x3528a9c0}], 0x1, 0x0) ioctl$EVIOCSABS20(r1, 0x401845e0, &(0x7f0000000000)={0x100000000000, 0x8, 0x41f2, 0x27, 0x2, 0x7}) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) openat$cgroup_ro(r1, &(0x7f0000000100)='cgroup.stat\x00', 0x0, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0xf) mlock2(&(0x7f0000ffe000/0x1000)=nil, 0x1000, 0x1) [ 1745.155005] binder: 9562:9563 unknown command 997177868 [ 1745.160696] binder: 9562:9563 ioctl c0306201 20000300 returned -22 [ 1745.191159] binder: 9568:9569 ioctl c0306201 20000300 returned -14 [ 1745.241871] binder: 9573:9575 unknown command -533309438 [ 1745.248484] binder: 9573:9575 ioctl c0306201 20000140 returned -22 [ 1745.256262] binder: 9573:9575 unknown command 0 [ 1745.261092] binder: 9573:9575 ioctl c0306201 20000300 returned -22 [ 1745.268799] binder: 9573:9578 unknown command -533309438 [ 1745.274535] binder: 9573:9578 ioctl c0306201 20000140 returned -22 [ 1745.281133] binder: 9573:9575 unknown command 0 [ 1745.285955] binder: 9573:9575 ioctl c0306201 20000300 returned -22 16:20:34 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) r2 = dup2(r1, r0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000380)=ANY=[@ANYBLOB="04630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000300)={0x8, 0x0, &(0x7f00000004c0)=[@acquire={0x40046304}], 0xb19b868c1a8b328c, 0x0, 0x0}) ioctl$FS_IOC_MEASURE_VERITY(0xffffffffffffffff, 0xc0046686, &(0x7f0000000040)={0x2, 0x4e, "deb0426b04a2d26e6b73cf584797e1f1d7105f1e0faf457f12fb623a4bf03ed95adbb0d2735842547377f80cadc060777825b22a529fc921a1bd97883cb45499132c1a00dc34c0f9015d2bb702da"}) 16:20:34 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) r2 = dup2(r1, r0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) r3 = socket$inet6_udp(0xa, 0x2, 0x0) ioctl$sock_SIOCGPGRP(r3, 0x8904, &(0x7f0000000040)) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000380)=ANY=[@ANYBLOB="04630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000300)={0x8, 0x0, &(0x7f00000004c0)=[@acquire={0x40046304}], 0xb19b868c1a8b328c, 0x0, 0x0}) r4 = ioctl$TUNGETDEVNETNS(0xffffffffffffffff, 0x54e3, 0x0) pipe(&(0x7f0000000480)={0xffffffffffffffff, 0xffffffffffffffff}) write(r5, &(0x7f0000000340), 0x41395527) dup2(r4, r5) pipe(&(0x7f0000000480)={0xffffffffffffffff}) vmsplice(r6, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) fcntl$addseals(r6, 0x409, 0x0) [ 1745.319945] binder: 9582:9583 ioctl c0306201 20000300 returned -14 [ 1745.354473] binder: 9589:9590 ioctl c0306201 20000300 returned -14 16:20:34 executing program 2: r0 = syz_open_procfs(0x0, &(0x7f0000000080)='net/dev_snmp6\x00') r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r1, 0x40045431, &(0x7f00000000c0)) r2 = syz_open_pts(r1, 0x0) r3 = dup3(r2, r0, 0x0) ioctl$TCXONC(r3, 0x540a, 0x0) pselect6(0x40, &(0x7f0000000340)={0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9b86}, 0x0, 0x0, 0x0, 0x0) 16:20:34 executing program 2: r0 = syz_open_procfs(0x0, &(0x7f0000000080)='net/dev_snmp6\x00') r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r1, 0x40045431, &(0x7f00000000c0)) r2 = syz_open_pts(r1, 0x0) r3 = dup3(r2, r0, 0x0) ioctl$TCXONC(r3, 0x540a, 0x0) ioctl$PIO_FONTX(r1, 0x4b6c, &(0x7f0000000000)="bf8fb4c16e244b86f8d965919791533cee10d04f42d4b21a03f29ce789c469040c31a8dd7650259a2f078c1ffb81e4f85474f0dda8d2264576844f10") pselect6(0x54a8de436ac20be, &(0x7f0000000240)={0x3, 0x0, 0x4, 0x2, 0x23, 0x266c, 0xfffffffffffffffd, 0x4}, 0x0, 0x0, 0x0, 0x0) ioctl$TIOCSSERIAL(0xffffffffffffffff, 0x541f, &(0x7f00000001c0)={0xffffffffffffff86, 0x4, 0x10000, 0x1, 0xa7, 0x10001, 0x8, 0x1, 0x1, 0x200, 0x100000000, 0x1, 0x6d000000, 0x6, &(0x7f0000000100)=""/159, 0x9, 0xe4, 0x6}) 16:20:35 executing program 2: r0 = syz_open_procfs(0x0, &(0x7f0000000080)='net/dev_snmp6\x00') r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ptmx\x00', 0x0, 0x0) pipe(&(0x7f0000000480)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r4, 0x40045431, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1}) syz_open_pts(r4, 0x0) write(r2, &(0x7f0000000140), 0x63132da4e0d484f4) r5 = openat$cgroup_ro(r3, &(0x7f0000000000)='cpuacct.usage_user\x00', 0x0, 0x0) write$P9_RLCREATE(r5, &(0x7f0000000100)={0x18, 0xf, 0x1, {{0x0, 0x3, 0x1}, 0x8000}}, 0x18) ioctl$TCSETS(r1, 0x40045431, &(0x7f00000000c0)) r6 = syz_open_pts(r1, 0x0) r7 = dup3(r6, r0, 0x0) ioctl$TCXONC(r7, 0x540a, 0x0) pselect6(0x40, &(0x7f0000000340)={0x9}, 0x0, 0x0, 0x0, 0x0) 16:20:35 executing program 5: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040), 0x3044, 0x0) ioctl$TCSETS2(r1, 0x402c542b, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, 0x0, "c41e495183430405e274ccf7defb07f5340067"}) rt_sigreturn() 16:20:35 executing program 1: r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/raw\x00') getsockopt$IP_VS_SO_GET_DAEMON(r0, 0x0, 0x487, &(0x7f0000000040), &(0x7f0000000080)=0x30) pread64(r0, 0x0, 0x0, 0x800000000002) 16:20:35 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f00000003c0)="11dca50d5e0bcfe47bf070") r1 = socket$inet_tcp(0x2, 0x1, 0x0) stat(&(0x7f0000000180)='./file0\x00', &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x0}) stat(&(0x7f0000000240)='./file0\x00', &(0x7f0000000280)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) fchown(r0, r2, r3) bind$inet(r1, &(0x7f0000000100)={0x2, 0x4e20}, 0x10) connect$inet(r1, &(0x7f0000000cc0)={0x2, 0x4e20, @local}, 0x10) setsockopt$SO_TIMESTAMPING(r1, 0x1, 0x25, &(0x7f00000010c0)=0x19ff, 0x4) r4 = openat$selinux_avc_hash_stats(0xffffffffffffff9c, &(0x7f0000000040)='/selinux/avc/hash_stats\x00', 0x0, 0x0) ioctl$EVIOCGPHYS(r4, 0x80404507, &(0x7f0000000080)=""/66) sendto$inet(r1, &(0x7f0000000140)="b0", 0x1, 0x0, 0x0, 0x0) pipe(&(0x7f0000000480)={0xffffffffffffffff, 0xffffffffffffffff}) write(r5, &(0x7f0000000340), 0x41395527) ioctl(r5, 0x6f3, &(0x7f0000000000)="469526aa09c75eb44e568ee5d2da89a96d1ec237224f49e4c9a3b25f630ed3d89273f7f9") recvmmsg(r1, &(0x7f0000003b40)=[{{0x0, 0x0, 0x0}}], 0x1, 0x2000, 0x0) 16:20:35 executing program 2: r0 = syz_open_procfs(0x0, &(0x7f0000000080)='net/dev_snmp6\x00') r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r1, 0x40045431, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9}) pipe(&(0x7f0000000480)={0xffffffffffffffff}) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) ioctl$TIOCGPKT(r2, 0x80045438, &(0x7f0000000000)) r3 = syz_open_pts(r1, 0x0) r4 = dup3(r3, r0, 0x0) connect(r0, &(0x7f0000000100)=@ethernet={0x1}, 0x80) ioctl$TCXONC(r4, 0x540a, 0x0) pselect6(0x40, &(0x7f0000000340)={0x9, 0x0, 0xffffffffffffffff}, 0x0, 0x0, 0x0, 0x0) 16:20:35 executing program 5: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) pipe(&(0x7f0000000480)={0xffffffffffffffff}) vmsplice(r1, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) syncfs(r1) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x4) r2 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS2(r2, 0x402c542b, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, 0x0, "c41e495183430405e274ccf7defb07f5340067"}) 16:20:35 executing program 1: fcntl$getownex(0xffffffffffffffff, 0x10, &(0x7f0000000040)={0x0, 0x0}) r1 = syz_open_procfs(r0, &(0x7f0000000080)='limits\x00L\x7f\x1f|\x10\x1c\x95\xca\xdaa\xfa\xac\x98p\x8d\xf9f3\x95\x18\xc1r\f\xe8w$\a\xf6\fs\xc4\xed\x82\xdb\x06\xbe\x9d\xebv\x06\x8c9\xc5\xa5\n^C\xf9\xd7\xc1\xf5\t\xcf\x0e\xd0\xf3\xef/\a\x03\x83\xf3pj\x15\xee;S|\xd1>\\\xcf0\x97\xc4Wq\x10d\x12\x98E.\xb9\xc0\xc1\xea\xdfh\x8b\x84\xea\xf7k\x9dq\xb4\x15\xd8\xc3\xe5\x8d\x8a\xb9,\"\xd4\xc9g\b\xfc\x82\xa4\xad)\xe1') pipe(&(0x7f0000000480)={0xffffffffffffffff}) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) setsockopt$inet6_buf(r2, 0x29, 0x31, &(0x7f0000000280)="fcc7f9bff95f2e7c6bef156d78cb8eb15682ea704c30f36f99796f1373a1200c57d6a3394d36ea3dc67032ad72e934180ab675ed999b2ca595daa92725abc636ac53729bff0a41fef752c96edb6dd75866d56a09b794e9646f007454b5b4e2405461763b9c147a407210dc75", 0x6c) r3 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r3, 0x40045431, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1}) write$P9_RLOCK(r1, &(0x7f0000000000)={0x8, 0x35, 0x1}, 0x8) syz_open_pts(r3, 0x0) r4 = dup2(0xffffffffffffffff, r3) writev(r4, &(0x7f0000000240)=[{&(0x7f0000000180)="763a3299c665c4303546b2fe1d5f2bcba5aedc26d8ebd5430ec63e7ea58b8c1d3abf09a7110ea714ea4848f89a1ea48c2814e41b0a1710abedfc2b088b0f173ce364ca25f6eab994303bb236c42863a7ef4a5abf7d57e11f99cb75d3ba775d6ff7d309afefbe11e1f9e8007c17b7397baf67f98759e67e0bba611af30af2a3cf6430dc87c8de5aa8db7a4f348e2111124aa974529c555a5dd5ed37c797f3979b88985108069af8fdc7a17d3264f3f41660c62bf26c103e3eb7a964", 0xff12}], 0x1) pread64(r1, 0x0, 0x0, 0x800000000002) 16:20:35 executing program 4: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0xf) pipe(&(0x7f0000000480)={0xffffffffffffffff}) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) setsockopt$sock_int(r2, 0x1, 0x23, &(0x7f0000000000)=0x1, 0x4) 16:20:35 executing program 0: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/eev/ \x00\x00\x00\xb1\xd6#d', 0x0, 0x5) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) r2 = dup2(r1, r0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000380)=ANY=[@ANYBLOB="04630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000300)={0x8, 0x0, &(0x7f00000004c0)=[@acquire={0x40046304}], 0xb19b868c1a8b328c, 0x0, 0x0}) 16:20:35 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) r1 = openat$full(0xffffffffffffff9c, &(0x7f0000000040)='/dev/full\x00', 0x80000, 0x0) r2 = syz_genetlink_get_family_id$tipc(&(0x7f00000000c0)='TIPC\x00') sendmsg$TIPC_CMD_SET_LINK_TOL(r1, &(0x7f00000001c0)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x40200000}, 0xc, &(0x7f0000000180)={&(0x7f0000000100)={0x30, r2, 0x1, 0x70bd28, 0x25dfdbfb, {{}, 0x0, 0x4107, 0x0, {0x14, 0x18, {0x5, @bearer=@udp='udp:syz2\x00'}}}, ["", ""]}, 0x30}, 0x1, 0x0, 0x0, 0x4}, 0x4000) r3 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) r4 = dup2(r3, r0) ioctl$BINDER_SET_CONTEXT_MGR(r4, 0x40046207, 0x0) preadv(r0, &(0x7f0000000240)=[{&(0x7f0000000200)=""/39, 0x27}], 0x1, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000380)=ANY=[@ANYBLOB="04630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000300)={0x8, 0x0, &(0x7f00000004c0)=[@acquire={0x40046304}], 0xb19b868c1a8b328c, 0x0, 0x0}) 16:20:35 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) r2 = dup2(r1, r0) pipe(&(0x7f0000000480)={0xffffffffffffffff, 0xffffffffffffffff}) write(r3, &(0x7f0000000340), 0x41395527) recvmsg(r3, &(0x7f0000000240)={&(0x7f0000000040)=@llc, 0x80, &(0x7f0000000200)=[{&(0x7f00000000c0)=""/64, 0x40}, {&(0x7f0000000100)=""/15, 0xf}, {&(0x7f0000000180)=""/120, 0x78}], 0x3}, 0x40010063) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000380)=ANY=[@ANYBLOB="04630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000300)={0x8, 0x0, &(0x7f00000004c0)=[@acquire={0x40046304}], 0xb19b868c1a8b328c, 0x0, 0x0}) syz_open_dev$binder(&(0x7f0000000280)='/dev/binder#\x00', 0x0, 0x1002) [ 1746.213428] binder: 9648:9649 ioctl c0306201 20000300 returned -14 [ 1746.301715] binder: 9654:9656 ioctl c0306201 20000300 returned -14 16:20:36 executing program 1: r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/raw\x00') pread64(r0, 0x0, 0x0, 0x800000000002) pipe(&(0x7f0000000480)={0xffffffffffffffff}) vmsplice(r1, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) pipe(&(0x7f0000000480)={0xffffffffffffffff}) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) connect$inet(r2, &(0x7f00000000c0)={0x2, 0x4e20, @initdev={0xac, 0x1e, 0x0, 0x0}}, 0x10) write$selinux_create(r1, &(0x7f0000000040)=@access={'system_u:object_r:ksm_device_t:s0', 0x20, '/usr/sbin/cups-browsed', 0x20, 0x80000000}, 0x4e) 16:20:36 executing program 2: r0 = syz_open_procfs(0x0, &(0x7f0000000080)='net/dev_snmp6\x00') r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r1, 0x40045431, &(0x7f00000000c0)) r2 = syz_open_pts(r1, 0x0) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000100)={0x0, 0xffffffffffffffff, 0x0, 0xe, &(0x7f0000000000)='net/dev_snmp6\x00', 0xffffffffffffffff}, 0x30) pipe(&(0x7f0000000480)={0xffffffffffffffff}) vmsplice(r4, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) statx(r0, &(0x7f0000000140)='./file0\x00', 0x6000, 0x2, &(0x7f0000000180)) dup3(r3, r4, 0x80000) r5 = dup3(r2, r0, 0x0) ioctl$TCXONC(r5, 0x540a, 0x0) pselect6(0x40, &(0x7f0000000340)={0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0x0, 0x0, 0x0) 16:20:36 executing program 5: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS2(r1, 0x402c542b, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, 0x0, "c41e495183430405e274ccf7defb07f5340067", 0x0, 0x100}) 16:20:36 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f00000003c0)="11dca50d5e0bcfe47bf070") r1 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r1, &(0x7f0000000100)={0x2, 0x4e20}, 0x10) connect$inet(r1, &(0x7f0000000cc0)={0x2, 0x4e20, @local}, 0x10) setsockopt$SO_TIMESTAMPING(r1, 0x1, 0x25, &(0x7f00000010c0)=0x19ff, 0x4) r2 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/enforce\x00', 0x200000, 0x0) r3 = openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000080)='/selinux/commit_pending_bools\x00', 0x1, 0x0) r4 = syz_genetlink_get_family_id$team(&(0x7f0000000100)='team\x00') r5 = creat(&(0x7f0000000040)='./file0\x00', 0x0) ioctl$FS_IOC_SETFLAGS(r5, 0x40086602, &(0x7f0000000200)=0x1fb) ioctl$FS_IOC_SETFLAGS(r5, 0x401c5820, &(0x7f0000000000)=0xa8) r6 = openat$selinux_status(0xffffffffffffff9c, 0x0, 0x0, 0x0) accept$packet(r6, &(0x7f00000001c0)={0x11, 0x0, 0x0}, &(0x7f0000000200)=0x14) ioctl$ifreq_SIOCGIFINDEX_team(r5, 0x8933, &(0x7f0000000140)={'team0\x00', r7}) accept$packet(0xffffffffffffffff, &(0x7f0000000180)={0x11, 0x0, 0x0}, &(0x7f00000001c0)=0x14) r10 = openat$selinux_status(0xffffffffffffff9c, 0x0, 0x0, 0x0) r11 = socket(0x200000000000011, 0x3, 0x0) fcntl$setstatus(r11, 0x4, 0x2400) accept$packet(r10, &(0x7f00000001c0)={0x11, 0x0, 0x0}, &(0x7f0000000200)=0x14) ioctl$sock_SIOCGIFINDEX(r11, 0x8933, &(0x7f0000000240)={'ip6_vti0\x00', r12}) getsockopt$inet6_mreq(r3, 0x29, 0x14, &(0x7f00000003c0)={@dev, 0x0}, &(0x7f0000000400)=0x14) r14 = creat(&(0x7f0000000040)='./file0\x00', 0x0) ioctl$FS_IOC_SETFLAGS(r14, 0x40086602, &(0x7f0000000200)=0x1fb) ioctl$FS_IOC_SETFLAGS(r14, 0x401c5820, &(0x7f0000000000)=0xa8) getsockopt$inet_mreqn(r14, 0x0, 0x0, &(0x7f0000000440)={@local, @dev, 0x0}, &(0x7f0000000480)=0xc) r16 = openat$selinux_status(0xffffffffffffff9c, 0x0, 0x0, 0x0) r17 = socket(0x200000000000011, 0x3, 0x0) fcntl$setstatus(r17, 0x4, 0x2400) accept$packet(r16, &(0x7f00000001c0)={0x11, 0x0, 0x0}, &(0x7f0000000200)=0x14) ioctl$sock_SIOCGIFINDEX(r17, 0x8933, &(0x7f0000000240)={'ip6_vti0\x00', r18}) r19 = openat$selinux_status(0xffffffffffffff9c, 0x0, 0x0, 0x0) r20 = socket(0x200000000000011, 0x3, 0x0) fcntl$setstatus(r20, 0x4, 0x2400) accept$packet(r19, &(0x7f00000001c0)={0x11, 0x0, 0x0}, &(0x7f0000000200)=0x14) ioctl$sock_SIOCGIFINDEX(r20, 0x8933, &(0x7f0000000240)={'ip6_vti0\x00', r21}) r22 = openat$selinux_status(0xffffffffffffff9c, 0x0, 0x0, 0x0) r23 = socket(0x200000000000011, 0x3, 0x0) fcntl$setstatus(r23, 0x4, 0x2400) accept$packet(r22, &(0x7f00000001c0)={0x11, 0x0, 0x0}, &(0x7f0000000200)=0x14) ioctl$sock_SIOCGIFINDEX(r23, 0x8933, &(0x7f0000000240)={'ip6_vti0\x00', r24}) r25 = openat$selinux_status(0xffffffffffffff9c, 0x0, 0x0, 0x0) r26 = socket(0x200000000000011, 0x3, 0x0) fcntl$setstatus(r26, 0x4, 0x2400) accept$packet(r25, &(0x7f00000001c0)={0x11, 0x0, 0x0}, &(0x7f0000000200)=0x14) ioctl$sock_SIOCGIFINDEX(r26, 0x8933, &(0x7f0000000240)={'ip6_vti0\x00', r27}) r28 = openat$selinux_status(0xffffffffffffff9c, 0x0, 0x0, 0x0) r29 = socket(0x200000000000011, 0x3, 0x0) fcntl$setstatus(r29, 0x4, 0x2400) accept$packet(r28, &(0x7f00000001c0)={0x11, 0x0, 0x0}, &(0x7f0000000200)=0x14) ioctl$sock_SIOCGIFINDEX(r29, 0x8933, &(0x7f0000000240)={'ip6_vti0\x00', r30}) r31 = openat$selinux_status(0xffffffffffffff9c, 0x0, 0x0, 0x0) r32 = socket(0x200000000000011, 0x3, 0x0) fcntl$setstatus(r32, 0x4, 0x2400) accept$packet(r31, &(0x7f00000001c0)={0x11, 0x0, 0x0}, &(0x7f0000000200)=0x14) ioctl$sock_SIOCGIFINDEX(r32, 0x8933, &(0x7f0000000240)={'ip6_vti0\x00', r33}) r34 = creat(&(0x7f0000000040)='./file0\x00', 0x0) ioctl$FS_IOC_SETFLAGS(r34, 0x40086602, &(0x7f0000000200)=0x1fb) ioctl$FS_IOC_SETFLAGS(r34, 0x401c5820, &(0x7f0000000000)=0xa8) getsockopt$inet6_IPV6_IPSEC_POLICY(r34, 0x29, 0x22, &(0x7f0000003f00)={{{@in6=@mcast1, @in=@local, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@broadcast}, 0x0, @in=@local}}, &(0x7f0000004000)=0xe8) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f00000053c0)={{{@in=@broadcast, @in6=@loopback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@multicast1}, 0x0, @in=@remote}}, &(0x7f00000054c0)=0xe8) r37 = openat$selinux_status(0xffffffffffffff9c, 0x0, 0x0, 0x0) r38 = socket(0x200000000000011, 0x3, 0x0) fcntl$setstatus(r38, 0x4, 0x2400) accept$packet(r37, &(0x7f00000001c0)={0x11, 0x0, 0x0}, &(0x7f0000000200)=0x14) ioctl$sock_SIOCGIFINDEX(r38, 0x8933, &(0x7f0000000240)={'ip6_vti0\x00', r39}) getsockopt$inet_IP_IPSEC_POLICY(r3, 0x0, 0x10, &(0x7f0000005500)={{{@in=@multicast1, @in6=@initdev, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@initdev}, 0x0, @in6=@remote}}, &(0x7f0000005600)=0xe8) sendmsg$TEAM_CMD_NOOP(0xffffffffffffffff, &(0x7f0000005d00)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000005cc0)={&(0x7f0000005640)={0x678, r4, 0x600, 0x70bd2b, 0x25dfdbfc, {}, [{{0x8, 0x1, r8}, {0xb8, 0x2, [{0x38, 0x1, @mcast_rejoin_interval={{0x24, 0x1, 'mcast_rejoin_interval\x00'}, {0x8}, {0x8, 0x4, 0x5}}}, {0x40, 0x1, @priority={{{0x24, 0x1, 'priority\x00'}, {0x8}, {0x8, 0x4, 0x1000}}, {0x8, 0x6, r9}}}, {0x3c, 0x1, @user_linkup_enabled={{{0x24, 0x1, 'user_linkup_enabled\x00'}, {0x8}, {0x4}}, {0x8, 0x6, r12}}}]}}, {{0x8, 0x1, r13}, {0x84, 0x2, [{0x40, 0x1, @lb_hash_stats={{{0x24, 0x1, 'lb_hash_stats\x00'}, {0x8}, {0x8, 0x4, 0x1ff}}, {0x8}}}, {0x40, 0x1, @priority={{{0x24, 0x1, 'priority\x00'}, {0x8}, {0x8, 0x4, 0x5}}, {0x8, 0x6, r15}}}]}}, {{0x8, 0x1, r18}, {0x1a4, 0x2, [{0x40, 0x1, @priority={{{0x24, 0x1, 'priority\x00'}, {0x8}, {0x8, 0x4, 0x81}}, {0x8}}}, {0x38, 0x1, @mcast_rejoin_interval={{0x24, 0x1, 'mcast_rejoin_interval\x00'}, {0x8}, {0x8, 0x4, 0xff}}}, {0x38, 0x1, @mcast_rejoin_interval={{0x24, 0x1, 'mcast_rejoin_interval\x00'}, {0x8}, {0x8, 0x4, 0xe6cf}}}, {0x3c, 0x1, @enabled={{{0x24, 0x1, 'enabled\x00'}, {0x8}, {0x4}}, {0x8, 0x6, r21}}}, {0x3c, 0x1, @user_linkup={{{0x24, 0x1, 'user_linkup\x00'}, {0x8}, {0x4}}, {0x8, 0x6, r24}}}, {0x40, 0x1, @name={{0x24, 0x1, 'mode\x00'}, {0x8}, {0x10, 0x4, 'roundrobin\x00'}}}, {0x38, 0x1, @mcast_rejoin_count={{0x24, 0x1, 'mcast_rejoin_count\x00'}, {0x8}, {0x8, 0x4, 0x4}}}]}}, {{0x8, 0x1, r27}, {0x80, 0x2, [{0x3c, 0x1, @name={{0x24, 0x1, 'mode\x00'}, {0x8}, {0xc, 0x4, 'random\x00'}}}, {0x40, 0x1, @queue_id={{{0x24, 0x1, 'queue_id\x00'}, {0x8}, {0x8, 0x4, 0x9}}, {0x8, 0x6, r30}}}]}}, {{0x8, 0x1, r33}, {0x1a8, 0x2, [{0x40, 0x1, @lb_hash_stats={{{0x24, 0x1, 'lb_hash_stats\x00'}, {0x8}, {0x8, 0x4, 0xfffffffffffffff8}}, {0x8}}}, {0x40, 0x1, @queue_id={{{0x24, 0x1, 'queue_id\x00'}, {0x8}, {0x8, 0x4, 0x7}}, {0x8}}}, {0x38, 0x1, @mcast_rejoin_interval={{0x24, 0x1, 'mcast_rejoin_interval\x00'}, {0x8}, {0x8, 0x4, 0x7ff}}}, {0x40, 0x1, @lb_tx_hash_to_port_mapping={{{0x24, 0x1, 'lb_tx_hash_to_port_mapping\x00'}, {0x8}, {0x8, 0x4, r35}}, {0x8}}}, {0x3c, 0x1, @user_linkup={{{0x24, 0x1, 'user_linkup\x00'}, {0x8}, {0x4}}, {0x8, 0x6, r36}}}, {0x38, 0x1, @notify_peers_interval={{0x24, 0x1, 'notify_peers_interval\x00'}, {0x8}, {0x8, 0x4, 0x10001}}}, {0x38, 0x1, @notify_peers_count={{0x24, 0x1, 'notify_peers_count\x00'}, {0x8}, {0x8, 0x4, 0xe0}}}]}}, {{0x8, 0x1, r39}, {0x12c, 0x2, [{0x38, 0x1, @mcast_rejoin_count={{0x24, 0x1, 'mcast_rejoin_count\x00'}, {0x8}, {0x8}}}, {0x3c, 0x1, @user_linkup={{{0x24, 0x1, 'user_linkup\x00'}, {0x8}, {0x4}}, {0x8, 0x6, r40}}}, {0x38, 0x1, @mcast_rejoin_count={{0x24, 0x1, 'mcast_rejoin_count\x00'}, {0x8}, {0x8, 0x4, 0x1f}}}, {0x3c, 0x1, @bpf_hash_func={{0x24, 0x1, 'bpf_hash_func\x00'}, {0x8}, {0xc, 0x4, [{0x9, 0x6, 0xff, 0xc4}]}}}, {0x40, 0x1, @lb_hash_stats={{{0x24, 0x1, 'lb_hash_stats\x00'}, {0x8}, {0x8, 0x4, 0x3ff}}, {0x8}}}]}}]}, 0x678}, 0x1, 0x0, 0x0, 0x20008000}, 0x8000) getsockname$packet(0xffffffffffffffff, &(0x7f0000000180)={0x11, 0x0, 0x0}, &(0x7f00000001c0)=0x14) getsockopt$inet_mreqn(0xffffffffffffffff, 0x0, 0x20, &(0x7f0000000200)={@dev, @empty, 0x0}, &(0x7f0000000240)=0xc) r43 = openat(0xffffffffffffff9c, &(0x7f00000003c0)='./file0/file0\x00', 0x20000, 0x60) accept$packet(0xffffffffffffffff, &(0x7f0000000400)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000440)=0x14) ioctl$sock_inet6_SIOCSIFDSTADDR(r43, 0x8918, &(0x7f0000000480)={@mcast2, 0x3f, r44}) r45 = openat(0xffffffffffffff9c, &(0x7f00000003c0)='./file0/file0\x00', 0x20000, 0x60) accept$packet(0xffffffffffffffff, &(0x7f0000000400)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000440)=0x14) ioctl$sock_inet6_SIOCSIFDSTADDR(r45, 0x8918, &(0x7f0000000480)={@mcast2, 0x3f, r46}) getsockopt$inet_mreqn(r0, 0x0, 0x20, &(0x7f0000000280)={@remote, @empty, 0x0}, &(0x7f00000002c0)=0xc) r48 = openat(0xffffffffffffff9c, &(0x7f00000003c0)='./file0/file0\x00', 0x20000, 0x60) accept$packet(0xffffffffffffffff, &(0x7f0000000400)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000440)=0x14) ioctl$sock_inet6_SIOCSIFDSTADDR(r48, 0x8918, &(0x7f0000000480)={@mcast2, 0x3f, r49}) getsockopt$inet6_mreq(0xffffffffffffffff, 0x29, 0x1c, &(0x7f0000000300)={@rand_addr, 0x0}, &(0x7f0000000340)=0x14) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000000540)={{{@in=@dev, @in6=@remote, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@dev}, 0x0, @in=@empty}}, &(0x7f0000000640)=0xe8) pipe(&(0x7f0000000480)={0xffffffffffffffff, 0xffffffffffffffff}) write(r52, &(0x7f0000000340), 0x41395527) accept$packet(r52, &(0x7f0000000700)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @random}, &(0x7f0000000740)=0x14) getsockopt$inet6_mreq(r0, 0x29, 0x1c, &(0x7f0000000780)={@empty, 0x0}, &(0x7f00000007c0)=0x14) getsockopt$inet_mreqn(r0, 0x0, 0x61, &(0x7f0000000800)={@empty, @local, 0x0}, &(0x7f0000000840)=0xc) sendmsg$TEAM_CMD_NOOP(r2, &(0x7f00000008c0)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x800}, 0xc, &(0x7f0000000880)={&(0x7f0000001100)={0x584, r4, 0x300, 0x70bd28, 0x25dfdbfe, {}, [{{0x8, 0x1, r41}, {0x1e0, 0x2, [{0x54, 0x1, @bpf_hash_func={{0x24, 0x1, 'bpf_hash_func\x00'}, {0x8}, {0x24, 0x4, [{0xdc59, 0xf40b, 0x20, 0x20}, {0x10000, 0x1, 0x6, 0xfffffffffffffe82}, {0x1000, 0x9, 0x9c, 0x2}, {0x7dc2, 0x1f, 0x4, 0x6}]}}}, {0x38, 0x1, @activeport={{0x24, 0x1, 'activeport\x00'}, {0x8}, {0x8}}}, {0x5c, 0x1, @bpf_hash_func={{0x24, 0x1, 'bpf_hash_func\x00'}, {0x8}, {0x2c, 0x4, [{0x14b8000, 0x6, 0x20, 0x2}, {0x3, 0x8001, 0x9}, {0x40008, 0x7f, 0x7, 0x9}, {0x0, 0x7ff, 0x4, 0x1ff}, {0x1000, 0x3f, 0x8, 0x9}]}}}, {0x3c, 0x1, @bpf_hash_func={{0x24, 0x1, 'bpf_hash_func\x00'}, {0x8}, {0xc, 0x4, [{0x3f, 0xffffffff, 0xfff, 0x20}]}}}, {0x40, 0x1, @name={{0x24, 0x1, 'mode\x00'}, {0x8}, {0x10, 0x4, 'broadcast\x00'}}}, {0x3c, 0x1, @user_linkup_enabled={{{0x24, 0x1, 'user_linkup_enabled\x00'}, {0x8}, {0x4}}, {0x8, 0x6, r42}}}, {0x3c, 0x1, @user_linkup_enabled={{{0x24, 0x1, 'user_linkup_enabled\x00'}, {0x8}, {0x4}}, {0x8, 0x6, r44}}}]}}, {{0x8, 0x1, r46}, {0x184, 0x2, [{0x44, 0x1, @name={{0x24, 0x1, 'mode\x00'}, {0x8}, {0x14, 0x4, 'activebackup\x00'}}}, {0x44, 0x1, @bpf_hash_func={{0x24, 0x1, 'bpf_hash_func\x00'}, {0x8}, {0x14, 0x4, [{0x1f, 0x5, 0x0, 0x401}, {0x81, 0x7, 0x5, 0x7}]}}}, {0x38, 0x1, @notify_peers_interval={{0x24, 0x1, 'notify_peers_interval\x00'}, {0x8}, {0x8, 0x4, 0x1}}}, {0x3c, 0x1, @bpf_hash_func={{0x24, 0x1, 'bpf_hash_func\x00'}, {0x8}, {0xc, 0x4, [{0x0, 0x2, 0x7, 0x7fff}]}}}, {0x38, 0x1, @lb_stats_refresh_interval={{0x24, 0x1, 'lb_stats_refresh_interval\x00'}, {0x8}, {0x8, 0x4, 0x80000000}}}, {0x4c, 0x1, @lb_tx_method={{0x24, 0x1, 'lb_tx_method\x00'}, {0x8}, {0x1c, 0x4, 'hash_to_port_mapping\x00'}}}]}}, {{0x8, 0x1, r47}, {0x1f4, 0x2, [{0x3c, 0x1, @user_linkup_enabled={{{0x24, 0x1, 'user_linkup_enabled\x00'}, {0x8}, {0x4}}, {0x8, 0x6, r49}}}, {0x44, 0x1, @bpf_hash_func={{0x24, 0x1, 'bpf_hash_func\x00'}, {0x8}, {0x14, 0x4, [{0x400, 0xfffffffffffffbff, 0x80000000, 0x10001}, {0xfb, 0xffffffffffff9270, 0x4, 0x8}]}}}, {0x3c, 0x1, @lb_tx_method={{0x24, 0x1, 'lb_tx_method\x00'}, {0x8}, {0xc, 0x4, 'hash\x00'}}}, {0x40, 0x1, @queue_id={{{0x24, 0x1, 'queue_id\x00'}, {0x8}, {0x8, 0x4, 0x8}}, {0x8, 0x6, r50}}}, {0x40, 0x1, @queue_id={{{0x24, 0x1, 'queue_id\x00'}, {0x8}, {0x8, 0x4, 0x80000001}}, {0x8, 0x6, r51}}}, {0x38, 0x1, @activeport={{0x24, 0x1, 'activeport\x00'}, {0x8}, {0x8, 0x4, r53}}}, {0x3c, 0x1, @enabled={{{0x24, 0x1, 'enabled\x00'}, {0x8}, {0x4}}, {0x8, 0x6, r54}}}, {0x40, 0x1, @lb_port_stats={{{0x24, 0x1, 'lb_port_stats\x00'}, {0x8}, {0x8, 0x4, 0xffffffffffff0000}}, {0x8, 0x6, r55}}}]}}]}, 0x584}, 0x1, 0x0, 0x0, 0x63c76c1704f7fa01}, 0x84) sendto$inet(r1, &(0x7f0000000140)="b0", 0x1, 0x0, 0x0, 0x0) recvmmsg(r1, &(0x7f0000003b40)=[{{0x0, 0x0, 0x0}}], 0x1, 0x2000, 0x0) 16:20:36 executing program 5: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS2(r1, 0x402c542b, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, 0x0, "c41e495183430405e274ccf7defb07f5340067"}) ioctl$TIOCGPKT(r1, 0x80045438, &(0x7f0000000080)) 16:20:36 executing program 5: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS2(r1, 0x402c542b, &(0x7f0000000000)={0x0, 0x0, 0x5, 0x0, 0x0, "7f00000083430005e274cceedefb07f5340067"}) 16:20:36 executing program 4: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) pipe(&(0x7f0000000480)={0xffffffffffffffff, 0xffffffffffffffff}) write(r2, &(0x7f0000000340), 0x41395527) ioctl$UI_BEGIN_FF_ERASE(r2, 0xc00c55ca, &(0x7f0000000240)={0xd, 0x10001, 0x618c}) r3 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r3, 0x40045431, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1}) syz_open_pts(r3, 0x0) r4 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000180)='/selinux/enforce\x00', 0x402001, 0x0) getsockopt$inet6_buf(r4, 0x29, 0xd3, &(0x7f00000001c0)=""/17, &(0x7f0000000200)=0x11) fsetxattr(r3, &(0x7f0000000000)=@known='trusted.overlay.metacopy\x00', &(0x7f0000000080)='/dev/ptmx\x00', 0xa, 0x1) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0xf) 16:20:36 executing program 5: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ptmx\x00', 0x0, 0x0) pipe(&(0x7f0000000480)={0xffffffffffffffff}) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) pipe(&(0x7f0000000480)={0xffffffffffffffff}) vmsplice(r3, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) getsockopt$inet_mreqn(r3, 0x0, 0x20, &(0x7f00000000c0)={@dev, @rand_addr, 0x0}, &(0x7f0000000100)=0xc) sendmsg$nl_route(r2, &(0x7f00000001c0)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x10400000}, 0xc, &(0x7f0000000180)={&(0x7f0000000140)=@bridge_dellink={0x30, 0x11, 0x0, 0x70bd2d, 0x25dfdbff, {0x7, 0x0, 0x0, r4, 0x10, 0x400}, [@IFLA_LINK={0x8, 0x5, 0x32}, @IFLA_LINK={0x8, 0x5, 0x8}]}, 0x30}, 0x1, 0x0, 0x0, 0x4000000}, 0x4) ioctl$TCSETS2(r1, 0x402c542b, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, 0x0, "c41e495183430405e274ccf7defb07f5340067"}) 16:20:36 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) fcntl$setown(r0, 0x8, 0xffffffffffffffff) r2 = dup2(r1, r0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000380)=ANY=[@ANYBLOB="04630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000300)={0x8, 0x0, &(0x7f00000004c0)=[@acquire={0x40046304}], 0xb19b868c1a8b328c, 0x0, 0x0}) 16:20:36 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) pipe(&(0x7f0000000480)={0xffffffffffffffff, 0xffffffffffffffff}) write(r2, &(0x7f0000000340), 0x41395527) ioctl$TIOCNOTTY(r2, 0x5422) r3 = dup2(r1, r0) pipe(&(0x7f0000000480)={0xffffffffffffffff, 0xffffffffffffffff}) write(r4, &(0x7f0000000340), 0x41395527) renameat2(r3, &(0x7f0000000080)='./file0\x00', r4, &(0x7f00000000c0)='./file0\x00', 0x7) pipe(&(0x7f0000000480)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$BINDER_SET_MAX_THREADS(r5, 0x40046205, &(0x7f0000000040)=0x7fffffff) openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000100)='/dev/loop-control\x00', 0x486980, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r3, 0x40046207, 0x0) pipe(&(0x7f0000000480)={0xffffffffffffffff}) pipe(&(0x7f0000000480)={0xffffffffffffffff}) vmsplice(r7, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) close(r7) r8 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r8, 0x40045431, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1}) syz_open_pts(r8, 0x0) ioctl$TIOCPKT(r8, 0x5420, &(0x7f0000000180)=0x616) vmsplice(r6, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) ioctl$BINDER_WRITE_READ(r6, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000180)=ANY=[], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000300)={0x8, 0x0, &(0x7f00000004c0)=ANY=[@ANYBLOB='\b\x00\x00\x00\x00\x00\x00\x00'], 0xb19b868c1a8b328c, 0x0, 0x0}) [ 1747.071377] binder: 9699:9700 ioctl c0306201 20000300 returned -14 [ 1747.079380] binder: 9699:9702 ioctl c0306201 20000300 returned -14 [ 1747.304310] binder: 9705:9710 unknown command 8 [ 1747.309311] binder: 9705:9710 ioctl c0306201 20000300 returned -22 16:20:37 executing program 1: r0 = gettid() ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x3c) ptrace$cont(0x10, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r0, 0x0, 0x0) r1 = syz_open_procfs(r0, &(0x7f0000000280)='net/raw\x00\xf3\x87$\xe9\x9c.\xbd\xf7\x8f\x18\xf0\xb9)\xd96\xb1\xdf;\x00#\x93\xfe$\xc0%\xbbl\xe6L\xa8\x86I\xc8y\x9e\x16\x89\x9fx\xd7\x1f>:@\xfcW6k\x8e4\xf5\x14\xa0\xc0\x06\b\x8c\xcc\xce\xfdS\xc56\xa6\xce(V\x02\xae\xb7aF\xd1\xa0\x92\xa5\xaf\xf3\xf9oy\x12\xe3u\x9a\xfbn\xa6\xf4[\xbe\xdd\x9f\x1a\x0e\xbc6\xfb\xda\xf1\xf7\xc7\xd2') perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x1ee6b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) clone(0x841100, 0x0, &(0x7f00000000c0), 0x0, 0x0) ppoll(&(0x7f0000000000)=[{}], 0x2000000000000087, &(0x7f0000000180)={0x0, 0x989680}, 0x0, 0x0) pread64(r1, 0x0, 0x0, 0x800000000002) getsockopt$inet_pktinfo(0xffffffffffffffff, 0x0, 0x8, &(0x7f0000000040)={0x0, @broadcast, @empty}, &(0x7f0000000080)=0xc) recvfrom$packet(0xffffffffffffffff, &(0x7f00000001c0)=""/136, 0x88, 0x40000000, &(0x7f0000000100)={0x11, 0xf7, r2, 0x1, 0x9, 0x6, @remote}, 0x14) 16:20:37 executing program 1: r0 = openat$selinux_avc_cache_threshold(0xffffffffffffff9c, &(0x7f0000000240)='/selinux/avc/cache_threshold\x00', 0x2, 0x0) r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) lsetxattr$trusted_overlay_opaque(0x0, 0x0, 0x0, 0x0, 0x0) mkdir(&(0x7f0000000000)='./file0\x00', 0x0) write$P9_RXATTRCREATE(r0, &(0x7f0000000180)={0x7, 0x21, 0x2}, 0x7) ioctl$BLKIOOPT(r0, 0x1279, &(0x7f0000000400)) r2 = open(&(0x7f0000000240)='./file0\x00', 0x0, 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', 0x0, 0x2001001, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r3 = getpid() timer_create(0x0, 0x0, 0x0) setxattr$security_evm(&(0x7f0000000200)='./file0\x00', &(0x7f00000003c0)='security.evm\x00', &(0x7f0000000540)=ANY=[@ANYBLOB="c459d4035f8c3005bbe54ca562251afbd8b5b031403ffe3b2e2b8e10ff77dd06d8057c3afc76e8be2be685289ebbc854553a48a228d55ab5bbf33ace05879b6ec8e1daa958022441b6494c699f0037c40a76479a73f896eb04da15e1712d901a5574feec91c2c6e17fe8fceae12c15e108c185c4c69c7dfc8784fa1a10d19d753465cf7594e2a7b103702c046bfbcced7eafe53e4e47b7ca165c1fbdec187f9b0d2f2175643cb5caa9096be9342118919c588490b5ac184763198d8133f3e749243a45556933"], 0x7, 0x0) waitid(0x1, r3, &(0x7f0000000280), 0x2, 0x0) setxattr$security_smack_transmute(&(0x7f0000000300)='./file0\x00', &(0x7f0000000340)='security.SMACK64TRANSMUTE\x00', &(0x7f0000000380)='TRUE', 0x4, 0x0) setsockopt$inet_tcp_TCP_REPAIR_QUEUE(0xffffffffffffffff, 0x6, 0x14, &(0x7f00000001c0), 0x4) r4 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r4, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000000)=ANY=[@ANYBLOB="300000001000010800"/20, @ANYRES32=0x0, @ANYBLOB="400000000000000008001b000000"], 0x30}}, 0x0) pivot_root(&(0x7f0000000140)='./file0\x00', &(0x7f0000000100)='./file0\x00') prctl$PR_SET_KEEPCAPS(0x8, 0x1) ioctl$LOOP_SET_STATUS64(r2, 0x4c04, 0x0) syz_open_pts(r1, 0x0) fdatasync(r1) r5 = syz_open_procfs(0x0, &(0x7f0000000000)='net/raw\x00') pread64(r5, 0x0, 0xfffffffffffffca7, 0x800000000002) ioctl$UI_SET_RELBIT(r5, 0x40045566, 0x9) 16:20:37 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f00000003c0)="11dca50d5e0bcfe47bf070") r1 = socket$inet_tcp(0x2, 0x1, 0x0) r2 = open$dir(&(0x7f0000000000)='./file0\x00', 0x10000, 0x81) fchmodat(r2, &(0x7f0000000040)='./file0\x00', 0xd52f857d14ecb072) bind$inet(r1, &(0x7f0000000100)={0x2, 0x4e20}, 0x10) connect$inet(r1, &(0x7f0000000cc0)={0x2, 0x4e20, @local}, 0x10) setsockopt$SO_TIMESTAMPING(r1, 0x1, 0x25, &(0x7f00000010c0)=0x19ff, 0x4) socket$inet(0x2, 0x4, 0x5) sendto$inet(r1, &(0x7f0000000140)="b0", 0x1, 0x0, 0x0, 0x0) recvmmsg(r1, &(0x7f0000003b40)=[{{0x0, 0x0, 0x0}}], 0x1, 0x2000, 0x0) [ 1747.654952] netlink: 8 bytes leftover after parsing attributes in process `syz-executor.1'. 16:20:37 executing program 2: r0 = syz_open_procfs(0x0, &(0x7f0000000080)='net/dev_snmp6\x00') r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r1, 0x40045431, &(0x7f00000000c0)) getrusage(0x0, &(0x7f0000000100)) r2 = syz_open_pts(r1, 0x200000) r3 = dup3(r2, r0, 0x0) ioctl$TCXONC(r3, 0x540a, 0x0) pselect6(0x40, &(0x7f0000000340)={0x9}, 0x0, 0x0, 0x0, 0x0) 16:20:37 executing program 2: r0 = syz_open_procfs(0x0, &(0x7f0000000080)='net/dev_snmp6\x00') r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r1, 0x40045431, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x200000, 0xffffffffffffffff}) r2 = syz_open_pts(r1, 0x0) r3 = dup3(r2, r0, 0x0) ioctl$TCXONC(r3, 0x540a, 0x0) pselect6(0x40, &(0x7f0000000340)={0x9}, 0x0, 0x0, 0x0, 0x0) 16:20:37 executing program 4: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) socketpair$unix(0x1, 0xf, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0xf) syncfs(r1) 16:20:37 executing program 2: r0 = syz_open_procfs(0x0, &(0x7f0000000080)='net/dev_snmp6\x00') r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r1, 0x40045431, &(0x7f00000000c0)) r2 = syz_open_pts(r1, 0x0) write(0xffffffffffffffff, &(0x7f0000000340), 0x41395527) setsockopt$sock_attach_bpf(0xffffffffffffffff, 0x1, 0x32, &(0x7f0000000000), 0x4) r3 = socket$unix(0x1, 0x5, 0x0) setsockopt$SO_TIMESTAMPING(r3, 0x1, 0x41, &(0x7f0000000100)=0x400, 0x4) r4 = dup3(r2, r0, 0x0) ioctl$TCXONC(r4, 0x540a, 0x0) pselect6(0x40, &(0x7f0000000340)={0x9}, 0x0, 0x0, 0x0, 0x0) 16:20:37 executing program 1: r0 = gettid() ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x3c) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0x7, r0, 0x0, &(0x7f00000000c0)) r1 = gettid() ptrace$setopts(0x4206, r1, 0x0, 0x0) tkill(r1, 0x3c) ptrace$cont(0x18, r1, 0x0, 0x0) ptrace$setregs(0xd, r1, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r1, 0x0, 0x0) ptrace$PTRACE_SECCOMP_GET_METADATA(0x420d, r1, 0x10, &(0x7f0000000040)={0x9}) ptrace$cont(0x7, r0, 0x0, 0x0) r2 = syz_open_procfs(r0, &(0x7f0000000000)='net/raw\x00') pipe(&(0x7f0000000480)={0xffffffffffffffff, 0xffffffffffffffff}) pipe(&(0x7f0000000480)={0xffffffffffffffff}) vmsplice(r4, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) ioctl$TCSETAF(r4, 0x5408, &(0x7f0000000080)={0x5, 0x6, 0x1, 0x7, 0x7, 0x3, 0x5f, 0x7fffffff, 0x8, 0xfffffffffffffff9}) write(r3, &(0x7f0000000340), 0x41395527) ioctl$UI_SET_SNDBIT(r3, 0x4004556a, 0x1) pread64(r2, 0x0, 0x0, 0x800000000002) 16:20:37 executing program 5: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ptmx\x00', 0x2000, 0x0) pipe(&(0x7f0000000480)={0xffffffffffffffff, 0xffffffffffffffff}) write(r2, &(0x7f0000000340), 0x41395527) r3 = accept4(r2, &(0x7f00000000c0)=@pptp={0x18, 0x2, {0x0, @dev}}, &(0x7f0000000000)=0x80, 0x80c00) setsockopt$inet6_icmp_ICMP_FILTER(r3, 0x1, 0x1, &(0x7f0000000140)={0x80000000}, 0x4) ioctl$TCSETS2(r1, 0x402c542b, &(0x7f0000000080)={0x0, 0xce, 0x4, 0xfffffffffffffffc, 0x0, "c41e495183430405e274ccf7defb07f5340067", 0x2}) pipe(&(0x7f0000000480)={0xffffffffffffffff}) vmsplice(r4, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) ioctl$EVIOCGRAB(r4, 0x40044590, &(0x7f0000000180)=0xffffffffffff8001) 16:20:37 executing program 0: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev_\xfeinder#\x00', 0x0, 0x802) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) r2 = dup2(r1, r0) pipe2(&(0x7f0000000040)={0xffffffffffffffff}, 0x84000) ioctl$PERF_EVENT_IOC_REFRESH(r3, 0x2402, 0x3) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) pipe(&(0x7f0000000480)={0xffffffffffffffff, 0xffffffffffffffff}) write(r4, &(0x7f0000000340), 0x41395527) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000100)={0x1, 0x0, &(0x7f0000000080)=ANY=[], 0x1d4, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000300)={0x8, 0x0, &(0x7f00000004c0)=ANY=[@ANYBLOB="0463044000200000"], 0xb19b868c1a8b328c, 0x0, 0x0}) 16:20:37 executing program 2: r0 = syz_open_procfs(0x0, &(0x7f0000000080)='net/dev_snmp6\x00') r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r1, 0x40045431, &(0x7f00000000c0)) r2 = syz_open_pts(r1, 0x0) r3 = dup3(r2, r0, 0x0) r4 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000100)='/dev/vga_arbiter\x00', 0x206506, 0x0) r5 = openat$selinux_mls(0xffffffffffffff9c, &(0x7f0000000140)='/selinux/mls\x00', 0x0, 0x0) r6 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000200)='TIPCv2\x00') sendmsg$TIPC_NL_BEARER_SET(r5, &(0x7f00000006c0)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x20000}, 0xc, &(0x7f0000000240)={&(0x7f00000003c0)={0x110, r6, 0x404, 0x70bd29, 0x25dfdbff, {}, [@TIPC_NLA_MEDIA={0x38, 0x5, [@TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'ib\x00'}, @TIPC_NLA_MEDIA_PROP={0x24, 0x2, [@TIPC_NLA_PROP_WIN={0x8, 0x3, 0x7a2d627a}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x1}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x3}, @TIPC_NLA_PROP_PRIO={0x8}]}, @TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'ib\x00'}]}, @TIPC_NLA_NODE={0x14, 0x6, [@TIPC_NLA_NODE_ADDR={0x8, 0x1, 0x3}, @TIPC_NLA_NODE_ADDR={0x8, 0x1, 0x4a49}]}, @TIPC_NLA_LINK={0x28, 0x4, [@TIPC_NLA_LINK_PROP={0x24, 0x7, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x11}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x1f}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_WIN={0x8}]}]}, @TIPC_NLA_LINK={0x88, 0x4, [@TIPC_NLA_LINK_PROP={0x14, 0x7, [@TIPC_NLA_PROP_WIN={0x8, 0x3, 0x1}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x8}]}, @TIPC_NLA_LINK_NAME={0xc, 0x1, 'syz0\x00'}, @TIPC_NLA_LINK_NAME={0xc, 0x1, 'syz1\x00'}, @TIPC_NLA_LINK_PROP={0x1c, 0x7, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0x92ce}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x5}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x200}]}, @TIPC_NLA_LINK_PROP={0x3c, 0x7, [@TIPC_NLA_PROP_TOL={0x8, 0x2, 0x8}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x8}, @TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x7}, @TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_TOL={0x8}]}]}]}, 0x110}, 0x1, 0x0, 0x0, 0x4000}, 0x0) sendmsg$TIPC_NL_MON_SET(r4, &(0x7f0000000240)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x40200400}, 0xc, &(0x7f0000000200)={&(0x7f0000000180)={0x74, r6, 0x1, 0x70bd25, 0x25dfdbfc, {}, [@TIPC_NLA_SOCK={0x1c, 0x2, [@TIPC_NLA_SOCK_ADDR={0x8, 0x1, 0x4}, @TIPC_NLA_SOCK_ADDR={0x8, 0x1, 0x48a}, @TIPC_NLA_SOCK_ADDR={0x8, 0x1, 0x617c}]}, @TIPC_NLA_SOCK={0x18, 0x2, [@TIPC_NLA_SOCK_HAS_PUBL={0x4}, @TIPC_NLA_SOCK_ADDR={0x8, 0x1, 0x2}, @TIPC_NLA_SOCK_REF={0x8, 0x2, 0x9}]}, @TIPC_NLA_BEARER={0x2c, 0x1, [@TIPC_NLA_BEARER_PROP={0xc, 0x2, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0x9}]}, @TIPC_NLA_BEARER_DOMAIN={0x8, 0x3, 0x7}, @TIPC_NLA_BEARER_DOMAIN={0x8, 0x3, 0x7}, @TIPC_NLA_BEARER_PROP={0xc, 0x2, [@TIPC_NLA_PROP_WIN={0x8}]}]}]}, 0x74}}, 0x808) ioctl$TCXONC(r3, 0x540a, 0x0) pipe(&(0x7f0000000480)={0xffffffffffffffff}) vmsplice(r7, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) ioctl$EXT4_IOC_ALLOC_DA_BLKS(r7, 0x660c) pselect6(0x40, &(0x7f0000000340)={0x9}, 0x0, 0x0, 0x0, 0x0) ioctl$KDSETMODE(0xffffffffffffffff, 0x4b3a, 0x40) pipe(&(0x7f0000000480)={0xffffffffffffffff}) vmsplice(r8, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) sendmsg$TIPC_NL_PUBL_GET(r8, &(0x7f0000000380)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x20800810}, 0xc, &(0x7f0000000300)={&(0x7f0000000500)={0x1b0, r6, 0x4, 0x70bd25, 0x25dfdbfd, {}, [@TIPC_NLA_MON={0x2c, 0x9, [@TIPC_NLA_MON_REF={0x8, 0x2, 0x2}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8, 0x1, 0x1}, @TIPC_NLA_MON_REF={0x8, 0x2, 0xff}, @TIPC_NLA_MON_REF={0x8}, @TIPC_NLA_MON_REF={0x8, 0x2, 0x2}]}, @TIPC_NLA_BEARER={0x24, 0x1, [@TIPC_NLA_BEARER_NAME={0x10, 0x1, @l2={'eth', 0x3a, 'gretap0\x00'}}, @TIPC_NLA_BEARER_NAME={0x10, 0x1, @udp='udp:syz0\x00'}]}, @TIPC_NLA_MON={0x4c, 0x9, [@TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8, 0x1, 0x2}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8, 0x1, 0x9}, @TIPC_NLA_MON_REF={0x8, 0x2, 0x8}, @TIPC_NLA_MON_REF={0x8, 0x2, 0x1d3}, @TIPC_NLA_MON_REF={0x8, 0x2, 0x7ff}, @TIPC_NLA_MON_REF={0x8, 0x2, 0x7fffffff}, @TIPC_NLA_MON_REF={0x8, 0x2, 0x1d}, @TIPC_NLA_MON_REF={0x8, 0x2, 0x9}, @TIPC_NLA_MON_REF={0x8, 0x2, 0x6}]}, @TIPC_NLA_SOCK={0x20, 0x2, [@TIPC_NLA_SOCK_ADDR={0x8, 0x1, 0xfff}, @TIPC_NLA_SOCK_ADDR={0x8, 0x1, 0x2}, @TIPC_NLA_SOCK_ADDR={0x8}, @TIPC_NLA_SOCK_HAS_PUBL={0x4}]}, @TIPC_NLA_MON={0x2c, 0x9, [@TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8, 0x1, 0x6}, @TIPC_NLA_MON_REF={0x8, 0x2, 0x8}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8, 0x1, 0x1}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8, 0x1, 0x80000000}, @TIPC_NLA_MON_REF={0x8, 0x2, 0x100000000}]}, @TIPC_NLA_LINK={0x54, 0x4, [@TIPC_NLA_LINK_NAME={0x14, 0x1, 'broadcast-link\x00'}, @TIPC_NLA_LINK_NAME={0x14, 0x1, 'broadcast-link\x00'}, @TIPC_NLA_LINK_NAME={0xc, 0x1, 'syz0\x00'}, @TIPC_NLA_LINK_PROP={0x1c, 0x7, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0xf}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0xec00000000000000}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0xc}]}]}, @TIPC_NLA_MEDIA={0x60, 0x5, [@TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'eth\x00'}, @TIPC_NLA_MEDIA_PROP={0x14, 0x2, [@TIPC_NLA_PROP_WIN={0x8, 0x3, 0x1300000}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x2}]}, @TIPC_NLA_MEDIA_PROP={0x14, 0x2, [@TIPC_NLA_PROP_TOL={0x8, 0x2, 0x10001}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x80000001}]}, @TIPC_NLA_MEDIA_PROP={0x2c, 0x2, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0x5}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x4}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0xffffffff}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x8}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x7ff}]}]}]}, 0x1b0}, 0x1, 0x0, 0x0, 0x4000}, 0x10) 16:20:37 executing program 4: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = openat$selinux_mls(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/mls\x00', 0x0, 0x0) ioctl$PERF_EVENT_IOC_PAUSE_OUTPUT(r2, 0x40042409, 0x1) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0xf) r3 = openat$selinux_avc_cache_stats(0xffffffffffffff9c, &(0x7f0000000080)='/selinux/avc/cache_stats\x00', 0x0, 0x0) write$P9_RLOCK(r3, &(0x7f0000000100)={0x8, 0x35, 0x1, 0x1}, 0x8) 16:20:37 executing program 1: r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/raw\x00') pipe(&(0x7f0000000480)={0xffffffffffffffff, 0xffffffffffffffff}) write(r1, &(0x7f0000000340), 0x41395527) ioctl$EVIOCSKEYCODE(r1, 0x40084504, &(0x7f0000000040)=[0x3, 0x7ff]) r2 = openat$selinux_avc_cache_threshold(0xffffffffffffff9c, &(0x7f0000000100)='/selinux/avc/cache_threshold\x00', 0x2, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000140)={'sit0\x00', 0x8421}) r3 = syz_open_procfs$namespace(0x0, &(0x7f00000000c0)='ns/cgroup\x00') fcntl$F_SET_FILE_RW_HINT(r3, 0x40e, &(0x7f0000000080)) pread64(r0, 0x0, 0x0, 0x800000000002) 16:20:37 executing program 4: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0xc) openat$full(0xffffffffffffff9c, &(0x7f0000000000)='/dev/full\x00', 0x612000, 0x0) pipe(&(0x7f0000000480)) write(0xffffffffffffffff, &(0x7f0000000340), 0x0) pipe(&(0x7f0000000480)={0xffffffffffffffff}) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) pipe(&(0x7f0000000480)={0xffffffffffffffff}) vmsplice(r3, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) pipe(&(0x7f0000000480)={0xffffffffffffffff}) vmsplice(r4, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) openat$selinux_mls(0xffffffffffffff9c, &(0x7f0000000080)='/selinux/mls\x00', 0x0, 0x0) pipe(&(0x7f0000000480)={0xffffffffffffffff, 0xffffffffffffffff}) write(r5, &(0x7f0000000340), 0x41395527) ioctl$RTC_WKALM_RD(r5, 0x80287010, &(0x7f00000001c0)) pipe(&(0x7f0000000480)={0xffffffffffffffff, 0xffffffffffffffff}) write(r6, &(0x7f0000000340), 0x41395527) pipe(&(0x7f0000000480)={0xffffffffffffffff}) vmsplice(r7, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) pipe(&(0x7f0000000480)={0xffffffffffffffff}) vmsplice(r8, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) r9 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ptmx\x00', 0x20002, 0x0) ioctl$TCSETS(r9, 0x40045431, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, 0x0, 0x10000000000, 0x0, 0x0, 0x0, 0x0, 0x1}) syz_open_pts(r9, 0x0) pipe(&(0x7f0000000480)={0xffffffffffffffff}) vmsplice(r10, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) pipe(&(0x7f0000000480)={0xffffffffffffffff, 0xffffffffffffffff}) write(r11, &(0x7f0000000340), 0x41395527) ioctl$SNDRV_TIMER_IOCTL_SELECT(r11, 0x40345410, &(0x7f0000000180)={{0x3, 0x3, 0x8, 0x1, 0x5ea2}}) ioctl$TIOCMIWAIT(r10, 0x545c, 0x0) 16:20:38 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f00000003c0)="11dca50d5e0bcfe47bf070") perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r1, &(0x7f0000000240)={0xa, 0x0, 0x0, @mcast1, 0x100000000004}, 0x1c) connect(r1, &(0x7f00000001c0)=@in={0x2, 0x4e1f, @remote}, 0x80) sendmmsg(r1, &(0x7f00000002c0), 0x4000000000000d7, 0x0) r2 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r2, &(0x7f0000000100)={0x2, 0x4e20}, 0x10) connect$inet(r2, &(0x7f0000000cc0)={0x2, 0x4e20, @local}, 0x10) setsockopt$SO_TIMESTAMPING(r2, 0x1, 0x25, &(0x7f00000010c0)=0x19ff, 0x4) sendto$inet(r2, &(0x7f0000000140)="b0", 0x1, 0x0, 0x0, 0x0) recvmmsg(r2, &(0x7f0000000080), 0x40000000000007d, 0x0, 0x0) 16:20:38 executing program 1: pipe(&(0x7f0000000480)={0xffffffffffffffff}) vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) getsockopt$inet6_IPV6_XFRM_POLICY(r0, 0x29, 0x23, &(0x7f0000000040)={{{@in=@multicast1, @in=@multicast2}}, {{@in6=@local}, 0x0, @in6=@local}}, &(0x7f0000000140)=0xe8) r1 = syz_open_procfs(0x0, &(0x7f0000000000)='net/raw\x00') pread64(r1, 0x0, 0x0, 0x800000000002) 16:20:38 executing program 4: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0xf) getrlimit(0xb, &(0x7f0000000080)) 16:20:38 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) mprotect(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x200000e) pipe(&(0x7f0000000480)={0xffffffffffffffff}) vmsplice(r1, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000000000)=0xf) 16:20:38 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) pipe(&(0x7f0000000480)={0xffffffffffffffff, 0xffffffffffffffff}) write(r2, &(0x7f0000000340), 0x41395527) readahead(r2, 0x3023, 0xffffffff) r3 = dup2(r1, r0) ioctl$BINDER_SET_CONTEXT_MGR(r3, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000380)=ANY=[@ANYBLOB="04630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000300)={0x8, 0x0, &(0x7f00000004c0)=[@acquire={0x40046304}], 0xb19b868c1a8b328c, 0x0, 0x0}) r4 = ioctl$TIOCGPTPEER(0xffffffffffffffff, 0x5441, 0x7f4) ioctl$PIO_UNIMAP(r4, 0x4b67, &(0x7f0000000080)={0xa, &(0x7f0000000040)=[{0x7ff, 0xd6}, {0xffffffffffffffff, 0x400}, {0x6, 0x7fffffff}, {0x8, 0x5}, {0x68, 0x80000000}, {0x0, 0x8001}, {0x100, 0x2}, {0xa87, 0x6}, {0x2, 0x40}, {0x100000001, 0x6949}]}) 16:20:38 executing program 5: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ptmx\x00', 0x0, 0x0) 16:20:38 executing program 2: syz_open_procfs(0x0, &(0x7f0000000080)='net/dev_snmp6\x00') r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00000000c0)) syz_open_pts(r0, 0x0) socket$packet(0x11, 0x519e1d1b8e33e847, 0x300) r1 = dup3(r0, 0xffffffffffffffff, 0x40000) ioctl$TCXONC(r1, 0x540a, 0x0) pselect6(0x40, &(0x7f0000000340)={0x9}, 0x0, 0x0, 0x0, 0x0) 16:20:38 executing program 5: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) getsockopt$SO_TIMESTAMP(r0, 0x1, 0x40, &(0x7f0000000080), &(0x7f00000000c0)=0x4) r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ptmx\x00', 0x8200, 0x0) ioctl$TCSETS2(r1, 0x402c542b, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, 0x0, "c41e495183430405e274ccf7defb07f5340067"}) 16:20:38 executing program 2: r0 = syz_open_procfs(0x0, &(0x7f0000000080)='net/dev_snmp6\x00') r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ptmx\x00', 0x0, 0x0) pipe(&(0x7f0000000480)={0xffffffffffffffff, 0xffffffffffffffff}) write(r2, &(0x7f0000000340), 0x41395527) r3 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r3, 0x40045431, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1}) syz_open_pts(r3, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000700)={0xc8, 0x0, &(0x7f0000000500)=[@increfs_done={0x40106308, 0x2}, @increfs, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000140)={@fd={0x66642a85, 0x0, r3}, @fda={0x66646185, 0x4, 0x0, 0x11}, @fda={0x66646185, 0x1, 0x2, 0x1f}}, &(0x7f00000001c0)={0x0, 0x18, 0x38}}, 0x40}, @register_looper, @clear_death={0x400c630f, 0x2}, @reply_sg={0x40486312, {0x3, 0x0, 0x0, 0x0, 0x20, 0x0, 0x0, 0x78, 0x18, &(0x7f00000002c0)={@ptr={0x70742a85, 0x1, &(0x7f0000000200)=""/90, 0x5a, 0x1, 0xc}, @ptr={0x70742a85, 0x0, &(0x7f0000000380)=""/250, 0xfa, 0x1, 0x2b}, @ptr={0x70742a85, 0x0, &(0x7f0000000280)=""/13, 0xd, 0x0, 0x5}}, &(0x7f00000004c0)={0x0, 0x28, 0x50}}, 0x1400}], 0xe0, 0x0, &(0x7f0000000600)="43c788562587e85c8cd765ad2d9a4f6563abb6a828ae4fdb1001597bd40bb8f48ef140fbe8020cda0efeb4ef63c73604fab50e23414836b506928f219fe1bf42fc556ed4f0b5cb5b0e98f4b766ed20902f763a7efcd880a4052ec6172d3a223231ba357c2ff39fa329bc2355455704b57e2d00be06ce738e0dada178cbd51f74cdbc5d0feaacd0474be52a6a4672a455960073f63e8c43b70484d0d5a4312505a0c27672fac320db861ca61a008e94dbe34d88d90aa1dfee43dffde72cb5c2273faf5c1c4195058e46d2e15dc22074bb735118ceeae745d0e22cd1dfa990e76d"}) ioctl$TCSETS(r1, 0x40045431, &(0x7f00000000c0)) r4 = syz_open_pts(r1, 0x0) pipe(&(0x7f0000000480)={0xffffffffffffffff}) pipe(&(0x7f0000000480)={0xffffffffffffffff, 0xffffffffffffffff}) write(r6, &(0x7f0000000340), 0x41395527) ioctl$TUNGETFEATURES(r6, 