Warning: Permanently added '10.128.0.40' (ECDSA) to the list of known hosts. 2019/04/02 14:06:55 fuzzer started 2019/04/02 14:07:00 dialing manager at 10.128.0.26:33717 2019/04/02 14:07:00 syscalls: 1294 2019/04/02 14:07:00 code coverage: enabled 2019/04/02 14:07:00 comparison tracing: CONFIG_KCOV_ENABLE_COMPARISONS is not enabled 2019/04/02 14:07:00 extra coverage: extra coverage is not supported by the kernel 2019/04/02 14:07:00 setuid sandbox: enabled 2019/04/02 14:07:00 namespace sandbox: enabled 2019/04/02 14:07:00 Android sandbox: /sys/fs/selinux/policy does not exist 2019/04/02 14:07:00 fault injection: kernel does not have systematic fault injection support 2019/04/02 14:07:00 leak checking: CONFIG_DEBUG_KMEMLEAK is not enabled 2019/04/02 14:07:00 net packet injection: enabled 2019/04/02 14:07:00 net device setup: enabled 14:07:50 executing program 5: mlock(&(0x7f0000a00000/0x600000)=nil, 0x600000) mprotect(&(0x7f00007eb000/0x600000)=nil, 0x600000, 0x0) mprotect(&(0x7f0000a00000/0x600000)=nil, 0x600000, 0x0) 14:07:50 executing program 0: open(&(0x7f00000000c0)='./file0\x00', 0x80000000000206, 0x0) mlockall(0x2) r0 = open$dir(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) setrlimit(0x6, &(0x7f0000000000)) mmap(&(0x7f0000fee000/0x12000)=nil, 0x800000, 0x0, 0x12, r0, 0x0) 14:07:50 executing program 1: open(&(0x7f0000000480)='./file0\x00', 0x80000000000202, 0x0) truncate(&(0x7f0000000040)='./file0\x00', 0xca86) truncate(&(0x7f00000001c0)='./file0\x00', 0x800800805ffff) 14:07:50 executing program 4: getegid() 14:07:50 executing program 2: socket(0x0, 0x0, 0x0) nanosleep(&(0x7f0000000000)={0x0, 0x8000006}, 0x0) execve(&(0x7f0000000080)='./file0\x00', &(0x7f0000000100)=[&(0x7f00000000c0)='^\x00'], &(0x7f0000000300)=[&(0x7f0000000180)='}\x00', &(0x7f00000001c0)='\x00', &(0x7f0000000200)='.\x00', &(0x7f0000000240)='-/\x00', &(0x7f0000000280)='&\x00', &(0x7f00000002c0)='\x00']) 14:07:50 executing program 3: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = dup2(r0, r0) getsockopt$bt_hci(r1, 0x0, 0x0, 0x0, &(0x7f0000000180)) 14:07:51 executing program 5: clone(0x84007bf8, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = getpid() mknod(&(0x7f0000000000)='./file0\x00', 0x800000000001042, 0x0) execve(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) ptrace(0x10, r0) r1 = creat(&(0x7f0000000200)='./file0\x00', 0x0) ioctl$KDGETLED(r1, 0x4b31, 0x0) ptrace(0x11, r0) 14:07:51 executing program 2: clone(0x2102001ffd, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x13, &(0x7f0000000040)=0x100000001, 0x4) clone(0x4001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) connect$inet6(r0, &(0x7f0000000080), 0x1c) r1 = dup2(r0, r0) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r1, 0x6, 0x16, &(0x7f0000000440), 0xfdf2) read(r0, &(0x7f0000000200)=""/158, 0x9e) connect$inet6(r0, 0x0, 0x0) 14:07:51 executing program 0: creat(&(0x7f0000000440)='./file0\x00', 0x0) setxattr$security_smack_transmute(&(0x7f0000000480)='./file0\x00', &(0x7f00000004c0)='security.SMACK64TRANSMUTE\x00', 0x0, 0x0, 0x0) 14:07:51 executing program 4: mknod(0x0, 0x0, 0x0) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ptmx\x00', 0x0, 0x0) read(r0, &(0x7f0000000480)=""/11, 0x369) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000200)) r1 = creat(&(0x7f0000000140)='\xe9\x1fq\x89Y\x1e\x923aK\x00', 0x909) r2 = dup2(r0, r1) execve(&(0x7f00000000c0)='\xe9\x1fq\x89Y\x1e\x923aK\x00', 0x0, 0x0) clone(0x3102001ff2, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) execve(&(0x7f0000000080)='\xe9\x1fq\x89Y\x1e\x923aK\x00', 0x0, 0x0) ioctl$FS_IOC_RESVSP(r2, 0x40305828, 0x0) 14:07:51 executing program 2: r0 = socket$packet(0x11, 0x3, 0x300) sendmmsg(r0, &(0x7f0000004500)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0) 14:07:51 executing program 0: r0 = syz_open_dev$evdev(&(0x7f0000000400)='/dev/input/event#\x00', 0x4, 0x0) read$eventfd(r0, 0x0, 0x0) 14:07:51 executing program 1: r0 = gettid() r1 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000040)='attr/exec\x00') socketpair$unix(0x1, 0x5, 0x0, &(0x7f000000d000)={0xffffffffffffffff, 0xffffffffffffffff}) clone(0x7fd, 0x0, 0xfffffffffffffffe, 0xfffffffffffffffe, 0xffffffffffffffff) ioctl$int_in(r2, 0x5452, &(0x7f0000008ff8)=0x3f) recvfrom$unix(r3, 0x0, 0x0, 0x0, 0x0, 0x0) fcntl$setown(r2, 0x8, r0) fcntl$setsig(r2, 0xa, 0x12) getrandom(&(0x7f0000000000)=""/50, 0x32, 0x2) dup2(r1, r3) tkill(r0, 0x80000000000016) 14:07:51 executing program 1: socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = fcntl$dupfd(r0, 0x0, r0) sendmsg$TIPC_NL_BEARER_ENABLE(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) 14:07:51 executing program 0: pipe2(&(0x7f0000000000)={0xffffffffffffffff}, 0x0) fgetxattr(r0, 0xfffffffffffffffd, 0x0, 0x0) 14:07:51 executing program 5: socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = fcntl$dupfd(r0, 0x0, r0) sendmsg$TEAM_CMD_OPTIONS_GET(r1, &(0x7f0000000740)={&(0x7f00000000c0), 0xc, &(0x7f0000000700)}, 0x0) 14:07:51 executing program 2: socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = fcntl$dupfd(r0, 0x0, r0) sendmsg$TEAM_CMD_OPTIONS_GET(r1, &(0x7f00000101c0)={&(0x7f0000000040), 0xc, 0x0, 0x1, 0x0, 0x0, 0x80}, 0x40000) 14:07:51 executing program 3: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = dup2(r0, r0) ioctl$sock_inet_tcp_SIOCOUTQ(r1, 0x5411, &(0x7f0000000140)) 14:07:51 executing program 1: clone(0x2102001ffd, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x13, &(0x7f0000000040)=0x100000001, 0x4) clone(0x4001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) connect$inet6(r0, &(0x7f0000000080), 0x1c) r1 = dup2(r0, r0) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r1, 0x6, 0x16, &(0x7f0000000440), 0xfdf2) read(r0, &(0x7f0000000200)=""/158, 0x9e) setsockopt$inet6_IPV6_PKTINFO(r0, 0x29, 0x32, 0x0, 0x0) 14:07:51 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000080)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) 14:07:51 executing program 0: r0 = socket$unix(0x1, 0x2, 0x0) ioctl$sock_SIOCGIFBR(0xffffffffffffffff, 0x8940, 0x0) listen(r0, 0x0) 14:07:51 executing program 4: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) clone(0x208, 0x0, 0x0, 0x0, 0x0) symlink(&(0x7f0000000100)='./file1\x00', &(0x7f0000000040)='./file1\x00') mknod(&(0x7f0000f80000)='./file0\x00', 0x1040, 0x0) execve(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r1 = creat(&(0x7f0000000200)='\xe9\x1fq\x89Y\x1e\x923aK\x00', 0x109) r2 = dup2(r0, r1) execve(&(0x7f00000002c0)='\xe9\x1fq\x89Y\x1e\x923aK\x00', 0x0, 0x0) open$dir(&(0x7f00000000c0)='./file0\x00', 0x841, 0x0) clone(0x3102001ffd, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) execve(&(0x7f0000000000)='./file1\x00', 0x0, 0x0) sendmmsg(r2, &(0x7f0000005b00)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0) 14:07:51 executing program 5: r0 = openat$zero(0xffffffffffffff9c, &(0x7f0000000040)='/dev/zero\x00', 0x0, 0x0) fsetxattr$security_evm(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0) openat(r0, &(0x7f0000000080)='./file0\x00', 0x0, 0x0) 14:07:51 executing program 1: clone(0xf93efc, 0x0, 0x0, 0x0, 0x0) 14:07:51 executing program 3: r0 = socket(0x1, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(0xffffffffffffffff, 0x6, 0x1d, 0x0, 0x0) ioctl$sock_inet6_tcp_SIOCINQ(r0, 0x541b, 0x0) 14:07:51 executing program 0: r0 = socket$inet(0x2, 0x3, 0x81) sendmmsg(r0, &(0x7f00000038c0)=[{{&(0x7f0000000040)=@nl=@unspec, 0x80, 0x0}}, {{0x0, 0x0, 0x0}}], 0x2, 0x0) 14:07:51 executing program 1: r0 = syz_open_dev$sndtimer(&(0x7f0000000000)='/dev/snd/timer\x00', 0x0, 0x0) ioctl$SNDRV_TIMER_IOCTL_SELECT(r0, 0x40345410, &(0x7f0000000040)={{0x3}}) ioctl$SNDRV_TIMER_IOCTL_PARAMS(r0, 0x40505412, &(0x7f00000015c0)) syzkaller login: [ 91.856349] binder: 2377:2381 transaction failed 29189/-22, size 0-0 line 3014 14:07:51 executing program 5: open(&(0x7f0000000000)='.\x00', 0x0, 0x0) getpgid(0x0) clone(0x802102001ffe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x38) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x3}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x9, r0, 0x0, 0x0) 14:07:51 executing program 3: write$P9_RSTATFS(0xffffffffffffffff, &(0x7f0000000040)={0x43, 0x9, 0x0, {0x0, 0x0, 0x40, 0x0, 0x0, 0x0, 0x0, 0x93f}}, 0x43) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000240)='net/ptype\x00') sendmsg(0xffffffffffffffff, &(0x7f0000002fc8)={0x0, 0x0, 0x0, 0x0, &(0x7f00000002c0)=ANY=[]}, 0x0) preadv(r0, &(0x7f00000017c0), 0x1fe, 0x400000000000) 14:07:51 executing program 2: socketpair$unix(0x1, 0x5, 0x0, &(0x7f000001a000)={0xffffffffffffffff, 0xffffffffffffffff}) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) setsockopt$SO_ATTACH_FILTER(r0, 0x1, 0x1a, &(0x7f0000000140)={0x1, &(0x7f0000000000)=[{0x6}]}, 0x10) 14:07:51 executing program 0: r0 = creat(&(0x7f00000000c0)='./file0\x00', 0x0) write$cgroup_type(r0, &(0x7f00000009c0)='threaded\x00', 0xf0daec) sched_setattr(0x0, &(0x7f0000000100)={0x0, 0x6, 0x0, 0x0, 0x0, 0x9917, 0xffff}, 0x0) write$P9_RGETLOCK(r0, &(0x7f0000000080)={0x24, 0x37, 0x0, {0x0, 0x0, 0x0, 0x0, 0x6, 'bdev^]'}}, 0x24) [ 91.948903] binder: undelivered TRANSACTION_ERROR: 29189 14:07:51 executing program 3: write$P9_RSTATFS(0xffffffffffffffff, &(0x7f0000000040)={0x43, 0x9, 0x0, {0x0, 0x0, 0x40, 0x0, 0x0, 0x0, 0x0, 0x93f}}, 0x43) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000240)='net/ptype\x00') sendmsg(0xffffffffffffffff, &(0x7f0000002fc8)={0x0, 0x0, 0x0, 0x0, &(0x7f00000002c0)=ANY=[]}, 0x0) preadv(r0, &(0x7f00000017c0), 0x1fe, 0x400000000000) 14:07:51 executing program 5: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) recvmsg(r0, &(0x7f0000000440)={0x0, 0x0, 0x0}, 0x2002) 14:07:52 executing program 4: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) clone(0x208, 0x0, 0x0, 0x0, 0x0) symlink(&(0x7f0000000100)='./file1\x00', &(0x7f0000000040)='./file1\x00') mknod(&(0x7f0000f80000)='./file0\x00', 0x1040, 0x0) execve(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r1 = creat(&(0x7f0000000200)='\xe9\x1fq\x89Y\x1e\x923aK\x00', 0x109) r2 = dup2(r0, r1) execve(&(0x7f00000002c0)='\xe9\x1fq\x89Y\x1e\x923aK\x00', 0x0, 0x0) open$dir(&(0x7f00000000c0)='./file0\x00', 0x841, 0x0) clone(0x3102001ffd, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) execve(&(0x7f0000000000)='./file1\x00', 0x0, 0x0) sendmmsg(r2, &(0x7f0000005b00)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0) 14:07:52 executing program 2: mount(&(0x7f0000000000)=@nbd={'/dev/nbd'}, 0x0, &(0x7f0000000080)='fusectl\x00', 0x0, 0x0) 14:07:52 executing program 1: r0 = creat(&(0x7f0000000240)='./bus\x00', 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) write$nbd(r0, 0x0, 0x0) 14:07:52 executing program 3: r0 = creat(&(0x7f0000000080)='./file1\x00', 0x0) ioctl$EXT4_IOC_SETFLAGS(0xffffffffffffffff, 0x40086602, 0x0) write$P9_RSTATu(r0, &(0x7f0000000040)=ANY=[], 0x445144e9) 14:07:52 executing program 2: fsetxattr$trusted_overlay_nlink(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0) fsetxattr$trusted_overlay_nlink(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0) r0 = creat(&(0x7f0000000340)='./file0\x00', 0x0) mkdirat$cgroup(0xffffffffffffffff, 0x0, 0x1ff) ioctl$int_in(0xffffffffffffffff, 0x0, 0x0) prctl$PR_SET_TIMERSLACK(0x1d, 0x0) write$eventfd(r0, 0x0, 0x0) 14:07:52 executing program 1: r0 = perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) recvmsg(0xffffffffffffffff, &(0x7f00000006c0)={&(0x7f0000000180)=@hci, 0x80, &(0x7f0000000580)=[{&(0x7f00000002c0)=""/134, 0x86}, {0x0}, {&(0x7f0000000440)=""/169, 0xa9}, {&(0x7f0000000500)=""/79, 0x4f}], 0x4, &(0x7f0000000600)=""/176, 0xb0}, 0x2002) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x20000, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x2400, 0xb2) ioctl$TUNDETACHFILTER(r1, 0x401054d6, 0x0) r2 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000200)='memory.stat\x00', 0x0, 0x0) ioctl$TUNSETSNDBUF(r2, 0x400454d4, &(0x7f00000002c0)=0x64) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) ioctl$PERF_EVENT_IOC_PAUSE_OUTPUT(r3, 0x40086602, 0x400007) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) write$cgroup_subtree(r4, &(0x7f0000000000)=ANY=[], 0x20032600) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a0f, 0x1700) recvmsg(0xffffffffffffffff, &(0x7f0000001780)={0x0, 0x0, 0x0}, 0x0) sendmsg(0xffffffffffffffff, &(0x7f0000000280)={&(0x7f0000000000)=@in6={0xa, 0x0, 0x0, @mcast1={0xff, 0x1302}}, 0x80, 0x0}, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8907, 0x70a000) 14:07:52 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x1, 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB='\x00'], 0x0, 0x0, 0x0}) 14:07:52 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$BINDER_GET_NODE_DEBUG_INFO(0xffffffffffffffff, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x1c, 0x0, &(0x7f0000000100)=[@clear_death, @free_buffer], 0x0, 0x0, &(0x7f0000000140)}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) 14:07:52 executing program 1: clone(0x2102001ffe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socket(0x0, 0x0, 0x0) r0 = getpid() rt_tgsigqueueinfo(r0, r0, 0x16, &(0x7f0000000100)) rt_sigqueueinfo(r0, 0x23, &(0x7f0000000000)={0x0, 0x0, 0xffffffff8f0b5fc2}) 14:07:52 executing program 2: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000180)="0acc1f123c123f3188b070") r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$SO_TIMESTAMPING(r1, 0x1, 0x25, &(0x7f0000000340)=0x1950, 0x4) bind$inet6(r1, &(0x7f0000000080)={0xa, 0x4e22}, 0x1c) sendto$inet6(r1, 0x0, 0x0, 0x200408d4, &(0x7f0000000380)={0xa, 0x4e22, 0x0, @loopback}, 0x1c) sendto$inet6(r1, &(0x7f0000000000)="cc", 0x1, 0x0, 0x0, 0x0) [ 92.277854] binder: 2458:2459 unknown command 0 [ 92.291533] binder: 2458:2459 ioctl c0306201 20007000 returned -22 [ 92.301795] binder: 2460:2462 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 [ 92.319902] binder: 2460:2462 BC_FREE_BUFFER u0000000000000000 no match 14:07:52 executing program 0: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000140)={'sy\x17\xe9\x96\x1b\x00\x00r1\x00\x00\x00\x00\r\x00', 0x1}) ioctl$TUNSETSNDBUF(r0, 0x400454d4, &(0x7f0000000080)=0x3) 14:07:52 executing program 5: 14:07:52 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ptmx\x00', 0x3d, 0x0) ioctl$TCSETSW(0xffffffffffffffff, 0x5403, 0x0) write$binfmt_aout(r0, &(0x7f00000000c0)=ANY=[], 0xffffff78) 14:07:52 executing program 1: 14:07:52 executing program 3: 14:07:52 executing program 4: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) clone(0x208, 0x0, 0x0, 0x0, 0x0) symlink(&(0x7f0000000100)='./file1\x00', &(0x7f0000000040)='./file1\x00') mknod(&(0x7f0000f80000)='./file0\x00', 0x1040, 0x0) execve(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r1 = creat(&(0x7f0000000200)='\xe9\x1fq\x89Y\x1e\x923aK\x00', 0x109) r2 = dup2(r0, r1) execve(&(0x7f00000002c0)='\xe9\x1fq\x89Y\x1e\x923aK\x00', 0x0, 0x0) open$dir(&(0x7f00000000c0)='./file0\x00', 0x841, 0x0) clone(0x3102001ffd, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) execve(&(0x7f0000000000)='./file1\x00', 0x0, 0x0) sendmmsg(r2, &(0x7f0000005b00)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0) 14:07:52 executing program 0: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000140)={'sy\x17\xe9\x96\x1b\x00\x00r1\x00\x00\x00\x00\r\x00', 0x1}) ioctl$TUNSETSNDBUF(r0, 0x400454d4, &(0x7f0000000080)=0x3) 14:07:52 executing program 1: 14:07:52 executing program 5: 14:07:52 executing program 1: 14:07:52 executing program 3: 14:07:52 executing program 3: 14:07:52 executing program 1: 14:07:52 executing program 0: 14:07:53 executing program 2: 14:07:53 executing program 3: 14:07:53 executing program 0: 14:07:53 executing program 5: 14:07:53 executing program 1: 14:07:53 executing program 4: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) clone(0x208, 0x0, 0x0, 0x0, 0x0) symlink(&(0x7f0000000100)='./file1\x00', &(0x7f0000000040)='./file1\x00') mknod(&(0x7f0000f80000)='./file0\x00', 0x1040, 0x0) execve(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r1 = creat(&(0x7f0000000200)='\xe9\x1fq\x89Y\x1e\x923aK\x00', 0x109) r2 = dup2(r0, r1) execve(&(0x7f00000002c0)='\xe9\x1fq\x89Y\x1e\x923aK\x00', 0x0, 0x0) open$dir(&(0x7f00000000c0)='./file0\x00', 0x841, 0x0) clone(0x3102001ffd, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) execve(&(0x7f0000000000)='./file1\x00', 0x0, 0x0) sendmmsg(r2, &(0x7f0000005b00)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0) 14:07:53 executing program 3: 14:07:53 executing program 5: 14:07:53 executing program 0: 14:07:53 executing program 1: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x13, &(0x7f00000000c0)=0x100000001, 0x4) connect$inet6(r0, &(0x7f0000000080)={0xa, 0x0, 0x0, @ipv4={[], [], @loopback}}, 0x1c) r1 = dup2(r0, r0) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r1, 0x6, 0x16, &(0x7f0000000440), 0x131f64) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) connect$inet6(r1, &(0x7f0000000000)={0xa, 0x4e20, 0x0, @local}, 0x1c) getsockopt$inet_mreqn(r1, 0x0, 0x0, 0x0, &(0x7f0000001680)) 14:07:53 executing program 2: socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = fcntl$dupfd(r0, 0x0, r0) sendmsg$TIPC_NL_MON_SET(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={0x0}}, 0x8805) 14:07:53 executing program 3: 14:07:53 executing program 5: 14:07:53 executing program 0: 14:07:53 executing program 2: 14:07:53 executing program 3: 14:07:53 executing program 0: 14:07:54 executing program 4: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) clone(0x208, 0x0, 0x0, 0x0, 0x0) symlink(&(0x7f0000000100)='./file1\x00', &(0x7f0000000040)='./file1\x00') mknod(&(0x7f0000f80000)='./file0\x00', 0x1040, 0x0) execve(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r1 = creat(&(0x7f0000000200)='\xe9\x1fq\x89Y\x1e\x923aK\x00', 0x109) r2 = dup2(r0, r1) execve(&(0x7f00000002c0)='\xe9\x1fq\x89Y\x1e\x923aK\x00', 0x0, 0x0) open$dir(&(0x7f00000000c0)='./file0\x00', 0x841, 0x0) clone(0x3102001ffd, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) sendmmsg(r2, &(0x7f0000005b00)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0) 14:07:54 executing program 5: 14:07:54 executing program 2: 14:07:54 executing program 3: 14:07:54 executing program 1: 14:07:54 executing program 0: 14:07:54 executing program 2: 14:07:54 executing program 3: 14:07:54 executing program 5: 14:07:54 executing program 2: 14:07:54 executing program 5: 14:07:54 executing program 3: 14:07:54 executing program 4: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) clone(0x208, 0x0, 0x0, 0x0, 0x0) symlink(&(0x7f0000000100)='./file1\x00', &(0x7f0000000040)='./file1\x00') mknod(&(0x7f0000f80000)='./file0\x00', 0x1040, 0x0) execve(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r1 = creat(&(0x7f0000000200)='\xe9\x1fq\x89Y\x1e\x923aK\x00', 0x109) r2 = dup2(r0, r1) execve(&(0x7f00000002c0)='\xe9\x1fq\x89Y\x1e\x923aK\x00', 0x0, 0x0) open$dir(&(0x7f00000000c0)='./file0\x00', 0x841, 0x0) clone(0x3102001ffd, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) sendmmsg(r2, &(0x7f0000005b00)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0) 14:07:54 executing program 0: 14:07:54 executing program 1: 14:07:54 executing program 2: 14:07:54 executing program 3: 14:07:54 executing program 1: 14:07:54 executing program 5: 14:07:54 executing program 0: 14:07:54 executing program 2: 14:07:54 executing program 5: 14:07:54 executing program 3: 14:07:54 executing program 0: 14:07:54 executing program 4: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) clone(0x208, 0x0, 0x0, 0x0, 0x0) symlink(&(0x7f0000000100)='./file1\x00', &(0x7f0000000040)='./file1\x00') mknod(&(0x7f0000f80000)='./file0\x00', 0x1040, 0x0) execve(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r1 = creat(&(0x7f0000000200)='\xe9\x1fq\x89Y\x1e\x923aK\x00', 0x109) r2 = dup2(r0, r1) execve(&(0x7f00000002c0)='\xe9\x1fq\x89Y\x1e\x923aK\x00', 0x0, 0x0) open$dir(&(0x7f00000000c0)='./file0\x00', 0x841, 0x0) clone(0x3102001ffd, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) sendmmsg(r2, &(0x7f0000005b00)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0) 14:07:54 executing program 1: 14:07:54 executing program 3: 14:07:54 executing program 0: 14:07:54 executing program 2: 14:07:54 executing program 5: 14:07:54 executing program 2: 14:07:54 executing program 5: 14:07:54 executing program 1: 14:07:54 executing program 3: 14:07:54 executing program 0: 14:07:54 executing program 3: 14:07:54 executing program 4: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) clone(0x208, 0x0, 0x0, 0x0, 0x0) symlink(&(0x7f0000000100)='./file1\x00', &(0x7f0000000040)='./file1\x00') mknod(&(0x7f0000f80000)='./file0\x00', 0x1040, 0x0) execve(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r1 = creat(&(0x7f0000000200)='\xe9\x1fq\x89Y\x1e\x923aK\x00', 0x109) r2 = dup2(r0, r1) execve(&(0x7f00000002c0)='\xe9\x1fq\x89Y\x1e\x923aK\x00', 0x0, 0x0) open$dir(&(0x7f00000000c0)='./file0\x00', 0x841, 0x0) execve(&(0x7f0000000000)='./file1\x00', 0x0, 0x0) sendmmsg(r2, &(0x7f0000005b00)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0) 14:07:54 executing program 5: 14:07:54 executing program 1: 14:07:54 executing program 2: 14:07:54 executing program 0: 14:07:54 executing program 3: 14:07:54 executing program 0: 14:07:54 executing program 1: 14:07:54 executing program 2: 14:07:54 executing program 3: 14:07:54 executing program 5: 14:07:54 executing program 2: 14:07:54 executing program 4: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) clone(0x208, 0x0, 0x0, 0x0, 0x0) symlink(&(0x7f0000000100)='./file1\x00', &(0x7f0000000040)='./file1\x00') mknod(&(0x7f0000f80000)='./file0\x00', 0x1040, 0x0) execve(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r1 = creat(&(0x7f0000000200)='\xe9\x1fq\x89Y\x1e\x923aK\x00', 0x109) r2 = dup2(r0, r1) execve(&(0x7f00000002c0)='\xe9\x1fq\x89Y\x1e\x923aK\x00', 0x0, 0x0) open$dir(&(0x7f00000000c0)='./file0\x00', 0x841, 0x0) execve(&(0x7f0000000000)='./file1\x00', 0x0, 0x0) sendmmsg(r2, &(0x7f0000005b00)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0) 14:07:54 executing program 0: 14:07:54 executing program 3: 14:07:54 executing program 1: 14:07:54 executing program 5: 14:07:54 executing program 2: 14:07:54 executing program 2: 14:07:54 executing program 5: 14:07:54 executing program 1: 14:07:54 executing program 3: 14:07:54 executing program 0: 14:07:55 executing program 3: 14:07:55 executing program 4: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) clone(0x208, 0x0, 0x0, 0x0, 0x0) symlink(&(0x7f0000000100)='./file1\x00', &(0x7f0000000040)='./file1\x00') mknod(&(0x7f0000f80000)='./file0\x00', 0x1040, 0x0) execve(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r1 = creat(&(0x7f0000000200)='\xe9\x1fq\x89Y\x1e\x923aK\x00', 0x109) r2 = dup2(r0, r1) execve(&(0x7f00000002c0)='\xe9\x1fq\x89Y\x1e\x923aK\x00', 0x0, 0x0) open$dir(&(0x7f00000000c0)='./file0\x00', 0x841, 0x0) execve(&(0x7f0000000000)='./file1\x00', 0x0, 0x0) sendmmsg(r2, &(0x7f0000005b00)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0) 14:07:55 executing program 1: 14:07:55 executing program 5: 14:07:55 executing program 2: 14:07:55 executing program 0: 14:07:55 executing program 3: 14:07:55 executing program 0: 14:07:55 executing program 2: 14:07:55 executing program 1: 14:07:55 executing program 3: 14:07:55 executing program 5: 14:07:55 executing program 5: 14:07:55 executing program 4: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) clone(0x208, 0x0, 0x0, 0x0, 0x0) symlink(&(0x7f0000000100)='./file1\x00', &(0x7f0000000040)='./file1\x00') mknod(&(0x7f0000f80000)='./file0\x00', 0x1040, 0x0) execve(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r1 = creat(&(0x7f0000000200)='\xe9\x1fq\x89Y\x1e\x923aK\x00', 0x109) r2 = dup2(r0, r1) execve(&(0x7f00000002c0)='\xe9\x1fq\x89Y\x1e\x923aK\x00', 0x0, 0x0) clone(0x3102001ffd, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) execve(&(0x7f0000000000)='./file1\x00', 0x0, 0x0) sendmmsg(r2, &(0x7f0000005b00)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0) 14:07:55 executing program 3: 14:07:55 executing program 0: 14:07:55 executing program 1: 14:07:55 executing program 2: 14:07:55 executing program 5: 14:07:55 executing program 3: 14:07:55 executing program 0: 14:07:55 executing program 2: 14:07:55 executing program 1: 14:07:55 executing program 5: 14:07:55 executing program 0: futex(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) write(0xffffffffffffffff, 0x0, 0x0) r0 = creat(&(0x7f0000000700)='./bus\x00', 0x0) ftruncate(r0, 0xa48204) r1 = open(&(0x7f0000000180)='./bus\x00', 0x0, 0x0) pread64(r1, &(0x7f0000005000)=""/4096, 0xffffffc7, 0x0) 14:07:55 executing program 4: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) clone(0x208, 0x0, 0x0, 0x0, 0x0) symlink(&(0x7f0000000100)='./file1\x00', &(0x7f0000000040)='./file1\x00') mknod(&(0x7f0000f80000)='./file0\x00', 0x1040, 0x0) execve(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r1 = creat(&(0x7f0000000200)='\xe9\x1fq\x89Y\x1e\x923aK\x00', 0x109) r2 = dup2(r0, r1) execve(&(0x7f00000002c0)='\xe9\x1fq\x89Y\x1e\x923aK\x00', 0x0, 0x0) clone(0x3102001ffd, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) execve(&(0x7f0000000000)='./file1\x00', 0x0, 0x0) sendmmsg(r2, &(0x7f0000005b00)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0) 14:07:55 executing program 3: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000000)='memory.events\x00', 0x26e1, 0x0) fallocate(r0, 0x1, 0x0, 0x100000001) fsetxattr$trusted_overlay_upper(r0, &(0x7f0000000080)='trusted.overlay.upper\x00', &(0x7f0000000280)={0x0, 0xfb, 0x39, 0x0, 0x0, "d767e3c128cc81936f6696b90f1c8d72", "3e5948b0b58a378a12a63c3edd2e4f26910471945ece4cf32333b5a319f1e2722304ae03"}, 0x39, 0x0) 14:07:55 executing program 2: creat(&(0x7f00000001c0)='./file0\x00', 0x0) r0 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) lseek(r0, 0xfffffffffffffffe, 0x0) 14:07:55 executing program 1: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000000)='memory.events\x00', 0x26e1, 0x0) fsetxattr$trusted_overlay_upper(r0, &(0x7f0000000080)='trusted.overlay.upper\x00', &(0x7f0000000280)={0x0, 0xfb, 0xfbd, 0x0, 0x0, "d767e3c128cc81936f6696b90f1c8d72", "3e5948b0b58a378a12a63c3edd2e4f26910471945ece4cf32333b5a319f1e2722304ae039590f7dddb1d1e72435b24303b43d2e80e9c3e979dfa3a51bee9e07d8ec91b63304cc930f60ba9d0f88b4e17418538b4e384a47204aa66b5aa3251942280ece14993eaab05291eb039dde53bae72dcc7ae15d2408a820539527565d0b706fad999492ef3cc442fa34774ff503d71094e403348ef5e1d454a0d683ca7dc565253fb119eb5e796140183ad143a7620e53e1ca02857a1d42f8f3325b76145b55f102abcb6202a2cdaf65f448c6a4905644e794dacf0a6ffad14eec112a393d7ad1df53748ca6a0d48e9bffb5729fddb1cb807878569604634d0f84c03265197a06b25cf0cee3753cb61e0dd1947df21632b54d87261017c944ede2b41db3a0ff82e2494aedf24ace632ee47a379bd636bd69a418609394f44d79e389ee2dfe6dc4fd0f14aec43b62802e92963fed6c0d021b3c67656702ad7685fc38855262c02bb7505c45587cae109882bd58aa05d1f9ae8326b8a7dbcc0713f1a871efeabf46aa37ac1d95a4483159c1e9c3a371690bbfdf737adeeee59f7f9e9a589d50745c36b542cd86c594f9f4f049e562463f796ea232575bda6581c3226b706af65aa03432098af12a4a3d1e51258ca1cb919dcf9f0a414e040a458fa2cef40a54e0ae7ef273b3ba855cc4c845e5ef1cda6eeaf5916beb5edadd2cae6898a09c06dacd1d3546114e06fbe786b818d755c20ab841b3fedf44a5f8042684c1a6bfd2a8efc59bb02e75ef17db09969d594a8f7a5c11f21de6b88570a8bf80c8a002d49dbaff5d6701b3436e6783d75a082a308b35ee33f57e0a653d3b574338ea2571f7086aceb5088fdad68b596afe9195997c1608ac1f9e7893c6efafa6b9df98f4e61b52adf0f46a89b2e04cc634ac361d0930206e2115ed3949542fe7c9c2b04537ac107c6282db898bf51834800e60f0dbb284810c73083d20ef9d2a098c1d71145412ad5ce2b9edb5692f9186165798b2c59181560223118ddf6464be20fd01692b32528e371580fe3ebcdf97c2cb1ae9d4a1b37179a59eda0d9b5c1063b4720f9e9c1f7cba54b02ae5678fbc3002aa5abc871fcab03e80ffef19d23e3d22abb30d641d26017202556e087f5b663706179084a06aca8e60b066b72ab0d686b55159bf867ec4978d041c986503588db4a01e2367a40d0626906dfc5419cf1194473d82eef2e8f3471b4b3938e7b6dc3bb4ac55f1e4c510591fc46e0d88a232952c6e5f539a11e936f6f5c419ee55a5cfa24fbf6b1e84995ed73cd3c6b462aa93e2063f351ce5515fc967f6c617b72ebd5752e877e1d995790011e150b9d261311c9312d0c664efb64db9724a72b381ff6ab2d7395604be85f4d96ac81375f116df6d0d3daefbb67b52d7915e3861a2661d190ab5dd6d25fb107ddd472835133f772089f481083f3a88cefdd53182b9e3fb6e40de66c884ca41ee17c2f027365d4a9efe909abbea78ce0e404f6ed008c44972ac6e5e64057c57d500c76365bb27a49682f864154feb3588acad19dda0e5a056eb1b71dd9f64b9b28531159f5f5881bd537988e203f20e1716053b7f811c5c88f171be479efb5b41d00adfa789852b7a4806106ab43824195b0b56d321ace13e507d4a42a769dfa6769cc9e12a338a91ad267cd1d7f7c66b043dcede9325d9d03a34a3275a8e8b20bb2fa03d2925b5b2119d7071a46c04597cdfe25f6bed47153f327f3ef8b695fd602c1a1ba8680abd60d83dc08e616631afaf6449830a46ffdb2e539c250fdf82bf6b10e8a6da022d956d38a8f6a1f038b25d559925fef1fba196678935501a15e907615ef3ce481e0b9db110a64a23618fadd957bff912dc1054a2cdcd68582272fe705be161ef7bd52aa563e503bb04b4a89a3e80a4fc464a047209a419e8d0d4cd10ce4fb0843c6657d5d68dba4a113231611849ba1518dd1e39b77303d127e944426e2b3419b09617833059e45953b13b7106ad9115a02aa2d0aedb749eeb441bd1dd8882f6a0c4df31d1dfbb76781b79e54795ca51be09412372f86855b2bf2dfce072ea635cbf2d2da66e65c9c459a2d67c78ddd21ba4065290cac4207257058214e4884b9678c9445875efac6a174e71cfeb4ab7ca288f6cd72f559e4a0864021eed75008624e813a4ebfe67c648d7224f960e2cea957746ce21f6b3e1896c2fb6ca328204dc67fb474f83199c606bbae34e5e811f5761a26f969b238e39a313da6e8f661019bf405949204ff970ab5012c20e8aea21a287cb6f0581885bdcddbd7df7d5763acb0ca1343ce8e6b6164fcab24b1ec51add206a90dfa861e42258a765844903a977ca14303112216758245b2264b6b61ef47b98bca1c95a2b24912c2e522798a88ec8109a010d4b985de982c338d9e1bc46acd136896dfba9211944a02787a52782332765067f6bc7faad7dfccf6354de7d64bc91b9a7a9cf294a6ff1a4581a21c46116d8fedd8b8dbdd8a3c1d5c6ac13b31bebb245961306d12fac0365ec54e0955134cee5b0a277d732a534b7554acad80f6e33771f22f5e9144b655bc03e8815e8fb3a265030b16bcb9b940157b1374ba6f3fde57089c88a77635b491bf1e7852220d10cdcc32dadfc96e4b58f314e6d5b656918a30f64818406fcc42c20576a5b7e6d5f3e33d5a17603ac6fe3771ca25442015e42d1ee17653398fa592a62cbfdd6b4c441380fbd7a08a0786069584c45878c8863851fd7a405cd01d09bd0b45860ac77b67e02c55321d12aa871ad1a887c3a82d1e208a92c293347754039821d3a9b80aa903d1a39530eb53064b35149b62b462e68b01a58c8b21670097c51bdbea0eb0d58d5303ff7f1174472ccf2733c8b67ea21976f9b6136c8769b7b5584eb9728cda18cec28c5666513e5a60418599d14a87fd064b7b58fa8140467e87e7dd40d3b68d5dc658d2937677444eab6b3bf6aa8a7364380b023efa7c08a8b941cd39a5f97c84a4a62be13133471446c41867f56d5273fbcea1be53ba42952023753d0deebd686c12a0519bec197ae287d752130c7a0056830462e64bfef07e993d52aeab33da8fab3821a09a08c053b9461d8527adb1397e89806987a2898a58ea7cc81d4207ffa760447fc024e688fc7662df0025ad072c129b690e34cb9bbcca9136987f84873de64521c802d69fcbe0a33f28ec285c1aee757b8d9dc7d7589f73d6795b0d4658b2d78cc9efdf7ea6a607a45287d766c6e5a28bfed0195030d4d88a3728f70e25e9a00aa32e21826cb65052476d2a630c8ecfe0a3b67e93b7d601c80706a7de2b474f30ce281dca510277ba70a92103c673181418938a5f18fb29ce626651ef75285fa8bcb839667466279bd5678f7e65dc89a77f3d9d2892b374721ceac69d4f1a1612ff68c38c045ae72f3d4c4eac22675c55846e7709962a3c551f2237b90fc41adefac0b85fbe78955a4b33db50c55fcae0bf135be361ca14eab8018d7ba7c9e1747d6d7740e1ea75acbe655b476e74a3078436c99e6ed26a451d5b3d0e42f211d2dad8590fbcd1afbe547af6d7c0cd8cd7c8f4c1b30a1724b7bf24c4c9e622747c101262204f2025ac2876d64da228d0e04ad53565886d216f847edd0984d8902aa5cf78a013d802f7abc2babaa25960f40e3c50f42b25c0f9551811bf94f8e1d52cd9cb1af66c38e75308ac34694caf50c89343f9b55fb34d47c4ac2183d7e76041e8bbbe28cf79cce7d85f0802e1b0c85f71118720e7f202b4a4291cd5cb2ec701e07e23c264fefb70233641f6499b57597ef0aa69442e9dbc9a12a77fb6ded399d21ae3458cd4c7c9845b42bc4ebf96e6a279f92df81d8ed7cfd7817ba691fd28d3591ffbc8bf813c2bfc5b1c661c9cb6138e9ab61ef7636a26d26de8c0109020ff195175c1e676c01eb1c113a5d95dd1cb57f34c0e805af12f09a110e26d26e088477bfa279d4c65715d4253668bfc1e9a9dba0bcce842ef2f767daee7a89104305d31dceb4d21953286091b1f429e5e706b356ba40f9b762f49f8a1e77b29f7e4db1bd4cf64e8e67d742bae0a736f73f4b023b96a43b243614f04e740d8793fa712ea9fbc0405d51e2b73072562e5305a38ec92015ab1f4dfe784f2a2ec54f680f37d3e7039396fde0836aaa5acd27e807436fac32c050218016189467a697f764841ade1fe9e47de9dd91a97caf667243233de6e5b372d1b73d06b1bf67b4f2008ed605493f2f5664d3c5e044d103bc6fcebd3703bdc6c03c94b7533781c047a9f92f59d4d34b0b9d3f5d5451594ff9808af7cb2160699f7d8c1862d84d31d8a2a156ce169cb8dcd7fcf01dac32c393b6ca9450e11554df2ed050b34db096996da7ea48079a7a84a77e4f152ee2dc8cecfcc0447316b7dd240c9fc2cf21d77b87f27061b6364156d070ac52dbf431db897e533f986240caa475b4d22868482d5150044de166b2819aff22db821234e740d9b58c02c8884b228af4b975007b5a9fa4cc594f80573af9989de5397fb9046751fa2fe6a8e52819d9c2e8c7ad8ab499a6aa233ab800eaf4c6bad389642fdc270fda1602e4663f40020b002f70cdf23e25a02573b420f8d2375b21be356ed60a829d5525648971f8223088dcb4ff1b9eabe50d16bab00a245c095108ad29af52509d6243b0acfc36152abb319af66197b4e3c5079e08af539940f45c46b759683580e8970409a654ffb7592d8ec00925b687205904e804a4d096b28d1911cf831909c9ce4e3cd7bb860a401e20f2ce11f458deabef18a2e94536ed58ac3e8ceaccc36877555931e0e18ec33539fcc6534920dd045eb956aec9ac2d91fa51e209020cc2d21059b9e975ddad5492554aba6ea86a5e2c1ba0bbc43cf8e35ae7821de66f1d42f6f35bda83a71597c8edf6c6249ee07e7510cc7ac4ca6a2fceecc5c6c53d5e6e5eee15eb333ab86b1d5e910ac0fbaa56604648e67074612e82766170f755b5c082f22f61116189f6fdad6e1dee69a0e8cc6269f562dc8b45f49d065efe4817cd76ec30204ce060f7a0949e237d2ead5c382e96c9c7bea76aa81d3994c59bd9787a7fbfdc6a5af06c1138b7e84e3aca27c66a7e8a2aeffc3a314b2fd7e2ed8ade2fd524a95c33de445d60cbc8a262eead1949ca0708da5ba96e1a835919bf7a3f158e962f01a81f2a8a74d13e418aea052032212ee10f2af608cda380e7aa01e2593de826ff8cf9de2893bf99e34a145d4ca50138389b0c90211f42377aa31b8115f94fbd4b970c1abac67f849e581543844dc3cc76e68309d994777529543752bf4fb5322fa6f2d267ec3e15cb132eb520d089150e0ebcda9004af7ab04d0e62deab68d3eb39e961a9ed16064d40954627cdfbb7ff069af9a00214b0081e5059dde47c43b85ba438c0b936ad092172dfde61d106db1079c5277ccb9e0d832191b2676e98d4c7ee28289a4b5f34fb1f8da97341f7378c0935cae7333a7593603ea13852a0baa3bcb1394cd9cbbce004359e2a0970a2ad3c7b6dfcb31c5614a69f5a057fdf31c40be69fdfb2383cdec70847b4d23f6005f455e1e3dd16bf2a21ee0ed68720d63a2cb9b611f35a08080316da6dd2c8cdb20a02ffe816c893bd18529a1450973278b92d82ff314680495efaa9b8e294e438efa85937b13c47f6cf6"}, 0xfbd, 0x0) 14:07:55 executing program 5: 14:07:55 executing program 0: 14:07:55 executing program 5: r0 = add_key$keyring(&(0x7f0000000200)='keyring\x00', &(0x7f00000000c0)={'syz'}, 0x0, 0x0, 0xfffffffffffffffc) r1 = add_key$keyring(&(0x7f0000000280)='keyring\x00', &(0x7f0000000240)={'syz'}, 0x0, 0x0, r0) add_key(&(0x7f0000000100)='dns_resolver\x00', &(0x7f0000000080)={'syz', 0x1}, &(0x7f0000000140)="dee7030022cf9e5e1dbac27b0426fc0299c41fb9b9761a1b44dac894f365ae68edf335abf35ec53d6751467ebd2c187491bcab2c8d34fec505fc8a14622dba33ff9b054eb7e8a5bc4ab2719cb230328931deb95ef3fcafb1ce27743a93f4715976ede8860ab49c3a4f51ab0124b50c3362201a307df03000", 0x78, r1) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) request_key(&(0x7f0000000000)='dns_resolver\x00', &(0x7f00000002c0)={'syz', 0x1}, 0x0, 0x0) 14:07:55 executing program 1: r0 = socket$inet(0x10, 0x803, 0x0) getsockopt$sock_int(r0, 0x1, 0x10, 0x0, &(0x7f00000000c0)) 14:07:55 executing program 0: r0 = dup3(0xffffffffffffffff, 0xffffffffffffff9c, 0x80000) ioctl$EVIOCGABS20(r0, 0x80184560, &(0x7f0000000240)=""/128) socket(0x10, 0x803, 0x0) ioctl$RTC_PLL_GET(r0, 0x80207011, &(0x7f00000002c0)) sched_setscheduler(0x0, 0x1, &(0x7f0000000100)=0x5) futex(&(0x7f000000cffc)=0x1, 0x800000000006, 0x0, 0x0, 0x0, 0x0) creat(0x0, 0x0) ioctl$KDGKBENT(0xffffffffffffffff, 0x4b46, 0x0) prctl$PR_GET_FPEXC(0xb, 0x0) perf_event_open(&(0x7f000001d000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) pipe(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) write(r2, &(0x7f00000001c0), 0xfffffef3) vmsplice(r1, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) r3 = creat(&(0x7f0000000700)='./bus\x00', 0x0) ftruncate(r3, 0xa48204) open(0x0, 0x4000, 0x0) pread64(0xffffffffffffffff, 0x0, 0x0, 0x0) 14:07:55 executing program 2: r0 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000000)='projid_map\x00') write$P9_RLOPEN(r0, 0x0, 0x0) 14:07:55 executing program 3: r0 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r0, &(0x7f0000000140)={0x2, 0x4e23, @multicast2}, 0x10) setsockopt$SO_ATTACH_FILTER(r0, 0x1, 0x1a, &(0x7f0000b86000)={0x1, &(0x7f0000f40ff8)=[{0x6, 0x0, 0x0, 0xe8}]}, 0x10) sendto$inet(r0, 0x0, 0x0, 0x200007fd, &(0x7f0000000680)={0x2, 0x4e23, @local}, 0x10) sendto(r0, &(0x7f00000006c0)="ae8e1fe10c566add28d148dacdedfd6519d7dd7d971623c00d25ebf88ce0830b8ed5dcf100fe8548c1ce4c799a93a31309dc73bde29d971b9a0bff541ee62aa5f39be766c9d9851bf41f0b27195997275b341fc074dfab5dff1f73c5f5aeb4bb4818d1825f8190bdae8ea227c56a57c915a6b10f9d0995cf603c58108af1cde387a9a61ac24610d553229e6216c7f2ff1ec785349cb075ba399f284e22ae37e0e40d574f043ee00f9d2555c7eb804448f69fb6fc390e2aef90b6c66e36b2e2b072d8d008c8be37d885", 0xc9, 0x0, 0x0, 0x0) recvmmsg(r0, &(0x7f0000008c80)=[{{0x0, 0x0, &(0x7f0000000480)=[{&(0x7f00000001c0)=""/248, 0xf8}], 0x1}}], 0x1, 0x100, 0x0) write$P9_RWRITE(r0, &(0x7f0000000000)={0xb}, 0xb) 14:07:55 executing program 1: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x200000000000013, &(0x7f0000000280)=0x400100000001, 0x4) connect$inet6(r0, &(0x7f0000000080), 0x1c) r1 = dup2(r0, r0) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r1, 0x6, 0x16, &(0x7f0000000440), 0x132224) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = gettid() setsockopt$inet6_IPV6_FLOWLABEL_MGR(r0, 0x29, 0x20, &(0x7f0000000000)={@mcast2, 0x0, 0x0, 0x3}, 0x20) ptrace$setopts(0x4206, r2, 0x0, 0x0) tkill(r2, 0x100000000033) fcntl$setstatus(r0, 0x4, 0x42803) 14:07:56 executing program 4: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) clone(0x208, 0x0, 0x0, 0x0, 0x0) symlink(&(0x7f0000000100)='./file1\x00', &(0x7f0000000040)='./file1\x00') mknod(&(0x7f0000f80000)='./file0\x00', 0x1040, 0x0) execve(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r1 = creat(&(0x7f0000000200)='\xe9\x1fq\x89Y\x1e\x923aK\x00', 0x109) r2 = dup2(r0, r1) execve(&(0x7f00000002c0)='\xe9\x1fq\x89Y\x1e\x923aK\x00', 0x0, 0x0) clone(0x3102001ffd, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) execve(&(0x7f0000000000)='./file1\x00', 0x0, 0x0) sendmmsg(r2, &(0x7f0000005b00)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0) 14:07:56 executing program 2: perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) write(0xffffffffffffffff, 0x0, 0x0) r0 = creat(&(0x7f0000000700)='./bus\x00', 0x0) ftruncate(r0, 0xa48204) r1 = open(&(0x7f0000000180)='./bus\x00', 0x0, 0x0) pread64(r1, &(0x7f0000005000)=""/4096, 0xffffffc7, 0x0) 14:07:56 executing program 5: r0 = syz_open_dev$loop(&(0x7f00000000c0)='/dev/loop#\x00', 0x0, 0x0) ioctl$LOOP_SET_STATUS64(r0, 0x4c04, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1c, "7bd6fa82ac8ea8d081c5695202c4eb08f87cbd3d53fa0327cfd959ddae95393cc8da61f7eb7528d5a70223c0fffb2c0b164e72ef066e4e4c2672627d3bf8780b", "85693a7e9c6291a1403b124e39efd91984fe775530983635418ab16489358664fbb87915caf1cbff9443179bd7c7856b5e0f0865a56e7bc081b1511fdcccb46d", "adba2bff90b5cb72026a279992840bda1a4e92abbc38dc25155c2f5c27a3c391"}) 14:07:56 executing program 5: ioctl$EVIOCGABS20(0xffffffffffffffff, 0x80184560, 0x0) socket(0x10, 0x803, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000100)=0x5) futex(&(0x7f000000cffc)=0x1, 0x800000000006, 0x0, 0x0, 0x0, 0x0) r0 = creat(0x0, 0x2) prctl$PR_GET_FPEXC(0xb, &(0x7f0000000400)) perf_event_open(0x0, 0x0, 0x0, r0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) pipe(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) write(r2, &(0x7f00000001c0), 0xfffffef3) vmsplice(r1, 0x0, 0x0, 0x0) r3 = creat(&(0x7f0000000700)='./bus\x00', 0x0) ftruncate(r3, 0xa48204) r4 = open(&(0x7f0000000180)='./bus\x00', 0x4000, 0x0) pread64(r4, &(0x7f0000005000)=""/4096, 0xffffffc7, 0x0) 14:07:56 executing program 3: r0 = socket$inet(0x10, 0x803, 0x6) sendmsg(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)=[{&(0x7f0000000180)="240000001e0007021dfffd946f610500070200001f00000000000f00421ba3a20400ff7e", 0x24}], 0x1}, 0x0) 14:07:56 executing program 0: r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000001040)='/dev/ion\x00', 0x0, 0x0) ioctl$void(r0, 0x0) 14:07:56 executing program 3: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) clone(0x800000409ff, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = gettid() futex(&(0x7f0000000140)=0x2, 0x0, 0x2, 0x0, 0x0, 0x0) ptrace$setopts(0x4206, r1, 0x0, 0x0) tkill(r1, 0x38) write$P9_RREAD(0xffffffffffffffff, &(0x7f0000000100)=ANY=[@ANYBLOB="fa79be9c799330d190ed33059ec73ca27775c5418889206e11265c9deea56e9137e3bd4f414ec79287995334fec7daa136e025e4ccc1ee83d2"], 0x39) ptrace$cont(0x18, r1, 0x0, 0x0) ptrace$setregs(0xd, r1, 0x0, &(0x7f00000000c0)) ptrace$cont(0x7, r1, 0x0, 0x0) 14:07:56 executing program 2: perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) write(0xffffffffffffffff, 0x0, 0x0) r0 = creat(&(0x7f0000000700)='./bus\x00', 0x0) ftruncate(r0, 0xa48204) r1 = open(&(0x7f0000000180)='./bus\x00', 0x0, 0x0) pread64(r1, &(0x7f0000005000)=""/4096, 0xffffffc7, 0x0) 14:07:56 executing program 0: r0 = socket$inet_tcp(0x2, 0x1, 0x0) getsockopt$sock_buf(r0, 0x1, 0x1f, 0x0, &(0x7f00000000c0)) 14:07:56 executing program 3: r0 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r0, &(0x7f0000000140)={0x2, 0x4e23, @multicast2}, 0x10) setsockopt$SO_ATTACH_FILTER(r0, 0x1, 0x1a, &(0x7f0000b86000)={0x1, &(0x7f0000f40ff8)=[{0x6, 0x0, 0x0, 0xe8}]}, 0x10) sendto$inet(r0, 0x0, 0x0, 0x200007fd, &(0x7f0000000680)={0x2, 0x4e23, @local}, 0x10) sendto(r0, &(0x7f00000006c0)="ae8e1fe10c566add28d148dacdedfd6519d7dd7d971623c00d25ebf88ce0830b8ed5dcf100fe8548c1ce4c799a93a31309dc73bde29d971b9a0bff541ee62aa5f39be766c9d9851bf41f0b27195997275b341fc074dfab5dff1f73c5f5aeb4bb4818d1825f8190bdae8ea227c56a57c915a6b10f9d0995cf603c58108af1cde387a9a61ac24610d553229e6216c7f2ff1ec785349cb075ba399f284e22ae37e0e40d574f043ee00f9d2555c7eb804448f69fb6fc390e2aef90b6c66e36b2e2b072d8d008c8be37d885", 0xc9, 0x0, 0x0, 0x0) shutdown(r0, 0x1) recvmmsg(r0, &(0x7f0000008c80)=[{{0x0, 0x0, &(0x7f0000000480)=[{&(0x7f00000001c0)=""/248, 0xf8}], 0x1}}], 0x1, 0x100, 0x0) 14:07:56 executing program 0: io_getevents(0x0, 0x0, 0x0, 0x0, 0x0) io_destroy(0x0) r0 = openat$tun(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000140)={'ip_vti0\x00\x1e\x00', 0x800201d}) 14:07:58 executing program 1: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x200000000000013, &(0x7f0000000280)=0x400100000001, 0x4) connect$inet6(r0, &(0x7f0000000080), 0x1c) r1 = dup2(r0, r0) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r1, 0x6, 0x16, &(0x7f0000000440), 0x132224) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = gettid() setsockopt$inet6_IPV6_FLOWLABEL_MGR(r0, 0x29, 0x20, &(0x7f0000000000)={@mcast2}, 0x20) ptrace$setopts(0x4206, r2, 0x0, 0x0) tkill(r2, 0x100000000033) fcntl$setstatus(r0, 0x4, 0x42803) 14:07:58 executing program 3: r0 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r0, &(0x7f0000000140)={0x2, 0x4e23, @multicast2}, 0x10) setsockopt$SO_ATTACH_FILTER(r0, 0x1, 0x1a, &(0x7f0000b86000)={0x1, &(0x7f0000f40ff8)=[{0x6, 0x0, 0x0, 0xe8}]}, 0x10) sendto$inet(r0, 0x0, 0x0, 0x200007fd, &(0x7f0000000680)={0x2, 0x4e23, @local}, 0x10) sendto(r0, &(0x7f00000006c0)="ae8e1fe10c566add28d148dacdedfd6519d7dd7d971623c00d25ebf88ce0830b8ed5dcf100fe8548c1ce4c799a93a31309dc73bde29d971b9a0bff541ee62aa5f39be766c9d9851bf41f0b27195997275b341fc074dfab5dff1f73c5f5aeb4bb4818d1825f8190bdae8ea227c56a57c915a6b10f9d0995cf603c58108af1cde387a9a61ac24610d553229e6216c7f2ff1ec785349cb075ba399f284e22ae37e0e40d574f043ee00f9d2555c7eb804448f69fb6fc390e2aef90b6c66e36b2e2b072d8d008c8be37d885", 0xc9, 0x0, 0x0, 0x0) shutdown(r0, 0x1) recvmmsg(r0, &(0x7f0000008c80)=[{{0x0, 0x0, &(0x7f0000000480)=[{&(0x7f00000001c0)=""/248, 0xf8}], 0x1}}], 0x1, 0x100, 0x0) 14:07:58 executing program 0: r0 = socket$unix(0x1, 0x1, 0x0) r1 = socket$unix(0x1, 0x400040000000001, 0x0) bind$unix(r1, &(0x7f0000003000)=@abs={0x1}, 0x8) listen(r1, 0x0) connect(r0, &(0x7f0000985ff8)=@un=@abs={0x1}, 0x8) r2 = syz_open_procfs(0x0, &(0x7f00000002c0)='net/ipv6_route\x00') sendfile(r0, r2, 0x0, 0x800000bf) 14:07:58 executing program 2: ftruncate(0xffffffffffffffff, 0x0) perf_event_open(&(0x7f000001d000)={0x2, 0x70, 0x40, 0x8001, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$RTC_PLL_SET(0xffffffffffffffff, 0x40207012, 0x0) r0 = socket$inet6(0xa, 0x200000000000001, 0x0) getsockopt$IP6T_SO_GET_REVISION_MATCH(r0, 0x29, 0x44, &(0x7f0000000000)={'icmp6\x00'}, &(0x7f0000000040)=0x1e) 14:07:58 executing program 4: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) clone(0x208, 0x0, 0x0, 0x0, 0x0) symlink(&(0x7f0000000100)='./file1\x00', &(0x7f0000000040)='./file1\x00') mknod(&(0x7f0000f80000)='./file0\x00', 0x1040, 0x0) execve(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r1 = creat(&(0x7f0000000200)='\xe9\x1fq\x89Y\x1e\x923aK\x00', 0x109) r2 = dup2(r0, r1) open$dir(&(0x7f00000000c0)='./file0\x00', 0x841, 0x0) clone(0x3102001ffd, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) execve(&(0x7f0000000000)='./file1\x00', 0x0, 0x0) sendmmsg(r2, &(0x7f0000005b00)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0) 14:07:58 executing program 5: r0 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x80000000000002, &(0x7f00000005c0)=0x16c, 0x4) bind$inet(r0, &(0x7f00000007c0)={0x2, 0x4e23, @multicast1}, 0x10) sendto$inet(r0, 0x0, 0x0, 0x200007fd, &(0x7f00000008c0)={0x2, 0x4e23, @local}, 0x10) recvmsg(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000180)=[{0x0}], 0x1, &(0x7f0000000200)=""/20, 0x14}, 0x100) write$binfmt_elf64(r0, &(0x7f0000002300)=ANY=[@ANYRES64], 0x1000001bd) 14:07:58 executing program 3: r0 = memfd_create(&(0x7f0000000100)='\vem1\xc1\xf8\xa6\x8dN\xc0\xa3\\\xe2\xcb\xa2\xba\xe5\xf4\x97\xac#*\xff', 0x0) write$FUSE_NOTIFY_STORE(r0, &(0x7f00000002c0)=ANY=[@ANYBLOB='4\x00\x00\x00\x00\x00%'], 0x7) sendfile(r0, r0, &(0x7f0000001000), 0xffff) mmap(&(0x7f0000000000/0x7000)=nil, 0x7000, 0x80000000004, 0x11, r0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f000001a000)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$SO_ATTACH_FILTER(r1, 0x1, 0x1a, &(0x7f0000000140)={0x0, 0x0}, 0x10) 14:07:58 executing program 2: clone(0x200, 0x0, 0x0, 0x0, 0x0) mknod(&(0x7f0000000140)='./file0\x00', 0x1040, 0x0) execve(&(0x7f0000000000)='./file0\x00', 0x0, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000400)='attr/current\x00') write(r0, 0x0, 0x0) 14:07:58 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000300)="0adc1f123c123f3188b070") remap_file_pages(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x0, 0x0, 0x0) 14:07:58 executing program 4: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) clone(0x208, 0x0, 0x0, 0x0, 0x0) symlink(&(0x7f0000000100)='./file1\x00', &(0x7f0000000040)='./file1\x00') mknod(&(0x7f0000f80000)='./file0\x00', 0x1040, 0x0) execve(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r1 = creat(&(0x7f0000000200)='\xe9\x1fq\x89Y\x1e\x923aK\x00', 0x109) r2 = dup2(r0, r1) open$dir(&(0x7f00000000c0)='./file0\x00', 0x841, 0x0) clone(0x3102001ffd, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) execve(&(0x7f0000000000)='./file1\x00', 0x0, 0x0) sendmmsg(r2, &(0x7f0000005b00)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0) [ 98.983657] mmap: syz-executor.0 (2885) uses deprecated remap_file_pages() syscall. See Documentation/vm/remap_file_pages.txt. 14:07:58 executing program 0: r0 = syz_open_procfs(0x0, &(0x7f00000000c0)='comm\x00') write$P9_RLOPEN(r0, 0x0, 0x0) 14:07:59 executing program 4: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) clone(0x208, 0x0, 0x0, 0x0, 0x0) symlink(&(0x7f0000000100)='./file1\x00', &(0x7f0000000040)='./file1\x00') mknod(&(0x7f0000f80000)='./file0\x00', 0x1040, 0x0) execve(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r1 = creat(&(0x7f0000000200)='\xe9\x1fq\x89Y\x1e\x923aK\x00', 0x109) r2 = dup2(r0, r1) open$dir(&(0x7f00000000c0)='./file0\x00', 0x841, 0x0) clone(0x3102001ffd, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) execve(&(0x7f0000000000)='./file1\x00', 0x0, 0x0) sendmmsg(r2, &(0x7f0000005b00)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0) 14:07:59 executing program 1: r0 = socket$unix(0x1, 0x1, 0x0) r1 = socket$unix(0x1, 0x400040000000001, 0x0) setxattr(&(0x7f0000000080)='./file0\x00', &(0x7f0000000200)=@known='trusted.overlay.opaque\x00', &(0x7f0000000300)='\xcd\x1f\xb0b\x90x\xc4\'\x0ekjs\x14\xac\xed\xb2\x06\x12\'\xd1A\x8c\xe0\xbe\xb6X,\xc6 \x9a\x02\xa8\xaf\xd5\xd8){\xa05\x8cM\xa2\xfd\xbe\x8bPZ\xa5\xc3\nq\x8d{~\'F\xb8', 0x5c, 0x3) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) bind$unix(r1, &(0x7f0000003000)=@abs={0x1}, 0x8) getsockname$unix(r0, &(0x7f0000000240), 0x0) listen(r1, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x430100, 0x1) ioctl$LOOP_SET_DIRECT_IO(r2, 0x4c08, 0x2000000000000) connect(r0, &(0x7f0000985ff8)=@un=@abs={0x1}, 0x8) r3 = syz_open_procfs(0x0, &(0x7f00000002c0)='net/ipv6_route\x00') sendfile(r0, r3, 0x0, 0x800000bf) 14:07:59 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x200000000000013, &(0x7f0000000280)=0x400100000001, 0x4) connect$inet6(r0, &(0x7f0000000080)={0xa, 0x0, 0x0, @empty}, 0x1c) r1 = dup2(r0, r0) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r1, 0x6, 0x16, &(0x7f0000000440), 0x132224) clone(0x500, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = gettid() setsockopt$inet6_tcp_int(r0, 0x6, 0x0, &(0x7f0000000000), 0x4) ptrace$setopts(0x4206, r2, 0x0, 0x0) tkill(r2, 0x3c) fcntl$setstatus(r1, 0x4, 0x42803) 14:07:59 executing program 4: socket$inet6_tcp(0xa, 0x1, 0x0) clone(0x208, 0x0, 0x0, 0x0, 0x0) symlink(&(0x7f0000000100)='./file1\x00', &(0x7f0000000040)='./file1\x00') mknod(&(0x7f0000f80000)='./file0\x00', 0x1040, 0x0) execve(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) creat(&(0x7f0000000200)='\xe9\x1fq\x89Y\x1e\x923aK\x00', 0x109) execve(&(0x7f00000002c0)='\xe9\x1fq\x89Y\x1e\x923aK\x00', 0x0, 0x0) open$dir(&(0x7f00000000c0)='./file0\x00', 0x841, 0x0) clone(0x3102001ffd, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) execve(&(0x7f0000000000)='./file1\x00', 0x0, 0x0) sendmmsg(0xffffffffffffffff, &(0x7f0000005b00)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0) 14:07:59 executing program 1: r0 = perf_event_open(&(0x7f000001d000)={0x2, 0x70, 0x40, 0x8001, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$VT_RELDISP(0xffffffffffffffff, 0x5605) ioctl$RTC_PLL_SET(0xffffffffffffffff, 0x40207012, 0x0) fadvise64(r0, 0x0, 0x8, 0x0) 14:07:59 executing program 1: mkdir(&(0x7f0000000280)='./file0\x00', 0x0) perf_event_open(&(0x7f0000000000)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0xa00000000, 0x0, 0x40000}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mount(0x0, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000180)='nfs\x00', 0x0, &(0x7f0000000000)) 14:07:59 executing program 5: r0 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r0, &(0x7f0000000140)={0x2, 0x4e23, @multicast2}, 0x10) setsockopt$SO_ATTACH_FILTER(r0, 0x1, 0x1a, &(0x7f0000b86000)={0x1, &(0x7f0000f40ff8)=[{0x6, 0x0, 0x0, 0xe8}]}, 0x10) sendto$inet(r0, 0x0, 0x0, 0x200007fd, &(0x7f0000000680)={0x2, 0x4e23, @local}, 0x10) sendto(r0, &(0x7f00000002c0)="ae8e1fe10c566add28d148dacdedfd6519d7dd7d971623c00d25ebf88ce0830b8ed5dc34f80b8e48c1ce4c799a93a31309dc73bde29d971b9a0bff541ee62aa5f39be766c9d9851bf41f0b27195997275b341fc074dfab5dff1f73c5f5aeb4bb4818d1825f8190bdae8ea227c56a57c915a6b10f9d0995cf603c58108af1cde387a9a61ac24610d553229e6216c7f2ff1ec785349cb075ba399f284e22ae370fe40d574f043ee00f9d2555c7eb804448f69fb6fc390e2aef90b6c66e36b2e2b072d8d008c8be37d88558efb3daf8ed01d9917202f14df9850119309741026dd9e3b81fe6912a3759621a907a5cba80272039cb8d82f3b39f90f046ca87491775e6a6e3cc96dc8a31ae82b457bfbedbb55b885160245e01f1b42b8c3b4dd16de98e11566dea35a7686f72d8c8b48bc3fa14abf1e4b4c79a2935", 0x139, 0xffffffffffffffff, 0x0, 0x0) recvmmsg(r0, &(0x7f0000008c80)=[{{0x0, 0x0, &(0x7f0000000480)=[{&(0x7f00000001c0)=""/248, 0xf8}], 0x1}}], 0x1, 0x100, 0x0) 14:07:59 executing program 3: socketpair(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_SET_FILTER(r0, 0x89f2, &(0x7f0000000040)='sit0\x00\xf5\xf7\x9b\xe6\x81\xd7&\x80\x00`p\x00\x00 ') 14:07:59 executing program 2: r0 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000000)='net/sockstat6\x00') preadv(r0, &(0x7f0000001000)=[{&(0x7f0000000e40)=""/180, 0xb4}], 0x1, 0x0) 14:07:59 executing program 4: socket$inet6_tcp(0xa, 0x1, 0x0) clone(0x208, 0x0, 0x0, 0x0, 0x0) symlink(&(0x7f0000000100)='./file1\x00', &(0x7f0000000040)='./file1\x00') mknod(&(0x7f0000f80000)='./file0\x00', 0x1040, 0x0) execve(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) creat(&(0x7f0000000200)='\xe9\x1fq\x89Y\x1e\x923aK\x00', 0x109) execve(&(0x7f00000002c0)='\xe9\x1fq\x89Y\x1e\x923aK\x00', 0x0, 0x0) open$dir(&(0x7f00000000c0)='./file0\x00', 0x841, 0x0) clone(0x3102001ffd, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) execve(&(0x7f0000000000)='./file1\x00', 0x0, 0x0) sendmmsg(0xffffffffffffffff, &(0x7f0000005b00)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0) 14:07:59 executing program 1: dup3(0xffffffffffffffff, 0xffffffffffffff9c, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000100)=0x5) futex(&(0x7f000000cffc)=0x1, 0x800000000006, 0x0, &(0x7f0000000040)={0x77359400}, &(0x7f0000048000), 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) poll(0x0, 0x0, 0x7f) pipe(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) write(r1, &(0x7f00000001c0), 0xfffffef3) vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) r2 = creat(&(0x7f0000000700)='./bus\x00', 0x0) ftruncate(r2, 0xa48204) r3 = open(&(0x7f0000000180)='./bus\x00', 0x4000, 0x0) pread64(r3, &(0x7f0000005000)=""/4096, 0xffffffc7, 0x0) 14:07:59 executing program 3: r0 = syz_open_dev$loop(&(0x7f00000000c0)='/dev/loop#\x00', 0x0, 0x0) ioctl$BLKTRACESTART(r0, 0x1274, 0x0) 14:07:59 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f3188b070") perf_event_open(&(0x7f0000000140)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7fffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = socket$packet(0x11, 0x100000000000a, 0x300) ioctl$sock_SIOCETHTOOL(r1, 0x8946, &(0x7f0000000000)={'syz_tun\x00', &(0x7f0000002fc0)=@ethtool_link_settings={0xe}}) 14:07:59 executing program 3: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x20000000000001b, &(0x7f00000001c0)=0x400100000004, 0x4) 14:07:59 executing program 2: r0 = creat(&(0x7f0000000700)='./bus\x00', 0x0) ftruncate(r0, 0xa48204) r1 = open(&(0x7f0000000180)='./bus\x00', 0x0, 0x0) pread64(r1, &(0x7f0000005000)=""/4096, 0xffffffc7, 0x0) 14:07:59 executing program 3: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000006c0)='/dev/ptmx\x00', 0x3d, 0x0) ioctl$TCSETSW(r0, 0x5403, &(0x7f0000000100)) write$binfmt_aout(r0, &(0x7f00000000c0)=ANY=[], 0xffffff78) ioctl$TCSETS(r0, 0x40045431, &(0x7f00003b9fdc)) ioctl$TCSETA(r0, 0x5406, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x4fbe}) r1 = syz_open_pts(r0, 0x0) dup3(r1, r0, 0x0) read(r0, &(0x7f00000000c0)=""/19, 0x1b43d048) 14:07:59 executing program 0: r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000240)='./cgroup.cpu\x00\x87\xec\x80\xa4\xb5.