7f0000ffb000/0x2000)=nil) shmctl$SHM_LOCK(r1, 0xb) bind$alg(r0, &(0x7f0000002640)={0x26, 'aead\x00', 0x0, 0x0, 'rfc7539(cfb(twofish),rmd128-generic)\x00'}, 0x58) ioctl$KVM_SET_ONE_REG(0xffffffffffffffff, 0x4010aeac, &(0x7f00000000c0)={0xfffffffffffff098, 0x1}) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000001400)="b7f2288a911993f0265df5cf1cdd8b55b062950b86bc01abc8464d4f8a906151", 0x20) r2 = openat$rfkill(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/rfkill\x00', 0x400, 0x0) r3 = syz_genetlink_get_family_id$tipc(&(0x7f0000000340)='TIPC\x00') sendmsg$TIPC_CMD_ENABLE_BEARER(r2, &(0x7f0000000400)={&(0x7f0000000300)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f00000003c0)={&(0x7f0000000380)={0x34, r3, 0x0, 0x70bd28, 0x25dfdbfd, {{}, 0x0, 0x4101, 0x0, {0x18, 0x17, {0x8, 0x2, @l2={'eth', 0x3a, 'teql0\x00'}}}}, ["", "", "", "", "", "", ""]}, 0x34}, 0x1, 0x0, 0x0, 0x40}, 0x200000c0) r4 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000080)='/dev/mixer\x00', 0x4040, 0x0) getsockopt$inet_sctp_SCTP_ASSOCINFO(0xffffffffffffff9c, 0x84, 0x1, &(0x7f00000001c0)={0x0, 0x1, 0x2, 0x100, 0x8001, 0x9}, &(0x7f0000000200)=0x14) r5 = accept$alg(r0, 0x0, 0x0) sendmsg$alg(r5, &(0x7f00000013c0)={0x0, 0x0, &(0x7f0000000200), 0x0, &(0x7f0000001340)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}, 0x0) recvmmsg(r5, &(0x7f0000008e80)=[{{&(0x7f0000000140)=@ethernet={0x0, @remote}, 0x80, &(0x7f0000001600)=[{&(0x7f0000001540)=""/165, 0x536}], 0x1, &(0x7f0000001680)=""/72, 0x48}}], 0x1, 0x0, &(0x7f0000002240)) ioctl$VIDIOC_SUBDEV_ENUM_FRAME_SIZE(0xffffffffffffffff, 0xc040564a, &(0x7f0000000100)={0x1, 0x0, 0x2013, 0x6d, 0x7, 0x1, 0x1, 0x1}) pipe2(&(0x7f0000000000)={0xffffffffffffffff}, 0x4000) socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$PPPIOCCONNECT(r2, 0x4004743a, &(0x7f0000000440)=0x2) ioctl$PPPIOCGIDLE(r6, 0x8010743f, &(0x7f0000000040)) ioctl$SIOCX25SCAUSEDIAG(r4, 0x89ec, &(0x7f0000000280)={0x2, 0x2}) 04:01:23 executing program 5: r0 = socket$inet6(0xa, 0x2, 0x0) r1 = syz_open_dev$mice(&(0x7f00000002c0)='/dev/input/mice\x00', 0x0, 0x0) ioctl$PPPOEIOCDFWD(r1, 0xb101, 0x0) syz_genetlink_get_family_id$nbd(&(0x7f0000000480)='nbd\x00') getsockopt$inet6_IPV6_XFRM_POLICY(r0, 0x29, 0x23, &(0x7f0000000340)={{{@in=@local, @in=@loopback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@local}, 0x0, @in=@remote}}, &(0x7f0000000140)=0xe8) connect$can_bcm(0xffffffffffffffff, &(0x7f00000001c0), 0x10) bind$inet6(r0, &(0x7f0000000040)={0xa, 0x4e24}, 0x1c) lsetxattr$security_ima(&(0x7f0000000280)='./file0\x00', &(0x7f0000000440)='security.ima\x00', 0x0, 0x0, 0x1) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clock_gettime(0x0, &(0x7f0000000100)={0x0, 0x0}) r4 = openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) bind(r4, &(0x7f0000000580)=@can={0x1d, r2}, 0x80) clock_gettime(0x3, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff}) ppoll(&(0x7f0000000000)=[{r0, 0x41a}], 0x1, &(0x7f0000000200)={0x0, r3+30000000}, &(0x7f0000000240), 0x8) connect$inet6(r0, &(0x7f0000000080)={0xa, 0x4e24, 0x0, @ipv4={[], [], @loopback}}, 0x1c) readv(0xffffffffffffffff, 0x0, 0x0) sendmmsg(r0, &(0x7f00000092c0), 0x4ff, 0x0) connect$pptp(r5, &(0x7f00000004c0)={0x18, 0x2, {0x0, @multicast1}}, 0x1e) [ 597.852942] binder: release 21040:21042 transaction 286 out, still active 04:01:23 executing program 2: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000440)=@updpolicy={0xb8, 0x19, 0x523, 0x0, 0x0, {{@in=@multicast2, @in6=@empty={[0x0, 0x0, 0xa]}, 0x0, 0x0, 0x0, 0x0, 0xa}}}, 0xb8}}, 0x0) 04:01:23 executing program 1: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) recvmsg(0xffffffffffffffff, &(0x7f00000036c0)={&(0x7f0000000180)=@can, 0xfd28, &(0x7f00000035c0), 0x0, &(0x7f0000003680)=""/41, 0x29}, 0x0) bind$alg(0xffffffffffffffff, &(0x7f0000001300)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb(blowfish)\x00'}, 0x58) setsockopt$ALG_SET_KEY(0xffffffffffffffff, 0x117, 0x1, &(0x7f0000ff8000)="0a0775b0", 0x4) r0 = accept$alg(0xffffffffffffffff, 0x0, 0x0) sendmmsg$alg(r0, &(0x7f0000003e80)=[{0x0, 0x0, &(0x7f0000002a80), 0x167, &(0x7f0000000100)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x0) recvmsg(r0, &(0x7f0000000000)={&(0x7f0000f7ffa8)=@alg, 0x61, &(0x7f0000000140)=[{&(0x7f0000000200)=""/4096, 0xfffffe45}], 0x1, &(0x7f0000fb3fa9)=""/87, 0x57}, 0x0) 04:01:23 executing program 3: r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x80000000000005, 0x3) bind$bt_l2cap(r0, &(0x7f0000000040), 0xe) listen(r0, 0x0) 04:01:23 executing program 2: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000440)=@updpolicy={0xb8, 0x19, 0x523, 0x0, 0x0, {{@in=@multicast2, @in6=@empty={[0x0, 0x0, 0xe]}, 0x0, 0x0, 0x0, 0x0, 0xa}}}, 0xb8}}, 0x0) [ 598.182547] binder: BINDER_SET_CONTEXT_MGR already set [ 598.192146] binder: 21058:21070 ioctl 40046207 0 returned -16 04:01:23 executing program 4: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000240)='/dev/vga_arbiter\x00', 0x24080, 0x0) r1 = shmget(0xffffffffffffffff, 0x2000, 0x900, &(0x7f0000ffb000/0x2000)=nil) shmctl$SHM_LOCK(r1, 0xb) bind$alg(r0, &(0x7f0000002640)={0x26, 'aead\x00', 0x0, 0x0, 'rfc7539(cfb(twofish),rmd128-generic)\x00'}, 0x58) ioctl$KVM_SET_ONE_REG(0xffffffffffffffff, 0x4010aeac, &(0x7f00000000c0)={0xfffffffffffff098, 0x1}) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000001400)="b7f2288a911993f0265df5cf1cdd8b55b062950b86bc01abc8464d4f8a906151", 0x20) r2 = openat$rfkill(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/rfkill\x00', 0x400, 0x0) r3 = syz_genetlink_get_family_id$tipc(&(0x7f0000000340)='TIPC\x00') sendmsg$TIPC_CMD_ENABLE_BEARER(r2, &(0x7f0000000400)={&(0x7f0000000300)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f00000003c0)={&(0x7f0000000380)={0x34, r3, 0x0, 0x70bd28, 0x25dfdbfd, {{}, 0x0, 0x4101, 0x0, {0x18, 0x17, {0x8, 0x2, @l2={'eth', 0x3a, 'teql0\x00'}}}}, ["", "", "", "", "", "", ""]}, 0x34}, 0x1, 0x0, 0x0, 0x40}, 0x200000c0) r4 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000080)='/dev/mixer\x00', 0x4040, 0x0) getsockopt$inet_sctp_SCTP_ASSOCINFO(0xffffffffffffff9c, 0x84, 0x1, &(0x7f00000001c0)={0x0, 0x1, 0x2, 0x100, 0x8001, 0x9}, &(0x7f0000000200)=0x14) r5 = accept$alg(r0, 0x0, 0x0) sendmsg$alg(r5, &(0x7f00000013c0)={0x0, 0x0, &(0x7f0000000200), 0x0, &(0x7f0000001340)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}, 0x0) recvmmsg(r5, &(0x7f0000008e80)=[{{&(0x7f0000000140)=@ethernet={0x0, @remote}, 0x80, &(0x7f0000001600)=[{&(0x7f0000001540)=""/165, 0x536}], 0x1, &(0x7f0000001680)=""/72, 0x48}}], 0x1, 0x0, &(0x7f0000002240)) ioctl$VIDIOC_SUBDEV_ENUM_FRAME_SIZE(0xffffffffffffffff, 0xc040564a, &(0x7f0000000100)={0x1, 0x0, 0x2013, 0x6d, 0x7, 0x1, 0x1, 0x1}) pipe2(&(0x7f0000000000)={0xffffffffffffffff}, 0x4000) socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$PPPIOCCONNECT(r2, 0x4004743a, &(0x7f0000000440)=0x2) ioctl$PPPIOCGIDLE(r6, 0x8010743f, &(0x7f0000000040)) ioctl$SIOCX25SCAUSEDIAG(r4, 0x89ec, &(0x7f0000000280)={0x2, 0x2}) 04:01:23 executing program 1: r0 = socket$alg(0x26, 0x5, 0x0) recvmsg(0xffffffffffffffff, &(0x7f00000036c0)={&(0x7f0000000180)=@can, 0xfd28, &(0x7f00000035c0), 0x0, &(0x7f0000003680)=""/41, 0x29}, 0x0) bind$alg(r0, &(0x7f0000001300)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb(blowfish)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000ff8000)="0a0775b0", 0x4) r1 = accept$alg(r0, 0x0, 0x0) sendmmsg$alg(r1, &(0x7f0000003e80)=[{0x0, 0x0, &(0x7f0000002a80), 0x167, &(0x7f0000000100)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x0) recvmsg(r1, &(0x7f0000000000)={&(0x7f0000f7ffa8)=@alg, 0x61, &(0x7f0000000140)=[{&(0x7f0000000200)=""/4096, 0xfffffe45}], 0x1, &(0x7f0000fb3fa9)=""/87, 0x57}, 0x0) [ 598.229288] binder: 21058:21072 Release 1 refcount change on invalid ref 1 ret -22 [ 598.319629] binder: 21058:21070 BC_ACQUIRE_DONE u0000000000000000 no match [ 598.340109] binder: 21058:21070 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 [ 598.385436] binder: 21058:21070 Release 1 refcount change on invalid ref 2 ret -22 04:01:24 executing program 0: r0 = perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) setxattr$security_smack_entry(&(0x7f0000000380)='./file0\x00', &(0x7f0000000480)='security.SMACK64IPIN\x00', &(0x7f0000000540)='^vboxnet1^\x00', 0xb, 0x1) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x0, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r1, &(0x7f0000000040), 0x0, 0x1}, 0x20) unlink(&(0x7f0000000900)='./file0/file0\x00') r2 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r3 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r3, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, &(0x7f00000006c0)={0x0}) ioctl$BINDER_GET_NODE_DEBUG_INFO(r2, 0xc018620b, &(0x7f0000000640)={r4}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f00000000c0)=[@enter_looper], 0x48, 0x0, &(0x7f0000000700)="2ba063fb309ec7fdbfb08e6e91baee7d7d4599fe14129a4d426834556ae420e087d59c0c7be7fcad1abb7e1f8f446f373f611ca1ee9c2231708e18a47bc68a2a79a0b48931f6ff6d"}) ioctl$BINDER_SET_CONTEXT_MGR(r3, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x1) prctl$PR_SET_NAME(0xf, &(0x7f00000004c0)='/group.stat\x00') ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, &(0x7f0000000780)}) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f0000000680)}) ioctl$FS_IOC_FIEMAP(r3, 0xc020660b, &(0x7f0000000b80)=ANY=[@ANYBLOB="0000010000000000200000000000000005000000010000000a00000000000000ff030000000000001a0a000000000000050000000000000000000000000000000000000000000000080000000000000000000000000000000800000000000000ffff0000000000000100008000000000000000000000000000000000000000000000000000000000000000000000000008000000000000003f0000000000000008000000000000000000000000000000000000000000800800000000000000000000000000000200000000000000000400000000000000000000010000000000000000000000000000000000000002110000000000000000000000000000cc0000000000000000000000000000001b0000000000000000000000000000000000000000000000841400000000000000000000000000000300000000000000feffffffffffffff000000000000000000000000000000000000000000000000020000000000000000000000000000000600000000000000ff01000000000000040000000000000000000000000000000000000000000000000400000000000000000000000000007be70000000000000900000000000000ff7f0000000000000000000000000000000000000000000004180000000000000000000000000000ffffffff0000000081000000000000000600000000000000000000000000000000000000000000000400000000000000000000000000000002000000000000000500000000000000ff7fffffffffffff0000000000000000000000000000000004040000000000000000000000000000"]) r6 = creat(&(0x7f00000000c0)='./file0\x00', 0x0) openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000100)='/group.stat\x00', 0x2761, 0x0) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000080), 0xffffffffffffffff) getpid() fallocate(r0, 0x0, 0x0, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x2f, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) memfd_create(&(0x7f0000000080)='!proccgroup\x00', 0x0) ioctl$sock_inet_SIOCSIFPFLAGS(0xffffffffffffffff, 0x8934, &(0x7f0000000400)={'veth0_to_bridge\x00', 0x100}) accept(r6, &(0x7f0000000580)=@alg, &(0x7f0000000600)=0x80) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x2400, 0x8000) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000008c0)={0x2c, 0x0, &(0x7f0000000780)=[@acquire_done={0x40106309, r5, 0x2}, @clear_death={0x400c630f, 0x1, 0x3}, @release={0x40046306, 0x2}], 0xc1, 0x0, &(0x7f00000007c0)="859547f83b9b058a973a491d7e6378544744f2b56b02270a2f78214a936e9afb25cd94695643af6563f86771aa9621b9f30f2ca538b018247a633c28ee01e03b4639679311117971e60dc1538f34e961ae301463172c41754be988f6beb0ce4d83c69f86c236d29520e6cdaf5dbb60404c66d63315ff287deac8632781d0197ef1f81314da0a1ed90b681842cf85a41b496ce0a7a6f5aa4b9b23483eea8861be89b3398c6aec3349174f9cdc9de34df361ac9bf7afd8566849487c3c0a1e3aaacd"}) 04:01:24 executing program 3: r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x3) bind$bt_l2cap(r0, &(0x7f0000000040)={0x1f, 0x0, {0x0, 0xfffffffffffffffd, 0x0, 0xffffffffffffffff}, 0xfffffffffffffffe}, 0xe) listen(r0, 0x0) r1 = open(&(0x7f0000000000)='./file0\x00', 0x400, 0x0) ioctl$KVM_DIRTY_TLB(r1, 0x4010aeaa, &(0x7f0000000080)={0x7, 0x7}) ioctl$EVIOCSKEYCODE(r1, 0x40084504, &(0x7f0000000100)=[0x100000000, 0x4]) ioctl$KVM_TPR_ACCESS_REPORTING(r1, 0xc028ae92, &(0x7f00000000c0)={0xffffffffffffff00, 0x9}) 04:01:24 executing program 1: r0 = socket$alg(0x26, 0x5, 0x0) recvmsg(0xffffffffffffffff, &(0x7f00000036c0)={&(0x7f0000000180)=@can, 0xfd28, &(0x7f00000035c0), 0x0, &(0x7f0000003680)=""/41, 0x29}, 0x0) bind$alg(r0, &(0x7f0000001300)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb(blowfish)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000ff8000)="0a0775b0", 0x4) r1 = accept$alg(r0, 0x0, 0x0) sendmmsg$alg(r1, &(0x7f0000003e80)=[{0x0, 0x0, &(0x7f0000002a80), 0x167, &(0x7f0000000100)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x0) recvmsg(r1, &(0x7f0000000000)={&(0x7f0000f7ffa8)=@alg, 0x61, &(0x7f0000000140)=[{&(0x7f0000000200)=""/4096, 0xfffffe45}], 0x1, &(0x7f0000fb3fa9)=""/87, 0x57}, 0x0) 04:01:24 executing program 2: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000440)=@updpolicy={0xb8, 0x19, 0x523, 0x0, 0x0, {{@in=@multicast2, @in6=@empty={[0x0, 0x0, 0xf]}, 0x0, 0x0, 0x0, 0x0, 0xa}}}, 0xb8}}, 0x0) 04:01:24 executing program 4: r0 = perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) setxattr$security_smack_entry(&(0x7f0000000380)='./file0\x00', &(0x7f0000000480)='security.SMACK64IPIN\x00', &(0x7f0000000540)='^vboxnet1^\x00', 0xb, 0x1) r1 = bpf$MAP_CREATE(0x0, 0x0, 0x0) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r1, &(0x7f0000000040), 0x0, 0x1}, 0x20) unlink(&(0x7f0000000900)='./file0/file0\x00') r2 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r3 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r3, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, &(0x7f00000006c0)={0x0}) ioctl$BINDER_GET_NODE_DEBUG_INFO(r2, 0xc018620b, &(0x7f0000000640)={r4}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f00000000c0)=[@enter_looper], 0x48, 0x0, &(0x7f0000000700)="2ba063fb309ec7fdbfb08e6e91baee7d7d4599fe14129a4d426834556ae420e087d59c0c7be7fcad1abb7e1f8f446f373f611ca1ee9c2231708e18a47bc68a2a79a0b48931f6ff6d"}) ioctl$BINDER_SET_CONTEXT_MGR(r3, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x1) prctl$PR_SET_NAME(0xf, &(0x7f00000004c0)='/group.stat\x00') ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, &(0x7f0000000780)}) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f0000000680)}) ioctl$FS_IOC_FIEMAP(r3, 0xc020660b, &(0x7f0000000b80)=ANY=[@ANYBLOB="0000010000000000200000000000000005000000010000000a00000000000000ff030000000000001a0a000000000000050000000000000000000000000000000000000000000000080000000000000000000000000000000800000000000000ffff0000000000000100008000000000000000000000000000000000000000000000000000000000000000000000000008000000000000003f0000000000000008000000000000000000000000000000000000000000800800000000000000000000000000000200000000000000000400000000000000000000010000000000000000000000000000000000000002110000000000000000000000000000cc0000000000000000000000000000001b0000000000000000000000000000000000000000000000841400000000000000000000000000000300000000000000feffffffffffffff000000000000000000000000000000000000000000000000020000000000000000000000000000000600000000000000ff01000000000000040000000000000000000000000000000000000000000000000400000000000000000000000000007be70000000000000900000000000000ff7f0000000000000000000000000000000000000000000004180000000000000000000000000000ffffffff0000000081000000000000000600000000000000000000000000000000000000000000000400000000000000000000000000000002000000000000000500000000000000ff7fffffffffffff0000000000000000000000000000000004040000000000000000000000000000"]) r6 = creat(&(0x7f00000000c0)='./file0\x00', 0x0) openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000100)='/group.stat\x00', 0x2761, 0x0) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000080), 0xffffffffffffffff) getpid() fallocate(r0, 0x0, 0x0, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x2f, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) memfd_create(&(0x7f0000000080)='!proccgroup\x00', 0x0) ioctl$sock_inet_SIOCSIFPFLAGS(0xffffffffffffffff, 0x8934, &(0x7f0000000400)={'veth0_to_bridge\x00', 0x100}) accept(r6, &(0x7f0000000580)=@alg, &(0x7f0000000600)=0x80) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x2400, 0x8000) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000008c0)={0x2c, 0x0, &(0x7f0000000780)=[@acquire_done={0x40106309, r5, 0x2}, @clear_death={0x400c630f, 0x1, 0x3}, @release={0x40046306, 0x2}], 0xc1, 0x0, &(0x7f00000007c0)="859547f83b9b058a973a491d7e6378544744f2b56b02270a2f78214a936e9afb25cd94695643af6563f86771aa9621b9f30f2ca538b018247a633c28ee01e03b4639679311117971e60dc1538f34e961ae301463172c41754be988f6beb0ce4d83c69f86c236d29520e6cdaf5dbb60404c66d63315ff287deac8632781d0197ef1f81314da0a1ed90b681842cf85a41b496ce0a7a6f5aa4b9b23483eea8861be89b3398c6aec3349174f9cdc9de34df361ac9bf7afd8566849487c3c0a1e3aaacd"}) 04:01:24 executing program 5: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000240)='/dev/vga_arbiter\x00', 0x24080, 0x0) r1 = shmget(0xffffffffffffffff, 0x2000, 0x900, &(0x7f0000ffb000/0x2000)=nil) shmctl$SHM_LOCK(r1, 0xb) bind$alg(r0, &(0x7f0000002640)={0x26, 'aead\x00', 0x0, 0x0, 'rfc7539(cfb(twofish),rmd128-generic)\x00'}, 0x58) ioctl$KVM_SET_ONE_REG(0xffffffffffffffff, 0x4010aeac, &(0x7f00000000c0)={0xfffffffffffff098, 0x1}) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000001400)="b7f2288a911993f0265df5cf1cdd8b55b062950b86bc01abc8464d4f8a906151", 0x20) r2 = openat$rfkill(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/rfkill\x00', 0x400, 0x0) r3 = syz_genetlink_get_family_id$tipc(&(0x7f0000000340)='TIPC\x00') sendmsg$TIPC_CMD_ENABLE_BEARER(r2, &(0x7f0000000400)={&(0x7f0000000300)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f00000003c0)={&(0x7f0000000380)={0x34, r3, 0x0, 0x70bd28, 0x25dfdbfd, {{}, 0x0, 0x4101, 0x0, {0x18, 0x17, {0x8, 0x2, @l2={'eth', 0x3a, 'teql0\x00'}}}}, ["", "", "", "", "", "", ""]}, 0x34}, 0x1, 0x0, 0x0, 0x40}, 0x200000c0) r4 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000080)='/dev/mixer\x00', 0x4040, 0x0) getsockopt$inet_sctp_SCTP_ASSOCINFO(0xffffffffffffff9c, 0x84, 0x1, &(0x7f00000001c0)={0x0, 0x1, 0x2, 0x100, 0x8001, 0x9}, &(0x7f0000000200)=0x14) r5 = accept$alg(r0, 0x0, 0x0) sendmsg$alg(r5, &(0x7f00000013c0)={0x0, 0x0, &(0x7f0000000200), 0x0, &(0x7f0000001340)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}, 0x0) recvmmsg(r5, &(0x7f0000008e80)=[{{&(0x7f0000000140)=@ethernet={0x0, @remote}, 0x80, &(0x7f0000001600)=[{&(0x7f0000001540)=""/165, 0x536}], 0x1, &(0x7f0000001680)=""/72, 0x48}}], 0x1, 0x0, &(0x7f0000002240)) ioctl$VIDIOC_SUBDEV_ENUM_FRAME_SIZE(0xffffffffffffffff, 0xc040564a, &(0x7f0000000100)={0x1, 0x0, 0x2013, 0x6d, 0x7, 0x1, 0x1, 0x1}) pipe2(&(0x7f0000000000)={0xffffffffffffffff}, 0x4000) socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$PPPIOCCONNECT(r2, 0x4004743a, &(0x7f0000000440)=0x2) ioctl$PPPIOCGIDLE(r6, 0x8010743f, &(0x7f0000000040)) ioctl$SIOCX25SCAUSEDIAG(r4, 0x89ec, &(0x7f0000000280)={0x2, 0x2}) [ 598.833926] binder: release 21058:21072 transaction 289 out, still active 04:01:24 executing program 3: r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x3) fsetxattr$security_smack_entry(r0, &(0x7f0000000000)='security.SMACK64MMAP\x00', &(0x7f0000000080)='\x00', 0x1, 0x3) bind$bt_l2cap(r0, &(0x7f0000000040), 0xe) listen(r0, 0x0) 04:01:24 executing program 2: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000440)=@updpolicy={0xb8, 0x19, 0x523, 0x0, 0x0, {{@in=@multicast2, @in6=@empty={[0x0, 0x0, 0x10]}, 0x0, 0x0, 0x0, 0x0, 0xa}}}, 0xb8}}, 0x0) 04:01:24 executing program 1: r0 = socket$alg(0x26, 0x5, 0x0) recvmsg(0xffffffffffffffff, &(0x7f00000036c0)={&(0x7f0000000180)=@can, 0xfd28, &(0x7f00000035c0), 0x0, &(0x7f0000003680)=""/41, 0x29}, 0x0) bind$alg(r0, &(0x7f0000001300)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb(blowfish)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000ff8000)="0a0775b0", 0x4) r1 = accept$alg(r0, 0x0, 0x0) sendmmsg$alg(r1, &(0x7f0000003e80)=[{0x0, 0x0, &(0x7f0000002a80), 0x167, &(0x7f0000000100)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x0) recvmsg(r1, &(0x7f0000000000)={&(0x7f0000f7ffa8)=@alg, 0x61, &(0x7f0000000140)=[{&(0x7f0000000200)=""/4096, 0xfffffe45}], 0x1, &(0x7f0000fb3fa9)=""/87, 0x57}, 0x0) [ 599.083663] binder: BINDER_SET_CONTEXT_MGR already set [ 599.103698] binder: 21093:21107 ioctl 40046207 0 returned -16 04:01:24 executing program 2: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000440)=@updpolicy={0xb8, 0x19, 0x523, 0x0, 0x0, {{@in=@multicast2, @in6=@empty={[0x0, 0x0, 0x2f]}, 0x0, 0x0, 0x0, 0x0, 0xa}}}, 0xb8}}, 0x0) 04:01:24 executing program 3: r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x3) bind$bt_l2cap(r0, &(0x7f0000000040)={0x1f, 0x0, {0x0, 0x8}}, 0xe) listen(r0, 0x0) nanosleep(&(0x7f0000000000)={0x77359400}, 0x0) [ 599.150989] binder: 21093:21107 Release 1 refcount change on invalid ref 1 ret -22 04:01:24 executing program 1: perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) recvmsg(0xffffffffffffffff, &(0x7f00000036c0)={&(0x7f0000000180)=@can, 0xfd28, &(0x7f00000035c0), 0x0, &(0x7f0000003680)=""/41, 0x29}, 0x0) bind$alg(r0, &(0x7f0000001300)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb(blowfish)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000ff8000)="0a0775b0", 0x4) r1 = accept$alg(r0, 0x0, 0x0) sendmmsg$alg(r1, &(0x7f0000003e80)=[{0x0, 0x0, &(0x7f0000002a80), 0x167, &(0x7f0000000100)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x0) recvmsg(r1, &(0x7f0000000000)={&(0x7f0000f7ffa8)=@alg, 0x61, &(0x7f0000000140)=[{&(0x7f0000000200)=""/4096, 0xfffffe45}], 0x1, &(0x7f0000fb3fa9)=""/87, 0x57}, 0x0) [ 599.244073] binder: 21093:21107 BC_ACQUIRE_DONE u0000000000000000 no match [ 599.280797] binder: 21093:21107 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 [ 599.287958] binder: 21093:21107 Release 1 refcount change on invalid ref 2 ret -22 04:01:25 executing program 0: r0 = perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) setxattr$security_smack_entry(&(0x7f0000000380)='./file0\x00', &(0x7f0000000480)='security.SMACK64IPIN\x00', &(0x7f0000000540)='^vboxnet1^\x00', 0xb, 0x1) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x0, 0x209e1e, 0x3, 0x1}, 0x2c) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r1, &(0x7f0000000040), 0x0, 0x1}, 0x20) unlink(&(0x7f0000000900)='./file0/file0\x00') r2 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r3 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r3, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, &(0x7f00000006c0)={0x0}) ioctl$BINDER_GET_NODE_DEBUG_INFO(r2, 0xc018620b, &(0x7f0000000640)={r4}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f00000000c0)=[@enter_looper], 0x48, 0x0, &(0x7f0000000700)="2ba063fb309ec7fdbfb08e6e91baee7d7d4599fe14129a4d426834556ae420e087d59c0c7be7fcad1abb7e1f8f446f373f611ca1ee9c2231708e18a47bc68a2a79a0b48931f6ff6d"}) ioctl$BINDER_SET_CONTEXT_MGR(r3, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x1) prctl$PR_SET_NAME(0xf, &(0x7f00000004c0)='/group.stat\x00') ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, &(0x7f0000000780)}) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f0000000680)}) ioctl$FS_IOC_FIEMAP(r3, 0xc020660b, &(0x7f0000000b80)=ANY=[@ANYBLOB="0000010000000000200000000000000005000000010000000a00000000000000ff030000000000001a0a000000000000050000000000000000000000000000000000000000000000080000000000000000000000000000000800000000000000ffff0000000000000100008000000000000000000000000000000000000000000000000000000000000000000000000008000000000000003f0000000000000008000000000000000000000000000000000000000000800800000000000000000000000000000200000000000000000400000000000000000000010000000000000000000000000000000000000002110000000000000000000000000000cc0000000000000000000000000000001b0000000000000000000000000000000000000000000000841400000000000000000000000000000300000000000000feffffffffffffff000000000000000000000000000000000000000000000000020000000000000000000000000000000600000000000000ff01000000000000040000000000000000000000000000000000000000000000000400000000000000000000000000007be70000000000000900000000000000ff7f0000000000000000000000000000000000000000000004180000000000000000000000000000ffffffff0000000081000000000000000600000000000000000000000000000000000000000000000400000000000000000000000000000002000000000000000500000000000000ff7fffffffffffff0000000000000000000000000000000004040000000000000000000000000000"]) r6 = creat(&(0x7f00000000c0)='./file0\x00', 0x0) openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000100)='/group.stat\x00', 0x2761, 0x0) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000080), 0xffffffffffffffff) getpid() fallocate(r0, 0x0, 0x0, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x2f, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) memfd_create(&(0x7f0000000080)='!proccgroup\x00', 0x0) ioctl$sock_inet_SIOCSIFPFLAGS(0xffffffffffffffff, 0x8934, &(0x7f0000000400)={'veth0_to_bridge\x00', 0x100}) accept(r6, &(0x7f0000000580)=@alg, &(0x7f0000000600)=0x80) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x2400, 0x8000) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000008c0)={0x2c, 0x0, &(0x7f0000000780)=[@acquire_done={0x40106309, r5, 0x2}, @clear_death={0x400c630f, 0x1, 0x3}, @release={0x40046306, 0x2}], 0xc1, 0x0, &(0x7f00000007c0)="859547f83b9b058a973a491d7e6378544744f2b56b02270a2f78214a936e9afb25cd94695643af6563f86771aa9621b9f30f2ca538b018247a633c28ee01e03b4639679311117971e60dc1538f34e961ae301463172c41754be988f6beb0ce4d83c69f86c236d29520e6cdaf5dbb60404c66d63315ff287deac8632781d0197ef1f81314da0a1ed90b681842cf85a41b496ce0a7a6f5aa4b9b23483eea8861be89b3398c6aec3349174f9cdc9de34df361ac9bf7afd8566849487c3c0a1e3aaacd"}) 04:01:25 executing program 5: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000240)='/dev/vga_arbiter\x00', 0x24080, 0x0) r1 = shmget(0xffffffffffffffff, 0x2000, 0x900, &(0x7f0000ffb000/0x2000)=nil) shmctl$SHM_LOCK(r1, 0xb) bind$alg(r0, &(0x7f0000002640)={0x26, 'aead\x00', 0x0, 0x0, 'rfc7539(cfb(twofish),rmd128-generic)\x00'}, 0x58) ioctl$KVM_SET_ONE_REG(0xffffffffffffffff, 0x4010aeac, &(0x7f00000000c0)={0xfffffffffffff098, 0x1}) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000001400)="b7f2288a911993f0265df5cf1cdd8b55b062950b86bc01abc8464d4f8a906151", 0x20) r2 = openat$rfkill(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/rfkill\x00', 0x400, 0x0) r3 = syz_genetlink_get_family_id$tipc(&(0x7f0000000340)='TIPC\x00') sendmsg$TIPC_CMD_ENABLE_BEARER(r2, &(0x7f0000000400)={&(0x7f0000000300)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f00000003c0)={&(0x7f0000000380)={0x34, r3, 0x0, 0x70bd28, 0x25dfdbfd, {{}, 0x0, 0x4101, 0x0, {0x18, 0x17, {0x8, 0x2, @l2={'eth', 0x3a, 'teql0\x00'}}}}, ["", "", "", "", "", "", ""]}, 0x34}, 0x1, 0x0, 0x0, 0x40}, 0x200000c0) r4 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000080)='/dev/mixer\x00', 0x4040, 0x0) getsockopt$inet_sctp_SCTP_ASSOCINFO(0xffffffffffffff9c, 0x84, 0x1, &(0x7f00000001c0)={0x0, 0x1, 0x2, 0x100, 0x8001, 0x9}, &(0x7f0000000200)=0x14) r5 = accept$alg(r0, 0x0, 0x0) sendmsg$alg(r5, &(0x7f00000013c0)={0x0, 0x0, &(0x7f0000000200), 0x0, &(0x7f0000001340)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}, 0x0) recvmmsg(r5, &(0x7f0000008e80)=[{{&(0x7f0000000140)=@ethernet={0x0, @remote}, 0x80, &(0x7f0000001600)=[{&(0x7f0000001540)=""/165, 0x536}], 0x1, &(0x7f0000001680)=""/72, 0x48}}], 0x1, 0x0, &(0x7f0000002240)) ioctl$VIDIOC_SUBDEV_ENUM_FRAME_SIZE(0xffffffffffffffff, 0xc040564a, &(0x7f0000000100)={0x1, 0x0, 0x2013, 0x6d, 0x7, 0x1, 0x1, 0x1}) pipe2(&(0x7f0000000000)={0xffffffffffffffff}, 0x4000) socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$PPPIOCCONNECT(r2, 0x4004743a, &(0x7f0000000440)=0x2) ioctl$PPPIOCGIDLE(r6, 0x8010743f, &(0x7f0000000040)) ioctl$SIOCX25SCAUSEDIAG(r4, 0x89ec, &(0x7f0000000280)={0x2, 0x2}) 04:01:25 executing program 4: r0 = perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) setxattr$security_smack_entry(&(0x7f0000000380)='./file0\x00', &(0x7f0000000480)='security.SMACK64IPIN\x00', &(0x7f0000000540)='^vboxnet1^\x00', 0xb, 0x1) r1 = bpf$MAP_CREATE(0x0, 0x0, 0x0) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r1, &(0x7f0000000040), 0x0, 0x1}, 0x20) unlink(&(0x7f0000000900)='./file0/file0\x00') r2 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r3 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r3, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, &(0x7f00000006c0)={0x0}) ioctl$BINDER_GET_NODE_DEBUG_INFO(r2, 0xc018620b, &(0x7f0000000640)={r4}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f00000000c0)=[@enter_looper], 0x48, 0x0, &(0x7f0000000700)="2ba063fb309ec7fdbfb08e6e91baee7d7d4599fe14129a4d426834556ae420e087d59c0c7be7fcad1abb7e1f8f446f373f611ca1ee9c2231708e18a47bc68a2a79a0b48931f6ff6d"}) ioctl$BINDER_SET_CONTEXT_MGR(r3, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x1) prctl$PR_SET_NAME(0xf, &(0x7f00000004c0)='/group.stat\x00') ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, &(0x7f0000000780)}) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f0000000680)}) ioctl$FS_IOC_FIEMAP(r3, 0xc020660b, &(0x7f0000000b80)=ANY=[@ANYBLOB="0000010000000000200000000000000005000000010000000a00000000000000ff030000000000001a0a000000000000050000000000000000000000000000000000000000000000080000000000000000000000000000000800000000000000ffff0000000000000100008000000000000000000000000000000000000000000000000000000000000000000000000008000000000000003f0000000000000008000000000000000000000000000000000000000000800800000000000000000000000000000200000000000000000400000000000000000000010000000000000000000000000000000000000002110000000000000000000000000000cc0000000000000000000000000000001b0000000000000000000000000000000000000000000000841400000000000000000000000000000300000000000000feffffffffffffff000000000000000000000000000000000000000000000000020000000000000000000000000000000600000000000000ff01000000000000040000000000000000000000000000000000000000000000000400000000000000000000000000007be70000000000000900000000000000ff7f0000000000000000000000000000000000000000000004180000000000000000000000000000ffffffff0000000081000000000000000600000000000000000000000000000000000000000000000400000000000000000000000000000002000000000000000500000000000000ff7fffffffffffff0000000000000000000000000000000004040000000000000000000000000000"]) r6 = creat(&(0x7f00000000c0)='./file0\x00', 0x0) openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000100)='/group.stat\x00', 0x2761, 0x0) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000080), 0xffffffffffffffff) getpid() fallocate(r0, 0x0, 0x0, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x2f, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) memfd_create(&(0x7f0000000080)='!proccgroup\x00', 0x0) ioctl$sock_inet_SIOCSIFPFLAGS(0xffffffffffffffff, 0x8934, &(0x7f0000000400)={'veth0_to_bridge\x00', 0x100}) accept(r6, &(0x7f0000000580)=@alg, &(0x7f0000000600)=0x80) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x2400, 0x8000) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000008c0)={0x2c, 0x0, &(0x7f0000000780)=[@acquire_done={0x40106309, r5, 0x2}, @clear_death={0x400c630f, 0x1, 0x3}, @release={0x40046306, 0x2}], 0xc1, 0x0, &(0x7f00000007c0)="859547f83b9b058a973a491d7e6378544744f2b56b02270a2f78214a936e9afb25cd94695643af6563f86771aa9621b9f30f2ca538b018247a633c28ee01e03b4639679311117971e60dc1538f34e961ae301463172c41754be988f6beb0ce4d83c69f86c236d29520e6cdaf5dbb60404c66d63315ff287deac8632781d0197ef1f81314da0a1ed90b681842cf85a41b496ce0a7a6f5aa4b9b23483eea8861be89b3398c6aec3349174f9cdc9de34df361ac9bf7afd8566849487c3c0a1e3aaacd"}) 04:01:25 executing program 2: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000440)=@updpolicy={0xb8, 0x19, 0x523, 0x0, 0x0, {{@in=@multicast2, @in6=@empty={[0x0, 0x0, 0x60]}, 0x0, 0x0, 0x0, 0x0, 0xa}}}, 0xb8}}, 0x0) 04:01:25 executing program 1: perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) recvmsg(0xffffffffffffffff, &(0x7f00000036c0)={&(0x7f0000000180)=@can, 0xfd28, &(0x7f00000035c0), 0x0, &(0x7f0000003680)=""/41, 0x29}, 0x0) bind$alg(r0, &(0x7f0000001300)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb(blowfish)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000ff8000)="0a0775b0", 0x4) r1 = accept$alg(r0, 0x0, 0x0) sendmmsg$alg(r1, &(0x7f0000003e80)=[{0x0, 0x0, &(0x7f0000002a80), 0x167, &(0x7f0000000100)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x0) recvmsg(r1, &(0x7f0000000000)={&(0x7f0000f7ffa8)=@alg, 0x61, &(0x7f0000000140)=[{&(0x7f0000000200)=""/4096, 0xfffffe45}], 0x1, &(0x7f0000fb3fa9)=""/87, 0x57}, 0x0) [ 599.750948] binder: release 21093:21107 transaction 292 out, still active 04:01:25 executing program 1: perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) recvmsg(0xffffffffffffffff, &(0x7f00000036c0)={&(0x7f0000000180)=@can, 0xfd28, &(0x7f00000035c0), 0x0, &(0x7f0000003680)=""/41, 0x29}, 0x0) bind$alg(r0, &(0x7f0000001300)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb(blowfish)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000ff8000)="0a0775b0", 0x4) r1 = accept$alg(r0, 0x0, 0x0) sendmmsg$alg(r1, &(0x7f0000003e80)=[{0x0, 0x0, &(0x7f0000002a80), 0x167, &(0x7f0000000100)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x0) recvmsg(r1, &(0x7f0000000000)={&(0x7f0000f7ffa8)=@alg, 0x61, &(0x7f0000000140)=[{&(0x7f0000000200)=""/4096, 0xfffffe45}], 0x1, &(0x7f0000fb3fa9)=""/87, 0x57}, 0x0) 04:01:25 executing program 2: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000440)=@updpolicy={0xb8, 0x19, 0x523, 0x0, 0x0, {{@in=@multicast2, @in6=@empty={[0x0, 0x0, 0xf0]}, 0x0, 0x0, 0x0, 0x0, 0xa}}}, 0xb8}}, 0x0) 04:01:25 executing program 1: perf_event_open(&(0x7f000001d000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) recvmsg(0xffffffffffffffff, &(0x7f00000036c0)={&(0x7f0000000180)=@can, 0xfd28, &(0x7f00000035c0), 0x0, &(0x7f0000003680)=""/41, 0x29}, 0x0) bind$alg(r0, &(0x7f0000001300)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb(blowfish)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000ff8000)="0a0775b0", 0x4) r1 = accept$alg(r0, 0x0, 0x0) sendmmsg$alg(r1, &(0x7f0000003e80)=[{0x0, 0x0, &(0x7f0000002a80), 0x167, &(0x7f0000000100)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x0) recvmsg(r1, &(0x7f0000000000)={&(0x7f0000f7ffa8)=@alg, 0x61, &(0x7f0000000140)=[{&(0x7f0000000200)=""/4096, 0xfffffe45}], 0x1, &(0x7f0000fb3fa9)=""/87, 0x57}, 0x0) [ 600.027170] binder: BINDER_SET_CONTEXT_MGR already set [ 600.032498] binder: 21131:21139 ioctl 40046207 0 returned -16 04:01:25 executing program 3: r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x3, 0x3) bind$bt_l2cap(r0, &(0x7f0000000040)={0x1f, 0x0, {0x9, 0x0, 0x0, 0x1}}, 0xe) listen(r0, 0x0) r1 = syz_open_dev$cec(&(0x7f0000000000)='/dev/cec#\x00', 0x0, 0x2) ioctl$SIOCAX25ADDFWD(r1, 0x89ea, &(0x7f0000000080)={@bcast, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}}) 04:01:25 executing program 4: r0 = perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) setxattr$security_smack_entry(&(0x7f0000000380)='./file0\x00', &(0x7f0000000480)='security.SMACK64IPIN\x00', &(0x7f0000000540)='^vboxnet1^\x00', 0xb, 0x1) r1 = bpf$MAP_CREATE(0x0, 0x0, 0x0) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r1, &(0x7f0000000040), 0x0, 0x1}, 0x20) unlink(&(0x7f0000000900)='./file0/file0\x00') r2 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r3 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r3, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, &(0x7f00000006c0)={0x0}) ioctl$BINDER_GET_NODE_DEBUG_INFO(r2, 0xc018620b, &(0x7f0000000640)={r4}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f00000000c0)=[@enter_looper], 0x48, 0x0, &(0x7f0000000700)="2ba063fb309ec7fdbfb08e6e91baee7d7d4599fe14129a4d426834556ae420e087d59c0c7be7fcad1abb7e1f8f446f373f611ca1ee9c2231708e18a47bc68a2a79a0b48931f6ff6d"}) ioctl$BINDER_SET_CONTEXT_MGR(r3, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x1) prctl$PR_SET_NAME(0xf, &(0x7f00000004c0)='/group.stat\x00') ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, &(0x7f0000000780)}) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f0000000680)}) ioctl$FS_IOC_FIEMAP(r3, 0xc020660b, &(0x7f0000000b80)=ANY=[@ANYBLOB="0000010000000000200000000000000005000000010000000a00000000000000ff030000000000001a0a000000000000050000000000000000000000000000000000000000000000080000000000000000000000000000000800000000000000ffff0000000000000100008000000000000000000000000000000000000000000000000000000000000000000000000008000000000000003f0000000000000008000000000000000000000000000000000000000000800800000000000000000000000000000200000000000000000400000000000000000000010000000000000000000000000000000000000002110000000000000000000000000000cc0000000000000000000000000000001b0000000000000000000000000000000000000000000000841400000000000000000000000000000300000000000000feffffffffffffff000000000000000000000000000000000000000000000000020000000000000000000000000000000600000000000000ff01000000000000040000000000000000000000000000000000000000000000000400000000000000000000000000007be70000000000000900000000000000ff7f0000000000000000000000000000000000000000000004180000000000000000000000000000ffffffff0000000081000000000000000600000000000000000000000000000000000000000000000400000000000000000000000000000002000000000000000500000000000000ff7fffffffffffff0000000000000000000000000000000004040000000000000000000000000000"]) r6 = creat(&(0x7f00000000c0)='./file0\x00', 0x0) openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000100)='/group.stat\x00', 0x2761, 0x0) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000080), 0xffffffffffffffff) getpid() fallocate(r0, 0x0, 0x0, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x2f, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) memfd_create(&(0x7f0000000080)='!proccgroup\x00', 0x0) ioctl$sock_inet_SIOCSIFPFLAGS(0xffffffffffffffff, 0x8934, &(0x7f0000000400)={'veth0_to_bridge\x00', 0x100}) accept(r6, &(0x7f0000000580)=@alg, &(0x7f0000000600)=0x80) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x2400, 0x8000) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000008c0)={0x2c, 0x0, &(0x7f0000000780)=[@acquire_done={0x40106309, r5, 0x2}, @clear_death={0x400c630f, 0x1, 0x3}, @release={0x40046306, 0x2}], 0xc1, 0x0, &(0x7f00000007c0)="859547f83b9b058a973a491d7e6378544744f2b56b02270a2f78214a936e9afb25cd94695643af6563f86771aa9621b9f30f2ca538b018247a633c28ee01e03b4639679311117971e60dc1538f34e961ae301463172c41754be988f6beb0ce4d83c69f86c236d29520e6cdaf5dbb60404c66d63315ff287deac8632781d0197ef1f81314da0a1ed90b681842cf85a41b496ce0a7a6f5aa4b9b23483eea8861be89b3398c6aec3349174f9cdc9de34df361ac9bf7afd8566849487c3c0a1e3aaacd"}) [ 600.067380] binder: 21131:21139 Release 1 refcount change on invalid ref 1 ret -22 04:01:25 executing program 2: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000440)=@updpolicy={0xb8, 0x19, 0x523, 0x0, 0x0, {{@in=@multicast2, @in6=@empty={[0x0, 0x0, 0x300]}, 0x0, 0x0, 0x0, 0x0, 0xa}}}, 0xb8}}, 0x0) [ 600.141630] binder: 21131:21150 BC_ACQUIRE_DONE u0000000000000000 no match 04:01:25 executing program 5 (fault-call:14 fault-nth:0): r0 = socket$inet6(0xa, 0x2, 0x0) r1 = syz_open_dev$mice(&(0x7f00000002c0)='/dev/input/mice\x00', 0x0, 0x0) ioctl$PPPOEIOCDFWD(r1, 0xb101, 0x0) syz_genetlink_get_family_id$nbd(&(0x7f0000000480)='nbd\x00') getsockopt$inet6_IPV6_XFRM_POLICY(r0, 0x29, 0x23, &(0x7f0000000340)={{{@in=@local, @in=@loopback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@local}, 0x0, @in=@remote}}, &(0x7f0000000140)=0xe8) connect$can_bcm(0xffffffffffffffff, &(0x7f00000001c0), 0x10) bind$inet6(r0, &(0x7f0000000040)={0xa, 0x4e24}, 0x1c) lsetxattr$security_ima(&(0x7f0000000280)='./file0\x00', &(0x7f0000000440)='security.ima\x00', 0x0, 0x0, 0x1) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clock_gettime(0x0, &(0x7f0000000100)={0x0, 0x0}) r4 = openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) bind(r4, &(0x7f0000000580)=@can={0x1d, r2}, 0x80) clock_gettime(0x3, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff}) ppoll(&(0x7f0000000000)=[{r0, 0x41a}], 0x1, &(0x7f0000000200)={0x0, r3+30000000}, &(0x7f0000000240), 0x8) connect$inet6(r0, &(0x7f0000000080)={0xa, 0x4e24, 0x0, @ipv4={[], [], @loopback}}, 0x1c) readv(0xffffffffffffffff, 0x0, 0x0) sendmmsg(r0, &(0x7f00000092c0), 0x4ff, 0x0) connect$pptp(r5, &(0x7f00000004c0)={0x18, 0x2, {0x0, @multicast1}}, 0x1e) [ 600.205160] binder: 21131:21150 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 [ 600.237731] binder: 21131:21150 Release 1 refcount change on invalid ref 2 ret -22 04:01:26 executing program 0: r0 = perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) setxattr$security_smack_entry(&(0x7f0000000380)='./file0\x00', &(0x7f0000000480)='security.SMACK64IPIN\x00', &(0x7f0000000540)='^vboxnet1^\x00', 0xb, 0x1) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x0, 0x209e1e, 0x3, 0x1}, 0x2c) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r1, &(0x7f0000000040), 0x0, 0x1}, 0x20) unlink(&(0x7f0000000900)='./file0/file0\x00') r2 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r3 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r3, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, &(0x7f00000006c0)={0x0}) ioctl$BINDER_GET_NODE_DEBUG_INFO(r2, 0xc018620b, &(0x7f0000000640)={r4}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f00000000c0)=[@enter_looper], 0x48, 0x0, &(0x7f0000000700)="2ba063fb309ec7fdbfb08e6e91baee7d7d4599fe14129a4d426834556ae420e087d59c0c7be7fcad1abb7e1f8f446f373f611ca1ee9c2231708e18a47bc68a2a79a0b48931f6ff6d"}) ioctl$BINDER_SET_CONTEXT_MGR(r3, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x1) prctl$PR_SET_NAME(0xf, &(0x7f00000004c0)='/group.stat\x00') ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, &(0x7f0000000780)}) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f0000000680)}) ioctl$FS_IOC_FIEMAP(r3, 0xc020660b, &(0x7f0000000b80)=ANY=[@ANYBLOB="0000010000000000200000000000000005000000010000000a00000000000000ff030000000000001a0a000000000000050000000000000000000000000000000000000000000000080000000000000000000000000000000800000000000000ffff0000000000000100008000000000000000000000000000000000000000000000000000000000000000000000000008000000000000003f0000000000000008000000000000000000000000000000000000000000800800000000000000000000000000000200000000000000000400000000000000000000010000000000000000000000000000000000000002110000000000000000000000000000cc0000000000000000000000000000001b0000000000000000000000000000000000000000000000841400000000000000000000000000000300000000000000feffffffffffffff000000000000000000000000000000000000000000000000020000000000000000000000000000000600000000000000ff01000000000000040000000000000000000000000000000000000000000000000400000000000000000000000000007be70000000000000900000000000000ff7f0000000000000000000000000000000000000000000004180000000000000000000000000000ffffffff0000000081000000000000000600000000000000000000000000000000000000000000000400000000000000000000000000000002000000000000000500000000000000ff7fffffffffffff0000000000000000000000000000000004040000000000000000000000000000"]) r6 = creat(&(0x7f00000000c0)='./file0\x00', 0x0) openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000100)='/group.stat\x00', 0x2761, 0x0) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000080), 0xffffffffffffffff) getpid() fallocate(r0, 0x0, 0x0, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x2f, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) memfd_create(&(0x7f0000000080)='!proccgroup\x00', 0x0) ioctl$sock_inet_SIOCSIFPFLAGS(0xffffffffffffffff, 0x8934, &(0x7f0000000400)={'veth0_to_bridge\x00', 0x100}) accept(r6, &(0x7f0000000580)=@alg, &(0x7f0000000600)=0x80) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x2400, 0x8000) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000008c0)={0x2c, 0x0, &(0x7f0000000780)=[@acquire_done={0x40106309, r5, 0x2}, @clear_death={0x400c630f, 0x1, 0x3}, @release={0x40046306, 0x2}], 0xc1, 0x0, &(0x7f00000007c0)="859547f83b9b058a973a491d7e6378544744f2b56b02270a2f78214a936e9afb25cd94695643af6563f86771aa9621b9f30f2ca538b018247a633c28ee01e03b4639679311117971e60dc1538f34e961ae301463172c41754be988f6beb0ce4d83c69f86c236d29520e6cdaf5dbb60404c66d63315ff287deac8632781d0197ef1f81314da0a1ed90b681842cf85a41b496ce0a7a6f5aa4b9b23483eea8861be89b3398c6aec3349174f9cdc9de34df361ac9bf7afd8566849487c3c0a1e3aaacd"}) 04:01:26 executing program 1: perf_event_open(&(0x7f000001d000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) recvmsg(0xffffffffffffffff, &(0x7f00000036c0)={&(0x7f0000000180)=@can, 0xfd28, &(0x7f00000035c0), 0x0, &(0x7f0000003680)=""/41, 0x29}, 0x0) bind$alg(r0, &(0x7f0000001300)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb(blowfish)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000ff8000)="0a0775b0", 0x4) r1 = accept$alg(r0, 0x0, 0x0) sendmmsg$alg(r1, &(0x7f0000003e80)=[{0x0, 0x0, &(0x7f0000002a80), 0x167, &(0x7f0000000100)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x0) recvmsg(r1, &(0x7f0000000000)={&(0x7f0000f7ffa8)=@alg, 0x61, &(0x7f0000000140)=[{&(0x7f0000000200)=""/4096, 0xfffffe45}], 0x1, &(0x7f0000fb3fa9)=""/87, 0x57}, 0x0) 04:01:26 executing program 3: r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x2, 0x3) bind$bt_l2cap(r0, &(0x7f0000000040), 0xe) listen(r0, 0x0) 04:01:26 executing program 4: r0 = syz_open_dev$loop(&(0x7f00000000c0)='/dev/loop#\x00', 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180)={0xffffffffffffffff}) ioctl$BLKROSET(r0, 0x125d, &(0x7f0000000000)=0x8) syz_open_dev$amidi(&(0x7f0000000040)='/dev/amidi#\x00', 0x5, 0x2000) openat$rfkill(0xffffffffffffff9c, &(0x7f0000000080)='/dev/rfkill\x00', 0x400, 0x0) openat(0xffffffffffffffff, &(0x7f0000000100)='./file0\x00', 0x0, 0x2) dup3(r0, r1, 0x80000) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x100a00) ioctl$LOOP_SET_STATUS64(r0, 0x4c05, &(0x7f0000000240)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, "7001e0f57c8cf6270b24e415e96042aae51d871554c11cd59cc8fb47081025bad6b39d7780666157a96aae15813f0dceb29700", "a8a4cd01e527e6fd3de45387daf7b1ac786d0e8a75e89046550fa2d2d25b60361fe06f308fe6033a61edb75c8d51c055faf7f4fdb16e0cdaa4276939a3410334", "7b8ddcc0c89159fed06d00f97c955b4ab8a700"}) 04:01:26 executing program 2: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000440)=@updpolicy={0xb8, 0x19, 0x523, 0x0, 0x0, {{@in=@multicast2, @in6=@empty={[0x0, 0x0, 0x324]}, 0x0, 0x0, 0x0, 0x0, 0xa}}}, 0xb8}}, 0x0) 04:01:26 executing program 5: r0 = socket$inet6(0xa, 0x2, 0x0) r1 = syz_open_dev$mice(&(0x7f00000002c0)='/dev/input/mice\x00', 0x0, 0x0) ioctl$PPPOEIOCDFWD(r1, 0xb101, 0x0) syz_genetlink_get_family_id$nbd(&(0x7f0000000480)='nbd\x00') getsockopt$inet6_IPV6_XFRM_POLICY(r0, 0x29, 0x23, &(0x7f0000000340)={{{@in=@local, @in=@loopback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@local}, 0x0, @in=@remote}}, &(0x7f0000000140)=0xe8) connect$can_bcm(0xffffffffffffffff, &(0x7f00000001c0), 0x10) bind$inet6(r0, &(0x7f0000000040)={0xa, 0x4e24}, 0x1c) lsetxattr$security_ima(&(0x7f0000000280)='./file0\x00', &(0x7f0000000440)='security.ima\x00', 0x0, 0x0, 0x1) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clock_gettime(0x0, &(0x7f0000000100)={0x0, 0x0}) r4 = openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) bind(r4, &(0x7f0000000580)=@can={0x1d, r2}, 0x80) clock_gettime(0x3, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff}) ppoll(&(0x7f0000000000)=[{r0, 0x41a}], 0x1, &(0x7f0000000200)={0x0, r3+30000000}, &(0x7f0000000240), 0x8) connect$inet6(r0, &(0x7f0000000080)={0xa, 0x4e24, 0x0, @ipv4={[], [], @loopback}}, 0x1c) readv(0xffffffffffffffff, 0x0, 0x0) sendmmsg(r0, &(0x7f00000092c0), 0x4ff, 0x0) connect$pptp(r5, &(0x7f00000004c0)={0x18, 0x2, {0x0, @multicast1}}, 0x1e) [ 600.706099] binder: release 21131:21139 transaction 295 out, still active 04:01:26 executing program 4: r0 = syz_open_dev$sndseq(&(0x7f0000000480)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_GET_NAMED_QUEUE(r0, 0x80045301, &(0x7f0000000340)={0x0, 0x0, 0x0, 'queue1\x00\x00\x03\x00\x00\x00\x1f\x00', 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x300]}) r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ubi_ctrl\x00', 0x4200, 0x0) getsockopt$inet6_opts(r1, 0x29, 0x36, &(0x7f0000000040)=""/91, &(0x7f00000000c0)=0x5b) 04:01:26 executing program 1: perf_event_open(&(0x7f000001d000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) recvmsg(0xffffffffffffffff, &(0x7f00000036c0)={&(0x7f0000000180)=@can, 0xfd28, &(0x7f00000035c0), 0x0, &(0x7f0000003680)=""/41, 0x29}, 0x0) bind$alg(r0, &(0x7f0000001300)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb(blowfish)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000ff8000)="0a0775b0", 0x4) r1 = accept$alg(r0, 0x0, 0x0) sendmmsg$alg(r1, &(0x7f0000003e80)=[{0x0, 0x0, &(0x7f0000002a80), 0x167, &(0x7f0000000100)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x0) recvmsg(r1, &(0x7f0000000000)={&(0x7f0000f7ffa8)=@alg, 0x61, &(0x7f0000000140)=[{&(0x7f0000000200)=""/4096, 0xfffffe45}], 0x1, &(0x7f0000fb3fa9)=""/87, 0x57}, 0x0) 04:01:26 executing program 3: bind$bt_l2cap(0xffffffffffffffff, &(0x7f0000000040), 0xe) listen(0xffffffffffffffff, 0x0) 04:01:26 executing program 2: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000440)=@updpolicy={0xb8, 0x19, 0x523, 0x0, 0x0, {{@in=@multicast2, @in6=@empty={[0x0, 0x0, 0xa00]}, 0x0, 0x0, 0x0, 0x0, 0xa}}}, 0xb8}}, 0x0) 04:01:26 executing program 4: setsockopt$ALG_SET_KEY(0xffffffffffffffff, 0x117, 0x1, 0x0, 0x0) r0 = accept$alg(0xffffffffffffffff, 0x0, 0x0) openat$vsock(0xffffffffffffff9c, &(0x7f0000000300)='/dev/vsock\x00', 0x0, 0x0) r1 = dup3(0xffffffffffffff9c, r0, 0x80002) pipe2(0x0, 0x4000) bpf$MAP_CREATE(0x0, 0x0, 0xffffff4a) setsockopt$IP_VS_SO_SET_TIMEOUT(r1, 0x0, 0x48a, &(0x7f0000000000)={0x20, 0x8000, 0x6}, 0xc) modify_ldt$read(0x0, &(0x7f0000000000), 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = syz_open_dev$loop(&(0x7f0000000040)='/dev/loop#\x00', 0x0, 0x0) ioctl$BLKRESETZONE(r2, 0x40101283, &(0x7f00000000c0)={0x3d, 0xffff}) r3 = memfd_create(&(0x7f0000000080)='t\bnu\x00\x00\x00\x00\x00\x00\x00\x00\x00\x8c\x00', 0x0) pwritev(r3, &(0x7f0000000340)=[{&(0x7f00000001c0)='\'', 0x1}], 0x1, 0x1081806) syz_open_dev$loop(&(0x7f0000000100)='/dev/loop#\x00', 0x1, 0x200) ioctl$LOOP_CHANGE_FD(r2, 0x4c00, r3) ioctl$LOOP_SET_STATUS64(r2, 0x4c04, &(0x7f0000000380)={0x0, 0x0, 0x0, 0xfffffffffffffffc, 0x0, 0x0, 0x0, 0x6, 0x1c, "7001e0f57c8cf6270b24e415e96042aae51d871554c11cd59cc80000000025bad6b39d778083002b4b54f4ffd142f70a7c0f30f66157a96aae15813f0dceb297", "a8a4cd0160ec941a3de45387daf7b1ac786d0e8a75e8904655faf6f2bc6cc487d93a61edb75c8d51c055faf7f4fdb16e0cdaa4276939a341033400", "2f18ffffffffffff4116893616105829576914e70bfeb59800f97c97644ab8a7", [0x101, 0x3]}) [ 600.880656] binder: BINDER_SET_CONTEXT_MGR already set [ 600.904007] binder: 21171:21186 ioctl 40046207 0 returned -16 [ 600.942904] binder: 21171:21186 Release 1 refcount change on invalid ref 1 ret -22 04:01:26 executing program 3: r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x3) bind$bt_l2cap(r0, &(0x7f0000000040), 0xe) ioctl$VIDIOC_ENUM_FREQ_BANDS(r0, 0xc0405665, &(0x7f0000000000)={0x8ac, 0x3, 0x0, 0x200, 0x5, 0x3, 0xa}) listen(r0, 0x0) [ 601.012839] binder: 21171:21191 BC_ACQUIRE_DONE u0000000000000000 no match [ 601.048505] binder: 21171:21191 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 04:01:26 executing program 0: r0 = perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) setxattr$security_smack_entry(&(0x7f0000000380)='./file0\x00', &(0x7f0000000480)='security.SMACK64IPIN\x00', &(0x7f0000000540)='^vboxnet1^\x00', 0xb, 0x1) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x0, 0x209e1e, 0x3, 0x1}, 0x2c) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r1, &(0x7f0000000040), 0x0, 0x1}, 0x20) unlink(&(0x7f0000000900)='./file0/file0\x00') r2 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r3 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r3, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, &(0x7f00000006c0)={0x0}) ioctl$BINDER_GET_NODE_DEBUG_INFO(r2, 0xc018620b, &(0x7f0000000640)={r4}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f00000000c0)=[@enter_looper], 0x48, 0x0, &(0x7f0000000700)="2ba063fb309ec7fdbfb08e6e91baee7d7d4599fe14129a4d426834556ae420e087d59c0c7be7fcad1abb7e1f8f446f373f611ca1ee9c2231708e18a47bc68a2a79a0b48931f6ff6d"}) ioctl$BINDER_SET_CONTEXT_MGR(r3, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x1) prctl$PR_SET_NAME(0xf, &(0x7f00000004c0)='/group.stat\x00') ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, &(0x7f0000000780)}) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f0000000680)}) ioctl$FS_IOC_FIEMAP(r3, 0xc020660b, &(0x7f0000000b80)=ANY=[@ANYBLOB="0000010000000000200000000000000005000000010000000a00000000000000ff030000000000001a0a000000000000050000000000000000000000000000000000000000000000080000000000000000000000000000000800000000000000ffff0000000000000100008000000000000000000000000000000000000000000000000000000000000000000000000008000000000000003f0000000000000008000000000000000000000000000000000000000000800800000000000000000000000000000200000000000000000400000000000000000000010000000000000000000000000000000000000002110000000000000000000000000000cc0000000000000000000000000000001b0000000000000000000000000000000000000000000000841400000000000000000000000000000300000000000000feffffffffffffff000000000000000000000000000000000000000000000000020000000000000000000000000000000600000000000000ff01000000000000040000000000000000000000000000000000000000000000000400000000000000000000000000007be70000000000000900000000000000ff7f0000000000000000000000000000000000000000000004180000000000000000000000000000ffffffff0000000081000000000000000600000000000000000000000000000000000000000000000400000000000000000000000000000002000000000000000500000000000000ff7fffffffffffff0000000000000000000000000000000004040000000000000000000000000000"]) r6 = creat(&(0x7f00000000c0)='./file0\x00', 0x0) openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000100)='/group.stat\x00', 0x2761, 0x0) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000080), 0xffffffffffffffff) getpid() fallocate(r0, 0x0, 0x0, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x2f, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) memfd_create(&(0x7f0000000080)='!proccgroup\x00', 0x0) ioctl$sock_inet_SIOCSIFPFLAGS(0xffffffffffffffff, 0x8934, &(0x7f0000000400)={'veth0_to_bridge\x00', 0x100}) accept(r6, &(0x7f0000000580)=@alg, &(0x7f0000000600)=0x80) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x2400, 0x8000) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000008c0)={0x2c, 0x0, &(0x7f0000000780)=[@acquire_done={0x40106309, r5, 0x2}, @clear_death={0x400c630f, 0x1, 0x3}, @release={0x40046306, 0x2}], 0xc1, 0x0, &(0x7f00000007c0)="859547f83b9b058a973a491d7e6378544744f2b56b02270a2f78214a936e9afb25cd94695643af6563f86771aa9621b9f30f2ca538b018247a633c28ee01e03b4639679311117971e60dc1538f34e961ae301463172c41754be988f6beb0ce4d83c69f86c236d29520e6cdaf5dbb60404c66d63315ff287deac8632781d0197ef1f81314da0a1ed90b681842cf85a41b496ce0a7a6f5aa4b9b23483eea8861be89b3398c6aec3349174f9cdc9de34df361ac9bf7afd8566849487c3c0a1e3aaacd"}) 04:01:26 executing program 1: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) recvmsg(0xffffffffffffffff, &(0x7f00000036c0)={&(0x7f0000000180)=@can, 0xfd28, &(0x7f00000035c0), 0x0, &(0x7f0000003680)=""/41, 0x29}, 0x0) bind$alg(r0, &(0x7f0000001300)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb(blowfish)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000ff8000)="0a0775b0", 0x4) r1 = accept$alg(r0, 0x0, 0x0) sendmmsg$alg(r1, &(0x7f0000003e80)=[{0x0, 0x0, &(0x7f0000002a80), 0x167, &(0x7f0000000100)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x0) recvmsg(r1, &(0x7f0000000000)={&(0x7f0000f7ffa8)=@alg, 0x61, &(0x7f0000000140)=[{&(0x7f0000000200)=""/4096, 0xfffffe45}], 0x1, &(0x7f0000fb3fa9)=""/87, 0x57}, 0x0) 04:01:26 executing program 2: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000440)=@updpolicy={0xb8, 0x19, 0x523, 0x0, 0x0, {{@in=@multicast2, @in6=@empty={[0x0, 0x0, 0xe00]}, 0x0, 0x0, 0x0, 0x0, 0xa}}}, 0xb8}}, 0x0) [ 601.089501] binder: 21171:21191 Release 1 refcount change on invalid ref 2 ret -22 04:01:26 executing program 4: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000140)='/dev/uinput\x00', 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, 0x0) bind$unix(0xffffffffffffffff, 0x0, 0x0) r1 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000400)='/dev/loop-control\x00', 0x0, 0x0) ioctl$LOOP_CTL_ADD(r1, 0x4c80, 0x0) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) ioctl$LOOP_CTL_GET_FREE(r0, 0x4c82) r3 = openat$pfkey(0xffffffffffffff9c, &(0x7f0000000100)='/proc/self/net/pfkey\x00', 0x40, 0x0) r4 = syz_genetlink_get_family_id$tipc(&(0x7f0000000240)='TIPC\x00') sendmsg$TIPC_CMD_ENABLE_BEARER(r3, &(0x7f0000000300)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x2404}, 0xc, &(0x7f00000002c0)={&(0x7f0000000280)={0x34, r4, 0x100, 0x70bd27, 0x25dfdbfb, {{}, 0x0, 0x4101, 0x0, {0x18, 0x17, {0x8, 0x7fff, @udp='udp:syz2\x00'}}}, ["", "", "", "", "", ""]}, 0x34}}, 0x84) sendmsg$nfc_llcp(r2, &(0x7f0000000500)={&(0x7f0000000180)={0x27, 0x1, 0x1, 0x3, 0xfffffffffffffffd, 0xd47, "c57333ecefb27b037c6fed0b24bafc0fa3fd6a1fac0b9a511ad93dc16646f148e13d2a57777853095d927cc2c2b37a47a49db0d0061ad35f115e8b82219686", 0xd}, 0x60, 0x0, 0x0, 0x0, 0x0, 0x800}, 0x4010) sendto$inet6(0xffffffffffffffff, 0x0, 0x0, 0x20000004, 0x0, 0x0) add_key$user(&(0x7f0000000700)='user\x00', 0x0, 0x0, 0x0, 0xffffffffffffffff) ioctl$LOOP_CTL_REMOVE(r1, 0x4c81, 0x0) read(0xffffffffffffffff, 0x0, 0x0) setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r2, 0x6, 0x14, &(0x7f00000000c0), 0x4) dup(0xffffffffffffffff) statfs(&(0x7f0000000000)='./file0\x00', &(0x7f0000000080)=""/30) getsockname$packet(0xffffffffffffffff, 0x0, &(0x7f0000000040)) 04:01:26 executing program 3: r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x1000000000003, 0x3) bind$bt_l2cap(r0, &(0x7f0000000040)={0x1f, 0x0, {0x0, 0x0, 0x10}}, 0xe) listen(r0, 0x0) r1 = openat$dlm_plock(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm_plock\x00', 0x0, 0x0) ioctl$CAPI_GET_SERIAL(r1, 0xc0044308, &(0x7f0000000200)=0x200) ioctl$VHOST_RESET_OWNER(r1, 0xaf02, 0x0) ioctl$DRM_IOCTL_ADD_CTX(0xffffffffffffff9c, 0xc0086420, &(0x7f0000000080)={0x0}) ioctl$DRM_IOCTL_DMA(r1, 0xc0406429, &(0x7f00000001c0)={r2, 0x1, &(0x7f00000000c0)=[0x1], &(0x7f0000000100)=[0x1, 0xfffffffffffff000, 0xbac4, 0x4, 0xfffffffffffff46b, 0x3], 0x15, 0x2, 0xff, &(0x7f0000000140)=[0x3, 0x9], &(0x7f0000000180)=[0x5, 0x8, 0xffffffffffffff92, 0x2, 0x7]}) [ 601.284467] net_ratelimit: 26 callbacks suppressed [ 601.284476] protocol 88fb is buggy, dev hsr_slave_0 [ 601.294612] protocol 88fb is buggy, dev hsr_slave_1 [ 601.299713] protocol 88fb is buggy, dev hsr_slave_0 [ 601.304847] protocol 88fb is buggy, dev hsr_slave_1 [ 601.363920] binder: BINDER_SET_CONTEXT_MGR already set [ 601.387311] binder: 21212:21222 ioctl 40046207 0 returned -16 [ 601.416849] binder: 21212:21222 Release 1 refcount change on invalid ref 1 ret -22 [ 601.438201] binder: 21212:21225 BC_ACQUIRE_DONE u0000000000000000 no match [ 601.455923] binder: 21212:21225 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 [ 601.462876] binder: 21212:21225 Release 1 refcount change on invalid ref 2 ret -22 04:01:27 executing program 5: r0 = socket$inet6(0xa, 0x2, 0x0) r1 = syz_open_dev$mice(&(0x7f00000002c0)='/dev/input/mice\x00', 0x0, 0x0) ioctl$PPPOEIOCDFWD(r1, 0xb101, 0x0) syz_genetlink_get_family_id$nbd(&(0x7f0000000480)='nbd\x00') getsockopt$inet6_IPV6_XFRM_POLICY(r0, 0x29, 0x23, &(0x7f0000000340)={{{@in=@local, @in=@loopback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@local}, 0x0, @in=@remote}}, &(0x7f0000000140)=0xe8) connect$can_bcm(0xffffffffffffffff, &(0x7f00000001c0), 0x10) bind$inet6(r0, &(0x7f0000000040)={0xa, 0x4e24}, 0x1c) lsetxattr$security_ima(&(0x7f0000000280)='./file0\x00', &(0x7f0000000440)='security.ima\x00', 0x0, 0x0, 0x1) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clock_gettime(0x0, &(0x7f0000000100)={0x0, 0x0}) r4 = openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) bind(r4, &(0x7f0000000580)=@can={0x1d, r2}, 0x80) clock_gettime(0x3, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff}) ppoll(&(0x7f0000000000)=[{r0, 0x41a, 0x3}], 0x1, &(0x7f0000000200)={0x0, r3+30000000}, &(0x7f0000000240), 0x8) connect$inet6(r0, &(0x7f0000000080)={0xa, 0x4e24, 0x0, @ipv4={[], [], @loopback}}, 0x1c) readv(0xffffffffffffffff, 0x0, 0x0) sendmmsg(r0, &(0x7f00000092c0), 0x4ff, 0x0) connect$pptp(r5, &(0x7f00000004c0)={0x18, 0x2, {0x0, @multicast1}}, 0x1e) 04:01:27 executing program 1: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) recvmsg(0xffffffffffffffff, &(0x7f00000036c0)={&(0x7f0000000180)=@can, 0xfd28, &(0x7f00000035c0), 0x0, &(0x7f0000003680)=""/41, 0x29}, 0x0) bind$alg(r0, &(0x7f0000001300)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb(blowfish)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000ff8000)="0a0775b0", 0x4) r1 = accept$alg(r0, 0x0, 0x0) sendmmsg$alg(r1, &(0x7f0000003e80)=[{0x0, 0x0, &(0x7f0000002a80), 0x167, &(0x7f0000000100)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x0) recvmsg(r1, &(0x7f0000000000)={&(0x7f0000f7ffa8)=@alg, 0x61, &(0x7f0000000140)=[{&(0x7f0000000200)=""/4096, 0xfffffe45}], 0x1, &(0x7f0000fb3fa9)=""/87, 0x57}, 0x0) 04:01:27 executing program 3: r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x3) bind$bt_l2cap(r0, &(0x7f0000000040), 0xe) ioctl$sock_SIOCGPGRP(r0, 0x8904, &(0x7f0000000000)) listen(r0, 0x0) 04:01:27 executing program 2: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000440)=@updpolicy={0xb8, 0x19, 0x523, 0x0, 0x0, {{@in=@multicast2, @in6=@empty={[0x0, 0x0, 0xf00]}, 0x0, 0x0, 0x0, 0x0, 0xa}}}, 0xb8}}, 0x0) 04:01:27 executing program 4: r0 = openat$kvm(0xffffffffffffff9c, 0x0, 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0x0) openat$kvm(0xffffffffffffff9c, 0x0, 0x0, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$inet(0x10, 0x80002, 0x0) r3 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000180)='/dev/sequencer\x00', 0x80000000000046, 0x0) ioctl$SCSI_IOCTL_STOP_UNIT(r3, 0x6) r4 = syz_open_procfs(0x0, &(0x7f0000000080)='/exe\x00\x00\x00\x00\x00\x04\t\x00K\xdd\xd9\xde\x91\xbe\x10\xee\xbf\x00\x0e\xe9\xa9\x0fy\x80XT\xfa\aBJ\xde\xe9\x01\xd2\xdau\xaf\x1f\x02\x00\xf5\xab&\xd7\xa0q\xfb53\x1c\xe3\x9cZ') sendfile(r3, r4, &(0x7f0000000000), 0x2b428a52) socket(0xfffffffffffffffd, 0x1, 0x0) r5 = openat$kvm(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/kvm\x00', 0x0, 0x0) ioctl$KVM_CREATE_VM(r5, 0xae01, 0x0) socket$inet_udp(0x2, 0x2, 0x0) r6 = ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x0) ioctl$KVM_SET_REGS(r6, 0x4090ae82, &(0x7f0000000000)={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x100]}) fsetxattr$security_smack_transmute(r5, &(0x7f0000000240)='security.SMACK64TRANSMUTE\x00', &(0x7f0000000280)='TRUE', 0x4, 0x0) ioctl$KVM_NMI(0xffffffffffffffff, 0xae9a) r7 = fcntl$dupfd(0xffffffffffffffff, 0x0, r6) ioctl$KVM_RUN(r7, 0xae80, 0x0) ioctl$KVM_RUN(0xffffffffffffffff, 0xae80, 0x0) mount$9p_xen(0x0, &(0x7f0000000200)='./file1\x00', &(0x7f00000002c0)='9p\x00', 0x7048, &(0x7f0000000540)=ANY=[]) ioctl$KVM_CREATE_VM(r5, 0xae01, 0x0) ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x0) ioctl$KVM_SET_FPU(r2, 0x41a0ae8d, &(0x7f0000000080)={[], 0x6, 0x7f, 0x0, 0x0, 0x9, 0xd000, 0xf004, [], 0x7}) ioctl$sock_inet_SIOCSIFDSTADDR(r3, 0x8918, &(0x7f0000000300)={'hsr0\x00', {0x2, 0x4e24, @empty}}) 04:01:27 executing program 2: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000440)=@updpolicy={0xb8, 0x19, 0x523, 0x0, 0x0, {{@in=@multicast2, @in6=@empty={[0x0, 0x0, 0x2403]}, 0x0, 0x0, 0x0, 0x0, 0xa}}}, 0xb8}}, 0x0) 04:01:27 executing program 3: r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x4000000000000001, 0x3) bind$bt_l2cap(r0, &(0x7f0000000040), 0xe) listen(r0, 0x0) 04:01:27 executing program 0: r0 = perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) setxattr$security_smack_entry(&(0x7f0000000380)='./file0\x00', &(0x7f0000000480)='security.SMACK64IPIN\x00', &(0x7f0000000540)='^vboxnet1^\x00', 0xb, 0x1) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x0, 0x3, 0x1}, 0x2c) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r1, &(0x7f0000000040), 0x0, 0x1}, 0x20) unlink(&(0x7f0000000900)='./file0/file0\x00') r2 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r3 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r3, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, &(0x7f00000006c0)={0x0}) ioctl$BINDER_GET_NODE_DEBUG_INFO(r2, 0xc018620b, &(0x7f0000000640)={r4}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f00000000c0)=[@enter_looper], 0x48, 0x0, &(0x7f0000000700)="2ba063fb309ec7fdbfb08e6e91baee7d7d4599fe14129a4d426834556ae420e087d59c0c7be7fcad1abb7e1f8f446f373f611ca1ee9c2231708e18a47bc68a2a79a0b48931f6ff6d"}) ioctl$BINDER_SET_CONTEXT_MGR(r3, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x1) prctl$PR_SET_NAME(0xf, &(0x7f00000004c0)='/group.stat\x00') ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, &(0x7f0000000780)}) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f0000000680)}) ioctl$FS_IOC_FIEMAP(r3, 0xc020660b, &(0x7f0000000b80)=ANY=[@ANYBLOB="0000010000000000200000000000000005000000010000000a00000000000000ff030000000000001a0a000000000000050000000000000000000000000000000000000000000000080000000000000000000000000000000800000000000000ffff0000000000000100008000000000000000000000000000000000000000000000000000000000000000000000000008000000000000003f0000000000000008000000000000000000000000000000000000000000800800000000000000000000000000000200000000000000000400000000000000000000010000000000000000000000000000000000000002110000000000000000000000000000cc0000000000000000000000000000001b0000000000000000000000000000000000000000000000841400000000000000000000000000000300000000000000feffffffffffffff000000000000000000000000000000000000000000000000020000000000000000000000000000000600000000000000ff01000000000000040000000000000000000000000000000000000000000000000400000000000000000000000000007be70000000000000900000000000000ff7f0000000000000000000000000000000000000000000004180000000000000000000000000000ffffffff0000000081000000000000000600000000000000000000000000000000000000000000000400000000000000000000000000000002000000000000000500000000000000ff7fffffffffffff0000000000000000000000000000000004040000000000000000000000000000"]) r6 = creat(&(0x7f00000000c0)='./file0\x00', 0x0) openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000100)='/group.stat\x00', 0x2761, 0x0) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000080), 0xffffffffffffffff) getpid() fallocate(r0, 0x0, 0x0, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x2f, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) memfd_create(&(0x7f0000000080)='!proccgroup\x00', 0x0) ioctl$sock_inet_SIOCSIFPFLAGS(0xffffffffffffffff, 0x8934, &(0x7f0000000400)={'veth0_to_bridge\x00', 0x100}) accept(r6, &(0x7f0000000580)=@alg, &(0x7f0000000600)=0x80) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x2400, 0x8000) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000008c0)={0x2c, 0x0, &(0x7f0000000780)=[@acquire_done={0x40106309, r5, 0x2}, @clear_death={0x400c630f, 0x1, 0x3}, @release={0x40046306, 0x2}], 0xc1, 0x0, &(0x7f00000007c0)="859547f83b9b058a973a491d7e6378544744f2b56b02270a2f78214a936e9afb25cd94695643af6563f86771aa9621b9f30f2ca538b018247a633c28ee01e03b4639679311117971e60dc1538f34e961ae301463172c41754be988f6beb0ce4d83c69f86c236d29520e6cdaf5dbb60404c66d63315ff287deac8632781d0197ef1f81314da0a1ed90b681842cf85a41b496ce0a7a6f5aa4b9b23483eea8861be89b3398c6aec3349174f9cdc9de34df361ac9bf7afd8566849487c3c0a1e3aaacd"}) 04:01:27 executing program 1: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) recvmsg(0xffffffffffffffff, &(0x7f00000036c0)={&(0x7f0000000180)=@can, 0xfd28, &(0x7f00000035c0), 0x0, &(0x7f0000003680)=""/41, 0x29}, 0x0) bind$alg(r0, &(0x7f0000001300)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb(blowfish)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000ff8000)="0a0775b0", 0x4) r1 = accept$alg(r0, 0x0, 0x0) sendmmsg$alg(r1, &(0x7f0000003e80)=[{0x0, 0x0, &(0x7f0000002a80), 0x167, &(0x7f0000000100)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x0) recvmsg(r1, &(0x7f0000000000)={&(0x7f0000f7ffa8)=@alg, 0x61, &(0x7f0000000140)=[{&(0x7f0000000200)=""/4096, 0xfffffe45}], 0x1, &(0x7f0000fb3fa9)=""/87, 0x57}, 0x0) 04:01:27 executing program 4: r0 = socket$netlink(0x10, 0x3, 0x400000000004) write(r0, &(0x7f0000000240)="2300000014000707030f00c0f635c63f280f550b00120f0a0811000100f5fe0012ff00", 0x23) r1 = syz_genetlink_get_family_id$fou(&(0x7f00000001c0)='fou\x00') sendmsg$FOU_CMD_DEL(r0, &(0x7f00000002c0)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x400080}, 0xc, &(0x7f0000000280)={&(0x7f0000000200)={0x38, r1, 0x0, 0x70bd25, 0x25dfdbfd, {}, [@FOU_ATTR_REMCSUM_NOPARTIAL={0x4}, @FOU_ATTR_TYPE={0x8}, @FOU_ATTR_REMCSUM_NOPARTIAL={0x4}, @FOU_ATTR_REMCSUM_NOPARTIAL={0x4}, @FOU_ATTR_REMCSUM_NOPARTIAL={0x4}, @FOU_ATTR_REMCSUM_NOPARTIAL={0x4}, @FOU_ATTR_TYPE={0x8}]}, 0x38}, 0x1, 0x0, 0x0, 0x40000}, 0x20000000) r2 = openat$autofs(0xffffffffffffff9c, &(0x7f0000000000)='/dev/autofs\x00', 0x4000, 0x0) ioctl$DRM_IOCTL_MODE_GETRESOURCES(r2, 0xc04064a0, &(0x7f0000000140)={&(0x7f0000000040)=[0x0, 0x0, 0x0, 0x0, 0x0], &(0x7f0000000080)=[0x0, 0x0, 0x0, 0x0, 0x0], &(0x7f00000000c0)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], &(0x7f0000000100)=[0x0, 0x0], 0x5, 0x5, 0xa, 0x2}) 04:01:27 executing program 2: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000440)=@updpolicy={0xb8, 0x19, 0x523, 0x0, 0x0, {{@in=@multicast2, @in6=@empty={[0x0, 0x0, 0x2f00]}, 0x0, 0x0, 0x0, 0x0, 0xa}}}, 0xb8}}, 0x0) 04:01:27 executing program 3: r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x2, 0x3) bind$bt_l2cap(r0, &(0x7f0000000040), 0xe) listen(r0, 0x0) [ 602.035880] binder: release 21212:21222 transaction 301 out, still active [ 602.164318] protocol 88fb is buggy, dev hsr_slave_0 [ 602.169511] protocol 88fb is buggy, dev hsr_slave_1 [ 602.205127] binder: BINDER_SET_CONTEXT_MGR already set [ 602.220699] binder: 21259:21265 ioctl 40046207 0 returned -16 [ 602.236202] binder: 21259:21265 Release 1 refcount change on invalid ref 1 ret -22 04:01:28 executing program 3: r0 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000000)='/dev/snapshot\x00', 0x10802, 0x0) ioctl$KVM_SET_PIT(r0, 0x8048ae66, &(0x7f0000000080)={[{0x10f, 0x3, 0xfffffffffffeffff, 0x7fff, 0xffffffffffffff80, 0xf8, 0x4, 0x5, 0x6, 0x40, 0x19, 0x80000000, 0x3ff}, {0x7, 0x1, 0x0, 0xfffffffffffffffe, 0x40, 0x9, 0x1, 0x8, 0x0, 0x6, 0x2, 0x3, 0x57}, {0x8001, 0xffff, 0x5, 0x4, 0x2, 0x1, 0x6, 0x2ab, 0x200000000, 0x5, 0x97cb, 0xfffffffffffffffa}], 0x80010000}) r1 = syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x3) r2 = getpgrp(0xffffffffffffffff) ptrace$getenv(0x4201, r2, 0x40, &(0x7f0000000180)) fsetxattr$security_smack_entry(r0, &(0x7f0000000100)='security.SMACK64IPOUT\x00', &(0x7f0000000140)='\x00', 0x1, 0x2) bind$bt_l2cap(r1, &(0x7f0000000040), 0xe) listen(r1, 0x0) 04:01:28 executing program 2: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000440)=@updpolicy={0xb8, 0x19, 0x523, 0x0, 0x0, {{@in=@multicast2, @in6=@empty={[0x0, 0x0, 0x6000]}, 0x0, 0x0, 0x0, 0x0, 0xa}}}, 0xb8}}, 0x0) 04:01:28 executing program 5: r0 = socket$inet6(0xa, 0x2, 0x0) r1 = syz_open_dev$mice(&(0x7f00000002c0)='/dev/input/mice\x00', 0x0, 0x0) ioctl$PPPOEIOCDFWD(r1, 0xb101, 0x0) syz_genetlink_get_family_id$nbd(&(0x7f0000000480)='nbd\x00') getsockopt$inet6_IPV6_XFRM_POLICY(r0, 0x29, 0x23, &(0x7f0000000340)={{{@in=@local, @in=@loopback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@local}, 0x0, @in=@remote}}, &(0x7f0000000140)=0xe8) connect$can_bcm(0xffffffffffffffff, &(0x7f00000001c0), 0x10) bind$inet6(r0, &(0x7f0000000040)={0xa, 0x4e24}, 0x1c) lsetxattr$security_ima(&(0x7f0000000280)='./file0\x00', &(0x7f0000000440)='security.ima\x00', 0x0, 0x0, 0x1) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clock_gettime(0x0, &(0x7f0000000100)={0x0, 0x0}) r4 = openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) bind(r4, &(0x7f0000000580)=@can={0x1d, r2}, 0x80) clock_gettime(0x3, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff}) ppoll(&(0x7f0000000000)=[{r0, 0x41a, 0x8}], 0x1, &(0x7f0000000200)={0x0, r3+30000000}, &(0x7f0000000240), 0x8) connect$inet6(r0, &(0x7f0000000080)={0xa, 0x4e24, 0x0, @ipv4={[], [], @loopback}}, 0x1c) readv(0xffffffffffffffff, 0x0, 0x0) sendmmsg(r0, &(0x7f00000092c0), 0x4ff, 0x0) connect$pptp(r5, &(0x7f00000004c0)={0x18, 0x2, {0x0, @multicast1}}, 0x1e) 04:01:28 executing program 1: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) recvmsg(0xffffffffffffffff, &(0x7f00000036c0)={&(0x7f0000000180)=@can, 0xfd28, &(0x7f00000035c0), 0x0, &(0x7f0000003680)=""/41, 0x29}, 0x0) bind$alg(r0, &(0x7f0000001300)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb(blowfish)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000ff8000)="0a0775b0", 0x4) r1 = accept$alg(r0, 0x0, 0x0) sendmmsg$alg(r1, &(0x7f0000003e80)=[{0x0, 0x0, &(0x7f0000002a80), 0x167, &(0x7f0000000100)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x0) recvmsg(r1, &(0x7f0000000000)={&(0x7f0000f7ffa8)=@alg, 0x61, &(0x7f0000000140)=[{&(0x7f0000000200)=""/4096, 0xfffffe45}], 0x1, &(0x7f0000fb3fa9)=""/87, 0x57}, 0x0) 04:01:28 executing program 4: clock_gettime(0x0, &(0x7f0000000200)={0x0, 0x0}) rt_sigtimedwait(&(0x7f00000001c0)={0x5}, &(0x7f0000000100), &(0x7f00000000c0)={r0, r1+30000000}, 0xffffffffffffff8c) r2 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000240)='/dev/vcs\x00', 0xa8000, 0x0) ioctl$KVM_ASSIGN_SET_MSIX_ENTRY(r2, 0x4010ae74, &(0x7f0000000280)={0x0, 0x4, 0x5}) rt_sigtimedwait(&(0x7f0000000000)={0x5}, &(0x7f00000002c0), &(0x7f0000000180)={0x77359400}, 0x8) [ 602.305386] binder: 21259:21268 BC_ACQUIRE_DONE u0000000000000000 no match [ 602.312449] binder: 21259:21268 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 [ 602.324320] protocol 88fb is buggy, dev hsr_slave_0 [ 602.329425] protocol 88fb is buggy, dev hsr_slave_1 04:01:28 executing program 1: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) recvmsg(0xffffffffffffffff, &(0x7f00000036c0)={&(0x7f0000000180)=@can, 0xfd28, &(0x7f00000035c0), 0x0, &(0x7f0000003680)=""/41, 0x29}, 0x0) bind$alg(r0, &(0x7f0000001300)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb(blowfish)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000ff8000)="0a0775b0", 0x4) r1 = accept$alg(r0, 0x0, 0x0) sendmmsg$alg(r1, &(0x7f0000003e80)=[{0x0, 0x0, &(0x7f0000002a80), 0x167, &(0x7f0000000100)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x0) recvmsg(r1, &(0x7f0000000000)={&(0x7f0000f7ffa8)=@alg, 0x61, &(0x7f0000000140)=[{&(0x7f0000000200)=""/4096, 0xfffffe45}], 0x1, &(0x7f0000fb3fa9)=""/87, 0x57}, 0x0) 04:01:28 executing program 2: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000440)=@updpolicy={0xb8, 0x19, 0x523, 0x0, 0x0, {{@in=@multicast2, @in6=@empty={[0x0, 0x0, 0xf000]}, 0x0, 0x0, 0x0, 0x0, 0xa}}}, 0xb8}}, 0x0) [ 602.377678] binder: 21259:21268 Release 1 refcount change on invalid ref 2 ret -22 [ 602.404316] protocol 88fb is buggy, dev hsr_slave_0 [ 602.409475] protocol 88fb is buggy, dev hsr_slave_1 04:01:28 executing program 0: r0 = perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) setxattr$security_smack_entry(&(0x7f0000000380)='./file0\x00', &(0x7f0000000480)='security.SMACK64IPIN\x00', &(0x7f0000000540)='^vboxnet1^\x00', 0xb, 0x1) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x0, 0x3, 0x1}, 0x2c) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r1, &(0x7f0000000040), 0x0, 0x1}, 0x20) unlink(&(0x7f0000000900)='./file0/file0\x00') r2 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r3 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r3, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, &(0x7f00000006c0)={0x0}) ioctl$BINDER_GET_NODE_DEBUG_INFO(r2, 0xc018620b, &(0x7f0000000640)={r4}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f00000000c0)=[@enter_looper], 0x48, 0x0, &(0x7f0000000700)="2ba063fb309ec7fdbfb08e6e91baee7d7d4599fe14129a4d426834556ae420e087d59c0c7be7fcad1abb7e1f8f446f373f611ca1ee9c2231708e18a47bc68a2a79a0b48931f6ff6d"}) ioctl$BINDER_SET_CONTEXT_MGR(r3, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x1) prctl$PR_SET_NAME(0xf, &(0x7f00000004c0)='/group.stat\x00') ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, &(0x7f0000000780)}) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f0000000680)}) ioctl$FS_IOC_FIEMAP(r3, 0xc020660b, &(0x7f0000000b80)=ANY=[@ANYBLOB="0000010000000000200000000000000005000000010000000a00000000000000ff030000000000001a0a000000000000050000000000000000000000000000000000000000000000080000000000000000000000000000000800000000000000ffff0000000000000100008000000000000000000000000000000000000000000000000000000000000000000000000008000000000000003f0000000000000008000000000000000000000000000000000000000000800800000000000000000000000000000200000000000000000400000000000000000000010000000000000000000000000000000000000002110000000000000000000000000000cc0000000000000000000000000000001b0000000000000000000000000000000000000000000000841400000000000000000000000000000300000000000000feffffffffffffff000000000000000000000000000000000000000000000000020000000000000000000000000000000600000000000000ff01000000000000040000000000000000000000000000000000000000000000000400000000000000000000000000007be70000000000000900000000000000ff7f0000000000000000000000000000000000000000000004180000000000000000000000000000ffffffff0000000081000000000000000600000000000000000000000000000000000000000000000400000000000000000000000000000002000000000000000500000000000000ff7fffffffffffff0000000000000000000000000000000004040000000000000000000000000000"]) r6 = creat(&(0x7f00000000c0)='./file0\x00', 0x0) openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000100)='/group.stat\x00', 0x2761, 0x0) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000080), 0xffffffffffffffff) getpid() fallocate(r0, 0x0, 0x0, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x2f, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) memfd_create(&(0x7f0000000080)='!proccgroup\x00', 0x0) ioctl$sock_inet_SIOCSIFPFLAGS(0xffffffffffffffff, 0x8934, &(0x7f0000000400)={'veth0_to_bridge\x00', 0x100}) accept(r6, &(0x7f0000000580)=@alg, &(0x7f0000000600)=0x80) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x2400, 0x8000) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000008c0)={0x2c, 0x0, &(0x7f0000000780)=[@acquire_done={0x40106309, r5, 0x2}, @clear_death={0x400c630f, 0x1, 0x3}, @release={0x40046306, 0x2}], 0xc1, 0x0, &(0x7f00000007c0)="859547f83b9b058a973a491d7e6378544744f2b56b02270a2f78214a936e9afb25cd94695643af6563f86771aa9621b9f30f2ca538b018247a633c28ee01e03b4639679311117971e60dc1538f34e961ae301463172c41754be988f6beb0ce4d83c69f86c236d29520e6cdaf5dbb60404c66d63315ff287deac8632781d0197ef1f81314da0a1ed90b681842cf85a41b496ce0a7a6f5aa4b9b23483eea8861be89b3398c6aec3349174f9cdc9de34df361ac9bf7afd8566849487c3c0a1e3aaacd"}) 04:01:28 executing program 3: r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x3) bind$bt_l2cap(r0, &(0x7f0000000040), 0xe) listen(r0, 0x8) r1 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vcs\x00', 0x2000, 0x0) setsockopt$inet6_group_source_req(r1, 0x29, 0x2f, &(0x7f0000000080)={0xffffffffffffff40, {{0xa, 0x4e20, 0xfffffffffffffffa, @empty, 0x401}}, {{0xa, 0x4e20, 0x1, @ipv4={[], [], @remote}, 0xffffffff}}}, 0x108) 04:01:28 executing program 2: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000440)=@updpolicy={0xb8, 0x19, 0x523, 0x0, 0x0, {{@in=@multicast2, @in6=@empty={[0x0, 0x0, 0xf0ffff]}, 0x0, 0x0, 0x0, 0x0, 0xa}}}, 0xb8}}, 0x0) 04:01:28 executing program 1: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) recvmsg(0xffffffffffffffff, &(0x7f00000036c0)={&(0x7f0000000180)=@can, 0xfd28, &(0x7f00000035c0), 0x0, &(0x7f0000003680)=""/41, 0x29}, 0x0) bind$alg(r0, &(0x7f0000001300)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb(blowfish)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000ff8000)="0a0775b0", 0x4) r1 = accept$alg(r0, 0x0, 0x0) sendmmsg$alg(r1, &(0x7f0000003e80)=[{0x0, 0x0, &(0x7f0000002a80), 0x167, &(0x7f0000000100)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x0) recvmsg(r1, &(0x7f0000000000)={&(0x7f0000f7ffa8)=@alg, 0x61, &(0x7f0000000140)=[{&(0x7f0000000200)=""/4096, 0xfffffe45}], 0x1, &(0x7f0000fb3fa9)=""/87, 0x57}, 0x0) 04:01:28 executing program 5: r0 = socket$inet6(0xa, 0x2, 0x0) r1 = syz_open_dev$mice(&(0x7f00000002c0)='/dev/input/mice\x00', 0x0, 0x0) ioctl$PPPOEIOCDFWD(r1, 0xb101, 0x0) syz_genetlink_get_family_id$nbd(&(0x7f0000000480)='nbd\x00') getsockopt$inet6_IPV6_XFRM_POLICY(r0, 0x29, 0x23, &(0x7f0000000340)={{{@in=@local, @in=@loopback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@local}, 0x0, @in=@remote}}, &(0x7f0000000140)=0xe8) connect$can_bcm(0xffffffffffffffff, &(0x7f00000001c0), 0x10) bind$inet6(r0, &(0x7f0000000040)={0xa, 0x4e24}, 0x1c) lsetxattr$security_ima(&(0x7f0000000280)='./file0\x00', &(0x7f0000000440)='security.ima\x00', 0x0, 0x0, 0x1) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clock_gettime(0x0, &(0x7f0000000100)={0x0, 0x0}) r4 = openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) bind(r4, &(0x7f0000000580)=@can={0x1d, r2}, 0x80) clock_gettime(0x3, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff}) ppoll(&(0x7f0000000000)=[{r0, 0x41a, 0x64}], 0x1, &(0x7f0000000200)={0x0, r3+30000000}, &(0x7f0000000240), 0x8) connect$inet6(r0, &(0x7f0000000080)={0xa, 0x4e24, 0x0, @ipv4={[], [], @loopback}}, 0x1c) readv(0xffffffffffffffff, 0x0, 0x0) sendmmsg(r0, &(0x7f00000092c0), 0x4ff, 0x0) connect$pptp(r5, &(0x7f00000004c0)={0x18, 0x2, {0x0, @multicast1}}, 0x1e) [ 602.938891] binder: release 21259:21265 transaction 304 out, still active 04:01:28 executing program 2: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000440)=@updpolicy={0xb8, 0x19, 0x523, 0x0, 0x0, {{@in=@multicast2, @in6=@empty={[0x0, 0x0, 0x1000000]}, 0x0, 0x0, 0x0, 0x0, 0xa}}}, 0xb8}}, 0x0) 04:01:28 executing program 3: r0 = syz_open_dev$admmidi(&(0x7f0000000180)='/dev/admmidi#\x00', 0x0, 0x2000) ioctl$VHOST_SET_LOG_BASE(r0, 0x4008af04, &(0x7f0000000200)=&(0x7f00000001c0)) r1 = syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x3) bind$bt_l2cap(r1, &(0x7f0000000040), 0xe) r2 = syz_open_dev$dmmidi(&(0x7f0000000000)='/dev/dmmidi#\x00', 0x7ff, 0x80800) ioctl$VIDIOC_G_INPUT(r2, 0x80045626, &(0x7f0000000080)) setsockopt$inet6_MCAST_LEAVE_GROUP(r2, 0x29, 0x2d, &(0x7f00000000c0)={0x9, {{0xa, 0x4e20, 0x1f, @ipv4={[], [], @multicast2}, 0xa6c}}}, 0x88) listen(r1, 0x0) [ 603.169690] binder: BINDER_SET_CONTEXT_MGR already set [ 603.189064] binder: 21300:21309 ioctl 40046207 0 returned -16 04:01:28 executing program 4: perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000001f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, 0x0) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/kvm\x00', 0x0, 0x0) lsetxattr$security_capability(&(0x7f0000000240)='./file0\x00', 0x0, 0x0, 0x0, 0x3) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) getsockopt$inet_sctp_SCTP_RTOINFO(0xffffffffffffffff, 0x84, 0x0, &(0x7f0000000800)={0x0, 0x8}, 0x0) r2 = syz_open_dev$vcsn(&(0x7f0000000100)='/dev/vcs#\x00', 0x0, 0x40000) ioctl$EVIOCGKEY(r2, 0x80404518, &(0x7f0000000140)=""/10) r3 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) r4 = openat$dsp(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/dsp\x00', 0x800, 0x0) getsockopt$IP_VS_SO_GET_VERSION(r4, 0x0, 0x480, &(0x7f00000005c0), &(0x7f0000000600)=0xffffffffffffff34) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r3, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000000)=[@text64={0x40, &(0x7f0000000500)="c74424004b8a0000c744240200800000c7442406000000000f011424660f38815e00b95a0a00000f32410f32400f01c90f35640f01cff23ae70f0f930e000000b048b884e57c66000000000f23c80f21f8350000e0000f23f8"}], 0x1, 0x51, 0x0, 0xffffff63) ioctl$KVM_SET_MP_STATE(0xffffffffffffffff, 0x4004ae99, 0x0) syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000fe8000/0x18000)=nil, 0x0, 0x0, 0x0, &(0x7f0000000000), 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$KVM_X86_SET_MCE(0xffffffffffffffff, 0x4040ae9e, &(0x7f0000000580)={0x0, 0x1, 0xffffffff, 0x0, 0x1c}) r5 = syz_open_dev$swradio(&(0x7f0000000040)='/dev/swradio#\x00', 0x1, 0x2) ioctl$RTC_ALM_READ(r5, 0x80247008, &(0x7f00000004c0)) ioctl$KVM_RUN(r3, 0xae80, 0x0) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x418) r6 = semget(0xffffffffffffffff, 0x0, 0x0) semctl$SEM_INFO(r6, 0x0, 0x13, 0x0) lsetxattr$trusted_overlay_origin(&(0x7f0000000880)='./file0\x00', &(0x7f00000008c0)='trusted.overlay.origin\x00', &(0x7f0000000900)='y\x00', 0x2, 0x1) ioctl$KVM_SET_VAPIC_ADDR(r3, 0x4008ae93, &(0x7f0000000300)) ioctl$SNDRV_SEQ_IOCTL_GET_SUBSCRIPTION(0xffffffffffffffff, 0xc0505350, &(0x7f0000000440)={{0x5}, {}, 0xfffffffffffffffb, 0x0, 0x3f}) syz_genetlink_get_family_id$ipvs(&(0x7f0000000a40)='IPVS\x00') ioctl$ifreq_SIOCGIFINDEX_team(r1, 0x8933, &(0x7f0000000200)={'team0\x00'}) setsockopt$inet6_tcp_TCP_QUEUE_SEQ(r5, 0x6, 0x15, &(0x7f0000000080)=0x1, 0x4) add_key$user(&(0x7f0000000340)='user\x00', &(0x7f0000000380)={'syz', 0x1}, &(0x7f00000003c0)="749820e3d529641abe8f553344bcd46b1b5af5c545d91d370aabb3c92b139f2851b626dd823ebcec913dd4450537135ad86c85aef7f9241a12f3cd7afb2733659bf1bea41d990aa8951c2028841df8b99f21a6920fb0e776e652e96ca690116400a9bc", 0x63, 0xfffffffffffffffe) keyctl$update(0x2, 0x0, &(0x7f0000000480), 0x0) ioctl$sock_inet6_SIOCSIFDSTADDR(0xffffffffffffffff, 0x8918, 0x0) 04:01:29 executing program 1: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) recvmsg(0xffffffffffffffff, 0x0, 0x0) bind$alg(r0, &(0x7f0000001300)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb(blowfish)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000ff8000)="0a0775b0", 0x4) r1 = accept$alg(r0, 0x0, 0x0) sendmmsg$alg(r1, &(0x7f0000003e80)=[{0x0, 0x0, &(0x7f0000002a80), 0x167, &(0x7f0000000100)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x0) recvmsg(r1, &(0x7f0000000000)={&(0x7f0000f7ffa8)=@alg, 0x61, &(0x7f0000000140)=[{&(0x7f0000000200)=""/4096, 0xfffffe45}], 0x1, &(0x7f0000fb3fa9)=""/87, 0x57}, 0x0) 04:01:29 executing program 2: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000440)=@updpolicy={0xb8, 0x19, 0x523, 0x0, 0x0, {{@in=@multicast2, @in6=@empty={[0x0, 0x0, 0x2000000]}, 0x0, 0x0, 0x0, 0x0, 0xa}}}, 0xb8}}, 0x0) [ 603.277003] binder: 21300:21315 BC_ACQUIRE_DONE u0000000000000000 no match [ 603.312120] binder: 21300:21315 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 04:01:29 executing program 3: r0 = socket$kcm(0x29, 0x5, 0x0) fstatfs(r0, &(0x7f00000000c0)=""/28) r1 = syz_init_net_socket$bt_l2cap(0x1f, 0x7, 0x3) r2 = syz_open_procfs(0x0, &(0x7f0000000000)='net/dev\x00') ioctl$KVM_X86_SETUP_MCE(r2, 0x4008ae9c, &(0x7f0000000080)={0x10, 0x4, 0x2}) bind$bt_l2cap(r1, &(0x7f0000000040), 0xe) listen(r1, 0x0) ioctl$SIOCX25SDTEFACILITIES(r2, 0x89eb, &(0x7f0000000100)={0x8001, 0x9, 0x100000000, 0x10001, 0x81, 0x20, 0x1d, "8e3f1aed95e04e310e39eb5321af5364aa76144e", "6da5f6083b8d37c9aa668fb38e7ee3697c45bac8"}) 04:01:29 executing program 1: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) recvmsg(0xffffffffffffffff, &(0x7f00000036c0)={0x0, 0x0, &(0x7f00000035c0), 0x0, &(0x7f0000003680)=""/41, 0x29}, 0x0) bind$alg(r0, &(0x7f0000001300)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb(blowfish)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000ff8000)="0a0775b0", 0x4) r1 = accept$alg(r0, 0x0, 0x0) sendmmsg$alg(r1, &(0x7f0000003e80)=[{0x0, 0x0, &(0x7f0000002a80), 0x167, &(0x7f0000000100)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x0) recvmsg(r1, &(0x7f0000000000)={&(0x7f0000f7ffa8)=@alg, 0x61, &(0x7f0000000140)=[{&(0x7f0000000200)=""/4096, 0xfffffe45}], 0x1, &(0x7f0000fb3fa9)=""/87, 0x57}, 0x0) 04:01:29 executing program 0: r0 = perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) setxattr$security_smack_entry(&(0x7f0000000380)='./file0\x00', &(0x7f0000000480)='security.SMACK64IPIN\x00', &(0x7f0000000540)='^vboxnet1^\x00', 0xb, 0x1) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x0, 0x3, 0x1}, 0x2c) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r1, &(0x7f0000000040), 0x0, 0x1}, 0x20) unlink(&(0x7f0000000900)='./file0/file0\x00') r2 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r3 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r3, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, &(0x7f00000006c0)={0x0}) ioctl$BINDER_GET_NODE_DEBUG_INFO(r2, 0xc018620b, &(0x7f0000000640)={r4}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f00000000c0)=[@enter_looper], 0x48, 0x0, &(0x7f0000000700)="2ba063fb309ec7fdbfb08e6e91baee7d7d4599fe14129a4d426834556ae420e087d59c0c7be7fcad1abb7e1f8f446f373f611ca1ee9c2231708e18a47bc68a2a79a0b48931f6ff6d"}) ioctl$BINDER_SET_CONTEXT_MGR(r3, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x1) prctl$PR_SET_NAME(0xf, &(0x7f00000004c0)='/group.stat\x00') ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, &(0x7f0000000780)}) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f0000000680)}) ioctl$FS_IOC_FIEMAP(r3, 0xc020660b, &(0x7f0000000b80)=ANY=[@ANYBLOB="0000010000000000200000000000000005000000010000000a00000000000000ff030000000000001a0a000000000000050000000000000000000000000000000000000000000000080000000000000000000000000000000800000000000000ffff0000000000000100008000000000000000000000000000000000000000000000000000000000000000000000000008000000000000003f0000000000000008000000000000000000000000000000000000000000800800000000000000000000000000000200000000000000000400000000000000000000010000000000000000000000000000000000000002110000000000000000000000000000cc0000000000000000000000000000001b0000000000000000000000000000000000000000000000841400000000000000000000000000000300000000000000feffffffffffffff000000000000000000000000000000000000000000000000020000000000000000000000000000000600000000000000ff01000000000000040000000000000000000000000000000000000000000000000400000000000000000000000000007be70000000000000900000000000000ff7f0000000000000000000000000000000000000000000004180000000000000000000000000000ffffffff0000000081000000000000000600000000000000000000000000000000000000000000000400000000000000000000000000000002000000000000000500000000000000ff7fffffffffffff0000000000000000000000000000000004040000000000000000000000000000"]) r6 = creat(&(0x7f00000000c0)='./file0\x00', 0x0) openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000100)='/group.stat\x00', 0x2761, 0x0) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000080), 0xffffffffffffffff) getpid() fallocate(r0, 0x0, 0x0, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x2f, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) memfd_create(&(0x7f0000000080)='!proccgroup\x00', 0x0) ioctl$sock_inet_SIOCSIFPFLAGS(0xffffffffffffffff, 0x8934, &(0x7f0000000400)={'veth0_to_bridge\x00', 0x100}) accept(r6, &(0x7f0000000580)=@alg, &(0x7f0000000600)=0x80) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x2400, 0x8000) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000008c0)={0x2c, 0x0, &(0x7f0000000780)=[@acquire_done={0x40106309, r5, 0x2}, @clear_death={0x400c630f, 0x1, 0x3}, @release={0x40046306, 0x2}], 0xc1, 0x0, &(0x7f00000007c0)="859547f83b9b058a973a491d7e6378544744f2b56b02270a2f78214a936e9afb25cd94695643af6563f86771aa9621b9f30f2ca538b018247a633c28ee01e03b4639679311117971e60dc1538f34e961ae301463172c41754be988f6beb0ce4d83c69f86c236d29520e6cdaf5dbb60404c66d63315ff287deac8632781d0197ef1f81314da0a1ed90b681842cf85a41b496ce0a7a6f5aa4b9b23483eea8861be89b3398c6aec3349174f9cdc9de34df361ac9bf7afd8566849487c3c0a1e3aaacd"}) 04:01:29 executing program 2: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000440)=@updpolicy={0xb8, 0x19, 0x523, 0x0, 0x0, {{@in=@multicast2, @in6=@empty={[0x0, 0x0, 0x3000000]}, 0x0, 0x0, 0x0, 0x0, 0xa}}}, 0xb8}}, 0x0) 04:01:29 executing program 4: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) recvmsg(0xffffffffffffffff, &(0x7f00000036c0)={&(0x7f0000000180)=@can, 0xfd28, &(0x7f00000035c0), 0x0, &(0x7f0000003680)=""/41, 0x29}, 0x0) bind$alg(r0, &(0x7f0000001300)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb(blowfish)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000ff8000)="0a0775b0", 0x4) r1 = accept$alg(r0, 0x0, 0x0) sendmmsg$alg(r1, &(0x7f0000003e80)=[{0x0, 0x0, &(0x7f0000002a80), 0x167, &(0x7f0000000100)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x0) recvmsg(r1, &(0x7f0000000000)={&(0x7f0000f7ffa8)=@alg, 0x61, &(0x7f0000000140)=[{&(0x7f0000000200)=""/4096, 0xfffffe45}], 0x1, &(0x7f0000fb3fa9)=""/87, 0x57}, 0x0) 04:01:29 executing program 3: bind$bt_l2cap(0xffffffffffffffff, &(0x7f0000000040), 0xe) r0 = syz_open_dev$midi(&(0x7f0000000000)='/dev/midi#\x00', 0x0, 0x800) setsockopt$RDS_FREE_MR(r0, 0x114, 0x3, &(0x7f0000000080)={{0x9, 0x64}, 0x2}, 0x10) getsockopt$inet_sctp6_SCTP_RECVRCVINFO(r0, 0x84, 0x20, &(0x7f00000000c0), &(0x7f0000000100)=0x4) listen(0xffffffffffffffff, 0x0) [ 603.864601] binder: release 21300:21309 transaction 307 out, still active 04:01:29 executing program 5: r0 = socket$inet6(0xa, 0x2, 0x0) r1 = syz_open_dev$mice(&(0x7f00000002c0)='/dev/input/mice\x00', 0x0, 0x0) ioctl$PPPOEIOCDFWD(r1, 0xb101, 0x0) syz_genetlink_get_family_id$nbd(&(0x7f0000000480)='nbd\x00') getsockopt$inet6_IPV6_XFRM_POLICY(r0, 0x29, 0x23, &(0x7f0000000340)={{{@in=@local, @in=@loopback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@local}, 0x0, @in=@remote}}, &(0x7f0000000140)=0xe8) connect$can_bcm(0xffffffffffffffff, &(0x7f00000001c0), 0x10) bind$inet6(r0, &(0x7f0000000040)={0xa, 0x4e24}, 0x1c) lsetxattr$security_ima(&(0x7f0000000280)='./file0\x00', &(0x7f0000000440)='security.ima\x00', 0x0, 0x0, 0x1) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clock_gettime(0x0, &(0x7f0000000100)={0x0, 0x0}) r4 = openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) bind(r4, &(0x7f0000000580)=@can={0x1d, r2}, 0x80) clock_gettime(0x3, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff}) ppoll(&(0x7f0000000000)=[{r0, 0x41a, 0x259}], 0x1, &(0x7f0000000200)={0x0, r3+30000000}, &(0x7f0000000240), 0x8) connect$inet6(r0, &(0x7f0000000080)={0xa, 0x4e24, 0x0, @ipv4={[], [], @loopback}}, 0x1c) readv(0xffffffffffffffff, 0x0, 0x0) sendmmsg(r0, &(0x7f00000092c0), 0x4ff, 0x0) connect$pptp(r5, &(0x7f00000004c0)={0x18, 0x2, {0x0, @multicast1}}, 0x1e) 04:01:29 executing program 1: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) recvmsg(0xffffffffffffffff, &(0x7f00000036c0)={0x0, 0x0, &(0x7f00000035c0), 0x0, &(0x7f0000003680)=""/41, 0x29}, 0x0) bind$alg(r0, &(0x7f0000001300)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb(blowfish)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000ff8000)="0a0775b0", 0x4) r1 = accept$alg(r0, 0x0, 0x0) sendmmsg$alg(r1, &(0x7f0000003e80)=[{0x0, 0x0, &(0x7f0000002a80), 0x167, &(0x7f0000000100)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x0) recvmsg(r1, &(0x7f0000000000)={&(0x7f0000f7ffa8)=@alg, 0x61, &(0x7f0000000140)=[{&(0x7f0000000200)=""/4096, 0xfffffe45}], 0x1, &(0x7f0000fb3fa9)=""/87, 0x57}, 0x0) 04:01:29 executing program 2: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000440)=@updpolicy={0xb8, 0x19, 0x523, 0x0, 0x0, {{@in=@multicast2, @in6=@empty={[0x0, 0x0, 0x4000000]}, 0x0, 0x0, 0x0, 0x0, 0xa}}}, 0xb8}}, 0x0) 04:01:29 executing program 3: r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x3) bind$bt_l2cap(r0, &(0x7f0000000040), 0xe) r1 = dup2(r0, r0) setsockopt$inet_tcp_TCP_QUEUE_SEQ(r1, 0x6, 0x15, &(0x7f0000000000)=0xa3df, 0x4) listen(r0, 0x0) ioctl$sock_inet_SIOCGARP(r1, 0x8954, &(0x7f0000000140)={{0x2, 0x4e24, @empty}, {0x306, @broadcast}, 0x8, {0x2, 0x4e24, @multicast1}, 'gretap0\x00'}) ioctl$sock_inet_SIOCRTMSG(r1, 0x890d, &(0x7f00000000c0)={0x0, {0x2, 0x4e23, @multicast1}, {0x2, 0x4e22, @rand_addr=0x5}, {0x2, 0x4e23, @remote}, 0x9, 0x0, 0x0, 0x0, 0x4, &(0x7f0000000080)='syz_tun\x00', 0x6, 0x6b56ba21, 0x8}) 04:01:29 executing program 4: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) recvmsg(0xffffffffffffffff, &(0x7f00000036c0)={&(0x7f0000000180)=@can, 0xfd28, &(0x7f00000035c0), 0x0, &(0x7f0000003680)=""/41, 0x29}, 0x0) bind$alg(r0, &(0x7f0000001300)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb(blowfish)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000ff8000)="0a0775b0", 0x4) r1 = accept$alg(r0, 0x0, 0x0) sendmmsg$alg(r1, &(0x7f0000003e80)=[{0x0, 0x0, &(0x7f0000002a80), 0x167, &(0x7f0000000100)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x0) recvmsg(r1, &(0x7f0000000000)={&(0x7f0000f7ffa8)=@alg, 0x61, &(0x7f0000000140)=[{&(0x7f0000000200)=""/4096, 0xfffffe45}], 0x1, &(0x7f0000fb3fa9)=""/87, 0x57}, 0x0) 04:01:29 executing program 1: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) recvmsg(0xffffffffffffffff, &(0x7f00000036c0)={0x0, 0x0, &(0x7f00000035c0), 0x0, &(0x7f0000003680)=""/41, 0x29}, 0x0) bind$alg(r0, &(0x7f0000001300)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb(blowfish)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000ff8000)="0a0775b0", 0x4) r1 = accept$alg(r0, 0x0, 0x0) sendmmsg$alg(r1, &(0x7f0000003e80)=[{0x0, 0x0, &(0x7f0000002a80), 0x167, &(0x7f0000000100)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x0) recvmsg(r1, &(0x7f0000000000)={&(0x7f0000f7ffa8)=@alg, 0x61, &(0x7f0000000140)=[{&(0x7f0000000200)=""/4096, 0xfffffe45}], 0x1, &(0x7f0000fb3fa9)=""/87, 0x57}, 0x0) [ 604.113200] binder: BINDER_SET_CONTEXT_MGR already set [ 604.126585] binder: 21341:21351 ioctl 40046207 0 returned -16 [ 604.162649] binder: 21341:21361 BC_ACQUIRE_DONE u0000000000000000 no match 04:01:29 executing program 2: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000440)=@updpolicy={0xb8, 0x19, 0x523, 0x0, 0x0, {{@in=@multicast2, @in6=@empty={[0x0, 0x0, 0x8000000]}, 0x0, 0x0, 0x0, 0x0, 0xa}}}, 0xb8}}, 0x0) 04:01:30 executing program 3: r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x3) bind$bt_l2cap(r0, &(0x7f0000000000)={0x1f, 0x0, {0x0, 0x0, 0x7, 0x0, 0x0, 0x1}}, 0xfffffffffffffffb) listen(r0, 0x0) [ 604.211858] binder: 21341:21361 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 [ 604.248261] binder_thread_write: 3 callbacks suppressed [ 604.248276] binder: 21341:21361 Release 1 refcount change on invalid ref 2 ret -22 04:01:30 executing program 0: r0 = perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) setxattr$security_smack_entry(&(0x7f0000000380)='./file0\x00', &(0x7f0000000480)='security.SMACK64IPIN\x00', &(0x7f0000000540)='^vboxnet1^\x00', 0xb, 0x1) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x0, 0x1}, 0x2c) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r1, &(0x7f0000000040), 0x0, 0x1}, 0x20) unlink(&(0x7f0000000900)='./file0/file0\x00') r2 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r3 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r3, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, &(0x7f00000006c0)={0x0}) ioctl$BINDER_GET_NODE_DEBUG_INFO(r2, 0xc018620b, &(0x7f0000000640)={r4}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f00000000c0)=[@enter_looper], 0x48, 0x0, &(0x7f0000000700)="2ba063fb309ec7fdbfb08e6e91baee7d7d4599fe14129a4d426834556ae420e087d59c0c7be7fcad1abb7e1f8f446f373f611ca1ee9c2231708e18a47bc68a2a79a0b48931f6ff6d"}) ioctl$BINDER_SET_CONTEXT_MGR(r3, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x1) prctl$PR_SET_NAME(0xf, &(0x7f00000004c0)='/group.stat\x00') ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, &(0x7f0000000780)}) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f0000000680)}) ioctl$FS_IOC_FIEMAP(r3, 0xc020660b, &(0x7f0000000b80)=ANY=[@ANYBLOB="0000010000000000200000000000000005000000010000000a00000000000000ff030000000000001a0a000000000000050000000000000000000000000000000000000000000000080000000000000000000000000000000800000000000000ffff0000000000000100008000000000000000000000000000000000000000000000000000000000000000000000000008000000000000003f0000000000000008000000000000000000000000000000000000000000800800000000000000000000000000000200000000000000000400000000000000000000010000000000000000000000000000000000000002110000000000000000000000000000cc0000000000000000000000000000001b0000000000000000000000000000000000000000000000841400000000000000000000000000000300000000000000feffffffffffffff000000000000000000000000000000000000000000000000020000000000000000000000000000000600000000000000ff01000000000000040000000000000000000000000000000000000000000000000400000000000000000000000000007be70000000000000900000000000000ff7f0000000000000000000000000000000000000000000004180000000000000000000000000000ffffffff0000000081000000000000000600000000000000000000000000000000000000000000000400000000000000000000000000000002000000000000000500000000000000ff7fffffffffffff0000000000000000000000000000000004040000000000000000000000000000"]) r6 = creat(&(0x7f00000000c0)='./file0\x00', 0x0) openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000100)='/group.stat\x00', 0x2761, 0x0) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000080), 0xffffffffffffffff) getpid() fallocate(r0, 0x0, 0x0, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x2f, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) memfd_create(&(0x7f0000000080)='!proccgroup\x00', 0x0) ioctl$sock_inet_SIOCSIFPFLAGS(0xffffffffffffffff, 0x8934, &(0x7f0000000400)={'veth0_to_bridge\x00', 0x100}) accept(r6, &(0x7f0000000580)=@alg, &(0x7f0000000600)=0x80) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x2400, 0x8000) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000008c0)={0x2c, 0x0, &(0x7f0000000780)=[@acquire_done={0x40106309, r5, 0x2}, @clear_death={0x400c630f, 0x1, 0x3}, @release={0x40046306, 0x2}], 0xc1, 0x0, &(0x7f00000007c0)="859547f83b9b058a973a491d7e6378544744f2b56b02270a2f78214a936e9afb25cd94695643af6563f86771aa9621b9f30f2ca538b018247a633c28ee01e03b4639679311117971e60dc1538f34e961ae301463172c41754be988f6beb0ce4d83c69f86c236d29520e6cdaf5dbb60404c66d63315ff287deac8632781d0197ef1f81314da0a1ed90b681842cf85a41b496ce0a7a6f5aa4b9b23483eea8861be89b3398c6aec3349174f9cdc9de34df361ac9bf7afd8566849487c3c0a1e3aaacd"}) 04:01:30 executing program 2: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000440)=@updpolicy={0xb8, 0x19, 0x523, 0x0, 0x0, {{@in=@multicast2, @in6=@empty={[0x0, 0x0, 0xa000000]}, 0x0, 0x0, 0x0, 0x0, 0xa}}}, 0xb8}}, 0x0) 04:01:30 executing program 1: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) recvmsg(0xffffffffffffffff, &(0x7f00000036c0)={&(0x7f0000000180)=@can, 0x80, 0x0, 0x0, &(0x7f0000003680)=""/41, 0x29}, 0x0) bind$alg(r0, &(0x7f0000001300)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb(blowfish)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000ff8000)="0a0775b0", 0x4) r1 = accept$alg(r0, 0x0, 0x0) sendmmsg$alg(r1, &(0x7f0000003e80)=[{0x0, 0x0, &(0x7f0000002a80), 0x167, &(0x7f0000000100)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x0) recvmsg(r1, &(0x7f0000000000)={&(0x7f0000f7ffa8)=@alg, 0x61, &(0x7f0000000140)=[{&(0x7f0000000200)=""/4096, 0xfffffe45}], 0x1, &(0x7f0000fb3fa9)=""/87, 0x57}, 0x0) 04:01:30 executing program 4: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) recvmsg(0xffffffffffffffff, &(0x7f00000036c0)={&(0x7f0000000180)=@can, 0xfd28, &(0x7f00000035c0), 0x0, &(0x7f0000003680)=""/41, 0x29}, 0x0) bind$alg(r0, &(0x7f0000001300)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb(blowfish)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000ff8000)="0a0775b0", 0x4) r1 = accept$alg(r0, 0x0, 0x0) sendmmsg$alg(r1, &(0x7f0000003e80)=[{0x0, 0x0, &(0x7f0000002a80), 0x167, &(0x7f0000000100)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x0) recvmsg(r1, &(0x7f0000000000)={&(0x7f0000f7ffa8)=@alg, 0x61, &(0x7f0000000140)=[{&(0x7f0000000200)=""/4096, 0xfffffe45}], 0x1, &(0x7f0000fb3fa9)=""/87, 0x57}, 0x0) [ 604.785637] binder: release 21341:21351 transaction 310 out, still active [ 604.938263] binder: BINDER_SET_CONTEXT_MGR already set [ 604.943701] binder: 21379:21384 ioctl 40046207 0 returned -16 [ 604.969790] binder: 21379:21384 Release 1 refcount change on invalid ref 1 ret -22 04:01:30 executing program 5: r0 = socket$inet6(0xa, 0x2, 0x0) r1 = syz_open_dev$mice(&(0x7f00000002c0)='/dev/input/mice\x00', 0x0, 0x0) ioctl$PPPOEIOCDFWD(r1, 0xb101, 0x0) syz_genetlink_get_family_id$nbd(&(0x7f0000000480)='nbd\x00') getsockopt$inet6_IPV6_XFRM_POLICY(r0, 0x29, 0x23, &(0x7f0000000340)={{{@in=@local, @in=@loopback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@local}, 0x0, @in=@remote}}, &(0x7f0000000140)=0xe8) connect$can_bcm(0xffffffffffffffff, &(0x7f00000001c0), 0x10) bind$inet6(r0, &(0x7f0000000040)={0xa, 0x4e24}, 0x1c) lsetxattr$security_ima(&(0x7f0000000280)='./file0\x00', &(0x7f0000000440)='security.ima\x00', 0x0, 0x0, 0x1) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clock_gettime(0x0, &(0x7f0000000100)={0x0, 0x0}) r4 = openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) bind(r4, &(0x7f0000000580)=@can={0x1d, r2}, 0x80) clock_gettime(0x3, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff}) ppoll(&(0x7f0000000000)=[{r0, 0x41a, 0x300}], 0x1, &(0x7f0000000200)={0x0, r3+30000000}, &(0x7f0000000240), 0x8) connect$inet6(r0, &(0x7f0000000080)={0xa, 0x4e24, 0x0, @ipv4={[], [], @loopback}}, 0x1c) readv(0xffffffffffffffff, 0x0, 0x0) sendmmsg(r0, &(0x7f00000092c0), 0x4ff, 0x0) connect$pptp(r5, &(0x7f00000004c0)={0x18, 0x2, {0x0, @multicast1}}, 0x1e) 04:01:30 executing program 3: r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x5, 0x3) bind$bt_l2cap(r0, &(0x7f0000000040), 0xe) listen(r0, 0x3) setsockopt$sock_attach_bpf(r0, 0x1, 0x32, &(0x7f0000000080), 