0x800454cf, &(0x7f0000000100)) vmsplice(r5, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) ioctl$FS_IOC_SETVERSION(r5, 0x40087602, &(0x7f0000000000)=0x3) r7 = dup3(r4, r0, 0x0) ioctl$TCXONC(r7, 0x540a, 0xfff) pselect6(0xfffffe7a, &(0x7f0000000340)={0x9, 0x200000000000}, 0x0, 0x0, 0x0, 0x0) [ 1748.961064] binder: 9801:9811 ioctl c0306201 20000300 returned -14 16:20:38 executing program 5: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ptmx\x00', 0x10100, 0x0) ioctl$TCSETS2(r1, 0x402c542b, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, 0x0, "c41e495183430405e274ccf7defb07f5340067"}) r2 = openat$selinux_mls(0xffffffffffffff9c, &(0x7f0000000080)='/selinux/mls\x00', 0x0, 0x0) r3 = gettid() ptrace$setopts(0x4206, r3, 0x0, 0x0) tkill(r3, 0x3c) ptrace$cont(0x18, r3, 0x0, 0x0) ptrace$setregs(0xd, r3, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r3, 0x0, 0x0) pipe(&(0x7f0000000480)={0xffffffffffffffff, 0xffffffffffffffff}) write(r4, &(0x7f0000000340), 0x41395527) getsockopt$inet6_IPV6_IPSEC_POLICY(r4, 0x29, 0x22, &(0x7f00000000c0)={{{@in6=@empty, @in=@empty, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@remote}, 0x0, @in=@loopback}}, &(0x7f00000001c0)=0xe8) r6 = getegid() setsockopt$sock_cred(r2, 0x1, 0x11, &(0x7f0000000200)={r3, r5, r6}, 0xc) 16:20:38 executing program 5: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS2(r1, 0x402c542b, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, 0x0, "c41e495183430405e274ccf7defb07f5340067"}) r2 = request_key(&(0x7f00000001c0)='keyring\x00', &(0x7f0000000200)={'syz', 0x2}, &(0x7f0000000240)='[^wlan1\x9c\x00', 0xfffffffffffffffa) keyctl$KEYCTL_PKEY_SIGN(0x1b, &(0x7f0000000280)={r2, 0x1000, 0x4e}, &(0x7f0000001440)=ANY=[@ANYBLOB="656e633d72617720686173683d6372637431306469662d70636c6d756c0000000000000001040000000000ff0000000000000000000000000000000000000000000000000000000000000000009d658d275d64f0b2fec07e1141ef339ec949e75747624e64a16f26d7e7902336e3b83187cf5bf5a52013ee6879e178559d902325e4611cc656513d63ed8ad0dfac0d2fe9546a58f420dad48685b33987d6c6e08e49697ea67f5b146d35ede24b92e57944e45428a26e26035a275813b1a94594f50f480bf9b6e11234b9cda75b4af9bac8a852a16c35b07e3e719a3330832859e114d2b9cdbe2c4aebd0dc4de19f1a563dbf8b624d53251057be00c7802b429be740bb443b68c51e7eeaa3e4041fbdfbace2765250d14c9e33d68d2a8bd4a294f73fa2dc3faaf8cd93ad61d420"], &(0x7f00000003c0)="2ba9f1c0ec7892dae50bc57b574db574c22dd95e6665b30bb2beb9ab2cb8010a70262ef1eb623bb7ae384ddda5cd5e2e8df55a2fd54a4b3fc9e4394e488a9f59452843c21a57444ad90d27e22a544c1a12891a19b8daeb64120549ade92f27b8cc1b9732a8c32d8fc3a35695bd860605d5c48df9401ee9921524e8edefa5d86c308c58fba2d34e4878459021488c9b59c343a8ff858afa4cb11164087fd58ec3781b0dad1fc1f54d782a83d44c26b55b33a2d2d94b83a939600e692dc703925729ed285e2ca6e4f3032b137a956e1c3b08006f32f1c139478e15b3896c97627fdbdf5df2a3e0b2d6c7790e7d7a911680a28c03b076f48144c4e4950d4858706cbe3a3fe60c6a0340b9880f3ec3c9f411d868470d7366e02be9805c021873fbf3237184a722867c8a76018a2b6ee3c00d89c7d32bc24c1c831fedd843d63938bf7624a6a278b76b39c59761f79677b5da3cd947ea293d05ff22dad34b69307b9e1a83eb9ef2146aaab798e0fdda9464b2d2b2b7e0306bef986ec5963daa6255dc59d1043e268af9aaadddc0aa62b887d786b067218c334f4c83a7999134221265e221987e2bd8c9aabf0f18d2dd8e37617d739808f7067e48638dbbfafbcaa903e1a6e2958bb2a56aad9b5149349376f1957cf2084180c3cb88cee2dfc36d76ce120ea48c306d9953a8c2bd77b7c2e8f8cdb5f5153409aaebb9b3e14308978d0d0e6aab14db198951957548c91d427a06ac9cf397c5607b9db086e202dfd28ca71896e5a825f267268104d5896b8cfd9f94e46534f145754f499c12ecc38df573ff4e137b2120936767023980e0a95a81a7567d69b3a61c2a8f9fa91a59b5e9e0832d9a3463bb18eb0ae7552b991ea43dccf3e15204a6201c6870440cb5dc9ed5d901a4a2436b229ed0bca23b0b0890e2d1b300da8971cac28fe62c09350111cdffca738178d17d2959aa89c4e5803d24effd3b5058163cdcb008bc02020446047c15a541cb259642ebba23798101d07fc76ea022b47444ba8e968841ef0dffa67eed7794db90c83b1119f02b6b5fc63911bb0e2a162ab94b650ccb3c4c45856014da6214d7295622153d872d69bef2c0afe044f7988552ea60ffa30fcdaf99a4f3d4fa203daa547ec8c4017770fc0e95a788c9d6695e3af63c348d4220ce0cd87ff1d70914a31c3cc858198c7ed90e970003ff896fa264574bfc0f81d9501619bbe73d8ad4b7e6d5b29fde6ce34ec6c149cb3b0d9a44e7026b66ea6d9e9412c7af519a04d98130961ef39cb2f076ea279cac2c67ef60ef428ba8ff797543c8070777567891f4ab8f5af0ddc380eadc4da647b49cbe7dd09f032df6f2f4611e57a8db9b2d65c3c1f3759106979667b618b734f5d6acbbbd040881f7cddbd6dd2950ccacc6adad1ff1974f41ebf976e48657e50e04c72bdc4ce2aaab244e7dc5a95aaa393902e0d4785b7ddfa8ca84a602d3ade3591b5671baafd13883f712c1d3679276cfa93df00086b248d7a243a12e20e5dc3ca10075dc4daba3c5e4e6ca20a34c15f94303b2e3b9f9ab450409c6da8d74070c12be8fd6efa99b22240be71c02ab18dba3f9f4facc93c62dc35456c2b6af7f03eb4f54975b95a1bd3e70f6df582e736100016a680741f056fa9b34a6ac14858c494ed07a3231e06040e5e9ea76af274e8782c75744c429e023d0c56f5e85e10a1fae1e3b2f030a37786acb5f7b407b1857d769da8759588f11989eeb4b892da0d385df2a64b99dbb74353c90195bd73942cf598ec1abbd02d66cb9afdd51a735387770aed7c45976ec0a43e451ca6686d6445435f66b6e90a48ba2b4a695fb92503ebc85811880e1ad1188231879eeaf7eb1995d74d34ab985c791894208b42a43edf77f970ff337e4a2e91f1b9879b7cc6a3c86f63dd70f24ab1fdcdcb2762c23fd4e17f08436f88a8969dbb5ef89de3569e1a51377d704e017cc97fd46a2b061f6e455f96fa293dd5df84a96b0d0bdad3fce1c5b5c0d12ba4c059e682104ddc03bf8a79d958311240673b398841e9a30658a98d24cbe5e3a4f7ce9ed763997f0ecd912545446033039ea81579b0fb5c10583d1da0d6fee853e2b142ab64e155c3fd9d44172c6f72323604d3ce68e0721041bfe1d016c8d325e5dd83c46c2c6993111e437c12433469e73c02733ca392ae306ca9fb587d960c858ea2c06662504a6e45863ec5e62f2c3e34a8f42c360551132311687af1748632a3f570d4f9a6a3cb6a1df6ca1269063f0e256efcf61d763de8fced8faecaec9284104299d40e2a8b61f31a161258ce9547a8615eb780cf876a995cf2d007d318c3d899849a435a72491764bfbce16a2eb342973154bee51f66b07414744d67e8b192f73ec71be231b1bc8fe21f2f9846da8ea7d1a48e0721eb2a049da881aebe101279f903059bf3c7a426d6ee26a216c7f950651dc90e4e6a6a61a82095787fca030d69efa05159cdf667ccbad5e7b1d84439e184e17c7a8e01631c9c09257c90d62c272d755f17e4e2ffd61ac721b48d48764944a48608956a961a148040b0ed245083de9e7491e35cdaaecff442c28d32ba71ebefc6d816cb1bb7c6ffb90ae2ed4bde297e6353b96ebb443234c84f4449b2f46916ac4ca774d9d6f77924912cd33fd2507d84712b653274ee7f7f1ad790b6bb0738537deac8ba03206b12f9efa1082a83cb7c97df7c115b1da120654a4b77747c855ce059864c1058196a82c2d3ddd9e5939e5d08d7afa792be6c09ea7b2a82ab9dcfaaa12589f0e469d1961495a60a93d452f8a0e37d742641284c796f0b17ec69a3a644ff21a714ffa36b869c638b7b2d27439df1649ae5f6750d1925101934c39d332f83b748f85f9631a86a5487bd88a106e45759a43eec7060a6292805ca23de08a509aed5b9bfbef05364ac1fb85372273ddabef64d281ee8c656d55befeef6a1bf9433c99713d6f40538a79bc7afdd642c3df78b29f935cdeeb1462c4039b0134599857427582aa5d318a5ef5e0c37ca9013872d1b516060a3a01fe364febdf12b26bda01afb050dbd97f7290b41a6a904199e90324ca94792e3cd4e2fe4eeafb947f712dfa3e3c46acb20612b2040c70e40505e895e4868a821d0c3f76bd17759f6575e727f40f01a3d14fe90d619219dbb3bac59b30f193e85e46d9b636bbd81fde64d8bf959fc1502e3955b46ebecbdb9aede888f2e56be1dddb83a504c9df41215d8d85def26901063d73516f55effbf65d668809660c0403c0905b4aa8c20f8f50225ddaa807320123b1b562795acdbe09d0c6bc676f9b3c9c9d8c6a1ec81af72df9bb597e8ebd3c0c50c3148c4a82750ee9f8ed5bf383f2a2c8d442a5b758f5a83945f75d6941ad873a1af519506356f904b591ca7ee5951fa83d404cd25262d9bad5c124d850423ee81d990a15df5c58d945dbd92306819e308d219bd641fc1659feb578c24eec1f6bc8348980e648c3957a7f3280e1dbf9987c76cf83be82747d7adff754be7f421418becfcec9c6b45dde18a2890d0e81c36e443f3fa47be5c176caceeca46a0782917fb3b39a35903eeac5ea4378c87602ab827357309da06e7f301e13a8bf7b35bd8bd4575a3b9a8974467c991caa30f74f4c1968489a04a404a16baf6765adfed68ad4b7f9e6d2b435e1a13ef8e380e94cf0c6c94ce72f58cafd75d135d3f34f7000a4fedf63a68c600c2b11dfbfd0598a97478486f60493e35c07e199cc6d7a52e4b1eb2df33896004b02bffcc2092a77fa7f6aea51b29400a49700c9a691a5e05fb4297d42c7ab3cc34e8a46a6013dd788b403581bf6ca17b51c2cae803e192e64645eb5baafb5ec5b9464d7b0b02207ca68e3193e8a381724dc640b40d0d95cf820d1bc30532a9381ea3156bcb592fff7d0823aa3c8630d2ef47c097f9f35ddd9d580d98e7e0a8b0a44fc29784c05d17b7a48330c628a7d260c96f67fda2806b7f3575d3585355306baa030b5fff1f3d40174bdd022c17d8448206a6b933e58e266f51b0260a0d4f535530ead3f63349263f4955ebe914ad4a3f26d323934580bbca2643ad0b84ab06857ae105798533ae0e51f3df12b6a53762d171d3222c8e086427ae35c8d9d49690ce5595cc9c5fba7c07b7d169571a95334c11f74bf8cf1554c28f32278516813323d65431d0ffe28ce21ab3c8305ba510bc752f7c55263d236796705efb773a99f1e5049125bd41bbc535ef3f4ad49c5d6115eeacb17211acb3912433fcae2a3c1f92ae80e1aa9cb733496ea28ebb7593a7495a5d32b090dafde927d0e3ee652fbfda7b02d5779af167defe77dbf04cd92e848e315395bfc6190f7a1dc09afa6ed71ef17579fd53bb1d9d1b300154a5a791f73c917afc3a3ca3b712d01da200e552fec2e028398210b7101c4d66aa2e2d9bd1530d0e2e846fe29269ca85735171bbae334e5b7cb62ec3f04a84fe869c311162a46142428913a20bac66571e7ed92d74714826fe248cedd7f87602e08f9d072925733549ab2a1a74d324b7712e84c184109c0b053baa134584cec75c63a480530b4b41eb3fc0831c7379c8f31cb31ca97ac815c99e7592d7efae84bbf55426b8ccb9bf70cc048b08cf5f340af09c1981b8862c5978b051deca744e461e36c678bd0c96ecfd249b5fb4126eb39419fe175d37c5ce00d66cad55c95c35a13007c3cc1de92bbd865d12ca5d4d85368a442996bebe0a13e15a01b30b901e513b12d42c97450c0a7f7e12cfb4681ff7cb136d505c80f7f45dd6e03d53b30cf9c17d5ce210cdb5819fb99f00b4fe1ae9f0b510a1a014c5d307a0b8bb019cf63cb0e9a940c3b9caa23c022c439fc55a309f4c6161c3ae9259c4f0b437c44eab90757fd6a866c64d5d864d13d1f5c56645b077eb1f68cc5b88e48ff65df7d1f1a04557e527661cb6cf51edc0410979dde1de8595dc908eefe991b4623f2a2ef055ee34efdba7562e2db623c8a0b9832b4cc3a9cc85691969fcd3bc6c622669d93e3cae00cdb14531ae4b4f83f65f9acf89320d2aba9dfc7979df4f4f17e47e13d4509f2d83a25e02f1786cdd0c414086cfa3251c54f1db3ad782cc3c421521d9d2a7a032d64830cfb6d7728e45bfa9ca4a70ddc1650e41d1c33db8dcc55e7fdda3af046dba931d21d2f236feb11142283ca9abf85fc79858b6f96ea816dcb53ae4087543520545c48bfc171ac68b9c975513dfeb2ecac11d75cfd91d5c44f47b01d29678f2dccfd8cefd7c038455664f80e36442c6d090586e0496695138aff393d191caf82d9740cb7b76e9b0e36b23736bf39b3372d2c2e5934228554f90061ef3413a071ee308039b9d60c88648add97352b627f2957abb1b8e2c4eb3aa02b853ecdf4fbaa2b48407489f811997985e0fc0be9cd8c670ebc190d442cdbc0e64199518660c793c39fcfbc2c8e0d79ad6e0fa09e5a97bfc8884404c7b80fd45daf66bf1d60462a73f629b8b9b86101275ec2958b8f2a1a97018a64cf283f5b7f110e99acdfbeb3f065e9d7cff340203f7a1b6619580611df83faf9cb81d56f368447d781648e355df040c38f55461fbc538321bf2001f59b5e60dda166699fdd277f7fc8263c6cb8cf3e2a8d1b454ec36153ff6d583d4c42695dda967475260110e305653848611e81793972e4f4389e458f2337b1ce37a586c2431eb5de9a7d45d05446eed3d84fee7cf85c81a99d0955b64a30da5a13cccf45fd5251731d923495a0b1cfe3fe2f1082f50221419efc3203f0c380c163b9913fda687531b47edb5f4e814a99f85d2d991d1ddbc9b9decf9af7", &(0x7f00000013c0)=""/78) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) pipe(&(0x7f0000000480)={0xffffffffffffffff}) vmsplice(r4, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) ioctl$SNDRV_TIMER_IOCTL_TREAD(r4, 0x40045402, &(0x7f0000000340)=0x1) setsockopt$inet6_tcp_TCP_ULP(r3, 0x6, 0x1f, &(0x7f00000000c0)='tls\x00', 0x4) ioctl$sock_inet_tcp_SIOCOUTQ(0xffffffffffffffff, 0x5411, &(0x7f0000000080)) stat(&(0x7f0000000100)='./file0\x00', &(0x7f0000000140)) 16:20:38 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f00000003c0)="11dca50d5e0bcfe47bf070") r1 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r1, &(0x7f0000000100)={0x2, 0x4e20}, 0x10) connect$inet(r1, &(0x7f0000000cc0)={0x2, 0x4e20, @local}, 0x10) setsockopt$SO_TIMESTAMPING(r1, 0x1, 0x25, &(0x7f00000010c0)=0x19ff, 0x4) sendto$inet(r1, &(0x7f0000000140)="b0", 0x1, 0x0, 0x0, 0x0) recvmmsg(r1, &(0x7f0000003b40)=[{{0x0, 0x0, 0x0}}], 0x1, 0x2000, 0x0) setxattr$security_evm(&(0x7f0000000000)='./file0\x00', &(0x7f0000000040)='security.evm\x00', &(0x7f0000000080)=@sha1={0x1, "78c26149e443e43fc7ec31235a1a708cd09f1e32"}, 0x15, 0x1) 16:20:38 executing program 4: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) pipe(&(0x7f0000000480)={0xffffffffffffffff, 0xffffffffffffffff}) write(r2, &(0x7f0000000340), 0x41395527) ioctl$SNDRV_TIMER_IOCTL_SELECT(r2, 0x40345410, &(0x7f0000000000)={{0x0, 0x6, 0x9, 0x2, 0x5}}) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0xf) 16:20:42 executing program 1: r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/raw\x00') ioctl$TUNSETNOCSUM(r0, 0x400454c8, 0x1) getsockopt$IPT_SO_GET_INFO(r0, 0x0, 0x40, &(0x7f0000000040)={'nat\x00'}, &(0x7f00000000c0)=0x54) 16:20:42 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) r2 = dup2(r1, r0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000380)=ANY=[@ANYBLOB="04630450"], 0x0, 0x0, 0x0}) pipe(&(0x7f0000000480)={0xffffffffffffffff}) vmsplice(r3, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) r4 = mmap$binder(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x1, 0x11, r3, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000300)={0x3c, 0x0, &(0x7f0000000080)=[@free_buffer={0x40086303, r4}, @increfs_done={0x40106308, 0x1}, @request_death={0x400c630e, 0x1}, @dead_binder_done], 0xfffffffffffffd35, 0x0, 0x0}) 16:20:42 executing program 2: r0 = syz_open_procfs(0x0, &(0x7f0000000080)='net/dev_snmp6\x00') r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ptmx\x00', 0x52e605ea6cd026c6, 0x0) ioctl$TCSETS(r1, 0x40045431, &(0x7f00000000c0)) r2 = openat$full(0xffffffffffffff9c, &(0x7f0000000000)='/dev/full\x00', 0x80000, 0x0) r3 = syz_open_pts(r2, 0x0) r4 = dup3(r3, r0, 0x0) ioctl$TCXONC(r4, 0x540a, 0x0) pselect6(0x40, &(0x7f0000000340)={0x9}, 0x0, 0x0, 0x0, 0x0) 16:20:42 executing program 5: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) pipe(&(0x7f0000000480)={0xffffffffffffffff}) vmsplice(r1, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) setsockopt$inet_tcp_int(r1, 0x6, 0x6, &(0x7f0000000000), 0x4) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) pipe(&(0x7f0000000480)={0xffffffffffffffff}) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) ioctl$UI_SET_LEDBIT(r2, 0x40045569, 0x1) openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ptmx\x00', 0x0, 0x0) 16:20:42 executing program 4: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_ifreq(0xffffffffffffffff, 0x8913, &(0x7f0000000000)={'veth0_to_team\x00', @ifru_hwaddr}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0xf) 16:20:42 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f00000003c0)="11dca50d5e0bcfe47bf070") r1 = socket$inet_tcp(0x2, 0x1, 0x0) lsetxattr$security_smack_entry(&(0x7f0000000200)='./file0\x00', &(0x7f0000000240)='security.SMACK64IPOUT\x00', &(0x7f0000000280)='security.selinux\x00', 0x11, 0x1) socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r1, &(0x7f0000000100)={0x2, 0x4e20}, 0x10) connect$inet(r1, &(0x7f0000000cc0)={0x2, 0x4e20, @local}, 0x10) ioctl$TIOCGPGRP(0xffffffffffffffff, 0x540f, &(0x7f0000000040)=0x0) r3 = openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000380)='/selinux/commit_pending_bools\x00', 0x1, 0x0) ioctl$FS_IOC_GET_ENCRYPTION_PWSALT(r3, 0x40106614, &(0x7f0000000580)={0x0, @speck128}) ioctl$RTC_VL_READ(r3, 0x80047013, &(0x7f0000000400)) r4 = syz_open_procfs(r2, &(0x7f0000000080)='projid_map\x00') r5 = openat$selinux_status(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/status\x00', 0x0, 0x0) recvfrom$unix(r5, &(0x7f0000001100)=""/4096, 0x1000, 0x10100, 0x0, 0x0) setsockopt$SO_TIMESTAMPING(r1, 0x1, 0x25, &(0x7f00000010c0)=0x19ff, 0x4) setxattr$security_selinux(&(0x7f00000000c0)='./file0\x00', &(0x7f0000000180)='security.selinux\x00', &(0x7f00000001c0)='system_u:object_r:dbusd_etc_t:s0\x00', 0x21, 0x2) r6 = syz_genetlink_get_family_id$net_dm(&(0x7f0000000480)='NET_DM\x00') sendmsg$NET_DM_CMD_START(r4, &(0x7f0000000540)={&(0x7f0000000440)={0x10, 0x0, 0x0, 0x400}, 0xc, &(0x7f0000000500)={&(0x7f00000004c0)={0x14, r6, 0x600, 0x70bd28, 0x25dfdbfb, {}, ["", "", "", ""]}, 0x14}, 0x1, 0x0, 0x0, 0x80}, 0x4) setxattr$trusted_overlay_nlink(&(0x7f00000002c0)='./file0\x00', &(0x7f0000000300)='trusted.overlay.nlink\x00', &(0x7f0000000340)={'U-', 0x8}, 0x28, 0x2) sendto$inet(r1, &(0x7f0000000140)="b0", 0x1, 0x0, 0x0, 0x0) recvmmsg(r1, &(0x7f0000003b40)=[{{0x0, 0x20f, 0x0, 0xfffffffffffffdc7, 0x0, 0x2d2}}], 0x4000000000000a5, 0x40000000, 0x0) 16:20:42 executing program 2: r0 = syz_open_procfs(0x0, &(0x7f0000000080)='net/dev_snmp6\x00') r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r1, 0x40045431, &(0x7f00000000c0)={0x4, 0xfffffffffffffffa, 0x0, 0x0, 0x0, 0x3, 0x0, 0xa8f, 0x3, 0x0, 0x1}) r2 = syz_open_pts(r1, 0x0) r3 = dup3(r2, r0, 0x0) openat$selinux_avc_cache_stats(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/avc/cache_stats\x00', 0x0, 0x0) pipe(&(0x7f0000000480)={0xffffffffffffffff}) vmsplice(r4, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) ioctl$TIOCOUTQ(r4, 0x5411, &(0x7f0000000100)) ioctl$TCXONC(r3, 0x540a, 0x0) pselect6(0x40, &(0x7f0000000340)={0x9}, 0x0, 0x0, 0x0, 0x0) [ 1753.197044] binder: 10005:10015 unknown command 1342464772 [ 1753.206996] binder: 10005:10015 ioctl c0306201 20000140 returned -22 16:20:42 executing program 1: r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/raw\x00') remap_file_pages(&(0x7f0000ffc000/0x2000)=nil, 0x2000, 0x1000002, 0x4, 0xc92a4af2c079b40e) socket$inet6_udplite(0xa, 0x2, 0x88) pread64(r0, 0x0, 0x0, 0x800000000002) pipe(&(0x7f0000000480)={0xffffffffffffffff}) r2 = socket$nl_route(0x10, 0x3, 0x0) pipe(&(0x7f0000000480)={0xffffffffffffffff, 0xffffffffffffffff}) write(r3, &(0x7f0000000340), 0x41395527) pipe(&(0x7f0000000480)={0xffffffffffffffff, 0xffffffffffffffff}) write(r4, &(0x7f0000000340), 0x41395527) sendmsg$nl_netfilter(r3, &(0x7f0000000440)={&(0x7f00000003c0)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f0000000400)={&(0x7f00000004c0)={0x1a24, 0x12, 0x8, 0x808, 0x70bd28, 0x25dfdbff, {0x1, 0x0, 0x4}, [@nested={0x110, 0x77, [@generic="ab4fdae243b0265e4d9803d4460e6dc90140d773910d77d4e7b63acdb979777c26955bf3567bdc6c5bc3b5085f0834087a8c7ceefcbb3639f2a2aae8c1ee4847f1238dcb4706095dc54be0374f1e85e0cf8787d6083e1fb1178d11f68b66cd838919057a25615be6c25bb48658840c1bcabc9b222c3234f0d707af75a36be905f436d0c38537656f501bbb91861396ab68233a13aad236c455bf3d00b2bf119d926f91b6ca2d1f5bee261903347cc02572464767e1e646756228661875d4bfdb02d5b6a1ae6db15db5321e208618fd7d2dc5e6dc9b69d5ffa09183094abd58bdb4318ba815b15baab10f13279d0787e8b5908a2d05644011fd", @generic="1a5fad68162a04bb7067928e8a7db274"]}, @generic="f0bb111356c880da9f2f1a7941d975a069c9998e24d599cd3bc7fe5df4af7a594d0c84539c9fee44e03bae665b29bef9a5fe9186796fb1a7114b498ab68956b1946f3e", @nested={0x16c, 0x6, [@typed={0x8, 0x92, @u32=0x8}, @generic="94a341237fd994d6d165ec0e02b1a7913f8c511c7dde72b14111e1f77ace4fea071d12de004758ff73c446ecb30eb8faa1dfb21df771250a884d2f66094dd401415c52d324b1086370429f60f225f164e3b8733f5a4e21e6c83355011336587a5481381d8332097c9fb8ce389a0d9639a2821bf692e6b2dae4f363cfe9c136a3ea56068f5cca0efc347ebab564d6f12da692f0f2f52a15a270a0e0a2d5cf767f560a333b274f8c", @typed={0xc, 0x43, @u64=0x40}, @generic="1dafe5b37dbb6e4e4aee180baa3f16d906c7c613b4b912a9d9c76d50d9865f3f3bcd5059befdb627f20583121013c56601613507ed913933676f59505de44a215a9ae06cb7bb0b71544ba9db8ad12627c1b44821627b3085600d1bbd4a1435872d4d42586ac567aff147c05a97095a61adfd471be91d7937abf6665acf23d423467acda3b1ffefef49c06593ec7ef8fb12c76de17e975eca8ca729d55c3eb68388d19e85224ed978bd68c58f"]}, @generic="4312fb6846d91be6cd1dc06a3d12ba02cc01d61e3d89b6c827bfb519c75fb621c585b62a2724a9ff3656a968a322cc5cc4c6619e16a48af0f561235315643c717d8356e65504fd358ef42ac90f3dfc052deb1a530be4e3a35dd48ca5a3a151c229478684e4530e3f77990846d5bfdccabeeeb72371c4c4cd3946e04e550669118d459f0e6156ac50c64252b2eb293b1880d669f4c3916a43ad672db24a0b6ff7a1e9db75809cd1344c4bc9eb12a423604bfd5a8284e960d82435db6669cace68d1271b922294182cc3d8af416558288fd4d05fa4596633a82fc102a7faca0e3abede54e3f0ab4f0c2c2a", @nested={0x1cc, 0x55, [@typed={0xc, 0x6b, @str='net/raw\x00'}, @generic="75e0a037c9df19040e84436d7dc82c55f4f3e3152906edeb309e6b846ab9769148c2d24c41b06a0772d3103884c0aa13b41d3374f8ab4193a87d8c552a2fcd0766c1913b95efd3aed462ae6486223ab1d958fa8c5d778a102c484d414679a4e5ba53ee197a1c46dff0833889532ba71daa566ea689b229ce9f97a3a0cdd8ff3da96c8748b6f173cc36d3447f1c0b812d2542e330cc2ba6d1758eda3ab578c5228498a548ceb8b7558ca23e26591b1551cf8ef23b0a207e3a64d59551bbfc6612c46d363efb09b1eba22c3fef2a0ea49f7775501f4a401fc85bc152791e8f9135066691ea9f670f9f", @typed={0x8, 0x59, @fd}, @generic="77d337d3c708c76f551482a4ac07bb9fff898b15bde37842d62bcd4b659f78d060c4691b4dc8de76299c0fdd018e61b1e3518a6e8f598e00f05feb74d13b31fa2a6c05bf8e3180d37181969bcbd3c338e8bd7dd9cb0caeb89ea5ece4df150dac", @generic="6cc54ec93535191f3116722b954b7a6a5a0744137a7a03f7dca4e2a2dcfcf9b7e2eeab19b05e47d27b18a5c008d33643b970fc929f60dbbf101238ac52971f4c3881f0998fd7147b46e1665b20d09b84ccd740e264e0768f7d88ec2b8d44fb2f448fe9", @typed={0x8, 0x57, @pid=0xffffffffffffffff}]}, @nested={0x24, 0x8c, [@typed={0x8, 0x91, @ipv4=@loopback}, @typed={0x18, 0x61, @binary="82727b47ea8d929f65fa2acaf7fc2e4cce"}]}, @nested={0x100, 0x75, [@generic='\f*c', @generic="2753c5c9d7996b05852cf07b65f356e326b5a05d684d626392625080a22ac244dd9dafd5cef67510a9be22b48b4b547cc9186d54d35097c4dd685b557462e75f3dd24d33b3b26ed109c53106b3662ccadf94972d7f4624adbf2e12bbc0b7d1e98e7b1e2928fc345a1c6016c5eae6efc5c1baa5c33dd6441e544ca94fcf09ef67af552d657b7b4774c4e654b150c398e49fc99a06226dfba6010c5a27f9cdb0bea32a4a68300f07a459f16b4c18e8c61350e4c81e3464a9f8a5320b7dc833b997bb90a00df2455a6bb3a450591e25da624a1bb6948abd7de8ec7f0187657f774fb482e579869109982816e2f8005682a00658c1e993cf13"]}, @nested={0x1374, 0x8, [@generic="fec17b688d5f3e71fff93897f38d6589370ed7670f371893a7a4e381f2ca5417d3b96daca4b12bac42f4a3e0d36ed2b53c60e01578b95d3d06902969ac5e712c166ffb4d863edf2f8d4729ef27ac2762b6585f768da9c5ba92c9231043216bc2fbcaacc326908fd624dc049ac705a4bb3905fec3bcce44675058754853c1aa05aeb2a77f4f4e7716548e9821e882c6aefc17471a37fccf112f2a8ea492586840f3074c10b4ae48ce8b6693ff88d960648762257acfee3ce6b773f00a27cb5fcc1611088b9a822f0434aa2164b16cefe8e06d5d002cbc77879dd895d6f5ea7c92539acfb5943f1621d39e0068e9435afaf4cd736ff449e67e7ccd2dc3826a3837791058fff1422a9d8b2320753bf286dd9ce0c3f6eb47e6c0aa946b5411dfab9bbe6909e29c5fca528bda4de439450e02f09eb6ddbd2623a6f42c82367f3969fd7f345c0f6146f7afa36504ff1fc6cf406c73dbdb5193684315693e5142ed76fefb225de5a27e242aade8ac49c5e37fd30f5e2e3e2677103201e721e23777db73b2ae16a781de82cfb3a4d53f60c1167e55457685e8aba4eb783ceed5f335b679616be950e0680283775bf46d392a86e88617b50c3fc66909865c50227aa7038961bcbd42dae5b326cca638b2c4cc8e9ca25a2f5dd744d1fe0e2412d1badfd26b6428e122e7806dc74a35bd35a090f19fff4e41d0c2ef6610ee845ca49334ac8a09fc71cc605f96ff6643e07da74b896d9b2209fe32fdbff2d044bbdb06dc007922f74c769b3ca004e585f7b670c77335583b52f6619ee62fd1022902671fbf9594fa37dff3a01e24fc77cc888e4122fdcc93fa11f504a2d63f2f1d93ea26afcd02e8db683a8f04673d4e0132dfa876ad0cd2896c1dba11cbcf906a9e141afb528d7c0ad2f051245227a5c7f5500a2c17d393c38e61de1c895fdd0e829dd2ee2ced5093fcc3c7da3133a22b16811b976dd2c1e176faa523954c9b6b378fa5ec82b233dbdb9ccf9d8ee68bf717271f633c8e5f7f79111e4d047f42ef8c746fd13d4e49da7fab4f5a268da646fb54808dcf82ab42181eb6929cf1d8da508e09d1e4a64c5ff57f0abef1768283e57ef39834ec2e7641ba9d464d72574d074906179f7ea4ada3806101f49df2a96d48f5c4e0e680f7793312c33edd7a5ceca1ed5ac6d028f1e73578bfbacdd26b1346c119b36307692b28d91e9bf12a3a4ff3c7789c0e2492ec531fa12dfa60a5588671034caec5dfc7af204faffba8a312118a44351716b426cce70d9da61d75a3e4231debf14359c8f914f8187fa9db472eba07ac4c2fa225d5588ec0ef64dc2d496c125ba0c92ce5902c0bf09b72f46e04f819938f2fa684f41ed0d17df9e5311b0f79fbe0e0710153ad019e75076d2f8f039215eba507015893ee00a955814f4d8bed2682c5cfc22a503ad3627c7b3a300afaef3a6cfc2380213a09f8e646147a14f158fb5b599fbce814444ec6a4fd8c817cfaf1aa7151266ec313f3aa0a11d4d7a3bafaad0185e752601018b0c3634d1a612908c8a2defaa1da0d739bb0fc7d928c5a1511f9b3d69b88ae3e2a76fe47f24c22afd4d3ca8bbed885ded2a8e19b7c3414be1722c5e912127271b63cab3486ea2643fa3c7a0350253534f35f13da85c09d71690c16c4b317dfa0d01fdcc3a3b8b1e629224c681839f5904c32698951b8d43f46409729772ecdef0cf7c753f83a15437c3267749493483e9da4d3177ba62665189cc43f06ea9f62e898f94b16620678ebb3625277ff29433dfdbe3abb1b65a8af3368df741d4eddb7d81e223bb7db7716c2928a05826d758e93fd55c877ccb01be2f6c9a3b686a4641ed5b96697a38bd637f56f5977facf45decc1cefbe0b5a7023827074724355e3377e81a514f204d42dadd44278eeb75fab17e4daeae4d54be0c1958c3dcce54eeb3e064e7633a6750778be948dff30c10ff4f2df26395126168e67d20c4add2cdaf1e8b21cb2b96cbba327eb06af651b2484a1f967d1a63a73708dc68e03b090df0001344c90c56251428f846de5b10be3659edc571bb94f544b2687b42b1fca9b263001edc6f9d23293b6cba4292e95647e385745e8db2343e288c4438ff1e2afb65e5cb0bd3d1a3f69ab4ca391bdd78c7d1c69025449d1b3ad764b907fd31e842b78416867944ad409c06d340db2bae4218b349658a4a4fb52bf95f61edf69fc97f66e5b07fc57a0d715997434808a9539e533627884fdd88ba371f8ec013c756dcfaf04aab061717b165e741b99d63284096ecc97b7d39757fd0f15db6a3399dc22dfca2450d16f61e2cf9636b32b636553f7a7728f0015c461d3d9dbc6d5bf9c766fda17e3c2773cfd2be500f5e73eaec98b6d1660bbf2a2f587fb1f5f287f719f0323709948196e1168d3029e608d5d928d8e61a2be1627de1732ac10270a2a58ebff07f08d1ae00aff0c93fdc8ac37a36416acde1b981ca6c93e16e06a409904237d88e3179e4632aef9778250f5893c1ef921274a30031cc32b4361dcb34f20d51be87d6c1e1cc5af4020cb05880d7d3016a8aed5e1fe80ef3b2419aa82381ac64adad4d60c70e652de35bb843d14129c95c11f981bdfdeff39d61c1883e14f4839da63385f2a02a29a3b29fefaaf29ea14ac59e4c951ef34ad52d371f555c0c14a44ae7a66225c807d8a69fd30eea49aab7a4033c8380599563b9ad1011dcceb9a3249c6f5841ed8cda821a4a2dc8b357b34880645e8b0706f3ae32c65bf54de7e71eb8d68c6e46e75b27e0b40644c89e7f8bc7a0aaefa4f35b9518a9f93ac09c135d7aa36d5bc6b17636d1f1cfd0a7f24502d061c82b2164ae9bfd7b994e9c016d01999bfbf07ac78a33204eee2936cf423c357872b0dc1b2a9086250f7be88aebf84788cc0888aa8dd4f4541522b78f1d438d2b845a379da60ea672cb80f6bf70f7be06898c9241869b97e28bb8f5fae25fd18b894342ae2cf176b3b9b70c35ad2db5f02c62c8291f6aea995a04a529c82ac16e5d67693216d5aae2a73f19152a9f72ded89bf24415f0db792818a571aeee9aacd25b7529e5df46695275d00a1a7d1e00bddd179ced6c52f0be7502e631f2f215298f517c4cfe59712718b90df2c95fa825b47258b081116b16f2e2175364483e466d5fa4ae0e517e7624316ae38ca2bdbec7e9085e8e5b4eff28a537b5035ec6f97a89547dd382dbc926ce4960813a54319ad98173fd0fd86832057d6778b0b3cb54702ccd8ccb1758ee6b6dc8e6cdcc59994e1c4500a96c0e3854cea517d9ba06ad7ba36b804596f993d2a7fe16252b2c244af0cd828979ed01d2618d52b13fc0e61083bf8d3fa182dde0de7923d9b5feb432ea2651f0df477ba69e5811c0c631f8a57c5f2d262f8b675653a19efcb32aa85b6b4ed73e2bca8a4073a007ed82b6d79fb495b0a8fefac47d432eec5f61ab478968759e2327ba8c3f2c1c140ecc0e9dd0b50ebef48115b2f8909c6588f4c543b9053eecee0463c5c9f3d38105f4c7190f4785f79066b7231786624b0aaa541e65385b4de16058bfdee90ee6b9363e086d4cc1fbae7d2bcdd2586c5172b718d70763e6982db0947c7e7181f0f588df4891dd2fa6c36bcda619ec8c204f4d12124bdb54ae30c16c118cdae9908768bbfe8c99a15dba9296cec4681c1fbb4705dd6ef1da4d820567a18627bade87ed465d98e98cbb0e22b889034f6316fead204bbdaab6dfdc2ddab99d331abe9c4c76cacf5d7aac86f04b300682869faa8cceba93234143814b4242e663a73eca710d62460179f549f9bcc139c16b5e0e671f592926403d9324b7f0cf6f92f077e8b4fde5a659fc41dceeb6b1dc49d2043b3ec6b6f02fe9484e95badcb0cb5dd3d65c2e85dfdad9df95337cdae483466fde80b96d15485160c87f5ca4b6750ce7dd05d9485b07a1b733d638c9f9662cf7670355a54ab914fc5ce23ea4145b6e669c467a435452300944c94d8a713ae1a91b4d5191525e3111ea6ebfcd7d40d46e95aa71b6e9d9b62ca6f59d7c60579c4e46309506db280caca9cb4c06897b7ae6a4c19f31ecc56d194b3c35eaf6a8e522c9882fdf0ce69c936654cdf67ab823cab9f1a0788b3771f7250c36176629d88ae5d5b4d7046e140895289ffeabaa6049b13a4a5e0eb396ea7aef14fae489dc59e6a548531384036f36fb8f22b7142c8ddf5d3fdce8b38fdf15f298cf48836cb6669ce7e80c084acb9958855509fe1a983623d443161d4608c3b5ec1e8e5fc8010e8eb799c4b709059a1f83f08aec60d926b6206e02c5e1506b8cfcafc3a2c46e93148f31cdf92ac961b01554d60d74e8f604e41ab409ada6120feacf4079d4532be00f7f723140346d0a93415df240d660344c991749eea7c91d76362fb85b8eb2a41faa0227bb268566d4868b4710c28c5eade1c8d6c689c877ada462daee21ff8bc8f31874e31dadc7bab77cf7ae7e02021a0d0eb3ba08611c7eba829af760eccc3d7bcd2978435346991100f6b14136d4625e886218b6af63fcf81abb55b75f8e993c384c45ac421c753ca5b311b9a0443e31efde923627b00ece95ce12c9be2b1aea93b88fbdb9cf8fdbd9f71fb93d216c4552b89f4b06c95f17eb99a8a756e0b70794699e915b16ac5fc5bd1a390e60c4b913b9f102b25b59456bd8fad7e87fef46be306906085c5c5c32c41abd13910a358bba4b07a82871f1aeb811a027bccbe43aad41fc3bdcdcab9a9e4daaaf5a65df4a5c00d577e9e587d494522f6729a161e178bab72725b23cbb3c9028848bfc7ab1a3deff0cbe20cdeca83e77d5e1f3e89addd3236bf72bb1ffc1318a7879df1d55588e37e6fb423be25ea0b9cb63a37c5b4fc5a46710e9ebfb57098d1b6e73274583562f48e0c2f9689d44f781dbeb4d76950ec271fb6a766385a20a78eec07601a55590e888077be59ae5db31d0234b288c62089ae5a67976c998cccb5e93962215bfa4c9efe6f605b271f59ef20870a376c1247396c7fab25be359d1a14ec5cb2b441980600180d9921700de56c3d84d1719280e318e00698866da35285cc7fa4e0f7f08a12b94efaf8a7149fb79064dd675d4503d7d7bffb94057c3fc0fd20180b615a217fb6afb52af4c3956e43a865351aae4fbda6064356d78e58797a437c2c9163413c575df7f9b334d03cdba63dc6d40bf120306db6191248cc9fcb7f23883f52356c66c2bd4246d6a77e9415e959cfb328a3ca02e333510fe180ccab649f79eb1ed57199456d5bc312b18755f00a9db961d775e30795fd1462fbda4244d1ed73a1f9fdd4151b7a19641e1e8fae4c30368a33f84738408f7dd5bdd21fee284c325099029147e2a7588f8ca60cf9a5902fb52f0e7ecb6f3b8d9f15080e2cc3d6098608ed2b6180342e87add870200d7963605aca743fb5bc7551c98a3a6df4d30e80d0023de7c4214f54002f08079fbc94e988d058bff68b7a2b640dbbedd217cadbf4569159860a7488b03943ba012012c5e77b118159badbd0e1ff7e4876613f63e4146496f1d55f8c4ce55d490d8d17280700839fa3caec447494974aed415692113b1beed01b8e148ae37553424bfc20ff2610a798ec3b7d05723ad6f7b04d52802013480529c4a9f79ee3370f11eb4742a0246347f6a483d95ca193dffa689c6eb54066ef125b34a184881f7707ade65c19f9e82dc201b656f3731791cb9feaadf21e3144dc45b70c83871c486fbe40ee59b801e0b35e3fc201fe415b9a1f3be4c698531ae7584b54ed715f19eaf6bf2e6f26868227c21b8f0ef2c67a1b01e4d71823229c", @generic="857b13018e7d8268e8676ed77390d6398e62506302eb5a9358e82b80df4f7b9ab36f4527001951365ba07b508f242488740cecf8fb9a2713ddf41532f167a0470d66d1efdbf6455844eaacea049428e559cc893e41fe1729e255fa7b46b86aa3d5d872fea833452e69d036b0f34d5b4e12aafb81b59d6d", @typed={0xc, 0x4, @u64=0x5}, @generic="000bf987646a2093823d243a1b10c87353279e9f981d167cc6e05e80996867eaec89cddb6c597937dffb0020a8105eca3c1a4c1fd73c2f04697f4b6bddcde645f343b4afd5518254bdc584b8e72695348e93b1889e255da4c60fc717f108de15fbf6b0c7ce2d502f4a54269631424c8d8befbd028441009b8ce1391fbc3ef6b0a635dc1e5164b21a3d974aa5693c4ec0cd1b6b79af517ecb2063df9a5cf6f431a08aa1d7b39b", @typed={0x8, 0x44, @fd=r4}, @generic="99a0d8495adaf11106347fb3ea43b65fe7064e45336be9fc63fbe2db2527706323216a4ce95745a3f3af8c28f40687863f87fe3ec0471e0c480f4889aef235207dbded3464fcdc7a6196379d66cc7b316eff3182f1bc78791ab2475abd9a140d00e18c52e778dce0bf2bf7f07a72ede39a6323bc5b309382000dfc57e31cd221461ef6a75c9c0b728f7fe4f821b106b5ec418b33172cfa758e2df0c09c38dda0155192e35a083c6f3548435d23e109fd620eabcd170c47eb712930c8504aac0907dab1b5cc09e0c5b93a7c2328052d013e346cafd458b931825196033bbf3583c3473eb31d85c864e7c5", @typed={0xc, 0x7f, @str='net/raw\x00'}, @generic="a7cf06323f190377699da4d77045761fe5a3d62cc9fa7f5efe46964e3ded35dc0e7fe4997735e3eb978eeba911b0054668d2f44d10313e6d4c6df1a5a769643aee69828465740ef4b7cd06c7af609a373fab2ddef8919c5f5b6de7455040b40093fbb8cd956ce9c0e48c72d88057a2a47aded39dd02fe9e79a90c05c2f60ccfeb01e8d88454a6846a11b8e810905acfc82106a35f4c9cc1773f69818aae78f42e72fb85918fd15e0be069f21735d4734309d88998044987632423328473b55b409de372d28483f0390e3fc8c2d5cf5b4fa84f6cc71bd", @typed={0x70, 0x48, @binary="af5216ce54d90e8a1a7fc03ab1357f24e5f1a982c68edfef593861883a243eae979be9db6c890b4583bd03af7bca4ea0dd4e20e0b7f7d55a0d7e21b8f5ae5660e4d6ca98a8008679042c87dab6186f8d2e23b75636fd8e53fb446377ed0933a1cd9f48416b85c00fe54d"}]}]}, 0x1a24}, 0x1, 0x0, 0x0, 0x14001000}, 0x4010000) r5 = syz_open_pts(r0, 0x2200) pipe(&(0x7f0000000480)={0xffffffffffffffff, 0xffffffffffffffff}) write(r6, &(0x7f0000000340), 0x41395527) ppoll(&(0x7f0000000240)=[{r0, 0x4988}, {r2, 0x20}, {r3, 0x320}, {r0, 0x10}, {r5, 0x20}, {r6, 0x400}, {r0, 0x200}], 0x7, &(0x7f0000000280), &(0x7f00000002c0)={0x9}, 0x8) r7 = openat$selinux_mls(0xffffffffffffff9c, &(0x7f0000000140)='/selinux/mls\x00', 0x0, 0x0) r8 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000200)='TIPCv2\x00') sendmsg$TIPC_NL_BEARER_SET(r7, &(0x7f00000002c0)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x20000}, 0xc, &(0x7f0000000240)={&(0x7f00000003c0)={0x128, r8, 0x100, 0x70bd29, 0x25dfdbff, {}, [@TIPC_NLA_MEDIA={0x38, 0x5, [@TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'ib\x00'}, @TIPC_NLA_MEDIA_PROP={0x24, 0x2, [@TIPC_NLA_PROP_WIN={0x8, 0x3, 0x7a2d627a}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x1}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x3}, @TIPC_NLA_PROP_PRIO={0x8}]}, @TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'ib\x00'}]}, @TIPC_NLA_NODE={0x14, 0x6, [@TIPC_NLA_NODE_ADDR={0x8, 0x1, 0x3}, @TIPC_NLA_NODE_ADDR={0x8, 0x1, 0x4a49}]}, @TIPC_NLA_LINK={0x28, 0x4, [@TIPC_NLA_LINK_PROP={0x24, 0x7, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x11}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x1f}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_WIN={0x8}]}]}, @TIPC_NLA_LINK={0xa0, 0x4, [@TIPC_NLA_LINK_PROP={0x14, 0x7, [@TIPC_NLA_PROP_WIN={0x8}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x8}]}, @TIPC_NLA_LINK_PROP={0x24, 0x7, [@TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x5}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x4}]}, @TIPC_NLA_LINK_NAME={0xc, 0x1, 'syz1\x00'}, @TIPC_NLA_LINK_PROP={0x1c, 0x7, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0x92ce}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x5}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x8}]}, @TIPC_NLA_LINK_PROP={0x3c, 0x7, [@TIPC_NLA_PROP_TOL={0x8, 0x2, 0x8}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x8}, @TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x4}, @TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_TOL={0x8}]}]}]}, 0x128}}, 0x0) sendmsg$TIPC_NL_MON_GET(0xffffffffffffffff, &(0x7f0000002040)={&(0x7f0000001f00)={0x10, 0x0, 0x0, 0x6181407aa30c06c}, 0xc, &(0x7f0000002000)={&(0x7f0000002080)=ANY=[@ANYBLOB="c2ab9ffc79e96be491f4ac67de98685f6a6709bed702d01b7f0af8cefe0b941c74632076e79fe7b071839a55d84f9a39ecb56f2d38759fd67138dba44646ec0f37c534e8d04f09d9744a8a4bd5a4f984d59f5a2ea359692b6d202f7d9e", @ANYRES16=r8, @ANYBLOB="020029bd7000fcdbdf251200000040000200080002000900000004000400080002000600000008000100f40d0000040004000400040008000200020000000400040008000200d7040000040004000c0002000800020000000000240006000400020004000200080001000100008004000200080001000010000004000200240002000400040008000100000000000800020008000000080002000600000004000400"], 0xa8}, 0x1, 0x0, 0x0, 0x40000}, 0x10) pipe(&(0x7f0000000480)={0xffffffffffffffff, 0xffffffffffffffff}) write(r9, &(0x7f0000000340), 0x41395527) getsockopt$packet_buf(r9, 0x107, 0x6, &(0x7f0000000300)=""/82, &(0x7f0000000380)=0x52) clone(0xd63e02a3dbef423c, &(0x7f0000000080)="1d5c55be74d5f078436072c92f3a51f3cc458e57fe66d0e2d61a7866ad203ea012df7b23d47fc0fbce57673c0885b789771a9c7298d70d75f0f4eb0c5483845636893bc6bdb268bc63aa568673a7364ce156e22f1bae25cd445fa58a74eee3c7d1bcf96749abadb98936fc6c03a33299559c333e3183c0677fde6d618dfdbfcc896d79cbf8648eade1ff505d5214d1bc449263223614a9a54b25176bd8faf9205a7f1f63ce6f876144110b7341a7fe304f9978074a924cb7526b71e8f880143f87812d7066c388c9c0d528a80a", &(0x7f0000000180), &(0x7f00000001c0), &(0x7f0000000200)="955604d45e554d8b7666b1f67205b01c1b12") vmsplice(r5, &(0x7f0000000000)=[{&(0x7f0000000500), 0xfffffffffffffcbc}], 0x1, 0x0) ioctl$int_out(r1, 0x5462, &(0x7f0000000040)) 16:20:42 executing program 4: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r2, 0x40045431, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1}) syz_open_pts(r2, 0x0) ioctl$TIOCMIWAIT(r2, 0x545c, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0xf) r3 = openat$selinux_avc_cache_threshold(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/avc/cache_threshold\x00', 0x2, 0x0) ioctl$TCSETSW(r3, 0x5403, &(0x7f0000000080)={0xfffffffffffffff8, 0x82, 0x7ff, 0x7fffffff, 0xf, 0x6, 0x800, 0xfff, 0x80000001, 0x7, 0xfffffffffffffffc}) fstat(r0, &(0x7f0000000180)) [ 1753.271143] binder: 10005:10029 BC_FREE_BUFFER u0000000000000000 no match [ 1753.285963] binder: 10005:10029 BC_INCREFS_DONE u0000000000000001 no match [ 1753.302362] binder: 10005:10029 BC_REQUEST_DEATH_NOTIFICATION invalid ref 1 [ 1753.312957] binder: 10005:10029 BC_DEAD_BINDER_DONE 0000000000000000 not found 16:20:42 executing program 4: pipe(&(0x7f0000000480)={0xffffffffffffffff}) openat$smack_task_current(0xffffffffffffff9c, &(0x7f0000000100)='/proc/self/attr/current\x00', 0x2, 0x0) vmsplice(r0, &(0x7f0000000000), 0x0, 0x0) getsockopt$inet6_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000000), &(0x7f0000000080)=0x14) openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000240)) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000180)='/dev/vga_arbiter\x00', 0x40300, 0x0) ioctl$TIOCSETD(r2, 0x5423, &(0x7f0000000040)=0x20000010000010) pipe(&(0x7f0000000480)={0xffffffffffffffff}) vmsplice(r3, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) getsockopt$inet_tcp_TCP_REPAIR_WINDOW(r3, 0x6, 0x1d, &(0x7f00000001c0), &(0x7f0000000200)=0x14) [ 1753.320519] binder: 10005:10029 ioctl c0306201 20000300 returned -14 [ 1753.995553] binder: 10005:10015 unknown command 1342464772 [ 1754.001429] binder: 10005:10015 ioctl c0306201 20000140 returned -22 [ 1754.008437] binder: 10005:10051 BC_FREE_BUFFER u0000000000000000 no match [ 1754.015724] binder: 10005:10051 BC_INCREFS_DONE u0000000000000001 no match [ 1754.022980] binder: 10005:10051 BC_REQUEST_DEATH_NOTIFICATION invalid ref 1 [ 1754.030617] binder: 10005:10051 BC_DEAD_BINDER_DONE 0000000000000000 not found [ 1754.038035] binder: 10005:10051 ioctl c0306201 20000300 returned -14 16:20:43 executing program 2: r0 = syz_open_procfs(0x0, &(0x7f0000000080)='net/dev_snmp6\x00') r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r1, 0x40045431, &(0x7f00000000c0)) r2 = syz_open_pts(r1, 0x0) r3 = dup3(r2, r0, 0x0) ioctl$TCXONC(r3, 0x540a, 0x0) pselect6(0x40, &(0x7f0000000340)={0x9}, 0x0, 0x0, 0x0, 0x0) pipe(&(0x7f0000000480)={0xffffffffffffffff}) vmsplice(r4, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) ioctl$TCSETS(r4, 0x5402, &(0x7f0000000000)={0x426c, 0x4, 0x6, 0x8, 0xf, 0x9, 0x10000, 0xc00000000, 0x7be, 0x90d9, 0x8, 0x5}) pipe(&(0x7f0000000480)={0xffffffffffffffff, 0xffffffffffffffff}) write(r5, &(0x7f0000000340), 0x41395527) setsockopt$IPT_SO_SET_REPLACE(r5, 0x0, 0x40, &(0x7f00000004c0)=@mangle={'mangle\x00', 0x1f, 0x6, 0x578, 0x308, 0x200, 0x0, 0x200, 0x200, 0x4e0, 0x4e0, 0x4e0, 0x4e0, 0x4e0, 0x6, &(0x7f0000000100), {[{{@ip={@dev={0xac, 0x14, 0x14, 0xc}, @initdev={0xac, 0x1e, 0x0, 0x0}, 0xff, 0xffffff00, 'veth1_to_team\x00', 'veth0\x00', {0x17e}, {0xff}, 0x5e, 0x2, 0xa2}, 0x0, 0x118, 0x140, 0x0, {}, [@common=@osf={0x50, 'osf\x00', 0x0, {'syz1\x00', 0x4, 0x4, 0x1}}, @common=@ah={0x30, 'ah\x00', 0x0, {0x8, 0x1, 0x1}}]}, @ECN={0x28, 'ECN\x00', 0x0, {0xd41dee9b1b3a1df6, 0xd5, 0x3}}}, {{@ip={@remote, @broadcast, 0xffffff00, 0xff000000, 'caif0\x00', 'syz_tun\x00', {0x7f}, {0x101}, 0x89, 0x2, 0x2}, 0x0, 0x98, 0xc0}, @TTL={0x28, 'TTL\x00', 0x0, {0x0, 0xc000000000000}}}, {{@uncond, 0x0, 0xe0, 0x108, 0x0, {}, [@common=@unspec=@ipvs={0x48, 'ipvs\x00', 0x0, {@ipv4=@loopback, [0xff, 0xff000000, 0xff000000, 0xffffffff], 0x4e23, 0x5e, 0x4, 0x4e21, 0x8, 0x2}}]}, @ECN={0x28, 'ECN\x00', 0x0, {0x21, 0x9}}}, {{@uncond, 0x0, 0xe8, 0x118, 0x0, {}, [@inet=@rpfilter={0x28, 'rpfilter\x00', 0x0, {0xd}}, @inet=@rpfilter={0x28, 'rpfilter\x00', 0x0, {0x4}}]}, @TPROXY={0x30, 'TPROXY\x00', 0x0, {0x1, 0x9, @loopback, 0x4e23}}}, {{@ip={@remote, @broadcast, 0x80ffff80, 0x0, 'syzkaller0\x00', 'eql\x00', {}, {}, 0x2, 0x1, 0x1}, 0x0, 0x98, 0xc0}, @common=@inet=@SYNPROXY={0x28, 'SYNPROXY\x00', 0x0, {0x4, 0x1, 0x7}}}], {{[], 0x0, 0x70, 0x98}, {0x28}}}}, 0x5d8) 16:20:43 executing program 5: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) pipe(&(0x7f0000000080)) r2 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000100)='IPVS\x00') sendmsg$IPVS_CMD_SET_SERVICE(0xffffffffffffffff, &(0x7f0000000200)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f00000001c0)={&(0x7f0000000140)={0x78, r2, 0x402, 0x70bd2a, 0x25dfdbfd, {}, [@IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x100000001}, @IPVS_CMD_ATTR_DEST={0x30, 0x2, [@IPVS_DEST_ATTR_ACTIVE_CONNS={0x8, 0x7, 0x3}, @IPVS_DEST_ATTR_L_THRESH={0x8, 0x6, 0x5}, @IPVS_DEST_ATTR_ADDR={0x14, 0x1, @ipv6=@local}, @IPVS_DEST_ATTR_WEIGHT={0x8, 0x4, 0x2}]}, @IPVS_CMD_ATTR_DAEMON={0x24, 0x3, [@IPVS_DAEMON_ATTR_STATE={0x8, 0x1, 0x1}, @IPVS_DAEMON_ATTR_MCAST_TTL={0x8, 0x8, 0x5}, @IPVS_DAEMON_ATTR_MCAST_GROUP={0x8, 0x5, @dev={0xac, 0x14, 0x14, 0x11}}, @IPVS_DAEMON_ATTR_MCAST_GROUP={0x8, 0x5, @initdev={0xac, 0x1e, 0x0, 0x0}}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x6}]}, 0x78}, 0x1, 0x0, 0x0, 0x62e759b80cc66c8b}, 0x4010840) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r3 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS2(r3, 0x402c542b, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, 0x0, "c41e495183430405e274ccf7defb07f5340067"}) dup(r0) 16:20:43 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f00000003c0)="11dca50d5e0bcfe47bf070") r1 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r1, &(0x7f0000000100)={0x2, 0x4e20}, 0x10) connect$inet(r1, &(0x7f0000000cc0)={0x2, 0x4e20, @local}, 0x10) setsockopt$SO_TIMESTAMPING(r1, 0x1, 0x25, &(0x7f00000010c0)=0x19ff, 0x4) sendto$inet(r1, &(0x7f0000000140)="b0", 0xfffffffffffffd97, 0x0, 0x0, 0x0) prctl$PR_SET_MM_AUXV(0x23, 0xc, &(0x7f0000000000)="0dc954d9992c92aa9e0e3a12bca5ed11f0ac16c430cf", 0x16) recvmmsg(r1, &(0x7f0000003b40)=[{{0x0, 0x0, 0x0}}], 0x1, 0x2000, 0x0) 16:20:43 executing program 1: munmap(&(0x7f0000ffc000/0x1000)=nil, 0x1000) r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/raw\x00') pread64(r0, 0x0, 0x0, 0x800000000002) setsockopt$inet_udp_encap(r0, 0x11, 0x64, &(0x7f0000000040)=0x2, 0x4) pipe(&(0x7f0000000480)={0xffffffffffffffff}) vmsplice(r1, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) dup(r1) 16:20:43 executing program 0: bpf$PROG_LOAD(0x5, &(0x7f0000000100)={0x1, 0x3, &(0x7f0000000580)=ANY=[@ANYBLOB="850000002e000000840000049d0000009500000000000000819d3c6bae5eca1d504e54789afb803c20678c1ff036d5bd373041918f6635ed128260f2def7160498f13019ad6f637eac19e7511fc5051a208c3b4f52e8dd3ae7a83ee1225e967c565c8144429b0000000000d0becddd201e759f83f6f79bef2ee566480db158e479aa42514fcee61b0dfc01d66ccdc146b756cacef584f5e8e86e6ae552d43620081335fdb44ce1e2addda722c21a3f15cecf4eaa00000000000000"], &(0x7f0000000240)='EP\xd4\x00\x1f\x91\xeb/W\xb72$C0%\x03\x9c0\x96\xb2\fkC\x93H\xbfh\x9c\b`\x857\xd6\">c\xad\xc0bO\xba\xe2\xe1\t5\x9d\xcei\"2L\xcc\x13\x16\vh\xca\xe6C\x06\x97%\x9d\xd5-\x1fs\xe1j\xdc5\x92\xd0)%\xdf\xfa\xe8^\x9c\xd29\x8clg\xc8\x7f\xb5\xb1&\x02\xf1E\xb4\x84\xbeE\x91)f\xe8\xb7\xe2\xf6`i\xc5m\xd7l\x1d\xc1\x12\x01<:kM\xe9\x99\xcd\xcd\xc8\x85Z\xee47\xdc\xc8u\x80\xcf\xbeTo\xbb\xfb\xc0\xebV\xd8\xbb\xbe\xa2\x90J|s\xc2', 0x1, 0x348, &(0x7f0000000480)=""/195}, 0x48) r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) creat(&(0x7f0000000240)='./file0/file0/../file0\x00', 0x24) r2 = dup2(r1, r0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) pipe(&(0x7f0000000480)={0xffffffffffffffff, 0xffffffffffffffff}) write(r3, &(0x7f0000000340), 0x41395527) getpeername(r3, &(0x7f0000000040)=@pppol2tpin6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @mcast1}}}, &(0x7f00000000c0)=0x80) r5 = syz_genetlink_get_family_id$fou(&(0x7f0000000080)='fou\x00') sendmsg$FOU_CMD_GET(0xffffffffffffffff, &(0x7f00000001c0)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x245e2311}, 0xc, &(0x7f0000000180)={&(0x7f0000000680)=ANY=[@ANYBLOB="240008000e95203734b69ff21e564de6076ff0aae92b22d9ff0fdd7b627df23c1ee61f0d365a5d94c34b47ca2997dc0700d22477b4198c8be101e1a7c7b1d3814400000068e0e16b58763dbcca500595307397958c7227c9f749dbe1c604992c281b0c42871d3919f100"/124, @ANYRES16=r5, @ANYRESHEX=0x0], 0x3}, 0x1, 0x0, 0x0, 0x40800}, 0x8000) r6 = openat(0xffffffffffffff9c, &(0x7f00000003c0)='./file0/file0\x00', 0x20000, 0x60) accept$packet(0xffffffffffffffff, &(0x7f0000000400)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000440)=0x14) r8 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r8, 0x40045431, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1}) syz_open_pts(r8, 0x0) ioctl$TCSETS(r8, 0x5402, &(0x7f0000000340)={0x0, 0x2b46dbb0, 0x3, 0x8, 0x2, 0x80000001, 0x5, 0x4, 0x100, 0x7, 0x3, 0x9}) ioctl$sock_inet6_SIOCSIFDSTADDR(r6, 0x8918, &(0x7f0000000480)={@mcast2, 0x3f, r7}) mincore(&(0x7f0000ffc000/0x4000)=nil, 0x4000, &(0x7f0000000740)=""/102) sendmsg$FOU_CMD_DEL(r4, &(0x7f0000000200)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x203}, 0xc, &(0x7f00000001c0)={&(0x7f0000000180)={0x34, r5, 0x10, 0x70bd2d, 0x25dfdbfc, {}, [@FOU_ATTR_IFINDEX={0x8, 0xb, r7}, @FOU_ATTR_AF={0x8, 0x2, 0x2}, @FOU_ATTR_IPPROTO={0x8, 0x3, 0x6c}, @FOU_ATTR_IPPROTO={0x8, 0x3, 0xd9}]}, 0x34}, 0x1, 0x0, 0x0, 0x4008800}, 0x80000) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000380)=ANY=[@ANYBLOB="04630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000300)={0x8, 0x0, &(0x7f00000004c0)=[@acquire={0x40046304}], 0xb19b868c1a8b328c, 0x0, 0x0}) pipe(&(0x7f0000000480)={0xffffffffffffffff}) vmsplice(r9, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) openat$selinux_load(0xffffffffffffff9c, &(0x7f0000000640)='/selinux/load\x00', 0x2, 0x0) ioctl$RTC_AIE_OFF(r9, 0x7002) 16:20:43 executing program 4: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0xf) pipe(&(0x7f0000000480)={0xffffffffffffffff}) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) accept4$inet(r2, &(0x7f0000000000)={0x2, 0x0, @empty}, &(0x7f0000000080)=0x10, 0x40000) 16:20:43 executing program 5: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ptmx\x00', 0x0, 0x0) creat(&(0x7f00000000c0)='./file0\x00', 0x5f1b52303e649b0) chmod(&(0x7f0000000100)='./file0\x00', 0x40) ioctl$TIOCGISO7816(r1, 0x80285442, &(0x7f0000000080)) ioctl$TCSETS2(r1, 0x402c542b, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, 0x0, "c41e495183430405e274ccf7defb07f5340067"}) 16:20:43 executing program 5: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000080)='/dev/vga_arbiter\x00', 0x100001, 0x0) getsockopt$inet6_IPV6_FLOWLABEL_MGR(r1, 0x29, 0x20, &(0x7f00000000c0)={@ipv4={[], [], @local}, 0x9, 0x1, 0xff, 0xd, 0x0, 0x5}, &(0x7f0000000100)=0x20) r2 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS2(r2, 0x402c542b, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, 0x0, "c41e495183430405e274ccf7defb07f5340067"}) 16:20:43 executing program 5: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ptmx\x00', 0x0, 0x0) pipe(&(0x7f0000000480)={0xffffffffffffffff}) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) getsockopt$SO_TIMESTAMP(r2, 0x1, 0x40, &(0x7f0000000080), &(0x7f00000000c0)=0x4) ioctl$TCSETS2(r1, 0x402c542b, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, 0x0, "c41e495183430405e274ccf7defb07f5340067"}) [ 1754.249516] binder: 10069:10084 ioctl c0306201 20000300 returned -14 16:20:44 executing program 2: r0 = syz_open_procfs(0x0, &(0x7f0000000080)='net/dev_snmp6\x00') ioctl$KDSKBMODE(r0, 0x4b45, &(0x7f0000000000)=0x7fffffff) r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r1, 0x40045431, &(0x7f00000000c0)) r2 = syz_open_pts(r1, 0x0) r3 = dup3(r2, r0, 0x0) ioctl$TCXONC(r3, 0x540a, 0x0) pselect6(0x40, &(0x7f0000000340)={0x9}, 0x0, 0x0, 0x0, 0x0) 16:20:44 executing program 2: r0 = gettid() ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x3c) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r0, 0x0, 0x0) r1 = gettid() ptrace$setopts(0x4206, r1, 0x0, 0x0) tkill(r1, 0x3c) ptrace$cont(0x18, r1, 0x0, 0x0) ptrace$setregs(0xd, r1, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r1, 0x0, 0x0) getpid() r2 = syz_open_procfs(0x0, &(0x7f00000002c0)='net/tcp6\x00') r3 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ptmx\x00', 0x0, 0x0) r4 = gettid() ptrace$setopts(0x4206, r4, 0x0, 0x0) tkill(r4, 0x3c) ptrace$cont(0x18, r4, 0x0, 0x0) ptrace$setregs(0xd, r4, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r4, 0x0, 0x0) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000100)={r4, 0xffffffffffffffff, 0x0, 0xa, &(0x7f0000000000)='/dev/ptmx\x00'}, 0x30) r6 = open$dir(&(0x7f0000000180)='./file0\x00', 0x80003, 0x19) clock_gettime(0x0, &(0x7f0000000200)={0x0, 0x0}) clock_gettime(0x0, &(0x7f0000000240)={0x0, 0x0}) utimensat(r6, &(0x7f00000001c0)='./file0\x00', &(0x7f0000000280)={{r7, r8/1000+10000}, {r9, r10/1000+30000}}, 0x0) sched_setparam(r5, &(0x7f0000000140)=0x100) ioctl$TCSETS(r3, 0x40045431, &(0x7f00000000c0)) r11 = syz_open_pts(r3, 0x0) r12 = dup3(r11, r2, 0x0) ioctl$TCXONC(r12, 0x540a, 0x0) pselect6(0x40, &(0x7f0000000340)={0x9}, 0x0, 0x0, 0x0, 0x0) 16:20:44 executing program 1: r0 = openat$selinux_policy(0xffffffffffffff9c, &(0x7f0000000040)='/selinux/policy\x00', 0x0, 0x0) ioctl$ASHMEM_PURGE_ALL_CACHES(r0, 0x770a, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000000)='net/raw\x00') pread64(r1, 0x0, 0x0, 0x800000000002) 16:20:44 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) r2 = dup2(r1, r0) ioctl$FS_IOC_SETVERSION(r2, 0x40087602, &(0x7f0000000040)=0x401) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000380)=ANY=[@ANYBLOB="04630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000300)={0x8, 0x0, &(0x7f00000004c0)=[@acquire={0x40046304}], 0xb19b868c1a8b328c, 0x0, 0x0}) ioctl$FS_IOC_GET_ENCRYPTION_POLICY(r1, 0x400c6615, &(0x7f0000000080)) 16:20:44 executing program 2: r0 = syz_open_procfs(0x0, &(0x7f0000000080)='net/dev_snmp6\x00') r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r1, 0x40045431, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x800000001ff, 0xffffffffffffff3c}) r2 = syz_open_pts(r1, 0x0) getsockopt$inet6_opts(r0, 0x29, 0x62, &(0x7f0000000000)=""/41, &(0x7f0000000100)=0x29) r3 = dup3(r2, r0, 0x0) ioctl$TCXONC(r3, 0x540a, 0x0) pselect6(0x40, &(0x7f0000000340)={0x9}, 0x0, 0x0, 0x0, 0x0) 16:20:44 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f00000003c0)="11dca50d5e0bcfe47bf070") r1 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r1, &(0x7f0000000100)={0x2, 0x4e20, @rand_addr=0xffffffffffffeffc}, 0xd8) r2 = socket$nl_route(0x10, 0x3, 0x0) setsockopt$sock_int(r2, 0x1, 0xa, &(0x7f0000000000)=0x7, 0x4) connect$inet(r1, &(0x7f0000000cc0)={0x2, 0x4e20, @local}, 0x10) setsockopt$SO_TIMESTAMPING(r1, 0x1, 0x25, &(0x7f00000010c0)=0x19ff, 0x4) sendto$inet(r1, &(0x7f0000000140)="b0", 0x1, 0x0, 0x0, 0x0) recvmmsg(r1, &(0x7f0000003b40)=[{{0x0, 0x0, 0x0}}], 0x1, 0x2000, 0x0) 16:20:44 executing program 4: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0xf) pipe(&(0x7f0000000480)={0xffffffffffffffff}) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) write$P9_RLERRORu(r2, &(0x7f0000000000)={0x1e, 0x7, 0x1, {{0x11, 'cgroup(-mime_type'}}}, 0x1e) [ 1755.064942] binder: 10115:10118 ioctl 40087602 20000040 returned -22 [ 1755.095319] binder: 10115:10118 ioctl c0306201 20000300 returned -14 16:20:44 executing program 