9c2bb3102d24380b3384ea89827ebd7cb75c9d02ba1949c3356e52739aeecacbc13ee764d50a6ba410bc6820a9f18ceab1b30a1484733f43994c971a73b7c2e9cbb28874a18a3be3028fe46cf13af317a21bd7608e7b83c85d4fe3e6279c924e6078efb5370b6ec247208093955e262269bd7f790a5c33f1c96aabe2052d7140cd7cc5be1c1b4c4e79ac704ddb0886dc87f98c825aa2284206cb29f38b317e4f16b9937735ec9a4fcd96407bb6d7431985f96146b02167073d0677d997bc3964d6db15c87b85a27e89460404f5451873290f75e11c3f3d71cb2cc7b0e93dc8ee340ede073e9946d639625eafd5acca5a1e9aaaa91a616b4096012a27775e546b065fb9342d5dc04cc553b9c7bd57151d8e72fb9fa58d84dd37937b9f5433ea960ebbc5cab800999eb77472bf633a6e2a7fd0969df2a55234dbd44f3b0996507a39219d8ea47481bc0ffca045ea4ce1364241be32a9f945641e2c2974c3176d530d2b84a90d4e997322584d9f57b300aef1462073dea20354eb609b0ebe06edc911a0ffc7d4f5e96d2152ea24b8e1214bbdc0efc10f10003e23b04c8f6bf2e920309c8468a4121b217858e67f5a94e1ac99ba2a4bb19bc4ba3f6291aa4a1a0ff24c4f0ade0d4247b72562076570aef926a9c676f960c6b3699f74ce6ba04b1128fd0db4139e71275e40c34f12991e1287498c58fdc01270693ad99f21fbaf3cc47ed23a1373341f2a90d37ee24788dc1000cdea1c25dd2d4f517f6b927d0df4163c1e678ff2cca85231a733ff9bee16fc0abeec0af65ea04a16c7e3d01c74f0153c91227780fe8a0602724dd7112d21446baf0304ca71f6ef10e871b1e492767d61f652ec57e20579e809b6abf2819325afaa2d3ec25712cee275cce78d227ec1ecd9aaf57e49471411538144004bf09e7d1bb4843a133982b9b96c5ddc7bcaedfd4534904c4af303cd071d3dc95f098c3c07fc12e427db79715b3e0d1bece34225896f6256205d0bdabff62608713d79b0cbc9143a41331122d1450d92e1efc6a36e849214ad152d1610c1aa73262799218a8f0fb5c7b42d2969b7da44186d2840dd038de95b623d007b5556f93fc9c2bddf18ea35da3b5d3007ac169f81ecb2ec169665a1c85bb696558361d895811e25b2ff83cf303d747ef8581d3c64dd4a0ae9c62ba43d34d9ac7477b87de7ce0eafe63a3dd9ec3f20072c99c435659827a325e330628abebc43caaf2e09faaf05ef5d95f77adbbf3d0d64a90adfdd18a2e17475e63e5bf6c94354353022fc4cfd9282769d9ad07d22e8618f8ada50c52ac01aaa59f8bcd0497e59fe57a9beb10d2fbc78de8a92af122ff67ce05537b217b7c0b00a617d9afed1befa96c11c9ad58845fd4e045a75486b75cdb52df63a4e19af929e0a23ae55640df6fdeeb42cac87923093a215eb38de629f2d9c5d475735a5f23322d1e92c860fe9116e25c507e26b28b528ae16a1a091259f7109321512c8bd262d7c9260bf386c1cc598a795786210f62b5532fa2a65c023ace9bd7f2bdac59ef4f68e7d37cd0bf13c4eeb26d662e6873e14a76fb34c967268baac4ce0eafaad71f816d0f3860fe14d127699f58d41090d8fda0f3caf5d2c3cfd10ec2456ed88c4222df0e5416345f8f5d92261ce7f6b44dfa60c90262452a41211888eb5faf69c25d780943638a0b7fb9431d9c31f74cbeface131ef0be2e9203b130381a8cfc0900c971be5a26f62e95c61c2e5ff7362744b7c749ea688b83fdd87ae333b7b974b6e869cedbacd001e94b76ace34cdb144a5680ed16ad279b8a22af2bb237cde9518b93ffba0698da6ea835f32b8d65afe4a5a87c51d05fd5268ea9152cd7fd686b9f06197b82e11ae82e2e1dbddf767608eb4310445fffeb45f4a04fdf525a44083480bec0f344ad482df09baea7b66a824b7e7efa85009a9772c04daefd0e2a051a7ea08a38fb2327d6a2cf9d52f88ac5547d89f9dae6239c562b08bf3e3d269467064bf1035c2bd1c369f23d9bcb90196ace93d5e9fa9d53fe30c27f923a979b8538108dfa2397321c16fc9f2d3e3dc45dfac2efb6e0550233856bdf481ff89acefabe01e14dd99252b70997922aa7fcd19fbc5f0814d7a8b3ed637cc3ecf583d8fd0a9cfc984043d700a24d1d64b156e57e72b78951ec64854d214282c8a828d24c10d2814902ac5d1e66a9aad0f8da848afbcdcf5a03fbda2430f3c1a54f5fd1c19825bde219827f02f8ea0d2da4bce25662f4ce5244bfc9c927379e71b16b5f2c1270234b42a61e6dd3491973b8f7861abaa1aab92912cb884fbed0c4c50d4aac7d0001676ceb15a982c90187ef842f2380fa81498e4478f32ea1f02ac1a0d158045bc62470acf3ec5c0821e39046471d525e3bc1f803c471065c2cdb2477fce79f52f9aee95fc1646f2ae373750e96b9f177b475ce5bf02ac6a7663ccfaac3966bb0f48817bea19c597c70211da99e89e080d5a12ed8649815e223d45d870b25a5e0ae877269ded0c55a3111d7565ceb5f5fb73dc958dcc25041b6dfb2295038e20cc3091b3f72218f189f31b3664bf13ccf01134cc3ec9528e3a5a3e1b25c32e522b3fdefda17f8743829f8e9f7271babf0a131eff1fd5246a09381e49d26b1321fd4d03b803676bc6402b2bc07ec4c32cfa7bec565554a200b16f2d5348b85d4b14a7527c158bea3dd2480b96ab5c6fe4d5fd69deb942ac65ac669e38e9a389f03eb9c31bc7296b0fe287633bcf3e1ac544ba17a755d33bbbe5265fbc4c6f5ee5592e90a15f4502fbe02975d7ff66bd2145384465c200f036c291d889f7d37443a72d79da50ecfb8199fe10224184d90369728246de9aa5b97b996b584afda7ae3ed0172e24256d5b1adb3edb845aefb8feb3beb70aa91405784c8ad6c8e6d6949835e6fd57fd9517d8fe4a40024232898fd281b5eb4de00c73897dc8260f9f32e1cdab5af7ae63cbb1e5da0c3421881ed479b96a3c77b6538152f7cb2f421b89888f185b6f2af9f541554e8da0ba978bb61b134c0dd57b94f3caaeb9e440d1ec408ba6b2273bbf3caec0fdd59cf8753a41b4e70f1e589a2757263e08b2c4decbc3f79690cfe8d14d3886b16d5e50d3d6d66205c0b8599ce5f7fd9e182d91661cf9f9e5798d3208cd5320b6d81ef8197891ebc0bc59e441f0072c794a81c736bd38bb07f5c05a2d804e418a1a7b30e31c584012c16983d61b8446191d37c1ca9566b07d5285a45b27d7b49dcfca20238b6b5d505376358a3029cd23bda9fe501e53ec49bbcd519bc23cb09c744268fe51dcf51ba6ff03670c7ba5f8f67968fd41d2104e6bceb1e5a70e856316b0c518ad8df3bb31a4790d8509f6bd4abe8e8092074b9f575748cc59659fc75d9ae43817fd6425a527952e15633c78e4902fda63bb47ce0a6f25c705870f011278f80dc1fe7557e47c7acaf997ecdb2399ca4aa17920b2888fa69c1dc6e5c6b0796d84e9dee1f7b565f353db8556cf84d87171d023d91b08272320dd1123be1cdcf1bd6198e64f3acd3033b93c8074ff917c442d20e367d5474421143913c324a6f1ac0cbba19ac1386dbfd9e7ec7a73be052021d61b5bdaead593b9a2e781e85c51870e4f7e57d325c15f404e3770ea3e28057cb9fcffb09978306a599fa422246620965797520bbbbe875e5414399447b6aca57f56cf6b92fb84010a8bc73a7b526b67b454572c06736a604179ddae145874567da422df5611d4276047d142a5ae477e46c602aa006c4e45a6ef7590437179d04ce4627ca3bdad0713ad7d7a26c2b86a363cfcba574f313a8e05d72822182bee8fa9cf4f93df467cde71f80f4422e91e1a338beeff45fa1e6fbeb1f6f394f70d78f73d67df5fe99430d4e3703e6ffd28ec362629dea3b713a8c0dca35daedefeec3e9977768c6de1793a5611f706b685e207f3862ee26b783b771b75e984bc6f04513269aa09baf7609859d8c491dbf684dcdc143387ba8ab640ffaf79c36e810734f7e5052e8eb361040f8fe358a196677ab85894da683897d3e925ea5a2459525f8d1265e93fd5a0de2fb5c42bd304e5911738ee6916094724a9fffb45e8d21832a6dcd1619b4215de49a8ce37e3dfb4cef89815e142fdf483057b40f5cd9b6b8f81d0fc9c2f8bf54364b7f941c256c5688a627f0ac928ac0ca4f6e223048b7a84a8cb6b3df740c0f11c87ed3ac6b8e14ada73c8a0644f729cbcb79ec4b4f06aba8ae337cc9f5fbd371b4bdb2bac", &(0x7f00000000c0)=""/20}, 0x18) bpf$OBJ_GET_MAP(0x7, &(0x7f0000004900)={&(0x7f00000048c0)='./file0\x00'}, 0x10) perf_event_open(&(0x7f0000000000)={0x2, 0x70, 0x8df, 0x80000001, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) getpid() openat$tun(0xffffffffffffff9c, &(0x7f00000015c0)='/dev/net/tun\x00', 0x101000, 0x0) ioctl$TUNSETVNETHDRSZ(0xffffffffffffffff, 0x400454d8, &(0x7f0000001600)=0x7) r0 = openat$cgroup(0xffffffffffffffff, &(0x7f0000000140)='syz0\x00', 0x200002, 0x0) r1 = perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$KVM_TPR_ACCESS_REPORTING(r0, 0xc028ae92, &(0x7f0000001080)={0x4}) r2 = openat$cgroup_ro(r0, &(0x7f0000000200)="2f67726f75702e7374619fd474002b044a7b09ab0b02e10985a6fa15b35ba69421f204dec5668a06000000b90ff860e01f262bafac750a6d5ce259cb61ea0cd94458583eef2fc597ea93a7dec9b4168e468be0576d1d0ebf8bc4478f8ed85b547c6924880400000000000000901e428b98add1375f51e135848fea98c6e3574511e0c61ff22ff61f00", 0x2761, 0x0) ioctl$PERF_EVENT_IOC_MODIFY_ATTRIBUTES(r1, 0x4008240b, &(0x7f0000001480)={0x4, 0x70, 0x1, 0x3f, 0x73a, 0x1000, 0x0, 0x8a, 0x40100, 0xa, 0x7fff, 0x7, 0x100, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x1, 0x9, 0x0, 0xafa6, 0x100000000, 0x5, 0xfffffffffffffffe, 0x79a3, 0x8001, 0x0, 0xaaf, 0x0, 0x4, 0x0, 0x3, 0x100000000, 0xfffffffffffffffd, 0x0, 0xb8, 0x0, 0x8000000, 0x4, @perf_bp={&(0x7f0000000080)}, 0x10000, 0x639, 0x0, 0x0, 0x800, 0x7}) socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$PERF_EVENT_IOC_ID(r1, 0x80082407, &(0x7f0000001380)) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000024c0)=[{&(0x7f00000023c0)}], 0x1, &(0x7f0000001580)}, 0x0) ioctl$PERF_EVENT_IOC_PERIOD(r2, 0x4030582a, &(0x7f0000001100)) openat$cgroup_ro(r2, &(0x7f0000001580)='cpu.stat\x00', 0x0, 0x0) socket$kcm(0x29, 0x8000b, 0x0) 13:29:47 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000007000)={0x8, 0x0, &(0x7f0000000140)=[@acquire], 0x0, 0x0, &(0x7f00000001c0)}) r2 = dup2(r1, r0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000002c0)={0x8, 0x3f00000000000000, &(0x7f00000000c0)=[@release], 0x0, 0x0, &(0x7f0000000300)}) 13:29:47 executing program 4: preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f00000000c0)=""/148, 0x94}], 0x1, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000080)='io\x00') preadv(r0, &(0x7f0000000480), 0x10000000000002a1, 0x7ffff000) 13:29:47 executing program 0: r0 = socket$inet(0x2, 0x4000000803, 0x4) bind$inet(r0, &(0x7f0000000000)={0x2, 0x0, @broadcast}, 0x10) getsockname(r0, &(0x7f00000036c0)=@xdp={0x2c, 0x0, 0x0}, &(0x7f0000000080)=0x80) setsockopt$inet_pktinfo(r0, 0x0, 0x8, &(0x7f0000003780)={r1, @rand_addr, @dev}, 0xc) syz_emit_ethernet(0x4a, &(0x7f0000000240)={@link_local, @empty=[0x0, 0xe000], [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x3c, 0x0, 0x0, 0x0, 0x4, 0x0, @empty=0x9000000, @broadcast}, @udp={0x0, 0x0, 0x28}}}}}, &(0x7f0000000380)) 13:29:47 executing program 1: socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)) syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0xe1, 0x400100) creat(&(0x7f00000001c0)='./file0\x00', 0x2) syz_open_dev$mouse(&(0x7f0000000240)='/dev/input/mouse#\x00', 0x100, 0x10000) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000007000)={0x8, 0x0, &(0x7f0000000140)=[@acquire], 0x0, 0x0, &(0x7f00000001c0)}) r2 = dup2(r1, r0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000002c0)={0x8, 0x0, &(0x7f00000000c0)=[@release], 0x0, 0x0, &(0x7f0000000300)}) 13:29:47 executing program 3: socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)) syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0xe1, 0x400100) creat(&(0x7f00000001c0)='./file0\x00', 0x2) syz_open_dev$mouse(&(0x7f0000000240)='/dev/input/mouse#\x00', 0x100, 0x10000) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000007000)={0x8, 0x0, &(0x7f0000000140)=[@acquire], 0x0, 0x0, &(0x7f00000001c0)}) r2 = dup2(r1, r0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000002c0)={0x8, 0x0, &(0x7f00000000c0)=[@release], 0x0, 0x0, &(0x7f0000000300)}) 13:29:47 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000007000)={0x8, 0x0, &(0x7f0000000140)=[@acquire], 0x0, 0x0, &(0x7f00000001c0)}) r2 = dup2(r1, r0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000002c0)={0x8, 0xfdfdffff00000000, &(0x7f00000000c0)=[@release], 0x0, 0x0, &(0x7f0000000300)}) 13:29:47 executing program 0: r0 = socket$inet(0x2, 0x4000000803, 0x4) bind$inet(r0, &(0x7f0000000000)={0x2, 0x0, @broadcast}, 0x10) getsockname(r0, &(0x7f00000036c0)=@xdp={0x2c, 0x0, 0x0}, &(0x7f0000000080)=0x80) setsockopt$inet_pktinfo(r0, 0x0, 0x8, &(0x7f0000003780)={r1, @rand_addr, @dev}, 0xc) syz_emit_ethernet(0x4a, &(0x7f0000000240)={@link_local, @empty=[0x0, 0x4888], [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x3c, 0x0, 0x0, 0x0, 0x4, 0x0, @empty=0x9000000, @broadcast}, @udp={0x0, 0x0, 0x28}}}}}, &(0x7f0000000380)) [ 545.826268] binder: 26226:26229 Acquire 1 refcount change on invalid ref 0 ret -22 [ 545.842544] binder: 26228:26233 Acquire 1 refcount change on invalid ref 0 ret -22 13:29:47 executing program 4: preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f00000000c0)=""/148, 0x94}], 0x1, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000080)='io\x00') preadv(r0, &(0x7f0000000480), 0x10000000000002a1, 0x600000000000000) [ 545.889537] binder: 26226:26241 Release 1 refcount change on invalid ref 0 ret -22 13:29:47 executing program 3: ioctl$NBD_SET_TIMEOUT(0xffffffffffffffff, 0xab09, 0x0) mq_timedreceive(0xffffffffffffffff, &(0x7f0000000240)=""/156, 0x9c, 0x0, 0x0) syz_open_dev$sndpcmp(&(0x7f0000000080)='/dev/snd/pcmC#D#p\x00', 0x7, 0x200000) perf_event_open(&(0x7f0000000000)={0x2, 0x70, 0x667, 0x80000005, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x400000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x20000000000000, 0x0, 0x0, 0x4}, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, @perf_config_ext}, 0x0, 0xbfffffffffffffff, 0xffffffffffffffff, 0x0) r0 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000180)="2f67726f75702e73746174003c23fb572a1f0294e6f378b41ad54b4d9d9a1f63f8785ad188a7e1c88875e05b18a4cb3a9cd12dcea440d899c22c652b3a471b4a7fa2f3fdf6e034d804e5f0df4b1dee483b157624c59c0100e89e6a357c000000", 0x2761, 0x0) write$cgroup_int(r0, &(0x7f0000000100)=0x10000000000081, 0xffffffffffffff6d) 13:29:47 executing program 1: socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)) syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0xe1, 0x400100) openat$dsp(0xffffffffffffff9c, &(0x7f0000000200)='/dev/dsp\x00', 0x8000, 0x0) syz_open_dev$mouse(&(0x7f0000000240)='/dev/input/mouse#\x00', 0x100, 0x10000) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000007000)={0x8, 0x0, &(0x7f0000000140)=[@acquire], 0x0, 0x0, &(0x7f00000001c0)}) r2 = dup2(r1, r0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000002c0)={0x8, 0x0, &(0x7f00000000c0)=[@release], 0x0, 0x0, &(0x7f0000000300)}) 13:29:47 executing program 5: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000)='/dev/kvm\x00', 0x0, 0x0) r1 = shmget(0x3, 0x3000, 0xe763c83d2ac67ad, &(0x7f0000ffa000/0x3000)=nil) shmat(r1, &(0x7f0000ffc000/0x1000)=nil, 0x4000) r2 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) ioctl$KVM_ENABLE_CAP_CPU(r3, 0x4008ae89, &(0x7f00000001c0)={0x2, 0x0, [0xc0000102, 0x0, 0x4000009f, 0x80ffff]}) r4 = openat$ipvs(0xffffffffffffff9c, &(0x7f00000000c0)='/proc/sys/net/ipv4/vs/cache_bypass\x00', 0x2, 0x0) r5 = openat$qat_adf_ctl(0xffffffffffffff9c, &(0x7f0000000040)='/dev/qat_adf_ctl\x00', 0x0, 0x0) shmget(0x3, 0x2000, 0x4, &(0x7f0000ffc000/0x2000)=nil) r6 = shmget$private(0x0, 0x2000, 0x24, &(0x7f0000ffc000/0x2000)=nil) shmat(r6, &(0x7f0000ffb000/0x4000)=nil, 0x6000) socketpair$inet6_tcp(0xa, 0x1, 0x0, &(0x7f0000000180)) setsockopt$inet6_MCAST_MSFILTER(r5, 0x29, 0x30, &(0x7f0000000240)=ANY=[@ANYBLOB="04000000000000000a004e22ff000000ff010000000000000000000000000001800000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000700000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000020000000a004e223f00000000000000000000000000ffff7f00000106000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000a004e2240000000ff0200000000000000000000000000010300000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000"], 0x190) r7 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000140)='IPVS\x00') sendmsg$IPVS_CMD_ZERO(r4, &(0x7f0000000440)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000000400)={&(0x7f0000000480)=ANY=[@ANYBLOB="3000304be71b09ff8ff82a25bfbba9b7e9295a2319c3f77b58b75369513aedc7d1c8fd5d7818fcfe1697790c5bec59572ccfd4cc20be3033e19dbf244b", @ANYRES16=r7, @ANYBLOB="02002bbd7000fbdbdf25100000001c000100080001000200000008000500000000000800020087000000"], 0x30}, 0x1, 0x0, 0x0, 0x880}, 0x4000080) setsockopt$SO_VM_SOCKETS_BUFFER_SIZE(r5, 0x28, 0x0, &(0x7f0000000080), 0x8) 13:29:47 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000007000)={0x8, 0x0, &(0x7f0000000140)=[@acquire], 0x0, 0x0, &(0x7f00000001c0)}) r2 = dup2(r1, r0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000002c0)={0x8, 0x1a0ffffffff, &(0x7f00000000c0)=[@release], 0x0, 0x0, &(0x7f0000000300)}) 13:29:47 executing program 0: r0 = socket$inet(0x2, 0x4000000803, 0x4) bind$inet(r0, &(0x7f0000000000)={0x2, 0x0, @broadcast}, 0x10) getsockname(r0, &(0x7f00000036c0)=@xdp={0x2c, 0x0, 0x0}, &(0x7f0000000080)=0x80) setsockopt$inet_pktinfo(r0, 0x0, 0x8, &(0x7f0000003780)={r1, @rand_addr, @dev}, 0xc) syz_emit_ethernet(0x4a, &(0x7f0000000240)={@link_local, @empty=[0x0, 0x3c], [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x3c, 0x0, 0x0, 0x0, 0x4, 0x0, @empty=0x9000000, @broadcast}, @udp={0x0, 0x0, 0x28}}}}}, &(0x7f0000000380)) 13:29:47 executing program 4: preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f00000000c0)=""/148, 0x94}], 0x1, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000080)='io\x00') preadv(r0, &(0x7f0000000480), 0x10000000000002a1, 0x4000000) 13:29:47 executing program 1: socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)) syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0xe1, 0x400100) openat$dsp(0xffffffffffffff9c, &(0x7f0000000200)='/dev/dsp\x00', 0x8000, 0x0) syz_open_dev$mouse(&(0x7f0000000240)='/dev/input/mouse#\x00', 0x100, 0x10000) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000007000)={0x8, 0x0, &(0x7f0000000140)=[@acquire], 0x0, 0x0, &(0x7f00000001c0)}) r2 = dup2(r1, r0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000002c0)={0x8, 0x0, &(0x7f00000000c0)=[@release], 0x0, 0x0, &(0x7f0000000300)}) 13:29:47 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000007000)={0x8, 0x0, &(0x7f0000000140)=[@acquire], 0x0, 0x0, &(0x7f00000001c0)}) r2 = dup2(r1, r0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000002c0)={0x8, 0x3f000000, &(0x7f00000000c0)=[@release], 0x0, 0x0, &(0x7f0000000300)}) 13:29:47 executing program 0: r0 = socket$inet(0x2, 0x4000000803, 0x4) bind$inet(r0, &(0x7f0000000000)={0x2, 0x0, @broadcast}, 0x10) getsockname(r0, &(0x7f00000036c0)=@xdp={0x2c, 0x0, 0x0}, &(0x7f0000000080)=0x80) setsockopt$inet_pktinfo(r0, 0x0, 0x8, &(0x7f0000003780)={r1, @rand_addr, @dev}, 0xc) syz_emit_ethernet(0x4a, &(0x7f0000000240)={@link_local, @empty=[0x0, 0x600000000000000], [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x3c, 0x0, 0x0, 0x0, 0x4, 0x0, @empty=0x9000000, @broadcast}, @udp={0x0, 0x0, 0x28}}}}}, &(0x7f0000000380)) 13:29:47 executing program 4: preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f00000000c0)=""/148, 0x94}], 0x1, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000080)='io\x00') preadv(r0, &(0x7f0000000480), 0x10000000000002a1, 0xa000000) 13:29:47 executing program 3: r0 = accept(0xffffffffffffff9c, &(0x7f0000000100)=@vsock={0x28, 0x0, 0x0, @host}, &(0x7f0000000180)=0x80) getsockopt$inet_sctp_SCTP_AUTO_ASCONF(r0, 0x84, 0x1e, &(0x7f00000001c0), &(0x7f0000000280)=0x4) r1 = syz_open_dev$sndseq(&(0x7f0000000000)='/dev/snd/seq\x00', 0x0, 0x0) clone(0x2102001ffa, 0x0, 0xfffffffffffffffe, &(0x7f0000000240), 0xffffffffffffffff) r2 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000100)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write(r2, &(0x7f00000000c0), 0xfec9) r3 = getpid() sched_setscheduler(r3, 0x5, &(0x7f0000000200)) ioctl$SNDRV_SEQ_IOCTL_QUERY_NEXT_CLIENT(r1, 0x40505331, &(0x7f0000000040)={0x700, 0x0, 'client1\x00', 0x0, "6a61009e6d558526", "996612c5ac5c8cb078011a9807dc07c70ae22ac1535c44ed484aca3b8bfe4fca"}) 13:29:47 executing program 5: recvmmsg(0xffffffffffffffff, &(0x7f0000003140)=[{{&(0x7f00000002c0)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @local}}}, 0x80, &(0x7f0000002900)}}], 0x1, 0x0, &(0x7f0000000180)) r0 = socket$inet6(0xa, 0x803, 0x8) ioctl(r0, 0x8912, &(0x7f0000000280)="153f6234488dd25d5c6070") mmap(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x100000d, 0x10, r0, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000340)='net/rt6_stats\x00') preadv(r1, &(0x7f00000017c0), 0x1d0, 0x0) 13:29:47 executing program 0: r0 = socket$inet(0x2, 0x4000000803, 0x4) bind$inet(r0, &(0x7f0000000000)={0x2, 0x0, @broadcast}, 0x10) getsockname(r0, &(0x7f00000036c0)=@xdp={0x2c, 0x0, 0x0}, &(0x7f0000000080)=0x80) setsockopt$inet_pktinfo(r0, 0x0, 0x8, &(0x7f0000003780)={r1, @rand_addr, @dev}, 0xc) syz_emit_ethernet(0x4a, &(0x7f0000000240)={@link_local, @empty=[0x0, 0x400000000000000], [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x3c, 0x0, 0x0, 0x0, 0x4, 0x0, @empty=0x9000000, @broadcast}, @udp={0x0, 0x0, 0x28}}}}}, &(0x7f0000000380)) 13:29:47 executing program 1: socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)) syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0xe1, 0x400100) openat$dsp(0xffffffffffffff9c, &(0x7f0000000200)='/dev/dsp\x00', 0x8000, 0x0) syz_open_dev$mouse(&(0x7f0000000240)='/dev/input/mouse#\x00', 0x100, 0x10000) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000007000)={0x8, 0x0, &(0x7f0000000140)=[@acquire], 0x0, 0x0, &(0x7f00000001c0)}) r2 = dup2(r1, r0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000002c0)={0x8, 0x0, &(0x7f00000000c0)=[@release], 0x0, 0x0, &(0x7f0000000300)}) 13:29:47 executing program 4: preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f00000000c0)=""/148, 0x94}], 0x1, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000080)='io\x00') preadv(r0, &(0x7f0000000480), 0x10000000000002a1, 0x7000000) 13:29:47 executing program 3: r0 = creat(&(0x7f0000000180)='./file0\x00', 0xfffffffffffffffe) sendmsg$nl_generic(r0, &(0x7f0000000400)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x80500}, 0xc, &(0x7f00000003c0)={&(0x7f0000000440)=ANY=[@ANYBLOB="f40000001f00000329bd7000fedbdf25128000003c002e00dceac892b9b64154637eda2462b7afad9407c05e20fd94d2f6e84efc992d6f227af624e2c9469045a2e4d8d5914f3220a3ad1d2f692155008c822730a77061b2277490fd7a94ec3b7667f3262d66e1dd718c0ea2f5d1e837b48273913356747836bc25c0307ee241bc1913ced9c1a7f0d5143929e14b1f354ecc2188c8ee8d174dd790d0ba87892bd370c7aab19c6d5b6d5d7231488ebb7c824fcc6b93d24914e14447a2097abd2339c5a61171a315d4a8955b27171636e2d67f4e7d663dd0f978ea94bd39b02a4c8bab0fee49def844da7670fc17f8dc601f5391000000"], 0xf4}, 0x1, 0x0, 0x0, 0x48840}, 0x800) fallocate(r0, 0x0, 0x0, 0x8200003) ioctl$VHOST_SET_VRING_ADDR(r0, 0x4028af11, &(0x7f00000000c0)={0x1, 0x1, &(0x7f0000000040)=""/36, &(0x7f0000000080), &(0x7f00000001c0)=""/202, 0xf003}) ioctl$EXT4_IOC_SETFLAGS(r0, 0x40086602, &(0x7f0000000080)=0x20000) fallocate(r0, 0x20000000000008, 0x0, 0x4000000) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000000000), &(0x7f0000000100)=0xc) 13:29:47 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000007000)={0x8, 0x0, &(0x7f0000000140)=[@acquire], 0x0, 0x0, &(0x7f00000001c0)}) r2 = dup2(r1, r0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000002c0)={0x8, 0xfdfdffff, &(0x7f00000000c0)=[@release], 0x0, 0x0, &(0x7f0000000300)}) 13:29:47 executing program 5: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f00000003c0)='/dev/kvm\x00', 0x8000000040000001, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r2, r2, &(0x7f0000fe5000/0x18000)=nil, &(0x7f0000000080)=[@text32={0x20, &(0x7f0000000100)="f40fc76c3805c744240000000000c7442402c2430000c7442406000000000f011c24f4b9660900000f32c4e1bde3b9f07f000066baf80cb8aa413582ef66bafc0c66b8380066ef0f0f8600080000943e660f382b40e20fc79f14e70000", 0x5d}], 0x1, 0x30, &(0x7f0000000180)=[@flags], 0x1) ioctl$KVM_NMI(r2, 0xae9a) sysfs$2(0x2, 0x2a7, &(0x7f00000001c0)=""/246) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_ENABLE_CAP_CPU(r2, 0xc008ae88, &(0x7f0000000000)={0x7b, 0x0, [0x9, 0x0, 0x0, 0x20000000001f]}) 13:29:47 executing program 4: preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f00000000c0)=""/148, 0x94}], 0x1, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000080)='io\x00') preadv(r0, &(0x7f0000000480), 0x10000000000002a1, 0x7ffffffff000) 13:29:47 executing program 1: socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)) creat(&(0x7f00000001c0)='./file0\x00', 0x2) openat$dsp(0xffffffffffffff9c, &(0x7f0000000200)='/dev/dsp\x00', 0x8000, 0x0) syz_open_dev$mouse(&(0x7f0000000240)='/dev/input/mouse#\x00', 0x100, 0x10000) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000007000)={0x8, 0x0, &(0x7f0000000140)=[@acquire], 0x0, 0x0, &(0x7f00000001c0)}) r2 = dup2(r1, r0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000002c0)={0x8, 0x0, &(0x7f00000000c0)=[@release], 0x0, 0x0, &(0x7f0000000300)}) 13:29:48 executing program 0: r0 = socket$inet(0x2, 0x4000000803, 0x4) bind$inet(r0, &(0x7f0000000000)={0x2, 0x0, @broadcast}, 0x10) getsockname(r0, &(0x7f00000036c0)=@xdp={0x2c, 0x0, 0x0}, &(0x7f0000000080)=0x80) setsockopt$inet_pktinfo(r0, 0x0, 0x8, &(0x7f0000003780)={r1, @rand_addr, @dev}, 0xc) syz_emit_ethernet(0x4a, &(0x7f0000000240)={@link_local, @empty=[0x0, 0x81000000], [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x3c, 0x0, 0x0, 0x0, 0x4, 0x0, @empty=0x9000000, @broadcast}, @udp={0x0, 0x0, 0x28}}}}}, &(0x7f0000000380)) 13:29:48 executing program 3: r0 = open(&(0x7f00009e1000)='./file0\x00', 0x8040, 0x0) rt_sigprocmask(0x0, &(0x7f0000000100)={0xfffffffffffffff7}, 0x0, 0x8) rt_sigtimedwait(&(0x7f00005a1000)={0xfffffffffffffffd}, &(0x7f00000003c0), &(0x7f00007adff0)={0x77359400}, 0x8) r1 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) recvfrom$inet(r0, &(0x7f00000001c0)=""/148, 0x94, 0x10002, &(0x7f0000000040), 0x10) truncate(&(0x7f0000000000)='./file0\x00', 0x0) fcntl$setlease(r0, 0x400, 0x2) ioctl$TIOCGPGRP(r0, 0x540f, &(0x7f0000000080)=0x0) fcntl$setownex(r1, 0xf, &(0x7f00000000c0)={0x1, r2}) stat(&(0x7f0000000140)='./file0\x00', &(0x7f0000000280)) msgget(0xffffffffffffffff, 0x84) 13:29:48 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000007000)={0x8, 0x0, &(0x7f0000000140)=[@acquire], 0x0, 0x0, &(0x7f00000001c0)}) r2 = dup2(r1, r0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000002c0)={0x8, 0x1a0, &(0x7f00000000c0)=[@release], 0x0, 0x0, &(0x7f0000000300)}) 13:29:48 executing program 4: preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f00000000c0)=""/148, 0x94}], 0x1, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000080)='io\x00') preadv(r0, &(0x7f0000000480), 0x10000000000002a1, 0x2) 13:29:48 executing program 1: socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)) creat(&(0x7f00000001c0)='./file0\x00', 0x2) openat$dsp(0xffffffffffffff9c, &(0x7f0000000200)='/dev/dsp\x00', 0x8000, 0x0) syz_open_dev$mouse(&(0x7f0000000240)='/dev/input/mouse#\x00', 0x100, 0x10000) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000007000)={0x8, 0x0, &(0x7f0000000140)=[@acquire], 0x0, 0x0, &(0x7f00000001c0)}) r2 = dup2(r1, r0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000002c0)={0x8, 0x0, &(0x7f00000000c0)=[@release], 0x0, 0x0, &(0x7f0000000300)}) 13:29:48 executing program 5: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000200)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000080)={'vlan0\x00', 0x2003}) pwritev(r0, &(0x7f0000000000)=[{&(0x7f0000000140)="bdda14e56b3212b375c78fe17c5fd984be2042b6384513632da45782a6e7d1b661b491cf523ea4ff0c1c3b8e56a598846bd67a6eb09c933979e94fb8bf6e1c4343a799114c5c64b5ee271d642a6e93fc0dbb4748e99c23d34ca58a4546566dae9fa650857d1bb7d4ddbe0cc059611fde5bbfe7fa023fec33792fe851f3bcb7464f741029bf6041b69823c2701b4ee9921c73434772855ab3940414247ae5f66489a8976a1e2a6a557162c80e", 0xac}], 0x1, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCETHTOOL(r1, 0x8946, &(0x7f0000000100)={'vlan0\x00', &(0x7f0000000240)=@ethtool_flash={0x33, 0x0, "1698c616ac32456490e0f74cc7741339dc7f356e13b7827809979a12a364216cc66fcaff5da82d1e77a0e4e632ab2e7fcd3d1f84507ba2a23bf9aef82d35300ac9f3f21f42deb02a68c0b868cfecc02f3e16c1049484b971f0ba74eb6ad312478aee368f86cb985802227cec31102d2e6142e32c3e7b994b080a727888f917b1"}}) 13:29:48 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000007000)={0x8, 0x0, &(0x7f0000000140)=[@acquire], 0x0, 0x0, &(0x7f00000001c0)}) r2 = dup2(r1, r0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000002c0)={0x8, 0x100000000000000, &(0x7f00000000c0)=[@release], 0x0, 0x0, &(0x7f0000000300)}) 13:29:48 executing program 1: socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)) creat(&(0x7f00000001c0)='./file0\x00', 0x2) openat$dsp(0xffffffffffffff9c, &(0x7f0000000200)='/dev/dsp\x00', 0x8000, 0x0) syz_open_dev$mouse(&(0x7f0000000240)='/dev/input/mouse#\x00', 0x100, 0x10000) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000007000)={0x8, 0x0, &(0x7f0000000140)=[@acquire], 0x0, 0x0, &(0x7f00000001c0)}) r2 = dup2(r1, r0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000002c0)={0x8, 0x0, &(0x7f00000000c0)=[@release], 0x0, 0x0, &(0x7f0000000300)}) 13:29:48 executing program 0: r0 = socket$inet(0x2, 0x4000000803, 0x4) bind$inet(r0, &(0x7f0000000000)={0x2, 0x0, @broadcast}, 0x10) getsockname(r0, &(0x7f00000036c0)=@xdp={0x2c, 0x0, 0x0}, &(0x7f0000000080)=0x80) setsockopt$inet_pktinfo(r0, 0x0, 0x8, &(0x7f0000003780)={r1, @rand_addr, @dev}, 0xc) syz_emit_ethernet(0x4a, &(0x7f0000000240)={@link_local, @empty=[0x0, 0x14000000], [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x3c, 0x0, 0x0, 0x0, 0x4, 0x0, @empty=0x9000000, @broadcast}, @udp={0x0, 0x0, 0x28}}}}}, &(0x7f0000000380)) 13:29:48 executing program 4: preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f00000000c0)=""/148, 0x94}], 0x1, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000080)='io\x00') preadv(r0, &(0x7f0000000480), 0x10000000000002a1, 0x6) 13:29:48 executing program 5: r0 = fcntl$dupfd(0xffffffffffffffff, 0x406, 0xffffffffffffff9c) setsockopt$inet6_tcp_TCP_ULP(r0, 0x6, 0x1f, &(0x7f00000000c0)='tls\x00', 0x4) mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x4, 0x32, 0xffffffffffffffff, 0x0) getsockopt$inet_sctp6_SCTP_ASSOCINFO(0xffffffffffffffff, 0x84, 0x1, &(0x7f0000000040)={0x0, 0x0, 0x401}, &(0x7f0000000080)=0xfffffff0) r1 = userfaultfd(0x0) ioctl$UFFDIO_API(r1, 0xc018aa3f, &(0x7f0000003fe8)) ioctl$UFFDIO_REGISTER(r1, 0xc020aa00, &(0x7f0000001fe2)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = socket$inet6_sctp(0xa, 0x5, 0x84) setsockopt$inet_sctp6_SCTP_DISABLE_FRAGMENTS(r3, 0x84, 0x8, &(0x7f0000013e95), 0x4) setsockopt$IP_VS_SO_SET_TIMEOUT(r3, 0x0, 0x60, &(0x7f0000000000), 0xc) close(r3) close(r1) 13:29:48 executing program 1: syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0xe1, 0x400100) creat(&(0x7f00000001c0)='./file0\x00', 0x2) openat$dsp(0xffffffffffffff9c, &(0x7f0000000200)='/dev/dsp\x00', 0x8000, 0x0) syz_open_dev$mouse(&(0x7f0000000240)='/dev/input/mouse#\x00', 0x100, 0x10000) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000007000)={0x8, 0x0, &(0x7f0000000140)=[@acquire], 0x0, 0x0, &(0x7f00000001c0)}) r2 = dup2(r1, r0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000002c0)={0x8, 0x0, &(0x7f00000000c0)=[@release], 0x0, 0x0, &(0x7f0000000300)}) 13:29:48 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000007000)={0x8, 0x0, &(0x7f0000000140)=[@acquire], 0x0, 0x0, &(0x7f00000001c0)}) r2 = dup2(r1, r0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000002c0)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x630d}], 0x0, 0x0, &(0x7f0000000300)}) [ 547.221749] binder: 26376:26379 unknown command 0 [ 547.234389] binder: 26376:26379 ioctl c0306201 200002c0 returned -22 13:29:48 executing program 1: syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0xe1, 0x400100) creat(&(0x7f00000001c0)='./file0\x00', 0x2) openat$dsp(0xffffffffffffff9c, &(0x7f0000000200)='/dev/dsp\x00', 0x8000, 0x0) syz_open_dev$mouse(&(0x7f0000000240)='/dev/input/mouse#\x00', 0x100, 0x10000) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000007000)={0x8, 0x0, &(0x7f0000000140)=[@acquire], 0x0, 0x0, &(0x7f00000001c0)}) r2 = dup2(r1, r0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000002c0)={0x8, 0x0, &(0x7f00000000c0)=[@release], 0x0, 0x0, &(0x7f0000000300)}) 13:29:48 executing program 0: r0 = socket$inet(0x2, 0x4000000803, 0x4) bind$inet(r0, &(0x7f0000000000)={0x2, 0x0, @broadcast}, 0x10) getsockname(r0, &(0x7f00000036c0)=@xdp={0x2c, 0x0, 0x0}, &(0x7f0000000080)=0x80) setsockopt$inet_pktinfo(r0, 0x0, 0x8, &(0x7f0000003780)={r1, @rand_addr, @dev}, 0xc) syz_emit_ethernet(0x4a, &(0x7f0000000240)={@link_local, @empty=[0x0, 0x43050000], [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x3c, 0x0, 0x0, 0x0, 0x4, 0x0, @empty=0x9000000, @broadcast}, @udp={0x0, 0x0, 0x28}}}}}, &(0x7f0000000380)) 13:29:48 executing program 4: preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f00000000c0)=""/148, 0x94}], 0x1, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000080)='io\x00') preadv(r0, &(0x7f0000000480), 0x10000000000002a1, 0x200000000000000) 13:29:48 executing program 3: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070") r1 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_int(r1, 0x29, 0x19, &(0x7f00000000c0)=0x1, 0x4) setsockopt$inet6_int(r1, 0x29, 0x21, &(0x7f0000000100)=0xfff, 0x4) r2 = syz_open_dev$adsp(&(0x7f0000000080)='/dev/adsp#\x00', 0x80000000, 0x0) ioctl$VT_WAITACTIVE(r2, 0x5607) sendto$inet6(r1, &(0x7f0000000240), 0x0, 0x0, &(0x7f0000000140)={0xa, 0x10000000004e21}, 0x1c) recvmsg(r1, &(0x7f0000000400)={&(0x7f0000000000)=@nl=@proc, 0x80, &(0x7f0000000080), 0x0, &(0x7f00000003c0)=""/36, 0x24}, 0x2000) 13:29:48 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000007000)={0x8, 0x0, &(0x7f0000000140)=[@acquire], 0x0, 0x0, &(0x7f00000001c0)}) r2 = dup2(r1, r0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000002c0)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x40486311}], 0x0, 0x0, &(0x7f0000000300)}) 13:29:48 executing program 5: socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)) creat(&(0x7f00000001c0)='./file0\x00', 0x2) openat$dsp(0xffffffffffffff9c, &(0x7f0000000200)='/dev/dsp\x00', 0x8000, 0x0) syz_open_dev$mouse(&(0x7f0000000240)='/dev/input/mouse#\x00', 0x100, 0x10000) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000007000)={0x8, 0x0, &(0x7f0000000140)=[@acquire], 0x0, 0x0, &(0x7f00000001c0)}) r2 = dup2(r1, r0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000002c0)={0x8, 0x0, &(0x7f00000000c0)=[@release], 0x0, 0x0, &(0x7f0000000300)}) 13:29:49 executing program 5: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x2b, &(0x7f0000000000)=@broute={'broute\x00', 0x60, 0x1, 0x290, [0x0, 0x0, 0x0, 0x0, 0x0, 0x20000440], 0x30, &(0x7f0000000700), &(0x7f0000000440)=[{0x0, '\x00', 0x0, 0x2}, {}, {0x0, '\x00', 0x0, 0xffffffffffffffff, 0x1, [{{{0x80000000f, 0x0, 0x6, 'vlan0\x00', 'team_slave_0\x00', 'eql\x00', "6772653009ecffffff00", @local, [0xfb, 0x100, 0x0, 0xff, 0x0, 0xff], @remote, [0x0, 0x7f, 0x0, 0x0, 0xff], 0xa0, 0x1d0, 0x200, [@connlabel={'connlabel\x00', 0x8, {{0x8, 0x2}}}]}, [@common=@SECMARK={'SECMARK\x00', 0x108, {{0x1, 0x8000, 'system_u:object_r:bsdpty_device_t:s0\x00'}}}]}, @common=@CLASSIFY={'CLASSIFY\x00', 0x8, {{0x9}}}}]}]}, 0x308) setsockopt$IP_VS_SO_SET_DELDEST(r0, 0x0, 0x488, &(0x7f0000000080)={{0x37, @loopback, 0x4e23, 0x2, 'sh\x00', 0x2, 0x8, 0x25}, {@multicast2, 0x4e21, 0x1, 0x9e, 0x2, 0x3}}, 0x44) [ 547.700812] binder: 26391:26398 transaction failed 29189/-22, size 0-0 line 2834 [ 547.726336] binder: undelivered TRANSACTION_ERROR: 29189 13:29:49 executing program 4: preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f00000000c0)=""/148, 0x94}], 0x1, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000080)='io\x00') preadv(r0, &(0x7f0000000480), 0x10000000000002a1, 0x3000000) 13:29:49 executing program 3: r0 = openat$rfkill(0xffffffffffffff9c, &(0x7f0000000240)='/dev/rfkill\x00', 0x0, 0x0) ioctl$RNDADDTOENTCNT(r0, 0x40045201, &(0x7f0000000080)) clock_gettime(0x0, &(0x7f0000000100)) clock_gettime(0x0, &(0x7f0000000180)={0x0, 0x0}) futimesat(r0, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)={{r1, r2/1000+30000}, {0x0, 0x7530}}) ioctl$RNDADDTOENTCNT(r0, 0x40045201, &(0x7f0000011000)) ioctl$sock_SIOCGPGRP(r0, 0x8904, &(0x7f0000000000)=0x0) ioctl$TIOCSPGRP(r0, 0x5410, &(0x7f0000000040)=r3) 13:29:49 executing program 0: r0 = socket$inet(0x2, 0x4000000803, 0x4) bind$inet(r0, &(0x7f0000000000)={0x2, 0x0, @broadcast}, 0x10) getsockname(r0, &(0x7f00000036c0)=@xdp={0x2c, 0x0, 0x0}, &(0x7f0000000080)=0x80) setsockopt$inet_pktinfo(r0, 0x0, 0x8, &(0x7f0000003780)={r1, @rand_addr, @dev}, 0xc) syz_emit_ethernet(0x4a, &(0x7f0000000240)={@link_local, @empty=[0x0, 0x600], [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x3c, 0x0, 0x0, 0x0, 0x4, 0x0, @empty=0x9000000, @broadcast}, @udp={0x0, 0x0, 0x28}}}}}, &(0x7f0000000380)) 13:29:49 executing program 1: syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0xe1, 0x400100) creat(&(0x7f00000001c0)='./file0\x00', 0x2) openat$dsp(0xffffffffffffff9c, &(0x7f0000000200)='/dev/dsp\x00', 0x8000, 0x0) syz_open_dev$mouse(&(0x7f0000000240)='/dev/input/mouse#\x00', 0x100, 0x10000) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000007000)={0x8, 0x0, &(0x7f0000000140)=[@acquire], 0x0, 0x0, &(0x7f00000001c0)}) r2 = dup2(r1, r0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000002c0)={0x8, 0x0, &(0x7f00000000c0)=[@release], 0x0, 0x0, &(0x7f0000000300)}) 13:29:49 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000007000)={0x8, 0x0, &(0x7f0000000140)=[@acquire], 0x0, 0x0, &(0x7f00000001c0)}) r2 = dup2(r1, r0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000002c0)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x40046312}], 0x0, 0x0, &(0x7f0000000300)}) [ 547.840563] IPVS: set_ctl: invalid protocol: 55 127.0.0.1:20003 [ 547.892646] IPVS: set_ctl: invalid protocol: 55 127.0.0.1:20003 13:29:49 executing program 4: preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f00000000c0)=""/148, 0x94}], 0x1, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000080)='io\x00') preadv(r0, &(0x7f0000000480), 0x10000000000002a1, 0xf0ff7f) 13:29:49 executing program 1: socketpair$unix(0x1, 0x0, 0x0, &(0x7f00000000c0)) syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0xe1, 0x400100) creat(&(0x7f00000001c0)='./file0\x00', 0x2) openat$dsp(0xffffffffffffff9c, &(0x7f0000000200)='/dev/dsp\x00', 0x8000, 0x0) syz_open_dev$mouse(&(0x7f0000000240)='/dev/input/mouse#\x00', 0x100, 0x10000) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000007000)={0x8, 0x0, &(0x7f0000000140)=[@acquire], 0x0, 0x0, &(0x7f00000001c0)}) r2 = dup2(r1, r0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000002c0)={0x8, 0x0, &(0x7f00000000c0)=[@release], 0x0, 0x0, &(0x7f0000000300)}) 13:29:49 executing program 3: r0 = socket(0x11, 0x4000000000080002, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000008c0)={'lo\x00', 0x0}) bind$packet(r0, &(0x7f0000000140)={0x11, 0x0, r1, 0x1, 0x0, 0x6, @local}, 0x14) sendmmsg$inet_sctp(r0, &(0x7f0000871fc8)=[{&(0x7f000086c000)=@in6={0xa, 0x6558, 0x2}, 0x1c, &(0x7f0000d1e000), 0x0, &(0x7f0000dda000)}], 0x492492492492510, 0x0) r2 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r2, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070") ioctl$sock_inet_SIOCGIFDSTADDR(r0, 0x8917, &(0x7f0000000000)={'dummy0\x00', {0x2, 0x4e23, @multicast1}}) 13:29:49 executing program 0: r0 = socket$inet(0x2, 0x4000000803, 0x4) bind$inet(r0, &(0x7f0000000000)={0x2, 0x0, @broadcast}, 0x10) getsockname(r0, &(0x7f00000036c0)=@xdp={0x2c, 0x0, 0x0}, &(0x7f0000000080)=0x80) setsockopt$inet_pktinfo(r0, 0x0, 0x8, &(0x7f0000003780)={r1, @rand_addr, @dev}, 0xc) syz_emit_ethernet(0x4a, &(0x7f0000000240)={@link_local, @empty=[0x0, 0x543], [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x3c, 0x0, 0x0, 0x0, 0x4, 0x0, @empty=0x9000000, @broadcast}, @udp={0x0, 0x0, 0x28}}}}}, &(0x7f0000000380)) 13:29:49 executing program 5: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) socketpair$unix(0x1, 0x40000000001, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) close(r0) openat$ion(0xffffffffffffff9c, &(0x7f0000000140)='/dev/ion\x00', 0x0, 0x0) socket$inet_tcp(0x2, 0x1, 0x0) r3 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000400)='/dev/vga_arbiter\x00', 0x80040080, 0x0) io_setup(0x280, &(0x7f0000000200)=0x0) r5 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r5, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070") r6 = socket$inet6(0x10, 0x3, 0x0) sendmsg(r6, &(0x7f0000002fc8)={&(0x7f0000000000)=@nl, 0x80, &(0x7f0000002000)=[{&(0x7f000000dfaa)="5500000018007f5300fe01b2a4a280930a06000000a84306910000003900090035000c00060000001900150005000000000000dc1338d54400009b84136ef75afb83de4411001600c43ab8220000060cec4fab91d4", 0x55}], 0x1, &(0x7f0000000400)}, 0x0) io_getevents(r4, 0x109f, 0x6, &(0x7f0000000280)=[{}, {}, {}, {}, {}, {}], &(0x7f0000000340)) setsockopt$inet6_udp_int(r3, 0x11, 0x65, &(0x7f0000000040)=0x7, 0x4) ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(r3, 0xc058534f, &(0x7f0000000380)={{0x400, 0x8}, 0x0, 0xfffffffffffffd2b, 0x4, {0x3, 0x7}, 0x100000001, 0x1}) io_setup(0x6, &(0x7f0000000480)=0x0) openat$cuse(0xffffffffffffff9c, &(0x7f0000000240)='/dev/cuse\x00', 0x2, 0x0) io_getevents(r7, 0x101, 0x800000000000083, &(0x7f0000000040), &(0x7f0000000100)={0x77359400}) io_submit(r7, 0x1400, &(0x7f0000000600)=[&(0x7f0000000180)={0x0, 0x0, 0x0, 0x0, 0x0, r2, &(0x7f0000000140), 0x705000}]) socketpair$inet6_icmp_raw(0xa, 0x3, 0x3a, &(0x7f0000000000)) [ 547.997246] binder: 26419:26422 unknown command 1074029330 [ 548.017847] binder: 26419:26422 ioctl c0306201 200002c0 returned -22 13:29:49 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000007000)={0x8, 0x0, &(0x7f0000000140)=[@acquire], 0x0, 0x0, &(0x7f00000001c0)}) r2 = dup2(r1, r0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000002c0)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x40046304}], 0x0, 0x0, &(0x7f0000000300)}) 13:29:49 executing program 4: preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f00000000c0)=""/148, 0x94}], 0x1, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000080)='io\x00') preadv(r0, &(0x7f0000000480), 0x10000000000002a1, 0x6000000) 13:29:49 executing program 1: socketpair$unix(0x1, 0x0, 0x0, &(0x7f00000000c0)) syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0xe1, 0x400100) creat(&(0x7f00000001c0)='./file0\x00', 0x2) openat$dsp(0xffffffffffffff9c, &(0x7f0000000200)='/dev/dsp\x00', 0x8000, 0x0) syz_open_dev$mouse(&(0x7f0000000240)='/dev/input/mouse#\x00', 0x100, 0x10000) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000007000)={0x8, 0x0, &(0x7f0000000140)=[@acquire], 0x0, 0x0, &(0x7f00000001c0)}) r2 = dup2(r1, r0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000002c0)={0x8, 0x0, &(0x7f00000000c0)=[@release], 0x0, 0x0, &(0x7f0000000300)}) 13:29:49 executing program 0: r0 = socket$inet(0x2, 0x4000000803, 0x4) bind$inet(r0, &(0x7f0000000000)={0x2, 0x0, @broadcast}, 0x10) getsockname(r0, &(0x7f00000036c0)=@xdp={0x2c, 0x0, 0x0}, &(0x7f0000000080)=0x80) setsockopt$inet_pktinfo(r0, 0x0, 0x8, &(0x7f0000003780)={r1, @rand_addr, @dev}, 0xc) syz_emit_ethernet(0x4a, &(0x7f0000000240)={@link_local, @empty=[0x0, 0x3], [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x3c, 0x0, 0x0, 0x0, 0x4, 0x0, @empty=0x9000000, @broadcast}, @udp={0x0, 0x0, 0x28}}}}}, &(0x7f0000000380)) [ 548.202775] netlink: 13 bytes leftover after parsing attributes in process `syz-executor5'. 13:29:49 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000007000)={0x8, 0x0, &(0x7f0000000140)=[@acquire], 0x0, 0x0, &(0x7f00000001c0)}) r2 = dup2(r1, r0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000002c0)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x40086303}], 0x0, 0x0, &(0x7f0000000300)}) 13:29:49 executing program 4: preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f00000000c0)=""/148, 0x94}], 0x1, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000080)='io\x00') preadv(r0, &(0x7f0000000480), 0x10000000000002a1, 0x10) 13:29:49 executing program 0: r0 = socket$inet(0x2, 0x4000000803, 0x4) bind$inet(r0, &(0x7f0000000000)={0x2, 0x0, @broadcast}, 0x10) getsockname(r0, &(0x7f00000036c0)=@xdp={0x2c, 0x0, 0x0}, &(0x7f0000000080)=0x80) setsockopt$inet_pktinfo(r0, 0x0, 0x8, &(0x7f0000003780)={r1, @rand_addr, @dev}, 0xc) syz_emit_ethernet(0x4a, &(0x7f0000000240)={@link_local, @empty=[0x0, 0x400300], [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x3c, 0x0, 0x0, 0x0, 0x4, 0x0, @empty=0x9000000, @broadcast}, @udp={0x0, 0x0, 0x28}}}}}, &(0x7f0000000380)) 13:29:49 executing program 1: socketpair$unix(0x1, 0x0, 0x0, &(0x7f00000000c0)) syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0xe1, 0x400100) creat(&(0x7f00000001c0)='./file0\x00', 0x2) openat$dsp(0xffffffffffffff9c, &(0x7f0000000200)='/dev/dsp\x00', 0x8000, 0x0) syz_open_dev$mouse(&(0x7f0000000240)='/dev/input/mouse#\x00', 0x100, 0x10000) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000007000)={0x8, 0x0, &(0x7f0000000140)=[@acquire], 0x0, 0x0, &(0x7f00000001c0)}) r2 = dup2(r1, r0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000002c0)={0x8, 0x0, &(0x7f00000000c0)=[@release], 0x0, 0x0, &(0x7f0000000300)}) 13:29:49 executing program 4: preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f00000000c0)=""/148, 0x94}], 0x1, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000080)='io\x00') preadv(r0, &(0x7f0000000480), 0x10000000000002a1, 0x7fffef6c) [ 548.440434] binder: 26467:26472 BC_FREE_BUFFER u0000000000000000 no match 13:29:49 executing program 3: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000018000)={&(0x7f0000000000), 0xc, &(0x7f0000013ff1)={&(0x7f0000000080)={0x20, 0x1d, 0x301, 0x0, 0x0, {0x5}, [@typed={0xc, 0x3, @u64}]}, 0x20}}, 0x0) r1 = creat(&(0x7f0000000040)='./file0\x00', 0x2) pkey_alloc(0x0, 0x2) getsockopt$inet_sctp6_SCTP_AUTO_ASCONF(r1, 0x84, 0x1e, &(0x7f00000000c0), &(0x7f0000000100)=0x4) 13:29:49 executing program 1: socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)) syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0x0, 0x400100) creat(&(0x7f00000001c0)='./file0\x00', 0x2) openat$dsp(0xffffffffffffff9c, &(0x7f0000000200)='/dev/dsp\x00', 0x8000, 0x0) syz_open_dev$mouse(&(0x7f0000000240)='/dev/input/mouse#\x00', 0x100, 0x10000) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000007000)={0x8, 0x0, &(0x7f0000000140)=[@acquire], 0x0, 0x0, &(0x7f00000001c0)}) r2 = dup2(r1, r0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000002c0)={0x8, 0x0, &(0x7f00000000c0)=[@release], 0x0, 0x0, &(0x7f0000000300)}) [ 548.681494] netlink: 'syz-executor3': attribute type 3 has an invalid length. [ 548.699993] netlink: 'syz-executor3': attribute type 3 has an invalid length. [ 548.961779] netlink: 13 bytes leftover after parsing attributes in process `syz-executor5'. 13:29:50 executing program 0: r0 = socket$inet(0x2, 0x4000000803, 0x4) bind$inet(r0, &(0x7f0000000000)={0x2, 0x0, @broadcast}, 0x10) getsockname(r0, &(0x7f00000036c0)=@xdp={0x2c, 0x0, 0x0}, &(0x7f0000000080)=0x80) setsockopt$inet_pktinfo(r0, 0x0, 0x8, &(0x7f0000003780)={r1, @rand_addr, @dev}, 0xc) syz_emit_ethernet(0x4a, &(0x7f0000000240)={@link_local, @empty=[0x0, 0x4305], [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x3c, 0x0, 0x0, 0x0, 0x4, 0x0, @empty=0x9000000, @broadcast}, @udp={0x0, 0x0, 0x28}}}}}, &(0x7f0000000380)) 13:29:50 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000007000)={0x8, 0x0, &(0x7f0000000140)=[@acquire], 0x0, 0x0, &(0x7f00000001c0)}) r2 = dup2(r1, r0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000002c0)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x40406301}], 0x0, 0x0, &(0x7f0000000300)}) 13:29:50 executing program 4: preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f00000000c0)=""/148, 0x94}], 0x1, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000080)='io\x00') preadv(r0, &(0x7f0000000480), 0x10000000000002a1, 0x4) 13:29:50 executing program 1: socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)) syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0x0, 0x400100) creat(&(0x7f00000001c0)='./file0\x00', 0x2) openat$dsp(0xffffffffffffff9c, &(0x7f0000000200)='/dev/dsp\x00', 0x8000, 0x0) syz_open_dev$mouse(&(0x7f0000000240)='/dev/input/mouse#\x00', 0x100, 0x10000) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000007000)={0x8, 0x0, &(0x7f0000000140)=[@acquire], 0x0, 0x0, &(0x7f00000001c0)}) r2 = dup2(r1, r0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000002c0)={0x8, 0x0, &(0x7f00000000c0)=[@release], 0x0, 0x0, &(0x7f0000000300)}) 13:29:50 executing program 5: r0 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dsp\x00', 0x400, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x40000000000013, 0x10, 0xe68, 0x0, 0x5000000, r0}, 0x2c) 13:29:50 executing program 3: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) r1 = socket$inet6_udp(0xa, 0x2, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) connect$inet6(r1, &(0x7f0000000000)={0xa, 0x0, 0x0, @remote, 0x3}, 0x1c) socket$l2tp(0x18, 0x1, 0x1) r2 = socket$l2tp(0x18, 0x1, 0x1) connect$l2tp(r2, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, r1, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) setsockopt$inet6_IPV6_XFRM_POLICY(r1, 0x29, 0x23, &(0x7f00000001c0)={{{@in6=@local, @in, 0x0, 0x0, 0x0, 0x0, 0xa}, {}, {}, 0x0, 0x0, 0x1}, {{@in=@rand_addr, 0x0, 0x33}, 0x0, @in6=@mcast2}}, 0xe8) sendmmsg(r2, &(0x7f0000005fc0), 0x800000000000059, 0x0) getsockopt$IP6T_SO_GET_REVISION_TARGET(r1, 0x29, 0x45, &(0x7f0000000040)={'HL\x00'}, &(0x7f00000000c0)=0x1e) bind$netlink(r0, &(0x7f0000000080)={0x10, 0x0, 0x0, 0x1}, 0x41) 13:29:50 executing program 0: r0 = socket$inet(0x2, 0x4000000803, 0x4) bind$inet(r0, &(0x7f0000000000)={0x2, 0x0, @broadcast}, 0x10) getsockname(r0, &(0x7f00000036c0)=@xdp={0x2c, 0x0, 0x0}, &(0x7f0000000080)=0x80) setsockopt$inet_pktinfo(r0, 0x0, 0x8, &(0x7f0000003780)={r1, @rand_addr, @dev}, 0xc) syz_emit_ethernet(0x4a, &(0x7f0000000240)={@link_local, @empty=[0x0, 0x0, 0xe80], [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x3c, 0x0, 0x0, 0x0, 0x4, 0x0, @empty=0x9000000, @broadcast}, @udp={0x0, 0x0, 0x28}}}}}, &(0x7f0000000380)) 13:29:50 executing program 4: preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f00000000c0)=""/148, 0x94}], 0x1, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000080)='io\x00') preadv(r0, &(0x7f0000000480), 0x10000000000002a1, 0xf0ffffff7f0000) [ 549.169999] binder: 26496:26506 got reply transaction with no transaction stack [ 549.194080] binder: 26496:26506 transaction failed 29201/-71, size 0-0 line 2741 [ 549.237616] binder: undelivered TRANSACTION_ERROR: 29201 13:29:50 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000007000)={0x8, 0x0, &(0x7f0000000140)=[@acquire], 0x0, 0x0, &(0x7f00000001c0)}) r2 = dup2(r1, r0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000002c0)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x40486312}], 0x0, 0x0, &(0x7f0000000300)}) 13:29:50 executing program 5: r0 = socket$key(0xf, 0x3, 0x2) sched_setaffinity(0x0, 0x8, &(0x7f0000000100)=0x800000009) r1 = perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r2 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r2, &(0x7f0000000200)={0xa, 0x0, 0x0, @remote, 0x2}, 0x1c) setsockopt$inet6_IPV6_XFRM_POLICY(r2, 0x29, 0x23, &(0x7f00000013c0)={{{@in, @in6=@ipv4={[], [], @rand_addr}, 0x0, 0x0, 0x0, 0x0, 0x2}, {}, {}, 0x0, 0x0, 0x1}, {{@in6=@local, 0x0, 0x32}, 0x0, @in6, 0x0, 0x0, 0x0, 0x5}}, 0xe8) connect$inet6(r2, &(0x7f0000000140)={0xa, 0xffffffffffffffff, 0x0, @ipv4={[], [], @dev={0xac, 0x14, 0x14, 0x18}}}, 0x1c) sendmmsg(r2, &(0x7f0000000240), 0x5c3, 0x0) sendmsg$key(r0, &(0x7f0000000000)={0x40000000, 0x0, &(0x7f0000000040)={&(0x7f0000000080)={0x2, 0x7, 0x0, 0x9, 0x2}, 0x10}}, 0x0) write$binfmt_misc(r1, &(0x7f0000000240)={'syz0', "c632bc5c49cf7f3d7e7ab753f8b7a6cd7bd8c0b790136e8424a002e077489035f5d4d32c90c8ece4cd0a38f79f46926dd2f2eb918c39524221e22fcc07e585d452571bac3b309ea9be932f68374306df14337fedcd6648aefd192422ef0278d4ce687ff6e782d07dea456c385743f60525135e01ad7e26447a56f44c322011be9352de33d1f7eccfbbc21903077a525d64bbb2eca3c9f51031f22a15443c5dd55b108775e1f2"}, 0xaa) 13:29:50 executing program 1: socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)) syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0x0, 0x400100) creat(&(0x7f00000001c0)='./file0\x00', 0x2) openat$dsp(0xffffffffffffff9c, &(0x7f0000000200)='/dev/dsp\x00', 0x8000, 0x0) syz_open_dev$mouse(&(0x7f0000000240)='/dev/input/mouse#\x00', 0x100, 0x10000) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000007000)={0x8, 0x0, &(0x7f0000000140)=[@acquire], 0x0, 0x0, &(0x7f00000001c0)}) r2 = dup2(r1, r0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000002c0)={0x8, 0x0, &(0x7f00000000c0)=[@release], 0x0, 0x0, &(0x7f0000000300)}) 13:29:50 executing program 0: r0 = socket$inet(0x2, 0x4000000803, 0x4) bind$inet(r0, &(0x7f0000000000)={0x2, 0x0, @broadcast}, 0x10) getsockname(r0, &(0x7f00000036c0)=@xdp={0x2c, 0x0, 0x0}, &(0x7f0000000080)=0x80) setsockopt$inet_pktinfo(r0, 0x0, 0x8, &(0x7f0000003780)={r1, @rand_addr, @dev}, 0xc) syz_emit_ethernet(0x4a, &(0x7f0000000240)={@link_local, @empty=[0x0, 0x0, 0x8848], [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x3c, 0x0, 0x0, 0x0, 0x4, 0x0, @empty=0x9000000, @broadcast}, @udp={0x0, 0x0, 0x28}}}}}, &(0x7f0000000380)) 13:29:50 executing program 4: preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f00000000c0)=""/148, 0x94}], 0x1, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000080)='io\x00') preadv(r0, &(0x7f0000000480), 0x10000000000002a1, 0x6cefff7f) [ 549.419060] binder: 26523:26526 got reply transaction with no transaction stack [ 549.452372] binder: 26523:26526 transaction failed 29201/-71, size 0-0 line 2741 [ 549.504869] binder: undelivered TRANSACTION_ERROR: 29201 [ 549.548791] binder_thread_write: 31 callbacks suppressed [ 549.548847] binder: 26528:26531 Acquire 1 refcount change on invalid ref 0 ret -22 13:29:50 executing program 0: r0 = socket$inet(0x2, 0x4000000803, 0x4) bind$inet(r0, &(0x7f0000000000)={0x2, 0x0, @broadcast}, 0x10) getsockname(r0, &(0x7f00000036c0)=@xdp={0x2c, 0x0, 0x0}, &(0x7f0000000080)=0x80) setsockopt$inet_pktinfo(r0, 0x0, 0x8, &(0x7f0000003780)={r1, @rand_addr, @dev}, 0xc) syz_emit_ethernet(0x4a, &(0x7f0000000240)={@link_local, @empty=[0x0, 0x0, 0x300000000000000], [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x3c, 0x0, 0x0, 0x0, 0x4, 0x0, @empty=0x9000000, @broadcast}, @udp={0x0, 0x0, 0x28}}}}}, &(0x7f0000000380)) [ 549.595094] binder: 26528:26531 Release 1 refcount change on invalid ref 0 ret -22 13:29:51 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000007000)={0x8, 0x0, &(0x7f0000000140)=[@acquire], 0x0, 0x0, &(0x7f00000001c0)}) r2 = dup2(r1, r0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000002c0)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x40406300}], 0x0, 0x0, &(0x7f0000000300)}) 13:29:51 executing program 4: preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f00000000c0)=""/148, 0x94}], 0x1, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000080)='io\x00') preadv(r0, &(0x7f0000000480), 0x10000000000002a1, 0x500) 13:29:51 executing program 1: socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)) syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0xe1, 0x0) creat(&(0x7f00000001c0)='./file0\x00', 0x2) openat$dsp(0xffffffffffffff9c, &(0x7f0000000200)='/dev/dsp\x00', 0x8000, 0x0) syz_open_dev$mouse(&(0x7f0000000240)='/dev/input/mouse#\x00', 0x100, 0x10000) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000007000)={0x8, 0x0, &(0x7f0000000140)=[@acquire], 0x0, 0x0, &(0x7f00000001c0)}) r2 = dup2(r1, r0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000002c0)={0x8, 0x0, &(0x7f00000000c0)=[@release], 0x0, 0x0, &(0x7f0000000300)}) 13:29:51 executing program 3: clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000640), 0xffffffffffffffff) r0 = ioctl$KVM_CREATE_VM(0xffffffffffffff9c, 0xae01, 0x0) fcntl$getflags(r0, 0x40b) r1 = getpid() socketpair$inet_dccp(0x2, 0x6, 0x0, &(0x7f0000000140)={0xffffffffffffffff}) accept(r2, &(0x7f0000000180)=@xdp, &(0x7f0000000240)=0x80) dup(r0) creat(&(0x7f0000000080)='./file0\x00', 0xd3) sched_setscheduler(r1, 0x5, &(0x7f0000000200)) r3 = perf_event_open$cgroup(&(0x7f00000000c0)={0x8, 0x70, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000040)}}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) r4 = getuid() syz_mount_image$reiserfs(&(0x7f0000000280)='reiserfs\x00', &(0x7f00000002c0)='./file0\x00', 0x101, 0x8, &(0x7f0000001700)=[{&(0x7f0000000300)="dd3f74bb9c110e07172bac14e924e988c22db1510d2fe71007c545a0fa42daea9eee3bf8127b528a75ab6b8d089ee3fa02225c0cbe2b0bdaa98bbf67d9e0477ea8e370efb4d627bfcf101611d34a37d0a75ee430b932119852b86b2eb21e2882b7af59dea1976cebb307fbc46046106746a625182125d2e9e65840328985063ab6c3caa70a68a43aa70b01ce56513246017e7e21dec582f56cbffbbcb99ea476168562d5a38f56d64a293453e0c0b58a581136f8841a32f2bebc554d6effb3da0e288397011e156c30b6af23c84518bcc529f2543eab1a7da37900d909cdc3f8edc748671e", 0xe5, 0xe4a}, {&(0x7f0000000680)="a04e2ca5c4c4c3b173c6cc31e481d24c91b7f74ae73eedc2fd74b301d12a39b9fc93002552c7091f4fe9ecad0ed01e73b587221d18f541872730516421b39da93ac5a6f4eb8652ec2c02d032c88885660f2ae2a346aea954acccdd7b11b6a4bbf48e73e794efb513ea3364435c83d35e3448bdadc4bd7c6e24dab699b99b7695f0da98f8cb99f329030a0932afdfc88f7b82fe00d24ad76da5f9a09d1ab8a90ded17d481b781cd9e88e1976355e1442f4a9aeb95cc5aa187ea2d7ace6cc80cec327a65e4d0b50d1b2d2a9e28c73bd3775e35dd462054060e65058a64fde21ca7d4aee449b486b8538f39a898881f536679c3c147875850d61d5e4d64c5bcd8f373468841f772d5283e4f5d009d47a8c535068b2935cce310a61d629ec33bed8302e40669ae8027ceab4004a9fdd405bb9c4cdec413490ae8f33f525266fd2076e0d7d62b916cc3944714737fd7dddb00412251ba8c4f6e6da9709d730bd03fc6ec5df928b4a88cca76cb45cafeba768a9934032e84a6fdbd2b16e0792c816d5c2062f90ebbf3a58d76e91f5793fc756134df16910a47ec7d9eaf76963a4dc3c3919dde0abffe55b11731b80777faff27b6d188c4358da88d6e99f7a9379f1914d6a87f1c4efe6b39d9a399a9808af08ea3e1d444856721f9ce342662880e4c3bbd055bf5674626eff4bd46bcee82e9575e98788c541d2bf3fb9a3a76efd9529a67f841e2254dda4643dd59091d63604f0af8a85de587c8ac726883b0e15efd321e473d84ae50fed5cf6272af0cc3efc7922a679d6acc9594fe62f0277242ecc281c53f3302bf63878b6d402b5b34c11863a7203d493ca26766567e1cea1b927c4f6ec7167f4f00e13476a281f4de1cd17ee4a8e166a26a893e29cc16f53774721d9a5956f68dc54da717c4ee4a4af523e3437f1204fc7accbec74d410b31a6b027dad301185c3419806ee13e1ec0b4d2ed744125b86952027ef4accabd1bb6f4b629b81cb3eba193c1d3dc542d0afe4d5d945544d9cb6d8f14903d5344f720e1683cd9a0dd79912503d767d542509dc7bdbb062d403eb4cce9945b61759790d66e321a300d21bbb3d492fe905733099c35538d0d3dc6d4c574bdacc5d12a4f92ca70dd7813f2a2f6d611904becb5d55c68fb8d5ed9b45e63db59c76f91296bc37677741c23232025cea6fa7847c6a96686420cc78b539581e6d8d105e73428345eebe917b01f64e1b6c4561b6492e1c882da98fde26260a6ff961466bde2611fb5844d56618e7016ca42d3c9eafaf310bffb5e6d9f0075b98cf9692bec6ac0d5faba6e117ec891c2e03147241fe732e8d27895605086cadd8a1de2ed0e5e86a130e79cf5cd4534c8cdc3bfaa8433a54f28b9583cc2b1a8ccaaa24d08d59a671eaf56a210377f58e37934e7d14fb95854c07ecde4e8caf730d4796ea22306132f659bc6c52c95f0cbfda29bd25b74be46a8f7f750beb6af2a4ccc3c352f7048df45b56fdc0ca8ffae690d672d50c2b8f3739fb463e035eb712afc74185938f09261c3f1f5a500a453212215b5f27a81c95cef03c8394f171bbf081dea529a60115fc72532156699d85f40e2ef694883322d0749ce9e79cbd7493a74387961c5ff0fc05f464de1382f097245212aacaaf44a1d21b823f6226f78ba6a460cd7bd74d6ff2f612c03880126cc24c55fad82237d1af8b84d212ff8185f4e3240b1638156998f14b05168fe532c9fd6cb2b2f0585d9c8039738ce72f299d9b4e2f8a6c3e9820f4eca88fe4fe36e909753cabd4b622e69a70db24b17abc675f202f5697f2f9480e6411ce3779fb6b88c62d7d901a3a6c17f2e7e986ebfaa6c59ee116975706014ab3b5f4a70fd282069402dbea5739bf949a87938133ea660ab2470a4212f4d4092dc725aef4992d2b669f700ad4e67f1313359cd8ee87c838a4c8351f0fc772011eaf502ebaebe99751d5b379665edd562f8e92b0d960b05b419b9db4ea30b805cc0416fa2e8da8660ed4fbd2dfb9d1e38fbac451488d0e2d74b9570216bbe3945dc431bf0167332b20cb63e43b6e3c7bab5c2846edaf8d20cf987e1e10f6632a8d7b202e6bc6f7ab2c42179e65cef97717711f8679568925cb92d4ae589d3302991084f98b5c663c4aed50966bf48f0af4f40428b484d997d0113a0b805d13fe7709f752c49f2eb95da34dd3cf8c4f4d16c0bfa6d9581a3c6eae9790ae9409c8fc4624766327e55f08d9361922ec89dd75ce32cf4124a30f503a84c6dfc16ac30c8005cb1482677af657dc464a0fd31285cd3a22f69b734f5bd7d276549152d1dc72424cb30834fdfff0bcaf9e7f4c7dfc8991f4eb7eaf4c8e6663a7c4bd4c9e20bf897941afe385677d2ac4fed576e6192acb39a9f5cf3df98dde11ef1ed92c339a00066369e86d452cc5ecc106f877294f35fdbf9335d854c6dc79d0bdc15dc204f9be3aebde73b557dba0fe95935d021a3894c2130a7f4148a2189a6bb36e453af4102d9da8abc0863219402aa8c5320b477c753200c709c6b49df65eeaa1db2d74168576d13f82a84371dd3fe898c089f978d8c97242b463db634d687d9a422d50a4e9a34586ef11aeefee3b14334c793d539000c3338e933574a153e16685f5b321063a3e283c0c1f3af9b65bdbae314180778bd1979a5cffdf4f920e37245404b41e5214496cd967eca0c0b945c9b6093e4759cdd3df168803a5afb9f023f120a1d77d75334f6a40cae17441e715b440cd63a7ba95dc61bf3dc9c2dea4bd3ec9cfc2c71135cd7998b3086e21ec61c062ee8e3ba28d258a4bc5b433180716797df0d9a92a87be084032c8ae03f0dc54c5c32efb47101f530cb5d1a6ab6f51290457227a7919443d1b71d26c5f4329198c3cad2bbb2d55278848c533cef69973ca58d3b86d31926dbae00c22ca85fdf36461c6029790d800b66478405a6613e0b8653fd064ae94dc02312236df950b51b3c9fb62d91119b3c0077d213dbd53c162c8bff63d0e10ef299169305ee65a8a1e67b5efc20e397607af980db4d2e59584161fa6353f3ae830bf5b8edf2507e3faee0c289e72f8046a0670ba99a59bfe3c6c563cb8d6ad152fbaf03f8d2fce66b061d68a8cd57dc421108c4c374e772b8f654fcb22b0fda8b8094d9cd55461f761c05b46066d0d9fefed545b300e6ea41d15e6c329a28de239ea44f0b10490b87e696f78e5b8ee21b004e0154c34b055de17730270be9d3a17fb9b589cb48a2c52ae4cf1a872a7225f0a90ab8882ed291fffa68599004a1b14595fcdaae845cf7179ec0980b2086ed78b9ddd808c9ae7b1af5d94865cf8a3a1b4fa1b9d6c804c858a784a5fb5e736f49cace5a514c00f61d167a40ea9a75bdd102225e67fc89b3de7fac0cd46d4d58d2ff043d22a03dea0a3ee871f54a67cf7e4df70a6856cdf1e6cdf91f8f993065b7e17d92921525888d49151af7d9496e4584194edd62ec941cc6d19603769d289d10ee19603258197b69c14a2c8d19d0f2ad6e827e57fb8bc06e12152cd0dfd87f79b5bd409b876ab70226f9f7346758c90be0da0f9c467d2547fb49708b915f5df89fef0d4f5b16a45d6e4bc35133eec918921fc61e8f11331cf2da85d104c77d1be69fd49f353ec25755e2775ec3fe56768c297fa5340179e2b5912be9a85e0c89c67c4c161b3c04b2316914eca4891a039a1ce6ce160bad09aa4b495aff569735ba57afe8594a3a804f163a3f2f2b8c708fc38ce3e4c3c0f0d22c153c13f94a243f12c7ff382e4119058025fa48fc58952bad9c02d783076a68627e7656ce1702539e6ca6625445e3d44308dd595477db4f76e2483062284376a72c931549e61798f523197818201c2aa2781169373e3016dc7f09d43f94d966e22dc4ee93c97288bcb0d7b03decbad26508db53eacd3867a70dbeda364b7a8b0e28777a08c0d4b47b33ce7f0d43881288b342de8c0f60f172ebf4ba62330c063ba2a09444f78edb070739d785662fce1de9605d855b57e93ce5f315514377b7bcb3515dc2d39c2a8c0f69e6055fe5154fb90a0c46025c94d7c5579d01d2fc408df8f608a4d71b585e67eb2bf782de31b5351dfc7f104cbe86a051ae832f099bd640ac6420d4962917f15e75e3be29496230b7ee598f46ffed9624f650cd02b211a0abe8c1b6366d34774a7df279e1b3cd3109b0721db8bb2a66716fbbfcc988cfa27b4ca31e4535a0c2e33f4d79a2846141a150e64c0875fff2adcd5797cd29fe0fc6693b36436d397dbdf3de7d7c4b5c2d95946ce1c07df0127ec8960be5d961fe39400bcc4acafabc3347677f609582e872e5bf8cd92292dd1f639cd3151f16ff516a7c9dfd7a52a4440d36cbf55732c8bb7086f16611595e03c497f47845faeec938ddff11142ad76d5dcd536a70aff01aa926cdb4763a2856e70b4d5b2f85db4a696a3fa24ba226216e425f404704df2be5d2bd693b1f7df7fd5f1375b8b7863ae47a9bf7eb9325d58f70db84ec123503aabb9760bfa8bd2560efc673ba754cd916fae256c34b04b260fb02ff6bc7fd453503c4515353038d562bfc232cfc28316048a7d7106a12bfbbaa3b4bdfc20ed1a7d913ae08c284a6a6003d4bce9a9d549b9b0b8b1a3cff2bdc0f709d4d4ef858c2c2d162f00a3b5540fb49e5dfc9d28463ab6e355fe99775d30d79df29e23e588db7e71bc1ad42ec9670abf508c116fdbcccd625cf46ab553784b9fdb797286888a9acb4dafa5b7883a21032d784f6b74e3af97a22c2310f40b152c6dd4ed542b3061567b821e9b2a3a947df7999266b2369fa822faa09a7632a945fe3e2c7bad778cb31143797e183a14f657ce9a4736fdc6099704358547d648ee193a217e4bf40d18533d1863b27d3e792419f6392c67e57c1edcf12a32bbfd5dbc2747f58201857772d89a3a1b333f7438c64bd05ea0c1f1dafba3f2f84d8092ed8621924b07094665eb1bcc043eab3d621206f73f27c6f3dc6f921f98a652986aeff518bad2ae10a79b161f67ca91123aeedfae11979f83e976755b947badcfcb310d382f681642a5fc55a0730cfd702afcb5e8bfcacfd1cbc8390823a0f123056496267e409d44c25c2f479accf51e2fbc75d91a4bfec1aed58b74f57001f5b8e041a8a2330fb766a3540faa54b962c28dc87154d8051e06174553119220add62610c0c2ab0431d140cc96d44373fb376e333323674764583b87ca4174f96a69745a514fa614272f3cf461dec71dcd4dc826b50c1be51e5af0b3fe4097b3e584232ba0db89332cefb1526f9af781b04619ebee9c260bba31a54aa11e412743f476b8fa2d8a7765b3c2cb23d8e984ec1e55f9cfe9e4c6780f983864c311e6fa0e956241a2e89dd2fe5831f81e850d8e4fbfad968869081a4567d63c2f27ea97deaac322fe4deca4c929af4abe444dd09f9db4233ca9e597494718416b16c1bb7c5be9d0564105a06df412a3782775be0caf49efe02ef95ef8924edd0891d6c9e31f42020547522dd2429adf84aa1e6fe2461887e3691655a6002aa14081e2abf0e673415cd359c128da461eba1c518129e785fc8d801d51364c06201f1fd35f74b9e4cbcdce3285140de31ff4728826e2b8efcf44ff3db643424de86cf3f38b922b1c41f56d7250a0799bde38d515ab8f1689dde77b316617805bd892443d8fee6295895628d91cfdbb1352eb33377f029ecdfff7f3840e79e95812fa11d7ae264fd435b3f6fd19b5280bfae1f19b1b13f4de9ea98864acafff7264b40bd2c9a587b53f980de07ae2df91f17f5eac236e1a8b21c3c03fb7a", 0x1000, 0x19}, {&(0x7f0000000400)="12fff2a45f04b7255132c70165433cd735318f81d44d20ff003bb49cacfe09e01c804b29e4fa0ea1ea1b697a9a401b8c2cd639994db4b94479e2f5b2269d990ff8e37e009abbc41fbb09dae3df21da8b6cf231c2ca5159961e269bfab3f56f5b01e043d2ad4dfad5583a0f", 0x6b, 0x100}, {&(0x7f0000000480)="c9fd16a9f72e89006683107245191f244a694699751e84d2656b6096a9c712a0a8b7877f5dcad706972ebc19fd74c88ebbd12a6d427201c164f74fe21a5b8e0ad8d3148857564d7d4ad90f36ce01d960c1aa33b7e4b36da17ef15665cf4e051a905581a69164c82a5e71f3e4fa5ba27ecb5546df25f1d5c35cc28d38", 0x7c, 0x7}, {&(0x7f0000000500)="02d80b042969290aa2704b8ac3b25e37a7b90f5812d2af581407119d3e0ce0fe3b", 0x21, 0x7ff}, {&(0x7f0000000540)="4f60185e0432a31f8124057491fa04b98407dcaa88508c04ac0de824182bc8bf5bba17649947543924c73a8f2f9675512bae1c5a0e5036a4d1ba46fe96e698287257411dd0309bc056a9135694c064f900e233679cd61fc229c32c3ee11125dfc984679fa6223f57ef792ae765a871fbc450b189a4ca48448926a3fc257ac7cbbf94473dbb442be0486b9c1eaacd3579c64dc963cf35eacf4463fef65b42ed2ed73871332913f3b9579d75ffb8049e32c250cc3c26df57966a82acd938130829efa5dc409b5d1a6474f21a8416635b81d8d255942ccd4b9daf15199c5aa8b691adc6a3eb0b5cd33806bf37a15a52f68170cac3049afccd28e8b175", 0xfb, 0x100}, {&(0x7f0000001680)="a7337ffb5bbc7d9722447a7de6e8e7", 0xf, 0x6000000000}, {&(0x7f00000016c0)="0fe97557b305e5e359b64aac1ba1f7aa5af9d37bdc98be13dea0191eb2a8b5ac449aa97444d00e211134a1696bd31f893b", 0x31, 0x8}], 0x1000, &(0x7f00000017c0)={[{@usrjquota_file='usrjquota=syz'}, {@balloc_test4='block-allocator=test4'}, {@balloc_test4='block-allocator=test4'}], [{@fowner_lt={'fowner<', r4}}, {@smackfsdef={'smackfsdef', 0x3d, '*$-\\vboxnet0posix_acl_access:&securityprocvmnet0!md5sum'}}]}) ioctl$PERF_EVENT_IOC_PERIOD(r3, 0x40082404, &(0x7f0000000000)=0x3) [ 549.963945] binder: 26553:26558 transaction failed 29189/-22, size 0-0 line 2834 13:29:51 executing program 0: r0 = socket$inet(0x2, 0x4000000803, 0x4) bind$inet(r0, &(0x7f0000000000)={0x2, 0x0, @broadcast}, 0x10) getsockname(r0, &(0x7f00000036c0)=@xdp={0x2c, 0x0, 0x0}, &(0x7f0000000080)=0x80) setsockopt$inet_pktinfo(r0, 0x0, 0x8, &(0x7f0000003780)={r1, @rand_addr, @dev}, 0xc) syz_emit_ethernet(0x4a, &(0x7f0000000240)={@link_local, @empty=[0x0, 0x0, 0x600000000000000], [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x3c, 0x0, 0x0, 0x0, 0x4, 0x0, @empty=0x9000000, @broadcast}, @udp={0x0, 0x0, 0x28}}}}}, &(0x7f0000000380)) 13:29:51 executing program 4: preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f00000000c0)=""/148, 0x94}], 0x1, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000080)='io\x00') preadv(r0, &(0x7f0000000480), 0x10000000000002a1, 0xa) [ 550.051718] binder: undelivered TRANSACTION_ERROR: 29189 [ 550.089065] binder: 26556:26562 Acquire 1 refcount change on invalid ref 0 ret -22 13:29:51 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000007000)={0x8, 0x0, &(0x7f0000000140)=[@acquire], 0x0, 0x0, &(0x7f00000001c0)}) r2 = dup2(r1, r0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000002c0)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x630c}], 0x0, 0x0, &(0x7f0000000300)}) [ 550.208444] binder: 26556:26562 Release 1 refcount change on invalid ref 0 ret -22 13:29:51 executing program 5: r0 = socket$key(0xf, 0x3, 0x2) sched_setaffinity(0x0, 0x8, &(0x7f0000000100)=0x800000009) r1 = perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r2 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r2, &(0x7f0000000200)={0xa, 0x0, 0x0, @remote, 0x2}, 0x1c) setsockopt$inet6_IPV6_XFRM_POLICY(r2, 0x29, 0x23, &(0x7f00000013c0)={{{@in, @in6=@ipv4={[], [], @rand_addr}, 0x0, 0x0, 0x0, 0x0, 0x2}, {}, {}, 0x0, 0x0, 0x1}, {{@in6=@local, 0x0, 0x32}, 0x0, @in6, 0x0, 0x0, 0x0, 0x5}}, 0xe8) connect$inet6(r2, &(0x7f0000000140)={0xa, 0xffffffffffffffff, 0x0, @ipv4={[], [], @dev={0xac, 0x14, 0x14, 0x18}}}, 0x1c) sendmmsg(r2, &(0x7f0000000240), 0x5c3, 0x0) sendmsg$key(r0, &(0x7f0000000000)={0x40000000, 0x0, &(0x7f0000000040)={&(0x7f0000000080)={0x2, 0x7, 0x0, 0x9, 0x2}, 0x10}}, 0x0) write$binfmt_misc(r1, &(0x7f0000000240)={'syz0', "c632bc5c49cf7f3d7e7ab753f8b7a6cd7bd8c0b790136e8424a002e077489035f5d4d32c90c8ece4cd0a38f79f46926dd2f2eb918c39524221e22fcc07e585d452571bac3b309ea9be932f68374306df14337fedcd6648aefd192422ef0278d4ce687ff6e782d07dea456c385743f60525135e01ad7e26447a56f44c322011be9352de33d1f7eccfbbc21903077a525d64bbb2eca3c9f51031f22a15443c5dd55b108775e1f2"}, 0xaa) 13:29:51 executing program 1: socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)) syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0xe1, 0x0) creat(&(0x7f00000001c0)='./file0\x00', 0x2) openat$dsp(0xffffffffffffff9c, &(0x7f0000000200)='/dev/dsp\x00', 0x8000, 0x0) syz_open_dev$mouse(&(0x7f0000000240)='/dev/input/mouse#\x00', 0x100, 0x10000) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000007000)={0x8, 0x0, &(0x7f0000000140)=[@acquire], 0x0, 0x0, &(0x7f00000001c0)}) r2 = dup2(r1, r0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000002c0)={0x8, 0x0, &(0x7f00000000c0)=[@release], 0x0, 0x0, &(0x7f0000000300)}) 13:29:51 executing program 0: r0 = socket$inet(0x2, 0x4000000803, 0x4) bind$inet(r0, &(0x7f0000000000)={0x2, 0x0, @broadcast}, 0x10) getsockname(r0, &(0x7f00000036c0)=@xdp={0x2c, 0x0, 0x0}, &(0x7f0000000080)=0x80) setsockopt$inet_pktinfo(r0, 0x0, 0x8, &(0x7f0000003780)={r1, @rand_addr, @dev}, 0xc) syz_emit_ethernet(0x4a, &(0x7f0000000240)={@link_local, @empty=[0x0, 0x0, 0x3c00000000000000], [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x3c, 0x0, 0x0, 0x0, 0x4, 0x0, @empty=0x9000000, @broadcast}, @udp={0x0, 0x0, 0x28}}}}}, &(0x7f0000000380)) [ 550.393154] binder: 26586:26598 unknown command 0 [ 550.400567] binder: 26586:26598 ioctl c0306201 200002c0 returned -22 13:29:51 executing program 4: preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f00000000c0)=""/148, 0x94}], 0x1, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000080)='io\x00') preadv(r0, &(0x7f0000000480), 0x10000000000002a1, 0x100000000000000) 13:29:51 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000007000)={0x8, 0x0, &(0x7f0000000140)=[@acquire], 0x0, 0x0, &(0x7f00000001c0)}) r2 = dup2(r1, r0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000002c0)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x40086310}], 0x0, 0x0, &(0x7f0000000300)}) 13:29:51 executing program 0: r0 = socket$inet(0x2, 0x4000000803, 0x4) bind$inet(r0, &(0x7f0000000000)={0x2, 0x0, @broadcast}, 0x10) getsockname(r0, &(0x7f00000036c0)=@xdp={0x2c, 0x0, 0x0}, &(0x7f0000000080)=0x80) setsockopt$inet_pktinfo(r0, 0x0, 0x8, &(0x7f0000003780)={r1, @rand_addr, @dev}, 0xc) syz_emit_ethernet(0x4a, &(0x7f0000000240)={@link_local, @empty=[0x0, 0x0, 0xb000000], [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x3c, 0x0, 0x0, 0x0, 0x4, 0x0, @empty=0x9000000, @broadcast}, @udp={0x0, 0x0, 0x28}}}}}, &(0x7f0000000380)) [ 550.531047] binder: 26611:26613 Acquire 1 refcount change on invalid ref 0 ret -22 [ 550.570168] binder: 26611:26613 Release 1 refcount change on invalid ref 0 ret -22 13:29:51 executing program 1: socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)) syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0xe1, 0x0) creat(&(0x7f00000001c0)='./file0\x00', 0x2) openat$dsp(0xffffffffffffff9c, &(0x7f0000000200)='/dev/dsp\x00', 0x8000, 0x0) syz_open_dev$mouse(&(0x7f0000000240)='/dev/input/mouse#\x00', 0x100, 0x10000) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000007000)={0x8, 0x0, &(0x7f0000000140)=[@acquire], 0x0, 0x0, &(0x7f00000001c0)}) r2 = dup2(r1, r0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000002c0)={0x8, 0x0, &(0x7f00000000c0)=[@release], 0x0, 0x0, &(0x7f0000000300)}) [ 550.636945] binder: 26621:26625 BC_DEAD_BINDER_DONE 0000000000000000 not found 13:29:52 executing program 4: preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f00000000c0)=""/148, 0x94}], 0x1, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000080)='io\x00') preadv(r0, &(0x7f0000000480), 0x10000000000002a1, 0x6cefff7f00000000) [ 550.804067] binder: 26630:26638 Acquire 1 refcount change on invalid ref 0 ret -22 [ 550.852695] binder: 26630:26638 Release 1 refcount change on invalid ref 0 ret -22 13:29:52 executing program 3: r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000380)={0x9, 0x7, 0x3, 0x400000bff}, 0x2c) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000180)={r0, &(0x7f0000000040), &(0x7f0000000080)}, 0x20) bpf$MAP_DELETE_ELEM(0x3, &(0x7f0000000080)={r0, &(0x7f0000000580)="0910b09021f75bdc8b6e3751e180958a2f67e31ae3a45d7de162914ec5e4c4851bee8a063fd51f64b43ca908291ba02e1ea4be4801da6d0d4167055c8f55b1450b20b5fc6a1e06a04b1c4a85592976c57b640559a2ba1282dcef204de13ecd514424b6cf6a6b2bcf5230c1e1f0b2fa7967e70b632e60ec21d44f7d03426d4714c87598232d99b630c76b63ad23c1e98731cf5ff6c5cc04971ff9bd8468560c656b9dab6fd99e30ca3211b9fb8f99b452f3ffcef8f0ff97ed7d67b8e80b5488f04dfab4a286f3a7928a2afb9a6e3e68a182260e0703713f00cb04dd9dbd390d9300997d6584cd08d8f2fb0350d899341577a9281e13ca5d5daa6955219e67d553d96b9a4a91ebc98bf34d0bc6fb84c2154ec2e447280db24e8ee74c024263677bec44d34939bd7cbfabb33ad6de0a3152e68817a875f9e00af5a6d830baca794d75d9aea110f84cc4d9959615e8e66673ab7edae8caa4e51917ae42daeb5231785bb1040b1f9284229f483cfb4ae96769304c505412337b34ebac5a74dcab77d181bae266d2052d06"}, 0x10) fcntl$getownex(r0, 0x10, &(0x7f0000000000)={0x0, 0x0}) gettid() tgkill(r1, r1, 0x24) 13:29:52 executing program 0: r0 = socket$inet(0x2, 0x4000000803, 0x4) bind$inet(r0, &(0x7f0000000000)={0x2, 0x0, @broadcast}, 0x10) getsockname(r0, &(0x7f00000036c0)=@xdp={0x2c, 0x0, 0x0}, &(0x7f0000000080)=0x80) setsockopt$inet_pktinfo(r0, 0x0, 0x8, &(0x7f0000003780)={r1, @rand_addr, @dev}, 0xc) syz_emit_ethernet(0x4a, &(0x7f0000000240)={@link_local, @empty=[0x0, 0x0, 0x800e], [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x3c, 0x0, 0x0, 0x0, 0x4, 0x0, @empty=0x9000000, @broadcast}, @udp={0x0, 0x0, 0x28}}}}}, &(0x7f0000000380)) 13:29:52 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000007000)={0x8, 0x0, &(0x7f0000000140)=[@acquire], 0x0, 0x0, &(0x7f00000001c0)}) r2 = dup2(r1, r0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000002c0)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x4008630a}], 0x0, 0x0, &(0x7f0000000300)}) 13:29:52 executing program 4: preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f00000000c0)=""/148, 0x94}], 0x1, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000080)='io\x00') preadv(r0, &(0x7f0000000480), 0x10000000000002a1, 0xa00000000000000) [ 551.000355] binder: BC_ATTEMPT_ACQUIRE not supported [ 551.046183] binder: 26649:26654 ioctl c0306201 200002c0 returned -22 13:29:52 executing program 5: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x5, &(0x7f0000000340)="0a5cc80700315f85715070") recvfrom$inet6(r0, &(0x7f0000000000), 0x0, 0x40, 0x0, 0x0) r1 = openat$audio(0xffffffffffffff9c, &(0x7f0000000000)='/dev/audio\x00', 0x420000, 0x0) setsockopt$RDS_RECVERR(r1, 0x114, 0x5, &(0x7f0000000040), 0x4) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000580)={&(0x7f0000000500), 0xc, &(0x7f0000000540)={&(0x7f00000015c0)=@ipv4_newroute={0x30, 0x18, 0x331, 0x0, 0x0, {0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfe, 0x2}, [@RTA_MULTIPATH={0x14, 0x9, {0x8}}, @RTA_OIF={0x8}]}, 0x30}}, 0x0) socket$alg(0x26, 0x5, 0x0) 13:29:52 executing program 1: socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)) syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0xe1, 0x400100) creat(&(0x7f00000001c0)='./file0\x00', 0x0) openat$dsp(0xffffffffffffff9c, &(0x7f0000000200)='/dev/dsp\x00', 0x8000, 0x0) syz_open_dev$mouse(&(0x7f0000000240)='/dev/input/mouse#\x00', 0x100, 0x10000) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000007000)={0x8, 0x0, &(0x7f0000000140)=[@acquire], 0x0, 0x0, &(0x7f00000001c0)}) r2 = dup2(r1, r0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000002c0)={0x8, 0x0, &(0x7f00000000c0)=[@release], 0x0, 0x0, &(0x7f0000000300)}) 13:29:52 executing program 0: r0 = socket$inet(0x2, 0x4000000803, 0x4) bind$inet(r0, &(0x7f0000000000)={0x2, 0x0, @broadcast}, 0x10) getsockname(r0, &(0x7f00000036c0)=@xdp={0x2c, 0x0, 0x0}, &(0x7f0000000080)=0x80) setsockopt$inet_pktinfo(r0, 0x0, 0x8, &(0x7f0000003780)={r1, @rand_addr, @dev}, 0xc) syz_emit_ethernet(0x4a, &(0x7f0000000240)={@link_local, @empty=[0x0, 0x0, 0x3f00], [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x3c, 0x0, 0x0, 0x0, 0x4, 0x0, @empty=0x9000000, @broadcast}, @udp={0x0, 0x0, 0x28}}}}}, &(0x7f0000000380)) 13:29:52 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000007000)={0x8, 0x0, &(0x7f0000000140)=[@acquire], 0x0, 0x0, &(0x7f00000001c0)}) r2 = dup2(r1, r0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000002c0)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x40106308}], 0x0, 0x0, &(0x7f0000000300)}) 13:29:52 executing program 4: preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f00000000c0)=""/148, 0x94}], 0x1, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000080)='io\x00') preadv(r0, &(0x7f0000000480), 0x10000000000002a1, 0x600) 13:29:52 executing program 3: r0 = dup2(0xffffffffffffff9c, 0xffffffffffffff9c) openat$cgroup_type(r0, &(0x7f0000000080)='cgroup.type\x00', 0x2, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) writev(r1, &(0x7f0000000000)=[{&(0x7f0000000040)="290000002000190000003fffffffda060200000000e800023bad18a38487635aea1100000005050000", 0x29}], 0x1) [ 551.303439] netlink: 13 bytes leftover after parsing attributes in process `syz-executor3'. [ 551.336228] binder: 26669:26675 BC_INCREFS_DONE u0000000000000000 no match 13:29:52 executing program 0: r0 = socket$inet(0x2, 0x4000000803, 0x4) bind$inet(r0, &(0x7f0000000000)={0x2, 0x0, @broadcast}, 0x10) getsockname(r0, &(0x7f00000036c0)=@xdp={0x2c, 0x0, 0x0}, &(0x7f0000000080)=0x80) setsockopt$inet_pktinfo(r0, 0x0, 0x8, &(0x7f0000003780)={r1, @rand_addr, @dev}, 0xc) syz_emit_ethernet(0x4a, &(0x7f0000000240)={@link_local, @empty=[0x0, 0x0, 0x1f4], [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x3c, 0x0, 0x0, 0x0, 0x4, 0x0, @empty=0x9000000, @broadcast}, @udp={0x0, 0x0, 0x28}}}}}, &(0x7f0000000380)) 13:29:52 executing program 4: preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f00000000c0)=""/148, 0x94}], 0x1, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000080)='io\x00') preadv(r0, &(0x7f0000000480), 0x10000000000002a1, 0x3) 13:29:52 executing program 3: perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sync() ioctl$KVM_SET_MP_STATE(0xffffffffffffffff, 0x4004ae99, &(0x7f0000000400)=0x2) r0 = socket$inet6(0xa, 0x1, 0x8010000000000084) bind$inet6(r0, &(0x7f0000ef8cfd)={0xa, 0x4e23, 0x0, @loopback}, 0x1c) r1 = socket$inet6_sctp(0xa, 0x1, 0x84) sendto$inet6(r1, &(0x7f0000e33fe0)='X', 0xffffffffffffff25, 0x0, &(0x7f00000000c0)={0xa, 0x4e23, 0x20000000000000, @loopback}, 0x1c) r2 = accept4(r0, 0x0, &(0x7f0000000080), 0x0) syz_open_dev$ndb(&(0x7f0000000100)='/dev/nbd#\x00', 0x0, 0x4000) setsockopt$inet_sctp6_SCTP_RESET_ASSOC(r1, 0x84, 0x78, &(0x7f00000003c0), 0x4) write$FUSE_POLL(0xffffffffffffffff, &(0x7f00000001c0)={0x18, 0x0, 0x4}, 0x18) shutdown(r2, 0x1) 13:29:52 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000007000)={0x8, 0x0, &(0x7f0000000140)=[@acquire], 0x0, 0x0, &(0x7f00000001c0)}) r2 = dup2(r1, r0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000002c0)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x400c630e}], 0x0, 0x0, &(0x7f0000000300)}) [ 551.370029] binder: 26668:26681 Acquire 1 refcount change on invalid ref 0 ret -22 [ 551.409101] binder: 26668:26681 Release 1 refcount change on invalid ref 0 ret -22 13:29:52 executing program 5: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f00000003c0)='/dev/kvm\x00', 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0x4020ae46, &(0x7f00000000c0)={0xfffffffffffffffd, 0x8002000004, 0x2000014ffd, 0x2000, &(0x7f0000015000/0x2000)=nil}) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r3, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000140)=[@textreal={0x8, &(0x7f0000000000)="66b98103000066b80200008066ba000000000f30baf80c66b818a0078e66efbafc0cb80040efbad00466b80b00000066ef260f01b50d00f20f0136003067260f01cb0f07bad004ec0f01cb0f35", 0x4d}], 0x1, 0x0, &(0x7f00000003c0), 0xa4) r4 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/backup_only\x00', 0x2, 0x0) ioctl$PERF_EVENT_IOC_REFRESH(r4, 0x2402, 0x5) ioctl$KVM_RUN(r3, 0xae80, 0x0) 13:29:52 executing program 1: socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)) syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0xe1, 0x400100) creat(&(0x7f00000001c0)='./file0\x00', 0x0) openat$dsp(0xffffffffffffff9c, &(0x7f0000000200)='/dev/dsp\x00', 0x8000, 0x0) syz_open_dev$mouse(&(0x7f0000000240)='/dev/input/mouse#\x00', 0x100, 0x10000) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000007000)={0x8, 0x0, &(0x7f0000000140)=[@acquire], 0x0, 0x0, &(0x7f00000001c0)}) r2 = dup2(r1, r0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000002c0)={0x8, 0x0, &(0x7f00000000c0)=[@release], 0x0, 0x0, &(0x7f0000000300)}) 13:29:52 executing program 0: r0 = socket$inet(0x2, 0x4000000803, 0x4) bind$inet(r0, &(0x7f0000000000)={0x2, 0x0, @broadcast}, 0x10) getsockname(r0, &(0x7f00000036c0)=@xdp={0x2c, 0x0, 0x0}, &(0x7f0000000080)=0x80) setsockopt$inet_pktinfo(r0, 0x0, 0x8, &(0x7f0000003780)={r1, @rand_addr, @dev}, 0xc) syz_emit_ethernet(0x4a, &(0x7f0000000240)={@link_local, @empty=[0x0, 0x0, 0x7], [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x3c, 0x0, 0x0, 0x0, 0x4, 0x0, @empty=0x9000000, @broadcast}, @udp={0x0, 0x0, 0x28}}}}}, &(0x7f0000000380)) 13:29:52 executing program 4: preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f00000000c0)=""/148, 0x94}], 0x1, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000080)='io\x00') preadv(r0, &(0x7f0000000480), 0x10000000000002a1, 0x300000000000000) 13:29:52 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000007000)={0x8, 0x0, &(0x7f0000000140)=[@acquire], 0x0, 0x0, &(0x7f00000001c0)}) r2 = dup2(r1, r0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000002c0)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x40106309}], 0x0, 0x0, &(0x7f0000000300)}) 13:29:53 executing program 1: socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)) syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0xe1, 0x400100) creat(&(0x7f00000001c0)='./file0\x00', 0x0) openat$dsp(0xffffffffffffff9c, &(0x7f0000000200)='/dev/dsp\x00', 0x8000, 0x0) syz_open_dev$mouse(&(0x7f0000000240)='/dev/input/mouse#\x00', 0x100, 0x10000) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000007000)={0x8, 0x0, &(0x7f0000000140)=[@acquire], 0x0, 0x0, &(0x7f00000001c0)}) r2 = dup2(r1, r0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000002c0)={0x8, 0x0, &(0x7f00000000c0)=[@release], 0x0, 0x0, &(0x7f0000000300)}) 13:29:53 executing program 5: r0 = memfd_create(&(0x7f0000000100)='wlan1-*]\x00', 0x6) fcntl$setstatus(r0, 0x4, 0x42400) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x0, 0x5011, r0, 0x0) 13:29:53 executing program 0: r0 = socket$inet(0x2, 0x4000000803, 0x4) bind$inet(r0, &(0x7f0000000000)={0x2, 0x0, @broadcast}, 0x10) getsockname(r0, &(0x7f00000036c0)=@xdp={0x2c, 0x0, 0x0}, &(0x7f0000000080)=0x80) setsockopt$inet_pktinfo(r0, 0x0, 0x8, &(0x7f0000003780)={r1, @rand_addr, @dev}, 0xc) syz_emit_ethernet(0x4a, &(0x7f0000000240)={@link_local, @empty=[0x0, 0x0, 0x700], [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x3c, 0x0, 0x0, 0x0, 0x4, 0x0, @empty=0x9000000, @broadcast}, @udp={0x0, 0x0, 0x28}}}}}, &(0x7f0000000380)) [ 551.742413] binder: 26716:26717 BC_ACQUIRE_DONE u0000000000000000 no match 13:29:53 executing program 4: preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f00000000c0)=""/148, 0x94}], 0x1, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000080)='io\x00') preadv(r0, &(0x7f0000000480), 0x10000000000002a1, 0xf0ff7f00000000) 13:29:53 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000007000)={0x8, 0x0, &(0x7f0000000140)=[@acquire], 0x0, 0x0, &(0x7f00000001c0)}) r2 = dup2(r1, r0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000002c0)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x40046302}], 0x0, 0x0, &(0x7f0000000300)}) 13:29:53 executing program 3: bpf$MAP_DELETE_ELEM(0x2, &(0x7f0000000140)={0xffffffffffffffff, &(0x7f0000000040)}, 0x10) connect$inet(0xffffffffffffffff, &(0x7f0000002880)={0x2, 0x0, @rand_addr=0x5}, 0x10) r0 = dup(0xffffffffffffffff) r1 = socket$inet(0x2, 0x4000000000000001, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(0xffffffffffffffff, 0x2405, 0xffffffffffffffff) setsockopt$inet_tcp_int(r1, 0x6, 0x0, &(0x7f0000000140)=0x78, 0x4) getrusage(0x0, &(0x7f0000000300)) perf_event_open(&(0x7f0000002800)={0x7, 0x70, 0x0, 0x5, 0xa3, 0x0, 0x0, 0x0, 0x80002, 0xe, 0x2, 0x7, 0x5, 0x0, 0x7, 0x0, 0x7, 0x0, 0x2, 0x10001, 0x7, 0x0, 0x3, 0x8, 0x0, 0x8, 0x0, 0x0, 0x0, 0x7, 0x3, 0x40, 0x9, 0x0, 0x400, 0x4, 0x0, 0x0, 0x0, 0x3, 0x0, @perf_bp={&(0x7f00000027c0)}, 0x2002, 0x1000, 0x0, 0x5, 0x0, 0x1}, 0x0, 0xb, 0xffffffffffffffff, 0x2) setsockopt$inet_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f00000002c0)='hybla\x00', 0x6) bind$inet(r1, &(0x7f0000deb000)={0x2, 0x4e23, @multicast1}, 0x10) connect(0xffffffffffffffff, &(0x7f00000003c0)=@ipx={0x4, 0x5, 0x1, "1e8df4dd1bbc", 0x8a}, 0x80) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socketpair$inet6_tcp(0xa, 0x1, 0x0, &(0x7f0000000100)) ioctl$UFFDIO_COPY(r0, 0xc028aa03, &(0x7f00000001c0)={&(0x7f0000fff000/0x1000)=nil, &(0x7f0000fff000/0x1000)=nil, 0x1000}) write$P9_RCREATE(0xffffffffffffffff, &(0x7f0000000240)={0xfffffffffffffe8a, 0x73, 0x0, {{0x0, 0x0, 0x3}}}, 0x18) sendto$inet(r1, &(0x7f0000a88f88), 0x29f, 0x200007fd, &(0x7f0000e68000)={0x2, 0x4e23, @loopback}, 0x10) sendto$inet(r1, &(0x7f0000000000), 0xff6c, 0x0, &(0x7f00000000c0)={0x2, 0x0, @dev}, 0x10) ioctl$SG_GET_PACK_ID(0xffffffffffffffff, 0x227c, &(0x7f0000000040)) 13:29:53 executing program 5: syz_mount_image$btrfs(&(0x7f0000000140)='btrfs\x00', &(0x7f0000000180)='./file0\x00', 0x0, 0x0, &(0x7f00000007c0), 0x0, &(0x7f0000000380)=ANY=[]) syz_mount_image$ntfs(&(0x7f0000000200)='ntfs\x00', &(0x7f0000000080)='./file1\x00', 0x0, 0x30, &(0x7f0000000580), 0x8000, &(0x7f0000000680)=ANY=[]) mount$overlay(0x404030, &(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f0000000100)={[{@upperdir={'upperdir', 0x3d, './file0'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@workdir={'workdir', 0x3d, './file1'}, 0x5c}]}) umount2(&(0x7f0000000040)='./file0\x00', 0x0) [ 551.928339] binder: BC_ACQUIRE_RESULT not supported 13:29:53 executing program 0: r0 = socket$inet(0x2, 0x4000000803, 0x4) bind$inet(r0, &(0x7f0000000000)={0x2, 0x0, @broadcast}, 0x10) getsockname(r0, &(0x7f00000036c0)=@xdp={0x2c, 0x0, 0x0}, &(0x7f0000000080)=0x80) setsockopt$inet_pktinfo(r0, 0x0, 0x8, &(0x7f0000003780)={r1, @rand_addr, @dev}, 0xc) syz_emit_ethernet(0x4a, &(0x7f0000000240)={@link_local, @empty=[0x0, 0x0, 0x86ddffff00000000], [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x3c, 0x0, 0x0, 0x0, 0x4, 0x0, @empty=0x9000000, @broadcast}, @udp={0x0, 0x0, 0x28}}}}}, &(0x7f0000000380)) 13:29:53 executing program 1: socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)) syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0xe1, 0x400100) creat(&(0x7f00000001c0)='./file0\x00', 0x2) openat$dsp(0xffffffffffffff9c, &(0x7f0000000200)='/dev/dsp\x00', 0x0, 0x0) syz_open_dev$mouse(&(0x7f0000000240)='/dev/input/mouse#\x00', 0x100, 0x10000) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000007000)={0x8, 