0x4) 04:01:30 executing program 2: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000440)=@updpolicy={0xb8, 0x19, 0x523, 0x0, 0x0, {{@in=@multicast2, @in6=@empty={[0x0, 0x0, 0xe000000]}, 0x0, 0x0, 0x0, 0x0, 0xa}}}, 0xb8}}, 0x0) 04:01:30 executing program 1: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) recvmsg(0xffffffffffffffff, &(0x7f00000036c0)={&(0x7f0000000180)=@can, 0x80, 0x0, 0x0, &(0x7f0000003680)=""/41, 0x29}, 0x0) bind$alg(r0, &(0x7f0000001300)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb(blowfish)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000ff8000)="0a0775b0", 0x4) r1 = accept$alg(r0, 0x0, 0x0) sendmmsg$alg(r1, &(0x7f0000003e80)=[{0x0, 0x0, &(0x7f0000002a80), 0x167, &(0x7f0000000100)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x0) recvmsg(r1, &(0x7f0000000000)={&(0x7f0000f7ffa8)=@alg, 0x61, &(0x7f0000000140)=[{&(0x7f0000000200)=""/4096, 0xfffffe45}], 0x1, &(0x7f0000fb3fa9)=""/87, 0x57}, 0x0) 04:01:30 executing program 4: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) recvmsg(0xffffffffffffffff, &(0x7f00000036c0)={&(0x7f0000000180)=@can, 0xfd28, &(0x7f00000035c0), 0x0, &(0x7f0000003680)=""/41, 0x29}, 0x0) bind$alg(r0, &(0x7f0000001300)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb(blowfish)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000ff8000)="0a0775b0", 0x4) r1 = accept$alg(r0, 0x0, 0x0) recvmsg(r1, &(0x7f0000000000)={&(0x7f0000f7ffa8)=@alg, 0x61, &(0x7f0000000140)=[{&(0x7f0000000200)=""/4096, 0xfffffe45}], 0x1, &(0x7f0000fb3fa9)=""/87, 0x57}, 0x0) [ 605.001643] binder: 21379:21386 BC_ACQUIRE_DONE u0000000000000000 no match [ 605.013545] binder: 21379:21386 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 [ 605.036205] binder: 21379:21386 Release 1 refcount change on invalid ref 2 ret -22 04:01:30 executing program 1: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) recvmsg(0xffffffffffffffff, &(0x7f00000036c0)={&(0x7f0000000180)=@can, 0x80, 0x0, 0x0, &(0x7f0000003680)=""/41, 0x29}, 0x0) bind$alg(r0, &(0x7f0000001300)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb(blowfish)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000ff8000)="0a0775b0", 0x4) r1 = accept$alg(r0, 0x0, 0x0) sendmmsg$alg(r1, &(0x7f0000003e80)=[{0x0, 0x0, &(0x7f0000002a80), 0x167, &(0x7f0000000100)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x0) recvmsg(r1, &(0x7f0000000000)={&(0x7f0000f7ffa8)=@alg, 0x61, &(0x7f0000000140)=[{&(0x7f0000000200)=""/4096, 0xfffffe45}], 0x1, &(0x7f0000fb3fa9)=""/87, 0x57}, 0x0) 04:01:30 executing program 3: r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x3) pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) getsockopt$IP6T_SO_GET_ENTRIES(r1, 0x29, 0x41, &(0x7f0000000080)={'mangle\x00', 0x10, "3331e4184f936bfe063a7fb47a6088bd"}, &(0x7f00000000c0)=0x34) bind$bt_l2cap(r0, &(0x7f0000000040), 0xe) bind$bt_rfcomm(r2, &(0x7f0000000100)={0x1f, {0x6b10, 0x100000001, 0x9, 0x20, 0x6, 0xbd7}, 0x9}, 0xa) listen(r0, 0x0) 04:01:30 executing program 2: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000440)=@updpolicy={0xb8, 0x19, 0x523, 0x0, 0x0, {{@in=@multicast2, @in6=@empty={[0x0, 0x0, 0xf000000]}, 0x0, 0x0, 0x0, 0x0, 0xa}}}, 0xb8}}, 0x0) 04:01:31 executing program 0: r0 = perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) setxattr$security_smack_entry(&(0x7f0000000380)='./file0\x00', &(0x7f0000000480)='security.SMACK64IPIN\x00', &(0x7f0000000540)='^vboxnet1^\x00', 0xb, 0x1) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x0, 0x1}, 0x2c) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r1, &(0x7f0000000040), 0x0, 0x1}, 0x20) unlink(&(0x7f0000000900)='./file0/file0\x00') r2 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r3 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r3, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, &(0x7f00000006c0)={0x0}) ioctl$BINDER_GET_NODE_DEBUG_INFO(r2, 0xc018620b, &(0x7f0000000640)={r4}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f00000000c0)=[@enter_looper], 0x48, 0x0, &(0x7f0000000700)="2ba063fb309ec7fdbfb08e6e91baee7d7d4599fe14129a4d426834556ae420e087d59c0c7be7fcad1abb7e1f8f446f373f611ca1ee9c2231708e18a47bc68a2a79a0b48931f6ff6d"}) ioctl$BINDER_SET_CONTEXT_MGR(r3, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x1) prctl$PR_SET_NAME(0xf, &(0x7f00000004c0)='/group.stat\x00') ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, &(0x7f0000000780)}) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f0000000680)}) ioctl$FS_IOC_FIEMAP(r3, 0xc020660b, &(0x7f0000000b80)=ANY=[@ANYBLOB="0000010000000000200000000000000005000000010000000a00000000000000ff030000000000001a0a000000000000050000000000000000000000000000000000000000000000080000000000000000000000000000000800000000000000ffff0000000000000100008000000000000000000000000000000000000000000000000000000000000000000000000008000000000000003f0000000000000008000000000000000000000000000000000000000000800800000000000000000000000000000200000000000000000400000000000000000000010000000000000000000000000000000000000002110000000000000000000000000000cc0000000000000000000000000000001b0000000000000000000000000000000000000000000000841400000000000000000000000000000300000000000000feffffffffffffff000000000000000000000000000000000000000000000000020000000000000000000000000000000600000000000000ff01000000000000040000000000000000000000000000000000000000000000000400000000000000000000000000007be70000000000000900000000000000ff7f0000000000000000000000000000000000000000000004180000000000000000000000000000ffffffff0000000081000000000000000600000000000000000000000000000000000000000000000400000000000000000000000000000002000000000000000500000000000000ff7fffffffffffff0000000000000000000000000000000004040000000000000000000000000000"]) r6 = creat(&(0x7f00000000c0)='./file0\x00', 0x0) openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000100)='/group.stat\x00', 0x2761, 0x0) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000080), 0xffffffffffffffff) getpid() fallocate(r0, 0x0, 0x0, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x2f, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) memfd_create(&(0x7f0000000080)='!proccgroup\x00', 0x0) ioctl$sock_inet_SIOCSIFPFLAGS(0xffffffffffffffff, 0x8934, &(0x7f0000000400)={'veth0_to_bridge\x00', 0x100}) accept(r6, &(0x7f0000000580)=@alg, &(0x7f0000000600)=0x80) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x2400, 0x8000) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000008c0)={0x2c, 0x0, &(0x7f0000000780)=[@acquire_done={0x40106309, r5, 0x2}, @clear_death={0x400c630f, 0x1, 0x3}, @release={0x40046306, 0x2}], 0xc1, 0x0, &(0x7f00000007c0)="859547f83b9b058a973a491d7e6378544744f2b56b02270a2f78214a936e9afb25cd94695643af6563f86771aa9621b9f30f2ca538b018247a633c28ee01e03b4639679311117971e60dc1538f34e961ae301463172c41754be988f6beb0ce4d83c69f86c236d29520e6cdaf5dbb60404c66d63315ff287deac8632781d0197ef1f81314da0a1ed90b681842cf85a41b496ce0a7a6f5aa4b9b23483eea8861be89b3398c6aec3349174f9cdc9de34df361ac9bf7afd8566849487c3c0a1e3aaacd"}) 04:01:31 executing program 4: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) recvmsg(0xffffffffffffffff, &(0x7f00000036c0)={&(0x7f0000000180)=@can, 0xfd28, &(0x7f00000035c0), 0x0, &(0x7f0000003680)=""/41, 0x29}, 0x0) bind$alg(r0, &(0x7f0000001300)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb(blowfish)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000ff8000)="0a0775b0", 0x4) r1 = accept$alg(r0, 0x0, 0x0) recvmsg(r1, &(0x7f0000000000)={&(0x7f0000f7ffa8)=@alg, 0x61, &(0x7f0000000140)=[{&(0x7f0000000200)=""/4096, 0xfffffe45}], 0x1, &(0x7f0000fb3fa9)=""/87, 0x57}, 0x0) 04:01:31 executing program 2: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000440)=@updpolicy={0xb8, 0x19, 0x523, 0x0, 0x0, {{@in=@multicast2, @in6=@empty={[0x0, 0x0, 0x10000000]}, 0x0, 0x0, 0x0, 0x0, 0xa}}}, 0xb8}}, 0x0) 04:01:31 executing program 3: r0 = syz_open_dev$vbi(&(0x7f0000000000)='/dev/vbi#\x00', 0x3, 0x2) rt_sigprocmask(0x0, &(0x7f0000000080)={0xfffffffffffffffe}, 0x0, 0x8) clone(0x3102001ffe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = gettid() futex(&(0x7f0000000140)=0x2, 0x0, 0x2, 0x0, 0x0, 0x0) ptrace$setopts(0x4206, r1, 0x0, 0x0) setsockopt$inet_dccp_buf(r0, 0x21, 0x80, &(0x7f0000000200)="566ababf40a53e46fbcac21ebd2121d347fb622bd4f055e7701e312068d2a64d2bd5bd7c8c24b3378c", 0x29) rt_sigqueueinfo(r1, 0x12, &(0x7f0000000000)={0x0, 0x0, 0xfffffffffffffffc}) ptrace$cont(0x20, r1, 0x0, 0x0) ptrace$cont(0x9, r1, 0x0, 0x1) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000000c0)={'veth0_to_team\x00', 0x0}) ioctl$TUNSETIFINDEX(r0, 0x400454da, &(0x7f00000001c0)=r2) getsockopt$inet_sctp6_SCTP_MAX_BURST(r0, 0x84, 0x14, &(0x7f0000000080)=@assoc_value={0x0}, &(0x7f0000000180)=0x8) getsockopt$inet_sctp6_SCTP_SOCKOPT_PEELOFF(r0, 0x84, 0x66, &(0x7f0000000100)={r3, 0x100}, &(0x7f0000000140)=0x8) r4 = syz_init_net_socket$bt_l2cap(0x1f, 0x99961e923b1ac650, 0x3) syz_init_net_socket$bt_l2cap(0x1f, 0x5, 0x0) bind$bt_l2cap(r4, &(0x7f0000000040), 0xe) listen(r4, 0x0) [ 605.668305] binder: release 21379:21384 transaction 313 out, still active [ 605.815578] binder: BINDER_SET_CONTEXT_MGR already set [ 605.821023] binder: 21416:21425 ioctl 40046207 0 returned -16 [ 605.828410] binder: 21416:21425 Release 1 refcount change on invalid ref 1 ret -22 [ 605.888199] binder: 21416:21427 BC_ACQUIRE_DONE u0000000000000000 no match [ 605.895363] binder: 21416:21427 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 [ 605.902294] binder: 21416:21427 Release 1 refcount change on invalid ref 2 ret -22 04:01:31 executing program 5: r0 = socket$inet6(0xa, 0x2, 0x0) r1 = syz_open_dev$mice(&(0x7f00000002c0)='/dev/input/mice\x00', 0x0, 0x0) ioctl$PPPOEIOCDFWD(r1, 0xb101, 0x0) syz_genetlink_get_family_id$nbd(&(0x7f0000000480)='nbd\x00') getsockopt$inet6_IPV6_XFRM_POLICY(r0, 0x29, 0x23, &(0x7f0000000340)={{{@in=@local, @in=@loopback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@local}, 0x0, @in=@remote}}, &(0x7f0000000140)=0xe8) connect$can_bcm(0xffffffffffffffff, &(0x7f00000001c0), 0x10) bind$inet6(r0, &(0x7f0000000040)={0xa, 0x4e24}, 0x1c) lsetxattr$security_ima(&(0x7f0000000280)='./file0\x00', &(0x7f0000000440)='security.ima\x00', 0x0, 0x0, 0x1) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clock_gettime(0x0, &(0x7f0000000100)={0x0, 0x0}) r4 = openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) bind(r4, &(0x7f0000000580)=@can={0x1d, r2}, 0x80) clock_gettime(0x3, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff}) ppoll(&(0x7f0000000000)=[{r0, 0x41a, 0x2000}], 0x1, &(0x7f0000000200)={0x0, r3+30000000}, &(0x7f0000000240), 0x8) connect$inet6(r0, &(0x7f0000000080)={0xa, 0x4e24, 0x0, @ipv4={[], [], @loopback}}, 0x1c) readv(0xffffffffffffffff, 0x0, 0x0) sendmmsg(r0, &(0x7f00000092c0), 0x4ff, 0x0) connect$pptp(r5, &(0x7f00000004c0)={0x18, 0x2, {0x0, @multicast1}}, 0x1e) 04:01:31 executing program 1: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) recvmsg(0xffffffffffffffff, &(0x7f00000036c0)={&(0x7f0000000180)=@can, 0x80, &(0x7f00000035c0)}, 0x0) bind$alg(r0, &(0x7f0000001300)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb(blowfish)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000ff8000)="0a0775b0", 0x4) r1 = accept$alg(r0, 0x0, 0x0) sendmmsg$alg(r1, &(0x7f0000003e80)=[{0x0, 0x0, &(0x7f0000002a80), 0x167, &(0x7f0000000100)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x0) recvmsg(r1, &(0x7f0000000000)={&(0x7f0000f7ffa8)=@alg, 0x61, &(0x7f0000000140)=[{&(0x7f0000000200)=""/4096, 0xfffffe45}], 0x1, &(0x7f0000fb3fa9)=""/87, 0x57}, 0x0) 04:01:31 executing program 2: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000440)=@updpolicy={0xb8, 0x19, 0x523, 0x0, 0x0, {{@in=@multicast2, @in6=@empty={[0x0, 0x0, 0x24030000]}, 0x0, 0x0, 0x0, 0x0, 0xa}}}, 0xb8}}, 0x0) 04:01:31 executing program 4: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) recvmsg(0xffffffffffffffff, &(0x7f00000036c0)={&(0x7f0000000180)=@can, 0xfd28, &(0x7f00000035c0), 0x0, &(0x7f0000003680)=""/41, 0x29}, 0x0) bind$alg(r0, &(0x7f0000001300)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb(blowfish)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000ff8000)="0a0775b0", 0x4) r1 = accept$alg(r0, 0x0, 0x0) recvmsg(r1, &(0x7f0000000000)={&(0x7f0000f7ffa8)=@alg, 0x61, &(0x7f0000000140)=[{&(0x7f0000000200)=""/4096, 0xfffffe45}], 0x1, &(0x7f0000fb3fa9)=""/87, 0x57}, 0x0) 04:01:31 executing program 1: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) recvmsg(0xffffffffffffffff, &(0x7f00000036c0)={&(0x7f0000000180)=@can, 0xfd28, &(0x7f00000035c0), 0x0, &(0x7f0000003680)=""/41, 0x29}, 0x0) bind$alg(0xffffffffffffffff, &(0x7f0000001300)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb(blowfish)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000ff8000)="0a0775b0", 0x4) r1 = accept$alg(r0, 0x0, 0x0) sendmmsg$alg(r1, &(0x7f0000003e80)=[{0x0, 0x0, &(0x7f0000002a80), 0x167, &(0x7f0000000100)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x0) recvmsg(r1, &(0x7f0000000000)={&(0x7f0000f7ffa8)=@alg, 0x61, &(0x7f0000000140)=[{&(0x7f0000000200)=""/4096, 0xfffffe45}], 0x1, &(0x7f0000fb3fa9)=""/87, 0x57}, 0x0) 04:01:31 executing program 2: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000440)=@updpolicy={0xb8, 0x19, 0x523, 0x0, 0x0, {{@in=@multicast2, @in6=@empty={[0x0, 0x0, 0x2f000000]}, 0x0, 0x0, 0x0, 0x0, 0xa}}}, 0xb8}}, 0x0) 04:01:31 executing program 4: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) recvmsg(0xffffffffffffffff, &(0x7f00000036c0)={&(0x7f0000000180)=@can, 0xfd28, &(0x7f00000035c0), 0x0, &(0x7f0000003680)=""/41, 0x29}, 0x0) bind$alg(r0, &(0x7f0000001300)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb(blowfish)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000ff8000)="0a0775b0", 0x4) sendmmsg$alg(0xffffffffffffffff, &(0x7f0000003e80)=[{0x0, 0x0, &(0x7f0000002a80), 0x167, &(0x7f0000000100)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x0) recvmsg(0xffffffffffffffff, &(0x7f0000000000)={&(0x7f0000f7ffa8)=@alg, 0x61, &(0x7f0000000140)=[{&(0x7f0000000200)=""/4096, 0xfffffe45}], 0x1, &(0x7f0000fb3fa9)=""/87, 0x57}, 0x0) 04:01:32 executing program 4: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) recvmsg(0xffffffffffffffff, &(0x7f00000036c0)={&(0x7f0000000180)=@can, 0xfd28, &(0x7f00000035c0), 0x0, &(0x7f0000003680)=""/41, 0x29}, 0x0) bind$alg(r0, &(0x7f0000001300)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb(blowfish)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000ff8000)="0a0775b0", 0x4) sendmmsg$alg(0xffffffffffffffff, &(0x7f0000003e80)=[{0x0, 0x0, &(0x7f0000002a80), 0x167, &(0x7f0000000100)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x0) recvmsg(0xffffffffffffffff, &(0x7f0000000000)={&(0x7f0000f7ffa8)=@alg, 0x61, &(0x7f0000000140)=[{&(0x7f0000000200)=""/4096, 0xfffffe45}], 0x1, &(0x7f0000fb3fa9)=""/87, 0x57}, 0x0) [ 606.324323] net_ratelimit: 18 callbacks suppressed [ 606.324332] protocol 88fb is buggy, dev hsr_slave_0 [ 606.334499] protocol 88fb is buggy, dev hsr_slave_1 [ 606.484326] protocol 88fb is buggy, dev hsr_slave_0 [ 606.489426] protocol 88fb is buggy, dev hsr_slave_1 04:01:32 executing program 0: r0 = perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) setxattr$security_smack_entry(&(0x7f0000000380)='./file0\x00', &(0x7f0000000480)='security.SMACK64IPIN\x00', &(0x7f0000000540)='^vboxnet1^\x00', 0xb, 0x1) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x0, 0x1}, 0x2c) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r1, &(0x7f0000000040), 0x0, 0x1}, 0x20) unlink(&(0x7f0000000900)='./file0/file0\x00') r2 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r3 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r3, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, &(0x7f00000006c0)={0x0}) ioctl$BINDER_GET_NODE_DEBUG_INFO(r2, 0xc018620b, &(0x7f0000000640)={r4}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f00000000c0)=[@enter_looper], 0x48, 0x0, &(0x7f0000000700)="2ba063fb309ec7fdbfb08e6e91baee7d7d4599fe14129a4d426834556ae420e087d59c0c7be7fcad1abb7e1f8f446f373f611ca1ee9c2231708e18a47bc68a2a79a0b48931f6ff6d"}) ioctl$BINDER_SET_CONTEXT_MGR(r3, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x1) prctl$PR_SET_NAME(0xf, &(0x7f00000004c0)='/group.stat\x00') ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, &(0x7f0000000780)}) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f0000000680)}) ioctl$FS_IOC_FIEMAP(r3, 0xc020660b, &(0x7f0000000b80)=ANY=[@ANYBLOB="0000010000000000200000000000000005000000010000000a00000000000000ff030000000000001a0a000000000000050000000000000000000000000000000000000000000000080000000000000000000000000000000800000000000000ffff0000000000000100008000000000000000000000000000000000000000000000000000000000000000000000000008000000000000003f0000000000000008000000000000000000000000000000000000000000800800000000000000000000000000000200000000000000000400000000000000000000010000000000000000000000000000000000000002110000000000000000000000000000cc0000000000000000000000000000001b0000000000000000000000000000000000000000000000841400000000000000000000000000000300000000000000feffffffffffffff000000000000000000000000000000000000000000000000020000000000000000000000000000000600000000000000ff01000000000000040000000000000000000000000000000000000000000000000400000000000000000000000000007be70000000000000900000000000000ff7f0000000000000000000000000000000000000000000004180000000000000000000000000000ffffffff0000000081000000000000000600000000000000000000000000000000000000000000000400000000000000000000000000000002000000000000000500000000000000ff7fffffffffffff0000000000000000000000000000000004040000000000000000000000000000"]) r6 = creat(&(0x7f00000000c0)='./file0\x00', 0x0) openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000100)='/group.stat\x00', 0x2761, 0x0) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000080), 0xffffffffffffffff) getpid() fallocate(r0, 0x0, 0x0, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x2f, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) memfd_create(&(0x7f0000000080)='!proccgroup\x00', 0x0) ioctl$sock_inet_SIOCSIFPFLAGS(0xffffffffffffffff, 0x8934, &(0x7f0000000400)={'veth0_to_bridge\x00', 0x100}) accept(r6, &(0x7f0000000580)=@alg, &(0x7f0000000600)=0x80) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x2400, 0x8000) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000008c0)={0x2c, 0x0, &(0x7f0000000780)=[@acquire_done={0x40106309, r5, 0x2}, @clear_death={0x400c630f, 0x1, 0x3}, @release={0x40046306, 0x2}], 0xc1, 0x0, &(0x7f00000007c0)="859547f83b9b058a973a491d7e6378544744f2b56b02270a2f78214a936e9afb25cd94695643af6563f86771aa9621b9f30f2ca538b018247a633c28ee01e03b4639679311117971e60dc1538f34e961ae301463172c41754be988f6beb0ce4d83c69f86c236d29520e6cdaf5dbb60404c66d63315ff287deac8632781d0197ef1f81314da0a1ed90b681842cf85a41b496ce0a7a6f5aa4b9b23483eea8861be89b3398c6aec3349174f9cdc9de34df361ac9bf7afd8566849487c3c0a1e3aaacd"}) 04:01:32 executing program 2: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000440)=@updpolicy={0xb8, 0x19, 0x523, 0x0, 0x0, {{@in=@multicast2, @in6=@empty={[0x0, 0x0, 0x60000000]}, 0x0, 0x0, 0x0, 0x0, 0xa}}}, 0xb8}}, 0x0) 04:01:32 executing program 1: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) recvmsg(0xffffffffffffffff, &(0x7f00000036c0)={&(0x7f0000000180)=@can, 0xfd28, &(0x7f00000035c0), 0x0, &(0x7f0000003680)=""/41, 0x29}, 0x0) bind$alg(0xffffffffffffffff, &(0x7f0000001300)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb(blowfish)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000ff8000)="0a0775b0", 0x4) r1 = accept$alg(r0, 0x0, 0x0) sendmmsg$alg(r1, &(0x7f0000003e80)=[{0x0, 0x0, &(0x7f0000002a80), 0x167, &(0x7f0000000100)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x0) recvmsg(r1, &(0x7f0000000000)={&(0x7f0000f7ffa8)=@alg, 0x61, &(0x7f0000000140)=[{&(0x7f0000000200)=""/4096, 0xfffffe45}], 0x1, &(0x7f0000fb3fa9)=""/87, 0x57}, 0x0) [ 606.535588] binder: release 21416:21425 transaction 316 out, still active [ 606.564338] protocol 88fb is buggy, dev hsr_slave_0 [ 606.569470] protocol 88fb is buggy, dev hsr_slave_1 [ 606.574658] protocol 88fb is buggy, dev hsr_slave_0 [ 606.579738] protocol 88fb is buggy, dev hsr_slave_1 [ 606.724652] binder: BINDER_SET_CONTEXT_MGR already set [ 606.730122] binder: 21455:21458 ioctl 40046207 0 returned -16 [ 606.737661] binder: 21455:21458 Release 1 refcount change on invalid ref 1 ret -22 [ 606.798820] binder: 21455:21460 BC_ACQUIRE_DONE u0000000000000000 no match [ 606.810071] binder: 21455:21460 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 [ 606.817865] binder: 21455:21460 Release 1 refcount change on invalid ref 2 ret -22 [ 607.464855] binder: release 21455:21458 transaction 319 out, still active [ 607.524412] protocol 88fb is buggy, dev hsr_slave_0 [ 607.529533] protocol 88fb is buggy, dev hsr_slave_1 04:01:34 executing program 3: r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x3) bind$bt_l2cap(r0, &(0x7f0000000040)={0x1f, 0x0, {0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x7}, 0x7}, 0xe) listen(r0, 0x0) getsockopt$XDP_MMAP_OFFSETS(0xffffffffffffffff, 0x11b, 0x1, &(0x7f0000000080), &(0x7f0000000100)=0x60) 04:01:34 executing program 4: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) recvmsg(0xffffffffffffffff, &(0x7f00000036c0)={&(0x7f0000000180)=@can, 0xfd28, &(0x7f00000035c0), 0x0, &(0x7f0000003680)=""/41, 0x29}, 0x0) bind$alg(r0, &(0x7f0000001300)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb(blowfish)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000ff8000)="0a0775b0", 0x4) sendmmsg$alg(0xffffffffffffffff, &(0x7f0000003e80)=[{0x0, 0x0, &(0x7f0000002a80), 0x167, &(0x7f0000000100)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x0) recvmsg(0xffffffffffffffff, &(0x7f0000000000)={&(0x7f0000f7ffa8)=@alg, 0x61, &(0x7f0000000140)=[{&(0x7f0000000200)=""/4096, 0xfffffe45}], 0x1, &(0x7f0000fb3fa9)=""/87, 0x57}, 0x0) 04:01:34 executing program 1: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) recvmsg(0xffffffffffffffff, &(0x7f00000036c0)={&(0x7f0000000180)=@can, 0xfd28, &(0x7f00000035c0), 0x0, &(0x7f0000003680)=""/41, 0x29}, 0x0) bind$alg(0xffffffffffffffff, &(0x7f0000001300)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb(blowfish)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000ff8000)="0a0775b0", 0x4) r1 = accept$alg(r0, 0x0, 0x0) sendmmsg$alg(r1, &(0x7f0000003e80)=[{0x0, 0x0, &(0x7f0000002a80), 0x167, &(0x7f0000000100)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x0) recvmsg(r1, &(0x7f0000000000)={&(0x7f0000f7ffa8)=@alg, 0x61, &(0x7f0000000140)=[{&(0x7f0000000200)=""/4096, 0xfffffe45}], 0x1, &(0x7f0000fb3fa9)=""/87, 0x57}, 0x0) 04:01:34 executing program 2: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000440)=@updpolicy={0xb8, 0x19, 0x523, 0x0, 0x0, {{@in=@multicast2, @in6=@empty={[0x0, 0x0, 0x80ffffff]}, 0x0, 0x0, 0x0, 0x0, 0xa}}}, 0xb8}}, 0x0) 04:01:34 executing program 5: r0 = socket$inet6(0xa, 0x2, 0x0) r1 = syz_open_dev$mice(&(0x7f00000002c0)='/dev/input/mice\x00', 0x0, 0x0) ioctl$PPPOEIOCDFWD(r1, 0xb101, 0x0) syz_genetlink_get_family_id$nbd(&(0x7f0000000480)='nbd\x00') getsockopt$inet6_IPV6_XFRM_POLICY(r0, 0x29, 0x23, &(0x7f0000000340)={{{@in=@local, @in=@loopback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@local}, 0x0, @in=@remote}}, &(0x7f0000000140)=0xe8) connect$can_bcm(0xffffffffffffffff, &(0x7f00000001c0), 0x10) bind$inet6(r0, &(0x7f0000000040)={0xa, 0x4e24}, 0x1c) lsetxattr$security_ima(&(0x7f0000000280)='./file0\x00', &(0x7f0000000440)='security.ima\x00', 0x0, 0x0, 0x1) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clock_gettime(0x0, &(0x7f0000000100)={0x0, 0x0}) r4 = openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) bind(r4, &(0x7f0000000580)=@can={0x1d, r2}, 0x80) clock_gettime(0x3, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff}) ppoll(&(0x7f0000000000)=[{r0, 0x41a, 0x3f00}], 0x1, &(0x7f0000000200)={0x0, r3+30000000}, &(0x7f0000000240), 0x8) connect$inet6(r0, &(0x7f0000000080)={0xa, 0x4e24, 0x0, @ipv4={[], [], @loopback}}, 0x1c) readv(0xffffffffffffffff, 0x0, 0x0) sendmmsg(r0, &(0x7f00000092c0), 0x4ff, 0x0) connect$pptp(r5, &(0x7f00000004c0)={0x18, 0x2, {0x0, @multicast1}}, 0x1e) 04:01:34 executing program 0: r0 = perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) setxattr$security_smack_entry(&(0x7f0000000380)='./file0\x00', &(0x7f0000000480)='security.SMACK64IPIN\x00', &(0x7f0000000540)='^vboxnet1^\x00', 0xb, 0x1) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x3}, 0x2c) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r1, &(0x7f0000000040), 0x0, 0x1}, 0x20) unlink(&(0x7f0000000900)='./file0/file0\x00') r2 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r3 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r3, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, &(0x7f00000006c0)={0x0}) ioctl$BINDER_GET_NODE_DEBUG_INFO(r2, 0xc018620b, &(0x7f0000000640)={r4}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f00000000c0)=[@enter_looper], 0x48, 0x0, &(0x7f0000000700)="2ba063fb309ec7fdbfb08e6e91baee7d7d4599fe14129a4d426834556ae420e087d59c0c7be7fcad1abb7e1f8f446f373f611ca1ee9c2231708e18a47bc68a2a79a0b48931f6ff6d"}) ioctl$BINDER_SET_CONTEXT_MGR(r3, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x1) prctl$PR_SET_NAME(0xf, &(0x7f00000004c0)='/group.stat\x00') ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, &(0x7f0000000780)}) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f0000000680)}) ioctl$FS_IOC_FIEMAP(r3, 0xc020660b, &(0x7f0000000b80)=ANY=[@ANYBLOB="0000010000000000200000000000000005000000010000000a00000000000000ff030000000000001a0a000000000000050000000000000000000000000000000000000000000000080000000000000000000000000000000800000000000000ffff0000000000000100008000000000000000000000000000000000000000000000000000000000000000000000000008000000000000003f0000000000000008000000000000000000000000000000000000000000800800000000000000000000000000000200000000000000000400000000000000000000010000000000000000000000000000000000000002110000000000000000000000000000cc0000000000000000000000000000001b0000000000000000000000000000000000000000000000841400000000000000000000000000000300000000000000feffffffffffffff000000000000000000000000000000000000000000000000020000000000000000000000000000000600000000000000ff01000000000000040000000000000000000000000000000000000000000000000400000000000000000000000000007be70000000000000900000000000000ff7f0000000000000000000000000000000000000000000004180000000000000000000000000000ffffffff0000000081000000000000000600000000000000000000000000000000000000000000000400000000000000000000000000000002000000000000000500000000000000ff7fffffffffffff0000000000000000000000000000000004040000000000000000000000000000"]) r6 = creat(&(0x7f00000000c0)='./file0\x00', 0x0) openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000100)='/group.stat\x00', 0x2761, 0x0) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000080), 0xffffffffffffffff) getpid() fallocate(r0, 0x0, 0x0, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x2f, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) memfd_create(&(0x7f0000000080)='!proccgroup\x00', 0x0) ioctl$sock_inet_SIOCSIFPFLAGS(0xffffffffffffffff, 0x8934, &(0x7f0000000400)={'veth0_to_bridge\x00', 0x100}) accept(r6, &(0x7f0000000580)=@alg, &(0x7f0000000600)=0x80) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x2400, 0x8000) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000008c0)={0x2c, 0x0, &(0x7f0000000780)=[@acquire_done={0x40106309, r5, 0x2}, @clear_death={0x400c630f, 0x1, 0x3}, @release={0x40046306, 0x2}], 0xc1, 0x0, &(0x7f00000007c0)="859547f83b9b058a973a491d7e6378544744f2b56b02270a2f78214a936e9afb25cd94695643af6563f86771aa9621b9f30f2ca538b018247a633c28ee01e03b4639679311117971e60dc1538f34e961ae301463172c41754be988f6beb0ce4d83c69f86c236d29520e6cdaf5dbb60404c66d63315ff287deac8632781d0197ef1f81314da0a1ed90b681842cf85a41b496ce0a7a6f5aa4b9b23483eea8861be89b3398c6aec3349174f9cdc9de34df361ac9bf7afd8566849487c3c0a1e3aaacd"}) 04:01:34 executing program 2: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000440)=@updpolicy={0xb8, 0x19, 0x523, 0x0, 0x0, {{@in=@multicast2, @in6=@empty={[0x0, 0x0, 0x9effffff]}, 0x0, 0x0, 0x0, 0x0, 0xa}}}, 0xb8}}, 0x0) 04:01:34 executing program 4: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) recvmsg(0xffffffffffffffff, &(0x7f00000036c0)={&(0x7f0000000180)=@can, 0xfd28, &(0x7f00000035c0), 0x0, &(0x7f0000003680)=""/41, 0x29}, 0x0) bind$alg(r0, &(0x7f0000001300)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb(blowfish)\x00'}, 0x58) r1 = accept$alg(r0, 0x0, 0x0) sendmmsg$alg(r1, &(0x7f0000003e80)=[{0x0, 0x0, &(0x7f0000002a80), 0x167, &(0x7f0000000100)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x0) recvmsg(r1, &(0x7f0000000000)={&(0x7f0000f7ffa8)=@alg, 0x61, &(0x7f0000000140)=[{&(0x7f0000000200)=""/4096, 0xfffffe45}], 0x1, &(0x7f0000fb3fa9)=""/87, 0x57}, 0x0) 04:01:34 executing program 1: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) recvmsg(0xffffffffffffffff, &(0x7f00000036c0)={&(0x7f0000000180)=@can, 0xfd28, &(0x7f00000035c0), 0x0, &(0x7f0000003680)=""/41, 0x29}, 0x0) bind$alg(r0, 0x0, 0x0) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000ff8000)="0a0775b0", 0x4) r1 = accept$alg(r0, 0x0, 0x0) sendmmsg$alg(r1, &(0x7f0000003e80)=[{0x0, 0x0, &(0x7f0000002a80), 0x167, &(0x7f0000000100)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x0) recvmsg(r1, &(0x7f0000000000)={&(0x7f0000f7ffa8)=@alg, 0x61, &(0x7f0000000140)=[{&(0x7f0000000200)=""/4096, 0xfffffe45}], 0x1, &(0x7f0000fb3fa9)=""/87, 0x57}, 0x0) [ 608.850745] binder: BINDER_SET_CONTEXT_MGR already set 04:01:34 executing program 3: r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x4, 0x3) bind$bt_l2cap(r0, &(0x7f0000000040), 0xe) listen(r0, 0x7fff) [ 608.876770] binder: 21468:21479 ioctl 40046207 0 returned -16 [ 608.915598] binder: 21468:21479 Release 1 refcount change on invalid ref 1 ret -22 04:01:34 executing program 2: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000440)=@updpolicy={0xb8, 0x19, 0x523, 0x0, 0x0, {{@in=@multicast2, @in6=@empty={[0x0, 0x0, 0xf0ffffff]}, 0x0, 0x0, 0x0, 0x0, 0xa}}}, 0xb8}}, 0x0) 04:01:34 executing program 4: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) recvmsg(0xffffffffffffffff, &(0x7f00000036c0)={&(0x7f0000000180)=@can, 0xfd28, &(0x7f00000035c0), 0x0, &(0x7f0000003680)=""/41, 0x29}, 0x0) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000ff8000)="0a0775b0", 0x4) r1 = accept$alg(r0, 0x0, 0x0) sendmmsg$alg(r1, &(0x7f0000003e80)=[{0x0, 0x0, &(0x7f0000002a80), 0x167, &(0x7f0000000100)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x0) recvmsg(r1, &(0x7f0000000000)={&(0x7f0000f7ffa8)=@alg, 0x61, &(0x7f0000000140)=[{&(0x7f0000000200)=""/4096, 0xfffffe45}], 0x1, &(0x7f0000fb3fa9)=""/87, 0x57}, 0x0) 04:01:34 executing program 1: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) recvmsg(0xffffffffffffffff, &(0x7f00000036c0)={&(0x7f0000000180)=@can, 0xfd28, &(0x7f00000035c0), 0x0, &(0x7f0000003680)=""/41, 0x29}, 0x0) bind$alg(r0, 0x0, 0x0) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000ff8000)="0a0775b0", 0x4) r1 = accept$alg(r0, 0x0, 0x0) sendmmsg$alg(r1, &(0x7f0000003e80)=[{0x0, 0x0, &(0x7f0000002a80), 0x167, &(0x7f0000000100)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x0) recvmsg(r1, &(0x7f0000000000)={&(0x7f0000f7ffa8)=@alg, 0x61, &(0x7f0000000140)=[{&(0x7f0000000200)=""/4096, 0xfffffe45}], 0x1, &(0x7f0000fb3fa9)=""/87, 0x57}, 0x0) 04:01:34 executing program 3: r0 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-monitor\x00', 0x103400, 0x0) ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0) setsockopt$TIPC_MCAST_REPLICAST(r0, 0x10f, 0x86) r1 = syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x3) bind$bt_l2cap(r1, &(0x7f0000000040), 0xe) listen(r1, 0x0) [ 609.055898] binder: 21468:21485 BC_ACQUIRE_DONE u0000000000000000 no match [ 609.062969] binder: 21468:21485 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 04:01:34 executing program 2: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000440)=@updpolicy={0xb8, 0x19, 0x523, 0x0, 0x0, {{@in=@multicast2, @in6=@empty={[0x0, 0x0, 0xfcffffff]}, 0x0, 0x0, 0x0, 0x0, 0xa}}}, 0xb8}}, 0x0) [ 609.136739] binder: 21468:21485 Release 1 refcount change on invalid ref 2 ret -22 04:01:34 executing program 3: r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x5, 0x3) bind$bt_l2cap(r0, &(0x7f0000000040), 0xe) listen(r0, 0x0) r1 = accept4$inet6(0xffffffffffffffff, &(0x7f0000000000), &(0x7f0000000080)=0x1c, 0x80000) getsockopt$inet_sctp_SCTP_LOCAL_AUTH_CHUNKS(0xffffffffffffffff, 0x84, 0x1b, &(0x7f00000000c0)={0x0, 0x3e, "2fc3842d15e4464c7484cdde63cab0d549317a8cf73a857baf60ded0ff7f4436ee4ffd5d02450d9017b1671892cd6048fc509a87402cbf98eb775c6ae659"}, &(0x7f0000000140)=0x46) setsockopt$inet_sctp6_SCTP_SET_PEER_PRIMARY_ADDR(r1, 0x84, 0x5, &(0x7f0000000180)={r2, @in6={{0xa, 0x4e23, 0x3, @mcast1, 0x7ff}}}, 0x84) r3 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ubi_ctrl\x00', 0x400000, 0x0) ioctl$sock_bt_bnep_BNEPGETSUPPFEAT(r3, 0x800442d4, &(0x7f0000000280)=0x8) 04:01:35 executing program 5: r0 = socket$inet6(0xa, 0x2, 0x0) r1 = syz_open_dev$mice(&(0x7f00000002c0)='/dev/input/mice\x00', 0x0, 0x0) ioctl$PPPOEIOCDFWD(r1, 0xb101, 0x0) syz_genetlink_get_family_id$nbd(&(0x7f0000000480)='nbd\x00') getsockopt$inet6_IPV6_XFRM_POLICY(r0, 0x29, 0x23, &(0x7f0000000340)={{{@in=@local, @in=@loopback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@local}, 0x0, @in=@remote}}, &(0x7f0000000140)=0xe8) connect$can_bcm(0xffffffffffffffff, &(0x7f00000001c0), 0x10) bind$inet6(r0, &(0x7f0000000040)={0xa, 0x4e24}, 0x1c) lsetxattr$security_ima(&(0x7f0000000280)='./file0\x00', &(0x7f0000000440)='security.ima\x00', 0x0, 0x0, 0x1) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clock_gettime(0x0, &(0x7f0000000100)={0x0, 0x0}) r4 = openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) bind(r4, &(0x7f0000000580)=@can={0x1d, r2}, 0x80) clock_gettime(0x3, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff}) ppoll(&(0x7f0000000000)=[{r0, 0x41a, 0x5902}], 0x1, &(0x7f0000000200)={0x0, r3+30000000}, &(0x7f0000000240), 0x8) connect$inet6(r0, &(0x7f0000000080)={0xa, 0x4e24, 0x0, @ipv4={[], [], @loopback}}, 0x1c) readv(0xffffffffffffffff, 0x0, 0x0) sendmmsg(r0, &(0x7f00000092c0), 0x4ff, 0x0) connect$pptp(r5, &(0x7f00000004c0)={0x18, 0x2, {0x0, @multicast1}}, 0x1e) 04:01:35 executing program 4: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) recvmsg(0xffffffffffffffff, &(0x7f00000036c0)={&(0x7f0000000180)=@can, 0xfd28, &(0x7f00000035c0), 0x0, &(0x7f0000003680)=""/41, 0x29}, 0x0) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000ff8000)="0a0775b0", 0x4) r1 = accept$alg(r0, 0x0, 0x0) sendmmsg$alg(r1, &(0x7f0000003e80)=[{0x0, 0x0, &(0x7f0000002a80), 0x167, &(0x7f0000000100)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x0) recvmsg(r1, &(0x7f0000000000)={&(0x7f0000f7ffa8)=@alg, 0x61, &(0x7f0000000140)=[{&(0x7f0000000200)=""/4096, 0xfffffe45}], 0x1, &(0x7f0000fb3fa9)=""/87, 0x57}, 0x0) 04:01:35 executing program 1: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) recvmsg(0xffffffffffffffff, &(0x7f00000036c0)={&(0x7f0000000180)=@can, 0xfd28, &(0x7f00000035c0), 0x0, &(0x7f0000003680)=""/41, 0x29}, 0x0) bind$alg(r0, &(0x7f0000001300)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb(blowfish)\x00'}, 0x58) setsockopt$ALG_SET_KEY(0xffffffffffffffff, 0x117, 0x1, &(0x7f0000ff8000)="0a0775b0", 0x4) r1 = accept$alg(r0, 0x0, 0x0) sendmmsg$alg(r1, &(0x7f0000003e80)=[{0x0, 0x0, &(0x7f0000002a80), 0x167, &(0x7f0000000100)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x0) recvmsg(r1, &(0x7f0000000000)={&(0x7f0000f7ffa8)=@alg, 0x61, &(0x7f0000000140)=[{&(0x7f0000000200)=""/4096, 0xfffffe45}], 0x1, &(0x7f0000fb3fa9)=""/87, 0x57}, 0x0) [ 609.574952] binder: release 21468:21479 transaction 322 out, still active 04:01:35 executing program 2: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000440)=@updpolicy={0xb8, 0x19, 0x523, 0x0, 0x0, {{@in=@multicast2, @in6=@empty={[0x0, 0x0, 0xfffff000]}, 0x0, 0x0, 0x0, 0x0, 0xa}}}, 0xb8}}, 0x0) 04:01:35 executing program 3: r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x3) bind$bt_l2cap(r0, &(0x7f0000000040), 0xe) r1 = socket(0x5, 0x6, 0x0) ioctl$SIOCRSSL2CALL(r1, 0x89e2, &(0x7f00000001c0)=@rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}) listen(r0, 0x0) ioctl$FS_IOC_GETFSLABEL(r0, 0x81009431, &(0x7f00000000c0)) r2 = openat$proc_capi20ncci(0xffffffffffffff9c, &(0x7f0000000000)='/proc/capi/capi20ncci\x00', 0x80000, 0x0) ioctl$KDSETKEYCODE(r2, 0x4b4d, &(0x7f0000000200)={0x3f, 0x1}) ioctl$KVM_S390_VCPU_FAULT(r2, 0x4008ae52, &(0x7f0000000080)=0xffff) 04:01:35 executing program 0: r0 = perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) setxattr$security_smack_entry(&(0x7f0000000380)='./file0\x00', &(0x7f0000000480)='security.SMACK64IPIN\x00', &(0x7f0000000540)='^vboxnet1^\x00', 0xb, 0x1) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x3}, 0x2c) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r1, &(0x7f0000000040), 0x0, 0x1}, 0x20) unlink(&(0x7f0000000900)='./file0/file0\x00') r2 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r3 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r3, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, &(0x7f00000006c0)={0x0}) ioctl$BINDER_GET_NODE_DEBUG_INFO(r2, 0xc018620b, &(0x7f0000000640)={r4}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f00000000c0)=[@enter_looper], 0x48, 0x0, &(0x7f0000000700)="2ba063fb309ec7fdbfb08e6e91baee7d7d4599fe14129a4d426834556ae420e087d59c0c7be7fcad1abb7e1f8f446f373f611ca1ee9c2231708e18a47bc68a2a79a0b48931f6ff6d"}) ioctl$BINDER_SET_CONTEXT_MGR(r3, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x1) prctl$PR_SET_NAME(0xf, &(0x7f00000004c0)='/group.stat\x00') ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, &(0x7f0000000780)}) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f0000000680)}) ioctl$FS_IOC_FIEMAP(r3, 0xc020660b, &(0x7f0000000b80)=ANY=[@ANYBLOB="0000010000000000200000000000000005000000010000000a00000000000000ff030000000000001a0a000000000000050000000000000000000000000000000000000000000000080000000000000000000000000000000800000000000000ffff0000000000000100008000000000000000000000000000000000000000000000000000000000000000000000000008000000000000003f0000000000000008000000000000000000000000000000000000000000800800000000000000000000000000000200000000000000000400000000000000000000010000000000000000000000000000000000000002110000000000000000000000000000cc0000000000000000000000000000001b0000000000000000000000000000000000000000000000841400000000000000000000000000000300000000000000feffffffffffffff000000000000000000000000000000000000000000000000020000000000000000000000000000000600000000000000ff01000000000000040000000000000000000000000000000000000000000000000400000000000000000000000000007be70000000000000900000000000000ff7f0000000000000000000000000000000000000000000004180000000000000000000000000000ffffffff0000000081000000000000000600000000000000000000000000000000000000000000000400000000000000000000000000000002000000000000000500000000000000ff7fffffffffffff0000000000000000000000000000000004040000000000000000000000000000"]) r6 = creat(&(0x7f00000000c0)='./file0\x00', 0x0) openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000100)='/group.stat\x00', 0x2761, 0x0) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000080), 0xffffffffffffffff) getpid() fallocate(r0, 0x0, 0x0, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x2f, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) memfd_create(&(0x7f0000000080)='!proccgroup\x00', 0x0) ioctl$sock_inet_SIOCSIFPFLAGS(0xffffffffffffffff, 0x8934, &(0x7f0000000400)={'veth0_to_bridge\x00', 0x100}) accept(r6, &(0x7f0000000580)=@alg, &(0x7f0000000600)=0x80) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x2400, 0x8000) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000008c0)={0x2c, 0x0, &(0x7f0000000780)=[@acquire_done={0x40106309, r5, 0x2}, @clear_death={0x400c630f, 0x1, 0x3}, @release={0x40046306, 0x2}], 0xc1, 0x0, &(0x7f00000007c0)="859547f83b9b058a973a491d7e6378544744f2b56b02270a2f78214a936e9afb25cd94695643af6563f86771aa9621b9f30f2ca538b018247a633c28ee01e03b4639679311117971e60dc1538f34e961ae301463172c41754be988f6beb0ce4d83c69f86c236d29520e6cdaf5dbb60404c66d63315ff287deac8632781d0197ef1f81314da0a1ed90b681842cf85a41b496ce0a7a6f5aa4b9b23483eea8861be89b3398c6aec3349174f9cdc9de34df361ac9bf7afd8566849487c3c0a1e3aaacd"}) 04:01:35 executing program 2: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000440)=@updpolicy={0xb8, 0x19, 0x523, 0x0, 0x0, {{@in=@multicast2, @in6=@empty={[0x0, 0x0, 0xffffff7f]}, 0x0, 0x0, 0x0, 0x0, 0xa}}}, 0xb8}}, 0x0) 04:01:35 executing program 1: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) recvmsg(0xffffffffffffffff, &(0x7f00000036c0)={&(0x7f0000000180)=@can, 0xfd28, &(0x7f00000035c0), 0x0, &(0x7f0000003680)=""/41, 0x29}, 0x0) bind$alg(r0, &(0x7f0000001300)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb(blowfish)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, 0x0, 0x0) r1 = accept$alg(r0, 0x0, 0x0) sendmmsg$alg(r1, &(0x7f0000003e80)=[{0x0, 0x0, &(0x7f0000002a80), 0x167, &(0x7f0000000100)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x0) recvmsg(r1, &(0x7f0000000000)={&(0x7f0000f7ffa8)=@alg, 0x61, &(0x7f0000000140)=[{&(0x7f0000000200)=""/4096, 0xfffffe45}], 0x1, &(0x7f0000fb3fa9)=""/87, 0x57}, 0x0) 04:01:35 executing program 4: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000001300)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb(blowfish)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000ff8000)="0a0775b0", 0x4) r1 = accept$alg(r0, 0x0, 0x0) sendmmsg$alg(r1, &(0x7f0000003e80)=[{0x0, 0x0, &(0x7f0000002a80), 0x167, &(0x7f0000000100)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x0) recvmsg(r1, &(0x7f0000000000)={&(0x7f0000f7ffa8)=@alg, 0x61, &(0x7f0000000140)=[{&(0x7f0000000200)=""/4096, 0xfffffe45}], 0x1, &(0x7f0000fb3fa9)=""/87, 0x57}, 0x0) [ 609.782543] binder: BINDER_SET_CONTEXT_MGR already set [ 609.802182] binder: 21515:21532 ioctl 40046207 0 returned -16 [ 609.840088] binder: 21515:21532 Release 1 refcount change on invalid ref 1 ret -22 04:01:35 executing program 3: r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x3) prctl$PR_SET_MM_EXE_FILE(0x23, 0xd, r0) bind$bt_l2cap(r0, &(0x7f0000000040), 0xffffff4a) ioctl$sock_SIOCGIFCONF(r0, 0x8912, &(0x7f00000002c0)=@req={0x28, &(0x7f0000000240)={'bpq0\x00', @ifru_map={0x5, 0x2, 0xf68, 0x101, 0x6000000}}}) r1 = openat(0xffffffffffffffff, &(0x7f0000000000)='./file0\x00', 0x383801, 0x8) sendmsg$rds(r1, &(0x7f0000000280)={&(0x7f0000000080)={0x2, 0x4e21, @broadcast}, 0x10, &(0x7f0000000200)=[{&(0x7f00000000c0)=""/59, 0x3b}, {&(0x7f0000000100)=""/234, 0xea}], 0x2, &(0x7f0000000240), 0x0, 0x24008804}, 0x40) write$binfmt_misc(r1, &(0x7f00000007c0)=ANY=[@ANYPTR=&(0x7f0000000740)=ANY=[@ANYRESOCT=r1, @ANYRES16, @ANYRES32=r0, @ANYPTR64=&(0x7f0000000600)=ANY=[@ANYRES64, @ANYPTR64, @ANYRESDEC=r1, @ANYRES32, @ANYBLOB="f1508ec563a5ded51dfc6cc22c6db3cdab61e01088ad39e3a10b3936fda45a2a54d3f6f1afd69e8da4ee998274fea5eb9ff42fdd79d5957631a5495f3efb3aa3f071a53eceb3ac6b45b74839f114e68f414a17d93adf9e9292e0b19d757d7fb9506c1ab96151269279fd5ad3f03f4a826ab3c0005f6174e443358a32d64633a77378d9ee40368a2835f7b73e9447496c5ec4ec16a44ce43302a776a60aa3336273fc6df3f04dcc5ab4921938fd112821280d271e17ec1c7df29bff121f57ac564d3d2f6bbb54789ddf8c87e7aa8b97cb5548b418fbac9ce87cd5b077b478181dcd6e80effb770d6e153a5bfa55cb999d53372b51c04736a650f4", @ANYRESHEX=r0], @ANYRESHEX=r0, @ANYRES64=r1, @ANYBLOB="b80f2504c5e54a8be2ac43bcb01a4795c650ec243c65a5672a403d7031b40a2f055c"]], 0x8) listen(r0, 0x0) ioctl$UI_END_FF_UPLOAD(r1, 0x406855c9, &(0x7f0000000580)={0x2, 0x3, {0x52, 0x1, 0x9, {0x3ff, 0x7f}, {0x1, 0xd1}, @period={0x0, 0x3450, 0x80, 0x83, 0x1, {0x0, 0x1, 0xfffffffffffff5b0, 0x7}, 0x4, &(0x7f0000000300)=[0x40, 0x12000000000000, 0x80000000, 0xfffffffffffffff7]}}, {0x57, 0x0, 0x9, {0x7, 0x8}, {0x8, 0x772}, @ramp={0x677, 0x80000000, {0x5, 0x2, 0x100000000, 0x9}}}}) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000000540)={0x0}, &(0x7f0000000340)=0x5e) ioctl$SNDRV_CTL_IOCTL_ELEM_ADD(r1, 0xc1105517, &(0x7f00000003c0)={{0x4, 0x7, 0x1, 0xedbe, '\x00', 0x842f}, 0x1, 0x122, 0x9, r2, 0x3, 0x1, 'syz0\x00', &(0x7f0000000380)=['\x00', '\x00', ',em1trustedposix_acl_access\x00'], 0x1e, [], [0x800, 0x7, 0x80000000, 0x1ff]}) 04:01:35 executing program 2: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000440)=@updpolicy={0xb8, 0x19, 0x523, 0x0, 0x0, {{@in=@multicast2, @in6=@empty={[0x0, 0x0, 0xffffff80]}, 0x0, 0x0, 0x0, 0x0, 0xa}}}, 0xb8}}, 0x0) [ 609.902530] binder: 21515:21542 BC_ACQUIRE_DONE u0000000000000000 no match [ 609.931917] binder: 21515:21542 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 04:01:35 executing program 4: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) recvmsg(0xffffffffffffffff, &(0x7f00000036c0)={&(0x7f0000000180)=@can, 0xfd28, &(0x7f00000035c0), 0x0, &(0x7f0000003680)=""/41, 0x29}, 0x0) bind$alg(0xffffffffffffffff, &(0x7f0000001300)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb(blowfish)\x00'}, 0x58) setsockopt$ALG_SET_KEY(0xffffffffffffffff, 0x117, 0x1, &(0x7f0000ff8000)="0a0775b0", 0x4) r0 = accept$alg(0xffffffffffffffff, 0x0, 0x0) sendmmsg$alg(r0, &(0x7f0000003e80)=[{0x0, 0x0, &(0x7f0000002a80), 0x167, &(0x7f0000000100)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x0) recvmsg(r0, &(0x7f0000000000)={&(0x7f0000f7ffa8)=@alg, 0x61, &(0x7f0000000140)=[{&(0x7f0000000200)=""/4096, 0xfffffe45}], 0x1, &(0x7f0000fb3fa9)=""/87, 0x57}, 0x0) [ 609.973559] binder: 21515:21542 Release 1 refcount change on invalid ref 2 ret -22 04:01:36 executing program 5: r0 = socket$inet6(0xa, 0x2, 0x0) r1 = syz_open_dev$mice(&(0x7f00000002c0)='/dev/input/mice\x00', 0x0, 0x0) ioctl$PPPOEIOCDFWD(r1, 0xb101, 0x0) syz_genetlink_get_family_id$nbd(&(0x7f0000000480)='nbd\x00') getsockopt$inet6_IPV6_XFRM_POLICY(r0, 0x29, 0x23, &(0x7f0000000340)={{{@in=@local, @in=@loopback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@local}, 0x0, @in=@remote}}, &(0x7f0000000140)=0xe8) connect$can_bcm(0xffffffffffffffff, &(0x7f00000001c0), 0x10) bind$inet6(r0, &(0x7f0000000040)={0xa, 0x4e24}, 0x1c) lsetxattr$security_ima(&(0x7f0000000280)='./file0\x00', &(0x7f0000000440)='security.ima\x00', 0x0, 0x0, 0x1) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clock_gettime(0x0, &(0x7f0000000100)={0x0, 0x0}) r4 = openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) bind(r4, &(0x7f0000000580)=@can={0x1d, r2}, 0x80) clock_gettime(0x3, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff}) ppoll(&(0x7f0000000000)=[{r0, 0x41a, 0x6400}], 0x1, &(0x7f0000000200)={0x0, r3+30000000}, &(0x7f0000000240), 0x8) connect$inet6(r0, &(0x7f0000000080)={0xa, 0x4e24, 0x0, @ipv4={[], [], @loopback}}, 0x1c) readv(0xffffffffffffffff, 0x0, 0x0) sendmmsg(r0, &(0x7f00000092c0), 0x4ff, 0x0) connect$pptp(r5, &(0x7f00000004c0)={0x18, 0x2, {0x0, @multicast1}}, 0x1e) 04:01:36 executing program 1: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) recvmsg(0xffffffffffffffff, &(0x7f00000036c0)={&(0x7f0000000180)=@can, 0xfd28, &(0x7f00000035c0), 0x0, &(0x7f0000003680)=""/41, 0x29}, 0x0) bind$alg(r0, &(0x7f0000001300)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb(blowfish)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000ff8000), 0x0) r1 = accept$alg(r0, 0x0, 0x0) sendmmsg$alg(r1, &(0x7f0000003e80)=[{0x0, 0x0, &(0x7f0000002a80), 0x167, &(0x7f0000000100)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x0) recvmsg(r1, &(0x7f0000000000)={&(0x7f0000f7ffa8)=@alg, 0x61, &(0x7f0000000140)=[{&(0x7f0000000200)=""/4096, 0xfffffe45}], 0x1, &(0x7f0000fb3fa9)=""/87, 0x57}, 0x0) 04:01:36 executing program 3: bpf$BPF_BTF_LOAD(0x12, &(0x7f00000022c0)={&(0x7f0000002300)=ANY=[@ANYBLOB="9feb010018"], 0x0, 0x5}, 0x20) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000100)="0af51f023c123f3188a070") bpf$BPF_BTF_LOAD(0x12, &(0x7f0000001240)={&(0x7f0000001100)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x5c, 0x74, 0x85ee, {"9e412ad1632037c60f194e5c020045c317f5d2ab67dbcde0746788141cc9634985d838c00d1352d3d0fb12991d25dbd655ebc6d14948610b52deac16052f04595251ae74c290f65f4c9b9dbbd8934d712cf81fa6988becb2464eb0"}}, {0x0, "7c2a7048818c9c96b5a9f961b91ae2a38de1db5cdb00f35bb63b5647316967b366465ec041d68b133a9a0760b32d9e62b06c62cba33858cbd88b049ab470b2ed74da9ea3be675a932f955acd6a8f68ef74fbb084b3d2cf7b28f49ff8ad9a3a26a4b0757041a74820c082167741e861162d2730c4611c3653db32078b7f8584e42f4753bf3c7b30b54fb2bfedc6afd92be966207f3735f5d4"}}, &(0x7f0000000040)=""/151, 0x10e, 0x97}, 0x20) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000000)={&(0x7f0000002300)=ANY=[], &(0x7f0000000100)=""/4096, 0x14e147, 0x1000, 0x1}, 0x20) 04:01:36 executing program 2: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000440)=@updpolicy={0xb8, 0x19, 0x523, 0x0, 0x0, {{@in=@multicast2, @in6=@empty={[0x0, 0x0, 0xffffff9e]}, 0x0, 0x0, 0x0, 0x0, 0xa}}}, 0xb8}}, 0x0) 04:01:36 executing program 4: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) recvmsg(0xffffffffffffffff, &(0x7f00000036c0)={&(0x7f0000000180)=@can, 0xfd28, &(0x7f00000035c0), 0x0, &(0x7f0000003680)=""/41, 0x29}, 0x0) bind$alg(0xffffffffffffffff, &(0x7f0000001300)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb(blowfish)\x00'}, 0x58) setsockopt$ALG_SET_KEY(0xffffffffffffffff, 0x117, 0x1, &(0x7f0000ff8000)="0a0775b0", 0x4) r0 = accept$alg(0xffffffffffffffff, 0x0, 0x0) sendmmsg$alg(r0, &(0x7f0000003e80)=[{0x0, 0x0, &(0x7f0000002a80), 0x167, &(0x7f0000000100)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x0) recvmsg(r0, &(0x7f0000000000)={&(0x7f0000f7ffa8)=@alg, 0x61, &(0x7f0000000140)=[{&(0x7f0000000200)=""/4096, 0xfffffe45}], 0x1, &(0x7f0000fb3fa9)=""/87, 0x57}, 0x0) 04:01:36 executing program 0: r0 = perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) setxattr$security_smack_entry(&(0x7f0000000380)='./file0\x00', &(0x7f0000000480)='security.SMACK64IPIN\x00', &(0x7f0000000540)='^vboxnet1^\x00', 0xb, 0x1) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x3}, 0x2c) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r1, &(0x7f0000000040), 0x0, 0x1}, 0x20) unlink(&(0x7f0000000900)='./file0/file0\x00') r2 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r3 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r3, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, &(0x7f00000006c0)={0x0}) ioctl$BINDER_GET_NODE_DEBUG_INFO(r2, 0xc018620b, &(0x7f0000000640)={r4}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f00000000c0)=[@enter_looper], 0x48, 0x0, &(0x7f0000000700)="2ba063fb309ec7fdbfb08e6e91baee7d7d4599fe14129a4d426834556ae420e087d59c0c7be7fcad1abb7e1f8f446f373f611ca1ee9c2231708e18a47bc68a2a79a0b48931f6ff6d"}) ioctl$BINDER_SET_CONTEXT_MGR(r3, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x1) prctl$PR_SET_NAME(0xf, &(0x7f00000004c0)='/group.stat\x00') ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, &(0x7f0000000780)}) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f0000000680)}) ioctl$FS_IOC_FIEMAP(r3, 0xc020660b, &(0x7f0000000b80)=ANY=[@ANYBLOB="0000010000000000200000000000000005000000010000000a00000000000000ff030000000000001a0a000000000000050000000000000000000000000000000000000000000000080000000000000000000000000000000800000000000000ffff0000000000000100008000000000000000000000000000000000000000000000000000000000000000000000000008000000000000003f0000000000000008000000000000000000000000000000000000000000800800000000000000000000000000000200000000000000000400000000000000000000010000000000000000000000000000000000000002110000000000000000000000000000cc0000000000000000000000000000001b0000000000000000000000000000000000000000000000841400000000000000000000000000000300000000000000feffffffffffffff000000000000000000000000000000000000000000000000020000000000000000000000000000000600000000000000ff01000000000000040000000000000000000000000000000000000000000000000400000000000000000000000000007be70000000000000900000000000000ff7f0000000000000000000000000000000000000000000004180000000000000000000000000000ffffffff0000000081000000000000000600000000000000000000000000000000000000000000000400000000000000000000000000000002000000000000000500000000000000ff7fffffffffffff0000000000000000000000000000000004040000000000000000000000000000"]) r6 = creat(&(0x7f00000000c0)='./file0\x00', 0x0) openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000100)='/group.stat\x00', 0x2761, 0x0) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000080), 0xffffffffffffffff) getpid() fallocate(r0, 0x0, 0x0, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x2f, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) memfd_create(&(0x7f0000000080)='!proccgroup\x00', 0x0) ioctl$sock_inet_SIOCSIFPFLAGS(0xffffffffffffffff, 0x8934, &(0x7f0000000400)={'veth0_to_bridge\x00', 0x100}) accept(r6, &(0x7f0000000580)=@alg, &(0x7f0000000600)=0x80) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x2400, 0x8000) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000008c0)={0x2c, 0x0, &(0x7f0000000780)=[@acquire_done={0x40106309, r5, 0x2}, @clear_death={0x400c630f, 0x1, 0x3}, @release={0x40046306, 0x2}], 0xc1, 0x0, &(0x7f00000007c0)="859547f83b9b058a973a491d7e6378544744f2b56b02270a2f78214a936e9afb25cd94695643af6563f86771aa9621b9f30f2ca538b018247a633c28ee01e03b4639679311117971e60dc1538f34e961ae301463172c41754be988f6beb0ce4d83c69f86c236d29520e6cdaf5dbb60404c66d63315ff287deac8632781d0197ef1f81314da0a1ed90b681842cf85a41b496ce0a7a6f5aa4b9b23483eea8861be89b3398c6aec3349174f9cdc9de34df361ac9bf7afd8566849487c3c0a1e3aaacd"}) [ 610.484619] binder: release 21515:21532 transaction 325 out, still active 04:01:36 executing program 1: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) recvmsg(0xffffffffffffffff, &(0x7f00000036c0)={&(0x7f0000000180)=@can, 0xfd28, &(0x7f00000035c0), 0x0, &(0x7f0000003680)=""/41, 0x29}, 0x0) bind$alg(r0, &(0x7f0000001300)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb(blowfish)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000ff8000)='\n\a', 0x2) r1 = accept$alg(r0, 0x0, 0x0) sendmmsg$alg(r1, &(0x7f0000003e80)=[{0x0, 0x0, &(0x7f0000002a80), 0x167, &(0x7f0000000100)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x0) recvmsg(r1, &(0x7f0000000000)={&(0x7f0000f7ffa8)=@alg, 0x61, &(0x7f0000000140)=[{&(0x7f0000000200)=""/4096, 0xfffffe45}], 0x1, &(0x7f0000fb3fa9)=""/87, 0x57}, 0x0) 04:01:36 executing program 2: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000440)=@updpolicy={0xb8, 0x19, 0x523, 0x0, 0x0, {{@in=@multicast2, @in6=@empty={[0x0, 0x0, 0xfffffff0]}, 0x0, 0x0, 0x0, 0x0, 0xa}}}, 0xb8}}, 0x0) 04:01:36 executing program 4: r0 = socket$alg(0x26, 0x5, 0x0) recvmsg(0xffffffffffffffff, &(0x7f00000036c0)={&(0x7f0000000180)=@can, 0xfd28, &(0x7f00000035c0), 0x0, &(0x7f0000003680)=""/41, 0x29}, 0x0) bind$alg(r0, &(0x7f0000001300)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb(blowfish)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000ff8000)="0a0775b0", 0x4) r1 = accept$alg(r0, 0x0, 0x0) sendmmsg$alg(r1, &(0x7f0000003e80)=[{0x0, 0x0, &(0x7f0000002a80), 0x167, &(0x7f0000000100)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x0) recvmsg(r1, &(0x7f0000000000)={&(0x7f0000f7ffa8)=@alg, 0x61, &(0x7f0000000140)=[{&(0x7f0000000200)=""/4096, 0xfffffe45}], 0x1, &(0x7f0000fb3fa9)=""/87, 0x57}, 0x0) 04:01:36 executing program 3: open(&(0x7f0000000040)='./file0\x00', 0x0, 0x9) r0 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000080)='/dev/snapshot\x00', 0x80002, 0x0) ioctl$VHOST_SET_VRING_KICK(r0, 0x3305, 0x0) [ 610.704869] binder: BINDER_SET_CONTEXT_MGR already set [ 610.718831] binder: 21563:21575 ioctl 40046207 0 returned -16 [ 610.756102] binder: 21563:21575 Release 1 refcount change on invalid ref 1 ret -22 04:01:36 executing program 1: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) recvmsg(0xffffffffffffffff, &(0x7f00000036c0)={&(0x7f0000000180)=@can, 0xfd28, &(0x7f00000035c0), 0x0, &(0x7f0000003680)=""/41, 0x29}, 0x0) bind$alg(r0, &(0x7f0000001300)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb(blowfish)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000ff8000)='\n\au', 0x3) r1 = accept$alg(r0, 0x0, 0x0) sendmmsg$alg(r1, &(0x7f0000003e80)=[{0x0, 0x0, &(0x7f0000002a80), 0x167, &(0x7f0000000100)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x0) recvmsg(r1, &(0x7f0000000000)={&(0x7f0000f7ffa8)=@alg, 0x61, &(0x7f0000000140)=[{&(0x7f0000000200)=""/4096, 0xfffffe45}], 0x1, &(0x7f0000fb3fa9)=""/87, 0x57}, 0x0) 04:01:36 executing program 2: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000440)=@updpolicy={0xb8, 0x19, 0x523, 0x0, 0x0, {{@in=@multicast2, @in6=@empty={[0x0, 0x0, 0xfffffffc]}, 0x0, 0x0, 0x0, 0x0, 0xa}}}, 0xb8}}, 0x0) [ 610.820748] binder: 21563:21585 BC_ACQUIRE_DONE u0000000000000000 no match [ 610.858708] binder: 21563:21585 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 [ 610.874415] binder: 21563:21585 Release 1 refcount change on invalid ref 2 ret -22 04:01:36 executing program 5: r0 = socket$inet6(0xa, 0x2, 0x0) r1 = syz_open_dev$mice(&(0x7f00000002c0)='/dev/input/mice\x00', 0x0, 0x0) ioctl$PPPOEIOCDFWD(r1, 0xb101, 0x0) syz_genetlink_get_family_id$nbd(&(0x7f0000000480)='nbd\x00') getsockopt$inet6_IPV6_XFRM_POLICY(r0, 0x29, 0x23, &(0x7f0000000340)={{{@in=@local, @in=@loopback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@local}, 0x0, @in=@remote}}, &(0x7f0000000140)=0xe8) connect$can_bcm(0xffffffffffffffff, &(0x7f00000001c0), 0x10) bind$inet6(r0, &(0x7f0000000040)={0xa, 0x4e24}, 0x1c) lsetxattr$security_ima(&(0x7f0000000280)='./file0\x00', &(0x7f0000000440)='security.ima\x00', 0x0, 0x0, 0x1) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clock_gettime(0x0, &(0x7f0000000100)={0x0, 0x0}) r4 = openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) bind(r4, &(0x7f0000000580)=@can={0x1d, r2}, 0x80) clock_gettime(0x3, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff}) ppoll(&(0x7f0000000000)=[{r0, 0x41a, 0x3000000}], 0x1, &(0x7f0000000200)={0x0, r3+30000000}, &(0x7f0000000240), 0x8) connect$inet6(r0, &(0x7f0000000080)={0xa, 0x4e24, 0x0, @ipv4={[], [], @loopback}}, 0x1c) readv(0xffffffffffffffff, 0x0, 0x0) sendmmsg(r0, &(0x7f00000092c0), 0x4ff, 0x0) connect$pptp(r5, &(0x7f00000004c0)={0x18, 0x2, {0x0, @multicast1}}, 0x1e) 04:01:36 executing program 4: r0 = socket$alg(0x26, 0x5, 0x0) recvmsg(0xffffffffffffffff, &(0x7f00000036c0)={&(0x7f0000000180)=@can, 0xfd28, &(0x7f00000035c0), 0x0, &(0x7f0000003680)=""/41, 0x29}, 0x0) bind$alg(r0, &(0x7f0000001300)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb(blowfish)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000ff8000)="0a0775b0", 0x4) r1 = accept$alg(r0, 0x0, 0x0) sendmmsg$alg(r1, &(0x7f0000003e80)=[{0x0, 0x0, &(0x7f0000002a80), 0x167, &(0x7f0000000100)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x0) recvmsg(r1, &(0x7f0000000000)={&(0x7f0000f7ffa8)=@alg, 0x61, &(0x7f0000000140)=[{&(0x7f0000000200)=""/4096, 0xfffffe45}], 0x1, &(0x7f0000fb3fa9)=""/87, 0x57}, 0x0) 04:01:36 executing program 3: r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000000)='/exe\x00\x00\x00\x00\x00\x04\x89\x00K\xdd\xd9\xde\x91\xbe\x10\xee\xbf\x00\x0e\xe9\x1e\x18\xf0\xc7o\xbb#*\aBJ\xe1\xe9\x01\xd2\xdau\xaf\x1f\x02\x00\xf5\xab&\xd7\xe0q\xfb53\x1c\xe3\x9cZ\x00\x00') io_setup(0x6, &(0x7f0000000100)=0x0) io_cancel(r2, &(0x7f0000000380)={0x0, 0x0, 0x0, 0x5, 0x43, r1, &(0x7f0000000300)="3c8a27c3cd6af70496e3d19aa71e16940f7ceaa1039c4c574de23abe50e53790406d2c8e6511db2c40349ff6ccfec00af2d89ba8fd99fd269d820618876c5a734f320e3ee7d225e9e1ce8ff18bc10f2548ce57de92b091fd9c1ac870cf50c2172706bf5059f18864d41b31c5ba4527ad486ac002d8b3b65e", 0x78, 0x5, 0x0, 0x1, r1}, &(0x7f0000000440)) ioctl$FS_IOC_FSGETXATTR(r1, 0xc020660b, &(0x7f0000000040)={0x0, 0x0, 0x6940000}) syncfs(0xffffffffffffffff) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000480)='./cgroup.cpu/syz0\x00', 0x1ff) getsockopt$inet_sctp_SCTP_STREAM_SCHEDULER_VALUE(r1, 0x84, 0x7c, 0x0, &(0x7f0000000180)) ioctl$DRM_IOCTL_VERSION(r1, 0xc0406400, 0x0) socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$VIDIOC_S_FREQUENCY(0xffffffffffffffff, 0x402c5639, &(0x7f0000000140)) openat$nullb(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x802, 0x0) openat$cuse(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/cuse\x00', 0x2, 0x0) fstatfs(r0, &(0x7f00000001c0)=""/196) setsockopt$packet_tx_ring(0xffffffffffffffff, 0x10f, 0x87, &(0x7f0000000400)=@req={0x127a, 0xce43, 0x0, 0x6}, 0x10) shmget(0xffffffffffffffff, 0x1000, 0x0, &(0x7f0000bfa000/0x1000)=nil) openat$qat_adf_ctl(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/qat_adf_ctl\x00', 0x90600, 0x0) ioctl$RTC_IRQP_READ(r1, 0x8008700b, &(0x7f0000000080)) 04:01:36 executing program 1: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) recvmsg(0xffffffffffffffff, &(0x7f00000036c0)={&(0x7f0000000180)=@can, 0xfd28, &(0x7f00000035c0), 0x0, &(0x7f0000003680)=""/41, 0x29}, 0x0) bind$alg(r0, &(0x7f0000001300)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb(blowfish)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000ff8000)="0a0775b0", 0x4) r1 = accept$alg(0xffffffffffffffff, 0x0, 0x0) sendmmsg$alg(r1, &(0x7f0000003e80)=[{0x0, 0x0, &(0x7f0000002a80), 0x167, &(0x7f0000000100)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x0) recvmsg(r1, &(0x7f0000000000)={&(0x7f0000f7ffa8)=@alg, 0x61, &(0x7f0000000140)=[{&(0x7f0000000200)=""/4096, 0xfffffe45}], 0x1, &(0x7f0000fb3fa9)=""/87, 0x57}, 0x0) 04:01:36 executing program 2: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000440)=@updpolicy={0xb8, 0x19, 0x523, 0x0, 0x0, {{@in=@multicast2, @in6=@empty={[0x0, 0x0, 0xf0ffffffffffff]}, 0x0, 0x0, 0x0, 0x0, 0xa}}}, 0xb8}}, 0x0) 04:01:37 executing program 0: r0 = perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) setxattr$security_smack_entry(&(0x7f0000000380)='./file0\x00', &(0x7f0000000480)='security.SMACK64IPIN\x00', &(0x7f0000000540)='^vboxnet1^\x00', 0xb, 0x1) bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c) bpf$MAP_UPDATE_ELEM(0x2, 0x0, 0x0) unlink(&(0x7f0000000900)='./file0/file0\x00') r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, &(0x7f00000006c0)={0x0}) ioctl$BINDER_GET_NODE_DEBUG_INFO(r1, 0xc018620b, &(0x7f0000000640)={r3}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f00000000c0)=[@enter_looper], 0x48, 0x0, &(0x7f0000000700)="2ba063fb309ec7fdbfb08e6e91baee7d7d4599fe14129a4d426834556ae420e087d59c0c7be7fcad1abb7e1f8f446f373f611ca1ee9c2231708e18a47bc68a2a79a0b48931f6ff6d"}) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x1) prctl$PR_SET_NAME(0xf, &(0x7f00000004c0)='/group.stat\x00') ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, &(0x7f0000000780)}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f0000000680)}) ioctl$FS_IOC_FIEMAP(r2, 0xc020660b, &(0x7f0000000b80)=ANY=[@ANYBLOB="0000010000000000200000000000000005000000010000000a00000000000000ff030000000000001a0a000000000000050000000000000000000000000000000000000000000000080000000000000000000000000000000800000000000000ffff0000000000000100008000000000000000000000000000000000000000000000000000000000000000000000000008000000000000003f0000000000000008000000000000000000000000000000000000000000800800000000000000000000000000000200000000000000000400000000000000000000010000000000000000000000000000000000000002110000000000000000000000000000cc0000000000000000000000000000001b0000000000000000000000000000000000000000000000841400000000000000000000000000000300000000000000feffffffffffffff000000000000000000000000000000000000000000000000020000000000000000000000000000000600000000000000ff01000000000000040000000000000000000000000000000000000000000000000400000000000000000000000000007be70000000000000900000000000000ff7f0000000000000000000000000000000000000000000004180000000000000000000000000000ffffffff0000000081000000000000000600000000000000000000000000000000000000000000000400000000000000000000000000000002000000000000000500000000000000ff7fffffffffffff0000000000000000000000000000000004040000000000000000000000000000"]) r5 = creat(&(0x7f00000000c0)='./file0\x00', 0x0) openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000100)='/group.stat\x00', 0x2761, 0x0) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000080), 0xffffffffffffffff) getpid() fallocate(r0, 0x0, 0x0, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x2f, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) memfd_create(&(0x7f0000000080)='!proccgroup\x00', 0x0) ioctl$sock_inet_SIOCSIFPFLAGS(0xffffffffffffffff, 0x8934, &(0x7f0000000400)={'veth0_to_bridge\x00', 0x100}) accept(r5, &(0x7f0000000580)=@alg, &(0x7f0000000600)=0x80) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x2400, 0x8000) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000008c0)={0x2c, 0x0, &(0x7f0000000780)=[@acquire_done={0x40106309, r4, 0x2}, @clear_death={0x400c630f, 0x1, 0x3}, @release={0x40046306, 0x2}], 0xc1, 0x0, &(0x7f00000007c0)="859547f83b9b058a973a491d7e6378544744f2b56b02270a2f78214a936e9afb25cd94695643af6563f86771aa9621b9f30f2ca538b018247a633c28ee01e03b4639679311117971e60dc1538f34e961ae301463172c41754be988f6beb0ce4d83c69f86c236d29520e6cdaf5dbb60404c66d63315ff287deac8632781d0197ef1f81314da0a1ed90b681842cf85a41b496ce0a7a6f5aa4b9b23483eea8861be89b3398c6aec3349174f9cdc9de34df361ac9bf7afd8566849487c3c0a1e3aaacd"}) 04:01:37 executing program 1: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) recvmsg(0xffffffffffffffff, &(0x7f00000036c0)={&(0x7f0000000180)=@can, 0xfd28, &(0x7f00000035c0), 0x0, &(0x7f0000003680)=""/41, 0x29}, 0x0) bind$alg(r0, &(0x7f0000001300)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb(blowfish)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000ff8000)="0a0775b0", 0x4) r1 = accept$alg(r0, 0x0, 0x0) sendmmsg$alg(0xffffffffffffffff, &(0x7f0000003e80)=[{0x0, 0x0, &(0x7f0000002a80), 0x167, &(0x7f0000000100)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x0) recvmsg(r1, &(0x7f0000000000)={&(0x7f0000f7ffa8)=@alg, 0x61, &(0x7f0000000140)=[{&(0x7f0000000200)=""/4096, 0xfffffe45}], 0x1, &(0x7f0000fb3fa9)=""/87, 0x57}, 0x0) 04:01:37 executing program 2: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000440)=@updpolicy={0xb8, 0x19, 0x523, 0x0, 0x0, {{@in=@multicast2, @in6=@empty={[0x0, 0x0, 0x100000000000000]}, 0x0, 0x0, 0x0, 0x0, 0xa}}}, 0xb8}}, 0x0) 04:01:37 executing program 4: r0 = socket$alg(0x26, 0x5, 0x0) recvmsg(0xffffffffffffffff, &(0x7f00000036c0)={&(0x7f0000000180)=@can, 0xfd28, &(0x7f00000035c0), 0x0, &(0x7f0000003680)=""/41, 0x29}, 0x0) bind$alg(r0, &(0x7f0000001300)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb(blowfish)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000ff8000)="0a0775b0", 0x4) r1 = accept$alg(r0, 0x0, 0x0) sendmmsg$alg(r1, &(0x7f0000003e80)=[{0x0, 0x0, &(0x7f0000002a80), 0x167, &(0x7f0000000100)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x0) recvmsg(r1, &(0x7f0000000000)={&(0x7f0000f7ffa8)=@alg, 0x61, &(0x7f0000000140)=[{&(0x7f0000000200)=""/4096, 0xfffffe45}], 0x1, &(0x7f0000fb3fa9)=""/87, 0x57}, 0x0) [ 611.434117] binder: release 21563:21575 transaction 328 out, still active 04:01:37 executing program 2: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000440)=@updpolicy={0xb8, 0x19, 0x523, 0x0, 0x0, {{@in=@multicast2, @in6=@empty={[0x0, 0x0, 0x200000000000000]}, 0x0, 0x0, 0x0, 0x0, 0xa}}}, 0xb8}}, 0x0) [ 611.653454] binder: BINDER_SET_CONTEXT_MGR already set [ 611.659084] binder: 21612:21622 ioctl 40046207 0 returned -16 [ 611.684393] net_ratelimit: 22 callbacks suppressed [ 611.684402] protocol 88fb is buggy, dev hsr_slave_0 [ 611.694540] protocol 88fb is buggy, dev hsr_slave_1 04:01:37 executing program 3: r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000000)='/exe\x00\x00\x00\x00\x00\x04\x89\x00K\xdd\xd9\xde\x91\xbe\x10\xee\xbf\x00\x0e\xe9\x1e\x18\xf0\xc7o\xbb#*\aBJ\xe1\xe9\x01\xd2\xdau\xaf\x1f\x02\x00\xf5\xab&\xd7\xe0q\xfb53\x1c\xe3\x9cZ\x00\x00') io_setup(0x6, &(0x7f0000000100)=0x0) io_cancel(r2, &(0x7f0000000380)={0x0, 0x0, 0x0, 0x5, 0x43, r1, &(0x7f0000000300)="3c8a27c3cd6af70496e3d19aa71e16940f7ceaa1039c4c574de23abe50e53790406d2c8e6511db2c40349ff6ccfec00af2d89ba8fd99fd269d820618876c5a734f320e3ee7d225e9e1ce8ff18bc10f2548ce57de92b091fd9c1ac870cf50c2172706bf5059f18864d41b31c5ba4527ad486ac002d8b3b65e", 0x78, 0x5, 0x0, 0x1, r1}, &(0x7f0000000440)) ioctl$FS_IOC_FSGETXATTR(r1, 0xc020660b, &(0x7f0000000040)={0x0, 0x0, 0x6940000}) syncfs(0xffffffffffffffff) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000480)='./cgroup.cpu/syz0\x00', 0x1ff) getsockopt$inet_sctp_SCTP_STREAM_SCHEDULER_VALUE(r1, 0x84, 0x7c, 0x0, &(0x7f0000000180)) ioctl$DRM_IOCTL_VERSION(r1, 0xc0406400, 0x0) socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$VIDIOC_S_FREQUENCY(0xffffffffffffffff, 0x402c5639, &(0x7f0000000140)) openat$nullb(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x802, 0x0) openat$cuse(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/cuse\x00', 0x2, 0x0) fstatfs(r0, &(0x7f00000001c0)=""/196) setsockopt$packet_tx_ring(0xffffffffffffffff, 0x10f, 0x87, &(0x7f0000000400)=@req={0x127a, 0xce43, 0x0, 0x6}, 0x10) shmget(0xffffffffffffffff, 0x1000, 0x0, &(0x7f0000bfa000/0x1000)=nil) openat$qat_adf_ctl(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/qat_adf_ctl\x00', 0x90600, 0x0) ioctl$RTC_IRQP_READ(r1, 0x8008700b, &(0x7f0000000080)) 04:01:37 executing program 1: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) recvmsg(0xffffffffffffffff, &(0x7f00000036c0)={&(0x7f0000000180)=@can, 0xfd28, &(0x7f00000035c0), 0x0, &(0x7f0000003680)=""/41, 0x29}, 0x0) bind$alg(r0, &(0x7f0000001300)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb(blowfish)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000ff8000)="0a0775b0", 0x4) r1 = accept$alg(r0, 0x0, 0x0) sendmmsg$alg(0xffffffffffffffff, &(0x7f0000003e80)=[{0x0, 0x0, &(0x7f0000002a80), 0x167, &(0x7f0000000100)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x0) recvmsg(r1, &(0x7f0000000000)={&(0x7f0000f7ffa8)=@alg, 0x61, &(0x7f0000000140)=[{&(0x7f0000000200)=""/4096, 0xfffffe45}], 0x1, &(0x7f0000fb3fa9)=""/87, 0x57}, 0x0) [ 611.699714] protocol 88fb is buggy, dev hsr_slave_0 [ 611.704828] protocol 88fb is buggy, dev hsr_slave_1 [ 611.728146] binder: 21612:21622 Release 1 refcount change on invalid ref 1 ret -22 [ 611.806908] binder: 21612:21629 BC_ACQUIRE_DONE u0000000000000000 no match [ 611.864412] binder: 21612:21629 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 [ 611.874488] binder: 21612:21629 Release 1 refcount change on invalid ref 2 ret -22 04:01:37 executing program 5: r0 = socket$inet6(0xa, 0x2, 0x0) r1 = syz_open_dev$mice(&(0x7f00000002c0)='/dev/input/mice\x00', 0x0, 0x0) ioctl$PPPOEIOCDFWD(r1, 0xb101, 0x0) syz_genetlink_get_family_id$nbd(&(0x7f0000000480)='nbd\x00') getsockopt$inet6_IPV6_XFRM_POLICY(r0, 0x29, 0x23, &(0x7f0000000340)={{{@in=@local, @in=@loopback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@local}, 0x0, @in=@remote}}, &(0x7f0000000140)=0xe8) connect$can_bcm(0xffffffffffffffff, &(0x7f00000001c0), 0x10) bind$inet6(r0, &(0x7f0000000040)={0xa, 0x4e24}, 0x1c) lsetxattr$security_ima(&(0x7f0000000280)='./file0\x00', &(0x7f0000000440)='security.ima\x00', 0x0, 0x0, 0x1) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clock_gettime(0x0, &(0x7f0000000100)={0x0, 0x0}) r4 = openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) bind(r4, &(0x7f0000000580)=@can={0x1d, r2}, 0x80) clock_gettime(0x3, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff}) ppoll(&(0x7f0000000000)=[{r0, 0x41a, 0x8000000}], 0x1, &(0x7f0000000200)={0x0, r3+30000000}, &(0x7f0000000240), 0x8) connect$inet6(r0, &(0x7f0000000080)={0xa, 0x4e24, 0x0, @ipv4={[], [], @loopback}}, 0x1c) readv(0xffffffffffffffff, 0x0, 0x0) sendmmsg(r0, &(0x7f00000092c0), 0x4ff, 0x0) connect$pptp(r5, &(0x7f00000004c0)={0x18, 0x2, {0x0, @multicast1}}, 0x1e) 04:01:37 executing program 4: perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) recvmsg(0xffffffffffffffff, &(0x7f00000036c0)={&(0x7f0000000180)=@can, 0xfd28, &(0x7f00000035c0), 0x0, &(0x7f0000003680)=""/41, 0x29}, 0x0) bind$alg(r0, &(0x7f0000001300)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb(blowfish)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000ff8000)="0a0775b0", 0x4) r1 = accept$alg(r0, 0x0, 0x0) sendmmsg$alg(r1, &(0x7f0000003e80)=[{0x0, 0x0, &(0x7f0000002a80), 0x167, &(0x7f0000000100)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x0) recvmsg(r1, &(0x7f0000000000)={&(0x7f0000f7ffa8)=@alg, 0x61, &(0x7f0000000140)=[{&(0x7f0000000200)=""/4096, 0xfffffe45}], 0x1, &(0x7f0000fb3fa9)=""/87, 0x57}, 0x0) 04:01:37 executing program 2: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000440)=@updpolicy={0xb8, 0x19, 0x523, 0x0, 0x0, {{@in=@multicast2, @in6=@empty={[0x0, 0x0, 0x300000000000000]}, 0x0, 0x0, 0x0, 0x0, 0xa}}}, 0xb8}}, 0x0) 04:01:37 executing program 1: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) recvmsg(0xffffffffffffffff, &(0x7f00000036c0)={&(0x7f0000000180)=@can, 0xfd28, &(0x7f00000035c0), 0x0, &(0x7f0000003680)=""/41, 0x29}, 0x0) bind$alg(r0, &(0x7f0000001300)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb(blowfish)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000ff8000)="0a0775b0", 0x4) r1 = accept$alg(r0, 0x0, 0x0) sendmmsg$alg(0xffffffffffffffff, &(0x7f0000003e80)=[{0x0, 0x0, &(0x7f0000002a80), 0x167, &(0x7f0000000100)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x0) recvmsg(r1, &(0x7f0000000000)={&(0x7f0000f7ffa8)=@alg, 0x61, &(0x7f0000000140)=[{&(0x7f0000000200)=""/4096, 0xfffffe45}], 0x1, &(0x7f0000fb3fa9)=""/87, 0x57}, 0x0) 04:01:37 executing program 3: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) recvmsg(0xffffffffffffffff, &(0x7f00000036c0)={&(0x7f0000000180)=@can, 0xfd28, &(0x7f00000035c0), 0x0, &(0x7f0000003680)=""/41, 0x29}, 0x0) bind$alg(r0, &(0x7f0000001300)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb(blowfish)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000ff8000)="0a0775b0", 0x4) r1 = accept$alg(r0, 0x0, 0x0) sendmmsg$alg(0xffffffffffffffff, &(0x7f0000003e80)=[{0x0, 0x0, &(0x7f0000002a80), 0x167, &(0x7f0000000100)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x0) recvmsg(r1, &(0x7f0000000000)={&(0x7f0000f7ffa8)=@alg, 0x61, &(0x7f0000000140)=[{&(0x7f0000000200)=""/4096, 0xfffffe45}], 0x1, &(0x7f0000fb3fa9)=""/87, 0x57}, 0x0) 04:01:38 executing program 0: r0 = perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) setxattr$security_smack_entry(&(0x7f0000000380)='./file0\x00', &(0x7f0000000480)='security.SMACK64IPIN\x00', &(0x7f0000000540)='^vboxnet1^\x00', 0xb, 0x1) bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c) bpf$MAP_UPDATE_ELEM(0x2, 0x0, 0x0) unlink(&(0x7f0000000900)='./file0/file0\x00') r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, &(0x7f00000006c0)={0x0}) ioctl$BINDER_GET_NODE_DEBUG_INFO(r1, 0xc018620b, &(0x7f0000000640)={r3}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f00000000c0)=[@enter_looper], 0x48, 0x0, &(0x7f0000000700)="2ba063fb309ec7fdbfb08e6e91baee7d7d4599fe14129a4d426834556ae420e087d59c0c7be7fcad1abb7e1f8f446f373f611ca1ee9c2231708e18a47bc68a2a79a0b48931f6ff6d"}) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x1) prctl$PR_SET_NAME(0xf, &(0x7f00000004c0)='/group.stat\x00') ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, &(0x7f0000000780)}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f0000000680)}) ioctl$FS_IOC_FIEMAP(r2, 0xc020660b, &(0x7f0000000b80)=ANY=[@ANYBLOB="0000010000000000200000000000000005000000010000000a00000000000000ff030000000000001a0a000000000000050000000000000000000000000000000000000000000000080000000000000000000000000000000800000000000000ffff0000000000000100008000000000000000000000000000000000000000000000000000000000000000000000000008000000000000003f0000000000000008000000000000000000000000000000000000000000800800000000000000000000000000000200000000000000000400000000000000000000010000000000000000000000000000000000000002110000000000000000000000000000cc0000000000000000000000000000001b0000000000000000000000000000000000000000000000841400000000000000000000000000000300000000000000feffffffffffffff000000000000000000000000000000000000000000000000020000000000000000000000000000000600000000000000ff01000000000000040000000000000000000000000000000000000000000000000400000000000000000000000000007be70000000000000900000000000000ff7f0000000000000000000000000000000000000000000004180000000000000000000000000000ffffffff0000000081000000000000000600000000000000000000000000000000000000000000000400000000000000000000000000000002000000000000000500000000000000ff7fffffffffffff0000000000000000000000000000000004040000000000000000000000000000"]) r5 = creat(&(0x7f00000000c0)='./file0\x00', 0x0) openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000100)='/group.stat\x00', 0x2761, 0x0) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000080), 0xffffffffffffffff) getpid() fallocate(r0, 0x0, 0x0, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x2f, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) memfd_create(&(0x7f0000000080)='!proccgroup\x00', 0x0) ioctl$sock_inet_SIOCSIFPFLAGS(0xffffffffffffffff, 0x8934, &(0x7f0000000400)={'veth0_to_bridge\x00', 0x100}) accept(r5, &(0x7f0000000580)=@alg, &(0x7f0000000600)=0x80) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x2400, 0x8000) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000008c0)={0x2c, 0x0, &(0x7f0000000780)=[@acquire_done={0x40106309, r4, 0x2}, @clear_death={0x400c630f, 0x1, 0x3}, @release={0x40046306, 0x2}], 0xc1, 0x0, &(0x7f00000007c0)="859547f83b9b058a973a491d7e6378544744f2b56b02270a2f78214a936e9afb25cd94695643af6563f86771aa9621b9f30f2ca538b018247a633c28ee01e03b4639679311117971e60dc1538f34e961ae301463172c41754be988f6beb0ce4d83c69f86c236d29520e6cdaf5dbb60404c66d63315ff287deac8632781d0197ef1f81314da0a1ed90b681842cf85a41b496ce0a7a6f5aa4b9b23483eea8861be89b3398c6aec3349174f9cdc9de34df361ac9bf7afd8566849487c3c0a1e3aaacd"}) 04:01:38 executing program 1: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) recvmsg(0xffffffffffffffff, &(0x7f00000036c0)={&(0x7f0000000180)=@can, 0xfd28, &(0x7f00000035c0), 0x0, &(0x7f0000003680)=""/41, 0x29}, 0x0) bind$alg(r0, &(0x7f0000001300)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb(blowfish)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000ff8000)="0a0775b0", 0x4) r1 = accept$alg(r0, 0x0, 0x0) sendmmsg$alg(r1, 0x0, 0x0, 0x0) recvmsg(r1, &(0x7f0000000000)={&(0x7f0000f7ffa8)=@alg, 0x61, &(0x7f0000000140)=[{&(0x7f0000000200)=""/4096, 0xfffffe45}], 0x1, &(0x7f0000fb3fa9)=""/87, 0x57}, 0x0) 04:01:38 executing program 4: perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) recvmsg(0xffffffffffffffff, &(0x7f00000036c0)={&(0x7f0000000180)=@can, 0xfd28, &(0x7f00000035c0), 0x0, &(0x7f0000003680)=""/41, 0x29}, 0x0) bind$alg(r0, &(0x7f0000001300)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb(blowfish)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000ff8000)="0a0775b0", 0x4) r1 = accept$alg(r0, 0x0, 0x0) sendmmsg$alg(r1, &(0x7f0000003e80)=[{0x0, 0x0, &(0x7f0000002a80), 0x167, &(0x7f0000000100)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x0) recvmsg(r1, &(0x7f0000000000)={&(0x7f0000f7ffa8)=@alg, 0x61, &(0x7f0000000140)=[{&(0x7f0000000200)=""/4096, 0xfffffe45}], 0x1, &(0x7f0000fb3fa9)=""/87, 0x57}, 0x0) 04:01:38 executing program 2: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000440)=@updpolicy={0xb8, 0x19, 0x523, 0x0, 0x0, {{@in=@multicast2, @in6=@empty={[0x0, 0x0, 0x400000000000000]}, 0x0, 0x0, 0x0, 0x0, 0xa}}}, 0xb8}}, 0x0) [ 612.354497] binder: release 21612:21622 transaction 331 out, still active 04:01:38 executing program 3: socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000140)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r1, 0x5423, &(0x7f00000000c0)=0x2) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000000000)) r2 = dup2(r0, r0) ioctl$VIDIOC_SUBDEV_S_FMT(r2, 0xc0585605, &(0x7f0000000040)={0x1, 0x0, {0x2, 0x0, 0x700f, 0x7, 0x2, 0x1, 0x2, 0x3}}) ioctl$KDGETMODE(r1, 0x5437, 0x0) syz_open_pts(r1, 0x20400) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000180)={&(0x7f0000000100)='\x00', r2}, 0x10) 04:01:38 executing program 2: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000440)=@updpolicy={0xb8, 0x19, 0x523, 0x0, 0x0, {{@in=@multicast2, @in6=@empty={[0x0, 0x0, 0x800000000000000]}, 0x0, 0x0, 0x0, 0x0, 0xa}}}, 0xb8}}, 0x0) [ 612.564404] protocol 88fb is buggy, dev hsr_slave_0 [ 612.569524] protocol 88fb is buggy, dev hsr_slave_1 [ 612.582754] binder: BINDER_SET_CONTEXT_MGR already set 04:01:38 executing program 4: perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) recvmsg(0xffffffffffffffff, &(0x7f00000036c0)={&(0x7f0000000180)=@can, 0xfd28, &(0x7f00000035c0), 0x0, &(0x7f0000003680)=""/41, 0x29}, 0x0) bind$alg(r0, &(0x7f0000001300)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb(blowfish)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000ff8000)="0a0775b0", 0x4) r1 = accept$alg(r0, 0x0, 0x0) sendmmsg$alg(r1, &(0x7f0000003e80)=[{0x0, 0x0, &(0x7f0000002a80), 0x167, &(0x7f0000000100)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x0) recvmsg(r1, &(0x7f0000000000)={&(0x7f0000f7ffa8)=@alg, 0x61, &(0x7f0000000140)=[{&(0x7f0000000200)=""/4096, 0xfffffe45}], 0x1, &(0x7f0000fb3fa9)=""/87, 0x57}, 0x0) [ 612.620855] binder: 21652:21662 ioctl 40046207 0 returned -16 [ 612.635379] binder: 21652:21665 Release 1 refcount change on invalid ref 1 ret -22 [ 612.699810] binder: 21652:21662 BC_ACQUIRE_DONE u0000000000000000 no match [ 612.724346] protocol 88fb is buggy, dev hsr_slave_0 [ 612.729482] protocol 88fb is buggy, dev hsr_slave_1 [ 612.751180] binder: 21652:21662 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 [ 612.799191] binder: 21652:21662 Release 1 refcount change on invalid ref 2 ret -22 [ 612.807098] protocol 88fb is buggy, dev hsr_slave_0 [ 612.807152] protocol 88fb is buggy, dev hsr_slave_1 04:01:38 executing program 5: r0 = socket$inet6(0xa, 0x2, 0x0) r1 = syz_open_dev$mice(&(0x7f00000002c0)='/dev/input/mice\x00', 0x0, 0x0) ioctl$PPPOEIOCDFWD(r1, 0xb101, 0x0) syz_genetlink_get_family_id$nbd(&(0x7f0000000480)='nbd\x00') getsockopt$inet6_IPV6_XFRM_POLICY(r0, 0x29, 0x23, &(0x7f0000000340)={{{@in=@local, @in=@loopback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@local}, 0x0, @in=@remote}}, &(0x7f0000000140)=0xe8) connect$can_bcm(0xffffffffffffffff, &(0x7f00000001c0), 0x10) bind$inet6(r0, &(0x7f0000000040)={0xa, 0x4e24}, 0x1c) lsetxattr$security_ima(&(0x7f0000000280)='./file0\x00', &(0x7f0000000440)='security.ima\x00', 0x0, 0x0, 0x1) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clock_gettime(0x0, &(0x7f0000000100)={0x0, 0x0}) r4 = openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) bind(r4, &(0x7f0000000580)=@can={0x1d, r2}, 0x80) clock_gettime(0x3, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff}) ppoll(&(0x7f0000000000)=[{r0, 0x41a, 0x20000000}], 0x1, &(0x7f0000000200)={0x0, r3+30000000}, &(0x7f0000000240), 0x8) connect$inet6(r0, &(0x7f0000000080)={0xa, 0x4e24, 0x0, @ipv4={[], [], @loopback}}, 0x1c) readv(0xffffffffffffffff, 0x0, 0x0) sendmmsg(r0, &(0x7f00000092c0), 0x4ff, 0x0) connect$pptp(r5, &(0x7f00000004c0)={0x18, 0x2, {0x0, @multicast1}}, 0x1e) 04:01:38 executing program 1: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) recvmsg(0xffffffffffffffff, &(0x7f00000036c0)={&(0x7f0000000180)=@can, 0xfd28, &(0x7f00000035c0), 0x0, &(0x7f0000003680)=""/41, 0x29}, 0x0) bind$alg(r0, &(0x7f0000001300)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb(blowfish)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000ff8000)="0a0775b0", 0x4) r1 = accept$alg(r0, 0x0, 0x0) sendmmsg$alg(r1, 0x0, 0x0, 0x0) recvmsg(r1, &(0x7f0000000000)={&(0x7f0000f7ffa8)=@alg, 0x61, &(0x7f0000000140)=[{&(0x7f0000000200)=""/4096, 0xfffffe45}], 0x1, &(0x7f0000fb3fa9)=""/87, 0x57}, 0x0) 04:01:38 executing program 3: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) setsockopt$inet6_IPV6_ADDRFORM(0xffffffffffffffff, 0x29, 0x1, &(0x7f00000002c0), 0x4) gettid() socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ppoll(&(0x7f0000000000)=[{0xffffffffffffffff, 0x8009}, {0xffffffffffffffff, 0x444}], 0x2, &(0x7f0000000040)={0x0, 0x989680}, &(0x7f0000000080)={0x9}, 0xfffffffffffffc5c) r1 = perf_event_open(&(0x7f000025c000)={0x0, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7fffffffffff}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r2 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000280)='/dev/vhost-net\x00', 0x2, 0x0) ioctl$int_in(r2, 0x40000000af01, &(0x7f0000000140)) ioctl$sock_inet_SIOCSARP(0xffffffffffffffff, 0x8955, &(0x7f0000000300)={{0x2, 0x0, @multicast1}, {0x307}, 0x8, {0x2, 0x4e24, @local}, 'teql0\x00'}) ioctl$VHOST_SET_VRING_ADDR(r2, 0x4028af11, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000001740)=""/163, &(0x7f0000000540)=""/246, &(0x7f0000000640)=""/4096}) r3 = openat$audio(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/audio\x00', 0x0, 0x0) lstat(&(0x7f0000000380)='./file0\x00', &(0x7f00000028c0)={0x0, 0x0, 0x0, 0x0, 0x0}) quotactl(0x8, &(0x7f0000000200)='./file0\x00', r4, &(0x7f0000002940)="5f78f0baa86465c6700ec496af509398e00b36048788603701e2db35ebcdfc1560ff14542267adaa6d0454afe46666cb54071bbac85b5804c84a1ca0564ff9012eb9eb273ed3979584d9ceaf8719de013e0257aec9bebe3f6d99e02eeb6b157d62552fe8c043f6677c583a90560d270613f7517cc96649f772b6b306ccdbb9593c685cc7c4529e06f3c004f9050eec6f571ab264f62d01bd2289b3267c884e40344474f2a2da212b32badf7ae7f88f4dd7484666d2") ioctl$EVIOCSMASK(0xffffffffffffffff, 0x40104593, &(0x7f0000001700)={0x17, 0x69, &(0x7f0000002800)="49c12125d235971ca2daccda085663559d015eff87b10d6952e773e358f9087d59b79aedb029786b420420375ec8e30299bedcc50f521f4f075cef7edb6e8a57fd7889cbd2f301fb9e4c4a1a17748bb3640a41844e7290ff41f8623fbda8795563f310a6a72fc5715d"}) ioctl$UI_END_FF_UPLOAD(r3, 0x406855c9, &(0x7f0000000400)={0xa, 0x7, {0x57, 0x0, 0x6, {0x5, 0x5}, {0x3, 0x101}, @ramp={0x2, 0x27f, {0x7, 0x0, 0x2, 0x3f}}}, {0x57, 0x7ff, 0x0, {0x2, 0x4}, {0x80000001, 0x7f}, @rumble={0x40, 0x6}}}) setsockopt$inet_sctp_SCTP_EVENTS(r3, 0x84, 0xb, &(0x7f0000002b40)={0xe0, 0xffffffffffffffe3, 0xfffffffffffffffc, 0x7fff, 0xdfa3, 0x7, 0x5, 0x3, 0x40, 0x5, 0x1}, 0xb) close(r1) r5 = openat$tun(0xffffffffffffff9c, &(0x7f0000002880)='/dev/net/tun\x00', 0x0, 0x0) getsockopt$inet_sctp6_SCTP_PR_SUPPORTED(r3, 0x84, 0x71, &(0x7f00000003c0)={0x0, 0x3}, &(0x7f0000002a00)=0x8) getsockopt$inet_sctp_SCTP_PRIMARY_ADDR(r0, 0x84, 0x6, &(0x7f0000002a40)={r6, @in={{0x2, 0x4e20, @multicast1}}}, &(0x7f0000002b00)=0x84) ioctl$TUNSETIFF(r5, 0x400454ca, &(0x7f0000000000)={'vet\x00\x00\x00\x00\x00\x00\x00\x00\x00\xbdh\x00', 0x43732e5398416f1a}) ioctl$VHOST_SET_MEM_TABLE(r2, 0x4008af03, &(0x7f00000007c0)=ANY=[]) ioctl$UI_SET_EVBIT(0xffffffffffffffff, 0x40045564, 0x3) ioctl$VHOST_NET_SET_BACKEND(r2, 0x4008af30, &(0x7f0000f1dff8)={0x0, r3}) syz_genetlink_get_family_id$fou(&(0x7f0000000500)='fou\x00') sendmsg$FOU_CMD_DEL(r3, &(0x7f00000016c0)={&(0x7f00000004c0)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f0000001680)={&(0x7f0000001640)=ANY=[@ANYBLOB="0502"], 0x1}, 0x1, 0x0, 0x0, 0x4040}, 0x0) ioctl$FS_IOC_GETVERSION(r0, 0x80087601, &(0x7f0000000480)) setsockopt$packet_fanout_data(0xffffffffffffffff, 0x107, 0x16, &(0x7f0000000140)={0x9, &(0x7f0000002b80)=[{0x800, 0x3, 0xcd, 0x7}, {0x3, 0x7, 0x9, 0x4}, {0x6, 0xfd9c, 0x500000, 0x10001}, {0xa6, 0x56b, 0x3b2768ca, 0x837e}, {0x4, 0x1, 0xfa6, 0xd4e}, {0x400, 0x9, 0x13bc, 0x1002}, {0x20, 0x2, 0x8001, 0x4}, {0x7ee1473b, 0x8, 0x3, 0xffffffffffffd1f5}, {0x800, 0x3f5, 0xffffffff, 0x5}]}, 0x10) setuid(r4) statfs(&(0x7f0000000100)='./file0\x00', &(0x7f0000001800)=""/4096) 04:01:38 executing program 2: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000440)=@updpolicy={0xb8, 0x19, 0x523, 0x0, 0x0, {{@in=@multicast2, @in6=@empty={[0x0, 0x0, 0xa00000000000000]}, 0x0, 0x0, 0x0, 0x0, 0xa}}}, 0xb8}}, 0x0) 04:01:38 executing program 4: perf_event_open(&(0x7f000001d000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) recvmsg(0xffffffffffffffff, &(0x7f00000036c0)={&(0x7f0000000180)=@can, 0xfd28, &(0x7f00000035c0), 0x0, &(0x7f0000003680)=""/41, 0x29}, 0x0) bind$alg(r0, &(0x7f0000001300)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb(blowfish)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000ff8000)="0a0775b0", 0x4) r1 = accept$alg(r0, 0x0, 0x0) sendmmsg$alg(r1, &(0x7f0000003e80)=[{0x0, 0x0, &(0x7f0000002a80), 0x167, &(0x7f0000000100)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x0) recvmsg(r1, &(0x7f0000000000)={&(0x7f0000f7ffa8)=@alg, 0x61, &(0x7f0000000140)=[{&(0x7f0000000200)=""/4096, 0xfffffe45}], 0x1, &(0x7f0000fb3fa9)=""/87, 0x57}, 0x0) 04:01:39 executing program 0: r0 = perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) setxattr$security_smack_entry(&(0x7f0000000380)='./file0\x00', &(0x7f0000000480)='security.SMACK64IPIN\x00', &(0x7f0000000540)='^vboxnet1^\x00', 0xb, 0x1) bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={0xffffffffffffffff, &(0x7f0000000040), 0x0, 0x1}, 0x20) unlink(&(0x7f0000000900)='./file0/file0\x00') r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, &(0x7f00000006c0)={0x0}) ioctl$BINDER_GET_NODE_DEBUG_INFO(r1, 0xc018620b, &(0x7f0000000640)={r3}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f00000000c0)=[@enter_looper], 0x48, 0x0, &(0x7f0000000700)="2ba063fb309ec7fdbfb08e6e91baee7d7d4599fe14129a4d426834556ae420e087d59c0c7be7fcad1abb7e1f8f446f373f611ca1ee9c2231708e18a47bc68a2a79a0b48931f6ff6d"}) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x1) prctl$PR_SET_NAME(0xf, &(0x7f00000004c0)='/group.stat\x00') ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, &(0x7f0000000780)}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f0000000680)}) ioctl$FS_IOC_FIEMAP(r2, 0xc020660b, &(0x7f0000000b80)=ANY=[@ANYBLOB="0000010000000000200000000000000005000000010000000a00000000000000ff030000000000001a0a000000000000050000000000000000000000000000000000000000000000080000000000000000000000000000000800000000000000ffff0000000000000100008000000000000000000000000000000000000000000000000000000000000000000000000008000000000000003f0000000000000008000000000000000000000000000000000000000000800800000000000000000000000000000200000000000000000400000000000000000000010000000000000000000000000000000000000002110000000000000000000000000000cc0000000000000000000000000000001b0000000000000000000000000000000000000000000000841400000000000000000000000000000300000000000000feffffffffffffff000000000000000000000000000000000000000000000000020000000000000000000000000000000600000000000000ff01000000000000040000000000000000000000000000000000000000000000000400000000000000000000000000007be70000000000000900000000000000ff7f0000000000000000000000000000000000000000000004180000000000000000000000000000ffffffff0000000081000000000000000600000000000000000000000000000000000000000000000400000000000000000000000000000002000000000000000500000000000000ff7fffffffffffff0000000000000000000000000000000004040000000000000000000000000000"]) r5 = creat(&(0x7f00000000c0)='./file0\x00', 0x0) openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000100)='/group.stat\x00', 0x2761, 0x0) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000080), 0xffffffffffffffff) getpid() fallocate(r0, 0x0, 0x0, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x2f, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) memfd_create(&(0x7f0000000080)='!proccgroup\x00', 0x0) ioctl$sock_inet_SIOCSIFPFLAGS(0xffffffffffffffff, 0x8934, &(0x7f0000000400)={'veth0_to_bridge\x00', 0x100}) accept(r5, &(0x7f0000000580)=@alg, &(0x7f0000000600)=0x80) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x2400, 0x8000) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000008c0)={0x2c, 0x0, &(0x7f0000000780)=[@acquire_done={0x40106309, r4, 0x2}, @clear_death={0x400c630f, 0x1, 0x3}, @release={0x40046306, 0x2}], 0xc1, 0x0, &(0x7f00000007c0)="859547f83b9b058a973a491d7e6378544744f2b56b02270a2f78214a936e9afb25cd94695643af6563f86771aa9621b9f30f2ca538b018247a633c28ee01e03b4639679311117971e60dc1538f34e961ae301463172c41754be988f6beb0ce4d83c69f86c236d29520e6cdaf5dbb60404c66d63315ff287deac8632781d0197ef1f81314da0a1ed90b681842cf85a41b496ce0a7a6f5aa4b9b23483eea8861be89b3398c6aec3349174f9cdc9de34df361ac9bf7afd8566849487c3c0a1e3aaacd"}) 04:01:39 executing program 1: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) recvmsg(0xffffffffffffffff, &(0x7f00000036c0)={&(0x7f0000000180)=@can, 0xfd28, &(0x7f00000035c0), 0x0, &(0x7f0000003680)=""/41, 0x29}, 0x0) bind$alg(r0, &(0x7f0000001300)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb(blowfish)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000ff8000)="0a0775b0", 0x4) r1 = accept$alg(r0, 0x0, 0x0) sendmmsg$alg(r1, 0x0, 0x0, 0x0) recvmsg(r1, &(0x7f0000000000)={&(0x7f0000f7ffa8)=@alg, 0x61, &(0x7f0000000140)=[{&(0x7f0000000200)=""/4096, 0xfffffe45}], 0x1, &(0x7f0000fb3fa9)=""/87, 0x57}, 0x0) 04:01:39 executing program 2: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000440)=@updpolicy={0xb8, 0x19, 0x523, 0x0, 0x0, {{@in=@multicast2, @in6=@empty={[0x0, 0x0, 0xe00000000000000]}, 0x0, 0x0, 0x0, 0x0, 0xa}}}, 0xb8}}, 0x0) 04:01:39 executing program 4: perf_event_open(&(0x7f000001d000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) recvmsg(0xffffffffffffffff, &(0x7f00000036c0)={&(0x7f0000000180)=@can, 0xfd28, &(0x7f00000035c0), 0x0, &(0x7f0000003680)=""/41, 0x29}, 0x0) bind$alg(r0, &(0x7f0000001300)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb(blowfish)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000ff8000)="0a0775b0", 0x4) r1 = accept$alg(r0, 0x0, 0x0) sendmmsg$alg(r1, &(0x7f0000003e80)=[{0x0, 0x0, &(0x7f0000002a80), 0x167, &(0x7f0000000100)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x0) recvmsg(r1, &(0x7f0000000000)={&(0x7f0000f7ffa8)=@alg, 0x61, &(0x7f0000000140)=[{&(0x7f0000000200)=""/4096, 0xfffffe45}], 0x1, &(0x7f0000fb3fa9)=""/87, 0x57}, 0x0) [ 613.297114] binder: release 21652:21665 transaction 334 out, still active 04:01:39 executing program 2: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000440)=@updpolicy={0xb8, 0x19, 0x523, 0x0, 0x0, {{@in=@multicast2, @in6=@empty={[0x0, 0x0, 0xf00000000000000]}, 0x0, 0x0, 0x0, 0x0, 0xa}}}, 0xb8}}, 0x0) 04:01:39 executing program 1: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) recvmsg(0xffffffffffffffff, &(0x7f00000036c0)={&(0x7f0000000180)=@can, 0xfd28, &(0x7f00000035c0), 0x0, &(0x7f0000003680)=""/41, 0x29}, 0x0) bind$alg(r0, &(0x7f0000001300)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb(blowfish)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000ff8000)="0a0775b0", 0x4) r1 = accept$alg(r0, 0x0, 0x0) sendmmsg$alg(r1, &(0x7f0000003e80), 0x0, 0x0) recvmsg(r1, &(0x7f0000000000)={&(0x7f0000f7ffa8)=@alg, 0x61, &(0x7f0000000140)=[{&(0x7f0000000200)=""/4096, 0xfffffe45}], 0x1, &(0x7f0000fb3fa9)=""/87, 0x57}, 0x0) 04:01:39 executing program 4: perf_event_open(&(0x7f000001d000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) recvmsg(0xffffffffffffffff, &(0x7f00000036c0)={&(0x7f0000000180)=@can, 0xfd28, &(0x7f00000035c0), 0x0, &(0x7f0000003680)=""/41, 0x29}, 0x0) bind$alg(r0, &(0x7f0000001300)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb(blowfish)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000ff8000)="0a0775b0", 0x4) r1 = accept$alg(r0, 0x0, 0x0) sendmmsg$alg(r1, &(0x7f0000003e80)=[{0x0, 0x0, &(0x7f0000002a80), 0x167, &(0x7f0000000100)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x0) recvmsg(r1, &(0x7f0000000000)={&(0x7f0000f7ffa8)=@alg, 0x61, &(0x7f0000000140)=[{&(0x7f0000000200)=""/4096, 0xfffffe45}], 0x1, &(0x7f0000fb3fa9)=""/87, 0x57}, 0x0) [ 613.577870] binder: BINDER_SET_CONTEXT_MGR already set [ 613.583292] binder: 21699:21708 ioctl 40046207 0 returned -16 [ 613.611521] binder: 21699:21708 Release 1 refcount change on invalid ref 1 ret -22 [ 613.627642] binder: 21699:21711 BC_ACQUIRE_DONE u0000000000000000 no match [ 613.635049] binder: 21699:21711 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 [ 613.642267] binder: 21699:21711 Release 1 refcount change on invalid ref 2 ret -22 04:01:39 executing program 5: r0 = socket$inet6(0xa, 0x2, 0x0) r1 = syz_open_dev$mice(&(0x7f00000002c0)='/dev/input/mice\x00', 0x0, 0x0) ioctl$PPPOEIOCDFWD(r1, 0xb101, 0x0) syz_genetlink_get_family_id$nbd(&(0x7f0000000480)='nbd\x00') getsockopt$inet6_IPV6_XFRM_POLICY(r0, 0x29, 0x23, &(0x7f0000000340)={{{@in=@local, @in=@loopback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@local}, 0x0, @in=@remote}}, &(0x7f0000000140)=0xe8) connect$can_bcm(0xffffffffffffffff, &(0x7f00000001c0), 0x10) bind$inet6(r0, &(0x7f0000000040)={0xa, 0x4e24}, 0x1c) lsetxattr$security_ima(&(0x7f0000000280)='./file0\x00', &(0x7f0000000440)='security.ima\x00', 0x0, 0x0, 0x1) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clock_gettime(0x0, &(0x7f0000000100)={0x0, 0x0}) r4 = openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) bind(r4, &(0x7f0000000580)=@can={0x1d, r2}, 0x80) clock_gettime(0x3, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff}) ppoll(&(0x7f0000000000)=[{r0, 0x41a, 0x3f000000}], 0x1, &(0x7f0000000200)={0x0, r3+30000000}, &(0x7f0000000240), 0x8) connect$inet6(r0, &(0x7f0000000080)={0xa, 0x4e24, 0x0, @ipv4={[], [], @loopback}}, 0x1c) readv(0xffffffffffffffff, 0x0, 0x0) sendmmsg(r0, &(0x7f00000092c0), 0x4ff, 0x0) connect$pptp(r5, &(0x7f00000004c0)={0x18, 0x2, {0x0, @multicast1}}, 0x1e) 04:01:39 executing program 3: r0 = socket$inet_tcp(0x2, 0x1, 0x0) clone(0x2102001fbc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = gettid() ioctl$sock_ifreq(r0, 0x8913, &(0x7f0000000340)={'teql0\x00', @ifru_flags=0x1500}) ptrace$setopts(0x4206, r1, 0x0, 0x0) tkill(r1, 0x10000003f) wait4(0x0, 0x0, 0x0, 0x0) ioctl$sock_bt_bnep_BNEPCONNADD(r0, 0x400442c8, &(0x7f0000000000)={r0, 0x100000001, 0x7f000, "d8f9f5c8632a06fd6e6f3828b80c57cec3945c0750cd7fc2b5a81eeda03b6323c0ade363c8c8de3e2d265e2cb685182cf154f5b791dd19db4a7817a4224fc12913996bb496ea04396834a80a91ff1a9b7413feb3ba89a2f2a53bffdaf442c19f2efd529ba5b142c8bd3bf9a3b3c7a2cb86635b"}) 04:01:39 executing program 4: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) recvmsg(0xffffffffffffffff, &(0x7f00000036c0)={&(0x7f0000000180)=@can, 0xfd28, &(0x7f00000035c0), 0x0, &(0x7f0000003680)=""/41, 0x29}, 0x0) bind$alg(r0, &(0x7f0000001300)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb(blowfish)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000ff8000)="0a0775b0", 0x4) r1 = accept$alg(r0, 0x0, 0x0) sendmmsg$alg(r1, &(0x7f0000003e80)=[{0x0, 0x0, &(0x7f0000002a80), 0x167, &(0x7f0000000100)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x0) recvmsg(r1, &(0x7f0000000000)={&(0x7f0000f7ffa8)=@alg, 0x61, &(0x7f0000000140)=[{&(0x7f0000000200)=""/4096, 0xfffffe45}], 0x1, &(0x7f0000fb3fa9)=""/87, 0x57}, 0x0) 04:01:39 executing program 1: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) recvmsg(0xffffffffffffffff, &(0x7f00000036c0)={&(0x7f0000000180)=@can, 0xfd28, &(0x7f00000035c0), 0x0, &(0x7f0000003680)=""/41, 0x29}, 0x0) bind$alg(r0, &(0x7f0000001300)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb(blowfish)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000ff8000)="0a0775b0", 0x4) r1 = accept$alg(r0, 0x0, 0x0) sendmmsg$alg(r1, &(0x7f0000003e80), 0x0, 0x0) recvmsg(r1, &(0x7f0000000000)={&(0x7f0000f7ffa8)=@alg, 0x61, &(0x7f0000000140)=[{&(0x7f0000000200)=""/4096, 0xfffffe45}], 0x1, &(0x7f0000fb3fa9)=""/87, 0x57}, 0x0) 04:01:39 executing program 2: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000440)=@updpolicy={0xb8, 0x19, 0x523, 0x0, 0x0, {{@in=@multicast2, @in6=@empty={[0x0, 0x0, 0x1000000000000000]}, 0x0, 0x0, 0x0, 0x0, 0xa}}}, 0xb8}}, 0x0) 04:01:40 executing program 0: r0 = perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) setxattr$security_smack_entry(&(0x7f0000000380)='./file0\x00', &(0x7f0000000480)='security.SMACK64IPIN\x00', &(0x7f0000000540)='^vboxnet1^\x00', 0xb, 0x1) bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={0xffffffffffffffff, &(0x7f0000000040), 0x0, 0x1}, 0x20) unlink(&(0x7f0000000900)='./file0/file0\x00') r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, &(0x7f00000006c0)={0x0}) ioctl$BINDER_GET_NODE_DEBUG_INFO(r1, 0xc018620b, &(0x7f0000000640)={r3}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f00000000c0)=[@enter_looper], 0x48, 0x0, &(0x7f0000000700)="2ba063fb309ec7fdbfb08e6e91baee7d7d4599fe14129a4d426834556ae420e087d59c0c7be7fcad1abb7e1f8f446f373f611ca1ee9c2231708e18a47bc68a2a79a0b48931f6ff6d"}) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x1) prctl$PR_SET_NAME(0xf, &(0x7f00000004c0)='/group.stat\x00') ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, &(0x7f0000000780)}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f0000000680)}) ioctl$FS_IOC_FIEMAP(r2, 0xc020660b, &(0x7f0000000b80)=ANY=[@ANYBLOB="0000010000000000200000000000000005000000010000000a00000000000000ff030000000000001a0a000000000000050000000000000000000000000000000000000000000000080000000000000000000000000000000800000000000000ffff0000000000000100008000000000000000000000000000000000000000000000000000000000000000000000000008000000000000003f0000000000000008000000000000000000000000000000000000000000800800000000000000000000000000000200000000000000000400000000000000000000010000000000000000000000000000000000000002110000000000000000000000000000cc0000000000000000000000000000001b0000000000000000000000000000000000000000000000841400000000000000000000000000000300000000000000feffffffffffffff000000000000000000000000000000000000000000000000020000000000000000000000000000000600000000000000ff01000000000000040000000000000000000000000000000000000000000000000400000000000000000000000000007be70000000000000900000000000000ff7f0000000000000000000000000000000000000000000004180000000000000000000000000000ffffffff0000000081000000000000000600000000000000000000000000000000000000000000000400000000000000000000000000000002000000000000000500000000000000ff7fffffffffffff0000000000000000000000000000000004040000000000000000000000000000"]) r5 = creat(&(0x7f00000000c0)='./file0\x00', 0x0) openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000100)='/group.stat\x00', 0x2761, 0x0) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000080), 0xffffffffffffffff) getpid() fallocate(r0, 0x0, 0x0, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x2f, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) memfd_create(&(0x7f0000000080)='!proccgroup\x00', 0x0) ioctl$sock_inet_SIOCSIFPFLAGS(0xffffffffffffffff, 0x8934, &(0x7f0000000400)={'veth0_to_bridge\x00', 0x100}) accept(r5, &(0x7f0000000580)=@alg, &(0x7f0000000600)=0x80) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x2400, 0x8000) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000008c0)={0x2c, 0x0, &(0x7f0000000780)=[@acquire_done={0x40106309, r4, 0x2}, @clear_death={0x400c630f, 0x1, 0x3}, @release={0x40046306, 0x2}], 0xc1, 0x0, &(0x7f00000007c0)="859547f83b9b058a973a491d7e6378544744f2b56b02270a2f78214a936e9afb25cd94695643af6563f86771aa9621b9f30f2ca538b018247a633c28ee01e03b4639679311117971e60dc1538f34e961ae301463172c41754be988f6beb0ce4d83c69f86c236d29520e6cdaf5dbb60404c66d63315ff287deac8632781d0197ef1f81314da0a1ed90b681842cf85a41b496ce0a7a6f5aa4b9b23483eea8861be89b3398c6aec3349174f9cdc9de34df361ac9bf7afd8566849487c3c0a1e3aaacd"}) 04:01:40 executing program 2: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000440)=@updpolicy={0xb8, 0x19, 0x523, 0x0, 0x0, {{@in=@multicast2, @in6=@empty={[0x0, 0x0, 0x2403000000000000]}, 0x0, 0x0, 0x0, 0x0, 0xa}}}, 0xb8}}, 0x0) 04:01:40 executing program 4: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) recvmsg(0xffffffffffffffff, &(0x7f00000036c0)={&(0x7f0000000180)=@can, 0xfd28, &(0x7f00000035c0), 0x0, &(0x7f0000003680)=""/41, 0x29}, 0x0) bind$alg(r0, &(0x7f0000001300)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb(blowfish)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000ff8000)="0a0775b0", 0x4) r1 = accept$alg(r0, 0x0, 0x0) sendmmsg$alg(r1, &(0x7f0000003e80)=[{0x0, 0x0, &(0x7f0000002a80), 0x167, &(0x7f0000000100)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x0) recvmsg(r1, &(0x7f0000000000)={&(0x7f0000f7ffa8)=@alg, 0x61, &(0x7f0000000140)=[{&(0x7f0000000200)=""/4096, 0xfffffe45}], 0x1, &(0x7f0000fb3fa9)=""/87, 0x57}, 0x0) 04:01:40 executing program 1: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) recvmsg(0xffffffffffffffff, &(0x7f00000036c0)={&(0x7f0000000180)=@can, 0xfd28, &(0x7f00000035c0), 0x0, &(0x7f0000003680)=""/41, 0x29}, 0x0) bind$alg(r0, &(0x7f0000001300)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb(blowfish)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000ff8000)="0a0775b0", 0x4) r1 = accept$alg(r0, 0x0, 0x0) sendmmsg$alg(r1, &(0x7f0000003e80), 0x0, 0x0) recvmsg(r1, &(0x7f0000000000)={&(0x7f0000f7ffa8)=@alg, 0x61, &(0x7f0000000140)=[{&(0x7f0000000200)=""/4096, 0xfffffe45}], 0x1, &(0x7f0000fb3fa9)=""/87, 0x57}, 0x0) [ 614.278042] binder: release 21699:21708 transaction 337 out, still active 04:01:40 executing program 4: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) recvmsg(0xffffffffffffffff, &(0x7f00000036c0)={&(0x7f0000000180)=@can, 0xfd28, &(0x7f00000035c0), 0x0, &(0x7f0000003680)=""/41, 0x29}, 0x0) bind$alg(r0, &(0x7f0000001300)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb(blowfish)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000ff8000)="0a0775b0", 0x4) r1 = accept$alg(r0, 0x0, 0x0) sendmmsg$alg(r1, &(0x7f0000003e80)=[{0x0, 0x0, &(0x7f0000002a80), 0x167, &(0x7f0000000100)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x0) recvmsg(r1, &(0x7f0000000000)={&(0x7f0000f7ffa8)=@alg, 0x61, &(0x7f0000000140)=[{&(0x7f0000000200)=""/4096, 0xfffffe45}], 0x1, &(0x7f0000fb3fa9)=""/87, 0x57}, 0x0) 04:01:40 executing program 2: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000440)=@updpolicy={0xb8, 0x19, 0x523, 0x0, 0x0, {{@in=@multicast2, @in6=@empty={[0x0, 0x0, 0x2f00000000000000]}, 0x0, 0x0, 0x0, 0x0, 0xa}}}, 0xb8}}, 