1: r0 = getpid() r1 = syz_open_procfs(r0, &(0x7f00000000c0)='net/raw\x00\xee\xca\x9b\xc8\xc8(,b\x01\x1f\xba\xcf\x1b\xbbl\x99\xbf\xa8\x82>W\xe2\x87\xf9\xfeQj\x10A\xa9RaIj\xdcBS \xd0L\xbc\xec\x1d\xfd\xd0E\xbcr\xc6/\x8c\x9f\xc4\x11O{\xaf0\xbe\xcc\xf9\xc4\x98f\x8a\xc0`\x11d\x19J\x91W\xbc-\xe5a\x8d\xf5\xed\xacX\xd4\x99{\xf2\xc9cC:\x1f\v\xfa_r\b\r>yv\xe9*c\xe6\b\x00\xd1af\x11\xe8\xcc\xf5v\xb4\x85\x8a\xb0\x11M\xd4\xc0\t\t\xaf:X\x1a\x01p\xe7\x17\xca\x8d\x06w\xa2\xaa\xb6\x9ee\xe86\xb4\xb1\xe7_\xcb\xea(Si\x82\x85-\xde\x93\xe6\xe8\x1c\xf8P\xa6\x11}\xd2O\xff\xdc\xb6\x12s:\x18\xfa\x1e\xb2}\xcb\x96%WM\xd7~\xda\xb2\xba\xab\xdc\xef\x10\x8a\xa8\x88\xbb\xe6\xd1;\x17\xc85\xc2eW\xc8\x03\xd4\x06\x10\xfa\xfd\x90=\x96\xde\x94\x92\x00\x00\x00') r2 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vga_arbiter\x00', 0x0, 0x0) ioctl$PERF_EVENT_IOC_RESET(r2, 0x2403, 0xffff) prctl$PR_GET_PDEATHSIG(0x2, &(0x7f00000006c0)) pread64(r1, 0x0, 0x0, 0x800000000002) pipe(&(0x7f0000000480)={0xffffffffffffffff, 0xffffffffffffffff}) write(r3, &(0x7f0000000340), 0x41395527) readv(r3, &(0x7f0000000600)=[{&(0x7f0000000000)=""/13, 0xd}, {&(0x7f00000001c0)=""/128, 0x80}, {&(0x7f0000000080)=""/12, 0xc}, {&(0x7f0000000240)=""/217, 0xd9}, {&(0x7f0000000340)=""/128, 0x80}, {&(0x7f00000003c0)=""/168, 0xa8}, {&(0x7f0000000480)=""/126, 0x7e}, {&(0x7f0000000500)=""/52, 0x34}, {&(0x7f0000000540)=""/81, 0x51}, {&(0x7f00000005c0)=""/58, 0x3a}], 0xa) 16:20:44 executing program 2: r0 = syz_open_procfs(0x0, &(0x7f0000000080)='net/dev_snmp6\x00') r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r1, 0x40045431, &(0x7f00000000c0)={0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd}) r2 = syz_open_pts(r1, 0x0) r3 = dup3(r2, r0, 0x0) r4 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r4, 0x40045431, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1}) syz_open_pts(r4, 0x0) r5 = syz_open_pts(r4, 0x100) ioctl$TIOCLINUX5(r5, 0x541c, &(0x7f0000000000)={0x5, 0x4, 0x251, 0x100000000, 0x7}) ioctl$TCXONC(r3, 0x540a, 0x0) pselect6(0x40, &(0x7f0000000340)={0x9}, 0x0, 0x0, 0x0, 0x0) 16:20:44 executing program 5: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ptmx\x00', 0x0, 0x0) r2 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ptmx\x00', 0x0, 0x0) r3 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r3, 0x40045431, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1}) syz_open_pts(r3, 0x0) ioctl$FS_IOC_SETFSLABEL(r3, 0x41009432, &(0x7f0000000200)="f0bf5ce3f7ca49c33d063b6a072f0e5cea4e9009271922a09bf2c31496fffde388eab2d1eee2e8bce30b310d3320d1853a79711d7a4f2c438ea808e96b8733f0e21f0c5b978304c997843a53f0ed534ff40d16bbad9a85281d6901bc28ac52eedca873171467793c7fcf4bdf12bdab0245e7eccaea3b670fa4dd1a37cdf62369325659073b506df8b8ef187d2a449ca7d599ae9a01c8359b81b7bc1240a39acd9c43236d20c773d64fe92adc9671e4b9cca239d9ba3453afe3fe75af488f0a171060a9114621c486a9b7d2c390b9b505fec341f7e41a767a13e25973dc476f8e1ec363e80d33261468c7493ba1303a7b5adaff73327b4a9f503a290902d578a9") ioctl$TCSETS(r2, 0x40045431, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1}) syz_open_pts(r2, 0x0) fsetxattr$trusted_overlay_upper(r2, &(0x7f0000000080)='trusted.overlay.upper\x00', &(0x7f00000000c0)={0x0, 0xfb, 0x106, 0x2, 0x4, "a4f982881e481ff9d11909e322b6d067", "1a08028385ec75e2c250637c8fbe1fc021fb9d2ecb2cc72bf0db5a445ac5056c597b4241e6f8b7db2b434f8d43624811f2abda15bb9cb9d0bbd06a820fc8847adcb3e3d004052799d9dbaf82b113309438a540159ad38be5e67315653df14eb9f8642ab1f68a44b19926642c66415b275019a0185229c54e99b0a0475000fcc3d9b303f376546b24db7a7049d3a1848f8f5064b5cdef3a3eced3ec3d677a8c41a8cef477c66bf701a0fe88af93c8960bd52720a2319f5eea990043aac57641b83775afcaae3fd91cfc6e7c55d9c64f5f03932254c626fb81c22883616d64c15fa6482be99f005aafa1dbc8012970ec9222"}, 0x106, 0x5) ioctl$TCSETS2(r1, 0x402c542b, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, 0x0, "c41e495183430405e274ccf7defb07f5340067"}) [ 1755.125092] binder: 10115:10118 ioctl 400c6615 20000080 returned -22 [ 1755.149046] binder: 10115:10118 ioctl 40087602 20000040 returned -22 [ 1755.155798] binder: 10115:10131 ioctl c0306201 20000300 returned -14 16:20:44 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x800) r2 = dup2(r1, r0) r3 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r3, 0x40045431, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1}) syz_open_pts(r3, 0x0) ioctl$PIO_CMAP(r3, 0x4b71, &(0x7f0000000040)={0x400, 0x2, 0x8000, 0xfffffffffffffffb, 0x3, 0xffff}) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000380)=ANY=[@ANYBLOB="ab118393"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000300)={0x8, 0x0, &(0x7f00000004c0)=[@acquire={0x40046304}], 0xb19b868c1a8b328c, 0x0, 0x0}) 16:20:44 executing program 5: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ptmx\x00', 0x0, 0x0) r2 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r2, 0x40045431, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1}) syz_open_pts(r2, 0x0) ioctl$GIO_SCRNMAP(r2, 0x4b40, &(0x7f0000000080)=""/193) ioctl$TCSETS2(r1, 0x402c542b, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, 0x0, "c41e495183430405e274ccf7defb07f5340067"}) 16:20:44 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x800) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) r2 = dup2(r1, r0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000380)=ANY=[@ANYBLOB="04630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000300)={0x8, 0x0, &(0x7f00000004c0)=ANY=[@ANYBLOB="e762000400000001"], 0xb19b868c1a8b328c, 0x0, 0x0}) [ 1755.244936] binder: 10143:10146 unknown command -1820126805 [ 1755.251114] binder: 10143:10146 ioctl c0306201 20000140 returned -22 [ 1755.258830] binder: 10143:10146 ioctl c0306201 20000300 returned -14 [ 1755.276828] binder: 10143:10152 unknown command -1820126805 [ 1755.284986] binder: 10143:10152 ioctl c0306201 20000140 returned -22 16:20:44 executing program 2: r0 = syz_open_procfs(0x0, &(0x7f0000000080)='net/dev_snmp6\x00') r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000140)='/dev/ptmx\x00', 0x0, 0x0) pipe(&(0x7f0000000480)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000100)='./cgroup.cpu/syz1\x00', 0x200002, 0x0) write(r3, &(0x7f0000000180), 0xffffffffffffff29) ioctl$EVIOCGSW(r2, 0x8040451b, &(0x7f0000000000)=""/24) ioctl$TCSETS(r1, 0x40045431, &(0x7f00000000c0)) r4 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r4, 0x40045431, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1}) syz_open_pts(r4, 0x0) r5 = syz_open_pts(r4, 0x0) pipe(&(0x7f0000000480)={0xffffffffffffffff, 0xffffffffffffffff}) vmsplice(r6, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) syz_open_pts(r6, 0x81404) r8 = dup3(r5, r0, 0x0) ioctl$TCXONC(r8, 0x540a, 0x0) write(r7, &(0x7f0000000180)="b2733240955b319f388863d101027c842c5a28e9c5500ecd5414a1b2260f37afbfcb888e778d0c418850f6be0e1edcd26e20e518c633eba4fd503443afe1a66aca1091bd217d1f1bcf5c19ee5d72af37ca1efcabce0ed7e605c1dcf9cfe3f3e05cb78d51cdbb", 0x66) pselect6(0x40, &(0x7f0000000340)={0x9}, 0x0, 0x0, 0x0, 0x0) 16:20:44 executing program 5: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) setsockopt$inet6_int(0xffffffffffffffff, 0x29, 0x21, &(0x7f0000000080)=0x81, 0x4) r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS2(r1, 0x402c542b, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, 0x0, "c41e495183430405e274ccf7defb07f5340067"}) 16:20:44 executing program 0: r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) r1 = openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/commit_pending_bools\x00', 0x1, 0x0) ioctl$BLKBSZSET(r1, 0x40081271, &(0x7f0000000040)=0x82) r2 = dup2(r0, 0xffffffffffffffff) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000380)=ANY=[@ANYBLOB="04630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000300)={0x8, 0x0, &(0x7f00000004c0)=[@acquire={0x40046304}], 0xb19b868c1a8b328c, 0x0, 0x0}) [ 1755.338072] binder: 10155:10159 unknown command 67134183 [ 1755.356057] binder: 10155:10159 ioctl c0306201 20000300 returned -22 16:20:44 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000000)='\x00\xd6\t\x10\xc7m\x00', 0x0, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) r2 = dup2(r1, r0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="a9000000342f14b8d8645523d4764dbfd02b082486465aee746892764aa7038a16bbdd96a3653bab09103d2240442653e5474858bf589edcf8c0c6b244ba41b4250c7bc1baa824986d25f2c253beb3ea117ad8f169555867aa8c6880fbcea7e40509376feee3cea4adb20a70a3dc035535e9633b4bbee8df557dbf096f488d527c4cbca58729ea5bcde2176908013f9f264ecbc8f895792970b685f1b5b21fdbb2932c0a07d2b0d330f5deff799abb5fdb18e63a6552f214799f4ee9847d38dc9956caa8fa08e2cc924b1889724fec26f437e8eb52516326d81c182e07ff0fc05defc3997d0001ba75258a07555c93454ef2bff462d139e37038ef50bc623906b5780a82b54204c37237ac24f1a1cda5d9134b1507486e58693f239be110ecdec13d1a4aa648a9006f33770357a5bf4159280cfd37cfca975000dff4481b4b680428834d951f65b21e5124c69a309587ad42f249f54372e966ce45af5b23f0a1d99fdd90aa1a2671"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000300)={0x8, 0x0, &(0x7f00000004c0)=[@acquire={0x40046304}], 0xb19b868c1a8b328c, 0x0, 0x0}) r3 = add_key$user(&(0x7f00000007c0)='user\x00', &(0x7f0000000a80)={'syz', 0x2}, &(0x7f0000000b00)="c3f63ddd3ce37190a16fb2d31396f9fce5b975241a658aac3f06ac42bffecd4587468be969faf13c0604104998623ee65b6e8b0b467ce62b027ad1c9a7f909db0b210ec556de140a765dff23f11fcba786bf0e93a90c09d15fe549354115414278c387f00e62b2ce4625f7f4e27b34f9bba2b13631c860d07a33f6c654d2c2b9ba8f520e968ce091bea8498ed244740ffc5dcbfabb6e485d44ee17639a9e0a759eb482cc7e11cb4337763950e64b6a1e201ce12b784e09be", 0xb8, 0xfffffffffffffffd) r4 = add_key$keyring(&(0x7f00000009c0)='keyring\x00', 0x0, 0x0, 0x0, 0xfffffffffffffffe) keyctl$reject(0x13, r3, 0x0, 0x0, r4) r5 = add_key$user(&(0x7f0000000040)='user\x00', &(0x7f0000000080)={'syz', 0x3}, &(0x7f0000000180)="c6cae11cd64c63d70c3eb64a82a3a82a2ccf6645597f01e652dfe42f079502bfb947b13f58186230338a108ce3ebdff71ee4235f03dfd4de7805aae22bfcc07d30f54630a2bfefa7598b5042448dca323929d64e0eaff2a2f5931f13f90218e3de416664e76507d0c5fe390bf3730388a2915a34d49f65a7d853506594fbfea5e84a0d52437446c2e7420aa2c742c6216ea545f5e0bd7e8b6f8f1180978e12368d1d63304209d10dfc1568b6f471a1120a5b1cbaf18f10881e83e06abb31250b45a77cbea989259f205c8d0b0f0595fa541e0a7882e01abed0f2361dee7af79ce0ed", 0xe2, r4) keyctl$assume_authority(0x10, r5) 16:20:45 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) pipe(&(0x7f0000000480)={0xffffffffffffffff, 0xffffffffffffffff}) write(r2, &(0x7f0000000340), 0x41395527) getsockopt$inet_tcp_int(r2, 0x6, 0x1b, &(0x7f0000000040), &(0x7f0000000080)=0x4) mknod$loop(&(0x7f0000000240)='./file0\x00', 0x100, 0x1) ioctl(r0, 0x1000008912, &(0x7f00000003c0)="11dca50d5e0bcfe47bf070") r3 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r3, &(0x7f00000000c0)={0x2, 0x4e20, @rand_addr=0x9}, 0x10) connect$inet(r3, &(0x7f0000000cc0)={0x2, 0x4e20, @local}, 0x10) fcntl$setownex(r1, 0xf, &(0x7f0000000100)={0x2, 0xffffffffffffffff}) setsockopt$SO_TIMESTAMPING(r3, 0x1, 0x25, &(0x7f00000010c0)=0x19ff, 0x4) pipe(&(0x7f0000000000)) pipe(&(0x7f0000000480)={0xffffffffffffffff}) vmsplice(r4, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) getsockopt$inet_pktinfo(r1, 0x0, 0x8, &(0x7f0000000180)={0x0, @broadcast, @broadcast}, &(0x7f00000001c0)=0xc) ioctl$sock_inet6_SIOCDIFADDR(r4, 0x8936, &(0x7f0000000200)={@empty, 0x64, r5}) sendto$inet(r3, &(0x7f0000000140)="b0", 0xfffffffffffffe3b, 0x0, 0x0, 0x0) recvmmsg(r3, &(0x7f0000003b40)=[{{0x0, 0x0, 0x0}}], 0x1, 0x2000, 0x0) 16:20:45 executing program 5: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = creat(&(0x7f0000000140)='./file0\x00', 0x8) setsockopt$netlink_NETLINK_CAP_ACK(r1, 0x10e, 0xa, &(0x7f0000000180)=0x1, 0x4) r2 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS2(r2, 0x402c542b, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, 0x0, "c41e495183430405e274ccf7defb07f5340067"}) 16:20:45 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$FS_IOC_SETVERSION(r0, 0x40087602, &(0x7f0000000080)=0x4000000000002) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) r2 = dup2(r1, r0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="0463ac458404a2907ccdcdfbe7e076b8e594cf3e52124d7fece8bff2ed2c657c51901e33701f279075068874f75a92c32c23220400"/64], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000300)={0x8, 0x0, &(0x7f00000004c0)=ANY=[@ANYBLOB="6c5b0b74e6fe25b7"], 0xb19b868c1a8b328c, 0x0, 0x0}) 16:20:45 executing program 2: r0 = syz_open_procfs(0x0, &(0x7f0000000140)='net/dev_snmp6\x00\xe8\x87\b\xad\xac\x0fV\xa2\x87\xe1\xe9\x16\xf5[i0xffffffffffffffff}) vmsplice(r5, &(0x7f0000000180)=[{&(0x7f0000000500), 0x2c997588}], 0x1, 0x0) r6 = socket(0x10, 0x2, 0x0) getsockopt$sock_cred(r6, 0x1, 0x11, &(0x7f0000caaffb)={0x0, 0x0}, &(0x7f0000cab000)=0xc) chown(&(0x7f00000001c0)='./file0\x00', r7, 0x0) ioprio_set$uid(0x4, r7, 0x6) openat$cgroup_procs(r5, &(0x7f0000000100)='cgroup.threads\x00', 0x2, 0x0) 16:20:45 executing program 4: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0xf) syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000001200)='./file0\x00', 0x3, 0x1, &(0x7f0000000100)=[{&(0x7f0000000180)="c8e7795fba45e91ba8c03c0ccf053fbe8d976feb4a206b2b497adbc823d24c8a45001a83932b18016c9285de994974711243517c9e118a0f0ee5eb05fe270309539c4c42863c9e374c73db7a0a7b6a5d65fdf64253755948480ff9dbdd27fc3e6d89c29f3685f7dea9864878b08ef49f8b8dbd44fcfe7c435ed993798e73a3ffbce85b13dfc0bbd0fad476468571c3d897192599efc8fed37dccbbc3d7a2442307dbee421070dcfc37bc800aa5895975d1407a475c6f07937777bae4ddae1a35b6780ef232db54c46f539e922053629e359116d9d5650e2bd03728d6474e08ed023b35d2d51de15590c1f2373edfd72e6697c228577d284c9b41613fe9d90cada0a826db4f07e13b552a726c4af511e9a9ba33a55b5bb0c127151b1e1a81de62fd6bd169c905040b4701c41b27ee08d927ab47b683f67b11630425ce8105f370563ac117b102621ad020c3ff1b2a5b0921e6da6bddd5e9ef7483e2e8acc4838de6a3bf31b1ebe388d344649f387fef50c862d7af9ffb0a4c155dd16d0c41b5c3ca4a840289333688d36db7df12f6b4870ead7a5f82c8f7ac8245aaf6b4b0aa1587998fa0615deade5d865e0d664e513181eae163e61a662a73b500df1876ff83372bdd508871d4fab35d656b7f109a603ed85eff40ffa6ddf2db4cd979cf94281fc0552786cc26a5a5a98d7113e2c3b86feeb38dc890171ce1ad42c89e805e72aa7e4340e8d72da70b459aa759a46827e6d61938f5af5f318840d5c1e2a9d849e6e7d84ed050e14ccdbf6f2796edfd598e5ba9c8f718836ea4f1012463610ef37d86dfe3aae2bc1bfb974d206d9e2a449c6856abc1069cd07c384f0351029224f19b4594b0c6f192b0b08fb2eeeb821124558e09521c172c03ae0d8771840a3550e3e66bdbb7fd76de9b3b6ab681b2c8061bc623131442456ebf72b60715ff07245bef009c210043205ec0b5721f0d0f137edce216bba532ed56623b34638dbfbb448918e9def910b0bb2db06d0c168b10f56fd94e04b533d447d7f4de221057489aec3dbffcd0a1b16922d24b3ca72c41445a45f0849fa371606c64145705ca945e30c3fea48c4fd861b8e852f7f630b325c69faff06ba51ec629785573d91fa0f4c94b134a74cf8527d2f61545480edbfcc1aeb4df7cb283f695b6759fdb0094c32d7ee5d86e142f962940033a90758b40ae3661d22e575d5dd636f97a4bcbecc244a6b2a342f1faeea49af962ec3cde2540a0f0608718a7cccea933cd4e807df6bf580f56275f2ec7ca34767a5e32e197996a6156c9607a0469bd70aaf20802c7327825762f126532bf8ee0631f21eefec6ccd6861074c602476d79f5acf3b2d3b08dcef944787752f69abb24b3562192f42914f32b0e6d81293af223d0e1d594f7f90c858d88a08b27eaea92aa1e05c3fa6e06b7a952e75c5fd782f5522ec6d1e5bba2da63fd2acf6ed2b3658987b476c217dd65cf0004d941d15f517a2e5b91754e1184ea1e038431a988f0d418f7fef40a4bba2766abd1004bc5aa6d67ce3124477adb84215b1067a89939584aef4751f60efdf44fc1725ec7c062ad3af3ce80970d8e7a3a9df8042fda62a231a106fb3a5512d4ca31d0b08743d2acd224b77311f1d1ad54d717f365973126dddb26beb67192c5cb5030eb2d96846ddbb8c07b434d1d72c5f8c825d75b9bee8e715972f47ec146ab4ab5351090738710bc33927793c818c12556b43559fc07d14940dd02a9e526472784d9681fc559033908fdcfe1116909aaa9ece0bca4ebd6fc9cb70a0e4fcafb4812412effea9ace79f4c4978f06fbc9b0a811d1f68f0466ada2b3fb77480d51538d0ba236402544cb3e8eabf6d6757fbc318aafdd75dd8b23cb6ac453c6b7bf66da780fcb98471cb3e33cb3061b5cd8d0cda34c886cd6afac287714cc1a7ff682c7757b009e03eca9200b4f9b9b4cccb1795bb1beb693605fba6e308778339900c7705aa2b48142266b510e84c9e159f104c6c5cc8be088cfe66528f06d83304a6dce69047232baa009a4a48edfa6f5627970ee6826f9f81b67f6dc167c75d022ceff1e51a666db51b5ff2597c0b24099ef4f2f737cb06635fdd483d81ae0c08df400e802a87c84c70899ec59d144540ef1b94fe27df83a9ad3735f25ab72e40e13665c8aaeadee9d2f14dd803d62302e07a022911e0b88cd40c19a1ea07ac2cbf7158bc7a382b6395d2f82f5bbc084a34a28c6c7e99646d7c067a29e21e5e300e66c7cd2ae57b21f1bc57749e14f574a8dc463a276b74ce0ad52436baf6d43352fa52541db9b9c8092e41aee2f17aac6f09a28e18926b8636b38e8b56a9b50a6f34aba0339e5eff1d5087fb47297361d3170f94a76cd79411a759dc9ab308c2bf2508b6f39f3aeb9f32ee004758fde41b21667a25dbd2102f2ffb3a2832f6768c14131511560edc79cff046b90b613c827fed980f4d808e14cef54376c8be4104a7693011f4fd51da90ec654856fb8d78159971a298557aa86be0a7e1e9c9584f91f4fd45058b0fa1517c07c98706aac33ebc1f7793c1f471024929fc7e8ade664183196192fc8bc60b855633662a018802d6f87ce74cbf7165fd9671b02e8087db2478c20ecd04fd58f49b4072b8f8cedc62821be84544ed725d3c714dd976a8cbcc44e3c443041a445e24966781eeb47009cb54541483e348e5b62fc806b37d193d06906cef1f6f2162ebf2ae9578230a22830e0c408ba5c995b456b31fe1196403c929293805d7ece7bb82584005acf3ed9f846e99fd73107fafa836b12a6b62e1706a54966420e429b4eee50e1e1c37200e8e476bfa735cc877d9e29b6da3982a08e0237fe73335b741d19c67ce8d60f431ee2a81ebb82d1fe34d8b6ba26a5ea5e0a4de426614f2b4dea2514ff0ff5e88775cd487418f1f22e3df2689338ab513d685e548dd54636bc535207829c35938bae477f64c591e3906f43f6f09419692f1703533cd49103b8aaac6f10d9c1cd94c4845b87a3c334b5f426eb39a3f24951d6ceac228363b4a61129450b9e0baf4de25ac51271033f6382c428441601d2c83f37fc7ba66eb68316238024b65f985ab9ff4da5b15e95b550a50eea3eeeac75d68793e4237fd4e33c94c37c8cd5fae2b249df732eafc1392a2669b92f00f580b494e26931bb4bf62a122d310241df10a12c5eadd27af7f705ea3ff6d42c7d7539cdd36894afb580f915d547e84b33cd175b7b7919e8d0241f4da6f26f38627e7c12906211e963d574c3b7f86d3d0c8cbbc76fe6186103cdd1198d7cc050263a9cd6bb101017f55dbef30531bb3785d231416736dac59a6e28de3617cc12c895abfd1c9c0dd3573816dffcce71eeb184599c5bfdc3929b82d74742f40af811a1e51c35559cbb83b14d6490986c8eb441ca13eef332a8f5546dfad62b6fb63c4666122282722958a29ae56441c543715a97b403f49205471e9e180b89a168a6247ba6cf9d7b41a749bd7b349ad70417cd335bdbe1bb49539bf8192c2d09489a481ff77a211873910b9fa3455500309caac5f6dd219dbf16adf2ab7e6503961248176f1e559fe9a8b622ef42c2267655ae55fed58ec42e0bfaec2b13e6dd2887c55fabdcd9f7e764894aa34d00c1ae125bc566b1689319e45d59dfd65eae9b541232052eb1f45afc51bc21fb6f4032500e1e12966245dc9f73fbe8aae06a3dd813d5693fda693539b887ef5b1feedc55e777531bd81fdfd28b10cd9923735b4cbbd13dc3bd4deee086a7eb4652e9f37f866f2e904e478ee9c0a3b6f7c943becc1ca01fa1c339686448a6757d72610342ea8de676e81355b9c8e691d5f95a2e73885eeaf1d78595bef1cb0e29e44b6efd6aa9d62d7360aff69b6fa9b5d88c2156ed9cdf7d5f4570f065c43e25cb38b8967da3e509eb2557d614cfc8e85b56d3f8dce2c271839054422dd073cf34c59bf0cc476415d0b3349ef95b30d980b1d2eb2c35e8e2f90e9911488fb0a7a0bcd80b390f3f1f0a88b9218eafb35c7d00b72ec6efa7cfe323de0f0e708711d89f8eabf53f90b2002beb52013cfc17cf9bbea78adbf27a2a12fa5d9888d12f922b9d0aef6f51e259c33a5a58052de1ca58515bd2f908b62cc182b5474fc8c506607fe808824024db1e50bcb19f356806a2102d1c5d2a3ea1663deca7b4a9e7b300c991fe5d07557b88d4d68d26dc8c4a852a98ede7aa8384bb6b8dd0a8e25f46e70bb3cc25b9e8b46a211895380d0233dd5c10e287de2cca2ee461440000412166416220018ad3b0073ac45e5f9a6a948275fefd8fc5677b147ef971f93409ad9ec82d8f90e6b70489d772e145dbfc719c6cbf6b72170290115b7d5b7490cbb185c89f1f8710ca9e4362340a62bcddb1e856212b308960377d1ac5c132f4085dad9c62f4bdcdc96da23a8c02b9eeed146fb2d6c2655de652e9d4a275f07ebe3e46f06cfd89b1803f591ef549c49cb70dbbb3636a9b4b2ada4027c3a4fb532ea3796aac2038ab714946a6e00f27252673a2b4921a0db0f118361aa278d39ba4a838f31e4c2ef38d847d05b0e8905e8952f0d8dc66679de2bfb1c18c5e7c81fc7b26db1210410383a2648ef79e9d4205d2a233c7840ae87735a34ba7c0807e5fec275ce38010182d735917a504faf8ca85e0335d0340a24d0d186b836ad3dc0dcb97c45f8ce305ad7bd0ce47df02cf2d63dc12508b7a82be3c9a47c93def6fc047e09ad76942a08a624008f7ed04296858d2dbb63cfe04700f0f33c7f948878716697fd3c4113a75868e542f94891a4f5f31a67944b62f515ac1e5675c758923b2b05f7e1e277b2d998688cdfea5caff7010321ca1e56cab8fd96b6685f96c3c74e6c6ec72a9ba55b39462b6725758d02e5aa7309cc8088e942855b4519638fec6024eaad1abc0b11d04891cde74ea6a3f66e07efa3ea91e9f7fda9e39b9c0f0b4f0fbc84cb749f6a5f90b1a928b5e4c54cc82ae0c19f73045251ad54666624965528a3b49c52ec495865ffd47f5e98502fc547840aa4eb993b045bf59ade2abcb4e7131bb0a961ed6e1eff9aa47602693f630b24737668a69e75e9eefc26115146f8fdf76456236295eb2dc024bf2a39da3f07c5e476e6ab846a14cf7ee464bcf9935fbb7c6d2b5774ad3912694b21b098b687c638a79b5890488c529c992c7ee275e35092b6d33da3134c6ad3871fac01e6fcbf035290c3ef504e3428e707b8438b051a4b2b00aeef10e75c941d71d25cb07f21dfc0af2d3ce5923e86760b67dcbbc9cee69927631cfb4586e40834d6d78d811102e91129bf1a7fe0c5d3328b030d3dd07acbfe977be752462d571ceab6753656497e22437cdbcaf15e5b901c5be79a2e7b78a4076eb0629fc6c8dd6eb1ae5a549fab647fbaf28d7d0e29991bdf61ba0a73338d33798612d4fb736349ca42bd79858ed55cf986e4e762c44db4d6f0841f34aba09eef8defc3c32c733b7483613e95fbc97d97406725d81aadecafa87708d7775e2c3d0eca647f0b8cb2b02f6383c5914dfcee3ce3e6503a27eb3cdebf5606938f486584b68c8f8f6f6a40178eaaf8ce9aacd22fb72b51cf9b9db5af5d80d91c08c4c46ecf2e86cf6c84e5feeec4fa923c01a22b807be50c9ee87a49fcb035771908128feedac03b7bfe7234401521dbaec38163611cef76336fdcdf6f7388c5b2b9923bfa5a4d75ca339e24d75c373574ec2e224fa1ece12e5b47254c60e1fed95b899832f076eb6e85c6def156aef461f68cc9f57c0356a53d83ac5b65009acd44b84cb074cba4dd9f89d7415df5051d852", 0x1000, 0x7f}], 0x8000, &(0x7f0000001180)={[{@nojournal_checksum='nojournal_checksum'}, {@norecovery='norecovery'}, {@nobarrier='nobarrier'}, {@nogrpid='nogrpid'}, {@errors_continue='errors=continue'}, {@dioread_nolock='dioread_nolock'}, {@noquota='noquota'}]}) 16:20:45 executing program 1: r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/raw\x00') ioctl$KDSKBMODE(r0, 0x4b45, &(0x7f0000000040)=0x1) pread64(r0, 0x0, 0x0, 0x800000000002) 16:20:45 executing program 1: r0 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vga_arbiter\x00', 0x8140, 0x0) ioctl$PIO_UNISCRNMAP(r0, 0x4b6a, &(0x7f0000000080)="830008444f1f15c8ec3d2c5ca710f5e88923ace8e1c9a272fa13cd87cc06594f7d0d2901c6862efed4cc2adbfd208c165adeade30634e1403ed8881626fba311461f9ed62ce2b183a808b4ba389b464a99e4388d9db17744ae7aa37e441ef3661d206af0b79917221fe8553e2ccecff7f01568fcf0842197df7260c9a56df5c1c9f11227edce3ff47b5feb52ea460930") r1 = getpgid(0x0) r2 = syz_open_procfs(r1, &(0x7f0000000000)='net/raw\x00') pread64(r2, 0x0, 0x0, 0x800000000002) [ 1756.054405] binder: 10188:10191 ioctl 40087602 20000080 returned -22 [ 1756.067184] binder: 10188:10191 unknown command 1168925444 [ 1756.074842] binder: 10188:10191 ioctl c0306201 20000140 returned -22 16:20:45 executing program 1: r0 = syz_open_procfs(0x0, &(0x7f0000000040)='7\xf6\x8b^\xab\x16\x13\xaaX\xc0D\xf5yf\xecg\xcf?\xca@\xc9\x00\xc0\xc4\xd9\xd8\xcb\xb61\x12\xdd\x8dk\xf2\x82\xa9\xcc\xf7\x05\xdd\x84\xbd\xa8={-\xfa\x935w\x93|+\xcf\xe8\x90\a\x0e\xba\xd3\x01_\x94\xfb\xb2\xcb0;,\'\xab\xca\xdc\xa3\xb0\x97Q\x06?p\xcb\x02\x90\x16\xb7\x82\xc3\xa4\xe7\xd6\xda\x80\x97db\xb3\xaem\xe8\xb07$i\xf5\x85\x8c\xa8R\xd6UQ\x16lz\xac\xc5&6\x85\xc2\x97\xd5\xe6\xc3z[U\xbb\x8d\f\xf2jXf\xc3\xb8\f\xa6\x9f\xd3\xc8\xffU\xae\vr\r\x10\xc13f\x90\xbd2k2\x01\xe0\nF\xf7\x1d/)\x18\x12\x01\xb7\x05%/\b\x89\xc6)(\x0e\xc5\xae\x88\x94\xd3\x98\\\xed\"\x88?\x06j\x19?\xac\xee!T\x88v\x8bU\a\x7f\xb4\xfcn>\x7f\xe5\xc5\xfd\xfc\xdb\x02\xbaH\xb2,\x9d\x18^\xc6ZL7\xe3.\xe6\x13J{\x7f\x8c\x01 \x80\x008Qrb\x9ex(}:\xe9Yi`\xf1\xf2.\xa8\xc6\xe2=C\xc5f\xc4*\xb5\x8f\xa4\xd9F\x91\x9cm\xc3N6\x99Wr\x9fG\xe6)&\xde\x1c\xfaR&\xaa\x86\xacq\n\xe3(ak\xe7\xc4NC\xa4\x99b8\xfby\x02') pread64(r0, 0x0, 0x0, 0x800000000002) getsockopt$sock_timeval(0xffffffffffffffff, 0x1, 0x15, &(0x7f0000000000), &(0x7f0000000180)=0x10) pipe(&(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) utimensat(r1, &(0x7f0000000200)='./file0\x00', &(0x7f0000000240)={{}, {0x77359400}}, 0x0) 16:20:45 executing program 5: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x420042, 0x0) syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x800) ioctl$TIOCSISO7816(r1, 0xc0285443, &(0x7f0000000040)={0x8001, 0x8, 0x4, 0x101, 0x68295b}) ioctl$TCSETS2(r1, 0x402c542b, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, 0x0, "c41e495183430405e274ccf7defb07f5340067"}) [ 1756.100892] binder: 10188:10191 unknown command 1946901356 [ 1756.109374] binder: 10188:10191 ioctl c0306201 20000300 returned -22 [ 1756.123686] binder: 10188:10191 ioctl 40087602 20000080 returned -22 [ 1756.128814] binder: 10188:10208 unknown command 1168925444 16:20:45 executing program 5: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000080)='/selinux/commit_pending_bools\x00', 0x1, 0x0) ioctl$TCGETS(r1, 0x5401, &(0x7f00000000c0)) r2 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS2(r2, 0x402c542b, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, 0x0, "c41e495183430405e274ccf7defb07f5340067"}) 16:20:45 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) r2 = dup2(r1, r0) syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0x0, 0x803) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000300)={0x8, 0x0, &(0x7f00000004c0)=[@acquire={0x40046304}], 0xb19b868c1a8b328c, 0x0, 0x0}) [ 1756.158029] binder: 10188:10208 ioctl c0306201 20000140 returned -22 16:20:45 executing program 1: pipe(&(0x7f0000000480)={0xffffffffffffffff}) vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) ioctl$FS_IOC_RESVSP(r0, 0x40305828, &(0x7f0000000040)={0x0, 0x0, 0x3, 0x4}) r1 = syz_open_procfs(0x0, &(0x7f0000000000)='net/raw\x00') pread64(r1, 0x0, 0x0, 0x0) [ 1756.286467] binder: 10230:10235 ioctl c0306201 20000300 returned -14 16:20:46 executing program 4: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) pipe(&(0x7f0000000480)={0xffffffffffffffff}) vmsplice(r1, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) r2 = accept4$inet6(r1, 0x0, &(0x7f0000000000), 0x80800) write$binfmt_script(r2, &(0x7f0000000180)={'#! ', './file0', [{0x20, '/dev/ptmx\x00'}], 0xa, "6fb966dee3e5a296bbf74705a568189899be910920007ee57f971d9535d68b845044c495d83b8f1c3f8922bd27b18472fa9c579f12bf66407f97e6"}, 0x51) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0xf) pipe(&(0x7f0000000480)={0xffffffffffffffff, 0xffffffffffffffff}) write(r4, &(0x7f0000000340), 0x41395527) pipe(&(0x7f0000000480)={0xffffffffffffffff, 0xffffffffffffffff}) write(r5, &(0x7f0000000340), 0x41395527) setsockopt$inet6_tcp_TLS_TX(r5, 0x6, 0x1, &(0x7f0000000100)=@gcm_128={{0x303}, "bee641530448a94c", "913f17be38ce851f9dd25100", "4675a7e3", "c01d2edf2a8cdddc"}, 0x28) accept4$unix(r4, &(0x7f0000000200), &(0x7f0000000080)=0x6e, 0x400) 16:20:46 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) pipe(&(0x7f0000000480)={0xffffffffffffffff, 0xffffffffffffffff}) write(r1, &(0x7f0000000340), 0x41395527) setsockopt$inet_buf(r1, 0x0, 0x29, &(0x7f0000000040)="980b20155cc06873a4a10a74789320a4a208044a841509b65d8fe8c014d34f4866f4d90e2053305f9c68ff555ffd004c671bdd0ab7cb3c76121d582994f2f61fb0d5fe522686598abd32b5e27f6bab51051123063bd6e3998b008cc46e03bd90c956006c52ad3a02b3baff9bc498486753389d439f22f555f52f48791ad9fbb9967cf117c3a2e2cb20001d35a1ed53461bec02d45970236f95eac32bd91258759a502a7d09b242351d15857cee9769321fa20163405734104c88064f0b8b3a3399ecd6ee6a1f842811e93080adeb4f2c09143fd09d8cfa153926023b927b1a6b5987e38db620c723faa79149f85a50eb09565a605d9d986a3c", 0xf9) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) r3 = dup2(r2, r0) ioctl$BINDER_SET_CONTEXT_MGR(r3, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000380)=ANY=[@ANYBLOB="04630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000300)={0x8, 0x0, &(0x7f00000004c0)=ANY=[@ANYBLOB="0463044000100000"], 0xb19b868c1a8b328c, 0x0, 0x0}) 16:20:46 executing program 5: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r2, 0x40045431, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1}) syz_open_pts(r0, 0x8000) ioctl$TCSETSW(r2, 0x5403, &(0x7f0000000080)={0x1, 0x1, 0x6, 0xfffffffffffffe00, 0x6, 0x7fffffff, 0x4, 0x0, 0x2, 0x6, 0x8, 0x2985}) fcntl$getflags(r0, 0x16) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x4101fd) r3 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ptmx\x00', 0x0, 0x0) r4 = gettid() ptrace$setopts(0x4206, r4, 0x0, 0x0) tkill(r4, 0x3c) ptrace$cont(0x18, r4, 0x0, 0x0) ptrace$setregs(0xd, r4, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r4, 0x0, 0x0) r5 = syz_open_procfs(r4, &(0x7f00000000c0)='net/l2cap\x00') ioctl$TIOCNOTTY(r5, 0x5422) ioctl$TCSETS2(r3, 0x402c542b, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, 0x0, "c41e495183430405e274ccf7defb07f5340067"}) 16:20:46 executing program 2: r0 = syz_open_procfs(0x0, &(0x7f0000000080)='net/dev_snmp6\x00') r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r1, 0x40045431, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1}) syz_open_pts(r1, 0x0) ioctl$PIO_FONTRESET(r1, 0x4b6d, 0x0) r2 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r2, 0x40045431, &(0x7f00000000c0)) r3 = syz_open_pts(r2, 0x0) r4 = dup3(r3, r0, 0x0) ioctl$TCXONC(r4, 0x540a, 0x0) pselect6(0x40, &(0x7f0000000340)={0x9, 0x0, 0xfffffffffffffffe, 0xfffffffffffffffc}, 0x0, 0x0, 0x0, 0x0) 16:20:46 executing program 3: setxattr$trusted_overlay_nlink(&(0x7f0000000100)='./file0\x00', &(0x7f0000000180)='trusted.overlay.nlink\x00', &(0x7f00000001c0)={'U-', 0x8f3a}, 0x28, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f00000003c0)="11dca50d5e0bcfe47bf070") r1 = socket$inet_tcp(0x2, 0x1, 0x0) pipe(&(0x7f0000000480)={0xffffffffffffffff, 0xffffffffffffffff}) write(r2, &(0x7f0000000040)="a13232a719732bc8e470c74365decca536a6944afeb8e9fe4c23090b60e02d8b7f59bff5b2cdf7e3890e88ad8b32ab6cf125ee9355baf46977d85094186f78b9cc2f258a750da1477a9e16fb46853ac034dfd4e6cb89e9ad233b7b776c167f556e20655f", 0x64) r3 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/enforce\x00', 0x28000, 0x0) pipe(&(0x7f0000000480)={0xffffffffffffffff, 0xffffffffffffffff}) write(r4, &(0x7f0000000340), 0x41395527) ioctl$PERF_EVENT_IOC_RESET(r4, 0x2403, 0x7ff) bind$inet(r3, &(0x7f0000000000)={0x2, 0x4e21, @multicast1}, 0x10) connect$inet(r1, &(0x7f0000000cc0)={0x2, 0x4e20, @local}, 0x10) setsockopt$SO_TIMESTAMPING(r1, 0x1, 0x25, &(0x7f00000010c0)=0x19ff, 0x4) sendto$inet(r1, &(0x7f0000000140)="b0", 0x1, 0x0, 0x0, 0x0) recvmmsg(r1, &(0x7f0000003b40)=[{{0x0, 0x0, 0x0}}], 0x1, 0x2000, 0x0) r5 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000200)='/dev/ptmx\x00', 0x0, 0x0) ioctl$VT_GETSTATE(r5, 0x5603, &(0x7f0000000240)={0x20, 0x7, 0x5}) 16:20:46 executing program 5: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) pipe(&(0x7f0000000480)={0xffffffffffffffff, 0xffffffffffffffff}) write(r1, &(0x7f0000000340), 0x41395527) r2 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r2, 0x40045431, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1}) syz_open_pts(r2, 0x0) r3 = dup3(r1, r2, 0x80000) ioctl$BLKROGET(r3, 0x125e, &(0x7f0000000080)) r4 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS2(r4, 0x402c542b, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, 0x0, "c41e495183430405e274ccf7defb07f5340067"}) 16:20:46 executing program 2: r0 = syz_open_procfs(0x0, &(0x7f0000000080)='net/dev_snmp6\x00') r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ptmx\x00', 0x0, 0x0) pipe(&(0x7f0000000480)={0xffffffffffffffff}) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) setsockopt$inet6_MRT6_ADD_MFC_PROXY(r2, 0x29, 0xd2, &(0x7f0000000100)={{0xa, 0x4e23, 0x0, @empty, 0x7}, {0xa, 0x4e22, 0xff, @dev={0xfe, 0x80, [], 0x23}, 0x1}, 0x18, [0xa355, 0x6de8b431, 0x3, 0x5, 0x7, 0xff, 0xa0, 0x401]}, 0x5c) ioctl$TCSETS(r1, 0x40045431, &(0x7f00000000c0)) r3 = syz_open_pts(r1, 0x0) r4 = dup3(r3, r0, 0x0) ioctl$TCXONC(r4, 0x540a, 0x0) pselect6(0x40, &(0x7f0000000340)={0x9}, 0x0, 0x0, 0x0, 0x0) [ 1756.964096] binder: 10243:10257 IncRefs 0 refcount change on invalid ref 0 ret -22 16:20:46 executing program 1: r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/raw\x00') r1 = syz_open_procfs(0x0, &(0x7f0000000bc0)='net/xfrm_stat\x00') io_setup(0x2, &(0x7f0000000040)=0x0) r3 = openat$cgroup_procs(0xffffffffffffffff, &(0x7f0000000080)='cgroup.procs\x00', 0x2, 0x0) pipe(&(0x7f0000000480)={0xffffffffffffffff}) vmsplice(r4, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) pipe(&(0x7f0000000480)={0xffffffffffffffff, 0xffffffffffffffff}) write(r5, &(0x7f0000000340), 0x41395527) pipe(&(0x7f0000000480)={0xffffffffffffffff, 0xffffffffffffffff}) write(r6, &(0x7f0000000340), 0x41395527) r7 = accept4$inet(r6, &(0x7f0000000340)={0x2, 0x0, @multicast2}, &(0x7f0000000380)=0x10, 0x80000) r8 = eventfd2(0x9, 0x2) r9 = epoll_create(0x5) pipe(&(0x7f0000000480)={0xffffffffffffffff}) vmsplice(r10, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) pipe(&(0x7f0000000480)={0xffffffffffffffff, 0xffffffffffffffff}) write(r11, &(0x7f0000000340), 0x41395527) io_submit(r2, 0x8, &(0x7f0000000700)=[&(0x7f0000000140)={0x0, 0x0, 0x0, 0x5, 0x8001, r3, &(0x7f00000000c0)="0ab6f56a6dcbc01fe006bfea303fd99189e99449107ff329a25cfd372490a44e2007c38e8384fc60fd520e49464af326247b29d8dfadf100d4f05d9dd220aec538c41ee7b25c1ae1ba1eb6a805b56a3e50f02d3f89dc24c3d1209f7978fd7549b6c4303c78c96d39f430d06f3cbfd42b991864e016ff111d00aa", 0x7a, 0xa7, 0x0, 0x2}, &(0x7f0000000240)={0x0, 0x0, 0x0, 0x8, 0xd95, r1, &(0x7f0000000180)="80284c3328499a3426687740e79edebca208122d5a82ae0b9ac620ff9b50c6901ca6f0f4b178d4229915b560aff72682d9f8355f2ffd03395cb352d734b40ecc7ca80a89e9360162759d80f3c817072ed19ab0846f9899dba38541089f2b8edc82959ded00de92909a4293a7de8c5526474a87812ea35cdbac1ce04a4b42f8eff6ed358a434d60d4f8f86ffae817ee75", 0x90, 0x6}, &(0x7f0000000300)={0x0, 0x0, 0x0, 0x3, 0x4005, r4, &(0x7f0000000280)="7bdee346cecf213168b9d91625474816fa1d51ce8b540afe5bd851b7017a97a4c91095e7ea9f34dbc62261140874f35223df69f8428605cf45caf36ff722302d60b7ea771a83b63501", 0x49, 0x64, 0x0, 0x6, r5}, &(0x7f0000000440)={0x0, 0x0, 0x0, 0x5, 0x7f, r7, &(0x7f00000003c0)="36284f0b718c516da774061eac77ec7a0ac6b310f571fb8676874245a583f3cc0404420eb360852320f6ae861a14e982523e8d41a66e5a1349445a3a27199af230e01fc81b76225a312f7ae1defb41d91d8e4ea564f85b64a9eaff3c89ba8042b73f3d8b7903", 0x66, 0x1, 0x0, 0x1, r8}, &(0x7f00000004c0)={0x0, 0x0, 0x0, 0x8, 0x1, r0, &(0x7f0000000480)="414ae0fa2ec0651437ec4c6ead2ce33f3d3107f8325b6bdc43778f88a1443d66ccabea87", 0x24, 0x8, 0x0, 0x2}, &(0x7f0000000580)={0x0, 0x0, 0x0, 0x1, 0x3, r9, &(0x7f0000000500)="0e2d81c35562f781ad59cd4f5953154190577335e9d25d671dd6cc7216122321ac69c56e5fb6ccfd99d3aac0122830521d61dd1743fee9d930baf1adc6924a1e5fb54f9fc4eba3a5340823ce1d", 0x4d, 0x7, 0x0, 0x2}, &(0x7f0000000600)={0x0, 0x0, 0x0, 0x0, 0x1000, r10, &(0x7f00000005c0)="c040d6f8ddaef9692b92ab599dde9e02572725a1f59f897b25a675f093b1e7a87336bd7eeefb930dc2", 0x29, 0x400000000000, 0x0, 0x3, r11}, &(0x7f00000006c0)={0x0, 0x0, 0x0, 0x5, 0x80000001, r1, &(0x7f0000000640)="c7b28e8e3fdc0cc6eb5f389798c37d9b377380396a2594e4f1345085142fa72961d8da9151e7660d96d3c63052c8b49d82c91198df504d5ed8a6e157ae0f6a9d59daddc4aaa6bbbe07ed3244e34298692886f815387655416916b5d4b32544ab390d2a2a", 0x64, 0xfffffffffffffffb}]) vmsplice(r1, &(0x7f0000000b40)=[{&(0x7f00000007c0)="b96ce434a40840fc7c506da42b91f387deeaeb7337ae6fe67886ba432174587b2add192a899123867e5dafa9b5d6f837dde6755dcc3a68b8ce49dc74fe02b56a916f712717f8967f102632a98e9e59b29ca6f6", 0x53}, {&(0x7f0000000840)="016bb3510634881ca68aed0e93a6d1ef669145d9ebf21bfeb80a694279a184e0905df91f86fb247d366a39f9a90cd9e26a18a945e76480a33562444aa15fd87a64a703eb757edba8e189ca8cd68f170c1f4879a738eaab5a025deb8cd3bec1767abd49790515f9df8960118cf03285353cefd2d3f1d65fbda3f52d29a48285666ca764fd2cd0d9fac400ae33c0cca1e823eae3fd34c11c59", 0x98}, {&(0x7f0000000900)="7bf11370ee797a9e446fb7a6ee598c177e3b624ff783c0f8b4983288127d1c40cdffce85a7f31d4a9ebbf069c3fd6f3b643d9f1ec72bf18ab23bed9f69071b85854ec735ac658cb81e135fbcc115e089e4bec4c6e3da2fe6a5b5665f23209902b0f15492e6257d7f17d442bddc365072e34add63bf", 0x75}, {&(0x7f0000000980)="8aae78bccfbe10de74f6a2682643a5f1aca614d15a5bbee99d3dc9fc844b84e52e", 0x21}, {&(0x7f00000009c0)="6831a60fdf8cb8e7ca17649b2d85a0bb85cbc1a336ac741e03a7f34400ba4ffd9023208e2683e9edc365146ced5d", 0x2e}, {&(0x7f0000000a00)="e1d9169f885313090a815070a7778bfe27613cea18a7385e568ffa8e042ace1b84a43b48b4fa4e03f10bb359b6cd139d709f37aaa767c481f82a80bd9f20d7de4b1f8d3b01fbadfcd0c9ba606a6db2e2f7237f9c4b44cdc623967cf560613d1092c08bbc532a1d422f4ce4af192fde5c4f0363c40365fc1ce0914fc2e00638c598ce55378238aa018a9470f64b127a63451f97be5eceb5042633192a91ce3d0176da05e7e5965dd2e2a1cdecbbffd4b163143b5d56828bd2a68a3ddcced0ec144ae9eef89e7f338cacc102a0555beaca9238a55ffa0903643c19cec2a38675e3d3c3158007a4b17e4a288bcdd713", 0xee}, {&(0x7f0000000b00)="686899c26d0c206f5a454a35426ba31b102f22cc55d85355abed58df784313f94b1b90410c34a36604a1d76ccbf4c268615ae6f6f18aa377", 0x38}], 0x7, 0x2) pread64(r0, 0x0, 0x0, 0x800000000002) 16:20:47 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r1, 0x40045431, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1}) syz_open_pts(r1, 0x0) ioctl$TIOCGLCKTRMIOS(r1, 0x5456, &(0x7f0000000000)={0x8, 0xfffffffffffffffe, 0xfb, 0x2, 0x16, 0xfff, 0x7f, 0x1, 0x4, 0x7, 0x5, 0x5}) 16:20:47 executing program 0: r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) r1 = dup2(r0, 0xffffffffffffffff) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) pipe(&(0x7f0000000480)={0xffffffffffffffff, 0xffffffffffffffff}) write(r2, &(0x7f0000000340), 0x41395527) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000080)={0x79, 0x0, &(0x7f0000000000)=ANY=[], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000300)={0x8, 0x0, &(0x7f00000004c0)=[@acquire={0x40046304}], 0xb19b868c1a8b328c, 0x0, 0x0}) 16:20:47 executing program 3: r0 = dup(0xffffffffffffffff) write$P9_RSTAT(r0, &(0x7f0000000000)=ANY=[@ANYBLOB="5a0000007d020000005400ff7fe90600000c0400000008000000000000ff033710a1be80fe0b00000009000100000007000000000000f7ffffffffffff0d00766d6e6574315c6b657972696e670a006d696d655f74797065260900"], 0x5b) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f00000003c0)="11dca50d5e0bcfe47bf070") r2 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r2, &(0x7f0000000100)={0x2, 0x4e20}, 0x10) connect$inet(r2, &(0x7f0000000cc0)={0x2, 0x4e20, @local}, 0x10) setsockopt$SO_TIMESTAMPING(r2, 0x1, 0x25, &(0x7f00000010c0)=0x19ff, 0x4) sendto$inet(r2, &(0x7f0000000140)="b0", 0x1, 0x0, 0x0, 0x0) recvmmsg(r2, &(0x7f0000003b40)=[{{0x0, 0x0, 0x0, 0x0, 0x0, 0x294}}], 0x1, 0x2000, 0x0) 16:20:47 executing program 5: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS2(r1, 0x402c542b, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, 0x0, "c41e495183430405e274ccf7defb07f5340067"}) setrlimit(0xc, &(0x7f00000000c0)={0x0, 0x2}) pipe(&(0x7f0000000480)={0xffffffffffffffff, 0xffffffffffffffff}) pipe(&(0x7f0000000480)={0xffffffffffffffff}) vmsplice(r3, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) write$evdev(r3, &(0x7f0000000100)=[{{0x0, 0x2710}, 0x16, 0x9, 0x7fffffff}, {{0x0, 0x7530}, 0x1f, 0x8000000, 0x7f}, {{0x77359400}, 0x16, 0xffff, 0x7}], 0x48) write(r2, &(0x7f0000000340), 0x41395527) ioctl$ASHMEM_SET_PROT_MASK(r2, 0x40087705, &(0x7f0000000080)={0x2, 0x7}) 16:20:47 executing program 4: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TIOCLINUX5(r0, 0x541c, &(0x7f0000000080)={0x5, 0x2, 0x8001, 0x7, 0xa6}) r2 = dup2(0xffffffffffffffff, 0xffffffffffffffff) epoll_ctl$EPOLL_CTL_MOD(r2, 0x3, r0, &(0x7f0000000000)) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) prctl$PR_SET_MM(0x23, 0xa, &(0x7f0000ffe000/0x2000)=nil) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0xf) 16:20:47 executing program 2: r0 = syz_open_procfs(0x0, &(0x7f0000000080)='net/dev_snmp6\x00') r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r1, 0x40045431, &(0x7f00000000c0)) r2 = syz_open_pts(r1, 0x0) pipe(&(0x7f0000000480)={0xffffffffffffffff, 0xffffffffffffffff}) write(r3, &(0x7f0000000340), 0x41395527) r4 = ioctl$TIOCGPTPEER(r3, 0x5441, 0x1) ioctl$PIO_FONTRESET(r4, 0x4b6d, 0x0) r5 = dup3(r2, r0, 0x0) ioctl$TCXONC(r5, 0x540a, 0x0) pselect6(0x40, &(0x7f0000000340)={0x9}, 0x0, 0x0, 0x0, 0x0) 16:20:47 executing program 4: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000000)=0x13) pipe(&(0x7f0000000480)={0xffffffffffffffff, 0xffffffffffffffff}) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) ioctl$KDGKBLED(r3, 0x4b64, &(0x7f0000000200)) r4 = openat$zero(0xffffffffffffff9c, &(0x7f0000001740)='/dev/zero\x00', 0x0, 0x0) r5 = syz_genetlink_get_family_id$tipc(&(0x7f0000000700)='TIPC\x00') sendmsg$TIPC_CMD_GET_LINKS(r4, &(0x7f0000001940)={&(0x7f00000006c0), 0xc, &(0x7f00000017c0)={&(0x7f0000001780)={0x24, r5, 0x100, 0x70bd2b, 0x25dfdbfc, {{}, 0x0, 0x4, 0x0, {0x8, 0x11, 0x5}}, ["", "", ""]}, 0x24}, 0x1, 0x0, 0x0, 0x40}, 0x48800) sendmsg$TIPC_CMD_SHOW_STATS(r2, &(0x7f00000001c0)={&(0x7f0000000080), 0xc, &(0x7f0000000180)={&(0x7f0000000100)={0x1c, r5, 0x1, 0x70bd2b, 0x25dfdbff, {}, ["", "", "", "", "", ""]}, 0x1c}, 0x1, 0x0, 0x0, 0x24850}, 0x20000000) ioctl$TIOCLINUX7(r0, 0x541c, &(0x7f0000000040)={0x7, 0x2}) 16:20:47 executing program 1: r0 = gettid() ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x3c) ptrace$cont(0x18, r0, 0x0, 0x0) r1 = gettid() ptrace$setopts(0x4206, r1, 0x0, 0x0) tkill(r1, 0x3c) ptrace$cont(0x18, r1, 0x0, 0x0) ptrace$setregs(0xd, r1, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r1, 0x0, 0x0) ptrace$setregs(0xd, r1, 0x8e11, &(0x7f0000000140)="d61ac19b5aca454918a0450c46d9bf92966ef706912472a8c45049eb9da82d6ac4550d47b50d3909000000eaf505998d53843ac304d021e597d1d2b457f8112a1a28fcd4423690e393839e2c6736970c93b1f78cb6ecc8e871bd06f56d8edaa4e25ee353ee1ea518fc65abc9eb3e1f1f5bf40b7e5b6d00217d97be147dc187330ab85ed362fad53b77fb3c4661de639278e3ed97487a367e2f7c71be41bdd48f30c41ba0f11b9f8840b8d7ee1c67d651c3e5d911358a080056a2a064be235b1d526894c5f6c29fe9504c005685de2b69") ptrace$cont(0x7, r0, 0x0, 0x0) r2 = gettid() ptrace$setopts(0x4206, r2, 0x0, 0x0) tkill(r2, 0x3c) ptrace$cont(0x18, r2, 0x0, 0x0) ptrace$setregs(0xd, r2, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r2, 0x0, 0x0) sched_setscheduler(r2, 0x0, &(0x7f0000000040)=0x80000000) r3 = syz_open_procfs(r0, &(0x7f0000000100)='netL[&:\xfa\x06\x00\xe1e\xd1\x8bzp@') pread64(r3, 0x0, 0x0, 0x800000000002) 16:20:47 executing program 1: r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/raw\x00') ioctl$FICLONERANGE(0xffffffffffffffff, 0x4020940d, &(0x7f0000000040)={0xffffffffffffffff, 0x0, 0x1, 0x7fffffff, 0x6}) lstat(&(0x7f0000000140)='./file0\x00', &(0x7f0000000180)) pread64(r0, 0x0, 0x0, 0x800000000002) getsockopt$inet_pktinfo(r0, 0x0, 0x8, &(0x7f0000000080)={0x0, @empty, @loopback}, &(0x7f00000000c0)=0xc) ioctl$TUNSETQUEUE(0xffffffffffffffff, 0x400454d9, &(0x7f0000000100)={'bridge_slave_0\x00', 0x600}) r1 = open(&(0x7f0000000200)='./file0\x00', 0x140, 0x4) getsockopt$inet_IP_IPSEC_POLICY(r0, 0x0, 0x10, &(0x7f0000000240)={{{@in, @in=@dev, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@local}, 0x0, @in6}}, &(0x7f0000000340)=0xe8) ioctl$TUNSETOWNER(r1, 0x400454cc, r2) 16:20:47 executing program 1: r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/raw\x00') fstat(0xffffffffffffffff, &(0x7f0000000040)) pread64(r0, 0x0, 0x0, 0x800000000002) 16:20:47 executing program 1: r0 = gettid() ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x3c) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r0, 0x0, 0x0) ioctl$TIOCGSID(0xffffffffffffffff, 0x5429, &(0x7f00000000c0)=0x0) r2 = syz_open_procfs(r1, &(0x7f0000000040)='0\x86\x00\x00\x00\x00\x00\x00\xd1_\x01\xe9\xaa\xb3B\xb7@\xb8\a(\x11\x0f\xdd\xdbf\x18yM\x13\bjo\x86\xd5\xa3\be\x87A\xea\xed\xf33\x98\xd4\x82l\'od\xd8\xf5\xad\xf2\x89\x88\xb5\xcc&J}\xa9\x01.1Xy\xa3\x04\x9e\x8a]2\aJ\xba6Em\x16/\b\xba+\x87m|}@\x9c\xed\x80\xde^\xc7') pread64(r2, 0x0, 0x0, 0x800000000002) 16:20:47 executing program 1: openat$zero(0xffffffffffffff9c, &(0x7f0000000100)='/dev/zero\x00', 0x2000, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/raw\x00') ioctl$EVIOCSABS2F(r0, 0x401845ef, &(0x7f0000000040)={0x81, 0x0, 0x0, 0xc99, 0xfffffffffffffe00, 0x80000000}) pread64(r0, 0x0, 0x0, 0x800000000002) 16:20:47 executing program 1: syz_open_procfs(0x0, &(0x7f0000000000)='net/raw\x00') pipe(&(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) write(r0, &(0x7f0000000340), 0x41395527) r1 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./file0\x00', 0x0, 0x121) ioctl$EVIOCGLED(r1, 0x80404519, &(0x7f00000000c0)=""/42) pipe(&(0x7f0000000480)={0xffffffffffffffff}) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) ioctl$TUNSETNOCSUM(r2, 0x400454c8, 0x0) ioctl$KDDISABIO(r1, 0x4b37) openat$zero(0xffffffffffffff9c, &(0x7f0000000040)='/dev/zero\x00', 0x4000, 0x0) 16:20:48 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) r2 = dup2(r1, r0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000380)=ANY=[@ANYBLOB="04630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000300)={0x8, 0x0, &(0x7f00000004c0)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], 0xb19b868c1a8b328c, 0x0, 0x0}) [ 1758.584143] binder: 10337:10338 unknown command 0 [ 1758.589207] binder: 10337:10338 ioctl c0306201 20000300 returned -22 [ 1758.599151] binder: 10337:10338 unknown command 0 [ 1758.604378] binder: 10337:10338 ioctl c0306201 20000300 returned -22 16:20:48 executing program 5: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ptmx\x00', 0x0, 0x0) r1 = openat$zero(0xffffffffffffff9c, &(0x7f0000000100)='/dev/zero\x00', 0x6c0900, 0x0) epoll_pwait(r1, &(0x7f00000002c0)=[{}, {}, {}, {}], 0x4, 0x9, &(0x7f0000000300)={0x7fffffff}, 0x8) pipe(&(0x7f0000000480)={0xffffffffffffffff}) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000340)='/selinux/commit_pending_bools\x00', 0x1, 0x0) r3 = syz_genetlink_get_family_id$ipvs(&(0x7f00000000c0)='IPVS\x00') sendmsg$IPVS_CMD_SET_INFO(r2, &(0x7f0000000240)={&(0x7f0000000080), 0xc, &(0x7f0000000200)={&(0x7f00000004c0)=ANY=[@ANYBLOB="577183fb756aaf04f419b58d884924e8000000456bee71bbbe3ffaf98a03293b8bb3a58407c8a2f90ef155bede20cb1ee3f644411d429944f9ae6c5d1abb3d2f810aba44722651ad62776dde53975496dba095468ab27592b17ba7cef90298e82b6a244310f0afdc8c04516fbdfb62", @ANYRES16=r3, @ANYBLOB="020026bd7000fddbdf250e000000080005000700000024000100080009000700000008000600736564000800020080321900080004004e2000000800050005000000780003fda773360000000000000000000000000000000001140006000000000000000000000000000000000108000800010000001400020076657468315f746f5f7465616d00000008000800ff0000000008000500ac14142108000100020000000800010000000000080004400000000008000500240000000c000200080006000600000008000400320300000c000100080001001b00"/226], 0xe8}, 0x1, 0x0, 0x0, 0x10000}, 0x40000) 16:20:48 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) r2 = dup2(r1, r0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000380)=ANY=[@ANYBLOB="04630440"], 0x0, 0x0, 0x0}) munmap(&(0x7f0000ffd000/0x2000)=nil, 0x2000) fcntl$setstatus(r1, 0x4, 0x44000) pipe(&(0x7f0000000480)={0xffffffffffffffff}) vmsplice(r3, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) write$selinux_create(r3, &(0x7f0000000040)=@objname={'system_u:object_r:xserver_misc_device_t:s0', 0x20, '/usr/lib/telepathy/mission-control-5', 0x20, 0x3, 0x20, './file0\x00'}, 0x6d) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000300)={0x8, 0x0, &(0x7f00000004c0)=[@acquire={0x40046304}], 0xb19b868c1a8b328c, 0x0, 0x0}) 16:20:48 executing program 2: r0 = syz_open_procfs(0x0, &(0x7f0000000080)='net/dev_snmp6\x00') r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r1, 0x40045431, &(0x7f00000000c0)) r2 = syz_open_pts(r1, 0x0) r3 = dup3(r2, r0, 0x0) ioctl$TCXONC(r3, 0x540a, 0x0) pselect6(0x40, &(0x7f0000000340)={0x9}, 0x0, 0x0, 0x0, 0x0) r4 = add_key(&(0x7f0000000000)='keyring\x00', &(0x7f0000000100)={'syz', 0x2}, &(0x7f0000000140)="94f0c00e5043d518e97205aebb046627d83109c0f288b2c89ba030b7e8d7c3344ffc4c3503f4cc8339b4851318e75cb1a72c434c7908876887b211ad1df6c91a00c89db320d6cb822abaf2d18552d1869992105555b22bcef437eeed6957b78f8af89c8c057178ff15d6bb0340f580bf76198f6f4f4f7a54ded5272f0365cf0f11d4658e9479bfb8573bc0db5746ba8af8c7c01ae1f9d6c1ddbbcd24a245935dd64a5de5b0ed4df9ed16456e46718bfb776d3c6bdc9534e912f6c1b40ca14b26912ec2968e9099b5e0edf01381743b0e92fa", 0xd2, 0xfffffffffffffffb) r5 = add_key(&(0x7f0000000240)='trusted\x00', &(0x7f0000000280)={'syz', 0x3}, 0x0, 0x0, 0xfffffffffffffff9) keyctl$unlink(0x9, r4, r5) 16:20:48 executing program 3: socket$inet_udplite(0x2, 0x2, 0x88) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1}) syz_open_pts(r0, 0x0) r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r1, 0x40045431, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1}) syz_open_pts(r1, 0x0) ioctl(r1, 0x1000008912, &(0x7f00000003c0)="05bd9e1d5e0bcfe47bf070") r2 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r2, &(0x7f0000000100)={0x2, 0x4e20}, 0x10) connect$inet(r2, &(0x7f0000000cc0)={0x2, 0x4e20, @local}, 0x10) setsockopt$SO_TIMESTAMPING(r2, 0x1, 0x25, &(0x7f00000010c0)=0x19ff, 0x4) sendto$inet(r2, &(0x7f0000000140)="b0", 0x1, 0x0, 0x0, 0x0) pipe(&(0x7f0000000480)={0xffffffffffffffff, 0xffffffffffffffff}) write(r3, &(0x7f0000000180)="7fc733433982d023a6a75a0e78a2484693b91bfae5b4303fbacb878d5548adaefce74d0c5697d19fa815f6322db3516f02e5539c76c805226d1c3c7e0fb4817c49b0d94dd4dc88d7232ec22eb4d24ce2573b31451606dbaa53c3efe738db2f784e858483e8bd02a21b8b0d7ddcabbd0876d2b56cbee14c55c2a84f052ce03a52b50420b1b1607f8e864c2eb4c479ba916406347a1b40b52a1d220c6b96c20a021f16b316fd9c11d86b51b76ab8cbc4c0cf6b9fb7ee470c4d017807817bda17bfa421b108a779d715d6ab6b22c0c85783f1d4120f538833f45edaad", 0xdb) ioctl$EXT4_IOC_GROUP_ADD(r3, 0x40286608, &(0x7f0000000000)={0xb63, 0x3ff, 0xffffffffffffff01, 0x7, 0x40, 0x4}) recvmmsg(r2, &(0x7f0000003b40)=[{{0x0, 0x0, 0x0}}], 0x1, 0x2000, 0x0) 16:20:48 executing program 4: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet(0x2, 0x800, 0x2) sendto$inet(r2, &(0x7f0000000180)="f44e15f8b2e0b7527141866fc45be992b6bfbc9a2bc7fde238924b92d0f46bdbd1a05286e1d88e22a3301fa6a7148929854203235b9ed1a03b0b855dae7e8cf6fac64b8b5d8694d0aab26d76183c6968ed0e78745e30b1c1d6c210c7ca5d8c5e18b06862dcac9e179e8be5bf14360f43389f0338f6c13961df72235b247c1dcb8b18315acd945b0b92491711f68dab5778b957cdf74b92583e046e10b848509d731bfefb39357af70953a3a798c193a288cf8863be5634c12e167a6902f1f765442578aa", 0xc4, 0x40, 0x0, 0x0) getegid() ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) pipe(&(0x7f0000000480)={0xffffffffffffffff, 0xffffffffffffffff}) write(r3, &(0x7f0000000340), 0x41395527) ioctl$PIO_SCRNMAP(r3, 