\x17\'\x8c\x97\xcd]K\xd01@\xea\x82\xb4x\xe9\xceNC\xe4\xd6\xf1\x89\x8bIY\xbbE\xaf\xb9\x8a\x12e\x1c\xc7;\x00\xb2\xfc\xff\x03\xfb\x19\xb7\xf3\xf1\xf333\xed\x05#4\x98\xfc>_\x98\x7f\x86%\xf7\x8e\x8a\x13@\xd7\xd3#\x98\xec>\xae\x1e];\x10\xea\x93\xff\xb0\xfe\xd1\xcfU\xce\x17\xbb\xc7\x92h\x1cb\r}r\x03\f\xbe\x10Nzj\x15l\xe3\x17\xab\x8b\x8fnX\xb1DT\xa9\xf7\xfd\x17{R2P\xa55\x94R\x92;y\x8e\xe8', 0x200002, 0x0) fchdir(r0) perf_event_open(&(0x7f0000000000)={0x2, 0x70, 0x800000000000013, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) rename(&(0x7f0000000100)='./control\x00', &(0x7f0000000140)='./control\x00') 14:07:59 executing program 0: r0 = syz_open_dev$loop(&(0x7f0000000140)='/dev/loop#\x00', 0x1, 0x80) r1 = socket$inet_udplite(0x2, 0x2, 0x88) perf_event_open(&(0x7f0000000000)={0x2, 0x70, 0x800000000000013, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) dup3(r1, r0, 0x0) 14:08:00 executing program 5: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000140)={0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) seccomp(0x1, 0x7, &(0x7f0000007ff0)={0x1, &(0x7f0000004fe8)=[{0x8000000010006, 0x0, 0x0, 0x50000}]}) clock_getres(0x0, 0x0) 14:08:00 executing program 2: r0 = creat(&(0x7f0000000700)='./bus\x00', 0x0) ftruncate(r0, 0xa48204) r1 = open(&(0x7f0000000180)='./bus\x00', 0x0, 0x0) pread64(r1, &(0x7f0000005000)=""/4096, 0xffffffc7, 0x0) 14:08:00 executing program 4: socket$inet6_tcp(0xa, 0x1, 0x0) clone(0x208, 0x0, 0x0, 0x0, 0x0) symlink(&(0x7f0000000100)='./file1\x00', &(0x7f0000000040)='./file1\x00') mknod(&(0x7f0000f80000)='./file0\x00', 0x1040, 0x0) execve(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) creat(&(0x7f0000000200)='\xe9\x1fq\x89Y\x1e\x923aK\x00', 0x109) execve(&(0x7f00000002c0)='\xe9\x1fq\x89Y\x1e\x923aK\x00', 0x0, 0x0) open$dir(&(0x7f00000000c0)='./file0\x00', 0x841, 0x0) clone(0x3102001ffd, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) execve(&(0x7f0000000000)='./file1\x00', 0x0, 0x0) sendmmsg(0xffffffffffffffff, &(0x7f0000005b00)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0) 14:08:00 executing program 0: clone(0x0, 0x0, 0x0, 0x0, 0x0) r0 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000000)='children\x00') clone(0x0, 0x0, 0x0, 0x0, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000340)={0xffffffffffffffff}) sendfile(r1, r0, 0x0, 0xe0) 14:08:00 executing program 1: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f0000000040)={0xa, 0x4e22}, 0x1c) listen(r0, 0xeb) ioctl$UI_SET_PHYS(0xffffffffffffffff, 0x4008556c, 0x0) setsockopt$inet6_tcp_TLS_TX(0xffffffffffffffff, 0x6, 0x1, 0x0, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) sendto$inet6(r1, 0x0, 0x0, 0x20000004, &(0x7f0000000140)={0xa, 0x4e22}, 0x1c) readv(r1, &(0x7f0000000700)=[{&(0x7f0000000440)=""/132, 0x31}], 0x1) ioctl$RTC_ALM_SET(0xffffffffffffffff, 0x40247007, 0x0) prctl$PR_MCE_KILL_GET(0x22) timerfd_create(0x0, 0x0) r2 = accept4(r0, 0x0, 0x0, 0x0) socket$inet6_udplite(0xa, 0x2, 0x88) setsockopt$packet_fanout(0xffffffffffffffff, 0x107, 0x12, 0x0, 0x309) ioctl$FICLONE(0xffffffffffffffff, 0x40049409, 0xffffffffffffffff) ioctl$EXT4_IOC_GROUP_EXTEND(0xffffffffffffffff, 0x40046607, 0x0) ioctl$PPPIOCGFLAGS1(0xffffffffffffffff, 0x8004745a, 0x0) dup(0xffffffffffffffff) shutdown(r1, 0x1) setsockopt(r1, 0x0, 0x1, &(0x7f0000000000)="1d", 0x1) sendto$inet6(r2, &(0x7f0000000300)='A', 0x1, 0x0, 0x0, 0x0) 14:08:00 executing program 5: r0 = getpgid(0x0) prctl$PR_SET_PTRACER(0x59616d61, r0) clone(0x802102001ffe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) ptrace$setopts(0x4206, r1, 0x0, 0x0) tkill(r1, 0x38) ptrace$cont(0x18, r1, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x2}) ptrace$setregs(0xd, r1, 0x0, &(0x7f0000000080)) ptrace$cont(0x9, r1, 0x0, 0x0) 14:08:00 executing program 0: r0 = syz_open_dev$loop(&(0x7f00000000c0)='/dev/loop#\x00', 0x0, 0x0) r1 = socket$inet_udplite(0x2, 0x2, 0x88) dup3(r1, r0, 0x0) 14:08:00 executing program 4: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) clone(0x208, 0x0, 0x0, 0x0, 0x0) symlink(&(0x7f0000000100)='./file1\x00', &(0x7f0000000040)='./file1\x00') mknod(&(0x7f0000f80000)='./file0\x00', 0x1040, 0x0) execve(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r1 = dup2(r0, 0xffffffffffffffff) execve(&(0x7f00000002c0)='\xe9\x1fq\x89Y\x1e\x923aK\x00', 0x0, 0x0) open$dir(&(0x7f00000000c0)='./file0\x00', 0x841, 0x0) clone(0x3102001ffd, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) execve(&(0x7f0000000000)='./file1\x00', 0x0, 0x0) sendmmsg(r1, &(0x7f0000005b00)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0) 14:08:00 executing program 2: clone(0x802102001ffe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x38) ptrace$cont(0x18, r0, 0x0, 0x0) syz_emit_ethernet(0xee, &(0x7f0000000000)={@random="19eef6872d8b", @link_local, [], {@ipv6={0x86dd, {0x0, 0x6, "a60803", 0xb8, 0x0, 0x0, @dev, @mcast2, {[], @udp={0x4e21, 0x4e24, 0xb8, 0x0, [@guehdr={0x2, 0x6d, 0x558, 0x47, 0x100, [0x80]}, @guehdr={0x2, 0x1, 0x7986, 0x3, 0x100, [0x80]}, @guehdr={0x2, 0x7fffffff, 0xfffffffffffffffc, 0xfffffffffffffff9, 0x100, [0x80]}, @guehdr={0x1, 0x6, 0xea3b, 0x6, 0x100}, @guehdr={0x2, 0xa6, 0x1ff, 0x7f, 0x0, [0x80]}, @guehdr={0x2, 0x101, 0x6, 0x2, 0x656a4edc0fe15ee1, [0x80]}], "401045e99d71f9328cd2e34042c059bf00edd8f3f15c52c03a2aa80e1fd4a30a96b2abb955b103e581797d7452fd4a3dda4a00e8967e3a6bd4cbaa2954aa146cd39d77d4a5d64b2b34637b18d4ab4f375626ecb7a4cf315a0a22f937bc86d284ffaa827dd3d4a1b84506e1069495cc4450218ce771d4fab9c38639284ee605254870c477"}}}}}}, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x9, r0, 0x0, 0x0) 14:08:00 executing program 5: r0 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r0, &(0x7f0000000080)={0xa, 0x0, 0x0, @ipv4={[], [], @loopback}}, 0x1c) sendto(r0, 0x0, 0x0, 0x0, &(0x7f0000000000)=@un=@file={0x0, './file0\x00'}, 0x80) 14:08:00 executing program 0: clone(0x802102001ffe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x38) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$cont(0x18, r0, 0x0, 0x2) ptrace$cont(0x9, r0, 0x0, 0x0) 14:08:00 executing program 2: clone(0x802102001ffe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x38) ptrace$cont(0x18, r0, 0x0, 0x0) syz_emit_ethernet(0xee, &(0x7f0000000000)={@random="19eef6872d8b", @link_local, [], {@ipv6={0x86dd, {0x0, 0x6, "a60803", 0xb8, 0x0, 0x0, @dev, @mcast2, {[], @udp={0x4e21, 0x4e24, 0xb8, 0x0, [@guehdr={0x2, 0x6d, 0x558, 0x47, 0x100, [0x80]}, @guehdr={0x2, 0x1, 0x7986, 0x3, 0x100, [0x80]}, @guehdr={0x2, 0x7fffffff, 0xfffffffffffffffc, 0xfffffffffffffff9, 0x100, [0x80]}, @guehdr={0x1, 0x6, 0xea3b, 0x6, 0x100}, @guehdr={0x2, 0xa6, 0x1ff, 0x7f, 0x0, [0x80]}, @guehdr={0x2, 0x101, 0x6, 0x2, 0x656a4edc0fe15ee1, [0x80]}], "401045e99d71f9328cd2e34042c059bf00edd8f3f15c52c03a2aa80e1fd4a30a96b2abb955b103e581797d7452fd4a3dda4a00e8967e3a6bd4cbaa2954aa146cd39d77d4a5d64b2b34637b18d4ab4f375626ecb7a4cf315a0a22f937bc86d284ffaa827dd3d4a1b84506e1069495cc4450218ce771d4fab9c38639284ee605254870c477"}}}}}}, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x9, r0, 0x0, 0x0) 14:08:00 executing program 3: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) listen(r0, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000001040)='net/tcp6\x00') read$FUSE(r1, 0x0, 0x9a) read$FUSE(r1, &(0x7f0000005080), 0xffffffffffffff3d) 14:08:00 executing program 4: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) clone(0x208, 0x0, 0x0, 0x0, 0x0) symlink(&(0x7f0000000100)='./file1\x00', &(0x7f0000000040)='./file1\x00') mknod(&(0x7f0000f80000)='./file0\x00', 0x1040, 0x0) execve(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r1 = dup2(r0, 0xffffffffffffffff) execve(&(0x7f00000002c0)='\xe9\x1fq\x89Y\x1e\x923aK\x00', 0x0, 0x0) open$dir(&(0x7f00000000c0)='./file0\x00', 0x841, 0x0) clone(0x3102001ffd, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) execve(&(0x7f0000000000)='./file1\x00', 0x0, 0x0) sendmmsg(r1, &(0x7f0000005b00)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0) 14:08:00 executing program 1: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f0000000040)={0xa, 0x4e22}, 0x1c) listen(r0, 0xeb) ioctl$UI_SET_PHYS(0xffffffffffffffff, 0x4008556c, 0x0) setsockopt$inet6_tcp_TLS_TX(0xffffffffffffffff, 0x6, 0x1, 0x0, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) sendto$inet6(r1, 0x0, 0x0, 0x20000004, &(0x7f0000000140)={0xa, 0x4e22}, 0x1c) readv(r1, &(0x7f0000000700)=[{&(0x7f0000000440)=""/132, 0x31}], 0x1) ioctl$RTC_ALM_SET(0xffffffffffffffff, 0x40247007, 0x0) prctl$PR_MCE_KILL_GET(0x22) timerfd_create(0x0, 0x0) r2 = accept4(r0, 0x0, 0x0, 0x0) socket$inet6_udplite(0xa, 0x2, 0x88) setsockopt$packet_fanout(0xffffffffffffffff, 0x107, 0x12, 0x0, 0x309) ioctl$FICLONE(0xffffffffffffffff, 0x40049409, 0xffffffffffffffff) ioctl$EXT4_IOC_GROUP_EXTEND(0xffffffffffffffff, 0x40046607, 0x0) ioctl$PPPIOCGFLAGS1(0xffffffffffffffff, 0x8004745a, 0x0) dup(0xffffffffffffffff) shutdown(r1, 0x1) setsockopt(r1, 0x0, 0x1, &(0x7f0000000000)="1d", 0x1) sendto$inet6(r2, &(0x7f0000000300)='A', 0x1, 0x0, 0x0, 0x0) 14:08:00 executing program 5: r0 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r0, &(0x7f00000000c0)={0xa, 0x0, 0x0, @dev, 0x5}, 0x1c) sendmmsg(r0, &(0x7f0000000a40)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f00000005c0)=[{0xc, 0x1, 0x6e}], 0xc}}], 0x1, 0x0) 14:08:00 executing program 3: r0 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_int(r0, 0x29, 0x4b, 0x0, 0x389) 14:08:00 executing program 5: r0 = socket$inet6(0xa, 0x802, 0x0) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r0, 0x29, 0x20, &(0x7f0000000040)={@dev, 0x800, 0x0, 0x3}, 0x20) 14:08:00 executing program 3: r0 = socket$inet6(0xa, 0x802, 0x0) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r0, 0x29, 0x20, &(0x7f0000000080)={@loopback, 0x0, 0x2}, 0x20) 14:08:00 executing program 0: clone(0x802102001ffe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x38) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$cont(0x18, r0, 0x0, 0x2) ptrace$cont(0x9, r0, 0x0, 0x0) 14:08:01 executing program 4: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) clone(0x208, 0x0, 0x0, 0x0, 0x0) symlink(&(0x7f0000000100)='./file1\x00', &(0x7f0000000040)='./file1\x00') mknod(&(0x7f0000f80000)='./file0\x00', 0x1040, 0x0) execve(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r1 = dup2(r0, 0xffffffffffffffff) execve(&(0x7f00000002c0)='\xe9\x1fq\x89Y\x1e\x923aK\x00', 0x0, 0x0) open$dir(&(0x7f00000000c0)='./file0\x00', 0x841, 0x0) clone(0x3102001ffd, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) execve(&(0x7f0000000000)='./file1\x00', 0x0, 0x0) sendmmsg(r1, &(0x7f0000005b00)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0) 14:08:01 executing program 5: clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = memfd_create(&(0x7f0000000140)='\x00\x00\x00\x00\x03\x00\x00\x00\b\x00\x00\x00\xa5\xe3j\xe1N\xf5=\xc0\x94\x88[\x11\xea\x01%vL%\x86\xb2\x02_\x04=\xba8\x9c;\x94<\xb9\xb9\xa3\'O\xbd', 0x0) write$binfmt_elf32(r0, &(0x7f00000000c0)=ANY=[@ANYBLOB="7f454c4600000000000000000000000003000300000000000000000038000000000000000000000000002000010000000000000100000000030000000000000000000000000000000300"/88], 0x58) execveat(r0, &(0x7f0000000080)='\x00', 0x0, 0x0, 0x1000) 14:08:01 executing program 1: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f0000000040)={0xa, 0x4e22}, 0x1c) listen(r0, 0xeb) ioctl$UI_SET_PHYS(0xffffffffffffffff, 0x4008556c, 0x0) setsockopt$inet6_tcp_TLS_TX(0xffffffffffffffff, 0x6, 0x1, 0x0, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) sendto$inet6(r1, 0x0, 0x0, 0x20000004, &(0x7f0000000140)={0xa, 0x4e22}, 0x1c) readv(r1, &(0x7f0000000700)=[{&(0x7f0000000440)=""/132, 0x31}], 0x1) ioctl$RTC_ALM_SET(0xffffffffffffffff, 0x40247007, 0x0) prctl$PR_MCE_KILL_GET(0x22) timerfd_create(0x0, 0x0) r2 = accept4(r0, 0x0, 0x0, 0x0) socket$inet6_udplite(0xa, 0x2, 0x88) setsockopt$packet_fanout(0xffffffffffffffff, 0x107, 0x12, 0x0, 0x309) ioctl$FICLONE(0xffffffffffffffff, 0x40049409, 0xffffffffffffffff) ioctl$EXT4_IOC_GROUP_EXTEND(0xffffffffffffffff, 0x40046607, 0x0) ioctl$PPPIOCGFLAGS1(0xffffffffffffffff, 0x8004745a, 0x0) dup(0xffffffffffffffff) shutdown(r1, 0x1) setsockopt(r1, 0x0, 0x1, &(0x7f0000000000)="1d", 0x1) sendto$inet6(r2, &(0x7f0000000300)='A', 0x1, 0x0, 0x0, 0x0) 14:08:03 executing program 2: r0 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(0xffffffffffffffff, 0x0, 0x0) clone(0x0, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) pipe(&(0x7f00000005c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_inet_SIOCSIFPFLAGS(r1, 0x8934, &(0x7f0000004580)={'syzkaller1\x00', 0x100}) write(r2, &(0x7f00000001c0), 0xfffffef3) read(r1, &(0x7f0000000200)=""/250, 0x50c7e3e3) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = memfd_create(&(0x7f0000000380)='\x00', 0x0) ftruncate(r4, 0x1000000) setsockopt$IP_VS_SO_SET_TIMEOUT(r2, 0x0, 0x48a, &(0x7f0000000040)={0x3, 0x100000000, 0x3}, 0xc) sendfile(r0, r4, &(0x7f0000005dc0)=0x39, 0x2b) sendfile(r3, r4, 0x0, 0xfffffdef) getpid() sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x1) setsockopt$inet6_MCAST_MSFILTER(0xffffffffffffffff, 0x29, 0x30, 0x0, 0x0) ioctl$sock_SIOCGPGRP(0xffffffffffffffff, 0x8904, 0x0) recvmmsg(r2, &(0x7f00000058c0)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f0000002180)=""/64, 0x40}}, {{0x0, 0x0, &(0x7f0000004540)=[{&(0x7f0000002240)=""/255, 0xff}, {0x0}, {&(0x7f0000002440)=""/230, 0xe6}, {&(0x7f0000002540)=""/4096, 0x1000}], 0x4, &(0x7f0000004580)}, 0x8}, {{0x0, 0x0, 0x0}, 0xe1}, {{0x0, 0x0, &(0x7f0000005780)=[{0x0}, {0x0}], 0x2, &(0x7f00000057c0)=""/195, 0xc3}, 0x7}], 0x4, 0x40000143, 0x0) r5 = getpgrp(0x0) sched_setparam(r5, &(0x7f0000000340)) write$UHID_GET_REPORT_REPLY(0xffffffffffffffff, 0x0, 0x0) getsockopt$inet_int(r1, 0x0, 0x6, 0x0, 0x0) execve(&(0x7f0000000300)='./file0\x00', &(0x7f0000000800)=[&(0x7f00000004c0)='scpuset\x00', 0x0, 0x0, 0x0], 0x0) execve(&(0x7f0000004640)='./file0\x00', &(0x7f0000005c00)=[&(0x7f0000005a00)='self\\\x00', 0x0, 0x0], 0x0) sendmmsg(r0, 0x0, 0x0, 0x0) add_key$user(0x0, 0x0, &(0x7f0000000180), 0x0, 0xfffffffffffffffb) 14:08:03 executing program 5: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f0000000100)={0xa, 0x4e22}, 0x1c) writev(r0, 0x0, 0xfffffffffffffd88) listen(r0, 0xc) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) r2 = openat$pfkey(0xffffffffffffff9c, &(0x7f0000000340)='/proc/self/net/pfkey\x00', 0x10000, 0x0) mkdirat$cgroup(r2, &(0x7f0000000180)='syz1\x00', 0x1ff) r3 = memfd_create(&(0x7f00000000c0)='systemAu:object_r:crontab_c_t:s0\x00\x00\x00\x00', 0x2000000000001) write$P9_RFSYNC(r2, &(0x7f0000000240)={0x7, 0x33, 0x2}, 0x41) r4 = socket$nl_xfrm(0x10, 0x3, 0x6) sendto$inet6(r1, 0x0, 0x0, 0x20000004, &(0x7f000031e000)={0xa, 0x4e22, 0x0, @empty}, 0x1c) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000440)='./cgroup/syz1\x00', 0x200002, 0x0) fcntl$setstatus(r3, 0x4, 0x4000) fchdir(r0) r5 = creat(&(0x7f0000000140)='./bus\x00', 0x1000000000) fcntl$setstatus(r5, 0x4, 0x0) write$selinux_context(r5, &(0x7f00000003c0)='system_u:object_r:crontab_exec_t:s0\x00', 0xfffffffffffffda3) r6 = creat(&(0x7f00000004c0)='./bus\x00', 0x85) write$cgroup_type(r5, &(0x7f0000000200)='threaded\x00', 0xfffffeb3) write(r3, &(0x7f0000000480), 0xfea2) select(0x40, &(0x7f0000000040), 0x0, &(0x7f00000001c0), &(0x7f0000000280)={0x77359400}) recvfrom$inet6(r1, &(0x7f0000001840)=""/31, 0xfffffe0e, 0x100, &(0x7f0000001880)={0xa, 0x0, 0xffff}, 0x1c) ioctl$FIDEDUPERANGE(r0, 0xc0189436, &(0x7f0000000480)=ANY=[]) listen(r4, 0x1000) renameat(r6, &(0x7f0000000000)='./bus\x00', r2, 0x0) open(&(0x7f0000000380)='./bus\x00', 0x10000202, 0x0) r7 = accept4(r0, 0x0, 0x0, 0x0) write$P9_RRENAME(r2, &(0x7f0000000400)={0x7, 0x15, 0x2}, 0xfffffc2a) sendto$inet6(r7, &(0x7f00000000c0), 0xfffffdda, 0x0, 0x0, 0x0) setsockopt$inet6_tcp_buf(r3, 0x6, 0xb, &(0x7f00000002c0)="a511d63ef4328d534e043d386654e7940518d24e0000000079b352ec9c8909e90a6cdabf44890e465b1db35abfcbfc6f5c60e9a494b799dd854b9cfe0219dc6b09bcc13222fcceea199330bcc3685e0d7f579bbaeae9b3c80c207e658b9246878d0cbfa373e85f", 0x67) 14:08:03 executing program 1: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f0000000040)={0xa, 0x4e22}, 0x1c) listen(r0, 0xeb) ioctl$UI_SET_PHYS(0xffffffffffffffff, 0x4008556c, 0x0) setsockopt$inet6_tcp_TLS_TX(0xffffffffffffffff, 0x6, 0x1, 0x0, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) sendto$inet6(r1, 0x0, 0x0, 0x20000004, &(0x7f0000000140)={0xa, 0x4e22}, 0x1c) readv(r1, &(0x7f0000000700)=[{&(0x7f0000000440)=""/132, 0x31}], 0x1) ioctl$RTC_ALM_SET(0xffffffffffffffff, 0x40247007, 0x0) prctl$PR_MCE_KILL_GET(0x22) timerfd_create(0x0, 0x0) r2 = accept4(r0, 0x0, 0x0, 0x0) socket$inet6_udplite(0xa, 0x2, 0x88) setsockopt$packet_fanout(0xffffffffffffffff, 0x107, 0x12, 0x0, 0x309) ioctl$FICLONE(0xffffffffffffffff, 0x40049409, 0xffffffffffffffff) ioctl$EXT4_IOC_GROUP_EXTEND(0xffffffffffffffff, 0x40046607, 0x0) ioctl$PPPIOCGFLAGS1(0xffffffffffffffff, 0x8004745a, 0x0) dup(0xffffffffffffffff) shutdown(r1, 0x1) setsockopt(r1, 0x0, 0x1, &(0x7f0000000000)="1d", 0x1) sendto$inet6(r2, &(0x7f0000000300)='A', 0x1, 0x0, 0x0, 0x0) 14:08:03 executing program 3: clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = memfd_create(&(0x7f0000000140)='\x00\x00\x00\x00\x03\x00\x00\x00\b\x00\x00\x00\xa5\xe3j\xe1N\xf5=\xc0\x94\x88[\x11\xea\x01%vL%\x86\xb2\x02_\x04=\xba8\x9c;\x94<\xb9\xb9\xa3\'O\xbd', 0x0) write$binfmt_elf32(r0, &(0x7f00000000c0)=ANY=[@ANYBLOB="7f454c46000000000000000000000000030003"], 0x13) execveat(r0, &(0x7f0000000080)='\x00', 0x0, 0x0, 0x1000) 14:08:03 executing program 4: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) clone(0x208, 0x0, 0x0, 0x0, 0x0) symlink(&(0x7f0000000100)='./file1\x00', &(0x7f0000000040)='./file1\x00') mknod(&(0x7f0000f80000)='./file0\x00', 0x1040, 0x0) r1 = creat(&(0x7f0000000200)='\xe9\x1fq\x89Y\x1e\x923aK\x00', 0x109) r2 = dup2(r0, r1) execve(&(0x7f00000002c0)='\xe9\x1fq\x89Y\x1e\x923aK\x00', 0x0, 0x0) open$dir(&(0x7f00000000c0)='./file0\x00', 0x841, 0x0) clone(0x3102001ffd, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) execve(&(0x7f0000000000)='./file1\x00', 0x0, 0x0) sendmmsg(r2, &(0x7f0000005b00)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0) 14:08:03 executing program 3: r0 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r0, 0x29, 0x20, &(0x7f0000f68000)={@loopback, 0x800, 0x0, 0xff, 0x1}, 0x20) r1 = socket$inet6(0xa, 0x802, 0x0) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r1, 0x29, 0x20, &(0x7f0000000040)={@dev, 0x800, 0x0, 0x3}, 0x20) 14:08:03 executing program 4: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) clone(0x208, 0x0, 0x0, 0x0, 0x0) symlink(&(0x7f0000000100)='./file1\x00', &(0x7f0000000040)='./file1\x00') r1 = creat(&(0x7f0000000200)='\xe9\x1fq\x89Y\x1e\x923aK\x00', 0x109) r2 = dup2(r0, r1) execve(&(0x7f00000002c0)='\xe9\x1fq\x89Y\x1e\x923aK\x00', 0x0, 0x0) open$dir(&(0x7f00000000c0)='./file0\x00', 0x841, 0x0) clone(0x3102001ffd, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) execve(&(0x7f0000000000)='./file1\x00', 0x0, 0x0) sendmmsg(r2, &(0x7f0000005b00)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0) 14:08:04 executing program 3: getpid() rt_tgsigqueueinfo(0x0, 0x0, 0x0, 0x0) r0 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000140)='clear_refs\x00') r1 = syz_open_procfs(0x0, &(0x7f0000000080)='stat\x00') exit(0x0) sendfile(r0, r1, 0x0, 0x1) 14:08:04 executing program 0: clone(0x802102001ffe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x38) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$cont(0x18, r0, 0x0, 0x2) ptrace$cont(0x9, r0, 0x0, 0x0) 14:08:04 executing program 1: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f0000000040)={0xa, 0x4e22}, 0x1c) listen(r0, 0xeb) ioctl$UI_SET_PHYS(0xffffffffffffffff, 0x4008556c, 0x0) setsockopt$inet6_tcp_TLS_TX(0xffffffffffffffff, 0x6, 0x1, 0x0, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) sendto$inet6(r1, 0x0, 0x0, 0x20000004, &(0x7f0000000140)={0xa, 0x4e22}, 0x1c) readv(r1, &(0x7f0000000700)=[{&(0x7f0000000440)=""/132, 0x31}], 0x1) ioctl$RTC_ALM_SET(0xffffffffffffffff, 0x40247007, 0x0) prctl$PR_MCE_KILL_GET(0x22) timerfd_create(0x0, 0x0) accept4(r0, 0x0, 0x0, 0x0) socket$inet6_udplite(0xa, 0x2, 0x88) setsockopt$packet_fanout(0xffffffffffffffff, 0x107, 0x12, 0x0, 0x309) ioctl$FICLONE(0xffffffffffffffff, 0x40049409, 0xffffffffffffffff) ioctl$EXT4_IOC_GROUP_EXTEND(0xffffffffffffffff, 0x40046607, 0x0) ioctl$PPPIOCGFLAGS1(0xffffffffffffffff, 0x8004745a, 0x0) dup(0xffffffffffffffff) shutdown(r1, 0x1) setsockopt(r1, 0x0, 0x1, &(0x7f0000000000)="1d", 0x1) [ 104.123746] audit: type=1400 audit(1554214084.027:5): avc: denied { create } for pid=3123 comm="syz-executor.2" scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=netlink_generic_socket permissive=1 14:08:04 executing program 4: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) clone(0x208, 0x0, 0x0, 0x0, 0x0) r1 = creat(&(0x7f0000000200)='\xe9\x1fq\x89Y\x1e\x923aK\x00', 0x109) r2 = dup2(r0, r1) execve(&(0x7f00000002c0)='\xe9\x1fq\x89Y\x1e\x923aK\x00', 0x0, 0x0) open$dir(&(0x7f00000000c0)='./file0\x00', 0x841, 0x0) clone(0x3102001ffd, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) execve(&(0x7f0000000000)='./file1\x00', 0x0, 0x0) sendmmsg(r2, &(0x7f0000005b00)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0) 14:08:04 executing program 4: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) clone(0x208, 0x0, 0x0, 0x0, 0x0) r1 = creat(&(0x7f0000000200)='\xe9\x1fq\x89Y\x1e\x923aK\x00', 0x109) r2 = dup2(r0, r1) execve(&(0x7f00000002c0)='\xe9\x1fq\x89Y\x1e\x923aK\x00', 0x0, 0x0) open$dir(&(0x7f00000000c0)='./file0\x00', 0x841, 0x0) clone(0x3102001ffd, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) execve(&(0x7f0000000000)='./file1\x00', 0x0, 0x0) sendmmsg(r2, &(0x7f0000005b00)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0) 14:08:04 executing program 2: r0 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r0, 0x29, 0x20, &(0x7f0000f68000)={@loopback, 0x800, 0x0, 0xff, 0x1}, 0x20) [ 104.344275] audit: type=1400 audit(1554214084.247:6): avc: denied { write } for pid=3123 comm="syz-executor.2" path="socket:[11374]" dev="sockfs" ino=11374 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=netlink_generic_socket permissive=1 14:08:04 executing program 2: r0 = syz_open_procfs(0x0, &(0x7f0000000080)='statm\x00\x0f`\a/X\xeb\xd2\"\xe7F$\x06m\xae\xef\x15\x99\xb4\a\x94te\x1c\x1c\x85\xb5\xf9\xfd\x16j') r1 = syz_open_procfs(0x0, &(0x7f0000000200)='projid_map\x00') sendfile(r1, r0, 0x0, 0x1) 14:08:04 executing program 4: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) clone(0x208, 0x0, 0x0, 0x0, 0x0) r1 = creat(&(0x7f0000000200)='\xe9\x1fq\x89Y\x1e\x923aK\x00', 0x109) r2 = dup2(r0, r1) execve(&(0x7f00000002c0)='\xe9\x1fq\x89Y\x1e\x923aK\x00', 0x0, 0x0) open$dir(&(0x7f00000000c0)='./file0\x00', 0x841, 0x0) clone(0x3102001ffd, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) execve(&(0x7f0000000000)='./file1\x00', 0x0, 0x0) sendmmsg(r2, &(0x7f0000005b00)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0) 14:08:04 executing program 5: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f0000000100)={0xa, 0x4e22}, 0x1c) writev(r0, 0x0, 0xfffffffffffffd88) listen(r0, 0xc) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) r2 = openat$pfkey(0xffffffffffffff9c, &(0x7f0000000340)='/proc/self/net/pfkey\x00', 0x10000, 0x0) mkdirat$cgroup(r2, &(0x7f0000000180)='syz1\x00', 0x1ff) r3 = memfd_create(&(0x7f00000000c0)='systemAu:object_r:crontab_c_t:s0\x00\x00\x00\x00', 0x2000000000001) write$P9_RFSYNC(r2, &(0x7f0000000240)={0x7, 0x33, 0x2}, 0x41) r4 = socket$nl_xfrm(0x10, 0x3, 0x6) sendto$inet6(r1, 0x0, 0x0, 0x20000004, &(0x7f000031e000)={0xa, 0x4e22, 0x0, @empty}, 0x1c) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000440)='./cgroup/syz1\x00', 0x200002, 0x0) fcntl$setstatus(r3, 0x4, 0x4000) fchdir(r0) r5 = creat(&(0x7f0000000140)='./bus\x00', 0x1000000000) fcntl$setstatus(r5, 0x4, 0x0) write$selinux_context(r5, &(0x7f00000003c0)='system_u:object_r:crontab_exec_t:s0\x00', 0xfffffffffffffda3) r6 = creat(&(0x7f00000004c0)='./bus\x00', 0x85) write$cgroup_type(r5, &(0x7f0000000200)='threaded\x00', 0xfffffeb3) write(r3, &(0x7f0000000480), 0xfea2) select(0x40, &(0x7f0000000040), 0x0, &(0x7f00000001c0), &(0x7f0000000280)={0x77359400}) recvfrom$inet6(r1, &(0x7f0000001840)=""/31, 0xfffffe0e, 0x100, &(0x7f0000001880)={0xa, 0x0, 0xffff}, 0x1c) ioctl$FIDEDUPERANGE(r0, 0xc0189436, &(0x7f0000000480)=ANY=[]) listen(r4, 0x1000) renameat(r6, &(0x7f0000000000)='./bus\x00', r2, 0x0) open(&(0x7f0000000380)='./bus\x00', 0x10000202, 0x0) r7 = accept4(r0, 0x0, 0x0, 0x0) write$P9_RRENAME(r2, &(0x7f0000000400)={0x7, 0x15, 0x2}, 0xfffffc2a) sendto$inet6(r7, &(0x7f00000000c0), 0xfffffdda, 0x0, 0x0, 0x0) setsockopt$inet6_tcp_buf(r3, 0x6, 0xb, &(0x7f00000002c0)="a511d63ef4328d534e043d386654e7940518d24e0000000079b352ec9c8909e90a6cdabf44890e465b1db35abfcbfc6f5c60e9a494b799dd854b9cfe0219dc6b09bcc13222fcceea199330bcc3685e0d7f579bbaeae9b3c80c207e658b9246878d0cbfa373e85f", 0x67) 14:08:04 executing program 2: r0 = socket$packet(0x11, 0x2, 0x300) getsockopt$packet_int(r0, 0x107, 0x8, 0x0, &(0x7f0000000080)=0x2c) 14:08:04 executing program 4: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) symlink(&(0x7f0000000100)='./file1\x00', &(0x7f0000000040)='./file1\x00') r1 = creat(&(0x7f0000000200)='\xe9\x1fq\x89Y\x1e\x923aK\x00', 0x109) r2 = dup2(r0, r1) execve(&(0x7f00000002c0)='\xe9\x1fq\x89Y\x1e\x923aK\x00', 0x0, 0x0) open$dir(&(0x7f00000000c0)='./file0\x00', 0x841, 0x0) clone(0x3102001ffd, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) execve(&(0x7f0000000000)='./file1\x00', 0x0, 0x0) sendmmsg(r2, &(0x7f0000005b00)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0) 14:08:04 executing program 1: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f0000000040)={0xa, 0x4e22}, 0x1c) listen(r0, 0xeb) ioctl$UI_SET_PHYS(0xffffffffffffffff, 0x4008556c, 0x0) setsockopt$inet6_tcp_TLS_TX(0xffffffffffffffff, 0x6, 0x1, 0x0, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) sendto$inet6(r1, 0x0, 0x0, 0x20000004, &(0x7f0000000140)={0xa, 0x4e22}, 0x1c) readv(r1, &(0x7f0000000700)=[{&(0x7f0000000440)=""/132, 0x31}], 0x1) ioctl$RTC_ALM_SET(0xffffffffffffffff, 0x40247007, 0x0) prctl$PR_MCE_KILL_GET(0x22) timerfd_create(0x0, 0x0) accept4(r0, 0x0, 0x0, 0x0) socket$inet6_udplite(0xa, 0x2, 0x88) setsockopt$packet_fanout(0xffffffffffffffff, 0x107, 0x12, 0x0, 0x309) ioctl$FICLONE(0xffffffffffffffff, 0x40049409, 0xffffffffffffffff) ioctl$EXT4_IOC_GROUP_EXTEND(0xffffffffffffffff, 0x40046607, 0x0) ioctl$PPPIOCGFLAGS1(0xffffffffffffffff, 0x8004745a, 0x0) dup(0xffffffffffffffff) shutdown(r1, 0x1) setsockopt(r1, 0x0, 0x1, &(0x7f0000000000)="1d", 0x1) 14:08:04 executing program 3: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f0000000100)={0xa, 0x4e22}, 0x1c) writev(r0, 0x0, 0xfffffffffffffd88) listen(r0, 0xc) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) r2 = openat$pfkey(0xffffffffffffff9c, &(0x7f0000000340)='/proc/self/net/pfkey\x00', 0x10000, 0x0) mkdirat$cgroup(r2, &(0x7f0000000180)='syz1\x00', 0x1ff) r3 = memfd_create(&(0x7f00000000c0)='systemAu:object_r:crontab_c_t:s0\x00\x00\x00\x00', 0x2000000000001) write$P9_RFSYNC(r2, &(0x7f0000000240)={0x7, 0x33, 0x2}, 0x41) r4 = socket$nl_xfrm(0x10, 0x3, 0x6) sendto$inet6(r1, 0x0, 0x0, 0x20000004, &(0x7f000031e000)={0xa, 0x4e22, 0x0, @empty}, 0x1c) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000440)='./cgroup/syz1\x00', 0x200002, 0x0) fcntl$setstatus(r3, 0x4, 0x4000) fchdir(r0) r5 = creat(&(0x7f0000000140)='./bus\x00', 0x1000000000) fcntl$setstatus(r5, 0x4, 0x0) write$selinux_context(r5, &(0x7f00000003c0)='system_u:object_r:crontab_exec_t:s0\x00', 0xfffffffffffffda3) r6 = creat(&(0x7f00000004c0)='./bus\x00', 0x85) write$cgroup_type(r5, &(0x7f0000000200)='threaded\x00', 0xfffffeb3) write(r3, &(0x7f0000000480), 0xfea2) select(0x40, &(0x7f0000000040), 0x0, &(0x7f00000001c0), &(0x7f0000000280)={0x77359400}) recvfrom$inet6(r1, &(0x7f0000001840)=""/31, 0xfffffe0e, 0x100, &(0x7f0000001880)={0xa, 0x0, 0xffff}, 0x1c) ioctl$FIDEDUPERANGE(r0, 0xc0189436, &(0x7f0000000480)=ANY=[]) listen(r4, 0x1000) renameat(r6, &(0x7f0000000000)='./bus\x00', r2, 0x0) open(&(0x7f0000000380)='./bus\x00', 0x10000202, 0x0) r7 = accept4(r0, 0x0, 0x0, 0x0) write$P9_RRENAME(r2, &(0x7f0000000400)={0x7, 0x15, 0x2}, 0xfffffc2a) sendto$inet6(r7, &(0x7f00000000c0), 0xfffffdda, 0x0, 0x0, 0x0) setsockopt$inet6_tcp_buf(r3, 0x6, 0xb, &(0x7f00000002c0)="a511d63ef4328d534e043d386654e7940518d24e0000000079b352ec9c8909e90a6cdabf44890e465b1db35abfcbfc6f5c60e9a494b799dd854b9cfe0219dc6b09bcc13222fcceea199330bcc3685e0d7f579bbaeae9b3c80c207e658b9246878d0cbfa373e85f", 0x67) 14:08:07 executing program 0: clone(0x802102001ffe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x38) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$cont(0x18, r0, 0x0, 0x2) ptrace$cont(0x9, r0, 0x0, 0x0) 14:08:07 executing program 4: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) symlink(&(0x7f0000000100)='./file1\x00', &(0x7f0000000040)='./file1\x00') r1 = creat(&(0x7f0000000200)='\xe9\x1fq\x89Y\x1e\x923aK\x00', 0x109) r2 = dup2(r0, r1) execve(&(0x7f00000002c0)='\xe9\x1fq\x89Y\x1e\x923aK\x00', 0x0, 0x0) open$dir(&(0x7f00000000c0)='./file0\x00', 0x841, 0x0) clone(0x3102001ffd, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) execve(&(0x7f0000000000)='./file1\x00', 0x0, 0x0) sendmmsg(r2, &(0x7f0000005b00)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0) 14:08:07 executing program 2: pipe(&(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x4240a2a0) socketpair$unix(0x1, 0x200000005, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) bind$inet(r2, &(0x7f0000000140)={0x2, 0x0, @local}, 0x10) write$P9_ROPEN(r1, &(0x7f0000000100)={0x18}, 0x18) connect$inet(r2, &(0x7f0000000040)={0x2, 0x0, @multicast1}, 0x10) splice(r0, 0x0, r2, 0x0, 0x10005, 0x0) 14:08:07 executing program 1: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f0000000040)={0xa, 0x4e22}, 0x1c) listen(r0, 0xeb) ioctl$UI_SET_PHYS(0xffffffffffffffff, 0x4008556c, 0x0) setsockopt$inet6_tcp_TLS_TX(0xffffffffffffffff, 0x6, 0x1, 0x0, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) sendto$inet6(r1, 0x0, 0x0, 0x20000004, &(0x7f0000000140)={0xa, 0x4e22}, 0x1c) readv(r1, &(0x7f0000000700)=[{&(0x7f0000000440)=""/132, 0x31}], 0x1) ioctl$RTC_ALM_SET(0xffffffffffffffff, 0x40247007, 0x0) prctl$PR_MCE_KILL_GET(0x22) timerfd_create(0x0, 0x0) accept4(r0, 0x0, 0x0, 0x0) socket$inet6_udplite(0xa, 0x2, 0x88) setsockopt$packet_fanout(0xffffffffffffffff, 0x107, 0x12, 0x0, 0x309) ioctl$FICLONE(0xffffffffffffffff, 0x40049409, 0xffffffffffffffff) ioctl$EXT4_IOC_GROUP_EXTEND(0xffffffffffffffff, 0x40046607, 0x0) ioctl$PPPIOCGFLAGS1(0xffffffffffffffff, 0x8004745a, 0x0) dup(0xffffffffffffffff) shutdown(r1, 0x1) setsockopt(r1, 0x0, 0x1, &(0x7f0000000000)="1d", 0x1) 14:08:07 executing program 5: r0 = eventfd2(0x0, 0x0) fremovexattr(0xffffffffffffffff, 0x0) r1 = dup(r0) pwrite64(0xffffffffffffffff, 0x0, 0x0, 0x0) ioctl$TCSETSW(0xffffffffffffffff, 0x5403, 0x0) getpeername$netlink(0xffffffffffffffff, 0x0, 0x0) write$P9_RWALK(r1, &(0x7f00000006c0)={0x9}, 0x9) 14:08:07 executing program 3: sendmsg(0xffffffffffffffff, &(0x7f0000000380)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000000), 0x128}, 0x0) 14:08:07 executing program 3: r0 = socket$inet6_udp(0xa, 0x2, 0x0) connect$inet6(r0, &(0x7f0000000180)={0xa, 0x0, 0x0, @initdev, 0x480000000000000a}, 0x1c) connect$inet6(r0, &(0x7f0000000000)={0xa, 0x0, 0x0, @ipv4={[], [], @multicast1}}, 0x1c) 14:08:07 executing program 5: clone(0x84007ff9, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = getpid() mknod(&(0x7f00000000c0)='./file0\x00', 0x1042, 0x0) execve(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) ptrace(0x10, r0) creat(&(0x7f0000000100)='./file0\x00', 0x0) 14:08:07 executing program 3: seccomp(0x1, 0x0, &(0x7f0000000180)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0xffffff7f7ffffffe}]}) setpriority(0x0, 0x0, 0x0) 14:08:07 executing program 4: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) symlink(&(0x7f0000000100)='./file1\x00', &(0x7f0000000040)='./file1\x00') r1 = creat(&(0x7f0000000200)='\xe9\x1fq\x89Y\x1e\x923aK\x00', 0x109) r2 = dup2(r0, r1) execve(&(0x7f00000002c0)='\xe9\x1fq\x89Y\x1e\x923aK\x00', 0x0, 0x0) open$dir(&(0x7f00000000c0)='./file0\x00', 0x841, 0x0) clone(0x3102001ffd, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) execve(&(0x7f0000000000)='./file1\x00', 0x0, 0x0) sendmmsg(r2, &(0x7f0000005b00)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0) 14:08:07 executing program 3: 14:08:07 executing program 3: 14:08:10 executing program 0: clone(0x802102001ffe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x38) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$cont(0x9, r0, 0x0, 0x0) 14:08:10 executing program 3: 14:08:10 executing program 4: clone(0x208, 0x0, 0x0, 0x0, 0x0) symlink(&(0x7f0000000100)='./file1\x00', &(0x7f0000000040)='./file1\x00') r0 = creat(&(0x7f0000000200)='\xe9\x1fq\x89Y\x1e\x923aK\x00', 0x109) r1 = dup2(0xffffffffffffffff, r0) execve(&(0x7f00000002c0)='\xe9\x1fq\x89Y\x1e\x923aK\x00', 0x0, 0x0) open$dir(&(0x7f00000000c0)='./file0\x00', 0x841, 0x0) clone(0x3102001ffd, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) execve(&(0x7f0000000000)='./file1\x00', 0x0, 0x0) sendmmsg(r1, &(0x7f0000005b00)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0) 14:08:10 executing program 5: r0 = gettid() socketpair$unix(0x1, 0x80000000000005, 0x0, &(0x7f0000029000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$int_in(r1, 0x5452, &(0x7f0000fc3000)=0x1) fcntl$setsig(r1, 0xa, 0x12) poll(&(0x7f0000000080)=[{r2}], 0x1, 0xfffffffffffffff8) r3 = gettid() r4 = dup2(r1, r2) fcntl$setown(r4, 0x8, r0) tkill(r3, 0x16) 14:08:10 executing program 1: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f0000000040)={0xa, 0x4e22}, 0x1c) listen(r0, 0xeb) ioctl$UI_SET_PHYS(0xffffffffffffffff, 0x4008556c, 0x0) setsockopt$inet6_tcp_TLS_TX(0xffffffffffffffff, 0x6, 0x1, 0x0, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) sendto$inet6(r1, 0x0, 0x0, 0x20000004, &(0x7f0000000140)={0xa, 0x4e22}, 0x1c) readv(r1, &(0x7f0000000700)=[{&(0x7f0000000440)=""/132, 0x31}], 0x1) ioctl$RTC_ALM_SET(0xffffffffffffffff, 0x40247007, 0x0) prctl$PR_MCE_KILL_GET(0x22) timerfd_create(0x0, 0x0) r2 = accept4(r0, 0x0, 0x0, 0x0) socket$inet6_udplite(0xa, 0x2, 0x88) setsockopt$packet_fanout(0xffffffffffffffff, 0x107, 0x12, 0x0, 0x309) ioctl$FICLONE(0xffffffffffffffff, 0x40049409, 0xffffffffffffffff) ioctl$EXT4_IOC_GROUP_EXTEND(0xffffffffffffffff, 0x40046607, 0x0) ioctl$PPPIOCGFLAGS1(0xffffffffffffffff, 0x8004745a, 0x0) dup(0xffffffffffffffff) shutdown(r1, 0x1) sendto$inet6(r2, &(0x7f0000000300)='A', 0x1, 0x0, 0x0, 0x0) 14:08:10 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ptmx\x00', 0x3a, 0x0) write$binfmt_aout(r0, &(0x7f00000000c0)=ANY=[], 0xff2e) ioctl$TCSETS(r0, 0x40045431, &(0x7f00003b9fdc)) r1 = syz_open_pts(r0, 0x0) r2 = dup3(r1, r0, 0x0) ioctl$TCSETSF(r0, 0x5404, &(0x7f0000000000)) readv(r2, &(0x7f0000001580)=[{&(0x7f0000000400)=""/181, 0xb5}], 0x1) 14:08:10 executing program 3: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) sendmmsg$unix(r1, &(0x7f00000bd000), 0x2ac, 0x0) setsockopt$sock_int(r1, 0x1, 0x7, 0x0, 0x0) write$binfmt_script(r1, 0x0, 0x94) close(r0) 14:08:10 executing program 4: clone(0x208, 0x0, 0x0, 0x0, 0x0) symlink(&(0x7f0000000100)='./file1\x00', &(0x7f0000000040)='./file1\x00') r0 = creat(&(0x7f0000000200)='\xe9\x1fq\x89Y\x1e\x923aK\x00', 0x109) r1 = dup2(0xffffffffffffffff, r0) execve(&(0x7f00000002c0)='\xe9\x1fq\x89Y\x1e\x923aK\x00', 0x0, 0x0) open$dir(&(0x7f00000000c0)='./file0\x00', 0x841, 0x0) clone(0x3102001ffd, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) execve(&(0x7f0000000000)='./file1\x00', 0x0, 0x0) sendmmsg(r1, &(0x7f0000005b00)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0) 14:08:10 executing program 4: clone(0x208, 0x0, 0x0, 0x0, 0x0) symlink(&(0x7f0000000100)='./file1\x00', &(0x7f0000000040)='./file1\x00') r0 = creat(&(0x7f0000000200)='\xe9\x1fq\x89Y\x1e\x923aK\x00', 0x109) r1 = dup2(0xffffffffffffffff, r0) execve(&(0x7f00000002c0)='\xe9\x1fq\x89Y\x1e\x923aK\x00', 0x0, 0x0) open$dir(&(0x7f00000000c0)='./file0\x00', 0x841, 0x0) clone(0x3102001ffd, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) execve(&(0x7f0000000000)='./file1\x00', 0x0, 0x0) sendmmsg(r1, &(0x7f0000005b00)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0) 14:08:10 executing program 4: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) clone(0x0, 0x0, 0x0, 0x0, 0x0) symlink(&(0x7f0000000100)='./file1\x00', &(0x7f0000000040)='./file1\x00') r1 = creat(&(0x7f0000000200)='\xe9\x1fq\x89Y\x1e\x923aK\x00', 0x109) r2 = dup2(r0, r1) execve(&(0x7f00000002c0)='\xe9\x1fq\x89Y\x1e\x923aK\x00', 0x0, 0x0) open$dir(&(0x7f00000000c0)='./file0\x00', 0x841, 0x0) clone(0x3102001ffd, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) execve(&(0x7f0000000000)='./file1\x00', 0x0, 0x0) sendmmsg(r2, &(0x7f0000005b00)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0) 14:08:10 executing program 1: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f0000000040)={0xa, 0x4e22}, 0x1c) listen(r0, 0xeb) ioctl$UI_SET_PHYS(0xffffffffffffffff, 0x4008556c, 0x0) setsockopt$inet6_tcp_TLS_TX(0xffffffffffffffff, 0x6, 0x1, 0x0, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) sendto$inet6(r1, 0x0, 0x0, 0x20000004, &(0x7f0000000140)={0xa, 0x4e22}, 0x1c) readv(r1, &(0x7f0000000700)=[{&(0x7f0000000440)=""/132, 0x31}], 0x1) ioctl$RTC_ALM_SET(0xffffffffffffffff, 0x40247007, 0x0) prctl$PR_MCE_KILL_GET(0x22) timerfd_create(0x0, 0x0) r2 = accept4(r0, 0x0, 0x0, 0x0) socket$inet6_udplite(0xa, 0x2, 0x88) setsockopt$packet_fanout(0xffffffffffffffff, 0x107, 0x12, 0x0, 0x309) ioctl$FICLONE(0xffffffffffffffff, 0x40049409, 0xffffffffffffffff) ioctl$EXT4_IOC_GROUP_EXTEND(0xffffffffffffffff, 0x40046607, 0x0) ioctl$PPPIOCGFLAGS1(0xffffffffffffffff, 0x8004745a, 0x0) dup(0xffffffffffffffff) shutdown(r1, 0x1) sendto$inet6(r2, &(0x7f0000000300)='A', 0x1, 0x0, 0x0, 0x0) 14:08:10 executing program 3: 14:08:13 executing program 0: clone(0x802102001ffe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x38) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$cont(0x9, r0, 0x0, 0x0) 14:08:13 executing program 3: 14:08:13 executing program 4: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) clone(0x0, 0x0, 0x0, 0x0, 0x0) symlink(0x0, &(0x7f0000000040)='./file1\x00') r1 = creat(&(0x7f0000000200)='\xe9\x1fq\x89Y\x1e\x923aK\x00', 0x109) r2 = dup2(r0, r1) execve(&(0x7f00000002c0)='\xe9\x1fq\x89Y\x1e\x923aK\x00', 0x0, 0x0) open$dir(&(0x7f00000000c0)='./file0\x00', 0x841, 0x0) clone(0x3102001ffd, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) execve(&(0x7f0000000000)='./file1\x00', 0x0, 0x0) sendmmsg(r2, &(0x7f0000005b00)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0) 14:08:13 executing program 1: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f0000000040)={0xa, 0x4e22}, 0x1c) listen(r0, 0xeb) ioctl$UI_SET_PHYS(0xffffffffffffffff, 0x4008556c, 0x0) setsockopt$inet6_tcp_TLS_TX(0xffffffffffffffff, 0x6, 0x1, 0x0, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) sendto$inet6(r1, 0x0, 0x0, 0x20000004, &(0x7f0000000140)={0xa, 0x4e22}, 0x1c) readv(r1, &(0x7f0000000700)=[{&(0x7f0000000440)=""/132, 0x31}], 0x1) ioctl$RTC_ALM_SET(0xffffffffffffffff, 0x40247007, 0x0) prctl$PR_MCE_KILL_GET(0x22) timerfd_create(0x0, 0x0) r2 = accept4(r0, 0x0, 0x0, 0x0) socket$inet6_udplite(0xa, 0x2, 0x88) setsockopt$packet_fanout(0xffffffffffffffff, 0x107, 0x12, 0x0, 0x309) ioctl$FICLONE(0xffffffffffffffff, 0x40049409, 0xffffffffffffffff) ioctl$EXT4_IOC_GROUP_EXTEND(0xffffffffffffffff, 0x40046607, 0x0) ioctl$PPPIOCGFLAGS1(0xffffffffffffffff, 0x8004745a, 0x0) dup(0xffffffffffffffff) shutdown(r1, 0x1) sendto$inet6(r2, &(0x7f0000000300)='A', 0x1, 0x0, 0x0, 0x0) 14:08:13 executing program 2: 14:08:13 executing program 5: 14:08:13 executing program 3: 14:08:13 executing program 2: 14:08:13 executing program 5: 14:08:13 executing program 3: creat(&(0x7f0000000000)='./file0\x00', 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) fchownat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x0, 0x0, 0x0) 14:08:13 executing program 5: r0 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000280)='/dev/loop-control\x00', 0x0, 0x0) ioctl$LOOP_CTL_REMOVE(r0, 0x4c81, 0x0) ioctl$LOOP_CTL_ADD(r0, 0x4c80, 0x0) 14:08:13 executing program 2: clone(0x8000, &(0x7f0000000000), 0x0, 0x0, 0x0) 14:08:16 executing program 0: clone(0x802102001ffe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x38) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$cont(0x9, r0, 0x0, 0x0) 14:08:16 executing program 4: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) clone(0x0, 0x0, 0x0, 0x0, 0x0) symlink(0x0, &(0x7f0000000040)='./file1\x00') r1 = creat(&(0x7f0000000200)='\xe9\x1fq\x89Y\x1e\x923aK\x00', 0x109) r2 = dup2(r0, r1) execve(&(0x7f00000002c0)='\xe9\x1fq\x89Y\x1e\x923aK\x00', 0x0, 0x0) open$dir(&(0x7f00000000c0)='./file0\x00', 0x841, 0x0) clone(0x3102001ffd, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) execve(&(0x7f0000000000)='./file1\x00', 0x0, 0x0) sendmmsg(r2, &(0x7f0000005b00)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0) 14:08:16 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") r1 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x1000)=nil, 0x1000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffd49, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000180)={0x18, 0x0, &(0x7f00000006c0)=[@increfs, @clear_death], 0x0, 0x0, 0x0}) openat$selinux_checkreqprot(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/checkreqprot\x00', 0x0, 0x0) 14:08:16 executing program 2: r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000100)='./cgroup.cpu\x00', 0x200002, 0x0) fchdir(r0) r1 = open(&(0x7f0000000040)='./bus\x00', 0x4000, 0x0) pread64(r1, &(0x7f0000005000)=""/4096, 0xffffffc7, 0x0) 14:08:16 executing program 1: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f0000000040)={0xa, 0x4e22}, 0x1c) listen(r0, 0xeb) ioctl$UI_SET_PHYS(0xffffffffffffffff, 0x4008556c, 0x0) setsockopt$inet6_tcp_TLS_TX(0xffffffffffffffff, 0x6, 0x1, 0x0, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) sendto$inet6(r1, 0x0, 0x0, 0x20000004, &(0x7f0000000140)={0xa, 0x4e22}, 0x1c) readv(r1, &(0x7f0000000700)=[{&(0x7f0000000440)=""/132, 0x31}], 0x1) ioctl$RTC_ALM_SET(0xffffffffffffffff, 0x40247007, 0x0) prctl$PR_MCE_KILL_GET(0x22) timerfd_create(0x0, 0x0) r2 = accept4(r0, 0x0, 0x0, 0x0) socket$inet6_udplite(0xa, 0x2, 0x88) setsockopt$packet_fanout(0xffffffffffffffff, 0x107, 0x12, 0x0, 0x309) ioctl$FICLONE(0xffffffffffffffff, 0x40049409, 0xffffffffffffffff) ioctl$EXT4_IOC_GROUP_EXTEND(0xffffffffffffffff, 0x40046607, 0x0) ioctl$PPPIOCGFLAGS1(0xffffffffffffffff, 0x8004745a, 0x0) dup(0xffffffffffffffff) setsockopt(r1, 0x0, 0x1, &(0x7f0000000000)="1d", 0x1) sendto$inet6(r2, &(0x7f0000000300)='A', 0x1, 0x0, 0x0, 0x0) 14:08:16 executing program 5: r0 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000280)='/dev/loop-control\x00', 0x0, 0x0) ioctl$LOOP_CTL_REMOVE(r0, 0x4c81, 0x0) ioctl$LOOP_CTL_ADD(r0, 0x4c80, 0x0) 14:08:16 executing program 2: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_SIOCETHTOOL(r0, 0x8946, &(0x7f0000000040)={'bond_slave_0\x00', &(0x7f0000000080)=@ethtool_cmd={0x17}}) [ 116.315143] audit: type=1400 audit(1554214096.227:7): avc: denied { set_context_mgr } for pid=3401 comm="syz-executor.3" scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=binder permissive=1 [ 116.341588] audit: type=1400 audit(1554214096.257:8): avc: denied { call } for pid=3401 comm="syz-executor.3" scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=binder permissive=1 14:08:16 executing program 4: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) clone(0x0, 0x0, 0x0, 0x0, 0x0) symlink(0x0, &(0x7f0000000040)='./file1\x00') r1 = creat(&(0x7f0000000200)='\xe9\x1fq\x89Y\x1e\x923aK\x00', 0x109) r2 = dup2(r0, r1) execve(&(0x7f00000002c0)='\xe9\x1fq\x89Y\x1e\x923aK\x00', 0x0, 0x0) open$dir(&(0x7f00000000c0)='./file0\x00', 0x841, 0x0) clone(0x3102001ffd, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) execve(&(0x7f0000000000)='./file1\x00', 0x0, 0x0) sendmmsg(r2, &(0x7f0000005b00)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0) [ 116.365712] audit: type=1400 audit(1554214096.277:9): avc: denied { transfer } for pid=3401 comm="syz-executor.3" scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=binder permissive=1 [ 116.388969] binder: 3401:3408 ioctl c0306201 20000440 returned -14 [ 116.391415] binder: 3401:3421 BC_CLEAR_DEATH_NOTIFICATION death notification not active [ 116.417119] binder_alloc: binder_alloc_mmap_handler: 3401 20001000-20002000 already mapped failed -16 [ 116.427539] binder: BINDER_SET_CONTEXT_MGR already set [ 116.432957] binder: 3401:3408 ioctl 40046207 0 returned -16 [ 116.438994] binder_alloc: 3401: binder_alloc_buf, no vma [ 116.451723] binder: 3401:3421 transaction failed 29189/-3, size 24-8 line 3137 14:08:16 executing program 5: r0 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000080)='/dev/rtc0\x00', 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$RTC_WKALM_RD(r0, 0x80287010, 0x0) 14:08:16 executing program 2: r0 = gettid() ptrace$peekuser(0x3, 0x0, 0x0) timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) write$P9_RMKDIR(0xffffffffffffffff, 0x0, 0xffffffffffffff41) timer_settime(0x0, 0x0, &(0x7f0000000080)={{0x0, 0x1c9c380}, {0x0, 0x9}}, 0x0) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000000)) accept(0xffffffffffffffff, 0x0, 0x0) ioctl$sock_inet_SIOCSIFADDR(0xffffffffffffffff, 0x8916, 0x0) syz_open_procfs$namespace(0x0, 0x0) prctl$PR_CAPBSET_DROP(0x18, 0x0) tkill(r0, 0x1000000000016) [ 116.472658] binder: 3401:3421 ioctl c0306201 20000440 returned -14 [ 116.479525] binder: 3401:3408 BC_CLEAR_DEATH_NOTIFICATION death notification not active [ 116.488439] binder: send failed reply for transaction 3 to 3401:3408 [ 116.505467] binder: undelivered TRANSACTION_COMPLETE 14:08:16 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") r1 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x1000)=nil, 0x1000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffd49, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000180)={0x18, 0x0, &(0x7f00000006c0)=[@increfs, @clear_death], 0x0, 0x0, 0x0}) openat$selinux_checkreqprot(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/checkreqprot\x00', 0x0, 0x0) [ 116.520870] binder: undelivered TRANSACTION_ERROR: 29189 14:08:16 executing program 5: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f00001fefe4)={0xa, 0x4e22}, 0x1c) listen(r0, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) sendto$inet6(r1, 0x0, 0x0, 0x20000004, &(0x7f0000000080)={0xa, 0x4e22, 0x0, @dev={0xfe, 0x80, [], 0x19}, 0x5}, 0x1c) [ 116.550945] binder: undelivered TRANSACTION_ERROR: 29189 [ 116.594132] binder: 3443:3444 ioctl c0306201 20000440 returned -14 [ 116.604815] binder: 3443:3444 BC_CLEAR_DEATH_NOTIFICATION death notification not active [ 116.618406] binder: release 3443:3444 transaction 10 out, still active [ 116.628360] binder: unexpected work type, 4, not freed [ 116.634899] binder: undelivered TRANSACTION_COMPLETE [ 116.640480] binder: send failed reply for transaction 10, target dead [ 117.394857] syz-executor.5 (3448) used greatest stack depth: 22960 bytes left INIT: Id "3" respawning too fast: disabled for 5 minutes INIT: Id "4" respawning too fast: disabled for 5 minutes INIT: Id "1" respawning too fast: disabled for 5 minutes INIT: Id "2" respawning too fast: disabled for 5 minutes INIT: Id "6" respawning too fast: disabled for 5 minutes INIT: Id "5" respawning too fast: disabled for 5 minutes 14:08:19 executing program 0: clone(0x802102001ffe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x38) ptrace$cont(0x18, r0, 0x0, 0x2) ptrace$cont(0x9, r0, 0x0, 0x0) 14:08:19 executing program 4: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) clone(0x0, 0x0, 0x0, 0x0, 0x0) symlink(&(0x7f0000000100)='./file1\x00', 0x0) r1 = creat(&(0x7f0000000200)='\xe9\x1fq\x89Y\x1e\x923aK\x00', 0x109) r2 = dup2(r0, r1) execve(&(0x7f00000002c0)='\xe9\x1fq\x89Y\x1e\x923aK\x00', 0x0, 0x0) open$dir(&(0x7f00000000c0)='./file0\x00', 0x841, 0x0) clone(0x3102001ffd, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) execve(&(0x7f0000000000)='./file1\x00', 0x0, 0x0) sendmmsg(r2, &(0x7f0000005b00)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0) 14:08:19 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") r1 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x1000)=nil, 0x1000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffd49, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000180)={0x18, 0x0, &(0x7f00000006c0)=[@increfs, @clear_death], 0x0, 0x0, 0x0}) openat$selinux_checkreqprot(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/checkreqprot\x00', 0x0, 0x0) 14:08:19 executing program 2: poll(&(0x7f00000000c0)=[{}], 0x1, 0x0) 14:08:19 executing program 1: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f0000000040)={0xa, 0x4e22}, 0x1c) listen(r0, 0xeb) ioctl$UI_SET_PHYS(0xffffffffffffffff, 0x4008556c, 0x0) setsockopt$inet6_tcp_TLS_TX(0xffffffffffffffff, 0x6, 0x1, 0x0, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) sendto$inet6(r1, 0x0, 0x0, 0x20000004, &(0x7f0000000140)={0xa, 0x4e22}, 0x1c) readv(r1, &(0x7f0000000700)=[{&(0x7f0000000440)=""/132, 0x31}], 0x1) ioctl$RTC_ALM_SET(0xffffffffffffffff, 0x40247007, 0x0) prctl$PR_MCE_KILL_GET(0x22) timerfd_create(0x0, 0x0) r2 = accept4(r0, 0x0, 0x0, 0x0) socket$inet6_udplite(0xa, 0x2, 0x88) setsockopt$packet_fanout(0xffffffffffffffff, 0x107, 0x12, 0x0, 0x309) ioctl$FICLONE(0xffffffffffffffff, 0x40049409, 0xffffffffffffffff) ioctl$EXT4_IOC_GROUP_EXTEND(0xffffffffffffffff, 0x40046607, 0x0) ioctl$PPPIOCGFLAGS1(0xffffffffffffffff, 0x8004745a, 0x0) dup(0xffffffffffffffff) setsockopt(r1, 0x0, 0x1, &(0x7f0000000000)="1d", 0x1) sendto$inet6(r2, &(0x7f0000000300)='A', 0x1, 0x0, 0x0, 0x0) 14:08:19 executing program 5: r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000200)='./cgroup\x00\f#\x9f\xd0\x85\xac\xc4\x9b\x81-\xb3\xd7=C\xea', 0x200002, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000180)='./bus\x00', 0x0) r2 = open(&(0x7f0000000140)='./bus\x00', 0x0, 0x0) mmap(&(0x7f0000001000/0x4000)=nil, 0x4000, 0x0, 0x11, r2, 0x0) fcntl$setstatus(r1, 0x4, 0x44040) io_setup(0x2, &(0x7f00000004c0)=0x0) io_submit(r3, 0x1, &(0x7f0000000540)=[&(0x7f00000000c0)={0x0, 0x0, 0x0, 0x1, 0x0, r1, &(0x7f0000000000), 0x10000}]) 14:08:19 executing program 2: [ 119.343292] binder: 3461:3465 ioctl c0306201 20000440 returned -14 [ 119.362833] binder: 3461:3465 BC_CLEAR_DEATH_NOTIFICATION death notification not active [ 119.376885] binder: release 3461:3465 transaction 15 out, still active [ 119.383602] binder: unexpected work type, 4, not freed 14:08:19 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") r1 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x1000)=nil, 0x1000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffd49, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000180)={0x18, 0x0, &(0x7f00000006c0)=[@increfs, @clear_death], 0x0, 0x0, 0x0}) openat$selinux_checkreqprot(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/checkreqprot\x00', 0x0, 0x0) 14:08:19 executing program 2: 14:08:19 executing program 4: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) clone(0x0, 0x0, 0x0, 0x0, 0x0) symlink(&(0x7f0000000100)='./file1\x00', 0x0) r1 = creat(&(0x7f0000000200)='\xe9\x1fq\x89Y\x1e\x923aK\x00', 0x109) r2 = dup2(r0, r1) execve(&(0x7f00000002c0)='\xe9\x1fq\x89Y\x1e\x923aK\x00', 0x0, 0x0) open$dir(&(0x7f00000000c0)='./file0\x00', 0x841, 0x0) clone(0x3102001ffd, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) execve(&(0x7f0000000000)='./file1\x00', 0x0, 0x0) sendmmsg(r2, &(0x7f0000005b00)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0) [ 119.412624] binder: undelivered TRANSACTION_COMPLETE [ 119.421979] binder: send failed reply for transaction 15, target dead 14:08:19 executing program 5: r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000200)='./cgroup\x00\f#\x9f\xd0\x85\xac\xc4\x9b\x81-\xb3\xd7=C\xea', 0x200002, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000180)='./bus\x00', 0x0) r2 = open(&(0x7f0000000140)='./bus\x00', 0x0, 0x0) mmap(&(0x7f0000001000/0x4000)=nil, 0x4000, 0x0, 0x11, r2, 0x0) fcntl$setstatus(r1, 0x4, 0x44040) io_setup(0x2, &(0x7f00000004c0)=0x0) io_submit(r3, 0x1, &(0x7f0000000540)=[&(0x7f00000000c0)={0x0, 0x0, 0x0, 0x1, 0x0, r1, &(0x7f0000000000), 0x10000}]) 14:08:19 executing program 2: [ 119.488436] binder: 3484:3487 ioctl c0306201 20000440 returned -14 [ 119.502131] binder: 3484:3487 BC_CLEAR_DEATH_NOTIFICATION death notification not active [ 119.527645] binder: release 3484:3487 transaction 20 out, still active [ 119.538256] binder: unexpected work type, 4, not freed [ 119.558655] binder: undelivered TRANSACTION_COMPLETE [ 119.564038] binder: send failed reply for transaction 20, target dead 14:08:22 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") r1 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x1000)=nil, 0x1000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffd49, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000180)={0x18, 0x0, &(0x7f00000006c0)=[@increfs, @clear_death], 0x0, 0x0, 0x0}) 14:08:22 executing program 0: clone(0x802102001ffe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x38) ptrace$cont(0x18, r0, 0x0, 0x2) ptrace$cont(0x9, r0, 0x0, 0x0) 14:08:22 executing program 5: r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000200)='./cgroup\x00\f#\x9f\xd0\x85\xac\xc4\x9b\x81-\xb3\xd7=C\xea', 0x200002, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000180)='./bus\x00', 0x0) r2 = open(&(0x7f0000000140)='./bus\x00', 0x0, 0x0) mmap(&(0x7f0000001000/0x4000)=nil, 0x4000, 0x0, 0x11, r2, 0x0) fcntl$setstatus(r1, 0x4, 0x44040) io_setup(0x2, &(0x7f00000004c0)=0x0) io_submit(r3, 0x1, &(0x7f0000000540)=[&(0x7f00000000c0)={0x0, 0x0, 0x0, 0x1, 0x0, r1, &(0x7f0000000000), 0x10000}]) 14:08:22 executing program 2: 14:08:22 executing program 4: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) clone(0x0, 0x0, 0x0, 0x0, 0x0) symlink(&(0x7f0000000100)='./file1\x00', 0x0) r1 = creat(&(0x7f0000000200)='\xe9\x1fq\x89Y\x1e\x923aK\x00', 0x109) r2 = dup2(r0, r1) execve(&(0x7f00000002c0)='\xe9\x1fq\x89Y\x1e\x923aK\x00', 0x0, 0x0) open$dir(&(0x7f00000000c0)='./file0\x00', 0x841, 0x0) clone(0x3102001ffd, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) execve(&(0x7f0000000000)='./file1\x00', 0x0, 0x0) sendmmsg(r2, &(0x7f0000005b00)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0) 14:08:22 executing program 1: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f0000000040)={0xa, 0x4e22}, 0x1c) listen(r0, 0xeb) ioctl$UI_SET_PHYS(0xffffffffffffffff, 0x4008556c, 0x0) setsockopt$inet6_tcp_TLS_TX(0xffffffffffffffff, 0x6, 0x1, 0x0, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) sendto$inet6(r1, 0x0, 0x0, 0x20000004, &(0x7f0000000140)={0xa, 0x4e22}, 0x1c) readv(r1, &(0x7f0000000700)=[{&(0x7f0000000440)=""/132, 0x31}], 0x1) ioctl$RTC_ALM_SET(0xffffffffffffffff, 0x40247007, 0x0) prctl$PR_MCE_KILL_GET(0x22) timerfd_create(0x0, 0x0) r2 = accept4(r0, 0x0, 0x0, 0x0) socket$inet6_udplite(0xa, 0x2, 0x88) setsockopt$packet_fanout(0xffffffffffffffff, 0x107, 0x12, 0x0, 0x309) ioctl$FICLONE(0xffffffffffffffff, 0x40049409, 0xffffffffffffffff) ioctl$EXT4_IOC_GROUP_EXTEND(0xffffffffffffffff, 0x40046607, 0x0) ioctl$PPPIOCGFLAGS1(0xffffffffffffffff, 0x8004745a, 0x0) dup(0xffffffffffffffff) setsockopt(r1, 0x0, 0x1, &(0x7f0000000000)="1d", 0x1) sendto$inet6(r2, &(0x7f0000000300)='A', 0x1, 0x0, 0x0, 0x0) 14:08:22 executing program 2: 14:08:22 executing program 2: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x2000001000008912, &(0x7f0000000100)="0adc1f123c123f3188b070") prctl$PR_SET_PTRACER(0x59616d61, 0x0) 14:08:22 executing program 4: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) clone(0x0, 0x0, 0x0, 0x0, 0x0) symlink(&(0x7f0000000100)='./file1\x00', &(0x7f0000000040)='./file1\x00') r1 = creat(0x0, 0x109) r2 = dup2(r0, r1) execve(&(0x7f00000002c0)='\xe9\x1fq\x89Y\x1e\x923aK\x00', 0x0, 0x0) open$dir(&(0x7f00000000c0)='./file0\x00', 0x841, 0x0) clone(0x3102001ffd, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) execve(&(0x7f0000000000)='./file1\x00', 0x0, 0x0) sendmmsg(r2, &(0x7f0000005b00)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0) 14:08:22 executing program 2: [ 122.410959] binder: 3504:3508 ioctl c0306201 20000440 returned -14 [ 122.446586] binder: 3504:3508 BC_CLEAR_DEATH_NOTIFICATION death notification not active 14:08:22 executing program 5: r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000200)='./cgroup\x00\f#\x9f\xd0\x85\xac\xc4\x9b\x81-\xb3\xd7=C\xea', 0x200002, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000180)='./bus\x00', 0x0) r2 = open(&(0x7f0000000140)='./bus\x00', 0x0, 0x0) mmap(&(0x7f0000001000/0x4000)=nil, 0x4000, 0x0, 0x11, r2, 0x0) fcntl$setstatus(r1, 0x4, 0x44040) io_setup(0x2, &(0x7f00000004c0)=0x0) io_submit(r3, 0x1, &(0x7f0000000540)=[&(0x7f00000000c0)={0x0, 0x0, 0x0, 0x1, 0x0, r1, &(0x7f0000000000), 0x10000}]) 14:08:22 executing program 2: 14:08:22 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x1000)=nil, 0x1000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x18, 0x0, &(0x7f00000006c0)=[@increfs, @clear_death], 0x0, 0x0, 0x0}) [ 122.485851] binder: release 3504:3508 transaction 25 out, still active [ 122.496247] binder: unexpected work type, 4, not freed [ 122.555283] binder: undelivered TRANSACTION_COMPLETE [ 122.560619] binder: send failed reply for transaction 25, target dead [ 122.578854] binder: 3538:3541 BC_CLEAR_DEATH_NOTIFICATION death notification not active 14:08:25 executing program 0: clone(0x802102001ffe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x38) ptrace$cont(0x18, r0, 0x0, 0x2) ptrace$cont(0x9, r0, 0x0, 0x0) 14:08:25 executing program 4: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) clone(0x0, 0x0, 0x0, 0x0, 0x0) symlink(&(0x7f0000000100)='./file1\x00', &(0x7f0000000040)='./file1\x00') r1 = creat(0x0, 0x109) r2 = dup2(r0, r1) execve(&(0x7f00000002c0)='\xe9\x1fq\x89Y\x1e\x923aK\x00', 0x0, 0x0) open$dir(&(0x7f00000000c0)='./file0\x00', 0x841, 0x0) clone(0x3102001ffd, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) execve(&(0x7f0000000000)='./file1\x00', 0x0, 0x0) sendmmsg(r2, &(0x7f0000005b00)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0) 14:08:25 executing program 2: 14:08:25 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x1000)=nil, 0x1000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x18, 0x0, &(0x7f00000006c0)=[@increfs, @clear_death], 0x0, 0x0, 0x0}) 14:08:25 executing program 5: r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000200)='./cgroup\x00\f#\x9f\xd0\x85\xac\xc4\x9b\x81-\xb3\xd7=C\xea', 0x200002, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000180)='./bus\x00', 0x0) r2 = open(&(0x7f0000000140)='./bus\x00', 0x0, 0x0) mmap(&(0x7f0000001000/0x4000)=nil, 0x4000, 0x0, 0x11, r2, 0x0) fcntl$setstatus(r1, 0x4, 0x44040) io_submit(0x0, 0x1, &(0x7f0000000540)=[&(0x7f00000000c0)={0x0, 0x0, 0x0, 0x1, 0x0, r1, &(0x7f0000000000), 0x10000}]) 14:08:25 executing program 1: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f0000000040)={0xa, 0x4e22}, 0x1c) listen(r0, 0xeb) ioctl$UI_SET_PHYS(0xffffffffffffffff, 0x4008556c, 0x0) setsockopt$inet6_tcp_TLS_TX(0xffffffffffffffff, 0x6, 0x1, 0x0, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) sendto$inet6(r1, 0x0, 0x0, 0x20000004, &(0x7f0000000140)={0xa, 0x4e22}, 0x1c) readv(r1, &(0x7f0000000700)=[{&(0x7f0000000440)=""/132, 0x31}], 0x1) ioctl$RTC_ALM_SET(0xffffffffffffffff, 0x40247007, 0x0) prctl$PR_MCE_KILL_GET(0x22) timerfd_create(0x0, 0x0) r2 = accept4(r0, 0x0, 0x0, 0x0) socket$inet6_udplite(0xa, 0x2, 0x88) setsockopt$packet_fanout(0xffffffffffffffff, 0x107, 0x12, 0x0, 0x309) ioctl$FICLONE(0xffffffffffffffff, 0x40049409, 0xffffffffffffffff) ioctl$EXT4_IOC_GROUP_EXTEND(0xffffffffffffffff, 0x40046607, 0x0) ioctl$PPPIOCGFLAGS1(0xffffffffffffffff, 0x8004745a, 0x0) shutdown(r1, 0x1) setsockopt(r1, 0x0, 0x1, &(0x7f0000000000)="1d", 0x1) sendto$inet6(r2, &(0x7f0000000300)='A', 0x1, 0x0, 0x0, 0x0) 14:08:25 executing program 2: 14:08:25 executing program 5: r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000200)='./cgroup\x00\f#\x9f\xd0\x85\xac\xc4\x9b\x81-\xb3\xd7=C\xea', 0x200002, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000180)='./bus\x00', 0x0) r2 = open(&(0x7f0000000140)='./bus\x00', 0x0, 0x0) mmap(&(0x7f0000001000/0x4000)=nil, 0x4000, 0x0, 0x11, r2, 0x0) fcntl$setstatus(r1, 0x4, 0x44040) io_submit(0x0, 0x1, &(0x7f0000000540)=[&(0x7f00000000c0)={0x0, 0x0, 0x0, 0x1, 0x0, r1, &(0x7f0000000000), 0x10000}]) 14:08:25 executing program 4: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) clone(0x0, 0x0, 0x0, 0x0, 0x0) symlink(&(0x7f0000000100)='./file1\x00', &(0x7f0000000040)='./file1\x00') r1 = creat(0x0, 0x109) r2 = dup2(r0, r1) execve(&(0x7f00000002c0)='\xe9\x1fq\x89Y\x1e\x923aK\x00', 0x0, 0x0) open$dir(&(0x7f00000000c0)='./file0\x00', 0x841, 0x0) clone(0x3102001ffd, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) execve(&(0x7f0000000000)='./file1\x00', 0x0, 0x0) sendmmsg(r2, &(0x7f0000005b00)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0) [ 125.429785] binder: 3548:3550 BC_CLEAR_DEATH_NOTIFICATION death notification not active 14:08:25 executing program 0: clone(0x802102001ffe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$cont(0x18, r0, 0x0, 0x2) ptrace$cont(0x9, r0, 0x0, 0x0) 14:08:25 executing program 2: 14:08:25 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x1000)=nil, 0x1000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x18, 0x0, &(0x7f00000006c0)=[@increfs, @clear_death], 0x0, 0x0, 0x0}) 14:08:25 executing program 5: r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000200)='./cgroup\x00\f#\x9f\xd0\x85\xac\xc4\x9b\x81-\xb3\xd7=C\xea', 0x200002, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000180)='./bus\x00', 