0x0, &(0x7f0000000140)=[@acquire], 0x0, 0x0, &(0x7f00000001c0)}) r2 = dup2(r1, r0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000002c0)={0x8, 0x0, &(0x7f00000000c0)=[@release], 0x0, 0x0, &(0x7f0000000300)}) 13:29:53 executing program 4: preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f00000000c0)=""/148, 0x94}], 0x1, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000080)='io\x00') preadv(r0, &(0x7f0000000480), 0x10000000000002a1, 0x2000000) [ 551.981516] binder: 26733:26738 ioctl c0306201 200002c0 returned -22 13:29:53 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000007000)={0x8, 0x0, &(0x7f0000000140)=[@acquire], 0x0, 0x0, &(0x7f00000001c0)}) r2 = dup2(r1, r0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000002c0)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x630b}], 0x0, 0x0, &(0x7f0000000300)}) 13:29:53 executing program 3: r0 = accept(0xffffffffffffffff, &(0x7f0000000000)=@generic, &(0x7f0000000080)=0x80) getsockopt$inet_dccp_int(r0, 0x21, 0x1f, &(0x7f00000000c0), &(0x7f0000000140)=0x4) r1 = dup2(0xffffffffffffffff, 0xffffffffffffff9c) ioctl$LOOP_SET_DIRECT_IO(r1, 0x4c08, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = socket(0x1e, 0x1, 0x0) sendmsg(r2, &(0x7f00003bbfc8)={&(0x7f0000fdbf80)=@generic={0x10000000001e, "02ff0100000001000000000000000ae77f5bf86c48020002000000f1ffffff009a480075e6a50000de010300000000e4ff064b3f013a000000080000008f00000000ac50d5fe32c4000000007fffffff6a008356edb9a6341c1fd45624281e00070ecddd0206c39750c40000fd00000900000000000b0000db000004da36"}, 0x2ef, &(0x7f0000d1b000), 0x4b, &(0x7f000012e000)}, 0x0) recvmsg$kcm(r2, &(0x7f0000000d40)={&(0x7f0000000800)=@l2, 0x80, &(0x7f0000000c00)=[{&(0x7f0000001600)=""/4096, 0x1000}, {&(0x7f0000000400)=""/45, 0x2d}, {&(0x7f0000000980)=""/253, 0xfd}, {&(0x7f0000002600)=""/4096, 0x1000}], 0x4, &(0x7f0000000cc0)=""/71, 0x47}, 0x40000100) write$binfmt_elf32(r2, &(0x7f00000015c0)=ANY=[@ANYPTR=&(0x7f0000000100)=ANY=[@ANYRES16]], 0xfffffd6d) 13:29:53 executing program 1: socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)) syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0xe1, 0x400100) creat(&(0x7f00000001c0)='./file0\x00', 0x2) openat$dsp(0xffffffffffffff9c, &(0x7f0000000200)='/dev/dsp\x00', 0x0, 0x0) syz_open_dev$mouse(&(0x7f0000000240)='/dev/input/mouse#\x00', 0x100, 0x10000) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000007000)={0x8, 0x0, &(0x7f0000000140)=[@acquire], 0x0, 0x0, &(0x7f00000001c0)}) r2 = dup2(r1, r0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000002c0)={0x8, 0x0, &(0x7f00000000c0)=[@release], 0x0, 0x0, &(0x7f0000000300)}) 13:29:53 executing program 0: r0 = socket$inet(0x2, 0x4000000803, 0x4) bind$inet(r0, &(0x7f0000000000)={0x2, 0x0, @broadcast}, 0x10) getsockname(r0, &(0x7f00000036c0)=@xdp={0x2c, 0x0, 0x0}, &(0x7f0000000080)=0x80) setsockopt$inet_pktinfo(r0, 0x0, 0x8, &(0x7f0000003780)={r1, @rand_addr, @dev}, 0xc) syz_emit_ethernet(0x4a, &(0x7f0000000240)={@link_local, @empty=[0x0, 0x0, 0xb00], [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x3c, 0x0, 0x0, 0x0, 0x4, 0x0, @empty=0x9000000, @broadcast}, @udp={0x0, 0x0, 0x28}}}}}, &(0x7f0000000380)) [ 552.199510] binder: 26760:26763 ERROR: BC_REGISTER_LOOPER called without request 13:29:53 executing program 4: preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f00000000c0)=""/148, 0x94}], 0x1, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000080)='io\x00') preadv(r0, &(0x7f0000000480), 0x10000000000002a1, 0x300) 13:29:53 executing program 5: syz_mount_image$btrfs(&(0x7f0000000140)='btrfs\x00', &(0x7f0000000180)='./file0\x00', 0x0, 0x0, &(0x7f00000007c0), 0x0, &(0x7f0000000380)=ANY=[]) syz_mount_image$ntfs(&(0x7f0000000200)='ntfs\x00', &(0x7f0000000080)='./file1\x00', 0x0, 0x30, &(0x7f0000000580), 0x8000, &(0x7f0000000680)=ANY=[]) mount$overlay(0x404030, &(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f0000000100)={[{@upperdir={'upperdir', 0x3d, './file0'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@workdir={'workdir', 0x3d, './file1'}, 0x5c}]}) umount2(&(0x7f0000000040)='./file0\x00', 0x0) [ 552.282414] binder: 26760:26763 unknown command 0 13:29:53 executing program 0: r0 = socket$inet(0x2, 0x4000000803, 0x4) bind$inet(r0, &(0x7f0000000000)={0x2, 0x0, @broadcast}, 0x10) getsockname(r0, &(0x7f00000036c0)=@xdp={0x2c, 0x0, 0x0}, &(0x7f0000000080)=0x80) setsockopt$inet_pktinfo(r0, 0x0, 0x8, &(0x7f0000003780)={r1, @rand_addr, @dev}, 0xc) syz_emit_ethernet(0x4a, &(0x7f0000000240)={@link_local, @empty=[0x0, 0x0, 0x800e0000], [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x3c, 0x0, 0x0, 0x0, 0x4, 0x0, @empty=0x9000000, @broadcast}, @udp={0x0, 0x0, 0x28}}}}}, &(0x7f0000000380)) [ 552.313628] binder: 26760:26763 ioctl c0306201 200002c0 returned -22 13:29:53 executing program 1: socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)) syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0xe1, 0x400100) creat(&(0x7f00000001c0)='./file0\x00', 0x2) openat$dsp(0xffffffffffffff9c, &(0x7f0000000200)='/dev/dsp\x00', 0x0, 0x0) syz_open_dev$mouse(&(0x7f0000000240)='/dev/input/mouse#\x00', 0x100, 0x10000) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000007000)={0x8, 0x0, &(0x7f0000000140)=[@acquire], 0x0, 0x0, &(0x7f00000001c0)}) r2 = dup2(r1, r0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000002c0)={0x8, 0x0, &(0x7f00000000c0)=[@release], 0x0, 0x0, &(0x7f0000000300)}) 13:29:53 executing program 4: preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f00000000c0)=""/148, 0x94}], 0x1, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000080)='io\x00') preadv(r0, &(0x7f0000000480), 0x10000000000002a1, 0x5) [ 552.428794] binder: 26760:26763 ERROR: BC_REGISTER_LOOPER called without request [ 552.498395] binder: 26760:26763 unknown command 0 [ 552.523681] binder: 26760:26763 ioctl c0306201 200002c0 returned -22 13:29:53 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000007000)={0x8, 0x0, &(0x7f0000000140)=[@acquire], 0x0, 0x0, &(0x7f00000001c0)}) r2 = dup2(r1, r0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000002c0)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x40046307}], 0x0, 0x0, &(0x7f0000000300)}) 13:29:53 executing program 1: socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)) syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0xe1, 0x400100) creat(&(0x7f00000001c0)='./file0\x00', 0x2) openat$dsp(0xffffffffffffff9c, &(0x7f0000000200)='/dev/dsp\x00', 0x8000, 0x0) syz_open_dev$mouse(&(0x7f0000000240)='/dev/input/mouse#\x00', 0x0, 0x10000) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000007000)={0x8, 0x0, &(0x7f0000000140)=[@acquire], 0x0, 0x0, &(0x7f00000001c0)}) r2 = dup2(r1, r0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000002c0)={0x8, 0x0, &(0x7f00000000c0)=[@release], 0x0, 0x0, &(0x7f0000000300)}) 13:29:53 executing program 0: r0 = socket$inet(0x2, 0x4000000803, 0x4) bind$inet(r0, &(0x7f0000000000)={0x2, 0x0, @broadcast}, 0x10) getsockname(r0, &(0x7f00000036c0)=@xdp={0x2c, 0x0, 0x0}, &(0x7f0000000080)=0x80) setsockopt$inet_pktinfo(r0, 0x0, 0x8, &(0x7f0000003780)={r1, @rand_addr, @dev}, 0xc) syz_emit_ethernet(0x4a, &(0x7f0000000240)={@link_local, @empty=[0x0, 0x0, 0x6000000000000000], [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x3c, 0x0, 0x0, 0x0, 0x4, 0x0, @empty=0x9000000, @broadcast}, @udp={0x0, 0x0, 0x28}}}}}, &(0x7f0000000380)) 13:29:53 executing program 4: preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f00000000c0)=""/148, 0x94}], 0x1, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000080)='io\x00') preadv(r0, &(0x7f0000000480), 0x10000000000002a1, 0x500000000000000) [ 552.694528] binder: 26802 invalid dec weak, ref 330 desc 0 s 1 w 0 13:29:54 executing program 3: r0 = socket(0x40000000015, 0x5, 0x0) perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e5}, 0x0, 0x0, 0xffffffffffffffff, 0x0) bind$inet(r0, &(0x7f0000000840)={0x2, 0x4e20, @loopback}, 0x10) mkdir(&(0x7f0000000100)='./file0\x00', 0x0) creat(&(0x7f0000b9a000)='./file0/bus\x00', 0x0) r1 = open$dir(&(0x7f0000eb6000)='./file0/bus\x00', 0x0, 0x0) r2 = dup(r1) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x2011, r2, 0x0) close(0xffffffffffffffff) bpf$MAP_GET_NEXT_KEY(0x4, &(0x7f00000000c0)={r2, &(0x7f0000000880)="9d3538bd816396cd85977a90efb561264b61b3b7d27e369cb87a1ab34549aacbb6b61088f9654188f8e078021b1a1ff996f695a3d9ab7439db36fa9743cc0a52354c5cff0f82ec8123d3e7830cc11739746ea9066bb4084fdc845d064d8892816ac0d25c27efa7390b8a951e61a31a5f741fda89a5aa7c918e2b66a6419ce60339d00cc47d8c7902d97e0f9ebb266e51a57675326560a06e8dbef1ad03001338ac5c578fc566cc0f9c79171bfea824bb10d125c70043dee105f9b5f096fecf0a96b6a20ddc38f3eb2e446cdc2a88b6412c8098d4ccd39df5e8956af53f07e024bd1c39b38657c0b018a66aa3b753bf516ddceaf39a11e2f394bfc692b0ffa2329518146e0e183d225f5a7780a2bfc2f8ee9ecfb62205309fa678927de0c84f953cc30adbd5e64994f962e46fd5e3b07f1f9021abd28b510a13ec2d84c8179fe10ee5b979eb01b826876a1e4699863072cd22902f48493f6841cf86215aebcb488b5af6c0aee0ade859d22a363607530bcedf9a80fd38e8f4fee41f2c33498980d2209db5726f4e62aba5d9a8802dee177c948111cf9c1ffd2478c74b99050fd6bad6c2c58678931ba3786b4b22e0ab8b092d1739f5986cf9166429762a3d68462b7c702ff9758683ed82c58c5a353246759f21acaaeff124198d32410756775c4cf3ba28220aa07af6e49ef1a191a8d94decf47eab45753686c65dfe00fdcc6d489a25fd0a0fb42e85c36c3d30ea35620fd7f0b5420088fc26e5789acb4641d3b6695965b5e72394f8e1bd0ac4503377cf2050719cee117296e5312dda9e603f705e87ad9a1e8c86a6aa01bee7920c35cf6eebce45ce6048992a701fcf83e2cda706df1292df16c500bb5f75d7bb1117aa3f12c93fe57d656374866f80e1d20ac2de6793e63fc0e1d477e73a475242207768c37760e7a92a98a63d1d758b802463d9949093bb1e43d00cfcd40cb13e834463dc2e7a8ec7709f007eb8d4b461154bdc893e299dd17784ac828a19449cdc66050615d9760614af5328072841396b1681639f3923f2caa2282bed6775a71dd3c2251f89c3782d38e791a1f1b5c95536a57cbae5775511b09de15ca624b9dd3e6d622541e8f0b9283ab4023b00f5cc18b2e4cdee35ecb64193c1a22281876e544f3e253952dd0c2a63d7fc12a474f19309d3d6c85d9f29180089e98199f0cd1b5b5121be7c1221466c3db1bd89c5a14de4dcf9e682f0bfa310aa12df927bd16b77bd0218c37ebc3d92393f3d26514edab51ae7af887976c848e45c523061f19ae48a3a1e3749d4cd02fbb052e634510531e1af79190d3094b6ecd7a4a6fd4e46f409ddd9d3246012572d56bfd8f9c9de3a248b0e28772143ca37b5bf28c030f4e55c87771191d05ca3d8b5d4a3c56ffd03bb788528d8b2ba89fca9341658b6ff9893333c592116426a73c5f2774b62f39588ac971cdf1ba6a333b4819c40d3824ddf725251716c76da140b990e6be55aaf9d5b9ac76cde3bedc60f386d466a6b3a5e8ebddf59054374d4c8f99aded4610e77602fd9ccd3f0c854788ebb7ec1dd88877f1c3e9425ef75fe89e64e07396740595c3172ab97e4b2aa6e9cf3ebd4793e9a1ffa6e7f17a41bab76592066323ac4dc72e93c57779efa9dfd90719d206f2b26b7d6c1fb0f5cf976bffbb270d14f21912459abbeef7fcfc1e3435e1c03bff1ff267dd961a75a04d6bc5b8673a55526079cbcf098241c71cc0411d1f0a308f00364708c8edb95c939b7969233820e5c7943c638f3664744de1f0817c33dd7c17b1b5f2e527058f8a67234b53bbc8f942826ee5a9cf1223e3e807631fb8fc6d0c3033b5f8d7f1c245c0868e3b18caf0c8c080f24c9f518f9642d5036ebd1ea60c476d1a1dc1c3264f4ef5071d95ceccfd998b1afa9fc2e6f613c3ea0b7b197872e0124a80605bb826a452e5710b4665a426cf6725044c3d1d2a5ad9f2b46a6ca669a44222cd3d198b5e56e91bf04875d0b8854e625c1aa66becdf7e18eba8178ea15c4c74881db75f7b0a10462312a4201ef1476ea1310e5e2f859eb7f8b2da14350a06bcd055cbd807e6d080069e79cebe6a96d9905b80517b54ed757df1c12281f5f3bacd6b755b10a2b631fcb5923d8b3edea0256247a268be8f884cd679897987b100dc06843f430063c69c96eb970f5356d5fe62744d04b18310381b1997102fa13bbaf495095fe5970fad9caea5cd22bb280d04954da1b312913a6720c94031aa1f42699f1af39d016a6e8d5a5d94a9ea95397a52e0d2906a828d9f57f0215f1d3c6ec66a13554b38a03ab471f34c61d03c3aca9ef36ece26e2b930145cc94be67dec61ed7dd6cb4188485f544250162b10068c198a8ed53b4fc2b3fe6ecc967adeb69357e2fb768d6b6f0c9f9d919ef919a394930ee856c20c640bab2c11e2da89bda890f6ec9466024e7cc86fd75c34c03b1b7062b1d7259dd79a881bbe55529843e21637b71d6b50a92a4f984125bb6b24bd05553427bc9848ef67fdaaf74e8fa5e509b3a213e58cad3eff8bdf14339008d8f2926378e223f28bb6ee0edcf9715b9ebfe012bd28cd758a8b9352df39237d7211655a7cf491403cace4fcd5eba8e169a820b71ae64ac2203eb505b3c0d073c6a7711b75094547eaa50c13979f11aab904ca142de4165b86d1da6f1708dc4e82ba422ab85ae1ac97c0a226f25ab82e0d105f89fcf93fbdaa08d4edcb9875df7bf83042da3a0ea6fe6b9baf6a23fcd32ccb688f85f2c11e8fa197e9e7911aa1ad896ba6e581f874d77f7fafdc2f59756bcb3751cdd7cd42d9afd1eb8907ded5eab5bb51c6972a6cbb132204297ef1fd44a6dec99af325d64d6b30a10cc7aea2ea5df31735364708c0a8f0f49d9a4378ec1c806f547defaaed1f86fef255ffb0a443393930cbde4f77532485e5d103f5c4a10a8943f8e8c27c5a654895b689ccdbe03b45003296cf36bd0d895699f68ef2dd220800aef146d26a2813cb76110b391c00ef469323113bb9a83cb6b49ce707f5ea717f3b95dc2381a46f7a7d8d841f06097b974e2c31751de20a0042c3d0e39c0a27b1c8088e4b4d8dd4e22a67ccb34ac2129c8e33a6de73491687dadadf6e86ebcd5444a89bf15bf04599ff6d77261dadf8ea187060668fd2f70713ffd10bb0dea6ef85bcbcf6cabbe180085a24146f3a0578b0810d5736791dd206f440b3689c76935eef89b0fd73383f39758e06df25a404eab5d9d4ac37d71beb8e31fadd497994909543986e4a9fedb74de81beaf4d72150d1eb56093169c98c0398419b2fdd9f430a5b07d73a80baa60c2f663762e1aed1d0734a9808caab2dfa7bd313a748a050ebc11edefe3344b1ceb394580159c498e7e0bed0151f625b1c0614ecbe14c4d3306200b788cc7056bd65e99a696363a33e218311808158ebc92c340f18c69464b3b6bd0870c13333c045e248e6772c5308353b203a53b08b0bd164e401dcf8d75053d583790cd7685e9176df9260d6998c83310d7f97d4abaa167bf021cbecf063f73240eee9ffe362828b4deb9701d122547d98f1be3c4836574463e926feb86e3b063c1434b647d66048f3bb66a0a1f5ede55cacdd6c2c1ca2596f6ebba6d609458b6c961f68268d2bcb56842f0b9d156cc3181e16bf472ca9a3534cc2beee93bb9b27f4ca71a851fe5e0cecf664c9afb57e39eb53ffbc9340d64500fdd4c4b81dee8b39158259c0e4c9d63adc7ef759ac7a0fc38bcd983aaac014b755c7b443c50035cf1775521bc0495e15eee0a312a7b5354d6e9d844c7216f423ad6c4c65ba7bf86a2637d2b8a50c7f4419093b23fa63ca91c75b39c2b3130440f7161da9daaf534405d9d19634ed75c348601bf88c0d8dc03fb1744f5697615111ac7c75b014e56cea05622fc92c856bc90a0921e915245aff2cc3b4461e9575ad6f0a5f7d920b6dd3d8a404e9a2068675b5325f4cbe5f52ac1f812744f734c10fbb493de749e5a236dcc99342bff76848c417366fc55e539d23580788ecaa0d63b4c84a0c378ef9ae2f097b4108dd58c5833ffbfae21445c6c165f91566ea738045444360b2e1622a9d753aaa200be915e89aae8cca165244f1008bcbc2034fdf6d144af20ab49fb1331b704695c4fbd8b6a9af99ce31af889378fa5d6b792bb521eafe2a8eefb6080499b3b2b979d5c28f3ccfa04284b30544325e8bc8a3b7f479e50c32c951fdd67929ed670b246e159ffdfe58bac472a660f5d7ab11ab9a882ba07e0933964a30866eea28f100c4b4b4da9e08c19566b5d5ce8e63c8354c003dbdcfeee185e59e32ed09968f050c91f0674f8a9ddc5f2e6ee47579cda3d38f5d058634d0375c3a046e22ae14999597a947dc7ee4b97d76e276e01f32e1b35549381e78b0b438537095da92d6c8411f34d71cc7a5293d25e66560bfb4f204577df17b02270648fc1ea7d63209125124223b3238cd5fcede46ba1794198eb78febe1d029e95035ca7b7e3c572246325b6c82710e0a28db4f086fc52399d287bac74a554ab1c30c2130e577485a586f807ed1a07c547a43b5b4a7ea89f7ca77ba97375abe3b7baa455f15271851f38036ebc38176429cedcb7ea3c4bd8bc27a25c9d3c30e8e79dbe7f87cb620f9378a7b3b4e58334e80f4d7c4d2e0f11d14be21011a9519f12bbb9e988e738ad31c5e454b51b823a9734d40c805a01caadffc22bfaa41eeedd1d238fff52962ef90fc439b458193b290671dae53b4ca1f75ab32042ef7e15441a372d902400c94aeaacd6e6b11239d0ba3651724dbf9385c75a0199444bec3130d15d9eb4f02c63b67b989dd3e295179a2688d35eccd76ca221c6d60227c1e6f869b97e9fcd78b81d77ba7225195783ced6922830719013fb9e713b68ea89cf3c70a5873a0de00e2981aeab335475ef789cd872a0ade32dde8b4d4b242635dc694e12aff420a95e0d0504545b414d49dc09b55eae0e92ba1c2ed4b36b59c2ad25e20d6eefa6a82879b20cf696d91403e027f60f2da219a14ecbc663968e722f48909617885aa7af2e73d6dc0cad7aeb4310fc0e71a3c3e9b00c82a479471759759c67ab56cbb3108e58c20bdf2fcb36088332ec7904b0e7a2917f4195ec539fcd0fd7c887ca5cad42a501ca227c986bb07894157760841e0bee88b2e59f2a98299e65210bb5afe34fe7607592ee28b22316c0a4f551cb6a9bac4cf10020e50bdb3b6c6afe401570c61db5449df17359bd6791288092fb94ed710a3b59b0249b0805dff0d25dde1424efece308e23d1ca29ad6fc93355c0053a160c65b56c4da7e398756d6c13f093f20af006eb0fb31c94eb9b42836b994d70bc42256fad650a584c198242033f6dfd3f6fcc34cfb5061156909c02843d0a32527b24a42f544c5f3364d83b347a09a55b9e16a5cd5176ba3da14bf27d64f2ad8e64b87f065349099024e7ff7c2fbed1fc9bbbcdd71e6362c86a4f72e87dbb2ebf6fe3bc81668f4880bfe4f8997298f554664c5c9d463ed495c06d8999ba89052b7aa1cc28f542499007b4e2491490360a3a3341f375e6d361ec023d562afa67ae1059480cc46d5b215123a244bda2ed560a50a3b49eb7cb520a8b79f377024e75fa4c3b2358d91ebf7b5284adde640c358bb4e9381dfd159782daf65e2a56e2588312ef4136eeeff398becbf99127cec3e33a8f16e5f00060de523ae2ee12a06f7b1283096f49b83cd5882a1eed60c917ee93bad7da52737adf109b4332f94510f5fe74c1b37c0079da316a1376d5252d15a06c0326de19e66d6fb67e0262ce8a1dd079f38", &(0x7f0000000040)=""/125}, 0x18) sendto$inet(r0, &(0x7f0000000000)="ba", 0x1, 0x0, &(0x7f000069affb)={0x2, 0x0, @loopback}, 0x10) 13:29:54 executing program 1: socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)) syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0xe1, 0x400100) creat(&(0x7f00000001c0)='./file0\x00', 0x2) openat$dsp(0xffffffffffffff9c, &(0x7f0000000200)='/dev/dsp\x00', 0x8000, 0x0) syz_open_dev$mouse(&(0x7f0000000240)='/dev/input/mouse#\x00', 0x0, 0x10000) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000007000)={0x8, 0x0, &(0x7f0000000140)=[@acquire], 0x0, 0x0, &(0x7f00000001c0)}) r2 = dup2(r1, r0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000002c0)={0x8, 0x0, &(0x7f00000000c0)=[@release], 0x0, 0x0, &(0x7f0000000300)}) 13:29:54 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000007000)={0x8, 0x0, &(0x7f0000000140)=[@acquire], 0x0, 0x0, &(0x7f00000001c0)}) r2 = dup2(r1, r0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000002c0)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x400c630f}], 0x0, 0x0, &(0x7f0000000300)}) 13:29:54 executing program 5: syz_mount_image$btrfs(&(0x7f0000000140)='btrfs\x00', &(0x7f0000000180)='./file0\x00', 0x0, 0x0, &(0x7f00000007c0), 0x0, &(0x7f0000000380)=ANY=[]) syz_mount_image$ntfs(&(0x7f0000000200)='ntfs\x00', &(0x7f0000000080)='./file1\x00', 0x0, 0x30, &(0x7f0000000580), 0x8000, &(0x7f0000000680)=ANY=[]) mount$overlay(0x404030, &(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f0000000100)={[{@upperdir={'upperdir', 0x3d, './file0'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@workdir={'workdir', 0x3d, './file1'}, 0x5c}]}) umount2(&(0x7f0000000040)='./file0\x00', 0x0) 13:29:54 executing program 0: r0 = socket$inet(0x2, 0x4000000803, 0x4) bind$inet(r0, &(0x7f0000000000)={0x2, 0x0, @broadcast}, 0x10) getsockname(r0, &(0x7f00000036c0)=@xdp={0x2c, 0x0, 0x0}, &(0x7f0000000080)=0x80) setsockopt$inet_pktinfo(r0, 0x0, 0x8, &(0x7f0000003780)={r1, @rand_addr, @dev}, 0xc) syz_emit_ethernet(0x4a, &(0x7f0000000240)={@link_local, @empty=[0x0, 0x0, 0x806000000000000], [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x3c, 0x0, 0x0, 0x0, 0x4, 0x0, @empty=0x9000000, @broadcast}, @udp={0x0, 0x0, 0x28}}}}}, &(0x7f0000000380)) 13:29:54 executing program 4: preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f00000000c0)=""/148, 0x94}], 0x1, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000080)='io\x00') preadv(r0, &(0x7f0000000480), 0x10000000000002a1, 0x700000000000000) [ 552.910068] audit: type=1804 audit(1540474194.209:156): pid=26824 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor3" name="/root/syzkaller-testdir625636457/syzkaller.IugyCy/743/file0/bus" dev="sda1" ino=16564 res=1 [ 552.939494] binder: 26823:26825 BC_CLEAR_DEATH_NOTIFICATION death notification not active 13:29:54 executing program 4: preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f00000000c0)=""/148, 0x94}], 0x1, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000080)='io\x00') preadv(r0, &(0x7f0000000480), 0x10000000000002a1, 0x10000000000000) 13:29:54 executing program 1: socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)) syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0xe1, 0x400100) creat(&(0x7f00000001c0)='./file0\x00', 0x2) openat$dsp(0xffffffffffffff9c, &(0x7f0000000200)='/dev/dsp\x00', 0x8000, 0x0) syz_open_dev$mouse(&(0x7f0000000240)='/dev/input/mouse#\x00', 0x0, 0x10000) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000007000)={0x8, 0x0, &(0x7f0000000140)=[@acquire], 0x0, 0x0, &(0x7f00000001c0)}) r2 = dup2(r1, r0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000002c0)={0x8, 0x0, &(0x7f00000000c0)=[@release], 0x0, 0x0, &(0x7f0000000300)}) 13:29:54 executing program 0: r0 = socket$inet(0x2, 0x4000000803, 0x4) bind$inet(r0, &(0x7f0000000000)={0x2, 0x0, @broadcast}, 0x10) getsockname(r0, &(0x7f00000036c0)=@xdp={0x2c, 0x0, 0x0}, &(0x7f0000000080)=0x80) setsockopt$inet_pktinfo(r0, 0x0, 0x8, &(0x7f0000003780)={r1, @rand_addr, @dev}, 0xc) syz_emit_ethernet(0x4a, &(0x7f0000000240)={@link_local, @empty=[0x0, 0x0, 0x700000000000000], [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x3c, 0x0, 0x0, 0x0, 0x4, 0x0, @empty=0x9000000, @broadcast}, @udp={0x0, 0x0, 0x28}}}}}, &(0x7f0000000380)) [ 553.019617] audit: type=1804 audit(1540474194.239:157): pid=26824 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor3" name="/root/syzkaller-testdir625636457/syzkaller.IugyCy/743/file0/bus" dev="sda1" ino=16564 res=1 13:29:54 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000007000)={0x8, 0x0, &(0x7f0000000140)=[@acquire], 0x0, 0x0, &(0x7f00000001c0)}) r2 = dup2(r1, r0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000002c0)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x40046306, 0xfdfdffff00000000}], 0x0, 0x0, &(0x7f0000000300)}) 13:29:54 executing program 3: r0 = bpf$MAP_CREATE(0x0, &(0x7f0000733000)={0x5, 0x5, 0x7, 0x9}, 0x2c) r1 = bpf$MAP_CREATE(0x0, &(0x7f00004f9fe4)={0xd, 0x4, 0x4, 0x100000001, 0x0, r0}, 0x2c) bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0xd, 0x9, 0x4, 0x100000001, 0x0, r1}, 0x2c) bpf$OBJ_PIN_MAP(0x6, &(0x7f0000000080)={&(0x7f0000000000)='./file0\x00', r1}, 0x10) [ 553.180453] audit: type=1804 audit(1540474194.239:158): pid=26824 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor3" name="/root/syzkaller-testdir625636457/syzkaller.IugyCy/743/file0/bus" dev="sda1" ino=16564 res=1 13:29:54 executing program 1: socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)) syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0xe1, 0x400100) creat(&(0x7f00000001c0)='./file0\x00', 0x2) openat$dsp(0xffffffffffffff9c, &(0x7f0000000200)='/dev/dsp\x00', 0x8000, 0x0) syz_open_dev$mouse(&(0x7f0000000240)='/dev/input/mouse#\x00', 0x100, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000007000)={0x8, 0x0, &(0x7f0000000140)=[@acquire], 0x0, 0x0, &(0x7f00000001c0)}) r2 = dup2(r1, r0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000002c0)={0x8, 0x0, &(0x7f00000000c0)=[@release], 0x0, 0x0, &(0x7f0000000300)}) 13:29:54 executing program 4: preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f00000000c0)=""/148, 0x94}], 0x1, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000080)='io\x00') preadv(r0, &(0x7f0000000480), 0x10000000000002a1, 0x400000000000000) 13:29:54 executing program 5: syz_mount_image$btrfs(&(0x7f0000000140)='btrfs\x00', &(0x7f0000000180)='./file0\x00', 0x0, 0x0, &(0x7f00000007c0), 0x0, &(0x7f0000000380)=ANY=[]) syz_mount_image$ntfs(&(0x7f0000000200)='ntfs\x00', &(0x7f0000000080)='./file1\x00', 0x0, 0x30, &(0x7f0000000580), 0x8000, &(0x7f0000000680)=ANY=[]) mount$overlay(0x404030, &(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f0000000100)={[{@upperdir={'upperdir', 0x3d, './file0'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@workdir={'workdir', 0x3d, './file1'}, 0x5c}]}) umount2(&(0x7f0000000040)='./file0\x00', 0x0) 13:29:54 executing program 0: r0 = socket$inet(0x2, 0x4000000803, 0x4) bind$inet(r0, &(0x7f0000000000)={0x2, 0x0, @broadcast}, 0x10) getsockname(r0, &(0x7f00000036c0)=@xdp={0x2c, 0x0, 0x0}, &(0x7f0000000080)=0x80) setsockopt$inet_pktinfo(r0, 0x0, 0x8, &(0x7f0000003780)={r1, @rand_addr, @dev}, 0xc) syz_emit_ethernet(0x4a, &(0x7f0000000240)={@link_local, @empty=[0x0, 0x0, 0x88caffff00000000], [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x3c, 0x0, 0x0, 0x0, 0x4, 0x0, @empty=0x9000000, @broadcast}, @udp={0x0, 0x0, 0x28}}}}}, &(0x7f0000000380)) 13:29:54 executing program 3: r0 = open(&(0x7f0000000040)='./file0\x00', 0x10000, 0x88) ioctl$sock_inet_SIOCSIFDSTADDR(r0, 0x8918, &(0x7f0000000080)={'ip_vti0\x00', {0x2, 0x4e24, @loopback}}) r1 = creat(&(0x7f00000000c0)='./file0\x00', 0x0) ioctl$FS_IOC_SETFLAGS(r1, 0x40086602, &(0x7f0000000000)) write$cgroup_type(r1, &(0x7f0000000240)='threaded\x00', 0xf96d) fallocate(r1, 0x3, 0x0, 0x408001) fallocate(r1, 0x3, 0x0, 0xfff9) 13:29:54 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000007000)={0x8, 0x0, &(0x7f0000000140)=[@acquire], 0x0, 0x0, &(0x7f00000001c0)}) r2 = dup2(r1, r0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000002c0)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x40046306, 0xa0010000}], 0x0, 0x0, &(0x7f0000000300)}) 13:29:54 executing program 4: preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f00000000c0)=""/148, 0x94}], 0x1, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000080)='io\x00') preadv(r0, &(0x7f0000000480), 0x10000000000002a1, 0x100000) 13:29:54 executing program 0: r0 = socket$inet(0x2, 0x4000000803, 0x4) bind$inet(r0, &(0x7f0000000000)={0x2, 0x0, @broadcast}, 0x10) getsockname(r0, &(0x7f00000036c0)=@xdp={0x2c, 0x0, 0x0}, &(0x7f0000000080)=0x80) setsockopt$inet_pktinfo(r0, 0x0, 0x8, &(0x7f0000003780)={r1, @rand_addr, @dev}, 0xc) syz_emit_ethernet(0x4a, &(0x7f0000000240)={@link_local, @empty=[0x0, 0x0, 0x14000000], [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x3c, 0x0, 0x0, 0x0, 0x4, 0x0, @empty=0x9000000, @broadcast}, @udp={0x0, 0x0, 0x28}}}}}, &(0x7f0000000380)) 13:29:54 executing program 1: socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)) syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0xe1, 0x400100) creat(&(0x7f00000001c0)='./file0\x00', 0x2) openat$dsp(0xffffffffffffff9c, &(0x7f0000000200)='/dev/dsp\x00', 0x8000, 0x0) syz_open_dev$mouse(&(0x7f0000000240)='/dev/input/mouse#\x00', 0x100, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000007000)={0x8, 0x0, &(0x7f0000000140)=[@acquire], 0x0, 0x0, &(0x7f00000001c0)}) r2 = dup2(r1, r0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000002c0)={0x8, 0x0, &(0x7f00000000c0)=[@release], 0x0, 0x0, &(0x7f0000000300)}) 13:29:54 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000007000)={0x8, 0x0, &(0x7f0000000140)=[@acquire], 0x0, 0x0, &(0x7f00000001c0)}) r2 = dup2(r1, r0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000002c0)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x40046306, 0x100000000000000}], 0x0, 0x0, &(0x7f0000000300)}) 13:29:54 executing program 3: r0 = socket$unix(0x1, 0x2, 0x0) bind$unix(r0, &(0x7f0000000100)=@file={0x1, './file0\x00'}, 0x6e) r1 = openat$qat_adf_ctl(0xffffffffffffff9c, &(0x7f0000000000)='/dev/qat_adf_ctl\x00', 0x100, 0x0) ioctl$SIOCSIFHWADDR(r1, 0x8924, &(0x7f0000000080)={'veth1\x00', @broadcast}) getsockname(r0, &(0x7f0000000180)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @local}}}, &(0x7f0000000040)=0x80) 13:29:54 executing program 0: r0 = socket$inet(0x2, 0x4000000803, 0x4) bind$inet(r0, &(0x7f0000000000)={0x2, 0x0, @broadcast}, 0x10) getsockname(r0, &(0x7f00000036c0)=@xdp={0x2c, 0x0, 0x0}, &(0x7f0000000080)=0x80) setsockopt$inet_pktinfo(r0, 0x0, 0x8, &(0x7f0000003780)={r1, @rand_addr, @dev}, 0xc) syz_emit_ethernet(0x4a, &(0x7f0000000240)={@link_local, @empty=[0x0, 0x0, 0x60], [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x3c, 0x0, 0x0, 0x0, 0x4, 0x0, @empty=0x9000000, @broadcast}, @udp={0x0, 0x0, 0x28}}}}}, &(0x7f0000000380)) 13:29:54 executing program 4: preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f00000000c0)=""/148, 0x94}], 0x1, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000080)='io\x00') preadv(r0, &(0x7f0000000480), 0x10000000000002a1, 0xa00) 13:29:55 executing program 1: socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)) syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0xe1, 0x400100) creat(&(0x7f00000001c0)='./file0\x00', 0x2) openat$dsp(0xffffffffffffff9c, &(0x7f0000000200)='/dev/dsp\x00', 0x8000, 0x0) syz_open_dev$mouse(&(0x7f0000000240)='/dev/input/mouse#\x00', 0x100, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000007000)={0x8, 0x0, &(0x7f0000000140)=[@acquire], 0x0, 0x0, &(0x7f00000001c0)}) r2 = dup2(r1, r0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000002c0)={0x8, 0x0, &(0x7f00000000c0)=[@release], 0x0, 0x0, &(0x7f0000000300)}) 13:29:55 executing program 5: syz_mount_image$btrfs(&(0x7f0000000140)='btrfs\x00', &(0x7f0000000180)='./file0\x00', 0x0, 0x0, &(0x7f00000007c0), 0x0, &(0x7f0000000380)=ANY=[]) syz_mount_image$ntfs(&(0x7f0000000200)='ntfs\x00', &(0x7f0000000080)='./file1\x00', 0x0, 0x30, &(0x7f0000000580), 0x8000, &(0x7f0000000680)=ANY=[]) umount2(&(0x7f0000000040)='./file0\x00', 0x0) 13:29:55 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000007000)={0x8, 0x0, &(0x7f0000000140)=[@acquire], 0x0, 0x0, &(0x7f00000001c0)}) r2 = dup2(r1, r0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000002c0)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x40046306, 0xffffffffa0010000}], 0x0, 0x0, &(0x7f0000000300)}) [ 553.750501] QAT: Invalid ioctl [ 553.770624] QAT: Invalid ioctl 13:29:55 executing program 4: preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f00000000c0)=""/148, 0x94}], 0x1, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000080)='io\x00') preadv(r0, &(0x7f0000000480), 0x10000000000002a1, 0x700) 13:29:55 executing program 3: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)) r0 = syz_open_procfs(0x0, &(0x7f0000000380)='ns\x00') ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x3) getdents64(r0, &(0x7f0000000100)=""/136, 0x88) getdents64(r0, &(0x7f00000001c0)=""/248, 0xf8) setsockopt$inet_MCAST_JOIN_GROUP(r0, 0x0, 0x2a, &(0x7f00000002c0)={0x0, {{0x2, 0x4e20, @remote}}}, 0x88) 13:29:55 executing program 1: socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)) syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0xe1, 0x400100) creat(&(0x7f00000001c0)='./file0\x00', 0x2) openat$dsp(0xffffffffffffff9c, &(0x7f0000000200)='/dev/dsp\x00', 0x8000, 0x0) syz_open_dev$mouse(&(0x7f0000000240)='/dev/input/mouse#\x00', 0x100, 0x10000) perf_event_open(&(0x7f0000000040)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000007000)={0x8, 0x0, &(0x7f0000000140)=[@acquire], 0x0, 0x0, &(0x7f00000001c0)}) r2 = dup2(r1, r0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000002c0)={0x8, 0x0, &(0x7f00000000c0)=[@release], 0x0, 0x0, &(0x7f0000000300)}) 13:29:55 executing program 0: r0 = socket$inet(0x2, 0x4000000803, 0x4) bind$inet(r0, &(0x7f0000000000)={0x2, 0x0, @broadcast}, 0x10) getsockname(r0, &(0x7f00000036c0)=@xdp={0x2c, 0x0, 0x0}, &(0x7f0000000080)=0x80) setsockopt$inet_pktinfo(r0, 0x0, 0x8, &(0x7f0000003780)={r1, @rand_addr, @dev}, 0xc) syz_emit_ethernet(0x4a, &(0x7f0000000240)={@link_local, @empty=[0x0, 0x0, 0x3580], [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x3c, 0x0, 0x0, 0x0, 0x4, 0x0, @empty=0x9000000, @broadcast}, @udp={0x0, 0x0, 0x28}}}}}, &(0x7f0000000380)) 13:29:55 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000007000)={0x8, 0x0, &(0x7f0000000140)=[@acquire], 0x0, 0x0, &(0x7f00000001c0)}) r2 = dup2(r1, r0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000002c0)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x40046306, 0x3f00000000000000}], 0x0, 0x0, &(0x7f0000000300)}) 13:29:55 executing program 5: syz_mount_image$btrfs(&(0x7f0000000140)='btrfs\x00', &(0x7f0000000180)='./file0\x00', 0x0, 0x0, &(0x7f00000007c0), 0x0, &(0x7f0000000380)=ANY=[]) mount$overlay(0x404030, &(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f0000000100)={[{@upperdir={'upperdir', 0x3d, './file0'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@workdir={'workdir', 0x3d, './file1'}, 0x5c}]}) umount2(&(0x7f0000000040)='./file0\x00', 0x0) 13:29:55 executing program 3: r0 = socket$kcm(0x10, 0x2, 0x0) r1 = openat$autofs(0xffffffffffffff9c, &(0x7f0000000080)='/dev/autofs\x00', 0x80, 0x0) ioctl$SCSI_IOCTL_TEST_UNIT_READY(r1, 0x2) sendmsg$kcm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)=[{&(0x7f00000000c0)="1b0000001a0081b4e4050c00000f00fe0a9ac30000000000fc0000", 0x1b}], 0x1, &(0x7f0000000080)}, 0x0) 13:29:55 executing program 1: socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)) syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0xe1, 0x400100) creat(&(0x7f00000001c0)='./file0\x00', 0x2) openat$dsp(0xffffffffffffff9c, &(0x7f0000000200)='/dev/dsp\x00', 0x8000, 0x0) syz_open_dev$mouse(&(0x7f0000000240)='/dev/input/mouse#\x00', 0x100, 0x10000) perf_event_open(&(0x7f0000000040)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000007000)={0x8, 0x0, &(0x7f0000000140)=[@acquire], 0x0, 0x0, &(0x7f00000001c0)}) r2 = dup2(r1, r0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000002c0)={0x8, 0x0, &(0x7f00000000c0)=[@release], 0x0, 0x0, &(0x7f0000000300)}) 13:29:55 executing program 4: preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f00000000c0)=""/148, 0x94}], 0x1, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000080)='io\x00') preadv(r0, &(0x7f0000000480), 0x10000000000002a1, 0x7) 13:29:55 executing program 0: r0 = socket$inet(0x2, 0x4000000803, 0x4) bind$inet(r0, &(0x7f0000000000)={0x2, 0x0, @broadcast}, 0x10) getsockname(r0, &(0x7f00000036c0)=@xdp={0x2c, 0x0, 0x0}, &(0x7f0000000080)=0x80) setsockopt$inet_pktinfo(r0, 0x0, 0x8, &(0x7f0000003780)={r1, @rand_addr, @dev}, 0xc) syz_emit_ethernet(0x4a, &(0x7f0000000240)={@link_local, @empty=[0x0, 0x0, 0x4000000000000000], [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x3c, 0x0, 0x0, 0x0, 0x4, 0x0, @empty=0x9000000, @broadcast}, @udp={0x0, 0x0, 0x28}}}}}, &(0x7f0000000380)) 13:29:55 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000007000)={0x8, 0x0, &(0x7f0000000140)=[@acquire], 0x0, 0x0, &(0x7f00000001c0)}) r2 = dup2(r1, r0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000002c0)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x40046306, 0x1a0ffffffff}], 0x0, 0x0, &(0x7f0000000300)}) [ 554.156071] overlayfs: failed to resolve './file1': -2 13:29:55 executing program 3: mkdir(&(0x7f0000fd5ff8)='./file0\x00', 0x0) r0 = inotify_init() r1 = syz_open_dev$adsp(&(0x7f0000000240)='/dev/adsp#\x00', 0x12, 0x2000) getsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(0xffffffffffffffff, 0x84, 0x9, &(0x7f0000000280)={0x0, @in6={{0xa, 0x4e23, 0x3, @dev={0xfe, 0x80, [], 0x10}, 0x1}}, 0xfc, 0x39ba, 0x3e3b, 0xfffffffffffffffe}, &(0x7f0000000340)=0x98) setsockopt$inet_sctp_SCTP_ADD_STREAMS(r1, 0x84, 0x79, &(0x7f0000000380)={r2, 0x5}, 0x8) r3 = getpgrp(0x0) socketpair(0x9, 0x5, 0x7fffffff, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) kcmp$KCMP_EPOLL_TFD(r3, r3, 0x7, r0, &(0x7f0000000200)={r4, r0, 0x3f}) r5 = syz_open_dev$audion(&(0x7f0000000180)='/dev/audio#\x00', 0x2, 0x200000) perf_event_open(&(0x7f0000000100)={0x0, 0x70, 0x1, 0x9, 0x2, 0xfffffffffffff487, 0x0, 0xa589, 0x40, 0x8, 0x1ff, 0x7, 0xffffffffffffff80, 0x7, 0x8, 0x1ff, 0x3, 0x1, 0x6, 0x9, 0x9, 0xffffffffffffffff, 0x40, 0xa7, 0x5cfd, 0x4ef, 0x9, 0x10001, 0x0, 0xfff, 0x3c1, 0x1, 0x0, 0x8, 0x65, 0x8001, 0x1e, 0x100000001, 0x0, 0x0, 0x4, @perf_bp={&(0x7f00000000c0), 0x4}, 0x200, 0xd7ff, 0x6, 0x2, 0x7, 0x4, 0x2}, r3, 0x1, r5, 0x0) r6 = inotify_add_watch(r0, &(0x7f0000000040)='./file0\x00', 0x20000000) inotify_add_watch(r0, &(0x7f0000000000)='./file0\x00', 0x10000000) inotify_rm_watch(r0, r6) rmdir(&(0x7f0000000080)='./file0\x00') 13:29:55 executing program 1: socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)) syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0xe1, 0x400100) creat(&(0x7f00000001c0)='./file0\x00', 0x2) openat$dsp(0xffffffffffffff9c, &(0x7f0000000200)='/dev/dsp\x00', 0x8000, 0x0) syz_open_dev$mouse(&(0x7f0000000240)='/dev/input/mouse#\x00', 0x100, 0x10000) perf_event_open(&(0x7f0000000040)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000007000)={0x8, 0x0, &(0x7f0000000140)=[@acquire], 0x0, 0x0, &(0x7f00000001c0)}) r2 = dup2(r1, r0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000002c0)={0x8, 0x0, &(0x7f00000000c0)=[@release], 0x0, 0x0, &(0x7f0000000300)}) 13:29:55 executing program 4: preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f00000000c0)=""/148, 0x94}], 0x1, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000080)='io\x00') preadv(r0, &(0x7f0000000480), 0x10000000000002a1, 0x1000000) 13:29:55 executing program 0: r0 = socket$inet(0x2, 0x4000000803, 0x4) bind$inet(r0, &(0x7f0000000000)={0x2, 0x0, @broadcast}, 0x10) getsockname(r0, &(0x7f00000036c0)=@xdp={0x2c, 0x0, 0x0}, &(0x7f0000000080)=0x80) setsockopt$inet_pktinfo(r0, 0x0, 0x8, &(0x7f0000003780)={r1, @rand_addr, @dev}, 0xc) syz_emit_ethernet(0x4a, &(0x7f0000000240)={@link_local, @empty=[0x0, 0x0, 0xf000], [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x3c, 0x0, 0x0, 0x0, 0x4, 0x0, @empty=0x9000000, @broadcast}, @udp={0x0, 0x0, 0x28}}}}}, &(0x7f0000000380)) 13:29:55 executing program 5: syz_mount_image$ntfs(&(0x7f0000000200)='ntfs\x00', &(0x7f0000000080)='./file1\x00', 0x0, 0x30, &(0x7f0000000580), 0x8000, &(0x7f0000000680)=ANY=[]) mount$overlay(0x404030, &(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f0000000100)={[{@upperdir={'upperdir', 0x3d, './file0'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@workdir={'workdir', 0x3d, './file1'}, 0x5c}]}) umount2(&(0x7f0000000040)='./file0\x00', 0x0) 13:29:55 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000007000)={0x8, 0x0, &(0x7f0000000140)=[@acquire], 0x0, 0x0, &(0x7f00000001c0)}) r2 = dup2(r1, r0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000002c0)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x40046306, 0x1a0}], 0x0, 0x0, &(0x7f0000000300)}) 13:29:55 executing program 0: r0 = socket$inet(0x2, 0x4000000803, 0x4) bind$inet(r0, &(0x7f0000000000)={0x2, 0x0, @broadcast}, 0x10) getsockname(r0, &(0x7f00000036c0)=@xdp={0x2c, 0x0, 0x0}, &(0x7f0000000080)=0x80) setsockopt$inet_pktinfo(r0, 0x0, 0x8, &(0x7f0000003780)={r1, @rand_addr, @dev}, 0xc) syz_emit_ethernet(0x4a, &(0x7f0000000240)={@link_local, @empty=[0x0, 0x0, 0x3f00000000000000], [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x3c, 0x0, 0x0, 0x0, 0x4, 0x0, @empty=0x9000000, @broadcast}, @udp={0x0, 0x0, 0x28}}}}}, &(0x7f0000000380)) 13:29:55 executing program 1: socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)) syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0xe1, 0x400100) creat(&(0x7f00000001c0)='./file0\x00', 0x2) openat$dsp(0xffffffffffffff9c, &(0x7f0000000200)='/dev/dsp\x00', 0x8000, 0x0) syz_open_dev$mouse(&(0x7f0000000240)='/dev/input/mouse#\x00', 0x100, 0x10000) perf_event_open(&(0x7f0000000040)={0x1, 0x70}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000007000)={0x8, 0x0, &(0x7f0000000140)=[@acquire], 0x0, 0x0, &(0x7f00000001c0)}) r2 = dup2(r1, r0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000002c0)={0x8, 0x0, &(0x7f00000000c0)=[@release], 0x0, 0x0, &(0x7f0000000300)}) 13:29:55 executing program 4: preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f00000000c0)=""/148, 0x94}], 0x1, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000080)='io\x00') preadv(r0, &(0x7f0000000480), 0x10000000000002a1, 0x5000000) 13:29:55 executing program 5: syz_mount_image$btrfs(&(0x7f0000000140)='btrfs\x00', &(0x7f0000000180)='./file0\x00', 0x0, 0x0, &(0x7f00000007c0), 0x0, &(0x7f0000000380)=ANY=[]) syz_mount_image$ntfs(&(0x7f0000000200)='ntfs\x00', &(0x7f0000000080)='./file1\x00', 0x0, 0x30, &(0x7f0000000580), 0x0, &(0x7f0000000680)=ANY=[]) mount$overlay(0x404030, &(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f0000000100)={[{@upperdir={'upperdir', 0x3d, './file0'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@workdir={'workdir', 0x3d, './file1'}, 0x5c}]}) umount2(&(0x7f0000000040)='./file0\x00', 0x0) 13:29:55 executing program 3: r0 = bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0x15, 0x3, &(0x7f0000000100)=ANY=[@ANYBLOB="8500000000000000bfff0000009700009500000000000000"], &(0x7f0000003ff6)='syzkaller\x00', 0x5, 0xc3, &(0x7f000000cf3d)=""/195}, 0x48) ioctl$SNDRV_SEQ_IOCTL_GET_QUEUE_STATUS(0xffffffffffffffff, 0xc05c5340, &(0x7f00000003c0)) r1 = openat$qat_adf_ctl(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/qat_adf_ctl\x00', 0x10700, 0x0) getsockopt$inet6_mreq(r1, 0x29, 0x14, &(0x7f0000000300)={@local}, &(0x7f0000000380)=0x14) bpf$BPF_PROG_DETACH(0x9, &(0x7f0000000000)={0x0, r0, 0xc, 0x1}, 0x14) r2 = syz_open_dev$adsp(&(0x7f0000000040)='/dev/adsp#\x00', 0x5cb, 0x2001) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000000c0)={0x50, 0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB="0c63000012634840030000000000000004000000000000000000000001000000000000000000000038000000000000004800000000000000", @ANYPTR=&(0x7f0000000080)=ANY=[@ANYBLOB="852a646600000000", @ANYRES32=r0, @ANYBLOB="0000000002000000000000008561646600000000020000000000000000000000000000001a00000000000000"], @ANYPTR=&(0x7f0000000140)=ANY=[@ANYBLOB="000000000000000038000000000000003800000000000000480000000000000078002000000000003800000000000000680000000000000040000000000000001800000000000000"], @ANYBLOB='\a\x00\x00\x00\x00\x00\x00\x00'], 0x42, 0x0, &(0x7f0000000240)="41c2f98100b1393f15de2e9597c6bd505ca617352e631a0718c1d1b9b38d1706623affa81ba844e7548b394e1c68c60729c073500aba1a7a71d230adca78539a31a9"}) 13:29:55 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000007000)={0x8, 0x0, &(0x7f0000000140)=[@acquire], 0x0, 0x0, &(0x7f00000001c0)}) r2 = dup2(r1, r0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000002c0)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x40046306, 0x1000000}], 0x0, 0x0, &(0x7f0000000300)}) 13:29:55 executing program 4: preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f00000000c0)=""/148, 0x94}], 0x1, 0x0) ioctl$sock_SIOCGPGRP(0xffffffffffffff9c, 0x8904, &(0x7f0000000000)) r0 = fcntl$getown(0xffffffffffffffff, 0x9) r1 = syz_open_procfs(r0, &(0x7f00000001c0)='net/sco\x00') preadv(r1, &(0x7f0000000480), 0x10000000000002a1, 0x0) 13:29:55 executing program 0: r0 = socket$inet(0x2, 0x4000000803, 0x4) bind$inet(r0, &(0x7f0000000000)={0x2, 0x0, @broadcast}, 0x10) getsockname(r0, &(0x7f00000036c0)=@xdp={0x2c, 0x0, 0x0}, &(0x7f0000000080)=0x80) setsockopt$inet_pktinfo(r0, 0x0, 0x8, &(0x7f0000003780)={r1, @rand_addr, @dev}, 0xc) syz_emit_ethernet(0x4a, &(0x7f0000000240)={@link_local, @empty=[0x0, 0x0, 0x1400000000000000], [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x3c, 0x0, 0x0, 0x0, 0x4, 0x0, @empty=0x9000000, @broadcast}, @udp={0x0, 0x0, 0x28}}}}}, &(0x7f0000000380)) [ 554.629909] ntfs: (device loop5): ntfs_fill_super(): Unable to determine device size. 13:29:56 executing program 1: socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)) syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0xe1, 0x400100) creat(&(0x7f00000001c0)='./file0\x00', 0x2) openat$dsp(0xffffffffffffff9c, &(0x7f0000000200)='/dev/dsp\x00', 0x8000, 0x0) syz_open_dev$mouse(&(0x7f0000000240)='/dev/input/mouse#\x00', 0x100, 0x10000) perf_event_open(&(0x7f0000000040)={0x1, 0x70}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000007000)={0x8, 0x0, &(0x7f0000000140)=[@acquire], 0x0, 0x0, &(0x7f00000001c0)}) r2 = dup2(r1, r0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000002c0)={0x8, 0x0, &(0x7f00000000c0)=[@release], 0x0, 0x0, &(0x7f0000000300)}) [ 554.680791] binder_thread_write: 34 callbacks suppressed [ 554.680807] binder: 27020:27025 Release 1 refcount change on invalid ref 16777216 ret -22 13:29:56 executing program 3: r0 = creat(&(0x7f0000000a00)='./bus\x00', 0x0) mount$9p_xen(&(0x7f0000000040)='GPL]eth1posix_acl_access\x00', &(0x7f0000000080)='./bus\x00', &(0x7f0000000140)='9p\x00', 0x20, &(0x7f0000000180)={'trans=xen,', {[{@access_any='access=any'}, {@cache_mmap='cache=mmap'}, {@cache_none='cache=none'}, {@version_L='version=9p2000.L'}, {@afid={'afid', 0x3d, 0x3}}, {@cache_fscache='cache=fscache'}], [{@obj_role={'obj_role', 0x3d, '}'}}, {@subj_role={'subj_role'}}]}}) fcntl$setstatus(r0, 0x4, 0x8000000000044000) io_setup(0xb, &(0x7f0000000240)=0x0) ioctl$EXT4_IOC_SETFLAGS(r0, 0x40086602, &(0x7f0000000100)) io_submit(r1, 0x8, &(0x7f0000000540)=[&(0x7f00000000c0)={0x0, 0x0, 0x0, 0x1, 0x0, r0, &(0x7f0000000000), 0x10000, 0x407000}]) truncate(&(0x7f0000000000)='./bus\x00', 0x417000) 13:29:56 executing program 4: preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f00000000c0)=""/148, 0x94}], 0x1, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000080)='io\x00') ioctl$VHOST_SET_FEATURES(r0, 0x4008af00, &(0x7f0000000000)=0x4000000) preadv(r0, &(0x7f0000000480), 0x10000000000002a1, 0x0) 13:29:56 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000007000)={0x8, 0x0, &(0x7f0000000140)=[@acquire], 0x0, 0x0, &(0x7f00000001c0)}) r2 = dup2(r1, r0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000002c0)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x40046306, 0x3f000000}], 0x0, 0x0, &(0x7f0000000300)}) 13:29:56 executing program 5: syz_mount_image$btrfs(&(0x7f0000000140)='btrfs\x00', &(0x7f0000000180)='./file0\x00', 0x0, 0x0, &(0x7f00000007c0), 0x0, &(0x7f0000000380)=ANY=[]) syz_mount_image$ntfs(&(0x7f0000000200)='ntfs\x00', &(0x7f0000000080)='./file1\x00', 0x0, 0x30, &(0x7f0000000580), 0x0, &(0x7f0000000680)=ANY=[]) mount$overlay(0x404030, &(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f0000000100)={[{@upperdir={'upperdir', 0x3d, './file0'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}]}) umount2(&(0x7f0000000040)='./file0\x00', 0x0) 13:29:56 executing program 1: socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)) syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0xe1, 0x400100) creat(&(0x7f00000001c0)='./file0\x00', 0x2) openat$dsp(0xffffffffffffff9c, &(0x7f0000000200)='/dev/dsp\x00', 0x8000, 0x0) syz_open_dev$mouse(&(0x7f0000000240)='/dev/input/mouse#\x00', 0x100, 0x10000) perf_event_open(&(0x7f0000000040)={0x1, 0x70}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000007000)={0x8, 0x0, &(0x7f0000000140)=[@acquire], 0x0, 0x0, &(0x7f00000001c0)}) r2 = dup2(r1, r0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000002c0)={0x8, 0x0, &(0x7f00000000c0)=[@release], 0x0, 0x0, &(0x7f0000000300)}) 13:29:56 executing program 0: r0 = socket$inet(0x2, 0x4000000803, 0x4) bind$inet(r0, &(0x7f0000000000)={0x2, 0x0, @broadcast}, 0x10) getsockname(r0, &(0x7f00000036c0)=@xdp={0x2c, 0x0, 0x0}, &(0x7f0000000080)=0x80) setsockopt$inet_pktinfo(r0, 0x0, 0x8, &(0x7f0000003780)={r1, @rand_addr, @dev}, 0xc) syz_emit_ethernet(0x4a, &(0x7f0000000240)={@link_local, @empty=[0x0, 0x0, 0x1000000], [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x3c, 0x0, 0x0, 0x0, 0x4, 0x0, @empty=0x9000000, @broadcast}, @udp={0x0, 0x0, 0x28}}}}}, &(0x7f0000000380)) 13:29:56 executing program 1: socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)) syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0xe1, 0x400100) creat(&(0x7f00000001c0)='./file0\x00', 0x2) openat$dsp(0xffffffffffffff9c, &(0x7f0000000200)='/dev/dsp\x00', 0x8000, 0x0) syz_open_dev$mouse(&(0x7f0000000240)='/dev/input/mouse#\x00', 0x100, 0x10000) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000007000)={0x8, 0x0, &(0x7f0000000140)=[@acquire], 0x0, 0x0, &(0x7f00000001c0)}) r2 = dup2(r1, r0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000002c0)={0x8, 0x0, &(0x7f00000000c0)=[@release], 0x0, 0x0, &(0x7f0000000300)}) [ 554.937582] binder: 27043:27046 Release 1 refcount change on invalid ref 1056964608 ret -22 [ 554.953190] binder: 27051:27052 Acquire 1 refcount change on invalid ref 0 ret -22 [ 554.968428] binder: 27051:27052 Release 1 refcount change on invalid ref 0 ret -22 13:29:56 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000007000)={0x8, 0x0, &(0x7f0000000140)=[@acquire], 0x0, 0x0, &(0x7f00000001c0)}) r2 = dup2(r1, r0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000002c0)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x40046306, 0xfdfdffff}], 0x0, 0x0, &(0x7f0000000300)}) 13:29:56 executing program 4: preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f00000000c0)=""/148, 0x94}], 0x1, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000080)='io\x00') ioctl$DRM_IOCTL_FREE_BUFS(r0, 0x4010641a, &(0x7f0000000040)={0x9, &(0x7f0000000180)=[0x2000000120000000, 0x7, 0x4, 0x7, 0x87, 0x100000000, 0x6, 0x7fff, 0x7]}) preadv(r0, &(0x7f0000000480), 0x10000000000002a1, 0x0) [ 555.031357] ntfs: (device loop5): ntfs_fill_super(): Unable to determine device size. 13:29:56 executing program 3: r0 = syz_open_dev$usb(&(0x7f0000000080)='/dev/bus/usb/00#/00#\x00', 0x40000ffffff, 0x2) ioctl$UI_SET_SWBIT(r0, 0x8004551a, 0x70e002) bpf$BPF_GET_BTF_INFO(0xf, &(0x7f00000001c0)={r0, 0x10, &(0x7f0000000180)={&(0x7f00000000c0)=""/181, 0xb5, 0x0}}, 0x10) bpf$BPF_GET_BTF_INFO(0xf, &(0x7f0000000240)={r0, 0x10, &(0x7f0000000200)={&(0x7f0000000000)=""/77, 0x4d, r1}}, 0x10) 13:29:56 executing program 0: r0 = socket$inet(0x2, 0x4000000803, 0x4) bind$inet(r0, &(0x7f0000000000)={0x2, 0x0, @broadcast}, 0x10) getsockname(r0, &(0x7f00000036c0)=@xdp={0x2c, 0x0, 0x0}, &(0x7f0000000080)=0x80) setsockopt$inet_pktinfo(r0, 0x0, 0x8, &(0x7f0000003780)={r1, @rand_addr, @dev}, 0xc) syz_emit_ethernet(0x4a, &(0x7f0000000240)={@link_local, @empty=[0x0, 0x0, 0xe8030000], [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x3c, 0x0, 0x0, 0x0, 0x4, 0x0, @empty=0x9000000, @broadcast}, @udp={0x0, 0x0, 0x28}}}}}, &(0x7f0000000380)) [ 555.081187] overlayfs: missing 'workdir' [ 555.081593] binder: 27065:27067 Release 1 refcount change on invalid ref -33685505 ret -22 [ 555.095814] binder: 27061:27062 Acquire 1 refcount change on invalid ref 0 ret -22 13:29:56 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000007000)={0x8, 0x0, &(0x7f0000000140)=[@acquire], 0x0, 0x0, &(0x7f00000001c0)}) r2 = dup2(r1, r0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000002c0)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x40046306, 0xfffffdfd}], 0x0, 0x0, &(0x7f0000000300)}) [ 555.154838] binder: 27061:27068 Release 1 refcount change on invalid ref 0 ret -22 13:29:56 executing program 4: preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f00000000c0)=""/148, 0x94}], 0x1, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000080)='io\x00') ioctl$VT_ACTIVATE(r0, 0x5606, 0xffffffffffffffff) preadv(r0, &(0x7f0000000480), 0x10000000000002a1, 0x0) ioctl$VHOST_SET_OWNER(r0, 0xaf01, 0x0) 13:29:56 executing program 3: r0 = syz_open_dev$usbmon(&(0x7f0000000380)='/dev/usbmon#\x00', 0x0, 0x240000) setsockopt$inet_tcp_int(0xffffffffffffffff, 0x6, 0x0, &(0x7f0000000140), 0x4) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) setsockopt$SO_ATTACH_FILTER(0xffffffffffffffff, 0x1, 0x1a, &(0x7f0000b86000)={0x1, &(0x7f00000000c0)=[{}]}, 0x10) getsockopt$inet6_tcp_TCP_REPAIR_WINDOW(0xffffffffffffffff, 0x6, 0x1d, &(0x7f00000002c0), &(0x7f0000000340)=0x14) r1 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rtc0\x00', 0x0, 0x0) ioctl$RTC_SET_TIME(r1, 0x4024700a, &(0x7f0000004540)={0x0, 0x0, 0x0, 0x8, 0x0, 0x47}) ioctl$RTC_WKALM_SET(r0, 0x4028700f, &(0x7f0000000200)={0x0, 0x100000001, {0x24, 0x1, 0x11, 0x4, 0x4, 0x3, 0x5, 0x13d}}) r2 = syz_open_dev$sndmidi(&(0x7f0000000300)='/dev/snd/midiC#D#\x00', 0x7, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x8, &(0x7f0000000100), 0x921b527a62bfd8af) ioctl$KVM_GET_REGS(0xffffffffffffffff, 0x8090ae81, &(0x7f0000000940)) ioctl$sock_SIOCGSKNS(r0, 0x894c, &(0x7f0000000240)=0x5) getsockopt$inet_sctp6_SCTP_MAXSEG(r1, 0x84, 0xd, &(0x7f0000000180)=@assoc_value={0x0, 0x1a65c185}, &(0x7f00000001c0)=0x8) setsockopt$inet_sctp_SCTP_DEFAULT_SNDINFO(r0, 0x84, 0x22, &(0x7f0000000280)={0x7, 0x1, 0x0, 0x5, r3}, 0x10) setsockopt$inet_sctp6_SCTP_DELAYED_SACK(r1, 0x84, 0x10, &(0x7f0000000440)=@sack_info={r3, 0x8719, 0xacf}, 0xc) pwrite64(r0, &(0x7f0000001080)="d1a4d9ce03e35b70bb249adc3f15925cebfe878ef02dec3eff45fbb5d683fd63fbc4101ba31ec540be95a468461252a142d197153eb85e6a0ccb938ceb3ef1388ad42f91c07c61ca8c60dd282afb22202509c73208f635cd877b4ee93d9ff9dc75f79547cdb1a07576e9676cc9ceee05596b65e1278192221f6481b3deecd016002d6664d9c7a33d871bfbface20340ace4bca4ca12a12d78b57a3592bb586402c276dbea346a40cb119008b3199ae86b584cc9c31f00046de9628e4efad7f47d7a270a91611dda5df6ccd12feba33371c99b5c99611028006f5d18b47bd9ab8608958da013c5c1ad1d01db776b50f5f2a18aaef6075cdca37c9ffb427435d30527a4557fc06bc4bc4d1747c83d76e63a0e2f6bcb622ae1e95a8ade7c86e5c8f6463610f250aa215ed6c2be49268404fe61114fb9f720c1b567baba0b894fc72619ba3d1b512605d8204dfacf5cb6615fdfb0a9ad6a76e383fd9f9df784d772901981fff613792673eea863418ee0401fcf8ffc159600dc214124f7e7df4903ef77b5d6baf497d8be4306aa2e726598dd4f3a4edfe1e13a6b028cdeffd5278dc54d7154cf10c628f7122d377463353278b457d56bf078ccc58bfd74ed822ddc964f315ed0a66fe27dc570f147a3048a672a1cadb1955cab3292f1ac4bcc1b0e097e2b12b0456795d561b3e26f563fe37d21c4cea60355467d77d8cefb86a1ed06571df7b55f9b5991fa94e9640acd09bd4ce20337e14f53cfb47495c99d3f27504f172cea65773471eee48a07b60638a88e1c34a8f1399d233261e77797ff6721ac274c87530c7b31a63b709cce14d5ab10666dcf1086e5690103a9f0a993237b9d6c90e7e3217295cdab538f50aa963278926102d4e7591ad39a05cb71552ffc60d13a2df1ea0cb57b87a9590cf96d3108e909b230db48a5777bd55e0d85ee3620485656a5fe8a0078d51f8eb20739ee51c091e4326dae90ac00c10173f0fc91f218c4a075f7c03b6c02ba01cc7283734cad53d6f9c891d8c5d0bee004b4648d4d806a3a2bc9351cf2529e8e5f1cb7f2c622f5256172d05b5fa746adc7ca32a5e40daef3104410680d808be8967f1d454310e116b563f9330478d3e44bff4a83e457836445cb9d4a9c8594717cd0b0e0ebaba09dfa9d7793def7a905d1518c414e1bcc486ec2d6ba350dd952c89de218ac4b2d53d42fbfe7c1a18df4c2a11a0d4f75e62e2ad533328058cbd7679fdd219b09380312c50add10ac27da751990dc689984c1acf6463fed91e32c4f8653910da09b314ec3af7470258322a8c41f86eb35f45ad836a368e3623b22047ee5bdf6d9f5c0cd8982879006cc94562497436051b6b55d58d19d491f425ff1b410cc11ee2e6ab14219015053ea895ad061fb292358487ec286d4ef600f2145ad81b3b78c604c1b663437a9c15273a5dcd205742af205fb8a69e288871bb9d2fa32f70dc9699f7bdd19ac55826e1e0663156c76a1f1878697d1ceb3f5c086e8c6666490821918c0f10e304c38d1609c7ada3f1c0e6bf5f59062d957c166ff45c4debe161cb1df9db5304e82f4096004b5a43926a3f07cef2dc1aa7cbb0598b1dc5e66ef52bdd77d8ea4e7a7162259169ef01c38c7e39d7a4736e9c1aaa3ddd0bdc21ef8ad3285fb3a197891d5098b2bb6a7ffc85a37ee4db9f545bff0c251478e6f3fed490514e1cdafb46c8d52e4c537fa732a97b1d8e2402f5022e3861d4eec570fe5d1549bacb673b5374edac3a511b071ad4c0c2044be07949909bcf772b8016ad432d59913b767fe50c4ce1cb733e3b1fc1dd3064aa576ad0cc940047aefcb33c6160f2463aa1b15e349888faadf8c351fc269df973c0885bf1f943a9099d66209da78eb50187097af62e5d53b5d43a3f4facc44e2060df092dab7207d447da0520133cd68d5ebb280ae6f2eb9786ab2cbb50fc213be1d4dcf1edcafef21faf75a17baa5e0e860c62350af41880c5032be62c6f3930ad9317d4b979f29d78fdbc7e965ee2af1eb05e16ab0853f6cff102ac4f5a148c1e45e867b27d2191ddf543ae5ae0c0dfd91c6f74de594f2518bbea5d3772ffa14f0201d3864ca849259958c529ac49dfd1d3ffc4acdfb36efc8cfa97a930181e2e651471a6b2a4a08b2ce12388d5ae3e43287ca2c3c55bb923eeca0d89dbddfc7205b609bf6d28b9cf1da9be1de908fdd2d16a3d96da62902332b858ccb5c7d4537542535a98a43bbab9e133e3d2b21a04d68d9a998ef0af2850f856222e7bde6fd6007ae942b72cd110b206546e7ab163db7c1e55e6d0d5f59e1cb44072f47d2b864399c584228fc7f788c25547b9f3d6a62d03d3ce303048e71a94baf314dc2a714cbe3d78807fe70e0c4c78b87f4914b157a4eac241a04069bda23df6b8e8ddb32c74869f64a0e2b052cec948356891077429feb3c87cd56f5f83b629d39dfa81e81fcd6a76150c87b0153aae4be9f0ca7363f818b6974be926d7ff0151bd4d6eeeaa018aeb9090eb17cec009e4bab5b8826409596e0f1f87b284a16db14d939e2788c7d73d42ac22c35a5ed8f7b7f7b8cd8c380bc0a86101c624dcac0d0bf2d400a39f6ac82801218fcea187812e0fa6ea30ff94e9c042d48ea2f6e71d93944d66286911ba70c6d69425afb36af25d55e34d5cb4b5f667f1d29036b918d21c33a7101f9c94cc8831ff7da786ad962e8abbdc22bf311a5218f4af604fbb7a7b319826467cd7ce966984c1226ff59ce5a5677a1c902e55b9265eb910c6d8df281ddf0217f297887b4689d1df148317a405be13667237eb4b0e6ca3caea84173d6df862f3fca5e72b4a11db2d14375aa95cb6f214e6ea3c19376edc8573dff87d089e2cdcebb62e950867bc35e1b06f6eac8599b35480ba8192976629d59503ff9e1f34e22bea4b0563350d65624c8a69021205e116fd56fe9680fbcd5d7a46b9f88b54d9e055e541b9c7efd1258bdfdff198ac8353d8c4b5fcb939febaa5b093231790e2a33475ec24f81777a42660bb10ef29eec5cade5f90e31e008cb0dcf7145fa2ba856d841310b0ef7a3fb6eaa386713dea822db8fe408acc336f5a000c70dd1574c7fbecd4344cd781136abf5009cb31b5372c001f8ebfa6f09d4d6572e62051bdd3bcff666c2cb3288b783cbba43c34e9e7c78c2797fbc943d391af9ee79f83978801fee3d4d1c2ea84de5abe6a70cb31242cedce46dfcbcf42f062cbf61bf36b9565d14a2584e69504bcf4a9d5ad89ef1e8bf79753aaa5b3eeca8e239b200b3818f4636bd46161af5f3d260a74c71de8aaa7c0bb65e6ec3639ff470c5122df6f582c09ddafacbaaa18476a102c5c846d8f78a0cf6790c6f122e3d94dcd9c9a366ee368b0ccca7942e2755b68168820ea51b354fc9ea99a8428f2bafee398b6012c07760123eb41f6f744a895c5a097ae7b2dcf86da358c9b884aa8bfa42a10a8b3aa2fd98d0f2c53b49d6aa6f6a1dcaa5e873dc063d643be9ea6fe0cb73235436fa8f2d7b4b46f5a5a90abba55337c0572c924f138fc636c405e947062b55bd17eb350be2615a250f06ac03959c4c243c8a35417d7833211a6fe5a8c5690b74809f2c3565307023ac5ded6083370378399ea1ef8a9df94ad6ee4e51188d7c47c86a7063d21248ab937056e94e1ae877d6f044072d8772b4c33767a9403d7ba1a8d92d30bcc4014016e94a9a3c24436c5599445404b8c312e8a10c573af59396f23be0ea83624c6a8a2925185d2674fefb72965fb4833f34ed7e574f9874a6a4cd49cb9b732ab0ffcd1b35cbd11e87acdfe82060d811fb89f703efda020197a7803616f884dca06b22767299a5850ad648177602b93c60ee6f964318dbe878480dfd37462b97a4ee7e5ff620efce120fa0e4e0883bbd2b5fb0a3787c019f8ee0173f7dd35a12777a2232b021be1a0a0ddfe36b19149f34811abf17630176f38893eb4788864ae04457b654f63588745ef740a125216f9f8a0882a51bd28842e0a4099508b255d072025ab9f894ebdc1ab4413ce9e39eb685e4be6a356346545107f6ee715449a62af2a8e34e505cf08df477b6119ea971056f2d15f9fbeb5afcb2b2bdf6bc5312236ea7eba9a20394857fa1a566153dcd8b57230b6eca5de9f68e41b94395ca9e2528cfef0e9c1a53315f495581e9e1ee249fc18bfaedff058d2f9075fb5b93cc9d0e6db4f2afda5860af1a430d61914bb299500b5f636f3871c47e9272df60c09f15b54cd4716df71d53434d0120b53ff76da9ffe45a6b3e24d02854f2b6efdc9ad40b2cc4c61b1a6692e427db76a2dc3ffeccbeaa645f24853882e103fa07547fdaf15976cd2f31a96117b75db5fa76da3ec797207968dcbb59767e1c6068554533034e5a6f1a589a1d4648a888888c9487eba1b013fa98e3f5f94d2f5b3db3b59c80b20fd1af6a80eb3d486be9876ac08ae841b8a75bd1711d10ad2b421ecd2d535c9d99310f53949b64923884a5ade901ad0904372e5b5cffe01587786de960fbae1c5979b2d5c0f6c258d6cb088f515c80792f3c07bbfc0a8c7a0245fb22050dda5bc82f215b6b2663e48aa41eb6a54e1ab4efe833614a9c8ff4c67fbe0bc5dbbe685885d86e33f45ade57060e95be0d7d04d5492812b4672edec02be1b4fd02a365c0f2e2181e0cf0892d14a269c3aeb3d53ed65db29a9cb9ecbcb8171e0ea67166543f7f356c9cbe85aa306ae5b4061e1a356f35674fa6a85de2f56ad8f52a24e886fe8b787d9049fea9c99bb815e8ab7f4ff9fdfa6fd98b1992cb0ff2bed7481d5fda2df878d7610251be8fcede74a3e3c386d5380e6c32c5ceb6d9cbc276efee87312bbac8c1ce45de8ae198d5a00868602173e0079e206d548e5527a043cb959de003391f9e3cca09163ee3ce1f65e38f9fce03ddc7e533ad106123820a4fdec98c3c95a073b09e18abb6f0912213d457b37a1e1e1dd46aa0ddc632155d29b466f37cc8d0fc41f61a043d4952e8e71d32b67fdeec75ad9e74219423ce8dfc7ba0efac6961fdbca0b8a21a0644be9eae43c0086f37ae82ebe4b0d14f782153a675092ece61a4dfb74e5df3d9a75eb1c0d9c367f0f9eb3f31650af0f9fb7942f29b935642ca82e3a97ea82552469f2a1942f22ca04895e54cb599a6368c111570455b04549d5401669035a74fe17b85f271befea320fbb864fc5902ff99dfce2aa0e2b88ea91623908bb93da3fa9a1e1067f00dd7144f3fdab636d036dbd8ee52d77a7a1dfd5dd6d8f5dd1af9af9be57bb98888f73f08db5c2546d9f4804ed175c52f0a4eef1b00412d348b21be6a5bf876255dadb2c120ebe02778e453edbfbd0557170ea972b01cff467bbf43b2563dfb855ed9c8b111c96e77ed9e3501053096e58c30d5bede74697ca0e5805f072bb7b8aba863ee77bee6a3d41f142f1a56cd651b7395ab930d9ff377868d82e6439eb86a796ae1a9a6270c69b9a565c70a56b2319be544b9963763a0bf07688e283bc3b61ab9e961a3d5605d2254ea04fb1c250a3abd392f1251680369d54fe64446a31daef15730ce1eb753a5f652e1ea21e0e46b4fef816295674ec705b7fa0389e65a082541640685e68222de2f82950ee3688b775e4de9a451fee62f87583e4cc574d9e78877699405cfc9c0f7a94555d780f1ce901b3d1aa505a869243294fcaa6708ab21d0cf07f6f04da89e58d339a1d0167f7116ff66c1c04e845c461fde79471eacd9e0049b447e2bf30f47f42dfece6e77f58b1adfad6babadaaf484d064f969f8baf28b94caa022ffc02dc0a7e44e5c1c248c806aada", 0x1000, 0x0) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000600), 0xffffffffffffffff) bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000001000)=ANY=[], &(0x7f0000000100)='GPL\x00'}, 0x48) nanosleep(&(0x7f0000000080)={0x77359400}, &(0x7f00000000c0)) getegid() ioctl$SNDRV_RAWMIDI_IOCTL_PARAMS(r2, 0xc0305710, &(0x7f0000000400)={0x1, 0x8001, 0x4, 0x7}) socket(0x4, 0x4, 0x8001) 13:29:56 executing program 5: syz_mount_image$btrfs(&(0x7f0000000140)='btrfs\x00', &(0x7f0000000180)='./file0\x00', 0x0, 0x0, &(0x7f00000007c0), 0x0, &(0x7f0000000380)=ANY=[]) syz_mount_image$ntfs(&(0x7f0000000200)='ntfs\x00', &(0x7f0000000080)='./file1\x00', 0x0, 0x30, &(0x7f0000000580), 0x0, &(0x7f0000000680)=ANY=[]) mount$overlay(0x404030, &(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f0000000100)={[{@upperdir={'upperdir', 0x3d, './file0'}}, {@workdir={'workdir', 0x3d, './file1'}, 0x5c}]}) umount2(&(0x7f0000000040)='./file0\x00', 0x0) 13:29:56 executing program 1: socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)) syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0xe1, 0x400100) creat(&(0x7f00000001c0)='./file0\x00', 0x2) openat$dsp(0xffffffffffffff9c, &(0x7f0000000200)='/dev/dsp\x00', 0x8000, 0x0) syz_open_dev$mouse(&(0x7f0000000240)='/dev/input/mouse#\x00', 0x100, 0x10000) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000007000)={0x8, 0x0, &(0x7f0000000140)=[@acquire], 0x0, 0x0, &(0x7f00000001c0)}) r2 = dup2(r1, r0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000002c0)={0x8, 0x0, &(0x7f00000000c0)=[@release], 0x0, 0x0, &(0x7f0000000300)}) 13:29:56 executing program 0: r0 = socket$inet(0x2, 0x4000000803, 0x4) bind$inet(r0, &(0x7f0000000000)={0x2, 0x0, @broadcast}, 0x10) getsockname(r0, &(0x7f00000036c0)=@xdp={0x2c, 0x0, 0x0}, &(0x7f0000000080)=0x80) setsockopt$inet_pktinfo(r0, 0x0, 0x8, &(0x7f0000003780)={r1, @rand_addr, @dev}, 0xc) syz_emit_ethernet(0x4a, &(0x7f0000000240)={@link_local, @empty=[0x0, 0x0, 0xe000], [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x3c, 0x0, 0x0, 0x0, 0x4, 0x0, @empty=0x9000000, @broadcast}, @udp={0x0, 0x0, 0x28}}}}}, &(0x7f0000000380)) [ 555.268825] binder: 27085:27087 Release 1 refcount change on invalid ref -515 ret -22 13:29:56 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000007000)={0x8, 0x0, &(0x7f0000000140)=[@acquire], 0x0, 0x0, &(0x7f00000001c0)}) r2 = dup2(r1, r0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000002c0)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x40046306, 0x3f00}], 0x0, 0x0, &(0x7f0000000300)}) 13:29:56 executing program 3: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f00000000c0)={&(0x7f0000000000), 0xc, &(0x7f0000000040)={&(0x7f0000000380)=@newsa={0xf0, 0x10, 0x713, 0x0, 0x0, {{@in=@multicast2, @in=@rand_addr}, {@in6=@ipv4={[0xfffffff0], [], @broadcast}, 0x0, 0x32}, @in6=@ipv4, {}, {}, {}, 0x0, 0x0, 0x2, 0xd101}}, 0xf0}}, 0x0) r1 = socket$pppoe(0x18, 0x1, 0x0) ioctl$PPPIOCGCHAN(r1, 0x80047437, &(0x7f0000000180)) setsockopt$inet6_MCAST_MSFILTER(0xffffffffffffffff, 0x29, 0x30, &(0x7f00000004c0)={0x100, {{0xa, 0x4e23, 0x1, @mcast2, 0x5}}, 0x0, 0x3, [{{0xa, 0x4e24, 0x4, @dev={0xfe, 0x80, [], 0xf}, 0x1ff}}, {{0xa, 0x4e24, 0x6, @mcast1}}, {{0xa, 0x4e24, 0x2, @dev={0xfe, 0x80, [], 0x1b}, 0x66e6}}]}, 0x210) getsockname$inet6(0xffffffffffffffff, &(0x7f0000000740), &(0x7f0000000780)=0x1c) sendmsg$IPVS_CMD_SET_CONFIG(0xffffffffffffffff, &(0x7f00000009c0)={&(0x7f0000000880)={0x10, 0x0, 0x0, 0x40000}, 0xc, &(0x7f0000000980)={&(0x7f0000000a00)=ANY=[@ANYBLOB="000127bd7000fcdbdf250c00000058000300080007004e220000080004000300000008000300020000001400020073797a6b616c6c65723000000000000014000600fe8000000000000000000000000000aa14000200626373683000000000000000000000000800050000000000"], 0x1}, 0x1, 0x0, 0x0, 0x810}, 0x240000c0) kexec_load(0x9, 0x1, &(0x7f0000000800)=[{&(0x7f00000007c0)="23a373c7c7fb9a2d6707653c32fa6a", 0xf, 0x1ff, 0x1ff}], 0x280002) setsockopt$inet6_tcp_buf(0xffffffffffffffff, 0x6, 0x3f, &(0x7f00000002c0)="e348d382d2810a43d0f66958b49c0e4490a44eb11ada4544425c09bfa4fb9a688dead3ab16ced5c1dd25feb48ced023a383c527d31f31669d609e42d56e97d30da04d6c7fc184b676b4b84d23845dbc4b01396b3be0fe133eef6fcae649800b24c6e4c39bb11541fdb7f1431f745c9fd78aa29c359f93ca6be1f510d45075482c026a39bf0c2712b909cb9f288cf9ecac93487368ddc509fd94b05ae451fe19c3cc5afbfa23cd97d0b50f0f248b5", 0xae) socket$nl_xfrm(0x10, 0x3, 0x6) [ 555.418941] binder: 27096:27097 Acquire 1 refcount change on invalid ref 0 ret -22 [ 555.447591] binder: 27109:27111 Release 1 refcount change on invalid ref 16128 ret -22 13:29:56 executing program 4: preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f00000000c0)=""/148, 0x94}], 0x1, 0x0) openat$ashmem(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ashmem\x00', 0x80000, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000080)='io\x00') preadv(r0, &(0x7f0000000480), 0x10000000000002a1, 0x0) fcntl$setpipe(r0, 0x407, 0x0) 13:29:56 executing program 0: r0 = socket$inet(0x2, 0x4000000803, 0x4) bind$inet(r0, &(0x7f0000000000)={0x2, 0x0, @broadcast}, 0x10) getsockname(r0, &(0x7f00000036c0)=@xdp={0x2c, 0x0, 0x0}, &(0x7f0000000080)=0x80) setsockopt$inet_pktinfo(r0, 0x0, 0x8, &(0x7f0000003780)={r1, @rand_addr, @dev}, 0xc) syz_emit_ethernet(0x4a, &(0x7f0000000240)={@link_local, @empty=[0x0, 0x0, 0x8035], [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x3c, 0x0, 0x0, 0x0, 0x4, 0x0, @empty=0x9000000, @broadcast}, @udp={0x0, 0x0, 0x28}}}}}, &(0x7f0000000380)) [ 555.505630] overlayfs: missing 'lowerdir' [ 555.538203] ntfs: (device loop5): ntfs_fill_super(): Unable to determine device size. 13:29:56 executing program 1: socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)) syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0xe1, 0x400100) creat(&(0x7f00000001c0)='./file0\x00', 0x2) openat$dsp(0xffffffffffffff9c, &(0x7f0000000200)='/dev/dsp\x00', 0x8000, 0x0) syz_open_dev$mouse(&(0x7f0000000240)='/dev/input/mouse#\x00', 0x100, 0x10000) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000007000)={0x8, 0x0, &(0x7f0000000140)=[@acquire], 0x0, 0x0, &(0x7f00000001c0)}) r2 = dup2(r1, r0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000002c0)={0x8, 0x0, &(0x7f00000000c0)=[@release], 0x0, 0x0, &(0x7f0000000300)}) 13:29:56 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000007000)={0x8, 0x0, &(0x7f0000000140)=[@acquire], 0x0, 0x0, &(0x7f00000001c0)}) r2 = dup2(r1, r0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000002c0)={0x8, 0x0, &(0x7f00000000c0)=[@release], 0xa0010000, 0x0, &(0x7f0000000300)}) 13:29:56 executing program 5: syz_mount_image$btrfs(&(0x7f0000000140)='btrfs\x00', &(0x7f0000000180)='./file0\x00', 0x0, 0x0, &(0x7f00000007c0), 0x0, &(0x7f0000000380)=ANY=[]) syz_mount_image$ntfs(&(0x7f0000000200)='ntfs\x00', &(0x7f0000000080)='./file1\x00', 0x0, 0x30, &(0x7f0000000580), 0x0, &(0x7f0000000680)=ANY=[]) mount$overlay(0x404030, &(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f0000000100)={[{@lowerdir={'lowerdir', 0x3d, './file0'}}, {@workdir={'workdir', 0x3d, './file1'}, 0x5c}]}) umount2(&(0x7f0000000040)='./file0\x00', 0x0) 13:29:57 executing program 3: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000140)='/dev/ptmx\x00', 0x0, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000000)=0x3) r3 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000040)='/dev/sequencer2\x00', 0x140, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x18, 0xfa00, {0x1, &(0x7f00000000c0)={0xffffffffffffffff}, 0x13f, 0x1003}}, 0x20) getresuid(&(0x7f0000000280), &(0x7f00000002c0)=0x0, &(0x7f0000000300)) stat(&(0x7f0000000340)='./file0\x00', &(0x7f0000000380)={0x0, 0x0, 0x0, 0x0, 0x0}) fstat(r1, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x0, 0x0}) mount$9p_tcp(&(0x7f00000001c0)='127.0.0.1\x00', &(0x7f0000000200)='./file0\x00', &(0x7f0000000240)='9p\x00', 0x240000, &(0x7f0000000480)={'trans=tcp,', {'port', 0x3d, 0x4e21}, 0x2c, {[{@cache_loose='cache=loose'}, {@uname={'uname', 0x3d, 'mime_typekeyring:#'}}, {@debug={'debug', 0x3d, 0x7}}, {@version_9p2000='version=9p2000'}, {@access_any='access=any'}, {@loose='loose'}, {@version_9p2000='version=9p2000'}, {@posixacl='posixacl'}, {@access_uid={'access', 0x3d, r5}}], [{@uid_eq={'uid', 0x3d, r6}}, {@obj_type={'obj_type', 0x3d, '/dev/sequencer2\x00'}}, {@fscontext={'fscontext', 0x3d, 'system_u'}}, {@euid_gt={'euid>', r7}}]}}) write$RDMA_USER_CM_CMD_JOIN_IP_MCAST(r3, &(0x7f0000000180)={0x10, 0x30, 0xfa00, {&(0x7f0000000080), 0x1, {0xa, 0x4e20, 0x4, @ipv4={[], [], @local}, 0x7}, r4}}, 0x38) ioctl$TCFLSH(r0, 0x80047456, 0x70affb) 13:29:57 executing program 0: r0 = socket$inet(0x2, 0x4000000803, 0x4) bind$inet(r0, &(0x7f0000000000)={0x2, 0x0, @broadcast}, 0x10) getsockname(r0, &(0x7f00000036c0)=@xdp={0x2c, 0x0, 0x0}, &(0x7f0000000080)=0x80) setsockopt$inet_pktinfo(r0, 0x0, 0x8, &(0x7f0000003780)={r1, @rand_addr, @dev}, 0xc) syz_emit_ethernet(0x4a, &(0x7f0000000240)={@link_local, @empty=[0x0, 0x0, 0xffffa888], [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x3c, 0x0, 0x0, 0x0, 0x4, 0x0, @empty=0x9000000, @broadcast}, @udp={0x0, 0x0, 0x28}}}}}, &(0x7f0000000380)) 13:29:57 executing program 1: socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)) syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0xe1, 0x400100) creat(&(0x7f00000001c0)='./file0\x00', 0x2) openat$dsp(0xffffffffffffff9c, &(0x7f0000000200)='/dev/dsp\x00', 0x8000, 0x0) syz_open_dev$mouse(&(0x7f0000000240)='/dev/input/mouse#\x00', 0x100, 0x10000) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000007000)={0x8, 0x0, &(0x7f0000000140)=[@acquire], 0x0, 0x0, &(0x7f00000001c0)}) r2 = dup2(r1, r0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000002c0)={0x8, 0x0, &(0x7f00000000c0)=[@release], 0x0, 0x0, &(0x7f0000000300)}) 13:29:57 executing program 4: preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f00000000c0)=""/148, 0x94}], 0x1, 0x0) ioctl$sock_FIOGETOWN(0xffffffffffffffff, 0x8903, &(0x7f0000000000)=0x0) ioctl$TIOCGSID(0xffffffffffffffff, 0x5429, &(0x7f00000002c0)) socketpair$inet(0x2, 0x2, 0x5, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$getownex(r1, 0x10, &(0x7f0000000180)) syz_open_procfs(r0, &(0x7f0000000080)='net/l2cap\x00') ioctl$TIOCGPGRP(0xffffffffffffff9c, 0x540f, &(0x7f0000000280)) ioctl$TIOCGPGRP(0xffffffffffffff9c, 0x540f, &(0x7f0000000300)=0x0) r3 = syz_open_procfs(r2, &(0x7f0000000400)="6e6574294bd2e2880d53122700") preadv(r3, &(0x7f0000000480), 0x10000000000002a1, 0x0) [ 555.811202] ntfs: (device loop5): ntfs_fill_super(): Unable to determine device size. 13:29:57 executing program 0: r0 = socket$inet(0x2, 0x4000000803, 0x4) bind$inet(r0, &(0x7f0000000000)={0x2, 0x0, @broadcast}, 0x10) getsockname(r0, &(0x7f00000036c0)=@xdp={0x2c, 0x0, 0x0}, &(0x7f0000000080)=0x80) setsockopt$inet_pktinfo(r0, 0x0, 0x8, &(0x7f0000003780)={r1, @rand_addr, @dev}, 0xc) syz_emit_ethernet(0x4a, &(0x7f0000000240)={@link_local, @empty=[0x0, 0x0, 0xfffffffffffff000], [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x3c, 0x0, 0x0, 0x0, 0x4, 0x0, @empty=0x9000000, @broadcast}, @udp={0x0, 0x0, 0x28}}}}}, &(0x7f0000000380)) [ 555.852457] overlayfs: option "workdir=./file1\" is useless in a non-upper mount, ignore [ 555.872439] overlayfs: at least 2 lowerdir are needed while upperdir nonexistent 13:29:57 executing program 1: socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)) syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0xe1, 0x400100) creat(&(0x7f00000001c0)='./file0\x00', 0x2) openat$dsp(0xffffffffffffff9c, &(0x7f0000000200)='/dev/dsp\x00', 0x8000, 0x0) syz_open_dev$mouse(&(0x7f0000000240)='/dev/input/mouse#\x00', 0x100, 0x10000) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000007000)={0x8, 0x0, &(0x7f0000000140)=[@acquire], 0x0, 0x0, &(0x7f00000001c0)}) r2 = dup2(r1, r0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000002c0)={0x8, 0x0, &(0x7f00000000c0)=[@release], 0x0, 0x0, &(0x7f0000000300)}) 13:29:57 executing program 3: r0 = socket$inet6(0xa, 0x800000001, 0x8010000000000084) bind$inet6(r0, &(0x7f0000ef8cfd)={0xa, 0x4e23, 0x0, @loopback}, 0x1c) fsetxattr$security_smack_entry(r0, 0x0, &(0x7f00000000c0)='mime_type&#\x00', 0xc, 0x1) sendto$inet6(r0, &(0x7f0000000000)="8e", 0x1, 0x0, &(0x7f0000000040)={0xa, 0x0, 0x0, @remote, 0x6}, 0x1c) listen(r0, 0x6) r1 = socket(0x10, 0x3, 0x0) sendmsg$nl_generic(r1, &(0x7f0000000040)={&(0x7f0000000000), 0xc, &(0x7f0000000080)={&(0x7f0000000440)=ANY=[@ANYBLOB="2c000000197ec80429f800010200000000000000001d01000018000b0014000000ff0000000000000000000001ddd1f8ff8d226f497febe37e7c9e4a09d478d8f146a23398a775ab7b60488f88caa0a42ce19473604a352994579e8c83b4a6078467d057f7b58c9b2a99acfbff6b92af9cbdde6ff97e5f512133391be742fbfea70e9decfcd1cac65f68b2796fce5300a658cb845e0f0000000016099799a1daf101b2461ad081fecba6d803d94f9cf25d8c4b53b765e4f800a4e562fabef80aaaf2c4cf632143c63390ea9f127209ed76aa2e404fb34dd9512febaa1253604df54dc7aedfb48c496598da32d883b347c8e5dc7928452b797cfc8e9357dbb8e1962095830c205f9918a9703c30ab9bf9427b1f25eae796ec95d24fbc8b7a9f0690b88bc81f2772bdef70cafd7d04fa69e86a3bf7b1b746e7c26f85d14b1f050381d92dde6d32182fdad893c8dc41a3766f969c8ca035d8360eab79b8227fcf21f3b64aa1ebf00f46d6d5d42da6a97bcc9cadf3807ac0227584eaff11c48b49fbc599e075a65b34dd9560f67ca98e4b191ade86efe5f040651f6f1bab360ddd000000"], 0x2c}}, 0x0) r2 = socket$inet6_sctp(0xa, 0x5, 0x84) sendto$inet6(r2, &(0x7f0000e33fe0)='X', 0x1, 0x0, &(0x7f000005ffe4)={0xa, 0x4e23, 0x0, @loopback}, 0x1c) accept4(r0, 0x0, &(0x7f0000000100), 0x0) getsockopt$inet_sctp6_SCTP_RECONFIG_SUPPORTED(r0, 0x84, 0x75, &(0x7f0000000140)={0x0, 0x7ff}, &(0x7f0000000180)=0x8) getsockopt$inet_sctp6_SCTP_AUTH_ACTIVE_KEY(r2, 0x84, 0x18, &(0x7f00000001c0)={r3, 0x10000}, &(0x7f0000000200)=0x8) ioctl$sock_SIOCGPGRP(r0, 0x8904, &(0x7f0000000240)) 13:29:57 executing program 4: preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f00000000c0)=""/148, 0x94}], 0x1, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000080)='io\x00') r1 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) preadv(r0, &(0x7f0000000480), 0x10000000000002a1, 0x0) ioctl$sock_SIOCOUTQNSD(r1, 0x894b, &(0x7f0000000000)) 13:29:57 executing program 1: socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)) syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0xe1, 0x400100) creat(&(0x7f00000001c0)='./file0\x00', 0x2) openat$dsp(0xffffffffffffff9c, &(0x7f0000000200)='/dev/dsp\x00', 0x8000, 0x0) syz_open_dev$mouse(&(0x7f0000000240)='/dev/input/mouse#\x00', 0x100, 0x10000) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000007000)={0x8, 0x0, &(0x7f0000000140)=[@acquire], 0x0, 0x0, &(0x7f00000001c0)}) r2 = dup2(r1, r0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000002c0)={0x8, 0x0, &(0x7f00000000c0)=[@release], 0x0, 0x0, &(0x7f0000000300)}) 13:29:57 executing program 0: r0 = socket$inet(0x2, 0x4000000803, 0x4) bind$inet(r0, &(0x7f0000000000)={0x2, 0x0, @broadcast}, 0x10) getsockname(r0, &(0x7f00000036c0)=@xdp={0x2c, 0x0, 0x0}, &(0x7f0000000080)=0x80) setsockopt$inet_pktinfo(r0, 0x0, 0x8, &(0x7f0000003780)={r1, @rand_addr, @dev}, 0xc) syz_emit_ethernet(0x4a, &(0x7f0000000240)={@link_local, @empty=[0x0, 0x0, 0x40030000000000], [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x3c, 0x0, 0x0, 0x0, 0x4, 0x0, @empty=0x9000000, @broadcast}, @udp={0x0, 0x0, 0x28}}}}}, &(0x7f0000000380)) 13:29:57 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000007000)={0x8, 0x0, &(0x7f0000000140)=[@acquire], 0x0, 0x0, &(0x7f00000001c0)}) r2 = dup2(r1, r0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000002c0)={0x8, 0x0, &(0x7f00000000c0)=[@release], 0x1a0, 0x0, &(0x7f0000000300)}) 13:29:57 executing program 5 (fault-call:3 fault-nth:0): syz_mount_image$btrfs(&(0x7f0000000140)='btrfs\x00', &(0x7f0000000180)='./file0\x00', 0x0, 0x0, &(0x7f00000007c0), 0x0, &(0x7f0000000380)=ANY=[]) syz_mount_image$ntfs(&(0x7f0000000200)='ntfs\x00', &(0x7f0000000080)='./file1\x00', 0x0, 0x30, &(0x7f0000000580), 0x0, &(0x7f0000000680)=ANY=[]) mount$overlay(0x404030, &(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f0000000100)={[{@upperdir={'upperdir', 0x3d, './file0'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@workdir={'workdir', 0x3d, './file1'}, 0x5c}]}) umount2(&(0x7f0000000040)='./file0\x00', 0x0) 13:29:57 executing program 4: preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f00000000c0)=""/148, 0x94}], 0x1, 0x0) r0 = socket$netlink(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000023000)={&(0x7f0000000000), 0xc, &(0x7f0000000040)={&(0x7f0000000140)={0x1c, 0x28, 0xaff, 0x0, 0x0, {0x5}, [@nested={0x8, 0x1, [@typed={0x4, 0x1, @binary}]}]}, 0x1c}}, 0x0) gettid() getpgrp(0xffffffffffffffff) readahead(r0, 0xffff, 0x0) fcntl$getownex(r0, 0x10, &(0x7f0000000540)={0x0, 0x0}) r2 = syz_open_procfs(r1, &(0x7f0000000500)='children\x00') syz_open_dev$sndtimer(&(0x7f0000000440)='/dev/snd/timer\x00', 0x0, 0x0) r3 = dup(r2) getsockopt$inet_sctp_SCTP_RECVRCVINFO(r3, 0x84, 0x20, &(0x7f0000000200), &(0x7f0000000480)=0x4) preadv(r2, &(0x7f0000000480), 0x10000000000002a1, 0x0) getsockopt$inet_IP_IPSEC_POLICY(r3, 0x0, 0x10, &(0x7f0000000240)={{{@in6=@dev, @in6=@mcast1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@multicast2}, 0x0, @in6=@loopback}}, &(0x7f00000001c0)=0xe8) r5 = geteuid() write$FUSE_NOTIFY_STORE(r3, &(0x7f0000000080)={0x2d, 0x4, 0x0, {0x0, 0x7, 0x5, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0]}}, 0x2d) setsockopt$inet_IP_IPSEC_POLICY(r3, 0x0, 0x10, &(0x7f0000000340)={{{@in6, @in=@broadcast, 0x4e23, 0x80, 0x4e22, 0x0, 0xa, 0xa0, 0x80, 0x3f, r4, r5}, {0x80, 0xfc5, 0x8, 0xdbd6, 0x3, 0x100000001, 0xeba, 0x1}, {0x2, 0x3ff, 0x7, 0x3}, 0xaf, 0x6e6bb9, 0x0, 0x0, 0x1, 0x3}, {{@in=@loopback, 0x4d5, 0x3c}, 0x0, @in, 0x3503, 0x4, 0x5c80426c940b4ebc, 0x0, 0x100}}, 0xe8) getsockopt$inet_pktinfo(r2, 0x0, 0x8, &(0x7f0000000040)={0x0, @loopback, @multicast2}, &(0x7f0000000180)=0xc) 13:29:57 executing program 1: socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)) syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0xe1, 0x400100) creat(&(0x7f00000001c0)='./file0\x00', 0x2) openat$dsp(0xffffffffffffff9c, &(0x7f0000000200)='/dev/dsp\x00', 0x8000, 0x0) syz_open_dev$mouse(&(0x7f0000000240)='/dev/input/mouse#\x00', 0x100, 0x10000) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000007000)={0x0, 0x0, &(0x7f0000000140), 0x0, 0x0, &(0x7f00000001c0)}) r2 = dup2(r1, r0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000002c0)={0x8, 0x0, &(0x7f00000000c0)=[@release], 0x0, 0x0, &(0x7f0000000300)}) 13:29:57 executing program 0: r0 = socket$inet(0x2, 0x4000000803, 0x4) bind$inet(r0, &(0x7f0000000000)={0x2, 0x0, @broadcast}, 0x10) getsockname(r0, &(0x7f00000036c0)=@xdp={0x2c, 0x0, 0x0}, &(0x7f0000000080)=0x80) setsockopt$inet_pktinfo(r0, 0x0, 0x8, &(0x7f0000003780)={r1, @rand_addr, @dev}, 0xc) syz_emit_ethernet(0x4a, &(0x7f0000000240)={@link_local, @empty=[0x0, 0x0, 0x88a8ffff00000000], [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x3c, 0x0, 0x0, 0x0, 0x4, 0x0, @empty=0x9000000, @broadcast}, @udp={0x0, 0x0, 0x28}}}}}, &(0x7f0000000380)) 13:29:57 executing program 4: preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f0000000180)=""/148, 0x94}], 0x1, 0x0) dup(0xffffffffffffffff) openat$vcs(0xffffffffffffff9c, &(0x7f0000000080)='/dev/vcs\x00', 0x200000, 0x0) fcntl$dupfd(0xffffffffffffffff, 0x406, 0xffffffffffffff9c) r0 = syz_open_dev$sndpcmp(&(0x7f0000000100)='/dev/snd/pcmC#D#p\x00', 0x5, 0x20000) setsockopt$bt_BT_SNDMTU(r0, 0x112, 0xc, &(0x7f0000000040), 0x2) ioctl$TIOCGSID(r0, 0x5429, &(0x7f00000000c0)=0x0) r2 = syz_open_procfs(r1, &(0x7f0000000000)='io\x00') preadv(r2, &(0x7f0000000480), 0x0, 0x0) 13:29:57 executing program 0: r0 = socket$inet(0x2, 0x4000000803, 0x4) bind$inet(r0, &(0x7f0000000000)={0x2, 0x0, @broadcast}, 0x10) getsockname(r0, &(0x7f00000036c0)=@xdp={0x2c, 0x0, 0x0}, &(0x7f0000000080)=0x80) setsockopt$inet_pktinfo(r0, 0x0, 0x8, &(0x7f0000003780)={r1, @rand_addr, @dev}, 0xc) syz_emit_ethernet(0x4a, &(0x7f0000000240)={@link_local, @empty=[0x0, 0x0, 0xffffffff00000000], [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x3c, 0x0, 0x0, 0x0, 0x4, 0x0, @empty=0x9000000, @broadcast}, @udp={0x0, 0x0, 0x28}}}}}, &(0x7f0000000380)) [ 556.563194] ntfs: (device loop5): ntfs_fill_super(): Unable to determine device size. 13:29:57 executing program 1: socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)) syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0xe1, 0x400100) creat(&(0x7f00000001c0)='./file0\x00', 0x2) openat$dsp(0xffffffffffffff9c, &(0x7f0000000200)='/dev/dsp\x00', 0x8000, 0x0) syz_open_dev$mouse(&(0x7f0000000240)='/dev/input/mouse#\x00', 0x100, 0x10000) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000007000)={0x0, 0x0, &(0x7f0000000140), 0x0, 0x0, &(0x7f00000001c0)}) r2 = dup2(r1, r0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000002c0)={0x8, 0x0, &(0x7f00000000c0)=[@release], 0x0, 0x0, &(0x7f0000000300)}) [ 556.675253] FAULT_INJECTION: forcing a failure. [ 556.675253] name failslab, interval 1, probability 0, space 0, times 0 [ 556.735516] CPU: 1 PID: 27204 Comm: syz-executor5 Not tainted 4.19.0-rc8-next-20181019+ #98 [ 556.744071] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 556.753450] Call Trace: [ 556.756082] dump_stack+0x244/0x39d [ 556.759740] ? dump_stack_print_info.cold.1+0x20/0x20 [ 556.764969] ? debug_smp_processor_id+0x1c/0x20 [ 556.769659] ? perf_trace_lock+0x14d/0x7a0 [ 556.773912] should_fail.cold.4+0xa/0x17 [ 556.778006] ? fault_create_debugfs_attr+0x1f0/0x1f0 [ 556.783131] ? mark_held_locks+0xc7/0x130 [ 556.787310] ? lockdep_hardirqs_on+0x3bb/0x5b0 [ 556.791909] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 556.797478] ? check_preemption_disabled+0x48/0x280 [ 556.802514] ? finish_task_switch+0x1f4/0x920 [ 556.807043] ? find_held_lock+0x36/0x1c0 [ 556.811150] ? perf_trace_sched_process_exec+0x860/0x860 [ 556.816639] __should_failslab+0x124/0x180 [ 556.820875] should_failslab+0x9/0x14 [ 556.824681] kmem_cache_alloc+0x2be/0x730 [ 556.828900] ? cap_capable+0x1f9/0x260 [ 556.832867] getname_flags+0xd0/0x590 [ 556.836673] user_path_mountpoint_at+0x27/0x40 [ 556.841261] ksys_umount+0x1c9/0x1230 [ 556.845075] ? find_held_lock+0x36/0x1c0 [ 556.849194] ? kasan_check_write+0x14/0x20 [ 556.853435] ? __detach_mounts+0x430/0x430 [ 556.857678] ? wait_for_completion+0x8a0/0x8a0 [ 556.862253] ? retint_kernel+0x2d/0x2d [ 556.866153] ? __sb_end_write+0xba/0x110 [ 556.870258] ? write_comp_data+0x4/0x70 [ 556.874248] ? __sb_end_write+0xd9/0x110 [ 556.878316] ? __sanitizer_cov_trace_const_cmp1+0x1a/0x20 [ 556.883848] ? fput+0x130/0x1a0 [ 556.887122] ? do_syscall_64+0x9a/0x820 [ 556.891101] ? do_syscall_64+0x9a/0x820 [ 556.895085] ? lockdep_hardirqs_on+0x3bb/0x5b0 [ 556.899659] ? trace_hardirqs_on+0xbd/0x310 [ 556.903973] ? __ia32_sys_read+0xb0/0xb0 [ 556.908040] ? entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 556.913401] ? trace_hardirqs_off_caller+0x300/0x300 [ 556.918508] __x64_sys_umount+0x54/0x80 [ 556.922499] do_syscall_64+0x1b9/0x820 [ 556.926405] ? entry_SYSCALL_64_after_hwframe+0x3e/0xbe [ 556.931791] ? syscall_return_slowpath+0x5e0/0x5e0 [ 556.936742] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 556.941619] ? trace_hardirqs_on_caller+0x310/0x310 [ 556.946679] ? prepare_exit_to_usermode+0x291/0x3b0 [ 556.951723] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 556.956594] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 556.961794] RIP: 0033:0x457569 [ 556.964987] Code: fd b3 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 cb b3 fb ff c3 66 2e 0f 1f 84 00 00 00 00 13:29:58 executing program 3: unshare(0x8000400) socketpair(0xb, 0x800, 0x6cca, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) getsockopt$inet_sctp_SCTP_DEFAULT_PRINFO(0xffffffffffffffff, 0x84, 0x72, &(0x7f0000000040)={0x0, 0x5, 0x20}, &(0x7f00000000c0)=0xc) getsockopt$inet_sctp_SCTP_SOCKOPT_PEELOFF(r0, 0x84, 0x66, &(0x7f0000000100)={r1, 0x9}, &(0x7f0000000180)=0xffffffffffffff84) r2 = mq_open(&(0x7f00000002c0)='-$\x00', 0x6e93ebbbcc0884f2, 0x0, &(0x7f0000664fc0)={0x0, 0x5, 0x2}) socketpair$unix(0x1, 0x200000000002, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) dup3(r2, r0, 0x80000) getsockopt$inet_sctp_SCTP_DEFAULT_SEND_PARAM(r0, 0x84, 0xa, &(0x7f00000001c0)={0x6, 0x5, 0x4, 0x3f, 0x84, 0x9, 0x80d, 0x1, r1}, &(0x7f0000000200)=0x20) rt_sigreturn() ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) mq_notify(r2, &(0x7f0000000140)={0x0, 0x0, 0x1, @thr={&(0x7f0000000040), &(0x7f00000000c0)}}) socket$inet6(0xa, 0x3, 0x100000000) 13:29:58 executing program 0: r0 = socket$inet(0x2, 0x4000000803, 0x4) bind$inet(r0, &(0x7f0000000000)={0x2, 0x0, @broadcast}, 0x10) getsockname(r0, &(0x7f00000036c0)=@xdp={0x2c, 0x0, 0x0}, &(0x7f0000000080)=0x80) setsockopt$inet_pktinfo(r0, 0x0, 0x8, &(0x7f0000003780)={r1, @rand_addr, @dev}, 0xc) syz_emit_ethernet(0x4a, &(0x7f0000000240)={@link_local, @empty=[0x0, 0x0, 0x200000000000000], [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x3c, 0x0, 0x0, 0x0, 0x4, 0x0, @empty=0x9000000, @broadcast}, @udp={0x0, 0x0, 0x28}}}}}, &(0x7f0000000380)) 13:29:58 executing program 4: preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f00000000c0)=""/148, 0x94}], 0x1, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000080)='io\x00') preadv(r0, &(0x7f0000000480), 0x10000000000002a1, 0x0) socket$netlink(0x10, 0x3, 0xf) 13:29:58 executing program 1: socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)) syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0xe1, 0x400100) creat(&(0x7f00000001c0)='./file0\x00', 0x2) openat$dsp(0xffffffffffffff9c, &(0x7f0000000200)='/dev/dsp\x00', 0x8000, 0x0) syz_open_dev$mouse(&(0x7f0000000240)='/dev/input/mouse#\x00', 0x100, 0x10000) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000007000)={0x0, 0x0, &(0x7f0000000140), 0x0, 0x0, &(0x7f00000001c0)}) r2 = dup2(r1, r0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000002c0)={0x8, 0x0, &(0x7f00000000c0)=[@release], 0x0, 0x0, &(0x7f0000000300)}) [ 556.983898] RSP: 002b:00007fc9ef9fec78 EFLAGS: 00000246 ORIG_RAX: 00000000000000a6 [ 556.991618] RAX: ffffffffffffffda RBX: 00007fc9ef9fec90 RCX: 0000000000457569 [ 556.998877] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000020000040 [ 557.006134] RBP: 000000000072bf00 R08: 0000000000000000 R09: 0000000000000000 [ 557.013393] R10: 0000000000000000 R11: 0000000000000246 R12: 00007fc9ef9ff6d4 [ 557.020649] R13: 00000000004c4efe R14: 00000000004d8418 R15: 0000000000000003 13:29:58 executing program 5 (fault-call:3 fault-nth:1): syz_mount_image$btrfs(&(0x7f0000000140)='btrfs\x00', &(0x7f0000000180)='./file0\x00', 0x0, 0x0, &(0x7f00000007c0), 0x0, &(0x7f0000000380)=ANY=[]) syz_mount_image$ntfs(&(0x7f0000000200)='ntfs\x00', &(0x7f0000000080)='./file1\x00', 0x0, 0x30, &(0x7f0000000580), 0x0, &(0x7f0000000680)=ANY=[]) mount$overlay(0x404030, &(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f0000000100)={[{@upperdir={'upperdir', 0x3d, './file0'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@workdir={'workdir', 0x3d, './file1'}, 0x5c}]}) umount2(&(0x7f0000000040)='./file0\x00', 0x0) 13:29:58 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000007000)={0x8, 0x0, &(0x7f0000000140)=[@acquire], 0x0, 0x0, &(0x7f00000001c0)}) r2 = dup2(r1, r0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000002c0)={0x8, 0x0, &(0x7f00000000c0)=[@release], 0x3f00, 0x0, &(0x7f0000000300)}) 13:29:58 executing program 0: r0 = socket$inet(0x2, 0x4000000803, 0x4) bind$inet(r0, &(0x7f0000000000)={0x2, 