0x0) [ 614.506577] binder: BINDER_SET_CONTEXT_MGR already set [ 614.511907] binder: 21740:21747 ioctl 40046207 0 returned -16 04:01:40 executing program 1: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) recvmsg(0xffffffffffffffff, &(0x7f00000036c0)={&(0x7f0000000180)=@can, 0xfd28, &(0x7f00000035c0), 0x0, &(0x7f0000003680)=""/41, 0x29}, 0x0) bind$alg(r0, &(0x7f0000001300)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb(blowfish)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000ff8000)="0a0775b0", 0x4) r1 = accept$alg(r0, 0x0, 0x0) sendmmsg$alg(r1, &(0x7f0000003e80)=[{0x0, 0x0, 0x0, 0x0, &(0x7f0000000100)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x0) recvmsg(r1, &(0x7f0000000000)={&(0x7f0000f7ffa8)=@alg, 0x61, &(0x7f0000000140)=[{&(0x7f0000000200)=""/4096, 0xfffffe45}], 0x1, &(0x7f0000fb3fa9)=""/87, 0x57}, 0x0) [ 614.597503] binder: 21740:21750 BC_ACQUIRE_DONE u0000000000000000 no match [ 614.641564] binder: 21740:21750 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 04:01:40 executing program 5: r0 = socket$inet6(0xa, 0x2, 0x0) r1 = syz_open_dev$mice(&(0x7f00000002c0)='/dev/input/mice\x00', 0x0, 0x0) ioctl$PPPOEIOCDFWD(r1, 0xb101, 0x0) syz_genetlink_get_family_id$nbd(&(0x7f0000000480)='nbd\x00') getsockopt$inet6_IPV6_XFRM_POLICY(r0, 0x29, 0x23, &(0x7f0000000340)={{{@in=@local, @in=@loopback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@local}, 0x0, @in=@remote}}, &(0x7f0000000140)=0xe8) connect$can_bcm(0xffffffffffffffff, &(0x7f00000001c0), 0x10) bind$inet6(r0, &(0x7f0000000040)={0xa, 0x4e24}, 0x1c) lsetxattr$security_ima(&(0x7f0000000280)='./file0\x00', &(0x7f0000000440)='security.ima\x00', 0x0, 0x0, 0x1) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clock_gettime(0x0, &(0x7f0000000100)={0x0, 0x0}) r4 = openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) bind(r4, &(0x7f0000000580)=@can={0x1d, r2}, 0x80) clock_gettime(0x3, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff}) ppoll(&(0x7f0000000000)=[{r0, 0x41a, 0x59020000}], 0x1, &(0x7f0000000200)={0x0, r3+30000000}, &(0x7f0000000240), 0x8) connect$inet6(r0, &(0x7f0000000080)={0xa, 0x4e24, 0x0, @ipv4={[], [], @loopback}}, 0x1c) readv(0xffffffffffffffff, 0x0, 0x0) sendmmsg(r0, &(0x7f00000092c0), 0x4ff, 0x0) connect$pptp(r5, &(0x7f00000004c0)={0x18, 0x2, {0x0, @multicast1}}, 0x1e) [ 615.214341] binder: release 21740:21747 transaction 340 out, still active [ 616.724383] net_ratelimit: 18 callbacks suppressed [ 616.724393] protocol 88fb is buggy, dev hsr_slave_0 [ 616.734508] protocol 88fb is buggy, dev hsr_slave_1 [ 616.884365] protocol 88fb is buggy, dev hsr_slave_0 [ 616.889468] protocol 88fb is buggy, dev hsr_slave_1 [ 616.964419] protocol 88fb is buggy, dev hsr_slave_0 [ 616.969511] protocol 88fb is buggy, dev hsr_slave_1 [ 616.974703] protocol 88fb is buggy, dev hsr_slave_0 [ 616.979754] protocol 88fb is buggy, dev hsr_slave_1 04:01:42 executing program 3: r0 = gettid() ioctl$TIOCLINUX3(0xffffffffffffffff, 0x541c, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) openat$ptmx(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$PIO_SCRNMAP(0xffffffffffffffff, 0x4b41, 0x0) chmod(0x0, 0x0) timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) getresuid(0x0, 0x0, 0x0) ioctl$TIOCSETD(0xffffffffffffffff, 0x5423, 0x0) sendmsg$netlink(r1, 0x0, 0x0) timer_settime(0x0, 0x0, &(0x7f0000000080)={{0x0, 0x1c9c380}, {0x0, 0x9}}, 0x0) ioctl$TIOCSETD(0xffffffffffffffff, 0x5423, 0x0) setsockopt$netlink_NETLINK_BROADCAST_ERROR(0xffffffffffffffff, 0x10e, 0x4, 0x0, 0x0) getsockopt$sock_linger(0xffffffffffffffff, 0x1, 0xd, 0x0, 0x0) tkill(r0, 0x1000000000016) 04:01:42 executing program 4: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) recvmsg(0xffffffffffffffff, 0x0, 0x0) bind$alg(r0, &(0x7f0000001300)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb(blowfish)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000ff8000)="0a0775b0", 0x4) r1 = accept$alg(r0, 0x0, 0x0) sendmmsg$alg(r1, &(0x7f0000003e80)=[{0x0, 0x0, &(0x7f0000002a80), 0x167, &(0x7f0000000100)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x0) recvmsg(r1, &(0x7f0000000000)={&(0x7f0000f7ffa8)=@alg, 0x61, &(0x7f0000000140)=[{&(0x7f0000000200)=""/4096, 0xfffffe45}], 0x1, &(0x7f0000fb3fa9)=""/87, 0x57}, 0x0) 04:01:42 executing program 2: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000440)=@updpolicy={0xb8, 0x19, 0x523, 0x0, 0x0, {{@in=@multicast2, @in6=@empty={[0x0, 0x0, 0x6000000000000000]}, 0x0, 0x0, 0x0, 0x0, 0xa}}}, 0xb8}}, 0x0) 04:01:42 executing program 1: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) recvmsg(0xffffffffffffffff, &(0x7f00000036c0)={&(0x7f0000000180)=@can, 0xfd28, &(0x7f00000035c0), 0x0, &(0x7f0000003680)=""/41, 0x29}, 0x0) bind$alg(r0, &(0x7f0000001300)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb(blowfish)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000ff8000)="0a0775b0", 0x4) r1 = accept$alg(r0, 0x0, 0x0) sendmmsg$alg(r1, &(0x7f0000003e80)=[{0x0, 0x0, 0x0, 0x0, &(0x7f0000000100)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x0) recvmsg(r1, &(0x7f0000000000)={&(0x7f0000f7ffa8)=@alg, 0x61, &(0x7f0000000140)=[{&(0x7f0000000200)=""/4096, 0xfffffe45}], 0x1, &(0x7f0000fb3fa9)=""/87, 0x57}, 0x0) 04:01:42 executing program 0: r0 = perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) setxattr$security_smack_entry(&(0x7f0000000380)='./file0\x00', &(0x7f0000000480)='security.SMACK64IPIN\x00', &(0x7f0000000540)='^vboxnet1^\x00', 0xb, 0x1) bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={0xffffffffffffffff, &(0x7f0000000040), 0x0, 0x1}, 0x20) unlink(&(0x7f0000000900)='./file0/file0\x00') r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, &(0x7f00000006c0)={0x0}) ioctl$BINDER_GET_NODE_DEBUG_INFO(r1, 0xc018620b, &(0x7f0000000640)={r3}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f00000000c0)=[@enter_looper], 0x48, 0x0, &(0x7f0000000700)="2ba063fb309ec7fdbfb08e6e91baee7d7d4599fe14129a4d426834556ae420e087d59c0c7be7fcad1abb7e1f8f446f373f611ca1ee9c2231708e18a47bc68a2a79a0b48931f6ff6d"}) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x1) prctl$PR_SET_NAME(0xf, &(0x7f00000004c0)='/group.stat\x00') ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, &(0x7f0000000780)}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f0000000680)}) ioctl$FS_IOC_FIEMAP(r2, 0xc020660b, &(0x7f0000000b80)=ANY=[@ANYBLOB="0000010000000000200000000000000005000000010000000a00000000000000ff030000000000001a0a000000000000050000000000000000000000000000000000000000000000080000000000000000000000000000000800000000000000ffff0000000000000100008000000000000000000000000000000000000000000000000000000000000000000000000008000000000000003f0000000000000008000000000000000000000000000000000000000000800800000000000000000000000000000200000000000000000400000000000000000000010000000000000000000000000000000000000002110000000000000000000000000000cc0000000000000000000000000000001b0000000000000000000000000000000000000000000000841400000000000000000000000000000300000000000000feffffffffffffff000000000000000000000000000000000000000000000000020000000000000000000000000000000600000000000000ff01000000000000040000000000000000000000000000000000000000000000000400000000000000000000000000007be70000000000000900000000000000ff7f0000000000000000000000000000000000000000000004180000000000000000000000000000ffffffff0000000081000000000000000600000000000000000000000000000000000000000000000400000000000000000000000000000002000000000000000500000000000000ff7fffffffffffff0000000000000000000000000000000004040000000000000000000000000000"]) r5 = creat(&(0x7f00000000c0)='./file0\x00', 0x0) openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000100)='/group.stat\x00', 0x2761, 0x0) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000080), 0xffffffffffffffff) getpid() fallocate(r0, 0x0, 0x0, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x2f, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) memfd_create(&(0x7f0000000080)='!proccgroup\x00', 0x0) ioctl$sock_inet_SIOCSIFPFLAGS(0xffffffffffffffff, 0x8934, &(0x7f0000000400)={'veth0_to_bridge\x00', 0x100}) accept(r5, &(0x7f0000000580)=@alg, &(0x7f0000000600)=0x80) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x2400, 0x8000) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000008c0)={0x2c, 0x0, &(0x7f0000000780)=[@acquire_done={0x40106309, r4, 0x2}, @clear_death={0x400c630f, 0x1, 0x3}, @release={0x40046306, 0x2}], 0xc1, 0x0, &(0x7f00000007c0)="859547f83b9b058a973a491d7e6378544744f2b56b02270a2f78214a936e9afb25cd94695643af6563f86771aa9621b9f30f2ca538b018247a633c28ee01e03b4639679311117971e60dc1538f34e961ae301463172c41754be988f6beb0ce4d83c69f86c236d29520e6cdaf5dbb60404c66d63315ff287deac8632781d0197ef1f81314da0a1ed90b681842cf85a41b496ce0a7a6f5aa4b9b23483eea8861be89b3398c6aec3349174f9cdc9de34df361ac9bf7afd8566849487c3c0a1e3aaacd"}) 04:01:42 executing program 5: r0 = socket$inet6(0xa, 0x2, 0x0) r1 = syz_open_dev$mice(&(0x7f00000002c0)='/dev/input/mice\x00', 0x0, 0x0) ioctl$PPPOEIOCDFWD(r1, 0xb101, 0x0) syz_genetlink_get_family_id$nbd(&(0x7f0000000480)='nbd\x00') getsockopt$inet6_IPV6_XFRM_POLICY(r0, 0x29, 0x23, &(0x7f0000000340)={{{@in=@local, @in=@loopback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@local}, 0x0, @in=@remote}}, &(0x7f0000000140)=0xe8) connect$can_bcm(0xffffffffffffffff, &(0x7f00000001c0), 0x10) bind$inet6(r0, &(0x7f0000000040)={0xa, 0x4e24}, 0x1c) lsetxattr$security_ima(&(0x7f0000000280)='./file0\x00', &(0x7f0000000440)='security.ima\x00', 0x0, 0x0, 0x1) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clock_gettime(0x0, &(0x7f0000000100)={0x0, 0x0}) r4 = openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) bind(r4, &(0x7f0000000580)=@can={0x1d, r2}, 0x80) clock_gettime(0x3, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff}) ppoll(&(0x7f0000000000)=[{r0, 0x41a, 0x64000000}], 0x1, &(0x7f0000000200)={0x0, r3+30000000}, &(0x7f0000000240), 0x8) connect$inet6(r0, &(0x7f0000000080)={0xa, 0x4e24, 0x0, @ipv4={[], [], @loopback}}, 0x1c) readv(0xffffffffffffffff, 0x0, 0x0) sendmmsg(r0, &(0x7f00000092c0), 0x4ff, 0x0) connect$pptp(r5, &(0x7f00000004c0)={0x18, 0x2, {0x0, @multicast1}}, 0x1e) 04:01:42 executing program 4: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) recvmsg(0xffffffffffffffff, &(0x7f00000036c0)={0x0, 0x0, &(0x7f00000035c0), 0x0, &(0x7f0000003680)=""/41, 0x29}, 0x0) bind$alg(r0, &(0x7f0000001300)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb(blowfish)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000ff8000)="0a0775b0", 0x4) r1 = accept$alg(r0, 0x0, 0x0) sendmmsg$alg(r1, &(0x7f0000003e80)=[{0x0, 0x0, &(0x7f0000002a80), 0x167, &(0x7f0000000100)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x0) recvmsg(r1, &(0x7f0000000000)={&(0x7f0000f7ffa8)=@alg, 0x61, &(0x7f0000000140)=[{&(0x7f0000000200)=""/4096, 0xfffffe45}], 0x1, &(0x7f0000fb3fa9)=""/87, 0x57}, 0x0) 04:01:43 executing program 1: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) recvmsg(0xffffffffffffffff, &(0x7f00000036c0)={&(0x7f0000000180)=@can, 0xfd28, &(0x7f00000035c0), 0x0, &(0x7f0000003680)=""/41, 0x29}, 0x0) bind$alg(r0, &(0x7f0000001300)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb(blowfish)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000ff8000)="0a0775b0", 0x4) r1 = accept$alg(r0, 0x0, 0x0) sendmmsg$alg(r1, &(0x7f0000003e80)=[{0x0, 0x0, 0x0, 0x0, &(0x7f0000000100)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x0) recvmsg(r1, &(0x7f0000000000)={&(0x7f0000f7ffa8)=@alg, 0x61, &(0x7f0000000140)=[{&(0x7f0000000200)=""/4096, 0xfffffe45}], 0x1, &(0x7f0000fb3fa9)=""/87, 0x57}, 0x0) 04:01:43 executing program 2: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000440)=@updpolicy={0xb8, 0x19, 0x523, 0x0, 0x0, {{@in=@multicast2, @in6=@empty={[0x0, 0x0, 0x80ffffff00000000]}, 0x0, 0x0, 0x0, 0x0, 0xa}}}, 0xb8}}, 0x0) [ 617.277884] binder: BINDER_SET_CONTEXT_MGR already set [ 617.283290] binder: 21767:21780 ioctl 40046207 0 returned -16 [ 617.323688] binder_thread_write: 2 callbacks suppressed [ 617.323702] binder: 21767:21780 Release 1 refcount change on invalid ref 1 ret -22 04:01:43 executing program 3: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000000)=@filter={'filter\x00', 0xe, 0x1, 0x18c, [0x0, 0x20000180, 0x200001b0, 0x200002b4], 0x0, 0x0, &(0x7f0000000240)=ANY=[@ANYBLOB="0000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000feffffffedaa6b7a69f0b69c1e56953c010000000b0000000000000000006263736830000000000000d490ee36f4d90000000000626373683000000000000000000000006263736630000000000000000000000069666230000000000000000000000000000000000000000000000000aaaaaaaaaa000000000000000000ac000000ac000000d40000006c696d697400000000000000000000000000000000000000000000000000000018000000000000000000000000000000000041554449540097507b3500000000000000000000000000000000000000000000040000000000000000000000000081000000e30000000000000000000000000000000000000000000000000000000000000000000000001ed330740ec3d315a3233f4a6c9ead3e4091a437aeb70b03fb00923d398b4fd3e4ed270d40ac"]}, 0x204) 04:01:43 executing program 4: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) recvmsg(0xffffffffffffffff, &(0x7f00000036c0)={0x0, 0x0, &(0x7f00000035c0), 0x0, &(0x7f0000003680)=""/41, 0x29}, 0x0) bind$alg(r0, &(0x7f0000001300)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb(blowfish)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000ff8000)="0a0775b0", 0x4) r1 = accept$alg(r0, 0x0, 0x0) sendmmsg$alg(r1, &(0x7f0000003e80)=[{0x0, 0x0, &(0x7f0000002a80), 0x167, &(0x7f0000000100)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x0) recvmsg(r1, &(0x7f0000000000)={&(0x7f0000f7ffa8)=@alg, 0x61, &(0x7f0000000140)=[{&(0x7f0000000200)=""/4096, 0xfffffe45}], 0x1, &(0x7f0000fb3fa9)=""/87, 0x57}, 0x0) [ 617.483601] binder: 21767:21786 BC_ACQUIRE_DONE u0000000000000000 no match [ 617.512773] kernel msg: ebtables bug: please report to author: EBT_ENTRY_OR_ENTRIES shouldn't be set in distinguisher [ 617.520148] binder: 21767:21786 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 04:01:43 executing program 1: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) recvmsg(0xffffffffffffffff, &(0x7f00000036c0)={&(0x7f0000000180)=@can, 0xfd28, &(0x7f00000035c0), 0x0, &(0x7f0000003680)=""/41, 0x29}, 0x0) bind$alg(r0, &(0x7f0000001300)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb(blowfish)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000ff8000)="0a0775b0", 0x4) r1 = accept$alg(r0, 0x0, 0x0) sendmmsg$alg(r1, &(0x7f0000003e80)=[{0x0, 0x0, &(0x7f0000002a80)}], 0x1, 0x0) recvmsg(r1, &(0x7f0000000000)={&(0x7f0000f7ffa8)=@alg, 0x61, &(0x7f0000000140)=[{&(0x7f0000000200)=""/4096, 0xfffffe45}], 0x1, &(0x7f0000fb3fa9)=""/87, 0x57}, 0x0) 04:01:43 executing program 2: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000440)=@updpolicy={0xb8, 0x19, 0x523, 0x0, 0x0, {{@in=@multicast2, @in6=@empty={[0x0, 0x0, 0x9effffff00000000]}, 0x0, 0x0, 0x0, 0x0, 0xa}}}, 0xb8}}, 0x0) [ 617.567303] binder: 21767:21786 Release 1 refcount change on invalid ref 2 ret -22 04:01:43 executing program 3: r0 = syz_open_dev$dri(&(0x7f0000000100)='/dev/dri/card#\x00', 0x0, 0x0) futex(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) mmap(&(0x7f0000701000/0x2000)=nil, 0x2000, 0x0, 0x20012, r0, 0x0) 04:01:43 executing program 4: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) recvmsg(0xffffffffffffffff, &(0x7f00000036c0)={0x0, 0x0, &(0x7f00000035c0), 0x0, &(0x7f0000003680)=""/41, 0x29}, 0x0) bind$alg(r0, &(0x7f0000001300)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb(blowfish)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000ff8000)="0a0775b0", 0x4) r1 = accept$alg(r0, 0x0, 0x0) sendmmsg$alg(r1, &(0x7f0000003e80)=[{0x0, 0x0, &(0x7f0000002a80), 0x167, &(0x7f0000000100)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x0) recvmsg(r1, &(0x7f0000000000)={&(0x7f0000f7ffa8)=@alg, 0x61, &(0x7f0000000140)=[{&(0x7f0000000200)=""/4096, 0xfffffe45}], 0x1, &(0x7f0000fb3fa9)=""/87, 0x57}, 0x0) 04:01:43 executing program 2: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000440)=@updpolicy={0xb8, 0x19, 0x523, 0x0, 0x0, {{@in=@multicast2, @in6=@empty={[0x0, 0x0, 0xf0ffffff00000000]}, 0x0, 0x0, 0x0, 0x0, 0xa}}}, 0xb8}}, 0x0) [ 617.924324] protocol 88fb is buggy, dev hsr_slave_0 [ 617.929523] protocol 88fb is buggy, dev hsr_slave_1 [ 617.970862] binder: release 21767:21780 transaction 343 out, still active 04:01:43 executing program 0: r0 = perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) setxattr$security_smack_entry(&(0x7f0000000380)='./file0\x00', &(0x7f0000000480)='security.SMACK64IPIN\x00', &(0x7f0000000540)='^vboxnet1^\x00', 0xb, 0x1) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r1, 0x0, 0x0, 0x1}, 0x20) unlink(&(0x7f0000000900)='./file0/file0\x00') r2 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r3 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r3, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, &(0x7f00000006c0)={0x0}) ioctl$BINDER_GET_NODE_DEBUG_INFO(r2, 0xc018620b, &(0x7f0000000640)={r4}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f00000000c0)=[@enter_looper], 0x48, 0x0, &(0x7f0000000700)="2ba063fb309ec7fdbfb08e6e91baee7d7d4599fe14129a4d426834556ae420e087d59c0c7be7fcad1abb7e1f8f446f373f611ca1ee9c2231708e18a47bc68a2a79a0b48931f6ff6d"}) ioctl$BINDER_SET_CONTEXT_MGR(r3, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x1) prctl$PR_SET_NAME(0xf, &(0x7f00000004c0)='/group.stat\x00') ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, &(0x7f0000000780)}) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f0000000680)}) ioctl$FS_IOC_FIEMAP(r3, 0xc020660b, &(0x7f0000000b80)=ANY=[@ANYBLOB="0000010000000000200000000000000005000000010000000a00000000000000ff030000000000001a0a000000000000050000000000000000000000000000000000000000000000080000000000000000000000000000000800000000000000ffff0000000000000100008000000000000000000000000000000000000000000000000000000000000000000000000008000000000000003f0000000000000008000000000000000000000000000000000000000000800800000000000000000000000000000200000000000000000400000000000000000000010000000000000000000000000000000000000002110000000000000000000000000000cc0000000000000000000000000000001b0000000000000000000000000000000000000000000000841400000000000000000000000000000300000000000000feffffffffffffff000000000000000000000000000000000000000000000000020000000000000000000000000000000600000000000000ff01000000000000040000000000000000000000000000000000000000000000000400000000000000000000000000007be70000000000000900000000000000ff7f0000000000000000000000000000000000000000000004180000000000000000000000000000ffffffff0000000081000000000000000600000000000000000000000000000000000000000000000400000000000000000000000000000002000000000000000500000000000000ff7fffffffffffff0000000000000000000000000000000004040000000000000000000000000000"]) r6 = creat(&(0x7f00000000c0)='./file0\x00', 0x0) openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000100)='/group.stat\x00', 0x2761, 0x0) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000080), 0xffffffffffffffff) getpid() fallocate(r0, 0x0, 0x0, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x2f, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) memfd_create(&(0x7f0000000080)='!proccgroup\x00', 0x0) ioctl$sock_inet_SIOCSIFPFLAGS(0xffffffffffffffff, 0x8934, &(0x7f0000000400)={'veth0_to_bridge\x00', 0x100}) accept(r6, &(0x7f0000000580)=@alg, &(0x7f0000000600)=0x80) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x2400, 0x8000) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000008c0)={0x2c, 0x0, &(0x7f0000000780)=[@acquire_done={0x40106309, r5, 0x2}, @clear_death={0x400c630f, 0x1, 0x3}, @release={0x40046306, 0x2}], 0xc1, 0x0, &(0x7f00000007c0)="859547f83b9b058a973a491d7e6378544744f2b56b02270a2f78214a936e9afb25cd94695643af6563f86771aa9621b9f30f2ca538b018247a633c28ee01e03b4639679311117971e60dc1538f34e961ae301463172c41754be988f6beb0ce4d83c69f86c236d29520e6cdaf5dbb60404c66d63315ff287deac8632781d0197ef1f81314da0a1ed90b681842cf85a41b496ce0a7a6f5aa4b9b23483eea8861be89b3398c6aec3349174f9cdc9de34df361ac9bf7afd8566849487c3c0a1e3aaacd"}) 04:01:43 executing program 5: r0 = socket$inet6(0xa, 0x2, 0x0) r1 = syz_open_dev$mice(&(0x7f00000002c0)='/dev/input/mice\x00', 0x0, 0x0) ioctl$PPPOEIOCDFWD(r1, 0xb101, 0x0) syz_genetlink_get_family_id$nbd(&(0x7f0000000480)='nbd\x00') getsockopt$inet6_IPV6_XFRM_POLICY(r0, 0x29, 0x23, &(0x7f0000000340)={{{@in=@local, @in=@loopback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@local}, 0x0, @in=@remote}}, &(0x7f0000000140)=0xe8) connect$can_bcm(0xffffffffffffffff, &(0x7f00000001c0), 0x10) bind$inet6(r0, &(0x7f0000000040)={0xa, 0x4e24}, 0x1c) lsetxattr$security_ima(&(0x7f0000000280)='./file0\x00', &(0x7f0000000440)='security.ima\x00', 0x0, 0x0, 0x1) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clock_gettime(0x0, &(0x7f0000000100)={0x0, 0x0}) r4 = openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) bind(r4, &(0x7f0000000580)=@can={0x1d, r2}, 0x80) clock_gettime(0x3, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff}) ppoll(&(0x7f0000000000)=[{r0, 0x41a, 0xfcffffff}], 0x1, &(0x7f0000000200)={0x0, r3+30000000}, &(0x7f0000000240), 0x8) connect$inet6(r0, &(0x7f0000000080)={0xa, 0x4e24, 0x0, @ipv4={[], [], @loopback}}, 0x1c) readv(0xffffffffffffffff, 0x0, 0x0) sendmmsg(r0, &(0x7f00000092c0), 0x4ff, 0x0) connect$pptp(r5, &(0x7f00000004c0)={0x18, 0x2, {0x0, @multicast1}}, 0x1e) 04:01:43 executing program 1: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) recvmsg(0xffffffffffffffff, &(0x7f00000036c0)={&(0x7f0000000180)=@can, 0xfd28, &(0x7f00000035c0), 0x0, &(0x7f0000003680)=""/41, 0x29}, 0x0) bind$alg(r0, &(0x7f0000001300)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb(blowfish)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000ff8000)="0a0775b0", 0x4) r1 = accept$alg(r0, 0x0, 0x0) sendmmsg$alg(r1, &(0x7f0000003e80)=[{0x0, 0x0, &(0x7f0000002a80)}], 0x1, 0x0) recvmsg(r1, &(0x7f0000000000)={&(0x7f0000f7ffa8)=@alg, 0x61, &(0x7f0000000140)=[{&(0x7f0000000200)=""/4096, 0xfffffe45}], 0x1, &(0x7f0000fb3fa9)=""/87, 0x57}, 0x0) 04:01:43 executing program 3: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CREATE_PIT2(r1, 0x4040ae77, &(0x7f00000001c0)) syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000080)=[@textreal={0x8, &(0x7f00000000c0)="0f0f1ba00873850f01d1ba4000b8a989ef660f2ac3ba4000b85700eff3cfbad00466b8b200000066ef3e0f38003abaf80c66b8a206ef8766efbafc0cec", 0x3d}], 0x1, 0x0, 0x0, 0x0) ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60) ioctl$KVM_SET_PIT(r1, 0x8048ae66, &(0x7f0000000240)) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r2, &(0x7f0000fdd000/0x18000)=nil, &(0x7f0000000100)=[@textreal={0x8, 0x0}], 0x1, 0x0, 0x0, 0x66) setsockopt$bt_l2cap_L2CAP_OPTIONS(0xffffffffffffffff, 0x6, 0x1, &(0x7f0000000000)={0x46e0, 0x0, 0x1, 0x3f, 0x3f, 0x20, 0x6}, 0xc) ioctl$KVM_RUN(r2, 0xae80, 0x0) 04:01:43 executing program 2: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000440)=@updpolicy={0xb8, 0x19, 0x523, 0x0, 0x0, {{@in=@multicast2, @in6=@empty={[0x0, 0x0, 0xfcffffff00000000]}, 0x0, 0x0, 0x0, 0x0, 0xa}}}, 0xb8}}, 0x0) 04:01:43 executing program 4: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) recvmsg(0xffffffffffffffff, &(0x7f00000036c0)={&(0x7f0000000180)=@can, 0x80, 0x0, 0x0, &(0x7f0000003680)=""/41, 0x29}, 0x0) bind$alg(r0, &(0x7f0000001300)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb(blowfish)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000ff8000)="0a0775b0", 0x4) r1 = accept$alg(r0, 0x0, 0x0) sendmmsg$alg(r1, &(0x7f0000003e80)=[{0x0, 0x0, &(0x7f0000002a80), 0x167, &(0x7f0000000100)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x0) recvmsg(r1, &(0x7f0000000000)={&(0x7f0000f7ffa8)=@alg, 0x61, &(0x7f0000000140)=[{&(0x7f0000000200)=""/4096, 0xfffffe45}], 0x1, &(0x7f0000fb3fa9)=""/87, 0x57}, 0x0) [ 618.130428] binder: BINDER_SET_CONTEXT_MGR already set [ 618.137739] binder: 21813:21816 ioctl 40046207 0 returned -16 [ 618.148711] binder: 21813:21816 Release 1 refcount change on invalid ref 1 ret -22 04:01:44 executing program 2: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000440)=@updpolicy={0xb8, 0x19, 0x523, 0x0, 0x0, {{@in=@multicast2, @in6=@empty={[0x0, 0x0, 0xffffff7f00000000]}, 0x0, 0x0, 0x0, 0x0, 0xa}}}, 0xb8}}, 0x0) [ 618.255837] binder: 21813:21826 BC_ACQUIRE_DONE u0000000000000000 no match [ 618.288562] binder: 21813:21826 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 04:01:44 executing program 4: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) recvmsg(0xffffffffffffffff, &(0x7f00000036c0)={&(0x7f0000000180)=@can, 0x80, 0x0, 0x0, &(0x7f0000003680)=""/41, 0x29}, 0x0) bind$alg(r0, &(0x7f0000001300)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb(blowfish)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000ff8000)="0a0775b0", 0x4) r1 = accept$alg(r0, 0x0, 0x0) sendmmsg$alg(r1, &(0x7f0000003e80)=[{0x0, 0x0, &(0x7f0000002a80), 0x167, &(0x7f0000000100)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x0) recvmsg(r1, &(0x7f0000000000)={&(0x7f0000f7ffa8)=@alg, 0x61, &(0x7f0000000140)=[{&(0x7f0000000200)=""/4096, 0xfffffe45}], 0x1, &(0x7f0000fb3fa9)=""/87, 0x57}, 0x0) [ 618.312807] binder: 21813:21826 Release 1 refcount change on invalid ref 2 ret -22 04:01:44 executing program 1: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) recvmsg(0xffffffffffffffff, &(0x7f00000036c0)={&(0x7f0000000180)=@can, 0xfd28, &(0x7f00000035c0), 0x0, &(0x7f0000003680)=""/41, 0x29}, 0x0) bind$alg(r0, &(0x7f0000001300)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb(blowfish)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000ff8000)="0a0775b0", 0x4) r1 = accept$alg(r0, 0x0, 0x0) sendmmsg$alg(r1, &(0x7f0000003e80)=[{0x0, 0x0, &(0x7f0000002a80)}], 0x1, 0x0) recvmsg(r1, &(0x7f0000000000)={&(0x7f0000f7ffa8)=@alg, 0x61, &(0x7f0000000140)=[{&(0x7f0000000200)=""/4096, 0xfffffe45}], 0x1, &(0x7f0000fb3fa9)=""/87, 0x57}, 0x0) 04:01:44 executing program 2: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000440)=@updpolicy={0xb8, 0x19, 0x523, 0x0, 0x0, {{@in=@multicast2, @in6=@empty={[0x0, 0x0, 0xfffffffffffff000]}, 0x0, 0x0, 0x0, 0x0, 0xa}}}, 0xb8}}, 0x0) 04:01:44 executing program 4: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) recvmsg(0xffffffffffffffff, &(0x7f00000036c0)={&(0x7f0000000180)=@can, 0x80, 0x0, 0x0, &(0x7f0000003680)=""/41, 0x29}, 0x0) bind$alg(r0, &(0x7f0000001300)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb(blowfish)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000ff8000)="0a0775b0", 0x4) r1 = accept$alg(r0, 0x0, 0x0) sendmmsg$alg(r1, &(0x7f0000003e80)=[{0x0, 0x0, &(0x7f0000002a80), 0x167, &(0x7f0000000100)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x0) recvmsg(r1, &(0x7f0000000000)={&(0x7f0000f7ffa8)=@alg, 0x61, &(0x7f0000000140)=[{&(0x7f0000000200)=""/4096, 0xfffffe45}], 0x1, &(0x7f0000fb3fa9)=""/87, 0x57}, 0x0) 04:01:44 executing program 1: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) recvmsg(0xffffffffffffffff, &(0x7f00000036c0)={&(0x7f0000000180)=@can, 0xfd28, &(0x7f00000035c0), 0x0, &(0x7f0000003680)=""/41, 0x29}, 0x0) bind$alg(r0, &(0x7f0000001300)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb(blowfish)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000ff8000)="0a0775b0", 0x4) r1 = accept$alg(r0, 0x0, 0x0) sendmmsg$alg(r1, &(0x7f0000003e80)=[{0x0, 0x0, &(0x7f0000002a80), 0x0, &(0x7f0000000100)}], 0x1, 0x0) recvmsg(r1, &(0x7f0000000000)={&(0x7f0000f7ffa8)=@alg, 0x61, &(0x7f0000000140)=[{&(0x7f0000000200)=""/4096, 0xfffffe45}], 0x1, &(0x7f0000fb3fa9)=""/87, 0x57}, 0x0) 04:01:44 executing program 0: r0 = perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) setxattr$security_smack_entry(&(0x7f0000000380)='./file0\x00', &(0x7f0000000480)='security.SMACK64IPIN\x00', &(0x7f0000000540)='^vboxnet1^\x00', 0xb, 0x1) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r1, 0x0, 0x0, 0x1}, 0x20) unlink(&(0x7f0000000900)='./file0/file0\x00') r2 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r3 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r3, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, &(0x7f00000006c0)={0x0}) ioctl$BINDER_GET_NODE_DEBUG_INFO(r2, 0xc018620b, &(0x7f0000000640)={r4}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f00000000c0)=[@enter_looper], 0x48, 0x0, &(0x7f0000000700)="2ba063fb309ec7fdbfb08e6e91baee7d7d4599fe14129a4d426834556ae420e087d59c0c7be7fcad1abb7e1f8f446f373f611ca1ee9c2231708e18a47bc68a2a79a0b48931f6ff6d"}) ioctl$BINDER_SET_CONTEXT_MGR(r3, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x1) prctl$PR_SET_NAME(0xf, &(0x7f00000004c0)='/group.stat\x00') ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, &(0x7f0000000780)}) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f0000000680)}) ioctl$FS_IOC_FIEMAP(r3, 0xc020660b, &(0x7f0000000b80)=ANY=[@ANYBLOB="0000010000000000200000000000000005000000010000000a00000000000000ff030000000000001a0a000000000000050000000000000000000000000000000000000000000000080000000000000000000000000000000800000000000000ffff0000000000000100008000000000000000000000000000000000000000000000000000000000000000000000000008000000000000003f0000000000000008000000000000000000000000000000000000000000800800000000000000000000000000000200000000000000000400000000000000000000010000000000000000000000000000000000000002110000000000000000000000000000cc0000000000000000000000000000001b0000000000000000000000000000000000000000000000841400000000000000000000000000000300000000000000feffffffffffffff000000000000000000000000000000000000000000000000020000000000000000000000000000000600000000000000ff01000000000000040000000000000000000000000000000000000000000000000400000000000000000000000000007be70000000000000900000000000000ff7f0000000000000000000000000000000000000000000004180000000000000000000000000000ffffffff0000000081000000000000000600000000000000000000000000000000000000000000000400000000000000000000000000000002000000000000000500000000000000ff7fffffffffffff0000000000000000000000000000000004040000000000000000000000000000"]) r6 = creat(&(0x7f00000000c0)='./file0\x00', 0x0) openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000100)='/group.stat\x00', 0x2761, 0x0) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000080), 0xffffffffffffffff) getpid() fallocate(r0, 0x0, 0x0, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x2f, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) memfd_create(&(0x7f0000000080)='!proccgroup\x00', 0x0) ioctl$sock_inet_SIOCSIFPFLAGS(0xffffffffffffffff, 0x8934, &(0x7f0000000400)={'veth0_to_bridge\x00', 0x100}) accept(r6, &(0x7f0000000580)=@alg, &(0x7f0000000600)=0x80) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x2400, 0x8000) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000008c0)={0x2c, 0x0, &(0x7f0000000780)=[@acquire_done={0x40106309, r5, 0x2}, @clear_death={0x400c630f, 0x1, 0x3}, @release={0x40046306, 0x2}], 0xc1, 0x0, &(0x7f00000007c0)="859547f83b9b058a973a491d7e6378544744f2b56b02270a2f78214a936e9afb25cd94695643af6563f86771aa9621b9f30f2ca538b018247a633c28ee01e03b4639679311117971e60dc1538f34e961ae301463172c41754be988f6beb0ce4d83c69f86c236d29520e6cdaf5dbb60404c66d63315ff287deac8632781d0197ef1f81314da0a1ed90b681842cf85a41b496ce0a7a6f5aa4b9b23483eea8861be89b3398c6aec3349174f9cdc9de34df361ac9bf7afd8566849487c3c0a1e3aaacd"}) [ 618.872731] binder: release 21813:21816 transaction 346 out, still active 04:01:44 executing program 5: r0 = socket$inet6(0xa, 0x2, 0x0) r1 = syz_open_dev$mice(&(0x7f00000002c0)='/dev/input/mice\x00', 0x0, 0x0) ioctl$PPPOEIOCDFWD(r1, 0xb101, 0x0) syz_genetlink_get_family_id$nbd(&(0x7f0000000480)='nbd\x00') getsockopt$inet6_IPV6_XFRM_POLICY(r0, 0x29, 0x23, &(0x7f0000000340)={{{@in=@local, @in=@loopback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@local}, 0x0, @in=@remote}}, &(0x7f0000000140)=0xe8) connect$can_bcm(0xffffffffffffffff, &(0x7f00000001c0), 0x10) bind$inet6(r0, &(0x7f0000000040)={0xa, 0x4e24}, 0x1c) lsetxattr$security_ima(&(0x7f0000000280)='./file0\x00', &(0x7f0000000440)='security.ima\x00', 0x0, 0x0, 0x1) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clock_gettime(0x0, &(0x7f0000000100)={0x0, 0x0}) r4 = openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) bind(r4, &(0x7f0000000580)=@can={0x1d, r2}, 0x80) clock_gettime(0x3, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff}) ppoll(&(0x7f0000000000)=[{r0, 0x41a, 0xfffffffc}], 0x1, &(0x7f0000000200)={0x0, r3+30000000}, &(0x7f0000000240), 0x8) connect$inet6(r0, &(0x7f0000000080)={0xa, 0x4e24, 0x0, @ipv4={[], [], @loopback}}, 0x1c) readv(0xffffffffffffffff, 0x0, 0x0) sendmmsg(r0, &(0x7f00000092c0), 0x4ff, 0x0) connect$pptp(r5, &(0x7f00000004c0)={0x18, 0x2, {0x0, @multicast1}}, 0x1e) 04:01:44 executing program 2: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000440)=@updpolicy={0xb8, 0x19, 0x523, 0x0, 0x0, {{@in=@multicast2, @in6=@empty={[0x0, 0x0, 0xffffffffffffffff]}, 0x0, 0x0, 0x0, 0x0, 0xa}}}, 0xb8}}, 0x0) 04:01:44 executing program 4: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) recvmsg(0xffffffffffffffff, &(0x7f00000036c0)={&(0x7f0000000180)=@can, 0x80, &(0x7f00000035c0)}, 0x0) bind$alg(r0, &(0x7f0000001300)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb(blowfish)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000ff8000)="0a0775b0", 0x4) r1 = accept$alg(r0, 0x0, 0x0) sendmmsg$alg(r1, &(0x7f0000003e80)=[{0x0, 0x0, &(0x7f0000002a80), 0x167, &(0x7f0000000100)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x0) recvmsg(r1, &(0x7f0000000000)={&(0x7f0000f7ffa8)=@alg, 0x61, &(0x7f0000000140)=[{&(0x7f0000000200)=""/4096, 0xfffffe45}], 0x1, &(0x7f0000fb3fa9)=""/87, 0x57}, 0x0) 04:01:44 executing program 3: r0 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000140)='net/snmp\x00') r1 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ppp\x00', 0x0, 0x0) unshare(0x40000000) link(&(0x7f0000000000)='./file0\x00', &(0x7f0000000080)='./file0\x00') ioctl$LOOP_SET_FD(r2, 0x4c00, 0xffffffffffffffff) unlink(&(0x7f00000000c0)='./file0\x00') r3 = openat(r0, &(0x7f0000000400)='./file0\x00', 0x40001, 0x4) write$P9_RREADDIR(r2, &(0x7f0000000900)=ANY=[@ANYBLOB="68000000290200ff0340000804000000080000ffffffff0907002e2f66696c65302a020000000800000000000000070000000000005cd5431d2e2f66696c6531000200000004000000000800000000000000f107002e2f66696c6530000000000000000000000000dd6bc90000329d3e4dd1041a0d1d0af77cd681689bffeb8d873b492b6e95f1f57f000000b4dab138c9c2554c28acc1ae356de2138c9a96b402e860c3931698b2c018131f0ff7becc9437d0ddff7ff93e104fd5429157c82b56c4775615fc29255bd9fa3f503e61d979a269c06db6869eb38f078e38f5fe27ce73b04eac408cfb169e73c77935d0df596a420d12d87631608cb6e71955c4651e5242af4bd8c1c472cf6580fd7e7a8ef270f653bf585a4d3a4344d8e0c35b6bcc72acc2c2f7e9ca67ebd7867939ae7ca508cb31a75d8070b618806b02c4750000847d5a1811ed89e637d035d912f8c901da8b17413a4264ebae0cc46a83012643441e81df9730b2c23e3a10e42384bdf0eaeaae99d63c364386751652c7daf3455dc59552d8a5ed32bc2d5f95d3b94440f02929791db8f61f2a1c6f24c3840f000094647561be3409bc555565b6a883d19e4417c2deddfe05db459cb7097576eae90da632bc01340deb28c5ded4feb7dfb8879a8a7d2cb5a3b42fe4cdca29ec22b544650f75f0f1c93e68efe30064c2a9193ca558e5d89fc5a704000000323fc228ccf65817221247871002f60bd57f9d00aab75721410a709b027c62b33f2ca4ed10659f3de56b7dc7bb2553b805000000878a768dcbf46511a10b59ffe4d58155a9787fd2e4d3260726c8ce237527b027fe1da9db26e665d9aa0083aa174e0b065621593fa0d4df22a7fa36cef73bb623bb9b9ca3199d356f4cad4b23d8f9fb480c519a0f0a70ca234ff1c24e9df49a4e77996bfd8e0bae782bb6c22bdde0beceb29e5bb03649dfd40f3f11879683030e3763702056e1de18d91c90fcb6a3165356be226a2cb0"], 0x2c8) fstat(r1, &(0x7f0000000380)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) accept4$unix(r2, 0x0, &(0x7f0000000240), 0x80000) chown(&(0x7f0000000040)='./file0\x00', 0x0, r4) ioctl$int_in(r2, 0x5421, &(0x7f0000000480)) get_thread_area(&(0x7f0000000440)={0xa, 0x20000000, 0x3000, 0x0, 0xfffffffffffffffa, 0x0, 0x100000001, 0x62, 0x200}) pipe(&(0x7f00000008c0)) write$binfmt_script(r3, &(0x7f0000000280)=ANY=[@ANYBLOB="2321012e2f66696cf64da4074b7046d2f0836530202f6465762f707070002079616d300001178b002079616de38901178b000a9f9a90a94ed1"], 0x39) setsockopt$IP_VS_SO_SET_EDIT(r2, 0x0, 0x483, &(0x7f00000004c0)={0x0, @broadcast, 0x0, 0x1, 'lblcr\x00', 0x2, 0x7, 0x1}, 0x2c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r5 = inotify_init1(0x0) fcntl$setown(r5, 0x8, 0xffffffffffffffff) fcntl$getownex(r5, 0x10, &(0x7f0000000200)={0x0, 0x0}) ptrace$setopts(0x804206, r6, 0x8, 0x0) ptrace(0x4207, r6) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000000)={'yam0\x00\x01\x17\x8b\x00', 0x8001}) tkill(r6, 0x100019) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x60fd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r7 = openat$zero(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/zero\x00', 0x288000, 0x0) openat$loop_ctrl(0xffffffffffffff9c, 0x0, 0x0, 0x0) write$P9_RAUTH(r7, &(0x7f0000000100)={0x14, 0x67, 0x2, {0x10, 0x2, 0x4}}, 0x14) openat$vcs(0xffffffffffffff9c, &(0x7f0000000080)='/dev/vcs\x00', 0x0, 0x0) 04:01:44 executing program 1: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) recvmsg(0xffffffffffffffff, &(0x7f00000036c0)={&(0x7f0000000180)=@can, 0xfd28, &(0x7f00000035c0), 0x0, &(0x7f0000003680)=""/41, 0x29}, 0x0) bind$alg(r0, &(0x7f0000001300)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb(blowfish)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000ff8000)="0a0775b0", 0x4) r1 = accept$alg(r0, 0x0, 0x0) sendmmsg$alg(r1, &(0x7f0000003e80)=[{0x0, 0x0, &(0x7f0000002a80), 0x0, &(0x7f0000000100)}], 0x1, 0x0) recvmsg(r1, &(0x7f0000000000)={&(0x7f0000f7ffa8)=@alg, 0x61, &(0x7f0000000140)=[{&(0x7f0000000200)=""/4096, 0xfffffe45}], 0x1, &(0x7f0000fb3fa9)=""/87, 0x57}, 0x0) [ 619.059189] binder_send_failed_reply: 11 callbacks suppressed [ 619.059196] binder: send failed reply for transaction 286, target dead [ 619.073668] binder: send failed reply for transaction 289, target dead [ 619.083878] binder: send failed reply for transaction 292, target dead [ 619.130313] binder: send failed reply for transaction 295, target dead [ 619.152687] binder: send failed reply for transaction 298 to 21171:21186 [ 619.172307] binder: send failed reply for transaction 301, target dead 04:01:44 executing program 1: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) recvmsg(0xffffffffffffffff, &(0x7f00000036c0)={&(0x7f0000000180)=@can, 0xfd28, &(0x7f00000035c0), 0x0, &(0x7f0000003680)=""/41, 0x29}, 0x0) bind$alg(r0, &(0x7f0000001300)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb(blowfish)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000ff8000)="0a0775b0", 0x4) r1 = accept$alg(r0, 0x0, 0x0) sendmmsg$alg(r1, &(0x7f0000003e80)=[{0x0, 0x0, &(0x7f0000002a80), 0x0, &(0x7f0000000100)}], 0x1, 0x0) recvmsg(r1, &(0x7f0000000000)={&(0x7f0000f7ffa8)=@alg, 0x61, &(0x7f0000000140)=[{&(0x7f0000000200)=""/4096, 0xfffffe45}], 0x1, &(0x7f0000fb3fa9)=""/87, 0x57}, 0x0) [ 619.191305] binder: send failed reply for transaction 304, target dead [ 619.223376] binder: send failed reply for transaction 307, target dead 04:01:45 executing program 4: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) recvmsg(0xffffffffffffffff, &(0x7f00000036c0)={&(0x7f0000000180)=@can, 0xfd28, &(0x7f00000035c0), 0x0, &(0x7f0000003680)=""/41, 0x29}, 0x0) bind$alg(0xffffffffffffffff, &(0x7f0000001300)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb(blowfish)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000ff8000)="0a0775b0", 0x4) r1 = accept$alg(r0, 0x0, 0x0) sendmmsg$alg(r1, &(0x7f0000003e80)=[{0x0, 0x0, &(0x7f0000002a80), 0x167, &(0x7f0000000100)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x0) recvmsg(r1, &(0x7f0000000000)={&(0x7f0000f7ffa8)=@alg, 0x61, &(0x7f0000000140)=[{&(0x7f0000000200)=""/4096, 0xfffffe45}], 0x1, &(0x7f0000fb3fa9)=""/87, 0x57}, 0x0) 04:01:45 executing program 2: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000440)=@updpolicy={0xb8, 0x19, 0x523, 0x0, 0x0, {{@in=@multicast2, @in6=@empty={[0x0, 0x0, 0x0, 0x2]}, 0x0, 0x0, 0x0, 0x0, 0xa}}}, 0xb8}}, 0x0) [ 619.247887] binder: send failed reply for transaction 310, target dead [ 619.287724] binder: send failed reply for transaction 313, target dead [ 619.328998] binder: send failed reply for transaction 316, target dead [ 619.365411] binder: undelivered TRANSACTION_ERROR: 29189 04:01:45 executing program 1: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) recvmsg(0xffffffffffffffff, &(0x7f00000036c0)={&(0x7f0000000180)=@can, 0xfd28, &(0x7f00000035c0), 0x0, &(0x7f0000003680)=""/41, 0x29}, 0x0) bind$alg(r0, &(0x7f0000001300)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb(blowfish)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000ff8000)="0a0775b0", 0x4) r1 = accept$alg(r0, 0x0, 0x0) sendmmsg$alg(r1, &(0x7f0000003e80)=[{0x0, 0x0, &(0x7f0000002a80), 0x167, &(0x7f0000000100)=[@op={0x18}], 0x18}], 0x1, 0x0) recvmsg(r1, &(0x7f0000000000)={&(0x7f0000f7ffa8)=@alg, 0x61, &(0x7f0000000140)=[{&(0x7f0000000200)=""/4096, 0xfffffe45}], 0x1, &(0x7f0000fb3fa9)=""/87, 0x57}, 0x0) [ 619.438548] IPVS: ftp: loaded support on port[0] = 21 04:01:45 executing program 0: r0 = perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) setxattr$security_smack_entry(&(0x7f0000000380)='./file0\x00', &(0x7f0000000480)='security.SMACK64IPIN\x00', &(0x7f0000000540)='^vboxnet1^\x00', 0xb, 0x1) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r1, 0x0, 0x0, 0x1}, 0x20) unlink(&(0x7f0000000900)='./file0/file0\x00') r2 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r3 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r3, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, &(0x7f00000006c0)={0x0}) ioctl$BINDER_GET_NODE_DEBUG_INFO(r2, 0xc018620b, &(0x7f0000000640)={r4}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f00000000c0)=[@enter_looper], 0x48, 0x0, &(0x7f0000000700)="2ba063fb309ec7fdbfb08e6e91baee7d7d4599fe14129a4d426834556ae420e087d59c0c7be7fcad1abb7e1f8f446f373f611ca1ee9c2231708e18a47bc68a2a79a0b48931f6ff6d"}) ioctl$BINDER_SET_CONTEXT_MGR(r3, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x1) prctl$PR_SET_NAME(0xf, &(0x7f00000004c0)='/group.stat\x00') ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, &(0x7f0000000780)}) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f0000000680)}) ioctl$FS_IOC_FIEMAP(r3, 0xc020660b, &(0x7f0000000b80)=ANY=[@ANYBLOB="0000010000000000200000000000000005000000010000000a00000000000000ff030000000000001a0a000000000000050000000000000000000000000000000000000000000000080000000000000000000000000000000800000000000000ffff0000000000000100008000000000000000000000000000000000000000000000000000000000000000000000000008000000000000003f0000000000000008000000000000000000000000000000000000000000800800000000000000000000000000000200000000000000000400000000000000000000010000000000000000000000000000000000000002110000000000000000000000000000cc0000000000000000000000000000001b0000000000000000000000000000000000000000000000841400000000000000000000000000000300000000000000feffffffffffffff000000000000000000000000000000000000000000000000020000000000000000000000000000000600000000000000ff01000000000000040000000000000000000000000000000000000000000000000400000000000000000000000000007be70000000000000900000000000000ff7f0000000000000000000000000000000000000000000004180000000000000000000000000000ffffffff0000000081000000000000000600000000000000000000000000000000000000000000000400000000000000000000000000000002000000000000000500000000000000ff7fffffffffffff0000000000000000000000000000000004040000000000000000000000000000"]) r6 = creat(&(0x7f00000000c0)='./file0\x00', 0x0) openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000100)='/group.stat\x00', 0x2761, 0x0) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000080), 0xffffffffffffffff) getpid() fallocate(r0, 0x0, 0x0, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x2f, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) memfd_create(&(0x7f0000000080)='!proccgroup\x00', 0x0) ioctl$sock_inet_SIOCSIFPFLAGS(0xffffffffffffffff, 0x8934, &(0x7f0000000400)={'veth0_to_bridge\x00', 0x100}) accept(r6, &(0x7f0000000580)=@alg, &(0x7f0000000600)=0x80) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x2400, 0x8000) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000008c0)={0x2c, 0x0, &(0x7f0000000780)=[@acquire_done={0x40106309, r5, 0x2}, @clear_death={0x400c630f, 0x1, 0x3}, @release={0x40046306, 0x2}], 0xc1, 0x0, &(0x7f00000007c0)="859547f83b9b058a973a491d7e6378544744f2b56b02270a2f78214a936e9afb25cd94695643af6563f86771aa9621b9f30f2ca538b018247a633c28ee01e03b4639679311117971e60dc1538f34e961ae301463172c41754be988f6beb0ce4d83c69f86c236d29520e6cdaf5dbb60404c66d63315ff287deac8632781d0197ef1f81314da0a1ed90b681842cf85a41b496ce0a7a6f5aa4b9b23483eea8861be89b3398c6aec3349174f9cdc9de34df361ac9bf7afd8566849487c3c0a1e3aaacd"}) 04:01:45 executing program 4: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) recvmsg(0xffffffffffffffff, &(0x7f00000036c0)={&(0x7f0000000180)=@can, 0xfd28, &(0x7f00000035c0), 0x0, &(0x7f0000003680)=""/41, 0x29}, 0x0) bind$alg(0xffffffffffffffff, &(0x7f0000001300)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb(blowfish)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000ff8000)="0a0775b0", 0x4) r1 = accept$alg(r0, 0x0, 0x0) sendmmsg$alg(r1, &(0x7f0000003e80)=[{0x0, 0x0, &(0x7f0000002a80), 0x167, &(0x7f0000000100)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x0) recvmsg(r1, &(0x7f0000000000)={&(0x7f0000f7ffa8)=@alg, 0x61, &(0x7f0000000140)=[{&(0x7f0000000200)=""/4096, 0xfffffe45}], 0x1, &(0x7f0000fb3fa9)=""/87, 0x57}, 0x0) 04:01:45 executing program 2: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000440)=@updpolicy={0xb8, 0x19, 0x523, 0x0, 0x0, {{@in=@multicast2, @in6=@empty={[0x0, 0x0, 0x0, 0x3]}, 0x0, 0x0, 0x0, 0x0, 0xa}}}, 0xb8}}, 0x0) [ 620.006964] IPVS: ftp: loaded support on port[0] = 21 [ 620.080222] IPVS: ftp: loaded support on port[0] = 21 [ 620.086264] device bridge_slave_1 left promiscuous mode [ 620.091768] bridge0: port 2(bridge_slave_1) entered disabled state [ 620.145619] device bridge_slave_0 left promiscuous mode [ 620.152379] bridge0: port 1(bridge_slave_0) entered disabled state 04:01:46 executing program 5: r0 = socket$inet6(0xa, 0x2, 0x0) r1 = syz_open_dev$mice(&(0x7f00000002c0)='/dev/input/mice\x00', 0x0, 0x0) ioctl$PPPOEIOCDFWD(r1, 0xb101, 0x0) syz_genetlink_get_family_id$nbd(&(0x7f0000000480)='nbd\x00') getsockopt$inet6_IPV6_XFRM_POLICY(r0, 0x29, 0x23, &(0x7f0000000340)={{{@in=@local, @in=@loopback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@local}, 0x0, @in=@remote}}, &(0x7f0000000140)=0xe8) connect$can_bcm(0xffffffffffffffff, &(0x7f00000001c0), 0x10) bind$inet6(r0, &(0x7f0000000040)={0xa, 0x4e24}, 0x1c) lsetxattr$security_ima(&(0x7f0000000280)='./file0\x00', &(0x7f0000000440)='security.ima\x00', 0x0, 0x0, 0x1) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clock_gettime(0x0, &(0x7f0000000100)={0x0, 0x0}) r4 = openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) bind(r4, &(0x7f0000000580)=@can={0x1d, r2}, 0x80) clock_gettime(0x3, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff}) ppoll(&(0x7f0000000000)=[{r0, 0x41a, 0x300000000000000}], 0x1, &(0x7f0000000200)={0x0, r3+30000000}, &(0x7f0000000240), 0x8) connect$inet6(r0, &(0x7f0000000080)={0xa, 0x4e24, 0x0, @ipv4={[], [], @loopback}}, 0x1c) readv(0xffffffffffffffff, 0x0, 0x0) sendmmsg(r0, &(0x7f00000092c0), 0x4ff, 0x0) connect$pptp(r5, &(0x7f00000004c0)={0x18, 0x2, {0x0, @multicast1}}, 0x1e) 04:01:46 executing program 1: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) recvmsg(0xffffffffffffffff, &(0x7f00000036c0)={&(0x7f0000000180)=@can, 0xfd28, &(0x7f00000035c0), 0x0, &(0x7f0000003680)=""/41, 0x29}, 0x0) bind$alg(r0, &(0x7f0000001300)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb(blowfish)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000ff8000)="0a0775b0", 0x4) r1 = accept$alg(r0, 0x0, 0x0) sendmmsg$alg(r1, &(0x7f0000003e80)=[{0x0, 0x0, &(0x7f0000002a80), 0x167, &(0x7f0000000100)=[@op={0x18}], 0x18}], 0x1, 0x0) recvmsg(r1, &(0x7f0000000000)={&(0x7f0000f7ffa8)=@alg, 0x61, &(0x7f0000000140)=[{&(0x7f0000000200)=""/4096, 0xfffffe45}], 0x1, &(0x7f0000fb3fa9)=""/87, 0x57}, 0x0) 04:01:46 executing program 4: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) recvmsg(0xffffffffffffffff, &(0x7f00000036c0)={&(0x7f0000000180)=@can, 0xfd28, &(0x7f00000035c0), 0x0, &(0x7f0000003680)=""/41, 0x29}, 0x0) bind$alg(r0, 0x0, 0x0) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000ff8000)="0a0775b0", 0x4) r1 = accept$alg(r0, 0x0, 0x0) sendmmsg$alg(r1, &(0x7f0000003e80)=[{0x0, 0x0, &(0x7f0000002a80), 0x167, &(0x7f0000000100)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x0) recvmsg(r1, &(0x7f0000000000)={&(0x7f0000f7ffa8)=@alg, 0x61, &(0x7f0000000140)=[{&(0x7f0000000200)=""/4096, 0xfffffe45}], 0x1, &(0x7f0000fb3fa9)=""/87, 0x57}, 0x0) [ 620.368636] device hsr_slave_1 left promiscuous mode [ 620.431025] device hsr_slave_0 left promiscuous mode [ 620.492196] team0 (unregistering): Port device team_slave_1 removed [ 620.520904] team0 (unregistering): Port device team_slave_0 removed [ 620.543379] bond0 (unregistering): Releasing backup interface bond_slave_1 [ 620.608779] bond0 (unregistering): Releasing backup interface bond_slave_0 [ 620.700383] bond0 (unregistering): Released all slaves [ 620.931517] chnl_net:caif_netlink_parms(): no params data found [ 620.974107] bridge0: port 1(bridge_slave_0) entered blocking state [ 620.980697] bridge0: port 1(bridge_slave_0) entered disabled state [ 620.989035] device bridge_slave_0 entered promiscuous mode [ 621.085004] bridge0: port 2(bridge_slave_1) entered blocking state [ 621.091391] bridge0: port 2(bridge_slave_1) entered disabled state [ 621.106179] device bridge_slave_1 entered promiscuous mode [ 621.165176] bond0: Enslaving bond_slave_0 as an active interface with an up link [ 621.189128] bond0: Enslaving bond_slave_1 as an active interface with an up link [ 621.227923] IPv6: ADDRCONF(NETDEV_UP): team_slave_0: link is not ready [ 621.235707] team0: Port device team_slave_0 added [ 621.247915] IPv6: ADDRCONF(NETDEV_UP): team_slave_1: link is not ready [ 621.265011] team0: Port device team_slave_1 added [ 621.270441] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_0: link is not ready [ 621.284879] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_1: link is not ready [ 621.417313] device hsr_slave_0 entered promiscuous mode [ 621.454566] device hsr_slave_1 entered promiscuous mode [ 621.494907] IPv6: ADDRCONF(NETDEV_UP): hsr_slave_0: link is not ready [ 621.501989] IPv6: ADDRCONF(NETDEV_UP): hsr_slave_1: link is not ready [ 621.617817] bridge0: port 2(bridge_slave_1) entered blocking state [ 621.624282] bridge0: port 2(bridge_slave_1) entered forwarding state [ 621.630939] bridge0: port 1(bridge_slave_0) entered blocking state [ 621.637365] bridge0: port 1(bridge_slave_0) entered forwarding state [ 621.769368] 8021q: adding VLAN 0 to HW filter on device bond0 [ 621.797885] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready [ 621.823327] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 621.832473] bridge0: port 1(bridge_slave_0) entered disabled state [ 621.861342] bridge0: port 2(bridge_slave_1) entered disabled state [ 621.896884] IPv6: ADDRCONF(NETDEV_UP): team0: link is not ready [ 621.902971] 8021q: adding VLAN 0 to HW filter on device team0 [ 621.927816] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bridge: link is not ready [ 621.944535] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 621.952491] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 621.974843] bridge0: port 1(bridge_slave_0) entered blocking state [ 621.981201] bridge0: port 1(bridge_slave_0) entered forwarding state [ 621.997185] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bridge: link is not ready [ 622.004638] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 622.012534] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 622.020786] bridge0: port 2(bridge_slave_1) entered blocking state [ 622.027192] bridge0: port 2(bridge_slave_1) entered forwarding state [ 622.038031] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bond: link is not ready [ 622.061085] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 622.077553] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bond: link is not ready [ 622.084460] net_ratelimit: 20 callbacks suppressed [ 622.084468] protocol 88fb is buggy, dev hsr_slave_0 [ 622.084533] protocol 88fb is buggy, dev hsr_slave_1 [ 622.084645] protocol 88fb is buggy, dev hsr_slave_0 [ 622.084703] protocol 88fb is buggy, dev hsr_slave_1 [ 622.124550] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 622.135849] IPv6: ADDRCONF(NETDEV_UP): veth0_to_team: link is not ready [ 622.157379] IPv6: ADDRCONF(NETDEV_UP): veth1_to_team: link is not ready [ 622.164523] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 622.172507] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 622.195081] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 622.203027] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 622.228053] IPv6: ADDRCONF(NETDEV_UP): veth0_to_hsr: link is not ready [ 622.236018] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 622.243170] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 622.255103] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 622.265507] IPv6: ADDRCONF(NETDEV_UP): veth1_to_hsr: link is not ready [ 622.273597] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 622.304444] IPv6: ADDRCONF(NETDEV_UP): hsr0: link is not ready [ 622.310481] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 622.325163] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 622.332830] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 622.351951] IPv6: ADDRCONF(NETDEV_UP): vxcan1: link is not ready [ 622.373036] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 622.434328] protocol 88fb is buggy, dev hsr_slave_0 [ 622.439470] protocol 88fb is buggy, dev hsr_slave_1 [ 622.554393] protocol 88fb is buggy, dev hsr_slave_0 [ 622.559510] protocol 88fb is buggy, dev hsr_slave_1 [ 622.621559] binder: 21903:21904 BC_ACQUIRE_DONE u0000000000000000 node 349 cookie mismatch 0000000000000002 != 0000000000000000 [ 622.660821] binder: 21903:21904 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 [ 622.668305] binder: 21903:21904 Release 1 refcount change on invalid ref 2 ret -22 [ 622.678017] protocol 88fb is buggy, dev hsr_slave_0 [ 622.679066] protocol 88fb is buggy, dev hsr_slave_1 [ 623.284984] binder: release 21903:21905 transaction 350 out, still active 04:01:49 executing program 3: r0 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r0, &(0x7f0000000180)={0x2, 0x4e23, @multicast1}, 0x10) setsockopt$sock_int(r0, 0x1, 0x12, &(0x7f00000001c0)=0x5c1381ac, 0x4) sendto$inet(r0, 0x0, 0x0, 0x200007fd, &(0x7f0000000140)={0x2, 0x4e23, @local}, 0x10) sendmmsg$inet_sctp(r0, &(0x7f0000002ac0)=[{0x0, 0x0, &(0x7f0000001b80)=[{&(0x7f0000000500)="c60db629f1a7981f1c25fb9f5def8e3555d5ab61124b7fb91b610f3189c05b98bf22ebfca74b9a3c0b7e7f5726dc236c06e6d97a2a7e61f871b6a7a9a169eba3f989edfe7b4cc65797fa73239feb35b62fe36e5d3483c4c13503a6144c55a7242a6e70be10cfd48128ca9bfb4fc9bd9fc746794c0fe933e2ff9f8e7688e79d7b", 0x80}], 0x1}], 0x1, 0x0) 04:01:49 executing program 2: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000440)=@updpolicy={0xb8, 0x19, 0x523, 0x0, 0x0, {{@in=@multicast2, @in6=@empty={[0x0, 0x0, 0x0, 0x4]}, 0x0, 0x0, 0x0, 0x0, 0xa}}}, 0xb8}}, 0x0) 04:01:49 executing program 4: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) recvmsg(0xffffffffffffffff, &(0x7f00000036c0)={&(0x7f0000000180)=@can, 0xfd28, &(0x7f00000035c0), 0x0, &(0x7f0000003680)=""/41, 0x29}, 0x0) bind$alg(r0, 0x0, 0x0) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000ff8000)="0a0775b0", 0x4) r1 = accept$alg(r0, 0x0, 0x0) sendmmsg$alg(r1, &(0x7f0000003e80)=[{0x0, 0x0, &(0x7f0000002a80), 0x167, &(0x7f0000000100)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x0) recvmsg(r1, &(0x7f0000000000)={&(0x7f0000f7ffa8)=@alg, 0x61, &(0x7f0000000140)=[{&(0x7f0000000200)=""/4096, 0xfffffe45}], 0x1, &(0x7f0000fb3fa9)=""/87, 0x57}, 0x0) 04:01:49 executing program 1: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) recvmsg(0xffffffffffffffff, &(0x7f00000036c0)={&(0x7f0000000180)=@can, 0xfd28, &(0x7f00000035c0), 0x0, &(0x7f0000003680)=""/41, 0x29}, 0x0) bind$alg(r0, &(0x7f0000001300)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb(blowfish)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000ff8000)="0a0775b0", 0x4) r1 = accept$alg(r0, 0x0, 0x0) sendmmsg$alg(r1, &(0x7f0000003e80)=[{0x0, 0x0, &(0x7f0000002a80), 0x167, &(0x7f0000000100)=[@op={0x18}], 0x18}], 0x1, 0x0) recvmsg(r1, &(0x7f0000000000)={&(0x7f0000f7ffa8)=@alg, 0x61, &(0x7f0000000140)=[{&(0x7f0000000200)=""/4096, 0xfffffe45}], 0x1, &(0x7f0000fb3fa9)=""/87, 0x57}, 0x0) 04:01:49 executing program 0: r0 = perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) setxattr$security_smack_entry(&(0x7f0000000380)='./file0\x00', &(0x7f0000000480)='security.SMACK64IPIN\x00', &(0x7f0000000540)='^vboxnet1^\x00', 0xb, 0x1) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r1, &(0x7f0000000040), 0x0}, 0x20) unlink(&(0x7f0000000900)='./file0/file0\x00') r2 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r3 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r3, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, &(0x7f00000006c0)={0x0}) ioctl$BINDER_GET_NODE_DEBUG_INFO(r2, 0xc018620b, &(0x7f0000000640)={r4}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f00000000c0)=[@enter_looper], 0x48, 0x0, &(0x7f0000000700)="2ba063fb309ec7fdbfb08e6e91baee7d7d4599fe14129a4d426834556ae420e087d59c0c7be7fcad1abb7e1f8f446f373f611ca1ee9c2231708e18a47bc68a2a79a0b48931f6ff6d"}) ioctl$BINDER_SET_CONTEXT_MGR(r3, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x1) prctl$PR_SET_NAME(0xf, &(0x7f00000004c0)='/group.stat\x00') ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, &(0x7f0000000780)}) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f0000000680)}) ioctl$FS_IOC_FIEMAP(r3, 0xc020660b, &(0x7f0000000b80)=ANY=[@ANYBLOB="0000010000000000200000000000000005000000010000000a00000000000000ff030000000000001a0a000000000000050000000000000000000000000000000000000000000000080000000000000000000000000000000800000000000000ffff0000000000000100008000000000000000000000000000000000000000000000000000000000000000000000000008000000000000003f0000000000000008000000000000000000000000000000000000000000800800000000000000000000000000000200000000000000000400000000000000000000010000000000000000000000000000000000000002110000000000000000000000000000cc0000000000000000000000000000001b0000000000000000000000000000000000000000000000841400000000000000000000000000000300000000000000feffffffffffffff000000000000000000000000000000000000000000000000020000000000000000000000000000000600000000000000ff01000000000000040000000000000000000000000000000000000000000000000400000000000000000000000000007be70000000000000900000000000000ff7f0000000000000000000000000000000000000000000004180000000000000000000000000000ffffffff0000000081000000000000000600000000000000000000000000000000000000000000000400000000000000000000000000000002000000000000000500000000000000ff7fffffffffffff0000000000000000000000000000000004040000000000000000000000000000"]) r6 = creat(&(0x7f00000000c0)='./file0\x00', 0x0) openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000100)='/group.stat\x00', 0x2761, 0x0) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000080), 0xffffffffffffffff) getpid() fallocate(r0, 0x0, 0x0, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x2f, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) memfd_create(&(0x7f0000000080)='!proccgroup\x00', 0x0) ioctl$sock_inet_SIOCSIFPFLAGS(0xffffffffffffffff, 0x8934, &(0x7f0000000400)={'veth0_to_bridge\x00', 0x100}) accept(r6, &(0x7f0000000580)=@alg, &(0x7f0000000600)=0x80) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x2400, 0x8000) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000008c0)={0x2c, 0x0, &(0x7f0000000780)=[@acquire_done={0x40106309, r5, 0x2}, @clear_death={0x400c630f, 0x1, 0x3}, @release={0x40046306, 0x2}], 0xc1, 0x0, &(0x7f00000007c0)="859547f83b9b058a973a491d7e6378544744f2b56b02270a2f78214a936e9afb25cd94695643af6563f86771aa9621b9f30f2ca538b018247a633c28ee01e03b4639679311117971e60dc1538f34e961ae301463172c41754be988f6beb0ce4d83c69f86c236d29520e6cdaf5dbb60404c66d63315ff287deac8632781d0197ef1f81314da0a1ed90b681842cf85a41b496ce0a7a6f5aa4b9b23483eea8861be89b3398c6aec3349174f9cdc9de34df361ac9bf7afd8566849487c3c0a1e3aaacd"}) 04:01:49 executing program 5: r0 = socket$inet6(0xa, 0x2, 0x0) r1 = syz_open_dev$mice(&(0x7f00000002c0)='/dev/input/mice\x00', 0x0, 0x0) ioctl$PPPOEIOCDFWD(r1, 0xb101, 0x0) syz_genetlink_get_family_id$nbd(&(0x7f0000000480)='nbd\x00') getsockopt$inet6_IPV6_XFRM_POLICY(r0, 0x29, 0x23, &(0x7f0000000340)={{{@in=@local, @in=@loopback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@local}, 0x0, @in=@remote}}, &(0x7f0000000140)=0xe8) connect$can_bcm(0xffffffffffffffff, &(0x7f00000001c0), 0x10) bind$inet6(r0, &(0x7f0000000040)={0xa, 0x4e24}, 0x1c) lsetxattr$security_ima(&(0x7f0000000280)='./file0\x00', &(0x7f0000000440)='security.ima\x00', 0x0, 0x0, 0x1) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clock_gettime(0x0, &(0x7f0000000100)={0x0, 0x0}) r4 = openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) bind(r4, &(0x7f0000000580)=@can={0x1d, r2}, 0x80) clock_gettime(0x3, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff}) ppoll(&(0x7f0000000000)=[{r0, 0x41a, 0x800000000000000}], 0x1, &(0x7f0000000200)={0x0, r3+30000000}, &(0x7f0000000240), 0x8) connect$inet6(r0, &(0x7f0000000080)={0xa, 0x4e24, 0x0, @ipv4={[], [], @loopback}}, 0x1c) readv(0xffffffffffffffff, 0x0, 0x0) sendmmsg(r0, &(0x7f00000092c0), 0x4ff, 0x0) connect$pptp(r5, &(0x7f00000004c0)={0x18, 0x2, {0x0, @multicast1}}, 0x1e) 04:01:49 executing program 2: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000440)=@updpolicy={0xb8, 0x19, 0x523, 0x0, 0x0, {{@in=@multicast2, @in6=@empty={[0x0, 0x0, 0x0, 0x8]}, 0x0, 0x0, 0x0, 0x0, 0xa}}}, 0xb8}}, 0x0) 04:01:49 executing program 4: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) recvmsg(0xffffffffffffffff, &(0x7f00000036c0)={&(0x7f0000000180)=@can, 0xfd28, &(0x7f00000035c0), 0x0, &(0x7f0000003680)=""/41, 0x29}, 0x0) bind$alg(r0, 0x0, 0x0) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000ff8000)="0a0775b0", 0x4) r1 = accept$alg(r0, 0x0, 0x0) sendmmsg$alg(r1, &(0x7f0000003e80)=[{0x0, 0x0, &(0x7f0000002a80), 0x167, &(0x7f0000000100)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x0) recvmsg(r1, &(0x7f0000000000)={&(0x7f0000f7ffa8)=@alg, 0x61, &(0x7f0000000140)=[{&(0x7f0000000200)=""/4096, 0xfffffe45}], 0x1, &(0x7f0000fb3fa9)=""/87, 0x57}, 0x0) 04:01:49 executing program 1: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) recvmsg(0xffffffffffffffff, &(0x7f00000036c0)={&(0x7f0000000180)=@can, 0xfd28, &(0x7f00000035c0), 0x0, &(0x7f0000003680)=""/41, 0x29}, 0x0) bind$alg(r0, &(0x7f0000001300)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb(blowfish)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000ff8000)="0a0775b0", 0x4) r1 = accept$alg(r0, 0x0, 0x0) sendmmsg$alg(r1, &(0x7f0000003e80)=[{0x0, 0x0, &(0x7f0000002a80), 0x167, &(0x7f0000000100)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x0) recvmsg(0xffffffffffffffff, &(0x7f0000000000)={&(0x7f0000f7ffa8)=@alg, 0x61, &(0x7f0000000140)=[{&(0x7f0000000200)=""/4096, 0xfffffe45}], 0x1, &(0x7f0000fb3fa9)=""/87, 0x57}, 0x0) [ 624.020851] binder: 21914:21915 BC_ACQUIRE_DONE u0000000000000000 node 353 cookie mismatch 0000000000000002 != 0000000000000000 04:01:49 executing program 3: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) recvmsg(0xffffffffffffffff, &(0x7f00000036c0)={&(0x7f0000000180)=@can, 0xfd28, &(0x7f00000035c0), 0x0, &(0x7f0000003680)=""/41, 0x29}, 0x0) bind$alg(r0, &(0x7f0000001300)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb(blowfish)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000ff8000)="0a0775b0", 0x4) r1 = accept$alg(r0, 0x0, 0x0) sendmmsg$alg(r1, &(0x7f0000003e80)=[{0x0, 0x0, &(0x7f0000002a80)}], 0x1, 0x0) recvmsg(r1, &(0x7f0000000000)={&(0x7f0000f7ffa8)=@alg, 0x61, &(0x7f0000000140)=[{&(0x7f0000000200)=""/4096, 0xfffffe45}], 0x1, &(0x7f0000fb3fa9)=""/87, 0x57}, 0x0) [ 624.072754] binder: 21914:21915 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 04:01:49 executing program 4: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) recvmsg(0xffffffffffffffff, &(0x7f00000036c0)={&(0x7f0000000180)=@can, 0xfd28, &(0x7f00000035c0), 0x0, &(0x7f0000003680)=""/41, 0x29}, 0x0) bind$alg(r0, &(0x7f0000001300)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb(blowfish)\x00'}, 0x58) setsockopt$ALG_SET_KEY(0xffffffffffffffff, 0x117, 0x1, &(0x7f0000ff8000)="0a0775b0", 0x4) r1 = accept$alg(r0, 0x0, 0x0) sendmmsg$alg(r1, &(0x7f0000003e80)=[{0x0, 0x0, &(0x7f0000002a80), 0x167, &(0x7f0000000100)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x0) recvmsg(r1, &(0x7f0000000000)={&(0x7f0000f7ffa8)=@alg, 0x61, &(0x7f0000000140)=[{&(0x7f0000000200)=""/4096, 0xfffffe45}], 0x1, &(0x7f0000fb3fa9)=""/87, 0x57}, 0x0) [ 624.124633] binder: 21914:21915 Release 1 refcount change on invalid ref 2 ret -22 04:01:49 executing program 0: r0 = perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) setxattr$security_smack_entry(&(0x7f0000000380)='./file0\x00', &(0x7f0000000480)='security.SMACK64IPIN\x00', &(0x7f0000000540)='^vboxnet1^\x00', 0xb, 0x1) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r1, &(0x7f0000000040), 0x0}, 0x20) unlink(0x0) r2 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r3 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r3, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, &(0x7f00000006c0)={0x0}) ioctl$BINDER_GET_NODE_DEBUG_INFO(r2, 0xc018620b, &(0x7f0000000640)={r4}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f00000000c0)=[@enter_looper], 0x48, 0x0, &(0x7f0000000700)="2ba063fb309ec7fdbfb08e6e91baee7d7d4599fe14129a4d426834556ae420e087d59c0c7be7fcad1abb7e1f8f446f373f611ca1ee9c2231708e18a47bc68a2a79a0b48931f6ff6d"}) ioctl$BINDER_SET_CONTEXT_MGR(r3, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x1) prctl$PR_SET_NAME(0xf, &(0x7f00000004c0)='/group.stat\x00') ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, &(0x7f0000000780)}) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f0000000680)}) ioctl$FS_IOC_FIEMAP(r3, 0xc020660b, &(0x7f0000000b80)=ANY=[@ANYBLOB="0000010000000000200000000000000005000000010000000a00000000000000ff030000000000001a0a000000000000050000000000000000000000000000000000000000000000080000000000000000000000000000000800000000000000ffff0000000000000100008000000000000000000000000000000000000000000000000000000000000000000000000008000000000000003f0000000000000008000000000000000000000000000000000000000000800800000000000000000000000000000200000000000000000400000000000000000000010000000000000000000000000000000000000002110000000000000000000000000000cc0000000000000000000000000000001b0000000000000000000000000000000000000000000000841400000000000000000000000000000300000000000000feffffffffffffff000000000000000000000000000000000000000000000000020000000000000000000000000000000600000000000000ff01000000000000040000000000000000000000000000000000000000000000000400000000000000000000000000007be70000000000000900000000000000ff7f0000000000000000000000000000000000000000000004180000000000000000000000000000ffffffff0000000081000000000000000600000000000000000000000000000000000000000000000400000000000000000000000000000002000000000000000500000000000000ff7fffffffffffff0000000000000000000000000000000004040000000000000000000000000000"]) r6 = creat(&(0x7f00000000c0)='./file0\x00', 0x0) openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000100)='/group.stat\x00', 0x2761, 0x0) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000080), 0xffffffffffffffff) getpid() fallocate(r0, 0x0, 0x0, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x2f, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) memfd_create(&(0x7f0000000080)='!proccgroup\x00', 0x0) ioctl$sock_inet_SIOCSIFPFLAGS(0xffffffffffffffff, 0x8934, &(0x7f0000000400)={'veth0_to_bridge\x00', 0x100}) accept(r6, &(0x7f0000000580)=@alg, &(0x7f0000000600)=0x80) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x2400, 0x8000) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000008c0)={0x2c, 0x0, &(0x7f0000000780)=[@acquire_done={0x40106309, r5, 0x2}, @clear_death={0x400c630f, 0x1, 0x3}, @release={0x40046306, 0x2}], 0xc1, 0x0, &(0x7f00000007c0)="859547f83b9b058a973a491d7e6378544744f2b56b02270a2f78214a936e9afb25cd94695643af6563f86771aa9621b9f30f2ca538b018247a633c28ee01e03b4639679311117971e60dc1538f34e961ae301463172c41754be988f6beb0ce4d83c69f86c236d29520e6cdaf5dbb60404c66d63315ff287deac8632781d0197ef1f81314da0a1ed90b681842cf85a41b496ce0a7a6f5aa4b9b23483eea8861be89b3398c6aec3349174f9cdc9de34df361ac9bf7afd8566849487c3c0a1e3aaacd"}) 04:01:49 executing program 2: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000440)=@updpolicy={0xb8, 0x19, 0x523, 0x0, 0x0, {{@in=@multicast2, @in6=@empty={[0x0, 0x0, 0x0, 0xa]}, 0x0, 0x0, 0x0, 0x0, 0xa}}}, 0xb8}}, 0x0) 04:01:49 executing program 1: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) recvmsg(0xffffffffffffffff, &(0x7f00000036c0)={&(0x7f0000000180)=@can, 0xfd28, &(0x7f00000035c0), 0x0, &(0x7f0000003680)=""/41, 0x29}, 0x0) bind$alg(r0, &(0x7f0000001300)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb(blowfish)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000ff8000)="0a0775b0", 0x4) r1 = accept$alg(r0, 0x0, 0x0) sendmmsg$alg(r1, &(0x7f0000003e80)=[{0x0, 0x0, &(0x7f0000002a80), 0x167, &(0x7f0000000100)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x0) recvmsg(0xffffffffffffffff, &(0x7f0000000000)={&(0x7f0000f7ffa8)=@alg, 0x61, &(0x7f0000000140)=[{&(0x7f0000000200)=""/4096, 0xfffffe45}], 0x1, &(0x7f0000fb3fa9)=""/87, 0x57}, 0x0) [ 624.173190] binder: release 21914:21923 transaction 354 out, still active 04:01:50 executing program 3: perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$audio(0xffffffffffffff9c, &(0x7f0000000000)='/dev/audio\x00', 0x101080, 0x0) ioctl$RNDZAPENTCNT(r0, 0x5204, &(0x7f00000000c0)) r1 = socket$unix(0x1, 0x2, 0x0) connect$unix(r1, &(0x7f0000000040)=@abs, 0x6e) 04:01:50 executing program 4: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) recvmsg(0xffffffffffffffff, &(0x7f00000036c0)={&(0x7f0000000180)=@can, 0xfd28, &(0x7f00000035c0), 0x0, &(0x7f0000003680)=""/41, 0x29}, 0x0) bind$alg(r0, &(0x7f0000001300)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb(blowfish)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, 0x0, 0x0) r1 = accept$alg(r0, 0x0, 0x0) sendmmsg$alg(r1, &(0x7f0000003e80)=[{0x0, 0x0, &(0x7f0000002a80), 0x167, &(0x7f0000000100)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x0) recvmsg(r1, &(0x7f0000000000)={&(0x7f0000f7ffa8)=@alg, 0x61, &(0x7f0000000140)=[{&(0x7f0000000200)=""/4096, 0xfffffe45}], 0x1, &(0x7f0000fb3fa9)=""/87, 0x57}, 0x0) 04:01:50 executing program 2: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000440)=@updpolicy={0xb8, 0x19, 0x523, 0x0, 0x0, {{@in=@multicast2, @in6=@empty={[0x0, 0x0, 0x0, 0xe]}, 0x0, 0x0, 0x0, 0x0, 0xa}}}, 0xb8}}, 0x0) [ 624.449626] binder: BINDER_SET_CONTEXT_MGR already set [ 624.463141] binder: 21944:21955 ioctl 40046207 0 returned -16 [ 624.492901] binder: 21944:21955 Release 1 refcount change on invalid ref 1 ret -22 [ 624.550907] binder: 21944:21957 BC_ACQUIRE_DONE u0000000000000000 no match [ 624.580975] binder: 21944:21957 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 [ 624.591469] binder: 21944:21957 Release 1 refcount change on invalid ref 2 ret -22 04:01:50 executing program 5: r0 = socket$inet6(0xa, 0x2, 0x0) r1 = syz_open_dev$mice(&(0x7f00000002c0)='/dev/input/mice\x00', 0x0, 0x0) ioctl$PPPOEIOCDFWD(r1, 0xb101, 0x0) syz_genetlink_get_family_id$nbd(&(0x7f0000000480)='nbd\x00') getsockopt$inet6_IPV6_XFRM_POLICY(r0, 0x29, 0x23, &(0x7f0000000340)={{{@in=@local, @in=@loopback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@local}, 0x0, @in=@remote}}, &(0x7f0000000140)=0xe8) connect$can_bcm(0xffffffffffffffff, &(0x7f00000001c0), 0x10) bind$inet6(r0, &(0x7f0000000040)={0xa, 0x4e24}, 0x1c) lsetxattr$security_ima(&(0x7f0000000280)='./file0\x00', &(0x7f0000000440)='security.ima\x00', 0x0, 0x0, 0x1) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clock_gettime(0x0, &(0x7f0000000100)={0x0, 0x0}) r4 = openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) bind(r4, &(0x7f0000000580)=@can={0x1d, r2}, 0x80) clock_gettime(0x3, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff}) ppoll(&(0x7f0000000000)=[{r0, 0x41a, 0x2000000000000000}], 0x1, &(0x7f0000000200)={0x0, r3+30000000}, &(0x7f0000000240), 0x8) connect$inet6(r0, &(0x7f0000000080)={0xa, 0x4e24, 0x0, @ipv4={[], [], @loopback}}, 0x1c) readv(0xffffffffffffffff, 0x0, 0x0) sendmmsg(r0, &(0x7f00000092c0), 0x4ff, 0x0) connect$pptp(r5, &(0x7f00000004c0)={0x18, 0x2, {0x0, @multicast1}}, 0x1e) 04:01:50 executing program 1: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) recvmsg(0xffffffffffffffff, &(0x7f00000036c0)={&(0x7f0000000180)=@can, 0xfd28, &(0x7f00000035c0), 0x0, &(0x7f0000003680)=""/41, 0x29}, 0x0) bind$alg(r0, &(0x7f0000001300)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb(blowfish)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000ff8000)="0a0775b0", 0x4) r1 = accept$alg(r0, 0x0, 0x0) sendmmsg$alg(r1, &(0x7f0000003e80)=[{0x0, 0x0, &(0x7f0000002a80), 0x167, &(0x7f0000000100)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x0) recvmsg(r1, 0x0, 0x0) 04:01:50 executing program 2: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000440)=@updpolicy={0xb8, 0x19, 0x523, 0x0, 0x0, {{@in=@multicast2, @in6=@empty={[0x0, 0x0, 0x0, 0xf]}, 0x0, 0x0, 0x0, 0x0, 0xa}}}, 0xb8}}, 0x0) 04:01:50 executing program 4: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) recvmsg(0xffffffffffffffff, &(0x7f00000036c0)={&(0x7f0000000180)=@can, 0xfd28, &(0x7f00000035c0), 0x0, &(0x7f0000003680)=""/41, 0x29}, 0x0) bind$alg(r0, &(0x7f0000001300)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb(blowfish)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000ff8000), 0x0) r1 = accept$alg(r0, 0x0, 0x0) sendmmsg$alg(r1, &(0x7f0000003e80)=[{0x0, 0x0, &(0x7f0000002a80), 0x167, &(0x7f0000000100)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x0) recvmsg(r1, &(0x7f0000000000)={&(0x7f0000f7ffa8)=@alg, 0x61, &(0x7f0000000140)=[{&(0x7f0000000200)=""/4096, 0xfffffe45}], 0x1, &(0x7f0000fb3fa9)=""/87, 0x57}, 0x0) 04:01:50 executing program 3: perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$inet(0x10, 0x3, 0x0) sendmsg(r0, &(0x7f0000004fc8)={0x0, 0x0, &(0x7f0000004000)=[{&(0x7f0000006000)="1b0000005200030f07fffd946fa283bc04eee6d87986c497271d85", 0x1b}], 0x1}, 0x0) r1 = openat$hwrng(0xffffffffffffff9c, 0x0, 0x0, 0x0) recvmmsg(r0, &(0x7f0000004d40)=[{{0x0, 0x0, 0x0}}, {{&(0x7f0000004b40)=@nfc, 0x80, 0x0}}], 0x2, 0x0, 0x0) clock_nanosleep(0x0, 0x0, 0x0, 0x0) ioctl$VT_RESIZEX(0xffffffffffffffff, 0x560a, 0x0) ioctl$VHOST_SET_FEATURES(0xffffffffffffffff, 0x4008af00, 0x0) mount(0x0, 0x0, 0x0, 0x0, 0x0) fstat(0xffffffffffffffff, 0x0) r2 = perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) r3 = openat$cgroup_procs(0xffffffffffffffff, 0x0, 0x2, 0x0) recvmmsg(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0) ioctl$KVM_SET_VCPU_EVENTS(r1, 0x4040aea0, &(0x7f0000000000)={0x0, 0x4, 0x4, 0x0, 0x624b, 0xa4, 0xd76, 0x7fff, 0x200, 0x3f, 0x0, 0xf0, 0x0, 0xe0000000000000, 0x1, 0x7, 0x9, 0x20c, 0x2}) preadv(r3, 0x0, 0x0, 0x0) openat$hwrng(0xffffffffffffff9c, &(0x7f0000000780)='/dev/hwrng\x00', 0x4000, 0x0) write$binfmt_aout(r2, &(0x7f0000000040)=ANY=[@ANYBLOB="0b0140039200000063030000880b581a4601000005000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000fafb81458179a10362aaa156a9000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000e3ff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ff010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000"], 0x720) 04:01:50 executing program 2: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000440)=@updpolicy={0xb8, 0x19, 0x523, 0x0, 0x0, {{@in=@multicast2, @in6=@empty={[0x0, 0x0, 0x0, 0x10]}, 0x0, 0x0, 0x0, 0x0, 0xa}}}, 0xb8}}, 0x0) 04:01:50 executing program 0: r0 = perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) setxattr$security_smack_entry(&(0x7f0000000380)='./file0\x00', &(0x7f0000000480)='security.SMACK64IPIN\x00', &(0x7f0000000540)='^vboxnet1^\x00', 0xb, 0x1) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r1, &(0x7f0000000040), 0x0}, 0x20) unlink(0x0) r2 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r3 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r3, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, &(0x7f00000006c0)={0x0}) ioctl$BINDER_GET_NODE_DEBUG_INFO(r2, 0xc018620b, &(0x7f0000000640)={r4}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f00000000c0)=[@enter_looper], 0x48, 0x0, &(0x7f0000000700)="2ba063fb309ec7fdbfb08e6e91baee7d7d4599fe14129a4d426834556ae420e087d59c0c7be7fcad1abb7e1f8f446f373f611ca1ee9c2231708e18a47bc68a2a79a0b48931f6ff6d"}) ioctl$BINDER_SET_CONTEXT_MGR(r3, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x1) prctl$PR_SET_NAME(0xf, &(0x7f00000004c0)='/group.stat\x00') ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, &(0x7f0000000780)}) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f0000000680)}) ioctl$FS_IOC_FIEMAP(r3, 0xc020660b, &(0x7f0000000b80)=ANY=[@ANYBLOB="0000010000000000200000000000000005000000010000000a00000000000000ff030000000000001a0a000000000000050000000000000000000000000000000000000000000000080000000000000000000000000000000800000000000000ffff0000000000000100008000000000000000000000000000000000000000000000000000000000000000000000000008000000000000003f0000000000000008000000000000000000000000000000000000000000800800000000000000000000000000000200000000000000000400000000000000000000010000000000000000000000000000000000000002110000000000000000000000000000cc0000000000000000000000000000001b0000000000000000000000000000000000000000000000841400000000000000000000000000000300000000000000feffffffffffffff000000000000000000000000000000000000000000000000020000000000000000000000000000000600000000000000ff01000000000000040000000000000000000000000000000000000000000000000400000000000000000000000000007be70000000000000900000000000000ff7f0000000000000000000000000000000000000000000004180000000000000000000000000000ffffffff0000000081000000000000000600000000000000000000000000000000000000000000000400000000000000000000000000000002000000000000000500000000000000ff7fffffffffffff0000000000000000000000000000000004040000000000000000000000000000"]) r6 = creat(&(0x7f00000000c0)='./file0\x00', 0x0) openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000100)='/group.stat\x00', 0x2761, 0x0) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000080), 0xffffffffffffffff) getpid() fallocate(r0, 0x0, 0x0, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x2f, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) memfd_create(&(0x7f0000000080)='!proccgroup\x00', 0x0) ioctl$sock_inet_SIOCSIFPFLAGS(0xffffffffffffffff, 0x8934, &(0x7f0000000400)={'veth0_to_bridge\x00', 0x100}) accept(r6, &(0x7f0000000580)=@alg, &(0x7f0000000600)=0x80) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x2400, 0x8000) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000008c0)={0x2c, 0x0, &(0x7f0000000780)=[@acquire_done={0x40106309, r5, 0x2}, @clear_death={0x400c630f, 0x1, 0x3}, @release={0x40046306, 0x2}], 0xc1, 0x0, &(0x7f00000007c0)="859547f83b9b058a973a491d7e6378544744f2b56b02270a2f78214a936e9afb25cd94695643af6563f86771aa9621b9f30f2ca538b018247a633c28ee01e03b4639679311117971e60dc1538f34e961ae301463172c41754be988f6beb0ce4d83c69f86c236d29520e6cdaf5dbb60404c66d63315ff287deac8632781d0197ef1f81314da0a1ed90b681842cf85a41b496ce0a7a6f5aa4b9b23483eea8861be89b3398c6aec3349174f9cdc9de34df361ac9bf7afd8566849487c3c0a1e3aaacd"}) 04:01:50 executing program 4: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) recvmsg(0xffffffffffffffff, &(0x7f00000036c0)={&(0x7f0000000180)=@can, 0xfd28, &(0x7f00000035c0), 0x0, &(0x7f0000003680)=""/41, 0x29}, 0x0) bind$alg(r0, &(0x7f0000001300)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb(blowfish)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000ff8000)='\n\a', 0x2) r1 = accept$alg(r0, 0x0, 0x0) sendmmsg$alg(r1, &(0x7f0000003e80)=[{0x0, 0x0, &(0x7f0000002a80), 0x167, &(0x7f0000000100)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x0) recvmsg(r1, &(0x7f0000000000)={&(0x7f0000f7ffa8)=@alg, 0x61, &(0x7f0000000140)=[{&(0x7f0000000200)=""/4096, 0xfffffe45}], 0x1, &(0x7f0000fb3fa9)=""/87, 0x57}, 0x0) 04:01:50 executing program 3: r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = socket$packet(0x11, 0x2, 0x300) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000180)={'team0\x00', 0x0}) setsockopt$packet_add_memb(r1, 0x107, 0x1, &(0x7f0000000300)={r2, 0x3, 0x6, @local}, 0x10) r3 = openat$pfkey(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/net/pfkey\x00', 0x800, 0x0) ioctl$NBD_SET_SOCK(r3, 0xab00, r0) 04:01:50 executing program 1: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) recvmsg(0xffffffffffffffff, &(0x7f00000036c0)={&(0x7f0000000180)=@can, 0xfd28, &(0x7f00000035c0), 0x0, &(0x7f0000003680)=""/41, 0x29}, 0x0) bind$alg(r0, &(0x7f0000001300)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb(blowfish)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000ff8000)="0a0775b0", 0x4) r1 = accept$alg(r0, 0x0, 0x0) sendmmsg$alg(r1, &(0x7f0000003e80)=[{0x0, 0x0, &(0x7f0000002a80), 0x167, &(0x7f0000000100)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x0) recvmsg(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)=[{&(0x7f0000000200)=""/4096, 0x1000}], 0x1, &(0x7f0000fb3fa9)=""/87, 0x57}, 0x0) 04:01:50 executing program 2: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000440)=@updpolicy={0xb8, 0x19, 0x523, 0x0, 0x0, {{@in=@multicast2, @in6=@empty={[0x0, 0x0, 0x0, 0x2f]}, 0x0, 0x0, 0x0, 0x0, 0xa}}}, 0xb8}}, 0x0) [ 625.114667] binder: release 21944:21955 transaction 357 out, still active [ 625.149912] device team_slave_0 entered promiscuous mode [ 625.156294] device team_slave_1 entered promiscuous mode 04:01:50 executing program 4: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) recvmsg(0xffffffffffffffff, &(0x7f00000036c0)={&(0x7f0000000180)=@can, 0xfd28, &(0x7f00000035c0), 0x0, &(0x7f0000003680)=""/41, 0x29}, 0x0) bind$alg(r0, &(0x7f0000001300)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb(blowfish)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000ff8000)='\n\au', 0x3) r1 = accept$alg(r0, 0x0, 0x0) sendmmsg$alg(r1, &(0x7f0000003e80)=[{0x0, 0x0, &(0x7f0000002a80), 0x167, &(0x7f0000000100)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x0) recvmsg(r1, &(0x7f0000000000)={&(0x7f0000f7ffa8)=@alg, 0x61, &(0x7f0000000140)=[{&(0x7f0000000200)=""/4096, 0xfffffe45}], 0x1, &(0x7f0000fb3fa9)=""/87, 0x57}, 0x0) [ 625.269614] device team_slave_0 left promiscuous mode [ 625.275151] device team_slave_1 left promiscuous mode [ 625.325526] binder: BINDER_SET_CONTEXT_MGR already set [ 625.332153] binder: 21988:21995 ioctl 40046207 0 returned -16 [ 625.357154] binder: 21988:21995 Release 1 refcount change on invalid ref 1 ret -22 [ 625.369567] binder: 21988:21996 BC_ACQUIRE_DONE u0000000000000000 no match [ 625.376998] binder: 21988:21996 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 [ 625.383947] binder: 21988:21996 Release 1 refcount change on invalid ref 2 ret -22 04:01:51 executing program 5: r0 = socket$inet6(0xa, 0x2, 0x0) r1 = syz_open_dev$mice(&(0x7f00000002c0)='/dev/input/mice\x00', 0x0, 0x0) ioctl$PPPOEIOCDFWD(r1, 0xb101, 0x0) syz_genetlink_get_family_id$nbd(&(0x7f0000000480)='nbd\x00') getsockopt$inet6_IPV6_XFRM_POLICY(r0, 0x29, 0x23, &(0x7f0000000340)={{{@in=@local, @in=@loopback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@local}, 0x0, @in=@remote}}, &(0x7f0000000140)=0xe8) connect$can_bcm(0xffffffffffffffff, &(0x7f00000001c0), 0x10) bind$inet6(r0, &(0x7f0000000040)={0xa, 0x4e24}, 0x1c) lsetxattr$security_ima(&(0x7f0000000280)='./file0\x00', &(0x7f0000000440)='security.ima\x00', 0x0, 0x0, 0x1) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clock_gettime(0x0, &(0x7f0000000100)={0x0, 0x0}) r4 = openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) bind(r4, &(0x7f0000000580)=@can={0x1d, r2}, 0x80) clock_gettime(0x3, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff}) ppoll(&(0x7f0000000000)=[{r0, 0x41a, 0x3f00000000000000}], 0x1, &(0x7f0000000200)={0x0, r3+30000000}, &(0x7f0000000240), 0x8) connect$inet6(r0, &(0x7f0000000080)={0xa, 0x4e24, 0x0, @ipv4={[], [], @loopback}}, 0x1c) readv(0xffffffffffffffff, 0x0, 0x0) sendmmsg(r0, &(0x7f00000092c0), 0x4ff, 0x0) connect$pptp(r5, &(0x7f00000004c0)={0x18, 0x2, {0x0, @multicast1}}, 0x1e) 04:01:51 executing program 1: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) recvmsg(0xffffffffffffffff, &(0x7f00000036c0)={&(0x7f0000000180)=@can, 0xfd28, &(0x7f00000035c0), 0x0, &(0x7f0000003680)=""/41, 0x29}, 0x0) bind$alg(r0, &(0x7f0000001300)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb(blowfish)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000ff8000)="0a0775b0", 0x4) r1 = accept$alg(r0, 0x0, 0x0) sendmmsg$alg(r1, &(0x7f0000003e80)=[{0x0, 0x0, &(0x7f0000002a80), 0x167, &(0x7f0000000100)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x0) recvmsg(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)=[{&(0x7f0000000200)=""/4096, 0x1000}], 0x1, &(0x7f0000fb3fa9)=""/87, 0x57}, 0x0) 04:01:51 executing program 2: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000440)=@updpolicy={0xb8, 0x19, 0x523, 0x0, 0x0, {{@in=@multicast2, @in6=@empty={[0x0, 0x0, 0x0, 0x60]}, 0x0, 0x0, 0x0, 0x0, 0xa}}}, 0xb8}}, 0x0) 04:01:51 executing program 4: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) recvmsg(0xffffffffffffffff, &(0x7f00000036c0)={&(0x7f0000000180)=@can, 0xfd28, &(0x7f00000035c0), 0x0, &(0x7f0000003680)=""/41, 0x29}, 0x0) bind$alg(r0, &(0x7f0000001300)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb(blowfish)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000ff8000)="0a0775b0", 0x4) r1 = accept$alg(0xffffffffffffffff, 0x0, 0x0) sendmmsg$alg(r1, &(0x7f0000003e80)=[{0x0, 0x0, &(0x7f0000002a80), 0x167, &(0x7f0000000100)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x0) recvmsg(r1, &(0x7f0000000000)={&(0x7f0000f7ffa8)=@alg, 0x61, &(0x7f0000000140)=[{&(0x7f0000000200)=""/4096, 0xfffffe45}], 0x1, &(0x7f0000fb3fa9)=""/87, 0x57}, 0x0) 04:01:51 executing program 3: socketpair$unix(0x1, 0x3, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000180)='/dev/sequencer\x00', 0x80000000000046, 0x0) r2 = syz_open_procfs(0x0, &(0x7f0000000080)='/exe\x00\x00\x00\x00\x00\x04\t\x00K\xdd\xd9\xde\x91\xbe\x10\xee\xbf\x00\x0e\xe9\xa9\x0fy\x80XT\xfa\aBJ\xde\xe9\x01\xd2\xdau\xaf\x1f\x02\x00\xf5\xab&\xd7\xa0q\xfb53\x1c\xe3\x9cZ') bind$bt_rfcomm(r1, &(0x7f0000000200)={0x1f, {0x9, 0x1f, 0x2, 0x0, 0xfffffffffffffff7, 0x100000000}, 0x3ff}, 0xa) sendfile(r1, r2, 0x0, 0x2b428a52) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) write$RDMA_USER_CM_CMD_CREATE_ID(r1, &(0x7f0000000240)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000000)={0xffffffffffffffff}, 0x0, 0x6}}, 0x20) write$RDMA_USER_CM_CMD_LISTEN(r1, &(0x7f0000000280)={0x7, 0x8, 0xfa00, {r3, 0x572}}, 0x10) r4 = dup2(r0, r1) ioctl$BLKZEROOUT(r4, 0x127f, &(0x7f00000001c0)={0x1, 0x2}) ioctl$PERF_EVENT_IOC_SET_FILTER(r1, 0x40082406, &(0x7f0000000040)='\x00') write$P9_RSTATFS(r4, &(0x7f0000000100)={0x43, 0x9, 0x2, {0x40, 0x7, 0x20, 0x2f, 0x5, 0xfffffffffffffff7, 0x1, 0x7, 0x5}}, 0x43) 04:01:51 executing program 2: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000440)=@updpolicy={0xb8, 0x19, 0x523, 0x0, 0x0, {{@in=@multicast2, @in6=@empty={[0x0, 0x0, 0x0, 0xf0]}, 0x0, 0x0, 0x0, 0x0, 0xa}}}, 0xb8}}, 0x0) 04:01:51 executing program 0: r0 = perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) setxattr$security_smack_entry(&(0x7f0000000380)='./file0\x00', &(0x7f0000000480)='security.SMACK64IPIN\x00', &(0x7f0000000540)='^vboxnet1^\x00', 0xb, 0x1) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r1, &(0x7f0000000040), 0x0}, 0x20) unlink(0x0) r2 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r3 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r3, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, &(0x7f00000006c0)={0x0}) ioctl$BINDER_GET_NODE_DEBUG_INFO(r2, 0xc018620b, &(0x7f0000000640)={r4}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f00000000c0)=[@enter_looper], 0x48, 0x0, &(0x7f0000000700)="2ba063fb309ec7fdbfb08e6e91baee7d7d4599fe14129a4d426834556ae420e087d59c0c7be7fcad1abb7e1f8f446f373f611ca1ee9c2231708e18a47bc68a2a79a0b48931f6ff6d"}) ioctl$BINDER_SET_CONTEXT_MGR(r3, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x1) prctl$PR_SET_NAME(0xf, &(0x7f00000004c0)='/group.stat\x00') ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, &(0x7f0000000780)}) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f0000000680)}) ioctl$FS_IOC_FIEMAP(r3, 0xc020660b, &(0x7f0000000b80)=ANY=[@ANYBLOB="0000010000000000200000000000000005000000010000000a00000000000000ff030000000000001a0a000000000000050000000000000000000000000000000000000000000000080000000000000000000000000000000800000000000000ffff0000000000000100008000000000000000000000000000000000000000000000000000000000000000000000000008000000000000003f0000000000000008000000000000000000000000000000000000000000800800000000000000000000000000000200000000000000000400000000000000000000010000000000000000000000000000000000000002110000000000000000000000000000cc0000000000000000000000000000001b0000000000000000000000000000000000000000000000841400000000000000000000000000000300000000000000feffffffffffffff000000000000000000000000000000000000000000000000020000000000000000000000000000000600000000000000ff01000000000000040000000000000000000000000000000000000000000000000400000000000000000000000000007be70000000000000900000000000000ff7f0000000000000000000000000000000000000000000004180000000000000000000000000000ffffffff0000000081000000000000000600000000000000000000000000000000000000000000000400000000000000000000000000000002000000000000000500000000000000ff7fffffffffffff0000000000000000000000000000000004040000000000000000000000000000"]) r6 = creat(&(0x7f00000000c0)='./file0\x00', 0x0) openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000100)='/group.stat\x00', 0x2761, 0x0) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000080), 0xffffffffffffffff) getpid() fallocate(r0, 0x0, 0x0, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x2f, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) memfd_create(&(0x7f0000000080)='!proccgroup\x00', 0x0) ioctl$sock_inet_SIOCSIFPFLAGS(0xffffffffffffffff, 0x8934, &(0x7f0000000400)={'veth0_to_bridge\x00', 0x100}) accept(r6, &(0x7f0000000580)=@alg, &(0x7f0000000600)=0x80) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x2400, 0x8000) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000008c0)={0x2c, 0x0, &(0x7f0000000780)=[@acquire_done={0x40106309, r5, 0x2}, @clear_death={0x400c630f, 0x1, 0x3}, @release={0x40046306, 0x2}], 0xc1, 0x0, &(0x7f00000007c0)="859547f83b9b058a973a491d7e6378544744f2b56b02270a2f78214a936e9afb25cd94695643af6563f86771aa9621b9f30f2ca538b018247a633c28ee01e03b4639679311117971e60dc1538f34e961ae301463172c41754be988f6beb0ce4d83c69f86c236d29520e6cdaf5dbb60404c66d63315ff287deac8632781d0197ef1f81314da0a1ed90b681842cf85a41b496ce0a7a6f5aa4b9b23483eea8861be89b3398c6aec3349174f9cdc9de34df361ac9bf7afd8566849487c3c0a1e3aaacd"}) 04:01:51 executing program 1: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) recvmsg(0xffffffffffffffff, &(0x7f00000036c0)={&(0x7f0000000180)=@can, 0xfd28, &(0x7f00000035c0), 0x0, &(0x7f0000003680)=""/41, 0x29}, 0x0) bind$alg(r0, &(0x7f0000001300)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb(blowfish)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000ff8000)="0a0775b0", 0x4) r1 = accept$alg(r0, 0x0, 0x0) sendmmsg$alg(r1, &(0x7f0000003e80)=[{0x0, 0x0, &(0x7f0000002a80), 0x167, &(0x7f0000000100)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x0) recvmsg(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)=[{&(0x7f0000000200)=""/4096, 0x1000}], 0x1, &(0x7f0000fb3fa9)=""/87, 0x57}, 0x0) 04:01:51 executing program 4: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) recvmsg(0xffffffffffffffff, &(0x7f00000036c0)={&(0x7f0000000180)=@can, 0xfd28, &(0x7f00000035c0), 0x0, &(0x7f0000003680)=""/41, 0x29}, 0x0) bind$alg(r0, &(0x7f0000001300)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb(blowfish)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000ff8000)="0a0775b0", 0x4) r1 = accept$alg(r0, 0x0, 0x0) sendmmsg$alg(0xffffffffffffffff, &(0x7f0000003e80)=[{0x0, 0x0, &(0x7f0000002a80), 0x167, &(0x7f0000000100)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x0) recvmsg(r1, &(0x7f0000000000)={&(0x7f0000f7ffa8)=@alg, 0x61, &(0x7f0000000140)=[{&(0x7f0000000200)=""/4096, 0xfffffe45}], 0x1, &(0x7f0000fb3fa9)=""/87, 0x57}, 0x0) 04:01:51 executing program 3: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000440)=@updpolicy={0xb8, 0x19, 0x523, 0x0, 0x0, {{@in=@multicast2, @in6=@empty={[0x0, 0x0, 0x0, 0x60]}, 0x0, 0x0, 0x0, 0x0, 0xa}}}, 0xb8}}, 0x0) 04:01:51 executing program 2: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000440)=@updpolicy={0xb8, 0x19, 0x523, 0x0, 0x0, {{@in=@multicast2, @in6=@empty={[0x0, 0x0, 0x0, 0x300]}, 0x0, 0x0, 0x0, 0x0, 0xa}}}, 0xb8}}, 0x0) [ 626.032733] binder: release 21988:21995 transaction 360 out, still active 04:01:51 executing program 1: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) recvmsg(0xffffffffffffffff, &(0x7f00000036c0)={&(0x7f0000000180)=@can, 0xfd28, &(0x7f00000035c0), 0x0, &(0x7f0000003680)=""/41, 0x29}, 0x0) bind$alg(r0, &(0x7f0000001300)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb(blowfish)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000ff8000)="0a0775b0", 0x4) r1 = accept$alg(r0, 0x0, 0x0) sendmmsg$alg(r1, &(0x7f0000003e80)=[{0x0, 0x0, &(0x7f0000002a80), 0x167, &(0x7f0000000100)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x0) recvmsg(r1, &(0x7f0000000000)={&(0x7f0000f7ffa8)=@alg, 0x80, 0x0, 0x0, &(0x7f0000fb3fa9)=""/87, 0x57}, 0x0) [ 626.222570] binder: BINDER_SET_CONTEXT_MGR already set [ 626.233886] binder: 22027:22033 ioctl 40046207 0 returned -16 [ 626.265134] binder: 22027:22033 Release 1 refcount change on invalid ref 1 ret -22 [ 626.284092] binder: 22027:22034 BC_ACQUIRE_DONE u0000000000000000 no match [ 626.298698] binder: 22027:22034 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 [ 626.308402] binder: 22027:22034 Release 1 refcount change on invalid ref 2 ret -22 04:01:52 executing program 2: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000440)=@updpolicy={0xb8, 0x19, 0x523, 0x0, 0x0, {{@in=@multicast2, @in6=@empty={[0x0, 0x0, 0x0, 0x324]}, 0x0, 0x0, 0x0, 0x0, 0xa}}}, 0xb8}}, 0x0) 04:01:52 executing program 3: r0 = socket(0x10, 0x3, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) write(r0, &(0x7f0000000080)="240000001e0025eaa87865f51ef6bce90a04000200bff20182a9040c080009000b000000", 0x24) r1 = openat$rfkill(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rfkill\x00', 0x3, 0x0) preadv(r0, &(0x7f0000000040)=[{&(0x7f0000000100)=""/88, 0x58}, {&(0x7f0000000180)=""/115, 0x73}], 0x2, 0x0) faccessat(r1, &(0x7f00000000c0)='./file0\x00', 0x10, 0xfc) 04:01:52 executing program 4: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) recvmsg(0xffffffffffffffff, &(0x7f00000036c0)={&(0x7f0000000180)=@can, 0xfd28, &(0x7f00000035c0), 0x0, &(0x7f0000003680)=""/41, 0x29}, 0x0) bind$alg(r0, &(0x7f0000001300)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb(blowfish)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000ff8000)="0a0775b0", 0x4) r1 = accept$alg(r0, 0x0, 0x0) sendmmsg$alg(0xffffffffffffffff, &(0x7f0000003e80)=[{0x0, 0x0, &(0x7f0000002a80), 0x167, &(0x7f0000000100)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x0) recvmsg(r1, &(0x7f0000000000)={&(0x7f0000f7ffa8)=@alg, 0x61, &(0x7f0000000140)=[{&(0x7f0000000200)=""/4096, 0xfffffe45}], 0x1, &(0x7f0000fb3fa9)=""/87, 0x57}, 0x0) 04:01:52 executing program 5: r0 = socket$inet6(0xa, 0x2, 0x0) r1 = syz_open_dev$mice(&(0x7f00000002c0)='/dev/input/mice\x00', 0x0, 0x0) ioctl$PPPOEIOCDFWD(r1, 0xb101, 0x0) syz_genetlink_get_family_id$nbd(&(0x7f0000000480)='nbd\x00') getsockopt$inet6_IPV6_XFRM_POLICY(r0, 0x29, 0x23, &(0x7f0000000340)={{{@in=@local, @in=@loopback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@local}, 0x0, @in=@remote}}, &(0x7f0000000140)=0xe8) connect$can_bcm(0xffffffffffffffff, &(0x7f00000001c0), 0x10) bind$inet6(r0, &(0x7f0000000040)={0xa, 0x4e24}, 0x1c) lsetxattr$security_ima(&(0x7f0000000280)='./file0\x00', &(0x7f0000000440)='security.ima\x00', 0x0, 0x0, 0x1) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clock_gettime(0x0, &(0x7f0000000100)={0x0, 0x0}) r4 = openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) bind(r4, &(0x7f0000000580)=@can={0x1d, r2}, 0x80) clock_gettime(0x3, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff}) ppoll(&(0x7f0000000000)=[{r0, 0x41a, 0x5902000000000000}], 0x1, &(0x7f0000000200)={0x0, r3+30000000}, &(0x7f0000000240), 0x8) connect$inet6(r0, &(0x7f0000000080)={0xa, 0x4e24, 0x0, @ipv4={[], [], @loopback}}, 0x1c) readv(0xffffffffffffffff, 0x0, 0x0) sendmmsg(r0, &(0x7f00000092c0), 0x4ff, 0x0) connect$pptp(r5, &(0x7f00000004c0)={0x18, 0x2, {0x0, @multicast1}}, 0x1e) 04:01:52 executing program 1: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) recvmsg(0xffffffffffffffff, &(0x7f00000036c0)={&(0x7f0000000180)=@can, 0xfd28, &(0x7f00000035c0), 0x0, &(0x7f0000003680)=""/41, 0x29}, 0x0) bind$alg(r0, &(0x7f0000001300)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb(blowfish)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000ff8000)="0a0775b0", 0x4) r1 = accept$alg(r0, 0x0, 0x0) sendmmsg$alg(r1, &(0x7f0000003e80)=[{0x0, 0x0, &(0x7f0000002a80), 0x167, &(0x7f0000000100)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x0) recvmsg(r1, &(0x7f0000000000)={&(0x7f0000f7ffa8)=@alg, 0x80, 0x0, 0x0, &(0x7f0000fb3fa9)=""/87, 0x57}, 0x0) 04:01:52 executing program 2: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000440)=@updpolicy={0xb8, 0x19, 0x523, 0x0, 0x0, {{@in=@multicast2, @in6=@empty={[0x0, 0x0, 0x0, 0xa00]}, 0x0, 0x0, 0x0, 0x0, 0xa}}}, 0xb8}}, 0x0) 04:01:52 executing program 0: r0 = perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) setxattr$security_smack_entry(&(0x7f0000000380)='./file0\x00', &(0x7f0000000480)='security.SMACK64IPIN\x00', &(0x7f0000000540)='^vboxnet1^\x00', 0xb, 0x1) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r1, &(0x7f0000000040), 0x0}, 0x20) unlink(&(0x7f0000000900)='./file0/file0\x00') r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) r3 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r3, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, &(0x7f00000006c0)={0x0}) ioctl$BINDER_GET_NODE_DEBUG_INFO(r2, 0xc018620b, &(0x7f0000000640)={r4}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f00000000c0)=[@enter_looper], 0x48, 0x0, &(0x7f0000000700)="2ba063fb309ec7fdbfb08e6e91baee7d7d4599fe14129a4d426834556ae420e087d59c0c7be7fcad1abb7e1f8f446f373f611ca1ee9c2231708e18a47bc68a2a79a0b48931f6ff6d"}) ioctl$BINDER_SET_CONTEXT_MGR(r3, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x1) prctl$PR_SET_NAME(0xf, &(0x7f00000004c0)='/group.stat\x00') ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, &(0x7f0000000780)}) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f0000000680)}) ioctl$FS_IOC_FIEMAP(r3, 0xc020660b, &(0x7f0000000b80)=ANY=[@ANYBLOB="0000010000000000200000000000000005000000010000000a00000000000000ff030000000000001a0a000000000000050000000000000000000000000000000000000000000000080000000000000000000000000000000800000000000000ffff0000000000000100008000000000000000000000000000000000000000000000000000000000000000000000000008000000000000003f0000000000000008000000000000000000000000000000000000000000800800000000000000000000000000000200000000000000000400000000000000000000010000000000000000000000000000000000000002110000000000000000000000000000cc0000000000000000000000000000001b0000000000000000000000000000000000000000000000841400000000000000000000000000000300000000000000feffffffffffffff000000000000000000000000000000000000000000000000020000000000000000000000000000000600000000000000ff01000000000000040000000000000000000000000000000000000000000000000400000000000000000000000000007be70000000000000900000000000000ff7f0000000000000000000000000000000000000000000004180000000000000000000000000000ffffffff0000000081000000000000000600000000000000000000000000000000000000000000000400000000000000000000000000000002000000000000000500000000000000ff7fffffffffffff0000000000000000000000000000000004040000000000000000000000000000"]) r6 = creat(&(0x7f00000000c0)='./file0\x00', 0x0) openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000100)='/group.stat\x00', 0x2761, 0x0) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000080), 0xffffffffffffffff) getpid() fallocate(r0, 0x0, 0x0, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x2f, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) memfd_create(&(0x7f0000000080)='!proccgroup\x00', 0x0) ioctl$sock_inet_SIOCSIFPFLAGS(0xffffffffffffffff, 0x8934, &(0x7f0000000400)={'veth0_to_bridge\x00', 0x100}) accept(r6, &(0x7f0000000580)=@alg, &(0x7f0000000600)=0x80) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x2400, 0x8000) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000008c0)={0x2c, 0x0, &(0x7f0000000780)=[@acquire_done={0x40106309, r5, 0x2}, @clear_death={0x400c630f, 0x1, 0x3}, @release={0x40046306, 0x2}], 0xc1, 0x0, &(0x7f00000007c0)="859547f83b9b058a973a491d7e6378544744f2b56b02270a2f78214a936e9afb25cd94695643af6563f86771aa9621b9f30f2ca538b018247a633c28ee01e03b4639679311117971e60dc1538f34e961ae301463172c41754be988f6beb0ce4d83c69f86c236d29520e6cdaf5dbb60404c66d63315ff287deac8632781d0197ef1f81314da0a1ed90b681842cf85a41b496ce0a7a6f5aa4b9b23483eea8861be89b3398c6aec3349174f9cdc9de34df361ac9bf7afd8566849487c3c0a1e3aaacd"}) 04:01:52 executing program 3: r0 = inotify_init1(0x0) fcntl$setown(r0, 0x8, 0xffffffffffffffff) fcntl$getownex(r0, 0x10, &(0x7f000045fff8)={0x0, 0x0}) r2 = openat$autofs(0xffffffffffffff9c, &(0x7f0000000040)='/dev/autofs\x00', 0xb4100, 0x0) ioctl$NBD_CLEAR_SOCK(r2, 0xab04) ptrace$setopts(0x4206, r1, 0x0, 0x0) semget(0x0, 0x1, 0x80) ptrace(0x4207, r1) r3 = memfd_create(&(0x7f0000000000)='\x00', 0x1000000000000000) ioctl$CAPI_REGISTER(r2, 0x400c4301, &(0x7f0000000080)={0x5, 0xa5a5, 0x3}) write$binfmt_aout(r3, &(0x7f0000000180)=ANY=[@ANYBLOB="ffff0100000000000000ee"], 0xb) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x11, r3, 0x0) ptrace$getregset(0x4205, r1, 0x202, &(0x7f0000000140)={0x0}) 04:01:52 executing program 4: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) recvmsg(0xffffffffffffffff, &(0x7f00000036c0)={&(0x7f0000000180)=@can, 0xfd28, &(0x7f00000035c0), 0x0, &(0x7f0000003680)=""/41, 0x29}, 0x0) bind$alg(r0, &(0x7f0000001300)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb(blowfish)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000ff8000)="0a0775b0", 0x4) r1 = accept$alg(r0, 0x0, 0x0) sendmmsg$alg(0xffffffffffffffff, &(0x7f0000003e80)=[{0x0, 0x0, &(0x7f0000002a80), 0x167, &(0x7f0000000100)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x0) recvmsg(r1, &(0x7f0000000000)={&(0x7f0000f7ffa8)=@alg, 0x61, &(0x7f0000000140)=[{&(0x7f0000000200)=""/4096, 0xfffffe45}], 0x1, &(0x7f0000fb3fa9)=""/87, 0x57}, 0x0) 04:01:52 executing program 1: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) recvmsg(0xffffffffffffffff, &(0x7f00000036c0)={&(0x7f0000000180)=@can, 0xfd28, &(0x7f00000035c0), 0x0, &(0x7f0000003680)=""/41, 0x29}, 0x0) bind$alg(r0, &(0x7f0000001300)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb(blowfish)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000ff8000)="0a0775b0", 0x4) r1 = accept$alg(r0, 0x0, 0x0) sendmmsg$alg(r1, &(0x7f0000003e80)=[{0x0, 0x0, &(0x7f0000002a80), 0x167, &(0x7f0000000100)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x0) recvmsg(r1, &(0x7f0000000000)={&(0x7f0000f7ffa8)=@alg, 0x80, 0x0, 0x0, &(0x7f0000fb3fa9)=""/87, 0x57}, 0x0) 04:01:52 executing program 2: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000440)=@updpolicy={0xb8, 0x19, 0x523, 0x0, 0x0, {{@in=@multicast2, @in6=@empty={[0x0, 0x0, 0x0, 0xe00]}, 0x0, 0x0, 0x0, 0x0, 0xa}}}, 0xb8}}, 0x0) [ 626.932861] binder: release 22027:22033 transaction 363 out, still active 04:01:52 executing program 2: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000440)=@updpolicy={0xb8, 0x19, 0x523, 0x0, 0x0, {{@in=@multicast2, @in6=@empty={[0x0, 0x0, 0x0, 0xf00]}, 0x0, 0x0, 0x0, 0x0, 0xa}}}, 0xb8}}, 0x0) 04:01:52 executing program 1: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) recvmsg(0xffffffffffffffff, &(0x7f00000036c0)={&(0x7f0000000180)=@can, 0xfd28, &(0x7f00000035c0), 0x0, &(0x7f0000003680)=""/41, 0x29}, 0x0) bind$alg(r0, &(0x7f0000001300)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb(blowfish)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000ff8000)="0a0775b0", 0x4) r1 = accept$alg(r0, 0x0, 0x0) sendmmsg$alg(r1, &(0x7f0000003e80)=[{0x0, 0x0, &(0x7f0000002a80), 0x167, &(0x7f0000000100)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x0) recvmsg(r1, &(0x7f0000000000)={&(0x7f0000f7ffa8)=@alg, 0x80, &(0x7f0000000140), 0x0, &(0x7f0000fb3fa9)=""/87, 0x57}, 0x0) 04:01:52 executing program 3: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000140)='/dev/net/tun\x00', 0x0, 0x0) r1 = openat$qat_adf_ctl(0xffffffffffffff9c, &(0x7f0000000040)='/dev/qat_adf_ctl\x00', 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) write$FUSE_DIRENTPLUS(0xffffffffffffffff, 