0x0) r2 = open(&(0x7f0000000140)='./bus\x00', 0x0, 0x0) mmap(&(0x7f0000001000/0x4000)=nil, 0x4000, 0x0, 0x11, r2, 0x0) fcntl$setstatus(r1, 0x4, 0x44040) io_submit(0x0, 0x1, &(0x7f0000000540)=[&(0x7f00000000c0)={0x0, 0x0, 0x0, 0x1, 0x0, r1, &(0x7f0000000000), 0x10000}]) 14:08:25 executing program 2: 14:08:25 executing program 4: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) clone(0x0, 0x0, 0x0, 0x0, 0x0) symlink(&(0x7f0000000100)='./file1\x00', &(0x7f0000000040)='./file1\x00') r1 = creat(&(0x7f0000000200)='\xe9\x1fq\x89Y\x1e\x923aK\x00', 0x0) r2 = dup2(r0, r1) execve(&(0x7f00000002c0)='\xe9\x1fq\x89Y\x1e\x923aK\x00', 0x0, 0x0) open$dir(&(0x7f00000000c0)='./file0\x00', 0x841, 0x0) clone(0x3102001ffd, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) execve(&(0x7f0000000000)='./file1\x00', 0x0, 0x0) sendmmsg(r2, &(0x7f0000005b00)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0) 14:08:25 executing program 5: r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000200)='./cgroup\x00\f#\x9f\xd0\x85\xac\xc4\x9b\x81-\xb3\xd7=C\xea', 0x200002, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000180)='./bus\x00', 0x0) r2 = open(&(0x7f0000000140)='./bus\x00', 0x0, 0x0) mmap(&(0x7f0000001000/0x4000)=nil, 0x4000, 0x0, 0x11, r2, 0x0) io_setup(0x2, &(0x7f00000004c0)=0x0) io_submit(r3, 0x1, &(0x7f0000000540)=[&(0x7f00000000c0)={0x0, 0x0, 0x0, 0x1, 0x0, r1, &(0x7f0000000000), 0x10000}]) [ 125.576509] binder: 3571:3576 BC_CLEAR_DEATH_NOTIFICATION death notification not active 14:08:25 executing program 4: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) clone(0x0, 0x0, 0x0, 0x0, 0x0) symlink(&(0x7f0000000100)='./file1\x00', &(0x7f0000000040)='./file1\x00') r1 = creat(&(0x7f0000000200)='\xe9\x1fq\x89Y\x1e\x923aK\x00', 0x0) r2 = dup2(r0, r1) execve(&(0x7f00000002c0)='\xe9\x1fq\x89Y\x1e\x923aK\x00', 0x0, 0x0) open$dir(&(0x7f00000000c0)='./file0\x00', 0x841, 0x0) clone(0x3102001ffd, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) execve(&(0x7f0000000000)='./file1\x00', 0x0, 0x0) sendmmsg(r2, &(0x7f0000005b00)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0) 14:08:26 executing program 2: 14:08:26 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") r1 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x1000)=nil, 0x1000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffd49, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000180)={0x18, 0x0, &(0x7f00000006c0)=[@increfs, @clear_death], 0x0, 0x0, 0x0}) 14:08:26 executing program 4: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) clone(0x0, 0x0, 0x0, 0x0, 0x0) symlink(&(0x7f0000000100)='./file1\x00', &(0x7f0000000040)='./file1\x00') r1 = creat(&(0x7f0000000200)='\xe9\x1fq\x89Y\x1e\x923aK\x00', 0x0) r2 = dup2(r0, r1) execve(&(0x7f00000002c0)='\xe9\x1fq\x89Y\x1e\x923aK\x00', 0x0, 0x0) open$dir(&(0x7f00000000c0)='./file0\x00', 0x841, 0x0) clone(0x3102001ffd, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) execve(&(0x7f0000000000)='./file1\x00', 0x0, 0x0) sendmmsg(r2, &(0x7f0000005b00)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0) 14:08:26 executing program 1: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f0000000040)={0xa, 0x4e22}, 0x1c) listen(r0, 0xeb) ioctl$UI_SET_PHYS(0xffffffffffffffff, 0x4008556c, 0x0) setsockopt$inet6_tcp_TLS_TX(0xffffffffffffffff, 0x6, 0x1, 0x0, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) sendto$inet6(r1, 0x0, 0x0, 0x20000004, &(0x7f0000000140)={0xa, 0x4e22}, 0x1c) readv(r1, &(0x7f0000000700)=[{&(0x7f0000000440)=""/132, 0x31}], 0x1) ioctl$RTC_ALM_SET(0xffffffffffffffff, 0x40247007, 0x0) prctl$PR_MCE_KILL_GET(0x22) timerfd_create(0x0, 0x0) r2 = accept4(r0, 0x0, 0x0, 0x0) socket$inet6_udplite(0xa, 0x2, 0x88) setsockopt$packet_fanout(0xffffffffffffffff, 0x107, 0x12, 0x0, 0x309) ioctl$FICLONE(0xffffffffffffffff, 0x40049409, 0xffffffffffffffff) ioctl$EXT4_IOC_GROUP_EXTEND(0xffffffffffffffff, 0x40046607, 0x0) ioctl$PPPIOCGFLAGS1(0xffffffffffffffff, 0x8004745a, 0x0) shutdown(r1, 0x1) setsockopt(r1, 0x0, 0x1, &(0x7f0000000000)="1d", 0x1) sendto$inet6(r2, &(0x7f0000000300)='A', 0x1, 0x0, 0x0, 0x0) [ 126.280135] binder: 3601:3603 transaction failed 29189/-22, size 24-8 line 3014 [ 126.300067] binder: 3601:3603 ioctl c0306201 20000440 returned -14 [ 126.308196] binder: 3601:3603 IncRefs 0 refcount change on invalid ref 0 ret -22 [ 126.316643] binder: 3601:3603 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 [ 126.324065] binder: undelivered TRANSACTION_ERROR: 29189 14:08:28 executing program 0: clone(0x802102001ffe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$cont(0x18, r0, 0x0, 0x2) ptrace$cont(0x9, r0, 0x0, 0x0) 14:08:28 executing program 5: r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000200)='./cgroup\x00\f#\x9f\xd0\x85\xac\xc4\x9b\x81-\xb3\xd7=C\xea', 0x200002, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000180)='./bus\x00', 0x0) r2 = open(&(0x7f0000000140)='./bus\x00', 0x0, 0x0) mmap(&(0x7f0000001000/0x4000)=nil, 0x4000, 0x0, 0x11, r2, 0x0) io_setup(0x2, &(0x7f00000004c0)=0x0) io_submit(r3, 0x1, &(0x7f0000000540)=[&(0x7f00000000c0)={0x0, 0x0, 0x0, 0x1, 0x0, r1, &(0x7f0000000000), 0x10000}]) 14:08:28 executing program 2: 14:08:28 executing program 4: socket$inet6_tcp(0xa, 0x1, 0x0) clone(0x0, 0x0, 0x0, 0x0, 0x0) symlink(&(0x7f0000000100)='./file1\x00', &(0x7f0000000040)='./file1\x00') r0 = creat(&(0x7f0000000200)='\xe9\x1fq\x89Y\x1e\x923aK\x00', 0x109) r1 = dup2(0xffffffffffffffff, r0) execve(&(0x7f00000002c0)='\xe9\x1fq\x89Y\x1e\x923aK\x00', 0x0, 0x0) open$dir(&(0x7f00000000c0)='./file0\x00', 0x841, 0x0) clone(0x3102001ffd, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) execve(&(0x7f0000000000)='./file1\x00', 0x0, 0x0) sendmmsg(r1, &(0x7f0000005b00)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0) 14:08:28 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") r1 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x1000)=nil, 0x1000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffd49, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000180)={0x18, 0x0, &(0x7f00000006c0)=[@increfs, @clear_death], 0x0, 0x0, 0x0}) 14:08:28 executing program 1: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f0000000040)={0xa, 0x4e22}, 0x1c) listen(r0, 0xeb) ioctl$UI_SET_PHYS(0xffffffffffffffff, 0x4008556c, 0x0) setsockopt$inet6_tcp_TLS_TX(0xffffffffffffffff, 0x6, 0x1, 0x0, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) sendto$inet6(r1, 0x0, 0x0, 0x20000004, &(0x7f0000000140)={0xa, 0x4e22}, 0x1c) readv(r1, &(0x7f0000000700)=[{&(0x7f0000000440)=""/132, 0x31}], 0x1) ioctl$RTC_ALM_SET(0xffffffffffffffff, 0x40247007, 0x0) prctl$PR_MCE_KILL_GET(0x22) timerfd_create(0x0, 0x0) r2 = accept4(r0, 0x0, 0x0, 0x0) socket$inet6_udplite(0xa, 0x2, 0x88) setsockopt$packet_fanout(0xffffffffffffffff, 0x107, 0x12, 0x0, 0x309) ioctl$FICLONE(0xffffffffffffffff, 0x40049409, 0xffffffffffffffff) ioctl$EXT4_IOC_GROUP_EXTEND(0xffffffffffffffff, 0x40046607, 0x0) ioctl$PPPIOCGFLAGS1(0xffffffffffffffff, 0x8004745a, 0x0) shutdown(r1, 0x1) setsockopt(r1, 0x0, 0x1, &(0x7f0000000000)="1d", 0x1) sendto$inet6(r2, &(0x7f0000000300)='A', 0x1, 0x0, 0x0, 0x0) 14:08:28 executing program 2: 14:08:28 executing program 4: socket$inet6_tcp(0xa, 0x1, 0x0) clone(0x0, 0x0, 0x0, 0x0, 0x0) symlink(&(0x7f0000000100)='./file1\x00', &(0x7f0000000040)='./file1\x00') r0 = creat(&(0x7f0000000200)='\xe9\x1fq\x89Y\x1e\x923aK\x00', 0x109) r1 = dup2(0xffffffffffffffff, r0) execve(&(0x7f00000002c0)='\xe9\x1fq\x89Y\x1e\x923aK\x00', 0x0, 0x0) open$dir(&(0x7f00000000c0)='./file0\x00', 0x841, 0x0) clone(0x3102001ffd, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) execve(&(0x7f0000000000)='./file1\x00', 0x0, 0x0) sendmmsg(r1, &(0x7f0000005b00)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0) 14:08:28 executing program 2: [ 128.580581] binder: 3618:3621 transaction failed 29189/-22, size 24-8 line 3014 [ 128.614979] binder: 3618:3621 ioctl c0306201 20000440 returned -14 14:08:28 executing program 4: socket$inet6_tcp(0xa, 0x1, 0x0) clone(0x0, 0x0, 0x0, 0x0, 0x0) symlink(&(0x7f0000000100)='./file1\x00', &(0x7f0000000040)='./file1\x00') r0 = creat(&(0x7f0000000200)='\xe9\x1fq\x89Y\x1e\x923aK\x00', 0x109) r1 = dup2(0xffffffffffffffff, r0) execve(&(0x7f00000002c0)='\xe9\x1fq\x89Y\x1e\x923aK\x00', 0x0, 0x0) open$dir(&(0x7f00000000c0)='./file0\x00', 0x841, 0x0) clone(0x3102001ffd, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) execve(&(0x7f0000000000)='./file1\x00', 0x0, 0x0) sendmmsg(r1, &(0x7f0000005b00)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0) 14:08:28 executing program 5: r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000200)='./cgroup\x00\f#\x9f\xd0\x85\xac\xc4\x9b\x81-\xb3\xd7=C\xea', 0x200002, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000180)='./bus\x00', 0x0) r2 = open(&(0x7f0000000140)='./bus\x00', 0x0, 0x0) mmap(&(0x7f0000001000/0x4000)=nil, 0x4000, 0x0, 0x11, r2, 0x0) io_setup(0x2, &(0x7f00000004c0)=0x0) io_submit(r3, 0x1, &(0x7f0000000540)=[&(0x7f00000000c0)={0x0, 0x0, 0x0, 0x1, 0x0, r1, &(0x7f0000000000), 0x10000}]) 14:08:28 executing program 2: [ 128.628666] binder: 3618:3636 IncRefs 0 refcount change on invalid ref 0 ret -22 [ 128.689514] binder: 3618:3636 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 [ 128.722548] binder: undelivered TRANSACTION_ERROR: 29189 14:08:31 executing program 4: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) clone(0x0, 0x0, 0x0, 0x0, 0x0) symlink(&(0x7f0000000100)='./file1\x00', &(0x7f0000000040)='./file1\x00') creat(&(0x7f0000000200)='\xe9\x1fq\x89Y\x1e\x923aK\x00', 0x109) r1 = dup2(r0, 0xffffffffffffffff) execve(&(0x7f00000002c0)='\xe9\x1fq\x89Y\x1e\x923aK\x00', 0x0, 0x0) open$dir(&(0x7f00000000c0)='./file0\x00', 0x841, 0x0) clone(0x3102001ffd, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) execve(&(0x7f0000000000)='./file1\x00', 0x0, 0x0) sendmmsg(r1, &(0x7f0000005b00)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0) 14:08:31 executing program 0: clone(0x802102001ffe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$cont(0x18, r0, 0x0, 0x2) ptrace$cont(0x9, r0, 0x0, 0x0) 14:08:31 executing program 2: 14:08:31 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") r1 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x1000)=nil, 0x1000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffd49, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000180)={0x18, 0x0, &(0x7f00000006c0)=[@increfs, @clear_death], 0x0, 0x0, 0x0}) 14:08:31 executing program 5: r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000200)='./cgroup\x00\f#\x9f\xd0\x85\xac\xc4\x9b\x81-\xb3\xd7=C\xea', 0x200002, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000180)='./bus\x00', 0x0) open(&(0x7f0000000140)='./bus\x00', 0x0, 0x0) fcntl$setstatus(r1, 0x4, 0x44040) io_setup(0x2, &(0x7f00000004c0)=0x0) io_submit(r2, 0x1, &(0x7f0000000540)=[&(0x7f00000000c0)={0x0, 0x0, 0x0, 0x1, 0x0, r1, &(0x7f0000000000), 0x10000}]) 14:08:31 executing program 1: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f0000000040)={0xa, 0x4e22}, 0x1c) listen(r0, 0xeb) ioctl$UI_SET_PHYS(0xffffffffffffffff, 0x4008556c, 0x0) setsockopt$inet6_tcp_TLS_TX(0xffffffffffffffff, 0x6, 0x1, 0x0, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) sendto$inet6(r1, 0x0, 0x0, 0x20000004, &(0x7f0000000140)={0xa, 0x4e22}, 0x1c) readv(r1, &(0x7f0000000700)=[{&(0x7f0000000440)=""/132, 0x31}], 0x1) ioctl$RTC_ALM_SET(0xffffffffffffffff, 0x40247007, 0x0) prctl$PR_MCE_KILL_GET(0x22) timerfd_create(0x0, 0x0) r2 = accept4(r0, 0x0, 0x0, 0x0) socket$inet6_udplite(0xa, 0x2, 0x88) setsockopt$packet_fanout(0xffffffffffffffff, 0x107, 0x12, 0x0, 0x309) ioctl$FICLONE(0xffffffffffffffff, 0x40049409, 0xffffffffffffffff) ioctl$EXT4_IOC_GROUP_EXTEND(0xffffffffffffffff, 0x40046607, 0x0) dup(0xffffffffffffffff) shutdown(r1, 0x1) setsockopt(r1, 0x0, 0x1, &(0x7f0000000000)="1d", 0x1) sendto$inet6(r2, &(0x7f0000000300)='A', 0x1, 0x0, 0x0, 0x0) 14:08:31 executing program 2: r0 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) mlockall(0x6) 14:08:31 executing program 4: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) clone(0x0, 0x0, 0x0, 0x0, 0x0) symlink(&(0x7f0000000100)='./file1\x00', &(0x7f0000000040)='./file1\x00') creat(&(0x7f0000000200)='\xe9\x1fq\x89Y\x1e\x923aK\x00', 0x109) r1 = dup2(r0, 0xffffffffffffffff) execve(&(0x7f00000002c0)='\xe9\x1fq\x89Y\x1e\x923aK\x00', 0x0, 0x0) open$dir(&(0x7f00000000c0)='./file0\x00', 0x841, 0x0) clone(0x3102001ffd, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) execve(&(0x7f0000000000)='./file1\x00', 0x0, 0x0) sendmmsg(r1, &(0x7f0000005b00)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0) 14:08:31 executing program 2: r0 = socket$inet6(0xa, 0x2, 0x0) r1 = socket$packet(0x11, 0x2, 0x300) ioctl(r1, 0x1000008912, &(0x7f0000000000)="0adc5f123c123f319bd070") sendto$inet6(r0, 0x0, 0x0, 0x0, &(0x7f0000000000)={0xa, 0x4e20, 0x0, @mcast2}, 0x1c) [ 131.608121] binder: 3655:3663 transaction failed 29189/-22, size 24-8 line 3014 [ 131.623196] binder: 3655:3663 ioctl c0306201 20000440 returned -14 14:08:31 executing program 4: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) clone(0x0, 0x0, 0x0, 0x0, 0x0) symlink(&(0x7f0000000100)='./file1\x00', &(0x7f0000000040)='./file1\x00') creat(&(0x7f0000000200)='\xe9\x1fq\x89Y\x1e\x923aK\x00', 0x109) r1 = dup2(r0, 0xffffffffffffffff) execve(&(0x7f00000002c0)='\xe9\x1fq\x89Y\x1e\x923aK\x00', 0x0, 0x0) open$dir(&(0x7f00000000c0)='./file0\x00', 0x841, 0x0) clone(0x3102001ffd, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) execve(&(0x7f0000000000)='./file1\x00', 0x0, 0x0) sendmmsg(r1, &(0x7f0000005b00)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0) 14:08:31 executing program 5: r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000200)='./cgroup\x00\f#\x9f\xd0\x85\xac\xc4\x9b\x81-\xb3\xd7=C\xea', 0x200002, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000180)='./bus\x00', 0x0) open(&(0x7f0000000140)='./bus\x00', 0x0, 0x0) fcntl$setstatus(r1, 0x4, 0x44040) io_setup(0x2, &(0x7f00000004c0)=0x0) io_submit(r2, 0x1, &(0x7f0000000540)=[&(0x7f00000000c0)={0x0, 0x0, 0x0, 0x1, 0x0, r1, &(0x7f0000000000), 0x10000}]) 14:08:31 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") r1 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffd49, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000180)={0x18, 0x0, &(0x7f00000006c0)=[@increfs, @clear_death], 0x0, 0x0, 0x0}) [ 131.656935] binder: 3655:3676 IncRefs 0 refcount change on invalid ref 0 ret -22 [ 131.670289] binder: 3655:3676 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 [ 131.685368] binder: undelivered TRANSACTION_ERROR: 29189 14:08:31 executing program 2: r0 = socket$inet6(0xa, 0x400000000001, 0x0) r1 = dup(r0) unshare(0x400) inotify_add_watch(r1, 0x0, 0x80) [ 131.749754] binder_alloc: 3686: binder_alloc_buf, no vma [ 131.770929] binder: 3686:3688 transaction failed 29189/-3, size 24-8 line 3137 [ 131.785727] binder: 3686:3688 ioctl c0306201 20000440 returned -14 [ 131.795474] binder: 3686:3697 BC_CLEAR_DEATH_NOTIFICATION death notification not active [ 131.809771] binder: undelivered TRANSACTION_ERROR: 29189 14:08:34 executing program 0: clone(0x802102001ffe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) tkill(r0, 0x38) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$cont(0x18, r0, 0x0, 0x2) ptrace$cont(0x9, r0, 0x0, 0x0) 14:08:34 executing program 4: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) clone(0x0, 0x0, 0x0, 0x0, 0x0) symlink(&(0x7f0000000100)='./file1\x00', &(0x7f0000000040)='./file1\x00') r1 = creat(&(0x7f0000000200)='\xe9\x1fq\x89Y\x1e\x923aK\x00', 0x109) r2 = dup2(r0, r1) execve(0x0, 0x0, 0x0) open$dir(&(0x7f00000000c0)='./file0\x00', 0x841, 0x0) clone(0x3102001ffd, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) execve(&(0x7f0000000000)='./file1\x00', 0x0, 0x0) sendmmsg(r2, &(0x7f0000005b00)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0) 14:08:34 executing program 2: r0 = socket$inet6(0xa, 0x2, 0x0) bind$inet6(r0, &(0x7f0000000480)={0xa, 0x4e20, 0x0, @mcast1, 0x1}, 0x1c) 14:08:34 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") r1 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffd49, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000180)={0x18, 0x0, &(0x7f00000006c0)=[@increfs, @clear_death], 0x0, 0x0, 0x0}) 14:08:34 executing program 5: r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000200)='./cgroup\x00\f#\x9f\xd0\x85\xac\xc4\x9b\x81-\xb3\xd7=C\xea', 0x200002, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000180)='./bus\x00', 0x0) open(&(0x7f0000000140)='./bus\x00', 0x0, 0x0) fcntl$setstatus(r1, 0x4, 0x44040) io_setup(0x2, &(0x7f00000004c0)=0x0) io_submit(r2, 0x1, &(0x7f0000000540)=[&(0x7f00000000c0)={0x0, 0x0, 0x0, 0x1, 0x0, r1, &(0x7f0000000000), 0x10000}]) 14:08:34 executing program 1: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f0000000040)={0xa, 0x4e22}, 0x1c) listen(r0, 0xeb) ioctl$UI_SET_PHYS(0xffffffffffffffff, 0x4008556c, 0x0) setsockopt$inet6_tcp_TLS_TX(0xffffffffffffffff, 0x6, 0x1, 0x0, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) sendto$inet6(r1, 0x0, 0x0, 0x20000004, &(0x7f0000000140)={0xa, 0x4e22}, 0x1c) readv(r1, &(0x7f0000000700)=[{&(0x7f0000000440)=""/132, 0x31}], 0x1) ioctl$RTC_ALM_SET(0xffffffffffffffff, 0x40247007, 0x0) prctl$PR_MCE_KILL_GET(0x22) timerfd_create(0x0, 0x0) r2 = accept4(r0, 0x0, 0x0, 0x0) socket$inet6_udplite(0xa, 0x2, 0x88) setsockopt$packet_fanout(0xffffffffffffffff, 0x107, 0x12, 0x0, 0x309) ioctl$FICLONE(0xffffffffffffffff, 0x40049409, 0xffffffffffffffff) ioctl$EXT4_IOC_GROUP_EXTEND(0xffffffffffffffff, 0x40046607, 0x0) dup(0xffffffffffffffff) shutdown(r1, 0x1) setsockopt(r1, 0x0, 0x1, &(0x7f0000000000)="1d", 0x1) sendto$inet6(r2, &(0x7f0000000300)='A', 0x1, 0x0, 0x0, 0x0) 14:08:34 executing program 2: r0 = socket$netlink(0x10, 0x3, 0x0) writev(r0, &(0x7f0000000040)=[{&(0x7f0000ae6fc7)="390000001100094701bb61e1c3050001070000000400000045efffff08009b0019001a000f000000220001071c06000004e9ff0004000d0005", 0x39}], 0x1) [ 134.630431] binder_alloc: 3707: binder_alloc_buf, no vma [ 134.642231] binder: 3707:3709 transaction failed 29189/-3, size 24-8 line 3137 [ 134.660495] binder: 3707:3709 ioctl c0306201 20000440 returned -14 14:08:34 executing program 4: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) clone(0x0, 0x0, 0x0, 0x0, 0x0) symlink(&(0x7f0000000100)='./file1\x00', &(0x7f0000000040)='./file1\x00') r1 = creat(&(0x7f0000000200)='\xe9\x1fq\x89Y\x1e\x923aK\x00', 0x109) r2 = dup2(r0, r1) execve(0x0, 0x0, 0x0) open$dir(&(0x7f00000000c0)='./file0\x00', 0x841, 0x0) clone(0x3102001ffd, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) execve(&(0x7f0000000000)='./file1\x00', 0x0, 0x0) sendmmsg(r2, &(0x7f0000005b00)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0) 14:08:34 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") r1 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffd49, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000180)={0x18, 0x0, &(0x7f00000006c0)=[@increfs, @clear_death], 0x0, 0x0, 0x0}) 14:08:34 executing program 2: r0 = syz_open_procfs(0xffffffffffffffff, &(0x7f00000002c0)='status\x00B#g9\xc1m\x17\xf9\r\xc2#\"\xc9O\x135 x^\x91\xea\x85\xae\x10|\xc3\x81\x98\x19\xc2cT\v\x1d\xe1\xba \x1em\xe4\xb7ZP\x11P\x91\xee\xd50\xaaH.6YF\x01\xce\xb5\xd1i\xc5\xba\xf4\x1b5\xd8\xa5\xa0\x9a\x82If\x13\xd8`#\x86[W\xef&\x9f\x90\xd3\x04\x96\x9fh}\xf5;a\x1b@\xa4B\x91\xb5\xa8\x82 \x8f\xbb\x83^T\xa4\x13\x10\xa3\xb4\x81\xd5\xbd\xbb\t\x81t)\t\xa6;|\xd1\xa1\x8d@^[\x01\x1b\xfb\xe5\xa4\xd5\xbf)\x94G\xe4\xc0\xddKc\xa3g!\x1c\x00x#\x8bP\x9daA\x00\xd3:U\x84\xaa;<\xb9\xb9\x9en_\x84q\x92\x94\xd4\x1b\'\x11|G\xfbO++\xe4u\xeb%\xd5\x01\x00\x00\x00\xcf\x84\"\xca\xdeW\f\b{\x03\xf6\xb1\x81\x8b\xc9pw\xdb#') socketpair$unix(0x1, 0x200000000001, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) prctl$PR_SET_NAME(0xf, &(0x7f0000000600)='em8>0\x80\n\xd4evW#\\m\xac~\xc2{typmG-\x00\x00\x00\xa3\x05\x97\xa7M\xd1\x91\xa9\x03\xe0\xa7\xe9qy\xc7?\xee\xae\xec\xad\x96@/,\x95\xb4&K:\x9bE\xd6\x11\x8d\x99\x8f\x14c\x850\xf7\xf0\x98\xbbH :W\xf6\x92.Y\b\xb8\x99\xc2\x9d\x87\xda\xbf\xab\xdc\xaaAi\rN\xf2\x81\x10V;L~\xd9\xdf/K\x19\x1baW\xdf\x7f.\xd0|xP\xd2\xbf\xf7\xd3\x97&\xdc\xbd\x008>\x8d\xe7\x8d\x0f\x81)\xd7\x95Wg\xc4\xf0\x92`\xa7\xd8a\xfb\x01\xe4o\xb4\xda\xca\xcd\xf2\x8dZ\x9d\xbf\xe7&\x9fA~Y\xa5\x99\xa9b\x9c0\x16B&\xa4\xc5\xcc(\xfd\xcf+_\xff\x1c\xe3N\x7fr5h\xdd@\x87\x00\xc9N\xfd_\x06\xaao\x9a@\x9d)\x19\xaa\xdd\x03\x80\xba\xc5}\x1cUf\x87o79?\xf8\x9aM\x8f\x86\xcc\vp\x11 |\xb1DF2\x91\xf4\fef\f\x93\xc1\xb4') sendfile(r1, r0, 0x0, 0x71c) 14:08:34 executing program 0: clone(0x802102001ffe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) tkill(r0, 0x38) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$cont(0x18, r0, 0x0, 0x2) ptrace$cont(0x9, r0, 0x0, 0x0) 14:08:34 executing program 2: 14:08:34 executing program 5: r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000200)='./cgroup\x00\f#\x9f\xd0\x85\xac\xc4\x9b\x81-\xb3\xd7=C\xea', 0x200002, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000180)='./bus\x00', 0x0) mmap(&(0x7f0000001000/0x4000)=nil, 0x4000, 0x0, 0x11, 0xffffffffffffffff, 0x0) fcntl$setstatus(r1, 0x4, 0x44040) io_setup(0x2, &(0x7f00000004c0)=0x0) io_submit(r2, 0x1, &(0x7f0000000540)=[&(0x7f00000000c0)={0x0, 0x0, 0x0, 0x1, 0x0, r1, &(0x7f0000000000), 0x10000}]) [ 134.674194] binder: 3707:3709 BC_CLEAR_DEATH_NOTIFICATION death notification not active [ 134.700523] binder: undelivered TRANSACTION_ERROR: 29189 14:08:34 executing program 2: 14:08:34 executing program 4: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) clone(0x0, 0x0, 0x0, 0x0, 0x0) symlink(&(0x7f0000000100)='./file1\x00', &(0x7f0000000040)='./file1\x00') r1 = creat(&(0x7f0000000200)='\xe9\x1fq\x89Y\x1e\x923aK\x00', 0x109) r2 = dup2(r0, r1) execve(0x0, 0x0, 0x0) open$dir(&(0x7f00000000c0)='./file0\x00', 0x841, 0x0) clone(0x3102001ffd, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) execve(&(0x7f0000000000)='./file1\x00', 0x0, 0x0) sendmmsg(r2, &(0x7f0000005b00)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0) 14:08:34 executing program 0: clone(0x802102001ffe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) tkill(r0, 0x38) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$cont(0x18, r0, 0x0, 0x2) ptrace$cont(0x9, r0, 0x0, 0x0) 14:08:34 executing program 0: clone(0x802102001ffe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x38) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$cont(0x18, r0, 0x0, 0x2) ptrace$cont(0x9, r0, 0x0, 0x0) [ 134.837195] binder_alloc: 3732: binder_alloc_buf, no vma [ 134.864040] binder: 3732:3738 transaction failed 29189/-3, size 24-8 line 3137 [ 134.881843] binder: 3732:3738 ioctl c0306201 20000440 returned -14 [ 134.909445] binder: 3732:3752 BC_CLEAR_DEATH_NOTIFICATION death notification not active [ 134.936051] binder: undelivered TRANSACTION_ERROR: 29189 14:08:35 executing program 1: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f0000000040)={0xa, 0x4e22}, 0x1c) listen(r0, 0xeb) ioctl$UI_SET_PHYS(0xffffffffffffffff, 0x4008556c, 0x0) setsockopt$inet6_tcp_TLS_TX(0xffffffffffffffff, 0x6, 0x1, 0x0, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) sendto$inet6(r1, 0x0, 0x0, 0x20000004, &(0x7f0000000140)={0xa, 0x4e22}, 0x1c) readv(r1, &(0x7f0000000700)=[{&(0x7f0000000440)=""/132, 0x31}], 0x1) ioctl$RTC_ALM_SET(0xffffffffffffffff, 0x40247007, 0x0) prctl$PR_MCE_KILL_GET(0x22) timerfd_create(0x0, 0x0) r2 = accept4(r0, 0x0, 0x0, 0x0) socket$inet6_udplite(0xa, 0x2, 0x88) setsockopt$packet_fanout(0xffffffffffffffff, 0x107, 0x12, 0x0, 0x309) ioctl$FICLONE(0xffffffffffffffff, 0x40049409, 0xffffffffffffffff) ioctl$EXT4_IOC_GROUP_EXTEND(0xffffffffffffffff, 0x40046607, 0x0) dup(0xffffffffffffffff) shutdown(r1, 0x1) setsockopt(r1, 0x0, 0x1, &(0x7f0000000000)="1d", 0x1) sendto$inet6(r2, &(0x7f0000000300)='A', 0x1, 0x0, 0x0, 0x0) 14:08:35 executing program 2: 14:08:35 executing program 5: r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000200)='./cgroup\x00\f#\x9f\xd0\x85\xac\xc4\x9b\x81-\xb3\xd7=C\xea', 0x200002, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000180)='./bus\x00', 0x0) mmap(&(0x7f0000001000/0x4000)=nil, 0x4000, 0x0, 0x11, 0xffffffffffffffff, 0x0) fcntl$setstatus(r1, 0x4, 0x44040) io_setup(0x2, &(0x7f00000004c0)=0x0) io_submit(r2, 0x1, &(0x7f0000000540)=[&(0x7f00000000c0)={0x0, 0x0, 0x0, 0x1, 0x0, r1, &(0x7f0000000000), 0x10000}]) 14:08:35 executing program 0: clone(0x802102001ffe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x38) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$cont(0x18, r0, 0x0, 0x2) ptrace$cont(0x9, r0, 0x0, 0x0) 14:08:35 executing program 4: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) clone(0x0, 0x0, 0x0, 0x0, 0x0) symlink(&(0x7f0000000100)='./file1\x00', &(0x7f0000000040)='./file1\x00') r1 = creat(&(0x7f0000000200)='\xe9\x1fq\x89Y\x1e\x923aK\x00', 0x109) r2 = dup2(r0, r1) execve(&(0x7f00000002c0)='\xe9\x1fq\x89Y\x1e\x923aK\x00', 0x0, 0x0) open$dir(0x0, 0x841, 0x0) clone(0x3102001ffd, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) execve(&(0x7f0000000000)='./file1\x00', 0x0, 0x0) sendmmsg(r2, &(0x7f0000005b00)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0) 14:08:35 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") r1 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x1000)=nil, 0x1000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffd49, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000180)={0x18, 0x0, &(0x7f00000006c0)=[@increfs, @clear_death], 0x0, 0x0, 0x0}) 14:08:35 executing program 2: 14:08:35 executing program 0: clone(0x802102001ffe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x38) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$cont(0x18, r0, 0x0, 0x2) ptrace$cont(0x9, r0, 0x0, 0x0) [ 135.458735] binder: 3762:3769 transaction failed 29189/-22, size 24-8 line 3014 [ 135.480916] binder: 3762:3769 ioctl c0306201 20000440 returned -14 14:08:35 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") r1 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x1000)=nil, 0x1000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffd49, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000180)={0x18, 0x0, &(0x7f00000006c0)=[@increfs, @clear_death], 0x0, 0x0, 0x0}) 14:08:35 executing program 2: 14:08:35 executing program 0: clone(0x802102001ffe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) wait4(0x0, 0x0, 0x80000000, 0x0) ptrace$setopts(0x4206, 0x0, 0x0, 0x0) tkill(0x0, 0x38) ptrace$cont(0x18, 0x0, 0x0, 0x0) ptrace$cont(0x18, 0x0, 0x0, 0x2) ptrace$cont(0x9, 0x0, 0x0, 0x0) [ 135.511940] binder: undelivered TRANSACTION_ERROR: 29189 14:08:35 executing program 5: r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000200)='./cgroup\x00\f#\x9f\xd0\x85\xac\xc4\x9b\x81-\xb3\xd7=C\xea', 0x200002, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000180)='./bus\x00', 0x0) mmap(&(0x7f0000001000/0x4000)=nil, 0x4000, 0x0, 0x11, 0xffffffffffffffff, 0x0) fcntl$setstatus(r1, 0x4, 0x44040) io_setup(0x2, &(0x7f00000004c0)=0x0) io_submit(r2, 0x1, &(0x7f0000000540)=[&(0x7f00000000c0)={0x0, 0x0, 0x0, 0x1, 0x0, r1, &(0x7f0000000000), 0x10000}]) [ 135.604200] binder: 3787:3792 transaction failed 29189/-22, size 24-8 line 3014 [ 135.647259] binder: 3787:3792 ioctl c0306201 20000440 returned -14 [ 135.666399] binder: undelivered TRANSACTION_ERROR: 29189 14:08:36 executing program 1: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f0000000040)={0xa, 0x4e22}, 0x1c) listen(r0, 0xeb) ioctl$UI_SET_PHYS(0xffffffffffffffff, 0x4008556c, 0x0) setsockopt$inet6_tcp_TLS_TX(0xffffffffffffffff, 0x6, 0x1, 0x0, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) sendto$inet6(r1, 0x0, 0x0, 0x20000004, &(0x7f0000000140)={0xa, 0x4e22}, 0x1c) readv(r1, &(0x7f0000000700)=[{&(0x7f0000000440)=""/132, 0x31}], 0x1) ioctl$RTC_ALM_SET(0xffffffffffffffff, 0x40247007, 0x0) prctl$PR_MCE_KILL_GET(0x22) timerfd_create(0x0, 0x0) r2 = accept4(r0, 0x0, 0x0, 0x0) socket$inet6_udplite(0xa, 0x2, 0x88) setsockopt$packet_fanout(0xffffffffffffffff, 0x107, 0x12, 0x0, 0x309) ioctl$FICLONE(0xffffffffffffffff, 0x40049409, 0xffffffffffffffff) ioctl$PPPIOCGFLAGS1(0xffffffffffffffff, 0x8004745a, 0x0) dup(0xffffffffffffffff) shutdown(r1, 0x1) setsockopt(r1, 0x0, 0x1, &(0x7f0000000000)="1d", 0x1) sendto$inet6(r2, &(0x7f0000000300)='A', 0x1, 0x0, 0x0, 0x0) 14:08:36 executing program 2: 14:08:36 executing program 4: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) clone(0x0, 0x0, 0x0, 0x0, 0x0) symlink(&(0x7f0000000100)='./file1\x00', &(0x7f0000000040)='./file1\x00') r1 = creat(&(0x7f0000000200)='\xe9\x1fq\x89Y\x1e\x923aK\x00', 0x109) r2 = dup2(r0, r1) execve(&(0x7f00000002c0)='\xe9\x1fq\x89Y\x1e\x923aK\x00', 0x0, 0x0) open$dir(0x0, 0x841, 0x0) clone(0x3102001ffd, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) execve(&(0x7f0000000000)='./file1\x00', 0x0, 0x0) sendmmsg(r2, &(0x7f0000005b00)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0) 14:08:36 executing program 0: clone(0x802102001ffe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) wait4(0x0, 0x0, 0x80000000, 0x0) ptrace$setopts(0x4206, 0x0, 0x0, 0x0) tkill(0x0, 0x38) ptrace$cont(0x18, 0x0, 0x0, 0x0) ptrace$cont(0x18, 0x0, 0x0, 0x2) ptrace$cont(0x9, 0x0, 0x0, 0x0) 14:08:36 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") r1 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x1000)=nil, 0x1000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffd49, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000180)={0x18, 0x0, &(0x7f00000006c0)=[@increfs, @clear_death], 0x0, 0x0, 0x0}) 14:08:36 executing program 5: r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000200)='./cgroup\x00\f#\x9f\xd0\x85\xac\xc4\x9b\x81-\xb3\xd7=C\xea', 0x200002, 0x0) fchdir(r0) r1 = open(&(0x7f0000000140)='./bus\x00', 0x0, 0x0) mmap(&(0x7f0000001000/0x4000)=nil, 0x4000, 0x0, 0x11, r1, 0x0) fcntl$setstatus(0xffffffffffffffff, 0x4, 0x44040) io_setup(0x2, &(0x7f00000004c0)=0x0) io_submit(r2, 0x1, &(0x7f0000000540)=[&(0x7f00000000c0)={0x0, 0x0, 0x0, 0x1, 0x0, 0xffffffffffffffff, &(0x7f0000000000), 0x10000}]) 14:08:36 executing program 2: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f00000000c0)='ramfs\x00', 0x0, 0x0) creat(&(0x7f00000001c0)='./file0/bus\x00', 0x0) r0 = open(&(0x7f0000021000)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = open(&(0x7f0000000000)='./bus\x00', 0x1, 0x0) write$P9_RAUTH(r1, &(0x7f0000000180)={0x14}, 0x14) creat(&(0x7f0000000040)='./bus\x00', 0x0) write$P9_RMKDIR(r1, &(0x7f0000000200)={0x14}, 0x14) 14:08:36 executing program 0: clone(0x802102001ffe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) wait4(0x0, 0x0, 0x80000000, 0x0) ptrace$setopts(0x4206, 0x0, 0x0, 0x0) tkill(0x0, 0x38) ptrace$cont(0x18, 0x0, 0x0, 0x0) ptrace$cont(0x18, 0x0, 0x0, 0x2) ptrace$cont(0x9, 0x0, 0x0, 0x0) 14:08:36 executing program 0: r0 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x38) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$cont(0x18, r0, 0x0, 0x2) ptrace$cont(0x9, r0, 0x0, 0x0) 14:08:36 executing program 5: r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000200)='./cgroup\x00\f#\x9f\xd0\x85\xac\xc4\x9b\x81-\xb3\xd7=C\xea', 0x200002, 0x0) fchdir(r0) r1 = open(&(0x7f0000000140)='./bus\x00', 0x0, 0x0) mmap(&(0x7f0000001000/0x4000)=nil, 0x4000, 0x0, 0x11, r1, 0x0) fcntl$setstatus(0xffffffffffffffff, 0x4, 0x44040) io_setup(0x2, &(0x7f00000004c0)=0x0) io_submit(r2, 0x1, &(0x7f0000000540)=[&(0x7f00000000c0)={0x0, 0x0, 0x0, 0x1, 0x0, 0xffffffffffffffff, &(0x7f0000000000), 0x10000}]) [ 136.373637] binder: 3806:3813 transaction failed 29189/-22, size 24-8 line 3014 [ 136.399266] binder: 3806:3813 ioctl c0306201 20000440 returned -14 14:08:36 executing program 2: r0 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$inet6_MCAST_MSFILTER(r0, 0x29, 0x30, &(0x7f0000000300)={0x800, {{0xa, 0x0, 0x0, @mcast2}}}, 0x90) 14:08:36 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x1000)=nil, 0x1000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffd49, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x18, 0x0, &(0x7f00000006c0)=[@increfs, @clear_death], 0x0, 0x0, 0x0}) [ 136.442323] binder: undelivered TRANSACTION_ERROR: 29189 14:08:37 executing program 1: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f0000000040)={0xa, 0x4e22}, 0x1c) listen(r0, 0xeb) ioctl$UI_SET_PHYS(0xffffffffffffffff, 0x4008556c, 0x0) setsockopt$inet6_tcp_TLS_TX(0xffffffffffffffff, 0x6, 0x1, 0x0, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) sendto$inet6(r1, 0x0, 0x0, 0x20000004, &(0x7f0000000140)={0xa, 0x4e22}, 0x1c) readv(r1, &(0x7f0000000700)=[{&(0x7f0000000440)=""/132, 0x31}], 0x1) ioctl$RTC_ALM_SET(0xffffffffffffffff, 0x40247007, 0x0) prctl$PR_MCE_KILL_GET(0x22) timerfd_create(0x0, 0x0) r2 = accept4(r0, 0x0, 0x0, 0x0) socket$inet6_udplite(0xa, 0x2, 0x88) setsockopt$packet_fanout(0xffffffffffffffff, 0x107, 0x12, 0x0, 0x309) ioctl$FICLONE(0xffffffffffffffff, 0x40049409, 0xffffffffffffffff) ioctl$PPPIOCGFLAGS1(0xffffffffffffffff, 0x8004745a, 0x0) dup(0xffffffffffffffff) shutdown(r1, 0x1) setsockopt(r1, 0x0, 0x1, &(0x7f0000000000)="1d", 0x1) sendto$inet6(r2, &(0x7f0000000300)='A', 0x1, 0x0, 0x0, 0x0) 14:08:37 executing program 0: r0 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x38) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$cont(0x18, r0, 0x0, 0x2) ptrace$cont(0x9, r0, 0x0, 0x0) 14:08:37 executing program 4: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) clone(0x0, 0x0, 0x0, 0x0, 0x0) symlink(&(0x7f0000000100)='./file1\x00', &(0x7f0000000040)='./file1\x00') r1 = creat(&(0x7f0000000200)='\xe9\x1fq\x89Y\x1e\x923aK\x00', 0x109) r2 = dup2(r0, r1) execve(&(0x7f00000002c0)='\xe9\x1fq\x89Y\x1e\x923aK\x00', 0x0, 0x0) open$dir(0x0, 0x841, 0x0) clone(0x3102001ffd, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) execve(&(0x7f0000000000)='./file1\x00', 0x0, 0x0) sendmmsg(r2, &(0x7f0000005b00)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0) 14:08:37 executing program 2: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000040)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_SET_PHYS(r0, 0x4008556c, &(0x7f0000000080)='syz0\x00') 14:08:37 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x1000)=nil, 0x1000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffd49, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x18, 0x0, &(0x7f00000006c0)=[@increfs, @clear_death], 0x0, 0x0, 0x0}) 14:08:37 executing program 5: r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000200)='./cgroup\x00\f#\x9f\xd0\x85\xac\xc4\x9b\x81-\xb3\xd7=C\xea', 0x200002, 0x0) fchdir(r0) r1 = open(&(0x7f0000000140)='./bus\x00', 0x0, 0x0) mmap(&(0x7f0000001000/0x4000)=nil, 0x4000, 0x0, 0x11, r1, 0x0) fcntl$setstatus(0xffffffffffffffff, 0x4, 0x44040) io_setup(0x2, &(0x7f00000004c0)=0x0) io_submit(r2, 0x1, &(0x7f0000000540)=[&(0x7f00000000c0)={0x0, 0x0, 0x0, 0x1, 0x0, 0xffffffffffffffff, &(0x7f0000000000), 0x10000}]) 14:08:37 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x1000)=nil, 0x1000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffd49, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x18, 0x0, &(0x7f00000006c0)=[@increfs, @clear_death], 0x0, 0x0, 0x0}) 14:08:37 executing program 0: r0 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x38) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$cont(0x18, r0, 0x0, 0x2) ptrace$cont(0x9, r0, 0x0, 0x0) 14:08:37 executing program 2: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000000)='/dev/uinput\x00', 0x2, 0x0) write$uinput_user_dev(r0, &(0x7f00000000c0)={'syz1\x00'}, 0x45c) ioctl$UI_DEV_CREATE(r0, 0x5501) write$uinput_user_dev(r0, &(0x7f0000000ac0)={'syz0\x00', {}, 0x0, [], [], [], [0x0, 0x0, 0x0, 0x0, 0x0, 0x36a4]}, 0x45c) 14:08:37 executing program 3: socket$inet_udplite(0x2, 0x2, 0x88) r0 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x1000)=nil, 0x1000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffd49, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x18, 0x0, &(0x7f00000006c0)=[@increfs, @clear_death], 0x0, 0x0, 0x0}) 14:08:37 executing program 5: openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000200)='./cgroup\x00\f#\x9f\xd0\x85\xac\xc4\x9b\x81-\xb3\xd7=C\xea', 0x200002, 0x0) r0 = creat(&(0x7f0000000180)='./bus\x00', 0x0) r1 = open(&(0x7f0000000140)='./bus\x00', 0x0, 0x0) mmap(&(0x7f0000001000/0x4000)=nil, 0x4000, 0x0, 0x11, r1, 0x0) fcntl$setstatus(r0, 0x4, 0x44040) io_setup(0x2, &(0x7f00000004c0)=0x0) io_submit(r2, 0x1, &(0x7f0000000540)=[&(0x7f00000000c0)={0x0, 0x0, 0x0, 0x1, 0x0, r0, &(0x7f0000000000), 0x10000}]) 14:08:37 executing program 4: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) clone(0x0, 0x0, 0x0, 0x0, 0x0) symlink(&(0x7f0000000100)='./file1\x00', &(0x7f0000000040)='./file1\x00') r1 = creat(&(0x7f0000000200)='\xe9\x1fq\x89Y\x1e\x923aK\x00', 0x109) r2 = dup2(r0, r1) execve(&(0x7f00000002c0)='\xe9\x1fq\x89Y\x1e\x923aK\x00', 0x0, 0x0) open$dir(&(0x7f00000000c0)='./file0\x00', 0x0, 0x0) clone(0x3102001ffd, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) execve(&(0x7f0000000000)='./file1\x00', 0x0, 0x0) sendmmsg(r2, &(0x7f0000005b00)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0) [ 137.320801] binder: 3868:3872 ioctl c0306201 20000440 returned -14 [ 137.336272] input: syz1 as /devices/virtual/input/input5 [ 137.365499] binder: 3868:3872 BC_CLEAR_DEATH_NOTIFICATION death notification not active [ 137.386665] binder: release 3868:3872 transaction 51 out, still active [ 137.397557] binder: unexpected work type, 4, not freed [ 137.401442] input: syz1 as /devices/virtual/input/input6 [ 137.465751] binder: undelivered TRANSACTION_COMPLETE [ 137.489235] binder: send failed reply for transaction 51, target dead 14:08:37 executing program 5: openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000200)='./cgroup\x00\f#\x9f\xd0\x85\xac\xc4\x9b\x81-\xb3\xd7=C\xea', 0x200002, 0x0) r0 = creat(&(0x7f0000000180)='./bus\x00', 0x0) r1 = open(&(0x7f0000000140)='./bus\x00', 0x0, 0x0) mmap(&(0x7f0000001000/0x4000)=nil, 0x4000, 0x0, 0x11, r1, 0x0) fcntl$setstatus(r0, 0x4, 0x44040) io_setup(0x2, &(0x7f00000004c0)=0x0) io_submit(r2, 0x1, &(0x7f0000000540)=[&(0x7f00000000c0)={0x0, 0x0, 0x0, 0x1, 0x0, r0, &(0x7f0000000000), 0x10000}]) 14:08:37 executing program 0: clone(0x0, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x38) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$cont(0x18, r0, 0x0, 0x2) ptrace$cont(0x9, r0, 0x0, 0x0) 14:08:37 executing program 3: socket$inet_udplite(0x2, 0x2, 0x88) r0 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x1000)=nil, 0x1000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffd49, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x18, 0x0, &(0x7f00000006c0)=[@increfs, @clear_death], 0x0, 0x0, 0x0}) 14:08:37 executing program 1: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f0000000040)={0xa, 0x4e22}, 0x1c) listen(r0, 0xeb) ioctl$UI_SET_PHYS(0xffffffffffffffff, 0x4008556c, 0x0) setsockopt$inet6_tcp_TLS_TX(0xffffffffffffffff, 0x6, 0x1, 0x0, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) sendto$inet6(r1, 0x0, 0x0, 0x20000004, &(0x7f0000000140)={0xa, 0x4e22}, 0x1c) readv(r1, &(0x7f0000000700)=[{&(0x7f0000000440)=""/132, 0x31}], 0x1) ioctl$RTC_ALM_SET(0xffffffffffffffff, 0x40247007, 0x0) prctl$PR_MCE_KILL_GET(0x22) timerfd_create(0x0, 0x0) r2 = accept4(r0, 0x0, 0x0, 0x0) socket$inet6_udplite(0xa, 0x2, 0x88) setsockopt$packet_fanout(0xffffffffffffffff, 0x107, 0x12, 0x0, 0x309) ioctl$FICLONE(0xffffffffffffffff, 0x40049409, 0xffffffffffffffff) ioctl$PPPIOCGFLAGS1(0xffffffffffffffff, 0x8004745a, 0x0) dup(0xffffffffffffffff) shutdown(r1, 0x1) setsockopt(r1, 0x0, 0x1, &(0x7f0000000000)="1d", 0x1) sendto$inet6(r2, &(0x7f0000000300)='A', 0x1, 0x0, 0x0, 0x0) 14:08:37 executing program 2: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000000)='/dev/uinput\x00', 0x2, 0x0) write$uinput_user_dev(r0, &(0x7f00000000c0)={'syz1\x00'}, 0x45c) ioctl$UI_DEV_CREATE(r0, 0x5501) write$uinput_user_dev(r0, &(0x7f0000000ac0)={'syz0\x00', {}, 0x0, [], [], [], [0x0, 0x0, 0x0, 0x0, 0x0, 0x36a4]}, 0x45c) 14:08:37 executing program 4: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) clone(0x0, 0x0, 0x0, 0x0, 0x0) symlink(&(0x7f0000000100)='./file1\x00', &(0x7f0000000040)='./file1\x00') r1 = creat(&(0x7f0000000200)='\xe9\x1fq\x89Y\x1e\x923aK\x00', 0x109) r2 = dup2(r0, r1) execve(&(0x7f00000002c0)='\xe9\x1fq\x89Y\x1e\x923aK\x00', 0x0, 0x0) open$dir(&(0x7f00000000c0)='./file0\x00', 0x0, 0x0) clone(0x3102001ffd, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) execve(&(0x7f0000000000)='./file1\x00', 0x0, 0x0) sendmmsg(r2, &(0x7f0000005b00)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0) [ 138.087376] input: syz1 as /devices/virtual/input/input7 [ 138.095697] binder: 3897:3904 ioctl c0306201 20000440 returned -14 [ 138.114161] binder: 3897:3904 BC_CLEAR_DEATH_NOTIFICATION death notification not active 14:08:38 executing program 5: openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000200)='./cgroup\x00\f#\x9f\xd0\x85\xac\xc4\x9b\x81-\xb3\xd7=C\xea', 0x200002, 0x0) r0 = creat(&(0x7f0000000180)='./bus\x00', 0x0) r1 = open(&(0x7f0000000140)='./bus\x00', 0x0, 0x0) mmap(&(0x7f0000001000/0x4000)=nil, 0x4000, 0x0, 0x11, r1, 0x0) fcntl$setstatus(r0, 0x4, 0x44040) io_setup(0x2, &(0x7f00000004c0)=0x0) io_submit(r2, 0x1, &(0x7f0000000540)=[&(0x7f00000000c0)={0x0, 0x0, 0x0, 0x1, 0x0, r0, &(0x7f0000000000), 0x10000}]) 14:08:38 executing program 3: socket$inet_udplite(0x2, 0x2, 0x88) r0 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x1000)=nil, 0x1000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffd49, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x18, 0x0, &(0x7f00000006c0)=[@increfs, @clear_death], 0x0, 0x0, 0x0}) 14:08:38 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00005befdc)) r1 = syz_open_pts(r0, 0x0) ioctl$TCXONC(r1, 0x540a, 0x3) close(0xffffffffffffffff) 14:08:38 executing program 0: clone(0x0, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x38) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$cont(0x18, r0, 0x0, 0x2) ptrace$cont(0x9, r0, 0x0, 0x0) [ 138.136711] binder: release 3897:3904 transaction 56 out, still active [ 138.145029] binder: unexpected work type, 4, not freed [ 138.168300] binder: undelivered TRANSACTION_COMPLETE 14:08:38 executing program 4: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) clone(0x0, 0x0, 0x0, 0x0, 0x0) symlink(&(0x7f0000000100)='./file1\x00', &(0x7f0000000040)='./file1\x00') r1 = creat(&(0x7f0000000200)='\xe9\x1fq\x89Y\x1e\x923aK\x00', 0x109) r2 = dup2(r0, r1) execve(&(0x7f00000002c0)='\xe9\x1fq\x89Y\x1e\x923aK\x00', 0x0, 0x0) open$dir(&(0x7f00000000c0)='./file0\x00', 0x0, 0x0) clone(0x3102001ffd, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) execve(&(0x7f0000000000)='./file1\x00', 0x0, 0x0) sendmmsg(r2, &(0x7f0000005b00)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0) [ 138.212005] binder: send failed reply for transaction 56, target dead 14:08:38 executing program 2: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x200000000000013, &(0x7f0000000280)=0x400100000001, 0x4) connect$inet6(r0, &(0x7f0000000080), 0x1c) r1 = dup2(r0, r0) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r1, 0x6, 0x16, &(0x7f0000000440), 0x132224) clone(0x2100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = gettid() setsockopt$SO_ATTACH_FILTER(r0, 0x1, 0x1a, &(0x7f0000000000)={0x77, &(0x7f0000000040)}, 0x10) ptrace$setopts(0x4206, r2, 0x0, 0x0) tkill(r2, 0x3c) fcntl$setstatus(r0, 0x4, 0x42803) 14:08:38 executing program 4: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) clone(0x0, 0x0, 0x0, 0x0, 0x0) symlink(&(0x7f0000000100)='./file1\x00', &(0x7f0000000040)='./file1\x00') r1 = creat(&(0x7f0000000200)='\xe9\x1fq\x89Y\x1e\x923aK\x00', 0x109) r2 = dup2(r0, r1) execve(&(0x7f00000002c0)='\xe9\x1fq\x89Y\x1e\x923aK\x00', 0x0, 0x0) open$dir(&(0x7f00000000c0)='./file0\x00', 0x841, 0x0) clone(0x0, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) execve(&(0x7f0000000000)='./file1\x00', 0x0, 0x0) sendmmsg(r2, &(0x7f0000005b00)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0) [ 138.255739] binder: 3922:3928 ioctl c0306201 20000440 returned -14 [ 138.278104] binder: 3922:3928 BC_CLEAR_DEATH_NOTIFICATION death notification not active 14:08:38 executing program 5: fchdir(0xffffffffffffffff) r0 = creat(&(0x7f0000000180)='./bus\x00', 0x0) r1 = open(&(0x7f0000000140)='./bus\x00', 0x0, 0x0) mmap(&(0x7f0000001000/0x4000)=nil, 0x4000, 0x0, 0x11, r1, 0x0) fcntl$setstatus(r0, 0x4, 0x44040) io_setup(0x2, &(0x7f00000004c0)=0x0) io_submit(r2, 0x1, &(0x7f0000000540)=[&(0x7f00000000c0)={0x0, 0x0, 0x0, 0x1, 0x0, r0, &(0x7f0000000000), 0x10000}]) 14:08:38 executing program 3: ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") r0 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x1000)=nil, 0x1000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffd49, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x18, 0x0, &(0x7f00000006c0)=[@increfs, @clear_death], 0x0, 0x0, 0x0}) [ 138.305169] binder: release 3922:3928 transaction 61 out, still active [ 138.311855] binder: unexpected work type, 4, not freed [ 138.358701] binder: undelivered TRANSACTION_COMPLETE [ 138.364008] binder: send failed reply for transaction 61, target dead [ 138.411197] binder: 3952:3956 ioctl c0306201 20000440 returned -14 [ 138.428454] binder: 3952:3956 BC_CLEAR_DEATH_NOTIFICATION death notification not active [ 138.437341] binder: release 3952:3956 transaction 66 out, still active [ 138.454452] binder: unexpected work type, 4, not freed [ 138.462662] binder: undelivered TRANSACTION_COMPLETE [ 138.486587] binder: send failed reply for transaction 66, target dead 14:08:38 executing program 1: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f0000000040)={0xa, 0x4e22}, 0x1c) listen(r0, 0xeb) ioctl$UI_SET_PHYS(0xffffffffffffffff, 0x4008556c, 0x0) setsockopt$inet6_tcp_TLS_TX(0xffffffffffffffff, 0x6, 0x1, 0x0, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) sendto$inet6(r1, 0x0, 0x0, 0x20000004, &(0x7f0000000140)={0xa, 0x4e22}, 0x1c) readv(r1, &(0x7f0000000700)=[{&(0x7f0000000440)=""/132, 0x31}], 0x1) ioctl$RTC_ALM_SET(0xffffffffffffffff, 0x40247007, 0x0) prctl$PR_MCE_KILL_GET(0x22) timerfd_create(0x0, 0x0) r2 = accept4(r0, 0x0, 0x0, 0x0) socket$inet6_udplite(0xa, 0x2, 0x88) setsockopt$packet_fanout(0xffffffffffffffff, 0x107, 0x12, 0x0, 0x309) ioctl$EXT4_IOC_GROUP_EXTEND(0xffffffffffffffff, 0x40046607, 0x0) ioctl$PPPIOCGFLAGS1(0xffffffffffffffff, 0x8004745a, 0x0) dup(0xffffffffffffffff) shutdown(r1, 0x1) setsockopt(r1, 0x0, 0x1, &(0x7f0000000000)="1d", 0x1) sendto$inet6(r2, &(0x7f0000000300)='A', 0x1, 0x0, 0x0, 0x0) 14:08:38 executing program 0: clone(0x0, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x38) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$cont(0x18, r0, 0x0, 0x2) ptrace$cont(0x9, r0, 0x0, 0x0) 14:08:38 executing program 4: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) clone(0x0, 0x0, 0x0, 0x0, 0x0) symlink(&(0x7f0000000100)='./file1\x00', &(0x7f0000000040)='./file1\x00') r1 = creat(&(0x7f0000000200)='\xe9\x1fq\x89Y\x1e\x923aK\x00', 0x109) r2 = dup2(r0, r1) execve(&(0x7f00000002c0)='\xe9\x1fq\x89Y\x1e\x923aK\x00', 0x0, 0x0) open$dir(&(0x7f00000000c0)='./file0\x00', 0x841, 0x0) clone(0x0, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) execve(&(0x7f0000000000)='./file1\x00', 0x0, 0x0) sendmmsg(r2, &(0x7f0000005b00)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0) 14:08:38 executing program 3: ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") r0 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x1000)=nil, 0x1000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffd49, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x18, 0x0, &(0x7f00000006c0)=[@increfs, @clear_death], 0x0, 0x0, 0x0}) 14:08:38 executing program 5: fchdir(0xffffffffffffffff) r0 = creat(&(0x7f0000000180)='./bus\x00', 0x0) r1 = open(&(0x7f0000000140)='./bus\x00', 0x0, 0x0) mmap(&(0x7f0000001000/0x4000)=nil, 0x4000, 0x0, 0x11, r1, 0x0) fcntl$setstatus(r0, 0x4, 0x44040) io_setup(0x2, &(0x7f00000004c0)=0x0) io_submit(r2, 0x1, &(0x7f0000000540)=[&(0x7f00000000c0)={0x0, 0x0, 0x0, 0x1, 0x0, r0, &(0x7f0000000000), 0x10000}]) 14:08:38 executing program 3: ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") r0 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x1000)=nil, 0x1000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffd49, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x18, 0x0, &(0x7f00000006c0)=[@increfs, @clear_death], 0x0, 0x0, 0x0}) [ 138.946587] binder: 3968:3973 ioctl c0306201 20000440 returned -14 [ 138.955640] binder: 3968:3973 BC_CLEAR_DEATH_NOTIFICATION death notification not active [ 138.968407] binder: release 3968:3973 transaction 71 out, still active [ 138.982137] binder: unexpected work type, 4, not freed [ 138.988976] binder: BINDER_SET_CONTEXT_MGR already set 14:08:38 executing program 0: clone(0x802102001ffe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x0, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x38) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$cont(0x18, r0, 0x0, 0x2) ptrace$cont(0x9, r0, 0x0, 0x0) 14:08:38 executing program 5: fchdir(0xffffffffffffffff) r0 = creat(&(0x7f0000000180)='./bus\x00', 0x0) r1 = open(&(0x7f0000000140)='./bus\x00', 0x0, 0x0) mmap(&(0x7f0000001000/0x4000)=nil, 0x4000, 0x0, 0x11, r1, 0x0) fcntl$setstatus(r0, 0x4, 0x44040) io_setup(0x2, &(0x7f00000004c0)=0x0) io_submit(r2, 0x1, &(0x7f0000000540)=[&(0x7f00000000c0)={0x0, 0x0, 0x0, 0x1, 0x0, r0, &(0x7f0000000000), 0x10000}]) [ 139.000007] binder: 3978:3979 ioctl 40046207 0 returned -16 [ 139.000903] binder: undelivered TRANSACTION_COMPLETE [ 139.001329] binder: send failed reply for transaction 71, target dead [ 139.047837] binder: 3978:3983 transaction failed 29189/-22, size 24-8 line 3014 [ 139.081352] binder: 3978:3993 IncRefs 0 refcount change on invalid ref 0 ret -22 [ 139.084754] binder: 3978:3983 ioctl c0306201 20000440 returned -14 [ 139.101516] binder: 3978:3993 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 [ 139.111231] binder: undelivered TRANSACTION_ERROR: 29189 14:08:41 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x802, 0x0) readv(r0, &(0x7f0000000100)=[{&(0x7f0000000080)=""/4, 0x4}], 0x2dc) 14:08:41 executing program 4: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) clone(0x0, 0x0, 0x0, 0x0, 0x0) symlink(&(0x7f0000000100)='./file1\x00', &(0x7f0000000040)='./file1\x00') r1 = creat(&(0x7f0000000200)='\xe9\x1fq\x89Y\x1e\x923aK\x00', 0x109) r2 = dup2(r0, r1) execve(&(0x7f00000002c0)='\xe9\x1fq\x89Y\x1e\x923aK\x00', 0x0, 0x0) open$dir(&(0x7f00000000c0)='./file0\x00', 0x841, 0x0) clone(0x0, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) execve(&(0x7f0000000000)='./file1\x00', 0x0, 0x0) sendmmsg(r2, &(0x7f0000005b00)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0) 14:08:41 executing program 0: clone(0x802102001ffe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x0, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x38) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$cont(0x18, r0, 0x0, 0x2) ptrace$cont(0x9, r0, 0x0, 0x0) 14:08:41 executing program 3: socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") r0 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x1000)=nil, 0x1000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffd49, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x18, 0x0, &(0x7f00000006c0)=[@increfs, @clear_death], 0x0, 0x0, 0x0}) 14:08:41 executing program 5: r0 = openat$cgroup_root(0xffffffffffffff9c, 0x0, 0x200002, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000180)='./bus\x00', 0x0) r2 = open(&(0x7f0000000140)='./bus\x00', 0x0, 0x0) mmap(&(0x7f0000001000/0x4000)=nil, 0x4000, 0x0, 0x11, r2, 0x0) fcntl$setstatus(r1, 0x4, 0x44040) io_setup(0x2, &(0x7f00000004c0)=0x0) io_submit(r3, 0x1, &(0x7f0000000540)=[&(0x7f00000000c0)={0x0, 0x0, 0x0, 0x1, 0x0, r1, &(0x7f0000000000), 0x10000}]) 14:08:41 executing program 1: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f0000000040)={0xa, 0x4e22}, 0x1c) listen(r0, 0xeb) ioctl$UI_SET_PHYS(0xffffffffffffffff, 0x4008556c, 0x0) setsockopt$inet6_tcp_TLS_TX(0xffffffffffffffff, 0x6, 0x1, 0x0, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) sendto$inet6(r1, 0x0, 0x0, 0x20000004, &(0x7f0000000140)={0xa, 0x4e22}, 0x1c) readv(r1, &(0x7f0000000700)=[{&(0x7f0000000440)=""/132, 0x31}], 0x1) ioctl$RTC_ALM_SET(0xffffffffffffffff, 0x40247007, 0x0) prctl$PR_MCE_KILL_GET(0x22) timerfd_create(0x0, 0x0) r2 = accept4(r0, 0x0, 0x0, 0x0) socket$inet6_udplite(0xa, 0x2, 0x88) setsockopt$packet_fanout(0xffffffffffffffff, 0x107, 0x12, 0x0, 0x309) ioctl$EXT4_IOC_GROUP_EXTEND(0xffffffffffffffff, 0x40046607, 0x0) ioctl$PPPIOCGFLAGS1(0xffffffffffffffff, 0x8004745a, 0x0) dup(0xffffffffffffffff) shutdown(r1, 0x1) setsockopt(r1, 0x0, 0x1, &(0x7f0000000000)="1d", 0x1) sendto$inet6(r2, &(0x7f0000000300)='A', 0x1, 0x0, 0x0, 0x0) 14:08:41 executing program 0: clone(0x802102001ffe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x0, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x38) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$cont(0x18, r0, 0x0, 0x2) ptrace$cont(0x9, r0, 0x0, 0x0) 14:08:41 executing program 2: openat$rtc(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rtc0\x00', 0x6100, 0x0) 14:08:41 executing program 0: clone(0x802102001ffe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) ptrace$setopts(0xffffffffffffffff, r0, 0x0, 0x0) tkill(r0, 0x38) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$cont(0x18, r0, 0x0, 0x2) ptrace$cont(0x9, r0, 0x0, 0x0) [ 141.324226] binder: 4001:4002 ioctl c0306201 20000440 returned -14 [ 141.342468] binder: 4001:4002 BC_CLEAR_DEATH_NOTIFICATION death notification not active 14:08:41 executing program 2: openat$rtc(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rtc0\x00', 0x6100, 0x0) 14:08:41 executing program 5: r0 = openat$cgroup_root(0xffffffffffffff9c, 0x0, 0x200002, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000180)='./bus\x00', 0x0) r2 = open(&(0x7f0000000140)='./bus\x00', 0x0, 0x0) mmap(&(0x7f0000001000/0x4000)=nil, 0x4000, 0x0, 0x11, r2, 0x0) fcntl$setstatus(r1, 0x4, 0x44040) io_setup(0x2, &(0x7f00000004c0)=0x0) io_submit(r3, 0x1, &(0x7f0000000540)=[&(0x7f00000000c0)={0x0, 0x0, 0x0, 0x1, 0x0, r1, &(0x7f0000000000), 0x10000}]) [ 141.377538] binder: release 4001:4002 transaction 77 out, still active [ 141.389938] binder: unexpected work type, 4, not freed 14:08:41 executing program 3: socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") r0 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x1000)=nil, 0x1000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffd49, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x18, 0x0, &(0x7f00000006c0)=[@increfs, @clear_death], 0x0, 0x0, 0x0}) 14:08:41 executing program 0: clone(0x802102001ffe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) ptrace$setopts(0xffffffffffffffff, r0, 0x0, 0x0) tkill(r0, 0x38) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$cont(0x18, r0, 0x0, 0x2) ptrace$cont(0x9, r0, 0x0, 0x0) 14:08:41 executing program 4: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) clone(0x0, 0x0, 0x0, 0x0, 0x0) symlink(&(0x7f0000000100)='./file1\x00', &(0x7f0000000040)='./file1\x00') r1 = creat(&(0x7f0000000200)='\xe9\x1fq\x89Y\x1e\x923aK\x00', 0x109) r2 = dup2(r0, r1) execve(&(0x7f00000002c0)='\xe9\x1fq\x89Y\x1e\x923aK\x00', 0x0, 0x0) open$dir(&(0x7f00000000c0)='./file0\x00', 0x841, 0x0) clone(0x3102001ffd, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) execve(0x0, 0x0, 0x0) sendmmsg(r2, &(0x7f0000005b00)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0) [ 141.418330] binder: undelivered TRANSACTION_COMPLETE [ 141.426857] binder: send failed reply for transaction 77, target dead 14:08:41 executing program 2: openat$rtc(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rtc0\x00', 0x6100, 0x0) 14:08:41 executing program 0: clone(0x802102001ffe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) ptrace$setopts(0xffffffffffffffff, r0, 0x0, 0x0) tkill(r0, 0x38) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$cont(0x18, r0, 0x0, 0x2) ptrace$cont(0x9, r0, 0x0, 0x0) 14:08:41 executing program 0: clone(0x802102001ffe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) ptrace$setopts(0x4206, 0x0, 0x0, 0x0) tkill(r0, 0x38) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$cont(0x18, r0, 0x0, 0x2) ptrace$cont(0x9, r0, 0x0, 0x0) [ 141.512401] binder: 4035:4040 ioctl c0306201 20000440 returned -14 [ 141.563394] binder: 4035:4050 BC_CLEAR_DEATH_NOTIFICATION death notification not active [ 141.599455] binder: release 4035:4040 transaction 82 out, still active [ 141.625129] binder: unexpected work type, 4, not freed [ 141.637455] binder: undelivered TRANSACTION_COMPLETE [ 141.651936] binder: send failed reply for transaction 82, target dead 14:08:42 executing program 1: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f0000000040)={0xa, 0x4e22}, 0x1c) listen(r0, 0xeb) ioctl$UI_SET_PHYS(0xffffffffffffffff, 0x4008556c, 0x0) setsockopt$inet6_tcp_TLS_TX(0xffffffffffffffff, 0x6, 0x1, 0x0, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) sendto$inet6(r1, 0x0, 0x0, 0x20000004, &(0x7f0000000140)={0xa, 0x4e22}, 0x1c) readv(r1, &(0x7f0000000700)=[{&(0x7f0000000440)=""/132, 0x31}], 0x1) ioctl$RTC_ALM_SET(0xffffffffffffffff, 0x40247007, 0x0) prctl$PR_MCE_KILL_GET(0x22) timerfd_create(0x0, 0x0) r2 = accept4(r0, 0x0, 0x0, 0x0) socket$inet6_udplite(0xa, 0x2, 0x88) setsockopt$packet_fanout(0xffffffffffffffff, 0x107, 0x12, 0x0, 0x309) ioctl$EXT4_IOC_GROUP_EXTEND(0xffffffffffffffff, 0x40046607, 0x0) ioctl$PPPIOCGFLAGS1(0xffffffffffffffff, 0x8004745a, 0x0) dup(0xffffffffffffffff) shutdown(r1, 0x1) setsockopt(r1, 0x0, 0x1, &(0x7f0000000000)="1d", 0x1) sendto$inet6(r2, &(0x7f0000000300)='A', 0x1, 0x0, 0x0, 0x0) 14:08:42 executing program 2: openat$rtc(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rtc0\x00', 0x6100, 0x0) 14:08:42 executing program 5: r0 = openat$cgroup_root(0xffffffffffffff9c, 0x0, 0x200002, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000180)='./bus\x00', 0x0) r2 = open(&(0x7f0000000140)='./bus\x00', 0x0, 0x0) mmap(&(0x7f0000001000/0x4000)=nil, 0x4000, 0x0, 0x11, r2, 0x0) fcntl$setstatus(r1, 0x4, 0x44040) io_setup(0x2, &(0x7f00000004c0)=0x0) io_submit(r3, 0x1, &(0x7f0000000540)=[&(0x7f00000000c0)={0x0, 0x0, 0x0, 0x1, 0x0, r1, &(0x7f0000000000), 0x10000}]) 14:08:42 executing program 0: clone(0x802102001ffe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) ptrace$setopts(0x4206, 0x0, 0x0, 0x0) tkill(r0, 