0x0, @broadcast}, 0x10) getsockname(r0, &(0x7f00000036c0)=@xdp={0x2c, 0x0, 0x0}, &(0x7f0000000080)=0x80) setsockopt$inet_pktinfo(r0, 0x0, 0x8, &(0x7f0000003780)={r1, @rand_addr, @dev}, 0xc) syz_emit_ethernet(0x4a, &(0x7f0000000240)={@link_local, @empty=[0x0, 0x0, 0x4], [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x3c, 0x0, 0x0, 0x0, 0x4, 0x0, @empty=0x9000000, @broadcast}, @udp={0x0, 0x0, 0x28}}}}}, &(0x7f0000000380)) 13:29:58 executing program 3: open_by_handle_at(0xffffffffffffffff, &(0x7f0000000200)=ANY=[@ANYBLOB="0800000000000000f729a90f18c101079fa66c10d1f4e0d995cc882c464b2988145ce54106247a8006b816aadd1b7be8fbe46cc353a009d4a61f97cd8c7137c0f56479bc404d7bdb36ba5e759a2f3e1fc7f22d78bd6f297509f1fd2568ce6a25859ce9781fe8c77e082d8512cead931199afa2ce873e7f0380ae5ac618c62324"], 0x0) ioctl$TUNGETFILTER(0xffffffffffffffff, 0x801054db, &(0x7f0000000040)=""/130) mmap(&(0x7f0000600000/0x4000)=nil, 0x4000, 0x0, 0x1000044031, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f000025c000)={0x0, 0x70, 0x3e6}, 0x0, 0x0, 0xffffffffffffffff, 0x0) setsockopt$inet_sctp6_SCTP_SOCKOPT_BINDX_REM(0xffffffffffffffff, 0x84, 0x65, &(0x7f0000000300)=[@in6={0xa, 0x0, 0x0, @mcast2}, @in={0x2, 0x0, @multicast1}], 0x2c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x4002, 0x0) io_setup(0x5b3, &(0x7f0000000040)=0x0) io_submit(r1, 0x111, &(0x7f0000001540)=[&(0x7f0000000140)={0x0, 0x0, 0xf0000000000000, 0x1, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x0, 0x10, 0xffffffffffffffff, 0x0) 13:29:58 executing program 4: r0 = syz_open_procfs(0x0, &(0x7f0000000080)='io\x00') preadv(r0, &(0x7f0000000480), 0x10000000000002a1, 0x0) 13:29:58 executing program 1: socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)) syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0xe1, 0x400100) creat(&(0x7f00000001c0)='./file0\x00', 0x2) openat$dsp(0xffffffffffffff9c, &(0x7f0000000200)='/dev/dsp\x00', 0x8000, 0x0) syz_open_dev$mouse(&(0x7f0000000240)='/dev/input/mouse#\x00', 0x100, 0x10000) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000007000)={0x8, 0x0, &(0x7f0000000140)=[@acquire], 0x0, 0x0, &(0x7f00000001c0)}) r2 = dup2(0xffffffffffffffff, r0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000002c0)={0x8, 0x0, &(0x7f00000000c0)=[@release], 0x0, 0x0, &(0x7f0000000300)}) 13:29:58 executing program 1: socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)) syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0xe1, 0x400100) creat(&(0x7f00000001c0)='./file0\x00', 0x2) openat$dsp(0xffffffffffffff9c, &(0x7f0000000200)='/dev/dsp\x00', 0x8000, 0x0) syz_open_dev$mouse(&(0x7f0000000240)='/dev/input/mouse#\x00', 0x100, 0x10000) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x8, 0x0, &(0x7f0000000140)=[@acquire], 0x0, 0x0, &(0x7f00000001c0)}) r1 = dup2(r0, 0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000002c0)={0x8, 0x0, &(0x7f00000000c0)=[@release], 0x0, 0x0, &(0x7f0000000300)}) 13:29:58 executing program 4: preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f00000000c0)=""/148, 0x94}], 0x1, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000080)='io\x00') getsockopt$inet_sctp6_SCTP_MAX_BURST(r0, 0x84, 0x14, &(0x7f0000000040)=@assoc_value={0x0}, &(0x7f0000000180)=0x8) getsockopt$inet_tcp_buf(r0, 0x6, 0x1f, &(0x7f0000000240)=""/41, &(0x7f0000000280)=0x29) getsockopt$inet_sctp6_SCTP_DELAYED_SACK(r0, 0x84, 0x10, &(0x7f00000001c0)=@assoc_value={r1, 0x7}, &(0x7f0000000200)=0x8) ioctl$sock_bt_bnep_BNEPGETSUPPFEAT(r0, 0x800442d4, &(0x7f00000002c0)=0x7) preadv(r0, &(0x7f0000000480), 0x100000000000004a, 0x0) write$P9_RLOCK(r0, &(0x7f0000000000)={0x8, 0x35, 0x2, 0x1}, 0x8) 13:29:58 executing program 0: r0 = socket$inet(0x2, 0x4000000803, 0x4) bind$inet(r0, &(0x7f0000000000)={0x2, 0x0, @broadcast}, 0x10) getsockname(r0, &(0x7f00000036c0)=@xdp={0x2c, 0x0, 0x0}, &(0x7f0000000080)=0x80) setsockopt$inet_pktinfo(r0, 0x0, 0x8, &(0x7f0000003780)={r1, @rand_addr, @dev}, 0xc) syz_emit_ethernet(0x4a, &(0x7f0000000240)={@link_local, @empty=[0x0, 0x0, 0xffffdd86], [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x3c, 0x0, 0x0, 0x0, 0x4, 0x0, @empty=0x9000000, @broadcast}, @udp={0x0, 0x0, 0x28}}}}}, &(0x7f0000000380)) 13:29:58 executing program 1: socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)) syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0xe1, 0x400100) creat(&(0x7f00000001c0)='./file0\x00', 0x2) openat$dsp(0xffffffffffffff9c, &(0x7f0000000200)='/dev/dsp\x00', 0x8000, 0x0) syz_open_dev$mouse(&(0x7f0000000240)='/dev/input/mouse#\x00', 0x100, 0x10000) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000007000)={0x8, 0x0, &(0x7f0000000140)=[@acquire], 0x0, 0x0, &(0x7f00000001c0)}) dup2(r1, r0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f00000002c0)={0x8, 0x0, &(0x7f00000000c0)=[@release], 0x0, 0x0, &(0x7f0000000300)}) [ 557.469147] ntfs: (device loop5): ntfs_fill_super(): Unable to determine device size. [ 557.559741] FAULT_INJECTION: forcing a failure. [ 557.559741] name failslab, interval 1, probability 0, space 0, times 0 13:29:58 executing program 1: socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)) syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0xe1, 0x400100) creat(&(0x7f00000001c0)='./file0\x00', 0x2) openat$dsp(0xffffffffffffff9c, &(0x7f0000000200)='/dev/dsp\x00', 0x8000, 0x0) syz_open_dev$mouse(&(0x7f0000000240)='/dev/input/mouse#\x00', 0x100, 0x10000) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000007000)={0x8, 0x0, &(0x7f0000000140)=[@acquire], 0x0, 0x0, &(0x7f00000001c0)}) r2 = dup2(r1, r0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000002c0)={0x0, 0x0, &(0x7f00000000c0), 0x0, 0x0, &(0x7f0000000300)}) [ 557.621377] CPU: 0 PID: 27260 Comm: syz-executor5 Not tainted 4.19.0-rc8-next-20181019+ #98 [ 557.629935] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 557.639336] Call Trace: [ 557.641956] dump_stack+0x244/0x39d [ 557.645640] ? dump_stack_print_info.cold.1+0x20/0x20 [ 557.650961] should_fail.cold.4+0xa/0x17 [ 557.655050] ? fault_create_debugfs_attr+0x1f0/0x1f0 [ 557.660177] ? mark_held_locks+0xc7/0x130 [ 557.664344] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 557.669900] ? check_preemption_disabled+0x48/0x280 [ 557.674946] ? _raw_spin_unlock_irqrestore+0x82/0xd0 [ 557.680086] ? debug_smp_processor_id+0x1c/0x20 [ 557.684784] ? perf_trace_lock+0x14d/0x7a0 [ 557.689046] ? print_usage_bug+0xc0/0xc0 [ 557.693145] ? lock_is_held_type+0x210/0x210 [ 557.697592] ? zap_class+0x640/0x640 [ 557.701334] ? find_held_lock+0x36/0x1c0 [ 557.705418] ? zap_class+0x640/0x640 [ 557.709182] ? print_usage_bug+0xc0/0xc0 [ 557.713264] ? mark_held_locks+0xc7/0x130 [ 557.717446] ? lock_acquire+0x1ed/0x520 13:29:59 executing program 1: socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)) syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0xe1, 0x400100) creat(&(0x7f00000001c0)='./file0\x00', 0x2) openat$dsp(0xffffffffffffff9c, &(0x7f0000000200)='/dev/dsp\x00', 0x8000, 0x0) syz_open_dev$mouse(&(0x7f0000000240)='/dev/input/mouse#\x00', 0x100, 0x10000) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000007000)={0x8, 0x0, &(0x7f0000000140)=[@acquire], 0x0, 0x0, &(0x7f00000001c0)}) r2 = dup2(r1, r0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000002c0)={0x0, 0x0, &(0x7f00000000c0), 0x0, 0x0, &(0x7f0000000300)}) [ 557.721591] ? bdi_split_work_to_wbs+0x123/0x13d0 [ 557.726472] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 557.732035] ? check_preemption_disabled+0x48/0x280 [ 557.737074] __should_failslab+0x124/0x180 [ 557.741333] should_failslab+0x9/0x14 [ 557.745151] kmem_cache_alloc_trace+0x4b/0x750 [ 557.749769] bdi_split_work_to_wbs+0x5c1/0x13d0 [ 557.754490] ? locked_inode_to_wb_and_lock_list+0xb50/0xb50 [ 557.760218] ? mark_held_locks+0x130/0x130 [ 557.764493] ? lockdep_hardirqs_on+0x3bb/0x5b0 [ 557.769096] ? trace_hardirqs_on+0xbd/0x310 [ 557.773434] ? rcu_dynticks_curr_cpu_in_eqs+0xa2/0x170 [ 557.778743] ? call_rcu+0xb/0x10 [ 557.782127] ? trace_hardirqs_off_caller+0x300/0x300 [ 557.787250] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 557.792922] ? zap_class+0x640/0x640 [ 557.796666] ? find_held_lock+0x36/0x1c0 [ 557.800779] ? rcu_is_watching+0x30/0x30 [ 557.804873] ? __lock_is_held+0xb5/0x140 [ 557.808947] ? lock_downgrade+0x900/0x900 [ 557.813119] ? zap_class+0x640/0x640 [ 557.816852] ? __sanitizer_cov_trace_cmp8+0x18/0x20 [ 557.821900] __writeback_inodes_sb_nr+0x3fa/0x580 [ 557.826775] ? bdi_split_work_to_wbs+0x13d0/0x13d0 [ 557.831732] ? __sanitizer_cov_trace_cmp4+0x16/0x20 [ 557.836758] ? get_nr_dirty_inodes+0xd6/0x130 [ 557.841275] ? inode_sleep_on_writeback+0x240/0x240 [ 557.846315] ? lock_release+0xa10/0xa10 [ 557.850310] ? perf_trace_sched_process_exec+0x860/0x860 [ 557.855778] ? __sanitizer_cov_trace_cmp4+0x16/0x20 [ 557.860827] ? sync_inodes_sb+0x375/0x480 [ 557.860864] writeback_inodes_sb+0x27/0x30 [ 557.860883] sync_filesystem+0x16f/0x330 [ 557.869303] ? sync_fs_one_sb+0x100/0x100 [ 557.869322] ? __down_interruptible+0x700/0x700 [ 557.869423] ? ovl_statfs+0x1f0/0x1f0 [ 557.886490] ovl_sync_fs+0xb4/0xf0 [ 557.890034] sync_filesystem+0x277/0x330 [ 557.894089] ? sync_fs_one_sb+0x100/0x100 [ 557.898239] ? trace_hardirqs_off_caller+0x300/0x300 [ 557.903343] generic_shutdown_super+0xdd/0x530 [ 557.908020] ? unregister_shrinker+0x270/0x460 [ 557.912712] ? destroy_super_rcu+0x210/0x210 [ 557.917143] ? unregister_shrinker+0x298/0x460 [ 557.921751] ? prepare_kswapd_sleep+0x220/0x220 [ 557.926428] ? deactivate_super+0x2b3/0x320 [ 557.930762] kill_anon_super+0x3e/0x60 [ 557.934650] deactivate_locked_super+0x97/0x100 [ 557.939322] deactivate_super+0x2bb/0x320 [ 557.943472] ? get_super_exclusive_thawed+0x20/0x20 [ 557.948504] ? shrink_dcache_sb+0x350/0x350 [ 557.952835] cleanup_mnt+0xbf/0x160 [ 557.956474] __cleanup_mnt+0x16/0x20 [ 557.960279] task_work_run+0x1e8/0x2a0 [ 557.964177] ? task_work_cancel+0x240/0x240 [ 557.968507] ? fput+0x130/0x1a0 [ 557.971833] ? do_syscall_64+0x9a/0x820 [ 557.975800] ? do_syscall_64+0x9a/0x820 [ 557.979774] exit_to_usermode_loop+0x318/0x380 [ 557.984365] ? __bpf_trace_sys_exit+0x30/0x30 [ 557.988856] do_syscall_64+0x6be/0x820 [ 557.992734] ? entry_SYSCALL_64_after_hwframe+0x3e/0xbe [ 557.998088] ? syscall_return_slowpath+0x5e0/0x5e0 [ 558.003006] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 558.007862] ? trace_hardirqs_on_caller+0x310/0x310 [ 558.012883] ? prepare_exit_to_usermode+0x3b0/0x3b0 [ 558.017891] ? prepare_exit_to_usermode+0x291/0x3b0 [ 558.022907] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 558.027766] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 558.032950] RIP: 0033:0x457569 [ 558.036143] Code: fd b3 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 cb b3 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 558.055054] RSP: 002b:00007fc9ef9fec78 EFLAGS: 00000246 ORIG_RAX: 00000000000000a6 [ 558.062753] RAX: 0000000000000000 RBX: 00007fc9ef9fec90 RCX: 0000000000457569 [ 558.070012] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000020000040 [ 558.077268] RBP: 000000000072bf00 R08: 0000000000000000 R09: 0000000000000000 [ 558.084527] R10: 0000000000000000 R11: 0000000000000246 R12: 00007fc9ef9ff6d4 [ 558.091803] R13: 00000000004c4efe R14: 00000000004d8418 R15: 0000000000000003 13:29:59 executing program 5 (fault-call:3 fault-nth:2): syz_mount_image$btrfs(&(0x7f0000000140)='btrfs\x00', &(0x7f0000000180)='./file0\x00', 0x0, 0x0, &(0x7f00000007c0), 0x0, &(0x7f0000000380)=ANY=[]) syz_mount_image$ntfs(&(0x7f0000000200)='ntfs\x00', &(0x7f0000000080)='./file1\x00', 0x0, 0x30, &(0x7f0000000580), 0x0, &(0x7f0000000680)=ANY=[]) mount$overlay(0x404030, &(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f0000000100)={[{@upperdir={'upperdir', 0x3d, './file0'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@workdir={'workdir', 0x3d, './file1'}, 0x5c}]}) umount2(&(0x7f0000000040)='./file0\x00', 0x0) 13:29:59 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000007000)={0x8, 0x0, &(0x7f0000000140)=[@acquire], 0x0, 0x0, &(0x7f00000001c0)}) r2 = dup2(r1, r0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000002c0)={0x8, 0x0, &(0x7f00000000c0)=[@release], 0xfffffdfd, 0x0, &(0x7f0000000300)}) 13:29:59 executing program 4: preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f00000000c0)=""/148, 0x94}], 0x1, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000080)='io\x00') ioctl$sock_inet_SIOCGIFADDR(r0, 0x8915, &(0x7f0000000000)={'gretap0\x00', {0x2, 0x4e20, @multicast1}}) getresuid(&(0x7f0000002440)=0x0, &(0x7f0000002480), &(0x7f00000024c0)) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000002500)={0x0, 0x0, 0x0}, &(0x7f0000002540)=0xc) mount$fuse(0x0, &(0x7f0000001300)='./file0\x00', &(0x7f0000001340)='fuse\x00', 0x8000, &(0x7f0000002580)={{'fd', 0x3d, r0}, 0x2c, {'rootmode', 0x3d, 0x8000}, 0x2c, {'user_id', 0x3d, r1}, 0x2c, {'group_id', 0x3d, r2}, 0x2c, {[{@blksize={'blksize'}}, {@default_permissions='default_permissions'}], [{@fscontext={'fscontext', 0x3d, 'unconfined_u'}}, {@fsmagic={'fsmagic', 0x3d, 0x7}}]}}) ioctl$sock_SIOCSIFBR(r0, 0x8941, &(0x7f0000000040)=@generic={0x3, 0x80000000, 0x10000}) preadv(r0, &(0x7f00000023c0)=[{&(0x7f0000000180)=""/4096, 0x1000}, {&(0x7f0000001180)=""/126, 0x7e}, {&(0x7f00000013c0)=""/4096, 0x1000}, {&(0x7f0000001200)=""/28, 0x1c}, {&(0x7f0000001240)=""/173, 0xad}, {&(0x7f0000001300)}], 0x6, 0x4) 13:29:59 executing program 1: socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)) syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0xe1, 0x400100) creat(&(0x7f00000001c0)='./file0\x00', 0x2) openat$dsp(0xffffffffffffff9c, &(0x7f0000000200)='/dev/dsp\x00', 0x8000, 0x0) syz_open_dev$mouse(&(0x7f0000000240)='/dev/input/mouse#\x00', 0x100, 0x10000) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000007000)={0x8, 0x0, &(0x7f0000000140)=[@acquire], 0x0, 0x0, &(0x7f00000001c0)}) r2 = dup2(r1, r0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000002c0)={0x0, 0x0, &(0x7f00000000c0), 0x0, 0x0, &(0x7f0000000300)}) 13:29:59 executing program 0: r0 = socket$inet(0x2, 0x4000000803, 0x4) bind$inet(r0, &(0x7f0000000000)={0x2, 0x0, @broadcast}, 0x10) getsockname(r0, &(0x7f00000036c0)=@xdp={0x2c, 0x0, 0x0}, &(0x7f0000000080)=0x80) setsockopt$inet_pktinfo(r0, 0x0, 0x8, &(0x7f0000003780)={r1, @rand_addr, @dev}, 0xc) syz_emit_ethernet(0x4a, &(0x7f0000000240)={@link_local, @empty=[0x0, 0x0, 0x8847000000000000], [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x3c, 0x0, 0x0, 0x0, 0x4, 0x0, @empty=0x9000000, @broadcast}, @udp={0x0, 0x0, 0x28}}}}}, &(0x7f0000000380)) 13:29:59 executing program 3: r0 = syz_open_procfs(0x0, &(0x7f0000000040)='net/igmp\x00') preadv(r0, &(0x7f00000017c0), 0x1a0, 0x400000000000) ioctl$RTC_EPOCH_READ(r0, 0x8008700d, &(0x7f0000000080)) setsockopt$bt_l2cap_L2CAP_CONNINFO(r0, 0x6, 0x2, &(0x7f0000000000)={0x2, 0x9, 0x3, 0x3}, 0x6) [ 558.238178] ntfs: (device loop5): ntfs_fill_super(): Unable to determine device size. 13:29:59 executing program 4: preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f00000000c0)=""/148, 0x94}], 0x1, 0x0) r0 = inotify_init1(0x80000) fcntl$setflags(r0, 0x2, 0x1) r1 = syz_open_dev$midi(&(0x7f0000000040)='/dev/midi#\x00', 0x0, 0x440100) ioctl$EVIOCGPROP(r1, 0x80404509, &(0x7f0000000340)=""/4096) r2 = syz_open_procfs(0x0, &(0x7f0000000080)='io\x00') ioctl$FS_IOC_SETVERSION(r2, 0x40087602, &(0x7f0000000000)=0x5) preadv(r2, &(0x7f0000000240)=[{&(0x7f00000002c0)=""/77, 0x4d}, {&(0x7f0000000180)=""/131, 0x83}], 0x2, 0x8) setsockopt$inet6_tcp_TCP_REPAIR_WINDOW(r2, 0x6, 0x1d, &(0x7f0000000280)={0x49, 0x3ff, 0x3, 0x8000, 0x6}, 0x14) [ 558.337549] FAULT_INJECTION: forcing a failure. [ 558.337549] name failslab, interval 1, probability 0, space 0, times 0 [ 558.363936] CPU: 0 PID: 27307 Comm: syz-executor5 Not tainted 4.19.0-rc8-next-20181019+ #98 [ 558.372492] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 558.381854] Call Trace: [ 558.384467] dump_stack+0x244/0x39d [ 558.388120] ? dump_stack_print_info.cold.1+0x20/0x20 [ 558.393338] should_fail.cold.4+0xa/0x17 [ 558.397408] ? worker_thread+0x1390/0x1390 [ 558.401660] ? fault_create_debugfs_attr+0x1f0/0x1f0 [ 558.406784] ? find_held_lock+0x36/0x1c0 [ 558.410859] ? mark_held_locks+0xc7/0x130 [ 558.415083] ? __local_bh_enable_ip+0x160/0x260 [ 558.419761] ? __local_bh_enable_ip+0x160/0x260 [ 558.424449] ? lockdep_hardirqs_on+0x3bb/0x5b0 [ 558.429058] ? trace_hardirqs_on+0xbd/0x310 [ 558.433393] ? _raw_spin_unlock_bh+0x30/0x40 [ 558.437808] ? trace_hardirqs_off_caller+0x300/0x300 [ 558.442921] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 558.448476] ? check_preemption_disabled+0x48/0x280 [ 558.453517] ? wb_queue_work+0x327/0x6f0 [ 558.457590] ? wb_queue_work+0x327/0x6f0 [ 558.461658] ? __local_bh_enable_ip+0x160/0x260 [ 558.466355] ? _raw_spin_unlock_bh+0x30/0x40 [ 558.470780] ? wb_queue_work+0x327/0x6f0 [ 558.474855] ? perf_trace_writeback_dirty_page+0x920/0x920 [ 558.480531] __should_failslab+0x124/0x180 [ 558.484776] should_failslab+0x9/0x14 [ 558.488587] kmem_cache_alloc_trace+0x4b/0x750 [ 558.493190] bdi_split_work_to_wbs+0x5c1/0x13d0 [ 558.497882] ? locked_inode_to_wb_and_lock_list+0xb50/0xb50 [ 558.503607] ? mark_held_locks+0x130/0x130 [ 558.507854] ? lockdep_hardirqs_on+0x3bb/0x5b0 [ 558.512468] ? trace_hardirqs_on+0xbd/0x310 [ 558.516802] ? rcu_dynticks_curr_cpu_in_eqs+0xa2/0x170 [ 558.522080] ? call_rcu+0xb/0x10 [ 558.525453] ? trace_hardirqs_off_caller+0x300/0x300 [ 558.530590] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 558.536143] ? zap_class+0x640/0x640 [ 558.539868] ? find_held_lock+0x36/0x1c0 [ 558.543938] ? rcu_is_watching+0x30/0x30 [ 558.548042] ? __lock_is_held+0xb5/0x140 [ 558.552105] ? lock_downgrade+0x900/0x900 [ 558.556270] ? zap_class+0x640/0x640 [ 558.559989] ? __sanitizer_cov_trace_cmp8+0x18/0x20 [ 558.565015] __writeback_inodes_sb_nr+0x3fa/0x580 [ 558.569869] ? bdi_split_work_to_wbs+0x13d0/0x13d0 [ 558.574810] ? __sanitizer_cov_trace_cmp4+0x16/0x20 [ 558.579831] ? get_nr_dirty_inodes+0xd6/0x130 [ 558.584349] ? inode_sleep_on_writeback+0x240/0x240 [ 558.589373] ? lock_release+0xa10/0xa10 [ 558.593352] ? perf_trace_sched_process_exec+0x860/0x860 [ 558.598815] ? __sanitizer_cov_trace_cmp4+0x16/0x20 [ 558.603838] ? sync_inodes_sb+0x375/0x480 [ 558.608002] writeback_inodes_sb+0x27/0x30 [ 558.612247] sync_filesystem+0x16f/0x330 [ 558.616315] ? sync_fs_one_sb+0x100/0x100 [ 558.620487] ? __down_interruptible+0x700/0x700 [ 558.625200] ? ovl_statfs+0x1f0/0x1f0 [ 558.629008] ovl_sync_fs+0xb4/0xf0 [ 558.632558] sync_filesystem+0x277/0x330 [ 558.636626] ? sync_fs_one_sb+0x100/0x100 [ 558.640784] ? trace_hardirqs_off_caller+0x300/0x300 [ 558.645907] generic_shutdown_super+0xdd/0x530 [ 558.650508] ? unregister_shrinker+0x270/0x460 [ 558.655101] ? destroy_super_rcu+0x210/0x210 [ 558.659521] ? unregister_shrinker+0x298/0x460 [ 558.664110] ? prepare_kswapd_sleep+0x220/0x220 [ 558.668786] ? deactivate_super+0x2b3/0x320 [ 558.673122] kill_anon_super+0x3e/0x60 [ 558.677016] deactivate_locked_super+0x97/0x100 [ 558.681692] deactivate_super+0x2bb/0x320 [ 558.685848] ? get_super_exclusive_thawed+0x20/0x20 [ 558.690871] ? shrink_dcache_sb+0x350/0x350 [ 558.695222] cleanup_mnt+0xbf/0x160 [ 558.698869] __cleanup_mnt+0x16/0x20 [ 558.702590] task_work_run+0x1e8/0x2a0 [ 558.706503] ? task_work_cancel+0x240/0x240 [ 558.710836] ? fput+0x130/0x1a0 [ 558.714128] ? do_syscall_64+0x9a/0x820 [ 558.718107] ? do_syscall_64+0x9a/0x820 [ 558.722094] exit_to_usermode_loop+0x318/0x380 [ 558.726686] ? __bpf_trace_sys_exit+0x30/0x30 [ 558.731205] do_syscall_64+0x6be/0x820 [ 558.735119] ? entry_SYSCALL_64_after_hwframe+0x3e/0xbe [ 558.740516] ? syscall_return_slowpath+0x5e0/0x5e0 [ 558.745472] ? trace_hardirqs_on_caller+0x310/0x310 [ 558.750511] ? prepare_exit_to_usermode+0x3b0/0x3b0 [ 558.755623] ? post_copy_siginfo_from_user.isra.25.part.26+0x250/0x250 [ 558.762328] ? __switch_to_asm+0x40/0x70 [ 558.766398] ? __switch_to_asm+0x34/0x70 [ 558.770480] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 558.775344] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 558.780545] RIP: 0033:0x457569 [ 558.783749] Code: fd b3 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 cb b3 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 558.802666] RSP: 002b:00007fc9ef9ddc78 EFLAGS: 00000246 ORIG_RAX: 00000000000000a6 [ 558.810416] RAX: 0000000000000000 RBX: 00007fc9ef9ddc90 RCX: 0000000000457569 [ 558.817709] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000020000040 [ 558.825021] RBP: 000000000072bfa0 R08: 0000000000000000 R09: 0000000000000000 [ 558.832310] R10: 0000000000000000 R11: 0000000000000246 R12: 00007fc9ef9de6d4 13:30:00 executing program 3: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000140)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_SET_SIGNAL_MASK(0xffffffffffffffff, 0x4004ae8b, &(0x7f0000001000)=ANY=[@ANYBLOB="eb"]) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) bpf$BPF_PROG_ATTACH(0x8, &(0x7f0000000100)={r0, r2, 0x9, 0x2}, 0x10) ioctl$KVM_SET_GUEST_DEBUG(r2, 0x4048ae9b, &(0x7f0000000240)={0x20001, 0x0, [0x4, 0x100000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7]}) syz_kvm_setup_cpu$x86(r1, r2, &(0x7f0000fe7000/0x18000)=nil, &(0x7f0000000440)=[@textreal={0x8, &(0x7f0000000000)="0f01c8f20f35ba2000b000ee0f2336360fc76df20f2054440f20c0663504000000440f22c064f3e10a660f3a63a63c6700baf80c66b8bd08428766efbafc0cb066ee", 0x42}], 0x1, 0x0, &(0x7f0000000100), 0x0) r3 = semget$private(0x0, 0x5, 0x1) semctl$GETALL(r3, 0x0, 0xd, &(0x7f0000000180)=""/115) ioctl$KVM_NMI(r2, 0xae9a) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f00000002c0)={0x0, 0x2, 0x0, 0x2000, &(0x7f0000001000/0x2000)=nil}) r4 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000080)='/dev/hwrng\x00', 0x305000, 0x0) ioctl$DRM_IOCTL_MARK_BUFS(r4, 0x40206417, &(0x7f00000000c0)={0xa8e, 0x40, 0x9, 0xffffffff, 0x1a, 0xff}) ioctl$KVM_RUN(r2, 0xae80, 0x0) ioctl$KVM_RUN(r2, 0xae80, 0x0) 13:30:00 executing program 0: r0 = socket$inet(0x2, 0x4000000803, 0x4) bind$inet(r0, &(0x7f0000000000)={0x2, 0x0, @broadcast}, 0x10) getsockname(r0, &(0x7f00000036c0)=@xdp={0x2c, 0x0, 0x0}, &(0x7f0000000080)=0x80) setsockopt$inet_pktinfo(r0, 0x0, 0x8, &(0x7f0000003780)={r1, @rand_addr, @dev}, 0xc) syz_emit_ethernet(0x4a, &(0x7f0000000240)={@link_local, @empty=[0x0, 0x0, 0xe803000000000000], [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x3c, 0x0, 0x0, 0x0, 0x4, 0x0, @empty=0x9000000, @broadcast}, @udp={0x0, 0x0, 0x28}}}}}, &(0x7f0000000380)) [ 558.839596] R13: 00000000004c4efe R14: 00000000004d8418 R15: 0000000000000005 13:30:00 executing program 1 (fault-call:10 fault-nth:0): socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)) syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0xe1, 0x400100) creat(&(0x7f00000001c0)='./file0\x00', 0x2) openat$dsp(0xffffffffffffff9c, &(0x7f0000000200)='/dev/dsp\x00', 0x8000, 0x0) syz_open_dev$mouse(&(0x7f0000000240)='/dev/input/mouse#\x00', 0x100, 0x10000) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000007000)={0x8, 0x0, &(0x7f0000000140)=[@acquire], 0x0, 0x0, &(0x7f00000001c0)}) r2 = dup2(r1, r0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000002c0)={0x8, 0x0, &(0x7f00000000c0)=[@release], 0x0, 0x0, &(0x7f0000000300)}) 13:30:00 executing program 5 (fault-call:3 fault-nth:3): syz_mount_image$btrfs(&(0x7f0000000140)='btrfs\x00', &(0x7f0000000180)='./file0\x00', 0x0, 0x0, &(0x7f00000007c0), 0x0, &(0x7f0000000380)=ANY=[]) syz_mount_image$ntfs(&(0x7f0000000200)='ntfs\x00', &(0x7f0000000080)='./file1\x00', 0x0, 0x30, &(0x7f0000000580), 0x0, &(0x7f0000000680)=ANY=[]) mount$overlay(0x404030, &(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f0000000100)={[{@upperdir={'upperdir', 0x3d, './file0'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@workdir={'workdir', 0x3d, './file1'}, 0x5c}]}) umount2(&(0x7f0000000040)='./file0\x00', 0x0) 13:30:00 executing program 4: preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f00000000c0)=""/148, 0x94}], 0x1, 0x0) preadv(0xffffffffffffffff, &(0x7f0000000480), 0x10000000000002a1, 0x0) 13:30:00 executing program 0: r0 = socket$inet(0x2, 0x4000000803, 0x4) bind$inet(r0, &(0x7f0000000000)={0x2, 0x0, @broadcast}, 0x10) getsockname(r0, &(0x7f00000036c0)=@xdp={0x2c, 0x0, 0x0}, &(0x7f0000000080)=0x80) setsockopt$inet_pktinfo(r0, 0x0, 0x8, &(0x7f0000003780)={r1, @rand_addr, @dev}, 0xc) syz_emit_ethernet(0x4a, &(0x7f0000000240)={@link_local, @empty=[0x0, 0x0, 0x8906000000000000], [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x3c, 0x0, 0x0, 0x0, 0x4, 0x0, @empty=0x9000000, @broadcast}, @udp={0x0, 0x0, 0x28}}}}}, &(0x7f0000000380)) 13:30:00 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000007000)={0x8, 0x0, &(0x7f0000000140)=[@acquire], 0x0, 0x0, &(0x7f00000001c0)}) r2 = dup2(r1, r0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000002c0)={0x8, 0x0, &(0x7f00000000c0)=[@release], 0x3f00000000000000, 0x0, &(0x7f0000000300)}) 13:30:00 executing program 1: socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)) syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0xe1, 0x400100) creat(&(0x7f00000001c0)='./file0\x00', 0x2) openat$dsp(0xffffffffffffff9c, &(0x7f0000000200)='/dev/dsp\x00', 0x8000, 0x0) syz_open_dev$mouse(&(0x7f0000000240)='/dev/input/mouse#\x00', 0x100, 0x10000) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000007000)={0x8, 0x0, &(0x7f0000000140)=[@acquire], 0x0, 0x0, &(0x7f00000001c0)}) r2 = dup2(r1, r0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000002c0)={0x8, 0x0, &(0x7f00000000c0)=[@release], 0x0, 0x0, &(0x7f0000000300)}) 13:30:00 executing program 4: r0 = syz_open_dev$dmmidi(&(0x7f0000000180)='/dev/dmmidi#\x00', 0x7f, 0x0) accept4$packet(0xffffffffffffffff, &(0x7f0000004800)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @remote}, &(0x7f0000004840)=0x14, 0x0) ioctl$sock_inet6_SIOCADDRT(r0, 0x890b, &(0x7f0000004880)={@loopback, @local, @loopback, 0x23c60be, 0x34e, 0x5, 0x100, 0x5, 0x80000000, r1}) preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f00000000c0)=""/148, 0x94}], 0x1, 0x0) r2 = syz_open_procfs(0x0, &(0x7f0000000080)='io\x00') accept$packet(r2, &(0x7f0000000000), &(0x7f0000000040)=0x14) preadv(r2, &(0x7f0000000480), 0x10000000000002a1, 0x0) 13:30:00 executing program 3: fstat(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, 0x0, 0x0, 0x0}) r1 = openat$qat_adf_ctl(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/qat_adf_ctl\x00', 0x400, 0x0) ioctl$RTC_IRQP_SET(r1, 0x4008700c, 0x3b8) r2 = getegid() lchown(&(0x7f0000000000)='./file0\x00', r0, r2) r3 = socket(0x1e, 0x4, 0x0) getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @link_local}, &(0x7f0000000140)=0x14) [ 559.175078] overlayfs: failed to resolve './file1': -2 13:30:00 executing program 1: socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)) syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0xe1, 0x400100) creat(&(0x7f00000001c0)='./file0\x00', 0x2) openat$dsp(0xffffffffffffff9c, &(0x7f0000000200)='/dev/dsp\x00', 0x8000, 0x0) syz_open_dev$mouse(&(0x7f0000000240)='/dev/input/mouse#\x00', 0x100, 0x10000) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000007000)={0x8, 0x0, &(0x7f0000000140)=[@acquire], 0x0, 0x0, &(0x7f00000001c0)}) r2 = dup2(r1, r0) ioctl$BINDER_WRITE_READ(r2, 0x5421, &(0x7f00000002c0)={0x8, 0x0, &(0x7f00000000c0)=[@release], 0x0, 0x0, &(0x7f0000000300)}) 13:30:00 executing program 0: r0 = socket$inet(0x2, 0x4000000803, 0x4) bind$inet(r0, &(0x7f0000000000)={0x2, 0x0, @broadcast}, 0x10) getsockname(r0, &(0x7f00000036c0)=@xdp={0x2c, 0x0, 0x0}, &(0x7f0000000080)=0x80) setsockopt$inet_pktinfo(r0, 0x0, 0x8, &(0x7f0000003780)={r1, @rand_addr, @dev}, 0xc) syz_emit_ethernet(0x4a, &(0x7f0000000240)={@link_local, @empty=[0x0, 0x0, 0xfffff000], [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x3c, 0x0, 0x0, 0x0, 0x4, 0x0, @empty=0x9000000, @broadcast}, @udp={0x0, 0x0, 0x28}}}}}, &(0x7f0000000380)) [ 559.301687] QAT: Invalid ioctl [ 559.315670] QAT: Invalid ioctl 13:30:00 executing program 0: r0 = socket$inet(0x2, 0x4000000803, 0x4) bind$inet(r0, &(0x7f0000000000)={0x2, 0x0, @broadcast}, 0x10) getsockname(r0, &(0x7f00000036c0)=@xdp={0x2c, 0x0, 0x0}, &(0x7f0000000080)=0x80) setsockopt$inet_pktinfo(r0, 0x0, 0x8, &(0x7f0000003780)={r1, @rand_addr, @dev}, 0xc) syz_emit_ethernet(0x4a, &(0x7f0000000240)={@link_local, @empty=[0x0, 0x0, 0xd], [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x3c, 0x0, 0x0, 0x0, 0x4, 0x0, @empty=0x9000000, @broadcast}, @udp={0x0, 0x0, 0x28}}}}}, &(0x7f0000000380)) [ 559.356514] ntfs: (device loop5): ntfs_fill_super(): Unable to determine device size. 13:30:00 executing program 3: r0 = socket$inet6(0xa, 0x40000080806, 0x0) bind$inet6(r0, &(0x7f000047b000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) listen(r0, 0x2007) r1 = socket$inet6(0xa, 0x6, 0x0) connect$inet6(r1, &(0x7f00000001c0)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) ioctl$FIGETBSZ(r0, 0x2, &(0x7f00000004c0)) r2 = accept4(r0, &(0x7f0000660ff4)=@nl=@unspec, &(0x7f0000000580)=0x5061, 0x4) sendmmsg(r0, &(0x7f0000000200)=[{{&(0x7f0000000140)=@rc, 0x80, &(0x7f0000001700), 0x1, &(0x7f0000001780)=ANY=[], 0xffffffffffffff15}}], 0x40000000000008b, 0x0) setsockopt$inet6_MCAST_LEAVE_GROUP(r2, 0x29, 0x2d, &(0x7f0000000240)={0x282, {{0xa, 0x4e20, 0x2, @remote, 0x7ff}}}, 0x88) mmap(&(0x7f0000000000/0xfda000)=nil, 0xfda000, 0x0, 0x31, 0xffffffffffffffff, 0x0) r3 = syz_open_dev$audion(&(0x7f0000000000)='/dev/audio#\x00', 0x80000000, 0x4000) ioctl$EVIOCGNAME(r3, 0x80404506, &(0x7f0000000500)=""/81) ioctl$TIOCGSID(0xffffffffffffffff, 0x5429, &(0x7f00000003c0)=0x0) capget(&(0x7f0000000400)={0x20071026, r4}, &(0x7f0000000440)={0x5, 0x17, 0x8, 0x4, 0x0, 0x80000001}) r5 = getpgid(0xffffffffffffffff) ioctl$TIOCGSID(0xffffffffffffff9c, 0x5429, &(0x7f0000000300)=0x0) r7 = syz_open_dev$sndpcmp(&(0x7f0000000340)='/dev/snd/pcmC#D#p\x00', 0x4, 0x101000) kcmp$KCMP_EPOLL_TFD(r5, r6, 0x7, r2, &(0x7f0000000380)={r7, r0, 0x8}) recvfrom$inet(r2, &(0x7f0000000080)=""/168, 0xa8, 0x0, &(0x7f0000000480)={0x2, 0x0, @multicast1}, 0x70e000) 13:30:00 executing program 5: syz_mount_image$btrfs(&(0x7f0000000140)='btrfs\x00', &(0x7f0000000180)='./file0\x00', 0x0, 0x0, &(0x7f00000007c0), 0x0, &(0x7f0000000380)=ANY=[]) syz_mount_image$ntfs(&(0x7f0000000200)='ntfs\x00', &(0x7f0000000080)='./file1\x00', 0x0, 0x30, &(0x7f0000000580), 0x0, &(0x7f0000000680)=ANY=[]) mount$overlay(0x404030, &(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f0000000100)={[{@upperdir={'upperdir', 0x3d, './file0'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@workdir={'workdir', 0x3d, './file1'}, 0x5c}]}) umount2(&(0x7f0000000040)='./file0\x00', 0x0) 13:30:00 executing program 1: socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)) syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0xe1, 0x400100) creat(&(0x7f00000001c0)='./file0\x00', 0x2) openat$dsp(0xffffffffffffff9c, &(0x7f0000000200)='/dev/dsp\x00', 0x8000, 0x0) syz_open_dev$mouse(&(0x7f0000000240)='/dev/input/mouse#\x00', 0x100, 0x10000) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000007000)={0x8, 0x0, &(0x7f0000000140)=[@acquire], 0x0, 0x0, &(0x7f00000001c0)}) r2 = dup2(r1, r0) ioctl$BINDER_WRITE_READ(r2, 0x2, &(0x7f00000002c0)={0x8, 0x0, &(0x7f00000000c0)=[@release], 0x0, 0x0, &(0x7f0000000300)}) 13:30:00 executing program 4: preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f00000000c0)=""/148, 0x94}], 0x1, 0x0) r0 = syz_open_dev$mouse(&(0x7f0000000040)='/dev/input/mouse#\x00', 0x7846, 0x2000) getsockopt$inet6_mreq(r0, 0x29, 0x1f, &(0x7f0000000180)={@local}, &(0x7f00000001c0)=0x14) r1 = syz_open_procfs(0x0, &(0x7f0000000080)='io\x00') syz_open_pts(r1, 0x4c000) preadv(r1, &(0x7f0000000480), 0x10000000000002a1, 0x0) syz_open_dev$dspn(&(0x7f0000000000)='/dev/dsp#\x00', 0x5, 0x0) 13:30:00 executing program 0: r0 = socket$inet(0x2, 0x4000000803, 0x4) bind$inet(r0, &(0x7f0000000000)={0x2, 0x0, @broadcast}, 0x10) getsockname(r0, &(0x7f00000036c0)=@xdp={0x2c, 0x0, 0x0}, &(0x7f0000000080)=0x80) setsockopt$inet_pktinfo(r0, 0x0, 0x8, &(0x7f0000003780)={r1, @rand_addr, @dev}, 0xc) syz_emit_ethernet(0x4a, &(0x7f0000000240)={@link_local, @empty=[0x0, 0x0, 0x689], [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x3c, 0x0, 0x0, 0x0, 0x4, 0x0, @empty=0x9000000, @broadcast}, @udp={0x0, 0x0, 0x28}}}}}, &(0x7f0000000380)) 13:30:00 executing program 3: r0 = accept$nfc_llcp(0xffffffffffffff9c, 0x0, &(0x7f0000000000)) listen(r0, 0x803) r1 = syz_open_dev$sndctrl(&(0x7f0000000040)='/dev/snd/controlC#\x00', 0x0, 0x0) ioctl$TCSETSF(0xffffffffffffffff, 0x5404, &(0x7f0000000340)) ioctl$SNDRV_CTL_IOCTL_ELEM_ADD(r1, 0xc4c85513, &(0x7f0000000080)={{0x0, 0x0, 0x0, 0x0, 'syz0\x00'}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'syz0\x00'}) [ 559.690852] ntfs: (device loop5): ntfs_fill_super(): Unable to determine device size. 13:30:01 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000007000)={0x8, 0x0, &(0x7f0000000140)=[@acquire], 0x0, 0x0, &(0x7f00000001c0)}) r2 = dup2(r1, r0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000002c0)={0x8, 0x0, &(0x7f00000000c0)=[@release], 0xfdfdffff00000000, 0x0, &(0x7f0000000300)}) 13:30:01 executing program 1: socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)) syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0xe1, 0x400100) creat(&(0x7f00000001c0)='./file0\x00', 0x2) openat$dsp(0xffffffffffffff9c, &(0x7f0000000200)='/dev/dsp\x00', 0x8000, 0x0) syz_open_dev$mouse(&(0x7f0000000240)='/dev/input/mouse#\x00', 0x100, 0x10000) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000007000)={0x8, 0x0, &(0x7f0000000140)=[@acquire], 0x0, 0x0, &(0x7f00000001c0)}) r2 = dup2(r1, r0) ioctl$BINDER_WRITE_READ(r2, 0xc0045878, &(0x7f00000002c0)={0x8, 0x0, &(0x7f00000000c0)=[@release], 0x0, 0x0, &(0x7f0000000300)}) 13:30:01 executing program 3: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000000)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) sendfile(r0, r0, &(0x7f0000000100), 0x400) r1 = dup2(r0, r0) getsockopt$inet6_int(r1, 0x29, 0xd0, &(0x7f0000000040), &(0x7f0000000080)=0x4) r2 = syz_open_procfs(0x0, &(0x7f0000000780)='net/ip_vs\x00') ioctl$SNDRV_CTL_IOCTL_RAWMIDI_NEXT_DEVICE(r2, 0xc0045540, &(0x7f00000000c0)=0x1) sendfile(r0, r2, &(0x7f0000000200), 0x80000003) 13:30:01 executing program 4: r0 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000040)='/dev/mixer\x00', 0x10000, 0x0) ioctl$TIOCLINUX5(r0, 0x541c, &(0x7f0000000180)={0x5, 0x2f, 0xfffffffffffffff9, 0x3ff}) preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f00000000c0)=""/148, 0x94}], 0x1, 0x0) r1 = openat$null(0xffffffffffffff9c, &(0x7f0000000000)='/dev/null\x00', 0x10000, 0x0) ioctl$RNDZAPENTCNT(r1, 0x5204, &(0x7f0000000200)=0x7fff) syz_open_procfs(0x0, &(0x7f0000000080)='io\x00') ioctl$RNDZAPENTCNT(r0, 0x5204, &(0x7f00000001c0)) 13:30:01 executing program 0: r0 = socket$inet(0x2, 0x4000000803, 0x4) bind$inet(r0, &(0x7f0000000000)={0x2, 0x0, @broadcast}, 0x10) getsockname(r0, &(0x7f00000036c0)=@xdp={0x2c, 0x0, 0x0}, &(0x7f0000000080)=0x80) setsockopt$inet_pktinfo(r0, 0x0, 0x8, &(0x7f0000003780)={r1, @rand_addr, @dev}, 0xc) syz_emit_ethernet(0x4a, &(0x7f0000000240)={@link_local, @empty=[0x0, 0x0, 0x89060000], [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x3c, 0x0, 0x0, 0x0, 0x4, 0x0, @empty=0x9000000, @broadcast}, @udp={0x0, 0x0, 0x28}}}}}, &(0x7f0000000380)) 13:30:01 executing program 5: syz_mount_image$btrfs(&(0x7f0000000140)='btrfs\x00', &(0x7f0000000180)='./file0\x00', 0x0, 0x0, &(0x7f00000007c0), 0x0, &(0x7f0000000380)=ANY=[]) syz_mount_image$ntfs(&(0x7f0000000200)='ntfs\x00', &(0x7f0000000080)='./file1\x00', 0x0, 0x30, &(0x7f0000000580), 0x0, &(0x7f0000000680)=ANY=[]) mount$overlay(0x404030, &(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f0000000100)={[{@upperdir={'upperdir', 0x3d, './file0'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@workdir={'workdir', 0x3d, './file1'}, 0x5c}]}) umount2(&(0x7f0000000040)='./file0\x00', 0x3c) 13:30:01 executing program 0: r0 = socket$inet(0x2, 0x4000000803, 0x4) bind$inet(r0, &(0x7f0000000000)={0x2, 0x0, @broadcast}, 0x10) getsockname(r0, &(0x7f00000036c0)=@xdp={0x2c, 0x0, 0x0}, &(0x7f0000000080)=0x80) setsockopt$inet_pktinfo(r0, 0x0, 0x8, &(0x7f0000003780)={r1, @rand_addr, @dev}, 0xc) syz_emit_ethernet(0x4a, &(0x7f0000000240)={@link_local, @empty=[0x0, 0x0, 0x600], [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x3c, 0x0, 0x0, 0x0, 0x4, 0x0, @empty=0x9000000, @broadcast}, @udp={0x0, 0x0, 0x28}}}}}, &(0x7f0000000380)) 13:30:01 executing program 4: preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f00000000c0)=""/148, 0x94}], 0x1, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000080)='io\x00') preadv(r0, &(0x7f0000001340)=[{&(0x7f0000000000)=""/80, 0x434}, {&(0x7f0000000180)=""/248, 0x1b9}, {&(0x7f0000000280)=""/45, 0x2d}, {&(0x7f0000001400)=""/33, 0x21}], 0x4, 0x20000000) r1 = socket(0x9, 0x7, 0x10000) write(r0, &(0x7f0000000340)="27a7c6dedd5708b55a029742ef918b85c3f25060dcef3cd2270f2e67bea2979d4b360e1d78081c936f19dd4e054fb0f6e85d720842a772245113b1d48e2e75d12b1d52d67f079f831937f5d4c924b069d204174bbc404ed7bd772bfc02fe897b2d9eae8a1543d1984be716377c2b2a00606a42cbb781dd06643c072ef0a7cefcb47f5602c495c6d734fc625e63fc53266338d9114e31f85c99543a3c93b605df2a935d8f192f1d324b9d306391e09ea6dd08418fdd69cd46bfaf2dab952b1b728946596a4afbe0d5dadedff194e242618208ce399f9489ac72beaaf78bff1098801754e9bb0c2106d6f2de9617966d2a2e84bc2a166721e40274aebd1e5108600208fd86933153cd36e7d914dd46a35c182608d587d99bbf32af708cd9e966ce8c8cffe1d82a0be99d1736b2e50734a8f481005fb5bfafd6704c68c43a93ac808dcb22c1fad7f085e45afb20ba3362fe9923343e4b46eb51b96f78eb54cdfbc5294d3a448d0e5d828003f3006d558134008db888b0ad2a0e096e31e90610b0fac945390259ffa24dd439af3d7f8a6e7a717d5e3636e716955734bd197428ed65faa27c541a5e9ac7723ea30bed16205a68066d111c8cbae34200ed772de86e887529792f33929b40f7d4aee19af0b2c6944ed95a3264a20fd924e5b61407c9a1b9dff865e00814fdb8de6140fd079065b52d5265dc1c93159f1c0942552a3b3dabe058238851596bcabb2cf9548946dad233f719a3f15796b3bd7db36622bf939ce6bcdcf2cca26c35318aa7c5e6a8b9f27d044f9cf5228064caef3fd3a07dd66638f60496ebc1e9fa8c6d2c58c9720dba008374e73fb96a02277a54ffe79a89a56002129653fc455350b2687ddf52bfb77aad1634c9e18591ae6ab2a204f2cd6b0eab3190cd419928e6bc3739b70799573b4d7caacc23f361860d3d6bf55c9a98c354dd3dd66a2fcd4c08863e2491bf6a12ed39956936583f9d3ba60976914df917908355ed2405ca583769a258e8cff2b8f430b11198ff7dfe039e8868ec6745ea509eeff93bd60b3b8348b3682d2dd993f04697d965ae51f21af5f702e6bbf913bd6c94f94edfb2cf7f9b23f3d11846ed6f358c5597181bf867c1256ffcd0212b9e411484c7327492ae1196a883419b6b205c717c79142ae02815a6d57f29d04767c05bbdfbf972436006d641cbac5a22620d6cb7d0c45da8498c7e612a7415b88716a63a0df052dc3b579ba243b2b0ae3689eb31122ef5c4dc8b52e4addf4cb75b854140b37f9cc86150b9d7ade74e6b6d61f040a3b2e690abf6cae537946579fd48539a51074d5ca6c870cef3f6becd01a0232927239f46385d5339eabb0ca5567a48f2ebb65b339ea9fc8baa92dab29f41317ffc2e73fc423e7a5352b1142cbb4e2f535e6d392c3c8229f6e25de5a3208785068e930ac855f771a0ce27cf56e80ba531a1d7edf5fd070c175d4ec16624d9f84edd91dfa047ac83917b4641bf1da3c827968eedc9d901b1d836901efb86d1a6b793a0575949c319604a3d2094d10065857931f38c21261c363b355623ac43dcefd29b157c86b631117e768db345ea5ec6239a8089a29d16c53bfca80cd12a07fed0c0adcf90a27a5a35df986d8a29568d9e48607f6ba172fa9ea05c5006f77a64c017498b0834f137ad13204570034db2299d3e53bd03c03df2f295e9eee4880c05542ec7b0a5af0b579957c0df98f31f6f7a7452aeb63ca6f9a235babc8b442a777d65c6e541aeee5915a085e3300e731924152f337bf581eda9ed62a8651a5246bff3476aa87886907b213a815e5def365be0134e931c03603839bc8f7d74db89e075289c067d9d64566651ea79c71d53a8e9170aea046b606eff36f0ceb46127138df068626a9e407b7b6e9976cbe28e9edcdba2fd2b468d24d111da68d9ca34ca230d82182803f23448148f403c2bce856a9417a9a90229c564fde9d240f6df3f93e74bc70d12955c28464ee6aece3144535ce1264bfe9bd14bb9c9fca5cfa2c82989951277f1236fe7c31062b4765d325baa92de76bce308358252ddbb1d76874687e03b65eab108aa1cff951f95fd57306a1f4b48f3bd07478d4acac9064e653e50dd019be98545599040fdcbf7a91446c6179e185bd6a7810de7d370b125ffb5c026fe612c155323eaaafbff6c5a941c990fda766b7c4e4823daa5888413d5a11870a2cc07be6dde9037d76f6092e51413d29892272f3f0805931bf9c34bc7a42c55843e561d749aba841f2213cf6040c97392584dfc251f9cf61e7c5a75986731d3139df96e5d7ab91d80997aa121c020158e308652b39b6ded888f1abcae25b2409a3a25496b8581a0b2fad685cc096ce9fd9f43a3b357ae18f49d416f889e9d1ffa87953bbc651cb92e811f0195554bafb249b2267a929307ed51861172afe161c3eff43371bb7b6db1a3deb8f711e825f600a1e75a157c470793f056aa26c00d99a67dd25674d2b7a058684fafe5aaf24ffc398ae1956088bb618b0ff39f4efb08d5c56ef7ecf1113486994f635372c4e73b531fab3c11cf320804c0895bcc3fbfe6cd04d30f28bbcec5f7ff872750cfad48c6a9f4289a1b7c01e7def8abf9558087eb3dd0c5ec36a18e12e861f7d8a74a062c000ad6431f9f7269d3c2a8aa72eb18e9c81e60a1fa530eb2b555acb6c5ef16fe32a81a0937925c235b16495c27932c94dcb80585e7b4a6e3c2a6c52f9d45069b9348a17550551321ea13bd71cf539bdfbf1f21f124e3d72be04c64409a4b4015b90cce408493f8b5e924a3d764d8b63be76f8e22d44418200b7c06c68b0ac519ba976ea44daea8831d4bdf5caf320995fe0fa16362f6d6c535a90607e75897414f1d0f3ece5d70fa3179387abc694120a871a5a6c23c32bebe6a9e322d71c4b9cea47a3fcfcc51fd2195eb33ae29d1ed5ccac73ba7eec8055bf1f37b1887b2a4d54c6159f285d5145d3dd805516a96cd0b03856898e774abfb24bfc2986ddc5e93bedeacc0a652b4119e211dd608771c7f23f5813e1f0bccfdef5cb785e857953811413a4683d82188576e1d5891f6d56c103851e1a7f2ee086f2a1cf5babb5cd3e5be98a1e078f2aa67d21bb4db9b230f2e0226957268e2822adc310427a09805dfbb1810a03d4cc4487d37543845ae7234c6ebc01e0e9ad7aa45b865945e08ef82dc7cab645ed5cf312f4761c6300e853f190e5647852d5026b8c8594e76ac4955bdb9580037464dd34726016fedd3feb53ac96c507c719086c4e82d051c679a3a05ac9314c343306d4cfff51c66f82a891fe7f173ab0af4327d1029afcab84771460f433bde1eb082b20014be0585fb4a1e18f94bed24c342e8ca554ea320afa1630d23f972839e9b73bacb6e334b557fafefe04640a1186411e504115c97c7bb35c4b34724cc5559bc9b766bb65c684839fd090b7ad7a9b0a83dcaa058a0c994ab54cee38ed1e7b4697f9d7ca6f82c98d1f43930f26153a13f7a65ba089b2ee67122c607db3ba52ad44f1d1d1168b66580b66b1e53f3a271fe42266b3678578c3efe7d1d4169b021066d4c92283bc1f408c3315147217c9460cc8c6861c45726b469646a696f400e98871cf52e35cc6b47e19c2f2c1892b214e1724184a7e0ccf5be5c64066696335e28c1e34103d6295dd9f1ac35cec03734d70aba362190982e6d9699f6c855d48e2c433245c8c7e8d5a9051a0013c8b7899959ac0055a30b88ec7569451e9efcbda434966e4b925547264955b831ee3ccda02c8f2801efcfbf7ebb324361360397bf0ed6feb8618ef7dcb27c4d80bd49d4d423290f8ba8c9a12c82de1fd81581b5faa8616e63a34efc433c428e89f6a67702ed79da39b60a45919a8ce403ff74bf1583ddd687be2367b042d1d4d92a01e2593774b24a79f7a0c6394440dc4b118f56d41d40a2898fde1fa5700c4ad9db3dfc2707eefc207f8da9a3a943f2884eb015a8278c71f3594d4adccc4dec991d3f9dafbc8d331587835782da7cf06010e96819b8f0f6dba7b8b6dd6bffdd10dcecc4bc20ec3085b3a6083d4f820400f07f959e3ac9bb60a9a784b41bc746ef0d9ce87bb9df8e1e85a22daa3d604de70fdd8a084680ff0addd4f43cf1dbd6a562e5eaaa50fe09869702db3a0c99e99e3a3cc2bd9388528b0eb7b0f1673c3893b314c06fd98f4629a89d3b17919afd026f4ae99329ae0ad5c6e19b777003e21afe4b0b484b821d04065b1f3dafc52c246961427020c530b866fa25d7da2efd671059c427df749d43f4e81bf8669d2932e69d59c5edd11a92b3f5a9d1b41ce98cf34f59f72cbd0a3634e4ac023341f3ff435ada78ceff1a95f273c6da950a9694c7c915cfb0c3ba58647c1351b708f2166e6c5dbac1254398953eef76d6cd1f625e5210d34f30478319a535d31fd5b0fe17493856e55bad258e77d75a8570fe9960bc0bfdffff20e215130bef1e8a08548895b8dda9efabf966673e5dd655f2fffbf050cc8ded60cbff9b315943587209038ba6ceec53d433e371f38770db5a20d212467df3b418ebb97c4d4ae830920c22e058f3b4a2572fff52a25517a463b48b09a396947e51165eb35705bd8ea1dfd7a37fa1b69714734b2ca575f5e0b469f10a8dd29822b40078e5b5581b3b6501ffd0689b2698d62c3ad09a9746e75b7306bbc182d47979e434df7787f18c326a42eef7bb65906058337820ee90bc3899764547545307b625da830e53bf990a0b54dd4cf3a53882debf15bee5259133f4f9c8a4d16d0b9f3b385b7733b6b21831f1b5272e14f2b9d762384aa6df69ae8b3b13713f44e17c2cb2371a819d78f84c497665338971f27a305fefd83c0a2425942544756bdc04337cbde919dac6b603e9640a08bd84c80783b6789c5820684ef5c747c6ba1cd988d9ecaf430974db4aa068b08147ae14c1933e3068112f1fa0a80a5b12d243c1dcd12dfce0b5658c73921611ea1693882eea52f049e0933304c4c14dd09fbf1dac752667b20ede7eefa5b4c7205aebadc3b729d71d9553cf1915c03f422a6cc27fca76e82c3243e9cabdf04fea30df4f40c6cf56e78bd4a630b64d36433d829467b453b5cfb4bde1a1fbb8b6681984c01d1f005be982bc011a6519042b68437b76c7db0d25834fc31991528d91a3889e5230e22d2c4fa03e0c804aac54eb1e29eebc0e3b7de8d368f2e6168c3f3f5f776ea07912b08c340cc0155f4516f744c957f743b1a7e02f209392f1e0069aaf759a716b33c0e6fa281556f93859380507e2adb98a9772081f7f982d1d2d22674167ffb14734b3070e3c06ab65b08067912ad59f2d4ef31a84a83561e805017e3c2743108bd235a8658764e2e29fd7765f88ca1cac33a1529c378f6a903a2474f2011d68aed88e69ff5101ec32bbd572d7673f0573bf4d275ff1f96eb3f3e4819bc1d16dcbffd195f875d46186e36982f5adf41ed413762cb37ed336eeedda52f5e0945ac8aab06826d3ac888a4f8bcd843802d5587724e7bd00eaceb42ac43e6fb6476172530ddec2cad552d4620b1c6cd231a86a1fb8820b81fb780611e44c775c66ddfdcc3a206ddf382d6adf47f68451f2aeccd14a973f609d6253eb4e7923896cb629d63813231a5b36c34d123aeaaef6e99fea72ff2b1aca7d274c4cf2dd6a1bf75f690120935b930a6d620f9e93f49f1a33e5acac5458b26cdfef2172e2c189c4776958183f18ce7ad654e206b1b9e42d296599ecab4eec6eeaa023a07ee23f43b904540aa192fed7314a56fdfccceeccacb84d6ab39fb9b26e7969e9346ba5", 0x1000) preadv(r0, &(0x7f0000001640)=[{&(0x7f00000002c0)}, {&(0x7f0000001440)=""/237, 0xed}, {&(0x7f0000000300)}, {&(0x7f00000013c0)=""/41, 0x29}, {&(0x7f0000001540)=""/151, 0x97}, {&(0x7f0000001600)=""/57, 0x39}], 0x6, 0x0) dup2(r1, r0) [ 560.126495] ucma_write: process 2709 (syz-executor3) changed security contexts after opening file descriptor, this is not allowed. [ 560.134079] binder_thread_write: 25 callbacks suppressed [ 560.134134] binder: 27422:27424 Acquire 1 refcount change on invalid ref 0 ret -22 [ 560.198597] overlayfs: failed to resolve './file1': -2 [ 560.206170] ntfs: (device loop5): ntfs_fill_super(): Unable to determine device size. [ 560.240443] binder: 27422:27437 Acquire 1 refcount change on invalid ref 0 ret -22 13:30:01 executing program 1: socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)) syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0xe1, 0x400100) creat(&(0x7f00000001c0)='./file0\x00', 0x2) openat$dsp(0xffffffffffffff9c, &(0x7f0000000200)='/dev/dsp\x00', 0x8000, 0x0) syz_open_dev$mouse(&(0x7f0000000240)='/dev/input/mouse#\x00', 0x100, 0x10000) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000007000)={0x8, 0x0, &(0x7f0000000140)=[@acquire], 0x0, 0x0, &(0x7f00000001c0)}) r2 = dup2(r1, r0) ioctl$BINDER_WRITE_READ(r2, 0x40046207, &(0x7f00000002c0)={0x8, 0x0, &(0x7f00000000c0)=[@release], 0x0, 0x0, &(0x7f0000000300)}) 13:30:01 executing program 3: setsockopt$inet_int(0xffffffffffffffff, 0x0, 0xc8, &(0x7f0000000100), 0x4) ioctl$EVIOCSKEYCODE_V2(0xffffffffffffffff, 0x40284504, &(0x7f0000000000)={0x0, 0x16, 0x9, 0x9, "a95beef511319c9873d741d214ff86bf10e62dd13eb1f0477d134ecb674be30a"}) r0 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vcs\x00', 0x40000, 0x0) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f00000000c0), &(0x7f0000000240)=0xc) ioctl$KVM_SET_GUEST_DEBUG(r0, 0x4048ae9b, &(0x7f00000001c0)={0x80000, 0x0, [0x5, 0x9, 0x0, 0x3, 0x80, 0x80000001, 0x80000000, 0xffff]}) r1 = syz_open_dev$vcsn(&(0x7f0000000140)='/dev/vcs#\x00', 0x8, 0x4000) ioctl$SIOCSIFMTU(r1, 0x8922, &(0x7f0000000300)={"45705f767469300000090e1800", 0x5}) setsockopt$inet_int(0xffffffffffffffff, 0x0, 0x40000000000c8, &(0x7f0000000080), 0x4) ioctl$EXT4_IOC_SETFLAGS(r0, 0x40086602, &(0x7f0000000280)=0x8000) 13:30:01 executing program 4: socketpair$inet6_icmp_raw(0xa, 0x3, 0x3a, &(0x7f0000000000)={0xffffffffffffffff}) flock(r0, 0x7) preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f00000000c0)=""/148, 0x94}], 0x1, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000080)='io\x00') preadv(r1, &(0x7f0000000480), 0x10000000000002a1, 0x0) 13:30:01 executing program 0: r0 = socket$inet(0x2, 0x4000000803, 0x4) bind$inet(r0, &(0x7f0000000000)={0x2, 0x0, @broadcast}, 0x10) getsockname(r0, &(0x7f00000036c0)=@xdp={0x2c, 0x0, 0x0}, &(0x7f0000000080)=0x80) setsockopt$inet_pktinfo(r0, 0x0, 0x8, &(0x7f0000003780)={r1, @rand_addr, @dev}, 0xc) syz_emit_ethernet(0x4a, &(0x7f0000000240)={@link_local, @empty=[0x0, 0x0, 0x8906], [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x3c, 0x0, 0x0, 0x0, 0x4, 0x0, @empty=0x9000000, @broadcast}, @udp={0x0, 0x0, 0x28}}}}}, &(0x7f0000000380)) [ 560.405500] binder: 27450:27452 Acquire 1 refcount change on invalid ref 0 ret -22 [ 560.500737] binder: 27450:27464 Acquire 1 refcount change on invalid ref 0 ret -22 13:30:02 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000007000)={0x8, 0x0, &(0x7f0000000140)=[@acquire], 0x0, 0x0, &(0x7f00000001c0)}) r2 = dup2(r1, r0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000002c0)={0x8, 0x0, &(0x7f00000000c0)=[@release], 0x1a0ffffffff, 0x0, &(0x7f0000000300)}) 13:30:02 executing program 5: syz_mount_image$btrfs(&(0x7f0000000140)='btrfs\x00', &(0x7f0000000180)='./file0\x00', 0x0, 0x0, &(0x7f00000007c0), 0x0, &(0x7f0000000380)=ANY=[]) syz_mount_image$ntfs(&(0x7f0000000200)='ntfs\x00', &(0x7f0000000080)='./file1\x00', 0x0, 0x30, &(0x7f0000000580), 0x0, &(0x7f0000000680)=ANY=[]) mount$overlay(0x404030, &(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f0000000100)={[{@upperdir={'upperdir', 0x3d, './file0'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@workdir={'workdir', 0x3d, './file1'}, 0x5c}]}) umount2(&(0x7f0000000040)='./file0\x00', 0xf4ffffff00000000) 13:30:02 executing program 3: socketpair$unix(0x1, 0x802, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = syz_open_dev$midi(&(0x7f0000000040)='/dev/midi#\x00', 0x1, 0x400) ioctl$TIOCGSID(r1, 0x5429, &(0x7f0000000080)) pipe2$9p(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) mount$9p_fd(0x0, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000000)='9p\x00', 0x0, &(0x7f0000000380)={'trans=fd,', {'rfdno', 0x3d, r2}, 0x2c, {'wfdno', 0x3d, r3}, 0x2c, {[{@access_uid={'access'}}]}}) 13:30:02 executing program 0: r0 = socket$inet(0x2, 0x4000000803, 0x4) bind$inet(r0, &(0x7f0000000000)={0x2, 0x0, @broadcast}, 0x10) getsockname(r0, &(0x7f00000036c0)=@xdp={0x2c, 0x0, 0x0}, &(0x7f0000000080)=0x80) setsockopt$inet_pktinfo(r0, 0x0, 0x8, &(0x7f0000003780)={r1, @rand_addr, @dev}, 0xc) syz_emit_ethernet(0x4a, &(0x7f0000000240)={@link_local, @empty=[0x0, 0x0, 0x8100000000000000], [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x3c, 0x0, 0x0, 0x0, 0x4, 0x0, @empty=0x9000000, @broadcast}, @udp={0x0, 0x0, 0x28}}}}}, &(0x7f0000000380)) 13:30:02 executing program 4: preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f00000000c0)=""/148, 0x94}], 0x1, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000080)='io\x00') preadv(r0, &(0x7f0000000040), 0x70, 0x0) getsockname(r0, &(0x7f00000001c0)=@xdp={0x2c, 0x0, 0x0}, &(0x7f0000000240)=0x80) lstat(&(0x7f0000000280)='./file0\x00', &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x0, 0x0}) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x11, &(0x7f0000000340)={{{@in6, @in6, 0x4e20, 0x6, 0x4e23, 0xc9760000, 0xa, 0x80, 0x20, 0xbb, r1, r2}, {0x2, 0x5, 0x8000, 0x3, 0x6, 0x5, 0xffff, 0x401}, {0x7fff, 0x1f, 0x0, 0xfffffffffffffeff}, 0x95, 0x6e6bbb, 0x0, 0x0, 0x2, 0x2}, {{@in6=@remote, 0x4d4, 0x3c}, 0xa, @in6=@mcast2, 0x3504, 0x0, 0x0, 0x0, 0x2, 0x7, 0x3e}}, 0xe8) 13:30:02 executing program 1: socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)) syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0xe1, 0x400100) creat(&(0x7f00000001c0)='./file0\x00', 0x2) openat$dsp(0xffffffffffffff9c, &(0x7f0000000200)='/dev/dsp\x00', 0x8000, 0x0) syz_open_dev$mouse(&(0x7f0000000240)='/dev/input/mouse#\x00', 0x100, 0x10000) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000007000)={0x8, 0x0, &(0x7f0000000140)=[@acquire], 0x0, 0x0, &(0x7f00000001c0)}) r2 = dup2(r1, r0) ioctl$BINDER_WRITE_READ(r2, 0xc020660b, &(0x7f00000002c0)={0x8, 0x0, &(0x7f00000000c0)=[@release], 0x0, 0x0, &(0x7f0000000300)}) 13:30:02 executing program 4: preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f00000000c0)=""/148, 0x94}], 0x1, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000080)='io\x00') bpf$BPF_GET_BTF_INFO(0xf, &(0x7f0000000040)={r0, 0x10, &(0x7f0000000000)={&(0x7f0000000180)=""/4096, 0x1000, 0x0}}, 0x10) bpf$BPF_BTF_GET_FD_BY_ID(0x13, &(0x7f0000001180)=r1, 0x4) preadv(r0, &(0x7f0000000480), 0x10000000000002a1, 0x0) 13:30:02 executing program 0: r0 = socket$inet(0x2, 0x4000000803, 0x4) bind$inet(r0, &(0x7f0000000000)={0x2, 0x0, @broadcast}, 0x10) getsockname(r0, &(0x7f00000036c0)=@xdp={0x2c, 0x0, 0x0}, &(0x7f0000000080)=0x80) setsockopt$inet_pktinfo(r0, 0x0, 0x8, &(0x7f0000003780)={r1, @rand_addr, @dev}, 0xc) syz_emit_ethernet(0x4a, &(0x7f0000000240)={@link_local, @empty=[0x0, 0x0, 0x3000000], [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x3c, 0x0, 0x0, 0x0, 0x4, 0x0, @empty=0x9000000, @broadcast}, @udp={0x0, 0x0, 0x28}}}}}, &(0x7f0000000380)) 13:30:02 executing program 3: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = memfd_create(&(0x7f00000001c0)='cgroup%!wlan0\x00', 0x1) accept4$inet(r1, &(0x7f0000000200), &(0x7f0000000240)=0x10, 0x80800) setsockopt$netlink_NETLINK_DROP_MEMBERSHIP(r0, 0x10e, 0x2, &(0x7f0000000100)=0x1f, 0x4) writev(r0, &(0x7f00000000c0)=[{&(0x7f0000000080)="390000001300090468feedffffbf6dff0600ff3f03000000450001070000001419001a000e00020001000a000200000800005d148399a7b338", 0x39}], 0x1) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000000280)={0x0, 0x0}, &(0x7f00000002c0)=0xc) fsetxattr$security_capability(r0, &(0x7f0000000340)='security.capability\x00', &(0x7f0000000300)=@v3={0x3000000, [{0x1ff, 0x4}, {0x1, 0x1000}], r2}, 0x18, 0x0) r3 = openat$vhci(0xffffffffffffff9c, &(0x7f0000000140)='/dev/vhci\x00', 0x109000, 0x0) setsockopt$inet6_tcp_TCP_FASTOPEN_KEY(r3, 0x6, 0x21, &(0x7f0000000180)="8c77a07e6d56c2abc67c490b6eb7060b", 0x10) [ 561.035940] binder: 27481:27483 Acquire 1 refcount change on invalid ref 0 ret -22 [ 561.072476] ntfs: (device loop5): ntfs_fill_super(): Unable to determine device size. [ 561.117607] binder: 27481:27494 Acquire 1 refcount change on invalid ref 0 ret -22 13:30:02 executing program 1: socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)) syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0xe1, 0x400100) creat(&(0x7f00000001c0)='./file0\x00', 0x2) openat$dsp(0xffffffffffffff9c, &(0x7f0000000200)='/dev/dsp\x00', 0x8000, 0x0) syz_open_dev$mouse(&(0x7f0000000240)='/dev/input/mouse#\x00', 0x100, 0x10000) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000007000)={0x8, 0x0, &(0x7f0000000140)=[@acquire], 0x0, 0x0, &(0x7f00000001c0)}) r2 = dup2(r1, r0) ioctl$BINDER_WRITE_READ(r2, 0xc0046209, &(0x7f00000002c0)={0x8, 0x0, &(0x7f00000000c0)=[@release], 0x0, 0x0, &(0x7f0000000300)}) 13:30:02 executing program 4: r0 = dup(0xffffffffffffff9c) ioctl$BLKTRACESTOP(r0, 0x1275, 0x0) preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f00000000c0)=""/148, 0x94}], 0x1, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000080)='io\x00') preadv(r1, &(0x7f0000000480), 0x10000000000002a1, 0x0) [ 561.211750] netlink: 10 bytes leftover after parsing attributes in process `syz-executor3'. [ 561.244376] netlink: 10 bytes leftover after parsing attributes in process `syz-executor3'. 13:30:02 executing program 0: r0 = socket$inet(0x2, 0x4000000803, 0x4) bind$inet(r0, &(0x7f0000000000)={0x2, 0x0, @broadcast}, 0x10) getsockname(r0, &(0x7f00000036c0)=@xdp={0x2c, 0x0, 0x0}, &(0x7f0000000080)=0x80) setsockopt$inet_pktinfo(r0, 0x0, 0x8, &(0x7f0000003780)={r1, @rand_addr, @dev}, 0xc) syz_emit_ethernet(0x4a, &(0x7f0000000240)={@link_local, @empty=[0x0, 0x0, 0x100000000000000], [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x3c, 0x0, 0x0, 0x0, 0x4, 0x0, @empty=0x9000000, @broadcast}, @udp={0x0, 0x0, 0x28}}}}}, &(0x7f0000000380)) [ 561.280991] netlink: 10 bytes leftover after parsing attributes in process `syz-executor3'. [ 561.305718] binder: 27508:27509 Acquire 1 refcount change on invalid ref 0 ret -22 [ 561.314368] netlink: 10 bytes leftover after parsing attributes in process `syz-executor3'. [ 561.362251] binder: 27508:27520 Acquire 1 refcount change on invalid ref 0 ret -22 13:30:03 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000007000)={0x8, 0x0, &(0x7f0000000140)=[@acquire], 0x0, 0x0, &(0x7f00000001c0)}) r2 = dup2(r1, r0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000002c0)={0x8, 0x0, &(0x7f00000000c0)=[@release], 0x1000000, 0x0, &(0x7f0000000300)}) 13:30:03 executing program 5: syz_mount_image$btrfs(&(0x7f0000000140)='btrfs\x00', &(0x7f0000000180)='./file0\x00', 0x0, 0x0, &(0x7f00000007c0), 0x0, &(0x7f0000000380)=ANY=[]) syz_mount_image$ntfs(&(0x7f0000000200)='ntfs\x00', &(0x7f0000000080)='./file1\x00', 0x0, 0x30, &(0x7f0000000580), 0x0, &(0x7f0000000680)=ANY=[]) mount$overlay(0x404030, &(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f0000000100)={[{@upperdir={'upperdir', 0x3d, './file0'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@workdir={'workdir', 0x3d, './file1'}, 0x5c}]}) umount2(&(0x7f0000000040)='./file0\x00', 0x100100) 13:30:03 executing program 3: r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x12, 0x8, &(0x7f0000000140)=ANY=[@ANYBLOB="7a0af8ff00000000bfa1000000000000070162bf77d6ffffb702000008000000bd000006000000b7000000000000009500000000000000000000000000000000"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, [], 0x0, 0xa}, 0x48) r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000080)='./cgroup\x00syz1\x00', 0x200002, 0x0) bpf$BPF_PROG_ATTACH(0x8, &(0x7f00000000c0)={r1, r0, 0xa}, 0x10) bpf$BPF_PROG_ATTACH(0x9, &(0x7f0000000640)={r1, 0xffffffffffffffff, 0xa}, 0x10) 13:30:03 executing program 0: r0 = socket$inet(0x2, 0x4000000803, 0x4) bind$inet(r0, &(0x7f0000000000)={0x2, 0x0, @broadcast}, 0x10) getsockname(r0, &(0x7f00000036c0)=@xdp={0x2c, 0x0, 0x0}, &(0x7f0000000080)=0x80) setsockopt$inet_pktinfo(r0, 0x0, 0x8, &(0x7f0000003780)={r1, @rand_addr, @dev}, 0xc) syz_emit_ethernet(0x4a, &(0x7f0000000240)={@link_local, @empty=[0x0, 0x0, 0x34000], [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x3c, 0x0, 0x0, 0x0, 0x4, 0x0, @empty=0x9000000, @broadcast}, @udp={0x0, 0x0, 0x28}}}}}, &(0x7f0000000380)) 13:30:03 executing program 4: preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f00000000c0)=""/148, 0x94}], 0x1, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000080)='io\x00') ioctl$EXT4_IOC_GROUP_ADD(r0, 0x40286608, &(0x7f0000000000)={0x3, 0xfff, 0x800, 0x3, 0x6, 0x8}) preadv(r0, &(0x7f0000000480), 0x10000000000002a1, 0x0) 13:30:03 executing program 1: socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)) syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0xe1, 0x400100) creat(&(0x7f00000001c0)='./file0\x00', 0x2) openat$dsp(0xffffffffffffff9c, &(0x7f0000000200)='/dev/dsp\x00', 0x8000, 0x0) syz_open_dev$mouse(&(0x7f0000000240)='/dev/input/mouse#\x00', 0x100, 0x10000) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000007000)={0x8, 0x0, &(0x7f0000000140)=[@acquire], 0x0, 0x0, &(0x7f00000001c0)}) r2 = dup2(r1, r0) ioctl$BINDER_WRITE_READ(r2, 0xc0045878, &(0x7f00000002c0)={0x8, 0x0, &(0x7f00000000c0)=[@release], 0x0, 0x0, &(0x7f0000000300)}) [ 561.851276] binder: 27533:27541 Acquire 1 refcount change on invalid ref 0 ret -22 13:30:03 executing program 3: r0 = socket(0x10, 0x803, 0x0) sendto(r0, &(0x7f0000000000)="120000001600e70d017b00000000000000a1", 0x12, 0x0, 0x0, 0x0) getsockname(r0, &(0x7f0000000040)=@can, &(0x7f0000000100)=0x51443a30f3b09aaa) recvmmsg(r0, &(0x7f0000003a40)=[{{&(0x7f00000003c0)=@pppol2tpv3in6, 0x80, &(0x7f0000000480), 0x0, &(0x7f00000004c0)=""/4096, 0x1000}}], 0x1, 0x0, &(0x7f0000003bc0)={0x77359400}) 13:30:03 executing program 4: preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f00000000c0)=""/148, 0x94}], 0x1, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000080)='io\x00') socket$netlink(0x10, 0x3, 0x6) preadv(r0, &(0x7f0000000480), 0x10000000000002a1, 0x0) 13:30:03 executing program 0: r0 = socket$inet(0x2, 0x4000000803, 0x4) bind$inet(r0, &(0x7f0000000000)={0x2, 0x0, @broadcast}, 0x10) getsockname(r0, &(0x7f00000036c0)=@xdp={0x2c, 0x0, 0x0}, &(0x7f0000000080)=0x80) setsockopt$inet_pktinfo(r0, 0x0, 0x8, &(0x7f0000003780)={r1, @rand_addr, @dev}, 0xc) syz_emit_ethernet(0x4a, &(0x7f0000000240)={@link_local, @empty=[0x0, 0x0, 0x6], [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x3c, 0x0, 0x0, 0x0, 0x4, 0x0, @empty=0x9000000, @broadcast}, @udp={0x0, 0x0, 0x28}}}}}, &(0x7f0000000380)) [ 561.897919] ntfs: (device loop5): ntfs_fill_super(): Unable to determine device size. [ 561.901150] binder: 27533:27553 Acquire 1 refcount change on invalid ref 0 ret -22 13:30:03 executing program 1: socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)) syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0xe1, 0x400100) creat(&(0x7f00000001c0)='./file0\x00', 0x2) openat$dsp(0xffffffffffffff9c, &(0x7f0000000200)='/dev/dsp\x00', 0x8000, 0x0) syz_open_dev$mouse(&(0x7f0000000240)='/dev/input/mouse#\x00', 0x100, 0x10000) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000007000)={0x8, 0x0, &(0x7f0000000140)=[@acquire], 0x0, 0x0, &(0x7f00000001c0)}) r2 = dup2(r1, r0) ioctl$BINDER_WRITE_READ(r2, 0x5451, &(0x7f00000002c0)={0x8, 0x0, &(0x7f00000000c0)=[@release], 0x0, 0x0, &(0x7f0000000300)}) 13:30:03 executing program 4: preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f00000000c0)=""/148, 0x94}], 0x1, 0x0) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffff9c, 0x0, 0x17, &(0x7f0000000040)='user(ppp0-$)em1]md5sum\x00'}, 0x30) r1 = syz_open_procfs(r0, &(0x7f00000001c0)='net/icmp6\x00') preadv(r1, &(0x7f0000000480), 0x10000000000002a1, 0x0) 13:30:03 executing program 3: openat$autofs(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/autofs\x00', 0x400100, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000140)={&(0x7f0000000100)={0x10, 0xffffff9e}, 0xc, &(0x7f00000001c0)={&(0x7f0000000180)=@ipv6_newroute={0x30, 0x18, 0xe0b, 0x0, 0x0, {0xa, 0x0, 0x0, 0x0, 0xc0fe}, [@RTA_GATEWAY={0x14, 0x5, @loopback}]}, 0x30}}, 0x0) add_key$keyring(&(0x7f0000000240)='keyring\x00', &(0x7f0000000280)={'syz', 0x1}, 0x0, 0x0, 0xfffffffffffffff9) r1 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000000)='/dev/sequencer\x00', 0x0, 0x0) ioctl$KVM_RUN(r1, 0xae80, 0x0) r2 = add_key$user(&(0x7f0000000340)='user\x00', &(0x7f0000000040)={'syz', 0x1}, &(0x7f0000000080)="fdb2a43682932606907843e90b0f089bad9cd449f0418b", 0x17, 0xfffffffffffffff8) r3 = add_key$keyring(&(0x7f00000000c0)='keyring\x00', &(0x7f0000000200)={'syz', 0x0}, 0x0, 0x0, 0xfffffffffffffffe) keyctl$negate(0xd, r2, 0x6, r3) [ 562.065750] overlayfs: filesystem on './file0' not supported as upperdir 13:30:03 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000007000)={0x8, 0x0, &(0x7f0000000140)=[@acquire], 0x0, 0x0, &(0x7f00000001c0)}) r2 = dup2(r1, r0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000002c0)={0x8, 0x0, &(0x7f00000000c0)=[@release], 0x3f000000, 0x0, &(0x7f0000000300)}) 13:30:03 executing program 0: r0 = socket$inet(0x2, 0x4000000803, 0x4) bind$inet(r0, &(0x7f0000000000)={0x2, 0x0, @broadcast}, 0x10) getsockname(r0, &(0x7f00000036c0)=@xdp={0x2c, 0x0, 0x0}, &(0x7f0000000080)=0x80) setsockopt$inet_pktinfo(r0, 0x0, 0x8, &(0x7f0000003780)={r1, @rand_addr, @dev}, 0xc) syz_emit_ethernet(0x4a, &(0x7f0000000240)={@link_local, @empty=[0x0, 0x0, 0x28000000], [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x3c, 0x0, 0x0, 0x0, 0x4, 0x0, @empty=0x9000000, @broadcast}, @udp={0x0, 0x0, 0x28}}}}}, &(0x7f0000000380)) 13:30:03 executing program 5: syz_mount_image$btrfs(&(0x7f0000000140)='btrfs\x00', &(0x7f0000000180)='./file0\x00', 0x0, 0x0, &(0x7f00000007c0), 0x0, &(0x7f0000000380)=ANY=[]) syz_mount_image$ntfs(&(0x7f0000000200)='ntfs\x00', &(0x7f0000000080)='./file1\x00', 0x0, 0x30, &(0x7f0000000580), 0x0, &(0x7f0000000680)=ANY=[]) mount$overlay(0x404030, &(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f0000000100)={[{@upperdir={'upperdir', 0x3d, './file0'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@workdir={'workdir', 0x3d, './file1'}, 0x5c}]}) umount2(&(0x7f0000000040)='./file0\x00', 0x3f000000) 13:30:03 executing program 1: socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)) syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0xe1, 0x400100) creat(&(0x7f00000001c0)='./file0\x00', 0x2) openat$dsp(0xffffffffffffff9c, &(0x7f0000000200)='/dev/dsp\x00', 0x8000, 0x0) syz_open_dev$mouse(&(0x7f0000000240)='/dev/input/mouse#\x00', 0x100, 0x10000) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000007000)={0x8, 0x0, &(0x7f0000000140)=[@acquire], 0x0, 0x0, &(0x7f00000001c0)}) r2 = dup2(r1, r0) ioctl$BINDER_WRITE_READ(r2, 0x4020940d, &(0x7f00000002c0)={0x8, 0x0, &(0x7f00000000c0)=[@release], 0x0, 0x0, &(0x7f0000000300)}) 13:30:03 executing program 4: preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f00000000c0)=""/148, 0x94}], 0x1, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000080)='io\x00') preadv(r0, &(0x7f0000000580)=[{&(0x7f0000000180)=""/213, 0xd5}, {0xfffffffffffffffd}, {&(0x7f0000000280)=""/178, 0xb2}, {&(0x7f0000000000)=""/108, 0x6c}, {&(0x7f0000000340)=""/128, 0x80}, {&(0x7f00000003c0)=""/5, 0x5}, {&(0x7f0000000400)=""/57, 0x39}, {&(0x7f0000000440)=""/51, 0x33}, {&(0x7f0000000480)=""/139, 0x8b}, {&(0x7f0000000540)=""/64, 0x40}], 0xa, 0x3) 13:30:03 executing program 3: r0 = socket$inet(0x2, 0x4000000803, 0x4) bind$inet(r0, &(0x7f0000000000)={0x2, 0x0, @broadcast}, 0x10) getsockname(r0, &(0x7f00000036c0)=@xdp={0x2c, 0x0, 0x0}, &(0x7f0000000080)=0x80) setsockopt$inet_pktinfo(r0, 0x0, 0x8, &(0x7f0000003780)={r1, @rand_addr, @dev}, 0xc) syz_emit_ethernet(0x4a, &(0x7f0000000240)={@link_local, @empty=[0x0, 0x0, 0x6], [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x3c, 0x0, 0x0, 0x0, 0x4, 0x0, @empty=0x9000000, @broadcast}, @udp={0x0, 0x0, 0x28}}}}}, &(0x7f0000000380)) 13:30:04 executing program 3: r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000100)="2e2f6367726f75702e6370752f008ff9bf809e961d36f4c738142db50b39ca1bc4c08c901336f2225a69b44ba5937e519d0c840ec9b0476223e56d2316121e319d", 0x200002, 0x0) arch_prctl(0x1004, &(0x7f0000000000)) r1 = socket$inet6(0xa, 0x6, 0x800000000000004) ioctl(r1, 0x8912, &(0x7f0000000280)="153f6234488dd25d5c6070") r2 = dup(r1) ioctl$SNDRV_SEQ_IOCTL_RUNNING_MODE(r2, 0xc0105303, &(0x7f0000000000)={0x7, 0x7fffffff}) r3 = openat$cgroup_procs(r0, &(0x7f0000000080)='cgroup.procs\x00', 0x2, 0x0) write$cgroup_pid(r3, &(0x7f00000001c0), 0xb) 13:30:04 executing program 4: preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f00000000c0)=""/148, 0x94}], 0x1, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000080)='io\x00') preadv(r0, &(0x7f0000000480), 0x0, 0x0) [ 562.786135] ntfs: (device loop5): ntfs_fill_super(): Unable to determine device size. 13:30:04 executing program 0: r0 = socket$inet(0x2, 0x4000000803, 0x4) bind$inet(r0, &(0x7f0000000000)={0x2, 0x0, @broadcast}, 0x10) getsockname(r0, &(0x7f00000036c0)=@xdp={0x2c, 0x0, 0x0}, &(0x7f0000000080)=0x80) setsockopt$inet_pktinfo(r0, 0x0, 0x8, &(0x7f0000003780)={r1, @rand_addr, @dev}, 0xc) syz_emit_ethernet(0x4a, &(0x7f0000000240)={@link_local, @empty=[0x0, 0x0, 0xffffca88], [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x3c, 0x0, 0x0, 0x0, 0x4, 0x0, @empty=0x9000000, @broadcast}, @udp={0x0, 0x0, 0x28}}}}}, &(0x7f0000000380)) 13:30:04 executing program 1: socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)) syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0xe1, 0x400100) creat(&(0x7f00000001c0)='./file0\x00', 0x2) openat$dsp(0xffffffffffffff9c, &(0x7f0000000200)='/dev/dsp\x00', 0x8000, 0x0) syz_open_dev$mouse(&(0x7f0000000240)='/dev/input/mouse#\x00', 0x100, 0x10000) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000007000)={0x8, 0x0, &(0x7f0000000140)=[@acquire], 0x0, 0x0, &(0x7f00000001c0)}) r2 = dup2(r1, r0) ioctl$BINDER_WRITE_READ(r2, 0xc018620b, &(0x7f00000002c0)={0x8, 0x0, &(0x7f00000000c0)=[@release], 0x0, 0x0, &(0x7f0000000300)}) [ 562.918068] overlayfs: filesystem on './file0' not supported as upperdir [ 562.935493] ntfs: (device loop5): ntfs_fill_super(): Unable to determine device size. 13:30:04 executing program 3: r0 = socket$inet6_sctp(0xa, 0x200000005, 0x84) setsockopt$inet_sctp6_SCTP_EVENTS(r0, 0x84, 0xb, &(0x7f0000000500)={0x0, 0x0, 0x0, 0x405}, 0xb) socketpair$unix(0x1, 0x3, 0x0, &(0x7f00000001c0)) r1 = syz_open_dev$sndpcmc(&(0x7f0000000000)='/dev/snd/pcmC#D#c\x00', 0xffffffffffff32ad, 0x100) getsockopt$inet_sctp_SCTP_FRAGMENT_INTERLEAVE(r1, 0x84, 0x12, &(0x7f0000000400), &(0x7f0000000440)) r2 = syz_open_dev$dmmidi(&(0x7f00000000c0)='/dev/dmmidi#\x00', 0x81, 0x200) r3 = perf_event_open$cgroup(&(0x7f0000000200)={0x0, 0x70, 0x2, 0x3ff, 0x401, 0x200, 0x0, 0x2, 0x0, 0xa, 0x2, 0x0, 0xe0, 0x0, 0x81, 0x9, 0x200, 0x10000, 0x1, 0x0, 0x80000000, 0xbbc6, 0x5e0a, 0x0, 0x7, 0x3d8, 0x9, 0x9, 0x8, 0x225f76d5, 0x401, 0xfff, 0x4, 0x9, 0x4, 0x9, 0x2, 0x1, 0x0, 0x5, 0x2, @perf_config_ext={0x100000001, 0x7fffffff}, 0x20000, 0xffff, 0x1, 0x5, 0x9, 0x5, 0xffff}, 0xffffffffffffffff, 0xa, 0xffffffffffffff9c, 0x3) openat$hwrng(0xffffffffffffff9c, &(0x7f0000000100)='/dev/hwrng\x00', 0x200, 0x0) fsync(r0) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x5) syz_read_part_table(0x700000000000000, 0x1, &(0x7f0000000080)=[{&(0x7f0000010000)="000000000000000000000000000000000000000000000000ed793afe00000000020082012600010000006400000000012700fd030c00650000006400000000030d0085043100c90000006400000000043200052020002d010000d306000055aa", 0x60, 0x1a0}]) sendto$inet6(r0, &(0x7f0000000180)='F', 0x1, 0x0, &(0x7f0000000040)={0xa, 0x0, 0x0, @loopback}, 0xffffffffffffff15) epoll_pwait(r2, &(0x7f00000002c0)=[{}, {}, {}, {}], 0x4, 0x8, &(0x7f0000000300)={0x5}, 0x8) recvfrom$llc(r0, &(0x7f0000000140)=""/10, 0xa, 0x0, &(0x7f00000001c0)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @link_local}, 0x705000) 13:30:04 executing program 5: syz_mount_image$btrfs(&(0x7f0000000140)='btrfs\x00', &(0x7f0000000180)='./file0\x00', 0x0, 0x0, &(0x7f00000007c0), 0x0, &(0x7f0000000380)=ANY=[]) syz_mount_image$ntfs(&(0x7f0000000200)='ntfs\x00', &(0x7f0000000080)='./file1\x00', 0x0, 0x30, &(0x7f0000000580), 0x0, &(0x7f0000000680)=ANY=[]) mount$overlay(0x404030, &(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f0000000100)={[{@upperdir={'upperdir', 0x3d, './file0'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@workdir={'workdir', 0x3d, './file1'}, 0x5c}]}) umount2(&(0x7f0000000040)='./file0\x00', 0xfbffffff) [ 563.135710] loop3: p1 p2 p3 < > p4 < > [ 563.190586] ntfs: (device loop5): ntfs_fill_super(): Unable to determine device size. [ 563.316944] overlayfs: filesystem on './file0' not supported as upperdir 13:30:04 executing program 4: r0 = userfaultfd(0x80800) preadv(r0, &(0x7f0000000000)=[{&(0x7f00000000c0)=""/148, 0xfffffffffffffdfa}], 0x10000000000002c2, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000080)='io\x00') preadv(r1, &(0x7f0000000480), 0x10000000000002a1, 0x0) 13:30:04 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000007000)={0x8, 0x0, &(0x7f0000000140)=[@acquire], 0x0, 0x0, &(0x7f00000001c0)}) r2 = dup2(r1, r0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000002c0)={0x8, 0x0, &(0x7f00000000c0)=[@release], 0xfdfdffff, 0x0, &(0x7f0000000300)}) 13:30:04 executing program 0: r0 = socket$inet(0x2, 0x4000000803, 0x4) bind$inet(r0, &(0x7f0000000000)={0x2, 0x0, @broadcast}, 0x10) getsockname(r0, &(0x7f00000036c0)=@xdp={0x2c, 0x0, 0x0}, &(0x7f0000000080)=0x80) setsockopt$inet_pktinfo(r0, 0x0, 0x8, &(0x7f0000003780)={r1, @rand_addr, @dev}, 0xc) syz_emit_ethernet(0x4a, &(0x7f0000000240)={@link_local, @empty=[0x0, 0x0, 0x43050000], [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x3c, 0x0, 0x0, 0x0, 0x4, 0x0, @empty=0x9000000, @broadcast}, @udp={0x0, 0x0, 0x28}}}}}, &(0x7f0000000380)) 13:30:04 executing program 1: socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)) syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0xe1, 0x400100) creat(&(0x7f00000001c0)='./file0\x00', 0x2) openat$dsp(0xffffffffffffff9c, &(0x7f0000000200)='/dev/dsp\x00', 0x8000, 0x0) syz_open_dev$mouse(&(0x7f0000000240)='/dev/input/mouse#\x00', 0x100, 0x10000) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000007000)={0x8, 0x0, &(0x7f0000000140)=[@acquire], 0x0, 0x0, &(0x7f00000001c0)}) r2 = dup2(r1, r0) ioctl$BINDER_WRITE_READ(r2, 0x5450, &(0x7f00000002c0)={0x8, 0x0, &(0x7f00000000c0)=[@release], 0x0, 0x0, &(0x7f0000000300)}) 13:30:04 executing program 3: r0 = syz_open_dev$adsp(&(0x7f0000000000)='/dev/adsp#\x00', 0x0, 0x8000) write$FUSE_NOTIFY_INVAL_ENTRY(r0, &(0x7f0000000040)={0x25, 0x3, 0x0, {0x3, 0x4, 0x0, '[em0'}}, 0x25) r1 = openat$md(0xffffffffffffff9c, &(0x7f0000000080)='/dev/md0\x00', 0x0, 0x0) ioctl$IOC_PR_PREEMPT(r1, 0x1268, &(0x7f00000000c0)) 13:30:04 executing program 5: syz_mount_image$btrfs(&(0x7f0000000140)='btrfs\x00', &(0x7f0000000180)='./file0\x00', 0x0, 0x0, &(0x7f00000007c0), 0x0, &(0x7f0000000380)=ANY=[]) syz_mount_image$ntfs(&(0x7f0000000200)='ntfs\x00', &(0x7f0000000080)='./file1\x00', 0x0, 0x30, &(0x7f0000000580), 0x0, &(0x7f0000000680)=ANY=[]) mount$overlay(0x404030, &(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f0000000100)={[{@upperdir={'upperdir', 0x3d, './file0'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@workdir={'workdir', 0x3d, './file1'}, 0x5c}]}) umount2(&(0x7f0000000040)='./file0\x00', 0xfff0) 13:30:05 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000007000)={0x8, 0x0, &(0x7f0000000140)=[@acquire], 0x0, 0x0, &(0x7f00000001c0)}) r2 = dup2(r1, r0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000002c0)={0x8, 0x0, &(0x7f00000000c0)=[@release], 0x3f000000, 0x0, &(0x7f0000000300)}) 13:30:05 executing program 0: r0 = socket$inet(0x2, 0x4000000803, 0x4) bind$inet(r0, &(0x7f0000000000)={0x2, 0x0, @broadcast}, 0x10) getsockname(r0, &(0x7f00000036c0)=@xdp={0x2c, 0x0, 0x0}, &(0x7f0000000080)=0x80) setsockopt$inet_pktinfo(r0, 0x0, 0x8, &(0x7f0000003780)={r1, @rand_addr, @dev}, 0xc) syz_emit_ethernet(0x4a, &(0x7f0000000240)={@link_local, @empty=[0x0, 0x0, 0x8035000000000000], [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x3c, 0x0, 0x0, 0x0, 0x4, 0x0, @empty=0x9000000, @broadcast}, @udp={0x0, 0x0, 0x28}}}}}, &(0x7f0000000380)) 13:30:05 executing program 4: r0 = syz_open_dev$rtc(&(0x7f0000000000)='/dev/rtc#\x00', 0x63c, 0x14040) r1 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000340)='/dev/sequencer2\x00', 0x44000, 0x0) ioctl$TIOCSWINSZ(r1, 0x5414, &(0x7f0000000380)={0x77e5d6c4, 0xffffffffffffffff, 0x3, 0x4}) getsockopt$sock_cred(0xffffffffffffff9c, 0x1, 0x11, &(0x7f00000000c0), &(0x7f0000000100)=0xc) r2 = fcntl$getown(r0, 0x9) r3 = syz_open_procfs(r2, &(0x7f0000000240)="6e971fa07e3e48e7") ioctl$TCSETA(r3, 0x5406, &(0x7f0000000040)={0x9, 0x3, 0x200, 0x828, 0xff, 0x7f, 0x4, 0x5, 0x5, 0x2}) getsockopt$inet_sctp6_SCTP_GET_PEER_ADDRS(r3, 0x84, 0x6c, &(0x7f0000000140)={0x0, 0xea, "1deae02d7dacad74596f1515937c958817ff10f9fcc1d99dc7aa4400c868601db0ff77a25ea1b18a67e951f15714b316b54fc23286921301ed042a4e6d88b1ca161a2d8fd80dca353110195e8dfab364758aaaacba96316083e4796d981f477ea6953ab7f64cb34cc231ebcdc53632c69ae25a12dc0cab51bf587745a7895d93f82982415ebb980303795fb34ad7cc62d21337bf5bada571c27aacc0af1d768eb07f546721669c78413ba6b914c6f6cd90fdf3262444215daccc08e4bd5b3d94831947ab1a90abc21c3c1f7d8572fe5d3438f7c78e81834b76357a509be5622df0eadd4592252dbb658e"}, &(0x7f0000000080)=0xf2) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r0, 0x84, 0x6f, &(0x7f00000002c0)={r4, 0x1c, &(0x7f0000000280)=[@in6={0xa, 0x4e20, 0x8, @ipv4, 0xfffffffffffffc01}]}, &(0x7f0000000300)=0x10) preadv(r3, &(0x7f0000000480), 0x10000000000002a1, 0x0) [ 563.679779] ntfs: (device loop5): ntfs_fill_super(): Unable to determine device size. 13:30:05 executing program 1: socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)) syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0xe1, 0x400100) creat(&(0x7f00000001c0)='./file0\x00', 0x2) openat$dsp(0xffffffffffffff9c, &(0x7f0000000200)='/dev/dsp\x00', 0x8000, 0x0) syz_open_dev$mouse(&(0x7f0000000240)='/dev/input/mouse#\x00', 0x100, 0x10000) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000007000)={0x8, 0x0, &(0x7f0000000140)=[@acquire], 0x0, 0x0, &(0x7f00000001c0)}) r2 = dup2(r1, r0) ioctl$BINDER_WRITE_READ(r2, 0x5460, &(0x7f00000002c0)={0x8, 0x0, &(0x7f00000000c0)=[@release], 0x0, 0x0, &(0x7f0000000300)}) [ 563.786107] overlayfs: filesystem on './file0' not supported as upperdir [ 563.803949] ntfs: (device loop5): ntfs_fill_super(): Unable to determine device size. 13:30:05 executing program 0: r0 = socket$inet(0x2, 0x4000000803, 0x4) bind$inet(r0, &(0x7f0000000000)={0x2, 0x0, @broadcast}, 0x10) getsockname(r0, &(0x7f00000036c0)=@xdp={0x2c, 0x0, 0x0}, &(0x7f0000000080)=0x80) setsockopt$inet_pktinfo(r0, 0x0, 0x8, &(0x7f0000003780)={r1, @rand_addr, @dev}, 0xc) syz_emit_ethernet(0x4a, &(0x7f0000000240)={@link_local, @empty=[0x0, 0x0, 0x2800], [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x3c, 0x0, 0x0, 0x0, 0x4, 0x0, @empty=0x9000000, @broadcast}, @udp={0x0, 0x0, 0x28}}}}}, &(0x7f0000000380)) 13:30:05 executing program 4: preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f00000000c0)=""/148, 0x94}], 0x1, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000080)='io\x00') getsockopt$IPT_SO_GET_ENTRIES(r0, 0x0, 0x41, &(0x7f0000000180)={'nat\x00', 0x91, "168310ce72cd66bcd5db5c72ab1408b6534dd9709a4a843b33830146d65c65a981ea0b3ff412d0145688ee7880227e38152c3856a6721f29f6fb1245177a9fb18406de3e697ec5240b65fb2a54510b2505db9de9a32648790fb2da337b9d0bf4ba966e78bdcd6aa4e8f579bb6bf5d0df847886cbdc692ce5359d8be7c4bd87c9d49a89eb3c217f33224b7d465a3d5ce938"}, &(0x7f0000000000)=0xb5) preadv(r0, &(0x7f0000000480), 0x10000000000002a1, 0x0) ioctl$BLKIOMIN(r0, 0x1278, &(0x7f0000000040)) 13:30:05 executing program 1: socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)) syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0xe1, 0x400100) creat(&(0x7f00000001c0)='./file0\x00', 0x2) openat$dsp(0xffffffffffffff9c, &(0x7f0000000200)='/dev/dsp\x00', 0x8000, 0x0) syz_open_dev$mouse(&(0x7f0000000240)='/dev/input/mouse#\x00', 0x100, 0x10000) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000007000)={0x8, 0x0, &(0x7f0000000140)=[@acquire], 0x0, 0x0, &(0x7f00000001c0)}) r2 = dup2(r1, r0) ioctl$BINDER_WRITE_READ(r2, 0x5452, &(0x7f00000002c0)={0x8, 0x0, &(0x7f00000000c0)=[@release], 0x0, 0x0, &(0x7f0000000300)}) 13:30:05 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000007000)={0x8, 0x0, &(0x7f0000000140)=[@acquire], 0x0, 0x0, &(0x7f00000001c0)}) r2 = dup2(r1, r0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000002c0)={0x8, 0x0, &(0x7f00000000c0)=[@release], 0xffffffffa0010000, 0x0, &(0x7f0000000300)}) 13:30:05 executing program 5: syz_mount_image$btrfs(&(0x7f0000000140)='btrfs\x00', &(0x7f0000000180)='./file0\x00', 0x0, 0x0, &(0x7f00000007c0), 0x0, &(0x7f0000000380)=ANY=[]) syz_mount_image$ntfs(&(0x7f0000000200)='ntfs\x00', &(0x7f0000000080)='./file1\x00', 0x0, 0x30, &(0x7f0000000580), 0x0, &(0x7f0000000680)=ANY=[]) mount$overlay(0x404030, &(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f0000000100)={[{@upperdir={'upperdir', 0x3d, './file0'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@workdir={'workdir', 0x3d, './file1'}, 0x5c}]}) umount2(&(0x7f0000000040)='./file0\x00', 0x17) 13:30:05 executing program 0: r0 = socket$inet(0x2, 0x4000000803, 0x4) bind$inet(r0, &(0x7f0000000000)={0x2, 0x0, @broadcast}, 0x10) getsockname(r0, &(0x7f00000036c0)=@xdp={0x2c, 0x0, 0x0}, &(0x7f0000000080)=0x80) setsockopt$inet_pktinfo(r0, 0x0, 0x8, &(0x7f0000003780)={r1, @rand_addr, @dev}, 0xc) syz_emit_ethernet(0x4a, &(0x7f0000000240)={@link_local, @empty=[0x0, 0x0, 0x6488], [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x3c, 0x0, 0x0, 0x0, 0x4, 0x0, @empty=0x9000000, @broadcast}, @udp={0x0, 0x0, 0x28}}}}}, &(0x7f0000000380)) 13:30:05 executing program 1: socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)) syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0xe1, 0x400100) creat(&(0x7f00000001c0)='./file0\x00', 0x2) openat$dsp(0xffffffffffffff9c, &(0x7f0000000200)='/dev/dsp\x00', 0x8000, 0x0) syz_open_dev$mouse(&(0x7f0000000240)='/dev/input/mouse#\x00', 0x100, 0x10000) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000007000)={0x8, 0x0, &(0x7f0000000140)=[@acquire], 0x0, 0x0, &(0x7f00000001c0)}) r2 = dup2(r1, r0) ioctl$BINDER_WRITE_READ(r2, 0x40046208, &(0x7f00000002c0)={0x8, 0x0, &(0x7f00000000c0)=[@release], 0x0, 0x0, &(0x7f0000000300)}) 13:30:05 executing program 4: preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f00000000c0)=""/148, 0x94}], 0x1, 0x1) r0 = syz_open_procfs(0x0, &(0x7f0000000080)='io\x00') preadv(r0, &(0x7f0000000480), 0x10000000000002a1, 0x0) [ 564.525938] ntfs: (device loop5): ntfs_fill_super(): Unable to determine device size. 13:30:05 executing program 3: socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)) syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0xe1, 0x400100) creat(&(0x7f00000001c0)='./file0\x00', 0x2) openat$dsp(0xffffffffffffff9c, &(0x7f0000000200)='/dev/dsp\x00', 0x8000, 0x0) syz_open_dev$mouse(&(0x7f0000000240)='/dev/input/mouse#\x00', 0x100, 0x10000) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000007000)={0x8, 0x0, &(0x7f0000000140)=[@acquire], 0x0, 0x0, &(0x7f00000001c0)}) r2 = dup2(r1, r0) ioctl$BINDER_WRITE_READ(r2, 0x40046208, &(0x7f00000002c0)={0x8, 0x0, &(0x7f00000000c0)=[@release], 0x0, 0x0, &(0x7f0000000300)}) 13:30:05 executing program 0: r0 = socket$inet(0x2, 0x4000000803, 0x4) bind$inet(r0, &(0x7f0000000000)={0x2, 0x0, @broadcast}, 0x10) getsockname(r0, &(0x7f00000036c0)=@xdp={0x2c, 0x0, 0x0}, &(0x7f0000000080)=0x80) setsockopt$inet_pktinfo(r0, 0x0, 0x8, &(0x7f0000003780)={r1, @rand_addr, @dev}, 0xc) syz_emit_ethernet(0x4a, &(0x7f0000000240)={@link_local, @empty=[0x0, 0x0, 0x800e000000000000], [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x3c, 0x0, 0x0, 0x0, 0x4, 0x0, @empty=0x9000000, @broadcast}, @udp={0x0, 0x0, 0x28}}}}}, &(0x7f0000000380)) 13:30:05 executing program 1: socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)) syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0xe1, 0x400100) creat(&(0x7f00000001c0)='./file0\x00', 0x2) openat$dsp(0xffffffffffffff9c, &(0x7f0000000200)='/dev/dsp\x00', 0x8000, 0x0) syz_open_dev$mouse(&(0x7f0000000240)='/dev/input/mouse#\x00', 0x100, 0x10000) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000007000)={0x8, 0x0, &(0x7f0000000140)=[@acquire], 0x0, 0x0, &(0x7f00000001c0)}) r2 = dup2(r1, r0) ioctl$BINDER_WRITE_READ(r2, 0x40049409, &(0x7f00000002c0)={0x8, 0x0, &(0x7f00000000c0)=[@release], 0x0, 0x0, &(0x7f0000000300)}) 13:30:05 executing program 4: preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f00000000c0)=""/148, 0x94}], 0x1, 0x0) r0 = syz_open_dev$vcsa(&(0x7f00000005c0)='/dev/vcsa#\x00', 0x2, 0x400000) ioctl$DRM_IOCTL_ADD_CTX(0xffffffffffffff9c, 0xc0086420, &(0x7f0000000600)={0x0}) ioctl$DRM_IOCTL_GET_SAREA_CTX(r0, 0xc010641d, &(0x7f0000000680)={r1, &(0x7f0000000640)=""/16}) ioctl$TIOCGSID(0xffffffffffffff9c, 0x5429, &(0x7f0000000000)=0x0) r3 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000340)='/dev/sequencer\x00', 0x4000, 0x0) getsockopt$inet6_IPV6_XFRM_POLICY(r3, 0x29, 0x23, &(0x7f00000003c0)={{{@in6, @in=@dev, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@local}, 0x0, @in6=@dev}}, &(0x7f00000004c0)=0xe8) ioprio_get$uid(0x3, r4) ioctl$TCSETSF(r3, 0x5404, &(0x7f0000000380)={0x1, 0x4, 0x6, 0x10000, 0xff, 0x8, 0x80000001, 0x80000001, 0x100, 0x1, 0x8, 0x800}) r5 = syz_open_procfs(r2, &(0x7f0000000200)="6e65742f736f0500000061743600") preadv(r5, &(0x7f0000000480), 0x10000000000002a1, 0x0) r6 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000180)='IPVS\x00') sendmsg$IPVS_CMD_ZERO(r5, &(0x7f0000000300)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x40000060}, 0xc, &(0x7f00000001c0)={&(0x7f0000000240)={0x9c, r6, 0x0, 0x70bd2b, 0x25dfdbff, {}, [@IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0x6}, @IPVS_CMD_ATTR_DAEMON={0xc, 0x3, [@IPVS_DAEMON_ATTR_STATE={0x8, 0x1, 0x3}]}, @IPVS_CMD_ATTR_DAEMON={0x28, 0x3, [@IPVS_DAEMON_ATTR_STATE={0x8, 0x1, 0x1}, @IPVS_DAEMON_ATTR_MCAST_IFN={0x14, 0x2, 'gre0\x00'}, @IPVS_DAEMON_ATTR_MCAST_TTL={0x8, 0x8, 0x3}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5, 0x3}, @IPVS_CMD_ATTR_DEST={0x3c, 0x2, [@IPVS_DEST_ATTR_WEIGHT={0x8, 0x4, 0xffffffff}, @IPVS_DEST_ATTR_ADDR={0x14, 0x1, @ipv4=@local}, @IPVS_DEST_ATTR_PERSIST_CONNS={0x8, 0x9, 0xfff}, @IPVS_DEST_ATTR_ADDR={0x14, 0x1, @ipv4=@loopback}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x401}]}, 0x9c}, 0x1, 0x0, 0x0, 0x1}, 0x20000000) ioctl$KVM_SET_VCPU_EVENTS(r5, 0x4040aea0, &(0x7f0000000040)={0x101, 0x3, 0x4, 0x0, 0x9dc, 0x10001, 0xfff, 0x0, 0x81, 0x40, 0x8, 0x3ed, 0x0, 0xfffffffffffffffb, 0x1, 0x4, 0x5, 0x0, 0x5}) getsockopt$inet_sctp_SCTP_STREAM_SCHEDULER_VALUE(r3, 0x84, 0x7c, &(0x7f0000000500)={0x0, 0x0, 0x9}, &(0x7f0000000540)=0x8) kexec_load(0xb39, 0x2, &(0x7f00000007c0)=[{&(0x7f00000006c0)="3538548cf43fe4be5ccf9e4df7a7fcbd88846ab0fa6677919b99deefc7685349a82d5b6d4836ce4c4386f70c594a1f11d9bb7d2eabfa851e424b9fff02e9ce81541bc75808be9fd704f8721dc2e0f3a889d5757cfee3d49b7823d1d0cb4039ed2208efff81c92340ae213efdbb5c9f2536ea33ca7c64a0a6bbd4156ec1213d89d48a4db058a1c1c2ca42a2879619b050d50d802407193ece01f809bff2fad52125a2869d4535872e0c3a1d9f2f154f010f2e77b445209a4c2f406dff3c299950a6422b74aabd4e69331c", 0xca, 0x0, 