Warning: Permanently added '10.128.10.61' (ECDSA) to the list of known hosts. 2019/04/12 04:38:34 fuzzer started [ 52.050806] audit: type=1400 audit(1555043914.501:36): avc: denied { map } for pid=7801 comm="syz-fuzzer" path="/root/syz-fuzzer" dev="sda1" ino=16481 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:object_r:user_home_t:s0 tclass=file permissive=1 2019/04/12 04:38:36 dialing manager at 10.128.0.105:35303 2019/04/12 04:38:36 syscalls: 2428 2019/04/12 04:38:36 code coverage: enabled 2019/04/12 04:38:36 comparison tracing: enabled 2019/04/12 04:38:36 extra coverage: extra coverage is not supported by the kernel 2019/04/12 04:38:36 setuid sandbox: enabled 2019/04/12 04:38:36 namespace sandbox: enabled 2019/04/12 04:38:36 Android sandbox: /sys/fs/selinux/policy does not exist 2019/04/12 04:38:36 fault injection: enabled 2019/04/12 04:38:36 leak checking: CONFIG_DEBUG_KMEMLEAK is not enabled 2019/04/12 04:38:36 net packet injection: enabled 2019/04/12 04:38:36 net device setup: enabled 04:40:04 executing program 0: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000280)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000400)={0x0, 0x3, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0x0) ioctl$KVM_REGISTER_COALESCED_MMIO(r1, 0x4010ae67, &(0x7f00000001c0)={0x0, 0x119000}) openat$proc_capi20ncci(0xffffffffffffff9c, 0x0, 0x0, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r2, &(0x7f0000000000/0x18000)=nil, 0x0, 0x0, 0x44, 0x0, 0x0) ioctl$KVM_NMI(r2, 0xae9a) mmap$binder(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x0, 0x10, 0xffffffffffffff9c, 0x0) perf_event_open(&(0x7f00000002c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) io_setup(0x40000100000003, &(0x7f0000000200)) ioctl$KVM_RUN(r2, 0xae80, 0x0) [ 141.576290] audit: type=1400 audit(1555044004.031:37): avc: denied { map } for pid=7817 comm="syz-executor.0" path="/sys/kernel/debug/kcov" dev="debugfs" ino=117 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=system_u:object_r:debugfs_t:s0 tclass=file permissive=1 [ 141.665103] IPVS: ftp: loaded support on port[0] = 21 04:40:04 executing program 1: socket$inet_udplite(0x2, 0x2, 0x88) r0 = socket$inet_udp(0x2, 0x2, 0x0) close(r0) r1 = socket(0x840000000002, 0x3, 0xff) connect$inet(r1, &(0x7f0000000040)={0x2, 0x0, @empty}, 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r2, &(0x7f0000001400)={0x0, 0x0, &(0x7f00000013c0)={&(0x7f0000001440)={0x1c, 0x17, 0x101, 0x0, 0x0, {0x4}, [@nested={0x8, 0x11, [@generic='Q']}]}, 0x1c}}, 0x0) sendmmsg(r0, &(0x7f0000006d00)=[{{0x0, 0xfffffffffffffe64, &(0x7f0000000040), 0x2}}], 0xd3, 0x1ffffffe) [ 141.771512] chnl_net:caif_netlink_parms(): no params data found [ 141.832012] bridge0: port 1(bridge_slave_0) entered blocking state [ 141.839971] bridge0: port 1(bridge_slave_0) entered disabled state [ 141.848029] device bridge_slave_0 entered promiscuous mode [ 141.856669] bridge0: port 2(bridge_slave_1) entered blocking state [ 141.863339] bridge0: port 2(bridge_slave_1) entered disabled state [ 141.871397] device bridge_slave_1 entered promiscuous mode [ 141.910063] bond0: Enslaving bond_slave_0 as an active interface with an up link [ 141.921905] bond0: Enslaving bond_slave_1 as an active interface with an up link [ 141.948586] IPv6: ADDRCONF(NETDEV_UP): team_slave_0: link is not ready [ 141.956885] team0: Port device team_slave_0 added [ 141.962762] IPv6: ADDRCONF(NETDEV_UP): team_slave_1: link is not ready [ 141.971868] team0: Port device team_slave_1 added [ 141.978249] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_0: link is not ready [ 141.987234] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_1: link is not ready 04:40:04 executing program 2: [ 142.014238] IPVS: ftp: loaded support on port[0] = 21 [ 142.057774] device hsr_slave_0 entered promiscuous mode [ 142.095137] device hsr_slave_1 entered promiscuous mode [ 142.135707] IPv6: ADDRCONF(NETDEV_UP): hsr_slave_0: link is not ready [ 142.142787] IPv6: ADDRCONF(NETDEV_UP): hsr_slave_1: link is not ready [ 142.160790] IPVS: ftp: loaded support on port[0] = 21 [ 142.193975] bridge0: port 2(bridge_slave_1) entered blocking state [ 142.200484] bridge0: port 2(bridge_slave_1) entered forwarding state [ 142.207434] bridge0: port 1(bridge_slave_0) entered blocking state [ 142.213888] bridge0: port 1(bridge_slave_0) entered forwarding state 04:40:04 executing program 3: [ 142.386100] chnl_net:caif_netlink_parms(): no params data found [ 142.459746] IPv6: ADDRCONF(NETDEV_UP): bond0: link is not ready [ 142.466945] 8021q: adding VLAN 0 to HW filter on device bond0 [ 142.491633] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready [ 142.494148] IPVS: ftp: loaded support on port[0] = 21 [ 142.512708] bridge0: port 1(bridge_slave_0) entered blocking state [ 142.521445] bridge0: port 1(bridge_slave_0) entered disabled state [ 142.529527] device bridge_slave_0 entered promiscuous mode [ 142.540777] bridge0: port 2(bridge_slave_1) entered blocking state [ 142.547883] bridge0: port 2(bridge_slave_1) entered disabled state [ 142.555888] device bridge_slave_1 entered promiscuous mode 04:40:05 executing program 4: [ 142.588844] IPv6: ADDRCONF(NETDEV_UP): team0: link is not ready [ 142.596525] 8021q: adding VLAN 0 to HW filter on device team0 [ 142.602817] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 142.614581] bridge0: port 1(bridge_slave_0) entered disabled state [ 142.634318] bridge0: port 2(bridge_slave_1) entered disabled state [ 142.646183] IPv6: ADDRCONF(NETDEV_CHANGE): bond0: link becomes ready [ 142.701657] chnl_net:caif_netlink_parms(): no params data found [ 142.712158] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 142.723198] bridge0: port 1(bridge_slave_0) entered blocking state [ 142.730106] bridge0: port 1(bridge_slave_0) entered forwarding state [ 142.739766] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 142.747858] bridge0: port 2(bridge_slave_1) entered blocking state [ 142.754482] bridge0: port 2(bridge_slave_1) entered forwarding state [ 142.771527] bond0: Enslaving bond_slave_0 as an active interface with an up link [ 142.801853] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 142.810096] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 142.823173] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 142.851249] bond0: Enslaving bond_slave_1 as an active interface with an up link [ 142.867617] IPv6: ADDRCONF(NETDEV_UP): veth1_to_hsr: link is not ready [ 142.874507] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 142.882348] IPVS: ftp: loaded support on port[0] = 21 04:40:05 executing program 5: [ 142.895863] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 142.904456] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 142.985825] IPv6: ADDRCONF(NETDEV_UP): hsr0: link is not ready [ 142.991972] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 143.018114] IPv6: ADDRCONF(NETDEV_UP): team_slave_0: link is not ready [ 143.030085] team0: Port device team_slave_0 added [ 143.068439] IPv6: ADDRCONF(NETDEV_UP): team_slave_1: link is not ready [ 143.076670] team0: Port device team_slave_1 added [ 143.082751] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_0: link is not ready [ 143.092179] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_1: link is not ready [ 143.123540] IPv6: ADDRCONF(NETDEV_UP): vxcan1: link is not ready [ 143.129565] IPVS: ftp: loaded support on port[0] = 21 [ 143.131071] chnl_net:caif_netlink_parms(): no params data found [ 143.187785] device hsr_slave_0 entered promiscuous mode [ 143.225154] device hsr_slave_1 entered promiscuous mode [ 143.265165] bridge0: port 1(bridge_slave_0) entered blocking state [ 143.271674] bridge0: port 1(bridge_slave_0) entered disabled state [ 143.279258] device bridge_slave_0 entered promiscuous mode [ 143.288791] bridge0: port 2(bridge_slave_1) entered blocking state [ 143.296164] bridge0: port 2(bridge_slave_1) entered disabled state [ 143.303961] device bridge_slave_1 entered promiscuous mode [ 143.321183] bond0: Enslaving bond_slave_0 as an active interface with an up link [ 143.332095] bond0: Enslaving bond_slave_1 as an active interface with an up link [ 143.352625] IPv6: ADDRCONF(NETDEV_UP): hsr_slave_0: link is not ready [ 143.366594] IPv6: ADDRCONF(NETDEV_UP): hsr_slave_1: link is not ready [ 143.393204] bridge0: port 1(bridge_slave_0) entered blocking state [ 143.400693] bridge0: port 1(bridge_slave_0) entered disabled state [ 143.407876] device bridge_slave_0 entered promiscuous mode [ 143.426859] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 143.449800] bridge0: port 2(bridge_slave_1) entered blocking state [ 143.450810] audit: type=1400 audit(1555044005.901:38): avc: denied { associate } for pid=7818 comm="syz-executor.0" name="syz0" scontext=unconfined_u:object_r:unlabeled_t:s0 tcontext=system_u:object_r:unlabeled_t:s0 tclass=filesystem permissive=1 [ 143.456958] bridge0: port 2(bridge_slave_1) entered disabled state [ 143.488084] device bridge_slave_1 entered promiscuous mode [ 143.508703] IPv6: ADDRCONF(NETDEV_UP): team_slave_0: link is not ready [ 143.516577] team0: Port device team_slave_0 added [ 143.527322] IPv6: ADDRCONF(NETDEV_UP): bridge0: link is not ready [ 143.558592] IPv6: ADDRCONF(NETDEV_UP): team_slave_1: link is not ready [ 143.566350] team0: Port device team_slave_1 added [ 143.572324] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_0: link is not ready [ 143.588183] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_1: link is not ready [ 143.620837] L1TF CPU bug present and SMT on, data leak possible. See CVE-2018-3646 and https://www.kernel.org/doc/html/latest/admin-guide/l1tf.html for details. [ 143.664611] bond0: Enslaving bond_slave_0 as an active interface with an up link [ 143.676044] bond0: Enslaving bond_slave_1 as an active interface with an up link [ 143.708037] hrtimer: interrupt took 43055 ns [ 143.757269] kvm: emulating exchange as write 04:40:06 executing program 0: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000280)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000400)={0x0, 0x3, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0x0) ioctl$KVM_REGISTER_COALESCED_MMIO(r1, 0x4010ae67, &(0x7f00000001c0)={0x0, 0x119000}) openat$proc_capi20ncci(0xffffffffffffff9c, 0x0, 0x0, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r2, &(0x7f0000000000/0x18000)=nil, 0x0, 0x0, 0x44, 0x0, 0x0) ioctl$KVM_NMI(r2, 0xae9a) mmap$binder(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x0, 0x10, 0xffffffffffffff9c, 0x0) perf_event_open(&(0x7f00000002c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) io_setup(0x40000100000003, &(0x7f0000000200)) ioctl$KVM_RUN(r2, 0xae80, 0x0) [ 143.798091] device hsr_slave_0 entered promiscuous mode [ 143.859471] device hsr_slave_1 entered promiscuous mode 04:40:06 executing program 0: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000280)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000400)={0x0, 0x3, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0x0) ioctl$KVM_REGISTER_COALESCED_MMIO(r1, 0x4010ae67, &(0x7f00000001c0)={0x0, 0x119000}) openat$proc_capi20ncci(0xffffffffffffff9c, 0x0, 0x0, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r2, &(0x7f0000000000/0x18000)=nil, 0x0, 0x0, 0x44, 0x0, 0x0) ioctl$KVM_NMI(r2, 0xae9a) mmap$binder(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x0, 0x10, 0xffffffffffffff9c, 0x0) perf_event_open(&(0x7f00000002c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) io_setup(0x40000100000003, &(0x7f0000000200)) ioctl$KVM_RUN(r2, 0xae80, 0x0) [ 143.914688] chnl_net:caif_netlink_parms(): no params data found [ 143.969787] IPv6: ADDRCONF(NETDEV_UP): hsr_slave_0: link is not ready [ 143.979258] IPv6: ADDRCONF(NETDEV_UP): team_slave_0: link is not ready [ 143.989672] team0: Port device team_slave_0 added [ 144.012683] 8021q: adding VLAN 0 to HW filter on device bond0 [ 144.025557] IPv6: ADDRCONF(NETDEV_UP): hsr_slave_1: link is not ready [ 144.046294] IPv6: ADDRCONF(NETDEV_UP): team_slave_1: link is not ready [ 144.053776] team0: Port device team_slave_1 added [ 144.060487] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_0: link is not ready [ 144.086980] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready [ 144.094955] bridge0: port 1(bridge_slave_0) entered blocking state [ 144.101623] bridge0: port 1(bridge_slave_0) entered disabled state [ 144.110960] device bridge_slave_0 entered promiscuous mode [ 144.125273] bridge0: port 2(bridge_slave_1) entered blocking state 04:40:06 executing program 0: write$evdev(0xffffffffffffffff, &(0x7f0000000100)=[{{0x77359400}, 0x4, 0x4}], 0x18) r0 = syz_open_dev$evdev(&(0x7f0000000000)='/dev/input/event#\x00', 0x2, 0x28001) ioctl$EVIOCSMASK(0xffffffffffffffff, 0x40104593, 0x0) write$evdev(r0, &(0x7f0000000040)=[{}, {}], 0x52a) [ 144.132918] bridge0: port 2(bridge_slave_1) entered disabled state [ 144.146078] device bridge_slave_1 entered promiscuous mode [ 144.164824] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_1: link is not ready [ 144.199508] IPv6: ADDRCONF(NETDEV_UP): veth1: link is not ready [ 144.267240] device hsr_slave_0 entered promiscuous mode 04:40:06 executing program 0: r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000080)='./cgroup\x00', 0x200002, 0x0) fchdir(r0) mkdir(&(0x7f0000001340)='./file0\x00', 0x0) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bc070") r2 = open(&(0x7f0000000000)='./file0\x00', 0x0, 0x0) openat$cgroup_procs(r2, &(0x7f0000000200)='cgroup.procs\x00', 0x2, 0x0) rmdir(&(0x7f0000000180)='./file0\x00') [ 144.325146] device hsr_slave_1 entered promiscuous mode [ 144.365188] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 144.372260] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 144.394005] IPv6: ADDRCONF(NETDEV_UP): team0: link is not ready [ 144.402945] 8021q: adding VLAN 0 to HW filter on device team0 04:40:06 executing program 0: r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000080)='./cgroup\x00', 0x200002, 0x0) fchdir(r0) mkdir(&(0x7f0000001340)='./file0\x00', 0x0) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bc070") r2 = open(&(0x7f0000000000)='./file0\x00', 0x0, 0x0) openat$cgroup_procs(r2, &(0x7f0000000200)='cgroup.procs\x00', 0x2, 0x0) rmdir(&(0x7f0000000180)='./file0\x00') [ 144.424125] bond0: Enslaving bond_slave_0 as an active interface with an up link [ 144.439823] IPv6: ADDRCONF(NETDEV_UP): hsr_slave_0: link is not ready [ 144.454540] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bridge: link is not ready 04:40:06 executing program 0: r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000080)='./cgroup\x00', 0x200002, 0x0) fchdir(r0) mkdir(&(0x7f0000001340)='./file0\x00', 0x0) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bc070") r2 = open(&(0x7f0000000000)='./file0\x00', 0x0, 0x0) openat$cgroup_procs(r2, &(0x7f0000000200)='cgroup.procs\x00', 0x2, 0x0) rmdir(&(0x7f0000000180)='./file0\x00') [ 144.471745] bond0: Enslaving bond_slave_1 as an active interface with an up link [ 144.483720] chnl_net:caif_netlink_parms(): no params data found [ 144.502045] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 144.510309] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 144.530674] bridge0: port 1(bridge_slave_0) entered blocking state [ 144.537499] bridge0: port 1(bridge_slave_0) entered forwarding state [ 144.553894] IPv6: ADDRCONF(NETDEV_UP): hsr_slave_1: link is not ready [ 144.564117] IPv6: ADDRCONF(NETDEV_UP): bridge0: link is not ready 04:40:07 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f00000001c0)="0adc1f123c123f319bc070") mkdir(0x0, 0x0) r1 = memfd_create(&(0x7f0000000140)='proc}GPLeth0^wlan0#:\x00', 0x0) clone(0x3102001ffe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = gettid() socket$netlink(0x10, 0x3, 0xe) ptrace$setopts(0x4206, r2, 0x0, 0x0) wait4(0x0, 0x0, 0x0, 0x0) execveat(r1, &(0x7f0000000000)='\x00', 0x0, 0x0, 0x400001000) tkill(r2, 0x20) [ 144.580005] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bridge: link is not ready [ 144.601513] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 144.613828] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 144.623386] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 144.639939] bridge0: port 2(bridge_slave_1) entered blocking state [ 144.646570] bridge0: port 2(bridge_slave_1) entered forwarding state [ 144.671563] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bond: link is not ready [ 144.694236] IPv6: ADDRCONF(NETDEV_UP): team_slave_0: link is not ready [ 144.704543] team0: Port device team_slave_0 added [ 144.711822] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 144.730356] IPv6: ADDRCONF(NETDEV_UP): bridge0: link is not ready [ 144.740307] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bond: link is not ready [ 144.754306] IPv6: ADDRCONF(NETDEV_UP): team_slave_1: link is not ready [ 144.763334] team0: Port device team_slave_1 added [ 144.777304] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_0: link is not ready [ 144.785804] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_1: link is not ready [ 144.795128] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 144.819825] IPv6: ADDRCONF(NETDEV_UP): veth0_to_team: link is not ready [ 144.827441] bridge0: port 1(bridge_slave_0) entered blocking state [ 144.833930] bridge0: port 1(bridge_slave_0) entered disabled state [ 144.841512] device bridge_slave_0 entered promiscuous mode [ 144.858807] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 144.867834] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 144.877586] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 144.888999] bridge0: port 2(bridge_slave_1) entered blocking state [ 144.896003] bridge0: port 2(bridge_slave_1) entered disabled state [ 144.904113] device bridge_slave_1 entered promiscuous mode [ 144.925783] IPv6: ADDRCONF(NETDEV_UP): veth1_to_team: link is not ready [ 144.937264] IPv6: ADDRCONF(NETDEV_UP): veth0_to_hsr: link is not ready [ 144.950547] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 144.958739] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 144.966903] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 144.974603] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 145.017836] device hsr_slave_0 entered promiscuous mode [ 145.055264] device hsr_slave_1 entered promiscuous mode [ 145.095785] IPv6: ADDRCONF(NETDEV_UP): hsr_slave_0: link is not ready [ 145.103998] IPv6: ADDRCONF(NETDEV_UP): veth1_to_hsr: link is not ready [ 145.112970] bond0: Enslaving bond_slave_0 as an active interface with an up link [ 145.122512] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 145.131993] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 145.141761] IPv6: ADDRCONF(NETDEV_UP): hsr_slave_1: link is not ready [ 145.151887] IPv6: ADDRCONF(NETDEV_UP): hsr0: link is not ready [ 145.158358] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 145.167290] bond0: Enslaving bond_slave_1 as an active interface with an up link [ 145.198507] IPv6: ADDRCONF(NETDEV_UP): team_slave_0: link is not ready [ 145.207120] team0: Port device team_slave_0 added [ 145.213098] IPv6: ADDRCONF(NETDEV_UP): team_slave_1: link is not ready [ 145.221317] team0: Port device team_slave_1 added [ 145.227723] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_0: link is not ready [ 145.239998] IPv6: ADDRCONF(NETDEV_UP): vxcan1: link is not ready [ 145.250881] 8021q: adding VLAN 0 to HW filter on device bond0 [ 145.260463] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_1: link is not ready [ 145.273059] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready [ 145.291606] 8021q: adding VLAN 0 to HW filter on device bond0 [ 145.301336] IPv6: ADDRCONF(NETDEV_UP): bridge0: link is not ready [ 145.309427] IPv6: ADDRCONF(NETDEV_UP): veth1: link is not ready [ 145.358494] device hsr_slave_0 entered promiscuous mode [ 145.405906] device hsr_slave_1 entered promiscuous mode [ 145.448330] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 145.455928] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 145.465685] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 145.473061] IPv6: ADDRCONF(NETDEV_UP): team0: link is not ready [ 145.479919] 8021q: adding VLAN 0 to HW filter on device team0 [ 145.487963] IPv6: ADDRCONF(NETDEV_UP): hsr_slave_0: link is not ready [ 145.497440] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready [ 145.503856] IPv6: ADDRCONF(NETDEV_UP): hsr_slave_1: link is not ready [ 