0x38) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$cont(0x18, r0, 0x0, 0x2) ptrace$cont(0x9, r0, 0x0, 0x0) 14:08:42 executing program 3: socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") r0 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x1000)=nil, 0x1000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffd49, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x18, 0x0, &(0x7f00000006c0)=[@increfs, @clear_death], 0x0, 0x0, 0x0}) 14:08:42 executing program 4: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) clone(0x0, 0x0, 0x0, 0x0, 0x0) symlink(&(0x7f0000000100)='./file1\x00', &(0x7f0000000040)='./file1\x00') r1 = creat(&(0x7f0000000200)='\xe9\x1fq\x89Y\x1e\x923aK\x00', 0x109) r2 = dup2(r0, r1) execve(&(0x7f00000002c0)='\xe9\x1fq\x89Y\x1e\x923aK\x00', 0x0, 0x0) open$dir(&(0x7f00000000c0)='./file0\x00', 0x841, 0x0) clone(0x3102001ffd, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) execve(0x0, 0x0, 0x0) sendmmsg(r2, &(0x7f0000005b00)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0) 14:08:42 executing program 2: openat$rtc(0xffffffffffffff9c, 0x0, 0x6100, 0x0) 14:08:42 executing program 0: clone(0x802102001ffe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) ptrace$setopts(0x4206, 0x0, 0x0, 0x0) tkill(r0, 0x38) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$cont(0x18, r0, 0x0, 0x2) ptrace$cont(0x9, r0, 0x0, 0x0) [ 142.152761] binder: 4065:4069 ioctl c0306201 20000440 returned -14 14:08:42 executing program 2: openat$rtc(0xffffffffffffff9c, 0x0, 0x6100, 0x0) 14:08:42 executing program 4: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) clone(0x0, 0x0, 0x0, 0x0, 0x0) symlink(&(0x7f0000000100)='./file1\x00', &(0x7f0000000040)='./file1\x00') r1 = creat(&(0x7f0000000200)='\xe9\x1fq\x89Y\x1e\x923aK\x00', 0x109) r2 = dup2(r0, r1) execve(&(0x7f00000002c0)='\xe9\x1fq\x89Y\x1e\x923aK\x00', 0x0, 0x0) open$dir(&(0x7f00000000c0)='./file0\x00', 0x841, 0x0) clone(0x3102001ffd, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) execve(0x0, 0x0, 0x0) sendmmsg(r2, &(0x7f0000005b00)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0) 14:08:42 executing program 0: clone(0x802102001ffe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(0x0, 0x38) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$cont(0x18, r0, 0x0, 0x2) ptrace$cont(0x9, r0, 0x0, 0x0) 14:08:42 executing program 5: openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000200)='./cgroup\x00\f#\x9f\xd0\x85\xac\xc4\x9b\x81-\xb3\xd7=C\xea', 0x200002, 0x0) fchdir(0xffffffffffffffff) r0 = creat(&(0x7f0000000180)='./bus\x00', 0x0) r1 = open(&(0x7f0000000140)='./bus\x00', 0x0, 0x0) mmap(&(0x7f0000001000/0x4000)=nil, 0x4000, 0x0, 0x11, r1, 0x0) fcntl$setstatus(r0, 0x4, 0x44040) io_setup(0x2, &(0x7f00000004c0)=0x0) io_submit(r2, 0x1, &(0x7f0000000540)=[&(0x7f00000000c0)={0x0, 0x0, 0x0, 0x1, 0x0, r0, &(0x7f0000000000), 0x10000}]) [ 142.201646] binder: 4065:4082 BC_CLEAR_DEATH_NOTIFICATION death notification not active [ 142.232086] binder: release 4065:4069 transaction 87 out, still active [ 142.242475] binder: unexpected work type, 4, not freed [ 142.295850] binder: undelivered TRANSACTION_COMPLETE [ 142.331013] binder: send failed reply for transaction 87, target dead 14:08:42 executing program 1: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f0000000040)={0xa, 0x4e22}, 0x1c) listen(r0, 0xeb) ioctl$UI_SET_PHYS(0xffffffffffffffff, 0x4008556c, 0x0) setsockopt$inet6_tcp_TLS_TX(0xffffffffffffffff, 0x6, 0x1, 0x0, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) sendto$inet6(r1, 0x0, 0x0, 0x20000004, &(0x7f0000000140)={0xa, 0x4e22}, 0x1c) readv(r1, &(0x7f0000000700)=[{&(0x7f0000000440)=""/132, 0x31}], 0x1) ioctl$RTC_ALM_SET(0xffffffffffffffff, 0x40247007, 0x0) prctl$PR_MCE_KILL_GET(0x22) timerfd_create(0x0, 0x0) r2 = accept4(r0, 0x0, 0x0, 0x0) socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$FICLONE(0xffffffffffffffff, 0x40049409, 0xffffffffffffffff) ioctl$EXT4_IOC_GROUP_EXTEND(0xffffffffffffffff, 0x40046607, 0x0) ioctl$PPPIOCGFLAGS1(0xffffffffffffffff, 0x8004745a, 0x0) dup(0xffffffffffffffff) shutdown(r1, 0x1) setsockopt(r1, 0x0, 0x1, &(0x7f0000000000)="1d", 0x1) sendto$inet6(r2, &(0x7f0000000300)='A', 0x1, 0x0, 0x0, 0x0) 14:08:42 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x0, &(0x7f0000000040)="0adc1f123c123f3188b070") r1 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x1000)=nil, 0x1000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffd49, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000180)={0x18, 0x0, &(0x7f00000006c0)=[@increfs, @clear_death], 0x0, 0x0, 0x0}) 14:08:42 executing program 2: openat$rtc(0xffffffffffffff9c, 0x0, 0x6100, 0x0) 14:08:42 executing program 4: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) clone(0x0, 0x0, 0x0, 0x0, 0x0) symlink(&(0x7f0000000100)='./file1\x00', &(0x7f0000000040)='./file1\x00') r1 = creat(&(0x7f0000000200)='\xe9\x1fq\x89Y\x1e\x923aK\x00', 0x109) dup2(r0, r1) execve(&(0x7f00000002c0)='\xe9\x1fq\x89Y\x1e\x923aK\x00', 0x0, 0x0) open$dir(&(0x7f00000000c0)='./file0\x00', 0x841, 0x0) clone(0x3102001ffd, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) execve(&(0x7f0000000000)='./file1\x00', 0x0, 0x0) sendmmsg(0xffffffffffffffff, &(0x7f0000005b00)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0) 14:08:42 executing program 5: openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000200)='./cgroup\x00\f#\x9f\xd0\x85\xac\xc4\x9b\x81-\xb3\xd7=C\xea', 0x200002, 0x0) fchdir(0xffffffffffffffff) r0 = creat(&(0x7f0000000180)='./bus\x00', 0x0) r1 = open(&(0x7f0000000140)='./bus\x00', 0x0, 0x0) mmap(&(0x7f0000001000/0x4000)=nil, 0x4000, 0x0, 0x11, r1, 0x0) fcntl$setstatus(r0, 0x4, 0x44040) io_setup(0x2, &(0x7f00000004c0)=0x0) io_submit(r2, 0x1, &(0x7f0000000540)=[&(0x7f00000000c0)={0x0, 0x0, 0x0, 0x1, 0x0, r0, &(0x7f0000000000), 0x10000}]) 14:08:42 executing program 2: openat$rtc(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rtc0\x00', 0x0, 0x0) [ 143.027304] binder: 4110:4112 ioctl c0306201 20000440 returned -14 [ 143.048686] binder: 4110:4112 BC_CLEAR_DEATH_NOTIFICATION death notification not active [ 143.068380] binder: release 4110:4112 transaction 92 out, still active 14:08:43 executing program 2: openat$rtc(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rtc0\x00', 0x0, 0x0) 14:08:43 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x0, &(0x7f0000000040)="0adc1f123c123f3188b070") r1 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x1000)=nil, 0x1000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffd49, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000180)={0x18, 0x0, &(0x7f00000006c0)=[@increfs, @clear_death], 0x0, 0x0, 0x0}) 14:08:43 executing program 5: openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000200)='./cgroup\x00\f#\x9f\xd0\x85\xac\xc4\x9b\x81-\xb3\xd7=C\xea', 0x200002, 0x0) fchdir(0xffffffffffffffff) r0 = creat(&(0x7f0000000180)='./bus\x00', 0x0) r1 = open(&(0x7f0000000140)='./bus\x00', 0x0, 0x0) mmap(&(0x7f0000001000/0x4000)=nil, 0x4000, 0x0, 0x11, r1, 0x0) fcntl$setstatus(r0, 0x4, 0x44040) io_setup(0x2, &(0x7f00000004c0)=0x0) io_submit(r2, 0x1, &(0x7f0000000540)=[&(0x7f00000000c0)={0x0, 0x0, 0x0, 0x1, 0x0, r0, &(0x7f0000000000), 0x10000}]) [ 143.079011] binder: unexpected work type, 4, not freed [ 143.088396] binder: undelivered TRANSACTION_COMPLETE [ 143.093766] binder: send failed reply for transaction 92, target dead 14:08:43 executing program 4: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) clone(0x0, 0x0, 0x0, 0x0, 0x0) symlink(&(0x7f0000000100)='./file1\x00', &(0x7f0000000040)='./file1\x00') r1 = creat(&(0x7f0000000200)='\xe9\x1fq\x89Y\x1e\x923aK\x00', 0x109) dup2(r0, r1) execve(&(0x7f00000002c0)='\xe9\x1fq\x89Y\x1e\x923aK\x00', 0x0, 0x0) open$dir(&(0x7f00000000c0)='./file0\x00', 0x841, 0x0) clone(0x3102001ffd, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) execve(&(0x7f0000000000)='./file1\x00', 0x0, 0x0) sendmmsg(0xffffffffffffffff, &(0x7f0000005b00)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0) [ 143.164283] binder: 4132:4135 ioctl c0306201 20000440 returned -14 [ 143.198836] binder: 4132:4135 BC_CLEAR_DEATH_NOTIFICATION death notification not active [ 143.221130] binder: release 4132:4135 transaction 97 out, still active [ 143.229222] binder: unexpected work type, 4, not freed [ 143.247605] binder: undelivered TRANSACTION_COMPLETE [ 143.253511] binder: send failed reply for transaction 97, target dead 14:08:45 executing program 0: clone(0x802102001ffe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(0x0, 0x38) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$cont(0x18, r0, 0x0, 0x2) ptrace$cont(0x9, r0, 0x0, 0x0) 14:08:45 executing program 2: openat$rtc(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rtc0\x00', 0x0, 0x0) 14:08:45 executing program 4: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) clone(0x0, 0x0, 0x0, 0x0, 0x0) symlink(&(0x7f0000000100)='./file1\x00', &(0x7f0000000040)='./file1\x00') r1 = creat(&(0x7f0000000200)='\xe9\x1fq\x89Y\x1e\x923aK\x00', 0x109) dup2(r0, r1) execve(&(0x7f00000002c0)='\xe9\x1fq\x89Y\x1e\x923aK\x00', 0x0, 0x0) open$dir(&(0x7f00000000c0)='./file0\x00', 0x841, 0x0) clone(0x3102001ffd, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) execve(&(0x7f0000000000)='./file1\x00', 0x0, 0x0) sendmmsg(0xffffffffffffffff, &(0x7f0000005b00)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0) 14:08:45 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x0, &(0x7f0000000040)="0adc1f123c123f3188b070") r1 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x1000)=nil, 0x1000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffd49, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000180)={0x18, 0x0, &(0x7f00000006c0)=[@increfs, @clear_death], 0x0, 0x0, 0x0}) 14:08:45 executing program 5: r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000200)='./cgroup\x00\f#\x9f\xd0\x85\xac\xc4\x9b\x81-\xb3\xd7=C\xea', 0x200002, 0x0) fchdir(r0) r1 = creat(0x0, 0x0) r2 = open(&(0x7f0000000140)='./bus\x00', 0x0, 0x0) mmap(&(0x7f0000001000/0x4000)=nil, 0x4000, 0x0, 0x11, r2, 0x0) fcntl$setstatus(r1, 0x4, 0x44040) io_setup(0x2, &(0x7f00000004c0)=0x0) io_submit(r3, 0x1, &(0x7f0000000540)=[&(0x7f00000000c0)={0x0, 0x0, 0x0, 0x1, 0x0, r1, &(0x7f0000000000), 0x10000}]) 14:08:45 executing program 1: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f0000000040)={0xa, 0x4e22}, 0x1c) listen(r0, 0xeb) ioctl$UI_SET_PHYS(0xffffffffffffffff, 0x4008556c, 0x0) setsockopt$inet6_tcp_TLS_TX(0xffffffffffffffff, 0x6, 0x1, 0x0, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) sendto$inet6(r1, 0x0, 0x0, 0x20000004, &(0x7f0000000140)={0xa, 0x4e22}, 0x1c) readv(r1, &(0x7f0000000700)=[{&(0x7f0000000440)=""/132, 0x31}], 0x1) ioctl$RTC_ALM_SET(0xffffffffffffffff, 0x40247007, 0x0) prctl$PR_MCE_KILL_GET(0x22) timerfd_create(0x0, 0x0) r2 = accept4(r0, 0x0, 0x0, 0x0) socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$FICLONE(0xffffffffffffffff, 0x40049409, 0xffffffffffffffff) ioctl$EXT4_IOC_GROUP_EXTEND(0xffffffffffffffff, 0x40046607, 0x0) ioctl$PPPIOCGFLAGS1(0xffffffffffffffff, 0x8004745a, 0x0) dup(0xffffffffffffffff) shutdown(r1, 0x1) setsockopt(r1, 0x0, 0x1, &(0x7f0000000000)="1d", 0x1) sendto$inet6(r2, &(0x7f0000000300)='A', 0x1, 0x0, 0x0, 0x0) 14:08:45 executing program 2: r0 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000140)='/dev/vga_arbiter\x00', 0x0, 0x0) fsetxattr$security_capability(r0, &(0x7f00000001c0)='security.capability\x00', 0x0, 0x0, 0x0) 14:08:45 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x1000)=nil, 0x1000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffd49, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000180)={0x18, 0x0, &(0x7f00000006c0)=[@increfs, @clear_death], 0x0, 0x0, 0x0}) [ 145.305044] binder: 4151:4156 ioctl c0306201 20000440 returned -14 [ 145.320451] binder: 4151:4156 BC_CLEAR_DEATH_NOTIFICATION death notification not active [ 145.331651] binder: release 4151:4156 transaction 102 out, still active [ 145.340921] binder: unexpected work type, 4, not freed 14:08:45 executing program 5: r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000200)='./cgroup\x00\f#\x9f\xd0\x85\xac\xc4\x9b\x81-\xb3\xd7=C\xea', 0x200002, 0x0) fchdir(r0) r1 = creat(0x0, 0x0) r2 = open(&(0x7f0000000140)='./bus\x00', 0x0, 0x0) mmap(&(0x7f0000001000/0x4000)=nil, 0x4000, 0x0, 0x11, r2, 0x0) fcntl$setstatus(r1, 0x4, 0x44040) io_setup(0x2, &(0x7f00000004c0)=0x0) io_submit(r3, 0x1, &(0x7f0000000540)=[&(0x7f00000000c0)={0x0, 0x0, 0x0, 0x1, 0x0, r1, &(0x7f0000000000), 0x10000}]) [ 145.372379] binder: undelivered TRANSACTION_COMPLETE 14:08:45 executing program 2: sendmsg$TIPC_NL_BEARER_SET(0xffffffffffffffff, 0x0, 0x0) perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0xee6b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) clone(0x0, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) perf_event_open(&(0x7f0000000040)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) 14:08:45 executing program 4: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) clone(0x0, 0x0, 0x0, 0x0, 0x0) symlink(&(0x7f0000000100)='./file1\x00', &(0x7f0000000040)='./file1\x00') r1 = creat(&(0x7f0000000200)='\xe9\x1fq\x89Y\x1e\x923aK\x00', 0x109) r2 = dup2(r0, r1) execve(&(0x7f00000002c0)='\xe9\x1fq\x89Y\x1e\x923aK\x00', 0x0, 0x0) open$dir(&(0x7f00000000c0)='./file0\x00', 0x841, 0x0) clone(0x3102001ffd, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) execve(&(0x7f0000000000)='./file1\x00', 0x0, 0x0) sendmmsg(r2, 0x0, 0x0, 0x0) [ 145.412532] binder: send failed reply for transaction 102, target dead [ 145.432644] binder: 4173:4176 ioctl c0306201 20000440 returned -14 14:08:45 executing program 2: clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) wait4(0x0, 0x0, 0x80000000, 0x0) r0 = gettid() r1 = getpid() syz_open_procfs(r0, 0x0) pipe(&(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) write(r2, &(0x7f00000001c0), 0xfffffef3) tkill(r1, 0x9) [ 145.465720] binder: 4173:4176 BC_CLEAR_DEATH_NOTIFICATION death notification not active [ 145.479792] binder: release 4173:4176 transaction 107 out, still active [ 145.488789] binder: unexpected work type, 4, not freed [ 145.516650] binder: undelivered TRANSACTION_COMPLETE [ 145.553643] binder: send failed reply for transaction 107, target dead 14:08:48 executing program 0: clone(0x802102001ffe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(0x0, 0x38) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$cont(0x18, r0, 0x0, 0x2) ptrace$cont(0x9, r0, 0x0, 0x0) 14:08:48 executing program 5: r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000200)='./cgroup\x00\f#\x9f\xd0\x85\xac\xc4\x9b\x81-\xb3\xd7=C\xea', 0x200002, 0x0) fchdir(r0) r1 = creat(0x0, 0x0) r2 = open(&(0x7f0000000140)='./bus\x00', 0x0, 0x0) mmap(&(0x7f0000001000/0x4000)=nil, 0x4000, 0x0, 0x11, r2, 0x0) fcntl$setstatus(r1, 0x4, 0x44040) io_setup(0x2, &(0x7f00000004c0)=0x0) io_submit(r3, 0x1, &(0x7f0000000540)=[&(0x7f00000000c0)={0x0, 0x0, 0x0, 0x1, 0x0, r1, &(0x7f0000000000), 0x10000}]) 14:08:48 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x1000)=nil, 0x1000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffd49, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000180)={0x18, 0x0, &(0x7f00000006c0)=[@increfs, @clear_death], 0x0, 0x0, 0x0}) 14:08:48 executing program 4: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) clone(0x0, 0x0, 0x0, 0x0, 0x0) symlink(&(0x7f0000000100)='./file1\x00', &(0x7f0000000040)='./file1\x00') r1 = creat(&(0x7f0000000200)='\xe9\x1fq\x89Y\x1e\x923aK\x00', 0x109) r2 = dup2(r0, r1) execve(&(0x7f00000002c0)='\xe9\x1fq\x89Y\x1e\x923aK\x00', 0x0, 0x0) open$dir(&(0x7f00000000c0)='./file0\x00', 0x841, 0x0) clone(0x3102001ffd, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) execve(&(0x7f0000000000)='./file1\x00', 0x0, 0x0) sendmmsg(r2, 0x0, 0x0, 0x0) 14:08:48 executing program 2: r0 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rtc0\x00', 0x0, 0x0) ioctl$RTC_IRQP_READ(r0, 0x8008700b, 0x0) 14:08:48 executing program 1: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f0000000040)={0xa, 0x4e22}, 0x1c) listen(r0, 0xeb) ioctl$UI_SET_PHYS(0xffffffffffffffff, 0x4008556c, 0x0) setsockopt$inet6_tcp_TLS_TX(0xffffffffffffffff, 0x6, 0x1, 0x0, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) sendto$inet6(r1, 0x0, 0x0, 0x20000004, &(0x7f0000000140)={0xa, 0x4e22}, 0x1c) readv(r1, &(0x7f0000000700)=[{&(0x7f0000000440)=""/132, 0x31}], 0x1) ioctl$RTC_ALM_SET(0xffffffffffffffff, 0x40247007, 0x0) prctl$PR_MCE_KILL_GET(0x22) timerfd_create(0x0, 0x0) r2 = accept4(r0, 0x0, 0x0, 0x0) socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$FICLONE(0xffffffffffffffff, 0x40049409, 0xffffffffffffffff) ioctl$EXT4_IOC_GROUP_EXTEND(0xffffffffffffffff, 0x40046607, 0x0) ioctl$PPPIOCGFLAGS1(0xffffffffffffffff, 0x8004745a, 0x0) dup(0xffffffffffffffff) shutdown(r1, 0x1) setsockopt(r1, 0x0, 0x1, &(0x7f0000000000)="1d", 0x1) sendto$inet6(r2, &(0x7f0000000300)='A', 0x1, 0x0, 0x0, 0x0) 14:08:48 executing program 2: 14:08:48 executing program 4: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) clone(0x0, 0x0, 0x0, 0x0, 0x0) symlink(&(0x7f0000000100)='./file1\x00', &(0x7f0000000040)='./file1\x00') r1 = creat(&(0x7f0000000200)='\xe9\x1fq\x89Y\x1e\x923aK\x00', 0x109) r2 = dup2(r0, r1) execve(&(0x7f00000002c0)='\xe9\x1fq\x89Y\x1e\x923aK\x00', 0x0, 0x0) open$dir(&(0x7f00000000c0)='./file0\x00', 0x841, 0x0) clone(0x3102001ffd, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) execve(&(0x7f0000000000)='./file1\x00', 0x0, 0x0) sendmmsg(r2, 0x0, 0x0, 0x0) [ 148.331768] binder: 4206:4212 ioctl c0306201 20000440 returned -14 14:08:48 executing program 2: 14:08:48 executing program 5: r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000200)='./cgroup\x00\f#\x9f\xd0\x85\xac\xc4\x9b\x81-\xb3\xd7=C\xea', 0x200002, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000180)='./bus\x00', 0x0) r2 = open(0x0, 0x0, 0x0) mmap(&(0x7f0000001000/0x4000)=nil, 0x4000, 0x0, 0x11, r2, 0x0) fcntl$setstatus(r1, 0x4, 0x44040) io_setup(0x2, &(0x7f00000004c0)=0x0) io_submit(r3, 0x1, &(0x7f0000000540)=[&(0x7f00000000c0)={0x0, 0x0, 0x0, 0x1, 0x0, r1, &(0x7f0000000000), 0x10000}]) 14:08:48 executing program 0: clone(0x802102001ffe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x0) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$cont(0x18, r0, 0x0, 0x2) ptrace$cont(0x9, r0, 0x0, 0x0) [ 148.379765] binder: 4206:4227 BC_CLEAR_DEATH_NOTIFICATION death notification not active 14:08:48 executing program 2: 14:08:48 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x1000)=nil, 0x1000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffd49, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000180)={0x18, 0x0, &(0x7f00000006c0)=[@increfs, @clear_death], 0x0, 0x0, 0x0}) 14:08:48 executing program 2: [ 148.456999] binder: release 4206:4212 transaction 112 out, still active [ 148.463963] binder: unexpected work type, 4, not freed 14:08:48 executing program 4: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) clone(0x0, 0x0, 0x0, 0x0, 0x0) symlink(&(0x7f0000000100)='./file1\x00', &(0x7f0000000040)='./file1\x00') r1 = creat(&(0x7f0000000200)='\xe9\x1fq\x89Y\x1e\x923aK\x00', 0x109) r2 = dup2(r0, r1) execve(&(0x7f00000002c0)='\xe9\x1fq\x89Y\x1e\x923aK\x00', 0x0, 0x0) open$dir(&(0x7f00000000c0)='./file0\x00', 0x841, 0x0) clone(0x3102001ffd, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) execve(&(0x7f0000000000)='./file1\x00', 0x0, 0x0) sendmmsg(r2, &(0x7f0000005b00), 0x0, 0x0) 14:08:48 executing program 2: [ 148.509901] binder: undelivered TRANSACTION_COMPLETE [ 148.523354] binder: send failed reply for transaction 112, target dead [ 148.545689] binder: 4246:4248 ioctl c0306201 20000440 returned -14 14:08:48 executing program 5: r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000200)='./cgroup\x00\f#\x9f\xd0\x85\xac\xc4\x9b\x81-\xb3\xd7=C\xea', 0x200002, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000180)='./bus\x00', 0x0) r2 = open(0x0, 0x0, 0x0) mmap(&(0x7f0000001000/0x4000)=nil, 0x4000, 0x0, 0x11, r2, 0x0) fcntl$setstatus(r1, 0x4, 0x44040) io_setup(0x2, &(0x7f00000004c0)=0x0) io_submit(r3, 0x1, &(0x7f0000000540)=[&(0x7f00000000c0)={0x0, 0x0, 0x0, 0x1, 0x0, r1, &(0x7f0000000000), 0x10000}]) [ 148.558531] binder: 4246:4248 BC_CLEAR_DEATH_NOTIFICATION death notification not active [ 148.598085] binder: release 4246:4248 transaction 117 out, still active [ 148.608609] binder: unexpected work type, 4, not freed [ 148.633764] binder: undelivered TRANSACTION_COMPLETE [ 148.652517] binder: send failed reply for transaction 117, target dead 14:08:49 executing program 1: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f0000000040)={0xa, 0x4e22}, 0x1c) listen(r0, 0xeb) ioctl$UI_SET_PHYS(0xffffffffffffffff, 0x4008556c, 0x0) setsockopt$inet6_tcp_TLS_TX(0xffffffffffffffff, 0x6, 0x1, 0x0, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) sendto$inet6(r1, 0x0, 0x0, 0x20000004, &(0x7f0000000140)={0xa, 0x4e22}, 0x1c) readv(r1, &(0x7f0000000700)=[{&(0x7f0000000440)=""/132, 0x31}], 0x1) ioctl$RTC_ALM_SET(0xffffffffffffffff, 0x40247007, 0x0) prctl$PR_MCE_KILL_GET(0x22) timerfd_create(0x0, 0x0) r2 = accept4(r0, 0x0, 0x0, 0x0) setsockopt$packet_fanout(0xffffffffffffffff, 0x107, 0x12, 0x0, 0x309) ioctl$FICLONE(0xffffffffffffffff, 0x40049409, 0xffffffffffffffff) ioctl$EXT4_IOC_GROUP_EXTEND(0xffffffffffffffff, 0x40046607, 0x0) ioctl$PPPIOCGFLAGS1(0xffffffffffffffff, 0x8004745a, 0x0) dup(0xffffffffffffffff) shutdown(r1, 0x1) setsockopt(r1, 0x0, 0x1, &(0x7f0000000000)="1d", 0x1) sendto$inet6(r2, &(0x7f0000000300)='A', 0x1, 0x0, 0x0, 0x0) 14:08:49 executing program 2: 14:08:49 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)) r1 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x1000)=nil, 0x1000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffd49, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000180)={0x18, 0x0, &(0x7f00000006c0)=[@increfs, @clear_death], 0x0, 0x0, 0x0}) 14:08:49 executing program 4: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) clone(0x0, 0x0, 0x0, 0x0, 0x0) symlink(&(0x7f0000000100)='./file1\x00', &(0x7f0000000040)='./file1\x00') r1 = creat(&(0x7f0000000200)='\xe9\x1fq\x89Y\x1e\x923aK\x00', 0x109) r2 = dup2(r0, r1) execve(&(0x7f00000002c0)='\xe9\x1fq\x89Y\x1e\x923aK\x00', 0x0, 0x0) open$dir(&(0x7f00000000c0)='./file0\x00', 0x841, 0x0) clone(0x3102001ffd, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) execve(&(0x7f0000000000)='./file1\x00', 0x0, 0x0) sendmmsg(r2, &(0x7f0000005b00), 0x0, 0x0) 14:08:49 executing program 5: r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000200)='./cgroup\x00\f#\x9f\xd0\x85\xac\xc4\x9b\x81-\xb3\xd7=C\xea', 0x200002, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000180)='./bus\x00', 0x0) r2 = open(0x0, 0x0, 0x0) mmap(&(0x7f0000001000/0x4000)=nil, 0x4000, 0x0, 0x11, r2, 0x0) fcntl$setstatus(r1, 0x4, 0x44040) io_setup(0x2, &(0x7f00000004c0)=0x0) io_submit(r3, 0x1, &(0x7f0000000540)=[&(0x7f00000000c0)={0x0, 0x0, 0x0, 0x1, 0x0, r1, &(0x7f0000000000), 0x10000}]) [ 149.161199] binder: 4268:4273 ioctl c0306201 20000440 returned -14 [ 149.169992] binder: 4268:4273 BC_CLEAR_DEATH_NOTIFICATION death notification not active [ 149.184833] binder: release 4268:4273 transaction 122 out, still active [ 149.194552] binder: unexpected work type, 4, not freed [ 149.200583] binder: undelivered TRANSACTION_COMPLETE [ 149.207633] binder: send failed reply for transaction 122, target dead 14:08:51 executing program 0: clone(0x802102001ffe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x0) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$cont(0x18, r0, 0x0, 0x2) ptrace$cont(0x9, r0, 0x0, 0x0) 14:08:51 executing program 2: 14:08:51 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)) r1 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x1000)=nil, 0x1000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffd49, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000180)={0x18, 0x0, &(0x7f00000006c0)=[@increfs, @clear_death], 0x0, 0x0, 0x0}) 14:08:51 executing program 5: r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000200)='./cgroup\x00\f#\x9f\xd0\x85\xac\xc4\x9b\x81-\xb3\xd7=C\xea', 0x200002, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000180)='./bus\x00', 0x0) r2 = open(&(0x7f0000000140)='./bus\x00', 0x0, 0x0) mmap(&(0x7f0000001000/0x4000)=nil, 0x4000, 0x0, 0x10, r2, 0x0) fcntl$setstatus(r1, 0x4, 0x44040) io_setup(0x2, &(0x7f00000004c0)=0x0) io_submit(r3, 0x1, &(0x7f0000000540)=[&(0x7f00000000c0)={0x0, 0x0, 0x0, 0x1, 0x0, r1, &(0x7f0000000000), 0x10000}]) 14:08:51 executing program 4: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) clone(0x0, 0x0, 0x0, 0x0, 0x0) symlink(&(0x7f0000000100)='./file1\x00', &(0x7f0000000040)='./file1\x00') r1 = creat(&(0x7f0000000200)='\xe9\x1fq\x89Y\x1e\x923aK\x00', 0x109) r2 = dup2(r0, r1) execve(&(0x7f00000002c0)='\xe9\x1fq\x89Y\x1e\x923aK\x00', 0x0, 0x0) open$dir(&(0x7f00000000c0)='./file0\x00', 0x841, 0x0) clone(0x3102001ffd, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) execve(&(0x7f0000000000)='./file1\x00', 0x0, 0x0) sendmmsg(r2, &(0x7f0000005b00), 0x0, 0x0) 14:08:51 executing program 1: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f0000000040)={0xa, 0x4e22}, 0x1c) listen(r0, 0xeb) ioctl$UI_SET_PHYS(0xffffffffffffffff, 0x4008556c, 0x0) setsockopt$inet6_tcp_TLS_TX(0xffffffffffffffff, 0x6, 0x1, 0x0, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) sendto$inet6(r1, 0x0, 0x0, 0x20000004, &(0x7f0000000140)={0xa, 0x4e22}, 0x1c) readv(r1, &(0x7f0000000700)=[{&(0x7f0000000440)=""/132, 0x31}], 0x1) ioctl$RTC_ALM_SET(0xffffffffffffffff, 0x40247007, 0x0) prctl$PR_MCE_KILL_GET(0x22) timerfd_create(0x0, 0x0) r2 = accept4(r0, 0x0, 0x0, 0x0) setsockopt$packet_fanout(0xffffffffffffffff, 0x107, 0x12, 0x0, 0x309) ioctl$FICLONE(0xffffffffffffffff, 0x40049409, 0xffffffffffffffff) ioctl$EXT4_IOC_GROUP_EXTEND(0xffffffffffffffff, 0x40046607, 0x0) ioctl$PPPIOCGFLAGS1(0xffffffffffffffff, 0x8004745a, 0x0) dup(0xffffffffffffffff) shutdown(r1, 0x1) setsockopt(r1, 0x0, 0x1, &(0x7f0000000000)="1d", 0x1) sendto$inet6(r2, &(0x7f0000000300)='A', 0x1, 0x0, 0x0, 0x0) 14:08:51 executing program 2: [ 151.449351] binder: 4290:4294 ioctl c0306201 20000440 returned -14 [ 151.482203] binder: 4290:4294 BC_CLEAR_DEATH_NOTIFICATION death notification not active 14:08:51 executing program 0: clone(0x802102001ffe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x0) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$cont(0x18, r0, 0x0, 0x2) ptrace$cont(0x9, r0, 0x0, 0x0) 14:08:51 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)) r1 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x1000)=nil, 0x1000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffd49, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000180)={0x18, 0x0, &(0x7f00000006c0)=[@increfs, @clear_death], 0x0, 0x0, 0x0}) 14:08:51 executing program 2: 14:08:51 executing program 5: r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000200)='./cgroup\x00\f#\x9f\xd0\x85\xac\xc4\x9b\x81-\xb3\xd7=C\xea', 0x200002, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000180)='./bus\x00', 0x0) r2 = open(&(0x7f0000000140)='./bus\x00', 0x0, 0x0) mmap(&(0x7f0000001000/0x4000)=nil, 0x4000, 0x0, 0x10, r2, 0x0) fcntl$setstatus(r1, 0x4, 0x44040) io_setup(0x2, &(0x7f00000004c0)=0x0) io_submit(r3, 0x1, &(0x7f0000000540)=[&(0x7f00000000c0)={0x0, 0x0, 0x0, 0x1, 0x0, r1, &(0x7f0000000000), 0x10000}]) [ 151.503472] binder: release 4290:4294 transaction 127 out, still active [ 151.514168] binder: unexpected work type, 4, not freed [ 151.552096] binder: undelivered TRANSACTION_COMPLETE 14:08:51 executing program 4: 14:08:51 executing program 2: [ 151.587198] binder: send failed reply for transaction 127, target dead [ 151.616551] binder: 4316:4320 ioctl c0306201 20000440 returned -14 14:08:51 executing program 4: 14:08:51 executing program 2: 14:08:51 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c12") r1 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x1000)=nil, 0x1000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffd49, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000180)={0x18, 0x0, &(0x7f00000006c0)=[@increfs, @clear_death], 0x0, 0x0, 0x0}) 14:08:51 executing program 5: r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000200)='./cgroup\x00\f#\x9f\xd0\x85\xac\xc4\x9b\x81-\xb3\xd7=C\xea', 0x200002, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000180)='./bus\x00', 0x0) r2 = open(&(0x7f0000000140)='./bus\x00', 0x0, 0x0) mmap(&(0x7f0000001000/0x4000)=nil, 0x4000, 0x0, 0x10, r2, 0x0) fcntl$setstatus(r1, 0x4, 0x44040) io_setup(0x2, &(0x7f00000004c0)=0x0) io_submit(r3, 0x1, &(0x7f0000000540)=[&(0x7f00000000c0)={0x0, 0x0, 0x0, 0x1, 0x0, r1, &(0x7f0000000000), 0x10000}]) [ 151.641205] binder: 4316:4320 BC_CLEAR_DEATH_NOTIFICATION death notification not active [ 151.659565] binder: release 4316:4320 transaction 132 out, still active [ 151.677619] binder: unexpected work type, 4, not freed [ 151.700033] binder: undelivered TRANSACTION_COMPLETE [ 151.737991] binder: send failed reply for transaction 132, target dead [ 151.756189] binder: 4330:4334 ioctl c0306201 20000440 returned -14 [ 151.768900] binder: 4330:4334 BC_CLEAR_DEATH_NOTIFICATION death notification not active [ 151.777713] binder: release 4330:4334 transaction 137 out, still active [ 151.785394] binder: unexpected work type, 4, not freed [ 151.791909] binder: undelivered TRANSACTION_COMPLETE [ 151.798587] binder: send failed reply for transaction 137, target dead 14:08:52 executing program 1: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f0000000040)={0xa, 0x4e22}, 0x1c) listen(r0, 0xeb) ioctl$UI_SET_PHYS(0xffffffffffffffff, 0x4008556c, 0x0) setsockopt$inet6_tcp_TLS_TX(0xffffffffffffffff, 0x6, 0x1, 0x0, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) sendto$inet6(r1, 0x0, 0x0, 0x20000004, &(0x7f0000000140)={0xa, 0x4e22}, 0x1c) readv(r1, &(0x7f0000000700)=[{&(0x7f0000000440)=""/132, 0x31}], 0x1) ioctl$RTC_ALM_SET(0xffffffffffffffff, 0x40247007, 0x0) prctl$PR_MCE_KILL_GET(0x22) timerfd_create(0x0, 0x0) r2 = accept4(r0, 0x0, 0x0, 0x0) setsockopt$packet_fanout(0xffffffffffffffff, 0x107, 0x12, 0x0, 0x309) ioctl$FICLONE(0xffffffffffffffff, 0x40049409, 0xffffffffffffffff) ioctl$EXT4_IOC_GROUP_EXTEND(0xffffffffffffffff, 0x40046607, 0x0) ioctl$PPPIOCGFLAGS1(0xffffffffffffffff, 0x8004745a, 0x0) dup(0xffffffffffffffff) shutdown(r1, 0x1) setsockopt(r1, 0x0, 0x1, &(0x7f0000000000)="1d", 0x1) sendto$inet6(r2, &(0x7f0000000300)='A', 0x1, 0x0, 0x0, 0x0) 14:08:52 executing program 4: 14:08:54 executing program 0: clone(0x802102001ffe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x38) ptrace$cont(0xffffffffffffffff, r0, 0x0, 0x0) ptrace$cont(0x18, r0, 0x0, 0x2) ptrace$cont(0x9, r0, 0x0, 0x0) 14:08:54 executing program 2: 14:08:54 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c12") r1 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x1000)=nil, 0x1000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffd49, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000180)={0x18, 0x0, &(0x7f00000006c0)=[@increfs, @clear_death], 0x0, 0x0, 0x0}) 14:08:54 executing program 5: r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000200)='./cgroup\x00\f#\x9f\xd0\x85\xac\xc4\x9b\x81-\xb3\xd7=C\xea', 0x200002, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000180)='./bus\x00', 0x0) open(&(0x7f0000000140)='./bus\x00', 0x0, 0x0) mmap(&(0x7f0000001000/0x4000)=nil, 0x4000, 0x0, 0x11, 0xffffffffffffffff, 0x0) fcntl$setstatus(r1, 0x4, 0x44040) io_setup(0x2, &(0x7f00000004c0)=0x0) io_submit(r2, 0x1, &(0x7f0000000540)=[&(0x7f00000000c0)={0x0, 0x0, 0x0, 0x1, 0x0, r1, &(0x7f0000000000), 0x10000}]) 14:08:54 executing program 4: 14:08:54 executing program 1: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f0000000040)={0xa, 0x4e22}, 0x1c) listen(r0, 0xeb) ioctl$UI_SET_PHYS(0xffffffffffffffff, 0x4008556c, 0x0) setsockopt$inet6_tcp_TLS_TX(0xffffffffffffffff, 0x6, 0x1, 0x0, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) sendto$inet6(r1, 0x0, 0x0, 0x20000004, &(0x7f0000000140)={0xa, 0x4e22}, 0x1c) readv(r1, &(0x7f0000000700)=[{&(0x7f0000000440)=""/132, 0x31}], 0x1) ioctl$RTC_ALM_SET(0xffffffffffffffff, 0x40247007, 0x0) prctl$PR_MCE_KILL_GET(0x22) timerfd_create(0x0, 0x0) socket$inet6_udplite(0xa, 0x2, 0x88) setsockopt$packet_fanout(0xffffffffffffffff, 0x107, 0x12, 0x0, 0x309) ioctl$FICLONE(0xffffffffffffffff, 0x40049409, 0xffffffffffffffff) ioctl$EXT4_IOC_GROUP_EXTEND(0xffffffffffffffff, 0x40046607, 0x0) ioctl$PPPIOCGFLAGS1(0xffffffffffffffff, 0x8004745a, 0x0) dup(0xffffffffffffffff) shutdown(r1, 0x1) setsockopt(r1, 0x0, 0x1, &(0x7f0000000000)="1d", 0x1) sendto$inet6(0xffffffffffffffff, &(0x7f0000000300)='A', 0x1, 0x0, 0x0, 0x0) 14:08:54 executing program 2: 14:08:54 executing program 4: 14:08:54 executing program 1: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f0000000040)={0xa, 0x4e22}, 0x1c) listen(r0, 0xeb) ioctl$UI_SET_PHYS(0xffffffffffffffff, 0x4008556c, 0x0) setsockopt$inet6_tcp_TLS_TX(0xffffffffffffffff, 0x6, 0x1, 0x0, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) sendto$inet6(r1, 0x0, 0x0, 0x20000004, &(0x7f0000000140)={0xa, 0x4e22}, 0x1c) readv(r1, &(0x7f0000000700)=[{&(0x7f0000000440)=""/132, 0x31}], 0x1) ioctl$RTC_ALM_SET(0xffffffffffffffff, 0x40247007, 0x0) prctl$PR_MCE_KILL_GET(0x22) timerfd_create(0x0, 0x0) socket$inet6_udplite(0xa, 0x2, 0x88) setsockopt$packet_fanout(0xffffffffffffffff, 0x107, 0x12, 0x0, 0x309) ioctl$FICLONE(0xffffffffffffffff, 0x40049409, 0xffffffffffffffff) ioctl$EXT4_IOC_GROUP_EXTEND(0xffffffffffffffff, 0x40046607, 0x0) ioctl$PPPIOCGFLAGS1(0xffffffffffffffff, 0x8004745a, 0x0) dup(0xffffffffffffffff) shutdown(r1, 0x1) setsockopt(r1, 0x0, 0x1, &(0x7f0000000000)="1d", 0x1) sendto$inet6(0xffffffffffffffff, &(0x7f0000000300)='A', 0x1, 0x0, 0x0, 0x0) 14:08:54 executing program 4: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000100)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_DEV_DESTROY(r0, 0x5502) [ 154.633339] binder: 4347:4353 ioctl c0306201 20000440 returned -14 [ 154.665792] binder: 4347:4353 BC_CLEAR_DEATH_NOTIFICATION death notification not active [ 154.674933] binder: release 4347:4353 transaction 142 out, still active 14:08:54 executing program 5: r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000200)='./cgroup\x00\f#\x9f\xd0\x85\xac\xc4\x9b\x81-\xb3\xd7=C\xea', 0x200002, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000180)='./bus\x00', 0x0) open(&(0x7f0000000140)='./bus\x00', 0x0, 0x0) mmap(&(0x7f0000001000/0x4000)=nil, 0x4000, 0x0, 0x11, 0xffffffffffffffff, 0x0) fcntl$setstatus(r1, 0x4, 0x44040) io_setup(0x2, &(0x7f00000004c0)=0x0) io_submit(r2, 0x1, &(0x7f0000000540)=[&(0x7f00000000c0)={0x0, 0x0, 0x0, 0x1, 0x0, r1, &(0x7f0000000000), 0x10000}]) 14:08:54 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c12") r1 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x1000)=nil, 0x1000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffd49, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000180)={0x18, 0x0, &(0x7f00000006c0)=[@increfs, @clear_death], 0x0, 0x0, 0x0}) [ 154.682984] binder: unexpected work type, 4, not freed [ 154.691974] binder: undelivered TRANSACTION_COMPLETE [ 154.698802] binder: send failed reply for transaction 142, target dead [ 154.768462] binder: 4371:4373 ioctl c0306201 20000440 returned -14 [ 154.788132] binder: 4371:4373 BC_CLEAR_DEATH_NOTIFICATION death notification not active [ 154.801748] binder: release 4371:4373 transaction 147 out, still active [ 154.815885] binder: unexpected work type, 4, not freed [ 154.821264] binder: undelivered TRANSACTION_COMPLETE [ 154.829010] binder: send failed reply for transaction 147, target dead 14:08:57 executing program 0: clone(0x802102001ffe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x38) ptrace$cont(0xffffffffffffffff, r0, 0x0, 0x0) ptrace$cont(0x18, r0, 0x0, 0x2) ptrace$cont(0x9, r0, 0x0, 0x0) 14:08:57 executing program 2: clone(0x3102001ffe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socket$inet6(0xa, 0x0, 0x0) 14:08:57 executing program 1: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f0000000040)={0xa, 0x4e22}, 0x1c) listen(r0, 0xeb) ioctl$UI_SET_PHYS(0xffffffffffffffff, 0x4008556c, 0x0) setsockopt$inet6_tcp_TLS_TX(0xffffffffffffffff, 0x6, 0x1, 0x0, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) sendto$inet6(r1, 0x0, 0x0, 0x20000004, &(0x7f0000000140)={0xa, 0x4e22}, 0x1c) readv(r1, &(0x7f0000000700)=[{&(0x7f0000000440)=""/132, 0x31}], 0x1) ioctl$RTC_ALM_SET(0xffffffffffffffff, 0x40247007, 0x0) prctl$PR_MCE_KILL_GET(0x22) timerfd_create(0x0, 0x0) socket$inet6_udplite(0xa, 0x2, 0x88) setsockopt$packet_fanout(0xffffffffffffffff, 0x107, 0x12, 0x0, 0x309) ioctl$FICLONE(0xffffffffffffffff, 0x40049409, 0xffffffffffffffff) ioctl$EXT4_IOC_GROUP_EXTEND(0xffffffffffffffff, 0x40046607, 0x0) ioctl$PPPIOCGFLAGS1(0xffffffffffffffff, 0x8004745a, 0x0) dup(0xffffffffffffffff) shutdown(r1, 0x1) setsockopt(r1, 0x0, 0x1, &(0x7f0000000000)="1d", 0x1) sendto$inet6(0xffffffffffffffff, &(0x7f0000000300)='A', 0x1, 0x0, 0x0, 0x0) 14:08:57 executing program 4: r0 = eventfd(0x0) write$binfmt_script(r0, &(0x7f0000000000)=ANY=[@ANYBLOB="1202613c376d2fe5"], 0x8) writev(r0, &(0x7f0000000a40)=[{&(0x7f00000004c0)="df015be2a1043cce", 0x8}], 0x1) read(r0, &(0x7f0000000080)=""/250, 0xe4) 14:08:57 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188") r1 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x1000)=nil, 0x1000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffd49, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000180)={0x18, 0x0, &(0x7f00000006c0)=[@increfs, @clear_death], 0x0, 0x0, 0x0}) 14:08:57 executing program 5: r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000200)='./cgroup\x00\f#\x9f\xd0\x85\xac\xc4\x9b\x81-\xb3\xd7=C\xea', 0x200002, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000180)='./bus\x00', 0x0) open(&(0x7f0000000140)='./bus\x00', 0x0, 0x0) mmap(&(0x7f0000001000/0x4000)=nil, 0x4000, 0x0, 0x11, 0xffffffffffffffff, 0x0) fcntl$setstatus(r1, 0x4, 0x44040) io_setup(0x2, &(0x7f00000004c0)=0x0) io_submit(r2, 0x1, &(0x7f0000000540)=[&(0x7f00000000c0)={0x0, 0x0, 0x0, 0x1, 0x0, r1, &(0x7f0000000000), 0x10000}]) 14:08:57 executing program 2: r0 = syz_open_procfs(0x0, &(0x7f00000000c0)='net/stat\x00') getdents(r0, &(0x7f0000000040)=""/36, 0x3ab) 14:08:57 executing program 1: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f0000000040)={0xa, 0x4e22}, 0x1c) listen(r0, 0xeb) ioctl$UI_SET_PHYS(0xffffffffffffffff, 0x4008556c, 0x0) setsockopt$inet6_tcp_TLS_TX(0xffffffffffffffff, 0x6, 0x1, 0x0, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) sendto$inet6(r1, 0x0, 0x0, 0x20000004, &(0x7f0000000140)={0xa, 0x4e22}, 0x1c) readv(r1, &(0x7f0000000700)=[{&(0x7f0000000440)=""/132, 0x31}], 0x1) ioctl$RTC_ALM_SET(0xffffffffffffffff, 0x40247007, 0x0) prctl$PR_MCE_KILL_GET(0x22) r2 = accept4(r0, 0x0, 0x0, 0x0) socket$inet6_udplite(0xa, 0x2, 0x88) setsockopt$packet_fanout(0xffffffffffffffff, 0x107, 0x12, 0x0, 0x309) ioctl$FICLONE(0xffffffffffffffff, 0x40049409, 0xffffffffffffffff) ioctl$EXT4_IOC_GROUP_EXTEND(0xffffffffffffffff, 0x40046607, 0x0) ioctl$PPPIOCGFLAGS1(0xffffffffffffffff, 0x8004745a, 0x0) dup(0xffffffffffffffff) shutdown(r1, 0x1) setsockopt(r1, 0x0, 0x1, &(0x7f0000000000)="1d", 0x1) sendto$inet6(r2, &(0x7f0000000300)='A', 0x1, 0x0, 0x0, 0x0) [ 157.653504] binder: 4381:4387 ioctl c0306201 20000440 returned -14 [ 157.663386] binder: 4381:4387 BC_CLEAR_DEATH_NOTIFICATION death notification not active 14:08:57 executing program 2: mkdir(&(0x7f0000f4eff8)='./file0\x00', 0x0) chroot(&(0x7f00000001c0)='./file0\x00') mount(&(0x7f00000004c0)=@filename='./file0\x00', &(0x7f00000007c0)='./file0\x00', 0x0, 0x149000, 0x0) chdir(&(0x7f0000000980)='./file0\x00') symlink(&(0x7f0000000140)='..', &(0x7f00000000c0)='./file0\x00') open(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) 14:08:57 executing program 5: r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000200)='./cgroup\x00\f#\x9f\xd0\x85\xac\xc4\x9b\x81-\xb3\xd7=C\xea', 0x200002, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000180)='./bus\x00', 0x0) r2 = open(&(0x7f0000000140)='./bus\x00', 0x0, 0x0) mmap(&(0x7f0000001000/0x4000)=nil, 0x4000, 0x0, 0x11, r2, 0x0) fcntl$setstatus(0xffffffffffffffff, 0x4, 0x44040) io_setup(0x2, &(0x7f00000004c0)=0x0) io_submit(r3, 0x1, &(0x7f0000000540)=[&(0x7f00000000c0)={0x0, 0x0, 0x0, 0x1, 0x0, r1, &(0x7f0000000000), 0x10000}]) 14:08:57 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188") r1 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x1000)=nil, 0x1000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffd49, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000180)={0x18, 0x0, &(0x7f00000006c0)=[@increfs, @clear_death], 0x0, 0x0, 0x0}) 14:08:57 executing program 4: mknod(&(0x7f0000000100)='./file0\x00', 0x1040, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) open$dir(&(0x7f0000000200)='./file0\x00', 0x27e, 0x0) [ 157.701356] binder: release 4381:4387 transaction 152 out, still active [ 157.715007] binder: unexpected work type, 4, not freed [ 157.728570] binder: undelivered TRANSACTION_COMPLETE [ 157.779122] binder: send failed reply for transaction 152, target dead [ 157.799874] binder: 4413:4416 ioctl c0306201 20000440 returned -14 [ 157.809706] binder: 4413:4416 BC_CLEAR_DEATH_NOTIFICATION death notification not active [ 157.819613] binder: release 4413:4416 transaction 157 out, still active [ 157.826783] binder: unexpected work type, 4, not freed [ 157.832356] binder: undelivered TRANSACTION_COMPLETE [ 157.837982] binder: send failed reply for transaction 157, target dead 14:09:00 executing program 0: clone(0x802102001ffe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x38) ptrace$cont(0xffffffffffffffff, r0, 0x0, 0x0) ptrace$cont(0x18, r0, 0x0, 0x2) ptrace$cont(0x9, r0, 0x0, 0x0) 14:09:00 executing program 2: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000100)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r1, 0x5423, &(0x7f00000000c0)=0xf) ioctl$KDADDIO(r1, 0x400455c8, 0x4) 14:09:00 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188") r1 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x1000)=nil, 0x1000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffd49, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000180)={0x18, 0x0, &(0x7f00000006c0)=[@increfs, @clear_death], 0x0, 0x0, 0x0}) 14:09:00 executing program 5: r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000200)='./cgroup\x00\f#\x9f\xd0\x85\xac\xc4\x9b\x81-\xb3\xd7=C\xea', 0x200002, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000180)='./bus\x00', 0x0) r2 = open(&(0x7f0000000140)='./bus\x00', 0x0, 0x0) mmap(&(0x7f0000001000/0x4000)=nil, 0x4000, 0x0, 0x11, r2, 0x0) fcntl$setstatus(0xffffffffffffffff, 0x4, 0x44040) io_setup(0x2, &(0x7f00000004c0)=0x0) io_submit(r3, 0x1, &(0x7f0000000540)=[&(0x7f00000000c0)={0x0, 0x0, 0x0, 0x1, 0x0, r1, &(0x7f0000000000), 0x10000}]) 14:09:00 executing program 4: r0 = syz_open_dev$loop(&(0x7f00000000c0)='/dev/loop#\x00', 0x0, 0x182) r1 = memfd_create(&(0x7f0000000100)='t\bnu\x00\x00\x00\x00\x00\x00\x00\x00\x00\x8c\x00', 0x0) ioctl$LOOP_CHANGE_FD(r0, 0x4c00, r1) sendfile(0xffffffffffffffff, r0, 0x0, 0x0) ioctl$LOOP_CLR_FD(r0, 0x4c01) 14:09:00 executing program 1: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f0000000040)={0xa, 0x4e22}, 0x1c) listen(r0, 0xeb) ioctl$UI_SET_PHYS(0xffffffffffffffff, 0x4008556c, 0x0) setsockopt$inet6_tcp_TLS_TX(0xffffffffffffffff, 0x6, 0x1, 0x0, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) sendto$inet6(r1, 0x0, 0x0, 0x20000004, &(0x7f0000000140)={0xa, 0x4e22}, 0x1c) readv(r1, &(0x7f0000000700)=[{&(0x7f0000000440)=""/132, 0x31}], 0x1) ioctl$RTC_ALM_SET(0xffffffffffffffff, 0x40247007, 0x0) prctl$PR_MCE_KILL_GET(0x22) r2 = accept4(r0, 0x0, 0x0, 0x0) socket$inet6_udplite(0xa, 0x2, 0x88) setsockopt$packet_fanout(0xffffffffffffffff, 0x107, 0x12, 0x0, 0x309) ioctl$FICLONE(0xffffffffffffffff, 0x40049409, 0xffffffffffffffff) ioctl$EXT4_IOC_GROUP_EXTEND(0xffffffffffffffff, 0x40046607, 0x0) ioctl$PPPIOCGFLAGS1(0xffffffffffffffff, 0x8004745a, 0x0) dup(0xffffffffffffffff) shutdown(r1, 0x1) setsockopt(r1, 0x0, 0x1, &(0x7f0000000000)="1d", 0x1) sendto$inet6(r2, &(0x7f0000000300)='A', 0x1, 0x0, 0x0, 0x0) 14:09:00 executing program 2: mkdir(&(0x7f0000000140)='./file0\x00', 0x0) mount(&(0x7f0000000040)=@loop={'/dev/loop'}, 0x0, &(0x7f0000000180)='ceph\x00', 0x0, 0x0) [ 160.691468] binder: 4424:4428 ioctl c0306201 20000440 returned -14 [ 160.702183] binder: 4424:4428 BC_CLEAR_DEATH_NOTIFICATION death notification not active [ 160.721254] binder: release 4424:4428 transaction 162 out, still active [ 160.732169] binder: unexpected work type, 4, not freed 14:09:00 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b0") r1 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x1000)=nil, 0x1000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffd49, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000180)={0x18, 0x0, &(0x7f00000006c0)=[@increfs, @clear_death], 0x0, 0x0, 0x0}) 14:09:00 executing program 5: r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000200)='./cgroup\x00\f#\x9f\xd0\x85\xac\xc4\x9b\x81-\xb3\xd7=C\xea', 0x200002, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000180)='./bus\x00', 0x0) r2 = open(&(0x7f0000000140)='./bus\x00', 0x0, 0x0) mmap(&(0x7f0000001000/0x4000)=nil, 0x4000, 0x0, 0x11, r2, 0x0) fcntl$setstatus(0xffffffffffffffff, 0x4, 0x44040) io_setup(0x2, &(0x7f00000004c0)=0x0) io_submit(r3, 0x1, &(0x7f0000000540)=[&(0x7f00000000c0)={0x0, 0x0, 0x0, 0x1, 0x0, r1, &(0x7f0000000000), 0x10000}]) 14:09:00 executing program 4: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f000051cff6)='/dev/ptmx\x00', 0x0, 0x0) r1 = dup(r0) ioctl$sock_inet_udp_SIOCOUTQ(r1, 0x5411, &(0x7f0000000040)) [ 160.741202] binder: undelivered TRANSACTION_COMPLETE [ 160.747822] binder: send failed reply for transaction 162, target dead [ 160.778528] binder: 4444:4447 ioctl c0306201 20000440 returned -14 14:09:00 executing program 2: clone(0x1ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socket$inet(0x2, 0x0, 0x0) 14:09:00 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b0") r1 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x1000)=nil, 0x1000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffd49, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000180)={0x18, 0x0, &(0x7f00000006c0)=[@increfs, @clear_death], 0x0, 0x0, 0x0}) [ 160.827297] binder: 4444:4455 BC_CLEAR_DEATH_NOTIFICATION death notification not active [ 160.850250] binder: release 4444:4447 transaction 167 out, still active [ 160.859686] binder: unexpected work type, 4, not freed [ 160.894432] binder: undelivered TRANSACTION_COMPLETE [ 160.926679] binder: send failed reply for transaction 167, target dead [ 160.938913] binder: 4464:4466 ioctl c0306201 20000440 returned -14 [ 160.958845] binder: 4464:4466 BC_CLEAR_DEATH_NOTIFICATION death notification not active [ 160.990234] binder: release 4464:4466 transaction 172 out, still active [ 160.998365] binder: unexpected work type, 4, not freed [ 161.010596] binder: undelivered TRANSACTION_COMPLETE [ 161.017653] binder: send failed reply for transaction 172, target dead 14:09:03 executing program 0: clone(0x802102001ffe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x38) ptrace$cont(0x18, 0x0, 0x0, 0x0) ptrace$cont(0x18, r0, 0x0, 0x2) ptrace$cont(0x9, r0, 0x0, 0x0) 14:09:03 executing program 4: r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/protocols\x00') sendmsg(0xffffffffffffffff, &(0x7f0000002fc8)={0x0, 0x0, &(0x7f0000000540)}, 0x0) ioctl$UI_SET_KEYBIT(0xffffffffffffffff, 0x40045565, 0x0) preadv(r0, &(0x7f00000017c0), 0x1fe, 0x400000000000) 14:09:03 executing program 5: r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000200)='./cgroup\x00\f#\x9f\xd0\x85\xac\xc4\x9b\x81-\xb3\xd7=C\xea', 0x200002, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000180)='./bus\x00', 0x0) r2 = open(&(0x7f0000000140)='./bus\x00', 0x0, 0x0) mmap(&(0x7f0000001000/0x4000)=nil, 0x4000, 0x0, 0x11, r2, 0x0) fcntl$setstatus(r1, 0x4, 0x0) io_setup(0x2, &(0x7f00000004c0)=0x0) io_submit(r3, 0x1, &(0x7f0000000540)=[&(0x7f00000000c0)={0x0, 0x0, 0x0, 0x1, 0x0, r1, &(0x7f0000000000), 0x10000}]) 14:09:03 executing program 2: r0 = socket$inet(0x2, 0x2, 0x2000000088) setsockopt$inet_int(r0, 0x0, 0x17, &(0x7f0000000180)=0x7, 0x4) bind(r0, &(0x7f0000000080)=@in={0x2, 0x4e20}, 0x80) sendto$inet(r0, 0x0, 0x0, 0x0, &(0x7f0000000140)={0x2, 0x18004e20}, 0x10) recvmmsg(r0, &(0x7f00000078c0)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0) 14:09:03 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b0") r1 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x1000)=nil, 0x1000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffd49, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000180)={0x18, 0x0, &(0x7f00000006c0)=[@increfs, @clear_death], 0x0, 0x0, 0x0}) 14:09:03 executing program 1: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f0000000040)={0xa, 0x4e22}, 0x1c) listen(r0, 0xeb) ioctl$UI_SET_PHYS(0xffffffffffffffff, 0x4008556c, 0x0) setsockopt$inet6_tcp_TLS_TX(0xffffffffffffffff, 0x6, 0x1, 0x0, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) sendto$inet6(r1, 0x0, 0x0, 0x20000004, &(0x7f0000000140)={0xa, 0x4e22}, 0x1c) readv(r1, &(0x7f0000000700)=[{&(0x7f0000000440)=""/132, 0x31}], 0x1) ioctl$RTC_ALM_SET(0xffffffffffffffff, 0x40247007, 0x0) prctl$PR_MCE_KILL_GET(0x22) r2 = accept4(r0, 0x0, 0x0, 0x0) socket$inet6_udplite(0xa, 0x2, 0x88) setsockopt$packet_fanout(0xffffffffffffffff, 0x107, 0x12, 0x0, 0x309) ioctl$FICLONE(0xffffffffffffffff, 0x40049409, 0xffffffffffffffff) ioctl$EXT4_IOC_GROUP_EXTEND(0xffffffffffffffff, 0x40046607, 0x0) ioctl$PPPIOCGFLAGS1(0xffffffffffffffff, 0x8004745a, 0x0) dup(0xffffffffffffffff) shutdown(r1, 0x1) setsockopt(r1, 0x0, 0x1, &(0x7f0000000000)="1d", 0x1) sendto$inet6(r2, &(0x7f0000000300)='A', 0x1, 0x0, 0x0, 0x0) 14:09:03 executing program 4: r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/protocols\x00') sendmsg(0xffffffffffffffff, &(0x7f0000002fc8)={0x0, 0x0, &(0x7f0000000540)}, 0x0) ioctl$UI_SET_KEYBIT(0xffffffffffffffff, 0x40045565, 0x0) preadv(r0, &(0x7f00000017c0), 0x1fe, 0x400000000000) [ 163.718466] binder: 4480:4484 ioctl c0306201 20000440 returned -14 [ 163.733564] binder: 4480:4484 BC_CLEAR_DEATH_NOTIFICATION death notification not active [ 163.750304] binder: release 4480:4484 transaction 177 out, still active [ 163.759600] binder: unexpected work type, 4, not freed 14:09:03 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x1000)=nil, 0x1000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffd49, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000180)={0x18, 0x0, &(0x7f00000006c0)=[@increfs, @clear_death], 0x0, 0x0, 0x0}) 14:09:03 executing program 2: perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) socketpair(0x11, 0x2, 0x0, 0x0) 14:09:03 executing program 5: r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000200)='./cgroup\x00\f#\x9f\xd0\x85\xac\xc4\x9b\x81-\xb3\xd7=C\xea', 0x200002, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000180)='./bus\x00', 0x0) r2 = open(&(0x7f0000000140)='./bus\x00', 0x0, 0x0) mmap(&(0x7f0000001000/0x4000)=nil, 0x4000, 0x0, 0x11, r2, 0x0) fcntl$setstatus(r1, 0x4, 0x0) io_setup(0x2, &(0x7f00000004c0)=0x0) io_submit(r3, 0x1, &(0x7f0000000540)=[&(0x7f00000000c0)={0x0, 0x0, 0x0, 0x1, 0x0, r1, &(0x7f0000000000), 0x10000}]) [ 163.765983] binder: undelivered TRANSACTION_COMPLETE [ 163.779705] binder: send failed reply for transaction 177, target dead 14:09:03 executing program 4: r0 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x80000000000002, &(0x7f00000000c0)=0x2000000000000074, 0x25d) bind$inet(r0, &(0x7f0000000180)={0x2, 0x4e23, @multicast1}, 0x10) setsockopt$SO_ATTACH_FILTER(r0, 0x1, 0x1a, &(0x7f0000b86000)={0x1, &(0x7f0000f40ff8)=[{0x6, 0x0, 0x0, 0xe8}]}, 0x10) sendto$inet(r0, 0x0, 0x0, 0x200007fd, &(0x7f0000e68000)={0x2, 0x4e23, @local}, 0x10) recvmsg(r0, &(0x7f0000000900)={0x0, 0x0, &(0x7f0000000840)=[{&(0x7f0000002200)=""/4096, 0x1000}], 0x1}, 0x0) write$binfmt_elf64(r0, &(0x7f0000000100)=ANY=[@ANYRESOCT], 0x321) sendto$inet(r0, &(0x7f00000002c0)="03f4a2c970de1d9c3776a9481255ced5dbc57fe63cd931916a02bae17f7850aea473b1c2395dcc0f572febcadeb7fa0f2ee9dc78ccc69169ccfc0bf46dbaba25f3f5a75b77654c0cb9989ea026da080991348232bc2541328a29ec7e06942980144d2ae1b8811ef7af232c4bcb7d89d1aafda6e27d68ed8047debe4f6acdb39851142538045af7a37276d45101a908acd7e6586aaa477a1ed765207d078f68d3f09646ebb175b64f48673bab39a740b280f8876953befe1c", 0xb8, 0x0, 0x0, 0x0) 14:09:03 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x1000)=nil, 0x1000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffd49, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000180)={0x18, 0x0, &(0x7f00000006c0)=[@increfs, @clear_death], 0x0, 0x0, 0x0}) 14:09:06 executing program 0: clone(0x802102001ffe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x38) ptrace$cont(0x18, 0x0, 0x0, 0x0) ptrace$cont(0x18, r0, 0x0, 0x2) ptrace$cont(0x9, r0, 0x0, 0x0) 14:09:06 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x1000)=nil, 0x1000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffd49, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000180)={0x18, 0x0, &(0x7f00000006c0)=[@increfs, @clear_death], 0x0, 0x0, 0x0}) 14:09:06 executing program 2: r0 = syz_open_procfs(0x0, &(0x7f0000000180)='net/ip6_tables_matches\x00') readv(r0, &(0x7f0000002340)=[{&(0x7f00000001c0)=""/4096, 0x141b}], 0x1) 14:09:06 executing program 5: r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000200)='./cgroup\x00\f#\x9f\xd0\x85\xac\xc4\x9b\x81-\xb3\xd7=C\xea', 0x200002, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000180)='./bus\x00', 0x0) r2 = open(&(0x7f0000000140)='./bus\x00', 0x0, 0x0) mmap(&(0x7f0000001000/0x4000)=nil, 0x4000, 0x0, 0x11, r2, 0x0) fcntl$setstatus(r1, 0x4, 0x0) io_setup(0x2, &(0x7f00000004c0)=0x0) io_submit(r3, 0x1, &(0x7f0000000540)=[&(0x7f00000000c0)={0x0, 0x0, 0x0, 0x1, 0x0, r1, &(0x7f0000000000), 0x10000}]) 14:09:06 executing program 4: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) unshare(0x200) 14:09:06 executing program 1: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f0000000040)={0xa, 0x4e22}, 0x1c) listen(r0, 0xeb) ioctl$UI_SET_PHYS(0xffffffffffffffff, 0x4008556c, 0x0) setsockopt$inet6_tcp_TLS_TX(0xffffffffffffffff, 0x6, 0x1, 0x0, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) sendto$inet6(r1, 0x0, 0x0, 0x20000004, &(0x7f0000000140)={0xa, 0x4e22}, 0x1c) readv(r1, &(0x7f0000000700)=[{&(0x7f0000000440)=""/132, 0x31}], 0x1) ioctl$RTC_ALM_SET(0xffffffffffffffff, 0x40247007, 0x0) timerfd_create(0x0, 0x0) r2 = accept4(r0, 0x0, 0x0, 0x0) socket$inet6_udplite(0xa, 0x2, 0x88) setsockopt$packet_fanout(0xffffffffffffffff, 0x107, 0x12, 0x0, 0x309) ioctl$FICLONE(0xffffffffffffffff, 0x40049409, 0xffffffffffffffff) ioctl$EXT4_IOC_GROUP_EXTEND(0xffffffffffffffff, 0x40046607, 0x0) ioctl$PPPIOCGFLAGS1(0xffffffffffffffff, 0x8004745a, 0x0) dup(0xffffffffffffffff) shutdown(r1, 0x1) setsockopt(r1, 0x0, 0x1, &(0x7f0000000000)="1d", 0x1) sendto$inet6(r2, &(0x7f0000000300)='A', 0x1, 0x0, 0x0, 0x0) 14:09:06 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") r1 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x1000)=nil, 0x1000, 0x0, 0x10, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffd49, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000180)={0x18, 0x0, &(0x7f00000006c0)=[@increfs, @clear_death], 0x0, 0x0, 0x0}) 14:09:06 executing program 2: r0 = syz_open_procfs(0x0, &(0x7f0000000180)='net/ip6_tables_matches\x00') readv(r0, &(0x7f0000002340)=[{&(0x7f00000001c0)=""/4096, 0x141b}], 0x1) 14:09:06 executing program 4: r0 = socket$netlink(0x10, 0x3, 0x4000000000000004) r1 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000000)='dctcp\x00', 0x6) sendto$inet(r1, 0x0, 0x0, 0x20000000, &(0x7f0000000080), 0x4f) writev(r0, &(0x7f0000000040)=[{&(0x7f0000000280)="580000001400192340834b80040d8c5602067fffffff81000000000000dca87086a5c000004f6400940005891550f4a8000000006700008000f0fffeffff09000080fff5dd00000010000100000c0900fcff0000040e05a5", 0x58}], 0x1) 14:09:06 executing program 2: creat(&(0x7f0000000000)='./file0\x00', 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) fchownat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x0, 0x0, 0x1000) 14:09:06 executing program 5: r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000200)='./cgroup\x00\f#\x9f\xd0\x85\xac\xc4\x9b\x81-\xb3\xd7=C\xea', 0x200002, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000180)='./bus\x00', 0x0) r2 = open(&(0x7f0000000140)='./bus\x00', 0x0, 0x0) mmap(&(0x7f0000001000/0x4000)=nil, 0x4000, 0x0, 0x11, r2, 0x0) fcntl$setstatus(r1, 0x4, 0x44040) io_setup(0x0, &(0x7f00000004c0)=0x0) io_submit(r3, 0x1, &(0x7f0000000540)=[&(0x7f00000000c0)={0x0, 0x0, 0x0, 0x1, 0x0, r1, &(0x7f0000000000), 0x10000}]) [ 166.820224] binder_alloc: 4537: binder_alloc_buf, no vma [ 166.832844] binder: 4537:4539 transaction failed 29189/-3, size 24-8 line 3137 14:09:06 executing program 2: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'vlan0\x00', 0xd803}) ioctl$TUNGETSNDBUF(r0, 0x800454d3, &(0x7f0000000040)) [ 166.863938] binder: 4537:4539 ioctl c0306201 20000440 returned -14 [ 166.897599] binder: 4537:4551 BC_CLEAR_DEATH_NOTIFICATION death notification not active [ 166.914886] binder: undelivered TRANSACTION_ERROR: 29189 14:09:09 executing program 0: clone(0x802102001ffe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x38) ptrace$cont(0x18, 0x0, 0x0, 0x0) ptrace$cont(0x18, r0, 0x0, 0x2) ptrace$cont(0x9, r0, 0x0, 0x0) 14:09:09 executing program 4: r0 = syz_open_dev$evdev(&(0x7f0000000000)='/dev/input/event#\x00', 0x0, 0x0) ioctl$EVIOCGMASK(r0, 0x80104592, &(0x7f00000001c0)={0x0, 0x1, &(0x7f0000000180)="b7"}) 14:09:09 executing program 5: r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000200)='./cgroup\x00\f#\x9f\xd0\x85\xac\xc4\x9b\x81-\xb3\xd7=C\xea', 0x200002, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000180)='./bus\x00', 0x0) r2 = open(&(0x7f0000000140)='./bus\x00', 0x0, 0x0) mmap(&(0x7f0000001000/0x4000)=nil, 0x4000, 0x0, 0x11, r2, 0x0) fcntl$setstatus(r1, 0x4, 0x44040) io_setup(0x0, &(0x7f00000004c0)=0x0) io_submit(r3, 0x1, &(0x7f0000000540)=[&(0x7f00000000c0)={0x0, 0x0, 0x0, 0x1, 0x0, r1, &(0x7f0000000000), 0x10000}]) 14:09:09 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") r1 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x1000)=nil, 0x1000, 0x0, 