0x0, 0x0) ioctl$sock_FIOGETOWN(0xffffffffffffffff, 0x8903, 0x0) ioctl(0xffffffffffffffff, 0x0, &(0x7f0000000280)) ioctl$DRM_IOCTL_AGP_ALLOC(0xffffffffffffffff, 0xc0206434, &(0x7f00000000c0)={0x3ff, 0x0, 0x0, 0x7}) ioctl$DRM_IOCTL_AGP_UNBIND(0xffffffffffffffff, 0x40106437, &(0x7f0000000640)={r2, 0x7}) syz_open_dev$ndb(&(0x7f0000000040)='/dev/nbd#\x00', 0x0, 0x0) request_key(&(0x7f0000000300)='ceph\x00', 0x0, &(0x7f0000000380)='/dev/nbd#\x00', 0xffffffffffffffff) ioctl$SNDRV_SEQ_IOCTL_SET_PORT_INFO(r1, 0x40a85323, &(0x7f0000000880)={{}, 'port1\x00', 0x45, 0x40002, 0x4103, 0x400000000102, 0x0, 0x0, 0x0, 0x0, 0x0, 0x400}) r3 = openat$ion(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ion\x00', 0x0, 0x0) setsockopt$inet6_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f00000004c0)='cdg\x00', 0x4) getsockopt$IP_VS_SO_GET_SERVICE(0xffffffffffffffff, 0x0, 0x483, &(0x7f0000000240), &(0x7f00000002c0)=0x68) ioctl$ION_IOC_ALLOC(r3, 0xc0184900, &(0x7f0000000500)={0x10000009, 0xffffffffffffffff, 0x0, 0xffffffffffffffff}) mmap(&(0x7f0000bfe000/0x400000)=nil, 0x400000, 0x0, 0x811, r4, 0x0) bpf$BPF_GET_PROG_INFO(0xf, 0x0, 0x0) bpf$BPF_PROG_GET_FD_BY_ID(0xd, 0x0, 0x0) write$P9_RLERRORu(0xffffffffffffffff, 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x4002}) ioctl$TUNSETLINK(r0, 0x400454cd, 0x336) syz_init_net_socket$bt_l2cap(0x1f, 0x0, 0x0) close(0xffffffffffffffff) 04:01:52 executing program 4: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) recvmsg(0xffffffffffffffff, &(0x7f00000036c0)={&(0x7f0000000180)=@can, 0xfd28, &(0x7f00000035c0), 0x0, &(0x7f0000003680)=""/41, 0x29}, 0x0) bind$alg(r0, &(0x7f0000001300)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb(blowfish)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000ff8000)="0a0775b0", 0x4) r1 = accept$alg(r0, 0x0, 0x0) sendmmsg$alg(r1, 0x0, 0x0, 0x0) recvmsg(r1, &(0x7f0000000000)={&(0x7f0000f7ffa8)=@alg, 0x61, &(0x7f0000000140)=[{&(0x7f0000000200)=""/4096, 0xfffffe45}], 0x1, &(0x7f0000fb3fa9)=""/87, 0x57}, 0x0) [ 627.109368] binder: BINDER_SET_CONTEXT_MGR already set [ 627.163268] binder: 22063:22065 ioctl 40046207 0 returned -16 [ 627.190151] binder: 22063:22070 Release 1 refcount change on invalid ref 1 ret -22 [ 627.229824] QAT: Invalid ioctl [ 627.284315] net_ratelimit: 26 callbacks suppressed [ 627.284322] protocol 88fb is buggy, dev hsr_slave_0 [ 627.294469] protocol 88fb is buggy, dev hsr_slave_1 [ 627.308912] binder: 22063:22070 BC_ACQUIRE_DONE u0000000000000000 no match [ 627.321573] binder: 22063:22070 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 [ 627.330243] binder: 22063:22070 Release 1 refcount change on invalid ref 2 ret -22 [ 627.364340] protocol 88fb is buggy, dev hsr_slave_0 [ 627.369441] protocol 88fb is buggy, dev hsr_slave_1 [ 627.374594] protocol 88fb is buggy, dev hsr_slave_0 [ 627.379659] protocol 88fb is buggy, dev hsr_slave_1 [ 627.398037] QAT: Invalid ioctl 04:01:53 executing program 1: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) recvmsg(0xffffffffffffffff, &(0x7f00000036c0)={&(0x7f0000000180)=@can, 0xfd28, &(0x7f00000035c0), 0x0, &(0x7f0000003680)=""/41, 0x29}, 0x0) bind$alg(r0, &(0x7f0000001300)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb(blowfish)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000ff8000)="0a0775b0", 0x4) r1 = accept$alg(r0, 0x0, 0x0) sendmmsg$alg(r1, &(0x7f0000003e80)=[{0x0, 0x0, &(0x7f0000002a80), 0x167, &(0x7f0000000100)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x0) recvmsg(r1, &(0x7f0000000000)={&(0x7f0000f7ffa8)=@alg, 0x80, &(0x7f0000000140), 0x0, &(0x7f0000fb3fa9)=""/87, 0x57}, 0x0) 04:01:53 executing program 2: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000440)=@updpolicy={0xb8, 0x19, 0x523, 0x0, 0x0, {{@in=@multicast2, @in6=@empty={[0x0, 0x0, 0x0, 0x2403]}, 0x0, 0x0, 0x0, 0x0, 0xa}}}, 0xb8}}, 0x0) 04:01:53 executing program 0: r0 = perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) setxattr$security_smack_entry(&(0x7f0000000380)='./file0\x00', &(0x7f0000000480)='security.SMACK64IPIN\x00', &(0x7f0000000540)='^vboxnet1^\x00', 0xb, 0x1) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r1, &(0x7f0000000040), 0x0}, 0x20) unlink(&(0x7f0000000900)='./file0/file0\x00') r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) r3 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r3, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, &(0x7f00000006c0)={0x0}) ioctl$BINDER_GET_NODE_DEBUG_INFO(r2, 0xc018620b, &(0x7f0000000640)={r4}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f00000000c0)=[@enter_looper], 0x48, 0x0, &(0x7f0000000700)="2ba063fb309ec7fdbfb08e6e91baee7d7d4599fe14129a4d426834556ae420e087d59c0c7be7fcad1abb7e1f8f446f373f611ca1ee9c2231708e18a47bc68a2a79a0b48931f6ff6d"}) ioctl$BINDER_SET_CONTEXT_MGR(r3, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x1) prctl$PR_SET_NAME(0xf, &(0x7f00000004c0)='/group.stat\x00') ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, &(0x7f0000000780)}) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f0000000680)}) ioctl$FS_IOC_FIEMAP(r3, 0xc020660b, &(0x7f0000000b80)=ANY=[@ANYBLOB="0000010000000000200000000000000005000000010000000a00000000000000ff030000000000001a0a000000000000050000000000000000000000000000000000000000000000080000000000000000000000000000000800000000000000ffff0000000000000100008000000000000000000000000000000000000000000000000000000000000000000000000008000000000000003f0000000000000008000000000000000000000000000000000000000000800800000000000000000000000000000200000000000000000400000000000000000000010000000000000000000000000000000000000002110000000000000000000000000000cc0000000000000000000000000000001b0000000000000000000000000000000000000000000000841400000000000000000000000000000300000000000000feffffffffffffff000000000000000000000000000000000000000000000000020000000000000000000000000000000600000000000000ff01000000000000040000000000000000000000000000000000000000000000000400000000000000000000000000007be70000000000000900000000000000ff7f0000000000000000000000000000000000000000000004180000000000000000000000000000ffffffff0000000081000000000000000600000000000000000000000000000000000000000000000400000000000000000000000000000002000000000000000500000000000000ff7fffffffffffff0000000000000000000000000000000004040000000000000000000000000000"]) r6 = creat(&(0x7f00000000c0)='./file0\x00', 0x0) openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000100)='/group.stat\x00', 0x2761, 0x0) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000080), 0xffffffffffffffff) getpid() fallocate(r0, 0x0, 0x0, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x2f, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) memfd_create(&(0x7f0000000080)='!proccgroup\x00', 0x0) ioctl$sock_inet_SIOCSIFPFLAGS(0xffffffffffffffff, 0x8934, &(0x7f0000000400)={'veth0_to_bridge\x00', 0x100}) accept(r6, &(0x7f0000000580)=@alg, &(0x7f0000000600)=0x80) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x2400, 0x8000) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000008c0)={0x2c, 0x0, &(0x7f0000000780)=[@acquire_done={0x40106309, r5, 0x2}, @clear_death={0x400c630f, 0x1, 0x3}, @release={0x40046306, 0x2}], 0xc1, 0x0, &(0x7f00000007c0)="859547f83b9b058a973a491d7e6378544744f2b56b02270a2f78214a936e9afb25cd94695643af6563f86771aa9621b9f30f2ca538b018247a633c28ee01e03b4639679311117971e60dc1538f34e961ae301463172c41754be988f6beb0ce4d83c69f86c236d29520e6cdaf5dbb60404c66d63315ff287deac8632781d0197ef1f81314da0a1ed90b681842cf85a41b496ce0a7a6f5aa4b9b23483eea8861be89b3398c6aec3349174f9cdc9de34df361ac9bf7afd8566849487c3c0a1e3aaacd"}) 04:01:53 executing program 5: r0 = socket$inet6(0xa, 0x2, 0x0) r1 = syz_open_dev$mice(&(0x7f00000002c0)='/dev/input/mice\x00', 0x0, 0x0) ioctl$PPPOEIOCDFWD(r1, 0xb101, 0x0) syz_genetlink_get_family_id$nbd(&(0x7f0000000480)='nbd\x00') getsockopt$inet6_IPV6_XFRM_POLICY(r0, 0x29, 0x23, &(0x7f0000000340)={{{@in=@local, @in=@loopback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@local}, 0x0, @in=@remote}}, &(0x7f0000000140)=0xe8) connect$can_bcm(0xffffffffffffffff, &(0x7f00000001c0), 0x10) bind$inet6(r0, &(0x7f0000000040)={0xa, 0x4e24}, 0x1c) lsetxattr$security_ima(&(0x7f0000000280)='./file0\x00', &(0x7f0000000440)='security.ima\x00', 0x0, 0x0, 0x1) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clock_gettime(0x0, &(0x7f0000000100)={0x0, 0x0}) r4 = openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) bind(r4, &(0x7f0000000580)=@can={0x1d, r2}, 0x80) clock_gettime(0x3, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff}) ppoll(&(0x7f0000000000)=[{r0, 0x41a, 0x6400000000000000}], 0x1, &(0x7f0000000200)={0x0, r3+30000000}, &(0x7f0000000240), 0x8) connect$inet6(r0, &(0x7f0000000080)={0xa, 0x4e24, 0x0, @ipv4={[], [], @loopback}}, 0x1c) readv(0xffffffffffffffff, 0x0, 0x0) sendmmsg(r0, &(0x7f00000092c0), 0x4ff, 0x0) connect$pptp(r5, &(0x7f00000004c0)={0x18, 0x2, {0x0, @multicast1}}, 0x1e) 04:01:53 executing program 4: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) recvmsg(0xffffffffffffffff, &(0x7f00000036c0)={&(0x7f0000000180)=@can, 0xfd28, &(0x7f00000035c0), 0x0, &(0x7f0000003680)=""/41, 0x29}, 0x0) bind$alg(r0, &(0x7f0000001300)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb(blowfish)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000ff8000)="0a0775b0", 0x4) r1 = accept$alg(r0, 0x0, 0x0) sendmmsg$alg(r1, 0x0, 0x0, 0x0) recvmsg(r1, &(0x7f0000000000)={&(0x7f0000f7ffa8)=@alg, 0x61, &(0x7f0000000140)=[{&(0x7f0000000200)=""/4096, 0xfffffe45}], 0x1, &(0x7f0000fb3fa9)=""/87, 0x57}, 0x0) 04:01:53 executing program 2: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000440)=@updpolicy={0xb8, 0x19, 0x523, 0x0, 0x0, {{@in=@multicast2, @in6=@empty={[0x0, 0x0, 0x0, 0x2f00]}, 0x0, 0x0, 0x0, 0x0, 0xa}}}, 0xb8}}, 0x0) [ 627.640523] binder: BINDER_SET_CONTEXT_MGR already set [ 627.660351] binder: 22085:22091 ioctl 40046207 0 returned -16 04:01:53 executing program 4: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) recvmsg(0xffffffffffffffff, &(0x7f00000036c0)={&(0x7f0000000180)=@can, 0xfd28, &(0x7f00000035c0), 0x0, &(0x7f0000003680)=""/41, 0x29}, 0x0) bind$alg(r0, &(0x7f0000001300)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb(blowfish)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000ff8000)="0a0775b0", 0x4) r1 = accept$alg(r0, 0x0, 0x0) sendmmsg$alg(r1, 0x0, 0x0, 0x0) recvmsg(r1, &(0x7f0000000000)={&(0x7f0000f7ffa8)=@alg, 0x61, &(0x7f0000000140)=[{&(0x7f0000000200)=""/4096, 0xfffffe45}], 0x1, &(0x7f0000fb3fa9)=""/87, 0x57}, 0x0) [ 627.716887] binder: 22085:22091 Release 1 refcount change on invalid ref 1 ret -22 04:01:53 executing program 2: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000440)=@updpolicy={0xb8, 0x19, 0x523, 0x0, 0x0, {{@in=@multicast2, @in6=@empty={[0x0, 0x0, 0x0, 0x6000]}, 0x0, 0x0, 0x0, 0x0, 0xa}}}, 0xb8}}, 0x0) 04:01:53 executing program 1: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) recvmsg(0xffffffffffffffff, &(0x7f00000036c0)={&(0x7f0000000180)=@can, 0xfd28, &(0x7f00000035c0), 0x0, &(0x7f0000003680)=""/41, 0x29}, 0x0) bind$alg(r0, &(0x7f0000001300)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb(blowfish)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000ff8000)="0a0775b0", 0x4) r1 = accept$alg(r0, 0x0, 0x0) sendmmsg$alg(r1, &(0x7f0000003e80)=[{0x0, 0x0, &(0x7f0000002a80), 0x167, &(0x7f0000000100)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x0) recvmsg(r1, &(0x7f0000000000)={&(0x7f0000f7ffa8)=@alg, 0x80, &(0x7f0000000140), 0x0, &(0x7f0000fb3fa9)=""/87, 0x57}, 0x0) [ 627.832380] binder: 22085:22091 BC_ACQUIRE_DONE u0000000000000000 no match [ 627.866712] binder: 22085:22091 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 04:01:53 executing program 4: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) recvmsg(0xffffffffffffffff, &(0x7f00000036c0)={&(0x7f0000000180)=@can, 0xfd28, &(0x7f00000035c0), 0x0, &(0x7f0000003680)=""/41, 0x29}, 0x0) bind$alg(r0, &(0x7f0000001300)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb(blowfish)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000ff8000)="0a0775b0", 0x4) r1 = accept$alg(r0, 0x0, 0x0) sendmmsg$alg(r1, &(0x7f0000003e80), 0x0, 0x0) recvmsg(r1, &(0x7f0000000000)={&(0x7f0000f7ffa8)=@alg, 0x61, &(0x7f0000000140)=[{&(0x7f0000000200)=""/4096, 0xfffffe45}], 0x1, &(0x7f0000fb3fa9)=""/87, 0x57}, 0x0) [ 627.884487] binder: 22085:22091 Release 1 refcount change on invalid ref 2 ret -22 04:01:53 executing program 3: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/kvm\x00', 0x0, 0x0) r1 = syz_open_dev$radio(0x0, 0xffffffffffffffff, 0x2) ioctl$SNDRV_SEQ_IOCTL_GET_CLIENT_INFO(r1, 0xc0bc5310, &(0x7f0000000100)) r2 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r2, 0xae60) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) fsetxattr$trusted_overlay_upper(r0, &(0x7f0000000000)='trusted.overlay.upper\x00', 0x0, 0x0, 0x0) ioctl$SNDRV_RAWMIDI_IOCTL_PVERSION(0xffffffffffffffff, 0x80045700, 0x0) ioctl$SIOCX25GSUBSCRIP(r1, 0x89e0, &(0x7f00000001c0)={'rose0\x00', 0x1, 0x9}) timer_create(0x0, 0x0, 0x0) ioctl$KVM_RUN(r3, 0xae80, 0x0) dup2(r0, r3) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) dup3(r3, r2, 0x0) 04:01:53 executing program 2: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000440)=@updpolicy={0xb8, 0x19, 0x523, 0x0, 0x0, {{@in=@multicast2, @in6=@empty={[0x0, 0x0, 0x0, 0xf000]}, 0x0, 0x0, 0x0, 0x0, 0xa}}}, 0xb8}}, 0x0) 04:01:53 executing program 1: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) recvmsg(0xffffffffffffffff, &(0x7f00000036c0)={&(0x7f0000000180)=@can, 0xfd28, &(0x7f00000035c0), 0x0, &(0x7f0000003680)=""/41, 0x29}, 0x0) bind$alg(r0, &(0x7f0000001300)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb(blowfish)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000ff8000)="0a0775b0", 0x4) r1 = accept$alg(r0, 0x0, 0x0) sendmmsg$alg(r1, &(0x7f0000003e80)=[{0x0, 0x0, &(0x7f0000002a80), 0x167, &(0x7f0000000100)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x0) recvmsg(r1, &(0x7f0000000000)={&(0x7f0000f7ffa8)=@alg, 0x80, &(0x7f0000000140)=[{0x0}], 0x1, &(0x7f0000fb3fa9)=""/87, 0x57}, 0x0) 04:01:53 executing program 4: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) recvmsg(0xffffffffffffffff, &(0x7f00000036c0)={&(0x7f0000000180)=@can, 0xfd28, &(0x7f00000035c0), 0x0, &(0x7f0000003680)=""/41, 0x29}, 0x0) bind$alg(r0, &(0x7f0000001300)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb(blowfish)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000ff8000)="0a0775b0", 0x4) r1 = accept$alg(r0, 0x0, 0x0) sendmmsg$alg(r1, &(0x7f0000003e80), 0x0, 0x0) recvmsg(r1, &(0x7f0000000000)={&(0x7f0000f7ffa8)=@alg, 0x61, &(0x7f0000000140)=[{&(0x7f0000000200)=""/4096, 0xfffffe45}], 0x1, &(0x7f0000fb3fa9)=""/87, 0x57}, 0x0) [ 628.324391] protocol 88fb is buggy, dev hsr_slave_0 [ 628.329566] protocol 88fb is buggy, dev hsr_slave_1 [ 628.334750] protocol 88fb is buggy, dev hsr_slave_0 [ 628.339830] protocol 88fb is buggy, dev hsr_slave_1 04:01:54 executing program 0: r0 = perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) setxattr$security_smack_entry(&(0x7f0000000380)='./file0\x00', &(0x7f0000000480)='security.SMACK64IPIN\x00', &(0x7f0000000540)='^vboxnet1^\x00', 0xb, 0x1) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r1, &(0x7f0000000040), 0x0}, 0x20) unlink(&(0x7f0000000900)='./file0/file0\x00') r2 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r3 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r3, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, &(0x7f00000006c0)={0x0}) ioctl$BINDER_GET_NODE_DEBUG_INFO(r2, 0xc018620b, &(0x7f0000000640)={r4}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f00000000c0)=[@enter_looper], 0x48, 0x0, &(0x7f0000000700)="2ba063fb309ec7fdbfb08e6e91baee7d7d4599fe14129a4d426834556ae420e087d59c0c7be7fcad1abb7e1f8f446f373f611ca1ee9c2231708e18a47bc68a2a79a0b48931f6ff6d"}) ioctl$BINDER_SET_CONTEXT_MGR(r3, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x1) prctl$PR_SET_NAME(0xf, &(0x7f00000004c0)='/group.stat\x00') ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, &(0x7f0000000780)}) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f0000000680)}) ioctl$FS_IOC_FIEMAP(r3, 0xc020660b, &(0x7f0000000b80)=ANY=[@ANYBLOB="0000010000000000200000000000000005000000010000000a00000000000000ff030000000000001a0a000000000000050000000000000000000000000000000000000000000000080000000000000000000000000000000800000000000000ffff0000000000000100008000000000000000000000000000000000000000000000000000000000000000000000000008000000000000003f0000000000000008000000000000000000000000000000000000000000800800000000000000000000000000000200000000000000000400000000000000000000010000000000000000000000000000000000000002110000000000000000000000000000cc0000000000000000000000000000001b0000000000000000000000000000000000000000000000841400000000000000000000000000000300000000000000feffffffffffffff000000000000000000000000000000000000000000000000020000000000000000000000000000000600000000000000ff01000000000000040000000000000000000000000000000000000000000000000400000000000000000000000000007be70000000000000900000000000000ff7f0000000000000000000000000000000000000000000004180000000000000000000000000000ffffffff0000000081000000000000000600000000000000000000000000000000000000000000000400000000000000000000000000000002000000000000000500000000000000ff7fffffffffffff0000000000000000000000000000000004040000000000000000000000000000"]) r6 = creat(&(0x7f00000000c0)='./file0\x00', 0x0) openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000100)='/group.stat\x00', 0x2761, 0x0) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000080), 0xffffffffffffffff) getpid() fallocate(r0, 0x0, 0x0, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x2f, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) memfd_create(&(0x7f0000000080)='!proccgroup\x00', 0x0) ioctl$sock_inet_SIOCSIFPFLAGS(0xffffffffffffffff, 0x8934, &(0x7f0000000400)={'veth0_to_bridge\x00', 0x100}) accept(r6, &(0x7f0000000580)=@alg, &(0x7f0000000600)=0x80) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x2400, 0x8000) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000008c0)={0x2c, 0x0, &(0x7f0000000780)=[@acquire_done={0x40106309, r5, 0x2}, @clear_death={0x400c630f, 0x1, 0x3}, @release={0x40046306, 0x2}], 0xc1, 0x0, &(0x7f00000007c0)="859547f83b9b058a973a491d7e6378544744f2b56b02270a2f78214a936e9afb25cd94695643af6563f86771aa9621b9f30f2ca538b018247a633c28ee01e03b4639679311117971e60dc1538f34e961ae301463172c41754be988f6beb0ce4d83c69f86c236d29520e6cdaf5dbb60404c66d63315ff287deac8632781d0197ef1f81314da0a1ed90b681842cf85a41b496ce0a7a6f5aa4b9b23483eea8861be89b3398c6aec3349174f9cdc9de34df361ac9bf7afd8566849487c3c0a1e3aaacd"}) 04:01:54 executing program 5: r0 = socket$inet6(0xa, 0x2, 0x0) r1 = syz_open_dev$mice(&(0x7f00000002c0)='/dev/input/mice\x00', 0x0, 0x0) ioctl$PPPOEIOCDFWD(r1, 0xb101, 0x0) syz_genetlink_get_family_id$nbd(&(0x7f0000000480)='nbd\x00') getsockopt$inet6_IPV6_XFRM_POLICY(r0, 0x29, 0x23, &(0x7f0000000340)={{{@in=@local, @in=@loopback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@local}, 0x0, @in=@remote}}, &(0x7f0000000140)=0xe8) connect$can_bcm(0xffffffffffffffff, &(0x7f00000001c0), 0x10) bind$inet6(r0, &(0x7f0000000040)={0xa, 0x4e24}, 0x1c) lsetxattr$security_ima(&(0x7f0000000280)='./file0\x00', &(0x7f0000000440)='security.ima\x00', 0x0, 0x0, 0x1) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clock_gettime(0x0, &(0x7f0000000100)={0x0, 0x0}) r4 = openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) bind(r4, &(0x7f0000000580)=@can={0x1d, r2}, 0x80) clock_gettime(0x3, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff}) ppoll(&(0x7f0000000000)=[{r0, 0x41a, 0xfcffffff00000000}], 0x1, &(0x7f0000000200)={0x0, r3+30000000}, &(0x7f0000000240), 0x8) connect$inet6(r0, &(0x7f0000000080)={0xa, 0x4e24, 0x0, @ipv4={[], [], @loopback}}, 0x1c) readv(0xffffffffffffffff, 0x0, 0x0) sendmmsg(r0, &(0x7f00000092c0), 0x4ff, 0x0) connect$pptp(r5, &(0x7f00000004c0)={0x18, 0x2, {0x0, @multicast1}}, 0x1e) 04:01:54 executing program 2: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000440)=@updpolicy={0xb8, 0x19, 0x523, 0x0, 0x0, {{@in=@multicast2, @in6=@empty={[0x0, 0x0, 0x0, 0xf0ffff]}, 0x0, 0x0, 0x0, 0x0, 0xa}}}, 0xb8}}, 0x0) 04:01:54 executing program 4: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) recvmsg(0xffffffffffffffff, &(0x7f00000036c0)={&(0x7f0000000180)=@can, 0xfd28, &(0x7f00000035c0), 0x0, &(0x7f0000003680)=""/41, 0x29}, 0x0) bind$alg(r0, &(0x7f0000001300)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb(blowfish)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000ff8000)="0a0775b0", 0x4) r1 = accept$alg(r0, 0x0, 0x0) sendmmsg$alg(r1, &(0x7f0000003e80), 0x0, 0x0) recvmsg(r1, &(0x7f0000000000)={&(0x7f0000f7ffa8)=@alg, 0x61, &(0x7f0000000140)=[{&(0x7f0000000200)=""/4096, 0xfffffe45}], 0x1, &(0x7f0000fb3fa9)=""/87, 0x57}, 0x0) 04:01:54 executing program 1: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) recvmsg(0xffffffffffffffff, &(0x7f00000036c0)={&(0x7f0000000180)=@can, 0xfd28, &(0x7f00000035c0), 0x0, &(0x7f0000003680)=""/41, 0x29}, 0x0) bind$alg(r0, &(0x7f0000001300)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb(blowfish)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000ff8000)="0a0775b0", 0x4) r1 = accept$alg(r0, 0x0, 0x0) sendmmsg$alg(r1, &(0x7f0000003e80)=[{0x0, 0x0, &(0x7f0000002a80), 0x167, &(0x7f0000000100)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x0) recvmsg(r1, &(0x7f0000000000)={&(0x7f0000f7ffa8)=@alg, 0x80, &(0x7f0000000140)=[{0x0}], 0x1, &(0x7f0000fb3fa9)=""/87, 0x57}, 0x0) 04:01:54 executing program 3: pipe(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = socket$inet6(0xa, 0x1, 0x0) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000640), 0xffffffffffffffff) r3 = getpid() sched_setscheduler(r3, 0x5, &(0x7f0000000140)) ioctl$VIDIOC_S_AUDIO(r1, 0x40345622, &(0x7f00000000c0)={0x64, "0c9f285432571450171613ff22826eef0f59800b7ad3b59f1ada1d1988b37eff", 0x1, 0x1}) setsockopt$inet6_buf(r2, 0x29, 0x6, &(0x7f0000000080), 0xa59568830e3ea86b) sched_setattr(0x0, &(0x7f0000000000)={0x0, 0x6, 0x0, 0x0, 0x0, 0x9917, 0xffff}, 0x0) r4 = open(&(0x7f0000000880)='./file0\x00', 0x141042, 0x80) write$evdev(r4, &(0x7f0000000400)=[{}], 0x18) bind$rds(r0, &(0x7f0000000080)={0x2, 0x4e24, @multicast1}, 0x10) sendfile(r4, r4, &(0x7f00000001c0), 0xa198) [ 628.529932] binder: BINDER_SET_CONTEXT_MGR already set [ 628.564484] binder: 22127:22132 ioctl 40046207 0 returned -16 [ 628.572177] binder: 22127:22132 Release 1 refcount change on invalid ref 1 ret -22 [ 628.606668] binder: 22127:22142 BC_ACQUIRE_DONE u0000000000000000 no match [ 628.619317] binder: 22127:22142 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 [ 628.626849] binder: 22127:22142 Release 1 refcount change on invalid ref 2 ret -22 04:01:54 executing program 2: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000440)=@updpolicy={0xb8, 0x19, 0x523, 0x0, 0x0, {{@in=@multicast2, @in6=@empty={[0x0, 0x0, 0x0, 0x1000000]}, 0x0, 0x0, 0x0, 0x0, 0xa}}}, 0xb8}}, 0x0) 04:01:54 executing program 1: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) recvmsg(0xffffffffffffffff, &(0x7f00000036c0)={&(0x7f0000000180)=@can, 0xfd28, &(0x7f00000035c0), 0x0, &(0x7f0000003680)=""/41, 0x29}, 0x0) bind$alg(r0, &(0x7f0000001300)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb(blowfish)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000ff8000)="0a0775b0", 0x4) r1 = accept$alg(r0, 0x0, 0x0) sendmmsg$alg(r1, &(0x7f0000003e80)=[{0x0, 0x0, &(0x7f0000002a80), 0x167, &(0x7f0000000100)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x0) recvmsg(r1, &(0x7f0000000000)={&(0x7f0000f7ffa8)=@alg, 0x80, &(0x7f0000000140)=[{0x0}], 0x1, &(0x7f0000fb3fa9)=""/87, 0x57}, 0x0) 04:01:54 executing program 4: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) recvmsg(0xffffffffffffffff, &(0x7f00000036c0)={&(0x7f0000000180)=@can, 0xfd28, &(0x7f00000035c0), 0x0, &(0x7f0000003680)=""/41, 0x29}, 0x0) bind$alg(r0, &(0x7f0000001300)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb(blowfish)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000ff8000)="0a0775b0", 0x4) r1 = accept$alg(r0, 0x0, 0x0) sendmmsg$alg(r1, &(0x7f0000003e80)=[{0x0, 0x0, 0x0, 0x0, &(0x7f0000000100)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x0) recvmsg(r1, &(0x7f0000000000)={&(0x7f0000f7ffa8)=@alg, 0x61, &(0x7f0000000140)=[{&(0x7f0000000200)=""/4096, 0xfffffe45}], 0x1, &(0x7f0000fb3fa9)=""/87, 0x57}, 0x0) 04:01:54 executing program 1: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) recvmsg(0xffffffffffffffff, &(0x7f00000036c0)={&(0x7f0000000180)=@can, 0xfd28, &(0x7f00000035c0), 0x0, &(0x7f0000003680)=""/41, 0x29}, 0x0) bind$alg(r0, &(0x7f0000001300)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb(blowfish)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000ff8000)="0a0775b0", 0x4) r1 = accept$alg(r0, 0x0, 0x0) sendmmsg$alg(r1, &(0x7f0000003e80)=[{0x0, 0x0, &(0x7f0000002a80), 0x167, &(0x7f0000000100)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x0) recvmsg(r1, &(0x7f0000000000)={&(0x7f0000f7ffa8)=@alg, 0x80, &(0x7f0000000140)=[{&(0x7f0000000200)=""/4096, 0x1000}], 0x1}, 0x0) 04:01:54 executing program 2: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000440)=@updpolicy={0xb8, 0x19, 0x523, 0x0, 0x0, {{@in=@multicast2, @in6=@empty={[0x0, 0x0, 0x0, 0x2000000]}, 0x0, 0x0, 0x0, 0x0, 0xa}}}, 0xb8}}, 0x0) 04:01:54 executing program 1: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) recvmsg(0xffffffffffffffff, &(0x7f00000036c0)={&(0x7f0000000180)=@can, 0xfd28, &(0x7f00000035c0), 0x0, &(0x7f0000003680)=""/41, 0x29}, 0x0) bind$alg(r0, &(0x7f0000001300)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb(blowfish)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000ff8000)="0a0775b0", 0x4) r1 = accept$alg(r0, 0x0, 0x0) sendmmsg$alg(r1, &(0x7f0000003e80)=[{0x0, 0x0, &(0x7f0000002a80), 0x167, &(0x7f0000000100)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x0) recvmsg(r1, &(0x7f0000000000)={&(0x7f0000f7ffa8)=@alg, 0x80, &(0x7f0000000140)=[{&(0x7f0000000200)=""/4096, 0x1000}], 0x1}, 0x0) 04:01:55 executing program 0: r0 = perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) setxattr$security_smack_entry(&(0x7f0000000380)='./file0\x00', &(0x7f0000000480)='security.SMACK64IPIN\x00', &(0x7f0000000540)='^vboxnet1^\x00', 0xb, 0x1) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r1, &(0x7f0000000040), 0x0}, 0x20) unlink(&(0x7f0000000900)='./file0/file0\x00') r2 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r3 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r3, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, &(0x7f00000006c0)={0x0}) ioctl$BINDER_GET_NODE_DEBUG_INFO(r2, 0xc018620b, &(0x7f0000000640)={r4}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f00000000c0)=[@enter_looper], 0x48, 0x0, &(0x7f0000000700)="2ba063fb309ec7fdbfb08e6e91baee7d7d4599fe14129a4d426834556ae420e087d59c0c7be7fcad1abb7e1f8f446f373f611ca1ee9c2231708e18a47bc68a2a79a0b48931f6ff6d"}) ioctl$BINDER_SET_CONTEXT_MGR(r3, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x1) prctl$PR_SET_NAME(0xf, &(0x7f00000004c0)='/group.stat\x00') ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, &(0x7f0000000780)}) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f0000000680)}) ioctl$FS_IOC_FIEMAP(r3, 0xc020660b, &(0x7f0000000b80)=ANY=[@ANYBLOB="0000010000000000200000000000000005000000010000000a00000000000000ff030000000000001a0a000000000000050000000000000000000000000000000000000000000000080000000000000000000000000000000800000000000000ffff0000000000000100008000000000000000000000000000000000000000000000000000000000000000000000000008000000000000003f0000000000000008000000000000000000000000000000000000000000800800000000000000000000000000000200000000000000000400000000000000000000010000000000000000000000000000000000000002110000000000000000000000000000cc0000000000000000000000000000001b0000000000000000000000000000000000000000000000841400000000000000000000000000000300000000000000feffffffffffffff000000000000000000000000000000000000000000000000020000000000000000000000000000000600000000000000ff01000000000000040000000000000000000000000000000000000000000000000400000000000000000000000000007be70000000000000900000000000000ff7f0000000000000000000000000000000000000000000004180000000000000000000000000000ffffffff0000000081000000000000000600000000000000000000000000000000000000000000000400000000000000000000000000000002000000000000000500000000000000ff7fffffffffffff0000000000000000000000000000000004040000000000000000000000000000"]) r6 = creat(&(0x7f00000000c0)='./file0\x00', 0x0) openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000100)='/group.stat\x00', 0x2761, 0x0) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000080), 0xffffffffffffffff) getpid() fallocate(r0, 0x0, 0x0, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x2f, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) memfd_create(&(0x7f0000000080)='!proccgroup\x00', 0x0) ioctl$sock_inet_SIOCSIFPFLAGS(0xffffffffffffffff, 0x8934, &(0x7f0000000400)={'veth0_to_bridge\x00', 0x100}) accept(r6, &(0x7f0000000580)=@alg, &(0x7f0000000600)=0x80) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x2400, 0x8000) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000008c0)={0x2c, 0x0, &(0x7f0000000780)=[@acquire_done={0x40106309, r5, 0x2}, @clear_death={0x400c630f, 0x1, 0x3}, @release={0x40046306, 0x2}], 0xc1, 0x0, &(0x7f00000007c0)="859547f83b9b058a973a491d7e6378544744f2b56b02270a2f78214a936e9afb25cd94695643af6563f86771aa9621b9f30f2ca538b018247a633c28ee01e03b4639679311117971e60dc1538f34e961ae301463172c41754be988f6beb0ce4d83c69f86c236d29520e6cdaf5dbb60404c66d63315ff287deac8632781d0197ef1f81314da0a1ed90b681842cf85a41b496ce0a7a6f5aa4b9b23483eea8861be89b3398c6aec3349174f9cdc9de34df361ac9bf7afd8566849487c3c0a1e3aaacd"}) [ 629.251037] binder: release 22127:22132 transaction 366 out, still active [ 629.461627] binder: BINDER_SET_CONTEXT_MGR already set [ 629.474616] binder: 22163:22171 ioctl 40046207 0 returned -16 [ 629.482653] binder: 22163:22171 Release 1 refcount change on invalid ref 1 ret -22 04:01:55 executing program 5: r0 = socket$inet6(0xa, 0x2, 0x0) r1 = syz_open_dev$mice(&(0x7f00000002c0)='/dev/input/mice\x00', 0x0, 0x0) ioctl$PPPOEIOCDFWD(r1, 0xb101, 0x0) syz_genetlink_get_family_id$nbd(&(0x7f0000000480)='nbd\x00') getsockopt$inet6_IPV6_XFRM_POLICY(r0, 0x29, 0x23, &(0x7f0000000340)={{{@in=@local, @in=@loopback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@local}, 0x0, @in=@remote}}, &(0x7f0000000140)=0xe8) connect$can_bcm(0xffffffffffffffff, &(0x7f00000001c0), 0x10) bind$inet6(r0, &(0x7f0000000040)={0xa, 0x4e24}, 0x1c) lsetxattr$security_ima(&(0x7f0000000280)='./file0\x00', &(0x7f0000000440)='security.ima\x00', 0x0, 0x0, 0x1) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clock_gettime(0x0, &(0x7f0000000100)={0x0, 0x0}) r4 = openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) bind(r4, &(0x7f0000000580)=@can={0x1d, r2}, 0x80) clock_gettime(0x3, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff}) ppoll(&(0x7f0000000000)=[{r0, 0x41a, 0xffffffff00000000}], 0x1, &(0x7f0000000200)={0x0, r3+30000000}, &(0x7f0000000240), 0x8) connect$inet6(r0, &(0x7f0000000080)={0xa, 0x4e24, 0x0, @ipv4={[], [], @loopback}}, 0x1c) readv(0xffffffffffffffff, 0x0, 0x0) sendmmsg(r0, &(0x7f00000092c0), 0x4ff, 0x0) connect$pptp(r5, &(0x7f00000004c0)={0x18, 0x2, {0x0, @multicast1}}, 0x1e) 04:01:55 executing program 4: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) recvmsg(0xffffffffffffffff, &(0x7f00000036c0)={&(0x7f0000000180)=@can, 0xfd28, &(0x7f00000035c0), 0x0, &(0x7f0000003680)=""/41, 0x29}, 0x0) bind$alg(r0, &(0x7f0000001300)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb(blowfish)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000ff8000)="0a0775b0", 0x4) r1 = accept$alg(r0, 0x0, 0x0) sendmmsg$alg(r1, &(0x7f0000003e80)=[{0x0, 0x0, 0x0, 0x0, &(0x7f0000000100)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x0) recvmsg(r1, &(0x7f0000000000)={&(0x7f0000f7ffa8)=@alg, 0x61, &(0x7f0000000140)=[{&(0x7f0000000200)=""/4096, 0xfffffe45}], 0x1, &(0x7f0000fb3fa9)=""/87, 0x57}, 0x0) 04:01:55 executing program 2: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000440)=@updpolicy={0xb8, 0x19, 0x523, 0x0, 0x0, {{@in=@multicast2, @in6=@empty={[0x0, 0x0, 0x0, 0x3000000]}, 0x0, 0x0, 0x0, 0x0, 0xa}}}, 0xb8}}, 0x0) 04:01:55 executing program 3: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000280)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) setitimer(0x2, &(0x7f0000000040)={{}, {0x77359400}}, 0x0) clock_gettime(0x0, &(0x7f0000000000)={0x0, 0x0}) timerfd_settime(r0, 0x1, &(0x7f0000000080)={{0x77359400}, {r1, r2+30000000}}, &(0x7f00000000c0)) 04:01:55 executing program 1 (fault-call:7 fault-nth:0): perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) recvmsg(0xffffffffffffffff, &(0x7f00000036c0)={&(0x7f0000000180)=@can, 0xfd28, &(0x7f00000035c0), 0x0, &(0x7f0000003680)=""/41, 0x29}, 0x0) bind$alg(r0, &(0x7f0000001300)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb(blowfish)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000ff8000)="0a0775b0", 0x4) r1 = accept$alg(r0, 0x0, 0x0) sendmmsg$alg(r1, &(0x7f0000003e80)=[{0x0, 0x0, &(0x7f0000002a80), 0x167, &(0x7f0000000100)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x0) recvmsg(r1, &(0x7f0000000000)={&(0x7f0000f7ffa8)=@alg, 0x80, &(0x7f0000000140)=[{&(0x7f0000000200)=""/4096, 0x1000}], 0x1}, 0x0) [ 629.549611] binder: 22163:22174 BC_ACQUIRE_DONE u0000000000000000 no match [ 629.579058] binder: 22163:22174 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 [ 629.614336] binder: 22163:22174 Release 1 refcount change on invalid ref 2 ret -22 04:01:55 executing program 2: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000440)=@updpolicy={0xb8, 0x19, 0x523, 0x0, 0x0, {{@in=@multicast2, @in6=@empty={[0x0, 0x0, 0x0, 0x4000000]}, 0x0, 0x0, 0x0, 0x0, 0xa}}}, 0xb8}}, 0x0) 04:01:55 executing program 3: mkdir(&(0x7f00000013c0)='./file0\x00', 0x0) mount(0x0, &(0x7f0000026ff8)='./file0\x00', 0x0, 0x0, 0x0) r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) splice(r0, 0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x5) r1 = getpid() sched_setscheduler(r1, 0x5, &(0x7f0000000040)) futimesat(0xffffffffffffffff, &(0x7f00000006c0)='./file0\x00', 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_REPLACE(0xffffffffffffffff, 0xc1105518, &(0x7f0000000440)={{0x0, 0x7, 0x401}, 0x0, 0x3, 0x0, r1, 0x2, 0x8, 'syz1\x00', &(0x7f0000000140)=['overlay\x00', 'vmnet1^\'cgroup%posix_acl_access\\{\x84\x00'], 0x2b, [], [0x0, 0x0, 0xffffffffffff7fff, 0x1]}) syz_mount_image$btrfs(0x0, &(0x7f00000002c0)='./file1/file0\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f0000000b40)={[{@flushoncommit='flushoncommit'}], [{@fscontext={'fscontext', 0x3d, 'system_u'}}, {@fowner_lt={'fowner<'}}]}) syz_mount_image$ntfs(&(0x7f00000003c0)='ntfs\x00', &(0x7f00000001c0)='./file1\x00', 0x0, 0x0, &(0x7f0000000180), 0x0, 0x0) r2 = shmget(0xffffffffffffffff, 0x3000, 0x10, &(0x7f0000ffb000/0x3000)=nil) shmctl$SHM_LOCK(r2, 0xb) r3 = creat(&(0x7f0000000180)='./file1/file0\x00', 0x40) mount$overlay(0x400000, &(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f0000000c40)=ANY=[]) chdir(&(0x7f0000000280)='./file0\x00') getsockopt$inet_IP_IPSEC_POLICY(0xffffffffffffffff, 0x0, 0x10, 0x0, &(0x7f0000001180)) syz_read_part_table(0x7fffffff, 0x1, &(0x7f0000000900)=[{&(0x7f0000002400)="33b8471a6f94bd7472882e368451cb30f6ca57f9e30f000d0cd9dfdcd8dbbcca359eb3cd7e64c5fc24569b49b9873aac981ef42ff5b2a924ce90ac716055bd552f434b245936140c1f8704c74b42974a8a8c56261f7b236f7695842513a25f8ab8e407a13ffdbac8d7a2db0f1980d2c0755cb177d28c914bdf915bff9ba063dfe1e67d268b11d0f63fbe4373638510d0ee872490b44419817fb2e2f512d94b64c24f191cc4134ce7e623f6d8ed871b038dffa72a584f113c0d35adbba0f806d0eb44022f633e9a4b45675155f75c1fbe07b42a074b9c273cb2738658d0cdc0099a97d1377bf7ce8799ccd963dbffb441db4a35d184122ef686d809db64f6d5ec860f6514dd00ac35d4b2abc09e29c11c9aaa9e76462373d385d5f84a43f1debdc245c9b051bb4dc24459b074dc34d667139f7c74ebff008f466096ebb02de834771bbd4377ab186ecb053f267227072355dd2face6313d40653708e6df28187717b8ce3b8124628fc981ef32a70ae310095d0182191e1ec7f1b087e8089decc3eb0e653474829a6adb5b21ce22eed2b7bbf66f3a549abe063f88f030feea42d640678dbde3c37bcc23e37dbf723762ff379602905974d1632d6997690032769b116b65ad2eb34555b301a9955d5e208435635c93cf5ecd84e36921d2fd16366f57647f271d0cf0ce3d164b4a9e9c8186754e1f33f1cf3ce4bd675248cccb32dedee747f1d670c36420c19f7b9e141e01995939c4f9574a99c91be910846e896f6d985293ab80ab8c3bc46a8b5461303babfd0223fb43b5fe3b7e7f1ece2cebbee0b842f936df453f8b7e1fb289a8ef483dafd709867254c79b2448f2166ece3bdb9df89f40a4a5afc9946d8c38aa590f426fb1b24a82316e69a95dc70d64d519aebc2b80e6df1a421e8df94070434a84e1e03e5be71ea669fb87cd8223e04401fa061bc87069a6de8e434f3c729535cd63978dac390733f261a7089162d2c11be33f38418d143ca9050978b0ead2f3ecf7c3e3383ac0ff25e70f014536c03d026ab289e7a49f550d4326dd85580ee625f77bf5336b378d6f81200b5e23ea0043d58f6be3473eb62208b34040cfe7cfbfde8611a041e7acd099ce7c4073a5e409459b899d0294a38f011b71e06ca32d912397a09d2fd3bc5effc21d3b59156bcbd37d347d1ac9cb4ecb14e15a1d836dc609168ac70c65d6cc18945984a95e947658a3c3b40a33a7297947e5e71cd88a68e67a133ec2b3782b84c1deb07e16681b550c1f036e974576c81a1d3afce4cbe9b82b31167fe76e61a3b578aa6e5978c1a09f24b506008c726e3aad3faa2b049adf29b201f9aeaa0c15962a2e648b0d4c8531d20fd19b96fc7350dab09c46e2cb78e5c15260abdb2e598cf2814ed695defb5df857bad42ada8108dd24340877f9f9daedde8263a694953357db709ae4278c8539d8f6e703b152ffdf7e9586e938dad81fc45818a1e48c9f1d40734683e02b44333f53873d60d24363da9e942a1a6ca12e58fbd01886f923ed6ef6a21384f6a3bebdaa1fa1fa744b0cbcd7da9be119f2b0264c56ae89b61d5cae264f614bad51076137cfcaf68db810f898c75f2dcf9167bd0b55cc704562576955a547f701380ebebf6e40b4efee4d3312ae511419572f1a47239680f44738ec66e8a2aca2fb2568f6c527fadfc36701525da1b67077a9aa285bc72897b72dc4ad7866df37d7c8f3a69e5d73a1822362d9be9b4fbb37e41c91020a00a5d118e815715f9087a466a8317beefabb52cc62c5985b77bf39b8e075613d25624e8a0104790a720014a25e48294134d7e46fca71a56847be193273df29d964595b90425057a1cd771219acd895c2a6ed0450071266337ba40e7c6dff53ac246fd388999bdb9695cdf689d2f750dd5cadd6a8457cdcc70bffebd62af5388f231a80a930a6d71d717085d6f7640379b63df65e2c96f50f3fd1bff14849e4a063c40af8849d7dd0a4c8592f6951afe4cd8bb642c40d82376b8fa1d63d927ccc40760d2aa6487d7a24914dd54ae413716194d6a2566fd4afacc22cc331cdcc913f8f3947105fe6d3f959342bb4ddcf84416f7c9e499c38e14c5a4a158ba61ec9e2357f32a27841daf05bdb3b52b4d679d21bc30c15cce15b18bcb9bae6909fdc92af33fd3abb3d5afb17e3efbfe002d4ac60108e342c0813e99bb3169c0cf23656cb0113d4557ff2ee799028030e76264db5330b2d8832221ab239647958b4c31b33df859fdea8452fd89c6637412a2d2d2c4df7bda213d58f6fbad40b369ee5738f04b219e06104539039c3cd12f8e9e123fafe3fb79010f7498f4a2e1005e805565a36d27319d63a8304ff45cf864572a628e49618c8973d46f6b12a3a6a36def07925396620062d0e4e5f805d3477418b83c90180e45f9317417422a0929c287ff184c8a5d11f5dfdca8efb0098c31ef79f31e0d7bf13a38bc0f23709aa40c9a4c7e5f4efe42fe2856809d5fae7d2b9d182b24550ca55f3478bf682764a566e1a53b073fd6f8dfd13e121b1abb79abc5516354f985df3ca73c18e181aa82b6b638ed43bad93e84ac164a6bc3a6965d7d9ee64ec92f0ceae255eadb9051976cb1fce1b219ee7c3aabe18e195f547ae7f6e00424a373a200569917cdc997f508f7cb74efc36ad85d6a412181c3577d2bc58ffce24bf48a9c26dc2aca2f7eb5d423cb33c4f96585d870a633c23c3d2acd50aa6624939a6947a490071ff987cabb4462fc18072af5d6433d0c9a97b18c6e3b499bea2162e2b0618e57954b8ec5791c235b470d99e55cf19ed39d8251a49da1edd1e1abeb511f01cef13d7e0a0fb8728ef24cf5ea864dbfcba2a44e7ed77cc80e78bf277264fbe845ca69b51c62749c7fb29fbc3caefe6411dd5da96e7abeb44bda92047ac1b502ad712ef7d3cf629f59d2795356c564dff9f756ce79fea9be702d771738ee04295d7f04ddb044b9a560b90dc2e6ce12a8960b161907fec918f2ce3e802faff7f6379fe7135d1d95eb26b3afe88913637e859515ddf6d2bb09f0aec7a0449962189baae240f6bce9dbe6bd324a3b136235395c5bb181d39137548e0c581b87310c16fdd94d787eddfb58f4641f27fd66d16b038b329c6a9d8023eec6493483fcd1f08dbff47618b56e867b29e031a82bc40dcb28b4da2cd7a8cc0746b00e9969f5e631c49dd0e1f9f3555b0913494f095f51b35e35e2513a2b00d863c97f6e6abd2ade565ae1dcb6745a520f2137e545d0de4dc03cfc808b2cd90fcaadf225e0728b53f766d330f2adcc9864ff16709191ab8d21387415beec8267dff54490fe20ef2d67e1628698e62ccf7c755a37166ab9facea34aebe1c1d0951e1a7836029b580e327ace6ed07e53f9fe0578ff81360852aaa29cf8e2f74e8bad35b7c5ca9f977716b050ad88f3e7446990eec9458853077e98e7442a78c2258661572605c82014fcbd48fe958e191697fac44633129a205d2dc86065cdff8da7d7c12843ffe938dd2337955258f503a2311181ee3df372411771a1de355b68c71e7addcef7eec7eaa76aae40a2ec90f0ac45e71a0029b86e01b8ae42946979fe938c80e3996671bcd5f09da5ad1728ef8ecf55b197b9b57617d75018000034737213f856c43863995ef275acae78100d64834f178f4618d6590b60d2e08fae44404035826092e8fb3b383c984deecf6dca7b9240c9c3936be6c8df4e976eebf6eeda462f6c2513bfdb15bf78517460514ac976aa1468a5a790f57d232c48f5fe78d73e022ea7374a8e720f883cc9b7df03fb2c95c486ee3590befa6bf9216e5ba28ee2f2a2f767d53edd90f99b31dff86d2f69ce9bd3363df4ac0217884c4796b7aabc4c6ab28143aa4b6e4b9c71af6620fb24a6c984ff06c3f5f2af5307ccb3f6da839a79e8d5c347c45b7dc4f28db2f231dd1308443a797c7b0bd5a530f8e91c3386e320fe0305e6709699ab98cd991680e3525eace1a449409e1dc99bed621402bc27a21579b9ec209cbe9e8b3a24b51a3fbc549f5118637bca2e78b5ced01bfded450dc11aa6b73b0564284b98c18d8f5984d423e11edd8c725799264298dd28d64f7ba829ee5db38f5398f97e1d3ed41026fdb9f540bc6ba0ec51614f0e4360b9e93568500c8ac1f82aefb4bde514f978cfadbbd86fce9420fc1aa4a9ad2394f95d74e1fedf981747e098c8add3a5d9954dbc9db60b201acf62ca304fea70a331f526aa05b0fc638c807b824a5d1fb72be244bd6d23e0a32e559a182ed52df6c5b43e40abbf57718ee68697615d92b0100bfd71676eaa8beec44fea78ff0a2837a5331d30f7c27b1099fecbd8e3bd6266a97d514b20ce56e654892940a55a3ec4d34b877a04dbeea2f702cd3e2e73a5e0ea1b1466812b8e0ed21a0742489f92e9279b1c89f88311cc7d1b09b66b25f317fd7eb62f1c6f557da9cda23a3c4e1e62e2eb45d0b70f7b222f6eb205d16822da7df9211e31b5bdcb9f63dd7ce021272ae45f6143443332185f64617eb3919288393f4e4eb917fb94d8ba9df8fe354a7bd96296b703a7fb2c7edaea026428c5e5b311085dd5a87765ef5f74cf9cbdfc08f162c04d9120df9310d72a818ab3e75d465ddc4196a67986a8c96170c3344db95a998c07fb95e03b5b2f51f722d05a8c8a4b1c763c7e51dd7817f4f303dc85b2b2f36556964c3b7579f61fe2e61e63e6d378795b3593c492a8e63662809e79aed15c0ea4f57c2ca282d6389f71908ed59e684a9e3e0ade9df5fedf8124f907406ad2f0d7ae45770bc3c4a7ba448a7ca5e17bd595f6738ef761ae03f2d29eace648fb71cc159d05ff19329b3b40bd2170c18fdcfa29f7ad88fbbb5c1419e4144a7c8372dafa52527c6a2a9df221fa50d37f73b089b6c00d50811523418aa18ed795fa49f505e41d5fcd14435f868d8edf500d43a584802a42c5952d82ef9d0f05515b4ae6bb9937db0ee8cd91fe60ce22f6ab58110a0cc1cbe4822638c4fb6dd082bebdd8dc689ea4765d775685bcad1d670661ebc68fc6dc560fc8ff1ac7d9a8017c39fc1e53c6327640b5c8a8dd71c36f50b96076b10b9e4faa460a538950690d7d7e2a479910550e2b20937247ba6bf39eb92285a89a823c9af51dcd68664313ef1409f5bf89b5149d502d13e509034dec3a6f823a344b4bbe4d96b46cc211e90ebccd58718428e62d76f7a0350546639a46a28a7c735a78428330958f8204bc4909e1d618aa949bc8f97a97cfd50e6590f9f40688512486617ce691b4e3887e9c0da90cd88c8a7b9acb9e678dc97c565c2956645b61b72d6f5e7f9d94e071baa5de0ab50fb249b1779b0eeb02677d0e82697cac6964d73eec55bdb3259bb28267feac443c15112055f0d9ca6783a70fd0fd66f0c80d775f0456759bd028867ffdbd6583b1bc35b740023d27d0ad8cc909da1f9495c9a581eb10427694d673362fae4a9156542c757a3bd0be4ad696c6d9cf14c0b11fc91e6fabf3c7cff114f57f96b4c875e3f5a19e8227ee27f4e08e30555078479d01dd099054099997cc06a342d0bbbdbfae415b9123b52853a58a5259e2612d042d0f2c90078619e3d6a2624f4c1eb72ef630b0e1f4d11465206d06e737eca4a690836b4a2e739f003fd15678a8397d8414e93e1bb1610e6ac4f44422042c9bcffe387f8dae2d14740277c8184ef36a4a8af9c8aa9f3ccf05a201979008025288bdf51d9bb4e30f5ce400716d63defed5cef1ccde77b814091b3632e1b57c519c962653a78b8b494f199159c6035b0e27ca9ba263ecf32aaf8883c", 0x1000, 0x3ff}]) getsockopt$inet_sctp_SCTP_GET_ASSOC_STATS(r3, 0x84, 0x70, &(0x7f0000000580)={0x0, @in={{0x2, 0x4e20, @loopback}}, [0x97, 0x48a7, 0x4, 0x5, 0x60e, 0x0, 0x4, 0xff, 0x3, 0x8340, 0x36, 0x0, 0x93d, 0x0, 0x1ff]}, &(0x7f0000000200)=0x100) getsockopt$inet_sctp6_SCTP_GET_PEER_ADDRS(r3, 0x84, 0x6c, &(0x7f0000000300)={r4, 0x53, "7a6cb7352def14d028ae0c2db700fa6970994950d6d7a25eb0b22928be52f082df73391d2a894c9aea4362071902a0e276f5da2b322a9dc299a360452ea3270d05173b50d7924eb1ab49604f3fa16d97d1a181"}, 0x0) syz_genetlink_get_family_id$ipvs(&(0x7f0000000400)='IPVS\x00') ioctl$PPPIOCSACTIVE(r0, 0x40107446, &(0x7f0000000380)={0x3, &(0x7f0000000240)=[{0x2, 0x8, 0x10000, 0x180000000000}, {0x3ff, 0x5, 0x8, 0x4}, {0xffffffff, 0xffff, 0x63, 0x3}]}) creat(&(0x7f0000000100)='./file0\x00', 0x0) syz_mount_image$bfs(&(0x7f00000000c0)='bfs\x00', &(0x7f0000000040)='./file0\x00', 0x80000004, 0x1, &(0x7f0000000080)=[{&(0x7f0000000140)="cefaad1bb83c000000dc", 0xa}], 0x0, 0x0) 04:01:55 executing program 1: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) recvmsg(0xffffffffffffffff, &(0x7f00000036c0)={&(0x7f0000000180)=@can, 0xfd28, &(0x7f00000035c0), 0x0, &(0x7f0000003680)=""/41, 0x29}, 0x0) bind$alg(r0, &(0x7f0000001300)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb(blowfish)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000ff8000)="0a0775b0", 0x4) r1 = accept$alg(r0, 0x0, 0x0) sendmmsg$alg(r1, &(0x7f0000003e80)=[{0x0, 0x0, &(0x7f0000002a80), 0x167, &(0x7f0000000100)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x0) recvmsg(r1, &(0x7f0000000000)={&(0x7f0000f7ffa8)=@alg, 0x80, &(0x7f0000000140)=[{&(0x7f0000000200)=""/4096, 0x1000}], 0x1}, 0x0) 04:01:55 executing program 4: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) recvmsg(0xffffffffffffffff, &(0x7f00000036c0)={&(0x7f0000000180)=@can, 0xfd28, &(0x7f00000035c0), 0x0, &(0x7f0000003680)=""/41, 0x29}, 0x0) bind$alg(r0, &(0x7f0000001300)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb(blowfish)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000ff8000)="0a0775b0", 0x4) r1 = accept$alg(r0, 0x0, 0x0) sendmmsg$alg(r1, &(0x7f0000003e80)=[{0x0, 0x0, 0x0, 0x0, &(0x7f0000000100)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x0) recvmsg(r1, &(0x7f0000000000)={&(0x7f0000f7ffa8)=@alg, 0x61, &(0x7f0000000140)=[{&(0x7f0000000200)=""/4096, 0xfffffe45}], 0x1, &(0x7f0000fb3fa9)=""/87, 0x57}, 0x0) 04:01:55 executing program 2: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000440)=@updpolicy={0xb8, 0x19, 0x523, 0x0, 0x0, {{@in=@multicast2, @in6=@empty={[0x0, 0x0, 0x0, 0x8000000]}, 0x0, 0x0, 0x0, 0x0, 0xa}}}, 0xb8}}, 0x0) 04:01:55 executing program 4: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) recvmsg(0xffffffffffffffff, &(0x7f00000036c0)={&(0x7f0000000180)=@can, 0xfd28, &(0x7f00000035c0), 0x0, &(0x7f0000003680)=""/41, 0x29}, 0x0) bind$alg(r0, &(0x7f0000001300)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb(blowfish)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000ff8000)="0a0775b0", 0x4) r1 = accept$alg(r0, 0x0, 0x0) sendmmsg$alg(r1, &(0x7f0000003e80)=[{0x0, 0x0, &(0x7f0000002a80)}], 0x1, 0x0) recvmsg(r1, &(0x7f0000000000)={&(0x7f0000f7ffa8)=@alg, 0x61, &(0x7f0000000140)=[{&(0x7f0000000200)=""/4096, 0xfffffe45}], 0x1, &(0x7f0000fb3fa9)=""/87, 0x57}, 0x0) [ 629.929110] overlayfs: missing 'lowerdir' [ 630.133626] overlayfs: missing 'lowerdir' 04:01:55 executing program 0: r0 = perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) setxattr$security_smack_entry(&(0x7f0000000380)='./file0\x00', &(0x7f0000000480)='security.SMACK64IPIN\x00', &(0x7f0000000540)='^vboxnet1^\x00', 0xb, 0x1) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r1, &(0x7f0000000040), 0x0}, 0x20) unlink(&(0x7f0000000900)='./file0/file0\x00') r2 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r3 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r3, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, &(0x7f00000006c0)={0x0}) ioctl$BINDER_GET_NODE_DEBUG_INFO(r2, 0xc018620b, &(0x7f0000000640)={r4}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f00000000c0)=[@enter_looper], 0x48, 0x0, &(0x7f0000000700)="2ba063fb309ec7fdbfb08e6e91baee7d7d4599fe14129a4d426834556ae420e087d59c0c7be7fcad1abb7e1f8f446f373f611ca1ee9c2231708e18a47bc68a2a79a0b48931f6ff6d"}) ioctl$BINDER_SET_CONTEXT_MGR(r3, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x1) prctl$PR_SET_NAME(0xf, &(0x7f00000004c0)='/group.stat\x00') ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, &(0x7f0000000780)}) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f0000000680)}) ioctl$FS_IOC_FIEMAP(r3, 0xc020660b, &(0x7f0000000b80)=ANY=[@ANYBLOB="0000010000000000200000000000000005000000010000000a00000000000000ff030000000000001a0a000000000000050000000000000000000000000000000000000000000000080000000000000000000000000000000800000000000000ffff0000000000000100008000000000000000000000000000000000000000000000000000000000000000000000000008000000000000003f0000000000000008000000000000000000000000000000000000000000800800000000000000000000000000000200000000000000000400000000000000000000010000000000000000000000000000000000000002110000000000000000000000000000cc0000000000000000000000000000001b0000000000000000000000000000000000000000000000841400000000000000000000000000000300000000000000feffffffffffffff000000000000000000000000000000000000000000000000020000000000000000000000000000000600000000000000ff01000000000000040000000000000000000000000000000000000000000000000400000000000000000000000000007be70000000000000900000000000000ff7f0000000000000000000000000000000000000000000004180000000000000000000000000000ffffffff0000000081000000000000000600000000000000000000000000000000000000000000000400000000000000000000000000000002000000000000000500000000000000ff7fffffffffffff0000000000000000000000000000000004040000000000000000000000000000"]) r6 = creat(&(0x7f00000000c0)='./file0\x00', 0x0) openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000100)='/group.stat\x00', 0x2761, 0x0) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000080), 0xffffffffffffffff) getpid() fallocate(r0, 0x0, 0x0, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x2f, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) memfd_create(&(0x7f0000000080)='!proccgroup\x00', 0x0) ioctl$sock_inet_SIOCSIFPFLAGS(0xffffffffffffffff, 0x8934, &(0x7f0000000400)={'veth0_to_bridge\x00', 0x100}) accept(r6, &(0x7f0000000580)=@alg, &(0x7f0000000600)=0x80) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x2400, 0x8000) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000008c0)={0x2c, 0x0, &(0x7f0000000780)=[@acquire_done={0x40106309, r5, 0x2}, @clear_death={0x400c630f, 0x1, 0x3}, @release={0x40046306, 0x2}], 0xc1, 0x0, &(0x7f00000007c0)="859547f83b9b058a973a491d7e6378544744f2b56b02270a2f78214a936e9afb25cd94695643af6563f86771aa9621b9f30f2ca538b018247a633c28ee01e03b4639679311117971e60dc1538f34e961ae301463172c41754be988f6beb0ce4d83c69f86c236d29520e6cdaf5dbb60404c66d63315ff287deac8632781d0197ef1f81314da0a1ed90b681842cf85a41b496ce0a7a6f5aa4b9b23483eea8861be89b3398c6aec3349174f9cdc9de34df361ac9bf7afd8566849487c3c0a1e3aaacd"}) [ 630.174450] binder: release 22163:22171 transaction 369 out, still active [ 630.318509] binder: BINDER_SET_CONTEXT_MGR already set [ 630.323831] binder: 22213:22215 ioctl 40046207 0 returned -16 [ 630.331547] binder: 22213:22215 Release 1 refcount change on invalid ref 1 ret -22 [ 630.345944] binder: 22213:22216 BC_ACQUIRE_DONE u0000000000000000 no match [ 630.352993] binder: 22213:22216 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 [ 630.360292] binder: 22213:22216 Release 1 refcount change on invalid ref 2 ret -22 04:01:56 executing program 5: r0 = socket$inet6(0xa, 0x2, 0x0) r1 = syz_open_dev$mice(&(0x7f00000002c0)='/dev/input/mice\x00', 0x0, 0x0) ioctl$PPPOEIOCDFWD(r1, 0xb101, 0x0) syz_genetlink_get_family_id$nbd(&(0x7f0000000480)='nbd\x00') getsockopt$inet6_IPV6_XFRM_POLICY(r0, 0x29, 0x23, &(0x7f0000000340)={{{@in=@local, @in=@loopback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@local}, 0x0, @in=@remote}}, &(0x7f0000000140)=0xe8) connect$can_bcm(0xffffffffffffffff, &(0x7f00000001c0), 0x10) bind$inet6(r0, &(0x7f0000000040)={0xa, 0x4e24}, 0x1c) lsetxattr$security_ima(&(0x7f0000000280)='./file0\x00', &(0x7f0000000440)='security.ima\x00', 0x0, 0x0, 0x1) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clock_gettime(0x0, &(0x7f0000000100)={0x0, 0x0}) r4 = openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) bind(r4, &(0x7f0000000580)=@can={0x1d, r2}, 0x80) clock_gettime(0x3, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff}) ppoll(&(0x7f0000000000)=[{r0, 0x41a}], 0x2, &(0x7f0000000200)={0x0, r3+30000000}, &(0x7f0000000240), 0x8) connect$inet6(r0, &(0x7f0000000080)={0xa, 0x4e24, 0x0, @ipv4={[], [], @loopback}}, 0x1c) readv(0xffffffffffffffff, 0x0, 0x0) sendmmsg(r0, &(0x7f00000092c0), 0x4ff, 0x0) connect$pptp(r5, &(0x7f00000004c0)={0x18, 0x2, {0x0, @multicast1}}, 0x1e) 04:01:56 executing program 1: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) recvmsg(0xffffffffffffffff, &(0x7f00000036c0)={&(0x7f0000000180)=@can, 0xfd28, &(0x7f00000035c0), 0x0, &(0x7f0000003680)=""/41, 0x29}, 0x0) bind$alg(r0, &(0x7f0000001300)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb(blowfish)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000ff8000)="0a0775b0", 0x4) r1 = accept$alg(r0, 0x0, 0x0) sendmmsg$alg(r1, &(0x7f0000003e80)=[{0x0, 0x0, &(0x7f0000002a80), 0x167, &(0x7f0000000100)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x0) recvmsg(r1, &(0x7f0000000000)={&(0x7f0000f7ffa8)=@alg, 0x80, &(0x7f0000000140)=[{&(0x7f0000000200)=""/4096, 0x1000}], 0x1}, 0x0) 04:01:56 executing program 2: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000440)=@updpolicy={0xb8, 0x19, 0x523, 0x0, 0x0, {{@in=@multicast2, @in6=@empty={[0x0, 0x0, 0x0, 0xa000000]}, 0x0, 0x0, 0x0, 0x0, 0xa}}}, 0xb8}}, 0x0) 04:01:56 executing program 4: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) recvmsg(0xffffffffffffffff, &(0x7f00000036c0)={&(0x7f0000000180)=@can, 0xfd28, &(0x7f00000035c0), 0x0, &(0x7f0000003680)=""/41, 0x29}, 0x0) bind$alg(r0, &(0x7f0000001300)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb(blowfish)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000ff8000)="0a0775b0", 0x4) r1 = accept$alg(r0, 0x0, 0x0) sendmmsg$alg(r1, &(0x7f0000003e80)=[{0x0, 0x0, &(0x7f0000002a80)}], 0x1, 0x0) recvmsg(r1, &(0x7f0000000000)={&(0x7f0000f7ffa8)=@alg, 0x61, &(0x7f0000000140)=[{&(0x7f0000000200)=""/4096, 0xfffffe45}], 0x1, &(0x7f0000fb3fa9)=""/87, 0x57}, 0x0) 04:01:56 executing program 3: r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x7fff, 0x4}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = syz_open_dev$adsp(&(0x7f00000001c0)='/dev/adsp#\x00', 0x3, 0x2000) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000340)={r1, &(0x7f00000002c0)="4c0b62c74b4d255501ce2bdc05ee5e281549cf8269cd", 0x0, 0x2}, 0x20) mlockall(0x1) clone(0x0, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) mbind(&(0x7f0000860000/0x1000)=nil, 0x1000, 0x4, 0x0, 0x0, 0x5) socket$rxrpc(0x21, 0x2, 0xa) getresgid(&(0x7f0000000280), &(0x7f0000000200), &(0x7f0000000240)) setsockopt$inet_group_source_req(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0) r2 = fcntl$dupfd(r0, 0x406, r0) getsockopt$inet_sctp_SCTP_RESET_STREAMS(0xffffffffffffffff, 0x84, 0x77, &(0x7f0000000000)=ANY=[@ANYBLOB="abb8ad95"], 0x0) getsockopt$inet_sctp6_SCTP_GET_PEER_ADDR_INFO(r2, 0x84, 0xf, &(0x7f0000000080)={0x0, @in={{0x2, 0x4e23, @remote}}, 0x0, 0x7fffffff, 0x6, 0x6, 0x7e00000000}, 0x0) ioctl$PIO_UNIMAP(r2, 0x4b67, &(0x7f0000000140)={0x9, &(0x7f0000000040)=[{0x1, 0x2}, {0x100000001, 0x100000000}, {0x7, 0x7}, {0x2, 0x3}, {0x2, 0x100000000}, {0x6, 0x6}, {0x6, 0x881}, {0x9, 0x3}, {0x40, 0xffff}]}) 04:01:56 executing program 2: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000440)=@updpolicy={0xb8, 0x19, 0x523, 0x0, 0x0, {{@in=@multicast2, @in6=@empty={[0x0, 0x0, 0x0, 0xe000000]}, 0x0, 0x0, 0x0, 0x0, 0xa}}}, 0xb8}}, 0x0) 04:01:56 executing program 1: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) recvmsg(0xffffffffffffffff, &(0x7f00000036c0)={&(0x7f0000000180)=@can, 0xfd28, &(0x7f00000035c0), 0x0, &(0x7f0000003680)=""/41, 0x29}, 0x0) bind$alg(r0, &(0x7f0000001300)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb(blowfish)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000ff8000)="0a0775b0", 0x4) r1 = accept$alg(r0, 0x0, 0x0) sendmmsg$alg(r1, &(0x7f0000003e80)=[{0x0, 0x0, &(0x7f0000002a80), 0x167, &(0x7f0000000100)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x0) recvmsg(r1, &(0x7f0000000000)={&(0x7f0000f7ffa8)=@alg, 0x80, &(0x7f0000000140)=[{&(0x7f0000000200)=""/4096, 0x1000}], 0x1}, 0x0) 04:01:56 executing program 4: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) recvmsg(0xffffffffffffffff, &(0x7f00000036c0)={&(0x7f0000000180)=@can, 0xfd28, &(0x7f00000035c0), 0x0, &(0x7f0000003680)=""/41, 0x29}, 0x0) bind$alg(r0, &(0x7f0000001300)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb(blowfish)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000ff8000)="0a0775b0", 0x4) r1 = accept$alg(r0, 0x0, 0x0) sendmmsg$alg(r1, &(0x7f0000003e80)=[{0x0, 0x0, &(0x7f0000002a80)}], 0x1, 0x0) recvmsg(r1, &(0x7f0000000000)={&(0x7f0000f7ffa8)=@alg, 0x61, &(0x7f0000000140)=[{&(0x7f0000000200)=""/4096, 0xfffffe45}], 0x1, &(0x7f0000fb3fa9)=""/87, 0x57}, 0x0) 04:01:56 executing program 2: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000440)=@updpolicy={0xb8, 0x19, 0x523, 0x0, 0x0, {{@in=@multicast2, @in6=@empty={[0x0, 0x0, 0x0, 0xf000000]}, 0x0, 0x0, 0x0, 0x0, 0xa}}}, 0xb8}}, 0x0) 04:01:56 executing program 1: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) recvmsg(0xffffffffffffffff, &(0x7f00000036c0)={&(0x7f0000000180)=@can, 0xfd28, &(0x7f00000035c0), 0x0, &(0x7f0000003680)=""/41, 0x29}, 0x0) bind$alg(r0, &(0x7f0000001300)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb(blowfish)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000ff8000)="0a0775b0", 0x4) r1 = accept$alg(r0, 0x0, 0x0) sendmmsg$alg(r1, &(0x7f0000003e80)=[{0x0, 0x0, &(0x7f0000002a80), 0x167, &(0x7f0000000100)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x0) recvmsg(r1, &(0x7f0000000000)={&(0x7f0000f7ffa8)=@alg, 0x80, &(0x7f0000000140)=[{&(0x7f0000000200)=""/4096, 0x1000}], 0x1}, 0x0) 04:01:56 executing program 0: r0 = perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) setxattr$security_smack_entry(&(0x7f0000000380)='./file0\x00', &(0x7f0000000480)='security.SMACK64IPIN\x00', &(0x7f0000000540)='^vboxnet1^\x00', 0xb, 0x1) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r1, &(0x7f0000000040), 0x0}, 0x20) unlink(&(0x7f0000000900)='./file0/file0\x00') r2 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r3 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10, r3, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, &(0x7f00000006c0)={0x0}) ioctl$BINDER_GET_NODE_DEBUG_INFO(r2, 0xc018620b, &(0x7f0000000640)={r4}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f00000000c0)=[@enter_looper], 0x48, 0x0, &(0x7f0000000700)="2ba063fb309ec7fdbfb08e6e91baee7d7d4599fe14129a4d426834556ae420e087d59c0c7be7fcad1abb7e1f8f446f373f611ca1ee9c2231708e18a47bc68a2a79a0b48931f6ff6d"}) ioctl$BINDER_SET_CONTEXT_MGR(r3, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x1) prctl$PR_SET_NAME(0xf, &(0x7f00000004c0)='/group.stat\x00') ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, &(0x7f0000000780)}) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f0000000680)}) ioctl$FS_IOC_FIEMAP(r3, 0xc020660b, &(0x7f0000000b80)=ANY=[@ANYBLOB="0000010000000000200000000000000005000000010000000a00000000000000ff030000000000001a0a000000000000050000000000000000000000000000000000000000000000080000000000000000000000000000000800000000000000ffff0000000000000100008000000000000000000000000000000000000000000000000000000000000000000000000008000000000000003f0000000000000008000000000000000000000000000000000000000000800800000000000000000000000000000200000000000000000400000000000000000000010000000000000000000000000000000000000002110000000000000000000000000000cc0000000000000000000000000000001b0000000000000000000000000000000000000000000000841400000000000000000000000000000300000000000000feffffffffffffff000000000000000000000000000000000000000000000000020000000000000000000000000000000600000000000000ff01000000000000040000000000000000000000000000000000000000000000000400000000000000000000000000007be70000000000000900000000000000ff7f0000000000000000000000000000000000000000000004180000000000000000000000000000ffffffff0000000081000000000000000600000000000000000000000000000000000000000000000400000000000000000000000000000002000000000000000500000000000000ff7fffffffffffff0000000000000000000000000000000004040000000000000000000000000000"]) r6 = creat(&(0x7f00000000c0)='./file0\x00', 0x0) openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000100)='/group.stat\x00', 0x2761, 0x0) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000080), 0xffffffffffffffff) getpid() fallocate(r0, 0x0, 0x0, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x2f, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) memfd_create(&(0x7f0000000080)='!proccgroup\x00', 0x0) ioctl$sock_inet_SIOCSIFPFLAGS(0xffffffffffffffff, 0x8934, &(0x7f0000000400)={'veth0_to_bridge\x00', 0x100}) accept(r6, &(0x7f0000000580)=@alg, &(0x7f0000000600)=0x80) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x2400, 0x8000) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000008c0)={0x2c, 0x0, &(0x7f0000000780)=[@acquire_done={0x40106309, r5, 0x2}, @clear_death={0x400c630f, 0x1, 0x3}, @release={0x40046306, 0x2}], 0xc1, 0x0, &(0x7f00000007c0)="859547f83b9b058a973a491d7e6378544744f2b56b02270a2f78214a936e9afb25cd94695643af6563f86771aa9621b9f30f2ca538b018247a633c28ee01e03b4639679311117971e60dc1538f34e961ae301463172c41754be988f6beb0ce4d83c69f86c236d29520e6cdaf5dbb60404c66d63315ff287deac8632781d0197ef1f81314da0a1ed90b681842cf85a41b496ce0a7a6f5aa4b9b23483eea8861be89b3398c6aec3349174f9cdc9de34df361ac9bf7afd8566849487c3c0a1e3aaacd"}) [ 631.064001] binder: release 22213:22215 transaction 372 out, still active 04:01:56 executing program 4: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) recvmsg(0xffffffffffffffff, &(0x7f00000036c0)={&(0x7f0000000180)=@can, 0xfd28, &(0x7f00000035c0), 0x0, &(0x7f0000003680)=""/41, 0x29}, 0x0) bind$alg(r0, &(0x7f0000001300)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb(blowfish)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000ff8000)="0a0775b0", 0x4) r1 = accept$alg(r0, 0x0, 0x0) sendmmsg$alg(r1, &(0x7f0000003e80)=[{0x0, 0x0, &(0x7f0000002a80), 0x0, &(0x7f0000000100)}], 0x1, 0x0) recvmsg(r1, &(0x7f0000000000)={&(0x7f0000f7ffa8)=@alg, 0x61, &(0x7f0000000140)=[{&(0x7f0000000200)=""/4096, 0xfffffe45}], 0x1, &(0x7f0000fb3fa9)=""/87, 0x57}, 0x0) [ 631.231767] binder: BINDER_SET_CONTEXT_MGR already set [ 631.254511] binder: 22244:22250 ioctl 40046207 0 returned -16 [ 631.324831] binder: 22244:22253 Release 1 refcount change on invalid ref 1 ret -22 [ 631.382271] binder: 22244:22250 BC_ACQUIRE_DONE u0000000000000000 no match [ 631.428612] binder: 22244:22250 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 [ 631.471346] binder: 22244:22250 Release 1 refcount change on invalid ref 2 ret -22 04:01:57 executing program 5: r0 = socket$inet6(0xa, 0x2, 0x0) r1 = syz_open_dev$mice(&(0x7f00000002c0)='/dev/input/mice\x00', 0x0, 0x0) ioctl$PPPOEIOCDFWD(r1, 0xb101, 0x0) syz_genetlink_get_family_id$nbd(&(0x7f0000000480)='nbd\x00') getsockopt$inet6_IPV6_XFRM_POLICY(r0, 0x29, 0x23, &(0x7f0000000340)={{{@in=@local, @in=@loopback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@local}, 0x0, @in=@remote}}, &(0x7f0000000140)=0xe8) connect$can_bcm(0xffffffffffffffff, &(0x7f00000001c0), 0x10) bind$inet6(r0, &(0x7f0000000040)={0xa, 0x4e24}, 0x1c) lsetxattr$security_ima(&(0x7f0000000280)='./file0\x00', &(0x7f0000000440)='security.ima\x00', 0x0, 0x0, 0x1) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clock_gettime(0x0, &(0x7f0000000100)={0x0, 0x0}) r4 = openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) bind(r4, &(0x7f0000000580)=@can={0x1d, r2}, 0x80) clock_gettime(0x3, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff}) ppoll(&(0x7f0000000000)=[{r0, 0x41a}], 0xf, &(0x7f0000000200)={0x0, r3+30000000}, &(0x7f0000000240), 0x8) connect$inet6(r0, &(0x7f0000000080)={0xa, 0x4e24, 0x0, @ipv4={[], [], @loopback}}, 0x1c) readv(0xffffffffffffffff, 0x0, 0x0) sendmmsg(r0, &(0x7f00000092c0), 0x4ff, 0x0) connect$pptp(r5, &(0x7f00000004c0)={0x18, 0x2, {0x0, @multicast1}}, 0x1e) 04:01:57 executing program 2: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000440)=@updpolicy={0xb8, 0x19, 0x523, 0x0, 0x0, {{@in=@multicast2, @in6=@empty={[0x0, 0x0, 0x0, 0x10000000]}, 0x0, 0x0, 0x0, 0x0, 0xa}}}, 0xb8}}, 0x0) 04:01:57 executing program 1: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) recvmsg(0xffffffffffffffff, &(0x7f00000036c0)={&(0x7f0000000180)=@can, 0xfd28, &(0x7f00000035c0), 0x0, &(0x7f0000003680)=""/41, 0x29}, 0x0) bind$alg(r0, &(0x7f0000001300)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb(blowfish)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000ff8000)="0a0775b0", 0x4) r1 = accept$alg(r0, 0x0, 0x0) sendmmsg$alg(r1, &(0x7f0000003e80)=[{0x0, 0x0, &(0x7f0000002a80), 0x167, &(0x7f0000000100)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x0) recvmsg(r1, &(0x7f0000000000)={&(0x7f0000f7ffa8)=@alg, 0x80, &(0x7f0000000140)=[{&(0x7f0000000200)=""/4096, 0x1000}], 0x1}, 0x0) 04:01:57 executing program 4: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) recvmsg(0xffffffffffffffff, &(0x7f00000036c0)={&(0x7f0000000180)=@can, 0xfd28, &(0x7f00000035c0), 0x0, &(0x7f0000003680)=""/41, 0x29}, 0x0) bind$alg(r0, &(0x7f0000001300)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb(blowfish)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000ff8000)="0a0775b0", 0x4) r1 = accept$alg(r0, 0x0, 0x0) sendmmsg$alg(r1, &(0x7f0000003e80)=[{0x0, 0x0, &(0x7f0000002a80), 0x0, &(0x7f0000000100)}], 0x1, 0x0) recvmsg(r1, &(0x7f0000000000)={&(0x7f0000f7ffa8)=@alg, 0x61, &(0x7f0000000140)=[{&(0x7f0000000200)=""/4096, 0xfffffe45}], 0x1, &(0x7f0000fb3fa9)=""/87, 0x57}, 0x0) [ 631.964930] binder: release 22244:22253 transaction 375 out, still active [ 632.484384] net_ratelimit: 20 callbacks suppressed [ 632.484393] protocol 88fb is buggy, dev hsr_slave_0 [ 632.494508] protocol 88fb is buggy, dev hsr_slave_1 [ 632.499614] protocol 88fb is buggy, dev hsr_slave_0 [ 632.504706] protocol 88fb is buggy, dev hsr_slave_1 [ 633.124935] protocol 88fb is buggy, dev hsr_slave_0 [ 633.130445] protocol 88fb is buggy, dev hsr_slave_1 [ 633.525983] protocol 88fb is buggy, dev hsr_slave_0 [ 633.531665] protocol 88fb is buggy, dev hsr_slave_1 [ 633.615013] protocol 88fb is buggy, dev hsr_slave_0 [ 633.620229] protocol 88fb is buggy, dev hsr_slave_1 04:01:59 executing program 3: r0 = creat(&(0x7f0000000000)='\x00', 0x184) ioctl$SNDRV_SEQ_IOCTL_DELETE_QUEUE(r0, 0x408c5333, &(0x7f0000000140)={0x800, 0x10001, 0x2, 'queue0\x00', 0x4}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000240)={0xffffffffffffffff}) sendmsg$unix(0xffffffffffffffff, &(0x7f0000000080)={&(0x7f00000001c0)=@abs, 0x6e, &(0x7f0000000540), 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="00000000bd118c937b2d5b07c4f3c5b8"], 0x10}, 0x0) sendmmsg(r1, &(0x7f0000000040), 0x324fad809d5a9cf, 0x0) ioctl$RTC_WKALM_SET(r0, 0x4028700f, &(0x7f0000000040)={0x0, 0x1, {0x7, 0x14, 0xf, 0x6, 0x3, 0x61, 0x5, 0x164, 0x1}}) r2 = syz_open_dev$dri(&(0x7f0000000100)='/dev/dri/card#\x00', 0x1, 0x0) ioctl$DRM_IOCTL_WAIT_VBLANK(r2, 0xc018643a, &(0x7f0000000080)={0x1}) 04:01:59 executing program 1: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) recvmsg(0xffffffffffffffff, &(0x7f00000036c0)={&(0x7f0000000180)=@can, 0xfd28, &(0x7f00000035c0), 0x0, &(0x7f0000003680)=""/41, 0x29}, 0x0) bind$alg(r0, &(0x7f0000001300)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb(blowfish)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000ff8000)="0a0775b0", 0x4) r1 = accept$alg(r0, 0x0, 0x0) sendmmsg$alg(r1, &(0x7f0000003e80)=[{0x0, 0x0, &(0x7f0000002a80), 0x167, &(0x7f0000000100)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x0) recvmsg(r1, &(0x7f0000000000)={&(0x7f0000f7ffa8)=@alg, 0x80, &(0x7f0000000140)=[{&(0x7f0000000200)=""/4096, 0x1000}], 0x1}, 0x0) 04:01:59 executing program 2: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000440)=@updpolicy={0xb8, 0x19, 0x523, 0x0, 0x0, {{@in=@multicast2, @in6=@empty={[0x0, 0x0, 0x0, 0x24030000]}, 0x0, 0x0, 0x0, 0x0, 0xa}}}, 0xb8}}, 0x0) 04:01:59 executing program 4: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) recvmsg(0xffffffffffffffff, &(0x7f00000036c0)={&(0x7f0000000180)=@can, 0xfd28, &(0x7f00000035c0), 0x0, &(0x7f0000003680)=""/41, 0x29}, 0x0) bind$alg(r0, &(0x7f0000001300)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb(blowfish)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000ff8000)="0a0775b0", 0x4) r1 = accept$alg(r0, 0x0, 0x0) sendmmsg$alg(r1, &(0x7f0000003e80)=[{0x0, 0x0, &(0x7f0000002a80), 0x0, &(0x7f0000000100)}], 0x1, 0x0) recvmsg(r1, &(0x7f0000000000)={&(0x7f0000f7ffa8)=@alg, 0x61, &(0x7f0000000140)=[{&(0x7f0000000200)=""/4096, 0xfffffe45}], 0x1, &(0x7f0000fb3fa9)=""/87, 0x57}, 0x0) 04:01:59 executing program 0: r0 = perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) setxattr$security_smack_entry(&(0x7f0000000380)='./file0\x00', &(0x7f0000000480)='security.SMACK64IPIN\x00', &(0x7f0000000540)='^vboxnet1^\x00', 0xb, 0x1) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r1, &(0x7f0000000040), 0x0}, 0x20) unlink(&(0x7f0000000900)='./file0/file0\x00') r2 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r3 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, &(0x7f00000006c0)={0x0}) ioctl$BINDER_GET_NODE_DEBUG_INFO(r2, 0xc018620b, &(0x7f0000000640)={r4}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f00000000c0)=[@enter_looper], 0x48, 0x0, &(0x7f0000000700)="2ba063fb309ec7fdbfb08e6e91baee7d7d4599fe14129a4d426834556ae420e087d59c0c7be7fcad1abb7e1f8f446f373f611ca1ee9c2231708e18a47bc68a2a79a0b48931f6ff6d"}) ioctl$BINDER_SET_CONTEXT_MGR(r3, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x1) prctl$PR_SET_NAME(0xf, &(0x7f00000004c0)='/group.stat\x00') ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, &(0x7f0000000780)}) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f0000000680)}) ioctl$FS_IOC_FIEMAP(r3, 0xc020660b, &(0x7f0000000b80)=ANY=[@ANYBLOB="0000010000000000200000000000000005000000010000000a00000000000000ff030000000000001a0a000000000000050000000000000000000000000000000000000000000000080000000000000000000000000000000800000000000000ffff0000000000000100008000000000000000000000000000000000000000000000000000000000000000000000000008000000000000003f0000000000000008000000000000000000000000000000000000000000800800000000000000000000000000000200000000000000000400000000000000000000010000000000000000000000000000000000000002110000000000000000000000000000cc0000000000000000000000000000001b0000000000000000000000000000000000000000000000841400000000000000000000000000000300000000000000feffffffffffffff000000000000000000000000000000000000000000000000020000000000000000000000000000000600000000000000ff01000000000000040000000000000000000000000000000000000000000000000400000000000000000000000000007be70000000000000900000000000000ff7f0000000000000000000000000000000000000000000004180000000000000000000000000000ffffffff0000000081000000000000000600000000000000000000000000000000000000000000000400000000000000000000000000000002000000000000000500000000000000ff7fffffffffffff0000000000000000000000000000000004040000000000000000000000000000"]) r6 = creat(&(0x7f00000000c0)='./file0\x00', 0x0) openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000100)='/group.stat\x00', 0x2761, 0x0) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000080), 0xffffffffffffffff) getpid() fallocate(r0, 0x0, 0x0, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x2f, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) memfd_create(&(0x7f0000000080)='!proccgroup\x00', 0x0) ioctl$sock_inet_SIOCSIFPFLAGS(0xffffffffffffffff, 0x8934, &(0x7f0000000400)={'veth0_to_bridge\x00', 0x100}) accept(r6, &(0x7f0000000580)=@alg, &(0x7f0000000600)=0x80) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x2400, 0x8000) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000008c0)={0x2c, 0x0, &(0x7f0000000780)=[@acquire_done={0x40106309, r5, 0x2}, @clear_death={0x400c630f, 0x1, 0x3}, @release={0x40046306, 0x2}], 0xc1, 0x0, &(0x7f00000007c0)="859547f83b9b058a973a491d7e6378544744f2b56b02270a2f78214a936e9afb25cd94695643af6563f86771aa9621b9f30f2ca538b018247a633c28ee01e03b4639679311117971e60dc1538f34e961ae301463172c41754be988f6beb0ce4d83c69f86c236d29520e6cdaf5dbb60404c66d63315ff287deac8632781d0197ef1f81314da0a1ed90b681842cf85a41b496ce0a7a6f5aa4b9b23483eea8861be89b3398c6aec3349174f9cdc9de34df361ac9bf7afd8566849487c3c0a1e3aaacd"}) 04:01:59 executing program 5: r0 = socket$inet6(0xa, 0x2, 0x0) r1 = syz_open_dev$mice(&(0x7f00000002c0)='/dev/input/mice\x00', 0x0, 0x0) ioctl$PPPOEIOCDFWD(r1, 0xb101, 0x0) syz_genetlink_get_family_id$nbd(&(0x7f0000000480)='nbd\x00') getsockopt$inet6_IPV6_XFRM_POLICY(r0, 0x29, 0x23, &(0x7f0000000340)={{{@in=@local, @in=@loopback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@local}, 0x0, @in=@remote}}, &(0x7f0000000140)=0xe8) connect$can_bcm(0xffffffffffffffff, &(0x7f00000001c0), 0x10) bind$inet6(r0, &(0x7f0000000040)={0xa, 0x4e24}, 0x1c) lsetxattr$security_ima(&(0x7f0000000280)='./file0\x00', &(0x7f0000000440)='security.ima\x00', 0x0, 0x0, 0x1) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clock_gettime(0x0, &(0x7f0000000100)={0x0, 0x0}) r4 = openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) bind(r4, &(0x7f0000000580)=@can={0x1d, r2}, 0x80) clock_gettime(0x3, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff}) ppoll(&(0x7f0000000000)=[{r0, 0x41a}], 0x300, &(0x7f0000000200)={0x0, r3+30000000}, &(0x7f0000000240), 0x8) connect$inet6(r0, &(0x7f0000000080)={0xa, 0x4e24, 0x0, @ipv4={[], [], @loopback}}, 0x1c) readv(0xffffffffffffffff, 0x0, 0x0) sendmmsg(r0, &(0x7f00000092c0), 0x4ff, 0x0) connect$pptp(r5, &(0x7f00000004c0)={0x18, 0x2, {0x0, @multicast1}}, 0x1e) 04:02:00 executing program 2: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000440)=@updpolicy={0xb8, 0x19, 0x523, 0x0, 0x0, {{@in=@multicast2, @in6=@empty={[0x0, 0x0, 0x0, 0x2f000000]}, 0x0, 0x0, 0x0, 0x0, 0xa}}}, 0xb8}}, 0x0) [ 634.224808] binder: BINDER_SET_CONTEXT_MGR already set [ 634.233321] binder: 22281:22289 ioctl 40046207 0 returned -16 [ 634.252440] [drm:drm_calc_timestamping_constants] *ERROR* crtc 31: Can't calculate constants, dotclock = 0! [ 634.261070] binder: 22281:22289 Release 1 refcount change on invalid ref 1 ret -22 04:02:00 executing program 1: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) recvmsg(0xffffffffffffffff, &(0x7f00000036c0)={&(0x7f0000000180)=@can, 0xfd28, &(0x7f00000035c0), 0x0, &(0x7f0000003680)=""/41, 0x29}, 0x0) bind$alg(r0, &(0x7f0000001300)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb(blowfish)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000ff8000)="0a0775b0", 0x4) r1 = accept$alg(r0, 0x0, 0x0) sendmmsg$alg(r1, &(0x7f0000003e80)=[{0x0, 0x0, &(0x7f0000002a80), 0x167, &(0x7f0000000100)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x0) recvmsg(r1, &(0x7f0000000000)={&(0x7f0000f7ffa8)=@alg, 0x80, &(0x7f0000000140)=[{&(0x7f0000000200)=""/4096, 0x1000}], 0x1}, 0x0) 04:02:00 executing program 4: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) recvmsg(0xffffffffffffffff, &(0x7f00000036c0)={&(0x7f0000000180)=@can, 0xfd28, &(0x7f00000035c0), 0x0, &(0x7f0000003680)=""/41, 0x29}, 0x0) bind$alg(r0, &(0x7f0000001300)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb(blowfish)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000ff8000)="0a0775b0", 0x4) r1 = accept$alg(r0, 0x0, 0x0) sendmmsg$alg(r1, &(0x7f0000003e80)=[{0x0, 0x0, &(0x7f0000002a80), 0x167, &(0x7f0000000100)=[@op={0x18}], 0x18}], 0x1, 0x0) recvmsg(r1, &(0x7f0000000000)={&(0x7f0000f7ffa8)=@alg, 0x61, &(0x7f0000000140)=[{&(0x7f0000000200)=""/4096, 0xfffffe45}], 0x1, &(0x7f0000fb3fa9)=""/87, 0x57}, 0x0) [ 634.325745] binder: 22281:22294 BC_ACQUIRE_DONE u0000000000000000 no match [ 634.352966] binder: 22281:22294 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 [ 634.403527] binder: 22281:22294 Release 1 refcount change on invalid ref 2 ret -22 04:02:00 executing program 3: pipe(&(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$alg(0x26, 0x5, 0x0) bind$alg(r2, &(0x7f0000000000)={0x26, 'hash\x00', 0x0, 0x0, 'tgr192\x00'}, 0x58) r3 = accept4$alg(r2, 0x0, 0x0, 0x0) write$binfmt_elf64(r1, &(0x7f00000003c0)=ANY=[@ANYRESOCT], 0x17) splice(r0, 0x0, r3, 0x0, 0x20000000003, 0x0) 04:02:00 executing program 2: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000440)=@updpolicy={0xb8, 0x19, 0x523, 0x0, 0x0, {{@in=@multicast2, @in6=@empty={[0x0, 0x0, 0x0, 0x60000000]}, 0x0, 0x0, 0x0, 0x0, 0xa}}}, 0xb8}}, 0x0) 04:02:00 executing program 1: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) recvmsg(0xffffffffffffffff, &(0x7f00000036c0)={&(0x7f0000000180)=@can, 0xfd28, &(0x7f00000035c0), 0x0, &(0x7f0000003680)=""/41, 0x29}, 0x0) bind$alg(r0, &(0x7f0000001300)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb(blowfish)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000ff8000)="0a0775b0", 0x4) r1 = accept$alg(r0, 0x0, 0x0) sendmmsg$alg(r1, &(0x7f0000003e80)=[{0x0, 0x0, &(0x7f0000002a80), 0x167, &(0x7f0000000100)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x0) recvmsg(r1, &(0x7f0000000000)={&(0x7f0000f7ffa8)=@alg, 0x80, &(0x7f0000000140)=[{&(0x7f0000000200)=""/4096, 0x1000}], 0x1}, 0x0) 04:02:00 executing program 4: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) recvmsg(0xffffffffffffffff, &(0x7f00000036c0)={&(0x7f0000000180)=@can, 0xfd28, &(0x7f00000035c0), 0x0, &(0x7f0000003680)=""/41, 0x29}, 0x0) bind$alg(r0, &(0x7f0000001300)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb(blowfish)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000ff8000)="0a0775b0", 0x4) r1 = accept$alg(r0, 0x0, 0x0) sendmmsg$alg(r1, &(0x7f0000003e80)=[{0x0, 0x0, &(0x7f0000002a80), 0x167, &(0x7f0000000100)=[@op={0x18}], 0x18}], 0x1, 0x0) recvmsg(r1, &(0x7f0000000000)={&(0x7f0000f7ffa8)=@alg, 0x61, &(0x7f0000000140)=[{&(0x7f0000000200)=""/4096, 0xfffffe45}], 0x1, &(0x7f0000fb3fa9)=""/87, 0x57}, 0x0) 04:02:00 executing program 2: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000440)=@updpolicy={0xb8, 0x19, 0x523, 0x0, 0x0, {{@in=@multicast2, @in6=@empty={[0x0, 0x0, 0x0, 0x80ffffff]}, 0x0, 0x0, 0x0, 0x0, 0xa}}}, 0xb8}}, 0x0) 04:02:00 executing program 3: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x800000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = openat$rfkill(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rfkill\x00', 0x0, 0x0) ioctl$KVM_GET_XSAVE(r0, 0x9000aea4, &(0x7f0000000040)) r1 = socket$kcm(0x29, 0x5, 0x0) accept$packet(r0, &(0x7f0000000480)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f00000004c0)=0x14) close(r1) write$binfmt_misc(r1, &(0x7f0000000440)={'syz0'}, 0xfffffd70) 04:02:00 executing program 0: r0 = perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) setxattr$security_smack_entry(&(0x7f0000000380)='./file0\x00', &(0x7f0000000480)='security.SMACK64IPIN\x00', &(0x7f0000000540)='^vboxnet1^\x00', 0xb, 0x1) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r1, &(0x7f0000000040), 0x0}, 0x20) unlink(&(0x7f0000000900)='./file0/file0\x00') r2 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r3 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, &(0x7f00000006c0)={0x0}) ioctl$BINDER_GET_NODE_DEBUG_INFO(r2, 0xc018620b, &(0x7f0000000640)={r4}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f00000000c0)=[@enter_looper], 0x48, 0x0, &(0x7f0000000700)="2ba063fb309ec7fdbfb08e6e91baee7d7d4599fe14129a4d426834556ae420e087d59c0c7be7fcad1abb7e1f8f446f373f611ca1ee9c2231708e18a47bc68a2a79a0b48931f6ff6d"}) ioctl$BINDER_SET_CONTEXT_MGR(r3, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x1) prctl$PR_SET_NAME(0xf, &(0x7f00000004c0)='/group.stat\x00') ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, &(0x7f0000000780)}) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f0000000680)}) ioctl$FS_IOC_FIEMAP(r3, 0xc020660b, &(0x7f0000000b80)=ANY=[@ANYBLOB="0000010000000000200000000000000005000000010000000a00000000000000ff030000000000001a0a000000000000050000000000000000000000000000000000000000000000080000000000000000000000000000000800000000000000ffff0000000000000100008000000000000000000000000000000000000000000000000000000000000000000000000008000000000000003f0000000000000008000000000000000000000000000000000000000000800800000000000000000000000000000200000000000000000400000000000000000000010000000000000000000000000000000000000002110000000000000000000000000000cc0000000000000000000000000000001b0000000000000000000000000000000000000000000000841400000000000000000000000000000300000000000000feffffffffffffff000000000000000000000000000000000000000000000000020000000000000000000000000000000600000000000000ff01000000000000040000000000000000000000000000000000000000000000000400000000000000000000000000007be70000000000000900000000000000ff7f0000000000000000000000000000000000000000000004180000000000000000000000000000ffffffff0000000081000000000000000600000000000000000000000000000000000000000000000400000000000000000000000000000002000000000000000500000000000000ff7fffffffffffff0000000000000000000000000000000004040000000000000000000000000000"]) r6 = creat(&(0x7f00000000c0)='./file0\x00', 0x0) openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000100)='/group.stat\x00', 0x2761, 0x0) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000080), 0xffffffffffffffff) getpid() fallocate(r0, 0x0, 0x0, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x2f, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) memfd_create(&(0x7f0000000080)='!proccgroup\x00', 0x0) ioctl$sock_inet_SIOCSIFPFLAGS(0xffffffffffffffff, 0x8934, &(0x7f0000000400)={'veth0_to_bridge\x00', 0x100}) accept(r6, &(0x7f0000000580)=@alg, &(0x7f0000000600)=0x80) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x2400, 0x8000) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000008c0)={0x2c, 0x0, &(0x7f0000000780)=[@acquire_done={0x40106309, r5, 0x2}, @clear_death={0x400c630f, 0x1, 0x3}, @release={0x40046306, 0x2}], 0xc1, 0x0, &(0x7f00000007c0)="859547f83b9b058a973a491d7e6378544744f2b56b02270a2f78214a936e9afb25cd94695643af6563f86771aa9621b9f30f2ca538b018247a633c28ee01e03b4639679311117971e60dc1538f34e961ae301463172c41754be988f6beb0ce4d83c69f86c236d29520e6cdaf5dbb60404c66d63315ff287deac8632781d0197ef1f81314da0a1ed90b681842cf85a41b496ce0a7a6f5aa4b9b23483eea8861be89b3398c6aec3349174f9cdc9de34df361ac9bf7afd8566849487c3c0a1e3aaacd"}) 04:02:00 executing program 1: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) recvmsg(0xffffffffffffffff, &(0x7f00000036c0)={&(0x7f0000000180)=@can, 0xfd28, &(0x7f00000035c0), 0x0, &(0x7f0000003680)=""/41, 0x29}, 0x0) bind$alg(r0, &(0x7f0000001300)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb(blowfish)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000ff8000)="0a0775b0", 0x4) r1 = accept$alg(r0, 0x0, 0x0) sendmmsg$alg(r1, &(0x7f0000003e80)=[{0x0, 0x0, &(0x7f0000002a80), 0x167, &(0x7f0000000100)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x0) recvmsg(r1, &(0x7f0000000000)={&(0x7f0000f7ffa8)=@alg, 0x80, &(0x7f0000000140)=[{&(0x7f0000000200)=""/4096, 0x1000}], 0x1}, 0x0) [ 634.963260] binder: release 22281:22289 transaction 378 out, still active [ 635.230139] binder: BINDER_SET_CONTEXT_MGR already set [ 635.275107] binder: 22323:22331 ioctl 40046207 0 returned -16 [ 635.295896] binder: 22323:22331 Release 1 refcount change on invalid ref 1 ret -22 04:02:01 executing program 5: r0 = socket$inet6(0xa, 0x2, 0x0) r1 = syz_open_dev$mice(&(0x7f00000002c0)='/dev/input/mice\x00', 0x0, 0x0) ioctl$PPPOEIOCDFWD(r1, 0xb101, 0x0) syz_genetlink_get_family_id$nbd(&(0x7f0000000480)='nbd\x00') getsockopt$inet6_IPV6_XFRM_POLICY(r0, 0x29, 0x23, &(0x7f0000000340)={{{@in=@local, @in=@loopback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@local}, 0x0, @in=@remote}}, &(0x7f0000000140)=0xe8) connect$can_bcm(0xffffffffffffffff, &(0x7f00000001c0), 0x10) bind$inet6(r0, &(0x7f0000000040)={0xa, 0x4e24}, 0x1c) lsetxattr$security_ima(&(0x7f0000000280)='./file0\x00', &(0x7f0000000440)='security.ima\x00', 0x0, 0x0, 0x1) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clock_gettime(0x0, &(0x7f0000000100)={0x0, 0x0}) r4 = openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) bind(r4, &(0x7f0000000580)=@can={0x1d, r2}, 0x80) clock_gettime(0x3, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff}) ppoll(&(0x7f0000000000)=[{r0, 0x41a}], 0x1a000, &(0x7f0000000200)={0x0, r3+30000000}, &(0x7f0000000240), 0x8) connect$inet6(r0, &(0x7f0000000080)={0xa, 0x4e24, 0x0, @ipv4={[], [], @loopback}}, 0x1c) readv(0xffffffffffffffff, 0x0, 0x0) sendmmsg(r0, &(0x7f00000092c0), 0x4ff, 0x0) connect$pptp(r5, &(0x7f00000004c0)={0x18, 0x2, {0x0, @multicast1}}, 0x1e) 04:02:01 executing program 2: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000440)=@updpolicy={0xb8, 0x19, 0x523, 0x0, 0x0, {{@in=@multicast2, @in6=@empty={[0x0, 0x0, 0x0, 0x9effffff]}, 0x0, 0x0, 0x0, 0x0, 0xa}}}, 0xb8}}, 0x0) 04:02:01 executing program 4: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) recvmsg(0xffffffffffffffff, &(0x7f00000036c0)={&(0x7f0000000180)=@can, 0xfd28, &(0x7f00000035c0), 0x0, &(0x7f0000003680)=""/41, 0x29}, 0x0) bind$alg(r0, &(0x7f0000001300)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb(blowfish)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000ff8000)="0a0775b0", 0x4) r1 = accept$alg(r0, 0x0, 0x0) sendmmsg$alg(r1, &(0x7f0000003e80)=[{0x0, 0x0, &(0x7f0000002a80), 0x167, &(0x7f0000000100)=[@op={0x18}], 0x18}], 0x1, 0x0) recvmsg(r1, &(0x7f0000000000)={&(0x7f0000f7ffa8)=@alg, 0x61, &(0x7f0000000140)=[{&(0x7f0000000200)=""/4096, 0xfffffe45}], 0x1, &(0x7f0000fb3fa9)=""/87, 0x57}, 0x0) 04:02:01 executing program 3: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) recvmsg(0xffffffffffffffff, &(0x7f00000036c0)={&(0x7f0000000180)=@can, 0xfd28, &(0x7f00000035c0), 0x0, &(0x7f0000003680)=""/41, 0x29}, 0x0) bind$alg(r0, &(0x7f0000001300)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb(blowfish)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000ff8000)="0a0775b0", 0x4) r1 = accept$alg(r0, 0x0, 0x0) sendmmsg$alg(r1, &(0x7f0000003e80)=[{0x0, 0x0, &(0x7f0000002a80), 0x167, &(0x7f0000000100)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x0) recvmsg(r1, &(0x7f0000000000)={&(0x7f0000f7ffa8)=@alg, 0x80, &(0x7f0000000140)=[{&(0x7f0000000200)=""/4096, 0x1000}], 0x1}, 0x0) 04:02:01 executing program 1: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) recvmsg(0xffffffffffffffff, &(0x7f00000036c0)={&(0x7f0000000180)=@can, 0xfd28, &(0x7f00000035c0), 0x0, &(0x7f0000003680)=""/41, 0x29}, 0x0) bind$alg(r0, &(0x7f0000001300)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb(blowfish)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000ff8000)="0a0775b0", 0x4) r1 = accept$alg(r0, 0x0, 0x0) sendmmsg$alg(r1, &(0x7f0000003e80)=[{0x0, 0x0, &(0x7f0000002a80), 0x167, &(0x7f0000000100)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x0) recvmsg(r1, &(0x7f0000000000)={&(0x7f0000f7ffa8)=@alg, 0x80, &(0x7f0000000140)=[{&(0x7f0000000200)=""/4096, 0x1000}], 0x1}, 0x0) 04:02:01 executing program 0: r0 = perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) setxattr$security_smack_entry(&(0x7f0000000380)='./file0\x00', &(0x7f0000000480)='security.SMACK64IPIN\x00', &(0x7f0000000540)='^vboxnet1^\x00', 0xb, 0x1) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r1, &(0x7f0000000040), 0x0}, 0x20) unlink(&(0x7f0000000900)='./file0/file0\x00') r2 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r3 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, &(0x7f00000006c0)={0x0}) ioctl$BINDER_GET_NODE_DEBUG_INFO(r2, 0xc018620b, &(0x7f0000000640)={r4}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f00000000c0)=[@enter_looper], 0x48, 0x0, &(0x7f0000000700)="2ba063fb309ec7fdbfb08e6e91baee7d7d4599fe14129a4d426834556ae420e087d59c0c7be7fcad1abb7e1f8f446f373f611ca1ee9c2231708e18a47bc68a2a79a0b48931f6ff6d"}) ioctl$BINDER_SET_CONTEXT_MGR(r3, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x1) prctl$PR_SET_NAME(0xf, &(0x7f00000004c0)='/group.stat\x00') ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, &(0x7f0000000780)}) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f0000000680)}) ioctl$FS_IOC_FIEMAP(r3, 0xc020660b, &(0x7f0000000b80)=ANY=[@ANYBLOB="0000010000000000200000000000000005000000010000000a00000000000000ff030000000000001a0a000000000000050000000000000000000000000000000000000000000000080000000000000000000000000000000800000000000000ffff0000000000000100008000000000000000000000000000000000000000000000000000000000000000000000000008000000000000003f0000000000000008000000000000000000000000000000000000000000800800000000000000000000000000000200000000000000000400000000000000000000010000000000000000000000000000000000000002110000000000000000000000000000cc0000000000000000000000000000001b0000000000000000000000000000000000000000000000841400000000000000000000000000000300000000000000feffffffffffffff000000000000000000000000000000000000000000000000020000000000000000000000000000000600000000000000ff01000000000000040000000000000000000000000000000000000000000000000400000000000000000000000000007be70000000000000900000000000000ff7f0000000000000000000000000000000000000000000004180000000000000000000000000000ffffffff0000000081000000000000000600000000000000000000000000000000000000000000000400000000000000000000000000000002000000000000000500000000000000ff7fffffffffffff0000000000000000000000000000000004040000000000000000000000000000"]) r6 = creat(&(0x7f00000000c0)='./file0\x00', 0x0) openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000100)='/group.stat\x00', 0x2761, 0x0) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000080), 0xffffffffffffffff) getpid() fallocate(r0, 0x0, 0x0, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x2f, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) memfd_create(&(0x7f0000000080)='!proccgroup\x00', 0x0) ioctl$sock_inet_SIOCSIFPFLAGS(0xffffffffffffffff, 0x8934, &(0x7f0000000400)={'veth0_to_bridge\x00', 0x100}) accept(r6, &(0x7f0000000580)=@alg, &(0x7f0000000600)=0x80) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x2400, 0x8000) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000008c0)={0x2c, 0x0, &(0x7f0000000780)=[@acquire_done={0x40106309, r5, 0x2}, @clear_death={0x400c630f, 0x1, 0x3}, @release={0x40046306, 0x2}], 0xc1, 0x0, &(0x7f00000007c0)="859547f83b9b058a973a491d7e6378544744f2b56b02270a2f78214a936e9afb25cd94695643af6563f86771aa9621b9f30f2ca538b018247a633c28ee01e03b4639679311117971e60dc1538f34e961ae301463172c41754be988f6beb0ce4d83c69f86c236d29520e6cdaf5dbb60404c66d63315ff287deac8632781d0197ef1f81314da0a1ed90b681842cf85a41b496ce0a7a6f5aa4b9b23483eea8861be89b3398c6aec3349174f9cdc9de34df361ac9bf7afd8566849487c3c0a1e3aaacd"}) 04:02:01 executing program 2: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000440)=@updpolicy={0xb8, 0x19, 0x523, 0x0, 0x0, {{@in=@multicast2, @in6=@empty={[0x0, 0x0, 0x0, 0xf0ffffff]}, 0x0, 0x0, 0x0, 0x0, 0xa}}}, 0xb8}}, 0x0) [ 635.590595] binder: BINDER_SET_CONTEXT_MGR already set [ 635.636748] binder: 22338:22351 ioctl 40046207 0 returned -16 04:02:01 executing program 3: r0 = syz_open_dev$mouse(&(0x7f0000000000)='/dev/input/mouse#\x00', 0x5, 0x10000) getsockopt$inet6_IPV6_FLOWLABEL_MGR(r0, 0x29, 0x20, &(0x7f0000000040)={@mcast2, 0x9, 0x0, 0x0, 0x1, 0xff}, &(0x7f0000000080)=0x20) prctl$PR_GET_THP_DISABLE(0x2a) ioctl$BLKREPORTZONE(r0, 0xc0101282, &(0x7f00000000c0)={0xfff, 0x1, 0x0, [{0x80000000, 0x200, 0x8, 0xaad, 0x9, 0xffff, 0x885b}]}) ioctl$TIOCSLCKTRMIOS(r0, 0x5457, &(0x7f0000000140)) ioctl$BLKBSZGET(r0, 0x80081270, &(0x7f0000000180)) ioctl$VIDIOC_S_FBUF(r0, 0x4030560b, &(0x7f0000000240)={0x20, 0x8, &(0x7f00000001c0)="9c7c4a083919db734823c4f98a90c7eb8122575845565ce014ebbfc813a0aeb1ad0d3e7b74ec678710699aa3b6dc2c0c0baf843e3942321aadd00ce22b78a689f6d3a41cd2e7cdf92cc022696fd8ae6d95917b2dbb272bb6e8fe20afcd3d5d0efbcbe7d0f898", {0x7ff, 0x4, 0x62a4be07c6241b2c, 0x7, 0xfffffffffffffffd, 0x0, 0x9, 0xff}}) fgetxattr(r0, &(0x7f0000000280)=@known='trusted.overlay.nlink\x00', &(0x7f00000002c0)=""/4096, 0x1000) ioctl$VT_SETMODE(r0, 0x5602, &(0x7f00000012c0)={0x7ff, 0x1, 0x8, 0x4, 0x1}) setsockopt$TIPC_MCAST_REPLICAST(r0, 0x10f, 0x86) epoll_create1(0x80000) getsockopt$inet_sctp6_SCTP_STATUS(r0, 0x84, 0xe, &(0x7f0000001300)={0x0, 0x8, 0x1, 0x7, 0xff, 0xfff, 0xffffffffffff2590, 0x20, {0x0, @in={{0x2, 0x4e22, @broadcast}}, 0x80000001, 0x6, 0x1, 0x3, 0x6f2a207}}, &(0x7f00000013c0)=0xb0) getsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(r0, 0x84, 0x9, &(0x7f0000001400)={r1, @in6={{0xa, 0x4e23, 0x401, @initdev={0xfe, 0x88, [], 0x1, 0x0}, 0xfa}}, 0xdcb, 0x4, 0x200, 0x80000000, 0x31}, &(0x7f00000014c0)=0x98) write$FUSE_POLL(r0, &(0x7f0000001500)={0x18, 0xffffffffffffffda, 0x6, {0xc30}}, 0x18) ioctl$VT_RESIZEX(r0, 0x560a, &(0x7f0000001540)={0x0, 0x7, 0x6, 0x800, 0x5, 0x8001}) r2 = openat$uinput(0xffffffffffffff9c, &(0x7f0000001580)='/dev/uinput\x00', 0x802, 0x0) fcntl$getownex(r2, 0x10, &(0x7f00000015c0)) ioctl$IMGETCOUNT(r0, 0x80044943, &(0x7f0000001600)) r3 = syz_genetlink_get_family_id$net_dm(&(0x7f0000001680)='NET_DM\x00') sendmsg$NET_DM_CMD_START(r0, &(0x7f0000001740)={&(0x7f0000001640)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000001700)={&(0x7f00000016c0)={0x14, r3, 0x0, 0x70bd26, 0x25dfdbfe, {}, ["", "", ""]}, 0x14}, 0x1, 0x0, 0x0, 0x40080}, 0x40) r4 = accept$alg(r0, 0x0, 0x0) ioctl$TIOCLINUX3(r0, 0x541c, &(0x7f0000001780)) write$P9_RUNLINKAT(r0, &(0x7f00000017c0)={0x7, 0x4d, 0x2}, 0x7) epoll_pwait(r0, &(0x7f0000001800)=[{}], 0x1, 0x3, &(0x7f0000001840)={0x8}, 0x8) setsockopt$IP_VS_SO_SET_TIMEOUT(r0, 0x0, 0x48a, &(0x7f0000001880)={0xfffffffffffffffc, 0x6}, 0xc) ioctl$sock_inet_SIOCSIFBRDADDR(r4, 0x891a, &(0x7f00000018c0)={'veth0_to_bond\x00', {0x2, 0x4e22, @initdev={0xac, 0x1e, 0x1, 0x0}}}) r5 = openat$zero(0xffffffffffffff9c, &(0x7f0000001900)='/dev/zero\x00', 0x40, 0x0) ioctl$sock_inet6_udp_SIOCINQ(r5, 0x541b, &(0x7f0000001940)) write$P9_RMKDIR(r4, &(0x7f0000001980)={0x14, 0x49, 0x1, {0x10, 0x2, 0x5}}, 0x14) lstat(&(0x7f00000019c0)='./file0\x00', &(0x7f0000001a00)={0x0, 0x0, 0x0, 0x0, 0x0}) r7 = geteuid() setreuid(r6, r7) 04:02:01 executing program 1: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) recvmsg(0xffffffffffffffff, &(0x7f00000036c0)={&(0x7f0000000180)=@can, 0xfd28, &(0x7f00000035c0), 0x0, &(0x7f0000003680)=""/41, 0x29}, 0x0) bind$alg(r0, &(0x7f0000001300)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb(blowfish)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000ff8000)="0a0775b0", 0x4) r1 = accept$alg(r0, 0x0, 0x0) sendmmsg$alg(r1, &(0x7f0000003e80)=[{0x0, 0x0, &(0x7f0000002a80), 0x167, &(0x7f0000000100)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x0) recvmsg(r1, &(0x7f0000000000)={&(0x7f0000f7ffa8)=@alg, 0x80, &(0x7f0000000140)=[{&(0x7f0000000200)=""/4096, 0x1000}], 0x1}, 0x0) 04:02:01 executing program 4: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) recvmsg(0xffffffffffffffff, &(0x7f00000036c0)={&(0x7f0000000180)=@can, 0xfd28, &(0x7f00000035c0), 0x0, &(0x7f0000003680)=""/41, 0x29}, 0x0) bind$alg(r0, &(0x7f0000001300)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb(blowfish)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000ff8000)="0a0775b0", 0x4) r1 = accept$alg(r0, 0x0, 0x0) sendmmsg$alg(r1, &(0x7f0000003e80)=[{0x0, 0x0, &(0x7f0000002a80), 0x167, &(0x7f0000000100)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x0) recvmsg(0xffffffffffffffff, &(0x7f0000000000)={&(0x7f0000f7ffa8)=@alg, 0x61, &(0x7f0000000140)=[{&(0x7f0000000200)=""/4096, 0xfffffe45}], 0x1, &(0x7f0000fb3fa9)=""/87, 0x57}, 0x0) [ 635.685646] binder: 22338:22351 Release 1 refcount change on invalid ref 1 ret -22 [ 635.777323] binder: 22338:22359 BC_ACQUIRE_DONE u0000000000000000 no match 04:02:01 executing program 4: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) recvmsg(0xffffffffffffffff, &(0x7f00000036c0)={&(0x7f0000000180)=@can, 0xfd28, &(0x7f00000035c0), 0x0, &(0x7f0000003680)=""/41, 0x29}, 0x0) bind$alg(r0, &(0x7f0000001300)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb(blowfish)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000ff8000)="0a0775b0", 0x4) r1 = accept$alg(r0, 0x0, 0x0) sendmmsg$alg(r1, &(0x7f0000003e80)=[{0x0, 0x0, &(0x7f0000002a80), 0x167, &(0x7f0000000100)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x0) recvmsg(r1, 0x0, 0x0) 04:02:01 executing program 3: r0 = socket$inet(0x10, 0x3, 0xc) r1 = openat$dlm_plock(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm_plock\x00', 0x100, 0x0) write$P9_RLOPEN(r1, &(0x7f0000000080)={0x18, 0xd, 0x1, {{0x40, 0x4, 0x5}, 0x1f}}, 0x18) sendmsg(r0, &(0x7f0000011fc8)={0x0, 0x0, &(0x7f0000000040)=[{&(0x7f0000000100)="24000000010407031dfffd946ff20c000a200a0009000100031d85680c1baba20400ff7e", 0x24}], 0x1}, 0x0) [ 635.882040] binder: 22338:22359 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 [ 635.959285] binder: 22338:22359 Release 1 refcount change on invalid ref 2 ret -22 [ 636.294711] binder: release 22338:22351 transaction 384 out, still active 04:02:02 executing program 5: r0 = socket$inet6(0xa, 0x2, 0x0) r1 = syz_open_dev$mice(&(0x7f00000002c0)='/dev/input/mice\x00', 0x0, 0x0) ioctl$PPPOEIOCDFWD(r1, 0xb101, 0x0) syz_genetlink_get_family_id$nbd(&(0x7f0000000480)='nbd\x00') getsockopt$inet6_IPV6_XFRM_POLICY(r0, 0x29, 0x23, &(0x7f0000000340)={{{@in=@local, @in=@loopback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@local}, 0x0, @in=@remote}}, &(0x7f0000000140)=0xe8) connect$can_bcm(0xffffffffffffffff, &(0x7f00000001c0), 0x10) bind$inet6(r0, &(0x7f0000000040)={0xa, 0x4e24}, 0x1c) lsetxattr$security_ima(&(0x7f0000000280)='./file0\x00', &(0x7f0000000440)='security.ima\x00', 0x0, 0x0, 0x1) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clock_gettime(0x0, &(0x7f0000000100)={0x0, 0x0}) r4 = openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) bind(r4, &(0x7f0000000580)=@can={0x1d, r2}, 0x80) clock_gettime(0x3, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff}) ppoll(&(0x7f0000000000)=[{r0, 0x41a}], 0x1, &(0x7f0000000200)={0x0, r3+30000000}, &(0x7f0000000240)={0x3}, 0x8) connect$inet6(r0, &(0x7f0000000080)={0xa, 0x4e24, 0x0, @ipv4={[], [], @loopback}}, 0x1c) readv(0xffffffffffffffff, 0x0, 0x0) sendmmsg(r0, &(0x7f00000092c0), 0x4ff, 0x0) connect$pptp(r5, &(0x7f00000004c0)={0x18, 0x2, {0x0, @multicast1}}, 0x1e) 04:02:02 executing program 2: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000440)=@updpolicy={0xb8, 0x19, 0x523, 0x0, 0x0, {{@in=@multicast2, @in6=@empty={[0x0, 0x0, 0x0, 0xfcffffff]}, 0x0, 0x0, 0x0, 0x0, 0xa}}}, 0xb8}}, 0x0) 04:02:02 executing program 1: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) recvmsg(0xffffffffffffffff, &(0x7f00000036c0)={&(0x7f0000000180)=@can, 0xfd28, &(0x7f00000035c0), 0x0, &(0x7f0000003680)=""/41, 0x29}, 0x0) bind$alg(r0, &(0x7f0000001300)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb(blowfish)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000ff8000)="0a0775b0", 0x4) r1 = accept$alg(r0, 0x0, 0x0) sendmmsg$alg(r1, &(0x7f0000003e80)=[{0x0, 0x0, &(0x7f0000002a80), 0x167, &(0x7f0000000100)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x0) recvmsg(r1, &(0x7f0000000000)={&(0x7f0000f7ffa8)=@alg, 0x80, &(0x7f0000000140)=[{&(0x7f0000000200)=""/4096, 0x1000}], 0x1}, 0x0) 04:02:02 executing program 3: r0 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000000)='/dev/sequencer2\x00', 0x80040, 0x0) getsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(0xffffffffffffffff, 0x84, 0x9, &(0x7f0000000180)={0x0, @in6={{0xa, 0x4e23, 0x81, @remote, 0x5}}, 0x4819, 0x0, 0x5, 0x2, 0x50}, &(0x7f0000000040)=0x98) getsockopt$inet_sctp6_SCTP_GET_LOCAL_ADDRS(r0, 0x84, 0x6d, &(0x7f0000000240)={r1, 0xed, "6eacf6252eef32ff1fef349ff84618a7d6ba8262ffe3f8b2dbc629819c9a4d5c5058f17b98d9568be68a0144af46d387b6f9f2a76da2039092929ed9b338db32acda28a0454fe5d4ee263b7a75e486fd380aa6b1f8a4b6d615223b32130ea29daf83059c454e3bbe93f53907ecba691587660ed61b47214a0fc1ec9532f5efc4d01bc055a83e082f10ecdbce9f228ca92fadb3e5dab66bcc36afda599e016ce18009b140919727cd3ab78f9b3e1f277901732edc2e89eccb040806ca1fa26056d029c73fc83ac2130f931ea6c9a08d95f73e9c1355025bf3cba70dcc8b19d7a2b8f55e7c27bf2a81d970eaf45c"}, &(0x7f00000000c0)=0xf5) r2 = bpf$MAP_CREATE(0x0, &(0x7f0000733000)={0x5, 0x5, 0x7, 0x9}, 0x26d) r3 = bpf$MAP_CREATE(0x0, &(0x7f0000000100)={0xd, 0x23, 0x4, 0x1, 0x0, r2}, 0x2c) bpf$BPF_GET_MAP_INFO(0xf, &(0x7f0000000080)={r2, 0x0, 0x0}, 0x10) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000140)={r3, &(0x7f0000000000), 0x0, 0x1}, 0x20) 04:02:02 executing program 4: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) recvmsg(0xffffffffffffffff, &(0x7f00000036c0)={&(0x7f0000000180)=@can, 0xfd28, &(0x7f00000035c0), 0x0, &(0x7f0000003680)=""/41, 0x29}, 0x0) bind$alg(r0, &(0x7f0000001300)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb(blowfish)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000ff8000)="0a0775b0", 0x4) r1 = accept$alg(r0, 0x0, 0x0) sendmmsg$alg(r1, &(0x7f0000003e80)=[{0x0, 0x0, &(0x7f0000002a80), 0x167, &(0x7f0000000100)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x0) recvmsg(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)=[{&(0x7f0000000200)=""/4096, 0x1000}], 0x1, &(0x7f0000fb3fa9)=""/87, 0x57}, 0x0) 04:02:02 executing program 0: r0 = perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) setxattr$security_smack_entry(&(0x7f0000000380)='./file0\x00', &(0x7f0000000480)='security.SMACK64IPIN\x00', &(0x7f0000000540)='^vboxnet1^\x00', 0xb, 0x1) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r1, &(0x7f0000000040), 0x0}, 0x20) unlink(&(0x7f0000000900)='./file0/file0\x00') r2 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r3 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r3, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(0xffffffffffffffff, 0xc018620b, &(0x7f00000006c0)={0x0}) ioctl$BINDER_GET_NODE_DEBUG_INFO(r2, 0xc018620b, &(0x7f0000000640)={r4}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f00000000c0)=[@enter_looper], 0x48, 0x0, &(0x7f0000000700)="2ba063fb309ec7fdbfb08e6e91baee7d7d4599fe14129a4d426834556ae420e087d59c0c7be7fcad1abb7e1f8f446f373f611ca1ee9c2231708e18a47bc68a2a79a0b48931f6ff6d"}) ioctl$BINDER_SET_CONTEXT_MGR(r3, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x1) prctl$PR_SET_NAME(0xf, &(0x7f00000004c0)='/group.stat\x00') ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, &(0x7f0000000780)}) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f0000000680)}) ioctl$FS_IOC_FIEMAP(r3, 0xc020660b, &(0x7f0000000b80)=ANY=[@ANYBLOB="0000010000000000200000000000000005000000010000000a00000000000000ff030000000000001a0a000000000000050000000000000000000000000000000000000000000000080000000000000000000000000000000800000000000000ffff0000000000000100008000000000000000000000000000000000000000000000000000000000000000000000000008000000000000003f0000000000000008000000000000000000000000000000000000000000800800000000000000000000000000000200000000000000000400000000000000000000010000000000000000000000000000000000000002110000000000000000000000000000cc0000000000000000000000000000001b0000000000000000000000000000000000000000000000841400000000000000000000000000000300000000000000feffffffffffffff000000000000000000000000000000000000000000000000020000000000000000000000000000000600000000000000ff01000000000000040000000000000000000000000000000000000000000000000400000000000000000000000000007be70000000000000900000000000000ff7f0000000000000000000000000000000000000000000004180000000000000000000000000000ffffffff0000000081000000000000000600000000000000000000000000000000000000000000000400000000000000000000000000000002000000000000000500000000000000ff7fffffffffffff0000000000000000000000000000000004040000000000000000000000000000"]) r6 = creat(&(0x7f00000000c0)='./file0\x00', 0x0) openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000100)='/group.stat\x00', 0x2761, 0x0) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000080), 0xffffffffffffffff) getpid() fallocate(r0, 0x0, 0x0, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x2f, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) memfd_create(&(0x7f0000000080)='!proccgroup\x00', 0x0) ioctl$sock_inet_SIOCSIFPFLAGS(0xffffffffffffffff, 0x8934, &(0x7f0000000400)={'veth0_to_bridge\x00', 0x100}) accept(r6, &(0x7f0000000580)=@alg, &(0x7f0000000600)=0x80) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x2400, 0x8000) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000008c0)={0x2c, 0x0, &(0x7f0000000780)=[@acquire_done={0x40106309, r5, 0x2}, @clear_death={0x400c630f, 0x1, 0x3}, @release={0x40046306, 0x2}], 0xc1, 0x0, &(0x7f00000007c0)="859547f83b9b058a973a491d7e6378544744f2b56b02270a2f78214a936e9afb25cd94695643af6563f86771aa9621b9f30f2ca538b018247a633c28ee01e03b4639679311117971e60dc1538f34e961ae301463172c41754be988f6beb0ce4d83c69f86c236d29520e6cdaf5dbb60404c66d63315ff287deac8632781d0197ef1f81314da0a1ed90b681842cf85a41b496ce0a7a6f5aa4b9b23483eea8861be89b3398c6aec3349174f9cdc9de34df361ac9bf7afd8566849487c3c0a1e3aaacd"}) 04:02:02 executing program 4: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) recvmsg(0xffffffffffffffff, &(0x7f00000036c0)={&(0x7f0000000180)=@can, 0xfd28, &(0x7f00000035c0), 0x0, &(0x7f0000003680)=""/41, 0x29}, 0x0) bind$alg(r0, &(0x7f0000001300)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb(blowfish)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000ff8000)="0a0775b0", 0x4) r1 = accept$alg(r0, 0x0, 0x0) sendmmsg$alg(r1, &(0x7f0000003e80)=[{0x0, 0x0, &(0x7f0000002a80), 0x167, &(0x7f0000000100)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x0) recvmsg(r1, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, &(0x7f0000fb3fa9)=""/87, 0x57}, 0x0) 04:02:02 executing program 