0x4b41, &(0x7f0000000280)="b4124ae39cf228d0686fa6105bae90b8b5a051fd76f4d21b5031880703af3df69a369bd3c234fe28cdf7f66e9579f209a394c69eb60ab7fdf14aa4b14b1af3cf8a8144dac54d42d2157852d282ae8d76d24d7cde42c941a1eccfe93b3d6ba5c3fc636f1024cf846eb64db1e218ab95ad81eb05e5b6e57d5b93ca0b5078aec9d418ab0fd921931432199c0170d1ba9c9e8ac5762bd6b0fd66f468fd87f1995d6672768bfde2c0f03bc114379961195983f5083cdeff842bcb63da6d61ea0967ff135145ea8214ffd3f214a91000471df92b36eb4cee67ffe0ad84bb82c9df40a7fe25a8606a2790c60db4c1f99fad333770195317c474aab32bf49ad411063d8ae7d9866c38fb6b23917ea47e64952e2fc512ddb856e0a65398a542ea6d99c1d17f1cf8dc20434003940ebb509eb3c515954c2421e9993fd79841c859b43b5bcd5fc69461983deab8fd52fca421e9fecd86036e1f9d651e1905c2eaadb5219a3a5e0eadb80f02d53f32978b5cb2feb3af1429ef4d3af01bd13d51fbe399bf53b0b5a1af6213e88ddd9594ac3dda139b633fcf8139b83df9ac8813e36226c4e4a824493baf45428a75da613f51351efd2ef403245d5ec151bec3955b599dc43f63d6d3403e79da86de483da9542bc389a59ae97fa85ba19e4cf10b945b75ac83f0891ff063fa5a62b786a872e1e08efbf4a778a2ddbc5252be5f692dee1e53e9b645623ef16d565bf5d0a8988ffff4daaa4ec2d948812159389778d71d444a63d90adad74ec7b9158779721bfb4ad0ac28ad2335df58c07fa74b7cdab9e16d2ab8fb425d12d42ca2343ce69787d99dd5e1dddb172a42e52ca0695dd32b6ca6f0b3dfd1e60a11c5358689abd2455c45da50dbb00b23ace21e2570bb9f8e0beff54ee5affcb2823819e8c833c0915c8bc9f7457c40666dcbe67f283946f758cde226e484a94786fb100e24dbe66510b43ab6f6a1287d7986e47744c39c7cbddae2fa926314492de22f080c747873043372c04edbb8f723f63619a8538d2103f498a251aac3a03c6fd4b8e9f27b6616124a0db5004bc714f8c15720832f647a3df46e6b3376849eac8e13d397028f0877d6debe81413e769822bfd03d0a829966f4eefb93ac5c5d81f44c4c4089d86561448e10f626c5b5c799c20c34f4e4db8a78aa4e5684a007e8868c5b0d76796715a49bd14e5922877edfce28d6bba98d1627bdba64474f25ad08be1f0ddb38c19bd6b6c6bd8a3ceab819cd2bcb9640df1d17596cd38c2b67ede5b2342c0c3e41d0048a9a0ad0e64bc10fb22a908c74cdb75829bddaddd8a35784e4d224dd67e1569a682952a346aca51515d00f889b87abee99c4a35938804ec5160ecf1f4e7b708af62382b14e3948b46d5a0758113358e32762fe3ecce0b1d4cbae559167359e57d771d3e37cde351c5dcbcc55a22afabb6f57f1b0900a9f6d9bb85fd46482776ce8719090d446ef6a51a92ef0a05447dbadb2fec0ba19fc766afc79923546230c8ed77b3c08fdfbcee657e19cff84e852cead015a2120187e1f6a7e16d573d67f2023f03340f259a7e6f689fc95cc50cbe9fe103fc679e274af77c166ba9d68c0757f94adc9717fe6a036f62b20832474e1909d0b51f5ff40924047c7e0108b46c57da1b3e4ece695312f0ee6eeab6b88ffccf81da513eef54c98c2186611a3993604d5041fbed0f8ed41a650490ed10a7a390f5cb50ce12b9ec1a355e4e061fbc949d0c7061a9e7436d2ae5d2b3e70be6fa62034338652317da01a98b49dfc4f29a4a364ac97c631fc04f44de93417c43c5c1a1a6977ee434138b132665665b0b110806e2916ee16b15f55dc923f6571ff4c85d9beb776f877c622a2f5d3c6072a896bf6e4b14f161fbe8a9b952adec55e399a1c7878d1b3b7d9d247b212cff608cef8c86f19e26f9fa39ae290136745eb539975d1ec816d7a7df819040da32f8a6b3f4eb65f9ba244ed8144ff219156bc092cf00a4b66cb33e1c0ce9082c8b285d7b763c1198ec24cc7342ca26b8836941b0141bacd7373f13ea6884d0350065a4d261ba424f2bc1e22546ba67c3960549b4b252acdc78f18fb1dde11e5e587d038c34b476d25af576a57e33402f8bb689dd6fc2ef30051a863deec9efb42fa597a770680f596045c0e2d8f666cf6260d04827c08041bab0321e15c2e40cf7fee8e0060c70f8d041451c04cb91144fe745569b8ef77dc0525807fa45802c95b9481fdd313066ce3537e1e33d64db7ee6a28c837d695861ac4754ff1d03482b636311c16fbad952e7e842e7572accd3e4df97e89d30e867d28fe78ff65088050b67ce46ebcc157d217a96d996e4be851e2892bfa67b2d6069fbd80b78a232e202e384534ee05194c23147dbf5378d496608631d883da98ae2dcbdd0a9f79eaa859854e4234147559697b3a3b559ecf3a046a8ded948798a233df880e090e3dafdfe9481596aab367c50e263e623559c6186d44154147adb8ef9e3137f4c048bd380950bbe815883180b64acc980a8341c752971d196febe29d1f2693a009062d2ae208a23ad9fd09eda9712b6b004a4ab9fdebb56da93a2cc5b7a6a52d1b0d0e47451c6fd28dec13d7d3deaae2c8c13902b5b6315a6638e9846d17d3d1d39de1930e8d74cf9dc6831fb9c23926e7f9be12514c868eeaf0d66730b695cbd75c7f4fce67a89fc12538dd7ddb0a3fca7a7f9c3c56a22632bacf99394c636c345312da4d7f0facb6c9f6c4295915e269e88c59c855bdadbfb9d126f65c30d1226fdc64594fa1f2654a3751c7ad6e1d06bed6fcf3fb202fb581efd662943e48f8ce59a644b9434d3029dd90b52388309a65fab80cd95260fc76e74886ddb6c02ae8df9dcfd0052ecf09fa7f24cbd4a27df6ddd93a4b0b885b887a6f273f98d0e811de8fee6d3c410c2c0905f18acc10da695ac87607336f016815040a88821051871a827d493323925992961c9bdba726d675ac1d414b63d3df9477b6bf7da524c31ab47abb3726f16b94f7b2fc7d40c7f9aae5158a9679ea48caa40016f179f667e74d12b213951bee0528287d6fa610d5d1d5b88657207cc74ab95c21330c09260f019a1069a992160d4db86d22b12423be3ba28556a532d18d6c141b2949651f1fbd75df506a42ee3755546bcedc9f60bcd5e3e222af78e37236c9c713769d577552e061b7e18788989943fb02893049b0e2d23e20f62336c89b106daeac5ebb9332fd40c8587a4999fbc645302f94c04866cfa854e0c77e36c55d2e6a4d8d264f62277c801ffeb5f2f5a9629436a02315481ddb02c3daaf60e98e0094da4e894943118b9edd23692e232a48ebb76a179f88c6928a7ad14b4831c853909cf0e30e7ffdd82a60ec045f4bc183578729668b6c4c97d5a712d309b31e469d8647f5238deeb7c57076f33574152c82f1c44020e439c81fbdd047b4bdcecdab8ab41e1d17f22859e40c909f1e970703fcce4229c4b8cb6ad0e17c9a7b658c3ef54e05b6ccc91754f36cb5f0472f4e42114324327009fc6e3a5b1955680bea37a6391fb08a3d8c82e4d5b0c1f011d407ddf01df3b1a88388ea9b5622d1e5a66837dd4324fe62e1ead7bf1afbf2f4254f1794ea145b87baee87114b6f9058f617539f7125a2b5709aba2afed0fe73cb4b710c6322425d48ab36a0ee8b548ae8ab8d04f9c95902602832edb73f150d17302e404841551d63ec9b530ab1b401e108159f4ab56f59ccc15a84cbca6cfc9df60d92cdbc49ca086186e96674878a5953409908f679da88d8e2d31bd9fa3eea5678f0a2be9a952127c7d98bf740fd973dd379dfc29d2e6cebb21662ded058aa75d16129cb3b583d8c2cc3a00755de15ad28c0e8f6a37ff0f25c3c76744d77e3cd06eff9ebcb5760903f3c3659f15e20c838782a7145221d91892860417de57b90477c0bf4681194acffab1f691e1145e01004ff1e8ec1122c1a00a9a3db3e08588c5b9b7fc784b8871ca84d86100d1e6fb437b4a78a3bd725307649a0c4fb26d2b6b35b460984d820129d9d349ac68642e9c881b603a4152932be3987ce508d72dcd7b5dc9b9822574c69b6535083bcc38ee9d37b3f96e5bc66e4ed0677fa32119dd6e8b08417adac88d8ba91289a66eb8334e22fe4c54b27603bdb5b1de91f90f363ae511355dc4bb291330567fbd2c5a40139e5cf2533ff4a3008af2289e84fa8ea18678830b8e7bcfd5f93a724e94666b470a9c813839e783123ebc9d8369dd78e4b55423a55970430452a9293156a14fb1286d9821cd0073372ab6e1de0128c79990fab0d41da62d1dc1d104b910645669922e6916a79b88f4b3e01251541ae522dc3d7592ce30e969b2409677dfea692116848ded9acf3d29895b55e4f2fb2d86924b187a912814acbb2acae32cc0cd563e6849507bcf5c35f8d466ecd643306bc325f862cffc589e10b6d75b8c44f1ffbb33e7d82f9166765a84776d2d35879fe2e02fa846dcdb2547d5e6e1185b00efc8a65f5b167d787a9b904f4e6d8f7e656258d2c7181c84ec730e50694ac94ed2c0853737e0f396ad149137e2b0105ed438f033212cf5355e1bcb00492feeff2a088c054f2126b87c8cb8f441af7d93371b973d0750a87dfa5aa76222c7736df84c52fcb12386a20093f697de98e5ab6b9ac1bfba9e3a9922bb3a8065bb48b6b3b363d17f8f3f1c4b0ad76bbc162676e31d47b241e973d5897a01d16d33e019749d143c74c881f850be89cec3483ed9f7eddbfa96f18e92a2b89f3d62788a7dd4aaf47ce19333ae18b4997283f7a4917caccf819410668152d7d9f8b4fdd6933254af471b247ff6e2dbc4a75ce451feb9fc338f7049fa164ee75b665e5870b0c21896ada20b5e3175218798540c8390c55050f3d16c40574bc437f8b36cfa0789c5ac9a256a44001d69580727870844ac9c8a075cacb78efbd21cccf42baebd8688326e9ef79b3405b59b7e2152fd4d7a2249f6e017beb2619f066f62f9e2bbb63567ebff7d546623bc39495b21fdae430971a0c17c5ca9e26703a3c428e8f949c88d24ffaf413b1414e3c9155039ea4d3c467f5feb5f1505857d25f022717d717fae8fec297c86144617953b3aacc4dec8c0b995e51b864af9d7bb157497f0026575fdb79764c5bd69aa7d3e8b40140ecf5bc88a97b0517ff9c95292e84e0e239b15e6393fa96b3542ea3b5cdfe3096f7fca42055c0de9a923623c77374d83153e8a111a3f8713af9a4d40695985f7531d21014eca1ffafc9ffc6ab514d9e9df3da9b16fa0b87640202b14def6ad65daafbe0f6a11b2d210c430b3837c89080fd0845236fe132de9705979fa39a34e9076b7daa57bd2b08beb9c7c867c63ed062081a51d5d80394df1de54dce268482e0f182f040bf240d9321c92942470d07ed840b991b502f9be839ef663d487cd324a0bbe51e4e49f56ef152cf8f44f53e2c94195a086a3dba1ce79ced56db5a88908bca5e0949766d0cbb84a5cae98a51121c581ed1c971c2a4191a653fb1ff39ac425309bf2309770f7fa10287741f3d772a0db57c9b3fb5c57557568b96f312b7b4d57cfad0532e54714476f3cf957a673bc4f0a97445e9832e23584b6014560e129111298d239dc3ec7afb8e3c76aa2478a1294727828bf9612706269a646869ebf3dc1c6321b4e2a28e012a589efba79f6d923da1895add57b9d97d57b32f4336ff4ac2114520534e6b7d26aea7557272469e603bd47d20373e0890a0d294d671463015db4dbfd75fa81c1d6f9f21dcaa93d89480c1faa313944199c691d6cf8efa") ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0xf) 16:20:48 executing program 2: r0 = syz_open_procfs(0x0, &(0x7f0000000080)='net/dev_snmp6\x00') r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r1, 0x40045431, &(0x7f00000000c0)) r2 = syz_open_pts(r1, 0x0) r3 = dup3(r2, r0, 0x0) chmod(&(0x7f0000000000)='./file0\x00', 0x24) fallocate(0xffffffffffffffff, 0x43, 0x8, 0x5) pipe2$9p(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}, 0xc800) ioctl(r4, 0x41c8, &(0x7f0000000140)="af7ec1e938a348d7c8ab3ddc6a321fd19e3529ce547722a83ddf9906b33baa9a12bfa12794860532b17ba20c83029ec823d612c227c122d6a10fe5ca63ed8d531245dcd16ff15a15a09c91ddd861e301aa78bbf27af95eebdb9c68") ioctl$TCXONC(r3, 0x540a, 0x0) pselect6(0x40, &(0x7f0000000340)={0x9}, 0x0, 0x0, 0x0, 0x0) 16:20:48 executing program 2: r0 = syz_open_procfs(0x0, &(0x7f0000000080)='net/dev_snmp6\x00') r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r1, 0x40045431, &(0x7f00000000c0)={0xd3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0xfffffffffffff801}) r2 = syz_open_pts(r1, 0x0) r3 = dup3(r2, r0, 0x0) ioctl$TCXONC(r3, 0x540a, 0x0) pselect6(0x40, &(0x7f0000000340)={0x9}, 0x0, 0x0, 0x0, 0x0) [ 1758.770802] binder: 10347:10362 ioctl c0306201 20000300 returned -14 16:20:48 executing program 2: r0 = syz_open_procfs(0x0, &(0x7f0000000080)='net/dev_snmp6\x00') r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r1, 0x40045431, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffc}) r2 = syz_open_pts(r1, 0x0) r3 = dup3(r2, r0, 0x0) ioctl$TCXONC(r3, 0x540a, 0x0) pselect6(0x40, &(0x7f0000000340)={0x9}, 0x0, 0x0, 0x0, 0x0) 16:20:48 executing program 2: r0 = syz_open_procfs(0x0, &(0x7f0000000080)='net/dev_snmp6\x00') r1 = add_key$keyring(&(0x7f0000000040)='keyring\x00', &(0x7f0000000140)={'syz', 0x0}, 0x0, 0x0, 0xfffffffffffffffd) pipe(&(0x7f0000000480)={0xffffffffffffffff, 0xffffffffffffffff}) write(r2, &(0x7f0000000340), 0x41395527) ioctl$TCSETS(r2, 0x5402, &(0x7f00000004c0)={0x7f, 0x7, 0xffffffff, 0x5, 0x15, 0x80000000, 0x7, 0x9, 0x9, 0x9, 0x7, 0x800}) pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PPPIOCGNPMODE(r3, 0xc008744c, &(0x7f0000000100)={0x7e9f419eccd8f83a}) r5 = add_key$keyring(&(0x7f0000000180)='yring\x00', &(0x7f00000001c0)={'\xfd\xd3z', 0x2}, 0x0, 0x0, 0xffffffffffffffff) keyctl$link(0x8, r1, r5) r6 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r6, 0x40045431, &(0x7f00000000c0)) r7 = syz_open_pts(r6, 0x0) r8 = dup3(r7, r0, 0x0) ioctl$TCXONC(r8, 0x540a, 0x0) lsetxattr$security_smack_transmute(&(0x7f0000000300)='./file0\x00', &(0x7f0000000380)='security.SMACK64TRANSMUTE\x00', &(0x7f00000003c0)='TRUE', 0x4, 0x1) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000280)={&(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffa000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ff8000/0x3000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ff8000/0x2000)=nil, &(0x7f0000ff8000/0x4000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000000200)="188c7ac8e6e52327dddca7256c69116dbb4b0e10ddcedc14e8326cc05d2d7ab8c9e3e298d381276ab0b745c2ba72c081d5b1c48a8be271c0bd8be5136bcb3eab2e436f81f888e61ef0b21e428a", 0x4d}, 0x2f2) pselect6(0x40, &(0x7f0000000340)={0x9}, 0x0, 0x0, 0x0, 0x0) ioctl$sock_SIOCOUTQ(r4, 0x5411, &(0x7f0000000400)) pipe(&(0x7f0000000480)={0xffffffffffffffff, 0xffffffffffffffff}) write(r9, &(0x7f0000000340), 0x41395527) setsockopt$inet6_tcp_buf(r9, 0x6, 0xd, &(0x7f0000000440)="8bd635f2bf94c3eb6a4fe530fba284ff4c0ee153e5d44898575feb4be3ac", 0x1e) 16:20:48 executing program 1: r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/raw\x00') pread64(r0, 0x0, 0x0, 0x800000000002) accept4$inet6(r0, &(0x7f0000000040)={0xa, 0x0, 0x0, @empty}, &(0x7f0000000080)=0x1c, 0x100c00) r1 = bpf$OBJ_GET_MAP(0x7, &(0x7f0000000100)={&(0x7f00000000c0)='./file0\x00', 0x0, 0x8}, 0x10) fsync(r1) 16:20:48 executing program 1: r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/raw\x00') pread64(r0, 0x0, 0x0, 0x800000000002) r1 = openat$pfkey(0xffffffffffffff9c, &(0x7f0000000100)='\xafproc/celf/net/pfkey\x00', 0x101000, 0x0) ioctl$BLKRAGET(r1, 0x1263, &(0x7f0000000080)) 16:20:48 executing program 1: r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/raw\x00') pipe(&(0x7f0000000480)={0xffffffffffffffff}) vmsplice(r1, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) ioctl$UI_SET_SWBIT(r1, 0x4004556d, 0x6) fsetxattr$security_smack_transmute(0xffffffffffffffff, &(0x7f0000000040)='security.SMACK64TRANSMUTE\x00', &(0x7f0000000080)='jtUE', 0xfe08, 0x2) pread64(r0, 0x0, 0x0, 0x800000000002) 16:20:49 executing program 5: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS2(r1, 0x402c542b, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, 0x0, "c41e495183430405e274ccf7defb07f5340067"}) ioctl$TIOCEXCL(0xffffffffffffffff, 0x540c) [ 1759.565618] binder: 10347:10403 ioctl c0306201 20000300 returned -14 16:20:49 executing program 4: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) pipe(&(0x7f0000000480)={0xffffffffffffffff, 0xffffffffffffffff}) write(r1, &(0x7f0000000340), 0x41395527) pipe(&(0x7f0000000480)={0xffffffffffffffff}) r3 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r3, 0x40045431, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1}) syz_open_pts(r3, 0x0) ioctl$TIOCGPKT(r3, 0x80045438, &(0x7f0000000100)) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) r4 = dup2(r1, r2) ioctl$UI_GET_VERSION(r4, 0x8004552d, &(0x7f0000000080)) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) pipe(&(0x7f0000000480)={0xffffffffffffffff}) vmsplice(r6, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) ioctl$UI_SET_FFBIT(r6, 0x4004556b, 0x3c) ioctl$PERF_EVENT_IOC_ENABLE(r5, 0x8912, 0x400200) mkdir(&(0x7f0000000300)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f00000000c0)='ramfs\x00', 0x50, 0x0) creat(&(0x7f0000000040)='./file0/bus\x00', 0x6857b21ff1155d90) r7 = open(&(0x7f0000021000)='./file0\x00', 0x0, 0x0) r8 = socket(0x10, 0x2, 0x0) getsockopt$sock_cred(r8, 0x1, 0x11, &(0x7f0000caaffb)={0x0, 0x0}, &(0x7f0000cab000)=0xc) chown(&(0x7f00000001c0)='./file0\x00', r9, 0x0) r10 = socket(0x10, 0x2, 0x0) getsockopt$sock_cred(r10, 0x1, 0x11, &(0x7f0000caaffb)={0x0, 0x0}, &(0x7f0000cab000)=0xc) chown(&(0x7f00000001c0)='./file0\x00', r11, 0x0) mount$bpf(0x0, &(0x7f0000000180)='./bus\x00', &(0x7f0000000200)='bpf\x00', 0x3000100, &(0x7f00000004c0)=ANY=[@ANYBLOB="6d6f64653d30303030303030303030303031373737373737373737372c6d6f64653d30303030303030303030303030303030303030303030312c6d6f64653d30303030303030303030303030303030303030313031322c6d6f64653d30303030303030303030303030303030303030301031312c7569643d60ac5d8b4bfb10218b58e2a046dcc63368c5ea38042d030109996e5ffab94b49399cc968e93870826c3b32e87b2a0bbe25be921dc54b237974b94529214f84e5676febfe14", @ANYRESDEC=r9, @ANYBLOB=',dont_appraise,uid>', @ANYRESDEC=r11, @ANYBLOB=',fsmagic=0x0000000000000020,\x00']) fchdir(r7) creat(&(0x7f00000001c0)='./bus\x00', 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0xf) 16:20:49 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder# ', 0x0, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) r2 = dup2(r1, r0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000380)=ANY=[@ANYBLOB="04630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000300)={0x8, 0x0, &(0x7f00000004c0)=[@acquire={0x40046304}], 0xb19b868c1a8b328c, 0x0, 0x0}) 16:20:49 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f00000003c0)="11dca50d5e0bcfe47bf070") r1 = socket$inet_tcp(0x2, 0x1, 0x0) pipe(&(0x7f0000000480)={0xffffffffffffffff}) pipe(&(0x7f0000000480)={0xffffffffffffffff}) vmsplice(r3, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) ioctl$sock_inet_SIOCDELRT(r3, 0x890c, &(0x7f0000000280)={0x0, {0x2, 0x4e21, @loopback}, {0x2, 0x4e24, @rand_addr=0x1f}, {0x2, 0x4e22, @multicast1}, 0x111, 0x0, 0x0, 0x0, 0xb0, &(0x7f0000000240)='bond_slave_1\x00', 0x8000, 0x81, 0x54f99810}) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) getsockopt$inet6_IPV6_XFRM_POLICY(r2, 0x29, 0x23, &(0x7f0000000140)={{{@in6=@dev, @in6=@dev}}, {{}, 0x0, @in6=@remote}}, &(0x7f00000000c0)=0xe8) bind$inet(r1, &(0x7f0000000100)={0x2, 0x4e20}, 0x10) connect$inet(r1, &(0x7f0000000cc0)={0x2, 0x4e20, @local}, 0x10) setsockopt$SO_TIMESTAMPING(r1, 0x1, 0x25, &(0x7f00000010c0)=0x19ff, 0x4) r4 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r4, 0x40045431, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1}) syz_open_pts(r4, 0x0) ioctl$TIOCGPTLCK(r4, 0x80045439, &(0x7f0000000300)) sendto$inet(r1, &(0x7f0000000000)="01ecd164d13787a35597c5772fffc22fec6d8697aaa5d81ba3f688be4280b29e07f3fff5b7d974a43b76181cb756197c8a0b08c41ea6e41c6a6038a42bf4ca4481475911ba5d8742449126abe6686b4dd5146b336f5374ac1f56fd6b13a42a23658c5ba32f4bc8f35e6d863794fc5087a4946ab4558fae1dbe5b40ffb5dd47feb7e95c967e45914111b692b97e5654", 0xffffffffffffff5c, 0x0, 0x0, 0x0) recvmmsg(r1, &(0x7f0000003b40)=[{{0x0, 0x0, 0x0}}], 0x1, 0x2000, 0x0) 16:20:49 executing program 5: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS2(r1, 0x402c542b, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, 0x0, "c41e495183430405e274ccf7defb07f5340067"}) r2 = gettid() ptrace$setopts(0x4206, r2, 0x0, 0x0) ptrace$cont(0x18, r2, 0x0, 0x0) pipe(&(0x7f0000000480)={0xffffffffffffffff}) getpid() pipe(&(0x7f0000000480)={0xffffffffffffffff}) vmsplice(r4, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) prctl$PR_SET_MM_EXE_FILE(0x23, 0xd, r4) vmsplice(r3, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) creat(&(0x7f0000000200)='./file0\x00', 0x14) accept(r3, &(0x7f0000000140)=@pppoe={0x18, 0x0, {0x0, @local}}, &(0x7f00000001c0)=0x80) ptrace$setregs(0xd, r2, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r2, 0x0, 0x0) perf_event_open(&(0x7f00000000c0)={0x0, 0x70, 0x3ff800, 0x10001, 0xffffffffffff0521, 0x70, 0x0, 0x80, 0x10000, 0x4, 0x6, 0x100000001, 0x1, 0x1d, 0x2, 0x8c8, 0x5, 0x7ff, 0x8, 0x2, 0x2, 0x7c68, 0x2b, 0x6, 0x9, 0x4, 0x8, 0x9b, 0x8, 0x5, 0xa35c, 0x8, 0x6, 0x0, 0xfffffffffffffff7, 0xffffffffffff7fff, 0x7fff, 0x7, 0x0, 0x7, 0x1, @perf_bp={&(0x7f0000000080), 0x1}, 0x80, 0x200, 0x5d7, 0x6, 0xfffffffffffffff7, 0x1, 0x7f}, r2, 0xf, r1, 0x8) 16:20:49 executing program 2: r0 = syz_open_procfs(0x0, &(0x7f0000000080)='net/dev_snmp6\x00') r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r1, 0x40045431, &(0x7f00000000c0)) r2 = syz_open_pts(r1, 0x0) r3 = openat$selinux_policy(0xffffffffffffff9c, &(0x7f0000000280)='/selinux/policy\x00', 0x0, 0x0) ioctl$TIOCGSID(r1, 0x5429, &(0x7f00000002c0)=0x0) ioctl$TIOCSPGRP(r3, 0x5410, &(0x7f0000000300)=r4) r5 = add_key$keyring(&(0x7f0000000140)='keyring\x00', &(0x7f0000000180)={'syz', 0x1}, 0x0, 0x0, 0xfffffffffffffff9) keyctl$setperm(0x5, r5, 0x400) r6 = dup3(r2, r0, 0x0) ioctl$TCXONC(r6, 0x540a, 0x0) pselect6(0x40, &(0x7f0000000340)={0x9}, 0x0, 0x0, 0x0, 0x0) r7 = openat$selinux_access(0xffffffffffffff9c, &(0x7f0000000240)='/selinux/access\x00', 0x2, 0x0) fchmod(r7, 0x45) r8 = openat$selinux_policy(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/policy\x00', 0x0, 0x0) ioctl$KDSKBMODE(r8, 0x4b45, &(0x7f0000000100)=0x4) bind$unix(0xffffffffffffffff, &(0x7f00000001c0)=@file={0x1, './file0\x00'}, 0x6e) 16:20:49 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binder(0x0, 0x0, 0x1000) mlockall(0x1) r2 = dup2(r1, r0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000380)=ANY=[@ANYBLOB="04630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000300)={0x8, 0x0, &(0x7f00000004c0)=[@acquire={0x40046304}], 0xb19b868c1a8b328c, 0x0, 0x0}) 16:20:49 executing program 2: r0 = gettid() ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x3c) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r0, 0x0, 0x0) prctl$PR_SET_PTRACER(0x59616d61, r0) r1 = syz_open_procfs(0x0, &(0x7f0000000080)='net/dev_snmp6\x00') r2 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r2, 0x40045431, &(0x7f00000000c0)) getsockopt$sock_cred(r1, 0x1, 0x11, &(0x7f0000001800)={0x0}, &(0x7f0000001840)=0xc) perf_event_open(&(0x7f0000001780)={0x4, 0x70, 0xcf, 0x5ff, 0xff, 0xfffffffffffffffe, 0x0, 0xf25f, 0xa0010, 0x4, 0x72, 0xc333, 0x20, 0x0, 0x9, 0x4, 0x3a59, 0x20, 0x65a41814, 0x3ff, 0x101, 0x2, 0x1d, 0x6, 0x8001, 0x100, 0x0, 0xffffffff7fffffff, 0x80000000, 0x2, 0x9, 0x80000001, 0x9, 0x3, 0xfffffffffffffff9, 0x1, 0x7, 0x1, 0x0, 0x100000000, 0x7, @perf_config_ext={0x2, 0x7}, 0x401, 0x7fff, 0xa42, 0x0, 0xa, 0x1f, 0x5}, r3, 0xd, r1, 0x1) r4 = syz_open_pts(r2, 0x0) pipe(&(0x7f0000000480)={0xffffffffffffffff}) vmsplice(r5, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) recvmsg(r5, &(0x7f0000001680)={&(0x7f0000000100)=@pptp={0x18, 0x2, {0x0, @initdev}}, 0x80, &(0x7f0000001540)=[{&(0x7f0000000180)=""/227, 0xe3}, {&(0x7f0000000000)=""/26, 0x1a}, {&(0x7f0000000380)=""/4096, 0x1000}, {&(0x7f0000000280)=""/185, 0xb9}, {&(0x7f0000001380)=""/155, 0x9b}, {&(0x7f0000001440)=""/253, 0x381}], 0x6, &(0x7f00000015c0)=""/150, 0x96}, 0x40) r6 = dup3(r4, r1, 0x0) r7 = gettid() ptrace$setopts(0x4206, r7, 0x0, 0x0) tkill(r7, 0x3c) ptrace$cont(0x18, r7, 0x0, 0x0) ptrace$setregs(0xd, r7, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r7, 0x0, 0x0) ptrace$setregs(0xf, r7, 0x7, &(0x7f0000001880)="8f654ff4ede3378ce9bc1e863fb0600a257c2ff6971f955badccd96a075f589c4a0ebd7d809aa6b250f7cbf1195d1dcfa01b0fcc8a0badc900ee072c765b480af1f2a9aadeb8269e4b5f0c7058eb7b466eb80f42dfd1eab1b88f508b68b69710fba0") ioctl$TCXONC(r6, 0x540a, 0x0) pipe(&(0x7f0000000480)={0xffffffffffffffff}) vmsplice(r8, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) ioctl$EVIOCGBITKEY(r8, 0x80404521, &(0x7f00000016c0)=""/166) pselect6(0x40, &(0x7f0000000340)={0x9}, 0x0, 0x0, 0x0, 0x0) 16:20:49 executing program 2: r0 = syz_open_procfs(0x0, &(0x7f0000000080)='net/dev_snmp6\x00') r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ptmx\x00', 0x0, 0x0) r2 = syz_open_pts(r1, 0x0) r3 = dup3(r2, r0, 0x0) ioctl$TCXONC(r3, 0x540a, 0x0) pipe(&(0x7f0000000480)={0xffffffffffffffff}) vmsplice(r4, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) r5 = accept$unix(r4, &(0x7f0000000100)=@abs, &(0x7f0000000000)=0x6e) fsetxattr$trusted_overlay_origin(r5, &(0x7f0000000180)='trusted.overlay.origin\x00', &(0x7f00000001c0)='y\x00', 0x2, 0x2) pselect6(0x40, &(0x7f0000000340)={0x9}, 0x0, 0x0, 0x0, 0x0) 16:20:49 executing program 1: r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/raw\x00') pread64(r0, 0x0, 0x0, 0x800000000002) fsetxattr$trusted_overlay_redirect(r0, &(0x7f0000000040)='trusted.overlay.redirect\x00', &(0x7f0000000080)='./file0\x00', 0x8, 0x3) pipe(&(0x7f0000000480)={0xffffffffffffffff, 0xffffffffffffffff}) write(r1, &(0x7f0000000340), 0x41395527) ioctl$KDGKBSENT(r1, 0x4b48, &(0x7f00000003c0)={0x1, 0x8, 0x1f}) pipe(&(0x7f0000000480)={0xffffffffffffffff, 0xffffffffffffffff}) pipe(&(0x7f0000000480)={0xffffffffffffffff}) vmsplice(r4, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) ioctl$UI_GET_VERSION(r4, 0x8004552d, &(0x7f0000000500)) vmsplice(r2, &(0x7f0000000000), 0x10000000000003ab, 0x0) vmsplice(0xffffffffffffffff, &(0x7f0000000340)=[{&(0x7f00000000c0)="e4c81e877c9b847c9f90878e1dea58bfd23dd2b48721f3fd898844465f35960759b3aa3049af4cf640723617ece84ce359a5f7c70df61167ee99840387aa121c3f102f542b726f073c241391a2556d8ce20e1fa946c0642418bece94c30aa8c6d6784b1f89eb094ae3d120682502a738c65849755db71e69a62590e51edea6ada4ff37a16eddc80fb96a6e631b175273ceb22f5d55f234c76512c1185e037b40d0337dd70a9e7c5e90483456d7a73f47f96ec3851b0e2539d7a5744b9ae30994e81b68b71f3f62ca3e6a53d3a9924358", 0xd0}, {&(0x7f00000001c0)="06dda28c4e100eeb77b7d5", 0xb}, {&(0x7f0000000200)="0f7f0193d0f60411e0ebd6478a2ea09a747126371988148ff584bf6a164fe66ad25813d9a7965179579ac2fe0c0604b4aea16a4693a4bed02e61723e0c97f7634fdb53af3b9e11c66410d14701c30b42b9714fcb20f1f1cb3021f6e81228cfd4c40ca54d4b55d72d085ebb27d7b6dc076c48e42b6cda144542b54160f0c4daea9d4fb999f9e2d7657e1a1cae323768eceff3ac8d095a363128964f3b5767b64ab0b9fe690b36e3a325bebf7c82355fefeb967949004a75a1f85e658f86f43dab2134a44b7c15990e8791", 0xca}, {&(0x7f0000000300)="6558ad2698d949e3b106225a7ff3b9d7dae01e2458db37979767ff567fe53af8c68f6bdbcb15dcb33ef40e8a", 0x2c}], 0x4, 0x3c8563f45130591c) ioctl$FIGETBSZ(r3, 0x2, &(0x7f0000000380)) fcntl$setlease(r3, 0x400, 0x3) pipe(&(0x7f0000000480)={0xffffffffffffffff, 0xffffffffffffffff}) write(r5, &(0x7f0000000340), 0x41395527) r6 = ioctl$TUNGETDEVNETNS(r5, 0x54e3, 0x0) write$P9_RCLUNK(r2, &(0x7f0000000400)={0x7, 0x79, 0x1}, 0x7) fcntl$getown(r1, 0x9) fcntl$getown(r6, 0x9) pipe(&(0x7f0000000480)={0xffffffffffffffff, 0xffffffffffffffff}) write(r7, &(0x7f0000000340), 0x41395527) r8 = openat$selinux_mls(0xffffffffffffff9c, &(0x7f0000000440)='/selinux/mls\x00', 0x0, 0x0) bpf$BPF_PROG_ATTACH(0x8, &(0x7f00000004c0)={r7, r8, 0x20, 0x2}, 0x10) [ 1759.861886] binder: 10425:10444 ioctl c0306201 20000300 returned -14 [ 1759.983912] binder: 10425:10444 ioctl c0306201 20000300 returned -14 16:20:49 executing program 0: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) request_key(&(0x7f0000000000)='user\x00', &(0x7f0000000040)={'syz'}, &(0x7f0000000a80), 0xfffffffffffffffd) r0 = socket$inet(0x2, 0x4000000000000001, 0x0) sendto$inet(r0, 0x0, 0x0, 0x0, 0x0, 0xb2) waitid(0x0, 0x0, &(0x7f0000000080), 0x80000004, &(0x7f0000000280)) r1 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) pipe(&(0x7f0000000480)={0xffffffffffffffff}) vmsplice(r3, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) ioctl$BLKBSZSET(r3, 0x40081271, &(0x7f0000000080)=0xa6) r4 = dup2(r2, r1) ioctl$BINDER_SET_CONTEXT_MGR(r4, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="56f2ea9deae0285ae50463"], 0xfffffd9c, 0x0, 0x0}) ioctl$RTC_ALM_READ(r4, 0x80247008, &(0x7f0000000040)) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000300)={0x8, 0x0, &(0x7f00000004c0)=[@acquire={0x40046304}], 0xb19b868c1a8b328c, 0x0, 0x0}) 16:20:49 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) r2 = dup2(r1, r0) epoll_create(0x7) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000380)=ANY=[@ANYBLOB="04630440"], 0x0, 0x0, 0x0}) pipe(&(0x7f0000000480)={0xffffffffffffffff}) vmsplice(r3, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000300)={0x19b, 0x0, &(0x7f0000000040), 0xfe92, 0x0, 0x0}) 16:20:49 executing program 4: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) pipe(&(0x7f0000000480)={0xffffffffffffffff, 0xffffffffffffffff}) write(r2, &(0x7f0000000340), 0x41395527) r3 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000380)='/dev/vga_arbiter\x00', 0x140, 0x0) splice(r3, &(0x7f00000003c0), r2, &(0x7f0000000400), 0x81, 0x0) setsockopt$packet_int(r2, 0x107, 0x0, &(0x7f0000000080)=0x10001, 0x4) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0xf) 16:20:50 executing program 5: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ptmx\x00', 0x0, 0x0) pipe(&(0x7f0000000480)={0xffffffffffffffff, 0xffffffffffffffff}) write(r2, &(0x7f0000000340), 0x41395527) fcntl$setsig(r2, 0xa, 0x30) ioctl$TCSETS2(r1, 0x402c542b, &(0x7f0000000000)={0x8000, 0x0, 0x0, 0xfffffffffffffffe, 0x0, "c41e495183430405e274ccf7defb07f5340067", 0x0, 0x10000000000}) 16:20:50 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f00000003c0)="11dca50d5e0bcfe47bf070") r1 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r1, &(0x7f0000000100)={0x2, 0x4e20}, 0x10) connect$inet(r1, &(0x7f0000000cc0)={0x2, 0x4e20, @local}, 0x10) setsockopt$SO_TIMESTAMPING(r1, 0x1, 0x25, &(0x7f00000010c0)=0x19ff, 0x4) sendto$inet(r1, &(0x7f0000000140)="b0", 0x1, 0x0, 0x0, 0x0) recvmmsg(r1, &(0x7f0000003b40)=[{{0x0, 0x0, 0x0}}], 0x1, 0x2000, 0x0) r2 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000000)='/dev/uinput\x00', 0x802, 0x0) r3 = gettid() ptrace$setopts(0x4206, r3, 0x0, 0x0) tkill(r3, 0x3c) ptrace$cont(0x18, r3, 0x0, 0x0) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='stat\t\xc0\xd2\xfe\xbc\xf9\xdf-\xea\xc8\xc1w\xff\x17\x12H\xe9\x11\x93Q0I\xf81U\ro}\xe6l\xf67\xbd\xbf\x13\x11\x92\f\x8a&\xed\xa4\xdc\xc3x?\x9d\xb5\x11k4\xd3\x1b\x05\x12\xa5`\x8a\xaf\xf0\x1eyR4\f\xd6\xfd\x00\x00\x00\x00', 0x275a, 0x0) r5 = creat(&(0x7f0000000140)='./file0\x00', 0x0) write$P9_RWRITE(r4, &(0x7f0000000100)={0xb}, 0xb) write$P9_RREAD(r5, &(0x7f0000000000)=ANY=[@ANYBLOB="82720f4a52687f57a53fa5"], 0xb) fallocate(r5, 0x0, 0x40000, 0xfff) fallocate(r4, 0x0, 0x0, 0x110001) ioctl$EXT4_IOC_MOVE_EXT(r4, 0xc028660f, &(0x7f0000000040)={0x0, r5, 0x0, 0x8}) bpf$BPF_GET_MAP_INFO(0xf, &(0x7f0000000480)={r4, 0x28, &(0x7f0000000440)={0x0, 0x0}}, 0x10) bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f00000004c0)={r6, 0x6}, 0xc) bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f0000000040)={r6, 0x9, 0x10}, 0xc) ptrace$setregs(0xd, r3, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r3, 0x0, 0x0) fcntl$setown(r2, 0x8, r3) 16:20:50 executing program 2: r0 = syz_open_procfs(0x0, &(0x7f0000000080)='net/dev_snmp6\x00') r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r1, 0x40045431, &(0x7f00000000c0)) r2 = syz_open_pts(r1, 0x0) r3 = dup3(r2, r0, 0x0) r4 = socket$nl_xfrm(0x10, 0x3, 0x6) getsockopt$sock_cred(r4, 0x1, 0x11, &(0x7f0000000000), &(0x7f0000000100)=0xc) ioctl$TCXONC(r3, 0x540a, 0x0) 16:20:50 executing program 2: r0 = syz_open_procfs(0x0, &(0x7f0000000080)='net/dev_snmp6\x00') ioctl$TCSETS(0xffffffffffffffff, 0x40045431, &(0x7f00000000c0)) r1 = syz_open_pts(0xffffffffffffffff, 0x0) dup3(r1, r0, 0x0) open(&(0x7f0000000000)='./file0\x00', 0x221000, 0x0) pipe(&(0x7f0000000480)={0xffffffffffffffff, 0xffffffffffffffff}) write(r2, &(0x7f0000000340), 0x41395527) openat$zero(0xffffffffffffff9c, &(0x7f0000000040)='/dev/zero\x00', 0x0, 0x0) ioctl$TCXONC(r2, 0x540a, 0xc54) pselect6(0x40, &(0x7f0000000340)={0x9}, 0x0, 0x0, 0x0, 0x0) 16:20:50 executing program 1: r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/raw\x00') pread64(r0, 0x0, 0x0, 0x800000000002) write$P9_RCLUNK(r0, &(0x7f0000000040)={0x7, 0x79, 0x1}, 0x7) 16:20:50 executing program 1: pipe(&(0x7f0000000480)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = openat$pfkey(0xffffffffffffff9c, &(0x7f0000000200)='/proc/self/net/pfkey\x00', 0x200801, 0x0) bind$netlink(r1, &(0x7f0000000240)={0x10, 0x0, 0x25dfdbfe, 0x18000000}, 0xc) write(r0, &(0x7f0000000340), 0x41395527) r2 = accept$unix(r0, &(0x7f0000000140), &(0x7f00000001c0)=0x6e) r3 = accept4(r2, &(0x7f0000000040)=@generic, &(0x7f00000000c0)=0x80, 0x7a0e3d2bcdedfeef) fcntl$setflags(0xffffffffffffffff, 0x2, 0x1) r4 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000280)='coredump_filter\x00') r5 = getpid() r6 = gettid() ptrace$setopts(0x4206, r6, 0x0, 0x0) tkill(r6, 0x3c) ptrace$cont(0x18, r6, 0x0, 0x0) ptrace$setregs(0xd, r6, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r6, 0x0, 0x0) r7 = getpgrp(r6) ioctl$sock_SIOCGPGRP(0xffffffffffffffff, 0x8904, &(0x7f0000000300)=0x0) sendmsg$nl_netfilter(r4, &(0x7f0000000380)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f0000000340)={&(0x7f00000004c0)={0x6a8, 0xb, 0x2, 0x100, 0x70bd27, 0x25dfdbff, {0x3, 0x0, 0x6}, [@generic="041f95077afdcde24eccf823f3768dc1f95ae6b17c075b02c5d89afbd8e156b7430abb518b647f07a503340569a58c8e4e53d96e96e3b4063c50c9c6cc492e8338de27c139a449f4600ec764c30bd928046f45620fe4a4b0d6b5587f6d", @nested={0x1f8, 0x22, [@typed={0x8, 0x44, @ipv4=@rand_addr=0x100}, @generic="ca3aa5e7939ff31b804426bba726cdfd34cddfa3b4b00b074d10a8e6cbae8524db577cf463989af02f72a88ec9dd3c70fc425032d8eba6ca9988a5a338dfdee2088a7b4dac5cb2b3dff23cc9e85cad4e303b4fe1897bcd3fc583c1fa9cf59dab9316a208911bfd9b122e0dcf02203c40f1e1ccd84d68b37abe4bc96d06ad6ddd560c433b670a2a0c266b050e8e943433b5cf08c1b05b689c1104590c938a4a15213005e892793207d319bae27e93ed11825642cdd63706dd75af4f506b483770e528535e0023fe25045ae38b31005d1f9cc313b14182a0", @typed={0x14, 0x2b, @ipv6=@rand_addr="5b0ef9fed857810bd6691b442202b526"}, @generic="fbb0ad995adeb49fe0fff6fcdc277e79abd1d504aa53b965c878586667f503a7feb0764280fc189bdaaeee2cc57cb89a15a123903d5153f30ed613a626288e71405faf6b362aad0206152520bfcff6e4dc791ea28b7d17019bff83ae01337f8d9f1e2c4d0dca5b5e8a8c960c1271a15b0d195d69aff48404a02ed805e5225fb719d2d54e", @typed={0x8, 0x4d, @pid=r5}, @typed={0x8, 0x91, @pid=r7}, @generic="abea27f3a6d20492b877e07e1c474f472b8ed8ed5c77e673388f68f0fd44ed02fd023a57c4f4ae0e66bad72d61dce2e463aea6cfe72c6ce54279a51fe10985bca13681d93b6a1ebb9a82acc657c28ead2bd12cd7ab263d740ffa9aa51d8eb5ae21af36aade0f12587a246294"]}, @generic="78c0569993add521f5ee25b622485c8acf918dba19fd600d0ec42e67fd57ef0e0ed1c63273af0382", @generic="7369b8d7c12d8e919062bdcb2739c445c4f0a33f47d8031f4a606026e61d4fb0c22db6ba1ada584c9883307f42", @generic="13dc6c7f5ff9f8f0c221a134e0dedf0fa700e4cf587a2a1e308fabb0d84b0e5a4275019a306248bb30b6b5c14597cb2e7ca24e1002c31173cb00fcf4cfd653fe21cd269641ca841a381f8e7b043c06894d5a59bbe7a3c9", @nested={0x390, 0x5e, [@generic="d9252d4a3915feace811bbb13353e77bdc47e18ff7ef8914396a991d4c57b57a90edd3890e34387c800737aa2e8ae760fc7714a132af12c47224a341760aa33f908879fe9803205620a3064c98ae595e47e238a2bdffd618", @generic="55eb87e75e7e9540f150aad0fc9d2477a9bbf9e8c241ac9644e37be3a02dafed85ed8df9f23e01001ea80b216eb2234b7b6ef7b2518cd5f9e6c4d9f107d09d91bdc68c90ee1815fbdccc947d1f8706f1503d24cb41601b62410cdcabbdf0c2f1e04f457fa1f2ca2eb603d7e8a181f9f26184d16d829489ed552a0dd562735454", @generic="e6c42927e7c19ba47f9111a2aa893a93596df862e23d1967c1957b22b89a5bd06ec8c882116b03e969b51a5a26452fd3f0102a719a5de1c319af4db724de490d8c2657a04f5ca60c8c4374e8a62e6854c46064b7e0795b12c6f1f3608554f17dd112eed464711918224b53db14a185630ca042cae03df346118710f8d068287a92bd0cedb120cf29e419929bc8615f70438894ff6f7b5b6e666b7f4aebce6b49a613936d84426a21f0f39ac7550b14a33c1ba274abde2dba649b9314b81455966f72a72668a7bbe5cee02d87bfd91a515c217cd32ef83ddaa2424eef0448404b339c07938e11458fa434ea642baab710720d33822cec812a", @generic="45e995a0cca970a2dfea4d7c112a241236820a4f3ad33e10c1ab1840ddd7a4e9257f17089a8c525eba838472fa46a1a523239d6ab44a99e7f811bd1bdb35770f5dcf28df603539cb5b284f1e265be5ddca5972ef4cd19d9922a14b5076e3df4295b6ccc5a91e487b9cd76ff5604fcd7b41bbdf0fd9209bac7362e0a7868d126afc53410931bbe6c56f151a53f1f3fa99cba904bc0ff66e05ee7da90f583e1e832bb914b914ebd47567887daf94eae672b7f5195952a9a28aa80fb6f17de563173d09cc16b8e3cca41b7343e24e10843e9a6150c2aff5b754e0c826a692fec588addcab6101af", @generic="c47fa20ed63f66c598bf42280d74489ed7728d292fd1e3d8ea1937b103b00f34a0d4f8a299c2d032c1588d531e36469bc6af276d19fbc1a4f34997df28ec540c9d78acbefc5faada75bc3bd3dbed6dc1fc90611eb73663970372e2e9563d6316ae1494047db77001be54f94ce3cac3b9b1525cf389cf3a315f786bd610fac481e33cf0d008f582ed1ef15f1f1717aa5edaf0d6b6f6caef33dc16b07ea1e81dbddf66c9113ba86c91428315f941e6575fcdf7dd6ca141b1bdaaf21148", @generic="544a24b69c9cb206295a21697d754f", @typed={0x8, 0x13, @pid=r8}]}]}, 0x6a8}, 0x1, 0x0, 0x0, 0x810}, 0x14) signalfd4(r3, &(0x7f0000000100)={0x6}, 0x8, 0x101800) r9 = syz_open_procfs(0x0, &(0x7f0000000000)='net/raw\x00') pread64(r9, 0x0, 0x0, 0x800000000002) syz_extract_tcp_res(&(0x7f00000003c0), 0x100000000, 0xff) 16:20:50 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f00000003c0)="11dca50d5e0bcfe47bf070") setsockopt$ARPT_SO_SET_REPLACE(0xffffffffffffffff, 0x0, 0x60, &(0x7f0000000400)={'filter\x00', 0x7, 0x4, 0x480, 0x140, 0x280, 0x140, 0x398, 0x398, 0x398, 0x4, &(0x7f0000000000), {[{{@uncond, 0xf0, 0x140}, @mangle={0x50, 'mangle\x00', 0x0, {@mac=@broadcast, @mac=@local, @remote, @rand_addr=0x7fff, 0xf, 0xffffffff}}}, {{@uncond, 0xf0, 0x140}, @mangle={0x50, 'mangle\x00', 0x0, {@empty, @mac=@remote, @broadcast, @dev={0xac, 0x14, 0x14, 0x1b}, 0x1}}}, {{@uncond, 0xf0, 0x118}, @unspec=@NFQUEUE1={0x28, 'NFQUEUE\x00', 0x1, {0x6, 0x2}}}], {{[], 0xc0, 0xe8}, {0x28}}}}, 0x4d0) r1 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r1, &(0x7f0000000100)={0x2, 0x4e20}, 0x10) connect$inet(r1, &(0x7f0000000cc0)={0x2, 0x4e20, @local}, 0x10) setsockopt$SO_TIMESTAMPING(r1, 0x1, 0x25, &(0x7f00000010c0)=0x19ff, 0x4) sendto$inet(r1, &(0x7f0000000140)="b0", 0x1, 0x0, 0x0, 0x0) getsockopt$inet_opts(0xffffffffffffffff, 0x0, 0x4, &(0x7f0000000280)=""/219, &(0x7f0000000380)=0xdb) socketpair(0x7, 0xe02e0621003d7c38, 0x2, &(0x7f0000000040)={0xffffffffffffffff}) r3 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000100)=@newlink={0x40, 0x10, 0xe3b, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x243}, [@IFLA_MASTER={0x8, 0xa, 0x6}, @IFLA_LINKINFO={0x18, 0x12, @vti={{0x8, 0x1, 'vti\x00'}, {0xc, 0x2, [@IFLA_VTI_LOCAL={0x8, 0x4, @multicast2}]}}}]}, 0x40}, 0x1, 0x0, 0x0, 0x4000000}, 0x800) r4 = syz_genetlink_get_family_id$ipvs(&(0x7f0000001500)='IPVS\x00') r5 = accept(r3, &(0x7f0000000000)=@in={0x2, 0x0, @broadcast}, &(0x7f00000000c0)=0x80) sendmsg$IPVS_CMD_SET_INFO(r5, &(0x7f0000000240)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x2002006}, 0xc, &(0x7f0000000200)={&(0x7f00000001c0)={0x1c, r4, 0xf08, 0x70bd2b, 0x25dfdbff, {}, [@IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x5}]}, 0x1c}, 0x1, 0x0, 0x0, 0x40080}, 0x0) sendmsg$IPVS_CMD_NEW_SERVICE(r2, &(0x7f00000001c0)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x20}, 0xc, &(0x7f0000000180)={&(0x7f00000000c0)={0x1c, r4, 0x200, 0x70bd26, 0x25dfdbfb, {}, [@IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0xfffffffffffffffa}]}, 0x1c}, 0x1, 0x0, 0x0, 0x4}, 0x841) recvmmsg(r1, &(0x7f0000003b40)=[{{0x0, 0x0, 0x0}}], 0x1, 0x2000, 0x0) 16:20:50 executing program 1: r0 = syz_open_procfs(0x0, &(0x7f0000000040)='net/raw\x00') pread64(r0, 0x0, 0x0, 0x800000000002) pipe(&(0x7f0000000480)={0xffffffffffffffff}) vmsplice(r1, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) syncfs(r1) 16:20:50 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) r2 = dup2(r1, r0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) pipe(&(0x7f0000000480)={0xffffffffffffffff, 0xffffffffffffffff}) write(r3, &(0x7f0000000340), 0x41395527) r4 = openat$cgroup_ro(r3, &(0x7f0000000040)='cpuacct.usage_percpu\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000380)=ANY=[], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000300)={0x8, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="b975fc3b7b13e0bba141bd2ede1603"], 0xb19b868c1a8b328c, 0x0, 0x0}) [ 1760.973516] binder: 10508:10511 unknown command 1006400953 [ 1760.979329] binder: 10508:10511 ioctl c0306201 20000300 returned -22 16:20:50 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) truncate(&(0x7f0000000080)='./file0\x00', 0x6) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = openat$zero(0xffffffffffffff9c, &(0x7f0000000000)='/dev/zero\x00', 0x8000, 0x0) ioctl$TIOCSWINSZ(r1, 0x5414, &(0x7f0000000100)={0xff, 0x3, 0x3, 0x10001}) ioctl$SNDRV_TIMER_IOCTL_GINFO(r1, 0xc0f85403, &(0x7f0000000180)={{0x3, 0x2, 0x7, 0x1, 0x5456}, 0x9, 0x8, 'id1\x00', 'timer1\x00', 0x0, 0x4, 0x4, 0x6, 0x127b602f}) 16:20:50 executing program 4: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0xf) 16:20:50 executing program 4: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x202002, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0xf) openat$selinux_load(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/load\x00', 0x2, 0x0) lsetxattr(&(0x7f0000000080)='./file0\x00', &(0x7f0000000100)=@known='system.posix_acl_access\x00', &(0x7f0000000180)='/dev/ptmx\x00', 0xa, 0x4) r2 = socket$inet(0x2, 0x4000000000000001, 0x0) r3 = add_key$user(&(0x7f0000000400)='user\x00', &(0x7f0000000500)={'syz', 0x2}, &(0x7f0000000740)="adf1f298ac1bac9c3d6f3dd7088ea654b4d0c0216fd6039c9f3599f4eb90e9fa9662a65d09962ab7985f28190c268be092caad1a44a30b9cb7ffb74ba55a08d87a17b142b3767782e5b9dca7bf952e0c54fe24c41f7ec528036c0641a850e7e13bb3e1f8d628563930c484d5f4c7e6f57eb8210ae214170116934c7c4b9ecd38ebe379a4e370e6b036d4558d2c6a22f98bff9a1e6c0f32bd9fc1f1c2d3d42b351434a95544db8db01a6370828055e048246b9cca39ce36a812f2ce6975c8f20d8b1c156a842cc2ddce5ad756caa98ba0b4ceedb3f59dc50e2f832f77145425903391f84e4488e41d389923ee22c813923b0ddf78781242793b4a58b7d1b32f3c9e0e11f3ccd2bb9cb92364453a89cc9e9188cf075959f164daeb894937ef7ccfe675d841879bf5d9f41d427bee1a707fb5cdb87a369e7ad0778906f92d743ae9da5bd145c344ae748c41e4980816e6e5f30548125d8a8e78f08e742e876c3708db6934b9eadb446b7d406ded73d01f989936ca214b1c4cc24c741f9992e238a2d44fd9bdc474e11d3de5b86b97bb1468f0da8236c48e3dbe4925212dca23d462b8f87feefee83487ab429cb57aeb02c17e53ba39778e546ec827ffc5c0cc0ec0ddd876a0268ed27a1ffdd200d546ef1d9df96e0db747465df2e2ebdef50c907f5a23b0f23cefe866dc6a9e6e2fdb0e525ff5533e2bcb5df452e5601a840cca9fd0052ff1211276ec405e5816e41c010b242a63fa3b97b0a4d79fef738f263a16fbdb734fb11ef174bfd09709d8ebabe8e9b774c3a34d7f3146ead0cc4c6b329ec5ab3b4a58b40cf9f47199a794ccd89326d9e57d5d8faee65a21c34e49cb8994d6e69df42d0927cbe82e667cbd2ec0ecd89c8ba490ee78e4a11635587e5ccbb5fa3f93d3b776d4e522748e2bbf1dc2cb6d826a1d60d010981cf4305ec59f948f80a21c36ad3b10227825cde0c3f82f2960ddbc9e6dc31038f4b184440562cc3e74604b9162cec885324cfdf48da6c18c78fee359b53d8fe80e6b7a1d9fa37eda00179e517d9ef87c31486f184817051b7ff4421d016fad8728ce2d71435a102387084a9819b87c7858c267e1706455ee0a6dd069c057bb88df0fc7cddfd7298d273994e726fe747fffaff6b91d1bc6efe5e98f68ed762d20f8ee47ac5efd7bde79e106b84b886ab8cb69d8f3955ffd6eaca423b35d9a2d48444d296b5ac40877a137cdb150182c670abf67fdd8156a1a1da6eef74e1f6e01b771789d6b39fda761b0de124086c86d02e3912473efdc8082b3b9c97231464b6e286dbba0fa079d273ec82d620f459dda008d3975ac848794c9b47ac13bb401b1ed54544cfb010a929596a77ab12f8d78629ff81524fa66743e8197adaf9014fa51e590d6c54996dc52bca8cd965bcdcdc6d711d9b40b6fb5834e62e0ba5c41a25376393b1d79be14fee3400536f758c9c483a85d451b8f764241c2266e26449f588827ad7f2433c7810ef6f892d2da86b1109c14cef4c78796474b2f6d5c6761ea8debc6ad9a201395dbcc58d5dd098b965d76876d50dbd4cd1f3184a87cbd9d2c845d005ffece73dc9644c6d3876ea79c630d885ccf2ca10432094801bd0407f932f623132b66f690f59f163f942dd14f7a50881721e65ed674815fc0b70e57d2afdd90a58ea22cbefd117e7e2b3bbd08cf0287788d2e770cbc25bd10f5a0bf9d4fd604ff415b6e32bee283e8079c2f176911820de7d9a71d392796f396d0a4aebb1e54e1daf5a50712390e8294b288887da5ad9990b61846701c79de2f77c2fe259cb06e438b11d2b9fb9ef0dcd5666f3339326a46da9bd09d5004156eec0a4e09880a2a838fefc2d3a491eff358919d4c15ce6f0c9d32abdac334887be04601cfaf4092a8f4df25e8c4ea28ea8eb0d003d603ccc91a1555b2dc3b055c05d8b908a1d19890d7e31e6539e90021d57f040df5c2554d083c4345579c815c677d6e6a42e5b2e9f76635ec5908bd80bcb4fdb25012ea02104f86f9e31643608c1b18fcd94d04f59bc8658ebf09ca78837830c6453d8e143a474f715bacabc76f88e6742ac68fef2f6644bd0d3de978ff5f269b27ec6f1a5e025c2a0c01f1e9bf0ea7b4d54a80b4498a85307aad5f6098b335d22f0d31625ca95ed1856b55cd02dbf6431da0b536b7f5e073d22cbe7b09784f389a4935f5d854c64c7a3753f28dc2bac480343374d86f3278170233a3e74eaa461fad0590f8ce715981532203edaa762d23db1705e8efee53a85a8f5548a71d12a9644b025e782d88c87e46698ce1260a3ef37d8add19f895b712325e26ca5b6165e7ec28061925e18ca70f44c02d082cbb74e78915894a3a3de96f5ce3198d0b7e11d97a708dad811cc66424e1a741e979fdac0a15a62a5252b8f34deb23798f84469ddfc968e8961268868715affd8dc6a43b5c8716dd94372e331a6e0cebf4fd8696bc9133984e060efaee80f9921dbf3b18d510eff7fb414b961eba0e88f83dec6c66121ffe068f3a646eb86b631362d49cd38e1aa6704f0397908a0babf9cb962de4aec4b20530e2225e3ba7c8263d9a8a90640b12a9d0633eef22a42ccc478d1b0d1bf6a9590e0b9803479509c89b0187fb35ffe1aa6703e7d48c75281cdbbc6cce1e2e5f0bcd8689071747cdbac317a7d71430312927b95b1cd0fc15603da8395825aeb6499acc811e6974d4e46c8f6a7c17c8edc9727b9a68d65e7a1efb2b8085bbc0640e6fc56550a2e4e93d4b11bace5a9676716c44b1f2d5b2ab18ed45c6c71f6a58078d5814f925a52b1a601cd675c3e8ce218013895c071abcf2501cf24499cb5c3531b98a9b97dd762ed9af6f8d22c720f156c38eb7a27eabe22fa93d292497e8da1285ac223ad30a624542e2082f78adbe1059b2e7e6e831a850f0e9d71ade8c011cfbcb0718707fd6bf5b865c4af381bf431a5b22be6143ef12acb4e992c0361fabc14cfefeca590217c7416598a12623066e6b31b77c6839d6cc63e4a494d16616bcd0eab082b946bc90f324c3ffa131378b02937f677f6803f80d802cda7dac607aabe9df8bc19594711d12c85726ce4bcd6f686d13bbf391721f634b89216e1c947f88134c8b9df912306974a9140c68fe1badf8c0f693a197131846881f3ef0b3ae3ed3fbbde90b6acfa4e018000f1ac0b63bc4810690014d44dc8fe8ca5ac88f584a890f47786737a507cde305991ea0156db425e9f540b32ae01acf493db8bae8705fe46724dfdcb453cf4ee93b9305d29746b3628ea8e322ac70170ec02797e1c897e476f74d8b4d70eef872c4305015391304647c5c55171790e24188cd3e08db1b507f022b2b81c5d88abc776a41e0070c86c297ef832e548497a8b65e6bdc249c1a90ca0d72a0f2ff4b04206aad4c5bf55c7b84dde974a2e87504d2145aea3d3b478ebc028e88728b3e834d0f9f6ace8e0b570923b07e390971b035d9e4d1b6fd77db56f4196e55622c34897204690bfd3c69665a66e04f97d4b5e193f20632f5c57ab9aa496e274978b147f84bcf7e3be85bfa9245c2f55296619bdc9bdf1fb0986573206cc95ca47cb13cd663f82ea8042e42a3e8bc61c832f1745f83f1b8529d623406fa8184779141b58269adbd220afc546aa6a4d3be27567793a8fff83d71cec3ab7e59e5943f388ed3b1f3e8e254d6c6143fd0e63b4a2da47dbbebad178a323e2ccce33adeb1d4974c5cf6ab59c732afab6854a55cc165cefc17641bdb17e907d9d18b5dcc3155b8101153c30ccdc3e0bbf749bad08b4d201b35b564cb74323bdf6346bf956a3448ec6f7ca99f7e37a069b7771b32c15e2e0e5c9d6898e70e6ed0641516da2f95b7a34516883366b0b22358fd12e934934a4642ee1a8eb78225f74e8aa34e3906ed6d9585869a752e7db2b8c99a02c62512c1a435ae09fc7ef06caf578a4c7965ad684c044d336b8cf7e540cf14e6c6ebced155eb0c7b33a12754d451310adc3e5a737a31e978483004cc1a12c80c97cf316830a780b9dff407bf394b84ecbf37703849e3c37a4401d010f05be8cd5f9a011e2bfb7df829cc3efeb9479eca41e44c459329a0d2008073f156adfe0928ee8d5234cc568fc0ec128b5fbc23f445fcf8d4cfaeaacf3ea691ebfc7efc75dbf17d50f1d9eaa783c5116c086738b3434f7d71316fc96930f18f91f77ad6a2d6f30287f54b97f91f8062cbea7c4fa5ef38c970ef64aaef5a7ffdf2ffb999ae82e6f4227f69b2a3c330be24c34afc5eee54fdf8939ee4770a3b5f0f6cf07319530b1b4758d3c1ce2832300c3a2a54d9861335b12c72c3ba6105a1a1eae961fcfdae3e92390302c50ec28111549532411a505dd33b61e948e49afc8e3523e906c0bed14c7aad27aff202db4d3a415c41bedec87d37afe26915da864d812e9d1b4e5a140b1769935cdfb7223cd94d00657f9b70641759a481266b7026bb1a0fd0bbb643d0364b7b3d3535866d73db248f4bdd71f6fff2ef618b1556b92f337a4b4bbd8fa0d3c8ec1b9d01521044e1133bae69c52e44dabc3e7d4ad9503cefa382e0e7cd395dde86539c6f1d5b74315988766d3f5e7da0a45e2cce2ccb2090d8100abd35e0d40a3fc2d86258cf7d5d86cb033bf6057542768067a4ecb56e7e1b88ac0e7033adf86a59aa451ac2552b85de4e9bf88ac301733f05c99be883565d1637b522924f950aaac8cfd606b701c39192b55184a8c2366875c1e6d90e667f66d46596a0c155efa0ca09914a19d971220cad2b67d200489cdd70b59416d5442267d0a06cb2e6b8dfe7064736a40c7b1780fbc2600f659cffe8d79d620cee33c7504d6dc65023d4d8234ec04478ec25ec0e162abd0220c3c46e3901a0803be8bb5e7c45a19e7facce5593d48f04b4203983bbf5d9849742301d6e11436c2cae72d6af88f02ac1d3e50bbc489398dab9e5662d2c6062fdb187d30f607409723a817704bf742ad32f654a3e5a8c8743851e0d0391058f7eda7d686a4d544d7ad261bd818ce7df60e9f9467810f41da6315fd72a80a1a276619b4a39d7123d2ccd5bd15022edd65bfa93c068958564d2fb4c4f002512f6f9846529c6c1d5c051af467786d7d1ed5b66fa9834e6a9240bc56dbbd15d2a3ea6cdfadb2a19fd3b8df2c42e27f5833b93ce70ce0e7cf0bf6bafca369c82ccde75a119e589a7321f060979c5bf8dfc64112aabc269e8f1f83f304e17ae20a828396bb9721fdcf56861f2e5aae062a46b29cfb6c74a873ce2dc7da69a27fa7d5081e9c1a9dce056bea2cf6e9397c70d4317f322e73faaeb906c922e0e47149f4acf42f9517be203aea8aa759baafd63abdd3be6bc5a7cd34f2d01865fe8fbbe671935bb7ba1f889c0018fd0dc9ca365cd7b9a787fbb7a923661b681cb82b0d0c29b9e67431fc94de4c1291246a463dd8029cafd0a67954c4397b444c911aea08d7aba2661ec34b5153de3060a84e0f91d36bb5dc782953f32461cb3826d8b4d1364dccd9e84ea54273f93717c2b050b22a9ff773ff6ed6e29c06b406026b2b984aed2d43a6af6ff461c81e67f582ed161e92069e9bb8f5f33e3979b2f174336bf9a79a06ca842f75877a504b3ae4fe2fe18d936c2036af6cfda84ff93d64734a5b3c6ad267cde9e1127ffe4773a93ac640961d1c8f01285633ab9506956f8d772e017dbfa85a1b7dac433e27b7b0d64c31fa7654812c05bf0d395b98bc667ff836fa1a920bdfbfc0f38e96002a48a993e13e88a4e4f31fd3ee03b128bd17627fc10abb7e690fee7bfe5d38c305473da919581a9238cb361", 0xffc, 0xfffffffffffffffb) getsockopt$inet_IP_XFRM_POLICY(r2, 0x0, 0x11, &(0x7f0000000540)={{{@in6=@loopback, @in6=@ipv4={[], [], @broadcast}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@empty}, 0x0, @in6=@dev}}, &(0x7f0000000680)=0xe8) r5 = getgid() keyctl$chown(0x4, r3, r4, r5) setgid(r5) 16:20:50 executing program 5: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) sendmsg$TIPC_CMD_DISABLE_BEARER(r0, &(0x7f0000000140)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x20480015}, 0xc, &(0x7f0000000100)={&(0x7f00000000c0)=ANY=[@ANYBLOB='(\x00\x00\x00', @ANYRES16=0x0, @ANYBLOB="f5cb26bd7000eaacb3b8fddbdf00000000000062ec33"], 0x28}, 0x1, 0x0, 0x0, 0x34020040}, 0x5f5651a9005f9153) r2 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS2(r2, 0x402c542b, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, 0x0, "c41e495183430405e274ccf7defb07f5340067"}) pipe(&(0x7f0000000480)={0xffffffffffffffff, 0xffffffffffffffff}) write(r3, &(0x7f0000000340), 0x41395527) r4 = openat$zero(0xffffffffffffff9c, &(0x7f0000001740)='/dev/zero\x00', 0x0, 0x0) r5 = syz_genetlink_get_family_id$tipc(&(0x7f0000000700)='TIPC\x00') sendmsg$TIPC_CMD_GET_LINKS(r4, &(0x7f0000001940)={&(0x7f00000006c0), 0xc, &(0x7f00000017c0)={&(0x7f0000001780)={0x24, r5, 0x100, 0x70bd2b, 0x25dfdbfc, {{}, 0x0, 0x4, 0x0, {0x8, 0x11, 0x5}}, ["", "", ""]}, 0x24}, 0x1, 0x0, 0x0, 0x40}, 0x48800) sendmsg$TIPC_CMD_SHOW_LINK_STATS(r3, &(0x7f0000000240)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x26000808}, 0xc, &(0x7f0000000200)={&(0x7f00000001c0)={0x28, r5, 0x2, 0x70bd26, 0x25dfdbff, {{}, 0x0, 0xb, 0x0, {0xc, 0x14, 'syz0\x00'}}, ["", ""]}, 0x28}, 0x1, 0x0, 0x0, 0x40040c0}, 0x800) 16:20:50 executing program 4: pipe(&(0x7f0000000480)={0xffffffffffffffff}) vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x2400, 0xffff) r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ptmx\x00', 0x7ad6d136a0120c23, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000000040)=0xf) 16:20:51 executing program 2: r0 = syz_open_procfs(0x0, &(0x7f0000000080)='net/dev_snmp6\x00') r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r1, 0x40045431, &(0x7f00000000c0)) r2 = syz_open_pts(r1, 0x0) r3 = dup3(r2, r0, 0x0) ioctl$TCXONC(r3, 0x540a, 0x0) ioctl$KDSETLED(r1, 0x4b32, 0x5da) pselect6(0x40, &(0x7f0000000340)={0x9}, 0x0, 0x0, 0x0, 0x0) 16:20:51 executing program 2: r0 = syz_open_procfs(0x0, &(0x7f0000000080)='net/dev_snmp6\x00') r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r1, 0x40045431, &(0x7f00000000c0)={0xffffffffffffffff, 0x0, 0x10000004, 0x0, 0x0, 0x6b1b, 0x20000000000, 0x0, 0x0, 0x5, 0x0, 0x4}) r2 = syz_open_pts(r1, 0x0) r3 = dup3(r2, r0, 0x0) ioctl$TCXONC(r3, 0x540a, 0x0) pselect6(0x40, &(0x7f0000000340)={0x9}, 0x0, 0x0, 0x0, 0x0) setsockopt$IP_VS_SO_SET_FLUSH(r3, 0x0, 0x485, 0x0, 0x0) 16:20:51 executing program 2: r0 = syz_open_procfs(0x0, &(0x7f0000000080)='net/dev_snmp6\x00') r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r1, 0x40045431, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd}) pipe(&(0x7f0000000480)={0xffffffffffffffff, 0xffffffffffffffff}) write(r2, &(0x7f0000000340), 0x41395527) ioctl$KDGKBTYPE(r2, 0x4b33, &(0x7f0000000000)) r3 = syz_open_pts(r1, 0x0) r4 = dup3(r3, r0, 0x0) ioctl$KDDELIO(r0, 0x4b35, 0x5a3b) ioctl$TCXONC(r4, 0x540a, 0x0) pselect6(0x40, &(0x7f0000000340)={0x9}, 0x0, 0x0, 0x0, 0x0) 16:20:51 executing program 1: r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/raw\x00') pread64(r0, 0x0, 0x0, 0x800000000002) sendfile(r0, r0, &(0x7f0000000040)=0x5, 0x1) write$P9_RWALK(0xffffffffffffffff, &(0x7f0000000080)={0x7e, 0x6f, 0x1, {0x9, [{0x44, 0x1, 0x6}, {0x8, 0x4, 0x5}, {0x40, 0x3}, {0x8f, 0x2, 0x5}, {0x40, 0x3}, {0x48, 0x2, 0x6}, {0x80, 0x1, 0x1}, {0x10, 0x1, 0x1}, {0x4d}]}}, 0x7e) 16:20:51 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f00000003c0)="11dca50d5e0bcfe47bf070") r1 = socket$inet_tcp(0x2, 0x1, 