0xffff}, {&(0x7f00000013c0)="82d3b35d2fb8f4fafb7d8e2bca407dab9265192789d8746cde4cf7415480ba39727e128a92f87f6b8df610b1ef2f8daddd35b2668bc80398e0467236d5204b3308896ce800d836d2623d8a02f805000c615323328b8c736920dab1c616623bee0f45ee24700971a39b6a6b490a96abb7d9f594681c10677585ebd5d0112af70618ee637798f7013062e6017935827055777f54a522a97436e143b012bc4f08e89fd2be5035cbc10f54c6c8ac8a29522edc92dfa3839f37819ebabe1a4e82c502d13f6e4917856fc3024dcc40879076ac2d0246db843b595309769a38129f05af86228caf1f00f862013b0ecd3c9b40155b8b718fa83c485f6c6ae7ff805db03f383c2e9c64bf9ace79a4fbe79471a1e9fbac8f813a773eb9cfebe5a3e445a22eb6d0002cbb2f844257ceacc6867638c3bc51035fbb76ad6a6361dee9254a8e54caf4299c4d90dd0cd2ca9b004eb9bef53eb52d05a5b24276e59775819ab61e96ec328d223ec60c95fb03eecb2e422495632518f535941a93b26a11d84832492fb16050e8cc6f7d31abbe4062c4510fb662e88db06e40f3bfb9e751b1749cf902f1115d436c8afcbedf0f9e1d5af21d542b26c9cba980ebd2e80f43f75884af70712731dfa56d6db8d6ba8116220c229d06cab18c0bf879184dd7c3493e6a65122450d316a7c574467511659ab9dcc3455da760896a7b9f1e99ec6ed849a03be6d02fa0df51c97ad234f7b89857221f73097bdeb6337d70eaa4862420efaeb070ebf3b54e73344c5fde717183e91accd13bf0ed9f5cd17f85518645600ba71184f3fdbf029be40ffd11a68c5294e299f787e670dd238d1390c17059679f5a3940c9f1125cbe99ad3ef373c23fc21761b1fb055917fbb233eae1f345434ce97c961476b0abeeb5ffa889c21b0108d5df266563c7dcb1d0085e781ef415821084173fced08d89a51356fc43e94ab775a85b551444e9d0dff31c9890d5b47f96e12c991a4b39d41b23863c54584e8e033c896606904def0ce2f3a4ac8a934119123b8c6a414a840c28dcfe4e51f9cbafc0dc9178f6f5c01bfb568a262322e9c1c463171cf895552c8bf4e56199f8029bcf1778b0d2247f884b188df311061a1d24f0b278c4f63ba241723870c6abb0665ade7231cf3989cd8856d579aa8423eec952f3c8a00ca0543380c15f5382fc4bbd6c10648d673ee3447c68f8a60daf4421d234b683d49dbd5b8d35bd57edd9414435ec58734dd3fc537c29d917a78464461781fc3215477ff48bb88eb9ccba84ad38e817d56b219b1f630967ac414b962aa91a8eff146d8edcda29131e43ce4005c2cc6cd4753fcc1bf9ed71c48400d60c958ee33682b0dc75ee20875c04f7a42c4552b21080cdefaed5f14e2da180d732ede9b6ee5cbd6d3e8db1e40e4fe450cf7523191ab08b77cbe1c35000c695c5b1b1eeefbc627fbcd9da6629447e150716f089e0e7a11541fe73032958f17db20b403faa8f7891ec4122d30f0a34133dbb2bbb6405d0eeb5bb8e4afbba051615787e2e454876fffe14fd673b136460e73326fa53520b884073cc6d2f389c2237328d9bb144de31b8b678732090fe30cfb82b4d126cb6520da7001459dd469b8ab12f28a1a6e682205c31ee9b5c00c1503682086e9b8ee6c6054611feefc573cb09a035a71a70503199310996b94023e48eb2908a6c23a1801f9e4a827bbe9d0881cfb4dfc8930fec0a0f6db0b0879c6187079be8fb3235e3c657e265caa8ee733b40bb025dfe35cd9738970d4f357760fe9850b093a02cc5cbb6aca6fa916069670e44f3a6a3569ecec825ad9ab73b3d2106c532d98c4273d9726b3bdec415f634b00ad41abcbd38c73bc85c77e6f4b93b7246cff87f8474e0e5ce5ea24b4e26784795fcae89dd1692badd9cf485b4d6f209f6243b0892fa559e248b5dfd26254a4b43f2e9a8371334582d06283b38f24faa3e6ed5c3667dd1436b8527ab1b55c06ba41208a8599380df71db058eacf5682461f8db30b40a7632ab981f80ef8ba3294ba87b3ce31a47c6a66480eb1030371905c20e585494ad0229afa3698545b7c268135f09e0fd0e545ba1705500e23d6d27272d9c90626834e8845835ebe3790804cdfd42b2296f7fe59b32842c9bac2358916e7f9a5530a09f444e9bcba109182650c5002e099ff4c9cae9c8d1652b347b1869e6707197bc3ae9329b8d47d2afeafcb58968b762faf9c740d568423c86621a55e7ab6b0eb989f5fef7be27a62428342cb6ecc20292caddae879b1d9b9b61b0ad3901a8f8550ade62894a6588e1f9b287bbc56cd5bbc7680a72043c16d42b2b94ffe93587378186f7a5ed44328f55cee667b0a89fa45275ba3be8d7807bcfa9e3f75e1522cbda2be01ba42573976aa96fda2fc808de6dbffd806723b29d7d9eb4037c56e6b5f6de01a32343bed3cb49a040110b0c2123baadd4383e7004d5d5cab21787fd22ae39e80ce0b212660fce0eafbdec9456cf45851a85226681769f5ce409b770807ed560a64f363be1cb7301beb134863a37598472805a5399a3937366814ea7e977458987d15235e01444ac79d27a81046cea70cefc154f6e97e52eea6d2f0e4460c46f2e49a382f789c0198ab442a4a5c7d82b7557bcbff7d5bbd4587bb779ae38c46e0ef0032cdf8f075403d8d0711d03a5959ec76b6c4e14d23ec92e9fdf41f7a52c1f6938ec21a945e75137b1704f94f86dec5f28b6785f4e4d6bdb908d6e03f5c00861611f16787e33c00df0cf0067cfb095f2972f6abca5b201d585662c69cbbc23a5b16ef58f6646eb16b0ae14bb1e19399573edfd42a10c07bde24e78a74a65c929f8a91517de7e244698676efdb3c7950248d6735eebffc2b9331f3fefeec575a5284bb12af2dc3ffe517e16e5fec171d6875040a4d9cb56535e36b0e9dbc20ab8371cbcad039d54648fa2028be79a8a690fc05c0741e03cdb3bae6a89c51f5cb2761d543b9528e114dcaef4df92489cc9f5c7db89f73fb4dfe5e343e91673f71661d5e6489bbc03611bac4379218d40741c38a7f8f8edc4756f8cab07354023e69a1a574ac95ba7809099d809377b9461a5be4f3bfe2d92bd466bfa4592f02c14054ddfad8b04392ede22574bb17d5c26fcfc80c625b735690646dadeca59fbfb7b78281d4360786eab412d94733ec060bc859a2024652f209de82f9bb3c4067ec80243cb2808bcaf5c87a0ee61854ea1a97379befad5dc396963429adecf6cba76e0401dcec62e8ac2118dfeec6e2c9857c6c84fdef55896e50674f4e6a2e4b4955a1b8a451add615f80596a97affb48293bf29177b5b4dc61b1503c73f37a3c7b75d02b16f09e2970927daf0fdfa57e18f894f398793198845c2cca403898d305d7924e8ab5f0e8651f1a9d6e89f3516afb7979bc023d510904238803a95e93a9fd4ceba472c03ef674f99678043d393608b13c79b4c8d68fd5f99c7866c438e49d47105588e2d561ec32d2710748e8d3fd239b82e480f1a78d5b1bbabf6e6052dc8c881b299005da23497f7469216667c98dfa5c0c8f174ded38d3c193a7f84ddd2ee008759de191ed7c28099f232f344062921893e44d3dca8a96af69e7afc0c0ebf7f2bbe3cc0869cb124b73c103e9e09ce5cfcf9cb4f1ee7b58ba0f14de074d562f96c90b0845fac1930e203858a2929cbc964cd7bfafd828a4d061d8f3f13e53d00f9cfc4d43d0ae030409f5c312efd4bb2ad9aad148af826c758485cecaca2286d0d77882169a422b8bb20f1f23467b6c1ae1084f1e1509f55f78412a6e26a87c161066ccf30c900a238d136d5405058dcce14dfced60febeb6d5b6b3568a4447645ac8a58584b58ce51530ba00c0263e4f0968c7b8a4d64846681ea9bdba46be5785469b9eea067ca9fb338a98fad58576df9e0091862b7fc09850bc81be145755038d20b025f6704e56f54db79c192d0e9b32e34c8b330e1835b3297c14eeed9652c2c27095163b130b8fe4ac418711af2724e913e248966b466e3d7c11fde046473e47f51e83ee977b6fd163a16e7a95c5eaa9f075957557149e005be65dc5c453fc344750c6892a1f0282676afc4ea6ecd565b0866a8cd370c36ba4520ca28259636ce3d5ae6edba21cdd949319017c286e5e888b8f28ce7067a57a3ed1c086f74268d07880a1a45bc16a6660b72032cbecc87e444804fe9dc98ee324311b7d6a0abd8e6b100d9e5b53cfabeb7edcc095f34d02b24ef6c47de83691920fb1f440f2cee7d34144d13ab988a4363402c094d74fa0c1720926078edc87e4e679f7361e95748b1ca383fdd186c433fb8e0b1eda1df5aac26fd7138edaebfeac6eb5f07093cf7e5ea416601d87279faf70d216446950cbb1d1fa816be2c039c9a23a3f2cff0d5c62bdff8cacd606090c59edd55f8b352ef245823e73bcae928277ef32a77c966d9d9e147b44d341bd787659a9a13afed1e775f311cec3425361ee0989b9decf7c98b6009474ad4c4138dc721e0d555a5e2e697ef080232aeac2afcb8730b3584a1f9d4906c80a3717fa670d5eb7f241f81c51027d4eb2a8ba31c7bc2e1830982c484c0df461db7eb8e05bf4273c526d10d7859123291e99ce714eb439180ae744dedaa8d49d0c7c0dff2a92fd9011e3f0c9a1bd136528af4db34b132761ca5b30cc95973975e3e28d71b35a45330cf5724ad2783ab12811097a60e9d4c35fa1aa36a88407cd8f9a113dfc781eb82938a5c7a50c340adb416d5d06f618b2e35356485acc2d0c04dd95be4082d93fbe8538dc22554f482e951b60625d7af610b12b9e409b778c2b59c7bf90122216f307c97bb6d3c8a5c0e730ab0fc91b6c11cf150dfa8183f57b04ca6411162e72ccc1181203fc6ed2f1bf4a217e24b0650274de4dc5e4eec1e3c599645775b6312128edc077b2e70723f095dcbfbb0a92fe430782467005ffb61da509d7b49194c9b603b91bbdd060062e8a5b62b458941f281c7fb327ae00beb1b3d0ee772297a196766dac4a1079174a4dcd8621d565618964916efc7e7dcc88676de516ffefdf0fa334cb3360c8590713a8ef1e6503c1770680e82ecc095d138fe63bf6dd21c612efa0fb266d3d5f21aac3323d6aec9ffd7aea98dfc6bdaf1176701e9bcd6752a5c6606e625b0a94e8c30fb676a16eb44aa1db5f2026d60d6191a96c803797ebba749a76532a5277290636758083b5e672666e9216f14fcc5f96a07d260e84bcdc81e6087ced66b5b4ce6d9f50422d7f2923d51290a945d9facba40e54833c9b316623cf0458ab6f764710538a1d32c78ec68cd4f2f6bb49e1690c35695c4491d02a7d76583ec942097f9412616d7063454eb9b9b0327eac476666cd80c2adef7d5686fea3a7d22ba873629b76a7d6f0ecb514b6b3131ab02e45b5dbe4d9c8a659a6b594eb4b312686ba2e2a142f2f870c57f042bf953c4611e86f9d175ab771d24f8b120b58eaa32b85de9a750ee7090af0c949cfc379ba6c21d4562fcd7cd090c61ca7ac44ee6cfcc5c18345fd98c282715cf7a7d73eec215a776afba9ae63269474539ad24ee817dbf1934044973896f11c1f7d20b9ed896702ae9339adee8c390b7ac720cc9139bd9d9795d8f1d81324dbb23689f1434b730eef788f01b2b805462a62d9d7daf45b2d01894b94edc6d0a6be479083053736d82375a1103a910a7c5f9d97b6a2798c78d551d56d14a6dd25fffa4dbacd0d6e90aa40d43a317b5852b52882233df768e58b7ee6c522cdcb1b6aec658b98c50ccbd852a7c9ffddac2cc69ebb370b460b05", 0x1000, 0x7fffffff, 0x4}], 0x2a0000) setsockopt$inet_sctp6_SCTP_AUTH_DELETE_KEY(r3, 0x84, 0x19, &(0x7f0000000580)={r7, 0x401}, 0x8) [ 564.636824] overlayfs: filesystem on './file0' not supported as upperdir 13:30:06 executing program 0: r0 = socket$inet(0x2, 0x4000000803, 0x4) bind$inet(r0, &(0x7f0000000000)={0x2, 0x0, @broadcast}, 0x10) getsockname(r0, &(0x7f00000036c0)=@xdp={0x2c, 0x0, 0x0}, &(0x7f0000000080)=0x80) setsockopt$inet_pktinfo(r0, 0x0, 0x8, &(0x7f0000003780)={r1, @rand_addr, @dev}, 0xc) syz_emit_ethernet(0x4a, &(0x7f0000000240)={@link_local, @empty=[0x0, 0x0, 0x3], [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x3c, 0x0, 0x0, 0x0, 0x4, 0x0, @empty=0x9000000, @broadcast}, @udp={0x0, 0x0, 0x28}}}}}, &(0x7f0000000380)) 13:30:06 executing program 5: syz_mount_image$btrfs(&(0x7f0000000140)='btrfs\x00', &(0x7f0000000180)='./file0\x00', 0x0, 0x0, &(0x7f00000007c0), 0x0, &(0x7f0000000380)=ANY=[]) syz_mount_image$ntfs(&(0x7f0000000200)='ntfs\x00', &(0x7f0000000080)='./file1\x00', 0x0, 0x30, &(0x7f0000000580), 0x0, &(0x7f0000000680)=ANY=[]) mount$overlay(0x404030, &(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f0000000100)={[{@upperdir={'upperdir', 0x3d, './file0'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@workdir={'workdir', 0x3d, './file1'}, 0x5c}]}) umount2(&(0x7f0000000040)='./file0\x00', 0x1e) 13:30:06 executing program 0: r0 = socket$inet(0x2, 0x4000000803, 0x4) bind$inet(r0, &(0x7f0000000000)={0x2, 0x0, @broadcast}, 0x10) getsockname(r0, &(0x7f00000036c0)=@xdp={0x2c, 0x0, 0x0}, &(0x7f0000000080)=0x80) setsockopt$inet_pktinfo(r0, 0x0, 0x8, &(0x7f0000003780)={r1, @rand_addr, @dev}, 0xc) syz_emit_ethernet(0x4a, &(0x7f0000000240)={@link_local, @empty=[0x0, 0x0, 0x7000000], [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x3c, 0x0, 0x0, 0x0, 0x4, 0x0, @empty=0x9000000, @broadcast}, @udp={0x0, 0x0, 0x28}}}}}, &(0x7f0000000380)) [ 564.933459] ntfs: (device loop5): ntfs_fill_super(): Unable to determine device size. [ 564.996033] overlayfs: filesystem on './file0' not supported as upperdir [ 565.003963] ntfs: (device loop5): ntfs_fill_super(): Unable to determine device size. 13:30:06 executing program 4: preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f00000000c0)=""/148, 0x94}], 0x1, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000080)='io\x00') preadv(r0, &(0x7f0000000480), 0x10000000000002a1, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000640)={'veth1_to_bridge\x00', 0x0}) ioctl$HCIINQUIRY(r0, 0x800448f0, &(0x7f0000000680)={r1, 0x8, 0xe26, 0x59, 0x75172607, 0x9, 0x1}) 13:30:06 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000007000)={0x8, 0x0, &(0x7f0000000140)=[@acquire], 0x0, 0x0, &(0x7f00000001c0)}) r2 = dup2(r1, r0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000002c0)={0x8, 0x0, &(0x7f00000000c0)=[@release], 0x100000000000000, 0x0, &(0x7f0000000300)}) 13:30:06 executing program 3: socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)) syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0xe1, 0x400100) creat(&(0x7f00000001c0)='./file0\x00', 0x2) openat$dsp(0xffffffffffffff9c, &(0x7f0000000200)='/dev/dsp\x00', 0x8000, 0x0) syz_open_dev$mouse(&(0x7f0000000240)='/dev/input/mouse#\x00', 0x100, 0x10000) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000007000)={0x8, 0x0, &(0x7f0000000140)=[@acquire], 0x0, 0x0, &(0x7f00000001c0)}) r2 = dup2(r1, r0) ioctl$BINDER_WRITE_READ(r2, 0x40046208, &(0x7f00000002c0)={0x8, 0x0, &(0x7f00000000c0)=[@release], 0x0, 0x0, &(0x7f0000000300)}) 13:30:06 executing program 1: socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)) syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0xe1, 0x400100) creat(&(0x7f00000001c0)='./file0\x00', 0x2) openat$dsp(0xffffffffffffff9c, &(0x7f0000000200)='/dev/dsp\x00', 0x8000, 0x0) syz_open_dev$mouse(&(0x7f0000000240)='/dev/input/mouse#\x00', 0x100, 0x10000) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000007000)={0x8, 0x0, &(0x7f0000000140)=[@acquire], 0x0, 0x0, &(0x7f00000001c0)}) r2 = dup2(r1, r0) ioctl$BINDER_WRITE_READ(r2, 0xc0189436, &(0x7f00000002c0)={0x8, 0x0, &(0x7f00000000c0)=[@release], 0x0, 0x0, &(0x7f0000000300)}) 13:30:06 executing program 0: r0 = socket$inet(0x2, 0x4000000803, 0x4) bind$inet(r0, &(0x7f0000000000)={0x2, 0x0, @broadcast}, 0x10) getsockname(r0, &(0x7f00000036c0)=@xdp={0x2c, 0x0, 0x0}, &(0x7f0000000080)=0x80) setsockopt$inet_pktinfo(r0, 0x0, 0x8, &(0x7f0000003780)={r1, @rand_addr, @dev}, 0xc) syz_emit_ethernet(0x4a, &(0x7f0000000240)={@link_local, @empty=[0x0, 0x0, 0x3c00], [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x3c, 0x0, 0x0, 0x0, 0x4, 0x0, @empty=0x9000000, @broadcast}, @udp={0x0, 0x0, 0x28}}}}}, &(0x7f0000000380)) 13:30:06 executing program 5: syz_mount_image$btrfs(&(0x7f0000000140)='btrfs\x00', &(0x7f0000000180)='./file0\x00', 0x0, 0x0, &(0x7f00000007c0), 0x0, &(0x7f0000000380)=ANY=[]) syz_mount_image$ntfs(&(0x7f0000000200)='ntfs\x00', &(0x7f0000000080)='./file1\x00', 0x0, 0x30, &(0x7f0000000580), 0x0, &(0x7f0000000680)=ANY=[]) mount$overlay(0x404030, &(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f0000000100)={[{@upperdir={'upperdir', 0x3d, './file0'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@workdir={'workdir', 0x3d, './file1'}, 0x5c}]}) umount2(&(0x7f0000000040)='./file0\x00', 0x1e00) 13:30:06 executing program 0: r0 = socket$inet(0x2, 0x4000000803, 0x4) bind$inet(r0, &(0x7f0000000000)={0x2, 0x0, @broadcast}, 0x10) getsockname(r0, &(0x7f00000036c0)=@xdp={0x2c, 0x0, 0x0}, &(0x7f0000000080)=0x80) setsockopt$inet_pktinfo(r0, 0x0, 0x8, &(0x7f0000003780)={r1, @rand_addr, @dev}, 0xc) syz_emit_ethernet(0x4a, &(0x7f0000000240)={@link_local, @empty=[0x0, 0x0, 0x8000000], [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x3c, 0x0, 0x0, 0x0, 0x4, 0x0, @empty=0x9000000, @broadcast}, @udp={0x0, 0x0, 0x28}}}}}, &(0x7f0000000380)) [ 565.403654] binder_thread_write: 15 callbacks suppressed [ 565.403675] binder: 27810:27815 Acquire 1 refcount change on invalid ref 0 ret -22 [ 565.441946] ntfs: (device loop5): ntfs_fill_super(): Unable to determine device size. 13:30:06 executing program 3: r0 = perf_event_open(&(0x7f00000000c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) r1 = perf_event_open$cgroup(&(0x7f0000000000)={0x5, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, @perf_config_ext={0x0, 0x1}}, 0xffffffffffffffff, 0x0, r0, 0x0) perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, r1, 0x0) r2 = openat$zero(0xffffffffffffff9c, &(0x7f0000000080)='/dev/zero\x00', 0x8000, 0x0) setsockopt$XDP_UMEM_FILL_RING(r2, 0x11b, 0x5, &(0x7f0000000140)=0x100000, 0x4) 13:30:06 executing program 4: preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f00000000c0)=""/148, 0xe32d4b5a}], 0x0, 0x0) preadv(0xffffffffffffffff, &(0x7f0000000600)=[{&(0x7f00000006c0)=""/41}, {&(0x7f0000000180)=""/230}, {&(0x7f0000000040)=""/83}, {&(0x7f0000000280)=""/103}, {&(0x7f0000000300)=""/231}, {&(0x7f0000000400)=""/158}, {&(0x7f00000004c0)=""/56}, {&(0x7f0000000500)=""/78}, {&(0x7f0000000580)=""/70}], 0x100000000000005a, 0x0) [ 565.487031] binder: 27810:27827 Acquire 1 refcount change on invalid ref 0 ret -22 13:30:06 executing program 5: syz_mount_image$btrfs(&(0x7f0000000140)='btrfs\x00', &(0x7f0000000180)='./file0\x00', 0x0, 0x0, &(0x7f00000007c0), 0x0, &(0x7f0000000380)=ANY=[]) syz_mount_image$ntfs(&(0x7f0000000200)='ntfs\x00', &(0x7f0000000080)='./file1\x00', 0x0, 0x30, &(0x7f0000000580), 0x0, &(0x7f0000000680)=ANY=[]) mount$overlay(0x404030, &(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f0000000100)={[{@upperdir={'upperdir', 0x3d, './file0'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@workdir={'workdir', 0x3d, './file1'}, 0x5c}]}) umount2(&(0x7f0000000040)='./file0\x00', 0x2700) [ 565.575205] overlayfs: filesystem on './file0' not supported as upperdir 13:30:06 executing program 0: r0 = socket$inet(0x2, 0x4000000803, 0x4) bind$inet(r0, &(0x7f0000000000)={0x2, 0x0, @broadcast}, 0x10) getsockname(r0, &(0x7f00000036c0)=@xdp={0x2c, 0x0, 0x0}, &(0x7f0000000080)=0x80) setsockopt$inet_pktinfo(r0, 0x0, 0x8, &(0x7f0000003780)={r1, @rand_addr, @dev}, 0xc) syz_emit_ethernet(0x4a, &(0x7f0000000240)={@link_local, @empty=[0x0, 0x0, 0x8060000], [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x3c, 0x0, 0x0, 0x0, 0x4, 0x0, @empty=0x9000000, @broadcast}, @udp={0x0, 0x0, 0x28}}}}}, &(0x7f0000000380)) 13:30:06 executing program 1: socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)) syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0xe1, 0x400100) creat(&(0x7f00000001c0)='./file0\x00', 0x2) openat$dsp(0xffffffffffffff9c, &(0x7f0000000200)='/dev/dsp\x00', 0x8000, 0x0) syz_open_dev$mouse(&(0x7f0000000240)='/dev/input/mouse#\x00', 0x100, 0x10000) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000007000)={0x8, 0x0, &(0x7f0000000140)=[@acquire], 0x0, 0x0, &(0x7f00000001c0)}) r2 = dup2(r1, r0) ioctl$BINDER_WRITE_READ(r2, 0xc018620c, &(0x7f00000002c0)={0x8, 0x0, &(0x7f00000000c0)=[@release], 0x0, 0x0, &(0x7f0000000300)}) 13:30:06 executing program 4: preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f00000000c0)=""/148, 0x94}], 0x1, 0x0) ioctl$sock_SIOCGPGRP(0xffffffffffffffff, 0x8904, &(0x7f0000001300)=0x0) ioctl$TIOCGPGRP(0xffffffffffffff9c, 0x540f, &(0x7f00000014c0)=0x0) r2 = socket$key(0xf, 0x3, 0x2) ioctl$sock_FIOSETOWN(r2, 0x8901, &(0x7f0000001500)=r0) r3 = syz_open_procfs(r1, &(0x7f0000001340)="e2d1698300") ioctl$TUNSETVNETHDRSZ(r3, 0x400454d8, &(0x7f0000000000)=0x1) preadv(r3, &(0x7f0000000040)=[{&(0x7f0000000180)=""/187}, {&(0x7f0000000240)=""/136}, {&(0x7f0000000300)=""/4096}, {&(0x7f00000013c0)=""/213}], 0x10000227, 0x3) ioctl$sock_SIOCDELDLCI(r3, 0x8981, &(0x7f0000000080)={'ipddp0\x00'}) [ 565.771212] overlayfs: failed to resolve './file1': -2 [ 565.782588] binder: 27852:27853 Acquire 1 refcount change on invalid ref 0 ret -22 [ 565.793168] binder: 27852 BINDER_GET_NODE_INFO_FOR_REF: only handle may be non-zero. [ 565.793189] binder: 27852:27853 ioctl c018620c 200002c0 returned -22 [ 565.833004] overlayfs: failed to resolve './file1': -2 [ 565.835025] binder: 27852:27861 Acquire 1 refcount change on invalid ref 0 ret -22 [ 565.865751] binder: 27852 BINDER_GET_NODE_INFO_FOR_REF: only handle may be non-zero. [ 565.865767] binder: 27852:27861 ioctl c018620c 200002c0 returned -22 13:30:07 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000007000)={0x8, 0x0, &(0x7f0000000140)=[@acquire], 0x0, 0x0, &(0x7f00000001c0)}) r2 = dup2(r1, r0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000002c0)={0x8, 0x0, &(0x7f00000000c0)=[@release], 0x0, 0x1000000, &(0x7f0000000300)}) 13:30:07 executing program 3: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_SET_SIGNAL_MASK(0xffffffffffffffff, 0x4004ae8b, &(0x7f0000001000)=ANY=[@ANYBLOB="960f33"]) r2 = getpid() r3 = openat$ipvs(0xffffffffffffff9c, &(0x7f00000001c0)='/proc/sys/net/ipv4/vs/am_droprate\x00', 0x2, 0x0) perf_event_open(&(0x7f0000000140)={0x4, 0x70, 0x6, 0x47d62a66, 0x0, 0x0, 0x0, 0x7, 0x0, 0x2, 0x9, 0x5, 0x3, 0x7, 0xffffffff80000000, 0x0, 0xfffffffffffffff7, 0x1, 0x100000000, 0x8, 0x101, 0x1, 0x2f0, 0x8, 0x400, 0x4, 0x80, 0x1, 0x7fff, 0x5, 0x20, 0x7fff, 0x8, 0x9, 0xfffff80000000000, 0x9, 0x4, 0x1, 0x0, 0xb7, 0x1, @perf_bp={&(0x7f00000000c0), 0x8}, 0x220, 0x20, 0x61649ddf, 0x0, 0x4d6, 0x2, 0xdf}, r2, 0xc, r3, 0x1) r4 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmsg$alg(0xffffffffffffffff, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000240), 0x0, &(0x7f0000000280)=[@iv={0x18, 0x117, 0x2, 0x1, 'C'}], 0x18}, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r4, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000100)=[@textreal={0x8, &(0x7f0000000000)="0f01c8f20f35ba2000b000ee0f2336360fc76df20f2054440f20c0663504000000440f22c064f3e10a660f3a63a63c6700baf80c66b8bd08428766efbafc0cb066ee", 0x42}], 0x1, 0x0, &(0x7f00000001c0), 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f00000002c0)={0x0, 0x2, 0x0, 0x2000, &(0x7f0000001000/0x2000)=nil}) ioctl$KVM_RUN(r4, 0xae80, 0x0) 13:30:07 executing program 0: r0 = socket$inet(0x2, 0x4000000803, 0x4) bind$inet(r0, &(0x7f0000000000)={0x2, 0x0, @broadcast}, 0x10) getsockname(r0, &(0x7f00000036c0)=@xdp={0x2c, 0x0, 0x0}, &(0x7f0000000080)=0x80) setsockopt$inet_pktinfo(r0, 0x0, 0x8, &(0x7f0000003780)={r1, @rand_addr, @dev}, 0xc) syz_emit_ethernet(0x4a, &(0x7f0000000240)={@link_local, @empty=[0x0, 0x0, 0x8847], [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x3c, 0x0, 0x0, 0x0, 0x4, 0x0, @empty=0x9000000, @broadcast}, @udp={0x0, 0x0, 0x28}}}}}, &(0x7f0000000380)) 13:30:07 executing program 4: preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f00000000c0)=""/148, 0x94}], 0x1, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000080)='io\x00') ioctl$RTC_PIE_OFF(r0, 0x7006) preadv(r0, &(0x7f0000000480), 0x10000000000002a1, 0x0) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000000000)={0x0}, &(0x7f0000000040)=0xc) sendmsg$nl_netfilter(r0, &(0x7f0000000280)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x100002}, 0xc, &(0x7f0000000240)={&(0x7f0000000200)={0x28, 0x4, 0x3, 0x310, 0x70bd29, 0x25dfdbfb, {0x7, 0x0, 0x5}, [@typed={0x14, 0x46, @ipv6}]}, 0x28}, 0x1, 0x0, 0x0, 0x4080}, 0x804) syz_open_procfs(r1, &(0x7f0000000180)='oom_score\x00') 13:30:07 executing program 5: syz_mount_image$btrfs(&(0x7f0000000140)='btrfs\x00', &(0x7f0000000180)='./file0\x00', 0x0, 0x0, &(0x7f00000007c0), 0x0, &(0x7f0000000380)=ANY=[]) syz_mount_image$ntfs(&(0x7f0000000200)='ntfs\x00', &(0x7f0000000080)='./file1\x00', 0x0, 0x30, &(0x7f0000000580), 0x0, &(0x7f0000000680)=ANY=[]) mount$overlay(0x404030, &(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f0000000100)={[{@upperdir={'upperdir', 0x3d, './file0'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@workdir={'workdir', 0x3d, './file1'}, 0x5c}]}) umount2(&(0x7f0000000040)='./file0\x00', 0xd00000000000000) 13:30:07 executing program 1: socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)) syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0xe1, 0x400100) creat(&(0x7f00000001c0)='./file0\x00', 0x2) openat$dsp(0xffffffffffffff9c, &(0x7f0000000200)='/dev/dsp\x00', 0x8000, 0x0) syz_open_dev$mouse(&(0x7f0000000240)='/dev/input/mouse#\x00', 0x100, 0x10000) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000007000)={0x8, 0x0, &(0x7f0000000140)=[@acquire], 0x0, 0x0, &(0x7f00000001c0)}) r2 = dup2(r1, r0) ioctl$BINDER_WRITE_READ(r2, 0x40046205, &(0x7f00000002c0)={0x8, 0x0, &(0x7f00000000c0)=[@release], 0x0, 0x0, &(0x7f0000000300)}) 13:30:07 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000007000)={0x8, 0x0, &(0x7f0000000140)=[@acquire], 0x0, 0x0, &(0x7f00000001c0)}) r2 = dup2(r1, r0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000002c0)={0x8, 0x0, &(0x7f00000000c0)=[@release], 0x0, 0xfdfdffff, &(0x7f0000000300)}) [ 566.326578] ntfs: (device loop5): ntfs_fill_super(): Unable to determine device size. [ 566.345968] binder: 27883:27886 Acquire 1 refcount change on invalid ref 0 ret -22 [ 566.417999] binder: 27883:27895 Acquire 1 refcount change on invalid ref 0 ret -22 13:30:07 executing program 0: r0 = socket$inet(0x2, 0x4000000803, 0x4) bind$inet(r0, &(0x7f0000000000)={0x2, 0x0, @broadcast}, 0x10) getsockname(r0, &(0x7f00000036c0)=@xdp={0x2c, 0x0, 0x0}, &(0x7f0000000080)=0x80) setsockopt$inet_pktinfo(r0, 0x0, 0x8, &(0x7f0000003780)={r1, @rand_addr, @dev}, 0xc) syz_emit_ethernet(0x4a, &(0x7f0000000240)={@link_local, @empty=[0x0, 0x0, 0x4000000], [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x3c, 0x0, 0x0, 0x0, 0x4, 0x0, @empty=0x9000000, @broadcast}, @udp={0x0, 0x0, 0x28}}}}}, &(0x7f0000000380)) 13:30:07 executing program 4: preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f00000000c0)=""/148, 0x94}], 0x1, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000080)='io\x00') preadv(r0, &(0x7f0000000480), 0x10000000000002a1, 0x0) getsockopt$inet6_mreq(r0, 0x29, 0x1d, &(0x7f0000000180)={@ipv4, 0x0}, &(0x7f00000001c0)=0x14) setsockopt$inet6_mreq(r0, 0x29, 0x14, &(0x7f0000000200)={@loopback, r1}, 0x14) syz_open_dev$dspn(&(0x7f0000000040)='/dev/dsp#\x00', 0x7f, 0x182) getcwd(&(0x7f0000000000)=""/63, 0x3f) 13:30:07 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000007000)={0x8, 0x0, &(0x7f0000000140)=[@acquire], 0x0, 0x0, &(0x7f00000001c0)}) r2 = dup2(r1, r0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000002c0)={0x8, 0x0, &(0x7f00000000c0)=[@release], 0x0, 0x1a0, &(0x7f0000000300)}) 13:30:07 executing program 1: socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)) syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0xe1, 0x400100) creat(&(0x7f00000001c0)='./file0\x00', 0x2) openat$dsp(0xffffffffffffff9c, &(0x7f0000000200)='/dev/dsp\x00', 0x8000, 0x0) syz_open_dev$mouse(&(0x7f0000000240)='/dev/input/mouse#\x00', 0x100, 0x10000) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000007000)={0x8, 0x0, &(0x7f0000000140)=[@acquire], 0x0, 0x0, &(0x7f00000001c0)}) r2 = dup2(r1, r0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000002c0)={0x8, 0xfffffdfd, &(0x7f00000000c0)=[@release], 0x0, 0x0, &(0x7f0000000300)}) 13:30:07 executing program 5: syz_mount_image$btrfs(&(0x7f0000000140)='btrfs\x00', &(0x7f0000000180)='./file0\x00', 0x0, 0x0, &(0x7f00000007c0), 0x0, &(0x7f0000000380)=ANY=[]) syz_mount_image$ntfs(&(0x7f0000000200)='ntfs\x00', &(0x7f0000000080)='./file1\x00', 0x0, 0x30, &(0x7f0000000580), 0x0, &(0x7f0000000680)=ANY=[]) mount$overlay(0x404030, &(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f0000000100)={[{@upperdir={'upperdir', 0x3d, './file0'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@workdir={'workdir', 0x3d, './file1'}, 0x5c}]}) umount2(&(0x7f0000000040)='./file0\x00', 0x97000000) 13:30:08 executing program 0: r0 = socket$inet(0x2, 0x4000000803, 0x4) bind$inet(r0, &(0x7f0000000000)={0x2, 0x0, @broadcast}, 0x10) getsockname(r0, &(0x7f00000036c0)=@xdp={0x2c, 0x0, 0x0}, &(0x7f0000000080)=0x80) setsockopt$inet_pktinfo(r0, 0x0, 0x8, &(0x7f0000003780)={r1, @rand_addr, @dev}, 0xc) syz_emit_ethernet(0x4a, &(0x7f0000000240)={@link_local, @empty=[0x0, 0x0, 0x300], [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x3c, 0x0, 0x0, 0x0, 0x4, 0x0, @empty=0x9000000, @broadcast}, @udp={0x0, 0x0, 0x28}}}}}, &(0x7f0000000380)) [ 566.756831] binder: 27919:27920 Acquire 1 refcount change on invalid ref 0 ret -22 [ 566.849967] ntfs: (device loop5): ntfs_fill_super(): Unable to determine device size. [ 566.907132] binder: 27919:27935 Acquire 1 refcount change on invalid ref 0 ret -22 [ 567.044785] overlayfs: filesystem on './file0' not supported as upperdir 13:30:08 executing program 3: socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)) syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0xe1, 0x400100) creat(&(0x7f00000001c0)='./file0\x00', 0x2) openat$dsp(0xffffffffffffff9c, &(0x7f0000000200)='/dev/dsp\x00', 0x8000, 0x0) syz_open_dev$mouse(&(0x7f0000000240)='/dev/input/mouse#\x00', 0x100, 0x10000) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000007000)={0x8, 0x0, &(0x7f0000000140)=[@acquire], 0x0, 0x0, &(0x7f00000001c0)}) r2 = dup2(r1, r0) ioctl$BINDER_WRITE_READ(r2, 0xc018620c, &(0x7f00000002c0)={0x8, 0x0, &(0x7f00000000c0)=[@release], 0x0, 0x0, &(0x7f0000000300)}) 13:30:08 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000007000)={0x8, 0x0, &(0x7f0000000140)=[@acquire], 0x0, 0x0, &(0x7f00000001c0)}) r2 = dup2(r1, r0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000002c0)={0x8, 0x0, &(0x7f00000000c0)=[@release], 0x0, 0x100000000000000, &(0x7f0000000300)}) 13:30:08 executing program 4: preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f00000000c0)=""/148, 0x94}], 0x1, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000080)='io\x00') preadv(r0, &(0x7f00000001c0), 0x0, 0x0) ioctl$sock_bt_hci(r0, 0xc00448df, &(0x7f00000001c0)="364ea0b05614a42665458ac3aa46922d097e1494229b66b4115b6b06a4690298fc2c44a26bfd7982042cc10c809b7c1edeaf4e36be6afe838a8e97bbe983fb8648b010169ca36c4c1900ae4d5c49b9aca90b30fb6cb43a749fce02cc05a36fb4ee41e3d522bcf10aa80d28997cb8f4a87ae3109f017f885f0100d41a0b1b893698ae8d0c68d785d33b6bff19ae958dcdb5873ff9511befb2d9016a59160023d65fc3f2d27433a24e5a5e7042d5e0e90bd32b31876e001f5944ca7e17251076f491577efe24") ioctl$FS_IOC_SETFLAGS(r0, 0x40086602, &(0x7f0000000180)=0x1) ioctl$sock_bt_hci(r0, 0x800448d3, &(0x7f0000000000)="41c91eb673fc7ea4ed2892453b3dae855d2c4d921e303b795e0be3c78b5d889687faa8a404cec34bb7c3b9b1abc669c3517e3c0be72bfdcbdb91e990c793da495f5acc0c5e7f3f160f30fa01a700ea65990f500b66a61c27c4e65068ff9947b071060c") 13:30:08 executing program 1: socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)) syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0xe1, 0x400100) creat(&(0x7f00000001c0)='./file0\x00', 0x2) openat$dsp(0xffffffffffffff9c, &(0x7f0000000200)='/dev/dsp\x00', 0x8000, 0x0) syz_open_dev$mouse(&(0x7f0000000240)='/dev/input/mouse#\x00', 0x100, 0x10000) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000007000)={0x8, 0x0, &(0x7f0000000140)=[@acquire], 0x0, 0x0, &(0x7f00000001c0)}) r2 = dup2(r1, r0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000002c0)={0x8, 0xfdfdffff00000000, &(0x7f00000000c0)=[@release], 0x0, 0x0, &(0x7f0000000300)}) 13:30:08 executing program 0: r0 = socket$inet(0x2, 0x4000000803, 0x4) bind$inet(r0, &(0x7f0000000000)={0x2, 0x0, @broadcast}, 0x10) getsockname(r0, &(0x7f00000036c0)=@xdp={0x2c, 0x0, 0x0}, &(0x7f0000000080)=0x80) setsockopt$inet_pktinfo(r0, 0x0, 0x8, &(0x7f0000003780)={r1, @rand_addr, @dev}, 0xc) syz_emit_ethernet(0x4a, &(0x7f0000000240)={@link_local, @empty=[0x0, 0x0, 0xe0000000], [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x3c, 0x0, 0x0, 0x0, 0x4, 0x0, @empty=0x9000000, @broadcast}, @udp={0x0, 0x0, 0x28}}}}}, &(0x7f0000000380)) 13:30:08 executing program 5: syz_mount_image$btrfs(&(0x7f0000000140)='btrfs\x00', &(0x7f0000000180)='./file0\x00', 0x0, 0x0, &(0x7f00000007c0), 0x0, &(0x7f0000000380)=ANY=[]) syz_mount_image$ntfs(&(0x7f0000000200)='ntfs\x00', &(0x7f0000000080)='./file1\x00', 0x0, 0x30, &(0x7f0000000580), 0x0, &(0x7f0000000680)=ANY=[]) mount$overlay(0x404030, &(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f0000000100)={[{@upperdir={'upperdir', 0x3d, './file0'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@workdir={'workdir', 0x3d, './file1'}, 0x5c}]}) umount2(&(0x7f0000000040)='./file0\x00', 0x40000) 13:30:08 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000007000)={0x8, 0x0, &(0x7f0000000140)=[@acquire], 0x0, 0x0, &(0x7f00000001c0)}) r2 = dup2(r1, r0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000002c0)={0x8, 0x0, &(0x7f00000000c0)=[@release], 0x0, 0xffffffffa0010000, &(0x7f0000000300)}) [ 567.204398] binder: 27947:27948 Acquire 1 refcount change on invalid ref 0 ret -22 13:30:08 executing program 4: preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f00000000c0)=""/148, 0x94}], 0x1, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000000)='io\x00') preadv(r0, &(0x7f0000000480), 0x10000000000002a1, 0x0) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000080)={0xffffffffffffffff, r0, 0x0, 0x3, &(0x7f0000000040)='io\x00'}, 0x30) syz_open_procfs(r1, &(0x7f0000000180)='net/llc\x00') 13:30:08 executing program 0: r0 = socket$inet(0x2, 0x4000000803, 0x4) bind$inet(r0, &(0x7f0000000000)={0x2, 0x0, @broadcast}, 0x10) getsockname(r0, &(0x7f00000036c0)=@xdp={0x2c, 0x0, 0x0}, &(0x7f0000000080)=0x80) setsockopt$inet_pktinfo(r0, 0x0, 0x8, &(0x7f0000003780)={r1, @rand_addr, @dev}, 0xc) syz_emit_ethernet(0x4a, &(0x7f0000000240)={@link_local, @empty=[0x0, 0x0, 0x6000000], [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x3c, 0x0, 0x0, 0x0, 0x4, 0x0, @empty=0x9000000, @broadcast}, @udp={0x0, 0x0, 0x28}}}}}, &(0x7f0000000380)) [ 567.284417] binder: 27947:27967 Acquire 1 refcount change on invalid ref 0 ret -22 [ 567.306768] ntfs: (device loop5): ntfs_fill_super(): Unable to determine device size. [ 567.315439] binder: 27960 BINDER_GET_NODE_INFO_FOR_REF: only handle may be non-zero. [ 567.315458] binder: 27960:27961 ioctl c018620c 200002c0 returned -22 13:30:08 executing program 3: socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)) syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0xe1, 0x400100) creat(&(0x7f00000001c0)='./file0\x00', 0x2) openat$dsp(0xffffffffffffff9c, &(0x7f0000000200)='/dev/dsp\x00', 0x8000, 0x0) syz_open_dev$mouse(&(0x7f0000000240)='/dev/input/mouse#\x00', 0x100, 0x10000) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000007000)={0x8, 0x0, &(0x7f0000000140)=[@acquire], 0x0, 0x0, &(0x7f00000001c0)}) r2 = dup2(r1, r0) ioctl$BINDER_WRITE_READ(r2, 0xc018620c, &(0x7f00000002c0)={0x8, 0x0, &(0x7f00000000c0)=[@release], 0x0, 0x0, &(0x7f0000000300)}) 13:30:08 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000007000)={0x8, 0x0, &(0x7f0000000140)=[@acquire], 0x0, 0x0, &(0x7f00000001c0)}) r2 = dup2(r1, r0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000002c0)={0x8, 0x0, &(0x7f00000000c0)=[@release], 0x0, 0x3f00000000000000, &(0x7f0000000300)}) 13:30:08 executing program 1: socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)) syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0xe1, 0x400100) creat(&(0x7f00000001c0)='./file0\x00', 0x2) openat$dsp(0xffffffffffffff9c, &(0x7f0000000200)='/dev/dsp\x00', 0x8000, 0x0) syz_open_dev$mouse(&(0x7f0000000240)='/dev/input/mouse#\x00', 0x100, 0x10000) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000007000)={0x8, 0x0, &(0x7f0000000140)=[@acquire], 0x0, 0x0, &(0x7f00000001c0)}) r2 = dup2(r1, r0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000002c0)={0x8, 0x100000000000000, &(0x7f00000000c0)=[@release], 0x0, 0x0, &(0x7f0000000300)}) [ 567.427371] overlayfs: filesystem on './file0' not supported as upperdir [ 567.452958] ntfs: (device loop5): ntfs_fill_super(): Unable to determine device size. 13:30:08 executing program 4: r0 = openat$null(0xffffffffffffff9c, &(0x7f0000000000)='/dev/null\x00', 0x101000, 0x0) mmap$xdp(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x4, 0x10, r0, 0x100000000) preadv(0xffffffffffffffff, &(0x7f0000001380), 0x1, 0x1) ioctl$FIDEDUPERANGE(r0, 0xc0189436, &(0x7f0000000100)={0x5, 0x50, 0x3, 0x0, 0x0, [{r0, 0x0, 0x1c}, {r0, 0x0, 0x1000}, {r0, 0x0, 0xfffffffffffffffc}]}) r1 = syz_open_procfs(0x0, &(0x7f0000000080)='io\x00') creat(&(0x7f0000000040)='./file0\x00', 0x2) preadv(r1, &(0x7f0000000480), 0x10000000000002a1, 0x0) openat$cgroup_subtree(r1, &(0x7f00000000c0)='cgroup.subtree_control\x00', 0x2, 0x0) 13:30:08 executing program 0: r0 = socket$inet(0x2, 0x4000000803, 0x4) bind$inet(r0, &(0x7f0000000000)={0x2, 0x0, @broadcast}, 0x10) getsockname(r0, &(0x7f00000036c0)=@xdp={0x2c, 0x0, 0x0}, &(0x7f0000000080)=0x80) setsockopt$inet_pktinfo(r0, 0x0, 0x8, &(0x7f0000003780)={r1, @rand_addr, @dev}, 0xc) syz_emit_ethernet(0x4a, &(0x7f0000000240)={@link_local, @empty=[0x0, 0x0, 0x3e8], [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x3c, 0x0, 0x0, 0x0, 0x4, 0x0, @empty=0x9000000, @broadcast}, @udp={0x0, 0x0, 0x28}}}}}, &(0x7f0000000380)) [ 567.533197] binder: 27990 BINDER_GET_NODE_INFO_FOR_REF: only handle may be non-zero. [ 567.533217] binder: 27990:27991 ioctl c018620c 200002c0 returned -22 13:30:08 executing program 5: syz_mount_image$btrfs(&(0x7f0000000140)='btrfs\x00', &(0x7f0000000180)='./file0\x00', 0x0, 0x0, &(0x7f00000007c0), 0x0, &(0x7f0000000380)=ANY=[]) syz_mount_image$ntfs(&(0x7f0000000200)='ntfs\x00', &(0x7f0000000080)='./file1\x00', 0x0, 0x30, &(0x7f0000000580), 0x0, &(0x7f0000000680)=ANY=[]) mount$overlay(0x404030, &(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f0000000100)={[{@upperdir={'upperdir', 0x3d, './file0'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@workdir={'workdir', 0x3d, './file1'}, 0x5c}]}) umount2(&(0x7f0000000040)='./file0\x00', 0x12) 13:30:08 executing program 3: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000000)="153f6234488dd25d766070") pipe(&(0x7f0000000340)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$UFFDIO_REGISTER(r1, 0xc020aa00, &(0x7f0000000380)={{&(0x7f0000ffe000/0x1000)=nil, 0x1000}, 0x1}) socketpair(0x3, 0x807, 0x3, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) getsockopt$inet_sctp6_SCTP_GET_LOCAL_ADDRS(r0, 0x84, 0x6d, &(0x7f0000000140)={0x0, 0xa8, "0990bbbecfa0832c8d8688dd53807abe841f12cbcef3a71c35e85558f044e6d77253a9356d6f93ddcaeffb77c4e89b9319da3fd8ddd73f32e185ace05c320ea8708aafe0dae5f7eb90d2fec65e9e2558f9f217ae886301dbeb42421eefbc6e0c774df6b46465ed20cf5cb44d1ecd2a0b5ff6840edddb4003c197e61ff9a043c0ec5507c474984c523858206990c403f6e1152ce4878d7b390ec9af142531c34fe78b3d87cf79d44d"}, &(0x7f00000000c0)=0xb0) getsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(r2, 0x84, 0x9, &(0x7f0000000200)={r4, @in={{0x2, 0x7, @local}}, 0x935a, 0x1, 0x1f, 0x984, 0x9}, &(0x7f00000002c0)=0x98) r5 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r6 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) openat$qat_adf_ctl(0xffffffffffffff9c, &(0x7f0000000040)='/dev/qat_adf_ctl\x00', 0x8000, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r6, 0x0) ioctl$sock_SIOCOUTQNSD(r3, 0x894b, &(0x7f0000000300)) ioctl$BINDER_SET_CONTEXT_MGR(r6, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f0000000780)={0x4c, 0x0, &(0x7f0000000600)=[@transaction_sg={0x40486311, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x40, 0x10, &(0x7f0000000580)=[@flat={0x77622a85}, @ptr={0x70742a85, 0xffffff7f, &(0x7f0000000540), 0x1}], &(0x7f00000005c0)=[0x0, 0x18]}, 0x2d8}}], 0x0, 0x0, &(0x7f0000000680)}) 13:30:08 executing program 1: socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)) syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0xe1, 0x400100) creat(&(0x7f00000001c0)='./file0\x00', 0x2) openat$dsp(0xffffffffffffff9c, &(0x7f0000000200)='/dev/dsp\x00', 0x8000, 0x0) syz_open_dev$mouse(&(0x7f0000000240)='/dev/input/mouse#\x00', 0x100, 0x10000) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000007000)={0x8, 0x0, &(0x7f0000000140)=[@acquire], 0x0, 0x0, &(0x7f00000001c0)}) r2 = dup2(r1, r0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000002c0)={0x8, 0x3f00000000000000, &(0x7f00000000c0)=[@release], 0x0, 0x0, &(0x7f0000000300)}) 13:30:09 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000007000)={0x8, 0x0, &(0x7f0000000140)=[@acquire], 0x0, 0x0, &(0x7f00000001c0)}) r2 = dup2(r1, r0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000002c0)={0x8, 0x0, &(0x7f00000000c0)=[@release], 0x0, 0xfdfdffff00000000, &(0x7f0000000300)}) 13:30:09 executing program 4: preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f00000000c0)=""/148, 0x94}], 0x1, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000080)='io\x00') setsockopt$inet_dccp_int(r0, 0x21, 0x11, &(0x7f0000000000)=0x2, 0x4) preadv(r0, &(0x7f0000000480), 0x10000000000002a1, 0x0) write$nbd(r0, &(0x7f0000000180)={0x67446698, 0x0, 0x0, 0x1, 0x1, "0ee9358b228e1be1baeac33962b7d59443057193e374ebd389ac7fc3d9fdd55587d938ec6cadee8982a2f525c81126ee901d2aec38ca9d90e9d9d5717d718b68db86938ccd3b04e46d3730d9c3852be17e91d06a4215ff9cae1a75a7fd5bae14856c5f6f58e737392fcfee6f83906a545345797ab58a1c459bea51dfd0c39f497b5febabdd76af1bec4fd69967925e14a8eeb40791a185ecf027295cb783b6bad148e50a2cb6926c3f0352fba26a3075a88c72a66fbf9eaf55c2b5d41eff8f5e4a3551deb82127b905cce10df19f1ed3a3384f0b3211010e1e5feaa84e6396f4f2c9e374b1fe8d7ba91b796422e5c7275021d3caff143edef0d1e63567272376a5a4bcd97e1b6705d46c03a7168d02846f29f450145826c96fc7539bbf35f240945cb40721b12a731382fd9bb28cd6d6bfe1ef390f420cb17b541628c7166c845fd2f20ad5449ec9c17147d590d6b656e7f3aca403c1cd5b636c5c3928fb9ce3c0f2440adcb693c853e597eae6cbe8dfa86d0949122aa6207da9d196d21fa14b735853464c6ae20c8945d4e722d9445ad1a9ade799b2b4ec4a1e12715faf00a0d9ac8aade0696950fa988b3c5a5a0216fd80a14593ec53034c431fe5d57e14fc59109d5e6b5aae33688fbc8de7317414461348486631aba8316298efe160a8c7e06a232a5bd16078e0657346f9c3ab1b30b7636cfc9f29fcaa095730833b224ef58d8ef96c82255e29c67663bf99b04c47e8e0bf2388d2fe2877601e3a5b997fe9f8617f0a7265701674aa6a18b3796ec7bf5406eb91294980c36a6fc30bd92ba4e6714f89ac4f0875f4c933a3309377c5805c65f7f7076acaeafe74d61471c43f1d7ece331ea3874627a5bef0fd90e0e93186287fc8891c75d3a870e8bb206fb8e15975f700b328c272ce99a8f80e31689d448c10e9fbcbe55eb65159ae4220e065367b239d9722237af7d6f68a907f32aa16cdc2df06186b70408897096f87825df0f92dca2583d23ab2a2753fd26741d28b53e8889f491db96f8d50877bf07331be26be154d98f808fc0082407550b69572b5cbe0bd519f09c22acab07e7c6315c18f238e0b6900fd05f99ab4b1cbdb6734feb80b327b20df9b95624ef7fb8198c698e14b41d8cb0a8552bd592f3cb7380493900c8183d0001cf9ceafa86c37ab330605790cd364fa288c548b322a4c78b17163c78b3fd95c29305ac7a6381b8259da805ffddcd7cd921501d998e1ee346e93265ae7124f99c365f4e33e243d9d38a7d9a93b9c9f726e5bfdbe92e051a81a69b804b22e7dd99b96af147d6d045ba71ad0aeb2bc3c2c3447270f0429138d09393df0f8fb8e80b320d2936e507177b5f38456a759fd025b27537fe818f48ca60223d3eba22ca3d185c2168a45bf9418d7beca94288ff1a1916695e14c9a211957d9720197b70b795baf82e14efc4142521f3531b8ea2a461c85ccc77bfd055b547b779158ac20e2da77afb00bdb78c59f58673e9a0bdd6c82c7d7633e0ec9e12dca8df3723b63fa67b266200fa7db635f65f18461e9434716bc79cad8239a182fa52f76b7dcbc2aabc877d927b8db711ef48925b50650bfe9ca0b13ee21fc427c62525d265337eccc719a5882d94fb378068bcafe87f903db196e5206e392a4243903f3bc600ae13266d7e937c7c3f7a316080c2722460c3fc7438c43ed60c09f11d8197da73ba10a5b99d44446925b3c58e1783f23343fa41d62735782f89f34bc0d731c2da67343e374efa0fa4e019e03d7fcad15fb3c7a7dd148f3e2042029c1b9967a874542fa40a8b5c2b2d09d3df471942512afe170e63f0113f9130e0531254d9d282ab3dd25f55349d8edfe881fa0fa64935fc3581a4a16f2dd67cbad28f7b15b547a6abd0942c8d770cdf09f421725ec7b37637ca728b6d7a419902e402342246bab6e11c73af52eeee52a3bbeb09876b5e2b5c55f7a42b48eecd92a2926054594a2e62237c2069587e89423c7a32a2831d889aa26a0d710badde34384870f9bffa4f2d18ac1db89b11798aa9d46d658b6889636bd990135af78345b6ba148e6844c7767076e7ca8c6473a40fe0fb4f14b3951a3e4f47ac278b426819640f3c8d8e69933885c87b1f5bba079ddf8aa128f9b0270017555414814b7baa2b5067987b091ec8ffb3e4c4e8a1ef1d87476d3a7bb8c6a0945d2c94fbb0ada2ded6c22a5c5cfb3035490738aae07925bd97f4ba08352075d0e0d48d57fef225c0a43270764e4866fa58fd686f63f8978bd20404df60cd053eb8f62f88a24c91243afdcf7f49313ff8977b318e76caf6471db2c4eb2c8f4dd8eb6f233493aa5b35009459798bc2d7410851e2d548c329168c110230124adfa9b00155f68155fb0bb16668c2b3f3c1046b07eeb1d3c483409e9f8df47baaf4a559afe24c9463dda13feb314e1335fad97c0ba11219628e590574e37443541721b5c9da408c39d935c3607283706c23e3d7654112c2d2c0d613f7bc1dbc2b2a2da626b439adfd97dd1b40b1c71ce6947eaad1c0440b8cdc2aedd28c093f0582f1b3e2cad0f2a30c9f2f21d0e48c6e804dd89185cabf863bba62c9056e46aed1677ac126b2ae3c3a0cff6acf114c6357b4cae0796d71ef2f959b8582244df6257b89872daa72001430e37a8858ff14c7908ae413395c7193aa668c18cd9657a52009c70c727ec9ed4b10f0457018feee931d78fe032d15946aeb49ca55af0d7778b026385f801b42a42c3168b8dbf2ef0c27271e24f085777d6a7929df0a7e764c61e54987b4c7d6b772d55a44d5882ea408388e44e0505ee728ab395caa693d9ef4c4fa6eb4bbf4febd6ebf01d676d0479b0e385392c8b41be8467e0b2e12c62154d3132f470b2b41cfd3e1fb4ad4d747d631382db447c2053296b93b3a78c0249205c94399c246f0b95617537fbf7c6abc30473e84f29407ee33d565febaadc7ea002cd822d8fa3af6e0577f018f2499e28a2cd0ca3c1bb4be18648f485c8aad18ef71c4d92c0a7ffd23f08b4306e5e9604e7fdf999f975b9e1de6311fafb914bd2fdfd3d70f407a7c90e875b8c68cfe274271fceba487853fcaf87a908edfcf779ad0fcf542e6489d5bb018ae1607c0761895ac4827a724b82100c975d121a80256afb06181a9b26b39f863103a670dc7a373c042bb1ee47a47c076c413610a033b6d21ef4b855f7b8214b52f71aa35e0d79a3321ddd2711fbf9ed15cb6108058e0f4c9a98dd47572410931feff1731394394f6f3da4bb9e15dc85da63f8a20f7c88ddc9191e901e073d4cc7125524c303327e2b6281b4c659cca5aa796e122349670d3785e38576850c755c222ae852d3b12ffbaf3af0e22a2fe139a3baccab0a6b3cade621927057fef7165dcdb358ee9238d51b556f842892d3f90d60899cc2b2f6272963eb68d6f02729f9fed91b642ea8f5a02b9b343720f2f149a3e07cf5e05102915b176effeec34edf8439abff0f852dc24e871ce1f8ffe0ed3818147a3c307ac5c588a9f308a0fee4d71bc8c15800c22053c004e83f78ecab56a70d4c415f28a30062fd4bfb7d975a2b67e83013e8a4783b660a935e7c3c296fa5a5c29372a5e74820eb278786ac44bb247a76705f54f20fb3efe9c1013b0754b891672db59beca81ce9f3b929de5c4d38259860d7e2cf07911ad19c07f25bec457012aa1dc9eab16c8bb24aea0d177ee7c307cea13ac2c6a10ade65be56898540358306a69fad6457ed2149e48e87183730bf8c4781290674bbdceab29fa35f16d4b483ccd4f98b6004e69ecacef0d40b4da1359a465169e1cea52d4f12d4d67d791d31b1d58444da0939af110ae39241081ec2ecf5c34da7f9f448e248178a55c8a21b5d17ed6a4e5a5ceaac304e4bce1dfb7735ca733b7f6a88561a9bf97522edc6bf9670b728fa8a126f9b05557a391c346c0f19711b535fadd3a586845722e1953fe33dd2ddc43cc594e85d9ca576072e1c57f51f5993a2fc341ee4be5e3b4ae57177786e8d36678e70f304e2773032c9a332e04cdbefc065fb256b146cee6cdc6a7fcb9b24fe4a3b1deeff0cfe4b53eab6dd3ba712c368849f60b56e1f8376d253693a170a1ec51b7185ad48fc98d46fd375e34469026cc9a62347862927b4b99c56609fba247cf928b2c5f5c7221a0633ae2e55ae51bad08c48443c03f755b4af6c1f29d6e066da1a89723dbc29512b4d2c6010752605391ae8b4c5b03e4b745b6fd21656befef8ec5e4015cae2445bdaf1796c5cef77ed2fe3ba90d8e790cff29f5f2d5fa3555aaf80149ad291861c6fb4379c525c32aa0561e4a935f72efc856ea1758989534e7022840bbe0221f01a6ca58c5af9a634c575d596b4baf1435f961dbba80386aa9d3203bbda27fda2e53498cb2f911ea6075d9f5a8a847c7328ccd5e0afd93bbce39380967c541e80c50ef807022e92a8b859186eb2a40de65d5cc583c7feebef0b4ca571939af9e732a85b49cbf908871cad8c01018d0002246e628c6052f625f3847f95bf4fbf15907e256731d4f518001b0db13a3735c523fc99e0c2390404ba9960c324c6fe2356e92fe6cbe1becc997112f77df2ac57d1ecdac46763474e1da96fccfde1fed8bbdc99d88b119ae9aa8c01a02c9e97c727afeb04cd61d515b8fdd48e9c2589c66939f0c80e2d4982aac254ea174baeb7ce45397b775c96e1bb0f4577eb3e15f1e97a32ef1d837e9b31b9390e6186a53d4e325a10dbb45691e1f5c32064d1b66879290a593a128bddc4382c78dec8edbc3956ebc0c6baa38e410cb21a93a6b9e983423ef0340e860e626a17d7b95dea5e6303e0d5cc3ef4269115f6bee5b9d3293e537c1e1769fb200ef00b04addd7f6b5faa17e8803288797b208f03323357a43404bb3d7c21b8f14b5f99ec832b2b29945c1a4a667b10120700280cfc8d22eca35fa4aba42abea465700880469b99528c9000390590fc305147ba0f8f51617fcdb53043c7d42dee72652f99f4b19a9a2f1c7c54fc070ac39b6f81c8c347a5ca75560499568731615dfd3ad786f1da39338962c7a87508640c1cff11136876fce42f55aea17c95b1ca70d5f6b637b27061bc9088ad1b7c6bfa71cf03f1a5e1802ec79fb7ff52a185759c869c08f5a1a807d85769fd8f6c3a5dd8d3fe0a64e55c7170f33e1df965a8f026b5e711c1a23e5724b7c87a885cf630e775d6d9da4e05ca098f3acf7273ba9c67abaa78d6fd33c05b0e24229e14985311ace52baa80659ff77647799fd88fd61a7b1988afa77f7109e56b16b7dd9c85cbf61540a2abf1378c631c79f824c86c1f6edab00a737f4868e36baa8f1ac9f00ae19b1a4082cbfbe7dacb330d1818dddd49bb9d8f5386ee2f419196bdf92173f1faefe8b3c62a195584ad29f21f0bdea821bb00f80dc9c70e37c7d35a8cecfabec05f9d8515302262702da86741a2d51f137c04c0c048e8bef3bd11e9cab35a3a3dd2d7b40f6e4dfb941b9a470527f7fc11fca2886c092f1acb6c18d5675983492a22c192bc0ae1f8a16697461216fcb2c3ea49b91cb3a2aaeb6a9ab3db21b8359da12526b38cb98a13d54bf9248db069f6d65c7f179c3725196aef250454b06087107c2e3f765dcbb54836ad7bd9d17f8a8aae1967b9bb8bb73c011d2e1a9c88340fbf41982ac1affa197a9cc53f069ca2af732a000ff418612f5a6d1fb5de62dd54948433b2d2c487fad5a5af29bafc0e8e7999abe17512cf5afebb8693396de17beef433888aaa6dbdb24faf44800cdd7e1a14dd5b87349fea293904270b07b51d4822e5b028"}, 0x1010) dup3(r0, r0, 0x80000) openat$dir(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x220000, 0x8) 13:30:09 executing program 0: r0 = socket$inet(0x2, 0x4000000803, 0x4) bind$inet(r0, &(0x7f0000000000)={0x2, 0x0, @broadcast}, 0x10) getsockname(r0, &(0x7f00000036c0)=@xdp={0x2c, 0x0, 0x0}, &(0x7f0000000080)=0x80) setsockopt$inet_pktinfo(r0, 0x0, 0x8, &(0x7f0000003780)={r1, @rand_addr, @dev}, 0xc) syz_emit_ethernet(0x4a, &(0x7f0000000240)={@link_local, @empty=[0x0, 0x0, 0x2000000], [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x3c, 0x0, 0x0, 0x0, 0x4, 0x0, @empty=0x9000000, @broadcast}, @udp={0x0, 0x0, 0x28}}}}}, &(0x7f0000000380)) [ 567.789333] overlayfs: failed to resolve './file1': -2 [ 567.801121] binder: 28014:28016 got transaction with invalid parent offset or type [ 567.825556] binder: BINDER_SET_CONTEXT_MGR already set [ 567.835949] binder: 28014:28016 transaction failed 29201/-22, size 64-16 line 3157 [ 567.845102] binder: 28023:28024 ioctl 40046207 0 returned -16 [ 567.873591] binder: BINDER_SET_CONTEXT_MGR already set 13:30:09 executing program 1: socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)) syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0xe1, 0x400100) creat(&(0x7f00000001c0)='./file0\x00', 0x2) openat$dsp(0xffffffffffffff9c, &(0x7f0000000200)='/dev/dsp\x00', 0x8000, 0x0) syz_open_dev$mouse(&(0x7f0000000240)='/dev/input/mouse#\x00', 0x100, 0x10000) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000007000)={0x8, 0x0, &(0x7f0000000140)=[@acquire], 0x0, 0x0, &(0x7f00000001c0)}) r2 = dup2(r1, r0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000002c0)={0x8, 0x3f000000, &(0x7f00000000c0)=[@release], 0x0, 0x0, &(0x7f0000000300)}) 13:30:09 executing program 5: syz_mount_image$btrfs(&(0x7f0000000140)='btrfs\x00', &(0x7f0000000180)='./file0\x00', 0x0, 0x0, &(0x7f00000007c0), 0x0, &(0x7f0000000380)=ANY=[]) syz_mount_image$ntfs(&(0x7f0000000200)='ntfs\x00', &(0x7f0000000080)='./file1\x00', 0x0, 0x30, &(0x7f0000000580), 0x0, &(0x7f0000000680)=ANY=[]) mount$overlay(0x404030, &(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f0000000100)={[{@upperdir={'upperdir', 0x3d, './file0'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@workdir={'workdir', 0x3d, './file1'}, 0x5c}]}) umount2(&(0x7f0000000040)='./file0\x00', 0xfffffff6) [ 567.886328] overlayfs: failed to resolve './file1': -2 [ 567.900992] binder: 28023:28024 ioctl 40046207 0 returned -16 13:30:09 executing program 4: preadv(0xffffffffffffffff, &(0x7f0000001380), 0x0, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000080)='io\x00') r1 = openat$apparmor_task_exec(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/attr/exec\x00', 0x2, 0x0) ioctl$EXT4_IOC_MIGRATE(r1, 0x6609) preadv(r0, &(0x7f0000000480), 0x10000000000002a1, 0x0) [ 567.955755] binder: BINDER_SET_CONTEXT_MGR already set [ 567.961110] binder: 28014:28033 ioctl 40046207 0 returned -16 13:30:09 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000007000)={0x8, 0x0, &(0x7f0000000140)=[@acquire], 0x0, 0x0, &(0x7f00000001c0)}) r2 = dup2(r1, r0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000002c0)={0x8, 0x0, &(0x7f00000000c0)=[@release], 0x0, 0x1a0ffffffff, &(0x7f0000000300)}) [ 567.999559] binder_alloc: 28014: binder_alloc_buf, no vma [ 568.030553] binder: undelivered TRANSACTION_ERROR: 29201 [ 568.038288] binder: 28014:28016 transaction failed 29189/-3, size 64-16 line 2973 13:30:09 executing program 0: r0 = socket$inet(0x2, 0x4000000803, 0x4) bind$inet(r0, &(0x7f0000000000)={0x2, 0x0, @broadcast}, 0x10) getsockname(r0, &(0x7f00000036c0)=@xdp={0x2c, 0x0, 0x0}, &(0x7f0000000080)=0x80) setsockopt$inet_pktinfo(r0, 0x0, 0x8, &(0x7f0000003780)={r1, @rand_addr, @dev}, 0xc) syz_emit_ethernet(0x4a, &(0x7f0000000240)={@link_local, @empty=[0x0, 0x0, 0x81000000], [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x3c, 0x0, 0x0, 0x0, 0x4, 0x0, @empty=0x9000000, @broadcast}, @udp={0x0, 0x0, 0x28}}}}}, &(0x7f0000000380)) [ 568.069716] binder: undelivered TRANSACTION_ERROR: 29189 [ 568.088144] binder: BINDER_SET_CONTEXT_MGR already set [ 568.092432] overlayfs: failed to resolve './file1': -2 13:30:09 executing program 3: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000180)='/dev/uinput\x00', 0x2, 0x0) write$uinput_user_dev(r0, &(0x7f0000000400)={'syz1\x00'}, 0x45c) ioctl$UI_DEV_SETUP(r0, 0x5501, &(0x7f0000000300)={{}, 'syz1\x00'}) readv(r0, &(0x7f0000000000)=[{&(0x7f00000001c0)=""/166, 0xa6}], 0x1) r1 = syz_open_dev$midi(&(0x7f0000000080)='/dev/midi#\x00', 0x8c8, 0x101000) write$nbd(r1, &(0x7f00000000c0)={0x67446698, 0x1, 0x1, 0x0, 0x2, "fede262523393aa387bda3c25bc40e5ae12c4bc0baf9376e8d8f56623d05ede7ff1dceba0023e3344f953b6019b8ab013eef4e145e55244e55580478a7643ab2c86cbdaecf352b428a36f0cf69de7752c6a6f02b95ac"}, 0x66) socketpair$inet6_icmp_raw(0xa, 0x3, 0x3a, &(0x7f0000000040)) write$uinput_user_dev(r0, &(0x7f0000000880)={'syz1\x00', {}, 0x0, [], [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10000]}, 0x45c) [ 568.128755] binder: 28055:28058 ioctl 40046207 0 returned -16 13:30:09 executing program 4: r0 = getpgid(0xffffffffffffffff) process_vm_readv(r0, &(0x7f00000005c0)=[{&(0x7f0000000000)=""/49, 0x31}, {&(0x7f0000000180)=""/79, 0x4f}, {&(0x7f0000000200)=""/201, 0xc9}, {&(0x7f0000000040)=""/35, 0x23}, {&(0x7f0000000300)=""/160, 0xa0}, {&(0x7f00000003c0)=""/197, 0xc5}, {&(0x7f00000004c0)=""/72, 0x48}, {&(0x7f0000000540)=""/95, 0x5f}], 0x8, &(0x7f00000006c0)=[{&(0x7f0000000640)=""/74, 0x4a}], 0x1, 0x0) preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f00000000c0)=""/148, 0x94}], 0x1, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000080)='io\x00') setsockopt$inet_mtu(r1, 0x0, 0xa, &(0x7f0000000700)=0x3, 0x4) preadv(r1, &(0x7f0000000480), 0x10000000000002a1, 0x0) 13:30:09 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000007000)={0x8, 0x0, &(0x7f0000000140)=[@acquire], 0x0, 0x0, &(0x7f00000001c0)}) r2 = dup2(r1, r0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000002c0)={0x8, 0x0, &(0x7f00000000c0)=[@release], 0x0, 0xa0010000, &(0x7f0000000300)}) [ 568.237092] input: syz1 as /devices/virtual/input/input19 13:30:09 executing program 0: r0 = socket$inet(0x2, 0x4000000803, 0x4) bind$inet(r0, &(0x7f0000000000)={0x2, 0x0, @broadcast}, 0x10) getsockname(r0, &(0x7f00000036c0)=@xdp={0x2c, 0x0, 0x0}, &(0x7f0000000080)=0x80) setsockopt$inet_pktinfo(r0, 0x0, 0x8, &(0x7f0000003780)={r1, @rand_addr, @dev}, 0xc) syz_emit_ethernet(0x4a, &(0x7f0000000240)={@link_local, @empty=[0x0, 0x0, 0x3c], [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x3c, 0x0, 0x0, 0x0, 0x4, 0x0, @empty=0x9000000, @broadcast}, @udp={0x0, 0x0, 0x28}}}}}, &(0x7f0000000380)) 13:30:09 executing program 5: syz_mount_image$btrfs(&(0x7f0000000140)='btrfs\x00', &(0x7f0000000180)='./file0\x00', 0x0, 0x0, &(0x7f00000007c0), 0x0, &(0x7f0000000380)=ANY=[]) syz_mount_image$ntfs(&(0x7f0000000200)='ntfs\x00', &(0x7f0000000080)='./file1\x00', 0x0, 0x30, &(0x7f0000000580), 0x0, &(0x7f0000000680)=ANY=[]) mount$overlay(0x404030, &(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f0000000100)={[{@upperdir={'upperdir', 0x3d, './file0'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@workdir={'workdir', 0x3d, './file1'}, 0x5c}]}) umount2(&(0x7f0000000040)='./file0\x00', 0xf6ffffff00000000) 13:30:09 executing program 1: socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)) syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0xe1, 0x400100) creat(&(0x7f00000001c0)='./file0\x00', 0x2) openat$dsp(0xffffffffffffff9c, &(0x7f0000000200)='/dev/dsp\x00', 0x8000, 0x0) syz_open_dev$mouse(&(0x7f0000000240)='/dev/input/mouse#\x00', 0x100, 0x10000) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000007000)={0x8, 0x0, &(0x7f0000000140)=[@acquire], 0x0, 0x0, &(0x7f00000001c0)}) r2 = dup2(r1, r0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000002c0)={0x8, 0xfdfdffff, &(0x7f00000000c0)=[@release], 0x0, 0x0, &(0x7f0000000300)}) 13:30:09 executing program 3: perf_event_open(&(0x7f000001d000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket(0xc, 0x5, 0x20000000000b) r1 = syz_open_dev$mouse(&(0x7f0000000000)='/dev/input/mouse#\x00', 0x9, 0x402000) ioctl$UI_GET_VERSION(r1, 0x8004552d, &(0x7f0000000080)) ioctl$SG_GET_TIMEOUT(r1, 0x2202, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_INFO(0xffffffffffffffff, 0xc1105511, &(0x7f00000001c0)={{0x0, 0x0, 0x0, 0x0, 'syz0\x00'}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'syz0\x00', &(0x7f0000000180)}) ioctl$SG_GET_ACCESS_COUNT(0xffffffffffffffff, 0x2289, &(0x7f0000000bc0)) ioctl$TIOCLINUX3(0xffffffffffffffff, 0x541c, &(0x7f0000000940)) ioctl$FITRIM(r1, 0xc0185879, &(0x7f0000000040)={0x5, 0x4ff6c756, 0x100000000}) openat$ashmem(0xffffffffffffff9c, &(0x7f00000008c0)='/dev/ashmem\x00', 0x0, 0x0) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r0, 0x29, 0x20, &(0x7f00000009c0)={@loopback, 0x200007, 0x0, 0x0, 0xc}, 0x20) munlock(&(0x7f0000ffe000/0x1000)=nil, 0x1000) 13:30:09 executing program 4: preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f00000000c0)=""/148, 0x94}], 0x1, 0x0) preadv(0xffffffffffffffff, &(0x7f0000000480), 0x10000000000002a1, 0x0) 13:30:09 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000007000)={0x8, 0x0, &(0x7f0000000140)=[@acquire], 0x0, 0x0, &(0x7f00000001c0)}) r2 = dup2(r1, r0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000002c0)={0x8, 0x0, &(0x7f00000000c0)=[@release], 0x0, 0x3f000000, &(0x7f0000000300)}) 13:30:10 executing program 0: r0 = socket$inet(0x2, 0x4000000803, 0x4) bind$inet(r0, &(0x7f0000000000)={0x2, 0x0, @broadcast}, 0x10) getsockname(r0, &(0x7f00000036c0)=@xdp={0x2c, 0x0, 0x0}, &(0x7f0000000080)=0x80) setsockopt$inet_pktinfo(r0, 0x0, 0x8, &(0x7f0000003780)={r1, @rand_addr, @dev}, 0xc) syz_emit_ethernet(0x4a, &(0x7f0000000240)={@link_local, @empty=[0x0, 0x0, 0x8100], [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x3c, 0x0, 0x0, 0x0, 0x4, 0x0, @empty=0x9000000, @broadcast}, @udp={0x0, 0x0, 0x28}}}}}, &(0x7f0000000380)) 13:30:10 executing program 1: socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)) syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0xe1, 0x400100) creat(&(0x7f00000001c0)='./file0\x00', 0x2) openat$dsp(0xffffffffffffff9c, &(0x7f0000000200)='/dev/dsp\x00', 0x8000, 0x0) syz_open_dev$mouse(&(0x7f0000000240)='/dev/input/mouse#\x00', 0x100, 0x10000) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000007000)={0x8, 0x0, &(0x7f0000000140)=[@acquire], 0x0, 0x0, &(0x7f00000001c0)}) r2 = dup2(r1, r0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000002c0)={0x8, 0x1000000, &(0x7f00000000c0)=[@release], 0x0, 0x0, &(0x7f0000000300)}) 13:30:10 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000007000)={0x8, 0x0, &(0x7f0000000140)=[@acquire], 0x0, 0x0, &(0x7f00000001c0)}) r2 = dup2(r1, r0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000002c0)={0x8, 0x0, &(0x7f00000000c0)=[@release], 0x0, 0x3f00, &(0x7f0000000300)}) 13:30:10 executing program 4: preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f00000000c0)=""/148, 0x94}], 0x1, 0x0) socketpair$inet_smc(0x2b, 0x1, 0x0, &(0x7f0000001200)={0xffffffffffffffff, 0xffffffffffffffff}) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000001280)={0x0, 0xffffffffffffffff, 0x0, 0x3, &(0x7f0000001240)='io\x00'}, 0x30) ioctl$sock_SIOCSPGRP(r0, 0x8902, &(0x7f00000012c0)=r1) r2 = syz_open_procfs(0x0, &(0x7f0000000080)='io\x00') preadv(r2, &(0x7f0000000480), 0x10000000000002a1, 0x0) getsockopt$inet_sctp_SCTP_LOCAL_AUTH_CHUNKS(r2, 0x84, 0x1b, &(0x7f0000000180)={0x0, 0x1000, "484a13c1f1c8641eff7f6de77b3eff4663d6dc19bd90ab79f136fc90061dd7474fb435b2d8a3e7d9b2a47d94ee9376d829afc9d43666c51e40526f45d06280f04f797775a1d793f5267c727c8ac130cb19845330a2cd28bb1c890c562b91b7f40de1e9a998ea3d023a66e13a39f9ff4bd9eb5949f9d74b5dadb4876a2a9673a4927016847490eb340f77221e20c60515e8ea5018e24d0270477ae16628bca22d190bd6646a0c5beffc3e9e58467c01d2899befcf82d7bc7571324bcb3222ec2fbc3fab99788b604a2e1378bce54b9c69940e77788343b0e949b833c6cd511119ef97fb877c80363183161dbd3629cbee51057267b11d42813d4578c89713099dbfd6b56b76b1e3bee0ce600308e846e50fdd66ad09f6ef5b1b107c106fe7472e602f42f5ee24ea2fc21b59bd23c228b93ff01acdf9ebb9e48c758fc74d0a4618821519648811887e54def3956c84ef397a634ec36fc564445f1d53cffba15e67f033ef4256a622d81ba49989856a0714bfc3291f5614c30f81c5f08f53a0b3bbd691285b6627f2e7e5e1c347acc3c134548c89902139cff2d1b226954920d6fa2e4a1aaa860202e0d225ce75ea5b6e75f2a006ab091a3516ec0bcd18f2f25e77e558f5ed8b096af6e353ae3abf65aa77d92afd5de828cfe0570c9193d1c3a6239d34f9a0b2886abbf0fed67ce9b2023a85aa72ec187b729434c11d17f40dcb8c11ee7a310c49b02c116ce8462fd7a007b7c29146aa4eeefc48b400e4755727d1af5f6e8952149786d4e1e4c058c2c9a7621451363f25ea41ede3cc6e58efb1bdfeff3af56da40aece0514ce288020b2810dca2ff94ecb7190c8031cb6d049837848e24408bd3e464c3cc04ce0dfae8c23dcd4cacd30120130f17359fa75cb256c8f57602c33eee76b3ff5adf23c978dc6aa0665ec22c463239552694aa2cb310aecc022a67b52ff66f442eb05679ecef7e817abc78aebd1f6adf7bfa07a1507c56db499f96471d707cce450612f13d37633fa2efc4d66617aa6abdd8d0320a3ce7f0ae72edd45ddf57792bb15ad7d88e0eed4cdcedb5f9b236d264fe398be01b455b0eddf9746b6ed2d31a6494f6e0542700bdfd08c9be215f5c371a691b065d46625b0ad20a991d0fc171e52f11c0bce026d7f2cc02fee03e07a7b21169dcb93e5d9ccdb676566d570aa1029724dd03c27067eb13b0254832581ae3f591a0cbfec54719b078ab98e86c8339b3b3e9a814ea3b2d367a2f007440dc74b6552849f180c33ad1bd30e22f68d55862d016f247e3c26fee7d237bec43c6a8ea69e2fbf18304ee704aab9a112ceb931899662e73fd8f71f0ccf98e13c2132952b5e0dc226ec4d0639b86d9c3046900640eb6104080fba0b359579e356d5e99a6c5ac13c98b9a0817b6bd4cf96eb1699b91675ec97080d0acbdc72e927e0e74d230d107d82898d3def096ccd704484e5aa800d2bb4b0718f72e8a577aa0eb0c57f36dc6ad1dee480672bfa2740d97f6801392e08744bf4433a2eaf029a05542a8d6355ef0d9c78a7b37beefdf1484916414a36163b04ab549280a8b2f7522951062b0eef13ca17334c3dd37b41b9f49bb9698578d900cf1679f74f34de851f991db84980782738e41cd0003e15900343680fc8b5d42b60260bbfe1ec5fcd72d47138d14f181d93013f86903cc39254eabf592f2d8948399db2863b71b43f85897b1d0eabc973d1b45d430bd5a189121233a771eaa6f1a97d283af96f1f9a4105d17657f05b683bedfa2d00b9e904d81621fa216b32fea5c355de9f7a220025c964fa2152bcb9be785dbb43672c02f65eebe20508953e511829c0f00ac52ff4ff0aa2457ae05ea9d60149f0725bfa6fefe942bd1054f0cb31f6d8a6a0c32e568288b507ad036b6ad189081426a5552af1a8164444b3db5b43f74e9f4c14313be1c442fe9bd718e4329b497dd5f49dab78bf1b7d8efae3aaa3df3e53c93eb360864c1f3dfbae99bdefc01bc84b4bece800a529765bedf7540903fae3f0b890b129e13393be9f9106d79b629562867ff6e5224175085596dece039409c5ce61c1be04bc190b81fad331186c14c249f7cab0c8059e4d5f7c4739674d4a5fd378c47774c83689f6da9eb550266dffec65106e07309ad62c725713b031dbc4e643837ea451b949ab81d5ba6e0f8fb248db31bf5fd7d1512ba3d8cb37e6ac8f886e9811acf9b43be4d2449ac0875d3041553635ea6ba65d7a9a69ef7b7b3d57483584dc3aba8f45c9f58236adcba84d8be9c81fa90ea1aeb5006626bdfbf13c079c925e0ec883d6ce41094a5d540c0f90a926d661d17eb35c48a8672b40c117d4a5631aaf9b764f5ddf7401dfc9559492be2b61cf7a27b24792dce81e6f2e6240a01775640b0873e8569f0774f2e8d54901a702642759cec33ae5995834258cc4bfc10d10313088d26cda2b0bd70f5b7fc2fd7b179a34e21c51115d386790e3575980e8790196167498606419778b6fefd6cc3c874d8e1ab557009a754202cdbd6f4991a6e88fb2e3cf73969a507eaf573b3e32c7c37f3281d51f8830a98143e1ce54bcdc5e739ad4fd68261e43bc5e089a80dbc91ed46b2d9e5f6cd5c9f66cca926b17bc425c01b5a688640c7c25165c105bb6d66c25c2347fc8d8153d45da5db1a32d19ca615e587388b3e201632d4efdeb8e3013c119152f59230b5d6ec13f85a83188b75c5f02062ea9b11bb32d0234954c5d6cabdb3019016aea766a28c2f930b426d7172b2da27465e02295c3b77b91bf9bb84fcc4f43aa9646144f0d1674e37b5552c320d7a77d80e2d60a1a1a603880188db03b7c7d10a9695f904e0ed059499a5595d38bca40d168f0b2ecc04f6a3601ef5d841dd891746efd6833f0a0f0bd701afc1dbbbc3e9c0d0aa4993db4446be31be0d549c28d873aa4163d0128e932fed0def13d651637f4557bcb3bbc8f2cb27aabd3172c36cf6368938fc6dd11f5a40fa8cb35cc53bf9333b9e2d1eaf07248471888740cba3895e8410b69ef9ef0088fa5c1441a2a36e794ef8ea58f7102f4eb2b8d02313ec0aa8e90eb8be71f9877f44fb5fb69ba29ba688db02675cb92ad2f04c6f97be59a24fe730b629710cff6eca275d0b25fbf3692c3e6128b18e9b2c875dc3b93d93261d16ead5059c9a0882f9f1e0d489e07fa5213efb64d5b454cc4061f79700ea8c1a3eddecf7d7ad82b9ecd1e0af08ee062cef4330c2a4228c3b207dd7668a25f409762f39ce7c4de311a5345eaacd0166757d2a13597a364d4c9d9bf58a15596c0328769590eb1649d2394b34223fd896e39ff96000ea3f0cd33c2fb524eb24eaf9538c324bc94f82e5881206b87805036eec8836693199933222a5e224666c8f1a60167421b8c975ad80a0c47f7a354990487a846981256c387c2379663926ad068d8c15d0a4c4d517885f08a6a574d0456dca9861cb2d8b75c5f6d545ac68fe3a0d55842818d87e50920ba7d71dff2164a04cf2bbe5de73c1caee6e5999a64ec8c6d11a7c5b822a41416de4fc457bb43c50ead9b4bd809b44948b43d567b9955692353656e7ed3fca92318159829cfc484d0f01354c9d844d77a0d271c6b6966dce7b72c3cde68ffeaed357fface9271d65b1a7f2ea7508680d6a2998543262ab664e9261902f8b7a7eab156d622486cda4ca1d9818ed9f25d5f112052cd56d90e880e7659583e4653074eb593102b4f527209128ef2a6d78bdc9ef90cfbff4daf22b924674089a42f4fd61a60d273d3964f4f2b86876fb34bad53ded57ede08af4198d12fdb11379288ffacbcab96b05c34147ddc26feb80d4bad1cc129caa5a7e69376a81266e850279529a80a69c39d83a74342f3d5defd81a4c737ba75ea67557eaebaae5676e1edf2f11fc08209dc0b12a118c8ad0ddfa1190f7e84f239d4b08a84bad4500df40f341de77025f1e31949c930f12c02f1602c940b324ebe379033973424b0b4e74d4acf86cba20c2ab30a323526913165b728c9593d2073e073ab7448df2f70259ed3fb279d4d784e961b36716e5fcccdb75431657ef3fc5ab91c1f4469ba78cf6b5a01af332015dd318428b8721bf05e308da767e260b2a2560ee0d75d23b13ad1b74bc913534720406850d7cc25438dee98877ff7a2a66b0f985ddcfb1483580eef77cc6edd17f84551a77520a844fa8ddb3e6efb4b2bf92f58c112d45557492da724ad1160b97e2b5d268041459902be59eb8070fc1fd504c5c2cfea5eadd909d99c6a8c438a720f9c06c11161ee39197466937aa0fad2ad682ced561a2593c03b8356cb9959067e46a747938bac6d61639ee47753d6d74b6bdb46b8d62533abdd9e740d5898b306bbe1e51b50dd63de32d469ebb82e793c6acfea57caa55843f6fd110470f5729e1ef74c529378b8d9dc2a66c0e2a6ab920b89b5455af8ffe5dcfc5b254378cd4adc60e92cae81e2cc82766d1899fd0d845dc107217206ed83b08875fa64371dbcc53d9827e3b487dd6b4c9eff4e09ac19767153d073cd2e3f456ea9b8548cf30cd929dcb6ed61d2693f32451347eb9ff6bbbb0fb3770b5c49436e5e8a3a9d9df231e7c3b9bbe123d816b410ac6f0fdc375fb47709e574d8e8d8babdf454925f14205c4a2f9daa4b3cd8af1b3884f2dc1ad0bbe1d249046728c631022a3b0d3ef72b3453ec1e276140ecfcad2171313fa9f4eeb9ae7bebc3f28b1b994e3ae16a7e8eaedf1c87d3a6d8630558e9e7bfee31a576904b9232bb56df42a4ebe594398bed73889765aa4671436582033e45b60d22c9cbac509787fce7b3aa9cc2d5cfe56b3c8ad1484c691c79d82ea9d38b08f0e2009599d195cf2d8c19420f24c4b017c682e79862e7be164d09b5a66e44bac9211e1cb7a819435bc892d9dc779cafc74fe7dfb39d41748260baedada4bf360f2c2d83972facdd3c7aee756539151d242f643d2bb3c53be9f0ab40bf4cdcf3ace30944e77ae6c2eb23efc773e38f50348827709c5d7363616048a260aabf91f7620d476eb2e5a92aa4950df8408d382db255ec8a2743923257252c4d46242c97b84e18b933574518659a0e0ddaef6c8cd0752fff378e9a1dee1b8c855e0ff620414e992dca60dd7074dd919c6469cf7a486687f229cb5c3fbd62cd55e6c84191b8cac9a2bcf97a71f4aa311b5c44c3fca47a5d4748bdf8eb8bdc3afe739a113bc0a1f560f68bf836baede587329681c4d2c72be66745740201e5f50a3d9e011ad7b0eab23dbb2ba5036e0e269be0e2c9b07d60a02060e31f863f53cc83133eab40f53d3aac9d27517ebbd0212661fa0270054a321912796fb2d7f71f6246996ae52695af229158ec6276a5a4f65a99c8ea7b3128abf2c43e27c2ef158d9f98c6b5ebf7f4598ba2a8d01a0106ed9dbc7b114eb434d0955ed86ce9a845d3e083e3d8c2095395739cd590b5bf66eae4165e7f7bf7c49a573f6bcc86467d1da716bc41478f1574106772c89c1fe117bd24168c9b7e26d8159da62f9006268f307490362a48d10680e41260bf9cf85315bf7cd60ca6d7ca2e3a577ea1cba25c9beeb8eb5e18d9331cb083f7251a75efde18afea9fce7d34ad546b4c03c7dd3710c8273b6312be2922ac4344b6d1ea9e6729ee9e6058405c842c6f1a85613c7c41ee05937c29b137a86ddad320cc16a2530899d7cbd6858705a9a139ad55b3bc3f62dc1305af2bd7e830057904e72bd4225e6ffdcccef886d0a7a5f6281d13f9a123cad70722e931ef5e8cc1019f56b22d66d8be959f9535de0e0353cdb7a5b6139cd8a8a4d5e3e1add1c9b"}, &(0x7f0000000000)=0x1008) getsockopt$inet_sctp_SCTP_SOCKOPT_PEELOFF(r2, 0x84, 0x66, &(0x7f0000000040)={r3, 0x5}, &(0x7f00000011c0)=0x8) [ 568.779260] __ntfs_error: 1 callbacks suppressed [ 568.779271] ntfs: (device loop5): ntfs_fill_super(): Unable to determine device size. 13:30:10 executing program 3: r0 = socket$netlink(0x10, 0x3, 0xffffffbfff7ffffd) getsockopt$netlink(r0, 0x10e, 0xc, 0xfffffffffffffffe, &(0x7f0000000140)) 13:30:10 executing program 0: r0 = socket$inet(0x2, 0x4000000803, 0x4) bind$inet(r0, &(0x7f0000000000)={0x2, 0x0, @broadcast}, 0x10) getsockname(r0, &(0x7f00000036c0)=@xdp={0x2c, 0x0, 0x0}, &(0x7f0000000080)=0x80) setsockopt$inet_pktinfo(r0, 0x0, 0x8, &(0x7f0000003780)={r1, @rand_addr, @dev}, 0xc) syz_emit_ethernet(0x4a, &(0x7f0000000240)={@link_local, @empty=[0x0, 0x0, 0x608], [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x3c, 0x0, 0x0, 0x0, 0x4, 0x0, @empty=0x9000000, @broadcast}, @udp={0x0, 0x0, 0x28}}}}}, &(0x7f0000000380)) 13:30:10 executing program 3: r0 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$inet6_group_source_req(r0, 0x29, 0x2e, &(0x7f0000000000)={0x1, {{0xa, 0x0, 0x0, @mcast1}}, {{0xa, 0x0, 0x0, @remote}}}, 0xfd89) setsockopt$inet6_group_source_req(r0, 0x29, 0x2e, &(0x7f00000002c0)={0x5, {{0xa, 0x0, 0x0, @mcast1}}, {{0xa, 0x0, 0x0, @remote}}}, 0x108) getsockopt$inet6_buf(r0, 0x29, 0x30, &(0x7f0000000000)=""/40, &(0x7f0000001000)=0xfffffffffffffff9) r1 = openat$rfkill(0xffffffffffffff9c, &(0x7f0000000500)='/dev/rfkill\x00', 0x200, 0x0) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000400)={r1, &(0x7f0000000180)="79ed7b9adf737e333188829a6a32b1c70d5e8b6370fc42642ed702eabd067f8a99bb9a1b15de40908668a6843ce085ce178a51857d90b909fc91d9", &(0x7f00000001c0)="49cbc4b72b2047fff06c4dd646e147fc86ad0d6a756bbc9cafc61086fb36309f0b70919da82fc3fd74791475aefa8c6debe65564cb7e7ad72909682c60085f67bf1130192d4eb7fae59b38972010c177b2958c1a56bec8ddf170c9ed8b99984cc133dfe9488f1e332168b0269fdebf2c835080dc7e0f04ee9cfd85b2567dafdccb2f25c34607124f1de5410db26b747d9e152052dd659221cd53de385216f5bc1960ca9314ca3a5cc9357700eec7eabe21e7737c1e5f291891391de09d6850376bdcdcf764aec85c0d0cf8cfbeaf219829eccadfe8b0c8e8bb9ed7eb941ecec213c7988ad97eefd0103601325c8ff50aedcb7df69da6c6", 0x1}, 0x20) getsockopt$inet_mreq(r1, 0x0, 0x20, &(0x7f0000000440)={@multicast1, @rand_addr}, &(0x7f0000000480)=0x8) setsockopt$nfc_llcp_NFC_LLCP_RW(r1, 0x118, 0x0, &(0x7f00000004c0)=0xffff, 0x4) [ 568.946204] overlayfs: filesystem on './file0' not supported as upperdir 13:30:10 executing program 5: syz_mount_image$btrfs(&(0x7f0000000140)='btrfs\x00', &(0x7f0000000180)='./file0\x00', 0x0, 0x0, &(0x7f00000007c0), 0x0, &(0x7f0000000380)=ANY=[]) syz_mount_image$ntfs(&(0x7f0000000200)='ntfs\x00', &(0x7f0000000080)='./file1\x00', 0x0, 0x30, &(0x7f0000000580), 0x0, &(0x7f0000000680)=ANY=[]) mount$overlay(0x404030, &(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f0000000100)={[{@upperdir={'upperdir', 0x3d, './file0'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@workdir={'workdir', 0x3d, './file1'}, 0x5c}]}) umount2(&(0x7f0000000040)='./file0\x00', 0x86000000) 13:30:10 executing program 1: socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)) syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0xe1, 0x400100) creat(&(0x7f00000001c0)='./file0\x00', 0x2) openat$dsp(0xffffffffffffff9c, &(0x7f0000000200)='/dev/dsp\x00', 0x8000, 0x0) syz_open_dev$mouse(&(0x7f0000000240)='/dev/input/mouse#\x00', 0x100, 0x10000) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000007000)={0x8, 0x0, &(0x7f0000000140)=[@acquire], 0x0, 0x0, &(0x7f00000001c0)}) r2 = dup2(r1, r0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000002c0)={0x8, 0x3f00, &(0x7f00000000c0)=[@release], 0x0, 0x0, &(0x7f0000000300)}) 13:30:10 executing program 4: mlock(&(0x7f0000ffc000/0x4000)=nil, 0x4000) preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f00000000c0)=""/148, 0x94}], 0x1, 0x0) pipe2(&(0x7f00000027c0)={0xffffffffffffffff, 0xffffffffffffffff}, 0x847fa) ioctl$TIOCGWINSZ(r0, 0x5413, &(0x7f0000002640)) fsetxattr$trusted_overlay_opaque(r0, &(0x7f0000002680)='trusted.overlay.opaque\x00', &(0x7f00000026c0)='y\x00', 0x2, 0x2) r1 = syz_open_procfs(0x0, &(0x7f0000000080)='io\x00') ioctl$KDSETKEYCODE(r1, 0x4b4d, &(0x7f0000000000)={0x4, 0x400}) preadv(r1, &(0x7f00000025c0)=[{&(0x7f0000000180)=""/215, 0xd7}, {&(0x7f0000000280)=""/235, 0xeb}, {&(0x7f0000000040)}, {&(0x7f0000000380)=""/4096, 0x1000}, {&(0x7f00000013c0)=""/249, 0xf9}, {&(0x7f00000014c0)=""/4096, 0x1000}, {&(0x7f00000024c0)=""/224, 0xe0}], 0x7, 0x0) 13:30:10 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000007000)={0x8, 0x0, &(0x7f0000000140)=[@acquire], 0x0, 0x0, &(0x7f00000001c0)}) r2 = dup2(r1, r0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000002c0)={0x8, 0x0, &(0x7f00000000c0)=[@release], 0x0, 0xfffffdfd, &(0x7f0000000300)}) 13:30:10 executing program 0: r0 = socket$inet(0x2, 0x4000000803, 0x4) bind$inet(r0, &(0x7f0000000000)={0x2, 0x0, @broadcast}, 0x10) getsockname(r0, &(0x7f00000036c0)=@xdp={0x2c, 0x0, 0x0}, &(0x7f0000000080)=0x80) setsockopt$inet_pktinfo(r0, 0x0, 0x8, &(0x7f0000003780)={r1, @rand_addr, @dev}, 0xc) syz_emit_ethernet(0x4a, &(0x7f0000000240)={@link_local, @empty=[0x0, 0x0, 0x2], [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x3c, 0x0, 0x0, 0x0, 0x4, 0x0, @empty=0x9000000, @broadcast}, @udp={0x0, 0x0, 0x28}}}}}, &(0x7f0000000380)) 13:30:10 executing program 4: preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f00000000c0)=""/148, 0x94}], 0x1, 0x0) ioctl$sock_SIOCGPGRP(0xffffffffffffffff, 0x8904, &(0x7f0000000000)=0x0) r1 = syz_open_procfs(r0, &(0x7f0000000080)='io\x00') preadv(r1, &(0x7f0000000480), 0x10000000000002a1, 0x0) 13:30:10 executing program 3: r0 = socket$inet(0x2, 0x4, 0x4) ioctl$TIOCGPGRP(0xffffffffffffffff, 0x540f, &(0x7f00000000c0)=0x0) ptrace$peek(0x2, r1, &(0x7f0000000100)) preadv(r0, &(0x7f0000001380)=[{&(0x7f0000000180)=""/148, 0x94}], 0x1, 0x0) r2 = syz_open_procfs(0x0, &(0x7f0000000300)='net/route\x00') ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(r2, 0xc08c5332, &(0x7f0000000000)={0x10000, 0x1, 0x257, 'queue1\x00', 0x2}) preadv(r2, &(0x7f0000000480), 0x10000000000001e1, 0x4c000000) openat$autofs(0xffffffffffffff9c, &(0x7f0000000140)='/dev/autofs\x00', 0x14200, 0x0) 13:30:10 executing program 1: socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)) syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0xe1, 0x400100) creat(&(0x7f00000001c0)='./file0\x00', 0x2) openat$dsp(0xffffffffffffff9c, &(0x7f0000000200)='/dev/dsp\x00', 0x8000, 0x0) syz_open_dev$mouse(&(0x7f0000000240)='/dev/input/mouse#\x00', 0x100, 0x10000) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000007000)={0x8, 0x0, &(0x7f0000000140)=[@acquire], 0x0, 0x0, &(0x7f00000001c0)}) r2 = dup2(r1, r0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000002c0)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x40406300}], 0x0, 0x0, &(0x7f0000000300)}) 13:30:10 executing program 0: r0 = socket$inet(0x2, 0x4000000803, 0x4) bind$inet(r0, &(0x7f0000000000)={0x2, 0x0, @broadcast}, 0x10) getsockname(r0, &(0x7f00000036c0)=@xdp={0x2c, 0x0, 0x0}, &(0x7f0000000080)=0x80) setsockopt$inet_pktinfo(r0, 0x0, 0x8, &(0x7f0000003780)={r1, @rand_addr, @dev}, 0xc) syz_emit_ethernet(0x4a, &(0x7f0000000240)={@link_local, @empty=[0x0, 0x0, 0x1400], [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x3c, 0x0, 0x0, 0x0, 0x4, 0x0, @empty=0x9000000, @broadcast}, @udp={0x0, 0x0, 0x28}}}}}, &(0x7f0000000380)) 13:30:10 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000007000)={0x8, 0x0, &(0x7f0000000140)=[@acquire], 0x0, 0x0, &(0x7f00000001c0)}) r2 = dup2(r1, r0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000002c0)={0x8, 0x0, &(0x7f00000000c0)=[@release], 0x0, 0x0, &(0x7f0000000300)}) 13:30:10 executing program 4: r0 = openat$urandom(0xffffffffffffff9c, &(0x7f0000000000)='/dev/urandom\x00', 0x2000, 0x0) preadv(r0, &(0x7f0000000500)=[{&(0x7f00000001c0)=""/232, 0xe8}, {&(0x7f00000002c0)}, {&(0x7f0000000580)=""/101, 0xfffffffffffffef6}, {&(0x7f0000000380)=""/218, 0xda}, {&(0x7f0000000480)=""/74, 0x4a}], 0x5, 0x0) open_by_handle_at(r0, &(0x7f0000000180)=ANY=[@ANYBLOB='\n\x00\x00\x00\x00\x00\x00\x00\x00\x00'], 0x309000) preadv(r0, &(0x7f0000000040)=[{&(0x7f00000000c0)=""/148, 0x94}], 0x1, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000080)="c4737a") preadv(r1, &(0x7f0000000480), 0x10000000000002a1, 0x0) 13:30:10 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000007000)={0x8, 0x0, &(0x7f0000000140)=[@acquire], 0x0, 0x0, &(0x7f00000001c0)}) r2 = dup2(r1, r0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000002c0)={0x8, 0x0, &(0x7f00000000c0)=[@release], 0x0, 0x0, &(0x7f0000000300)}) setsockopt$packet_fanout(r2, 0x107, 0x12, &(0x7f0000000080)={0x401, 0x5, 0x2000}, 0x4) syz_genetlink_get_family_id$nbd(&(0x7f0000000040)='nbd\x00') accept4$bt_l2cap(r2, &(0x7f0000000100), &(0x7f0000000180)=0xe, 0x80000) [ 569.375191] ntfs: (device loop5): ntfs_fill_super(): Unable to determine device size. [ 569.413113] binder: 28180:28181 transaction failed 29189/-22, size 0-0 line 2834 [ 569.523233] binder: 28180:28203 transaction failed 29189/-22, size 0-0 line 2834 [ 569.540766] binder: undelivered TRANSACTION_ERROR: 29189 [ 569.542853] overlayfs: filesystem on './file0' not supported as upperdir [ 569.549495] binder: undelivered TRANSACTION_ERROR: 29189 [ 569.577059] binder: BINDER_SET_CONTEXT_MGR already set 13:30:10 executing program 5: syz_mount_image$btrfs(&(0x7f0000000140)='btrfs\x00', &(0x7f0000000180)='./file0\x00', 0x0, 0x0, &(0x7f00000007c0), 0x0, &(0x7f0000000380)=ANY=[]) syz_mount_image$ntfs(&(0x7f0000000200)='ntfs\x00', &(0x7f0000000080)='./file1\x00', 0x0, 0x30, &(0x7f0000000580), 0x0, &(0x7f0000000680)=ANY=[]) mount$overlay(0x404030, &(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f0000000100)={[{@upperdir={'upperdir', 0x3d, './file0'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@workdir={'workdir', 0x3d, './file1'}, 0x5c}]}) umount2(&(0x7f0000000040)='./file0\x00', 0x34000000) 13:30:10 executing program 0: r0 = socket$inet(0x2, 0x4000000803, 0x4) bind$inet(r0, &(0x7f0000000000)={0x2, 0x0, @broadcast}, 0x10) getsockname(r0, &(0x7f00000036c0)=@xdp={0x2c, 0x0, 0x0}, &(0x7f0000000080)=0x80) setsockopt$inet_pktinfo(r0, 0x0, 0x8, &(0x7f0000003780)={r1, @rand_addr, @dev}, 0xc) syz_emit_ethernet(0x4a, &(0x7f0000000240)={@link_local, @empty=[0x0, 0x0, 0x806], [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x3c, 0x0, 0x0, 0x0, 0x4, 0x0, @empty=0x9000000, @broadcast}, @udp={0x0, 0x0, 0x28}}}}}, &(0x7f0000000380)) 13:30:10 executing program 3: pipe(&(0x7f00000003c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$LOOP_SET_DIRECT_IO(r1, 0x4c08, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$loop_ctrl(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/loop-control\x00', 0x0, 0x0) sched_setattr(0x0, &(0x7f0000000000)={0x0, 0x6, 0x0, 0x0, 0x0, 0x9917, 0xffff}, 0x0) ioctl$TIOCGSID(r1, 0x5429, &(0x7f0000000100)=0x0) ioctl$sock_SIOCSPGRP(r0, 0x8902, &(0x7f0000000200)=r2) openat$cgroup_procs(0xffffffffffffffff, &(0x7f0000000180)='cgroup.procs\x00', 0x2, 0x0) ioctl$KDGKBDIACR(r0, 0x4b4a, &(0x7f0000000480)=""/116) ioctl$LOOP_CTL_GET_FREE(r1, 0x4c82) unshare(0x40000000) openat$snapshot(0xffffffffffffff9c, &(0x7f0000000080)='/dev/snapshot\x00', 0x400, 0x0) ioctl$BLKREPORTZONE(r0, 0xc0101282, &(0x7f0000000980)=ANY=[@ANYBLOB="010000000000000005000000000000000900000000000000431c00000000000000000000000000080000000000000000000000000000000000007971000001ffffffffffffffdbd9000000000000c1000000000000007f00ff000000000000000000000000000000000000000000000000000000000000000000000000001f000000000000003c00000000000000000000000000000007000001000096b383ff00000000000000000000000000268ccd86c88efac60000000000000000431fdbf89915707c8f00000000002000856200000100000000000700000000000000010100000000000038073a0c00000000000000000000000000000000000000000000001000000000000000000000000001f6feffffffffff0300010000000000020000000000000001ff0800000000000000000000000000000000000000000000000000000000000000000000000000000000000000000066b4b2822d74b75de8006d7f40b4033cabb0ba92e51bdb92d88478692cdf7848a5ae255ccb4559bb889df7789fb79d161a80b1aa0000000000000000000000"]) ioctl$sock_ifreq(0xffffffffffffffff, 0x4000000008936, &(0x7f0000000040)={'tunl0\x00', @ifru_ivalue=0x7fffffff}) pipe2(&(0x7f0000000140)={0xffffffffffffffff}, 0x0) clock_gettime(0x8000000000, &(0x7f0000000340)) r4 = openat$dsp(0xffffffffffffff9c, &(0x7f00000006c0)='/dev/dsp\x00', 0x62080, 0x0) socket$packet(0x11, 0x2, 0x300) getsockopt$inet_sctp6_SCTP_DEFAULT_SNDINFO(r4, 0x84, 0x22, &(0x7f00000001c0)={0xbca9, 0x2, 0x6, 0xfffffffffffffffc, 0x0}, &(0x7f0000000300)=0x10) getsockopt$inet_sctp_SCTP_SOCKOPT_CONNECTX3(r3, 0x84, 0x6f, &(0x7f0000000900)={r5, 0x68, &(0x7f0000000880)=[@in={0x2, 0x4e20, @local}, @in={0x2, 0x4e24, @local}, @in6={0xa, 0x4e24, 0x0, @loopback, 0x3}, @in={0x2, 0x4e23}, @in6={0xa, 0x4e20, 0x5, @empty, 0xbd4}]}, &(0x7f0000000940)=0x10) ioctl$KDDISABIO(r3, 0x4b37) setxattr(&(0x7f0000000280)='./file0\x00', &(0x7f0000000700)=ANY=[@ANYBLOB="6f96782e47504c5d6e6f645276262b2800b8cc5ee64eed663ef9ef489ed7aa600eb5ef3f1e81a30ed2dace21c7d34fae2b0638b2a9348093d4756a5032f699979d1217dad32c2c55ede4cade6f6dc853e4ec54de7e6e600000aa35be212bc8892d384630c7f6bba037188099bc1c228da23abc93ab3b65ff4a38dfb32496bbd24b2287e05660c49bf2f42a8b38bb867153fb7e271b36c8b8100cdca077c82360688579beded4c06d0889811dea93d5b2c9d18e7829cc6d30083490deecbd4fe2f5c3651d627c929639e33b81fcb696a00a46e542ed0373002a0dbce6cb21c09f395b6984bf1cc7b5a0df86aa8d7b039fbd598a4de6f14fe6bd477c020957ffb07b898f9a088421610f8df03e0b4ecaccbfcb02a790678d52bca87ab935f236300c62ab7bbe8dddf4885ffc018d2036a3acee25df6431956d1623282d5ca227b0509f89929e81cc142a3e16099e"], &(0x7f0000000400)='\x00', 0x1, 0x2) openat$rfkill(0xffffffffffffff9c, &(0x7f0000000440)='/dev/rfkill\x00', 0x400, 0x0) r6 = syz_open_dev$sg(&(0x7f0000000180)='/dev/sg#\x00', 0x0, 0x0) write$P9_RFLUSH(r0, &(0x7f0000000500)={0x7, 0x6d, 0x1}, 0x7) ioctl$BLKTRACESETUP(r6, 0xc0481273, &(0x7f0000000000)={[], 0x0, 0x100, 0x279d}) openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000380)='/dev/loop-control\x00', 0x1, 0x0) socketpair$inet6_sctp(0xa, 0x0, 0x84, &(0x7f0000000240)) 13:30:10 executing program 4: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) getsockopt$bt_BT_SECURITY(r0, 0x112, 0x4, &(0x7f0000000040), 0x2) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000)='/dev/net/tun\x00', 0x0, 0x0) preadv(r1, &(0x7f0000001380)=[{&(0x7f00000000c0)=""/148, 0x94}], 0x1, 0x0) r2 = syz_open_dev$vcsa(&(0x7f0000000200)='/dev/vcsa#\x00', 0x2, 0x741000) r3 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000280)='IPVS\x00') sendmsg$IPVS_CMD_GET_CONFIG(r2, &(0x7f0000000380)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x800000}, 0xc, &(0x7f0000000340)={&(0x7f00000002c0)={0x6c, r3, 0x100, 0x70bd28, 0x25dfdbff, {}, [@IPVS_CMD_ATTR_DEST={0xc, 0x2, [@IPVS_DEST_ATTR_ACTIVE_CONNS={0x8, 0x7, 0x8}]}, @IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0x8}, @IPVS_CMD_ATTR_DEST={0x44, 0x2, [@IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8, 0xfffffffffffffff9}, @IPVS_DEST_ATTR_PORT={0x8, 0x2, 0x4e23}, @IPVS_DEST_ATTR_PERSIST_CONNS={0x8}, @IPVS_DEST_ATTR_ACTIVE_CONNS={0x8, 0x7, 0x800}, @IPVS_DEST_ATTR_U_THRESH={0x8, 0x5, 0xff}, @IPVS_DEST_ATTR_ACTIVE_CONNS={0x8, 0x7, 0x101}, @IPVS_DEST_ATTR_L_THRESH={0x8, 0x6, 0x2}, @IPVS_DEST_ATTR_ADDR_FAMILY={0x8, 0xb, 0xa}]}]}, 0x6c}, 0x1, 0x0, 0x0, 0x80}, 0x4000050) ioctl$TIOCGPGRP(0xffffffffffffffff, 0x540f, &(0x7f0000000180)=0x0) ioctl$TIOCSPGRP(r1, 0x5410, &(0x7f00000001c0)=r4) r5 = syz_open_procfs(0x0, &(0x7f0000000080)='io\x00') preadv(r5, &(0x7f0000000480), 0x10000000000002a1, 0x0) ioctl$UI_SET_ABSBIT(r5, 0x40045567, 0x7) [ 569.608837] binder: 28201:28204 ioctl 40046207 0 returned -16 13:30:11 executing program 0: r0 = socket$inet(0x2, 0x4000000803, 0x4) bind$inet(r0, &(0x7f0000000000)={0x2, 0x0, @broadcast}, 0x10) getsockname(r0, &(0x7f00000036c0)=@xdp={0x2c, 0x0, 0x0}, &(0x7f0000000080)=0x80) setsockopt$inet_pktinfo(r0, 0x0, 0x8, &(0x7f0000003780)={r1, @rand_addr, @dev}, 0xc) syz_emit_ethernet(0x4a, &(0x7f0000000240)={@link_local, @empty=[0x0, 0x0, 0x8], [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x3c, 0x0, 0x0, 0x0, 0x4, 0x0, @empty=0x9000000, @broadcast}, @udp={0x0, 0x0, 0x28}}}}}, &(0x7f0000000380)) 13:30:11 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000007000)={0x8, 0x0, &(0x7f0000000140)=[@acquire], 0x0, 0x0, &(0x7f00000001c0)}) r2 = dup2(r1, r0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000002c0)={0x8, 0x0, &(0x7f00000000c0)=[@release], 0x0, 0x0, &(0x7f0000000300)}) [ 569.766024] IPVS: ftp: loaded support on port[0] = 21 13:30:11 executing program 1: socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)) syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0xe1, 0x400100) creat(&(0x7f00000001c0)='./file0\x00', 0x2) openat$dsp(0xffffffffffffff9c, &(0x7f0000000200)='/dev/dsp\x00', 0x8000, 0x0) syz_open_dev$mouse(&(0x7f0000000240)='/dev/input/mouse#\x00', 0x100, 0x10000) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000007000)={0x8, 0x0, &(0x7f0000000140)=[@acquire], 0x0, 0x0, &(0x7f00000001c0)}) r2 = dup2(r1, r0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000002c0)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x4008630a}], 0x0, 0x0, &(0x7f0000000300)}) [ 569.816159] overlayfs: failed to resolve './file1': -2 [ 569.961102] ntfs: (device loop5): ntfs_fill_super(): Unable to determine device size. 13:30:11 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, &(0x7f0000000040)={0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000300)={0x44, 0x0, &(0x7f0000000180)=[@reply={0x40406301, {0x1, 0x0, 0x4, 0x0, 0x10, 0x0, 0x0, 0x30, 0x28, &(0x7f0000000080)=[@flat={0x776a2a85, 0x1, r1, 0x2}, @fd={0x66642a85, 0x0, r0, 0x0, 0x2}], &(0x7f0000000100)=[0x78, 0x78, 0x0, 0x20, 0x48]}}], 0x9d, 0x0, &(0x7f0000000200)="47ff6932866ff82031edf9eda0051fcb3c58b2ca1a1f22a8b5d61d43d64b50d8873d025de1b80d0275bbe36af1c4669a42c755c0885146aebd9a3358c6070765c9f7d622d9a41f563503050155a43f8b9ec68433f4a5def9fac06a02a8a4c4b2d9679bf6a890ea861fb658916941adda4f609af40766cf44ca279c8e731736cf6ac69df9f5a08f0f61ee854d9166472d207a9c12f19a676e95bedfdfd2"}) r2 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000340)='/dev/snapshot\x00', 0x80000, 0x0) getsockopt$IP6T_SO_GET_INFO(r2, 0x29, 0x40, &(0x7f0000000380)={'raw\x00'}, &(0x7f0000000400)=0x54) openat$zero(0xffffffffffffff9c, &(0x7f0000000440)='/dev/zero\x00', 0x80, 0x0) setsockopt$sock_attach_bpf(r2, 0x1, 0x32, &(0x7f0000000480)=r2, 0x4) r3 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000007000)={0x8, 0x0, &(0x7f0000000140)=ANY=[@ANYBLOB="fd7d9c6722709158"], 0x0, 0x0, &(0x7f00000001c0)}) r4 = dup2(r3, r0) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f00000002c0)={0x8, 0x0, &(0x7f00000000c0)=[@release], 0x0, 0x0, &(0x7f0000000300)}) [ 570.029032] binder: BC_ATTEMPT_ACQUIRE not supported 13:30:11 executing program 0: r0 = socket$inet(0x2, 0x4000000803, 0x4) bind$inet(r0, &(0x7f0000000000)={0x2, 0x0, @broadcast}, 0x10) getsockname(r0, &(0x7f00000036c0)=@xdp={0x2c, 0x0, 0x0}, &(0x7f0000000080)=0x80) setsockopt$inet_pktinfo(r0, 0x0, 0x8, &(0x7f0000003780)={r1, @rand_addr, @dev}, 0xc) syz_emit_ethernet(0x4a, &(0x7f0000000240)={@link_local, @empty=[0x0, 0x0, 0x60000000], [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x3c, 0x0, 0x0, 0x0, 0x4, 0x0, @empty=0x9000000, @broadcast}, @udp={0x0, 0x0, 0x28}}}}}, &(0x7f0000000380)) [ 570.086373] binder: 28232:28239 ioctl c0306201 200002c0 returned -22 [ 570.210213] binder: BC_ATTEMPT_ACQUIRE not supported [ 570.219284] binder: 28246:28250 got reply transaction with no transaction stack 13:30:11 executing program 4: preadv(0xffffffffffffffff, &(0x7f0000000140), 0x26f, 0x0) openat$rtc(0xffffffffffffff9c, &(0x7f0000000100)='/dev/rtc0\x00', 0x4a400, 0x0) openat$audio(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/audio\x00', 0x10000, 0x0) epoll_create(0x1) socketpair$packet(0x11, 0x0, 0x300, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$getownex(r0, 0x10, &(0x7f00000002c0)={0x0, 0x0}) r2 = syz_open_procfs(r1, &(0x7f0000000080)='sched\x00') getsockopt$inet_sctp6_SCTP_AUTOCLOSE(r2, 0x84, 0x4, &(0x7f00000000c0), &(0x7f0000000180)=0xf56d1fe623b30721) r3 = syz_open_procfs(0x0, &(0x7f0000000040)='io\x00') preadv(r3, &(0x7f0000000480), 0x10000000000002a1, 0x0) 13:30:11 executing program 5: syz_mount_image$btrfs(&(0x7f0000000140)='btrfs\x00', &(0x7f0000000180)='./file0\x00', 0x0, 0x0, &(0x7f00000007c0), 0x0, &(0x7f0000000380)=ANY=[]) syz_mount_image$ntfs(&(0x7f0000000200)='ntfs\x00', &(0x7f0000000080)='./file1\x00', 0x0, 0x30, &(0x7f0000000580), 0x0, &(0x7f0000000680)=ANY=[]) mount$overlay(0x404030, &(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f0000000100)={[{@upperdir={'upperdir', 0x3d, './file0'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@workdir={'workdir', 0x3d, './file1'}, 0x5c}]}) umount2(&(0x7f0000000040)='./file0\x00', 0x1000000) [ 570.287443] binder: 28246:28250 transaction failed 29201/-71, size 48-40 line 2741 [ 570.323353] binder: 28232:28248 ioctl c0306201 200002c0 returned -22 [ 570.393706] binder: 28246:28255 unknown command 1738309117 [ 570.457602] binder: 28246:28255 ioctl c0306201 20007000 returned -22 [ 570.466135] binder_thread_write: 14 callbacks suppressed [ 570.466151] binder: 28246:28250 Release 1 refcount change on invalid ref 0 ret -22 [ 570.480642] binder: 28246:28255 got reply transaction with no transaction stack [ 570.488338] binder: 28246:28255 transaction failed 29201/-71, size 48-40 line 2741 [ 570.526439] binder: 28246:28250 unknown command 1738309117 [ 570.532253] binder: 28246:28250 ioctl c0306201 20007000 returned -22 [ 570.536158] IPVS: ftp: loaded support on port[0] = 21 13:30:11 executing program 4: preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f00000000c0)=""/148, 0x94}], 0x1, 0x0) r0 = syz_open_dev$audion(&(0x7f0000000040)='/dev/audio#\x00', 0x0, 0x0) syz_open_dev$sndctrl(&(0x7f0000000000)='/dev/snd/controlC#\x00', 0x0, 0x0) perf_event_open(&(0x7f0000001000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000005000)}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_open_dev$evdev(&(0x7f0000000380)='/dev/input/event#\x00', 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = socket$inet6(0xa, 