0x10, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffd49, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000180)={0x18, 0x0, &(0x7f00000006c0)=[@increfs, @clear_death], 0x0, 0x0, 0x0}) 14:09:09 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x802, 0x0) connect$inet6(r0, &(0x7f0000002740)={0xa, 0x0, 0x0, @dev, 0x4}, 0x79) accept4$inet(0xffffffffffffff9c, &(0x7f0000000000)={0x2, 0x0, @dev}, &(0x7f0000000040)=0x10, 0x0) sendmmsg(r0, &(0x7f0000007e00), 0x4d2, 0x4008000) 14:09:09 executing program 1: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f0000000040)={0xa, 0x4e22}, 0x1c) listen(r0, 0xeb) ioctl$UI_SET_PHYS(0xffffffffffffffff, 0x4008556c, 0x0) setsockopt$inet6_tcp_TLS_TX(0xffffffffffffffff, 0x6, 0x1, 0x0, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) sendto$inet6(r1, 0x0, 0x0, 0x20000004, &(0x7f0000000140)={0xa, 0x4e22}, 0x1c) readv(r1, &(0x7f0000000700)=[{&(0x7f0000000440)=""/132, 0x31}], 0x1) ioctl$RTC_ALM_SET(0xffffffffffffffff, 0x40247007, 0x0) timerfd_create(0x0, 0x0) r2 = accept4(r0, 0x0, 0x0, 0x0) socket$inet6_udplite(0xa, 0x2, 0x88) setsockopt$packet_fanout(0xffffffffffffffff, 0x107, 0x12, 0x0, 0x309) ioctl$FICLONE(0xffffffffffffffff, 0x40049409, 0xffffffffffffffff) ioctl$EXT4_IOC_GROUP_EXTEND(0xffffffffffffffff, 0x40046607, 0x0) ioctl$PPPIOCGFLAGS1(0xffffffffffffffff, 0x8004745a, 0x0) dup(0xffffffffffffffff) shutdown(r1, 0x1) setsockopt(r1, 0x0, 0x1, &(0x7f0000000000)="1d", 0x1) sendto$inet6(r2, &(0x7f0000000300)='A', 0x1, 0x0, 0x0, 0x0) 14:09:09 executing program 5: r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000200)='./cgroup\x00\f#\x9f\xd0\x85\xac\xc4\x9b\x81-\xb3\xd7=C\xea', 0x200002, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000180)='./bus\x00', 0x0) r2 = open(&(0x7f0000000140)='./bus\x00', 0x0, 0x0) mmap(&(0x7f0000001000/0x4000)=nil, 0x4000, 0x0, 0x11, r2, 0x0) fcntl$setstatus(r1, 0x4, 0x44040) io_setup(0x0, &(0x7f00000004c0)=0x0) io_submit(r3, 0x1, &(0x7f0000000540)=[&(0x7f00000000c0)={0x0, 0x0, 0x0, 0x1, 0x0, r1, &(0x7f0000000000), 0x10000}]) [ 169.755573] binder_alloc: 4562: binder_alloc_buf, no vma [ 169.785166] binder: 4562:4566 transaction failed 29189/-3, size 24-8 line 3137 14:09:09 executing program 5: r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000200)='./cgroup\x00\f#\x9f\xd0\x85\xac\xc4\x9b\x81-\xb3\xd7=C\xea', 0x200002, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000180)='./bus\x00', 0x0) r2 = open(&(0x7f0000000140)='./bus\x00', 0x0, 0x0) mmap(&(0x7f0000001000/0x4000)=nil, 0x4000, 0x0, 0x11, r2, 0x0) fcntl$setstatus(r1, 0x4, 0x44040) io_setup(0x2, 0x0) io_submit(0x0, 0x1, &(0x7f0000000540)=[&(0x7f00000000c0)={0x0, 0x0, 0x0, 0x1, 0x0, r1, &(0x7f0000000000), 0x10000}]) 14:09:09 executing program 2: r0 = syz_open_procfs(0x0, &(0x7f0000000200)='pagemap\x00') read$FUSE(r0, 0x0, 0xfffffd6c) 14:09:09 executing program 2: r0 = creat(&(0x7f0000000180)='./bus\x00', 0x0) r1 = open(&(0x7f0000000140)='./bus\x00', 0x0, 0x0) mmap(&(0x7f0000001000/0x4000)=nil, 0x4000, 0x0, 0x11, r1, 0x0) fcntl$setstatus(r0, 0x4, 0x44040) io_setup(0x2, &(0x7f00000004c0)=0x0) io_submit(r2, 0x1, &(0x7f0000000540)=[&(0x7f00000000c0)={0x0, 0x0, 0x0, 0x1, 0x0, r0, &(0x7f0000000000), 0x10000}]) 14:09:09 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") r1 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x1000)=nil, 0x1000, 0x0, 0x10, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffd49, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000180)={0x18, 0x0, &(0x7f00000006c0)=[@increfs, @clear_death], 0x0, 0x0, 0x0}) [ 169.803360] binder: 4562:4579 BC_CLEAR_DEATH_NOTIFICATION death notification not active [ 169.810010] binder: 4562:4566 ioctl c0306201 20000440 returned -14 [ 169.830633] binder: undelivered TRANSACTION_ERROR: 29189 14:09:09 executing program 5: r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000200)='./cgroup\x00\f#\x9f\xd0\x85\xac\xc4\x9b\x81-\xb3\xd7=C\xea', 0x200002, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000180)='./bus\x00', 0x0) r2 = open(&(0x7f0000000140)='./bus\x00', 0x0, 0x0) mmap(&(0x7f0000001000/0x4000)=nil, 0x4000, 0x0, 0x11, r2, 0x0) fcntl$setstatus(r1, 0x4, 0x44040) io_setup(0x2, 0x0) io_submit(0x0, 0x1, &(0x7f0000000540)=[&(0x7f00000000c0)={0x0, 0x0, 0x0, 0x1, 0x0, r1, &(0x7f0000000000), 0x10000}]) [ 169.907493] binder_alloc: 4589: binder_alloc_buf, no vma [ 169.919893] binder: 4589:4591 transaction failed 29189/-3, size 24-8 line 3137 [ 169.932273] binder: 4589:4591 ioctl c0306201 20000440 returned -14 [ 169.943671] binder: 4589:4591 BC_CLEAR_DEATH_NOTIFICATION death notification not active [ 169.957922] binder: undelivered TRANSACTION_ERROR: 29189 14:09:12 executing program 0: clone(0x802102001ffe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x38) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$cont(0xffffffffffffffff, r0, 0x0, 0x2) ptrace$cont(0x9, r0, 0x0, 0x0) 14:09:12 executing program 4: r0 = syz_open_procfs(0x0, &(0x7f0000000200)='gid_map\x00') r1 = syz_open_procfs(0x0, &(0x7f0000000100)='projid_map\x00') sendfile(r0, r1, 0x0, 0x10001) 14:09:12 executing program 5: r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000200)='./cgroup\x00\f#\x9f\xd0\x85\xac\xc4\x9b\x81-\xb3\xd7=C\xea', 0x200002, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000180)='./bus\x00', 0x0) r2 = open(&(0x7f0000000140)='./bus\x00', 0x0, 0x0) mmap(&(0x7f0000001000/0x4000)=nil, 0x4000, 0x0, 0x11, r2, 0x0) fcntl$setstatus(r1, 0x4, 0x44040) io_setup(0x2, 0x0) io_submit(0x0, 0x1, &(0x7f0000000540)=[&(0x7f00000000c0)={0x0, 0x0, 0x0, 0x1, 0x0, r1, &(0x7f0000000000), 0x10000}]) 14:09:12 executing program 2: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) clone(0x0, 0x0, 0x0, 0x0, 0x0) r1 = creat(&(0x7f0000000200)='\xe9\x1fq\x89Y\x1e\x923aK\x00', 0x109) dup2(r0, r1) execve(&(0x7f00000002c0)='\xe9\x1fq\x89Y\x1e\x923aK\x00', 0x0, 0x0) execve(&(0x7f0000000000)='./file1\x00', 0x0, 0x0) 14:09:12 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") r1 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x1000)=nil, 0x1000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffd49, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000180)={0x18, 0x0, &(0x7f00000006c0)=[@increfs, @clear_death], 0x0, 0x0, 0x0}) 14:09:12 executing program 1: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f0000000040)={0xa, 0x4e22}, 0x1c) listen(r0, 0xeb) ioctl$UI_SET_PHYS(0xffffffffffffffff, 0x4008556c, 0x0) setsockopt$inet6_tcp_TLS_TX(0xffffffffffffffff, 0x6, 0x1, 0x0, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) sendto$inet6(r1, 0x0, 0x0, 0x20000004, &(0x7f0000000140)={0xa, 0x4e22}, 0x1c) readv(r1, &(0x7f0000000700)=[{&(0x7f0000000440)=""/132, 0x31}], 0x1) ioctl$RTC_ALM_SET(0xffffffffffffffff, 0x40247007, 0x0) timerfd_create(0x0, 0x0) r2 = accept4(r0, 0x0, 0x0, 0x0) socket$inet6_udplite(0xa, 0x2, 0x88) setsockopt$packet_fanout(0xffffffffffffffff, 0x107, 0x12, 0x0, 0x309) ioctl$FICLONE(0xffffffffffffffff, 0x40049409, 0xffffffffffffffff) ioctl$EXT4_IOC_GROUP_EXTEND(0xffffffffffffffff, 0x40046607, 0x0) ioctl$PPPIOCGFLAGS1(0xffffffffffffffff, 0x8004745a, 0x0) dup(0xffffffffffffffff) shutdown(r1, 0x1) setsockopt(r1, 0x0, 0x1, &(0x7f0000000000)="1d", 0x1) sendto$inet6(r2, &(0x7f0000000300)='A', 0x1, 0x0, 0x0, 0x0) 14:09:12 executing program 4: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x802, 0x0) connect$inet6(r0, &(0x7f0000002740)={0xa, 0x0, 0x0, @dev, 0x4}, 0x79) accept4$inet(0xffffffffffffff9c, &(0x7f0000000000)={0x2, 0x0, @dev}, 0x0, 0x80000) sendmmsg(r0, &(0x7f0000007e00), 0x4d2, 0x4008000) 14:09:12 executing program 5: r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000200)='./cgroup\x00\f#\x9f\xd0\x85\xac\xc4\x9b\x81-\xb3\xd7=C\xea', 0x200002, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000180)='./bus\x00', 0x0) r2 = open(&(0x7f0000000140)='./bus\x00', 0x0, 0x0) mmap(&(0x7f0000001000/0x4000)=nil, 0x4000, 0x0, 0x11, r2, 0x0) fcntl$setstatus(r1, 0x4, 0x44040) io_setup(0x2, &(0x7f00000004c0)) io_submit(0x0, 0x1, &(0x7f0000000540)=[&(0x7f00000000c0)={0x0, 0x0, 0x0, 0x1, 0x0, r1, &(0x7f0000000000), 0x10000}]) [ 172.813111] binder_alloc: 4606: binder_alloc_buf, no vma [ 172.837243] binder: 4606:4610 transaction failed 29189/-3, size 24-8 line 3137 [ 172.852526] binder: 4606:4610 ioctl c0306201 20000440 returned -14 14:09:12 executing program 2: r0 = add_key$user(&(0x7f0000000940)='user\x00', &(0x7f0000000980)={'syz'}, 0x0, 0x0, 0xfffffffffffffffc) keyctl$unlink(0x9, r0, r0) 14:09:12 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") r1 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x1000)=nil, 0x1000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffd49, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000180)={0x18, 0x0, &(0x7f00000006c0)=[@increfs, @clear_death], 0x0, 0x0, 0x0}) 14:09:12 executing program 4: pipe(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) write$cgroup_int(0xffffffffffffffff, 0x0, 0x0) syz_open_procfs(0xffffffffffffffff, &(0x7f0000000040)='oom_score_adj\x00') write$binfmt_misc(r1, &(0x7f00000002c0)=ANY=[@ANYRESOCT], 0x2da4df39) splice(r0, 0x0, r2, 0x0, 0x8100000, 0x0) 14:09:12 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f0000000180)=""/148, 0x94}], 0x1, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000100)='net/snmp\x00') preadv(r0, &(0x7f0000000480), 0x1000000000000237, 0x0) accept4$unix(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$TIOCPKT(0xffffffffffffffff, 0x5420, 0x0) [ 172.865852] binder: 4606:4625 BC_CLEAR_DEATH_NOTIFICATION death notification not active [ 172.896659] binder: undelivered TRANSACTION_ERROR: 29189 [ 172.993615] binder_alloc: 4634: binder_alloc_buf, no vma [ 173.009339] binder: 4634:4638 transaction failed 29189/-3, size 24-8 line 3137 [ 173.021105] binder: 4634:4638 ioctl c0306201 20000440 returned -14 [ 173.030126] binder: 4634:4638 BC_CLEAR_DEATH_NOTIFICATION death notification not active [ 173.039274] binder: undelivered TRANSACTION_ERROR: 29189 14:09:15 executing program 0: clone(0x802102001ffe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x38) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$cont(0xffffffffffffffff, r0, 0x0, 0x2) ptrace$cont(0x9, r0, 0x0, 0x0) 14:09:15 executing program 5: r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000200)='./cgroup\x00\f#\x9f\xd0\x85\xac\xc4\x9b\x81-\xb3\xd7=C\xea', 0x200002, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000180)='./bus\x00', 0x0) r2 = open(&(0x7f0000000140)='./bus\x00', 0x0, 0x0) mmap(&(0x7f0000001000/0x4000)=nil, 0x4000, 0x0, 0x11, r2, 0x0) fcntl$setstatus(r1, 0x4, 0x44040) io_setup(0x2, &(0x7f00000004c0)) io_submit(0x0, 0x1, &(0x7f0000000540)=[&(0x7f00000000c0)={0x0, 0x0, 0x0, 0x1, 0x0, r1, &(0x7f0000000000), 0x10000}]) 14:09:15 executing program 2: 14:09:15 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") r1 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x1000)=nil, 0x1000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffd49, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000180)={0x18, 0x0, &(0x7f00000006c0)=[@increfs, @clear_death], 0x0, 0x0, 0x0}) 14:09:15 executing program 1: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f0000000040)={0xa, 0x4e22}, 0x1c) listen(r0, 0xeb) ioctl$UI_SET_PHYS(0xffffffffffffffff, 0x4008556c, 0x0) setsockopt$inet6_tcp_TLS_TX(0xffffffffffffffff, 0x6, 0x1, 0x0, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) sendto$inet6(r1, 0x0, 0x0, 0x20000004, &(0x7f0000000140)={0xa, 0x4e22}, 0x1c) readv(r1, &(0x7f0000000700)=[{&(0x7f0000000440)=""/132, 0x31}], 0x1) prctl$PR_MCE_KILL_GET(0x22) timerfd_create(0x0, 0x0) r2 = accept4(r0, 0x0, 0x0, 0x0) socket$inet6_udplite(0xa, 0x2, 0x88) setsockopt$packet_fanout(0xffffffffffffffff, 0x107, 0x12, 0x0, 0x309) ioctl$FICLONE(0xffffffffffffffff, 0x40049409, 0xffffffffffffffff) ioctl$EXT4_IOC_GROUP_EXTEND(0xffffffffffffffff, 0x40046607, 0x0) ioctl$PPPIOCGFLAGS1(0xffffffffffffffff, 0x8004745a, 0x0) dup(0xffffffffffffffff) shutdown(r1, 0x1) setsockopt(r1, 0x0, 0x1, &(0x7f0000000000)="1d", 0x1) sendto$inet6(r2, &(0x7f0000000300)='A', 0x1, 0x0, 0x0, 0x0) 14:09:15 executing program 4: 14:09:15 executing program 4: 14:09:15 executing program 4: 14:09:15 executing program 2: 14:09:15 executing program 5: r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000200)='./cgroup\x00\f#\x9f\xd0\x85\xac\xc4\x9b\x81-\xb3\xd7=C\xea', 0x200002, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000180)='./bus\x00', 0x0) r2 = open(&(0x7f0000000140)='./bus\x00', 0x0, 0x0) mmap(&(0x7f0000001000/0x4000)=nil, 0x4000, 0x0, 0x11, r2, 0x0) fcntl$setstatus(r1, 0x4, 0x44040) io_setup(0x2, &(0x7f00000004c0)) io_submit(0x0, 0x1, &(0x7f0000000540)=[&(0x7f00000000c0)={0x0, 0x0, 0x0, 0x1, 0x0, r1, &(0x7f0000000000), 0x10000}]) 14:09:15 executing program 4: [ 175.858631] binder_alloc: 4651: binder_alloc_buf, no vma [ 175.870230] binder: 4651:4653 transaction failed 29189/-3, size 24-8 line 3137 14:09:15 executing program 2: r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000040)='./cgroup.cpu\x00', 0x200002, 0x0) fchdir(r0) r1 = open(&(0x7f0000000140)='./bus\x00', 0x141042, 0x0) r2 = creat(&(0x7f0000000300)='./file0\x00', 0x0) write$P9_RREMOVE(r2, &(0x7f0000000280)={0x1}, 0xff7f) r3 = creat(&(0x7f0000000700)='./bus\x00', 0x0) r4 = creat(&(0x7f00000002c0)='./bus\x00', 0x0) ftruncate(r4, 0x2081fc) pipe(&(0x7f00000003c0)={0xffffffffffffffff, 0xffffffffffffffff}) write(r6, &(0x7f00000001c0), 0xfffffef3) r7 = open(&(0x7f000000fffa)='./bus\x00', 0x141042, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x800002, 0x11, r7, 0x0) read(r5, &(0x7f0000000000)=""/250, 0x128b9372) fcntl$setstatus(r3, 0x4, 0x6100) fdatasync(r2) write$cgroup_type(r3, &(0x7f0000000200)='threaded\x00', 0xf642e7e) write(r3, &(0x7f0000000740)="ad7a5ba107f228da12d0983268221dc7d1fd7c76b676e58fbd2a1382cfb1510582a51541bb20410b2e440b3f55dea320ef11e204ea615f1c652e8bf09b9a5d9dab55d3f862cabeb056b6d951cc3c0983bf79aa920acc1c5b0589e588ef601c077975344bd08fbc564ef466cee47981fad087f13e1dd57e7c99980a66cb8e19f6dd09c2ea5b942ab64d4e2d9575f4cba0b5b30209647a06fb9fda2f2871b7e34e9b41e7552324d7e47065538bcdcc604a2f25946e95fc76a258d0752f26649a368269c0ab4516e3ac4169320a8f0fa5da91e93e83799c195ec88bf9b10b211e92bc67db36780679f6e5a481cede30303c7f9d270cdf125f4e5aeeb90df242a3d51237f1a91a8f6afb1f283d3ba053f524b378244c8cca51b9ccb71f0ae2c4cb9ca2e83af25388869544f710fa8dedd953e46aaf21996fc9a84352522e2e3b744d43b0eb728e8385edc7bc7b39733570cdd39a2fa81f0e9aaf0941bb63199f1d18333cb0b46d30af172d33f096d073b18c8ae0b3927dbb822e1b0c4caf2bee430bdce0c9068f7a481c343df3083bad53626ef3dfe4f9fe09345ad7d6945e22baa30515610de5253dac2f5d232995beed02862bc5a84c2e4ccb29b970597710312c6f54e3f6ecdf3f733ff78452bb2d854ab8ef27be95b5d1cffdae46c571b13a189ec135e9c8bf16bf3022cf4f78513e22efc837d792bf00569ae5bb42366eb552fff9e128ed0802238815558c9b98284e5996997f34e0cd233d00798ccd5b7a7858593262ebcdf2142f5ddd407dc0bbe3292ba461804b9191c4971e5337925f73ef33e4c2dd2ed832e425ef04dccd19b6bdf0e1071d9aba275b34804dcf39bb1e482e3b369a47e9ac80a17424863667ee15afb3662a53bf6d4240b6bf4721793431a0226fb3bfc7b073264ca18dce0f331cbee4b368ef96ad4bc02d8fa3984bfeb842eb42afb7af60eb3329a2d068a5791cafa76bd90181433614e61289b1c56778bb76953809849ac0908855d2f90a01b4609301cc6b5cd80b495d50e1d42462537ad98353bf6b1e1e2a44bbb93d51efcca0cb9964cfbbb6995f4a40075ba0d963d61d5afc69a370bcee71880e96b8e5789367772563aa5af3fe457cf036ceabb71a41de96178d0e8d6f0b099b73360b6197dcacfe052cbb9f280fe9629b53784a04611c68f94276354565fd8368cedf10173fc4d53d7d33209e33e24780a32cedae9afc968796da50996f21a1c45d6f966c7ac801eb01b6649fac56e852d20ad750a106eeb1e80464523b43ad20745e9ee1c1bbde7c670b02c6547add021b53e307307337eedc5e69c6f9a0c413661e99e8ea0a504966b8a1a7974242ee80d8b6cd64159c8919ae7727aab6863b3d50482b4df451ba379fa70c3fb3441604e7e17d67227b14889115ff5299fe34379355335fd2825df4c6f6f5bfa3dd74e157052dadb0bfa27bea13bd89dffff55e2604287f6a884835cd2a2c47e99940c327395c8a545764d6ea51775000a97580879adfd9d79368e78abdd3347dbad58bd4cd9681a56c15c45ddd6e78873ba0be434181dcf3db6850dc5cf0879b6b39bbcdd8f2402ccdd7600648752acf7a6fcefdc3872ecedc64abd3dbc9253d7d1b3db6c8c9cf6696f300301342e02a17a435fc357bb122528042ac9b83a573d50d94649182a49eeab6ae4c31f2cb3148f6b8d943c50e4d0df2153892ea14c8da7f31af4dd51e85523af6e65a15cb1e79a9dc968869338e685cf65bef2de6f2d8006f6ff06a9a00b3196aabc6f4aecd82534920a5c631cf1212c1d351438ef5314932efd541750e8a31bddffa2098900b82eefd06ac9987b241e5b2fff9d01391c45cd6e27bbeb7730de3f55db2821ae2a3417788cd5d56bfb33ce234afc831d5ced8d30273622c97ff8606b5018feeba0cc558749930e67427cb5ebc28ae80e3db79221a5fdcd85d7fd80ccbcd799632231f33614069658f773253048ef21b06491a86170566c4e56a733842e6d3c1b0b3279e4ea475ce6bc3af9f59222b42c66a1d80019697191c95f778f2008029dca3eca47cd04779dc67e9cfea64d412b1eb23a688ddc1a5d5a4cc65d1020bb58d38eec81bc89d207153f05a86076bb4704cb3b3e62a70223f51605bad2a7094124c5e0d50b225797d1b246d711a6e8bd09da72d27d63969bdef702b9a4ae453099868cbd7c04cc658f1e95e869163da7e8c5ba4cb6bc23510cbef5dd9aab0564ecf15a5012f6f1072abad8b029d65c630e78a23f5eff0d96a474452e28648c6660c612d076146e5898bc57dfb75a56d629b63ca852249f088ef12de1b4608ad7541027e4b99c96520934c023912b712d6f64b5990eb95c0c9666284cb548e9b9186d0b565f0dcf92dcdf4310c77638d973c88f435d049e2e330208d0ed2aa67e384ad5e01dd8a73816d715369799ceb639771c596bcfd14513c6d324415344e827fe8e72db6ab9e098077a72ff63f88d1cbefb792eb2e33147183049d66318359a548e92e984dc3a282fefcde529e46a1a7b1f090f5510f302c6756603c4bb6828977eaf23623475bd3270316af13bfd33a47b6a1f6459e004ed7447452afdc845a23e30efef92a910726de8ac09c8857be3e060f9c30232adc56737fb16be8197a0730e927bf02eb2c1b9696707b7a1098fc366f7c70d116466bc09d9405b1ef50996a771faafb316ea212d8eb599972d218e4fa09513c720488aab5bb2d9ab6186dd326ed4255740648963394866369695ad229c81c74f9b3d3aa339c651e9a5c94fd8d66b6be0aae8edcb5bc528e435da6c7bddeb5e7f35a793d21e20fcf0f82cbd20600218d8c839071c036313a989d0600ec937b91087db9ba8e02b8f03cf8693d5c07b99af6c310dc27c8a9f7ed7625497fc6b269589afbf0fd5f7c7aea8e4b2dc0d76e2d771afb52ba344efda2a62fffc8b4dcf8eb2839f8052165a1f7c203637e3e17b6f1f1a95d4be0071f28380e090e7e20397cf262d309fb54afd5b5cb8fb93515ae3e4f4ac78eee3c3b85c1a72f0623907df15c58b5e17ac384137964d4f6bb42c8c200a5f251016f833d4bf564d53954bbc721cb7cbc8942a86988771914691ac3e8208f8b471a815d81413b63c316c6ad9db9592a1c7c5aec70ca9761346fada600bf31cf1fd809c8bafd271a20d7563e", 0x8c4) ioctl$EXT4_IOC_MOVE_EXT(r1, 0xc028660f, &(0x7f0000000200)={0x0, r2}) [ 175.917519] binder: 4651:4663 BC_CLEAR_DEATH_NOTIFICATION death notification not active [ 175.928649] binder: 4651:4653 ioctl c0306201 20000440 returned -14 [ 175.966410] binder: undelivered TRANSACTION_ERROR: 29189 14:09:18 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") r1 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x1000)=nil, 0x1000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffd49, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000180)={0x18, 0x0, &(0x7f00000006c0)=[@increfs, @clear_death], 0x0, 0x0, 0x0}) 14:09:18 executing program 0: clone(0x802102001ffe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x38) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$cont(0xffffffffffffffff, r0, 0x0, 0x2) ptrace$cont(0x9, r0, 0x0, 0x0) 14:09:18 executing program 5: r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000200)='./cgroup\x00\f#\x9f\xd0\x85\xac\xc4\x9b\x81-\xb3\xd7=C\xea', 0x200002, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000180)='./bus\x00', 0x0) r2 = open(&(0x7f0000000140)='./bus\x00', 0x0, 0x0) mmap(&(0x7f0000001000/0x4000)=nil, 0x4000, 0x0, 0x11, r2, 0x0) fcntl$setstatus(r1, 0x4, 0x44040) io_setup(0x2, &(0x7f00000004c0)=0x0) io_submit(r3, 0x0, 0x0) 14:09:18 executing program 4: setsockopt$SO_ATTACH_FILTER(0xffffffffffffffff, 0x1, 0x1a, &(0x7f0000ab9ff0)={0x1, &(0x7f00000000c0)=[{0x6}]}, 0x10) sendmmsg(0xffffffffffffffff, &(0x7f0000006e00)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0) perf_event_open(&(0x7f000025c000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket(0x10, 0x803, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) keyctl$restrict_keyring(0x1d, 0x0, &(0x7f0000000200)='keyring\x00', &(0x7f0000000240)='/dev/loop-control\x00') unshare(0x20600) prctl$PR_GET_TIMERSLACK(0x1e) openat$selinux_checkreqprot(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/checkreqprot\x00', 0x80000, 0x0) getsockopt$IP6T_SO_GET_ENTRIES(0xffffffffffffffff, 0x29, 0x41, 0x0, 0x0) geteuid() ioctl$sock_SIOCGPGRP(r0, 0x8904, 0x0) fstat(0xffffffffffffffff, 0x0) r1 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000280)='/dev/loop-control\x00', 0x3f, 0x0) ioctl$LOOP_CTL_ADD(r1, 0x4c80, 0x0) openat$selinux_status(0xffffffffffffff9c, &(0x7f0000000100)='/selinux/status\x00', 0x0, 0x0) setsockopt$ARPT_SO_SET_REPLACE(0xffffffffffffffff, 0x0, 0x60, 0x0, 0x0) write$P9_RXATTRCREATE(0xffffffffffffffff, 0x0, 0x0) getrandom(&(0x7f00000002c0)=""/59, 0x14, 0x3) 14:09:18 executing program 2: r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000040)='./cgroup.cpu\x00', 0x200002, 0x0) fchdir(r0) r1 = open(&(0x7f0000000140)='./bus\x00', 0x141042, 0x0) r2 = creat(&(0x7f0000000300)='./file0\x00', 0x0) write$P9_RREMOVE(r2, &(0x7f0000000280)={0x1}, 0xff7f) r3 = creat(&(0x7f0000000700)='./bus\x00', 0x0) r4 = creat(&(0x7f00000002c0)='./bus\x00', 0x0) ftruncate(r4, 0x2081fc) pipe(&(0x7f00000003c0)={0xffffffffffffffff, 0xffffffffffffffff}) write(r6, &(0x7f00000001c0), 0xfffffef3) r7 = open(&(0x7f000000fffa)='./bus\x00', 0x141042, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x800002, 0x11, r7, 0x0) read(r5, &(0x7f0000000000)=""/250, 0x128b9372) fcntl$setstatus(r3, 0x4, 0x6100) fdatasync(r2) write$cgroup_type(r3, &(0x7f0000000200)='threaded\x00', 0xf642e7e) write(r3, &(0x7f0000000740)="ad7a5ba107f228da12d0983268221dc7d1fd7c76b676e58fbd2a1382cfb1510582a51541bb20410b2e440b3f55dea320ef11e204ea615f1c652e8bf09b9a5d9dab55d3f862cabeb056b6d951cc3c0983bf79aa920acc1c5b0589e588ef601c077975344bd08fbc564ef466cee47981fad087f13e1dd57e7c99980a66cb8e19f6dd09c2ea5b942ab64d4e2d9575f4cba0b5b30209647a06fb9fda2f2871b7e34e9b41e7552324d7e47065538bcdcc604a2f25946e95fc76a258d0752f26649a368269c0ab4516e3ac4169320a8f0fa5da91e93e83799c195ec88bf9b10b211e92bc67db36780679f6e5a481cede30303c7f9d270cdf125f4e5aeeb90df242a3d51237f1a91a8f6afb1f283d3ba053f524b378244c8cca51b9ccb71f0ae2c4cb9ca2e83af25388869544f710fa8dedd953e46aaf21996fc9a84352522e2e3b744d43b0eb728e8385edc7bc7b39733570cdd39a2fa81f0e9aaf0941bb63199f1d18333cb0b46d30af172d33f096d073b18c8ae0b3927dbb822e1b0c4caf2bee430bdce0c9068f7a481c343df3083bad53626ef3dfe4f9fe09345ad7d6945e22baa30515610de5253dac2f5d232995beed02862bc5a84c2e4ccb29b970597710312c6f54e3f6ecdf3f733ff78452bb2d854ab8ef27be95b5d1cffdae46c571b13a189ec135e9c8bf16bf3022cf4f78513e22efc837d792bf00569ae5bb42366eb552fff9e128ed0802238815558c9b98284e5996997f34e0cd233d00798ccd5b7a7858593262ebcdf2142f5ddd407dc0bbe3292ba461804b9191c4971e5337925f73ef33e4c2dd2ed832e425ef04dccd19b6bdf0e1071d9aba275b34804dcf39bb1e482e3b369a47e9ac80a17424863667ee15afb3662a53bf6d4240b6bf4721793431a0226fb3bfc7b073264ca18dce0f331cbee4b368ef96ad4bc02d8fa3984bfeb842eb42afb7af60eb3329a2d068a5791cafa76bd90181433614e61289b1c56778bb76953809849ac0908855d2f90a01b4609301cc6b5cd80b495d50e1d42462537ad98353bf6b1e1e2a44bbb93d51efcca0cb9964cfbbb6995f4a40075ba0d963d61d5afc69a370bcee71880e96b8e5789367772563aa5af3fe457cf036ceabb71a41de96178d0e8d6f0b099b73360b6197dcacfe052cbb9f280fe9629b53784a04611c68f94276354565fd8368cedf10173fc4d53d7d33209e33e24780a32cedae9afc968796da50996f21a1c45d6f966c7ac801eb01b6649fac56e852d20ad750a106eeb1e80464523b43ad20745e9ee1c1bbde7c670b02c6547add021b53e307307337eedc5e69c6f9a0c413661e99e8ea0a504966b8a1a7974242ee80d8b6cd64159c8919ae7727aab6863b3d50482b4df451ba379fa70c3fb3441604e7e17d67227b14889115ff5299fe34379355335fd2825df4c6f6f5bfa3dd74e157052dadb0bfa27bea13bd89dffff55e2604287f6a884835cd2a2c47e99940c327395c8a545764d6ea51775000a97580879adfd9d79368e78abdd3347dbad58bd4cd9681a56c15c45ddd6e78873ba0be434181dcf3db6850dc5cf0879b6b39bbcdd8f2402ccdd7600648752acf7a6fcefdc3872ecedc64abd3dbc9253d7d1b3db6c8c9cf6696f300301342e02a17a435fc357bb122528042ac9b83a573d50d94649182a49eeab6ae4c31f2cb3148f6b8d943c50e4d0df2153892ea14c8da7f31af4dd51e85523af6e65a15cb1e79a9dc968869338e685cf65bef2de6f2d8006f6ff06a9a00b3196aabc6f4aecd82534920a5c631cf1212c1d351438ef5314932efd541750e8a31bddffa2098900b82eefd06ac9987b241e5b2fff9d01391c45cd6e27bbeb7730de3f55db2821ae2a3417788cd5d56bfb33ce234afc831d5ced8d30273622c97ff8606b5018feeba0cc558749930e67427cb5ebc28ae80e3db79221a5fdcd85d7fd80ccbcd799632231f33614069658f773253048ef21b06491a86170566c4e56a733842e6d3c1b0b3279e4ea475ce6bc3af9f59222b42c66a1d80019697191c95f778f2008029dca3eca47cd04779dc67e9cfea64d412b1eb23a688ddc1a5d5a4cc65d1020bb58d38eec81bc89d207153f05a86076bb4704cb3b3e62a70223f51605bad2a7094124c5e0d50b225797d1b246d711a6e8bd09da72d27d63969bdef702b9a4ae453099868cbd7c04cc658f1e95e869163da7e8c5ba4cb6bc23510cbef5dd9aab0564ecf15a5012f6f1072abad8b029d65c630e78a23f5eff0d96a474452e28648c6660c612d076146e5898bc57dfb75a56d629b63ca852249f088ef12de1b4608ad7541027e4b99c96520934c023912b712d6f64b5990eb95c0c9666284cb548e9b9186d0b565f0dcf92dcdf4310c77638d973c88f435d049e2e330208d0ed2aa67e384ad5e01dd8a73816d715369799ceb639771c596bcfd14513c6d324415344e827fe8e72db6ab9e098077a72ff63f88d1cbefb792eb2e33147183049d66318359a548e92e984dc3a282fefcde529e46a1a7b1f090f5510f302c6756603c4bb6828977eaf23623475bd3270316af13bfd33a47b6a1f6459e004ed7447452afdc845a23e30efef92a910726de8ac09c8857be3e060f9c30232adc56737fb16be8197a0730e927bf02eb2c1b9696707b7a1098fc366f7c70d116466bc09d9405b1ef50996a771faafb316ea212d8eb599972d218e4fa09513c720488aab5bb2d9ab6186dd326ed4255740648963394866369695ad229c81c74f9b3d3aa339c651e9a5c94fd8d66b6be0aae8edcb5bc528e435da6c7bddeb5e7f35a793d21e20fcf0f82cbd20600218d8c839071c036313a989d0600ec937b91087db9ba8e02b8f03cf8693d5c07b99af6c310dc27c8a9f7ed7625497fc6b269589afbf0fd5f7c7aea8e4b2dc0d76e2d771afb52ba344efda2a62fffc8b4dcf8eb2839f8052165a1f7c203637e3e17b6f1f1a95d4be0071f28380e090e7e20397cf262d309fb54afd5b5cb8fb93515ae3e4f4ac78eee3c3b85c1a72f0623907df15c58b5e17ac384137964d4f6bb42c8c200a5f251016f833d4bf564d53954bbc721cb7cbc8942a86988771914691ac3e8208f8b471a815d81413b63c316c6ad9db9592a1c7c5aec70ca9761346fada600bf31cf1fd809c8bafd271a20d7563e", 0x8c4) ioctl$EXT4_IOC_MOVE_EXT(r1, 0xc028660f, &(0x7f0000000200)={0x0, r2}) 14:09:18 executing program 1: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f0000000040)={0xa, 0x4e22}, 0x1c) listen(r0, 0xeb) ioctl$UI_SET_PHYS(0xffffffffffffffff, 0x4008556c, 0x0) setsockopt$inet6_tcp_TLS_TX(0xffffffffffffffff, 0x6, 0x1, 0x0, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) sendto$inet6(r1, 0x0, 0x0, 0x20000004, &(0x7f0000000140)={0xa, 0x4e22}, 0x1c) readv(r1, &(0x7f0000000700)=[{&(0x7f0000000440)=""/132, 0x31}], 0x1) prctl$PR_MCE_KILL_GET(0x22) timerfd_create(0x0, 0x0) r2 = accept4(r0, 0x0, 0x0, 0x0) socket$inet6_udplite(0xa, 0x2, 0x88) setsockopt$packet_fanout(0xffffffffffffffff, 0x107, 0x12, 0x0, 0x309) ioctl$FICLONE(0xffffffffffffffff, 0x40049409, 0xffffffffffffffff) ioctl$EXT4_IOC_GROUP_EXTEND(0xffffffffffffffff, 0x40046607, 0x0) ioctl$PPPIOCGFLAGS1(0xffffffffffffffff, 0x8004745a, 0x0) dup(0xffffffffffffffff) shutdown(r1, 0x1) setsockopt(r1, 0x0, 0x1, &(0x7f0000000000)="1d", 0x1) sendto$inet6(r2, &(0x7f0000000300)='A', 0x1, 0x0, 0x0, 0x0) 14:09:18 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") r1 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x1000)=nil, 0x1000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffd49, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000180)={0x18, 0x0, &(0x7f00000006c0)=[@increfs, @clear_death], 0x0, 0x0, 0x0}) 14:09:18 executing program 4: r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000040)='./cgroup.cpu\x00', 0x200002, 0x0) fchdir(r0) r1 = open(&(0x7f0000000140)='./bus\x00', 0x141042, 0x0) r2 = creat(&(0x7f0000000300)='./file0\x00', 0x0) write$P9_RREMOVE(r2, &(0x7f0000000280)={0x1}, 0xff7f) r3 = creat(&(0x7f0000000700)='./bus\x00', 0x0) r4 = creat(&(0x7f00000002c0)='./bus\x00', 0x0) ftruncate(r4, 0x2081fc) pipe(&(0x7f00000003c0)={0xffffffffffffffff, 0xffffffffffffffff}) write(r6, &(0x7f00000001c0), 0xfffffef3) r7 = open(&(0x7f000000fffa)='./bus\x00', 0x141042, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x800002, 0x11, r7, 0x0) read(r5, &(0x7f0000000000)=""/250, 0x128b9372) fcntl$setstatus(r3, 0x4, 0x6100) fdatasync(r2) write$cgroup_type(r3, &(0x7f0000000200)='threaded\x00', 0xf642e7e) write(r3, &(0x7f0000000740)="ad7a5ba107f228da12d0983268221dc7d1fd7c76b676e58fbd2a1382cfb1510582a51541bb20410b2e440b3f55dea320ef11e204ea615f1c652e8bf09b9a5d9dab55d3f862cabeb056b6d951cc3c0983bf79aa920acc1c5b0589e588ef601c077975344bd08fbc564ef466cee47981fad087f13e1dd57e7c99980a66cb8e19f6dd09c2ea5b942ab64d4e2d9575f4cba0b5b30209647a06fb9fda2f2871b7e34e9b41e7552324d7e47065538bcdcc604a2f25946e95fc76a258d0752f26649a368269c0ab4516e3ac4169320a8f0fa5da91e93e83799c195ec88bf9b10b211e92bc67db36780679f6e5a481cede30303c7f9d270cdf125f4e5aeeb90df242a3d51237f1a91a8f6afb1f283d3ba053f524b378244c8cca51b9ccb71f0ae2c4cb9ca2e83af25388869544f710fa8dedd953e46aaf21996fc9a84352522e2e3b744d43b0eb728e8385edc7bc7b39733570cdd39a2fa81f0e9aaf0941bb63199f1d18333cb0b46d30af172d33f096d073b18c8ae0b3927dbb822e1b0c4caf2bee430bdce0c9068f7a481c343df3083bad53626ef3dfe4f9fe09345ad7d6945e22baa30515610de5253dac2f5d232995beed02862bc5a84c2e4ccb29b970597710312c6f54e3f6ecdf3f733ff78452bb2d854ab8ef27be95b5d1cffdae46c571b13a189ec135e9c8bf16bf3022cf4f78513e22efc837d792bf00569ae5bb42366eb552fff9e128ed0802238815558c9b98284e5996997f34e0cd233d00798ccd5b7a7858593262ebcdf2142f5ddd407dc0bbe3292ba461804b9191c4971e5337925f73ef33e4c2dd2ed832e425ef04dccd19b6bdf0e1071d9aba275b34804dcf39bb1e482e3b369a47e9ac80a17424863667ee15afb3662a53bf6d4240b6bf4721793431a0226fb3bfc7b073264ca18dce0f331cbee4b368ef96ad4bc02d8fa3984bfeb842eb42afb7af60eb3329a2d068a5791cafa76bd90181433614e61289b1c56778bb76953809849ac0908855d2f90a01b4609301cc6b5cd80b495d50e1d42462537ad98353bf6b1e1e2a44bbb93d51efcca0cb9964cfbbb6995f4a40075ba0d963d61d5afc69a370bcee71880e96b8e5789367772563aa5af3fe457cf036ceabb71a41de96178d0e8d6f0b099b73360b6197dcacfe052cbb9f280fe9629b53784a04611c68f94276354565fd8368cedf10173fc4d53d7d33209e33e24780a32cedae9afc968796da50996f21a1c45d6f966c7ac801eb01b6649fac56e852d20ad750a106eeb1e80464523b43ad20745e9ee1c1bbde7c670b02c6547add021b53e307307337eedc5e69c6f9a0c413661e99e8ea0a504966b8a1a7974242ee80d8b6cd64159c8919ae7727aab6863b3d50482b4df451ba379fa70c3fb3441604e7e17d67227b14889115ff5299fe34379355335fd2825df4c6f6f5bfa3dd74e157052dadb0bfa27bea13bd89dffff55e2604287f6a884835cd2a2c47e99940c327395c8a545764d6ea51775000a97580879adfd9d79368e78abdd3347dbad58bd4cd9681a56c15c45ddd6e78873ba0be434181dcf3db6850dc5cf0879b6b39bbcdd8f2402ccdd7600648752acf7a6fcefdc3872ecedc64abd3dbc9253d7d1b3db6c8c9cf6696f300301342e02a17a435fc357bb122528042ac9b83a573d50d94649182a49eeab6ae4c31f2cb3148f6b8d943c50e4d0df2153892ea14c8da7f31af4dd51e85523af6e65a15cb1e79a9dc968869338e685cf65bef2de6f2d8006f6ff06a9a00b3196aabc6f4aecd82534920a5c631cf1212c1d351438ef5314932efd541750e8a31bddffa2098900b82eefd06ac9987b241e5b2fff9d01391c45cd6e27bbeb7730de3f55db2821ae2a3417788cd5d56bfb33ce234afc831d5ced8d30273622c97ff8606b5018feeba0cc558749930e67427cb5ebc28ae80e3db79221a5fdcd85d7fd80ccbcd799632231f33614069658f773253048ef21b06491a86170566c4e56a733842e6d3c1b0b3279e4ea475ce6bc3af9f59222b42c66a1d80019697191c95f778f2008029dca3eca47cd04779dc67e9cfea64d412b1eb23a688ddc1a5d5a4cc65d1020bb58d38eec81bc89d207153f05a86076bb4704cb3b3e62a70223f51605bad2a7094124c5e0d50b225797d1b246d711a6e8bd09da72d27d63969bdef702b9a4ae453099868cbd7c04cc658f1e95e869163da7e8c5ba4cb6bc23510cbef5dd9aab0564ecf15a5012f6f1072abad8b029d65c630e78a23f5eff0d96a474452e28648c6660c612d076146e5898bc57dfb75a56d629b63ca852249f088ef12de1b4608ad7541027e4b99c96520934c023912b712d6f64b5990eb95c0c9666284cb548e9b9186d0b565f0dcf92dcdf4310c77638d973c88f435d049e2e330208d0ed2aa67e384ad5e01dd8a73816d715369799ceb639771c596bcfd14513c6d324415344e827fe8e72db6ab9e098077a72ff63f88d1cbefb792eb2e33147183049d66318359a548e92e984dc3a282fefcde529e46a1a7b1f090f5510f302c6756603c4bb6828977eaf23623475bd3270316af13bfd33a47b6a1f6459e004ed7447452afdc845a23e30efef92a910726de8ac09c8857be3e060f9c30232adc56737fb16be8197a0730e927bf02eb2c1b9696707b7a1098fc366f7c70d116466bc09d9405b1ef50996a771faafb316ea212d8eb599972d218e4fa09513c720488aab5bb2d9ab6186dd326ed4255740648963394866369695ad229c81c74f9b3d3aa339c651e9a5c94fd8d66b6be0aae8edcb5bc528e435da6c7bddeb5e7f35a793d21e20fcf0f82cbd20600218d8c839071c036313a989d0600ec937b91087db9ba8e02b8f03cf8693d5c07b99af6c310dc27c8a9f7ed7625497fc6b269589afbf0fd5f7c7aea8e4b2dc0d76e2d771afb52ba344efda2a62fffc8b4dcf8eb2839f8052165a1f7c203637e3e17b6f1f1a95d4be0071f28380e090e7e20397cf262d309fb54afd5b5cb8fb93515ae3e4f4ac78eee3c3b85c1a72f0623907df15c58b5e17ac384137964d4f6bb42c8c200a5f251016f833d4bf564d53954bbc721cb7cbc8942a86988771914691ac3e8208f8b471a815d81413b63c316c6ad9db9592a1c7c5aec70ca9761346fada600bf31cf1fd809c8bafd271a20d7563e", 0x8c4) ioctl$EXT4_IOC_MOVE_EXT(r1, 0xc028660f, &(0x7f0000000200)={0x0, r2}) [ 178.904998] binder: 4682:4688 transaction failed 29189/-22, size 24-8 line 3014 [ 178.919020] binder: 4682:4688 ioctl c0306201 20000440 returned -14 [ 178.926726] binder: 4682:4688 IncRefs 0 refcount change on invalid ref 0 ret -22 [ 178.934267] binder: 4682:4688 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 [ 178.942602] binder: undelivered TRANSACTION_ERROR: 29189 14:09:18 executing program 5: r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000200)='./cgroup\x00\f#\x9f\xd0\x85\xac\xc4\x9b\x81-\xb3\xd7=C\xea', 0x200002, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000180)='./bus\x00', 0x0) r2 = open(&(0x7f0000000140)='./bus\x00', 0x0, 0x0) mmap(&(0x7f0000001000/0x4000)=nil, 0x4000, 0x0, 0x11, r2, 0x0) fcntl$setstatus(r1, 0x4, 0x44040) io_setup(0x2, &(0x7f00000004c0)=0x0) io_submit(r3, 0x0, 0x0) 14:09:18 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") r1 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x1000)=nil, 0x1000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffd49, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000180)={0x18, 0x0, &(0x7f00000006c0)=[@increfs, @clear_death], 0x0, 0x0, 0x0}) [ 178.973568] binder: 4700:4701 transaction failed 29189/-22, size 24-8 line 3014 [ 178.982039] binder: 4700:4701 ioctl c0306201 20000440 returned -14 [ 178.990291] binder: 4700:4701 IncRefs 0 refcount change on invalid ref 0 ret -22 [ 178.998024] binder: 4700:4701 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 [ 179.006937] binder: undelivered TRANSACTION_ERROR: 29189 14:09:18 executing program 1: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f0000000040)={0xa, 0x4e22}, 0x1c) listen(r0, 0xeb) ioctl$UI_SET_PHYS(0xffffffffffffffff, 0x4008556c, 0x0) setsockopt$inet6_tcp_TLS_TX(0xffffffffffffffff, 0x6, 0x1, 0x0, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) readv(r1, &(0x7f0000000700)=[{&(0x7f0000000440)=""/132, 0x31}], 0x1) prctl$PR_MCE_KILL_GET(0x22) timerfd_create(0x0, 0x0) r2 = accept4(r0, 0x0, 0x0, 0x0) socket$inet6_udplite(0xa, 0x2, 0x88) setsockopt$packet_fanout(0xffffffffffffffff, 0x107, 0x12, 0x0, 0x309) ioctl$FICLONE(0xffffffffffffffff, 0x40049409, 0xffffffffffffffff) ioctl$EXT4_IOC_GROUP_EXTEND(0xffffffffffffffff, 0x40046607, 0x0) ioctl$PPPIOCGFLAGS1(0xffffffffffffffff, 0x8004745a, 0x0) dup(0xffffffffffffffff) shutdown(r1, 0x1) setsockopt(r1, 0x0, 0x1, &(0x7f0000000000)="1d", 0x1) sendto$inet6(r2, &(0x7f0000000300)='A', 0x1, 0x0, 0x0, 0x0) 14:09:19 executing program 5: r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000200)='./cgroup\x00\f#\x9f\xd0\x85\xac\xc4\x9b\x81-\xb3\xd7=C\xea', 0x200002, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000180)='./bus\x00', 0x0) r2 = open(&(0x7f0000000140)='./bus\x00', 0x0, 0x0) mmap(&(0x7f0000001000/0x4000)=nil, 0x4000, 0x0, 0x11, r2, 0x0) fcntl$setstatus(r1, 0x4, 0x44040) io_setup(0x2, &(0x7f00000004c0)=0x0) io_submit(r3, 0x0, 0x0) 14:09:19 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x1000)=nil, 0x1000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffd49, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x18, 0x0, &(0x7f00000006c0)=[@increfs, @clear_death], 0x0, 0x0, 0x0}) [ 179.052930] binder: 4708:4710 transaction failed 29189/-22, size 24-8 line 3014 [ 179.064155] binder: 4708:4710 ioctl c0306201 20000440 returned -14 [ 179.073713] binder: 4708:4710 IncRefs 0 refcount change on invalid ref 0 ret -22 [ 179.082306] binder: 4708:4710 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 [ 179.092970] binder: undelivered TRANSACTION_ERROR: 29189 [ 179.150523] binder: 4718:4719 BC_CLEAR_DEATH_NOTIFICATION death notification not active 14:09:21 executing program 0: clone(0x802102001ffe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x38) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$cont(0x18, 0x0, 0x0, 0x2) ptrace$cont(0x9, r0, 0x0, 0x0) 14:09:21 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x1000)=nil, 0x1000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffd49, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x18, 0x0, &(0x7f00000006c0)=[@increfs, @clear_death], 0x0, 0x0, 0x0}) 14:09:21 executing program 5: r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000200)='./cgroup\x00\f#\x9f\xd0\x85\xac\xc4\x9b\x81-\xb3\xd7=C\xea', 0x200002, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000180)='./bus\x00', 0x0) r2 = open(&(0x7f0000000140)='./bus\x00', 0x0, 0x0) mmap(&(0x7f0000001000/0x4000)=nil, 0x4000, 0x0, 0x11, r2, 0x0) fcntl$setstatus(r1, 0x4, 0x44040) io_setup(0x2, &(0x7f00000004c0)=0x0) io_submit(r3, 0x0, &(0x7f0000000540)) 14:09:21 executing program 2: r0 = open(&(0x7f0000000140)='.\x00', 0x0, 0x0) gettid() fsync(r0) 14:09:21 executing program 4: r0 = gettid() ptrace$peekuser(0x3, 0x0, 0x0) timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) write$P9_RMKDIR(0xffffffffffffffff, 0x0, 0xffffffffffffff41) timer_settime(0x0, 0x0, &(0x7f0000000080)={{0x0, 0x1c9c380}, {0x0, 0x9}}, 0x0) socketpair$nbd(0x1, 0x1, 0x0, 0x0) accept(0xffffffffffffffff, 0x0, 0x0) ioctl$sock_inet_SIOCSIFADDR(0xffffffffffffffff, 0x8916, 0x0) r1 = openat$null(0xffffffffffffff9c, &(0x7f0000000040)='/dev/null\x00', 0x0, 0x0) ioctl$TIOCSSOFTCAR(r1, 0x541a, 0x0) tkill(r0, 0x1000000000016) 14:09:21 executing program 1: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f0000000040)={0xa, 0x4e22}, 0x1c) listen(r0, 0xeb) ioctl$UI_SET_PHYS(0xffffffffffffffff, 0x4008556c, 0x0) setsockopt$inet6_tcp_TLS_TX(0xffffffffffffffff, 0x6, 0x1, 0x0, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) readv(r1, &(0x7f0000000700)=[{&(0x7f0000000440)=""/132, 0x31}], 0x1) prctl$PR_MCE_KILL_GET(0x22) timerfd_create(0x0, 0x0) r2 = accept4(r0, 0x0, 0x0, 0x0) socket$inet6_udplite(0xa, 0x2, 0x88) setsockopt$packet_fanout(0xffffffffffffffff, 0x107, 0x12, 0x0, 0x309) ioctl$FICLONE(0xffffffffffffffff, 0x40049409, 0xffffffffffffffff) ioctl$EXT4_IOC_GROUP_EXTEND(0xffffffffffffffff, 0x40046607, 0x0) ioctl$PPPIOCGFLAGS1(0xffffffffffffffff, 0x8004745a, 0x0) dup(0xffffffffffffffff) shutdown(r1, 0x1) setsockopt(r1, 0x0, 0x1, &(0x7f0000000000)="1d", 0x1) sendto$inet6(r2, &(0x7f0000000300)='A', 0x1, 0x0, 0x0, 0x0) 14:09:21 executing program 2: r0 = syz_open_procfs(0x0, &(0x7f0000000200)='gid_map\x00') preadv(r0, &(0x7f0000000080)=[{&(0x7f0000000100)=""/218, 0xda}], 0x1, 0x0) 14:09:21 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x1000)=nil, 0x1000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffd49, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x18, 0x0, &(0x7f00000006c0)=[@increfs, @clear_death], 0x0, 0x0, 0x0}) [ 181.931971] binder: 4729:4735 BC_CLEAR_DEATH_NOTIFICATION death notification not active 14:09:21 executing program 5: r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000200)='./cgroup\x00\f#\x9f\xd0\x85\xac\xc4\x9b\x81-\xb3\xd7=C\xea', 0x200002, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000180)='./bus\x00', 0x0) r2 = open(&(0x7f0000000140)='./bus\x00', 0x0, 0x0) mmap(&(0x7f0000001000/0x4000)=nil, 0x4000, 0x0, 0x11, r2, 0x0) fcntl$setstatus(r1, 0x4, 0x44040) io_setup(0x2, &(0x7f00000004c0)=0x0) io_submit(r3, 0x0, &(0x7f0000000540)) 14:09:21 executing program 2: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f00001fefe4)={0xa, 0x4e22}, 0x1c) listen(r0, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$sock_int(r1, 0x1, 0x8, &(0x7f0000000000), 0x4) sendto$inet6(r1, 0x0, 0x0, 0x20000004, &(0x7f000031e000)={0xa, 0x4e22}, 0x1c) 14:09:21 executing program 4: munmap(&(0x7f0000029000/0x2000)=nil, 0x2000) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ptmx\x00', 0x23d, 0x0) write$binfmt_aout(r0, &(0x7f00000000c0)=ANY=[], 0xffffff78) ioctl$TCSETS(r0, 0x40045431, &(0x7f00003b9fdc)) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000080)) syz_open_pts(r0, 0x0) 14:09:21 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") r1 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x1000)=nil, 0x1000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000180)={0x18, 0x0, &(0x7f00000006c0)=[@increfs, @clear_death], 0x0, 0x0, 0x0}) [ 181.986478] binder: 4746:4749 BC_CLEAR_DEATH_NOTIFICATION death notification not active [ 182.067473] binder: 4755:4760 ioctl c0306201 0 returned -14 [ 182.079498] TCP: request_sock_TCPv6: Possible SYN flooding on port 20002. Dropping request. Check SNMP counters. [ 182.097558] binder: 4755:4760 BC_CLEAR_DEATH_NOTIFICATION death notification not active 14:09:24 executing program 0: clone(0x802102001ffe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x38) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$cont(0x18, 0x0, 0x0, 0x2) ptrace$cont(0x9, r0, 0x0, 0x0) 14:09:24 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") r1 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x1000)=nil, 0x1000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000180)={0x18, 0x0, &(0x7f00000006c0)=[@increfs, @clear_death], 0x0, 0x0, 0x0}) 14:09:24 executing program 5: r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000200)='./cgroup\x00\f#\x9f\xd0\x85\xac\xc4\x9b\x81-\xb3\xd7=C\xea', 0x200002, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000180)='./bus\x00', 0x0) r2 = open(&(0x7f0000000140)='./bus\x00', 0x0, 0x0) mmap(&(0x7f0000001000/0x4000)=nil, 0x4000, 0x0, 0x11, r2, 0x0) fcntl$setstatus(r1, 0x4, 0x44040) io_setup(0x2, &(0x7f00000004c0)=0x0) io_submit(r3, 0x0, &(0x7f0000000540)) 14:09:24 executing program 4: madvise(&(0x7f0000ffb000/0x3000)=nil, 0x3000, 0xca) madvise(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x200000010) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000340)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) madvise(&(0x7f0000ff7000/0x9000)=nil, 0x9000, 0xcb) 14:09:24 executing program 1: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f0000000040)={0xa, 0x4e22}, 0x1c) listen(r0, 0xeb) ioctl$UI_SET_PHYS(0xffffffffffffffff, 0x4008556c, 0x0) setsockopt$inet6_tcp_TLS_TX(0xffffffffffffffff, 0x6, 0x1, 0x0, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) readv(r1, &(0x7f0000000700)=[{&(0x7f0000000440)=""/132, 0x31}], 0x1) prctl$PR_MCE_KILL_GET(0x22) timerfd_create(0x0, 0x0) r2 = accept4(r0, 0x0, 0x0, 0x0) socket$inet6_udplite(0xa, 0x2, 0x88) setsockopt$packet_fanout(0xffffffffffffffff, 0x107, 0x12, 0x0, 0x309) ioctl$FICLONE(0xffffffffffffffff, 0x40049409, 0xffffffffffffffff) ioctl$EXT4_IOC_GROUP_EXTEND(0xffffffffffffffff, 0x40046607, 0x0) ioctl$PPPIOCGFLAGS1(0xffffffffffffffff, 0x8004745a, 0x0) dup(0xffffffffffffffff) shutdown(r1, 0x1) setsockopt(r1, 0x0, 0x1, &(0x7f0000000000)="1d", 0x1) sendto$inet6(r2, &(0x7f0000000300)='A', 0x1, 0x0, 0x0, 0x0) 14:09:24 executing program 2: r0 = socket(0x2, 0x10000001, 0x84) connect$unix(r0, &(0x7f0000000000)=ANY=[@ANYBLOB="8202c1ffffffffffffff"], 0x1) 14:09:24 executing program 2: r0 = socket(0x2, 0x10000001, 0x0) connect$unix(r0, &(0x7f0000000000)=ANY=[@ANYBLOB="82022e2f66697c653000"], 0x1) 14:09:24 executing program 4: r0 = socket$inet6(0xa, 0x80002, 0x0) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r0, 0x29, 0x20, &(0x7f0000000080)={@dev, 0x0, 0x0, 0x2}, 0x20) 14:09:24 executing program 5: r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000200)='./cgroup\x00\f#\x9f\xd0\x85\xac\xc4\x9b\x81-\xb3\xd7=C\xea', 0x200002, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000180)='./bus\x00', 0x0) r2 = open(&(0x7f0000000140)='./bus\x00', 0x0, 0x0) mmap(&(0x7f0000001000/0x4000)=nil, 0x4000, 0x0, 0x11, r2, 0x0) fcntl$setstatus(r1, 0x4, 0x44040) io_setup(0x2, &(0x7f00000004c0)=0x0) io_submit(r3, 0x1, &(0x7f0000000540)=[0x0]) 14:09:24 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") r1 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x1000)=nil, 0x1000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000180)={0x18, 0x0, &(0x7f00000006c0)=[@increfs, @clear_death], 0x0, 0x0, 0x0}) [ 184.964801] binder: 4772:4780 ioctl c0306201 0 returned -14 [ 185.000738] binder: 4772:4780 BC_CLEAR_DEATH_NOTIFICATION death notification not active 14:09:24 executing program 4: clone(0x2102001ffe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socket(0x0, 0x0, 0x0) r0 = getpid() rt_tgsigqueueinfo(r0, r0, 0x16, &(0x7f0000000100)) rt_sigqueueinfo(r0, 0x0, 0x0) 14:09:24 executing program 2: clone(0x2302001ffe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) wait4(0x0, 0x0, 0x80000000, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) clone(0xa01ffff, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = gettid() pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) write(r2, &(0x7f00000001c0), 0xfffffef3) ptrace(0x4206, r1) tkill(r1, 0x9) [ 185.089067] binder: 4798:4803 ioctl c0306201 0 returned -14 [ 185.102805] binder: 4798:4803 BC_CLEAR_DEATH_NOTIFICATION death notification not active 14:09:27 executing program 0: clone(0x802102001ffe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x38) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$cont(0x18, 0x0, 0x0, 0x2) ptrace$cont(0x9, r0, 0x0, 0x0) 14:09:27 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") r1 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x1000)=nil, 0x1000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000180)={0x18, 0x0, &(0x7f00000006c0)=[@increfs, @clear_death], 0x0, 0x0, 0x0}) 14:09:27 executing program 5: r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000200)='./cgroup\x00\f#\x9f\xd0\x85\xac\xc4\x9b\x81-\xb3\xd7=C\xea', 0x200002, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000180)='./bus\x00', 0x0) r2 = open(&(0x7f0000000140)='./bus\x00', 0x0, 0x0) mmap(&(0x7f0000001000/0x4000)=nil, 0x4000, 0x0, 0x11, r2, 0x0) fcntl$setstatus(r1, 0x4, 0x44040) io_setup(0x2, &(0x7f00000004c0)=0x0) io_submit(r3, 0x1, &(0x7f0000000540)=[0x0]) 14:09:27 executing program 4: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$SO_ATTACH_FILTER(r1, 0x1, 0x1a, &(0x7f0000ab9ff0)={0x2, &(0x7f00000000c0)=[{0x20}, {0x6}]}, 0x10) sendmmsg(r0, &(0x7f0000006e00)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0) perf_event_open(&(0x7f000025c000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r2 = socket(0x10, 0x803, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) unshare(0x20600) prctl$PR_GET_TIMERSLACK(0x1e) openat$selinux_checkreqprot(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/checkreqprot\x00', 0x80000, 0x0) getsockopt$IP6T_SO_GET_ENTRIES(0xffffffffffffffff, 0x29, 0x41, 0x0, 0x0) geteuid() ioctl$sock_SIOCGPGRP(r2, 0x8904, 0x0) fstat(0xffffffffffffffff, 0x0) r3 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000280)='/dev/loop-control\x00', 0x3f, 0x0) ioctl$LOOP_CTL_REMOVE(0xffffffffffffffff, 0x4c81, 0x0) ioctl$LOOP_CTL_ADD(r3, 0x4c80, 0x0) openat$selinux_status(0xffffffffffffff9c, &(0x7f0000000100)='/selinux/status\x00', 0x0, 0x0) setsockopt$ARPT_SO_SET_REPLACE(0xffffffffffffffff, 0x0, 0x60, &(0x7f0000000800)=ANY=[@ANYRES32], 0x1) write$P9_RXATTRCREATE(0xffffffffffffffff, 0x0, 0x0) getrandom(&(0x7f00000002c0)=""/59, 0x14, 0x3) 14:09:27 executing program 1: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f0000000040)={0xa, 0x4e22}, 0x1c) listen(r0, 0xeb) ioctl$UI_SET_PHYS(0xffffffffffffffff, 0x4008556c, 0x0) setsockopt$inet6_tcp_TLS_TX(0xffffffffffffffff, 0x6, 0x1, 0x0, 0x0) sendto$inet6(0xffffffffffffffff, 0x0, 0x0, 0x20000004, &(0x7f0000000140)={0xa, 0x4e22}, 0x1c) readv(0xffffffffffffffff, &(0x7f0000000700)=[{&(0x7f0000000440)=""/132, 0x31}], 0x1) prctl$PR_MCE_KILL_GET(0x22) timerfd_create(0x0, 0x0) r1 = accept4(r0, 0x0, 0x0, 0x0) socket$inet6_udplite(0xa, 0x2, 0x88) setsockopt$packet_fanout(0xffffffffffffffff, 0x107, 0x12, 0x0, 0x309) ioctl$FICLONE(0xffffffffffffffff, 0x40049409, 0xffffffffffffffff) ioctl$EXT4_IOC_GROUP_EXTEND(0xffffffffffffffff, 0x40046607, 0x0) ioctl$PPPIOCGFLAGS1(0xffffffffffffffff, 0x8004745a, 0x0) dup(0xffffffffffffffff) shutdown(0xffffffffffffffff, 0x1) setsockopt(0xffffffffffffffff, 0x0, 0x1, &(0x7f0000000000)="1d", 0x1) sendto$inet6(r1, &(0x7f0000000300)='A', 0x1, 0x0, 0x0, 0x0) 14:09:27 executing program 2: r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000040)='./cgroup.cpu\x00', 0x200002, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000300)='./file0\x00', 0x0) write$P9_RREMOVE(r1, &(0x7f0000000280)={0x1}, 0xff7f) 14:09:27 executing program 2: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000001400)={0xffffffffffffffff, 0xffffffffffffffff}) recvmsg(0xffffffffffffffff, 0x0, 0x0) setsockopt$sock_int(r0, 0x1, 0x0, 0x0, 0x0) [ 187.975678] binder: 4820:4823 BC_CLEAR_DEATH_NOTIFICATION death notification not active 14:09:27 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") r1 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x1000)=nil, 0x1000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000180)={0x18, 0x0, &(0x7f00000006c0)=[@increfs, @clear_death], 0x0, 0x0, 0x0}) 14:09:27 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ptmx\x00', 0x23d, 0x0) write$binfmt_aout(r0, &(0x7f00000000c0)=ANY=[], 0xffffff78) ioctl$TCSETA(r0, 0x5406, &(0x7f0000000180)) ioctl$TCSETSF(r0, 0x5404, &(0x7f00000001c0)) 14:09:27 executing program 5: r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000200)='./cgroup\x00\f#\x9f\xd0\x85\xac\xc4\x9b\x81-\xb3\xd7=C\xea', 0x200002, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000180)='./bus\x00', 0x0) r2 = open(&(0x7f0000000140)='./bus\x00', 0x0, 0x0) mmap(&(0x7f0000001000/0x4000)=nil, 0x4000, 0x0, 0x11, r2, 0x0) fcntl$setstatus(r1, 0x4, 0x44040) io_setup(0x2, &(0x7f00000004c0)=0x0) io_submit(r3, 0x1, &(0x7f0000000540)=[0x0]) 14:09:27 executing program 4: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x210000000013, &(0x7f0000000040)=0x100000001, 0x4) setsockopt$inet_tcp_int(r0, 0x6, 0x18, &(0x7f0000000100)=0xffffffff80000001, 0x4) setsockopt$inet_tcp_TCP_REPAIR(r0, 0x6, 0x13, &(0x7f0000000000), 0x4) connect$inet(r0, &(0x7f0000000180)={0x2, 0x0, @local}, 0x10) 14:09:28 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") r1 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x1000)=nil, 0x1000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000180)={0x18, 0x0, &(0x7f00000006c0)=[@increfs, @clear_death], 0x0, 0x0, 0x0}) [ 188.057583] binder: 4843:4844 BC_CLEAR_DEATH_NOTIFICATION death notification not active 14:09:28 executing program 4: [ 188.121874] binder: 4852:4856 BC_CLEAR_DEATH_NOTIFICATION death notification not active 14:09:30 executing program 0: clone(0x802102001ffe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x38) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$cont(0x9, r0, 0x0, 0x0) 14:09:30 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") r1 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x1000)=nil, 0x1000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000300), 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000180)={0x18, 0x0, &(0x7f00000006c0)=[@increfs, @clear_death], 0x0, 0x0, 0x0}) 14:09:30 executing program 4: 14:09:30 executing program 5: r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000200)='./cgroup\x00\f#\x9f\xd0\x85\xac\xc4\x9b\x81-\xb3\xd7=C\xea', 0x200002, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000180)='./bus\x00', 0x0) r2 = open(&(0x7f0000000140)='./bus\x00', 0x0, 0x0) mmap(&(0x7f0000001000/0x4000)=nil, 0x4000, 0x0, 0x11, r2, 0x0) fcntl$setstatus(r1, 0x4, 0x44040) io_setup(0x2, &(0x7f00000004c0)=0x0) io_submit(r3, 0x1, &(0x7f0000000540)=[&(0x7f00000000c0)={0x0, 0x0, 0x0, 0x0, 0x0, r1, &(0x7f0000000000), 0x10000}]) 14:09:30 executing program 1: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f0000000040)={0xa, 0x4e22}, 0x1c) listen(r0, 0xeb) ioctl$UI_SET_PHYS(0xffffffffffffffff, 0x4008556c, 0x0) setsockopt$inet6_tcp_TLS_TX(0xffffffffffffffff, 0x6, 0x1, 0x0, 0x0) sendto$inet6(0xffffffffffffffff, 0x0, 0x0, 0x20000004, &(0x7f0000000140)={0xa, 0x4e22}, 0x1c) readv(0xffffffffffffffff, &(0x7f0000000700)=[{&(0x7f0000000440)=""/132, 0x31}], 0x1) prctl$PR_MCE_KILL_GET(0x22) timerfd_create(0x0, 0x0) r1 = accept4(r0, 0x0, 0x0, 0x0) socket$inet6_udplite(0xa, 0x2, 0x88) setsockopt$packet_fanout(0xffffffffffffffff, 0x107, 0x12, 0x0, 0x309) ioctl$FICLONE(0xffffffffffffffff, 0x40049409, 0xffffffffffffffff) ioctl$EXT4_IOC_GROUP_EXTEND(0xffffffffffffffff, 0x40046607, 0x0) ioctl$PPPIOCGFLAGS1(0xffffffffffffffff, 0x8004745a, 0x0) dup(0xffffffffffffffff) shutdown(0xffffffffffffffff, 0x1) setsockopt(0xffffffffffffffff, 0x0, 0x1, &(0x7f0000000000)="1d", 0x1) sendto$inet6(r1, &(0x7f0000000300)='A', 0x1, 0x0, 0x0, 0x0) 14:09:30 executing program 2: 14:09:30 executing program 2: 14:09:30 executing program 4: 14:09:30 executing program 2: 14:09:30 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") r1 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x1000)=nil, 0x1000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000300), 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000180)={0x18, 0x0, &(0x7f00000006c0)=[@increfs, @clear_death], 0x0, 0x0, 0x0}) 14:09:31 executing program 2: [ 191.025797] binder: 4865:4869 BC_CLEAR_DEATH_NOTIFICATION death notification not active 14:09:31 executing program 4: [ 191.099232] binder: 4881:4885 BC_CLEAR_DEATH_NOTIFICATION death notification not active 14:09:33 executing program 0: clone(0x802102001ffe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x38) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$cont(0x9, r0, 0x0, 0x0) 14:09:33 executing program 5: r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000200)='./cgroup\x00\f#\x9f\xd0\x85\xac\xc4\x9b\x81-\xb3\xd7=C\xea', 0x200002, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000180)='./bus\x00', 0x0) r2 = open(&(0x7f0000000140)='./bus\x00', 0x0, 0x0) mmap(&(0x7f0000001000/0x4000)=nil, 0x4000, 0x0, 0x11, r2, 0x0) fcntl$setstatus(r1, 0x4, 0x44040) io_setup(0x2, &(0x7f00000004c0)=0x0) io_submit(r3, 0x1, &(0x7f0000000540)=[&(0x7f00000000c0)={0x0, 0x0, 0x0, 0x0, 0x0, r1, &(0x7f0000000000), 0x10000}]) 14:09:33 executing program 4: 14:09:33 executing program 2: 14:09:33 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") r1 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x1000)=nil, 0x1000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000300), 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000180)={0x18, 0x0, &(0x7f00000006c0)=[@increfs, @clear_death], 0x0, 0x0, 0x0}) 14:09:33 executing program 1: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f0000000040)={0xa, 0x4e22}, 0x1c) listen(r0, 0xeb) ioctl$UI_SET_PHYS(0xffffffffffffffff, 0x4008556c, 0x0) setsockopt$inet6_tcp_TLS_TX(0xffffffffffffffff, 0x6, 0x1, 0x0, 0x0) sendto$inet6(0xffffffffffffffff, 0x0, 0x0, 0x20000004, &(0x7f0000000140)={0xa, 0x4e22}, 0x1c) readv(0xffffffffffffffff, &(0x7f0000000700)=[{&(0x7f0000000440)=""/132, 0x31}], 0x1) prctl$PR_MCE_KILL_GET(0x22) timerfd_create(0x0, 0x0) r1 = accept4(r0, 0x0, 0x0, 0x0) socket$inet6_udplite(0xa, 0x2, 0x88) setsockopt$packet_fanout(0xffffffffffffffff, 0x107, 0x12, 0x0, 0x309) ioctl$FICLONE(0xffffffffffffffff, 0x40049409, 0xffffffffffffffff) ioctl$EXT4_IOC_GROUP_EXTEND(0xffffffffffffffff, 0x40046607, 0x0) ioctl$PPPIOCGFLAGS1(0xffffffffffffffff, 0x8004745a, 0x0) dup(0xffffffffffffffff) shutdown(0xffffffffffffffff, 0x1) setsockopt(0xffffffffffffffff, 0x0, 0x1, &(0x7f0000000000)="1d", 0x1) sendto$inet6(r1, &(0x7f0000000300)='A', 0x1, 0x0, 0x0, 0x0) 14:09:34 executing program 4: 14:09:34 executing program 2: 14:09:34 executing program 2: 14:09:34 executing program 4: 14:09:34 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") r1 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x1000)=nil, 0x1000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000180)={0x18, 0x0, &(0x7f00000006c0)=[@increfs, @clear_death], 0x0, 0x0, 0x0}) 14:09:34 executing program 5: r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000200)='./cgroup\x00\f#\x9f\xd0\x85\xac\xc4\x9b\x81-\xb3\xd7=C\xea', 0x200002, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000180)='./bus\x00', 0x0) r2 = open(&(0x7f0000000140)='./bus\x00', 0x0, 0x0) mmap(&(0x7f0000001000/0x4000)=nil, 0x4000, 0x0, 0x11, r2, 0x0) fcntl$setstatus(r1, 0x4, 0x44040) io_setup(0x2, &(0x7f00000004c0)=0x0) io_submit(r3, 0x1, &(0x7f0000000540)=[&(0x7f00000000c0)={0x0, 0x0, 0x0, 0x0, 0x0, r1, &(0x7f0000000000), 0x10000}]) [ 194.126434] binder: 4894:4904 BC_CLEAR_DEATH_NOTIFICATION death notification not active 14:09:34 executing program 0: clone(0x802102001ffe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x38) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$cont(0x9, r0, 0x0, 0x0) 14:09:34 executing program 2: 14:09:34 executing program 4: 14:09:34 executing program 2: 14:09:34 executing program 4: [ 194.237738] binder: 4915:4920 got transaction with invalid offset (0, min 0 max 0) or object. [ 194.277842] binder: 4915:4920 transaction failed 29201/-22, size 0-8 line 3199 [ 194.288371] binder: 4915:4929 BC_CLEAR_DEATH_NOTIFICATION death notification not active [ 194.321558] binder: undelivered TRANSACTION_ERROR: 29201 14:09:34 executing program 1: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f0000000040)={0xa, 0x4e22}, 0x1c) listen(r0, 0xeb) ioctl$UI_SET_PHYS(0xffffffffffffffff, 0x4008556c, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) sendto$inet6(r1, 0x0, 0x0, 0x20000004, &(0x7f0000000140)={0xa, 0x4e22}, 0x1c) readv(r1, &(0x7f0000000700)=[{&(0x7f0000000440)=""/132, 0x31}], 0x1) prctl$PR_MCE_KILL_GET(0x22) timerfd_create(0x0, 0x0) r2 = accept4(r0, 0x0, 0x0, 0x0) socket$inet6_udplite(0xa, 0x2, 0x88) setsockopt$packet_fanout(0xffffffffffffffff, 0x107, 0x12, 0x0, 0x309) ioctl$FICLONE(0xffffffffffffffff, 0x40049409, 0xffffffffffffffff) ioctl$EXT4_IOC_GROUP_EXTEND(0xffffffffffffffff, 0x40046607, 0x0) ioctl$PPPIOCGFLAGS1(0xffffffffffffffff, 0x8004745a, 0x0) dup(0xffffffffffffffff) shutdown(r1, 0x1) setsockopt(r1, 0x0, 0x1, &(0x7f0000000000)="1d", 0x1) sendto$inet6(r2, &(0x7f0000000300)='A', 0x1, 0x0, 0x0, 0x0) 14:09:34 executing program 2: 14:09:34 executing program 4: 14:09:34 executing program 5: r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000200)='./cgroup\x00\f#\x9f\xd0\x85\xac\xc4\x9b\x81-\xb3\xd7=C\xea', 0x200002, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000180)='./bus\x00', 0x0) r2 = open(&(0x7f0000000140)='./bus\x00', 0x0, 0x0) mmap(&(0x7f0000001000/0x4000)=nil, 0x4000, 0x0, 0x11, r2, 0x0) fcntl$setstatus(r1, 0x4, 0x44040) io_setup(0x2, &(0x7f00000004c0)=0x0) io_submit(r3, 0x1, &(0x7f0000000540)=[&(0x7f00000000c0)={0x0, 0x0, 0x0, 0x1, 0x0, 0xffffffffffffffff, &(0x7f0000000000), 0x10000}]) 14:09:34 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") r1 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x1000)=nil, 0x1000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000180)={0x18, 0x0, &(0x7f00000006c0)=[@increfs, @clear_death], 0x0, 0x0, 0x0}) 14:09:34 executing program 2: 14:09:34 executing program 4: [ 194.944701] binder: 4934:4940 got transaction with invalid offset (0, min 0 max 0) or object. [ 194.978070] binder: 4934:4940 transaction failed 29201/-22, size 0-8 line 3199 [ 195.010900] binder: 4934:4947 BC_CLEAR_DEATH_NOTIFICATION death notification not active [ 195.034657] binder: undelivered TRANSACTION_ERROR: 29201 14:09:37 executing program 0: clone(0x802102001ffe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x38) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$cont(0x18, r0, 0x0, 0x2) ptrace$cont(0xffffffffffffffff, r0, 0x0, 0x0) 14:09:37 executing program 4: 14:09:37 executing program 2: 14:09:37 executing program 5: r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000200)='./cgroup\x00\f#\x9f\xd0\x85\xac\xc4\x9b\x81-\xb3\xd7=C\xea', 0x200002, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000180)='./bus\x00', 0x0) r2 = open(&(0x7f0000000140)='./bus\x00', 0x0, 0x0) mmap(&(0x7f0000001000/0x4000)=nil, 0x4000, 0x0, 0x11, r2, 0x0) fcntl$setstatus(r1, 0x4, 0x44040) io_setup(0x2, &(0x7f00000004c0)=0x0) io_submit(r3, 0x1, &(0x7f0000000540)=[&(0x7f00000000c0)={0x0, 0x0, 0x0, 0x1, 0x0, 0xffffffffffffffff, &(0x7f0000000000), 0x10000}]) 14:09:37 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") r1 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x1000)=nil, 0x1000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000180)={0x18, 0x0, &(0x7f00000006c0)=[@increfs, @clear_death], 0x0, 0x0, 0x0}) 14:09:37 executing program 1: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f0000000040)={0xa, 0x4e22}, 0x1c) listen(r0, 0xeb) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) sendto$inet6(r1, 0x0, 0x0, 0x20000004, &(0x7f0000000140)={0xa, 0x4e22}, 0x1c) readv(r1, &(0x7f0000000700)=[{&(0x7f0000000440)=""/132, 0x31}], 0x1) prctl$PR_MCE_KILL_GET(0x22) timerfd_create(0x0, 0x0) r2 = accept4(r0, 0x0, 0x0, 0x0) socket$inet6_udplite(0xa, 0x2, 0x88) setsockopt$packet_fanout(0xffffffffffffffff, 0x107, 0x12, 0x0, 0x309) ioctl$FICLONE(0xffffffffffffffff, 0x40049409, 0xffffffffffffffff) ioctl$EXT4_IOC_GROUP_EXTEND(0xffffffffffffffff, 0x40046607, 0x0) ioctl$PPPIOCGFLAGS1(0xffffffffffffffff, 0x8004745a, 0x0) dup(0xffffffffffffffff) shutdown(r1, 0x1) setsockopt(r1, 0x0, 0x1, &(0x7f0000000000)="1d", 0x1) sendto$inet6(r2, &(0x7f0000000300)='A', 0x1, 0x0, 0x0, 0x0) 14:09:37 executing program 4: 14:09:37 executing program 2: 14:09:37 executing program 4: [ 197.255645] binder: 4959:4961 got transaction with invalid offset (0, min 0 max 0) or object. 