0x0) socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r1, &(0x7f0000000100)={0x2, 0x4e20}, 0x10) connect$inet(r1, &(0x7f0000000cc0)={0x2, 0x4e20, @local}, 0x10) setsockopt$SO_TIMESTAMPING(r1, 0x1, 0x25, &(0x7f00000010c0)=0x19ff, 0x4) sendto$inet(r1, &(0x7f0000000140)="b0", 0x1, 0x0, 0x0, 0x0) recvmmsg(r1, &(0x7f0000003b40)=[{{0x0, 0x0, 0x0}}], 0x1, 0x2000, 0x0) 16:20:51 executing program 1: r0 = syz_open_procfs(0x0, 0xfffffffffffffffe) pread64(r0, 0x0, 0x0, 0x800000000002) r1 = openat$urandom(0xffffffffffffff9c, &(0x7f0000000000)='/dev/urandom\x00', 0x200, 0x0) r2 = memfd_create(&(0x7f0000000040)='^keyring#&*\x00', 0x2) fcntl$dupfd(r1, 0x406, r2) 16:20:51 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) r2 = dup2(r1, r0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) clock_gettime(0x3, &(0x7f0000000100)) clock_gettime(0x0, &(0x7f0000000080)={0x0, 0x0}) pselect6(0x40, &(0x7f00000000c0)={0x8}, 0x0, &(0x7f0000000140)={0x1b7}, &(0x7f00000003c0)={0x0, r3+30000000}, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000380)=ANY=[], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000300)={0x8, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="046304409d8de5610000fb00"], 0xb19b868c1a8b328c, 0x0, 0x0}) 16:20:51 executing program 1: r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/raw\x00') pread64(r0, 0x0, 0x0, 0x800000000002) pipe(&(0x7f0000000480)={0xffffffffffffffff}) r2 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000400)='/dev/ppp\x00', 0x0, 0x0) ioctl$EVIOCGPROP(r2, 0xc004743e, &(0x7f00000002c0)=""/246) ioctl$PPPIOCSDEBUG(r2, 0x40047440, 0x0) pipe(&(0x7f0000000480)={0xffffffffffffffff, 0xffffffffffffffff}) write(r3, &(0x7f0000000340), 0x41395527) ioctl$PIO_UNIMAPCLR(r3, 0x4b68, &(0x7f0000000200)={0x6, 0x1, 0x1}) vmsplice(r1, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) r4 = syz_genetlink_get_family_id$ipvs(&(0x7f00000000c0)) pipe(&(0x7f0000000480)={0xffffffffffffffff, 0xffffffffffffffff}) write(r5, &(0x7f0000000340), 0x41395527) r6 = open(&(0x7f0000000040)='./file0\x00', 0x2003, 0x100) getsockopt$inet_mreqsrc(r6, 0x0, 0x25, &(0x7f0000000080)={@remote, @loopback, @remote}, &(0x7f0000000100)=0xc) r7 = fcntl$getown(r5, 0x9) fcntl$setown(r2, 0x8, r7) sendmsg$IPVS_CMD_GET_CONFIG(r1, &(0x7f0000000180)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x2000}, 0xc, &(0x7f0000000140)={&(0x7f0000000780)=ANY=[@ANYBLOB="fcd23ecd6a6de48b6bfc78c43081e5a969d7bb9b438a0a0000d4b6beead8706855a71328a9cce1caf82f4f8515b3c62e0a0b7c87639ca7a4068dba0d4d5d50821393983a8197362fe96ecb2c695566cb5a50b39cc98980349356a596aba1ffa83d1cdc4b3d026783a261e32788d7cd8e374aac9d944d107880fdffe88f595aa8a6a9f47a1d361dfa295241472602563c0e79c7ec1b61989b132b5e15395cce7040705f2c7df697faba4d5460eec6bc039f98dc21ccd533541fab819212a74e85902e6da58e3acdaa690b63687bd4d30c94e2f3d3bc01acac362a0ac75177", @ANYRES16=r4, @ANYBLOB="000228bd7000fddbdf250d0000000800050008b4000028000300080001000000000014000200626f6e645f736cce19856648a7a187b6ce7b09398d26db6176655f300000000008000400fcff00000525e6f10f725961556ffd18f62aaa1878ad267829a4c6"], 0x3}, 0x1, 0x0, 0x0, 0x810}, 0x4000a1c1) 16:20:51 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) r2 = dup2(r1, r0) accept4(r2, &(0x7f0000000040)=@nl, &(0x7f00000000c0)=0x80, 0x800) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000380)=ANY=[@ANYBLOB="04630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000300)={0x8, 0x0, &(0x7f00000004c0)=[@acquire={0x40046304}], 0xb19b868c1a8b328c, 0x0, 0x0}) [ 1761.771219] binder: 10566:10567 IncRefs 0 refcount change on invalid ref 1642433949 ret -22 [ 1761.790593] binder: 10566:10567 ioctl c0306201 20000300 returned -14 [ 1761.798914] binder: 10566:10573 IncRefs 0 refcount change on invalid ref 1642433949 ret -22 [ 1761.807913] binder: 10566:10573 ioctl c0306201 20000300 returned -14 16:20:51 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) r2 = dup2(r1, r0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000380)=ANY=[@ANYBLOB="04630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000300)={0x8, 0x0, &(0x7f00000004c0)=[@acquire={0x40046304}], 0x0, 0x0, 0x0}) [ 1761.838854] binder: 10577:10578 ioctl c0306201 20000300 returned -14 [ 1761.847423] binder: 10577:10580 ioctl c0306201 20000300 returned -14 16:20:51 executing program 5: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) pipe(&(0x7f0000000480)={0xffffffffffffffff, 0xffffffffffffffff}) write(r1, &(0x7f0000000340), 0x41395527) setsockopt$sock_int(r1, 0x1, 0xc, &(0x7f00000000c0)=0x4, 0x4) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r2 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS2(r2, 0x402c542b, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, 0x0, "c41e495183430405e274ccf7defb07f5340067"}) syz_genetlink_get_family_id$fou(&(0x7f0000000080)='fou\x00') 16:20:51 executing program 4: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x20000, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0xf) pipe(&(0x7f0000000480)={0xffffffffffffffff}) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) ioctl$PPPIOCSMRRU(r2, 0x4004743b, &(0x7f0000000000)=0x1) 16:20:51 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = getpid() ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r3 = openat$pfkey(0xffffffffffffff9c, &(0x7f0000000100)='/proc/self/net/pfkey\x00', 0x100, 0x0) write$smack_current(r3, &(0x7f0000000180)='#eth0\x00', 0x6) ioprio_get$pid(0x2, r2) r4 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) r5 = dup2(r4, r0) ioctl$BINDER_SET_CONTEXT_MGR(r5, 0x40046207, 0x0) r6 = openat$full(0xffffffffffffff9c, &(0x7f0000000040)='/dev/full\x00', 0x2, 0x0) ioctl$PERF_EVENT_IOC_PAUSE_OUTPUT(r6, 0x40042409, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000380)=ANY=[@ANYBLOB="04630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f00000000c0)={0x0, 0x0, &(0x7f00000004c0)=ANY=[], 0x0, 0x0, 0x0}) openat$selinux_member(0xffffffffffffff9c, &(0x7f0000000080)='/selinux/member\x00', 0x2, 0x0) 16:20:51 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) r2 = dup2(r1, r0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000380)=ANY=[@ANYBLOB="04630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000300)={0x8, 0x0, &(0x7f00000004c0)=[@acquire={0x40046304}], 0xb19b868c1a8b328c, 0x0, 0x0}) r3 = gettid() ptrace$setopts(0x4206, r3, 0x0, 0x0) tkill(r3, 0x3c) ptrace$cont(0x18, r3, 0x0, 0x0) ptrace$setregs(0xd, r3, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r3, 0x0, 0x0) write$cgroup_pid(r2, &(0x7f0000000040)=r3, 0x12) [ 1762.345718] binder: 10602:10605 ioctl c0306201 20000300 returned -14 16:20:51 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) r2 = dup2(r1, r0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="04630440824f1a95884625be28c8fbf6eb0a7da26a33c49371bfb6bffc048f6e22c3ce81ae0b75513dd886a6c053389e3638586ecdea52e8b99dfa22a6542281ebbaaa676a133cee441b680f46ccbafc6f0c7be51fdda70fa0c1c122351e8ab1d9a5f85eba6991b7eef9627274575db93016"], 0x0, 0x0, 0x0}) prctl$PR_GET_KEEPCAPS(0x7) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000300)={0x8, 0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="000000004ba4b9e84013dc76719436f000000000"], 0xb19b868c1a8b328c, 0x0, 0x0}) 16:20:51 executing program 2: r0 = syz_open_procfs(0x0, &(0x7f0000000080)='net/dev_snmp6\x00') r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r1, 0x40045431, &(0x7f00000000c0)={0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x10000000000040, 0x2}) r2 = syz_open_pts(r1, 0x0) dup3(r2, r0, 0x0) r3 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r3, 0x40045431, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1}) syz_open_pts(r3, 0x0) ioctl$KDSKBMETA(r3, 0x4b63, &(0x7f0000000740)=0x7) pipe(&(0x7f0000000480)={0xffffffffffffffff, 0xffffffffffffffff}) write(r4, &(0x7f0000000340), 0x41395527) pipe(&(0x7f0000000480)={0xffffffffffffffff}) vmsplice(r5, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) r6 = dup3(r5, 0xffffffffffffffff, 0xc0000) ioctl$TCGETS(r6, 0x5401, &(0x7f0000000780)) r7 = openat$selinux_avc_cache_stats(0xffffffffffffff9c, &(0x7f0000000800)='/selinux/avc/cache_stats\x00', 0x0, 0x0) ioctl$TCXONC(r7, 0x540a, 0xa) setsockopt$IP_VS_SO_SET_DEL(0xffffffffffffffff, 0x0, 0x484, &(0x7f0000000000)={0x8, @remote, 0x4e22, 0x1, 'sh\x00', 0x20, 0x15, 0x20}, 0x2c) pipe(&(0x7f0000000480)={0xffffffffffffffff}) vmsplice(r8, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) readv(r8, &(0x7f00000006c0)=[{&(0x7f0000000100)=""/162, 0xffffffffffffffbf}, {&(0x7f00000001c0)=""/161, 0xa1}, {&(0x7f0000000280)=""/150, 0x96}, {&(0x7f0000000380)=""/203, 0xcb}, {&(0x7f00000004c0)=""/197, 0xc5}, {&(0x7f00000005c0)=""/105, 0x69}, {&(0x7f0000000640)=""/86, 0x56}], 0x7) pselect6(0x40, &(0x7f0000000340)={0x9}, 0x0, 0x0, 0x0, 0x0) ioctl$BLKBSZGET(r5, 0x80081270, &(0x7f00000007c0)) [ 1762.436462] binder: 10607:10608 IncRefs 0 refcount change on invalid ref -1793437822 ret -22 [ 1762.445810] binder: 10607:10608 unknown command 0 [ 1762.453377] binder: 10607:10608 ioctl c0306201 20000300 returned -22 [ 1762.462185] binder: 10607:10612 IncRefs 0 refcount change on invalid ref -1793437822 ret -22 [ 1762.471276] binder: 10607:10612 unknown command 0 [ 1762.476470] binder: 10607:10612 ioctl c0306201 20000300 returned -22 16:20:52 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) r2 = dup2(r1, r0) pipe(&(0x7f0000000480)={0xffffffffffffffff, 0xffffffffffffffff}) write(r3, &(0x7f0000000340), 0x41395527) ioctl$PIO_SCRNMAP(r3, 0x4b41, &(0x7f0000000040)="840796178bd1caaa8126d8f9e86625b74be97174164b426b498dfd5ad3eec5a43c5c164560c2faa399154c0a5d058d10403722864623a39e8244feb1a8219d5b3248148e8e1db9ebdaf5fa6c6cdecbfd9a380a1764b53f984a6de74ea4a01f2c68e6c869e5ae5d893647ea3fcaf3eb38e847b3804707056aafec3bf9f82cbad7780c55b9ed62ea12fb080e58d2f34ae6c29a5c552255803a56148ce53d088a") ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000380)=ANY=[@ANYBLOB="04630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000300)={0x8, 0x0, &(0x7f00000004c0)=[@acquire={0x40046304}], 0xb19b868c1a8b328c, 0x0, 0x0}) 16:20:52 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f00000003c0)="11dca50d5e0bcfe47bf070") r1 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r1, &(0x7f0000000100)={0x2, 0x4e20}, 0x10) connect$inet(r1, &(0x7f0000000cc0)={0x2, 0x4e20, @local}, 0x10) r2 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$EXT4_IOC_ALLOC_DA_BLKS(r2, 0x660c) r3 = openat$selinux_mls(0xffffffffffffff9c, &(0x7f0000000140)='/selinux/mls\x00', 0x0, 0x0) r4 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000200)='TIPCv2\x00') sendmsg$TIPC_NL_BEARER_SET(r3, &(0x7f00000002c0)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x20000}, 0xc, &(0x7f0000000240)={&(0x7f00000006c0)=ANY=[@ANYBLOB="28010000", @ANYRES16=r4, @ANYBLOB="000129bd7000ffdbdf250500000038000500080001006962000024000201080003007a622d7a080002000100000008000400030000000800010000000000080001006962000014000600080001000400000008000100494a000028000400240007000800010011000000080002001f00000008000400000000000800030000000000a000040014000700080003000000000008000200080000002400070008000400000000000800010000000000080003000500000008000200040000000c00010073797a31000000001c00070008000400ce920000080003000500000008000400080000003c000700080002000800000008000400080000000800020000000000080001000400000008000200000008000400000000000800020000000000e753782aec133657d4a703b912b224b5229bd3c8f9983e82f802ae2025c24afe5f181a9f83567c794c7fa797bdd57ff4e99a3088a543d8f9ccab1dfecf3ce47d63473153a66a0d199d9449c145c6e676cfb613ab1eeeb09552f42b619bf998b8af7a2555a77cc027f4c5ffc94c37448b31b50c1f09b562ddafeb24ba3bc201be755dbdbe"], 0x128}}, 0x0) pipe(&(0x7f0000000480)={0xffffffffffffffff, 0xffffffffffffffff}) write(r5, &(0x7f0000000340), 0x41395527) sendmsg$TIPC_NL_UDP_GET_REMOTEIP(r5, &(0x7f0000000080)={&(0x7f0000000000), 0xc, &(0x7f0000000040)={&(0x7f0000000400)={0x29c, r4, 0x1, 0x70bd28, 0x25dfdbfb, {}, [@TIPC_NLA_SOCK={0x40, 0x2, [@TIPC_NLA_SOCK_REF={0x8, 0x2, 0x3}, @TIPC_NLA_SOCK_HAS_PUBL={0x4}, @TIPC_NLA_SOCK_HAS_PUBL={0x4}, @TIPC_NLA_SOCK_REF={0x8, 0x2, 0x5}, @TIPC_NLA_SOCK_REF={0x8, 0x2, 0x6}, @TIPC_NLA_SOCK_HAS_PUBL={0x4}, @TIPC_NLA_SOCK_HAS_PUBL={0x4}, @TIPC_NLA_SOCK_HAS_PUBL={0x4}, @TIPC_NLA_SOCK_ADDR={0x8, 0x1, 0xfffffffffffff000}, @TIPC_NLA_SOCK_REF={0x8, 0x2, 0x6}]}, @TIPC_NLA_SOCK={0x1c, 0x2, [@TIPC_NLA_SOCK_ADDR={0x8}, @TIPC_NLA_SOCK_HAS_PUBL={0x4}, @TIPC_NLA_SOCK_REF={0x8, 0x2, 0x5}, @TIPC_NLA_SOCK_HAS_PUBL={0x4}]}, @TIPC_NLA_NET={0x44, 0x7, [@TIPC_NLA_NET_ID={0x8, 0x1, 0x7}, @TIPC_NLA_NET_ID={0x8, 0x1, 0x8}, @TIPC_NLA_NET_NODEID_W1={0xc, 0x4, 0x1000}, @TIPC_NLA_NET_ID={0x8, 0x1, 0x7}, @TIPC_NLA_NET_NODEID_W1={0xc, 0x4, 0xffffffffffffffff}, @TIPC_NLA_NET_ID={0x8, 0x1, 0x3}, @TIPC_NLA_NET_ID={0x8, 0x1, 0x7f}]}, @TIPC_NLA_MON={0x3c, 0x9, [@TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8, 0x1, 0x6}, @TIPC_NLA_MON_REF={0x8, 0x2, 0x48}, @TIPC_NLA_MON_REF={0x8, 0x2, 0x20}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8, 0x1, 0x80000001}, @TIPC_NLA_MON_REF={0x8, 0x2, 0xb11}, @TIPC_NLA_MON_REF={0x8, 0x2, 0x2}, @TIPC_NLA_MON_REF={0x8, 0x2, 0x9}]}, @TIPC_NLA_BEARER={0x70, 0x1, [@TIPC_NLA_BEARER_PROP={0xc, 0x2, [@TIPC_NLA_PROP_WIN={0x8, 0x3, 0x2}]}, @TIPC_NLA_BEARER_NAME={0x10, 0x1, @udp='udp:syz0\x00'}, @TIPC_NLA_BEARER_PROP={0x4}, @TIPC_NLA_BEARER_NAME={0x10, 0x1, @udp='udp:syz1\x00'}, @TIPC_NLA_BEARER_UDP_OPTS={0x2c, 0x4, {{0x14, 0x1, @in={0x2, 0x4e22, @dev={0xac, 0x14, 0x14, 0x1a}}}, {0x14, 0x2, @in={0x2, 0x4e23, @remote}}}}, @TIPC_NLA_BEARER_NAME={0x10, 0x1, @udp='udp:syz0\x00'}]}, @TIPC_NLA_LINK={0x1c, 0x4, [@TIPC_NLA_LINK_NAME={0xc, 0x1, 'syz1\x00'}, @TIPC_NLA_LINK_NAME={0xc, 0x1, 'syz0\x00'}]}, @TIPC_NLA_MON={0x24, 0x9, [@TIPC_NLA_MON_REF={0x8}, @TIPC_NLA_MON_REF={0x8, 0x2, 0x1}, @TIPC_NLA_MON_REF={0x8, 0x2, 0x41}, @TIPC_NLA_MON_REF={0x8, 0x2, 0xb1}]}, @TIPC_NLA_MEDIA={0x84, 0x5, [@TIPC_NLA_MEDIA_PROP={0x1c, 0x2, [@TIPC_NLA_PROP_TOL={0x8, 0x2, 0x9}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x7}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x7}]}, @TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'ib\x00'}, @TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'udp\x00'}, @TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'eth\x00'}, @TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'ib\x00'}, @TIPC_NLA_MEDIA_PROP={0x44, 0x2, [@TIPC_NLA_PROP_WIN={0x8}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x2}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x1b}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x20}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x9}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x481}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x1b}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x7}]}]}, @TIPC_NLA_BEARER={0x48, 0x1, [@TIPC_NLA_BEARER_UDP_OPTS={0x44, 0x4, {{0x20, 0x1, @in6={0xa, 0x4e21, 0x1, @dev={0xfe, 0x80, [], 0x26}, 0x7fffffff}}, {0x20, 0x2, @in6={0xa, 0x4e24, 0x1, @loopback, 0x6}}}}]}, @TIPC_NLA_NET={0x30, 0x7, [@TIPC_NLA_NET_NODEID={0xc, 0x3, 0x360082d0}, @TIPC_NLA_NET_ID={0x8, 0x1, 0x3}, @TIPC_NLA_NET_ADDR={0x8, 0x2, 0x4}, @TIPC_NLA_NET_ADDR={0x8, 0x2, 0x8}, @TIPC_NLA_NET_ID={0x8, 0x1, 0x8000}]}]}, 0x29c}, 0x1, 0x0, 0x0, 0x4040004}, 0x10) socket$key(0xf, 0x3, 0x2) setsockopt$SO_TIMESTAMPING(r1, 0x1, 0x25, &(0x7f00000010c0)=0x19ff, 0x4) sendto$inet(r1, &(0x7f0000000140)="b0", 0x1, 0x0, 0x0, 0x0) recvmmsg(r1, &(0x7f0000003b40)=[{{0x0, 0x0, 0x0, 0x348}, 0xfffffffffffffffe}], 0x1, 0xa101, 0x0) 16:20:52 executing program 1: pipe(&(0x7f0000000480)={0xffffffffffffffff, 0xffffffffffffffff}) write(r0, &(0x7f0000000340), 0x41395527) fcntl$getownex(r0, 0x10, &(0x7f0000000040)={0x0, 0x0}) r2 = syz_open_procfs(r1, &(0x7f00000000c0)='net/udplite\x00') pread64(r2, 0x0, 0x0, 0x800000000002) [ 1762.660626] binder: 10618:10624 ioctl c0306201 20000300 returned -14 [ 1762.671368] audit: type=1400 audit(1568823652.128:120): avc: denied { ioctl } for pid=10620 comm="syz-executor.3" path="socket:[179356]" dev="sockfs" ino=179356 ioctlcmd=0x660c scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=netlink_generic_socket permissive=1 16:20:52 executing program 5: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ptmx\x00', 0x0, 0x0) openat$selinux_checkreqprot(0xffffffffffffff9c, &(0x7f0000000100)='/selinux/checkreqprot\x00', 0x101000, 0x0) ioctl$TCSETS2(r1, 0x402c542b, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, 0x0, "c41e495183430405e274ccf7defb07f5340067"}) r2 = openat$selinux_mls(0xffffffffffffff9c, &(0x7f0000000080)='/selinux/mls\x00', 0x0, 0x0) write$P9_RLOPEN(r2, &(0x7f00000000c0)={0x18, 0xd, 0x2, {{0x0, 0x1, 0x8}, 0x401}}, 0x18) 16:20:52 executing program 5: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) pipe(&(0x7f0000000480)={0xffffffffffffffff, 0xffffffffffffffff}) write(r2, &(0x7f0000000340), 0x41395527) pipe(&(0x7f0000000480)={0xffffffffffffffff}) vmsplice(r3, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) pipe(&(0x7f0000000480)={0xffffffffffffffff}) vmsplice(r4, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) poll(&(0x7f0000000080)=[{r2, 0xd004}, {r1, 0x400}, {r3, 0x480}, {r1, 0x2a9ad81f8cc13df7}, {r4, 0x1040}, {r0, 0x8}], 0x6, 0x9) r5 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS2(r5, 0x402c542b, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, 0x0, "c41e495183430405e274ccf7defb07f5340067"}) 16:20:52 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = syz_genetlink_get_family_id$SEG6(&(0x7f0000000080)='SEG6\x00') sendmsg$SEG6_CMD_DUMPHMAC(r0, &(0x7f0000000240)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x1100880}, 0xc, &(0x7f0000000100)={&(0x7f0000000180)={0x58, r1, 0xbf1b96cf33daa805, 0x70bd2c, 0x25dfdbfd, {}, [@SEG6_ATTR_DST={0xffffffffffffff92, 0x1, @empty}, @SEG6_ATTR_SECRET={0xc, 0x4, [0x7, 0x8]}, @SEG6_ATTR_DST={0x14, 0x1, @mcast1}, @SEG6_ATTR_DSTLEN={0xffffffffffffff47, 0x2, 0x3}, @SEG6_ATTR_ALGID={0x8, 0x6, 0x7}]}, 0x58}, 0x1, 0x0, 0x0, 0x80803}, 0x8000) pipe(&(0x7f0000000480)={0xffffffffffffffff, 0xffffffffffffffff}) write(r2, &(0x7f0000000340), 0x41395527) ioctl$TIOCSETD(r2, 0x5423, &(0x7f0000000000)=0xf) 16:20:52 executing program 2: r0 = syz_open_procfs(0x0, &(0x7f0000000080)='net/dev_snmp6\x00') r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r1, 0x40045431, &(0x7f00000000c0)) r2 = syz_open_pts(r1, 0x0) r3 = dup3(r2, r0, 0x0) ioctl$TCXONC(r3, 0x540a, 0x0) pselect6(0x40, &(0x7f0000000340)={0x9}, 0x0, 0x0, 0x0, 0x0) pipe(&(0x7f0000000480)={0xffffffffffffffff}) vmsplice(r4, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) r5 = openat(0xffffffffffffff9c, &(0x7f00000003c0)='./file0/file0\x00', 0x20000, 0x60) accept$packet(0xffffffffffffffff, &(0x7f0000000400)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000440)=0x14) ioctl$sock_inet6_SIOCSIFDSTADDR(r5, 0x8918, &(0x7f0000000480)={@mcast2, 0x3f, r6}) setsockopt$inet_pktinfo(r4, 0x0, 0x8, &(0x7f0000000000)={r6, @local, @multicast1}, 0xc) 16:20:52 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) pipe(&(0x7f0000000480)={0xffffffffffffffff, 0xffffffffffffffff}) write(r2, &(0x7f0000000340), 0x41395527) r3 = dup2(r2, r0) ioctl$BINDER_SET_CONTEXT_MGR(r3, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000380)=ANY=[@ANYBLOB="4af30463"], 0x0, 0x0, 0x0}) r4 = socket$inet(0x2, 0x4000000000000001, 0x0) r5 = add_key$user(&(0x7f0000000400)='user\x00', &(0x7f0000000500)={'syz', 0x2}, &(0x7f0000000740)="adf1f298ac1bac9c3d6f3dd7088ea654b4d0c0216fd6039c9f3599f4eb90e9fa9662a65d09962ab7985f28190c268be092caad1a44a30b9cb7ffb74ba55a08d87a17b142b3767782e5b9dca7bf952e0c54fe24c41f7ec528036c0641a850e7e13bb3e1f8d628563930c484d5f4c7e6f57eb8210ae214170116934c7c4b9ecd38ebe379a4e370e6b036d4558d2c6a22f98bff9a1e6c0f32bd9fc1f1c2d3d42b351434a95544db8db01a6370828055e048246b9cca39ce36a812f2ce6975c8f20d8b1c156a842cc2ddce5ad756caa98ba0b4ceedb3f59dc50e2f832f77145425903391f84e4488e41d389923ee22c813923b0ddf78781242793b4a58b7d1b32f3c9e0e11f3ccd2bb9cb92364453a89cc9e9188cf075959f164daeb894937ef7ccfe675d841879bf5d9f41d427bee1a707fb5cdb87a369e7ad0778906f92d743ae9da5bd145c344ae748c41e4980816e6e5f30548125d8a8e78f08e742e876c3708db6934b9eadb446b7d406ded73d01f989936ca214b1c4cc24c741f9992e238a2d44fd9bdc474e11d3de5b86b97bb1468f0da8236c48e3dbe4925212dca23d462b8f87feefee83487ab429cb57aeb02c17e53ba39778e546ec827ffc5c0cc0ec0ddd876a0268ed27a1ffdd200d546ef1d9df96e0db747465df2e2ebdef50c907f5a23b0f23cefe866dc6a9e6e2fdb0e525ff5533e2bcb5df452e5601a840cca9fd0052ff1211276ec405e5816e41c010b242a63fa3b97b0a4d79fef738f263a16fbdb734fb11ef174bfd09709d8ebabe8e9b774c3a34d7f3146ead0cc4c6b329ec5ab3b4a58b40cf9f47199a794ccd89326d9e57d5d8faee65a21c34e49cb8994d6e69df42d0927cbe82e667cbd2ec0ecd89c8ba490ee78e4a11635587e5ccbb5fa3f93d3b776d4e522748e2bbf1dc2cb6d826a1d60d010981cf4305ec59f948f80a21c36ad3b10227825cde0c3f82f2960ddbc9e6dc31038f4b184440562cc3e74604b9162cec885324cfdf48da6c18c78fee359b53d8fe80e6b7a1d9fa37eda00179e517d9ef87c31486f184817051b7ff4421d016fad8728ce2d71435a102387084a9819b87c7858c267e1706455ee0a6dd069c057bb88df0fc7cddfd7298d273994e726fe747fffaff6b91d1bc6efe5e98f68ed762d20f8ee47ac5efd7bde79e106b84b886ab8cb69d8f3955ffd6eaca423b35d9a2d48444d296b5ac40877a137cdb150182c670abf67fdd8156a1a1da6eef74e1f6e01b771789d6b39fda761b0de124086c86d02e3912473efdc8082b3b9c97231464b6e286dbba0fa079d273ec82d620f459dda008d3975ac848794c9b47ac13bb401b1ed54544cfb010a929596a77ab12f8d78629ff81524fa66743e8197adaf9014fa51e590d6c54996dc52bca8cd965bcdcdc6d711d9b40b6fb5834e62e0ba5c41a25376393b1d79be14fee3400536f758c9c483a85d451b8f764241c2266e26449f588827ad7f2433c7810ef6f892d2da86b1109c14cef4c78796474b2f6d5c6761ea8debc6ad9a201395dbcc58d5dd098b965d76876d50dbd4cd1f3184a87cbd9d2c845d005ffece73dc9644c6d3876ea79c630d885ccf2ca10432094801bd0407f932f623132b66f690f59f163f942dd14f7a50881721e65ed674815fc0b70e57d2afdd90a58ea22cbefd117e7e2b3bbd08cf0287788d2e770cbc25bd10f5a0bf9d4fd604ff415b6e32bee283e8079c2f176911820de7d9a71d392796f396d0a4aebb1e54e1daf5a50712390e8294b288887da5ad9990b61846701c79de2f77c2fe259cb06e438b11d2b9fb9ef0dcd5666f3339326a46da9bd09d5004156eec0a4e09880a2a838fefc2d3a491eff358919d4c15ce6f0c9d32abdac334887be04601cfaf4092a8f4df25e8c4ea28ea8eb0d003d603ccc91a1555b2dc3b055c05d8b908a1d19890d7e31e6539e90021d57f040df5c2554d083c4345579c815c677d6e6a42e5b2e9f76635ec5908bd80bcb4fdb25012ea02104f86f9e31643608c1b18fcd94d04f59bc8658ebf09ca78837830c6453d8e143a474f715bacabc76f88e6742ac68fef2f6644bd0d3de978ff5f269b27ec6f1a5e025c2a0c01f1e9bf0ea7b4d54a80b4498a85307aad5f6098b335d22f0d31625ca95ed1856b55cd02dbf6431da0b536b7f5e073d22cbe7b09784f389a4935f5d854c64c7a3753f28dc2bac480343374d86f3278170233a3e74eaa461fad0590f8ce715981532203edaa762d23db1705e8efee53a85a8f5548a71d12a9644b025e782d88c87e46698ce1260a3ef37d8add19f895b712325e26ca5b6165e7ec28061925e18ca70f44c02d082cbb74e78915894a3a3de96f5ce3198d0b7e11d97a708dad811cc66424e1a741e979fdac0a15a62a5252b8f34deb23798f84469ddfc968e8961268868715affd8dc6a43b5c8716dd94372e331a6e0cebf4fd8696bc9133984e060efaee80f9921dbf3b18d510eff7fb414b961eba0e88f83dec6c66121ffe068f3a646eb86b631362d49cd38e1aa6704f0397908a0babf9cb962de4aec4b20530e2225e3ba7c8263d9a8a90640b12a9d0633eef22a42ccc478d1b0d1bf6a9590e0b9803479509c89b0187fb35ffe1aa6703e7d48c75281cdbbc6cce1e2e5f0bcd8689071747cdbac317a7d71430312927b95b1cd0fc15603da8395825aeb6499acc811e6974d4e46c8f6a7c17c8edc9727b9a68d65e7a1efb2b8085bbc0640e6fc56550a2e4e93d4b11bace5a9676716c44b1f2d5b2ab18ed45c6c71f6a58078d5814f925a52b1a601cd675c3e8ce218013895c071abcf2501cf24499cb5c3531b98a9b97dd762ed9af6f8d22c720f156c38eb7a27eabe22fa93d292497e8da1285ac223ad30a624542e2082f78adbe1059b2e7e6e831a850f0e9d71ade8c011cfbcb0718707fd6bf5b865c4af381bf431a5b22be6143ef12acb4e992c0361fabc14cfefeca590217c7416598a12623066e6b31b77c6839d6cc63e4a494d16616bcd0eab082b946bc90f324c3ffa131378b02937f677f6803f80d802cda7dac607aabe9df8bc19594711d12c85726ce4bcd6f686d13bbf391721f634b89216e1c947f88134c8b9df912306974a9140c68fe1badf8c0f693a197131846881f3ef0b3ae3ed3fbbde90b6acfa4e018000f1ac0b63bc4810690014d44dc8fe8ca5ac88f584a890f47786737a507cde305991ea0156db425e9f540b32ae01acf493db8bae8705fe46724dfdcb453cf4ee93b9305d29746b3628ea8e322ac70170ec02797e1c897e476f74d8b4d70eef872c4305015391304647c5c55171790e24188cd3e08db1b507f022b2b81c5d88abc776a41e0070c86c297ef832e548497a8b65e6bdc249c1a90ca0d72a0f2ff4b04206aad4c5bf55c7b84dde974a2e87504d2145aea3d3b478ebc028e88728b3e834d0f9f6ace8e0b570923b07e390971b035d9e4d1b6fd77db56f4196e55622c34897204690bfd3c69665a66e04f97d4b5e193f20632f5c57ab9aa496e274978b147f84bcf7e3be85bfa9245c2f55296619bdc9bdf1fb0986573206cc95ca47cb13cd663f82ea8042e42a3e8bc61c832f1745f83f1b8529d623406fa8184779141b58269adbd220afc546aa6a4d3be27567793a8fff83d71cec3ab7e59e5943f388ed3b1f3e8e254d6c6143fd0e63b4a2da47dbbebad178a323e2ccce33adeb1d4974c5cf6ab59c732afab6854a55cc165cefc17641bdb17e907d9d18b5dcc3155b8101153c30ccdc3e0bbf749bad08b4d201b35b564cb74323bdf6346bf956a3448ec6f7ca99f7e37a069b7771b32c15e2e0e5c9d6898e70e6ed0641516da2f95b7a34516883366b0b22358fd12e934934a4642ee1a8eb78225f74e8aa34e3906ed6d9585869a752e7db2b8c99a02c62512c1a435ae09fc7ef06caf578a4c7965ad684c044d336b8cf7e540cf14e6c6ebced155eb0c7b33a12754d451310adc3e5a737a31e978483004cc1a12c80c97cf316830a780b9dff407bf394b84ecbf37703849e3c37a4401d010f05be8cd5f9a011e2bfb7df829cc3efeb9479eca41e44c459329a0d2008073f156adfe0928ee8d5234cc568fc0ec128b5fbc23f445fcf8d4cfaeaacf3ea691ebfc7efc75dbf17d50f1d9eaa783c5116c086738b3434f7d71316fc96930f18f91f77ad6a2d6f30287f54b97f91f8062cbea7c4fa5ef38c970ef64aaef5a7ffdf2ffb999ae82e6f4227f69b2a3c330be24c34afc5eee54fdf8939ee4770a3b5f0f6cf07319530b1b4758d3c1ce2832300c3a2a54d9861335b12c72c3ba6105a1a1eae961fcfdae3e92390302c50ec28111549532411a505dd33b61e948e49afc8e3523e906c0bed14c7aad27aff202db4d3a415c41bedec87d37afe26915da864d812e9d1b4e5a140b1769935cdfb7223cd94d00657f9b70641759a481266b7026bb1a0fd0bbb643d0364b7b3d3535866d73db248f4bdd71f6fff2ef618b1556b92f337a4b4bbd8fa0d3c8ec1b9d01521044e1133bae69c52e44dabc3e7d4ad9503cefa382e0e7cd395dde86539c6f1d5b74315988766d3f5e7da0a45e2cce2ccb2090d8100abd35e0d40a3fc2d86258cf7d5d86cb033bf6057542768067a4ecb56e7e1b88ac0e7033adf86a59aa451ac2552b85de4e9bf88ac301733f05c99be883565d1637b522924f950aaac8cfd606b701c39192b55184a8c2366875c1e6d90e667f66d46596a0c155efa0ca09914a19d971220cad2b67d200489cdd70b59416d5442267d0a06cb2e6b8dfe7064736a40c7b1780fbc2600f659cffe8d79d620cee33c7504d6dc65023d4d8234ec04478ec25ec0e162abd0220c3c46e3901a0803be8bb5e7c45a19e7facce5593d48f04b4203983bbf5d9849742301d6e11436c2cae72d6af88f02ac1d3e50bbc489398dab9e5662d2c6062fdb187d30f607409723a817704bf742ad32f654a3e5a8c8743851e0d0391058f7eda7d686a4d544d7ad261bd818ce7df60e9f9467810f41da6315fd72a80a1a276619b4a39d7123d2ccd5bd15022edd65bfa93c068958564d2fb4c4f002512f6f9846529c6c1d5c051af467786d7d1ed5b66fa9834e6a9240bc56dbbd15d2a3ea6cdfadb2a19fd3b8df2c42e27f5833b93ce70ce0e7cf0bf6bafca369c82ccde75a119e589a7321f060979c5bf8dfc64112aabc269e8f1f83f304e17ae20a828396bb9721fdcf56861f2e5aae062a46b29cfb6c74a873ce2dc7da69a27fa7d5081e9c1a9dce056bea2cf6e9397c70d4317f322e73faaeb906c922e0e47149f4acf42f9517be203aea8aa759baafd63abdd3be6bc5a7cd34f2d01865fe8fbbe671935bb7ba1f889c0018fd0dc9ca365cd7b9a787fbb7a923661b681cb82b0d0c29b9e67431fc94de4c1291246a463dd8029cafd0a67954c4397b444c911aea08d7aba2661ec34b5153de3060a84e0f91d36bb5dc782953f32461cb3826d8b4d1364dccd9e84ea54273f93717c2b050b22a9ff773ff6ed6e29c06b406026b2b984aed2d43a6af6ff461c81e67f582ed161e92069e9bb8f5f33e3979b2f174336bf9a79a06ca842f75877a504b3ae4fe2fe18d936c2036af6cfda84ff93d64734a5b3c6ad267cde9e1127ffe4773a93ac640961d1c8f01285633ab9506956f8d772e017dbfa85a1b7dac433e27b7b0d64c31fa7654812c05bf0d395b98bc667ff836fa1a920bdfbfc0f38e96002a48a993e13e88a4e4f31fd3ee03b128bd17627fc10abb7e690fee7bfe5d38c305473da919581a9238cb361", 0xffc, 0xfffffffffffffffb) getsockopt$inet_IP_XFRM_POLICY(r4, 0x0, 0x11, &(0x7f0000000540)={{{@in6=@loopback, @in6=@ipv4={[], [], @broadcast}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@empty}, 0x0, @in6=@dev}}, &(0x7f0000000680)=0xe8) r7 = syz_open_dev$loop(&(0x7f0000000040)='/dev/loop#\x00', 0x8, 0x2) ioctl$BLKSECDISCARD(r7, 0x127d, &(0x7f0000000080)=0x5) r8 = getgid() keyctl$chown(0x4, r5, r6, r8) keyctl$reject(0x13, r5, 0x9, 0x1, 0xfffffffffffffff9) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000080)=ANY=[], 0x0, 0x0, 0x0}) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x2400, 0x11) 16:20:52 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f00000003c0)="11dca50d5e0bcfe47bf070") r1 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r1, &(0x7f0000000100)={0x2, 0x4e21, @multicast2}, 0x10) connect$inet(r1, &(0x7f0000000cc0)={0x2, 0x4e20, @local}, 0x10) setsockopt$IP_VS_SO_SET_DELDEST(r1, 0x0, 0x488, &(0x7f0000000000)={{0x2b, @dev={0xac, 0x14, 0x14, 0x16}, 0x4e24, 0x1, 'wlc\x00', 0x32, 0x9, 0x38}, {@multicast2, 0x4e24, 0x10000, 0x80000000, 0xb43a, 0x20}}, 0x44) setsockopt$SO_TIMESTAMPING(r1, 0x1, 0x25, &(0x7f00000010c0)=0x19ff, 0x4) sendto$inet(r1, &(0x7f0000000140)="b0", 0x1, 0x0, 0x0, 0x0) recvmmsg(r1, &(0x7f0000003b40)=[{{0x0, 0x0, 0x0}}], 0x1, 0x2000, 0x0) listen(r1, 0xfffffffffffffffd) 16:20:52 executing program 1: ioctl$sock_SIOCGPGRP(0xffffffffffffffff, 0x8904, &(0x7f0000000040)=0x0) r1 = syz_open_procfs(r0, &(0x7f0000000000)='net/raw\x00') r2 = syz_genetlink_get_family_id$tipc2(&(0x7f00000000c0)='TIPCv2\x00') sendmsg$TIPC_NL_UDP_GET_REMOTEIP(r1, &(0x7f0000000200)={&(0x7f0000000080), 0xc, &(0x7f00000001c0)={&(0x7f0000000100)={0xa8, r2, 0x2, 0x70bd28, 0x25dfdbfe, {}, [@TIPC_NLA_BEARER={0x94, 0x1, [@TIPC_NLA_BEARER_NAME={0x10, 0x1, @l2={'ib', 0x3a, 'vxcan1\x00'}}, @TIPC_NLA_BEARER_PROP={0x3c, 0x2, [@TIPC_NLA_PROP_TOL={0x8, 0x2, 0x8000}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x8}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x1}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x9}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0xe}, @TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x100000000}]}, @TIPC_NLA_BEARER_NAME={0x10, 0x1, @l2={'eth', 0x3a, 'yam0\x00'}}, @TIPC_NLA_BEARER_NAME={0x10, 0x1, @udp='udp:syz1\x00'}, @TIPC_NLA_BEARER_PROP={0xc, 0x2, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x8}]}, @TIPC_NLA_BEARER_NAME={0x10, 0x1, @l2={'ib', 0x3a, 'ip_vti0\x00'}}, @TIPC_NLA_BEARER_DOMAIN={0x8, 0x3, 0x5}]}]}, 0xa8}, 0x1, 0x0, 0x0, 0x4000000}, 0x8040) pread64(r1, 0x0, 0xfffffffffffffe6b, 0x800000000002) 16:20:52 executing program 1: r0 = openat$selinux_avc_cache_threshold(0xffffffffffffff9c, &(0x7f0000000140)='/selinux/avc/cache_threshold\x00', 0x2, 0x0) ioctl$TIOCGPGRP(r0, 0x540f, &(0x7f0000000100)) getpgrp(0xffffffffffffffff) r1 = gettid() ptrace$setopts(0x4206, r1, 0x0, 0x0) tkill(r1, 0x3c) ptrace$cont(0x18, r1, 0x0, 0x0) ptrace$setregs(0xd, r1, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r1, 0x0, 0x0) setpriority(0x2, r1, 0xbd7f) r2 = gettid() ptrace$setopts(0x4206, r2, 0x0, 0x0) tkill(r2, 0x3c) ptrace$cont(0x18, r2, 0x0, 0x0) ptrace$setregs(0xf, r2, 0x0, &(0x7f0000000080)) r3 = openat$random(0xffffffffffffff9c, &(0x7f0000000000)='/dev/urandom\x00', 0xa4000, 0x0) write(r3, &(0x7f00000000c0)="4bcb69d1717e9a1593054ef5935787663c2e8cfd459fa17a99", 0x19) ptrace$cont(0x7, r2, 0x0, 0x0) r4 = syz_open_procfs(r2, &(0x7f0000000040)='\xca\xb1\x00\x00\x00\x00\x00\xb6 ~\v\x80\x01P\x0e%dha`\xaa\x00') pread64(r4, 0x0, 0x0, 0x800000000002) 16:20:53 executing program 1: r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/raw\x00') ioctl$int_out(r0, 0x5460, &(0x7f0000000040)) pread64(r0, 0x0, 0x0, 0x800000000002) prctl$PR_SET_FP_MODE(0x2d, 0x1) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) ioctl$FITRIM(r1, 0xc0185879, &(0x7f00000000c0)={0x0, 0x3f, 0x7}) 16:20:53 executing program 1: r0 = syz_open_procfs(0x0, &(0x7f0000000080)='net/mcfilter6\x00') pread64(r0, 0x0, 0x0, 0x800000000002) 16:20:53 executing program 1: r0 = syz_open_procfs(0x0, &(0x7f0000000040)='\x00\x00\x00\x00\x00\x00\x00\x00\xd8\xd3\xbb5\x05Em\x92A\xd3\x81\xb7\xff\xff\xff\xff\xff\xdf\xff\xfc\x89x\x05\x9b\xa8sI\xdc\xe5\xfc\xc1\xf0\xf0\xe5_\x8fN\xfc\xbbO\x99\xe9\xf2p\x06\xda\v\xe2ZnOs\x05g\xec-\xea\fJ9\x88\xe8\x04<\xffKT\x9f\xf5\x13wg\xf4\xce\xce\x1d\xb8(f\x01\xdb7\v-\x151\x96\xcc\x8eB\xfa\xed\xa3\x83\xb1#\x1a+\xe6!#Ui\x99_.b\x94\xcf\xba\x92\x973\xb3f\x85\x19\x97\xb4\x87C\xb1F\n\xe1D\x8d\xa5|av\x10\x04u\xab(\xa1\xe0\x04\x8cO\xaf\xec\xc1\xaar\xcdr\xd9J\x1a\x9f\x05\xcf\xec\xb5\xf7\xc1EP\x95\xf7\x84g\x90\a\xec\x94Y\xd8\xfad\xb5\xf0\xbb\x8c\x14\x8d)\x16\x7f*b\xee\xc6\xb9\xdf\x86\xae\xeb\xa9\x82eA') pread64(r0, 0x0, 0xfffffffffffffebf, 0x800000000002) 16:20:53 executing program 1: r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/raw\x00') r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r1, 0x40045431, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1}) syz_open_pts(r1, 0x0) r2 = fcntl$dupfd(r1, 0x406, r0) write$cgroup_subtree(r2, &(0x7f0000000040)={[{0x2d, 'pids'}, {0x0, 'memory'}, {0x2d, 'rdma'}, {0x2b, 'memory'}, {0x2b, 'cpu'}]}, 0x21) pipe(&(0x7f0000000480)={0xffffffffffffffff, 0xffffffffffffffff}) write(r3, &(0x7f0000000340), 0x41395527) write$P9_RSTATFS(r3, &(0x7f0000000080)={0x43, 0x9, 0x2, {0x7, 0x3b1b, 0x11, 0x1, 0x8, 0x6, 0x400, 0x2, 0x6}}, 0x43) pread64(r0, 0x0, 0x0, 0x800000000002) 16:20:53 executing program 5: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/commit_pending_bools\x00', 0x1, 0x0) ioctl$TCGETS2(r1, 0x802c542a, &(0x7f0000000100)) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r2 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS2(r2, 0x402c542b, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, 0x0, "c41e495183430405e274ccf7defb07f5340067"}) ioctl$KDSKBMODE(0xffffffffffffffff, 0x4b45, &(0x7f0000000080)=0xfff) fallocate(r2, 0x2e, 0x5, 0xffffffff) r3 = gettid() ptrace$setopts(0x4206, r3, 0x0, 0x0) tkill(r3, 0x3c) ptrace$cont(0x18, r3, 0x0, 0x0) ptrace$setregs(0xd, r3, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r3, 0x0, 0x0) syz_open_procfs(r3, &(0x7f0000000140)='net/rt6_stats\x00') 16:20:53 executing program 4: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) openat$selinux_status(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/status\x00', 0x0, 0x0) openat$selinux_status(0xffffffffffffff9c, &(0x7f0000000080)='/selinux/status\x00', 0x0, 0x0) r1 = openat$selinux_avc_cache_stats(0xffffffffffffff9c, &(0x7f0000000100)='/selinux/avc/cache_stats\x00', 0x0, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x2400, 0x200) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0xf) 16:20:53 executing program 5: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ptmx\x00', 0x0, 0x0) openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ptmx\x00', 0x20000, 0x0) ioctl$TCSETS2(r1, 0x402c542b, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, 0x0, "c41e495183430405e274ccf7defb07f5340067"}) 16:20:53 executing program 2: r0 = syz_open_procfs(0x0, &(0x7f0000000080)='net/dev_snmp6\x00') r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ptmx\x00', 0xb00, 0x0) ioctl$TCSETS(r1, 0x40045431, &(0x7f00000000c0)) r2 = syz_open_pts(r1, 0x0) r3 = dup3(r2, r0, 0x0) ioctl$TCXONC(r3, 0x540a, 0x0) 16:20:53 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) r2 = dup2(r1, r0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) pipe(&(0x7f0000000480)={0xffffffffffffffff, 0xffffffffffffffff}) write(r3, &(0x7f0000000340), 0x41395527) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000040)=ANY=[], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000300)={0x8, 0x0, &(0x7f00000004c0)=[@acquire={0x40046304}], 0xb19b868c1a8b328c, 0x0, 0x0}) 16:20:53 executing program 4: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) r1 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000100)='/selinux/enforce\x00', 0x65d8c98b234fab40, 0x0) write$tun(r1, &(0x7f0000000180)={@void, @val={0x2, 0x80, 0x5, 0x3, 0x7f, 0x1}, @ipx={0xffff, 0x1e, 0x4, 0x0, {@random=0x1000, @current, 0xfffffffffffffffd}, {@random=0x80, @broadcast, 0x9e}}}, 0x28) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = openat$zero(0xffffffffffffff9c, &(0x7f0000000000)='/dev/zero\x00', 0x1a1240, 0x0) ioctl$VT_OPENQRY(r3, 0x5600, &(0x7f0000000080)) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0xf) 16:20:53 executing program 5: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) bpf$BPF_GET_PROG_INFO(0xf, &(0x7f0000000280)={0xffffffffffffffff, 0xc0, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, ""/16, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000080)=0x7fffffff, 0x0, 0x0, 0x0, &(0x7f00000000c0)={0x7, 0x3}, 0x0, 0x0, &(0x7f0000000100)={0x3, 0x6, 0x5, 0x800}, &(0x7f0000000140)=0x1, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000180)=0xb9b1}}, 0x10) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS2(r1, 0x402c542b, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, 0x0, "c41e495183430405e274ccf7defb07f5340067"}) 16:20:53 executing program 2: r0 = syz_open_procfs(0x0, &(0x7f0000000080)='net/dev_snmp6\x00') r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r1, 0x40045431, &(0x7f00000000c0)) pipe(&(0x7f0000000480)={0xffffffffffffffff, 0xffffffffffffffff}) write(r2, &(0x7f0000000340), 0x41395527) getsockopt$sock_int(r2, 0x1, 0x1d, &(0x7f0000000000), &(0x7f0000000100)=0x4) r3 = syz_open_pts(r1, 0x0) r4 = dup3(r3, r0, 0x0) ioctl$TCXONC(r4, 0x540a, 0x0) ioctl$TIOCGPGRP(0xffffffffffffffff, 0x540f, &(0x7f0000000140)=0x0) fcntl$lock(0xffffffffffffffff, 0x26, &(0x7f0000000180)={0x0, 0x1, 0x1000, 0x8001, r5}) pselect6(0x40, &(0x7f0000000340)={0x9}, 0x0, 0x0, 0x0, 0x0) 16:20:53 executing program 5: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS2(r1, 0x402c542b, &(0x7f0000000000)={0x0, 0x0, 0xc6, 0x0, 0x0, "c41e495183430405e274ccf7defb07f5340067"}) [ 1764.322871] binder: 10707:10712 ioctl c0306201 20000300 returned -14 16:20:53 executing program 5: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = openat$pfkey(0xffffffffffffff9c, &(0x7f0000000080)='/proc/self/net/pfkey\x00', 0x2, 0x0) r2 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000100)='TIPCv2\x00') sendmsg$TIPC_NL_BEARER_ENABLE(r1, &(0x7f0000000300)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x40082000}, 0xc, &(0x7f00000002c0)={&(0x7f0000001980)=ANY=[@ANYBLOB="8001000061f6de62d182c20148ee580024eba55106ef1a848bf179cf62e3fba98183d6ea47167b2eec5974ff3d49104e327ddbad078d4078b8992bd35ad82a04fab1dd111ae94ef5070668c7fc2b47030334a5b94fa3e7b60916c2f11190ac2aa692d8a16f0c3f52f33e33f3751fafea00"/122, @ANYRES16=r2, @ANYBLOB="803429bd7000fedbdf2503000000180004001400070008000400080000000800010012000000540005002c0002000800030002000000080002008100000008000400000000000800030006000000080003009d0900001c0002000800060002000000080003000000000008000300000001000800010069620000e00004000c000700080001001b000000140001917ead7d05debe0d06ddf93cc4a5830062726f6164636173742d6c696e6b000044000700080004000900000008000200ff000000080002003f000000080002003ba80d700800040001010000080003003b870000080001001b00000108000300faffffff24000700080001001300000008000300540f0000080002008ed4aa7f48256dffff08000300810000001400010062726f6164636173742d6c696e6b000014000700080001001c00000008000200ff0100002c00070008000300080000070800030007000000080001001f0000000800040002000000080004000100000020000700080001004708000008000100ffffff7f0c0004008800000000000000"], 0x180}, 0x1, 0x0, 0x0, 0x80}, 0x40040) r3 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ptmx\x00', 0x0, 0x0) r4 = socket$inet(0x2, 0x4000000000000001, 0x0) r5 = add_key$user(&(0x7f0000000400)='user\x00', &(0x7f0000000500)={'syz', 0x2}, &(0x7f0000000740)="adf1f298ac1bac9c3d6f3dd7088ea654b4d0c0216fd6039c9f3599f4eb90e9fa9662a65d09962ab7985f28190c268be092caad1a44a30b9cb7ffb74ba55a08d87a17b142b3767782e5b9dca7bf952e0c54fe24c41f7ec528036c0641a850e7e13bb3e1f8d628563930c484d5f4c7e6f57eb8210ae214170116934c7c4b9ecd38ebe379a4e370e6b036d4558d2c6a22f98bff9a1e6c0f32bd9fc1f1c2d3d42b351434a95544db8db01a6370828055e048246b9cca39ce36a812f2ce6975c8f20d8b1c156a842cc2ddce5ad756caa98ba0b4ceedb3f59dc50e2f832f77145425903391f84e4488e41d389923ee22c813923b0ddf78781242793b4a58b7d1b32f3c9e0e11f3ccd2bb9cb92364453a89cc9e9188cf075959f164daeb894937ef7ccfe675d841879bf5d9f41d427bee1a707fb5cdb87a369e7ad0778906f92d743ae9da5bd145c344ae748c41e4980816e6e5f30548125d8a8e78f08e742e876c3708db6934b9eadb446b7d406ded73d01f989936ca214b1c4cc24c741f9992e238a2d44fd9bdc474e11d3de5b86b97bb1468f0da8236c48e3dbe4925212dca23d462b8f87feefee83487ab429cb57aeb02c17e53ba39778e546ec827ffc5c0cc0ec0ddd876a0268ed27a1ffdd200d546ef1d9df96e0db747465df2e2ebdef50c907f5a23b0f23cefe866dc6a9e6e2fdb0e525ff5533e2bcb5df452e5601a840cca9fd0052ff1211276ec405e5816e41c010b242a63fa3b97b0a4d79fef738f263a16fbdb734fb11ef174bfd09709d8ebabe8e9b774c3a34d7f3146ead0cc4c6b329ec5ab3b4a58b40cf9f47199a794ccd89326d9e57d5d8faee65a21c34e49cb8994d6e69df42d0927cbe82e667cbd2ec0ecd89c8ba490ee78e4a11635587e5ccbb5fa3f93d3b776d4e522748e2bbf1dc2cb6d826a1d60d010981cf4305ec59f948f80a21c36ad3b10227825cde0c3f82f2960ddbc9e6dc31038f4b184440562cc3e74604b9162cec885324cfdf48da6c18c78fee359b53d8fe80e6b7a1d9fa37eda00179e517d9ef87c31486f184817051b7ff4421d016fad8728ce2d71435a102387084a9819b87c7858c267e1706455ee0a6dd069c057bb88df0fc7cddfd7298d273994e726fe747fffaff6b91d1bc6efe5e98f68ed762d20f8ee47ac5efd7bde79e106b84b886ab8cb69d8f3955ffd6eaca423b35d9a2d48444d296b5ac40877a137cdb150182c670abf67fdd8156a1a1da6eef74e1f6e01b771789d6b39fda761b0de124086c86d02e3912473efdc8082b3b9c97231464b6e286dbba0fa079d273ec82d620f459dda008d3975ac848794c9b47ac13bb401b1ed54544cfb010a929596a77ab12f8d78629ff81524fa66743e8197adaf9014fa51e590d6c54996dc52bca8cd965bcdcdc6d711d9b40b6fb5834e62e0ba5c41a25376393b1d79be14fee3400536f758c9c483a85d451b8f764241c2266e26449f588827ad7f2433c7810ef6f892d2da86b1109c14cef4c78796474b2f6d5c6761ea8debc6ad9a201395dbcc58d5dd098b965d76876d50dbd4cd1f3184a87cbd9d2c845d005ffece73dc9644c6d3876ea79c630d885ccf2ca10432094801bd0407f932f623132b66f690f59f163f942dd14f7a50881721e65ed674815fc0b70e57d2afdd90a58ea22cbefd117e7e2b3bbd08cf0287788d2e770cbc25bd10f5a0bf9d4fd604ff415b6e32bee283e8079c2f176911820de7d9a71d392796f396d0a4aebb1e54e1daf5a50712390e8294b288887da5ad9990b61846701c79de2f77c2fe259cb06e438b11d2b9fb9ef0dcd5666f3339326a46da9bd09d5004156eec0a4e09880a2a838fefc2d3a491eff358919d4c15ce6f0c9d32abdac334887be04601cfaf4092a8f4df25e8c4ea28ea8eb0d003d603ccc91a1555b2dc3b055c05d8b908a1d19890d7e31e6539e90021d57f040df5c2554d083c4345579c815c677d6e6a42e5b2e9f76635ec5908bd80bcb4fdb25012ea02104f86f9e31643608c1b18fcd94d04f59bc8658ebf09ca78837830c6453d8e143a474f715bacabc76f88e6742ac68fef2f6644bd0d3de978ff5f269b27ec6f1a5e025c2a0c01f1e9bf0ea7b4d54a80b4498a85307aad5f6098b335d22f0d31625ca95ed1856b55cd02dbf6431da0b536b7f5e073d22cbe7b09784f389a4935f5d854c64c7a3753f28dc2bac480343374d86f3278170233a3e74eaa461fad0590f8ce715981532203edaa762d23db1705e8efee53a85a8f5548a71d12a9644b025e782d88c87e46698ce1260a3ef37d8add19f895b712325e26ca5b6165e7ec28061925e18ca70f44c02d082cbb74e78915894a3a3de96f5ce3198d0b7e11d97a708dad811cc66424e1a741e979fdac0a15a62a5252b8f34deb23798f84469ddfc968e8961268868715affd8dc6a43b5c8716dd94372e331a6e0cebf4fd8696bc9133984e060efaee80f9921dbf3b18d510eff7fb414b961eba0e88f83dec6c66121ffe068f3a646eb86b631362d49cd38e1aa6704f0397908a0babf9cb962de4aec4b20530e2225e3ba7c8263d9a8a90640b12a9d0633eef22a42ccc478d1b0d1bf6a9590e0b9803479509c89b0187fb35ffe1aa6703e7d48c75281cdbbc6cce1e2e5f0bcd8689071747cdbac317a7d71430312927b95b1cd0fc15603da8395825aeb6499acc811e6974d4e46c8f6a7c17c8edc9727b9a68d65e7a1efb2b8085bbc0640e6fc56550a2e4e93d4b11bace5a9676716c44b1f2d5b2ab18ed45c6c71f6a58078d5814f925a52b1a601cd675c3e8ce218013895c071abcf2501cf24499cb5c3531b98a9b97dd762ed9af6f8d22c720f156c38eb7a27eabe22fa93d292497e8da1285ac223ad30a624542e2082f78adbe1059b2e7e6e831a850f0e9d71ade8c011cfbcb0718707fd6bf5b865c4af381bf431a5b22be6143ef12acb4e992c0361fabc14cfefeca590217c7416598a12623066e6b31b77c6839d6cc63e4a494d16616bcd0eab082b946bc90f324c3ffa131378b02937f677f6803f80d802cda7dac607aabe9df8bc19594711d12c85726ce4bcd6f686d13bbf391721f634b89216e1c947f88134c8b9df912306974a9140c68fe1badf8c0f693a197131846881f3ef0b3ae3ed3fbbde90b6acfa4e018000f1ac0b63bc4810690014d44dc8fe8ca5ac88f584a890f47786737a507cde305991ea0156db425e9f540b32ae01acf493db8bae8705fe46724dfdcb453cf4ee93b9305d29746b3628ea8e322ac70170ec02797e1c897e476f74d8b4d70eef872c4305015391304647c5c55171790e24188cd3e08db1b507f022b2b81c5d88abc776a41e0070c86c297ef832e548497a8b65e6bdc249c1a90ca0d72a0f2ff4b04206aad4c5bf55c7b84dde974a2e87504d2145aea3d3b478ebc028e88728b3e834d0f9f6ace8e0b570923b07e390971b035d9e4d1b6fd77db56f4196e55622c34897204690bfd3c69665a66e04f97d4b5e193f20632f5c57ab9aa496e274978b147f84bcf7e3be85bfa9245c2f55296619bdc9bdf1fb0986573206cc95ca47cb13cd663f82ea8042e42a3e8bc61c832f1745f83f1b8529d623406fa8184779141b58269adbd220afc546aa6a4d3be27567793a8fff83d71cec3ab7e59e5943f388ed3b1f3e8e254d6c6143fd0e63b4a2da47dbbebad178a323e2ccce33adeb1d4974c5cf6ab59c732afab6854a55cc165cefc17641bdb17e907d9d18b5dcc3155b8101153c30ccdc3e0bbf749bad08b4d201b35b564cb74323bdf6346bf956a3448ec6f7ca99f7e37a069b7771b32c15e2e0e5c9d6898e70e6ed0641516da2f95b7a34516883366b0b22358fd12e934934a4642ee1a8eb78225f74e8aa34e3906ed6d9585869a752e7db2b8c99a02c62512c1a435ae09fc7ef06caf578a4c7965ad684c044d336b8cf7e540cf14e6c6ebced155eb0c7b33a12754d451310adc3e5a737a31e978483004cc1a12c80c97cf316830a780b9dff407bf394b84ecbf37703849e3c37a4401d010f05be8cd5f9a011e2bfb7df829cc3efeb9479eca41e44c459329a0d2008073f156adfe0928ee8d5234cc568fc0ec128b5fbc23f445fcf8d4cfaeaacf3ea691ebfc7efc75dbf17d50f1d9eaa783c5116c086738b3434f7d71316fc96930f18f91f77ad6a2d6f30287f54b97f91f8062cbea7c4fa5ef38c970ef64aaef5a7ffdf2ffb999ae82e6f4227f69b2a3c330be24c34afc5eee54fdf8939ee4770a3b5f0f6cf07319530b1b4758d3c1ce2832300c3a2a54d9861335b12c72c3ba6105a1a1eae961fcfdae3e92390302c50ec28111549532411a505dd33b61e948e49afc8e3523e906c0bed14c7aad27aff202db4d3a415c41bedec87d37afe26915da864d812e9d1b4e5a140b1769935cdfb7223cd94d00657f9b70641759a481266b7026bb1a0fd0bbb643d0364b7b3d3535866d73db248f4bdd71f6fff2ef618b1556b92f337a4b4bbd8fa0d3c8ec1b9d01521044e1133bae69c52e44dabc3e7d4ad9503cefa382e0e7cd395dde86539c6f1d5b74315988766d3f5e7da0a45e2cce2ccb2090d8100abd35e0d40a3fc2d86258cf7d5d86cb033bf6057542768067a4ecb56e7e1b88ac0e7033adf86a59aa451ac2552b85de4e9bf88ac301733f05c99be883565d1637b522924f950aaac8cfd606b701c39192b55184a8c2366875c1e6d90e667f66d46596a0c155efa0ca09914a19d971220cad2b67d200489cdd70b59416d5442267d0a06cb2e6b8dfe7064736a40c7b1780fbc2600f659cffe8d79d620cee33c7504d6dc65023d4d8234ec04478ec25ec0e162abd0220c3c46e3901a0803be8bb5e7c45a19e7facce5593d48f04b4203983bbf5d9849742301d6e11436c2cae72d6af88f02ac1d3e50bbc489398dab9e5662d2c6062fdb187d30f607409723a817704bf742ad32f654a3e5a8c8743851e0d0391058f7eda7d686a4d544d7ad261bd818ce7df60e9f9467810f41da6315fd72a80a1a276619b4a39d7123d2ccd5bd15022edd65bfa93c068958564d2fb4c4f002512f6f9846529c6c1d5c051af467786d7d1ed5b66fa9834e6a9240bc56dbbd15d2a3ea6cdfadb2a19fd3b8df2c42e27f5833b93ce70ce0e7cf0bf6bafca369c82ccde75a119e589a7321f060979c5bf8dfc64112aabc269e8f1f83f304e17ae20a828396bb9721fdcf56861f2e5aae062a46b29cfb6c74a873ce2dc7da69a27fa7d5081e9c1a9dce056bea2cf6e9397c70d4317f322e73faaeb906c922e0e47149f4acf42f9517be203aea8aa759baafd63abdd3be6bc5a7cd34f2d01865fe8fbbe671935bb7ba1f889c0018fd0dc9ca365cd7b9a787fbb7a923661b681cb82b0d0c29b9e67431fc94de4c1291246a463dd8029cafd0a67954c4397b444c911aea08d7aba2661ec34b5153de3060a84e0f91d36bb5dc782953f32461cb3826d8b4d1364dccd9e84ea54273f93717c2b050b22a9ff773ff6ed6e29c06b406026b2b984aed2d43a6af6ff461c81e67f582ed161e92069e9bb8f5f33e3979b2f174336bf9a79a06ca842f75877a504b3ae4fe2fe18d936c2036af6cfda84ff93d64734a5b3c6ad267cde9e1127ffe4773a93ac640961d1c8f01285633ab9506956f8d772e017dbfa85a1b7dac433e27b7b0d64c31fa7654812c05bf0d395b98bc667ff836fa1a920bdfbfc0f38e96002a48a993e13e88a4e4f31fd3ee03b128bd17627fc10abb7e690fee7bfe5d38c305473da919581a9238cb361", 0xffc, 0xfffffffffffffffb) pipe(&(0x7f0000000480)={0xffffffffffffffff, 0xffffffffffffffff}) write(r6, &(0x7f0000000340), 0x41395527) openat$selinux_checkreqprot(0xffffffffffffff9c, &(0x7f0000000340)='/selinux/checkreqprot\x00', 0x105020, 0x0) getsockopt$inet_IP_XFRM_POLICY(r4, 0x0, 0x11, &(0x7f0000000140)={{{@in6=@loopback, @in6=@ipv4={[], [], @broadcast}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@empty}, 0x0, @in6=@dev}}, &(0x7f0000000280)=0xe8) r8 = getgid() sync() keyctl$chown(0x4, r5, r7, r8) keyctl$setperm(0x5, r5, 0x2000) ioctl$TCSETS2(r3, 0x402c542b, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, 0x0, "c41e495183430405e274ccf7defb07f5340067"}) 16:20:53 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f00000003c0)="11dca50d5e0bcfe47bf070") r1 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r1, &(0x7f0000000100)={0x2, 0x4e20}, 0x10) connect$inet(r1, &(0x7f0000000cc0)={0x2, 0x4e20, @local}, 0x10) setsockopt$SO_TIMESTAMPING(r1, 0x1, 0x25, &(0x7f00000010c0)=0x35fb, 0x4) sendto$inet(r1, &(0x7f0000000140)="b0", 0x1, 0x0, 0x0, 0x0) recvmmsg(r1, &(0x7f0000003b40)=[{{0x0, 0x0, 0x0}}], 0x1, 0x2000, 0x0) write$P9_RREADLINK(r1, &(0x7f0000000000)={0x10, 0x17, 0x1, {0x7, './file0'}}, 0x10) r2 = open(&(0x7f0000000040)='./file0\x00', 0x42800, 0x100) r3 = openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000080)='/selinux/commit_pending_bools\x00', 0x1, 0x0) r4 = syz_genetlink_get_family_id$team(&(0x7f0000000100)='team\x00') r5 = creat(&(0x7f0000000040)='./file0\x00', 0x0) ioctl$FS_IOC_SETFLAGS(r5, 0x40086602, &(0x7f0000000200)=0x1fb) ioctl$FS_IOC_SETFLAGS(r5, 0x401c5820, &(0x7f0000000000)=0xa8) r6 = openat$selinux_status(0xffffffffffffff9c, 0x0, 0x0, 0x0) accept$packet(r6, &(0x7f00000001c0)={0x11, 0x0, 0x0}, &(0x7f0000000200)=0x14) ioctl$ifreq_SIOCGIFINDEX_team(r5, 0x8933, &(0x7f0000000140)={'team0\x00', r7}) accept$packet(0xffffffffffffffff, &(0x7f0000000180)={0x11, 0x0, 0x0}, &(0x7f00000001c0)=0x14) r10 = openat$selinux_status(0xffffffffffffff9c, 0x0, 0x0, 0x0) r11 = socket(0x200000000000011, 0x3, 0x0) fcntl$setstatus(r11, 0x4, 0x2400) accept$packet(r10, &(0x7f00000001c0)={0x11, 0x0, 0x0}, &(0x7f0000000200)=0x14) ioctl$sock_SIOCGIFINDEX(r11, 0x8933, &(0x7f0000000240)={'ip6_vti0\x00', r12}) getsockopt$inet6_mreq(r3, 0x29, 0x14, &(0x7f00000003c0)={@dev, 0x0}, &(0x7f0000000400)=0x14) r14 = creat(&(0x7f0000000040)='./file0\x00', 0x0) ioctl$FS_IOC_SETFLAGS(r14, 0x40086602, &(0x7f0000000200)=0x1fb) ioctl$FS_IOC_SETFLAGS(r14, 0x401c5820, &(0x7f0000000000)=0xa8) getsockopt$inet_mreqn(r14, 0x0, 0x0, &(0x7f0000000440)={@local, @dev, 0x0}, &(0x7f0000000480)=0xc) r16 = openat$selinux_status(0xffffffffffffff9c, 0x0, 0x0, 0x0) r17 = socket(0x200000000000011, 0x3, 0x0) fcntl$setstatus(r17, 0x4, 0x2400) accept$packet(r16, &(0x7f00000001c0)={0x11, 0x0, 0x0}, &(0x7f0000000200)=0x14) ioctl$sock_SIOCGIFINDEX(r17, 0x8933, &(0x7f0000000240)={'ip6_vti0\x00', r18}) r19 = openat$selinux_status(0xffffffffffffff9c, 0x0, 0x0, 0x0) r20 = socket(0x200000000000011, 0x3, 0x0) fcntl$setstatus(r20, 0x4, 0x2400) accept$packet(r19, &(0x7f00000001c0)={0x11, 0x0, 0x0}, &(0x7f0000000200)=0x14) ioctl$sock_SIOCGIFINDEX(r20, 0x8933, &(0x7f0000000240)={'ip6_vti0\x00', r21}) r22 = openat$selinux_status(0xffffffffffffff9c, 0x0, 0x0, 0x0) r23 = socket(0x200000000000011, 