145.514405] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bridge: link is not ready [ 145.529970] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 145.542533] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 145.551408] bridge0: port 1(bridge_slave_0) entered blocking state [ 145.558107] bridge0: port 1(bridge_slave_0) entered forwarding state [ 145.569400] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bridge: link is not ready [ 145.582029] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bond: link is not ready [ 145.590367] IPv6: ADDRCONF(NETDEV_UP): veth1: link is not ready [ 145.606092] IPv6: ADDRCONF(NETDEV_UP): bridge0: link is not ready [ 145.619871] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 145.636071] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 145.644084] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 145.652582] bridge0: port 2(bridge_slave_1) entered blocking state [ 145.659282] bridge0: port 2(bridge_slave_1) entered forwarding state [ 145.668653] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 145.677173] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 145.684704] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 145.701274] IPv6: ADDRCONF(NETDEV_UP): team0: link is not ready [ 145.707527] audit: type=1400 audit(1555044008.151:39): avc: denied { create } for pid=7883 comm="syz-executor.1" scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=netlink_generic_socket permissive=1 [ 145.732898] 8021q: adding VLAN 0 to HW filter on device team0 [ 145.748390] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bond: link is not ready [ 145.767055] audit: type=1400 audit(1555044008.161:40): avc: denied { write } for pid=7883 comm="syz-executor.1" scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=netlink_generic_socket permissive=1 [ 145.778180] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bridge: link is not ready [ 145.807676] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready 04:40:08 executing program 1: socket$inet_udplite(0x2, 0x2, 0x88) r0 = socket$inet_udp(0x2, 0x2, 0x0) close(r0) r1 = socket(0x840000000002, 0x3, 0xff) connect$inet(r1, &(0x7f0000000040)={0x2, 0x0, @empty}, 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r2, &(0x7f0000001400)={0x0, 0x0, &(0x7f00000013c0)={&(0x7f0000001440)={0x1c, 0x17, 0x101, 0x0, 0x0, {0x4}, [@nested={0x8, 0x11, [@generic='Q']}]}, 0x1c}}, 0x0) sendmmsg(r0, &(0x7f0000006d00)=[{{0x0, 0xfffffffffffffe64, &(0x7f0000000040), 0x2}}], 0xd3, 0x1ffffffe) [ 145.820825] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 145.829593] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 145.838069] bridge0: port 1(bridge_slave_0) entered blocking state [ 145.844701] bridge0: port 1(bridge_slave_0) entered forwarding state [ 145.854277] IPv6: ADDRCONF(NETDEV_UP): veth0_to_team: link is not ready [ 145.879343] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bridge: link is not ready [ 145.897407] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 145.905654] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 145.913738] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 145.922330] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 145.931462] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 145.940023] bridge0: port 2(bridge_slave_1) entered blocking state [ 145.947376] bridge0: port 2(bridge_slave_1) entered forwarding state [ 145.958560] IPv6: ADDRCONF(NETDEV_UP): veth1_to_team: link is not ready [ 145.977438] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bond: link is not ready [ 145.985640] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 145.993552] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 146.002489] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 146.011510] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 146.023366] IPv6: ADDRCONF(NETDEV_UP): veth0_to_hsr: link is not ready [ 146.042148] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bond: link is not ready [ 146.053937] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 146.069725] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 146.080625] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 146.100096] 8021q: adding VLAN 0 to HW filter on device bond0 [ 146.115068] IPv6: ADDRCONF(NETDEV_UP): veth1_to_hsr: link is not ready [ 146.123540] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 146.132409] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 146.144181] 8021q: adding VLAN 0 to HW filter on device bond0 [ 146.152248] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready [ 146.160401] IPv6: ADDRCONF(NETDEV_UP): hsr0: link is not ready [ 146.167937] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 146.177391] IPv6: ADDRCONF(NETDEV_UP): veth0_to_team: link is not ready [ 146.189073] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready [ 146.196621] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 146.205484] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 146.213858] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 146.227540] IPv6: ADDRCONF(NETDEV_UP): veth1_to_team: link is not ready [ 146.236990] IPv6: ADDRCONF(NETDEV_UP): veth1: link is not ready [ 146.245812] IPv6: ADDRCONF(NETDEV_UP): veth1: link is not ready [ 146.254422] IPv6: ADDRCONF(NETDEV_UP): team0: link is not ready [ 146.261679] 8021q: adding VLAN 0 to HW filter on device team0 [ 146.275370] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 146.283373] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 146.292133] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 146.299662] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 146.306991] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 146.314308] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 146.324198] IPv6: ADDRCONF(NETDEV_UP): veth0_to_hsr: link is not ready [ 146.335639] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bridge: link is not ready [ 146.345291] IPv6: ADDRCONF(NETDEV_UP): veth1_to_hsr: link is not ready [ 146.355667] IPv6: ADDRCONF(NETDEV_UP): vxcan1: link is not ready [ 146.363161] IPv6: ADDRCONF(NETDEV_UP): team0: link is not ready [ 146.370044] 8021q: adding VLAN 0 to HW filter on device team0 [ 146.378107] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 146.386643] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 146.394384] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 146.402852] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 146.411088] bridge0: port 1(bridge_slave_0) entered blocking state [ 146.417847] bridge0: port 1(bridge_slave_0) entered forwarding state [ 146.425080] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 146.433242] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 146.441385] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 146.450785] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bridge: link is not ready [ 146.460603] IPv6: ADDRCONF(NETDEV_UP): hsr0: link is not ready [ 146.467587] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 146.478089] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bridge: link is not ready [ 146.491638] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 146.500567] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 146.509797] bridge0: port 2(bridge_slave_1) entered blocking state [ 146.516632] bridge0: port 2(bridge_slave_1) entered forwarding state [ 146.524128] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 146.534076] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 146.541939] bridge0: port 1(bridge_slave_0) entered blocking state [ 146.549730] bridge0: port 1(bridge_slave_0) entered forwarding state [ 146.559541] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bond: link is not ready [ 146.572216] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 146.580101] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 146.594316] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bond: link is not ready [ 146.606033] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bridge: link is not ready [ 146.620213] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 146.628198] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 146.636599] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 146.645098] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 146.652743] bridge0: port 2(bridge_slave_1) entered blocking state [ 146.659577] bridge0: port 2(bridge_slave_1) entered forwarding state [ 146.668467] IPv6: ADDRCONF(NETDEV_UP): vxcan1: link is not ready [ 146.680619] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 146.690058] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bond: link is not ready [ 146.699882] IPv6: ADDRCONF(NETDEV_UP): veth0_to_team: link is not ready [ 146.713229] IPv6: ADDRCONF(NETDEV_UP): veth1_to_team: link is not ready [ 146.720425] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 146.728978] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 146.739501] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 146.750786] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 146.759632] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 146.769632] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 146.787306] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bond: link is not ready [ 146.804301] IPv6: ADDRCONF(NETDEV_UP): veth0_to_hsr: link is not ready 04:40:09 executing program 2: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f00000001c0)="0adc1f123c123f319bc070") unshare(0x10000) [ 146.822198] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 146.839160] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 146.852465] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 146.881039] IPv6: ADDRCONF(NETDEV_UP): veth0_to_team: link is not ready [ 146.894473] IPv6: ADDRCONF(NETDEV_UP): veth1_to_hsr: link is not ready [ 146.907377] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 146.920542] IPv6: ADDRCONF(NETDEV_UP): hsr0: link is not ready [ 146.927457] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 146.941226] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 146.954401] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 146.972335] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready 04:40:09 executing program 3: perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0xf7c, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) rt_sigtimedwait(&(0x7f0000000000), 0x0, &(0x7f00000000c0), 0x8) [ 146.995577] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 147.017596] IPv6: ADDRCONF(NETDEV_UP): veth1_to_team: link is not ready [ 147.028118] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 147.048758] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 147.058000] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 147.076373] IPv6: ADDRCONF(NETDEV_UP): veth0_to_hsr: link is not ready [ 147.084602] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 147.092647] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 147.104476] IPv6: ADDRCONF(NETDEV_UP): vxcan1: link is not ready [ 147.113254] IPv6: ADDRCONF(NETDEV_UP): veth1_to_hsr: link is not ready [ 147.123154] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 147.135644] IPv6: ADDRCONF(NETDEV_UP): hsr0: link is not ready [ 147.141870] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 147.151181] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 147.159537] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 147.179990] IPv6: ADDRCONF(NETDEV_UP): vxcan1: link is not ready [ 147.194600] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 147.208983] 8021q: adding VLAN 0 to HW filter on device batadv0 04:40:09 executing program 4: 04:40:09 executing program 1: socket$inet_udplite(0x2, 0x2, 0x88) r0 = socket$inet_udp(0x2, 0x2, 0x0) close(r0) r1 = socket(0x840000000002, 0x3, 0xff) connect$inet(r1, &(0x7f0000000040)={0x2, 0x0, @empty}, 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r2, &(0x7f0000001400)={0x0, 0x0, &(0x7f00000013c0)={&(0x7f0000001440)={0x1c, 0x17, 0x101, 0x0, 0x0, {0x4}, [@nested={0x8, 0x11, [@generic='Q']}]}, 0x1c}}, 0x0) sendmmsg(r0, &(0x7f0000006d00)=[{{0x0, 0xfffffffffffffe64, &(0x7f0000000040), 0x2}}], 0xd3, 0x1ffffffe) 04:40:09 executing program 2: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f00000001c0)="0adc1f123c123f319bc070") syz_emit_ethernet(0x2a, &(0x7f0000000000)={@random="0fdc2d1e8d38", @local, [], {@arp={0x806, @ether_ipv4={0x6, 0x800, 0x6, 0x4, 0x1, @random="f8bf88df5b1b", @remote={0xac, 0x223}, @dev, @rand_addr=0xac1414bb}}}}, 0x0) 04:40:09 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f00000001c0)="0adc1f123c123f319bc070") dup(0xffffffffffffffff) mkdir(0x0, 0x0) dup(0xffffffffffffff9c) r1 = memfd_create(&(0x7f0000000140)='proc}GPLeth0^wlan0#:\x00', 0x0) clone(0x3102001ffe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = gettid() socket$netlink(0x10, 0x3, 0xe) ptrace$setopts(0x4206, r2, 0x0, 0x0) wait4(0x0, 0x0, 0x0, 0x0) execveat(r1, &(0x7f0000000000)='\x00', 0x0, 0x0, 0x400001000) tkill(r2, 0x20) ioctl$UI_BEGIN_FF_UPLOAD(0xffffffffffffffff, 0xc06855c8, 0x0) mount(0x0, &(0x7f00000000c0)='./file0\x00', 0x0, 0x0, 0x0) 04:40:09 executing program 5: 04:40:09 executing program 5: 04:40:09 executing program 4: 04:40:09 executing program 2: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f00000001c0)="0adc1f123c123f319bc070") syz_emit_ethernet(0x2a, &(0x7f0000000000)={@random="0fdc2d1e8d38", @local, [], {@arp={0x806, @ether_ipv4={0x6, 0x800, 0x6, 0x4, 0x1, @random="f8bf88df5b1b", @remote={0xac, 0x223}, @dev, @rand_addr=0xac1414bb}}}}, 0x0) 04:40:10 executing program 0: 04:40:10 executing program 5: 04:40:10 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f00000001c0)="0adc1f123c123f319bc070") openat(0xffffffffffffffff, 0x0, 0x0, 0x0) ioctl$TIOCGSID(0xffffffffffffffff, 0x5429, 0x0) clone(0x4000002102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) request_key(&(0x7f0000000240)='asymmetric\x00', &(0x7f0000001ffb)={'\x00@\x00'}, &(0x7f0000001fee)='R\trist\xe3cusgrVid:De', 0x0) 04:40:10 executing program 1: socket$inet_udplite(0x2, 0x2, 0x88) r0 = socket$inet_udp(0x2, 0x2, 0x0) close(r0) r1 = socket(0x840000000002, 0x3, 0xff) connect$inet(r1, &(0x7f0000000040)={0x2, 0x0, @empty}, 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r2, &(0x7f0000001400)={0x0, 0x0, &(0x7f00000013c0)={&(0x7f0000001440)={0x1c, 0x17, 0x101, 0x0, 0x0, {0x4}, [@nested={0x8, 0x11, [@generic='Q']}]}, 0x1c}}, 0x0) sendmmsg(r0, &(0x7f0000006d00)=[{{0x0, 0xfffffffffffffe64, &(0x7f0000000040), 0x2}}], 0xd3, 0x1ffffffe) 04:40:10 executing program 2: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f00000001c0)="0adc1f123c123f319bc070") syz_emit_ethernet(0x2a, &(0x7f0000000000)={@random="0fdc2d1e8d38", @local, [], {@arp={0x806, @ether_ipv4={0x6, 0x800, 0x6, 0x4, 0x1, @random="f8bf88df5b1b", @remote={0xac, 0x223}, @dev, @rand_addr=0xac1414bb}}}}, 0x0) 04:40:10 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f00000001c0)="0adc1f123c123f319bc070") openat(0xffffffffffffffff, 0x0, 0x0, 0x0) ioctl$TIOCGSID(0xffffffffffffffff, 0x5429, 0x0) clone(0x4000002102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) request_key(&(0x7f0000000240)='asymmetric\x00', &(0x7f0000001ffb)={'\x00@\x00'}, &(0x7f0000001fee)='R\trist\xe3cusgrVid:De', 0x0) 04:40:10 executing program 5: 04:40:12 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f00000001c0)="0adc1f123c123f319bc070") dup(0xffffffffffffffff) mkdir(0x0, 0x0) dup(0xffffffffffffff9c) r1 = memfd_create(&(0x7f0000000140)='proc}GPLeth0^wlan0#:\x00', 0x0) clone(0x3102001ffe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = gettid() socket$netlink(0x10, 0x3, 0xe) ptrace$setopts(0x4206, r2, 0x0, 0x0) wait4(0x0, 0x0, 0x0, 0x0) execveat(r1, &(0x7f0000000000)='\x00', 0x0, 0x0, 0x400001000) tkill(r2, 0x20) ioctl$UI_BEGIN_FF_UPLOAD(0xffffffffffffffff, 0xc06855c8, 0x0) mount(0x0, &(0x7f00000000c0)='./file0\x00', 0x0, 0x0, 0x0) 04:40:12 executing program 0: 04:40:12 executing program 2: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f00000001c0)="0adc1f123c123f319bc070") syz_emit_ethernet(0x2a, &(0x7f0000000000)={@random="0fdc2d1e8d38", @local, [], {@arp={0x806, @ether_ipv4={0x6, 0x800, 0x6, 0x4, 0x1, @random="f8bf88df5b1b", @remote={0xac, 0x223}, @dev, @rand_addr=0xac1414bb}}}}, 0x0) 04:40:12 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f00000001c0)="0adc1f123c123f319bc070") openat(0xffffffffffffffff, 0x0, 0x0, 0x0) ioctl$TIOCGSID(0xffffffffffffffff, 0x5429, 0x0) clone(0x4000002102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) request_key(&(0x7f0000000240)='asymmetric\x00', &(0x7f0000001ffb)={'\x00@\x00'}, &(0x7f0000001fee)='R\trist\xe3cusgrVid:De', 0x0) 04:40:12 executing program 5: 04:40:12 executing program 1: 04:40:12 executing program 5: 04:40:12 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f00000001c0)="0adc1f123c123f319bc070") openat(0xffffffffffffffff, 0x0, 0x0, 0x0) ioctl$TIOCGSID(0xffffffffffffffff, 0x5429, 0x0) clone(0x4000002102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) request_key(&(0x7f0000000240)='asymmetric\x00', &(0x7f0000001ffb)={'\x00@\x00'}, &(0x7f0000001fee)='R\trist\xe3cusgrVid:De', 0x0) 04:40:12 executing program 1: mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup/syz0\x00', 0x1ff) 04:40:12 executing program 0: setuid(0xee01) ioprio_set$pid(0x3, 0x0, 0x0) 04:40:12 executing program 2: socket$inet_udplite(0x2, 0x2, 0x88) syz_emit_ethernet(0x2a, &(0x7f0000000000)={@random="0fdc2d1e8d38", @local, [], {@arp={0x806, @ether_ipv4={0x6, 0x800, 0x6, 0x4, 0x1, @random="f8bf88df5b1b", @remote={0xac, 0x223}, @dev, @rand_addr=0xac1414bb}}}}, 0x0) 04:40:13 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc9f123c1237319bc070") r1 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f00000001c0)=[@acquire], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000008fd0)={0x4, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="0e630c40"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f000000dfd0)={0x10, 0x0, &(0x7f0000000100)=[@request_death], 0x0, 0x0, 0x0}) [ 150.612547] audit: type=1400 audit(1555044013.061:41): avc: denied { set_context_mgr } for pid=8002 comm="syz-executor.5" scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=binder permissive=1 [ 150.659518] binder: 8002:8004 BC_REQUEST_DEATH_NOTIFICATION death notification already set 04:40:15 executing program 1: perf_event_open(&(0x7f0000940000)={0x2, 0x70, 0xee6a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = eventfd2(0x7ff, 0x800) readv(r0, &(0x7f0000001600)=[{&(0x7f0000000040)=""/8, 0x8}, {&(0x7f0000000200)=""/231, 0xe7}], 0x2) 04:40:15 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f00000001c0)="0adc1f123c123f319bc070") openat(0xffffffffffffffff, 0x0, 0x0, 0x0) ioctl$TIOCGSID(0xffffffffffffffff, 0x5429, 0x0) request_key(&(0x7f0000000240)='asymmetric\x00', &(0x7f0000001ffb)={'\x00@\x00'}, &(0x7f0000001fee)='R\trist\xe3cusgrVid:De', 0x0) 04:40:15 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f00000001c0)="0adc1f123c123f319bc070") dup(0xffffffffffffffff) mkdir(0x0, 0x0) dup(0xffffffffffffff9c) r1 = memfd_create(&(0x7f0000000140)='proc}GPLeth0^wlan0#:\x00', 0x0) clone(0x3102001ffe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = gettid() socket$netlink(0x10, 0x3, 0xe) ptrace$setopts(0x4206, r2, 0x0, 0x0) wait4(0x0, 0x0, 0x0, 0x0) execveat(r1, &(0x7f0000000000)='\x00', 0x0, 0x0, 0x400001000) tkill(r2, 0x20) ioctl$UI_BEGIN_FF_UPLOAD(0xffffffffffffffff, 0xc06855c8, 0x0) mount(0x0, &(0x7f00000000c0)='./file0\x00', 0x0, 0x0, 0x0) 04:40:15 executing program 0: setuid(0xee01) ioprio_set$pid(0x3, 0x0, 0x0) 04:40:15 executing program 2: socket$inet_udplite(0x2, 0x2, 0x88) syz_emit_ethernet(0x2a, &(0x7f0000000000)={@random="0fdc2d1e8d38", @local, [], {@arp={0x806, @ether_ipv4={0x6, 0x800, 0x6, 0x4, 0x1, @random="f8bf88df5b1b", @remote={0xac, 0x223}, @dev, @rand_addr=0xac1414bb}}}}, 0x0) 04:40:15 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc9f123c1237319bc070") r1 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f00000001c0)=[@acquire], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000008fd0)={0x4, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="0e630c40"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f000000dfd0)={0x10, 0x0, &(0x7f0000000100)=[@request_death], 0x0, 0x0, 0x0}) 04:40:15 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f00000001c0)="0adc1f123c123f319bc070") openat(0xffffffffffffffff, 0x0, 0x0, 