0x3, 0x3a) setsockopt$inet6_MRT6_ADD_MFC(r1, 0x29, 0xcc, &(0x7f0000000040)={{0xa, 0x0, 0x0, @loopback}, {0xa, 0x0, 0x0, @mcast1}}, 0x5c) getsockopt$sock_cred(0xffffffffffffff9c, 0x1, 0x11, &(0x7f0000000040), &(0x7f0000000180)=0xc) r2 = syz_open_procfs(0x0, &(0x7f0000000080)='io\x00') r3 = socket$inet6_tcp(0xa, 0x1, 0x0) r4 = socket$inet6_tcp(0xa, 0x1, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) bind$inet6(r4, &(0x7f0000000200)={0xa, 0x4e24}, 0x1c) listen(r2, 0x48ed3ec) sendto$inet6(r3, &(0x7f0000000040), 0x0, 0x20000001, &(0x7f0000000080)={0xa, 0x4e22, 0x1000000000, @loopback}, 0x1c) setsockopt$inet6_tcp_TCP_ULP(r3, 0x6, 0x1f, &(0x7f0000000140)='tls\x00', 0x4) sysfs$2(0x2, 0xec4, &(0x7f0000000240)=""/93) setsockopt$inet6_tcp_TLS_TX(r3, 0x11a, 0x1, &(0x7f0000000100), 0x28) sendto$inet6(r3, &(0x7f0000000040)="1c", 0x1, 0x0, &(0x7f0000000000)={0xa, 0x0, 0x0, @remote={0xfe, 0x80, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8030100000000000]}}, 0x1c) preadv(r2, &(0x7f0000000480), 0x10000000000002a1, 0x0) socketpair$packet(0x11, 0x3, 0x300, &(0x7f00000001c0)) sendto$inet6(r0, &(0x7f00000002c0)="1db8c3a393a7a72d4a9c6441e0d49dd98edca60d58bdd678d6a67eb3fb9584c0c2", 0x21, 0x40041, &(0x7f0000000300)={0xa, 0x4e23, 0x8, @loopback, 0xc0}, 0x1c) 13:30:11 executing program 1: socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)) syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0xe1, 0x400100) creat(&(0x7f00000001c0)='./file0\x00', 0x2) openat$dsp(0xffffffffffffff9c, &(0x7f0000000200)='/dev/dsp\x00', 0x8000, 0x0) syz_open_dev$mouse(&(0x7f0000000240)='/dev/input/mouse#\x00', 0x100, 0x10000) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000007000)={0x8, 0x0, &(0x7f0000000140)=[@acquire], 0x0, 0x0, &(0x7f00000001c0)}) r2 = dup2(r1, r0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000002c0)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x630d}], 0x0, 0x0, &(0x7f0000000300)}) 13:30:11 executing program 0: r0 = socket$inet(0x2, 0x4000000803, 0x4) bind$inet(r0, &(0x7f0000000000)={0x2, 0x0, @broadcast}, 0x10) getsockname(r0, &(0x7f00000036c0)=@xdp={0x2c, 0x0, 0x0}, &(0x7f0000000080)=0x80) setsockopt$inet_pktinfo(r0, 0x0, 0x8, &(0x7f0000003780)={r1, @rand_addr, @dev}, 0xc) syz_emit_ethernet(0x4a, &(0x7f0000000240)={@link_local, @empty=[0x0, 0x0, 0x8864000000000000], [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x3c, 0x0, 0x0, 0x0, 0x4, 0x0, @empty=0x9000000, @broadcast}, @udp={0x0, 0x0, 0x28}}}}}, &(0x7f0000000380)) 13:30:12 executing program 3: perf_event_open(&(0x7f00000001c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x511}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_mount_image$xfs(&(0x7f0000000040)='xfs\x00', &(0x7f0000000080)='./file2\x00', 0x0, 0x6, &(0x7f0000000440)=[{&(0x7f00000000c0)="a66589819b8ba7b831b7cbabf694e34adb443ebb474d810de33df8ccefbec5c41bd09e8a0598ad9c43b3b2bee76eac4d640604734b0d938feb44270486b11e232f486dd8106af3d686852af3211b019a1ec1c1b993bfdc4bb328791364a9", 0x5e, 0x6}, {&(0x7f0000000240)="9eb0775ba47bf7137e526819ea05335fab83bb4b84fdf3319732b21976df081f1b2f064f48b4a3711d250762baf1b32b62defb4daccc26de013c51885fbae513c674b019a0422cdb0b97f5c1e870c937a6fd209131f1bbf6d8157425000268c4eb765757d3bf70c2be803db0d09a34aadf5b66eca13d6762fa64b3e1b280cbcdf95ae76a26a77dc2f2b2d07a3b41f2289b1f01631b4f43de868cb37f3b7f", 0x9e, 0x1f}, {&(0x7f0000000140)="832a1cfb8bf76f", 0x7, 0xfff}, {&(0x7f0000000300)="f6ab00eab411068f4f6f67b02543fc18bda205bcaeb4137daa32973f9d461513d37beb61daf6d52017451472237a1933aba1603be1ec2bcd5e829cbb35e5a678f525f9bf2ccc9e9acfe4066a7e6f913ca3f824e942dc3cd76278e5eeb005163ba9d4746d8637d1464774bf9edae6de4e09f55fba0ec16e1cae3da7cf950ad2ae954ac4353390335bd1ae371504", 0x8d, 0x9}, {&(0x7f0000000500)="058c1511066ceef8c2618c21a084f9fea9736a9d3dee03e521feb0316ffa15c024085bd790b8eaa026b937292a54a49b1942a91fad130c3adf3447ec8dbfc5a90dfb33327543b630f41f01c44eccf4", 0x4f, 0x5}, {&(0x7f0000000180)="14beb90132acf0037520da0b09052183b4b353f1de1fd79f43c4a8f5c16663", 0x1f, 0x100}], 0x0, &(0x7f0000000000)) 13:30:12 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) syz_init_net_socket$bt_l2cap(0x1f, 0x7, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000007000)={0x8, 0x0, &(0x7f0000000140)=[@acquire], 0x0, 0x0, &(0x7f00000001c0)}) fsetxattr$security_evm(r0, &(0x7f0000000400)='security.evm\x00', &(0x7f0000000440)=@sha1={0x1, "66c8c99e98d79b70f7862b80355313a59fb671c8"}, 0x15, 0x0) r2 = openat$audio(0xffffffffffffff9c, &(0x7f0000000040)='/dev/audio\x00', 0x400, 0x0) ioctl$IOC_PR_RELEASE(r2, 0x401070ca, &(0x7f0000000080)={0x3, 0x9ff7, 0x1}) getsockopt$inet6_IPV6_IPSEC_POLICY(r2, 0x29, 0x22, &(0x7f0000000180)={{{@in6=@mcast2, @in6=@mcast2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{}, 0x0, @in6}}, &(0x7f0000000100)=0xe8) sendmsg$can_raw(r1, &(0x7f00000003c0)={&(0x7f0000000280)={0x1d, r3}, 0x10, &(0x7f0000000380)={&(0x7f0000000300)=@canfd={{0x4, 0x4, 0x5df1bc9c, 0x7ff}, 0x2f, 0x3, 0x0, 0x0, "76cf2c02ac779ff680dfa70c319e2f48b462c313677d15fb1400f58254e714537fa4ee29d820d1ec0dd35ac34909656824a0523a8caddd5ad245df948fcb9b56"}, 0x48}, 0x1, 0x0, 0x0, 0x20000010}, 0x4008050) r4 = dup2(r1, r0) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f00000002c0)={0x8, 0x0, &(0x7f00000000c0)=[@release], 0x0, 0x0, &(0x7f0000000300)}) [ 570.759529] ntfs: (device loop5): ntfs_fill_super(): Unable to determine device size. 13:30:12 executing program 0: r0 = socket$inet(0x2, 0x4000000803, 0x4) bind$inet(r0, &(0x7f0000000000)={0x2, 0x0, @broadcast}, 0x10) getsockname(r0, &(0x7f00000036c0)=@xdp={0x2c, 0x0, 0x0}, &(0x7f0000000080)=0x80) setsockopt$inet_pktinfo(r0, 0x0, 0x8, &(0x7f0000003780)={r1, @rand_addr, @dev}, 0xc) syz_emit_ethernet(0x4a, &(0x7f0000000240)={@link_local, @empty=[0x0, 0x0, 0x8864], [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x3c, 0x0, 0x0, 0x0, 0x4, 0x0, @empty=0x9000000, @broadcast}, @udp={0x0, 0x0, 0x28}}}}}, &(0x7f0000000380)) [ 570.828412] binder: 28266:28277 Acquire 1 refcount change on invalid ref 0 ret -22 [ 570.868152] binder: 28266:28277 unknown command 0 [ 570.906048] binder: 28266:28277 ioctl c0306201 200002c0 returned -22 13:30:12 executing program 5: syz_mount_image$btrfs(&(0x7f0000000140)='btrfs\x00', &(0x7f0000000180)='./file0\x00', 0x0, 0x0, &(0x7f00000007c0), 0x0, &(0x7f0000000380)=ANY=[]) syz_mount_image$ntfs(&(0x7f0000000200)='ntfs\x00', &(0x7f0000000080)='./file1\x00', 0x0, 0x30, &(0x7f0000000580), 0x0, &(0x7f0000000680)=ANY=[]) mount$overlay(0x404030, &(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f0000000100)={[{@upperdir={'upperdir', 0x3d, './file0'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@workdir={'workdir', 0x3d, './file1'}, 0x5c}]}) umount2(&(0x7f0000000040)='./file0\x00', 0x3c00) [ 570.969447] binder: 28266:28293 Acquire 1 refcount change on invalid ref 0 ret -22 [ 571.013670] binder: 28266:28293 unknown command 0 13:30:12 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ptmx\x00', 0x82100, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000007000)={0x8, 0x0, &(0x7f0000000140)=[@acquire], 0x0, 0x0, &(0x7f00000001c0)}) r2 = dup2(r1, r0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000002c0)={0x8, 0x0, &(0x7f00000000c0)=[@release], 0x0, 0x0, &(0x7f0000000300)}) 13:30:12 executing program 0: r0 = socket$inet(0x2, 0x4000000803, 0x4) bind$inet(r0, &(0x7f0000000000)={0x2, 0x0, @broadcast}, 0x10) getsockname(r0, &(0x7f00000036c0)=@xdp={0x2c, 0x0, 0x0}, &(0x7f0000000080)=0x80) setsockopt$inet_pktinfo(r0, 0x0, 0x8, &(0x7f0000003780)={r1, @rand_addr, @dev}, 0xc) syz_emit_ethernet(0x4a, &(0x7f0000000240)={@link_local, @empty=[0x0, 0x0, 0xf0], [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x3c, 0x0, 0x0, 0x0, 0x4, 0x0, @empty=0x9000000, @broadcast}, @udp={0x0, 0x0, 0x28}}}}}, &(0x7f0000000380)) [ 571.045709] binder: 28266:28293 ioctl c0306201 200002c0 returned -22 13:30:12 executing program 4: preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f00000000c0)=""/148, 0x94}], 0x1, 0x0) syz_open_dev$rtc(&(0x7f0000000000)='/dev/rtc#\x00', 0x0, 0xffffffffffffffff) r0 = syz_open_procfs(0x0, &(0x7f0000000080)='io\x00') preadv(r0, &(0x7f0000000480), 0x10000000000002a1, 0x0) 13:30:12 executing program 1: socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)) syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0xe1, 0x400100) creat(&(0x7f00000001c0)='./file0\x00', 0x2) openat$dsp(0xffffffffffffff9c, &(0x7f0000000200)='/dev/dsp\x00', 0x8000, 0x0) syz_open_dev$mouse(&(0x7f0000000240)='/dev/input/mouse#\x00', 0x100, 0x10000) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000007000)={0x8, 0x0, &(0x7f0000000140)=[@acquire], 0x0, 0x0, &(0x7f00000001c0)}) r2 = dup2(r1, r0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000002c0)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x40086303}], 0x0, 0x0, &(0x7f0000000300)}) [ 571.166319] overlayfs: failed to resolve './file1': -2 [ 571.181376] XFS (loop3): Invalid superblock magic number [ 571.257199] overlayfs: failed to resolve './file1': -2 13:30:12 executing program 2: r0 = syz_open_dev$binder(&(0x7f00000003c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x2) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000100)='/dev/ppp\x00', 0x4000, 0x0) getsockopt$inet_sctp_SCTP_DELAYED_SACK(0xffffffffffffff9c, 0x84, 0x10, &(0x7f0000000200)=@sack_info={0x0, 0x8, 0x6}, &(0x7f0000000240)=0xc) getsockopt$inet_sctp_SCTP_DELAYED_SACK(r1, 0x84, 0x10, &(0x7f0000000280)=@assoc_value={r2, 0xfffffffffffffc00}, &(0x7f0000000300)=0x8) r3 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$sock_kcm_SIOCKCMCLONE(0xffffffffffffff9c, 0x89e2, &(0x7f0000000180)={0xffffffffffffff9c}) setsockopt$inet_sctp_SCTP_INITMSG(r4, 0x84, 0x2, &(0x7f00000001c0)={0x3, 0x8f7, 0x5, 0x1}, 0x8) ioctl$SNDRV_TIMER_IOCTL_CONTINUE(r1, 0x54a2) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000007000)={0x8, 0x0, &(0x7f0000000140)=[@acquire], 0x0, 0x0, &(0x7f00000001c0)}) r5 = dup2(r3, r0) syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x802) ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f00000002c0)={0x8, 0x0, &(0x7f00000000c0)=[@release], 0x0, 0x0, &(0x7f0000000300)}) getsockopt$inet_tcp_TCP_REPAIR_WINDOW(r5, 0x6, 0x1d, &(0x7f0000000040), &(0x7f0000000080)=0x14) 13:30:12 executing program 4: preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f00000000c0)=""/148, 0x94}], 0x1, 0x0) r0 = socket$rds(0x15, 0x5, 0x0) fgetxattr(r0, &(0x7f0000000000)=@known='trusted.syz\x00', &(0x7f0000000180)=""/195, 0xc3) r1 = syz_open_procfs(0x0, &(0x7f0000000080)='io\x00') preadv(r1, &(0x7f0000000480), 0x10000000000002a1, 0x0) 13:30:12 executing program 5: syz_mount_image$btrfs(&(0x7f0000000140)='btrfs\x00', &(0x7f0000000180)='./file0\x00', 0x0, 0x0, &(0x7f00000007c0), 0x0, &(0x7f0000000380)=ANY=[]) syz_mount_image$ntfs(&(0x7f0000000200)='ntfs\x00', &(0x7f0000000080)='./file1\x00', 0x0, 0x30, &(0x7f0000000580), 0x0, &(0x7f0000000680)=ANY=[]) mount$overlay(0x404030, &(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f0000000100)={[{@upperdir={'upperdir', 0x3d, './file0'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@workdir={'workdir', 0x3d, './file1'}, 0x5c}]}) umount2(&(0x7f0000000040)='./file0\x00', 0xff0f) [ 571.296799] binder: 28324:28325 Acquire 1 refcount change on invalid ref 0 ret -22 [ 571.328252] binder: 28324:28325 BC_FREE_BUFFER u0000000000000000 no match 13:30:12 executing program 3: r0 = socket$inet6(0xa, 0x80003, 0x800000000000006) ioctl(r0, 0x8912, &(0x7f0000000080)="153f6234488dd25d766070") r1 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000040)={'tunl0\x00', 0x0}) r3 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r3, &(0x7f0000000240)={&(0x7f0000000000), 0x37, &(0x7f0000000200)={&(0x7f00000000c0)=ANY=[@ANYBLOB="2800000013000502000000000000000000000000", @ANYRES32=r2, @ANYBLOB="000000000100000008000a0010000000"], 0x28}}, 0x0) 13:30:12 executing program 0: r0 = socket$inet(0x2, 0x4000000803, 0x4) bind$inet(r0, &(0x7f0000000000)={0x2, 0x0, @broadcast}, 0x10) getsockname(r0, &(0x7f00000036c0)=@xdp={0x2c, 0x0, 0x0}, &(0x7f0000000080)=0x80) setsockopt$inet_pktinfo(r0, 0x0, 0x8, &(0x7f0000003780)={r1, @rand_addr, @dev}, 0xc) syz_emit_ethernet(0x4a, &(0x7f0000000240)={@link_local, @empty=[0x0, 0x0, 0xf0ffffffffffff], [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x3c, 0x0, 0x0, 0x0, 0x4, 0x0, @empty=0x9000000, @broadcast}, @udp={0x0, 0x0, 0x28}}}}}, &(0x7f0000000380)) [ 571.392889] binder: 28324:28336 BC_FREE_BUFFER u0000000000000000 no match 13:30:12 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000007000)={0x8, 0x0, &(0x7f0000000140)=[@acquire], 0x0, 0x0, &(0x7f00000001c0)}) r2 = dup2(r1, r0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000002c0)={0x8, 0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="066304567a2e0425"], 0x0, 0x0, &(0x7f0000000300)}) [ 571.492653] ntfs: (device loop5): ntfs_fill_super(): Unable to determine device size. 13:30:12 executing program 1: socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)) syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0xe1, 0x400100) creat(&(0x7f00000001c0)='./file0\x00', 0x2) openat$dsp(0xffffffffffffff9c, &(0x7f0000000200)='/dev/dsp\x00', 0x8000, 0x0) syz_open_dev$mouse(&(0x7f0000000240)='/dev/input/mouse#\x00', 0x100, 0x10000) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000007000)={0x8, 0x0, &(0x7f0000000140)=[@acquire], 0x0, 0x0, &(0x7f00000001c0)}) r2 = dup2(r1, r0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000002c0)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x40046307}], 0x0, 0x0, &(0x7f0000000300)}) 13:30:12 executing program 4: preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f00000000c0)=""/148, 0x94}], 0x1, 0x0) getsockopt$sock_cred(0xffffffffffffff9c, 0x1, 0x11, &(0x7f0000000040)={0x0}, &(0x7f0000000180)=0xc) r1 = syz_open_procfs(r0, &(0x7f0000000200)='net/ip_mr_cache\x00') preadv(r1, &(0x7f0000000000), 0x0, 0x0) 13:30:12 executing program 0: r0 = socket$inet(0x2, 0x4000000803, 0x4) bind$inet(r0, &(0x7f0000000000)={0x2, 0x0, @broadcast}, 0x10) getsockname(r0, &(0x7f00000036c0)=@xdp={0x2c, 0x0, 0x0}, &(0x7f0000000080)=0x80) setsockopt$inet_pktinfo(r0, 0x0, 0x8, &(0x7f0000003780)={r1, @rand_addr, @dev}, 0xc) syz_emit_ethernet(0x4a, &(0x7f0000000240)={@link_local, @empty=[0x0, 0x0, 0xd00000000000000], [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x3c, 0x0, 0x0, 0x0, 0x4, 0x0, @empty=0x9000000, @broadcast}, @udp={0x0, 0x0, 0x28}}}}}, &(0x7f0000000380)) [ 571.614578] binder: 28356:28357 unknown command 1443128070 [ 571.620281] binder: 28356:28357 ioctl c0306201 200002c0 returned -22 13:30:13 executing program 4: preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f00000000c0)=""/148, 0x94}], 0x10000000000003b0, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000080)='io\x00') dup2(r0, r0) preadv(r0, &(0x7f0000000480), 0x10000000000002a1, 0x0) [ 571.676224] overlayfs: filesystem on './file0' not supported as upperdir [ 571.698244] binder: 28361:28362 Acquire 1 refcount change on invalid ref 0 ret -22 13:30:13 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) lstat(&(0x7f0000000740)='./file0\x00', &(0x7f0000000780)={0x0, 0x0, 0x0, 0x0, 0x0}) r2 = geteuid() mount$9p_tcp(&(0x7f0000000500)='127.0.0.1\x00', &(0x7f0000000540)='./file0\x00', &(0x7f0000000700)='9p\x00', 0x800, &(0x7f0000000940)=ANY=[@ANYBLOB='trans=tcp,port=0x0000000000004e20,fowner=', @ANYRESDEC=r1, @ANYBLOB=',subj_role=/dev/binder#\x00,subj_role=/dev/dmmidi#\x00,euid>', @ANYRESDEC=r2, @ANYBLOB="0010a371404d7a88cb240a0d59c9264d6100"]) r3 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000007000)={0x8, 0x0, &(0x7f0000000140)=[@acquire], 0x0, 0x0, &(0x7f0000000500)}) syslog(0x4, &(0x7f0000000b40)=""/160, 0xa0) r4 = syz_open_dev$dmmidi(&(0x7f0000000040)='/dev/dmmidi#\x00', 0x3, 0x345000) r5 = mmap$binder(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0xc, 0xc012, r3, 0x0) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000480)={0xbc, 0x0, &(0x7f0000000340)=[@release, @clear_death={0x400c630f, 0x4, 0x3}, @exit_looper, @transaction={0x40406300, {0x4, 0x0, 0x3, 0x0, 0x1, 0x0, 0x0, 0x50, 0x10, &(0x7f0000000180)=[@fd={0x66642a85, 0x0, r4, 0x0, 0x2}, @fda={0x66646185, 0x9, 0x1, 0x27}, @fd={0x66642a85, 0x0, r3, 0x0, 0x4}], &(0x7f0000000100)=[0x40, 0x0]}}, @acquire={0x40046305, 0x2}, @acquire, @transaction={0x40406300, {0x3, 0x0, 0x4, 0x0, 0x1, 0x0, 0x0, 0x60, 0x8, &(0x7f0000000240)=[@ptr={0x70742a85, 0x1, &(0x7f0000000200), 0x1, 0x4, 0x16}, @fda={0x66646185, 0x3, 0x3, 0xc}, @flat={0x776a2a85, 0x1, r5, 0x1}], &(0x7f0000000300)=[0x38]}}, @decrefs={0x40046307, 0x3}], 0x55, 0x0, &(0x7f0000000400)="4ff905d804bbb5b73577518702410e39ad9d00fb859da5287eb66b660913486985b7e5f86677e5be05641cf6ebe905f13f456f78460904ed7928544645d37ba0b8abdb9abbe026b0c290206483d4d6485a3805301e"}) r6 = fcntl$getown(r3, 0x9) fsetxattr$trusted_overlay_redirect(r4, &(0x7f00000008c0)='trusted.overlay.redirect\x00', &(0x7f0000000900)='./file0\x00', 0x15ee7cfa97f2f45a, 0x1) getsockopt$inet6_mreq(r4, 0x29, 0x1f, &(0x7f0000000840)={@local, 0x0}, &(0x7f0000000880)=0x14) sendmsg$xdp(r4, &(0x7f0000000b00)={&(0x7f0000000a00)={0x2c, 0x1, r7, 0x22}, 0x10, &(0x7f0000000ac0)=[{&(0x7f0000000a40)="d24024bce44044aa69a0387daa317c158b2614a0403731c6a3e3581fae03ead1b28b57ed349f1c1f5a6a8d58ac0a3c6ba74d4a9851d640d18d9cdaf70ed0856a9ae25238568b5e60267a58474bf34b351d3b7e5791e09ace5ea203bce78eb456a8e9", 0x62}], 0x1}, 0x20048080) mq_notify(r4, &(0x7f0000000080)={0x0, 0x16, 0x4, @tid=r6}) ioctl$BLKIOOPT(r4, 0x1279, &(0x7f0000000800)) ioctl$TIOCLINUX2(r4, 0x541c, &(0x7f00000004c0)={0x2, 0x4, 0x7, 0x7fff, 0xaedc}) r8 = dup2(r3, r0) accept4$packet(r8, &(0x7f0000000580)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @remote}, &(0x7f00000005c0)=0x14, 0x80000) r10 = geteuid() setsockopt$inet_IP_XFRM_POLICY(r8, 0x0, 0x11, &(0x7f0000000600)={{{@in6=@local, @in=@local, 0x4e23, 0x0, 0x4e24, 0xfff, 0xa, 0xa0, 0x80, 0x67, r9, r10}, {0x6, 0x0, 0x8, 0x7ff, 0x401, 0x6, 0x5, 0xfffffffffffffff7}, {0x10000, 0x1, 0x5, 0x7f}, 0x1, 0x6e6bb9, 0x2, 0xdaac11facd6e822d, 0x1, 0x2}, {{@in=@broadcast, 0x4d6, 0xff}, 0x0, @in6=@ipv4={[], [], @rand_addr=0x7}, 0x3502, 0x2, 0x2, 0x6, 0x5, 0x730}}, 0xe8) ioctl$BINDER_WRITE_READ(r8, 0xc0306201, &(0x7f00000002c0)={0x8, 0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="0100004000000000"], 0x0, 0x0, &(0x7f0000000300)}) 13:30:13 executing program 5: syz_mount_image$btrfs(&(0x7f0000000140)='btrfs\x00', &(0x7f0000000180)='./file0\x00', 0x0, 0x0, &(0x7f00000007c0), 0x0, &(0x7f0000000380)=ANY=[]) syz_mount_image$ntfs(&(0x7f0000000200)='ntfs\x00', &(0x7f0000000080)='./file1\x00', 0x0, 0x30, &(0x7f0000000580), 0x0, &(0x7f0000000680)=ANY=[]) mount$overlay(0x404030, &(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f0000000100)={[{@upperdir={'upperdir', 0x3d, './file0'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@workdir={'workdir', 0x3d, './file1'}, 0x5c}]}) umount2(&(0x7f0000000040)='./file0\x00', 0x11000) [ 571.778173] binder: 28361:28362 DecRefs 0 refcount change on invalid ref 0 ret -22 13:30:13 executing program 0: r0 = socket$inet(0x2, 0x4000000803, 0x4) bind$inet(r0, &(0x7f0000000000)={0x2, 0x0, @broadcast}, 0x10) getsockname(r0, &(0x7f00000036c0)=@xdp={0x2c, 0x0, 0x0}, &(0x7f0000000080)=0x80) setsockopt$inet_pktinfo(r0, 0x0, 0x8, &(0x7f0000003780)={r1, @rand_addr, @dev}, 0xc) syz_emit_ethernet(0x4a, &(0x7f0000000240)={@link_local, @empty=[0x0, 0x0, 0xd000000], [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x3c, 0x0, 0x0, 0x0, 0x4, 0x0, @empty=0x9000000, @broadcast}, @udp={0x0, 0x0, 0x28}}}}}, &(0x7f0000000380)) [ 571.857885] binder: 28361:28380 Acquire 1 refcount change on invalid ref 0 ret -22 13:30:13 executing program 4: preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f00000000c0)=""/148, 0x94}], 0x1, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000080)='io\x00') ioctl$KVM_GET_SREGS(r0, 0x8138ae83, &(0x7f0000000180)) bpf$BPF_GET_PROG_INFO(0xf, &(0x7f00000002c0)={r0, 0x50, &(0x7f0000000000)={0x0, 0x0}}, 0x10) bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f0000000300)=r1, 0x4) preadv(r0, &(0x7f0000001340), 0x2d3, 0x0) setsockopt$bt_l2cap_L2CAP_CONNINFO(r0, 0x6, 0x2, &(0x7f0000000340)={0x3, 0x4, 0x4, 0x3ff}, 0x6) [ 571.944737] binder: 28361:28378 DecRefs 0 refcount change on invalid ref 0 ret -22 [ 571.986017] ntfs: (device loop5): ntfs_fill_super(): Unable to determine device size. 13:30:13 executing program 0: r0 = socket$inet(0x2, 0x4000000803, 0x4) bind$inet(r0, &(0x7f0000000000)={0x2, 0x0, @broadcast}, 0x10) getsockname(r0, &(0x7f00000036c0)=@xdp={0x2c, 0x0, 0x0}, &(0x7f0000000080)=0x80) setsockopt$inet_pktinfo(r0, 0x0, 0x8, &(0x7f0000003780)={r1, @rand_addr, @dev}, 0xc) syz_emit_ethernet(0x4a, &(0x7f0000000240)={@link_local, @empty=[0x0, 0x0, 0x2800000000000000], [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x3c, 0x0, 0x0, 0x0, 0x4, 0x0, @empty=0x9000000, @broadcast}, @udp={0x0, 0x0, 0x28}}}}}, &(0x7f0000000380)) [ 572.034827] binder: 28377:28382 unknown command 1073741825 [ 572.053425] binder: 28377:28382 ioctl c0306201 200002c0 returned -22 [ 572.114597] overlayfs: filesystem on './file0' not supported as upperdir [ 572.135139] binder: 28377:28400 tried to acquire reference to desc 0, got 1 instead [ 572.150888] ntfs: (device loop5): ntfs_fill_super(): Unable to determine device size. [ 572.184625] binder: 28377:28407 unknown command 1073741825 [ 572.190327] binder: 28377:28407 ioctl c0306201 200002c0 returned -22 13:30:13 executing program 3: r0 = socket$nl_generic(0x10, 0x3, 0x10) readv(0xffffffffffffffff, &(0x7f00000004c0), 0x0) socketpair(0x3, 0x1, 0x9, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$DRM_IOCTL_MAP_BUFS(r1, 0xc0186419, &(0x7f0000000140)={0x2, &(0x7f0000000200)=""/206, &(0x7f0000000080)=[{0x101, 0xf1, 0x4, &(0x7f0000000300)=""/241}, {0x0, 0xf, 0x80, &(0x7f0000000040)=""/15}]}) sendmsg$nl_generic(r0, &(0x7f0000000180)={&(0x7f00000000c0)={0x10, 0x34000}, 0xc, &(0x7f0000000100)={&(0x7f00000001c0)={0x2c, 0x2f, 0x829, 0x0, 0x0, {0x4}, [@nested={0x18, 0x0, [@typed={0x14, 0x1, @ipv6=@loopback={0x400000007000f00}}]}]}, 0x2c}}, 0x0) 13:30:13 executing program 1: socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)) syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0xe1, 0x400100) creat(&(0x7f00000001c0)='./file0\x00', 0x2) openat$dsp(0xffffffffffffff9c, &(0x7f0000000200)='/dev/dsp\x00', 0x8000, 0x0) syz_open_dev$mouse(&(0x7f0000000240)='/dev/input/mouse#\x00', 0x100, 0x10000) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000007000)={0x8, 0x0, &(0x7f0000000140)=[@acquire], 0x0, 0x0, &(0x7f00000001c0)}) r2 = dup2(r1, r0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000002c0)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x40106309}], 0x0, 0x0, &(0x7f0000000300)}) 13:30:13 executing program 4: preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f00000000c0)=""/148, 0x94}], 0x1, 0x0) fcntl$getown(0xffffffffffffffff, 0x9) r0 = syz_open_dev$usbmon(&(0x7f0000000080)='/dev/usbmon#\x00', 0x4f9, 0x208800) ioctl$TIOCGPGRP(r0, 0x540f, &(0x7f0000000040)) getsockopt$sock_cred(0xffffffffffffff9c, 0x1, 0x11, &(0x7f0000000180)={0x0}, &(0x7f00000001c0)=0xc) r2 = syz_open_procfs(r1, &(0x7f0000000000)='net/igmp6\x00') preadv(r2, &(0x7f0000000480), 0x10000000000002a1, 0x0) 13:30:13 executing program 0: r0 = socket$inet(0x2, 0x4000000803, 0x4) bind$inet(r0, &(0x7f0000000000)={0x2, 0x0, @broadcast}, 0x10) getsockname(r0, &(0x7f00000036c0)=@xdp={0x2c, 0x0, 0x0}, &(0x7f0000000080)=0x80) setsockopt$inet_pktinfo(r0, 0x0, 0x8, &(0x7f0000003780)={r1, @rand_addr, @dev}, 0xc) syz_emit_ethernet(0x4a, &(0x7f0000000240)={@link_local, @empty=[0x0, 0x0, 0x80350000], [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x3c, 0x0, 0x0, 0x0, 0x4, 0x0, @empty=0x9000000, @broadcast}, @udp={0x0, 0x0, 0x28}}}}}, &(0x7f0000000380)) 13:30:13 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000007000)={0x8, 0x0, &(0x7f0000000140)=[@acquire], 0x0, 0x0, &(0x7f00000001c0)}) madvise(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0xa) r2 = dup2(r1, r0) setns(r2, 0x4000000) ioctl$KVM_SET_SIGNAL_MASK(r2, 0x4004ae8b, &(0x7f0000000300)={0x1000, "590a67d8d65f889bd425c3b8eaac63a9a78f732451d1ae4bd5306c0bdc366087184dee46397600231ae4aaa57ff92595712b241c7d61d7103782e3777fe84686eb4cc661c52cd5c8b2d8a64ebdbd9f4a32bb19f21a6b284be9a57ae1c7b1836556fe16626b338c60f33bdf6408af4d282fa717dce65e02d8c2a95f983a356e684e10d2fcd1c577a274dce5e11f73a73b1e85229a9c6b5c222e2124e19602fcf02ff415ac8e2eeb9ba95a784ed590be887ab59505463e38cf823c1844a369a6bcbba2086c9f8d30c0e678450444bdb61a695dbcbb4c5ba7fb4da294a89bdbc32cf4c7961b85c16238df831d265ea7debc39555b34daf30799da6370ba21a75160a620756bcf539002b656f8b9bb144ad805cc14d70ff3de96c347652be1a52ef124668595395fc9e6260f817d02dc81397dae818d0fcc78c4e42e4535039d335e1b03a6c68b910b9b59384c0a8f41d24c59dcca6529d6cf470900522f19e1c8ada3fbe166533d813c5c3bd0690cdaf84f09053c034e7d981f390e0eb23a3629107528772220b86dae01a8f96c44b9475044416ed8ff42514913ba70aed59dcffda47d3f6d7587112e23e1e974efdbdac45301343a68736f304513fab1cc7fc23b9e05dba9a587756a9525207064526d918e6e2e5f5ad42d4ce040e3d25cf1c7f38511aa07549e31e7ccdb3e6e9faaac49968fa9e953dc4dc09906fe756da99a29f15691d98c6cd4a26838067376083606b74e0a18ead7e8b204cc736218623dd230e5ccfe5a2f9ecd566513b5d81c451c39f40ee3ed585da626a6dae0eb22b47c3d0aba241a3ecc0e072bc297d83dba9786df12276f81d83d4922eca75b3a9d2b57c1b4a1c4b272a36cccb83ddc7c8a6f3c162032380188566cc846ad9f6d61119cf74c767a4fa0b203e4b38dab5fcb9b3b9945f584f7c8a531e52079548b40339d0aa23404d50b0321b9082d6b75e702b9be6f59d99ed3fbd49dc2b126724031c26963a06ef4d3636b247702611aa8f2e2b6e2c207a85f3813f4bd5aa5d2babba1606aff25d176a129c5220246042ce678a8ab4772b0c05f08f1bdd4719c9bdb3dac3b38173f77f61a1154d3062c3214df875bd717c43b56de807da9dc1cc5f1a9bfbbaaa61b98ce2a49d0b81fcf7ca72feda1195a022aec70eb0daf919c4839e3cf1093a54f913c2a43cc3887cadfedd1983e951722d7a67278e5e43e2a9d61b8fb4be17bff848e9341dba7bba512a3f86c98c494a34835ebd1f799e20a6eafd5c2ac599201e8ae65ee45488921a6dfbf1e855c42f21484e1491ab72bdfbee79ee25fd087909222de7df0b0ba27d79a0f676fcb0bd41c140374e9220f33228bfe9a25c3965ada2f36a506cf8b1fc24937ff6cb21d06140d7179d6b2398b2a1d1a5ad8027a755761e10c600114ed23fefd0f396a42761a8a5b9973f79f1501d163b81621cf83dfe340f266adaf4c60eedc72e6a4ab866fbc0a14c32153c867d01aba30015f8d2ed17bfff0e1fc4aad5460d71f157ed367780f0e1c2da9e7c202b8daf4f5b88be9f7c7ae5aad593de5dfc98cb8636ff20f2a4228b83ae121f3d1446271cb01ebc43fdf78eb5bed743055b0c21436b963b2885a06a4f40af9784388c56bf3f332709f9afe87d0b62727a7a4e4a699b2f0a80e553fce316b3d9ee3e97a42a09b0f011bafa3e0f2f4e67645c6b009cf525fcddc44ca244bea58522f5bc408347d7d7888e0bcb1c59f9aa35fa21ecd5ec41fb047f87c52a63ced305e418475e701bdb917f225078212052666b760505dfa431a88470186b58d5421c109a0443e3f4d793c4364c7df6c8718ba90d311efbfa27eb48103a38d1fef7d2357401255997ee9dbe08217243bfcbb4a87fc7c38a9bfc641c5385a96b4b7064eb5cad744e6f575903d31106231d6cd3baa642267a579ebf2e88583cb4af418238b04c5d0a3e6e92a3c97fcbf661436d258a03a898f3d41a3c05c22c878b266da146b6cbb515132ddd12bbfc3c387a0a8312adec5f51d1ee18aa8ad186dfe610a77b4774be9432dd352217756fc4a2b707c281059c373b6739495881e1d92472e41129284cfd6ee601d2072e0f1fcfb4a9cf4899dd7c6b2635ad85694d00d4979214e785f60acce16353ec4dbc8e3ccf07cc7e0b8da15419a610cdc3361d0ecc4481631d7ed8d65f90637b140dc64ee3028796b4f125b627db02d86d6138f121655b596a74999d2b55987d22face239b422c4f3305cad8c5b54b73450af6519d6a55ffff7ae0020a74e263a6e83d8b6035eee3419bb017fd02ab129b07833a830f3c085f1eb855d2ce54f323217aae3f59572a9705612a3f33effb94f88cde5508d89a19917bd0ebca2b03e1f122606c6b13480eb8eb8ca42ebee5969ab85895982261f9751df14e68fe455075652de2a972f18e73df96d70fb0b5b5978ef1b6fd3eef3114587b395ec7ff075934de7f7f155484be8815e4967c2147dd96940840f07e87ccf48654d62e1a90cbbf7b4ed5dc7e82a5008bb2356046f2f1866c7b66abf677cc7db31f13e41ffd119d716b37551e68337ba69aac32b839c982f944af531ade9cc8be4423962f22571b6eeb53423145ac7fae1ca31ab2d0f1ddd407b3897acf5ed15c57e815c394655d6cbd136f5bcf93ac98968a9d4dcc7c2a499bfa3a22d7467353dc334f191963790ee380404b044936939de2f89dd522295ce3a36a8c842ef40ed83755524f44b43186c4c0ac14b58ddffd4f5fd46f3d61875bb91887867e103490874fc518a3f78c134bda48dc5103cd2fd6b12b09ffc6f76692f5cffbbce2623a907f8cac26eaec2730f0e77824f872b73f20e476928fa28fc625d11999d1b5e30752685d7047a1171aeeecddd9aee29f0f510fa160b1c012ca1d512d16d7ddb0d44ce5b6b7a44d643de7a182aef7d4fc686c6601c63600657c507d6b559251b87ca360b7499937a303e7ecf85b07fef3e1b90f6c233ba2f0f04ac82740795111608f686f6f2eacebd42194f860b2fb0268a5d8f9a17419a13e867ccaa869fc28f9f5b15b92cb1d5c2380ff13fcfc9b3eef0bbc8a4254aa744ee9aacf9de661f936501b98a345b49f0ff29d824ef7b9b423aaaa6d4596519bdcc4c01704c79854dfb306bcacc8c1bd3aac6a2346861d474b99daccabee7a9b5f54396784a6d68b84d9e45c74adf640cdcd8cd56ce711a62a8c048529053fe50fcb1a78e405d43ce23312d598f2ec1d930e3499f52675d4a1ece8f315d8ed49498cd851ebdafd5b9d44b175069e947995bbabc50cbdaedd718a027d35b95b4aa31d28c5eb2a2133b45773cf46a4a58f7ad0d53bf37b76e8349deb3e5ded9188a3826fb9fcd16cc5120c49cb1b9e8a88dd7ecd7d27cc2b8671b78269f5cb9a0387ca99616613d21ee67892ea8722df41065ceea0365f04986ba22f7ade8c1fbcbf4e6f9becbb30ced50e3e1395b1300dc6702f474f4bf30503e9311d66875d78287ab1ec63ab4fa1c9f73f0fbaa25364fb389463c39d5e12e22d7f82e6f664cbf76d73a0969a62509664b33e45bac20adbaa5882ae2844c97412af0675c191a9bb4a51abc97bcf58fb8cdb59395a8bf4b5abefd006c3f3239cb6a24047204ea5362a94b2aa39c6fd1467059cfa91fc392382592965a90ad41cb84eb13c0df5376f65b758b76ee83f5cfe36295821e09c4b8a955dbe5dd15054a8ce064ee9246bb55bea6f0da96e7e3a9cfb6b760ef4bc6780504968df706c2611adba7cebb144a62eabe445058cffd3576e4a0e433fd7fb395d48694b103a7b5c7a692097885b9173c844429807714bcc697904163f13a4ac36ba93dbaf1287d46a514f48b230489e976fc0905d63846c58903c03632199cd73129f6eada857a2e0e083d45391eb78033cddcfb658189379125df452985ce67170ad31c9416c42eef592f02f00e47679e66900117b199fab524c3a60919c58dc90a3833ff2f395ea10ff9af668b985c2e497af18d2d6a3635f1918ed8941904ddb48c7810296ef23a17b752d4b8d5cf9edd04c348fadf114c36f225ec304ec3b244fd91502cb61735f3e9816f06756038963929ab393678e67093b06b769e9e5ef95737e006b2390013463483e393fe23c24562b0da0e786b4490165470041e3a891f3d30e89e5d4a403698de2f513ff48628a7ec481ef1bb10dc617032c76afbbcfb9803c0f26fab756959ed2a61466339bf0a0c12ec19f85ffc9c18fbf060bcf3bec16df1b06c65e6bd616eafc333ee936617d8420ea9d7803632559feda28398bd26811fa481e479e6db111e6bc726e2bddf09e5f9a5674b6c2fde58113cdb9326c0525545aad11d9a9a2991c5e35403be324f9ea32a5a4b3430ff1914de98681f5c1faf046265a457de4d4e6c540d475ab1817674a2d796c4d7008f5d5ef98161505b8925cf78a94f0cc0a1d5697f4900f22108f96babcb9ba9cdcac57360a4d56b6377a45b7d59757d03cd1feac90295c70926770b08a93209c7bc0926957e52f2a37c5ff98c2b24e48c4bcc7aaab178a33200cc01f3cc5e405c96d8a71bd9633ead37d5ff55aaa2231cc5f16e5ad652e37cad8fa9270c64b51f662f66dcf030c5cc6d2cc8c1c71a11e67ae5afa40d4c8ebfa267940c491abbe0224497b982446abf8e0ab53be0f8bcec6cdb71e6ad19343a3de63b1126ddd8165be2d771639daf07862c9eba5cd6903367428738e499fcf9981bcfae9253ccb4c668f70d4bed99b7caccb13397916e4fb69948ab746385dda9e7958745ea80631cb6835ee063efc745a464fb0698b5e648f6fcc489837801f584daf43c505826852f9e73b87cff225b679b7aa57b02346526f4bddb966398cdaed94c0ee84d121dd2fd9e557aa5f07819b223bffc07c29d8ba70399429bed838dac2f7f501114db0e7ebea742c8cfe81802f4dc4dce46d2f6113d55020f78e3b0bc70e95a0e9abb634f67b20d32ea2ee690bc6d41e898b36553292253e0a0dae6980d52dd6f81ea991f39c44a7c775d00b2d543e1f8ea3262381de12a31b2de7fc6c5184268eeb3d7d72ee2451df52dad91b07b80ca0278a24510306ea9c1f4a025fdb7f8ef8b24c8fe7bf7a606eeaa0580b66cf3c27c77f9578b7462c6dcc673a3316ac9e60d3c581de1689ae5a4812bcb0f6e21fb9ecfe4dc661cc06dd4c1eb0cb06836770df785d290eb4ad5ce47a056f78fd779eaec6983a132eacc9dc685c1e7afd57a1b4943bf5cdd37b6139d2f137ea3ec369c7e71df44f806fb1b651af148e897fd961ffb852964e99d24125306557e8b11b2e9448ec8be9963d1c953c3ce90851a980c4557b613c066861c3e2d15e6665ddcbaa62d52fc791759613aef39ef7708a5a1dafad27b15f75d00d473c432366aba4d6543d1b1677c7c435ef37e33833d8ec3da7e128120d76988ded570683b5f2de02132ad80c5c1cb85d6d49e1531a03132df7e3540f63a17eebc61ec18c8df6971d46d0cc78566a9563f11cad027d4e4c10eb2dacfde2254e67baf842a26b553e8ae3fcafa9dd5238abd3df2ed46385780a6554004cbc7f40060a56886f869df4f7fbeb729e8436de9174ee84a5b8b4053e377ce8fcba2976a77b958781d2530b492ee33c0621460fa33b75868244f525202cfc0a8e8ce41c0ca16f7e09e7e458d1cbf0facddeb92a9ed4842a6d7b296e187b84645bebcbe3865ce694992ba80be0002324c76593335f68b3bfd33797aaeb74482cca16a8f73135eaf36f739a53149dd931416027beaac03f215434a45c9cc23ea13793665944553d0cc02ca1085"}) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, &(0x7f0000000040)={0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000180)={0xc, 0x0, &(0x7f0000000100)=[@free_buffer={0x40086303, r3}], 0x0, 0x0, &(0x7f0000000300)}) 13:30:13 executing program 5: syz_mount_image$btrfs(&(0x7f0000000140)='btrfs\x00', &(0x7f0000000180)='./file0\x00', 0x0, 0x0, &(0x7f00000007c0), 0x0, &(0x7f0000000380)=ANY=[]) syz_mount_image$ntfs(&(0x7f0000000200)='ntfs\x00', &(0x7f0000000080)='./file1\x00', 0x0, 0x30, &(0x7f0000000580), 0x0, &(0x7f0000000680)=ANY=[]) mount$overlay(0x404030, &(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f0000000100)={[{@upperdir={'upperdir', 0x3d, './file0'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@workdir={'workdir', 0x3d, './file1'}, 0x5c}]}) umount2(&(0x7f0000000040)='./file0\x00', 0x8cffffff00000000) [ 572.463884] team0: Device tunl0 is of different type [ 572.539694] binder: 28419:28422 ioctl 4004ae8b 20000300 returned -22 [ 572.565053] binder: 28418:28426 Acquire 1 refcount change on invalid ref 0 ret -22 [ 572.577908] ntfs: (device loop5): ntfs_fill_super(): Unable to determine device size. 13:30:13 executing program 0: r0 = socket$inet(0x2, 0x4000000803, 0x4) bind$inet(r0, &(0x7f0000000000)={0x2, 0x0, @broadcast}, 0x10) getsockname(r0, &(0x7f00000036c0)=@xdp={0x2c, 0x0, 0x0}, &(0x7f0000000080)=0x80) setsockopt$inet_pktinfo(r0, 0x0, 0x8, &(0x7f0000003780)={r1, @rand_addr, @dev}, 0xc) syz_emit_ethernet(0x4a, &(0x7f0000000240)={@link_local, @empty=[0x0, 0x0, 0x40000000], [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x3c, 0x0, 0x0, 0x0, 0x4, 0x0, @empty=0x9000000, @broadcast}, @udp={0x0, 0x0, 0x28}}}}}, &(0x7f0000000380)) [ 572.588504] binder: 28419:28422 BC_FREE_BUFFER u0000000000000000 no match [ 572.610196] binder: 28418:28426 BC_ACQUIRE_DONE u0000000000000000 no match 13:30:13 executing program 4: preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f00000000c0)=""/148, 0x94}], 0x1, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000080)='io\x00') preadv(r0, &(0x7f0000000480), 0x10000000000002a1, 0x0) setsockopt$bt_BT_DEFER_SETUP(r0, 0x112, 0x7, &(0x7f0000000000)=0x101, 0x4) [ 572.634844] binder: 28419:28422 Acquire 1 refcount change on invalid ref 0 ret -22 [ 572.645288] openvswitch: netlink: Key 15 has unexpected len 3 expected 4 [ 572.664523] binder: 28419:28440 ioctl 4004ae8b 20000300 returned -22 [ 572.707447] openvswitch: netlink: Key 15 has unexpected len 3 expected 4 [ 572.730232] binder: 28418:28439 BC_ACQUIRE_DONE u0000000000000000 no match [ 572.757414] binder: 28419:28422 BC_FREE_BUFFER u0000000000000000 no match 13:30:14 executing program 5: syz_mount_image$btrfs(&(0x7f0000000140)='btrfs\x00', &(0x7f0000000180)='./file0\x00', 0x0, 0x0, &(0x7f00000007c0), 0x0, &(0x7f0000000380)=ANY=[]) syz_mount_image$ntfs(&(0x7f0000000200)='ntfs\x00', &(0x7f0000000080)='./file1\x00', 0x0, 0x30, &(0x7f0000000580), 0x0, &(0x7f0000000680)=ANY=[]) mount$overlay(0x404030, &(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f0000000100)={[{@upperdir={'upperdir', 0x3d, './file0'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@workdir={'workdir', 0x3d, './file1'}, 0x5c}]}) umount2(&(0x7f0000000040)='./file0\x00', 0x1700) 13:30:14 executing program 3: perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f000025c000)={0x2, 0x70}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$full(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/full\x00', 0x301800, 0x0) r1 = openat$cgroup_ro(r0, &(0x7f0000000300)="2f67726f3c23fb57e6c60f1f4b45b74d999a9a8c2ce15b26e518a4cb3a9cd12dcea440d899c22c652b3a471b4a7db7f3fef6e0f6f549c61aae2e947abed6cf0424cfa9c981e9bdeeee03000000000000005b540745df4b1dee483b157624c5bc719a099e6a3509", 0x2761, 0x0) write$cgroup_pid(r1, &(0x7f0000000100), 0xda4fff08) setsockopt$l2tp_PPPOL2TP_SO_DEBUG(r1, 0x111, 0x1, 0x3, 0x4) socketpair$packet(0x11, 0x10000000000, 0x300, &(0x7f0000000500)) ioctl$TUNSETLINK(0xffffffffffffffff, 0x400454cd, 0x337) r2 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000240)='cgroup.controllers\x00', 0x0, 0x0) socket$kcm(0x29, 0x0, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x101, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$cgroup_ro(r1, &(0x7f0000000040)='cgroup.controllers\x00', 0x0, 0x0) ioctl$TUNGETVNETHDRSZ(r2, 0x800454d7, &(0x7f0000000080)) ioctl$PERF_EVENT_IOC_QUERY_BPF(0xffffffffffffffff, 0xc008240a, &(0x7f0000000300)=ANY=[]) ioctl$PERF_EVENT_IOC_PAUSE_OUTPUT(r1, 0x660c, 0x1701) socketpair$inet6(0xa, 0x800, 0x76a0, &(0x7f0000000200)={0xffffffffffffffff}) ioctl$TUNGETIFF(0xffffffffffffffff, 0x800454d2, &(0x7f00000002c0)) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000380)={r1, &(0x7f0000000300), &(0x7f0000000580)="9338f9f4bf8f6f407b7836c2fe22d141bd00dd690cc5f4d993bc84ee6aa0c5b0f7a193a24087ad7f85da5995d34518e35c776e5f8b05bcf6f1ac0ba4f5842aeacd41992812bd2f5f2b53cb66a1b8981772bcf68b195cb4ff3ccfeebfa8ecbca6147f01aa37f4b50b2e6f73e0e91081bf92da77e1ddbca83f485ab831964808c4f0d0888f0c12c10353cc862bd63c646084444c337b2ae52dbb5dbe54cf7e3d1ca23c3a5341bd2c8afb63724af4f8a1760f39594d6d26ff394566c1fac82b2f46eab7b0ed0f0a194a043666d753db490664907b16c98457e3962705f1a347d407b18112f96bb06b7fb4fe13e59c6a1406b007954e2dcd5673577e16bc08941b96cf4072585d78bf9974f398447ba3fc4b3cb0a984456288f4775a2235a4b56e3d8116e001997a1e24baa3cfe0060956ef3113b21d396e3bb17007bf9fa3e965bd190d20df444fe6e234ce6866ab9b8815f9f9641f24b870be495ca906fc97d8179fcf781503964bb7a79a413c7fbb135b80522539791e3a864868335fc6bfc28f3389fb325d6a57d5e62e351016b5289e13300a1b5ad4fd947f08c26aaa7efa5652c640abd3a98cea29e8191b5117344295c19db0a890c3983bb667f2e87b13e28b1615f843d74fe1157f73809ae81a576fd77e8b3abb1577a0699135786ac289ec90fdddd47a069cbbf3542d3cdbdbd10716965d072d95539a6a5c74fdadf8f17f33d748d16cac61c6f50ac2b6d7540050f798ef51ec65044ea97b74a2ab4a5134000f3928be9ebcb16a1adfed0d2025f6b3db7a253afb309dc2d61de398119640e0fc44ef4f0743dbed1702810ce88159e6d00f2506115a8b1a54a52d16691b4df3ee23ae94f9eb37801fa728ced996187c3985daf76fde732c89abdc446c0afc14f565c1279ec060a1fd06a4dfa21f07a2e8863819604981f1d22a94409ff6e0ad591dd9893328e74b6e642342966c134851590888a9c9ba18a8c1070dbd48c2966cd4a55e9bf107ae975002693ba6bc03f8f3b5ec17983bceb10ac9a2ac0b27f7668a9efcbf684327946771dcca46cd38c37807baa7c2fa794724ac79f77d0d416ad71a33b790b70cb5506c9e24072bd980456ed1a6f2c787efd3eee61d3eb701e4a8fa6b36693ab480ce50ebb2aee1b017d8be80a134e4b75cbe27c215d1a608ac472a91bab02eb1a77288f89ec29ed52e291246c25fc1f1a91f979da2b7c1cb3f2e87e5a0854e235fd0492a61a5ccf77734853789714559b5c45c970c5badf87ed3fff81c2982430c90b533349e1eae312fd4fcd80ec82040a0ef099dbc2d27812dd61ffb9518ea587dc61c5698f044cc7ed649477c8591516bfbfb59353c8c5d55ef543f5164fb55287d1a693d9ae7d0e6f3e0e4e4593a0d5e10c5f96f30b835555e0cc2fdc771dec7bff241c03c3213c05e9b903e7006913ee66b331d0c0de4972294a5d1ab1394993be0bc8c3faaf21267deccf2471efe9dcb8080b01d41d2c41cbeb2bc713b088abb083d8c16368d1f630fe2d7d2cbe9f93812749e3fdf8dec52c51c5d2839e5989902931ce73c65b474c0e5541b8a25a42080ea1ef5751e0096bfa78954ccb460f7ec9ef3af5abb911aece9ee2ec997017b947b96a6db319ff223f33bdb6039a3d27dbd020e8873a40efb28baec5860f028c6c9747e1af3217edc40b3fbdf23c2add78bf6a3fd37a734e77986b06c9085932f38a48cdf687b13cf347efda4397a3ad59271b27612384c5e33b37deda7326ce9256551904d910d91a045855741b23db2e40011183f6e6ebf5644ef999c72085fe8216e954fec4a91c47889df6ab5817cd847655e66ed1fcc5d5fea53d59ba6f8287e23ac7f977003cfd3a1df6f010607273db3153487b03457ee8a2346d12d681464847cc02b1b227725fe67335ad6025842d7035894a6fa8716d6705d91129180a15e511480e72b519c61d0da9243448715f776bb8dd13cb26f11449fa246142a56f49402b6fc515624a2af98e7ec2e425d46bdb4ef1f9458d8f3381e6066e74e630bbacf9e36c8ac576b93cbe8e9c788684aad430668413b01a4a5febb60508f4cc2e22cbf8dd46cc7aa0f3cdaaff5d5059b0313edb29c407ad8b268951146303f6a314911306988b5f68a7d5d65a187441483bf218ee59f6865c6f831bbdb6f11289346158d69546e2f4716628f5ef8d9663a142535920e4909db4a66b0dbb214d3c3b356415f1dc15b3f7b52b60f36c366f393727754e7290eaf3d7fc6007657f6e96b939472311e6069ea06c46f295097983d1ec7ac61e82b90a619c60920654fbc9a7a294ccc322a6b099972ce1ec04c50647c5eb41e99bb5f6da613c4f4a556c93ad74b84f924ab1acf5bab84a0408c82b466c6df2829f08ca9d0fa61cd823cd4aa07b53cf28012d8d0b863fa0336a0706e435e1b1dc7e19138eb69d3e57edd69addac50fcb8fce5905f5a7fe433fa77e7447ab77c39b914210b86e2b8c7be0cda20611a6d81cda12563a13ce493ec8ddd5570d5923740d567ba5242f16065e07a53dfece999b488988a60847d1120f5f3b7afd07f004dbc0ccaa92c80284b8ceb627f56a100bee4255853b434d648ae5fc00b474129aaf0372e83cdb758853b485a003189a6d8150617b32ab0087703557d952eab720b8fcdcf365ac9097e6e68488af8b24ebc7964527969e5085c3b5a9ba4787abb6860006af929b4d426dcbe8d4802d88bf782b6174ae3a02a8bb8b50eb0ba3738347f1ebfcc4bfe925bd4cadcf883d04279024e77fd352a3a485956851013d53c8f0706ae349e49b6188b5f0566fafb77e97bc247c30f1e9ddf498f67f17777fdcd36efb4c0ad25438d3a9347098029b664a292afde6b189d33994bcc29b697ecb54f973bd21613254f9977b0b20b9b08f08d93f646dad9761b3a20e0d7f39d03e404644e9f6989393f43b1ec84f69ce9b14189a7ca068cd9e87ccbc68c436e5e9be56d866cc6b82b795d4f72d693d2a09252c60d789c41f890c12d61386a381ff3379811d56a1bc281bb74be543a659e667ce5e6b515e85f7d2fa0cba1abdd52ec712fcf60248b32449760ceb1a644807f60152bdbfc95fb335003d60296857966fb5ab28742492f891261fe45e3dc2d3ec31f8af6ced1080bdfb6a747cea2530b7373dad89f3b7f3612010929dce6f7e34f909dcb168a4e7b2ec314e0a8d4873de04633740259640a72f704103109b2af6a2caa7d0ab13e1ba880ffa50c12b8cf2f3fa245fb333c6a7e49b72ff8dea91a325b2d6b72598d3c568dbd9273e80922041c5a937532b75ca617cd31d4ac89e97463cece73ad83b116982ca3f120460dd24d109a72ce4ae6b2ad2cd0e9c52c0fb1491eb3515a94a946b2c05868db13860a0d284079fca7e91b150d4e11f3fc989bc1f8a6428b4cc88563148ec34ab35a63479f13454e23dc5882202252ac9c3711c97373950ad3e094577c0602dfff80a68e98f983451b268bba04179c3d5d8e7d031ddd375ac032de80071cf155d7acfc8255d5cfd84f66742831a00a1d6edc6fd5ed44cd9797ba90bdb57194984f67e3ba99c78ffaa11b29bc0b27c924dc19e4079117243cd51ccf81a7ce57693e31ce29f8e66bad0d12d6857983854e8bcb0d973ce770258b85b10359daf5256da010e08fbba52872088b5bf4a89dfbd184e44bdf69a2030200ec0e1944b9d269c0c929247be3c73ace446d91bcddb784f890822b7ba30ff1d4328ec6e378d67a7b96ed1b34d676aa3e210774dbe371cba11a0043f319f007e219fbfcf0db15d8010cda51623f8bba807a71f80b1bbcfbf4d41b0195902f26a0981f0e6380a14871a498363a2bc0743120172e0fe8a3624256b407353b8bd5dc53ece26e5fbc3085269ee887f909dc7ba78cd441828fbc5492d3476bbe2f456f174fc9dd8d5cf9dffc2f3611d00fec3f2b5f6f5bb62507af7d1f86865d7b3df11f0fbea1bd329bc774968ee35053b5f78ebdd78baa74a801514920b7c773a8dcc98ddd4835e85a0f3ee87fcc22ff6b9d96ba2d26b1fd08bd40beaba635f3a390cba03c9d7d1529c1db17bfe1c3061d84f7f01e4a4e7c81d3fd63a63f2d21e2e34f44029ddf8686a43842c816bedf7a702de9aecfc221e0acd6b4589d9e53a2f0bbde99e8b3fc93cfbd6493c925d14cadf9e73dd1ad650f4c64dba8d51fb33cd118a715f93b61bade41e4a58463db05e94dc4fff828bca0f9cab35b8794c079cae3e06f96db0c396c4f7f047121d374f0f1613b04525c44cc572f352b0335c261eecc0ba78c45da2fac21f69cb9e20badf137621c8a19940b996fa2db1ca3e070969765723ba5a5ae2e160919cb68a1b9bb23174aef0ac118ca8273b63e2086947795cac8d172219493a72ee08016da2cf50b3de75594b4c9d52c3d4d63caa9fc4b4c2bb1bf0154ec67da763b90d71ecd4cd6c805c2493f1dc96c2ee41e9822dd069fbe75b38cae500df65a01dc2a34b968b8c797ec6b41844b652a484c3a652b7377c493e53fc1f19d56700db6005c3e4ca08737e49581881b8cde35dc37d238ac032be7b41725c87599479c9c4a71813eba63f3a0b06a5b606d60489465bf386814b878ce933847e6e5f8220e4efeaac268bc4318a6ad436c83722e7139b58eecfe62062a3a5d51a6a89164b6cdc64cd3d6d72754883abe3aadc786bbe082a3bcff9af2bdd29b38a3dfa9ce9b90d51097c4a74e259df7fc62254b3495a14505a6ad9176f72f9fe7a7b30a6cc01aac3e215bd75d589dd6b477eb12ed0fd585e16ccee8cb344f74a0f91b3e0d4d4009c54bbaa7e1d6b6a0d20bee50c3a6ced83ddd0b8875386e10a3a4484f8f37d49fb18ade2b58fa6b8dff992ebe21758506fe474600fd70466a807cbb214d37a7d80bd5909e8680fded12a0390cb60159a127de894e045d0e575cafdb7e914be9bcca28ca5d6a6435eb233c1bc864be8f2db0c54158337a3764929e28741f280ed5dd2206d47a9abf400f0c4f738685b13fba895c41704fbc665ab7f05ca7ffcdd7bf761ad00f7b2976c22d5f7da127e39eeef3f9c002990f668c92e0322b51b1c9d068bce7b3af6edc55fbff574e8f155bc8f0f76b724a5efa377b66a67d181aa24666d1a1e3c34bebe716dcde0da2827c8afa3cf3639332cd72e66e77ccdf0b737718ceeb62d4d85b1e109be65aa13dc0906ca13cd3977c64dee804f82c3c48889350f456678ff976eb26280e8dafce69074755a70cdb1bf021a6c81f3e385fa20c09852d569225104faca9f88517d194235801525d87d5ea44ed26749d9d1026edfea68f105d8c2c10c8debf8d397eb6b369e74010f71285f919962da49ee34896798ce944aecbbbb007b860c0599d2a4944e6aac9ba6cb0dd657c4d3986e1ef8c6b00843605c14481e7863628dfc1f683c29202842690f1fc5b74ec19eb9964dda957ed70c3035ac6ea0338c68110ea21e52135b646d7a6b34be421658d8db01e21bd4a7418f7a266caed8517a6dd998f44d8e7cc2e20ad929fa84194db78cf5061c16457ebddf10820ade523ad51bf3066a3c1a9457000feedca6a81eb864e586503ff52718f78c70433499ddd815e2f30e26b5d872fe12e9e3094ce985bfc9a631ea30f9ab1c0680cb9b52f13ce310edae240619616d6096aeaa745d511a6efddf"}, 0x20) socketpair(0x0, 0x0, 0x4, &(0x7f0000000540)) socketpair(0x1, 0x1, 0x0, &(0x7f0000000140)={0x0, 0x0}) close(r3) 13:30:14 executing program 0: r0 = socket$inet(0x2, 0x4000000803, 0x4) bind$inet(r0, &(0x7f0000000000)={0x2, 0x0, @broadcast}, 0x10) getsockname(r0, &(0x7f00000036c0)=@xdp={0x2c, 0x0, 0x0}, &(0x7f0000000080)=0x80) setsockopt$inet_pktinfo(r0, 0x0, 0x8, &(0x7f0000003780)={r1, @rand_addr, @dev}, 0xc) syz_emit_ethernet(0x4a, &(0x7f0000000240)={@link_local, @empty=[0x0, 0x0, 0xe803], [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x3c, 0x0, 0x0, 0x0, 0x4, 0x0, @empty=0x9000000, @broadcast}, @udp={0x0, 0x0, 0x28}}}}}, &(0x7f0000000380)) 13:30:14 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) setsockopt$inet_sctp6_SCTP_MAX_BURST(r0, 0x84, 0x14, &(0x7f0000000300)=@int=0x4, 0x4) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$FS_IOC_FIEMAP(r0, 0xc020660b, &(0x7f0000000480)={0x2000000000000000, 0x1, 0x0, 0x0, 0x6, [{0x0, 0x7e, 0xffff}, {0x2, 0x200, 0x10, 0x0, 0x0, 0x800}, {0x9342, 0x200000, 0x10, 0x0, 0x0, 0x100}, {0x8, 0x7, 0xa8, 0x0, 0x0, 0x82}, {0x1, 0x7, 0xfffffffffffffffd, 0x0, 0x0, 0x2401}, {0x0, 0x70000000000, 0x8, 0x0, 0x0, 0x100d}]}) r1 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000007000)={0x8, 0x0, &(0x7f0000000140)=[@acquire], 0x0, 0x0, &(0x7f0000000100)}) r2 = dup2(r1, r0) r3 = mmap$binder(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x9, 0x90810, r1, 0x0) fsetxattr$security_selinux(r2, &(0x7f0000000400)='security.selinux\x00', &(0x7f0000000440)='system_u:object_r:faillog_t:s0\x00', 0x1f, 0x2) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x14, 0x0, &(0x7f0000000040)=[@increfs_done={0x40106308, r3, 0x4}], 0x61, 0x0, &(0x7f0000000180)="89d27357cea507968bc643267a64c31f362e69ec8015bc8f2dcd7a7e2d58ab76ca5facab5981ac3232ffe4d71a1fc19e006429ea31125b8244f94c7d3fc3ad04c37e5cdf69028af66348742f2834cff7ec8dfc3d89c8bdd0aa645b4647338d59a0"}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000002c0)={0x8, 0x0, &(0x7f00000000c0)=[@release], 0x0, 0x0, &(0x7f0000000300)}) getsockopt$inet_sctp_SCTP_RESET_STREAMS(r2, 0x84, 0x77, &(0x7f0000000100)={0x0, 0x4, 0x8, [0x58b, 0x0, 0x5, 0x80000000, 0xffffffff, 0x2, 0x8, 0x4]}, &(0x7f0000000200)=0x18) getsockopt$inet_sctp6_SCTP_GET_LOCAL_ADDRS(r2, 0x84, 0x6d, &(0x7f0000000340)={r4, 0x40, "dff662145ac23bc4d82d2c85349de2b0f19911ec843eca54aa8ee4ba92d44ad8b11410c99d6df4a3c89253c8b8306cb2bb44c58b6f6db84809bdefd336007797"}, &(0x7f00000003c0)=0x48) getsockopt$inet_sctp_SCTP_DEFAULT_SNDINFO(r2, 0x84, 0x22, &(0x7f0000000240)={0x2, 0x8, 0x7, 0x10000, r4}, &(0x7f0000000280)=0x10) 13:30:14 executing program 1: socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)) syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0xe1, 0x400100) creat(&(0x7f00000001c0)='./file0\x00', 0x2) openat$dsp(0xffffffffffffff9c, &(0x7f0000000200)='/dev/dsp\x00', 0x8000, 0x0) syz_open_dev$mouse(&(0x7f0000000240)='/dev/input/mouse#\x00', 0x100, 0x10000) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000007000)={0x8, 0x0, &(0x7f0000000140)=[@acquire], 0x0, 0x0, &(0x7f00000001c0)}) r2 = dup2(r1, r0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000002c0)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x40486311}], 0x0, 0x0, &(0x7f0000000300)}) 13:30:14 executing program 4: preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f00000000c0)=""/148, 0x94}], 0x1, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000080)='io\x00') preadv(r0, &(0x7f0000000480), 0x10000000000002a1, 0x0) ioctl$GIO_UNISCRNMAP(r0, 0x4b69, &(0x7f0000000000)=""/20) [ 573.005772] binder: 28469:28470 BC_INCREFS_DONE u0000000000000000 no match [ 573.034878] binder: 28464:28465 transaction failed 29189/-22, size 0-0 line 2834 13:30:14 executing program 0: r0 = socket$inet(0x2, 0x4000000803, 0x4) bind$inet(r0, &(0x7f0000000000)={0x2, 0x0, @broadcast}, 0x10) getsockname(r0, &(0x7f00000036c0)=@xdp={0x2c, 0x0, 0x0}, &(0x7f0000000080)=0x80) setsockopt$inet_pktinfo(r0, 0x0, 0x8, &(0x7f0000003780)={r1, @rand_addr, @dev}, 0xc) syz_emit_ethernet(0x4a, &(0x7f0000000240)={@link_local, @empty=[0x0, 0x0, 0x28], [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x3c, 0x0, 0x0, 0x0, 0x4, 0x0, @empty=0x9000000, @broadcast}, @udp={0x0, 0x0, 0x28}}}}}, &(0x7f0000000380)) [ 573.071709] binder: 28464:28484 transaction failed 29189/-22, size 0-0 line 2834 [ 573.075758] overlayfs: failed to resolve './file1': -2 [ 573.101733] ntfs: (device loop5): ntfs_fill_super(): Unable to determine device size. [ 573.156978] binder: undelivered TRANSACTION_ERROR: 29189 [ 573.162540] binder: undelivered TRANSACTION_ERROR: 29189 13:30:14 executing program 1: socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)) syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0xe1, 0x400100) creat(&(0x7f00000001c0)='./file0\x00', 0x2) openat$dsp(0xffffffffffffff9c, &(0x7f0000000200)='/dev/dsp\x00', 0x8000, 0x0) syz_open_dev$mouse(&(0x7f0000000240)='/dev/input/mouse#\x00', 0x100, 0x10000) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000007000)={0x8, 0x0, &(0x7f0000000140)=[@acquire], 0x0, 0x0, &(0x7f00000001c0)}) r2 = dup2(r1, r0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000002c0)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x40046312}], 0x0, 0x0, &(0x7f0000000300)}) 13:30:14 executing program 0: r0 = socket$inet(0x2, 0x4000000803, 0x4) bind$inet(r0, &(0x7f0000000000)={0x2, 0x0, @broadcast}, 0x10) getsockname(r0, &(0x7f00000036c0)=@xdp={0x2c, 0x0, 0x0}, &(0x7f0000000080)=0x80) setsockopt$inet_pktinfo(r0, 0x0, 0x8, &(0x7f0000003780)={r1, @rand_addr, @dev}, 0xc) syz_emit_ethernet(0x4a, &(0x7f0000000240)={@link_local, @empty=[0x0, 0x0, 0x88a8ffff], [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x3c, 0x0, 0x0, 0x0, 0x4, 0x0, @empty=0x9000000, @broadcast}, @udp={0x0, 0x0, 0x28}}}}}, &(0x7f0000000380)) 13:30:14 executing program 4: socket$kcm(0x29, 0x5, 0x0) preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f00000000c0)=""/148, 0x94}], 0x1, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000080)='io\x00') preadv(r0, &(0x7f0000000000)=[{&(0x7f0000000180)=""/253, 0xfd}, {&(0x7f0000000280)=""/220, 0xdc}, {&(0x7f0000000380)=""/180, 0xb4}, {&(0x7f00000013c0)=""/4096, 0x1000}], 0x4, 0x40000000000000) 13:30:14 executing program 5: syz_mount_image$btrfs(&(0x7f0000000140)='btrfs\x00', &(0x7f0000000180)='./file0\x00', 0x0, 0x0, &(0x7f00000007c0), 0x0, &(0x7f0000000380)=ANY=[]) syz_mount_image$ntfs(&(0x7f0000000200)='ntfs\x00', &(0x7f0000000080)='./file1\x00', 0x0, 0x30, &(0x7f0000000580), 0x0, &(0x7f0000000680)=ANY=[]) mount$overlay(0x404030, &(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f0000000100)={[{@upperdir={'upperdir', 0x3d, './file0'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@workdir={'workdir', 0x3d, './file1'}, 0x5c}]}) umount2(&(0x7f0000000040)='./file0\x00', 0x36000000) [ 573.320832] binder: 28497:28498 unknown command 1074029330 [ 573.391369] binder: 28497:28498 ioctl c0306201 200002c0 returned -22 13:30:14 executing program 4: preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f00000000c0)=""/148, 0x94}], 0x1, 0x0) r0 = accept4(0xffffffffffffffff, &(0x7f0000000500)=@nl, &(0x7f0000000580)=0x80, 0x800) preadv(r0, &(0x7f00000008c0)=[{&(0x7f00000005c0)=""/97, 0x61}, {&(0x7f0000000640)=""/200, 0xc8}, {&(0x7f0000000740)=""/34, 0x22}, {&(0x7f0000000780)=""/56, 0x38}, {&(0x7f00000007c0)=""/32, 0x20}, {&(0x7f0000000800)=""/150, 0x96}], 0x6, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000080)='io\x00') r2 = pkey_alloc(0x0, 0x2) pkey_free(r2) preadv(r1, &(0x7f0000000480), 0x10000000000002a1, 0x0) ioctl$PPPIOCSFLAGS(r1, 0x40047459, &(0x7f00000004c0)=0x80082) ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TEMPO(r1, 0x402c5342, &(0x7f0000000940)={0x8, 0x7, 0x1, {0x77359400}, 0x6, 0x7}) sendmsg(r1, &(0x7f0000000480)={&(0x7f0000000000)=@alg={0x26, 'skcipher\x00', 0x0, 0x0, 'salsa20-generic\x00'}, 0x80, &(0x7f0000000300)=[{&(0x7f0000000180)="04192a6b4c3f503248eeb6260f2014f1d3be2802fbc3541e3312c2ea28435304e6fe84503cea2a0335d5172e7833693859e08db541532096349078e6b12059299b42043897c7e2c9956a7e9394e1f8cc0c89f447e7f46508933fa3d9d1c6805d0f3b17259272238cb7a8ddbed774f8543054ccabd91c9fa388ff4f1a0c0d71b424fabe7da18fa3db2c08103bc5c467ed7e541a10c7d01e3a67acb011536e7e2d4bbbc525965bc61e093dfcac97558e85644d1f14a66fffec36dbbd19", 0xbc}, {&(0x7f0000000240)="d1542123a78d1c80267a5a4e1a9c017470977571550252adc10a7d000a6a547ad1bf3f69df1a3b9e3434ec494b90f5accb1afad0171ddeb4dbd7a8f0c60d6a354270e7e95ff6e4e444e7debb68d88c9815616b5d0f81db97a26f13c6562e21b6e8536a351ac52baa053099b3c1594250e32137256caa32131c929d1b56295d4035de32bcfe9c005a2581bc85f328835055c2eb8a4b08e0d6d1d3a3f5df5efadb7c4104bc6577accfd9e413542ba9690a871aeb88f6ed", 0xb6}], 0x2, &(0x7f0000000340)=[{0x30, 0x10e, 0x4, "071161dcfae6fa87bf8190f24d3014361e70485b4f89e8005dcf86"}, {0x108, 0x108, 0x49, "acd0af684634f46918ec9213275c3caac2173936f08ee1022b9c137819662678e1e9bca13d0b56fe8c64c9c064c4eca24512ad617311a5a1fa92861f8aaf9825b2caee86d12455bf61f90b48e8ff2ced1d5968adf85a635d65666edee1d1a71ef388b77c5447a5075c26ff0479f6a29a244e422037b3a5a310982816d123ca4a175f5494124b478bac748e4c13e0c2f377e16b6e677085728a94f21fa374f565838f19ff7d04268fccc5c64e54d75ec77956d6298345f13f556fed56d68b59121fbf89c9050073ebae3a6a07b829cbca02eba7fd7c6ffd6df1869e3cc5e018fa30087c3b0cbc7ea9a704a8bc53b5fc901b8bff"}], 0x138, 0x20000041}, 0x4090) [ 573.453875] binder: 28497:28507 unknown command 1074029330 [ 573.485782] binder: 28497:28507 ioctl c0306201 200002c0 returned -22 13:30:14 executing program 0: r0 = socket$inet(0x2, 0x4000000803, 0x4) bind$inet(r0, &(0x7f0000000000)={0x2, 0x0, @broadcast}, 0x10) getsockname(r0, &(0x7f00000036c0)=@xdp={0x2c, 0x0, 0x0}, &(0x7f0000000080)=0x80) setsockopt$inet_pktinfo(r0, 0x0, 0x8, &(0x7f0000003780)={r1, @rand_addr, @dev}, 0xc) syz_emit_ethernet(0x4a, &(0x7f0000000240)={@link_local, @empty=[0x0, 0x0, 0x14], [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x3c, 0x0, 0x0, 0x0, 0x4, 0x0, @empty=0x9000000, @broadcast}, @udp={0x0, 0x0, 0x28}}}}}, &(0x7f0000000380)) [ 573.778198] binder: 28469:28482 BC_INCREFS_DONE u0000000000000000 no match [ 573.935578] ntfs: (device loop5): ntfs_fill_super(): Unable to determine device size. [ 574.059901] overlayfs: filesystem on './file0' not supported as upperdir 13:30:15 executing program 3: syz_mount_image$vfat(&(0x7f0000000300)='vfat\x00', &(0x7f0000000100)='./file0\x00', 0xe004, 0x1, &(0x7f0000000140)=[{&(0x7f0000010000)="eb3c906d6b66732e66617400100401000200027000f8", 0x16}], 0x0, &(0x7f0000000340)=ANY=[]) r0 = openat$dir(0xffffffffffffff9c, &(0x7f0000000140)='./file0\x00', 0x80000000000000, 0x0) mknodat(r0, &(0x7f0000000180)="2e2f66692e65318c", 0x0, 0x0) msgget$private(0x0, 0x8) r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000007000)={0x4, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, &(0x7f0000002000)}) perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000000c0)={0xc, 0x0, &(0x7f0000000200)=[@free_buffer], 0x0, 0x0, &(0x7f0000000140)}) bpf$OBJ_GET_PROG(0x7, &(0x7f0000000080)={&(0x7f0000000000)='./file0\x00', 0x0, 0x8}, 0x10) unlinkat(r0, &(0x7f0000000040)='./file0\x00', 0x800000000000000) getdents(r0, &(0x7f0000000740)=""/246, 0xf6) r3 = openat$ipvs(0xffffffffffffff9c, &(0x7f00000001c0)='/proc/sys/net/ipv4/vs/expire_nodest_conn\x00', 0x2, 0x0) ioctl$KVM_SET_NESTED_STATE(r3, 0x4080aebf, &(0x7f0000000840)={0x1, 0x0, 0x2080, {0xd000, 0x2, 0x1}, [], "992e6f8d40a5f0abbc296205779a20dc74cef197da0b871261a0de57ddf39443296b46be89af85a40d52f4378fac5223b2231fc52f72a3c81f9584ed6a8d8e72160ead15e8d8906072ad66a720cb851c8f93e87ae3359729c88aab34008bfe1023f28657cd4f45078d87490dc224e60bfad6554f01162da48ef82300266bf3cd5d1174074eb26fb776987994b7fccf49abc261684d2825fd3596066063fa7b2e4af700225d4914fa39f31ac35611ae958f19ab21197959cfba4e81b9c0b15860c3d22c94a5944fb37902741460734abaf5ee3e08608436486dfbd8285cbbf0a620bfb99a8e5544bc89f1f20b858f988966c783b9a014f00b970e80851916db1ed9e7b3e6e2b7315d57ed61c9e46c29cc67d61c737361a4a1dd2b2378c69ca37cb30487db3801c4be3c8bf582f3f7363e62d67e52f968e4cc909a11b9e19da885552767d6f62392a58c6e627866c35d853ca62ec1d4a2d9c3ea62b0dcc7fad78f21b0169c2d36277548a02aeef8a880c07686144a3b33f53501616314ad650c3b31651e5ecd23b80036c9913653588fdade53f7e97b5fe13e989105c6de54336e7839041e1459e92c7d4c9b05680465e9f6a3fd3bf1cf49a59746cb89985a7c367b776a9c0bc1ef944fb5b83ef87a91bfa233e242bd48f714b1225896edd4fff4d648c943b4438621ad6d24f2b75e388925a761cdc9e31542b05388d8ee7c84e14f81767ea3de929b942be5ef023d034bd2899e97307ef58afdf7e04fdccd1ad096b098c7c2dd809683a6cdd0a7fea0b5f7a6c4461622db216683db508a49022d13e3618eabe01540f27e642208ea6689cc4e115ba7c759df825d54242fc78df6b3ac346e67c44d96ec4d682876e8d74b5d1248f1a7b449881627f708e28decaa2cbd459ef9c0d80287f598f3c00088be5e502a4dd171ebd796bbb7fbc3e1caa6e88b69dfc20cc054ecff3825916470c30160b3e853ac83b2b729809b91671589db7cfaca8b36d7d72ce1538eae7e66770dd1c76cb338667e8d73b6deaaec47efd1173b31f52dff6eac2bb70f93bc1eaab738b0176bda41bcb8b3ce88ec328d828125c9be16ddde4f36ca16deea9d1114fbfaa38ff7fdad4de916e4a5a05b9dc61efe1d442c80326e8d720b40c2268710bed5b9f84cf926ee925cce298c97a4c175b140539b5ade6513598f60df22d269f5969c02a29cecac4e73047e38e3083f708034f312d824b1cce42639905994f4cdd01fa7d00b652ac210c52ec41a658b50e4ee81f26c7385140ba9eaff18cb4e80aa0f3f07dd8d699d99af79906885dee5c527207163167845f8341dbf2066074d174d3e819ccfabb79cdb002069f3917418fce11e7a22cc52e117794411278c10f0c736fd806bd83890f501f3bbb997dc2b2f948f6b399d481fa909363ac62543c800b691d66b97ffb1f19663c62b96e4bc56c5705406bf0853b9368c521c83267f61ba8e5f8276950154af3966d38d8c6597ae51e692fd03a254dd1f321b40fa0040db8c2494e491e508f915c21b5e5988186d3bd31ad35bb64e8688c421c968d67e0a36b19d8eb89c327ddc640422eb6b1540e1343780d7336306bb3b2edac80f176572086322a8ad330306ab292aa56597e28550a2e9d090e06c2c65cf5c31152b05a3ce8ed908ef5c34330245de32e239bb201c1d80e702bbb764f6f1522cf720cee7ca4398d59a1d63e54c171ab38285b403ce32bcf81fc551e8f8b450a4bd09a495670338f34ae9f90630bc5349558ec0f7d682f3cdd183b5017c7918e8067900067b42d058ff1a6ceb01e0afb1ada8c2c3512b589638d783fad38a2cf797a4aa72f307bee889ef4a9da2dbf7002149edf16536af57e990032d9fdee05e54d24ae7b7651f71b980fec96721ec57353135098c93411049f59bb6346cd3970a9f83477d8fd2872a3f3bb81547a3ef329594e71500d459cf7b1c1bee79ff1d8efa0d3d8f822196bcd8046158024cd9e65344e5a477f194b4edf6298ebbe8005e5de3dbab3e35469fb96d04d026440e7268c6608133a13398503c57066b3a75cee5db570cc86cf4eb80f39a6c3662d261ea33a70c7c107dfcd3aebc7941e4ead32a56c069f9f4ccbe4d8a6b4d830535933efc1108ed17449c35e912d27f3dfe5995959e843f208c7c4b131d875a5fdd0f27ea641cf388c88c1cd98d52082ec6feeb295e92fce2f47238f8eced65fe45f379c32594bf5aa0ff03345cc52eebe7c757476d5d3d6f3f4cea83bee737ba0c8de961b52154ad3e1ac3b638908c65b458ecc20c752493f301df5862e1cb518fedcf0fd84e3c98264060cb8ed5996e2250ed24f46a8b95d6ae7eb583ef7b0665b43d4bf4cf8d85c3eb99f8367c99fd4d1ac2df697a8808d79cae03b845ed157018cc99b6f67f9aec9525423226998e1b8c7d9f77fd10eb3e65162da15b2857a68b0fc7108f8da09f57f13b2fc946ff71eac65d3b0b2e25bdb0ffda5ae6a4e74981b6afa66253ca84ad2a79ef3baab51a6098e2ca9fe2f606a0d169eb57b1b1203714b5b1bc0526224734af0a0fd98756fede0eb5a7b5c922e6f00226a46cbcb04cb2eff8914ff402bac321f0a13e0abb4e980f2b29cdb2a58af909651819774175884f1df0510b40c302ecff38ff1fc0868defdcf8f1adac5987aeb819403d125c1ab01338cdbacbca85da2cec0ec2e934984202df0c2421168bfe6d69cc99906c3dde8a2a1ae27f66b2ac5461cfd95a37ff240359effe3f43ea63605868f0337e50cc6bfcbb9852cc3864382518841f109c131646c807c42bd0de587aca88c1b02065b478d26abbb982311c1a5b45e6a0984c5792b0235c785b539431161fe6c42eac01b2fcc2daaba6296815cea446a665915be59899693e1a2f4a167fb8288327f864fd41168e57dc286f5792278005136cc17a28f911a23bcf1b4171abe84131851a32b732c6f594ac7c6888568fdaa37258f2861bb24f442f6e74a6739efa4ba9181840124fda730bdbe45618d0d60b26d35c10dd888cd620735a97dc2fe771f20bd081ba3ac9331401c147063cfd867943101ac22c04c372c792eb53b662f8bed7c23aad24254ae8c49c55b361e8b3ab3cc89a5a2f6aea71948c1bdc674398b54558062e1802fa22f4edbd1d491f415c418f8fae9a31259b460376a872ef1f746253deef4725f75eb3f1e8ecd9aed515d03f0ea819396e05209720c0fa23ec8c1ce418730ff57192d02d2e643aa8a398268abad35f88af5e6e562a3fbd123f1c88da80842f8f814c56e4a59a45a5229ff675e97f7ca4847d8497ae38b28fcd23fb4e1ac75003dd6a986240e395af9e6c91485774e2c5d0ee922050d1d8458a4ad5acbc0bc8ddc9336a192ac1d437dd1549fa0e47b220435f638d957650e58bbde3d9833325bc3be12f4de1eedb0df62699c199a3a02acb5ab96d7df853eeed7f0b92051c7cf025b313069ca6a24f7123e7a474df371d2eb001de139729e937d19c8dd3db1d3156e9a993abdc63f53275ae3605b287a0b1b33c342bcf7a64d055950e4a5b79200c528854c65fdc0a3122546f770005d32465c8808b7859178d5f40ea228d0ecce6c366f0717bf7f947f0e50ce257b7f959d1eb381e61e28a740f94e2230da098ede78487da4a4f5926566250e145afff6ed9c6206d664b650bd717c9e0a438fed6a098dfdd95d94bdc24b6ab727640ac57729caf8226a7c45ba01e8d0b312089ef390461c596783ed7e52f6d462649e20d1349ead25244fb3041138a119d9e8f49b2b6f5b4157c63524d370bd295d5608c5722a1f8ca300c93115851f3609935d748c241c40cd2f661457191adb86cc0209428ba7a3aa1edf8893c27b7c3b9ab280a9457f6e46e35100b2ead6b5b67f451ca444170dac4d4e73e452ff03f7cbab4b274833b67cd01dd1365b0d0775f3c92d3e474a87cc2d5c808e48e1c9b2550bbe9011e33ed600dc2c927da4451f7f83d7a4f82cdd8bf90af8d48ec3afb5ab21c4dbea956678124e7b69e2491be3ec53334eafa2f4c396fce88a9413f296ba65e21cbaf0d4614207adb172671f9dea703f738b99fd8b8c6d7f909cf1f816cb13f279fcb13bccf4b5c812bd9616abacfe85d8f2fa183a8b85b5fbfb0f275b5ca2f64f7ee8417f8679b26b7fc0a8d42230dcd4a652e67a449874e9b51d32398b3cb24b963848e79cf782459b0c6d6256923696812139d525d4036f12d9c769635f48bad527b4e717e0241844b6f69e4fd0a8b972acd46cafaf2f3e4b1e09118a2d6801726304be8bafb80ffdfd2916a47146d1ff17c8e55ba80e9a56bcd4d6885f0a5d9801a4acc33f8afad586d54b95400bcc714b55dd698de5f57fbb562824ee2e70efb5e31cdf1065dc44d9ec19b0b655881e978d0cb51797cc4e97f0ade4a17bc88b05a0c566a9122f7214145fd900b27a15627665da180bbc539b380c5c46a6ae8aa3497d200b6bd05ec26d77ac5822a60be2df646445bf1644ee60203a7b66ce46979f0ddce0ebdb0a1f6a17523a4f5846455cf7d033eb2ef97a1428c19c4a5ac28fa08b2816d3dfa0ec813d0f02567d43c892c52d56f96b265e1e66014a228cb2ea98bdb2a4270a43753e658a3493e7580a5c04aa1c015cc96e80df92eb0c0814c3f49a91c4729feb747b5f2a4faf82210f061577bcb54d2f33f6bc6418fd7afe4fe4f85b600f17a5223390e8819196053bbbc37c4bd35d7641c27ffe15e9514bdf92492e6a30d0cc2571d56d41827297fd62205b5304c8cb48d1a7c50bdd9dcbc5046d1a964df2c9560df47701efc30302d1ce11f7375b013bc6695b8790c45d5438874206ba8950a8bab79033fbaecb582f328818dffa93fe78189971341d3b626ae1a2dfaf915f50d25c836dba16714b5b260ab57b7fef0cb6148d3456fa492ab69f0f8de55d961917fea9010fc5e4c00b2cf8a7a760c198f34c50f17c533e7f85978ae579a7014d09cb5487231576cb25143368a022197ad09b18708412df9979e27e5c87712d6242b3106fbfb26b0b3e493316ae37bd2dae069bdc9b35ca79e6a30d0a0250598ca65d4eaabf8eac28151acc6edf21f17c8b96f0213c76bdba22d3a3a06428046ce01240a6df6bfe104c31e85d988bfec536fc02c55304d59cabedd0136302c5f46f76290beddcb584ba60152930a4bf9e3c8643816f87c4b7bfa50dacf20ce1e6875ba96754021fb331a21537fc2a34b6c0ef95bea4db54ae650e52ede514c4800838ceeef952a4c87f20094aabee395ffeb70e0f36452c2200c1df1cd4ed84035c8f153fbe7c6ccf9090b70b3a48f8de1574455faf8a693e4d2b285487f6333f00afa483a778360de3f9dd39fbbe95616d3436cb5579ad15d902052f43aa31738222c567d8ca682c914a16598b80fb319b044f5aba82320b86665016e64f143e5abd08e259defe6d4f03f9f67528be67f2a7a76127627934e5c7bee37922a73fe215db9418947119cedcffa50d3d86954c72fd4cbef42ff2baee065aed83f06a24614ba2577403eba223aa95608236bca0c39f2686dc1caa7d15c01430d5d6e33f1517e51764c3807b2be0e0fa785eb456757192b8afe1b1fc600c4608c85fa68c3e2128313cc8b6dec06167b6b06da637cd44ac8cb527b93599c6574d6544374475c8fdc239580de012c90677e6295a7cb816b6041bc0a556d2a761848ae1a385a5a830fe7ae29870c544085f1be4ab479a20e890e2eaa0ff96d97cdb5b0f67bde0a1f0d1c6b5084bd3b7709f32b6e7981f672c5211f52ecb90c80bb721aa033034154f20af424d388", "7b7e8178abbbe7535885e83f4c9f963ad7665b833472eda86ae3dae5929305f05829d77cb0a965fa6e82deafc3d3977262a9fc9486ce2acff19ff6e3bedf4b492aaa1ae60b03de6e811edea8eaf2dacf5ba0edd19ff6e4eb5230431b54984af463252528a2f46545bd52ef6542ecc5508fed54ec6a71c50feb6c02df3d4bda4c1f78d96a28ef3742d06d974a4bee3c46a7ca4cd2c60d922894249e2194ab2f6fbfd0370cd9807287586f107a2fdbfbb1369dca0b6161f7ac823df02476c0a939bc931b2832b645d1c531947a6c3b3392d23abfce416891a3b45bb69c0f8d1756b04ab0e1ecbffd845fde8c5da1af09c5e23360376ad5f1598bee185bf72abf254afffbf877583b4d999dd9f7860e385edbaf6f8c72f3f65fd7b86327dc203e51232e7d2ec7a12744423b406a05e48840946f62f9a90626f2a1f14bf251296b508116c3add87b7ad2f312585c49bf4eb03a6d90c5b69a297b5e67f3cfe88a5a2d5a421f174b15085a13e67ea09642cfdd1ed62447865c35ee8cceeedc343d3c9928f8421c1c3f3db452ea97b1bfa3fab28b261b1f7fe215af820e28ba85f444446a1295580bb87500ea5ecc6f7e96ef3ccd2e03295d57d1e8d49177c3393deaa23721e332637b8d81aa9d5cb6253b2136beb7fcde0a4439599e519f808083b69e98ac9d3ca38c315df530ef0f387502edabf4bff73d7b9b211adfbd8d893217882878da2cb8d5353216964386856d4308d364375653fb6822fbc225e54bc6932a1d2664e92e807d048e81c75c9473eef30219a95c38e7ae44b093c0fea67dee7b6b03e8e3f01bcc4812f3dd05ffd1e5dd6a2249c6ee2d6e84c717e5e04d2937ca2ebce53b809eee820146a73f6e7ec43194b5c5548a39bd733dedcb10339c332706f652d4f0ec57a4706b7db1afccaf9e42258cc8ea460e2e5449ce56900bec245ca60c27235d5197cd61b713ad60c49fe558e4344fefa4c8302d792007c88a5262f357a61ec29d8e3ac3f6b9affe8e7a908b0e4da4288b78edad7c9a01ff8740af972225ce42870ac6369bea6fbdc95e69e57f634a35b4c582945183ba67e5c2bde3009977b002f4902b59ed6985e44d25f2843c8eaf82b86f06bab9462fa7009cef8c6a0d98cd2d548f3d91217f596564ddf4a651c0243160441ed7eaacca9e3eb2fb961b366b0e223cf061aeaf42d1afcc3a53b8e17458362a4fd430bff62fdd661ac01f2a7a0722a00f6bee868813799e49582e76fec53a656e8360add0e75f11e38cf6b17d00ae7e58d0f5bbdcc89768f0fbdb17dff895bc5ecedb1b1c30b505d2654464190240aca61716dfbb2792ed6bc2c14cd9affec1309f9d078d1ee2056f304a574ab7aeafcd1063d7a5a928863add0253b12a5d299f2af6ec97b772d3a72a8ce1ddde63855e3c3efcb21366cab7a108e4f10a19eff021dfb3013371fe3e8a1cbf369e234e03cf1aa9a4b2f1c10c5ef04998d78508ee922b54271b6f0824e7b81b302c56ccbce0f4676565b799cd97af46f26b7ef410be15d81df21102199732831e19614f54564ded997593fdaa3811b65786eee0ca7994c5376b498af8f229ee148aee79b0d44274c7ca9414bc6ebc884c75ca47865a3281b0a539de8777d9ab7b8d4702c103f74ea0d301096d1c73a4f62d936f7cfe4ee33747cb804ce016a760f1ec72c25da0c0f98753feccc092b3e9e119258df3404ea9eae37828ec61b0cedaf5a5009f1e623821d3a85afa6907ca87a579c000ac97feac9f7a5b2bc959f82295dbdb4ff6a68bdadcff9c91719b0f312731dbef482a200fb973f2dafe597bbf6cd0029d81a353e78c55328d7ac08867cb9d6f0b98a5fb07a548672a218ed8d39a7bc19e91b9ceb8a67e55c90f43941edad267bee07ca814fdd9be9cd93651b9a11ade7f7bde3687d7906664cde749a0adb3d30ebe32af5758939622e914abe8b247cd33fe78135d5dcdc686a2aba68491a933f704e97464b9217ec90689b5a10507d9a8d98be715822d84d838fddddcd165daacafc1eddf85fc9f8952dfb3196a84d02aad90b4e61406d304c18bff961b3b46f31d97f0d6ed6dbfeceb0dba0c8228917c7ac86123882dd057635f75093f6429614cef4a9833b73450ace6087906fd4ab5bc895f951590763743a8528ddff3aab66a13d740e0af64e1f68b9d50dece49f2ce0452b3fc2536b427d80879809d70a0a40ec135ecfb857ce5c478361698add3e23e4e248ee025697ed2b835fc3aa6b88a2971418b4ea8e2aaec21f8a3390fa5ba92900fdfb57ac680ca416aa8913cbe337d12a785161b822403866cefb183edb862e5a01865f2876b82eb30f0a1daf9882693826582b57ea2d3d8fc514e89285f694f2bfd87b82e10f9f4349516c6ef80f77df8179cc5b75c56173e2c25bc2799493780dc3035b140a966a1f934fd65f0e5fcfd700cf9fdf2d616ee10cc108967e56284ebaadb7b74378385540883c3fe2a6e9a0110a5a903dfecbd0c016721afedc24ba2a1d3a8f5a2149ce882fb9899f3d02b1661708ddea3993effa1514a77639b2a3eac70f694e06cb7756bc28a4078ef362b25119764f6b3fe1f803c8e03dd3095dd46f6ee84b04c1db0d799596ae1ebee9fe90befc376f44e11d8899d5e15044e4027e0197db91e492a7f2957d0dba24983d18f791ffb89ad3aab2fbd6186649efcb8a49543ac6a510a5ebd1c92b3698ae8808f1316445585acb23f6cb256de3a00bb4bc4c237f1b3cfb80d69a4087e4c05bb24926461b2964f749641cdb67e55897d00939fa5f6c4f200347a5949a08f1373521ec5eb9218e9c767fcde034259cb37939ba8985aa79744c31472db491ba56974e2052ad9888d2eb05d4fe53ff1c886e9dda6e0bbbe22e6ad17e29dcc4848422a2588a8bb7e20b9ada9294ddae431e9653219de39b57a46946fe2673a8998fe995b034eeceee007e83c52a19b7863fb7c74f7d900f36249e2887e4d76644c1296a2d58d2a521afa8d56e3ca77007e15204f981504d342bb8ef3b13556e4fda408d6a41a09fc177371f75c228e9f6fb985b7522775094aab4cd3cc23bc509a8234895abbe281eab731a05be1d7f76a0eea0ee5ce7a52bf526aca9623976a88a99df6b1e33095ecdf5dc8fc35185d018081a45da5cc5b288b32c9bfe05e046ba50024962512e57675edecdd3ee9b9f406fbbea0b01b82b9c4c0ef227186a8dc80b6366f8195abf6206c237ec20647a35e9784dcfa5f6f9f531d3155cdde578d8e3e4533bd1fe8e4df0e47601a1da9787df36acfee4ab5b21e1f9d8f254b4bf12be758082fcc4a818ad0fb5444ec2533747a0d9386d440f763cbe766c13c9d8808a57f54e4970cf5ca6a92754099180520bb8b44ea2913d41693264ab4f58d62eea3fff232530375940606574c5f95916e9b9db611d17f68dafdb1704b58b9c48050eaad0525958a86394fb1fcb99a979071b93aa6d9925984119c8146d077e176fead84da1c8b2a48efc8e09a71d89268c31bafd02d5a1516362da39e7f9b2f91faa1a0e653060757499450237f5abc103b44d001771c44349180a046c9d23a84191102f635c734f930734601ac87632845786d613464640389112bfd0e0b02c7f0fce68f90afe33595eae7d42368d58e21ddeb2a8211e81859689001aa311dca9cb8566106337c1a1afda1d17f178284c68ff163d7638e459f43d79d60928fa8577f386c0f616ea8c11acca6b2042471e54b5f0fa2b9f3a2e14d2f4288e15a30454334ff694acc82bfbc7324992777c820bcdd2ce7cd4a0a03e86d91d5f8932ac99feca200b186501650530bc3bbb541f548c3aef988de6d0fb79d276005ad2e32474664f8f48de6daf466f9474e8c02c596c388ae5f46b93ca0fe377e6f7c9b3f6835b9cc45cd860e934f323dee54b5494cc815f09db2532b15b80d741addf1999500b38362d476d4ec62783e34e12492ffe07c49f51a9fc4c697de6c3530011ef75b9df62143c2cb8646435b108b846c4ea2b2eab93b16ff54cb45d88f0dd6b3b703fd10f986d50536a67abb9f3718893c6871e4c0f83d0a3d6f277a5c9738ba3611860fcd83fb681e05dde403f0272c337a97dbafb48bd916e8abfe409262b619097ff7869801ea42674deb015f4e9a14317eb41c68ec204ee2bf708a525e2029eca97669581a06572c5ab6096c0e385d26c0e3f71551387d1190a84bc35ac0492c5bbaee5249ff85f83740662668ba76317077cd0a200c24a85b86a93d3002b8c8178c23f34cbf93ed5dcc10dd1738f6790739341fcb387edea8ec026fa59ff752eeab7b24eba3dc1271a70caa4eabd33bd946dce6e612563232ef20aadfd217dafd07743d0a67a56109b6ff9ef31ccec789f80c377aef6f25c5de8aa285250c35f5b9f11184ab50784ba0959f481a84b97a1a552d1756a57d704cf523512a8b339e3918ba29b0503f1baede84ddb1289745eb73d10d0c931b14e9e7cae12313c20b46bfe54976c1ea0b13d3cfb440a1438c90e09ff2697a43117e09ccfb06f07538b2313683e9c12062d6f20f19ee118cc30d05aff75eddf58cec45b1c38d70ca352151a0d76c0423c395cdbca8a62059ce14ae9034962ec781189b966babee769bba4450cadd80494283fd715eecdfe4b0e4d72ef6352d25c3555f3ba7b7259879b9c085351b8c89a163a14365ed63a54b7789e833a341047277543add95f23834cdd3c2c1da794f7a817c23707595a0885c4e2d79ab65dce078329bdd5b528894cec592450d3fa163b3333febd2ee2125936b453c99635ded657d8738de1a373cdceecb0204b81dbba42e1ab6500a077c9354b77ff0472eac50dfdfa3d50cc68e662f359c9452d77624756b362fc6c6adc481d6e59e4207c39a21a9826b449f548616b5a42810f4ffb0b62255376f625af9ab6e41c058e89bbe6e2bca4fff989b919100171563bada90dc6cdef60807a6e5d5dd79ed54b02204283072c2b09f5155adaf7b76fd7cb38277e93180dd6d2bb722307019bf3fb9ccd65c9287d8895b193df2344d6187dbccc26e7304dde57c71cf11bdb22c1c32ec26fc04af19be5f39c9d2e8b89c7844d99dbcf454c662af01d8f3cfe683d5d623beac25283eac2cac4f9aed0d98c3a8f0564ad4d3d55ac1c9ed91cbc3ece78d6523d8dfe224dccda1b857e818abd504f910cc330c19f47e18c3d5de5936eb0ddc4f0dedce2a070ff0d05e1f245150e4abeed3fc719d96bf9a9daa250bb918b500c7fb904364bc7f9ed5058135168da7593969c40625beb9a9b42e0c4aa58141f4d4074ce06b0d9c72b3d41f9100749779424bdcf3e644830f629e0dab3177a4c15bbe90f1b9134e65ca1f543bd85fc3f5d3dc7014053c2f31f59f19f5b90ffbbc4e72f022f615205ceea519313a2115acdcef4aa3149c9660c935501143ee74217d85fce3ce1306ce11a67ec2d6f0b1ffa8cfa32408e8d30dcafe6916801d90df6f0968e3cb621cf351a3d04f30c558d4951d98050dee9104da45cf1b335b19082bfe01f96c4f14814f22ac574d8d4b2fa888c642876f535689ecfb291c1e4d5934ed6125444ec251db85b057a9b16c89ffc083826eb3645d1e4a09850031c91746cc2f4ef93164852de3b765ad1ccce940b3ce7f658a4febe3119fe59203f225e17248df3e619ba875b632c56861266f0f8b5757e8e7a0f02a32c466c0acc47658e521e9ba74abb344ff326083a79c1a2d92ee56b766d7d03bafbe96429cf9e49f5547b4b35ac246e799c829eab8c0b1dea4aa5f84500ecbcb2f66711ad5e084d8"}) 13:30:15 executing program 4: preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f00000000c0)=""/148, 0x94}], 0x1, 0x0) r0 = syz_open_dev$usb(&(0x7f0000000000)='/dev/bus/usb/00#/00#\x00', 0x8, 0x0) ioctl$sock_inet_SIOCRTMSG(r0, 0x890d, &(0x7f0000000180)={0x3, {0x2, 0x4e21, @multicast1}, {0x2, 0x4e21, @broadcast}, {0x2, 0x4e22, @rand_addr=0xd70}, 0x22a, 0x20, 0x5, 0x100000001, 0x4, &(0x7f0000000040)='bond_slave_0\x00', 0x7fffffff, 0xfffffffffffffffc}) r1 = syz_open_procfs(0x0, &(0x7f0000000080)='io\x00') preadv(r1, &(0x7f0000000480), 0x10000000000002a1, 0x0) 13:30:15 executing program 1: socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)) syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0xe1, 0x400100) creat(&(0x7f00000001c0)='./file0\x00', 0x2) openat$dsp(0xffffffffffffff9c, &(0x7f0000000200)='/dev/dsp\x00', 0x8000, 0x0) syz_open_dev$mouse(&(0x7f0000000240)='/dev/input/mouse#\x00', 0x100, 0x10000) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000007000)={0x8, 0x0, &(0x7f0000000140)=[@acquire], 0x0, 0x0, &(0x7f00000001c0)}) r2 = dup2(r1, r0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000002c0)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x40086310}], 0x0, 0x0, &(0x7f0000000300)}) 13:30:15 executing program 2: r0 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000040)='/dev/sequencer\x00', 0x402000, 0x0) ioctl$NBD_DISCONNECT(r0, 0xab08) r1 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000007000)={0x8, 0x0, &(0x7f0000000340)=ANY=[@ANYBLOB="070038873e80883f5c547f3a258259675f41dcd3edeaa699aec1812be8b662b40a7b111d1a45049ee24d309776fc25de4af03e74056a8a6200163cc33c0ba999bff162650f5d3cb5d4a3217523c6c67e340a0980c24815ee4a6c411b411797bd5163a8ceb9e2e7374b143f8a94903b447b230c1fa0cc8a77e5e7ee4ec71ccfbc3be42cd0edfbc27a7db205012023162bd7333779da2be2129520b4ab8c3896908e4542cb02e5990ce57fcf98ba074c2e8b284fa01dd7ceca5b4570e18735670464f833b5ed82cff1ad9959c53be4794fb934242b9d570391cab8628e10726a0211209aa1fa1da8ec367eeea1837f000000591ccf06344f3f941241053928ea2ddd84c679aa1fd888b2cabdc899fd9fec3565aa75332957ce857d2854cc39404ad27f69a17f3e6a446b3ed132f22c06738d07e0c27d95f5c455d856f294f2a4b27938dd98b7e734b41f732da4bb8543302dbabaeb207067786b4dd5dbd647d178fe248bdb69b7039caecefc5c5c49bfd06016c39f9ee2a497c1bc78d077a1651485addc895079f73db00c2d37fd0823125a904cdce96823206333cc41bcb45d3322c38f51466f0862bcd0e18fedca11430c224703d3d3f6230635796ff6ced6a23d50a7c90bc5184ca5af174d10ca2cb473b30853f5c16a5b9ecc758704689411f9d5a134c5b8880202edd697b07fc88c4d688b5a6065acbd1bff208d"], 0x0, 0x0, &(0x7f00000001c0)}) r3 = dup2(r2, r1) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000002c0)={0x8, 0x0, &(0x7f00000000c0)=[@release], 0x0, 0x0, &(0x7f0000000300)}) 13:30:15 executing program 0: r0 = socket$inet(0x2, 0x4000000803, 0x4) bind$inet(r0, &(0x7f0000000000)={0x2, 0x0, @broadcast}, 0x10) getsockname(r0, &(0x7f00000036c0)=@xdp={0x2c, 0x0, 0x0}, &(0x7f0000000080)=0x80) setsockopt$inet_pktinfo(r0, 0x0, 0x8, &(0x7f0000003780)={r1, @rand_addr, @dev}, 0xc) syz_emit_ethernet(0x4a, &(0x7f0000000240)={@link_local, @empty=[0x0, 0x0, 0x3f000000], [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x3c, 0x0, 0x0, 0x0, 0x4, 0x0, @empty=0x9000000, @broadcast}, @udp={0x0, 0x0, 0x28}}}}}, &(0x7f0000000380)) 13:30:15 executing program 5: syz_mount_image$btrfs(&(0x7f0000000140)='btrfs\x00', &(0x7f0000000180)='./file0\x00', 0x0, 0x0, &(0x7f00000007c0), 0x0, &(0x7f0000000380)=ANY=[]) syz_mount_image$ntfs(&(0x7f0000000200)='ntfs\x00', &(0x7f0000000080)='./file1\x00', 0x0, 0x30, &(0x7f0000000580), 0x0, &(0x7f0000000680)=ANY=[]) mount$overlay(0x404030, &(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f0000000100)={[{@upperdir={'upperdir', 0x3d, './file0'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@workdir={'workdir', 0x3d, './file1'}, 0x5c}]}) umount2(&(0x7f0000000040)='./file0\x00', 0x1800) [ 574.633378] binder: 28561:28564 unknown command -2026373113 [ 574.694716] binder: 28561:28564 ioctl c0306201 20007000 returned -22 [ 574.712149] overlayfs: failed to resolve './file1': -2 13:30:16 executing program 0: r0 = socket$inet(0x2, 0x4000000803, 0x4) bind$inet(r0, &(0x7f0000000000)={0x2, 0x0, @broadcast}, 0x10) getsockname(r0, &(0x7f00000036c0)=@xdp={0x2c, 0x0, 0x0}, &(0x7f0000000080)=0x80) setsockopt$inet_pktinfo(r0, 0x0, 0x8, &(0x7f0000003780)={r1, @rand_addr, @dev}, 0xc) syz_emit_ethernet(0x4a, &(0x7f0000000240)={@link_local, @empty=[0x0, 0x0, 0xe0], [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x3c, 0x0, 0x0, 0x0, 0x4, 0x0, @empty=0x9000000, @broadcast}, @udp={0x0, 0x0, 0x28}}}}}, &(0x7f0000000380)) [ 574.747869] binder: BINDER_SET_CONTEXT_MGR already set [ 574.748773] binder: 28559:28560 BC_DEAD_BINDER_DONE 0000000000000000 not found [ 574.767330] binder: 28561:28571 unknown command -2026373113 13:30:16 executing program 4: preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f00000000c0)=""/148, 0x94}], 0x1, 0x0) r0 = syz_open_dev$audion(&(0x7f0000000040)='/dev/audio#\x00', 0x5, 0x0) getsockopt$inet_tcp_int(r0, 0x6, 0x27, &(0x7f0000000180), &(0x7f00000001c0)=0x4) r1 = syz_open_procfs(0x0, &(0x7f0000000080)='io\x00') preadv(r1, &(0x7f0000000480), 0x10000000000002a1, 0x0) ioctl$sock_SIOCINQ(r1, 0x541b, &(0x7f0000000000)) [ 574.801997] binder: 28561:28564 ioctl 40046207 0 returned -16 [ 574.849976] ntfs: (device loop5): ntfs_fill_super(): Unable to determine device size. [ 574.867866] binder: 28572:28575 BC_FREE_BUFFER u0000000000000000 no match [ 574.870657] binder: 28559:28583 tried to acquire reference to desc 0, got 1 instead [ 574.883004] binder: 28561:28571 ioctl c0306201 20007000 returned -22 13:30:16 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000007000)={0x0, 0x0, &(0x7f0000000040), 0x0, 0x0, &(0x7f00000001c0)}) r2 = dup2(r1, r0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000002c0)={0x8, 0x0, &(0x7f00000000c0)=[@release], 0x0, 0x0, &(0x7f0000000300)}) [ 574.917367] binder: 28559:28585 BC_DEAD_BINDER_DONE 0000000000000000 not found [ 574.947075] binder_alloc: binder_alloc_mmap_handler: 28572 20001000-20004000 already mapped failed -16 13:30:16 executing program 0: r0 = socket$inet(0x2, 0x4000000803, 0x4) bind$inet(r0, &(0x7f0000000000)={0x2, 0x0, @broadcast}, 0x10) getsockname(r0, &(0x7f00000036c0)=@xdp={0x2c, 0x0, 0x0}, &(0x7f0000000080)=0x80) setsockopt$inet_pktinfo(r0, 0x0, 0x8, &(0x7f0000003780)={r1, @rand_addr, @dev}, 0xc) syz_emit_ethernet(0x4a, &(0x7f0000000240)={@link_local, @empty=[0x0, 0x0, 0x8848000000000000], [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x3c, 0x0, 0x0, 0x0, 0x4, 0x0, @empty=0x9000000, @broadcast}, @udp={0x0, 0x0, 0x28}}}}}, &(0x7f0000000380)) 13:30:16 executing program 1: socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)) syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0xe1, 0x400100) creat(&(0x7f00000001c0)='./file0\x00', 0x2) openat$dsp(0xffffffffffffff9c, &(0x7f0000000200)='/dev/dsp\x00', 0x8000, 0x0) syz_open_dev$mouse(&(0x7f0000000240)='/dev/input/mouse#\x00', 0x100, 0x10000) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000007000)={0x8, 0x0, &(0x7f0000000140)=[@acquire], 0x0, 0x0, &(0x7f00000001c0)}) r2 = dup2(r1, r0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000002c0)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x40046302}], 0x0, 0x0, &(0x7f0000000300)}) [ 575.014817] binder: BINDER_SET_CONTEXT_MGR already set [ 575.022059] binder: 28572:28592 ioctl 40046207 0 returned -16 [ 575.048626] binder_alloc: 28572: binder_alloc_buf, no vma 13:30:16 executing program 4: preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f00000000c0)=""/148, 0x94}], 0x1, 0x0) r0 = openat$zero(0xffffffffffffff9c, &(0x7f0000000000)='/dev/zero\x00', 0x400080, 0x0) ioctl$KVM_SET_DEBUGREGS(r0, 0x4080aea2, &(0x7f0000000180)={[0xf000, 0xd000, 0x0, 0x1f001], 0x10001, 0x1b, 0x9}) r1 = syz_open_procfs(0x0, &(0x7f0000000080)='io\x00') preadv(r1, &(0x7f0000000480), 0x10000000000002a1, 0x0) fcntl$setstatus(r1, 0x4, 0xc00) r2 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000200)='IPVS\x00') sendmsg$IPVS_CMD_DEL_DAEMON(r0, &(0x7f00000002c0)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x40080201}, 0xc, &(0x7f0000000280)={&(0x7f0000000240)={0x1c, r2, 0x8, 0x70bd27, 0x25dfdbfe, {}, [@IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x4}]}, 0x1c}, 0x1, 0x0, 0x0, 0xc050}, 0x1) [ 575.088404] binder: 28572:28580 BC_FREE_BUFFER u0000000000000000 no match [ 575.093877] binder: BINDER_SET_CONTEXT_MGR already set [ 575.139575] binder: 28596:28598 ioctl 40046207 0 returned -16 [ 575.154384] binder: send failed reply for transaction 540 to 28572:28575 [ 575.177874] binder: undelivered TRANSACTION_COMPLETE [ 575.178767] binder: BC_ACQUIRE_RESULT not supported [ 575.212620] binder: 28572:28597 transaction failed 29189/-3, size 0-0 line 2973 [ 575.217747] binder: undelivered TRANSACTION_ERROR: 29189 [ 575.226130] binder: 28606:28607 ioctl c0306201 200002c0 returned -22 [ 575.282234] binder: BC_ACQUIRE_RESULT not supported [ 575.294699] binder: 28606:28618 ioctl c0306201 200002c0 returned -22 [ 575.312140] binder: undelivered TRANSACTION_ERROR: 29189 13:30:16 executing program 0: r0 = socket$inet(0x2, 0x4000000803, 0x4) bind$inet(r0, &(0x7f0000000000)={0x2, 0x0, @broadcast}, 0x10) getsockname(r0, &(0x7f00000036c0)=@xdp={0x2c, 0x0, 0x0}, &(0x7f0000000080)=0x80) setsockopt$inet_pktinfo(r0, 0x0, 0x8, &(0x7f0000003780)={r1, @rand_addr, @dev}, 0xc) syz_emit_ethernet(0x4a, &(0x7f0000000240)={@link_local, @empty=[0x0, 0x0, 0xf4010000], [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x3c, 0x0, 0x0, 0x0, 0x4, 0x0, @empty=0x9000000, @broadcast}, @udp={0x0, 0x0, 0x28}}}}}, &(0x7f0000000380)) 13:30:16 executing program 5: syz_mount_image$btrfs(&(0x7f0000000140)='btrfs\x00', &(0x7f0000000180)='./file0\x00', 0x0, 0x0, &(0x7f00000007c0), 0x0, &(0x7f0000000380)=ANY=[]) syz_mount_image$ntfs(&(0x7f0000000200)='ntfs\x00', &(0x7f0000000080)='./file1\x00', 0x0, 0x30, &(0x7f0000000580), 0x0, &(0x7f0000000680)=ANY=[]) mount$overlay(0x404030, &(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f0000000100)={[{@upperdir={'upperdir', 0x3d, './file0'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@workdir={'workdir', 0x3d, './file1'}, 0x5c}]}) umount2(&(0x7f0000000040)='./file0\x00', 0x1e00000000000000) 13:30:16 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = openat$audio(0xffffffffffffff9c, &(0x7f0000000040)='/dev/audio\x00', 0x80000, 0x0) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000100)={r1, &(0x7f0000000180)="8fb1aec3327ffe86cb25892a392e846430b167d85adeeba61b6281253a1a8cb447a9d6210b06fe0a47f162fa3690522c9dc1f04396d5ad3fe14c96609a459a682c92bab7e60a13c20d2bfb796e533f20bad0acf4f5aba34a0b57af470ccb504598779ee69b70e73ca2daa1b7cfdeb4e7e000470773d4c0cfb99e83e77e7017f2edcd1584df42e5f1fb5e3bd0cbf89c03c34401f84b1e0ca70467834c4520be6fe13f84fdf0d5e38f56cd5d32477937b42f91b261bf0f4ee87cafc99979524cb7cf1354a6b6c15f84868ff9", &(0x7f0000000080)="4f61c9c38d207b1c6278112e354ddac788e93f39618ca71592244aefd81500d3e4", 0x3}, 0x20) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r2 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000007000)={0x8, 0x0, &(0x7f0000000140)=[@acquire], 0x0, 0x0, &(0x7f00000001c0)}) r3 = dup2(r2, r0) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000002c0)={0x8, 0x0, &(0x7f00000000c0)=[@release], 0x0, 0x0, &(0x7f0000000300)}) 13:30:16 executing program 1: socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)) syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0xe1, 0x400100) creat(&(0x7f00000001c0)='./file0\x00', 0x2) openat$dsp(0xffffffffffffff9c, &(0x7f0000000200)='/dev/dsp\x00', 0x8000, 0x0) syz_open_dev$mouse(&(0x7f0000000240)='/dev/input/mouse#\x00', 0x100, 0x10000) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000007000)={0x8, 0x0, &(0x7f0000000140)=[@acquire], 0x0, 0x0, &(0x7f00000001c0)}) r2 = dup2(r1, r0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000002c0)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x400c630e}], 0x0, 0x0, &(0x7f0000000300)}) 13:30:16 executing program 3: socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)) syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0xe1, 0x400100) creat(&(0x7f00000001c0)='./file0\x00', 0x2) openat$dsp(0xffffffffffffff9c, &(0x7f0000000200)='/dev/dsp\x00', 0x8000, 0x0) syz_open_dev$mouse(&(0x7f0000000240)='/dev/input/mouse#\x00', 0x100, 0x10000) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000007000)={0x8, 0x0, &(0x7f0000000140)=[@acquire], 0x0, 0x0, &(0x7f00000001c0)}) r2 = dup2(r1, r0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000002c0)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x40086310}], 0x0, 0x0, &(0x7f0000000300)}) 13:30:16 executing program 4: preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f00000000c0)=""/148, 0x94}], 0x1, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000080)='io\x00') ioctl$LOOP_CHANGE_FD(r0, 0x4c06, r0) preadv(r0, &(0x7f00000001c0), 0x0, 0x8) ioctl$EVIOCGABS2F(r0, 0x8018456f, &(0x7f0000000300)=""/109) ioctl$LOOP_CHANGE_FD(r0, 0x4c06, r0) setsockopt$l2tp_PPPOL2TP_SO_RECVSEQ(r0, 0x111, 0x2, 0x1, 0x4) [ 575.487908] overlayfs: failed to resolve './file1': -2 [ 575.516641] ntfs: (device loop5): ntfs_fill_super(): Unable to determine device size. 13:30:16 executing program 0: r0 = socket$inet(0x2, 0x4000000803, 0x4) bind$inet(r0, &(0x7f0000000000)={0x2, 0x0, @broadcast}, 0x10) getsockname(r0, &(0x7f00000036c0)=@xdp={0x2c, 0x0, 0x0}, &(0x7f0000000080)=0x80) setsockopt$inet_pktinfo(r0, 0x0, 0x8, &(0x7f0000003780)={r1, @rand_addr, @dev}, 0xc) syz_emit_ethernet(0x4a, &(0x7f0000000240)={@link_local, @empty=[0x0, 0x0, 0x400300], [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x3c, 0x0, 0x0, 0x0, 0x4, 0x0, @empty=0x9000000, @broadcast}, @udp={0x0, 0x0, 0x28}}}}}, &(0x7f0000000380)) 13:30:16 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) pipe2(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80800) r3 = syz_open_dev$dmmidi(&(0x7f0000000080)='/dev/dmmidi#\x00', 0x4, 0x200000) bpf$BPF_PROG_ATTACH(0x8, &(0x7f0000000100)={r2, r3, 0x0, 0x2}, 0x10) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000007000)={0x8, 0x0, &(0x7f0000000140)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], 0x0, 0x0, &(0x7f00000001c0)}) r4 = dup2(r1, r0) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f00000002c0)={0x8, 0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="0663ec7500000000"], 0x0, 0x0, &(0x7f0000000300)}) 13:30:16 executing program 4: preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f00000000c0)=""/148, 0x94}], 0x1, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000080)='io\x00') preadv(r0, &(0x7f0000001480)=[{&(0x7f0000000000)=""/40, 0x28}, {&(0x7f0000000040)}, {&(0x7f0000000280)=""/4096, 0x1000}, {&(0x7f0000001280)=""/231, 0xe7}, {&(0x7f00000013c0)=""/180, 0xb4}], 0x5, 0x0) ioctl$BLKZEROOUT(r0, 0x127f, &(0x7f0000000040)={0x5fa6, 0x9}) ioctl$sock_bt_hci(r0, 0x400448dc, &(0x7f0000000180)="fbf529233bbd3f89914798bc0e2f1109c20aa0a2dbbe97c5bba9aa0c3b8b285baff9f6e48098dd388b5165967a147347e77c97ff7cdfca9ca3471c811078ed674af7cbf727c956d46616c501cee821220f7355d7800de34ff358289fac2a5c8193ee947cd6ef75ca93b5e81dcd58826a11ff6ba0a1d347060bfeaa0649e7f5fb7056588eeefc83d5e3d143f77127d63244d187130a33de32f6a7a35670fa4b7d343e7de898ab77f5eb9ec4c91d252a4b14d9a549be94b0e75f8e4e35831abcee74a947efc2f12e53d1ba36c600f158fc50ad3bcdd2e386feadde1c0a63f62dbdcfd98a84d1a9ac99a34485da8811f5f9") [ 575.533427] binder_thread_write: 10 callbacks suppressed [ 575.533536] binder: 28631:28633 Acquire 1 refcount change on invalid ref 0 ret -22 [ 575.614157] binder: 28631:28633 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 575.656072] binder: 28650:28651 unknown command 0 [ 575.669907] binder: 28650:28651 ioctl c0306201 20007000 returned -22 13:30:17 executing program 5: syz_mount_image$btrfs(&(0x7f0000000140)='btrfs\x00', &(0x7f0000000180)='./file0\x00', 0x0, 0x0, &(0x7f00000007c0), 0x0, &(0x7f0000000380)=ANY=[]) syz_mount_image$ntfs(&(0x7f0000000200)='ntfs\x00', &(0x7f0000000080)='./file1\x00', 0x0, 0x30, &(0x7f0000000580), 0x0, &(0x7f0000000680)=ANY=[]) mount$overlay(0x404030, &(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f0000000100)={[{@upperdir={'upperdir', 0x3d, './file0'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@workdir={'workdir', 0x3d, './file1'}, 0x5c}]}) umount2(&(0x7f0000000040)='./file0\x00', 0xc00000000000000) 13:30:17 executing program 1: socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)) syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0xe1, 0x400100) creat(&(0x7f00000001c0)='./file0\x00', 0x2) openat$dsp(0xffffffffffffff9c, &(0x7f0000000200)='/dev/dsp\x00', 0x8000, 0x0) syz_open_dev$mouse(&(0x7f0000000240)='/dev/input/mouse#\x00', 0x100, 0x10000) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000007000)={0x8, 0x0, &(0x7f0000000140)=[@acquire], 0x0, 0x0, &(0x7f00000001c0)}) r2 = dup2(r1, r0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000002c0)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x400c630f}], 0x0, 0x0, &(0x7f0000000300)}) 13:30:17 executing program 4: preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f00000000c0)=""/148, 0x94}], 0x1, 0x0) r0 = accept(0xffffffffffffffff, &(0x7f0000000000)=@xdp, &(0x7f0000000180)=0x80) socket$rds(0x15, 0x5, 0x0) r1 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000200)='IPVS\x00') sendmsg$IPVS_CMD_SET_DEST(r0, &(0x7f00000002c0)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x4}, 0xc, &(0x7f0000000280)={&(0x7f0000000240)={0x2c, r1, 0x800, 0x70bd2c, 0x25dfdbfe, {}, [@IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x4}, @IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0x7ff}, @IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0x7}]}, 0x2c}}, 0x80) r2 = syz_open_procfs(0x0, &(0x7f0000000080)='io\x00') preadv(r2, &(0x7f0000000480), 0x10000000000002a1, 0x0) [ 575.749605] binder: 28650:28651 unknown command 1978426118 [ 575.760963] binder: 28653:28654 BC_DEAD_BINDER_DONE 0000000000000000 not found 13:30:17 executing program 0: r0 = socket$inet(0x2, 0x4000000803, 0x4) bind$inet(r0, &(0x7f0000000000)={0x2, 0x0, @broadcast}, 0x10) getsockname(r0, &(0x7f00000036c0)=@xdp={0x2c, 0x0, 0x0}, &(0x7f0000000080)=0x80) setsockopt$inet_pktinfo(r0, 0x0, 0x8, &(0x7f0000003780)={r1, @rand_addr, @dev}, 0xc) syz_emit_ethernet(0x4a, &(0x7f0000000240)={@link_local, @empty=[0x0, 0x0, 0x88480000], [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x3c, 0x0, 0x0, 0x0, 0x4, 0x0, @empty=0x9000000, @broadcast}, @udp={0x0, 0x0, 0x28}}}}}, &(0x7f0000000380)) [ 575.823663] binder: 28650:28651 ioctl c0306201 200002c0 returned -22 [ 575.907834] binder: 28650:28674 unknown command 0 [ 575.935545] binder: 28650:28674 ioctl c0306201 20007000 returned -22 [ 575.953062] binder: 28650:28663 unknown command 1978426118 [ 575.971932] binder: 28667:28670 BC_CLEAR_DEATH_NOTIFICATION death notification not active [ 575.979610] overlayfs: failed to resolve './file1': -2 13:30:17 executing program 3: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f00000010c0)='/dev/kvm\x00', 0x0, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f000002b000/0x18000)=nil, &(0x7f0000000080)=[@text32={0x20, &(0x7f0000000540)="c4c140161666b833000f00d80fc79d04000000440f20c03505000000440f22c00f01c9c4e27913ccb9800000c00f3235000400000f3066b86e000f00d066b8e4008ee80fc7ab42430000", 0x4a}], 0x1, 0x0, &(0x7f0000000280), 0x0) bpf$MAP_DELETE_ELEM(0x3, &(0x7f0000000240)={0xffffffffffffffff, &(0x7f0000000100)}, 0x10) mmap(&(0x7f0000abe000/0x3000)=nil, 0x3000, 0x2, 0x400000000084031, r0, 0x1) openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) socketpair$inet_smc(0x2b, 0x1, 0x0, &(0x7f0000000340)={0xffffffffffffffff, 0xffffffffffffffff}) clone(0x14000000, 0x0, 0xfffffffffffffffe, &(0x7f0000000040), 0xffffffffffffffff) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x1, 0xe, &(0x7f0000000dc0)=ANY=[@ANYBLOB="b700000005ed0050bfa30000000000000703000028feffff7a0af0fff8ffffff71a4f0b7060000000000012d400500000000005504000001000000006b0a00fe000000008500000007000000b700000000000000950000000000000015fb9bf985536a47ce2af6afc09f3af8c6278bfd62b24d1e63140c53bd3d4974c34ff33198692a7888621d62af88b5f33ef5476908f031f05339c3b0960e56e42dabb91a1cfe3e36ff7fc735c355f7bc58cf584781bc9e8079a351efe317a1ca4150883da19ce0d3568fe43d3add6222e8be75a277d81610d6a596429bce0f15792da7b94cd0d09abd1f11826dfd0e11eef563518213ab29a708f19e549a3a73048ff9cf1023c78b0c6bfd75069cef0a1672fa9509092b1a8d1dfd55e3f1533a73cce90025e7363fcf932519470ecc92296f155cc407693b4d2ab24efaecf39f68bf02dd776e46eac2625d1fe442a5bffeaf3ed222959a0654b3b890f91b59563a0a077dc35d04a3e30b63faa68a868cb48392ec3fb85eb88f95498bf9cb9a253d29ec2142f3f414a1b22698d597a861f3065a337bc0b7003153015061d838ef4734631fc1ae6295764d0315fa180169a11eb9207d4c0deab5e9c05c0ed61902ea23f81658496e93cd3d106ac10e4717ba7993e165d58060384c7908276b5e73fc60af1dcda984d06e9ae5"], &(0x7f0000000100)='EPL\x00'}, 0x48) readlinkat(0xffffffffffffffff, &(0x7f00000001c0)='./file0\x00', &(0x7f0000000280)=""/19, 0x13) exit(0x20000000000000) io_submit(0x0, 0x0, &(0x7f00000000c0)) r3 = syz_open_dev$audion(&(0x7f0000000140)='/dev/audio#\x00', 0x0, 0x410000) inotify_add_watch(r3, &(0x7f0000000200)='./file0\x00', 0x140) r4 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000180)='/dev/vcs\x00', 0x0, 0x0) ptrace(0xffffffffffffffff, 0x0) ioctl$KVM_ENABLE_CAP(r1, 0x4068aea3, &(0x7f0000000240)={0x79}) ioctl$ifreq_SIOCGIFINDEX_team(r2, 0x8933, &(0x7f00000000c0)={'team0\x00', 0x0}) ioctl$TUNSETIFINDEX(r3, 0x400454da, &(0x7f0000000380)=r5) r6 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000080)=[@text16={0x10, &(0x7f0000000180)="2e65f32efe0a6766c7442400008000006766c7442402000000006766c744240600000000670f011c24b866000f00d066b88044a2b20f23c80f21f866350400d0000f23f80f0766b80500000066b9080000000f01c10f0766b8010000000f01c10f01dfb835008ee0", 0x68}], 0x1, 0x0, &(0x7f00000000c0), 0x0) getdents(r4, &(0x7f00000005c0)=""/194, 0xc2) ioctl$KVM_SET_LAPIC(r6, 0x4400ae8f, &(0x7f00000007c0)={"a523fb9656eb871ffcd7ffeb51d84e738a55eba841ae487e33cdd921e8a51ce6c924020f0ac3562dd8cdeb31deac16f46da4ac16ee8165bce439eddce671c5b0a1103ea3f86a43cbb78504f6f9c77c2f09dc27632ec6036ee52a87e321e707c0cfe15576c26d52d0334c8d4693e127b3a046a5ed7796c9c5017cfd58ec871ed76369846fea9ebfa2f7f96496abf4ef57ed1ecd930eb9e13396875f01e932804ffe8a34c8fbedd97cdfb3176ec59fbbfd20a6ff17795431c3908530e4f5f703480a5211cc6a7e2084e4a9b6aedf60b7b8084b00ca2cbed255b4cc4679c967432fea5e95119f9635e94794aab6ef54f290677fa08d0ee2cc8eae468efd02417055d3f3ccc86b629dfb878c4d115c16c75fe352cffa93648cf49577256b5d2faf0634335c97ffff966ae90cbf81250df3613c25d2789c869c9cc95a6e9d364c4c684059c593f9950e66cf81cd9f36d73fade4f0cbb795010364d13ff32c12efd91d0ebb6533700945f2db6113a630bd521eec89a74c46e1733b72d6e4d2ccee3b40f99809a9a4fb5fc2d1c53e1366d455bcbe81893100ab56b2556b55c1a0c5787356b464c3bf7011488e55f587a6d4420d46d69a74ee5bbfbcb0d6cb00aae8c3dfd6dd2e9f76d7a542f20553207b668dce69f1b463ee9166e81bb109f461b8885f15c9e525d72260ccdbd69e3345612158114780b9409ea856cb724faa6ed27ba836b35c10e7c7d43f2fa34f98f16a00f31565e16a213eaf4a7f438c89733ebe6d16328b930fd942bc64d631dd1f2aa1cc2ccdaff2324076c83e1ba4d2a0e40e010c96b42e7a4a76cd7a89ef592b9b3030f62d9fbd565ee5908ab90b42620b61e5d1e08621a31d21003cd12a450461636472fa64a7e1b98778bfb482fb4b4da31b42ee98b10f9c0f4c085d08c37ee2e3a9e4a5aff72a0ab844fcbfa224842c85f6cdfd25829c44760e3859624f891df4824f7d17938ac2def6721639176fad9512ee9b4c5de1412cf3083e1d5ee2d29b63267ccba535409da7bef05d3fa79a3ef037ee609e01ad345ee17f48b5e8510f767de35df4dfb856f7533ad88866c6b01fe345107ba7191a8809e2e014492acf9c4f35cad664198a65c55f884490f4b30b4526324be842c393f336f16bea2bf6c6b917fdb751e12ff689ab4ffa44625a8b2bc1de4e88682abe5ce9d1942792747681ad23c31046d825140987f19a9cf10323c3f50a20f35a6d1dd8ca6758296b4537a0da1a853011b777623c8774b3689897cf9264a7782470847f36a8093faee04114663438ab39d8a777fb3e10cb4a2402a939a98d387087c5ca5fd8fbc4d96ae698b5bb84a0a8484e2b85743e623a033eb5b1889ccfb4b95885bc69d4c1cb819b95e7923e557c9ec9ec10e94d1e1295fc2f256fa095036f6cfc04c414fc57fc72c120614a586089c93741e97a61c466"}) ioctl$KVM_SET_VAPIC_ADDR(r6, 0x4008ae93, &(0x7f0000000000)=0xefff) open_by_handle_at(r3, &(0x7f00000006c0)=ANY=[@ANYBLOB="f00000001f000000c0e3930cd5d9737f7a712bac37e000e7a81d2971a497a161f7ea1528422887f34f9b45ab6b332c7fd52a3525e9c12f9a5fb3f80c58a148a92220611a9f04a9bbfa5116f8a6a44d3a81efc12095f25b322b0742cc2a4bba97fd02f1147e62d3bc7a5f7d531069b0753eec5b9811825ff7d8714e4a5715b7a557b34a5457be7f790f495d6a0aec7838a86316bed552123705add6bce4d423eaf5334e635c6d736d037674f4e46eaa2bad94b92b84156d21c3c29feac166e6b24e22d0b499258ec0bf90c66e8c7b2b70ded90f1f4e36173adac2fcffc66d3236eec8b5a0309790f38b3320d63b2e768e"], 0x101080) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r6, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000440)=[@text64={0x40, &(0x7f0000000100)="460f300f07c483614804ee08440f20c03506000000440f22c0c402f93473230f09f20f013cb9b805000000b9c00000000f01d90fc728c4c1f9e79f2e000000", 0x3f}], 0x1, 0x0, &(0x7f0000000400), 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$KVM_RUN(r6, 0xae80, 0x0) ioctl$KVM_RUN(0xffffffffffffffff, 0xae80, 0x0) [ 575.995280] binder: 28650:28663 ioctl c0306201 200002c0 returned -22 [ 576.017030] ntfs: (device loop5): ntfs_fill_super(): Unable to determine device size. 13:30:17 executing program 0: r0 = socket$inet(0x2, 0x4000000803, 0x4) bind$inet(r0, &(0x7f0000000000)={0x2, 0x0, @broadcast}, 0x10) getsockname(r0, &(0x7f00000036c0)=@xdp={0x2c, 0x0, 0x0}, &(0x7f0000000080)=0x80) setsockopt$inet_pktinfo(r0, 0x0, 0x8, &(0x7f0000003780)={r1, @rand_addr, @dev}, 0xc) syz_emit_ethernet(0x4a, &(0x7f0000000240)={@link_local, @empty=[0x0, 0x0, 0x86ddffff], [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x3c, 0x0, 0x0, 0x0, 0x4, 0x0, @empty=0x9000000, @broadcast}, @udp={0x0, 0x0, 0x28}}}}}, &(0x7f0000000380)) 13:30:17 executing program 4: preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f00000000c0)=""/148, 0x94}], 0x1, 0x0) r0 = gettid() r1 = syz_open_procfs(r0, &(0x7f0000000080)='io\x00') preadv(r1, &(0x7f0000000480), 0x10000000000002a1, 0x0) [ 576.060899] binder: 28667:28687 BC_CLEAR_DEATH_NOTIFICATION death notification not active 13:30:17 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000180)='/dev/vga_arbiter\x00', 0x200000, 0x0) write$P9_RXATTRCREATE(r1, &(0x7f00000001c0)={0x7, 0x21, 0x2}, 0x7) r2 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000007000)={0x8, 0x0, &(0x7f0000000140)=[@acquire], 0x0, 0x0, &(0x7f00000001c0)}) r3 = dup2(r2, r0) pipe(&(0x7f00000000c0)) ioctl$RTC_SET_TIME(r3, 0x4024700a, &(0x7f0000000200)={0x17, 0x1f, 0x1, 0x6, 0xa, 0x1, 0x0, 0x124, 0xffffffffffffffff}) ioctl$BINDER_SET_MAX_THREADS(r1, 0x40046205, 0x7e12e6a5) r4 = mmap$binder(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x1000000, 0x10, r2, 0x0) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000080)={0x5, 0x0, &(0x7f0000000240)=ANY=[@ANYBLOB="81ecb773", @ANYRES64=r4, @ANYBLOB="1d0000001b07c7d4d000000000"], 0x2f, 0x0, &(0x7f0000000040)="58473373c48f682b02bcfdd806936f4303da8c2fe42e9e9d76e304161c213c7c17196cc455c266e9e262315cc4ed1c"}) 13:30:17 executing program 1: socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)) syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0xe1, 0x400100) creat(&(0x7f00000001c0)='./file0\x00', 0x2) openat$dsp(0xffffffffffffff9c, &(0x7f0000000200)='/dev/dsp\x00', 0x8000, 0x0) syz_open_dev$mouse(&(0x7f0000000240)='/dev/input/mouse#\x00', 0x100, 0x10000) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000007000)={0x8, 0x0, &(0x7f0000000140)=[@acquire], 0x0, 0x0, &(0x7f00000001c0)}) r2 = dup2(r1, r0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000002c0)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x40106308}], 0x0, 0x0, &(0x7f0000000300)}) 13:30:17 executing program 0: r0 = socket$inet(0x2, 0x4000000803, 0x4) bind$inet(r0, &(0x7f0000000000)={0x2, 0x0, @broadcast}, 0x10) getsockname(r0, &(0x7f00000036c0)=@xdp={0x2c, 0x0, 0x0}, &(0x7f0000000080)=0x80) setsockopt$inet_pktinfo(r0, 0x0, 0x8, &(0x7f0000003780)={r1, @rand_addr, @dev}, 0xc) syz_emit_ethernet(0x4a, &(0x7f0000000240)={@link_local, @empty=[0x0, 0x0, 0x543], [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x3c, 0x0, 0x0, 0x0, 0x4, 0x0, @empty=0x9000000, @broadcast}, @udp={0x0, 0x0, 0x28}}}}}, &(0x7f0000000380)) 13:30:17 executing program 5: syz_mount_image$btrfs(&(0x7f0000000140)='btrfs\x00', &(0x7f0000000180)='./file0\x00', 0x0, 0x0, &(0x7f00000007c0), 0x0, &(0x7f0000000380)=ANY=[]) syz_mount_image$ntfs(&(0x7f0000000200)='ntfs\x00', &(0x7f0000000080)='./file1\x00', 0x0, 0x30, &(0x7f0000000580), 0x0, &(0x7f0000000680)=ANY=[]) mount$overlay(0x404030, &(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f0000000100)={[{@upperdir={'upperdir', 0x3d, './file0'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@workdir={'workdir', 0x3d, './file1'}, 0x5c}]}) umount2(&(0x7f0000000040)='./file0\x00', 0xf5ffffff) [ 576.266844] binder: 28703:28706 ioctl 4024700a 20000200 returned -22 13:30:17 executing program 4: preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f00000000c0)=""/148, 0x94}], 0x1, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000080)='io\x00') ioctl$KVM_ENABLE_CAP_CPU(r0, 0x4068aea3, &(0x7f0000000000)={0x7b, 0x0, [0x9, 0x1ff, 0x40]}) preadv(r0, &(0x7f0000000480), 0x10000000000002a1, 0x0) setsockopt$inet6_group_source_req(r0, 0x29, 0x2c, &(0x7f0000000180)={0x5, {{0xa, 0x4e21, 0x1, @mcast2, 0x7ff}}, {{0xa, 0x4e23, 0x3cf9, @local, 0x9}}}, 0x108) [ 576.307330] binder: 28703:28706 unknown command 1941433473 [ 576.326760] binder: 28703:28706 ioctl c0306201 20000080 returned -22 [ 576.328588] binder: 28708:28709 Acquire 1 refcount change on invalid ref 0 ret -22 13:30:17 executing program 0: r0 = socket$inet(0x2, 0x4000000803, 0x4) bind$inet(r0, &(0x7f0000000000)={0x2, 0x0, @broadcast}, 0x10) getsockname(r0, &(0x7f00000036c0)=@xdp={0x2c, 0x0, 0x0}, &(0x7f0000000080)=0x80) setsockopt$inet_pktinfo(r0, 0x0, 0x8, &(0x7f0000003780)={r1, @rand_addr, @dev}, 0xc) syz_emit_ethernet(0x4a, &(0x7f0000000240)={@link_local, @empty=[0x0, 0x0, 0xb], [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x3c, 0x0, 0x0, 0x0, 0x4, 0x0, @empty=0x9000000, @broadcast}, @udp={0x0, 0x0, 0x28}}}}}, &(0x7f0000000380)) [ 576.416711] binder: 28703:28718 ioctl 4024700a 20000200 returned -22 [ 576.440402] binder: 28708:28721 BC_INCREFS_DONE u0000000000000000 no match [ 576.504126] binder: 28708:28721 Acquire 1 refcount change on invalid ref 0 ret -22 [ 576.540775] ntfs: (device loop5): ntfs_fill_super(): Unable to determine device size. 13:30:17 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0x0, 0x200802) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000007000)={0x8, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="c1000000000ba10010719aa7a9a73a16bc0aa3995f976ed50b64"], 0x0, 0x0, &(0x7f00000001c0)}) r2 = dup2(r1, r0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000002c0)={0x8, 0x0, &(0x7f00000000c0)=[@release], 0x6e, 0x0, &(0x7f0000000040)}) [ 576.556022] binder: 28708:28721 BC_INCREFS_DONE u0000000000000000 no match 13:30:17 executing program 4: preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f00000000c0)=""/148, 0x94}], 0x1, 0x0) r0 = bpf$OBJ_GET_PROG(0x7, &(0x7f0000000040)={&(0x7f0000000000)='./file0\x00', 0x0, 0x18}, 0x10) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000200)='hugetlb.2MB.usage_in_bytes\x00', 0x0, 0x0) pipe(&(0x7f00000003c0)={0xffffffffffffffff}) ioctl$EVIOCSMASK(r2, 0x40104593, &(0x7f0000000500)={0x15, 0xd1, &(0x7f0000000400)="a03fd532ab6f5b41769622b84ce2f564ec5a79031cc0e986c7b702f3d07ab89003375f31e27ad0466f10a3ebc6c72f2c0bb94b7814dbfa5d32fdfa45f3075e525e30f5ed0956669edab38c095b45140e373f523bf2cfd750b3ea39755606234f9a0da55b551296ebf180bd69ff357f53b9e447ab0f02a1daa7ae2613c7015170d9694b617735c5b77bdfe9c9b6d9ed8f128f6f093051747254f61233d8496da7c30b90743f90098ff23d8f8fe9ab7c5cdbcf88d3c0f7a92f2c6940443fbc4cddcafe371b8dbbf19f1a9e233b673a87eb95"}) ioctl$SG_GET_NUM_WAITING(r1, 0x227d, &(0x7f0000000540)) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x17, &(0x7f0000000280)='vmnet0:.securityloeth1\x00', 0xffffffffffffffff}, 0x30) r4 = gettid() sendmsg$nl_generic(r1, &(0x7f0000000340)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f0000000300)={&(0x7f0000002880)=ANY=[@ANYBLOB="701400001200080128bd7000fbdbdf25080000006f01b9005d851f05531932d912307df242d3c6d40e8015afe269bd2ceb39032e2944346db4d8457aab37013e0763c427b6f0e798278e49b90cda7cb968fe12c048ba85a8b20839c9a52c7c19ef8df9c78c90d0404207e8ec1bbcc7584eabb75797f9cf381997ee1f7e11de3dd6ac6260e73df2b9254c38221249af9a8a279b71da41a2bfe7dbb556092cf2a9f078eef8c3cfc106dbf329e310fc5d180002001400090000000000000000000000000000000001595c3dda997fdc3f42767f31157228b89cac24351bb811df66b1a4521535d2b8c2bb5e9d7e0f2705077ad90a8e56346744790ea7df3e34b9bb41cb89c6ef721c23c79c923cc0c20ddb0620bd3a9b7ff96ae760acff8f3d1090ecfb503b096490687ee175cbd2595f1dfabc0116d492b8d9eba4f7f6eb4a645ea213826fad184cb24d9fe7aadf5408e55d32eff6de9338562356acaf2819ac316d5c3578744a00f9eff5490040c983953c195e22da767d398f984338ee4bdbd21bb2feba8b0a910f838442d7039c8f758084f3ce51498475c3de2620c04de32307a271bf46fa4789fdc67718a3a846d1b7e928a29137e18738003400f07b28cea84d825ed167e84bf203eb52aa77c33729d1f5efc8789881a4fe6d7993323689ee0b039caf1a6fd26e0bc5f2559a000038114400b979c627b471cdf4934b1b8049a93f522fb743e1168b87764c103c9dd041e569c422eba7baf7df231a8012670003161e3813fdc9810c1561b3320820f274aada538f1bc12b971e39db203a8153bb74b2a2020333d48f3a09bd8dc531bdad4b858d6a78c28babbe779e1441131e6163fbcedc8913e44cbaf94c7b680693e2b66e4f49db141c4a430d9e1959e8d0b498ff07ec02e8b44fc57d375d8851aed491b488e8b7f5073a6c0deb6c70dacc2860dd708eb4cc31afcfb1e148d4c3eba67622691dc7b1c8bcd15ad46005ce797e32e88a8875f707c2e4717e5079c689c9af4db292b4b6f04e1d2e11dac1481c2f2509ea6d74d848d6e6b8f3b947617c5e83b4eb196943c60e0110915602d61b0500626ab50f1e89fc3c768ca52a02962d141424d26fe7c550e59018dd12b7649bda941304583638234667b4bb704e48d08243c773fe32422f25f9ee84e4e2e64f2970102ce0ba5f6f3b0ffd3f3b68f1754ff756d79cf94d873f99b36c42c705f8bbf6931e249da37e24af4e5f4c0ae6eea44dcb9b6e184ec266b1dc736f651e6ecdf636e7059404a34c2f56ac8177991a34679d6464e23ddc5a9431c3a37ec74a2d5d5dc2ba9b958987fd95bc13e915ce8187a4c27ab0107a65dd11dc49c95098e757574a0bf5c0a5af3221817738bef31b98f87c4a99e80d0dc6f94b7c98009737087894176fde7bf5fec9ea8def6c0332f7719fc0ef8a613a8afe4aa50115ebcca0e30d38f645599877325d4c38f1de9284b86c0b5b0ede74f11d05817fbe8ce80a99b9bb3fad09b15eb7b5d2156dc749e945b007f5e5539219d6c08063a4e2524276d65aac7848a8b7aaa8fdab099bc1f664a477fc3ba8187a612cf67f490801d76da3e8d8971ec92402788e2d6fc0f09b19ae9e3604a4813acd867249d467fab9ae7fce76384037108c30038b274905eb2f11084015575fc0e1f8ae84aa6ea96f715af22a14fa89a519be2d1c4052f6ecd5fbd6fbaeb3ebeaf964999cfcfa1b3b81f13ee3b7a45d1c4c602625de6de32a64f56365dd91594831296d7a217342e11530dad2eb97e29e7b8133348d07d1a31564018849aba356db3a8a1170fbb8ff28216f71d0d236fd76a5c1c76b32b27d689fde92cba65f66f1b09035c27953898b7a517dd95f573a7be7b4cf3251419efbe7d7e95188cbf97ae7dbdb00db3b22321c96c0e99e9bf4953444354ebd4b960885d76a3dcf4a7ed3b0a86015bfaae07f61e1ee88e1d31a118e400ba31c78e89cbd8978f1743081889e522340cf17949f72e4d75a4b0c36f53ed5ba1a57abc22dacb111a65d3926947012e9db50b9161810cc67af51665cff1d61a0fafa6500470e5340b153933d115c863314fc498a0af9997a7ad263394a456f808ba147e6d7f0098ca61d563a8fbcc64493ab6319126a89670829c0b0f4b3a1079456dadf46791317af452b13621e00fa7fbb642f66d0ff9611d1a93912ee23a0e0f2835cc1a2d27fec36b048dabf6f116052890ac774949e387bd881e769e94e29de114b05d514398be7255186f77fb4676a59ba331357b665468694e308d647de32d2adc2f30b212223299a3f3b3659201b5d2ea3407b1dc4d6477ddc20e8993ea843624c8bbdefcdfdd2f01f930eff978c2611a257fd3781a3d3e8365bb3bfea8ab95c44a768c92bed64e2f676a2799d6c99229887592a594e15e4ce921c1b849c471eba8f0c0810c7cbc889f69caba8fbd1d3a42fe6ea5e7b7896b5a08af5f304986238a9309e1ffb0d31c0bc8f44e7855af566a66641ccde2ee26a9247ee8e9997932b1aaa9fbf68e9a2a9a3374b753ec64b3938a3271239eb45d28f3a414d76a83a2a3ccbae4afcbba29eac8b209afc2e044d00868a244952fda900e44d7f437deeff2bd9712f92c30aab54e30ac16bbf277cdfa8ffd16d86a0d3b92c0cbc380e6f1f359ba161089d62ce6e1a47429731face3165dbf459219f3f0002a28bd399c6cd81d346c3243c392e6c56ab139131cedd9d08964e25384dd7d4634151d92b22f97a414ebf4c9c4ecf1236b39a25adec78db685168c6e1fa173aabf137e902a2a770f296faa4cde99477f231da2f7cc7809b7e95e9e3e2dd56ca0140c720e46e902da7d85f8ffc013507c3cbc50b9937d41c818ae92b31036f9577aa9b924888a217b70d9f0604c3537c7b223e48afafa3f78259f026c5e9bf0b433245db3f0d598d78557ba576fda258c24f3d9600b334c3b74680ae3606e80e2c16c1e2e305f4578c2da77a84e1b9704478f9e35c8f588992e29bf042b8bd4c5c78619c4b05a08ff75845fc80e8bfd3b3acc82167743f1fcbac720a42b050f20ffb39c5f3f39da1b15112a5a1fb5fae1162f515dd613b62200bc19ca624a217bb7f8925dd37a4f1d7937e7477be455788caabaa945e355030a69546e18056a55915e66cd26fdf84fc8a74916020354e93cc0c9517a5e3228db66d4221a9097d1130d91e92c9523d8b4c92bbd4017065c999ccee3287c68e64297c3277335ce9c7ae557e67dddf3ce6ac774e0d2879120f141635b5e110fb41115bb5ebd3556f9800be8666693fb0009221bcee4edf5bb6ec2e17aee33c4078d6d0f33c2c9d2c4eb653d5f8395c6562d7418edff6c27852149c1cd749ac5b98590bd65cee73005ed311907688aa0328514a8592ec5cf598d1b727e8853d44b7099130425378fa150123715b92b10bcd16a92eade15cdb12a9f767ca41f3232bd59b64a24bfb43fc91a67204dc8c14d34f9d85a6517986227dea484c59174df1a80104154a7772644502b919b394d0f191af32a8b0ef71ec9cac1767a1a04460f1e39530a02138f01f9fa55be527b66950dbaa7b4f155f2825c20bec6f665bd4da71cb09acd6d3a61b73f7102b0107dc247619804645939c61d3026ae0b9478d4f7359492562250346fd19d75c5102923bb5299e804b47a1732f3b4de705be45e97603994518e19b7e0d13853f11e319d765cdf4713361f714c1ec0dcd56deef4b0273914e8c3922eea6e4a47a606468385f1099af6aef239d1bc0401a802d5c1978106e51f79f28deacf6344212b69932af082de4ab3a4952972324905669514ec4df3495ef89f2d38cdb6dbe998051d3501f455bbb40bcf57403025d661ef76e3fe03e649dd5ff8319364eede90ea536a482edd41e2b1f2c666a2e59d25f7d639cf1e2f8a2fe6d2662a00b04435296729685918f4f339be5357d06964747c22bec81ce1e67d0dfb24a9f4391613def524fe9894f035e9e51c50756457b32ad726a5799d7ec9ea883cea6724a65b6d102e0d37a7f73f5f10fdb15bfba7fdeb9ff7dd7d2a8fd5d787b91c204a025910ad8a54b050aaae27a676c3f9a4bcd750d9609dc00515afb0f4d9229caec093c8a679a109b0b609b4e39235bc6b475a275c4ed4ae3ee1f03efe223822a80ca80c07ed6665e4eacad8c56f55ada70838a8c6a26ec35cb10faf19d288f5d80f5b84093dca3d6f60e429d8eef63241a1932d95ca9ad0eb95c1914cd86ea8bad608f7042f3d2cc9a5935a7b6ab02bb8b31a1183767e6d565cf332c429ec2fcdf649f76269149d33fd4b4a8658d2ce2ff286e2832d638d08dd34bc44158395a93ab1b9760b193d248a48a4ecafa97f95ade53e5f057643301c167a4a10bdfbaea166dc45ca412088949d93b559a3648128fc5a7b59811739bb7631491b536fbe671e82f94aaf926e80826823a867e326bfbf96c7ca3aff8dbde51fdee5f7c6b9c53a99a83af8a2345e4f75ce350fd0a8433978bfdc1e335fd3064e14c52fbb817b608dd2bed8bcb2f36c0761f1d7169303e106936826fab7730482b996a7a99eb549d61f2371b5d692c070eb289355cb35ee40342066df262303030447394de857e826a396c435d79a87fb62f8ec7050bdabda8e8526223c33a811354acdf44ce42cbd3c84095cb81a01886c366c2525349b5ee3b06c5dfc3c8c7873440fbea7c7f794178521c948bcd8f4138445a96c0b2a289d740eff7701ea30e67004884e269848a8a724439522ce1940a0b3a388d4a93d0604e870baa87b6ff9df6a63a8b6526373d3b29a1c2ce53494a0ebccd422e34141c1579178eb9e7d8cdd9ca0f94a9eb4cbb652cfefc3a7ca3c3f5b6c2e6cf001c04db49610fe48d7a2b89c2486f3a05996cd13b62a8f32273bc6211b637f670085b02bf33c88caf3b08e122118fc249e90f82877a5659abb098d905c6676161336bcf386cb8643b55a1dc542266efe94c9d53a27853fd7f6954a039485327f446578450317c7c9862dab1b947d08b9a3b7e4fb0b0d071c6d809ae874fc758cf36fab47560db7b91b6ae53c342470b8948cadedcbced0566557798641504ae59d6eb2560d6f0a5e15dc723d007f74f23e47da90c8a51a6c659b969bcd4b68382bbf17148aa0886592332cc081a9c2dc1ba62aa22c6e05e2f1b8dc9d9a563f98d580e760cb6750e9294a183684f785ec594c5b0e8c1bb1807b1d364d224eee78fdba420992ec064de1daea2afa1d853935dc017e3d2aae81fe31561d1d5d734e2bb317e45d61a0c08b329f35df727202504b25429a73bef0fe9c286148d0d892ec68cbe7b6358a75799101544a11911fbe5e2f5f37d50b0c11ea59fe6d856fd7be70d8188a0a9b7dfccbc4f5851ff5c051f33e34f7f683df3b87f4b1bea86e0f5d1bdeefb28e1189c6042844872a464bac16e1512de8ce38a4440e4b076a12c0fcc4f38d13eed1e35aac90b76e993861892422e82d97f705c11ec8f28dbe1b4f70b36dfcdd0c4d3ba1a0698ae8a1681574afc863cc94b210c1d89f41e5b63511bfcc02889e58fa7e6645b88b45525dd3b05aa2b0a9884054fcbd9fc1a29011be89dd4b5a758e05f266eb21be9b58e7271194ee85aec5ba1f9e929e9db3dec6b24f3ab48238d5960e7bdd9bc9c5d3afd6c20f75b2008a56d5652c2e5c1a0265b34421a2b6bb86023c7dcc38d96a836f8d5e92bb9bc779ed54a1b8ec6d72a701a2d00c02b560261dd2beca867e756135c97e8b949e33193cc2b9c2fcd058f476f646021f317170b1779fc99a25daaacd0ca0453456852828cc93539474aafd405972691a682cb43c7382c20940716668b78ad1ff1b1243c6d88894b0354ca1188cc7016925fff5517d236c2a6d7f9677cf0765be7909d418babc3c88de876e3e6b752fe72e61845dcd7bb714d376567ec9ae5db9de576eaf5fd5efcbf9eb8037eb3262a0a01fa3d666317eeaa04127824006546e13ff9ffa6b9e0d86ef0a039102e638b96936372b4c42cb53203786aad25879ecd0e04ec897b7587b3610056c7557a96031195163802f8d62b353afeeceff9f202ec27d068d49a4196b1848fc6d4790ac5e77cdc7cf2f9be3e68b07e0477ee18a3fd01ea81c1414e7a3cbe8af617c967fe20fe3e9c7f548f8cc52db06d7316b54b9b53071a003c82ad306a33da9656c3cfa8c1f9d925d94a7de964c0d0ea7a1b8423d27c04e6ddcb076d5d14e273862ea8915adc1b3944d9a354532616a700536512c83c49cf5282dd905dd95d4dae65560f71b6deebee4711008cda9da72567115172fbd02117a021c3d99276b8e91daddbd29420a0c76972a9323f1c11f654ade3806b99774fa61786e6c77030374513b103ccb9c0c07887f80721905a2aeac860de847ed24e21d48d66ca85aae6af27b39eacd3edd7fd3b0987dd92cc00a6a09b959b6603dcf4f0543755e689c4ae9a5bcd87f7d786b62b4b40f601df236264b1421ed5651ce2997b541ca3f823363c315762d23e9afdead777bbf7160e248707c56b94ee423a502deb88e4af8e412103fc76cef7c4c91956676209c4c2107f47469644f4b3a021a85a7eedd1aba5728785b0a7f18e45b35d81b9accb2ccf12da252607b76811de339bc28b77c9f46b7d1edfb54569f5df883c2ea462a0f4cda891fd7f14243692c1d59272c339cceadc943a34fc42aca7382a650b23d7daced118401caaebcabe3dbaba0b8c2789b4ac39983ed03af67d10ed62b7e78c1fd6b1f38f777c894e61fddbedd9e2599cd0e0a5bb5c3a439b593af553646a8583949d9d93aa31e9979cf40c0591b8f70aa79bd8fbfe7ef186f902cd5c564cd0a5ed935a7340d7b0f4a7cb855025646bbaf6c723f7e2011b4ee611e502422a96f144401de0de47c54e5fea2e3e1172ad12351d1dfd6e8cc46d6f8b2cd778dda2902e48d4644b69385a7b9de52d370000004801100008005100070000003f088271e877d175322bf01018c2a65c47f5d70be30936a12c148fbe8438e0f1c817254abb17c5fa25709d8fa26b23595ea120f681a57decdfbeefbc58982012c84919054d0cd89151806c29ae347a61838f1e1163d1610ce08d9b7ce8826891521886dbea4baf664ce32e4867d27a66c39a4fedd87995ff4a6aed43dc75dc74db655f32cc6b0b4d88335f6732bd34719b5c40ce332917880da5ee280772734e24090cdfc93e8d8d92e457f15f1333015037edaeed16ab4f4e331ad44ca2ca3122efdc4ddb6aac28dabda4e2ecf1ceb5450157e6c8c00b11184dadcbb884014a81b5c2a7e013613d8c08007f00", @ANYRES32=r3, @ANYBLOB="20000900266e6f64657676626f786e6574306b657972696e672547504c0000000c003900020000000000000008003600", @ANYRES32=r4, @ANYBLOB='\b\x00!\x00', @ANYRES32=r0, @ANYBLOB="3f11c15227c04542ad44a219fa42814def91c899582a7f006d00000000000000000000"], 0x1470}, 0x1, 0x0, 0x0, 0x1}, 0x0) fsetxattr$security_smack_transmute(r0, &(0x7f0000000180)='security.SMACK64TRANSMUTE\x00', &(0x7f00000001c0)='TRUE', 0x4, 0x1) ioctl$TIOCGSOFTCAR(r1, 0x5419, &(0x7f0000000380)) r5 = syz_open_procfs(0x0, &(0x7f0000000080)='io\x00') preadv(r5, &(0x7f0000000480), 0x10000000000002a1, 0x0) dup(r5) 13:30:17 executing program 1: socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)) syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0xe1, 0x400100) creat(&(0x7f00000001c0)='./file0\x00', 0x2) openat$dsp(0xffffffffffffff9c, &(0x7f0000000200)='/dev/dsp\x00', 0x8000, 0x0) syz_open_dev$mouse(&(0x7f0000000240)='/dev/input/mouse#\x00', 0x100, 0x10000) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000007000)={0x8, 0x0, &(0x7f0000000140)=[@acquire], 0x0, 0x0, &(0x7f00000001c0)}) r2 = dup2(r1, r0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000002c0)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x40486312}], 0x0, 0x0, &(0x7f0000000300)}) [ 576.669376] overlayfs: filesystem on './file0' not supported as upperdir [ 576.739604] binder: 28741:28742 got reply transaction with no transaction stack [ 576.785184] binder: 28741:28742 transaction failed 29201/-71, size 0-0 line 2741 [ 576.897153] binder: 28741:28752 got reply transaction with no transaction stack [ 576.909380] binder: 28741:28752 transaction failed 29201/-71, size 0-0 line 2741 [ 576.920258] binder: undelivered TRANSACTION_ERROR: 29201 [ 576.926259] binder: undelivered TRANSACTION_ERROR: 29201 13:30:18 executing program 3: socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)) syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0xe1, 0x400100) creat(&(0x7f00000001c0)='./file0\x00', 0x2) openat$dsp(0xffffffffffffff9c, &(0x7f0000000200)='/dev/dsp\x00', 0x8000, 0x0) syz_open_dev$mouse(&(0x7f0000000240)='/dev/input/mouse#\x00', 0x100, 0x10000) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000007000)={0x8, 0x0, &(0x7f0000000140)=[@acquire], 0x0, 0x0, &(0x7f00000001c0)}) r2 = dup2(r1, r0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000002c0)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x400c630f}], 0x0, 0x0, &(0x7f0000000300)}) 13:30:18 executing program 0: r0 = socket$inet(0x2, 0x4000000803, 0x4) bind$inet(r0, &(0x7f0000000000)={0x2, 0x0, @broadcast}, 0x10) getsockname(r0, &(0x7f00000036c0)=@xdp={0x2c, 0x0, 0x0}, &(0x7f0000000080)=0x80) setsockopt$inet_pktinfo(r0, 0x0, 0x8, &(0x7f0000003780)={r1, @rand_addr, @dev}, 0xc) syz_emit_ethernet(0x4a, &(0x7f0000000240)={@link_local, @empty=[0x0, 0x0, 0x4000], [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x3c, 0x0, 0x0, 0x0, 0x4, 0x0, @empty=0x9000000, @broadcast}, @udp={0x0, 0x0, 0x28}}}}}, &(0x7f0000000380)) 13:30:18 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000007000)={0x8, 0x0, &(0x7f0000000140)=[@acquire], 0x0, 0x0, &(0x7f00000001c0)}) r2 = dup2(r1, r0) ioctl$SCSI_IOCTL_DOORLOCK(r2, 0x5380) setsockopt$bt_hci_HCI_FILTER(r2, 0x0, 0x2, &(0x7f0000000040)={0x3f, 0x685e, 0x7, 0x5}, 0x10) ftruncate(r0, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000002c0)={0x90, 0x0, &(0x7f0000000200)=[@reply={0x40406301, {0x2, 0x0, 0x2, 0x0, 0x11, 0x0, 0x0, 0x0, 0x10, &(0x7f0000000080), &(0x7f0000000100)=[0x38, 0x0]}}, @decrefs={0x40046307, 0x4}, @reply={0x40406301, {0x2, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x28, &(0x7f0000000180), &(0x7f00000001c0)=[0x48, 0x0, 0x78, 0x0, 0x38]}}], 0x0, 0x0, &(0x7f0000000300)}) 13:30:18 executing program 5: syz_mount_image$btrfs(&(0x7f0000000140)='btrfs\x00', &(0x7f0000000180)='./file0\x00', 0x0, 0x0, &(0x7f00000007c0), 0x0, &(0x7f0000000380)=ANY=[]) syz_mount_image$ntfs(&(0x7f0000000200)='ntfs\x00', &(0x7f0000000080)='./file1\x00', 0x0, 0x30, &(0x7f0000000580), 0x0, &(0x7f0000000680)=ANY=[]) mount$overlay(0x404030, &(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f0000000100)={[{@upperdir={'upperdir', 0x3d, './file0'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@workdir={'workdir', 0x3d, './file1'}, 0x5c}]}) umount2(&(0x7f0000000040)='./file0\x00', 0x8cffffff) 13:30:18 executing program 4: preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f00000000c0)=""/148, 0x94}], 0x0, 0x4000000000000000) r0 = syz_open_dev$mouse(&(0x7f0000000180)='/dev/input/mouse#\x00', 0x5, 0x20000) ioctl$SCSI_IOCTL_SEND_COMMAND(r0, 0x1, &(0x7f00000001c0)={0xb5, 0x3, 0x2, "35ba2b19ad0463fc4a3298410e66b72c51ddcda6f0143ac73e2cde493cbcd3d1544860345e403b30825d86f82f9afcbfeccff396d31b6ea06f09c36307f11f05dfa9cbfc0c016f7cd074c1561c3ee222e2497156382920b757937878dbce168d3f3ac48937c04d4127c96dd2305f9fa44c7ab60ed546e56d76ca44be28d0699705234c73133feb15154ce0d7669bd972fa5dc7658f8891f342438c889cf7e50599daa9b3c320587e009278b65be002a88a3d3a12b5"}) r1 = syz_open_procfs(0x0, &(0x7f0000000080)='io\x00') ioctl$RTC_WIE_OFF(r1, 0x7010) preadv(r1, &(0x7f0000000480), 0x10000000000002a1, 0x0) ioctl$sock_bt_hci(r1, 0x800448f2, &(0x7f0000000000)="31c6436fd962f1356c1db8732caef63dac8d5e650bd78effaa07be148db0298d03e286a80ae9f0f83a0527fcdd5a82ce90c4f1153a6b305aa312f423b3751c42b7") 13:30:18 executing program 1: socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)) syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0xe1, 0x400100) creat(&(0x7f00000001c0)='./file0\x00', 0x2) openat$dsp(0xffffffffffffff9c, &(0x7f0000000200)='/dev/dsp\x00', 0x8000, 0x0) syz_open_dev$mouse(&(0x7f0000000240)='/dev/input/mouse#\x00', 0x100, 0x10000) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000007000)={0x8, 0x0, &(0x7f0000000140)=[@acquire], 0x0, 0x0, &(0x7f00000001c0)}) r2 = dup2(r1, r0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000002c0)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x40406301}], 0x0, 0x0, &(0x7f0000000300)}) [ 577.232585] binder: 28767:28768 Acquire 1 refcount change on invalid ref 0 ret -22 [ 577.233503] binder: 28766:28777 Acquire 1 refcount change on invalid ref 0 ret -22 [ 577.268350] binder: 28766:28777 ioctl 5380 0 returned -22 [ 577.281897] binder: 28766:28777 got reply transaction with no transaction stack [ 577.290122] binder: 28766:28777 transaction failed 29201/-71, size 0-16 line 2741 [ 577.297670] binder: 28767:28768 got reply transaction with no transaction stack [ 577.312635] binder: 28766:28777 Acquire 1 refcount change on invalid ref 0 ret -22 13:30:18 executing program 0: r0 = socket$inet(0x2, 0x4000000803, 0x4) bind$inet(r0, &(0x7f0000000000)={0x2, 0x0, @broadcast}, 0x10) getsockname(r0, &(0x7f00000036c0)=@xdp={0x2c, 0x0, 0x0}, &(0x7f0000000080)=0x80) setsockopt$inet_pktinfo(r0, 0x0, 0x8, &(0x7f0000003780)={r1, @rand_addr, @dev}, 0xc) syz_emit_ethernet(0x4a, &(0x7f0000000240)={@link_local, @empty=[0x0, 0x0, 0xf0ffff], [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x3c, 0x0, 0x0, 0x0, 0x4, 0x0, @empty=0x9000000, @broadcast}, @udp={0x0, 0x0, 0x28}}}}}, &(0x7f0000000380)) [ 577.328114] binder: 28776:28780 Acquire 1 refcount change on invalid ref 0 ret -22 [ 577.337037] overlayfs: failed to resolve './file1': -2 [ 577.345960] ntfs: (device loop5): ntfs_fill_super(): Unable to determine device size. [ 577.354923] binder: 28766:28785 ioctl 5380 0 returned -22 [ 577.355549] binder: 28767:28768 transaction failed 29201/-71, size 0-0 line 2741 [ 577.366608] binder: 28766:28790 got reply transaction with no transaction stack 13:30:18 executing program 4: preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f00000000c0)=""/148, 0x94}], 0x1, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000080)='io\x00') ioctl$DRM_IOCTL_ADD_CTX(r0, 0xc0086420, &(0x7f0000000000)={0x0}) ioctl$DRM_IOCTL_SET_SAREA_CTX(r0, 0x4010641c, &(0x7f0000000040)={r1, &(0x7f0000000180)=""/227}) preadv(r0, &(0x7f0000000480), 0x0, 0x0) [ 577.388537] binder: 28776:28780 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 [ 577.401851] binder: 28766:28790 transaction failed 29201/-71, size 0-16 line 2741 [ 577.426330] binder: undelivered TRANSACTION_ERROR: 29201 [ 577.439147] binder: undelivered TRANSACTION_ERROR: 29201 [ 577.445729] binder: 28767:28799 Acquire 1 refcount change on invalid ref 0 ret -22 13:30:18 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x1) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000007000)={0x8, 0x0, &(0x7f0000000140)=[@acquire], 0xfffffffc, 0x0, &(0x7f00000001c0)}) r2 = dup2(r1, r0) ioctl$EVIOCGPHYS(r2, 0x80404507, &(0x7f0000000180)=""/151) 13:30:18 executing program 0: r0 = socket$inet(0x2, 0x4000000803, 0x4) bind$inet(r0, &(0x7f0000000000)={0x2, 0x0, @broadcast}, 0x10) getsockname(r0, &(0x7f00000036c0)=@xdp={0x2c, 0x0, 0x0}, &(0x7f0000000080)=0x80) setsockopt$inet_pktinfo(r0, 0x0, 0x8, &(0x7f0000003780)={r1, @rand_addr, @dev}, 0xc) syz_emit_ethernet(0x4a, &(0x7f0000000240)={@link_local, @empty=[0x0, 0x0, 0xf401], [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x3c, 0x0, 0x0, 0x0, 0x4, 0x0, @empty=0x9000000, @broadcast}, @udp={0x0, 0x0, 0x28}}}}}, &(0x7f0000000380)) 13:30:18 executing program 4: r0 = openat$rfkill(0xffffffffffffff9c, &(0x7f00000012c0)='/dev/rfkill\x00', 0x0, 0x0) getsockopt$inet_sctp_SCTP_GET_PEER_ADDRS(0xffffffffffffffff, 0x84, 0x6c, &(0x7f0000001300)={0x0, 0x25, "8658420ebe9f8be17ff0a9f20d686366951952837d3da0073c16fa112a99a29ffe3289ab3f"}, &(0x7f0000001340)=0x2d) setsockopt$inet_sctp6_SCTP_PEER_ADDR_THLDS(r0, 0x84, 0x1f, &(0x7f00000013c0)={r1, @in6={{0xa, 0x4e20, 0x4, @mcast2, 0x6000000}}, 0x163024bb, 0xfffffffffffffffb}, 0x90) preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f00000000c0)=""/148, 0x94}], 0x1, 0x0) r2 = syz_open_procfs(0x0, &(0x7f0000000080)='io\x00') ioctl$SNDRV_TIMER_IOCTL_GSTATUS(r2, 0xc0505405, &(0x7f0000001180)={{0x0, 0x0, 0x101, 0x1, 0x40}, 0x3, 0xffffffc000000000, 0x2f}) preadv(r2, &(0x7f0000000480), 0x10000000000002a1, 0x0) recvmsg$kcm(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000180)=""/4096, 0x1000}], 0x1, 0x0, 0x0, 0x8}, 0x40002020) 13:30:18 executing program 3: r0 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vhost-vsock\x00', 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r0, 0xaf01, &(0x7f0000000040)={0x4, 0x791ba16c}) r1 = eventfd(0x0) ioctl$VHOST_SET_VRING_KICK(r0, 0x4008af20, &(0x7f0000000100)={0x0, r1}) ioctl$VHOST_SET_VRING_KICK(r0, 0x4008af20, &(0x7f0000000080)={0x0, r1}) [ 577.491591] binder: 28767:28784 got reply transaction with no transaction stack [ 577.530232] binder: 28767:28784 transaction failed 29201/-71, size 0-0 line 2741 13:30:18 executing program 5: syz_mount_image$btrfs(&(0x7f0000000140)='btrfs\x00', &(0x7f0000000180)='./file0\x00', 0x0, 0x0, &(0x7f00000007c0), 0x0, &(0x7f0000000380)=ANY=[]) syz_mount_image$ntfs(&(0x7f0000000200)='ntfs\x00', &(0x7f0000000080)='./file1\x00', 0x0, 0x30, &(0x7f0000000580), 0x0, &(0x7f0000000680)=ANY=[]) mount$overlay(0x404030, &(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f0000000100)={[{@upperdir={'upperdir', 0x3d, './file0'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@workdir={'workdir', 0x3d, './file1'}, 0x5c}]}) umount2(&(0x7f0000000040)='./file0\x00', 0x3c000000) 13:30:18 executing program 1: socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)) syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0xe1, 0x400100) creat(&(0x7f00000001c0)='./file0\x00', 0x2) openat$dsp(0xffffffffffffff9c, &(0x7f0000000200)='/dev/dsp\x00', 0x8000, 0x0) syz_open_dev$mouse(&(0x7f0000000240)='/dev/input/mouse#\x00', 0x100, 0x10000) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000007000)={0x8, 0x0, &(0x7f0000000140)=[@acquire], 0x0, 0x0, &(0x7f00000001c0)}) r2 = dup2(r1, r0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000002c0)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x630c}], 0x0, 0x0, &(0x7f0000000300)}) [ 577.607751] binder: undelivered TRANSACTION_ERROR: 29201 [ 577.613487] binder: undelivered TRANSACTION_ERROR: 29201 [ 577.629538] binder: 28808:28815 ioctl 80404507 20000180 returned -22 13:30:19 executing program 4: preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f00000000c0)=""/148, 0x94}], 0x1, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000180)="4a494f00e3f278c2fd4bb836adf44b361d2ea18e527a9c82ac5623b4d90fa08735") preadv(r0, &(0x7f0000000480), 0x10000000000002a1, 0x0) ppoll(&(0x7f0000000000)=[{r0, 0x100}, {r0, 0x280}, {r0, 0x8400}], 0x3, &(0x7f0000000040), &(0x7f0000000080)={0x8}, 0x8) 13:30:19 executing program 0: r0 = socket$inet(0x2, 0x4000000803, 0x4) bind$inet(r0, &(0x7f0000000000)={0x2, 0x0, @broadcast}, 0x10) getsockname(r0, &(0x7f00000036c0)=@xdp={0x2c, 0x0, 0x0}, &(0x7f0000000080)=0x80) setsockopt$inet_pktinfo(r0, 0x0, 0x8, &(0x7f0000003780)={r1, @rand_addr, @dev}, 0xc) syz_emit_ethernet(0x4a, &(0x7f0000000240)={@link_local, @empty=[0x0, 0x0, 0x400000000000000], [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x3c, 0x0, 0x0, 0x0, 0x4, 0x0, @empty=0x9000000, @broadcast}, @udp={0x0, 0x0, 0x28}}}}}, &(0x7f0000000380)) 13:30:19 executing program 3: getsockopt$sock_cred(0xffffffffffffff9c, 0x1, 0x11, &(0x7f00000001c0)={0x0, 0x0}, &(0x7f0000000200)=0xc) r1 = getegid() lchown(&(0x7f0000000180)='./file0\x00', r0, r1) r2 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r2, 0x100008912, &(0x7f0000000100)="025cc80700145f8f764070") fsetxattr$trusted_overlay_redirect(r2, &(0x7f0000000040)='trusted.overlay.redirect\x00', &(0x7f0000000140)='./file0\x00', 0x8, 0x3) r3 = socket$inet6(0xa, 0x1, 0x0) r4 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000080)={'bridge_slave_0\x00', 0x0}) sendmsg$nl_route(r4, &(0x7f0000000100)={&(0x7f0000000000), 0xc, &(0x7f00000000c0)={&(0x7f0000000500)=@setlink={0x2c, 0x13, 0x309, 0x0, 0x0, {0x0, 0x0, 0x0, r5}, [@IFLA_MASTER={0x8}, @IFLA_PORT_SELF={0x4}]}, 0x2c}}, 0x0) [ 577.770549] binder: 28825:28831 Acquire 1 refcount change on invalid ref 0 ret -22 13:30:19 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000007000)={0x8, 0x0, &(0x7f0000000140)=[@acquire], 0x0, 0x0, &(0x7f00000001c0)}) r2 = dup2(r1, r1) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000002c0)={0x8, 0x0, &(0x7f00000000c0)=[@release], 0x0, 0x0, &(0x7f0000000300)}) 13:30:19 executing program 0: r0 = socket$inet(0x2, 0x4000000803, 0x4) bind$inet(r0, &(0x7f0000000000)={0x2, 0x0, @broadcast}, 0x10) getsockname(r0, &(0x7f00000036c0)=@xdp={0x2c, 0x0, 0x0}, &(0x7f0000000080)=0x80) setsockopt$inet_pktinfo(r0, 0x0, 0x8, &(0x7f0000003780)={r1, @rand_addr, @dev}, 0xc) syz_emit_ethernet(0x4a, &(0x7f0000000240)={@link_local, @empty=[0x0, 0x0, 0x88640000], [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x3c, 0x0, 0x0, 0x0, 0x4, 0x0, @empty=0x9000000, @broadcast}, @udp={0x0, 0x0, 0x28}}}}}, &(0x7f0000000380)) [ 577.836342] device bridge_slave_0 left promiscuous mode [ 577.845959] binder: 28825:28831 unknown command 0 [ 577.866567] binder: 28825:28831 ioctl c0306201 200002c0 returned -22 [ 577.873534] bridge0: port 1(bridge_slave_0) entered disabled state 13:30:19 executing program 4: preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f00000000c0)=""/148, 0x94}], 0x1, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000080)='io\x00') fsetxattr$trusted_overlay_nlink(r0, &(0x7f0000000040)='trusted.overlay.nlink\x00', &(0x7f0000000180)={'U+', 0x5}, 0x28, 0x3) ioctl$KDGKBMETA(r0, 0x4b62, &(0x7f0000000000)) preadv(r0, &(0x7f0000000480), 0x10000000000002a1, 0x0) [ 577.931943] binder: 28825:28840 unknown command 0 [ 577.932240] binder: BINDER_SET_CONTEXT_MGR already set [ 577.951066] overlayfs: failed to resolve './file1': -2 [ 577.955261] binder: 28825:28840 ioctl c0306201 200002c0 returned -22 [ 577.968587] binder: 28845:28849 ioctl 40046207 0 returned -16 13:30:19 executing program 1: socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)) syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0xe1, 0x400100) creat(&(0x7f00000001c0)='./file0\x00', 0x2) openat$dsp(0xffffffffffffff9c, &(0x7f0000000200)='/dev/dsp\x00', 0x8000, 0x0) syz_open_dev$mouse(&(0x7f0000000240)='/dev/input/mouse#\x00', 0x100, 0x10000) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000007000)={0x8, 0x0, &(0x7f0000000140)=[@acquire], 0x0, 0x0, &(0x7f00000001c0)}) r2 = dup2(r1, r0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000002c0)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x40046304}], 0x0, 0x0, &(0x7f0000000300)}) [ 577.979606] A link change request failed with some changes committed already. Interface bridge_slave_0 may have been left with an inconsistent configuration, please check. [ 577.981407] ntfs: (device loop5): ntfs_fill_super(): Unable to determine device size. 13:30:19 executing program 0: r0 = socket$inet(0x2, 0x4000000803, 0x4) bind$inet(r0, &(0x7f0000000000)={0x2, 0x0, @broadcast}, 0x10) getsockname(r0, &(0x7f00000036c0)=@xdp={0x2c, 0x0, 0x0}, &(0x7f0000000080)=0x80) setsockopt$inet_pktinfo(r0, 0x0, 0x8, &(0x7f0000003780)={r1, @rand_addr, @dev}, 0xc) syz_emit_ethernet(0x4a, &(0x7f0000000240)={@link_local, @empty=[0x0, 0x0, 0x4305], [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x3c, 0x0, 0x0, 0x0, 0x4, 0x0, @empty=0x9000000, @broadcast}, @udp={0x0, 0x0, 0x28}}}}}, &(0x7f0000000380)) [ 578.047219] binder: 28845:28851 Acquire 1 refcount change on invalid ref 0 ret -22 13:30:19 executing program 3: r0 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000240)='/dev/sequencer2\x00', 0x100, 0x0) r1 = openat$null(0xffffffffffffff9c, &(0x7f0000000280)='/dev/null\x00', 0x84000, 0x0) ioctl$KVM_CREATE_DEVICE(r0, 0xc00caee0, &(0x7f00000002c0)={0xfffffffffffffffe, r1}) r2 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000200)='./cgroup\x00', 0x200002, 0x0) r3 = openat$cgroup_int(r2, &(0x7f0000000000)='cpu.weight.nice\x00', 0x2, 0x0) sendfile(r3, r2, 0x0, 0x2) setsockopt$inet6_MRT6_ADD_MFC_PROXY(r2, 0x29, 0xd2, &(0x7f0000000040)={{0xa, 0x4e20, 0x7, @mcast2, 0x20}, {0xa, 0x4e21, 0x2, @local, 0x9}, 0x6e, [0x9b25e4d, 0x6, 0x8, 0x7fffffff, 0x7, 0xd889, 0x9, 0x7000000000000]}, 0x5c) r4 = accept4$inet6(0xffffffffffffffff, &(0x7f00000000c0)={0xa, 0x0, 0x0, @remote}, &(0x7f0000000100)=0x1c, 0x80000) preadv(r2, &(0x7f00000005c0)=[{&(0x7f0000000300)=""/26, 0x1a}, {&(0x7f0000000340)=""/175, 0xaf}, {&(0x7f0000000400)=""/231, 0xe7}, {&(0x7f0000000500)=""/27, 0x1b}, {&(0x7f0000000540)=""/82, 0x52}], 0x5, 0x0) ioctl$sock_SIOCSIFBR(r4, 0x8941, &(0x7f00000001c0)=@get={0x1, &(0x7f0000000140)=""/117, 0x6}) 13:30:19 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000007000)={0x8, 0x0, &(0x7f0000000140)=[@acquire], 0x0, 0x0, &(0x7f00000001c0)}) r2 = dup2(r1, r1) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000002c0)={0x8, 0x0, &(0x7f00000000c0)=[@release], 0x0, 0x0, &(0x7f0000000300)}) 13:30:19 executing program 5: syz_mount_image$btrfs(&(0x7f0000000140)='btrfs\x00', &(0x7f0000000180)='./file0\x00', 0x0, 0x0, &(0x7f00000007c0), 0x0, &(0x7f0000000380)=ANY=[]) syz_mount_image$ntfs(&(0x7f0000000200)='ntfs\x00', &(0x7f0000000080)='./file1\x00', 0x0, 0x30, &(0x7f0000000580), 0x0, &(0x7f0000000680)=ANY=[]) mount$overlay(0x404030, &(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f0000000100)={[{@upperdir={'upperdir', 0x3d, './file0'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@workdir={'workdir', 0x3d, './file1'}, 0x5c}]}) umount2(&(0x7f0000000040)='./file0\x00', 0x880000) 13:30:19 executing program 1: socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)) syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0xe1, 0x400100) creat(&(0x7f00000001c0)='./file0\x00', 0x2) openat$dsp(0xffffffffffffff9c, &(0x7f0000000200)='/dev/dsp\x00', 0x8000, 0x0) syz_open_dev$mouse(&(0x7f0000000240)='/dev/input/mouse#\x00', 0x100, 0x10000) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000007000)={0x8, 0x0, &(0x7f0000000140)=[@acquire], 0x0, 0x0, &(0x7f00000001c0)}) r2 = dup2(r1, r0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000002c0)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x630b}], 0x0, 0x0, &(0x7f0000000300)}) 13:30:19 executing program 4: preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f00000000c0)=""/148, 0x94}], 0x1, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000080)='io\x00') preadv(r0, &(0x7f0000000480), 0x10000000000002a1, 0x0) fcntl$getownex(r0, 0x10, &(0x7f0000000000)) 13:30:19 executing program 0: r0 = socket$inet(0x2, 0x4000000803, 0x4) bind$inet(r0, &(0x7f0000000000)={0x2, 0x0, @broadcast}, 0x10) getsockname(r0, &(0x7f00000036c0)=@xdp={0x2c, 0x0, 0x0}, &(0x7f0000000080)=0x80) setsockopt$inet_pktinfo(r0, 0x0, 0x8, &(0x7f0000003780)={r1, @rand_addr, @dev}, 0xc) syz_emit_ethernet(0x4a, &(0x7f0000000240)={@link_local, @empty=[0x0, 0x0, 0x6000], [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x3c, 0x0, 0x0, 0x0, 0x4, 0x0, @empty=0x9000000, @broadcast}, @udp={0x0, 0x0, 0x28}}}}}, &(0x7f0000000380)) [ 578.267366] binder: BINDER_SET_CONTEXT_MGR already set [ 578.305734] binder: 28878:28879 ioctl 40046207 0 returned -16 [ 578.315572] binder: 28880:28882 ERROR: BC_REGISTER_LOOPER called without request 13:30:19 executing program 3: syz_mount_image$vfat(&(0x7f0000001680)='vfat\x00', &(0x7f0000000100)='./file0\x00', 0x100000000000dfff, 0x1, &(0x7f0000000040)=[{&(0x7f00000016c0)="eb64c86d4f66732e66617400020441000500077008f8", 0x16}], 0x0, &(0x7f0000000140)=ANY=[]) r0 = perf_event_open(&(0x7f0000000040)={0x0, 0x70}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = socket$inet6(0xa, 0x4, 0x0) sync() syz_mount_image$iso9660(&(0x7f0000000200)='iso9660\x00', &(0x7f00000005c0)='./file0\x00', 0x0, 0x0, &(0x7f0000000840), 0x3040800, &(0x7f0000000140)=ANY=[@ANYBLOB="96879ebc96dccaefe5b5b51da7f2b7e2c04e"]) r2 = fcntl$dupfd(r0, 0x406, r0) setsockopt$inet_sctp_SCTP_NODELAY(r2, 0x84, 0x3, &(0x7f0000000380)=0x1, 0x4) perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000001c0)={&(0x7f0000000200), 0xc, &(0x7f0000000080)={&(0x7f0000000100)=@ipv6_deladdr={0x2c, 0x15, 0x101, 0x0, 0x0, {}, [@IFA_LOCAL={0x14}]}, 0x2c}}, 0x1) setsockopt$inet_sctp_SCTP_DISABLE_FRAGMENTS(r2, 0x84, 0x8, &(0x7f0000000300)=0x1e1, 0x4) sched_setaffinity(0x0, 0x8, &(0x7f00000001c0)=0x9) ioctl$KDGETLED(0xffffffffffffffff, 0x4b31, &(0x7f00000003c0)) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x0, 0x0, 0xffffffffffffffff, 0x0) umount2(&(0x7f0000000340)='./file0\x00', 0x0) ioctl$BLKTRACESTOP(r2, 0x1275, 0x0) r3 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000500)='/dev/mixer\x00', 0x0, 0x0) getsockname$packet(r3, &(0x7f00000000c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @link_local}, &(0x7f0000000240)=0x14) getsockopt$inet_sctp_SCTP_DEFAULT_SNDINFO(r3, 0x84, 0x22, &(0x7f0000000400)={0x141b, 0x8, 0x6b, 0x3ff, 0x0}, &(0x7f0000000440)=0x10) socket$inet_udp(0x2, 0x2, 0x0) setsockopt$inet_sctp6_SCTP_DEFAULT_SEND_PARAM(r2, 0x84, 0xa, &(0x7f0000000480)={0x3f, 0x9, 0x4, 0x4, 0xdca5, 0x100, 0x3ff, 0x3f, r5}, 0x20) setsockopt$inet_sctp6_SCTP_AUTOCLOSE(r1, 0x84, 0x4, &(0x7f00000004c0)=0x1000, 0x4) r6 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000580)='IPVS\x00') sendmsg$IPVS_CMD_NEW_DAEMON(r2, &(0x7f0000000680)={&(0x7f0000000540)={0x10, 0x0, 0x0, 0xa000}, 0xc, &(0x7f0000000640)={&(0x7f0000000600)={0x1c, r6, 0x301, 0x70bd25, 0x4, {}, [@IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5, 0x7}]}, 0x1c}, 0x1, 0x0, 0x0, 0x4000004}, 0x8000) ioctl$HCIINQUIRY(r3, 0x800448f0, &(0x7f0000000280)={r4, 0xffff, 0x5, 0x20, 0x3656, 0x5}) ioctl$EVIOCGLED(r3, 0x80404519, &(0x7f0000001700)=""/4096) getpgid(0xffffffffffffffff) lstat(&(0x7f00000008c0)='./file0/file0\x00', &(0x7f0000000d80)) ioctl$sock_inet_SIOCSIFADDR(r3, 0x8916, &(0x7f00000002c0)={'veth1_to_bridge\x00', {0x2, 0x4e24, @remote}}) [ 578.349611] binder: 28880:28882 unknown command 0 [ 578.375024] binder: 28880:28882 ioctl c0306201 200002c0 returned -22 [ 578.400003] ntfs: (device loop5): ntfs_fill_super(): Unable to determine device size. 13:30:19 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = openat$pfkey(0xffffffffffffff9c, &(0x7f0000000140)='/proc/self/net/pfkey\x00', 0x40102, 0x0) setsockopt$inet_udp_encap(r1, 0x11, 0x64, &(0x7f0000000180)=0x6, 0x4) r2 = accept$inet6(0xffffffffffffff9c, &(0x7f0000000040)={0xa, 0x0, 0x0, @local}, &(0x7f0000000080)=0x1c) ioctl$sock_inet_SIOCSIFBRDADDR(r2, 0x891a, &(0x7f0000000100)={'vlan0\x00', {0x2, 0x4e23, @loopback}}) r3 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r4 = dup2(r3, r0) dup3(r3, r3, 0x80000) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f00000002c0)={0x8, 0x0, &(0x7f00000000c0)=[@release], 0x0, 0x0, &(0x7f0000000300)}) [ 578.427924] binder: 28880:28901 ERROR: BC_REGISTER_LOOPER called without request [ 578.458882] binder: 28880:28901 unknown command 0 13:30:19 executing program 4: preadv(0xffffffffffffffff, &(0x7f0000000240)=[{&(0x7f0000000180)=""/148, 0xfffffffffffffe5b}], 0x0, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000080)='io\x00') getsockopt$inet_sctp_SCTP_ASSOCINFO(r0, 0x84, 0x1, &(0x7f0000001540)={0x0, 0x401, 0xe67, 0x1, 0x2, 0x6}, &(0x7f0000001bc0)=0x14) getsockopt$inet_sctp6_SCTP_ENABLE_STREAM_RESET(r0, 0x84, 0x76, &(0x7f0000001c00)={r1, 0x4}, &(0x7f0000001c40)=0x8) preadv(r0, &(0x7f0000000480), 0x10000000000002a1, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000001ec0)={0x0, 0x18, 0xfa00, {0x1, &(0x7f0000001e80)={0xffffffffffffffff}, 0x0, 0x9}}, 0x20) write$RDMA_USER_CM_CMD_QUERY(r0, &(0x7f0000001f00)={0x13, 0x10, 0xfa00, {&(0x7f0000001c80), r2, 0x2}}, 0x18) getsockopt$inet6_IPV6_XFRM_POLICY(r0, 0x29, 0x23, &(0x7f0000001840)={{{@in=@broadcast, @in=@remote, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@local}, 0x0, @in6=@dev}}, &(0x7f0000001940)=0xe8) getsockopt$inet6_IPV6_XFRM_POLICY(r0, 0x29, 0x23, &(0x7f0000001980)={{{@in6=@loopback, @in6=@mcast1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@remote}, 0x0, @in6}}, &(0x7f0000001a80)=0xe8) syz_mount_image$ext4(&(0x7f00000000c0)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x50b5, 0x9, &(0x7f0000001740)=[{&(0x7f0000000140)="58609a27bf0c88455d3b0a23aa5082a62496da7abb8a521bf04baaf928497bbab2733a426de222afad3e7b", 0x2b, 0xffffffffffffff00}, {&(0x7f0000000280)="dfcf4659075f7ecaf41acba09a014d09e2b82e01f2b2730787c6a7b19fedafc2976b3801b9e607220e4fcd6a9812a4d1aa10d22ff22eea028ea98120e76cc365bd3c433df7e12bfdb5cc364ad090dd9023ab32bda60d9396725726348824cc9e92e85f0d16e9abbe99598396c9baba2c6b6ceb720feeed05a1cc83eaf693492cfc5070cddbad70f7108376e486abb99a73d506cd40d02a9f2ad7146e10d4125b1cbb941857d727d670601817478bf80f3072d286f4d9", 0xb6, 0x1ff}, {&(0x7f0000000340)="6cd26af99e9d1b56418ff46b18d5bfc357c7666039ab162d381c0f34736e683e3219cd64a737d5bede86a8fedcd5862722ca9f2a4177a3ed07e7e9079c3164e4347a4a85164358ce99810cf6a89c255ce0e07872e6573ae92a097d", 0x5b, 0x8}, {&(0x7f00000003c0)="3730d61dabe3f0ce0291851e5907850d14f58ddea44d60fa7751b174dbd40f2ac4d6d56a27e6b362b4f35ab8ddfe51844cd6d08b6237a17cdbb029c3928e29485a582609dc2bc13700a9a0d00bd023c247c16fad9e1f8891a62930ac11d3d7bb57d291bf1a9791ede70a3beb3bf8076fa7cf9b9cf86094a31d18f50ccf01973c7ac6a9de576419fa1c488bb175feb778368983906b3a4572bd5fbdfad7f27050302715ed0d73d236bda58ff53c6e7020aa8be520553cfcad78e1b7307ab80620906729739a5753ecd46a096eb04db180c4f9c9a8ab00474f97bba62b337ad7c623e79aa90c61e742f7666024a168c8eec6e0c7c6162ef5ee5291f8e4377c92228d6f9b7e86076f9535d5e8691cfdacbe25956be14055347374272760991591d829044037d7cd97dbb529c5ebb648b731d9721551812bb509031502bd8794de21cba5de30092c2cbb487c4a2a119b71e2775b4ad97ce3b288dfb2498d80ce688efa487b56b4c02ed75f10c14351e37de78d87c5c0a91c253a6e08f2a8afa1b543b2e4c67dc8f61661d968e886ea5f24436e386db771edd7702051d1b07e1491a0d843a06d3c29d39ef6542878b5035ddc3ca33704da12149eb9a89b233e686bc090776692904d4d7f245c6762e9142cdc275ea8f99d39812b01427bde800b6a6d15dd51a0cf8271a868af03312342aa4998aadc749920963c962188b5800e3b32e8647de31c57bee95a6b67b8a78f43f982c61bb2acbe237ecaa94351a74f167922cccc409f1fdcdd7251fcae88bbdf31026a7be425dfb480e3515b29d0ebc302b7f0b66e201aacc100abb1271a68745693b1fd18193435a943177289c9477ba8124d78f6bd6db2b51965d0a29506db7d8387261fa315bba52910859d18600e42be63f2eca65d7fda2dc8c1d0a70025021a826f29b56972f212032b7b1513a77e9b954149e33325d71ac121dc80a1d6d96147f13e8cc4bb79c827003a4b8cbeb5aecd63519c6bfffca9f594d71b45d8128f2c145ef325f06a971a6836638151a6a3d13c005eb7339e748cf4f1dd3884a1f7986ebcdb15f42e0725aadb239393db71ae97e9e76b5754e22516c424f02ee6becd84d220180536cb119be171aeafd361ac3ab50affabf7e9d317f49e59cfdb73ec757841e76e7399187c30285f8103199d1388460c22ace74376fc9298d989e27eb6cc9d1509ff52f88fe9a4ac8a02c62e2f841f89c96b7f2c808f867505a03e7d2eb94cf1e026dd41c56ab727de0481c4bffeec3af170cfeefc3be6cf91e7b5d3b573185b6682ef2f8549648521f1a8f8b27955e125bb6e5c2d3d1786f51fdae66fbe2d96bb0489634fa2aae930d122dd9da6ffba9b1a8a8a6b511ec9744b3c738d0d6ec2a56e049b9d4378d1898af656aadc540986cad380a1529688c4c0df1088aded352854ef453c72066ed85ce59706aae6aeb3eb82309d5fde806fcf7ea9b371fcfc0910fd7e48552d8fb1bf5d246015206d982a93337485f69d8bd73109a6d8ef8c2bac3a65b2980009c6e5b8c48c45fab290d6239c4a9f72d3a91aadf512aca9dc49b8cd6ff9f60acecbc1ed5f62d2245cff636ab9b03778e7a50dc9e2e1dc4243089414c27d27de9def286c0abeced828cf5277daef4d259759e16ffda8e5dea1bbd4c12a18cd26a9d148d76b42d58ec51c662ea1579fb1d9dcb4a3a611ccad8b8b68d2e1e6f784922f076c53dc2d2bdf4bd46a5a06e4a88667b35949fd41bbba60c52b0f2883b22c0c32af2f60336aee9cd336c56c45449ed4a30d667f5f46c7fb99cdfefbb6663e076055215a6ce0130d42151122bd14dc483aa4d6d6926ea2287c13836be9ec9d351e9ce2fb50ddfcf8b3059155649b06a140ec7283533a10d73044fc69d80747442fa86e09058f222a9f382e568fd184abbe7d2681685aefe098fccd786d3306ae1ac945dffa1700312cdee4341ee739b4898f723282eb2992ca75069b21e628bb06ba0397ebdbed3bf2672cb71c81ae796314e283ffb6469c686bf40a18aca79b727e8386eef1004da2183727aa650033b4c78e37dfeb98c46f5fbd8afc4c3cdba2e3d32a315577f60a9552706c6c8a326e849b0c291e0c0629152fc4bd0c878be8771947e97bac2b2fb4284b0f534414c10664a2798fd0718c03bc0ed0ca668f7c9cbfdfd5416b826af6fb3c133d5b5de146c5df87029b1897a665b3cda744ae6a17427dd64d0abcb3067fd489b260e972922aef6a12836afd4ea3d5ce3525909897964fd85dc0dbaab0e64f0060cc08233f301bf73ab77719e474a15cfea9e1905584d067160edb63c89a2c56eea3d52dc37cb7dcf621102faa273a62ad98f812aef08752ef845426fde98c92be72ffed1060db8678069a755719c4b72548933128a1287db1461cbf05b5937deb55c24967912f2fcb3bb91b12122e317931c1201429605b3beafc2f290ff502e3f249a484c5af6d745e0b0bcd127a4e0a5cb29f794369e451ee5f7e03047dea556568fbe620fe268a3781ec59ccf571b9258deb2d483a313fac379f2d5b5cc0a9a71b3222ad8c8d60cdd4554bdcf2c0a66d62ca3423f20b674e7082f1ac495c530ef708b315833991adcfe8c32f0387b5be9298a2f35e5958af56a1c3bae8196c0ac89efe16f695a0585aa8a9ac9cb53e672c5d45999dfc0b48fa8d2a0631b63946e485672c163e0a3f8aeee6338318f324c2720fbfcd94d8efd416c0008bd6684fd9e4843143c163c7b4992267c193da02a1a75b1a656aa9a2a5d2a4aea9963bd1061158a909826c91de198c7d23c7839a708b8e468b472ffd6797ff4630166b2dba519346ac4c85ceb57135c531dc2b9ff903a81cb18a5baf507337842efbfc83bfc682fc421f2bee56ca720e1c2a92f0d7e77e6c0ff027d8d9992480775a71ecd95479642825c9041b965db757a9fc854aff054ddfe20457d769a7bb495f4ad8dbe765414c11176e7785b2b66a56e3dff76f21fbfeffe5bcdc83100e3e56cbc98098fc456ced2aca3b5a5ed28bb37ffb86655ddeeb380123c250a3e5c0d9109c49732324219f9823dfa1f2ded3d8fae8b0fcc7e4036349c6f2916ebbbd3678dc97549cfe29df1743ed23b995cec1fbf9e7707bd409a0823e72657f7168225fe226e0d87712a02221bb8a46460ba73f1d615c9528111f9147f4a7b3b9d3116a59c7340745238269402c11be3aa8ddaf643f68411a999cd1daf4b35bc157ef4e2a8c096483a32991f525a88cfc3b544490b5e867aa79f36548ad5c7f068b088054393f78ad9bdb2be0f3ecab53b2f08c330dee7edac06310c53345a653ba3a9b462acfc4b4ba53400f62a57b220a53bbfc78542ace269eff77ec7b8a2fa1c0bb4bdadd8f2021893666a93650057ff77c58b5ade03676ab99626a68b5ba92355b9a2ea913ea6b4c05d5780e2c96a6664772667e97153089ed08a6d14d3c3a27e6f2f064114b1e941118aeb5c1714272f50b753947fa58818f6ee5b1dea2af3acbc397e587726aaaf9dce71c121c26a6898c406b7a75731de91caee69078fc44ed24a2c989ac671b5e1c36dbda36d2c7362ccbd7f3d4dafc713e56ed114a10112d8849c49a85dcfd638573171b1c5531f2efd2e724caee4dcb37c7ca56369277254aa10d91702de68544613ad9a2cd0fa2f1dfc88604f5cbd89278f332db691d1d4684a0352b274632c637690ad72fe5da9449d2eb763f150391829a2aa91e07d77bc3fa516cee518c55415f8aa75a33b0933358499e1049621000ceb6c760f1e356ad2f12095b40afb5f8c7200c638fbaa59934f6f2cc6fa4dd3f20c975f5f13f225acbbfe42648f7658e5887b8921d06de61125f104a0350ee9cbfc3ffc80d3c75a3717eb4e8834ccbc8438369562e365229f5c472aa6bcdbc2c8a02d2f63642d3ff63909c150b41c8bda1c46451f62c9e206aae8c10b1e251aea496976c4ba4cd8168d61cb4f23f5f611083df0c0b0a14f9c498a4255f3bd6ebf388833eb41318d0ab5e366b106e87c10e1061ddd29487a73736a390be2e7aeb14f3adb438686926e70ea9865f0b05a4372ddbb919825dafc5bbcec7f8212779922b62c67e0f669eae558f9fd00a29390f9665fe62978c632ba5ca60539a3ab1c16515afdb87ead2ac06e5793c2956fcab2169b8ec24f0442c0ad36c6c06e3fb9f1bda47ffd5e5745ee8b0460c7f0782ba42d4c9b0eeb7778499e58225bfe4e1188828784e69e0bbf132819a806afa24ecc543f64466f22384a8f55f82e5b6347dfe169eb1c965fb3cdf2fbfb04145ca5920a8383da9a8519678c0260314e8990bddff8b37e91d0231b5cc2021c991066f15d80a62561907c8632e9e446025103fb2321ad7cfa1fa8036024e1f3b22f2fd0faf2ac84053834b20d254542d1d6e52860ca6cbf6375030e39ebfefda6455c64bc575eb6433411abce8a5f89d62f2b5823eece6a2cb21494a97cc2b7e943e95af8093b96de24ec27844dc6b08d2f3904529dd23ad399af59cd2b1e697fb748b64332552cc66b359b0fcb052cea24a2f878b87d533a991795732199f323e4c06764bbf21931fb760d428c5499d02a1ac6460dba02cb1b2c8f187370f7b00436bc0e35c29e29d39059043cafc916ac8dbb42534da9a1321358d04350f37de7e548a62a659566399f12fab9f638d806694ce159a775f0374117a9e081d68a24021c4701d91154b2f6142ffd0710f6650c96edee647d7fa8b857d4bb1ea0f296994a909615129f896bef3e16e1bdb68adf5cf05e66d9c40b613e836de961debbe33b6d703d36917a2febcf34fa1408809eb5eb71019b8e69c173671dbe557ff7275958e49f7fb9b8fb9ed70f607016988c719ed35a6d13e8dadf9e4544af3c9e004f123fb71aa5571d0992c90df6083106738196b8dbcf24dc102365bbc5772d9780b41a40932e26f4c481e2b3ac6acd077683dc9cf8732cd0def74f9d073d711381262c3732d90dd579351dbd2492dc2a88170bee314b5493feb0a7ff4538e16ea446c1259cbdf3f2c08fa703cf2337d992ed1617b3ecbc181a175b81f6a0f3aa96897c6882fd7880df7fdc4c8014abac94a3dbf8772d13c62e3dc803a6c3453150c65224c39fb7f347adccd97a143a768ab47ba2ab6253575eeb391af61a5c1ce9e08428f16edd72fd40e39f27eb6f79c32410fecf06b4857cadd15193346f71fc4681a6733c0afff45d5b53b0a683f24a8b0651898f61cc6bc3c90322af467977743b676fa5589ae7f4d388268621b671098eef2a9fb85546e581c6b44b6495b2dad04d0c0fd0c0aaaa72ef81e4a285bb6f72846d4532cb9e3144aa9cf05417ff8fbf637b1d5f44651cbe001a267675761ef8671adc785792a443873cdbeb926dba6c28b4ac70ef93b9c5d4e969dbd9e75cb4246025c58975e229aa37a3f39f3e4edf3f59bf52b96aa67bf56210cbc9f0a4438f33ae29f79952f0c40c945b67bada666a124abd6cda6aed912a5340f083b413fbd605b310c38b0ec05751f9731ca52a1118e4f1664218d161e2fc83990e43880a2938aff51cedd2ba294bfd8bb0d4fd3253720cd8b579b4e257f831066fdaaaff261be452c4af7c0c46574fde82e09018f112eb410a82a586b9bd8ea379d5db152b6b06872e45ee4566d2695d23e136b57094bf94248bdf95cf34da2a7133ec7bdb65c14437b858c86f890bfbee9ffee24e2640d1a2ada1c4c1357cd5a6d2ea2c7753e83ee2aa516d4cb836b597b5d6131c61e971ea5ba2498f6de25f13f47347e7d9889102f9658b4c17015c8e01ad5752871a8a0", 0x1000, 0x3}, {&(0x7f00000013c0)="a130aebc7b2768031b0ba338322d3344ce02cdb76583173933cb7101566e8bed38eb6b897a566debc1d826a22ca0bc1e53744e9a0a9ca0873a07a9ecde38f2b9c6032ccddfdd4fd1b8dad9ac812e6a71a228abc1af791c98f74f92a52dec4f8922f9ccd646f67482b167d8d5ba59d3991dcb1ff7e9ede0f3bf09188f61080cdca930e934b7b446a4a3c339d9ba115ca6883fdfecc7408de03c801d50620c64c3c7144eff5cc352a3c41f5ed72da3eb6c66102da5fa7d65", 0xb7, 0xe8}, {&(0x7f0000001480)="676e4f18871afe2ac957ba0d47417bef449e24a49c1cffec023c63277f36e6ea7bf1694f0b2c4b730677c226684f3f39539f4417f57b8aa234b85e8f77fee9cbcbc00860a9c9552b8cb400342d6690caaf9d27e56e511caf54e7eca4db99948aa6be883f642c0990647803e4cf1427b2c9dfadf6d4426466265e357439c95d5b941fb7949d67f537e65ca24c661d71e69eb4f62268d508e67b20992fce8deb097be6609efb9219962d265cd36e72a3ca36c85f6dfb", 0xb5, 0x80}, {&(0x7f0000001540), 0x0, 0xfffffffeffffffff}, {&(0x7f0000001580)="2b6ff51d0480a03ea6fbd1fbc206cbabc530da5808824bed8bc0c082805240dfae1aabbfe522e520d017e773377c91ddfa5f6e8357b0b4516911c01f06b9c292a651d9f5270cec20e4716fdf2ab5cf0fd2f4af26a81f2bb28ca150775b4d8571d16020b995a5cbb8298f5cc15956268ebbc4711e19b6f1e74d916701ce5290ce1dba44e48708bea7b5cbaf2d430dd6705666d14d488433eb37dd3fee5aadd40bdafafdc06f5e04ed060420ba0583c427361e9c9cdaad3a19f210132c746ccc7596bcb6ea36a9de263baef42cbd0f0f95ee71ba039bb1d413164c70724ad1d823f11e59cc5d01d2ba0c499dc521", 0xed}, {&(0x7f0000001680)="41fa60dbb6a152dac468dd8f194f026d8a380ebc5023f9167af8cc58f5d45cd356f63a6642d3c8b1d812d783859edd5b8773f3ed15368170fc9cea372e41bfd9ab35ab07199cee2e6aabff4245d33529dc2a4ad11d8909a90ce7ac829bbfe03afe33e89550cda52694715a72d20ccd693704c6b3f26c8e18b8e82dc2f1eeb182c6fa6993cd778fb985abf9eaad199b9ec2052358f77a37627e33aeeae74e7cdcd3bebe261605e436474238a0c71173188ec3", 0xb2, 0x2}], 0x202000, &(0x7f0000001ac0)={[{@data_ordered='data=ordered'}, {@noload='noload'}, {@max_batch_time={'max_batch_time', 0x3d, 0x4}}, {@noblock_validity='noblock_validity'}, {@abort='abort'}], [{@hash='hash'}, {@obj_type={'obj_type', 0x3d, "76626f786e6574316d696d655f74797065757365722e6e6f646576e7f525"}}, {@smackfshat={'smackfshat', 0x3d, 'io\x00'}}, {@obj_type={'obj_type', 0x3d, 'cgroupbdev'}}, {@uid_lt={'uid<', r3}}, {@appraise='appraise'}, {@fowner_gt={'fowner>', r4}}, {@dont_hash='dont_hash'}, {@subj_user={'subj_user', 0x3d, 'io\x00'}}]}) ioctl$KVM_SET_DEBUGREGS(r0, 0x4080aea2, &(0x7f0000000000)={[0x4000, 0x3000, 0x4, 0x1000], 0x3, 0xa, 0x1}) 13:30:19 executing program 0: r0 = socket$inet(0x2, 0x4000000803, 0x4) bind$inet(r0, &(0x7f0000000000)={0x2, 0x0, @broadcast}, 0x10) getsockname(r0, &(0x7f00000036c0)=@xdp={0x2c, 0x0, 0x0}, &(0x7f0000000080)=0x80) setsockopt$inet_pktinfo(r0, 0x0, 0x8, &(0x7f0000003780)={r1, @rand_addr, @dev}, 0xc) syz_emit_ethernet(0x4a, &(0x7f0000000240)={@link_local, @empty=[0x0, 0x0, 0xe000000000000000], [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x3c, 0x0, 0x0, 0x0, 0x4, 0x0, @empty=0x9000000, @broadcast}, @udp={0x0, 0x0, 0x28}}}}}, &(0x7f0000000380)) [ 578.483896] binder: 28880:28901 ioctl c0306201 200002c0 returned -22 [ 578.551828] overlayfs: filesystem on './file0' not supported as upperdir 13:30:19 executing program 1: socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)) syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0xe1, 0x400100) creat(&(0x7f00000001c0)='./file0\x00', 0x2) openat$dsp(0xffffffffffffff9c, &(0x7f0000000200)='/dev/dsp\x00', 0x8000, 0x0) syz_open_dev$mouse(&(0x7f0000000240)='/dev/input/mouse#\x00', 0x100, 0x10000) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000007000)={0x8, 0x0, &(0x7f0000000140)=[@acquire], 0x0, 0x0, &(0x7f00000001c0)}) r2 = dup2(r1, r0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000002c0)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x40046306, 0x100000000000000}], 0x0, 0x0, &(0x7f0000000300)}) 13:30:20 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000007000)={0x8, 0x0, &(0x7f0000000140)=[@acquire], 0x0, 0x0, &(0x7f00000001c0)}) r2 = dup2(r0, r0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000002c0)={0x8, 0x0, &(0x7f00000000c0)=[@release], 0x0, 0x0, &(0x7f0000000300)}) 13:30:20 executing program 5: syz_mount_image$btrfs(&(0x7f0000000140)='btrfs\x00', &(0x7f0000000180)='./file0\x00', 0x0, 0x0, &(0x7f00000007c0), 0x0, &(0x7f0000000380)=ANY=[]) syz_mount_image$ntfs(&(0x7f0000000200)='ntfs\x00', &(0x7f0000000080)='./file1\x00', 0x0, 0x30, &(0x7f0000000580), 0x0, &(0x7f0000000680)=ANY=[]) mount$overlay(0x404030, &(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f0000000100)={[{@upperdir={'upperdir', 0x3d, './file0'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@workdir={'workdir', 0x3d, './file1'}, 0x5c}]}) umount2(&(0x7f0000000040)='./file0\x00', 0x10000000000000) 13:30:20 executing program 0: r0 = socket$inet(0x2, 0x4000000803, 0x4) bind$inet(r0, &(0x7f0000000000)={0x2, 0x0, @broadcast}, 0x10) getsockname(r0, &(0x7f00000036c0)=@xdp={0x2c, 0x0, 0x0}, &(0x7f0000000080)=0x80) setsockopt$inet_pktinfo(r0, 0x0, 0x8, &(0x7f0000003780)={r1, @rand_addr, @dev}, 0xc) syz_emit_ethernet(0x4a, &(0x7f0000000240)={@link_local, @empty=[0x0, 0x0, 0xf401000000000000], [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x3c, 0x0, 0x0, 0x0, 0x4, 0x0, @empty=0x9000000, @broadcast}, @udp={0x0, 0x0, 0x28}}}}}, &(0x7f0000000380)) [ 578.830736] binder: BINDER_SET_CONTEXT_MGR already set 13:30:20 executing program 4: preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f00000000c0)=""/148, 0x94}], 0x1, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000080)='io\x00') preadv(r0, &(0x7f0000000480), 0x10000000000002a1, 0x0) getsockopt$inet_sctp6_SCTP_PRIMARY_ADDR(r0, 0x84, 0x6, &(0x7f00000003c0)={0x0, @in={{0x2, 0x4e23, @multicast1}}}, &(0x7f0000000380)=0x84) getsockopt$inet_sctp_SCTP_DEFAULT_SNDINFO(r0, 0x84, 0x22, &(0x7f0000000300)={0xfffffffffffffff8, 0x5, 0x4ee, 0x6, r1}, &(0x7f0000000340)=0x10) sendmsg$nl_route(r0, &(0x7f00000001c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x2004100}, 0xc, &(0x7f0000000180)={&(0x7f0000000040)=@getneigh={0x14, 0x1e, 0x400, 0x70bd2b, 0x25dfdbfd, {}, [""]}, 0x14}, 0x1, 0x0, 0x0, 0x4}, 0x840) 13:30:20 executing program 1: socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)) syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0xe1, 0x400100) creat(&(0x7f00000001c0)='./file0\x00', 0x2) openat$dsp(0xffffffffffffff9c, &(0x7f0000000200)='/dev/dsp\x00', 0x8000, 0x0) syz_open_dev$mouse(&(0x7f0000000240)='/dev/input/mouse#\x00', 0x100, 0x10000) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000007000)={0x8, 0x0, &(0x7f0000000140)=[@acquire], 0x0, 0x0, &(0x7f00000001c0)}) r2 = dup2(r1, r0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000002c0)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x40046306, 0x3f00000000000000}], 0x0, 0x0, &(0x7f0000000300)}) 13:30:20 executing program 3: ioctl$ASHMEM_SET_NAME(0xffffffffffffffff, 0x41007701, &(0x7f00000001c0)='/dev/usbmon#\x00') r0 = socket$inet6_udp(0xa, 0x2, 0x0) r1 = openat$ppp(0xffffffffffffff9c, &(0x7f00000004c0)='/dev/ppp\x00', 0x200000, 0x0) ioctl$TCXONC(r1, 0x540a, 0xfffffffffffffffc) r2 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) connect$inet6(r0, &(0x7f00000000c0)={0xa, 0x0, 0x0, @dev, 0x4}, 0x1c) r3 = socket$l2tp(0x18, 0x1, 0x1) openat$cgroup_type(0xffffffffffffffff, &(0x7f0000000080)='cgroup.type\x00', 0x2, 0x0) connect$l2tp(r3, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) sendmmsg(r0, &(0x7f0000005fc0), 0x8000000000000fc, 0x0) accept4$vsock_stream(r1, &(0x7f0000000240)={0x28, 0x0, 0x2711, @reserved}, 0x10, 0x80800) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) add_key(&(0x7f0000000200)='rxrpc\x00', &(0x7f00000002c0), &(0x7f0000000300), 0x0, 0x0) r4 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080)='/dev/nullb0\x00', 0x4000000004002, 0x0) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(0xffffffffffffffff, 0x6, 0x16, &(0x7f00000002c0), 0x0) connect$l2tp(0xffffffffffffffff, &(0x7f0000000040)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x4e22, @broadcast}, 0x4}}, 0x2e) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x200000e, 0x10, r4, 0x0) setsockopt$bt_BT_FLUSHABLE(0xffffffffffffffff, 0x112, 0x8, &(0x7f0000000340)=0x105, 0x4) ioctl$KVM_GET_REG_LIST(0xffffffffffffffff, 0xc008aeb0, &(0x7f0000000100)=ANY=[@ANYBLOB="d8023337b03f32e9073401141ac8a6ef92d71fcf43d4a8a5d03dd332c643c1960801c7c43fc42098f93d50c4e8648bd5107bbe9f74"]) write$binfmt_misc(r4, &(0x7f0000000440)={'syz1'}, 0x1200e) ioctl$KDGETMODE(0xffffffffffffffff, 0x4b3b, &(0x7f0000000140)) getsockopt$sock_cred(r1, 0x1, 0x11, &(0x7f0000000300), &(0x7f0000000400)=0xc) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f00000017c0)={0xffffffffffffffff, r2, 0x0, 0x8, &(0x7f0000001780)='wlan0{}\x00'}, 0x30) getresuid(&(0x7f0000001800), &(0x7f0000001840), &(0x7f0000001880)) getgroups(0x4, &(0x7f00000018c0)=[0xee01, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]) fcntl$getown(r3, 0x9) getsockopt$inet_IP_XFRM_POLICY(r1, 0x0, 0x11, &(0x7f0000001900)={{{@in6=@remote, @in6=@mcast2}}, {{@in=@multicast1}, 0x0, @in=@multicast1}}, &(0x7f0000001a00)=0xe8) fstat(r0, &(0x7f0000001a40)) getsockopt$inet6_IPV6_XFRM_POLICY(r1, 0x29, 0x23, &(0x7f0000001e80)={{{@in6=@loopback, @in6=@ipv4={[], [], @multicast2}}}, {{@in6=@loopback}, 0x0, @in=@dev}}, &(0x7f0000001f80)=0xe8) sendmmsg$unix(r0, &(0x7f0000003c40)=[{&(0x7f0000003ac0)=@file={0x1, './file0\x00'}, 0x6e, &(0x7f0000003c00)=[{&(0x7f0000003b40)="2cf8fee54469fc14977e5894c1bfeaa2655ce61824efda9820e632177cb3a6fc38d8ce68e9dc7b133e478306ef13774ae5eb841468a26418bd6330218f981997182c101a80eed03509286b94a86cb2b60fb4f4f905cbedee275c0280235f13c06b40ab5d4e43d6c38cb22a153ee7b4110e9f073e7b6d61abd353499a99f4827607c8d11787305c56d107f8e14d30487325c5ae3bfccb980b6e307d036814ffd0fd5a58eaa8af2422c3dd63ae80", 0xad}], 0x1, 0x0, 0x0, 0x4041}], 0x1, 0x24000000) 13:30:20 executing program 0: r0 = socket$inet(0x2, 0x4000000803, 0x4) bind$inet(r0, &(0x7f0000000000)={0x2, 0x0, @broadcast}, 0x10) getsockname(r0, &(0x7f00000036c0)=@xdp={0x2c, 0x0, 0x0}, &(0x7f0000000080)=0x80) setsockopt$inet_pktinfo(r0, 0x0, 0x8, &(0x7f0000003780)={r1, @rand_addr, @dev}, 0xc) syz_emit_ethernet(0x4a, &(0x7f0000000240)={@link_local, @empty=[0x0, 0x0, 0x3c000000], [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x3c, 0x0, 0x0, 0x0, 0x4, 0x0, @empty=0x9000000, @broadcast}, @udp={0x0, 0x0, 0x28}}}}}, &(0x7f0000000380)) [ 578.926332] binder: 28940:28942 ioctl 40046207 0 returned -16 [ 578.945866] overlayfs: failed to resolve './file1': -2 13:30:20 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x802) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000007000)={0x8, 0x0, &(0x7f0000000140)=[@acquire], 0x0, 0x0, &(0x7f00000001c0)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x78, 0x0, &(0x7f0000000180)=[@request_death={0x400c630e, 0x3, 0x2}, @decrefs, @enter_looper, @transaction_sg={0x40486311, {{0x3, 0x0, 0x3, 0x0, 0xa6956c4f94aa57a2, 0x0, 0x0, 0x0, 0x10, &(0x7f0000000080), &(0x7f0000000100)=[0x18, 0x78]}, 0x1}}, @clear_death={0x400c630f, 0x0, 0x1}], 0x2a, 0x0, &(0x7f0000000200)="fb8f3e5f19e0f5fd762744bd5d9197d28b1747fc89a0950a5d0b433ff76bb02681d5c7348678590f93a8"}) r2 = dup2(r1, r0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000002c0)={0x8, 0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00'], 0x0, 0x0, &(0x7f0000000300)}) [ 579.022321] ntfs: (device loop5): ntfs_fill_super(): Unable to determine device size. 13:30:20 executing program 1: socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)) syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0xe1, 0x400100) creat(&(0x7f00000001c0)='./file0\x00', 0x2) openat$dsp(0xffffffffffffff9c, &(0x7f0000000200)='/dev/dsp\x00', 0x8000, 0x0) syz_open_dev$mouse(&(0x7f0000000240)='/dev/input/mouse#\x00', 0x100, 0x10000) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000007000)={0x8, 0x0, &(0x7f0000000140)=[@acquire], 0x0, 0x0, &(0x7f00000001c0)}) r2 = dup2(r1, r0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000002c0)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x40046306, 0xfdfdffff00000000}], 0x0, 0x0, &(0x7f0000000300)}) 13:30:20 executing program 0: r0 = socket$inet(0x2, 0x4000000803, 0x4) bind$inet(r0, &(0x7f0000000000)={0x2, 0x0, @broadcast}, 0x10) getsockname(r0, &(0x7f00000036c0)=@xdp={0x2c, 0x0, 0x0}, &(0x7f0000000080)=0x80) setsockopt$inet_pktinfo(r0, 0x0, 0x8, &(0x7f0000003780)={r1, @rand_addr, @dev}, 0xc) syz_emit_ethernet(0x4a, &(0x7f0000000240)={@link_local, @empty=[0x0, 0x0, 0xb00000000000000], [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x3c, 0x0, 0x0, 0x0, 0x4, 0x0, @empty=0x9000000, @broadcast}, @udp={0x0, 0x0, 0x28}}}}}, &(0x7f0000000380)) 13:30:20 executing program 4: preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f00000000c0)=""/148, 0x94}], 0x1, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000080)='io\x00') preadv(r0, &(0x7f0000000480), 0x10000000000002a1, 0x0) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f00000001c0)={0xffffffffffffffff, r0, 0x0, 0x3, &(0x7f0000000180)='io\x00'}, 0x30) syz_emit_ethernet(0x437, &(0x7f00008bbfba)={@broadcast, @link_local, [], {@ipv6={0x86dd, {0x0, 0x6, "06f526", 0x401, 0x11, 0x0, @remote={0xfe, 0x80, [], 0xffffffffffffffff}, @mcast2, {[], @dccp={{0x0, 0x2, 0x4, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, "24a589", 0x0, '~9\f'}, "c45602f6ed79060cf38468cf6a0efffdc04001da35723ccb2e65d7372ab1ebbae56832e30eb7a55177fb28a6cc9a907686482040a5065a164b628de684dbd0379e0d6e6e97082ee0193e41d1b47dbfbdacce29c4cc968fab6a0f988f8b2bbbdf5ef3e9c2af7f2c29c7b25264de3c70ddb3161aca907778bf614b3f3d6d291b04870eb41fdc37879d9ca43a5b14586181714873c5bc29cbc1b75bcff927594c2cb1003c354b71de02dd1b856c979831536e9841d66c1986427e2f571a2682250b67bcfa4b3c63f4b98bcc86fd26429eb10972d9bcadc8f960768c3a6f68659c45d84cb63a1de86d4503bf9aea30e6e8eaf9c3a0935e2bee69a5b0859d74c20e14065dc493d28cf1158825d181433e70744131522b4f63e5b7438427745e1b33bbbbd4614565676e50196d336d5f257e3ccb9a0e2e255679e6f790bd72a5469aaea3063a93591eb9ba512b94471168d4fbe4a27d4dead85d59a33e17b6f718fc8e11b9f65714a68956233a24b3fa216cf7fe950ceb26994ffbb2f8a99fdb5b52205630ffeeb5fb2e7d4b01b4ec497171d518d5a97007c8a325aa3ee1bba422071328a926c55bbcfd6e9f16e9ad6eea82cdd29905915b500bf47d4890e4660859ffea905cc82ad938ae6ac2cafd4d51db78507f3de12caf2e3bcbe5aa7f7f1e7a651f62d0959aa3cf21904632a092c7080c6297a9da859a54360576c7f414f7f228d6a02f58e7fdd751809c68a00d7e7734b99833ad4b3b7134df7b8d29606b022b86d4f7c5825f7bc16019dde2bd47a2e1891db9d92beea35ef24133a7793603385184cf2a2cc2bfec493644f136556b3f3786c621c8d82678d18baacd54c48c9852e6986bc7f0e451de0b0d82c5f616bdcf12942bca5172b7bcfb714f65e6dc516031791aa3ccebc6f6db9f76396cd2d9697670a4f40f1279e0d9e838c71aa810e28744407936a9bd64ec0f953864dfb3e2526df25beb67687d37a574d92ac9e0c0bc5cb411887ad2a6cfad6f20d7e50d15045bed3fa3999af9aaff372669556387059e1a19b44dcae00640bfd7e09fecad93278cbf6664877c5f4059f9dff3ba0d9ecdf44b649d32528ae25e8c454b61c118779b716e405681d8b68f22338adff1b3e370103ff5fd006679b36cff1c0c9d5f90a48d7cc0f24e9b894647598d7a2d3f57d7c29934a61e8c2b638d6220fdfcf1182d561b2c649dcfd4b8b34469729dfc1a98adb9eeaf9da30ced0cc538cdcaa512e8ceaca828d606806c9df8b2d1913058f99339a18b24ef69d174e422a7ec6e5f9e711cb2e257b34e44bcd41a75dfa309cac2aec963a57420f9a09b168cb360d42e18d6904cfb7ca306ae34f3f06dd8a98299e4428ba2a2eba0964522c776cca8824e60832dcb4f6f89ca73f83b3e14f210e86d20e49bad9649a8983e6d38"}}}}}}, &(0x7f0000775000)) perf_event_open(&(0x7f0000000000)={0x0, 0x70, 0x8, 0x7f, 0x0, 0x497, 0x0, 0x1, 0x46800, 0xb, 0x9, 0x5, 0xbd, 0x0, 0x8, 0x7ff, 0xc000000000000000, 0x3, 0xffffffffffffff7e, 0x2, 0xe2, 0xfffffffffffffffd, 0x9, 0x101, 0x3, 0x400, 0x4, 0x8, 0x6000000000, 0xfffffffffffffffa, 0x200, 0x0, 0x1ff, 0x7, 0x4, 0x0, 0xc7, 0x5, 0x0, 0x7a6, 0x0, @perf_config_ext={0x6, 0x5}, 0x1, 0x3f7, 0x8000, 0x5, 0x39, 0x3, 0x2609}, r1, 0x10, r0, 0x2) [ 579.128827] binder: 28972:28974 BC_REQUEST_DEATH_NOTIFICATION invalid ref 3 [ 579.171744] binder: 28972:28974 got transaction to invalid handle [ 579.178536] binder: 28972:28980 unknown command 0 13:30:20 executing program 5: syz_mount_image$btrfs(&(0x7f0000000140)='btrfs\x00', &(0x7f0000000180)='./file0\x00', 0x0, 0x0, &(0x7f00000007c0), 0x0, &(0x7f0000000380)=ANY=[]) syz_mount_image$ntfs(&(0x7f0000000200)='ntfs\x00', &(0x7f0000000080)='./file1\x00', 0x0, 0x30, &(0x7f0000000580), 0x0, &(0x7f0000000680)=ANY=[]) mount$overlay(0x404030, &(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f0000000100)={[{@upperdir={'upperdir', 0x3d, './file0'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@workdir={'workdir', 0x3d, './file1'}, 0x5c}]}) umount2(&(0x7f0000000040)='./file0\x00', 0xfbffffff00000000) [ 579.216095] binder: 28972:28974 transaction failed 29201/-22, size 0-16 line 2834 [ 579.285756] binder: undelivered TRANSACTION_ERROR: 29201 [ 579.294396] binder: 28972:28980 ioctl c0306201 200002c0 returned -22 [ 579.327150] binder: 28972:28974 BC_REQUEST_DEATH_NOTIFICATION invalid ref 3 [ 579.364543] binder: 28972:28974 got transaction to invalid handle 13:30:20 executing program 1: socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)) syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0xe1, 0x400100) creat(&(0x7f00000001c0)='./file0\x00', 0x2) openat$dsp(0xffffffffffffff9c, &(0x7f0000000200)='/dev/dsp\x00', 0x8000, 0x0) syz_open_dev$mouse(&(0x7f0000000240)='/dev/input/mouse#\x00', 0x100, 0x10000) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000007000)={0x8, 0x0, &(0x7f0000000140)=[@acquire], 0x0, 0x0, &(0x7f00000001c0)}) r2 = dup2(r1, r0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000002c0)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x40046306, 0x1000000}], 0x0, 0x0, &(0x7f0000000300)}) 13:30:20 executing program 0: r0 = socket$inet(0x2, 0x4000000803, 0x4) bind$inet(r0, &(0x7f0000000000)={0x2, 0x0, @broadcast}, 0x10) getsockname(r0, &(0x7f00000036c0)=@xdp={0x2c, 0x0, 0x0}, &(0x7f0000000080)=0x80) setsockopt$inet_pktinfo(r0, 0x0, 0x8, &(0x7f0000003780)={r1, @rand_addr, @dev}, 0xc) syz_emit_ethernet(0x4a, &(0x7f0000000240)={@link_local, @empty=[0x0, 0x0, 0x4305000000000000], [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x3c, 0x0, 0x0, 0x0, 0x4, 0x0, @empty=0x9000000, @broadcast}, @udp={0x0, 0x0, 0x28}}}}}, &(0x7f0000000380)) [ 579.374346] binder: 28972:28974 transaction failed 29201/-22, size 0-16 line 2834 [ 579.397204] binder: 28972:28980 unknown command 0 13:30:20 executing program 4: preadv(0xffffffffffffffff, &(0x7f0000001380), 0x0, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000080)='io\x00') preadv(r0, &(0x7f0000000480), 0x10000000000002a1, 0x0) [ 579.419034] binder: undelivered TRANSACTION_ERROR: 29201 [ 579.425169] binder: 28972:28980 ioctl c0306201 200002c0 returned -22 [ 579.522078] ntfs: (device loop5): ntfs_fill_super(): Unable to determine device size. 13:30:20 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000007000)={0x8, 0x0, &(0x7f0000000140)=[@acquire], 0x0, 0x0, &(0x7f00000001c0)}) r2 = dup2(r1, r0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000002c0)={0x8, 0x0, &(0x7f00000000c0)=[@release], 0x0, 0x0, &(0x7f0000000300)}) r3 = request_key(&(0x7f0000000040)='keyring\x00', &(0x7f0000000080)={'syz', 0x0}, &(0x7f0000000100)='eth1\x00', 0xffffffffffffffff) keyctl$get_keyring_id(0x0, r3, 0x7fc000000000) 13:30:21 executing program 4: preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f00000000c0)=""/148, 0x94}], 0x1, 0x0) ioctl$sock_FIOGETOWN(0xffffffffffffffff, 0x8903, &(0x7f0000000000)=0x0) r1 = syz_open_procfs(r0, &(0x7f0000000080)='io\x00') preadv(r1, &(0x7f0000000480), 0x10000000000002a1, 0x0) 13:30:21 executing program 3: r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r1, &(0x7f0000000080)={0x2, 0x4e23, @dev}, 0x10) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000000)={r0, &(0x7f00000000c0)="10a02c6eba2abb94eaddf4b468eb754137da46f35be40fa0f6d4229abbb42d91127e84401b46a56604a5da5294c1137bec853b7e4b5ed039e19bacc2f0da46e03d036f5c0fb1a1f3c8f4dc75e880447181256ba6fb473554470abfcac921b4dfb1558e5dec90784ef8f4e0d729d8578ece139b5f3e72c2cea36966af4c54cb9aea9b051737bd753f", &(0x7f0000000180)="ecd467956d227450534b97cfe3428b497761c241de555f7a009694ac2eef9f123826ebc41a54101bf213d0b132174feff07349d8b1e32392b7d28df20f1735da1021c718830216d07227df73d63b927af6792c5fcde511b726a4d08cc38192e750b632250166c1cb62da38822974553a48862df130c9533887cc47524d21a12547d22ce6871fcf92b8ca8ef98bd80084d9abe1", 0x3}, 0x20) add_key(&(0x7f0000000440)='pkcs7_test\x00', &(0x7f0000000480)={'syz'}, &(0x7f00000004c0), 0x0, 0xfffffffffffffffb) 13:30:21 executing program 0: r0 = socket$inet(0x2, 0x4000000803, 0x4) bind$inet(r0, &(0x7f0000000000)={0x2, 0x0, @broadcast}, 0x10) getsockname(r0, &(0x7f00000036c0)=@xdp={0x2c, 0x0, 0x0}, &(0x7f0000000080)=0x80) setsockopt$inet_pktinfo(r0, 0x0, 0x8, &(0x7f0000003780)={r1, @rand_addr, @dev}, 0xc) syz_emit_ethernet(0x4a, &(0x7f0000000240)={@link_local, @empty=[0x0, 0x0, 0x88470000], [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x3c, 0x0, 0x0, 0x0, 0x4, 0x0, @empty=0x9000000, @broadcast}, @udp={0x0, 0x0, 0x28}}}}}, &(0x7f0000000380)) 13:30:21 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000007000)={0x8, 0x0, &(0x7f0000000140)=[@acquire], 0x0, 0x0, &(0x7f00000001c0)}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f00000002c0)={0x8, 0x0, &(0x7f00000000c0)=[@release], 0x0, 0x0, &(0x7f0000000300)}) 13:30:21 executing program 5: syz_mount_image$btrfs(&(0x7f0000000140)='btrfs\x00', &(0x7f0000000180)='./file0\x00', 0x0, 0x0, &(0x7f00000007c0), 0x0, &(0x7f0000000380)=ANY=[]) syz_mount_image$ntfs(&(0x7f0000000200)='ntfs\x00', &(0x7f0000000080)='./file1\x00', 0x0, 0x30, &(0x7f0000000580), 0x0, &(0x7f0000000680)=ANY=[]) mount$overlay(0x404030, &(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f0000000100)={[{@upperdir={'upperdir', 0x3d, './file0'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@workdir={'workdir', 0x3d, './file1'}, 0x5c}]}) umount2(&(0x7f0000000040)='./file0\x00', 0xfffffffffffffff0) 13:30:21 executing program 1: socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)) syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0xe1, 0x400100) creat(&(0x7f00000001c0)='./file0\x00', 0x2) openat$dsp(0xffffffffffffff9c, &(0x7f0000000200)='/dev/dsp\x00', 0x8000, 0x0) syz_open_dev$mouse(&(0x7f0000000240)='/dev/input/mouse#\x00', 0x100, 0x10000) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000007000)={0x8, 0x0, &(0x7f0000000140)=[@acquire], 0x0, 0x0, &(0x7f00000001c0)}) r2 = dup2(r1, r0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000002c0)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x40046306, 0x3f000000}], 0x0, 0x0, &(0x7f0000000300)}) 13:30:21 executing program 4: preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f00000000c0)=""/148, 0x94}], 0x1, 0x0) socketpair$inet_udplite(0x2, 0x2, 0x88, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) mmap(&(0x7f0000ffc000/0x2000)=nil, 0x2000, 0x8, 0x12, r0, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000080)='io\x00') preadv(r1, &(0x7f0000000480), 0x10000000000002a1, 0x0) [ 580.127303] binder: BINDER_SET_CONTEXT_MGR already set 13:30:21 executing program 1: socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)) syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0xe1, 0x400100) creat(&(0x7f00000001c0)='./file0\x00', 0x2) openat$dsp(0xffffffffffffff9c, &(0x7f0000000200)='/dev/dsp\x00', 0x8000, 0x0) syz_open_dev$mouse(&(0x7f0000000240)='/dev/input/mouse#\x00', 0x100, 0x10000) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000007000)={0x8, 0x0, &(0x7f0000000140)=[@acquire], 0x0, 0x0, &(0x7f00000001c0)}) r2 = dup2(r1, r0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000002c0)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x40046306, 0xfdfdffff}], 0x0, 0x0, &(0x7f0000000300)}) [ 580.183731] binder: 29036:29037 ioctl 40046207 0 returned -16 [ 580.216663] ntfs: (device loop5): ntfs_fill_super(): Unable to determine device size. 13:30:21 executing program 0: r0 = socket$inet(0x2, 0x4000000803, 0x4) bind$inet(r0, &(0x7f0000000000)={0x2, 0x0, @broadcast}, 0x10) getsockname(r0, &(0x7f00000036c0)=@xdp={0x2c, 0x0, 0x0}, &(0x7f0000000080)=0x80) setsockopt$inet_pktinfo(r0, 0x0, 0x8, &(0x7f0000003780)={r1, @rand_addr, @dev}, 0xc) syz_emit_ethernet(0x4a, &(0x7f0000000240)={@link_local, @empty=[0x0, 0x0, 0xd00], [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x3c, 0x0, 0x0, 0x0, 0x4, 