2: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000440)=@updpolicy={0xb8, 0x19, 0x523, 0x0, 0x0, {{@in=@multicast2, @in6=@empty={[0x0, 0x0, 0x0, 0xfffff000]}, 0x0, 0x0, 0x0, 0x0, 0xa}}}, 0xb8}}, 0x0) 04:02:02 executing program 1: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) recvmsg(0xffffffffffffffff, &(0x7f00000036c0)={&(0x7f0000000180)=@can, 0xfd28, &(0x7f00000035c0), 0x0, &(0x7f0000003680)=""/41, 0x29}, 0x0) bind$alg(r0, &(0x7f0000001300)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb(blowfish)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000ff8000)="0a0775b0", 0x4) r1 = accept$alg(r0, 0x0, 0x0) sendmmsg$alg(r1, &(0x7f0000003e80)=[{0x0, 0x0, &(0x7f0000002a80), 0x167, &(0x7f0000000100)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x0) recvmsg(r1, &(0x7f0000000000)={&(0x7f0000f7ffa8)=@alg, 0x80, &(0x7f0000000140)=[{&(0x7f0000000200)=""/4096, 0x1000}], 0x1}, 0x0) [ 636.778542] binder: BINDER_SET_CONTEXT_MGR already set [ 636.783983] binder: 22381:22394 ioctl 40046207 0 returned -16 [ 636.824102] binder: 22381:22394 Release 1 refcount change on invalid ref 1 ret -22 04:02:02 executing program 3: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) recvmsg(0xffffffffffffffff, &(0x7f00000036c0)={&(0x7f0000000180)=@can, 0xfd28, &(0x7f00000035c0), 0x0, &(0x7f0000003680)=""/41, 0x29}, 0x0) bind$alg(r0, &(0x7f0000001300)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb(blowfish)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000ff8000)="0a0775b0", 0x4) r1 = accept$alg(r0, 0x0, 0x0) sendmmsg$alg(r1, &(0x7f0000003e80)=[{0x0, 0x0, &(0x7f0000002a80), 0x167, &(0x7f0000000100)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x0) recvmsg(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)=[{&(0x7f0000000200)=""/4096, 0x1000}], 0x1, &(0x7f0000fb3fa9)=""/87, 0x57}, 0x0) 04:02:02 executing program 2: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000440)=@updpolicy={0xb8, 0x19, 0x523, 0x0, 0x0, {{@in=@multicast2, @in6=@empty={[0x0, 0x0, 0x0, 0xffffff7f]}, 0x0, 0x0, 0x0, 0x0, 0xa}}}, 0xb8}}, 0x0) [ 636.891389] binder: 22381:22404 BC_ACQUIRE_DONE u0000000000000000 no match 04:02:02 executing program 1: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) recvmsg(0xffffffffffffffff, &(0x7f00000036c0)={&(0x7f0000000180)=@can, 0xfd28, &(0x7f00000035c0), 0x0, &(0x7f0000003680)=""/41, 0x29}, 0x0) bind$alg(r0, &(0x7f0000001300)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb(blowfish)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000ff8000)="0a0775b0", 0x4) r1 = accept$alg(r0, 0x0, 0x0) sendmmsg$alg(r1, &(0x7f0000003e80)=[{0x0, 0x0, &(0x7f0000002a80), 0x167, &(0x7f0000000100)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x0) recvmsg(r1, &(0x7f0000000000)={&(0x7f0000f7ffa8)=@alg, 0x80, &(0x7f0000000140)=[{&(0x7f0000000200)=""/4096, 0x1000}], 0x1}, 0x0) [ 636.975064] binder: 22381:22404 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 [ 637.020286] binder: 22381:22404 Release 1 refcount change on invalid ref 2 ret -22 [ 637.442142] binder: release 22381:22394 transaction 387 out, still active 04:02:03 executing program 5: r0 = socket$inet6(0xa, 0x2, 0x0) r1 = syz_open_dev$mice(&(0x7f00000002c0)='/dev/input/mice\x00', 0x0, 0x0) ioctl$PPPOEIOCDFWD(r1, 0xb101, 0x0) syz_genetlink_get_family_id$nbd(&(0x7f0000000480)='nbd\x00') getsockopt$inet6_IPV6_XFRM_POLICY(r0, 0x29, 0x23, &(0x7f0000000340)={{{@in=@local, @in=@loopback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@local}, 0x0, @in=@remote}}, &(0x7f0000000140)=0xe8) connect$can_bcm(0xffffffffffffffff, &(0x7f00000001c0), 0x10) bind$inet6(r0, &(0x7f0000000040)={0xa, 0x4e24}, 0x1c) lsetxattr$security_ima(&(0x7f0000000280)='./file0\x00', &(0x7f0000000440)='security.ima\x00', 0x0, 0x0, 0x1) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clock_gettime(0x0, &(0x7f0000000100)={0x0, 0x0}) r4 = openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) bind(r4, &(0x7f0000000580)=@can={0x1d, r2}, 0x80) clock_gettime(0x3, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff}) ppoll(&(0x7f0000000000)=[{r0, 0x41a}], 0x1, &(0x7f0000000200)={0x0, r3+30000000}, &(0x7f0000000240)={0x8}, 0x8) connect$inet6(r0, &(0x7f0000000080)={0xa, 0x4e24, 0x0, @ipv4={[], [], @loopback}}, 0x1c) readv(0xffffffffffffffff, 0x0, 0x0) sendmmsg(r0, &(0x7f00000092c0), 0x4ff, 0x0) connect$pptp(r5, &(0x7f00000004c0)={0x18, 0x2, {0x0, @multicast1}}, 0x1e) 04:02:03 executing program 3: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) recvmsg(0xffffffffffffffff, &(0x7f00000036c0)={&(0x7f0000000180)=@can, 0xfd28, &(0x7f00000035c0), 0x0, &(0x7f0000003680)=""/41, 0x29}, 0x0) bind$alg(r0, &(0x7f0000001300)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb(blowfish)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000ff8000)="0a0775b0", 0x4) r1 = accept$alg(r0, 0x0, 0x0) sendmmsg$alg(r1, &(0x7f0000003e80)=[{0x0, 0x0, &(0x7f0000002a80), 0x167, &(0x7f0000000100)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x0) recvmsg(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)=[{&(0x7f0000000200)=""/4096, 0x1000}], 0x1, &(0x7f0000fb3fa9)=""/87, 0x57}, 0x0) 04:02:03 executing program 4: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) recvmsg(0xffffffffffffffff, &(0x7f00000036c0)={&(0x7f0000000180)=@can, 0xfd28, &(0x7f00000035c0), 0x0, &(0x7f0000003680)=""/41, 0x29}, 0x0) bind$alg(r0, &(0x7f0000001300)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb(blowfish)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000ff8000)="0a0775b0", 0x4) r1 = accept$alg(r0, 0x0, 0x0) sendmmsg$alg(r1, &(0x7f0000003e80)=[{0x0, 0x0, &(0x7f0000002a80), 0x167, &(0x7f0000000100)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x0) recvmsg(r1, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, &(0x7f0000fb3fa9)=""/87, 0x57}, 0x0) 04:02:03 executing program 2: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000440)=@updpolicy={0xb8, 0x19, 0x523, 0x0, 0x0, {{@in=@multicast2, @in6=@empty={[0x0, 0x0, 0x0, 0xffffff80]}, 0x0, 0x0, 0x0, 0x0, 0xa}}}, 0xb8}}, 0x0) 04:02:03 executing program 1: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) recvmsg(0xffffffffffffffff, &(0x7f00000036c0)={&(0x7f0000000180)=@can, 0xfd28, &(0x7f00000035c0), 0x0, &(0x7f0000003680)=""/41, 0x29}, 0x0) bind$alg(r0, &(0x7f0000001300)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb(blowfish)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000ff8000)="0a0775b0", 0x4) r1 = accept$alg(r0, 0x0, 0x0) sendmmsg$alg(r1, &(0x7f0000003e80)=[{0x0, 0x0, &(0x7f0000002a80), 0x167, &(0x7f0000000100)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x0) recvmsg(r1, &(0x7f0000000000)={&(0x7f0000f7ffa8)=@alg, 0x80, &(0x7f0000000140)=[{&(0x7f0000000200)=""/4096, 0x1000}], 0x1}, 0x0) 04:02:03 executing program 0: r0 = perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) setxattr$security_smack_entry(&(0x7f0000000380)='./file0\x00', &(0x7f0000000480)='security.SMACK64IPIN\x00', &(0x7f0000000540)='^vboxnet1^\x00', 0xb, 0x1) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r1, &(0x7f0000000040), 0x0}, 0x20) unlink(&(0x7f0000000900)='./file0/file0\x00') r2 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r3 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r3, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(0xffffffffffffffff, 0xc018620b, &(0x7f00000006c0)={0x0}) ioctl$BINDER_GET_NODE_DEBUG_INFO(r2, 0xc018620b, &(0x7f0000000640)={r4}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f00000000c0)=[@enter_looper], 0x48, 0x0, &(0x7f0000000700)="2ba063fb309ec7fdbfb08e6e91baee7d7d4599fe14129a4d426834556ae420e087d59c0c7be7fcad1abb7e1f8f446f373f611ca1ee9c2231708e18a47bc68a2a79a0b48931f6ff6d"}) ioctl$BINDER_SET_CONTEXT_MGR(r3, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x1) prctl$PR_SET_NAME(0xf, &(0x7f00000004c0)='/group.stat\x00') ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, &(0x7f0000000780)}) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f0000000680)}) ioctl$FS_IOC_FIEMAP(r3, 0xc020660b, &(0x7f0000000b80)=ANY=[@ANYBLOB="0000010000000000200000000000000005000000010000000a00000000000000ff030000000000001a0a000000000000050000000000000000000000000000000000000000000000080000000000000000000000000000000800000000000000ffff0000000000000100008000000000000000000000000000000000000000000000000000000000000000000000000008000000000000003f0000000000000008000000000000000000000000000000000000000000800800000000000000000000000000000200000000000000000400000000000000000000010000000000000000000000000000000000000002110000000000000000000000000000cc0000000000000000000000000000001b0000000000000000000000000000000000000000000000841400000000000000000000000000000300000000000000feffffffffffffff000000000000000000000000000000000000000000000000020000000000000000000000000000000600000000000000ff01000000000000040000000000000000000000000000000000000000000000000400000000000000000000000000007be70000000000000900000000000000ff7f0000000000000000000000000000000000000000000004180000000000000000000000000000ffffffff0000000081000000000000000600000000000000000000000000000000000000000000000400000000000000000000000000000002000000000000000500000000000000ff7fffffffffffff0000000000000000000000000000000004040000000000000000000000000000"]) r6 = creat(&(0x7f00000000c0)='./file0\x00', 0x0) openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000100)='/group.stat\x00', 0x2761, 0x0) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000080), 0xffffffffffffffff) getpid() fallocate(r0, 0x0, 0x0, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x2f, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) memfd_create(&(0x7f0000000080)='!proccgroup\x00', 0x0) ioctl$sock_inet_SIOCSIFPFLAGS(0xffffffffffffffff, 0x8934, &(0x7f0000000400)={'veth0_to_bridge\x00', 0x100}) accept(r6, &(0x7f0000000580)=@alg, &(0x7f0000000600)=0x80) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x2400, 0x8000) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000008c0)={0x2c, 0x0, &(0x7f0000000780)=[@acquire_done={0x40106309, r5, 0x2}, @clear_death={0x400c630f, 0x1, 0x3}, @release={0x40046306, 0x2}], 0xc1, 0x0, &(0x7f00000007c0)="859547f83b9b058a973a491d7e6378544744f2b56b02270a2f78214a936e9afb25cd94695643af6563f86771aa9621b9f30f2ca538b018247a633c28ee01e03b4639679311117971e60dc1538f34e961ae301463172c41754be988f6beb0ce4d83c69f86c236d29520e6cdaf5dbb60404c66d63315ff287deac8632781d0197ef1f81314da0a1ed90b681842cf85a41b496ce0a7a6f5aa4b9b23483eea8861be89b3398c6aec3349174f9cdc9de34df361ac9bf7afd8566849487c3c0a1e3aaacd"}) 04:02:03 executing program 2: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000440)=@updpolicy={0xb8, 0x19, 0x523, 0x0, 0x0, {{@in=@multicast2, @in6=@empty={[0x0, 0x0, 0x0, 0xffffff9e]}, 0x0, 0x0, 0x0, 0x0, 0xa}}}, 0xb8}}, 0x0) [ 637.685306] net_ratelimit: 20 callbacks suppressed [ 637.685320] protocol 88fb is buggy, dev hsr_slave_0 [ 637.695608] protocol 88fb is buggy, dev hsr_slave_1 [ 637.739158] binder: BINDER_SET_CONTEXT_MGR already set 04:02:03 executing program 3: r0 = socket$inet6(0xa, 0x2, 0x0) r1 = syz_open_dev$mice(&(0x7f00000002c0)='/dev/input/mice\x00', 0x0, 0x0) ioctl$PPPOEIOCDFWD(r1, 0xb101, 0x0) syz_genetlink_get_family_id$nbd(&(0x7f0000000480)='nbd\x00') getsockopt$inet6_IPV6_XFRM_POLICY(r0, 0x29, 0x23, &(0x7f0000000340)={{{@in=@local, @in=@loopback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@local}, 0x0, @in=@remote}}, &(0x7f0000000140)=0xe8) connect$can_bcm(0xffffffffffffffff, &(0x7f00000001c0), 0x10) bind$inet6(r0, &(0x7f0000000040)={0xa, 0x4e24}, 0x1c) lsetxattr$security_ima(&(0x7f0000000280)='./file0\x00', &(0x7f0000000440)='security.ima\x00', 0x0, 0x0, 0x1) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clock_gettime(0x0, &(0x7f0000000100)={0x0, 0x0}) r4 = openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) bind(r4, &(0x7f0000000580)=@can={0x1d, r2}, 0x80) clock_gettime(0x3, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff}) ppoll(&(0x7f0000000000)=[{r0, 0x41a}], 0x1, &(0x7f0000000200)={0x0, r3+30000000}, &(0x7f0000000240)={0x3}, 0x8) connect$inet6(r0, &(0x7f0000000080)={0xa, 0x4e24, 0x0, @ipv4={[], [], @loopback}}, 0x1c) readv(0xffffffffffffffff, 0x0, 0x0) sendmmsg(r0, &(0x7f00000092c0), 0x4ff, 0x0) connect$pptp(r5, &(0x7f00000004c0)={0x18, 0x2, {0x0, @multicast1}}, 0x1e) [ 637.764333] protocol 88fb is buggy, dev hsr_slave_0 [ 637.769457] protocol 88fb is buggy, dev hsr_slave_1 [ 637.774866] protocol 88fb is buggy, dev hsr_slave_0 [ 637.779944] protocol 88fb is buggy, dev hsr_slave_1 [ 637.799476] binder: 22424:22434 ioctl 40046207 0 returned -16 [ 637.800436] binder: 22424:22436 Release 1 refcount change on invalid ref 1 ret -22 04:02:03 executing program 1: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) recvmsg(0xffffffffffffffff, &(0x7f00000036c0)={&(0x7f0000000180)=@can, 0xfd28, &(0x7f00000035c0), 0x0, &(0x7f0000003680)=""/41, 0x29}, 0x0) bind$alg(r0, &(0x7f0000001300)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb(blowfish)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000ff8000)="0a0775b0", 0x4) r1 = accept$alg(r0, 0x0, 0x0) sendmmsg$alg(r1, &(0x7f0000003e80)=[{0x0, 0x0, &(0x7f0000002a80), 0x167, &(0x7f0000000100)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x0) recvmsg(r1, &(0x7f0000000000)={&(0x7f0000f7ffa8)=@alg, 0x80, &(0x7f0000000140)=[{&(0x7f0000000200)=""/4096, 0x1000}], 0x1}, 0x0) 04:02:03 executing program 4: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) recvmsg(0xffffffffffffffff, &(0x7f00000036c0)={&(0x7f0000000180)=@can, 0xfd28, &(0x7f00000035c0), 0x0, &(0x7f0000003680)=""/41, 0x29}, 0x0) bind$alg(r0, &(0x7f0000001300)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb(blowfish)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000ff8000)="0a0775b0", 0x4) r1 = accept$alg(r0, 0x0, 0x0) sendmmsg$alg(r1, &(0x7f0000003e80)=[{0x0, 0x0, &(0x7f0000002a80), 0x167, &(0x7f0000000100)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x0) recvmsg(r1, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, &(0x7f0000fb3fa9)=""/87, 0x57}, 0x0) [ 637.935627] binder: 22424:22434 BC_ACQUIRE_DONE u0000000000000000 no match [ 637.952859] binder: 22424:22434 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 04:02:03 executing program 2: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000440)=@updpolicy={0xb8, 0x19, 0x523, 0x0, 0x0, {{@in=@multicast2, @in6=@empty={[0x0, 0x0, 0x0, 0xfffffff0]}, 0x0, 0x0, 0x0, 0x0, 0xa}}}, 0xb8}}, 0x0) [ 637.995711] binder: 22424:22434 Release 1 refcount change on invalid ref 2 ret -22 04:02:03 executing program 4: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) recvmsg(0xffffffffffffffff, &(0x7f00000036c0)={&(0x7f0000000180)=@can, 0xfd28, &(0x7f00000035c0), 0x0, &(0x7f0000003680)=""/41, 0x29}, 0x0) bind$alg(r0, &(0x7f0000001300)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb(blowfish)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000ff8000)="0a0775b0", 0x4) r1 = accept$alg(r0, 0x0, 0x0) sendmmsg$alg(r1, &(0x7f0000003e80)=[{0x0, 0x0, &(0x7f0000002a80), 0x167, &(0x7f0000000100)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x0) recvmsg(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140), 0x0, &(0x7f0000fb3fa9)=""/87, 0x57}, 0x0) [ 638.484404] binder: release 22424:22436 transaction 390 out, still active 04:02:04 executing program 5: r0 = socket$inet6(0xa, 0x2, 0x0) r1 = syz_open_dev$mice(&(0x7f00000002c0)='/dev/input/mice\x00', 0x0, 0x0) ioctl$PPPOEIOCDFWD(r1, 0xb101, 0x0) syz_genetlink_get_family_id$nbd(&(0x7f0000000480)='nbd\x00') getsockopt$inet6_IPV6_XFRM_POLICY(r0, 0x29, 0x23, &(0x7f0000000340)={{{@in=@local, @in=@loopback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@local}, 0x0, @in=@remote}}, &(0x7f0000000140)=0xe8) connect$can_bcm(0xffffffffffffffff, &(0x7f00000001c0), 0x10) bind$inet6(r0, &(0x7f0000000040)={0xa, 0x4e24}, 0x1c) lsetxattr$security_ima(&(0x7f0000000280)='./file0\x00', &(0x7f0000000440)='security.ima\x00', 0x0, 0x0, 0x1) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clock_gettime(0x0, &(0x7f0000000100)={0x0, 0x0}) r4 = openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) bind(r4, &(0x7f0000000580)=@can={0x1d, r2}, 0x80) clock_gettime(0x3, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff}) ppoll(&(0x7f0000000000)=[{r0, 0x41a}], 0x1, &(0x7f0000000200)={0x0, r3+30000000}, &(0x7f0000000240)={0x64}, 0x8) connect$inet6(r0, &(0x7f0000000080)={0xa, 0x4e24, 0x0, @ipv4={[], [], @loopback}}, 0x1c) readv(0xffffffffffffffff, 0x0, 0x0) sendmmsg(r0, &(0x7f00000092c0), 0x4ff, 0x0) connect$pptp(r5, &(0x7f00000004c0)={0x18, 0x2, {0x0, @multicast1}}, 0x1e) 04:02:04 executing program 1: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) recvmsg(0xffffffffffffffff, &(0x7f00000036c0)={&(0x7f0000000180)=@can, 0xfd28, &(0x7f00000035c0), 0x0, &(0x7f0000003680)=""/41, 0x29}, 0x0) bind$alg(r0, &(0x7f0000001300)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb(blowfish)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000ff8000)="0a0775b0", 0x4) r1 = accept$alg(r0, 0x0, 0x0) sendmmsg$alg(r1, &(0x7f0000003e80)=[{0x0, 0x0, &(0x7f0000002a80), 0x167, &(0x7f0000000100)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x0) recvmsg(r1, &(0x7f0000000000)={&(0x7f0000f7ffa8)=@alg, 0x80, &(0x7f0000000140)=[{&(0x7f0000000200)=""/4096, 0x1000}], 0x1}, 0x0) 04:02:04 executing program 2: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000440)=@updpolicy={0xb8, 0x19, 0x523, 0x0, 0x0, {{@in=@multicast2, @in6=@empty={[0x0, 0x0, 0x0, 0xfffffffc]}, 0x0, 0x0, 0x0, 0x0, 0xa}}}, 0xb8}}, 0x0) 04:02:04 executing program 4: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) recvmsg(0xffffffffffffffff, &(0x7f00000036c0)={&(0x7f0000000180)=@can, 0xfd28, &(0x7f00000035c0), 0x0, &(0x7f0000003680)=""/41, 0x29}, 0x0) bind$alg(r0, &(0x7f0000001300)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb(blowfish)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000ff8000)="0a0775b0", 0x4) r1 = accept$alg(r0, 0x0, 0x0) sendmmsg$alg(r1, &(0x7f0000003e80)=[{0x0, 0x0, &(0x7f0000002a80), 0x167, &(0x7f0000000100)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x0) recvmsg(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140), 0x0, &(0x7f0000fb3fa9)=""/87, 0x57}, 0x0) 04:02:04 executing program 0: r0 = perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) setxattr$security_smack_entry(&(0x7f0000000380)='./file0\x00', &(0x7f0000000480)='security.SMACK64IPIN\x00', &(0x7f0000000540)='^vboxnet1^\x00', 0xb, 0x1) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r1, &(0x7f0000000040), 0x0}, 0x20) unlink(&(0x7f0000000900)='./file0/file0\x00') r2 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r3 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r3, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(0xffffffffffffffff, 0xc018620b, &(0x7f00000006c0)={0x0}) ioctl$BINDER_GET_NODE_DEBUG_INFO(r2, 0xc018620b, &(0x7f0000000640)={r4}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f00000000c0)=[@enter_looper], 0x48, 0x0, &(0x7f0000000700)="2ba063fb309ec7fdbfb08e6e91baee7d7d4599fe14129a4d426834556ae420e087d59c0c7be7fcad1abb7e1f8f446f373f611ca1ee9c2231708e18a47bc68a2a79a0b48931f6ff6d"}) ioctl$BINDER_SET_CONTEXT_MGR(r3, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x1) prctl$PR_SET_NAME(0xf, &(0x7f00000004c0)='/group.stat\x00') ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, &(0x7f0000000780)}) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f0000000680)}) ioctl$FS_IOC_FIEMAP(r3, 0xc020660b, &(0x7f0000000b80)=ANY=[@ANYBLOB="0000010000000000200000000000000005000000010000000a00000000000000ff030000000000001a0a000000000000050000000000000000000000000000000000000000000000080000000000000000000000000000000800000000000000ffff0000000000000100008000000000000000000000000000000000000000000000000000000000000000000000000008000000000000003f0000000000000008000000000000000000000000000000000000000000800800000000000000000000000000000200000000000000000400000000000000000000010000000000000000000000000000000000000002110000000000000000000000000000cc0000000000000000000000000000001b0000000000000000000000000000000000000000000000841400000000000000000000000000000300000000000000feffffffffffffff000000000000000000000000000000000000000000000000020000000000000000000000000000000600000000000000ff01000000000000040000000000000000000000000000000000000000000000000400000000000000000000000000007be70000000000000900000000000000ff7f0000000000000000000000000000000000000000000004180000000000000000000000000000ffffffff0000000081000000000000000600000000000000000000000000000000000000000000000400000000000000000000000000000002000000000000000500000000000000ff7fffffffffffff0000000000000000000000000000000004040000000000000000000000000000"]) r6 = creat(&(0x7f00000000c0)='./file0\x00', 0x0) openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000100)='/group.stat\x00', 0x2761, 0x0) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000080), 0xffffffffffffffff) getpid() fallocate(r0, 0x0, 0x0, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x2f, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) memfd_create(&(0x7f0000000080)='!proccgroup\x00', 0x0) ioctl$sock_inet_SIOCSIFPFLAGS(0xffffffffffffffff, 0x8934, &(0x7f0000000400)={'veth0_to_bridge\x00', 0x100}) accept(r6, &(0x7f0000000580)=@alg, &(0x7f0000000600)=0x80) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x2400, 0x8000) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000008c0)={0x2c, 0x0, &(0x7f0000000780)=[@acquire_done={0x40106309, r5, 0x2}, @clear_death={0x400c630f, 0x1, 0x3}, @release={0x40046306, 0x2}], 0xc1, 0x0, &(0x7f00000007c0)="859547f83b9b058a973a491d7e6378544744f2b56b02270a2f78214a936e9afb25cd94695643af6563f86771aa9621b9f30f2ca538b018247a633c28ee01e03b4639679311117971e60dc1538f34e961ae301463172c41754be988f6beb0ce4d83c69f86c236d29520e6cdaf5dbb60404c66d63315ff287deac8632781d0197ef1f81314da0a1ed90b681842cf85a41b496ce0a7a6f5aa4b9b23483eea8861be89b3398c6aec3349174f9cdc9de34df361ac9bf7afd8566849487c3c0a1e3aaacd"}) [ 638.724642] protocol 88fb is buggy, dev hsr_slave_0 [ 638.729870] protocol 88fb is buggy, dev hsr_slave_1 [ 638.735165] protocol 88fb is buggy, dev hsr_slave_0 [ 638.740378] protocol 88fb is buggy, dev hsr_slave_1 04:02:04 executing program 4: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) recvmsg(0xffffffffffffffff, &(0x7f00000036c0)={&(0x7f0000000180)=@can, 0xfd28, &(0x7f00000035c0), 0x0, &(0x7f0000003680)=""/41, 0x29}, 0x0) bind$alg(r0, &(0x7f0000001300)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb(blowfish)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000ff8000)="0a0775b0", 0x4) r1 = accept$alg(r0, 0x0, 0x0) sendmmsg$alg(r1, &(0x7f0000003e80)=[{0x0, 0x0, &(0x7f0000002a80), 0x167, &(0x7f0000000100)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x0) recvmsg(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140), 0x0, &(0x7f0000fb3fa9)=""/87, 0x57}, 0x0) 04:02:04 executing program 2: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000440)=@updpolicy={0xb8, 0x19, 0x523, 0x0, 0x0, {{@in=@multicast2, @in6=@empty={[0x0, 0x0, 0x0, 0xf0ffffffffffff]}, 0x0, 0x0, 0x0, 0x0, 0xa}}}, 0xb8}}, 0x0) [ 638.871625] binder: BINDER_SET_CONTEXT_MGR already set 04:02:04 executing program 3: r0 = socket$inet6(0xa, 0x2, 0x0) r1 = syz_open_dev$mice(&(0x7f00000002c0)='/dev/input/mice\x00', 0x0, 0x0) ioctl$PPPOEIOCDFWD(r1, 0xb101, 0x0) syz_genetlink_get_family_id$nbd(&(0x7f0000000480)='nbd\x00') getsockopt$inet6_IPV6_XFRM_POLICY(r0, 0x29, 0x23, &(0x7f0000000340)={{{@in=@local, @in=@loopback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@local}, 0x0, @in=@remote}}, &(0x7f0000000140)=0xe8) connect$can_bcm(0xffffffffffffffff, &(0x7f00000001c0), 0x10) bind$inet6(r0, &(0x7f0000000040)={0xa, 0x4e24}, 0x1c) lsetxattr$security_ima(&(0x7f0000000280)='./file0\x00', &(0x7f0000000440)='security.ima\x00', 0x0, 0x0, 0x1) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clock_gettime(0x0, &(0x7f0000000100)={0x0, 0x0}) r4 = openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) bind(r4, &(0x7f0000000580)=@can={0x1d, r2}, 0x80) clock_gettime(0x3, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff}) ppoll(&(0x7f0000000000)=[{r0, 0x41a}], 0x1, &(0x7f0000000200)={0x0, r3+30000000}, &(0x7f0000000240)={0x3}, 0x8) connect$inet6(r0, &(0x7f0000000080)={0xa, 0x4e24, 0x0, @ipv4={[], [], @loopback}}, 0x1c) readv(0xffffffffffffffff, 0x0, 0x0) sendmmsg(r0, &(0x7f00000092c0), 0x4ff, 0x0) connect$pptp(r5, &(0x7f00000004c0)={0x18, 0x2, {0x0, @multicast1}}, 0x1e) [ 638.899877] binder: 22463:22469 ioctl 40046207 0 returned -16 [ 638.918210] binder: 22463:22474 Release 1 refcount change on invalid ref 1 ret -22 04:02:04 executing program 1: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) recvmsg(0xffffffffffffffff, &(0x7f00000036c0)={&(0x7f0000000180)=@can, 0xfd28, &(0x7f00000035c0), 0x0, &(0x7f0000003680)=""/41, 0x29}, 0x0) bind$alg(r0, &(0x7f0000001300)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb(blowfish)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000ff8000)="0a0775b0", 0x4) r1 = accept$alg(r0, 0x0, 0x0) sendmmsg$alg(r1, &(0x7f0000003e80)=[{0x0, 0x0, &(0x7f0000002a80), 0x167, &(0x7f0000000100)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x0) recvmsg(r1, &(0x7f0000000000)={&(0x7f0000f7ffa8)=@alg, 0x80, &(0x7f0000000140)=[{&(0x7f0000000200)=""/4096, 0x1000}], 0x1}, 0x0) 04:02:04 executing program 4: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) recvmsg(0xffffffffffffffff, &(0x7f00000036c0)={&(0x7f0000000180)=@can, 0xfd28, &(0x7f00000035c0), 0x0, &(0x7f0000003680)=""/41, 0x29}, 0x0) bind$alg(r0, &(0x7f0000001300)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb(blowfish)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000ff8000)="0a0775b0", 0x4) r1 = accept$alg(r0, 0x0, 0x0) sendmmsg$alg(r1, &(0x7f0000003e80)=[{0x0, 0x0, &(0x7f0000002a80), 0x167, &(0x7f0000000100)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x0) recvmsg(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)=[{0x0}], 0x1, &(0x7f0000fb3fa9)=""/87, 0x57}, 0x0) 04:02:04 executing program 2: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000440)=@updpolicy={0xb8, 0x19, 0x523, 0x0, 0x0, {{@in=@multicast2, @in6=@empty={[0x0, 0x0, 0x0, 0x100000000000000]}, 0x0, 0x0, 0x0, 0x0, 0xa}}}, 0xb8}}, 0x0) [ 639.057389] binder: 22463:22469 BC_ACQUIRE_DONE u0000000000000000 no match [ 639.101155] binder: 22463:22469 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 04:02:05 executing program 1: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) recvmsg(0xffffffffffffffff, &(0x7f00000036c0)={&(0x7f0000000180)=@can, 0xfd28, &(0x7f00000035c0), 0x0, &(0x7f0000003680)=""/41, 0x29}, 0x0) bind$alg(r0, &(0x7f0000001300)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb(blowfish)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000ff8000)="0a0775b0", 0x4) r1 = accept$alg(r0, 0x0, 0x0) sendmmsg$alg(r1, &(0x7f0000003e80)=[{0x0, 0x0, &(0x7f0000002a80), 0x167, &(0x7f0000000100)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x0) recvmsg(r1, &(0x7f0000000000)={&(0x7f0000f7ffa8)=@alg, 0x80, &(0x7f0000000140)=[{&(0x7f0000000200)=""/4096, 0x1000}], 0x1}, 0x0) [ 639.551152] binder: release 22463:22474 transaction 393 out, still active 04:02:05 executing program 5: r0 = socket$inet6(0xa, 0x2, 0x0) r1 = syz_open_dev$mice(&(0x7f00000002c0)='/dev/input/mice\x00', 0x0, 0x0) ioctl$PPPOEIOCDFWD(r1, 0xb101, 0x0) syz_genetlink_get_family_id$nbd(&(0x7f0000000480)='nbd\x00') getsockopt$inet6_IPV6_XFRM_POLICY(r0, 0x29, 0x23, &(0x7f0000000340)={{{@in=@local, @in=@loopback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@local}, 0x0, @in=@remote}}, &(0x7f0000000140)=0xe8) connect$can_bcm(0xffffffffffffffff, &(0x7f00000001c0), 0x10) bind$inet6(r0, &(0x7f0000000040)={0xa, 0x4e24}, 0x1c) lsetxattr$security_ima(&(0x7f0000000280)='./file0\x00', &(0x7f0000000440)='security.ima\x00', 0x0, 0x0, 0x1) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clock_gettime(0x0, &(0x7f0000000100)={0x0, 0x0}) r4 = openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) bind(r4, &(0x7f0000000580)=@can={0x1d, r2}, 0x80) clock_gettime(0x3, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff}) ppoll(&(0x7f0000000000)=[{r0, 0x41a}], 0x1, &(0x7f0000000200)={0x0, r3+30000000}, &(0x7f0000000240)={0x259}, 0x8) connect$inet6(r0, &(0x7f0000000080)={0xa, 0x4e24, 0x0, @ipv4={[], [], @loopback}}, 0x1c) readv(0xffffffffffffffff, 0x0, 0x0) sendmmsg(r0, &(0x7f00000092c0), 0x4ff, 0x0) connect$pptp(r5, &(0x7f00000004c0)={0x18, 0x2, {0x0, @multicast1}}, 0x1e) 04:02:05 executing program 2: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000440)=@updpolicy={0xb8, 0x19, 0x523, 0x0, 0x0, {{@in=@multicast2, @in6=@empty={[0x0, 0x0, 0x0, 0x200000000000000]}, 0x0, 0x0, 0x0, 0x0, 0xa}}}, 0xb8}}, 0x0) 04:02:05 executing program 4: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) recvmsg(0xffffffffffffffff, &(0x7f00000036c0)={&(0x7f0000000180)=@can, 0xfd28, &(0x7f00000035c0), 0x0, &(0x7f0000003680)=""/41, 0x29}, 0x0) bind$alg(r0, &(0x7f0000001300)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb(blowfish)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000ff8000)="0a0775b0", 0x4) r1 = accept$alg(r0, 0x0, 0x0) sendmmsg$alg(r1, &(0x7f0000003e80)=[{0x0, 0x0, &(0x7f0000002a80), 0x167, &(0x7f0000000100)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x0) recvmsg(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)=[{0x0}], 0x1, &(0x7f0000fb3fa9)=""/87, 0x57}, 0x0) 04:02:05 executing program 0: r0 = perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) setxattr$security_smack_entry(&(0x7f0000000380)='./file0\x00', &(0x7f0000000480)='security.SMACK64IPIN\x00', &(0x7f0000000540)='^vboxnet1^\x00', 0xb, 0x1) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r1, &(0x7f0000000040), 0x0}, 0x20) unlink(&(0x7f0000000900)='./file0/file0\x00') r2 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r3 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r3, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r2, 0xc018620b, &(0x7f0000000640)={0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f00000000c0)=[@enter_looper], 0x48, 0x0, &(0x7f0000000700)="2ba063fb309ec7fdbfb08e6e91baee7d7d4599fe14129a4d426834556ae420e087d59c0c7be7fcad1abb7e1f8f446f373f611ca1ee9c2231708e18a47bc68a2a79a0b48931f6ff6d"}) ioctl$BINDER_SET_CONTEXT_MGR(r3, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x1) prctl$PR_SET_NAME(0xf, &(0x7f00000004c0)='/group.stat\x00') ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, &(0x7f0000000780)}) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f0000000680)}) ioctl$FS_IOC_FIEMAP(r3, 0xc020660b, &(0x7f0000000b80)=ANY=[@ANYBLOB="0000010000000000200000000000000005000000010000000a00000000000000ff030000000000001a0a000000000000050000000000000000000000000000000000000000000000080000000000000000000000000000000800000000000000ffff0000000000000100008000000000000000000000000000000000000000000000000000000000000000000000000008000000000000003f0000000000000008000000000000000000000000000000000000000000800800000000000000000000000000000200000000000000000400000000000000000000010000000000000000000000000000000000000002110000000000000000000000000000cc0000000000000000000000000000001b0000000000000000000000000000000000000000000000841400000000000000000000000000000300000000000000feffffffffffffff000000000000000000000000000000000000000000000000020000000000000000000000000000000600000000000000ff01000000000000040000000000000000000000000000000000000000000000000400000000000000000000000000007be70000000000000900000000000000ff7f0000000000000000000000000000000000000000000004180000000000000000000000000000ffffffff0000000081000000000000000600000000000000000000000000000000000000000000000400000000000000000000000000000002000000000000000500000000000000ff7fffffffffffff0000000000000000000000000000000004040000000000000000000000000000"]) r5 = creat(&(0x7f00000000c0)='./file0\x00', 0x0) openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000100)='/group.stat\x00', 0x2761, 0x0) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000080), 0xffffffffffffffff) getpid() fallocate(r0, 0x0, 0x0, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x2f, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) memfd_create(&(0x7f0000000080)='!proccgroup\x00', 0x0) ioctl$sock_inet_SIOCSIFPFLAGS(0xffffffffffffffff, 0x8934, &(0x7f0000000400)={'veth0_to_bridge\x00', 0x100}) accept(r5, &(0x7f0000000580)=@alg, &(0x7f0000000600)=0x80) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x2400, 0x8000) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000008c0)={0x2c, 0x0, &(0x7f0000000780)=[@acquire_done={0x40106309, r4, 0x2}, @clear_death={0x400c630f, 0x1, 0x3}, @release={0x40046306, 0x2}], 0xc1, 0x0, &(0x7f00000007c0)="859547f83b9b058a973a491d7e6378544744f2b56b02270a2f78214a936e9afb25cd94695643af6563f86771aa9621b9f30f2ca538b018247a633c28ee01e03b4639679311117971e60dc1538f34e961ae301463172c41754be988f6beb0ce4d83c69f86c236d29520e6cdaf5dbb60404c66d63315ff287deac8632781d0197ef1f81314da0a1ed90b681842cf85a41b496ce0a7a6f5aa4b9b23483eea8861be89b3398c6aec3349174f9cdc9de34df361ac9bf7afd8566849487c3c0a1e3aaacd"}) 04:02:05 executing program 1: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) recvmsg(0xffffffffffffffff, &(0x7f00000036c0)={&(0x7f0000000180)=@can, 0xfd28, &(0x7f00000035c0), 0x0, &(0x7f0000003680)=""/41, 0x29}, 0x0) bind$alg(r0, &(0x7f0000001300)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb(blowfish)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000ff8000)="0a0775b0", 0x4) r1 = accept$alg(r0, 0x0, 0x0) sendmmsg$alg(r1, &(0x7f0000003e80)=[{0x0, 0x0, &(0x7f0000002a80), 0x167, &(0x7f0000000100)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x0) recvmsg(r1, &(0x7f0000000000)={&(0x7f0000f7ffa8)=@alg, 0x80, &(0x7f0000000140)=[{&(0x7f0000000200)=""/4096, 0x1000}], 0x1}, 0x0) 04:02:05 executing program 4: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) recvmsg(0xffffffffffffffff, &(0x7f00000036c0)={&(0x7f0000000180)=@can, 0xfd28, &(0x7f00000035c0), 0x0, &(0x7f0000003680)=""/41, 0x29}, 0x0) bind$alg(r0, &(0x7f0000001300)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb(blowfish)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000ff8000)="0a0775b0", 0x4) r1 = accept$alg(r0, 0x0, 0x0) sendmmsg$alg(r1, &(0x7f0000003e80)=[{0x0, 0x0, &(0x7f0000002a80), 0x167, &(0x7f0000000100)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x0) recvmsg(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)=[{0x0}], 0x1, &(0x7f0000fb3fa9)=""/87, 0x57}, 0x0) 04:02:05 executing program 2: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000440)=@updpolicy={0xb8, 0x19, 0x523, 0x0, 0x0, {{@in=@multicast2, @in6=@empty={[0x0, 0x0, 0x0, 0x300000000000000]}, 0x0, 0x0, 0x0, 0x0, 0xa}}}, 0xb8}}, 0x0) [ 639.998230] binder: BINDER_SET_CONTEXT_MGR already set [ 640.008288] binder: 22509:22517 ioctl 40046207 0 returned -16 04:02:05 executing program 2: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000440)=@updpolicy={0xb8, 0x19, 0x523, 0x0, 0x0, {{@in=@multicast2, @in6=@empty={[0x0, 0x0, 0x0, 0x400000000000000]}, 0x0, 0x0, 0x0, 0x0, 0xa}}}, 0xb8}}, 0x0) 04:02:05 executing program 3: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) recvmsg(0xffffffffffffffff, &(0x7f00000036c0)={&(0x7f0000000180)=@can, 0xfd28, &(0x7f00000035c0), 0x0, &(0x7f0000003680)=""/41, 0x29}, 0x0) bind$alg(r0, &(0x7f0000001300)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb(blowfish)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000ff8000)="0a0775b0", 0x4) r1 = accept$alg(r0, 0x0, 0x0) sendmmsg$alg(r1, &(0x7f0000003e80)=[{0x0, 0x0, &(0x7f0000002a80), 0x167, &(0x7f0000000100)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x0) recvmsg(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)=[{0x0}], 0x1, &(0x7f0000fb3fa9)=""/87, 0x57}, 0x0) 04:02:05 executing program 1: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) recvmsg(0xffffffffffffffff, &(0x7f00000036c0)={&(0x7f0000000180)=@can, 0xfd28, &(0x7f00000035c0), 0x0, &(0x7f0000003680)=""/41, 0x29}, 0x0) bind$alg(r0, &(0x7f0000001300)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb(blowfish)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000ff8000)="0a0775b0", 0x4) r1 = accept$alg(r0, 0x0, 0x0) sendmmsg$alg(r1, &(0x7f0000003e80)=[{0x0, 0x0, &(0x7f0000002a80), 0x167, &(0x7f0000000100)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x0) recvmsg(r1, &(0x7f0000000000)={&(0x7f0000f7ffa8)=@alg, 0x80, &(0x7f0000000140)=[{&(0x7f0000000200)=""/4096, 0x1000}], 0x1}, 0x0) [ 640.038670] binder_thread_write: 1 callbacks suppressed [ 640.038684] binder: 22509:22517 Release 1 refcount change on invalid ref 1 ret -22 04:02:05 executing program 4: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) recvmsg(0xffffffffffffffff, &(0x7f00000036c0)={&(0x7f0000000180)=@can, 0xfd28, &(0x7f00000035c0), 0x0, &(0x7f0000003680)=""/41, 0x29}, 0x0) bind$alg(r0, &(0x7f0000001300)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb(blowfish)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000ff8000)="0a0775b0", 0x4) r1 = accept$alg(r0, 0x0, 0x0) sendmmsg$alg(r1, &(0x7f0000003e80)=[{0x0, 0x0, &(0x7f0000002a80), 0x167, &(0x7f0000000100)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x0) recvmsg(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)=[{&(0x7f0000000200)=""/4096, 0x1000}], 0x1}, 0x0) [ 640.151952] binder: 22509:22530 BC_ACQUIRE_DONE u0000000000000000 no match 04:02:05 executing program 1: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) recvmsg(0xffffffffffffffff, &(0x7f00000036c0)={&(0x7f0000000180)=@can, 0xfd28, &(0x7f00000035c0), 0x0, &(0x7f0000003680)=""/41, 0x29}, 0x0) bind$alg(r0, &(0x7f0000001300)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb(blowfish)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000ff8000)="0a0775b0", 0x4) r1 = accept$alg(r0, 0x0, 0x0) sendmmsg$alg(r1, &(0x7f0000003e80)=[{0x0, 0x0, &(0x7f0000002a80), 0x167, &(0x7f0000000100)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x0) recvmsg(r1, &(0x7f0000000000)={&(0x7f0000f7ffa8)=@alg, 0x80, &(0x7f0000000140)=[{&(0x7f0000000200)=""/4096, 0x1000}], 0x1}, 0x0) [ 640.192707] binder: 22509:22530 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 [ 640.230085] binder: 22509:22530 Release 1 refcount change on invalid ref 2 ret -22 [ 640.724067] binder: release 22509:22517 transaction 396 out, still active 04:02:06 executing program 2: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000440)=@updpolicy={0xb8, 0x19, 0x523, 0x0, 0x0, {{@in=@multicast2, @in6=@empty={[0x0, 0x0, 0x0, 0x800000000000000]}, 0x0, 0x0, 0x0, 0x0, 0xa}}}, 0xb8}}, 0x0) 04:02:06 executing program 3: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000440)=@updpolicy={0xb8, 0x19, 0x523, 0x0, 0x0, {{@in=@multicast2, @in6=@empty={[0x0, 0x0, 0x0, 0x100000000000000]}, 0x0, 0x0, 0x0, 0x0, 0xa}}}, 0xb8}}, 0x0) 04:02:06 executing program 4: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) recvmsg(0xffffffffffffffff, &(0x7f00000036c0)={&(0x7f0000000180)=@can, 0xfd28, &(0x7f00000035c0), 0x0, &(0x7f0000003680)=""/41, 0x29}, 0x0) bind$alg(r0, &(0x7f0000001300)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb(blowfish)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000ff8000)="0a0775b0", 0x4) r1 = accept$alg(r0, 0x0, 0x0) sendmmsg$alg(r1, &(0x7f0000003e80)=[{0x0, 0x0, &(0x7f0000002a80), 0x167, &(0x7f0000000100)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x0) recvmsg(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)=[{&(0x7f0000000200)=""/4096, 0x1000}], 0x1}, 0x0) 04:02:06 executing program 1: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) recvmsg(0xffffffffffffffff, &(0x7f00000036c0)={&(0x7f0000000180)=@can, 0xfd28, &(0x7f00000035c0), 0x0, &(0x7f0000003680)=""/41, 0x29}, 0x0) bind$alg(r0, &(0x7f0000001300)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb(blowfish)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000ff8000)="0a0775b0", 0x4) r1 = accept$alg(r0, 0x0, 0x0) sendmmsg$alg(r1, &(0x7f0000003e80)=[{0x0, 0x0, &(0x7f0000002a80), 0x167, &(0x7f0000000100)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x0) recvmsg(r1, &(0x7f0000000000)={&(0x7f0000f7ffa8)=@alg, 0x80, &(0x7f0000000140)=[{&(0x7f0000000200)=""/4096, 0x1000}], 0x1}, 0x0) 04:02:06 executing program 5: r0 = socket$inet6(0xa, 0x2, 0x0) r1 = syz_open_dev$mice(&(0x7f00000002c0)='/dev/input/mice\x00', 0x0, 0x0) ioctl$PPPOEIOCDFWD(r1, 0xb101, 0x0) syz_genetlink_get_family_id$nbd(&(0x7f0000000480)='nbd\x00') getsockopt$inet6_IPV6_XFRM_POLICY(r0, 0x29, 0x23, &(0x7f0000000340)={{{@in=@local, @in=@loopback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@local}, 0x0, @in=@remote}}, &(0x7f0000000140)=0xe8) connect$can_bcm(0xffffffffffffffff, &(0x7f00000001c0), 0x10) bind$inet6(r0, &(0x7f0000000040)={0xa, 0x4e24}, 0x1c) lsetxattr$security_ima(&(0x7f0000000280)='./file0\x00', &(0x7f0000000440)='security.ima\x00', 0x0, 0x0, 0x1) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clock_gettime(0x0, &(0x7f0000000100)={0x0, 0x0}) r4 = openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) bind(r4, &(0x7f0000000580)=@can={0x1d, r2}, 0x80) clock_gettime(0x3, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff}) ppoll(&(0x7f0000000000)=[{r0, 0x41a}], 0x1, &(0x7f0000000200)={0x0, r3+30000000}, &(0x7f0000000240)={0x300}, 0x8) connect$inet6(r0, &(0x7f0000000080)={0xa, 0x4e24, 0x0, @ipv4={[], [], @loopback}}, 0x1c) readv(0xffffffffffffffff, 0x0, 0x0) sendmmsg(r0, &(0x7f00000092c0), 0x4ff, 0x0) connect$pptp(r5, &(0x7f00000004c0)={0x18, 0x2, {0x0, @multicast1}}, 0x1e) 04:02:06 executing program 0: r0 = perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) setxattr$security_smack_entry(&(0x7f0000000380)='./file0\x00', &(0x7f0000000480)='security.SMACK64IPIN\x00', &(0x7f0000000540)='^vboxnet1^\x00', 0xb, 0x1) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r1, &(0x7f0000000040), 0x0}, 0x20) unlink(&(0x7f0000000900)='./file0/file0\x00') r2 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r3 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r3, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r2, 0xc018620b, &(0x7f0000000640)={0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f00000000c0)=[@enter_looper], 0x48, 0x0, &(0x7f0000000700)="2ba063fb309ec7fdbfb08e6e91baee7d7d4599fe14129a4d426834556ae420e087d59c0c7be7fcad1abb7e1f8f446f373f611ca1ee9c2231708e18a47bc68a2a79a0b48931f6ff6d"}) ioctl$BINDER_SET_CONTEXT_MGR(r3, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x1) prctl$PR_SET_NAME(0xf, &(0x7f00000004c0)='/group.stat\x00') ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, &(0x7f0000000780)}) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f0000000680)}) ioctl$FS_IOC_FIEMAP(r3, 0xc020660b, &(0x7f0000000b80)=ANY=[@ANYBLOB="0000010000000000200000000000000005000000010000000a00000000000000ff030000000000001a0a000000000000050000000000000000000000000000000000000000000000080000000000000000000000000000000800000000000000ffff0000000000000100008000000000000000000000000000000000000000000000000000000000000000000000000008000000000000003f0000000000000008000000000000000000000000000000000000000000800800000000000000000000000000000200000000000000000400000000000000000000010000000000000000000000000000000000000002110000000000000000000000000000cc0000000000000000000000000000001b0000000000000000000000000000000000000000000000841400000000000000000000000000000300000000000000feffffffffffffff000000000000000000000000000000000000000000000000020000000000000000000000000000000600000000000000ff01000000000000040000000000000000000000000000000000000000000000000400000000000000000000000000007be70000000000000900000000000000ff7f0000000000000000000000000000000000000000000004180000000000000000000000000000ffffffff0000000081000000000000000600000000000000000000000000000000000000000000000400000000000000000000000000000002000000000000000500000000000000ff7fffffffffffff0000000000000000000000000000000004040000000000000000000000000000"]) r5 = creat(&(0x7f00000000c0)='./file0\x00', 0x0) openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000100)='/group.stat\x00', 0x2761, 0x0) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000080), 0xffffffffffffffff) getpid() fallocate(r0, 0x0, 0x0, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x2f, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) memfd_create(&(0x7f0000000080)='!proccgroup\x00', 0x0) ioctl$sock_inet_SIOCSIFPFLAGS(0xffffffffffffffff, 0x8934, &(0x7f0000000400)={'veth0_to_bridge\x00', 0x100}) accept(r5, &(0x7f0000000580)=@alg, &(0x7f0000000600)=0x80) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x2400, 0x8000) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000008c0)={0x2c, 0x0, &(0x7f0000000780)=[@acquire_done={0x40106309, r4, 0x2}, @clear_death={0x400c630f, 0x1, 0x3}, @release={0x40046306, 0x2}], 0xc1, 0x0, &(0x7f00000007c0)="859547f83b9b058a973a491d7e6378544744f2b56b02270a2f78214a936e9afb25cd94695643af6563f86771aa9621b9f30f2ca538b018247a633c28ee01e03b4639679311117971e60dc1538f34e961ae301463172c41754be988f6beb0ce4d83c69f86c236d29520e6cdaf5dbb60404c66d63315ff287deac8632781d0197ef1f81314da0a1ed90b681842cf85a41b496ce0a7a6f5aa4b9b23483eea8861be89b3398c6aec3349174f9cdc9de34df361ac9bf7afd8566849487c3c0a1e3aaacd"}) 04:02:06 executing program 2: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000440)=@updpolicy={0xb8, 0x19, 0x523, 0x0, 0x0, {{@in=@multicast2, @in6=@empty={[0x0, 0x0, 0x0, 0xa00000000000000]}, 0x0, 0x0, 0x0, 0x0, 0xa}}}, 0xb8}}, 0x0) 04:02:06 executing program 3: r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000280)={0xe, 0x4, 0x100000004, 0x4, 0x0, 0xffffffffffffff9c}, 0x2c) r1 = openat$qat_adf_ctl(0xffffffffffffff9c, &(0x7f0000000180)='/dev/qat_adf_ctl\x00', 0x1, 0x0) bpf$MAP_DELETE_ELEM(0x3, &(0x7f0000000080)={r0}, 0x10) ioctl$KVM_GET_REGS(r1, 0x8090ae81, &(0x7f00000000c0)) 04:02:06 executing program 4: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) recvmsg(0xffffffffffffffff, &(0x7f00000036c0)={&(0x7f0000000180)=@can, 0xfd28, &(0x7f00000035c0), 0x0, &(0x7f0000003680)=""/41, 0x29}, 0x0) bind$alg(r0, &(0x7f0000001300)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb(blowfish)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000ff8000)="0a0775b0", 0x4) r1 = accept$alg(r0, 0x0, 0x0) sendmmsg$alg(r1, &(0x7f0000003e80)=[{0x0, 0x0, &(0x7f0000002a80), 0x167, &(0x7f0000000100)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x0) recvmsg(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)=[{&(0x7f0000000200)=""/4096, 0x1000}], 0x1}, 0x0) 04:02:06 executing program 1: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) recvmsg(0xffffffffffffffff, &(0x7f00000036c0)={&(0x7f0000000180)=@can, 0xfd28, &(0x7f00000035c0), 0x0, &(0x7f0000003680)=""/41, 0x29}, 0x0) bind$alg(r0, &(0x7f0000001300)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb(blowfish)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000ff8000)="0a0775b0", 0x4) r1 = accept$alg(r0, 0x0, 0x0) sendmmsg$alg(r1, &(0x7f0000003e80)=[{0x0, 0x0, &(0x7f0000002a80), 0x167, &(0x7f0000000100)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x0) recvmsg(r1, &(0x7f0000000000)={&(0x7f0000f7ffa8)=@alg, 0x80, &(0x7f0000000140)=[{&(0x7f0000000200)=""/4096, 0xe00}], 0x1}, 0x0) [ 641.132633] binder: BINDER_SET_CONTEXT_MGR already set [ 641.147056] QAT: Invalid ioctl [ 641.151653] binder: 22546:22567 ioctl 40046207 0 returned -16 [ 641.169824] QAT: Invalid ioctl 04:02:06 executing program 4 (fault-call:7 fault-nth:0): perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) recvmsg(0xffffffffffffffff, &(0x7f00000036c0)={&(0x7f0000000180)=@can, 0xfd28, &(0x7f00000035c0), 0x0, &(0x7f0000003680)=""/41, 0x29}, 0x0) bind$alg(r0, &(0x7f0000001300)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb(blowfish)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000ff8000)="0a0775b0", 0x4) r1 = accept$alg(r0, 0x0, 0x0) sendmmsg$alg(r1, &(0x7f0000003e80)=[{0x0, 0x0, &(0x7f0000002a80), 0x167, &(0x7f0000000100)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x0) recvmsg(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)=[{&(0x7f0000000200)=""/4096, 0x1000}], 0x1, &(0x7f0000fb3fa9)=""/87, 0x57}, 0x0) [ 641.179058] binder: 22546:22567 Release 1 refcount change on invalid ref 1 ret -22 04:02:06 executing program 2: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000440)=@updpolicy={0xb8, 0x19, 0x523, 0x0, 0x0, {{@in=@multicast2, @in6=@empty={[0x0, 0x0, 0x0, 0xe00000000000000]}, 0x0, 0x0, 0x0, 0x0, 0xa}}}, 0xb8}}, 0x0) 04:02:06 executing program 3: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f0000000040)='reno\x00', 0x5) r1 = syz_open_dev$mice(&(0x7f00000000c0)='/dev/input/mice\x00', 0x0, 0x105080) setsockopt$inet_sctp_SCTP_INITMSG(r1, 0x84, 0x2, &(0x7f0000000100)={0x282db9cf, 0x3, 0x1, 0x61}, 0x8) ioctl$SIOCRSGCAUSE(r0, 0x89e0, &(0x7f0000000000)) sendto$inet(r0, 0x0, 0x0, 0x20000000, &(0x7f0000000080), 0x10) [ 641.243382] binder: 22546:22573 BC_ACQUIRE_DONE u0000000000000000 no match [ 641.274491] binder: 22546:22573 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 04:02:07 executing program 1: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) recvmsg(0xffffffffffffffff, &(0x7f00000036c0)={&(0x7f0000000180)=@can, 0xfd28, &(0x7f00000035c0), 0x0, &(0x7f0000003680)=""/41, 0x29}, 0x0) bind$alg(r0, &(0x7f0000001300)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb(blowfish)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000ff8000)="0a0775b0", 0x4) r1 = accept$alg(r0, 0x0, 0x0) sendmmsg$alg(r1, &(0x7f0000003e80)=[{0x0, 0x0, &(0x7f0000002a80), 0x167, &(0x7f0000000100)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x0) recvmsg(r1, &(0x7f0000000000)={&(0x7f0000f7ffa8)=@alg, 0x80, &(0x7f0000000140)=[{&(0x7f0000000200)=""/4096, 0x1007}], 0x1}, 0x0) [ 641.300428] binder: 22546:22573 Release 1 refcount change on invalid ref 2 ret -22 04:02:07 executing program 4: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) recvmsg(0xffffffffffffffff, &(0x7f00000036c0)={&(0x7f0000000180)=@can, 0xfd28, &(0x7f00000035c0), 0x0, &(0x7f0000003680)=""/41, 0x29}, 0x0) bind$alg(r0, &(0x7f0000001300)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb(blowfish)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000ff8000)="0a0775b0", 0x4) r1 = accept$alg(r0, 0x0, 0x0) sendmmsg$alg(r1, &(0x7f0000003e80)=[{0x0, 0x0, &(0x7f0000002a80), 0x167, &(0x7f0000000100)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x0) recvmsg(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)=[{&(0x7f0000000200)=""/4096, 0x1000}], 0x1, &(0x7f0000fb3fa9)=""/87, 0x57}, 0x0) 04:02:07 executing program 2: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000440)=@updpolicy={0xb8, 0x19, 0x523, 0x0, 0x0, {{@in=@multicast2, @in6=@empty={[0x0, 0x0, 0x0, 0xf00000000000000]}, 0x0, 0x0, 0x0, 0x0, 0xa}}}, 0xb8}}, 0x0) [ 641.821940] binder: release 22546:22567 transaction 399 out, still active 04:02:07 executing program 5: r0 = socket$inet6(0xa, 0x2, 0x0) r1 = syz_open_dev$mice(&(0x7f00000002c0)='/dev/input/mice\x00', 0x0, 0x0) ioctl$PPPOEIOCDFWD(r1, 0xb101, 0x0) syz_genetlink_get_family_id$nbd(&(0x7f0000000480)='nbd\x00') getsockopt$inet6_IPV6_XFRM_POLICY(r0, 0x29, 0x23, &(0x7f0000000340)={{{@in=@local, @in=@loopback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@local}, 0x0, @in=@remote}}, &(0x7f0000000140)=0xe8) connect$can_bcm(0xffffffffffffffff, &(0x7f00000001c0), 0x10) bind$inet6(r0, &(0x7f0000000040)={0xa, 0x4e24}, 0x1c) lsetxattr$security_ima(&(0x7f0000000280)='./file0\x00', &(0x7f0000000440)='security.ima\x00', 0x0, 0x0, 0x1) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clock_gettime(0x0, &(0x7f0000000100)={0x0, 0x0}) r4 = openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) bind(r4, &(0x7f0000000580)=@can={0x1d, r2}, 0x80) clock_gettime(0x3, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff}) ppoll(&(0x7f0000000000)=[{r0, 0x41a}], 0x1, &(0x7f0000000200)={0x0, r3+30000000}, &(0x7f0000000240)={0x2000}, 0x8) connect$inet6(r0, &(0x7f0000000080)={0xa, 0x4e24, 0x0, @ipv4={[], [], @loopback}}, 0x1c) readv(0xffffffffffffffff, 0x0, 0x0) sendmmsg(r0, &(0x7f00000092c0), 0x4ff, 0x0) connect$pptp(r5, &(0x7f00000004c0)={0x18, 0x2, {0x0, @multicast1}}, 0x1e) 04:02:07 executing program 3: clock_gettime(0x0, &(0x7f0000002580)={0x0, 0x0}) clock_gettime(0x0, &(0x7f00000025c0)={0x0, 0x0}) utimes(&(0x7f0000002540)='./file0/file0\x00', &(0x7f0000002600)={{r0, r1/1000+30000}, {r2, r3/1000+10000}}) sched_setaffinity(0x0, 0x375, &(0x7f0000000140)=0x5) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r4 = socket$inet_sctp(0x2, 0x1, 0x84) setsockopt$inet_sctp_SCTP_EVENTS(r4, 0x84, 0xb, &(0x7f0000002480)={0x0, 0x6, 0xf000000000, 0x6, 0x3, 0x8, 0x7f1, 0x82b1, 0x2, 0x6, 0x6}, 0xb) r5 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r5, &(0x7f0000002640)={0xa, 0x0, 0x0, @local, 0x2000000008}, 0x1c) connect$inet6(r5, &(0x7f0000000180)={0xa, 0x4e1f, 0x0, @ipv4={[], [], @loopback}}, 0x1c) r6 = getpgrp(0xffffffffffffffff) process_vm_writev(r6, &(0x7f0000002280)=[{&(0x7f00000001c0)=""/4096, 0x1000}, {&(0x7f00000011c0)=""/178, 0xb2}, {&(0x7f0000001280)=""/4096, 0x1000}], 0x3, &(0x7f00000023c0)=[{&(0x7f00000022c0)=""/109, 0x6d}, {&(0x7f0000002340)=""/102, 0x66}], 0x2, 0x0) pivot_root(&(0x7f00000024c0)='./file0\x00', &(0x7f0000002500)='./file0\x00') r7 = openat$userio(0xffffffffffffff9c, &(0x7f0000002400)='/dev/userio\x00', 0xa042, 0x0) setsockopt$inet_sctp_SCTP_RECVNXTINFO(r7, 0x84, 0x21, &(0x7f0000002440)=0xc3, 0x4) sendmmsg(r5, &(0x7f00000002c0), 0x400000000000027, 0x0) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r5, 0x29, 0x20, &(0x7f00000000c0)={@loopback, 0x0, 0x0, 0x3, 0x3, 0x7, 0x5, 0x7}, 0x20) 04:02:07 executing program 4: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) recvmsg(0xffffffffffffffff, &(0x7f00000036c0)={&(0x7f0000000180)=@can, 0xfd28, &(0x7f00000035c0), 0x0, &(0x7f0000003680)=""/41, 0x29}, 0x0) bind$alg(r0, &(0x7f0000001300)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb(blowfish)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000ff8000)="0a0775b0", 0x4) r1 = accept$alg(r0, 0x0, 0x0) sendmmsg$alg(r1, &(0x7f0000003e80)=[{0x0, 0x0, &(0x7f0000002a80), 0x167, &(0x7f0000000100)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x0) recvmsg(r1, &(0x7f0000000000)={0x0, 0x7, &(0x7f0000000140)=[{&(0x7f0000000200)=""/4096, 0x1000}], 0x1, &(0x7f0000fb3fa9)=""/87, 0x57}, 0x0) 04:02:07 executing program 2: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000440)=@updpolicy={0xb8, 0x19, 0x523, 0x0, 0x0, {{@in=@multicast2, @in6=@empty={[0x0, 0x0, 0x0, 0x1000000000000000]}, 0x0, 0x0, 0x0, 0x0, 0xa}}}, 0xb8}}, 0x0) 04:02:07 executing program 1: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) recvmsg(0xffffffffffffffff, &(0x7f00000036c0)={&(0x7f0000000180)=@can, 0xfd28, &(0x7f00000035c0), 0x0, &(0x7f0000003680)=""/41, 0x29}, 0x0) bind$alg(r0, &(0x7f0000001300)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb(blowfish)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000ff8000)="0a0775b0", 0x4) r1 = accept$alg(r0, 0x0, 0x0) sendmmsg$alg(r1, &(0x7f0000003e80)=[{0x0, 0x0, &(0x7f0000002a80), 0x167, &(0x7f0000000100)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x0) recvmsg(r1, &(0x7f0000000000)={&(0x7f0000f7ffa8)=@alg, 0x80, &(0x7f0000000140)=[{&(0x7f0000000200)=""/4096, 0x1008}], 0x1}, 0x0) 04:02:07 executing program 0: r0 = perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) setxattr$security_smack_entry(&(0x7f0000000380)='./file0\x00', &(0x7f0000000480)='security.SMACK64IPIN\x00', &(0x7f0000000540)='^vboxnet1^\x00', 0xb, 0x1) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r1, &(0x7f0000000040), 0x0}, 0x20) unlink(&(0x7f0000000900)='./file0/file0\x00') r2 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r3 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r3, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r2, 0xc018620b, &(0x7f0000000640)={0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f00000000c0)=[@enter_looper], 0x48, 0x0, &(0x7f0000000700)="2ba063fb309ec7fdbfb08e6e91baee7d7d4599fe14129a4d426834556ae420e087d59c0c7be7fcad1abb7e1f8f446f373f611ca1ee9c2231708e18a47bc68a2a79a0b48931f6ff6d"}) ioctl$BINDER_SET_CONTEXT_MGR(r3, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x1) prctl$PR_SET_NAME(0xf, &(0x7f00000004c0)='/group.stat\x00') ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, &(0x7f0000000780)}) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f0000000680)}) ioctl$FS_IOC_FIEMAP(r3, 0xc020660b, &(0x7f0000000b80)=ANY=[@ANYBLOB="0000010000000000200000000000000005000000010000000a00000000000000ff030000000000001a0a000000000000050000000000000000000000000000000000000000000000080000000000000000000000000000000800000000000000ffff0000000000000100008000000000000000000000000000000000000000000000000000000000000000000000000008000000000000003f0000000000000008000000000000000000000000000000000000000000800800000000000000000000000000000200000000000000000400000000000000000000010000000000000000000000000000000000000002110000000000000000000000000000cc0000000000000000000000000000001b0000000000000000000000000000000000000000000000841400000000000000000000000000000300000000000000feffffffffffffff000000000000000000000000000000000000000000000000020000000000000000000000000000000600000000000000ff01000000000000040000000000000000000000000000000000000000000000000400000000000000000000000000007be70000000000000900000000000000ff7f0000000000000000000000000000000000000000000004180000000000000000000000000000ffffffff0000000081000000000000000600000000000000000000000000000000000000000000000400000000000000000000000000000002000000000000000500000000000000ff7fffffffffffff0000000000000000000000000000000004040000000000000000000000000000"]) r5 = creat(&(0x7f00000000c0)='./file0\x00', 0x0) openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000100)='/group.stat\x00', 0x2761, 0x0) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000080), 0xffffffffffffffff) getpid() fallocate(r0, 0x0, 0x0, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x2f, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) memfd_create(&(0x7f0000000080)='!proccgroup\x00', 0x0) ioctl$sock_inet_SIOCSIFPFLAGS(0xffffffffffffffff, 0x8934, &(0x7f0000000400)={'veth0_to_bridge\x00', 0x100}) accept(r5, &(0x7f0000000580)=@alg, &(0x7f0000000600)=0x80) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x2400, 0x8000) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000008c0)={0x2c, 0x0, &(0x7f0000000780)=[@acquire_done={0x40106309, r4, 0x2}, @clear_death={0x400c630f, 0x1, 0x3}, @release={0x40046306, 0x2}], 0xc1, 0x0, &(0x7f00000007c0)="859547f83b9b058a973a491d7e6378544744f2b56b02270a2f78214a936e9afb25cd94695643af6563f86771aa9621b9f30f2ca538b018247a633c28ee01e03b4639679311117971e60dc1538f34e961ae301463172c41754be988f6beb0ce4d83c69f86c236d29520e6cdaf5dbb60404c66d63315ff287deac8632781d0197ef1f81314da0a1ed90b681842cf85a41b496ce0a7a6f5aa4b9b23483eea8861be89b3398c6aec3349174f9cdc9de34df361ac9bf7afd8566849487c3c0a1e3aaacd"}) 04:02:07 executing program 1: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) recvmsg(0xffffffffffffffff, &(0x7f00000036c0)={&(0x7f0000000180)=@can, 0xfd28, &(0x7f00000035c0), 0x0, &(0x7f0000003680)=""/41, 0x29}, 0x0) bind$alg(r0, &(0x7f0000001300)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb(blowfish)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000ff8000)="0a0775b0", 0x4) r1 = accept$alg(r0, 0x0, 0x0) sendmmsg$alg(r1, &(0x7f0000003e80)=[{0x0, 0x0, &(0x7f0000002a80), 0x167, &(0x7f0000000100)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x0) recvmsg(r1, &(0x7f0000000000)={&(0x7f0000f7ffa8)=@alg, 0x80, &(0x7f0000000140)=[{&(0x7f0000000200)=""/4096, 0x1010}], 0x1}, 0x0) 04:02:07 executing program 4: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) recvmsg(0xffffffffffffffff, &(0x7f00000036c0)={&(0x7f0000000180)=@can, 0xfd28, &(0x7f00000035c0), 0x0, &(0x7f0000003680)=""/41, 0x29}, 0x0) bind$alg(r0, &(0x7f0000001300)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb(blowfish)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000ff8000)="0a0775b0", 0x4) r1 = accept$alg(r0, 0x0, 0x0) sendmmsg$alg(r1, &(0x7f0000003e80)=[{0x0, 0x0, &(0x7f0000002a80), 0x167, &(0x7f0000000100)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x0) recvmsg(r1, &(0x7f0000000000)={0x0, 0x8, &(0x7f0000000140)=[{&(0x7f0000000200)=""/4096, 0x1000}], 0x1, &(0x7f0000fb3fa9)=""/87, 0x57}, 0x0) 04:02:07 executing program 2: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000440)=@updpolicy={0xb8, 0x19, 0x523, 0x0, 0x0, {{@in=@multicast2, @in6=@empty={[0x0, 0x0, 0x0, 0x2403000000000000]}, 0x0, 0x0, 0x0, 0x0, 0xa}}}, 0xb8}}, 0x0) [ 642.143498] binder: BINDER_SET_CONTEXT_MGR already set [ 642.149443] binder: 22604:22612 ioctl 40046207 0 returned -16 [ 642.166142] binder: 22604:22612 Release 1 refcount change on invalid ref 1 ret -22 [ 642.223333] binder: 22604:22619 BC_ACQUIRE_DONE u0000000000000000 no match 04:02:08 executing program 1: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) recvmsg(0xffffffffffffffff, &(0x7f00000036c0)={&(0x7f0000000180)=@can, 0xfd28, &(0x7f00000035c0), 0x0, &(0x7f0000003680)=""/41, 0x29}, 0x0) bind$alg(r0, &(0x7f0000001300)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb(blowfish)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000ff8000)="0a0775b0", 0x4) r1 = accept$alg(r0, 0x0, 0x0) sendmmsg$alg(r1, &(0x7f0000003e80)=[{0x0, 0x0, &(0x7f0000002a80), 0x167, &(0x7f0000000100)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x0) recvmsg(r1, &(0x7f0000000000)={&(0x7f0000f7ffa8)=@alg, 0x80, &(0x7f0000000140)=[{&(0x7f0000000200)=""/4096, 0xfed0}], 0x1}, 0x0) [ 642.263845] binder: 22604:22619 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 [ 642.299710] binder: 22604:22619 Release 1 refcount change on invalid ref 2 ret -22 04:02:08 executing program 2: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000440)=@updpolicy={0xb8, 0x19, 0x523, 0x0, 0x0, {{@in=@multicast2, @in6=@empty={[0x0, 0x0, 0x0, 0x2f00000000000000]}, 0x0, 0x0, 0x0, 0x0, 0xa}}}, 0xb8}}, 0x0) 04:02:08 executing program 4: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) recvmsg(0xffffffffffffffff, &(0x7f00000036c0)={&(0x7f0000000180)=@can, 0xfd28, &(0x7f00000035c0), 0x0, &(0x7f0000003680)=""/41, 0x29}, 0x0) bind$alg(r0, &(0x7f0000001300)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb(blowfish)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000ff8000)="0a0775b0", 0x4) r1 = accept$alg(r0, 0x0, 0x0) sendmmsg$alg(r1, &(0x7f0000003e80)=[{0x0, 0x0, &(0x7f0000002a80), 0x167, &(0x7f0000000100)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x0) recvmsg(r1, &(0x7f0000000000)={0x0, 0x10, &(0x7f0000000140)=[{&(0x7f0000000200)=""/4096, 0x1000}], 0x1, &(0x7f0000fb3fa9)=""/87, 0x57}, 0x0) [ 642.859468] binder: release 22604:22612 transaction 402 out, still active [ 642.884398] net_ratelimit: 20 callbacks suppressed [ 642.884406] protocol 88fb is buggy, dev hsr_slave_0 [ 642.894465] protocol 88fb is buggy, dev hsr_slave_1 [ 642.899576] protocol 88fb is buggy, dev hsr_slave_0 [ 642.904669] protocol 88fb is buggy, dev hsr_slave_1 04:02:08 executing program 5: r0 = socket$inet6(0xa, 0x2, 0x0) r1 = syz_open_dev$mice(&(0x7f00000002c0)='/dev/input/mice\x00', 0x0, 0x0) ioctl$PPPOEIOCDFWD(r1, 0xb101, 0x0) syz_genetlink_get_family_id$nbd(&(0x7f0000000480)='nbd\x00') getsockopt$inet6_IPV6_XFRM_POLICY(r0, 0x29, 0x23, &(0x7f0000000340)={{{@in=@local, @in=@loopback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@local}, 0x0, @in=@remote}}, &(0x7f0000000140)=0xe8) connect$can_bcm(0xffffffffffffffff, &(0x7f00000001c0), 0x10) bind$inet6(r0, &(0x7f0000000040)={0xa, 0x4e24}, 0x1c) lsetxattr$security_ima(&(0x7f0000000280)='./file0\x00', &(0x7f0000000440)='security.ima\x00', 0x0, 0x0, 0x1) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clock_gettime(0x0, &(0x7f0000000100)={0x0, 0x0}) r4 = openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) bind(r4, &(0x7f0000000580)=@can={0x1d, r2}, 0x80) clock_gettime(0x3, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff}) ppoll(&(0x7f0000000000)=[{r0, 0x41a}], 0x1, &(0x7f0000000200)={0x0, r3+30000000}, &(0x7f0000000240)={0x3f00}, 0x8) connect$inet6(r0, &(0x7f0000000080)={0xa, 0x4e24, 0x0, @ipv4={[], [], @loopback}}, 0x1c) readv(0xffffffffffffffff, 0x0, 0x0) sendmmsg(r0, &(0x7f00000092c0), 0x4ff, 0x0) connect$pptp(r5, &(0x7f00000004c0)={0x18, 0x2, {0x0, @multicast1}}, 0x1e) 04:02:08 executing program 1: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) recvmsg(0xffffffffffffffff, &(0x7f00000036c0)={&(0x7f0000000180)=@can, 0xfd28, &(0x7f00000035c0), 0x0, &(0x7f0000003680)=""/41, 0x29}, 0x0) bind$alg(r0, &(0x7f0000001300)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb(blowfish)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000ff8000)="0a0775b0", 0x4) r1 = accept$alg(r0, 0x0, 0x0) sendmmsg$alg(r1, &(0x7f0000003e80)=[{0x0, 0x0, &(0x7f0000002a80), 0x167, &(0x7f0000000100)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x0) recvmsg(r1, &(0x7f0000000000)={&(0x7f0000f7ffa8)=@alg, 0x80, &(0x7f0000000140)=[{&(0x7f0000000200)=""/4096, 0x20001200}], 0x1}, 0x0) 04:02:08 executing program 3: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000280)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = syz_open_dev$amidi(&(0x7f0000000100)='/dev/amidi#\x00', 0x9000000, 0x4001) connect$rds(r1, &(0x7f0000000140)={0x2, 0x4e23, @multicast2}, 0x10) r2 = syz_open_dev$audion(&(0x7f0000000080)='/dev/audio#\x00', 0x8, 0x218000) ioctl$sock_inet_udp_SIOCOUTQ(r2, 0x5411, &(0x7f00000000c0)) r3 = socket$alg(0x26, 0x5, 0x0) bind$alg(r3, &(0x7f0000000580)={0x26, 'aead\x00', 0x0, 0x0, 'aegis256-generic\x00'}, 0x58) pipe2(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}, 0x84800) write$cgroup_int(r4, &(0x7f0000000040)=0x401, 0x12) close(r3) 04:02:08 executing program 4: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) recvmsg(0xffffffffffffffff, &(0x7f00000036c0)={&(0x7f0000000180)=@can, 0xfd28, &(0x7f00000035c0), 0x0, &(0x7f0000003680)=""/41, 0x29}, 0x0) bind$alg(r0, &(0x7f0000001300)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb(blowfish)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000ff8000)="0a0775b0", 0x4) r1 = accept$alg(r0, 0x0, 0x0) sendmmsg$alg(r1, &(0x7f0000003e80)=[{0x0, 0x0, &(0x7f0000002a80), 0x167, &(0x7f0000000100)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x0) recvmsg(r1, &(0x7f0000000000)={0x0, 0x700, &(0x7f0000000140)=[{&(0x7f0000000200)=""/4096, 0x1000}], 0x1, &(0x7f0000fb3fa9)=""/87, 0x57}, 0x0) 04:02:08 executing program 2: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000440)=@updpolicy={0xb8, 0x19, 0x523, 0x0, 0x0, {{@in=@multicast2, @in6=@empty={[0x0, 0x0, 0x0, 0x6000000000000000]}, 0x0, 0x0, 0x0, 0x0, 0xa}}}, 0xb8}}, 0x0) 04:02:08 executing program 0: r0 = perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) setxattr$security_smack_entry(&(0x7f0000000380)='./file0\x00', &(0x7f0000000480)='security.SMACK64IPIN\x00', &(0x7f0000000540)='^vboxnet1^\x00', 0xb, 0x1) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r1, &(0x7f0000000040), 0x0}, 0x20) unlink(&(0x7f0000000900)='./file0/file0\x00') r2 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r3 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r3, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, &(0x7f00000006c0)={0x0}) ioctl$BINDER_GET_NODE_DEBUG_INFO(0xffffffffffffffff, 0xc018620b, &(0x7f0000000640)={r4}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f00000000c0)=[@enter_looper], 0x48, 0x0, &(0x7f0000000700)="2ba063fb309ec7fdbfb08e6e91baee7d7d4599fe14129a4d426834556ae420e087d59c0c7be7fcad1abb7e1f8f446f373f611ca1ee9c2231708e18a47bc68a2a79a0b48931f6ff6d"}) ioctl$BINDER_SET_CONTEXT_MGR(r3, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x1) prctl$PR_SET_NAME(0xf, &(0x7f00000004c0)='/group.stat\x00') ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, &(0x7f0000000780)}) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f0000000680)}) ioctl$FS_IOC_FIEMAP(r3, 0xc020660b, &(0x7f0000000b80)=ANY=[@ANYBLOB="0000010000000000200000000000000005000000010000000a00000000000000ff030000000000001a0a000000000000050000000000000000000000000000000000000000000000080000000000000000000000000000000800000000000000ffff0000000000000100008000000000000000000000000000000000000000000000000000000000000000000000000008000000000000003f0000000000000008000000000000000000000000000000000000000000800800000000000000000000000000000200000000000000000400000000000000000000010000000000000000000000000000000000000002110000000000000000000000000000cc0000000000000000000000000000001b0000000000000000000000000000000000000000000000841400000000000000000000000000000300000000000000feffffffffffffff000000000000000000000000000000000000000000000000020000000000000000000000000000000600000000000000ff01000000000000040000000000000000000000000000000000000000000000000400000000000000000000000000007be70000000000000900000000000000ff7f0000000000000000000000000000000000000000000004180000000000000000000000000000ffffffff0000000081000000000000000600000000000000000000000000000000000000000000000400000000000000000000000000000002000000000000000500000000000000ff7fffffffffffff0000000000000000000000000000000004040000000000000000000000000000"]) r6 = creat(&(0x7f00000000c0)='./file0\x00', 0x0) openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000100)='/group.stat\x00', 0x2761, 0x0) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000080), 0xffffffffffffffff) getpid() fallocate(r0, 0x0, 0x0, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x2f, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) memfd_create(&(0x7f0000000080)='!proccgroup\x00', 0x0) ioctl$sock_inet_SIOCSIFPFLAGS(0xffffffffffffffff, 0x8934, &(0x7f0000000400)={'veth0_to_bridge\x00', 0x100}) accept(r6, &(0x7f0000000580)=@alg, &(0x7f0000000600)=0x80) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x2400, 0x8000) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000008c0)={0x2c, 0x0, &(0x7f0000000780)=[@acquire_done={0x40106309, r5, 0x2}, @clear_death={0x400c630f, 0x1, 0x3}, @release={0x40046306, 0x2}], 0xc1, 0x0, &(0x7f00000007c0)="859547f83b9b058a973a491d7e6378544744f2b56b02270a2f78214a936e9afb25cd94695643af6563f86771aa9621b9f30f2ca538b018247a633c28ee01e03b4639679311117971e60dc1538f34e961ae301463172c41754be988f6beb0ce4d83c69f86c236d29520e6cdaf5dbb60404c66d63315ff287deac8632781d0197ef1f81314da0a1ed90b681842cf85a41b496ce0a7a6f5aa4b9b23483eea8861be89b3398c6aec3349174f9cdc9de34df361ac9bf7afd8566849487c3c0a1e3aaacd"}) 04:02:08 executing program 2: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000440)=@updpolicy={0xb8, 0x19, 0x523, 0x0, 0x0, {{@in=@multicast2, @in6=@empty={[0x0, 0x0, 0x0, 0x80ffffff00000000]}, 0x0, 0x0, 0x0, 0x0, 0xa}}}, 0xb8}}, 0x0) 04:02:08 executing program 4: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) recvmsg(0xffffffffffffffff, &(0x7f00000036c0)={&(0x7f0000000180)=@can, 0xfd28, &(0x7f00000035c0), 0x0, &(0x7f0000003680)=""/41, 0x29}, 0x0) bind$alg(r0, &(0x7f0000001300)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb(blowfish)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000ff8000)="0a0775b0", 0x4) r1 = accept$alg(r0, 0x0, 0x0) sendmmsg$alg(r1, &(0x7f0000003e80)=[{0x0, 0x0, &(0x7f0000002a80), 0x167, &(0x7f0000000100)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x0) recvmsg(r1, &(0x7f0000000000)={0x0, 0x1f00, &(0x7f0000000140)=[{&(0x7f0000000200)=""/4096, 0x1000}], 0x1, &(0x7f0000fb3fa9)=""/87, 0x57}, 0x0) 04:02:08 executing program 3: accept$inet(0xffffffffffffffff, &(0x7f00000003c0)={0x2, 0x0, @multicast1}, &(0x7f0000000400)=0x10) sched_setaffinity(0x0, 0xfffffffffffffcbf, &(0x7f00000000c0)=0x8000009) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) io_setup(0x8, &(0x7f0000000040)) io_submit(0x0, 0x614470ac, 0xfffffffffffffffe) openat$apparmor_thread_exec(0xffffffffffffff9c, &(0x7f0000000000)='/proc/thread-self/attr/exec\x00', 0x2, 0x0) ioctl$SNDRV_RAWMIDI_IOCTL_INFO(0xffffffffffffffff, 0x810c5701, &(0x7f0000000200)) ioctl$SG_GET_TIMEOUT(0xffffffffffffffff, 0x2202, 0x0) fchdir(0xffffffffffffffff) r0 = socket$inet(0x2, 0x6000000000000003, 0x6) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000000)='sit0\x00', 0x10) sendto$inet(r0, &(0x7f0000000100), 0x0, 0x404c0c0, &(0x7f00000000c0)={0x2, 0x0, @multicast1}, 0x10) sendto$inet(r0, &(0x7f0000000080), 0xffeb, 0xf0490000, &(0x7f00000001c0), 0x10) syz_open_dev$loop(&(0x7f0000000040)='/dev/loop#\x00', 0x0, 0x0) setsockopt$inet_tcp_TCP_CONGESTION(0xffffffffffffffff, 0x6, 0xd, &(0x7f0000000100)='yeah\x00', 0x5) socket$inet6_udp(0xa, 0x2, 0x0) kexec_load(0x0, 0x0, &(0x7f0000001780), 0x360000) [ 643.168253] binder: BINDER_SET_CONTEXT_MGR already set [ 643.185176] binder: 22649:22651 ioctl 40046207 0 returned -16 04:02:09 executing program 1: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) recvmsg(0xffffffffffffffff, &(0x7f00000036c0)={&(0x7f0000000180)=@can, 0xfd28, &(0x7f00000035c0), 0x0, &(0x7f0000003680)=""/41, 0x29}, 0x0) bind$alg(r0, &(0x7f0000001300)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb(blowfish)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000ff8000)="0a0775b0", 0x4) r1 = accept$alg(r0, 0x0, 0x0) sendmmsg$alg(r1, &(0x7f0000003e80)=[{0x0, 0x0, &(0x7f0000002a80), 0x167, &(0x7f0000000100)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x0) recvmsg(r1, &(0x7f0000000000)={&(0x7f0000f7ffa8)=@alg, 0x80, &(0x7f0000000140)=[{&(0x7f0000000200)=""/4096, 0x7ffff000}], 0x1}, 0x0) 04:02:09 executing program 2: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000440)=@updpolicy={0xb8, 0x19, 0x523, 0x0, 0x0, {{@in=@multicast2, @in6=@empty={[0x0, 0x0, 0x0, 0x9effffff00000000]}, 0x0, 0x0, 0x0, 0x0, 0xa}}}, 0xb8}}, 0x0) 04:02:09 executing program 4: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) recvmsg(0xffffffffffffffff, &(0x7f00000036c0)={&(0x7f0000000180)=@can, 0xfd28, &(0x7f00000035c0), 0x0, &(0x7f0000003680)=""/41, 0x29}, 0x0) bind$alg(r0, &(0x7f0000001300)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb(blowfish)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000ff8000)="0a0775b0", 0x4) r1 = accept$alg(r0, 0x0, 0x0) sendmmsg$alg(r1, &(0x7f0000003e80)=[{0x0, 0x0, &(0x7f0000002a80), 0x167, &(0x7f0000000100)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x0) recvmsg(r1, &(0x7f0000000000)={0x0, 0x100000, &(0x7f0000000140)=[{&(0x7f0000000200)=""/4096, 0x1000}], 0x1, &(0x7f0000fb3fa9)=""/87, 0x57}, 0x0) [ 643.524442] protocol 88fb is buggy, dev hsr_slave_0 [ 643.529695] protocol 88fb is buggy, dev hsr_slave_1 [ 643.924356] protocol 88fb is buggy, dev hsr_slave_0 [ 643.929528] protocol 88fb is buggy, dev hsr_slave_1 [ 644.004398] protocol 88fb is buggy, dev hsr_slave_0 [ 644.009481] protocol 88fb is buggy, dev hsr_slave_1 04:02:09 executing program 5: r0 = socket$inet6(0xa, 0x2, 0x0) r1 = syz_open_dev$mice(&(0x7f00000002c0)='/dev/input/mice\x00', 0x0, 0x0) ioctl$PPPOEIOCDFWD(r1, 0xb101, 0x0) syz_genetlink_get_family_id$nbd(&(0x7f0000000480)='nbd\x00') getsockopt$inet6_IPV6_XFRM_POLICY(r0, 0x29, 0x23, &(0x7f0000000340)={{{@in=@local, @in=@loopback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@local}, 0x0, @in=@remote}}, &(0x7f0000000140)=0xe8) connect$can_bcm(0xffffffffffffffff, &(0x7f00000001c0), 0x10) bind$inet6(r0, &(0x7f0000000040)={0xa, 0x4e24}, 0x1c) lsetxattr$security_ima(&(0x7f0000000280)='./file0\x00', &(0x7f0000000440)='security.ima\x00', 0x0, 0x0, 0x1) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clock_gettime(0x0, &(0x7f0000000100)={0x0, 0x0}) r4 = openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) bind(r4, &(0x7f0000000580)=@can={0x1d, r2}, 0x80) clock_gettime(0x3, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff}) ppoll(&(0x7f0000000000)=[{r0, 0x41a}], 0x1, &(0x7f0000000200)={0x0, r3+30000000}, &(0x7f0000000240)={0x5902}, 0x8) connect$inet6(r0, &(0x7f0000000080)={0xa, 0x4e24, 0x0, @ipv4={[], [], @loopback}}, 0x1c) readv(0xffffffffffffffff, 0x0, 0x0) sendmmsg(r0, &(0x7f00000092c0), 0x4ff, 0x0) connect$pptp(r5, &(0x7f00000004c0)={0x18, 0x2, {0x0, @multicast1}}, 0x1e) 04:02:09 executing program 2: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000440)=@updpolicy={0xb8, 0x19, 0x523, 0x0, 0x0, {{@in=@multicast2, @in6=@empty={[0x0, 0x0, 0x0, 0xf0ffffff00000000]}, 0x0, 0x0, 0x0, 0x0, 0xa}}}, 0xb8}}, 0x0) 04:02:09 executing program 4: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) recvmsg(0xffffffffffffffff, &(0x7f00000036c0)={&(0x7f0000000180)=@can, 0xfd28, &(0x7f00000035c0), 0x0, &(0x7f0000003680)=""/41, 0x29}, 0x0) bind$alg(r0, &(0x7f0000001300)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb(blowfish)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000ff8000)="0a0775b0", 0x4) r1 = accept$alg(r0, 0x0, 0x0) sendmmsg$alg(r1, &(0x7f0000003e80)=[{0x0, 0x0, &(0x7f0000002a80), 0x167, &(0x7f0000000100)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x0) recvmsg(r1, &(0x7f0000000000)={0x0, 0x7000000, &(0x7f0000000140)=[{&(0x7f0000000200)=""/4096, 0x1000}], 0x1, &(0x7f0000fb3fa9)=""/87, 0x57}, 0x0) 04:02:09 executing program 1: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) recvmsg(0xffffffffffffffff, &(0x7f00000036c0)={&(0x7f0000000180)=@can, 0xfd28, &(0x7f00000035c0), 0x0, &(0x7f0000003680)=""/41, 0x29}, 0x0) bind$alg(r0, &(0x7f0000001300)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb(blowfish)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000ff8000)="0a0775b0", 0x4) r1 = accept$alg(r0, 0x0, 0x0) sendmmsg$alg(r1, &(0x7f0000003e80)=[{0x0, 0x0, &(0x7f0000002a80), 0x167, &(0x7f0000000100)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x0) recvmsg(r1, &(0x7f0000000000)={&(0x7f0000f7ffa8)=@alg, 0x80, &(0x7f0000000140)=[{&(0x7f0000000200)=""/4096, 0xffffffffffffffff}], 0x1}, 0x0) 04:02:09 executing program 0: r0 = perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) setxattr$security_smack_entry(&(0x7f0000000380)='./file0\x00', &(0x7f0000000480)='security.SMACK64IPIN\x00', &(0x7f0000000540)='^vboxnet1^\x00', 0xb, 0x1) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r1, &(0x7f0000000040), 0x0}, 0x20) unlink(&(0x7f0000000900)='./file0/file0\x00') r2 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r3 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r3, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, &(0x7f00000006c0)={0x0}) ioctl$BINDER_GET_NODE_DEBUG_INFO(0xffffffffffffffff, 0xc018620b, &(0x7f0000000640)={r4}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f00000000c0)=[@enter_looper], 0x48, 0x0, &(0x7f0000000700)="2ba063fb309ec7fdbfb08e6e91baee7d7d4599fe14129a4d426834556ae420e087d59c0c7be7fcad1abb7e1f8f446f373f611ca1ee9c2231708e18a47bc68a2a79a0b48931f6ff6d"}) ioctl$BINDER_SET_CONTEXT_MGR(r3, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x1) prctl$PR_SET_NAME(0xf, &(0x7f00000004c0)='/group.stat\x00') ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, &(0x7f0000000780)}) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f0000000680)}) ioctl$FS_IOC_FIEMAP(r3, 0xc020660b, &(0x7f0000000b80)=ANY=[@ANYBLOB="0000010000000000200000000000000005000000010000000a00000000000000ff030000000000001a0a000000000000050000000000000000000000000000000000000000000000080000000000000000000000000000000800000000000000ffff0000000000000100008000000000000000000000000000000000000000000000000000000000000000000000000008000000000000003f0000000000000008000000000000000000000000000000000000000000800800000000000000000000000000000200000000000000000400000000000000000000010000000000000000000000000000000000000002110000000000000000000000000000cc0000000000000000000000000000001b0000000000000000000000000000000000000000000000841400000000000000000000000000000300000000000000feffffffffffffff000000000000000000000000000000000000000000000000020000000000000000000000000000000600000000000000ff01000000000000040000000000000000000000000000000000000000000000000400000000000000000000000000007be70000000000000900000000000000ff7f0000000000000000000000000000000000000000000004180000000000000000000000000000ffffffff0000000081000000000000000600000000000000000000000000000000000000000000000400000000000000000000000000000002000000000000000500000000000000ff7fffffffffffff0000000000000000000000000000000004040000000000000000000000000000"]) r6 = creat(&(0x7f00000000c0)='./file0\x00', 0x0) openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000100)='/group.stat\x00', 0x2761, 0x0) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000080), 0xffffffffffffffff) getpid() fallocate(r0, 0x0, 0x0, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x2f, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) memfd_create(&(0x7f0000000080)='!proccgroup\x00', 0x0) ioctl$sock_inet_SIOCSIFPFLAGS(0xffffffffffffffff, 0x8934, &(0x7f0000000400)={'veth0_to_bridge\x00', 0x100}) accept(r6, &(0x7f0000000580)=@alg, &(0x7f0000000600)=0x80) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x2400, 0x8000) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000008c0)={0x2c, 0x0, &(0x7f0000000780)=[@acquire_done={0x40106309, r5, 0x2}, @clear_death={0x400c630f, 0x1, 0x3}, @release={0x40046306, 0x2}], 0xc1, 0x0, &(0x7f00000007c0)="859547f83b9b058a973a491d7e6378544744f2b56b02270a2f78214a936e9afb25cd94695643af6563f86771aa9621b9f30f2ca538b018247a633c28ee01e03b4639679311117971e60dc1538f34e961ae301463172c41754be988f6beb0ce4d83c69f86c236d29520e6cdaf5dbb60404c66d63315ff287deac8632781d0197ef1f81314da0a1ed90b681842cf85a41b496ce0a7a6f5aa4b9b23483eea8861be89b3398c6aec3349174f9cdc9de34df361ac9bf7afd8566849487c3c0a1e3aaacd"}) 04:02:09 executing program 3: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = add_key$keyring(&(0x7f0000000380)='keyring\x00', &(0x7f00000003c0)={'syz'}, 0x0, 0x0, 0xfffffffffffffffe) r1 = add_key$user(&(0x7f0000000480)='user\x00', &(0x7f0000000440)={'syz'}, &(0x7f00000009c0)="585ccbc4ed83b836c1a6474914dc5500b66147b3c7218a9169a85ea0bdc9e1587a050000000000000042e330897501f9007b6b482550829e022b8753a188748c569f435fb3bae96efb74b50ec93c2db8eae3198a29e5c0cfc60000ce0637ce0080b4ec24c53d86571ff5ff70e48884ca000018cea71fcfacf40d32e4b58a8d2725561f6110fd7b06f90b5274cc5c1e298a16324fe27da2a9d5ba9ff3d009d308bd73f47725390000000000000000000000000000000000000000000000195e233c00dc44dd50ee", 0xc7, r0) r2 = syz_open_dev$admmidi(&(0x7f0000000080)='/dev/admmidi#\x00', 0x8001, 0x0) r3 = syz_genetlink_get_family_id$team(&(0x7f0000000140)='team\x00') getsockopt$inet_IP_XFRM_POLICY(0xffffffffffffff9c, 0x0, 0x11, &(0x7f0000000240)={{{@in=@local, @in6=@initdev, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6}, 0x0, @in=@broadcast}}, &(0x7f0000000180)=0xe8) getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, &(0x7f0000000600)={{{@in6=@local, @in6=@ipv4={[], [], @multicast2}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@multicast2}, 0x0, @in=@remote}}, &(0x7f00000001c0)=0xe8) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000340)={'bpq0\x00', 0x0}) getsockopt$inet_IP_XFRM_POLICY(0xffffffffffffffff, 0x0, 0x11, &(0x7f0000000dc0)={{{@in6=@remote, @in6=@initdev, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@multicast2}, 0x0, @in6=@mcast1}}, &(0x7f0000000ec0)=0xe8) bpf$BPF_PROG_GET_NEXT_ID(0xb, &(0x7f0000000400)=0x8, 0x4) getpeername$packet(0xffffffffffffffff, &(0x7f0000000f00)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @random}, &(0x7f0000000f40)=0x14) sendmsg$TEAM_CMD_OPTIONS_SET(r2, &(0x7f0000001300)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x8000}, 0xc, &(0x7f00000012c0)={&(0x7f0000000f80)={0x32c, r3, 0x200, 0x70bd2a, 0x25dfdbff, {}, [{{0x8, 0x1, r4}, {0xe8, 0x2, [{0x3c, 0x1, @enabled={{{0x24, 0x1, 'enabled\x00'}, {0x8}, {0x4}}, {0x8, 0x6, r5}}}, {0x38, 0x1, @notify_peers_count={{0x24, 0x1, 'notify_peers_count\x00'}, {0x8}, {0x8, 0x4, 0x81}}}, {0x38, 0x1, @mcast_rejoin_count={{0x24, 0x1, 'mcast_rejoin_count\x00'}, {0x8}, {0x8, 0x4, 0x5}}}, {0x38, 0x1, @notify_peers_count={{0x24, 0x1, 'notify_peers_count\x00'}, {0x8}, {0x8, 0x4, 0x1000}}}]}}, {{0x8, 0x1, r6}, {0xb0, 0x2, [{0x38, 0x1, @mcast_rejoin_count={{0x24, 0x1, 'mcast_rejoin_count\x00'}, {0x8}, {0x8, 0x4, 0x1348}}}, {0x3c, 0x1, @lb_tx_method={{0x24, 0x1, 'lb_tx_method\x00'}, {0x8}, {0xc, 0x4, 'hash\x00'}}}, {0x38, 0x1, @mcast_rejoin_interval={{0x24, 0x1, 'mcast_rejoin_interval\x00'}, {0x8}, {0x8, 0x4, 0x9}}}]}}, {{0x8}, {0x124, 0x2, [{0x6c, 0x1, @bpf_hash_func={{0x24, 0x1, 'bpf_hash_func\x00'}, {0x8}, {0x3c, 0x4, [{0x200, 0xffffffff, 0x2, 0x7fffffff}, {0x7, 0x5, 0x3, 0x200}, {0x5, 0x8, 0xfff, 0x1}, {0xfffffffffffffffe, 0x10, 0x101, 0x9}, {0x3, 0x2, 0x8, 0x9}, {0x8000, 0x100, 0x80000000, 0x3}, {0x1, 0x200, 0x4, 0x100000001}]}}}, {0x38, 0x1, @mcast_rejoin_interval={{0x24, 0x1, 'mcast_rejoin_interval\x00'}, {0x8}, {0x8, 0x4, 0x2}}}, {0x40, 0x1, @name={{0x24, 0x1, 'mode\x00'}, {0x8}, {0x10, 0x4, 'roundrobin\x00'}}}, {0x3c, 0x1, @user_linkup={{{0x24, 0x1, 'user_linkup\x00'}, {0x8}, {0x4}}, {0x8, 0x6, r7}}}]}}, {{0x8, 0x1, r8}, {0x3c, 0x2, [{0x38, 0x1, @notify_peers_count={{0x24, 0x1, 'notify_peers_count\x00'}, {0x8}, {0x8, 0x4, 0xfff}}}]}}]}, 0x32c}, 0x1, 0x0, 0x0, 0x4000}, 0x800) r9 = add_key$user(&(0x7f0000000200)='user\x00', &(0x7f00000005c0)={'syz'}, &(0x7f0000000100)='\x00', 0x1, 0xfffffffffffffffd) keyctl$dh_compute(0x17, &(0x7f0000000000)={r9, r1, r9}, &(0x7f0000000700)=""/243, 0xf3, &(0x7f0000000040)={&(0x7f0000000580)={'streebog256-generic\x00'}}) [ 644.161181] binder: BINDER_SET_CONTEXT_MGR already set 04:02:09 executing program 4: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) recvmsg(0xffffffffffffffff, &(0x7f00000036c0)={&(0x7f0000000180)=@can, 0xfd28, &(0x7f00000035c0), 0x0, &(0x7f0000003680)=""/41, 0x29}, 0x0) bind$alg(r0, &(0x7f0000001300)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb(blowfish)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000ff8000)="0a0775b0", 0x4) r1 = accept$alg(r0, 0x0, 0x0) sendmmsg$alg(r1, &(0x7f0000003e80)=[{0x0, 0x0, &(0x7f0000002a80), 0x167, &(0x7f0000000100)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x0) recvmsg(r1, &(0x7f0000000000)={0x0, 0x8000000, &(0x7f0000000140)=[{&(0x7f0000000200)=""/4096, 0x1000}], 0x1, &(0x7f0000fb3fa9)=""/87, 0x57}, 0x0) 04:02:09 executing program 2: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000440)=@updpolicy={0xb8, 0x19, 0x523, 0x0, 0x0, {{@in=@multicast2, @in6=@empty={[0x0, 0x0, 0x0, 0xfcffffff00000000]}, 0x0, 0x0, 0x0, 0x0, 0xa}}}, 0xb8}}, 0x0) [ 644.193001] binder: 22690:22692 ioctl 40046207 0 returned -16 04:02:10 executing program 1: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) recvmsg(0xffffffffffffffff, &(0x7f00000036c0)={&(0x7f0000000180)=@can, 0xfd28, &(0x7f00000035c0), 0x0, &(0x7f0000003680)=""/41, 0x29}, 0x0) bind$alg(r0, &(0x7f0000001300)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb(blowfish)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000ff8000)="0a0775b0", 0x4) r1 = accept$alg(r0, 0x0, 0x0) sendmmsg$alg(r1, &(0x7f0000003e80)=[{0x0, 0x0, &(0x7f0000002a80), 0x167, &(0x7f0000000100)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x0) recvmsg(r1, &(0x7f0000000000)={&(0x7f0000f7ffa8)=@alg, 0x80, &(0x7f0000000140)=[{&(0x7f0000000200)=""/4096, 0x1000}], 0x2}, 0x0) 04:02:10 executing program 3: signalfd4(0xffffffffffffffff, &(0x7f0000000ff8), 0x8, 0x0) socket$pppoe(0x18, 0x1, 0x0) openat$cgroup_root(0xffffffffffffff9c, 0x0, 0x200002, 0x0) r0 = openat$cgroup_int(0xffffffffffffffff, 0x0, 0x2, 0x0) keyctl$join(0x1, &(0x7f00000005c0)) r1 = perf_event_open(&(0x7f000001d000)={0x3, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xb, 0xffffffffffffffff, 0x0) ioctl$sock_bt_bnep_BNEPGETCONNLIST(r0, 0x800442d2, &(0x7f00000001c0)={0x6, &(0x7f0000000380)=[{0x0, 0x0, 0x0, @dev}, {0x0, 0x0, 0x0, @remote}, {0x0, 0x0, 0x0, @random}, {}, {0x0, 0x0, 0x0, @dev}, {0x0, 0x0, 0x0, @local}]}) r2 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000200)='/dev/sequencer2\x00', 0x101000, 0x0) setsockopt$RDS_GET_MR_FOR_DEST(r2, 0x114, 0x7, &(0x7f0000000740)={@nl=@proc={0x10, 0x0, 0x0, 0x8292000}, {0x0}, &(0x7f0000000300)}, 0xa0) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000340)='./cgroup.cpu/syz1\x00', 0x1ff) r3 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/loop-control\x00', 0x0, 0x0) r4 = ioctl$LOOP_CTL_GET_FREE(r3, 0x4c82) ioctl$LOOP_CTL_REMOVE(r3, 0x4c81, r4) fchmodat(r2, &(0x7f0000000100)='./file0\x00', 0x0) r5 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_bp={&(0x7f0000abe000)}, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x47744279}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) bpf$BPF_PROG_DETACH(0x9, &(0x7f0000000080)={0x0, r2, 0xf, 0x1}, 0xc) msgctl$MSG_INFO(0x0, 0xc, &(0x7f0000001ac0)=""/4096) getpgid(0xffffffffffffffff) ioctl$LOOP_CTL_ADD(r3, 0x4c80, 0x0) fsetxattr$trusted_overlay_redirect(r1, &(0x7f0000000040)='trusted.overlay.redirect\x00', &(0x7f00000000c0)='./file0\x00', 0x8, 0x1) perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x800000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x10000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffff9c, 0x0) ioctl$TIOCSPGRP(r5, 0x5410, &(0x7f0000000000)) 04:02:10 executing program 4: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) recvmsg(0xffffffffffffffff, &(0x7f00000036c0)={&(0x7f0000000180)=@can, 0xfd28, &(0x7f00000035c0), 0x0, &(0x7f0000003680)=""/41, 0x29}, 0x0) bind$alg(r0, &(0x7f0000001300)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb(blowfish)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000ff8000)="0a0775b0", 0x4) r1 = accept$alg(r0, 0x0, 0x0) sendmmsg$alg(r1, &(0x7f0000003e80)=[{0x0, 0x0, &(0x7f0000002a80), 0x167, &(0x7f0000000100)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x0) recvmsg(r1, &(0x7f0000000000)={0x0, 0x10000000, &(0x7f0000000140)=[{&(0x7f0000000200)=""/4096, 0x1000}], 0x1, &(0x7f0000fb3fa9)=""/87, 0x57}, 0x0) 04:02:10 executing program 2: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000440)=@updpolicy={0xb8, 0x19, 0x523, 0x0, 0x0, {{@in=@multicast2, @in6=@empty={[0x0, 0x0, 0x0, 0xffffff7f00000000]}, 0x0, 0x0, 0x0, 0x0, 0xa}}}, 0xb8}}, 0x0) 04:02:10 executing program 5: r0 = socket$inet6(0xa, 0x2, 0x0) r1 = syz_open_dev$mice(&(0x7f00000002c0)='/dev/input/mice\x00', 0x0, 0x0) ioctl$PPPOEIOCDFWD(r1, 0xb101, 0x0) syz_genetlink_get_family_id$nbd(&(0x7f0000000480)='nbd\x00') getsockopt$inet6_IPV6_XFRM_POLICY(r0, 0x29, 0x23, &(0x7f0000000340)={{{@in=@local, @in=@loopback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@local}, 0x0, @in=@remote}}, &(0x7f0000000140)=0xe8) connect$can_bcm(0xffffffffffffffff, &(0x7f00000001c0), 0x10) bind$inet6(r0, &(0x7f0000000040)={0xa, 0x4e24}, 0x1c) lsetxattr$security_ima(&(0x7f0000000280)='./file0\x00', &(0x7f0000000440)='security.ima\x00', 0x0, 0x0, 0x1) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clock_gettime(0x0, &(0x7f0000000100)={0x0, 0x0}) r4 = openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) bind(r4, &(0x7f0000000580)=@can={0x1d, r2}, 0x80) clock_gettime(0x3, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff}) ppoll(&(0x7f0000000000)=[{r0, 0x41a}], 0x1, &(0x7f0000000200)={0x0, r3+30000000}, &(0x7f0000000240)={0x6400}, 0x8) connect$inet6(r0, &(0x7f0000000080)={0xa, 0x4e24, 0x0, @ipv4={[], [], @loopback}}, 0x1c) readv(0xffffffffffffffff, 0x0, 0x0) sendmmsg(r0, &(0x7f00000092c0), 0x4ff, 0x0) connect$pptp(r5, &(0x7f00000004c0)={0x18, 0x2, {0x0, @multicast1}}, 0x1e) 04:02:10 executing program 0: r0 = perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) setxattr$security_smack_entry(&(0x7f0000000380)='./file0\x00', &(0x7f0000000480)='security.SMACK64IPIN\x00', &(0x7f0000000540)='^vboxnet1^\x00', 0xb, 0x1) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r1, &(0x7f0000000040), 0x0}, 0x20) unlink(&(0x7f0000000900)='./file0/file0\x00') r2 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r3 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r3, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, &(0x7f00000006c0)={0x0}) ioctl$BINDER_GET_NODE_DEBUG_INFO(0xffffffffffffffff, 0xc018620b, &(0x7f0000000640)={r4}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f00000000c0)=[@enter_looper], 0x48, 0x0, &(0x7f0000000700)="2ba063fb309ec7fdbfb08e6e91baee7d7d4599fe14129a4d426834556ae420e087d59c0c7be7fcad1abb7e1f8f446f373f611ca1ee9c2231708e18a47bc68a2a79a0b48931f6ff6d"}) ioctl$BINDER_SET_CONTEXT_MGR(r3, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x1) prctl$PR_SET_NAME(0xf, &(0x7f00000004c0)='/group.stat\x00') ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, &(0x7f0000000780)}) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f0000000680)}) ioctl$FS_IOC_FIEMAP(r3, 0xc020660b, &(0x7f0000000b80)=ANY=[@ANYBLOB="0000010000000000200000000000000005000000010000000a00000000000000ff030000000000001a0a000000000000050000000000000000000000000000000000000000000000080000000000000000000000000000000800000000000000ffff0000000000000100008000000000000000000000000000000000000000000000000000000000000000000000000008000000000000003f0000000000000008000000000000000000000000000000000000000000800800000000000000000000000000000200000000000000000400000000000000000000010000000000000000000000000000000000000002110000000000000000000000000000cc0000000000000000000000000000001b0000000000000000000000000000000000000000000000841400000000000000000000000000000300000000000000feffffffffffffff000000000000000000000000000000000000000000000000020000000000000000000000000000000600000000000000ff01000000000000040000000000000000000000000000000000000000000000000400000000000000000000000000007be70000000000000900000000000000ff7f0000000000000000000000000000000000000000000004180000000000000000000000000000ffffffff0000000081000000000000000600000000000000000000000000000000000000000000000400000000000000000000000000000002000000000000000500000000000000ff7fffffffffffff0000000000000000000000000000000004040000000000000000000000000000"]) r6 = creat(&(0x7f00000000c0)='./file0\x00', 0x0) openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000100)='/group.stat\x00', 0x2761, 0x0) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000080), 0xffffffffffffffff) getpid() fallocate(r0, 0x0, 0x0, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x2f, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) memfd_create(&(0x7f0000000080)='!proccgroup\x00', 0x0) ioctl$sock_inet_SIOCSIFPFLAGS(0xffffffffffffffff, 0x8934, &(0x7f0000000400)={'veth0_to_bridge\x00', 0x100}) accept(r6, &(0x7f0000000580)=@alg, &(0x7f0000000600)=0x80) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x2400, 0x8000) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000008c0)={0x2c, 0x0, &(0x7f0000000780)=[@acquire_done={0x40106309, r5, 0x2}, @clear_death={0x400c630f, 0x1, 0x3}, @release={0x40046306, 0x2}], 0xc1, 0x0, &(0x7f00000007c0)="859547f83b9b058a973a491d7e6378544744f2b56b02270a2f78214a936e9afb25cd94695643af6563f86771aa9621b9f30f2ca538b018247a633c28ee01e03b4639679311117971e60dc1538f34e961ae301463172c41754be988f6beb0ce4d83c69f86c236d29520e6cdaf5dbb60404c66d63315ff287deac8632781d0197ef1f81314da0a1ed90b681842cf85a41b496ce0a7a6f5aa4b9b23483eea8861be89b3398c6aec3349174f9cdc9de34df361ac9bf7afd8566849487c3c0a1e3aaacd"}) 04:02:10 executing program 4: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) recvmsg(0xffffffffffffffff, &(0x7f00000036c0)={&(0x7f0000000180)=@can, 0xfd28, &(0x7f00000035c0), 0x0, &(0x7f0000003680)=""/41, 0x29}, 0x0) bind$alg(r0, &(0x7f0000001300)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb(blowfish)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000ff8000)="0a0775b0", 0x4) r1 = accept$alg(r0, 0x0, 0x0) sendmmsg$alg(r1, &(0x7f0000003e80)=[{0x0, 0x0, &(0x7f0000002a80), 0x167, &(0x7f0000000100)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x0) recvmsg(r1, &(0x7f0000000000)={0x0, 0x1f000000, &(0x7f0000000140)=[{&(0x7f0000000200)=""/4096, 0x1000}], 0x1, &(0x7f0000fb3fa9)=""/87, 0x57}, 0x0) 04:02:10 executing program 1: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) recvmsg(0xffffffffffffffff, &(0x7f00000036c0)={&(0x7f0000000180)=@can, 0xfd28, &(0x7f00000035c0), 0x0, &(0x7f0000003680)=""/41, 0x29}, 0x0) bind$alg(r0, &(0x7f0000001300)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb(blowfish)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000ff8000)="0a0775b0", 0x4) r1 = accept$alg(r0, 0x0, 0x0) sendmmsg$alg(r1, &(0x7f0000003e80)=[{0x0, 0x0, &(0x7f0000002a80), 0x167, &(0x7f0000000100)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x0) recvmsg(r1, &(0x7f0000000000)={&(0x7f0000f7ffa8)=@alg, 0x80, &(0x7f0000000140)=[{&(0x7f0000000200)=""/4096, 0x1000}], 0x8}, 0x0) 04:02:10 executing program 2: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000440)=@updpolicy={0xb8, 0x19, 0x523, 0x0, 0x0, {{@in=@multicast2, @in6=@empty={[0x0, 0x0, 0x0, 0xfffffffffffff000]}, 0x0, 0x0, 0x0, 0x0, 0xa}}}, 0xb8}}, 0x0) 04:02:10 executing program 3: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x7, 0x31, 0xffffffffffffffff, 0x0) remap_file_pages(&(0x7f00002ec000/0x200000)=nil, 0x200000, 0x0, 0x0, 0x0) r0 = shmat(0x0, &(0x7f00004b8000/0x4000)=nil, 0x1000000007000) syz_open_dev$dspn(0x0, 0x0, 0x8000) shmdt(r0) mbind(&(0x7f0000012000/0xc00000)=nil, 0xc00000, 0x1, &(0x7f0000000000), 0x5, 0x4) [ 645.199707] binder: BINDER_SET_CONTEXT_MGR already set 04:02:11 executing program 2: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000440)=@updpolicy={0xb8, 0x19, 0x523, 0x0, 0x0, {{@in=@multicast2, @in6=@empty={[0x0, 0x0, 0x0, 0xffffffffffffffff]}, 0x0, 0x0, 0x0, 0x0, 0xa}}}, 0xb8}}, 0x0) [ 645.223187] binder: 22738:22740 ioctl 40046207 0 returned -16 04:02:11 executing program 1: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) recvmsg(0xffffffffffffffff, &(0x7f00000036c0)={&(0x7f0000000180)=@can, 0xfd28, &(0x7f00000035c0), 0x0, &(0x7f0000003680)=""/41, 0x29}, 0x0) bind$alg(r0, &(0x7f0000001300)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb(blowfish)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000ff8000)="0a0775b0", 0x4) r1 = accept$alg(r0, 0x0, 0x0) sendmmsg$alg(r1, &(0x7f0000003e80)=[{0x0, 0x0, &(0x7f0000002a80), 0x167, &(0x7f0000000100)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x0) recvmsg(r1, &(0x7f0000000000)={&(0x7f0000f7ffa8)=@alg, 0x80, &(0x7f0000000140)=[{&(0x7f0000000200)=""/4096, 0x1000}], 0x10}, 0x0) 04:02:11 executing program 4: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) recvmsg(0xffffffffffffffff, &(0x7f00000036c0)={&(0x7f0000000180)=@can, 0xfd28, &(0x7f00000035c0), 0x0, &(0x7f0000003680)=""/41, 0x29}, 0x0) bind$alg(r0, &(0x7f0000001300)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb(blowfish)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000ff8000)="0a0775b0", 0x4) r1 = accept$alg(r0, 0x0, 0x0) sendmmsg$alg(r1, &(0x7f0000003e80)=[{0x0, 0x0, &(0x7f0000002a80), 0x167, &(0x7f0000000100)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x0) recvmsg(r1, &(0x7f0000000000)={0x0, 0x8dffffff, &(0x7f0000000140)=[{&(0x7f0000000200)=""/4096, 0x1000}], 0x1, &(0x7f0000fb3fa9)=""/87, 0x57}, 0x0) 04:02:11 executing program 2: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000440)=@updpolicy={0xb8, 0x19, 0x523, 0x0, 0x0, {{@in=@multicast2, @in6=@empty={[0x0, 0x0, 0x0, 0x0, 0x2]}, 0x0, 0x0, 0x0, 0x0, 0xa}}}, 0xb8}}, 0x0) 04:02:11 executing program 0: r0 = perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) setxattr$security_smack_entry(&(0x7f0000000380)='./file0\x00', &(0x7f0000000480)='security.SMACK64IPIN\x00', &(0x7f0000000540)='^vboxnet1^\x00', 0xb, 0x1) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r1, &(0x7f0000000040), 0x0}, 0x20) unlink(&(0x7f0000000900)='./file0/file0\x00') r2 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r3 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r3, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, &(0x7f00000006c0)) ioctl$BINDER_GET_NODE_DEBUG_INFO(r2, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f00000000c0)=[@enter_looper], 0x48, 0x0, &(0x7f0000000700)="2ba063fb309ec7fdbfb08e6e91baee7d7d4599fe14129a4d426834556ae420e087d59c0c7be7fcad1abb7e1f8f446f373f611ca1ee9c2231708e18a47bc68a2a79a0b48931f6ff6d"}) ioctl$BINDER_SET_CONTEXT_MGR(r3, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x1) prctl$PR_SET_NAME(0xf, &(0x7f00000004c0)='/group.stat\x00') ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, &(0x7f0000000780)}) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f0000000680)}) ioctl$FS_IOC_FIEMAP(r3, 0xc020660b, &(0x7f0000000b80)=ANY=[@ANYBLOB="0000010000000000200000000000000005000000010000000a00000000000000ff030000000000001a0a000000000000050000000000000000000000000000000000000000000000080000000000000000000000000000000800000000000000ffff0000000000000100008000000000000000000000000000000000000000000000000000000000000000000000000008000000000000003f0000000000000008000000000000000000000000000000000000000000800800000000000000000000000000000200000000000000000400000000000000000000010000000000000000000000000000000000000002110000000000000000000000000000cc0000000000000000000000000000001b0000000000000000000000000000000000000000000000841400000000000000000000000000000300000000000000feffffffffffffff000000000000000000000000000000000000000000000000020000000000000000000000000000000600000000000000ff01000000000000040000000000000000000000000000000000000000000000000400000000000000000000000000007be70000000000000900000000000000ff7f0000000000000000000000000000000000000000000004180000000000000000000000000000ffffffff0000000081000000000000000600000000000000000000000000000000000000000000000400000000000000000000000000000002000000000000000500000000000000ff7fffffffffffff0000000000000000000000000000000004040000000000000000000000000000"]) r4 = creat(&(0x7f00000000c0)='./file0\x00', 0x0) openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000100)='/group.stat\x00', 0x2761, 0x0) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000080), 0xffffffffffffffff) getpid() fallocate(r0, 0x0, 0x0, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x2f, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) memfd_create(&(0x7f0000000080)='!proccgroup\x00', 0x0) ioctl$sock_inet_SIOCSIFPFLAGS(0xffffffffffffffff, 0x8934, &(0x7f0000000400)={'veth0_to_bridge\x00', 0x100}) accept(r4, &(0x7f0000000580)=@alg, &(0x7f0000000600)=0x80) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x2400, 0x8000) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000008c0)={0x2c, 0x0, &(0x7f0000000780)=[@acquire_done={0x40106309, 0x0, 0x2}, @clear_death={0x400c630f, 0x1, 0x3}, @release={0x40046306, 0x2}], 0xc1, 0x0, &(0x7f00000007c0)="859547f83b9b058a973a491d7e6378544744f2b56b02270a2f78214a936e9afb25cd94695643af6563f86771aa9621b9f30f2ca538b018247a633c28ee01e03b4639679311117971e60dc1538f34e961ae301463172c41754be988f6beb0ce4d83c69f86c236d29520e6cdaf5dbb60404c66d63315ff287deac8632781d0197ef1f81314da0a1ed90b681842cf85a41b496ce0a7a6f5aa4b9b23483eea8861be89b3398c6aec3349174f9cdc9de34df361ac9bf7afd8566849487c3c0a1e3aaacd"}) 04:02:11 executing program 1: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) recvmsg(0xffffffffffffffff, &(0x7f00000036c0)={&(0x7f0000000180)=@can, 0xfd28, &(0x7f00000035c0), 0x0, &(0x7f0000003680)=""/41, 0x29}, 0x0) bind$alg(r0, &(0x7f0000001300)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb(blowfish)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000ff8000)="0a0775b0", 0x4) r1 = accept$alg(r0, 0x0, 0x0) sendmmsg$alg(r1, &(0x7f0000003e80)=[{0x0, 0x0, &(0x7f0000002a80), 0x167, &(0x7f0000000100)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x0) recvmsg(r1, &(0x7f0000000000)={&(0x7f0000f7ffa8)=@alg, 0x80, &(0x7f0000000140)=[{&(0x7f0000000200)=""/4096, 0x1000}], 0x500}, 0x0) [ 645.769459] binder: 22764:22765 ioctl c018620b 0 returned -14 04:02:12 executing program 5: r0 = socket$inet6(0xa, 0x2, 0x0) r1 = syz_open_dev$mice(&(0x7f00000002c0)='/dev/input/mice\x00', 0x0, 0x0) ioctl$PPPOEIOCDFWD(r1, 0xb101, 0x0) syz_genetlink_get_family_id$nbd(&(0x7f0000000480)='nbd\x00') getsockopt$inet6_IPV6_XFRM_POLICY(r0, 0x29, 0x23, &(0x7f0000000340)={{{@in=@local, @in=@loopback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@local}, 0x0, @in=@remote}}, &(0x7f0000000140)=0xe8) connect$can_bcm(0xffffffffffffffff, &(0x7f00000001c0), 0x10) bind$inet6(r0, &(0x7f0000000040)={0xa, 0x4e24}, 0x1c) lsetxattr$security_ima(&(0x7f0000000280)='./file0\x00', &(0x7f0000000440)='security.ima\x00', 0x0, 0x0, 0x1) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clock_gettime(0x0, &(0x7f0000000100)={0x0, 0x0}) r4 = openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) bind(r4, &(0x7f0000000580)=@can={0x1d, r2}, 0x80) clock_gettime(0x3, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff}) ppoll(&(0x7f0000000000)=[{r0, 0x41a}], 0x1, &(0x7f0000000200)={0x0, r3+30000000}, &(0x7f0000000240)={0x3000000}, 0x8) connect$inet6(r0, &(0x7f0000000080)={0xa, 0x4e24, 0x0, @ipv4={[], [], @loopback}}, 0x1c) readv(0xffffffffffffffff, 0x0, 0x0) sendmmsg(r0, &(0x7f00000092c0), 0x4ff, 0x0) connect$pptp(r5, &(0x7f00000004c0)={0x18, 0x2, {0x0, @multicast1}}, 0x1e) 04:02:12 executing program 4: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) recvmsg(0xffffffffffffffff, &(0x7f00000036c0)={&(0x7f0000000180)=@can, 0xfd28, &(0x7f00000035c0), 0x0, &(0x7f0000003680)=""/41, 0x29}, 0x0) bind$alg(r0, &(0x7f0000001300)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb(blowfish)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000ff8000)="0a0775b0", 0x4) r1 = accept$alg(r0, 0x0, 0x0) sendmmsg$alg(r1, &(0x7f0000003e80)=[{0x0, 0x0, &(0x7f0000002a80), 0x167, &(0x7f0000000100)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x0) recvmsg(r1, &(0x7f0000000000)={0x0, 0xf0ffffff, &(0x7f0000000140)=[{&(0x7f0000000200)=""/4096, 0x1000}], 0x1, &(0x7f0000fb3fa9)=""/87, 0x57}, 0x0) 04:02:12 executing program 1: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) recvmsg(0xffffffffffffffff, &(0x7f00000036c0)={&(0x7f0000000180)=@can, 0xfd28, &(0x7f00000035c0), 0x0, &(0x7f0000003680)=""/41, 0x29}, 0x0) bind$alg(r0, &(0x7f0000001300)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb(blowfish)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000ff8000)="0a0775b0", 