0x0) ioctl$TIOCGSID(0xffffffffffffffff, 0x5429, 0x0) request_key(&(0x7f0000000240)='asymmetric\x00', &(0x7f0000001ffb)={'\x00@\x00'}, &(0x7f0000001fee)='R\trist\xe3cusgrVid:De', 0x0) 04:40:15 executing program 0: setuid(0xee01) ioprio_set$pid(0x3, 0x0, 0x0) [ 153.462749] binder: 8018:8022 BC_REQUEST_DEATH_NOTIFICATION death notification already set 04:40:15 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc9f123c1237319bc070") r1 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f00000001c0)=[@acquire], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000008fd0)={0x4, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="0e630c40"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f000000dfd0)={0x10, 0x0, &(0x7f0000000100)=[@request_death], 0x0, 0x0, 0x0}) 04:40:16 executing program 2: socket$inet_udplite(0x2, 0x2, 0x88) syz_emit_ethernet(0x2a, &(0x7f0000000000)={@random="0fdc2d1e8d38", @local, [], {@arp={0x806, @ether_ipv4={0x6, 0x800, 0x6, 0x4, 0x1, @random="f8bf88df5b1b", @remote={0xac, 0x223}, @dev, @rand_addr=0xac1414bb}}}}, 0x0) 04:40:16 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f00000001c0)="0adc1f123c123f319bc070") openat(0xffffffffffffffff, 0x0, 0x0, 0x0) ioctl$TIOCGSID(0xffffffffffffffff, 0x5429, 0x0) request_key(&(0x7f0000000240)='asymmetric\x00', &(0x7f0000001ffb)={'\x00@\x00'}, &(0x7f0000001fee)='R\trist\xe3cusgrVid:De', 0x0) 04:40:16 executing program 1: perf_event_open(&(0x7f0000940000)={0x2, 0x70, 0xee6a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = eventfd2(0x7ff, 0x800) readv(r0, &(0x7f0000001600)=[{&(0x7f0000000040)=""/8, 0x8}, {&(0x7f0000000200)=""/231, 0xe7}], 0x2) [ 153.601625] binder: 8038:8044 BC_REQUEST_DEATH_NOTIFICATION death notification already set 04:40:16 executing program 0: setuid(0xee01) ioprio_set$pid(0x3, 0x0, 0x0) 04:40:16 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc9f123c1237319bc070") r1 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f00000001c0)=[@acquire], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000008fd0)={0x4, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="0e630c40"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f000000dfd0)={0x10, 0x0, &(0x7f0000000100)=[@request_death], 0x0, 0x0, 0x0}) [ 153.765872] binder: 8057:8058 BC_REQUEST_DEATH_NOTIFICATION death notification already set 04:40:18 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f00000001c0)="0adc1f123c123f319bc070") dup(0xffffffffffffffff) mkdir(0x0, 0x0) dup(0xffffffffffffff9c) r1 = memfd_create(&(0x7f0000000140)='proc}GPLeth0^wlan0#:\x00', 0x0) clone(0x3102001ffe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = gettid() socket$netlink(0x10, 0x3, 0xe) ptrace$setopts(0x4206, r2, 0x0, 0x0) wait4(0x0, 0x0, 0x0, 0x0) execveat(r1, &(0x7f0000000000)='\x00', 0x0, 0x0, 0x400001000) tkill(r2, 0x20) ioctl$UI_BEGIN_FF_UPLOAD(0xffffffffffffffff, 0xc06855c8, 0x0) mount(0x0, &(0x7f00000000c0)='./file0\x00', 0x0, 0x0, 0x0) 04:40:18 executing program 0: ioprio_set$pid(0x3, 0x0, 0x0) 04:40:18 executing program 2: ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f00000001c0)="0adc1f123c123f319bc070") syz_emit_ethernet(0x2a, &(0x7f0000000000)={@random="0fdc2d1e8d38", @local, [], {@arp={0x806, @ether_ipv4={0x6, 0x800, 0x6, 0x4, 0x1, @random="f8bf88df5b1b", @remote={0xac, 0x223}, @dev, @rand_addr=0xac1414bb}}}}, 0x0) 04:40:18 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f00000001c0)="0adc1f123c123f319bc070") openat(0xffffffffffffffff, 0x0, 0x0, 0x0) clone(0x4000002102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) request_key(&(0x7f0000000240)='asymmetric\x00', &(0x7f0000001ffb)={'\x00@\x00'}, &(0x7f0000001fee)='R\trist\xe3cusgrVid:De', 0x0) 04:40:18 executing program 1: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(0xffffffffffffffff, 0x6, 0x0, 0x0, 0x0) connect$inet6(0xffffffffffffffff, 0x0, 0x0) r3 = dup2(r2, r1) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r4 = gettid() setsockopt$inet6_opts(r3, 0x29, 0x3b, &(0x7f0000000780)=ANY=[@ANYRESDEC=r1, @ANYPTR64=&(0x7f0000000100)=ANY=[@ANYRESHEX=r2, @ANYPTR=&(0x7f0000000180)=ANY=[@ANYRESHEX=r3, @ANYRESHEX=r0, @ANYPTR, @ANYRES32, @ANYRES64=r2, @ANYPTR, @ANYPTR], @ANYRESHEX=r4, @ANYRES64=r3], @ANYPTR, @ANYPTR64=&(0x7f0000000200)=ANY=[@ANYRESOCT=r3, @ANYRESDEC=r1], @ANYRESDEC, @ANYRES32=r2], 0x6) ptrace$setopts(0x4206, r4, 0x0, 0x0) tkill(r4, 0x1d) fcntl$setstatus(r3, 0x4, 0x42803) 04:40:18 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc9f123c1237319bc070") r1 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f00000001c0)=[@acquire], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f000000dfd0)={0x10, 0x0, &(0x7f0000000100)=[@request_death], 0x0, 0x0, 0x0}) 04:40:19 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc9f123c1237319bc070") r1 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f00000001c0)=[@acquire], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f000000dfd0)={0x10, 0x0, &(0x7f0000000100)=[@request_death], 0x0, 0x0, 0x0}) 04:40:19 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f00000001c0)="0adc1f123c123f319bc070") openat(0xffffffffffffffff, 0x0, 0x0, 0x0) clone(0x4000002102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) request_key(&(0x7f0000000240)='asymmetric\x00', &(0x7f0000001ffb)={'\x00@\x00'}, &(0x7f0000001fee)='R\trist\xe3cusgrVid:De', 0x0) 04:40:19 executing program 1: r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000100)='./cgroup.cpu\x00', 0x200002, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000000)='./bus\x00', 0x0) ioctl$FS_IOC_FIEMAP(r1, 0xc020660b, &(0x7f00000002c0)=ANY=[@ANYBLOB="090000004008000088"]) 04:40:19 executing program 0: ioprio_set$pid(0x3, 0x0, 0x0) 04:40:19 executing program 2: ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f00000001c0)="0adc1f123c123f319bc070") syz_emit_ethernet(0x2a, &(0x7f0000000000)={@random="0fdc2d1e8d38", @local, [], {@arp={0x806, @ether_ipv4={0x6, 0x800, 0x6, 0x4, 0x1, @random="f8bf88df5b1b", @remote={0xac, 0x223}, @dev, @rand_addr=0xac1414bb}}}}, 0x0) 04:40:19 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f00000001c0)="0adc1f123c123f319bc070") clone(0x4000002102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) request_key(&(0x7f0000000240)='asymmetric\x00', &(0x7f0000001ffb)={'\x00@\x00'}, &(0x7f0000001fee)='R\trist\xe3cusgrVid:De', 0x0) 04:40:21 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f00000001c0)="0adc1f123c123f319bc070") dup(0xffffffffffffffff) mkdir(0x0, 0x0) dup(0xffffffffffffff9c) r1 = memfd_create(&(0x7f0000000140)='proc}GPLeth0^wlan0#:\x00', 0x0) clone(0x3102001ffe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = gettid() socket$netlink(0x10, 0x3, 0xe) ptrace$setopts(0x4206, r2, 0x0, 0x0) wait4(0x0, 0x0, 0x0, 0x0) execveat(r1, &(0x7f0000000000)='\x00', 0x0, 0x0, 0x400001000) tkill(r2, 0x20) ioctl$UI_BEGIN_FF_UPLOAD(0xffffffffffffffff, 0xc06855c8, 0x0) 04:40:21 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc9f123c1237319bc070") r1 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f00000001c0)=[@acquire], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f000000dfd0)={0x10, 0x0, &(0x7f0000000100)=[@request_death], 0x0, 0x0, 0x0}) 04:40:21 executing program 0: ioprio_set$pid(0x3, 0x0, 0x0) 04:40:21 executing program 1: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc9f123c1237319bc070") unshare(0x400) pwritev(0xffffffffffffffff, 0x0, 0x0, 0x0) 04:40:21 executing program 2: ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f00000001c0)="0adc1f123c123f319bc070") syz_emit_ethernet(0x2a, &(0x7f0000000000)={@random="0fdc2d1e8d38", @local, [], {@arp={0x806, @ether_ipv4={0x6, 0x800, 0x6, 0x4, 0x1, @random="f8bf88df5b1b", @remote={0xac, 0x223}, @dev, @rand_addr=0xac1414bb}}}}, 0x0) 04:40:21 executing program 4: socket$inet_udplite(0x2, 0x2, 0x88) clone(0x4000002102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) request_key(&(0x7f0000000240)='asymmetric\x00', &(0x7f0000001ffb)={'\x00@\x00'}, &(0x7f0000001fee)='R\trist\xe3cusgrVid:De', 0x0) 04:40:22 executing program 4: socket$inet_udplite(0x2, 0x2, 0x88) clone(0x4000002102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) request_key(&(0x7f0000000240)='asymmetric\x00', &(0x7f0000001ffb)={'\x00@\x00'}, &(0x7f0000001fee)='R\trist\xe3cusgrVid:De', 0x0) 04:40:22 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc9f123c1237319bc070") r1 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000008fd0)={0x4, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="0e630c40"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f000000dfd0)={0x10, 0x0, &(0x7f0000000100)=[@request_death], 0x0, 0x0, 0x0}) 04:40:22 executing program 0: setuid(0xee01) ioprio_set$pid(0x0, 0x0, 0x0) 04:40:22 executing program 1: r0 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vcs\x00', 0x2900, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, 0x0) write$FUSE_BMAP(0xffffffffffffffff, 0x0, 0x0) fallocate(0xffffffffffffffff, 0x0, 0x0, 0x100000000) ioctl$SNDRV_SEQ_IOCTL_GET_CLIENT_INFO(0xffffffffffffffff, 0xc0bc5310, 0x0) sendto$unix(r0, &(0x7f0000000540)="36c5e2ae7a7b332f2032125a2d0f402c074472823f7aff13019538db9ff8abe4938f004a6719df68935b0014f8f5ddf8dce3e228170acdef49cbf087126c6518de5b2f748d327916a1cb95442c1eb673", 0x50, 0x0, 0x0, 0x0) inotify_init() sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000000), 0x0) getsockopt$inet_IP_IPSEC_POLICY(0xffffffffffffffff, 0x0, 0x10, 0x0, 0x0) syz_mount_image$vfat(0x0, &(0x7f0000000180)='./file0\x00', 0x20, 0x0, 0x0, 0x2001008, 0x0) r1 = socket$nl_generic(0x10, 0x3, 0x10) open_by_handle_at(r0, &(0x7f0000000440)={0xd8, 0x800, "3bde9e47cf605525e30078fa87c8a9cf9c028ea5c3a002978211360a9ab1bfdd52666f08e514370c84d54d2285cc70fb00d2c98165e27e0e41e577dca32412e5b71d4ab7ba9f99e42f7ddf890f5fd5e7cb2f81fbe1b6605474d6e6edc1716d06fb59df2e0574271d9618cf3ada233a15c37db370399135c78cae539617d836a0142cfc924f31a67513c05a1e31bd34a97ecdb2cf7bf523b56e4425dc1b31eb3e3aa027c07ce19fd7a45dd0968317944c78f6d2337b64d3169b1102aa63a6199b39ac8d73f867944e55c4577be8601516"}, 0x80000) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmsg$nl_generic(r1, &(0x7f0000001400)={0x0, 0x4c00007e, &(0x7f00000013c0)={&(0x7f0000000100)={0x14, 0x17, 0x101, 0x0, 0x0, {0x4}}, 0x14}}, 0x0) prctl$PR_SET_MM(0x23, 0xb, &(0x7f0000ff9000/0x4000)=nil) 04:40:22 executing program 2: socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f00000001c0)="0adc1f123c123f319bc070") syz_emit_ethernet(0x2a, &(0x7f0000000000)={@random="0fdc2d1e8d38", @local, [], {@arp={0x806, @ether_ipv4={0x6, 0x800, 0x6, 0x4, 0x1, @random="f8bf88df5b1b", @remote={0xac, 0x223}, @dev, @rand_addr=0xac1414bb}}}}, 0x0) 04:40:22 executing program 4: socket$inet_udplite(0x2, 0x2, 0x88) clone(0x4000002102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) request_key(&(0x7f0000000240)='asymmetric\x00', &(0x7f0000001ffb)={'\x00@\x00'}, &(0x7f0000001fee)='R\trist\xe3cusgrVid:De', 0x0) [ 159.747836] binder: 8144:8146 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 159.801082] binder: 8144:8146 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 04:40:25 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f00000001c0)="0adc1f123c123f319bc070") dup(0xffffffffffffffff) mkdir(0x0, 0x0) dup(0xffffffffffffff9c) r1 = memfd_create(&(0x7f0000000140)='proc}GPLeth0^wlan0#:\x00', 0x0) clone(0x3102001ffe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = gettid() socket$netlink(0x10, 0x3, 0xe) ptrace$setopts(0x4206, r2, 0x0, 0x0) wait4(0x0, 0x0, 0x0, 0x0) execveat(r1, &(0x7f0000000000)='\x00', 0x0, 0x0, 0x400001000) tkill(r2, 0x20) ioctl$UI_BEGIN_FF_UPLOAD(0xffffffffffffffff, 0xc06855c8, 0x0) 04:40:25 executing program 2: socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f00000001c0)="0adc1f123c123f319bc070") syz_emit_ethernet(0x2a, &(0x7f0000000000)={@random="0fdc2d1e8d38", @local, [], {@arp={0x806, @ether_ipv4={0x6, 0x800, 0x6, 0x4, 0x1, @random="f8bf88df5b1b", @remote={0xac, 0x223}, @dev, @rand_addr=0xac1414bb}}}}, 0x0) 04:40:25 executing program 0: setuid(0xee01) ioprio_set$pid(0x0, 0x0, 0x0) 04:40:25 executing program 4: ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f00000001c0)="0adc1f123c123f319bc070") clone(0x4000002102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) request_key(&(0x7f0000000240)='asymmetric\x00', &(0x7f0000001ffb)={'\x00@\x00'}, &(0x7f0000001fee)='R\trist\xe3cusgrVid:De', 0x0) 04:40:25 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc9f123c1237319bc070") r1 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000008fd0)={0x4, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="0e630c40"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f000000dfd0)={0x10, 0x0, &(0x7f0000000100)=[@request_death], 0x0, 0x0, 0x0}) 04:40:25 executing program 1: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc9f123c1237319bc070") unshare(0x30010100) 04:40:25 executing program 0: setuid(0xee01) ioprio_set$pid(0x0, 0x0, 0x0) 04:40:25 executing program 4: ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f00000001c0)="0adc1f123c123f319bc070") clone(0x4000002102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) request_key(&(0x7f0000000240)='asymmetric\x00', &(0x7f0000001ffb)={'\x00@\x00'}, &(0x7f0000001fee)='R\trist\xe3cusgrVid:De', 0x0) 04:40:25 executing program 2: socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f00000001c0)="0adc1f123c123f319bc070") syz_emit_ethernet(0x2a, &(0x7f0000000000)={@random="0fdc2d1e8d38", @local, [], {@arp={0x806, @ether_ipv4={0x6, 0x800, 0x6, 0x4, 0x1, @random="f8bf88df5b1b", @remote={0xac, 0x223}, @dev, @rand_addr=0xac1414bb}}}}, 0x0) [ 162.609323] binder: 8174:8176 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 162.646314] binder: 8174:8176 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 04:40:25 executing program 1: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socketpair(0x2, 0xa, 0x2, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$packet_tx_ring(r0, 0x10f, 0x87, 0x0, 0xfffffffffffffe6a) r1 = openat$pfkey(0xffffffffffffff9c, &(0x7f0000000080)='/proc/self/net/pfkey\x00', 0x0, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f0000000200)=[{{0x0, 0x0, &(0x7f0000002580)=[{&(0x7f00000012c0)=""/115, 0x73}], 0x1, 0x0, 0x1d}}], 0x1, 0x0, 0x0) preadv(r1, &(0x7f0000000480), 0x372, 0x0) 04:40:25 executing program 4: ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f00000001c0)="0adc1f123c123f319bc070") clone(0x4000002102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) request_key(&(0x7f0000000240)='asymmetric\x00', &(0x7f0000001ffb)={'\x00@\x00'}, &(0x7f0000001fee)='R\trist\xe3cusgrVid:De', 0x0) 04:40:25 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc9f123c1237319bc070") r1 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000008fd0)={0x4, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="0e630c40"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f000000dfd0)={0x10, 0x0, &(0x7f0000000100)=[@request_death], 0x0, 0x0, 0x0}) [ 162.813835] binder: 8206:8207 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 162.816959] syz-executor.1 uses obsolete (PF_INET,SOCK_PACKET) [ 162.845371] binder: 8206:8207 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 04:40:28 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f00000001c0)="0adc1f123c123f319bc070") dup(0xffffffffffffffff) mkdir(0x0, 0x0) dup(0xffffffffffffff9c) r1 = memfd_create(&(0x7f0000000140)='proc}GPLeth0^wlan0#:\x00', 0x0) clone(0x3102001ffe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = gettid() socket$netlink(0x10, 0x3, 0xe) ptrace$setopts(0x4206, r2, 0x0, 0x0) wait4(0x0, 0x0, 0x0, 0x0) execveat(r1, &(0x7f0000000000)='\x00', 0x0, 0x0, 0x400001000) tkill(r2, 0x20) ioctl$UI_BEGIN_FF_UPLOAD(0xffffffffffffffff, 0xc06855c8, 0x0) 04:40:28 executing program 0: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) socketpair(0x2, 0xa, 0x2, &(0x7f0000000000)) 04:40:28 executing program 2: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x0, &(0x7f00000001c0)="0adc1f123c123f319bc070") syz_emit_ethernet(0x2a, &(0x7f0000000000)={@random="0fdc2d1e8d38", @local, [], {@arp={0x806, @ether_ipv4={0x6, 0x800, 0x6, 0x4, 0x1, @random="f8bf88df5b1b", @remote={0xac, 0x223}, @dev, @rand_addr=0xac1414bb}}}}, 0x0) 04:40:28 executing program 4: socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f00000001c0)="0adc1f123c123f319bc070") clone(0x4000002102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) request_key(&(0x7f0000000240)='asymmetric\x00', &(0x7f0000001ffb)={'\x00@\x00'}, &(0x7f0000001fee)='R\trist\xe3cusgrVid:De', 0x0) 04:40:28 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc9f123c1237319bc070") r1 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f00000001c0)=[@acquire], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000008fd0)={0x4, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="0e630c40"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f000000dfd0)={0x10, 0x0, &(0x7f0000000100)=[@request_death], 0x0, 0x0, 0x0}) 04:40:28 executing program 1: ioctl$UI_SET_FFBIT(0xffffffffffffffff, 0x4004556b, 0x6) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f00000001c0)="0adc1f123c123f319bc070") clone(0x4000002102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) request_key(&(0x7f0000000240)='asymmetric\x00', &(0x7f0000001ffb)={'\x00@\x00'}, &(0x7f0000001fee)='R\trist\xe3cusgrVid:De', 0x0) 04:40:28 executing program 4: socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f00000001c0)="0adc1f123c123f319bc070") clone(0x4000002102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) request_key(&(0x7f0000000240)='asymmetric\x00', &(0x7f0000001ffb)={'\x00@\x00'}, &(0x7f0000001fee)='R\trist\xe3cusgrVid:De', 0x0) 04:40:28 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc9f123c1237319bc070") r1 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f00000001c0)=[@acquire], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000008fd0)={0x4, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="0e630c40"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f000000dfd0)={0x10, 0x0, &(0x7f0000000100)=[@request_death], 0x0, 0x0, 0x0}) 04:40:28 executing program 2: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x0, &(0x7f00000001c0)="0adc1f123c123f319bc070") syz_emit_ethernet(0x2a, &(0x7f0000000000)={@random="0fdc2d1e8d38", @local, [], {@arp={0x806, @ether_ipv4={0x6, 0x800, 0x6, 0x4, 0x1, @random="f8bf88df5b1b", @remote={0xac, 0x223}, @dev, @rand_addr=0xac1414bb}}}}, 0x0) 04:40:28 executing program 1: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x2000001000008912, &(0x7f00000001c0)="0adc1f123c123f319bc070") r1 = creat(&(0x7f00000000c0)='./file0\x00', 0x0) clone(0x0, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) ioctl$sock_inet_udp_SIOCINQ(r1, 0x541b, &(0x7f0000000140)) 04:40:28 executing program 4: socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f00000001c0)="0adc1f123c123f319bc070") clone(0x4000002102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) request_key(&(0x7f0000000240)='asymmetric\x00', &(0x7f0000001ffb)={'\x00@\x00'}, &(0x7f0000001fee)='R\trist\xe3cusgrVid:De', 0x0) 04:40:28 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc9f123c1237319bc070") r1 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f00000001c0)=[@acquire], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000008fd0)={0x4, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="0e630c40"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f000000dfd0)={0x10, 0x0, &(0x7f0000000100)=[@request_death], 0x0, 0x0, 0x0}) 04:40:31 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f00000001c0)="0adc1f123c123f319bc070") dup(0xffffffffffffffff) mkdir(0x0, 0x0) dup(0xffffffffffffff9c) r1 = memfd_create(&(0x7f0000000140)='proc}GPLeth0^wlan0#:\x00', 0x0) clone(0x3102001ffe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = gettid() socket$netlink(0x10, 0x3, 0xe) ptrace$setopts(0x4206, r2, 0x0, 0x0) wait4(0x0, 0x0, 0x0, 0x0) execveat(r1, &(0x7f0000000000)='\x00', 0x0, 0x0, 0x400001000) tkill(r2, 0x20) 04:40:31 executing program 0: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) socketpair(0x2, 0xa, 0x2, &(0x7f0000000000)) 04:40:31 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x0, &(0x7f00000001c0)="0adc1f123c123f319bc070") clone(0x4000002102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) request_key(&(0x7f0000000240)='asymmetric\x00', &(0x7f0000001ffb)={'\x00@\x00'}, &(0x7f0000001fee)='R\trist\xe3cusgrVid:De', 0x0) 04:40:31 