0x0, @empty=0x9000000, @broadcast}, @udp={0x0, 0x0, 0x28}}}}}, &(0x7f0000000380)) 13:30:21 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000007000)={0x8, 0x0, &(0x7f0000000140)=[@acquire], 0x0, 0x0, &(0x7f00000001c0)}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f00000002c0)={0x8, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="06630440000000004376f4f41eeaa196ce8a0496618af8a1397a29da0eb9f633d82901594e9f0464c8b81f9f5871e1b354e4edd19d0c25d3d855beb673f9b363e10537e0287bce969ea1b7bb45721673fc6e106422afae04feffffffffffffff3529b077909db89ddd8ad50d05d35d4cd5b95c5e6f7adb3756fe0d6a0df9bd5140ba918a5b1a872ba2856e29e8c79f3c49f5a7832bab1f0171bb3e8bc8b1beba961ea16f0037511cd7d9b9f82402d28d87a8fede102b7fa6bdc4ea74343fca57faf2bae490ab4ace9ba4831d5658e2e9971a01cd1582028d7cc0adf9d6e84adcfaaca94bb259da2d57c12fe09719a50880107adf7ca600bc564b126cfe6d165dcfee65ddb2b061a41f41e23001fd31c596eae303a6f850ef9c9d142ecbe20101d87cedb2c800b3a0701853a107cb114c21606c6735e06d058b08d7de371f40fc9025"], 0x0, 0x0, &(0x7f0000000300)}) clock_gettime(0x0, &(0x7f0000000040)={0x0, 0x0}) clock_settime(0x5, &(0x7f0000000080)={r2, r3+10000000}) ioctl$EVIOCSABS20(0xffffffffffffffff, 0x401845e0, &(0x7f00000000c0)={0x19e5, 0x9, 0x3, 0x8, 0x5, 0x9846}) 13:30:21 executing program 3: socketpair$inet6(0xa, 0xa, 0x8, &(0x7f00000002c0)={0xffffffffffffffff}) fsetxattr$security_evm(r0, &(0x7f0000000340)='security.evm\x00', &(0x7f0000000380)=@md5={0x1, "2a1db91bb9ff5221b06a2b2ccef391a3"}, 0x11, 0x1) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0) r1 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000100)='/dev/fuse\x00', 0x2, 0x0) r2 = openat$vsock(0xffffffffffffff9c, &(0x7f0000000580)='/dev/vsock\x00', 0x400, 0x0) ioctl$RNDGETENTCNT(r2, 0x80045200, &(0x7f00000005c0)) mount$fuse(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000000400)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r1, @ANYBLOB=',rootmode=00000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0, @ANYBLOB='@\x00']) syz_open_dev$dspn(&(0x7f00000003c0)='/dev/dsp#\x00', 0xdb7, 0x2) r3 = syz_open_dev$mouse(&(0x7f0000000080)='/dev/input/mouse#\x00', 0x9, 0x8000) ioctl$SCSI_IOCTL_PROBE_HOST(r3, 0x5385, &(0x7f0000000180)={0x47, ""/71}) stat(&(0x7f0000000200)='./file0\x00', &(0x7f0000000240)={0x0, 0x0, 0x0, 0x0, 0x0}) read$FUSE(r1, &(0x7f00000020c0), 0x1000) write$FUSE_OPEN(r1, &(0x7f0000000140)={0x20, 0x0, 0x2, {0x7}}, 0x20) mount$overlay(0x0, &(0x7f0000000480)='./file0\x00', &(0x7f00000004c0)='overlay\x00', 0x201000, &(0x7f0000000500)={[{@lowerdir={'lowerdir', 0x3d, './file0/file0'}}], [{@euid_eq={'euid', 0x3d, r4}}, {@context={'context', 0x3d, 'staff_u'}}, {@smackfshat={'smackfshat', 0x3d, 'security++,'}}]}) openat$dir(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x0, 0x0) close(r1) 13:30:21 executing program 4: preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f00000000c0)=""/148, 0x94}], 0x1, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000080)='io\x00') preadv(r0, &(0x7f0000000480), 0x10000000000002a1, 0x0) ioctl$PERF_EVENT_IOC_ID(r0, 0x80082407, &(0x7f0000000000)) [ 580.356192] overlayfs: filesystem on './file0' not supported as upperdir [ 580.389742] ntfs: (device loop5): ntfs_fill_super(): Unable to determine device size. [ 580.416077] binder: BINDER_SET_CONTEXT_MGR already set [ 580.422372] binder: 29071:29072 ioctl 40046207 0 returned -16 13:30:21 executing program 0: r0 = socket$inet(0x2, 0x4000000803, 0x4) bind$inet(r0, &(0x7f0000000000)={0x2, 0x0, @broadcast}, 0x10) getsockname(r0, &(0x7f00000036c0)=@xdp={0x2c, 0x0, 0x0}, &(0x7f0000000080)=0x80) setsockopt$inet_pktinfo(r0, 0x0, 0x8, &(0x7f0000003780)={r1, @rand_addr, @dev}, 0xc) syz_emit_ethernet(0x4a, &(0x7f0000000240)={@link_local, @empty=[0x0, 0x0, 0x4788], [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x3c, 0x0, 0x0, 0x0, 0x4, 0x0, @empty=0x9000000, @broadcast}, @udp={0x0, 0x0, 0x28}}}}}, &(0x7f0000000380)) 13:30:21 executing program 1: socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)) syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0xe1, 0x400100) creat(&(0x7f00000001c0)='./file0\x00', 0x2) openat$dsp(0xffffffffffffff9c, &(0x7f0000000200)='/dev/dsp\x00', 0x8000, 0x0) syz_open_dev$mouse(&(0x7f0000000240)='/dev/input/mouse#\x00', 0x100, 0x10000) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000007000)={0x8, 0x0, &(0x7f0000000140)=[@acquire], 0x0, 0x0, &(0x7f00000001c0)}) r2 = dup2(r1, r0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000002c0)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x40046306, 0x3f00}], 0x0, 0x0, &(0x7f0000000300)}) 13:30:21 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000040)='/dev/rtc0\x00', 0x2000, 0x0) setsockopt$IP_VS_SO_SET_STOPDAEMON(r2, 0x0, 0x48c, &(0x7f0000000080)={0x3, 'erspan0\x00', 0x1}, 0x18) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000007000)={0x8, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="0563044000000004e12f3e5a8ae2768aef614594230ac701a8fa6dd299f5772e49612055f505360cbf04b5a7d89b37565485718c9503c73dc313749ac03cae2806e421f20ce4275960e6f677ff03a3046a5668801c6811f4a5d452efe58a62046ed803cacc8a56d7ae66f4ff1050ff3e0347920ca8e5ce240ee29ea3c9d0114dbfd6ce83d93c448bec10179957d49ba17618b66d0f55d5a56e8c3de69029c819c78594e798cb0c75022e"], 0x0, 0x0, &(0x7f00000001c0)}) r3 = dup2(r1, r0) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000002c0)={0x8, 0x0, &(0x7f00000000c0)=[@release], 0x0, 0x0, &(0x7f0000000300)}) accept$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000140)=0x14) ioctl$sock_inet6_SIOCSIFDSTADDR(r3, 0x8918, &(0x7f0000000180)={@local, 0x11, r4}) [ 580.462509] Unknown ioctl -2147200512 13:30:21 executing program 5: syz_mount_image$btrfs(&(0x7f0000000140)='btrfs\x00', &(0x7f0000000180)='./file0\x00', 0x0, 0x0, &(0x7f00000007c0), 0x0, &(0x7f0000000380)=ANY=[]) syz_mount_image$ntfs(&(0x7f0000000200)='ntfs\x00', &(0x7f0000000080)='./file1\x00', 0x0, 0x30, &(0x7f0000000580), 0x0, &(0x7f0000000680)=ANY=[]) mount$overlay(0x404030, &(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f0000000100)={[{@upperdir={'upperdir', 0x3d, './file0'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@workdir={'workdir', 0x3d, './file1'}, 0x5c}]}) umount2(&(0x7f0000000040)='./file0\x00', 0xd000000) [ 580.554912] binder_thread_write: 37 callbacks suppressed [ 580.554933] binder: 29088:29091 Acquire 1 refcount change on invalid ref 0 ret -22 [ 580.561368] binder: 29093:29096 Acquire 1 refcount change on invalid ref 67108864 ret -22 [ 580.583340] Unknown ioctl -2147200512 13:30:21 executing program 4: r0 = socket$inet(0x2, 0x2, 0x9) getsockopt$IP_VS_SO_GET_INFO(r0, 0x0, 0x481, &(0x7f0000000000), &(0x7f0000000040)=0xc) preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f00000000c0)=""/148, 0x94}], 0x1, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000080)='io\x00') preadv(r1, &(0x7f0000000480), 0x10000000000002a1, 0x0) 13:30:22 executing program 0: r0 = socket$inet(0x2, 0x4000000803, 0x4) bind$inet(r0, &(0x7f0000000000)={0x2, 0x0, @broadcast}, 0x10) getsockname(r0, &(0x7f00000036c0)=@xdp={0x2c, 0x0, 0x0}, &(0x7f0000000080)=0x80) setsockopt$inet_pktinfo(r0, 0x0, 0x8, &(0x7f0000003780)={r1, @rand_addr, @dev}, 0xc) syz_emit_ethernet(0x4a, &(0x7f0000000240)={@link_local, @empty=[0x0, 0x0, 0x800000000000000], [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x3c, 0x0, 0x0, 0x0, 0x4, 0x0, @empty=0x9000000, @broadcast}, @udp={0x0, 0x0, 0x28}}}}}, &(0x7f0000000380)) [ 580.646123] binder: 29088:29091 Release 1 refcount change on invalid ref 16128 ret -22 [ 580.683083] binder: 29093:29096 Release 1 refcount change on invalid ref 0 ret -22 13:30:22 executing program 3: ioctl$PPPIOCGL2TPSTATS(0xffffffffffffffff, 0x80487436, &(0x7f0000000140)) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket(0x2, 0x6, 0x0) clock_gettime(0x0, &(0x7f0000000100)={0x0}) recvmmsg(r0, &(0x7f0000001cc0), 0x400000000000160, 0x10102, &(0x7f0000001540)={r1}) llistxattr(&(0x7f00000000c0)='./file0\x00', &(0x7f0000000140), 0x0) getsockname$packet(r0, &(0x7f0000000b80)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @random}, &(0x7f0000000b00)=0x11a) sendto$packet(r0, &(0x7f0000000a80)="2a11f1b5bd5a7b46ea129772e358a020f8ddb29fbd596167713878030a3f46ac45f2cbd24b4c0306fbf7397578535d5c", 0x30, 0xc5, &(0x7f0000000b40)={0x11, 0xa, r2, 0x1, 0xf5e3, 0x6, @broadcast}, 0x14) r3 = openat$pfkey(0xffffffffffffff9c, &(0x7f00000006c0)='/proc/self/net/pfkey\x00', 0x10400, 0x0) rename(&(0x7f0000000800)='./file0\x00', &(0x7f0000000840)='./file0\x00') getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000000700)={0x0, 0x0}, &(0x7f0000000740)=0xc) ioctl$TUNSETOWNER(r3, 0x400454cc, r4) write$binfmt_elf64(r3, &(0x7f0000000380)=ANY=[@ANYBLOB="7f454c4600017eff000100000000000003003e0003000000df020000000000004000000000000000ce01000000000000090000000900380002000500090003000600000007f8ffffffff000000000000b008000000000000ff0f000000000000000000000000000004000000e5000000ff7f0000000000005807ff3c661ed221062f4089"], 0x84) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r0, 0x84, 0x6f, &(0x7f00000001c0)={0x0, 0x48, &(0x7f0000000140)=[@in={0x2, 0x4e22, @rand_addr=0x1ff}, @in6={0xa, 0x4e23, 0x4, @loopback, 0x100000000}, @in6={0xa, 0x4e21, 0x7, @ipv4={[], [], @multicast2}, 0x4}]}, &(0x7f0000000240)=0x10) getsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(0xffffffffffffffff, 0x84, 0x9, &(0x7f0000000280)={r5, @in6={{0xa, 0x4e24, 0x1000, @mcast1, 0x2cbb23a}}, 0x0, 0x3d6f, 0x8000, 0x2, 0x4}, &(0x7f0000000340)=0x98) ioctl$TIOCGSID(0xffffffffffffff9c, 0x5429, &(0x7f0000000640)=0x0) fcntl$setownex(r0, 0xf, &(0x7f0000000680)={0x1, r6}) openat$mixer(0xffffffffffffff9c, &(0x7f0000000780)='/dev/mixer\x00', 0x0, 0x0) r7 = socket(0xa, 0x80005, 0x0) ioctl$SIOCSIFMTU(r7, 0x8922, &(0x7f0000000100)={'bond0\x00', 0x7f}) r8 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000880)='IPVS\x00') sendmsg$IPVS_CMD_NEW_DAEMON(r7, &(0x7f0000000a40)={&(0x7f0000000600)={0x10, 0x0, 0x0, 0x28c4}, 0xc, &(0x7f0000000a00)={&(0x7f0000000900)={0xd4, r8, 0xc04, 0x70bd2b, 0x25dfdbfe, {}, [@IPVS_CMD_ATTR_SERVICE={0xc, 0x1, [@IPVS_SVC_ATTR_PROTOCOL={0x8, 0x2, 0xb7}]}, @IPVS_CMD_ATTR_DAEMON={0x28, 0x3, [@IPVS_DAEMON_ATTR_MCAST_GROUP={0x8, 0x5, @dev={0xac, 0x14, 0x14, 0x12}}, @IPVS_DAEMON_ATTR_MCAST_GROUP={0x8, 0x5, @dev={0xac, 0x14, 0x14, 0x1d}}, @IPVS_DAEMON_ATTR_MCAST_IFN={0x14, 0x2, 'ipddp0\x00'}]}, @IPVS_CMD_ATTR_DAEMON={0xc, 0x3, [@IPVS_DAEMON_ATTR_MCAST_PORT={0x8, 0x7, 0x4e23}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5, 0x800}, @IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0x5}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x5}, @IPVS_CMD_ATTR_SERVICE={0x24, 0x1, [@IPVS_SVC_ATTR_TIMEOUT={0x8, 0x8, 0x80000001}, @IPVS_SVC_ATTR_PROTOCOL={0x8}, @IPVS_SVC_ATTR_AF={0x8, 0x1, 0x2}, @IPVS_SVC_ATTR_AF={0x8, 0x1, 0xa}]}, @IPVS_CMD_ATTR_SERVICE={0xc, 0x1, [@IPVS_SVC_ATTR_FWMARK={0x8, 0x5, 0x1}]}, @IPVS_CMD_ATTR_DAEMON={0x38, 0x3, [@IPVS_DAEMON_ATTR_MCAST_PORT={0x8, 0x7, 0x4e20}, @IPVS_DAEMON_ATTR_MCAST_PORT={0x8, 0x7, 0x4e20}, @IPVS_DAEMON_ATTR_SYNC_MAXLEN={0x8, 0x4, 0x5a}, @IPVS_DAEMON_ATTR_MCAST_IFN={0x14, 0x2, 'bond_slave_0\x00'}, @IPVS_DAEMON_ATTR_SYNC_ID={0x8, 0x3, 0x1}]}]}, 0xd4}, 0x1, 0x0, 0x0, 0xc010}, 0x20000800) ioctl$SIOCSIFMTU(r7, 0x8922, &(0x7f0000000080)={'bond0\x00', 0x1000}) r9 = bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000480)={&(0x7f0000000440)="4c5e7070703126152b407070703000", 0xffffffffffffff9c}, 0x10) connect$l2tp(r9, &(0x7f00000005c0)=@pppol2tpv3={0x18, 0x1, {0x0, r9, {0x2, 0x4e22, @broadcast}, 0x1, 0x1, 0x4, 0x2}}, 0x2e) ioctl$KDDELIO(r9, 0x4b35, 0x36bf) ioctl$SNDRV_TIMER_IOCTL_GINFO(r9, 0xc0f85403, &(0x7f00000004c0)={{0x2, 0x3, 0x6, 0x3, 0x1}, 0x703, 0x6, 'id0\x00', 'timer0\x00', 0x0, 0x3f80000, 0x4, 0x4, 0x100000001}) ioctl$PIO_UNIMAPCLR(r3, 0x4b68, &(0x7f00000008c0)={0x6, 0xa, 0x4}) [ 580.730917] binder: 29093:29104 ioctl 8918 20000180 returned -22 [ 580.741585] binder: 29088:29115 Acquire 1 refcount change on invalid ref 0 ret -22 [ 580.777167] ntfs: (device loop5): ntfs_fill_super(): Unable to determine device size. [ 580.781341] binder: 29088:29103 Release 1 refcount change on invalid ref 16128 ret -22 [ 580.787050] binder: 29093:29096 Acquire 1 refcount change on invalid ref 67108864 ret -22 13:30:22 executing program 0: r0 = socket$inet(0x2, 0x4000000803, 0x4) bind$inet(r0, &(0x7f0000000000)={0x2, 0x0, @broadcast}, 0x10) getsockname(r0, &(0x7f00000036c0)=@xdp={0x2c, 0x0, 0x0}, &(0x7f0000000080)=0x80) setsockopt$inet_pktinfo(r0, 0x0, 0x8, &(0x7f0000003780)={r1, @rand_addr, @dev}, 0xc) syz_emit_ethernet(0x4a, &(0x7f0000000240)={@link_local, @empty=[0x0, 0x0, 0x4888], [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x3c, 0x0, 0x0, 0x0, 0x4, 0x0, @empty=0x9000000, @broadcast}, @udp={0x0, 0x0, 0x28}}}}}, &(0x7f0000000380)) 13:30:22 executing program 1: socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)) syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0xe1, 0x400100) creat(&(0x7f00000001c0)='./file0\x00', 0x2) openat$dsp(0xffffffffffffff9c, &(0x7f0000000200)='/dev/dsp\x00', 0x8000, 0x0) syz_open_dev$mouse(&(0x7f0000000240)='/dev/input/mouse#\x00', 0x100, 0x10000) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000007000)={0x8, 0x0, &(0x7f0000000140)=[@acquire], 0x0, 0x0, &(0x7f00000001c0)}) r2 = dup2(r1, r0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000002c0)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x40046306, 0xfffffdfd}], 0x0, 0x0, &(0x7f0000000300)}) [ 580.875857] binder: 29093:29129 Release 1 refcount change on invalid ref 0 ret -22 13:30:22 executing program 4: preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f00000000c0)=""/148, 0x94}], 0x1, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000080)='io\x00') ioctl$BLKROSET(r0, 0x125d, &(0x7f00000001c0)=0x106) ioctl$FS_IOC_GETFLAGS(r0, 0x80086601, &(0x7f0000000180)) setsockopt$ARPT_SO_SET_ADD_COUNTERS(r0, 0x0, 0x61, &(0x7f0000000000)={'filter\x00', 0x4}, 0x68) setsockopt$inet_tcp_int(r0, 0x6, 0x15, &(0x7f0000000200)=0x3cc4, 0x4) [ 580.943940] overlayfs: filesystem on './file0' not supported as upperdir 13:30:22 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000007000)={0x8, 0x0, &(0x7f0000000140)=[@acquire], 0x0, 0x0, &(0x7f00000001c0)}) r2 = dup2(r1, r0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000002c0)={0x8, 0x0, &(0x7f00000000c0)=[@release], 0x0, 0x0, &(0x7f0000000300)}) accept4$inet6(r2, 0xffffffffffffffff, &(0x7f0000000040), 0x80000) 13:30:22 executing program 0: r0 = socket$inet(0x2, 0x4000000803, 0x4) bind$inet(r0, &(0x7f0000000000)={0x2, 0x0, @broadcast}, 0x10) getsockname(r0, &(0x7f00000036c0)=@xdp={0x2c, 0x0, 0x0}, &(0x7f0000000080)=0x80) setsockopt$inet_pktinfo(r0, 0x0, 0x8, &(0x7f0000003780)={r1, @rand_addr, @dev}, 0xc) syz_emit_ethernet(0x4a, &(0x7f0000000240)={@link_local, @empty=[0x0, 0x0, 0x88caffff], [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x3c, 0x0, 0x0, 0x0, 0x4, 0x0, @empty=0x9000000, @broadcast}, @udp={0x0, 0x0, 0x28}}}}}, &(0x7f0000000380)) 13:30:22 executing program 4: preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f00000000c0)=""/148, 0x94}], 0x1, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000080)='io\x00') write$P9_RREADLINK(r0, &(0x7f0000000000)={0x10, 0x17, 0x2, {0x7, './file0'}}, 0x10) preadv(r0, &(0x7f0000000480), 0x10000000000002a1, 0x0) [ 581.127517] binder: 29134:29151 Acquire 1 refcount change on invalid ref 0 ret -22 13:30:22 executing program 5: syz_mount_image$btrfs(&(0x7f0000000140)='btrfs\x00', &(0x7f0000000180)='./file0\x00', 0x0, 0x0, &(0x7f00000007c0), 0x0, &(0x7f0000000380)=ANY=[]) syz_mount_image$ntfs(&(0x7f0000000200)='ntfs\x00', &(0x7f0000000080)='./file1\x00', 0x0, 0x30, &(0x7f0000000580), 0x0, &(0x7f0000000680)=ANY=[]) mount$overlay(0x404030, &(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f0000000100)={[{@upperdir={'upperdir', 0x3d, './file0'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@workdir={'workdir', 0x3d, './file1'}, 0x5c}]}) umount2(&(0x7f0000000040)='./file0\x00', 0xfffffff4) [ 581.212439] binder: BINDER_SET_CONTEXT_MGR already set [ 581.244618] binder: 29156:29164 Release 1 refcount change on invalid ref 0 ret -22 [ 581.254409] binder: 29156:29157 ioctl 40046207 0 returned -16 13:30:22 executing program 0: r0 = socket$inet(0x2, 0x4000000803, 0x4) bind$inet(r0, &(0x7f0000000000)={0x2, 0x0, @broadcast}, 0x10) getsockname(r0, &(0x7f00000036c0)=@xdp={0x2c, 0x0, 0x0}, &(0x7f0000000080)=0x80) setsockopt$inet_pktinfo(r0, 0x0, 0x8, &(0x7f0000003780)={r1, @rand_addr, @dev}, 0xc) syz_emit_ethernet(0x4a, &(0x7f0000000240)={@link_local, @empty=[0x0, 0x0, 0x0, 0xfffff000], [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x3c, 0x0, 0x0, 0x0, 0x4, 0x0, @empty=0x9000000, @broadcast}, @udp={0x0, 0x0, 0x28}}}}}, &(0x7f0000000380)) 13:30:22 executing program 4: preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f00000000c0)=""/148, 0x94}], 0x1, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000080)='io\x00') ioctl$PIO_UNISCRNMAP(r0, 0x4b6a, &(0x7f00000013c0)="bb6c9fb249959ff8f05d5e76bfda386b719766641467b9d0e6f001c1da916c8426e12e7ce2c2f6c9b191a5209100a958994efbfb337d4743be2f0e01e9f224ca7bc0b05c0c593170dacda53e32e009cae283358c86b41af50b732a6c49b7c4a200a3ad7b5ee2f70518dfb2196768c5bdfecbb03f6ecefae4730d4d8bfd982008417312b2aa28dc5c9686c15a9037c33e414c1bad9172674a55a992aafc8a861bd6adf3ab98978eb9865ec985aeb9daac8a4f07b5b85302f464732513c188f270d384b4a603afd5015766d69d46cf1b84c079fea2de5c2f0b56c34e055523deace7fec33e25d821debc3e25add96881ac621ad7d73e4661b2b38651ccd1614ede1e029c9c742ad76025af38c3ede239979830811214f0ba68bc51717b7102b209c0a006a3108de700590b0763a149b26af28e4fd56f6d894d1c6eeb8f0a50b235af76389af0ead6c33b4bfb38b0c35704ff756f07dfc38439938f48dd8dde72fd98c0b28e593f49ff635515a0a11468a5b7a2b2924796c81e73d178fb9ffdf2a1a9bdcd8004a4ad776565dfe1f3eb11ac987d487689e2347e4662e0ce2db3521bfe37617c1cbbfa4972a5b65c020172766561de4a16073d12449626feb700d713e0306e482ae77436f38d6e5f8fc647c747b89ecff075a7f6020dbc137c7000984d9dd7fa639bacba7991251c17aa1e987b07eb1bc97f5a94364400b3dacbc647fba697344a64473f2041098396940a1c10a1b27c1f78b936be1f03bff54aa15c5110cffee864c2b40a7342627e28e4fb6aa5f23e4aea66836786dc849c6d3bc5b9d4a9aa8bccf118814cc8f31199bb80fbb1070d001bb8b7347df46455ad1313709f28b89c7ebb7497f10508b8c54ae395fe24c6f6121030ef6417f0320d998e87e51f94543d5f7aaf19f20afb48568bf0a5b901fe4be76ca67467c9d418b68d6c48d955d0ba530e4ceca013ae367d349f33c4e73037b106bc9d110013c6a3731912dd3c2c0e0c56f1f7af8d667cbed5de916fdc1624cbe74441186bf8b0cf893b5a6b49f7cdd13d7dc3684c4a3faf41e5694b686ccbe501630b3b21a69ec5f4456fb384b35738e1f2ffc9ae6cb5785197035c50874d59abb34654ca0b8905dda1c448b52bf579109c94bd498e10ce61d64fb2ad5b186f1978597998865cd5cbf92de317176bc822c18c34b6ec1d1a9ee090ace8f1ec7fa49fd3189a546078d983974e7b37d77bdd666d40e1478e45ab43f2b23ca857e778c5096d770b6ace0a849ca23554de136a3bf7c8b839e5778c1dd6bb8e02de8b7ce89ba9fc5bae7d05022840a9ecd40f22b8a2ac178c2c1cb602db4fb81954f4e69e95ca2ef1213416f551c21d277a36145cd23db3157b6b5b15cca425d3f52c80276af24f8b591e6893ac117480c49c304c24230c560a5c670784d0f42b2c4c18a05d9195009d5bad7946e56823671558a71a683d2219142b5623b9c98bf1697d7719fd81af44c85981054b8637fb844c3821a5e49153514c953f94392bd3ec7b1d58a83aba8ea91cffad4a164807d2e8aa9e769142a4f451d2e549ad9771fffe66c2400f82b365154477c4f64c382ca0e6a856af2e5f7c897b35136df3f00d3afd692c362ce9eb96bc13f09aa16b0cf2eb086ceb9fef6638b076daec1fba617af0187b642675ab3060c781465bf3f60dc9b18eba96162f79b7093541c5a48b44a0ac0601c5a03f8d552b94ec37d4c88bd8a39d82f33c05c9151a18b93037aa257873c270c0ae0af3413461f963326fdc9a1975ee97e1e50e0e4cad10bf683042a4b3edf8240c97c9afe0daa0ae7e3b9805407040cc7dd1fae03d2d159fd46dd1f5b91a7b04c68c2e3e3460e5d898475b7427a764fd6d1aa6eaf1e162ab03e2c88e508c9e9560dd8ca700898c07fd10693e85a5f27969d08e854a16b7e12e0936f4e5c01d2f089939c08569fc04d052f2fd3070adc4fa04fd19a0c84b44a6e4dfe63a736238343c1e4dc4eb3f636c01a9cfbab3ba46fb4ac1e66fc04bb31084844c65a0f24875ba6066948df258e8dc220625ce688240138bc10daf7233db9896e1e24be31a0ff0b21005856d014182f2b1e18e4e900a4c837f07673c431f4d8e95451aa8edc2478965b7506c9743a1e61d412bfc55373b27c9fcc363d7efae58784316d09c15e7e7374ff69ae4cf8ae9e451cb7a2441c29aa5ff99f3f4a265d92dcf6e62620193c74ca35b548fd5e9c9a4336c30f77021a2fbe35933db04196fc5677732be1cd6ad52fc65622647332fecb15de3a8f2c8e41177f5b4b85416b0c6d01ba58fd5164ad56bb23a1ff686b0515c23e3364433f05d794ff5ee6e4dca0bfbb120f18c54860364270047c8f21c008c1f04b68980d25ee1fe17124fe81e0277f56d49ef18496f3085085385f92e23c2f6e3973cc68d45b041246457e743e54635501ce85658038604fcaa5f7c7e3e37917a4297986ce72473795e267c7f5cde17bb377ba009966fa209a74f1138960131ba9753fbf7ff40a47026f8bd92fe98a6527100689cee4a421f57cefd770906fdade7cb8e9ff06d90bc3e70132b95eb53901a63ce18c539ebd1c7bd2e3d7dcb52629e67cba8e2645c8c8c3afb613c67a32cdf026362d75cdcbc664be1b3893a550e13a32be4fa000c25ca578ad8e3d9a981ef3fbb77c5eb18a433f3ec1bf13711e82361d0f7880281510f8cc87c696cd827a9c3727224be5f278e36c9c2f2b260af8e0b333e78e5c7d2032a90816d8d2ab465931627d3e76d061423b826a4a8696fd61a7e9e9485e867375cbcee14e3df25eb31768612afac46f4b74ae57356f3f94b21e56ff9ccd248a28f3f63b9b299c9ae7fb5e630d363d6e65fd04b3a10985eb6823d867856bb551a2cd45d9e37f4792f52b4618b8d33fc58031bc4b7cd012892858c2aa99ebc76fbef65de5a55ea17bdd77e9ea476daa8fdc063c50c2439e39a67e64e1f2d752ff0154bc48298743f24e5f0316032d1f3cf2d2018a36863f8641a2a2c5f9bc0b4ab15a359f6a00bf224fa8b6233f19af1f455406f29ae54cec3b2d960775fde0d4698cd1aeb609973e9b7291c9ae3571127f8566dafd69ccf98cb656d557df23a2ca7a58f2969e51ecb64b9863bdd47ed1937597d32ca70d3a62d78279fc89b265a2ad47ff7c04ef944ed64530946c0075ebe0d0d4a38c6166a1f21d4ff62a49bb4428155e02576e5869fa7e8d420cc191195ac3fefd8b650532f5113c72eea7625ce7dd2c22f7ee24dcfcbacb7fe5f0edb135bf71f941a8cb6f6dff911ccb297543f46000bed1e1e11e9de8fb0ad9a67d5776ea315ebcf2cae554466c318ef38cf7940c0a324df715f3b707dbec2361d7f014ee2c6b3530c931fddf07205a2f8eb8dc01eb149bad5f9ccb61977a2ba1883a88dad5ff44ef3beb2997cd0c3add9620880d65a7d3f6f3191ca9e996330a6ca75d54be63dc238dab5600c81f66fe44b235a93d452027bd2fb2e3dca323a58850d5b2fca7e78f8c1f748b48747021245a40f3d57dc4c5f1262a53d13b86ccf1a4646c5b608a8725b14e4ec568a98cf94263a777922606fdadc9145935e8a33d17e05740840d404f1bade1fce9bf3cf43a11619cd1a8d1be3695725fa3535fe9adef4227b2c9e54fccc6d5f32a065966b970170dbffba06bd2d7cf2a9be13a74e9e24ba56ffe6693ff658d85b82f63df615da2755afb57eab643b743926efd5989fc57ad03c8296f39cc2e8d379175049545fec19bb2d835e4781687da501fbfc065178ecb3724d5b85f660b73318b507e887e7024a0b0bcb3c513ef2aa6cab99c5ce8dfb9460d9d618dfeacb0f9320bb163958e35a7de61ecbe6c03f52e93f116b3bfdfc374b6696fc278dd88ae6e66e296651cfd5719cf34d597ca52139f768861339ecabaa0f12ecc21c9df1c5b368e76131264f7b922984317ed0ae9bc0c8ea94e94d15f2f83b404ae7c38599b6da760d2edeed5fa068ab4019fd15890d079d1e49e43dee34485c91f6ee965b8f296e5dece2ca25e342601f76a6f3a7c35478a54ca8a1162425df017c544e5ac7e9d0f305dfcce46d09e6df2df9289c07d2a255ca000cff08adfd7803a3239d12a4167287aa4f1ecf65bf4979f63387f263a44c7f803347e3793e419335303d553b42075d650ad183363915a60d529bee2d768c9cd2d276ba610fa21457e1e33b25d98671b1db06bf1547969eac022d122209f8000c36661006fbbb59c5e24bd5ccd28aed47b60d44334c159e2f92a26a8ffbd6c6451dc92f4f8dc92a3f53fa9b00e95d6eb72b1adca1dc8b5c80cd9890293d32476ee88855478991b2753f92e7e3227e683c5091c4f3697d1419fdde1fc435a6d8ad56e62197b160c761ff28cfb117db7526319c0096ed9aa4af5a6675d6703413f48a3c81f8264c76013ec23cea8fef1f6f0910f001b72594dade812b46ee45fc46b4d1d627e706adc9ecf8dfa9e9bc22e58d28e37204227338d82238f39838edb349a41a9cd31e7c194ccaf38a6515277e3b390510f530ea5248d78cf45ffd5d5c4b74107a8f117129048f9203089de24c8850221e9c83db3b46b77cdaea5457ad3471f95cd7306a17c352776681f611bb39b9c558886439fec7dd47db1e4a77a0b90368c929adccd24848aa5216e2d9115129946ba0cbbbd4acfe9461ce7658031705f1f581c7576c13ed54a7639616a2eccfa7202e4ad0055e7fa4531f207aa087b727c01bf6559fffe34c482b8776ae1ef3d96ef12d05e99af79055c451c721d040afed590a3795740ece5d37a15a636f1d660629a51d249dfe8a267e783d3561014b314b9ee81a74955ca2541d23e9a5553981680103c353f9ff7dc832a15fd4c1713f03fb100a93684ca750851bb8d92ce67abc4ac56fc10f1f6b30b2bdc895605fe412718538ac10c05ce865dd2a41b97ef75abc0b99c50b613558d39eef4c91fd1f97a027ffd95b5b924c71fea6cb03d7b8a650179d9fb6b51cb2007745021d3304991c99693c1d188ae37baf81713c3aa1ded0bb1e6e367620dfb2b5ab870c8aa30db4239db8e7246ee740283309d71a388b1f73599a260f5e9f63a24c08fcd6a3dc8810b250334c76de0c6731adcbea74d6ba26e8416a72481ff2cd93774d4266371b6d59e436f879b23308f33bade28c78b68b042e05380c8f7f1043ecc565ef97db1a5cb784e2ada5e6b58dc626f5b5ae60b7e5f9935992482cca7acfc6ecebe1306203eb22ab1658eed7d3fcd4585fdaa7aa6b70093ebcdb6479a6f45a250cc7324b0332fdf9ae5b4f21c6d986611609a74c63bad856afa2e4ab91fc17e166fe0886f791a5b44af27ab92c172f0302420ad8ff22114ff4cb3a25484ae6a0aad7236a636892411b31da7fb27e082e2834846ee240c811788741d8fbf682b7c9b34ffabfad003a7ebec2ff3dfcaa2b2726e9ef695434c10ec33fed5ca50234f168f53637ab128d9054b11edc06ce555e071687d88f970f6ac055ac213415941421a38d6e30ecbd882af9031fbd0bb8e232f2f019587997c6f00b361ff82da36353cf229ef282ac9ba2a621fc1293e5943a67e179dc5cd801cd1f873c44eee711ab03ffb7c845dc841abedae96da934de18e71afdfb7c787067205f2913abc2b169113d1f7a3e66765e36c8e8c35a604eb2e457e902bd247827988482c825b7adb4f2c1c1f8167aaacdc5ce50e636994a6702cbd9f190237c7d93d98dee886f07fd53146c676eb8a079e6f2fe7530605cf59c922c7287fd71cdefa21412dded409ab9bd1bf30125fadd646b19b474791185bee87f93d6ed612e4091cbf621f9") preadv(r0, &(0x7f0000000480), 0x10000000000002a1, 0x0) 13:30:22 executing program 1: socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)) syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0xe1, 0x400100) creat(&(0x7f00000001c0)='./file0\x00', 0x2) openat$dsp(0xffffffffffffff9c, &(0x7f0000000200)='/dev/dsp\x00', 0x8000, 0x0) syz_open_dev$mouse(&(0x7f0000000240)='/dev/input/mouse#\x00', 0x100, 0x10000) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000007000)={0x8, 0x0, &(0x7f0000000140)=[@acquire], 0x0, 0x0, &(0x7f00000001c0)}) r2 = dup2(r1, r0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000002c0)={0x8, 0x0, &(0x7f00000000c0)=[@release], 0x1000000, 0x0, &(0x7f0000000300)}) 13:30:22 executing program 3: readv(0xffffffffffffffff, &(0x7f00000005c0)=[{&(0x7f0000000200)=""/248, 0xf8}, {&(0x7f0000000300)=""/40, 0x28}, {&(0x7f0000000340)=""/178, 0xb2}], 0x3) r0 = socket(0x10, 0x80002, 0x0) sendmmsg$alg(r0, &(0x7f0000000140)=[{0x0, 0x0, &(0x7f0000000100), 0x0, &(0x7f0000000100)}], 0x492492492492805, 0x0) sendmmsg$alg(r0, &(0x7f00000012c0)=[{0x0, 0x0, &(0x7f0000000980)=[{&(0x7f0000000000)="204167c35f3460dff062fd6dafb51ea75099dc6d6a6caaa9bb4e7ef3dfc76be3f8aa01a8242e1d6afbf01b6e7db26a6c7e46008f55a23e74948949d11bdb2f37ba3027de2e1db84ba04fb2ffd165b10e66ca6d0203fc5abe925dc6d024f57560913034a80d62046e3427c07310cac5732cf0ecab3cbaa95f30dff6b5185af7a4943beec96a7c408db15821f4fd9aec103f092d85f600c960edce93d18f7a9ece2fcb4ccb4a7239fd7285a5d1e4d7e287cdc477e48219a0f3bbb4da263d31f898c9bcd14e10ce52e2f614e2bec6cb5f4c1a3615be3c389a5192d83cebf87e03347f0e19db9e8db3da8ade5c", 0xeb}, {&(0x7f0000000100)}, {&(0x7f0000000400)="6d9f63cf94690faeb613b6e205ab3e14063e06fb697303ddd54caa09bef312767840b9f0ab9fb2691b80b78868b471c900030799395f3c4d93dc83eedff717560f1f5a43e6b80cce58feeb08c397a5653eb472ead37b9007293dbed3c01a349b0e344c8d6c1a535531897e9e3443cac5698ede6577636132c672c41a530e6d0cabf87636ff0ffc95c2cc49", 0x8b}, {&(0x7f00000004c0)="3d6020e65177ee7f8f3f9b4b8490847a3e2f6d51d3c540dd6f061d3cb13f7693940af1b9df48e6afe49b757a2784af2d79a35dd8193b0c78711dd35c49ab93ea7e645d0d1ebd3017689a81dcc1d408144f63006e7b01ab6f92ce10015be2be876763cfbaeea92a4f2c51ea713d5d66dfe86f9332e7440e3cb7ed75727db72131fd6aa48ddecc3f27a9949aabbe80899e9fbc2a8f40118c126544765545de6f520a59a2fcadc548b29feecf3a52d98f98f5fbc5f6618eaa16f4", 0xb9}, {&(0x7f0000000600)="05449d0eb8d547aad5cf244da900d78f5e4f641ef7cce43a9f2fa2218ec5356cb523b0ab3a7603d19380ed4c0bb5539e3833bddc9364a1d7f94a0f201fafb0ba518c853606170d531da5536a0aedb13149fc6f91388461b03bf3b5631419886d675fc0bc346f564c7ff17e8c7ebfb81d0e16f184fa5e78f3bddca3a5424162459f1df90fbeaad806e57b3f7aad", 0x8d}, {&(0x7f0000000180)="6c147006176e51094ad8678f47479136f41cccaca88a51cad8f7413921ebef05fff5cfcec6709155b1ee728a3dfbe4bb00b8fc350eb4bc5f7c5a7d0cae3c934657559aa9ffc2e1", 0x47}, {&(0x7f00000006c0)="6c33e25d6ec1e8f07921675b8e789f0f636e087927341c103ebc6c416e6139e5609a45772bba32d0dcc4180414a094ee4185a1d221cc4c6ae452992575ab796a3933fc60148d7263fba232fd0bea3609a2a5ff6412e0757316c322b2b6bcc13f209fb527360b27a1e82ea59468a97132aa4c6db38c33a831839d8d15366896035e603862eb9c3a0d9315f67638d49a0f6f466a3d564641277af45842a3a3d9ec0cd1e1af4837bb425abb4a63ed5659354004d709b32660f22b661c69a34f3de58b3b107065264d91ceae673854a2803858f7cfe39215c779960bdc15dc248f19d4b1403e28a144768964d9b82a719d989e5626b2760c40af", 0xf8}, {&(0x7f00000007c0)="6c8cd59a88d3ef2a8299dcf2ea3f180d5dcfff474110d5ce64393096f104c88468ca09794b7ff63d197b8217db97a5203cfb5d0b63358dec2fe8681899b0c534ac36fce5a32af97317449f836d9ce1bc3eb35477b991e3c8960bd20efb029a5f5d8d4bfcc21b08ea75b957bee5c5211cc5af64820af1c08e846189e4b73ade296a8ac9371b499e1133409177453f3b73d5bf0c38ba51076110f24aeb9e2b8ae1dab1d8033d30fe0ba0aa0b6af2d3b46a5b133723c7381887354e816a781eee1fec3be6a069565fb488c305b2e629317d29bcc0f490509528", 0xd8}, {&(0x7f00000008c0)="23bd220633c9e89096369b6c105850fa758735cb7a33615b160da55270f95b36b736fb83c251abe84d413de19888f8152a39bfa321b1737151d903808707c905f063f157875e6619d8afd1571c5f9b2e4c629eac53d533a300bb84a0e12d1e7b78e6aa5e16b191ad4b7dee7288d1ebe92014cebf79f00cb35763b0d936065d9cf51d179ca49ec8c44ce4ed74403758f4c3871c6af5edd52c5a5f31248111a9d668fca132628b27e94ae2a43737b93f", 0xaf}], 0x9, &(0x7f0000000a40)=[@op={0x18}, @assoc={0x18, 0x117, 0x4, 0x716af1a}, @op={0x18, 0x117, 0x3, 0x1}, @iv={0x100, 0x117, 0x2, 0xe8, "80397671ee4d67759d64aee6415e88ecc5e7e1a6e330631e801f7f80b5f6672117d5764467ed3fbd40752353a7c3828795ac194ab5c41341bb6b363583b647b49152c453f189f8145ddbbcb6d2197c6c9d82a0067c06aa679f9222f07c8e0e1dd73b4822df8702b930167812f145e7b0a7051e8d4615ea4cae5807559fdb0cc400b057dc1514f0ec2e1797be12588fdc00e75230a6a03baf7562a7e36d7bc22ffac2bcd56cc5de09ce63f1014a831641222f45ead41425fedd2b98058aa72b05c6a63b2a52da5ccfe35086353524f9739e0f055cb9bbd87a67eee5c74fa1d2bff64f77d9566e3dfd"}, @op={0x18, 0x117, 0x3, 0x1}, @assoc={0x18, 0x117, 0x4, 0x800}], 0x178, 0x80}, {0x0, 0x0, &(0x7f0000000ec0)=[{&(0x7f0000000bc0)="b000193af0c3e2731402b5d382fb993e5418133cf7f20755b6e47348ab5fb080a0bb1538c1aafdafcda51d753f0545a1d2bc17859adf6804f572a046242d5d31d12d0d51cdc863e9c6f753d333b17671f68b07c0ca0d165b5399eb5f497ae841b3f42e44a1bfd00488a654730984f5a4e7e92155fb02803a66bd503b9b8f96001131229648", 0x85}, {&(0x7f0000000c80)="fa9dad51613e30871d05c885f541a7723ed5929c51d4b9c44521776c961dee9cb7f88ca9ebeaddafe8af248a10d06228dcbe3a3f8699ec850dd4c22a707083cb6c9c1d13086558a9ac589e7717803fabd9e126d4d3b3778cbc825f8d76bfd7b4d61b74a8b4518474a2760562f70afc7a379c5b780ca75b5db874000b34b03bf2f8625309436cfcc9fea10ccc925373bca91a6052c8a01235e2f2e0d889dcdf7c95ee3c670b327c1b768e91429321db2131de4ef3dd3ca677035ee300cf7d84a03cafb135a0e5a9b0140f392c0847694e5afaf7e1cf8f484fd1df0c40373cfb63c2c836500d2fbb47caa0b91526", 0xed}, {&(0x7f0000000580)='g', 0x1}, {&(0x7f0000000d80)="f3893aec0c0801f7cb3f6a6e7a23fdc65eee37598399c7cfb0932338003c59188897c2e7cfd2971b494833306b53336e5808a6d241b2befa0c9c9af4461f971eccdb676bbd06865fd333afea2b96ee51b7988b316dbd7cc748fdb698b5b84b751b5d0434b570594ecef496539cc6103d6c92c5", 0x73}, {&(0x7f0000000e00)="8347e0a76577f08591d65098beff36d171c81fcc77c158416abe690ef1de73fa9730511f844f17f6407fa249f7a4f40468b308bda64d1878fdb0d8fdd5372e5591f0dde6959b540f552a4dd2821dee3584e1ba6c774a5f2e730fa5ddde68e66246164d4fec15075cd10963aa6b5ab12d4a29efebba7d5110cd7add68cd9d67e51c04323e91b2473610e1b0beb05c03e0d87bc023f770a684", 0x98}], 0x5, &(0x7f0000000f40)=[@iv={0x20, 0x117, 0x2, 0xc, "a8238e9bd733435fe01b6a22"}], 0x20, 0x1}, {0x0, 0x0, &(0x7f0000001240)=[{&(0x7f0000000f80)="97147cea30540f8dcafe08b972d693612860a386c957b27ce8414a5ac66ff75fbadda1229a9a92a0a2c2804e55df5b8162536e15a77cd189e14e999c639054c435bdeab1356309adb44be522397ef54e907566d4292f62621125570bf193051a64cf431d707c2f7cc12e47a7ae5a5c829881f5547f9381f1585694ffb3352407a0d4eaf0ec340a48e4fbf2a3fc937b7f3347687f2f", 0x95}, {&(0x7f0000001040)="64508992ba8ee308afb49b6cb6c8b80a7bd1472594f3987cecb7e7afe6baa67fb6003b97dce66d7bc68941e5775b6615765f736afcbdf9dd7d63a86498b162951aef9eb09048bea6e012ba26a0849e1c142cd926ea95226b9c9b45284ff578faa21faf2e6b8c245e185bd3800f92500a079d6c3418c0bcf3dc0063d6e42735de1c124eda987f16ca9d24c3664e00a7c0aca38914fa80851da75dde09c9c10e852addae8c5756d626c0ccc1e839a5422f7818a81c362b5f055759f5ebed8e7c91447632b4f4d1993f97c3a6d2285c9dbb6a", 0xd1}, {&(0x7f0000001140)="bdb08e12b7ffc3893d079bfb57289a04ad34ba2fb5486c20ea6ee43889e38801bd2ffd6d04576ca0a837a925a6e92fa81456e24974ca9b0546407cb9642920a52a3dd5c4af152c8bf1489f09a33ad17df706bcb848637840f15179108da8dfaf917316bf9a4ad958dcb8da095e6e04686e6470029a23b1c0dd96623a92ef27cc0521389b8c76ad0f36f6afecee974ac75c6f76ddd814e6a4", 0x98}, {&(0x7f0000001200)="1dd78088", 0x4}], 0x4, &(0x7f0000001280)=[@assoc={0x18, 0x117, 0x4, 0x100000000}], 0x18}], 0x3, 0x0) 13:30:22 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000007000)={0x4c, 0x0, &(0x7f0000000180)=[@transaction_sg={0x40486311, {{0x3, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x18, 0x18, &(0x7f0000000040)=[@fd={0x66642a85, 0x0, r0, 0x0, 0x4}], &(0x7f0000000080)=[0x30, 0x48, 0x58]}, 0x77328026}}], 0x0, 0x0, &(0x7f00000001c0)}) r2 = dup2(r1, r0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000002c0)={0x8, 0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB='\x00'], 0x0, 0x0, &(0x7f0000000300)}) [ 581.389042] ntfs: (device loop5): ntfs_fill_super(): Unable to determine device size. 13:30:22 executing program 4: preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f00000000c0)=""/148, 0x94}], 0x1, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000080)='io\x00') getsockopt$inet_sctp_SCTP_NODELAY(r0, 0x84, 0x3, &(0x7f0000000040), &(0x7f0000000180)=0x4) write$binfmt_aout(r0, &(0x7f00000013c0)={{0xcc, 0x8000, 0x5, 0x326, 0xbf, 0x30000000000000, 0x28e, 0x3}, "c95edc264ba8beda650d6cd7bb5452a8c3d7973f9e17d3217b7aca05b7fc9ca67bbad666d66246e749afa8bf8475a62b9404f28ce6589a3d288e40a0c5296c3659c1eeb57b9a74f4f7e7e71d77f349b1c7de88f6673096db77190cb67a657f5a270d0b89c87ad2fc0dcc9f4d0bda15a49248a60a2f9f002793fdade2fb682f7d601a107d752928620773e984c08b0720a934be6bcea015386ac3df9c6ffbdf25cc5e3a1da135576ed5b087bfe4ddc28baabef476e4422b04ce25bafed4cf529234fd1c21f9f94e473ed8a322aac9bd92930cba5585499c43846059401c2edec3b9f57a07105def92425eea9e9877cbbae736d98f0cc87a598a0a8a9308eed14ded9b166b8c4793bc845f0b451d6b46e637e9e5186b3990cf85690d239f0131d7c282b281ad474bb1396295c70134740c0e9b1aff7a8124f7515becc739c3db1c89cacddb4f41b8e8ef0de62aa3824ee45df146717ea05121a9e9a9a8158d6ef47e8dacd9dd9dcae04279e5e5a70a88fbd8bbe7997750ead9fa60e00cb57992b51e783ba47f5f005d1c3090d9558366a04a4fbc2490521668fdc1300477c2b101fe0ea0d71f421a26be29ac9f677f317177290f85ec9b001936229a508594a5d00c6da4add661fd06474eb890eb35fd922300f33d1b33cb3dc1df57661852ebb07903e3d8b3f4000f29612254e5c33b7bfe999b0533570bb62998ed949f155f4bc0007518871f2ea9dd5133475809cf1d4c338e4064757e55d8cf793df2453dfdf36c3a1a209a9c4d9b57554f45da8f2d4eaad503b75d58b7acbfa393faf52aa0af7eafb5d670b85f5e457159ecec0ed111f8448188788bb013bb4ff59888ec18433a17911a3c7bb72e15c065fd683531cc16cc4bf0b0bf455b0c7f9de244b104b6ae22bdfbbd373488a21f65815ba426ba110422fd199d29eb5dd05603c2b9bf62390438bf04470d50e5dea7f7c07478e087040808b61d9240cadf2605e6da587f83b2d800be970de6d570a52a9a393719b277d34dd7889104f531b4f91ab25dac337d68674396d3b0aa6318f21f7394e4376eb179c92c6bd308fe9250c4e908da38b73c3b8ac6e067b158d17261a00a09b576595ab224fcce974f0816aa9c041a69558839b3bcbc2d7cf22306b0d8d109adc1c064bcde21aef598727d249d4823c8b2e561a7f09a15965e3c0bc5af11d6890dbb7d51ca436ae9d97947bd3afc6d2863d0c91c34100f1f016d60df6e2401295383cbaa0b01213c3960662f3ff8b37e977a923c62f9a8f0d381d15751c0a0d0ad9d3f20b48890756a59285c782ef187ec5463b6028c36d18874d852a717b1a8aa83d91125f0f6fa8df43465b5f3058d60e1a6d296600c25b087318ee2b214661c2928ea98916dc6e1261fbd4f57af5556f6334e34a5c195cf863760bbfdad69580ebb7dac9395e1afdadba32171a2840f8ef494efeb947fa8651181366031eabda4d73ba4fc030101dd661732ac77ad624dba58b86b4a87273b3e143cbf040ea670bb05f17e9b85e30a75f26052d4ec8675b565cc0783d14a7d36b9a09ce1becee53c6c5e1a33032afe526b1070124ba194daabfba7959e30318317da862ffb68c84547720ddf885cf4b39edc62903c44731d68f8a758768b7f3bf55c8da288824fd8eaf40eb94b84ce76fbf7013e4f85840ef87f13ce01ce5646372d8926350975ccef66154886c620fcc56aea51c93ac5bf54c85406b75f8b5c6a978109d2d851926517f16d8cc292cbe2929860362417e6601f20348d2b6382c4e30a68b4775310d077200392ebd349f0201d37b1a11712028bfc787488a79b4f1c01f8a78c1744122630b574a5ad4cebdab5e4e3c2bd626f488ad273a72c779f4e4c5fee81b02542eabd617b3b2156f072e9f282770eb452d9a129ff9ed52ae9864589439e003ee2d09f1082639a411fc17bd499fb0a70034dc5cb8bd59c5ff2761a2588a5fc47fea8c93ee5a647dc1f1bf5ef8484a27c0103a089d1ac63a48b6fe51052fca830fc8aa79cf0e909a4d93e8056546de3f7c8850aa517889093260dce8a4b0a03d6d93be9fca87b161480339bb28a06d29201ff763449f326006bea6b14a44c0570cb55ea914017c5ba9c624bffa14d6b8ef45ebfe2400d94e91da232690ed463389be9af969ee754bffaf2d5925509da09125daef28b06c425f007d1c6e1357b2838f382f70668bd0c5142218e598932eadb73335665fbd63c2e9eef1c000ceba8fb01b651b499c7e9c7f7fea1b5e5b4fe5ae8ab523002728112ee1f524b90328b61e56e82d8da79794b5b29ca99d193952ecd651fb8e7751c7780f265923dd24614ff50c7cc693bb4929fedc888d65f55006af3516620e45c19de1f0396f540a86d809f266cdb225505de44d297c8b10dfc040d78e66e1fc24475203e243aaa5055e2b90ed015dafca4961f1a2ce0e4afd180d1882dd9ff2dee0663961a524b19040fdeff913ea6c5dccd7ba858186a6e6873ae611cbf53bb172905d481f125568203170b660e8490e11ee081ef93e25bb7afb8b164f42d8bed84190a9bcbd5c97028a534b9ac038a8fdb599b00a7f5cff18dfa395692c527a4d24cf466ab1b9801cde0bf19f8c7b9cec7fe264018f34cc71c35447d171c8ccdd160b31809f685757aeb3d3d034b63a13025d1f462a335165e5ee20b7f75c8964d54d157b116a6bb5f82d9c4663461f72d64d6284fa0428e9fd1c46ff8e0db02dfffdc4938fba23fbdcb6e8c8777d5cf02d1a27aa4aa92810ea99fc442060bdb4a688770970793de9c148fdb81af3e84bf49b9392faaad9d1bad45e36d75cd72bebca8bf2827e3579bbfb62e75b61e49e4f6e71bbdce4d1da498b0abf4e33234c2ddcda4014867f80f0f9f4a26632cf9977f5a4164e8eddb8ca82f94f7a2aa9dafa92c8bf269bb97a1ac602c7b08adbf8836a3116d5dd6c9e65cef27e0ac6e74fbeffde80617c025db1e3a511c4c618aefd2ed41d13910f6c1af21ccade2e45c01300dfaa4508f3577b2d32bd1d7167ea263b5bcf31308e2246c774402283c6a73f607076f8bdc299855644bc88cc70bb8dbad5a899bf119eeb5e8d59ba363ffe64965e313f89b4345f1865e36e2a8d20180b5c2fe37558aea0ffc71ff0989c4ef551c33ad300b78f09181793ebc516605140159042c356044bbcd77509d27bf7724dbf70c75bfadeee37aae1f21086d6086447e1e7d284d4aec26d712d1cffd69e78ddd5b653bcdbcca058ccd49e81078947496560e446b0688f60d69e9a8a119d5a494ecb53ecf959b78456ff34641bdc9d50d70a23a3c6829d93a2ba8f7b4221f51f55d8761e5a7e5ee2ecea5893cefa3481552748033d33c3bfaa4d7648b90c353de6628bb130ecd1630513dc3033d8320a0dc00083eee2817c8585dc59a98adfe8191bd843088582523478cb717c40ff6aefc3f7c6a23d2acf611f0309957ac425876229dbef9aecee09c55722afe0c8a7dd75fc0b779896e9d7ac2af7932b499beb884acd076284dffbd62abb9e9c0497fd7e34769d6d29d00ef07529ebad66bb26faae895e31d8034acb19455244d4d2b974e045f7fb352738ffb23e76c3dd07d7ac0bde519b979ae4ee8a1d2cf0b623187eee74a765c8f4892d925337800050c9de9ede180966378bda86d67ead30fd33f9a525a7cda7ee5bb3c6504fd6588fe3553f9d6fc1e584ff04af2dbab0a3b0ec4aaa4057e5891e21100d94b1abd47495db96d8f437287615ed0d1fb0bea05b8c7530348bc3d610dd3fcda72ad690f120a9897aaeb4e5592d1061c4dd13bbe6cde68866a8d788006d0b601b307c1f7fcc6bc6458885e23c843737b206c44ee149286185e6e1b7b7bc281b1735b0b062fce669537694cb54074914152dde8708dd2c167d03dee6c4f28f9cd1faff1c7b90ab30ce0be3b1e668cb6120a7a6831f54d61c3d74acbf21cd80fb17b9e89306023329249500512895537cd24682100ceb4d04ba7f5152b79b7d8ac9027ec3e0f629366d7dcf8d5cd04e43f2b477a590939d34a319c4e0eb416e568e48cc6ca1c49fe47413df6899e07c3aac68b42e4a77c5da144c222f66b21c0475bc338e79674007861d084e45e2cf91052e08e539d58a22574183a80f14a0671ead1af7ff26e052399e33582d101193d983c83777fb445d400d4c588813bc9ba3f6d22311bf3404e2e507ba64eab5af2f15650d74a7146f03794c458c8a0a7fe0be3c023543c4e9a272c844cccb98685eef77bace32fd7a5836081150e9d392cdaffdc6a024a56f2ef296312b3dce010912ea69fc3f8871d30b26b312f57bd5069b6bdc1a717eb20bd8519ac8f714a3aaf87290707c0e4ea0bd3bea28d4c05b100d902e0b85261a0c2cf4315e8db63919551716b15f2a9fc3ca97af8c4d45783fa01b32cc9b322682e4f1d83bb66ab3a8c32d9f2616a4d5ec7f5906918992aab17035bbf5e683943bafe3cd04453c2921766256a6f845b4befbd5fcd7637512c8952e59bf1874583a50b7bb23d99b86d5cbde083be8cc0609f74621b3d0e671e3afec581acd3ae1bd01f2c1479cc2da4664aa831f6c69846cd86e15eb74e84a50caf9e993504dfd634aa1b26b69871a309f6e979eba8409657648e921fc894f83258068eb67bc68190d2b614e714ba87fd15be49486bd1c18067a969e269de93185326a265805ddfa68ed63375a2d2ddbcaea4d1532e304a8fd900956f1123be95bb8d58d66e561c545889fe171e8e578ee94a90b37ab932ddb03b933ee1a9824186182b76c9fe89bb77c7e0857be761fd6333a97a2b77f9b3fa41395bca1726d915633a1694fd97aecc071abf4f674f1439032a732fb4e138d029b5881cff52ba03a535cc02eb3228e7922cd15a777d7403acefd4c4d27720f41930c823029dfa2387fdccbdd4029d96fd012201b82daa7ce26dfe0a74f3def21597353a1488689e323fa5f63ff916516a3f8ab15fd6869b023cf2d72953ee6e2b0c71bd0a5b74b976dbe7f1cbd97a8de75f9338052c35b6d08643fb4fc655555b384fb0cffaf52047da3c88b9ff11fb0df8143d5ccfea682a7014ac7095746ae79ed31da1dec17dd2f90ea1c957761425cd4ef59611b511677087ad13d97cd56d979c504a68576b534cdb096ca95b41c2ef6f1ef23bb1e726dc24fde72f3b26a9f73742cb5018ba24dac1654c357fcca6d1aaa504c6ad031d6afafa7e096a6c6f9466c40067291719bc7dd5cf76b07ce61191ecae95a32c6fbb2775ff27dba2e0570128dd717f282f76a2f62c00c63d77d496735d8ecfd315e868191c9bf72e00159a4dadd031063c41d5374d2ff11ac359eaf8cd2bef8d08a1c400422fb7761fe177dcdee8296b37f4c4385bcf5e6a2168a6292b6719553d3468a8516b4edda8256dfa57402afb377c59f1171fe58169d4047d5535449d513da0d5cf8786f35ac54699e3697e88026074f382a53f90909e3644c0abd4abf6bda24e3820bc05a64495e2eec96abc9f1eeb4e2ea3ab33e954ab56d8487e16b59cb8accbec1105aaa5594db20a8ed78a8c5d81dd8dbd115a1e990a2088ffbd8c7809f2b0db0e806116e2cd639a813a5bf3d95116d361f36b86b3f51b8f5173a7cd373707ad27ec0f25f33a6ef01cbc57e58426febb9fa38365d2e88adbd5b2d2aaa11af0e0fa0877d39fae9937a4320e2b7d65b0ca68ff48bf65019dc1093431b070891986001bcf4c76ea4b882e94c3d5a4af326a164aa3f03bee5953ecd55a0cb896af7cc3789aea8ca9c6258aa05209f23caaef024bdecb27262801bd0d68", [[], [], []]}, 0x1320) ioctl$TUNSETTXFILTER(r0, 0x400454d1, &(0x7f0000000000)={0x1, 0x9, [@dev={[], 0x16}, @dev={[], 0x19}, @dev={[], 0x16}, @broadcast, @local, @remote, @dev={[], 0x12}, @dev={[], 0x20}, @local]}) open(&(0x7f00000001c0)='./file0\x00', 0x80140, 0x180) preadv(r0, &(0x7f0000000480), 0x10000000000002a1, 0x0) 13:30:22 executing program 0: r0 = socket$inet(0x2, 0x4000000803, 0x4) bind$inet(r0, &(0x7f0000000000)={0x2, 0x0, @broadcast}, 0x10) getsockname(r0, &(0x7f00000036c0)=@xdp={0x2c, 0x0, 0x0}, &(0x7f0000000080)=0x80) setsockopt$inet_pktinfo(r0, 0x0, 0x8, &(0x7f0000003780)={r1, @rand_addr, @dev}, 0xc) syz_emit_ethernet(0x4a, &(0x7f0000000240)={@link_local, @empty=[0x0, 0x0, 0x0, 0x8060000], [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x3c, 0x0, 0x0, 0x0, 0x4, 0x0, @empty=0x9000000, @broadcast}, @udp={0x0, 0x0, 0x28}}}}}, &(0x7f0000000380)) [ 581.532324] binder: BINDER_SET_CONTEXT_MGR already set [ 581.532954] overlayfs: filesystem on './file0' not supported as upperdir [ 581.558292] binder: 29188:29192 ioctl 40046207 0 returned -16 13:30:22 executing program 3: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = socket$inet6(0xa, 0x100000003, 0x80000000000006) r2 = socket$packet(0x11, 0x808000000002, 0x300) setsockopt$packet_fanout(r2, 0x107, 0x12, &(0x7f0000000100)={0x0, 0x4}, 0x4) sendto$inet6(r1, &(0x7f0000000000), 0xffa7, 0x0, &(0x7f0000000180)={0xa, 0x0, 0x0, @loopback={0x0, 0x8}}, 0x1c) pipe2(&(0x7f0000000000)={0xffffffffffffffff}, 0x4800) bpf$MAP_DELETE_ELEM(0x3, &(0x7f0000000140)={r3, &(0x7f0000000080)="e1577e5d008cf4d3fc45419fcd858ee52787bd55ea57afe5f2ae5a042ca203a3c736eb99212fac21c0f719d443263ffd1b46904d2fa58a8732c2a03b496f29dad985fdb511bf08b41048f058225e24cfa83ebdd777efe408b61c83235d139c"}, 0x10) [ 581.608245] binder: 29188:29192 got transaction to invalid handle 13:30:22 executing program 5: syz_mount_image$btrfs(&(0x7f0000000140)='btrfs\x00', &(0x7f0000000180)='./file0\x00', 0x0, 0x0, &(0x7f00000007c0), 0x0, &(0x7f0000000380)=ANY=[]) syz_mount_image$ntfs(&(0x7f0000000200)='ntfs\x00', &(0x7f0000000080)='./file1\x00', 0x0, 0x30, &(0x7f0000000580), 0x0, &(0x7f0000000680)=ANY=[]) mount$overlay(0x404030, &(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f0000000100)={[{@upperdir={'upperdir', 0x3d, './file0'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@workdir={'workdir', 0x3d, './file1'}, 0x5c}]}) umount2(&(0x7f0000000040)='./file0\x00', 0x2) [ 581.673684] binder: 29188:29192 transaction failed 29201/-22, size 24-24 line 2834 [ 581.673964] binder: 29188:29205 unknown command 0 13:30:23 executing program 4: preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f00000000c0)=""/148, 0x94}], 0x1, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000080)='io\x00') pread64(r0, &(0x7f0000000180)=""/174, 0xae, 0x0) preadv(r0, &(0x7f0000000480), 0x10000000000002a1, 0x0) 13:30:23 executing program 0: r0 = socket$inet(0x2, 0x4000000803, 0x4) bind$inet(r0, &(0x7f0000000000)={0x2, 0x0, @broadcast}, 0x10) getsockname(r0, &(0x7f00000036c0)=@xdp={0x2c, 0x0, 0x0}, &(0x7f0000000080)=0x80) setsockopt$inet_pktinfo(r0, 0x0, 0x8, &(0x7f0000003780)={r1, @rand_addr, @dev}, 0xc) syz_emit_ethernet(0x4a, &(0x7f0000000240)={@link_local, @empty=[0x0, 0x0, 0x0, 0xb00000000000000], [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x3c, 0x0, 0x0, 0x0, 0x4, 0x0, @empty=0x9000000, @broadcast}, @udp={0x0, 0x0, 0x28}}}}}, &(0x7f0000000380)) [ 581.741686] binder: 29188:29205 ioctl c0306201 200002c0 returned -22 [ 581.815596] binder: BINDER_SET_CONTEXT_MGR already set [ 581.850979] ntfs: (device loop5): ntfs_fill_super(): Unable to determine device size. [ 581.864320] binder: 29188:29192 ioctl 40046207 0 returned -16 [ 581.883527] binder: 29188:29205 got transaction to invalid handle [ 581.904005] binder: 29188:29205 transaction failed 29201/-22, size 24-24 line 2834 [ 581.943381] binder: undelivered TRANSACTION_ERROR: 29201 13:30:23 executing program 4: socketpair$inet6_sctp(0xa, 0x5, 0x84, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) getsockopt$inet_sctp6_SCTP_DEFAULT_PRINFO(0xffffffffffffffff, 0x84, 0x72, &(0x7f00000001c0)={0x0, 0xd7, 0x20}, &(0x7f0000000200)=0xc) getsockopt$inet_sctp6_SCTP_GET_ASSOC_STATS(r0, 0x84, 0x70, &(0x7f0000000240)={r1, @in={{0x2, 0x4e22, @broadcast}}, [0x7, 0x6, 0x4, 0x1, 0x3, 0x660, 0x81, 0x8, 0x9, 0x6, 0x3, 0x7, 0xffffffffffffff81, 0x5799, 0x7fffffff]}, &(0x7f0000000340)=0x100) preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f00000000c0)=""/148, 0x94}], 0x1, 0x0) r2 = syz_open_procfs(0x0, &(0x7f0000000080)='io\x00') preadv(r2, &(0x7f0000000480), 0x10000000000002a1, 0x0) r3 = openat$vsock(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vsock\x00', 0x199680, 0x0) ioctl$DRM_IOCTL_WAIT_VBLANK(r3, 0xc018643a, &(0x7f0000000040)={0x20000001, 0x9, 0x3b}) 13:30:23 executing program 0: r0 = socket$inet(0x2, 0x4000000803, 0x4) bind$inet(r0, &(0x7f0000000000)={0x2, 0x0, @broadcast}, 0x10) getsockname(r0, &(0x7f00000036c0)=@xdp={0x2c, 0x0, 0x0}, &(0x7f0000000080)=0x80) setsockopt$inet_pktinfo(r0, 0x0, 0x8, &(0x7f0000003780)={r1, @rand_addr, @dev}, 0xc) syz_emit_ethernet(0x4a, &(0x7f0000000240)={@link_local, @empty=[0x0, 0x0, 0x0, 0x400000000000000], [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x3c, 0x0, 0x0, 0x0, 0x4, 0x0, @empty=0x9000000, @broadcast}, @udp={0x0, 0x0, 0x28}}}}}, &(0x7f0000000380)) 13:30:23 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000007000)={0x8, 0x0, &(0x7f0000000140)=[@acquire], 0x0, 0x0, &(0x7f00000001c0)}) r2 = getpgid(0xffffffffffffffff) ptrace$poke(0xffffffffffffffff, r2, &(0x7f0000000040), 0x4) r3 = dup2(r1, r0) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000002c0)={0x8, 0x0, &(0x7f00000000c0)=[@release], 0x0, 0x0, &(0x7f0000000300)}) [ 581.970417] binder: undelivered TRANSACTION_ERROR: 29201 [ 582.326620] binder: BINDER_SET_CONTEXT_MGR already set [ 582.332119] binder: 29245:29246 ioctl 40046207 0 returned -16 13:30:23 executing program 1: socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)) syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0xe1, 0x400100) creat(&(0x7f00000001c0)='./file0\x00', 0x2) openat$dsp(0xffffffffffffff9c, &(0x7f0000000200)='/dev/dsp\x00', 0x8000, 0x0) syz_open_dev$mouse(&(0x7f0000000240)='/dev/input/mouse#\x00', 0x100, 0x10000) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000007000)={0x8, 0x0, &(0x7f0000000140)=[@acquire], 0x0, 0x0, &(0x7f00000001c0)}) r2 = dup2(r1, r0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000002c0)={0x8, 0x0, &(0x7f00000000c0)=[@release], 0x3f00, 0x0, &(0x7f0000000300)}) 13:30:23 executing program 3: pipe(&(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) write$eventfd(r1, &(0x7f0000000000), 0x8) close(r0) openat$cuse(0xffffffffffffff9c, &(0x7f0000000300)='/dev/cuse\x00', 0x2, 0x0) splice(r0, 0x0, r1, &(0x7f00000002c0), 0x400000000003, 0x0) 13:30:23 executing program 4: preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f00000000c0)=""/148, 0x94}], 0x1, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000080)='io\x00') fsetxattr$trusted_overlay_upper(r0, &(0x7f0000000000)='trusted.overlay.upper\x00', &(0x7f0000000180)={0x0, 0xfb, 0x69, 0x1, 0x100000001, "02617918d4f65908f94f3d6ed4fdd70f", "0397dc43f54bdd17a1f7760f865cf8d1aac1548f99d53c75882c936ca5da35d3442b86a7b989a27fef8600d9769156cad235d5db391fb7b79cd4315bfb0562dc70b65ab1946bba0291c6f4f932cf42e44458c61f"}, 0x69, 0x3) preadv(r0, &(0x7f0000000480), 0x10000000000002a1, 0x0) getsockopt$inet6_IPV6_IPSEC_POLICY(r0, 0x29, 0x22, &(0x7f0000000780)={{{@in6=@local, @in=@local, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@loopback}, 0x0, @in=@remote}}, &(0x7f0000000880)=0xe8) sendmmsg(r0, &(0x7f0000000f40)=[{{&(0x7f00000008c0)=@can={0x1d, r1}, 0x80, &(0x7f00000009c0)=[{&(0x7f00000013c0)="c0c85df00eb7bcefdc3ef78196b4765a3cced00fa25e47a4a0f5ba3a80f029e68ced28b6110c209ba7159cab0c83d411496076b2915d748da4f4368b4ec6ed18f3c5917e310eecdff821dcc908cb0620d4d93fa266c2c67ab596008e39a9c0c7875bfef2de22caede364728a0eb2bc5029e026d0ffe90d991aa87b6e2f482e1fdc10301e742060edf2ac3259dcac722b31efdcc27021f1f85dd6994787ed3e6ab9266df51e02eb88bd18850b48b1367195d9d22302275bebc82f241dea6a5259d92b87c17f8b9e2712304b0813d93ec71107a1ab90d0f57da11ec185182f22d247528ade32cb29b2ae7dafa079a265eadb7f7911665873ebea9363bf3f0109c41313f1b7fc6aa46faeaa2c0a16bd8d69cfe7b8913dbec335cff5eae02d79556385d0779f9aa936460213f15efa03c7cdc7f0dc129290500511c7eddf45876740678443bf4c4c0513c6468a3018e1d7db6763723257538690553f5c9e6711f1028ef010173615462ce47c6f237fe72f00c8515de51f3f5bef6dd21910daf9fd612838ee1d72a30226faf32497ba2d4b13b651ca6b6ba67f4a2589a6d2e396cf8103d30cde23e93ac5efb7df9396c55b13689036444a219ac8ccb2636222e9a8ac801c35caf5ade8b07a610460927296e6c67f05bd95c4b625cfcbbaed88025f3ea18898f8756206ca59db3d783cb403532d4258ecbaa282836343e96aa30b6959e40e4fbcf6aab0390a86b8d9d9fb93c4376af57bfae3dda0556c37289a6fa6e05dd6134d092050bd7719ca36e8c3ac23f45c970ac3d107e68dde9da19f73326a5eb95975a2c85d47f517bf50af3b8428397ad180278112ce3affa6ada3af6797a4c55380ea144362cf4cc1f252de6b2ed15e00b2757ebae6229eb6ef13a9cebceef0076ff13fdb0204097e2594af0a47c19eea7f7ae730a71a307e725ea8463fd947cffb795886776c0152ae9eeab6a45a427573a1ea64ef5bef45183d568ce26e66831567140f7d2d3f3d7114df3ad28da6ec34b302460358f5cf34a9c09272f6f79d7addf5b1a9d101259699fa2e902e7d4a081a665b64a1f322c5667b1fbd7a9b3876efa52b3f9be84e311bd97cff33b63252e3519678682ea3a3432b556defbe2c7506980aefd0a0744b02d937b8e7ff82a31efe9ef1dc399fe2650a96f3767e3ac9d6ec84b6643d7f1644045e0ee9d7cbbfce16b347da59d6fe51b8ff983b2b32cdebcbf0c179670abd6a3018377e5c56913eae491258b92dee6ca841f0fe49fe9a5babc4bdfa13fdb0f2db7695acca039a004245edcaf2e9c3adfcef72cb045e37cc80fbf7eda56097533583ada34b7a274f00e9dbb7c99fb9bf90ed45956a59ac88e716486bca12c5006c575533cb4ca354c2047c4f4650186b1240620a7bc45fd8b62940f67c8d8a62f5d448c4c06209205c40d73277d4082d697c31643b5c6ef2542c4a1b8086b98ac18e874eb0df8298896df7f2ff4b711bc386fd1b698028ffcb0110da6d8f3615da111cecf47cc139bdbdd9ba8b8efd4e6218d84080f8f70624c9f7cd19b1db97695ec335ce6bf46c5970e7f94da72222ad5e421d3893c16a7e4fbdcd9332affae57c370331a72cb0c86b452eb090a42d1111760d91aa60b18e6cc02c22f015b218cb364d9653c16c6392519b97b59c242445d44f0540a6625d893b04894298fe322429ec9c8585b9df4e35f694530346bbcd2773f7cb653b9263b82778bbf2972bbebfa4951dcf2a43ce39e721ba266ece2845453b3a3ee330c50986cd6be4c775590201f5fa3e47095d447175eeeb32a835ad8f94bcdc61a6d4acd8842672f2e40dd774daaefd585643883a6099c31017a4fceed1c64697a7079b3730715f51569513a4079e332b46cf5906aaa238f6a74d0713896f59b7eb668fdbe02227f87cf346568b89125e61886aebf0de1757b627d95e6d445b9a98990cd0487fc2fc9eac92f84f8a771200f7b8eb713675da50526cf62fa6adc5bbb73ce6a3fc927d64caf9769035c85e4f8048f9cb055620480c42b587602aaef019f68f1aaef9a182332fac1ac50ebc15a56494da889451feca60551e6a7051a9a0c79d0151be345ff24c83ca88091385a5bb725466289ad91cbd08a230787bee01c84de4d2ac02e464d50f49d63b80281d8ffb6f9019e1b7e825075f2dc7bf42014bead10c4221b556d8f80abc0bdc4a828b76783ee502df2aa241ce8637e56f9faf524d259930686cd8c73a751b099b2456e18749dc7191b9a08f686777ea5487c5d59334042ecbf011c8769390b6f7c29807b0e84f9074ad5781b2f97b668baca4eb71aa69d9e53e768a3df0dde408908b0c1bba9b86829cc7fb79778a421410d1267ba74c4fec6c3f6072f0e06a829572c774a04af5953d0a7a6e873bed28474d62aba79cc07f0b4211207bcc831fd81344363dd0a700c450673fdc2f8c0bd273f8c68a827ace36ce91fc4b1b38bdefcf782da57ecf45d500de2e2a39977f45d2de626a1941661069535c649cdc0d409c5f0281f7d148b9b3da4fef3898096322193e088f4b05e1d4c28ce5e6a60d78f8df3dd552fdeeddc9cfc36ff79e3f03a903316bd610c19ecf385f9db07bb3a886d10c73946758adb2140279584bcea5aa244d6c1052cb94ba968aa7ae804798f83ac47f67ac63787fa68452f4378aa49b1d2d22db349e4b223230b051d2a913e6048435ba807de12d4850848784eba3c7bc7d7a0bf11b9640cf99ada2d0126d177bc8b49df49cf480c9d0cca7cbd0117052e99c98c7e8dc93950380e69c7693323e41c3fe53e8586ab0557c15651c2ca85bc4f9396f5392bda0f2b6ee2f84c4bee42f3c65d2cc3a2cfd38a910d6f0f9d57274c023e3993f4b9013f6888918c73f9de4b98a614da9c5f0b386138df504cfb70dfc2279047765ce9f5dab4d3e6ef7fda1d2598e156636f32cfd379047d515f931fb09b1f03a619358cd827c43fb75fe6a5a06af2c7fa77268d7199f7c7cf56ba4b97679cb2ebdfbea3ef980695ea019b4664dc83af09b1ac45166f0829282ca4706a01c023c718a62902e3fb9161a145b1325bb5e418df0b86795c1715966332a1d6522ed56a968bd6b8d23a842854e055aec9dabbc25a9361097f757d743aab0cce269e4aebcf65c60829f8e6919203b392c0d75405e458f7ee671491a7ea4e8aa9de4915ee2a7a032601df5a838c3155f7fbc0b1b8d36177cf9034055ea398b7c8c513f0c9b9eed1914936b63c14a13bfb5b920a4b9ba184ee4b1d06629eb458179096d8fbae66c800a3265084905f5dea3233e55dea4abcfeab720b166be87234c28c4e3f8333f4735f47f164e439fafcb4f87f0188fbd916402c215d9d868849c6dbf96d304d704b426df18dcf8ec9b8abe327f090deb22d603e48b77de2144b152a90fb22800aaf774687a72c09f99048ffacb0b34f95a2e6e4363194c7f3224e75a2e79ec8d69e24969f82a72a7be85bed09f6aace115b75bc85366d2ba16acb8316553b051e491de905012082a177946e16454414850970d4429864643166dcb5897728ef6e15190852f1f03d9a22b1ac6bfa6332b27b74cc1bd64b63e20519b524cea27e3ba4c0b7058d1b2ed29702846bfd56b6a95e4e4a5dcb6abe6ab869e96b33abc3affeb5a4403a46baf44d46162d73f106281e5265f0d640dfe2f4df7b5fbf5d05b9aff6f7bdf9595faecf61962f0e130dd4f1d26ee5589c304c293648ed3812b86461b7dca02b3bd91f3e6e9168586868bea92a92baed0eaf50f148f35974ea86b96701471dc8818b17bd3c7b9e003df25373a3e4a7e73a3bba84bf4c95b5f64017cd77269b86184a786e1506602a0e2c4a6085ec65f63ce2c1d3751ec8d9b54eada9620ba696c1b3907dee7a8cd801701b7d51371131a590ecb347b8252eeb6d2779050235e3ee25969d2cc0ce6872af68ba2c2e9eb6349213fc518717027649eb94b608f460b6a102bbdfc5778f520387ab1a4e3b403817ed09255d702b631cbed35734ebefdf2e413b8fbdef4f9ca3b20713475c3a78c154c2866c0447fe043c39fdbcf97d0796d7deb581243320c4d559d40c465182111863e3525fd8fcf49f1e2898aaf9f9c82ba7cb309488d997a6af7ebe3f4eef93f0bfc5379d06bf207951df7b274b4c5c8993252e4143cf978554d91c6d89a103cfda397abb11342275b2cba5599c1125386f7d2e5e2eb1cf5667e99884390ca0843f3a1e7390677e778cde877a2584f69b7dc6ad1f69a8677c1dd7aab31488e5feb5a88f65bf581c2f92c3d8de3d3b9f2135a2e478e87e81101e6d3b33dabbe147d502cfb86d31594d8d50bbb145e0a08a7fe96b8db1c0879561513b3f518c680bce3ef62aa284605ca5942f5f5bc2d98f71674ba2b44ff8263fa799dd404400952de11925082efab8cb1f66494c6812f4067ef256778ab08fa106098344d0e9abe193ea5fd6b15c799600d989617064a82af84f5fa69f9652ed68765415b8648085812664405c89966c53bef885f9d3d136d5e2bb9e0ce74edbc7c041682b3f41590e84ed9e5989377c5c9705c6e95fc331705888ce2f19144821a0fde5cc6d5e6eb86a6660d726311e4499c3b0122bdef2c09276dc091617922f996488c4d5e7e461201209f051de7d64f56344af90a32b31469fa3a1ab9fc3877bc01878e623e08238aa7f28965e873508c15c25244f6ceb72e9b6897bc9c379b6b1ee28a2740f8eb23533007e20f76cf7c201052ce5fa48cbce2c12afedaddca550f4fcbf8cc7399c7a9e2167712b31ed8dbb75eaadb1febf71a7b787b4d4f9ae1c7dee8c1f558d85f4dcb1664535b9fa6a49e5d3a58ba70b79a1ea490793e44c29b1796d6ddd88687ab2c35e69aa1244562333f9900043606600e41e90a9b3afe971474e9667a2da3ab99239114c88c13d58fef31e06ea32c81e632ed30b78a2e897d801c3b693c03175c2ce274cd0ccaaf7bdf80519af4cf330088dc5afdc73d8b35402dba42a6da9360c8277f70d46e4b0d55e691d12b273e19175b6a789d27f14486f7adca5fc57d3c6175e5b78d107e13db145a10ed0576c3e8f0e482fb931cdfcb953798b5f134124f108a84af3ec36e4c4103aacae1bedaa7c9c0892200c4ae703e29e89be7b16483242a186bae28c942df52fbbb284f92f3175de6675b8399ccdbfb081a71cb2f0f5150590aaf3fd1e78fbf8b10b37b55456c7a660e94bf6a1f1a1d471c1bdfe1236ee9bb333a7fc9b08eec5193b2cbaaae98e1133ff94aa33d9277129687894fb9cd9a00ffcfc51844b55055a0941b56a21ea27561c061e42aad4a1e13a09797adcc4e3e5020468fc802ccbf5e376c11c15bb9fc334e2535c3e7d8640039d4fc99eea296ec4f9c2873549a196e60ba61d5b5e4fb75eaf1ff026b77791f050cd6ad8e2134e9f9958641b90eb352eca86ecea6f700c66c6c44e9c200e1b65413e827fad42d1e37953f9cbac240bf23b2c674c833831bf7cb11cdca8815acea80c4f78e9f0fe0564bbeb8a3f13d519522cb1d805ca1d46c35b72b80e77685621ad9f7db8bad727d1dd5ddc2aab336b5da63ebac89ecc42992caf92788aaaf64e4833855e349e32ea512397fbea903ffdd0adffe4cb41042894bc17c0186183c95e222c14cffec1ab0a84d18b1620ab00202ca061d35e1c6aeadd93a0e29b4ed6032bbf579411c055ebf1e8268bbd5aebe3b27270a9201ec38dd65a5db52470a63a2f85bfddd42958265cec4ec0f6b614715e5a48add9583641112d9cec8bd19fadef3e97e700f4a7ae031e3da1aa6a0eb3f", 0x1000}, {&(0x7f0000000940)="ab62727615a37c224bb76948d450437404cb75e74bc43a5cf5b0ea549cc581f79c6aaa6cd56c57fd681a53837aedf33907f2670520f85e9bb43dea04972062073c36d19bd1b5", 0x46}], 0x2, 0x0, 0x0, 0x40000}, 0x3}, {{&(0x7f0000000a00)=@pptp={0x18, 0x2, {0x2, @loopback}}, 0x80, &(0x7f0000000ec0)=[{&(0x7f0000000a80)="418f5ce86b145b60a46bc829737530382b8897de0cfdd2528c6d3e8b4cf8df054aa8dd165062675a91b463602e0a16b862390ccb2a1477bdae67ce89fa7fa7b45a6fb37c844920cbd3d5e012541b6028e42198953d99c51edd3042a59f355c88d5dc707ed93bc985d6b590e2a911e23dcc80b5e86b52f66e0513b5123ad96f3cd68c38bff745d6", 0x87}, {&(0x7f0000000b40)="b000e37fa489ac5a9ca9c6632f6e5dd86f9cfd955fe030712ea58e7b02edbb3d37990c111c97cba9013f186f3c8183247a092f093fa853f1abaa339d9f5d2e84e6ee8b6718e3ec07d2df2906706bc8d5b55930d2efaef2e366078c6fd8bbb949c0b1264196f036cc58dc8bc41ac03dab3da02b3903fe561e9769d3cc6747298fe34dfd9e087dbed6cef9a22d551b8357323df2a7f94c2ff69a64a994137e3d0c32351aec08bf5c956696b9429fb9efb48081e18baceb2598f0374b118afd1fc940c565852d1a317845913f2efc5781ae38ccbedd08245176eb92bcc5447583c1b47afa837e40b67beea9fd98e5cc84b3c06fe0f6", 0xf4}, {&(0x7f0000000c40)="55cb77656dd90fab9bf5d7d386d95b56873486d7a9a8e03399f77b0701b586505a0875e3d48ce45cbd0b2b9276d77be58f304d27f636d79c79795fc017a41d83038667e4f3c1838ce7c672652ce7813dd556796f1fac0abe759acc931544ad675118e5b9f8cf2d84c3b4a843af42fff96dc397eb668a7e5ca489838f6decf963", 0x80}, {&(0x7f0000000cc0)="59ae10d12a857f8de4a03ece743e6a5ca430c117327e2ba8cef43b73272bac3a509f95706e07d120312bafebb3341792c34549506941a4529821293f90f7671cfd2793a288c139c28319755e3ea5a9bcbddce606f845cc0aa1c30c6fa98e61b0a59a8ea1c24ad7ac41ee1633ade955f78f8f18d0e2c14c0073d988c9e894913f0b65f27681e814ef7af7ae282d8d21f68bdc2a87777a24f0577a3b34cb0a04b8cff8747cb614ab4c97672a99a8e8f0460fa9f369149e63ab60eeffad57560d0a88f07b0d8d2c5b2371a354709e38ecf2badb62c79741f9004cd468be0d76954ebf45a243ff6f757e4b379ef10803fbdf48e9672c06f45fb13ea28f", 0xfb}, {&(0x7f0000000dc0)="125213ed5445bc943e9695ab04b8a264ecf96a953093f5a48eaf97234892bf1fe99df9438def9c", 0x27}, {&(0x7f0000000e00)="10e6d8277af90bd641c10b5e45236001f221daa2ce1a3ca3029c00029a29f2cb932e125f0be8d4f3e117e8d04dc56264fc8718cc7dd60f7d8824240f96dc92caa9a940cb46788703ddfbb611f8f587ca533b3b4629484efe8ca20e55dd14f767ec7c99e55e4f2a4b82aa1ee22b026af67a27e2d3c01dc46c0716d94950b83f897584946cac109b43e7cb4ff62aeee069299f8c7b10947bad0b531f772ac8195e2edf2eb52846ff0ba26ebd00c04e9c3c193797d5c66aaf", 0xb7}], 0x6, 0x0, 0x0, 0x8000}, 0x80}], 0x2, 0x804) 13:30:23 executing program 5: syz_mount_image$btrfs(&(0x7f0000000140)='btrfs\x00', &(0x7f0000000180)='./file0\x00', 0x0, 0x0, &(0x7f00000007c0), 0x0, &(0x7f0000000380)=ANY=[]) syz_mount_image$ntfs(&(0x7f0000000200)='ntfs\x00', &(0x7f0000000080)='./file1\x00', 0x0, 0x30, &(0x7f0000000580), 0x0, &(0x7f0000000680)=ANY=[]) mount$overlay(0x404030, &(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f0000000100)={[{@upperdir={'upperdir', 0x3d, './file0'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@workdir={'workdir', 0x3d, './file1'}, 0x5c}]}) umount2(&(0x7f0000000040)='./file0\x00', 0x4000000000000000) 13:30:23 executing program 0: r0 = socket$inet(0x2, 0x4000000803, 0x4) bind$inet(r0, &(0x7f0000000000)={0x2, 0x0, @broadcast}, 0x10) getsockname(r0, &(0x7f00000036c0)=@xdp={0x2c, 0x0, 0x0}, &(0x7f0000000080)=0x80) setsockopt$inet_pktinfo(r0, 0x0, 0x8, &(0x7f0000003780)={r1, @rand_addr, @dev}, 0xc) syz_emit_ethernet(0x4a, &(0x7f0000000240)={@link_local, @empty=[0x0, 0x0, 0x0, 0x3f000000], [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x3c, 0x0, 0x0, 0x0, 0x4, 0x0, @empty=0x9000000, @broadcast}, @udp={0x0, 0x0, 0x28}}}}}, &(0x7f0000000380)) 13:30:23 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000007000)={0x8, 0x0, &(0x7f0000000140)=[@acquire], 0x0, 0x0, &(0x7f00000001c0)}) r2 = dup2(r1, r0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000002c0)={0x8, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="eaf1d8b6c48480d85774c5299dad7c1fcd69cd9a438d9b14b366c02a79bb6bbe5431563e2c6e5fe0ed06d127e39eef32c9a764e42e5ad0cfe4b89b33844ed4bfc433da25c35f9ce721d0ec"], 0x0, 0x0, &(0x7f0000000300)}) 13:30:23 executing program 3: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000140)='IPVS\x00') sendmsg$IPVS_CMD_NEW_DAEMON(r0, &(0x7f0000000300)={&(0x7f0000000100), 0xc, &(0x7f00000002c0)={&(0x7f0000000000)=ANY=[@ANYBLOB='P\x00\x00\x00', @ANYRES16=r1, @ANYBLOB="01000000000000000000090000003c000300140002007663616e300000000000583a93f2339c0821c46100000000000014000800fe80000000000000000b0000bb082955d35454b8a7fa000734000000005e718b0b69260aa472bfdb9ec434"], 0x50}}, 0x0) 13:30:23 executing program 4: preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f00000000c0)=""/148, 0x94}], 0x1, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000080)='io\x00') preadv(r0, &(0x7f0000000480), 0x0, 0x0) fstat(r0, &(0x7f0000000000)) 13:30:23 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000140)='/dev/snapshot\x00', 0x101000, 0x0) ioctl$TUNSETVNETHDRSZ(r2, 0x400454d8, &(0x7f0000000180)) r3 = socket$inet(0x2, 0x7, 0xffff) getsockopt$SO_BINDTODEVICE(r3, 0x1, 0x19, &(0x7f00000000c0), 0x10) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000001c0), 0x2f0, 0x0, &(0x7f0000000180)}) r4 = dup2(r1, r0) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f00000002c0)={0x8, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="06630440000000000ad1de76c2062f5f1d9c3f07c9eed1af46e0df7efc79b0a4f5aab7bd95c61b318375c140ac13d24cf5a019b821255e2f10b229527b5db511c5c0dbc7036f9415c2eb430df3780dd99d58758033715207380d025a244e0a7504af27d2570a41c7406ef603e849248051b2f01931f4a19e976ca26d94f4"], 0x0, 0x0, &(0x7f0000000300)}) 13:30:23 executing program 0: r0 = socket$inet(0x2, 0x4000000803, 0x4) bind$inet(r0, &(0x7f0000000000)={0x2, 0x0, @broadcast}, 0x10) getsockname(r0, &(0x7f00000036c0)=@xdp={0x2c, 0x0, 0x0}, &(0x7f0000000080)=0x80) setsockopt$inet_pktinfo(r0, 0x0, 0x8, &(0x7f0000003780)={r1, @rand_addr, @dev}, 0xc) syz_emit_ethernet(0x4a, &(0x7f0000000240)={@link_local, @empty=[0x0, 0x0, 0x0, 0x14000000], [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x3c, 0x0, 0x0, 0x0, 0x4, 0x0, @empty=0x9000000, @broadcast}, @udp={0x0, 0x0, 0x28}}}}}, &(0x7f0000000380)) [ 582.462515] overlayfs: failed to resolve './file1': -2 [ 582.475115] binder: 29266:29267 unknown command -1227296278 [ 582.484992] binder: 29266:29267 ioctl c0306201 200002c0 returned -22 [ 582.560691] overlayfs: failed to resolve './file1': -2 13:30:23 executing program 0: r0 = socket$inet(0x2, 0x4000000803, 0x4) bind$inet(r0, &(0x7f0000000000)={0x2, 0x0, @broadcast}, 0x10) getsockname(r0, &(0x7f00000036c0)=@xdp={0x2c, 0x0, 0x0}, &(0x7f0000000080)=0x80) setsockopt$inet_pktinfo(r0, 0x0, 0x8, &(0x7f0000003780)={r1, @rand_addr, @dev}, 0xc) syz_emit_ethernet(0x4a, &(0x7f0000000240)={@link_local, @empty=[0x0, 0x0, 0x0, 0xffffdd86], [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x3c, 0x0, 0x0, 0x0, 0x4, 0x0, @empty=0x9000000, @broadcast}, @udp={0x0, 0x0, 0x28}}}}}, &(0x7f0000000380)) 13:30:23 executing program 5: syz_mount_image$btrfs(&(0x7f0000000140)='btrfs\x00', &(0x7f0000000180)='./file0\x00', 0x0, 0x0, &(0x7f00000007c0), 0x0, &(0x7f0000000380)=ANY=[]) syz_mount_image$ntfs(&(0x7f0000000200)='ntfs\x00', &(0x7f0000000080)='./file1\x00', 0x0, 0x30, &(0x7f0000000580), 0x0, &(0x7f0000000680)=ANY=[]) mount$overlay(0x404030, &(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f0000000100)={[{@upperdir={'upperdir', 0x3d, './file0'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@workdir={'workdir', 0x3d, './file1'}, 0x5c}]}) umount2(&(0x7f0000000040)='./file0\x00', 0xffffffff00000000) [ 582.821689] ntfs: (device loop5): ntfs_fill_super(): Unable to determine device size. 13:30:24 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = open(&(0x7f0000000040)='./file0\x00', 0x800, 0x0) bpf$BPF_GET_PROG_INFO(0xf, &(0x7f0000000080)={r2, 0x50, &(0x7f0000000180)}, 0x10) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000007000)={0x8, 0x0, &(0x7f0000000140)=[@acquire], 0x0, 0x0, &(0x7f00000001c0)}) r3 = dup2(r1, r0) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000002c0)={0x8, 0x0, &(0x7f00000000c0)=[@release], 0x0, 0x0, &(0x7f0000000300)}) 13:30:24 executing program 3: r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vhost-net\x00', 0x2, 0x0) ioctl$VHOST_SET_FEATURES(r0, 0x4008af00, &(0x7f0000000080)=0x200000000) ioctl$int_in(r0, 0x40000000af01, &(0x7f0000000300)) ioctl$VHOST_SET_VRING_ADDR(r0, 0x4028af11, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000001740)=""/163, &(0x7f0000000540)=""/246, &(0x7f0000000640)=""/4096}) r1 = openat$audio(0xffffffffffffff9c, &(0x7f0000000000)='/dev/audio\x00', 0x0, 0x0) close(r1) socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f0000000200)=ANY=[]) write$vnet(r0, &(0x7f00000004c0)={0x1, {&(0x7f00000003c0)=""/247, 0x3ac, &(0x7f0000000340)=""/118, 0x0, 0x2}}, 0x39e) getsockopt$inet_IP_IPSEC_POLICY(r1, 0x0, 0x10, &(0x7f00000000c0)={{{@in, @in=@multicast2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@dev}, 0x0, @in=@rand_addr}}, &(0x7f00000001c0)=0xe8) stat(&(0x7f0000000200)='./file0\x00', &(0x7f0000000280)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) write$FUSE_ATTR(r1, &(0x7f0000001640)={0x78, 0x0, 0x7, {0x100000000, 0x0, 0x0, {0x5, 0x80000001, 0x7fffffff, 0x1d, 0x8, 0x5, 0x5, 0x1, 0xf2ed, 0x10001, 0x1, r2, r3, 0x3f}}}, 0x78) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f0000f1dff8)={0x0, r1}) 13:30:24 executing program 1: socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)) syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0xe1, 0x400100) creat(&(0x7f00000001c0)='./file0\x00', 0x2) openat$dsp(0xffffffffffffff9c, &(0x7f0000000200)='/dev/dsp\x00', 0x8000, 0x0) syz_open_dev$mouse(&(0x7f0000000240)='/dev/input/mouse#\x00', 0x100, 0x10000) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000007000)={0x8, 0x0, &(0x7f0000000140)=[@acquire], 0x0, 0x0, &(0x7f00000001c0)}) r2 = dup2(r1, r0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000002c0)={0x8, 0x0, &(0x7f00000000c0)=[@release], 0xfffffdfd, 0x0, &(0x7f0000000300)}) 13:30:24 executing program 4: preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f00000000c0)=""/148, 0x94}], 0x10000000000001d8, 0x0) r0 = socket$nl_xfrm(0x10, 0x3, 0x6) recvmsg(r0, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000180)=[{&(0x7f0000000400)=""/114, 0x72}, {&(0x7f0000000080)=""/53, 0x35}], 0x2, 0x0, 0x0, 0x2}, 0x100) ioctl$sock_SIOCGPGRP(0xffffffffffffff9c, 0x8904, &(0x7f0000000000)=0x0) r2 = openat$full(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/full\x00', 0x10000, 0x0) getsockopt$inet_sctp_SCTP_SOCKOPT_CONNECTX3(0xffffffffffffff9c, 0x84, 0x6f, &(0x7f0000000280)={0x0, 0x58, &(0x7f0000000200)=[@in6={0xa, 0x4e24, 0x8, @mcast1, 0x8}, @in={0x2, 0x4e21, @remote}, @in6={0xa, 0x4e21, 0x0, @mcast1, 0x5}, @in={0x2, 0x4e20, @loopback}]}, &(0x7f00000002c0)=0x10) getsockopt$inet_sctp_SCTP_LOCAL_AUTH_CHUNKS(r2, 0x84, 0x1b, &(0x7f0000000300)={r3, 0x82, "f43efa0dc141de756c1240029b225840d33a65658b0a3c2424023877c98d38b7a8174ab9860b7095e53ee9d53d1733c75fc462e7603b2e8a1a6188867d7047c259fcc94afbcc656ce3dcea874281e4aa9a66d83d578889a73de2624dbd80e027c376cb10abfd2ac457521d1b5865a202aa68c0a81b86ab50f3b0fe74bb63c8443db3"}, &(0x7f00000003c0)=0x8a) r4 = syz_open_procfs(r1, &(0x7f0000000040)='iO\x00') preadv(r4, &(0x7f0000000180), 0x376, 0x0) 13:30:24 executing program 0: r0 = socket$inet(0x2, 0x4000000803, 0x4) bind$inet(r0, &(0x7f0000000000)={0x2, 0x0, @broadcast}, 0x10) getsockname(r0, &(0x7f00000036c0)=@xdp={0x2c, 0x0, 0x0}, &(0x7f0000000080)=0x80) setsockopt$inet_pktinfo(r0, 0x0, 0x8, &(0x7f0000003780)={r1, @rand_addr, @dev}, 0xc) syz_emit_ethernet(0x4a, &(0x7f0000000240)={@link_local, @empty=[0x0, 0x0, 0x0, 0x88470000], [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x3c, 0x0, 0x0, 0x0, 0x4, 0x0, @empty=0x9000000, @broadcast}, @udp={0x0, 0x0, 0x28}}}}}, &(0x7f0000000380)) 13:30:24 executing program 5: syz_mount_image$btrfs(&(0x7f0000000140)='btrfs\x00', &(0x7f0000000180)='./file0\x00', 0x0, 0x0, &(0x7f00000007c0), 0x0, &(0x7f0000000380)=ANY=[]) syz_mount_image$ntfs(&(0x7f0000000200)='ntfs\x00', &(0x7f0000000080)='./file1\x00', 0x0, 0x30, &(0x7f0000000580), 0x0, &(0x7f0000000680)=ANY=[]) mount$overlay(0x404030, &(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f0000000100)={[{@upperdir={'upperdir', 0x3d, './file0'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@workdir={'workdir', 0x3d, './file1'}, 0x5c}]}) umount2(&(0x7f0000000040)='./file0\x00', 0x600) 13:30:24 executing program 0: r0 = socket$inet(0x2, 0x4000000803, 0x4) bind$inet(r0, &(0x7f0000000000)={0x2, 0x0, @broadcast}, 0x10) getsockname(r0, &(0x7f00000036c0)=@xdp={0x2c, 0x0, 0x0}, &(0x7f0000000080)=0x80) setsockopt$inet_pktinfo(r0, 0x0, 0x8, &(0x7f0000003780)={r1, @rand_addr, @dev}, 0xc) syz_emit_ethernet(0x4a, &(0x7f0000000240)={@link_local, @empty=[0x0, 0x0, 0x0, 0x14], [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x3c, 0x0, 0x0, 0x0, 0x4, 0x0, @empty=0x9000000, @broadcast}, @udp={0x0, 0x0, 0x28}}}}}, &(0x7f0000000380)) 13:30:24 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$audion(&(0x7f0000000040)='/dev/audio#\x00', 0xf4b0, 0x10000) ioctl$NBD_SET_BLKSIZE(r1, 0xab01, 0x9) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r2 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x2) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000007000)={0x8, 0x0, &(0x7f0000000140)=[@acquire], 0x0, 0x0, &(0x7f00000001c0)}) r3 = dup2(r2, r0) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000002c0)={0x8, 0x0, &(0x7f00000000c0)=[@release], 0x0, 0x0, &(0x7f0000000300)}) write$binfmt_misc(r0, &(0x7f0000000180)={'syz1', "31a89d68929fb824903dd7d029fe0c0986be55b784f8b98a582a69840f090c04d021276a61920f1f32ea696c19064da3e6560038306000bec1072f7bbf2fbadc151c6ec2a2c8784e56182c9ef807e83aabe9698f850ba56d3648f06fe8c0cf63d5175b9390e50929fdab3429a5538811e85498ae48a16418ea74dc96052f34858e40a37c53e58ae555b8b6d4b5a618ba00f906983de099d1765cf7e10a63b38942fd075d67dd7fa50195149f0a230daf8d600064f79e9a443c4f0317b9b17835b9e5eea6cf4531ddc6d6e99a0f162f838b4cc2cf6e5066"}, 0xdb) [ 583.350448] ntfs: (device loop5): ntfs_fill_super(): Unable to determine device size. 13:30:24 executing program 0: r0 = socket$inet(0x2, 0x4000000803, 0x4) bind$inet(r0, &(0x7f0000000000)={0x2, 0x0, @broadcast}, 0x10) getsockname(r0, &(0x7f00000036c0)=@xdp={0x2c, 0x0, 0x0}, &(0x7f0000000080)=0x80) setsockopt$inet_pktinfo(r0, 0x0, 0x8, &(0x7f0000003780)={r1, @rand_addr, @dev}, 0xc) syz_emit_ethernet(0x4a, &(0x7f0000000240)={@link_local, @empty=[0x0, 0x0, 0x0, 0x3c00000000000000], [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x3c, 0x0, 0x0, 0x0, 0x4, 0x0, @empty=0x9000000, @broadcast}, @udp={0x0, 0x0, 0x28}}}}}, &(0x7f0000000380)) 13:30:24 executing program 0: r0 = socket$inet(0x2, 0x4000000803, 0x4) bind$inet(r0, &(0x7f0000000000)={0x2, 0x0, @broadcast}, 0x10) getsockname(r0, &(0x7f00000036c0)=@xdp={0x2c, 0x0, 0x0}, &(0x7f0000000080)=0x80) setsockopt$inet_pktinfo(r0, 0x0, 0x8, &(0x7f0000003780)={r1, @rand_addr, @dev}, 0xc) syz_emit_ethernet(0x4a, &(0x7f0000000240)={@link_local, @empty=[0x0, 0x0, 0x0, 0x543], [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x3c, 0x0, 0x0, 0x0, 0x4, 0x0, @empty=0x9000000, @broadcast}, @udp={0x0, 0x0, 0x28}}}}}, &(0x7f0000000380)) [ 583.476210] overlayfs: filesystem on './file0' not supported as upperdir 13:30:24 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$admmidi(&(0x7f0000000240)='/dev/admmidi#\x00', 0x7, 0x6040) setsockopt$nfc_llcp_NFC_LLCP_RW(r1, 0x118, 0x0, &(0x7f0000000040)=0x401, 0x4) setsockopt$inet_sctp6_SCTP_INITMSG(r1, 0x84, 0x2, &(0x7f0000000280)={0xb127, 0x8001, 0x2, 0x9}, 0x8) fstatfs(r0, &(0x7f0000000180)=""/150) r2 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000007000)={0x8, 0x0, &(0x7f0000000140)=[@acquire], 0x0, 0x0, &(0x7f00000001c0)}) r3 = dup2(r2, r0) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000002c0)={0x8, 0x0, &(0x7f00000000c0)=[@release], 0x0, 0x0, &(0x7f0000000300)}) 13:30:24 executing program 3: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/sys/net\x00\x00\x00\x00\x00\x00\x00\a/expire_nodest_conn\x00', 0x2, 0x0) write$FUSE_STATFS(r0, &(0x7f0000000040)={0x60, 0x0, 0x1, {{0x8, 0x3, 0x8000, 0x4, 0x6, 0x8, 0x1ff, 0x3}}}, 0x60) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x4) r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x0) ioctl$ifreq_SIOCGIFINDEX_team(0xffffffffffffffff, 0x8933, &(0x7f0000000140)={'team0\x00'}) ioctl$ifreq_SIOCGIFINDEX_team(r0, 0x8933, &(0x7f0000000180)={'team0\x00'}) getdents64(r1, &(0x7f00000000c0)=""/11, 0xeb) 13:30:24 executing program 5: syz_mount_image$btrfs(&(0x7f0000000140)='btrfs\x00', &(0x7f0000000180)='./file0\x00', 0x0, 0x0, &(0x7f00000007c0), 0x0, &(0x7f0000000380)=ANY=[]) syz_mount_image$ntfs(&(0x7f0000000200)='ntfs\x00', &(0x7f0000000080)='./file1\x00', 0x0, 0x30, &(0x7f0000000580), 0x0, &(0x7f0000000680)=ANY=[]) mount$overlay(0x404030, &(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f0000000100)={[{@upperdir={'upperdir', 0x3d, './file0'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@workdir={'workdir', 0x3d, './file1'}, 0x5c}]}) umount2(&(0x7f0000000040)='./file0\x00', 0x2800) 13:30:24 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000000c0)={0x10, 0x0, &(0x7f0000000100)=[@clear_death={0x400c630f, 0x1, 0x1}], 0xb, 0x0, &(0x7f0000000180)="53fd3d844ac639381173ec"}) r2 = dup2(r0, r0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000002c0)={0x8, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="0663044000000000f7c9107e1aa5ef1f0ff8f84efdecd3fdf756ccf5912742437c558fd041b083e7e806ced3781df10446746f6406a2ae5029d35da07eb13e1c1963f4988cd66a682f7dad6f1581dd9f5a0b9aa1035e54f7"], 0x0, 0x0, &(0x7f0000000300)}) [ 583.718252] binder: 29389:29390 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 [ 583.727205] binder: BINDER_SET_CONTEXT_MGR already set [ 583.749909] binder: 29389:29392 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 [ 583.759416] ntfs: (device loop5): ntfs_fill_super(): Unable to determine device size. [ 583.768701] binder: 29389:29390 ioctl 40046207 0 returned -16 [ 583.857406] overlayfs: filesystem on './file0' not supported as upperdir 13:30:25 executing program 1: socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)) syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0xe1, 0x400100) creat(&(0x7f00000001c0)='./file0\x00', 0x2) openat$dsp(0xffffffffffffff9c, &(0x7f0000000200)='/dev/dsp\x00', 0x8000, 0x0) syz_open_dev$mouse(&(0x7f0000000240)='/dev/input/mouse#\x00', 0x100, 0x10000) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000007000)={0x8, 0x0, &(0x7f0000000140)=[@acquire], 0x0, 0x0, &(0x7f00000001c0)}) r2 = dup2(r1, r0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000002c0)={0x8, 0x0, &(0x7f00000000c0)=[@release], 0x100000000000000, 0x0, &(0x7f0000000300)}) 13:30:25 executing program 0: r0 = socket$inet(0x2, 0x4000000803, 0x4) bind$inet(r0, &(0x7f0000000000)={0x2, 0x0, @broadcast}, 0x10) getsockname(r0, &(0x7f00000036c0)=@xdp={0x2c, 0x0, 0x0}, &(0x7f0000000080)=0x80) setsockopt$inet_pktinfo(r0, 0x0, 0x8, &(0x7f0000003780)={r1, @rand_addr, @dev}, 0xc) syz_emit_ethernet(0x4a, &(0x7f0000000240)={@link_local, @empty=[0x0, 0x0, 0x0, 0x700000000000000], [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x3c, 0x0, 0x0, 0x0, 0x4, 0x0, @empty=0x9000000, @broadcast}, @udp={0x0, 0x0, 0x28}}}}}, &(0x7f0000000380)) 13:30:25 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0x0, 0x0) r2 = syz_open_dev$sndpcmc(&(0x7f0000000100)='/dev/snd/pcmC#D#c\x00', 0xffff, 0x2000) ioctl$UI_SET_SNDBIT(r2, 0x4004556a, 0x0) r3 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000040)='/dev/sequencer\x00', 0xc6000, 0x0) setsockopt$bt_BT_POWER(r3, 0x112, 0x9, &(0x7f0000000080)=0x5, 0x1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000007000)={0x8, 0x0, &(0x7f0000000140)=[@acquire], 0x0, 0x0, &(0x7f00000001c0)}) ioctl$KVM_CHECK_EXTENSION(r3, 0xae03, 0xfffffffffffffff9) r4 = dup2(r1, r0) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f00000002c0)={0x8, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="066304400097a01256000000aa99c18be8afc24358b1bfb11ddf3bc4a427e762d67b507cf9c8750e19286c1907f7f212d3a399445b65d9848e97f00b1a6930210186d5b2774d7963b35a9306e6275f37898531f09f412383e8f71c8adcf09939ea90976d7ceb652bfc5aeca0b4bf64ddbbf660abf1be70dc521cd7edfd175445f0a35c373a0f1790c0c93e1277b132efc9be9d0eb753a526f02b715191e8c2055b7a74129ef9193577fa92ad102ddfc5d90af053001f21c1915ce812dc906d46c1014cc6094893607e9fb55bc823e99fbbde05044e63b39e0ecab1127f3c7f0a29fdc57746f131309f038c484e7aecf74708da2db997dc164535c098830ee4f852c179b44aaf"], 0x0, 0x0, &(0x7f0000000300)}) 13:30:25 executing program 5: syz_mount_image$btrfs(&(0x7f0000000140)='btrfs\x00', &(0x7f0000000180)='./file0\x00', 0x0, 0x0, &(0x7f00000007c0), 0x0, &(0x7f0000000380)=ANY=[]) syz_mount_image$ntfs(&(0x7f0000000200)='ntfs\x00', &(0x7f0000000080)='./file1\x00', 0x0, 0x30, &(0x7f0000000580), 0x0, &(0x7f0000000680)=ANY=[]) mount$overlay(0x404030, &(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f0000000100)={[{@upperdir={'upperdir', 0x3d, './file0'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@workdir={'workdir', 0x3d, './file1'}, 0x5c}]}) umount2(&(0x7f0000000040)='./file0\x00', 0x2a00) 13:30:25 executing program 4: r0 = syz_open_dev$sndpcmc(&(0x7f0000000200)='/dev/snd/pcmC#D#c\x00', 0x9, 0x20000) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000001280)={r0, &(0x7f0000000240)="5ae69a6c07c9c17527bb03f888e762a76efeb4af21e76c8b8d4e3ab682119f3c94876408c8ccee5d9386fd82b46418ad4a79021730deb609d19c07667404", &(0x7f0000000280)="77104153cbb73e169a1fe12754675107d46b19c810f3f4db2f060c648ee297b5620dcbcaf16c217026aafa53ea63dca81e67ab7babeb5f0fddebbccb1b4d6be7c518a1ba57729c39d771d26ff97b19965e563d17404389f90383f5f96a5cbfc436c644a5573531f65a94adbb5326fb7bf92607a473d42064b5a932705c2d0fda4e900ce6e4677df7c5f4f3a6c8d47adc8fff98ced8586a0fd3352c454b42d345869d0f56fa45ebdcd7862b40c89706893ef4ab131d7c3cfaa4b487bbe0ee68c9a27fb14e0a867ae61181b2f6de5b3e276d3c67bf4dcefccbb4c5ea2a3c94ace4c58c763483a751a8f5452d695bb512a8b9a02e1d80c2f18482013e5cc6a7efa1c110847ec067ccc4fb79ced29c771f02361b740641daa7c437138abbaa9e566fda6388dca95d75e91a2914cea56d5804c8a30f66ec49adf4aa8b10865d268700aa57df7409e3a3082627a543d68ce35126afedded18a39fcfd3a5932ab270533f8e6ddba878706e2f5cdcef1c5d0c8a2a1204d86273ce0cc5c32d10544dcce395d5b74c52553fbe3da81b9dd6d87f2672d6cac654c8669275f869c0f2c74246e8c8d735431a19ca8c3d032919de9a2bd924178c58732b1327919fa9d6776cd437ec376571e64bce38b9fd76c80f54c3aa094646b9138c4b2b0eb799945a12ec3042321e3aab81bc9e161b96f5733cee5bc3587f0cacb3e5d3f5648f65ef563e559011afa255a93967a8bb9233974ecc72e6298d1787e02418a0e2a8820dbd2069da2233dc7b70263c72f9c711e520c54238a85704934eac323d0ac256de102df69d06bdc554add33f12c3f749f0b710103c188bd2b12b53f108c9caa4c8c1c5a616803b99510a1d41cdf62ad9afc2fd99f12aeedae7c6335e802315cd35d852ab06ceb3ff348ad06765785bb682085eda108d71fb18562d8cf974cd52bd96fb77fce2603d7e9bf409831f6968a450b82c4caa4b498ba9aa02bb9c99ded5cadd883d6e6cffbb8280bc627d54ec463f2c76a8668e92b3fc9728dbe0f349990d09bcbad7b48d30e2f8aa6a492426dbf7dbdc39df2fa3b14c8efff0da604b22b795582cc8b8136b6a815e36b97108e647ea2d9051438766255374b01469911a23e8e47e0b0a358f36514c33d0509e45e023f430461710bc382b729b25ad805ca36d1e199bf08179adcdf09513a07da7f8abb8098edec9e47cf60352f89061c8eac3311873f4924f7d7b1b8de5f38226b8e5276d56e45943dd4d8e8a69b0c4cf06c0a3c27ef574a23657e5ffcd0d6c92b614dcdc0d3d788a03c579186dee3e1f0212f45807de003548d89ff75db22610e2a96676dacf78e11e5bd7bf163a1bd8f790369a1852b3c9e9d906df9aa8e6db5ff4ef8d05d0d0cdb84853e972c1a2b939c5022de4b8d3d2623a3f3479c7dbc8bf7fd077713c8cf3c368e1042b3beb6912d0a4a37f2249bd8bc8bc0319e43ed54e80b96fa9112b4e7e8212fde08ff875ba7fc65505d339c3345e1d6226ec78f5ddcdf23ac4c42db1ca515003cd64aaa1222076364e70b29278d6318e221b20cd4aff307688a89d455f81c36514798fc3e65e4bc9a92134632dd49ebee52c27b0856db95aa59b8c8273962bfe3667f14f4712cf4991335fc96a09c088417b95f58458f94c297388c35e7894e0b223db8cb0bcb1d399c292266d42e84d1fb7dee53f124f0cd3da9f3b9939e169c1f27ae7d698cfe6a2642072fe6019ddd9ffe9eed691815178f33a8a0d386929f567eebf2e0afbbe40f5156b9e1fbdcc352953ab0803d59fafefc12a0fff33b401cc7572b4377cc2d7bebb18f7dcec006d83e04c214f2d5efec8ade3679e84489ce8ba09b2c6be27cca8ccbdcf2af49052dcd6279231182cd3a887365a6d39fe65707575ff9a78d9ff41f510aa64cba927e440a28d0e6a5555f2320f1178c71bee7d4dd852932bf93e9c0407c6bdb87cd62d5fd7ae03fe9d1d308759c69284b32886464b9979dbb464db1ab2d3bfc9fc5ec4ade1634b430560a1ff97e4ec94e635d1c84952a262953caafd26814f1da8813fdbd43878b630b253b70f1c6095e0ed7170c9b8602ac301661a1cb6a4c7d75d442933dd0e0626cafbb80dc08cea739eaecef0af8a640046fd9570d1e338362761faa4d3fad708fbb98f193117382bba734855cdfc5bdd6db0250a029ff6817627ed682c2aae5792509fc964cf8c024a796cd7ec57d935a1b28287cc6e7e2ef183b41a0e9253c408ad66850613047751f5860ffc945f0cd5b77af96099a1a3b6313924e5d001fa067c45b8799b78f6d5135d537331a1e9879fbfcdd7dd7be0f02d428c591bf2d51a69da7289e9bba90cde931a477468f46056f3cbb7d404bb9f917c24199bb49088928ce51423b39760f975d011e97191862344787e266ab70156af03488318fb3dd9e05ca854b4221210f3b22274326f51e6c6d4e3ab2f7b0d1521f62761bac05e8df89da2d2a2fe3f5e8360569c47976a2ac5120781053bff34944349a8c68d83dfb0e3f966c3ea5a02febb5195de60cb8deffc5c195447d3995877681d093fb7fcebbe33e3f9b883f11fc3f0ec0150cbc2c39e298ead5602246843797db94228dc3c8fc025986386d032e2150a5094c91e08f494c3ef49a0a5a08e03d223feec96e17af8945da3603ba3fd5c6292e9a8b1953d9565abd68ab56f7ea29080a0a22583175c5c2618c9ba36f5531743cf7de717a9ad8e7a1e75d306254b6f914c9cf78d5e28e1c26a3c05177bbe9265a3e28da33759dfcceb8ba19c02de8c4ed793b82265f1353259244f3ef196648c478731d1b70a60c18a4f71e8a1b611015f9fe9308d77786e58015350cb7003262fab7940cc4d7cdef1b2ed3ff6bba9a1b84959b2ba0e9c774b1db77de6f5bc4e032870f63233070f552a25e7272407d680c4829cfc6cf1fa41c9445310e792d00aa5c209a262fbcb570cad24fcc20702dc5c73c0942b13f23bf4c11507cddd7e004fce5d0e62f85bcfc5817516ecfc034c5e58374a0bccefa9bce8fb7e8a6faf91af11a0e41aef25c3db5da3d0180aba253a488afa0d1177f65fe79d4bd67bd6325324bd4f85ca8b179c8dc43597b6db4c6ce46c2dccb1f5cc040be2f2c9aa7c76f417e0fde7ca85889b653a0d4bc08c6c2028361cc2c2c6a1fed9051f448065c6774385fa337d16328676db981d993996a161b46b90c619de58d29c30262f1571a683a4e8517c23fdf98d777a572493aeb2285e54f001144feb38cd51e03d4b27db9dd220d079537891bccab67a1ea77bed18cdae96e72921761de8199b666728678b5770a78c6d0756fb4a8a7292533e989e6fbc7505fa0aa5901d8b9919ae6cf71195c815304ff16099146eb0945b01dff0b2467536e2b5c2b43cc6bcbb6cceca4e4493536014c3331560638b939f578e9acfd4d804a7a9b4eb1194bc195b75e80de6a488aa777a1ab83b06c98fce0f1e8fb48d751e3e11e7df7fe93fe85ba46a75d8f0f1abfb9671b489f6c4eda9591dd592e992456df5b44f52866feeaa352db555db827ea951675e57a7bfd52107ebfa6ad2566985efecbd7c2eaf6158b77dc91b51fa0ae49fa16f07e7afc76bb27923d1ddca13d6600300f9260cbcd8762c555fa834ccec9fe1874babde2f04deeffdf3c36602d277b7c0be612b06563ebdbecfd81f587178a35ecfae3aacb5f711a808dee915e47e5ab7b6ba8d98c1fea7d95aad3953f7bcf7e586c9353ac1e7c6b9cb94549c7b6db8ee801a2afe978372d632f54d749c0cebb9db60de834c2151574ab1854db1de07962647f66bae3529984d22d0936ba446e9e7e3abcee5a7e9a89201c88ae67c4b3fcff8d447800ddd6b9e1775d0ddf3936ce65cd54324b9fc91bfe4cde155b88f7d231456747f586abec9adc8b8094943581f7a912a13d47da8bf52ecfa65093904aa3e238607843ca949e0ace171127db0f313e58aadc59be9f6d803efd6e89b9451c1921c3e6fca6a21c9985fac71c53d0e44e6892908ae6272227b0b6eeb78f696802c33e57c1265f837308c4558fe9358cc0a64ad07a0722a509e3926da5b4f9ee5cd401e5c8ab6905a4b1d03ddfbc2221ddf21477426f63e4abe4d93d2e5b53766f670529d7598ea9c0db8050d1a7394fa28c27a749c3084c9ec76a6022ac3c366c735abb3aca8d7f23df25508c94220a8ea49aa36c39954c238ca9e01346465710d4a3becb97f70b732187c57056fae708d3f49600e8fa2035e5896a0b7d02393183211fef841251354e2a488ddffd0bea7f5dc0df33a9391b27051ce3464fcdb93ec9ffbe2644d380d64648fb1740b63bde1851603e126cf0edaf368e1edaa32fc312f184b74dae8840f7648ad158b26bf3b755c455d43b41f064560c127c36e2390ce46bdf43df491145cd639d0ae46555d4bd1767d385e90c66c32166ac2083d531c1ad0bbc4146b72c8d83953373ead38f287806c946a7e217d16dee4f82edab7a773d986ae63079add856a21511585fb4f329b796c40aed02fccddc8e4c0008ef128336c0894225def5960ea61fe037d3ccd5ba577b1082260afb0800cbe41ac4842102e368e16208785f6cb2d9abbcf3202968513d543ad7625358579c96f24b2bc363184ff87ea65725a833102265453635632f2aa6106b0bc2f0437c72a463b05a6306d74351e24a8b81c48a8aa899489a4746615c2f3d0bfbf816cefab4dff6281a208ac9fecde96c5d84a7f7620eb1ba9fb69a8c9d9c805b5d039e19b3e83e01b0f0b1c6c285f98c8e0a2549837753bef7d572aef062d95dad40ec1dc6ce1787ab06de53011e8e9f3097ea782eb18b7f4d783d804326b547c9b24c95aeb98bce1b2363cba1aa34243dd39eeb7f3b045e64ba9197e7686468bf0b18d496b77619883a0accce4392e503694ef24ad96a1aa6dbca6cd49383a98ffd02f3e21d9b773ec0fc2de1bf05c71e29ddbdf99207f484e78f4dbaa036d4b3e32141b1e6cb7ab7111218d58ba80a8da8f928bd9a94eecbafb61662dec80462dfa0847c208000c2e25309cb61f89fe4fad2210c48d0e9efaf2963ed32f690d2d9d45e2e6665e09153b982e3f4ae61f6df1fa1ee4adfde233a55705369d8666f97b52b1882fe35ccf1ebe8b7e6295f5968ee1e7774c871aaea0bd8ccde683fdc5cc3641283357a03cb5648f5385df09e647ccb36182f569a17f7cb0337acad79d3c7ae8a1f3542cdfc017e77a8b1879f7b1e3f4c037de1a356645330f7b747a074b6d7f764a7e4a24404a3dcb5cb0272a4706ea953cedded0e2316339264f89123ec24230c8675d6e7228298621619dc03e8d5830b96a2418467df44b22cf417a117893770cf9f5e6b1809fa93f6d9eac43b81f5a50f82107c1c001bd1588499d9a80118d01dcaaf55f2dbf45774d7aa81c0d85748f63b583df3d52fd65d01a0afdfede6916ad2cd58908c6b66916242ac8491514e90cd31cea8f459454707b9927612ec1a0e43f77232d316ab8f809a7fb91a714eb76164f797fc54c2a81aa3d5db938127ce2b78812e5dbb1669e90466e66bfd5b1e7dc064278586013455076c5e31ab2c40497624e1f699eca40a3120cb2abd3cd9d5f868889e1af8040e8a3e95d1288a042dd2541c26d929844551c6bd394e4b239fb914f2f505b61279425fc1373cc1db7ae4cb622534c13195907c9c1ad6ae8bd3ee146766a94da9e0cc2998968f0fdab2c5a450088a79d66ac7b58c96c53bce345af003ff715ffbb6e40299d2396bbe98bd1b48eb43adb75bede7cbf3db82eac4a67ac1c76f780104d5ad75a2f6f3", 