0x3, 0x0) fcntl$setstatus(r23, 0x4, 0x2400) accept$packet(r22, &(0x7f00000001c0)={0x11, 0x0, 0x0}, &(0x7f0000000200)=0x14) ioctl$sock_SIOCGIFINDEX(r23, 0x8933, &(0x7f0000000240)={'ip6_vti0\x00', r24}) r25 = openat$selinux_status(0xffffffffffffff9c, 0x0, 0x0, 0x0) r26 = socket(0x200000000000011, 0x3, 0x0) fcntl$setstatus(r26, 0x4, 0x2400) accept$packet(r25, &(0x7f00000001c0)={0x11, 0x0, 0x0}, &(0x7f0000000200)=0x14) ioctl$sock_SIOCGIFINDEX(r26, 0x8933, &(0x7f0000000240)={'ip6_vti0\x00', r27}) r28 = openat$selinux_status(0xffffffffffffff9c, 0x0, 0x0, 0x0) r29 = socket(0x200000000000011, 0x3, 0x0) fcntl$setstatus(r29, 0x4, 0x2400) accept$packet(r28, &(0x7f00000001c0)={0x11, 0x0, 0x0}, &(0x7f0000000200)=0x14) ioctl$sock_SIOCGIFINDEX(r29, 0x8933, &(0x7f0000000240)={'ip6_vti0\x00', r30}) r31 = openat$selinux_status(0xffffffffffffff9c, 0x0, 0x0, 0x0) r32 = socket(0x200000000000011, 0x3, 0x0) fcntl$setstatus(r32, 0x4, 0x2400) accept$packet(r31, &(0x7f00000001c0)={0x11, 0x0, 0x0}, &(0x7f0000000200)=0x14) ioctl$sock_SIOCGIFINDEX(r32, 0x8933, &(0x7f0000000240)={'ip6_vti0\x00', r33}) r34 = creat(&(0x7f0000000040)='./file0\x00', 0x0) ioctl$FS_IOC_SETFLAGS(r34, 0x40086602, &(0x7f0000000200)=0x1fb) ioctl$FS_IOC_SETFLAGS(r34, 0x401c5820, &(0x7f0000000000)=0xa8) getsockopt$inet6_IPV6_IPSEC_POLICY(r34, 0x29, 0x22, &(0x7f0000003f00)={{{@in6=@mcast1, @in=@local, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@broadcast}, 0x0, @in=@local}}, &(0x7f0000004000)=0xe8) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f00000053c0)={{{@in=@broadcast, @in6=@loopback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@multicast1}, 0x0, @in=@remote}}, &(0x7f00000054c0)=0xe8) r37 = openat$selinux_status(0xffffffffffffff9c, 0x0, 0x0, 0x0) r38 = socket(0x200000000000011, 0x3, 0x0) fcntl$setstatus(r38, 0x4, 0x2400) accept$packet(r37, &(0x7f00000001c0)={0x11, 0x0, 0x0}, &(0x7f0000000200)=0x14) ioctl$sock_SIOCGIFINDEX(r38, 0x8933, &(0x7f0000000240)={'ip6_vti0\x00', r39}) getsockopt$inet_IP_IPSEC_POLICY(r3, 0x0, 0x10, &(0x7f0000005500)={{{@in=@multicast1, @in6=@initdev, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@initdev}, 0x0, @in6=@remote}}, &(0x7f0000005600)=0xe8) sendmsg$TEAM_CMD_NOOP(0xffffffffffffffff, &(0x7f0000005d00)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000005cc0)={&(0x7f0000005640)={0x678, r4, 0x600, 0x70bd2b, 0x25dfdbfc, {}, [{{0x8, 0x1, r8}, {0xb8, 0x2, [{0x38, 0x1, @mcast_rejoin_interval={{0x24, 0x1, 'mcast_rejoin_interval\x00'}, {0x8}, {0x8, 0x4, 0x5}}}, {0x40, 0x1, @priority={{{0x24, 0x1, 'priority\x00'}, {0x8}, {0x8, 0x4, 0x1000}}, {0x8, 0x6, r9}}}, {0x3c, 0x1, @user_linkup_enabled={{{0x24, 0x1, 'user_linkup_enabled\x00'}, {0x8}, {0x4}}, {0x8, 0x6, r12}}}]}}, {{0x8, 0x1, r13}, {0x84, 0x2, [{0x40, 0x1, @lb_hash_stats={{{0x24, 0x1, 'lb_hash_stats\x00'}, {0x8}, {0x8, 0x4, 0x1ff}}, {0x8}}}, {0x40, 0x1, @priority={{{0x24, 0x1, 'priority\x00'}, {0x8}, {0x8, 0x4, 0x5}}, {0x8, 0x6, r15}}}]}}, {{0x8, 0x1, r18}, {0x1a4, 0x2, [{0x40, 0x1, @priority={{{0x24, 0x1, 'priority\x00'}, {0x8}, {0x8, 0x4, 0x81}}, {0x8}}}, {0x38, 0x1, @mcast_rejoin_interval={{0x24, 0x1, 'mcast_rejoin_interval\x00'}, {0x8}, {0x8, 0x4, 0xff}}}, {0x38, 0x1, @mcast_rejoin_interval={{0x24, 0x1, 'mcast_rejoin_interval\x00'}, {0x8}, {0x8, 0x4, 0xe6cf}}}, {0x3c, 0x1, @enabled={{{0x24, 0x1, 'enabled\x00'}, {0x8}, {0x4}}, {0x8, 0x6, r21}}}, {0x3c, 0x1, @user_linkup={{{0x24, 0x1, 'user_linkup\x00'}, {0x8}, {0x4}}, {0x8, 0x6, r24}}}, {0x40, 0x1, @name={{0x24, 0x1, 'mode\x00'}, {0x8}, {0x10, 0x4, 'roundrobin\x00'}}}, {0x38, 0x1, @mcast_rejoin_count={{0x24, 0x1, 'mcast_rejoin_count\x00'}, {0x8}, {0x8, 0x4, 0x4}}}]}}, {{0x8, 0x1, r27}, {0x80, 0x2, [{0x3c, 0x1, @name={{0x24, 0x1, 'mode\x00'}, {0x8}, {0xc, 0x4, 'random\x00'}}}, {0x40, 0x1, @queue_id={{{0x24, 0x1, 'queue_id\x00'}, {0x8}, {0x8, 0x4, 0x9}}, {0x8, 0x6, r30}}}]}}, {{0x8, 0x1, r33}, {0x1a8, 0x2, [{0x40, 0x1, @lb_hash_stats={{{0x24, 0x1, 'lb_hash_stats\x00'}, {0x8}, {0x8, 0x4, 0xfffffffffffffff8}}, {0x8}}}, {0x40, 0x1, @queue_id={{{0x24, 0x1, 'queue_id\x00'}, {0x8}, {0x8, 0x4, 0x7}}, {0x8}}}, {0x38, 0x1, @mcast_rejoin_interval={{0x24, 0x1, 'mcast_rejoin_interval\x00'}, {0x8}, {0x8, 0x4, 0x7ff}}}, {0x40, 0x1, @lb_tx_hash_to_port_mapping={{{0x24, 0x1, 'lb_tx_hash_to_port_mapping\x00'}, {0x8}, {0x8, 0x4, r35}}, {0x8}}}, {0x3c, 0x1, @user_linkup={{{0x24, 0x1, 'user_linkup\x00'}, {0x8}, {0x4}}, {0x8, 0x6, r36}}}, {0x38, 0x1, @notify_peers_interval={{0x24, 0x1, 'notify_peers_interval\x00'}, {0x8}, {0x8, 0x4, 0x10001}}}, {0x38, 0x1, @notify_peers_count={{0x24, 0x1, 'notify_peers_count\x00'}, {0x8}, {0x8, 0x4, 0xe0}}}]}}, {{0x8, 0x1, r39}, {0x12c, 0x2, [{0x38, 0x1, @mcast_rejoin_count={{0x24, 0x1, 'mcast_rejoin_count\x00'}, {0x8}, {0x8}}}, {0x3c, 0x1, @user_linkup={{{0x24, 0x1, 'user_linkup\x00'}, {0x8}, {0x4}}, {0x8, 0x6, r40}}}, {0x38, 0x1, @mcast_rejoin_count={{0x24, 0x1, 'mcast_rejoin_count\x00'}, {0x8}, {0x8, 0x4, 0x1f}}}, {0x3c, 0x1, @bpf_hash_func={{0x24, 0x1, 'bpf_hash_func\x00'}, {0x8}, {0xc, 0x4, [{0x9, 0x6, 0xff, 0xc4}]}}}, {0x40, 0x1, @lb_hash_stats={{{0x24, 0x1, 'lb_hash_stats\x00'}, {0x8}, {0x8, 0x4, 0x3ff}}, {0x8}}}]}}]}, 0x678}, 0x1, 0x0, 0x0, 0x20008000}, 0x8000) getsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x11, &(0x7f0000000180)={{{@in=@initdev, @in6=@ipv4={[], [], @local}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@mcast1}, 0x0, @in6}}, &(0x7f0000000280)=0xe8) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f00000002c0)={{{@in=@multicast1, @in=@dev, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@multicast1}, 0x0, @in6=@remote}}, &(0x7f0000000400)=0xe8) r43 = openat(0xffffffffffffff9c, &(0x7f00000003c0)='./file0/file0\x00', 0x20000, 0x60) accept$packet(0xffffffffffffffff, &(0x7f0000000400)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000440)=0x14) ioctl$sock_inet6_SIOCSIFDSTADDR(r43, 0x8918, &(0x7f0000000480)={@mcast2, 0x3f, r44}) r45 = openat(0xffffffffffffff9c, &(0x7f00000003c0)='./file0/file0\x00', 0x20000, 0x60) accept$packet(0xffffffffffffffff, &(0x7f0000000400)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000440)=0x14) ioctl$sock_inet6_SIOCSIFDSTADDR(r45, 0x8918, &(0x7f0000000480)={@mcast2, 0x3f, r46}) ioctl$ifreq_SIOCGIFINDEX_team(r0, 0x8933, &(0x7f0000000480)={'team0\x00', r46}) r48 = openat(0xffffffffffffff9c, &(0x7f00000003c0)='./file0/file0\x00', 0x20000, 0x60) accept$packet(0xffffffffffffffff, &(0x7f0000000400)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000500)=0x17) ioctl$sock_inet6_SIOCSIFDSTADDR(r48, 0x8918, &(0x7f0000000480)={@mcast2, 0x3f, r49}) r50 = openat(0xffffffffffffff9c, &(0x7f00000003c0)='./file0/file0\x00', 0x20000, 0x60) accept$packet(0xffffffffffffffff, &(0x7f0000000400)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000440)=0x14) ioctl$sock_inet6_SIOCSIFDSTADDR(r50, 0x8918, &(0x7f0000000480)={@mcast2, 0x3f, r51}) pipe(&(0x7f0000000480)={0xffffffffffffffff, 0xffffffffffffffff}) write(r52, &(0x7f0000000340), 0x41395527) ioctl$ifreq_SIOCGIFINDEX_team(r52, 0x8933, &(0x7f00000004c0)={'team0\x00', 0x0}) getsockopt$inet_IP_XFRM_POLICY(0xffffffffffffffff, 0x0, 0x11, &(0x7f00000005c0)={{{@in, @in6=@dev, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@multicast2}, 0x0, @in=@broadcast}}, &(0x7f00000006c0)=0xe8) getsockopt$inet_pktinfo(r1, 0x0, 0x8, &(0x7f0000000700)={0x0, @multicast2, @local}, &(0x7f0000000740)=0xc) r56 = openat(0xffffffffffffff9c, &(0x7f00000003c0)='./file0/file0\x00', 0x20000, 0x60) accept$packet(0xffffffffffffffff, &(0x7f0000000400)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000440)=0x14) ioctl$sock_inet6_SIOCSIFDSTADDR(r56, 0x8918, &(0x7f0000000480)={@mcast2, 0x3f, r57}) r58 = openat(0xffffffffffffff9c, &(0x7f00000003c0)='./file0/file0\x00', 0x20000, 0x60) accept$packet(0xffffffffffffffff, &(0x7f0000000400)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000440)=0x14) ioctl$sock_inet6_SIOCSIFDSTADDR(r58, 0x8918, &(0x7f0000000480)={@mcast2, 0x3f, r59}) getsockopt$inet_mreqn(0xffffffffffffffff, 0x0, 0x20, &(0x7f0000000840)={@multicast2, @rand_addr, 0x0}, &(0x7f0000000880)=0xc) r61 = openat(0xffffffffffffff9c, &(0x7f00000003c0)='./file0/file0\x00', 0x20000, 0x60) accept$packet(0xffffffffffffffff, &(0x7f0000000400)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000440)=0x14) ioctl$sock_inet6_SIOCSIFDSTADDR(r61, 0x8918, &(0x7f0000000480)={@mcast2, 0x3f, r62}) r63 = openat(0xffffffffffffff9c, &(0x7f00000003c0)='./file0/file0\x00', 0x20000, 0x60) accept$packet(0xffffffffffffffff, &(0x7f0000000400)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000440)=0x14) ioctl$sock_inet6_SIOCSIFDSTADDR(r63, 0x8918, &(0x7f0000000480)={@mcast2, 0x3f, r64}) getsockopt$inet_IP_IPSEC_POLICY(0xffffffffffffffff, 0x0, 0x10, &(0x7f00000008c0)={{{@in6=@initdev, @in6=@mcast2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@local}, 0x0, @in=@empty}}, &(0x7f00000009c0)=0xe8) ioctl$ifreq_SIOCGIFINDEX_team(r1, 0x8933, &(0x7f0000000a00)={'team0\x00', 0x0}) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000000a40)={{{@in6=@mcast1, @in6=@loopback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@multicast1}, 0x0, @in6=@local}}, &(0x7f0000000b40)=0xe8) r68 = openat(0xffffffffffffff9c, &(0x7f00000003c0)='./file0/file0\x00', 0x20000, 0x60) accept$packet(0xffffffffffffffff, &(0x7f0000000400)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000440)=0x14) ioctl$sock_inet6_SIOCSIFDSTADDR(r68, 0x8918, &(0x7f0000000480)={@mcast2, 0x3f, r69}) r70 = openat(0xffffffffffffff9c, &(0x7f00000003c0)='./file0/file0\x00', 0x20000, 0x60) accept$packet(0xffffffffffffffff, &(0x7f0000000400)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000440)=0x14) ioctl$sock_inet6_SIOCSIFDSTADDR(r70, 0x8918, &(0x7f0000000480)={@mcast2, 0x3f, r71}) sendmsg$TEAM_CMD_OPTIONS_SET(r2, &(0x7f0000000bc0)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x40100208}, 0xc, &(0x7f0000000b80)={&(0x7f0000001100)={0x654, r4, 0x4, 0x70bd2c, 0x25dfdbfd, {}, [{{0x8, 0x1, r41}, {0x80, 0x2, [{0x3c, 0x1, @user_linkup_enabled={{{0x24, 0x1, 'user_linkup_enabled\x00'}, {0x8}, {0x4}}, {0x8, 0x6, r42}}}, {0x40, 0x1, @lb_tx_hash_to_port_mapping={{{0x24, 0x1, 'lb_tx_hash_to_port_mapping\x00'}, {0x8}, {0x8, 0x4, r44}}, {0x8}}}]}}, {{0x8, 0x1, r47}, {0x58, 0x2, [{0x54, 0x1, @bpf_hash_func={{0x24, 0x1, 'bpf_hash_func\x00'}, {0x8}, {0x24, 0x4, [{0x8001, 0x442a, 0x0, 0x5}, {0x7, 0x81, 0x23f, 0x8}, {0x35, 0x9, 0x80, 0x2}, {0x2, 0xbe3c, 0x4, 0x7fff}]}}}]}}, {{0x8, 0x1, r49}, {0xb8, 0x2, [{0x3c, 0x1, @lb_tx_method={{0x24, 0x1, 'lb_tx_method\x00'}, {0x8}, {0xc, 0x4, 'hash\x00'}}}, {0x38, 0x1, @notify_peers_count={{0x24, 0x1, 'notify_peers_count\x00'}, {0x8}, {0x8, 0x4, 0x7}}}, {0x40, 0x1, @lb_tx_hash_to_port_mapping={{{0x24, 0x1, 'lb_tx_hash_to_port_mapping\x00'}, {0x8}, {0x8, 0x4, r51}}, {0x8}}}]}}, {{0x8, 0x1, r53}, {0x118, 0x2, [{0x5c, 0x1, @bpf_hash_func={{0x24, 0x1, 'bpf_hash_func\x00'}, {0x8}, {0x2c, 0x4, [{0x7ff, 0xdbc, 0x7, 0x3}, {0x0, 0x100000000000000, 0x7, 0x20}, {0x800, 0x23d, 0xffff, 0x8}, {0x800, 0x5, 0x101, 0x80}, {0x0, 0x1, 0x3, 0x1f}]}}}, {0x3c, 0x1, @lb_tx_method={{0x24, 0x1, 'lb_tx_method\x00'}, {0x8}, {0xc, 0x4, 'hash\x00'}}}, {0x3c, 0x1, @name={{0x24, 0x1, 'mode\x00'}, {0x8}, {0xc, 0x4, 'random\x00'}}}, {0x40, 0x1, @name={{0x24, 0x1, 'mode\x00'}, {0x8}, {0x10, 0x4, 'loadbalance\x00'}}}]}}, {{0x8, 0x1, r54}, {0x3c, 0x2, [{0x38, 0x1, @lb_stats_refresh_interval={{0x24, 0x1, 'lb_stats_refresh_interval\x00'}, {0x8}, {0x8, 0x4, 0xffffffff}}}]}}, {{0x8, 0x1, r55}, {0x1a0, 0x2, [{0x40, 0x1, @priority={{{0x24, 0x1, 'priority\x00'}, {0x8}, {0x8, 0x4, 0x7}}, {0x8, 0x6, r57}}}, {0x38, 0x1, @mcast_rejoin_count={{0x24, 0x1, 'mcast_rejoin_count\x00'}, {0x8}, {0x8, 0x4, 0x2}}}, {0x3c, 0x1, @user_linkup_enabled={{{0x24, 0x1, 'user_linkup_enabled\x00'}, {0x8}, {0x4}}, {0x8, 0x6, r59}}}, {0x38, 0x1, @activeport={{0x24, 0x1, 'activeport\x00'}, {0x8}, {0x8, 0x4, r60}}}, {0x38, 0x1, @activeport={{0x24, 0x1, 'activeport\x00'}, {0x8}, {0x8, 0x4, r62}}}, {0x40, 0x1, @lb_tx_hash_to_port_mapping={{{0x24, 0x1, 'lb_tx_hash_to_port_mapping\x00'}, {0x8}, {0x8, 0x4, r64}}, {0x8}}}, {0x38, 0x1, @activeport={{0x24, 0x1, 'activeport\x00'}, {0x8}, {0x8, 0x4, r65}}}]}}, {{0x8, 0x1, r66}, {0x184, 0x2, [{0x40, 0x1, @lb_tx_hash_to_port_mapping={{{0x24, 0x1, 'lb_tx_hash_to_port_mapping\x00'}, {0x8}, {0x8, 0x4, r67}}, {0x8}}}, {0x3c, 0x1, @user_linkup={{{0x24, 0x1, 'user_linkup\x00'}, {0x8}, {0x4}}, {0x8, 0x6, r69}}}, {0x4c, 0x1, @lb_tx_method={{0x24, 0x1, 'lb_tx_method\x00'}, {0x8}, {0x1c, 0x4, 'hash_to_port_mapping\x00'}}}, {0x40, 0x1, @lb_port_stats={{{0x24, 0x1, 'lb_port_stats\x00'}, {0x8}, {0x8, 0x4, 0x5}}, {0x8, 0x6, r71}}}, {0x38, 0x1, @mcast_rejoin_interval={{0x24, 0x1, 'mcast_rejoin_interval\x00'}, {0x8}, {0x8, 0x4, 0xffffffffffffff01}}}, {0x40, 0x1, @lb_hash_stats={{{0x24, 0x1, 'lb_hash_stats\x00'}, {0x8}, {0x8, 0x4, 0x528}}, {0x8}}}]}}]}, 0x654}, 0x1, 0x0, 0x0, 0x4}, 0xc4) 16:20:53 executing program 4: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$KDSETLED(r0, 0x4b32, 0x7) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000080)='/selinux/commit_pending_bools\x00', 0x1, 0x0) r4 = syz_genetlink_get_family_id$team(&(0x7f0000000100)='team\x00') r5 = creat(&(0x7f0000000040)='./file0\x00', 0x0) ioctl$FS_IOC_SETFLAGS(r5, 0x40086602, &(0x7f0000000200)=0x1fb) ioctl$FS_IOC_SETFLAGS(r5, 0x401c5820, &(0x7f0000000000)=0xa8) r6 = openat$selinux_status(0xffffffffffffff9c, 0x0, 0x0, 0x0) accept$packet(r6, &(0x7f00000001c0)={0x11, 0x0, 0x0}, &(0x7f0000000200)=0x14) ioctl$ifreq_SIOCGIFINDEX_team(r5, 0x8933, &(0x7f0000000140)={'team0\x00', r7}) accept$packet(0xffffffffffffffff, &(0x7f0000000180)={0x11, 0x0, 0x0}, &(0x7f00000001c0)=0x14) r10 = openat$selinux_status(0xffffffffffffff9c, 0x0, 0x0, 0x0) r11 = socket(0x200000000000011, 0x3, 0x0) fcntl$setstatus(r11, 0x4, 0x2400) accept$packet(r10, &(0x7f00000001c0)={0x11, 0x0, 0x0}, &(0x7f0000000200)=0x14) ioctl$sock_SIOCGIFINDEX(r11, 0x8933, &(0x7f0000000240)={'ip6_vti0\x00', r12}) getsockopt$inet6_mreq(r3, 0x29, 0x14, &(0x7f00000003c0)={@dev, 0x0}, &(0x7f0000000400)=0x14) r14 = creat(&(0x7f0000000040)='./file0\x00', 0x0) ioctl$FS_IOC_SETFLAGS(r14, 0x40086602, &(0x7f0000000200)=0x1fb) ioctl$FS_IOC_SETFLAGS(r14, 0x401c5820, &(0x7f0000000000)=0xa8) getsockopt$inet_mreqn(r14, 0x0, 0x0, &(0x7f0000000440)={@local, @dev, 0x0}, &(0x7f0000000480)=0xc) r16 = openat$selinux_status(0xffffffffffffff9c, 0x0, 0x0, 0x0) r17 = socket(0x200000000000011, 0x3, 0x0) fcntl$setstatus(r17, 0x4, 0x2400) accept$packet(r16, &(0x7f00000001c0)={0x11, 0x0, 0x0}, &(0x7f0000000200)=0x14) ioctl$sock_SIOCGIFINDEX(r17, 0x8933, &(0x7f0000000240)={'ip6_vti0\x00', r18}) r19 = openat$selinux_status(0xffffffffffffff9c, 0x0, 0x0, 0x0) r20 = socket(0x200000000000011, 0x3, 0x0) fcntl$setstatus(r20, 0x4, 0x2400) accept$packet(r19, &(0x7f00000001c0)={0x11, 0x0, 0x0}, &(0x7f0000000200)=0x14) ioctl$sock_SIOCGIFINDEX(r20, 0x8933, &(0x7f0000000240)={'ip6_vti0\x00', r21}) r22 = openat$selinux_status(0xffffffffffffff9c, 0x0, 0x0, 0x0) r23 = socket(0x200000000000011, 0x3, 0x0) fcntl$setstatus(r23, 0x4, 0x2400) accept$packet(r22, &(0x7f00000001c0)={0x11, 0x0, 0x0}, &(0x7f0000000200)=0x14) ioctl$sock_SIOCGIFINDEX(r23, 0x8933, &(0x7f0000000240)={'ip6_vti0\x00', r24}) r25 = openat$selinux_status(0xffffffffffffff9c, 0x0, 0x0, 0x0) r26 = socket(0x200000000000011, 0x3, 0x0) fcntl$setstatus(r26, 0x4, 0x2400) accept$packet(r25, &(0x7f00000001c0)={0x11, 0x0, 0x0}, &(0x7f0000000200)=0x14) ioctl$sock_SIOCGIFINDEX(r26, 0x8933, &(0x7f0000000240)={'ip6_vti0\x00', r27}) r28 = openat$selinux_status(0xffffffffffffff9c, 0x0, 0x0, 0x0) r29 = socket(0x200000000000011, 0x3, 0x0) fcntl$setstatus(r29, 0x4, 0x2400) accept$packet(r28, &(0x7f00000001c0)={0x11, 0x0, 0x0}, &(0x7f0000000200)=0x14) ioctl$sock_SIOCGIFINDEX(r29, 0x8933, &(0x7f0000000240)={'ip6_vti0\x00', r30}) r31 = openat$selinux_status(0xffffffffffffff9c, 0x0, 0x0, 0x0) r32 = socket(0x200000000000011, 0x3, 0x0) fcntl$setstatus(r32, 0x4, 0x2400) accept$packet(r31, &(0x7f00000001c0)={0x11, 0x0, 0x0}, &(0x7f0000000200)=0x14) ioctl$sock_SIOCGIFINDEX(r32, 0x8933, &(0x7f0000000240)={'ip6_vti0\x00', r33}) r34 = creat(&(0x7f0000000040)='./file0\x00', 0x0) ioctl$FS_IOC_SETFLAGS(r34, 0x40086602, &(0x7f0000000200)=0x1fb) ioctl$FS_IOC_SETFLAGS(r34, 0x401c5820, &(0x7f0000000000)=0xa8) getsockopt$inet6_IPV6_IPSEC_POLICY(r34, 0x29, 0x22, &(0x7f0000003f00)={{{@in6=@mcast1, @in=@local, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@broadcast}, 0x0, @in=@local}}, &(0x7f0000000bc0)=0x17e) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f00000053c0)={{{@in=@broadcast, @in6=@loopback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@multicast1}, 0x0, @in=@remote}}, &(0x7f00000054c0)=0xe8) r37 = openat$selinux_status(0xffffffffffffff9c, 0x0, 0x0, 0x0) r38 = socket(0x200000000000011, 0x3, 0x0) fcntl$setstatus(r38, 0x4, 0x2400) accept$packet(r37, &(0x7f00000001c0)={0x11, 0x0, 0x0}, &(0x7f0000000200)=0x14) ioctl$sock_SIOCGIFINDEX(r38, 0x8933, &(0x7f0000000240)={'ip6_vti0\x00', r39}) getsockopt$inet_IP_IPSEC_POLICY(r3, 0x0, 0x10, &(0x7f0000005500)={{{@in=@multicast1, @in6=@initdev, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@initdev}, 0x0, @in6=@remote}}, &(0x7f0000005600)=0xe8) sendmsg$TEAM_CMD_NOOP(0xffffffffffffffff, &(0x7f0000005d00)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000005cc0)={&(0x7f0000005640)={0x678, r4, 0x600, 0x70bd2b, 0x25dfdbfc, {}, [{{0x8, 0x1, r8}, {0xb8, 0x2, [{0x38, 0x1, @mcast_rejoin_interval={{0x24, 0x1, 'mcast_rejoin_interval\x00'}, {0x8}, {0x8, 0x4, 0x5}}}, {0x40, 0x1, @priority={{{0x24, 0x1, 'priority\x00'}, {0x8}, {0x8, 0x4, 0x1000}}, {0x8, 0x6, r9}}}, {0x3c, 0x1, @user_linkup_enabled={{{0x24, 0x1, 'user_linkup_enabled\x00'}, {0x8}, {0x4}}, {0x8, 0x6, r12}}}]}}, {{0x8, 0x1, r13}, {0x84, 0x2, [{0x40, 0x1, @lb_hash_stats={{{0x24, 0x1, 'lb_hash_stats\x00'}, {0x8}, {0x8, 0x4, 0x1ff}}, {0x8}}}, {0x40, 0x1, @priority={{{0x24, 0x1, 'priority\x00'}, {0x8}, {0x8, 0x4, 0x5}}, {0x8, 0x6, r15}}}]}}, {{0x8, 0x1, r18}, {0x1a4, 0x2, [{0x40, 0x1, @priority={{{0x24, 0x1, 'priority\x00'}, {0x8}, {0x8, 0x4, 0x81}}, {0x8}}}, {0x38, 0x1, @mcast_rejoin_interval={{0x24, 0x1, 'mcast_rejoin_interval\x00'}, {0x8}, {0x8, 0x4, 0xff}}}, {0x38, 0x1, @mcast_rejoin_interval={{0x24, 0x1, 'mcast_rejoin_interval\x00'}, {0x8}, {0x8, 0x4, 0xe6cf}}}, {0x3c, 0x1, @enabled={{{0x24, 0x1, 'enabled\x00'}, {0x8}, {0x4}}, {0x8, 0x6, r21}}}, {0x3c, 0x1, @user_linkup={{{0x24, 0x1, 'user_linkup\x00'}, {0x8}, {0x4}}, {0x8, 0x6, r24}}}, {0x40, 0x1, @name={{0x24, 0x1, 'mode\x00'}, {0x8}, {0x10, 0x4, 'roundrobin\x00'}}}, {0x38, 0x1, @mcast_rejoin_count={{0x24, 0x1, 'mcast_rejoin_count\x00'}, {0x8}, {0x8, 0x4, 0x4}}}]}}, {{0x8, 0x1, r27}, {0x80, 0x2, [{0x3c, 0x1, @name={{0x24, 0x1, 'mode\x00'}, {0x8}, {0xc, 0x4, 'random\x00'}}}, {0x40, 0x1, @queue_id={{{0x24, 0x1, 'queue_id\x00'}, {0x8}, {0x8, 0x4, 0x9}}, {0x8, 0x6, r30}}}]}}, {{0x8, 0x1, r33}, {0x1a8, 0x2, [{0x40, 0x1, @lb_hash_stats={{{0x24, 0x1, 'lb_hash_stats\x00'}, {0x8}, {0x8, 0x4, 0xfffffffffffffff8}}, {0x8}}}, {0x40, 0x1, @queue_id={{{0x24, 0x1, 'queue_id\x00'}, {0x8}, {0x8, 0x4, 0x7}}, {0x8}}}, {0x38, 0x1, @mcast_rejoin_interval={{0x24, 0x1, 'mcast_rejoin_interval\x00'}, {0x8}, {0x8, 0x4, 0x7ff}}}, {0x40, 0x1, @lb_tx_hash_to_port_mapping={{{0x24, 0x1, 'lb_tx_hash_to_port_mapping\x00'}, {0x8}, {0x8, 0x4, r35}}, {0x8}}}, {0x3c, 0x1, @user_linkup={{{0x24, 0x1, 'user_linkup\x00'}, {0x8}, {0x4}}, {0x8, 0x6, r36}}}, {0x38, 0x1, @notify_peers_interval={{0x24, 0x1, 'notify_peers_interval\x00'}, {0x8}, {0x8, 0x4, 0x10001}}}, {0x38, 0x1, @notify_peers_count={{0x24, 0x1, 'notify_peers_count\x00'}, {0x8}, {0x8, 0x4, 0xe0}}}]}}, {{0x8, 0x1, r39}, {0x12c, 0x2, [{0x38, 0x1, @mcast_rejoin_count={{0x24, 0x1, 'mcast_rejoin_count\x00'}, {0x8}, {0x8}}}, {0x3c, 0x1, @user_linkup={{{0x24, 0x1, 'user_linkup\x00'}, {0x8}, {0x4}}, {0x8, 0x6, r40}}}, {0x38, 0x1, @mcast_rejoin_count={{0x24, 0x1, 'mcast_rejoin_count\x00'}, {0x8}, {0x8, 0x4, 0x1f}}}, {0x3c, 0x1, @bpf_hash_func={{0x24, 0x1, 'bpf_hash_func\x00'}, {0x8}, {0xc, 0x4, [{0x9, 0x6, 0xff, 0xc4}]}}}, {0x40, 0x1, @lb_hash_stats={{{0x24, 0x1, 'lb_hash_stats\x00'}, {0x8}, {0x8, 0x4, 0x3ff}}, {0x8}}}]}}]}, 0x678}, 0x1, 0x0, 0x0, 0x20008000}, 0x8000) pipe(&(0x7f0000000480)={0xffffffffffffffff}) vmsplice(r41, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) getsockopt$inet6_mreq(r41, 0x29, 0x0, &(0x7f0000000080)={@rand_addr, 0x0}, &(0x7f0000000100)=0x14) ioctl$ifreq_SIOCGIFINDEX_team(r1, 0x8933, &(0x7f0000000180)={'team0\x00', 0x0}) r44 = openat(0xffffffffffffff9c, &(0x7f00000003c0)='./file0/file0\x00', 0x20000, 0x60) accept$packet(0xffffffffffffffff, &(0x7f0000000400)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000440)=0x14) ioctl$sock_inet6_SIOCSIFDSTADDR(r44, 0x8918, &(0x7f0000000480)={@mcast2, 0x3f, r45}) accept4$packet(0xffffffffffffffff, &(0x7f00000001c0)={0x11, 0x0, 0x0}, &(0x7f0000000200)=0x14, 0x0) r47 = openat(0xffffffffffffff9c, &(0x7f00000003c0)='./file0/file0\x00', 0x20000, 0x60) accept$packet(0xffffffffffffffff, &(0x7f0000000400)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000440)=0x14) ioctl$sock_inet6_SIOCSIFDSTADDR(r47, 0x8918, &(0x7f0000000480)={@mcast2, 0x3f, r48}) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000240)={'\x00', r48}) getsockname$packet(0xffffffffffffffff, &(0x7f0000000280)={0x11, 0x0, 0x0}, &(0x7f00000002c0)=0x14) r51 = openat(0xffffffffffffff9c, &(0x7f00000003c0)='./file0/file0\x00', 0x20000, 0x60) accept$packet(0xffffffffffffffff, &(0x7f0000000400)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000440)=0x14) ioctl$sock_inet6_SIOCSIFDSTADDR(r51, 0x8918, &(0x7f0000000480)={@mcast2, 0x3f, r52}) r53 = openat(0xffffffffffffff9c, &(0x7f00000003c0)='./file0/file0\x00', 0x20000, 0x60) accept$packet(0xffffffffffffffff, &(0x7f0000000400)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000440)=0x14) ioctl$sock_inet6_SIOCSIFDSTADDR(r53, 0x8918, &(0x7f0000000480)={@mcast2, 0x3f, r54}) getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, &(0x7f0000000300)={{{@in=@multicast1, @in6=@remote, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@ipv4={[], [], @multicast1}}, 0x0, @in6=@dev}}, &(0x7f0000000400)=0xe8) pipe(&(0x7f0000000480)={0xffffffffffffffff}) vmsplice(r56, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) getpeername$packet(r56, &(0x7f0000000440)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @local}, &(0x7f0000000480)=0x14) getsockopt$inet_IP_XFRM_POLICY(0xffffffffffffffff, 0x0, 0x11, &(0x7f00000004c0)={{{@in=@empty, @in6=@remote, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@ipv4={[], [], @dev}}, 0x0, @in=@empty}}, &(0x7f00000005c0)=0xe8) pipe(&(0x7f0000000480)={0xffffffffffffffff, 0xffffffffffffffff}) write(r59, &(0x7f0000000340), 0x41395527) accept$packet(r59, &(0x7f0000000600)={0x11, 0x0, 0x0}, &(0x7f0000000640)=0x14) sendmsg$TEAM_CMD_NOOP(r2, &(0x7f0000000b80)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f0000000b40)={&(0x7f0000000680)={0x4a8, r4, 0x200, 0x70bd2c, 0x25dfdbfc, {}, [{{0x8, 0x1, r42}, {0xb4, 0x2, [{0x40, 0x1, @lb_port_stats={{{0x24, 0x1, 'lb_port_stats\x00'}, {0x8}, {0x8, 0x4, 0xe0}}, {0x8, 0x6, r43}}}, {0x38, 0x1, @activeport={{0x24, 0x1, 'activeport\x00'}, {0x8}, {0x8, 0x4, r45}}}, {0x38, 0x1, @mcast_rejoin_count={{0x24, 0x1, 'mcast_rejoin_count\x00'}, {0x8}, {0x8, 0x4, 0xdcf7}}}]}}, {{0x8, 0x1, r46}, {0x14c, 0x2, [{0x54, 0x1, @bpf_hash_func={{0x24, 0x1, 'bpf_hash_func\x00'}, {0x8}, {0x24, 0x4, [{0x80, 0x1f, 0x1, 0x1}, {0x100000000, 0x8, 0x7}, {0x5, 0x2, 0xf160, 0x1000}, {0x6, 0x293, 0xfffffffffffffe00, 0x3}]}}}, {0x3c, 0x1, @enabled={{{0x24, 0x1, 'enabled\x00'}, {0x8}, {0x4}}, {0x8, 0x6, r49}}}, {0x3c, 0x1, @user_linkup={{{0x24, 0x1, 'user_linkup\x00'}, {0x8}, {0x4}}, {0x8, 0x6, r50}}}, {0x3c, 0x1, @name={{0x24, 0x1, 'mode\x00'}, {0x8}, {0xc, 0x4, 'random\x00'}}}, {0x40, 0x1, @lb_port_stats={{{0x24, 0x1, 'lb_port_stats\x00'}, {0x8}, {0x8, 0x4, 0x3ff}}, {0x8, 0x6, r52}}}]}}, {{0x8, 0x1, r54}, {0xb4, 0x2, [{0x40, 0x1, @lb_port_stats={{{0x24, 0x1, 'lb_port_stats\x00'}, {0x8}, {0x8, 0x4, 0x2}}, {0x8, 0x6, r55}}}, {0x38, 0x1, @notify_peers_count={{0x24, 0x1, 'notify_peers_count\x00'}, {0x8}, {0x8}}}, {0x38, 0x1, @notify_peers_count={{0x24, 0x1, 'notify_peers_count\x00'}, {0x8}, {0x8, 0x4, 0xff}}}]}}, {{0x8, 0x1, r57}, {0x3c, 0x2, [{0x38, 0x1, @activeport={{0x24, 0x1, 'activeport\x00'}, {0x8}, {0x8}}}]}}, {{0x8}, {0x40, 0x2, [{0x3c, 0x1, @enabled={{{0x24, 0x1, 'enabled\x00'}, {0x8}, {0x4}}, {0x8, 0x6, r58}}}]}}, {{0x8, 0x1, r60}, {0x134, 0x2, [{0x40, 0x1, @queue_id={{{0x24, 0x1, 'queue_id\x00'}, {0x8}, {0x8}}, {0x8}}}, {0x40, 0x1, @lb_tx_hash_to_port_mapping={{{0x24, 0x1, 'lb_tx_hash_to_port_mapping\x00'}, {0x8}, {0x8}}, {0x8}}}, {0x38, 0x1, @notify_peers_count={{0x24, 0x1, 'notify_peers_count\x00'}, {0x8}, {0x8, 0x4, 0xda}}}, {0x38, 0x1, @lb_stats_refresh_interval={{0x24, 0x1, 'lb_stats_refresh_interval\x00'}, {0x8}, {0x8, 0x4, 0x100000000}}}, {0x40, 0x1, @name={{0x24, 0x1, 'mode\x00'}, {0x8}, {0x10, 0x4, 'roundrobin\x00'}}}]}}]}, 0x4a8}, 0x1, 0x0, 0x0, 0x20008008}, 0x40000) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0xf) prctl$PR_SET_KEEPCAPS(0x8, 0x1) 16:20:54 executing program 1: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r1, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000100)=@newlink={0x40, 0x10, 0xe3b, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x243}, [@IFLA_MASTER={0x8, 0xa, 0x6}, @IFLA_LINKINFO={0x18, 0x12, @vti={{0x8, 0x1, 'vti\x00'}, {0xc, 0x2, [@IFLA_VTI_LOCAL={0x8, 0x4, @multicast2}]}}}]}, 0x40}, 0x1, 0x0, 0x0, 0x4000000}, 0x800) r2 = syz_genetlink_get_family_id$ipvs(&(0x7f0000001500)='IPVS\x00') r3 = accept(r1, &(0x7f0000000000)=@in={0x2, 0x0, @broadcast}, &(0x7f00000000c0)=0x80) sendmsg$IPVS_CMD_SET_INFO(r3, &(0x7f0000000240)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x2002006}, 0xc, &(0x7f0000000200)={&(0x7f00000001c0)={0x1c, r2, 0xf08, 0x70bd2b, 0x25dfdbff, {}, [@IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x5}]}, 0x1c}, 0x1, 0x0, 0x0, 0x40080}, 0x0) socketpair(0x0, 0x3, 0x7, &(0x7f00000003c0)={0xffffffffffffffff, 0xffffffffffffffff}) getsockopt$SO_BINDTODEVICE(r4, 0x1, 0x19, &(0x7f0000000400), 0x10) sendmsg$IPVS_CMD_SET_DEST(r0, &(0x7f0000000380)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x30008200}, 0xc, &(0x7f0000000340)={&(0x7f0000000280)={0xb0, r2, 0x100, 0x70bd2b, 0x25dfdbfe, {}, [@IPVS_CMD_ATTR_DEST={0xc, 0x2, [@IPVS_DEST_ATTR_U_THRESH={0x8, 0x5, 0x1}]}, @IPVS_CMD_ATTR_DEST={0x4c, 0x2, [@IPVS_DEST_ATTR_U_THRESH={0x8, 0x5, 0x10000}, @IPVS_DEST_ATTR_PORT={0x8, 0x2, 0x4e20}, @IPVS_DEST_ATTR_ADDR_FAMILY={0x8, 0xb, 0xa}, @IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8, 0x8}, @IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8, 0x9a}, @IPVS_DEST_ATTR_WEIGHT={0x8, 0x4, 0x8}, @IPVS_DEST_ATTR_WEIGHT={0x8, 0x4, 0x3}, @IPVS_DEST_ATTR_PORT={0x8, 0x2, 0x4e21}, @IPVS_DEST_ATTR_U_THRESH={0x8, 0x5, 0xffffffffffffff81}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5, 0xfffffffffffffffe}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x4}, @IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0x100000001}, @IPVS_CMD_ATTR_DEST={0x14, 0x2, [@IPVS_DEST_ATTR_FWD_METHOD={0x8, 0x3, 0x2}, @IPVS_DEST_ATTR_TUN_TYPE={0x8}]}, @IPVS_CMD_ATTR_SERVICE={0x10, 0x1, [@IPVS_SVC_ATTR_FLAGS={0xc, 0x7, {0x12, 0x2}}]}, @IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0x1}]}, 0xb0}, 0x1, 0x0, 0x0, 0x22000023}, 0x80) r6 = syz_open_procfs(0x0, &(0x7f0000000000)='net/raw\x00') ioctl$FIBMAP(r5, 0x1, &(0x7f0000000440)=0x6) pread64(r6, 0x0, 0x0, 0x800000000002) r7 = open(&(0x7f0000000040)='./file0\x00', 0x40, 0x24) clone(0x41100500, &(0x7f0000000100)="a9aab25ebcbac79d9c214217532e5147b321dbbe001a087d42c7743eaf1324fb261910b4fd1a25d038743b8f39537b4b3b16be1451758301fef49dd7ff9518b86104", &(0x7f0000000180), &(0x7f00000001c0), &(0x7f0000000200)="5a50fd44c2a87b088ade99dbc4b7ad3f18f23d36cc4c381f6d670a0d10c63c7321618c218ece38d7927aee519f14f4ec32534e71e262") getsockopt$inet_udp_int(r7, 0x11, 0xb, &(0x7f0000000080), &(0x7f00000000c0)=0x4) 16:20:54 executing program 1: r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/raw\x00') pipe(&(0x7f0000000480)={0xffffffffffffffff, 0xffffffffffffffff}) pipe(&(0x7f0000000480)={0xffffffffffffffff}) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, &(0x7f0000000080)={{{@in6=@initdev, @in6=@ipv4={[], [], @multicast2}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@multicast2}, 0x0, @in6=@remote}}, &(0x7f0000000180)=0xe8) ioctl$sock_inet6_SIOCDIFADDR(r2, 0x8936, &(0x7f00000001c0)={@initdev={0xfe, 0x88, [], 0x0, 0x0}, 0x31, r3}) write(r1, &(0x7f0000000340), 0x41395527) write(r1, &(0x7f0000000040)="154a8808cbe67197f0a6397a0f94c057e3", 0x11) pread64(r0, 0x0, 0x0, 0x800000000002) 16:20:54 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) r2 = dup2(r1, r0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) openat$selinux_avc_cache_threshold(0xffffffffffffff9c, &(0x7f0000000040)='/selinux/avc/cache_threshold\x00', 0x2, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000380)=ANY=[@ANYBLOB="04630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000300)={0x153, 0x0, &(0x7f0000000080)=[@dead_binder_done], 0xb19b868c1a8b328c, 0x0, 0x0}) 16:20:54 executing program 2: syz_open_procfs(0x0, &(0x7f0000000080)='net/dev_snmp6\x00') r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ptmx\x00', 0x739d80469493cec0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00000000c0)) syz_open_pts(r0, 0x0) ioctl$TCXONC(0xffffffffffffffff, 0x540a, 0x0) pselect6(0x40, &(0x7f0000000340)={0x9}, 0x0, 0x0, 0x0, 0x0) 16:20:54 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) pipe(&(0x7f0000000480)={0xffffffffffffffff, 0xffffffffffffffff}) write(r2, &(0x7f0000000180)="bb776e222498c76af7528984234c30bedbd13a13ed92c642f484b863eee8c5e4d00c0ca0b2979e6a2e805417f22b960ef40eecead1ed37852dce2de2fcf02fdacf4e64a13d5c6aa35e39150b634e0453d4691c856151de4b70e09de456826a909c5c5d7389a651671f4092d237a1be9c3b5353f218cf6639e1c1a7e71facd5da29be8b90522dcfa300e2107fa7fa0d1eeddfc18e42c278d8c2e915099b7197b22635d2daa17dbb94d2fb820d38b8b244dbe87d0746e6c7c23223352132b323e3e282961e964cd44169d19c497ad37ef5c10521ba007fc9be96405e0847c7bbcbf937a35ae21438fb6c243a027dbe", 0xee) openat$cgroup(0xffffffffffffffff, &(0x7f0000000040)='syz1\x00', 0x200002, 0x0) r3 = openat$ion(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ion\x00', 0x81, 0x0) r4 = dup2(0xffffffffffffffff, r3) ioctl$BINDER_SET_CONTEXT_MGR(r4, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000380)=ANY=[@ANYBLOB="04630440"], 0x0, 0x0, 0x0}) r5 = syz_open_dev$sndtimer(&(0x7f00000000c0)='/dev/snd/timer\x00', 0x0, 0x121240) ioctl$SNDRV_TIMER_IOCTL_TREAD(r5, 0x40045402, &(0x7f0000000100)) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000300)={0x8, 0x0, &(0x7f00000004c0)=[@acquire={0x40046304}], 0xb19b868c1a8b328c, 0x0, 0x0}) [ 1765.088676] binder: 10768:10769 BC_DEAD_BINDER_DONE 0000000000000000 not found [ 1765.096341] binder: 10768:10769 unknown command 0 [ 1765.101918] binder: 10768:10769 ioctl c0306201 20000300 returned -22 [ 1765.111695] binder: 10768:10770 BC_DEAD_BINDER_DONE 0000000000000000 not found [ 1765.119396] binder: 10768:10770 unknown command 0 [ 1765.127545] binder: 10768:10770 ioctl c0306201 20000300 returned -22 16:20:54 executing program 2: r0 = syz_open_procfs(0x0, &(0x7f0000000080)='net/dev_snmp6\x00') pipe(&(0x7f0000000480)={0xffffffffffffffff}) vmsplice(r1, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) fsetxattr$security_evm(r1, &(0x7f0000000100)='security.evm\x00', &(0x7f0000000140)=@sha1={0x1, "d798cc2019832cca29442e6adef5a3acda7edc1a"}, 0x15, 0x1) r2 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ptmx\x00', 0x0, 0x0) r3 = openat$selinux_avc_cache_threshold(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/avc/cache_threshold\x00', 0x2, 0x0) ioctl$TIOCVHANGUP(r3, 0x5437, 0x0) ioctl$TCSETS(r2, 0x40045431, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1000000}) r4 = syz_open_pts(r2, 0x0) r5 = dup3(r4, r0, 0x0) ioctl$TCXONC(r5, 0x540a, 0x0) fcntl$getflags(r0, 0x0) pselect6(0x40, &(0x7f0000000340)={0x9}, 0x0, 0x0, 0x0, 0x0) socket$inet_udp(0x2, 0x2, 0x0) pipe(&(0x7f0000000480)={0xffffffffffffffff, 0xffffffffffffffff}) write(r6, &(0x7f0000000340), 0x41395527) ioctl$KDSETLED(r6, 0x4b32, 0x100000000) [ 1765.181600] binder: 10776:10778 IncRefs 0 refcount change on invalid ref 0 ret -22 [ 1765.197044] binder: 10776:10778 IncRefs 0 refcount change on invalid ref 0 ret -22 [ 1765.205030] binder: 10776:10778 ioctl c0306201 20000300 returned -14 [ 1765.216053] binder: 10776:10782 IncRefs 0 refcount change on invalid ref 0 ret -22 16:20:54 executing program 0: pipe2(&(0x7f00000002c0)={0xffffffffffffffff}, 0x1000) openat(r0, &(0x7f0000000340)='./file0\x00', 0x80, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) r3 = openat$selinux_create(0xffffffffffffff9c, &(0x7f0000000040)='/selinux/create\x00', 0x2, 0x0) readahead(r3, 0x7, 0x7) pipe(&(0x7f0000000480)={0xffffffffffffffff, 0xffffffffffffffff}) write(r4, &(0x7f0000000340), 0x41395527) getsockopt$IP_VS_SO_GET_SERVICES(r4, 0x0, 0x482, &(0x7f0000000080)=""/11, &(0x7f00000000c0)=0xb) r5 = dup2(r2, r1) ioctl$BINDER_SET_CONTEXT_MGR(r5, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="0463f23f"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000300)={0x8, 0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="046304400000000049b740b93805d3540b91f64bcae07ea32a570e59bd9008ac0fcb3c0eddfdf48de39076d3e1cd4770355be7567ebcefdf44a9f313564e76666490825dc0d975e609ebbc2dacee4f2038a9cd95e9630e23316dbd9b1d20ffc97037a51c51a6f3f639d043c20238d61e45f9006fc9cfc9298006809be4858eefc4aab0df9370ff72b0b82da3e52888110920aef8bf5f90aa6a8f4abc8635cafade3a54e9443aa26ff673ba0fd6614fd9f4"], 0xb19b868c1a8b328c, 0x0, 0x0}) pipe(&(0x7f0000000480)={0xffffffffffffffff, 0xffffffffffffffff}) write(r6, &(0x7f0000000340), 0x41395527) r7 = mmap$binder(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x1, 0x11, r6, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000240)={0xc, 0x0, &(0x7f0000000100)=[@free_buffer={0x40086303, r7}], 0xf8, 0x0, &(0x7f00000004c0)="e0510d76e7b50b77f391b5fb4954837340f956eeb87eca7b3d91438f6a566cdcc53961b095ec037a98882b70e8aee9475296859e41fb903cbaf7a09d3f249af891eb0f113b923dd05c2907a66527e16d0b9eea497e912b9131a6b48ccf5a73764edca2991521c833f6f772d07e6755f8f297f9566f2b743365a56d95d6232aab85e4aee9dfd86aaff11dbc4e452d2bd893f30af233e5f56dfa784dd74092cf6f495bcb227f5dc44329468ff3d212f30d653c9f249eabf19434abc4a110671dc9cd416a849d5b4da8130b7700f7bbbc93491325a4f226e3b92dcdacbb587948c8ae9ffa9290f21987733dcddb1d96b5e3c51daba7862feaa7"}) 16:20:54 executing program 5: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r1, 0x40045431, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1}) pipe(&(0x7f0000000480)={0xffffffffffffffff}) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) syz_open_pts(r2, 0x400) ioctl$KIOCSOUND(r1, 0x4b2f, 0x9) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r3 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS2(r3, 0x402c542b, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, 0x0, "c41e495183430405e274ccf7defb07f5340067"}) [ 1765.224661] binder: 10776:10778 IncRefs 0 refcount change on invalid ref 0 ret -22 [ 1765.233981] binder: 10776:10778 ioctl c0306201 20000300 returned -14 [ 1765.344924] binder: 10784:10791 unknown command 1072849668 [ 1765.351237] binder: 10784:10791 ioctl c0306201 20000140 returned -22 [ 1765.358420] binder: 10784:10791 ioctl c0306201 20000300 returned -14 [ 1765.411392] binder: 10784:10793 BC_FREE_BUFFER u0000000000000000 no match 16:20:55 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f00000003c0)="11dca50d5e0bcfe47bf070") r1 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r1, &(0x7f0000000100)={0x2, 0x4e20}, 0x10) r2 = accept$inet(r1, 0x0, &(0x7f0000000000)) connect$inet(r2, &(0x7f0000000cc0)={0x2, 0x4e20, @broadcast}, 0x1) setsockopt$SO_TIMESTAMPING(r1, 0x1, 0x25, &(0x7f00000010c0)=0x19ff, 0x4) sendto$inet(r1, &(0x7f0000000140)="b0", 0x1, 0x0, 0x0, 0x0) recvmmsg(r1, &(0x7f0000003b40)=[{{0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffb6}}], 0x88, 0x2000, 0x0) 16:20:55 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f00000003c0)="11dca50d5e0bcfe47bf070") r1 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r1, &(0x7f0000000100)={0x2, 0x4e20}, 0x10) connect$inet(r1, &(0x7f0000000cc0)={0x2, 0x4e20, @local}, 0x31f) setsockopt$SO_TIMESTAMPING(r1, 0x1, 0x25, &(0x7f00000010c0)=0x19ff, 0x4) sendto$inet(r1, &(0x7f0000000140)="b0", 0x1, 0x0, 0x0, 0x0) recvmmsg(r1, &(0x7f0000003b40)=[{{0x0, 0x0, 0x0}}], 0x1, 0x2000, 0x0) 16:20:55 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f00000003c0)="11dca50d5e0bcfe47bf070") r1 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r1, &(0x7f0000000100)={0x2, 0x4e20}, 0x10) pipe(&(0x7f0000000480)={0xffffffffffffffff, 0xffffffffffffffff}) write(r2, &(0x7f0000000340), 0x41395527) getsockopt$inet6_int(r2, 0x29, 0x21, &(0x7f0000000000), &(0x7f0000000040)=0x4) connect$inet(r1, &(0x7f0000000cc0)={0x2, 0x4e20, @local}, 0x10) setsockopt$SO_TIMESTAMPING(r1, 0x1, 0x25, &(0x7f00000010c0)=0x19ff, 0x4) sendto$inet(r1, &(0x7f0000000140)="b0", 0x1, 0x0, 0x0, 0x0) recvmmsg(r1, &(0x7f0000003b40)=[{{0x0, 0x0, 0x0}}], 0x1, 0x2000, 0x0) 16:20:55 executing program 4: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0xf) fsetxattr(r1, &(0x7f0000000000)=@random={'os2.', '\x00'}, &(0x7f0000000080)='/dev/ptmx\x00', 0xa, 0x0) 16:20:55 executing program 4: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0x19) 16:20:55 executing program 4: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$TIOCGPGRP(0xffffffffffffffff, 0x540f, &(0x7f0000000080)) pipe(&(0x7f0000000480)={0xffffffffffffffff}) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) ioctl$EXT4_IOC_ALLOC_DA_BLKS(r2, 0x660c) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0xf) pipe(&(0x7f0000000180)={0xffffffffffffffff}) vmsplice(r3, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x2400, 0x4) 16:20:55 executing program 1: pipe(&(0x7f0000000480)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r1, 0x40045431, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1}) syz_open_pts(r1, 0x0) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = openat$selinux_mls(0xffffffffffffff9c, &(0x7f0000000140)='/selinux/mls\x00', 0x0, 0x0) r4 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000200)='TIPCv2\x00') sendmsg$TIPC_NL_BEARER_SET(r3, &(0x7f00000002c0)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x20000}, 0xc, &(0x7f0000000240)={&(0x7f0000000a40)=ANY=[@ANYBLOB="28010000d75168996bbda42815fc319e691c1f4bfbc1db884169e05bae5aa590e18ba68339151c0798622a5b1cfa097be94caa008e9d809823392ee441bfbef80211aa1e86e60a070d677a30d5f0c436e828d71b6c192475", @ANYRES16=r4, @ANYBLOB="000129bd7000ffdbdf250500000038000500080001006962000024000200080003007a622d7a080002000100000008000400030000000800010000000000080001006962000014000600080001000300000008000100494a000028000400240007000800010011000000080002001f00000008000400000000000800030000000000a000040014000700080003000000000008000200080000002400070008000400000000000800010000000000080003000500000008000200040000000c00010073797a31000000001c00070008000400ce920000080003000500000008000400080000003c0007000800020008000000080004000800000008000200000000000800010004000000080002000000000008000400000000000800020000000000"], 0x128}}, 0x0) pipe(&(0x7f0000000480)={0xffffffffffffffff, 0xffffffffffffffff}) write(r5, &(0x7f0000000340), 0x41395527) socket(0xa, 0xa, 0x80) pipe(&(0x7f0000000480)={0xffffffffffffffff}) vmsplice(r6, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) clock_gettime(0x0, &(0x7f0000000080)={0x0, 0x0}) pselect6(0x40, &(0x7f00000000c0)={0x8}, 0x0, &(0x7f0000000140)={0x1b7}, &(0x7f00000003c0)={0x0, r7+30000000}, 0x0) pipe(&(0x7f0000000480)={0xffffffffffffffff}) vmsplice(r8, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) pipe(&(0x7f0000000480)={0xffffffffffffffff}) vmsplice(r9, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) pipe(&(0x7f0000000480)={0xffffffffffffffff}) vmsplice(r10, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f00000007c0)={0x78, 0x0, &(0x7f0000000680)=ANY=[@ANYBLOB="0663044000000000046304400300000012634840010000000000000000000000000000000000000010000000000000000000000058000000000000001800000000000000", @ANYPTR=&(0x7f0000000c00)=ANY=[@ANYPTR64=&(0x7f00000001c0)=ANY=[@ANYRESOCT], @ANYRESHEX=r8, @ANYPTR=&(0x7f0000000bc0)=ANY=[@ANYPTR64=&(0x7f00000004c0)=ANY=[@ANYPTR, @ANYPTR, @ANYRES32=r2, @ANYRES32=r9, @ANYRES16=r10, @ANYRESHEX=0x0]], @ANYRESHEX=0x0, @ANYRES16], @ANYPTR=&(0x7f0000000500)=ANY=[@ANYRESHEX=r7], @ANYBLOB="00000000000000000b63000010630840000000000000000006630440020000000d630000"], 0x6e, 0x0, &(0x7f0000000740)="7686afc01047c8f8bebd69e5e360ccba47970f875e7ca710d48085d21349e434bf95076bf12d94b2318b89b5d72e26dbef73b0c762cc5a06d6e41952005ab74f867c92743d4e49d4ad4aa3593affbe8f9282dbcba929686a21bf5a95cb01b5a29583f99ce2144c5b0453f4843094"}) r11 = syz_genetlink_get_family_id$nbd(&(0x7f0000000300)='nbd\x00') pipe(&(0x7f0000000480)={0xffffffffffffffff}) vmsplice(r12, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) r13 = openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f00000005c0)='/selinux/commit_pending_bools\x00', 0x1, 0x0) pipe(&(0x7f0000000480)={0xffffffffffffffff}) vmsplice(r14, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) pipe(&(0x7f0000000480)={0xffffffffffffffff}) vmsplice(r15, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) sendmsg$NBD_CMD_STATUS(0xffffffffffffffff, &(0x7f0000000980)={&(0x7f0000000540)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000700)={&(0x7f0000000600)={0x4c, r11, 0x200, 0x70bd26, 0x25dfdbfd, {}, [@NBD_ATTR_SOCKETS={0x2c, 0x7, [{0x8, 0x1, r12}, {0x8, 0x1, r13}, {0x8}, {0x8, 0x1, r14}, {0x8, 0x1, r15}]}, @NBD_ATTR_SERVER_FLAGS={0xc, 0x5, 0x4}]}, 0x4c}, 0x1, 0x0, 0x0, 0x20288c4}, 0x20000004) sendmsg$TIPC_NL_BEARER_ADD(r2, &(0x7f00000002c0)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x8000}, 0xc, &(0x7f0000000280)={&(0x7f0000000340)={0x10c, r4, 0x0, 0x70bd2a, 0x25dfdbfe, {}, [@TIPC_NLA_NODE={0x38, 0x6, [@TIPC_NLA_NODE_ADDR={0x8, 0x1, 0x5}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_ADDR={0x8, 0x1, 0x1}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_ADDR={0x8, 0x1, 0xfffffffffffffffc}, @TIPC_NLA_NODE_UP={0x4}]}, @TIPC_NLA_NODE={0x14, 0x6, [@TIPC_NLA_NODE_ADDR={0x8, 0x1, 0x2}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}]}, @TIPC_NLA_SOCK={0x28, 0x2, [@TIPC_NLA_SOCK_HAS_PUBL={0x4}, @TIPC_NLA_SOCK_ADDR={0x8}, @TIPC_NLA_SOCK_ADDR={0x8, 0x1, 0xd2}, @TIPC_NLA_SOCK_REF={0x8, 0x2, 0xffffffff}, @TIPC_NLA_SOCK_REF={0x8, 0x2, 0x5}]}, @TIPC_NLA_SOCK={0x3c, 0x2, [@TIPC_NLA_SOCK_HAS_PUBL={0x4}, @TIPC_NLA_SOCK_REF={0x8, 0x2, 0x10000}, @TIPC_NLA_SOCK_ADDR={0x8, 0x1, 0xff}, @TIPC_NLA_SOCK_HAS_PUBL={0x4}, @TIPC_NLA_SOCK_ADDR={0x8, 0x1, 0x9}, @TIPC_NLA_SOCK_REF={0x8, 0x2, 0x7}, @TIPC_NLA_SOCK_HAS_PUBL={0x4}, @TIPC_NLA_SOCK_REF={0x8, 0x2, 0x8}, @TIPC_NLA_SOCK_HAS_PUBL={0x32b}]}, @TIPC_NLA_MON={0x1c, 0x9, [@TIPC_NLA_MON_REF={0x8, 0x2, 0x8}, @TIPC_NLA_MON_REF={0x8, 0x2, 0x400}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8, 0x1, 0xc9b8}]}, @TIPC_NLA_NET={0x2c, 0x7, [@TIPC_NLA_NET_ID={0x8, 0x1, 0x2}, @TIPC_NLA_NET_NODEID_W1={0xc, 0x4, 0x5}, @TIPC_NLA_NET_ADDR={0x8, 0x2, 0x2}, @TIPC_NLA_NET_NODEID={0xc, 0x3, 0x401}]}]}, 0x10c}, 0x1, 0x0, 0x0, 0x800}, 0x20000000) pread64(r1, &(0x7f00000000c0)=""/56, 0x38, 0x0) write(r0, &(0x7f0000000340), 0x41395527) ioctl$EVIOCSMASK(r0, 0x40104593, &(0x7f0000000040)={0x14, 0x38, &(0x7f0000000000)="936b159569a9982ecd274284a3cad1805a232c06dd3c673b14be2ae87dc0ae92eeae277c8b630a694046d018e54aebd9def20b919f31080c"}) r16 = syz_open_procfs(0x0, &(0x7f0000000080)='net/raw\x00') pread64(r16, 0x0, 0x0, 0x800000000002) pipe(&(0x7f0000000480)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$inet6_tcp_TCP_ULP(r17, 0x6, 0x1f, &(0x7f0000000880)='tls\x00', 0x4) write(r18, &(0x7f0000000340), 0x41395527) fsetxattr$security_ima(r18, &(0x7f0000000800)='security.ima\x00', &(0x7f0000000840)=@ng={0x4, 0x2, "8f8a622f"}, 0x6, 0x0) ioctl$sock_inet_SIOCADDRT(r18, 0x890b, &(0x7f0000000900)={0x0, {0x2, 0x4e24, @broadcast}, {0x2, 0x4e21, @dev={0xac, 0x14, 0x14, 0x1e}}, {0x2, 0x4e23}, 0x8, 0x0, 0x0, 0x0, 0x3ff, &(0x7f00000008c0)='tunl0\x00', 0x2, 0x6, 0x5}) 16:20:55 executing program 2: syz_open_procfs(0x0, &(0x7f0000000080)='net/dev_snmp6\x00') r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00000000c0)) r1 = syz_open_pts(r0, 0x0) pipe(&(0x7f0000000200)={0xffffffffffffffff}) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) ioctl$TCXONC(0xffffffffffffffff, 0x540a, 0x80000000) pipe(&(0x7f0000000480)={0xffffffffffffffff, 0xffffffffffffffff}) write(r3, &(0x7f0000000340), 0x41395527) getsockopt$inet6_opts(r1, 0x29, 0x39, &(0x7f0000000240)=""/239, &(0x7f0000000180)=0xef) ioctl$KDGETLED(r3, 0x4b31, &(0x7f0000000000)) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)) ioctl$TUNGETIFF(r3, 0x800454d2, &(0x7f0000000140)) pselect6(0x40, &(0x7f0000000340)={0xd}, 0x0, 0x0, 0x0, 0x0) openat$selinux_member(0xffffffffffffff9c, &(0x7f00000001c0)='/selinux/member\x00', 0x2, 0x0) 16:20:55 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) r2 = dup2(r1, r0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000380)=ANY=[@ANYBLOB="04630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000300)={0x8, 0x0, &(0x7f00000004c0)=[@acquire={0x40046304}], 0xb19b868c1a8b328c, 0x0, 0x0}) 16:20:55 executing program 5: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) munmap(&(0x7f0000ffd000/0x1000)=nil, 0x1000) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS2(r1, 0x402c542b, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, 0x0, "c41e495183430405e274ccf7defb07f5340067"}) 16:20:55 executing program 5: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ptmx\x00', 0x10000, 0x0) pipe(&(0x7f0000000480)={0xffffffffffffffff, 0xffffffffffffffff}) write(r2, &(0x7f0000000340), 0x41395527) ioctl$TIOCGPTLCK(r2, 0x80045439, &(0x7f0000000100)) ioctl$TCSETS2(r1, 0x402c542b, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, 0x0, "c41e495183430405e274ccf7defb07f5340067"}) r3 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000080)='/selinux/enforce\x00', 0x10000, 0x0) setsockopt$inet_udp_encap(r3, 0x11, 0x64, &(0x7f00000000c0)=0x2, 0x4) 16:20:55 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) r2 = dup2(r1, r0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) r3 = openat(r2, &(0x7f0000000040)='./file0\x00', 0x8002, 0x6) ioctl$BINDER_THREAD_EXIT(r3, 0x40046208, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000380)=ANY=[@ANYBLOB="04630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000300)={0x8, 0x0, &(0x7f00000004c0)=[@acquire={0x40046304}], 0xb19b868c1a8b328c, 0x0, 0x0}) [ 1766.125645] binder: BINDER_SET_CONTEXT_MGR already set [ 1766.131199] binder: 10837:10838 ioctl 40046207 0 returned -16 [ 1766.138307] binder: 10837:10838 ioctl c0306201 20000300 returned -14 [ 1766.150804] binder: BINDER_SET_CONTEXT_MGR already set [ 1766.156880] binder: 10837:10838 ioctl 40046207 0 returned -16 [ 1766.164790] binder: 10837:10843 ioctl c0306201 20000300 returned -14 16:20:55 executing program 1: r0 = syz_open_procfs(0x0, &(0x7f0000000000)='\x00\x00\x00\x00\x00\x00\x00\x00\xfe\x009.i7L\x15\xae?