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc9f123c1237319bc070") syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f00000001c0)=[@acquire], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x4, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="0e630c40"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000dfd0)={0x10, 0x0, &(0x7f0000000100)=[@request_death], 0x0, 0x0, 0x0}) 04:40:31 executing program 2: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x0, &(0x7f00000001c0)="0adc1f123c123f319bc070") syz_emit_ethernet(0x2a, &(0x7f0000000000)={@random="0fdc2d1e8d38", @local, [], {@arp={0x806, @ether_ipv4={0x6, 0x800, 0x6, 0x4, 0x1, @random="f8bf88df5b1b", @remote={0xac, 0x223}, @dev, @rand_addr=0xac1414bb}}}}, 0x0) 04:40:31 executing program 1: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) socketpair(0x2, 0xa, 0x2, &(0x7f0000000000)) r0 = openat$pfkey(0xffffffffffffff9c, &(0x7f0000000080)='/proc/self/net/pfkey\x00', 0x0, 0x0) preadv(r0, &(0x7f0000000480), 0x372, 0x0) 04:40:31 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x0, &(0x7f00000001c0)="0adc1f123c123f319bc070") clone(0x4000002102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) request_key(&(0x7f0000000240)='asymmetric\x00', &(0x7f0000001ffb)={'\x00@\x00'}, &(0x7f0000001fee)='R\trist\xe3cusgrVid:De', 0x0) 04:40:31 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f00000001c0)="0adc1f123c123f319bc070") dup(0xffffffffffffffff) mkdir(0x0, 0x0) dup(0xffffffffffffff9c) r1 = memfd_create(&(0x7f0000000140)='proc}GPLeth0^wlan0#:\x00', 0x0) clone(0x3102001ffe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = gettid() socket$netlink(0x10, 0x3, 0xe) ptrace$setopts(0x4206, r2, 0x0, 0x0) wait4(0x0, 0x0, 0x0, 0x0) execveat(r1, &(0x7f0000000000)='\x00', 0x0, 0x0, 0x400001000) tkill(r2, 0x20) [ 168.695756] binder: 8277:8278 Acquire 1 refcount change on invalid ref 0 ret -22 [ 168.714073] binder: 8277:8278 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 168.732468] binder: 8277:8278 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 04:40:31 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x0, &(0x7f00000001c0)="0adc1f123c123f319bc070") clone(0x4000002102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) request_key(&(0x7f0000000240)='asymmetric\x00', &(0x7f0000001ffb)={'\x00@\x00'}, &(0x7f0000001fee)='R\trist\xe3cusgrVid:De', 0x0) 04:40:31 executing program 0: pselect6(0x40, &(0x7f0000000000), 0x0, &(0x7f0000000300)={0x0, 0x0, 0x0, 0x800000000000}, &(0x7f0000000100)={0x77359400}, &(0x7f00000003c0)={&(0x7f0000000380), 0x8}) 04:40:31 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc9f123c1237319bc070") syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f00000001c0)=[@acquire], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x4, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="0e630c40"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000dfd0)={0x10, 0x0, &(0x7f0000000100)=[@request_death], 0x0, 0x0, 0x0}) 04:40:31 executing program 2: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, 0x0) syz_emit_ethernet(0x2a, &(0x7f0000000000)={@random="0fdc2d1e8d38", @local, [], {@arp={0x806, @ether_ipv4={0x6, 0x800, 0x6, 0x4, 0x1, @random="f8bf88df5b1b", @remote={0xac, 0x223}, @dev, @rand_addr=0xac1414bb}}}}, 0x0) 04:40:31 executing program 1: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) socketpair(0x2, 0xa, 0x2, &(0x7f0000000000)) r0 = openat$pfkey(0xffffffffffffff9c, &(0x7f0000000080)='/proc/self/net/pfkey\x00', 0x0, 0x0) preadv(r0, &(0x7f0000000480), 0x372, 0x0) 04:40:31 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, 0x0) clone(0x4000002102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) request_key(&(0x7f0000000240)='asymmetric\x00', &(0x7f0000001ffb)={'\x00@\x00'}, &(0x7f0000001fee)='R\trist\xe3cusgrVid:De', 0x0) 04:40:31 executing program 2: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, 0x0) syz_emit_ethernet(0x2a, &(0x7f0000000000)={@random="0fdc2d1e8d38", @local, [], {@arp={0x806, @ether_ipv4={0x6, 0x800, 0x6, 0x4, 0x1, @random="f8bf88df5b1b", @remote={0xac, 0x223}, @dev, @rand_addr=0xac1414bb}}}}, 0x0) [ 168.948852] binder: 8317:8319 Acquire 1 refcount change on invalid ref 0 ret -22 [ 168.983288] binder: 8317:8319 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 04:40:31 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, 0x0) clone(0x4000002102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) request_key(&(0x7f0000000240)='asymmetric\x00', &(0x7f0000001ffb)={'\x00@\x00'}, &(0x7f0000001fee)='R\trist\xe3cusgrVid:De', 0x0) [ 169.008450] binder: 8317:8319 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 04:40:31 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc9f123c1237319bc070") syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f00000001c0)=[@acquire], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x4, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="0e630c40"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000dfd0)={0x10, 0x0, &(0x7f0000000100)=[@request_death], 0x0, 0x0, 0x0}) 04:40:31 executing program 2: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, 0x0) syz_emit_ethernet(0x2a, &(0x7f0000000000)={@random="0fdc2d1e8d38", @local, [], {@arp={0x806, @ether_ipv4={0x6, 0x800, 0x6, 0x4, 0x1, @random="f8bf88df5b1b", @remote={0xac, 0x223}, @dev, @rand_addr=0xac1414bb}}}}, 0x0) 04:40:31 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, 0x0) clone(0x4000002102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) request_key(&(0x7f0000000240)='asymmetric\x00', &(0x7f0000001ffb)={'\x00@\x00'}, &(0x7f0000001fee)='R\trist\xe3cusgrVid:De', 0x0) [ 169.149064] binder: 8342:8343 Acquire 1 refcount change on invalid ref 0 ret -22 [ 169.171020] binder: 8342:8343 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 169.192154] binder: 8342:8343 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 04:40:34 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f00000001c0)="0adc1f123c123f319bc070") dup(0xffffffffffffffff) mkdir(0x0, 0x0) dup(0xffffffffffffff9c) r1 = memfd_create(&(0x7f0000000140)='proc}GPLeth0^wlan0#:\x00', 0x0) clone(0x3102001ffe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = gettid() socket$netlink(0x10, 0x3, 0xe) ptrace$setopts(0x4206, r2, 0x0, 0x0) wait4(0x0, 0x0, 0x0, 0x0) execveat(r1, &(0x7f0000000000)='\x00', 0x0, 0x0, 0x400001000) 04:40:34 executing program 1: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$netlink(0x10, 0x3, 0x0) recvmmsg(r0, &(0x7f0000002d80), 0x400000000000368, 0x1a002, &(0x7f0000000180)={0x77359400}) sendmsg$nl_generic(r0, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000140)={0x14, 0x40000000042, 0x105}, 0x14}}, 0x0) ioctl$PIO_FONT(0xffffffffffffffff, 0x4b61, 0x0) 04:40:34 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc9f123c1237319bc070") ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f00000001c0)=[@acquire], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x4, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="0e630c40"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000dfd0)={0x10, 0x0, &(0x7f0000000100)=[@request_death], 0x0, 0x0, 0x0}) 04:40:34 executing program 2: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f00000001c0)) syz_emit_ethernet(0x2a, &(0x7f0000000000)={@random="0fdc2d1e8d38", @local, [], {@arp={0x806, @ether_ipv4={0x6, 0x800, 0x6, 0x4, 0x1, @random="f8bf88df5b1b", @remote={0xac, 0x223}, @dev, @rand_addr=0xac1414bb}}}}, 0x0) 04:40:34 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f00000001c0)) clone(0x4000002102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) request_key(&(0x7f0000000240)='asymmetric\x00', &(0x7f0000001ffb)={'\x00@\x00'}, &(0x7f0000001fee)='R\trist\xe3cusgrVid:De', 0x0) 04:40:34 executing program 0: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) socketpair(0x2, 0xa, 0x2, &(0x7f0000000000)) 04:40:34 executing program 2: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f00000001c0)) syz_emit_ethernet(0x2a, &(0x7f0000000000)={@random="0fdc2d1e8d38", @local, [], {@arp={0x806, @ether_ipv4={0x6, 0x800, 0x6, 0x4, 0x1, @random="f8bf88df5b1b", @remote={0xac, 0x223}, @dev, @rand_addr=0xac1414bb}}}}, 0x0) 04:40:34 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc9f123c1237319bc070") ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f00000001c0)=[@acquire], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x4, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="0e630c40"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000dfd0)={0x10, 0x0, &(0x7f0000000100)=[@request_death], 0x0, 0x0, 0x0}) 04:40:34 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f00000001c0)) clone(0x4000002102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) request_key(&(0x7f0000000240)='asymmetric\x00', &(0x7f0000001ffb)={'\x00@\x00'}, &(0x7f0000001fee)='R\trist\xe3cusgrVid:De', 0x0) 04:40:34 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc9f123c1237319bc070") unshare(0x400) r1 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000000)='net/ip_tables_matches\x00') ioctl$TUNSETNOCSUM(r1, 0x400454c8, 0x0) 04:40:34 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f00000001c0)) clone(0x4000002102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) request_key(&(0x7f0000000240)='asymmetric\x00', &(0x7f0000001ffb)={'\x00@\x00'}, &(0x7f0000001fee)='R\trist\xe3cusgrVid:De', 0x0) 04:40:34 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f00000001c0)="0adc1f123c123f319bc070") dup(0xffffffffffffffff) mkdir(0x0, 0x0) dup(0xffffffffffffff9c) r1 = memfd_create(&(0x7f0000000140)='proc}GPLeth0^wlan0#:\x00', 0x0) clone(0x3102001ffe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = gettid() socket$netlink(0x10, 0x3, 0xe) ptrace$setopts(0x4206, r2, 0x0, 0x0) wait4(0x0, 0x0, 0x0, 0x0) execveat(r1, &(0x7f0000000000)='\x00', 0x0, 0x0, 0x400001000) 04:40:34 executing program 2: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f00000001c0)) syz_emit_ethernet(0x2a, &(0x7f0000000000)={@random="0fdc2d1e8d38", @local, [], {@arp={0x806, @ether_ipv4={0x6, 0x800, 0x6, 0x4, 0x1, @random="f8bf88df5b1b", @remote={0xac, 0x223}, @dev, @rand_addr=0xac1414bb}}}}, 0x0) 04:40:34 executing program 1: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$netlink(0x10, 0x3, 0x0) recvmmsg(r0, &(0x7f0000002d80), 0x400000000000368, 0x1a002, &(0x7f0000000180)={0x77359400}) sendmsg$nl_generic(r0, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000140)={0x14, 0x40000000042, 0x105}, 0x14}}, 0x0) ioctl$PIO_FONT(0xffffffffffffffff, 0x4b61, 0x0) 04:40:34 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc9f123c1237319bc070") ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f00000001c0)=[@acquire], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x4, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="0e630c40"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000dfd0)={0x10, 0x0, &(0x7f0000000100)=[@request_death], 0x0, 0x0, 0x0}) 04:40:34 executing program 0: perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_open_dev$mice(&(0x7f0000000080)='/dev/input/mice\x00', 0x0, 0x4000) 04:40:34 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f00000001c0)="0adc1f123c12") clone(0x4000002102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) request_key(&(0x7f0000000240)='asymmetric\x00', &(0x7f0000001ffb)={'\x00@\x00'}, &(0x7f0000001fee)='R\trist\xe3cusgrVid:De', 0x0) 04:40:34 executing program 5: socket$inet_udplite(0x2, 0x2, 0x88) r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f00000001c0)=[@acquire], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x4, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="0e630c40"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000dfd0)={0x10, 0x0, &(0x7f0000000100)=[@request_death], 0x0, 0x0, 0x0}) 04:40:34 executing program 2: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f00000001c0)="0adc1f123c12") syz_emit_ethernet(0x2a, &(0x7f0000000000)={@random="0fdc2d1e8d38", @local, [], {@arp={0x806, @ether_ipv4={0x6, 0x800, 0x6, 0x4, 0x1, @random="f8bf88df5b1b", @remote={0xac, 0x223}, @dev, @rand_addr=0xac1414bb}}}}, 0x0) 04:40:34 executing program 0: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x7, 0x31, 0xffffffffffffffff, 0x0) r0 = userfaultfd(0x0) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000c34000)) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f00000000c0)={{&(0x7f0000068000/0x800000)=nil, 0x800000}, 0x1}) ioctl$UFFDIO_ZEROPAGE(r0, 0xc020aa04, &(0x7f0000000080)={{&(0x7f0000291000/0x400000)=nil, 0x400000}}) [ 172.340924] binder: 8421:8423 BC_REQUEST_DEATH_NOTIFICATION death notification already set 04:40:34 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f00000001c0)="0adc1f123c12") clone(0x4000002102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) request_key(&(0x7f0000000240)='asymmetric\x00', &(0x7f0000001ffb)={'\x00@\x00'}, &(0x7f0000001fee)='R\trist\xe3cusgrVid:De', 0x0) 04:40:34 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f00000001c0)="0adc1f123c123f319bc070") dup(0xffffffffffffffff) mkdir(0x0, 0x0) dup(0xffffffffffffff9c) r1 = memfd_create(&(0x7f0000000140)='proc}GPLeth0^wlan0#:\x00', 0x0) clone(0x3102001ffe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = gettid() socket$netlink(0x10, 0x3, 0xe) ptrace$setopts(0x4206, r2, 0x0, 0x0) wait4(0x0, 0x0, 0x0, 0x0) execveat(r1, &(0x7f0000000000)='\x00', 0x0, 0x0, 0x400001000) 04:40:34 executing program 2: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f00000001c0)="0adc1f123c12") syz_emit_ethernet(0x2a, &(0x7f0000000000)={@random="0fdc2d1e8d38", @local, [], {@arp={0x806, @ether_ipv4={0x6, 0x800, 0x6, 0x4, 0x1, @random="f8bf88df5b1b", @remote={0xac, 0x223}, @dev, @rand_addr=0xac1414bb}}}}, 0x0) 04:40:34 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f00000001c0)="0adc1f123c12") clone(0x4000002102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) request_key(&(0x7f0000000240)='asymmetric\x00', &(0x7f0000001ffb)={'\x00@\x00'}, &(0x7f0000001fee)='R\trist\xe3cusgrVid:De', 0x0) 04:40:35 executing program 5: socket$inet_udplite(0x2, 0x2, 0x88) r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f00000001c0)=[@acquire], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x4, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="0e630c40"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000dfd0)={0x10, 0x0, &(0x7f0000000100)=[@request_death], 0x0, 0x0, 0x0}) 04:40:35 executing program 1: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$netlink(0x10, 0x3, 0x0) recvmmsg(r0, &(0x7f0000002d80), 0x400000000000368, 0x1a002, &(0x7f0000000180)={0x77359400}) sendmsg$nl_generic(r0, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000140)={0x14, 0x40000000042, 0x105}, 0x14}}, 0x0) ioctl$PIO_FONT(0xffffffffffffffff, 0x4b61, 0x0) 04:40:35 executing program 2: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f00000001c0)="0adc1f123c12") syz_emit_ethernet(0x2a, &(0x7f0000000000)={@random="0fdc2d1e8d38", @local, [], {@arp={0x806, @ether_ipv4={0x6, 0x800, 0x6, 0x4, 0x1, @random="f8bf88df5b1b", @remote={0xac, 0x223}, @dev, @rand_addr=0xac1414bb}}}}, 0x0) 04:40:35 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f00000001c0)="0adc1f123c123f319b") clone(0x4000002102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) request_key(&(0x7f0000000240)='asymmetric\x00', &(0x7f0000001ffb)={'\x00@\x00'}, &(0x7f0000001fee)='R\trist\xe3cusgrVid:De', 0x0) [ 172.633738] binder: 8447:8451 BC_REQUEST_DEATH_NOTIFICATION death notification already set 04:40:35 executing program 5: socket$inet_udplite(0x2, 0x2, 0x88) r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f00000001c0)=[@acquire], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x4, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="0e630c40"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000dfd0)={0x10, 0x0, &(0x7f0000000100)=[@request_death], 0x0, 0x0, 0x0}) 04:40:35 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f00000001c0)="0adc1f123c123f319bc070") dup(0xffffffffffffffff) mkdir(0x0, 0x0) dup(0xffffffffffffff9c) r1 = memfd_create(&(0x7f0000000140)='proc}GPLeth0^wlan0#:\x00', 0x0) clone(0x3102001ffe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = gettid() socket$netlink(0x10, 0x3, 0xe) ptrace$setopts(0x4206, r2, 0x0, 0x0) execveat(r1, &(0x7f0000000000)='\x00', 0x0, 0x0, 0x400001000) tkill(r2, 0x20) 04:40:35 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f00000001c0)="0adc1f123c123f319b") clone(0x4000002102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) request_key(&(0x7f0000000240)='asymmetric\x00', &(0x7f0000001ffb)={'\x00@\x00'}, &(0x7f0000001fee)='R\trist\xe3cusgrVid:De', 0x0) [ 172.945976] binder: 8476:8478 BC_REQUEST_DEATH_NOTIFICATION death notification already set 04:40:35 executing program 0: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x7, 0x31, 0xffffffffffffffff, 0x0) r0 = userfaultfd(0x0) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000c34000)) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f00000000c0)={{&(0x7f0000068000/0x800000)=nil, 0x800000}, 0x1}) ioctl$UFFDIO_ZEROPAGE(r0, 0xc020aa04, &(0x7f0000000080)={{&(0x7f0000291000/0x400000)=nil, 0x400000}}) 04:40:35 executing program 2: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f00000001c0)="0adc1f123c123f319b") syz_emit_ethernet(0x2a, &(0x7f0000000000)={@random="0fdc2d1e8d38", @local, [], {@arp={0x806, @ether_ipv4={0x6, 0x800, 0x6, 0x4, 0x1, @random="f8bf88df5b1b", @remote={0xac, 0x223}, @dev, @rand_addr=0xac1414bb}}}}, 0x0) 04:40:35 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f00000001c0)="0adc1f123c123f319b") clone(0x4000002102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) request_key(&(0x7f0000000240)='asymmetric\x00', &(0x7f0000001ffb)={'\x00@\x00'}, &(0x7f0000001fee)='R\trist\xe3cusgrVid:De', 0x0) 04:40:35 executing program 1: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$netlink(0x10, 0x3, 0x0) recvmmsg(r0, &(0x7f0000002d80), 0x400000000000368, 0x1a002, &(0x7f0000000180)={0x77359400}) sendmsg$nl_generic(r0, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000140)={0x14, 0x40000000042, 0x105}, 0x14}}, 0x0) ioctl$PIO_FONT(0xffffffffffffffff, 0x4b61, 0x0) 04:40:35 executing program 5: ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="0adc9f123c1237319bc070") r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f00000001c0)=[@acquire], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x4, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="0e630c40"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000dfd0)={0x10, 0x0, &(0x7f0000000100)=[@request_death], 0x0, 0x0, 0x0}) [ 173.231933] binder: 8498:8499 BC_REQUEST_DEATH_NOTIFICATION death notification already set 04:40:35 executing program 2: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f00000001c0)="0adc1f123c123f319b") syz_emit_ethernet(0x2a, &(0x7f0000000000)={@random="0fdc2d1e8d38", @local, [], {@arp={0x806, @ether_ipv4={0x6, 0x800, 0x6, 0x4, 0x1, @random="f8bf88df5b1b", @remote={0xac, 0x223}, @dev, @rand_addr=0xac1414bb}}}}, 0x0) 04:40:35 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f00000001c0)="0adc1f123c123f319bc0") clone(0x4000002102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) request_key(&(0x7f0000000240)='asymmetric\x00', &(0x7f0000001ffb)={'\x00@\x00'}, &(0x7f0000001fee)='R\trist\xe3cusgrVid:De', 0x0) 04:40:35 executing program 5: ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="0adc9f123c1237319bc070") r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f00000001c0)=[@acquire], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x4, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="0e630c40"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000dfd0)={0x10, 0x0, &(0x7f0000000100)=[@request_death], 0x0, 0x0, 0x0}) 04:40:35 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f00000001c0)="0adc1f123c123f319bc0") clone(0x4000002102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) request_key(&(0x7f0000000240)='asymmetric\x00', &(0x7f0000001ffb)={'\x00@\x00'}, &(0x7f0000001fee)='R\trist\xe3cusgrVid:De', 0x0) 04:40:36 executing program 2: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f00000001c0)="0adc1f123c123f319b") syz_emit_ethernet(0x2a, &(0x7f0000000000)={@random="0fdc2d1e8d38", @local, [], {@arp={0x806, @ether_ipv4={0x6, 0x800, 0x6, 0x4, 0x1, @random="f8bf88df5b1b", @remote={0xac, 0x223}, @dev, @rand_addr=0xac1414bb}}}}, 0x0) [ 173.528210] binder: 8516:8517 BC_REQUEST_DEATH_NOTIFICATION death notification already set 04:40:38 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f00000001c0)="0adc1f123c123f319bc070") dup(0xffffffffffffffff) mkdir(0x0, 