0x3}, 0x20) r1 = syz_open_dev$amidi(&(0x7f0000000000)='/dev/amidi#\x00', 0x401, 0x40) getsockopt$inet_sctp6_SCTP_GET_LOCAL_ADDRS(0xffffffffffffffff, 0x84, 0x6d, &(0x7f0000000040)=ANY=[@ANYRES32=0x0, @ANYBLOB="15009548970c976102c9f59a"], &(0x7f0000000180)=0x1d) setsockopt$inet_sctp_SCTP_AUTH_ACTIVE_KEY(r1, 0x84, 0x18, &(0x7f00000001c0)={r2, 0x3f}, 0x8) preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f00000000c0)=""/148, 0x94}], 0x1, 0x0) r3 = syz_open_procfs(0x0, &(0x7f0000000080)='io\x00') preadv(r3, &(0x7f0000000480), 0x10000000000002a1, 0x0) 13:30:25 executing program 0: r0 = socket$inet(0x2, 0x4000000803, 0x4) bind$inet(r0, &(0x7f0000000000)={0x2, 0x0, @broadcast}, 0x10) getsockname(r0, &(0x7f00000036c0)=@xdp={0x2c, 0x0, 0x0}, &(0x7f0000000080)=0x80) setsockopt$inet_pktinfo(r0, 0x0, 0x8, &(0x7f0000003780)={r1, @rand_addr, @dev}, 0xc) syz_emit_ethernet(0x4a, &(0x7f0000000240)={@link_local, @empty=[0x0, 0x0, 0x0, 0x8864], [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x3c, 0x0, 0x0, 0x0, 0x4, 0x0, @empty=0x9000000, @broadcast}, @udp={0x0, 0x0, 0x28}}}}}, &(0x7f0000000380)) 13:30:25 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000007000)={0x8, 0x0, &(0x7f0000000140)=[@acquire], 0x0, 0x0, &(0x7f00000001c0)}) r2 = dup2(r1, r0) ioctl$SNDRV_CTL_IOCTL_RAWMIDI_PREFER_SUBDEVICE(r2, 0x40045542, &(0x7f0000000040)) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000002c0)={0x8, 0x0, &(0x7f00000000c0)=[@release], 0x0, 0x0, &(0x7f0000000300)}) 13:30:25 executing program 4: preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f00000000c0)=""/148, 0x94}], 0x1, 0x0) openat$apparmor_thread_exec(0xffffffffffffff9c, &(0x7f0000000340)='/proc/thread-self/attr/exec\x00', 0x2, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000080)='io\x00') preadv(r0, &(0x7f0000000300)=[{&(0x7f0000000000)=""/79}, {&(0x7f0000000180)=""/178}, {&(0x7f0000000240)=""/172}], 0x56473ded110dba7, 0x0) [ 584.360349] overlayfs: failed to resolve './file1': -2 [ 584.469102] ntfs: (device loop5): ntfs_fill_super(): Unable to determine device size. [ 584.543798] binder: 29432:29435 ioctl 40045542 20000040 returned -22 13:30:25 executing program 4: r0 = openat$zero(0xffffffffffffff9c, &(0x7f0000000000)='/dev/zero\x00', 0x100, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000240)={0xffffffffffffffff}, 0x13f, 0x5}}, 0xfffffffffffffced) write$RDMA_USER_CM_CMD_NOTIFY(r0, &(0x7f00000001c0)={0xf, 0x8, 0xfa00, {r1, 0x2}}, 0x10) preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f00000000c0)=""/148, 0x94}], 0x1, 0x0) r2 = syz_open_procfs(0x0, &(0x7f0000000080)='io\x00') preadv(r2, &(0x7f0000000480), 0x10000000000002a1, 0x0) [ 584.591283] binder: 29432:29435 ioctl 40045542 20000040 returned -22 13:30:27 executing program 3: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/sys/net\x00\x00\x00\x00\x00\x00\x00\a/expire_nodest_conn\x00', 0x2, 0x0) write$FUSE_STATFS(r0, &(0x7f0000000040)={0x60, 0x0, 0x1, {{0x8, 0x3, 0x8000, 0x4, 0x6, 0x8, 0x1ff, 0x3}}}, 0x60) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x4) r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x0) ioctl$ifreq_SIOCGIFINDEX_team(0xffffffffffffffff, 0x8933, &(0x7f0000000140)={'team0\x00'}) ioctl$ifreq_SIOCGIFINDEX_team(r0, 0x8933, &(0x7f0000000180)={'team0\x00'}) getdents64(r1, &(0x7f00000000c0)=""/11, 0xeb) 13:30:27 executing program 0: r0 = socket$inet(0x2, 0x4000000803, 0x4) bind$inet(r0, &(0x7f0000000000)={0x2, 0x0, @broadcast}, 0x10) getsockname(r0, &(0x7f00000036c0)=@xdp={0x2c, 0x0, 0x0}, &(0x7f0000000080)=0x80) setsockopt$inet_pktinfo(r0, 0x0, 0x8, &(0x7f0000003780)={r1, @rand_addr, @dev}, 0xc) syz_emit_ethernet(0x4a, &(0x7f0000000240)={@link_local, @empty=[0x0, 0x0, 0x0, 0xd], [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x3c, 0x0, 0x0, 0x0, 0x4, 0x0, @empty=0x9000000, @broadcast}, @udp={0x0, 0x0, 0x28}}}}}, &(0x7f0000000380)) 13:30:27 executing program 5: syz_mount_image$btrfs(&(0x7f0000000140)='btrfs\x00', &(0x7f0000000180)='./file0\x00', 0x0, 0x0, &(0x7f00000007c0), 0x0, &(0x7f0000000380)=ANY=[]) syz_mount_image$ntfs(&(0x7f0000000200)='ntfs\x00', &(0x7f0000000080)='./file1\x00', 0x0, 0x30, &(0x7f0000000580), 0x0, &(0x7f0000000680)=ANY=[]) mount$overlay(0x404030, &(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f0000000100)={[{@upperdir={'upperdir', 0x3d, './file0'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@workdir={'workdir', 0x3d, './file1'}, 0x5c}]}) umount2(&(0x7f0000000040)='./file0\x00', 0xd) 13:30:27 executing program 4: preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f00000000c0)=""/148, 0x94}], 0x1, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000080)='io\x00') ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, &(0x7f0000000000)={0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x2c, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="0f630c4000000000020000000000000009791040", @ANYRES64=r1, @ANYBLOB="02000000000000000563044004000000"], 0xc, 0x0, &(0x7f0000000180)="f159cfef93df0e5ad4495bea"}) preadv(r0, &(0x7f0000000480), 0x10000000000002a1, 0x0) 13:30:27 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000007000)={0xfffffffffffffdbc, 0x0, &(0x7f00000000c0)=[@acquire], 0x0, 0x0, &(0x7f00000001c0)}) r2 = dup2(r1, r0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000002c0)={0x8, 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB="7839f37b8f11feaf6dacddd388bb8d3755d8e865f2662d97d4e2f4ca2717d175f4c3a2e178"], 0x0, 0x0, &(0x7f0000000300)}) 13:30:27 executing program 1: socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)) syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0xe1, 0x400100) creat(&(0x7f00000001c0)='./file0\x00', 0x2) openat$dsp(0xffffffffffffff9c, &(0x7f0000000200)='/dev/dsp\x00', 0x8000, 0x0) syz_open_dev$mouse(&(0x7f0000000240)='/dev/input/mouse#\x00', 0x100, 0x10000) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000007000)={0x8, 0x0, &(0x7f0000000140)=[@acquire], 0x0, 0x0, &(0x7f00000001c0)}) r2 = dup2(r1, r0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000002c0)={0x8, 0x0, &(0x7f00000000c0)=[@release], 0x3f00000000000000, 0x0, &(0x7f0000000300)}) [ 585.717875] binder: 29463:29464 unknown command 2079537528 [ 585.734128] binder: 29463:29464 ioctl c0306201 200002c0 returned -22 13:30:27 executing program 0: r0 = socket$inet(0x2, 0x4000000803, 0x4) bind$inet(r0, &(0x7f0000000000)={0x2, 0x0, @broadcast}, 0x10) getsockname(r0, &(0x7f00000036c0)=@xdp={0x2c, 0x0, 0x0}, &(0x7f0000000080)=0x80) setsockopt$inet_pktinfo(r0, 0x0, 0x8, &(0x7f0000003780)={r1, @rand_addr, @dev}, 0xc) syz_emit_ethernet(0x4a, &(0x7f0000000240)={@link_local, @empty=[0x0, 0x0, 0x0, 0x600], [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x3c, 0x0, 0x0, 0x0, 0x4, 0x0, @empty=0x9000000, @broadcast}, @udp={0x0, 0x0, 0x28}}}}}, &(0x7f0000000380)) [ 585.778527] overlayfs: failed to resolve './file1': -2 13:30:27 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000007000)={0x8, 0x0, &(0x7f0000000140)=[@acquire], 0x0, 0x0, &(0x7f00000001c0)}) r2 = openat$qat_adf_ctl(0xffffffffffffff9c, &(0x7f0000000380)='/dev/qat_adf_ctl\x00', 0x8000, 0x0) ioctl$KVM_CREATE_IRQCHIP(r2, 0xae60) syz_open_dev$sndctrl(&(0x7f0000000040)='/dev/snd/controlC#\x00', 0x4, 0x900) r3 = dup2(r1, r0) ioctl$BINDER_THREAD_EXIT(r1, 0x40046208, 0x0) r4 = syz_genetlink_get_family_id$team(&(0x7f0000000180)='team\x00') accept$packet(r3, &(0x7f00000001c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @remote}, &(0x7f0000000200)=0x14) sendmsg$TEAM_CMD_OPTIONS_SET(r3, &(0x7f0000000300)={&(0x7f0000000100), 0xc, &(0x7f0000000280)={&(0x7f0000000240)={0x20, r4, 0x4, 0x70bd2d, 0x25dfdbff, {}, [{{0x8, 0x1, r5}, {0x4}}]}, 0x20}, 0x1, 0x0, 0x0, 0x10}, 0x4010) [ 585.898588] overlayfs: failed to resolve './file1': -2 13:30:27 executing program 0: r0 = socket$inet(0x2, 0x4000000803, 0x4) bind$inet(r0, &(0x7f0000000000)={0x2, 0x0, @broadcast}, 0x10) getsockname(r0, &(0x7f00000036c0)=@xdp={0x2c, 0x0, 0x0}, &(0x7f0000000080)=0x80) setsockopt$inet_pktinfo(r0, 0x0, 0x8, &(0x7f0000003780)={r1, @rand_addr, @dev}, 0xc) syz_emit_ethernet(0x4a, &(0x7f0000000240)={@link_local, @empty=[0x0, 0x0, 0x0, 0x3f00], [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x3c, 0x0, 0x0, 0x0, 0x4, 0x0, @empty=0x9000000, @broadcast}, @udp={0x0, 0x0, 0x28}}}}}, &(0x7f0000000380)) 13:30:27 executing program 4: preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f00000000c0)=""/148, 0x94}], 0x1, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000080)='io\x00') getsockopt$sock_int(r0, 0x1, 0x2, &(0x7f0000000000), &(0x7f0000000040)=0x4) preadv(r0, &(0x7f0000000480), 0x10000000000002a1, 0x0) 13:30:27 executing program 5: syz_mount_image$btrfs(&(0x7f0000000140)='btrfs\x00', &(0x7f0000000180)='./file0\x00', 0x0, 0x0, &(0x7f00000007c0), 0x0, &(0x7f0000000380)=ANY=[]) syz_mount_image$ntfs(&(0x7f0000000200)='ntfs\x00', &(0x7f0000000080)='./file1\x00', 0x0, 0x30, &(0x7f0000000580), 0x0, &(0x7f0000000680)=ANY=[]) mount$overlay(0x404030, &(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f0000000100)={[{@upperdir={'upperdir', 0x3d, './file0'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@workdir={'workdir', 0x3d, './file1'}, 0x5c}]}) umount2(&(0x7f0000000040)='./file0\x00', 0x9) [ 585.969105] QAT: Invalid ioctl [ 586.020650] binder_thread_write: 24 callbacks suppressed [ 586.020665] binder: 29487:29491 Acquire 1 refcount change on invalid ref 0 ret -22 [ 586.063896] QAT: Invalid ioctl 13:30:27 executing program 0: r0 = socket$inet(0x2, 0x4000000803, 0x4) bind$inet(r0, &(0x7f0000000000)={0x2, 0x0, @broadcast}, 0x10) getsockname(r0, &(0x7f00000036c0)=@xdp={0x2c, 0x0, 0x0}, &(0x7f0000000080)=0x80) setsockopt$inet_pktinfo(r0, 0x0, 0x8, &(0x7f0000003780)={r1, @rand_addr, @dev}, 0xc) syz_emit_ethernet(0x4a, &(0x7f0000000240)={@link_local, @empty=[0x0, 0x0, 0x0, 0x6], [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x3c, 0x0, 0x0, 0x0, 0x4, 0x0, @empty=0x9000000, @broadcast}, @udp={0x0, 0x0, 0x28}}}}}, &(0x7f0000000380)) [ 586.195654] ntfs: (device loop5): ntfs_fill_super(): Unable to determine device size. [ 586.561324] binder: 29465:29522 Acquire 1 refcount change on invalid ref 0 ret -22 [ 586.600877] binder: 29465:29522 Release 1 refcount change on invalid ref 0 ret -22 13:30:28 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = openat$rfkill(0xffffffffffffff9c, &(0x7f0000000080)='/dev/rfkill\x00', 0x800, 0x0) ioctl$SIOCGIFMTU(r1, 0x8921, &(0x7f0000000100)) r2 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000007000)={0x8, 0x0, &(0x7f0000000140)=[@acquire], 0x0, 0x0, &(0x7f00000001c0)}) r3 = dup3(r0, r0, 0x80000) setsockopt$netlink_NETLINK_PKTINFO(r3, 0x10e, 0x3, &(0x7f0000000040)=0x80000000000, 0x4) r4 = dup2(r2, r0) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f00000002c0)={0x8, 0x0, &(0x7f00000000c0)=[@release], 0x0, 0x0, &(0x7f0000000300)}) 13:30:28 executing program 3: mkdir(&(0x7f0000000180)='./file0\x00', 0x0) r0 = creat(&(0x7f00000001c0)='./file0/file1\x00', 0x0) lsetxattr$security_ima(&(0x7f0000000140)='./file0/file1\x00', &(0x7f0000000240)='security.ima\x00', &(0x7f0000000280)=@ng={0x4, 0x12}, 0x2, 0x0) ioctl$SNDRV_CTL_IOCTL_PCM_PREFER_SUBDEVICE(r0, 0x40045532, &(0x7f0000000000)=0x8) open(&(0x7f0000000080)='./file0/file1\x00', 0x0, 0x0) 13:30:28 executing program 0: r0 = socket$inet(0x2, 0x4000000803, 0x4) bind$inet(r0, &(0x7f0000000000)={0x2, 0x0, @broadcast}, 0x10) getsockname(r0, &(0x7f00000036c0)=@xdp={0x2c, 0x0, 0x0}, &(0x7f0000000080)=0x80) setsockopt$inet_pktinfo(r0, 0x0, 0x8, &(0x7f0000003780)={r1, @rand_addr, @dev}, 0xc) syz_emit_ethernet(0x4a, &(0x7f0000000240)={@link_local, @empty=[0x0, 0x0, 0x0, 0x600000000000000], [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x3c, 0x0, 0x0, 0x0, 0x4, 0x0, @empty=0x9000000, @broadcast}, @udp={0x0, 0x0, 0x28}}}}}, &(0x7f0000000380)) 13:30:28 executing program 4: preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f00000000c0)=""/148, 0x94}], 0x1, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000080)='io\x00') preadv(r0, &(0x7f0000000480), 0x10000000000002a1, 0x0) poll(&(0x7f0000000000)=[{r0, 0x10}, {r0, 0x1000}, {r0, 0x1}, {r0, 0x8}, {r0, 0x4000}, {r0, 0x60}, {r0, 0x4000}], 0x7, 0x200) 13:30:28 executing program 5: syz_mount_image$btrfs(&(0x7f0000000140)='btrfs\x00', &(0x7f0000000180)='./file0\x00', 0x0, 0x0, &(0x7f00000007c0), 0x0, &(0x7f0000000380)=ANY=[]) syz_mount_image$ntfs(&(0x7f0000000200)='ntfs\x00', &(0x7f0000000080)='./file1\x00', 0x0, 0x30, &(0x7f0000000580), 0x0, &(0x7f0000000680)=ANY=[]) mount$overlay(0x404030, &(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f0000000100)={[{@upperdir={'upperdir', 0x3d, './file0'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@workdir={'workdir', 0x3d, './file1'}, 0x5c}]}) umount2(&(0x7f0000000040)='./file0\x00', 0x100000000000000) 13:30:28 executing program 1: socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)) syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0xe1, 0x400100) creat(&(0x7f00000001c0)='./file0\x00', 0x2) openat$dsp(0xffffffffffffff9c, &(0x7f0000000200)='/dev/dsp\x00', 0x8000, 0x0) syz_open_dev$mouse(&(0x7f0000000240)='/dev/input/mouse#\x00', 0x100, 0x10000) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000007000)={0x8, 0x0, &(0x7f0000000140)=[@acquire], 0x0, 0x0, &(0x7f00000001c0)}) r2 = dup2(r1, r0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000002c0)={0x8, 0x0, &(0x7f00000000c0)=[@release], 0xfdfdffff00000000, 0x0, &(0x7f0000000300)}) 13:30:28 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = accept$inet6(0xffffffffffffff9c, &(0x7f0000000040)={0xa, 0x0, 0x0, @mcast2}, &(0x7f0000000080)=0x1c) ioctl$sock_SIOCDELDLCI(r1, 0x8981, &(0x7f0000000100)={'eql\x00', 0x8}) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r2 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mkdirat$cgroup(r1, &(0x7f0000000140)='syz1\x00', 0x1ff) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000007000)={0x8, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="056300400008001c43cbcbeabc6cd300e49147005559c5ca01b70ab09d1acea12ce927363b3b7d8c46d53e46d846587d1b83374ab1e2c6d14f8498c5c8f528b5fa40f76fd559dd4faf9b5cc4382e7267df60cbaf97c72254c6b03c68c7f713907230d79935d0586a115eb5c9fa19ceef723972fa48a07bca170eaff90341dca325a2bedae7acb292bd169352554fd75001e15931de70123c7268d08b956c89fe0fce7ba15c094621d1877df4762c95c728d94aceea116b3fc7e8f7a1f4cd4eef32c7dd29a68db379dff694aa19b88999f9a2ea23941ec141485a36b2e812cd08410015bfe382"], 0x0, 0x0, &(0x7f00000001c0)}) r3 = dup2(r1, r0) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000002c0)={0x8, 0x0, &(0x7f00000000c0)=[@release], 0x0, 0x0, &(0x7f0000000300)}) getsockopt$inet_IP_XFRM_POLICY(r3, 0x0, 0x11, &(0x7f00000001c0)={{{@in6=@ipv4={[], [], @multicast2}, @in6=@dev, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@loopback}, 0x0, @in=@dev}}, &(0x7f0000000400)=0xe8) r5 = getegid() chown(&(0x7f0000000180)='./file0\x00', r4, r5) [ 587.630542] binder: 29530:29534 Acquire 1 refcount change on invalid ref 0 ret -22 [ 587.665453] ntfs: (device loop5): ntfs_fill_super(): Unable to determine device size. 13:30:29 executing program 0: r0 = socket$inet(0x2, 0x4000000803, 0x4) bind$inet(r0, &(0x7f0000000000)={0x2, 0x0, @broadcast}, 0x10) getsockname(r0, &(0x7f00000036c0)=@xdp={0x2c, 0x0, 0x0}, &(0x7f0000000080)=0x80) setsockopt$inet_pktinfo(r0, 0x0, 0x8, &(0x7f0000003780)={r1, @rand_addr, @dev}, 0xc) syz_emit_ethernet(0x4a, &(0x7f0000000240)={@link_local, @empty=[0x0, 0x0, 0x0, 0x2800], [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x3c, 0x0, 0x0, 0x0, 0x4, 0x0, @empty=0x9000000, @broadcast}, @udp={0x0, 0x0, 0x28}}}}}, &(0x7f0000000380)) [ 587.700553] binder: 29530:29534 Release 1 refcount change on invalid ref 0 ret -22 [ 587.734978] binder: 29547:29550 unknown command 1073767173 13:30:29 executing program 4: r0 = socket$inet6(0xa, 0x2, 0x0) ioctl$sock_inet_SIOCSIFADDR(r0, 0x8916, &(0x7f0000000000)={'ifb0\x00', {0x2, 0x4e22, @remote}}) bind$inet6(r0, &(0x7f0000000040)={0xa, 0x4e24}, 0x1c) r1 = dup(r0) recvmsg(r0, &(0x7f0000001600)={&(0x7f00000001c0)=@nfc, 0x80, &(0x7f00000000c0), 0x0, &(0x7f00000000c0)=""/106, 0x6a}, 0x0) sendmsg(r1, &(0x7f0000000480)={&(0x7f0000000280)=@in6={0xa, 0x4e21, 0x100, @empty, 0x40}, 0x80, &(0x7f0000000440)=[{&(0x7f0000000300)="6b2d51812114eae8486a1663622f6c7e796e4050c13b1c", 0x17}, {&(0x7f0000001640)="fb678acd02d6b69fabdfeef2ed935c01bd31641dd69d5ee1a5022d5efa32530bde33141c7430463be8ff6f2b6ec68880282bdb01868b9296e4e961b9ae1d3cf0d52490b48e9a73d1305100ec9fcb3482e76312e2eac2588eaed712695f88f1bc916f9f3ac3d12550d1aa8586123e9db7dccf1e0bda856a549a96c7b6a4cc1c8dad0302812d780906673dae3e36c51bf4e29e8b35e6d6132fa6a8d3665e07a0541208883f5ba50a6bbf285d2bf16aa8d9cce01883e6d45dd2d6ffdad96127a253204e9a205cf40ce687af063374d07a4b8f57ee8ff332f0acf8f5ee2b8c07e8c3094f406627fd220c2166d6367a80a8cce2c9fe35df39bcb75af3bc655a4fd57ee2332baa0eb065f6ee41a096ebce78dfe77d7063c0af5e4b528b8fe0522896933caf80de618e9ec03ff365b97370293be73044d3f6151661cb99a6abee478b9c528b668bd100729d10184c8cefd62c8a6b602ff4385a2fa831a2a5148f8617182fa2d5b9a8cf139913f22f70e0d8e4fd02826b4e52a1ff0d561213e52827686d7560954576eae35381fe3d789463f714dc191b781309106e6249ab59a88eef432def8fe505d669f33d007d1dc1497085ee1ff90647859d8a6c00e9d50b6ff72dd4390089fb46693d8713614834b798e57a279846c83d27886430554fb34edd694af14faf3abc2f4bd67e87cc324a8be07296e442208a32d293e2908a52bd874c153156e28fb19f5d967d70e06edb35b8596ad2056e09f46846c6c7894544834de3b2c92892a639dc387842e952733bf2126ddb2996991ccff9fa4267f568d306b42d5521ea624367e3ecae909337b2a2ffb4bbd30a4a6fb2edd15468499a1027f1f52e31caeefadb88209492a7eb87d54994bfac5606b1b99b405129a333e3c331169edf7f98dde70dc63d81acb0a8919950611bd00980c73ce3b7ec96d153cc386ccea91287db41c063354b24dc10d7a640d179a75e6417ca506adca5b30501f48e5abdd86cd66e34f187fc13a826d4fcf245da0e669a04d44fca0515514446e87ca9c6bfd1438ec5126e8b15cf42c007d62736854eecd5f4a9e4e6d4d29e9ee9fad540e82af5f2fbf00e81f4fb96542c2db53db7ed84755c7157d108102f5507f48b2ffa7af07b174cfa3b5abf8f13a4d141bd5b835231d126a4cef13a36454153d40326b9a63d36cf30bde79d34b5d0b262345ba71a9d5b9f5108e069b695d52b5fca8470415ef48e684037c279f8a46159eee129394c661700e6bb3d7ec384ca73213bf5c7f0ac01f9c59acc6ecbf375e995f596faa881b4712cc9374dfb1c00dc331c43a690e0886fa7c3c25bbf2d68610603422f0ce36577c5d23cf540797cf97a49baf77709fac14ab58ab007845fddac5ed77a2c8148d6af247c169b359237bbc4f2b91c0211c75f680c66205f03f4bdcfcf40a6d7716c1619041270af97bb2c0cef4129d671c7a63044578dbee3011dc586b561f2e5c519f0ec286b8d2cb7b083212b0b89beb98b88a0f5a97d9f3a536c210354ab6c9cad8a3729da05f4817c7a8bce28af59f3d6187d1ba8dc2695f48d598c3920c65a837a6fea4ae72695f2e6fa04b01acb80c0e3152110ffa730cdd478d88724bc18ae84ba105caa6e8aec941a0571c5a800525af730913160f30abb57c5c1ebee68ee2d6dd223f94897d4f838fdde942f4505637bd94db0d8d3e77e8cf6946235f1b941d4e94db55b992bf5fd1eb72c78f81eb159113fd439285081fa7393b75b24647e984de21e223e5c453bbe88f2beca8260cd0dafec96ad08c545b9f6ffbafe5d30bcd99e8d2dad0745ab1000090dbd91f32adcb8b08111628a71060c7a404e6d5935464c1b18a0d98a9cf5ea527ae2d9c217c1255ed207c6171e25005a53c4ceddcce7de262766f925afafc9671af8b27cccf830b02c2b07ca6661c2d29340c7a9b61b04a3b2667e1f834b872a2f474f7f11c316789c644ce06a706121729d89d0136b28048bd62a47c4f4efd41ef8726d14ceb42eeb2be66fe74cd7986976f28d913c71e506631ac36195fc901bac508c6223a3d55c7df27b12d6597de637256e1910af780fa25857bfeaeb23cb75287bbbcc8eae0e4a7b552e4a84cf2c5eb45c2f1d960a475b634648ea1f94b120be31ed64415808b833f340e33f3c64eb93baadc82aafc9cac94c6bd5997f6e61c11f8c7b0607ee34b04974b7f46680d28fcee86a5534aafb5a1c82e810063b8b03f70a3dcaabf8c5feb004c97633292a0655d8b3f6b7958ecbb8d13a281222b32dda43ed46e21ae536c96555873ad43011b78f3ca8c86c5838f60b8f3734993a700c0144dae7a4cf2c04d5e43e6def48383ba87d51432f4de76e0c76f91fdbfd2529c6bde9c83edf434b4b19a05c71cb82aa96eed3a9af67a6713d0ffb308b408f6fa93a18977bfbf174509ab6c2ea9f26c076ac0ac96a4e64ed7fc2f124fea71b3b90291057a9dc76d02f470ea73b79f9e38b1776fd39fade965ba00f2dd07fb9ab8cc14ff6fe5116bb0c09d60efd9f4e2c04105d8aefdcb06cf01e786f816a4f0f94fb780383b04856430038ce7028a39609d93061a11a29ae682ce46c5f9f83e9df273e8f5dfb7c549015a06b2b9f0a9c45ec5cedea550b396e8cbc35fdab8ad46387a08c659e531171c739e2107fe3e9b4e27b738f212ae1da665f94f865243b9347ed29d9cee3a9fc180a78830693a6524d60f2887d59c8f9bf36b84fc90a4ffccddb234af56405930cd14de3a9dbf210a5e3112f3804f3fb1480bb5423484fa2c79fffd5b6320cd200e18f7053e9468baeddcafdf91a74bfd8c4e50a3a1e38848d25a72db72fce5de0e463c187772ea7b92e9c2ed3243bc51f1b2da0ade70db1404562291f69c6e2323978a4c20c4ae7fda7555a18157851089af1ba4d2cb04fa7e6ba07e258c2424a9c5fa6a7d8691f437387a5db0707402e23044498a35e6298883fab1c7058f8ecfb10cb13fbb306753186eac141c53fafaa518ce9d0f801864464a51e484b1daec920209166389c8e3769572febbfe70b47a844d29f7064bae96aa8406b9f99cecddf6788330ca6e97c982533eb65920c1f450387fe9de41cf958b7862e5e9270f25fe2561ee303f38571b216ad353fbb1ef30010841fdf5787fdf765026949824e54eb66dad78b4a8f0b580dac3e9c0a357bc9e15feb8a6596829a29feef59fd45b42d4275c6b5d5d154f415253c455700c061e7b13eeb91826c7b711f6f54667b8cf922587efc85eaf5cacf91a7d5de63c5b83331b584009422504b8c651207ca8591e10ea25c597051096bcfd785336e9b06c2e26893309b1c641cac374f4fd65f7e3d7c2f76d995c1398ab2cbf9081acc8f84be8875566c2fd8007d4ecf15bea7f1da15d5085f103441558b396a961d4b8b6fa0fa331591bb199f852ec01fd9b8d0e768a849941c8a85d1efd4cb7d3b2c7feb711334e578da93a2887b7b32784ae50e23438a400ae4aec3c09deb4ea5ef0b6c2a826aa37fea1005271ffd799e2f72e4f938015acb171f2147dcd0a81647ba10a16d1f797469da3cb6a956a682b8825c87b139ea581e00f4f2f8af90b5947e3892729491f91c4a581bb94816a5e46a3cd9c2e3cea3b1a580651a83d421d0af4271fa459c85bfabfddb63a8b76dd418a279bd6362cb921c6bc04c3dd7ecd5bfb01a923082009e09383a2db86a9630237ef18a21c1ccc9f0885772576a7d760c654b2d70bc3cbee1a35095fe3281be8e9ccea6861dabc648ed79ce576a0779f51d8a647cef1918169917cd8307f6c4f263d9bf3ea79d379721a7c65de4241d507445cb40d1d3c8a7f529e8c1c78d06407a9e7889666b629bd567c82b26830433b60625cacea5af03f70ede4cb46fc68072a5c710a20cd619fbc50f2a4422e20111555ef3ebc473578bc1e0ab9d887ecfed1c48569c11999cc6a249b575ec863f80fa6bce324310a42e528468a2f098eb9c1b95651902ab32f88e5b756709a6f4ee5bb8196acc9a17a7eaae9cd2290d368a1afd45d5a8decd583b776edd3237b5788d0422f9e465bc1a5b194a838c1a173576d06701d7f5b32e747f84b92af818d4bcdc1ba32d483b0ff8abd8d3f7769964e348b35ab1068d724b267361f73af1c05153a71b3ffc12d5538cd522ef995b03c0e7beec402284e6719d01f2a2fc87d5cc6cf0d9c401534459f6153343a25bcda3bca4d6930d525ac122f0db941d8bfe0314cef5954363182337deeacd74df498b0f84da03e6048e3179746afffa36216dd9dda25d26769e2a852e04fcf2ca6aba9ef30f764945475f8d5ee6ca07694001512dcf76a53b25411d7b2dc0d29463c484abd817f2d364cc3dd30d92fb05151f8638e50312b15a188bd413967b8bee275d13e582ecbc5e84ba56b319e31dd8f73977ba3e821a8401921ef096b5943c2ac7ee7a17e55aaf120aa900170b53a9a80b61601d214dcee8bd952a9d9434f197a0abbe55d3c8a02a7b80faa3a7b80a5f29e5381a5c0469d6f4dde0350fdc6b7db5b572ad5c67d2219164c1f7ae497596f069bf8b4a5bbe1329079823c57b7860ee2dbda3b48aaab6b06192aa5007a7fa1378e09474b1a3efbf55719922b959a5893179bcde31dce67aa1e663c3926aae07fe9ef319801c5cb5806b2ef25e0fe1ab807ad9f5481d64876a53224d671035fa70c6d81d3f6f2f2055ebec0a8208b88ab79931127aa3ed6d44fe32f3889b898e5351881aeae14318f242d4136eaadd2f2945bc1d0e766942d0f6f6988de04c1b49d758d9787d3f2f58df31e9d03a204ed68853db49bccdb7080a76d6358ea7f8f9328bbc14ac337bac999803a86e3e0e24640c501adc295d259fd0928390aab00b78586c7bb24ec74ea907da31d208a5ff8d16e7b53fe144d21018eb876a6fa0af9ad86976c3ec6b14f0dc0ee4bf45fdf141b43e78d03e98e331903b9a38557b925b05dec482568f84580943b4ebf0ad6e29e722e6fdc962204cab8be30bad4ca47176ceb38468bc9d907fbec752526cf43fc077fff1b95ea82267b6c82b7bd185447c2c39a1147abbadf57d1a0accdad103d42a7800921ffce9097709861c87804ddd952a9edacc571273123d14aa0d6956378da91b5ab882f13c0a34db83bad1876b33bc38fc9847cde9c003477e402bc0219d20d80a9d1522e69a2ad28b4e1d4d2d8f008ada48e4c8dd0b3afa1353d111245e21e0ea06893e959d18c7f577f42877bdaa3267fe70bc1b5b81aaeebd958d6515cbff6da57a688c24b2290c7f5f3d10306bb6d2ff3468c5ac27b1315e1bc77f321989ce966b2cfc2fb88ccaa75e0e62020d608ed3c280c6c52c31d8013ae72ece7eeffed68a27ffc14e1414d5e68886eb8cbcf1a743565c88f761c162bf52cddea1d515cc7e943fc8345d42bc2c7f891c36131bc1f6cce8e32e2819a88e28f907d7f052750d66fdfc25151e44bb657786ce67bfe791950bc2d1af0f4e013c2c0e7211197cb2bbd5057ceb1ca9ab5c6fb7a905d1db23b1e49a1a15870435ab7cb45121c066eb691b50d13942ef0703dd600c50f95f89012d69a2e35c43e74f5fa832eef81e4717bc66a6c38866a4592b0e4064f8dc495d510347f6f61ebcb1468533147538f56755a83bcec53894ee67dd920b2ec584ac515d5fd377e207b21859ed386dda0aab3ffb3bcfaa2b90a68393df4c047a30042fa49ef69bef0c6a5e7dde36bdb37292134955d7e2e3799354a980ccb64c7f9101309456ba1362fc703b2b6d01c3b75b41e4f2670170fc97bc44a18d4129bd5aa22488795b34fde1be", 0x1000}, {&(0x7f0000000340)="abfef38607821b83a4ac039407bd892e80d6cd16a9b2e815c38c6ea3885e8397c9e0333c21eece7efbb4bf770ae093dbcdb60d31799d58ce5811e96cd36fa9636379fd8b67acc595e60c48b2d7b655659b7c13e0e7365b9d1413f2db2d55609e6ff548927937efbf6adc91c5e58a460dbb4f30ba", 0x74}, {&(0x7f00000003c0)="51d1f1bcdce7d52a9b1c7ace856885dfcbb0c8a527e402be30adbc05de2758f0ba0ef1f8b68b88b59ca843e86b477c2feb219530354119e4c78152a3e7b779f54e227c3cb504a573c9538db9c5a1476b936d8f18832809b046352e6f8dee94f444947771dfa820a8ed7131b40cb6b45aa0d51951722ddbf1fd6d", 0x7a}], 0x4, &(0x7f0000002640)=[{0xe0, 0x110, 0x8, "d5cd6f23ad55b9895ab15321ba4360e4cb637a476d7fb94c34b3f384de94326285ad87040afecdd8f7c7fdeaaa15f48f151b743e0d378fc418508fe1bb068d55abb5a8a84b4a4dfaadfb9b8b859173880982c4255a45e66e95d5df3e753542b9afa6a8dba9e211dd0c4c79e2cf796a61fbbd2085008b54554ae6ff0e6b19bdd3579c60896d0a05c0a6e597fa7d4e2c9490dafb763f2bb220829b66d0e57321dc35237f969826212ff99232a915f4d61698d8aefc324515d4ea5f8c2e09e490de7408dce5c86a5f4e5d3d"}, {0xb0, 0x109, 0x1, "ea0bc9e93e62b12a405e095b1e257f2a95c4362962ba7c2966d8bc3a2bd7b3f6de066a1687d183ddcc6acc1a145fd878e16b794338404f56c3bc0faa22d1ea53b1845d28514c432e25a2ddc302212dba009202a10b96d7fe71e8dce35163d4849c00fd6c4e81114da6852fba821c38f6687973b7805100de53c3d1f639f7d266a6ed71832756cf88664f76757d2dc218e14d688919798b410a3d0042dd"}, {0x20, 0x102, 0x2, "06507302c8e5938700b93dac4323c9"}, {0x1010, 0x13d, 0x3, "a319753da9e4e9229c3df43e7573ca925fe617817319974bd7319bbffbaa790d578a96a6469bf0222c763747a444c4be4cc3a9c969bfceca1a2481c32b15839359c8af0e7072a4bd3dede026e674225291a8b5ee2a57522560c88bcbe28508bd1d26e470ab74dff26072d7d41a9b6125829901a867b4120e84b0e295b17b6098e56f925bbd8c0cc8618373765fa31953ccc9bbbfdc5bb14dab8d0937509d48ee26f7e69f0e48dd1a0985d1c395899152b4570d239a62c0d46121b8f051647371e209dc466e385a1d989f665da42820304822d7491113e84b1bd9efc59b42d12d821c7c9e5820746dc2adcae2317e7597838ac30db91c440217e359d294374902c593b3ab9dba5b38cf530fdbb561e39a329eb400c23a57722c1e011999bb59382835c655f7a95b51fb7eda7668ddbc571aa3047976c005521de996bd482f991a0933c2b735827da121b7850a31361b443a3e60aa8bbe9e384e18e95665112743d42c0f85d49e792e5a8447226409a637b6af598d859f4bf58a3921d30660b1360fe12630b14c44f1828c8cc75d1bdbaef623ed472393f4cf0d6aee19134aafe33c0a2b6de91db9bba9c9b38861e5617e1888b162c874219a55345c85ba738ffb683b29900067cd8cee7580916833d0edb51b4a2b9c32f569c7ba7050b056ad7e58996f1a7736b5c60e1dfb1d809bd4d4cf8db2549dca08505014119f67cd7e7304d10cd45a60a274bd9aff91c8fdb0bdb945e4b389f07d2c2f084ae2415c4e551d59f48488298acde7aa4cc4327a08c2c242ae529701e65b93d9a55a1f28697f1d3cb30bc9e9c2ce37b170977685dbdc3dd315768518a61a0855219ba1d1babf5daf7c098e75e13a7542575eca30a4872aecae829e6cea5160f54342cddd16fec24d56a02976c1776cc281c518cb1efefab9ab8ff080165f160450b8dde0af3576a5315eb9c75132bdee90d58e369d418cf1f955c53b421a843595960d6aa37fa5fcf95cd7a866820d2c0877211b9912956ae491441375513cd00a320cc8ccb65c477608b8a9fb56ec3b30d0f4caa97a4714594c752983605318554bbac88afbcbb52dc09d7be412d522d8a728f82033cb11f5a6371a350395758a51f63c6e93c7958b53ece30d16cb9565ef0a628c9778f4a306977174a5a7d66fe80603a78adf3fe006720b6ea8095ebcd7d895c0ec0ae04a6d270eecdab1918304cfc087a06ff07eb231e051766d1830d7fd846bed5d12b03e44e6e70d59775cf0192369cdbcf042a62bf9bde5cf3a6bac1f893531a2c6c6cc602fc8df61037fc9f4b1e52831bc71e1126d2238169b0e82eff924e974d750bd1c58ff9f4ba644f6e7b579716d9c76cef43e699c9ecb57f99fb4a2592ffe8a7efb229df1bb2e000ed7d251a9f3bb9a96dd8904f8dec998674de876c2d9498f999cad7809c1db55431aa3aee685728143692fe52c2a07a0b7311c47a2847d18f635be15394631a7921bb7f4896ff5a2f50e04a723781606f284c62923ae11c12886e14dd5d13ce61645b8e0e530e70e1a3c4c3782c3a3f3f083dbd8761891937dd07b5cbfbd1afd23a45708c4be17b5a4ceca83a974b1234c02807d41e654a407a2ae0d817eb8fa72334bd9884652963868ceb4ceb7a63c8e6a22e62b0f6b43daa7125451be75958bd58809526e56d290b623fd0090d19bf64fd08d22fb4633f6f9b8872a8d3737af53aab88299f0e1de33fd9375e2a3050e278b3da45e1c1e143ade8fca92e20e25d7b5b265a7859fb3f4bd9a09b33cf419daf6d14b629f4b8a16f4e81afc2f817648fd1eed680ba74860eddf36f751b0e379b7e43bd77ec8467fab496962c09dae22d49bec9e7dd9ef9e9b4122664ea8c8adb4c989f35387e7098355e3f4824813ba507c866b251a79d182383a11010ddae1ef3227f98a348444c0ad8b9a19eeaeb80dd6a42c465230f8b58d31e295c1251cc58bd4d6b3beecbf03cd181ffe021989701344d771a891ebb0c5d916e4a704d4c0e2527de9582eaadc745ca5278e439212acc56af071b5e616ba5eb07b4c6d2095751433b8c3fa9fa2fdaf9214d66ab6d771fd137af964d74b2ef542bd0e3434be971594492f25c51a0becec3f931e329059f995a0c24a0ef8c35e04fe8f2eae0ce6542b6d5200e3bd9cfb0d3306e8cbbf1e0308d3805df7382cfeb50bb1706f6de792c4b8c9c4a1608c2bdc3b489799f32952d74e4cbc85e947e835b9b93c63c42dcbeb29fbd5123c8dfc51675d809bff5dbd458dea64700e7c34ad8dea96fc301356cffabfb6264a8bf9156645277d90d5b7997ace9db329edd8933bd020ca00b05b21443d87ef0eefd3638a27dcdd114efaca78a9ccf16627452f26f087e0b394c25699992e7338859615fcfbedbcb4a5133a8c04957be25f38ff9917121f6b89c557fe6e423142d67778ae9ef0c5295a332be95c92c4224c7260b661d8ea33195751b8819b13e5ccadad3c3041800e47dd682b8297f479e9c29329cefe4018bb6864d87a6a5c634a82d39a8964b7b75f55abfefe0923e1be2dcda82955b959e219493cca7a167f63b935ecbb051a28ef8083a597fcc234d56fcee24a6f23d697876ef563879a14b3daca44df91f21529d4508addf092ad464039458137766c4bbf5d90180058582978632e0333931b1e7c6177431fa30680834bc64abfdf62cbad3662c14d48fd934f9830eaf2f466ec4fd8fb34db23303156220c53d591a79b414e515fb250474a1cc87739abd85d39ffe770136bb1ab73979822d7dddcefdc9e9e6e104855296df951ee48d020f60fb50ba92e67f8be73b80d3ad3bbb650fd30e7e9d61c95913b6b7062d0eb49fe78f1c8f9496d4bd8bee392554105016260c5c7c0592c7468d58fea226c6011edde2659d68e608017c1fafd2007a9fa2ccb930d6ef89eab21905042a312e02c2a56f59442a0a2c54475a5774421efc3b13d84cab2cb5d17cd21c2ae62007cff7dd02d28314071805e73b8d85a728d9ed96a5542a38bc0ad2fa85374402e4cf7946f5493dded0f398557de83159f72a17bade2352a3ce48030315dbe935ee3b308b5a2fb821e463690e5c809526d4db72231d878d4d04717b02d82bd808ceed4ee65e0cf38b6d0c0cc7bf7a9b30d36dcecb309f9a6263ab53ca488fdde4a556db2a676196c0bc47242010035220e12d0d05131fa48311e75e792d7423417b1cc044ac8a990b5c783bdd76a9161eab09eddc0ce8a6228bca5d16ed3e08d42feb9a6769a51cc55d40fd3a1d52901348ccc9ab23524c719bfa3568f3aa89c10cdd25560f77c6a01bcc1f793f007a37cfd134681a7ae15deb48791f223e2a886a1fe0b8fa6af4d4abfd60090b4ec7c604195bbe63405a39b9dd5cae0465261be2945fd2e155341acaea16b5c75fc9d95e7a5d9aeb9915e57038f9c3e8dcb3f1aba9b90fc3088cc26fe18559f003f090382ba4b9024985f0ab95bea6ab00de8e36063e1f7826356c463f45ef067c73eb8025b20aec270e7390f29e945de26ade7a151fa6815813cc6ca4035c0ef4f479d29b7385fdcd8dbb954c105929a3120150379bd20292c2e24544fa63db5e39509a858684699190942050eced99fe1cb0dc20ed8dca73e9ecdd967196806f6b76b1fed964515086215abfe7ccdf2c371d25582dc4fbedf532e117e170f9c747c58c61dd08547e05286974dfc630452d78ec5fb8b3749a1f783298c4575847824ad88045fd05767097abe27ac907ad659dd722e74e13f0b94041cb496c4de665a0bb95611913b844ce058d031bc9e190e7ec211fccf42fc31001d480442b6d1ed2fde6cd815c6e354293ecc3a184e62408603ff8a78b955d9d18a17cea2430a7f76813ace373a26ee1672929cb165a7f58baf97cb75429f5ef7739480c8c8f4c620881dffdd9d40bd2146fa72927e83ae2b51326cdb5b5ff721f0e4a7ce9bed9f6dcd25aa9698fdfd753c047d29fb356f84de97bd4816d1d0d903d289c58353ef01e9aec2e1d54e65d883160ca165e4400cd8d1940c5e81142688ed007d0215d284a325d30d4a071071a4f910ee52d08b2d25cb68982fd7951a09542467f4653c882da2bc5ac2accab429fbfb195512bb23662f7bfa2124bdde8991c982b97c0be5aa0ce1a905062553a77243d06d7b7727de0eb7080ea58608a1506322c342950c910992a47d58dbe687af3b28255e578e2de9fb7fc4142d13003e5def04cbc3811bbee5bf7e5cf076a654f815f4a5c9a9bb7f68e48a7bd39db8ddef12ad023ddc3189458506a0f762870fd30d94070e80bb191930666a67bc3a9c9a73d2888630e59dc29174bb6ab07dda4f57db83d1ffd1ae1d2df9eec1616a9af5e4f03aed72dffe457fb9fd0bdf02ed1768ec303a9153e416d76312153018b8d6fbf1ad826ac4113170e4393b68e88d7f9baf222bd6fd6146fc3a782b64c14a37c6d1e8da34868d1101b2381a9b28d72ec449bf73ff96057f6499607aa31c4263010f0d7dda10fd749003833968dc055ebb452b4e6067865ca089583537d2be82e045e9d33e44ae94fee8612c1d559eb368759bd15a071d40dc4575db0472cd24c0a04a0be0928dba53e6cd8eec3badcfd7c55da935b090a025cb12600c2a3d19d77c4eb08200cd11a469d65c2b6dea9a8d2bbc81ffee2d58878138a014ab8c5289df8137ecec942ee013ba94a58874b5e8d6120e893070167be64d8cf4c84b7d92615bfa5339a0e55753e80533f3074b5a8ce5c59d09ab73871f18f57e7383b6df5cb250c2ae52c1b41720335c2a8b4b557fa0d9d49c31ec8dd0dc5b2c4c8f5c1b884e90f8fba8f7dffa38ee68683e7332fb416cb8cb44d527d382121e6db19db11839c15cad58e755b2fe38fdba28e4c9e6501956aba509d21217aac156dc8361d118aff1863a94a6a799cad930e2acd4b0d117f80aac47c3d67e7b36727a05a8ceb123fefdc4770289102a04ff6de679d35b6d720f0d87dc78a3ab177d042f8853d14253429239a62bf066077f6e0e8652f4758f91b7d51f4aefdffd7cd10c5ed0c0c8120880d1d6e05d1e28c3e6b478e8361064d6e813f3f441cd94e4e563b9b49a942a48162f94d8d7c33349c16071382a05b6d3a28470d32685be11e219f95dc9c2f6264e307928167a7c8e47904be76b330bdcc882281e7edd6df8c5fe1edd05d1be715ec260483a8cd8079ce6389f5a4e62a719d5f1cdbb9959025e23646ce9b44cb711c48f25de61150b841a8ae253ca1441c4304b67c72f51b69124d57769bbde67dd15ee0c4e80924fd6773384fdeeac53cc36ce1fd3fe8c2367a97ebc8b059d861baef9fcf11aa30ea03e4e6741b1b9047d28116203b34646636ff68650367d6f839e8b60b10c881ddcc075b4a231a9da9e32c3ff602738c5024e536f2532ba3d25b6be81770d349b303a81f9a11bd030495d174cbb6191f6e8a655c2f316a2f2913cfac0822d0941b3bd29175dd044bae83bfaa738e4ee716298dcc0e9ad0583e447ee472f52f3a8ac7045b6dec9b0237fd6b2b1c82b2509e0d06fcc1f5820a00aa996e2b22465e2aeaed530ec8f012f87daa9aed52f5523842f489499ae88028d7029d9d3ef8d604eb8af4a3186bdf72b99e3a71b5dd598c264773d331579660378476b9b2459dd01e6a475503d570f536ae6ca677bcd22acf1008114f5ea554aab30070d3c66ca9799a4bf2943d1e25b43817c0e0f8855ac525787289e5e12ecd2da109b006e6f2a2c5647a0a7e2227956b0a20a736264a03d928d6394b8e36e44da5cc939571b72d6ff25871e3c6785e98d3d"}, {0x30, 0x10b, 0x5, "a01994a84ce62776bf61fedc6179b12f6626b0796db49d6c99ab0d703c"}, {0x1010, 0x10b, 0x0, "40645d7fe8ead036783ebd590492de262ccfc5b50b40067ef1d231f556b70fd0f1ef0cbd58b9a6dc832e08b3fd9ed8b047084b4667626fc416d7175e1cb2807208781684f66772994f812b86fe43505f9101707a4815780c28ad0c28a5c1fa2297eb1c290d4ce2703ff142e92b97c649091c1edc20c4a9460eafb6d2b4b220573f826908e4905ad0769d032b3b79eca1663ec5edfb068e7375fbe2a6eb6960de231b0d703635aa523cdf2342373aa23fedb6ff9400a4bf027e0ebf386762fe229dc338dbd3c18f7c10e7841a3c63ae5a555dbfc4f0938a2b24a458157fe57e58a0bc20eeef4049e5d7a496bcb9aee9dbbd06c56ed3e8cae7add5a94e04ce66aaf4b787cee6f0b32c038bb009b78dc712460566abd3581003f1b56374178509eb5bc700ff3704e2224f211b8e0ca2727161e7d7b3121bacbd7f75c044adbe2005b988bb096f7ec03f09d0bf5359c3eb646079daaf60b750209fd26672754573a3533aaee1bffef341bd4c2de3da578a2648a0cced98da6b3a90dffceb7f0d49eaaeebcbcdb150b038483d36917b638750ad63079851792a0858782a7454154ddc2ec78d7d9c463815316d267b899284bdb3bbdd71e77468c0cca3e29c8aa3d5c698cab8e53875f4fd5a8e62291f32c97aefc0702adc55d585676532304b4471ebc120f55969b0bdcefc06009c96fbf38ee0f66873457669e843e9916897c94aea492d30f2c51b8971c9d04efffea7d9da0c5957c460735348e4e7f9f5e41357016a62783dabf8df2f40583b4c025582b76b0a68d9076b21823be4ca6775331932d360c4392cc44a12e32fef2ef94b2bbab1c7f9f71a6ad87151e0c54eba44d12bc8bdf9c39a31eec95e5d2b6a05536c9f7318f0b921c57de413ee41839ae9277b15545e25a63fb7ef699992f98a58bd90f2fa31322f2015c710609c5343fbd590c8c3e7fd00c412798a83ff28b7a575dfde9f41d592155260c23d95cb3d84b51ca9d0e4ebbec9e5a7b20e8d0d3351ecdfe3b7a6d8aae2bc02ac106017dc408909fc59c955bb37254c226a916ea938e5d82a860df15ff72432c9dfadeb05f7da17a9ed669fa8efc9a6c7672cc9a33a0937a148c13096841e08808908b662fdca779d45352b86eff0642f69023659936ead5f2a2668d1362404d3996dba3280ad22738cf857195150f826d2a184165f0ed73898ce9822f7abf7e88d7df4fc5ff520713895dfe7ce97dcfd02ea7cdb815718302f69cc1caa35df7fc2d143f00e3fc867731828be03e7cc062f7d4d260d5a8863ec07714053fd366529de40b7aa5e7719ae04a1b1ef5f1e97d0b3f6172e60350aa37348b551e4b14cf0f6756e2a49c9198d8000d4865610acf0216f22c7aafdbd75be7dc52a037686aefa0d1b7c3c9bcaae8457295b1b0540e3a1dc7a6490366d03f21acee5407ec54ddee584f615149fb704aa37970c55a0ef5b367e8ab48dd3865f4d1310af9549aa03b76d7801a201592efaa68a817897e2b328e82b77ba370e6f11815c7457c962994d7acb7e30cd548390188e05200bd43504b6250e8e19db003ece833994e2b83b394e61495804698a94b3ab6975c7378d7c9cd5390279c9fdf5533b167cc3f7f8cf903383c17aa86c15c5fbda7537ba0fd39972c6abd3d04c2093e08623b1d096f381403f2ee8282534358a66e1665557d78be2650f3e13a51e0c8a61b1ff5d1e6d3be95929f303660d7aa31a420e785bfbc8dbcabce10a46a2c6516b6affed74bb594a43bf511b9b64bd7d1a6c0f19a78465d90d2f96fce1b4783e222b66dd36e5d74ff558fa5501f2dee05eca02c575968bf9d5f3b3e18d96bf8af8cf9335bb98bb33a65d5eb7711e17f8b861a4d7b736085957e559a832d9dc638d2d89f7f98f687135741300632a48a7a896c25ad0428660a3a8b7db46e3873cc1ce00b8c03bfb903db87c7f7aa92d972901fb0e81de735798eaa1c69a2018d2b4e9fed0edef79664dd747aef583e4449f46e5c52e5163ffe0e3eca1113d4ce900ad0fa574415447953938cc286671e3d8acf55255ad52901778c6b7c0482be0824e6fe34954368102d748d3f38deca3665fb3e9d9faef92018a585dd082b8af829905e0bb4c0a07a4322ffa3205a6ae1e71997c3b9bc8b4d2a6ac588ddbb8bbb37f95ed595f2fc35026dd9a9d93a4d85dbafb19d34d133885fffb6d9db744c292aabbf83ae4c1d4c2ef8133e2611d169aa4bfb4a5de60653064d31c3537481a6e3e109ee4d2b344f52294deff5b34f769ce102bd374f4f8a8a278051a311088256ee4a04054399b744360bb867d7a949261be5cef3fc6b01e103edbcd8ebadd2d73abffc6ee5775f99a44d0c040ab9a4a4bccb1f8d61bf12084e5b7c076df599b69a87f13a81de22fae386f322acb510a0b8245aa2a6763d5af15380af6e9ab78bb65308ba30e9ce81ce2514b74f394564986fc60e52a70837ca145c946c9031f2956acb8692d73547c33c472957e9225ba5414b455bfd0b377037c1ac6e52cd1cf423070bcdb08e2bbcfd28cc2661e9d1ad4edc5e54295d38e3a83b9a91e06895c171a870e366d617903627a185a5f05a02217f402c08c90a4fac7d6a8b288809991336fff28a32582806f81f3b463877e57b72349abc0748c1e7693789a5623cfab4710abc4ea51a2f879f8f8126e5327335a37cc4d0f8f2725ed524507726325977af5aa726c0e7cc8b0fae586723fd14a6335ce48af5a534276a99da438c8d443c64160475065348448e2091d88f05ec478c29909c18ae6897e52b9678c1f0bc44280a6bba41b512f90e1388e12ac73cae60efffaa68789e27c716446a77e541974ebd94c7747cb2b96c9ad8b694905ef84fd1c680e56401e4401be7e7e403460c956099c540aeb432be28ba9bed9c62197ddc24cf381a9738f1ab8a3e86c0cfe1e41fc66456d1b622d11a64d84653d46f01577a138f8b9d6d3e433c7ddf90a81de63fe0a64bec09e2ccc7c56d0fa1916cdcf38b3fa4ad2da0d4a39ae68e21d6cb017530dfce75127bc093750f8111fe97f9424e34ae94c1095313dbba4190f206d3ef8a110ff105b074f6f5ca21723da3d585510a3d1e199fde743fff5b14f702e36e9133ed1ef3142d2de950d06d9ff173a3659f0f3dd399f7af29243f6d4fe05ccfb347d04eba210fbcd4ef9eede67b3814757d9b55a2dfc1e9c15bb85587290d56674f341cc5aa3bd1dfe91f34a06114a06cb6dfb2d82eb0da90627d2f184022d1bfe98bc8eb0506ecd0f898ac2790bf4bd6c72031f234e22cc3721793ef7ac3aeb5f351063fabe040e4df932f3085e046b6ceac10e602b74daa96daebce9ff5a42ebf6b42b7d496863c5ec984d1e353322cfbddbc13db9f2b2a9289f3d498689aa4196b619a467cfb1574c82b70a31965ae8e08b21d5e066273dd9552839718ecb9245c3edaf8bae8b9cc0453c261470fe8532b5f9d732af02f7dc3ba9574a3c80f8362651501af19ca6877308079378e2aa87caf065c4ba6c34b8ddb22010c2ff20aa93eb5732978c61e66b2a2e36d11a0bc3a429d9f4560340b21f85585c5ef4b465567d0b27e1a40e548dd0bba85e1e15cf46834203406155c66536104872925730a1807665f52b31f685976a479b36dc887f460d030ad55a2f944e05fab2af6288c432af0587b0dee495432506ab3592e7bff2df6c234bb6cb4e4b67f43851e2b4b5eca429d9ff43f2739d41e71bc3514136d3707f08e7e20621f916753ed077d9a91fed20459c7082efc1d42749d69ec23f29a9bf20729ac45881d64c2dfc9f55fbed4fe686b3aca3179b194ee830038afe9ac094be756995cac61b89127b6244f25426a4af06d2f2f652762682f07b4308005e9b53a00488a4dfb91ee685de91d9f2ad6ffc0a6445d8c631b434a6490af7a381886f52307af58b986c2f732b0ad300312863b2a558d5f9c3b1b16f988547ef7bf36be19abfa4fdfef191725ce6be78c614e1d56f5c9f654d4b7ecb824b0ddb1ff057876e28cb839c3643cfb4e074215609d059cf480efb028741098817e3f12fcda29c6c643c08d3fb6c2029d3b319959c8921dda915545db1fb03bedee138d8b2d3e02616e4f89f6f02195c0ed0e724df4d18716dc89b040a32ab427bf9cd6e0fec7cbee9c1e66e0f12a90cae2539e8adcd6d6cccb761dfdbb799e661635c19c3c130215a60019b7391d326b8b57ce429f7836201e3e9fb4eace1393e06300d1856582f722f40d800d1c387315cad682d4dabec8740af114f78cf6569b3aed213973ae4b96e1237c080c7ec0df7a62e2f140b1375b71ba0086bb4a5e103ab32e12a5b8ee1012c430032aaa5bed6980a6c8f11690ec8ab9176d43bfa27d7243d8181168e4d0ec075104a9f751536650db77cb86dda52f9ba6e514e92590a4d16ac0c110befce6758617bf56fde94ee191172b0f1fa35f8b1321981ef6f57f61dd5fedfe842df269dcf4352335f5e579dcddd04d6abae4e3f3ba6dea2db54ddea2fb5a74805bcce95b7ba953406ada8d3f5bfcb60542de7ed1a45a590cca104a50bf98339ba181e55182c9a4d9b4d0886f2c2052294f8a2e8b637e3155d8b26fced11d98a84fafa5e3a1f23bbe25df35052b5c7db1e34046722d66f86c75b056c89a0e86f450817fc3e4c18246057029559c743defb55876120f08351eaa8b83aeca57da1dd3bd2a5b283cef89835294fe1e7fd4e84337753c6f0adedaebf34345d0d939a0ded82c978fcb2cdd31984933a8be55c66134075aab793aa6cb8b8ed7c0aad336265ea65e9e17c5866593b75795eb269e0e8911809d0147bb6ce10e184f30d7095f834ea43a57668aee81e0bffab6e3b88a82d711c9ac59d413a7d48f4554b2da12f4b85820a5abf16fdabe6ba8884ef5701be55d7c042ad17f8dd7675912c309d5c01e25a3a6e7843e536a12f2cd62c4e0f75d0511beb782fd426ba59d2e91b078c9811ebd093f1e644b00549068247521fff0490e6629eb4afcb023ccf74b09c05a2137acbe31eab0043b339f60db427a6e8f2b3d8327988bd70c55689e89e3efcf0fbf3f4163b07678de13170087e85c637215194bd0cfec84342a63a17707dc50c77248a78df4a5c28628109f91bdabdffd14248611b8082ec982b74709fca784b00f571a3a1a212e6e801881d23ea7e05f3d19d875d5b118c1ca0d5ed936a0d2c914ab476d2514ed87c70965c1b394189abbe7fa09e40d2269f8c1539bb49481e3dbbbb10dbd4a74835c5adc3267f9be9b9d6d09db3ca641358f3cc9373bdbe5920d0cd2f21420512efe925832665950d34fbdc2aded03a030c9f0e15190c74ac4413a34f4ad78771f4985da994ca55cbd3b7ca736f46c42edfbaf04e880321b4b6be261a684c5d82c0c2072fc8de84f3bc581f5bafbfafa64eadbd2fc7cc46fc001e4e26cec6914362885bac7c97e0e5a732d60a73c72d637af20bfa8c797f24724074509f6af11896f76d1536a4812c2e4e93103f3a50c9b10369793e24f1b93d1d5a6cc2728317465f6e526cf551d96cf078c38d4a5a4cd38d7e2afa5fbc23b8779f961f9385616d049e2372c7e260f382f8a225918682368904306a09bb0b02a7704c73b7c465602b72729fcf8abdc8f44f667c938d94c53f72e0268b6a01d29b5329030d05da8db7a536745c4fd763f0e448e6ef52e697e3f796191e998051da7244d8c6ee4502b70d499dc139e6c8dfd941918555cf664ae48b4bc315da4dde128a896cf2abe9673ee0a589c1768c7701d331612ad4f752ef38cd24df664df6c7989f95f550"}, {0x20, 0x11a, 0x5, "c755a2ed4b9c347177"}, {0x108, 0x0, 0x5, "b77732ad8175524dab7983b558a212044e36f455656c1eb23b4695a7fa32b2bb407d0302a8101ea0e50ce46d1550d4f57fe2486dd0470d9168e54ccc6106b4caf5d73b7e4495fdafc197de744d34ac94e7d6c707a71c0ea137d35a857efad8ec81bae8043f83200b28088d4d4a088ccdf6a45c90d49b113c181a8ab33a97f0088f7a75964d5c96cba4915ed27023b1851499227a63a539a18289e0211767b79934c8cf572d3f12cf5aa8443ed07a1084aaec8dd118f1c893e6df76a184efb41538cd8a94130d0a0ae6adcfb11e7bc554ee7f4b9eb5fbb29e64e3e24759a72316377419bd1dd6159d633214622921a569d9"}, {0x1010, 0x116, 0x1, "862af16c549fdc13e1e4fadd054109d402a99beb350eb5e557ec9ed0fd566e603042dc730b5f62d0f6b65d9534fd362e02eec656e1716be6ccb0c0d7d8ebe6e20d02bc3b1f9b86c245d1c97cc4a4714e8d7fa36b7a7cf858522e8a3e21772ee5091ee99ed31686006dbf75bd52b2226302a9198e39133c4a6bec6eb8c244fde146aaa8b7caff510eebbbff2707068ef2877b2bfd253a62dc4e03157857f588c84ad5710642450a7507271886170083e37c621aba8c491fb7fe585c5eaa1c8b65abebaf1deec849104cb8438a90971da3a86bf0ea6c48a2cd92ca07f4349575e7806b05477fd35ac80c0244ec700fed3b46d22ca28d13681e0bfcb4b4f03437e383eed46df96b571f9bb9fd2d2d5e2ed94c650332fddaf4ac792cc88529c956e422e0bc2575a10060cfbf2b7e768618e4eca744b0a56c8936c849a5956258dd9c7bf9b55ff57667bcbc4734a956af2dfd2f290c8391c188d15e79424030cdd3641f05456a5c31f42b06d3a3dd8cccf1b29b62c1fca3214c7a55d22b946f8ef9b80afcdbcb4a7991404d13fc8d59a850e14f5bfb7cac49e29a7cbb030db870ecdabee881e0c81a129e5b92991327188c663d98091e9b2a1cd27daf4327284ed4de68fb5df3a60d0308bc3edc7c69d22418b3f6f43cebe46da6a1215455c6a9b2a856e202e1f3fbc31863e0269dbfd827d3b9f18eb7cc946d7d436fa87d8df298ce5d5e39e33bc1db3775393cc7834add7b225468e4f2a458e5f0b3abc6c0143da57bd055b74835a87f418d39d2900f772596405c827a63204bff84bbde1dda6afa2c464e68c6dce1a3f4e520bb32c68bf1fea51a5ac8cf0f69aca0d7d09f4932b327219561226dd56ab5595748813aa1d60dbbf07a7912174b17a4a3a133fa2d21f577d6cc5b05f24330b2675f91a5bcfca6d152bc3cb6605df00debd578408a5ee40b971a17320c276b4538c8b22abe7a5a6254fc5cc07364cde5d0ba8b55fe96852636dd34212a8992f36c95d94bb2d68781899606e2586ff42bf69fc067b46bc35badbf3b3cf25861a1485b5c549b3a2382e0281c55d7111b78587e9348a172a82bf8d0fcd70974a45cf6bf7d11d515307818c52d5b79da90d298e7e30eb08967d27156ad3cb5a59e343e3b5edeb7e5106cbbc100eb033b4948816d6806f6f8919b88db55d42c2d4e43702bed0a15b0cc58e8db7b2efaeca0a99910f069aa0fdfd31314c620eeaa23aace052ece237e192a53933b171a4f967ede8012d81fc4b7cae1651c7972e60a432319284bdf19c93a277b39e43cbb8dd647cab86f4238f65c314833a3731da525b74284a53dba88f18e29dca0046ba1ad856996858ede7fa0cdb12d50ec793871c35c877c0899f84622d9ff819b805cbd88dc23d303bdd3624cd4109822a683f1b85047114803c7bed85a091ed66f1365ae00cb492f5a22a562a8432ef432a3b48c80961faede0ab24993fb18a98724e7831f0e51ef3d108e6bbfd3306436186d4e01ba082764805c0e5d3b1ae256c6f38905e511870ec8134daebcc304661b70e641468fd9b0e91f52546fc2526f9df6c0fe1d85d9720f063c249d57667026dc711d5bcee5cc6448b805b81f06df5ece718f196c739e4f6fe29cc9e3965bdcd0506f9089feb504134c5bc93cc5726bc62140f492450b5f17a2ed571a8730a0ad917a91446041dd10b6fa18420c20be7cf5578cb65965db1e52b196b20abac4f9f607a3385c9c99701a46c3459b031edb12f657b49dfd10ce137edff1c4cc32c41d1a82e0cfaa8f261f888b71f513b46ec63090d1702d0f5ed9f08d154541b44b2e612a8ac38abc77a1be69b793c118746f17d694b53304408f7eb425a13b7b917d5d6ac02877bf9a2572a12ca059610f0c0f696e73eabf2e1b49992e7244f80f4ee65a804baa91a83b6a0494d41fdf74ee7a89e80182dce1f04f2b7937f6cc93b63e0ff39b0aeb28cc69801731f742bec4552c0b574d9ed69f65426dc4a5139c0acf6dd152830a0b30e388cc1ee0a45e3eb87587828f518cefa130f56a14b5dcf10f4b0943126448f31d1c520727da3abd82e43b544015f0257d1a07ec30ca8c822425af3573902fb18ec9b101a038a37a08e0c3fc13667ad537c0362ca64741f53a4237ce6637374a4d631bac51a27a8ed689c419c506c06e522cfe8f9a386bb14bd6ce8bf81e9e87b6909180e7ef3ab4c4e6b968422a8928cf0e5531cb33dbd1f793de2dae7a271a8eff50a5fdf9036da0316d7dfbd90b6f350ac4d2234b195f5321b2723aa898882467709d86aaa7101a2f89da6e50f4507f99f9c778d46bf4859938c60b352574eb67d5015cde50b2c490fe30ab9856e7a09ae44d496490c07e5d536fd7a9ac33da8024c48b989da1efe1f5e01a9658baeda68c333a508ba084474e376bafa4e15f648265070b76da0e95247c5218a06c917482c22d044b581950c907b889cdf6dd9c21e64afe3c1b9c90984e85e273cb7a715f0cde7088120a92de780127b2d59e7485a8976c6982e9cc87432e7eda25a168eb4c4dff34f41f1bea06f6d6bdba8794381e4d172ec33d022f346616714f1e689a4b45e0e64258fd435501b245cfec14aa594fa745d229ac31dc3e7d8ea5f980c31cd8c1171def8100180c21f994faa700d88692124af02491df81998288153aadb251d1d8083ba5f21397e5f1b2ba372cbbe0ed4482ca1a4f6ccb4cc4a4291109117ced5bae1d84b875ef45bdc889cc3a3daf5970a029edd13d2f06c4f6cc08f268bc9ae683fb702c9f71c2d2c2bf827bab12ae3f052a6d49d1134c9ff30dd99c78319bc1b5ea01302e677be40aeca8a67a04ebc9a08424a816a68e2833394b60c6fae7080b896de31c5890125653479040b03daf408791146eca8d17530693de9a5e745d78cdf30f99a77672f741f46f132688bcb7d85b6f2a1be7fb3ad58f8169e9d99a53e8ec37a2c495c7ff18cf6a3b84e85bef221bf957bb7c887c90224050a1919c7f14607b981475c7db09142d15bf5250eea6b49ac61ecd904bc0f8369a11f2435d20bfb089fe1f213818a7bb95a28c869deff40d353e200ec1c10f68f8eebcbf3c16a848fde7f36653a37ab6070a805bfcdf8a02b44ffbb4f2d24e9e5d89c9b9c3c1db600ce6c88ee95e3da5781364ab01b3854b9bf06513525cb849f4807ea3c59f6233550639c18b5be2dbf857824d8545e932dbc6be6384a4d0f6f0de95ac48fed89480c053c102b35d10ec5e9788f8ec7e4efdb3b14b00fcdf7acb903bdd3488d6c9801d6e6f77b888f9e5a5d44f6c0ef17062b248e2036cc4b69d1772e0d507a26228b3e8ded9d6f676cb6725f536e3813abd843761427178dc48ac0dfb66810194fa7f6d5127f016cad8bd0a13864c9ca3a917ee9b6943f4617b14f447700990ba919ddb8717e0f91783b240b5805f50f316a06f6f40a0b2f3007688cede9a32490fe883f0fad56b69b89f338ee8e84785867b759960d367968ec9229d4a7de0a30fd5498faf9ad22725ef9b14a9e752bbe2a56850a4230ceff74aeb6ce6a6a599e281e218ce8988732ae1c4016ddfeecfffa1cbddeb9c65f358e5b2306a0afe5e22218386ed51de0ea6494e36d536cf15c48685498e0aa6c6cc86451b8468191ec0c086740a82788b8c79d04007a1d2a8ddcdbd627c5154012b80678a396e3e20d8de9752ceac123ebb89e11264fab0b908b7dc1c172437bd70b270317fa4c79e934e978db48901b88c865b4e82f796705e8897c157bbceb0294c1b83e07a5c354a1f89e6dc5db3078703d1ab1fcb79bbd67898165da76162005d4d939e6d97f2b7ac686e88100aed77e9d177f1f9948a048b70ff801d16bc0a493cb3a34963df99fc4250a274017c56e11a1044ff17a7c1dc66954fa7d06d381832f8356998dcb901c7a0694bdfa19183d0895bdab4dbd7038fa3d9ddf28161e6a100171627ecb6f2081e8165526cfed841ae10f50db2ae1ed676593bf03c976f0211f7b196dcfc8c156ea8cbb01fd9303246ce09b3b40e26d4d8d0c2cc6c0c0b1d95df6ad527ae168e48bd5f2d4d58adceedd022a11ae796411bf69fa3031c503529113d8f31795b78decf7534231b083b681efdf2c5514499978a9403cd49c7638fd659c1178dcdf70e79e0b4b456fe9c8791d2eabfe893018d53a114501ff9e3a7b3c22ea26fbe5771ed541d2dc9265283771fa85477ef0daadf00ec539a84e437f9f38e8e0971dd98ef96e8ef79145cc2003fec0df78797ac9496d57c914a288b1ad5baa8449d647e7549bf532078cdb357855cae7c287107411c3edf171a52af248e24c3c35af38a794546aa20957489e95f9bae672b8b68f2e8fce13620768c2cf1981c88f8ad85102c63152c3383acf94a6c798264ddb992b4bba769c59d18ed74a39535f03ea2625936f64ed00c8a75ce39d4c979f47ae4225385330ade39f8cf81c43b6a1d2f6dd5ae494c6b870b60e15254b8fea507e9763b01aa6023bfd0371cb385d8b8a31a0220904719086b30a8019ee44a307460cee1df35bd88d5f6d0f3c39d7fe5d03a65e0cfda000c48a2647b37594bda6e9624118de03957d1283ebd3ba20f7dc234e1b978d9f5d2672f9063ec17a0323553be47113c95983d3d5c75372c806e740a479d5d7f63f6485793919021dcb3c125d7abbfb16d0c6b20ee78145be497f9184b0ab5c9e99143a9b818284f345974a78f0151f45c4817d34d3f35aaaa7c2dddf36552c35031bb8b43985af9ee8dfd2de19a9c2e5f2bb8159127267b4905460471554d2a3a4ff8f3a14f7a99c594188054da98dcefd124a19dbaf0c6d19876df378f515e74b9ee2f058130e211e1776b5d1246b94f7c7ebcf7bd4ee1cd6d4dd399951532dca7f2c984ec2bd95ab08966e66f2c9b64afe8d505d0b0b47392eed38d1b398c04aa58f897eada5adf9bdc70dd69fd200f2a1d853195f493d22aaae3cb482c961ba275cf1b030f803ba6075737ae03403c84a9c1f0a7f1ba0eafac1507739d0fd81c2a10271b5dca2e0dc1161e98bc57620aaa0a8536014f784ea015420474e504f1838bc843f003698f76fa049ea43aae208b373747219a2ccc490a8f7f7b65511f4857c05a36bd425710c4b36ff79decdc4b9146ecddf75d6c0346ec35ba14fb12833e7140a44eec51466242516d677ce97387176513d58c4f0d5dc7fffb2d5179bb833d4b221c52398a5fdc18c672d500e6e0c8220a289097f2a3ce733e793cfb76c929703fb3be8600028f40ffdbcff595666c1a221c17fd13e29ddcbdfda8ef25b60fd99929a9ed771126134f446b3da227795b2645770e08b21f27b568a71b8affd8864df338d913201fccf38dbadb72adebce89e738dfc10a77c8f51d49a8b452c28f8b3cea830f7bf6e7a85a97ae13fa03ebb9ddb0ff4827f6ed72bd63abac0e85bc8f4c2ae7e5c527d0e5ae3dd51ac14904e5ff802bc358b47d78990c15501c9a245ec2cd611f0851a0bb10fe8e5ca5ccf786b72bb761586110ee5a943433df22d60ebaaa1f92daf1ace62821673371b6859b89e5e669916df81a56f9c0922c9f3fb5472f01f79d5f18f35776694c08c372f6cc987f177dc42fdc17a3908c2a79221bf9b58dc4d33d6aa19da5f51008f04feb89b8058b7158dc6b392ac8e837b6e7b3e7b0307d68bd35b9accecc90c27000a06ac21fcdaea07871c3fe596da8a9aa3e3826ef7a65c465e004e526d782bc27671b6186adacb535fed035aca5f79a17a8e398c246a779a36359cc317eb9227244fecfd8569d963073ad05f0a6aae4de459978"}], 0x3338}, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000500)={'ip6_vti0\x00', 0x0}) setsockopt$inet_pktinfo(r1, 0x0, 0x8, &(0x7f0000000240)={r2, @broadcast, @broadcast}, 0xc) connect$inet6(r0, &(0x7f0000000080)={0xa, 0x4e24, 0x0, @ipv4={[], [], @loopback}}, 0x1c) sendmmsg(r0, &(0x7f0000001300)=[{{0x0, 0x0, &(0x7f0000001280)}}], 0x400000000000033, 0x0) ioctl$KVM_GET_DEBUGREGS(r1, 0x8080aea1, &(0x7f0000000140)) [ 587.742104] audit: type=1804 audit(1540474229.019:159): pid=29549 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor3" name="/root/syzkaller-testdir625636457/syzkaller.IugyCy/812/file0/file1" dev="sda1" ino=16561 res=1 [ 587.784594] binder: 29547:29550 ioctl c0306201 20007000 returned -22 [ 587.807272] binder: BINDER_SET_CONTEXT_MGR already set 13:30:29 executing program 3: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, 0xfffffffffffffffe, 0x35d) r1 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000080)='/dev/snapshot\x00', 0x400000, 0x0) ioctl$UFFDIO_API(r1, 0xc018aa3f, &(0x7f00000000c0)={0xaa, 0x24}) pipe(&(0x7f0000000000)={0xffffffffffffffff}) ioctl$UI_GET_VERSION(r2, 0x8004552d, &(0x7f0000000040)) syz_open_dev$usbmon(&(0x7f0000000100)='/dev/usbmon#\x00', 0x7fff, 0x10000) [ 587.844817] audit: type=1804 audit(1540474229.069:160): pid=29549 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor3" name="/root/syzkaller-testdir625636457/syzkaller.IugyCy/812/file0/file1" dev="sda1" ino=16561 res=1 [ 587.872830] binder: 29547:29555 ioctl 40046207 0 returned -16 13:30:29 executing program 0: r0 = socket$inet(0x2, 0x4000000803, 0x4) bind$inet(r0, &(0x7f0000000000)={0x2, 0x0, @broadcast}, 0x10) getsockname(r0, &(0x7f00000036c0)=@xdp={0x2c, 0x0, 0x0}, &(0x7f0000000080)=0x80) setsockopt$inet_pktinfo(r0, 0x0, 0x8, &(0x7f0000003780)={r1, @rand_addr, @dev}, 0xc) syz_emit_ethernet(0x4a, &(0x7f0000000240)={@link_local, @empty=[0x0, 0x0, 0x0, 0xfffffffffffff000], [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x3c, 0x0, 0x0, 0x0, 0x4, 0x0, @empty=0x9000000, @broadcast}, @udp={0x0, 0x0, 0x28}}}}}, &(0x7f0000000380)) [ 587.914083] binder: 29547:29555 unknown command 1073767173 [ 587.946367] binder: 29547:29555 ioctl c0306201 20007000 returned -22 13:30:29 executing program 5: syz_mount_image$btrfs(&(0x7f0000000140)='btrfs\x00', &(0x7f0000000180)='./file0\x00', 0x0, 0x0, &(0x7f00000007c0), 0x0, &(0x7f0000000380)=ANY=[]) syz_mount_image$ntfs(&(0x7f0000000200)='ntfs\x00', &(0x7f0000000080)='./file1\x00', 0x0, 0x30, &(0x7f0000000580), 0x0, &(0x7f0000000680)=ANY=[]) mount$overlay(0x404030, &(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f0000000100)={[{@upperdir={'upperdir', 0x3d, './file0'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@workdir={'workdir', 0x3d, './file1'}, 0x5c}]}) umount2(&(0x7f0000000040)='./file0\x00', 0x7fffffffffffffff) 13:30:29 executing program 4: fcntl$setstatus(0xffffffffffffffff, 0x4, 0x6000) fcntl$setownex(0xffffffffffffffff, 0xf, &(0x7f0000fa4000)) r0 = creat(&(0x7f0000000240)='./file0\x00', 0x2) r1 = socket$inet_udp(0x2, 0x2, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x800, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = syz_open_dev$loop(&(0x7f00000000c0)='/dev/loop#\x00', 0x0, 0x4082) setsockopt$IP_VS_SO_SET_STARTDAEMON(r1, 0x0, 0x48b, &(0x7f0000000140)={0x2, 'veth1\x00', 0x4}, 0x18) r3 = memfd_create(&(0x7f0000002b00)='/dev/loop#\x00', 0x0) write$P9_RSTAT(r0, &(0x7f0000000380)={0x5f, 0x7d, 0x2, {0x0, 0x58, 0x7, 0x2, {0x81, 0x1, 0x3}, 0x80000, 0x200, 0x2, 0x100, 0x0, "", 0x10, '/dev/sequencer2\x00', 0x10, 'securitybdev[\\+}', 0x5, 'bdev{'}}, 0x5f) ioctl$RTC_EPOCH_READ(r3, 0x8008700d, &(0x7f0000002780)) pwritev(r3, &(0x7f0000000340)=[{&(0x7f0000000040)='\'', 0x1}], 0x1, 0x81806) ioctl$KDGKBENT(r3, 0x4b46, &(0x7f0000000200)={0x100, 0x1000, 0x9}) gettid() prlimit64(0x0, 0x0, &(0x7f0000002940)={0x3}, &(0x7f0000002900)) getsockopt$bt_BT_VOICE(r3, 0x112, 0xb, &(0x7f00000029c0)=0xfffffffffffffffc, &(0x7f0000000100)=0x2) ioctl$LOOP_CHANGE_FD(r2, 0x4c00, r3) epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, r2, &(0x7f00000028c0)={0x10}) setsockopt$IP_VS_SO_SET_ADD(r3, 0x0, 0x482, &(0x7f00000002c0)={0x0, @local, 0x4e23, 0x2, 'fo\x00', 0x1, 0x6, 0x4b}, 0x2c) ioctl$SNDRV_TIMER_IOCTL_GINFO(r3, 0xc0f85403, &(0x7f00000027c0)={{0x0, 0x0, 0x0, 0x3}, 0x0, 0x0, 'id1\x00', 'timer1\x00', 0x0, 0x0, 0x81, 0x0, 0x101}) sendfile(r2, r2, &(0x7f0000000000), 0x2000005) ioctl$LOOP_CLR_FD(0xffffffffffffffff, 0x4c01) r4 = gettid() setpgid(0x0, r4) r5 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000000)='/dev/sequencer2\x00', 0x0, 0x0) prctl$setendian(0x14, 0x2) fcntl$lock(r2, 0x7, &(0x7f0000000180)={0x0, 0x3, 0x0, 0x3, r4}) ioctl$HDIO_GETGEO(r3, 0x301, &(0x7f0000002980)) read(r5, &(0x7f0000000040)=""/92, 0x5c) [ 587.976335] audit: type=1804 audit(1540474229.069:161): pid=29554 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor3" name="/root/syzkaller-testdir625636457/syzkaller.IugyCy/812/file0/file1" dev="sda1" ino=16561 res=1 13:30:29 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000007000)={0x8, 0x0, &(0x7f0000000140)=ANY=[@ANYPTR64=&(0x7f0000000040)=ANY=[@ANYPTR=&(0x7f0000000180)=ANY=[@ANYRES64=r1, @ANYRES64=r0, @ANYBLOB="96258bd9d5b4c50407f036f062555f61a434cb26f9c57ffcd2aa61c4ad68e947785041e6451ba603af9c1d50edf4eff0170bf494a620f4b4ab293004d9a49973c0af0f4c509af202f52e3e2951b82d17a31c5b88bc178838b0493906f0fb73a9f1debb51ed3d2f", @ANYRES64=r0, @ANYBLOB="3c1ade9b6d7bc6ef4a1ccb76cfaf7e08d4e673576b3efe4fd71b4a38d9256fd7c9dae7c2ef9930", @ANYRES16=r1], @ANYRES32=r1, @ANYRES32=r0, @ANYRESHEX=r1]], 0x0, 0x0, &(0x7f00000001c0)}) r2 = dup2(r1, r0) ioctl$RNDGETENTCNT(r2, 0x80045200, &(0x7f0000000080)) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000002c0)={0x8, 0x0, &(0x7f00000000c0)=[@release], 0x0, 0x0, &(0x7f0000000300)}) 13:30:29 executing program 3: r0 = syz_open_dev$dspn(&(0x7f00000008c0)='/dev/dsp#\x00', 0x7ff, 0x4081) ioctl$SNDRV_CTL_IOCTL_ELEM_LIST(r0, 0xc0505510, &(0x7f0000000b00)={0x4, 0x7, 0x8a8, 0x20debbf5, &(0x7f0000000940)=[{}, {}, {}, {}, {}, {}, {}]}) perf_event_open(&(0x7f00000002c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) pipe2$9p(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) write$P9_RUNLINKAT(r2, &(0x7f0000000040)={0xffffffffffffffca}, 0x7) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) r3 = openat$sequencer2(0xffffffffffffff9c, &(0x7f00000003c0)='/dev/sequencer2\x00', 0x6000, 0x0) sendmsg$key(r3, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000400)={&(0x7f0000000680)={0x2, 0x6, 0xb94, 0x9, 0xd, 0x0, 0x70bd29, 0x25dfdbfe, [@sadb_x_sec_ctx={0xb, 0x18, 0x6, 0x0, 0x4c, "124889673ca8209fad9445476f6619115aea9bd95ad33ca9588c0401358b76d9f85318526e32486cfdb343bac9c6126d749de25438bfb1e03fabcd8c83ab279bcf5b10d7d2949fc48c39e98a"}]}, 0x68}}, 0x50) mount$9p_fd(0x0, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000340)='9p\x00', 0x0, &(0x7f00000001c0)={'trans=fd,', {'rfdno', 0x3d, r1}, 0x2c, {'wfdno', 0x3d, r2}}) write$P9_RREADDIR(r2, &(0x7f0000000480)=ANY=[@ANYBLOB="2a000000290100000000000000000000000000000000000000000000000000000007002e36666d6c6530"], 0x2a) r4 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f00000004c0)='/dev/vga_arbiter\x00', 0x3fffffff, 0x0) write$P9_RGETATTR(r2, &(0x7f0000000200)={0xa0, 0x19, 0x1}, 0xa0) ioctl$PPPOEIOCDFWD(r0, 0xb101, 0x0) openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000b80)='/dev/loop-control\x00', 0x20040, 0x0) write$P9_RUNLINKAT(0xffffffffffffffff, &(0x7f0000000880)={0x7, 0x4d, 0x1}, 0x7) mount$9p_fd(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000900)='9p\x00', 0x0, &(0x7f0000000840)={'trans=fd,', {'rfdno', 0x3d, r1}, 0x2c, {'wfdno', 0x3d, r2}}) umount2(&(0x7f0000000500)='./file0\x00', 0x0) getrusage(0x0, &(0x7f0000000580)) fallocate(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x1000f4) open(&(0x7f0000000180)='./bus\x00', 0x0, 0x20) syz_emit_ethernet(0xe0, &(0x7f0000001100)=ANY=[@ANYBLOB="aaaaaaaaaa0aaaaaaaaaaabb0800471f00d20067000908ff9078ffffffffe0000001860600000000000036009078ac14141569491495f2b6037519fa0c43c090eccbf08e3fbe0f2288ac752c43a6b5f34fed1666c1e2829e0ecf63fec2aad992bdc8b3d447c7a162b5b2e2f110bcb4cc0d162b896d9911560ee6c4110f407b974ea1e81ca168e8ec26f1d17483f9e631e0f30a131a6d7a8cf6edd2d08b64d685a6111d1df2b9eeddf7b4a421149607de924168a9b00569b6e9bfc9bcff135b74d8b7587c44e8cfc6e684ea26002030f815bfd1bf5c44a4bd6fdcef3b6dfcd33717904b594b5edb8bc148d9adc883d9ac29b2a061371ae7da08d48c6c3f276a8dcf20df5998f318adc72b1edf"], &(0x7f0000000640)={0x1, 0x2, [0xd9b, 0x6fa, 0x10b, 0x685]}) sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000d83ff8), 0x0) write$P9_RXATTRCREATE(r2, &(0x7f0000000080)={0x7, 0x21, 0x2}, 0x7) r5 = socket$inet(0x2, 0x2, 0x0) bind$inet(r5, &(0x7f0000eed000)={0x2, 0x1}, 0x10) syz_emit_ethernet(0x423, &(0x7f0000000cc0)={@link_local, @empty=[0x0, 0x0, 0x14], [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x415, 0x0, 0x0, 0x0, 0x200000000000011, 0x0, @rand_addr, @multicast1}, @dccp={{0x0, 0x1, 0x4, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, "d70502", 0x0, "f53475"}, "b441d632cdbbcb211363807aec73d3883762a61dc02d349bfa3ac974b987aa7fb97eb324d594fbbb77bab759418aa8d451d921e8f5d2cf2b08292111701192e97cac366dd3eb2e0fb039e58314ef4709c5f3556db6a1ab6b4fb2bdd83cdc26e8395ec4984ec3faf71a611d1569545d654cded93be827a85188b803c19c1b56aab522862a718b81e512b49690994d3425e33bd93f0e744c66a083c1f9f1bd7bb8f9e123c08f3f041ed3fdc058136cf0071a47cc0e38720a12e11e842a7b5b26dff07f578fdb9a7b14662a625c1ee76c41ccb2b1fc6376aa718e1067b9e4af511ef5b360dbfad326108bb033db193dab27974eb8c462739eaee51d87f31c516e7e391073770da3202e02c41a7277c847df24bd5b0a7ab6e252f3c8ebf00688cc55311d887e8bfd95a7f4c6a126af3fe26714ddb869c66d18f870631bbd497e8a06881b754ecdcdd0dcffc51cd52a6b560f8d64b63a1674745edc5f53b18a8ffcc5c2fbc4d2bbcc2faf3c189d9b36c0655d1394f5c127ec86b8a764a87b546c2b6ac37d0a8ec3edd7cda6f930570763dbdc0640d219749bd57c7c89eaadfdae41d654a46b17be069a32a7d94d29b612fbe61b8bd11a2d10ba5d4ac7014fc0465c3f144598bd1f913343e7293711040eee0ae8df1e49f04ed1037d4b742aed0e932116060aaf6b985238d2e10fb5b11d19d7801befed4833287d96a85a7cdd9e211a672760335655576fc0fa0336621c2b2b1018ef71bb5077c67ee5fa8d479d6776013363e98b1f1213712be7e47549b6035459008c509f0f983130a451531381ee3c1ab9e1cbb8e558b56ca1a70939389addc5f9632b37ff3f634abb504bb0be0a51649683f6e29588c15cda40255e173328681884ffef6729e9058c5623e1401fdcc7b8cb5623a8fd725fbeea05fc417c44e46500619218dff7c70aa068994c58883cada505a2aa85b6620dfe9c45b707c9aa1222b86972eae564b28a05ddfa3545df231fde2707d4bf67dc6ba41daba91dee8081e5c7e2bcfbebebd42d5ab8a32d6e098fd57233e3b813dc0d772134775def451823b7fef2bc93da01722cd613b9a3db7e2d4c51fb7b56006ee9cea53b62343599a56167388d45247f9289fb1cab67a7cb0c3665ddf1e1411875b4de3428b32fc6603691a023d8e4cb93c667acb7b535fb5f77af9a49640cbe8ffe3a193cf4df1b556a67cb753c60bdf978b871aa513c07074c6602037ebc32199290e3c7ac6f103ad9358951ad4de0c8f1b34951b0e6a48295975cf08b2c3c95064855fc95317e386f1c18608d1d08699003c998b93332cd316f17a5139d350cbfa9dabc3f77c4197a0186e50913978e980a7a028e7ccdeee718af028200e94a6b3a0ec93ba14b0c64dfaf3967e230d8cf876f26287d436ebc9588b52b43f2380836bfe3"}}}}}, 0x0) setsockopt$inet_tcp_TLS_TX(r4, 0x6, 0x1, &(0x7f0000000800), 0x4) ioctl$UFFDIO_COPY(r4, 0xc028aa03, &(0x7f0000000700)={&(0x7f0000ffd000/0x1000)=nil, &(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x1}) syz_emit_ethernet(0x1, &(0x7f0000000cc0)=ANY=[@ANYBLOB="01802400000000ffff000000000000e0800001000000010401907800d7050200f53475000000"], 0x0) openat$autofs(0xffffffffffffff9c, &(0x7f0000000380)='/dev/autofs\x00', 0x10000, 0x0) 13:30:29 executing program 0: r0 = socket$inet(0x2, 0x4000000803, 0x4) bind$inet(r0, &(0x7f0000000000)={0x2, 0x0, @broadcast}, 0x10) getsockname(r0, &(0x7f00000036c0)=@xdp={0x2c, 0x0, 0x0}, &(0x7f0000000080)=0x80) setsockopt$inet_pktinfo(r0, 0x0, 0x8, &(0x7f0000003780)={r1, @rand_addr, @dev}, 0xc) syz_emit_ethernet(0x4a, &(0x7f0000000240)={@link_local, @empty=[0x0, 0x0, 0x0, 0x3f00000000000000], [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x3c, 0x0, 0x0, 0x0, 0x4, 0x0, @empty=0x9000000, @broadcast}, @udp={0x0, 0x0, 0x28}}}}}, &(0x7f0000000380)) [ 588.148937] binder: 29583:29589 unknown command 536870976 [ 588.165477] IPVS: sync thread started: state = BACKUP, mcast_ifn = veth1, syncid = 4, id = 0 [ 588.183851] binder: 29583:29589 ioctl c0306201 20007000 returned -22 [ 588.193747] overlayfs: failed to resolve './file1': -2 [ 588.212177] binder: 29583:29589 ioctl 80045200 20000080 returned -22 [ 588.234866] binder: 29583:29589 Release 1 refcount change on invalid ref 0 ret -22 [ 588.240361] ntfs: (device loop5): ntfs_fill_super(): Unable to determine device size. 13:30:29 executing program 0: r0 = socket$inet(0x2, 0x4000000803, 0x4) bind$inet(r0, &(0x7f0000000000)={0x2, 0x0, @broadcast}, 0x10) getsockname(r0, &(0x7f00000036c0)=@xdp={0x2c, 0x0, 0x0}, &(0x7f0000000080)=0x80) setsockopt$inet_pktinfo(r0, 0x0, 0x8, &(0x7f0000003780)={r1, @rand_addr, @dev}, 0xc) syz_emit_ethernet(0x4a, &(0x7f0000000240)={@link_local, @empty=[0x0, 0x0, 0x0, 0xe000000000000000], [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x3c, 0x0, 0x0, 0x0, 0x4, 0x0, @empty=0x9000000, @broadcast}, @udp={0x0, 0x0, 0x28}}}}}, &(0x7f0000000380)) [ 588.259789] binder: 29583:29599 unknown command 536870976 [ 588.302928] binder: 29583:29599 ioctl c0306201 20007000 returned -22 [ 588.350983] binder: 29583:29589 ioctl 80045200 20000080 returned -22 [ 588.370852] binder: 29583:29599 Release 1 refcount change on invalid ref 0 ret -22 13:30:29 executing program 1: socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)) syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0xe1, 0x400100) creat(&(0x7f00000001c0)='./file0\x00', 0x2) openat$dsp(0xffffffffffffff9c, &(0x7f0000000200)='/dev/dsp\x00', 0x8000, 0x0) syz_open_dev$mouse(&(0x7f0000000240)='/dev/input/mouse#\x00', 0x100, 0x10000) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000007000)={0x8, 0x0, &(0x7f0000000140)=[@acquire], 0x0, 0x0, &(0x7f00000001c0)}) r2 = dup2(r1, r0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000002c0)={0x8, 0x0, &(0x7f00000000c0)=[@release], 0x3f000000, 0x0, &(0x7f0000000300)}) 13:30:29 executing program 4: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000480)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00003b9fdc)) r1 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000040)='/dev/rtc0\x00', 0x8000, 0x0) setsockopt$bt_BT_VOICE(r1, 0x112, 0xb, &(0x7f00000000c0)=0xaee9, 0x2) r2 = syz_open_pts(r0, 0x0) clone(0x7fe, 0x0, 0xfffffffffffffffe, &(0x7f0000000080), 0xffffffffffffffff) r3 = getpid() bpf$BPF_PROG_ATTACH(0x8, &(0x7f0000000140)={r1, r1, 0x4, 0x1}, 0x10) sched_setscheduler(r3, 0x5, &(0x7f0000000200)) ioctl$TIOCGSID(r2, 0x5429, &(0x7f0000000000)) write$P9_RRENAMEAT(r1, &(0x7f0000000100)={0x7, 0x4b, 0x1}, 0x7) 13:30:29 executing program 0: r0 = socket$inet(0x2, 0x4000000803, 0x4) bind$inet(r0, &(0x7f0000000000)={0x2, 0x0, @broadcast}, 0x10) getsockname(r0, &(0x7f00000036c0)=@xdp={0x2c, 0x0, 0x0}, &(0x7f0000000080)=0x80) setsockopt$inet_pktinfo(r0, 0x0, 0x8, &(0x7f0000003780)={r1, @rand_addr, @dev}, 0xc) syz_emit_ethernet(0x4a, &(0x7f0000000240)={@link_local, @empty=[0x0, 0x0, 0x0, 0x3c000000], [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x3c, 0x0, 0x0, 0x0, 0x4, 0x0, @empty=0x9000000, @broadcast}, @udp={0x0, 0x0, 0x28}}}}}, &(0x7f0000000380)) 13:30:29 executing program 5: syz_mount_image$btrfs(&(0x7f0000000140)='btrfs\x00', &(0x7f0000000180)='./file0\x00', 0x0, 0x0, &(0x7f00000007c0), 0x0, &(0x7f0000000380)=ANY=[]) syz_mount_image$ntfs(&(0x7f0000000200)='ntfs\x00', &(0x7f0000000080)='./file1\x00', 0x0, 0x30, &(0x7f0000000580), 0x0, &(0x7f0000000680)=ANY=[]) mount$overlay(0x404030, &(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f0000000100)={[{@upperdir={'upperdir', 0x3d, './file0'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@workdir={'workdir', 0x3d, './file1'}, 0x5c}]}) umount2(&(0x7f0000000040)='./file0\x00', 0x9700000000000000) 13:30:29 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x802) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) syz_init_net_socket$bt_l2cap(0x1f, 0x2, 0x0) r1 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000007000)={0x8, 0x0, &(0x7f00000004c0)=ANY=[@ANYBLOB="0528790000000000000000000000000000cd426b2b871fd46b17fc4da8adaf1c2a5e6146698ea503b5d1440a88aa9c96113767c96deed37ffdb6c5d1ed50b4a324a3582b7625da59319cad98dd78085c63c78ac29205968834ebd8d7114ee00988fa9b6015ded5cd5741beff892eae405d0d8d861dfa7a53a2df5d0a39290160c11fa01a77260b748077f04980fda4b061a804b7f167b270b41a1357c1e9efa018fbeaa9c927b961d880e56603a703f70a72776c82e3e2eaf29a4bcf0f885510cff2cf612dc244e4b1642efaf9a174c81c93c7590cb0467a14a424319e2b2709c61ce403ac5f4afb6ac608b608c1a5dfbe24d4b7164315db98a215ea2bfd0752e275"], 0x0, 0x0, &(0x7f00000001c0)}) r2 = dup2(r1, r0) bind$bt_l2cap(r2, &(0x7f0000000340)={0x1f, 0x1, {0x4, 0x74c, 0xffff, 0xfffffffffffffffe, 0x401, 0xffff}, 0x5, 0x5c7}, 0xe) tee(r1, r0, 0x9, 0x8) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000002c0)={0x8, 0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="0463044000000000"], 0x0, 0x0, &(0x7f0000000300)}) r3 = semget$private(0x0, 0x5, 0x100) semctl$GETALL(r3, 0x0, 0xd, &(0x7f0000000400)=""/60) sendmsg$unix(r2, &(0x7f0000000300)={&(0x7f0000000040)=@abs={0x1, 0x0, 0x4e23}, 0x6e, &(0x7f0000000100)=[{&(0x7f0000000180)="a610a8170123d7cade94d86496f75a64cb7e17c83f35239f93aac79065910b7d97f35ed73b5806eab265dd0e93e68cddab185c59aeb7ae542ad81cf08185658b5b15ebce703cbb9c861489a0b6fee58a0b59a29ca3a180d6142f972f6f99f220d0c8a744fbd9ad686f6cb3ec05e44700846221eea52964ff8b051260f32a1ea7930bac33a958edcc640911a427426b2d5c53b962f642356faa454e449c8e56", 0x9f}, {&(0x7f0000000240)="8b4b1099c1007aa11342aa2ac3d8254be8593cc9840c111ba3496b46dc14d0fdc0bd25554f698f9f0442d9cef2bdc7fba1c4ec9626e37915283f79923259c3f389b89a6c6ceb9f18d2721ec796651e1b585626616986dd7446ec57fb3eefd3abff9a92d4cc3ce03e4bb5ea59d2d3b11a886e2c6391", 0x75}], 0x2, 0x0, 0x0, 0x40000}, 0x80) [ 588.565774] binder: 29626:29629 unknown command 7940101 [ 588.603220] binder: 29625:29627 Acquire 1 refcount change on invalid ref 0 ret -22 13:30:29 executing program 0: r0 = socket$inet(0x2, 0x4000000803, 0x4) bind$inet(r0, &(0x7f0000000000)={0x2, 0x0, @broadcast}, 0x10) getsockname(r0, &(0x7f00000036c0)=@xdp={0x2c, 0x0, 0x0}, &(0x7f0000000080)=0x80) setsockopt$inet_pktinfo(r0, 0x0, 0x8, &(0x7f0000003780)={r1, @rand_addr, @dev}, 0xc) syz_emit_ethernet(0x4a, &(0x7f0000000240)={@link_local, @empty=[0x0, 0x0, 0x0, 0x6000], [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x3c, 0x0, 0x0, 0x0, 0x4, 0x0, @empty=0x9000000, @broadcast}, @udp={0x0, 0x0, 0x28}}}}}, &(0x7f0000000380)) [ 588.613533] binder: 29626:29629 ioctl c0306201 20007000 returned -22 13:30:29 executing program 4: r0 = socket$vsock_stream(0x28, 0x1, 0x0) r1 = syz_open_dev$mice(&(0x7f0000000000)='/dev/input/mice\x00', 0x0, 0x8400) syz_mount_image$msdos(&(0x7f0000000140)='msdos\x00', &(0x7f0000000180)='./file0\x00', 0x40, 0x9, &(0x7f0000001780)=[{&(0x7f00000001c0)="93bb9cedec46ea7db0e675deeba81820060b23bca8803e8f4c455cb59e73810964f16e883b8af5ea7c00e121dcc36091044d3fbd016793fac3fcd4075dd20899d04fc7c9f081f46d0e244947414023a3707a0673b40d13c46d63dccbfc114dc575a470506eee105ca4c515cfc034653b009aa60a30dcb595eca8aa3fdec7a192eed183a74333815d27d7ec7cd4", 0x8d, 0xffffffffffffffff}, {&(0x7f0000000280)="8501a5dadb1661fc26cd44a92410c498f894c55cef20a004e49aea08e41d84be4491d5c6de1b3da9b6caee405210ec412e5aed5d5b10d9747293133f055fb572bcca43d8a37e8dd7500eb358e6ad885b93edd0b37aa085121163df50de85932b2dd3e01958ee3a97ae02c9f9c4a3e3ef5e1461193de46fd8d9b4578e33265e0db9f48af522a974385850c2ca45434aac22e603f52c4a41db75f53d30cb0ccf0fe937ab1f7bd117ce82bbfaa8ac31d87f470f0d9e2756a138db8c2a0c144e96a2461e8b9e82d14f38e8eb0881b5147fff2432a3b87be6c44d2df0f13fc506e725399e1eb00bc66682656a2a9484bc4c93", 0xf0, 0x8001}, {&(0x7f0000000380)="08641dcd3ef521ba5bfc4cd76b19a5735925b6c79f7547be05f2c4422d7ba03cdfe267cfab1910cecd732cefda3a44f6e04f9192e936e09eb2c1e6f9a792c2a0803daf1a3424654db577c9dba18798347ff60c6f3f835eb686b7ffa56b717cf9222509725f14412f44f6c9321651ad4593ac74eeb6609294fb96a55d4111d8e6ae9f93b604dba07da37c197c480afa28a6c3eaab26cbab8b62bbf1e0696e59738e1b769c1313633f6abf06d5494a9cca76e83a0af2", 0xb5, 0x5}, {&(0x7f0000000440)="4a96e2e194ccb7db6c1284232b93443f339f921f691fe6a8023add8cc4cf721461bcf75008f213a472bc003eb37fe914", 0x30}, {&(0x7f0000000480)="ae4e41721b241a1e922ca22ae3f76f77d442bdb326ae9ab820b2bb99fd4fd8b4e5962e7616286920961fad5ac816c9a0bd3a54825a827256a00e2a8ded015587d8201907202b713841be9a6faa32e0ea379c1a1295339f6a9139865a63326e0f33c17758e6aadc4fb558755cfcc184e0bdc93008605c619316066898493dcb4a1a37f80cd5f5a1e6ead31a3547309c91927274a4236ac275c19aeac7a3d5eef2a4a24609fb6b01d72a56bd7d8d3ce6c84a60988775cf3a5e706e41be6826e60124256fa6510f1d39a65a5b5c00aac6c6bf9e1ddb03783f7d4f6ae145e5ab8e915bbf5c70988545d129ae0b794777f7530d070ff4d117baf21c889a144812d23756ee1edee641a9ab34550cfa2c0c6720ef7d5d2aaac74496efa9fa25e5dd9f1ca9acc105c2344cc10fc1ea9625285bed037c397595a2c7ebf1e5579545d0977eb43c3a78b5fe3aee3d645c587dde411b8dc04653a53edc7dffa74100d9d4c665a6832fcee951804ac8582e3b62c8503b4e28e232b3e2f7b3bbcffee8b621774b803310ee0d5320a4c191a7a4772ca59bf63447c6d9492190c02417111597c12e7ac8531357e551bc1c545d8a48e0850826c90793be7234dd78b1eef1fd83495507cdbf4f0d2ccee0c9e1ea3be18d30586039679feb47d85050f807a1f0ac1fb47d1f30b2d79a1d9cbf6043c8f3843e45963660da14149fc21a33a834200a62a27ad8b29b568c099a5c8ae10da263896f4a69525d49a6477ef57ff1d671154672129eaef550cf2774e1868cdcb9b1947b88bb30e53056798cf5af540aff450e04ef3e59c5396514db4daddda89d38e43cf1703c782c34e84e1ec29c2b8ed2c1ef69cf326178c05d6eaaa2d224f7494c9aa76337567d840aa1fc83f22c8b3b7d36d27c9ef85b1d028ed2682ac6ff7fc23486d4b66b7180a9c0b2eb1e94a5cdb47ebb103b68f24b82634f5b94c144f681f8ca95dae847f650e2f5a2aec0bdb6f0b8ca9e21ee3e9ac2ea35ed0eebb38164061f37d51fab6fc0e4e731793479add84b9059453d948c2ec2236b2e4fd18c3db127f1c3541c9a0fdf36a928e69de277e2e8dc3f5c4615ecc918d7b0367006d2ac031360276a91eb79089d4849348965ae94ba10a36d67e0eed851dbf28137db0610307ab26d8f4d76dfc2cb71874843ef3be52cc86a7627a23b00289c82f7991c0cfe322bddf3573063e7c225bb706f3a2b0f4f23bad5e01da42abcc838f5f3b16cc7fadc28bc574d18a5c7b7019765f5476968fa8ac9461a63e71a1854e72880b30bf2349b2209f4742afe6f9797fe7671c14d6b69ac6ee6250f439c73e6e8423e0263e1a7cec9810b905b6e960b5c277cfa63c43ac740183b24de11890ef23ee0add0d5d0364e7dba34d6c40d2acde53a2f26e372cc1381768ed5f1611f48ce7fd71f1f87b51deee73b7d44e693bbb87a7a041b396d562c34933470c723eb9dabf06ffdce7bf2647b07c9adb9b95cda7ac2626d543871b55bf3d92ad764e2c5e7fc59fceb46b830e7dff2cb9ea0ec592541e3514d8b2b0cd7238abff5c68dd9269bbf41dc0a3842d6e33548a6e59a13f4be9989b8e68eb3ba44f4658944dfbaa47d6c98ca0254d59c95012dde7e68064f1bbc4aac503138d4a48181699612eeb1774e995004563bc9b8f21a5e63ec17bf0dd12c99affd56a251d29ca87bd3efe6ad3a7a9f52fa8ca8c13ad26e34d552127163dca2043c7323ddb453b7e2a5048ab350e04845683d9c2d50694c0645c4bb7fa62bf2d3c421e5e4fad544cf5f53b9f09b97631c8cc56c95227bbe159d04debb40116b09186c4a7cfdc13a678b864e54634b12894f4ccfe354f227b7dbb53bcddead989165285289f37c2f1ec07b124fe20edd141d58e7d42752d7afb0721f2d39ed881a09db9c152fc458dc52144ae995ffec5c6a62b5000928a26ca975b565f70657c8d35119871aa54f79929d2654e6031ba3609751038e28eeeef37374b521da00aaf02c2678888365b9857837c9cd29daf9c711faa01509c9ac864ed3de40b91078a6913cf1547411f77ff815f138ae20f1df613d65778d0c17b6feff36d1f450806f9eb7658a72c862e542190c4e8c99f9525418eb94b6ea1cd8ed6df3aedbaa8f60cb24b646a5507486f8d0adb4414efbc8394ce454926d4245d014075b0543d102b2d4b0319561a758db06429ce7df358b23fda5ea93cc978f0780b1199e1353a28b70adf4dd0019f6bc630ca2aee3e70e1f5c294e00a6fc03faab383355daf09594e7bdc68871207e2f493e4dc0a3a609f017195915571495cc8e4f05ce6d42899ff6ea70d14b8d0a55652463c681492d4e59e235d45eab540c6088c23b3c8c59bb8a2a2d658dd0b4da6fceb10d20b8dad70c194427245212abb91a1b1ab406059e34855f0bcf5685ace9931f1cc348ba7d75713afb5aab0a74b7af7bf095aea49aa631ca00d2ebd25b7c6cce9bf6a4550c34b99268f13068355ed557faddca3226f89a6cfd4dfd0b8964bc8dfee000ca298316d0a4093c8c4505a1da4df04c516a8b1e80fc0d40322c7d4e81fb573e5eab730f82a0ca37f96a4c6a1e3fec1ca9af00b1f8a175729b1abbd19262e37b903fb8c11741e346deb13c09389582a809f40457ff92d00650bdea47d0977167b602290938859e0e255ceb8a50b9cabc13536d14da937de39ae321f19b1758bd8f58824bdc98882743452243d2fc57e67280d84c5f64f21f27665c42979f4f5ae5408fb27d05143d43d307a9bc3a27299476ec3bde9d0376665d954f1a07771f69bb9e3eae027879cc3a12e19976e5979ad4048f168975ec4931c89eb29693f546f69d345ab9efc55f47119e46cf45e7d07b84bc3cf82276a89ffe2bff31f3a4dc2dc60ea335aad44bde68a4769d778791071bd88be29c8835a2373d50fa3ed0ad8fcf02ab8c14c43f31624e43d17bc7dd1610fe814a02af7a12769af7b7393e71c19a9568e3be4d5f090d69ad3df14347b5f5ff6768b66a3fae5ff04a86914ae155d858ea6cd516d664c4464c136974198bb25b9f9a2cf6ea2c9f887130ee55df10f957a8a72b0cea1b953a8fae6afb48ff067728ddb27ee4a651c5f2b5e36506cfa9264d0660f619d39f8f987190e5eeccfe563bef26936d8d1255695fe1301aab90465135b19943f4ad9a1e874a00bf5fa50f0ff99082ce325f75a71ac012e5f3b739637535c9f8a9ba8bd9ef23ecb0d121cb99e78aa39fcf15c3ab668720bedd95c8e3604a352262ba1a45b338f94210b22619738c2f81347287c13ae63204067855d3e68ea6fdec51b22ee5a9e36a53c09a037e78e61fbc9e31ea3976d1d312d0a366727b6ae4d8e8ce94d4826b656a5c0693b5e0c9d7c4c59b678d3ebc6dcbccc6a370a542b04550393e3ad2e3b56c735954f8ad074354b34642a352c7208d9a34fb69d226603797bdc75d4d9704e0c2f1f81d1ac626a5ed289c732afa3a01c11db90c23903020af895b745eec5a0a26a9b91e0cb1b3041a6f2609d846e718d637dbd9fe4bef5817620e331bf48387bf6bdace194b7d64e648b27645d95941ab81a79720d3c8f1763171ff013293be40169e56945c3054eb512b2849082d40849ed1ae25cd76a778d1fed28f1b97ab187365e7d7b192b7b1d421bdd3a1b4e14e602991ec586a93150cfea6d1800608958edf48d2d7d8c68a0449c1daefda08881a53f343d72d315ae4002f20474d57ce0c9c89e9240ae304e7ff88785e982c78ff3c3d892ba83f683c38df14d0c388a457a940f9dae5e883a1337c0a8072846f1fe668bced39a5a3f618bd6b2fde318b1b7ffd194c39d7d28e75009bbe599f762ad5b76b79cf340f9a668eb772b02f0028856f77633f8f11fa10ecbf3f42326310168e34e215784a67838f7ef2d19a7375d108d0e8778fe08893fd89fb057cde671205da0466139f76f71c718ed95fb9d35f5916057a1ab669e7556508023de58d1cff4cae30cfe483c2bb0e38d52b96bf8ef741925a88fde131df03aac727f169a916811aa63f51cf5c6bbe92015af05d5ab914ba8bca09bd26bfb9b773bd42f9041412cb80925163f36cae8ac0fbd32202de96e3a743f4054b884fdf24e220b26de6be0b86c4fd4a9b3781bb6f4b539272c86d0a601ac72a761e1119d63bde773e37e7f6c6369bb186dc6075d3321f739d5e4fdca9d8d78d308e8f3e41aed4f28efa67fe2521a56663f76b0128b6a509e0b580433e95cf7628a44b243e7cf6a4982ab228a890c84f34e3cf74acb58bb709c3967737c9bf8c0bd5579f806bcf6edfa32f31200e4ca8e5e0958edbc76ed7852dcb01aa533c3ce92217ab8f9a7d72e082ea46252aa312dd4542bf1328e69eab29b000b24b3f0a8d9b01f651ac6272998c4231eb71eb0b154cd486318792cc38c262fe7e8c880346a24417d4acdc98f57b8ddcab01fb7bbc28f24c75b4d4e04f9971421f6ce37c8c3d75dcca449aa4d028ab0d8a1f15f2d8dba4e68b3c55859a449751c338991e076ed9369cbdac7c245f21d89e7526c5d0479e18226ccabdc0100ebfbc513ae47361cc3a7d5c4d7266e1367c0d04bcd8bc51d5dc9510bb707b781e72e12908a5efdb56042da1b5e1476ae02882a7d207563d740eade2d49fe4920597112b31fccc3f6341f91bd57220c5b1d01ddabfd84a760536d00c874f6bf9f06808f29dc2a8819fef2d52f2448ff1a69b35b9eea2caa194c7db90c303e258e52ad63724b4fe9d8584f27639fc2ce00cc579fdb2c39a0c8ed290c422347b6975b9c0ccf97f099f47d90310efa5d113c6c9121d037f20b8301e778d803bf20c8008f6626ae3d02130f4895a42f1df9b47a11204f0a6389b754a086104289b12bb0596870146d1db856b0e7da6ff9c1b5f3e911408f58ac500da918d1b06353819aca2a7334d8589fe12d56466cfd2d2db8f510eb52d5121ec8d36507e5050fcc4ddc0010907600c30fabeb5c229573a84a536df73a3dd7196c54f803328aab575404349d1482667564b4a8c5a12d7cc88cccdacdcb8d82db43774188f73d06fa15aa8f467f067d9b447e5a4ff1649d3f71689ae5800ba1482c8a5d35cd3f90f34e5310430174615c6d243d2355b2d94808eba9e865997ce11313a7e2d42c0c258438f3889bd99f2ab0f3e603301d8aa9b95c80d74df609e2d23a172e874d29d14711d4e5aeca13864c0b8f50060bedc52a5329a74482813e1431d6ff8ee1a8f9cfaed520f7e413991c7f66bd39db4de44a67782931792a562b6f2a149dec1ff1addca19184f97cfddd5866d251181c315c5ae9e22ef7577d574c7aa44b5684315fbfc348b416ac6feb7d2d0f54f78fc0a4ffdd5f3e1e204f3bb36143b5d6def8b47ddcffe7b12b6a83383fbfc5787cb8e13b6690fa190c58079b8154a1a22e58b451d08914f19a5673193c28af55407ecaf5e64cc24413db54957a0157a8f6845d940925348db1019b0695ab5a43dda38b68c030c8654bb2474b5177219ee322c91b9eb9a5398fa100a4d0ff04e087192751d4f10d3339e287b1bc6af9ffac912a38765cf1c61ff8d5a7694b6776679384a2a0bf0248e360040507bf8e2b8a40628dd574e72e6ae97d3b9576c25ce265515f79f15a98ad00c228b199f4e072998047271019cb6da7f66c7e1461af188c82cfbcd993907c8ed556306a9171d01cb0b271982f311a56b5fcf099b2451b0e527ffecdac3dde0110618d6f991613302a0d7fe1bc5bd68700139dc13d878cc2d1c5ce6c58841139039c09f023290a17830bbeab6952b8fd855dd1ee41cedfe75dc53d2", 0x1000, 0x8}, {&(0x7f0000001480)="1112dbf219e5acb0686c2d31723774ff1ac96db5130d7cb8b33630b972d668309d835f59b31a7b005d4c32eeab066e000f2a49e676fffa3e96a473804d318422dc83c0beaacb3b6a853f77ade7e60e201addf972f2df9c52df658931e4c8322ed267b0869a5e6a4f5a23373a5409431385d725773932c1c763b0e641f7dfd251e799", 0x82, 0x9}, {&(0x7f0000001540)="5dae9c36df4b82bf1a78f9a3be6012e650613be3fe21d9af5619b705fae57a56ba3b716c88a64a636767f470a7fda69b62ab06f2e988cec8f7b6b4edabd27a0e6a1cfc6ea70771ec74ae6fa6d979226a16ae6b1f1e62a282bad5d793aaf83675355d581ee817a7e6b083f5a56626cfdeda2c0c00039f0022d44c6002fa7111df14", 0x81, 0x8}, {&(0x7f0000001600)="608bd8fc68e282a44a4f32242d6d883a77375c405beb4cb72f48e761a55a642df50a2ae7c7d1e510ffdcf86e24be844b294c2f71bc1c02cfe6bd18e87ec547add1d7c8aa592aa037aa80b562313dae36956d61b8cb1f2ea528419a4a94328de376a58abf51ea6e5be178f25fc8be5b859fc558a4cbecad62", 0x78}, {&(0x7f0000001680)="4136a29d7b9c88335e54904dc4b1fa12325e15410c4646c6e203b261c83e74b58f26bd92f05024f16b7a497171acd9214246200bfb998454f50e48599ec6a3e03bedc5dd0903a2728fb8f5ec09913320113b7cd807ab4cea2407cc88eb85e544e99cac5ea0c0a6c6d0ae3c2545744b1e50fece85c1b18d3f51d2ebd2785fd3a89b4625fd452af95eeca2f181b976d4da6709c2beda9d3fe19d6a07b7a226674a9c13f0048a5db7d11240705b789b66fa666086aba21883bc9ba52a6bd0c402dd6867164ba54e10ef38b158c24a8601d65a89c3f1ad570a930c65dbf2ecd6305878a3", 0xe2, 0xfffffffffffffff8}], 0x40, &(0x7f0000001880)={[{@dots='dots'}, {@nodots='nodots'}], [{@obj_user={'obj_user', 0x3d, 'H\\+{'}}]}) ioctl$DRM_IOCTL_RES_CTX(0xffffffffffffffff, 0xc0106426, &(0x7f0000000080)={0x4, &(0x7f0000000040)=[{}, {0x0}, {}, {}]}) ioctl$DRM_IOCTL_GET_SAREA_CTX(r1, 0xc010641d, &(0x7f0000000100)={r2, &(0x7f00000000c0)=""/60}) shutdown(r0, 0x0) [ 588.640530] binder: 29625:29627 Release 1 refcount change on invalid ref 0 ret -22 [ 588.668023] binder: 29626:29629 IncRefs 0 refcount change on invalid ref 0 ret -22 [ 588.685580] ntfs: (device loop5): ntfs_fill_super(): Unable to determine device size. [ 588.705311] binder: 29626:29635 unknown command 7940101 [ 588.722829] list_del corruption, ffff8801c08c9fb0->next is LIST_POISON1 (dead000000000100) [ 588.732177] ------------[ cut here ]------------ [ 588.736948] kernel BUG at lib/list_debug.c:47! [ 588.741610] invalid opcode: 0000 [#1] PREEMPT SMP KASAN [ 588.746988] CPU: 0 PID: 5 Comm: kworker/0:0 Not tainted 4.19.0-rc8-next-20181019+ #98 [ 588.754956] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 588.764424] Workqueue: events p9_read_work [ 588.768693] RIP: 0010:__list_del_entry_valid.cold.1+0x26/0x4a [ 588.774590] Code: d1 fd 0f 0b 4c 89 e2 48 89 de 48 c7 c7 a0 e9 40 88 e8 76 d4 d1 fd 0f 0b 4c 89 ea 48 89 de 48 c7 c7 00 e9 40 88 e8 62 d4 d1 fd <0f> 0b 48 89 de 48 c7 c7 60 ea 40 88 e8 51 d4 d1 fd 0f 0b 48 89 de [ 588.793499] RSP: 0018:ffff8801d9aaf5c0 EFLAGS: 00010286 [ 588.798860] RAX: 000000000000004e RBX: ffff8801c08c9fb0 RCX: 0000000000000000 [ 588.806130] RDX: 0000000000000000 RSI: ffffffff816585a5 RDI: 0000000000000005 [ 588.813422] RBP: ffff8801d9aaf5d8 R08: ffff8801d9aa2140 R09: 0000000000000006 [ 588.820706] R10: 0000000000000000 R11: ffff8801d9aa2140 R12: dead000000000200 [ 588.827986] R13: dead000000000100 R14: ffff8801cce110d0 R15: ffff8801cce11090 [ 588.835258] FS: 0000000000000000(0000) GS:ffff8801dae00000(0000) knlGS:0000000000000000 [ 588.843494] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 588.849377] CR2: 00007f1c6d847330 CR3: 00000001d2bb5000 CR4: 00000000001426f0 [ 588.856650] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 588.863916] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000600 [ 588.871182] Call Trace: [ 588.873785] p9_read_work+0xa95/0x1140 [ 588.877675] ? zap_class+0x640/0x640 [ 588.881396] ? p9_poll_workfn+0x6e0/0x6e0 [ 588.885556] ? __lock_is_held+0xb5/0x140 [ 588.889632] process_one_work+0xc8b/0x1c40 [ 588.893877] ? mark_held_locks+0x130/0x130 [ 588.898121] ? pwq_dec_nr_in_flight+0x4a0/0x4a0 [ 588.902791] ? __switch_to_asm+0x40/0x70 [ 588.906853] ? __switch_to_asm+0x34/0x70 [ 588.910911] ? __switch_to_asm+0x40/0x70 [ 588.914974] ? __switch_to_asm+0x34/0x70 [ 588.919034] ? __switch_to_asm+0x40/0x70 [ 588.923096] ? __switch_to_asm+0x34/0x70 [ 588.927155] ? __switch_to_asm+0x40/0x70 [ 588.931226] ? __schedule+0x8d7/0x21d0 [ 588.935115] ? lockdep_hardirqs_on+0x3bb/0x5b0 [ 588.939715] ? zap_class+0x640/0x640 [ 588.943433] ? trace_hardirqs_on_thunk+0x1a/0x1c [ 588.948204] ? lockdep_hardirqs_on+0x3bb/0x5b0 [ 588.952805] ? lock_acquire+0x1ed/0x520 [ 588.956779] ? worker_thread+0x3e0/0x1390 [ 588.960932] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 588.966481] ? move_linked_works+0x304/0x420 [ 588.970906] ? trace_event_raw_event_workqueue_execute_start+0x2b0/0x2b0 [ 588.977751] ? rwlock_bug.part.2+0x90/0x90 [ 588.981996] ? trace_hardirqs_on+0x310/0x310 [ 588.986421] worker_thread+0x17f/0x1390 [ 588.990395] ? __switch_to_asm+0x34/0x70 [ 588.994474] ? process_one_work+0x1c40/0x1c40 [ 588.998991] ? __sched_text_start+0x8/0x8 [ 589.003157] ? __kthread_parkme+0xce/0x1a0 [ 589.007393] ? _raw_spin_unlock_irqrestore+0x82/0xd0 [ 589.012648] ? _raw_spin_unlock_irqrestore+0x82/0xd0 [ 589.017753] ? lockdep_hardirqs_on+0x3bb/0x5b0 [ 589.022337] ? trace_hardirqs_on+0xbd/0x310 [ 589.026659] ? kasan_check_read+0x11/0x20 [ 589.030808] ? __kthread_parkme+0xce/0x1a0 [ 589.035045] ? trace_hardirqs_off_caller+0x300/0x300 [ 589.040161] ? _raw_spin_unlock_irqrestore+0x6d/0xd0 [ 589.045269] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 589.050809] ? __kthread_parkme+0xfb/0x1a0 [ 589.055050] ? process_one_work+0x1c40/0x1c40 [ 589.059550] kthread+0x35a/0x440 [ 589.062923] ? kthread_stop+0x8f0/0x8f0 [ 589.066899] ret_from_fork+0x3a/0x50 [ 589.070619] Modules linked in: [ 589.074208] ---[ end trace 1b88b04fad65cf7d ]--- [ 589.078977] RIP: 0010:__list_del_entry_valid.cold.1+0x26/0x4a [ 589.084893] Code: d1 fd 0f 0b 4c 89 e2 48 89 de 48 c7 c7 a0 e9 40 88 e8 76 d4 d1 fd 0f 0b 4c 89 ea 48 89 de 48 c7 c7 00 e9 40 88 e8 62 d4 d1 fd <0f> 0b 48 89 de 48 c7 c7 60 ea 40 88 e8 51 d4 d1 fd 0f 0b 48 89 de [ 589.103835] RSP: 0018:ffff8801d9aaf5c0 EFLAGS: 00010286 [ 589.109219] RAX: 000000000000004e RBX: ffff8801c08c9fb0 RCX: 0000000000000000 [ 589.116517] RDX: 0000000000000000 RSI: ffffffff816585a5 RDI: 0000000000000005 [ 589.123797] RBP: ffff8801d9aaf5d8 R08: ffff8801d9aa2140 R09: 0000000000000006 [ 589.131096] R10: 0000000000000000 R11: ffff8801d9aa2140 R12: dead000000000200 [ 589.138384] R13: dead000000000100 R14: ffff8801cce110d0 R15: ffff8801cce11090 [ 589.145681] FS: 0000000000000000(0000) GS:ffff8801dae00000(0000) knlGS:0000000000000000 [ 589.153904] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 589.159809] CR2: 00007f1c6d847330 CR3: 00000001d2bb5000 CR4: 00000000001426f0 [ 589.167100] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 589.174391] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000600 [ 589.181674] Kernel panic - not syncing: Fatal exception [ 590.324251] Shutting down cpus with NMI [ 590.329311] Kernel Offset: disabled [ 590.332937] Rebooting in 86400 seconds..