14:09:37 executing program 2: 14:09:37 executing program 5: r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000200)='./cgroup\x00\f#\x9f\xd0\x85\xac\xc4\x9b\x81-\xb3\xd7=C\xea', 0x200002, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000180)='./bus\x00', 0x0) r2 = open(&(0x7f0000000140)='./bus\x00', 0x0, 0x0) mmap(&(0x7f0000001000/0x4000)=nil, 0x4000, 0x0, 0x11, r2, 0x0) fcntl$setstatus(r1, 0x4, 0x44040) io_setup(0x2, &(0x7f00000004c0)=0x0) io_submit(r3, 0x1, &(0x7f0000000540)=[&(0x7f00000000c0)={0x0, 0x0, 0x0, 0x1, 0x0, 0xffffffffffffffff, &(0x7f0000000000), 0x10000}]) 14:09:37 executing program 0: clone(0x802102001ffe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x38) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$cont(0x18, r0, 0x0, 0x2) ptrace$cont(0xffffffffffffffff, r0, 0x0, 0x0) 14:09:37 executing program 2: [ 197.298208] binder: 4959:4961 transaction failed 29201/-22, size 0-8 line 3199 [ 197.312113] binder: 4959:4971 BC_CLEAR_DEATH_NOTIFICATION death notification not active 14:09:37 executing program 4: 14:09:37 executing program 2: 14:09:37 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") r1 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x1000)=nil, 0x1000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, &(0x7f0000000200), &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000180)={0x18, 0x0, &(0x7f00000006c0)=[@increfs, @clear_death], 0x0, 0x0, 0x0}) 14:09:37 executing program 2: [ 197.395552] binder: undelivered TRANSACTION_ERROR: 29201 14:09:37 executing program 1: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f0000000040)={0xa, 0x4e22}, 0x1c) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) sendto$inet6(r1, 0x0, 0x0, 0x20000004, &(0x7f0000000140)={0xa, 0x4e22}, 0x1c) readv(r1, &(0x7f0000000700)=[{&(0x7f0000000440)=""/132, 0x31}], 0x1) prctl$PR_MCE_KILL_GET(0x22) timerfd_create(0x0, 0x0) r2 = accept4(r0, 0x0, 0x0, 0x0) socket$inet6_udplite(0xa, 0x2, 0x88) setsockopt$packet_fanout(0xffffffffffffffff, 0x107, 0x12, 0x0, 0x309) ioctl$FICLONE(0xffffffffffffffff, 0x40049409, 0xffffffffffffffff) ioctl$EXT4_IOC_GROUP_EXTEND(0xffffffffffffffff, 0x40046607, 0x0) ioctl$PPPIOCGFLAGS1(0xffffffffffffffff, 0x8004745a, 0x0) dup(0xffffffffffffffff) shutdown(r1, 0x1) setsockopt(r1, 0x0, 0x1, &(0x7f0000000000)="1d", 0x1) sendto$inet6(r2, &(0x7f0000000300)='A', 0x1, 0x0, 0x0, 0x0) 14:09:37 executing program 5: r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000200)='./cgroup\x00\f#\x9f\xd0\x85\xac\xc4\x9b\x81-\xb3\xd7=C\xea', 0x200002, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000180)='./bus\x00', 0x0) r2 = open(&(0x7f0000000140)='./bus\x00', 0x0, 0x0) mmap(&(0x7f0000001000/0x4000)=nil, 0x4000, 0x0, 0x11, r2, 0x0) fcntl$setstatus(r1, 0x4, 0x44040) io_setup(0x2, &(0x7f00000004c0)=0x0) io_submit(r3, 0x1, &(0x7f0000000540)=[&(0x7f00000000c0)={0x0, 0x0, 0x0, 0x1, 0x0, r1, 0x0}]) 14:09:37 executing program 4: 14:09:37 executing program 2: 14:09:37 executing program 4: [ 197.484273] binder: 4991:4994 got transaction with invalid offset (0, min 0 max 0) or object. [ 197.518904] binder: 4991:4994 transaction failed 29201/-22, size 0-8 line 3199 14:09:37 executing program 5: r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000200)='./cgroup\x00\f#\x9f\xd0\x85\xac\xc4\x9b\x81-\xb3\xd7=C\xea', 0x200002, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000180)='./bus\x00', 0x0) r2 = open(&(0x7f0000000140)='./bus\x00', 0x0, 0x0) mmap(&(0x7f0000001000/0x4000)=nil, 0x4000, 0x0, 0x11, r2, 0x0) fcntl$setstatus(r1, 0x4, 0x44040) io_setup(0x2, &(0x7f00000004c0)=0x0) io_submit(r3, 0x1, &(0x7f0000000540)=[&(0x7f00000000c0)={0x0, 0x0, 0x0, 0x1, 0x0, r1, 0x0}]) [ 197.539931] binder: 4991:5001 BC_CLEAR_DEATH_NOTIFICATION death notification not active [ 197.589178] binder: undelivered TRANSACTION_ERROR: 29201 14:09:40 executing program 0: clone(0x802102001ffe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x38) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$cont(0x18, r0, 0x0, 0x2) ptrace$cont(0xffffffffffffffff, r0, 0x0, 0x0) 14:09:40 executing program 1: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f0000000040)={0xa, 0x4e22}, 0x1c) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) sendto$inet6(r1, 0x0, 0x0, 0x20000004, &(0x7f0000000140)={0xa, 0x4e22}, 0x1c) readv(r1, &(0x7f0000000700)=[{&(0x7f0000000440)=""/132, 0x31}], 0x1) prctl$PR_MCE_KILL_GET(0x22) timerfd_create(0x0, 0x0) r2 = accept4(r0, 0x0, 0x0, 0x0) socket$inet6_udplite(0xa, 0x2, 0x88) setsockopt$packet_fanout(0xffffffffffffffff, 0x107, 0x12, 0x0, 0x309) ioctl$FICLONE(0xffffffffffffffff, 0x40049409, 0xffffffffffffffff) ioctl$EXT4_IOC_GROUP_EXTEND(0xffffffffffffffff, 0x40046607, 0x0) ioctl$PPPIOCGFLAGS1(0xffffffffffffffff, 0x8004745a, 0x0) dup(0xffffffffffffffff) shutdown(r1, 0x1) setsockopt(r1, 0x0, 0x1, &(0x7f0000000000)="1d", 0x1) sendto$inet6(r2, &(0x7f0000000300)='A', 0x1, 0x0, 0x0, 0x0) 14:09:40 executing program 2: 14:09:40 executing program 4: 14:09:40 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") r1 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x1000)=nil, 0x1000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, &(0x7f0000000200), &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000180)={0x18, 0x0, &(0x7f00000006c0)=[@increfs, @clear_death], 0x0, 0x0, 0x0}) 14:09:40 executing program 5: r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000200)='./cgroup\x00\f#\x9f\xd0\x85\xac\xc4\x9b\x81-\xb3\xd7=C\xea', 0x200002, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000180)='./bus\x00', 0x0) r2 = open(&(0x7f0000000140)='./bus\x00', 0x0, 0x0) mmap(&(0x7f0000001000/0x4000)=nil, 0x4000, 0x0, 0x11, r2, 0x0) fcntl$setstatus(r1, 0x4, 0x44040) io_setup(0x2, &(0x7f00000004c0)=0x0) io_submit(r3, 0x1, &(0x7f0000000540)=[&(0x7f00000000c0)={0x0, 0x0, 0x0, 0x1, 0x0, r1, 0x0}]) 14:09:40 executing program 4: 14:09:40 executing program 2: 14:09:40 executing program 1: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f0000000040)={0xa, 0x4e22}, 0x1c) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) sendto$inet6(r1, 0x0, 0x0, 0x20000004, &(0x7f0000000140)={0xa, 0x4e22}, 0x1c) readv(r1, &(0x7f0000000700)=[{&(0x7f0000000440)=""/132, 0x31}], 0x1) prctl$PR_MCE_KILL_GET(0x22) timerfd_create(0x0, 0x0) r2 = accept4(r0, 0x0, 0x0, 0x0) socket$inet6_udplite(0xa, 0x2, 0x88) setsockopt$packet_fanout(0xffffffffffffffff, 0x107, 0x12, 0x0, 0x309) ioctl$FICLONE(0xffffffffffffffff, 0x40049409, 0xffffffffffffffff) ioctl$EXT4_IOC_GROUP_EXTEND(0xffffffffffffffff, 0x40046607, 0x0) ioctl$PPPIOCGFLAGS1(0xffffffffffffffff, 0x8004745a, 0x0) dup(0xffffffffffffffff) shutdown(r1, 0x1) setsockopt(r1, 0x0, 0x1, &(0x7f0000000000)="1d", 0x1) sendto$inet6(r2, &(0x7f0000000300)='A', 0x1, 0x0, 0x0, 0x0) [ 200.384687] binder: 5013:5017 got transaction with invalid offset (0, min 0 max 0) or object. 14:09:40 executing program 2: [ 200.438851] binder: 5013:5023 BC_CLEAR_DEATH_NOTIFICATION death notification not active [ 200.452016] binder: 5013:5017 transaction failed 29201/-22, size 0-8 line 3199 14:09:40 executing program 4: 14:09:40 executing program 1: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) listen(r0, 0xeb) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) sendto$inet6(r1, 0x0, 0x0, 0x20000004, &(0x7f0000000140)={0xa, 0x4e22}, 0x1c) readv(r1, &(0x7f0000000700)=[{&(0x7f0000000440)=""/132, 0x31}], 0x1) prctl$PR_MCE_KILL_GET(0x22) timerfd_create(0x0, 0x0) r2 = accept4(r0, 0x0, 0x0, 0x0) socket$inet6_udplite(0xa, 0x2, 0x88) setsockopt$packet_fanout(0xffffffffffffffff, 0x107, 0x12, 0x0, 0x309) ioctl$FICLONE(0xffffffffffffffff, 0x40049409, 0xffffffffffffffff) ioctl$EXT4_IOC_GROUP_EXTEND(0xffffffffffffffff, 0x40046607, 0x0) ioctl$PPPIOCGFLAGS1(0xffffffffffffffff, 0x8004745a, 0x0) dup(0xffffffffffffffff) shutdown(r1, 0x1) setsockopt(r1, 0x0, 0x1, &(0x7f0000000000)="1d", 0x1) sendto$inet6(r2, &(0x7f0000000300)='A', 0x1, 0x0, 0x0, 0x0) [ 200.514071] binder: undelivered TRANSACTION_ERROR: 29201 14:09:43 executing program 0: clone(0x802102001ffe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x38) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$cont(0x18, r0, 0x0, 0x2) ptrace$cont(0x9, 0x0, 0x0, 0x0) 14:09:43 executing program 2: 14:09:43 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") r1 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x1000)=nil, 0x1000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, &(0x7f0000000200), &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000180)={0x18, 0x0, &(0x7f00000006c0)=[@increfs, @clear_death], 0x0, 0x0, 0x0}) 14:09:43 executing program 4: r0 = socket$inet(0x10, 0x3, 0x0) sendmsg(r0, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000600)=[{&(0x7f0000000140)="24000000200007031dfffd946f610500020000001f00000000000800080011000400ff7e", 0x24}], 0x1}, 0x0) 14:09:43 executing program 5: 14:09:43 executing program 1: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) listen(r0, 0xeb) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) sendto$inet6(r1, 0x0, 0x0, 0x20000004, &(0x7f0000000140)={0xa, 0x4e22}, 0x1c) readv(r1, &(0x7f0000000700)=[{&(0x7f0000000440)=""/132, 0x31}], 0x1) prctl$PR_MCE_KILL_GET(0x22) timerfd_create(0x0, 0x0) r2 = accept4(r0, 0x0, 0x0, 0x0) socket$inet6_udplite(0xa, 0x2, 0x88) setsockopt$packet_fanout(0xffffffffffffffff, 0x107, 0x12, 0x0, 0x309) ioctl$FICLONE(0xffffffffffffffff, 0x40049409, 0xffffffffffffffff) ioctl$EXT4_IOC_GROUP_EXTEND(0xffffffffffffffff, 0x40046607, 0x0) ioctl$PPPIOCGFLAGS1(0xffffffffffffffff, 0x8004745a, 0x0) dup(0xffffffffffffffff) shutdown(r1, 0x1) setsockopt(r1, 0x0, 0x1, &(0x7f0000000000)="1d", 0x1) sendto$inet6(r2, &(0x7f0000000300)='A', 0x1, 0x0, 0x0, 0x0) 14:09:43 executing program 4: r0 = socket$inet(0x10, 0x3, 0x0) sendmsg(r0, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000600)=[{&(0x7f0000000140)="24000000200007031dfffd946f610500020000001f00000000000800080011000400ff7e", 0x24}], 0x1}, 0x0) 14:09:43 executing program 2: 14:09:43 executing program 5: 14:09:43 executing program 5: 14:09:43 executing program 2: [ 203.486351] binder: 5042:5047 got transaction with invalid offset (0, min 0 max 0) or object. [ 203.524744] binder: 5042:5047 transaction failed 29201/-22, size 0-8 line 3199 14:09:43 executing program 4: mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000080)='tmpfs\x00', 0x0, 0x0) perf_event_open(&(0x7f0000940000)={0x2, 0x70, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) pivot_root(&(0x7f0000000180)='./file0/../file0\x00', &(0x7f0000000540)='./file0\x00') [ 203.558120] binder: 5042:5062 BC_CLEAR_DEATH_NOTIFICATION death notification not active [ 203.588469] binder: undelivered TRANSACTION_ERROR: 29201 14:09:46 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") r1 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x1000)=nil, 0x1000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat], &(0x7f0000000240)=[0x0]}}], 0xfffffd49, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000180)={0x18, 0x0, &(0x7f00000006c0)=[@increfs, @clear_death], 0x0, 0x0, 0x0}) 14:09:46 executing program 0: clone(0x802102001ffe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x38) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$cont(0x18, r0, 0x0, 0x2) ptrace$cont(0x9, 0x0, 0x0, 0x0) 14:09:46 executing program 5: clone(0x2000000c00ffff, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() futex(&(0x7f0000000000)=0x2, 0x0, 0x40000000002, 0x0, 0x0, 0x0) clone(0x2102801ff7, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) ptrace$setopts(0x4206, r0, 0x0, 0x0) 14:09:46 executing program 2: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000040)={0x0, 0xfecb}}, 0x0) sendmsg$key(0xffffffffffffffff, &(0x7f00000001c0)={0x40000000, 0x0, &(0x7f0000000040)={&(0x7f0000001540)=ANY=[@ANYBLOB="02030609100000000000004c9e0000000200aa0802010000000000000000000105000600200000100a000000000000000b4700e50000070000001f00000000e5002500000000000002000100000000be000000220000627c05000500000000000a00000000731f65000080ff170000000000f690b9a7008807a4cbadbed30200402f93cc72b9c7205f9ef6bcaa5aa1e46cc1c00db8658baef28f8fcbdce4d10e77421818207dd5becbbd90d6bb3b6c3d893c404159132d127e6d4e2ef192ae8b77ff1aa41a480fba89f45c"], 0xcb}}, 0x0) sendmsg$key(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000001440)=ANY=[@ANYBLOB="020a000e07000000000000000000de0005001a00000001f4031727fbb0fde70100000001530b0000000000ffffac1414b206000102000000728290475fe1e74525a6eafc0501001c6346c2f503b9f39d751cb8a846066c1da0fe912bf9ffa17ea4987ccb978202535b079cce0134c3021b06739583bf3145159e039a7b6c0583b454a60bd166326b36e679ce00425366257151927f1024ee6ad23ba735d9f5fcaba7f33dafdb250e732804a4ac19fa6861b4f714e6e346fe40619d61f5cd94f685955158"], 0xc4}}, 0x0) sendmmsg(r0, &(0x7f0000000180), 0x4000432, 0x0) 14:09:46 executing program 4: creat(&(0x7f0000000000)='./file0\x00', 0x0) clone(0x0, 0x0, 0x0, 0x0, 0x0) truncate(&(0x7f0000000140)='./file0\x00', 0x0) 14:09:46 executing program 1: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) listen(r0, 0xeb) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) sendto$inet6(r1, 0x0, 0x0, 0x20000004, &(0x7f0000000140)={0xa, 0x4e22}, 0x1c) readv(r1, &(0x7f0000000700)=[{&(0x7f0000000440)=""/132, 0x31}], 0x1) prctl$PR_MCE_KILL_GET(0x22) timerfd_create(0x0, 0x0) r2 = accept4(r0, 0x0, 0x0, 0x0) socket$inet6_udplite(0xa, 0x2, 0x88) setsockopt$packet_fanout(0xffffffffffffffff, 0x107, 0x12, 0x0, 0x309) ioctl$FICLONE(0xffffffffffffffff, 0x40049409, 0xffffffffffffffff) ioctl$EXT4_IOC_GROUP_EXTEND(0xffffffffffffffff, 0x40046607, 0x0) ioctl$PPPIOCGFLAGS1(0xffffffffffffffff, 0x8004745a, 0x0) dup(0xffffffffffffffff) shutdown(r1, 0x1) setsockopt(r1, 0x0, 0x1, &(0x7f0000000000)="1d", 0x1) sendto$inet6(r2, &(0x7f0000000300)='A', 0x1, 0x0, 0x0, 0x0) 14:09:46 executing program 4: creat(&(0x7f0000000000)='./file0\x00', 0x0) clone(0x0, 0x0, 0x0, 0x0, 0x0) truncate(&(0x7f0000000140)='./file0\x00', 0x0) [ 206.529127] binder: 5075:5080 got transaction with invalid offset (0, min 0 max 24) or object. [ 206.555934] binder: 5075:5080 transaction failed 29201/-22, size 24-8 line 3199 [ 206.563687] binder: 5075:5080 ioctl c0306201 20000440 returned -14 14:09:46 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") r1 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x1000)=nil, 0x1000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat], &(0x7f0000000240)=[0x0]}}], 0xfffffd49, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000180)={0x18, 0x0, &(0x7f00000006c0)=[@increfs, @clear_death], 0x0, 0x0, 0x0}) 14:09:46 executing program 2: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") r1 = syz_open_dev$loop(&(0x7f0000000100)='/dev/loop#\x00', 0x0, 0x105082) r2 = memfd_create(&(0x7f00000001c0)='\x00\x00\x00\x00\x8c\x00'/15, 0x0) pwritev(r2, &(0x7f0000000000)=[{&(0x7f00000000c0)="b8", 0x1}], 0x1, 0x0) fcntl$getflags(r1, 0x4) sendfile(r1, r2, 0x0, 0x80003) 14:09:46 executing program 4: creat(&(0x7f0000000000)='./file0\x00', 0x0) clone(0x0, 0x0, 0x0, 0x0, 0x0) truncate(&(0x7f0000000140)='./file0\x00', 0x0) [ 206.571925] binder: 5075:5080 BC_CLEAR_DEATH_NOTIFICATION death notification not active [ 206.581151] binder: undelivered TRANSACTION_ERROR: 29201 14:09:46 executing program 2: r0 = syz_open_dev$loop(&(0x7f0000000100)='/dev/loop#\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0xff7000)=nil, 0xff7000, 0x0, 0x2000000000071, 0xffffffffffffffff, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$LOOP_GET_STATUS64(r1, 0x4c05, &(0x7f0000000380)) [ 206.653838] binder: 5102:5103 got transaction with invalid offset (0, min 0 max 24) or object. [ 206.674261] binder: 5102:5103 transaction failed 29201/-22, size 24-8 line 3199 14:09:46 executing program 2: r0 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r0, &(0x7f0000000000)={0xa, 0x0, 0x0, @ipv4={[], [], @dev={0xac, 0x14, 0x14, 0x15}}}, 0x1c) connect$inet6(r0, &(0x7f00000001c0)={0xa, 0x0, 0x0, @remote, 0x3}, 0x1c) 14:09:46 executing program 4: creat(&(0x7f0000000000)='./file0\x00', 0x0) clone(0x0, 0x0, 0x0, 0x0, 0x0) truncate(&(0x7f0000000140)='./file0\x00', 0x0) [ 206.701995] binder: 5102:5115 BC_CLEAR_DEATH_NOTIFICATION death notification not active [ 206.703159] binder: 5102:5103 ioctl c0306201 20000440 returned -14 [ 206.753992] binder: undelivered TRANSACTION_ERROR: 29201 14:09:49 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") r1 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x1000)=nil, 0x1000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat], &(0x7f0000000240)=[0x0]}}], 0xfffffd49, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000180)={0x18, 0x0, &(0x7f00000006c0)=[@increfs, @clear_death], 0x0, 0x0, 0x0}) 14:09:49 executing program 5: r0 = socket$packet(0x11, 0x2, 0x300) setsockopt$SO_ATTACH_FILTER(r0, 0x1, 0x1a, &(0x7f0000fbe000)={0x2, &(0x7f0000000000)=[{0x28, 0x0, 0x0, 0xd34}, {0x80000006}]}, 0x10) syz_emit_ethernet(0x11, &(0x7f0000000240)={@link_local, @local, [], {@mpls_uc={0x8847, {[], @llc={@llc={0x0, 0x0, "f6"}}}}}}, 0x0) 14:09:49 executing program 4: creat(&(0x7f0000000000)='./file0\x00', 0x0) truncate(&(0x7f0000000140)='./file0\x00', 0x0) 14:09:49 executing program 2: perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f000001a000)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$SO_ATTACH_FILTER(r1, 0x1, 0x1a, &(0x7f0000000140)={0x2, &(0x7f0000000000)=[{0x2000000000048}, {0x6}]}, 0x10) sendmmsg(r0, &(0x7f0000003040), 0x253b03d5cf168c, 0x0) 14:09:49 executing program 0: clone(0x802102001ffe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x38) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$cont(0x18, r0, 0x0, 0x2) ptrace$cont(0x9, 0x0, 0x0, 0x0) 14:09:49 executing program 1: bind$inet6(0xffffffffffffffff, &(0x7f0000000040)={0xa, 0x4e22}, 0x1c) listen(0xffffffffffffffff, 0xeb) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) sendto$inet6(r0, 0x0, 0x0, 0x20000004, &(0x7f0000000140)={0xa, 0x4e22}, 0x1c) readv(r0, &(0x7f0000000700)=[{&(0x7f0000000440)=""/132, 0x31}], 0x1) prctl$PR_MCE_KILL_GET(0x22) timerfd_create(0x0, 0x0) r1 = accept4(0xffffffffffffffff, 0x0, 0x0, 0x0) socket$inet6_udplite(0xa, 0x2, 0x88) setsockopt$packet_fanout(0xffffffffffffffff, 0x107, 0x12, 0x0, 0x309) ioctl$FICLONE(0xffffffffffffffff, 0x40049409, 0xffffffffffffffff) ioctl$EXT4_IOC_GROUP_EXTEND(0xffffffffffffffff, 0x40046607, 0x0) ioctl$PPPIOCGFLAGS1(0xffffffffffffffff, 0x8004745a, 0x0) dup(0xffffffffffffffff) shutdown(r0, 0x1) setsockopt(r0, 0x0, 0x1, &(0x7f0000000000)="1d", 0x1) sendto$inet6(r1, &(0x7f0000000300)='A', 0x1, 0x0, 0x0, 0x0) 14:09:49 executing program 1: bind$inet6(0xffffffffffffffff, &(0x7f0000000040)={0xa, 0x4e22}, 0x1c) listen(0xffffffffffffffff, 0xeb) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) sendto$inet6(r0, 0x0, 0x0, 0x20000004, &(0x7f0000000140)={0xa, 0x4e22}, 0x1c) readv(r0, &(0x7f0000000700)=[{&(0x7f0000000440)=""/132, 0x31}], 0x1) prctl$PR_MCE_KILL_GET(0x22) timerfd_create(0x0, 0x0) r1 = accept4(0xffffffffffffffff, 0x0, 0x0, 0x0) socket$inet6_udplite(0xa, 0x2, 0x88) setsockopt$packet_fanout(0xffffffffffffffff, 0x107, 0x12, 0x0, 0x309) ioctl$FICLONE(0xffffffffffffffff, 0x40049409, 0xffffffffffffffff) ioctl$EXT4_IOC_GROUP_EXTEND(0xffffffffffffffff, 0x40046607, 0x0) ioctl$PPPIOCGFLAGS1(0xffffffffffffffff, 0x8004745a, 0x0) dup(0xffffffffffffffff) shutdown(r0, 0x1) setsockopt(r0, 0x0, 0x1, &(0x7f0000000000)="1d", 0x1) sendto$inet6(r1, &(0x7f0000000300)='A', 0x1, 0x0, 0x0, 0x0) 14:09:49 executing program 4: creat(&(0x7f0000000000)='./file0\x00', 0x0) truncate(&(0x7f0000000140)='./file0\x00', 0x0) 14:09:49 executing program 4: creat(&(0x7f0000000000)='./file0\x00', 0x0) truncate(&(0x7f0000000140)='./file0\x00', 0x0) 14:09:49 executing program 1: bind$inet6(0xffffffffffffffff, &(0x7f0000000040)={0xa, 0x4e22}, 0x1c) listen(0xffffffffffffffff, 0xeb) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) sendto$inet6(r0, 0x0, 0x0, 0x20000004, &(0x7f0000000140)={0xa, 0x4e22}, 0x1c) readv(r0, &(0x7f0000000700)=[{&(0x7f0000000440)=""/132, 0x31}], 0x1) prctl$PR_MCE_KILL_GET(0x22) timerfd_create(0x0, 0x0) r1 = accept4(0xffffffffffffffff, 0x0, 0x0, 0x0) socket$inet6_udplite(0xa, 0x2, 0x88) setsockopt$packet_fanout(0xffffffffffffffff, 0x107, 0x12, 0x0, 0x309) ioctl$FICLONE(0xffffffffffffffff, 0x40049409, 0xffffffffffffffff) ioctl$EXT4_IOC_GROUP_EXTEND(0xffffffffffffffff, 0x40046607, 0x0) ioctl$PPPIOCGFLAGS1(0xffffffffffffffff, 0x8004745a, 0x0) dup(0xffffffffffffffff) shutdown(r0, 0x1) setsockopt(r0, 0x0, 0x1, &(0x7f0000000000)="1d", 0x1) sendto$inet6(r1, &(0x7f0000000300)='A', 0x1, 0x0, 0x0, 0x0) [ 209.541575] binder: 5134:5142 got transaction with invalid offset (0, min 0 max 24) or object. [ 209.577507] binder: 5134:5142 transaction failed 29201/-22, size 24-8 line 3199 14:09:49 executing program 5: perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f000001a000)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$SO_ATTACH_FILTER(r1, 0x1, 0x1a, &(0x7f0000000140)={0x2, &(0x7f0000000000)=[{0x2000000000048, 0x0, 0x0, 0x80000001}, {0x6}]}, 0x10) sendmmsg(r0, &(0x7f0000003040), 0x253b03d5cf168c, 0x0) 14:09:49 executing program 4: clone(0x0, 0x0, 0x0, 0x0, 0x0) truncate(&(0x7f0000000140)='./file0\x00', 0x0) [ 209.590153] binder: 5134:5157 BC_CLEAR_DEATH_NOTIFICATION death notification not active [ 209.610294] binder: 5134:5142 ioctl c0306201 20000440 returned -14 14:09:49 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") r1 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x1000)=nil, 0x1000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x0, &(0x7f0000000200)=[@flat={0x73622a85}], 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000180)={0x18, 0x0, &(0x7f00000006c0)=[@increfs, @clear_death], 0x0, 0x0, 0x0}) [ 209.650987] binder: undelivered TRANSACTION_ERROR: 29201 [ 209.678284] binder: 5171:5172 BC_CLEAR_DEATH_NOTIFICATION death notification not active [ 209.698745] binder: release 5171:5172 transaction 254 out, still active [ 209.711225] binder: undelivered TRANSACTION_COMPLETE [ 209.719474] binder: send failed reply for transaction 254, target dead 14:09:52 executing program 5: clone(0x7ffe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) exit_group(0x0) r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000180)='./cgroup\x00', 0x200002, 0x0) fchdir(r0) mount(0x0, &(0x7f0000000180)='./file0\x00', &(0x7f00000001c0)='devpts\x00', 0x0, 0x0) 14:09:52 executing program 1: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(0xffffffffffffffff, &(0x7f0000000040)={0xa, 0x4e22}, 0x1c) listen(r0, 0xeb) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) sendto$inet6(r1, 0x0, 0x0, 0x20000004, &(0x7f0000000140)={0xa, 0x4e22}, 0x1c) readv(r1, &(0x7f0000000700)=[{&(0x7f0000000440)=""/132, 0x31}], 0x1) prctl$PR_MCE_KILL_GET(0x22) timerfd_create(0x0, 0x0) r2 = accept4(r0, 0x0, 0x0, 0x0) socket$inet6_udplite(0xa, 0x2, 0x88) setsockopt$packet_fanout(0xffffffffffffffff, 0x107, 0x12, 0x0, 0x309) ioctl$FICLONE(0xffffffffffffffff, 0x40049409, 0xffffffffffffffff) ioctl$EXT4_IOC_GROUP_EXTEND(0xffffffffffffffff, 0x40046607, 0x0) ioctl$PPPIOCGFLAGS1(0xffffffffffffffff, 0x8004745a, 0x0) dup(0xffffffffffffffff) shutdown(r1, 0x1) setsockopt(r1, 0x0, 0x1, &(0x7f0000000000)="1d", 0x1) sendto$inet6(r2, &(0x7f0000000300)='A', 0x1, 0x0, 0x0, 0x0) 14:09:52 executing program 2: perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0xf7d, 0x8000000000001, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) clone(0x103, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) 14:09:52 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") r1 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x1000)=nil, 0x1000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x0, &(0x7f0000000200)=[@flat={0x73622a85}], 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000180)={0x18, 0x0, &(0x7f00000006c0)=[@increfs, @clear_death], 0x0, 0x0, 0x0}) 14:09:52 executing program 4: clone(0x0, 0x0, 0x0, 0x0, 0x0) truncate(&(0x7f0000000140)='./file0\x00', 0x0) 14:09:52 executing program 0: 14:09:52 executing program 2: 14:09:52 executing program 4: clone(0x0, 0x0, 0x0, 0x0, 0x0) truncate(&(0x7f0000000140)='./file0\x00', 0x0) 14:09:52 executing program 2: 14:09:52 executing program 0: 14:09:52 executing program 5: 14:09:52 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") r1 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x1000)=nil, 0x1000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x0, &(0x7f0000000200)=[@flat={0x73622a85}], 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000180)={0x18, 0x0, &(0x7f00000006c0)=[@increfs, @clear_death], 0x0, 0x0, 0x0}) 14:09:52 executing program 2: [ 212.565185] binder: 5185:5186 BC_CLEAR_DEATH_NOTIFICATION death notification not active [ 212.583476] binder: release 5185:5186 transaction 257 out, still active [ 212.604134] binder: undelivered TRANSACTION_COMPLETE [ 212.648442] binder: BINDER_SET_CONTEXT_MGR already set [ 212.668358] binder: 5205:5209 ioctl 40046207 0 returned -16 [ 212.673646] binder: send failed reply for transaction 257, target dead [ 212.691013] binder: 5205:5209 transaction failed 29189/-22, size 24-0 line 3014 [ 212.698880] binder: 5205:5209 IncRefs 0 refcount change on invalid ref 0 ret -22 [ 212.706638] binder: 5205:5209 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 [ 212.714642] binder: undelivered TRANSACTION_ERROR: 29189 14:09:53 executing program 1: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(0xffffffffffffffff, &(0x7f0000000040)={0xa, 0x4e22}, 0x1c) listen(r0, 0xeb) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) sendto$inet6(r1, 0x0, 0x0, 0x20000004, &(0x7f0000000140)={0xa, 0x4e22}, 0x1c) readv(r1, &(0x7f0000000700)=[{&(0x7f0000000440)=""/132, 0x31}], 0x1) prctl$PR_MCE_KILL_GET(0x22) timerfd_create(0x0, 0x0) r2 = accept4(r0, 0x0, 0x0, 0x0) socket$inet6_udplite(0xa, 0x2, 0x88) setsockopt$packet_fanout(0xffffffffffffffff, 0x107, 0x12, 0x0, 0x309) ioctl$FICLONE(0xffffffffffffffff, 0x40049409, 0xffffffffffffffff) ioctl$EXT4_IOC_GROUP_EXTEND(0xffffffffffffffff, 0x40046607, 0x0) ioctl$PPPIOCGFLAGS1(0xffffffffffffffff, 0x8004745a, 0x0) dup(0xffffffffffffffff) shutdown(r1, 0x1) setsockopt(r1, 0x0, 0x1, &(0x7f0000000000)="1d", 0x1) sendto$inet6(r2, &(0x7f0000000300)='A', 0x1, 0x0, 0x0, 0x0) 14:09:53 executing program 0: 14:09:53 executing program 5: 14:09:53 executing program 4: creat(0x0, 0x0) clone(0x0, 0x0, 0x0, 0x0, 0x0) truncate(&(0x7f0000000140)='./file0\x00', 0x0) 14:09:53 executing program 2: 14:09:53 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") r1 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x1000)=nil, 0x1000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x0, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000180)={0x18, 0x0, &(0x7f00000006c0)=[@increfs, @clear_death], 0x0, 0x0, 0x0}) 14:09:53 executing program 0: 14:09:53 executing program 2: 14:09:53 executing program 5: 14:09:53 executing program 0: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000006c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSSOFTCAR(r0, 0x541a, &(0x7f0000000180)) 14:09:53 executing program 2: r0 = syz_open_procfs(0x0, &(0x7f0000000000)='\x00\x16\x00\x00\x00\x00\x00\x00') getdents64(r0, &(0x7f00000001c0)=""/78, 0x29) getdents64(r0, &(0x7f0000000040)=""/241, 0xf1) 14:09:53 executing program 5: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) sendmmsg$unix(r0, &(0x7f00000bd000), 0x80, 0x0) r1 = memfd_create(&(0x7f0000000180)='\x06\x00\x00\x00^\x00\xac\xd8\xfd\xcc\xeeq\xe5\xf5\xcb\x801`\xe48\x85\xa4\xf5\xd0\x1b\\\x04\f\xf8F\\\xb4\xba\x8d\xef\x12d\xee\xa5?\x00kZ\x8b\x19h\xd7|\x14i\r\x18U9\xc1\xd7\x10\xf0G\x12\xa8\xbaa\xb2\x94|%n\x1e+\x9f\xbb\xb8\xac\x81\x8d\x93q\xd4\xd4z\xaaZ\x0f\xaa\xc7\x97#\xe5g l\xd55\x15\xbf\xfc\xf5\x83\xb72\x00Y\x15\x92\xb1\xb6a\xf4\xe9u\xb2\xe7\xeciy\b\xdb\xc7\xf1\x87\xc9\a\x91\x04J\xc8\x0e\xff|J\'Nxr\x00\xbc\xab5\x9b\x85>\x99\xcaz2\xabKI\xdc\xe4\x9f\xa5\xd0\x0ewm\xe7\xccK\xc9\x8b\x8bE\x89\x03\x00\x00\x00}@Ry\xa69^\xdc\x9d\xa0\x04\xdf \aelO7\xf1\xda\xcc\xa2x\xc2\x9a\xf5\x18F\xa0\x80M\xf9,+\xc9\xf7/nt\x9ba\x14\x1b\x18\xdd\x18X\xd2o\x15\x97L\xe6\xb5\xba\xc7\xf2W\n\x7f\x14ZIL:T\x1bd\x19\x8dE\x9c\xb1\xb9JK\x1do\x85\xe9\xa2\xca\x9cd\b\xc8\xbdiQ_L\xb0\xb9 \xf7/F\xfc\'M#,\x84M\xba\xa9\xa2yr\'?f\tb\xdai\xfd\x8c\x9aoj\x84\x03i\x8a|\xf7T;=p\xa2\x98f\xc7\xefu=\x96\xcb\x11\x91\xce\xce\xbev\xaa\xbb\xca\xfa\xa3\xde\xd5\x1f\xd7\x03:12\xf2\xfd\rN\x84=A\xae\x9b3\x81\xa9~\xb7\x80\xd1\xe2\xf6\xf2\xb8\xc9\x8a\xabC\xe2\xec\xb8,j\xe1\xbb\x1b\x1f@', 0x3) write$binfmt_misc(r1, &(0x7f0000000000)=ANY=[@ANYRES32], 0xff9e) sendfile(r0, r1, &(0x7f0000000040), 0xfffb) fcntl$addseals(r1, 0x409, 0x8) r2 = dup3(r0, r1, 0x0) shutdown(r0, 0x1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) [ 213.407827] binder: 5219:5223 BC_CLEAR_DEATH_NOTIFICATION death notification not active [ 213.435445] binder: release 5219:5223 transaction 261 out, still active [ 213.446086] binder: undelivered TRANSACTION_COMPLETE [ 213.463334] binder: send failed reply for transaction 261, target dead 14:09:54 executing program 1: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(0xffffffffffffffff, &(0x7f0000000040)={0xa, 0x4e22}, 0x1c) listen(r0, 0xeb) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) sendto$inet6(r1, 0x0, 0x0, 0x20000004, &(0x7f0000000140)={0xa, 0x4e22}, 0x1c) readv(r1, &(0x7f0000000700)=[{&(0x7f0000000440)=""/132, 0x31}], 0x1) prctl$PR_MCE_KILL_GET(0x22) timerfd_create(0x0, 0x0) r2 = accept4(r0, 0x0, 0x0, 0x0) socket$inet6_udplite(0xa, 0x2, 0x88) setsockopt$packet_fanout(0xffffffffffffffff, 0x107, 0x12, 0x0, 0x309) ioctl$FICLONE(0xffffffffffffffff, 0x40049409, 0xffffffffffffffff) ioctl$EXT4_IOC_GROUP_EXTEND(0xffffffffffffffff, 0x40046607, 0x0) ioctl$PPPIOCGFLAGS1(0xffffffffffffffff, 0x8004745a, 0x0) dup(0xffffffffffffffff) shutdown(r1, 0x1) setsockopt(r1, 0x0, 0x1, &(0x7f0000000000)="1d", 0x1) sendto$inet6(r2, &(0x7f0000000300)='A', 0x1, 0x0, 0x0, 0x0) 14:09:54 executing program 4: creat(0x0, 0x0) clone(0x0, 0x0, 0x0, 0x0, 0x0) truncate(&(0x7f0000000140)='./file0\x00', 0x0) 14:09:54 executing program 0: r0 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = open(&(0x7f0000000080)='./file0\x00', 0x2000000000008040, 0x0) fcntl$setsig(r1, 0xa, 0x11) fcntl$setlease(r1, 0x400, 0x0) truncate(&(0x7f00000000c0)='./file0\x00', 0x0) fcntl$setlease(r1, 0x400, 0x2) 14:09:54 executing program 2: r0 = syz_open_procfs(0x0, &(0x7f0000000000)='\x00\x16\x00\x00\x00\x00\x00\x00') getdents64(r0, &(0x7f00000001c0)=""/78, 0x29) getdents64(r0, &(0x7f0000000040)=""/241, 0xf1) 14:09:54 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") r1 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x1000)=nil, 0x1000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x0, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000180)={0x18, 0x0, &(0x7f00000006c0)=[@increfs, @clear_death], 0x0, 0x0, 0x0}) 14:09:54 executing program 5: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f00001fefe4)={0xa, 0x4e22, 0x0, @ipv4={[], [], @local}}, 0x1c) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$sock_int(r1, 0x1, 0xf, &(0x7f0000000000)=0x5, 0x4) bind$inet6(r1, &(0x7f00001fefe4)={0xa, 0x4e22, 0x0, @loopback}, 0x1c) listen(r1, 0x0) 14:09:54 executing program 2: r0 = syz_open_procfs(0x0, &(0x7f0000000000)='\x00\x16\x00\x00\x00\x00\x00\x00') getdents64(r0, &(0x7f00000001c0)=""/78, 0x29) getdents64(r0, &(0x7f0000000040)=""/241, 0xf1) 14:09:54 executing program 4: creat(0x0, 0x0) clone(0x0, 0x0, 0x0, 0x0, 0x0) truncate(&(0x7f0000000140)='./file0\x00', 0x0) 14:09:54 executing program 2: r0 = syz_open_procfs(0x0, &(0x7f0000000000)='\x00\x16\x00\x00\x00\x00\x00\x00') getdents64(r0, &(0x7f00000001c0)=""/78, 0x29) getdents64(r0, &(0x7f0000000040)=""/241, 0xf1) 14:09:54 executing program 5: r0 = perf_event_open(&(0x7f0000000280)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$PERF_EVENT_IOC_PERIOD(r0, 0x40082404, &(0x7f0000000080)) [ 214.207704] binder: 5251:5252 BC_CLEAR_DEATH_NOTIFICATION death notification not active [ 214.234408] binder: release 5251:5252 transaction 264 out, still active 14:09:54 executing program 4: creat(&(0x7f0000000000)='./file0\x00', 0x0) clone(0x0, 0x0, 0x0, 0x0, 0x0) truncate(0x0, 0x0) 14:09:54 executing program 0: perf_event_open(&(0x7f0000000580)={0x0, 0x70, 0x0, 0x10000000000002, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000003000/0x3000)=nil, 0x3000, 0x1, 0x32, 0xffffffffffffffff, 0x0) writev(0xffffffffffffffff, &(0x7f00000000c0)=[{&(0x7f0000000140)='2', 0x1}], 0x1) r0 = syz_open_procfs(0x0, &(0x7f0000000080)='clear_refs\x00') writev(r0, &(0x7f00000000c0), 0x20000000000003fa) [ 214.257671] binder: undelivered TRANSACTION_COMPLETE [ 214.280965] binder: send failed reply for transaction 264, target dead 14:09:54 executing program 1: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, 0x0, 0x0) listen(r0, 0xeb) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) sendto$inet6(r1, 0x0, 0x0, 0x20000004, &(0x7f0000000140)={0xa, 0x4e22}, 0x1c) readv(r1, &(0x7f0000000700)=[{&(0x7f0000000440)=""/132, 0x31}], 0x1) prctl$PR_MCE_KILL_GET(0x22) timerfd_create(0x0, 0x0) r2 = accept4(r0, 0x0, 0x0, 0x0) socket$inet6_udplite(0xa, 0x2, 0x88) setsockopt$packet_fanout(0xffffffffffffffff, 0x107, 0x12, 0x0, 0x309) ioctl$FICLONE(0xffffffffffffffff, 0x40049409, 0xffffffffffffffff) ioctl$EXT4_IOC_GROUP_EXTEND(0xffffffffffffffff, 0x40046607, 0x0) ioctl$PPPIOCGFLAGS1(0xffffffffffffffff, 0x8004745a, 0x0) dup(0xffffffffffffffff) shutdown(r1, 0x1) setsockopt(r1, 0x0, 0x1, &(0x7f0000000000)="1d", 0x1) sendto$inet6(r2, &(0x7f0000000300)='A', 0x1, 0x0, 0x0, 0x0) 14:09:54 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") r1 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x1000)=nil, 0x1000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x0, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000180)={0x18, 0x0, &(0x7f00000006c0)=[@increfs, @clear_death], 0x0, 0x0, 0x0}) 14:09:54 executing program 5: open(&(0x7f0000000100)='./file1\x00', 0x40140, 0x81) r0 = open(&(0x7f00000000c0)='.\x00', 0x0, 0x0) execveat(r0, &(0x7f0000000200)='./file1\x00', 0x0, 0x0, 0x0) 14:09:54 executing program 2: r0 = syz_open_procfs(0x0, &(0x7f0000000000)='\x00\x16\x00\x00\x00\x00\x00\x00') getdents64(r0, &(0x7f0000000040)=""/241, 0xf1) 14:09:54 executing program 4: creat(&(0x7f0000000000)='./file0\x00', 0x0) clone(0x0, 0x0, 0x0, 0x0, 0x0) truncate(0x0, 0x0) 14:09:54 executing program 0: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) r1 = memfd_create(&(0x7f0000000700)='/7\x02\xe8\xa4\xef\x9e\xc8e\xd5n\x89\xeb[<\x18-\x14\x8d8\xbf\xfe\x83\x19\xf3(\xd7y\x14h\xcf(f\x06I:\xa4\xea\xcb\b\x81C\xdd\xcc\x00\x00\x00\x00\xf9\b1h\xbam\xa4x\xb1:\xcf\a\x94Z\x7f\xc8\vy\xf2F\xf4\x9d\n3\xd4\x9a[\xee\xaa\t\xbe\x90\xabU3\xd3[y\xd1d^We\xa9\xcb\x86a\"\xba\xb7\xcd\xcf\x88\x9eqO|\x9f\xcf\r\x86\xf4\x15@\x82w\xa8\\\x8c^a\xbe\x991l\\\x16\xd4\xd53\xdd\x9e\x00\x01:\xac\x14^\xf6\xb6\xb1^\xaa\xfa\x02x\x8aV\x87\xe3\xfb\xef\xd0\xb7({,\xf4\xa2cl`\xdc\xf7\xe2f\xad\xaa>\xd4Ts\x10\xb9V!\x91uGTy\xde$X\xff\xb1\xf3={\xb7\xe65\xb6\x1a\x99q^\xc2\xfc\xb0\xc09\x85\x03\xf1]\xc54;\x8d\x01\xec3#\x8f%5\xef\xfe\xc5\xdb\xd5\xb7\xe0\xdd\xec,rV\x82!\xa0', 0x0) sendmsg$unix(r0, &(0x7f0000000600)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000800)=[@rights={0x18, 0x1, 0x1, [r1]}, @rights={0x18, 0x1, 0x1, [r0]}], 0x30}, 0x0) 14:09:54 executing program 2: r0 = syz_open_procfs(0x0, &(0x7f0000000000)='\x00\x16\x00\x00\x00\x00\x00\x00') getdents64(r0, &(0x7f0000000040)=""/241, 0xf1) 14:09:54 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") r1 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x1000)=nil, 0x1000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffd49, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000180)={0x18, 0x0, &(0x7f00000006c0)=[@increfs, @clear_death], 0x0, 0x0, 0x0}) 14:09:55 executing program 2: r0 = syz_open_procfs(0x0, &(0x7f0000000000)='\x00\x16\x00\x00\x00\x00\x00\x00') getdents64(r0, &(0x7f0000000040)=""/241, 0xf1) 14:09:55 executing program 0: r0 = socket$inet6(0xa, 0x80002, 0x100000000000088) bind$inet6(r0, &(0x7f0000d85fe4)={0xa, 0x4e23}, 0x1c) r1 = socket$inet6(0xa, 0x802, 0x88) sendto$inet6(r1, 0x0, 0x0, 0x0, 0x0, 0x0) sendto$inet6(r1, &(0x7f00000000c0)="dd", 0x1, 0x0, 0x0, 0x0) recvfrom$inet6(r0, &(0x7f0000000040)=""/48, 0x30, 0x0, 0x0, 0x0) 14:09:55 executing program 4: creat(&(0x7f0000000000)='./file0\x00', 0x0) clone(0x0, 0x0, 0x0, 0x0, 0x0) truncate(0x0, 0x0) [ 215.038349] binder: 5289:5295 BC_CLEAR_DEATH_NOTIFICATION death notification not active [ 215.061175] binder: release 5289:5295 transaction 267 out, still active [ 215.080688] binder: undelivered TRANSACTION_COMPLETE 14:09:55 executing program 2: getdents64(0xffffffffffffffff, &(0x7f00000001c0)=""/78, 0x29) getdents64(0xffffffffffffffff, &(0x7f0000000040)=""/241, 0xf1) [ 215.105903] binder: BINDER_SET_CONTEXT_MGR already set [ 215.123918] binder: 5308:5311 ioctl 40046207 0 returned -16 [ 215.124226] binder: send failed reply for transaction 267, target dead [ 215.153025] binder: 5308:5328 transaction failed 29189/-22, size 24-8 line 3014 [ 215.160774] binder: 5308:5328 ioctl c0306201 20000440 returned -14 [ 215.178137] binder: undelivered TRANSACTION_ERROR: 29189 14:09:55 executing program 1: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, 0x0, 0x0) listen(r0, 0xeb) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) sendto$inet6(r1, 0x0, 0x0, 0x20000004, &(0x7f0000000140)={0xa, 0x4e22}, 0x1c) readv(r1, &(0x7f0000000700)=[{&(0x7f0000000440)=""/132, 0x31}], 0x1) prctl$PR_MCE_KILL_GET(0x22) timerfd_create(0x0, 0x0) r2 = accept4(r0, 0x0, 0x0, 0x0) socket$inet6_udplite(0xa, 0x2, 0x88) setsockopt$packet_fanout(0xffffffffffffffff, 0x107, 0x12, 0x0, 0x309) ioctl$FICLONE(0xffffffffffffffff, 0x40049409, 0xffffffffffffffff) ioctl$EXT4_IOC_GROUP_EXTEND(0xffffffffffffffff, 0x40046607, 0x0) ioctl$PPPIOCGFLAGS1(0xffffffffffffffff, 0x8004745a, 0x0) dup(0xffffffffffffffff) shutdown(r1, 0x1) setsockopt(r1, 0x0, 0x1, &(0x7f0000000000)="1d", 0x1) sendto$inet6(r2, &(0x7f0000000300)='A', 0x1, 0x0, 0x0, 0x0) 14:09:55 executing program 2: getdents64(0xffffffffffffffff, &(0x7f00000001c0)=""/78, 0x29) getdents64(0xffffffffffffffff, &(0x7f0000000040)=""/241, 0xf1) 14:09:55 executing program 4: seccomp(0x1, 0x0, &(0x7f0000000040)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0xffffff7f7fffffff}]}) clone(0xf11f00, 0x0, 0x0, 0x0, 0x0) 14:09:55 executing program 5: r0 = socket$inet6(0xa, 0x800000000000002, 0x0) sendto$inet6(r0, 0x0, 0x0, 0x8000, &(0x7f0000000040)={0xa, 0x400000000004e22, 0x0, @mcast2}, 0x1c) setsockopt$sock_linger(r0, 0x1, 0x3c, &(0x7f0000005140)={0x1}, 0x8) sendto$inet6(r0, &(0x7f0000000080)="02", 0x1, 0x4048080, 0x0, 0x0) sendto$inet6(r0, 0x0, 0x0, 0x0, 0x0, 0x0) 14:09:55 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") r1 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x1000)=nil, 0x1000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffd49, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000180)={0x18, 0x0, &(0x7f00000006c0)=[@increfs, @clear_death], 0x0, 0x0, 0x0}) 14:09:55 executing program 4: add_key(&(0x7f0000000800)='logon\x00', &(0x7f0000000840)={'syz'}, 0x0, 0x0, 0xfffffffffffffffc) 14:09:55 executing program 2: getdents64(0xffffffffffffffff, &(0x7f00000001c0)=""/78, 0x29) getdents64(0xffffffffffffffff, &(0x7f0000000040)=""/241, 0xf1) 14:09:55 executing program 5: socketpair$unix(0x1, 0x2004000000000001, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x0) r1 = socket$packet(0x11, 0x3, 0x300) ioctl$sock_inet_SIOCSIFFLAGS(r1, 0x8914, &(0x7f0000000100)={'bridge_slave_0\x00\x04'}) socket$inet6(0xa, 0x0, 0x0) ioctl$sock_inet6_SIOCSIFADDR(0xffffffffffffffff, 0x8916, 0x0) ioctl$sock_inet_SIOCSIFFLAGS(r1, 0x8914, &(0x7f0000000080)={'bridge_slave_0\x00?', 0x22000000c0ffffff}) 14:09:55 executing program 4: openat$cgroup_root(0xffffffffffffff9c, 0x0, 0x200002, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) r0 = creat(&(0x7f00000000c0)='./bus\x00', 0x0) fcntl$setstatus(r0, 0x4, 0x6100) truncate(&(0x7f0000000240)='./bus\x00', 0x800) r1 = open(&(0x7f0000000000)='./bus\x00', 0x0, 0x0) lseek(r0, 0x0, 0x2) sendfile(r0, r1, 0x0, 0x8000fffffffe) sendfile(r0, r1, 0x0, 0xa5cc54d) 14:09:55 executing program 0: ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) r0 = creat(&(0x7f00000000c0)='./bus\x00', 0x0) fcntl$setstatus(r0, 0x4, 0x6100) truncate(&(0x7f0000000240)='./bus\x00', 0x800) r1 = open(&(0x7f0000000000)='./bus\x00', 0x0, 0x0) lseek(r0, 0x0, 0x2) sendfile(r0, r1, 0x0, 0x8000fffffffe) sendfile(r0, r1, 0x0, 0xa5cc54d) 14:09:55 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") r1 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x1000)=nil, 0x1000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffd49, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000180)={0x18, 0x0, &(0x7f00000006c0)=[@increfs, @clear_death], 0x0, 0x0, 0x0}) 14:09:55 executing program 2: r0 = syz_open_procfs(0x0, 0x0) getdents64(r0, &(0x7f00000001c0)=""/78, 0x29) getdents64(r0, &(0x7f0000000040)=""/241, 0xf1) [ 215.873020] binder: 5337:5341 ioctl c0306201 20000440 returned -14 [ 215.894286] binder: release 5337:5341 transaction 271 out, still active [ 215.907181] binder: unexpected work type, 4, not freed [ 215.945857] binder: undelivered TRANSACTION_COMPLETE [ 215.947419] binder: BINDER_SET_CONTEXT_MGR already set [ 215.947426] binder: 5361:5367 ioctl 40046207 0 returned -16 [ 215.947731] binder_alloc: 5337: binder_alloc_buf, no vma [ 215.947756] binder: 5361:5367 transaction failed 29189/-3, size 24-8 line 3137 [ 215.947767] binder: 5361:5367 ioctl c0306201 20000440 returned -14 [ 216.005410] binder: undelivered TRANSACTION_ERROR: 29189 [ 216.019374] binder: send failed reply for transaction 271, target dead 14:09:56 executing program 1: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, 0x0, 0x0) listen(r0, 0xeb) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) sendto$inet6(r1, 0x0, 0x0, 0x20000004, &(0x7f0000000140)={0xa, 0x4e22}, 0x1c) readv(r1, &(0x7f0000000700)=[{&(0x7f0000000440)=""/132, 0x31}], 0x1) prctl$PR_MCE_KILL_GET(0x22) timerfd_create(0x0, 0x0) r2 = accept4(r0, 0x0, 0x0, 0x0) socket$inet6_udplite(0xa, 0x2, 0x88) setsockopt$packet_fanout(0xffffffffffffffff, 0x107, 0x12, 0x0, 0x309) ioctl$FICLONE(0xffffffffffffffff, 0x40049409, 0xffffffffffffffff) ioctl$EXT4_IOC_GROUP_EXTEND(0xffffffffffffffff, 0x40046607, 0x0) ioctl$PPPIOCGFLAGS1(0xffffffffffffffff, 0x8004745a, 0x0) dup(0xffffffffffffffff) shutdown(r1, 0x1) setsockopt(r1, 0x0, 0x1, &(0x7f0000000000)="1d", 0x1) sendto$inet6(r2, &(0x7f0000000300)='A', 0x1, 0x0, 0x0, 0x0) 14:09:56 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") r1 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x1000)=nil, 0x1000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffd49, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, 0x0) 14:09:56 executing program 2: r0 = syz_open_procfs(0x0, 0x0) getdents64(r0, &(0x7f00000001c0)=""/78, 0x29) getdents64(r0, &(0x7f0000000040)=""/241, 0xf1) 14:09:56 executing program 5: r0 = socket$inet(0x2, 0xa, 0x0) syncfs(r0) r1 = dup(r0) connect$netlink(r1, &(0x7f0000000280)=@kern={0x10, 0x0, 0x0, 0x81480000}, 0xc) setsockopt$inet_tcp_int(r0, 0x6, 0x80000000000002, &(0x7f0000000300)=0x72, 0x197) sendmsg$nl_route_sched(r1, &(0x7f0000000400)={&(0x7f00000002c0), 0xc, &(0x7f00000003c0)={&(0x7f0000000340)=@gettaction={0x68, 0x32, 0x300, 0x70bd25, 0x25dfdbfe, {}, [@action_dump_flags=@TCA_ROOT_TIME_DELTA={0x8, 0x4, 0x2}, @action_gd=@TCA_ACT_TAB={0x18, 0x1, [{0x14, 0x0, @TCA_ACT_KIND={0xc, 0x1, 'csum\x00'}}]}, @action_dump_flags=@TCA_ROOT_FLAGS={0xc, 0x2, {0x1, 0x1}}, @action_dump_flags=@TCA_ROOT_TIME_DELTA={0x8, 0x4, 0xff}, @action_dump_flags=@TCA_ROOT_FLAGS={0xc, 0x2, {0x1, 0x1}}, @action_dump_flags=@TCA_ROOT_FLAGS={0xc, 0x2, {0x0, 0x1}}, @action_dump_flags=@TCA_ROOT_TIME_DELTA={0x8, 0x4, 0x6}]}, 0x68}, 0x1, 0x0, 0x0, 0x40040}, 0x0) bind$inet(r0, &(0x7f0000000180)={0x2, 0x4e20, @remote}, 0xfffffffffffffd72) setsockopt$SO_ATTACH_FILTER(r0, 0x1, 0x1a, &(0x7f0000b86000)={0x1, &(0x7f0000f40ff8)=[{0x6, 0x0, 0x0, 0xe8}]}, 0x10) sendto$inet(r0, 0x0, 0x0, 0x200007fd, &(0x7f0000000240)={0x2, 0x400000000004e26, @local}, 0x78) prctl$PR_SET_TIMERSLACK(0x1d, 0x401) setsockopt$sock_int(r0, 0x1, 0x2f, &(0x7f0000000040)=0x6, 0x4) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = open(&(0x7f000000fffa)='./bus\x00', 0x400000000141042, 0x0) close(r2) r3 = syz_open_dev$loop(&(0x7f0000000100)='/dev/loop#\x00', 0x0, 0x105082) r4 = memfd_create(&(0x7f0000000140)='\x00\x00\x00\x00\x8c\x00'/15, 0x0) pwritev(r4, &(0x7f0000000080)=[{&(0x7f00000000c0)="a8", 0x1}], 0x1, 0x81003) ioctl$LOOP_CHANGE_FD(r3, 0x4c00, r4) ioctl$TIOCGSID(r2, 0x5429, &(0x7f0000000440)=0x0) syz_open_procfs(r5, &(0x7f0000000200)='fd\x00') mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x800002, 0x11, r2, 0x0) socketpair$unix(0x1, 0x2, 0x0, 0x0) sendfile(r3, r4, 0x0, 0x80003) 14:09:56 executing program 2: r0 = syz_open_procfs(0x0, 0x0) getdents64(r0, &(0x7f00000001c0)=""/78, 0x29) getdents64(r0, &(0x7f0000000040)=""/241, 0xf1) [ 216.730750] syz-executor.5 uses obsolete (PF_INET,SOCK_PACKET) [ 216.761395] binder: 5379:5387 ioctl c0306201 20000440 returned -14 [ 216.788190] binder: 5379:5387 ioctl c0306201 0 returned -14 [ 216.809421] audit: type=1400 audit(1554214196.717:10): avc: denied { write } for pid=5380 comm="syz-executor.5" path="/proc/325/fd" dev="proc" ino=20272 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=dir permissive=1 14:09:56 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") r1 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x1000)=nil, 0x1000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffd49, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, 0x0) 14:09:56 executing program 2: r0 = syz_open_procfs(0x0, &(0x7f0000000000)='\x00\x16\x00\x00\x00\x00\x00\x00') getdents64(0xffffffffffffffff, &(0x7f00000001c0)=""/78, 0x29) getdents64(r0, &(0x7f0000000040)=""/241, 0xf1) [ 216.813480] binder: release 5379:5387 transaction 276 out, still active [ 216.813486] binder: unexpected work type, 4, not freed [ 216.813488] binder: undelivered TRANSACTION_COMPLETE [ 216.824090] binder: send failed reply for transaction 276, target dead 14:09:56 executing program 2: r0 = syz_open_procfs(0x0, &(0x7f0000000000)='\x00\x16\x00\x00\x00\x00\x00\x00') getdents64(0xffffffffffffffff, &(0x7f00000001c0)=""/78, 0x29) getdents64(r0, &(0x7f0000000040)=""/241, 0xf1) 14:09:56 executing program 4: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x200000000000013, &(0x7f0000000280)=0x400100000001, 0x4) connect$inet6(r0, &(0x7f0000000080), 0x1c) r1 = dup2(r0, r0) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r1, 0x6, 0x16, &(0x7f0000000440), 0x132224) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = gettid() setsockopt$inet6_IPV6_FLOWLABEL_MGR(r0, 0x29, 0x20, &(0x7f0000000000)={@mcast2, 0x0, 0x2}, 0x20) ptrace$setopts(0x4206, r2, 0x0, 0x0) tkill(r2, 0x100000000033) fcntl$setstatus(r0, 0x4, 0x42803) [ 216.899536] binder: 5405:5406 ioctl c0306201 20000440 returned -14 [ 216.935861] binder: 5405:5406 ioctl c0306201 0 returned -14 14:09:56 executing program 0: unshare(0x400) r0 = memfd_create(&(0x7f0000000100)='t\bnu\x00\x00\x00\x00\x00\x00\x00\x00\x00\x8c\x00', 0x0) fdatasync(r0) 14:09:56 executing program 2: r0 = syz_open_procfs(0x0, &(0x7f0000000000)='\x00\x16\x00\x00\x00\x00\x00\x00') getdents64(0xffffffffffffffff, &(0x7f00000001c0)=""/78, 0x29) getdents64(r0, &(0x7f0000000040)=""/241, 0xf1) 14:09:56 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") r1 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x1000)=nil, 0x1000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffd49, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, 0x0) [ 216.963918] binder: release 5405:5406 transaction 280 out, still active [ 216.984064] binder: unexpected work type, 4, not freed [ 217.048173] binder: undelivered TRANSACTION_COMPLETE [ 217.067956] binder: BINDER_SET_CONTEXT_MGR already set [ 217.093460] binder: 5420:5424 ioctl 40046207 0 returned -16 [ 217.093599] binder: send failed reply for transaction 280, target dead [ 217.123574] binder: 5420:5431 transaction failed 29189/-22, size 24-8 line 3014 [ 217.131548] binder: 5420:5431 ioctl c0306201 20000440 returned -14 [ 217.140033] binder: 5420:5424 ioctl c0306201 0 returned -14 [ 217.153612] binder: undelivered TRANSACTION_ERROR: 29189 14:09:57 executing program 1: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f0000000040), 0x1c) listen(r0, 0xeb) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) sendto$inet6(r1, 0x0, 0x0, 0x20000004, &(0x7f0000000140)={0xa, 0x4e22}, 0x1c) readv(r1, &(0x7f0000000700)=[{&(0x7f0000000440)=""/132, 0x31}], 0x1) prctl$PR_MCE_KILL_GET(0x22) timerfd_create(0x0, 0x0) r2 = accept4(r0, 0x0, 0x0, 0x0) socket$inet6_udplite(0xa, 0x2, 0x88) setsockopt$packet_fanout(0xffffffffffffffff, 0x107, 0x12, 0x0, 0x309) ioctl$FICLONE(0xffffffffffffffff, 0x40049409, 0xffffffffffffffff) ioctl$EXT4_IOC_GROUP_EXTEND(0xffffffffffffffff, 0x40046607, 0x0) ioctl$PPPIOCGFLAGS1(0xffffffffffffffff, 0x8004745a, 0x0) dup(0xffffffffffffffff) shutdown(r1, 0x1) setsockopt(r1, 0x0, 0x1, &(0x7f0000000000)="1d", 0x1) sendto$inet6(r2, &(0x7f0000000300)='A', 0x1, 0x0, 0x0, 0x0) 14:09:57 executing program 5: mmap(&(0x7f0000000000/0xff7000)=nil, 0xff7000, 0x1001, 0x2000000000071, 0xffffffffffffffff, 0x0) signalfd4(0xffffffffffffffff, &(0x7f0000000100), 0x8, 0x0) 14:09:57 executing program 2: r0 = syz_open_procfs(0x0, &(0x7f0000000000)='\x00\x16\x00\x00\x00\x00\x00\x00') getdents64(r0, 0x0, 0x0) getdents64(r0, &(0x7f0000000040)=""/241, 0xf1) 14:09:57 executing program 0: r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000000c0)='./cgroup\x00\f#\x9f\xd0\x85\xac\xc4\x9b\x81-\xb3\xd7=C\xea', 0x200002, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000040)='./file1\x00', 0x0) r2 = creat(&(0x7f0000000440)='./file1\x00', 0x0) fcntl$setstatus(r1, 0x4, 0x4bff) write$FUSE_NOTIFY_RETRIEVE(r2, &(0x7f0000000080)={0x30}, 0x30) io_setup(0x4, &(0x7f0000000380)=0x0) perf_event_open(&(0x7f0000940000)={0x2, 0x70, 0xfffffffffffffffe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) io_submit(r3, 0x1, &(0x7f0000000340)=[&(0x7f0000000280)={0x0, 0x0, 0x0, 0x1, 0x0, r1, &(0x7f0000000200), 0xfffffd07}]) 14:09:57 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") r1 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x1000)=nil, 0x1000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffd49, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) 14:09:57 executing program 2: r0 = syz_open_procfs(0x0, &(0x7f0000000000)='\x00\x16\x00\x00\x00\x00\x00\x00') getdents64(r0, 0x0, 0x0) getdents64(r0, &(0x7f0000000040)=""/241, 0xf1) 14:09:57 executing program 5: r0 = syz_open_dev$loop(&(0x7f0000000000)='/dev/loop#\x00', 0x0, 0x4000010004002) mmap(&(0x7f0000000000/0xff7000)=nil, 0xff7000, 0x1001, 0x2000000000071, 0xffffffffffffffff, 0x0) ioctl$LOOP_SET_STATUS(r0, 0x4c02, &(0x7f0000000040)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, "6096ca89723e59b93042b51a66a7f70b6bec6e0461c3abea0a4c9e2ec1352b8ebbbc481b61901160294ecf84a63e931020730d2d90037bf9404078ae6f7420f0", "b985477a2a92f496a384375e5892be4daa0a710d010339324e0d2c560ff68ba6"}) ioctl$LOOP_SET_STATUS(r0, 0x4c02, &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, "8ccc8a43a4b722aad26a207ba5f73a433ce6863368a09708f37997559ae0b7fca4dab3fe6d9c62e4231f79b174bba913ffdf9be26a0a531abe129fa66000", "601694926e8ffb73e0e200"}) 14:09:57 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") r1 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x1000)=nil, 0x1000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffd49, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) [ 217.571315] binder: 5438:5442 ioctl c0306201 20000440 returned -14 [ 217.600302] binder: release 5438:5442 transaction 285 out, still active [ 217.613276] binder: unexpected work type, 4, not freed [ 217.648093] binder: undelivered TRANSACTION_COMPLETE [ 217.682390] binder: send failed reply for transaction 285, target dead [ 217.687845] binder: 5455:5458 ioctl c0306201 20000440 returned -14 [ 217.720308] binder: send failed reply for transaction 289 to 5455:5458 [ 217.727673] binder: undelivered TRANSACTION_COMPLETE [ 217.732783] binder: undelivered TRANSACTION_ERROR: 29189 14:09:59 executing program 4: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000300)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000240)={'\x00a\xa4\x00\x00\xff\xeb\xf9\x00\x00\x00\x00\x02\x00', 0x9d01}) ioctl$TUNSETQUEUE(r0, 0x400454d9, &(0x7f0000000040)={'syzkalle\x00\x00\x00\x00\x00\x00\x00\x05', 0x400}) 14:09:59 executing program 2: r0 = syz_open_procfs(0x0, &(0x7f0000000000)='\x00\x16\x00\x00\x00\x00\x00\x00') getdents64(r0, 0x0, 0x0) getdents64(r0, &(0x7f0000000040)=""/241, 0xf1) 14:09:59 executing program 5: creat(&(0x7f0000000040)='./file1\x00', 0x0) mount(0x0, &(0x7f0000000080)='./file1\x00', &(0x7f0000000100)='cgroup\x00', 0x0, 0x0) 14:09:59 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") r1 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x1000)=nil, 0x1000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffd49, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) 14:09:59 executing program 0: r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000000c0)='./cgroup\x00\f#\x9f\xd0\x85\xac\xc4\x9b\x81-\xb3\xd7=C\xea', 0x200002, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000040)='./file1\x00', 0x0) r2 = creat(&(0x7f0000000440)='./file1\x00', 0x0) fcntl$setstatus(r1, 0x4, 0x4bff) write$FUSE_NOTIFY_RETRIEVE(r2, &(0x7f0000000080)={0x30}, 0x30) io_setup(0x4, &(0x7f0000000380)=0x0) perf_event_open(&(0x7f0000940000)={0x2, 0x70, 0xfffffffffffffffe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) io_submit(r3, 0x1, &(0x7f0000000340)=[&(0x7f0000000280)={0x0, 0x0, 0x0, 0x1, 0x0, r1, &(0x7f0000000200), 0xfffffd07}]) 14:09:59 executing program 1: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f0000000040), 0x1c) listen(r0, 0xeb) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) sendto$inet6(r1, 0x0, 0x0, 0x20000004, &(0x7f0000000140)={0xa, 0x4e22}, 0x1c) readv(r1, &(0x7f0000000700)=[{&(0x7f0000000440)=""/132, 0x31}], 0x1) prctl$PR_MCE_KILL_GET(0x22) timerfd_create(0x0, 0x0) r2 = accept4(r0, 0x0, 0x0, 0x0) socket$inet6_udplite(0xa, 0x2, 0x88) setsockopt$packet_fanout(0xffffffffffffffff, 0x107, 0x12, 0x0, 0x309) ioctl$FICLONE(0xffffffffffffffff, 0x40049409, 0xffffffffffffffff) ioctl$EXT4_IOC_GROUP_EXTEND(0xffffffffffffffff, 0x40046607, 0x0) ioctl$PPPIOCGFLAGS1(0xffffffffffffffff, 0x8004745a, 0x0) dup(0xffffffffffffffff) shutdown(r1, 0x1) setsockopt(r1, 0x0, 0x1, &(0x7f0000000000)="1d", 0x1) sendto$inet6(r2, &(0x7f0000000300)='A', 0x1, 0x0, 0x0, 0x0) 14:09:59 executing program 5: 14:09:59 executing program 2: r0 = syz_open_procfs(0x0, &(0x7f0000000000)='\x00\x16\x00\x00\x00\x00\x00\x00') getdents64(r0, &(0x7f00000001c0)=""/78, 0x29) getdents64(0xffffffffffffffff, &(0x7f0000000040)=""/241, 0xf1) [ 219.991155] binder: 5464:5468 ioctl c0306201 20000440 returned -14 [ 220.029223] binder: release 5464:5468 transaction 293 out, still active 14:09:59 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") r1 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x1000)=nil, 