0x0) dup(0xffffffffffffff9c) r1 = memfd_create(&(0x7f0000000140)='proc}GPLeth0^wlan0#:\x00', 0x0) clone(0x3102001ffe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = gettid() socket$netlink(0x10, 0x3, 0xe) ptrace$setopts(0x4206, r2, 0x0, 0x0) execveat(r1, &(0x7f0000000000)='\x00', 0x0, 0x0, 0x400001000) tkill(r2, 0x20) 04:40:38 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f00000001c0)="0adc1f123c123f319bc0") clone(0x4000002102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) request_key(&(0x7f0000000240)='asymmetric\x00', &(0x7f0000001ffb)={'\x00@\x00'}, &(0x7f0000001fee)='R\trist\xe3cusgrVid:De', 0x0) 04:40:38 executing program 1: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$netlink(0x10, 0x3, 0x0) recvmmsg(r0, &(0x7f0000002d80), 0x400000000000368, 0x1a002, &(0x7f0000000180)={0x77359400}) sendmsg$nl_generic(r0, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000140)={0x14, 0x40000000042, 0x105}, 0x14}}, 0x0) 04:40:38 executing program 0: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x7, 0x31, 0xffffffffffffffff, 0x0) r0 = userfaultfd(0x0) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000c34000)) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f00000000c0)={{&(0x7f0000068000/0x800000)=nil, 0x800000}, 0x1}) ioctl$UFFDIO_ZEROPAGE(r0, 0xc020aa04, &(0x7f0000000080)={{&(0x7f0000291000/0x400000)=nil, 0x400000}}) 04:40:38 executing program 5: ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="0adc9f123c1237319bc070") r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f00000001c0)=[@acquire], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x4, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="0e630c40"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000dfd0)={0x10, 0x0, &(0x7f0000000100)=[@request_death], 0x0, 0x0, 0x0}) 04:40:38 executing program 2: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f00000001c0)="0adc1f123c123f319bc0") syz_emit_ethernet(0x2a, &(0x7f0000000000)={@random="0fdc2d1e8d38", @local, [], {@arp={0x806, @ether_ipv4={0x6, 0x800, 0x6, 0x4, 0x1, @random="f8bf88df5b1b", @remote={0xac, 0x223}, @dev, @rand_addr=0xac1414bb}}}}, 0x0) 04:40:38 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f00000001c0)="0adc1f123c123f319bc070") clone(0x0, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) request_key(&(0x7f0000000240)='asymmetric\x00', &(0x7f0000001ffb)={'\x00@\x00'}, &(0x7f0000001fee)='R\trist\xe3cusgrVid:De', 0x0) [ 175.882108] binder: 8531:8538 BC_REQUEST_DEATH_NOTIFICATION death notification already set 04:40:38 executing program 2: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f00000001c0)="0adc1f123c123f319bc0") syz_emit_ethernet(0x2a, &(0x7f0000000000)={@random="0fdc2d1e8d38", @local, [], {@arp={0x806, @ether_ipv4={0x6, 0x800, 0x6, 0x4, 0x1, @random="f8bf88df5b1b", @remote={0xac, 0x223}, @dev, @rand_addr=0xac1414bb}}}}, 0x0) 04:40:38 executing program 5: socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="0adc9f123c1237319bc070") r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f00000001c0)=[@acquire], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x4, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="0e630c40"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000dfd0)={0x10, 0x0, &(0x7f0000000100)=[@request_death], 0x0, 0x0, 0x0}) 04:40:38 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f00000001c0)="0adc1f123c123f319bc070") clone(0x0, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) request_key(&(0x7f0000000240)='asymmetric\x00', &(0x7f0000001ffb)={'\x00@\x00'}, &(0x7f0000001fee)='R\trist\xe3cusgrVid:De', 0x0) 04:40:38 executing program 1: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$netlink(0x10, 0x3, 0x0) recvmmsg(r0, &(0x7f0000002d80), 0x400000000000368, 0x1a002, &(0x7f0000000180)={0x77359400}) sendmsg$nl_generic(r0, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000140)={0x14, 0x40000000042, 0x105}, 0x14}}, 0x0) 04:40:38 executing program 2: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f00000001c0)="0adc1f123c123f319bc0") syz_emit_ethernet(0x2a, &(0x7f0000000000)={@random="0fdc2d1e8d38", @local, [], {@arp={0x806, @ether_ipv4={0x6, 0x800, 0x6, 0x4, 0x1, @random="f8bf88df5b1b", @remote={0xac, 0x223}, @dev, @rand_addr=0xac1414bb}}}}, 0x0) [ 176.163305] binder: 8566:8568 BC_REQUEST_DEATH_NOTIFICATION death notification already set 04:40:41 executing program 5: socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="0adc9f123c1237319bc070") r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f00000001c0)=[@acquire], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x4, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="0e630c40"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000dfd0)={0x10, 0x0, &(0x7f0000000100)=[@request_death], 0x0, 0x0, 0x0}) 04:40:41 executing program 0: r0 = socket$inet6(0x10, 0x3, 0x0) sendmsg(r0, &(0x7f0000002fc8)={0x0, 0x0, &(0x7f0000000140)=[{&(0x7f0000000000)="5500000018007f1412fe01b2a4a280930a06000000a84306910000000b000f00350200000600000f1900154006000001d40000dc1338d54400009b84136ef75afb83de44110016000d0003000000060cec4faba7d4", 0x55}], 0x1}, 0x0) 04:40:41 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f00000001c0)="0adc1f123c123f319bc070") clone(0x0, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) request_key(&(0x7f0000000240)='asymmetric\x00', &(0x7f0000001ffb)={'\x00@\x00'}, &(0x7f0000001fee)='R\trist\xe3cusgrVid:De', 0x0) 04:40:41 executing program 2: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f00000001c0)="0adc1f123c123f319bc070") syz_emit_ethernet(0x0, 0x0, 0x0) 04:40:41 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f00000001c0)="0adc1f123c123f319bc070") dup(0xffffffffffffffff) mkdir(0x0, 0x0) dup(0xffffffffffffff9c) r1 = memfd_create(&(0x7f0000000140)='proc}GPLeth0^wlan0#:\x00', 0x0) clone(0x3102001ffe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = gettid() socket$netlink(0x10, 0x3, 0xe) ptrace$setopts(0x4206, r2, 0x0, 0x0) execveat(r1, &(0x7f0000000000)='\x00', 0x0, 0x0, 0x400001000) tkill(r2, 0x20) 04:40:41 executing program 1: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$netlink(0x10, 0x3, 0x0) recvmmsg(r0, &(0x7f0000002d80), 0x400000000000368, 0x1a002, &(0x7f0000000180)={0x77359400}) sendmsg$nl_generic(r0, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000140)={0x14, 0x40000000042, 0x105}, 0x14}}, 0x0) 04:40:41 executing program 2: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f00000001c0)="0adc1f123c123f319bc070") syz_emit_ethernet(0x0, 0x0, 0x0) [ 178.976316] netlink: 'syz-executor.0': attribute type 15 has an invalid length. [ 178.977517] binder: 8588:8590 BC_REQUEST_DEATH_NOTIFICATION death notification already set [ 178.984854] netlink: 'syz-executor.0': attribute type 21 has an invalid length. [ 179.031338] netlink: 9 bytes leftover after parsing attributes in process `syz-executor.0'. 04:40:41 executing program 5: socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="0adc9f123c1237319bc070") r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f00000001c0)=[@acquire], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x4, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="0e630c40"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000dfd0)={0x10, 0x0, &(0x7f0000000100)=[@request_death], 0x0, 0x0, 0x0}) 04:40:41 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f00000001c0)="0adc1f123c123f319bc070") clone(0x4000002102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) request_key(0x0, &(0x7f0000001ffb)={'\x00@\x00'}, &(0x7f0000001fee)='R\trist\xe3cusgrVid:De', 0x0) 04:40:41 executing program 0: r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000080)='./cgroup\x00', 0x200002, 0x0) fchdir(r0) mkdir(&(0x7f0000001340)='./file0\x00', 0x0) r1 = open(&(0x7f0000000000)='./file0\x00', 0x0, 0x0) openat$cgroup_procs(r1, &(0x7f0000000200)='cgroup.procs\x00', 0x2, 0x0) openat$cgroup_procs(r1, &(0x7f0000000040)='cgroup.procs\x00', 0x2, 0x0) rmdir(&(0x7f0000000100)='./file0\x00') 04:40:41 executing program 2: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f00000001c0)="0adc1f123c123f319bc070") syz_emit_ethernet(0x0, 0x0, 0x0) 04:40:41 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f00000001c0)="0adc1f123c123f319bc070") clone(0x4000002102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) request_key(0x0, &(0x7f0000001ffb)={'\x00@\x00'}, &(0x7f0000001fee)='R\trist\xe3cusgrVid:De', 0x0) 04:40:41 executing program 2: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f00000001c0)="0adc1f123c123f319bc070") syz_emit_ethernet(0x2a, &(0x7f0000000000)={@random="0fdc2d1e8d38", @local, [], {@arp={0x806, @ether_ipv4={0x6, 0x800, 0x6, 0x4, 0x0, @random="f8bf88df5b1b", @remote={0xac, 0x223}, @dev, @rand_addr=0xac1414bb}}}}, 0x0) [ 179.224420] binder: 8610:8612 BC_REQUEST_DEATH_NOTIFICATION death notification already set 04:40:41 executing program 1: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$netlink(0x10, 0x3, 0x0) recvmmsg(r0, &(0x7f0000002d80), 0x400000000000368, 0x1a002, &(0x7f0000000180)={0x77359400}) ioctl$PIO_FONT(0xffffffffffffffff, 0x4b61, 0x0) 04:40:41 executing program 0: r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000080)='./cgroup\x00', 0x200002, 0x0) fchdir(r0) mkdir(&(0x7f0000001340)='./file0\x00', 0x0) r1 = open(&(0x7f0000000000)='./file0\x00', 0x0, 0x0) openat$cgroup_procs(r1, &(0x7f0000000200)='cgroup.procs\x00', 0x2, 0x0) openat$cgroup_procs(r1, &(0x7f0000000040)='cgroup.procs\x00', 0x2, 0x0) rmdir(&(0x7f0000000100)='./file0\x00') 04:40:41 executing program 2: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f00000001c0)="0adc1f123c123f319bc070") syz_emit_ethernet(0x2a, &(0x7f0000000000)={@random="0fdc2d1e8d38", @local, [], {@arp={0x806, @ether_ipv4={0x6, 0x800, 0x6, 0x4, 0x0, @random="f8bf88df5b1b", @remote={0xac, 0x223}, @dev, @rand_addr=0xac1414bb}}}}, 0x0) 04:40:44 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f00000001c0)="0adc1f123c123f319bc070") dup(0xffffffffffffffff) mkdir(0x0, 0x0) dup(0xffffffffffffff9c) r1 = memfd_create(&(0x7f0000000140)='proc}GPLeth0^wlan0#:\x00', 0x0) clone(0x3102001ffe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = gettid() socket$netlink(0x10, 0x3, 0xe) wait4(0x0, 0x0, 0x0, 0x0) execveat(r1, &(0x7f0000000000)='\x00', 0x0, 0x0, 0x400001000) tkill(r2, 0x20) 04:40:44 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x0, &(0x7f0000000040)="0adc9f123c1237319bc070") r1 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f00000001c0)=[@acquire], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000008fd0)={0x4, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="0e630c40"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f000000dfd0)={0x10, 0x0, &(0x7f0000000100)=[@request_death], 0x0, 0x0, 0x0}) 04:40:44 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f00000001c0)="0adc1f123c123f319bc070") clone(0x4000002102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) request_key(0x0, &(0x7f0000001ffb)={'\x00@\x00'}, &(0x7f0000001fee)='R\trist\xe3cusgrVid:De', 0x0) 04:40:44 executing program 2: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f00000001c0)="0adc1f123c123f319bc070") syz_emit_ethernet(0x2a, &(0x7f0000000000)={@random="0fdc2d1e8d38", @local, [], {@arp={0x806, @ether_ipv4={0x6, 0x800, 0x6, 0x4, 0x0, @random="f8bf88df5b1b", @remote={0xac, 0x223}, @dev, @rand_addr=0xac1414bb}}}}, 0x0) 04:40:44 executing program 0: r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000080)='./cgroup\x00', 0x200002, 0x0) fchdir(r0) mkdir(&(0x7f0000001340)='./file0\x00', 0x0) r1 = open(&(0x7f0000000000)='./file0\x00', 0x0, 0x0) openat$cgroup_procs(r1, &(0x7f0000000200)='cgroup.procs\x00', 0x2, 0x0) openat$cgroup_procs(r1, &(0x7f0000000040)='cgroup.procs\x00', 0x2, 0x0) rmdir(&(0x7f0000000100)='./file0\x00') 04:40:44 executing program 1: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$netlink(0x10, 0x3, 0x0) recvmmsg(r0, &(0x7f0000002d80), 0x400000000000368, 0x1a002, &(0x7f0000000180)={0x77359400}) ioctl$PIO_FONT(0xffffffffffffffff, 0x4b61, 0x0) 04:40:44 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f00000001c0)="0adc1f123c123f319bc070") clone(0x4000002102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) request_key(&(0x7f0000000240)='asymmetric\x00', 0x0, &(0x7f0000001fee)='R\trist\xe3cusgrVid:De', 0x0) [ 182.020020] binder: 8643:8644 BC_REQUEST_DEATH_NOTIFICATION death notification already set 04:40:44 executing program 2: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f00000001c0)="0adc1f123c123f319bc070") syz_emit_ethernet(0x2a, &(0x7f0000000000)={@random="0fdc2d1e8d38", @local, [], {@arp={0x806, @ether_ipv4={0x6, 0x800, 0x6, 0x4, 0x1, @random="f8bf88df5b1b", @remote={0xac, 0x223}, @dev}}}}, 0x0) 04:40:44 executing program 0: r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000080)='./cgroup\x00', 0x200002, 0x0) fchdir(r0) mkdir(&(0x7f0000001340)='./file0\x00', 0x0) r1 = open(&(0x7f0000000000)='./file0\x00', 0x0, 0x0) openat$cgroup_procs(r1, &(0x7f0000000200)='cgroup.procs\x00', 0x2, 0x0) openat$cgroup_procs(r1, &(0x7f0000000040)='cgroup.procs\x00', 0x2, 0x0) rmdir(&(0x7f0000000100)='./file0\x00') 04:40:44 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x0, &(0x7f0000000040)="0adc9f123c1237319bc070") r1 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f00000001c0)=[@acquire], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000008fd0)={0x4, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="0e630c40"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f000000dfd0)={0x10, 0x0, &(0x7f0000000100)=[@request_death], 0x0, 0x0, 0x0}) 04:40:44 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f00000001c0)="0adc1f123c123f319bc070") dup(0xffffffffffffffff) mkdir(0x0, 0x0) dup(0xffffffffffffff9c) r1 = memfd_create(&(0x7f0000000140)='proc}GPLeth0^wlan0#:\x00', 0x0) clone(0x3102001ffe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = gettid() socket$netlink(0x10, 0x3, 0xe) wait4(0x0, 0x0, 0x0, 0x0) execveat(r1, &(0x7f0000000000)='\x00', 0x0, 0x0, 0x400001000) tkill(r2, 0x20) 04:40:44 executing program 2: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f00000001c0)="0adc1f123c123f319bc070") syz_emit_ethernet(0x2a, &(0x7f0000000000)={@random="0fdc2d1e8d38", @local, [], {@arp={0x806, @ether_ipv4={0x6, 0x800, 0x6, 0x4, 0x1, @random="f8bf88df5b1b", @remote={0xac, 0x223}, @dev}}}}, 0x0) 04:40:44 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f00000001c0)="0adc1f123c123f319bc070") clone(0x4000002102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) request_key(&(0x7f0000000240)='asymmetric\x00', 0x0, &(0x7f0000001fee)='R\trist\xe3cusgrVid:De', 0x0) [ 182.258457] binder: 8674:8677 BC_REQUEST_DEATH_NOTIFICATION death notification already set 04:40:44 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f00000001c0)="0adc1f123c123f319bc070") dup(0xffffffffffffffff) mkdir(0x0, 0x0) dup(0xffffffffffffff9c) r1 = memfd_create(&(0x7f0000000140)='proc}GPLeth0^wlan0#:\x00', 0x0) clone(0x3102001ffe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = gettid() socket$netlink(0x10, 0x3, 0xe) wait4(0x0, 0x0, 0x0, 0x0) execveat(r1, &(0x7f0000000000)='\x00', 0x0, 0x0, 0x400001000) tkill(r2, 0x20) 04:40:44 executing program 0: r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000080)='./cgroup\x00', 0x200002, 0x0) fchdir(r0) mkdir(&(0x7f0000001340)='./file0\x00', 0x0) r1 = open(&(0x7f0000000000)='./file0\x00', 0x0, 0x0) openat$cgroup_procs(r1, &(0x7f0000000200)='cgroup.procs\x00', 0x2, 0x0) rmdir(&(0x7f0000000100)='./file0\x00') 04:40:44 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x0, &(0x7f0000000040)="0adc9f123c1237319bc070") r1 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f00000001c0)=[@acquire], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000008fd0)={0x4, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="0e630c40"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f000000dfd0)={0x10, 0x0, &(0x7f0000000100)=[@request_death], 0x0, 0x0, 0x0}) 04:40:44 executing program 2: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f00000001c0)="0adc1f123c123f319bc070") syz_emit_ethernet(0x2a, &(0x7f0000000000)={@random="0fdc2d1e8d38", @local, [], {@arp={0x806, @ether_ipv4={0x6, 0x800, 0x6, 0x4, 0x1, @random="f8bf88df5b1b", @remote={0xac, 0x223}, @dev}}}}, 0x0) [ 182.450486] binder: 8697:8698 BC_REQUEST_DEATH_NOTIFICATION death notification already set 04:40:45 executing program 1: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$netlink(0x10, 0x3, 0x0) recvmmsg(r0, &(0x7f0000002d80), 0x400000000000368, 0x1a002, &(0x7f0000000180)={0x77359400}) ioctl$PIO_FONT(0xffffffffffffffff, 0x4b61, 0x0) 04:40:45 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f00000001c0)="0adc1f123c123f319bc070") clone(0x4000002102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) request_key(&(0x7f0000000240)='asymmetric\x00', 0x0, &(0x7f0000001fee)='R\trist\xe3cusgrVid:De', 0x0) 04:40:45 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f00000001c0)="0adc1f123c123f319bc070") dup(0xffffffffffffffff) mkdir(0x0, 0x0) dup(0xffffffffffffff9c) r1 = memfd_create(&(0x7f0000000140)='proc}GPLeth0^wlan0#:\x00', 0x0) clone(0x3102001ffe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = gettid() ptrace$setopts(0x4206, r2, 0x0, 0x0) wait4(0x0, 0x0, 0x0, 0x0) execveat(r1, &(0x7f0000000000)='\x00', 0x0, 0x0, 0x400001000) tkill(r2, 0x20) 04:40:45 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, 0x0) r1 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f00000001c0)=[@acquire], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000008fd0)={0x4, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="0e630c40"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f000000dfd0)={0x10, 0x0, &(0x7f0000000100)=[@request_death], 0x0, 0x0, 0x0}) 04:40:45 executing program 0: r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000080)='./cgroup\x00', 0x200002, 0x0) fchdir(r0) mkdir(&(0x7f0000001340)='./file0\x00', 0x0) r1 = open(&(0x7f0000000000)='./file0\x00', 0x0, 0x0) openat$cgroup_procs(r1, &(0x7f0000000200)='cgroup.procs\x00', 0x2, 0x0) rmdir(&(0x7f0000000100)='./file0\x00') 04:40:45 executing program 2: r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000080)='./cgroup\x00', 0x200002, 0x0) fchdir(r0) mkdir(&(0x7f0000001340)='./file0\x00', 0x0) r1 = open(&(0x7f0000000000)='./file0\x00', 0x0, 0x0) r2 = openat$cgroup_procs(r1, &(0x7f0000000200)='cgroup.procs\x00', 0x2, 0x0) rmdir(&(0x7f00000000c0)='./file0\x00') dup2(r1, r2) 04:40:45 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f00000001c0)="0adc1f123c123f319bc070") dup(0xffffffffffffffff) mkdir(0x0, 0x0) dup(0xffffffffffffff9c) r1 = memfd_create(&(0x7f0000000140)='proc}GPLeth0^wlan0#:\x00', 0x0) clone(0x3102001ffe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = gettid() ptrace$setopts(0x4206, r2, 0x0, 0x0) wait4(0x0, 0x0, 0x0, 0x0) execveat(r1, &(0x7f0000000000)='\x00', 0x0, 0x0, 0x400001000) tkill(r2, 0x20) 04:40:45 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f00000001c0)="0adc1f123c123f319bc070") clone(0x4000002102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) request_key(&(0x7f0000000240)='asymmetric\x00', &(0x7f0000001ffb)={'\x00@\x00'}, 0x0, 0x0) [ 182.885153] binder: 8720:8722 BC_REQUEST_DEATH_NOTIFICATION death notification already set 04:40:45 executing program 2: r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000080)='./cgroup\x00', 0x200002, 0x0) fchdir(r0) mkdir(&(0x7f0000001340)='./file0\x00', 0x0) r1 = open(&(0x7f0000000000)='./file0\x00', 0x0, 0x0) r2 = openat$cgroup_procs(r1, &(0x7f0000000200)='cgroup.procs\x00', 0x2, 0x0) rmdir(&(0x7f00000000c0)='./file0\x00') dup2(r1, r2) 04:40:45 executing program 0: r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000080)='./cgroup\x00', 0x200002, 0x0) fchdir(r0) mkdir(&(0x7f0000001340)='./file0\x00', 0x0) r1 = open(&(0x7f0000000000)='./file0\x00', 0x0, 0x0) openat$cgroup_procs(r1, &(0x7f0000000200)='cgroup.procs\x00', 0x2, 0x0) rmdir(&(0x7f0000000100)='./file0\x00') 04:40:45 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, 0x0) r1 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f00000001c0)=[@acquire], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000008fd0)={0x4, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="0e630c40"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f000000dfd0)={0x10, 0x0, &(0x7f0000000100)=[@request_death], 0x0, 0x0, 0x0}) 04:40:45 