\x8cv\xcb\x84\xf0\x13\x00\x00') pread64(r0, 0x0, 0x0, 0x800000000002) openat$zero(0xffffffffffffff9c, &(0x7f0000000040)='/dev/zero\x00', 0x80000, 0x0) 16:20:55 executing program 1: pipe(&(0x7f0000000480)={0xffffffffffffffff}) vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) r1 = dup2(0xffffffffffffffff, r0) ioctl$TIOCLINUX5(r1, 0x541c, &(0x7f00000001c0)={0x5, 0x6, 0x998, 0xa9fb, 0x3f}) pipe(&(0x7f0000000480)={0xffffffffffffffff}) ioctl$FS_IOC_FIEMAP(r2, 0xc020660b, &(0x7f0000000200)=ANY=[@ANYBLOB="d54c18e9c12f6a3e334000200000000000f80800000000000004000000ffffffff040000000000000000020000000000000500000000000000040000000000000000000000000000000000000000000000000200000000000000000000000000000900000000000000040000000000000003000000000000000000000000000000000000000000000002000000000000000000000000000000ca32ffffffffffff0400000000000000ffff0000000000000000000000000000000000000000000038339c16000000000000000000000000ffffffffffffffff010000000000000007000000000000000000000000000000000000000000000075e6c1a7000000"]) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) getsockname(0xffffffffffffffff, &(0x7f00000000c0)=@xdp, &(0x7f0000000140)=0x80) fsetxattr$trusted_overlay_redirect(r2, &(0x7f0000000040)='trusted.overlay.redirect\x00', &(0x7f0000000080)='./file0\x00', 0x8, 0x1) set_thread_area(&(0x7f0000000180)={0xa48, 0x0, 0x4000, 0x36ebf1d9, 0x9, 0x5, 0x7, 0x8, 0x10001, 0x2}) r3 = syz_open_procfs(0x0, &(0x7f0000000000)='net/raw\x00') pread64(r3, 0x0, 0x0, 0x800000000002) [ 1766.239121] binder: 10851:10854 ioctl c0306201 20000300 returned -14 16:20:55 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x0, &(0x7f00000003c0)="cf8903168daa9ff57bf070") r1 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r1, &(0x7f0000000100)={0x2, 0x4e20}, 0x10) select(0x40, &(0x7f0000000080)={0xf7, 0x8, 0x3, 0x25, 0x2d0, 0xff, 0x7f, 0x3f}, &(0x7f00000000c0)={0x1, 0x3ff, 0x4, 0x1, 0x3, 0xca9, 0x8001, 0x8}, &(0x7f0000000180)={0x3, 0x7e, 0x28ce, 0x0, 0x401, 0x9, 0xff, 0x81}, &(0x7f00000001c0)) pipe(&(0x7f0000000480)={0xffffffffffffffff}) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) r3 = fcntl$dupfd(r2, 0x605, 0xffffffffffffffff) bpf$OBJ_PIN_PROG(0x6, &(0x7f0000000040)={&(0x7f0000000000)='./file0\x00', r3}, 0x10) socket$inet_tcp(0x2, 0x1, 0x0) r4 = accept$inet(0xffffffffffffffff, &(0x7f0000000200)={0x2, 0x0, @broadcast}, &(0x7f0000000340)=0x10) fcntl$setstatus(r4, 0x4, 0x40000) dup(r1) connect$inet(r1, &(0x7f0000000280)={0x2, 0x4e20, @local}, 0x10) setsockopt$SO_TIMESTAMPING(r1, 0x1, 0x25, &(0x7f00000010c0)=0x19ff, 0x4) sendto$inet(r1, &(0x7f0000000140)="b0", 0x1, 0x0, 0x0, 0x0) recvmmsg(r1, &(0x7f0000003b40)=[{{0x0, 0x0, 0x0}}], 0x1, 0x2000, 0x0) link(&(0x7f00000002c0)='./file0\x00', &(0x7f0000000300)='./file0\x00') 16:20:55 executing program 0: fdatasync(0xffffffffffffffff) r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) openat$selinux_status(0xffffffffffffff9c, &(0x7f0000000040)='/selinux/status\x00', 0x0, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) r2 = dup2(r1, r0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000380)=ANY=[@ANYBLOB="04630440"], 0x0, 0x0, 0x0}) pipe(&(0x7f0000000480)={0xffffffffffffffff}) fcntl$getownex(r3, 0x10, &(0x7f00000000c0)) vmsplice(r3, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) pipe(&(0x7f0000000480)={0xffffffffffffffff}) vmsplice(r4, &(0x7f0000000080)=[{&(0x7f0000000500)}], 0x1, 0x0) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000004c0), 0x0, 0x0, 0x0}) 16:20:56 executing program 4: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) pipe(&(0x7f0000000480)={0xffffffffffffffff}) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) r3 = dup(r2) r4 = syz_genetlink_get_family_id$fou(&(0x7f0000000080)='fou\x00') sendmsg$FOU_CMD_GET(0xffffffffffffffff, &(0x7f00000001c0)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x245e2311}, 0xc, &(0x7f0000000180)={&(0x7f0000000140)=ANY=[@ANYBLOB='$\x00\b\x00', @ANYRES16=r4, @ANYBLOB="000125bd700001dcdf250300000000000400030000002bff0600e0000002"], 0x24}, 0x1, 0x0, 0x0, 0x40800}, 0x8000) sendmsg$FOU_CMD_ADD(r3, &(0x7f0000000240)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f0000000200)={&(0x7f0000000100)={0x1c, r4, 0x400, 0x70bd27, 0x25dfdbfc, {}, [@FOU_ATTR_LOCAL_V4={0x8, 0x6, @dev={0xac, 0x14, 0x14, 0x29}}]}, 0x1c}, 0x1, 0x0, 0x0, 0x80}, 0x80) write$binfmt_misc(r2, &(0x7f0000000180)={'syz1', "8d84ef698c37438ce7b3363f6a82cd56388910f9d2e4fa58ae27a78e9a9434ea1e62aba4cde024afc58ef3aab2cc1cb2c85bdd91a7f2c3a2a9ba258f61328332e4a8d6ba3602a27f87752ef46390a850a667bfe4"}, 0x58) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0xf) 16:20:56 executing program 2: r0 = syz_open_procfs(0x0, &(0x7f0000000180)='net/ip_tables_matches\x00') r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r1, 0x40045431, &(0x7f00000000c0)) pipe(&(0x7f0000000480)={0xffffffffffffffff}) vmsplice(0xffffffffffffffff, &(0x7f0000000a40)=[{&(0x7f00000006c0)="930333dac2d439f23cedef898f6eacd4ee5be1f0b40105d1b52a7a7eed5f33d0c5030c4ba7838b10588f4a85d2c85273993fbcd1972626", 0x37}, {&(0x7f0000000700)="d728f9945a620494c260d3d693c9f4033afa0ad860288d1c83eee23f337c6d9c389a0b703dcb1650ef17b392c84daf40d4a5f34a40c00ed5c4cf2498877a8f3dcac07cb47f6d1d965a8a7bc01dc51b919caa29d0733998770bb9cd2625cc7386a6555c451931cb5bfd689d53f46189997941a75fb450760143dfc5100e7dd140eeb6921a61ee8db6fbac02977846ab47f6a6043df839b91b82af683a6dbb697cdb0e6e5f42f7934b2470628d7d17a3f0cd528fb97e34347025b0fd035b5b32", 0xbf}, {&(0x7f00000007c0)="5f8291fd18707c2fcfb72212d11d07be168aaf15945df7dc371605c0c01044ee639eb95c", 0x24}, {&(0x7f0000000800)="dc2c13f1ce37519ebb8ba5adacf9aa26621d01635c377c2eed514b11f52135556ef95aea35484eb974dbaf9f22509117695b8f964f1864105b9076ddb1797af23b224a14e3a706cce4637c7368ac88058d01800fc989c3897451476a80bc95ff7c13e6f05fba28321a33fabd01454c88070c1412901b8fcc1fb6baf1b6d5d53d40ab706a0f6eceb5226c0caa651c1e744b4a154ec6b0f7061aa6c24182b97b9b4cd3328adf53a3289bf2eb2430e01ddf42e76e736791a40549175aa154cc16a18e9861d312213f85462b6277f2fb1ccf487065dc75a2", 0xd6}, {&(0x7f0000000ac0)="a3a4df5a46839d2ea9e1106f1fc86656d1798fa112ec3e730c9f63dd4c9e67d822b6f6d4bf41761ae29498c7b5c1b63d662d51a8e2047b95e7c935785a39d4a12ebd76fae09a8bede8083746e90e070335d5ea4d9f09e7c6f83fcc814bcf1061c0dee73225836bd93e9482d23c", 0x6d}, {&(0x7f0000000980)="ca3c4acb0c5b6ba63d271bc90e2285b944974d386bb9d4ad108c916759d4485b3ca4ba03bf786796a33a26381e92512baf8d5dc19507ac5cdea0de0694558ad7f816e37ed258c42080deecd8aca769c093aad8c0b50c3528de1262fe07859cfa64e6824f587d4abfe45aac1a1c1e64a44f715941c63ba85a0205348ef82d4e2f198b933acbd7d06eb4be2e4698c895e18b4494424ef9846d9b65c6660f1bc897", 0xa0}], 0x6, 0x0) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000080)='./cgroup.net/syz0\x00', 0x1ff) ioctl$TIOCSSOFTCAR(r2, 0x541a, &(0x7f0000000000)=0x59) r3 = syz_open_pts(r1, 0x0) r4 = dup3(r3, r0, 0x0) ioctl$TCXONC(r4, 0x540a, 0x0) pselect6(0x40, &(0x7f0000000340)={0x9}, 0x0, 0x0, 0x0, 0x0) 16:20:56 executing program 2: r0 = syz_open_procfs(0x0, &(0x7f0000000080)='net/dev_snmp6\x00') r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r1, 0x40045431, &(0x7f00000000c0)) r2 = syz_open_pts(r1, 0x0) r3 = accept(r0, 0x0, &(0x7f0000000180)) ioctl$FS_IOC_RESVSP(r3, 0x40305828, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0xffffffff}) r4 = dup3(r2, r0, 0x0) ioctl$TCXONC(r4, 0x540a, 0x0) pipe(&(0x7f0000000480)={0xffffffffffffffff, 0xffffffffffffffff}) write(r5, &(0x7f0000000340), 0x41395527) getpeername$packet(r5, &(0x7f0000000680)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @remote}, &(0x7f00000006c0)=0x14) getsockopt$inet6_IPV6_XFRM_POLICY(r0, 0x29, 0x23, &(0x7f0000000700)={{{@in6=@dev, @in6=@loopback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@ipv4={[], [], @loopback}}, 0x0, @in=@empty}}, &(0x7f0000000800)=0xe8) accept$packet(0xffffffffffffffff, &(0x7f0000000840)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @link_local}, &(0x7f0000000880)=0x14) sendmsg$nl_xfrm(r0, &(0x7f0000000b40)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f0000000b00)={&(0x7f00000008c0)=@migrate={0x23c, 0x21, 0x800, 0x70bd2c, 0x25dfdbfb, {{@in6=@remote, @in6=@loopback, 0x4e24, 0x8ce, 0x4e23, 0x3, 0xa, 0x20, 0x10, 0x87, r6, r7}, 0x6e6bba, 0x1}, [@policy={0xac, 0x7, {{@in=@multicast1, @in6=@mcast2, 0x4e24, 0x3e02, 0x4e24, 0x5, 0x2, 0x20, 0x80, 0x449eb2a1a73502b2, r8}, {0x3, 0x4dfd, 0xc3, 0x6, 0x3f, 0xfa, 0x0, 0x101}, {0x2, 0xcdb, 0x4, 0xe216}, 0x2, 0x6e6bc0, 0x1, 0x1, 0x1, 0x3}}, @algo_auth={0xd0, 0x1, {{'crct10dif-pclmul\x00'}, 0x438, "5304ebc941535f952d34a7ec235b3eac706b678e7d9fd5edaaf600661e3ff0553ec56af57c4882b3ec308557a96e739d8d827986720a8cbf857cdd5c3c1ecfa334a1ed21089a1f07811d716b37449379c7fcea1c9401a825d708ec5ee477558548fc295c22091abff6f89049f5a754a038cb3d92a9fe2c643a20f52dc46dc6b62e4f27b407291e"}}, @user_kmaddress={0x2c, 0x13, {@in=@broadcast, @in=@remote, 0x0, 0x2}}, @replay_thresh={0x8, 0xb, 0x8000}, @srcaddr={0x14, 0xd, @in6=@local}, @policy_type={0xc, 0x10, {0x1}}, @etimer_thresh={0x8, 0xc, 0x6}, @srcaddr={0x14, 0xd, @in6=@initdev={0xfe, 0x88, [], 0x0, 0x0}}]}, 0x23c}, 0x1, 0x0, 0x0, 0x20000000}, 0x4040840) pselect6(0x40, &(0x7f0000000340)={0x9}, 0x0, 0x0, 0x0, 0x0) pipe(&(0x7f0000000480)={0xffffffffffffffff}) vmsplice(r9, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) ioctl$LOOP_GET_STATUS(r9, 0x4c03, &(0x7f0000000200)) r10 = add_key(&(0x7f0000000000)='.request_key_auth\x00', &(0x7f0000000100)={'syr', 0x2}, 0x0, 0x0, 0x0) keyctl$assume_authority(0x10, r10) 16:20:56 executing program 5: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS2(r1, 0x402c542b, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, 0x0, "c41e495183430405e274ccf7defb07f5340067"}) pipe(&(0x7f0000000480)={0xffffffffffffffff}) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) ioctl$BLKGETSIZE(r2, 0x1260, &(0x7f0000000080)) r3 = openat$selinux_mls(0xffffffffffffff9c, &(0x7f0000000140)='/selinux/mls\x00', 0x0, 0x0) r4 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000200)='TIPCv2\x00') sendmsg$TIPC_NL_BEARER_SET(r3, &(0x7f00000002c0)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x20000}, 0xc, &(0x7f0000000240)={&(0x7f00000003c0)={0x128, r4, 0x100, 0x70bd29, 0x25dfdbff, {}, [@TIPC_NLA_MEDIA={0x38, 0x5, [@TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'ib\x00'}, @TIPC_NLA_MEDIA_PROP={0x24, 0x2, [@TIPC_NLA_PROP_WIN={0x8, 0x3, 0x7a2d627a}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x1}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x3}, @TIPC_NLA_PROP_PRIO={0x8}]}, @TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'ib\x00'}]}, @TIPC_NLA_NODE={0x14, 0x6, [@TIPC_NLA_NODE_ADDR={0x8, 0x1, 0x3}, @TIPC_NLA_NODE_ADDR={0x8, 0x1, 0x4a49}]}, @TIPC_NLA_LINK={0x28, 0x4, [@TIPC_NLA_LINK_PROP={0x24, 0x7, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x11}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x1f}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0xa}, @TIPC_NLA_PROP_WIN={0x8}]}]}, @TIPC_NLA_LINK={0xa0, 0x4, [@TIPC_NLA_LINK_PROP={0x14, 0x7, [@TIPC_NLA_PROP_WIN={0x8}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x8}]}, @TIPC_NLA_LINK_PROP={0x24, 0x7, [@TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x5}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x4}]}, @TIPC_NLA_LINK_NAME={0xc, 0x1, 'syz1\x00'}, @TIPC_NLA_LINK_PROP={0x1c, 0x7, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0x92ce}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x5}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x8}]}, @TIPC_NLA_LINK_PROP={0x3c, 0x7, [@TIPC_NLA_PROP_TOL={0x8, 0x2, 0x8}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x8}, @TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x4}, @TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_TOL={0x8}]}]}]}, 0x128}}, 0x0) sendmsg$TIPC_NL_NET_SET(r2, &(0x7f0000000140)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x4811}, 0xc, &(0x7f0000000100)={&(0x7f00000004c0)={0x3c0, r4, 0x400, 0x70bd26, 0x25dfdbfd, {}, [@TIPC_NLA_LINK={0xec, 0x4, [@TIPC_NLA_LINK_NAME={0x14, 0x1, 'broadcast-link\x00'}, @TIPC_NLA_LINK_PROP={0x34, 0x7, [@TIPC_NLA_PROP_TOL={0x8, 0x2, 0x4}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x1}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x101}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x4}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x5}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x15}]}, @TIPC_NLA_LINK_NAME={0x14, 0x1, 'broadcast-link\x00'}, @TIPC_NLA_LINK_NAME={0x14, 0x1, 'broadcast-link\x00'}, @TIPC_NLA_LINK_PROP={0xc, 0x7, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0x34}]}, @TIPC_NLA_LINK_NAME={0x14, 0x1, 'broadcast-link\x00'}, @TIPC_NLA_LINK_PROP={0x4}, @TIPC_NLA_LINK_PROP={0x2c, 0x7, [@TIPC_NLA_PROP_WIN={0x8}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0xd}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x9}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x6deb}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x8}]}, @TIPC_NLA_LINK_NAME={0x14, 0x1, 'broadcast-link\x00'}, @TIPC_NLA_LINK_NAME={0x14, 0x1, 'broadcast-link\x00'}]}, @TIPC_NLA_NET={0xc, 0x7, [@TIPC_NLA_NET_ADDR={0x8, 0x2, 0x7e01}]}, @TIPC_NLA_BEARER={0x30, 0x1, [@TIPC_NLA_BEARER_PROP={0x2c, 0x2, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0xffff}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x8}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0xb}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x8}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0xfffffffffffffffc}]}]}, @TIPC_NLA_SOCK={0xc, 0x2, [@TIPC_NLA_SOCK_REF={0x8, 0x2, 0x648}]}, @TIPC_NLA_NODE={0x2c, 0x6, [@TIPC_NLA_NODE_ADDR={0x8, 0x1, 0x3ff}, @TIPC_NLA_NODE_ADDR={0x8, 0x1, 0x8}, @TIPC_NLA_NODE_ADDR={0x8, 0x1, 0x6}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}]}, @TIPC_NLA_MON={0x24, 0x9, [@TIPC_NLA_MON_REF={0x8, 0x2, 0x4}, @TIPC_NLA_MON_REF={0x8, 0x2, 0x6}, @TIPC_NLA_MON_REF={0x8, 0x2, 0x3d62}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8, 0x1, 0xfffffffffffffff7}]}, @TIPC_NLA_NODE={0x24, 0x6, [@TIPC_NLA_NODE_ADDR={0x8, 0x1, 0x3011}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_ADDR={0x8, 0x1, 0x4}, @TIPC_NLA_NODE_ADDR={0x8, 0x1, 0x1}]}, @TIPC_NLA_MEDIA={0xf0, 0x5, [@TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'eth\x00'}, @TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'udp\x00'}, @TIPC_NLA_MEDIA_PROP={0x24, 0x2, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x4}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x10001}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x5}, @TIPC_NLA_PROP_TOL={0x8}]}, @TIPC_NLA_MEDIA_PROP={0xc, 0x2, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0x3ff}]}, @TIPC_NLA_MEDIA_PROP={0x44, 0x2, [@TIPC_NLA_PROP_TOL={0x8, 0x2, 0x3}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0xe8}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x7}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x6}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0xfffffffffffffff7}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0xff}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x5}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x40}]}, @TIPC_NLA_MEDIA_PROP={0x54, 0x2, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x16}, @TIPC_NLA_PROP_WIN={0x8}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x1e}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x3ff}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x101}, @TIPC_NLA_PROP_WIN={0x8}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x12}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x13}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x5}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x9}]}, @TIPC_NLA_MEDIA_PROP={0xc, 0x2, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0x2}]}, @TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'udp\x00'}]}, @TIPC_NLA_BEARER={0xe0, 0x1, [@TIPC_NLA_BEARER_NAME={0x10, 0x1, @udp='udp:syz0\x00'}, @TIPC_NLA_BEARER_PROP={0x54, 0x2, [@TIPC_NLA_PROP_WIN={0x8, 0x3, 0xfff}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0xffff}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x15}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x81}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x12}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x4}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x7}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0xebc}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x7}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x1}]}, @TIPC_NLA_BEARER_UDP_OPTS={0x44, 0x4, {{0x20, 0x1, @in6={0xa, 0x4e20, 0x81, @ipv4={[], [], @dev={0xac, 0x14, 0x14, 0x21}}, 0x3f}}, {0x20, 0x2, @in6={0xa, 0x4e24, 0x7, @empty, 0x6}}}}, @TIPC_NLA_BEARER_PROP={0x34, 0x2, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x19}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x1}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x2}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x16}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x1c}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x9}]}]}, @TIPC_NLA_MEDIA={0x34, 0x5, [@TIPC_NLA_MEDIA_PROP={0xc, 0x2, [@TIPC_NLA_PROP_TOL={0x8, 0x2, 0x100000000}]}, @TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'eth\x00'}, @TIPC_NLA_MEDIA_PROP={0xc, 0x2, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0x5}]}, @TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'ib\x00'}, @TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'udp\x00'}]}]}, 0x3c0}, 0x1, 0x0, 0x0, 0x4}, 0x40000) 16:20:56 executing program 1: r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/raw\x00') openat$selinux_status(0xffffffffffffff9c, &(0x7f0000000040)='/selinux/status\x00', 0x0, 0x0) pread64(r0, 0x0, 0x0, 0x800000000002) 16:20:56 executing program 1: r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/raw\x00') pread64(r0, 0x0, 0x0, 0x800000000002) ioctl$PIO_FONT(r0, 0x4b61, &(0x7f00000000c0)="4e1899554d1b67c87c6df168901f6e34643f33b239457720fdc791f2bdf278ac5962871d2eac1e1a40a00adb") r1 = gettid() ptrace$setopts(0x4206, r1, 0x0, 0x0) tkill(r1, 0x3c) ptrace$cont(0x18, r1, 0x0, 0x0) ptrace$setregs(0xd, r1, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r1, 0x0, 0x0) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000140)={r1, 0xffffffffffffffff, 0x0, 0x8, &(0x7f0000000100)='net/raw\x00', 0xffffffffffffffff}, 0x30) syz_open_procfs$namespace(r2, &(0x7f0000000180)='ns/pid\x00') r3 = openat$selinux_checkreqprot(0xffffffffffffff9c, &(0x7f0000000040)='/selinux/checkreqprot\x00', 0x1a180, 0x0) ioctl$KDGKBMETA(r3, 0x4b62, &(0x7f0000000080)) 16:20:56 executing program 1: r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/raw\x00') pipe(&(0x7f0000000480)={0xffffffffffffffff, 0xffffffffffffffff}) write(r1, &(0x7f0000000340), 0x41395527) fsetxattr$trusted_overlay_origin(r1, &(0x7f0000000040)='trusted.overlay.origin\x00', &(0x7f0000000080)='y\x00', 0x2, 0x2) pread64(r0, 0x0, 0x0, 0x800000000002) 16:20:56 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) r2 = dup2(r1, r0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) setsockopt$netlink_NETLINK_RX_RING(r2, 0x10e, 0x6, &(0x7f0000000100)={0x1f, 0x4000000004, 0x9, 0x20000080000000}, 0x10) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="0463c7f37b54cfdad648d92614eda37e9d318794ffe1ca1a738817b0d46c9fc42f44866870f0afcf3ba1d5a7ba6e140d7332907191b9eba33a455cd79855e0c5941a86960b9a4ad77ad1309be35d8f4fe8eb641c719ad9fc7fb8a4b42b6e0931284d289ca1909e083fa053f76973eadf822729543c827a31f5a3815c8e7abf84f2322bd255e4dc2bcb561fc3ab71aba4d0a61a9616e208f1445bbc4c73dbe62b0dc076b0464c4f"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000300)={0x8, 0x0, &(0x7f00000004c0)=[@acquire={0x40046304}], 0xb19b868c1a8b328c, 0x0, 0x0}) [ 1767.260853] binder: 10866:10870 IncRefs 0 refcount change on invalid ref 0 ret -22 [ 1767.293543] binder: 10910:10911 unknown command -205036796 [ 1767.299370] binder: 10910:10911 ioctl c0306201 20000140 returned -22 16:20:56 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f00000003c0)="11dca50d5e0bcfe47bf070") r1 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r1, &(0x7f0000000100)={0x2, 0x4e20}, 0x10) pipe(&(0x7f0000000480)={0xffffffffffffffff, 0xffffffffffffffff}) write(r2, &(0x7f0000000340), 0x41395527) pipe(&(0x7f0000000480)={0xffffffffffffffff}) vmsplice(r3, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) ioctl$ifreq_SIOCGIFINDEX_team(r3, 0x8933, &(0x7f0000000500)={'team0\x00', 0x0}) ioctl$sock_inet6_SIOCADDRT(r2, 0x890b, &(0x7f0000000540)={@mcast1, @initdev={0xfe, 0x88, [], 0x1, 0x0}, @mcast1, 0xfffffffffffffff9, 0x7, 0x7, 0x100, 0x7fff, 0x1000000, r4}) pipe(&(0x7f0000000480)={0xffffffffffffffff}) vmsplice(r5, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) ioctl$FS_IOC_FIEMAP(r5, 0xc020660b, &(0x7f0000000180)=ANY=[@ANYBLOB="01000000010000000900000000000000040000000000000009000000000000000300000000000000ff07000000000000060000000000000000000000000000000000000000000000000200000000000000000000000000008000000000000000fdffffffffffffff010000000000000000000000000000000000000000000000000100000000000000000000000000004db80000000000000000000000000800000000000000000000000000000000000000000000000030000000000000000000000000000000000000000000000800000000000000050000000000000000000000000000000000000000000000011a0000000000000000000000000000ff0f00000000000000040000000000005f49000000000000000000000000000000000000000000000001000000000000000000000000000009000000000000004200000000000000030000000000000000000000000000000000000000000000010000000000000000000000000000000100008000000000080000000000000000040000000000000000000000000000000000000000000000080000000000000000000000000000040000000000000000000000000000001f000000000000000000000000000000000000000000000005400000000000000000000000000000070000000000000002000000000000009600000000000000000000000000000000000000000000000800"/534]) connect$inet(r1, &(0x7f0000000cc0)={0x2, 0x4e20, @local}, 0x10) getsockopt$packet_int(r2, 0x107, 0xf, &(0x7f0000000040), &(0x7f0000000080)=0x4) setsockopt$SO_TIMESTAMPING(r1, 0x1, 0x25, &(0x7f00000010c0)=0x19ff, 0x4) sendto$inet(r1, &(0x7f0000000140)="b0", 0x1, 0x0, 0x0, 0x0) recvmmsg(r1, &(0x7f0000003b40)=[{{0x0, 0x0, 0x0}}], 0x1, 0x2000, 0x0) 16:20:56 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) r2 = dup2(r1, r0) write$selinux_validatetrans(r2, &(0x7f0000000080)={'system_u:object_r:hwclock_exec_t:s0', 0x20, 'system_u:object_r:net_conf_t:s0', 0x20, 0x4, 0x20, '/usr/sbin/ntpd\x00'}, 0x68) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000040)=ANY=[], 0x142, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000300)={0x8, 0x0, &(0x7f00000004c0)=[@acquire={0x40046304}], 0xb19b868c1a8b328c, 0x0, 0x0}) pipe(&(0x7f0000000480)={0xffffffffffffffff}) vmsplice(r3, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) ioctl$sock_inet6_udp_SIOCOUTQ(r3, 0x5411, &(0x7f0000000040)) [ 1767.306948] binder: 10910:10911 ioctl c0306201 20000300 returned -14 [ 1767.314813] binder: 10910:10912 unknown command -205036796 [ 1767.319499] binder: 10910:10913 ioctl c0306201 20000300 returned -14 [ 1767.320914] binder: 10910:10912 ioctl c0306201 20000140 returned -22 [ 1767.373913] binder: 10919:10920 ioctl c0306201 20000140 returned -14 [ 1767.381077] binder: 10919:10920 ioctl c0306201 20000300 returned -14 16:20:56 executing program 4: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) pipe(&(0x7f0000000480)={0xffffffffffffffff, 0xffffffffffffffff}) write(r2, &(0x7f0000000340), 0x41395527) ioctl$BINDER_GET_NODE_DEBUG_INFO(r2, 0xc018620b, &(0x7f0000000000)={0x1}) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0xf) pipe2(&(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}, 0x84000) write(r3, &(0x7f0000000180)="89b3703c414eb2cdf01f4f5dfaa6c7dfffe36ea134ce070b621ad442f57048e400ac99e075815a2328f07205bf61cef4b5f91d278bb2977934a7594e18a69f417dec82adfabbc0762a31cd0859cfa5d9c6097056dddf39dd9c282fc654f058a38832354f40494e305155ab1af57fa8d52e38f0a3dbb5c707ae9375642e2c3aa698afb4be4dda26d7bf8fe5ef", 0x8c) 16:20:57 executing program 2: r0 = syz_open_procfs(0x0, &(0x7f0000000080)='net/dev_snmp6\x00') r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r1, 0x40045431, &(0x7f00000000c0)) r2 = syz_open_pts(r1, 0x0) r3 = dup3(r2, r0, 0x0) ioctl$TCXONC(r3, 0x540a, 0x0) pselect6(0x40, &(0x7f0000000340)={0x9}, 0x0, 0x0, 0x0, 0x0) lsetxattr$security_ima(&(0x7f0000000000)='./file0\x00', &(0x7f0000000100)='security.ima\x00', &(0x7f0000000140)=@sha1={0x1, "22e1beedda30b466512abb2a0bfa61c69f7bc6bc"}, 0x15, 0x2) 16:20:57 executing program 2: r0 = syz_open_procfs(0x0, &(0x7f0000000080)='net/dev_snmp6\x00') r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r1, 0x40045431, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x9, 0x2, 0x0, 0x1}) r2 = syz_open_pts(r1, 0x0) r3 = dup3(r2, r0, 0x0) ioctl$TCXONC(r3, 0x540a, 0x0) pselect6(0x40, &(0x7f0000000340)={0x9}, 0x0, 0x0, 0x0, 0x0) 16:20:57 executing program 2: r0 = syz_open_procfs(0x0, &(0x7f0000000080)='net/dev_snmp6\x00') r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r1, 0x40045431, &(0x7f00000000c0)) r2 = syz_open_pts(r1, 0x0) r3 = dup3(r2, r0, 0x0) ioctl$TCXONC(r3, 0x540a, 0x0) clock_gettime(0x0, &(0x7f0000000100)={0x0, 0x0}) ppoll(&(0x7f0000000000)=[{r3, 0x108}], 0x1, &(0x7f0000000140)={r4, r5+10000000}, &(0x7f0000000180)={0x81}, 0x8) pselect6(0x40, &(0x7f0000000340)={0x9}, 0x0, 0x0, 0x0, 0x0) 16:20:57 executing program 5: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = openat$selinux_avc_cache_threshold(0xffffffffffffff9c, &(0x7f0000000080)='/selinux/avc/cache_threshold\x00', 0x2, 0x0) ioctl$TIOCGICOUNT(r1, 0x545d, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r2 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$TCSETS2(r2, 0x402c542b, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, 0x0, "c41e495183430405e274ccf7defb07f5340067"}) 16:20:57 executing program 5: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080)='\x00\x00\x13\x05\x00', 0x0, 0x0) ioctl$TCSETS2(r1, 0x402c542b, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, 0x0, "c41e495183430405e274ccf7defb07f5340067"}) pipe(&(0x7f0000000480)={0xffffffffffffffff}) vmsplice(r2, &(0x7f0000000000), 0x0, 0x0) r3 = openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000040)='/selinux/commit_pending_bools\x00', 0x1, 0x0) setxattr(&(0x7f0000000180)='./file0\x00', &(0x7f00000001c0)=ANY=[@ANYBLOB="0000000000000000000f0000000000"], &(0x7f0000000200)='/selinux/commit_pending_bools\x00', 0x1e, 0x2) write$selinux_user(r3, &(0x7f0000000240)=ANY=[@ANYBLOB="7382ab1ae84b1e042b3a6f626a6563745f723a756465765f7661725f72356e5f743a7330d251eb25d487090500"], 0x2c) bind(r2, &(0x7f00000000c0)=@ax25={{0x3, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x2}, 0x6}, [@default, @null, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x2}, @null, @bcast, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}]}, 0x80) 16:20:57 executing program 5: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ptmx\x00', 0x474482, 0x0) ioctl$TCSETS2(r1, 0x402c542b, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, 0x0, "c41e495183430405e274ccf7defb07f5340067"}) 16:20:57 executing program 5: pipe(&(0x7f0000000480)={0xffffffffffffffff, 0xffffffffffffffff}) write(r0, &(0x7f0000000340), 0x41395527) ioctl$EXT4_IOC_SETFLAGS(r0, 0x40086602, &(0x7f0000000080)=0x50050) r1 = open(&(0x7f0000000240)='./file0\x00', 0x40, 0x40) ioctl$FS_IOC_SETVERSION(r1, 0x40087602, &(0x7f0000000280)=0xffffffff80000000) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000380)={0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) ioctl$RTC_PLL_SET(0xffffffffffffffff, 0x40207012, &(0x7f0000000580)={0x5, 0x6, 0x0, 0xac1, 0xfffffffffffffff8, 0x8, 0x5}) r3 = openat$selinux_status(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/status\x00', 0x0, 0x0) vmsplice(r3, &(0x7f0000000200)=[{&(0x7f0000000100)="b93532095c8ca259be0d0bc8a5ae00e13dcdd929054f8447fa19504b0ef8c53160e399977a58ee24d1b3953764b0b49b83703381ab8c90dc1aab9baa31758ec0fba4f1b0a9e880dfa372e41c4c0c81037b567af117edad833ac9bb8a33716b43088972f7b508ea4b7473799d512305b67a85f5df724491b765f5cad8d0e4b572aac9752c11eeb327f1b5ecbf303ad51dddc41e14a559ef6d854bb83e2335dc2baa87fc38922f27f60924701d41d42c3ff8bc19c2968e07161e4449afcb3318fb83898f50e5e8812fea2b", 0xca}], 0x1, 0x8) openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ptmx\x00', 0x0, 0x0) ioctl$sock_SIOCGPGRP(0xffffffffffffffff, 0x8904, &(0x7f00000002c0)=0x0) r5 = creat(&(0x7f0000000040)='./bus\x00', 0x0) fcntl$setstatus(r5, 0x4, 0x8000000000044000) perf_event_open(&(0x7f0000940000)={0x2, 0x70, 0xee6a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) io_setup(0x69, &(0x7f0000000140)=0x0) truncate(&(0x7f0000000000)='./bus\x00', 0x7) io_submit(r6, 0x34f, &(0x7f0000000540)=[&(0x7f00000000c0)={0x0, 0x0, 0x3, 0x1, 0x0, r5, &(0x7f0000000000), 0x1c000}]) r7 = socket$inet6(0xa, 0x1, 0x30) fcntl$F_GET_FILE_RW_HINT(r7, 0x40d, &(0x7f0000000440)) capget(&(0x7f0000000300)={0x19980330, r4}, &(0x7f0000000340)={0x80, 0xffffffffffff3cbe, 0x4, 0x6, 0x7fffffff, 0x10000}) socket$inet6_udp(0xa, 0x2, 0x0) fcntl$setsig(r2, 0xa, 0xa) r8 = gettid() ptrace$setopts(0x4206, r8, 0x0, 0x0) tkill(r8, 0x3c) ptrace$cont(0x18, r8, 0x0, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x2400, 0x2) ptrace$setregs(0xd, r8, 0x0, &(0x7f0000000080)) write$P9_RLINK(0xffffffffffffffff, &(0x7f0000000540)={0x7, 0x47, 0x2}, 0x7) 16:20:57 executing program 1: r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/raw\x00') setsockopt$inet_MCAST_MSFILTER(r0, 0x0, 0x30, &(0x7f0000000040)={0xffffffffffffffff, {{0x2, 0x4e20, @rand_addr=0x5}}, 0x1, 0x9, [{{0x2, 0x4e24, @loopback}}, {{0x2, 0x4e22, @remote}}, {{0x2, 0x4e23, @empty}}, {{0x2, 0x4e22, @broadcast}}, {{0x2, 0x4e24, @loopback}}, {{0x2, 0x4e20, @multicast2}}, {{0x2, 0x4e22, @empty}}, {{0x2, 0x4e20, @rand_addr=0x5}}, {{0x2, 0x4e20, @multicast1}}]}, 0x510) pread64(r0, 0x0, 0x0, 0x800000000002) socket$inet_tcp(0x2, 0x1, 0x0) ioctl$RTC_ALM_READ(r0, 0x80247008, &(0x7f0000000580)) 16:20:57 executing program 1: r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/raw\x00') r1 = dup2(0xffffffffffffffff, 0xffffffffffffffff) ioctl$PERF_EVENT_IOC_MODIFY_ATTRIBUTES(r1, 0x4008240b, &(0x7f00000000c0)={0x0, 0x70, 0x8, 0xb8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0xfffffffffffffffb, 0x40, 0x8, 0x0, 0x0, 0x7, 0x0, 0x2, 0x0, 0x7fff, 0xffffffff, 0x8c, 0x0, 0x6, 0x0, 0x4, 0x5, 0x89fe, 0x0, 0x20, 0x1, 0x41, 0x1000000000000000, 0x7fff, 0xffff, 0x7ff, 0x3, 0x1, 0x0, 0x7956, 0x5, @perf_bp={&(0x7f0000000080), 0x2}, 0x4000, 0x1f, 0x8, 0x3, 0x7, 0x1000}) syz_genetlink_get_family_id$tipc(&(0x7f0000000180)='TIPC\x00') getitimer(0x1, &(0x7f00000002c0)) mkdir(&(0x7f0000000000)='./file0\x00', 0x0) r2 = open(&(0x7f0000000240)='./file0\x00', 0x0, 0x0) ioctl$SNDRV_TIMER_IOCTL_STOP(0xffffffffffffffff, 0x54a1) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r3 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000000)=ANY=[@ANYBLOB="30000000100001995f73157087212d0800000000", @ANYRES32=0x0, @ANYBLOB="400000000000000008001b000000"], 0x30}}, 0x0) ioctl$PIO_FONTRESET(r1, 0x4b6d, 0x0) write$P9_RREADLINK(r2, &(0x7f0000000200)=ANY=[@ANYBLOB="0a004700171c0001002e"], 0xa) pivot_root(&(0x7f0000000140)='./file0\x00', &(0x7f0000000100)='./file0\x00') close(r2) quotactl(0x200, &(0x7f00000004c0)='./file0\x00', 0x0, 0x0) openat$selinux_load(0xffffffffffffff9c, 0x0, 0x2, 0x0) ioctl$TIOCGPGRP(r3, 0x540f, &(0x7f00000001c0)) perf_event_open(&(0x7f0000c86f88)={0x2, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x84, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7, @perf_bp={0x0}, 0x20002}, 0x0, 0x0, 0xffffffffffffffff, 0x2) syz_emit_ethernet(0x3e, &(0x7f0000000200)={@link_local, @broadcast, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x30, 0x0, 0x0, 0x0, 0x4, 0x0, @remote={0xac, 0x223}, @dev}, @icmp=@parameter_prob={0x4, 0x4, 0x0, 0x0, 0x0, 0x2, {0x5, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @local={0xac, 0x223}, @dev}}}}}}, 0x0) close(0xffffffffffffffff) pread64(r0, 0x0, 0x0, 0x800000000002) [ 1768.102031] netlink: 8 bytes leftover after parsing attributes in process `syz-executor.1'. 16:20:57 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f00000003c0)="11dca50d5e0bcfe47bf070") r1 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r1, &(0x7f0000000100)={0x2, 0x4e20}, 0x10) connect$inet(r1, &(0x7f0000000cc0)={0x2, 0x4e20, @local}, 0x10) setsockopt$SO_TIMESTAMPING(r1, 0x1, 0x25, &(0x7f00000010c0)=0x19ff, 0x4) sendto$inet(r1, &(0x7f0000000140)="b0", 0x1, 0x0, 0x0, 0x361) recvmmsg(r1, &(0x7f0000003b40)=[{{0x0, 0x0, 0x0}}], 0x1, 0x2000, 0x0) [ 1768.173831] binder: 10919:10920 ioctl c0306201 20000140 returned -14 [ 1768.180647] binder: 10919:10922 ioctl c0306201 20000300 returned -14 16:20:57 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) r2 = dup2(r1, r0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000380)=ANY=[@ANYBLOB="04630440"], 0x0, 0x0, 0x0}) r3 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r3, 0x40045431, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1}) syz_open_pts(r3, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000300)={0x4c, 0x0, &(0x7f0000000180)=[@reply_sg={0x40486312, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x48, 0x18, &(0x7f0000000040)={@flat=@weak_binder={0x77622a85, 0x1000, 0x1}, @fd={0x66642a85, 0x0, r3}, @flat=@binder={0x73622a85, 0x81, 0x3}}, &(0x7f00000000c0)={0x0, 0x18, 0x30}}, 0x400}], 0x0, 0x0, 0x0}) 16:20:57 executing program 4: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x2400, 0x6) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) pipe(&(0x7f0000000480)={0xffffffffffffffff}) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000180)="280cb13f76e821dd527337a8533ab79e0c8368776915d2e03ec59a4c4152eea1b36c28974047329337f4a15ce7515b75b3806277036cf4495d118b1a1674ff16d184d56b6e389354e8bf8130fb0e6856f9a78787b5aa321a1176b18b117812cc433fb2b1f631a59685a3c3573cb6a962e9b5deeedaf2b278372124dcec9a00207325fd224f68356603e196da0650ae403cf2d79846a732163daca2be0860146ffbb98e3a972defe3999d0d92b31406f5372054a158da2e", 0xb7}], 0x1, 0x0) ioctl$TIOCSERGETLSR(r2, 0x5459, &(0x7f0000000000)) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0xf) 16:20:57 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) r2 = dup2(r1, r0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000380)=ANY=[@ANYBLOB="04630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000300)={0x8, 0x0, &(0x7f00000004c0)=[@acquire={0x40046304}], 0x0, 0x0, 0x0}) 16:20:57 executing program 1: syz_open_procfs(0x0, &(0x7f0000000000)='net/raw\x00') r0 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vga_arbiter\x00', 0x80804, 0x0) pread64(r0, 0x0, 0x0, 0x800000000002) write$UHID_SET_REPORT_REPLY(r0, &(0x7f0000000080)={0xe, 0x8, 0x2, 0x1, 0x1000, "842d97fc364edcac39678876e915909a1c0cc12903346412026eb9c3bc1e58a41735a46c8359d7b80319c45e47961b03d6fb20b6dbee828395ba47623098566b2c931d2a173a8360ca79ab0c0b8ef029567965e6abb0bdecbf0a39d2fe83711dc718f0387f3f7e047b147b6ba1fbc8079ab7651f8466da1d9dbaa96759d358f1ce7328b4a74555deac6c514aa2f11cb4c010748a6a90935d6a04f4ddb041f2d4efc7f3ac2aaa51923b77154fdc82ffe68c9fab1d267fea5bfc1a06a0fec632f4e66da8ba5bc2f243405b9d19185d6809656e2b8b2e8e544db6c912a83d6b0a7831f7d8d5464229b6291d2fbb594392257dfd00555d78df07a269f9c674dd9b4a3a85ebcfac0379742da639f56ab058ad4a2de929fcb061d7655d75e9fe82000b7465f2f1b4a0ef86d3d7458dc948a783ba330423766fed6779a7954610476d6cd8402c36919f22b6e83af3c6331b8ff0470c764630306ea1ee6b595a6e8ced1ec83ed48923550546ff33a1980fa6a5338dbc528c735e2416e370d406a7cb2e301dfd5c3386985edfe4426317f5be10b33d4efc0073fe71e67cb95f45b6a611dedc9e11397aae8af4963048237bba9d29136e7e5c0099b601e515d35e5a518e7228df4c4096f6f6f89822bc7e9289ad55d439746642c404cc791f1847ab047c24577e51a520031a1ef7dfe96c80472489939ede02aad5ed2af14bb0ada092850ff04090ca0af3fb40703a52e556aecb3640b264ada24861ddbee4fd3744323da57b31e5848a2406e18850b032bc29559266642dbbfa7786048e4e58b266c47bb3d3f81300ae6486905afe025e342bf0c44915fa469656d8448af5ad65e2c1ae141ede08ad940ddda70877e24270ff270a2b8a67d8bd876708b5b9f75db7674abd683229d6e54b16272fa8cf1b9cc3ce042c3eb33821091bf39a2ba593b04b2a3c475b79143af65e3b5f27c56ad3a7cf67584285bce9379b49ffcf0347a7edd8654103a6fe9b7f9e31166181755a2259292a8dffd0a6701394b3418a1551ea7a7bc9fded1bac98a3b138cb6aba38c7b93c35cc08bb36b3608523ebbc99ae731b1451874a08acfc6828a2069a8d2f9f7912ae9b5eb64af44ef85a76db51ac89a2b1a4e96dc06f948ca2385cfe1594ad3ca213a6bd1312de71bdab9af9ee9ec6a1878a3e3973fd232db021be09b2f5f9e9f9b0d34e70788d6b28fa53c5763bcf752a4a34e4a64a0fcb05eac4ea17163b6ff8420708045df6e442057e60e0c4700b9b6f1d7b1b79ad0e3adffa46c0a55feb05f06d569f45d3b390cec5eee063092fa644597445d844c0032d8ef2d9af3f3c7148bda1aa45a9974da7b88233f6c0c698a52ccba811ef7e9a7da06813ed4d216622948f1a5cbf9581a2ea6829408853762786c086680450f8d716597fd4629db8cac6fd611a1d7e1f6a971121604aa696db4605826ac1a8f6b66c0e37534c9c2f82d0e34ba262fd4e3e7664f5debe12a1f1fbdbf4ad41ede61b16f56dda59de77ea184fb084746006c250a3a91a11d19320644cde162dfd689c94077935c25035256941e449eb4e1efbd26caa447b09da39419e586374cddc634d391c250705b6ddaee187efabec89e9e7fc2f4a53e0ea2a278c922964d86d92b6b01c091a0371ff9dd97693ffb19c8937acac852112befd036d0404cb630d8fd023220b53ce79bc3f9f0a9cb0884bf8dbf3d49a5d545a50506b36b72251a0c589fbf2321dcbf1220d04892f79f7335374fd207a380a8a984b6a756573e7c529710605ec0f8d80b4dabfe29083f8ea237caa09cbfe9fe51343da38587959dd472f01e4c930b2fed86103efba050aa8c6b9b3b6252cb2de3329ce7fcb409414b0c0ebbf1738e73c2ff1cb8265c0d5a028a62c475854d5a874d834fb48282599d22c0bdb71d34e075f2920829277b22054582eb6ed51d7a1bd7072ede0b114f025965f9b4abe8db87698f8e84cb26d27533e9ee5a5c7b8a99f4a6f511c7c4e24e5e7fd91dd86f6f491e83b9f709b2183088ca44ee3aba28eb03910d799c1b0d25b93e9a1a66f1ac3924b73e6916ff45d6155475ff2807e19ada0e5ea1968b5720fe3f30a10095596625855c82c9c65561e256abf633eb93b0f9e297d363db4d72d9935a37f653dfaf7eeebb0481803b68b1851690e1cb5d1d92920972650872679155559490770e8a2b5ed20e2f0c70096c963f8a590c9582ba40915df38a088492ecda1034692d473c3432a3f61c236fe18e92b476bae0ec3ef773487b5b8acb7812500a9f60c9f6f72394f18c7479030e34e6c261769294d65ab8a443b6e688c6390820389815971a1bc1450ddff5266898c3d595d607eb3528ca5293999883e48ac783f833ea3c2eefaf3c57d821075889017a2ae1a1759dec652cc6e03be171006da1133e1c7f8f11d59c2e7e0aca4c73d2e1caf49540430a3d65a5f4c58aa9a716c66f8365bc88f28d59506f19f590c133e5df1f480bdeeeb7e2d0409f70ccf4274da66b0b8d8e814bd7de7da3d0fda46bac592243bfd65f2ef7bac269386af3a5cbddd9571107934bd48ae9b7f016deaefb69d61c0390eeba54333918c8a91bc96167181ec652f2d398ed66cf3fc474e47d90dd02a20de39a89e2626eca7041dd63ad4ec63e982d207b87fa0dc29618bf1ff48db20e349ab92c871a48ec032c8189dd816428a515465904fe334223f19b5aeb567b48240208755e4f1b0125148a37541998f6f7fd5f265ffdac12e6a8f05cd152cb37cf7e9421ceb16543d806401eaf0b67a40796158c97f8e581645c6f32ce8d59e386adffd0bd6d70542036387eda968c0ecfc19f088c7879f96487f16341fa1d6a537e04551e42bd786569df0c554e68668f98d5c194f871184b11e25207cf560f2e8c0ad7e2dba36d0f87bec29e055b686714b845f700987e8ce0f2cdd3bf74312f6634d25fd21ab63f577fbf90c33c4198ed71741a889afb1f4511fd4cfac918a8fad647743ae9a8d31ebcead1607c8190b8e82c1a2dcb204f96e2cf2f0a6c58d091af8573fa61af17ebad4f86f307ed5d06a8d828f713a58232a6da8663041e69467339e30d72c63efe01cfb4089da78c66b5fe8171af0c8fc7d900f244f5d7fe7b35ca81eab9143546b38fbdab59b26b6460109637b46378cec8a19541a03dfec04a59337e81bbba6c7c97cad42473ff47f2fdb0b293d8fce41bde44d281b1279a143292150c5e743c1bf9a73c364c49f2ba6c2d4f4a05f176e409fdf6c3f642e4b5aca1d0d9f218a8b2f590144ed520f4282955fd95ffd0d27989c723459e62a47a6e3abc8b421593b75241496bfd23bccf954169c7ab77633d5eced8cf1b2040d041b4aa0967ff4692b868488847a9e4c2b4b5180bd74d4ecb060d152052d0cfa092ee73563613f562b0a8862b73ec1c762a7f3bfa887dc6e71715a30698cc075adc0131cfccb14ba40de2a52957114cef50a0b24d374b237ba2acc6ba9b9b16e09860f04c2f5e5d2b865fb8839e051ee6cdc49fad5f3ce456a81d7fa98e5d1480e73aef23c79ffa489632f96a555345294f4776c0a5bd45b767ee462c587607bd413cdbb3c8fd872b7fe7edc989ae76b074204e37e3077498ed4c6273f5bade24791d9283221c4195931555aadb8c58715d9597623e5e87db8182ea07c58310d4e586d651c636095144205332156001bd06e6b4a5ffda16f7095c6ea3cf6b3811edd7fee23d15466f829d274f4eb40602754a35b24479d1989a77be57a6d3a4ccb58058851b6f0c11590b587d9767990597a386f1d32716c346701cb75aea20fec5fc89e229dfed7687da51e4af863d8b7554ac3cef11c338e0f8abbdd251f784539b8a5b1055f80e4d1329484b5473330ab63c109bc6312c5a90cc11543fa4a46ab8263ec53aea23edab255cf694f5fcb9ee5e94a5fa36d4cf093717d3abc67f0c4cba4cffa3cf157b608bfda8bf2c064ec2ebd83380d6882db4edb5c7f4e441326ee9626d39cb0446989624df5a2afecaa0d205fbe0d4f33ad4b593999bd6b1b4dc17431caadb1fa655b75e071d760e95982abf4eba41e7a616a20459af84345f2be3132a3bf6009e3582bafdc225943f2d21f4d3b409406d89612d823369a2a4561437caed3cd738bec69378aafbce22a3265855fdd885d88c50f6e03be1f740542ec90776de69148fec09eb17a9b6303fc435598d1d3c4560996d14e0568f401f5e043c25a48b913980f357b724ac497b9761a85f10fe0b52337c190af516218e0c62348128f1c4d0cc3ffd60a5cf1396b2beac9c21f13990b1be290dffd1fdebae1b45e1ae44b774329e29108b271fbe89f188131f61b2321b2788bfafb4773f1f0b3690bc5ce7e6487bbad6eba205c21c389f51807311b6321471e3db1239a9d4a995f6397b26344f1ae6deb515f92b9cccf05252330dec720fc41ecac74b614be3acc5e5c1cf83e03bb2d06008649d63d61a9ec4d34d00a98875dbe69eb1d1a0441125499c55b3243cb9eaa4c7484bb8528642c8be6a12b68c16897fd154f904fc8e6f4f2cb63bbe6666e1e8e8edf4fa2ea31e7de7c58333ab751329978e2f12014aaffc9fc97cafe8111af2dbc975c1928e1dce3f035f8127c70c83da3ca1f0a2c0a4607a0963dfcae3a2109cb9a88fef994b546f71d188271a2e5f7bcb9d88dc8e8a12a9db8b755144568965269a288d2d192a8f4d632204e010a4eeb2aa19aa4780216c74db7a567bfbf2ba6aa35faad167bd06fda3f79cbb6f7b466a3bf0e17389757e1e471338b977d094f0883e7aa3cccaf8845d4c22c6bd5dc152b3788c70bf77dd9399ea2acef015098a27498f74835e0386bd49a8209711a2674dffc10fe5a31b6bd32578d290daa14f93d7ac34e61884711b46bdc8809c59936f8ec4fd61626f141170cd998c9815798fa843a6c046f53358301815eb263814c108245a992f0c1d583e216daab768c4a023f5b553f05a193a9a321b8abda721ddbd9c8fcae4f6edc9e2f9d2c2cab68d52fa5690a93a48f65a6ab006c5a950e0e871876677b468ff5deb733ec3d49fab9fc2e269abb6580a74f89a31aad5c97484ae54b2c1a4cbc8ce5689cc04ccee5a5a0bb1f9688e2cbea8579351710224487715842bfa6971d7b9d3f50d512e9eed2cfaad7d958abf0ed0053c36a959de70aea3846c4201827cb6fb753341e47d8feca500af80212a0fbeb162ea7ea48c489932702030d035e9cf39047f1c49277473869f129058c4d1adf7a76cbda3045b143d7d926e613eb8c0363d9c8d969585202c8f275f94704b962144dc6443d376c56355098c9216792393e2e875e38ad578a722c32f7c6c1cc6d0b3fd5439793a64f4351b0ee0561d4d67441cb04205e2ea3043ef48895f19a455f98352a42faf824f78b5efc5e074b4c0c1a1ffbe8755eb1724a5d45f79ec33096086686b62cecd911d82663b8fc4ba5d19a53476af4f46272c627100a82b49e61d864feef9804b0cdc5669d287908e733b45620dcbdcc866aedf7069db536fd0fe136cccea3c75f98927804f564a74214992c01e8078a93bc0ad96c14ef59ebbdb95e82097179986fc80c0ec96058a052d6edd291f3f984403e7dd37ddd9e16be463fa62b3537564fa18980e670be4d6a12f4d42a39c999ed13a5d56e59bf4e2fceaea4ee9490dbcad4e9f2d280a25b0f034e17dde0ab044e7d8579018c3c2cbc489fa185ad8c549b708663ae84f424fa344c805891d1211292b33835171540b2fc4b919e56561bf2da551a79d708a61ff861b681daf57c5f6490cd50948b4ccd6a"}, 0x100c) [ 1768.257811] binder: 11000:11001 got reply transaction with no transaction stack [ 1768.265469] binder: 11000:11001 transaction failed 29201/-71, size 72-24 line 3036 [ 1768.274402] binder: undelivered TRANSACTION_ERROR: 29201 16:20:58 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) r2 = dup2(r1, r0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000380)=ANY=[@ANYBLOB="04630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000300)={0x8, 0x0, &(0x7f00000004c0)=[@acquire={0x40046304}], 0x0, 0x0, 0x0}) 16:20:58 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ptmx\x00', 0x0, 0x0) r2 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r2, 0x40045431, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1}) syz_open_pts(r2, 0x0) ioctl$TCSETS(r2, 0x40045431, &(0x7f0000000100)={0x0, 0x46, 0x2, 0x0, 0x0, 0x20000, 0x4, 0x0, 0x8000, 0x20000000000001, 0x3506, 0x802}) syz_open_pts(r1, 0x0) ioctl$VT_ACTIVATE(r1, 0x5606, 0x6) r3 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$IOC_PR_PREEMPT_ABORT(0xffffffffffffffff, 0x401870cc, &(0x7f0000000440)={0x0, 0xffffffff, 0x3213, 0x8}) r4 = openat$selinux_policy(0xffffffffffffff9c, &(0x7f0000000080)='/selinux/policy\x00', 0x0, 0x0) r5 = openat$selinux_mls(0xffffffffffffff9c, &(0x7f0000000140)='/selinux/mls\x00', 0x0, 0x0) r6 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000200)='TIPCv2\x00') sendmsg$TIPC_NL_BEARER_SET(r5, &(0x7f00000002c0)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x20000}, 0xc, &(0x7f0000000240)={&(0x7f0000000500)=ANY=[@ANYBLOB="28010000", @ANYRES16=r6, @ANYBLOB="000129bd7000ffdbdf25050000003800f96704fc91b0fccc24f67ac3280500080001006962000024000200080003007a622d7a080002000100000008000400030000000800010000000000080001006962000014000600080001000300000008000100494a07000800010011000000080002001f00000008000300000000000800030000000010a000040014000700080003000000000008000200080000002400070008000400000000000800010000000000080003000500000008000200040000000c00010073797a31000000001c00070008000400ce920000080003000500000008000400080000003c00070008000200080000000800040008000000080002000000000008000100040000000800020000000000080004000000000008000200"/303], 0x128}}, 0x0) sendmsg$TIPC_NL_NET_GET(r4, &(0x7f0000000400)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f00000003c0)={&(0x7f0000000340)={0x18, r6, 0x2, 0x70bd2d, 0x25dfdbfb, {}, [@TIPC_NLA_MEDIA={0x4}]}, 0x18}, 0x1, 0x0, 0x0, 0x20040040}, 0x404c840) r7 = dup2(r3, r0) ioctl$BINDER_SET_CONTEXT_MGR(r7, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="5e68007c6b5b4434f5dbfc363a27cd68cbe818338562cdbede132d61caff8f0e54fa09d49fd1dffb403c64ac68a1c95b6e32ba2fae8fe557751b83f9c983b98c68cd1a2001fd927ac5fcf99784a922afac354dc6b3f8bc0757fe2e7cd585c11af357d055bbbb8f461986ae126f2afdb9eec525260a95f4b4ba652d134b15e5f1c0c6d08cf05a2383a8fff74e7abc163815254a1f56eba9c4a1c91e483731b73da3279a0262685d9113b02278206ac72cfcba346cf913b4f87b5f9ae333b6f9daced990a14a5df758110972502b2b68c9c2d434d318629c480e339e5e86288c0ee9f0c73b9d601b77ae34bad65e1974ea1fd89566a58b288c0ea6ad21c0a6d0527df3ad9c3c765681ba412e71956c11cbf67fd5f7162724d60a999340623e8590fe4b98d61b9976ddf9517c85fae63c955a84e7afa86cbe033185f7602c6394927850965f9ab33ae9"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000300)={0x8, 0x0, &(0x7f00000004c0)=[@acquire={0x40046304}], 0xb19b868c1a8b328c, 0x0, 0x0}) 16:20:58 executing program 2: r0 = syz_open_procfs(0x0, &(0x7f0000000080)='net/dev_snmp6\x00') r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r1, 0x40045431, &(0x7f00000000c0)) r2 = syz_open_pts(r1, 0x0) write$UHID_INPUT2(r0, &(0x7f0000000000)={0xc, 0x3a, "48a823c12a4941060d6c0fcbfd231d84cff94e9ac1ccbc9a2df07de027e0609a199c0280e3f400d104cbb5a545655f01e9964c8bdd45f6d04991"}, 0x40) r3 = dup3(r2, r0, 0x0) ioctl$TCXONC(r3, 0x540a, 0x0) pselect6(0x40, &(0x7f0000000340)={0x9, 0x80, 0x0, 0x3, 0x1000, 0x6, 0x0, 0xfffffffffffffffd}, 0x0, 0x0, 0x0, 0x0) 16:20:58 executing program 1: r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/raw\x00') pread64(r0, 0x0, 0x0, 0x800000000002) ioctl$EVIOCREVOKE(r0, 0x40044591, &(0x7f0000000040)=0x1) 16:20:58 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) r2 = dup2(r1, r0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000380)=ANY=[@ANYBLOB="04630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000300)={0x8, 0x0, &(0x7f00000004c0)=[@acquire={0x40046304}], 0x0, 0x0, 0x0}) 16:20:58 executing program 1: r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/raw\x00') pread64(r0, 0x0, 0x0, 0x800000000002) fallocate(r0, 0x20, 0x5, 0x40) setsockopt$IP6T_SO_SET_ADD_COUNTERS(r0, 0x29, 0x41, &(0x7f0000000040)={'nat\x00', 0x0, [{}, {}]}, 0x48) getpeername(r0, &(0x7f00000000c0)=@pppol2tpin6={0x18, 0x1, {0x0, 0xffffffffffffffff}}, &(0x7f0000000140)=0x80) setsockopt$inet6_MRT6_ADD_MIF(r1, 0x29, 0xca, &(0x7f0000000180)={0x2, 0x1, 0x522b, 0x4, 0x7}, 0xc) [ 1768.646682] binder: 11022:11025 unknown command 2080401502 [ 1768.667387] binder: 11022:11025 ioctl c0306201 20000140 returned -22 16:20:58 executing program 1: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)) r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/raw\x00') pread64(r0, 0x0, 0x0, 0x800000000002) r1 = add_key(&(0x7f0000000080)='syzkaller\x00', &(0x7f00000000c0)={'syz', 0x1}, &(0x7f0000000100)="e12d29f934", 0x5, 0x0) keyctl$get_keyring_id(0x0, r1, 0x20) pipe(&(0x7f0000000480)={0xffffffffffffffff}) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) r3 = socket(0x10, 0x2, 0x0) getsockopt$sock_cred(r3, 0x1, 0x11, &(0x7f0000caaffb)={0x0, 0x0}, &(0x7f0000cab000)=0xc) chown(&(0x7f00000001c0)='./file0\x00', r4, 0x0) sendmsg$nl_netfilter(r2, &(0x7f0000000200)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x8}, 0xc, &(0x7f00000001c0)={&(0x7f0000000180)={0x28, 0x4, 0x4, 0x800, 0x70bd26, 0x25dfdbfc, {0x5, 0x0, 0x6}, [@typed={0x8, 0x5f, @ipv4=@rand_addr=0x80000000}, @nested={0xc, 0x28, [@typed={0x8, 0x67, @uid=r4}]}]}, 0x28}, 0x1, 0x0, 0x0, 0x8000}, 0x2080) [ 1768.691625] binder: 11022:11025 ioctl c0306201 20000300 returned -14 16:20:58 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) r2 = dup2(r1, r0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000300)={0x8, 0x0, &(0x7f00000004c0)=[@acquire={0x40046304}], 0x0, 0x0, 0x0}) 16:20:58 executing program 2: r0 = syz_open_procfs(0x0, &(0x7f0000000080)='net/dev_snmp6\x00') r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r1, 0x40045431, &(0x7f00000000c0)) r2 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r2, 0x40045431, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1}) syz_open_pts(r2, 0x0) r3 = socket(0x10, 0x2, 0x0) getsockopt$sock_cred(r3, 0x1, 0x11, &(0x7f0000caaffb)={0x0, 0x0}, &(0x7f0000cab000)=0xc) chown(&(0x7f00000001c0)='./file0\x00', r4, 0x0) lstat(&(0x7f0000000100)='./file0\x00', &(0x7f0000000140)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) pipe(&(0x7f0000000480)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$GIO_UNIMAP(r7, 0x4b66, &(0x7f0000000300)={0x1, &(0x7f00000002c0)=[{}]}) vmsplice(r6, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) getsockopt$sock_cred(r6, 0x1, 0x11, &(0x7f00000001c0)={0x0, 0x0, 0x0}, &(0x7f0000000200)=0xc) r9 = socket$inet(0x2, 0x4000000000000001, 0x0) r10 = add_key$user(&(0x7f0000000400)='user\x00', &(0x7f0000000500)={'syz', 