0x4) r1 = accept$alg(r0, 0x0, 0x0) sendmmsg$alg(r1, &(0x7f0000003e80)=[{0x0, 0x0, &(0x7f0000002a80), 0x167, &(0x7f0000000100)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x0) recvmsg(r1, &(0x7f0000000000)={&(0x7f0000f7ffa8)=@alg, 0x80, &(0x7f0000000140)=[{&(0x7f0000000200)=""/4096, 0x1000}], 0x1f00}, 0x0) 04:02:12 executing program 2: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000440)=@updpolicy={0xb8, 0x19, 0x523, 0x0, 0x0, {{@in=@multicast2, @in6=@empty={[0x0, 0x0, 0x0, 0x0, 0x3]}, 0x0, 0x0, 0x0, 0x0, 0xa}}}, 0xb8}}, 0x0) 04:02:12 executing program 0: r0 = perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) setxattr$security_smack_entry(&(0x7f0000000380)='./file0\x00', &(0x7f0000000480)='security.SMACK64IPIN\x00', &(0x7f0000000540)='^vboxnet1^\x00', 0xb, 0x1) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r1, &(0x7f0000000040), 0x0}, 0x20) unlink(&(0x7f0000000900)='./file0/file0\x00') r2 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r3 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r3, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, &(0x7f00000006c0)) ioctl$BINDER_GET_NODE_DEBUG_INFO(r2, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f00000000c0)=[@enter_looper], 0x48, 0x0, &(0x7f0000000700)="2ba063fb309ec7fdbfb08e6e91baee7d7d4599fe14129a4d426834556ae420e087d59c0c7be7fcad1abb7e1f8f446f373f611ca1ee9c2231708e18a47bc68a2a79a0b48931f6ff6d"}) ioctl$BINDER_SET_CONTEXT_MGR(r3, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x1) prctl$PR_SET_NAME(0xf, &(0x7f00000004c0)='/group.stat\x00') ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, &(0x7f0000000780)}) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f0000000680)}) ioctl$FS_IOC_FIEMAP(r3, 0xc020660b, &(0x7f0000000b80)=ANY=[@ANYBLOB="0000010000000000200000000000000005000000010000000a00000000000000ff030000000000001a0a000000000000050000000000000000000000000000000000000000000000080000000000000000000000000000000800000000000000ffff0000000000000100008000000000000000000000000000000000000000000000000000000000000000000000000008000000000000003f0000000000000008000000000000000000000000000000000000000000800800000000000000000000000000000200000000000000000400000000000000000000010000000000000000000000000000000000000002110000000000000000000000000000cc0000000000000000000000000000001b0000000000000000000000000000000000000000000000841400000000000000000000000000000300000000000000feffffffffffffff000000000000000000000000000000000000000000000000020000000000000000000000000000000600000000000000ff01000000000000040000000000000000000000000000000000000000000000000400000000000000000000000000007be70000000000000900000000000000ff7f0000000000000000000000000000000000000000000004180000000000000000000000000000ffffffff0000000081000000000000000600000000000000000000000000000000000000000000000400000000000000000000000000000002000000000000000500000000000000ff7fffffffffffff0000000000000000000000000000000004040000000000000000000000000000"]) r4 = creat(&(0x7f00000000c0)='./file0\x00', 0x0) openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000100)='/group.stat\x00', 0x2761, 0x0) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000080), 0xffffffffffffffff) getpid() fallocate(r0, 0x0, 0x0, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x2f, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) memfd_create(&(0x7f0000000080)='!proccgroup\x00', 0x0) ioctl$sock_inet_SIOCSIFPFLAGS(0xffffffffffffffff, 0x8934, &(0x7f0000000400)={'veth0_to_bridge\x00', 0x100}) accept(r4, &(0x7f0000000580)=@alg, &(0x7f0000000600)=0x80) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x2400, 0x8000) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000008c0)={0x2c, 0x0, &(0x7f0000000780)=[@acquire_done={0x40106309, 0x0, 0x2}, @clear_death={0x400c630f, 0x1, 0x3}, @release={0x40046306, 0x2}], 0xc1, 0x0, &(0x7f00000007c0)="859547f83b9b058a973a491d7e6378544744f2b56b02270a2f78214a936e9afb25cd94695643af6563f86771aa9621b9f30f2ca538b018247a633c28ee01e03b4639679311117971e60dc1538f34e961ae301463172c41754be988f6beb0ce4d83c69f86c236d29520e6cdaf5dbb60404c66d63315ff287deac8632781d0197ef1f81314da0a1ed90b681842cf85a41b496ce0a7a6f5aa4b9b23483eea8861be89b3398c6aec3349174f9cdc9de34df361ac9bf7afd8566849487c3c0a1e3aaacd"}) 04:02:12 executing program 3: bpf$PROG_LOAD(0x5, &(0x7f00002a0fb8)={0xf, 0x3, &(0x7f0000000180)=ANY=[@ANYBLOB="851b0000010000009522e600000000009521c83ddae5ff00"], &(0x7f00000000c0)='GPL\x00', 0x2, 0x99, &(0x7f0000000000)=""/153}, 0x48) timer_create(0x3, &(0x7f0000000100)={0x0, 0x29}, &(0x7f0000000140)=0x0) timer_gettime(r0, &(0x7f00000001c0)) 04:02:12 executing program 3: r0 = socket$inet6(0xa, 0x2, 0x0) r1 = syz_open_dev$mice(&(0x7f00000002c0)='/dev/input/mice\x00', 0x0, 0x0) ioctl$PPPOEIOCDFWD(r1, 0xb101, 0x0) syz_genetlink_get_family_id$nbd(&(0x7f0000000480)='nbd\x00') getsockopt$inet6_IPV6_XFRM_POLICY(r0, 0x29, 0x23, &(0x7f0000000340)={{{@in=@local, @in=@loopback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@local}, 0x0, @in=@remote}}, &(0x7f0000000140)=0xe8) connect$can_bcm(0xffffffffffffffff, &(0x7f00000001c0), 0x10) bind$inet6(r0, &(0x7f0000000040)={0xa, 0x4e24}, 0x1c) lsetxattr$security_ima(&(0x7f0000000280)='./file0\x00', &(0x7f0000000440)='security.ima\x00', 0x0, 0x0, 0x1) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clock_gettime(0x0, &(0x7f0000000100)={0x0, 0x0}) r4 = openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) bind(r4, &(0x7f0000000580)=@can={0x1d, r2}, 0x80) clock_gettime(0x3, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff}) ppoll(&(0x7f0000000000)=[{r0, 0x41a}], 0x1, &(0x7f0000000200)={0x0, r3+30000000}, &(0x7f0000000240)={0x6400}, 0x8) connect$inet6(r0, &(0x7f0000000080)={0xa, 0x4e24, 0x0, @ipv4={[], [], @loopback}}, 0x1c) readv(0xffffffffffffffff, 0x0, 0x0) sendmmsg(r0, &(0x7f00000092c0), 0x4ff, 0x0) connect$pptp(r5, &(0x7f00000004c0)={0x18, 0x2, {0x0, @multicast1}}, 0x1e) 04:02:12 executing program 2: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000440)=@updpolicy={0xb8, 0x19, 0x523, 0x0, 0x0, {{@in=@multicast2, @in6=@empty={[0x0, 0x0, 0x0, 0x0, 0x4]}, 0x0, 0x0, 0x0, 0x0, 0xa}}}, 0xb8}}, 0x0) 04:02:12 executing program 1: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) recvmsg(0xffffffffffffffff, &(0x7f00000036c0)={&(0x7f0000000180)=@can, 0xfd28, &(0x7f00000035c0), 0x0, &(0x7f0000003680)=""/41, 0x29}, 0x0) bind$alg(r0, &(0x7f0000001300)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb(blowfish)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000ff8000)="0a0775b0", 0x4) r1 = accept$alg(r0, 0x0, 0x0) sendmmsg$alg(r1, &(0x7f0000003e80)=[{0x0, 0x0, &(0x7f0000002a80), 0x167, &(0x7f0000000100)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x0) recvmsg(r1, &(0x7f0000000000)={&(0x7f0000f7ffa8)=@alg, 0x80, &(0x7f0000000140)=[{&(0x7f0000000200)=""/4096, 0x1000}], 0x1, 0x0, 0x7}, 0x0) 04:02:12 executing program 4: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) recvmsg(0xffffffffffffffff, &(0x7f00000036c0)={&(0x7f0000000180)=@can, 0xfd28, &(0x7f00000035c0), 0x0, &(0x7f0000003680)=""/41, 0x29}, 0x0) bind$alg(r0, &(0x7f0000001300)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb(blowfish)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000ff8000)="0a0775b0", 0x4) r1 = accept$alg(r0, 0x0, 0x0) sendmmsg$alg(r1, &(0x7f0000003e80)=[{0x0, 0x0, &(0x7f0000002a80), 0x167, &(0x7f0000000100)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x0) recvmsg(r1, &(0x7f0000000000)={0x0, 0xffffff8d, &(0x7f0000000140)=[{&(0x7f0000000200)=""/4096, 0x1000}], 0x1, &(0x7f0000fb3fa9)=""/87, 0x57}, 0x0) [ 646.418201] binder: 22781:22783 ioctl c018620b 0 returned -14 04:02:12 executing program 2: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000440)=@updpolicy={0xb8, 0x19, 0x523, 0x0, 0x0, {{@in=@multicast2, @in6=@empty={[0x0, 0x0, 0x0, 0x0, 0x8]}, 0x0, 0x0, 0x0, 0x0, 0xa}}}, 0xb8}}, 0x0) 04:02:12 executing program 4: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) recvmsg(0xffffffffffffffff, &(0x7f00000036c0)={&(0x7f0000000180)=@can, 0xfd28, &(0x7f00000035c0), 0x0, &(0x7f0000003680)=""/41, 0x29}, 0x0) bind$alg(r0, &(0x7f0000001300)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb(blowfish)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000ff8000)="0a0775b0", 0x4) r1 = accept$alg(r0, 0x0, 0x0) sendmmsg$alg(r1, &(0x7f0000003e80)=[{0x0, 0x0, &(0x7f0000002a80), 0x167, &(0x7f0000000100)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x0) recvmsg(r1, &(0x7f0000000000)={0x0, 0xfffffff0, &(0x7f0000000140)=[{&(0x7f0000000200)=""/4096, 0x1000}], 0x1, &(0x7f0000fb3fa9)=""/87, 0x57}, 0x0) 04:02:12 executing program 5: r0 = socket$inet6(0xa, 0x2, 0x0) r1 = syz_open_dev$mice(&(0x7f00000002c0)='/dev/input/mice\x00', 0x0, 0x0) ioctl$PPPOEIOCDFWD(r1, 0xb101, 0x0) syz_genetlink_get_family_id$nbd(&(0x7f0000000480)='nbd\x00') getsockopt$inet6_IPV6_XFRM_POLICY(r0, 0x29, 0x23, &(0x7f0000000340)={{{@in=@local, @in=@loopback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@local}, 0x0, @in=@remote}}, &(0x7f0000000140)=0xe8) connect$can_bcm(0xffffffffffffffff, &(0x7f00000001c0), 0x10) bind$inet6(r0, &(0x7f0000000040)={0xa, 0x4e24}, 0x1c) lsetxattr$security_ima(&(0x7f0000000280)='./file0\x00', &(0x7f0000000440)='security.ima\x00', 0x0, 0x0, 0x1) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clock_gettime(0x0, &(0x7f0000000100)={0x0, 0x0}) r4 = openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) bind(r4, &(0x7f0000000580)=@can={0x1d, r2}, 0x80) clock_gettime(0x3, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff}) ppoll(&(0x7f0000000000)=[{r0, 0x41a}], 0x1, &(0x7f0000000200)={0x0, r3+30000000}, &(0x7f0000000240)={0x8000000}, 0x8) connect$inet6(r0, &(0x7f0000000080)={0xa, 0x4e24, 0x0, @ipv4={[], [], @loopback}}, 0x1c) readv(0xffffffffffffffff, 0x0, 0x0) sendmmsg(r0, &(0x7f00000092c0), 0x4ff, 0x0) connect$pptp(r5, &(0x7f00000004c0)={0x18, 0x2, {0x0, @multicast1}}, 0x1e) 04:02:12 executing program 1: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) recvmsg(0xffffffffffffffff, &(0x7f00000036c0)={&(0x7f0000000180)=@can, 0xfd28, &(0x7f00000035c0), 0x0, &(0x7f0000003680)=""/41, 0x29}, 0x0) bind$alg(r0, &(0x7f0000001300)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb(blowfish)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000ff8000)="0a0775b0", 0x4) r1 = accept$alg(r0, 0x0, 0x0) sendmmsg$alg(r1, &(0x7f0000003e80)=[{0x0, 0x0, &(0x7f0000002a80), 0x167, &(0x7f0000000100)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x0) recvmsg(r1, &(0x7f0000000000)={&(0x7f0000f7ffa8)=@alg, 0x80, &(0x7f0000000140)=[{&(0x7f0000000200)=""/4096, 0x1000}], 0x1, 0x0, 0x8}, 0x0) 04:02:12 executing program 2: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000440)=@updpolicy={0xb8, 0x19, 0x523, 0x0, 0x0, {{@in=@multicast2, @in6=@empty={[0x0, 0x0, 0x0, 0x0, 0xa]}, 0x0, 0x0, 0x0, 0x0, 0xa}}}, 0xb8}}, 0x0) 04:02:12 executing program 0: r0 = perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) setxattr$security_smack_entry(&(0x7f0000000380)='./file0\x00', &(0x7f0000000480)='security.SMACK64IPIN\x00', &(0x7f0000000540)='^vboxnet1^\x00', 0xb, 0x1) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r1, &(0x7f0000000040), 0x0}, 0x20) unlink(&(0x7f0000000900)='./file0/file0\x00') r2 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r3 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r3, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, &(0x7f00000006c0)) ioctl$BINDER_GET_NODE_DEBUG_INFO(r2, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f00000000c0)=[@enter_looper], 0x48, 0x0, &(0x7f0000000700)="2ba063fb309ec7fdbfb08e6e91baee7d7d4599fe14129a4d426834556ae420e087d59c0c7be7fcad1abb7e1f8f446f373f611ca1ee9c2231708e18a47bc68a2a79a0b48931f6ff6d"}) ioctl$BINDER_SET_CONTEXT_MGR(r3, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x1) prctl$PR_SET_NAME(0xf, &(0x7f00000004c0)='/group.stat\x00') ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, &(0x7f0000000780)}) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f0000000680)}) ioctl$FS_IOC_FIEMAP(r3, 0xc020660b, &(0x7f0000000b80)=ANY=[@ANYBLOB="0000010000000000200000000000000005000000010000000a00000000000000ff030000000000001a0a000000000000050000000000000000000000000000000000000000000000080000000000000000000000000000000800000000000000ffff0000000000000100008000000000000000000000000000000000000000000000000000000000000000000000000008000000000000003f0000000000000008000000000000000000000000000000000000000000800800000000000000000000000000000200000000000000000400000000000000000000010000000000000000000000000000000000000002110000000000000000000000000000cc0000000000000000000000000000001b0000000000000000000000000000000000000000000000841400000000000000000000000000000300000000000000feffffffffffffff000000000000000000000000000000000000000000000000020000000000000000000000000000000600000000000000ff01000000000000040000000000000000000000000000000000000000000000000400000000000000000000000000007be70000000000000900000000000000ff7f0000000000000000000000000000000000000000000004180000000000000000000000000000ffffffff0000000081000000000000000600000000000000000000000000000000000000000000000400000000000000000000000000000002000000000000000500000000000000ff7fffffffffffff0000000000000000000000000000000004040000000000000000000000000000"]) r4 = creat(&(0x7f00000000c0)='./file0\x00', 0x0) openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000100)='/group.stat\x00', 0x2761, 0x0) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000080), 0xffffffffffffffff) getpid() fallocate(r0, 0x0, 0x0, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x2f, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) memfd_create(&(0x7f0000000080)='!proccgroup\x00', 0x0) ioctl$sock_inet_SIOCSIFPFLAGS(0xffffffffffffffff, 0x8934, &(0x7f0000000400)={'veth0_to_bridge\x00', 0x100}) accept(r4, &(0x7f0000000580)=@alg, &(0x7f0000000600)=0x80) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x2400, 0x8000) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000008c0)={0x2c, 0x0, &(0x7f0000000780)=[@acquire_done={0x40106309, 0x0, 0x2}, @clear_death={0x400c630f, 0x1, 0x3}, @release={0x40046306, 0x2}], 0xc1, 0x0, &(0x7f00000007c0)="859547f83b9b058a973a491d7e6378544744f2b56b02270a2f78214a936e9afb25cd94695643af6563f86771aa9621b9f30f2ca538b018247a633c28ee01e03b4639679311117971e60dc1538f34e961ae301463172c41754be988f6beb0ce4d83c69f86c236d29520e6cdaf5dbb60404c66d63315ff287deac8632781d0197ef1f81314da0a1ed90b681842cf85a41b496ce0a7a6f5aa4b9b23483eea8861be89b3398c6aec3349174f9cdc9de34df361ac9bf7afd8566849487c3c0a1e3aaacd"}) 04:02:12 executing program 4: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) recvmsg(0xffffffffffffffff, &(0x7f00000036c0)={&(0x7f0000000180)=@can, 0xfd28, &(0x7f00000035c0), 0x0, &(0x7f0000003680)=""/41, 0x29}, 0x0) bind$alg(r0, &(0x7f0000001300)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb(blowfish)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000ff8000)="0a0775b0", 0x4) r1 = accept$alg(r0, 0x0, 0x0) sendmmsg$alg(r1, &(0x7f0000003e80)=[{0x0, 0x0, &(0x7f0000002a80), 0x167, &(0x7f0000000100)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x0) recvmsg(r1, &(0x7f0000000000)={0x0, 0x10000000000000, &(0x7f0000000140)=[{&(0x7f0000000200)=""/4096, 0x1000}], 0x1, &(0x7f0000fb3fa9)=""/87, 0x57}, 0x0) 04:02:12 executing program 3: socketpair$unix(0x1, 0xfffffffffffffffe, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) creat(&(0x7f0000000040)='./bus\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f0000000100)={[{@lowerdir={'lowerdir', 0x3d, './bus'}, 0x3a}]}) 04:02:13 executing program 3: r0 = socket$inet6_sctp(0xa, 0x5, 0x84) setsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX(r0, 0x84, 0x6e, &(0x7f0000961fe4)=[@in6={0xa, 0x0, 0x0, @remote={0xfe, 0x80, [], 0xffffffffffffffff}, 0x100000001}], 0x1c) getsockopt$inet_sctp6_SCTP_GET_ASSOC_ID_LIST(r0, 0x84, 0x1d, &(0x7f0000000000)=ANY=[@ANYBLOB="ff", @ANYRES32=0x0], &(0x7f0000000180)=0xf860) getsockopt$inet_sctp6_SCTP_SOCKOPT_PEELOFF(r0, 0x84, 0x14, &(0x7f0000000140)={r1}, &(0x7f000095c000)=0xa5) 04:02:13 executing program 2: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000440)=@updpolicy={0xb8, 0x19, 0x523, 0x0, 0x0, {{@in=@multicast2, @in6=@empty={[0x0, 0x0, 0x0, 0x0, 0xe]}, 0x0, 0x0, 0x0, 0x0, 0xa}}}, 0xb8}}, 0x0) [ 647.236602] binder: 22819:22822 ioctl c018620b 0 returned -14 [ 647.256707] overlayfs: './bus' not a directory 04:02:13 executing program 4: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) recvmsg(0xffffffffffffffff, &(0x7f00000036c0)={&(0x7f0000000180)=@can, 0xfd28, &(0x7f00000035c0), 0x0, &(0x7f0000003680)=""/41, 0x29}, 0x0) bind$alg(r0, &(0x7f0000001300)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb(blowfish)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000ff8000)="0a0775b0", 0x4) r1 = accept$alg(r0, 0x0, 0x0) sendmmsg$alg(r1, &(0x7f0000003e80)=[{0x0, 0x0, &(0x7f0000002a80), 0x167, &(0x7f0000000100)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x0) recvmsg(r1, &(0x7f0000000000)={0x0, 0x700000000000000, &(0x7f0000000140)=[{&(0x7f0000000200)=""/4096, 0x1000}], 0x1, &(0x7f0000fb3fa9)=""/87, 0x57}, 0x0) 04:02:13 executing program 1: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) recvmsg(0xffffffffffffffff, &(0x7f00000036c0)={&(0x7f0000000180)=@can, 0xfd28, &(0x7f00000035c0), 0x0, &(0x7f0000003680)=""/41, 0x29}, 0x0) bind$alg(r0, &(0x7f0000001300)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb(blowfish)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000ff8000)="0a0775b0", 0x4) r1 = accept$alg(r0, 0x0, 0x0) sendmmsg$alg(r1, &(0x7f0000003e80)=[{0x0, 0x0, &(0x7f0000002a80), 0x167, &(0x7f0000000100)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x0) recvmsg(r1, &(0x7f0000000000)={&(0x7f0000f7ffa8)=@alg, 0x80, &(0x7f0000000140)=[{&(0x7f0000000200)=""/4096, 0x1000}], 0x1, 0x0, 0x10}, 0x0) 04:02:13 executing program 2: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000440)=@updpolicy={0xb8, 0x19, 0x523, 0x0, 0x0, {{@in=@multicast2, @in6=@empty={[0x0, 0x0, 0x0, 0x0, 0xf]}, 0x0, 0x0, 0x0, 0x0, 0xa}}}, 0xb8}}, 0x0) 04:02:13 executing program 4: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) recvmsg(0xffffffffffffffff, &(0x7f00000036c0)={&(0x7f0000000180)=@can, 0xfd28, &(0x7f00000035c0), 0x0, &(0x7f0000003680)=""/41, 0x29}, 0x0) bind$alg(r0, &(0x7f0000001300)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb(blowfish)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000ff8000)="0a0775b0", 0x4) r1 = accept$alg(r0, 0x0, 0x0) sendmmsg$alg(r1, &(0x7f0000003e80)=[{0x0, 0x0, &(0x7f0000002a80), 0x167, &(0x7f0000000100)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x0) recvmsg(r1, &(0x7f0000000000)={0x0, 0x800000000000000, &(0x7f0000000140)=[{&(0x7f0000000200)=""/4096, 0x1000}], 0x1, &(0x7f0000fb3fa9)=""/87, 0x57}, 0x0) 04:02:13 executing program 5: r0 = socket$inet6(0xa, 0x2, 0x0) r1 = syz_open_dev$mice(&(0x7f00000002c0)='/dev/input/mice\x00', 0x0, 0x0) ioctl$PPPOEIOCDFWD(r1, 0xb101, 0x0) syz_genetlink_get_family_id$nbd(&(0x7f0000000480)='nbd\x00') getsockopt$inet6_IPV6_XFRM_POLICY(r0, 0x29, 0x23, &(0x7f0000000340)={{{@in=@local, @in=@loopback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@local}, 0x0, @in=@remote}}, &(0x7f0000000140)=0xe8) connect$can_bcm(0xffffffffffffffff, &(0x7f00000001c0), 0x10) bind$inet6(r0, &(0x7f0000000040)={0xa, 0x4e24}, 0x1c) lsetxattr$security_ima(&(0x7f0000000280)='./file0\x00', &(0x7f0000000440)='security.ima\x00', 0x0, 0x0, 0x1) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clock_gettime(0x0, &(0x7f0000000100)={0x0, 0x0}) r4 = openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) bind(r4, &(0x7f0000000580)=@can={0x1d, r2}, 0x80) clock_gettime(0x3, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff}) ppoll(&(0x7f0000000000)=[{r0, 0x41a}], 0x1, &(0x7f0000000200)={0x0, r3+30000000}, &(0x7f0000000240)={0x20000000}, 0x8) connect$inet6(r0, &(0x7f0000000080)={0xa, 0x4e24, 0x0, @ipv4={[], [], @loopback}}, 0x1c) readv(0xffffffffffffffff, 0x0, 0x0) sendmmsg(r0, &(0x7f00000092c0), 0x4ff, 0x0) connect$pptp(r5, &(0x7f00000004c0)={0x18, 0x2, {0x0, @multicast1}}, 0x1e) 04:02:13 executing program 0: r0 = perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) setxattr$security_smack_entry(&(0x7f0000000380)='./file0\x00', &(0x7f0000000480)='security.SMACK64IPIN\x00', &(0x7f0000000540)='^vboxnet1^\x00', 0xb, 0x1) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r1, &(0x7f0000000040), 0x0}, 0x20) unlink(&(0x7f0000000900)='./file0/file0\x00') r2 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r3 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r3, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, &(0x7f00000006c0)) ioctl$BINDER_GET_NODE_DEBUG_INFO(r2, 0xc018620b, &(0x7f0000000640)={0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f00000000c0)=[@enter_looper], 0x48, 0x0, &(0x7f0000000700)="2ba063fb309ec7fdbfb08e6e91baee7d7d4599fe14129a4d426834556ae420e087d59c0c7be7fcad1abb7e1f8f446f373f611ca1ee9c2231708e18a47bc68a2a79a0b48931f6ff6d"}) ioctl$BINDER_SET_CONTEXT_MGR(r3, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x1) prctl$PR_SET_NAME(0xf, &(0x7f00000004c0)='/group.stat\x00') ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, &(0x7f0000000780)}) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f0000000680)}) ioctl$FS_IOC_FIEMAP(r3, 0xc020660b, &(0x7f0000000b80)=ANY=[@ANYBLOB="0000010000000000200000000000000005000000010000000a00000000000000ff030000000000001a0a000000000000050000000000000000000000000000000000000000000000080000000000000000000000000000000800000000000000ffff0000000000000100008000000000000000000000000000000000000000000000000000000000000000000000000008000000000000003f0000000000000008000000000000000000000000000000000000000000800800000000000000000000000000000200000000000000000400000000000000000000010000000000000000000000000000000000000002110000000000000000000000000000cc0000000000000000000000000000001b0000000000000000000000000000000000000000000000841400000000000000000000000000000300000000000000feffffffffffffff000000000000000000000000000000000000000000000000020000000000000000000000000000000600000000000000ff01000000000000040000000000000000000000000000000000000000000000000400000000000000000000000000007be70000000000000900000000000000ff7f0000000000000000000000000000000000000000000004180000000000000000000000000000ffffffff0000000081000000000000000600000000000000000000000000000000000000000000000400000000000000000000000000000002000000000000000500000000000000ff7fffffffffffff0000000000000000000000000000000004040000000000000000000000000000"]) r5 = creat(&(0x7f00000000c0)='./file0\x00', 0x0) openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000100)='/group.stat\x00', 0x2761, 0x0) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000080), 0xffffffffffffffff) getpid() fallocate(r0, 0x0, 0x0, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x2f, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) memfd_create(&(0x7f0000000080)='!proccgroup\x00', 0x0) ioctl$sock_inet_SIOCSIFPFLAGS(0xffffffffffffffff, 0x8934, &(0x7f0000000400)={'veth0_to_bridge\x00', 0x100}) accept(r5, &(0x7f0000000580)=@alg, &(0x7f0000000600)=0x80) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x2400, 0x8000) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000008c0)={0x2c, 0x0, &(0x7f0000000780)=[@acquire_done={0x40106309, r4, 0x2}, @clear_death={0x400c630f, 0x1, 0x3}, @release={0x40046306, 0x2}], 0xc1, 0x0, &(0x7f00000007c0)="859547f83b9b058a973a491d7e6378544744f2b56b02270a2f78214a936e9afb25cd94695643af6563f86771aa9621b9f30f2ca538b018247a633c28ee01e03b4639679311117971e60dc1538f34e961ae301463172c41754be988f6beb0ce4d83c69f86c236d29520e6cdaf5dbb60404c66d63315ff287deac8632781d0197ef1f81314da0a1ed90b681842cf85a41b496ce0a7a6f5aa4b9b23483eea8861be89b3398c6aec3349174f9cdc9de34df361ac9bf7afd8566849487c3c0a1e3aaacd"}) 04:02:13 executing program 2: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000440)=@updpolicy={0xb8, 0x19, 0x523, 0x0, 0x0, {{@in=@multicast2, @in6=@empty={[0x0, 0x0, 0x0, 0x0, 0x10]}, 0x0, 0x0, 0x0, 0x0, 0xa}}}, 0xb8}}, 0x0) 04:02:13 executing program 1: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) recvmsg(0xffffffffffffffff, &(0x7f00000036c0)={&(0x7f0000000180)=@can, 0xfd28, &(0x7f00000035c0), 0x0, &(0x7f0000003680)=""/41, 0x29}, 0x0) bind$alg(r0, &(0x7f0000001300)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb(blowfish)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000ff8000)="0a0775b0", 0x4) r1 = accept$alg(r0, 0x0, 0x0) sendmmsg$alg(r1, &(0x7f0000003e80)=[{0x0, 0x0, &(0x7f0000002a80), 0x167, &(0x7f0000000100)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x0) recvmsg(r1, &(0x7f0000000000)={&(0x7f0000f7ffa8)=@alg, 0x80, &(0x7f0000000140)=[{&(0x7f0000000200)=""/4096, 0x1000}], 0x1, 0x0, 0x700}, 0x0) 04:02:13 executing program 4: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) recvmsg(0xffffffffffffffff, &(0x7f00000036c0)={&(0x7f0000000180)=@can, 0xfd28, &(0x7f00000035c0), 0x0, &(0x7f0000003680)=""/41, 0x29}, 0x0) bind$alg(r0, &(0x7f0000001300)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb(blowfish)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000ff8000)="0a0775b0", 0x4) r1 = accept$alg(r0, 0x0, 0x0) sendmmsg$alg(r1, &(0x7f0000003e80)=[{0x0, 0x0, &(0x7f0000002a80), 0x167, &(0x7f0000000100)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x0) recvmsg(r1, &(0x7f0000000000)={0x0, 0x1000000000000000, &(0x7f0000000140)=[{&(0x7f0000000200)=""/4096, 0x1000}], 0x1, &(0x7f0000fb3fa9)=""/87, 0x57}, 0x0) 04:02:13 executing program 1: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) recvmsg(0xffffffffffffffff, &(0x7f00000036c0)={&(0x7f0000000180)=@can, 0xfd28, &(0x7f00000035c0), 0x0, &(0x7f0000003680)=""/41, 0x29}, 0x0) bind$alg(r0, &(0x7f0000001300)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb(blowfish)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000ff8000)="0a0775b0", 0x4) r1 = accept$alg(r0, 0x0, 0x0) sendmmsg$alg(r1, &(0x7f0000003e80)=[{0x0, 0x0, &(0x7f0000002a80), 0x167, &(0x7f0000000100)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x0) recvmsg(r1, &(0x7f0000000000)={&(0x7f0000f7ffa8)=@alg, 0x80, &(0x7f0000000140)=[{&(0x7f0000000200)=""/4096, 0x1000}], 0x1, 0x0, 0x1f00}, 0x0) [ 648.084326] net_ratelimit: 20 callbacks suppressed [ 648.084336] protocol 88fb is buggy, dev hsr_slave_0 [ 648.094516] protocol 88fb is buggy, dev hsr_slave_1 04:02:13 executing program 2: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000440)=@updpolicy={0xb8, 0x19, 0x523, 0x0, 0x0, {{@in=@multicast2, @in6=@empty={[0x0, 0x0, 0x0, 0x0, 0x2f]}, 0x0, 0x0, 0x0, 0x0, 0xa}}}, 0xb8}}, 0x0) 04:02:13 executing program 3: r0 = socket$inet6(0xa, 0x1000000000002, 0x7) ioctl(r0, 0x8912, &(0x7f0000000240)="0047fc2f07d82c99240970") r1 = socket(0x10, 0x802, 0x0) setsockopt$inet_sctp6_SCTP_INITMSG(r1, 0x84, 0x2, &(0x7f0000000000)={0x4, 0x5, 0x8}, 0x8) write(r1, &(0x7f0000294f74)="fc00000048000700ab092500090007000aab80ff010000000000369321000100ff010000000500000000000000036915fa2c1ec28656aaa79bb94b46fe0000000700020800008c0000036c6c256f1a272f2e117c22ebc205214000000000008934d07302ade01720d7d5bbc91a3e2e80772c74fb2cc56ce1f0f156272f5b00000005defd5a32e280fc83ab82f605f70c9ddef2fe082038f4f8b29d3ef3d92c83170e5bbab2ccd243f295ed94e0ad91bd0734babc7c3f2eeb57d43dd16b17e583df150c3b880f411f46a6b567b4d5715587e658a1ad0a4f01731d05b0350b0041f0d48f6f0000080548deac270e33429fd3000175e63fb8d38a873cf1", 0xfc) 04:02:13 executing program 4: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) recvmsg(0xffffffffffffffff, &(0x7f00000036c0)={&(0x7f0000000180)=@can, 0xfd28, &(0x7f00000035c0), 0x0, &(0x7f0000003680)=""/41, 0x29}, 0x0) bind$alg(r0, &(0x7f0000001300)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb(blowfish)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000ff8000)="0a0775b0", 0x4) r1 = accept$alg(r0, 0x0, 0x0) sendmmsg$alg(r1, &(0x7f0000003e80)=[{0x0, 0x0, &(0x7f0000002a80), 0x167, &(0x7f0000000100)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x0) recvmsg(r1, &(0x7f0000000000)={0x0, 0x1f00000000000000, &(0x7f0000000140)=[{&(0x7f0000000200)=""/4096, 0x1000}], 0x1, &(0x7f0000fb3fa9)=""/87, 0x57}, 0x0) [ 648.164323] protocol 88fb is buggy, dev hsr_slave_0 [ 648.169457] protocol 88fb is buggy, dev hsr_slave_1 [ 648.174645] protocol 88fb is buggy, dev hsr_slave_0 [ 648.179704] protocol 88fb is buggy, dev hsr_slave_1 04:02:14 executing program 1: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) recvmsg(0xffffffffffffffff, &(0x7f00000036c0)={&(0x7f0000000180)=@can, 0xfd28, &(0x7f00000035c0), 0x0, &(0x7f0000003680)=""/41, 0x29}, 0x0) bind$alg(r0, &(0x7f0000001300)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb(blowfish)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000ff8000)="0a0775b0", 0x4) r1 = accept$alg(r0, 0x0, 0x0) sendmmsg$alg(r1, &(0x7f0000003e80)=[{0x0, 0x0, &(0x7f0000002a80), 0x167, &(0x7f0000000100)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x0) recvmsg(r1, &(0x7f0000000000)={&(0x7f0000f7ffa8)=@alg, 0x80, &(0x7f0000000140)=[{&(0x7f0000000200)=""/4096, 0x1000}], 0x1, 0x0, 0x100000}, 0x0) 04:02:14 executing program 4: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) recvmsg(0xffffffffffffffff, &(0x7f00000036c0)={&(0x7f0000000180)=@can, 0xfd28, &(0x7f00000035c0), 0x0, &(0x7f0000003680)=""/41, 0x29}, 0x0) bind$alg(r0, &(0x7f0000001300)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb(blowfish)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000ff8000)="0a0775b0", 0x4) r1 = accept$alg(r0, 0x0, 0x0) sendmmsg$alg(r1, &(0x7f0000003e80)=[{0x0, 0x0, &(0x7f0000002a80), 0x167, &(0x7f0000000100)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x0) recvmsg(r1, &(0x7f0000000000)={0x0, 0x8000000000000000, &(0x7f0000000140)=[{&(0x7f0000000200)=""/4096, 0x1000}], 0x1, &(0x7f0000fb3fa9)=""/87, 0x57}, 0x0) 04:02:14 executing program 2: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000440)=@updpolicy={0xb8, 0x19, 0x523, 0x0, 0x0, {{@in=@multicast2, @in6=@empty={[0x0, 0x0, 0x0, 0x0, 0x60]}, 0x0, 0x0, 0x0, 0x0, 0xa}}}, 0xb8}}, 0x0) [ 648.297718] netlink: 180 bytes leftover after parsing attributes in process `syz-executor3'. [ 648.374138] netlink: 180 bytes leftover after parsing attributes in process `syz-executor3'. 04:02:14 executing program 5: r0 = socket$inet6(0xa, 0x2, 0x0) r1 = syz_open_dev$mice(&(0x7f00000002c0)='/dev/input/mice\x00', 0x0, 0x0) ioctl$PPPOEIOCDFWD(r1, 0xb101, 0x0) syz_genetlink_get_family_id$nbd(&(0x7f0000000480)='nbd\x00') getsockopt$inet6_IPV6_XFRM_POLICY(r0, 0x29, 0x23, &(0x7f0000000340)={{{@in=@local, @in=@loopback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@local}, 0x0, @in=@remote}}, &(0x7f0000000140)=0xe8) connect$can_bcm(0xffffffffffffffff, &(0x7f00000001c0), 0x10) bind$inet6(r0, &(0x7f0000000040)={0xa, 0x4e24}, 0x1c) lsetxattr$security_ima(&(0x7f0000000280)='./file0\x00', &(0x7f0000000440)='security.ima\x00', 0x0, 0x0, 0x1) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clock_gettime(0x0, &(0x7f0000000100)={0x0, 0x0}) r4 = openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) bind(r4, &(0x7f0000000580)=@can={0x1d, r2}, 0x80) clock_gettime(0x3, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff}) ppoll(&(0x7f0000000000)=[{r0, 0x41a}], 0x1, &(0x7f0000000200)={0x0, r3+30000000}, &(0x7f0000000240)={0x3f000000}, 0x8) connect$inet6(r0, &(0x7f0000000080)={0xa, 0x4e24, 0x0, @ipv4={[], [], @loopback}}, 0x1c) readv(0xffffffffffffffff, 0x0, 0x0) sendmmsg(r0, &(0x7f00000092c0), 0x4ff, 0x0) connect$pptp(r5, &(0x7f00000004c0)={0x18, 0x2, {0x0, @multicast1}}, 0x1e) 04:02:14 executing program 0: r0 = perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) setxattr$security_smack_entry(&(0x7f0000000380)='./file0\x00', &(0x7f0000000480)='security.SMACK64IPIN\x00', &(0x7f0000000540)='^vboxnet1^\x00', 0xb, 0x1) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r1, &(0x7f0000000040), 0x0}, 0x20) unlink(&(0x7f0000000900)='./file0/file0\x00') r2 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r3 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r3, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, &(0x7f00000006c0)) ioctl$BINDER_GET_NODE_DEBUG_INFO(r2, 0xc018620b, &(0x7f0000000640)={0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f00000000c0)=[@enter_looper], 0x48, 0x0, &(0x7f0000000700)="2ba063fb309ec7fdbfb08e6e91baee7d7d4599fe14129a4d426834556ae420e087d59c0c7be7fcad1abb7e1f8f446f373f611ca1ee9c2231708e18a47bc68a2a79a0b48931f6ff6d"}) ioctl$BINDER_SET_CONTEXT_MGR(r3, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x1) prctl$PR_SET_NAME(0xf, &(0x7f00000004c0)='/group.stat\x00') ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, &(0x7f0000000780)}) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f0000000680)}) ioctl$FS_IOC_FIEMAP(r3, 0xc020660b, &(0x7f0000000b80)=ANY=[@ANYBLOB="0000010000000000200000000000000005000000010000000a00000000000000ff030000000000001a0a000000000000050000000000000000000000000000000000000000000000080000000000000000000000000000000800000000000000ffff0000000000000100008000000000000000000000000000000000000000000000000000000000000000000000000008000000000000003f0000000000000008000000000000000000000000000000000000000000800800000000000000000000000000000200000000000000000400000000000000000000010000000000000000000000000000000000000002110000000000000000000000000000cc0000000000000000000000000000001b0000000000000000000000000000000000000000000000841400000000000000000000000000000300000000000000feffffffffffffff000000000000000000000000000000000000000000000000020000000000000000000000000000000600000000000000ff01000000000000040000000000000000000000000000000000000000000000000400000000000000000000000000007be70000000000000900000000000000ff7f0000000000000000000000000000000000000000000004180000000000000000000000000000ffffffff0000000081000000000000000600000000000000000000000000000000000000000000000400000000000000000000000000000002000000000000000500000000000000ff7fffffffffffff0000000000000000000000000000000004040000000000000000000000000000"]) r5 = creat(&(0x7f00000000c0)='./file0\x00', 0x0) openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000100)='/group.stat\x00', 0x2761, 0x0) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000080), 0xffffffffffffffff) getpid() fallocate(r0, 0x0, 0x0, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x2f, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) memfd_create(&(0x7f0000000080)='!proccgroup\x00', 0x0) ioctl$sock_inet_SIOCSIFPFLAGS(0xffffffffffffffff, 0x8934, &(0x7f0000000400)={'veth0_to_bridge\x00', 0x100}) accept(r5, &(0x7f0000000580)=@alg, &(0x7f0000000600)=0x80) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x2400, 0x8000) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000008c0)={0x2c, 0x0, &(0x7f0000000780)=[@acquire_done={0x40106309, r4, 0x2}, @clear_death={0x400c630f, 0x1, 0x3}, @release={0x40046306, 0x2}], 0xc1, 0x0, &(0x7f00000007c0)="859547f83b9b058a973a491d7e6378544744f2b56b02270a2f78214a936e9afb25cd94695643af6563f86771aa9621b9f30f2ca538b018247a633c28ee01e03b4639679311117971e60dc1538f34e961ae301463172c41754be988f6beb0ce4d83c69f86c236d29520e6cdaf5dbb60404c66d63315ff287deac8632781d0197ef1f81314da0a1ed90b681842cf85a41b496ce0a7a6f5aa4b9b23483eea8861be89b3398c6aec3349174f9cdc9de34df361ac9bf7afd8566849487c3c0a1e3aaacd"}) 04:02:14 executing program 3: preadv(0xffffffffffffffff, &(0x7f0000001380), 0x150, 0x0) ioctl$TIOCGPGRP(0xffffffffffffffff, 0x540f, &(0x7f0000000080)=0x0) r1 = syz_open_procfs(r0, &(0x7f0000000100)='login\x81(d\x00') socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x8000000000010000) preadv(r1, &(0x7f0000000480), 0x1000000000000177, 0x0) 04:02:14 executing program 1: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) recvmsg(0xffffffffffffffff, &(0x7f00000036c0)={&(0x7f0000000180)=@can, 0xfd28, &(0x7f00000035c0), 0x0, &(0x7f0000003680)=""/41, 0x29}, 0x0) bind$alg(r0, &(0x7f0000001300)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb(blowfish)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000ff8000)="0a0775b0", 0x4) r1 = accept$alg(r0, 0x0, 0x0) sendmmsg$alg(r1, &(0x7f0000003e80)=[{0x0, 0x0, &(0x7f0000002a80), 0x167, &(0x7f0000000100)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x0) recvmsg(r1, &(0x7f0000000000)={&(0x7f0000f7ffa8)=@alg, 0x80, &(0x7f0000000140)=[{&(0x7f0000000200)=""/4096, 0x1000}], 0x1, 0x0, 0x7000000}, 0x0) 04:02:14 executing program 2: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000440)=@updpolicy={0xb8, 0x19, 0x523, 0x0, 0x0, {{@in=@multicast2, @in6=@empty={[0x0, 0x0, 0x0, 0x0, 0xf0]}, 0x0, 0x0, 0x0, 0x0, 0xa}}}, 0xb8}}, 0x0) 04:02:14 executing program 4: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) recvmsg(0xffffffffffffffff, &(0x7f00000036c0)={&(0x7f0000000180)=@can, 0xfd28, &(0x7f00000035c0), 0x0, &(0x7f0000003680)=""/41, 0x29}, 0x0) bind$alg(r0, &(0x7f0000001300)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb(blowfish)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000ff8000)="0a0775b0", 0x4) r1 = accept$alg(r0, 0x0, 0x0) sendmmsg$alg(r1, &(0x7f0000003e80)=[{0x0, 0x0, &(0x7f0000002a80), 0x167, &(0x7f0000000100)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x0) recvmsg(r1, &(0x7f0000000000)={0x0, 0x8dffffff00000000, &(0x7f0000000140)=[{&(0x7f0000000200)=""/4096, 0x1000}], 0x1, &(0x7f0000fb3fa9)=""/87, 0x57}, 0x0) 04:02:14 executing program 3: perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000001f}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmsg$IPVS_CMD_DEL_DAEMON(0xffffffffffffffff, &(0x7f00000008c0)={&(0x7f0000000780), 0xc, 0x0}, 0x0) openat$ipvs(0xffffffffffffff9c, &(0x7f0000000240)='/proc/sys/net/ipv4/vs/conntrack\x00', 0x2, 0x0) pipe2(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}, 0x84000) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000400)='./cgroup.net/syz1\x00', 0x200002, 0x0) syz_genetlink_get_family_id$ipvs(&(0x7f0000000840)='IPVS\x00') sendmsg$IPVS_CMD_FLUSH(r1, &(0x7f0000000500)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x8410}, 0xc, &(0x7f0000000280)={&(0x7f00000002c0)=ANY=[@ANYBLOB="6299aa31167461849bac0dcb9cf7c2f054e3cd25cc1852dfa58a4ee3a2fdc1276947d6a3aae270eceb075d9ee03a3a4b7dc708dc8ed746ddbc36b0fc2d8532e37e46f32504c549b28db29a80c4b32b299d5642510a8ee5f61d97b6218073470d0cfe8cfd6661b855cea1a1d87fa0447c3e15519a52ba9b6ec3bc556a4d017fc2e941b2fdd954a62d44815385dcb4288032f58cac4a43a5c6a9cd68931b685e0f18d3e9b4493c74f332909b260b129416f31bdea316c69ea10244502077f28da11c88729c23c5ca171ab97db69287a7f5b39e3bd1e593b5b5ac2bbd8cea0fea02c61af77d13144d1572862aa34d344cf26c140b27013b744a2e0ba5e7a4799bf6eb49e1122f1a32c71cf5ea998dc1fbce6df5349f385c8bb18962f5a5fc74eff96d000000000000000000000000000000"], 0x1}, 0x1, 0x0, 0x0, 0x80}, 0x4) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$KVM_PPC_GET_SMMU_INFO(r0, 0x8250aea6, &(0x7f0000000040)=""/38) ioctl(0xffffffffffffffff, 0x6, &(0x7f0000000080)="0a5cc80700315f85715070") r2 = syz_open_dev$loop(&(0x7f0000000680)='/dev/loop#\x00', 0x4, 0x800000000105082) pwritev(0xffffffffffffffff, &(0x7f0000f50f90)=[{&(0x7f0000000100)="a8", 0x1}], 0x1, 0x81003) ioctl$LOOP_CHANGE_FD(r2, 0x4c00, 0xffffffffffffffff) sendfile(r2, r2, 0x0, 0x102000000) 04:02:14 executing program 2: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000440)=@updpolicy={0xb8, 0x19, 0x523, 0x0, 0x0, {{@in=@multicast2, @in6=@empty={[0x0, 0x0, 0x0, 0x0, 0x300]}, 0x0, 0x0, 0x0, 0x0, 0xa}}}, 0xb8}}, 0x0) 04:02:14 executing program 1: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) recvmsg(0xffffffffffffffff, &(0x7f00000036c0)={&(0x7f0000000180)=@can, 0xfd28, &(0x7f00000035c0), 0x0, &(0x7f0000003680)=""/41, 0x29}, 0x0) bind$alg(r0, &(0x7f0000001300)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb(blowfish)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000ff8000)="0a0775b0", 0x4) r1 = accept$alg(r0, 0x0, 0x0) sendmmsg$alg(r1, &(0x7f0000003e80)=[{0x0, 0x0, &(0x7f0000002a80), 0x167, &(0x7f0000000100)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x0) recvmsg(r1, &(0x7f0000000000)={&(0x7f0000f7ffa8)=@alg, 0x80, &(0x7f0000000140)=[{&(0x7f0000000200)=""/4096, 0x1000}], 0x1, 0x0, 0x8000000}, 0x0) 04:02:14 executing program 4: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) recvmsg(0xffffffffffffffff, &(0x7f00000036c0)={&(0x7f0000000180)=@can, 0xfd28, &(0x7f00000035c0), 0x0, &(0x7f0000003680)=""/41, 0x29}, 0x0) bind$alg(r0, &(0x7f0000001300)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb(blowfish)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000ff8000)="0a0775b0", 0x4) r1 = accept$alg(r0, 0x0, 0x0) sendmmsg$alg(r1, &(0x7f0000003e80)=[{0x0, 0x0, &(0x7f0000002a80), 0x167, &(0x7f0000000100)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x0) recvmsg(r1, &(0x7f0000000000)={0x0, 0xf0ffffff00000000, &(0x7f0000000140)=[{&(0x7f0000000200)=""/4096, 0x1000}], 0x1, &(0x7f0000fb3fa9)=""/87, 0x57}, 0x0) [ 649.124351] protocol 88fb is buggy, dev hsr_slave_0 [ 649.129476] protocol 88fb is buggy, dev hsr_slave_1 [ 649.134650] protocol 88fb is buggy, dev hsr_slave_0 [ 649.139725] protocol 88fb is buggy, dev hsr_slave_1 04:02:14 executing program 1: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) recvmsg(0xffffffffffffffff, &(0x7f00000036c0)={&(0x7f0000000180)=@can, 0xfd28, &(0x7f00000035c0), 0x0, &(0x7f0000003680)=""/41, 0x29}, 0x0) bind$alg(r0, &(0x7f0000001300)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb(blowfish)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000ff8000)="0a0775b0", 0x4) r1 = accept$alg(r0, 0x0, 0x0) sendmmsg$alg(r1, &(0x7f0000003e80)=[{0x0, 0x0, &(0x7f0000002a80), 0x167, &(0x7f0000000100)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x0) recvmsg(r1, &(0x7f0000000000)={&(0x7f0000f7ffa8)=@alg, 0x80, &(0x7f0000000140)=[{&(0x7f0000000200)=""/4096, 0x1000}], 0x1, 0x0, 0x10000000}, 0x0) 04:02:14 executing program 2: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000440)=@updpolicy={0xb8, 0x19, 0x523, 0x0, 0x0, {{@in=@multicast2, @in6=@empty={[0x0, 0x0, 0x0, 0x0, 0x324]}, 0x0, 0x0, 0x0, 0x0, 0xa}}}, 0xb8}}, 0x0) 04:02:15 executing program 5: r0 = socket$inet6(0xa, 0x2, 0x0) r1 = syz_open_dev$mice(&(0x7f00000002c0)='/dev/input/mice\x00', 0x0, 0x0) ioctl$PPPOEIOCDFWD(r1, 0xb101, 0x0) syz_genetlink_get_family_id$nbd(&(0x7f0000000480)='nbd\x00') getsockopt$inet6_IPV6_XFRM_POLICY(r0, 0x29, 0x23, &(0x7f0000000340)={{{@in=@local, @in=@loopback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@local}, 0x0, @in=@remote}}, &(0x7f0000000140)=0xe8) connect$can_bcm(0xffffffffffffffff, &(0x7f00000001c0), 0x10) bind$inet6(r0, &(0x7f0000000040)={0xa, 0x4e24}, 0x1c) lsetxattr$security_ima(&(0x7f0000000280)='./file0\x00', &(0x7f0000000440)='security.ima\x00', 0x0, 0x0, 0x1) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clock_gettime(0x0, &(0x7f0000000100)={0x0, 0x0}) r4 = openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) bind(r4, &(0x7f0000000580)=@can={0x1d, r2}, 0x80) clock_gettime(0x3, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff}) ppoll(&(0x7f0000000000)=[{r0, 0x41a}], 0x1, &(0x7f0000000200)={0x0, r3+30000000}, &(0x7f0000000240)={0x59020000}, 0x8) connect$inet6(r0, &(0x7f0000000080)={0xa, 0x4e24, 0x0, @ipv4={[], [], @loopback}}, 0x1c) readv(0xffffffffffffffff, 0x0, 0x0) sendmmsg(r0, &(0x7f00000092c0), 0x4ff, 0x0) connect$pptp(r5, &(0x7f00000004c0)={0x18, 0x2, {0x0, @multicast1}}, 0x1e) 04:02:15 executing program 3: prctl$PR_SET_MM(0x23, 0xb, &(0x7f0000ffa000/0x4000)=nil) setsockopt$IP_VS_SO_SET_TIMEOUT(0xffffffffffffffff, 0x0, 0x48a, &(0x7f0000000040)={0x0, 0xd03}, 0xc) socketpair(0x8000000000001e, 0x5, 0x0, &(0x7f000000dff8)={0xffffffffffffffff, 0xffffffffffffffff}) writev(r0, &(0x7f0000000100)=[{0x0}], 0x1) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x87b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffc, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) writev(r0, &(0x7f0000000240)=[{&(0x7f0000000140)="a3", 0x1}], 0x1) write(r0, &(0x7f0000805000), 0x0) setsockopt$sock_int(r1, 0x1, 0x8, &(0x7f0000000000), 0x4) writev(r0, &(0x7f000063e000)=[{&(0x7f0000a66000)="da", 0x1}], 0x1) signalfd4(0xffffffffffffffff, 0x0, 0x0, 0x0) sendmmsg$alg(r1, &(0x7f0000236fc8)=[{0xc00, 0x0, &(0x7f00000fff80), 0xc, &(0x7f00001e1e78)}], 0x4924924924926c8, 0x101d0) getsockopt$XDP_STATISTICS(0xffffffffffffffff, 0x11b, 0x7, 0x0, 0x0) 04:02:15 executing program 4: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) recvmsg(0xffffffffffffffff, &(0x7f00000036c0)={&(0x7f0000000180)=@can, 0xfd28, &(0x7f00000035c0), 0x0, &(0x7f0000003680)=""/41, 0x29}, 0x0) bind$alg(r0, &(0x7f0000001300)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb(blowfish)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000ff8000)="0a0775b0", 0x4) r1 = accept$alg(r0, 0x0, 0x0) sendmmsg$alg(r1, &(0x7f0000003e80)=[{0x0, 0x0, &(0x7f0000002a80), 0x167, &(0x7f0000000100)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x0) recvmsg(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)=[{&(0x7f0000000200)=""/4096, 0x1000}], 0x1, &(0x7f0000fb3fa9)=""/87, 0x57}, 0x0) 04:02:15 executing program 2: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000440)=@updpolicy={0xb8, 0x19, 0x523, 0x0, 0x0, {{@in=@multicast2, @in6=@empty={[0x0, 0x0, 0x0, 0x0, 0xa00]}, 0x0, 0x0, 0x0, 0x0, 0xa}}}, 0xb8}}, 0x0) 04:02:15 executing program 0: r0 = perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) setxattr$security_smack_entry(&(0x7f0000000380)='./file0\x00', &(0x7f0000000480)='security.SMACK64IPIN\x00', &(0x7f0000000540)='^vboxnet1^\x00', 0xb, 0x1) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r1, &(0x7f0000000040), 0x0}, 0x20) unlink(&(0x7f0000000900)='./file0/file0\x00') r2 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r3 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r3, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, &(0x7f00000006c0)) ioctl$BINDER_GET_NODE_DEBUG_INFO(r2, 0xc018620b, &(0x7f0000000640)={0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f00000000c0)=[@enter_looper], 0x48, 0x0, &(0x7f0000000700)="2ba063fb309ec7fdbfb08e6e91baee7d7d4599fe14129a4d426834556ae420e087d59c0c7be7fcad1abb7e1f8f446f373f611ca1ee9c2231708e18a47bc68a2a79a0b48931f6ff6d"}) ioctl$BINDER_SET_CONTEXT_MGR(r3, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x1) prctl$PR_SET_NAME(0xf, &(0x7f00000004c0)='/group.stat\x00') ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, &(0x7f0000000780)}) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f0000000680)}) ioctl$FS_IOC_FIEMAP(r3, 0xc020660b, &(0x7f0000000b80)=ANY=[@ANYBLOB="0000010000000000200000000000000005000000010000000a00000000000000ff030000000000001a0a000000000000050000000000000000000000000000000000000000000000080000000000000000000000000000000800000000000000ffff0000000000000100008000000000000000000000000000000000000000000000000000000000000000000000000008000000000000003f0000000000000008000000000000000000000000000000000000000000800800000000000000000000000000000200000000000000000400000000000000000000010000000000000000000000000000000000000002110000000000000000000000000000cc0000000000000000000000000000001b0000000000000000000000000000000000000000000000841400000000000000000000000000000300000000000000feffffffffffffff000000000000000000000000000000000000000000000000020000000000000000000000000000000600000000000000ff01000000000000040000000000000000000000000000000000000000000000000400000000000000000000000000007be70000000000000900000000000000ff7f0000000000000000000000000000000000000000000004180000000000000000000000000000ffffffff0000000081000000000000000600000000000000000000000000000000000000000000000400000000000000000000000000000002000000000000000500000000000000ff7fffffffffffff0000000000000000000000000000000004040000000000000000000000000000"]) r5 = creat(&(0x7f00000000c0)='./file0\x00', 0x0) openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000100)='/group.stat\x00', 0x2761, 0x0) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000080), 0xffffffffffffffff) getpid() fallocate(r0, 0x0, 0x0, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x2f, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) memfd_create(&(0x7f0000000080)='!proccgroup\x00', 0x0) ioctl$sock_inet_SIOCSIFPFLAGS(0xffffffffffffffff, 0x8934, &(0x7f0000000400)={'veth0_to_bridge\x00', 0x100}) accept(r5, &(0x7f0000000580)=@alg, &(0x7f0000000600)=0x80) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x2400, 0x8000) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000008c0)={0x2c, 0x0, &(0x7f0000000780)=[@acquire_done={0x40106309, r4, 0x2}, @clear_death={0x400c630f, 0x1, 0x3}, @release={0x40046306, 0x2}], 0xc1, 0x0, &(0x7f00000007c0)="859547f83b9b058a973a491d7e6378544744f2b56b02270a2f78214a936e9afb25cd94695643af6563f86771aa9621b9f30f2ca538b018247a633c28ee01e03b4639679311117971e60dc1538f34e961ae301463172c41754be988f6beb0ce4d83c69f86c236d29520e6cdaf5dbb60404c66d63315ff287deac8632781d0197ef1f81314da0a1ed90b681842cf85a41b496ce0a7a6f5aa4b9b23483eea8861be89b3398c6aec3349174f9cdc9de34df361ac9bf7afd8566849487c3c0a1e3aaacd"}) 04:02:15 executing program 1: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) recvmsg(0xffffffffffffffff, &(0x7f00000036c0)={&(0x7f0000000180)=@can, 0xfd28, &(0x7f00000035c0), 0x0, &(0x7f0000003680)=""/41, 0x29}, 0x0) bind$alg(r0, &(0x7f0000001300)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb(blowfish)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000ff8000)="0a0775b0", 0x4) r1 = accept$alg(r0, 0x0, 0x0) sendmmsg$alg(r1, &(0x7f0000003e80)=[{0x0, 0x0, &(0x7f0000002a80), 0x167, &(0x7f0000000100)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x0) recvmsg(r1, &(0x7f0000000000)={&(0x7f0000f7ffa8)=@alg, 0x80, &(0x7f0000000140)=[{&(0x7f0000000200)=""/4096, 0x1000}], 0x1, 0x0, 0x1f000000}, 0x0) 04:02:15 executing program 1: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) recvmsg(0xffffffffffffffff, &(0x7f00000036c0)={&(0x7f0000000180)=@can, 0xfd28, &(0x7f00000035c0), 0x0, &(0x7f0000003680)=""/41, 0x29}, 0x0) bind$alg(r0, &(0x7f0000001300)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb(blowfish)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000ff8000)="0a0775b0", 0x4) r1 = accept$alg(r0, 0x0, 0x0) sendmmsg$alg(r1, &(0x7f0000003e80)=[{0x0, 0x0, &(0x7f0000002a80), 0x167, &(0x7f0000000100)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x0) recvmsg(r1, &(0x7f0000000000)={&(0x7f0000f7ffa8)=@alg, 0x80, &(0x7f0000000140)=[{&(0x7f0000000200)=""/4096, 0x1000}], 0x1, 0x0, 0x8dffffff}, 0x0) 04:02:15 executing program 4: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) recvmsg(0xffffffffffffffff, &(0x7f00000036c0)={&(0x7f0000000180)=@can, 0xfd28, &(0x7f00000035c0), 0x0, &(0x7f0000003680)=""/41, 0x29}, 0x0) bind$alg(r0, &(0x7f0000001300)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb(blowfish)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000ff8000)="0a0775b0", 0x4) r1 = accept$alg(r0, 0x0, 0x0) sendmmsg$alg(r1, &(0x7f0000003e80)=[{0x0, 0x0, &(0x7f0000002a80), 0x167, &(0x7f0000000100)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x0) recvmsg(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)=[{&(0x7f0000000200)=""/4096, 0x1000}], 0x1, &(0x7f0000fb3fa9)=""/87, 0x57}, 0x0) 04:02:15 executing program 2: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000440)=@updpolicy={0xb8, 0x19, 0x523, 0x0, 0x0, {{@in=@multicast2, @in6=@empty={[0x0, 0x0, 0x0, 0x0, 0xe00]}, 0x0, 0x0, 0x0, 0x0, 0xa}}}, 0xb8}}, 0x0) 04:02:16 executing program 2: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000440)=@updpolicy={0xb8, 0x19, 0x523, 0x0, 0x0, {{@in=@multicast2, @in6=@empty={[0x0, 0x0, 0x0, 0x0, 0xf00]}, 0x0, 0x0, 0x0, 0x0, 0xa}}}, 0xb8}}, 0x0) 04:02:16 executing program 4: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) recvmsg(0xffffffffffffffff, &(0x7f00000036c0)={&(0x7f0000000180)=@can, 0xfd28, &(0x7f00000035c0), 0x0, &(0x7f0000003680)=""/41, 0x29}, 0x0) bind$alg(r0, &(0x7f0000001300)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb(blowfish)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000ff8000)="0a0775b0", 0x4) r1 = accept$alg(r0, 0x0, 0x0) sendmmsg$alg(r1, &(0x7f0000003e80)=[{0x0, 0x0, &(0x7f0000002a80), 0x167, &(0x7f0000000100)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x0) recvmsg(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)=[{&(0x7f0000000200)=""/4096, 0x1000}], 0x1, &(0x7f0000fb3fa9)=""/87, 0x57}, 0x0) 04:02:16 executing program 1: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) recvmsg(0xffffffffffffffff, &(0x7f00000036c0)={&(0x7f0000000180)=@can, 0xfd28, &(0x7f00000035c0), 0x0, &(0x7f0000003680)=""/41, 0x29}, 0x0) bind$alg(r0, &(0x7f0000001300)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb(blowfish)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000ff8000)="0a0775b0", 0x4) r1 = accept$alg(r0, 0x0, 0x0) sendmmsg$alg(r1, &(0x7f0000003e80)=[{0x0, 0x0, &(0x7f0000002a80), 0x167, &(0x7f0000000100)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x0) recvmsg(r1, &(0x7f0000000000)={&(0x7f0000f7ffa8)=@alg, 0x80, &(0x7f0000000140)=[{&(0x7f0000000200)=""/4096, 0x1000}], 0x1, 0x0, 0xf0ffffff}, 0x0) 04:02:16 executing program 5: r0 = socket$inet6(0xa, 0x2, 0x0) r1 = syz_open_dev$mice(&(0x7f00000002c0)='/dev/input/mice\x00', 0x0, 0x0) ioctl$PPPOEIOCDFWD(r1, 0xb101, 0x0) syz_genetlink_get_family_id$nbd(&(0x7f0000000480)='nbd\x00') getsockopt$inet6_IPV6_XFRM_POLICY(r0, 0x29, 0x23, &(0x7f0000000340)={{{@in=@local, @in=@loopback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@local}, 0x0, @in=@remote}}, &(0x7f0000000140)=0xe8) connect$can_bcm(0xffffffffffffffff, &(0x7f00000001c0), 0x10) bind$inet6(r0, &(0x7f0000000040)={0xa, 0x4e24}, 0x1c) lsetxattr$security_ima(&(0x7f0000000280)='./file0\x00', &(0x7f0000000440)='security.ima\x00', 0x0, 0x0, 0x1) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clock_gettime(0x0, &(0x7f0000000100)={0x0, 0x0}) r4 = openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) bind(r4, &(0x7f0000000580)=@can={0x1d, r2}, 0x80) clock_gettime(0x3, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff}) ppoll(&(0x7f0000000000)=[{r0, 0x41a}], 0x1, &(0x7f0000000200)={0x0, r3+30000000}, &(0x7f0000000240)={0x64000000}, 0x8) connect$inet6(r0, &(0x7f0000000080)={0xa, 0x4e24, 0x0, @ipv4={[], [], @loopback}}, 0x1c) readv(0xffffffffffffffff, 0x0, 0x0) sendmmsg(r0, &(0x7f00000092c0), 0x4ff, 0x0) connect$pptp(r5, &(0x7f00000004c0)={0x18, 0x2, {0x0, @multicast1}}, 0x1e) 04:02:18 executing program 3: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000440)=@updpolicy={0xb8, 0x19, 0x523, 0x0, 0x0, {{@in=@multicast2, @in6=@empty={[0x0, 0x0, 0x0, 0x0, 0xe00]}, 0x0, 0x0, 0x0, 0x0, 0xa}}}, 0xb8}}, 0x0) 04:02:18 executing program 0: r0 = perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) setxattr$security_smack_entry(&(0x7f0000000380)='./file0\x00', &(0x7f0000000480)='security.SMACK64IPIN\x00', &(0x7f0000000540)='^vboxnet1^\x00', 0xb, 0x1) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r1, &(0x7f0000000040), 0x0}, 0x20) unlink(&(0x7f0000000900)='./file0/file0\x00') r2 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r3 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r3, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, &(0x7f00000006c0)={0x0}) ioctl$BINDER_GET_NODE_DEBUG_INFO(r2, 0xc018620b, &(0x7f0000000640)={r4}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f00000000c0)=[@enter_looper], 0x48, 0x0, &(0x7f0000000700)="2ba063fb309ec7fdbfb08e6e91baee7d7d4599fe14129a4d426834556ae420e087d59c0c7be7fcad1abb7e1f8f446f373f611ca1ee9c2231708e18a47bc68a2a79a0b48931f6ff6d"}) ioctl$BINDER_SET_CONTEXT_MGR(r3, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x1) prctl$PR_SET_NAME(0xf, &(0x7f00000004c0)='/group.stat\x00') ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, &(0x7f0000000780)}) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f0000000680)}) ioctl$FS_IOC_FIEMAP(r3, 0xc020660b, &(0x7f0000000b80)=ANY=[@ANYBLOB="0000010000000000200000000000000005000000010000000a00000000000000ff030000000000001a0a000000000000050000000000000000000000000000000000000000000000080000000000000000000000000000000800000000000000ffff0000000000000100008000000000000000000000000000000000000000000000000000000000000000000000000008000000000000003f0000000000000008000000000000000000000000000000000000000000800800000000000000000000000000000200000000000000000400000000000000000000010000000000000000000000000000000000000002110000000000000000000000000000cc0000000000000000000000000000001b0000000000000000000000000000000000000000000000841400000000000000000000000000000300000000000000feffffffffffffff000000000000000000000000000000000000000000000000020000000000000000000000000000000600000000000000ff01000000000000040000000000000000000000000000000000000000000000000400000000000000000000000000007be70000000000000900000000000000ff7f0000000000000000000000000000000000000000000004180000000000000000000000000000ffffffff0000000081000000000000000600000000000000000000000000000000000000000000000400000000000000000000000000000002000000000000000500000000000000ff7fffffffffffff0000000000000000000000000000000004040000000000000000000000000000"]) r6 = creat(&(0x7f00000000c0)='./file0\x00', 0x0) openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000100)='/group.stat\x00', 0x2761, 0x0) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000080), 0xffffffffffffffff) getpid() fallocate(r0, 0x0, 0x0, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x2f, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) memfd_create(&(0x7f0000000080)='!proccgroup\x00', 0x0) ioctl$sock_inet_SIOCSIFPFLAGS(0xffffffffffffffff, 0x8934, &(0x7f0000000400)={'veth0_to_bridge\x00', 0x100}) accept(r6, &(0x7f0000000580)=@alg, &(0x7f0000000600)=0x80) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x2400, 0x8000) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000008c0)={0x2c, 0x0, &(0x7f0000000780)=[@acquire_done={0x40106309, r5, 0x2}, @clear_death={0x400c630f, 0x1, 0x3}, @release={0x40046306, 0x2}], 0xc1, 0x0, &(0x7f00000007c0)="859547f83b9b058a973a491d7e6378544744f2b56b02270a2f78214a936e9afb25cd94695643af6563f86771aa9621b9f30f2ca538b018247a633c28ee01e03b4639679311117971e60dc1538f34e961ae301463172c41754be988f6beb0ce4d83c69f86c236d29520e6cdaf5dbb60404c66d63315ff287deac8632781d0197ef1f81314da0a1ed90b681842cf85a41b496ce0a7a6f5aa4b9b23483eea8861be89b3398c6aec3349174f9cdc9de34df361ac9bf7afd8566849487c3c0a1e3aaacd"}) 04:02:18 executing program 2: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000440)=@updpolicy={0xb8, 0x19, 0x523, 0x0, 0x0, {{@in=@multicast2, @in6=@empty={[0x0, 0x0, 0x0, 0x0, 0x2403]}, 0x0, 0x0, 0x0, 0x0, 0xa}}}, 0xb8}}, 0x0) 04:02:18 executing program 4: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) recvmsg(0xffffffffffffffff, &(0x7f00000036c0)={&(0x7f0000000180)=@can, 0xfd28, &(0x7f00000035c0), 0x0, &(0x7f0000003680)=""/41, 0x29}, 0x0) bind$alg(r0, &(0x7f0000001300)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb(blowfish)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000ff8000)="0a0775b0", 0x4) r1 = accept$alg(r0, 0x0, 0x0) sendmmsg$alg(r1, &(0x7f0000003e80)=[{0x0, 0x0, &(0x7f0000002a80), 0x167, &(0x7f0000000100)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x0) recvmsg(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)=[{&(0x7f0000000200)=""/4096, 0x1000}], 0x1, &(0x7f0000fb3fa9)=""/87, 0x57}, 0x0) 04:02:18 executing program 1: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) recvmsg(0xffffffffffffffff, &(0x7f00000036c0)={&(0x7f0000000180)=@can, 0xfd28, &(0x7f00000035c0), 0x0, &(0x7f0000003680)=""/41, 0x29}, 0x0) bind$alg(r0, &(0x7f0000001300)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb(blowfish)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000ff8000)="0a0775b0", 0x4) r1 = accept$alg(r0, 0x0, 0x0) sendmmsg$alg(r1, &(0x7f0000003e80)=[{0x0, 0x0, &(0x7f0000002a80), 0x167, &(0x7f0000000100)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x0) recvmsg(r1, &(0x7f0000000000)={&(0x7f0000f7ffa8)=@alg, 0x80, &(0x7f0000000140)=[{&(0x7f0000000200)=""/4096, 0x1000}], 0x1, 0x0, 0xffffff8d}, 0x0) 04:02:18 executing program 5: r0 = socket$inet6(0xa, 0x2, 0x0) r1 = syz_open_dev$mice(&(0x7f00000002c0)='/dev/input/mice\x00', 0x0, 0x0) ioctl$PPPOEIOCDFWD(r1, 0xb101, 0x0) syz_genetlink_get_family_id$nbd(&(0x7f0000000480)='nbd\x00') getsockopt$inet6_IPV6_XFRM_POLICY(r0, 0x29, 0x23, &(0x7f0000000340)={{{@in=@local, @in=@loopback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@local}, 0x0, @in=@remote}}, &(0x7f0000000140)=0xe8) connect$can_bcm(0xffffffffffffffff, &(0x7f00000001c0), 0x10) bind$inet6(r0, &(0x7f0000000040)={0xa, 0x4e24}, 0x1c) lsetxattr$security_ima(&(0x7f0000000280)='./file0\x00', &(0x7f0000000440)='security.ima\x00', 0x0, 0x0, 0x1) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clock_gettime(0x0, &(0x7f0000000100)={0x0, 0x0}) r4 = openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) bind(r4, &(0x7f0000000580)=@can={0x1d, r2}, 0x80) clock_gettime(0x3, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff}) ppoll(&(0x7f0000000000)=[{r0, 0x41a}], 0x1, &(0x7f0000000200)={0x0, r3+30000000}, &(0x7f0000000240)={0xfcffffff}, 0x8) connect$inet6(r0, &(0x7f0000000080)={0xa, 0x4e24, 0x0, @ipv4={[], [], @loopback}}, 0x1c) readv(0xffffffffffffffff, 0x0, 0x0) sendmmsg(r0, &(0x7f00000092c0), 0x4ff, 0x0) connect$pptp(r5, &(0x7f00000004c0)={0x18, 0x2, {0x0, @multicast1}}, 0x1e) 04:02:18 executing program 1: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) recvmsg(0xffffffffffffffff, &(0x7f00000036c0)={&(0x7f0000000180)=@can, 0xfd28, &(0x7f00000035c0), 0x0, &(0x7f0000003680)=""/41, 0x29}, 0x0) bind$alg(r0, &(0x7f0000001300)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb(blowfish)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000ff8000)="0a0775b0", 0x4) r1 = accept$alg(r0, 0x0, 0x0) sendmmsg$alg(r1, &(0x7f0000003e80)=[{0x0, 0x0, &(0x7f0000002a80), 0x167, &(0x7f0000000100)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x0) recvmsg(r1, &(0x7f0000000000)={&(0x7f0000f7ffa8)=@alg, 0x80, &(0x7f0000000140)=[{&(0x7f0000000200)=""/4096, 0x1000}], 0x1, 0x0, 0xfffffff0}, 0x0) 04:02:18 executing program 3: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = socket$inet6_udp(0xa, 0x2, 0x0) connect$inet6(r1, &(0x7f0000000040)={0xa, 0x0, 0x0, @local, 0x3}, 0x1c) r2 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r2, &(0x7f0000000000)={&(0x7f00003c7ff4), 0xc, &(0x7f00000bfff0)={&(0x7f0000006440)=@updpolicy={0xb8, 0x19, 0x1, 0x0, 0x0, {{@in6=@mcast1, @in=@multicast1, 0x0, 0x0, 0x0, 0x0, 0xa}}}, 0xb8}}, 0x0) setsockopt$inet6_MCAST_MSFILTER(r1, 0x29, 0x30, &(0x7f0000000240)=ANY=[@ANYBLOB="70000000000000000a00000000000000ff02000000000000000000000000000100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000100000000000000000000000000000000000"], 0x90) 04:02:18 executing program 2: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000440)=@updpolicy={0xb8, 0x19, 0x523, 0x0, 0x0, {{@in=@multicast2, @in6=@empty={[0x0, 0x0, 0x0, 0x0, 0x2f00]}, 0x0, 0x0, 0x0, 0x0, 0xa}}}, 0xb8}}, 0x0) [ 653.169237] binder: BINDER_SET_CONTEXT_MGR already set [ 653.179599] binder: 23004:23012 ioctl 40046207 0 returned -16 04:02:18 executing program 4: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) recvmsg(0xffffffffffffffff, &(0x7f00000036c0)={&(0x7f0000000180)=@can, 0xfd28, &(0x7f00000035c0), 0x0, &(0x7f0000003680)=""/41, 0x29}, 0x0) bind$alg(r0, &(0x7f0000001300)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb(blowfish)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000ff8000)="0a0775b0", 0x4) r1 = accept$alg(r0, 0x0, 0x0) sendmmsg$alg(r1, &(0x7f0000003e80)=[{0x0, 0x0, &(0x7f0000002a80), 0x167, &(0x7f0000000100)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x0) recvmsg(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)=[{&(0x7f0000000200)=""/4096, 0x1000}], 0x1, &(0x7f0000fb3fa9)=""/87, 0x57}, 0x0) [ 653.284342] net_ratelimit: 20 callbacks suppressed [ 653.284350] protocol 88fb is buggy, dev hsr_slave_0 [ 653.294473] protocol 88fb is buggy, dev hsr_slave_1 [ 653.299591] protocol 88fb is buggy, dev hsr_slave_0 [ 653.304684] protocol 88fb is buggy, dev hsr_slave_1 04:02:19 executing program 2: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000440)=@updpolicy={0xb8, 0x19, 0x523, 0x0, 0x0, {{@in=@multicast2, @in6=@empty={[0x0, 0x0, 0x0, 0x0, 0x6000]}, 0x0, 0x0, 0x0, 0x0, 0xa}}}, 0xb8}}, 0x0) 04:02:19 executing program 1: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) recvmsg(0xffffffffffffffff, &(0x7f00000036c0)={&(0x7f0000000180)=@can, 0xfd28, &(0x7f00000035c0), 0x0, &(0x7f0000003680)=""/41, 0x29}, 0x0) bind$alg(r0, &(0x7f0000001300)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb(blowfish)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000ff8000)="0a0775b0", 0x4) r1 = accept$alg(r0, 0x0, 0x0) sendmmsg$alg(r1, &(0x7f0000003e80)=[{0x0, 0x0, &(0x7f0000002a80), 0x167, &(0x7f0000000100)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x0) recvmsg(r1, &(0x7f0000000000)={&(0x7f0000f7ffa8)=@alg, 0x80, &(0x7f0000000140)=[{&(0x7f0000000200)=""/4096, 0x1000}], 0x1, 0x0, 0x10000000000000}, 0x0) 04:02:19 executing program 3: socketpair$unix(0x1, 0xfffffffffffffffe, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = socket$inet(0x2b, 0x801, 0x0) r2 = syz_open_dev$sndpcmc(&(0x7f0000000040)='/dev/snd/pcmC#D#c\x00', 0x0, 0x2) ioctl$VIDIOC_LOG_STATUS(r2, 0x5646, 0x0) connect$inet(r1, &(0x7f00000001c0), 0x10) 04:02:19 executing program 0: r0 = perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) setxattr$security_smack_entry(&(0x7f0000000380)='./file0\x00', &(0x7f0000000480)='security.SMACK64IPIN\x00', &(0x7f0000000540)='^vboxnet1^\x00', 0xb, 0x1) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r1, &(0x7f0000000040), 0x0}, 0x20) unlink(&(0x7f0000000900)='./file0/file0\x00') r2 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r3 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r3, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, &(0x7f00000006c0)={0x0}) ioctl$BINDER_GET_NODE_DEBUG_INFO(r2, 0xc018620b, &(0x7f0000000640)={r4}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f00000000c0)=[@enter_looper], 0x48, 0x0, &(0x7f0000000700)="2ba063fb309ec7fdbfb08e6e91baee7d7d4599fe14129a4d426834556ae420e087d59c0c7be7fcad1abb7e1f8f446f373f611ca1ee9c2231708e18a47bc68a2a79a0b48931f6ff6d"}) ioctl$BINDER_SET_CONTEXT_MGR(r3, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x1) prctl$PR_SET_NAME(0xf, &(0x7f00000004c0)='/group.stat\x00') ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, &(0x7f0000000780)}) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f0000000680)}) ioctl$FS_IOC_FIEMAP(r3, 0xc020660b, &(0x7f0000000b80)=ANY=[@ANYBLOB="0000010000000000200000000000000005000000010000000a00000000000000ff030000000000001a0a000000000000050000000000000000000000000000000000000000000000080000000000000000000000000000000800000000000000ffff0000000000000100008000000000000000000000000000000000000000000000000000000000000000000000000008000000000000003f0000000000000008000000000000000000000000000000000000000000800800000000000000000000000000000200000000000000000400000000000000000000010000000000000000000000000000000000000002110000000000000000000000000000cc0000000000000000000000000000001b0000000000000000000000000000000000000000000000841400000000000000000000000000000300000000000000feffffffffffffff000000000000000000000000000000000000000000000000020000000000000000000000000000000600000000000000ff01000000000000040000000000000000000000000000000000000000000000000400000000000000000000000000007be70000000000000900000000000000ff7f0000000000000000000000000000000000000000000004180000000000000000000000000000ffffffff0000000081000000000000000600000000000000000000000000000000000000000000000400000000000000000000000000000002000000000000000500000000000000ff7fffffffffffff0000000000000000000000000000000004040000000000000000000000000000"]) r6 = creat(&(0x7f00000000c0)='./file0\x00', 0x0) openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000100)='/group.stat\x00', 0x2761, 0x0) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000080), 0xffffffffffffffff) getpid() fallocate(r0, 0x0, 0x0, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x2f, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) memfd_create(&(0x7f0000000080)='!proccgroup\x00', 0x0) ioctl$sock_inet_SIOCSIFPFLAGS(0xffffffffffffffff, 0x8934, &(0x7f0000000400)={'veth0_to_bridge\x00', 0x100}) accept(r6, &(0x7f0000000580)=@alg, &(0x7f0000000600)=0x80) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x2400, 0x8000) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000008c0)={0x2c, 0x0, &(0x7f0000000780)=[@acquire_done={0x40106309, r5, 0x2}, @clear_death={0x400c630f, 0x1, 0x3}, @release={0x40046306, 0x2}], 0xc1, 0x0, &(0x7f00000007c0)="859547f83b9b058a973a491d7e6378544744f2b56b02270a2f78214a936e9afb25cd94695643af6563f86771aa9621b9f30f2ca538b018247a633c28ee01e03b4639679311117971e60dc1538f34e961ae301463172c41754be988f6beb0ce4d83c69f86c236d29520e6cdaf5dbb60404c66d63315ff287deac8632781d0197ef1f81314da0a1ed90b681842cf85a41b496ce0a7a6f5aa4b9b23483eea8861be89b3398c6aec3349174f9cdc9de34df361ac9bf7afd8566849487c3c0a1e3aaacd"}) 04:02:19 executing program 4: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) recvmsg(0xffffffffffffffff, &(0x7f00000036c0)={&(0x7f0000000180)=@can, 0xfd28, &(0x7f00000035c0), 0x0, &(0x7f0000003680)=""/41, 0x29}, 0x0) bind$alg(r0, &(0x7f0000001300)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb(blowfish)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000ff8000)="0a0775b0", 0x4) r1 = accept$alg(r0, 0x0, 0x0) sendmmsg$alg(r1, &(0x7f0000003e80)=[{0x0, 0x0, &(0x7f0000002a80), 0x167, &(0x7f0000000100)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x0) recvmsg(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)=[{&(0x7f0000000200)=""/4096, 0x1000}], 0x1, &(0x7f0000fb3fa9)=""/87, 0x57}, 0x0) 04:02:19 executing program 2: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000440)=@updpolicy={0xb8, 0x19, 0x523, 0x0, 0x0, {{@in=@multicast2, @in6=@empty={[0x0, 0x0, 0x0, 0x0, 0xf000]}, 0x0, 0x0, 0x0, 0x0, 0xa}}}, 0xb8}}, 0x0) [ 653.626678] binder: release 23004:23012 transaction 405 out, still active [ 653.633641] binder: unexpected work type, 4, not freed 04:02:19 executing program 1: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) recvmsg(0xffffffffffffffff, &(0x7f00000036c0)={&(0x7f0000000180)=@can, 0xfd28, &(0x7f00000035c0), 0x0, &(0x7f0000003680)=""/41, 0x29}, 0x0) bind$alg(r0, &(0x7f0000001300)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb(blowfish)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000ff8000)="0a0775b0", 0x4) r1 = accept$alg(r0, 0x0, 0x0) sendmmsg$alg(r1, &(0x7f0000003e80)=[{0x0, 0x0, &(0x7f0000002a80), 0x167, &(0x7f0000000100)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x0) recvmsg(r1, &(0x7f0000000000)={&(0x7f0000f7ffa8)=@alg, 0x80, &(0x7f0000000140)=[{&(0x7f0000000200)=""/4096, 0x1000}], 0x1, 0x0, 0x700000000000000}, 0x0) [ 653.677112] binder: undelivered TRANSACTION_COMPLETE [ 653.782062] binder: BINDER_SET_CONTEXT_MGR already set [ 653.824009] binder: 23049:23052 ioctl 40046207 0 returned -16 [ 653.924874] protocol 88fb is buggy, dev hsr_slave_0 [ 653.931029] protocol 88fb is buggy, dev hsr_slave_1 04:02:19 executing program 5: r0 = socket$inet6(0xa, 0x2, 0x0) r1 = syz_open_dev$mice(&(0x7f00000002c0)='/dev/input/mice\x00', 0x0, 0x0) ioctl$PPPOEIOCDFWD(r1, 0xb101, 0x0) syz_genetlink_get_family_id$nbd(&(0x7f0000000480)='nbd\x00') getsockopt$inet6_IPV6_XFRM_POLICY(r0, 0x29, 0x23, &(0x7f0000000340)={{{@in=@local, @in=@loopback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@local}, 0x0, @in=@remote}}, &(0x7f0000000140)=0xe8) connect$can_bcm(0xffffffffffffffff, &(0x7f00000001c0), 0x10) bind$inet6(r0, &(0x7f0000000040)={0xa, 0x4e24}, 0x1c) lsetxattr$security_ima(&(0x7f0000000280)='./file0\x00', &(0x7f0000000440)='security.ima\x00', 0x0, 0x0, 0x1) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clock_gettime(0x0, &(0x7f0000000100)={0x0, 0x0}) r4 = openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) bind(r4, &(0x7f0000000580)=@can={0x1d, r2}, 0x80) clock_gettime(0x3, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff}) ppoll(&(0x7f0000000000)=[{r0, 0x41a}], 0x1, &(0x7f0000000200)={0x0, r3+30000000}, &(0x7f0000000240)={0xfffffffc}, 0x8) connect$inet6(r0, &(0x7f0000000080)={0xa, 0x4e24, 0x0, @ipv4={[], [], @loopback}}, 0x1c) readv(0xffffffffffffffff, 0x0, 0x0) sendmmsg(r0, &(0x7f00000092c0), 0x4ff, 0x0) connect$pptp(r5, &(0x7f00000004c0)={0x18, 0x2, {0x0, @multicast1}}, 0x1e) 04:02:19 executing program 3: r0 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r0, &(0x7f0000000080)={0x2, 0x4e23, @multicast2}, 0x10) sendto$inet(r0, 0x0, 0x0, 0x20000802, &(0x7f0000000100)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10) r1 = openat$rtc(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/rtc0\x00', 0x80, 0x0) ioctl$UI_GET_VERSION(r1, 0x8004552d, &(0x7f0000000180)) sendto$inet(r0, &(0x7f0000d7cfcb), 0xfffffffffffffd8b, 0x0, 0x0, 0x0) r2 = syz_open_procfs(0x0, &(0x7f0000000080)='net/tcp\x00') socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000140)={0xffffffffffffffff}) getsockopt$inet6_tcp_int(r2, 0x6, 0x3, &(0x7f0000000000), &(0x7f0000000040)=0x4) sendfile(r3, r2, 0x0, 0x462c) 04:02:19 executing program 2: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000440)=@updpolicy={0xb8, 0x19, 0x523, 0x0, 0x0, {{@in=@multicast2, @in6=@empty={[0x0, 0x0, 0x0, 0x0, 0xf0ffff]}, 0x0, 0x0, 0x0, 0x0, 0xa}}}, 0xb8}}, 0x0) 04:02:19 executing program 4: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) recvmsg(0xffffffffffffffff, &(0x7f00000036c0)={&(0x7f0000000180)=@can, 0xfd28, &(0x7f00000035c0), 0x0, &(0x7f0000003680)=""/41, 0x29}, 0x0) bind$alg(r0, &(0x7f0000001300)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb(blowfish)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000ff8000)="0a0775b0", 0x4) r1 = accept$alg(r0, 0x0, 0x0) sendmmsg$alg(r1, &(0x7f0000003e80)=[{0x0, 0x0, &(0x7f0000002a80), 0x167, &(0x7f0000000100)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x0) recvmsg(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)=[{&(0x7f0000000200)=""/4096, 0x1000}], 0x1, &(0x7f0000fb3fa9)=""/87, 0x57}, 0x0) 04:02:19 executing program 1: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) recvmsg(0xffffffffffffffff, &(0x7f00000036c0)={&(0x7f0000000180)=@can, 0xfd28, &(0x7f00000035c0), 0x0, &(0x7f0000003680)=""/41, 0x29}, 0x0) bind$alg(r0, &(0x7f0000001300)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb(blowfish)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000ff8000)="0a0775b0", 0x4) r1 = accept$alg(r0, 0x0, 0x0) sendmmsg$alg(r1, &(0x7f0000003e80)=[{0x0, 0x0, &(0x7f0000002a80), 0x167, &(0x7f0000000100)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x0) recvmsg(r1, &(0x7f0000000000)={&(0x7f0000f7ffa8)=@alg, 0x80, &(0x7f0000000140)=[{&(0x7f0000000200)=""/4096, 0x1000}], 0x1, 0x0, 0x800000000000000}, 0x0) 04:02:19 executing program 0: r0 = perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) setxattr$security_smack_entry(&(0x7f0000000380)='./file0\x00', &(0x7f0000000480)='security.SMACK64IPIN\x00', &(0x7f0000000540)='^vboxnet1^\x00', 0xb, 0x1) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r1, &(0x7f0000000040), 0x0}, 0x20) unlink(&(0x7f0000000900)='./file0/file0\x00') r2 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r3 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r3, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, &(0x7f00000006c0)={0x0}) ioctl$BINDER_GET_NODE_DEBUG_INFO(r2, 0xc018620b, &(0x7f0000000640)={r4}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f00000000c0)=[@enter_looper], 0x48, 0x0, &(0x7f0000000700)="2ba063fb309ec7fdbfb08e6e91baee7d7d4599fe14129a4d426834556ae420e087d59c0c7be7fcad1abb7e1f8f446f373f611ca1ee9c2231708e18a47bc68a2a79a0b48931f6ff6d"}) ioctl$BINDER_SET_CONTEXT_MGR(r3, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x1) prctl$PR_SET_NAME(0xf, &(0x7f00000004c0)='/group.stat\x00') ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, &(0x7f0000000780)}) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f0000000680)}) ioctl$FS_IOC_FIEMAP(r3, 0xc020660b, &(0x7f0000000b80)=ANY=[@ANYBLOB="0000010000000000200000000000000005000000010000000a00000000000000ff030000000000001a0a000000000000050000000000000000000000000000000000000000000000080000000000000000000000000000000800000000000000ffff0000000000000100008000000000000000000000000000000000000000000000000000000000000000000000000008000000000000003f0000000000000008000000000000000000000000000000000000000000800800000000000000000000000000000200000000000000000400000000000000000000010000000000000000000000000000000000000002110000000000000000000000000000cc0000000000000000000000000000001b0000000000000000000000000000000000000000000000841400000000000000000000000000000300000000000000feffffffffffffff000000000000000000000000000000000000000000000000020000000000000000000000000000000600000000000000ff01000000000000040000000000000000000000000000000000000000000000000400000000000000000000000000007be70000000000000900000000000000ff7f0000000000000000000000000000000000000000000004180000000000000000000000000000ffffffff0000000081000000000000000600000000000000000000000000000000000000000000000400000000000000000000000000000002000000000000000500000000000000ff7fffffffffffff0000000000000000000000000000000004040000000000000000000000000000"]) r6 = creat(&(0x7f00000000c0)='./file0\x00', 0x0) openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000100)='/group.stat\x00', 0x2761, 0x0) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000080), 0xffffffffffffffff) getpid() fallocate(r0, 0x0, 0x0, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x2f, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) memfd_create(&(0x7f0000000080)='!proccgroup\x00', 0x0) ioctl$sock_inet_SIOCSIFPFLAGS(0xffffffffffffffff, 0x8934, &(0x7f0000000400)={'veth0_to_bridge\x00', 0x100}) accept(r6, &(0x7f0000000580)=@alg, &(0x7f0000000600)=0x80) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x2400, 0x8000) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000008c0)={0x2c, 0x0, &(0x7f0000000780)=[@acquire_done={0x40106309, r5, 0x2}, @clear_death={0x400c630f, 0x1, 0x3}, @release={0x40046306, 0x2}], 0xc1, 0x0, &(0x7f00000007c0)="859547f83b9b058a973a491d7e6378544744f2b56b02270a2f78214a936e9afb25cd94695643af6563f86771aa9621b9f30f2ca538b018247a633c28ee01e03b4639679311117971e60dc1538f34e961ae301463172c41754be988f6beb0ce4d83c69f86c236d29520e6cdaf5dbb60404c66d63315ff287deac8632781d0197ef1f81314da0a1ed90b681842cf85a41b496ce0a7a6f5aa4b9b23483eea8861be89b3398c6aec3349174f9cdc9de34df361ac9bf7afd8566849487c3c0a1e3aaacd"}) [ 654.173206] binder: BINDER_SET_CONTEXT_MGR already set 04:02:19 executing program 2: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000440)=@updpolicy={0xb8, 0x19, 0x523, 0x0, 0x0, {{@in=@multicast2, @in6=@empty={[0x0, 0x0, 0x0, 0x0, 0x1000000]}, 0x0, 0x0, 0x0, 0x0, 0xa}}}, 0xb8}}, 0x0) 04:02:19 executing program 1: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) recvmsg(0xffffffffffffffff, &(0x7f00000036c0)={&(0x7f0000000180)=@can, 0xfd28, &(0x7f00000035c0), 0x0, &(0x7f0000003680)=""/41, 0x29}, 0x0) bind$alg(r0, &(0x7f0000001300)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb(blowfish)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000ff8000)="0a0775b0", 0x4) r1 = accept$alg(r0, 0x0, 0x0) sendmmsg$alg(r1, &(0x7f0000003e80)=[{0x0, 0x0, &(0x7f0000002a80), 0x167, &(0x7f0000000100)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x0) recvmsg(r1, &(0x7f0000000000)={&(0x7f0000f7ffa8)=@alg, 0x80, &(0x7f0000000140)=[{&(0x7f0000000200)=""/4096, 0x1000}], 0x1, 0x0, 0x1000000000000000}, 0x0) 04:02:19 executing program 4: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) recvmsg(0xffffffffffffffff, &(0x7f00000036c0)={&(0x7f0000000180)=@can, 0xfd28, &(0x7f00000035c0), 0x0, &(0x7f0000003680)=""/41, 0x29}, 0x0) bind$alg(r0, &(0x7f0000001300)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb(blowfish)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000ff8000)="0a0775b0", 0x4) r1 = accept$alg(r0, 0x0, 0x0) sendmmsg$alg(r1, &(0x7f0000003e80)=[{0x0, 0x0, &(0x7f0000002a80), 0x167, &(0x7f0000000100)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x0) recvmsg(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)=[{&(0x7f0000000200)=""/4096, 0x1000}], 0x1, &(0x7f0000fb3fa9)=""/87, 0x57}, 0x0) [ 654.199529] binder: 23069:23070 ioctl 40046207 0 returned -16 04:02:20 executing program 2: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000440)=@updpolicy={0xb8, 0x19, 0x523, 0x0, 0x0, {{@in=@multicast2, @in6=@empty={[0x0, 0x0, 0x0, 0x0, 0x2000000]}, 0x0, 0x0, 0x0, 0x0, 0xa}}}, 0xb8}}, 0x0) [ 654.324828] protocol 88fb is buggy, dev hsr_slave_0 [ 654.330939] protocol 88fb is buggy, dev hsr_slave_1 04:02:20 executing program 4: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) recvmsg(0xffffffffffffffff, &(0x7f00000036c0)={&(0x7f0000000180)=@can, 0xfd28, &(0x7f00000035c0), 0x0, &(0x7f0000003680)=""/41, 0x29}, 0x0) bind$alg(r0, &(0x7f0000001300)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb(blowfish)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000ff8000)="0a0775b0", 0x4) r1 = accept$alg(r0, 0x0, 0x0) sendmmsg$alg(r1, &(0x7f0000003e80)=[{0x0, 0x0, &(0x7f0000002a80), 0x167, &(0x7f0000000100)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x0) recvmsg(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)=[{&(0x7f0000000200)=""/4096, 0x1000}], 0x1, &(0x7f0000fb3fa9)=""/87, 0x57}, 0x0) 04:02:20 executing program 1: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) recvmsg(0xffffffffffffffff, &(0x7f00000036c0)={&(0x7f0000000180)=@can, 0xfd28, &(0x7f00000035c0), 0x0, &(0x7f0000003680)=""/41, 0x29}, 0x0) bind$alg(r0, &(0x7f0000001300)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb(blowfish)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000ff8000)="0a0775b0", 0x4) r1 = accept$alg(r0, 0x0, 0x0) sendmmsg$alg(r1, &(0x7f0000003e80)=[{0x0, 0x0, &(0x7f0000002a80), 0x167, &(0x7f0000000100)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x0) recvmsg(r1, &(0x7f0000000000)={&(0x7f0000f7ffa8)=@alg, 0x80, &(0x7f0000000140)=[{&(0x7f0000000200)=""/4096, 0x1000}], 0x1, 0x0, 0x1f00000000000000}, 0x0) [ 654.404349] protocol 88fb is buggy, dev hsr_slave_0 [ 654.409473] protocol 88fb is buggy, dev hsr_slave_1 [ 654.593515] binder: release 23069:23070 transaction 408 out, still active [ 654.606732] binder: unexpected work type, 4, not freed [ 654.632377] binder: undelivered TRANSACTION_COMPLETE 04:02:20 executing program 5: r0 = socket$inet6(0xa, 0x2, 0x0) r1 = syz_open_dev$mice(&(0x7f00000002c0)='/dev/input/mice\x00', 0x0, 0x0) ioctl$PPPOEIOCDFWD(r1, 0xb101, 0x0) syz_genetlink_get_family_id$nbd(&(0x7f0000000480)='nbd\x00') getsockopt$inet6_IPV6_XFRM_POLICY(r0, 0x29, 0x23, &(0x7f0000000340)={{{@in=@local, @in=@loopback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@local}, 0x0, @in=@remote}}, &(0x7f0000000140)=0xe8) connect$can_bcm(0xffffffffffffffff, &(0x7f00000001c0), 0x10) bind$inet6(r0, &(0x7f0000000040)={0xa, 0x4e24}, 0x1c) lsetxattr$security_ima(&(0x7f0000000280)='./file0\x00', &(0x7f0000000440)='security.ima\x00', 0x0, 0x0, 0x1) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clock_gettime(0x0, &(0x7f0000000100)={0x0, 0x0}) r4 = openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) bind(r4, &(0x7f0000000580)=@can={0x1d, r2}, 0x80) clock_gettime(0x3, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff}) ppoll(&(0x7f0000000000)=[{r0, 0x41a}], 0x1, &(0x7f0000000200)={0x0, r3+30000000}, &(0x7f0000000240)={0x300000000000000}, 0x8) connect$inet6(r0, &(0x7f0000000080)={0xa, 0x4e24, 0x0, @ipv4={[], [], @loopback}}, 0x1c) readv(0xffffffffffffffff, 0x0, 0x0) sendmmsg(r0, &(0x7f00000092c0), 0x4ff, 0x0) connect$pptp(r5, &(0x7f00000004c0)={0x18, 0x2, {0x0, @multicast1}}, 0x1e) 04:02:20 executing program 2: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000440)=@updpolicy={0xb8, 0x19, 0x523, 0x0, 0x0, {{@in=@multicast2, @in6=@empty={[0x0, 0x0, 0x0, 0x0, 0x3000000]}, 0x0, 0x0, 0x0, 0x0, 0xa}}}, 0xb8}}, 0x0) 04:02:20 executing program 3: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000000)={0xffffffffffffffff}) getsockopt$sock_buf(r0, 0x1, 0x3b, 0xfffffffffffffffe, &(0x7f0000000040)=0x777) r1 = syz_open_procfs(0x0, &(0x7f0000000080)='net/sockstat\x00') ioctl$VIDIOC_DECODER_CMD(r1, 0xc0485660, &(0x7f00000000c0)={0x4, 0x1, @raw_data=[0x0, 0x5, 0x2, 0x3, 0x2, 0x2, 0xfffffffffffffff9, 0x8, 0x2, 0x1, 0x5, 0x2, 0x6, 0x40, 0x4]}) 04:02:20 executing program 4: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) recvmsg(0xffffffffffffffff, &(0x7f00000036c0)={&(0x7f0000000180)=@can, 0xfd28, &(0x7f00000035c0), 0x0, &(0x7f0000003680)=""/41, 0x29}, 0x0) bind$alg(r0, &(0x7f0000001300)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb(blowfish)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000ff8000)="0a0775b0", 0x4) r1 = accept$alg(r0, 0x0, 0x0) sendmmsg$alg(r1, &(0x7f0000003e80)=[{0x0, 0x0, &(0x7f0000002a80), 0x167, &(0x7f0000000100)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x0) recvmsg(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)=[{&(0x7f0000000200)=""/4096, 0x1000}], 0x1, &(0x7f0000fb3fa9)=""/87, 0x57}, 0x0) 04:02:20 executing program 0: r0 = perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) setxattr$security_smack_entry(&(0x7f0000000380)='./file0\x00', &(0x7f0000000480)='security.SMACK64IPIN\x00', &(0x7f0000000540)='^vboxnet1^\x00', 0xb, 0x1) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r1, &(0x7f0000000040), 0x0}, 0x20) unlink(&(0x7f0000000900)='./file0/file0\x00') r2 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r3 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r3, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, &(0x7f00000006c0)={0x0}) ioctl$BINDER_GET_NODE_DEBUG_INFO(r2, 0xc018620b, &(0x7f0000000640)={r4}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r3, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x1) prctl$PR_SET_NAME(0xf, &(0x7f00000004c0)='/group.stat\x00') ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, &(0x7f0000000780)}) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f0000000680)}) ioctl$FS_IOC_FIEMAP(r3, 0xc020660b, &(0x7f0000000b80)=ANY=[@ANYBLOB="0000010000000000200000000000000005000000010000000a00000000000000ff030000000000001a0a000000000000050000000000000000000000000000000000000000000000080000000000000000000000000000000800000000000000ffff0000000000000100008000000000000000000000000000000000000000000000000000000000000000000000000008000000000000003f0000000000000008000000000000000000000000000000000000000000800800000000000000000000000000000200000000000000000400000000000000000000010000000000000000000000000000000000000002110000000000000000000000000000cc0000000000000000000000000000001b0000000000000000000000000000000000000000000000841400000000000000000000000000000300000000000000feffffffffffffff000000000000000000000000000000000000000000000000020000000000000000000000000000000600000000000000ff01000000000000040000000000000000000000000000000000000000000000000400000000000000000000000000007be70000000000000900000000000000ff7f0000000000000000000000000000000000000000000004180000000000000000000000000000ffffffff0000000081000000000000000600000000000000000000000000000000000000000000000400000000000000000000000000000002000000000000000500000000000000ff7fffffffffffff0000000000000000000000000000000004040000000000000000000000000000"]) r6 = creat(&(0x7f00000000c0)='./file0\x00', 0x0) openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000100)='/group.stat\x00', 0x2761, 0x0) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000080), 0xffffffffffffffff) getpid() fallocate(r0, 0x0, 0x0, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x2f, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) memfd_create(&(0x7f0000000080)='!proccgroup\x00', 0x0) ioctl$sock_inet_SIOCSIFPFLAGS(0xffffffffffffffff, 0x8934, &(0x7f0000000400)={'veth0_to_bridge\x00', 0x100}) accept(r6, &(0x7f0000000580)=@alg, &(0x7f0000000600)=0x80) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x2400, 0x8000) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000008c0)={0x2c, 0x0, &(0x7f0000000780)=[@acquire_done={0x40106309, r5, 0x2}, @clear_death={0x400c630f, 0x1, 0x3}, @release={0x40046306, 0x2}], 0xc1, 0x0, &(0x7f00000007c0)="859547f83b9b058a973a491d7e6378544744f2b56b02270a2f78214a936e9afb25cd94695643af6563f86771aa9621b9f30f2ca538b018247a633c28ee01e03b4639679311117971e60dc1538f34e961ae301463172c41754be988f6beb0ce4d83c69f86c236d29520e6cdaf5dbb60404c66d63315ff287deac8632781d0197ef1f81314da0a1ed90b681842cf85a41b496ce0a7a6f5aa4b9b23483eea8861be89b3398c6aec3349174f9cdc9de34df361ac9bf7afd8566849487c3c0a1e3aaacd"}) 04:02:20 executing program 1: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) recvmsg(0xffffffffffffffff, &(0x7f00000036c0)={&(0x7f0000000180)=@can, 0xfd28, &(0x7f00000035c0), 0x0, &(0x7f0000003680)=""/41, 0x29}, 0x0) bind$alg(r0, &(0x7f0000001300)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb(blowfish)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000ff8000)="0a0775b0", 0x4) r1 = accept$alg(r0, 0x0, 0x0) sendmmsg$alg(r1, &(0x7f0000003e80)=[{0x0, 0x0, &(0x7f0000002a80), 0x167, &(0x7f0000000100)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x0) recvmsg(r1, &(0x7f0000000000)={&(0x7f0000f7ffa8)=@alg, 0x80, &(0x7f0000000140)=[{&(0x7f0000000200)=""/4096, 0x1000}], 0x1, 0x0, 0x8000000000000000}, 0x0) 04:02:21 executing program 4: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) recvmsg(0xffffffffffffffff, &(0x7f00000036c0)={&(0x7f0000000180)=@can, 0xfd28, &(0x7f00000035c0), 0x0, &(0x7f0000003680)=""/41, 0x29}, 0x0) bind$alg(r0, &(0x7f0000001300)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb(blowfish)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000ff8000)="0a0775b0", 0x4) r1 = accept$alg(r0, 0x0, 0x0) sendmmsg$alg(r1, &(0x7f0000003e80)=[{0x0, 0x0, &(0x7f0000002a80), 0x167, &(0x7f0000000100)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x0) recvmsg(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)=[{&(0x7f0000000200)=""/4096, 0x1000}], 0x1, &(0x7f0000fb3fa9)=""/87, 0x57}, 0x0) 04:02:21 executing program 2: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000440)=@updpolicy={0xb8, 0x19, 0x523, 0x0, 0x0, {{@in=@multicast2, @in6=@empty={[0x0, 0x0, 0x0, 0x0, 0x4000000]}, 0x0, 0x0, 0x0, 0x0, 0xa}}}, 0xb8}}, 0x0) 04:02:21 executing program 3: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) syz_execute_func(&(0x7f0000000000)="460f9cfd660f3a1690d5b80000f8450f2c75dc262e66460fd599feefffffc481f17dd73e26400f38028e52000000c403d95fd23d66dae96666440fd03bc4018976c2") mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x2, 0x11, r2, 0x0) add_key$user(0x0, 0x0, &(0x7f0000001040)="d8b98318b88de5636ad1a6da820065294787d16a63d50420019952e8f06a18a3c04f37e30b2fb760f6590a86fbb61b8e5863fc4b5cf2ab412922d63418b4a752b7a852508eac7f32899568ee242c8cb615d79341c68e97208da82d2f8b0f1b3c77de0442e0c3c3bcde1bfd8cc90b5e13db38ef64ed7156ae2989168cca0a533ce721f2daebc035835f32513c3147bbe6ca6d920e59753727a0f0b5e99528983590783f7aab76e996793f415a7b13e7be1ba7926245db63453ff642bc6a2844966df1f9e22db7b39e1901e2308153b4e7d7858450d23c4f0034488eb955003054f5", 0xe1, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000001c0)={0x5, 0x7, &(0x7f00000000c0)=@framed={{0x18, 0x0, 0x0, 0x0, 0xfffffffffffffffa, 0x0, 0x0, 0x0, 0x14000000000}, [@alu={0x4, 0x9, 0x6, 0x1, 0x6}, @initr0={0x18, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x40}, @ldst={0x2, 0x1, 0x6, 0x0, 0x0, 0xfffffffffffffff8, 0xffffffffffffffff}]}, &(0x7f0000000100)='GPL\x00', 0x9, 0x49, &(0x7f0000000140)=""/73, 0x40f00, 0x1, [], 0x0, 0x4}, 0x48) ioctl$KVM_RUN(r2, 0xae80, 0x0) [ 655.260689] binder: 23116:23118 ioctl c0306201 0 returned -14 [ 655.276087] binder: BINDER_SET_CONTEXT_MGR already set [ 655.286063] binder: 23116:23118 ioctl 40046207 0 returned -16 04:02:21 executing program 1: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) recvmsg(0xffffffffffffffff, &(0x7f00000036c0)={&(0x7f0000000180)=@can, 0xfd28, &(0x7f00000035c0), 0x0, &(0x7f0000003680)=""/41, 0x29}, 0x0) bind$alg(r0, &(0x7f0000001300)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb(blowfish)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000ff8000)="0a0775b0", 0x4) r1 = accept$alg(r0, 0x0, 0x0) sendmmsg$alg(r1, &(0x7f0000003e80)=[{0x0, 0x0, &(0x7f0000002a80), 0x167, &(0x7f0000000100)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x0) recvmsg(r1, &(0x7f0000000000)={&(0x7f0000f7ffa8)=@alg, 0x80, &(0x7f0000000140)=[{&(0x7f0000000200)=""/4096, 0x1000}], 0x1, 0x0, 0x8dffffff00000000}, 0x0) 04:02:21 executing program 2: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000440)=@updpolicy={0xb8, 0x19, 0x523, 0x0, 0x0, {{@in=@multicast2, @in6=@empty={[0x0, 0x0, 0x0, 0x0, 0x8000000]}, 0x0, 0x0, 0x0, 0x0, 0xa}}}, 0xb8}}, 0x0) 04:02:21 executing program 4: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) recvmsg(0xffffffffffffffff, &(0x7f00000036c0)={&(0x7f0000000180)=@can, 0xfd28, &(0x7f00000035c0), 0x0, &(0x7f0000003680)=""/41, 0x29}, 0x0) bind$alg(r0, &(0x7f0000001300)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb(blowfish)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000ff8000)="0a0775b0", 0x4) r1 = accept$alg(r0, 0x0, 0x0) sendmmsg$alg(r1, &(0x7f0000003e80)=[{0x0, 0x0, &(0x7f0000002a80), 0x167, &(0x7f0000000100)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x0) recvmsg(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)=[{&(0x7f0000000200)=""/4096, 0x1000}], 0x1, &(0x7f0000fb3fa9)=""/87, 0x57}, 0x0) 04:02:21 executing program 0: r0 = perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) setxattr$security_smack_entry(&(0x7f0000000380)='./file0\x00', &(0x7f0000000480)='security.SMACK64IPIN\x00', &(0x7f0000000540)='^vboxnet1^\x00', 0xb, 0x1) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r1, &(0x7f0000000040), 0x0}, 0x20) unlink(&(0x7f0000000900)='./file0/file0\x00') r2 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r3 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r3, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, &(0x7f00000006c0)={0x0}) ioctl$BINDER_GET_NODE_DEBUG_INFO(r2, 0xc018620b, &(0x7f0000000640)={r4}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r3, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x1) prctl$PR_SET_NAME(0xf, &(0x7f00000004c0)='/group.stat\x00') ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, &(0x7f0000000780)}) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f0000000680)}) ioctl$FS_IOC_FIEMAP(r3, 0xc020660b, &(0x7f0000000b80)=ANY=[@ANYBLOB="0000010000000000200000000000000005000000010000000a00000000000000ff030000000000001a0a000000000000050000000000000000000000000000000000000000000000080000000000000000000000000000000800000000000000ffff0000000000000100008000000000000000000000000000000000000000000000000000000000000000000000000008000000000000003f0000000000000008000000000000000000000000000000000000000000800800000000000000000000000000000200000000000000000400000000000000000000010000000000000000000000000000000000000002110000000000000000000000000000cc0000000000000000000000000000001b0000000000000000000000000000000000000000000000841400000000000000000000000000000300000000000000feffffffffffffff000000000000000000000000000000000000000000000000020000000000000000000000000000000600000000000000ff01000000000000040000000000000000000000000000000000000000000000000400000000000000000000000000007be70000000000000900000000000000ff7f0000000000000000000000000000000000000000000004180000000000000000000000000000ffffffff0000000081000000000000000600000000000000000000000000000000000000000000000400000000000000000000000000000002000000000000000500000000000000ff7fffffffffffff0000000000000000000000000000000004040000000000000000000000000000"]) r6 = creat(&(0x7f00000000c0)='./file0\x00', 0x0) openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000100)='/group.stat\x00', 0x2761, 0x0) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000080), 0xffffffffffffffff) getpid() fallocate(r0, 0x0, 0x0, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x2f, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) memfd_create(&(0x7f0000000080)='!proccgroup\x00', 0x0) ioctl$sock_inet_SIOCSIFPFLAGS(0xffffffffffffffff, 0x8934, &(0x7f0000000400)={'veth0_to_bridge\x00', 0x100}) accept(r6, &(0x7f0000000580)=@alg, &(0x7f0000000600)=0x80) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x2400, 0x8000) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000008c0)={0x2c, 0x0, &(0x7f0000000780)=[@acquire_done={0x40106309, r5, 0x2}, @clear_death={0x400c630f, 0x1, 0x3}, @release={0x40046306, 0x2}], 0xc1, 0x0, &(0x7f00000007c0)="859547f83b9b058a973a491d7e6378544744f2b56b02270a2f78214a936e9afb25cd94695643af6563f86771aa9621b9f30f2ca538b018247a633c28ee01e03b4639679311117971e60dc1538f34e961ae301463172c41754be988f6beb0ce4d83c69f86c236d29520e6cdaf5dbb60404c66d63315ff287deac8632781d0197ef1f81314da0a1ed90b681842cf85a41b496ce0a7a6f5aa4b9b23483eea8861be89b3398c6aec3349174f9cdc9de34df361ac9bf7afd8566849487c3c0a1e3aaacd"}) [ 655.629760] binder: release 23116:23118 transaction 411 out, still active [ 655.656654] binder: unexpected work type, 4, not freed [ 655.679293] binder: undelivered TRANSACTION_COMPLETE [ 655.721903] binder: 23144:23145 ioctl c0306201 0 returned -14 [ 655.752536] binder: BINDER_SET_CONTEXT_MGR already set [ 655.769802] binder: 23144:23145 ioctl 40046207 0 returned -16 [ 656.046843] binder: release 23144:23145 transaction 414 out, still active [ 656.062089] binder: unexpected work type, 4, not freed [ 656.068717] binder: undelivered TRANSACTION_COMPLETE 04:02:21 executing program 5: r0 = socket$inet6(0xa, 0x2, 0x0) r1 = syz_open_dev$mice(&(0x7f00000002c0)='/dev/input/mice\x00', 0x0, 0x0) ioctl$PPPOEIOCDFWD(r1, 0xb101, 0x0) syz_genetlink_get_family_id$nbd(&(0x7f0000000480)='nbd\x00') getsockopt$inet6_IPV6_XFRM_POLICY(r0, 0x29, 0x23, &(0x7f0000000340)={{{@in=@local, @in=@loopback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@local}, 0x0, @in=@remote}}, &(0x7f0000000140)=0xe8) connect$can_bcm(0xffffffffffffffff, &(0x7f00000001c0), 0x10) bind$inet6(r0, &(0x7f0000000040)={0xa, 0x4e24}, 0x1c) lsetxattr$security_ima(&(0x7f0000000280)='./file0\x00', &(0x7f0000000440)='security.ima\x00', 0x0, 0x0, 0x1) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clock_gettime(0x0, &(0x7f0000000100)={0x0, 0x0}) r4 = openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) bind(r4, &(0x7f0000000580)=@can={0x1d, r2}, 0x80) clock_gettime(0x3, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff}) ppoll(&(0x7f0000000000)=[{r0, 0x41a}], 0x1, &(0x7f0000000200)={0x0, r3+30000000}, &(0x7f0000000240)={0x800000000000000}, 0x8) connect$inet6(r0, &(0x7f0000000080)={0xa, 0x4e24, 0x0, @ipv4={[], [], @loopback}}, 0x1c) readv(0xffffffffffffffff, 0x0, 0x0) sendmmsg(r0, &(0x7f00000092c0), 0x4ff, 0x0) connect$pptp(r5, &(0x7f00000004c0)={0x18, 0x2, {0x0, @multicast1}}, 0x1e) 04:02:21 executing program 3: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) recvmsg(0xffffffffffffffff, &(0x7f00000036c0)={&(0x7f0000000180)=@can, 0xfd28, &(0x7f00000035c0), 0x0, &(0x7f0000003680)=""/41, 0x29}, 0x0) bind$alg(r0, &(0x7f0000001300)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb(blowfish)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000ff8000)="0a0775b0", 0x4) r1 = accept$alg(r0, 0x0, 0x0) sendmmsg$alg(r1, &(0x7f0000003e80)=[{0x0, 0x0, &(0x7f0000002a80), 0x167, &(0x7f0000000100)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x0) recvmsg(r1, &(0x7f0000000000)={&(0x7f0000f7ffa8)=@alg, 0x80, &(0x7f0000000140)=[{&(0x7f0000000200)=""/4096, 0x1000}], 0x1, 0x0, 0x8000000000000000}, 0x0) 04:02:21 executing program 1: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) recvmsg(0xffffffffffffffff, &(0x7f00000036c0)={&(0x7f0000000180)=@can, 0xfd28, &(0x7f00000035c0), 0x0, &(0x7f0000003680)=""/41, 0x29}, 0x0) bind$alg(r0, &(0x7f0000001300)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb(blowfish)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000ff8000)="0a0775b0", 0x4) r1 = accept$alg(r0, 0x0, 0x0) sendmmsg$alg(r1, &(0x7f0000003e80)=[{0x0, 0x0, &(0x7f0000002a80), 0x167, &(0x7f0000000100)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x0) recvmsg(r1, &(0x7f0000000000)={&(0x7f0000f7ffa8)=@alg, 0x80, &(0x7f0000000140)=[{&(0x7f0000000200)=""/4096, 0x1000}], 0x1, 0x0, 0xf0ffffff00000000}, 0x0) 04:02:21 executing program 2: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000440)=@updpolicy={0xb8, 0x19, 0x523, 0x0, 0x0, {{@in=@multicast2, @in6=@empty={[0x0, 0x0, 0x0, 0x0, 0xa000000]}, 0x0, 0x0, 0x0, 0x0, 0xa}}}, 0xb8}}, 0x0) 04:02:21 executing program 4: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) recvmsg(0xffffffffffffffff, &(0x7f00000036c0)={&(0x7f0000000180)=@can, 0xfd28, &(0x7f00000035c0), 0x0, &(0x7f0000003680)=""/41, 0x29}, 0x0) bind$alg(r0, &(0x7f0000001300)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb(blowfish)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000ff8000)="0a0775b0", 0x4) r1 = accept$alg(r0, 0x0, 0x0) sendmmsg$alg(r1, &(0x7f0000003e80)=[{0x0, 0x0, &(0x7f0000002a80), 0x167, &(0x7f0000000100)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x0) recvmsg(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)=[{&(0x7f0000000200)=""/4096, 0x1000}], 0x1, &(0x7f0000fb3fa9)=""/87, 0x57}, 0x0) 04:02:21 executing program 0: r0 = perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) setxattr$security_smack_entry(&(0x7f0000000380)='./file0\x00', &(0x7f0000000480)='security.SMACK64IPIN\x00', &(0x7f0000000540)='^vboxnet1^\x00', 0xb, 0x1) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r1, &(0x7f0000000040), 0x0}, 0x20) unlink(&(0x7f0000000900)='./file0/file0\x00') r2 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r3 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r3, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, &(0x7f00000006c0)={0x0}) ioctl$BINDER_GET_NODE_DEBUG_INFO(r2, 0xc018620b, &(0x7f0000000640)={r4}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r3, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x1) prctl$PR_SET_NAME(0xf, &(0x7f00000004c0)='/group.stat\x00') ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, &(0x7f0000000780)}) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f0000000680)}) ioctl$FS_IOC_FIEMAP(r3, 0xc020660b, &(0x7f0000000b80)=ANY=[@ANYBLOB="0000010000000000200000000000000005000000010000000a00000000000000ff030000000000001a0a000000000000050000000000000000000000000000000000000000000000080000000000000000000000000000000800000000000000ffff0000000000000100008000000000000000000000000000000000000000000000000000000000000000000000000008000000000000003f0000000000000008000000000000000000000000000000000000000000800800000000000000000000000000000200000000000000000400000000000000000000010000000000000000000000000000000000000002110000000000000000000000000000cc0000000000000000000000000000001b0000000000000000000000000000000000000000000000841400000000000000000000000000000300000000000000feffffffffffffff000000000000000000000000000000000000000000000000020000000000000000000000000000000600000000000000ff01000000000000040000000000000000000000000000000000000000000000000400000000000000000000000000007be70000000000000900000000000000ff7f0000000000000000000000000000000000000000000004180000000000000000000000000000ffffffff0000000081000000000000000600000000000000000000000000000000000000000000000400000000000000000000000000000002000000000000000500000000000000ff7fffffffffffff0000000000000000000000000000000004040000000000000000000000000000"]) r6 = creat(&(0x7f00000000c0)='./file0\x00', 0x0) openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000100)='/group.stat\x00', 0x2761, 0x0) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000080), 0xffffffffffffffff) getpid() fallocate(r0, 0x0, 0x0, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x2f, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) memfd_create(&(0x7f0000000080)='!proccgroup\x00', 0x0) ioctl$sock_inet_SIOCSIFPFLAGS(0xffffffffffffffff, 0x8934, &(0x7f0000000400)={'veth0_to_bridge\x00', 0x100}) accept(r6, &(0x7f0000000580)=@alg, &(0x7f0000000600)=0x80) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x2400, 0x8000) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000008c0)={0x2c, 0x0, &(0x7f0000000780)=[@acquire_done={0x40106309, r5, 0x2}, @clear_death={0x400c630f, 0x1, 0x3}, @release={0x40046306, 0x2}], 0xc1, 0x0, &(0x7f00000007c0)="859547f83b9b058a973a491d7e6378544744f2b56b02270a2f78214a936e9afb25cd94695643af6563f86771aa9621b9f30f2ca538b018247a633c28ee01e03b4639679311117971e60dc1538f34e961ae301463172c41754be988f6beb0ce4d83c69f86c236d29520e6cdaf5dbb60404c66d63315ff287deac8632781d0197ef1f81314da0a1ed90b681842cf85a41b496ce0a7a6f5aa4b9b23483eea8861be89b3398c6aec3349174f9cdc9de34df361ac9bf7afd8566849487c3c0a1e3aaacd"}) 04:02:22 executing program 2: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000440)=@updpolicy={0xb8, 0x19, 0x523, 0x0, 0x0, {{@in=@multicast2, @in6=@empty={[0x0, 0x0, 0x0, 0x0, 0xe000000]}, 0x0, 0x0, 0x0, 0x0, 0xa}}}, 0xb8}}, 0x0) 04:02:22 executing program 1: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) recvmsg(0xffffffffffffffff, &(0x7f00000036c0)={&(0x7f0000000180)=@can, 0xfd28, &(0x7f00000035c0), 0x0, &(0x7f0000003680)=""/41, 0x29}, 0x0) bind$alg(r0, &(0x7f0000001300)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb(blowfish)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000ff8000)="0a0775b0", 0x4) r1 = accept$alg(r0, 0x0, 0x0) sendmmsg$alg(r1, &(0x7f0000003e80)=[{0x0, 0x0, &(0x7f0000002a80), 0x167, &(0x7f0000000100)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x0) recvmsg(r1, &(0x7f0000000000)={&(0x7f0000f7ffa8)=@alg, 0x80, &(0x7f0000000140)=[{&(0x7f0000000200)=""/4096, 0x1000}], 0x1, 0x0, 0x0, 0x7}, 0x0) [ 656.305659] binder: 23156:23158 ioctl c0306201 