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f00000001c0)="0adc1f123c123f319bc070") clone(0x4000002102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) request_key(&(0x7f0000000240)='asymmetric\x00', &(0x7f0000001ffb)={'\x00@\x00'}, 0x0, 0x0) [ 183.073475] binder: 8745:8748 BC_REQUEST_DEATH_NOTIFICATION death notification already set 04:40:46 executing program 1: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f0000002d80), 0x400000000000368, 0x1a002, &(0x7f0000000180)={0x77359400}) sendmsg$nl_generic(0xffffffffffffffff, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000140)={0x14, 0x40000000042, 0x105}, 0x14}}, 0x0) ioctl$PIO_FONT(0xffffffffffffffff, 0x4b61, 0x0) 04:40:46 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f00000001c0)="0adc1f123c123f319bc070") clone(0x4000002102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) request_key(&(0x7f0000000240)='asymmetric\x00', &(0x7f0000001ffb)={'\x00@\x00'}, 0x0, 0x0) 04:40:46 executing program 2: r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000080)='./cgroup\x00', 0x200002, 0x0) fchdir(r0) mkdir(&(0x7f0000001340)='./file0\x00', 0x0) r1 = open(&(0x7f0000000000)='./file0\x00', 0x0, 0x0) r2 = openat$cgroup_procs(r1, &(0x7f0000000200)='cgroup.procs\x00', 0x2, 0x0) rmdir(&(0x7f00000000c0)='./file0\x00') dup2(r1, r2) 04:40:46 executing program 0: r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000080)='./cgroup\x00', 0x200002, 0x0) fchdir(r0) mkdir(&(0x7f0000001340)='./file0\x00', 0x0) r1 = open(&(0x7f0000000000)='./file0\x00', 0x0, 0x0) openat$cgroup_procs(r1, &(0x7f0000000040)='cgroup.procs\x00', 0x2, 0x0) rmdir(&(0x7f0000000100)='./file0\x00') 04:40:46 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, 0x0) r1 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f00000001c0)=[@acquire], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000008fd0)={0x4, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="0e630c40"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f000000dfd0)={0x10, 0x0, &(0x7f0000000100)=[@request_death], 0x0, 0x0, 0x0}) 04:40:46 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f00000001c0)="0adc1f123c123f319bc070") dup(0xffffffffffffffff) mkdir(0x0, 0x0) dup(0xffffffffffffff9c) r1 = memfd_create(&(0x7f0000000140)='proc}GPLeth0^wlan0#:\x00', 0x0) clone(0x3102001ffe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = gettid() ptrace$setopts(0x4206, r2, 0x0, 0x0) wait4(0x0, 0x0, 0x0, 0x0) execveat(r1, &(0x7f0000000000)='\x00', 0x0, 0x0, 0x400001000) tkill(r2, 0x20) 04:40:46 executing program 4: mkdir(&(0x7f00000001c0)='./file0\x00', 0x0) mkdir(&(0x7f0000000880)='./file0/file1\x00', 0x0) mount(0x0, &(0x7f00000000c0)='./file0/file1\x00', &(0x7f00000002c0)='fusectl\x00', 0x0, 0x0) 04:40:46 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f00000001c0)="0adc1f123c123f319bc070") dup(0xffffffffffffffff) mkdir(0x0, 0x0) dup(0xffffffffffffff9c) r1 = memfd_create(&(0x7f0000000140)='proc}GPLeth0^wlan0#:\x00', 0x0) clone(0x3102001ffe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socket$netlink(0x10, 0x3, 0xe) ptrace$setopts(0x4206, 0x0, 0x0, 0x0) wait4(0x0, 0x0, 0x0, 0x0) execveat(r1, &(0x7f0000000000)='\x00', 0x0, 0x0, 0x400001000) tkill(0x0, 0x20) 04:40:46 executing program 0: r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000080)='./cgroup\x00', 0x200002, 0x0) fchdir(r0) mkdir(&(0x7f0000001340)='./file0\x00', 0x0) r1 = open(&(0x7f0000000000)='./file0\x00', 0x0, 0x0) openat$cgroup_procs(r1, &(0x7f0000000040)='cgroup.procs\x00', 0x2, 0x0) rmdir(&(0x7f0000000100)='./file0\x00') [ 183.798375] binder: 8770:8773 BC_REQUEST_DEATH_NOTIFICATION death notification already set 04:40:46 executing program 2: r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000080)='./cgroup\x00', 0x200002, 0x0) fchdir(r0) mkdir(&(0x7f0000001340)='./file0\x00', 0x0) r1 = open(&(0x7f0000000000)='./file0\x00', 0x0, 0x0) r2 = openat$cgroup_procs(r1, &(0x7f0000000200)='cgroup.procs\x00', 0x2, 0x0) rmdir(&(0x7f00000000c0)='./file0\x00') dup2(r1, r2) 04:40:46 executing program 1: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f0000002d80), 0x400000000000368, 0x1a002, &(0x7f0000000180)={0x77359400}) sendmsg$nl_generic(0xffffffffffffffff, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000140)={0x14, 0x40000000042, 0x105}, 0x14}}, 0x0) ioctl$PIO_FONT(0xffffffffffffffff, 0x4b61, 0x0) 04:40:46 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)) r1 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f00000001c0)=[@acquire], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000008fd0)={0x4, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="0e630c40"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f000000dfd0)={0x10, 0x0, &(0x7f0000000100)=[@request_death], 0x0, 0x0, 0x0}) 04:40:46 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f00000001c0)="0adc1f123c123f319bc070") dup(0xffffffffffffffff) mkdir(0x0, 0x0) dup(0xffffffffffffff9c) r1 = memfd_create(&(0x7f0000000140)='proc}GPLeth0^wlan0#:\x00', 0x0) clone(0x3102001ffe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socket$netlink(0x10, 0x3, 0xe) ptrace$setopts(0x4206, 0x0, 0x0, 0x0) wait4(0x0, 0x0, 0x0, 0x0) execveat(r1, &(0x7f0000000000)='\x00', 0x0, 0x0, 0x400001000) tkill(0x0, 0x20) 04:40:46 executing program 0: r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000080)='./cgroup\x00', 0x200002, 0x0) fchdir(r0) mkdir(&(0x7f0000001340)='./file0\x00', 0x0) r1 = open(&(0x7f0000000000)='./file0\x00', 0x0, 0x0) openat$cgroup_procs(r1, &(0x7f0000000040)='cgroup.procs\x00', 0x2, 0x0) rmdir(&(0x7f0000000100)='./file0\x00') 04:40:46 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f00000001c0)="0adc1f123c123f319bc070") dup(0xffffffffffffffff) mkdir(0x0, 0x0) dup(0xffffffffffffff9c) r1 = memfd_create(&(0x7f0000000140)='proc}GPLeth0^wlan0#:\x00', 0x0) clone(0x3102001ffe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socket$netlink(0x10, 0x3, 0xe) ptrace$setopts(0x4206, 0x0, 0x0, 0x0) wait4(0x0, 0x0, 0x0, 0x0) execveat(r1, &(0x7f0000000000)='\x00', 0x0, 0x0, 0x400001000) tkill(0x0, 0x20) 04:40:46 executing program 2: r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000080)='./cgroup\x00', 0x200002, 0x0) fchdir(r0) mkdir(&(0x7f0000001340)='./file0\x00', 0x0) r1 = open(&(0x7f0000000000)='./file0\x00', 0x0, 0x0) r2 = openat$cgroup_procs(r1, &(0x7f0000000200)='cgroup.procs\x00', 0x2, 0x0) dup2(r1, r2) [ 184.030334] binder: 8802:8803 BC_REQUEST_DEATH_NOTIFICATION death notification already set 04:40:46 executing program 1: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f0000002d80), 0x400000000000368, 0x1a002, &(0x7f0000000180)={0x77359400}) sendmsg$nl_generic(0xffffffffffffffff, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000140)={0x14, 0x40000000042, 0x105}, 0x14}}, 0x0) ioctl$PIO_FONT(0xffffffffffffffff, 0x4b61, 0x0) 04:40:46 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)) r1 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f00000001c0)=[@acquire], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000008fd0)={0x4, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="0e630c40"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f000000dfd0)={0x10, 0x0, &(0x7f0000000100)=[@request_death], 0x0, 0x0, 0x0}) 04:40:46 executing program 4: mkdir(&(0x7f00000001c0)='./file0\x00', 0x0) mkdir(&(0x7f0000000880)='./file0/file1\x00', 0x0) mount(0x0, &(0x7f00000000c0)='./file0/file1\x00', &(0x7f00000002c0)='fusectl\x00', 0x0, 0x0) 04:40:46 executing program 0: r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000080)='./cgroup\x00', 0x200002, 0x0) fchdir(r0) mkdir(&(0x7f0000001340)='./file0\x00', 0x0) openat$cgroup_procs(0xffffffffffffffff, &(0x7f0000000200)='cgroup.procs\x00', 0x2, 0x0) openat$cgroup_procs(0xffffffffffffffff, &(0x7f0000000040)='cgroup.procs\x00', 0x2, 0x0) rmdir(&(0x7f0000000100)='./file0\x00') 04:40:46 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x0) recvmmsg(r0, &(0x7f0000002d80), 0x400000000000368, 0x1a002, &(0x7f0000000180)={0x77359400}) sendmsg$nl_generic(r0, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000140)={0x14, 0x40000000042, 0x105}, 0x14}}, 0x0) ioctl$PIO_FONT(0xffffffffffffffff, 0x4b61, 0x0) [ 184.218417] binder: 8826:8827 BC_REQUEST_DEATH_NOTIFICATION death notification already set 04:40:46 executing program 2: r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000080)='./cgroup\x00', 0x200002, 0x0) fchdir(r0) mkdir(&(0x7f0000001340)='./file0\x00', 0x0) r1 = open(&(0x7f0000000000)='./file0\x00', 0x0, 0x0) r2 = openat$cgroup_procs(r1, &(0x7f0000000200)='cgroup.procs\x00', 0x2, 0x0) dup2(r1, r2) 04:40:46 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)) r1 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f00000001c0)=[@acquire], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000008fd0)={0x4, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="0e630c40"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f000000dfd0)={0x10, 0x0, &(0x7f0000000100)=[@request_death], 0x0, 0x0, 0x0}) 04:40:46 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f00000001c0)="0adc1f123c123f319bc070") dup(0xffffffffffffffff) mkdir(0x0, 0x0) dup(0xffffffffffffff9c) r1 = memfd_create(&(0x7f0000000140)='proc}GPLeth0^wlan0#:\x00', 0x0) r2 = gettid() socket$netlink(0x10, 0x3, 0xe) ptrace$setopts(0x4206, r2, 0x0, 0x0) wait4(0x0, 0x0, 0x0, 0x0) execveat(r1, &(0x7f0000000000)='\x00', 0x0, 0x0, 0x400001000) tkill(r2, 0x20) 04:40:46 executing program 4: mkdir(&(0x7f00000001c0)='./file0\x00', 0x0) mkdir(&(0x7f0000000880)='./file0/file1\x00', 0x0) mount(0x0, &(0x7f00000000c0)='./file0/file1\x00', &(0x7f00000002c0)='fusectl\x00', 0x0, 0x0) 04:40:46 executing program 2: r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000080)='./cgroup\x00', 0x200002, 0x0) fchdir(r0) mkdir(&(0x7f0000001340)='./file0\x00', 0x0) r1 = open(&(0x7f0000000000)='./file0\x00', 0x0, 0x0) r2 = openat$cgroup_procs(r1, &(0x7f0000000200)='cgroup.procs\x00', 0x2, 0x0) dup2(r1, r2) [ 184.401989] binder: 8842:8845 BC_REQUEST_DEATH_NOTIFICATION death notification already set 04:40:46 executing program 0: r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000080)='./cgroup\x00', 0x200002, 0x0) fchdir(r0) mkdir(&(0x7f0000001340)='./file0\x00', 0x0) openat$cgroup_procs(0xffffffffffffffff, &(0x7f0000000200)='cgroup.procs\x00', 0x2, 0x0) openat$cgroup_procs(0xffffffffffffffff, &(0x7f0000000040)='cgroup.procs\x00', 0x2, 0x0) rmdir(&(0x7f0000000100)='./file0\x00') 04:40:47 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc9f123c12") r1 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f00000001c0)=[@acquire], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000008fd0)={0x4, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="0e630c40"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f000000dfd0)={0x10, 0x0, &(0x7f0000000100)=[@request_death], 0x0, 0x0, 0x0}) 04:40:47 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x0) recvmmsg(r0, &(0x7f0000002d80), 0x400000000000368, 0x1a002, &(0x7f0000000180)={0x77359400}) sendmsg$nl_generic(r0, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000140)={0x14, 0x40000000042, 0x105}, 0x14}}, 0x0) ioctl$PIO_FONT(0xffffffffffffffff, 0x4b61, 0x0) 04:40:47 executing program 4: mkdir(&(0x7f00000001c0)='./file0\x00', 0x0) mkdir(&(0x7f0000000880)='./file0/file1\x00', 0x0) mount(0x0, &(0x7f00000000c0)='./file0/file1\x00', &(0x7f00000002c0)='fusectl\x00', 0x0, 0x0) 04:40:47 executing program 2: r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000080)='./cgroup\x00', 0x200002, 0x0) fchdir(r0) mkdir(&(0x7f0000001340)='./file0\x00', 0x0) r1 = open(&(0x7f0000000000)='./file0\x00', 0x0, 0x0) rmdir(&(0x7f00000000c0)='./file0\x00') dup2(r1, 0xffffffffffffffff) [ 184.648827] binder: 8869:8873 BC_REQUEST_DEATH_NOTIFICATION death notification already set 04:40:47 executing program 0: r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000080)='./cgroup\x00', 0x200002, 0x0) fchdir(r0) mkdir(&(0x7f0000001340)='./file0\x00', 0x0) openat$cgroup_procs(0xffffffffffffffff, &(0x7f0000000200)='cgroup.procs\x00', 0x2, 0x0) openat$cgroup_procs(0xffffffffffffffff, &(0x7f0000000040)='cgroup.procs\x00', 0x2, 0x0) rmdir(&(0x7f0000000100)='./file0\x00') 04:40:47 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f00000001c0)="0adc1f123c123f319bc070") dup(0xffffffffffffffff) mkdir(0x0, 0x0) dup(0xffffffffffffff9c) r1 = memfd_create(&(0x7f0000000140)='proc}GPLeth0^wlan0#:\x00', 0x0) r2 = gettid() socket$netlink(0x10, 0x3, 0xe) ptrace$setopts(0x4206, r2, 0x0, 0x0) wait4(0x0, 0x0, 0x0, 0x0) execveat(r1, &(0x7f0000000000)='\x00', 0x0, 0x0, 0x400001000) tkill(r2, 0x20) 04:40:47 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x0) recvmmsg(r0, &(0x7f0000002d80), 0x400000000000368, 0x1a002, &(0x7f0000000180)={0x77359400}) sendmsg$nl_generic(r0, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000140)={0x14, 0x40000000042, 0x105}, 0x14}}, 0x0) ioctl$PIO_FONT(0xffffffffffffffff, 0x4b61, 0x0) 04:40:47 executing program 2: r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000080)='./cgroup\x00', 0x200002, 0x0) fchdir(r0) mkdir(&(0x7f0000001340)='./file0\x00', 0x0) r1 = open(&(0x7f0000000000)='./file0\x00', 0x0, 0x0) rmdir(&(0x7f00000000c0)='./file0\x00') dup2(r1, 0xffffffffffffffff) 04:40:47 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc9f123c12") r1 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f00000001c0)=[@acquire], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000008fd0)={0x4, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="0e630c40"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f000000dfd0)={0x10, 0x0, &(0x7f0000000100)=[@request_death], 0x0, 0x0, 0x0}) 04:40:47 executing program 4: mkdir(&(0x7f00000001c0)='./file0\x00', 0x0) mount(0x0, &(0x7f00000000c0)='./file0/file1\x00', &(0x7f00000002c0)='fusectl\x00', 0x0, 0x0) 04:40:47 executing program 0: r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000080)='./cgroup\x00', 0x200002, 0x0) fchdir(r0) r1 = open(&(0x7f0000000000)='./file0\x00', 0x0, 0x0) openat$cgroup_procs(r1, &(0x7f0000000200)='cgroup.procs\x00', 0x2, 0x0) openat$cgroup_procs(r1, &(0x7f0000000040)='cgroup.procs\x00', 0x2, 0x0) rmdir(&(0x7f0000000100)='./file0\x00') [ 184.888619] binder: 8893:8896 BC_REQUEST_DEATH_NOTIFICATION death notification already set 04:40:47 executing program 2: r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000080)='./cgroup\x00', 0x200002, 0x0) fchdir(r0) mkdir(&(0x7f0000001340)='./file0\x00', 0x0) r1 = open(&(0x7f0000000000)='./file0\x00', 0x0, 0x0) rmdir(&(0x7f00000000c0)='./file0\x00') dup2(r1, 0xffffffffffffffff) 04:40:47 executing program 1: perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$netlink(0x10, 0x3, 0x0) recvmmsg(r0, &(0x7f0000002d80), 0x400000000000368, 0x1a002, &(0x7f0000000180)={0x77359400}) sendmsg$nl_generic(r0, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000140)={0x14, 0x40000000042, 0x105}, 0x14}}, 0x0) ioctl$PIO_FONT(0xffffffffffffffff, 0x4b61, 0x0) 04:40:47 executing program 4: mkdir(&(0x7f00000001c0)='./file0\x00', 0x0) mount(0x0, &(0x7f00000000c0)='./file0/file1\x00', &(0x7f00000002c0)='fusectl\x00', 0x0, 0x0) 04:40:47 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc9f123c12") r1 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f00000001c0)=[@acquire], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000008fd0)={0x4, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="0e630c40"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f000000dfd0)={0x10, 0x0, &(0x7f0000000100)=[@request_death], 0x0, 0x0, 0x0}) 04:40:47 executing program 2: r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000080)='./cgroup\x00', 0x200002, 0x0) fchdir(r0) mkdir(&(0x7f0000001340)='./file0\x00', 0x0) r1 = openat$cgroup_procs(0xffffffffffffffff, &(0x7f0000000200)='cgroup.procs\x00', 0x2, 0x0) rmdir(&(0x7f00000000c0)='./file0\x00') dup2(0xffffffffffffffff, r1) 04:40:47 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f00000001c0)="0adc1f123c123f319bc070") dup(0xffffffffffffffff) mkdir(0x0, 0x0) dup(0xffffffffffffff9c) r1 = memfd_create(&(0x7f0000000140)='proc}GPLeth0^wlan0#:\x00', 0x0) r2 = gettid() socket$netlink(0x10, 0x3, 0xe) ptrace$setopts(0x4206, r2, 0x0, 0x0) wait4(0x0, 0x0, 0x0, 0x0) execveat(r1, &(0x7f0000000000)='\x00', 0x0, 0x0, 0x400001000) tkill(r2, 0x20) 04:40:47 executing program 0: r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000080)='./cgroup\x00', 0x200002, 0x0) fchdir(r0) r1 = open(&(0x7f0000000000)='./file0\x00', 0x0, 0x0) openat$cgroup_procs(r1, &(0x7f0000000200)='cgroup.procs\x00', 0x2, 0x0) openat$cgroup_procs(r1, &(0x7f0000000040)='cgroup.procs\x00', 0x2, 0x0) rmdir(&(0x7f0000000100)='./file0\x00') [ 185.122392] binder: 8918:8922 BC_REQUEST_DEATH_NOTIFICATION death notification already set 04:40:47 executing program 1: perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$netlink(0x10, 0x3, 0x0) recvmmsg(r0, &(0x7f0000002d80), 0x400000000000368, 0x1a002, &(0x7f0000000180)={0x77359400}) sendmsg$nl_generic(r0, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000140)={0x14, 0x40000000042, 0x105}, 0x14}}, 0x0) ioctl$PIO_FONT(0xffffffffffffffff, 0x4b61, 0x0) 04:40:47 executing program 4: mkdir(&(0x7f00000001c0)='./file0\x00', 0x0) mount(0x0, &(0x7f00000000c0)='./file0/file1\x00', &(0x7f00000002c0)='fusectl\x00', 0x0, 0x0) 04:40:47 executing program 2: r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000080)='./cgroup\x00', 0x200002, 0x0) fchdir(r0) mkdir(&(0x7f0000001340)='./file0\x00', 0x0) r1 = openat$cgroup_procs(0xffffffffffffffff, &(0x7f0000000200)='cgroup.procs\x00', 0x2, 0x0) rmdir(&(0x7f00000000c0)='./file0\x00') dup2(0xffffffffffffffff, r1) 04:40:47 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc9f123c1237319b") r1 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f00000001c0)=[@acquire], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000008fd0)={0x4, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="0e630c40"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f000000dfd0)={0x10, 0x0, &(0x7f0000000100)=[@request_death], 0x0, 0x0, 0x0}) 04:40:47 executing program 0: r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000080)='./cgroup\x00', 0x200002, 0x0) fchdir(r0) r1 = open(&(0x7f0000000000)='./file0\x00', 0x0, 0x0) openat$cgroup_procs(r1, &(0x7f0000000200)='cgroup.procs\x00', 0x2, 0x0) openat$cgroup_procs(r1, &(0x7f0000000040)='cgroup.procs\x00', 0x2, 0x0) rmdir(&(0x7f0000000100)='./file0\x00') 04:40:47 executing program 4: mkdir(&(0x7f0000000880)='./file0/file1\x00', 0x0) mount(0x0, &(0x7f00000000c0)='./file0/file1\x00', &(0x7f00000002c0)='fusectl\x00', 0x0, 0x0) 04:40:47 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f00000001c0)="0adc1f123c123f319bc070") dup(0xffffffffffffffff) mkdir(0x0, 0x0) dup(0xffffffffffffff9c) clone(0x3102001ffe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = gettid() socket$netlink(0x10, 0x3, 0xe) ptrace$setopts(0x4206, r1, 0x0, 0x0) wait4(0x0, 0x0, 0x0, 0x0) execveat(0xffffffffffffffff, &(0x7f0000000000)='\x00', 0x0, 0x0, 0x400001000) tkill(r1, 0x20) [ 185.406054] binder: 8944:8951 BC_REQUEST_DEATH_NOTIFICATION death notification already set 04:40:47 executing program 0: openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000080)='./cgroup\x00', 0x200002, 0x0) mkdir(&(0x7f0000001340)='./file0\x00', 0x0) r0 = open(&(0x7f0000000000)='./file0\x00', 0x0, 0x0) openat$cgroup_procs(r0, &(0x7f0000000200)='cgroup.procs\x00', 0x2, 0x0) openat$cgroup_procs(r0, &(0x7f0000000040)='cgroup.procs\x00', 0x2, 0x0) rmdir(&(0x7f0000000100)='./file0\x00') 04:40:47 executing program 2: r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000080)='./cgroup\x00', 0x200002, 0x0) fchdir(r0) mkdir(&(0x7f0000001340)='./file0\x00', 0x0) r1 = openat$cgroup_procs(0xffffffffffffffff, &(0x7f0000000200)='cgroup.procs\x00', 0x2, 0x0) rmdir(&(0x7f00000000c0)='./file0\x00') dup2(0xffffffffffffffff, r1) 04:40:47 executing program 1: perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$netlink(0x10, 0x3, 0x0) recvmmsg(r0, &(0x7f0000002d80), 0x400000000000368, 0x1a002, &(0x7f0000000180)={0x77359400}) sendmsg$nl_generic(r0, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000140)={0x14, 0x40000000042, 0x105}, 0x14}}, 0x0) ioctl$PIO_FONT(0xffffffffffffffff, 0x4b61, 0x0) 04:40:48 executing program 4: mkdir(&(0x7f0000000880)='./file0/file1\x00', 0x0) mount(0x0, &(0x7f00000000c0)='./file0/file1\x00', &(0x7f00000002c0)='fusectl\x00', 0x0, 0x0) 04:40:48 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc9f123c1237319b") r1 