0x1000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffd49, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000180)={0x8, 0x0, &(0x7f00000006c0)=[@increfs], 0x0, 0x0, 0x0}) [ 220.038547] binder: unexpected work type, 4, not freed 14:10:00 executing program 5: [ 220.066497] binder: undelivered TRANSACTION_COMPLETE 14:10:00 executing program 2: r0 = syz_open_procfs(0x0, &(0x7f0000000000)='\x00\x16\x00\x00\x00\x00\x00\x00') getdents64(r0, &(0x7f00000001c0)=""/78, 0x29) getdents64(0xffffffffffffffff, &(0x7f0000000040)=""/241, 0xf1) 14:10:00 executing program 5: [ 220.103543] binder: send failed reply for transaction 293, target dead [ 220.156937] binder: 5483:5485 ioctl c0306201 20000440 returned -14 [ 220.168630] binder: release 5483:5485 transaction 297 out, still active [ 220.178013] binder: unexpected work type, 4, not freed [ 220.196516] binder: undelivered TRANSACTION_COMPLETE 14:10:00 executing program 4: 14:10:00 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") r1 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x1000)=nil, 0x1000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffd49, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000180)={0x8, 0x0, &(0x7f00000006c0)=[@increfs], 0x0, 0x0, 0x0}) 14:10:00 executing program 5: 14:10:00 executing program 2: r0 = syz_open_procfs(0x0, &(0x7f0000000000)='\x00\x16\x00\x00\x00\x00\x00\x00') getdents64(r0, &(0x7f00000001c0)=""/78, 0x29) getdents64(0xffffffffffffffff, &(0x7f0000000040)=""/241, 0xf1) [ 220.217143] binder: send failed reply for transaction 297, target dead [ 220.282574] binder: 5494:5497 ioctl c0306201 20000440 returned -14 [ 220.295432] binder: release 5494:5497 transaction 302 out, still active [ 220.303668] binder: unexpected work type, 4, not freed 14:10:00 executing program 2: r0 = syz_open_procfs(0x0, &(0x7f0000000000)='\x00\x16\x00\x00\x00\x00\x00\x00') getdents64(r0, &(0x7f00000001c0)=""/78, 0x29) getdents64(r0, 0x0, 0x0) [ 220.340028] binder: undelivered TRANSACTION_COMPLETE [ 220.351576] binder: send failed reply for transaction 302, target dead 14:10:00 executing program 1: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f0000000040), 0x1c) listen(r0, 0xeb) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) sendto$inet6(r1, 0x0, 0x0, 0x20000004, &(0x7f0000000140)={0xa, 0x4e22}, 0x1c) readv(r1, &(0x7f0000000700)=[{&(0x7f0000000440)=""/132, 0x31}], 0x1) prctl$PR_MCE_KILL_GET(0x22) timerfd_create(0x0, 0x0) r2 = accept4(r0, 0x0, 0x0, 0x0) socket$inet6_udplite(0xa, 0x2, 0x88) setsockopt$packet_fanout(0xffffffffffffffff, 0x107, 0x12, 0x0, 0x309) ioctl$FICLONE(0xffffffffffffffff, 0x40049409, 0xffffffffffffffff) ioctl$EXT4_IOC_GROUP_EXTEND(0xffffffffffffffff, 0x40046607, 0x0) ioctl$PPPIOCGFLAGS1(0xffffffffffffffff, 0x8004745a, 0x0) dup(0xffffffffffffffff) shutdown(r1, 0x1) setsockopt(r1, 0x0, 0x1, &(0x7f0000000000)="1d", 0x1) sendto$inet6(r2, &(0x7f0000000300)='A', 0x1, 0x0, 0x0, 0x0) 14:10:00 executing program 5: 14:10:00 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") r1 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x1000)=nil, 0x1000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffd49, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000180)={0x8, 0x0, &(0x7f00000006c0)=[@increfs], 0x0, 0x0, 0x0}) 14:10:00 executing program 0: 14:10:00 executing program 4: 14:10:00 executing program 2: r0 = syz_open_procfs(0x0, &(0x7f0000000000)='\x00\x16\x00\x00\x00\x00\x00\x00') getdents64(r0, &(0x7f00000001c0)=""/78, 0x29) getdents64(r0, 0x0, 0x0) 14:10:00 executing program 4: 14:10:00 executing program 0: 14:10:00 executing program 5: 14:10:00 executing program 2: r0 = syz_open_procfs(0x0, &(0x7f0000000000)='\x00\x16\x00\x00\x00\x00\x00\x00') getdents64(r0, &(0x7f00000001c0)=""/78, 0x29) getdents64(r0, 0x0, 0x0) 14:10:00 executing program 4: 14:10:00 executing program 0: [ 220.851902] binder: 5508:5515 ioctl c0306201 20000440 returned -14 [ 220.876987] binder: release 5508:5515 transaction 307 out, still active [ 220.899195] binder: unexpected work type, 4, not freed [ 220.928041] binder: undelivered TRANSACTION_COMPLETE [ 220.956212] binder: send failed reply for transaction 307, target dead 14:10:01 executing program 1: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f0000000040)={0xa, 0x4e22}, 0x1c) listen(0xffffffffffffffff, 0xeb) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) sendto$inet6(r1, 0x0, 0x0, 0x20000004, &(0x7f0000000140)={0xa, 0x4e22}, 0x1c) readv(r1, &(0x7f0000000700)=[{&(0x7f0000000440)=""/132, 0x31}], 0x1) prctl$PR_MCE_KILL_GET(0x22) timerfd_create(0x0, 0x0) r2 = accept4(r0, 0x0, 0x0, 0x0) socket$inet6_udplite(0xa, 0x2, 0x88) setsockopt$packet_fanout(0xffffffffffffffff, 0x107, 0x12, 0x0, 0x309) ioctl$FICLONE(0xffffffffffffffff, 0x40049409, 0xffffffffffffffff) ioctl$EXT4_IOC_GROUP_EXTEND(0xffffffffffffffff, 0x40046607, 0x0) ioctl$PPPIOCGFLAGS1(0xffffffffffffffff, 0x8004745a, 0x0) dup(0xffffffffffffffff) shutdown(r1, 0x1) setsockopt(r1, 0x0, 0x1, &(0x7f0000000000)="1d", 0x1) sendto$inet6(r2, &(0x7f0000000300)='A', 0x1, 0x0, 0x0, 0x0) 14:10:01 executing program 5: 14:10:01 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") r1 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x1000)=nil, 0x1000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffd49, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000180)={0x10, 0x0, &(0x7f00000006c0)=[@clear_death], 0x0, 0x0, 0x0}) 14:10:01 executing program 0: 14:10:01 executing program 2: 14:10:01 executing program 4: 14:10:01 executing program 2: 14:10:01 executing program 5: 14:10:01 executing program 4: 14:10:01 executing program 0: 14:10:01 executing program 5: [ 221.685936] binder: 5533:5538 ioctl c0306201 20000440 returned -14 14:10:01 executing program 2: 14:10:01 executing program 1: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f0000000040)={0xa, 0x4e22}, 0x1c) listen(0xffffffffffffffff, 0xeb) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) sendto$inet6(r1, 0x0, 0x0, 0x20000004, &(0x7f0000000140)={0xa, 0x4e22}, 0x1c) readv(r1, &(0x7f0000000700)=[{&(0x7f0000000440)=""/132, 0x31}], 0x1) prctl$PR_MCE_KILL_GET(0x22) timerfd_create(0x0, 0x0) r2 = accept4(r0, 0x0, 0x0, 0x0) socket$inet6_udplite(0xa, 0x2, 0x88) setsockopt$packet_fanout(0xffffffffffffffff, 0x107, 0x12, 0x0, 0x309) ioctl$FICLONE(0xffffffffffffffff, 0x40049409, 0xffffffffffffffff) ioctl$EXT4_IOC_GROUP_EXTEND(0xffffffffffffffff, 0x40046607, 0x0) ioctl$PPPIOCGFLAGS1(0xffffffffffffffff, 0x8004745a, 0x0) dup(0xffffffffffffffff) shutdown(r1, 0x1) setsockopt(r1, 0x0, 0x1, &(0x7f0000000000)="1d", 0x1) sendto$inet6(r2, &(0x7f0000000300)='A', 0x1, 0x0, 0x0, 0x0) 14:10:01 executing program 0: [ 221.729046] binder: 5533:5538 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 [ 221.758877] binder: release 5533:5538 transaction 312 out, still active [ 221.788992] binder: unexpected work type, 4, not freed 14:10:01 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") r1 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x1000)=nil, 0x1000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffd49, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000180)={0x10, 0x0, &(0x7f00000006c0)=[@clear_death], 0x0, 0x0, 0x0}) 14:10:01 executing program 4: 14:10:01 executing program 5: 14:10:01 executing program 2: 14:10:01 executing program 0: 14:10:01 executing program 1: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f0000000040)={0xa, 0x4e22}, 0x1c) listen(0xffffffffffffffff, 0xeb) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) sendto$inet6(r1, 0x0, 0x0, 0x20000004, &(0x7f0000000140)={0xa, 0x4e22}, 0x1c) readv(r1, &(0x7f0000000700)=[{&(0x7f0000000440)=""/132, 0x31}], 0x1) prctl$PR_MCE_KILL_GET(0x22) timerfd_create(0x0, 0x0) r2 = accept4(r0, 0x0, 0x0, 0x0) socket$inet6_udplite(0xa, 0x2, 0x88) setsockopt$packet_fanout(0xffffffffffffffff, 0x107, 0x12, 0x0, 0x309) ioctl$FICLONE(0xffffffffffffffff, 0x40049409, 0xffffffffffffffff) ioctl$EXT4_IOC_GROUP_EXTEND(0xffffffffffffffff, 0x40046607, 0x0) ioctl$PPPIOCGFLAGS1(0xffffffffffffffff, 0x8004745a, 0x0) dup(0xffffffffffffffff) shutdown(r1, 0x1) setsockopt(r1, 0x0, 0x1, &(0x7f0000000000)="1d", 0x1) sendto$inet6(r2, &(0x7f0000000300)='A', 0x1, 0x0, 0x0, 0x0) [ 221.829501] binder: undelivered TRANSACTION_COMPLETE 14:10:01 executing program 5: 14:10:01 executing program 4: 14:10:01 executing program 2: [ 221.861855] binder: send failed reply for transaction 312, target dead 14:10:01 executing program 0: 14:10:01 executing program 5: 14:10:01 executing program 2: [ 221.912672] binder: 5564:5565 ioctl c0306201 20000440 returned -14 [ 221.930806] binder: 5564:5565 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 14:10:01 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") r1 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x1000)=nil, 0x1000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffd49, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000180)={0x10, 0x0, &(0x7f00000006c0)=[@clear_death], 0x0, 0x0, 0x0}) 14:10:01 executing program 1: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f0000000040)={0xa, 0x4e22}, 0x1c) listen(r0, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) sendto$inet6(r1, 0x0, 0x0, 0x20000004, &(0x7f0000000140)={0xa, 0x4e22}, 0x1c) readv(r1, &(0x7f0000000700)=[{&(0x7f0000000440)=""/132, 0x31}], 0x1) prctl$PR_MCE_KILL_GET(0x22) timerfd_create(0x0, 0x0) r2 = accept4(r0, 0x0, 0x0, 0x0) socket$inet6_udplite(0xa, 0x2, 0x88) setsockopt$packet_fanout(0xffffffffffffffff, 0x107, 0x12, 0x0, 0x309) ioctl$FICLONE(0xffffffffffffffff, 0x40049409, 0xffffffffffffffff) ioctl$EXT4_IOC_GROUP_EXTEND(0xffffffffffffffff, 0x40046607, 0x0) ioctl$PPPIOCGFLAGS1(0xffffffffffffffff, 0x8004745a, 0x0) dup(0xffffffffffffffff) shutdown(r1, 0x1) setsockopt(r1, 0x0, 0x1, &(0x7f0000000000)="1d", 0x1) sendto$inet6(r2, &(0x7f0000000300)='A', 0x1, 0x0, 0x0, 0x0) 14:10:01 executing program 4: 14:10:01 executing program 0: 14:10:01 executing program 5: 14:10:01 executing program 2: [ 222.002651] binder: release 5564:5565 transaction 316 out, still active [ 222.022310] binder: unexpected work type, 4, not freed [ 222.033921] binder: undelivered TRANSACTION_COMPLETE 14:10:01 executing program 5: 14:10:02 executing program 0: 14:10:02 executing program 4: [ 222.047504] binder: send failed reply for transaction 316, target dead [ 222.060198] TCP: request_sock_TCPv6: Possible SYN flooding on port 20002. Dropping request. Check SNMP counters. 14:10:02 executing program 2: 14:10:02 executing program 5: 14:10:02 executing program 0: [ 222.130831] binder: 5586:5589 ioctl c0306201 20000440 returned -14 [ 222.161103] binder: 5586:5589 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 14:10:02 executing program 0: [ 222.210329] binder: release 5586:5589 transaction 320 out, still active [ 222.220813] binder: unexpected work type, 4, not freed [ 222.247059] binder: undelivered TRANSACTION_COMPLETE [ 222.266651] binder: send failed reply for transaction 320, target dead 14:10:02 executing program 1: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f0000000040)={0xa, 0x4e22}, 0x1c) listen(r0, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) sendto$inet6(r1, 0x0, 0x0, 0x20000004, &(0x7f0000000140)={0xa, 0x4e22}, 0x1c) readv(r1, &(0x7f0000000700)=[{&(0x7f0000000440)=""/132, 0x31}], 0x1) prctl$PR_MCE_KILL_GET(0x22) timerfd_create(0x0, 0x0) r2 = accept4(r0, 0x0, 0x0, 0x0) socket$inet6_udplite(0xa, 0x2, 0x88) setsockopt$packet_fanout(0xffffffffffffffff, 0x107, 0x12, 0x0, 0x309) ioctl$FICLONE(0xffffffffffffffff, 0x40049409, 0xffffffffffffffff) ioctl$EXT4_IOC_GROUP_EXTEND(0xffffffffffffffff, 0x40046607, 0x0) ioctl$PPPIOCGFLAGS1(0xffffffffffffffff, 0x8004745a, 0x0) dup(0xffffffffffffffff) shutdown(r1, 0x1) setsockopt(r1, 0x0, 0x1, &(0x7f0000000000)="1d", 0x1) sendto$inet6(r2, &(0x7f0000000300)='A', 0x1, 0x0, 0x0, 0x0) 14:10:02 executing program 2: 14:10:02 executing program 4: 14:10:02 executing program 5: 14:10:02 executing program 3: 14:10:02 executing program 0: 14:10:02 executing program 2: 14:10:02 executing program 3: 14:10:02 executing program 0: 14:10:02 executing program 4: 14:10:02 executing program 3: 14:10:02 executing program 0: [ 222.969753] TCP: request_sock_TCPv6: Possible SYN flooding on port 20002. Dropping request. Check SNMP counters. 14:10:03 executing program 1: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f0000000040)={0xa, 0x4e22}, 0x1c) listen(r0, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) sendto$inet6(r1, 0x0, 0x0, 0x20000004, &(0x7f0000000140)={0xa, 0x4e22}, 0x1c) readv(r1, &(0x7f0000000700)=[{&(0x7f0000000440)=""/132, 0x31}], 0x1) prctl$PR_MCE_KILL_GET(0x22) timerfd_create(0x0, 0x0) r2 = accept4(r0, 0x0, 0x0, 0x0) socket$inet6_udplite(0xa, 0x2, 0x88) setsockopt$packet_fanout(0xffffffffffffffff, 0x107, 0x12, 0x0, 0x309) ioctl$FICLONE(0xffffffffffffffff, 0x40049409, 0xffffffffffffffff) ioctl$EXT4_IOC_GROUP_EXTEND(0xffffffffffffffff, 0x40046607, 0x0) ioctl$PPPIOCGFLAGS1(0xffffffffffffffff, 0x8004745a, 0x0) dup(0xffffffffffffffff) shutdown(r1, 0x1) setsockopt(r1, 0x0, 0x1, &(0x7f0000000000)="1d", 0x1) sendto$inet6(r2, &(0x7f0000000300)='A', 0x1, 0x0, 0x0, 0x0) 14:10:03 executing program 5: 14:10:03 executing program 4: 14:10:03 executing program 2: 14:10:03 executing program 3: 14:10:03 executing program 0: 14:10:03 executing program 2: 14:10:03 executing program 0: 14:10:03 executing program 5: 14:10:03 executing program 3: [ 223.795883] TCP: request_sock_TCPv6: Possible SYN flooding on port 20002. Dropping request. Check SNMP counters. 14:10:03 executing program 4: 14:10:03 executing program 2: 14:10:04 executing program 1: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f0000000040)={0xa, 0x4e22}, 0x1c) listen(r0, 0xeb) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) sendto$inet6(0xffffffffffffffff, 0x0, 0x0, 0x20000004, &(0x7f0000000140)={0xa, 0x4e22}, 0x1c) readv(r1, &(0x7f0000000700)=[{&(0x7f0000000440)=""/132, 0x31}], 0x1) prctl$PR_MCE_KILL_GET(0x22) timerfd_create(0x0, 0x0) r2 = accept4(r0, 0x0, 0x0, 0x0) socket$inet6_udplite(0xa, 0x2, 0x88) setsockopt$packet_fanout(0xffffffffffffffff, 0x107, 0x12, 0x0, 0x309) ioctl$FICLONE(0xffffffffffffffff, 0x40049409, 0xffffffffffffffff) ioctl$EXT4_IOC_GROUP_EXTEND(0xffffffffffffffff, 0x40046607, 0x0) ioctl$PPPIOCGFLAGS1(0xffffffffffffffff, 0x8004745a, 0x0) dup(0xffffffffffffffff) shutdown(r1, 0x1) setsockopt(r1, 0x0, 0x1, &(0x7f0000000000)="1d", 0x1) sendto$inet6(r2, &(0x7f0000000300)='A', 0x1, 0x0, 0x0, 0x0) 14:10:04 executing program 5: 14:10:04 executing program 0: 14:10:04 executing program 4: 14:10:04 executing program 3: 14:10:04 executing program 2: 14:10:04 executing program 0: 14:10:04 executing program 4: 14:10:04 executing program 2: 14:10:04 executing program 3: 14:10:04 executing program 5: 14:10:04 executing program 4: 14:10:05 executing program 1: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f0000000040)={0xa, 0x4e22}, 0x1c) listen(r0, 0xeb) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) sendto$inet6(0xffffffffffffffff, 0x0, 0x0, 0x20000004, &(0x7f0000000140)={0xa, 0x4e22}, 0x1c) readv(r1, &(0x7f0000000700)=[{&(0x7f0000000440)=""/132, 0x31}], 0x1) prctl$PR_MCE_KILL_GET(0x22) timerfd_create(0x0, 0x0) r2 = accept4(r0, 0x0, 0x0, 0x0) socket$inet6_udplite(0xa, 0x2, 0x88) setsockopt$packet_fanout(0xffffffffffffffff, 0x107, 0x12, 0x0, 0x309) ioctl$FICLONE(0xffffffffffffffff, 0x40049409, 0xffffffffffffffff) ioctl$EXT4_IOC_GROUP_EXTEND(0xffffffffffffffff, 0x40046607, 0x0) ioctl$PPPIOCGFLAGS1(0xffffffffffffffff, 0x8004745a, 0x0) dup(0xffffffffffffffff) shutdown(r1, 0x1) setsockopt(r1, 0x0, 0x1, &(0x7f0000000000)="1d", 0x1) sendto$inet6(r2, &(0x7f0000000300)='A', 0x1, 0x0, 0x0, 0x0) 14:10:05 executing program 2: r0 = socket$packet(0x11, 0xa, 0x300) setsockopt$SO_ATTACH_FILTER(r0, 0x1, 0x1a, &(0x7f0000fbe000)={0x2, &(0x7f0000000000)=[{0x28, 0x0, 0x0, 0xfffff034}, {0x80000006}]}, 0x10) syz_emit_ethernet(0x11, &(0x7f0000000080)={@link_local, @empty, [], {@llc_tr={0x11, {@llc={0x0, 0x0, "86"}}}}}, 0x0) 14:10:05 executing program 5: prctl$PR_SET_KEEPCAPS(0x8, 0xfffffffffffffffd) 14:10:05 executing program 3: r0 = socket$key(0xf, 0x3, 0x2) fcntl$lock(r0, 0x5, &(0x7f0000000000)) 14:10:05 executing program 0: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_inet_SIOCSIFDSTADDR(r0, 0x8918, &(0x7f0000000040)={'team_slave_0\x00', {0x2, 0x0, @loopback}}) 14:10:05 executing program 4: r0 = perf_event_open(&(0x7f0000000040)={0x2, 0x70, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$PERF_EVENT_IOC_QUERY_BPF(r0, 0xc008240a, &(0x7f0000000000)={0x1, 0x0, [0x0]}) 14:10:05 executing program 0: r0 = openat$random(0xffffffffffffff9c, &(0x7f0000000100)='/dev/urandom\x00', 0x0, 0x0) ioctl$EXT4_IOC_SETFLAGS(r0, 0x40086602, 0x0) 14:10:05 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f3188b070") r1 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r1, &(0x7f00000000c0)={0x1000000efffffff, 0xe00000000000000, &(0x7f0000000080)={&(0x7f0000000500)=ANY=[@ANYBLOB="020d000510000000000000d30000000003000600252000000200046ac0020001000000000100c869080012000200030000000000fa0000003000000002030000050000c6a8000000020000000008000092ab000000000001020014bb00200000ffffffde0000000003000500002000000200ebf2df0000210008000002000000"], 0x80}}, 0x0) 14:10:05 executing program 5: perf_event_open(&(0x7f0000000040)={0x2, 0x70, 0xf7d, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x80001, 0x0) setsockopt$inet6_MCAST_JOIN_GROUP(r0, 0x29, 0x2a, &(0x7f0000fca000)={0x0, {{0xa, 0x0, 0x0, @mcast1}}}, 0x88) setsockopt$inet6_group_source_req(r0, 0x29, 0x2b, &(0x7f0000000500)={0x0, {{0xa, 0x0, 0x0, @mcast1}}, {{0xa, 0x0, 0x0, @loopback}}}, 0xff40) close(r0) 14:10:05 executing program 0: r0 = socket$inet6(0xa, 0x80001, 0x0) getsockopt$inet6_IPV6_FLOWLABEL_MGR(r0, 0x29, 0x20, &(0x7f00000000c0)={@empty, 0x0, 0x1}, 0x0) 14:10:05 executing program 0: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) openat$cgroup_ro(r0, &(0x7f0000000140)='cpuacct.usage_user\x00', 0x0, 0x0) openat$full(0xffffffffffffff9c, &(0x7f0000000040)='/dev/full\x00', 0x0, 0x0) 14:10:05 executing program 5: perf_event_open(&(0x7f0000000040)={0x2, 0x70, 0xf7d, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x80001, 0x0) setsockopt$inet6_MCAST_JOIN_GROUP(r0, 0x29, 0x2a, &(0x7f0000fca000)={0x0, {{0xa, 0x0, 0x0, @mcast1}}}, 0x88) setsockopt$inet6_group_source_req(r0, 0x29, 0x2b, &(0x7f0000000500)={0x0, {{0xa, 0x0, 0x0, @mcast1}}, {{0xa, 0x0, 0x0, @loopback}}}, 0xff40) close(r0) 14:10:06 executing program 1: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f0000000040)={0xa, 0x4e22}, 0x1c) listen(r0, 0xeb) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) sendto$inet6(0xffffffffffffffff, 0x0, 0x0, 0x20000004, &(0x7f0000000140)={0xa, 0x4e22}, 0x1c) readv(r1, &(0x7f0000000700)=[{&(0x7f0000000440)=""/132, 0x31}], 0x1) prctl$PR_MCE_KILL_GET(0x22) timerfd_create(0x0, 0x0) r2 = accept4(r0, 0x0, 0x0, 0x0) socket$inet6_udplite(0xa, 0x2, 0x88) setsockopt$packet_fanout(0xffffffffffffffff, 0x107, 0x12, 0x0, 0x309) ioctl$FICLONE(0xffffffffffffffff, 0x40049409, 0xffffffffffffffff) ioctl$EXT4_IOC_GROUP_EXTEND(0xffffffffffffffff, 0x40046607, 0x0) ioctl$PPPIOCGFLAGS1(0xffffffffffffffff, 0x8004745a, 0x0) dup(0xffffffffffffffff) shutdown(r1, 0x1) setsockopt(r1, 0x0, 0x1, &(0x7f0000000000)="1d", 0x1) sendto$inet6(r2, &(0x7f0000000300)='A', 0x1, 0x0, 0x0, 0x0) 14:10:06 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f3188b070") r1 = getpgrp(0x0) get_robust_list(r1, &(0x7f0000000200)=0x0, &(0x7f0000000240)) 14:10:06 executing program 2: r0 = openat$random(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/urandom\x00', 0x0, 0x0) ioctl$RNDADDTOENTCNT(r0, 0x40045201, &(0x7f0000000000)=0x10000) 14:10:06 executing program 5: setrlimit(0x7, &(0x7f0000000000)) ppoll(&(0x7f0000000080)=[{}], 0x1, 0x0, 0x0, 0x0) 14:10:06 executing program 4: r0 = socket$packet(0x11, 0xa, 0x300) setsockopt$SO_ATTACH_FILTER(r0, 0x1, 0x1a, &(0x7f0000fbe000)={0x2, &(0x7f0000000000)=[{0x28, 0x0, 0x0, 0xfffff034}, {0x80000006}]}, 0x10) syz_emit_ethernet(0x1, &(0x7f0000000040)=ANY=[@ANYBLOB="5000004090782fd2"], 0x0) 14:10:06 executing program 0: fstat(0xffffffffffffffff, &(0x7f0000000000)) r0 = add_key(&(0x7f0000000180)='user\x00', &(0x7f00000001c0)={'syz', 0x1}, &(0x7f0000000200)="05a080dcb703ab66b874154659b1e58451d6a8ab0ce0cc542c693f5fb641866d5e8d3abd4e35cbda7bf72f2f9102c42f9044e2aa4ab6c2c6eddd10ae89449426f09d94703a61e59dcb58f72d4509fb5b0e592f36fc27a152b4f95e6654aaa3577efa07752d3e523ae42b58", 0x6b, 0xfffffffffffffffc) request_key(&(0x7f0000000080)='asymmetric\x00', &(0x7f00000000c0)={'syz'}, 0x0, r0) 14:10:06 executing program 3: r0 = socket$key(0xf, 0x3, 0x2) flock(r0, 0x0) 14:10:06 executing program 5: r0 = getpid() capset(&(0x7f0000000000)={0x19980330, r0}, 0x0) 14:10:06 executing program 2: r0 = openat$ashmem(0xffffffffffffff9c, &(0x7f0000000280)='/dev/ashmem\x00', 0x402001, 0x0) fsetxattr$security_smack_transmute(r0, &(0x7f00000002c0)='security.SMACK64TRANSMUTE\x00', &(0x7f0000000300)='TRUE', 0x4, 0x2) r1 = socket$inet_udplite(0x2, 0x2, 0x88) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f00009fd000/0x600000)=nil, 0x600000, 0x2000007, 0x6031, 0xffffffffffffffff, 0x0) mremap(&(0x7f0000a94000/0x2000)=nil, 0x2000, 0x800000, 0x0, &(0x7f0000130000/0x800000)=nil) ioctl(r1, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f3188b070") 14:10:06 executing program 0: r0 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r0, &(0x7f0000000040), 0x1c) sendmmsg(r0, &(0x7f00000092c0), 0x3fffffffffffe9f, 0x0) 14:10:06 executing program 4: perf_event_open(&(0x7f0000000040)={0x1, 0x43, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) request_key(&(0x7f0000000000)='user\x00', &(0x7f0000000040)={'syz'}, &(0x7f0000000080)='\x00', 0xfffffffffffffffd) r0 = socket$inet(0x2, 0x0, 0x0) sendto$inet(r0, 0x0, 0x0, 0x0, 0x0, 0x0) setsockopt$IP_VS_SO_SET_ZERO(0xffffffffffffffff, 0x0, 0x48f, 0x0, 0x0) syz_open_procfs(0x0, 0x0) preadv(0xffffffffffffffff, 0x0, 0x0, 0x0) 14:10:06 executing program 5: r0 = socket$inet(0x2, 0x4000000000000001, 0x0) sendto$inet(r0, 0x0, 0x0, 0x20000802, &(0x7f0000000100)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10) [ 226.388847] capability: warning: `syz-executor.5' uses 32-bit capabilities (legacy support in use) 14:10:07 executing program 1: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f0000000040)={0xa, 0x4e22}, 0x1c) listen(r0, 0xeb) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) sendto$inet6(r1, 0x0, 0x0, 0x0, &(0x7f0000000140)={0xa, 0x4e22}, 0x1c) readv(r1, &(0x7f0000000700)=[{&(0x7f0000000440)=""/132, 0x31}], 0x1) prctl$PR_MCE_KILL_GET(0x22) timerfd_create(0x0, 0x0) r2 = accept4(r0, 0x0, 0x0, 0x0) socket$inet6_udplite(0xa, 0x2, 0x88) setsockopt$packet_fanout(0xffffffffffffffff, 0x107, 0x12, 0x0, 0x309) ioctl$FICLONE(0xffffffffffffffff, 0x40049409, 0xffffffffffffffff) ioctl$EXT4_IOC_GROUP_EXTEND(0xffffffffffffffff, 0x40046607, 0x0) ioctl$PPPIOCGFLAGS1(0xffffffffffffffff, 0x8004745a, 0x0) dup(0xffffffffffffffff) shutdown(r1, 0x1) setsockopt(r1, 0x0, 0x1, &(0x7f0000000000)="1d", 0x1) sendto$inet6(r2, &(0x7f0000000300)='A', 0x1, 0x0, 0x0, 0x0) 14:10:07 executing program 0: socket$inet(0x2, 0x3, 0x29) 14:10:07 executing program 3: preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f0000000180)=""/148, 0x94}], 0x1, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/arp\x00') preadv(r0, &(0x7f0000000480), 0x1000000000000237, 0x0) 14:10:07 executing program 2: r0 = memfd_create(&(0x7f0000000580)='-B\xd5NI\xc5j\xbappp\xf0\b\x84\xa2m\x00:)\x00\xbb\x8d\xac\xacva}knh#\b\x00\x00\x00\xc0:\x9cc\x10d\xee\xa9\x8bCc\xad\x89\x9ck\xde\xc5\xe9\xaa\x9b\xc3\x14\xd2\xd1y\x1f\x9e\x856\xddU\xa9=\xcdJx\xaa\x8f~\xb90a\xa9\xb2\x04K\x98\x93?\x88Q\xf7\xd6\x1d\xa1\xce\x8b\x19\xea\xef\xe3\xab\xb6\xa5$4\xd6\xfe7\x0f\xe7\xd9$\xce(\xabN\xae\xc9\xbd\xd3g@\xe1\'s\x0e\x90\xf2\xcdr\xb8(\xb8\xd9\xa3\xc4p\xf4\\>A\x11U\x99\x8d\xa3\x86\xb7\x1d\x87z\xd3\xc4\xdf\x13/\x97Yy\x8b{\x1df\x8d/\x90\xd3<\xf8\x18\xa4\x88\xcf\x048\xb4\xbe\xfa\xa5\xb7\xd6\xa5&);\x1br\xd2a\xf2\x8b\xa7\x15\xbe\x95\xeb\x1bB\xacoyP\xbb\x1c\xb9S-\xe0oK\xac\x00;S\x8a\x01\xd2\xca<\x04\xaf\x04\x9a\x9d\x84\xa5\x94J>F\xc5V\xc6\xfa\x8e\v\xe1\x82\x03`\xf8\xca\xf4\x89\r^Z44\x91\xeb\xf4$\xf3\x1d\xd5\xbd\xb6ZZ\xd8\xfdS\r\x98\x06/\x9a%m\xcf\xab u\xa6Fw\xde\xb4?\r\xbdK\xfb\xf2\x13\xb3\xfa\x00\xaaP\xc9t\x7f\'\xba\x12', 0x0) pwrite64(r0, &(0x7f0000000000)='/', 0x1, 0x0) mmap(&(0x7f0000001000/0x1000)=nil, 0x1000, 0x4, 0x11, r0, 0x0) symlink(&(0x7f0000001000)='./file0\x00', &(0x7f0000000040)='./file0\x00') rename(&(0x7f0000000100)='./file0\x00', &(0x7f0000000080)='./file0/file0\x00') 14:10:07 executing program 5: mknod(&(0x7f0000000040)='./bus\x00', 0x3a0914c44f7b802c, 0x0) setuid(0xee01) open(&(0x7f0000000100)='./bus\x00', 0x0, 0x0) 14:10:07 executing program 4: r0 = socket(0x2, 0x3, 0x6) connect$unix(r0, &(0x7f0000000000)=@file={0xbd5699bc1ec0282, './file0\x00'}, 0x10) write(r0, &(0x7f0000000080)="3274d1ae4d0cefc37c2b023e5095bed01b2463b4", 0x14) 14:10:07 executing program 2: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f00000000c0)={'nr0\x01\x01\x00', 0x2}) ioctl$TUNATTACHFILTER(r0, 0x401054d5, &(0x7f0000000100)={0x2, &(0x7f0000000000)=[{0x30, 0x0, 0x0, 0xfffff020}, {0x16}]}) 14:10:07 executing program 3: socketpair(0x27, 0x0, 0x0, 0x0) 14:10:07 executing program 0: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f00000000c0)={'nr0\x01\x01\x00', 0x2}) ioctl$TUNATTACHFILTER(r0, 0x401054d5, &(0x7f0000000100)={0x2, &(0x7f0000000000)=[{0x30, 0x0, 0x0, 0xfffff034}, {0x16}]}) 14:10:07 executing program 5: r0 = socket$inet_tcp(0x2, 0x1, 0x0) r1 = socket$inet(0x2, 0x3, 0x1c) ioctl(r1, 0x1000008912, &(0x7f0000000040)="0adc5f123c123f319bd070") r2 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r2, &(0x7f0000000500)={0xa, 0x2, 0x0, @empty}, 0x1c) listen(r2, 0x0) connect$inet(r0, &(0x7f0000000000)={0x2, 0x2, @loopback}, 0x10) sendmmsg(r0, &(0x7f0000000280)=[{{0x0, 0x0, &(0x7f00000000c0)=[{&(0x7f0000000200)="9c", 0x1}], 0x1}}], 0x1, 0x0) 14:10:07 executing program 4: r0 = creat(&(0x7f0000000040)='./bus\x00', 0x0) open(0x0, 0x0, 0x0) fcntl$setstatus(r0, 0x4, 0x44000) 14:10:07 executing program 1: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f0000000040)={0xa, 0x4e22}, 0x1c) listen(r0, 0xeb) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) sendto$inet6(r1, 0x0, 0x0, 0x0, &(0x7f0000000140)={0xa, 0x4e22}, 0x1c) readv(r1, &(0x7f0000000700)=[{&(0x7f0000000440)=""/132, 0x31}], 0x1) prctl$PR_MCE_KILL_GET(0x22) timerfd_create(0x0, 0x0) r2 = accept4(r0, 0x0, 0x0, 0x0) socket$inet6_udplite(0xa, 0x2, 0x88) setsockopt$packet_fanout(0xffffffffffffffff, 0x107, 0x12, 0x0, 0x309) ioctl$FICLONE(0xffffffffffffffff, 0x40049409, 0xffffffffffffffff) ioctl$EXT4_IOC_GROUP_EXTEND(0xffffffffffffffff, 0x40046607, 0x0) ioctl$PPPIOCGFLAGS1(0xffffffffffffffff, 0x8004745a, 0x0) dup(0xffffffffffffffff) shutdown(r1, 0x1) setsockopt(r1, 0x0, 0x1, &(0x7f0000000000)="1d", 0x1) sendto$inet6(r2, &(0x7f0000000300)='A', 0x1, 0x0, 0x0, 0x0) 14:10:07 executing program 4: mknodat(0xffffffffffffffff, 0x0, 0x1080, 0x100) [ 227.341371] TCP: request_sock_TCP: Possible SYN flooding on port 2. Dropping request. Check SNMP counters. 14:10:07 executing program 1: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f0000000040)={0xa, 0x4e22}, 0x1c) listen(r0, 0xeb) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) sendto$inet6(r1, 0x0, 0x0, 0x0, &(0x7f0000000140)={0xa, 0x4e22}, 0x1c) readv(r1, &(0x7f0000000700)=[{&(0x7f0000000440)=""/132, 0x31}], 0x1) prctl$PR_MCE_KILL_GET(0x22) timerfd_create(0x0, 0x0) r2 = accept4(r0, 0x0, 0x0, 0x0) socket$inet6_udplite(0xa, 0x2, 0x88) setsockopt$packet_fanout(0xffffffffffffffff, 0x107, 0x12, 0x0, 0x309) ioctl$FICLONE(0xffffffffffffffff, 0x40049409, 0xffffffffffffffff) ioctl$EXT4_IOC_GROUP_EXTEND(0xffffffffffffffff, 0x40046607, 0x0) ioctl$PPPIOCGFLAGS1(0xffffffffffffffff, 0x8004745a, 0x0) dup(0xffffffffffffffff) shutdown(r1, 0x1) setsockopt(r1, 0x0, 0x1, &(0x7f0000000000)="1d", 0x1) sendto$inet6(r2, &(0x7f0000000300)='A', 0x1, 0x0, 0x0, 0x0) 14:10:07 executing program 3: r0 = socket$inet6_udplite(0xa, 0x2, 0x88) setsockopt$SO_ATTACH_FILTER(r0, 0x1, 0x35, &(0x7f0000000080)={0x0, 0x0}, 0x8) 14:10:07 executing program 2: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f00000000c0)={'nr0\x01\x01\x00', 0x2}) ioctl$TUNATTACHFILTER(r0, 0x401054d5, &(0x7f0000000100)={0x2, &(0x7f0000000000)=[{0x30, 0x0, 0x0, 0xfffff020}, {0x16}]}) 14:10:07 executing program 3: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = creat(&(0x7f0000000200)='\xe9\x1fq\x89Y\x1e\x923aK\x00', 0x109) dup2(r0, r1) execve(&(0x7f00000002c0)='\xe9\x1fq\x89Y\x1e\x923aK\x00', 0x0, 0x0) clone(0x0, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) execve(&(0x7f0000000000)='./file1\x00', 0x0, 0x0) 14:10:07 executing program 4: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) sendmmsg(r0, &(0x7f000000b240)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f00000051c0)=ANY=[@ANYBLOB="00000000000000000301000009000000"], 0x10}}], 0x1, 0x0) 14:10:07 executing program 1: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f0000000040)={0xa, 0x4e22}, 0x1c) listen(r0, 0xeb) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) sendto$inet6(r1, 0x0, 0x0, 0x20000004, 0x0, 0x0) readv(r1, &(0x7f0000000700)=[{&(0x7f0000000440)=""/132, 0x31}], 0x1) prctl$PR_MCE_KILL_GET(0x22) timerfd_create(0x0, 0x0) r2 = accept4(r0, 0x0, 0x0, 0x0) socket$inet6_udplite(0xa, 0x2, 0x88) setsockopt$packet_fanout(0xffffffffffffffff, 0x107, 0x12, 0x0, 0x309) ioctl$FICLONE(0xffffffffffffffff, 0x40049409, 0xffffffffffffffff) ioctl$EXT4_IOC_GROUP_EXTEND(0xffffffffffffffff, 0x40046607, 0x0) ioctl$PPPIOCGFLAGS1(0xffffffffffffffff, 0x8004745a, 0x0) dup(0xffffffffffffffff) shutdown(r1, 0x1) setsockopt(r1, 0x0, 0x1, &(0x7f0000000000)="1d", 0x1) sendto$inet6(r2, &(0x7f0000000300)='A', 0x1, 0x0, 0x0, 0x0) 14:10:07 executing program 0: r0 = openat$full(0xffffffffffffff9c, &(0x7f0000000000)='/dev/full\x00', 0x0, 0x0) ioctl$VT_RELDISP(0xffffffffffffffff, 0x5605) setsockopt$inet_udp_int(0xffffffffffffffff, 0x11, 0x0, 0x0, 0x0) setsockopt$sock_void(0xffffffffffffffff, 0x1, 0x0, 0x0, 0x0) fadvise64(r0, 0x0, 0x0, 0x7) 14:10:07 executing program 4: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ptmx\x00', 0x3d, 0x0) 14:10:08 executing program 5: r0 = socket$inet_tcp(0x2, 0x1, 0x0) r1 = socket$inet(0x2, 0x3, 0x1c) ioctl(r1, 0x1000008912, &(0x7f0000000040)="0adc5f123c123f319bd070") r2 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r2, &(0x7f0000000500)={0xa, 0x2, 0x0, @empty}, 0x1c) listen(r2, 0x0) connect$inet(r0, &(0x7f0000000000)={0x2, 0x2, @loopback}, 0x10) sendmmsg(r0, &(0x7f0000000280)=[{{0x0, 0x0, &(0x7f00000000c0)=[{&(0x7f0000000200)="9c", 0x1}], 0x1}}], 0x1, 0x0) 14:10:08 executing program 0: r0 = perf_event_open(0x0, 0x0, 0xd, 0xffffffffffffffff, 0x8000000000000000) r1 = socket$unix(0x1, 0x1, 0x0) socket$unix(0x1, 0x3, 0x0) bind$unix(r1, &(0x7f0000003000)=@abs={0x1}, 0x6e) listen(r1, 0x8) ioctl$TIOCGSID(0xffffffffffffff9c, 0x5429, &(0x7f00000002c0)) ioctl$TIOCGPGRP(0xffffffffffffffff, 0x540f, &(0x7f0000000340)=0x0) r3 = syz_open_procfs(r2, &(0x7f0000000380)='net/unix\x00') sendfile(r0, r3, 0x0, 0x10001) utime(&(0x7f0000000040)='./bus\x00', &(0x7f0000000140)={0x0, 0x80000001}) ioctl$FIONREAD(r3, 0x541b, &(0x7f0000000000)) setsockopt$netlink_NETLINK_CAP_ACK(r3, 0x10e, 0xa, 0x0, 0x0) ptrace$PTRACE_SECCOMP_GET_FILTER(0x420c, 0x0, 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$sock_SIOCGPGRP(0xffffffffffffffff, 0x8904, 0x0) socketpair$unix(0x1, 0x0, 0x0, 0x0) fcntl$lock(0xffffffffffffffff, 0x0, 0x0) ioctl$TIOCGPGRP(0xffffffffffffffff, 0x540f, 0x0) write$P9_RGETLOCK(0xffffffffffffffff, 0x0, 0xfffffffffffffe7b) r5 = socket$inet6(0xa, 0x400000000001, 0x0) r6 = dup(r5) bind$inet6(r5, &(0x7f0000000600)={0xa, 0x4e20, 0x800, @loopback}, 0x1c) sendto$inet6(r5, 0x0, 0x5e, 0x20000008, &(0x7f0000000100)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) connect$unix(r6, &(0x7f0000006780)=@file={0x0, './bus\x00'}, 0x6e) 14:10:08 executing program 4: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f00000004c0)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000000240)={{'fd', 0x3d, r0}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}}) write$FUSE_NOTIFY_STORE(r0, &(0x7f0000000480)={0x28, 0x4, 0x0, {0x1}}, 0x28) 14:10:08 executing program 3: r0 = socket$inet(0x2, 0x20000200080003, 0x3) sendto$inet(r0, 0x0, 0x0, 0x0, &(0x7f0000000040), 0x10) recvmmsg(r0, &(0x7f00000004c0)=[{{&(0x7f0000000400)=@ethernet={0x0, @dev}, 0x80, 0x0}}], 0x1, 0x0, 0x0) 14:10:08 executing program 2: r0 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000280)='/dev/loop-control\x00', 0x0, 0x0) ioctl$LOOP_CTL_ADD(r0, 0x4c80, 0x0) 14:10:08 executing program 3: socket$inet6(0xa, 0x0, 0x0) clone(0x3fff, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) msync(&(0x7f0000952000/0x2000)=nil, 0x87abbe8d1cc6ad9, 0x4) 14:10:08 executing program 2: 14:10:08 executing program 4: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f00000004c0)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000000240)={{'fd', 0x3d, r0}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}}) write$FUSE_NOTIFY_STORE(r0, &(0x7f0000000480)={0x28, 0x4, 0x0, {0x1}}, 0x28) 14:10:08 executing program 4: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f0000000180)=""/148, 0x94}], 0x2000000000000256, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000300)='fdinfo/3\x00') preadv(r0, &(0x7f0000000480), 0x10000000000001ea, 0x0) [ 228.269735] TCP: request_sock_TCP: Possible SYN flooding on port 2. Dropping request. Check SNMP counters. 14:10:08 executing program 1: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f0000000040)={0xa, 0x4e22}, 0x1c) listen(r0, 0xeb) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) sendto$inet6(r1, 0x0, 0x0, 0x20000004, 0x0, 0x0) readv(r1, &(0x7f0000000700)=[{&(0x7f0000000440)=""/132, 0x31}], 0x1) prctl$PR_MCE_KILL_GET(0x22) timerfd_create(0x0, 0x0) r2 = accept4(r0, 0x0, 0x0, 0x0) socket$inet6_udplite(0xa, 0x2, 0x88) setsockopt$packet_fanout(0xffffffffffffffff, 0x107, 0x12, 0x0, 0x309) ioctl$FICLONE(0xffffffffffffffff, 0x40049409, 0xffffffffffffffff) ioctl$EXT4_IOC_GROUP_EXTEND(0xffffffffffffffff, 0x40046607, 0x0) ioctl$PPPIOCGFLAGS1(0xffffffffffffffff, 0x8004745a, 0x0) dup(0xffffffffffffffff) shutdown(r1, 0x1) setsockopt(r1, 0x0, 0x1, &(0x7f0000000000)="1d", 0x1) sendto$inet6(r2, &(0x7f0000000300)='A', 0x1, 0x0, 0x0, 0x0) 14:10:08 executing program 0: r0 = creat(&(0x7f0000000180)='./bus\x00', 0x0) r1 = creat(&(0x7f0000000280)='./bus\x00', 0x0) ftruncate(r1, 0x208200) write$FUSE_INTERRUPT(r1, &(0x7f0000000200)={0x10}, 0x10) r2 = open(&(0x7f0000000140)='./bus\x00', 0x0, 0x0) mmap(&(0x7f0000001000/0x4000)=nil, 0x4000, 0x0, 0x11, r2, 0x0) fcntl$setstatus(r0, 0x4, 0x44040) io_setup(0x2, &(0x7f00000004c0)=0x0) io_submit(r3, 0x1, &(0x7f0000000540)=[&(0x7f00000000c0)={0x0, 0x0, 0x0, 0x1, 0x0, r0, &(0x7f0000000000), 0x10000}]) 14:10:08 executing program 2: syz_open_procfs(0x0, &(0x7f0000000380)='net/unix\x00') 14:10:08 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") getsockopt$inet_IP_XFRM_POLICY(0xffffffffffffffff, 0x0, 0x11, 0x0, 0x0) r1 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_inet_SIOCSIFFLAGS(r1, 0x8914, &(0x7f0000000040)={'sit0\x00'}) ioctl$sock_inet_SIOCSIFFLAGS(r1, 0x8914, &(0x7f00000000c0)={'sit0\x00\x00\x00\x00\x00\x00\xfc\x00', 0x141}) 14:10:08 executing program 3: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000140)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'vet\x00\x00\x00\x00\x00\x00\x00\x00\x00\xbdh\x00', 0x43732e5398416f16}) ioctl$TUNSETQUEUE(r0, 0x400454d9, &(0x7f0000001640)={'syzkaller1\x00', 0x401}) ioctl$TUNATTACHFILTER(r0, 0x401054d5, &(0x7f00000000c0)={0x0, 0x0}) 14:10:08 executing program 2: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180)={0xffffffffffffffff}) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$inet(0x2, 0x4000000000000001, 0x0) sendto$inet(r2, 0x0, 0x0, 0x200007ff, &(0x7f0000deaff0)={0x2, 0x0, @loopback}, 0x10) read(r2, &(0x7f0000001100)=""/4096, 0x1000) timer_create(0x0, &(0x7f0000cd0000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000040)) timer_settime(0x0, 0x0, &(0x7f0000000080)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) r3 = gettid() recvmmsg(r2, &(0x7f0000000ac0)=[{{0x0, 0xffffff5a, &(0x7f00000004c0)}}], 0x4000000000003a8, 0x0, 0x0) tkill(r3, 0x14) 14:10:08 executing program 4: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000003c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCGETA(r0, 0x5405, &(0x7f0000000040)) 14:10:08 executing program 0: mlock(&(0x7f0000ffd000/0x3000)=nil, 0x3000) munlockall() 14:10:08 executing program 0: perf_event_open(&(0x7f000001d000)={0x2, 0x70, 0x41, 0x8001, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000001080)}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mprotect(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x1000000) 14:10:09 executing program 4: mknod(0x0, 0x0, 0x0) execve(0x0, 0x0, 0x0) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket(0xa, 0x2, 0x0) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r0, 0x29, 0x20, &(0x7f00000002c0)={@ipv4, 0x0, 0x0, 0x0, 0x5}, 0x16d) 14:10:09 executing program 0: r0 = socket$packet(0x11, 0x8000000000000003, 0x300) setsockopt$packet_tx_ring(r0, 0x107, 0xd, &(0x7f0000000080)=@req3={0x10000, 0x100000001, 0x10000, 0x1}, 0x1c) 14:10:09 executing program 4: r0 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000280)='/dev/loop-control\x00', 0x0, 0x0) ioctl$LOOP_CTL_REMOVE(r0, 0x4c81, 0x0) 14:10:09 executing program 1: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f0000000040)={0xa, 0x4e22}, 0x1c) listen(r0, 0xeb) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) sendto$inet6(r1, 0x0, 0x0, 0x20000004, 0x0, 0x0) readv(r1, &(0x7f0000000700)=[{&(0x7f0000000440)=""/132, 0x31}], 0x1) prctl$PR_MCE_KILL_GET(0x22) timerfd_create(0x0, 0x0) r2 = accept4(r0, 0x0, 0x0, 0x0) socket$inet6_udplite(0xa, 0x2, 0x88) setsockopt$packet_fanout(0xffffffffffffffff, 0x107, 0x12, 0x0, 0x309) ioctl$FICLONE(0xffffffffffffffff, 0x40049409, 0xffffffffffffffff) ioctl$EXT4_IOC_GROUP_EXTEND(0xffffffffffffffff, 0x40046607, 0x0) ioctl$PPPIOCGFLAGS1(0xffffffffffffffff, 0x8004745a, 0x0) dup(0xffffffffffffffff) shutdown(r1, 0x1) setsockopt(r1, 0x0, 0x1, &(0x7f0000000000)="1d", 0x1) sendto$inet6(r2, &(0x7f0000000300)='A', 0x1, 0x0, 0x0, 0x0) 14:10:09 executing program 0: ptrace$PTRACE_SECCOMP_GET_FILTER(0x420c, 0x0, 0x0, 0x0) [ 229.163735] Can not set IPV6_FL_F_REFLECT if flowlabel_consistency sysctl is enable [ 229.185066] Can not set IPV6_FL_F_REFLECT if flowlabel_consistency sysctl is enable 14:10:09 executing program 2: perf_event_open(&(0x7f000001d000)={0x2, 0x70, 0x41, 0x8001, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mprotect(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x1000000) [ 229.252284] device sit0 entered promiscuous mode [ 229.279022] device sit0 left promiscuous mode 14:10:09 executing program 3: 14:10:09 executing program 0: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000140)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'vet\x00\x00\x00\x00\x00\x00\x00\x00\x00\xbdh\x00', 0x43732e5398416f16}) ioctl$TUNSETQUEUE(r0, 0x400454d9, &(0x7f0000001640)={'syzkaller1\x00', 0x401}) ioctl$TUNATTACHFILTER(r0, 0x401054d5, &(0x7f00000000c0)={0x0, 0x0}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a40)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000180)={'vet\x00\x00\x00\x00\x00\x00\x00\x00\x04\x00', 0x43732e5398416f1a}) 14:10:09 executing program 5: 14:10:09 executing program 4: r0 = creat(&(0x7f0000000700)='./bus\x00', 0x0) r1 = creat(&(0x7f0000000380)='./bus\x00', 0x0) io_setup(0xef, &(0x7f0000000040)=0x0) io_submit(r2, 0x1, &(0x7f0000000540)=[&(0x7f00000000c0)={0x0, 0x0, 0x0, 0x1, 0x0, r1, &(0x7f0000000000), 0x377140be6b5ef4c7}]) ioctl$FS_IOC_FIEMAP(r0, 0xc020660b, &(0x7f0000000180)={0x0, 0x7, 0x0, 0x0, 0x1, [{}]}) 14:10:09 executing program 2: pipe(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) syz_open_procfs(0xffffffffffffffff, &(0x7f0000000040)='oom_score_adj\x00') write$binfmt_misc(r1, &(0x7f00000002c0)=ANY=[@ANYRESOCT], 0x2da4df39) splice(r0, 0x0, r2, 0x0, 0x8100000, 0x0) 14:10:09 executing program 3: 14:10:09 executing program 5: 14:10:09 executing program 3: 14:10:09 executing program 5: 14:10:09 executing program 1: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f0000000040)={0xa, 0x4e22}, 0x1c) listen(r0, 0xeb) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) sendto$inet6(r1, 0x0, 0x0, 0x20000004, &(0x7f0000000140), 0x1c) readv(r1, &(0x7f0000000700)=[{&(0x7f0000000440)=""/132, 0x31}], 0x1) prctl$PR_MCE_KILL_GET(0x22) timerfd_create(0x0, 0x0) r2 = accept4(r0, 0x0, 0x0, 0x0) socket$inet6_udplite(0xa, 0x2, 0x88) setsockopt$packet_fanout(0xffffffffffffffff, 0x107, 0x12, 0x0, 0x309) ioctl$FICLONE(0xffffffffffffffff, 0x40049409, 0xffffffffffffffff) ioctl$EXT4_IOC_GROUP_EXTEND(0xffffffffffffffff, 0x40046607, 0x0) ioctl$PPPIOCGFLAGS1(0xffffffffffffffff, 0x8004745a, 0x0) dup(0xffffffffffffffff) shutdown(r1, 0x1) setsockopt(r1, 0x0, 0x1, &(0x7f0000000000)="1d", 0x1) sendto$inet6(r2, &(0x7f0000000300)='A', 0x1, 0x0, 0x0, 0x0) 14:10:09 executing program 3: 14:10:09 executing program 5: 14:10:09 executing program 0: 14:10:09 executing program 4: 14:10:09 executing program 3: 14:10:09 executing program 0: 14:10:10 executing program 2: 14:10:10 executing program 5: 14:10:10 executing program 4: 14:10:10 executing program 3: 14:10:10 executing program 0: 14:10:10 executing program 1: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f0000000040)={0xa, 0x4e22}, 0x1c) listen(r0, 0xeb) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) sendto$inet6(r1, 0x0, 0x0, 0x20000004, &(0x7f0000000140), 0x1c) readv(r1, &(0x7f0000000700)=[{&(0x7f0000000440)=""/132, 0x31}], 0x1) prctl$PR_MCE_KILL_GET(0x22) timerfd_create(0x0, 0x0) r2 = accept4(r0, 0x0, 0x0, 0x0) socket$inet6_udplite(0xa, 0x2, 0x88) setsockopt$packet_fanout(0xffffffffffffffff, 0x107, 0x12, 0x0, 0x309) ioctl$FICLONE(0xffffffffffffffff, 0x40049409, 0xffffffffffffffff) ioctl$EXT4_IOC_GROUP_EXTEND(0xffffffffffffffff, 0x40046607, 0x0) ioctl$PPPIOCGFLAGS1(0xffffffffffffffff, 0x8004745a, 0x0) dup(0xffffffffffffffff) shutdown(r1, 0x1) setsockopt(r1, 0x0, 0x1, &(0x7f0000000000)="1d", 0x1) sendto$inet6(r2, &(0x7f0000000300)='A', 0x1, 0x0, 0x0, 0x0) 14:10:10 executing program 3: 14:10:10 executing program 4: 14:10:10 executing program 0: 14:10:10 executing program 5: 14:10:10 executing program 2: 14:10:10 executing program 4: 14:10:10 executing program 0: 14:10:10 executing program 2: pipe(&(0x7f0000000e40)={0xffffffffffffffff}) write(0xffffffffffffffff, 0x0, 0x0) read(r0, &(0x7f0000000200)=""/250, 0x50c7e3e3) r1 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r1, &(0x7f0000000040)={0x2, 0x4e23, @broadcast}, 0x10) sendto$inet(r1, 0x0, 0x0, 0x400200007fd, &(0x7f0000000000)={0x2, 0x4e23, @loopback}, 0x10) bind$inet(0xffffffffffffffff, 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, 0x0) ioctl$UI_SET_ABSBIT(0xffffffffffffffff, 0x40045567, 0x0) ioctl$FS_IOC_FSSETXATTR(0xffffffffffffffff, 0x401c5820, 0x0) write$binfmt_elf64(r1, &(0x7f00000016c0)=ANY=[@ANYPTR=&(0x7f00000005c0)=ANY=[@ANYPTR=&(0x7f00000004c0)=ANY=[@ANYRES16], @ANYRES32, @ANYRES64=0x0, @ANYPTR=&(0x7f0000000580)=ANY=[@ANYPTR64, @ANYRESHEX, @ANYPTR64, @ANYRES32=0x0]], @ANYRESDEC, @ANYRES16], 0xffffff84) recvmsg(r1, &(0x7f0000000240)={&(0x7f0000000740)=@nfc, 0x80, &(0x7f00000001c0)=[{&(0x7f0000003ac0)=""/4096, 0x20013a5a}], 0x1, &(0x7f0000000200)=""/20, 0x14}, 0x100) 14:10:10 executing program 3: mkdir(0x0, 0x0) r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000000)='/dev/uinput\x00', 0x2, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = getpid() sched_setscheduler(r1, 0x5, &(0x7f0000000000)) write$uinput_user_dev(r0, &(0x7f0000000400)={'syz1\x00', {}, 0x0, [], [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9]}, 0x45c) ioctl$UI_DEV_SETUP(r0, 0x5501, 0x0) ioctl$UI_DEV_DESTROY(r0, 0x5502) 14:10:10 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) dup3(r0, r1, 0x80000) 14:10:10 executing program 4: socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_ifreq(r0, 0x89f0, &(0x7f0000000040)={'bond0\x00\x0f\x00@G\xd0\x06\x00\x04\x00', @ifru_names='bond_slave_1\x00\x00\x03/'}) [ 231.062981] input: syz1 as /devices/virtual/input/input9 [ 231.109727] input: syz1 as /devices/virtual/input/input10 14:10:11 executing program 1: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f0000000040)={0xa, 0x4e22}, 0x1c) listen(r0, 0xeb) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) sendto$inet6(r1, 0x0, 0x0, 0x20000004, &(0x7f0000000140), 0x1c) readv(r1, &(0x7f0000000700)=[{&(0x7f0000000440)=""/132, 0x31}], 0x1) prctl$PR_MCE_KILL_GET(0x22) timerfd_create(0x0, 0x0) r2 = accept4(r0, 0x0, 0x0, 0x0) socket$inet6_udplite(0xa, 0x2, 0x88) setsockopt$packet_fanout(0xffffffffffffffff, 0x107, 0x12, 0x0, 0x309) ioctl$FICLONE(0xffffffffffffffff, 0x40049409, 0xffffffffffffffff) ioctl$EXT4_IOC_GROUP_EXTEND(0xffffffffffffffff, 0x40046607, 0x0) ioctl$PPPIOCGFLAGS1(0xffffffffffffffff, 0x8004745a, 0x0) dup(0xffffffffffffffff) shutdown(r1, 0x1) setsockopt(r1, 0x0, 0x1, &(0x7f0000000000)="1d", 0x1) sendto$inet6(r2, &(0x7f0000000300)='A', 0x1, 0x0, 0x0, 0x0) 14:10:11 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) dup3(r0, r1, 0x80000) 14:10:11 executing program 0: r0 = inotify_init1(0x0) r1 = dup(r0) ioctl$sock_SIOCINQ(r1, 0x541b, &(0x7f0000000000)) 14:10:11 executing program 4: r0 = openat$full(0xffffffffffffff9c, &(0x7f0000000000)='/dev/full\x00', 0x0, 0x0) ioctl$sock_inet6_udp_SIOCINQ(0xffffffffffffffff, 0x541b, 0x0) ioctl$sock_TIOCINQ(r0, 0x541b, 0x0) 14:10:11 executing program 3: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00003b9fdc)) r1 = syz_open_pts(r0, 0x0) dup3(r1, r0, 0x0) 14:10:11 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) dup3(r0, r1, 0x80000) 14:10:11 executing program 0: r0 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r0, &(0x7f0000000100)={0xa, 0x0, 0x0, @dev, 0x4}, 0x1c) connect$inet6(r0, &(0x7f00000000c0)={0xa, 0x0, 0x0, @ipv4={[], [], @multicast1}}, 0x1c) 14:10:11 executing program 4: inotify_init() inotify_add_watch(0xffffffffffffffff, 0x0, 0x0) r0 = open(&(0x7f0000000040)='./file0\x00', 0x200c2, 0x0) inotify_add_watch(0xffffffffffffffff, 0x0, 0x0) write$binfmt_elf64(r0, 0x0, 0x0) 14:10:11 executing program 2: open(0x0, 0x0, 0x0) write$P9_RREMOVE(0xffffffffffffffff, 0x0, 0xfffffffffffffe5b) r0 = gettid() getsockopt$sock_linger(0xffffffffffffffff, 0x1, 0xd, 0x0, 0x0) ioctl$TIOCMGET(0xffffffffffffffff, 0x5415, 0x0) ioctl$VT_DISALLOCATE(0xffffffffffffffff, 0x5608) setrlimit(0x0, 0x0) ioctl$TIOCGETD(0xffffffffffffffff, 0x5452, 0x0) timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) write$P9_RMKDIR(0xffffffffffffffff, 0x0, 0x0) timer_settime(0x0, 0x0, &(0x7f0000000080)={{0x0, 0x1c9c380}, {0x0, 0x9}}, 0x0) ioctl$FS_IOC_FIEMAP(0xffffffffffffffff, 0xc020660b, 0x0) tkill(r0, 0x1000000000016) 14:10:11 executing program 3: r0 = syz_open_dev$loop(&(0x7f0000000000)='/dev/loop#\x00', 0x0, 0x4000010004002) ioctl$BLKSECDISCARD(r0, 0x127d, &(0x7f0000000180)) 14:10:11 executing program 5: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) fstat(0xffffffffffffffff, 0x0) r0 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000280)='/dev/loop-control\x00', 0x0, 0x0) ioctl$LOOP_CTL_REMOVE(r0, 0x4c81, 0x0) 14:10:11 executing program 0: sendmmsg(0xffffffffffffffff, 0x0, 0x0, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) keyctl$restrict_keyring(0x1d, 0x0, &(0x7f0000000200)='keyring\x00', &(0x7f0000000240)='/dev/loop-control\x00') getsockopt$IP6T_SO_GET_ENTRIES(0xffffffffffffffff, 0x29, 0x41, 0x0, 0x0) r0 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000280)='/dev/loop-control\x00', 0x3f, 0x0) ioctl$LOOP_CTL_REMOVE(r0, 0x4c81, 0x0) ioctl$LOOP_CTL_ADD(r0, 0x4c80, 0x0) setsockopt$ARPT_SO_SET_REPLACE(0xffffffffffffffff, 0x0, 0x60, 0x0, 0x0) write$P9_RXATTRCREATE(0xffffffffffffffff, 0x0, 0x0) 14:10:12 executing program 1: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f0000000040)={0xa, 0x4e22}, 0x1c) listen(r0, 0xeb) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) sendto$inet6(r1, 0x0, 0x0, 0x20000004, &(0x7f0000000140)={0xa, 0x4e22}, 0x1c) readv(0xffffffffffffffff, &(0x7f0000000700)=[{&(0x7f0000000440)=""/132, 0x31}], 0x1) prctl$PR_MCE_KILL_GET(0x22) timerfd_create(0x0, 0x0) r2 = accept4(r0, 0x0, 0x0, 0x0) socket$inet6_udplite(0xa, 0x2, 0x88) setsockopt$packet_fanout(0xffffffffffffffff, 0x107, 0x12, 0x0, 0x309) ioctl$FICLONE(0xffffffffffffffff, 0x40049409, 0xffffffffffffffff) ioctl$EXT4_IOC_GROUP_EXTEND(0xffffffffffffffff, 0x40046607, 0x0) ioctl$PPPIOCGFLAGS1(0xffffffffffffffff, 0x8004745a, 0x0) dup(0xffffffffffffffff) shutdown(r1, 0x1) setsockopt(r1, 0x0, 0x1, &(0x7f0000000000)="1d", 0x1) sendto$inet6(r2, &(0x7f0000000300)='A', 0x1, 0x0, 0x0, 0x0) 14:10:12 executing program 4: socketpair$unix(0x1, 0xfffffffffffffffe, 0x0, &(0x7f0000000180)) add_key$keyring(&(0x7f0000000100)='keyring\x00', &(0x7f0000000140)={'syz'}, 0x0, 0x0, 0x0) openat$ptmx(0xffffffffffffff9c, 0x0, 0x0, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) signalfd(0xffffffffffffffff, 0x0, 0x0) read(0xffffffffffffffff, 0x0, 0x0) signalfd(0xffffffffffffffff, 0x0, 0x0) open$dir(0x0, 0x0, 0x0) ioctl$sock_SIOCGPGRP(0xffffffffffffffff, 0x8904, 0x0) openat(0xffffffffffffffff, 0x0, 0x0, 0x0) ioctl$RTC_UIE_ON(0xffffffffffffffff, 0x7003) ioctl$sock_SIOCSPGRP(0xffffffffffffffff, 0x8902, 0x0) ioctl$sock_FIOGETOWN(0xffffffffffffffff, 0x8903, 0xfffffffffffffffd) r1 = socket$inet6(0xa, 0x400000000001, 0x0) r2 = dup(r1) setsockopt$inet6_tcp_int(r1, 0x6, 0xa, &(0x7f0000000000)=0x81, 0x4) bind$inet6(r1, &(0x7f00000000c0)={0xa, 0x4e20}, 0x1c) sendto$inet6(r1, 0x0, 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) setsockopt$inet6_opts(r1, 0x29, 0x36, &(0x7f0000000300)=ANY=[@ANYBLOB="1bace8fb08f48e38346017338c25fdabab1dff3183ba8626a2351a001a25ad439ed0e9dc2b5a109b73d72b61197fbe41d998ea46ff30159527fc8f3478ac4afd5d73e1f1ef003d323845ab959f938b255ea998751ab88b151da42e5605d7fe319dc1651b4af10ef282f78fa38c7b49486f9758bffb54406e014112af64f81fd47957542b3e1bce3a544b3d894b1c861d6d4ce649e46abae649804f2fc7c756a2b9444521d543eed27027686091ddf72d91a58fb02f543cf31ba0ad9a0dd6755ba3f0ad41edb5bd62a69bd44f5e6961ba08577909f4dbc12e6fa0a82de4b955"], 0x1) setsockopt$inet6_int(r2, 0x29, 0x33, &(0x7f0000000100)=0x5, 0x4) r3 = open(&(0x7f0000000040)='./bus\x00', 0x141042, 0x0) ftruncate(r3, 0x7fff) sendfile(r2, r3, &(0x7f0000d83ff8), 0x8000fffffffe) 14:10:12 executing program 3: lsetxattr(&(0x7f00000000c0)='./file0\x00', &(0x7f0000000100)=@random={'user.', '(proc:\x00'}, &(0x7f0000000140)='y\x00', 0x2, 0x2) prctl$PR_SET_ENDIAN(0x14, 0x0) statfs(&(0x7f0000000180)='./file0\x00', &(0x7f00000001c0)=""/137) pipe2(&(0x7f0000000280)={0xffffffffffffffff, 0xffffffffffffffff}, 0x800) ioctl$FIONREAD(r0, 0x541b, &(0x7f00000002c0)) fchmodat(r0, &(0x7f0000000300)='./file0\x00', 0x1) ioctl$ifreq_SIOCGIFINDEX_team(0xffffffffffffffff, 0x8933, 0x0) write$P9_RREADLINK(r1, &(0x7f0000007e00)={0x10, 0x17, 0x1, {0x7, './file0'}}, 0x10) lseek(r1, 0x0, 0x3) 14:10:12 executing program 5: r0 = perf_event_open(&(0x7f0000000000)={0x2, 0x70, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000080)='io\x00') sendfile(r0, r1, 0x0, 0x5) 14:10:12 executing program 2: socketpair$unix(0x1, 0x0, 0x0, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) mmap(&(0x7f0000000000/0xdf5000)=nil, 0x7fffdffff000, 0x0, 0x32, 0xffffffffffffffff, 0x0) 14:10:12 executing program 0: clone(0x2302001ffe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) wait4(0x0, 0x0, 0x80000000, 0x0) r0 = gettid() pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) write(r1, &(0x7f00000001c0), 0xfffffef3) ptrace(0x4206, r0) tkill(r0, 0x9) 14:10:12 executing program 2: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c12a41d88b070") r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r1, 0x29, 0x1b, &(0x7f00000002c0)={@remote, 0x1}, 0x20) 14:10:12 executing program 5: mkdir(0x0, 0x0) r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000000)='/dev/uinput\x00', 0x2, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = getpid() sched_setscheduler(r1, 0x5, &(0x7f0000000000)) write$uinput_user_dev(r0, &(0x7f0000000400)={'syz1\x00', {}, 0x0, [], [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9], [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10000], [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4000000000000, 0x0, 0x0, 0x0, 0x2]}, 0x45c) ioctl$UI_DEV_SETUP(r0, 0x5501, &(0x7f0000000300)={{}, 'syz0\x00'}) 14:10:12 executing program 3: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000000)='/dev/uinput\x00', 0x2, 0x0) r1 = getpid() sched_setscheduler(r1, 0x5, &(0x7f0000000000)) write$uinput_user_dev(r0, &(0x7f0000000400)={'syz1\x00', {}, 0x0, [], [], [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10000], [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4000000000000, 0x0, 0x0, 0x0, 0x2]}, 0x45c) ioctl$UI_DEV_SETUP(r0, 0x5501, 0x0) ioctl$UI_DEV_DESTROY(r0, 0x5502) 14:10:12 executing program 2: mkdir(0x0, 0x4) r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000000)='/dev/uinput\x00', 0x2, 0x0) setxattr$security_smack_entry(&(0x7f00000001c0)='./file0\x00', &(0x7f0000000a80)='security.SMAC\x00\x00\x01\x00MAP\x00`\xef8a\xe8\xec\xdb\xf7\xd4\x95\xe0\x9bv\x04\xb4\xd3\xd9\xc9J\x0e\xef\x8c\x10`\xe2`ky\x99\x12\xd7\xd2\xa4\xe7\xc6\xf0}\xda\xe2\x89\x1c\xfc\xe1\x14\x16 \x96', &(0x7f0000000280)='syz1\x00', 0xffffffffffffffe8, 0x40002) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) getpid() write$uinput_user_dev(r0, &(0x7f0000000400)={'syz1\x00', {}, 0x25, [], [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9], [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10000], [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4000000000000]}, 0x45c) ioctl$UI_DEV_SETUP(r0, 0x5501, &(0x7f0000000300)={{}, 'syz0\x00'}) ioctl$UI_DEV_DESTROY(r0, 0x5502) 14:10:12 executing program 4: r0 = socket(0x44000000002, 0x3, 0x67) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000000)='bridge0\x00', 0x10) sendmsg$unix(r0, &(0x7f0000000300)={&(0x7f00000000c0)=@abs={0x0, 0x0, 0x4e24}, 0x6e, &(0x7f0000000400)=[{&(0x7f0000000440)="00f4c4bc", 0x4}], 0x1}, 0x4008000) sendto$unix(r0, 0x0, 0x0, 0x0, &(0x7f0000000040)=@abs={0x0, 0x0, 0xd0000e0}, 0x6e) 14:10:12 executing program 1: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f0000000040)={0xa, 0x4e22}, 0x1c) listen(r0, 0xeb) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) sendto$inet6(r1, 0x0, 0x0, 0x20000004, &(0x7f0000000140)={0xa, 0x4e22}, 0x1c) readv(0xffffffffffffffff, &(0x7f0000000700)=[{&(0x7f0000000440)=""/132, 0x31}], 0x1) prctl$PR_MCE_KILL_GET(0x22) timerfd_create(0x0, 0x0) r2 = accept4(r0, 0x0, 0x0, 0x0) socket$inet6_udplite(0xa, 0x2, 0x88) setsockopt$packet_fanout(0xffffffffffffffff, 0x107, 0x12, 0x0, 0x309) ioctl$FICLONE(0xffffffffffffffff, 0x40049409, 0xffffffffffffffff) ioctl$EXT4_IOC_GROUP_EXTEND(0xffffffffffffffff, 0x40046607, 0x0) ioctl$PPPIOCGFLAGS1(0xffffffffffffffff, 0x8004745a, 0x0) dup(0xffffffffffffffff) shutdown(r1, 0x1) setsockopt(r1, 0x0, 0x1, &(0x7f0000000000)="1d", 0x1) sendto$inet6(r2, &(0x7f0000000300)='A', 0x1, 0x0, 0x0, 0x0) [ 232.736558] input: syz1 as /devices/virtual/input/input12 [ 232.743848] input: syz1 as /devices/virtual/input/input11 14:10:12 executing program 4: r0 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x80000000000002, &(0x7f00000000c0)=0x2000000000000074, 0x25d) bind$inet(r0, &(0x7f0000000140)={0x2, 0x4e23, @multicast1}, 0x10) setsockopt$SO_ATTACH_FILTER(r0, 0x1, 0x1a, &(0x7f0000b86000)={0x1, &(0x7f0000f40ff8)=[{0x6, 0x0, 0x0, 0xe8}]}, 0x10) sendto$inet(r0, 0x0, 0x0, 0x200007fd, &(0x7f0000e68000)={0x2, 0x4e23, @local}, 0x10) write(r0, &(0x7f0000000fc0)="7c43654e200fc615e2060f41cf4529a030d84ed21fe0386e9d450d0e2df4888f984d5fa9b7c8603dfc59fb1e32d87cd4c34450d43f681b257928b8e9d1082de5ae617ce96488be561f5c9dbb7df95783fae34854061ae16613daab19b1192118f99ab3b0db89d282b64149e8f0879862904036d672fcb65f9cee07336e1fae40d985471512a9e1e07d86db1ceb256beb1a0c24470f854023bd41d1fe20a20e775939212fc7ccc2bbf3aba9fe296cceb93c7cc70ecea4dfaf7bfce1fc4efdba28661952046f291af9a90940d6f574427fbdefce3c93b0aca01869d2cb18d41173bb38dbfda2d53c0583f78b4b46d93bdfed1f7fdfb94e9922c499b0a1b10638f15a36ac917ec265ffecd19f9388d035884dafeeb6220ad485a7356441438203f45c2b0ef53843a6a9349fcf22c817e7be7b5ee1f20b6f1a755b6f3ebdd6af3c7050cf326591f6aa79683e384ea8f89aec99706eb976cf896b7969ec753691650b0968ca6ec5b44a3eea05af7a071dfc6a5c2b0d096b3c9f1d94a26ff61bdba0766d769499f459850c4d721e8ee8ea6b51c93442e98c03fadb", 0x198) 14:10:12 executing program 1: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f0000000040)={0xa, 0x4e22}, 0x1c) listen(r0, 0xeb) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) sendto$inet6(r1, 0x0, 0x0, 0x20000004, &(0x7f0000000140)={0xa, 0x4e22}, 0x1c) readv(0xffffffffffffffff, &(0x7f0000000700)=[{&(0x7f0000000440)=""/132, 0x31}], 0x1) prctl$PR_MCE_KILL_GET(0x22) timerfd_create(0x0, 0x0) r2 = accept4(r0, 0x0, 0x0, 0x0) socket$inet6_udplite(0xa, 0x2, 0x88) setsockopt$packet_fanout(0xffffffffffffffff, 0x107, 0x12, 0x0, 0x309) ioctl$FICLONE(0xffffffffffffffff, 0x40049409, 0xffffffffffffffff) ioctl$EXT4_IOC_GROUP_EXTEND(0xffffffffffffffff, 0x40046607, 0x0) ioctl$PPPIOCGFLAGS1(0xffffffffffffffff, 0x8004745a, 0x0) dup(0xffffffffffffffff) shutdown(r1, 0x1) setsockopt(r1, 0x0, 0x1, &(0x7f0000000000)="1d", 0x1) sendto$inet6(r2, &(0x7f0000000300)='A', 0x1, 0x0, 0x0, 0x0) [ 232.840886] input: syz1 as /devices/virtual/input/input13 14:10:12 executing program 4: ioctl$PIO_FONT(0xffffffffffffffff, 0x4b61, &(0x7f0000001240)="935d1f824720f3fc081a670d") r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ptmx\x00', 0x3d, 0x0) write$binfmt_aout(r0, &(0x7f00000000c0)=ANY=[], 0xffffff78) ioctl$TCSETS(r0, 0x40045431, &(0x7f00003b9fdc)) r1 = syz_open_pts(r0, 0x0) dup3(r1, r0, 0x0) read(r0, &(0x7f00000000c0)=""/19, 0x1b43d048) [ 232.927536] input: syz1 as /devices/virtual/input/input14 [ 232.942311] input: syz1 as /devices/virtual/input/input15 14:10:12 executing program 2: socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)) r0 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000100)='/dev/rtc0\x00', 0x8000, 0x0) openat$rtc(0xffffffffffffff9c, &(0x7f0000000380)='/dev/rtc0\x00', 0x100, 0x0) r1 = dup3(r0, r0, 0x80000) pipe(&(0x7f00000003c0)) open(&(0x7f00000002c0)='./file0\x00', 0x2, 