0 returned -14 [ 656.337872] binder: BINDER_SET_CONTEXT_MGR already set [ 656.349217] binder: 23156:23158 ioctl 40046207 0 returned -16 04:02:22 executing program 4: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) recvmsg(0xffffffffffffffff, &(0x7f00000036c0)={&(0x7f0000000180)=@can, 0xfd28, &(0x7f00000035c0), 0x0, &(0x7f0000003680)=""/41, 0x29}, 0x0) bind$alg(r0, &(0x7f0000001300)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb(blowfish)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000ff8000)="0a0775b0", 0x4) r1 = accept$alg(r0, 0x0, 0x0) sendmmsg$alg(r1, &(0x7f0000003e80)=[{0x0, 0x0, &(0x7f0000002a80), 0x167, &(0x7f0000000100)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x0) recvmsg(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)=[{&(0x7f0000000200)=""/4096, 0x1000}], 0x1, &(0x7f0000fb3fa9)=""/87, 0x57}, 0x0) 04:02:22 executing program 3: r0 = perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) setxattr$security_smack_entry(&(0x7f0000000380)='./file0\x00', &(0x7f0000000480)='security.SMACK64IPIN\x00', &(0x7f0000000540)='^vboxnet1^\x00', 0xb, 0x1) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r1, &(0x7f0000000040), 0x0}, 0x20) unlink(&(0x7f0000000900)='./file0/file0\x00') r2 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r3 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r3, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, &(0x7f00000006c0)={0x0}) ioctl$BINDER_GET_NODE_DEBUG_INFO(r2, 0xc018620b, &(0x7f0000000640)={r4}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r3, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x1) prctl$PR_SET_NAME(0xf, &(0x7f00000004c0)='/group.stat\x00') ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, &(0x7f0000000780)}) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f0000000680)}) ioctl$FS_IOC_FIEMAP(r3, 0xc020660b, &(0x7f0000000b80)=ANY=[@ANYBLOB="0000010000000000200000000000000005000000010000000a00000000000000ff030000000000001a0a000000000000050000000000000000000000000000000000000000000000080000000000000000000000000000000800000000000000ffff0000000000000100008000000000000000000000000000000000000000000000000000000000000000000000000008000000000000003f0000000000000008000000000000000000000000000000000000000000800800000000000000000000000000000200000000000000000400000000000000000000010000000000000000000000000000000000000002110000000000000000000000000000cc0000000000000000000000000000001b0000000000000000000000000000000000000000000000841400000000000000000000000000000300000000000000feffffffffffffff000000000000000000000000000000000000000000000000020000000000000000000000000000000600000000000000ff01000000000000040000000000000000000000000000000000000000000000000400000000000000000000000000007be70000000000000900000000000000ff7f0000000000000000000000000000000000000000000004180000000000000000000000000000ffffffff0000000081000000000000000600000000000000000000000000000000000000000000000400000000000000000000000000000002000000000000000500000000000000ff7fffffffffffff0000000000000000000000000000000004040000000000000000000000000000"]) r6 = creat(&(0x7f00000000c0)='./file0\x00', 0x0) openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000100)='/group.stat\x00', 0x2761, 0x0) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000080), 0xffffffffffffffff) getpid() fallocate(r0, 0x0, 0x0, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x2f, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) memfd_create(&(0x7f0000000080)='!proccgroup\x00', 0x0) ioctl$sock_inet_SIOCSIFPFLAGS(0xffffffffffffffff, 0x8934, &(0x7f0000000400)={'veth0_to_bridge\x00', 0x100}) accept(r6, &(0x7f0000000580)=@alg, &(0x7f0000000600)=0x80) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x2400, 0x8000) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000008c0)={0x2c, 0x0, &(0x7f0000000780)=[@acquire_done={0x40106309, r5, 0x2}, @clear_death={0x400c630f, 0x1, 0x3}, @release={0x40046306, 0x2}], 0xc1, 0x0, &(0x7f00000007c0)="859547f83b9b058a973a491d7e6378544744f2b56b02270a2f78214a936e9afb25cd94695643af6563f86771aa9621b9f30f2ca538b018247a633c28ee01e03b4639679311117971e60dc1538f34e961ae301463172c41754be988f6beb0ce4d83c69f86c236d29520e6cdaf5dbb60404c66d63315ff287deac8632781d0197ef1f81314da0a1ed90b681842cf85a41b496ce0a7a6f5aa4b9b23483eea8861be89b3398c6aec3349174f9cdc9de34df361ac9bf7afd8566849487c3c0a1e3aaacd"}) 04:02:22 executing program 2: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000440)=@updpolicy={0xb8, 0x19, 0x523, 0x0, 0x0, {{@in=@multicast2, @in6=@empty={[0x0, 0x0, 0x0, 0x0, 0xf000000]}, 0x0, 0x0, 0x0, 0x0, 0xa}}}, 0xb8}}, 0x0) [ 656.586545] binder: 23178:23181 ioctl c0306201 0 returned -14 04:02:22 executing program 4: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) recvmsg(0xffffffffffffffff, &(0x7f00000036c0)={&(0x7f0000000180)=@can, 0xfd28, &(0x7f00000035c0), 0x0, &(0x7f0000003680)=""/41, 0x29}, 0x0) bind$alg(r0, &(0x7f0000001300)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb(blowfish)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000ff8000)="0a0775b0", 0x4) r1 = accept$alg(r0, 0x0, 0x0) sendmmsg$alg(r1, &(0x7f0000003e80)=[{0x0, 0x0, &(0x7f0000002a80), 0x167, &(0x7f0000000100)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x0) recvmsg(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)=[{&(0x7f0000000200)=""/4096, 0x1000}], 0x1, &(0x7f0000fb3fa9)=""/87, 0x57}, 0x0) [ 656.632998] binder: BINDER_SET_CONTEXT_MGR already set [ 656.663791] binder: 23178:23181 ioctl 40046207 0 returned -16 [ 656.757134] binder: 23178:23188 BC_INCREFS_DONE node 418 has no pending increfs request [ 656.773632] binder: 23178:23188 Release 1 refcount change on invalid ref 1 ret -22 [ 656.793308] binder: 23178:23188 BC_ACQUIRE_DONE node 418 has no pending acquire request [ 656.840292] binder: 23178:23195 BC_ACQUIRE_DONE u0000000000000000 no match [ 656.851039] binder: 23178:23195 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 [ 656.859925] binder: 23178:23195 Release 1 refcount change on invalid ref 2 ret -22 04:02:22 executing program 5: r0 = socket$inet6(0xa, 0x2, 0x0) r1 = syz_open_dev$mice(&(0x7f00000002c0)='/dev/input/mice\x00', 0x0, 0x0) ioctl$PPPOEIOCDFWD(r1, 0xb101, 0x0) syz_genetlink_get_family_id$nbd(&(0x7f0000000480)='nbd\x00') getsockopt$inet6_IPV6_XFRM_POLICY(r0, 0x29, 0x23, &(0x7f0000000340)={{{@in=@local, @in=@loopback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@local}, 0x0, @in=@remote}}, &(0x7f0000000140)=0xe8) connect$can_bcm(0xffffffffffffffff, &(0x7f00000001c0), 0x10) bind$inet6(r0, &(0x7f0000000040)={0xa, 0x4e24}, 0x1c) lsetxattr$security_ima(&(0x7f0000000280)='./file0\x00', &(0x7f0000000440)='security.ima\x00', 0x0, 0x0, 0x1) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clock_gettime(0x0, &(0x7f0000000100)={0x0, 0x0}) r4 = openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) bind(r4, &(0x7f0000000580)=@can={0x1d, r2}, 0x80) clock_gettime(0x3, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff}) ppoll(&(0x7f0000000000)=[{r0, 0x41a}], 0x1, &(0x7f0000000200)={0x0, r3+30000000}, &(0x7f0000000240)={0x2000000000000000}, 0x8) connect$inet6(r0, &(0x7f0000000080)={0xa, 0x4e24, 0x0, @ipv4={[], [], @loopback}}, 0x1c) readv(0xffffffffffffffff, 0x0, 0x0) sendmmsg(r0, &(0x7f00000092c0), 0x4ff, 0x0) connect$pptp(r5, &(0x7f00000004c0)={0x18, 0x2, {0x0, @multicast1}}, 0x1e) 04:02:22 executing program 1: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) recvmsg(0xffffffffffffffff, &(0x7f00000036c0)={&(0x7f0000000180)=@can, 0xfd28, &(0x7f00000035c0), 0x0, &(0x7f0000003680)=""/41, 0x29}, 0x0) bind$alg(r0, &(0x7f0000001300)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb(blowfish)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000ff8000)="0a0775b0", 0x4) r1 = accept$alg(r0, 0x0, 0x0) sendmmsg$alg(r1, &(0x7f0000003e80)=[{0x0, 0x0, &(0x7f0000002a80), 0x167, &(0x7f0000000100)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x0) recvmsg(r1, &(0x7f0000000000)={&(0x7f0000f7ffa8)=@alg, 0x80, &(0x7f0000000140)=[{&(0x7f0000000200)=""/4096, 0x1000}], 0x1, 0x0, 0x0, 0x8}, 0x0) 04:02:22 executing program 0: r0 = perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) setxattr$security_smack_entry(&(0x7f0000000380)='./file0\x00', &(0x7f0000000480)='security.SMACK64IPIN\x00', &(0x7f0000000540)='^vboxnet1^\x00', 0xb, 0x1) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r1, &(0x7f0000000040), 0x0}, 0x20) unlink(&(0x7f0000000900)='./file0/file0\x00') r2 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r3 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r3, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, &(0x7f00000006c0)={0x0}) ioctl$BINDER_GET_NODE_DEBUG_INFO(r2, 0xc018620b, &(0x7f0000000640)={r4}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x48, 0x0, &(0x7f0000000700)="2ba063fb309ec7fdbfb08e6e91baee7d7d4599fe14129a4d426834556ae420e087d59c0c7be7fcad1abb7e1f8f446f373f611ca1ee9c2231708e18a47bc68a2a79a0b48931f6ff6d"}) ioctl$BINDER_SET_CONTEXT_MGR(r3, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x1) prctl$PR_SET_NAME(0xf, &(0x7f00000004c0)='/group.stat\x00') ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, &(0x7f0000000780)}) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f0000000680)}) ioctl$FS_IOC_FIEMAP(r3, 0xc020660b, &(0x7f0000000b80)=ANY=[@ANYBLOB="0000010000000000200000000000000005000000010000000a00000000000000ff030000000000001a0a000000000000050000000000000000000000000000000000000000000000080000000000000000000000000000000800000000000000ffff0000000000000100008000000000000000000000000000000000000000000000000000000000000000000000000008000000000000003f0000000000000008000000000000000000000000000000000000000000800800000000000000000000000000000200000000000000000400000000000000000000010000000000000000000000000000000000000002110000000000000000000000000000cc0000000000000000000000000000001b0000000000000000000000000000000000000000000000841400000000000000000000000000000300000000000000feffffffffffffff000000000000000000000000000000000000000000000000020000000000000000000000000000000600000000000000ff01000000000000040000000000000000000000000000000000000000000000000400000000000000000000000000007be70000000000000900000000000000ff7f0000000000000000000000000000000000000000000004180000000000000000000000000000ffffffff0000000081000000000000000600000000000000000000000000000000000000000000000400000000000000000000000000000002000000000000000500000000000000ff7fffffffffffff0000000000000000000000000000000004040000000000000000000000000000"]) r6 = creat(&(0x7f00000000c0)='./file0\x00', 0x0) openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000100)='/group.stat\x00', 0x2761, 0x0) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000080), 0xffffffffffffffff) getpid() fallocate(r0, 0x0, 0x0, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x2f, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) memfd_create(&(0x7f0000000080)='!proccgroup\x00', 0x0) ioctl$sock_inet_SIOCSIFPFLAGS(0xffffffffffffffff, 0x8934, &(0x7f0000000400)={'veth0_to_bridge\x00', 0x100}) accept(r6, &(0x7f0000000580)=@alg, &(0x7f0000000600)=0x80) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x2400, 0x8000) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000008c0)={0x2c, 0x0, &(0x7f0000000780)=[@acquire_done={0x40106309, r5, 0x2}, @clear_death={0x400c630f, 0x1, 0x3}, @release={0x40046306, 0x2}], 0xc1, 0x0, &(0x7f00000007c0)="859547f83b9b058a973a491d7e6378544744f2b56b02270a2f78214a936e9afb25cd94695643af6563f86771aa9621b9f30f2ca538b018247a633c28ee01e03b4639679311117971e60dc1538f34e961ae301463172c41754be988f6beb0ce4d83c69f86c236d29520e6cdaf5dbb60404c66d63315ff287deac8632781d0197ef1f81314da0a1ed90b681842cf85a41b496ce0a7a6f5aa4b9b23483eea8861be89b3398c6aec3349174f9cdc9de34df361ac9bf7afd8566849487c3c0a1e3aaacd"}) 04:02:22 executing program 2: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000440)=@updpolicy={0xb8, 0x19, 0x523, 0x0, 0x0, {{@in=@multicast2, @in6=@empty={[0x0, 0x0, 0x0, 0x0, 0x10000000]}, 0x0, 0x0, 0x0, 0x0, 0xa}}}, 0xb8}}, 0x0) 04:02:22 executing program 4: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) recvmsg(0xffffffffffffffff, &(0x7f00000036c0)={&(0x7f0000000180)=@can, 0xfd28, &(0x7f00000035c0), 0x0, &(0x7f0000003680)=""/41, 0x29}, 0x0) bind$alg(r0, &(0x7f0000001300)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb(blowfish)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000ff8000)="0a0775b0", 0x4) r1 = accept$alg(r0, 0x0, 0x0) sendmmsg$alg(r1, &(0x7f0000003e80)=[{0x0, 0x0, &(0x7f0000002a80), 0x167, &(0x7f0000000100)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x0) recvmsg(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)=[{&(0x7f0000000200)=""/4096, 0x1000}], 0x1, &(0x7f0000fb3fa9)=""/87, 0x57}, 0x0) 04:02:22 executing program 2: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000440)=@updpolicy={0xb8, 0x19, 0x523, 0x0, 0x0, {{@in=@multicast2, @in6=@empty={[0x0, 0x0, 0x0, 0x0, 0x24030000]}, 0x0, 0x0, 0x0, 0x0, 0xa}}}, 0xb8}}, 0x0) 04:02:22 executing program 4: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) recvmsg(0xffffffffffffffff, &(0x7f00000036c0)={&(0x7f0000000180)=@can, 0xfd28, &(0x7f00000035c0), 0x0, &(0x7f0000003680)=""/41, 0x29}, 0x0) bind$alg(r0, &(0x7f0000001300)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb(blowfish)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000ff8000)="0a0775b0", 0x4) r1 = accept$alg(r0, 0x0, 0x0) sendmmsg$alg(r1, &(0x7f0000003e80)=[{0x0, 0x0, &(0x7f0000002a80), 0x167, &(0x7f0000000100)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x0) recvmsg(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)=[{&(0x7f0000000200)=""/4096, 0x1000}], 0x1, &(0x7f0000fb3fa9)=""/87, 0x57}, 0x0) 04:02:22 executing program 1: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) recvmsg(0xffffffffffffffff, &(0x7f00000036c0)={&(0x7f0000000180)=@can, 0xfd28, &(0x7f00000035c0), 0x0, &(0x7f0000003680)=""/41, 0x29}, 0x0) bind$alg(r0, &(0x7f0000001300)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb(blowfish)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000ff8000)="0a0775b0", 0x4) r1 = accept$alg(r0, 0x0, 0x0) sendmmsg$alg(r1, &(0x7f0000003e80)=[{0x0, 0x0, &(0x7f0000002a80), 0x167, &(0x7f0000000100)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x0) recvmsg(r1, &(0x7f0000000000)={&(0x7f0000f7ffa8)=@alg, 0x80, &(0x7f0000000140)=[{&(0x7f0000000200)=""/4096, 0x1000}], 0x1, 0x0, 0x0, 0x10}, 0x0) [ 657.267857] binder: release 23178:23181 transaction 417 out, still active 04:02:23 executing program 4: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) recvmsg(0xffffffffffffffff, &(0x7f00000036c0)={&(0x7f0000000180)=@can, 0xfd28, &(0x7f00000035c0), 0x0, &(0x7f0000003680)=""/41, 0x29}, 0x0) bind$alg(r0, &(0x7f0000001300)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb(blowfish)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000ff8000)="0a0775b0", 0x4) r1 = accept$alg(r0, 0x0, 0x0) sendmmsg$alg(r1, &(0x7f0000003e80)=[{0x0, 0x0, &(0x7f0000002a80), 0x167, &(0x7f0000000100)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x0) recvmsg(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)=[{&(0x7f0000000200)=""/4096, 0x1000}], 0x1, &(0x7f0000fb3fa9)=""/87, 0x57}, 0x0) 04:02:23 executing program 3: mkdir(&(0x7f0000000380)='./file0\x00', 0x0) mount(0x0, &(0x7f000000aff8)='./file1\x00', &(0x7f000000c000)='ramfs\x00', 0x0, 0x0) chdir(&(0x7f0000000780)='./file0\x00') symlink(&(0x7f0000000080)='./file2\x00', &(0x7f00000000c0)='./file1\x00') rename(&(0x7f0000000140)='./file1\x00', &(0x7f0000000180)='./file0\x00') 04:02:23 executing program 2: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000440)=@updpolicy={0xb8, 0x19, 0x523, 0x0, 0x0, {{@in=@multicast2, @in6=@empty={[0x0, 0x0, 0x0, 0x0, 0x2f000000]}, 0x0, 0x0, 0x0, 0x0, 0xa}}}, 0xb8}}, 0x0) 04:02:23 executing program 0: r0 = perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) setxattr$security_smack_entry(&(0x7f0000000380)='./file0\x00', &(0x7f0000000480)='security.SMACK64IPIN\x00', &(0x7f0000000540)='^vboxnet1^\x00', 0xb, 0x1) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r1, &(0x7f0000000040), 0x0}, 0x20) unlink(&(0x7f0000000900)='./file0/file0\x00') r2 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r3 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r3, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, &(0x7f00000006c0)={0x0}) ioctl$BINDER_GET_NODE_DEBUG_INFO(r2, 0xc018620b, &(0x7f0000000640)={r4}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x48, 0x0, &(0x7f0000000700)="2ba063fb309ec7fdbfb08e6e91baee7d7d4599fe14129a4d426834556ae420e087d59c0c7be7fcad1abb7e1f8f446f373f611ca1ee9c2231708e18a47bc68a2a79a0b48931f6ff6d"}) ioctl$BINDER_SET_CONTEXT_MGR(r3, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x1) prctl$PR_SET_NAME(0xf, &(0x7f00000004c0)='/group.stat\x00') ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, &(0x7f0000000780)}) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f0000000680)}) ioctl$FS_IOC_FIEMAP(r3, 0xc020660b, &(0x7f0000000b80)=ANY=[@ANYBLOB="0000010000000000200000000000000005000000010000000a00000000000000ff030000000000001a0a000000000000050000000000000000000000000000000000000000000000080000000000000000000000000000000800000000000000ffff0000000000000100008000000000000000000000000000000000000000000000000000000000000000000000000008000000000000003f0000000000000008000000000000000000000000000000000000000000800800000000000000000000000000000200000000000000000400000000000000000000010000000000000000000000000000000000000002110000000000000000000000000000cc0000000000000000000000000000001b0000000000000000000000000000000000000000000000841400000000000000000000000000000300000000000000feffffffffffffff000000000000000000000000000000000000000000000000020000000000000000000000000000000600000000000000ff01000000000000040000000000000000000000000000000000000000000000000400000000000000000000000000007be70000000000000900000000000000ff7f0000000000000000000000000000000000000000000004180000000000000000000000000000ffffffff0000000081000000000000000600000000000000000000000000000000000000000000000400000000000000000000000000000002000000000000000500000000000000ff7fffffffffffff0000000000000000000000000000000004040000000000000000000000000000"]) r6 = creat(&(0x7f00000000c0)='./file0\x00', 0x0) openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000100)='/group.stat\x00', 0x2761, 0x0) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000080), 0xffffffffffffffff) getpid() fallocate(r0, 0x0, 0x0, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x2f, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) memfd_create(&(0x7f0000000080)='!proccgroup\x00', 0x0) ioctl$sock_inet_SIOCSIFPFLAGS(0xffffffffffffffff, 0x8934, &(0x7f0000000400)={'veth0_to_bridge\x00', 0x100}) accept(r6, &(0x7f0000000580)=@alg, &(0x7f0000000600)=0x80) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x2400, 0x8000) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000008c0)={0x2c, 0x0, &(0x7f0000000780)=[@acquire_done={0x40106309, r5, 0x2}, @clear_death={0x400c630f, 0x1, 0x3}, @release={0x40046306, 0x2}], 0xc1, 0x0, &(0x7f00000007c0)="859547f83b9b058a973a491d7e6378544744f2b56b02270a2f78214a936e9afb25cd94695643af6563f86771aa9621b9f30f2ca538b018247a633c28ee01e03b4639679311117971e60dc1538f34e961ae301463172c41754be988f6beb0ce4d83c69f86c236d29520e6cdaf5dbb60404c66d63315ff287deac8632781d0197ef1f81314da0a1ed90b681842cf85a41b496ce0a7a6f5aa4b9b23483eea8861be89b3398c6aec3349174f9cdc9de34df361ac9bf7afd8566849487c3c0a1e3aaacd"}) 04:02:23 executing program 5: r0 = socket$inet6(0xa, 0x2, 0x0) r1 = syz_open_dev$mice(&(0x7f00000002c0)='/dev/input/mice\x00', 0x0, 0x0) ioctl$PPPOEIOCDFWD(r1, 0xb101, 0x0) syz_genetlink_get_family_id$nbd(&(0x7f0000000480)='nbd\x00') getsockopt$inet6_IPV6_XFRM_POLICY(r0, 0x29, 0x23, &(0x7f0000000340)={{{@in=@local, @in=@loopback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@local}, 0x0, @in=@remote}}, &(0x7f0000000140)=0xe8) connect$can_bcm(0xffffffffffffffff, &(0x7f00000001c0), 0x10) bind$inet6(r0, &(0x7f0000000040)={0xa, 0x4e24}, 0x1c) lsetxattr$security_ima(&(0x7f0000000280)='./file0\x00', &(0x7f0000000440)='security.ima\x00', 0x0, 0x0, 0x1) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clock_gettime(0x0, &(0x7f0000000100)={0x0, 0x0}) r4 = openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) bind(r4, &(0x7f0000000580)=@can={0x1d, r2}, 0x80) clock_gettime(0x3, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff}) ppoll(&(0x7f0000000000)=[{r0, 0x41a}], 0x1, &(0x7f0000000200)={0x0, r3+30000000}, &(0x7f0000000240)={0x3f00000000000000}, 0x8) connect$inet6(r0, &(0x7f0000000080)={0xa, 0x4e24, 0x0, @ipv4={[], [], @loopback}}, 0x1c) readv(0xffffffffffffffff, 0x0, 0x0) sendmmsg(r0, &(0x7f00000092c0), 0x4ff, 0x0) connect$pptp(r5, &(0x7f00000004c0)={0x18, 0x2, {0x0, @multicast1}}, 0x1e) 04:02:23 executing program 1: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) recvmsg(0xffffffffffffffff, &(0x7f00000036c0)={&(0x7f0000000180)=@can, 0xfd28, &(0x7f00000035c0), 0x0, &(0x7f0000003680)=""/41, 0x29}, 0x0) bind$alg(r0, &(0x7f0000001300)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb(blowfish)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000ff8000)="0a0775b0", 0x4) r1 = accept$alg(r0, 0x0, 0x0) sendmmsg$alg(r1, &(0x7f0000003e80)=[{0x0, 0x0, &(0x7f0000002a80), 0x167, &(0x7f0000000100)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x0) recvmsg(r1, &(0x7f0000000000)={&(0x7f0000f7ffa8)=@alg, 0x80, &(0x7f0000000140)=[{&(0x7f0000000200)=""/4096, 0x1000}], 0x1, 0x0, 0x0, 0x700}, 0x0) 04:02:23 executing program 3: perf_event_open(&(0x7f00000000c0)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4d63, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000001180)='/dev/nullb0\x00', 0x3ffe, 0x0) remap_file_pages(&(0x7f0000ffc000/0x2000)=nil, 0x2000, 0x2000003, 0x7d40, 0x80000) fsetxattr$trusted_overlay_upper(r0, &(0x7f0000000040)='trusted.overlay.upper\x00', &(0x7f0000000140)={0x0, 0xfb, 0x1015, 0x0, 0x9, "38d967f378a3d38517317ad75a156ebf", "56711e04b92481aa72d5184310d9aa7a7393e7c58f68a4592fb6140c3f0229df4f6aead606c1b521fef1c0fe7f10bac7fc096c5679c1d7e05badd7183a78dba27d875a906775be911ce8c3a8e6865cf47745fd5d45799fbebd54d2db037a5f09fc5bca06b0be5cd335883b085b3c74bdb6359067c2c281a5ec14e64f6e1ac5e332d57ff880b6d452c5d7e157b235ff7e1c3631221878f0212155bcfab1aa2a6a165290f7f1e3cdae6a0b4540637a69dce5801bd258c3e38ead07e1483a6f2566f14618305571e18fa68e74aedd6c7499da94c14ec7894f62452e0aef86d8eb10d49c6c460b7a9394c92d6001e7a6ee113c77c912183a1157fcd0daf3344b298535efbd80dcba42f29e65e4b877deb49251c4b07ac9c897d8e0fefc157d932b117b96c67ec2c8d801a6d0b6e461e0ad50fc0ece6358b93392fdade57281ac4cf0b3b5cd076ae320b7be5d074a475f49211d340c321fa4d389825ebd280b32ee4af4975bc90bb36075bf9a79a13dc5d4df59459f91ed64c819f4faaac11199d68883103a6145358d70de737c0cfd09c755d594d3c94bce0ce8dc329ec6eb6d11efe82ea76e1eebce82a73642eaa50756035f8b3213bc706c85440fb33784fbd45bc2d716e9076e0c013b3ce2ad1c0c7a36e6144081cdaba2386925bb7fba1dfb6c708020d8d2675a01a5233ca4c2c12e8a46a3650aad2ecddbdee58f369a5d0d1f6be5b8d0d560bbf7c23fdadfdf9bb9b93b2592f0e624b9d3b8bf9a2d89cd80387b303e026ba4cb260cb9a0e8b05818c3c99c31eaa3601dd2cf8f957b7ecc9b12f4d05fbb84d01f43abaa426cd9ba85b3e42b58a08c81159a8e1972760a8bf89f933c39c656a14e455e9ba1ce02b5ad61dedb5cea32b00c8f2cd4a7b8a367a42449431ca652a386c60bb5f92ad1cb60d392f066b3231d16e91eb68cb684d9ab45dd30253a3f0a6028d0a0db844c48618835e68cede8bdaa8cd6791246640410535e2992e3d21943a10d80170e74f8b88a90523fd9ab8814f916218b50c8e1efad0b660cc137a1fd680f4b7c6db5ba9b17a2a2a23950c3897c56621eed4fed2b44dcd79a56ee7bdc37e62325f2b10439f29f86b71194b8ef69ffa488154e0402abff5355e761c7b360612d6d779afe675bcc3d7e068bbb07105417a927c19c68ec5f36e33c6537f4e7ff30917d226cded88abee377f596281c13869e77b70240baa2a1ab345bce74b30073d1ea54be1d496443b7028fee792e445ab11f612ec728f7a45a1fb20bb1b260e2b8089951b8a13218a7745f86368374f0277ad71ebc13885ff7d09644d4d4462501d316cdfac979e96345df1293e3878ec9e6b63a92562090af98a048336a27501b500b38e36a99feba7f479a33389cb84129a74a813c9bcbb4850e39f9f26c922e89598f37c442df2f588f4489da9aad1168dac6a984464a11c0251f4631b2994cc4f4a5f18ad00eea57c65a0120479a5aaaee8660fccab66fbe7fa0b92ba5e152a422c93be9bf40d5229303001d861dad2795956ad8dbed15516ee6bcac3490bc6ce8ef26af90c541906b3213d3cc8f672cda2f8c49bd428eb8d8b08eea5cee657d1371bc7bdf3591925914a22d729aa05bb8d5f79979a34522a65a1486e8e44361777af191c5288ffe7fd0dd8142f55d36d53564ad7291d32c457fc9e22eb75c00355cd1a13fe1008452abdf63edb99b0c5e0e6d8e05b2b0bae62e58f27e295ccb9c649c71317d7be248acd85f3ece09bfb8b05c2daeb5a40d23cd603eed95e312f5081e132d017ed8a2242217a9f849b26205d414f567196f62f06d597a76325eb13c4fde6ad238fa7ecfab1dabc4dfb0c805f84fb462f1bc710afc0ea15fa8cfa2a711f14f098f1b479399d04d31321a861177474fcc010dc3906b0f69038a63e131ad0d7b7e276515f762130f527e0b5a143402862a1b2f0b486afaf6f282193014222cd075532270c81a8e8fe404b482151cbbcf351df35a0d75035adf113a592030c4d6f8a9d1deae6b699e920b05fee06651c8a865f43574b7dcb2d37380a3b30dee6b5509c9c36d9bdd68cc2e140275167442eb155b53c75fdfd6bea4f0cb7c58d2d1bcb53fa8605d9c4d2f48befa648c93158c9c2eedfa5e3841f6d7a21170528f45562a04935951d52f1410ba30b11ca67325d2151c77f8683dabcb5f805dce4efe58acf981f5d3f4e8435ce89943926f6f1a6ad843b139d26dc614ebe9ac70924d6ee13956a44398c7e288501a23e4acbc048f9e54408605627bba8baabdd6b9267f2490514c6b06bd7b6c65298bb5f3588c3e4c855b2815ac5b1673b14b9e04117181e28a0c69b294519c719f9111ece34034d3c32af3bf70e189267dbdfedcfba457b0f75a2afc210807a6d0c4f80bb2eb4917b89a5a9ffa5afef4f42490f6160939d0274947846c19ff4eb02ffdcb30fa0ee27a5258f8cbcd4a4186bff0f6a9d47e6f70f5f4d17977195cc5c216d17517df5b99bde745819091c038ebf552bca58b1cfeca7ba12e9f2cadd7751ec421198270835d3b7f8c8c15451602525b8773a924c1fbdbe622d8b72a6eeeebd401ae129327dae7511d450ff94c35b4c4edebfcb3841b1077a17686cd9c46d91f47f27c0507b7e3302eabf57d58383711ad3adc32c2775830feab2e1c907fd2cb2040ee8680bfa6e67defda1da2796a20c69086bd1c3078d3da8c0cdf79a99a5366032df2ed861b0a113c203f18b08260f5735b7b675cfa40f0a2fc0f37f4054ea8fdb11a41636a94ffab6be8d77dd27389d9515e0e1aad69f178655908282717213239441892433e76ef323062d25ccd41841d7eaa94e0e8dccf81cc57a27abf2bc6c7d87ce5f94fb18bb2737cf587ecc91fe8be09042785d88d968fa09f3cbefa2199c191b6a72d74a11fcf61e56389192ae246de1f3aa44cbba018ba2d7695479dcffceb20dab2a4c6c982a7c6c0bd91b6eebbf3847734816504095dd9c9ca51891ae9ade353516e7819973deed61f7572f6105e588d12453e66262f75deaa367f4ff8aabbdf95dbca0bae7a5fcdd023cd39707b54b38f2adad8736135e9d93a3169c96e5503e69aef77f68cea3ce8c1483c8497301fe3ec998d3a63fc5c3e648411b0bcee625dbbaa2ea6cc0dad2bcdcc8d0367ac6a270f6b1195748d712b00c825d6ba37305ac508ec16a4a72d3888a314c3518144d78f1360d1c174be3f0e7558e0a99d5350ca65f6ff8a567e76638276bf32a7e11a57b8318338750139d81336a05864a421dfd7828ab3319653c734f2c10ad83a134774efd0ff5eb19483270c5d983617067296fd26d7ab24206ac50c3ff1e0f25429be238e45bd9836d471128878dacaf9c513263df5532c856fdca618b4298482f19a26f10d5cb3f739f8e27a6d9ad8199e5a837d2881d1661edfa411f385a1016e92f5799d6534cf7f3660604b62a5d1d439d325a916fad6c537e5eee47fcda45c20bc143d660984da3e4d443c7a614d8fe116e5729a0d0a7940b7d427141e6108eac7be259fd9ce6bbb530ec20e92e717e989b40edead38bc86854107320b0ae6d1e865c03ffa933cb69502496d8c5514b052788244d4b4b26af1bf3da4de43f3c6752ef38fa42774159db7229d3be1c6c3a108010ae98b12297245bb06ce969a44308ab3db48b88500780b534d17b10279a452a25b2cf219a1a6b7f1781ff4d6f36254c9526a4fe6329d8925eb2fa3dfdc329f83ccaa6255bd2f1c8c9f5fa2875ba2c6dc311126a6099e37cf5b56f923106a87d770e5cd221b3ec099a83f24d53f723eaa9f171803eddc9031ce3746c837159c405e23c5856df154e5c2972737d84330ff72e04b60df2192d138d03b1d76b8fa0213857ef6d14eac9cc98ca68cf507455b5145448ac939618f07aafa2b1499421ef36ffd9ca52ccf62769dbcc1f05deae9f7b8e8692550f4970b18a5f95ec87550fc28bcdb793b2c32685178efa1eab675de833939c31badae9f019aee216c423ba1bb71f4021805648cc54a4cd75815957236e95338002c7dec60939e865bd532e014d05b9ac4ca8d9824a6c4624b66c6609a3a677181505445c9e95accf3edaa48c8ced25df1d0300705875c115f6a15840582758b5d888031c13f7909e656f77384d85a99caa8100a6e9d6d13e169e6880569f42e79d6f7b1aeb1bad36549e9cebf81de102dce7023236105ebc55a5ad894f73798f56a2eb0bc5c3a5d1538842bf7502806f8d5bb56bac2d64368c556b60abe77d94bbc4775e32b000f722fc72cb764242eda2de63109188c208d36a852c2ee33fc057732084771f694150600e4ce7d1f4e13357365af75c6b57205db598003fb29bd77a793b6e05905875d5082e9fc7af09742c2cc000a84b6e091e11570272d4710da13f673dc34d58c67f343abf26fd97a085f88f6476587ec1b152c745086f09c0d3819ee385617dbcdaa9b154da55831bef43389bdafcffae77d4f6f3de36f15136d6be8cb4afd1a6075fe1018ace7d1198e4ec75b83aa939a31402b0ad9d3a41ef527bb7117126583c5127a1f0a9be56b4f16a585a51d282f9b531ea6b37b9952b9a0c6033d378b4926043ae9b466b4820a8e5243b8dd24f26995529e5ac63ec730124fded340cb3f363b832cdab59ae4658699b96a734e1dcfdf44bb5200bf0cfc1e77d14fa2bdcd94cb18485b2551eb39c9307f4a39c51479e12f2f5c41e1e56d44a0cdec7faf751860d877d449d65a41333a42d5604be2ae96c773c6b351274a6cc72c1e1df8ff8451120ccc59167350b1b335cd91c0755fab2b1417c0cd1113782ef0a62dfc3c183de950c9c11dcf768991ddda41cd50ac2dd54e10c006df5ef6cd78de1b12368838c0633ffb7579a032b635a3a313b0d3abe76350ad144e06efe266e2df7fc67b451087a49d9e31b71ace80d363782ce45f4de2908cec3ab018ffff52980bd2776422f003a44cca59bf2822159da1a0ce2c86af7512ee34b3cccdcc4c9e331c66ee6ead38256e4ed29fafbdf1b4aab1c83ca5785b548c91951437548cd0bd37ec8e6022cc7fcf302f1f7f7cbd15fc17a629c250e0518f809bf6256adc5f7149407031583655169c3b280676105445052b231f4f501f061dcf255e3b524890120e65fbeba2a1e037585484544cac53a051473f4509d2d0487c9822a9cae298c05a2e294a632af54176c3eef5a61833d8969940e4798739c5632c69ebe2619e1ed3952a4f3ea803c8ac5e00522ebfadf34cf95feeaa4fd68870140fea0b2f0b06f37e9d573dcab573d7fc3748edcffa94f3ef96977840abd64ba5532598af3123c8f9acf33bc24ae16e3ad5afcf4d7f8822e6a1066018b8b935428a73202ffd179fde443397472c7d837a275176e038655c92f84780dc4364768e10c7cf57376fc4425bb01341bfdba83b99dd71b4ff588b0a35149e65d288d0f623bdb4485e231be01377b694d39a0eee39dd470152dbdf920f8c1f741c47af8b07d9b7db947b41ae50fa05ea046ca469dfc9aea06560f153214dec61addc56d026d4f6097ae86b6a8f9b6a5abd0a11ac176de28ff711a2895d858c451062851790da74568e4c396e10142e4fe17bf89d6e3f4c2d444db59a08f1028fd04d35738a1f6f27be32445e052b47c1c326392349dc7ccba56ab21e93b5170adcc9ec05eddd76ea0c13d1dc3f5f59960f2260dc822d6665ffde519d47bdb341a1a8d73cb2b4cae18308c0e24ae001d59258eceb772e1633dfd1c2864195e0ac96326d66e00a30f5a6b3ab6d199de51f0efb7e440ee42a48831cce1225ec"}, 0x1015, 0x1) preadv(r0, &(0x7f0000000040), 0x1000000000000044, 0x0) openat$nullb(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x2000, 0x0) 04:02:23 executing program 4: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) recvmsg(0xffffffffffffffff, &(0x7f00000036c0)={&(0x7f0000000180)=@can, 0xfd28, &(0x7f00000035c0), 0x0, &(0x7f0000003680)=""/41, 0x29}, 0x0) bind$alg(r0, &(0x7f0000001300)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb(blowfish)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000ff8000)="0a0775b0", 0x4) r1 = accept$alg(r0, 0x0, 0x0) sendmmsg$alg(r1, &(0x7f0000003e80)=[{0x0, 0x0, &(0x7f0000002a80), 0x167, &(0x7f0000000100)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x0) recvmsg(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)=[{&(0x7f0000000200)=""/4096, 0x1000}], 0x1, &(0x7f0000fb3fa9)=""/87, 0x57}, 0x0) 04:02:23 executing program 2: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000440)=@updpolicy={0xb8, 0x19, 0x523, 0x0, 0x0, {{@in=@multicast2, @in6=@empty={[0x0, 0x0, 0x0, 0x0, 0x60000000]}, 0x0, 0x0, 0x0, 0x0, 0xa}}}, 0xb8}}, 0x0) 04:02:23 executing program 0: r0 = perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) setxattr$security_smack_entry(&(0x7f0000000380)='./file0\x00', &(0x7f0000000480)='security.SMACK64IPIN\x00', &(0x7f0000000540)='^vboxnet1^\x00', 0xb, 0x1) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r1, &(0x7f0000000040), 0x0}, 0x20) unlink(&(0x7f0000000900)='./file0/file0\x00') r2 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r3 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r3, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, &(0x7f00000006c0)={0x0}) ioctl$BINDER_GET_NODE_DEBUG_INFO(r2, 0xc018620b, &(0x7f0000000640)={r4}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x48, 0x0, &(0x7f0000000700)="2ba063fb309ec7fdbfb08e6e91baee7d7d4599fe14129a4d426834556ae420e087d59c0c7be7fcad1abb7e1f8f446f373f611ca1ee9c2231708e18a47bc68a2a79a0b48931f6ff6d"}) ioctl$BINDER_SET_CONTEXT_MGR(r3, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x1) prctl$PR_SET_NAME(0xf, &(0x7f00000004c0)='/group.stat\x00') ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, &(0x7f0000000780)}) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f0000000680)}) ioctl$FS_IOC_FIEMAP(r3, 0xc020660b, &(0x7f0000000b80)=ANY=[@ANYBLOB="0000010000000000200000000000000005000000010000000a00000000000000ff030000000000001a0a000000000000050000000000000000000000000000000000000000000000080000000000000000000000000000000800000000000000ffff0000000000000100008000000000000000000000000000000000000000000000000000000000000000000000000008000000000000003f0000000000000008000000000000000000000000000000000000000000800800000000000000000000000000000200000000000000000400000000000000000000010000000000000000000000000000000000000002110000000000000000000000000000cc0000000000000000000000000000001b0000000000000000000000000000000000000000000000841400000000000000000000000000000300000000000000feffffffffffffff000000000000000000000000000000000000000000000000020000000000000000000000000000000600000000000000ff01000000000000040000000000000000000000000000000000000000000000000400000000000000000000000000007be70000000000000900000000000000ff7f0000000000000000000000000000000000000000000004180000000000000000000000000000ffffffff0000000081000000000000000600000000000000000000000000000000000000000000000400000000000000000000000000000002000000000000000500000000000000ff7fffffffffffff0000000000000000000000000000000004040000000000000000000000000000"]) r6 = creat(&(0x7f00000000c0)='./file0\x00', 0x0) openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000100)='/group.stat\x00', 0x2761, 0x0) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000080), 0xffffffffffffffff) getpid() fallocate(r0, 0x0, 0x0, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x2f, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) memfd_create(&(0x7f0000000080)='!proccgroup\x00', 0x0) ioctl$sock_inet_SIOCSIFPFLAGS(0xffffffffffffffff, 0x8934, &(0x7f0000000400)={'veth0_to_bridge\x00', 0x100}) accept(r6, &(0x7f0000000580)=@alg, &(0x7f0000000600)=0x80) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x2400, 0x8000) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000008c0)={0x2c, 0x0, &(0x7f0000000780)=[@acquire_done={0x40106309, r5, 0x2}, @clear_death={0x400c630f, 0x1, 0x3}, @release={0x40046306, 0x2}], 0xc1, 0x0, &(0x7f00000007c0)="859547f83b9b058a973a491d7e6378544744f2b56b02270a2f78214a936e9afb25cd94695643af6563f86771aa9621b9f30f2ca538b018247a633c28ee01e03b4639679311117971e60dc1538f34e961ae301463172c41754be988f6beb0ce4d83c69f86c236d29520e6cdaf5dbb60404c66d63315ff287deac8632781d0197ef1f81314da0a1ed90b681842cf85a41b496ce0a7a6f5aa4b9b23483eea8861be89b3398c6aec3349174f9cdc9de34df361ac9bf7afd8566849487c3c0a1e3aaacd"}) 04:02:23 executing program 3: mkdir(&(0x7f0000fd5ff8)='./file0\x00', 0x0) r0 = open(&(0x7f0000021000)='./file0\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$BLKROTATIONAL(r0, 0x127e, &(0x7f00000000c0)) dup2(r0, r2) recvmmsg(r1, &(0x7f0000000b80)=[{{&(0x7f0000000200)=@l2, 0x80, &(0x7f00000005c0), 0x0, &(0x7f0000000600)=""/84, 0x54}}, {{&(0x7f0000000680)=@l2, 0x80, &(0x7f0000000a40), 0x0, &(0x7f0000000ac0)=""/147, 0x93}}], 0x4000000000002ce, 0x62, 0x0) lgetxattr(&(0x7f0000000100)='./file0\x00', &(0x7f0000000300)=ANY=[@ANYBLOB="747275737457d82d642e2d6d2e0000a2b9c7d7cbc3c70f799da30ffe18095ccd13be158cff98db69f7e00c4c538cda0093f5a9c284d2737cec8566b60a4e07d88ee07378d5d00120d0f530d85e026dfbd5825d2247d34f60de7f5f95000000000000000000000000000000"], &(0x7f0000000180)=""/75, 0x4b) setsockopt$IP_VS_SO_SET_ADDDEST(0xffffffffffffffff, 0x0, 0x487, 0x0, 0x0) 04:02:23 executing program 1: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) recvmsg(0xffffffffffffffff, &(0x7f00000036c0)={&(0x7f0000000180)=@can, 0xfd28, &(0x7f00000035c0), 0x0, &(0x7f0000003680)=""/41, 0x29}, 0x0) bind$alg(r0, &(0x7f0000001300)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb(blowfish)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000ff8000)="0a0775b0", 0x4) r1 = accept$alg(r0, 0x0, 0x0) sendmmsg$alg(r1, &(0x7f0000003e80)=[{0x0, 0x0, &(0x7f0000002a80), 0x167, &(0x7f0000000100)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x0) recvmsg(r1, &(0x7f0000000000)={&(0x7f0000f7ffa8)=@alg, 0x80, &(0x7f0000000140)=[{&(0x7f0000000200)=""/4096, 0x1000}], 0x1, 0x0, 0x0, 0x1f00}, 0x0) 04:02:23 executing program 2: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000440)=@updpolicy={0xb8, 0x19, 0x523, 0x0, 0x0, {{@in=@multicast2, @in6=@empty={[0x0, 0x0, 0x0, 0x0, 0x80ffffff]}, 0x0, 0x0, 0x0, 0x0, 0xa}}}, 0xb8}}, 0x0) 04:02:23 executing program 4: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) recvmsg(0xffffffffffffffff, &(0x7f00000036c0)={&(0x7f0000000180)=@can, 0xfd28, &(0x7f00000035c0), 0x0, &(0x7f0000003680)=""/41, 0x29}, 0x0) bind$alg(r0, &(0x7f0000001300)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb(blowfish)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000ff8000)="0a0775b0", 0x4) r1 = accept$alg(r0, 0x0, 0x0) sendmmsg$alg(r1, &(0x7f0000003e80)=[{0x0, 0x0, &(0x7f0000002a80), 0x167, &(0x7f0000000100)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x0) recvmsg(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)=[{&(0x7f0000000200)=""/4096, 0x1000}], 0x1, &(0x7f0000fb3fa9)=""/87, 0x57}, 0x0) 04:02:24 executing program 2: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000440)=@updpolicy={0xb8, 0x19, 0x523, 0x0, 0x0, {{@in=@multicast2, @in6=@empty={[0x0, 0x0, 0x0, 0x0, 0x9effffff]}, 0x0, 0x0, 0x0, 0x0, 0xa}}}, 0xb8}}, 0x0) 04:02:24 executing program 1: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) recvmsg(0xffffffffffffffff, &(0x7f00000036c0)={&(0x7f0000000180)=@can, 0xfd28, &(0x7f00000035c0), 0x0, &(0x7f0000003680)=""/41, 0x29}, 0x0) bind$alg(r0, &(0x7f0000001300)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb(blowfish)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000ff8000)="0a0775b0", 0x4) r1 = accept$alg(r0, 0x0, 0x0) sendmmsg$alg(r1, &(0x7f0000003e80)=[{0x0, 0x0, &(0x7f0000002a80), 0x167, &(0x7f0000000100)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x0) recvmsg(r1, &(0x7f0000000000)={&(0x7f0000f7ffa8)=@alg, 0x80, &(0x7f0000000140)=[{&(0x7f0000000200)=""/4096, 0x1000}], 0x1, 0x0, 0x0, 0x100000}, 0x0) [ 658.484694] net_ratelimit: 20 callbacks suppressed [ 658.484757] protocol 88fb is buggy, dev hsr_slave_0 [ 658.494964] protocol 88fb is buggy, dev hsr_slave_1 [ 658.564355] protocol 88fb is buggy, dev hsr_slave_0 [ 658.569491] protocol 88fb is buggy, dev hsr_slave_1 [ 658.574681] protocol 88fb is buggy, dev hsr_slave_0 [ 658.579756] protocol 88fb is buggy, dev hsr_slave_1 04:02:24 executing program 5: r0 = socket$inet6(0xa, 0x2, 0x0) r1 = syz_open_dev$mice(&(0x7f00000002c0)='/dev/input/mice\x00', 0x0, 0x0) ioctl$PPPOEIOCDFWD(r1, 0xb101, 0x0) syz_genetlink_get_family_id$nbd(&(0x7f0000000480)='nbd\x00') getsockopt$inet6_IPV6_XFRM_POLICY(r0, 0x29, 0x23, &(0x7f0000000340)={{{@in=@local, @in=@loopback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@local}, 0x0, @in=@remote}}, &(0x7f0000000140)=0xe8) connect$can_bcm(0xffffffffffffffff, &(0x7f00000001c0), 0x10) bind$inet6(r0, &(0x7f0000000040)={0xa, 0x4e24}, 0x1c) lsetxattr$security_ima(&(0x7f0000000280)='./file0\x00', &(0x7f0000000440)='security.ima\x00', 0x0, 0x0, 0x1) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clock_gettime(0x0, &(0x7f0000000100)={0x0, 0x0}) r4 = openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) bind(r4, &(0x7f0000000580)=@can={0x1d, r2}, 0x80) clock_gettime(0x3, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff}) ppoll(&(0x7f0000000000)=[{r0, 0x41a}], 0x1, &(0x7f0000000200)={0x0, r3+30000000}, &(0x7f0000000240)={0x5902000000000000}, 0x8) connect$inet6(r0, &(0x7f0000000080)={0xa, 0x4e24, 0x0, @ipv4={[], [], @loopback}}, 0x1c) readv(0xffffffffffffffff, 0x0, 0x0) sendmmsg(r0, &(0x7f00000092c0), 0x4ff, 0x0) connect$pptp(r5, &(0x7f00000004c0)={0x18, 0x2, {0x0, @multicast1}}, 0x1e) 04:02:24 executing program 0: r0 = perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) setxattr$security_smack_entry(&(0x7f0000000380)='./file0\x00', &(0x7f0000000480)='security.SMACK64IPIN\x00', &(0x7f0000000540)='^vboxnet1^\x00', 0xb, 0x1) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r1, &(0x7f0000000040), 0x0}, 0x20) unlink(&(0x7f0000000900)='./file0/file0\x00') r2 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r3 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r3, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, &(0x7f00000006c0)={0x0}) ioctl$BINDER_GET_NODE_DEBUG_INFO(r2, 0xc018620b, &(0x7f0000000640)={r4}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000000c0), 0x48, 0x0, &(0x7f0000000700)="2ba063fb309ec7fdbfb08e6e91baee7d7d4599fe14129a4d426834556ae420e087d59c0c7be7fcad1abb7e1f8f446f373f611ca1ee9c2231708e18a47bc68a2a79a0b48931f6ff6d"}) ioctl$BINDER_SET_CONTEXT_MGR(r3, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x1) prctl$PR_SET_NAME(0xf, &(0x7f00000004c0)='/group.stat\x00') ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, &(0x7f0000000780)}) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f0000000680)}) ioctl$FS_IOC_FIEMAP(r3, 0xc020660b, &(0x7f0000000b80)=ANY=[@ANYBLOB="0000010000000000200000000000000005000000010000000a00000000000000ff030000000000001a0a000000000000050000000000000000000000000000000000000000000000080000000000000000000000000000000800000000000000ffff0000000000000100008000000000000000000000000000000000000000000000000000000000000000000000000008000000000000003f0000000000000008000000000000000000000000000000000000000000800800000000000000000000000000000200000000000000000400000000000000000000010000000000000000000000000000000000000002110000000000000000000000000000cc0000000000000000000000000000001b0000000000000000000000000000000000000000000000841400000000000000000000000000000300000000000000feffffffffffffff000000000000000000000000000000000000000000000000020000000000000000000000000000000600000000000000ff01000000000000040000000000000000000000000000000000000000000000000400000000000000000000000000007be70000000000000900000000000000ff7f0000000000000000000000000000000000000000000004180000000000000000000000000000ffffffff0000000081000000000000000600000000000000000000000000000000000000000000000400000000000000000000000000000002000000000000000500000000000000ff7fffffffffffff0000000000000000000000000000000004040000000000000000000000000000"]) r6 = creat(&(0x7f00000000c0)='./file0\x00', 0x0) openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000100)='/group.stat\x00', 0x2761, 0x0) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000080), 0xffffffffffffffff) getpid() fallocate(r0, 0x0, 0x0, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x2f, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) memfd_create(&(0x7f0000000080)='!proccgroup\x00', 0x0) ioctl$sock_inet_SIOCSIFPFLAGS(0xffffffffffffffff, 0x8934, &(0x7f0000000400)={'veth0_to_bridge\x00', 0x100}) accept(r6, &(0x7f0000000580)=@alg, &(0x7f0000000600)=0x80) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x2400, 0x8000) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000008c0)={0x2c, 0x0, &(0x7f0000000780)=[@acquire_done={0x40106309, r5, 0x2}, @clear_death={0x400c630f, 0x1, 0x3}, @release={0x40046306, 0x2}], 0xc1, 0x0, &(0x7f00000007c0)="859547f83b9b058a973a491d7e6378544744f2b56b02270a2f78214a936e9afb25cd94695643af6563f86771aa9621b9f30f2ca538b018247a633c28ee01e03b4639679311117971e60dc1538f34e961ae301463172c41754be988f6beb0ce4d83c69f86c236d29520e6cdaf5dbb60404c66d63315ff287deac8632781d0197ef1f81314da0a1ed90b681842cf85a41b496ce0a7a6f5aa4b9b23483eea8861be89b3398c6aec3349174f9cdc9de34df361ac9bf7afd8566849487c3c0a1e3aaacd"}) 04:02:24 executing program 2: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000440)=@updpolicy={0xb8, 0x19, 0x523, 0x0, 0x0, {{@in=@multicast2, @in6=@empty={[0x0, 0x0, 0x0, 0x0, 0xf0ffffff]}, 0x0, 0x0, 0x0, 0x0, 0xa}}}, 0xb8}}, 0x0) 04:02:24 executing program 4: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) recvmsg(0xffffffffffffffff, &(0x7f00000036c0)={&(0x7f0000000180)=@can, 0xfd28, &(0x7f00000035c0), 0x0, &(0x7f0000003680)=""/41, 0x29}, 0x0) bind$alg(r0, &(0x7f0000001300)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb(blowfish)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000ff8000)="0a0775b0", 0x4) r1 = accept$alg(r0, 0x0, 0x0) sendmmsg$alg(r1, &(0x7f0000003e80)=[{0x0, 0x0, &(0x7f0000002a80), 0x167, &(0x7f0000000100)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x0) recvmsg(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)=[{&(0x7f0000000200)=""/4096, 0x1000}], 0x1, &(0x7f0000fb3fa9)=""/87, 0x57}, 0x0) 04:02:24 executing program 1: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) recvmsg(0xffffffffffffffff, &(0x7f00000036c0)={&(0x7f0000000180)=@can, 0xfd28, &(0x7f00000035c0), 0x0, &(0x7f0000003680)=""/41, 0x29}, 0x0) bind$alg(r0, &(0x7f0000001300)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb(blowfish)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000ff8000)="0a0775b0", 0x4) r1 = accept$alg(r0, 0x0, 0x0) sendmmsg$alg(r1, &(0x7f0000003e80)=[{0x0, 0x0, &(0x7f0000002a80), 0x167, &(0x7f0000000100)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x0) recvmsg(r1, &(0x7f0000000000)={&(0x7f0000f7ffa8)=@alg, 0x80, &(0x7f0000000140)=[{&(0x7f0000000200)=""/4096, 0x1000}], 0x1, 0x0, 0x0, 0x7000000}, 0x0) 04:02:24 executing program 3: r0 = syz_open_dev$adsp(&(0x7f00000000c0)='/dev/adsp#\x00', 0x401, 0x84200) connect$rose(r0, &(0x7f0000000100)=@short={0xb, @dev={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @bcast, 0x1, @default}, 0x1c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mlock2(&(0x7f0000dfe000/0x200000)=nil, 0x200000, 0x0) madvise(&(0x7f000079c000/0x800000)=nil, 0x800000, 0xc) r1 = syz_open_dev$radio(&(0x7f0000000000)='/dev/radio#\x00', 0x0, 0x2) ioctl$VIDIOC_LOG_STATUS(r1, 0x5646, 0x0) madvise(&(0x7f00002f8000/0xc00000)=nil, 0xc00000, 0xd) seccomp(0x1, 0x1, &(0x7f0000000080)={0x2, &(0x7f0000000040)=[{0xc84c, 0x1, 0x1}, {0x80000000, 0x3, 0x4, 0xffffffffffffffff}]}) 04:02:24 executing program 2: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000440)=@updpolicy={0xb8, 0x19, 0x523, 0x0, 0x0, {{@in=@multicast2, @in6=@empty={[0x0, 0x0, 0x0, 0x0, 0xfcffffff]}, 0x0, 0x0, 0x0, 0x0, 0xa}}}, 0xb8}}, 0x0) 04:02:24 executing program 4: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) recvmsg(0xffffffffffffffff, &(0x7f00000036c0)={&(0x7f0000000180)=@can, 0xfd28, &(0x7f00000035c0), 0x0, &(0x7f0000003680)=""/41, 0x29}, 0x0) bind$alg(r0, &(0x7f0000001300)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb(blowfish)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000ff8000)="0a0775b0", 0x4) r1 = accept$alg(r0, 0x0, 0x0) sendmmsg$alg(r1, &(0x7f0000003e80)=[{0x0, 0x0, &(0x7f0000002a80), 0x167, &(0x7f0000000100)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x0) recvmsg(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)=[{&(0x7f0000000200)=""/4096, 0x1000}], 0x1, &(0x7f0000fb3fa9)=""/87, 0x57}, 0x0) 04:02:24 executing program 1: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) recvmsg(0xffffffffffffffff, &(0x7f00000036c0)={&(0x7f0000000180)=@can, 0xfd28, &(0x7f00000035c0), 0x0, &(0x7f0000003680)=""/41, 0x29}, 0x0) bind$alg(r0, &(0x7f0000001300)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb(blowfish)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000ff8000)="0a0775b0", 0x4) r1 = accept$alg(r0, 0x0, 0x0) sendmmsg$alg(r1, &(0x7f0000003e80)=[{0x0, 0x0, &(0x7f0000002a80), 0x167, &(0x7f0000000100)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x0) recvmsg(r1, &(0x7f0000000000)={&(0x7f0000f7ffa8)=@alg, 0x80, &(0x7f0000000140)=[{&(0x7f0000000200)=""/4096, 0x1000}], 0x1, 0x0, 0x0, 0x8000000}, 0x0) 04:02:25 executing program 2: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000440)=@updpolicy={0xb8, 0x19, 0x523, 0x0, 0x0, {{@in=@multicast2, @in6=@empty={[0x0, 0x0, 0x0, 0x0, 0xfffff000]}, 0x0, 0x0, 0x0, 0x0, 0xa}}}, 0xb8}}, 0x0) 04:02:25 executing program 4: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) recvmsg(0xffffffffffffffff, &(0x7f00000036c0)={&(0x7f0000000180)=@can, 0xfd28, &(0x7f00000035c0), 0x0, &(0x7f0000003680)=""/41, 0x29}, 0x0) bind$alg(r0, &(0x7f0000001300)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb(blowfish)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000ff8000)="0a0775b0", 0x4) r1 = accept$alg(r0, 0x0, 0x0) sendmmsg$alg(r1, &(0x7f0000003e80)=[{0x0, 0x0, &(0x7f0000002a80), 0x167, &(0x7f0000000100)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x0) recvmsg(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)=[{&(0x7f0000000200)=""/4096, 0xe00}], 0x1, &(0x7f0000fb3fa9)=""/87, 0x57}, 0x0) 04:02:25 executing program 1: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) recvmsg(0xffffffffffffffff, &(0x7f00000036c0)={&(0x7f0000000180)=@can, 0xfd28, &(0x7f00000035c0), 0x0, &(0x7f0000003680)=""/41, 0x29}, 0x0) bind$alg(r0, &(0x7f0000001300)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb(blowfish)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000ff8000)="0a0775b0", 0x4) r1 = accept$alg(r0, 0x0, 0x0) sendmmsg$alg(r1, &(0x7f0000003e80)=[{0x0, 0x0, &(0x7f0000002a80), 0x167, &(0x7f0000000100)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x0) recvmsg(r1, &(0x7f0000000000)={&(0x7f0000f7ffa8)=@alg, 0x80, &(0x7f0000000140)=[{&(0x7f0000000200)=""/4096, 0x1000}], 0x1, 0x0, 0x0, 0x10000000}, 0x0) [ 659.525775] protocol 88fb is buggy, dev hsr_slave_0 [ 659.531684] protocol 88fb is buggy, dev hsr_slave_1 [ 659.537089] protocol 88fb is buggy, dev hsr_slave_0 [ 659.542885] protocol 88fb is buggy, dev hsr_slave_1 [ 659.560217] vivid-001: ================= START STATUS ================= [ 659.599044] vivid-001: Radio HW Seek Mode: Bounded [ 659.635208] vivid-001: Radio Programmable HW Seek: false [ 659.642440] vivid-001: RDS Rx I/O Mode: Block I/O [ 659.675248] vivid-001: Generate RBDS Instead of RDS: false [ 659.685987] vivid-001: RDS Reception: true [ 659.690240] vivid-001: RDS Program Type: 0 inactive [ 659.705314] vivid-001: RDS PS Name: inactive [ 659.709845] vivid-001: RDS Radio Text: inactive [ 659.715129] vivid-001: RDS Traffic Announcement: false inactive [ 659.721205] vivid-001: RDS Traffic Program: false inactive [ 659.727456] vivid-001: RDS Music: false inactive [ 659.732232] vivid-001: ================== END STATUS ================== [ 659.791798] vivid-001: ================= START STATUS ================= [ 659.805709] vivid-001: Radio HW Seek Mode: Bounded [ 659.812977] vivid-001: Radio Programmable HW Seek: false [ 659.823173] vivid-001: RDS Rx I/O Mode: Block I/O [ 659.830508] vivid-001: Generate RBDS Instead of RDS: false [ 659.841271] vivid-001: RDS Reception: true [ 659.847196] vivid-001: RDS Program Type: 0 inactive [ 659.852379] vivid-001: RDS PS Name: inactive [ 659.857045] vivid-001: RDS Radio Text: inactive [ 659.861826] vivid-001: RDS Traffic Announcement: false inactive [ 659.868007] vivid-001: RDS Traffic Program: false inactive [ 659.873634] vivid-001: RDS Music: false inactive [ 659.878501] vivid-001: ================== END STATUS ================== 04:02:25 executing program 5: r0 = socket$inet6(0xa, 0x2, 0x0) r1 = syz_open_dev$mice(&(0x7f00000002c0)='/dev/input/mice\x00', 0x0, 0x0) ioctl$PPPOEIOCDFWD(r1, 0xb101, 0x0) syz_genetlink_get_family_id$nbd(&(0x7f0000000480)='nbd\x00') getsockopt$inet6_IPV6_XFRM_POLICY(r0, 0x29, 0x23, &(0x7f0000000340)={{{@in=@local, @in=@loopback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@local}, 0x0, @in=@remote}}, &(0x7f0000000140)=0xe8) connect$can_bcm(0xffffffffffffffff, &(0x7f00000001c0), 0x10) bind$inet6(r0, &(0x7f0000000040)={0xa, 0x4e24}, 0x1c) lsetxattr$security_ima(&(0x7f0000000280)='./file0\x00', &(0x7f0000000440)='security.ima\x00', 0x0, 0x0, 0x1) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clock_gettime(0x0, &(0x7f0000000100)={0x0, 0x0}) r4 = openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) bind(r4, &(0x7f0000000580)=@can={0x1d, r2}, 0x80) clock_gettime(0x3, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff}) ppoll(&(0x7f0000000000)=[{r0, 0x41a}], 0x1, &(0x7f0000000200)={0x0, r3+30000000}, &(0x7f0000000240)={0x6400000000000000}, 0x8) connect$inet6(r0, &(0x7f0000000080)={0xa, 0x4e24, 0x0, @ipv4={[], [], @loopback}}, 0x1c) readv(0xffffffffffffffff, 0x0, 0x0) sendmmsg(r0, &(0x7f00000092c0), 0x4ff, 0x0) connect$pptp(r5, &(0x7f00000004c0)={0x18, 0x2, {0x0, @multicast1}}, 0x1e) 04:02:25 executing program 0: r0 = perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) setxattr$security_smack_entry(&(0x7f0000000380)='./file0\x00', &(0x7f0000000480)='security.SMACK64IPIN\x00', &(0x7f0000000540)='^vboxnet1^\x00', 0xb, 0x1) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r1, &(0x7f0000000040), 0x0}, 0x20) unlink(&(0x7f0000000900)='./file0/file0\x00') r2 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r3 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r3, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, &(0x7f00000006c0)={0x0}) ioctl$BINDER_GET_NODE_DEBUG_INFO(r2, 0xc018620b, &(0x7f0000000640)={r4}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000000c0), 0x48, 0x0, &(0x7f0000000700)="2ba063fb309ec7fdbfb08e6e91baee7d7d4599fe14129a4d426834556ae420e087d59c0c7be7fcad1abb7e1f8f446f373f611ca1ee9c2231708e18a47bc68a2a79a0b48931f6ff6d"}) ioctl$BINDER_SET_CONTEXT_MGR(r3, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x1) prctl$PR_SET_NAME(0xf, &(0x7f00000004c0)='/group.stat\x00') ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, &(0x7f0000000780)}) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f0000000680)}) ioctl$FS_IOC_FIEMAP(r3, 0xc020660b, &(0x7f0000000b80)=ANY=[@ANYBLOB="0000010000000000200000000000000005000000010000000a00000000000000ff030000000000001a0a000000000000050000000000000000000000000000000000000000000000080000000000000000000000000000000800000000000000ffff0000000000000100008000000000000000000000000000000000000000000000000000000000000000000000000008000000000000003f0000000000000008000000000000000000000000000000000000000000800800000000000000000000000000000200000000000000000400000000000000000000010000000000000000000000000000000000000002110000000000000000000000000000cc0000000000000000000000000000001b0000000000000000000000000000000000000000000000841400000000000000000000000000000300000000000000feffffffffffffff000000000000000000000000000000000000000000000000020000000000000000000000000000000600000000000000ff01000000000000040000000000000000000000000000000000000000000000000400000000000000000000000000007be70000000000000900000000000000ff7f0000000000000000000000000000000000000000000004180000000000000000000000000000ffffffff0000000081000000000000000600000000000000000000000000000000000000000000000400000000000000000000000000000002000000000000000500000000000000ff7fffffffffffff0000000000000000000000000000000004040000000000000000000000000000"]) r6 = creat(&(0x7f00000000c0)='./file0\x00', 0x0) openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000100)='/group.stat\x00', 0x2761, 0x0) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000080), 0xffffffffffffffff) getpid() fallocate(r0, 0x0, 0x0, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x2f, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) memfd_create(&(0x7f0000000080)='!proccgroup\x00', 0x0) ioctl$sock_inet_SIOCSIFPFLAGS(0xffffffffffffffff, 0x8934, &(0x7f0000000400)={'veth0_to_bridge\x00', 0x100}) accept(r6, &(0x7f0000000580)=@alg, &(0x7f0000000600)=0x80) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x2400, 0x8000) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000008c0)={0x2c, 0x0, &(0x7f0000000780)=[@acquire_done={0x40106309, r5, 0x2}, @clear_death={0x400c630f, 0x1, 0x3}, @release={0x40046306, 0x2}], 0xc1, 0x0, &(0x7f00000007c0)="859547f83b9b058a973a491d7e6378544744f2b56b02270a2f78214a936e9afb25cd94695643af6563f86771aa9621b9f30f2ca538b018247a633c28ee01e03b4639679311117971e60dc1538f34e961ae301463172c41754be988f6beb0ce4d83c69f86c236d29520e6cdaf5dbb60404c66d63315ff287deac8632781d0197ef1f81314da0a1ed90b681842cf85a41b496ce0a7a6f5aa4b9b23483eea8861be89b3398c6aec3349174f9cdc9de34df361ac9bf7afd8566849487c3c0a1e3aaacd"}) 04:02:25 executing program 1: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) recvmsg(0xffffffffffffffff, &(0x7f00000036c0)={&(0x7f0000000180)=@can, 0xfd28, &(0x7f00000035c0), 0x0, &(0x7f0000003680)=""/41, 0x29}, 0x0) bind$alg(r0, &(0x7f0000001300)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb(blowfish)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000ff8000)="0a0775b0", 0x4) r1 = accept$alg(r0, 0x0, 0x0) sendmmsg$alg(r1, &(0x7f0000003e80)=[{0x0, 0x0, &(0x7f0000002a80), 0x167, &(0x7f0000000100)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x0) recvmsg(r1, &(0x7f0000000000)={&(0x7f0000f7ffa8)=@alg, 0x80, &(0x7f0000000140)=[{&(0x7f0000000200)=""/4096, 0x1000}], 0x1, 0x0, 0x0, 0x1f000000}, 0x0) 04:02:25 executing program 2: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000440)=@updpolicy={0xb8, 0x19, 0x523, 0x0, 0x0, {{@in=@multicast2, @in6=@empty={[0x0, 0x0, 0x0, 0x0, 0xffffff7f]}, 0x0, 0x0, 0x0, 0x0, 0xa}}}, 0xb8}}, 0x0) 04:02:25 executing program 4: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) recvmsg(0xffffffffffffffff, &(0x7f00000036c0)={&(0x7f0000000180)=@can, 0xfd28, &(0x7f00000035c0), 0x0, &(0x7f0000003680)=""/41, 0x29}, 0x0) bind$alg(r0, &(0x7f0000001300)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb(blowfish)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000ff8000)="0a0775b0", 0x4) r1 = accept$alg(r0, 0x0, 0x0) sendmmsg$alg(r1, &(0x7f0000003e80)=[{0x0, 0x0, &(0x7f0000002a80), 0x167, &(0x7f0000000100)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x0) recvmsg(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)=[{&(0x7f0000000200)=""/4096, 0x1007}], 0x1, &(0x7f0000fb3fa9)=""/87, 0x57}, 0x0) 04:02:25 executing program 3: r0 = syz_open_dev$adsp(&(0x7f00000000c0)='/dev/adsp#\x00', 0x401, 0x84200) connect$rose(r0, &(0x7f0000000100)=@short={0xb, @dev={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @bcast, 0x1, @default}, 0x1c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mlock2(&(0x7f0000dfe000/0x200000)=nil, 0x200000, 0x0) madvise(&(0x7f000079c000/0x800000)=nil, 0x800000, 0xc) r1 = syz_open_dev$radio(&(0x7f0000000000)='/dev/radio#\x00', 0x0, 0x2) ioctl$VIDIOC_LOG_STATUS(r1, 0x5646, 0x0) madvise(&(0x7f00002f8000/0xc00000)=nil, 0xc00000, 0xd) seccomp(0x1, 0x1, &(0x7f0000000080)={0x2, &(0x7f0000000040)=[{0xc84c, 0x1, 0x1}, {0x80000000, 0x3, 0x4, 0xffffffffffffffff}]}) 04:02:25 executing program 2: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000440)=@updpolicy={0xb8, 0x19, 0x523, 0x0, 0x0, {{@in=@multicast2, @in6=@empty={[0x0, 0x0, 0x0, 0x0, 0xffffff80]}, 0x0, 0x0, 0x0, 0x0, 0xa}}}, 0xb8}}, 0x0) [ 660.189001] vivid-001: ================= START STATUS ================= [ 660.231394] vivid-001: Radio HW Seek Mode: Bounded 04:02:26 executing program 1: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) recvmsg(0xffffffffffffffff, &(0x7f00000036c0)={&(0x7f0000000180)=@can, 0xfd28, &(0x7f00000035c0), 0x0, &(0x7f0000003680)=""/41, 0x29}, 0x0) bind$alg(r0, &(0x7f0000001300)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb(blowfish)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000ff8000)="0a0775b0", 0x4) r1 = accept$alg(r0, 0x0, 0x0) sendmmsg$alg(r1, &(0x7f0000003e80)=[{0x0, 0x0, &(0x7f0000002a80), 0x167, &(0x7f0000000100)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x0) recvmsg(r1, &(0x7f0000000000)={&(0x7f0000f7ffa8)=@alg, 0x80, &(0x7f0000000140)=[{&(0x7f0000000200)=""/4096, 0x1000}], 0x1, 0x0, 0x0, 0x8dffffff}, 0x0) 04:02:26 executing program 4: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) recvmsg(0xffffffffffffffff, &(0x7f00000036c0)={&(0x7f0000000180)=@can, 0xfd28, &(0x7f00000035c0), 0x0, &(0x7f0000003680)=""/41, 0x29}, 0x0) bind$alg(r0, &(0x7f0000001300)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb(blowfish)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000ff8000)="0a0775b0", 0x4) r1 = accept$alg(r0, 0x0, 0x0) sendmmsg$alg(r1, &(0x7f0000003e80)=[{0x0, 0x0, &(0x7f0000002a80), 0x167, &(0x7f0000000100)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x0) recvmsg(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)=[{&(0x7f0000000200)=""/4096, 0x1008}], 0x1, &(0x7f0000fb3fa9)=""/87, 0x57}, 0x0) [ 660.267557] vivid-001: Radio Programmable HW Seek: false [ 660.348484] vivid-001: RDS Rx I/O Mode: Block I/O [ 660.353497] vivid-001: Generate RBDS Instead of RDS: false [ 660.394494] vivid-001: RDS Reception: true [ 660.413830] vivid-001: RDS Program Type: 0 inactive [ 660.431895] vivid-001: RDS PS Name: inactive [ 660.444752] vivid-001: RDS Radio Text: inactive 04:02:26 executing program 2: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000440)=@updpolicy={0xb8, 0x19, 0x523, 0x0, 0x0, {{@in=@multicast2, @in6=@empty={[0x0, 0x0, 0x0, 0x0, 0xffffff9e]}, 0x0, 0x0, 0x0, 0x0, 0xa}}}, 0xb8}}, 0x0) 04:02:26 executing program 0: r0 = perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) setxattr$security_smack_entry(&(0x7f0000000380)='./file0\x00', &(0x7f0000000480)='security.SMACK64IPIN\x00', &(0x7f0000000540)='^vboxnet1^\x00', 0xb, 0x1) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r1, &(0x7f0000000040), 0x0}, 0x20) unlink(&(0x7f0000000900)='./file0/file0\x00') r2 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r3 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r3, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, &(0x7f00000006c0)={0x0}) ioctl$BINDER_GET_NODE_DEBUG_INFO(r2, 0xc018620b, &(0x7f0000000640)={r4}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000000c0), 0x48, 0x0, &(0x7f0000000700)="2ba063fb309ec7fdbfb08e6e91baee7d7d4599fe14129a4d426834556ae420e087d59c0c7be7fcad1abb7e1f8f446f373f611ca1ee9c2231708e18a47bc68a2a79a0b48931f6ff6d"}) ioctl$BINDER_SET_CONTEXT_MGR(r3, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x1) prctl$PR_SET_NAME(0xf, &(0x7f00000004c0)='/group.stat\x00') ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, &(0x7f0000000780)}) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f0000000680)}) ioctl$FS_IOC_FIEMAP(r3, 0xc020660b, &(0x7f0000000b80)=ANY=[@ANYBLOB="0000010000000000200000000000000005000000010000000a00000000000000ff030000000000001a0a000000000000050000000000000000000000000000000000000000000000080000000000000000000000000000000800000000000000ffff0000000000000100008000000000000000000000000000000000000000000000000000000000000000000000000008000000000000003f0000000000000008000000000000000000000000000000000000000000800800000000000000000000000000000200000000000000000400000000000000000000010000000000000000000000000000000000000002110000000000000000000000000000cc0000000000000000000000000000001b0000000000000000000000000000000000000000000000841400000000000000000000000000000300000000000000feffffffffffffff000000000000000000000000000000000000000000000000020000000000000000000000000000000600000000000000ff01000000000000040000000000000000000000000000000000000000000000000400000000000000000000000000007be70000000000000900000000000000ff7f0000000000000000000000000000000000000000000004180000000000000000000000000000ffffffff0000000081000000000000000600000000000000000000000000000000000000000000000400000000000000000000000000000002000000000000000500000000000000ff7fffffffffffff0000000000000000000000000000000004040000000000000000000000000000"]) r6 = creat(&(0x7f00000000c0)='./file0\x00', 0x0) openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000100)='/group.stat\x00', 0x2761, 0x0) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000080), 0xffffffffffffffff) getpid() fallocate(r0, 0x0, 0x0, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x2f, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) memfd_create(&(0x7f0000000080)='!proccgroup\x00', 0x0) ioctl$sock_inet_SIOCSIFPFLAGS(0xffffffffffffffff, 0x8934, &(0x7f0000000400)={'veth0_to_bridge\x00', 0x100}) accept(r6, &(0x7f0000000580)=@alg, &(0x7f0000000600)=0x80) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x2400, 0x8000) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000008c0)={0x2c, 0x0, &(0x7f0000000780)=[@acquire_done={0x40106309, r5, 0x2}, @clear_death={0x400c630f, 0x1, 0x3}, @release={0x40046306, 0x2}], 0xc1, 0x0, &(0x7f00000007c0)="859547f83b9b058a973a491d7e6378544744f2b56b02270a2f78214a936e9afb25cd94695643af6563f86771aa9621b9f30f2ca538b018247a633c28ee01e03b4639679311117971e60dc1538f34e961ae301463172c41754be988f6beb0ce4d83c69f86c236d29520e6cdaf5dbb60404c66d63315ff287deac8632781d0197ef1f81314da0a1ed90b681842cf85a41b496ce0a7a6f5aa4b9b23483eea8861be89b3398c6aec3349174f9cdc9de34df361ac9bf7afd8566849487c3c0a1e3aaacd"}) 04:02:26 executing program 1: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) recvmsg(0xffffffffffffffff, &(0x7f00000036c0)={&(0x7f0000000180)=@can, 0xfd28, &(0x7f00000035c0), 0x0, &(0x7f0000003680)=""/41, 0x29}, 0x0) bind$alg(r0, &(0x7f0000001300)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb(blowfish)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000ff8000)="0a0775b0", 0x4) r1 = accept$alg(r0, 0x0, 0x0) sendmmsg$alg(r1, &(0x7f0000003e80)=[{0x0, 0x0, &(0x7f0000002a80), 0x167, &(0x7f0000000100)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x0) recvmsg(r1, &(0x7f0000000000)={&(0x7f0000f7ffa8)=@alg, 0x80, &(0x7f0000000140)=[{&(0x7f0000000200)=""/4096, 0x1000}], 0x1, 0x0, 0x0, 0xf0ffffff}, 0x0) [ 660.494663] vivid-001: RDS Traffic Announcement: false inactive [ 660.557852] vivid-001: RDS Traffic Program: false inactive [ 660.598549] vivid-001: RDS Music: false inactive [ 660.642214] vivid-001: ================== END STATUS ================== [ 660.850519] binder: release 22323:22331 transaction 381 out, still active [ 660.913838] binder_send_failed_reply: 11 callbacks suppressed [ 660.913846] binder: send failed reply for transaction 354, target dead [ 660.935662] binder: send failed reply for transaction 357, target dead [ 660.943146] binder: send failed reply for transaction 360, target dead [ 660.950067] binder: send failed reply for transaction 363, target dead [ 660.957291] binder: send failed reply for transaction 366, target dead [ 660.963969] binder: send failed reply for transaction 369, target dead [ 660.971007] binder: send failed reply for transaction 372, target dead [ 660.977790] binder: send failed reply for transaction 375, target dead [ 660.984576] binder: send failed reply for transaction 378, target dead [ 660.991298] binder: send failed reply for transaction 381, target dead 04:02:26 executing program 5: r0 = socket$inet6(0xa, 0x2, 0x0) r1 = syz_open_dev$mice(&(0x7f00000002c0)='/dev/input/mice\x00', 0x0, 0x0) ioctl$PPPOEIOCDFWD(r1, 0xb101, 0x0) syz_genetlink_get_family_id$nbd(&(0x7f0000000480)='nbd\x00') getsockopt$inet6_IPV6_XFRM_POLICY(r0, 0x29, 0x23, &(0x7f0000000340)={{{@in=@local, @in=@loopback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@local}, 0x0, @in=@remote}}, &(0x7f0000000140)=0xe8) connect$can_bcm(0xffffffffffffffff, &(0x7f00000001c0), 0x10) bind$inet6(r0, &(0x7f0000000040)={0xa, 0x4e24}, 0x1c) lsetxattr$security_ima(&(0x7f0000000280)='./file0\x00', &(0x7f0000000440)='security.ima\x00', 0x0, 0x0, 0x1) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clock_gettime(0x0, &(0x7f0000000100)={0x0, 0x0}) r4 = openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) bind(r4, &(0x7f0000000580)=@can={0x1d, r2}, 0x80) clock_gettime(0x3, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff}) ppoll(&(0x7f0000000000)=[{r0, 0x41a}], 0x1, &(0x7f0000000200)={0x0, r3+30000000}, &(0x7f0000000240)={0xfcffffff00000000}, 0x8) connect$inet6(r0, &(0x7f0000000080)={0xa, 0x4e24, 0x0, @ipv4={[], [], @loopback}}, 0x1c) readv(0xffffffffffffffff, 0x0, 0x0) sendmmsg(r0, &(0x7f00000092c0), 0x4ff, 0x0) connect$pptp(r5, &(0x7f00000004c0)={0x18, 0x2, {0x0, @multicast1}}, 0x1e) 04:02:26 executing program 4: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) recvmsg(0xffffffffffffffff, &(0x7f00000036c0)={&(0x7f0000000180)=@can, 0xfd28, &(0x7f00000035c0), 0x0, &(0x7f0000003680)=""/41, 0x29}, 0x0) bind$alg(r0, &(0x7f0000001300)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb(blowfish)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000ff8000)="0a0775b0", 0x4) r1 = accept$alg(r0, 0x0, 0x0) sendmmsg$alg(r1, &(0x7f0000003e80)=[{0x0, 0x0, &(0x7f0000002a80), 0x167, &(0x7f0000000100)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x0) recvmsg(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)=[{&(0x7f0000000200)=""/4096, 0x1010}], 0x1, &(0x7f0000fb3fa9)=""/87, 0x57}, 0x0) 04:02:26 executing program 2: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000440)=@updpolicy={0xb8, 0x19, 0x523, 0x0, 0x0, {{@in=@multicast2, @in6=@empty={[0x0, 0x0, 0x0, 0x0, 0xfffffff0]}, 0x0, 0x0, 0x0, 0x0, 0xa}}}, 0xb8}}, 0x0) 04:02:26 executing program 1: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) recvmsg(0xffffffffffffffff, &(0x7f00000036c0)={&(0x7f0000000180)=@can, 0xfd28, &(0x7f00000035c0), 0x0, &(0x7f0000003680)=""/41, 0x29}, 0x0) bind$alg(r0, &(0x7f0000001300)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb(blowfish)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000ff8000)="0a0775b0", 0x4) r1 = accept$alg(r0, 0x0, 0x0) sendmmsg$alg(r1, &(0x7f0000003e80)=[{0x0, 0x0, &(0x7f0000002a80), 0x167, &(0x7f0000000100)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x0) recvmsg(r1, &(0x7f0000000000)={&(0x7f0000f7ffa8)=@alg, 0x80, &(0x7f0000000140)=[{&(0x7f0000000200)=""/4096, 0x1000}], 0x1, 0x0, 0x0, 0xffffff8d}, 0x0) 04:02:26 executing program 3: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) recvmsg(0xffffffffffffffff, &(0x7f00000036c0)={&(0x7f0000000180)=@can, 0xfd28, &(0x7f00000035c0), 0x0, &(0x7f0000003680)=""/41, 0x29}, 0x0) bind$alg(r0, &(0x7f0000001300)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb(blowfish)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000ff8000)="0a0775b0", 0x4) r1 = accept$alg(r0, 0x0, 0x0) sendmmsg$alg(r1, &(0x7f0000003e80)=[{0x0, 0x0, &(0x7f0000002a80), 0x167, &(0x7f0000000100)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x0) recvmsg(r1, &(0x7f0000000000)={&(0x7f0000f7ffa8)=@alg, 0x80, &(0x7f0000000140)=[{&(0x7f0000000200)=""/4096, 0x1000}], 0x1, 0x0, 0x0, 0x8dffffff}, 0x0) 04:02:26 executing program 0: r0 = perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) setxattr$security_smack_entry(&(0x7f0000000380)='./file0\x00', &(0x7f0000000480)='security.SMACK64IPIN\x00', &(0x7f0000000540)='^vboxnet1^\x00', 0xb, 0x1) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r1, &(0x7f0000000040), 0x0}, 0x20) unlink(&(0x7f0000000900)='./file0/file0\x00') r2 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r3 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r3, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, &(0x7f00000006c0)={0x0}) ioctl$BINDER_GET_NODE_DEBUG_INFO(r2, 0xc018620b, &(0x7f0000000640)={r4}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f00000000c0)=[@enter_looper], 0x0, 0x0, 0x0}) ioctl$BINDER_SET_CONTEXT_MGR(r3, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x1) prctl$PR_SET_NAME(0xf, &(0x7f00000004c0)='/group.stat\x00') ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, &(0x7f0000000780)}) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f0000000680)}) ioctl$FS_IOC_FIEMAP(r3, 0xc020660b, &(0x7f0000000b80)=ANY=[@ANYBLOB="0000010000000000200000000000000005000000010000000a00000000000000ff030000000000001a0a000000000000050000000000000000000000000000000000000000000000080000000000000000000000000000000800000000000000ffff0000000000000100008000000000000000000000000000000000000000000000000000000000000000000000000008000000000000003f0000000000000008000000000000000000000000000000000000000000800800000000000000000000000000000200000000000000000400000000000000000000010000000000000000000000000000000000000002110000000000000000000000000000cc0000000000000000000000000000001b0000000000000000000000000000000000000000000000841400000000000000000000000000000300000000000000feffffffffffffff000000000000000000000000000000000000000000000000020000000000000000000000000000000600000000000000ff01000000000000040000000000000000000000000000000000000000000000000400000000000000000000000000007be70000000000000900000000000000ff7f0000000000000000000000000000000000000000000004180000000000000000000000000000ffffffff0000000081000000000000000600000000000000000000000000000000000000000000000400000000000000000000000000000002000000000000000500000000000000ff7fffffffffffff0000000000000000000000000000000004040000000000000000000000000000"]) r6 = creat(&(0x7f00000000c0)='./file0\x00', 0x0) openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000100)='/group.stat\x00', 0x2761, 0x0) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000080), 0xffffffffffffffff) getpid() fallocate(r0, 0x0, 0x0, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x2f, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) memfd_create(&(0x7f0000000080)='!proccgroup\x00', 0x0) ioctl$sock_inet_SIOCSIFPFLAGS(0xffffffffffffffff, 0x8934, &(0x7f0000000400)={'veth0_to_bridge\x00', 0x100}) accept(r6, &(0x7f0000000580)=@alg, &(0x7f0000000600)=0x80) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x2400, 0x8000) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000008c0)={0x2c, 0x0, &(0x7f0000000780)=[@acquire_done={0x40106309, r5, 0x2}, @clear_death={0x400c630f, 0x1, 0x3}, @release={0x40046306, 0x2}], 0xc1, 0x0, &(0x7f00000007c0)="859547f83b9b058a973a491d7e6378544744f2b56b02270a2f78214a936e9afb25cd94695643af6563f86771aa9621b9f30f2ca538b018247a633c28ee01e03b4639679311117971e60dc1538f34e961ae301463172c41754be988f6beb0ce4d83c69f86c236d29520e6cdaf5dbb60404c66d63315ff287deac8632781d0197ef1f81314da0a1ed90b681842cf85a41b496ce0a7a6f5aa4b9b23483eea8861be89b3398c6aec3349174f9cdc9de34df361ac9bf7afd8566849487c3c0a1e3aaacd"}) 04:02:27 executing program 2: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000440)=@updpolicy={0xb8, 0x19, 0x523, 0x0, 0x0, {{@in=@multicast2, @in6=@empty={[0x0, 0x0, 0x0, 0x0, 0xfffffffc]}, 0x0, 0x0, 0x0, 0x0, 0xa}}}, 0xb8}}, 0x0) 04:02:27 executing program 1: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) recvmsg(0xffffffffffffffff, &(0x7f00000036c0)={&(0x7f0000000180)=@can, 0xfd28, &(0x7f00000035c0), 0x0, &(0x7f0000003680)=""/41, 0x29}, 0x0) bind$alg(r0, &(0x7f0000001300)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb(blowfish)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000ff8000)="0a0775b0", 0x4) r1 = accept$alg(r0, 0x0, 0x0) sendmmsg$alg(r1, &(0x7f0000003e80)=[{0x0, 0x0, &(0x7f0000002a80), 0x167, &(0x7f0000000100)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x0) recvmsg(r1, &(0x7f0000000000)={&(0x7f0000f7ffa8)=@alg, 0x80, &(0x7f0000000140)=[{&(0x7f0000000200)=""/4096, 0x1000}], 0x1, 0x0, 0x0, 0xfffffff0}, 0x0) 04:02:27 executing program 3: r0 = perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) setxattr$security_smack_entry(&(0x7f0000000380)='./file0\x00', &(0x7f0000000480)='security.SMACK64IPIN\x00', &(0x7f0000000540)='^vboxnet1^\x00', 0xb, 0x1) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r1, &(0x7f0000000040), 0x0}, 0x20) unlink(&(0x7f0000000900)='./file0/file0\x00') r2 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r3 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r3, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, &(0x7f00000006c0)={0x0}) ioctl$BINDER_GET_NODE_DEBUG_INFO(r2, 0xc018620b, &(0x7f0000000640)={r4}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000000c0), 0x48, 0x0, &(0x7f0000000700)="2ba063fb309ec7fdbfb08e6e91baee7d7d4599fe14129a4d426834556ae420e087d59c0c7be7fcad1abb7e1f8f446f373f611ca1ee9c2231708e18a47bc68a2a79a0b48931f6ff6d"}) ioctl$BINDER_SET_CONTEXT_MGR(r3, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x1) prctl$PR_SET_NAME(0xf, &(0x7f00000004c0)='/group.stat\x00') ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, &(0x7f0000000780)}) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f0000000680)}) ioctl$FS_IOC_FIEMAP(r3, 0xc020660b, &(0x7f0000000b80)=ANY=[@ANYBLOB="0000010000000000200000000000000005000000010000000a00000000000000ff030000000000001a0a000000000000050000000000000000000000000000000000000000000000080000000000000000000000000000000800000000000000ffff0000000000000100008000000000000000000000000000000000000000000000000000000000000000000000000008000000000000003f0000000000000008000000000000000000000000000000000000000000800800000000000000000000000000000200000000000000000400000000000000000000010000000000000000000000000000000000000002110000000000000000000000000000cc0000000000000000000000000000001b0000000000000000000000000000000000000000000000841400000000000000000000000000000300000000000000feffffffffffffff000000000000000000000000000000000000000000000000020000000000000000000000000000000600000000000000ff01000000000000040000000000000000000000000000000000000000000000000400000000000000000000000000007be70000000000000900000000000000ff7f0000000000000000000000000000000000000000000004180000000000000000000000000000ffffffff0000000081000000000000000600000000000000000000000000000000000000000000000400000000000000000000000000000002000000000000000500000000000000ff7fffffffffffff0000000000000000000000000000000004040000000000000000000000000000"]) r6 = creat(&(0x7f00000000c0)='./file0\x00', 0x0) openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000100)='/group.stat\x00', 0x2761, 0x0) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000080), 0xffffffffffffffff) getpid() fallocate(r0, 0x0, 0x0, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x2f, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) memfd_create(&(0x7f0000000080)='!proccgroup\x00', 0x0) ioctl$sock_inet_SIOCSIFPFLAGS(0xffffffffffffffff, 0x8934, &(0x7f0000000400)={'veth0_to_bridge\x00', 0x100}) accept(r6, &(0x7f0000000580)=@alg, &(0x7f0000000600)=0x80) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x2400, 0x8000) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000008c0)={0x2c, 0x0, &(0x7f0000000780)=[@acquire_done={0x40106309, r5, 0x2}, @clear_death={0x400c630f, 0x1, 0x3}, @release={0x40046306, 0x2}], 0xc1, 0x0, &(0x7f00000007c0)="859547f83b9b058a973a491d7e6378544744f2b56b02270a2f78214a936e9afb25cd94695643af6563f86771aa9621b9f30f2ca538b018247a633c28ee01e03b4639679311117971e60dc1538f34e961ae301463172c41754be988f6beb0ce4d83c69f86c236d29520e6cdaf5dbb60404c66d63315ff287deac8632781d0197ef1f81314da0a1ed90b681842cf85a41b496ce0a7a6f5aa4b9b23483eea8861be89b3398c6aec3349174f9cdc9de34df361ac9bf7afd8566849487c3c0a1e3aaacd"}) 04:02:27 executing program 4: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) recvmsg(0xffffffffffffffff, &(0x7f00000036c0)={&(0x7f0000000180)=@can, 0xfd28, &(0x7f00000035c0), 0x0, &(0x7f0000003680)=""/41, 0x29}, 0x0) bind$alg(r0, &(0x7f0000001300)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb(blowfish)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000ff8000)="0a0775b0", 0x4) r1 = accept$alg(r0, 0x0, 0x0) sendmmsg$alg(r1, &(0x7f0000003e80)=[{0x0, 0x0, &(0x7f0000002a80), 0x167, &(0x7f0000000100)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x0) recvmsg(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)=[{&(0x7f0000000200)=""/4096, 0xfed0}], 0x1, &(0x7f0000fb3fa9)=""/87, 0x57}, 0x0) 04:02:27 executing program 2: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000440)=@updpolicy={0xb8, 0x19, 0x523, 0x0, 0x0, {{@in=@multicast2, @in6=@empty={[0x0, 0x0, 0x0, 0x0, 0xf0ffffffffffff]}, 0x0, 0x0, 0x0, 0x0, 0xa}}}, 0xb8}}, 0x0) 04:02:27 executing program 4: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) recvmsg(0xffffffffffffffff, &(0x7f00000036c0)={&(0x7f0000000180)=@can, 0xfd28, &(0x7f00000035c0), 0x0, &(0x7f0000003680)=""/41, 0x29}, 0x0) bind$alg(r0, &(0x7f0000001300)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb(blowfish)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000ff8000)="0a0775b0", 0x4) r1 = accept$alg(r0, 0x0, 0x0) sendmmsg$alg(r1, &(0x7f0000003e80)=[{0x0, 0x0, &(0x7f0000002a80), 0x167, &(0x7f0000000100)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x0) recvmsg(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)=[{&(0x7f0000000200)=""/4096, 0x20001200}], 0x1, &(0x7f0000fb3fa9)=""/87, 0x57}, 0x0) [ 661.591051] binder: 23397:23411 BC_ACQUIRE_DONE u0000000000000000 node 420 cookie mismatch 0000000000000002 != 0000000000000000 [ 661.616119] binder: 23397:23411 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 [ 661.628865] IPVS: ftp: loaded support on port[0] = 21 [ 661.646468] device bridge_slave_1 left promiscuous mode [ 661.648159] binder: 23397:23411 Release 1 refcount change on invalid ref 2 ret -22 [ 661.652074] bridge0: port 2(bridge_slave_1) entered disabled state [ 661.730113] device bridge_slave_0 left promiscuous mode [ 661.737084] bridge0: port 1(bridge_slave_0) entered disabled state [ 661.927446] device hsr_slave_1 left promiscuous mode [ 662.003016] device hsr_slave_0 left promiscuous mode [ 662.053032] team0 (unregistering): Port device team_slave_1 removed [ 662.092959] team0 (unregistering): Port device team_slave_0 removed [ 662.119531] bond0 (unregistering): Releasing backup interface bond_slave_1 [ 662.200985] bond0 (unregistering): Releasing backup interface bond_slave_0 [ 662.212711] binder: release 23397:23403 transaction 421 out, still active 04:02:28 executing program 5: r0 = socket$inet6(0xa, 0x2, 0x0) r1 = syz_open_dev$mice(&(0x7f00000002c0)='/dev/input/mice\x00', 0x0, 0x0) ioctl$PPPOEIOCDFWD(r1, 0xb101, 0x0) syz_genetlink_get_family_id$nbd(&(0x7f0000000480)='nbd\x00') getsockopt$inet6_IPV6_XFRM_POLICY(r0, 0x29, 0x23, &(0x7f0000000340)={{{@in=@local, @in=@loopback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@local}, 0x0, @in=@remote}}, &(0x7f0000000140)=0xe8) connect$can_bcm(0xffffffffffffffff, &(0x7f00000001c0), 0x10) bind$inet6(r0, &(0x7f0000000040)={0xa, 0x4e24}, 0x1c) lsetxattr$security_ima(&(0x7f0000000280)='./file0\x00', &(0x7f0000000440)='security.ima\x00', 0x0, 0x0, 0x1) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clock_gettime(0x0, &(0x7f0000000100)={0x0, 0x0}) r4 = openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) bind(r4, &(0x7f0000000580)=@can={0x1d, r2}, 0x80) clock_gettime(0x3, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff}) ppoll(&(0x7f0000000000)=[{r0, 0x41a}], 0x1, &(0x7f0000000200)={0x0, r3+30000000}, &(0x7f0000000240)={0xffffffff00000000}, 0x8) connect$inet6(r0, &(0x7f0000000080)={0xa, 0x4e24, 0x0, @ipv4={[], [], @loopback}}, 0x1c) readv(0xffffffffffffffff, 0x0, 0x0) sendmmsg(r0, &(0x7f00000092c0), 0x4ff, 0x0) connect$pptp(r5, &(0x7f00000004c0)={0x18, 0x2, {0x0, @multicast1}}, 0x1e) 04:02:28 executing program 1: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) recvmsg(0xffffffffffffffff, &(0x7f00000036c0)={&(0x7f0000000180)=@can, 0xfd28, &(0x7f00000035c0), 0x0, &(0x7f0000003680)=""/41, 0x29}, 0x0) bind$alg(r0, &(0x7f0000001300)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb(blowfish)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000ff8000)="0a0775b0", 0x4) r1 = accept$alg(r0, 0x0, 0x0) sendmmsg$alg(r1, &(0x7f0000003e80)=[{0x0, 0x0, &(0x7f0000002a80), 0x167, &(0x7f0000000100)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x0) recvmsg(r1, &(0x7f0000000000)={&(0x7f0000f7ffa8)=@alg, 0x80, &(0x7f0000000140)=[{&(0x7f0000000200)=""/4096, 0x1000}], 0x1, 0x0, 0x0, 0x10000000000000}, 0x0) 04:02:28 executing program 2: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000440)=@updpolicy={0xb8, 0x19, 0x523, 0x0, 0x0, {{@in=@multicast2, @in6=@empty={[0x0, 0x0, 0x0, 0x0, 0x100000000000000]}, 0x0, 0x0, 0x0, 0x0, 0xa}}}, 0xb8}}, 0x0) 04:02:28 executing program 4: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) recvmsg(0xffffffffffffffff, &(0x7f00000036c0)={&(0x7f0000000180)=@can, 0xfd28, &(0x7f00000035c0), 0x0, &(0x7f0000003680)=""/41, 0x29}, 0x0) bind$alg(r0, &(0x7f0000001300)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb(blowfish)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000ff8000)="0a0775b0", 0x4) r1 = accept$alg(r0, 0x0, 0x0) sendmmsg$alg(r1, &(0x7f0000003e80)=[{0x0, 0x0, &(0x7f0000002a80), 0x167, &(0x7f0000000100)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x0) recvmsg(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)=[{&(0x7f0000000200)=""/4096, 0x7ffff000}], 0x1, &(0x7f0000fb3fa9)=""/87, 0x57}, 0x0) 04:02:28 executing program 3: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) recvmsg(0xffffffffffffffff, &(0x7f00000036c0)={&(0x7f0000000180)=@can, 0xfd28, &(0x7f00000035c0), 0x0, &(0x7f0000003680)=""/41, 0x29}, 0x0) bind$alg(r0, &(0x7f0000001300)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb(blowfish)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000ff8000)="0a0775b0", 0x4) r1 = accept$alg(r0, 0x0, 0x0) sendmmsg$alg(r1, &(0x7f0000003e80)=[{0x0, 0x0, &(0x7f0000002a80), 0x167, &(0x7f0000000100)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x0) recvmsg(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)=[{&(0x7f0000000200)=""/4096, 0x1010}], 0x1, &(0x7f0000fb3fa9)=""/87, 0x57}, 0x0) [ 662.353149] bond0 (unregistering): Released all slaves [ 662.633956] chnl_net:caif_netlink_parms(): no params data found [ 662.705252] bridge0: port 1(bridge_slave_0) entered blocking state [ 662.711823] bridge0: port 1(bridge_slave_0) entered disabled state [ 662.727240] device bridge_slave_0 entered promiscuous mode [ 662.740686] bridge0: port 2(bridge_slave_1) entered blocking state [ 662.749974] bridge0: port 2(bridge_slave_1) entered disabled state [ 662.763430] device bridge_slave_1 entered promiscuous mode [ 662.806585] bond0: Enslaving bond_slave_0 as an active interface with an up link [ 662.821806] bond0: Enslaving bond_slave_1 as an active interface with an up link [ 662.850036] IPv6: ADDRCONF(NETDEV_UP): team_slave_0: link is not ready [ 662.857655] team0: Port device team_slave_0 added [ 662.863547] IPv6: ADDRCONF(NETDEV_UP): team_slave_1: link is not ready [ 662.871044] team0: Port device team_slave_1 added [ 662.876671] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_0: link is not ready [ 662.884094] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_1: link is not ready [ 663.007693] device hsr_slave_0 entered promiscuous mode [ 663.040663] device hsr_slave_1 entered promiscuous mode [ 663.105006] IPv6: ADDRCONF(NETDEV_UP): hsr_slave_0: link is not ready [ 663.112010] IPv6: ADDRCONF(NETDEV_UP): hsr_slave_1: link is not ready [ 663.130223] bridge0: port 2(bridge_slave_1) entered blocking state [ 663.136627] bridge0: port 2(bridge_slave_1) entered forwarding state [ 663.143278] bridge0: port 1(bridge_slave_0) entered blocking state [ 663.149693] bridge0: port 1(bridge_slave_0) entered forwarding state [ 663.220447] 8021q: adding VLAN 0 to HW filter on device bond0 [ 663.238161] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready [ 663.256133] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 663.263953] bridge0: port 1(bridge_slave_0) entered disabled state [ 663.278182] bridge0: port 2(bridge_slave_1) entered disabled state [ 663.305781] IPv6: ADDRCONF(NETDEV_UP): team0: link is not ready [ 663.311883] 8021q: adding VLAN 0 to HW filter on device team0 [ 663.323775] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 663.332386] bridge0: port 1(bridge_slave_0) entered blocking state [ 663.338797] bridge0: port 1(bridge_slave_0) entered forwarding state [ 663.357773] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 663.365898] bridge0: port 2(bridge_slave_1) entered blocking state [ 663.372249] bridge0: port 2(bridge_slave_1) entered forwarding state [ 663.395662] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 663.403625] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 663.411797] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 663.419931] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 663.429273] IPv6: ADDRCONF(NETDEV_UP): hsr0: link is not ready [ 663.436247] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 663.443437] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 663.460157] IPv6: ADDRCONF(NETDEV_UP): vxcan1: link is not ready [ 663.473493] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 663.544893] net_ratelimit: 18 callbacks suppressed [ 663.544902] protocol 88fb is buggy, dev hsr_slave_0 [ 663.554964] protocol 88fb is buggy, dev hsr_slave_1 [ 663.564037] binder: BINDER_SET_CONTEXT_MGR already set [ 663.569982] binder: 23441:23442 ioctl 40046207 0 returned -16 [ 663.631920] binder: 23441:23443 BC_INCREFS_DONE node 425 has no pending increfs request [ 663.640776] binder: 23441:23443 Release 1 refcount change on invalid ref 1 ret -22 [ 663.659749] binder: 23441:23443 BC_ACQUIRE_DONE node 425 has no pending acquire request [ 663.668100] protocol 88fb is buggy, dev hsr_slave_0 [ 663.668157] protocol 88fb is buggy, dev hsr_slave_1 [ 663.684335] protocol 88fb is buggy, dev hsr_slave_0 [ 663.689429] protocol 88fb is buggy, dev hsr_slave_1 [ 663.694578] protocol 88fb is buggy, dev hsr_slave_0 [ 663.699639] protocol 88fb is buggy, dev hsr_slave_1 [ 663.718758] binder: 23441:23444 BC_ACQUIRE_DONE u0000000000000000 no match [ 663.732641] binder: 23441:23444 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 [ 663.740114] binder: 23441:23444 Release 1 refcount change on invalid ref 2 ret -22 [ 663.774388] protocol 88fb is buggy, dev hsr_slave_0 [ 663.779494] protocol 88fb is buggy, dev hsr_slave_1 04:02:30 executing program 0: r0 = perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) setxattr$security_smack_entry(&(0x7f0000000380)='./file0\x00', &(0x7f0000000480)='security.SMACK64IPIN\x00', &(0x7f0000000540)='^vboxnet1^\x00', 0xb, 0x1) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r1, &(0x7f0000000040), 0x0}, 0x20) unlink(&(0x7f0000000900)='./file0/file0\x00') r2 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r3 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r3, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, &(0x7f00000006c0)={0x0}) ioctl$BINDER_GET_NODE_DEBUG_INFO(r2, 0xc018620b, &(0x7f0000000640)={r4}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f00000000c0)=[@enter_looper], 0x0, 0x0, 0x0}) ioctl$BINDER_SET_CONTEXT_MGR(r3, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x1) prctl$PR_SET_NAME(0xf, &(0x7f00000004c0)='/group.stat\x00') ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, &(0x7f0000000780)}) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f0000000680)}) ioctl$FS_IOC_FIEMAP(r3, 0xc020660b, &(0x7f0000000b80)=ANY=[@ANYBLOB="0000010000000000200000000000000005000000010000000a00000000000000ff030000000000001a0a000000000000050000000000000000000000000000000000000000000000080000000000000000000000000000000800000000000000ffff0000000000000100008000000000000000000000000000000000000000000000000000000000000000000000000008000000000000003f0000000000000008000000000000000000000000000000000000000000800800000000000000000000000000000200000000000000000400000000000000000000010000000000000000000000000000000000000002110000000000000000000000000000cc0000000000000000000000000000001b0000000000000000000000000000000000000000000000841400000000000000000000000000000300000000000000feffffffffffffff000000000000000000000000000000000000000000000000020000000000000000000000000000000600000000000000ff01000000000000040000000000000000000000000000000000000000000000000400000000000000000000000000007be70000000000000900000000000000ff7f0000000000000000000000000000000000000000000004180000000000000000000000000000ffffffff0000000081000000000000000600000000000000000000000000000000000000000000000400000000000000000000000000000002000000000000000500000000000000ff7fffffffffffff0000000000000000000000000000000004040000000000000000000000000000"]) r6 = creat(&(0x7f00000000c0)='./file0\x00', 0x0) openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000100)='/group.stat\x00', 0x2761, 0x0) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000080), 0xffffffffffffffff) getpid() fallocate(r0, 0x0, 0x0, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x2f, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) memfd_create(&(0x7f0000000080)='!proccgroup\x00', 0x0) ioctl$sock_inet_SIOCSIFPFLAGS(0xffffffffffffffff, 0x8934, &(0x7f0000000400)={'veth0_to_bridge\x00', 0x100}) accept(r6, &(0x7f0000000580)=@alg, &(0x7f0000000600)=0x80) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x2400, 0x8000) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000008c0)={0x2c, 0x0, &(0x7f0000000780)=[@acquire_done={0x40106309, r5, 0x2}, @clear_death={0x400c630f, 0x1, 0x3}, @release={0x40046306, 0x2}], 0xc1, 0x0, &(0x7f00000007c0)="859547f83b9b058a973a491d7e6378544744f2b56b02270a2f78214a936e9afb25cd94695643af6563f86771aa9621b9f30f2ca538b018247a633c28ee01e03b4639679311117971e60dc1538f34e961ae301463172c41754be988f6beb0ce4d83c69f86c236d29520e6cdaf5dbb60404c66d63315ff287deac8632781d0197ef1f81314da0a1ed90b681842cf85a41b496ce0a7a6f5aa4b9b23483eea8861be89b3398c6aec3349174f9cdc9de34df361ac9bf7afd8566849487c3c0a1e3aaacd"}) 04:02:30 executing program 4: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) recvmsg(0xffffffffffffffff, &(0x7f00000036c0)={&(0x7f0000000180)=@can, 0xfd28, &(0x7f00000035c0), 0x0, &(0x7f0000003680)=""/41, 0x29}, 0x0) bind$alg(r0, &(0x7f0000001300)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb(blowfish)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000ff8000)="0a0775b0", 0x4) r1 = accept$alg(r0, 0x0, 0x0) sendmmsg$alg(r1, &(0x7f0000003e80)=[{0x0, 0x0, &(0x7f0000002a80), 0x167, &(0x7f0000000100)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x0) recvmsg(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)=[{&(0x7f0000000200)=""/4096, 0xffffffffffffffff}], 0x1, &(0x7f0000fb3fa9)=""/87, 0x57}, 0x0) 04:02:30 executing program 2: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000440)=@updpolicy={0xb8, 0x19, 0x523, 0x0, 0x0, {{@in=@multicast2, @in6=@empty={[0x0, 0x0, 0x0, 0x0, 0x200000000000000]}, 0x0, 0x0, 0x0, 0x0, 0xa}}}, 0xb8}}, 0x0) 04:02:30 executing program 1: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) recvmsg(0xffffffffffffffff, &(0x7f00000036c0)={&(0x7f0000000180)=@can, 0xfd28, &(0x7f00000035c0), 0x0, &(0x7f0000003680)=""/41, 0x29}, 0x0) bind$alg(r0, &(0x7f0000001300)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb(blowfish)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000ff8000)="0a0775b0", 0x4) r1 = accept$alg(r0, 0x0, 0x0) sendmmsg$alg(r1, &(0x7f0000003e80)=[{0x0, 0x0, &(0x7f0000002a80), 0x167, &(0x7f0000000100)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x0) recvmsg(r1, &(0x7f0000000000)={&(0x7f0000f7ffa8)=@alg, 0x80, &(0x7f0000000140)=[{&(0x7f0000000200)=""/4096, 0x1000}], 0x1, 0x0, 0x0, 0x700000000000000}, 0x0) 04:02:30 executing program 3: mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000000400)={{'fd', 0x3d, r0}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}}) utime(&(0x7f0000000080)='./file0\x00', 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) clone(0x0, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) read$FUSE(r0, 0x0, 0x0) 04:02:30 executing program 5: r0 = socket$inet6(0xa, 0x2, 0x0) r1 = syz_open_dev$mice(&(0x7f00000002c0)='/dev/input/mice\x00', 0x0, 0x0) ioctl$PPPOEIOCDFWD(r1, 0xb101, 0x0) syz_genetlink_get_family_id$nbd(&(0x7f0000000480)='nbd\x00') getsockopt$inet6_IPV6_XFRM_POLICY(r0, 0x29, 0x23, &(0x7f0000000340)={{{@in=@local, @in=@loopback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@local}, 0x0, @in=@remote}}, &(0x7f0000000140)=0xe8) connect$can_bcm(0xffffffffffffffff, &(0x7f00000001c0), 0x10) bind$inet6(r0, &(0x7f0000000040)={0xa, 0x4e24}, 0x1c) lsetxattr$security_ima(&(0x7f0000000280)='./file0\x00', &(0x7f0000000440)='security.ima\x00', 0x0, 0x0, 0x1) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clock_gettime(0x0, &(0x7f0000000100)={0x0, 0x0}) r4 = openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) bind(r4, &(0x7f0000000580)=@can={0x1d, r2}, 0x80) clock_gettime(0x3, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff}) ppoll(&(0x7f0000000000)=[{r0, 0x41a}], 0x1, &(0x7f0000000200)={0x0, r3+30000000}, &(0x7f0000000240), 0x20000008) connect$inet6(r0, &(0x7f0000000080)={0xa, 0x4e24, 0x0, @ipv4={[], [], @loopback}}, 0x1c) readv(0xffffffffffffffff, 0x0, 0x0) sendmmsg(r0, &(0x7f00000092c0), 0x4ff, 0x0) connect$pptp(r5, &(0x7f00000004c0)={0x18, 0x2, {0x0, @multicast1}}, 0x1e) [ 664.323961] binder: release 23441:23442 transaction 424 out, still active [ 664.372153] binder: unexpected work type, 4, not freed [ 664.405589] binder: undelivered TRANSACTION_COMPLETE [ 664.453737] binder: BINDER_SET_CONTEXT_MGR already set 04:02:30 executing program 4: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) recvmsg(0xffffffffffffffff, &(0x7f00000036c0)={&(0x7f0000000180)=@can, 0xfd28, &(0x7f00000035c0), 0x0, &(0x7f0000003680)=""/41, 0x29}, 0x0) bind$alg(r0, &(0x7f0000001300)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb(blowfish)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000ff8000)="0a0775b0", 0x4) r1 = accept$alg(r0, 0x0, 0x0) sendmmsg$alg(r1, &(0x7f0000003e80)=[{0x0, 0x0, &(0x7f0000002a80), 0x167, &(0x7f0000000100)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x0) recvmsg(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)=[{&(0x7f0000000200)=""/4096, 0x1000}], 0x2, &(0x7f0000fb3fa9)=""/87, 0x57}, 0x0) 04:02:30 executing program 2: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000440)=@updpolicy={0xb8, 0x19, 0x523, 0x0, 0x0, {{@in=@multicast2, @in6=@empty={[0x0, 0x0, 0x0, 0x0, 0x300000000000000]}, 0x0, 0x0, 0x0, 0x0, 0xa}}}, 0xb8}}, 0x0) 04:02:30 executing program 1: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) recvmsg(0xffffffffffffffff, &(0x7f00000036c0)={&(0x7f0000000180)=@can, 0xfd28, &(0x7f00000035c0), 0x0, &(0x7f0000003680)=""/41, 0x29}, 0x0) bind$alg(r0, &(0x7f0000001300)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb(blowfish)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000ff8000)="0a0775b0", 0x4) r1 = accept$alg(r0, 0x0, 0x0) sendmmsg$alg(r1, &(0x7f0000003e80)=[{0x0, 0x0, &(0x7f0000002a80), 0x167, &(0x7f0000000100)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x0) recvmsg(r1, &(0x7f0000000000)={&(0x7f0000f7ffa8)=@alg, 0x80, &(0x7f0000000140)=[{&(0x7f0000000200)=""/4096, 0x1000}], 0x1, 0x0, 0x0, 0x800000000000000}, 0x0) [ 664.483302] binder: 23454:23456 ioctl 40046207 0 returned -16 04:02:30 executing program 4: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) recvmsg(0xffffffffffffffff, &(0x7f00000036c0)={&(0x7f0000000180)=@can, 0xfd28, &(0x7f00000035c0), 0x0, &(0x7f0000003680)=""/41, 0x29}, 0x0) bind$alg(r0, &(0x7f0000001300)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb(blowfish)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000ff8000)="0a0775b0", 0x4) r1 = accept$alg(r0, 0x0, 0x0) sendmmsg$alg(r1, &(0x7f0000003e80)=[{0x0, 0x0, &(0x7f0000002a80), 0x167, &(0x7f0000000100)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x0) recvmsg(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)=[{&(0x7f0000000200)=""/4096, 0x1000}], 0x8, &(0x7f0000fb3fa9)=""/87, 0x57}, 0x0) 04:02:30 executing program 2: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000440)=@updpolicy={0xb8, 0x19, 0x523, 0x0, 0x0, {{@in=@multicast2, @in6=@empty={[0x0, 0x0, 0x0, 0x0, 0x400000000000000]}, 0x0, 0x0, 0x0, 0x0, 0xa}}}, 0xb8}}, 0x0) [ 664.573121] binder: 23454:23464 BC_INCREFS_DONE node 428 has no pending increfs request [ 664.609491] binder: 23454:23464 Release 1 refcount change on invalid ref 1 ret -22 04:02:30 executing program 1: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) recvmsg(0xffffffffffffffff, &(0x7f00000036c0)={&(0x7f0000000180)=@can, 0xfd28, &(0x7f00000035c0), 0x0, &(0x7f0000003680)=""/41, 0x29}, 0x0) bind$alg(r0, &(0x7f0000001300)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb(blowfish)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000ff8000)="0a0775b0", 0x4) r1 = accept$alg(r0, 0x0, 0x0) sendmmsg$alg(r1, &(0x7f0000003e80)=[{0x0, 0x0, &(0x7f0000002a80), 0x167, &(0x7f0000000100)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x0) recvmsg(r1, &(0x7f0000000000)={&(0x7f0000f7ffa8)=@alg, 0x80, &(0x7f0000000140)=[{&(0x7f0000000200)=""/4096, 0x1000}], 0x1, 0x0, 0x0, 0x1000000000000000}, 0x0) [ 664.679796] binder: 23454:23464 BC_ACQUIRE_DONE node 428 has no pending acquire request [ 664.718225] binder: 23454:23477 BC_ACQUIRE_DONE u0000000000000000 no match [ 664.759061] binder: 23454:23477 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 [ 664.786687] binder: 23454:23477 Release 1 refcount change on invalid ref 2 ret -22 04:02:30 executing program 0: r0 = perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) setxattr$security_smack_entry(&(0x7f0000000380)='./file0\x00', &(0x7f0000000480)='security.SMACK64IPIN\x00', &(0x7f0000000540)='^vboxnet1^\x00', 0xb, 0x1) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r1, &(0x7f0000000040), 0x0}, 0x20) unlink(&(0x7f0000000900)='./file0/file0\x00') r2 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r3 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r3, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, &(0x7f00000006c0)={0x0}) ioctl$BINDER_GET_NODE_DEBUG_INFO(r2, 0xc018620b, &(0x7f0000000640)={r4}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f00000000c0)=[@enter_looper], 0x0, 0x0, 0x0}) ioctl$BINDER_SET_CONTEXT_MGR(r3, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x1) prctl$PR_SET_NAME(0xf, &(0x7f00000004c0)='/group.stat\x00') ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, &(0x7f0000000780)}) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f0000000680)}) ioctl$FS_IOC_FIEMAP(r3, 0xc020660b, &(0x7f0000000b80)=ANY=[@ANYBLOB="0000010000000000200000000000000005000000010000000a00000000000000ff030000000000001a0a000000000000050000000000000000000000000000000000000000000000080000000000000000000000000000000800000000000000ffff0000000000000100008000000000000000000000000000000000000000000000000000000000000000000000000008000000000000003f0000000000000008000000000000000000000000000000000000000000800800000000000000000000000000000200000000000000000400000000000000000000010000000000000000000000000000000000000002110000000000000000000000000000cc0000000000000000000000000000001b0000000000000000000000000000000000000000000000841400000000000000000000000000000300000000000000feffffffffffffff000000000000000000000000000000000000000000000000020000000000000000000000000000000600000000000000ff01000000000000040000000000000000000000000000000000000000000000000400000000000000000000000000007be70000000000000900000000000000ff7f0000000000000000000000000000000000000000000004180000000000000000000000000000ffffffff0000000081000000000000000600000000000000000000000000000000000000000000000400000000000000000000000000000002000000000000000500000000000000ff7fffffffffffff0000000000000000000000000000000004040000000000000000000000000000"]) r6 = creat(&(0x7f00000000c0)='./file0\x00', 0x0) openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000100)='/group.stat\x00', 0x2761, 0x0) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000080), 0xffffffffffffffff) getpid() fallocate(r0, 0x0, 0x0, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x2f, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) memfd_create(&(0x7f0000000080)='!proccgroup\x00', 0x0) ioctl$sock_inet_SIOCSIFPFLAGS(0xffffffffffffffff, 0x8934, &(0x7f0000000400)={'veth0_to_bridge\x00', 0x100}) accept(r6, &(0x7f0000000580)=@alg, &(0x7f0000000600)=0x80) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x2400, 0x8000) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000008c0)={0x2c, 0x0, &(0x7f0000000780)=[@acquire_done={0x40106309, r5, 0x2}, @clear_death={0x400c630f, 0x1, 0x3}, @release={0x40046306, 0x2}], 0xc1, 0x0, &(0x7f00000007c0)="859547f83b9b058a973a491d7e6378544744f2b56b02270a2f78214a936e9afb25cd94695643af6563f86771aa9621b9f30f2ca538b018247a633c28ee01e03b4639679311117971e60dc1538f34e961ae301463172c41754be988f6beb0ce4d83c69f86c236d29520e6cdaf5dbb60404c66d63315ff287deac8632781d0197ef1f81314da0a1ed90b681842cf85a41b496ce0a7a6f5aa4b9b23483eea8861be89b3398c6aec3349174f9cdc9de34df361ac9bf7afd8566849487c3c0a1e3aaacd"}) 04:02:30 executing program 4: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) recvmsg(0xffffffffffffffff, &(0x7f00000036c0)={&(0x7f0000000180)=@can, 0xfd28, &(0x7f00000035c0), 0x0, &(0x7f0000003680)=""/41, 0x29}, 0x0) bind$alg(r0, &(0x7f0000001300)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb(blowfish)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000ff8000)="0a0775b0", 0x4) r1 = accept$alg(r0, 0x0, 0x0) sendmmsg$alg(r1, &(0x7f0000003e80)=[{0x0, 0x0, &(0x7f0000002a80), 0x167, &(0x7f0000000100)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x0) recvmsg(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)=[{&(0x7f0000000200)=""/4096, 0x1000}], 0x10, &(0x7f0000fb3fa9)=""/87, 0x57}, 0x0) 04:02:30 executing program 1: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) recvmsg(0xffffffffffffffff, &(0x7f00000036c0)={&(0x7f0000000180)=@can, 0xfd28, &(0x7f00000035c0), 0x0, &(0x7f0000003680)=""/41, 0x29}, 0x0) bind$alg(r0, &(0x7f0000001300)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb(blowfish)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000ff8000)="0a0775b0", 0x4) r1 = accept$alg(r0, 0x0, 0x0) sendmmsg$alg(r1, &(0x7f0000003e80)=[{0x0, 0x0, &(0x7f0000002a80), 0x167, &(0x7f0000000100)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x0) recvmsg(r1, &(0x7f0000000000)={&(0x7f0000f7ffa8)=@alg, 0x80, &(0x7f0000000140)=[{&(0x7f0000000200)=""/4096, 0x1000}], 0x1, 0x0, 0x0, 0x1f00000000000000}, 0x0) 04:02:30 executing program 2: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000440)=@updpolicy={0xb8, 0x19, 