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f00000001c0)=[@acquire], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000008fd0)={0x4, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="0e630c40"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f000000dfd0)={0x10, 0x0, &(0x7f0000000100)=[@request_death], 0x0, 0x0, 0x0}) 04:40:48 executing program 2: r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000080)='./cgroup\x00', 0x200002, 0x0) fchdir(r0) r1 = open(&(0x7f0000000000)='./file0\x00', 0x0, 0x0) r2 = openat$cgroup_procs(r1, &(0x7f0000000200)='cgroup.procs\x00', 0x2, 0x0) rmdir(&(0x7f00000000c0)='./file0\x00') dup2(r1, r2) 04:40:48 executing program 0: openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000080)='./cgroup\x00', 0x200002, 0x0) mkdir(&(0x7f0000001340)='./file0\x00', 0x0) r0 = open(&(0x7f0000000000)='./file0\x00', 0x0, 0x0) openat$cgroup_procs(r0, &(0x7f0000000200)='cgroup.procs\x00', 0x2, 0x0) openat$cgroup_procs(r0, &(0x7f0000000040)='cgroup.procs\x00', 0x2, 0x0) rmdir(&(0x7f0000000100)='./file0\x00') [ 185.629133] binder: 8972:8974 BC_REQUEST_DEATH_NOTIFICATION death notification already set 04:40:48 executing program 4: mkdir(&(0x7f0000000880)='./file0/file1\x00', 0x0) mount(0x0, &(0x7f00000000c0)='./file0/file1\x00', &(0x7f00000002c0)='fusectl\x00', 0x0, 0x0) 04:40:48 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc9f123c1237319b") r1 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f00000001c0)=[@acquire], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000008fd0)={0x4, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="0e630c40"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f000000dfd0)={0x10, 0x0, &(0x7f0000000100)=[@request_death], 0x0, 0x0, 0x0}) 04:40:48 executing program 1: perf_event_open(&(0x7f000001d000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$netlink(0x10, 0x3, 0x0) recvmmsg(r0, &(0x7f0000002d80), 0x400000000000368, 0x1a002, &(0x7f0000000180)={0x77359400}) sendmsg$nl_generic(r0, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000140)={0x14, 0x40000000042, 0x105}, 0x14}}, 0x0) ioctl$PIO_FONT(0xffffffffffffffff, 0x4b61, 0x0) 04:40:48 executing program 2: r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000080)='./cgroup\x00', 0x200002, 0x0) fchdir(r0) r1 = open(&(0x7f0000000000)='./file0\x00', 0x0, 0x0) r2 = openat$cgroup_procs(r1, &(0x7f0000000200)='cgroup.procs\x00', 0x2, 0x0) rmdir(&(0x7f00000000c0)='./file0\x00') dup2(r1, r2) [ 185.785317] binder: 8987:8988 BC_REQUEST_DEATH_NOTIFICATION death notification already set 04:40:50 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f00000001c0)="0adc1f123c123f319bc070") dup(0xffffffffffffffff) mkdir(0x0, 0x0) dup(0xffffffffffffff9c) clone(0x3102001ffe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = gettid() socket$netlink(0x10, 0x3, 0xe) ptrace$setopts(0x4206, r1, 0x0, 0x0) wait4(0x0, 0x0, 0x0, 0x0) execveat(0xffffffffffffffff, &(0x7f0000000000)='\x00', 0x0, 0x0, 0x400001000) tkill(r1, 0x20) 04:40:50 executing program 0: openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000080)='./cgroup\x00', 0x200002, 0x0) mkdir(&(0x7f0000001340)='./file0\x00', 0x0) r0 = open(&(0x7f0000000000)='./file0\x00', 0x0, 0x0) openat$cgroup_procs(r0, &(0x7f0000000200)='cgroup.procs\x00', 0x2, 0x0) openat$cgroup_procs(r0, &(0x7f0000000040)='cgroup.procs\x00', 0x2, 0x0) rmdir(&(0x7f0000000100)='./file0\x00') 04:40:50 executing program 4: mkdir(0x0, 0x0) mkdir(&(0x7f0000000880)='./file0/file1\x00', 0x0) mount(0x0, &(0x7f00000000c0)='./file0/file1\x00', &(0x7f00000002c0)='fusectl\x00', 0x0, 0x0) 04:40:50 executing program 2: r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000080)='./cgroup\x00', 0x200002, 0x0) fchdir(r0) r1 = open(&(0x7f0000000000)='./file0\x00', 0x0, 0x0) r2 = openat$cgroup_procs(r1, &(0x7f0000000200)='cgroup.procs\x00', 0x2, 0x0) rmdir(&(0x7f00000000c0)='./file0\x00') dup2(r1, r2) 04:40:50 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc9f123c1237319bc0") r1 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f00000001c0)=[@acquire], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000008fd0)={0x4, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="0e630c40"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f000000dfd0)={0x10, 0x0, &(0x7f0000000100)=[@request_death], 0x0, 0x0, 0x0}) 04:40:50 executing program 1: perf_event_open(&(0x7f000001d000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$netlink(0x10, 0x3, 0x0) recvmmsg(r0, &(0x7f0000002d80), 0x400000000000368, 0x1a002, &(0x7f0000000180)={0x77359400}) sendmsg$nl_generic(r0, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000140)={0x14, 0x40000000042, 0x105}, 0x14}}, 0x0) ioctl$PIO_FONT(0xffffffffffffffff, 0x4b61, 0x0) 04:40:50 executing program 2: openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000080)='./cgroup\x00', 0x200002, 0x0) mkdir(&(0x7f0000001340)='./file0\x00', 0x0) r0 = open(&(0x7f0000000000)='./file0\x00', 0x0, 0x0) r1 = openat$cgroup_procs(r0, &(0x7f0000000200)='cgroup.procs\x00', 0x2, 0x0) rmdir(&(0x7f00000000c0)='./file0\x00') dup2(r0, r1) [ 188.491142] binder: 9002:9008 BC_REQUEST_DEATH_NOTIFICATION death notification already set 04:40:51 executing program 4: mkdir(0x0, 0x0) mkdir(&(0x7f0000000880)='./file0/file1\x00', 0x0) mount(0x0, &(0x7f00000000c0)='./file0/file1\x00', &(0x7f00000002c0)='fusectl\x00', 0x0, 0x0) 04:40:51 executing program 0: fchdir(0xffffffffffffffff) mkdir(&(0x7f0000001340)='./file0\x00', 0x0) r0 = open(&(0x7f0000000000)='./file0\x00', 0x0, 0x0) openat$cgroup_procs(r0, &(0x7f0000000200)='cgroup.procs\x00', 0x2, 0x0) openat$cgroup_procs(r0, &(0x7f0000000040)='cgroup.procs\x00', 0x2, 0x0) rmdir(&(0x7f0000000100)='./file0\x00') 04:40:51 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc9f123c1237319bc0") r1 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f00000001c0)=[@acquire], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000008fd0)={0x4, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="0e630c40"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f000000dfd0)={0x10, 0x0, &(0x7f0000000100)=[@request_death], 0x0, 0x0, 0x0}) 04:40:51 executing program 1: perf_event_open(&(0x7f000001d000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$netlink(0x10, 0x3, 0x0) recvmmsg(r0, &(0x7f0000002d80), 0x400000000000368, 0x1a002, &(0x7f0000000180)={0x77359400}) sendmsg$nl_generic(r0, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000140)={0x14, 0x40000000042, 0x105}, 0x14}}, 0x0) ioctl$PIO_FONT(0xffffffffffffffff, 0x4b61, 0x0) 04:40:51 executing program 0: fchdir(0xffffffffffffffff) mkdir(&(0x7f0000001340)='./file0\x00', 0x0) r0 = open(&(0x7f0000000000)='./file0\x00', 0x0, 0x0) openat$cgroup_procs(r0, &(0x7f0000000200)='cgroup.procs\x00', 0x2, 0x0) openat$cgroup_procs(r0, &(0x7f0000000040)='cgroup.procs\x00', 0x2, 0x0) rmdir(&(0x7f0000000100)='./file0\x00') 04:40:53 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f00000001c0)="0adc1f123c123f319bc070") dup(0xffffffffffffffff) mkdir(0x0, 0x0) dup(0xffffffffffffff9c) clone(0x3102001ffe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = gettid() socket$netlink(0x10, 0x3, 0xe) ptrace$setopts(0x4206, r1, 0x0, 0x0) wait4(0x0, 0x0, 0x0, 0x0) execveat(0xffffffffffffffff, &(0x7f0000000000)='\x00', 0x0, 0x0, 0x400001000) tkill(r1, 0x20) 04:40:53 executing program 2: openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000080)='./cgroup\x00', 0x200002, 0x0) mkdir(&(0x7f0000001340)='./file0\x00', 0x0) r0 = open(&(0x7f0000000000)='./file0\x00', 0x0, 0x0) r1 = openat$cgroup_procs(r0, &(0x7f0000000200)='cgroup.procs\x00', 0x2, 0x0) rmdir(&(0x7f00000000c0)='./file0\x00') dup2(r0, r1) 04:40:53 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc9f123c1237319bc0") r1 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f00000001c0)=[@acquire], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000008fd0)={0x4, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="0e630c40"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f000000dfd0)={0x10, 0x0, &(0x7f0000000100)=[@request_death], 0x0, 0x0, 0x0}) 04:40:53 executing program 4: mkdir(0x0, 0x0) mkdir(&(0x7f0000000880)='./file0/file1\x00', 0x0) mount(0x0, &(0x7f00000000c0)='./file0/file1\x00', &(0x7f00000002c0)='fusectl\x00', 0x0, 0x0) 04:40:53 executing program 0: fchdir(0xffffffffffffffff) mkdir(&(0x7f0000001340)='./file0\x00', 0x0) r0 = open(&(0x7f0000000000)='./file0\x00', 0x0, 0x0) openat$cgroup_procs(r0, &(0x7f0000000200)='cgroup.procs\x00', 0x2, 0x0) openat$cgroup_procs(r0, &(0x7f0000000040)='cgroup.procs\x00', 0x2, 0x0) rmdir(&(0x7f0000000100)='./file0\x00') 04:40:53 executing program 1: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$netlink(0x10, 0x3, 0x0) recvmmsg(r0, &(0x7f0000002d80), 0x400000000000368, 0x1a002, &(0x7f0000000180)={0x77359400}) sendmsg$nl_generic(r0, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000140)={0x14, 0x40000000042, 0x105}, 0x14}}, 0x0) ioctl$PIO_FONT(0xffffffffffffffff, 0x4b61, 0x0) 04:40:54 executing program 4: mkdir(&(0x7f00000001c0)='./file0\x00', 0x0) mkdir(0x0, 0x0) mount(0x0, &(0x7f00000000c0)='./file0/file1\x00', &(0x7f00000002c0)='fusectl\x00', 0x0, 0x0) [ 191.533285] binder_thread_write: 1 callbacks suppressed [ 191.533293] binder: 9043:9047 BC_REQUEST_DEATH_NOTIFICATION death notification already set 04:40:54 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc9f123c1237319bc070") r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f00000001c0)=[@acquire], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000008fd0)={0x4, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="0e630c40"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f000000dfd0)={0x10, 0x0, &(0x7f0000000100)=[@request_death], 0x0, 0x0, 0x0}) 04:40:54 executing program 0: r0 = openat$cgroup_root(0xffffffffffffff9c, 0x0, 0x200002, 0x0) fchdir(r0) mkdir(&(0x7f0000001340)='./file0\x00', 0x0) r1 = open(&(0x7f0000000000)='./file0\x00', 0x0, 0x0) openat$cgroup_procs(r1, &(0x7f0000000200)='cgroup.procs\x00', 0x2, 0x0) openat$cgroup_procs(r1, &(0x7f0000000040)='cgroup.procs\x00', 0x2, 0x0) rmdir(&(0x7f0000000100)='./file0\x00') 04:40:54 executing program 2: openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000080)='./cgroup\x00', 0x200002, 0x0) mkdir(&(0x7f0000001340)='./file0\x00', 0x0) r0 = open(&(0x7f0000000000)='./file0\x00', 0x0, 0x0) r1 = openat$cgroup_procs(r0, &(0x7f0000000200)='cgroup.procs\x00', 0x2, 0x0) rmdir(&(0x7f00000000c0)='./file0\x00') dup2(r0, r1) 04:40:54 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f00000001c0)="0adc1f123c123f319bc070") dup(0xffffffffffffffff) mkdir(0x0, 0x0) r1 = memfd_create(&(0x7f0000000140)='proc}GPLeth0^wlan0#:\x00', 0x0) clone(0x3102001ffe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = gettid() socket$netlink(0x10, 0x3, 0xe) ptrace$setopts(0x4206, r2, 0x0, 0x0) wait4(0x0, 0x0, 0x0, 0x0) execveat(r1, &(0x7f0000000000)='\x00', 0x0, 0x0, 0x400001000) tkill(r2, 0x20) 04:40:54 executing program 1: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$netlink(0x10, 0x3, 0x0) recvmmsg(r0, &(0x7f0000002d80), 0x400000000000368, 0x1a002, &(0x7f0000000180)={0x77359400}) sendmsg$nl_generic(r0, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000140)={0x14, 0x40000000042, 0x105}, 0x14}}, 0x0) ioctl$PIO_FONT(0xffffffffffffffff, 0x4b61, 0x0) 04:40:54 executing program 2: fchdir(0xffffffffffffffff) mkdir(&(0x7f0000001340)='./file0\x00', 0x0) r0 = open(&(0x7f0000000000)='./file0\x00', 0x0, 0x0) r1 = openat$cgroup_procs(r0, &(0x7f0000000200)='cgroup.procs\x00', 0x2, 0x0) rmdir(&(0x7f00000000c0)='./file0\x00') dup2(r0, r1) 04:40:54 executing program 4: mkdir(&(0x7f00000001c0)='./file0\x00', 0x0) mkdir(0x0, 0x0) mount(0x0, &(0x7f00000000c0)='./file0/file1\x00', &(0x7f00000002c0)='fusectl\x00', 0x0, 0x0) 04:40:54 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc9f123c1237319bc070") r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f00000001c0)=[@acquire], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000008fd0)={0x4, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="0e630c40"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f000000dfd0)={0x10, 0x0, &(0x7f0000000100)=[@request_death], 0x0, 0x0, 0x0}) 04:40:54 executing program 0: r0 = openat$cgroup_root(0xffffffffffffff9c, 0x0, 0x200002, 0x0) fchdir(r0) mkdir(&(0x7f0000001340)='./file0\x00', 0x0) r1 = open(&(0x7f0000000000)='./file0\x00', 0x0, 0x0) openat$cgroup_procs(r1, &(0x7f0000000200)='cgroup.procs\x00', 0x2, 0x0) openat$cgroup_procs(r1, &(0x7f0000000040)='cgroup.procs\x00', 0x2, 0x0) rmdir(&(0x7f0000000100)='./file0\x00') 04:40:54 executing program 1: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$netlink(0x10, 0x3, 0x0) recvmmsg(r0, &(0x7f0000002d80), 0x400000000000368, 0x1a002, &(0x7f0000000180)={0x77359400}) sendmsg$nl_generic(r0, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000140)={0x14, 0x40000000042, 0x105}, 0x14}}, 0x0) ioctl$PIO_FONT(0xffffffffffffffff, 0x4b61, 0x0) 04:40:54 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc9f123c1237319bc070") r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f00000001c0)=[@acquire], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000008fd0)={0x4, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="0e630c40"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f000000dfd0)={0x10, 0x0, &(0x7f0000000100)=[@request_death], 0x0, 0x0, 0x0}) 04:40:54 executing program 4: mkdir(&(0x7f00000001c0)='./file0\x00', 0x0) mkdir(0x0, 0x0) mount(0x0, &(0x7f00000000c0)='./file0/file1\x00', &(0x7f00000002c0)='fusectl\x00', 0x0, 0x0) 04:40:54 executing program 2: fchdir(0xffffffffffffffff) mkdir(&(0x7f0000001340)='./file0\x00', 0x0) r0 = open(&(0x7f0000000000)='./file0\x00', 0x0, 0x0) r1 = openat$cgroup_procs(r0, &(0x7f0000000200)='cgroup.procs\x00', 0x2, 0x0) rmdir(&(0x7f00000000c0)='./file0\x00') dup2(r0, r1) 04:40:54 executing program 0: r0 = openat$cgroup_root(0xffffffffffffff9c, 0x0, 0x200002, 0x0) fchdir(r0) mkdir(&(0x7f0000001340)='./file0\x00', 0x0) r1 = open(&(0x7f0000000000)='./file0\x00', 0x0, 0x0) openat$cgroup_procs(r1, &(0x7f0000000200)='cgroup.procs\x00', 0x2, 0x0) openat$cgroup_procs(r1, &(0x7f0000000040)='cgroup.procs\x00', 0x2, 0x0) rmdir(&(0x7f0000000100)='./file0\x00') 04:40:54 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f00000001c0)="0adc1f123c123f319bc070") dup(0xffffffffffffffff) mkdir(0x0, 0x0) r1 = memfd_create(&(0x7f0000000140)='proc}GPLeth0^wlan0#:\x00', 0x0) clone(0x3102001ffe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = gettid() socket$netlink(0x10, 0x3, 0xe) ptrace$setopts(0x4206, r2, 0x0, 0x0) wait4(0x0, 0x0, 0x0, 0x0) execveat(r1, &(0x7f0000000000)='\x00', 0x0, 0x0, 0x400001000) tkill(r2, 0x20) 04:40:54 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc9f123c1237319bc070") syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f00000001c0)=[@acquire], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x4, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="0e630c40"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000dfd0)={0x10, 0x0, &(0x7f0000000100)=[@request_death], 0x0, 0x0, 0x0}) 04:40:54 executing program 4: mkdir(&(0x7f00000001c0)='./file0\x00', 0x0) mkdir(&(0x7f0000000880)='./file0/file1\x00', 0x0) mount(0x0, 0x0, &(0x7f00000002c0)='fusectl\x00', 0x0, 0x0) 04:40:54 executing program 1: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$netlink(0x10, 0x3, 0x0) recvmmsg(r0, &(0x7f0000002d80), 0x400000000000368, 0x1a002, &(0x7f0000000180)={0x77359400}) sendmsg$nl_generic(r0, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000140)={0x14, 0x40000000042, 0x105}, 0x14}}, 0x0) ioctl$PIO_FONT(0xffffffffffffffff, 0x4b61, 0x0) 04:40:54 executing program 2: fchdir(0xffffffffffffffff) mkdir(&(0x7f0000001340)='./file0\x00', 0x0) r0 = open(&(0x7f0000000000)='./file0\x00', 0x0, 0x0) r1 = openat$cgroup_procs(r0, &(0x7f0000000200)='cgroup.procs\x00', 0x2, 0x0) rmdir(&(0x7f00000000c0)='./file0\x00') dup2(r0, r1) 04:40:54 executing program 0: openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000080)='./cgroup\x00', 0x200002, 0x0) fchdir(0xffffffffffffffff) mkdir(&(0x7f0000001340)='./file0\x00', 0x0) r0 = open(&(0x7f0000000000)='./file0\x00', 0x0, 0x0) openat$cgroup_procs(r0, &(0x7f0000000200)='cgroup.procs\x00', 0x2, 0x0) openat$cgroup_procs(r0, &(0x7f0000000040)='cgroup.procs\x00', 0x2, 0x0) rmdir(&(0x7f0000000100)='./file0\x00') [ 192.229909] binder: 9115:9120 Acquire 1 refcount change on invalid ref 0 ret -22 04:40:54 executing program 4: mkdir(&(0x7f00000001c0)='./file0\x00', 0x0) mkdir(&(0x7f0000000880)='./file0/file1\x00', 0x0) mount(0x0, 0x0, &(0x7f00000002c0)='fusectl\x00', 0x0, 0x0) [ 192.288026] binder: 9115:9120 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 04:40:54 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc9f123c1237319bc070") syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f00000001c0)=[@acquire], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x4, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="0e630c40"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000dfd0)={0x10, 0x0, &(0x7f0000000100)=[@request_death], 0x0, 0x0, 0x0}) 04:40:54 executing program 2: r0 = openat$cgroup_root(0xffffffffffffff9c, 0x0, 0x200002, 0x0) fchdir(r0) mkdir(&(0x7f0000001340)='./file0\x00', 0x0) r1 = open(&(0x7f0000000000)='./file0\x00', 0x0, 0x0) r2 = openat$cgroup_procs(r1, &(0x7f0000000200)='cgroup.procs\x00', 0x2, 0x0) rmdir(&(0x7f00000000c0)='./file0\x00') dup2(r1, r2) [ 192.330283] binder: 9115:9120 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 04:40:54 executing program 0: openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000080)='./cgroup\x00', 0x200002, 0x0) fchdir(0xffffffffffffffff) mkdir(&(0x7f0000001340)='./file0\x00', 0x0) r0 = open(&(0x7f0000000000)='./file0\x00', 0x0, 0x0) openat$cgroup_procs(r0, &(0x7f0000000200)='cgroup.procs\x00', 0x2, 0x0) openat$cgroup_procs(r0, &(0x7f0000000040)='cgroup.procs\x00', 0x2, 0x0) rmdir(&(0x7f0000000100)='./file0\x00') 04:40:54 executing program 4: mkdir(&(0x7f00000001c0)='./file0\x00', 0x0) mkdir(&(0x7f0000000880)='./file0/file1\x00', 0x0) mount(0x0, 0x0, &(0x7f00000002c0)='fusectl\x00', 0x0, 0x0) 04:40:54 executing program 1: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$netlink(0x10, 0x3, 0x0) recvmmsg(r0, &(0x7f0000002d80), 0x400000000000368, 0x1a002, &(0x7f0000000180)={0x77359400}) sendmsg$nl_generic(r0, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000140)={0x14, 0x40000000042, 0x105}, 0x14}}, 0x0) ioctl$PIO_FONT(0xffffffffffffffff, 0x4b61, 0x0) [ 192.434050] binder: 9137:9139 Acquire 1 refcount change on invalid ref 0 ret -22 [ 192.503175] binder: 9137:9139 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 192.525326] binder: 9137:9139 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 04:40:57 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f00000001c0)="0adc1f123c123f319bc070") dup(0xffffffffffffffff) mkdir(0x0, 0x0) r1 = memfd_create(&(0x7f0000000140)='proc}GPLeth0^wlan0#:\x00', 0x0) clone(0x3102001ffe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = gettid() socket$netlink(0x10, 0x3, 0xe) ptrace$setopts(0x4206, r2, 0x0, 0x0) wait4(0x0, 0x0, 0x0, 0x0) execveat(r1, &(0x7f0000000000)='\x00', 0x0, 0x0, 0x400001000) tkill(r2, 0x20) 04:40:57 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc9f123c1237319bc070") syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f00000001c0)=[@acquire], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x4, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="0e630c40"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000dfd0)={0x10, 0x0, &(0x7f0000000100)=[@request_death], 0x0, 0x0, 0x0}) 04:40:57 executing program 2: r0 = openat$cgroup_root(0xffffffffffffff9c, 0x0, 0x200002, 0x0) fchdir(r0) mkdir(&(0x7f0000001340)='./file0\x00', 0x0) r1 = open(&(0x7f0000000000)='./file0\x00', 0x0, 0x0) r2 = openat$cgroup_procs(r1, &(0x7f0000000200)='cgroup.procs\x00', 0x2, 0x0) rmdir(&(0x7f00000000c0)='./file0\x00') dup2(r1, r2) 04:40:57 executing program 4: mkdir(&(0x7f00000001c0)='./file0\x00', 0x0) mkdir(&(0x7f0000000880)='./file0/file1\x00', 0x0) mount(0x0, &(0x7f00000000c0)='./file0/file1\x00', 0x0, 0x0, 0x0) 04:40:57 executing program 0: openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000080)='./cgroup\x00', 0x200002, 0x0) fchdir(0xffffffffffffffff) mkdir(&(0x7f0000001340)='./file0\x00', 0x0) r0 = open(&(0x7f0000000000)='./file0\x00', 0x0, 0x0) openat$cgroup_procs(r0, &(0x7f0000000200)='cgroup.procs\x00', 0x2, 