0x14) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0xfff) pipe(&(0x7f00000000c0)) rt_sigprocmask(0x0, &(0x7f0000032ff8)={0xfffffffffffffffe}, 0x0, 0x8) r2 = openat$full(0xffffffffffffff9c, &(0x7f0000000000)='/dev/full\x00', 0x80, 0x0) openat$cgroup_ro(r2, &(0x7f0000000240)='cpuset.effective_cpus\x00', 0x0, 0x0) preadv(r2, &(0x7f0000000580)=[{&(0x7f00000009c0)=""/148, 0xfffffffffffffc3b}], 0x1, 0xffffffffffffffff) perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0xee6b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$TIOCGPGRP(0xffffffffffffffff, 0x540f, 0x0) gettid() syz_open_procfs(0x0, 0x0) ioctl$TIOCGPGRP(0xffffffffffffffff, 0x540f, 0x0) ioctl$RTC_AIE_OFF(0xffffffffffffffff, 0x7002) getpgid(0x0) preadv(0xffffffffffffffff, 0x0, 0x0, 0x0) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x0) add_key$user(0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd) add_key(&(0x7f0000000040)='cifs.spnego\x00', &(0x7f0000000080)={'syz', 0x2}, &(0x7f0000000300)="da6adb2fe1d8b0169ba96da4af4a0543b6190df7bec5c2f28c59a1b2e3ca8d241ee09e21d5f6bf6683ced2a44460fe2d1905138ed2ca4076bd7ff9a332ff27afaaf435b0a2c37b2ac04ba74ce1d7db8c179b1264b31139e1999a2175c96d71b159a0b33917e0a40195af05076adeee001c777b1ff444cad6b48955f67692", 0x7e, 0xfffffffffffffff9) request_key(0x0, 0x0, 0x0, 0xfffffffffffffffa) request_key(0x0, 0x0, 0x0, 0x0) keyctl$search(0xa, 0x0, 0x0, 0x0, 0x0) memfd_create(0x0, 0x0) r3 = socket$inet6(0xa, 0x400000000001, 0x0) setsockopt$inet6_tcp_int(r3, 0x6, 0x19, &(0x7f000074fffc)=0x3, 0x348) r4 = dup(r3) setsockopt$inet6_tcp_int(r4, 0x6, 0x20000000000002, &(0x7f00007b1000)=0x81, 0x4) bind$inet6(r3, &(0x7f0000000180)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) sendto$inet6(r3, 0x0, 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) sendmmsg(r4, &(0x7f0000001740)=[{{0x0, 0x0, &(0x7f0000000280)=[{&(0x7f0000000400)="92ac24fe0b6252164b2f849f70d117893e5bc9e3ef65ea08e9c69a1cca3f6364d5dc7a2bcbf6c1dd5ec4c7c4032edb85980a11b15d5f36a00ae2a7d791d7604b92346cb6cf27a84b4c59a8f44676914ce072fa029ed9580cc4904eb91bc0224ae0c0958f83085f9f5208d16e98056d37343d579bd7ce", 0x76}], 0x1}}, {{0x0, 0x0, 0x0}}], 0x2, 0x1) 14:10:12 executing program 1: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f0000000040)={0xa, 0x4e22}, 0x1c) listen(r0, 0xeb) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) sendto$inet6(r1, 0x0, 0x0, 0x20000004, &(0x7f0000000140)={0xa, 0x4e22}, 0x1c) readv(r1, 0x0, 0x0) prctl$PR_MCE_KILL_GET(0x22) timerfd_create(0x0, 0x0) r2 = accept4(r0, 0x0, 0x0, 0x0) socket$inet6_udplite(0xa, 0x2, 0x88) setsockopt$packet_fanout(0xffffffffffffffff, 0x107, 0x12, 0x0, 0x309) ioctl$FICLONE(0xffffffffffffffff, 0x40049409, 0xffffffffffffffff) ioctl$EXT4_IOC_GROUP_EXTEND(0xffffffffffffffff, 0x40046607, 0x0) ioctl$PPPIOCGFLAGS1(0xffffffffffffffff, 0x8004745a, 0x0) dup(0xffffffffffffffff) shutdown(r1, 0x1) setsockopt(r1, 0x0, 0x1, &(0x7f0000000000)="1d", 0x1) sendto$inet6(r2, &(0x7f0000000300)='A', 0x1, 0x0, 0x0, 0x0) 14:10:15 executing program 0: socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)) r0 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000100)='/dev/rtc0\x00', 0x8000, 0x0) openat$rtc(0xffffffffffffff9c, &(0x7f0000000380)='/dev/rtc0\x00', 0x100, 0x0) r1 = dup3(r0, r0, 0x80000) pipe(&(0x7f00000003c0)) open(&(0x7f00000002c0)='./file0\x00', 0x2, 0x14) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0xfff) pipe(&(0x7f00000000c0)) rt_sigprocmask(0x0, &(0x7f0000032ff8)={0xfffffffffffffffe}, 0x0, 0x8) r2 = openat$full(0xffffffffffffff9c, &(0x7f0000000000)='/dev/full\x00', 0x80, 0x0) openat$cgroup_ro(r2, &(0x7f0000000240)='cpuset.effective_cpus\x00', 0x0, 0x0) preadv(r2, &(0x7f0000000580)=[{&(0x7f00000009c0)=""/148, 0xfffffffffffffc3b}], 0x1, 0xffffffffffffffff) perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0xee6b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$TIOCGPGRP(0xffffffffffffffff, 0x540f, 0x0) gettid() syz_open_procfs(0x0, 0x0) ioctl$TIOCGPGRP(0xffffffffffffffff, 0x540f, 0x0) ioctl$RTC_AIE_OFF(0xffffffffffffffff, 0x7002) getpgid(0x0) preadv(0xffffffffffffffff, 0x0, 0x0, 0x0) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x0) add_key$user(0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd) add_key(&(0x7f0000000040)='cifs.spnego\x00', &(0x7f0000000080)={'syz', 0x2}, &(0x7f0000000300)="da6adb2fe1d8b0169ba96da4af4a0543b6190df7bec5c2f28c59a1b2e3ca8d241ee09e21d5f6bf6683ced2a44460fe2d1905138ed2ca4076bd7ff9a332ff27afaaf435b0a2c37b2ac04ba74ce1d7db8c179b1264b31139e1999a2175c96d71b159a0b33917e0a40195af05076adeee001c777b1ff444cad6b48955f67692", 0x7e, 0xfffffffffffffff9) request_key(0x0, 0x0, 0x0, 0xfffffffffffffffa) request_key(0x0, 0x0, 0x0, 0x0) keyctl$search(0xa, 0x0, 0x0, 0x0, 0x0) memfd_create(0x0, 0x0) r3 = socket$inet6(0xa, 0x400000000001, 0x0) setsockopt$inet6_tcp_int(r3, 0x6, 0x19, &(0x7f000074fffc)=0x3, 0x348) r4 = dup(r3) setsockopt$inet6_tcp_int(r4, 0x6, 0x20000000000002, &(0x7f00007b1000)=0x81, 0x4) bind$inet6(r3, &(0x7f0000000180)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) sendto$inet6(r3, 0x0, 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) sendmmsg(r4, &(0x7f0000001740)=[{{0x0, 0x0, &(0x7f0000000280)=[{&(0x7f0000000400)="92ac24fe0b6252164b2f849f70d117893e5bc9e3ef65ea08e9c69a1cca3f6364d5dc7a2bcbf6c1dd5ec4c7c4032edb85980a11b15d5f36a00ae2a7d791d7604b92346cb6cf27a84b4c59a8f44676914ce072fa029ed9580cc4904eb91bc0224ae0c0958f83085f9f5208d16e98056d37343d579bd7ce", 0x76}], 0x1}}, {{0x0, 0x0, 0x0}}], 0x2, 0x1) 14:10:15 executing program 3: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000000)='/dev/uinput\x00', 0x2, 0x0) r1 = getpid() sched_setscheduler(r1, 0x5, &(0x7f0000000000)) write$uinput_user_dev(r0, &(0x7f0000000400)={'syz1\x00', {}, 0x0, [], [], [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10000], [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4000000000000, 0x0, 0x0, 0x0, 0x2]}, 0x45c) ioctl$UI_DEV_SETUP(r0, 0x5501, 0x0) ioctl$UI_DEV_DESTROY(r0, 0x5502) 14:10:15 executing program 2: socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)) r0 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000100)='/dev/rtc0\x00', 0x8000, 0x0) openat$rtc(0xffffffffffffff9c, &(0x7f0000000380)='/dev/rtc0\x00', 0x100, 0x0) r1 = dup3(r0, r0, 0x80000) pipe(&(0x7f00000003c0)) open(&(0x7f00000002c0)='./file0\x00', 0x2, 0x14) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0xfff) pipe(&(0x7f00000000c0)) rt_sigprocmask(0x0, &(0x7f0000032ff8)={0xfffffffffffffffe}, 0x0, 0x8) r2 = openat$full(0xffffffffffffff9c, &(0x7f0000000000)='/dev/full\x00', 0x80, 0x0) openat$cgroup_ro(r2, &(0x7f0000000240)='cpuset.effective_cpus\x00', 0x0, 0x0) preadv(r2, &(0x7f0000000580)=[{&(0x7f00000009c0)=""/148, 0xfffffffffffffc3b}], 0x1, 0xffffffffffffffff) perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0xee6b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$TIOCGPGRP(0xffffffffffffffff, 0x540f, 0x0) gettid() syz_open_procfs(0x0, 0x0) ioctl$TIOCGPGRP(0xffffffffffffffff, 0x540f, 0x0) ioctl$RTC_AIE_OFF(0xffffffffffffffff, 0x7002) getpgid(0x0) preadv(0xffffffffffffffff, 0x0, 0x0, 0x0) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x0) add_key$user(0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd) add_key(&(0x7f0000000040)='cifs.spnego\x00', &(0x7f0000000080)={'syz', 0x2}, &(0x7f0000000300)="da6adb2fe1d8b0169ba96da4af4a0543b6190df7bec5c2f28c59a1b2e3ca8d241ee09e21d5f6bf6683ced2a44460fe2d1905138ed2ca4076bd7ff9a332ff27afaaf435b0a2c37b2ac04ba74ce1d7db8c179b1264b31139e1999a2175c96d71b159a0b33917e0a40195af05076adeee001c777b1ff444cad6b48955f67692", 0x7e, 0xfffffffffffffff9) request_key(0x0, 0x0, 0x0, 0xfffffffffffffffa) request_key(0x0, 0x0, 0x0, 0x0) keyctl$search(0xa, 0x0, 0x0, 0x0, 0x0) memfd_create(0x0, 0x0) r3 = socket$inet6(0xa, 0x400000000001, 0x0) setsockopt$inet6_tcp_int(r3, 0x6, 0x19, &(0x7f000074fffc)=0x3, 0x348) r4 = dup(r3) setsockopt$inet6_tcp_int(r4, 0x6, 0x20000000000002, &(0x7f00007b1000)=0x81, 0x4) bind$inet6(r3, &(0x7f0000000180)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) sendto$inet6(r3, 0x0, 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) sendmmsg(r4, &(0x7f0000001740)=[{{0x0, 0x0, &(0x7f0000000280)=[{&(0x7f0000000400)="92ac24fe0b6252164b2f849f70d117893e5bc9e3ef65ea08e9c69a1cca3f6364d5dc7a2bcbf6c1dd5ec4c7c4032edb85980a11b15d5f36a00ae2a7d791d7604b92346cb6cf27a84b4c59a8f44676914ce072fa029ed9580cc4904eb91bc0224ae0c0958f83085f9f5208d16e98056d37343d579bd7ce", 0x76}], 0x1}}, {{0x0, 0x0, 0x0}}], 0x2, 0x1) 14:10:15 executing program 1: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f0000000040)={0xa, 0x4e22}, 0x1c) listen(r0, 0xeb) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) sendto$inet6(r1, 0x0, 0x0, 0x20000004, &(0x7f0000000140)={0xa, 0x4e22}, 0x1c) readv(r1, 0x0, 0x0) prctl$PR_MCE_KILL_GET(0x22) timerfd_create(0x0, 0x0) r2 = accept4(r0, 0x0, 0x0, 0x0) socket$inet6_udplite(0xa, 0x2, 0x88) setsockopt$packet_fanout(0xffffffffffffffff, 0x107, 0x12, 0x0, 0x309) ioctl$FICLONE(0xffffffffffffffff, 0x40049409, 0xffffffffffffffff) ioctl$EXT4_IOC_GROUP_EXTEND(0xffffffffffffffff, 0x40046607, 0x0) ioctl$PPPIOCGFLAGS1(0xffffffffffffffff, 0x8004745a, 0x0) dup(0xffffffffffffffff) shutdown(r1, 0x1) setsockopt(r1, 0x0, 0x1, &(0x7f0000000000)="1d", 0x1) sendto$inet6(r2, &(0x7f0000000300)='A', 0x1, 0x0, 0x0, 0x0) 14:10:15 executing program 5: mkdir(0x0, 0x0) r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000000)='/dev/uinput\x00', 0x2, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = getpid() sched_setscheduler(r1, 0x5, &(0x7f0000000000)) write$uinput_user_dev(r0, &(0x7f0000000400)={'syz1\x00', {}, 0x0, [], [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9], [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10000], [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4000000000000, 0x0, 0x0, 0x0, 0x2]}, 0x45c) ioctl$UI_DEV_SETUP(r0, 0x5501, &(0x7f0000000300)={{}, 'syz0\x00'}) 14:10:15 executing program 4: ioctl$PIO_FONT(0xffffffffffffffff, 0x4b61, &(0x7f0000001240)="935d1f824720f3fc081a670d") r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ptmx\x00', 0x3d, 0x0) write$binfmt_aout(r0, &(0x7f00000000c0)=ANY=[], 0xffffff78) ioctl$TCSETS(r0, 0x40045431, &(0x7f00003b9fdc)) r1 = syz_open_pts(r0, 0x0) dup3(r1, r0, 0x0) read(r0, &(0x7f00000000c0)=""/19, 0x1b43d048) 14:10:15 executing program 2: socketpair$unix(0x1, 0x0, 0x0, 0x0) ioctl$PIO_FONT(0xffffffffffffffff, 0x4b61, &(0x7f0000001240)="935d1f824720f3fc081a670deb2e07d0998601a3733369a4072358fda9d4f3cc22e945d9cb4396bbb1b26ee97c6275f435de429d0eccca2d7eba97e1c99da629fda1672b30a6c5b09cc3e5b821e711b7209a2094cb057cb150f9305629239cb7ee3c358038869cde19eca3e8894c1f64c445fc64a6559f950a") r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ptmx\x00', 0x3d, 0x0) write$binfmt_aout(r0, &(0x7f00000000c0)=ANY=[], 0xffffff78) ioctl$TCSETS(r0, 0x40045431, &(0x7f00003b9fdc)) ioctl$TCSETA(r0, 0x5406, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x4fbe}) r1 = syz_open_pts(r0, 0x0) r2 = dup3(r1, r0, 0x0) read(r0, &(0x7f00000000c0)=""/19, 0x1b43d048) read(r2, &(0x7f0000000240)=""/4096, 0x1000) 14:10:15 executing program 1: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f0000000040)={0xa, 0x4e22}, 0x1c) listen(r0, 0xeb) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) sendto$inet6(r1, 0x0, 0x0, 0x20000004, &(0x7f0000000140)={0xa, 0x4e22}, 0x1c) readv(r1, 0x0, 0x0) prctl$PR_MCE_KILL_GET(0x22) timerfd_create(0x0, 0x0) r2 = accept4(r0, 0x0, 0x0, 0x0) socket$inet6_udplite(0xa, 0x2, 0x88) setsockopt$packet_fanout(0xffffffffffffffff, 0x107, 0x12, 0x0, 0x309) ioctl$FICLONE(0xffffffffffffffff, 0x40049409, 0xffffffffffffffff) ioctl$EXT4_IOC_GROUP_EXTEND(0xffffffffffffffff, 0x40046607, 0x0) ioctl$PPPIOCGFLAGS1(0xffffffffffffffff, 0x8004745a, 0x0) dup(0xffffffffffffffff) shutdown(r1, 0x1) setsockopt(r1, 0x0, 0x1, &(0x7f0000000000)="1d", 0x1) sendto$inet6(r2, &(0x7f0000000300)='A', 0x1, 0x0, 0x0, 0x0) [ 235.678256] input: syz1 as /devices/virtual/input/input17 [ 235.688825] input: syz1 as /devices/virtual/input/input18 14:10:15 executing program 0: getpeername$unix(0xffffffffffffffff, 0x0, 0x0) r0 = eventfd2(0x0, 0x0) write$binfmt_misc(0xffffffffffffffff, 0x0, 0xfffffd33) fcntl$lock(r0, 0x0, 0x0) 14:10:15 executing program 0: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00003b9fdc)) r1 = syz_open_pts(r0, 0x0) ioctl$TCSETS(r0, 0x5402, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x800000}) poll(&(0x7f0000000040)=[{r1}], 0x1, 0x0) 14:10:15 executing program 0: r0 = epoll_create1(0x0) clone(0x0, 0x0, 0x0, 0x0, 0x0) epoll_pwait(r0, &(0x7f0000000000)=[{}], 0x1, 0x0, 0x0, 0x0) 14:10:15 executing program 1: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f0000000040)={0xa, 0x4e22}, 0x1c) listen(r0, 0xeb) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) sendto$inet6(r1, 0x0, 0x0, 0x20000004, &(0x7f0000000140)={0xa, 0x4e22}, 0x1c) readv(r1, &(0x7f0000000700), 0x0) prctl$PR_MCE_KILL_GET(0x22) timerfd_create(0x0, 0x0) r2 = accept4(r0, 0x0, 0x0, 0x0) socket$inet6_udplite(0xa, 0x2, 0x88) setsockopt$packet_fanout(0xffffffffffffffff, 0x107, 0x12, 0x0, 0x309) ioctl$FICLONE(0xffffffffffffffff, 0x40049409, 0xffffffffffffffff) ioctl$EXT4_IOC_GROUP_EXTEND(0xffffffffffffffff, 0x40046607, 0x0) ioctl$PPPIOCGFLAGS1(0xffffffffffffffff, 0x8004745a, 0x0) dup(0xffffffffffffffff) shutdown(r1, 0x1) setsockopt(r1, 0x0, 0x1, &(0x7f0000000000)="1d", 0x1) sendto$inet6(r2, &(0x7f0000000300)='A', 0x1, 0x0, 0x0, 0x0) 14:10:15 executing program 0: r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000040)='./cgroup.cpu\x00', 0x200002, 0x0) fchdir(r0) r1 = creat(&(0x7f00000002c0)='./bus\x00', 0x0) ftruncate(r1, 0x2081fc) pipe(&(0x7f00000003c0)={0xffffffffffffffff, 0xffffffffffffffff}) write(r3, &(0x7f00000001c0), 0xfffffef3) r4 = open(&(0x7f000000fffa)='./bus\x00', 0x141042, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x800002, 0x11, r4, 0x0) read(r2, &(0x7f0000000000)=""/250, 0x128b9372) 14:10:16 executing program 3: perf_event_open(&(0x7f0000000580)={0x2, 0x70, 0x5c62, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) prctl$PR_SET_SECCOMP(0x16, 0x1, 0x0) 14:10:16 executing program 1: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f0000000040)={0xa, 0x4e22}, 0x1c) listen(r0, 0xeb) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) sendto$inet6(r1, 0x0, 0x0, 0x20000004, &(0x7f0000000140)={0xa, 0x4e22}, 0x1c) readv(r1, &(0x7f0000000700), 0x0) prctl$PR_MCE_KILL_GET(0x22) timerfd_create(0x0, 0x0) r2 = accept4(r0, 0x0, 0x0, 0x0) socket$inet6_udplite(0xa, 0x2, 0x88) setsockopt$packet_fanout(0xffffffffffffffff, 0x107, 0x12, 0x0, 0x309) ioctl$FICLONE(0xffffffffffffffff, 0x40049409, 0xffffffffffffffff) ioctl$EXT4_IOC_GROUP_EXTEND(0xffffffffffffffff, 0x40046607, 0x0) ioctl$PPPIOCGFLAGS1(0xffffffffffffffff, 0x8004745a, 0x0) dup(0xffffffffffffffff) shutdown(r1, 0x1) setsockopt(r1, 0x0, 0x1, &(0x7f0000000000)="1d", 0x1) sendto$inet6(r2, &(0x7f0000000300)='A', 0x1, 0x0, 0x0, 0x0) 14:10:16 executing program 0: r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000040)='./cgroup.cpu\x00', 0x200002, 0x0) fchdir(r0) r1 = creat(&(0x7f00000002c0)='./bus\x00', 0x0) ftruncate(r1, 0x2081fc) pipe(&(0x7f00000003c0)={0xffffffffffffffff, 0xffffffffffffffff}) write(r3, &(0x7f00000001c0), 0xfffffef3) r4 = open(&(0x7f000000fffa)='./bus\x00', 0x141042, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x800002, 0x11, r4, 0x0) read(r2, &(0x7f0000000000)=""/250, 0x128b9372) 14:10:16 executing program 4: r0 = socket$unix(0x1, 0x2, 0x0) readv(0xffffffffffffffff, 0x0, 0x0) getsockname(r0, &(0x7f0000000480)=@pppol2tpv3in6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @loopback}}}, &(0x7f0000000440)=0x80) connect$inet(0xffffffffffffffff, 0x0, 0x103) dup2(r0, r1) gettid() sched_setaffinity(0x0, 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, 0x0) setsockopt$inet6_mreq(r1, 0x29, 0x0, 0x0, 0x0) 14:10:16 executing program 5: recvmmsg(0xffffffffffffffff, &(0x7f0000003140)=[{{&(0x7f0000001540)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @local}}}, 0x80, 0x0}}], 0x1, 0x0, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000140)='net/udp\x00') perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) socket$inet_udp(0x2, 0x2, 0x0) preadv(r0, &(0x7f00000017c0), 0x199, 0x0) [ 236.811818] audit: type=1326 audit(1554214216.717:11): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 pid=6212 comm="syz-executor.3" exe="/root/syz-executor.3" sig=9 arch=c000003e syscall=228 compat=0 ip=0x45b11a code=0x0 14:10:16 executing program 2: socketpair$unix(0x1, 0x0, 0x0, 0x0) ioctl$PIO_FONT(0xffffffffffffffff, 0x4b61, &(0x7f0000001240)="935d1f824720f3fc081a670deb2e07d0998601a3733369a4072358fda9d4f3cc22e945d9cb4396bbb1b26ee97c6275f435de429d0eccca2d7eba97e1c99da629fda1672b30a6c5b09cc3e5b821e711b7209a2094cb057cb150f9305629239cb7ee3c358038869cde19eca3e8894c1f64c445fc64a6559f950a") r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ptmx\x00', 0x3d, 0x0) write$binfmt_aout(r0, &(0x7f00000000c0)=ANY=[], 0xffffff78) ioctl$TCSETS(r0, 0x40045431, &(0x7f00003b9fdc)) ioctl$TCSETA(r0, 0x5406, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x4fbe}) r1 = syz_open_pts(r0, 0x0) r2 = dup3(r1, r0, 0x0) read(r0, &(0x7f00000000c0)=""/19, 0x1b43d048) read(r2, &(0x7f0000000240)=""/4096, 0x1000) 14:10:16 executing program 4: r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000040)='./cgroup.cpu\x00', 0x200002, 0x0) fchdir(r0) creat(0x0, 0x0) ftruncate(0xffffffffffffffff, 0x0) pipe(&(0x7f00000003c0)={0xffffffffffffffff, 0xffffffffffffffff}) write(r2, &(0x7f00000001c0), 0xfffffef3) r3 = open(&(0x7f000000fffa)='./bus\x00', 0x141042, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x800002, 0x11, r3, 0x0) read(r1, &(0x7f0000000000)=""/250, 0x128b9372) 14:10:16 executing program 5: perf_event_open(&(0x7f0000940000)={0x2, 0x70, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f000025c000)={0x1, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7fffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) 14:10:16 executing program 1: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f0000000040)={0xa, 0x4e22}, 0x1c) listen(r0, 0xeb) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) sendto$inet6(r1, 0x0, 0x0, 0x20000004, &(0x7f0000000140)={0xa, 0x4e22}, 0x1c) readv(r1, &(0x7f0000000700), 0x0) prctl$PR_MCE_KILL_GET(0x22) timerfd_create(0x0, 0x0) r2 = accept4(r0, 0x0, 0x0, 0x0) socket$inet6_udplite(0xa, 0x2, 0x88) setsockopt$packet_fanout(0xffffffffffffffff, 0x107, 0x12, 0x0, 0x309) ioctl$FICLONE(0xffffffffffffffff, 0x40049409, 0xffffffffffffffff) ioctl$EXT4_IOC_GROUP_EXTEND(0xffffffffffffffff, 0x40046607, 0x0) ioctl$PPPIOCGFLAGS1(0xffffffffffffffff, 0x8004745a, 0x0) dup(0xffffffffffffffff) shutdown(r1, 0x1) setsockopt(r1, 0x0, 0x1, &(0x7f0000000000)="1d", 0x1) sendto$inet6(r2, &(0x7f0000000300)='A', 0x1, 0x0, 0x0, 0x0) 14:10:16 executing program 5: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$nl_netfilter(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000140)=ANY=[@ANYBLOB="1400000000015b96f3547af595b65d0500000000"], 0x14}}, 0x0) 14:10:16 executing program 1: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f0000000040)={0xa, 0x4e22}, 0x1c) listen(r0, 0xeb) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) sendto$inet6(r1, 0x0, 0x0, 0x20000004, &(0x7f0000000140)={0xa, 0x4e22}, 0x1c) readv(r1, &(0x7f0000000700)=[{0x0}], 0x1) prctl$PR_MCE_KILL_GET(0x22) timerfd_create(0x0, 0x0) r2 = accept4(r0, 0x0, 0x0, 0x0) socket$inet6_udplite(0xa, 0x2, 0x88) setsockopt$packet_fanout(0xffffffffffffffff, 0x107, 0x12, 0x0, 0x309) ioctl$FICLONE(0xffffffffffffffff, 0x40049409, 0xffffffffffffffff) ioctl$EXT4_IOC_GROUP_EXTEND(0xffffffffffffffff, 0x40046607, 0x0) ioctl$PPPIOCGFLAGS1(0xffffffffffffffff, 0x8004745a, 0x0) dup(0xffffffffffffffff) shutdown(r1, 0x1) setsockopt(r1, 0x0, 0x1, &(0x7f0000000000)="1d", 0x1) sendto$inet6(r2, &(0x7f0000000300)='A', 0x1, 0x0, 0x0, 0x0) [ 237.028325] audit: type=1400 audit(1554214216.937:12): avc: denied { create } for pid=6232 comm="syz-executor.5" scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=netlink_netfilter_socket permissive=1 14:10:17 executing program 5: mknod(0x0, 0x0, 0x0) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000280)='/dev/ptmx\x00', 0x0, 0x0) read(r0, &(0x7f0000000140)=""/11, 0xb) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000200)) r1 = creat(&(0x7f0000000080)='\xe9\x1fq\x89Y\x1e\x923aK\x00', 0x109) dup2(r0, r1) execve(&(0x7f00000000c0)='\xe9\x1fq\x89Y\x1e\x923aK\x00', 0x0, 0x0) clone(0x3102001ff6, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) 14:10:17 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000080)="0adc1f123c123f3188b070") r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memt\x00\x8a\x11>\xe2\xf5bYQ\xf6\xf2\x8cro\xf8&\xbdL\x18\xbb\xfa`\xa8<\x9f\xb5\x03/\xb4\x93\xd0\xa5\xa0\nf\x18\xfd-b\xc2s\xccV\x0e3', 0x26e1, 0x0) ioctl$FS_IOC_FSSETXATTR(r1, 0x40086602, &(0x7f0000000140)) write$cgroup_int(r1, &(0x7f0000000080), 0xffffff19) ioctl$FS_IOC_FIEMAP(r1, 0xc020660b, &(0x7f0000000340)={0x0, 0xfff}) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x0, 0x40031, 0xffffffffffffffff, 0x0) 14:10:17 executing program 0: getsockname(0xffffffffffffffff, 0x0, 0x0) arch_prctl$ARCH_SET_GS(0x1001, 0x0) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) pipe(0x0) setsockopt(r0, 0x0, 0x0, 0x0, 0x0) 14:10:17 executing program 1: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f0000000040)={0xa, 0x4e22}, 0x1c) listen(r0, 0xeb) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) sendto$inet6(r1, 0x0, 0x0, 0x20000004, &(0x7f0000000140)={0xa, 0x4e22}, 0x1c) readv(r1, &(0x7f0000000700)=[{0x0}], 0x1) prctl$PR_MCE_KILL_GET(0x22) timerfd_create(0x0, 0x0) r2 = accept4(r0, 0x0, 0x0, 0x0) socket$inet6_udplite(0xa, 0x2, 0x88) setsockopt$packet_fanout(0xffffffffffffffff, 0x107, 0x12, 0x0, 0x309) ioctl$FICLONE(0xffffffffffffffff, 0x40049409, 0xffffffffffffffff) ioctl$EXT4_IOC_GROUP_EXTEND(0xffffffffffffffff, 0x40046607, 0x0) ioctl$PPPIOCGFLAGS1(0xffffffffffffffff, 0x8004745a, 0x0) dup(0xffffffffffffffff) shutdown(r1, 0x1) setsockopt(r1, 0x0, 0x1, &(0x7f0000000000)="1d", 0x1) sendto$inet6(r2, &(0x7f0000000300)='A', 0x1, 0x0, 0x0, 0x0) 14:10:17 executing program 5: sendmsg$unix(0xffffffffffffffff, 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, 0x0) sendto(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0) timer_create(0x0, 0x0, 0x0) ioctl$sock_SIOCGPGRP(0xffffffffffffffff, 0x8904, 0x0) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x80000) ioctl$TIOCLINUX2(0xffffffffffffffff, 0x541c, 0x0) openat$dir(0xffffffffffffff9c, &(0x7f0000000040)='./file1\x00', 0x18b07d, 0x4001000003) 14:10:17 executing program 4: perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) socket(0x10, 0x803, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) geteuid() r0 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000280)='/dev/loop-control\x00', 0x0, 0x0) ioctl$LOOP_CTL_REMOVE(r0, 0x4c81, 0x0) 14:10:17 executing program 2: timer_create(0x0, 0x0, &(0x7f0000000100)) socket$inet_icmp_raw(0x2, 0x3, 0x1) dup(0xffffffffffffffff) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) timer_gettime(0x0, &(0x7f0000500ff0)) 14:10:17 executing program 5: r0 = add_key$user(&(0x7f0000000040)='user\x00', &(0x7f0000000000)={'syz'}, &(0x7f0000000380)='X', 0x1, 0xfffffffffffffffe) keyctl$read(0xb, r0, &(0x7f0000000240)=""/226, 0xe2) 14:10:17 executing program 4: r0 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x80000000000002, &(0x7f00000000c0)=0x2000000000000074, 0x25d) bind$inet(r0, &(0x7f0000000140)={0x2, 0x4e23, @multicast1}, 0x10) setsockopt$SO_ATTACH_FILTER(r0, 0x1, 0x1a, &(0x7f0000b86000)={0x1, &(0x7f0000f40ff8)=[{0x6, 0x0, 0x0, 0xe8}]}, 0x10) sendto$inet(r0, 0x0, 0x0, 0x200007fd, &(0x7f0000e68000)={0x2, 0x4e23, @local}, 0x10) write(r0, &(0x7f0000000fc0)="7c43654e200fc615e2060f41cf4529a030d84ed21fe0386e9d450d0e2df4888f984d5fa9b7c8603dfc59fb1e32d87cd4c34450d43f681b257928b8e9d1082de5ae617ce96488be561f5c9dbb7df95783fae34854061ae16613daab19b1192118f99ab3b0db89d282b64149e8f0879862904036d672fcb65f9cee07336e1fae40d985471512a9e1e07d86db1ceb256beb1a0c24470f854023bd41d1fe20a20e775939212fc7ccc2bbf3aba9fe296cceb93c7cc70ecea4dfaf7bfce1fc4efdba28661952046f291af9a90940d6f574427fbdefce3c93b0aca01869d2cb18d41173bb38dbfda2d53c0583f78b4b46d93bdfed1f7fdfb94e9922c499b0a1b10638f15a36ac917ec265ffecd19f9388d035884dafeeb6220ad485a7356441438203f45c2b0ef53843a6a9349fcf22c817e7be7b5ee1f20b6f1a755b6f3ebdd6af3c7050cf326591f6aa79683e384ea8f89aec99706eb976cf896b7969ec753691650b0968ca6ec5b44a3eea05af7a071dfc6a5c2b0d096b3c9f1d94a26ff61bdba0766d769499f459850c4d721e8ee8ea6b51c93442e98c03fadb935e44ac3ae87389daa3cd1dfa4b3eae83f24e5f466742707f1acebf0a42e72b36b906779df67ab166c4771efb13d257f3537296f55fd31f1e831a7c2642bfcc177b16a979e543da59e7ad900de43f28ead2c3b7c077a011023290619cef26eb8e7a9c032355db271c4d9c6bf87321", 0x207) 14:10:17 executing program 0: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) r1 = socket$inet6(0xa, 0x1000000000002, 0x0) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000600)={'ip_vti0\x00', 0x201e}) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000001fc0)={'ip_vti0\x00', 0x0}) ioctl$sock_inet6_SIOCSIFADDR(r0, 0x8916, &(0x7f00000000c0)={@dev, 0x0, r3}) dup2(r1, r2) 14:10:17 executing program 1: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f0000000040)={0xa, 0x4e22}, 0x1c) listen(r0, 0xeb) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) sendto$inet6(r1, 0x0, 0x0, 0x20000004, &(0x7f0000000140)={0xa, 0x4e22}, 0x1c) readv(r1, &(0x7f0000000700)=[{0x0}], 0x1) prctl$PR_MCE_KILL_GET(0x22) timerfd_create(0x0, 0x0) r2 = accept4(r0, 0x0, 0x0, 0x0) socket$inet6_udplite(0xa, 0x2, 0x88) setsockopt$packet_fanout(0xffffffffffffffff, 0x107, 0x12, 0x0, 0x309) ioctl$FICLONE(0xffffffffffffffff, 0x40049409, 0xffffffffffffffff) ioctl$EXT4_IOC_GROUP_EXTEND(0xffffffffffffffff, 0x40046607, 0x0) ioctl$PPPIOCGFLAGS1(0xffffffffffffffff, 0x8004745a, 0x0) dup(0xffffffffffffffff) shutdown(r1, 0x1) setsockopt(r1, 0x0, 0x1, &(0x7f0000000000)="1d", 0x1) sendto$inet6(r2, &(0x7f0000000300)='A', 0x1, 0x0, 0x0, 0x0) 14:10:17 executing program 3: r0 = perf_event_open(&(0x7f0000000140)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) read(r0, &(0x7f0000000400)=""/91, 0x214) 14:10:17 executing program 5: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x1000400200) r1 = socket$inet(0x2, 0x1, 0x0) bind$inet(r1, &(0x7f0000000000)={0x2, 0x4e23, @local}, 0x10) sendto$inet(r1, 0x0, 0x0, 0x200007fd, &(0x7f0000e68000)={0x2, 0x4e23}, 0x10) setsockopt$sock_int(r1, 0x1, 0x0, &(0x7f0000000040)=0x3, 0x4) setsockopt$inet_tcp_int(0xffffffffffffffff, 0x6, 0x0, 0x0, 0xfffffffffffffd1d) bind$inet(0xffffffffffffffff, 0x0, 0x2e3) sendto$inet(0xffffffffffffffff, 0x0, 0x6d, 0x0, 0x0, 0x280) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x0, 0x0, 0x0) prctl$PR_GET_SECUREBITS(0x1b) sync() fcntl$setpipe(0xffffffffffffffff, 0x407, 0x0) syz_genetlink_get_family_id$tipc2(0x0) ioctl$TIOCCONS(0xffffffffffffffff, 0x541d) sendmsg$TIPC_NL_PUBL_GET(0xffffffffffffffff, 0x0, 0x0) ioctl$RTC_IRQP_SET(0xffffffffffffffff, 0x4004700c, 0x0) write$binfmt_elf64(0xffffffffffffffff, 0x0, 0x35c) socketpair$unix(0x1, 0x0, 0x0, 0x0) openat$rtc(0xffffffffffffff9c, 0x0, 0x0, 0x0) r2 = syz_open_procfs(0x0, &(0x7f0000000400)='net/tcp\x00\xcdWq\xe9*\a4g\a^\x90\xb6\xe4kH2\x80/\x88\xb6\xbb\xeb`\xb8@#\x83tH\xae\xa4y\x1d\\]\x93\x93\xb5e\xd9\xd4\xb8A# \xc8*s\xd0g>\x16\xabM\x7foK\xec\x17f\xb9x\x11\xbf\xab\x16\xc5\xcb\x94\xff\x1c\xa0\x01\xb3I\x1c\xb9\xcc\xbb\xbe\x9c\xd0!\x13\xe1\xbc.\xfaG3\x85\xe0,') sendfile(r1, r2, &(0x7f0000000080)=0x2, 0x80000003) 14:10:17 executing program 3: mkdir(0x0, 0x0) r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000000)='/dev/uinput\x00', 0x2, 0x0) setxattr$security_smack_entry(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0, 0x0, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = getpid() sched_setscheduler(r1, 0x5, &(0x7f0000000000)) write$uinput_user_dev(r0, &(0x7f0000000400)={'syz1\x00', {}, 0x0, [], [], [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10000], [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4000000000000, 0x0, 0x0, 0x0, 0x2]}, 0x45c) ioctl$UI_DEV_SETUP(r0, 0x5501, &(0x7f0000000300)={{}, 'syz0\x00'}) ioctl$UI_DEV_DESTROY(r0, 0x5502) 14:10:17 executing program 0: 14:10:17 executing program 4: 14:10:17 executing program 2: 14:10:17 executing program 0: 14:10:17 executing program 2: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000200)='memory.events\x00', 0x7a05, 0x1700) write$cgroup_subtree(r0, &(0x7f0000000000)=ANY=[@ANYBLOB], 0x200600) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000240)='memory.events\x00', 0x2da8020000100000, 0x500001c) 14:10:17 executing program 1: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f0000000040)={0xa, 0x4e22}, 0x1c) listen(r0, 0xeb) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) sendto$inet6(r1, 0x0, 0x0, 0x20000004, &(0x7f0000000140)={0xa, 0x4e22}, 0x1c) readv(r1, &(0x7f0000000700)=[{&(0x7f0000000440)=""/132, 0x31}], 0x1) prctl$PR_MCE_KILL_GET(0x22) timerfd_create(0x0, 0x0) r2 = accept4(0xffffffffffffffff, 0x0, 0x0, 0x0) socket$inet6_udplite(0xa, 0x2, 0x88) setsockopt$packet_fanout(0xffffffffffffffff, 0x107, 0x12, 0x0, 0x309) ioctl$FICLONE(0xffffffffffffffff, 0x40049409, 0xffffffffffffffff) ioctl$EXT4_IOC_GROUP_EXTEND(0xffffffffffffffff, 0x40046607, 0x0) ioctl$PPPIOCGFLAGS1(0xffffffffffffffff, 0x8004745a, 0x0) dup(0xffffffffffffffff) shutdown(r1, 0x1) setsockopt(r1, 0x0, 0x1, &(0x7f0000000000)="1d", 0x1) sendto$inet6(r2, &(0x7f0000000300)='A', 0x1, 0x0, 0x0, 0x0) 14:10:18 executing program 4: [ 238.083755] input: syz1 as /devices/virtual/input/input19 14:10:18 executing program 0: 14:10:18 executing program 2: 14:10:18 executing program 4: [ 238.205519] audit: type=1400 audit(1554214218.117:13): avc: denied { read } for pid=6300 comm="syz-executor.5" scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=netlink_generic_socket permissive=1 14:10:18 executing program 5: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x1000400200) r1 = socket$inet(0x2, 0x1, 0x0) bind$inet(r1, &(0x7f0000000000)={0x2, 0x4e23, @local}, 0x10) sendto$inet(r1, 0x0, 0x0, 0x200007fd, &(0x7f0000e68000)={0x2, 0x4e23}, 0x10) setsockopt$sock_int(r1, 0x1, 0x0, &(0x7f0000000040)=0x3, 0x4) setsockopt$inet_tcp_int(0xffffffffffffffff, 0x6, 0x0, 0x0, 0xfffffffffffffd1d) bind$inet(0xffffffffffffffff, 0x0, 0x2e3) sendto$inet(0xffffffffffffffff, 0x0, 0x6d, 0x0, 0x0, 0x280) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x0, 0x0, 0x0) prctl$PR_GET_SECUREBITS(0x1b) sync() fcntl$setpipe(0xffffffffffffffff, 0x407, 0x0) syz_genetlink_get_family_id$tipc2(0x0) ioctl$TIOCCONS(0xffffffffffffffff, 0x541d) sendmsg$TIPC_NL_PUBL_GET(0xffffffffffffffff, 0x0, 0x0) ioctl$RTC_IRQP_SET(0xffffffffffffffff, 0x4004700c, 0x0) write$binfmt_elf64(0xffffffffffffffff, 0x0, 0x35c) socketpair$unix(0x1, 0x0, 0x0, 0x0) openat$rtc(0xffffffffffffff9c, 0x0, 0x0, 0x0) r2 = syz_open_procfs(0x0, &(0x7f0000000400)='net/tcp\x00\xcdWq\xe9*\a4g\a^\x90\xb6\xe4kH2\x80/\x88\xb6\xbb\xeb`\xb8@#\x83tH\xae\xa4y\x1d\\]\x93\x93\xb5e\xd9\xd4\xb8A# \xc8*s\xd0g>\x16\xabM\x7foK\xec\x17f\xb9x\x11\xbf\xab\x16\xc5\xcb\x94\xff\x1c\xa0\x01\xb3I\x1c\xb9\xcc\xbb\xbe\x9c\xd0!\x13\xe1\xbc.\xfaG3\x85\xe0,') sendfile(r1, r2, &(0x7f0000000080)=0x2, 0x80000003) [ 238.305317] input: syz1 as /devices/virtual/input/input20 14:10:18 executing program 2: 14:10:18 executing program 0: 14:10:18 executing program 3: 14:10:18 executing program 4: 14:10:18 executing program 5: 14:10:18 executing program 0: 14:10:18 executing program 1: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f0000000040)={0xa, 0x4e22}, 0x1c) listen(r0, 0xeb) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) sendto$inet6(r1, 0x0, 0x0, 0x20000004, &(0x7f0000000140)={0xa, 0x4e22}, 0x1c) readv(r1, &(0x7f0000000700)=[{&(0x7f0000000440)=""/132, 0x31}], 0x1) prctl$PR_MCE_KILL_GET(0x22) timerfd_create(0x0, 0x0) r2 = accept4(0xffffffffffffffff, 0x0, 0x0, 0x0) socket$inet6_udplite(0xa, 0x2, 0x88) setsockopt$packet_fanout(0xffffffffffffffff, 0x107, 0x12, 0x0, 0x309) ioctl$FICLONE(0xffffffffffffffff, 0x40049409, 0xffffffffffffffff) ioctl$EXT4_IOC_GROUP_EXTEND(0xffffffffffffffff, 0x40046607, 0x0) ioctl$PPPIOCGFLAGS1(0xffffffffffffffff, 0x8004745a, 0x0) dup(0xffffffffffffffff) shutdown(r1, 0x1) setsockopt(r1, 0x0, 0x1, &(0x7f0000000000)="1d", 0x1) sendto$inet6(r2, &(0x7f0000000300)='A', 0x1, 0x0, 0x0, 0x0) 14:10:18 executing program 2: 14:10:18 executing program 4: 14:10:18 executing program 5: 14:10:18 executing program 3: 14:10:18 executing program 0: 14:10:18 executing program 3: 14:10:18 executing program 2: 14:10:18 executing program 0: 14:10:18 executing program 5: 14:10:18 executing program 4: 14:10:18 executing program 0: 14:10:19 executing program 1: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f0000000040)={0xa, 0x4e22}, 0x1c) listen(r0, 0xeb) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) sendto$inet6(r1, 0x0, 0x0, 0x20000004, &(0x7f0000000140)={0xa, 0x4e22}, 0x1c) readv(r1, &(0x7f0000000700)=[{&(0x7f0000000440)=""/132, 0x31}], 0x1) prctl$PR_MCE_KILL_GET(0x22) timerfd_create(0x0, 0x0) r2 = accept4(0xffffffffffffffff, 0x0, 0x0, 0x0) socket$inet6_udplite(0xa, 0x2, 0x88) setsockopt$packet_fanout(0xffffffffffffffff, 0x107, 0x12, 0x0, 0x309) ioctl$FICLONE(0xffffffffffffffff, 0x40049409, 0xffffffffffffffff) ioctl$EXT4_IOC_GROUP_EXTEND(0xffffffffffffffff, 0x40046607, 0x0) ioctl$PPPIOCGFLAGS1(0xffffffffffffffff, 0x8004745a, 0x0) dup(0xffffffffffffffff) shutdown(r1, 0x1) setsockopt(r1, 0x0, 0x1, &(0x7f0000000000)="1d", 0x1) sendto$inet6(r2, &(0x7f0000000300)='A', 0x1, 0x0, 0x0, 0x0) 14:10:19 executing program 5: 14:10:19 executing program 2: 14:10:19 executing program 3: 14:10:19 executing program 4: 14:10:19 executing program 0: 14:10:19 executing program 3: 14:10:19 executing program 5: 14:10:19 executing program 2: 14:10:19 executing program 0: 14:10:19 executing program 4: 14:10:19 executing program 0: 14:10:20 executing program 1: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f0000000040)={0xa, 0x4e22}, 0x1c) listen(r0, 0xeb) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) sendto$inet6(r1, 0x0, 0x0, 0x20000004, &(0x7f0000000140)={0xa, 0x4e22}, 0x1c) readv(r1, &(0x7f0000000700)=[{&(0x7f0000000440)=""/132, 0x31}], 0x1) prctl$PR_MCE_KILL_GET(0x22) timerfd_create(0x0, 0x0) r2 = accept4(r0, 0x0, 0x0, 0x0) socket$inet6_udplite(0xa, 0x2, 0x88) setsockopt$packet_fanout(0xffffffffffffffff, 0x107, 0x12, 0x0, 0x309) ioctl$FICLONE(0xffffffffffffffff, 0x40049409, 0xffffffffffffffff) ioctl$EXT4_IOC_GROUP_EXTEND(0xffffffffffffffff, 0x40046607, 0x0) ioctl$PPPIOCGFLAGS1(0xffffffffffffffff, 0x8004745a, 0x0) dup(0xffffffffffffffff) shutdown(0xffffffffffffffff, 0x1) setsockopt(r1, 0x0, 0x1, &(0x7f0000000000)="1d", 0x1) sendto$inet6(r2, &(0x7f0000000300)='A', 0x1, 0x0, 0x0, 0x0) 14:10:20 executing program 3: 14:10:20 executing program 5: 14:10:20 executing program 2: 14:10:20 executing program 4: 14:10:20 executing program 0: 14:10:20 executing program 3: 14:10:20 executing program 5: 14:10:20 executing program 2: 14:10:20 executing program 0: 14:10:20 executing program 4: 14:10:20 executing program 5: 14:10:21 executing program 1: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f0000000040)={0xa, 0x4e22}, 0x1c) listen(r0, 0xeb) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) sendto$inet6(r1, 0x0, 0x0, 0x20000004, &(0x7f0000000140)={0xa, 0x4e22}, 0x1c) readv(r1, &(0x7f0000000700)=[{&(0x7f0000000440)=""/132, 0x31}], 0x1) prctl$PR_MCE_KILL_GET(0x22) timerfd_create(0x0, 0x0) r2 = accept4(r0, 0x0, 0x0, 0x0) socket$inet6_udplite(0xa, 0x2, 0x88) setsockopt$packet_fanout(0xffffffffffffffff, 0x107, 0x12, 0x0, 0x309) ioctl$FICLONE(0xffffffffffffffff, 0x40049409, 0xffffffffffffffff) ioctl$EXT4_IOC_GROUP_EXTEND(0xffffffffffffffff, 0x40046607, 0x0) ioctl$PPPIOCGFLAGS1(0xffffffffffffffff, 0x8004745a, 0x0) dup(0xffffffffffffffff) shutdown(0xffffffffffffffff, 0x1) setsockopt(r1, 0x0, 0x1, &(0x7f0000000000)="1d", 0x1) sendto$inet6(r2, &(0x7f0000000300)='A', 0x1, 0x0, 0x0, 0x0) 14:10:21 executing program 3: 14:10:21 executing program 0: 14:10:21 executing program 2: 14:10:21 executing program 4: 14:10:21 executing program 5: 14:10:21 executing program 0: 14:10:21 executing program 4: 14:10:21 executing program 2: 14:10:21 executing program 5: 14:10:21 executing program 3: 14:10:21 executing program 2: 14:10:22 executing program 1: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f0000000040)={0xa, 0x4e22}, 0x1c) listen(r0, 0xeb) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) sendto$inet6(r1, 0x0, 0x0, 0x20000004, &(0x7f0000000140)={0xa, 0x4e22}, 0x1c) readv(r1, &(0x7f0000000700)=[{&(0x7f0000000440)=""/132, 0x31}], 0x1) prctl$PR_MCE_KILL_GET(0x22) timerfd_create(0x0, 0x0) r2 = accept4(r0, 0x0, 0x0, 0x0) socket$inet6_udplite(0xa, 0x2, 0x88) setsockopt$packet_fanout(0xffffffffffffffff, 0x107, 0x12, 0x0, 0x309) ioctl$FICLONE(0xffffffffffffffff, 0x40049409, 0xffffffffffffffff) ioctl$EXT4_IOC_GROUP_EXTEND(0xffffffffffffffff, 0x40046607, 0x0) ioctl$PPPIOCGFLAGS1(0xffffffffffffffff, 0x8004745a, 0x0) dup(0xffffffffffffffff) shutdown(0xffffffffffffffff, 0x1) setsockopt(r1, 0x0, 0x1, &(0x7f0000000000)="1d", 0x1) sendto$inet6(r2, &(0x7f0000000300)='A', 0x1, 0x0, 0x0, 0x0) 14:10:22 executing program 5: 14:10:22 executing program 4: 14:10:22 executing program 0: 14:10:22 executing program 3: 14:10:22 executing program 2: 14:10:22 executing program 2: 14:10:22 executing program 5: 14:10:22 executing program 4: 14:10:22 executing program 0: 14:10:22 executing program 3: 14:10:22 executing program 2: 14:10:23 executing program 1: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f0000000040)={0xa, 0x4e22}, 0x1c) listen(r0, 0xeb) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) sendto$inet6(r1, 0x0, 0x0, 0x20000004, &(0x7f0000000140)={0xa, 0x4e22}, 0x1c) readv(r1, &(0x7f0000000700)=[{&(0x7f0000000440)=""/132, 0x31}], 0x1) prctl$PR_MCE_KILL_GET(0x22) timerfd_create(0x0, 0x0) r2 = accept4(r0, 0x0, 0x0, 0x0) socket$inet6_udplite(0xa, 0x2, 0x88) setsockopt$packet_fanout(0xffffffffffffffff, 0x107, 0x12, 0x0, 0x309) ioctl$FICLONE(0xffffffffffffffff, 0x40049409, 0xffffffffffffffff) ioctl$EXT4_IOC_GROUP_EXTEND(0xffffffffffffffff, 0x40046607, 0x0) ioctl$PPPIOCGFLAGS1(0xffffffffffffffff, 0x8004745a, 0x0) dup(0xffffffffffffffff) shutdown(r1, 0x0) setsockopt(r1, 0x0, 0x1, &(0x7f0000000000)="1d", 0x1) sendto$inet6(r2, &(0x7f0000000300)='A', 0x1, 0x0, 0x0, 0x0) 14:10:23 executing program 5: 14:10:23 executing program 0: 14:10:23 executing program 4: 14:10:23 executing program 2: 14:10:23 executing program 3: 14:10:23 executing program 2: 14:10:23 executing program 4: 14:10:23 executing program 5: r0 = syz_open_dev$loop(&(0x7f0000000080)='/dev/loop#\x00', 0x0, 0x0) ioctl$BLKFLSBUF(r0, 0x1261, 0x0) 14:10:23 executing program 0: syz_open_procfs$namespace(0x0, &(0x7f0000000140)='ns/net\x00') syz_open_procfs$namespace(0x0, &(0x7f00000002c0)='ns/net\x00') 14:10:23 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") r1 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ppp\x00', 0x0, 0x0) ioctl$EVIOCGPROP(r1, 0xc004743e, &(0x7f0000000140)=""/246) ioctl$PPPIOCSMAXCID(r1, 0x40047451, &(0x7f0000000100)) mkdirat(0xffffffffffffff9c, 0x0, 0x0) ioctl$PPPIOCSMAXCID(r1, 0x40047451, &(0x7f0000000000)) 14:10:23 executing program 2: r0 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_tx_ring(r0, 0x107, 0x5, &(0x7f0000000040)=@req3={0x10000, 0x100000001, 0x10000, 0x1}, 0x1c) poll(&(0x7f0000000000)=[{r0}], 0x1, 0x0) 14:10:24 executing program 1: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f0000000040)={0xa, 0x4e22}, 0x1c) listen(r0, 0xeb) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) sendto$inet6(r1, 0x0, 0x0, 0x20000004, &(0x7f0000000140)={0xa, 0x4e22}, 0x1c) readv(r1, &(0x7f0000000700)=[{&(0x7f0000000440)=""/132, 0x31}], 0x1) prctl$PR_MCE_KILL_GET(0x22) timerfd_create(0x0, 0x0) r2 = accept4(r0, 0x0, 0x0, 0x0) socket$inet6_udplite(0xa, 0x2, 0x88) setsockopt$packet_fanout(0xffffffffffffffff, 0x107, 0x12, 0x0, 0x309) ioctl$FICLONE(0xffffffffffffffff, 0x40049409, 0xffffffffffffffff) ioctl$EXT4_IOC_GROUP_EXTEND(0xffffffffffffffff, 0x40046607, 0x0) ioctl$PPPIOCGFLAGS1(0xffffffffffffffff, 0x8004745a, 0x0) dup(0xffffffffffffffff) shutdown(r1, 0x0) setsockopt(r1, 0x0, 0x1, &(0x7f0000000000)="1d", 0x1) sendto$inet6(r2, &(0x7f0000000300)='A', 0x1, 0x0, 0x0, 0x0) 14:10:24 executing program 0: r0 = socket$inet6(0xa, 0x1, 0x0) mkdir(&(0x7f0000001c40)='./file0\x00', 0x0) r1 = creat(&(0x7f0000df1000)='./file0/bus\x00', 0x0) fcntl$lock(r1, 0x6, &(0x7f0000027000)={0x1}) unshare(0x40600) dup2(r0, r1) 14:10:24 executing program 3: socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000019c0)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f0000b82000)) 14:10:24 executing program 4: unshare(0x400) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000180)={0xffffffffffffffff}) getsockname$unix(r0, 0x0, &(0x7f0000000100)) 14:10:24 executing program 5: r0 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000180)='/dev/rtc0\x00', 0x0, 0x0) ioctl$RTC_UIE_ON(r0, 0x7003) 14:10:24 executing program 2: socketpair$unix(0x1, 0x4000000000000002, 0x0, &(0x7f0000000280)={0xffffffffffffffff, 0xffffffffffffffff}) recvmmsg(r1, &(0x7f0000003180)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x8) r2 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(r2, 0x1, r1, &(0x7f0000b82000)={0x10000004}) sendmmsg$unix(r1, &(0x7f00000bd000), 0x523, 0x0) timer_settime(0x0, 0x0, &(0x7f0000000300)={{0x0, 0x1c9c380}, {0x0, 0x1c9c380}}, 0x0) recvmmsg(r0, &(0x7f00000001c0)=[{{0x0, 0x0, 0x0, 0x0, 0x0, 0x152}}], 0xfffffffffffffdab, 0x0, 0x0) 14:10:24 executing program 4: r0 = socket$netlink(0x10, 0x3, 0x8000000004) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) writev(r0, &(0x7f00000000c0)=[{&(0x7f0000000300)="580000001400192340834b80040d8c560a067fbc45ff810500000000000058000b480400945f64009400050038925a01000000000000008000f0fffeffe809000000fff5dd0000001000010003081000418e00000004fcff", 0x58}], 0x1) 14:10:24 executing program 5: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x10000000013, &(0x7f0000000040)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_OPTIONS(r0, 0x6, 0x16, &(0x7f0000000140)=[@window, @window, @timestamp], 0x3) 14:10:24 executing program 3: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000040)={0xffffffffa0018000, 0x0, &(0x7f0000000080)={&(0x7f0000000140)={0x2, 0x3, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, [@sadb_x_sa2={0x2, 0x9}, @sadb_sa={0x2, 0x1, 0x0, 0x0, 0x0, 0x0, 0xb}]}, 0x30}}, 0x0) 14:10:24 executing program 0: r0 = socket$inet(0x2, 0x3, 0x2) ioctl$sock_inet_SIOCGIFBRDADDR(r0, 0x8919, &(0x7f00000003c0)={'gretap0\x00', {0x2, 0x0, @multicast1}}) 14:10:24 executing program 5: r0 = gettid() capget(&(0x7f00000002c0)={0x19980330, r0}, &(0x7f0000000300)) 14:10:24 executing program 0: r0 = socket$inet6(0xa, 0x3, 0x10000000003) setsockopt$inet6_mreq(r0, 0x29, 0x1b, &(0x7f0000000000)={@local}, 0x14) 14:10:25 executing program 1: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f0000000040)={0xa, 0x4e22}, 0x1c) listen(r0, 0xeb) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) sendto$inet6(r1, 0x0, 0x0, 0x20000004, &(0x7f0000000140)={0xa, 0x4e22}, 0x1c) readv(r1, &(0x7f0000000700)=[{&(0x7f0000000440)=""/132, 0x31}], 0x1) prctl$PR_MCE_KILL_GET(0x22) timerfd_create(0x0, 0x0) r2 = accept4(r0, 0x0, 0x0, 0x0) socket$inet6_udplite(0xa, 0x2, 0x88) setsockopt$packet_fanout(0xffffffffffffffff, 0x107, 0x12, 0x0, 0x309) ioctl$FICLONE(0xffffffffffffffff, 0x40049409, 0xffffffffffffffff) ioctl$EXT4_IOC_GROUP_EXTEND(0xffffffffffffffff, 0x40046607, 0x0) ioctl$PPPIOCGFLAGS1(0xffffffffffffffff, 0x8004745a, 0x0) dup(0xffffffffffffffff) shutdown(r1, 0x0) setsockopt(r1, 0x0, 0x1, &(0x7f0000000000)="1d", 0x1) sendto$inet6(r2, &(0x7f0000000300)='A', 0x1, 0x0, 0x0, 0x0) 14:10:25 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") perf_event_open(&(0x7f0000940000)={0x2, 0x70, 0xfffffffffffffffe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ppp\x00', 0x0, 0x0) ioctl$EVIOCGPROP(r1, 0xc004743e, &(0x7f0000000140)=""/246) 14:10:25 executing program 5: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00005befdc)) r1 = syz_open_pts(r0, 0x100000109001) write(r1, &(0x7f00000000c0)="d578599db5269e7d7b3bfdcd90298ddfbed924cd9e23122dc1ed52faad08d37078b162911b6c396b8bb96a305e77bba7620a", 0x32) 14:10:25 executing program 3: ioctl$sock_inet6_SIOCADDRT(0xffffffffffffffff, 0x890b, 0x0) socket$packet(0x11, 0x2, 0x300) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f00000000c0)='bridge0\x00', 0x10) connect$inet(r0, &(0x7f0000000040)={0x2, 0x0, @multicast1}, 0x10) sendmmsg(r0, &(0x7f0000007fc0), 0x400000000000030, 0x400300) 14:10:25 executing program 0: r0 = socket$inet6(0xa, 0x400000003, 0x7) connect$inet6(r0, &(0x7f0000000280)={0xa, 0x0, 0x0, @loopback}, 0x1c) sendmsg(r0, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000180)="b1", 0x1}], 0x1}, 0x0) setsockopt$inet6_int(r0, 0x29, 0x4a, &(0x7f0000000000)=0xe2b, 0x4) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f3188b070") recvfrom$inet6(r0, 0x0, 0x0, 0x0, 0x0, 0x0) 14:10:25 executing program 2: r0 = creat(&(0x7f0000000280)='./bus\x00', 0x0) ftruncate(r0, 0x2008200) open(&(0x7f0000000140)='./bus\x00', 0x0, 0x0) creat(&(0x7f0000000680)='./bus\x00', 0x0) 14:10:25 executing program 5: r0 = syz_open_dev$loop(&(0x7f0000000200)='/dev/loop#\x00', 0x0, 0x1100082) r1 = memfd_create(&(0x7f0000000080)='t\bnu\x00\x00\x00\x00\x00\x00\x00\x00\x00\x8c\x00', 0x0) ioctl$LOOP_CHANGE_FD(r0, 0x4c00, r1) ioctl$LOOP_SET_STATUS64(r0, 0x4c04, &(0x7f0000000380)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, "7001e0f57c8cf6270b24e415e96042aae51d871554c11cd59cc8fb47081025bad6b39d778066f9d1ac8a570e3a42f70a7c0f30f66157a96aae15813f0dceb297", "a8a4cd01e527e6fd3de45387daf7b1ac786d0e8a75e89046550fa2d2d25b60361fe06f308fe6033a61edb75c8d51c055faf7f4fdb16e0cdaa4276939a3410334", "7b8ddcc0c891591c4116893616105829576914e70bfed06d00f97c97644ab8a7"}) ioctl$LOOP_CLR_FD(r0, 0x4c01) 14:10:25 executing program 2: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000780)='TIPCv2\x00') sendmsg$TIPC_NL_MON_SET(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000000c0)={0x20, r1, 0x201, 0x0, 0x0, {}, [@TIPC_NLA_MON={0xc, 0x9, [@TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x5}]}]}, 0x20}}, 0x0) 14:10:25 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) getsockopt$ARPT_SO_GET_INFO(r0, 0x0, 0x60, &(0x7f0000000380)={'filter\x00'}, &(0x7f0000000400)=0x44) 14:10:25 executing program 0: perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10000003, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f0000000340)=0xa000000000000005) r0 = getpgrp(0xffffffffffffffff) openat$full(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/full\x00', 0x12a80, 0x0) setpriority(0x0, r0, 0x10000) open(&(0x7f0000000180)='./file0\x00', 0x40, 0x1) setxattr$security_capability(&(0x7f0000000600)='./file0\x00', &(0x7f0000000240)='security.capability\x00', &(0x7f0000000780)=@v2={0x2000000, [{0x0, 0xffff}]}, 0x14, 0x0) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000640), 0xffffffffffffffff) execve(&(0x7f0000000300)='./file0\x00', &(0x7f0000000140)=[&(0x7f00000003c0)='\xf6', &(0x7f0000000100)='security.capability\xf6', &(0x7f0000000440)='/dev/fullL'], &(0x7f0000000200)) 14:10:25 executing program 4: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f00001fefe4)={0xa, 0x4e22, 0x0, @ipv4={[], [], @local}}, 0x1c) listen(r0, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$sock_int(r1, 0x1, 0xf, &(0x7f0000000000)=0x5, 0x4) bind$inet6(r1, &(0x7f00001fefe4)={0xa, 0x0, 0x0, @loopback}, 0x1c) listen(r1, 0x0) 14:10:25 executing program 2: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_ABS_SETUP(r0, 0x401c5504, 0x0) r1 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) setsockopt$inet_tcp_int(r1, 0x6, 0x0, 0x0, 0x0) pipe(&(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r3, &(0x7f0000000000)={0xa, 0x8000002}, 0x1c) bind$inet6(0xffffffffffffffff, 0x0, 0x0) geteuid() mount$fuseblk(0x0, 0x0, 0x0, 0x0, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) getsockopt$inet_mtu(0xffffffffffffffff, 0x0, 0xa, 0x0, 0x0) fcntl$setstatus(0xffffffffffffffff, 0x4, 0x0) write$cgroup_type(0xffffffffffffffff, 0x0, 0x373) getpgrp(0x0) ioctl$sock_SIOCSPGRP(0xffffffffffffffff, 0x8902, 0x0) write$P9_RREMOVE(0xffffffffffffffff, 0x0, 0x0) sendto$inet6(r3, 0x0, 0x0, 0x20000001, &(0x7f0000b63fe4)={0xa, 0x2}, 0x1c) splice(r3, 0x0, r2, 0x0, 0xc4b1, 0x0) socket$inet6(0xa, 0x0, 0x0) signalfd4(0xffffffffffffffff, 0x0, 0x0, 0x0) inotify_init1(0x0) [ 245.244752] loop_reread_partitions: partition scan of loop0 (p|' $`BT՜G%ֳwfѬW:B [ 245.244752] |0aWj? β) failed (rc=-13) 14:10:25 executing program 1: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f0000000040)={0xa, 0x4e22}, 0x1c) listen(r0, 0xeb) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) sendto$inet6(r1, 0x0, 0x0, 0x20000004, &(0x7f0000000140)={0xa, 0x4e22}, 0x1c) readv(r1, &(0x7f0000000700)=[{&(0x7f0000000440)=""/132, 0x31}], 0x1) prctl$PR_MCE_KILL_GET(0x22) timerfd_create(0x0, 0x0) r2 = accept4(r0, 0x0, 0x0, 0x0) socket$inet6_udplite(0xa, 0x2, 0x88) setsockopt$packet_fanout(0xffffffffffffffff, 0x107, 0x12, 0x0, 0x309) ioctl$FICLONE(0xffffffffffffffff, 0x40049409, 0xffffffffffffffff) ioctl$EXT4_IOC_GROUP_EXTEND(0xffffffffffffffff, 0x40046607, 0x0) ioctl$PPPIOCGFLAGS1(0xffffffffffffffff, 0x8004745a, 0x0) dup(0xffffffffffffffff) shutdown(r1, 0x1) setsockopt(0xffffffffffffffff, 0x0, 0x1, &(0x7f0000000000)="1d", 0x1) sendto$inet6(r2, &(0x7f0000000300)='A', 0x1, 0x0, 0x0, 0x0) 14:10:25 executing program 3: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f0000000840)=""/148, 0x94}], 0x1, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000000)='net/netlink\x00') preadv(r1, &(0x7f0000000700), 0x31f, 0x0) syz_genetlink_get_family_id$tipc2(0x0) sendmsg$nl_xfrm(r0, &(0x7f0000000000)={0x0, 0x0, 0x0}, 0x0) 14:10:25 executing program 0: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00009e3ff6)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00005befdc)) r1 = syz_open_pts(r0, 0x0) r2 = dup2(r0, r1) ioctl$TIOCSWINSZ(r2, 0x5414, &(0x7f0000000000)) 14:10:25 executing program 4: perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f0000000840)=""/148, 0x94}], 0x1, 0x0) r0 = syz_open_procfs(0x0, &(0x7f00000000c0)='net/ip_tables_matches\x00') preadv(r0, &(0x7f0000000700), 0x31f, 0x10400003) 14:10:25 executing program 3: mkdir(&(0x7f0000fd5ff8)='./file0\x00', 0x0) mount(0x0, &(0x7f0000027000)='./file0\x00', &(0x7f0000018ffa)='ramfs\x00', 0x50, 0x0) r0 = creat(&(0x7f0000df1000)='./file0/bus\x00', 0xbc9dc8fbd81cb4b1) fcntl$lock(r0, 0x7, &(0x7f0000027000)={0x1}) creat(&(0x7f0000000080)='./file0/bus\x00', 0x0) [ 421.604519] INFO: task syz-executor.2:2137 blocked for more than 140 seconds. [ 421.611814] Not tainted 4.4.174+ #4 [ 421.616014] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. [ 421.623979] syz-executor.2 D ffff8800a76a7af8 25552 2137 1 0x00000004 [ 421.631472] ffff8800a76a7af8 ffff8800b6a317c0 bac6036d19d14acd ffff8800b6a317c0 [ 421.639522] 0000000000000002 ffff8800b6a32000 ffff8801db71f180 ffff8801db71f1a8 [ 421.647761] ffff8801db71e898 ffff8801da6497c0 ffff8800b6a317c0 ffffed0014ed4001 [ 421.655861] Call Trace: [ 421.658441] [] schedule+0x99/0x1d0 [ 421.663655] [] schedule_preempt_disabled+0x13/0x20 [ 421.670281] [] mutex_lock_nested+0x3c2/0xb80 [ 421.676359] [] ? lo_release+0x84/0x1b0 [ 421.681921] [] ? mutex_lock_nested+0x645/0xb80 [ 421.688285] [] ? __blkdev_put+0xbb/0x840 [ 421.693992] [] ? mutex_trylock+0x500/0x500 [ 421.699934] [] ? __blkdev_put+0x219/0x840 [ 421.705751] [] ? __blkdev_put+0x3c2/0x840 [ 421.711838] [] ? lo_compat_ioctl+0x140/0x140 [ 421.717935] [] lo_release+0x84/0x1b0 [ 421.723281] [] ? lo_compat_ioctl+0x140/0x140 [ 421.729353] [] __blkdev_put+0x461/0x840 [ 421.734984] [] ? __mutex_unlock_slowpath+0x25d/0x530 [ 421.741716] [] ? bd_unlink_disk_holder+0x450/0x450 [ 421.748480] [] blkdev_put+0x88/0x560 [ 421.753886] [] ? blkdev_put+0x560/0x560 [ 421.759603] [] blkdev_close+0x8b/0xb0 [ 421.765082] [] __fput+0x246/0x710 [ 421.770174] [] ____fput+0x16/0x20 [ 421.775404] [] task_work_run+0x202/0x2b0 [ 421.781278] [] exit_to_usermode_loop+0x14a/0x170 [ 421.787731] [] syscall_return_slowpath+0x25b/0x2e0 [ 421.794318] [] int_ret_from_sys_call+0x25/0xa3 [ 421.800583] 3 locks held by syz-executor.2/2137: [ 421.805346] #0: (&bdev->bd_mutex){+.+.+.}, at: [] __blkdev_put+0xbb/0x840 [ 421.814712] #1: (loop_index_mutex){+.+.+.}, at: [] lo_release+0x1e/0x1b0 [ 421.823952] #2: (loop_ctl_mutex#2){+.+.+.}, at: [] lo_release+0x84/0x1b0 [ 421.833340] Sending NMI to all CPUs: [ 421.837423] NMI backtrace for cpu 0 [ 421.841054] CPU: 0 PID: 0 Comm: swapper/0 Not tainted 4.4.174+ #4 [ 421.847313] task: ffffffff82e151c0 task.stack: ffffffff82e00000 [ 421.853359] RIP: 0010:[] [] native_safe_halt+0x2/0x10 [ 421.861802] RSP: 0018:ffffffff82e07db0 EFLAGS: 00000246 [ 421.867269] RAX: 0000000000000007 RBX: ffffffff8319bf68 RCX: 0000000000000000 [ 421.874570] RDX: 0000000000000000 RSI: 0000000000000001 RDI: ffffffff82e15a84 [ 421.881840] RBP: ffffffff82e07de0 R08: 0000000000000000 R09: 0000000000000000 [ 421.889132] R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000000 [ 421.896483] R13: ffffffff82e08000 R14: dffffc0000000000 R15: ffffffff82e00000 [ 421.903778] FS: 0000000000000000(0000) GS:ffff8801db600000(0000) knlGS:0000000000000000 [ 421.912067] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 421.917960] CR2: 00007f1096c0b000 CR3: 00000000ba69b000 CR4: 00000000001606b0 [ 421.925334] Stack: [ 421.927480] ffffffff81020b16 ffffffff82e00000 0000000000000000 ffffffff82e08000 [ 421.935045] dffffc0000000000 ffffffff82e00000 ffffffff82e07df0 ffffffff81022d50 [ 421.942617] ffffffff82e07e08 ffffffff811eb4c8 0000000000000000 ffffffff82e07ed0 [ 421.950194] Call Trace: [ 421.952770] [] ? default_idle+0x56/0x3d0 [ 421.958507] [] arch_cpu_idle+0x10/0x20 [ 421.964033] [] default_idle_call+0x48/0x70 [ 421.969951] [] cpu_startup_entry+0x6d1/0x810 [ 421.976098] [] ? complete+0x18/0x70 [ 421.981362] [] ? call_cpuidle+0xe0/0xe0 [ 421.987021] [] ? schedule+0xab/0x1d0 [ 421.992379] [] rest_init+0x190/0x199 [ 421.997909] [] ? trace_event_define_fields_x86_irq_vector+0x2c/0x2c [ 422.005992] [] start_kernel+0x64a/0x67e [ 422.011598] [] ? thread_stack_cache_init+0xb/0xb [ 422.018059] [] ? early_idt_handler_array+0x120/0x120 [ 422.024833] [] ? early_idt_handler_array+0x120/0x120 [ 422.031563] [] x86_64_start_reservations+0x29/0x2b [ 422.038188] [] x86_64_start_kernel+0x137/0x15a [ 422.044440] Code: 2e 0f 1f 84 00 00 00 00 00 fa c3 0f 1f 40 00 66 2e 0f 1f 84 00 00 00 00 00 fb c3 0f 1f 40 00 66 2e 0f 1f 84 00 00 00 00 00 fb f4 0f 1f 00 66 2e 0f 1f 84 00 00 00 00 00 f4 c3 0f 1f 40 00 66 [ 422.063492] NMI backtrace for cpu 1 [ 422.067134] CPU: 1 PID: 20 Comm: khungtaskd Not tainted 4.4.174+ #4 [ 422.073647] task: ffff8801da6f4740 task.stack: ffff8800001d0000 [ 422.079746] RIP: 0010:[] [] flat_send_IPI_mask+0xf7/0x1b0 [ 422.088513] RSP: 0018:ffff8800001d7c88 EFLAGS: 00000046 [ 422.093945] RAX: 0000000000000000 RBX: 0000000000000c00 RCX: 0000000000000000 [ 422.101262] RDX: 0000000000000c00 RSI: 0000000000000000 RDI: ffffffffff5fc300 [ 422.109105] RBP: ffff8800001d7cb8 R08: 0000000000000018 R09: 0000000000000000 [ 422.121193] R10: 0000000000000001 R11: 0000000000000001 R12: 0000000000000246 [ 422.128496] R13: 0000000003000000 R14: ffffffff82e5f2e0 R15: 0000000000000002 [ 422.135801] FS: 0000000000000000(0000) GS:ffff8801db700000(0000) knlGS:0000000000000000 [ 422.144099] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 422.150020] CR2: 00007f3934266000 CR3: 00000000ba69b000 CR4: 00000000001606b0 [ 422.157612] Stack: [ 422.159740] 0000000000000001 ffffffff82e5f2e0 ffffffff831a6ac0 fffffbfff0634c34 [ 422.167370] 000000000001b6c0 0000000000000008 ffff8800001d7cd8 ffffffff81092bee [ 422.174924] 0000000000000008 ffffffff82924260 ffff8800001d7d30 ffffffff81ab8252 [ 422.182438] Call Trace: [ 422.185054] [] nmi_raise_cpu_backtrace+0x5e/0x80 [ 422.191492] [] nmi_trigger_all_cpu_backtrace.cold+0xa1/0xae [ 422.198904] [] ? print_lock+0xa8/0xab [ 422.204405] [] ? irq_force_complete_move+0x330/0x330 [ 422.211155] [] arch_trigger_all_cpu_backtrace+0x14/0x20 [ 422.218515] [] watchdog.cold+0xd3/0xee [ 422.224083] [] ? watchdog+0xac/0xa00 [ 422.229481] [] ? reset_hung_task_detector+0x20/0x20 [ 422.236161] [] kthread+0x273/0x310 [ 422.241326] [] ? kthread_create_on_node+0x4c0/0x4c0 [ 422.248016] [] ? _raw_spin_unlock_irq+0x39/0x60 [ 422.254336] [] ? finish_task_switch+0x1e1/0x660 [ 422.260706] [] ? finish_task_switch+0x1b3/0x660 [ 422.267051] [] ? __schedule+0x7af/0x1ee0 [ 422.272739] [] ? __schedule+0x7a3/0x1ee0 [ 422.278550] [] ? __schedule+0x7af/0x1ee0 [ 422.284469] [] ? kthread_create_on_node+0x4c0/0x4c0 [ 422.291137] [] ret_from_fork+0x55/0x80 [ 422.296724] [] ? kthread_create_on_node+0x4c0/0x4c0 [ 422.303382] Code: 00 c3 5f ff 80 e6 10 75 e1 41 c1 e5 18 44 89 2c 25 10 c3 5f ff 44 89 fa 09 da 80 cf 04 41 83 ff 02 0f 44 d3 89 14 25 00 c3 5f ff <41> f7 c4 00 02 00 00 75 1e 4c 89 e7 57 9d 0f 1f 44 00 00 e8 f1 [ 422.322543] Kernel panic - not syncing: hung_task: blocked tasks [ 422.328676] CPU: 1 PID: 20 Comm: khungtaskd Not tainted 4.4.174+ #4 [ 422.335052] 0000000000000000 48ceec6601fd2b5b ffff8800001d7c60 ffffffff81aad1a1 [ 422.343195] ffff8800b6a317c0 ffffffff82872120 dffffc0000000000 0000000000000002 [ 422.351174] 00000000003fff9a ffff8800001d7d40 ffffffff813a48c2 0000000041b58ab3 [ 422.359155] Call Trace: [ 422.361723] [] dump_stack+0xc1/0x120 [ 422.367074] [] panic+0x1b9/0x37b [ 422.372078] [] ? add_taint.cold+0x16/0x16 [ 422.377858] [] ? nmi_trigger_all_cpu_backtrace+0x3e1/0x490 [ 422.385112] [] ? nmi_trigger_all_cpu_backtrace+0x3c6/0x490 [ 422.392366] [] ? nmi_trigger_all_cpu_backtrace+0x3c6/0x490 [ 422.399618] [] watchdog.cold+0xe4/0xee [ 422.405138] [] ? watchdog+0xac/0xa00 [ 422.410519] [] ? reset_hung_task_detector+0x20/0x20 [ 422.417172] [] kthread+0x273/0x310 [ 422.422345] [] ? kthread_create_on_node+0x4c0/0x4c0 [ 422.428997] [] ? _raw_spin_unlock_irq+0x39/0x60 [ 422.435296] [] ? finish_task_switch+0x1e1/0x660 [ 422.441591] [] ? finish_task_switch+0x1b3/0x660 [ 422.448037] [] ? __schedule+0x7af/0x1ee0 [ 422.453778] [] ? __schedule+0x7a3/0x1ee0 [ 422.459476] [] ? __schedule+0x7af/0x1ee0 [ 422.465167] [] ? kthread_create_on_node+0x4c0/0x4c0 [ 422.471815] [] ret_from_fork+0x55/0x80 [ 422.477334] [] ? kthread_create_on_node+0x4c0/0x4c0 [ 422.484378] Kernel Offset: disabled [ 422.488013] Rebooting in 86400 seconds..