0x523, 0x0, 0x0, {{@in=@multicast2, @in6=@empty={[0x0, 0x0, 0x0, 0x0, 0x800000000000000]}, 0x0, 0x0, 0x0, 0x0, 0xa}}}, 0xb8}}, 0x0) [ 665.204416] binder: release 23454:23456 transaction 427 out, still active [ 665.211427] binder: unexpected work type, 4, not freed [ 665.277806] binder: undelivered TRANSACTION_COMPLETE [ 665.380166] binder: BINDER_SET_CONTEXT_MGR already set 04:02:31 executing program 3: r0 = perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) setxattr$security_smack_entry(&(0x7f0000000380)='./file0\x00', &(0x7f0000000480)='security.SMACK64IPIN\x00', &(0x7f0000000540)='^vboxnet1^\x00', 0xb, 0x1) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r1, &(0x7f0000000040), 0x0}, 0x20) unlink(&(0x7f0000000900)='./file0/file0\x00') r2 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r3 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r3, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, &(0x7f00000006c0)={0x0}) ioctl$BINDER_GET_NODE_DEBUG_INFO(r2, 0xc018620b, &(0x7f0000000640)={r4}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f00000000c0)=[@enter_looper], 0x0, 0x0, 0x0}) ioctl$BINDER_SET_CONTEXT_MGR(r3, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x1) prctl$PR_SET_NAME(0xf, &(0x7f00000004c0)='/group.stat\x00') ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, &(0x7f0000000780)}) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f0000000680)}) ioctl$FS_IOC_FIEMAP(r3, 0xc020660b, &(0x7f0000000b80)=ANY=[@ANYBLOB="0000010000000000200000000000000005000000010000000a00000000000000ff030000000000001a0a000000000000050000000000000000000000000000000000000000000000080000000000000000000000000000000800000000000000ffff0000000000000100008000000000000000000000000000000000000000000000000000000000000000000000000008000000000000003f0000000000000008000000000000000000000000000000000000000000800800000000000000000000000000000200000000000000000400000000000000000000010000000000000000000000000000000000000002110000000000000000000000000000cc0000000000000000000000000000001b0000000000000000000000000000000000000000000000841400000000000000000000000000000300000000000000feffffffffffffff000000000000000000000000000000000000000000000000020000000000000000000000000000000600000000000000ff01000000000000040000000000000000000000000000000000000000000000000400000000000000000000000000007be70000000000000900000000000000ff7f0000000000000000000000000000000000000000000004180000000000000000000000000000ffffffff0000000081000000000000000600000000000000000000000000000000000000000000000400000000000000000000000000000002000000000000000500000000000000ff7fffffffffffff0000000000000000000000000000000004040000000000000000000000000000"]) r6 = creat(&(0x7f00000000c0)='./file0\x00', 0x0) openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000100)='/group.stat\x00', 0x2761, 0x0) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000080), 0xffffffffffffffff) getpid() fallocate(r0, 0x0, 0x0, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x2f, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) memfd_create(&(0x7f0000000080)='!proccgroup\x00', 0x0) ioctl$sock_inet_SIOCSIFPFLAGS(0xffffffffffffffff, 0x8934, &(0x7f0000000400)={'veth0_to_bridge\x00', 0x100}) accept(r6, &(0x7f0000000580)=@alg, &(0x7f0000000600)=0x80) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x2400, 0x8000) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000008c0)={0x2c, 0x0, &(0x7f0000000780)=[@acquire_done={0x40106309, r5, 0x2}, @clear_death={0x400c630f, 0x1, 0x3}, @release={0x40046306, 0x2}], 0xc1, 0x0, &(0x7f00000007c0)="859547f83b9b058a973a491d7e6378544744f2b56b02270a2f78214a936e9afb25cd94695643af6563f86771aa9621b9f30f2ca538b018247a633c28ee01e03b4639679311117971e60dc1538f34e961ae301463172c41754be988f6beb0ce4d83c69f86c236d29520e6cdaf5dbb60404c66d63315ff287deac8632781d0197ef1f81314da0a1ed90b681842cf85a41b496ce0a7a6f5aa4b9b23483eea8861be89b3398c6aec3349174f9cdc9de34df361ac9bf7afd8566849487c3c0a1e3aaacd"}) [ 665.409116] binder: 23494:23499 ioctl 40046207 0 returned -16 [ 665.492864] binder: 23494:23501 BC_INCREFS_DONE node 431 has no pending increfs request [ 665.509100] binder: 23494:23501 Release 1 refcount change on invalid ref 1 ret -22 [ 665.517961] binder: BINDER_SET_CONTEXT_MGR already set [ 665.522545] binder: 23494:23501 BC_ACQUIRE_DONE node 431 has no pending acquire request [ 665.523409] binder: 23502:23503 ioctl 40046207 0 returned -16 04:02:31 executing program 5: r0 = socket$inet6(0xa, 0x2, 0x0) r1 = syz_open_dev$mice(&(0x7f00000002c0)='/dev/input/mice\x00', 0x0, 0x0) ioctl$PPPOEIOCDFWD(r1, 0xb101, 0x0) syz_genetlink_get_family_id$nbd(&(0x7f0000000480)='nbd\x00') getsockopt$inet6_IPV6_XFRM_POLICY(r0, 0x29, 0x23, &(0x7f0000000340)={{{@in=@local, @in=@loopback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@local}, 0x0, @in=@remote}}, &(0x7f0000000140)=0xe8) connect$can_bcm(0xffffffffffffffff, &(0x7f00000001c0), 0x10) bind$inet6(r0, &(0x7f0000000040)={0xa, 0x4e24}, 0x1c) lsetxattr$security_ima(&(0x7f0000000280)='./file0\x00', &(0x7f0000000440)='security.ima\x00', 0x0, 0x0, 0x1) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clock_gettime(0x0, &(0x7f0000000100)={0x0, 0x0}) r4 = openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) bind(r4, &(0x7f0000000580)=@can={0x1d, r2}, 0x80) clock_gettime(0x3, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff}) ppoll(&(0x7f0000000000)=[{r0, 0x41a}], 0x1, &(0x7f0000000200)={0x0, r3+30000000}, &(0x7f0000000240), 0x20000248) connect$inet6(r0, &(0x7f0000000080)={0xa, 0x4e24, 0x0, @ipv4={[], [], @loopback}}, 0x1c) readv(0xffffffffffffffff, 0x0, 0x0) sendmmsg(r0, &(0x7f00000092c0), 0x4ff, 0x0) connect$pptp(r5, &(0x7f00000004c0)={0x18, 0x2, {0x0, @multicast1}}, 0x1e) 04:02:31 executing program 2: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000440)=@updpolicy={0xb8, 0x19, 0x523, 0x0, 0x0, {{@in=@multicast2, @in6=@empty={[0x0, 0x0, 0x0, 0x0, 0xa00000000000000]}, 0x0, 0x0, 0x0, 0x0, 0xa}}}, 0xb8}}, 0x0) 04:02:31 executing program 1: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) recvmsg(0xffffffffffffffff, &(0x7f00000036c0)={&(0x7f0000000180)=@can, 0xfd28, &(0x7f00000035c0), 0x0, &(0x7f0000003680)=""/41, 0x29}, 0x0) bind$alg(r0, &(0x7f0000001300)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb(blowfish)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000ff8000)="0a0775b0", 0x4) r1 = accept$alg(r0, 0x0, 0x0) sendmmsg$alg(r1, &(0x7f0000003e80)=[{0x0, 0x0, &(0x7f0000002a80), 0x167, &(0x7f0000000100)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x0) recvmsg(r1, &(0x7f0000000000)={&(0x7f0000f7ffa8)=@alg, 0x80, &(0x7f0000000140)=[{&(0x7f0000000200)=""/4096, 0x1000}], 0x1, 0x0, 0x0, 0x8000000000000000}, 0x0) 04:02:31 executing program 4: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) recvmsg(0xffffffffffffffff, &(0x7f00000036c0)={&(0x7f0000000180)=@can, 0xfd28, &(0x7f00000035c0), 0x0, &(0x7f0000003680)=""/41, 0x29}, 0x0) bind$alg(r0, &(0x7f0000001300)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb(blowfish)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000ff8000)="0a0775b0", 0x4) r1 = accept$alg(r0, 0x0, 0x0) sendmmsg$alg(r1, &(0x7f0000003e80)=[{0x0, 0x0, &(0x7f0000002a80), 0x167, &(0x7f0000000100)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x0) recvmsg(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)=[{&(0x7f0000000200)=""/4096, 0x1000}], 0x500, &(0x7f0000fb3fa9)=""/87, 0x57}, 0x0) [ 665.551134] binder: 23494:23504 BC_ACQUIRE_DONE u0000000000000000 no match [ 665.579540] binder: 23502:23508 BC_INCREFS_DONE node 434 has no pending increfs request [ 665.616793] binder: 23502:23508 Release 1 refcount change on invalid ref 1 ret -22 [ 665.631143] binder: 23494:23504 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 [ 665.647969] binder: 23502:23508 BC_ACQUIRE_DONE node 434 has no pending acquire request [ 665.656352] binder: 23494:23504 Release 1 refcount change on invalid ref 2 ret -22 04:02:31 executing program 2: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000440)=@updpolicy={0xb8, 0x19, 0x523, 0x0, 0x0, {{@in=@multicast2, @in6=@empty={[0x0, 0x0, 0x0, 0x0, 0xe00000000000000]}, 0x0, 0x0, 0x0, 0x0, 0xa}}}, 0xb8}}, 0x0) [ 665.669300] binder: 23502:23517 BC_ACQUIRE_DONE u0000000000000000 no match [ 665.676629] binder: 23502:23517 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 [ 665.683732] binder: 23502:23517 Release 1 refcount change on invalid ref 2 ret -22 04:02:31 executing program 1: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) recvmsg(0xffffffffffffffff, &(0x7f00000036c0)={&(0x7f0000000180)=@can, 0xfd28, &(0x7f00000035c0), 0x0, &(0x7f0000003680)=""/41, 0x29}, 0x0) bind$alg(r0, &(0x7f0000001300)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb(blowfish)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000ff8000)="0a0775b0", 0x4) r1 = accept$alg(r0, 0x0, 0x0) sendmmsg$alg(r1, &(0x7f0000003e80)=[{0x0, 0x0, &(0x7f0000002a80), 0x167, &(0x7f0000000100)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x0) recvmsg(r1, &(0x7f0000000000)={&(0x7f0000f7ffa8)=@alg, 0x80, &(0x7f0000000140)=[{&(0x7f0000000200)=""/4096, 0x1000}], 0x1, 0x0, 0x0, 0x8dffffff00000000}, 0x0) 04:02:31 executing program 4: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) recvmsg(0xffffffffffffffff, &(0x7f00000036c0)={&(0x7f0000000180)=@can, 0xfd28, &(0x7f00000035c0), 0x0, &(0x7f0000003680)=""/41, 0x29}, 0x0) bind$alg(r0, &(0x7f0000001300)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb(blowfish)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000ff8000)="0a0775b0", 0x4) r1 = accept$alg(r0, 0x0, 0x0) sendmmsg$alg(r1, &(0x7f0000003e80)=[{0x0, 0x0, &(0x7f0000002a80), 0x167, &(0x7f0000000100)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x0) recvmsg(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)=[{&(0x7f0000000200)=""/4096, 0x1000}], 0x1f00, &(0x7f0000fb3fa9)=""/87, 0x57}, 0x0) 04:02:31 executing program 2: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000440)=@updpolicy={0xb8, 0x19, 0x523, 0x0, 0x0, {{@in=@multicast2, @in6=@empty={[0x0, 0x0, 0x0, 0x0, 0xf00000000000000]}, 0x0, 0x0, 0x0, 0x0, 0xa}}}, 0xb8}}, 0x0) 04:02:31 executing program 1: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) recvmsg(0xffffffffffffffff, &(0x7f00000036c0)={&(0x7f0000000180)=@can, 0xfd28, &(0x7f00000035c0), 0x0, &(0x7f0000003680)=""/41, 0x29}, 0x0) bind$alg(r0, &(0x7f0000001300)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb(blowfish)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000ff8000)="0a0775b0", 0x4) r1 = accept$alg(r0, 0x0, 0x0) sendmmsg$alg(r1, &(0x7f0000003e80)=[{0x0, 0x0, &(0x7f0000002a80), 0x167, &(0x7f0000000100)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x0) recvmsg(r1, &(0x7f0000000000)={&(0x7f0000f7ffa8)=@alg, 0x80, &(0x7f0000000140)=[{&(0x7f0000000200)=""/4096, 0x1000}], 0x1, 0x0, 0x0, 0xf0ffffff00000000}, 0x0) 04:02:31 executing program 0: r0 = perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) setxattr$security_smack_entry(&(0x7f0000000380)='./file0\x00', &(0x7f0000000480)='security.SMACK64IPIN\x00', &(0x7f0000000540)='^vboxnet1^\x00', 0xb, 0x1) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r1, &(0x7f0000000040), 0x0}, 0x20) unlink(&(0x7f0000000900)='./file0/file0\x00') r2 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r3 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r3, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, &(0x7f00000006c0)={0x0}) ioctl$BINDER_GET_NODE_DEBUG_INFO(r2, 0xc018620b, &(0x7f0000000640)={r4}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f00000000c0)=[@enter_looper], 0x0, 0x0, &(0x7f0000000700)}) ioctl$BINDER_SET_CONTEXT_MGR(r3, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x1) prctl$PR_SET_NAME(0xf, &(0x7f00000004c0)='/group.stat\x00') ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, &(0x7f0000000780)}) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f0000000680)}) ioctl$FS_IOC_FIEMAP(r3, 0xc020660b, &(0x7f0000000b80)=ANY=[@ANYBLOB="0000010000000000200000000000000005000000010000000a00000000000000ff030000000000001a0a000000000000050000000000000000000000000000000000000000000000080000000000000000000000000000000800000000000000ffff0000000000000100008000000000000000000000000000000000000000000000000000000000000000000000000008000000000000003f0000000000000008000000000000000000000000000000000000000000800800000000000000000000000000000200000000000000000400000000000000000000010000000000000000000000000000000000000002110000000000000000000000000000cc0000000000000000000000000000001b0000000000000000000000000000000000000000000000841400000000000000000000000000000300000000000000feffffffffffffff000000000000000000000000000000000000000000000000020000000000000000000000000000000600000000000000ff01000000000000040000000000000000000000000000000000000000000000000400000000000000000000000000007be70000000000000900000000000000ff7f0000000000000000000000000000000000000000000004180000000000000000000000000000ffffffff0000000081000000000000000600000000000000000000000000000000000000000000000400000000000000000000000000000002000000000000000500000000000000ff7fffffffffffff0000000000000000000000000000000004040000000000000000000000000000"]) r6 = creat(&(0x7f00000000c0)='./file0\x00', 0x0) openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000100)='/group.stat\x00', 0x2761, 0x0) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000080), 0xffffffffffffffff) getpid() fallocate(r0, 0x0, 0x0, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x2f, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) memfd_create(&(0x7f0000000080)='!proccgroup\x00', 0x0) ioctl$sock_inet_SIOCSIFPFLAGS(0xffffffffffffffff, 0x8934, &(0x7f0000000400)={'veth0_to_bridge\x00', 0x100}) accept(r6, &(0x7f0000000580)=@alg, &(0x7f0000000600)=0x80) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x2400, 0x8000) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000008c0)={0x2c, 0x0, &(0x7f0000000780)=[@acquire_done={0x40106309, r5, 0x2}, @clear_death={0x400c630f, 0x1, 0x3}, @release={0x40046306, 0x2}], 0xc1, 0x0, &(0x7f00000007c0)="859547f83b9b058a973a491d7e6378544744f2b56b02270a2f78214a936e9afb25cd94695643af6563f86771aa9621b9f30f2ca538b018247a633c28ee01e03b4639679311117971e60dc1538f34e961ae301463172c41754be988f6beb0ce4d83c69f86c236d29520e6cdaf5dbb60404c66d63315ff287deac8632781d0197ef1f81314da0a1ed90b681842cf85a41b496ce0a7a6f5aa4b9b23483eea8861be89b3398c6aec3349174f9cdc9de34df361ac9bf7afd8566849487c3c0a1e3aaacd"}) 04:02:31 executing program 4: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) recvmsg(0xffffffffffffffff, &(0x7f00000036c0)={&(0x7f0000000180)=@can, 0xfd28, &(0x7f00000035c0), 0x0, &(0x7f0000003680)=""/41, 0x29}, 0x0) bind$alg(r0, &(0x7f0000001300)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb(blowfish)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000ff8000)="0a0775b0", 0x4) r1 = accept$alg(r0, 0x0, 0x0) sendmmsg$alg(r1, &(0x7f0000003e80)=[{0x0, 0x0, &(0x7f0000002a80), 0x167, &(0x7f0000000100)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x0) recvmsg(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)=[{&(0x7f0000000200)=""/4096, 0x1000}], 0x1, &(0x7f0000fb3fa9)=""/87, 0x57, 0x7}, 0x0) [ 666.128736] binder: release 23494:23499 transaction 430 out, still active [ 666.148194] binder: unexpected work type, 4, not freed [ 666.170529] binder: undelivered TRANSACTION_COMPLETE 04:02:32 executing program 2: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000440)=@updpolicy={0xb8, 0x19, 0x523, 0x0, 0x0, {{@in=@multicast2, @in6=@empty={[0x0, 0x0, 0x0, 0x0, 0x1000000000000000]}, 0x0, 0x0, 0x0, 0x0, 0xa}}}, 0xb8}}, 0x0) [ 666.242191] binder: BINDER_SET_CONTEXT_MGR already set [ 666.269753] binder: 23537:23539 ioctl 40046207 0 returned -16 [ 666.283461] binder: release 23502:23503 transaction 433 out, still active [ 666.308044] binder: unexpected work type, 4, not freed [ 666.322656] binder: undelivered TRANSACTION_COMPLETE [ 666.375199] binder: 23537:23543 BC_INCREFS_DONE node 437 has no pending increfs request [ 666.386324] binder: 23537:23543 Release 1 refcount change on invalid ref 1 ret -22 [ 666.406229] binder: 23537:23543 BC_ACQUIRE_DONE node 437 has no pending acquire request [ 666.433770] binder: 23537:23547 BC_ACQUIRE_DONE u0000000000000000 no match [ 666.450610] binder: 23537:23547 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 [ 666.458412] binder: 23537:23547 Release 1 refcount change on invalid ref 2 ret -22 04:02:32 executing program 5: r0 = socket$inet6(0xa, 0x2, 0x0) r1 = syz_open_dev$mice(&(0x7f00000002c0)='/dev/input/mice\x00', 0x0, 0x0) ioctl$PPPOEIOCDFWD(r1, 0xb101, 0x0) syz_genetlink_get_family_id$nbd(&(0x7f0000000480)='nbd\x00') getsockopt$inet6_IPV6_XFRM_POLICY(r0, 0x29, 0x23, &(0x7f0000000340)={{{@in=@local, @in=@loopback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@local}, 0x0, @in=@remote}}, &(0x7f0000000140)=0xe8) ioctl$PERF_EVENT_IOC_MODIFY_ATTRIBUTES(r1, 0x4008240b, &(0x7f0000000500)={0x4, 0x70, 0x0, 0x7, 0x6, 0x7ff, 0x0, 0xffffffff7fffffff, 0xc1, 0x7, 0x1000, 0x9, 0x4, 0xffffffffffffffff, 0x9, 0x7, 0x2a1, 0x80000001, 0x1f, 0x2, 0x9, 0x7, 0x7, 0xfffffffffffff40e, 0x5, 0x3, 0x6, 0x1, 0x1, 0x5, 0x9, 0x9, 0x3, 0x400000000000, 0x1, 0xff, 0x1, 0x2, 0x0, 0x5, 0x0, @perf_config_ext={0x7f4, 0x1f}, 0x12000, 0xfffffffffffffe01, 0x0, 0x1, 0x2, 0x4c, 0x9e5d}) connect$can_bcm(0xffffffffffffffff, &(0x7f00000001c0), 0x10) bind$inet6(r0, &(0x7f0000000040)={0xa, 0x4e24}, 0x1c) lsetxattr$security_ima(&(0x7f0000000280)='./file0\x00', &(0x7f0000000440)='security.ima\x00', 0x0, 0x0, 0x1) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clock_gettime(0x0, &(0x7f0000000100)={0x0, 0x0}) r4 = openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) bind(r4, &(0x7f0000000580)=@can={0x1d, r2}, 0x80) ioctl$PERF_EVENT_IOC_REFRESH(r1, 0x2402, 0x1f0) clock_gettime(0x3, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff}) ppoll(&(0x7f0000000000)=[{r0, 0x41a}], 0x1, &(0x7f0000000200)={0x0, r3+30000000}, &(0x7f0000000240), 0x8) connect$inet6(r0, &(0x7f0000000080)={0xa, 0x4e24, 0x0, @ipv4={[], [], @loopback}}, 0x1c) readv(0xffffffffffffffff, 0x0, 0x0) sendmmsg(r0, &(0x7f00000092c0), 0x4ff, 0x0) connect$pptp(r5, &(0x7f00000004c0)={0x18, 0x2, {0x0, @multicast1}}, 0x1e) 04:02:32 executing program 3: r0 = perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) setxattr$security_smack_entry(&(0x7f0000000380)='./file0\x00', &(0x7f0000000480)='security.SMACK64IPIN\x00', &(0x7f0000000540)='^vboxnet1^\x00', 0xb, 0x1) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r1, &(0x7f0000000040), 0x0}, 0x20) unlink(&(0x7f0000000900)='./file0/file0\x00') r2 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r3 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r3, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, &(0x7f00000006c0)={0x0}) ioctl$BINDER_GET_NODE_DEBUG_INFO(r2, 0xc018620b, &(0x7f0000000640)={r4}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f00000000c0)=[@enter_looper], 0x0, 0x0, 0x0}) ioctl$BINDER_SET_CONTEXT_MGR(r3, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x1) prctl$PR_SET_NAME(0xf, &(0x7f00000004c0)='/group.stat\x00') ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, &(0x7f0000000780)}) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f0000000680)}) ioctl$FS_IOC_FIEMAP(r3, 0xc020660b, &(0x7f0000000b80)=ANY=[@ANYBLOB="0000010000000000200000000000000005000000010000000a00000000000000ff030000000000001a0a000000000000050000000000000000000000000000000000000000000000080000000000000000000000000000000800000000000000ffff0000000000000100008000000000000000000000000000000000000000000000000000000000000000000000000008000000000000003f0000000000000008000000000000000000000000000000000000000000800800000000000000000000000000000200000000000000000400000000000000000000010000000000000000000000000000000000000002110000000000000000000000000000cc0000000000000000000000000000001b0000000000000000000000000000000000000000000000841400000000000000000000000000000300000000000000feffffffffffffff000000000000000000000000000000000000000000000000020000000000000000000000000000000600000000000000ff01000000000000040000000000000000000000000000000000000000000000000400000000000000000000000000007be70000000000000900000000000000ff7f0000000000000000000000000000000000000000000004180000000000000000000000000000ffffffff0000000081000000000000000600000000000000000000000000000000000000000000000400000000000000000000000000000002000000000000000500000000000000ff7fffffffffffff0000000000000000000000000000000004040000000000000000000000000000"]) r6 = creat(&(0x7f00000000c0)='./file0\x00', 0x0) openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000100)='/group.stat\x00', 0x2761, 0x0) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000080), 0xffffffffffffffff) getpid() fallocate(r0, 0x0, 0x0, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x2f, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) memfd_create(&(0x7f0000000080)='!proccgroup\x00', 0x0) ioctl$sock_inet_SIOCSIFPFLAGS(0xffffffffffffffff, 0x8934, &(0x7f0000000400)={'veth0_to_bridge\x00', 0x100}) accept(r6, &(0x7f0000000580)=@alg, &(0x7f0000000600)=0x80) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x2400, 0x8000) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000008c0)={0x2c, 0x0, &(0x7f0000000780)=[@acquire_done={0x40106309, r5, 0x2}, @clear_death={0x400c630f, 0x1, 0x3}, @release={0x40046306, 0x2}], 0xc1, 0x0, &(0x7f00000007c0)="859547f83b9b058a973a491d7e6378544744f2b56b02270a2f78214a936e9afb25cd94695643af6563f86771aa9621b9f30f2ca538b018247a633c28ee01e03b4639679311117971e60dc1538f34e961ae301463172c41754be988f6beb0ce4d83c69f86c236d29520e6cdaf5dbb60404c66d63315ff287deac8632781d0197ef1f81314da0a1ed90b681842cf85a41b496ce0a7a6f5aa4b9b23483eea8861be89b3398c6aec3349174f9cdc9de34df361ac9bf7afd8566849487c3c0a1e3aaacd"}) 04:02:32 executing program 1: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) recvmsg(0xffffffffffffffff, &(0x7f00000036c0)={&(0x7f0000000180)=@can, 0xfd28, &(0x7f00000035c0), 0x0, &(0x7f0000003680)=""/41, 0x29}, 0x0) bind$alg(r0, &(0x7f0000001300)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb(blowfish)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000ff8000)="0a0775b0", 0x4) r1 = accept$alg(r0, 0x0, 0x0) sendmmsg$alg(r1, &(0x7f0000003e80)=[{0x0, 0x0, &(0x7f0000002a80), 0x167, &(0x7f0000000100)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x0) recvmsg(r1, &(0x7f0000000000)={&(0x7f0000f7ffa8)=@alg, 0x80, &(0x7f0000000140)=[{&(0x7f0000000200)=""/4096, 0x1000}], 0x1, 0x0, 0x0, 0x0}, 0x0) 04:02:32 executing program 4: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) recvmsg(0xffffffffffffffff, &(0x7f00000036c0)={&(0x7f0000000180)=@can, 0xfd28, &(0x7f00000035c0), 0x0, &(0x7f0000003680)=""/41, 0x29}, 0x0) bind$alg(r0, &(0x7f0000001300)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb(blowfish)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000ff8000)="0a0775b0", 0x4) r1 = accept$alg(r0, 0x0, 0x0) sendmmsg$alg(r1, &(0x7f0000003e80)=[{0x0, 0x0, &(0x7f0000002a80), 0x167, &(0x7f0000000100)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x0) recvmsg(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)=[{&(0x7f0000000200)=""/4096, 0x1000}], 0x1, &(0x7f0000fb3fa9)=""/87, 0x57, 0x8}, 0x0) 04:02:32 executing program 2: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000440)=@updpolicy={0xb8, 0x19, 0x523, 0x0, 0x0, {{@in=@multicast2, @in6=@empty={[0x0, 0x0, 0x0, 0x0, 0x2403000000000000]}, 0x0, 0x0, 0x0, 0x0, 0xa}}}, 0xb8}}, 0x0) 04:02:32 executing program 2: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000440)=@updpolicy={0xb8, 0x19, 0x523, 0x0, 0x0, {{@in=@multicast2, @in6=@empty={[0x0, 0x0, 0x0, 0x0, 0x2f00000000000000]}, 0x0, 0x0, 0x0, 0x0, 0xa}}}, 0xb8}}, 0x0) [ 666.662577] binder: BINDER_SET_CONTEXT_MGR already set 04:02:32 executing program 1: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) recvmsg(0xffffffffffffffff, &(0x7f00000036c0)={&(0x7f0000000180)=@can, 0xfd28, &(0x7f00000035c0), 0x0, &(0x7f0000003680)=""/41, 0x29}, 0x0) bind$alg(r0, &(0x7f0000001300)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb(blowfish)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000ff8000)="0a0775b0", 0x4) r1 = accept$alg(r0, 0x0, 0x0) sendmmsg$alg(r1, &(0x7f0000003e80)=[{0x0, 0x0, &(0x7f0000002a80), 0x167, &(0x7f0000000100)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x0) recvmsg(r1, &(0x7f0000000000)={&(0x7f0000f7ffa8)=@alg, 0x80, &(0x7f0000000140)=[{&(0x7f0000000200)=""/4096, 0x1000}], 0x1, 0x0, 0x0, 0x0}, 0x0) 04:02:32 executing program 4: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) recvmsg(0xffffffffffffffff, &(0x7f00000036c0)={&(0x7f0000000180)=@can, 0xfd28, &(0x7f00000035c0), 0x0, &(0x7f0000003680)=""/41, 0x29}, 0x0) bind$alg(r0, &(0x7f0000001300)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb(blowfish)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000ff8000)="0a0775b0", 0x4) r1 = accept$alg(r0, 0x0, 0x0) sendmmsg$alg(r1, &(0x7f0000003e80)=[{0x0, 0x0, &(0x7f0000002a80), 0x167, &(0x7f0000000100)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x0) recvmsg(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)=[{&(0x7f0000000200)=""/4096, 0x1000}], 0x1, &(0x7f0000fb3fa9)=""/87, 0x57, 0x10}, 0x0) [ 666.695947] binder: 23550:23557 ioctl 40046207 0 returned -16 04:02:32 executing program 2: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000440)=@updpolicy={0xb8, 0x19, 0x523, 0x0, 0x0, {{@in=@multicast2, @in6=@empty={[0x0, 0x0, 0x0, 0x0, 0x6000000000000000]}, 0x0, 0x0, 0x0, 0x0, 0xa}}}, 0xb8}}, 0x0) [ 666.787221] binder: 23550:23566 BC_INCREFS_DONE node 440 has no pending increfs request [ 666.836490] binder: 23550:23566 BC_ACQUIRE_DONE node 440 has no pending acquire request [ 666.899269] binder: 23550:23582 BC_ACQUIRE_DONE u0000000000000000 no match [ 666.930416] binder: 23550:23582 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 04:02:32 executing program 0: r0 = perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) setxattr$security_smack_entry(&(0x7f0000000380)='./file0\x00', &(0x7f0000000480)='security.SMACK64IPIN\x00', &(0x7f0000000540)='^vboxnet1^\x00', 0xb, 0x1) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r1, &(0x7f0000000040), 0x0}, 0x20) unlink(&(0x7f0000000900)='./file0/file0\x00') r2 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r3 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r3, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, &(0x7f00000006c0)={0x0}) ioctl$BINDER_GET_NODE_DEBUG_INFO(r2, 0xc018620b, &(0x7f0000000640)={r4}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f00000000c0)=[@enter_looper], 0x0, 0x0, &(0x7f0000000700)}) ioctl$BINDER_SET_CONTEXT_MGR(r3, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x1) prctl$PR_SET_NAME(0xf, &(0x7f00000004c0)='/group.stat\x00') ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, &(0x7f0000000780)}) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f0000000680)}) ioctl$FS_IOC_FIEMAP(r3, 0xc020660b, &(0x7f0000000b80)=ANY=[@ANYBLOB="0000010000000000200000000000000005000000010000000a00000000000000ff030000000000001a0a000000000000050000000000000000000000000000000000000000000000080000000000000000000000000000000800000000000000ffff0000000000000100008000000000000000000000000000000000000000000000000000000000000000000000000008000000000000003f0000000000000008000000000000000000000000000000000000000000800800000000000000000000000000000200000000000000000400000000000000000000010000000000000000000000000000000000000002110000000000000000000000000000cc0000000000000000000000000000001b0000000000000000000000000000000000000000000000841400000000000000000000000000000300000000000000feffffffffffffff000000000000000000000000000000000000000000000000020000000000000000000000000000000600000000000000ff01000000000000040000000000000000000000000000000000000000000000000400000000000000000000000000007be70000000000000900000000000000ff7f0000000000000000000000000000000000000000000004180000000000000000000000000000ffffffff0000000081000000000000000600000000000000000000000000000000000000000000000400000000000000000000000000000002000000000000000500000000000000ff7fffffffffffff0000000000000000000000000000000004040000000000000000000000000000"]) r6 = creat(&(0x7f00000000c0)='./file0\x00', 0x0) openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000100)='/group.stat\x00', 0x2761, 0x0) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000080), 0xffffffffffffffff) getpid() fallocate(r0, 0x0, 0x0, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x2f, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) memfd_create(&(0x7f0000000080)='!proccgroup\x00', 0x0) ioctl$sock_inet_SIOCSIFPFLAGS(0xffffffffffffffff, 0x8934, &(0x7f0000000400)={'veth0_to_bridge\x00', 0x100}) accept(r6, &(0x7f0000000580)=@alg, &(0x7f0000000600)=0x80) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x2400, 0x8000) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000008c0)={0x2c, 0x0, &(0x7f0000000780)=[@acquire_done={0x40106309, r5, 0x2}, @clear_death={0x400c630f, 0x1, 0x3}, @release={0x40046306, 0x2}], 0xc1, 0x0, &(0x7f00000007c0)="859547f83b9b058a973a491d7e6378544744f2b56b02270a2f78214a936e9afb25cd94695643af6563f86771aa9621b9f30f2ca538b018247a633c28ee01e03b4639679311117971e60dc1538f34e961ae301463172c41754be988f6beb0ce4d83c69f86c236d29520e6cdaf5dbb60404c66d63315ff287deac8632781d0197ef1f81314da0a1ed90b681842cf85a41b496ce0a7a6f5aa4b9b23483eea8861be89b3398c6aec3349174f9cdc9de34df361ac9bf7afd8566849487c3c0a1e3aaacd"}) 04:02:32 executing program 4: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) recvmsg(0xffffffffffffffff, &(0x7f00000036c0)={&(0x7f0000000180)=@can, 0xfd28, &(0x7f00000035c0), 0x0, &(0x7f0000003680)=""/41, 0x29}, 0x0) bind$alg(r0, &(0x7f0000001300)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb(blowfish)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000ff8000)="0a0775b0", 0x4) r1 = accept$alg(r0, 0x0, 0x0) sendmmsg$alg(r1, &(0x7f0000003e80)=[{0x0, 0x0, &(0x7f0000002a80), 0x167, &(0x7f0000000100)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x0) recvmsg(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)=[{&(0x7f0000000200)=""/4096, 0x1000}], 0x1, &(0x7f0000fb3fa9)=""/87, 0x57, 0x700}, 0x0) 04:02:32 executing program 1: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) recvmsg(0xffffffffffffffff, &(0x7f00000036c0)={&(0x7f0000000180)=@can, 0xfd28, &(0x7f00000035c0), 0x0, &(0x7f0000003680)=""/41, 0x29}, 0x0) bind$alg(r0, &(0x7f0000001300)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb(blowfish)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000ff8000)="0a0775b0", 0x4) r1 = accept$alg(r0, 0x0, 0x0) sendmmsg$alg(r1, &(0x7f0000003e80)=[{0x0, 0x0, &(0x7f0000002a80), 0x167, &(0x7f0000000100)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x0) recvmsg(r1, &(0x7f0000000000)={&(0x7f0000f7ffa8)=@alg, 0x80, &(0x7f0000000140)=[{&(0x7f0000000200)=""/4096, 0x1000}], 0x1, 0x0, 0x0, 0x0}, 0x0) [ 667.002238] binder: release 23537:23539 transaction 436 out, still active [ 667.026633] binder: unexpected work type, 4, not freed [ 667.044556] binder: undelivered TRANSACTION_COMPLETE [ 667.099207] binder: BINDER_SET_CONTEXT_MGR already set [ 667.111408] binder: 23589:23591 ioctl 40046207 0 returned -16 [ 667.172852] binder: 23589:23592 BC_INCREFS_DONE node 443 has no pending increfs request [ 667.183747] binder: 23589:23592 BC_ACQUIRE_DONE node 443 has no pending acquire request [ 667.230082] binder: 23589:23594 BC_ACQUIRE_DONE u0000000000000000 no match [ 667.237328] binder: 23589:23594 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 04:02:33 executing program 5: r0 = socket$inet6(0xa, 0x2, 0x0) r1 = syz_open_dev$mice(&(0x7f00000002c0)='/dev/input/mice\x00', 0x0, 0x0) ioctl$PPPOEIOCDFWD(r1, 0xb101, 0x0) syz_genetlink_get_family_id$nbd(&(0x7f0000000480)='nbd\x00') getsockopt$inet6_IPV6_XFRM_POLICY(r0, 0x29, 0x23, &(0x7f0000000340)={{{@in=@local, @in=@loopback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@local}, 0x0, @in=@remote}}, &(0x7f0000000140)=0xe8) connect$can_bcm(0xffffffffffffffff, &(0x7f00000001c0), 0x10) bind$inet6(r0, &(0x7f0000000040)={0xa, 0x4e24}, 0x1c) lsetxattr$security_ima(&(0x7f0000000280)='./file0\x00', &(0x7f0000000440)='security.ima\x00', 0x0, 0x0, 0x1) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clock_gettime(0x0, &(0x7f0000000100)={0x0, 0x0}) r4 = openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) bind(r4, &(0x7f0000000580)=@can={0x1d, r2}, 0x80) clock_gettime(0x3, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) ppoll(&(0x7f0000000000)=[{r0, 0x41a}], 0x1, &(0x7f0000000200)={0x0, r3+30000000}, &(0x7f0000000240), 0x8) getsockopt$inet_sctp_SCTP_RESET_STREAMS(r5, 0x84, 0x77, &(0x7f00000000c0)=ANY=[@ANYRES32=0x0, @ANYBLOB="0000ebff0000ffff810009000000fcff000000000000"], &(0x7f0000000180)=0x1a) setsockopt$inet_sctp_SCTP_ADD_STREAMS(r5, 0x84, 0x79, &(0x7f0000000500)={r6, 0x6, 0x6}, 0x8) connect$inet6(r0, &(0x7f0000000080)={0xa, 0x4e24, 0x0, @ipv4={[], [], @loopback}}, 0x1c) readv(0xffffffffffffffff, 0x0, 0x0) sendmmsg(r0, &(0x7f00000092c0), 0x4ff, 0x0) connect$pptp(r1, &(0x7f00000004c0)={0x18, 0x2, {0xfffffffffffffffc, @multicast1}}, 0x1e) 04:02:33 executing program 3: r0 = perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) setxattr$security_smack_entry(&(0x7f0000000380)='./file0\x00', &(0x7f0000000480)='security.SMACK64IPIN\x00', &(0x7f0000000540)='^vboxnet1^\x00', 0xb, 0x1) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r1, &(0x7f0000000040), 0x0}, 0x20) unlink(&(0x7f0000000900)='./file0/file0\x00') r2 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r3 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r3, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, &(0x7f00000006c0)={0x0}) ioctl$BINDER_GET_NODE_DEBUG_INFO(r2, 0xc018620b, &(0x7f0000000640)={r4}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f00000000c0)=[@enter_looper], 0x0, 0x0, 0x0}) ioctl$BINDER_SET_CONTEXT_MGR(r3, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x1) prctl$PR_SET_NAME(0xf, &(0x7f00000004c0)='/group.stat\x00') ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, &(0x7f0000000780)}) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f0000000680)}) ioctl$FS_IOC_FIEMAP(r3, 0xc020660b, &(0x7f0000000b80)=ANY=[@ANYBLOB="0000010000000000200000000000000005000000010000000a00000000000000ff030000000000001a0a000000000000050000000000000000000000000000000000000000000000080000000000000000000000000000000800000000000000ffff0000000000000100008000000000000000000000000000000000000000000000000000000000000000000000000008000000000000003f0000000000000008000000000000000000000000000000000000000000800800000000000000000000000000000200000000000000000400000000000000000000010000000000000000000000000000000000000002110000000000000000000000000000cc0000000000000000000000000000001b0000000000000000000000000000000000000000000000841400000000000000000000000000000300000000000000feffffffffffffff000000000000000000000000000000000000000000000000020000000000000000000000000000000600000000000000ff01000000000000040000000000000000000000000000000000000000000000000400000000000000000000000000007be70000000000000900000000000000ff7f0000000000000000000000000000000000000000000004180000000000000000000000000000ffffffff0000000081000000000000000600000000000000000000000000000000000000000000000400000000000000000000000000000002000000000000000500000000000000ff7fffffffffffff0000000000000000000000000000000004040000000000000000000000000000"]) r6 = creat(&(0x7f00000000c0)='./file0\x00', 0x0) openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000100)='/group.stat\x00', 0x2761, 0x0) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000080), 0xffffffffffffffff) getpid() fallocate(r0, 0x0, 0x0, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x2f, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) memfd_create(&(0x7f0000000080)='!proccgroup\x00', 0x0) ioctl$sock_inet_SIOCSIFPFLAGS(0xffffffffffffffff, 0x8934, &(0x7f0000000400)={'veth0_to_bridge\x00', 0x100}) accept(r6, &(0x7f0000000580)=@alg, &(0x7f0000000600)=0x80) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x2400, 0x8000) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000008c0)={0x2c, 0x0, &(0x7f0000000780)=[@acquire_done={0x40106309, r5, 0x2}, @clear_death={0x400c630f, 0x1, 0x3}, @release={0x40046306, 0x2}], 0xc1, 0x0, &(0x7f00000007c0)="859547f83b9b058a973a491d7e6378544744f2b56b02270a2f78214a936e9afb25cd94695643af6563f86771aa9621b9f30f2ca538b018247a633c28ee01e03b4639679311117971e60dc1538f34e961ae301463172c41754be988f6beb0ce4d83c69f86c236d29520e6cdaf5dbb60404c66d63315ff287deac8632781d0197ef1f81314da0a1ed90b681842cf85a41b496ce0a7a6f5aa4b9b23483eea8861be89b3398c6aec3349174f9cdc9de34df361ac9bf7afd8566849487c3c0a1e3aaacd"}) 04:02:33 executing program 2: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000440)=@updpolicy={0xb8, 0x19, 0x523, 0x0, 0x0, {{@in=@multicast2, @in6=@empty={[0x0, 0x0, 0x0, 0x0, 0x80ffffff00000000]}, 0x0, 0x0, 0x0, 0x0, 0xa}}}, 0xb8}}, 0x0) 04:02:33 executing program 4: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) recvmsg(0xffffffffffffffff, &(0x7f00000036c0)={&(0x7f0000000180)=@can, 0xfd28, &(0x7f00000035c0), 0x0, &(0x7f0000003680)=""/41, 0x29}, 0x0) bind$alg(r0, &(0x7f0000001300)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb(blowfish)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000ff8000)="0a0775b0", 0x4) r1 = accept$alg(r0, 0x0, 0x0) sendmmsg$alg(r1, &(0x7f0000003e80)=[{0x0, 0x0, &(0x7f0000002a80), 0x167, &(0x7f0000000100)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x0) recvmsg(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)=[{&(0x7f0000000200)=""/4096, 0x1000}], 0x1, &(0x7f0000fb3fa9)=""/87, 0x57, 0x1f00}, 0x0) 04:02:33 executing program 1: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) recvmsg(0xffffffffffffffff, &(0x7f00000036c0)={&(0x7f0000000180)=@can, 0xfd28, &(0x7f00000035c0), 0x0, &(0x7f0000003680)=""/41, 0x29}, 0x0) bind$alg(r0, &(0x7f0000001300)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb(blowfish)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000ff8000)="0a0775b0", 0x4) r1 = accept$alg(r0, 0x0, 0x0) sendmmsg$alg(r1, &(0x7f0000003e80)=[{0x0, 0x0, &(0x7f0000002a80), 0x167, &(0x7f0000000100)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x0) recvmsg(r1, &(0x7f0000000000)={&(0x7f0000f7ffa8)=@alg, 0x80, &(0x7f0000000140)=[{&(0x7f0000000200)=""/4096, 0x1000}], 0x1, 0x0, 0x0, 0x0}, 0x0) [ 667.404840] binder: release 23550:23557 transaction 439 out, still active [ 667.416559] binder: unexpected work type, 4, not freed [ 667.426980] binder: undelivered TRANSACTION_COMPLETE 04:02:33 executing program 2: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000440)=@updpolicy={0xb8, 0x19, 0x523, 0x0, 0x0, {{@in=@multicast2, @in6=@empty={[0x0, 0x0, 0x0, 0x0, 0x9effffff00000000]}, 0x0, 0x0, 0x0, 0x0, 0xa}}}, 0xb8}}, 0x0) 04:02:33 executing program 4: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) recvmsg(0xffffffffffffffff, &(0x7f00000036c0)={&(0x7f0000000180)=@can, 0xfd28, &(0x7f00000035c0), 0x0, &(0x7f0000003680)=""/41, 0x29}, 0x0) bind$alg(r0, &(0x7f0000001300)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb(blowfish)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000ff8000)="0a0775b0", 0x4) r1 = accept$alg(r0, 0x0, 0x0) sendmmsg$alg(r1, &(0x7f0000003e80)=[{0x0, 0x0, &(0x7f0000002a80), 0x167, &(0x7f0000000100)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x0) recvmsg(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)=[{&(0x7f0000000200)=""/4096, 0x1000}], 0x1, &(0x7f0000fb3fa9)=""/87, 0x57, 0x100000}, 0x0) 04:02:33 executing program 1: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) recvmsg(0xffffffffffffffff, &(0x7f00000036c0)={&(0x7f0000000180)=@can, 0xfd28, &(0x7f00000035c0), 0x0, &(0x7f0000003680)=""/41, 0x29}, 0x0) bind$alg(r0, &(0x7f0000001300)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb(blowfish)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000ff8000)="0a0775b0", 0x4) r1 = accept$alg(r0, 0x0, 0x0) sendmmsg$alg(r1, &(0x7f0000003e80)=[{0x0, 0x0, &(0x7f0000002a80), 0x167, &(0x7f0000000100)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x0) recvmsg(r1, &(0x7f0000000000)={&(0x7f0000f7ffa8)=@alg, 0x80, &(0x7f0000000140)=[{&(0x7f0000000200)=""/4096, 0x1000}], 0x1, 0x0, 0x0, 0x0}, 0x0) [ 667.580509] binder: BINDER_SET_CONTEXT_MGR already set [ 667.607300] binder: 23608:23609 ioctl 40046207 0 returned -16 04:02:33 executing program 2: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000440)=@updpolicy={0xb8, 0x19, 0x523, 0x0, 0x0, {{@in=@multicast2, @in6=@empty={[0x0, 0x0, 0x0, 0x0, 0xf0ffffff00000000]}, 0x0, 0x0, 0x0, 0x0, 0xa}}}, 0xb8}}, 0x0) [ 667.665650] binder: 23608:23620 BC_INCREFS_DONE node 446 has no pending increfs request [ 667.720707] binder: 23608:23620 BC_ACQUIRE_DONE node 446 has no pending acquire request [ 667.745392] binder: 23608:23623 BC_ACQUIRE_DONE u0000000000000000 no match [ 667.771562] binder: 23608:23623 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 04:02:33 executing program 0: r0 = perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) setxattr$security_smack_entry(&(0x7f0000000380)='./file0\x00', &(0x7f0000000480)='security.SMACK64IPIN\x00', &(0x7f0000000540)='^vboxnet1^\x00', 0xb, 0x1) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r1, &(0x7f0000000040), 0x0}, 0x20) unlink(&(0x7f0000000900)='./file0/file0\x00') r2 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r3 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r3, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, &(0x7f00000006c0)={0x0}) ioctl$BINDER_GET_NODE_DEBUG_INFO(r2, 0xc018620b, &(0x7f0000000640)={r4}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f00000000c0)=[@enter_looper], 0x0, 0x0, &(0x7f0000000700)}) ioctl$BINDER_SET_CONTEXT_MGR(r3, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x1) prctl$PR_SET_NAME(0xf, &(0x7f00000004c0)='/group.stat\x00') ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, &(0x7f0000000780)}) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f0000000680)}) ioctl$FS_IOC_FIEMAP(r3, 0xc020660b, &(0x7f0000000b80)=ANY=[@ANYBLOB="0000010000000000200000000000000005000000010000000a00000000000000ff030000000000001a0a000000000000050000000000000000000000000000000000000000000000080000000000000000000000000000000800000000000000ffff0000000000000100008000000000000000000000000000000000000000000000000000000000000000000000000008000000000000003f0000000000000008000000000000000000000000000000000000000000800800000000000000000000000000000200000000000000000400000000000000000000010000000000000000000000000000000000000002110000000000000000000000000000cc0000000000000000000000000000001b0000000000000000000000000000000000000000000000841400000000000000000000000000000300000000000000feffffffffffffff000000000000000000000000000000000000000000000000020000000000000000000000000000000600000000000000ff01000000000000040000000000000000000000000000000000000000000000000400000000000000000000000000007be70000000000000900000000000000ff7f0000000000000000000000000000000000000000000004180000000000000000000000000000ffffffff0000000081000000000000000600000000000000000000000000000000000000000000000400000000000000000000000000000002000000000000000500000000000000ff7fffffffffffff0000000000000000000000000000000004040000000000000000000000000000"]) r6 = creat(&(0x7f00000000c0)='./file0\x00', 0x0) openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000100)='/group.stat\x00', 0x2761, 0x0) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000080), 0xffffffffffffffff) getpid() fallocate(r0, 0x0, 0x0, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x2f, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) memfd_create(&(0x7f0000000080)='!proccgroup\x00', 0x0) ioctl$sock_inet_SIOCSIFPFLAGS(0xffffffffffffffff, 0x8934, &(0x7f0000000400)={'veth0_to_bridge\x00', 0x100}) accept(r6, &(0x7f0000000580)=@alg, &(0x7f0000000600)=0x80) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x2400, 0x8000) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000008c0)={0x2c, 0x0, &(0x7f0000000780)=[@acquire_done={0x40106309, r5, 0x2}, @clear_death={0x400c630f, 0x1, 0x3}, @release={0x40046306, 0x2}], 0xc1, 0x0, &(0x7f00000007c0)="859547f83b9b058a973a491d7e6378544744f2b56b02270a2f78214a936e9afb25cd94695643af6563f86771aa9621b9f30f2ca538b018247a633c28ee01e03b4639679311117971e60dc1538f34e961ae301463172c41754be988f6beb0ce4d83c69f86c236d29520e6cdaf5dbb60404c66d63315ff287deac8632781d0197ef1f81314da0a1ed90b681842cf85a41b496ce0a7a6f5aa4b9b23483eea8861be89b3398c6aec3349174f9cdc9de34df361ac9bf7afd8566849487c3c0a1e3aaacd"}) 04:02:33 executing program 4: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) recvmsg(0xffffffffffffffff, &(0x7f00000036c0)={&(0x7f0000000180)=@can, 0xfd28, &(0x7f00000035c0), 0x0, &(0x7f0000003680)=""/41, 0x29}, 0x0) bind$alg(r0, &(0x7f0000001300)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb(blowfish)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000ff8000)="0a0775b0", 0x4) r1 = accept$alg(r0, 0x0, 0x0) sendmmsg$alg(r1, &(0x7f0000003e80)=[{0x0, 0x0, &(0x7f0000002a80), 0x167, &(0x7f0000000100)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x0) recvmsg(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)=[{&(0x7f0000000200)=""/4096, 0x1000}], 0x1, &(0x7f0000fb3fa9)=""/87, 0x57, 0x7000000}, 0x0) 04:02:33 executing program 1: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) recvmsg(0xffffffffffffffff, &(0x7f00000036c0)={&(0x7f0000000180)=@can, 0xfd28, &(0x7f00000035c0), 0x0, &(0x7f0000003680)=""/41, 0x29}, 0x0) bind$alg(r0, &(0x7f0000001300)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb(blowfish)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000ff8000)="0a0775b0", 0x4) r1 = accept$alg(r0, 0x0, 0x0) sendmmsg$alg(r1, &(0x7f0000003e80)=[{0x0, 0x0, &(0x7f0000002a80), 0x167, &(0x7f0000000100)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x0) recvmsg(r1, &(0x7f0000000000)={&(0x7f0000f7ffa8)=@alg, 0x80, &(0x7f0000000140)=[{&(0x7f0000000200)=""/4096, 0x1000}], 0x1, 0x0, 0x0, 0x0}, 0x0) [ 667.873320] binder: release 23589:23591 transaction 442 out, still active [ 667.910143] binder: unexpected work type, 4, not freed [ 667.942504] binder: undelivered TRANSACTION_COMPLETE 04:02:33 executing program 2: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000440)=@updpolicy={0xb8, 0x19, 0x523, 0x0, 0x0, {{@in=@multicast2, @in6=@empty={[0x0, 0x0, 0x0, 0x0, 0xfcffffff00000000]}, 0x0, 0x0, 0x0, 0x0, 0xa}}}, 0xb8}}, 0x0) [ 667.970245] binder: BINDER_SET_CONTEXT_MGR already set [ 667.987942] binder: 23632:23633 ioctl 40046207 0 returned -16 [ 668.043594] binder: 23632:23639 BC_INCREFS_DONE node 449 has no pending increfs request [ 668.060921] binder: 23632:23639 BC_ACQUIRE_DONE node 449 has no pending acquire request [ 668.070071] binder: 23632:23640 BC_ACQUIRE_DONE u0000000000000000 no match [ 668.081050] binder: 23632:23640 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 04:02:34 executing program 3: r0 = perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) setxattr$security_smack_entry(&(0x7f0000000380)='./file0\x00', &(0x7f0000000480)='security.SMACK64IPIN\x00', &(0x7f0000000540)='^vboxnet1^\x00', 0xb, 0x1) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r1, &(0x7f0000000040), 0x0}, 0x20) unlink(&(0x7f0000000900)='./file0/file0\x00') r2 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r3 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r3, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, &(0x7f00000006c0)={0x0}) ioctl$BINDER_GET_NODE_DEBUG_INFO(r2, 0xc018620b, &(0x7f0000000640)={r4}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f00000000c0)=[@enter_looper], 0x0, 0x0, &(0x7f0000000700)}) ioctl$BINDER_SET_CONTEXT_MGR(r3, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x1) prctl$PR_SET_NAME(0xf, &(0x7f00000004c0)='/group.stat\x00') ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, &(0x7f0000000780)}) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f0000000680)}) ioctl$FS_IOC_FIEMAP(r3, 0xc020660b, &(0x7f0000000b80)=ANY=[@ANYBLOB="0000010000000000200000000000000005000000010000000a00000000000000ff030000000000001a0a000000000000050000000000000000000000000000000000000000000000080000000000000000000000000000000800000000000000ffff0000000000000100008000000000000000000000000000000000000000000000000000000000000000000000000008000000000000003f0000000000000008000000000000000000000000000000000000000000800800000000000000000000000000000200000000000000000400000000000000000000010000000000000000000000000000000000000002110000000000000000000000000000cc0000000000000000000000000000001b0000000000000000000000000000000000000000000000841400000000000000000000000000000300000000000000feffffffffffffff000000000000000000000000000000000000000000000000020000000000000000000000000000000600000000000000ff01000000000000040000000000000000000000000000000000000000000000000400000000000000000000000000007be70000000000000900000000000000ff7f0000000000000000000000000000000000000000000004180000000000000000000000000000ffffffff0000000081000000000000000600000000000000000000000000000000000000000000000400000000000000000000000000000002000000000000000500000000000000ff7fffffffffffff0000000000000000000000000000000004040000000000000000000000000000"]) r6 = creat(&(0x7f00000000c0)='./file0\x00', 0x0) openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000100)='/group.stat\x00', 0x2761, 0x0) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000080), 0xffffffffffffffff) getpid() fallocate(r0, 0x0, 0x0, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x2f, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) memfd_create(&(0x7f0000000080)='!proccgroup\x00', 0x0) ioctl$sock_inet_SIOCSIFPFLAGS(0xffffffffffffffff, 0x8934, &(0x7f0000000400)={'veth0_to_bridge\x00', 0x100}) accept(r6, &(0x7f0000000580)=@alg, &(0x7f0000000600)=0x80) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x2400, 0x8000) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000008c0)={0x2c, 0x0, &(0x7f0000000780)=[@acquire_done={0x40106309, r5, 0x2}, @clear_death={0x400c630f, 0x1, 0x3}, @release={0x40046306, 0x2}], 0xc1, 0x0, &(0x7f00000007c0)="859547f83b9b058a973a491d7e6378544744f2b56b02270a2f78214a936e9afb25cd94695643af6563f86771aa9621b9f30f2ca538b018247a633c28ee01e03b4639679311117971e60dc1538f34e961ae301463172c41754be988f6beb0ce4d83c69f86c236d29520e6cdaf5dbb60404c66d63315ff287deac8632781d0197ef1f81314da0a1ed90b681842cf85a41b496ce0a7a6f5aa4b9b23483eea8861be89b3398c6aec3349174f9cdc9de34df361ac9bf7afd8566849487c3c0a1e3aaacd"}) 04:02:34 executing program 4: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) recvmsg(0xffffffffffffffff, &(0x7f00000036c0)={&(0x7f0000000180)=@can, 0xfd28, &(0x7f00000035c0), 0x0, &(0x7f0000003680)=""/41, 0x29}, 0x0) bind$alg(r0, &(0x7f0000001300)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb(blowfish)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000ff8000)="0a0775b0", 0x4) r1 = accept$alg(r0, 0x0, 0x0) sendmmsg$alg(r1, &(0x7f0000003e80)=[{0x0, 0x0, &(0x7f0000002a80), 0x167, &(0x7f0000000100)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x0) recvmsg(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)=[{&(0x7f0000000200)=""/4096, 0x1000}], 0x1, &(0x7f0000fb3fa9)=""/87, 0x57, 0x8000000}, 0x0) 04:02:34 executing program 5: r0 = socket$inet6(0xa, 0x2, 0x0) r1 = syz_open_dev$mice(&(0x7f00000002c0)='/dev/input/mice\x00', 0x0, 0x0) ioctl$PPPOEIOCDFWD(r1, 0xb101, 0x0) syz_genetlink_get_family_id$nbd(&(0x7f0000000480)='nbd\x00') getsockopt$inet6_IPV6_XFRM_POLICY(r0, 0x29, 0x23, &(0x7f0000000340)={{{@in=@local, @in=@loopback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@local}, 0x0, @in=@remote}}, &(0x7f0000000140)=0xe8) connect$can_bcm(0xffffffffffffffff, &(0x7f00000001c0), 0x10) r3 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000680)='IPVS\x00') sendmsg$IPVS_CMD_DEL_DEST(r1, &(0x7f00000007c0)={&(0x7f0000000640)={0x10, 0x0, 0x0, 0x8336b8d5839dbb66}, 0xc, &(0x7f0000000780)={&(0x7f00000006c0)={0xb4, r3, 0x8, 0x70bd2a, 0x25dfdbff, {}, [@IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x8}, @IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0x7}, @IPVS_CMD_ATTR_DAEMON={0x54, 0x3, [@IPVS_DAEMON_ATTR_SYNC_MAXLEN={0x8}, @IPVS_DAEMON_ATTR_MCAST_GROUP6={0x14, 0x6, @mcast1}, @IPVS_DAEMON_ATTR_MCAST_GROUP6={0x14, 0x6, @loopback}, @IPVS_DAEMON_ATTR_STATE={0x8, 0x1, 0x3}, @IPVS_DAEMON_ATTR_SYNC_ID={0x8, 0x3, 0x2}, @IPVS_DAEMON_ATTR_STATE={0x8, 0x1, 0x2}, @IPVS_DAEMON_ATTR_SYNC_MAXLEN={0x8, 0x4, 0x7ff}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5, 0x6}, @IPVS_CMD_ATTR_DAEMON={0x34, 0x3, [@IPVS_DAEMON_ATTR_MCAST_GROUP6={0x14, 0x6, @local}, @IPVS_DAEMON_ATTR_MCAST_IFN={0x14, 0x2, 'veth0_to_hsr\x00'}, @IPVS_DAEMON_ATTR_MCAST_PORT={0x8, 0x7, 0x4e21}]}]}, 0xb4}, 0x1, 0x0, 0x0, 0x40001}, 0x20000000) bind$inet6(r0, &(0x7f0000000040)={0xa, 0x4e24}, 0x1c) lsetxattr$security_ima(&(0x7f0000000280)='./file0\x00', &(0x7f0000000440)='security.ima\x00', 0x0, 0x0, 0x1) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clock_gettime(0x0, &(0x7f0000000100)={0x0, 0x0}) r5 = openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) bind(r5, &(0x7f0000000580)=@can={0x1d, r2}, 0x80) clock_gettime(0x3, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff}) ppoll(&(0x7f0000000000)=[{r0, 0x41a}], 0x1, &(0x7f0000000200)={0x0, r4+30000000}, &(0x7f0000000240), 0x8) getsockopt$inet_sctp6_SCTP_PEER_AUTH_CHUNKS(r5, 0x84, 0x1a, &(0x7f00000004c0)=ANY=[@ANYRES32=0x0, @ANYBLOB="4c0000004b1d8bb5ecf92063026216fea95218874f967948e690f0cd605c1f8dc9ff70190d4e9fb7c780fa158514d8ecee645414b0c4e1081caef63a2e1f40a0716da698ecb91e6131b5095f721542b8"], &(0x7f00000000c0)=0x54) setsockopt$inet_sctp6_SCTP_PR_SUPPORTED(r5, 0x84, 0x71, &(0x7f0000000540)={r7, 0x8}, 0x8) sysinfo(&(0x7f0000000600)=""/45) connect$inet6(r0, &(0x7f0000000080)={0xa, 0x4e24, 0x0, @ipv4={[], [], @loopback}}, 0x1c) readv(0xffffffffffffffff, 0x0, 0x0) sendmmsg(r0, &(0x7f00000092c0), 0x4ff, 0x0) connect$pptp(r6, &(0x7f0000000180)={0x18, 0x2, {0x0, @empty}}, 0x1e) 04:02:34 executing program 1: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) recvmsg(0xffffffffffffffff, &(0x7f00000036c0)={&(0x7f0000000180)=@can, 0xfd28, &(0x7f00000035c0), 0x0, &(0x7f0000003680)=""/41, 0x29}, 0x0) bind$alg(r0, &(0x7f0000001300)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb(blowfish)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000ff8000)="0a0775b0", 0x4) r1 = accept$alg(r0, 0x0, 0x0) sendmmsg$alg(r1, &(0x7f0000003e80)=[{0x0, 0x0, &(0x7f0000002a80), 0x167, &(0x7f0000000100)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x0) recvmsg(r1, &(0x7f0000000000)={&(0x7f0000f7ffa8)=@alg, 0x80, &(0x7f0000000140)=[{&(0x7f0000000200)=""/4096, 0x1000}], 0x1, 0x0, 0x0, 0x0}, 0x0) 04:02:34 executing program 2: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000440)=@updpolicy={0xb8, 0x19, 0x523, 0x0, 0x0, {{@in=@multicast2, @in6=@empty={[0x0, 0x0, 0x0, 0x0, 0xffffff7f00000000]}, 0x0, 0x0, 0x0, 0x0, 0xa}}}, 0xb8}}, 0x0) [ 668.286313] binder: release 23608:23609 transaction 445 out, still active [ 668.318420] binder: unexpected work type, 4, not freed [ 668.352196] binder: undelivered TRANSACTION_COMPLETE 04:02:34 executing program 2: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000440)=@updpolicy={0xb8, 0x19, 0x523, 0x0, 0x0, {{@in=@multicast2, @in6=@empty={[0x0, 0x0, 0x0, 0x0, 0xfffffffffffff000]}, 0x0, 0x0, 0x0, 0x0, 0xa}}}, 0xb8}}, 0x0) 04:02:34 executing program 1: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) recvmsg(0xffffffffffffffff, &(0x7f00000036c0)={&(0x7f0000000180)=@can, 0xfd28, &(0x7f00000035c0), 0x0, &(0x7f0000003680)=""/41, 0x29}, 0x0) bind$alg(r0, &(0x7f0000001300)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb(blowfish)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000ff8000)="0a0775b0", 0x4) r1 = accept$alg(r0, 0x0, 0x0) sendmmsg$alg(r1, &(0x7f0000003e80)=[{0x0, 0x0, &(0x7f0000002a80), 0x167, &(0x7f0000000100)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x0) recvmsg(r1, &(0x7f0000000000)={&(0x7f0000f7ffa8)=@alg, 0x80, &(0x7f0000000140)=[{&(0x7f0000000200)=""/4096, 0x1000}], 0x1, 0x0, 0x0, 0x0}, 0x0) 04:02:34 executing program 4: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) recvmsg(0xffffffffffffffff, &(0x7f00000036c0)={&(0x7f0000000180)=@can, 0xfd28, &(0x7f00000035c0), 0x0, &(0x7f0000003680)=""/41, 0x29}, 0x0) bind$alg(r0, &(0x7f0000001300)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb(blowfish)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000ff8000)="0a0775b0", 0x4) r1 = accept$alg(r0, 0x0, 0x0) sendmmsg$alg(r1, &(0x7f0000003e80)=[{0x0, 0x0, &(0x7f0000002a80), 0x167, &(0x7f0000000100)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x0) recvmsg(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)=[{&(0x7f0000000200)=""/4096, 0x1000}], 0x1, &(0x7f0000fb3fa9)=""/87, 0x57, 0x10000000}, 0x0) [ 668.404961] binder: BINDER_SET_CONTEXT_MGR already set [ 668.417659] binder: 23647:23654 ioctl 40046207 0 returned -16 [ 668.497887] binder: 23647:23665 BC_INCREFS_DONE node 452 has no pending increfs request [ 668.537779] binder: 23647:23665 BC_ACQUIRE_DONE node 452 has no pending acquire request [ 668.563083] binder: 23647:23667 BC_ACQUIRE_DONE u0000000000000000 no match [ 668.578995] binder: 23647:23667 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 04:02:34 executing program 0: r0 = perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) setxattr$security_smack_entry(&(0x7f0000000380)='./file0\x00', &(0x7f0000000480)='security.SMACK64IPIN\x00', &(0x7f0000000540)='^vboxnet1^\x00', 0xb, 0x1) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r1, &(0x7f0000000040), 0x0}, 0x20) unlink(&(0x7f0000000900)='./file0/file0\x00') r2 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r3 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r3, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, &(0x7f00000006c0)={0x0}) ioctl$BINDER_GET_NODE_DEBUG_INFO(r2, 0xc018620b, &(0x7f0000000640)={r4}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f00000000c0)=[@enter_looper], 0x24, 0x0, &(0x7f0000000700)="2ba063fb309ec7fdbfb08e6e91baee7d7d4599fe14129a4d426834556ae420e087d59c0c"}) ioctl$BINDER_SET_CONTEXT_MGR(r3, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x1) prctl$PR_SET_NAME(0xf, &(0x7f00000004c0)='/group.stat\x00') ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, &(0x7f0000000780)}) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f0000000680)}) ioctl$FS_IOC_FIEMAP(r3, 0xc020660b, &(0x7f0000000b80)=ANY=[@ANYBLOB="0000010000000000200000000000000005000000010000000a00000000000000ff030000000000001a0a000000000000050000000000000000000000000000000000000000000000080000000000000000000000000000000800000000000000ffff0000000000000100008000000000000000000000000000000000000000000000000000000000000000000000000008000000000000003f0000000000000008000000000000000000000000000000000000000000800800000000000000000000000000000200000000000000000400000000000000000000010000000000000000000000000000000000000002110000000000000000000000000000cc0000000000000000000000000000001b0000000000000000000000000000000000000000000000841400000000000000000000000000000300000000000000feffffffffffffff000000000000000000000000000000000000000000000000020000000000000000000000000000000600000000000000ff01000000000000040000000000000000000000000000000000000000000000000400000000000000000000000000007be70000000000000900000000000000ff7f0000000000000000000000000000000000000000000004180000000000000000000000000000ffffffff0000000081000000000000000600000000000000000000000000000000000000000000000400000000000000000000000000000002000000000000000500000000000000ff7fffffffffffff0000000000000000000000000000000004040000000000000000000000000000"]) r6 = creat(&(0x7f00000000c0)='./file0\x00', 0x0) openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000100)='/group.stat\x00', 0x2761, 0x0) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000080), 0xffffffffffffffff) getpid() fallocate(r0, 0x0, 0x0, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x2f, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) memfd_create(&(0x7f0000000080)='!proccgroup\x00', 0x0) ioctl$sock_inet_SIOCSIFPFLAGS(0xffffffffffffffff, 0x8934, &(0x7f0000000400)={'veth0_to_bridge\x00', 0x100}) accept(r6, &(0x7f0000000580)=@alg, &(0x7f0000000600)=0x80) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x2400, 0x8000) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000008c0)={0x2c, 0x0, &(0x7f0000000780)=[@acquire_done={0x40106309, r5, 0x2}, @clear_death={0x400c630f, 0x1, 0x3}, @release={0x40046306, 0x2}], 0xc1, 0x0, &(0x7f00000007c0)="859547f83b9b058a973a491d7e6378544744f2b56b02270a2f78214a936e9afb25cd94695643af6563f86771aa9621b9f30f2ca538b018247a633c28ee01e03b4639679311117971e60dc1538f34e961ae301463172c41754be988f6beb0ce4d83c69f86c236d29520e6cdaf5dbb60404c66d63315ff287deac8632781d0197ef1f81314da0a1ed90b681842cf85a41b496ce0a7a6f5aa4b9b23483eea8861be89b3398c6aec3349174f9cdc9de34df361ac9bf7afd8566849487c3c0a1e3aaacd"}) 04:02:34 executing program 1: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) recvmsg(0xffffffffffffffff, &(0x7f00000036c0)={&(0x7f0000000180)=@can, 0xfd28, &(0x7f00000035c0), 0x0, &(0x7f0000003680)=""/41, 0x29}, 0x0) bind$alg(r0, &(0x7f0000001300)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb(blowfish)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000ff8000)="0a0775b0", 0x4) r1 = accept$alg(r0, 0x0, 0x0) sendmmsg$alg(r1, &(0x7f0000003e80)=[{0x0, 0x0, &(0x7f0000002a80), 0x167, &(0x7f0000000100)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x0) recvmsg(r1, &(0x7f0000000000)={&(0x7f0000f7ffa8)=@alg, 0x80, &(0x7f0000000140)=[{&(0x7f0000000200)=""/4096, 0x1000}], 0x1, 0x0, 0x0, 0x0}, 0x0) 04:02:34 executing program 2: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000440)=@updpolicy={0xb8, 0x19, 0x523, 0x0, 0x0, {{@in=@multicast2, @in6=@empty={[0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff]}, 0x0, 0x0, 0x0, 0x0, 0xa}}}, 0xb8}}, 0x0) 04:02:34 executing program 4: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) recvmsg(0xffffffffffffffff, &(0x7f00000036c0)={&(0x7f0000000180)=@can, 0xfd28, &(0x7f00000035c0), 0x0, &(0x7f0000003680)=""/41, 0x29}, 0x0) bind$alg(r0, &(0x7f0000001300)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb(blowfish)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000ff8000)="0a0775b0", 0x4) r1 = accept$alg(r0, 0x0, 0x0) sendmmsg$alg(r1, &(0x7f0000003e80)=[{0x0, 0x0, &(0x7f0000002a80), 0x167, &(0x7f0000000100)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x0) recvmsg(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)=[{&(0x7f0000000200)=""/4096, 0x1000}], 0x1, &(0x7f0000fb3fa9)=""/87, 0x57, 0x1f000000}, 0x0) [ 668.729226] binder: release 23632:23633 transaction 448 out, still active [ 668.775727] binder: unexpected work type, 4, not freed [ 668.802441] binder: undelivered TRANSACTION_COMPLETE [ 668.884380] net_ratelimit: 26 callbacks suppressed [ 668.884388] protocol 88fb is buggy, dev hsr_slave_0 [ 668.888475] binder: BINDER_SET_CONTEXT_MGR already set [ 668.889428] protocol 88fb is buggy, dev hsr_slave_1 [ 668.895470] binder: 23678:23684 ioctl 40046207 0 returned -16 [ 668.919798] binder_thread_write: 10 callbacks suppressed [ 668.919812] binder: 23678:23684 Release 1 refcount change on invalid ref 1 ret -22 [ 668.964334] protocol 88fb is buggy, dev hsr_slave_0 [ 668.969490] protocol 88fb is buggy, dev hsr_slave_1 [ 668.974687] protocol 88fb is buggy, dev hsr_slave_0 [ 668.979742] protocol 88fb is buggy, dev hsr_slave_1 04:02:34 executing program 2: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000440)=@updpolicy={0xb8, 0x19, 0x523, 0x0, 0x0, {{@in=@multicast2, @in6=@empty={[0x0, 0x0, 0x0, 0x0, 0x0, 0x2]}, 0x0, 0x0, 0x0, 0x0, 0xa}}}, 0xb8}}, 0x0) 04:02:34 executing program 3: r0 = socket$inet6(0xa, 0x2, 0x0) r1 = syz_open_dev$mice(&(0x7f00000002c0)='/dev/input/mice\x00', 0x0, 0x0) ioctl$PPPOEIOCDFWD(r1, 0xb101, 0x0) syz_genetlink_get_family_id$nbd(&(0x7f0000000480)='nbd\x00') getsockopt$inet6_IPV6_XFRM_POLICY(r0, 0x29, 0x23, &(0x7f0000000340)={{{@in=@local, @in=@loopback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@local}, 0x0, @in=@remote}}, &(0x7f0000000140)=0xe8) ioctl$PERF_EVENT_IOC_MODIFY_ATTRIBUTES(r1, 0x4008240b, &(0x7f0000000500)={0x4, 0x70, 0x0, 0x7, 0x6, 0x7ff, 0x0, 0xffffffff7fffffff, 0xc1, 0x7, 0x1000, 0x9, 0x4, 0xffffffffffffffff, 0x9, 0x7, 0x2a1, 0x80000001, 0x1f, 0x2, 0x9, 0x7, 0x7, 0xfffffffffffff40e, 0x5, 0x3, 0x6, 0x1, 0x1, 0x5, 0x9, 0x9, 0x3, 0x400000000000, 0x1, 0xff, 0x1, 0x2, 0x0, 0x5, 0x0, @perf_config_ext={0x7f4, 0x1f}, 0x12000, 0xfffffffffffffe01, 0x0, 0x1, 0x2, 0x4c, 0x9e5d}) connect$can_bcm(0xffffffffffffffff, &(0x7f00000001c0), 0x10) bind$inet6(r0, &(0x7f0000000040)={0xa, 0x4e24}, 0x1c) lsetxattr$security_ima(&(0x7f0000000280)='./file0\x00', &(0x7f0000000440)='security.ima\x00', 0x0, 0x0, 0x1) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clock_gettime(0x0, &(0x7f0000000100)={0x0, 0x0}) r4 = openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) bind(r4, &(0x7f0000000580)=@can={0x1d, r2}, 0x80) ioctl$PERF_EVENT_IOC_REFRESH(r1, 0x2402, 0x1f0) clock_gettime(0x3, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff}) ppoll(&(0x7f0000000000)=[{r0, 0x41a}], 0x1, &(0x7f0000000200)={0x0, r3+30000000}, &(0x7f0000000240), 0x8) connect$inet6(r0, &(0x7f0000000080)={0xa, 0x4e24, 0x0, @ipv4={[], [], @loopback}}, 0x1c) readv(0xffffffffffffffff, 0x0, 0x0) sendmmsg(r0, &(0x7f00000092c0), 0x4ff, 0x0) connect$pptp(r5, &(0x7f00000004c0)={0x18, 0x2, {0x0, @multicast1}}, 0x1e) 04:02:34 executing program 1: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) recvmsg(0xffffffffffffffff, &(0x7f00000036c0)={&(0x7f0000000180)=@can, 0xfd28, &(0x7f00000035c0), 0x0, &(0x7f0000003680)=""/41, 0x29}, 0x0) bind$alg(r0, &(0x7f0000001300)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb(blowfish)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000ff8000)="0a0775b0", 0x4) r1 = accept$alg(r0, 0x0, 0x0) sendmmsg$alg(r1, &(0x7f0000003e80)=[{0x0, 0x0, &(0x7f0000002a80), 0x167, &(0x7f0000000100)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x0) recvmsg(r1, &(0x7f0000000000)={&(0x7f0000f7ffa8)=@alg, 0x80, &(0x7f0000000140)=[{&(0x7f0000000200)=""/4096, 0x1000}], 0x1, 0x0, 0x0, 0x0}, 0x0) 04:02:34 executing program 4: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) recvmsg(0xffffffffffffffff, &(0x7f00000036c0)={&(0x7f0000000180)=@can, 0xfd28, &(0x7f00000035c0), 0x0, &(0x7f0000003680)=""/41, 0x29}, 0x0) bind$alg(r0, &(0x7f0000001300)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb(blowfish)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000ff8000)="0a0775b0", 0x4) r1 = accept$alg(r0, 0x0, 0x0) sendmmsg$alg(r1, &(0x7f0000003e80)=[{0x0, 0x0, &(0x7f0000002a80), 0x167, &(0x7f0000000100)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x0) recvmsg(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)=[{&(0x7f0000000200)=""/4096, 0x1000}], 0x1, &(0x7f0000fb3fa9)=""/87, 0x57, 0x8dffffff}, 0x0) 04:02:34 executing program 5: r0 = socket$inet6(0xa, 0x2, 0x0) r1 = syz_open_dev$mice(&(0x7f00000002c0)='/dev/input/mice\x00', 0x0, 0x0) write$uinput_user_dev(r1, &(0x7f0000000600)={'syz0\x00', {0x10000, 0x0, 0x9, 0x9}, 0x11, [0x0, 0x80000001, 0x0, 0x1, 0xffff, 0x3, 0x0, 0x13f7400000000, 0x3, 0x6, 0x400, 0x8000, 0x4, 0x40, 0x1, 0x7, 0x0, 0x5, 0x9, 0x8, 0x81, 0x79bc, 0x2, 0x4a6, 0x43, 0x724fda79, 0x1, 0x10000, 0x1, 0x3, 0x5, 0x3d09, 0x1ff, 0x1, 0xbd, 0x100, 0x0, 0xfffffffffffffffe, 0x161, 0x1, 0x81, 0x1, 0xcad, 0x6, 0x1, 0x6, 0xf3, 0x64, 0x100000000, 0x2c, 0x8001, 0x5, 0x1, 0x7f, 0x15, 0x9, 0x7, 0x13, 0xfff, 0xfc6, 0xfffffffffffffff7, 0x7fffffff, 0xfffffffffffff800, 0x4], [0x80000001, 0x1ff, 0x24000000000000, 0xa30c, 0x89, 0x1, 0x0, 0xc3d, 0x8, 0xffff, 0xffffffffffffff3f, 0x8, 0x8, 0x7, 0x4, 0x6, 0x65, 0x2, 0x0, 0x4, 0xfffffffffffffffe, 0x7f, 0x1, 0x3, 0x1, 0x9, 0x4535, 0x2, 0x0, 0x3, 0x7fffffff, 0x10000, 0x0, 0x9, 0x7fff, 0x100, 0xde8e, 0x5, 0x0, 0x2, 0x5, 0x1, 0x200, 0x9, 0x1, 0x2212, 0xb46, 0x7fffffff, 0x4, 0x926, 0x2f2, 0x1, 0x100000000, 0xffff, 0x81, 0x40, 0x5, 0x20, 0x0, 0x4, 0x0, 0x0, 0x5, 0x1], [0x5, 0x3, 0x5, 0x5, 0xffffffff, 0xfffffffffffffffc, 0x5df, 0x8, 0x9, 0x6, 0x562f, 0x0, 0x8, 0x5, 0xffffffffffff8000, 0x10000, 0x800, 0xd741, 0xa3a5, 0x3, 0x2, 0xef, 0xfffffffffffffffe, 0x0, 0x1, 0x5, 0x4, 0x4, 0x1, 0x1000, 0x10001, 0x4, 0x6bae29e1, 0x3, 0x100000000, 0x5, 0x0, 0x3, 0x5, 0x2, 0x6, 0x4, 0x0, 0x378, 0x2, 0xbb, 0x5, 0x9, 0x5, 0xffffffffffffff00, 0x4, 0x7, 0x1, 0x7, 0x87f3, 0x1, 0x0, 0x5, 0x800, 0xffffffffffff8000, 0x80000000, 0x1, 0x101, 0x6], [0x1, 0x10, 0x59, 0x8, 0x1, 0xfffffffffffffff8, 0x7d, 0xa9, 0x4, 0x2, 0x100, 0x9869, 0x101, 0x2, 0x7, 0x2, 0xffffffff, 0x10000, 0x0, 0x2, 0x5, 0x253f, 0xffff, 0x3ff, 0x5, 0x6, 0x20, 0xca7, 0x3f, 0xffffffffffff0001, 0x9d57, 0xe41d3f6, 0x8, 0xfffffffffffffeff, 0xfffffffffffffffa, 0x80, 0x24f, 0x0, 0x1, 0x0, 0x5, 0x4, 0x5, 0xffff, 0x1, 0x8, 0xfff, 0x5, 0x2, 0x8001, 0x44, 0x0, 0x7fff, 0x80000001, 0x7fff, 0x4, 0x9, 0x2, 0x8, 0x7fffffff, 0xc799, 0x7, 0x4, 0x232e]}, 0x45c) ioctl$PPPOEIOCDFWD(r1, 0xb101, 0x0) syz_genetlink_get_family_id$nbd(&(0x7f0000000480)='nbd\x00') getsockopt$inet6_IPV6_XFRM_POLICY(r0, 0x29, 0x23, &(0x7f0000000340)={{{@in=@local, @in=@loopback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@local}, 0x0, @in=@remote}}, &(0x7f0000000140)=0xe8) connect$can_bcm(0xffffffffffffffff, &(0x7f00000001c0), 0x10) bind$inet6(r0, &(0x7f0000000040)={0xa, 0x4e24}, 0x1c) fcntl$F_GET_RW_HINT(r1, 0x40b, &(0x7f00000000c0)) lsetxattr$security_ima(&(0x7f0000000280)='./file0\x00', &(0x7f0000000440)='security.ima\x00', 0x0, 0x0, 0x1) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clock_gettime(0x0, &(0x7f0000000100)={0x0, 0x0}) r4 = openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) bind(r4, &(0x7f0000000580)=@can={0x1d, r2}, 0x80) clock_gettime(0x3, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff}) ppoll(&(0x7f0000000000)=[{r0, 0x41a}], 0x1, &(0x7f0000000200)={0x0, r3+30000000}, &(0x7f0000000240), 0x8) connect$inet6(r0, &(0x7f0000000080)={0xa, 0x4e24, 0x0, @ipv4={[], [], @loopback}}, 0x1c) readv(r4, 0x0, 0xfffffffffffffca4) sendmmsg(r0, &(0x7f00000092c0), 0x4ff, 0x0) connect$pptp(r5, &(0x7f00000004c0)={0x18, 0x2, {0x0, @multicast1}}, 0x1e) 04:02:34 executing program 0: r0 = perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) setxattr$security_smack_entry(&(0x7f0000000380)='./file0\x00', &(0x7f0000000480)='security.SMACK64IPIN\x00', &(0x7f0000000540)='^vboxnet1^\x00', 0xb, 0x1) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r1, &(0x7f0000000040), 0x0}, 0x20) unlink(&(0x7f0000000900)='./file0/file0\x00') r2 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r3 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r3, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, &(0x7f00000006c0)={0x0}) ioctl$BINDER_GET_NODE_DEBUG_INFO(r2, 0xc018620b, &(0x7f0000000640)={r4}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f00000000c0)=[@enter_looper], 0x24, 0x0, &(0x7f0000000700)="2ba063fb309ec7fdbfb08e6e91baee7d7d4599fe14129a4d426834556ae420e087d59c0c"}) ioctl$BINDER_SET_CONTEXT_MGR(r3, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x1) prctl$PR_SET_NAME(0xf, &(0x7f00000004c0)='/group.stat\x00') ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, &(0x7f0000000780)}) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f0000000680)}) ioctl$FS_IOC_FIEMAP(r3, 0xc020660b, &(0x7f0000000b80)=ANY=[@ANYBLOB="0000010000000000200000000000000005000000010000000a00000000000000ff030000000000001a0a000000000000050000000000000000000000000000000000000000000000080000000000000000000000000000000800000000000000ffff0000000000000100008000000000000000000000000000000000000000000000000000000000000000000000000008000000000000003f0000000000000008000000000000000000000000000000000000000000800800000000000000000000000000000200000000000000000400000000000000000000010000000000000000000000000000000000000002110000000000000000000000000000cc0000000000000000000000000000001b0000000000000000000000000000000000000000000000841400000000000000000000000000000300000000000000feffffffffffffff000000000000000000000000000000000000000000000000020000000000000000000000000000000600000000000000ff01000000000000040000000000000000000000000000000000000000000000000400000000000000000000000000007be70000000000000900000000000000ff7f0000000000000000000000000000000000000000000004180000000000000000000000000000ffffffff0000000081000000000000000600000000000000000000000000000000000000000000000400000000000000000000000000000002000000000000000500000000000000ff7fffffffffffff0000000000000000000000000000000004040000000000000000000000000000"]) r6 = creat(&(0x7f00000000c0)='./file0\x00', 0x0) openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000100)='/group.stat\x00', 0x2761, 0x0) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000080), 0xffffffffffffffff) getpid() fallocate(r0, 0x0, 0x0, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x2f, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) memfd_create(&(0x7f0000000080)='!proccgroup\x00', 0x0) ioctl$sock_inet_SIOCSIFPFLAGS(0xffffffffffffffff, 0x8934, &(0x7f0000000400)={'veth0_to_bridge\x00', 0x100}) accept(r6, &(0x7f0000000580)=@alg, &(0x7f0000000600)=0x80) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x2400, 0x8000) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000008c0)={0x2c, 0x0, &(0x7f0000000780)=[@acquire_done={0x40106309, r5, 0x2}, @clear_death={0x400c630f, 0x1, 0x3}, @release={0x40046306, 0x2}], 0xc1, 0x0, &(0x7f00000007c0)="859547f83b9b058a973a491d7e6378544744f2b56b02270a2f78214a936e9afb25cd94695643af6563f86771aa9621b9f30f2ca538b018247a633c28ee01e03b4639679311117971e60dc1538f34e961ae301463172c41754be988f6beb0ce4d83c69f86c236d29520e6cdaf5dbb60404c66d63315ff287deac8632781d0197ef1f81314da0a1ed90b681842cf85a41b496ce0a7a6f5aa4b9b23483eea8861be89b3398c6aec3349174f9cdc9de34df361ac9bf7afd8566849487c3c0a1e3aaacd"}) [ 669.150360] binder: release 23647:23654 transaction 451 out, still active [ 669.157432] binder: unexpected work type, 4, not freed 04:02:34 executing program 2: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000440)=@updpolicy={0xb8, 0x19, 0x523, 0x0, 0x0, {{@in=@multicast2, @in6=@empty={[0x0, 0x0, 0x0, 0x0, 0x0, 0x3]}, 0x0, 0x0, 0x0, 0x0, 0xa}}}, 0xb8}}, 0x0) [ 669.216215] binder: undelivered TRANSACTION_COMPLETE 04:02:35 executing program 1: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) recvmsg(0xffffffffffffffff, &(0x7f00000036c0)={&(0x7f0000000180)=@can, 0xfd28, &(0x7f00000035c0), 0x0, &(0x7f0000003680)=""/41, 0x29}, 0x0) bind$alg(r0, &(0x7f0000001300)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb(blowfish)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000ff8000)="0a0775b0", 0x4) r1 = accept$alg(r0, 0x0, 0x0) sendmmsg$alg(r1, &(0x7f0000003e80)=[{0x0, 0x0, &(0x7f0000002a80), 0x167, &(0x7f0000000100)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x0) recvmsg(r1, &(0x7f0000000000)={&(0x7f0000f7ffa8)=@alg, 0x80, &(0x7f0000000140)=[{&(0x7f0000000200)=""/4096, 0x1000}], 0x1, 0x0, 0x0, 0x0}, 0x0) 04:02:35 executing program 4: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) recvmsg(0xffffffffffffffff, &(0x7f00000036c0)={&(0x7f0000000180)=@can, 0xfd28, &(0x7f00000035c0), 0x0, &(0x7f0000003680)=""/41, 0x29}, 0x0) bind$alg(r0, &(0x7f0000001300)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb(blowfish)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000ff8000)="0a0775b0", 0x4) r1 = accept$alg(r0, 0x0, 0x0) sendmmsg$alg(r1, &(0x7f0000003e80)=[{0x0, 0x0, &(0x7f0000002a80), 0x167, &(0x7f0000000100)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x0) recvmsg(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)=[{&(0x7f0000000200)=""/4096, 0x1000}], 0x1, &(0x7f0000fb3fa9)=""/87, 0x57, 0xf0ffffff}, 0x0) [ 669.310557] binder: BINDER_SET_CONTEXT_MGR already set [ 669.322801] binder: 23688:23705 ioctl 40046207 0 returned -16 [ 669.371951] binder: 23688:23705 Release 1 refcount change on invalid ref 1 ret -22 04:02:35 executing program 2: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000440)=@updpolicy={0xb8, 0x19, 0x523, 0x0, 0x0, {{@in=@multicast2, @in6=@empty={[0x0, 0x0, 0x0, 0x0, 0x0, 0x4]}, 0x0, 0x0, 0x0, 0x0, 0xa}}}, 0xb8}}, 0x0) 04:02:35 executing program 1: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) recvmsg(0xffffffffffffffff, &(0x7f00000036c0)={&(0x7f0000000180)=@can, 0xfd28, &(0x7f00000035c0), 0x0, &(0x7f0000003680)=""/41, 0x29}, 0x0) bind$alg(r0, &(0x7f0000001300)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb(blowfish)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000ff8000)="0a0775b0", 0x4) r1 = accept$alg(r0, 0x0, 0x0) sendmmsg$alg(r1, &(0x7f0000003e80)=[{0x0, 0x0, &(0x7f0000002a80), 0x167, &(0x7f0000000100)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x0) recvmsg(r1, &(0x7f0000000000)={&(0x7f0000f7ffa8)=@alg, 0x80, &(0x7f0000000140)=[{&(0x7f0000000200)=""/4096, 0x1000}], 0x1, 0x0, 0x0, 0x0}, 0x0) 04:02:35 executing program 4: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) recvmsg(0xffffffffffffffff, &(0x7f00000036c0)={&(0x7f0000000180)=@can, 0xfd28, &(0x7f00000035c0), 0x0, &(0x7f0000003680)=""/41, 0x29}, 0x0) bind$alg(r0, &(0x7f0000001300)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb(blowfish)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000ff8000)="0a0775b0", 0x4) r1 = accept$alg(r0, 0x0, 0x0) sendmmsg$alg(r1, &(0x7f0000003e80)=[{0x0, 0x0, &(0x7f0000002a80), 0x167, &(0x7f0000000100)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x0) recvmsg(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)=[{&(0x7f0000000200)=""/4096, 0x1000}], 0x1, &(0x7f0000fb3fa9)=""/87, 0x57, 0xffffff8d}, 0x0) [ 669.475137] binder: 23688:23713 BC_ACQUIRE_DONE u0000000000000000 no match [ 669.535978] binder: 23688:23713 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 04:02:35 executing program 4: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) recvmsg(0xffffffffffffffff, &(0x7f00000036c0)={&(0x7f0000000180)=@can, 0xfd28, &(0x7f00000035c0), 0x0, &(0x7f0000003680)=""/41, 0x29}, 0x0) bind$alg(r0, &(0x7f0000001300)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb(blowfish)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000ff8000)="0a0775b0", 0x4) r1 = accept$alg(r0, 0x0, 0x0) sendmmsg$alg(r1, &(0x7f0000003e80)=[{0x0, 0x0, &(0x7f0000002a80), 0x167, &(0x7f0000000100)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x0) recvmsg(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)=[{&(0x7f0000000200)=""/4096, 0x1000}], 0x1, &(0x7f0000fb3fa9)=""/87, 0x57, 0xfffffff0}, 0x0) [ 669.604331] binder: 23688:23713 Release 1 refcount change on invalid ref 2 ret -22 04:02:35 executing program 3: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) recvmsg(0xffffffffffffffff, &(0x7f00000036c0)={&(0x7f0000000180)=@can, 0xfd28, &(0x7f00000035c0), 0x0, &(0x7f0000003680)=""/41, 0x29}, 0x0) bind$alg(r0, &(0x7f0000001300)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb(blowfish)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000ff8000)="0a0775b0", 0x4) r1 = accept$alg(r0, 0x0, 0x0) sendmmsg$alg(r1, &(0x7f0000003e80)=[{0x0, 0x0, &(0x7f0000002a80), 0x167, &(0x7f0000000100)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x0) recvmsg(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)=[{&(0x7f0000000200)=""/4096, 0x1000}], 0x1, &(0x7f0000fb3fa9)=""/87, 0x57, 0xffffff8d}, 0x0) 04:02:35 executing program 1: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) recvmsg(0xffffffffffffffff, &(0x7f00000036c0)={&(0x7f0000000180)=@can, 0xfd28, &(0x7f00000035c0), 0x0, &(0x7f0000003680)=""/41, 0x29}, 0x0) bind$alg(r0, &(0x7f0000001300)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb(blowfish)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000ff8000)="0a0775b0", 0x4) r1 = accept$alg(r0, 0x0, 0x0) sendmmsg$alg(r1, &(0x7f0000003e80)=[{0x0, 0x0, &(0x7f0000002a80), 0x167, &(0x7f0000000100)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x0) recvmsg(r1, &(0x7f0000000000)={&(0x7f0000f7ffa8)=@alg, 0x80, &(0x7f0000000140)=[{&(0x7f0000000200)=""/4096, 0x1000}], 0x1, 0x0, 0x0, 0x0}, 0x0) 04:02:35 executing program 2: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000440)=@updpolicy={0xb8, 0x19, 0x523, 0x0, 0x0, {{@in=@multicast2, @in6=@empty={[0x0, 0x0, 0x0, 0x0, 0x0, 0x8]}, 0x0, 0x0, 0x0, 0x0, 0xa}}}, 0xb8}}, 0x0) [ 669.924413] protocol 88fb is buggy, dev hsr_slave_0 [ 669.929582] protocol 88fb is buggy, dev hsr_slave_1 [ 669.934762] protocol 88fb is buggy, dev hsr_slave_0 [ 669.939834] protocol 88fb is buggy, dev hsr_slave_1 [ 670.011063] binder: release 23688:23705 transaction 457 out, still active 04:02:35 executing program 5: r0 = socket$inet6(0xa, 0x2, 0x0) r1 = syz_open_dev$mice(&(0x7f00000002c0)='/dev/input/mice\x00', 0x0, 0x0) ioctl$PPPOEIOCDFWD(r1, 0xb101, 0x0) syz_genetlink_get_family_id$nbd(&(0x7f0000000480)='nbd\x00') getsockopt$inet6_IPV6_XFRM_POLICY(r0, 0x29, 0x23, &(0x7f0000000340)={{{@in=@local, @in=@loopback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@local}, 0x0, @in=@remote}}, &(0x7f0000000140)=0xe8) connect$can_bcm(0xffffffffffffffff, &(0x7f00000001c0), 0x10) bind$inet6(r0, &(0x7f0000000040)={0xa, 0x4e24}, 0x1c) lsetxattr$security_ima(&(0x7f0000000280)='./file0\x00', &(0x7f0000000440)='security.ima\x00', 0x0, 0x0, 0x1) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clock_gettime(0x0, &(0x7f0000000100)={0x0, 0x0}) r4 = openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) bind(r4, &(0x7f0000000580)=@can={0x1d, r2}, 0x80) clock_gettime(0x3, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff}) ppoll(&(0x7f0000000000)=[{r0, 0x41a}], 0x1, &(0x7f0000000200)={0x0, r3+30000000}, &(0x7f0000000240), 0x8) connect$inet6(r0, &(0x7f0000000080)={0xa, 0x4e24, 0x0, @ipv4={[], [], @loopback}}, 0x1c) readv(0xffffffffffffffff, 0x0, 0x0) sendmmsg(r0, &(0x7f00000092c0), 0x4ff, 0x0) connect$pptp(r5, &(0x7f00000004c0)={0x18, 0x2, {0x0, @multicast1}}, 0x1e) 04:02:35 executing program 2: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000440)=@updpolicy={0xb8, 0x19, 0x523, 0x0, 0x0, {{@in=@multicast2, @in6=@empty={[0x0, 0x0, 0x0, 0x0, 0x0, 0xa]}, 0x0, 0x0, 0x0, 0x0, 0xa}}}, 0xb8}}, 0x0) 04:02:35 executing program 4: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) recvmsg(0xffffffffffffffff, &(0x7f00000036c0)={&(0x7f0000000180)=@can, 0xfd28, &(0x7f00000035c0), 0x0, &(0x7f0000003680)=""/41, 0x29}, 0x0) bind$alg(r0, &(0x7f0000001300)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb(blowfish)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000ff8000)="0a0775b0", 0x4) r1 = accept$alg(r0, 0x0, 0x0) sendmmsg$alg(r1, &(0x7f0000003e80)=[{0x0, 0x0, &(0x7f0000002a80), 0x167, &(0x7f0000000100)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x0) recvmsg(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)=[{&(0x7f0000000200)=""/4096, 0x1000}], 0x1, &(0x7f0000fb3fa9)=""/87, 0x57, 0x10000000000000}, 0x0) 04:02:35 executing program 3: r0 = perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) setxattr$security_smack_entry(&(0x7f0000000380)='./file0\x00', &(0x7f0000000480)='security.SMACK64IPIN\x00', &(0x7f0000000540)='^vboxnet1^\x00', 0xb, 0x1) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r1, &(0x7f0000000040), 0x0}, 0x20) unlink(&(0x7f0000000900)='./file0/file0\x00') r2 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r3 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r3, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, &(0x7f00000006c0)={0x0}) ioctl$BINDER_GET_NODE_DEBUG_INFO(r2, 0xc018620b, &(0x7f0000000640)={r4}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f00000000c0)=[@enter_looper], 0x0, 0x0, &(0x7f0000000700)}) ioctl$BINDER_SET_CONTEXT_MGR(r3, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x1) prctl$PR_SET_NAME(0xf, &(0x7f00000004c0)='/group.stat\x00') ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, &(0x7f0000000780)}) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f0000000680)}) ioctl$FS_IOC_FIEMAP(r3, 0xc020660b, &(0x7f0000000b80)=ANY=[@ANYBLOB="0000010000000000200000000000000005000000010000000a00000000000000ff030000000000001a0a000000000000050000000000000000000000000000000000000000000000080000000000000000000000000000000800000000000000ffff0000000000000100008000000000000000000000000000000000000000000000000000000000000000000000000008000000000000003f0000000000000008000000000000000000000000000000000000000000800800000000000000000000000000000200000000000000000400000000000000000000010000000000000000000000000000000000000002110000000000000000000000000000cc0000000000000000000000000000001b0000000000000000000000000000000000000000000000841400000000000000000000000000000300000000000000feffffffffffffff000000000000000000000000000000000000000000000000020000000000000000000000000000000600000000000000ff01000000000000040000000000000000000000000000000000000000000000000400000000000000000000000000007be70000000000000900000000000000ff7f0000000000000000000000000000000000000000000004180000000000000000000000000000ffffffff0000000081000000000000000600000000000000000000000000000000000000000000000400000000000000000000000000000002000000000000000500000000000000ff7fffffffffffff0000000000000000000000000000000004040000000000000000000000000000"]) r6 = creat(&(0x7f00000000c0)='./file0\x00', 0x0) openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000100)='/group.stat\x00', 0x2761, 0x0) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000080), 0xffffffffffffffff) getpid() fallocate(r0, 0x0, 0x0, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x2f, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) memfd_create(&(0x7f0000000080)='!proccgroup\x00', 0x0) ioctl$sock_inet_SIOCSIFPFLAGS(0xffffffffffffffff, 0x8934, &(0x7f0000000400)={'veth0_to_bridge\x00', 0x100}) accept(r6, &(0x7f0000000580)=@alg, &(0x7f0000000600)=0x80) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x2400, 0x8000) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000008c0)={0x2c, 0x0, &(0x7f0000000780)=[@acquire_done={0x40106309, r5, 0x2}, @clear_death={0x400c630f, 0x1, 0x3}, @release={0x40046306, 0x2}], 0xc1, 0x0, &(0x7f00000007c0)="859547f83b9b058a973a491d7e6378544744f2b56b02270a2f78214a936e9afb25cd94695643af6563f86771aa9621b9f30f2ca538b018247a633c28ee01e03b4639679311117971e60dc1538f34e961ae301463172c41754be988f6beb0ce4d83c69f86c236d29520e6cdaf5dbb60404c66d63315ff287deac8632781d0197ef1f81314da0a1ed90b681842cf85a41b496ce0a7a6f5aa4b9b23483eea8861be89b3398c6aec3349174f9cdc9de34df361ac9bf7afd8566849487c3c0a1e3aaacd"}) 04:02:35 executing program 1: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) recvmsg(0xffffffffffffffff, &(0x7f00000036c0)={&(0x7f0000000180)=@can, 0xfd28, &(0x7f00000035c0), 0x0, &(0x7f0000003680)=""/41, 0x29}, 0x0) bind$alg(r0, &(0x7f0000001300)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb(blowfish)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000ff8000)="0a0775b0", 0x4) r1 = accept$alg(r0, 0x0, 0x0) sendmmsg$alg(r1, &(0x7f0000003e80)=[{0x0, 0x0, &(0x7f0000002a80), 0x167, &(0x7f0000000100)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x0) recvmsg(r1, &(0x7f0000000000)={&(0x7f0000f7ffa8)=@alg, 0x80, &(0x7f0000000140)=[{&(0x7f0000000200)=""/4096, 0x1000}], 0x1, 0x0, 0x0, 0x0}, 0x0) 04:02:35 executing program 0: r0 = perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) setxattr$security_smack_entry(&(0x7f0000000380)='./file0\x00', &(0x7f0000000480)='security.SMACK64IPIN\x00', &(0x7f0000000540)='^vboxnet1^\x00', 0xb, 0x1) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r1, &(0x7f0000000040), 0x0}, 0x20) unlink(&(0x7f0000000900)='./file0/file0\x00') r2 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r3 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r3, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, &(0x7f00000006c0)={0x0}) ioctl$BINDER_GET_NODE_DEBUG_INFO(r2, 0xc018620b, &(0x7f0000000640)={r4}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f00000000c0)=[@enter_looper], 0x24, 0x0, &(0x7f0000000700)="2ba063fb309ec7fdbfb08e6e91baee7d7d4599fe14129a4d426834556ae420e087d59c0c"}) ioctl$BINDER_SET_CONTEXT_MGR(r3, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x1) prctl$PR_SET_NAME(0xf, &(0x7f00000004c0)='/group.stat\x00') ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, &(0x7f0000000780)}) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f0000000680)}) ioctl$FS_IOC_FIEMAP(r3, 0xc020660b, &(0x7f0000000b80)=ANY=[@ANYBLOB="0000010000000000200000000000000005000000010000000a00000000000000ff030000000000001a0a000000000000050000000000000000000000000000000000000000000000080000000000000000000000000000000800000000000000ffff0000000000000100008000000000000000000000000000000000000000000000000000000000000000000000000008000000000000003f0000000000000008000000000000000000000000000000000000000000800800000000000000000000000000000200000000000000000400000000000000000000010000000000000000000000000000000000000002110000000000000000000000000000cc0000000000000000000000000000001b0000000000000000000000000000000000000000000000841400000000000000000000000000000300000000000000feffffffffffffff000000000000000000000000000000000000000000000000020000000000000000000000000000000600000000000000ff01000000000000040000000000000000000000000000000000000000000000000400000000000000000000000000007be70000000000000900000000000000ff7f0000000000000000000000000000000000000000000004180000000000000000000000000000ffffffff0000000081000000000000000600000000000000000000000000000000000000000000000400000000000000000000000000000002000000000000000500000000000000ff7fffffffffffff0000000000000000000000000000000004040000000000000000000000000000"]) r6 = creat(&(0x7f00000000c0)='./file0\x00', 0x0) openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000100)='/group.stat\x00', 0x2761, 0x0) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000080), 0xffffffffffffffff) getpid() fallocate(r0, 0x0, 0x0, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x2f, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) memfd_create(&(0x7f0000000080)='!proccgroup\x00', 0x0) ioctl$sock_inet_SIOCSIFPFLAGS(0xffffffffffffffff, 0x8934, &(0x7f0000000400)={'veth0_to_bridge\x00', 0x100}) accept(r6, &(0x7f0000000580)=@alg, &(0x7f0000000600)=0x80) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x2400, 0x8000) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000008c0)={0x2c, 0x0, &(0x7f0000000780)=[@acquire_done={0x40106309, r5, 0x2}, @clear_death={0x400c630f, 0x1, 0x3}, @release={0x40046306, 0x2}], 0xc1, 0x0, &(0x7f00000007c0)="859547f83b9b058a973a491d7e6378544744f2b56b02270a2f78214a936e9afb25cd94695643af6563f86771aa9621b9f30f2ca538b018247a633c28ee01e03b4639679311117971e60dc1538f34e961ae301463172c41754be988f6beb0ce4d83c69f86c236d29520e6cdaf5dbb60404c66d63315ff287deac8632781d0197ef1f81314da0a1ed90b681842cf85a41b496ce0a7a6f5aa4b9b23483eea8861be89b3398c6aec3349174f9cdc9de34df361ac9bf7afd8566849487c3c0a1e3aaacd"}) 04:02:36 executing program 2: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000440)=@updpolicy={0xb8, 0x19, 0x523, 0x0, 0x0, {{@in=@multicast2, @in6=@empty={[0x0, 0x0, 0x0, 0x0, 0x0, 0xe]}, 0x0, 0x0, 0x0, 0x0, 0xa}}}, 0xb8}}, 0x0) [ 670.292822] binder: BINDER_SET_CONTEXT_MGR already set [ 670.298618] binder: 23746:23748 ioctl 40046207 0 returned -16 [ 670.341124] binder: BINDER_SET_CONTEXT_MGR already set 04:02:36 executing program 4: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) recvmsg(0xffffffffffffffff, &(0x7f00000036c0)={&(0x7f0000000180)=@can, 0xfd28, &(0x7f00000035c0), 0x0, &(0x7f0000003680)=""/41, 0x29}, 0x0) bind$alg(r0, &(0x7f0000001300)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb(blowfish)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000ff8000)="0a0775b0", 0x4) r1 = accept$alg(r0, 0x0, 0x0) sendmmsg$alg(r1, &(0x7f0000003e80)=[{0x0, 0x0, &(0x7f0000002a80), 0x167, &(0x7f0000000100)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x0) recvmsg(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)=[{&(0x7f0000000200)=""/4096, 0x1000}], 0x1, &(0x7f0000fb3fa9)=""/87, 0x57, 0x700000000000000}, 0x0) [ 670.388888] binder: 23752:23758 ioctl 40046207 0 returned -16 04:02:36 executing program 1: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) recvmsg(0xffffffffffffffff, &(0x7f00000036c0)={&(0x7f0000000180)=@can, 0xfd28, &(0x7f00000035c0), 0x0, &(0x7f0000003680)=""/41, 0x29}, 0x0) bind$alg(r0, &(0x7f0000001300)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb(blowfish)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000ff8000)="0a0775b0", 0x4) r1 = accept$alg(r0, 0x0, 0x0) sendmmsg$alg(r1, &(0x7f0000003e80)=[{0x0, 0x0, &(0x7f0000002a80), 0x167, &(0x7f0000000100)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x0) recvmsg(r1, &(0x7f0000000000)={&(0x7f0000f7ffa8)=@alg, 0x80, &(0x7f0000000140)=[{&(0x7f0000000200)=""/4096, 0x1000}], 0x1, 0x0, 0x0, 0x0}, 0x0) [ 670.433130] binder: 23752:23763 Release 1 refcount change on invalid ref 1 ret -22 04:02:36 executing program 2: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000440)=@updpolicy={0xb8, 0x19, 0x523, 0x0, 0x0, {{@in=@multicast2, @in6=@empty={[0x0, 0x0, 0x0, 0x0, 0x0, 0xf]}, 0x0, 0x0, 0x0, 0x0, 0xa}}}, 0xb8}}, 0x0) [ 670.491064] binder: 23752:23758 BC_ACQUIRE_DONE u0000000000000000 no match [ 670.544512] binder: 23752:23758 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 04:02:36 executing program 1: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) recvmsg(0xffffffffffffffff, &(0x7f00000036c0)={&(0x7f0000000180)=@can, 0xfd28, &(0x7f00000035c0), 0x0, &(0x7f0000003680)=""/41, 0x29}, 0x0) bind$alg(r0, &(0x7f0000001300)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb(blowfish)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000ff8000)="0a0775b0", 0x4) r1 = accept$alg(r0, 0x0, 0x0) sendmmsg$alg(r1, &(0x7f0000003e80)=[{0x0, 0x0, &(0x7f0000002a80), 0x167, &(0x7f0000000100)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x0) recvmsg(r1, &(0x7f0000000000)={&(0x7f0000f7ffa8)=@alg, 0x80, &(0x7f0000000140)=[{&(0x7f0000000200)=""/4096, 0x1000}], 0x1, 0x0, 0x0, 0x0}, 0x0) [ 670.588325] binder: 23752:23758 Release 1 refcount change on invalid ref 2 ret -22 04:02:36 executing program 3: r0 = perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) setxattr$security_smack_entry(&(0x7f0000000380)='./file0\x00', &(0x7f0000000480)='security.SMACK64IPIN\x00', &(0x7f0000000540)='^vboxnet1^\x00', 0xb, 0x1) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r1, &(0x7f0000000040), 0x0}, 0x20) unlink(&(0x7f0000000900)='./file0/file0\x00') r2 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r3 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r3, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, &(0x7f00000006c0)={0x0}) ioctl$BINDER_GET_NODE_DEBUG_INFO(r2, 0xc018620b, &(0x7f0000000640)={r4}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f00000000c0)=[@enter_looper], 0x0, 0x0, &(0x7f0000000700)}) ioctl$BINDER_SET_CONTEXT_MGR(r3, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x1) prctl$PR_SET_NAME(0xf, &(0x7f00000004c0)='/group.stat\x00') ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, &(0x7f0000000780)}) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f0000000680)}) ioctl$FS_IOC_FIEMAP(r3, 0xc020660b, &(0x7f0000000b80)=ANY=[@ANYBLOB="0000010000000000200000000000000005000000010000000a00000000000000ff030000000000001a0a000000000000050000000000000000000000000000000000000000000000080000000000000000000000000000000800000000000000ffff0000000000000100008000000000000000000000000000000000000000000000000000000000000000000000000008000000000000003f0000000000000008000000000000000000000000000000000000000000800800000000000000000000000000000200000000000000000400000000000000000000010000000000000000000000000000000000000002110000000000000000000000000000cc0000000000000000000000000000001b0000000000000000000000000000000000000000000000841400000000000000000000000000000300000000000000feffffffffffffff000000000000000000000000000000000000000000000000020000000000000000000000000000000600000000000000ff01000000000000040000000000000000000000000000000000000000000000000400000000000000000000000000007be70000000000000900000000000000ff7f0000000000000000000000000000000000000000000004180000000000000000000000000000ffffffff0000000081000000000000000600000000000000000000000000000000000000000000000400000000000000000000000000000002000000000000000500000000000000ff7fffffffffffff0000000000000000000000000000000004040000000000000000000000000000"]) r6 = creat(&(0x7f00000000c0)='./file0\x00', 0x0) openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000100)='/group.stat\x00', 0x2761, 0x0) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000080), 0xffffffffffffffff) getpid() fallocate(r0, 0x0, 0x0, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x2f, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) memfd_create(&(0x7f0000000080)='!proccgroup\x00', 0x0) ioctl$sock_inet_SIOCSIFPFLAGS(0xffffffffffffffff, 0x8934, &(0x7f0000000400)={'veth0_to_bridge\x00', 0x100}) accept(r6, &(0x7f0000000580)=@alg, &(0x7f0000000600)=0x80) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x2400, 0x8000) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000008c0)={0x2c, 0x0, &(0x7f0000000780)=[@acquire_done={0x40106309, r5, 0x2}, @clear_death={0x400c630f, 0x1, 0x3}, @release={0x40046306, 0x2}], 0xc1, 0x0, &(0x7f00000007c0)="859547f83b9b058a973a491d7e6378544744f2b56b02270a2f78214a936e9afb25cd94695643af6563f86771aa9621b9f30f2ca538b018247a633c28ee01e03b4639679311117971e60dc1538f34e961ae301463172c41754be988f6beb0ce4d83c69f86c236d29520e6cdaf5dbb60404c66d63315ff287deac8632781d0197ef1f81314da0a1ed90b681842cf85a41b496ce0a7a6f5aa4b9b23483eea8861be89b3398c6aec3349174f9cdc9de34df361ac9bf7afd8566849487c3c0a1e3aaacd"}) [ 670.648169] binder: release 23746:23748 transaction 460 out, still active [ 670.655614] binder: unexpected work type, 4, not freed [ 670.684503] binder: undelivered TRANSACTION_COMPLETE [ 670.806729] WARNING: CPU: 1 PID: 18624 at arch/x86/kvm/mmu.c:830 mmu_spte_clear_track_bits+0x43a/0x500 [ 670.817800] Kernel panic - not syncing: panic_on_warn set ... [ 670.823697] CPU: 1 PID: 18624 Comm: syz-executor3 Not tainted 5.0.0-rc1+ #14 [ 670.830882] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 670.840237] Call Trace: [ 670.842833] dump_stack+0x1db/0x2d0 [ 670.846478] ? dump_stack_print_info.cold+0x20/0x20 [ 670.851515] ? mmu_spte_clear_track_bits+0x380/0x500 [ 670.856638] panic+0x2cb/0x65c [ 670.859849] ? add_taint.cold+0x16/0x16 [ 670.863837] ? mmu_spte_clear_track_bits+0x43a/0x500 [ 670.868951] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 670.874590] ? __probe_kernel_read+0x1f4/0x250 [ 670.879190] ? __warn.cold+0x5/0x48 [ 670.882829] ? __warn+0xe8/0x1d0 [ 670.886205] ? mmu_spte_clear_track_bits+0x43a/0x500 [ 670.891319] __warn.cold+0x20/0x48 [ 670.894874] ? mmu_spte_clear_track_bits+0x43a/0x500 [ 670.899990] report_bug+0x263/0x2b0 [ 670.903682] do_error_trap+0x11b/0x200 [ 670.907586] do_invalid_op+0x37/0x50 [ 670.911306] ? mmu_spte_clear_track_bits+0x43a/0x500 [ 670.916417] invalid_op+0x14/0x20 [ 670.919876] RIP: 0010:mmu_spte_clear_track_bits+0x43a/0x500 [ 670.925594] Code: 45 89 67 90 31 ff 44 89 e6 48 ba 00 00 00 00 00 fc ff df c6 04 10 f8 e8 04 d3 70 00 45 85 e4 0f 85 74 fd ff ff e8 76 d1 70 00 <0f> 0b e9 68 fd ff ff e8 6a d1 70 00 4c 89 f7 e8 a2 24 f7 ff 31 f6 [ 670.944501] RSP: 0018:ffff888021406db8 EFLAGS: 00010293 [ 670.949870] RAX: ffff8880534f6440 RBX: 4000000061d50c77 RCX: ffffffff811125ac [ 670.957142] RDX: 0000000000000000 RSI: ffffffff811125ba RDI: 0000000000000005 [ 670.964418] RBP: ffff888021406e90 R08: ffff8880534f6440 R09: fffff9400030ea87 [ 670.971697] R10: fffff9400030ea86 R11: ffffea0001875437 R12: 0000000000000000 [ 670.978966] R13: 1ffff11004280db9 R14: 0000000000061d50 R15: ffff888021406e68 [ 670.986264] ? mmu_spte_clear_track_bits+0x42c/0x500 [ 670.991384] ? mmu_spte_clear_track_bits+0x43a/0x500 [ 670.996501] ? mmu_spte_clear_track_bits+0x43a/0x500 [ 671.001616] ? mmu_spte_update+0x330/0x330 [ 671.005874] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 671.011420] ? __pte_list_remove+0x94/0x460 [ 671.015812] drop_spte+0x24/0x220 [ 671.019279] mmu_page_zap_pte+0x2e2/0x3b0 [ 671.023435] ? drop_spte+0x220/0x220 [ 671.027149] ? __lock_is_held+0xb6/0x140 [ 671.031231] kvm_mmu_prepare_zap_page+0x19d/0x1440 [ 671.036349] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 671.041900] ? check_preemption_disabled+0x48/0x290 [ 671.046930] ? kvm_handle_hva_range+0x730/0x730 [ 671.051655] ? kvm_make_vcpus_request_mask+0x481/0x5a0 [ 671.056940] ? mark_held_locks+0x100/0x100 [ 671.061191] ? gfn_to_pfn_atomic+0x6c0/0x6c0 [ 671.065607] ? add_lock_to_list.isra.0+0x450/0x450 [ 671.070542] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 671.076088] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 671.081636] ? check_preemption_disabled+0x48/0x290 [ 671.086671] ? kvm_make_vcpus_request_mask+0x5a0/0x5a0 [ 671.091980] kvm_mmu_invalidate_zap_all_pages+0x53e/0x710 [ 671.097532] ? kvm_mmu_zap_collapsible_sptes+0x830/0x830 [ 671.101696] kobject: 'nullb0' (000000002518ca94): kobject_uevent_env [ 671.103010] ? lock_release+0xc40/0xc40 [ 671.110517] binder_send_failed_reply: 12 callbacks suppressed [ 671.110525] binder: send failed reply for transaction 421, target dead [ 671.113469] ? rcu_sync_dtor+0x170/0x170 [ 671.113485] ? kmem_cache_free+0x86/0x260 [ 671.113506] kvm_arch_flush_shadow_all+0x16/0x20 [ 671.113577] kvm_mmu_notifier_release+0x5c/0x90 [ 671.113594] ? kvm_vcpu_on_spin+0x800/0x800 [ 671.125778] kobject: 'nullb0' (000000002518ca94): fill_kobj_path: path = '/devices/virtual/block/nullb0' [ 671.126125] ? kvm_vcpu_on_spin+0x800/0x800 [ 671.131538] binder: send failed reply for transaction 424, target dead [ 671.134309] __mmu_notifier_release+0x1b4/0x610 [ 671.134325] ? trace_hardirqs_on_caller+0x310/0x310 [ 671.134342] ? do_raw_spin_trylock+0x270/0x270 [ 671.134364] ? __mmu_notifier_invalidate_range_end+0x460/0x460 [ 671.134392] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 671.134405] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 671.134423] ? check_preemption_disabled+0x48/0x290 [ 671.205010] ? rcu_lockdep_current_cpu_online+0x1aa/0x220 [ 671.210617] exit_mmap+0x4ae/0x5d0 [ 671.214172] ? __ia32_sys_munmap+0x80/0x80 [ 671.218444] ? __khugepaged_exit+0x42e/0x630 [ 671.222859] ? rcu_read_lock_sched_held+0x110/0x130 [ 671.227881] ? __sanitizer_cov_trace_const_cmp1+0x1a/0x20 [ 671.233415] ? __khugepaged_exit+0x12e/0x630 [ 671.237855] ? uprobe_clear_state+0x27a/0x380 [ 671.242358] ? hugepage_madvise+0x110/0x110 [ 671.246690] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 671.252229] ? __might_sleep+0x95/0x190 [ 671.256206] mmput+0x240/0x640 [ 671.259408] ? is_current_pgrp_orphaned+0xa0/0xa0 [ 671.264252] ? set_mm_exe_file+0x200/0x200 [ 671.268494] ? do_raw_spin_unlock+0xa0/0x330 [ 671.272898] ? up_read+0x212/0x2b0 [ 671.276443] ? do_raw_spin_trylock+0x270/0x270 [ 671.281046] ? __down_interruptible+0x740/0x740 [ 671.285721] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 671.291265] do_exit+0x9d3/0x2650 [ 671.294713] ? __lock_acquire+0x572/0x4a30 [ 671.298970] ? mm_update_next_owner+0x970/0x970 [ 671.303644] ? mark_held_locks+0x100/0x100 [ 671.307884] ? __sanitizer_cov_trace_switch+0x49/0x80 [ 671.313118] ? drop_futex_key_refs.isra.0+0x6f/0xf0 [ 671.318135] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 671.323674] ? futex_wait+0x6e6/0xa40 [ 671.327495] ? add_lock_to_list.isra.0+0x450/0x450 [ 671.332423] ? memset+0x32/0x40 [ 671.335726] ? __dequeue_signal+0xeb/0x730 [ 671.339962] ? get_signal+0x963/0x19b0 [ 671.343852] ? find_held_lock+0x35/0x120 [ 671.347913] ? get_signal+0x963/0x19b0 [ 671.351804] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 671.357338] ? _raw_spin_unlock_irq+0x28/0x90 [ 671.361829] ? _raw_spin_unlock_irq+0x28/0x90 [ 671.366326] do_group_exit+0x177/0x430 [ 671.370216] ? trace_hardirqs_off_caller+0x300/0x300 [ 671.375321] ? __ia32_sys_exit+0x50/0x50 [ 671.379402] get_signal+0x8b4/0x19b0 [ 671.383131] ? ptrace_notify+0x130/0x130 [ 671.387191] ? __might_fault+0x12b/0x1e0 [ 671.391248] ? find_held_lock+0x35/0x120 [ 671.395308] ? __might_fault+0x12b/0x1e0 [ 671.399380] ? lock_acquire+0x1db/0x570 [ 671.403364] do_signal+0x91/0x1ea0 [ 671.406919] ? lock_release+0xc40/0xc40 [ 671.410896] ? trace_hardirqs_off_caller+0x300/0x300 [ 671.416008] ? setup_sigcontext+0x7d0/0x7d0 [ 671.420334] ? exit_to_usermode_loop+0x98/0x3b0 [ 671.425004] ? exit_to_usermode_loop+0x98/0x3b0 [ 671.429683] ? lockdep_hardirqs_on+0x415/0x5d0 [ 671.434268] ? trace_hardirqs_off_caller+0x300/0x300 [ 671.439392] exit_to_usermode_loop+0x2f7/0x3b0 [ 671.443986] ? entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 671.449350] ? syscall_trace_enter+0x12a0/0x12a0 [ 671.454112] ? ret_from_fork+0x15/0x50 [ 671.458012] ? trace_hardirqs_on_thunk+0x1a/0x1c [ 671.462799] do_syscall_64+0x696/0x800 [ 671.466688] ? syscall_return_slowpath+0x5f0/0x5f0 [ 671.471630] ? prepare_exit_to_usermode+0x3b0/0x3b0 [ 671.476645] ? __switch_to_asm+0x34/0x70 [ 671.480710] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 671.485571] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 671.490753] RIP: 0033:0x457ec9 [ 671.493945] Code: 6d b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 3b b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 671.512845] RSP: 002b:00007fd323a66cf8 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca [ 671.520580] RAX: fffffffffffffe00 RBX: 000000000073bfa8 RCX: 0000000000457ec9 [ 671.527846] RDX: 0000000000000000 RSI: 0000000000000080 RDI: 000000000073bfa8 [ 671.535111] RBP: 000000000073bfa0 R08: 0000000000000000 R09: 0000000000000000 [ 671.542382] R10: 0000000000000000 R11: 0000000000000246 R12: 000000000073bfac [ 671.549650] R13: 00007ffe5de24a0f R14: 00007fd323a679c0 R15: 000000000073bfac [ 671.558704] Kernel Offset: disabled [ 671.563153] Rebooting in 86400 seconds..