0x0) openat$cgroup_procs(r0, &(0x7f0000000040)='cgroup.procs\x00', 0x2, 0x0) rmdir(&(0x7f0000000100)='./file0\x00') 04:40:57 executing program 1: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$netlink(0x10, 0x3, 0x0) recvmmsg(r0, &(0x7f0000002d80), 0x400000000000368, 0x1a002, &(0x7f0000000180)={0x77359400}) sendmsg$nl_generic(r0, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000140)={0x14, 0x40000000042, 0x105}, 0x14}}, 0x0) ioctl$PIO_FONT(0xffffffffffffffff, 0x4b61, 0x0) 04:40:57 executing program 2: r0 = openat$cgroup_root(0xffffffffffffff9c, 0x0, 0x200002, 0x0) fchdir(r0) mkdir(&(0x7f0000001340)='./file0\x00', 0x0) r1 = open(&(0x7f0000000000)='./file0\x00', 0x0, 0x0) r2 = openat$cgroup_procs(r1, &(0x7f0000000200)='cgroup.procs\x00', 0x2, 0x0) rmdir(&(0x7f00000000c0)='./file0\x00') dup2(r1, r2) 04:40:57 executing program 4: mkdir(&(0x7f00000001c0)='./file0\x00', 0x0) mkdir(&(0x7f0000000880)='./file0/file1\x00', 0x0) mount(0x0, &(0x7f00000000c0)='./file0/file1\x00', 0x0, 0x0, 0x0) [ 195.148618] binder: 9159:9162 Acquire 1 refcount change on invalid ref 0 ret -22 [ 195.177242] binder: 9159:9162 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 04:40:57 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc9f123c1237319bc070") r1 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f00000001c0)=[@acquire], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000008fd0)={0x4, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="0e630c40"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f000000dfd0)={0x10, 0x0, &(0x7f0000000100)=[@request_death], 0x0, 0x0, 0x0}) 04:40:57 executing program 0: r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000080)='./cgroup\x00', 0x200002, 0x0) fchdir(r0) mkdir(0x0, 0x0) r1 = open(&(0x7f0000000000)='./file0\x00', 0x0, 0x0) openat$cgroup_procs(r1, &(0x7f0000000200)='cgroup.procs\x00', 0x2, 0x0) openat$cgroup_procs(r1, &(0x7f0000000040)='cgroup.procs\x00', 0x2, 0x0) rmdir(&(0x7f0000000100)='./file0\x00') [ 195.220353] binder: 9159:9162 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 04:40:57 executing program 4: mkdir(&(0x7f00000001c0)='./file0\x00', 0x0) mkdir(&(0x7f0000000880)='./file0/file1\x00', 0x0) mount(0x0, &(0x7f00000000c0)='./file0/file1\x00', 0x0, 0x0, 0x0) 04:40:57 executing program 1: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$netlink(0x10, 0x3, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f0000002d80), 0x400000000000368, 0x1a002, &(0x7f0000000180)={0x77359400}) sendmsg$nl_generic(r0, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000140)={0x14, 0x40000000042, 0x105}, 0x14}}, 0x0) ioctl$PIO_FONT(0xffffffffffffffff, 0x4b61, 0x0) [ 195.343080] binder: 9185:9186 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 195.363911] binder: 9185:9186 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 04:41:00 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f00000001c0)="0adc1f123c123f319bc070") dup(0xffffffffffffffff) dup(0xffffffffffffff9c) r1 = memfd_create(&(0x7f0000000140)='proc}GPLeth0^wlan0#:\x00', 0x0) clone(0x3102001ffe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = gettid() socket$netlink(0x10, 0x3, 0xe) ptrace$setopts(0x4206, r2, 0x0, 0x0) wait4(0x0, 0x0, 0x0, 0x0) execveat(r1, &(0x7f0000000000)='\x00', 0x0, 0x0, 0x400001000) tkill(r2, 0x20) 04:41:00 executing program 2: openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000080)='./cgroup\x00', 0x200002, 0x0) fchdir(0xffffffffffffffff) mkdir(&(0x7f0000001340)='./file0\x00', 0x0) r0 = open(&(0x7f0000000000)='./file0\x00', 0x0, 0x0) r1 = openat$cgroup_procs(r0, &(0x7f0000000200)='cgroup.procs\x00', 0x2, 0x0) rmdir(&(0x7f00000000c0)='./file0\x00') dup2(r0, r1) 04:41:00 executing program 0: r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000080)='./cgroup\x00', 0x200002, 0x0) fchdir(r0) mkdir(0x0, 0x0) r1 = open(&(0x7f0000000000)='./file0\x00', 0x0, 0x0) openat$cgroup_procs(r1, &(0x7f0000000200)='cgroup.procs\x00', 0x2, 0x0) openat$cgroup_procs(r1, &(0x7f0000000040)='cgroup.procs\x00', 0x2, 0x0) rmdir(&(0x7f0000000100)='./file0\x00') 04:41:00 executing program 4: socket$inet(0x2, 0x3, 0x0) sched_setaffinity(0x0, 0xffffffffffffff26, &(0x7f0000000140)=0x1) perf_event_open(&(0x7f000001d000)={0x2, 0x70, 0x41, 0x8001, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$TIOCGPGRP(0xffffffffffffff9c, 0x540f, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000500)='net/packet\x00') sendmsg(0xffffffffffffffff, &(0x7f0000002fc8)={0x0, 0x0, &(0x7f0000000540)}, 0x0) preadv(r0, &(0x7f00000017c0), 0x1fe, 0x400000000000) openat$kvm(0xffffffffffffff9c, 0x0, 0x0, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_emit_ethernet(0x30b, &(0x7f0000000000)={@local, @dev, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x1, 0x0, @rand_addr, @multicast1}, @icmp=@address_reply={0x8}}}}}, 0x0) 04:41:00 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc9f123c1237319bc070") r1 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f00000001c0)=[@acquire], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000008fd0)={0x4, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="0e630c40"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f000000dfd0)={0x10, 0x0, &(0x7f0000000100)=[@request_death], 0x0, 0x0, 0x0}) 04:41:00 executing program 1: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$netlink(0x10, 0x3, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f0000002d80), 0x400000000000368, 0x1a002, &(0x7f0000000180)={0x77359400}) sendmsg$nl_generic(r0, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000140)={0x14, 0x40000000042, 0x105}, 0x14}}, 0x0) ioctl$PIO_FONT(0xffffffffffffffff, 0x4b61, 0x0) 04:41:00 executing program 0: r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000080)='./cgroup\x00', 0x200002, 0x0) fchdir(r0) mkdir(0x0, 0x0) r1 = open(&(0x7f0000000000)='./file0\x00', 0x0, 0x0) openat$cgroup_procs(r1, &(0x7f0000000200)='cgroup.procs\x00', 0x2, 0x0) openat$cgroup_procs(r1, &(0x7f0000000040)='cgroup.procs\x00', 0x2, 0x0) rmdir(&(0x7f0000000100)='./file0\x00') [ 198.212700] binder: 9205:9206 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 198.244508] binder: 9205:9206 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 04:41:00 executing program 2: openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000080)='./cgroup\x00', 0x200002, 0x0) fchdir(0xffffffffffffffff) mkdir(&(0x7f0000001340)='./file0\x00', 0x0) r0 = open(&(0x7f0000000000)='./file0\x00', 0x0, 0x0) r1 = openat$cgroup_procs(r0, &(0x7f0000000200)='cgroup.procs\x00', 0x2, 0x0) rmdir(&(0x7f00000000c0)='./file0\x00') dup2(r0, r1) 04:41:00 executing program 1: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$netlink(0x10, 0x3, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f0000002d80), 0x400000000000368, 0x1a002, &(0x7f0000000180)={0x77359400}) sendmsg$nl_generic(r0, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000140)={0x14, 0x40000000042, 0x105}, 0x14}}, 0x0) ioctl$PIO_FONT(0xffffffffffffffff, 0x4b61, 0x0) 04:41:00 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc9f123c1237319bc070") r1 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f00000001c0)=[@acquire], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000008fd0)={0x4, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="0e630c40"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f000000dfd0)={0x10, 0x0, &(0x7f0000000100)=[@request_death], 0x0, 0x0, 0x0}) 04:41:00 executing program 0: r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000080)='./cgroup\x00', 0x200002, 0x0) fchdir(r0) mkdir(&(0x7f0000001340)='./file0\x00', 0x0) r1 = open(0x0, 0x0, 0x0) openat$cgroup_procs(r1, &(0x7f0000000200)='cgroup.procs\x00', 0x2, 0x0) openat$cgroup_procs(r1, &(0x7f0000000040)='cgroup.procs\x00', 0x2, 0x0) rmdir(&(0x7f0000000100)='./file0\x00') 04:41:00 executing program 2: openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000080)='./cgroup\x00', 0x200002, 0x0) fchdir(0xffffffffffffffff) mkdir(&(0x7f0000001340)='./file0\x00', 0x0) r0 = open(&(0x7f0000000000)='./file0\x00', 0x0, 0x0) r1 = openat$cgroup_procs(r0, &(0x7f0000000200)='cgroup.procs\x00', 0x2, 0x0) rmdir(&(0x7f00000000c0)='./file0\x00') dup2(r0, r1) [ 198.409658] cgroup: fork rejected by pids controller in /syz4 [ 198.431630] binder: 9231:9232 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 198.488488] binder: 9231:9266 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 04:41:03 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f00000001c0)="0adc1f123c123f319bc070") dup(0xffffffffffffffff) dup(0xffffffffffffff9c) r1 = memfd_create(&(0x7f0000000140)='proc}GPLeth0^wlan0#:\x00', 0x0) clone(0x3102001ffe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = gettid() socket$netlink(0x10, 0x3, 0xe) ptrace$setopts(0x4206, r2, 0x0, 0x0) wait4(0x0, 0x0, 0x0, 0x0) execveat(r1, &(0x7f0000000000)='\x00', 0x0, 0x0, 0x400001000) tkill(r2, 0x20) 04:41:03 executing program 1: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$netlink(0x10, 0x3, 0x0) recvmmsg(r0, 0x0, 0x0, 0x1a002, &(0x7f0000000180)={0x77359400}) sendmsg$nl_generic(r0, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000140)={0x14, 0x40000000042, 0x105}, 0x14}}, 0x0) ioctl$PIO_FONT(0xffffffffffffffff, 0x4b61, 0x0) 04:41:03 executing program 0: r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000080)='./cgroup\x00', 0x200002, 0x0) fchdir(r0) mkdir(&(0x7f0000001340)='./file0\x00', 0x0) r1 = open(0x0, 0x0, 0x0) openat$cgroup_procs(r1, &(0x7f0000000200)='cgroup.procs\x00', 0x2, 0x0) openat$cgroup_procs(r1, &(0x7f0000000040)='cgroup.procs\x00', 0x2, 0x0) rmdir(&(0x7f0000000100)='./file0\x00') 04:41:03 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc9f123c1237319bc070") r1 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000008fd0)={0x4, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="0e630c40"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f000000dfd0)={0x10, 0x0, &(0x7f0000000100)=[@request_death], 0x0, 0x0, 0x0}) 04:41:03 executing program 2: r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000080)='./cgroup\x00', 0x200002, 0x0) fchdir(r0) mkdir(0x0, 0x0) r1 = open(&(0x7f0000000000)='./file0\x00', 0x0, 0x0) r2 = openat$cgroup_procs(r1, &(0x7f0000000200)='cgroup.procs\x00', 0x2, 0x0) rmdir(&(0x7f00000000c0)='./file0\x00') dup2(r1, r2) 04:41:03 executing program 4: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f00000001c0)="0adc1f123c123f319bc070") sendmsg$nl_netfilter(r0, &(0x7f0000dddfc8)={0x0, 0x0, &(0x7f00008a7000)={&(0x7f0000000100)=ANY=[@ANYBLOB="2c00000004080501ff0080fffdff01010ab0b1000c00030011000010870a00010c0002000002fa17711104a6"], 0x2c}}, 0x0) [ 201.241885] audit: type=1400 audit(1555044063.691:42): avc: denied { create } for pid=9350 comm="syz-executor.4" scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=netlink_netfilter_socket permissive=1 [ 201.272816] binder: 9352:9359 ioctl c0306201 0 returned -14 04:41:03 executing program 1: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$netlink(0x10, 0x3, 0x0) recvmmsg(r0, 0x0, 0x0, 0x1a002, &(0x7f0000000180)={0x77359400}) sendmsg$nl_generic(r0, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000140)={0x14, 0x40000000042, 0x105}, 0x14}}, 0x0) ioctl$PIO_FONT(0xffffffffffffffff, 0x4b61, 0x0) 04:41:03 executing program 0: r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000080)='./cgroup\x00', 0x200002, 0x0) fchdir(r0) mkdir(&(0x7f0000001340)='./file0\x00', 0x0) r1 = open(0x0, 0x0, 0x0) openat$cgroup_procs(r1, &(0x7f0000000200)='cgroup.procs\x00', 0x2, 0x0) openat$cgroup_procs(r1, &(0x7f0000000040)='cgroup.procs\x00', 0x2, 0x0) rmdir(&(0x7f0000000100)='./file0\x00') 04:41:03 executing program 2: r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000080)='./cgroup\x00', 0x200002, 0x0) fchdir(r0) mkdir(0x0, 0x0) r1 = open(&(0x7f0000000000)='./file0\x00', 0x0, 0x0) r2 = openat$cgroup_procs(r1, &(0x7f0000000200)='cgroup.procs\x00', 0x2, 0x0) rmdir(&(0x7f00000000c0)='./file0\x00') dup2(r1, r2) [ 201.288375] netlink: 'syz-executor.4': attribute type 3 has an invalid length. [ 201.309294] binder: 9352:9359 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 201.331599] netlink: 'syz-executor.4': attribute type 2 has an invalid length. [ 201.348024] binder: 9352:9359 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 201.355095] audit: type=1400 audit(1555044063.741:43): avc: denied { write } for pid=9350 comm="syz-executor.4" scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=netlink_netfilter_socket permissive=1 [ 201.390694] kasan: CONFIG_KASAN_INLINE enabled [ 201.410314] kasan: GPF could be caused by NULL-ptr deref or user memory access [ 201.425342] general protection fault: 0000 [#1] PREEMPT SMP KASAN [ 201.431784] CPU: 1 PID: 9358 Comm: syz-executor.4 Not tainted 4.19.34 #2 [ 201.436222] kobject: 'loop1' (00000000350576ea): fill_kobj_path: path = '/devices/virtual/block/loop1' [ 201.438733] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 04:41:03 executing program 2: r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000080)='./cgroup\x00', 0x200002, 0x0) fchdir(r0) mkdir(0x0, 0x0) r1 = open(&(0x7f0000000000)='./file0\x00', 0x0, 0x0) r2 = openat$cgroup_procs(r1, &(0x7f0000000200)='cgroup.procs\x00', 0x2, 0x0) rmdir(&(0x7f00000000c0)='./file0\x00') dup2(r1, r2) 04:41:03 executing program 2: r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000080)='./cgroup\x00', 0x200002, 0x0) fchdir(r0) mkdir(&(0x7f0000001340)='./file0\x00', 0x0) r1 = open(0x0, 0x0, 0x0) r2 = openat$cgroup_procs(r1, &(0x7f0000000200)='cgroup.procs\x00', 0x2, 0x0) rmdir(&(0x7f00000000c0)='./file0\x00') dup2(r1, r2) [ 201.438758] RIP: 0010:udp_timeout_obj_to_nlattr+0x77/0x1a0 [ 201.438774] Code: 96 85 c7 00 f1 f1 f1 f1 c7 40 04 04 f3 f3 f3 65 48 8b 04 25 28 00 00 00 48 89 45 d0 31 c0 e8 30 9a d4 fb 48 89 d8 48 c1 e8 03 <42> 0f b6 14 38 48 89 d8 83 e0 07 83 c0 03 38 d0 7c 08 84 d2 0f 85 [ 201.438787] RSP: 0018:ffff8880631273d0 EFLAGS: 00010246 [ 201.466306] kobject: 'loop2' (00000000385db077): kobject_uevent_env [ 201.483040] RAX: 0000000000000000 RBX: 0000000000000000 RCX: ffffc9000e6b3000 [ 201.483047] RDX: 000000000001d79e RSI: ffffffff85969d10 RDI: ffff8880969ad440 [ 201.483055] RBP: ffff888063127460 R08: ffff8880631a4100 R09: ffff888062d76328 [ 201.483063] R10: ffffed100c5aec64 R11: ffff888062d76320 R12: 1ffff1100c624e7b [ 201.483070] R13: ffff8880969ad440 R14: ffff888063127438 R15: dffffc0000000000 [ 201.483079] FS: 00007f61e2813700(0000) GS:ffff8880ae900000(0000) knlGS:0000000000000000 [ 201.483086] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 201.483094] CR2: 0000001b2c521000 CR3: 00000000941b0000 CR4: 00000000001406e0 [ 201.483104] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 04:41:04 executing program 2: r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000080)='./cgroup\x00', 0x200002, 0x0) fchdir(r0) mkdir(&(0x7f0000001340)='./file0\x00', 0x0) r1 = open(0x0, 0x0, 0x0) r2 = openat$cgroup_procs(r1, &(0x7f0000000200)='cgroup.procs\x00', 0x2, 0x0) rmdir(&(0x7f00000000c0)='./file0\x00') dup2(r1, r2) [ 201.483117] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 201.513282] kobject: 'loop2' (00000000385db077): fill_kobj_path: path = '/devices/virtual/block/loop2' [ 201.517399] Call Trace: [ 201.517419] ? memcpy+0x46/0x50 [ 201.517433] ? udp_timeout_nlattr_to_obj+0x240/0x240 [ 201.517447] ? __nla_put+0x37/0x40 [ 201.517458] ? nla_put+0x116/0x150 [ 201.517473] cttimeout_default_get+0x69a/0xa80 [ 201.517488] ? cttimeout_del_timeout+0x1a0/0x1a0 [ 201.517507] ? __lock_is_held+0x81/0x140 [ 201.550582] kobject: 'loop2' (00000000385db077): kobject_uevent_env [ 201.553998] ? cttimeout_del_timeout+0x1a0/0x1a0 [ 201.554012] nfnetlink_rcv_msg+0xd12/0xfe0 [ 201.554028] ? nfnetlink_bind+0x2d0/0x2d0 [ 201.612986] kobject: 'loop2' (00000000385db077): fill_kobj_path: path = '/devices/virtual/block/loop2' [ 201.616209] ? avc_has_extended_perms+0x10f0/0x10f0 [ 201.616226] ? __dev_queue_xmit+0x1764/0x3020 [ 201.616243] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 201.616254] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 201.616268] ? cred_has_capability+0x193/0x320 [ 201.616282] ? selinux_ipv4_output+0x50/0x50 [ 201.616299] ? __sanitizer_cov_trace_cmp1+0x3/0x20 [ 201.616315] netlink_rcv_skb+0x180/0x460 [ 201.616328] ? nfnetlink_bind+0x2d0/0x2d0 [ 201.616342] ? netlink_ack+0xb60/0xb60 [ 201.616354] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 201.616369] ? ns_capable+0x23/0x30 [ 201.616386] ? __netlink_ns_capable+0x104/0x140 [ 201.633153] kobject: 'loop1' (00000000350576ea): kobject_uevent_env [ 201.639565] nfnetlink_rcv+0x1c0/0x460 [ 201.639578] ? nfnetlink_rcv_batch+0x1770/0x1770 [ 201.639590] ? netlink_deliver_tap+0x254/0xc20 [ 201.639606] netlink_unicast+0x53c/0x720 [ 201.639621] ? netlink_attachskb+0x770/0x770 [ 201.639637] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 201.639654] netlink_sendmsg+0x8ae/0xd70 [ 201.648505] kobject: 'loop1' (00000000350576ea): fill_kobj_path: path = '/devices/virtual/block/loop1' [ 201.649275] ? netlink_unicast+0x720/0x720 [ 201.649295] ? selinux_socket_sendmsg+0x36/0x40 [ 201.763323] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 201.769167] ? security_socket_sendmsg+0x93/0xc0 [ 201.774097] ? netlink_unicast+0x720/0x720 [ 201.778426] sock_sendmsg+0xdd/0x130 [ 201.782347] ___sys_sendmsg+0x806/0x930 [ 201.786590] ? copy_msghdr_from_user+0x430/0x430 [ 201.791529] ? lock_downgrade+0x810/0x810 [ 201.796386] ? kasan_check_read+0x11/0x20 [ 201.800815] ? __fget+0x367/0x540 [ 201.804443] ? iterate_fd+0x360/0x360 [ 201.808239] ? lock_downgrade+0x810/0x810 [ 201.812386] ? __fget_light+0x1a9/0x230 [ 201.816356] ? __fdget+0x1b/0x20 [ 201.819804] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 201.825435] __sys_sendmsg+0x105/0x1d0 [ 201.829414] ? __ia32_sys_shutdown+0x80/0x80 [ 201.834042] ? trace_hardirqs_on_thunk+0x1a/0x1c [ 201.838941] ? do_syscall_64+0x26/0x610 [ 201.842915] ? entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 201.848296] ? do_syscall_64+0x26/0x610 [ 201.852399] __x64_sys_sendmsg+0x78/0xb0 [ 201.856460] do_syscall_64+0x103/0x610 [ 201.860444] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 201.865680] RIP: 0033:0x458c29 [ 201.868991] Code: ad b8 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 7b b8 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 201.887995] RSP: 002b:00007f61e2812c78 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 201.895920] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000000458c29 [ 201.903315] RDX: 0000000000000000 RSI: 0000000020dddfc8 RDI: 0000000000000003 [ 201.910778] RBP: 000000000073bf00 R08: 0000000000000000 R09: 0000000000000000 [ 201.918042] R10: 0000000000000000 R11: 0000000000000246 R12: 00007f61e28136d4 [ 201.925316] R13: 00000000004c632a R14: 00000000004da8e8 R15: 00000000ffffffff [ 201.932594] Modules linked in: [ 201.938326] kobject: 'loop0' (0000000096e59e37): kobject_uevent_env [ 201.941600] ---[ end trace 700a99cec32aad68 ]--- [ 201.949835] RIP: 0010:udp_timeout_obj_to_nlattr+0x77/0x1a0 [ 201.951654] kobject: 'loop0' (0000000096e59e37): fill_kobj_path: path = '/devices/virtual/block/loop0' [ 201.955591] Code: 96 85 c7 00 f1 f1 f1 f1 c7 40 04 04 f3 f3 f3 65 48 8b 04 25 28 00 00 00 48 89 45 d0 31 c0 e8 30 9a d4 fb 48 89 d8 48 c1 e8 03 <42> 0f b6 14 38 48 89 d8 83 e0 07 83 c0 03 38 d0 7c 08 84 d2 0f 85 [ 201.955599] RSP: 0018:ffff8880631273d0 EFLAGS: 00010246 [ 201.972904] kobject: 'loop5' (00000000374bab7d): kobject_uevent_env [ 201.986337] RAX: 0000000000000000 RBX: 0000000000000000 RCX: ffffc9000e6b3000 [ 202.000134] kobject: 'loop5' (00000000374bab7d): fill_kobj_path: path = '/devices/virtual/block/loop5' [ 202.003822] RDX: 000000000001d79e RSI: ffffffff85969d10 RDI: ffff8880969ad440 [ 202.020968] RBP: ffff888063127460 R08: ffff8880631a4100 R09: ffff888062d76328 [ 202.028348] R10: ffffed100c5aec64 R11: ffff888062d76320 R12: 1ffff1100c624e7b [ 202.035938] R13: ffff8880969ad440 R14: ffff888063127438 R15: dffffc0000000000 [ 202.043467] FS: 00007f61e2813700(0000) GS:ffff8880ae900000(0000) knlGS:0000000000000000 [ 202.052018] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 202.058089] CR2: 0000000000625208 CR3: 00000000941b0000 CR4: 00000000001406e0 [ 202.065602] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 202.073152] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 202.080805] Kernel panic - not syncing: Fatal exception [ 202.087787] Kernel Offset: disabled [ 202.091543] Rebooting in 86400 seconds..