0x2}, &(0x7f0000000740)="adf1f298ac1bac9c3d6f3dd7088ea654b4d0c0216fd6039c9f3599f4eb90e9fa9662a65d09962ab7985f28190c268be092caad1a44a30b9cb7ffb74ba55a08d87a17b142b3767782e5b9dca7bf952e0c54fe24c41f7ec528036c0641a850e7e13bb3e1f8d628563930c484d5f4c7e6f57eb8210ae214170116934c7c4b9ecd38ebe379a4e370e6b036d4558d2c6a22f98bff9a1e6c0f32bd9fc1f1c2d3d42b351434a95544db8db01a6370828055e048246b9cca39ce36a812f2ce6975c8f20d8b1c156a842cc2ddce5ad756caa98ba0b4ceedb3f59dc50e2f832f77145425903391f84e4488e41d389923ee22c813923b0ddf78781242793b4a58b7d1b32f3c9e0e11f3ccd2bb9cb92364453a89cc9e9188cf075959f164daeb894937ef7ccfe675d841879bf5d9f41d427bee1a707fb5cdb87a369e7ad0778906f92d743ae9da5bd145c344ae748c41e4980816e6e5f30548125d8a8e78f08e742e876c3708db6934b9eadb446b7d406ded73d01f989936ca214b1c4cc24c741f9992e238a2d44fd9bdc474e11d3de5b86b97bb1468f0da8236c48e3dbe4925212dca23d462b8f87feefee83487ab429cb57aeb02c17e53ba39778e546ec827ffc5c0cc0ec0ddd876a0268ed27a1ffdd200d546ef1d9df96e0db747465df2e2ebdef50c907f5a23b0f23cefe866dc6a9e6e2fdb0e525ff5533e2bcb5df452e5601a840cca9fd0052ff1211276ec405e5816e41c010b242a63fa3b97b0a4d79fef738f263a16fbdb734fb11ef174bfd09709d8ebabe8e9b774c3a34d7f3146ead0cc4c6b329ec5ab3b4a58b40cf9f47199a794ccd89326d9e57d5d8faee65a21c34e49cb8994d6e69df42d0927cbe82e667cbd2ec0ecd89c8ba490ee78e4a11635587e5ccbb5fa3f93d3b776d4e522748e2bbf1dc2cb6d826a1d60d010981cf4305ec59f948f80a21c36ad3b10227825cde0c3f82f2960ddbc9e6dc31038f4b184440562cc3e74604b9162cec885324cfdf48da6c18c78fee359b53d8fe80e6b7a1d9fa37eda00179e517d9ef87c31486f184817051b7ff4421d016fad8728ce2d71435a102387084a9819b87c7858c267e1706455ee0a6dd069c057bb88df0fc7cddfd7298d273994e726fe747fffaff6b91d1bc6efe5e98f68ed762d20f8ee47ac5efd7bde79e106b84b886ab8cb69d8f3955ffd6eaca423b35d9a2d48444d296b5ac40877a137cdb150182c670abf67fdd8156a1a1da6eef74e1f6e01b771789d6b39fda761b0de124086c86d02e3912473efdc8082b3b9c97231464b6e286dbba0fa079d273ec82d620f459dda008d3975ac848794c9b47ac13bb401b1ed54544cfb010a929596a77ab12f8d78629ff81524fa66743e8197adaf9014fa51e590d6c54996dc52bca8cd965bcdcdc6d711d9b40b6fb5834e62e0ba5c41a25376393b1d79be14fee3400536f758c9c483a85d451b8f764241c2266e26449f588827ad7f2433c7810ef6f892d2da86b1109c14cef4c78796474b2f6d5c6761ea8debc6ad9a201395dbcc58d5dd098b965d76876d50dbd4cd1f3184a87cbd9d2c845d005ffece73dc9644c6d3876ea79c630d885ccf2ca10432094801bd0407f932f623132b66f690f59f163f942dd14f7a50881721e65ed674815fc0b70e57d2afdd90a58ea22cbefd117e7e2b3bbd08cf0287788d2e770cbc25bd10f5a0bf9d4fd604ff415b6e32bee283e8079c2f176911820de7d9a71d392796f396d0a4aebb1e54e1daf5a50712390e8294b288887da5ad9990b61846701c79de2f77c2fe259cb06e438b11d2b9fb9ef0dcd5666f3339326a46da9bd09d5004156eec0a4e09880a2a838fefc2d3a491eff358919d4c15ce6f0c9d32abdac334887be04601cfaf4092a8f4df25e8c4ea28ea8eb0d003d603ccc91a1555b2dc3b055c05d8b908a1d19890d7e31e6539e90021d57f040df5c2554d083c4345579c815c677d6e6a42e5b2e9f76635ec5908bd80bcb4fdb25012ea02104f86f9e31643608c1b18fcd94d04f59bc8658ebf09ca78837830c6453d8e143a474f715bacabc76f88e6742ac68fef2f6644bd0d3de978ff5f269b27ec6f1a5e025c2a0c01f1e9bf0ea7b4d54a80b4498a85307aad5f6098b335d22f0d31625ca95ed1856b55cd02dbf6431da0b536b7f5e073d22cbe7b09784f389a4935f5d854c64c7a3753f28dc2bac480343374d86f3278170233a3e74eaa461fad0590f8ce715981532203edaa762d23db1705e8efee53a85a8f5548a71d12a9644b025e782d88c87e46698ce1260a3ef37d8add19f895b712325e26ca5b6165e7ec28061925e18ca70f44c02d082cbb74e78915894a3a3de96f5ce3198d0b7e11d97a708dad811cc66424e1a741e979fdac0a15a62a5252b8f34deb23798f84469ddfc968e8961268868715affd8dc6a43b5c8716dd94372e331a6e0cebf4fd8696bc9133984e060efaee80f9921dbf3b18d510eff7fb414b961eba0e88f83dec6c66121ffe068f3a646eb86b631362d49cd38e1aa6704f0397908a0babf9cb962de4aec4b20530e2225e3ba7c8263d9a8a90640b12a9d0633eef22a42ccc478d1b0d1bf6a9590e0b9803479509c89b0187fb35ffe1aa6703e7d48c75281cdbbc6cce1e2e5f0bcd8689071747cdbac317a7d71430312927b95b1cd0fc15603da8395825aeb6499acc811e6974d4e46c8f6a7c17c8edc9727b9a68d65e7a1efb2b8085bbc0640e6fc56550a2e4e93d4b11bace5a9676716c44b1f2d5b2ab18ed45c6c71f6a58078d5814f925a52b1a601cd675c3e8ce218013895c071abcf2501cf24499cb5c3531b98a9b97dd762ed9af6f8d22c720f156c38eb7a27eabe22fa93d292497e8da1285ac223ad30a624542e2082f78adbe1059b2e7e6e831a850f0e9d71ade8c011cfbcb0718707fd6bf5b865c4af381bf431a5b22be6143ef12acb4e992c0361fabc14cfefeca590217c7416598a12623066e6b31b77c6839d6cc63e4a494d16616bcd0eab082b946bc90f324c3ffa131378b02937f677f6803f80d802cda7dac607aabe9df8bc19594711d12c85726ce4bcd6f686d13bbf391721f634b89216e1c947f88134c8b9df912306974a9140c68fe1badf8c0f693a197131846881f3ef0b3ae3ed3fbbde90b6acfa4e018000f1ac0b63bc4810690014d44dc8fe8ca5ac88f584a890f47786737a507cde305991ea0156db425e9f540b32ae01acf493db8bae8705fe46724dfdcb453cf4ee93b9305d29746b3628ea8e322ac70170ec02797e1c897e476f74d8b4d70eef872c4305015391304647c5c55171790e24188cd3e08db1b507f022b2b81c5d88abc776a41e0070c86c297ef832e548497a8b65e6bdc249c1a90ca0d72a0f2ff4b04206aad4c5bf55c7b84dde974a2e87504d2145aea3d3b478ebc028e88728b3e834d0f9f6ace8e0b570923b07e390971b035d9e4d1b6fd77db56f4196e55622c34897204690bfd3c69665a66e04f97d4b5e193f20632f5c57ab9aa496e274978b147f84bcf7e3be85bfa9245c2f55296619bdc9bdf1fb0986573206cc95ca47cb13cd663f82ea8042e42a3e8bc61c832f1745f83f1b8529d623406fa8184779141b58269adbd220afc546aa6a4d3be27567793a8fff83d71cec3ab7e59e5943f388ed3b1f3e8e254d6c6143fd0e63b4a2da47dbbebad178a323e2ccce33adeb1d4974c5cf6ab59c732afab6854a55cc165cefc17641bdb17e907d9d18b5dcc3155b8101153c30ccdc3e0bbf749bad08b4d201b35b564cb74323bdf6346bf956a3448ec6f7ca99f7e37a069b7771b32c15e2e0e5c9d6898e70e6ed0641516da2f95b7a34516883366b0b22358fd12e934934a4642ee1a8eb78225f74e8aa34e3906ed6d9585869a752e7db2b8c99a02c62512c1a435ae09fc7ef06caf578a4c7965ad684c044d336b8cf7e540cf14e6c6ebced155eb0c7b33a12754d451310adc3e5a737a31e978483004cc1a12c80c97cf316830a780b9dff407bf394b84ecbf37703849e3c37a4401d010f05be8cd5f9a011e2bfb7df829cc3efeb9479eca41e44c459329a0d2008073f156adfe0928ee8d5234cc568fc0ec128b5fbc23f445fcf8d4cfaeaacf3ea691ebfc7efc75dbf17d50f1d9eaa783c5116c086738b3434f7d71316fc96930f18f91f77ad6a2d6f30287f54b97f91f8062cbea7c4fa5ef38c970ef64aaef5a7ffdf2ffb999ae82e6f4227f69b2a3c330be24c34afc5eee54fdf8939ee4770a3b5f0f6cf07319530b1b4758d3c1ce2832300c3a2a54d9861335b12c72c3ba6105a1a1eae961fcfdae3e92390302c50ec28111549532411a505dd33b61e948e49afc8e3523e906c0bed14c7aad27aff202db4d3a415c41bedec87d37afe26915da864d812e9d1b4e5a140b1769935cdfb7223cd94d00657f9b70641759a481266b7026bb1a0fd0bbb643d0364b7b3d3535866d73db248f4bdd71f6fff2ef618b1556b92f337a4b4bbd8fa0d3c8ec1b9d01521044e1133bae69c52e44dabc3e7d4ad9503cefa382e0e7cd395dde86539c6f1d5b74315988766d3f5e7da0a45e2cce2ccb2090d8100abd35e0d40a3fc2d86258cf7d5d86cb033bf6057542768067a4ecb56e7e1b88ac0e7033adf86a59aa451ac2552b85de4e9bf88ac301733f05c99be883565d1637b522924f950aaac8cfd606b701c39192b55184a8c2366875c1e6d90e667f66d46596a0c155efa0ca09914a19d971220cad2b67d200489cdd70b59416d5442267d0a06cb2e6b8dfe7064736a40c7b1780fbc2600f659cffe8d79d620cee33c7504d6dc65023d4d8234ec04478ec25ec0e162abd0220c3c46e3901a0803be8bb5e7c45a19e7facce5593d48f04b4203983bbf5d9849742301d6e11436c2cae72d6af88f02ac1d3e50bbc489398dab9e5662d2c6062fdb187d30f607409723a817704bf742ad32f654a3e5a8c8743851e0d0391058f7eda7d686a4d544d7ad261bd818ce7df60e9f9467810f41da6315fd72a80a1a276619b4a39d7123d2ccd5bd15022edd65bfa93c068958564d2fb4c4f002512f6f9846529c6c1d5c051af467786d7d1ed5b66fa9834e6a9240bc56dbbd15d2a3ea6cdfadb2a19fd3b8df2c42e27f5833b93ce70ce0e7cf0bf6bafca369c82ccde75a119e589a7321f060979c5bf8dfc64112aabc269e8f1f83f304e17ae20a828396bb9721fdcf56861f2e5aae062a46b29cfb6c74a873ce2dc7da69a27fa7d5081e9c1a9dce056bea2cf6e9397c70d4317f322e73faaeb906c922e0e47149f4acf42f9517be203aea8aa759baafd63abdd3be6bc5a7cd34f2d01865fe8fbbe671935bb7ba1f889c0018fd0dc9ca365cd7b9a787fbb7a923661b681cb82b0d0c29b9e67431fc94de4c1291246a463dd8029cafd0a67954c4397b444c911aea08d7aba2661ec34b5153de3060a84e0f91d36bb5dc782953f32461cb3826d8b4d1364dccd9e84ea54273f93717c2b050b22a9ff773ff6ed6e29c06b406026b2b984aed2d43a6af6ff461c81e67f582ed161e92069e9bb8f5f33e3979b2f174336bf9a79a06ca842f75877a504b3ae4fe2fe18d936c2036af6cfda84ff93d64734a5b3c6ad267cde9e1127ffe4773a93ac640961d1c8f01285633ab9506956f8d772e017dbfa85a1b7dac433e27b7b0d64c31fa7654812c05bf0d395b98bc667ff836fa1a920bdfbfc0f38e96002a48a993e13e88a4e4f31fd3ee03b128bd17627fc10abb7e690fee7bfe5d38c305473da919581a9238cb361", 0xffc, 0xfffffffffffffffb) getsockopt$inet_IP_XFRM_POLICY(r9, 0x0, 0x11, &(0x7f0000000540)={{{@in6=@loopback, @in6=@ipv4={[], [], @broadcast}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@empty}, 0x0, @in6=@dev}}, &(0x7f0000000680)=0xe8) r12 = getgid() keyctl$chown(0x4, r10, r11, r12) fsetxattr$system_posix_acl(r2, &(0x7f0000000000)='system.posix_acl_default\x00', &(0x7f0000000240)=ANY=[@ANYBLOB="02000000010006000000000002000200", @ANYRES32=r4, @ANYBLOB="040002000000000008000500", @ANYRES32=r5, @ANYBLOB="08000100", @ANYRES32=r8, @ANYBLOB="08000500", @ANYRES32=r12, @ANYBLOB="10000100000000002000000000000020"], 0x44, 0x0) r13 = dup3(0xffffffffffffffff, r0, 0x0) ioctl$TCXONC(r13, 0x540a, 0x0) pselect6(0x40, &(0x7f0000000340)={0x9}, 0x0, 0x0, 0x0, 0x0) 16:20:58 executing program 4: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0xf) ioctl$FS_IOC_GETFSLABEL(r0, 0x81009431, &(0x7f00000001c0)) openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x800, 0x0) openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ptmx\x00', 0x280300, 0x0) openat$tun(0xffffffffffffff9c, &(0x7f0000000180)='/dev/t/t\x00', 0x80, 0x0) 16:20:58 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) r2 = dup2(r1, r0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) pipe(&(0x7f0000000480)={0xffffffffffffffff, 0xffffffffffffffff}) write(r3, &(0x7f0000000340), 0x41395527) getsockopt$netlink(r3, 0x10e, 0x7, &(0x7f0000000040)=""/41, &(0x7f0000000080)=0x29) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000040)=ANY=[], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000300)={0x8, 0x0, &(0x7f00000004c0)=[@acquire={0x40046304}], 0xb19b868c1a8b328c, 0x0, 0x0}) 16:20:58 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f00000003c0)="11dca50d5e0bcfe47bf070") r1 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r1, &(0x7f0000000100)={0x2, 0x4e20}, 0x10) connect$inet(r1, &(0x7f0000000cc0)={0x2, 0x4e20, @local}, 0x10) setsockopt$SO_TIMESTAMPING(r1, 0x1, 0x25, &(0x7f00000010c0)=0x197f, 0xffffffffffffff86) pipe(&(0x7f0000000480)={0xffffffffffffffff}) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) r3 = openat(r2, &(0x7f0000000040)='./file0\x00', 0x200, 0x80) ioctl$RTC_WIE_OFF(r3, 0x7010) sendto$inet(r1, &(0x7f0000000140)="b0", 0x1, 0x0, 0x0, 0x0) recvmmsg(r1, &(0x7f0000003b40)=[{{0x0, 0x0, 0x0}}], 0x1, 0x2000, 0x0) openat$selinux_mls(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/mls\x00', 0x0, 0x0) 16:20:58 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) r2 = dup2(r1, r0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000300)={0x8, 0x0, &(0x7f00000004c0)=[@acquire={0x40046304}], 0x0, 0x0, 0x0}) 16:20:58 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) r2 = dup2(r1, r0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000300)={0x8, 0x0, &(0x7f00000004c0)=[@acquire={0x40046304}], 0x0, 0x0, 0x0}) 16:20:58 executing program 4: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) socketpair(0x3, 0x800, 0x3, &(0x7f0000000000)={0xffffffffffffffff}) pipe(&(0x7f0000000480)={0xffffffffffffffff}) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) getsockopt$inet_IP_IPSEC_POLICY(r2, 0x0, 0x10, &(0x7f0000000180)={{{@in=@empty, @in=@initdev, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@empty}, 0x0, @in=@local}}, &(0x7f0000000100)=0xe8) r4 = gettid() ptrace$setopts(0x4206, r4, 0x0, 0x0) tkill(r4, 0x3c) ptrace$cont(0x18, r4, 0x0, 0x0) ptrace$setregs(0xd, r4, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r4, 0x0, 0x0) r5 = getpgid(r4) sendmsg$nl_generic(r1, &(0x7f0000000c00)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x80400000}, 0xc, &(0x7f0000000bc0)={&(0x7f0000000280)={0x90c, 0x1c, 0x20, 0x70bd2d, 0x25dfdbfc, {0x19}, [@nested={0x208, 0x78, [@typed={0x8, 0x6, @uid=r3}, @generic="00097648c275dc5fe8c56a5dd6f5358ae2ca9d2bee74c50eb1bd2e199e0217e46ef3efe38d4a55dc5091674cf0ea0f78a85e15612434d2a512dc4bc015095eaf4ccf161224dd0643cede1b864da9edc8a21ca0a8f798c72eb3db8ea0d4478f97ddcb559f14537d4b50d4551eb4606da86be2c7e9c3c5096d175382b8492766cd20c7f35ca4609c4bf35416f77c2ebfd5ae43083b3bfecadb59a231109174b5c2866b4a7f9fc0d6150d9491231dd462272f03fddffb14a4ce56658a705d8830b827bd35edf4f830f35401d6667a773571ae2577d29a07b0db710e83938b009e7ee2c3b654f1e1d51ebcc9", @generic="456dba9bca1e79153826866d8fb9f593dbaabbeafe4a5b1badc292a1e8f10cb5c94bfb35d8716d5a5584f855f58427f5c0236959976a79a5b4fe3d2acf1b6318c36f72b56d16781706db97848a680c37fde72e8809dc0b4cf0d6f4fd5722771ab81d99bac49e1752e7004a1dbde1cc9147e7dfd4ee3d72e9e80a0f46bb46408bbc9817b4f573aaeb21ee18bf8441e570ccb7476eb45dc42df626cc6a064eadf3c75a81e094387b4d06179afead84e0dee77125bb20cdb93371b69437345969e1f8b340e093d61ec1777004d3d38c2575ba13a7a93d2b9b98d2287eae", @generic="e7ddfe9eaf028cb0ac5686a69c38a97812630a1c1c8efaa6747ad3107a30b4fc781b561a8b8e8deda3d3c7d061f539371c7ff596c2"]}, @nested={0x14, 0x8f, [@typed={0xc, 0x80, @u64=0x2}, @typed={0x4, 0x4a, @binary}]}, @typed={0x8, 0x35, @u32=0x6}, @nested={0xfc, 0x56, [@generic="4f35807c1d5052a081", @generic="dd26ce455b6a1152574a8084a7401ea31ea2300c608c2f46e910881ab7", @generic="c9a971192be7aef6bbcc74d5e542a2a1070ba4d901f440fe3ea927d032d0804560a5831681f9009b38a8b5c664b65176a650f6a65c585349e5781a33d28accaf14415bc8c551fba06970c5d52db17090900c3533ea723ec3c1d928f14085e3627e897127ef60a14040d13189fc5d4eab1f65a35e301049a179fbb22f26a6d138b96024c936a53f552cb2ac4145702ededd85d50d2cad79e8d565f219570b7fa62599c0350bed82600f6572b0e9b9aec7c45cd6fa95b155a3ef482443c176dc2ccf44b348a42c2443dcf78fd1e7a349ad1a"]}, @generic="6d319083d9169f18ce8982c9924892a81f875c07eaad0948345cb4fc08dc702961092da3f33f3c8d3a718b1ad8f6149e66b611279cde95af1078e5302a6114ebbfdfe6ec218ae8d8eea8b2145774211df008d0d783c91134082fb8aecd69828e6272cff59990ca", @generic="d4ea306bee0df944599e67a359e7c51972ab84027fceb2ad5c0ae624", @nested={0x1dc, 0x66, [@typed={0x14, 0x54, @binary="620d3d2ad033e63654e5866eaa46"}, @generic="c3b7cf8bb39e1eac3627e3a0267f930e0d18f7f3d92ddefda85bd38d610c15223e236ebe715bf3cea41d7ebba8f2178f111f275063c55bcede15010fdf18a797c7b84c76c6e986a6eb37fb4027f29c552581f8485d3f5abc1f0034bd0cac8b4a02fa6338a9e8200b40f961e4cf4fd7354d7f198be7586a86b13f5cee", @typed={0xc, 0x5d, @u64=0x3}, @typed={0x14, 0x2e, @ipv6=@local}, @generic="12ce21fa32db3a38593fb07dad3ddc64a524fd3335957b2ceefd9e3089867e70527184ed27d66a923e494d95d59bafddf973c4273f1a15726dfe", @generic="61774f9a288a43aeefbe11a98bea3c55f51cabb561a417d65bfa9b49038b5193e85f80d45f0b9f00ab164ddee2529dd0544968305581bf17600d8494cd3a5e1f825afb77ff800d5bba5a511ddabd2c384fa2f330f848c543533739c792ceb47af4a446650d68df57e49a339d73749db0c28ab5bb701e56d240691404e572d7b21a241997ef8cb1f6f357184327", @generic="6d2675fffb742de7694df1fc78e1d7e90eb615cd8429cfc6d7e9a6e3b5f4a4b34b1d635708124ec260da22f3750abdb1741012dba3b592bd161348b2102061ee0996a5673612fef2c2ac21dba3edcbd8e0a5499536a8d749", @typed={0x8, 0xa, @pid=r5}]}, @nested={0x294, 0x2b, [@typed={0x8, 0x90, @fd=r0}, @typed={0x8, 0x61, @ipv4=@local}, @generic="6c9679090c3b2b1acc84f6a399f9a76c7faf31706f116f81a87a5da0af19b5c9cb0f464aaaa4c9b3016f60d86c98b4d7c60b0c7e5c3667e91c9a8731bfdcd071820dc57ef4e45a7016008927e4f9ecd6c20b47f5805fcf2bfe9b7149d0549c4e2eef301498dfbbfb6b90b508e33d1b871934e51635307f46", @generic="e655a0ec77f28fa5b14ba26480eaa3b189f21e81b10c4c274c9237fe51c9d24e5420cd1133c0b52e93488e30403b627a11719cf72833465db63dd0c1d877b04dac7c01ae7dc4860d70f68e8ceb893233d5c40671a059868469bb72b6413c399b1a33f3080fa5ca", @generic="877a9c5fe9ec4a1c0ebac8b04f423f7d368f89f1b3d1c8df167d33764d2cb0c91357b9649cd2c591383cc2db8659753741bd834702e8e4dc474feae60e188b38a9dc4c9cf2385abedbd1b9031474aea0fd59babbb0ae41526bbe1a50148f66edf5cfb393667299b74e7fe800cfe7f3cc3898af8724b6fe562b0e9c005388456be7e20aa3761da6c4b08df29d7870ac5bbb9f5e011deca8799b4c1e09b9069b224e3ea0bce90a6ec1101e575b1f70", @typed={0x10, 0x8f, @str='em1selinux\x00'}, @generic="77ba05c1589a75ac37a2d5808267a8700a647ec6c0f66da45946b217a3003e0891449207d548c5462cde3de8706e6a4746a598930c6cf91a489407da0f9e7737a0d03e4304526552a0b7b64fe7321da0c987334ba5eaa4b3701d7e0e3d8a5d15314dada14f59452469b4e7091656e8761434c9241308be11e7cf1c58a082f0ee4bb0e4cd2dfa4bdd4066cd47515e9d292e51b60d52aad7e53ec5d575849c845395b79d892f28f03286eb3a778e12ba283cbd72c45fc7eb7f79d9f32ef85265347dc74ff7fe978e4b31c3f856db688a840017cdbf7a795801e4c21a50246fa1ce62"]}, @generic="2d721229163762d189375b3a431aca4b9281a165209e6564344428f676e527800418005d1686851f5b4f0f7852c18b5a5ea7c965dc4c3bb53c7ed238251247bbe1", @generic="896f7ce396e9241d70789a32f44c3a55ebde29df4df1590ef9d097b714bd78454294263fd861674986f4f00c5538121b803400447f276e801bdbf9d043cd1eea10275a4fd016010e62ddc9ae50cc1dcb32d9ab759601df1aa9e9f9d096b3624496508b8e0ee2be2a8a65e4d7d63ca0167be61455c1edbd8716786ec4c81a5b27287d420b050e8e37255d97b306639e3e5f37b54dce487757fa014faa0021a371d8"]}, 0x90c}, 0x1, 0x0, 0x0, 0x4008000}, 0x8800) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r6, 0x8912, 0x400200) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0xf) 16:20:58 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) dup2(r1, r0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000380)=ANY=[@ANYBLOB="04630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000300)={0x8, 0x0, &(0x7f00000004c0)=[@acquire={0x40046304}], 0x0, 0x0, 0x0}) [ 1769.223158] binder: 11058:11074 ioctl c0306201 20000300 returned -14 16:20:58 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) dup2(r1, r0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000380)=ANY=[@ANYBLOB="04630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000300)={0x8, 0x0, &(0x7f00000004c0)=[@acquire={0x40046304}], 0x0, 0x0, 0x0}) [ 1769.265567] binder: 11077:11082 IncRefs 0 refcount change on invalid ref 0 ret -22 [ 1769.274191] binder: 11077:11082 IncRefs 0 refcount change on invalid ref 0 ret -22 [ 1769.303200] binder: 11085:11086 IncRefs 0 refcount change on invalid ref 0 ret -22 16:20:58 executing program 4: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0xf) ioctl$TIOCGPKT(0xffffffffffffffff, 0x80045438, &(0x7f0000000000)) [ 1769.311545] binder: 11085:11086 IncRefs 0 refcount change on invalid ref 0 ret -22 16:20:59 executing program 1: r0 = syz_open_procfs(0x0, &(0x7f0000000140)='\b\x00\x00\x00\x00\x00\x00\x00\xe19\xad\xf1;\x15\xc8\xb9\xe7+b\x8a\x1c\xd9\xdb\x92,\xbe\xad\xd9\xda,\xc6\x00\xb3\')\a\xd8rJ\xfa\x04\x14\xef\xe4\xe5\x05\x1b\\\x10\x81W\x86JOm\xfc\xdf\xee\xc5\xdc_\xe5u\xdb \xa9\x15\r\xff\'\xb7\xf9l\x8a\xb9~o\xb2\x06\x00\x00\x00\x00\x00\x00\x00\xf9*A\v?\xc9~\xa2\xe5X\xec\xb5Y\xb0\x1c\xbe]>\x13\x89\xa7\x89\xc9xk\xf7\x8f\x1c\x92\xa9o\xa71T\x9f!H\xe44\xc1\x93\xed\x00\xde\xbe\xef\xbbW9\xad\xc3D$\xc4\xd6\xcf\xae\\\xac\xec`0\xe7A6\x89\x90\x9b\xe1\xa2\x13\xe9\x02\xb5\xf7+\xf6\x98\xca6\xf9\xa6\x92T\xb5\xae\'\xa5\xda\x1a:\x92#yf\v\xad\x1d5\x15\x85\b\xfb9\x02p\xc7\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\b\x00\x00\x00\x00y\xd4\x1b') pread64(r0, 0x0, 0x0, 0x800000000002) 16:20:59 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) dup2(r1, r0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000380)=ANY=[@ANYBLOB="04630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000300)={0x8, 0x0, &(0x7f00000004c0)=[@acquire={0x40046304}], 0x0, 0x0, 0x0}) [ 1769.618645] binder: 11099:11101 IncRefs 0 refcount change on invalid ref 0 ret -22 [ 1769.627575] binder: 11099:11101 IncRefs 0 refcount change on invalid ref 0 ret -22 16:20:59 executing program 4: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1}) syz_open_pts(r0, 0x0) fcntl$getownex(r0, 0x10, &(0x7f0000000000)={0x0, 0x0}) sched_getparam(r1, &(0x7f0000000080)) r2 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) pipe(&(0x7f0000000480)={0xffffffffffffffff}) vmsplice(r3, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) r4 = gettid() ptrace$setopts(0x4206, r4, 0x0, 0x0) tkill(r4, 0x3c) ptrace$cont(0x18, r4, 0x0, 0x0) ptrace$setregs(0xd, r4, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r4, 0x0, 0x0) write$P9_RGETLOCK(r3, &(0x7f0000000180)={0x41, 0x37, 0x2, {0x0, 0x6, 0x100, r4, 0x23, 'posix_acl_access}em0cgroup{security'}}, 0x41) fcntl$getownex(0xffffffffffffffff, 0x10, &(0x7f0000000200)={0x0, 0x0}) sched_setattr(r5, &(0x7f0000000240)={0x30, 0x6, 0x0, 0x0, 0x7fffffff, 0x81e, 0x8, 0x6}, 0x9a93cc981413d35) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r6, 0x8912, 0x400200) ioctl$TIOCSETD(r2, 0x5423, &(0x7f0000000040)=0xf) 16:20:59 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000380)=ANY=[@ANYBLOB="04630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000300)={0x8, 0x0, &(0x7f00000004c0)=[@acquire={0x40046304}], 0x0, 0x0, 0x0}) 16:20:59 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) pipe(&(0x7f0000000480)={0xffffffffffffffff}) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) ioctl$RTC_PLL_GET(r2, 0x80207011, &(0x7f0000000040)) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000380)=ANY=[@ANYBLOB="04630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x8, 0x0, &(0x7f0000000080)=ANY=[@ANYRES64], 0x0, 0x0, 0x0}) [ 1769.959873] binder: 11108:11110 IncRefs 0 refcount change on invalid ref 0 ret -22 [ 1769.968995] binder: 11108:11110 IncRefs 0 refcount change on invalid ref 0 ret -22 16:20:59 executing program 2: r0 = syz_open_procfs(0x0, &(0x7f0000000080)='net/dev_snmp6\x00') fallocate(r0, 0x20, 0x4, 0x6) r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r1, 0x40045431, &(0x7f00000000c0)={0x0, 0x100000000, 0x8, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x400000000000}) syz_open_pts(r1, 0x0) pipe(&(0x7f0000000480)={0xffffffffffffffff}) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) r3 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r3, 0x40045431, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1}) syz_open_pts(r3, 0x0) pipe(&(0x7f0000000480)={0xffffffffffffffff, 0xffffffffffffffff}) write(r4, &(0x7f0000000340), 0x41395527) pipe(&(0x7f0000000480)={0xffffffffffffffff, 0xffffffffffffffff}) write(r5, &(0x7f0000000340), 0x41395527) openat(r5, &(0x7f0000000000)='./file0\x00', 0x0, 0x4) r6 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r6, 0x40045431, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1}) syz_open_pts(r6, 0x0) pipe(&(0x7f0000000480)={0xffffffffffffffff}) vmsplice(r7, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) fcntl$dupfd(r6, 0x0, r7) r8 = accept$inet(r0, 0x0, &(0x7f0000000100)) r9 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r9, 0x40045431, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1}) syz_open_pts(r9, 0x0) r10 = dup3(r9, r8, 0x40000) ioctl$TCXONC(r10, 0x540a, 0x0) pselect6(0x40, &(0x7f0000000340)={0x9}, 0x0, 0x0, 0x0, 0x0) 16:20:59 executing program 1: r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/raw\x00') pread64(r0, 0x0, 0x1e0a1d393be225d, 0xffffffffffff8000) 16:20:59 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000380)=ANY=[@ANYBLOB="04630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000300)={0x8, 0x0, &(0x7f00000004c0)=[@acquire={0x40046304}], 0x0, 0x0, 0x0}) 16:20:59 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f00000003c0)="11dca50d5e0bcfe47bf070") r1 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r1, &(0x7f0000000100)={0x2, 0x4e20}, 0x10) connect$inet(r1, &(0x7f0000000cc0)={0x2, 0x4e20, @local}, 0x10) r2 = open(&(0x7f0000000000)='./file0\x00', 0x200400, 0x0) r3 = syz_genetlink_get_family_id$tipc(&(0x7f0000000080)='TIPC\x00') sendmsg$TIPC_CMD_SHOW_NAME_TABLE(r2, &(0x7f00000001c0)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x41009}, 0xc, &(0x7f0000000180)={&(0x7f00000000c0)={0x30, r3, 0x10, 0x70bd2a, 0x25dfdbfb, {{}, 0x0, 0x5, 0x0, {0x14, 0x19, {0x4, 0xff, 0x7f, 0xc9}}}, ["", ""]}, 0x30}, 0x1, 0x0, 0x0, 0x40010}, 0x80) setsockopt$SO_TIMESTAMPING(r1, 0x1, 0x25, &(0x7f00000010c0)=0x19ff, 0x4) sendto$inet(r1, &(0x7f0000000140)="b0", 0x1, 0x0, 0x0, 0x0) recvmmsg(r1, &(0x7f0000003b40)=[{{0x0, 0x0, 0x0}}], 0x1, 0x2000, 0x0) 16:20:59 executing program 4: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/ptmx\x00', 0x304080, 0x0) ioctl$TCSETS(r3, 0x40045431, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1}) syz_open_pts(r3, 0x0) ioctl$TIOCSSOFTCAR(r3, 0x541a, &(0x7f0000000180)=0x3) ioctl$TIOCSWINSZ(r0, 0x5414, &(0x7f0000000000)={0x100000001, 0x7ff, 0x6, 0x3e6}) fsetxattr$trusted_overlay_redirect(r1, &(0x7f0000000080)='trusted.overlay.redirect\x00', &(0x7f0000000100)='./file0\x00', 0x8, 0x4) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0xf) [ 1770.059473] binder: 11113:11120 IncRefs 0 refcount change on invalid ref 0 ret -22 [ 1770.067635] binder: 11113:11120 unknown command -1 [ 1770.072665] binder: 11113:11120 ioctl c0306201 20000180 returned -22 16:20:59 executing program 1: r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/raw\x00') r1 = dup2(0xffffffffffffffff, 0xffffffffffffffff) ioctl$PERF_EVENT_IOC_MODIFY_ATTRIBUTES(r1, 0x4008240b, &(0x7f00000000c0)={0x0, 0x70, 0x8, 0xb8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0xfffffffffffffffb, 0x40, 0x8, 0x0, 0x0, 0x7, 0x0, 0x2, 0x0, 0x7fff, 0xffffffff, 0x8c, 0x0, 0x6, 0x0, 0x4, 0x5, 0x89fe, 0x0, 0x20, 0x1, 0x41, 0x1000000000000000, 0x7fff, 0xffff, 0x7ff, 0x3, 0x1, 0x0, 0x7956, 0x5, @perf_bp={&(0x7f0000000080), 0x2}, 0x4000, 0x1f, 0x8, 0x3, 0x7, 0x1000}) syz_genetlink_get_family_id$tipc(&(0x7f0000000180)='TIPC\x00') getitimer(0x1, &(0x7f00000002c0)) mkdir(&(0x7f0000000000)='./file0\x00', 0x0) r2 = open(&(0x7f0000000240)='./file0\x00', 0x0, 0x0) ioctl$SNDRV_TIMER_IOCTL_STOP(0xffffffffffffffff, 0x54a1) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r3 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000000)=ANY=[@ANYBLOB="30000000100001995f73157087212d0800000000", @ANYRES32=0x0, @ANYBLOB="400000000000000008001b000000"], 0x30}}, 0x0) ioctl$PIO_FONTRESET(r1, 0x4b6d, 0x0) write$P9_RREADLINK(r2, &(0x7f0000000200)=ANY=[@ANYBLOB="0a004700171c0001002e"], 0xa) pivot_root(&(0x7f0000000140)='./file0\x00', &(0x7f0000000100)='./file0\x00') close(r2) quotactl(0x200, &(0x7f00000004c0)='./file0\x00', 0x0, 0x0) openat$selinux_load(0xffffffffffffff9c, 0x0, 0x2, 0x0) ioctl$TIOCGPGRP(r3, 0x540f, &(0x7f00000001c0)) perf_event_open(&(0x7f0000c86f88)={0x2, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x84, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7, @perf_bp={0x0}, 0x20002}, 0x0, 0x0, 0xffffffffffffffff, 0x2) syz_emit_ethernet(0x3e, &(0x7f0000000200)={@link_local, @broadcast, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x30, 0x0, 0x0, 0x0, 0x4, 0x0, @remote={0xac, 0x223}, @dev}, @icmp=@parameter_prob={0x4, 0x4, 0x0, 0x0, 0x0, 0x2, {0x5, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @local={0xac, 0x223}, @dev}}}}}}, 0x0) close(0xffffffffffffffff) pread64(r0, 0x0, 0x0, 0x800000000002) [ 1770.107374] binder: 11124:11127 IncRefs 0 refcount change on invalid ref 0 ret -22 [ 1770.115996] binder: 11124:11127 IncRefs 0 refcount change on invalid ref 0 ret -22 16:20:59 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000380)=ANY=[@ANYBLOB="04630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000300)={0x8, 0x0, &(0x7f00000004c0)=[@acquire={0x40046304}], 0x0, 0x0, 0x0}) 16:20:59 executing program 1: r0 = openat$selinux_avc_cache_threshold(0xffffffffffffff9c, &(0x7f0000000240)='/selinux/avc/cache_threshold\x00', 0x2, 0x0) r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) lsetxattr$trusted_overlay_opaque(0x0, 0x0, 0x0, 0x0, 0x0) mkdir(&(0x7f0000000000)='./file0\x00', 0x0) write$P9_RXATTRCREATE(r0, &(0x7f0000000180)={0x7, 0x21, 0x2}, 0x7) ioctl$BLKIOOPT(r0, 0x1279, &(0x7f0000000400)) r2 = open(&(0x7f0000000240)='./file0\x00', 0x0, 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', 0x0, 0x2001001, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r3 = getpid() timer_create(0x0, 0x0, 0x0) setxattr$security_evm(&(0x7f0000000200)='./file0\x00', &(0x7f00000003c0)='security.evm\x00', &(0x7f0000000540)=ANY=[@ANYBLOB="c459d4035f8c3005bbe54ca562251afbd8b5b031403ffe3b2e2b8e10ff77dd06d8057c3afc76e8be2be685289ebbc854553a48a228d55ab5bbf33ace05879b6ec8e1daa958022441b6494c699f0037c40a76479a73f896eb04da15e1712d901a5574feec91c2c6e17fe8fceae12c15e108c185c4c69c7dfc8784fa1a10d19d753465cf7594e2a7b103702c046bfbcced7eafe53e4e47b7ca165c1fbdec187f9b0d2f2175643cb5caa9096be9342118919c588490b5ac184763198d8133f3e749243a45556933"], 0x7, 0x0) waitid(0x1, r3, &(0x7f0000000280), 0x2, 0x0) setxattr$security_smack_transmute(&(0x7f0000000300)='./file0\x00', &(0x7f0000000340)='security.SMACK64TRANSMUTE\x00', &(0x7f0000000380)='TRUE', 0x4, 0x0) setsockopt$inet_tcp_TCP_REPAIR_QUEUE(0xffffffffffffffff, 0x6, 0x14, &(0x7f00000001c0), 0x4) r4 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r4, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000000)=ANY=[@ANYBLOB="300000001000010800"/20, @ANYRES32=0x0, @ANYBLOB="400000000000000008001b000000"], 0x30}}, 0x0) pivot_root(&(0x7f0000000140)='./file0\x00', &(0x7f0000000100)='./file0\x00') prctl$PR_SET_KEEPCAPS(0x8, 0x1) ioctl$LOOP_SET_STATUS64(r2, 0x4c04, 0x0) syz_open_pts(r1, 0x0) fdatasync(r1) r5 = syz_open_procfs(0x0, &(0x7f0000000000)='net/raw\x00') pread64(r5, 0x0, 0xfffffffffffffca7, 0x800000000002) ioctl$UI_SET_RELBIT(r5, 0x40045566, 0x9) [ 1770.149422] netlink: 8 bytes leftover after parsing attributes in process `syz-executor.1'. 16:20:59 executing program 4: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) pipe(&(0x7f0000000480)={0xffffffffffffffff}) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) ioctl$EVIOCGKEY(r2, 0x80404518, &(0x7f0000000180)=""/147) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0xf) 16:20:59 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) r1 = dup2(0xffffffffffffffff, r0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000380)=ANY=[@ANYBLOB="04630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000300)={0x8, 0x0, &(0x7f00000004c0)=[@acquire={0x40046304}], 0x0, 0x0, 0x0}) [ 1770.208917] binder: 11142:11143 IncRefs 0 refcount change on invalid ref 0 ret -22 [ 1770.218901] binder: 11142:11143 IncRefs 0 refcount change on invalid ref 0 ret -22 16:20:59 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) r1 = dup2(0xffffffffffffffff, r0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000380)=ANY=[@ANYBLOB="04630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000300)={0x8, 0x0, &(0x7f00000004c0)=[@acquire={0x40046304}], 0x0, 0x0, 0x0}) [ 1770.271896] binder: 11153:11154 IncRefs 0 refcount change on invalid ref 0 ret -22 [ 1770.277824] netlink: 8 bytes leftover after parsing attributes in process `syz-executor.1'. [ 1770.317979] binder: 11155:11157 IncRefs 0 refcount change on invalid ref 0 ret -22 16:21:00 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) r1 = socket$inet6(0xa, 0xb, 0x180000000000) ioctl$sock_TIOCINQ(r1, 0x541b, &(0x7f0000000040)) r2 = socket$inet6_udplite(0xa, 0x2, 0x88) setsockopt$inet6_group_source_req(r2, 0x29, 0x2b, &(0x7f0000001580)={0x6, {{0xa, 0x4e21, 0x400, @mcast2, 0x5}}, {{0xa, 0x4e21, 0x800, @mcast2, 0xfff}}}, 0x108) r3 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) r4 = dup2(r3, r0) ioctl$BINDER_SET_CONTEXT_MGR(r4, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000380)=ANY=[@ANYBLOB="04630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000300)={0x8, 0x0, &(0x7f00000004c0)=[@acquire={0x40046304}], 0xb19b868c1a8b328c, 0x0, 0x0}) [ 1770.814306] binder: 11113:11162 IncRefs 0 refcount change on invalid ref 0 ret -22 [ 1770.822458] binder: 11113:11120 unknown command -1 [ 1770.827567] binder: 11113:11120 ioctl c0306201 20000180 returned -22 [ 1770.858160] binder: 11164:11165 ioctl c0306201 20000300 returned -14 16:21:00 executing program 2: r0 = syz_open_procfs(0x0, &(0x7f0000000080)='net/dev_snmp6\x00') r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ptmx\x00', 0x0, 0x0) r2 = bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f0000000000)={0x0, 0x3, 0x10}, 0xc) fcntl$setstatus(r2, 0x4, 0x2400) r3 = syz_open_pts(r1, 0x0) r4 = dup3(r3, r0, 0x0) ioctl$BLKFRASET(r4, 0x1264, &(0x7f0000000100)=0x2) ioctl$TCXONC(r4, 0x540a, 0x0) pselect6(0x40, &(0x7f0000000340)={0x9}, 0x0, 0x0, 0x0, 0x0) 16:21:00 executing program 1: r0 = openat$selinux_avc_cache_threshold(0xffffffffffffff9c, &(0x7f0000000240)='/selinux/avc/cache_threshold\x00', 0x2, 0x0) r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) lsetxattr$trusted_overlay_opaque(0x0, 0x0, 0x0, 0x0, 0x0) mkdir(&(0x7f0000000000)='./file0\x00', 0x0) write$P9_RXATTRCREATE(r0, &(0x7f0000000180)={0x7, 0x21, 0x2}, 0x7) ioctl$BLKIOOPT(r0, 0x1279, &(0x7f0000000400)) r2 = open(&(0x7f0000000240)='./file0\x00', 0x0, 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', 0x0, 0x2001001, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r3 = getpid() timer_create(0x0, 0x0, 0x0) setxattr$security_evm(&(0x7f0000000200)='./file0\x00', &(0x7f00000003c0)='security.evm\x00', &(0x7f0000000540)=ANY=[@ANYBLOB="c459d4035f8c3005bbe54ca562251afbd8b5b031403ffe3b2e2b8e10ff77dd06d8057c3afc76e8be2be685289ebbc854553a48a228d55ab5bbf33ace05879b6ec8e1daa958022441b6494c699f0037c40a76479a73f896eb04da15e1712d901a5574feec91c2c6e17fe8fceae12c15e108c185c4c69c7dfc8784fa1a10d19d753465cf7594e2a7b103702c046bfbcced7eafe53e4e47b7ca165c1fbdec187f9b0d2f2175643cb5caa9096be9342118919c588490b5ac184763198d8133f3e749243a45556933"], 0x7, 0x0) waitid(0x1, r3, &(0x7f0000000280), 0x2, 0x0) setxattr$security_smack_transmute(&(0x7f0000000300)='./file0\x00', &(0x7f0000000340)='security.SMACK64TRANSMUTE\x00', &(0x7f0000000380)='TRUE', 0x4, 0x0) setsockopt$inet_tcp_TCP_REPAIR_QUEUE(0xffffffffffffffff, 0x6, 0x14, &(0x7f00000001c0), 0x4) r4 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r4, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000000)=ANY=[@ANYBLOB="300000001000010800"/20, @ANYRES32=0x0, @ANYBLOB="400000000000000008001b000000"], 0x30}}, 0x0) pivot_root(&(0x7f0000000140)='./file0\x00', &(0x7f0000000100)='./file0\x00') prctl$PR_SET_KEEPCAPS(0x8, 0x1) ioctl$LOOP_SET_STATUS64(r2, 0x4c04, 0x0) syz_open_pts(r1, 0x0) fdatasync(r1) r5 = syz_open_procfs(0x0, &(0x7f0000000000)='net/raw\x00') pread64(r5, 0x0, 0xfffffffffffffca7, 0x800000000002) ioctl$UI_SET_RELBIT(r5, 0x40045566, 0x9) 16:21:00 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) r1 = dup2(0xffffffffffffffff, r0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000380)=ANY=[@ANYBLOB="04630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000300)={0x8, 0x0, &(0x7f00000004c0)=[@acquire={0x40046304}], 0x0, 0x0, 0x0}) [ 1770.961970] binder: 11174:11176 IncRefs 0 refcount change on invalid ref 0 ret -22 16:21:00 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f00000003c0)="11dca50d5e0bcfe47bf070") r1 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r1, &(0x7f0000000100)={0x2, 0x4e20}, 0x10) connect$inet(r1, &(0x7f0000000cc0)={0x2, 0x4e20, @local}, 0x10) setsockopt$SO_TIMESTAMPING(r1, 0x1, 0x25, &(0x7f00000010c0)=0x19ff, 0x4) sendto$inet(r1, &(0x7f0000000180)="b098ac685b363661aa7d1a063104cc1eb3c269e1d9571ffe0389d3072811093f32f1944ee8e6ce3013c956d79a8a370aad64a498f1c9c36b6f241cfd6f8eaa4f882ec38d54c83229e7f2029cfc84fdaffea036c351170400ef52f26e859186673f26cac8588dbe39b3b92cf7ea21b01add33709d82e772ceaf504369c8a9a7c9ba9c13469d8c8bedc290b3bba368bc490d0ed5bb2267ab3c3022d0136792d10c86c18e8db0f23180a79d35de85fa3ec27494d03f7ccac41628ce413bc599a753a9d8f4d7a9ec2eb3328c70f1c59bd427eb252a236d0acc0f3fc8e2a055a56ac303b2c3cab22ad9ee8a4e36e08313087e7bc5d4b2fba17b532c996ca1d0ce9d5e4cd5ff1ec3861add59bc590bcec6a7ebe7f4748a50545c53578ebb6c72806f0e4e0ed8fbf5b2f71bdd9a28c67edbce1aad99eea59e480aba02b294c97a493050ad117dbf2fe399dc6283596d758740cbfaad57b07688f996a82db5c77127622f2a62bec00f8ff1461705a475cd3b242fd820ce4b2f9209ccc26e86af5c8f1046aaa59f2e197ee06717b37885f92a00"/409, 0xffffffffffffffa6, 0x808, 0x0, 0x0) recvmmsg(r1, &(0x7f0000003b40)=[{{0x0, 0x0, 0x0}}], 0x1, 0x2000, 0x0) pipe(&(0x7f0000000480)={0xffffffffffffffff}) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) ioctl$PPPIOCSMAXCID(r2, 0x40047451, &(0x7f0000000000)=0xde4) 16:21:00 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) openat$selinux_checkreqprot(0xffffffffffffff9c, &(0x7f0000000180)='/selinux/checkreqprot\x00', 0x200, 0x0) openat$zero(0xffffffffffffff9c, &(0x7f0000000240)='/dev/zero\x00', 0x2000, 0x0) pipe(&(0x7f0000000480)={0xffffffffffffffff, 0xffffffffffffffff}) write(r1, &(0x7f0000000340), 0x41395527) syz_open_pts(r1, 0x101a02) pipe2(&(0x7f00000003c0), 0x2000) r2 = gettid() ptrace$setopts(0x4206, r2, 0x0, 0x0) tkill(r2, 0x3c) ptrace$cont(0x18, r2, 0x0, 0x0) ptrace$setregs(0xd, r2, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r2, 0x0, 0x0) syz_open_procfs(r2, &(0x7f0000000440)='net/ip_vs_stats_percpu\x00') r3 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r3, 0x40045431, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1}) syz_open_pts(r3, 0x0) ioctl$TIOCMGET(r3, 0x5415, &(0x7f00000004c0)) r4 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) r5 = dup2(r4, r0) ioctl$EVIOCSKEYCODE(r5, 0x40084504, &(0x7f0000000040)=[0x401, 0x18ce]) ioctl$KDDISABIO(r5, 0x4b37) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="fa563e0a40"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000300)={0x8, 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB="0463044000000000e03ea328f11703743c3f547901bc52a4aab67523423c82c5472d3332754a0c4c53d94f317f8a8e617b5fa28d1b85c1d186602264afda250e02d19ba45f743ec2ea22f1dfb874932f83bb608e5ddb74744825340f0264d7c6404929a3c1f0d46efe376a89169252cdbaa1c2e9f500"/131], 0xb19b868c1a8b328c, 0x0, 0x0}) 16:21:00 executing program 2: pipe(&(0x7f0000000480)={0xffffffffffffffff}) vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) ioctl$PPPIOCGIDLE(r0, 0x8010743f, &(0x7f0000000000)) r1 = syz_open_procfs(0x0, &(0x7f0000000080)='net/dev_snmp6\x00') r2 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ptmx\x00', 0x185004, 0x0) ioctl$TCSETS(r2, 0x40045431, &(0x7f00000000c0)) r3 = syz_open_pts(r2, 0x0) r4 = dup3(r3, r1, 0x0) ioctl$TCXONC(r4, 0x540a, 0x0) pselect6(0x40, &(0x7f0000000340)={0x9}, 0x0, 0x0, 0x0, 0x0) 16:21:00 executing program 5: r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) r1 = dup2(r0, 0xffffffffffffffff) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000380)=ANY=[@ANYBLOB="04630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000300)={0x8, 0x0, &(0x7f00000004c0)=[@acquire={0x40046304}], 0x0, 0x0, 0x0}) 16:21:00 executing program 5: r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) r1 = dup2(r0, 0xffffffffffffffff) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000380)=ANY=[@ANYBLOB="04630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000300)={0x8, 0x0, &(0x7f00000004c0)=[@acquire={0x40046304}], 0x0, 0x0, 0x0}) 16:21:00 executing program 4: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) bpf$BPF_PROG_DETACH(0x9, &(0x7f0000000000)={0x0, 0xffffffffffffffff, 0x6}, 0x10) ioctl$TIOCSETD(0xffffffffffffffff, 0x5423, &(0x7f0000000080)=0x15) 16:21:00 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) pipe(&(0x7f0000000480)={0xffffffffffffffff, 0xffffffffffffffff}) write(r2, &(0x7f0000000340), 0x41395527) r3 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r3, 0x40045431, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1}) syz_open_pts(r3, 0x0) pipe(&(0x7f0000000480)={0xffffffffffffffff}) vmsplice(r4, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) r5 = dup2(r4, r3) ioctl$BINDER_SET_CONTEXT_MGR(r5, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000380)=ANY=[@ANYBLOB="04630440"], 0x0, 0x0, 0x0}) fsetxattr$security_evm(0xffffffffffffffff, &(0x7f0000000040)='security.evm\x00', &(0x7f0000000080)=@ng={0x4, 0x0, "656aa72260f3a5"}, 0x9, 0x2) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000300)={0x8, 0x0, &(0x7f00000004c0)=[@acquire={0x40046304}], 0xb19b868c1a8b328c, 0x0, 0x0}) 16:21:00 executing program 5: r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) r1 = dup2(r0, 0xffffffffffffffff) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000380)=ANY=[@ANYBLOB="04630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000300)={0x8, 0x0, &(0x7f00000004c0)=[@acquire={0x40046304}], 0x0, 0x0, 0x0}) 16:21:00 executing program 5: r0 = syz_open_dev$binder(0x0, 0x0, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) r2 = dup2(r1, r0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000380)=ANY=[@ANYBLOB="04630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000300)={0x8, 0x0, &(0x7f00000004c0)=[@acquire={0x40046304}], 0x0, 0x0, 0x0}) 16:21:00 executing program 4: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) r1 = openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/commit_pending_bools\x00', 0x1, 0x0) r2 = gettid() ptrace$setopts(0x4206, r2, 0x0, 0x0) tkill(r2, 0x3c) ptrace$cont(0x18, r2, 0x0, 0x0) ptrace$setregs(0xd, r2, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r2, 0x0, 0x0) write$cgroup_pid(r1, &(0x7f0000000080)=r2, 0x12) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0xf) [ 1771.335034] binder: 11202:11223 IncRefs 0 refcount change on invalid ref 0 ret -22 [ 1771.383151] binder: 11202:11223 IncRefs 0 refcount change on invalid ref 0 ret -22 [ 1771.395897] binder: 11202:11223 ioctl c0306201 20000300 returned -14 [ 1774.637890] netlink: 8 bytes leftover after parsing attributes in process `syz-executor.1'. 16:21:04 executing program 1: setxattr$security_evm(&(0x7f0000000080)='./file0\x00', 0x0, 0x0, 0x0, 0x0) recvmmsg(0xffffffffffffffff, 0x0, 0x0, 0x40, &(0x7f00000077c0)) r0 = socket$inet(0x2, 0x4000000000000001, 0x0) ioctl$sock_inet_SIOCDARP(r0, 0x8953, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x80000000000002, &(0x7f0000000300)=0x80, 0x4) bind$inet(r0, &(0x7f0000000000)={0x2, 0x4e23, @broadcast}, 0x10) r1 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0xe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) getsockopt$sock_cred(r0, 0x1, 0x11, 0x0, &(0x7f0000000a00)) fstat(r1, &(0x7f00000004c0)) clock_getres(0x5, &(0x7f00000001c0)) lstat(&(0x7f0000000740)='./file0\x00', &(0x7f0000000780)) setsockopt$inet_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f0000000040)='bbr\x00', 0x4) r2 = open(&(0x7f00000000c0)='./file0\x00', 0x400, 0x50) r3 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000380)='IPVS\x00') sendmsg$IPVS_CMD_DEL_DEST(0xffffffffffffffff, &(0x7f00000004c0)={0x0, 0x0, &(0x7f0000000480)={&(0x7f0000000780)=ANY=[@ANYBLOB="576e77206e671f2e47eb1d3e3605946eb97dfc8bd41bf208b00a92389a14ea62227dff79e45a801605bdf3d603bbca46cf177d80be25a7011fd46bd0914c3d297395d4662e61ee4caa4d900753c62a97bad3b3d1055cd1d8afa127774c9d07f6516f15f86128f8cd6fdd810300d96549996d7565b19505666740be5bf1a0080024408f255775bc5e6341387ac33f7b63c90eb787a12e035667f5ff892f4400"/180, @ANYRES16=r3, @ANYBLOB="00022bbd7000ffdbdf2507000000ff139c470ae354f47540ee0b0400020004000100080001000a00000008000500020000000c00020008000b003a4b004008000500030000002400020008000b000200a50c067bd87df74268f6bc6699280000080004004e0000000800070007000000080006000900000008000600090000002000030008000500ac1e0101"], 0x3}, 0x1, 0x0, 0x0, 0x4000000}, 0x880) sendmsg$IPVS_CMD_DEL_DAEMON(r2, &(0x7f0000000240)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0xe6000900}, 0xc, &(0x7f0000000200)={&(0x7f0000000600)=ANY=[@ANYBLOB="24000000fca59c3da116ad063c75b07ac7c9d1e45fc38c80ba0ae074a2c31cd765ef2df9a5c111f6daa5ba5a1a9960fc98d449ff7a2856d0033ed95189f860c373487f9932510540d99aff79c366c215f29b", @ANYRES16=r3, @ANYBLOB="0000000800060008000000081150e91d8ca0c3784d000000a66cc955d51029532e88ee25e86ae059a94ba864e45501658505668196f9f885e266098826f0e521d1aff763c3fccaf8e42c83edec9823fb82491ded5353283f901575e05999ab"], 0x24}, 0x1, 0x0, 0x0, 0x1}, 0x0) sendto$inet(r0, 0x0, 0x0, 0x200007fd, &(0x7f0000e68000)={0x2, 0x4e23, @local}, 0x10) write$binfmt_elf64(r0, &(0x7f0000000100)=ANY=[@ANYRES32, @ANYRES16=0x0], 0x2bcf) shutdown(r0, 0x1) setsockopt$sock_timeval(r0, 0x1, 0x15, 0x0, 0x0) futex(&(0x7f0000000340)=0x1, 0x4, 0x0, 0x0, &(0x7f0000000400), 0x1) openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000440)='/selinux/enforce\x00', 0x0, 0x0) mmap(&(0x7f0000ffc000/0x2000)=nil, 0x2000, 0x0, 0x11, 0xffffffffffffffff, 0x0) pipe(&(0x7f0000000480)={0xffffffffffffffff, 0xffffffffffffffff}) write(r4, &(0x7f0000000340), 0x41395527) ioctl$KDSETLED(r4, 0x4b32, 0x0) recvmsg(r0, &(0x7f0000001440)={0x0, 0xa, &(0x7f00000015c0)=[{&(0x7f0000001600)=""/4096, 0xf99e}], 0x1, 0x0, 0xff96ce4aaaa47475, 0x7115}, 0x100) r5 = creat(&(0x7f0000000040)='./bus\x00', 0x0) ftruncate(r5, 0x2081ff) r6 = open(&(0x7f00000006c0)='./bus\x00', 0x0, 0x0) sendfile(r5, r6, 0x0, 0x8000fffffffa) syz_genetlink_get_family_id$ipvs(&(0x7f00000002c0)='IPVS\x00') 16:21:04 executing program 5: r0 = syz_open_dev$binder(0x0, 0x0, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) r2 = dup2(r1, r0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000380)=ANY=[@ANYBLOB="04630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000300)={0x8, 0x0, &(0x7f00000004c0)=[@acquire={0x40046304}], 0x0, 0x0, 0x0}) 16:21:04 executing program 4: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) openat$urandom(0xffffffffffffff9c, &(0x7f0000000100)='/dev/urandom\x00', 0x501200, 0x0) pipe(&(0x7f0000000480)={0xffffffffffffffff}) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) clock_settime(0x8, &(0x7f0000000080)={0x0, 0x989680}) ioctl$PPPIOCDISCONN(r2, 0x7439) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0xf) fcntl$setflags(r1, 0x2, 0xe15231d313d1892c) 16:21:04 executing program 2: r0 = syz_open_procfs(0x0, &(0x7f0000000080)='net/dev_snmp6\x00') socket(0x10, 0x80002, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) socket$nl_generic(0x10, 0x3, 0x10) syz_open_procfs(0x0, &(0x7f0000000980)='net/sofH\x16tnet_sua') socket$inet6_tcp(0xa, 0x1, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) request_key(&(0x7f0000000000)='user\x00', &(0x7f0000000040)={'syz'}, &(0x7f0000000a80), 0xfffffffffffffffd) socket$inet(0x2, 0x4000000000000001, 0x0) perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x1ee6b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000000c0)={0xeb, 0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB="0563044000000000046304400000000006630440000000007997506ea39438033ada635f7cd4c9d1de50cf51e7a773b356e7348d3b19cbdc76ed97a6a08da8997815ea9e6d3b6a1d5a7c1cdf78337a6166cfd70cf41b6cb958e69b7dae4fe74a09c8e4db4c323ba219438b49c2f1736eb01b18c098512160aad1c0394bd4c9b785ea39e6f5b1f809658351bcb5f101899004e6a8542081ceec87f1a675538ce9264c7f128392c875c23507fc8a694ef2d13b127563b2da420a3df952f062dd3d46202a3466fa9a9c985dde3cc577a1fdf40687931bbc4303dbab0e28bb6757bc226d9bba4db1603de1a9c7"], 0x1, 0x0, &(0x7f00000003c0)='L'}) r2 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r2, 0x40045431, &(0x7f00000000c0)) r3 = syz_open_pts(r2, 0x0) r4 = dup3(r3, r0, 0x0) ioctl$TCXONC(r4, 0x540a, 0x0) pselect6(0x40, &(0x7f0000000340)={0x9}, 0x0, 0x0, 0x0, 0x0) 16:21:04 executing program 3: socket$inet_udplite(0x2, 0x2, 0x88) pipe(&(0x7f0000000480)={0xffffffffffffffff, 0xffffffffffffffff}) write(r0, &(0x7f0000000340), 0x41395527) ioctl(r0, 0x1, &(0x7f00000003c0)="11dca50d5e0bcfe47bf070") r1 = openat$pfkey(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/net/pfkey\x00', 0x20000, 0x0) setsockopt$IP_VS_SO_SET_DELDEST(r1, 0x0, 0x488, &(0x7f0000000040)={{0x87, @empty, 0x4e22, 0x0, 'lblc\x00', 0x14, 0x8}, {@loopback, 0x4e22, 0x1, 0xd38, 0x40, 0x302b}}, 0x44) epoll_create(0x5) r2 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r2, &(0x7f0000000100)={0x2, 0x4e20}, 0x10) connect$inet(r2, &(0x7f0000000cc0)={0x2, 0x4e20, @local}, 0x10) setsockopt$SO_TIMESTAMPING(r2, 0x1, 0x41, &(0x7f00000010c0)=0x19ff, 0x1) sendto$inet(r2, &(0x7f0000000140)="b0", 0x1, 0x0, 0x0, 0x0) recvmmsg(r2, &(0x7f0000003b40)=[{{0x0, 0x0, 0x0}}], 0x1, 0x2000, 0x0) r3 = openat$full(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/full\x00', 0x460042, 0x0) getpeername$inet(r3, &(0x7f0000000180)={0x2, 0x0, @loopback}, &(0x7f00000001c0)=0x10) 16:21:04 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) r2 = dup2(r1, r0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000380)=ANY=[@ANYBLOB="04630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000300)={0x8, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="046304400000006bdf41761bd400"], 0xb19b868c1a8b328c, 0x0, 0x0}) 16:21:04 executing program 5: r0 = syz_open_dev$binder(0x0, 0x0, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) r2 = dup2(r1, r0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000380)=ANY=[@ANYBLOB="04630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000300)={0x8, 0x0, &(0x7f00000004c0)=[@acquire={0x40046304}], 0x0, 0x0, 0x0}) 16:21:04 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) r1 = openat$selinux_avc_cache_stats(0xffffffffffffff9c, &(0x7f0000000040)='/selinux/avc/cache_stats\x00', 0x0, 0x0) sendmsg$IPVS_CMD_SET_DEST(r1, &(0x7f0000000100)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x8000800}, 0xc, &(0x7f00000000c0)={&(0x7f0000000180)={0xc0, 0x0, 0x100, 0x70bd2d, 0x25dfdbfd, {}, [@IPVS_CMD_ATTR_DEST={0xc, 0x2, [@IPVS_DEST_ATTR_TUN_TYPE={0x8, 0xd, 0x2}]}, @IPVS_CMD_ATTR_DEST={0x1c, 0x2, [@IPVS_DEST_ATTR_ADDR_FAMILY={0x8, 0xb, 0xa}, @IPVS_DEST_ATTR_ACTIVE_CONNS={0x8, 0x7, 0x1}, @IPVS_DEST_ATTR_U_THRESH={0x8, 0x5, 0x100}]}, @IPVS_CMD_ATTR_SERVICE={0x38, 0x1, [@IPVS_SVC_ATTR_FLAGS={0xc, 0x7, {0x1, 0xa}}, @IPVS_SVC_ATTR_AF={0x8, 0x1, 0xa}, @IPVS_SVC_ATTR_PE_NAME={0x8, 0xb, 'sip\x00'}, @IPVS_SVC_ATTR_NETMASK={0x8, 0x9, 0x18}, @IPVS_SVC_ATTR_AF={0x8, 0x1, 0xa}, @IPVS_SVC_ATTR_PE_NAME={0x8, 0xb, 'sip\x00'}]}, @IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0x2}, @IPVS_CMD_ATTR_SERVICE={0x30, 0x1, [@IPVS_SVC_ATTR_AF={0x8, 0x1, 0xa}, @IPVS_SVC_ATTR_PORT={0x8, 0x4, 0x4e24}, @IPVS_SVC_ATTR_SCHED_NAME={0x8, 0x6, 'dh\x00'}, @IPVS_SVC_ATTR_ADDR={0x14, 0x3, @ipv6=@dev={0xfe, 0x80, [], 0x12}}]}, @IPVS_CMD_ATTR_DEST={0xc, 0x2, [@IPVS_DEST_ATTR_PERSIST_CONNS={0x8, 0x9, 0x6}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x3}]}, 0xc0}, 0x1, 0x0, 0x0, 0x2000c001}, 0x4000) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) r3 = dup2(r2, r0) ioctl$BINDER_SET_CONTEXT_MGR(r3, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000380)=ANY=[@ANYBLOB="04630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000300)={0x8, 0x0, &(0x7f00000004c0)=ANY=[@ANYBLOB="dac69b8ea5da5748"], 0xb19b868c1a8b328c, 0x0, 0x0}) pipe(&(0x7f0000000480)={0xffffffffffffffff, 0xffffffffffffffff}) write(r4, &(0x7f0000000340), 0x41395527) ioctl$UI_SET_LEDBIT(r4, 0x40045569, 0xb) 16:21:04 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) r2 = dup2(0xffffffffffffffff, r0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000380)=ANY=[@ANYBLOB="04630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000300)={0x8, 0x0, &(0x7f00000004c0)=[@acquire={0x40046304}], 0x0, 0x0, 0x0}) [ 1774.732379] binder: 11404:11407 IncRefs 0 refcount change on invalid ref 1795162112 ret -22 [ 1774.747528] binder: 11402:11405 Acquire 1 refcount change on invalid ref 0 ret -22 [ 1774.756515] binder: 11404:11407 ioctl c0306201 20000300 returned -14 [ 1774.812511] binder: 11402:11405 IncRefs 0 refcount change on invalid ref 0 ret -22 [ 1774.825422] binder: 11418:11421 unknown command -1902393638 [ 1774.825434] binder: 11418:11421 ioctl c0306201 20000300 returned -22 [ 1774.828508] binder: 11420:11422 IncRefs 0 refcount change on invalid ref 0 ret -22 [ 1774.849637] binder: 11420:11422 IncRefs 0 refcount change on invalid ref 0 ret -22 16:21:04 executing program 1: setxattr$security_evm(&(0x7f0000000080)='./file0\x00', 0x0, 0x0, 0x0, 0x0) recvmmsg(0xffffffffffffffff, 0x0, 0x0, 0x40, &(0x7f00000077c0)) r0 = socket$inet(0x2, 0x4000000000000001, 0x0) ioctl$sock_inet_SIOCDARP(r0, 0x8953, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x80000000000002, &(0x7f0000000300)=0x80, 0x4) bind$inet(r0, &(0x7f0000000000)={0x2, 0x4e23, @broadcast}, 0x10) r1 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0xe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) getsockopt$sock_cred(r0, 0x1, 0x11, 0x0, &(0x7f0000000a00)) fstat(r1, &(0x7f00000004c0)) clock_getres(0x5, &(0x7f00000001c0)) lstat(&(0x7f0000000740)='./file0\x00', &(0x7f0000000780)) setsockopt$inet_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f0000000040)='bbr\x00', 0x4) r2 = open(&(0x7f00000000c0)='./file0\x00', 0x400, 0x50) r3 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000380)='IPVS\x00') sendmsg$IPVS_CMD_DEL_DEST(0xffffffffffffffff, &(0x7f00000004c0)={0x0, 0x0, &(0x7f0000000480)={&(0x7f0000000780)=ANY=[@ANYBLOB="576e77206e671f2e47eb1d3e3605946eb97dfc8bd41bf208b00a92389a14ea62227dff79e45a801605bdf3d603bbca46cf177d80be25a7011fd46bd0914c3d297395d4662e61ee4caa4d900753c62a97bad3b3d1055cd1d8afa127774c9d07f6516f15f86128f8cd6fdd810300d96549996d7565b19505666740be5bf1a0080024408f255775bc5e6341387ac33f7b63c90eb787a12e035667f5ff892f4400"/180, @ANYRES16=r3, @ANYBLOB="00022bbd7000ffdbdf2507000000ff139c470ae354f47540ee0b0400020004000100080001000a00000008000500020000000c00020008000b003a4b004008000500030000002400020008000b000200a50c067bd87df74268f6bc6699280000080004004e0000000800070007000000080006000900000008000600090000002000030008000500ac1e0101"], 0x3}, 0x1, 0x0, 0x0, 0x4000000}, 0x880) sendmsg$IPVS_CMD_DEL_DAEMON(r2, &(0x7f0000000240)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0xe6000900}, 0xc, &(0x7f0000000200)={&(0x7f0000000600)=ANY=[@ANYBLOB="24000000fca59c3da116ad063c75b07ac7c9d1e45fc38c80ba0ae074a2c31cd765ef2df9a5c111f6daa5ba5a1a9960fc98d449ff7a2856d0033ed95189f860c373487f9932510540d99aff79c366c215f29b", @ANYRES16=r3, @ANYBLOB="0000000800060008000000081150e91d8ca0c3784d000000a66cc955d51029532e88ee25e86ae059a94ba864e45501658505668196f9f885e266098826f0e521d1aff763c3fccaf8e42c83edec9823fb82491ded5353283f901575e05999ab"], 0x24}, 0x1, 0x0, 0x0, 0x1}, 0x0) sendto$inet(r0, 0x0, 0x0, 0x200007fd, &(0x7f0000e68000)={0x2, 0x4e23, @local}, 0x10) write$binfmt_elf64(r0, &(0x7f0000000100)=ANY=[@ANYRES32, @ANYRES16=0x0], 0x2bcf) shutdown(r0, 0x1) setsockopt$sock_timeval(r0, 0x1, 0x15, 0x0, 0x0) futex(&(0x7f0000000340)=0x1, 0x4, 0x0, 0x0, &(0x7f0000000400), 0x1) openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000440)='/selinux/enforce\x00', 0x0, 0x0) mmap(&(0x7f0000ffc000/0x2000)=nil, 0x2000, 0x0, 0x11, 0xffffffffffffffff, 0x0) pipe(&(0x7f0000000480)={0xffffffffffffffff, 0xffffffffffffffff}) write(r4, &(0x7f0000000340), 0x41395527) ioctl$KDSETLED(r4, 0x4b32, 0x0) recvmsg(r0, &(0x7f0000001440)={0x0, 0xa, &(0x7f00000015c0)=[{&(0x7f0000001600)=""/4096, 0xf99e}], 0x1, 0x0, 0xff96ce4aaaa47475, 0x7115}, 0x100) r5 = creat(&(0x7f0000000040)='./bus\x00', 0x0) ftruncate(r5, 0x2081ff) r6 = open(&(0x7f00000006c0)='./bus\x00', 0x0, 0x0) sendfile(r5, r6, 0x0, 0x8000fffffffa) syz_genetlink_get_family_id$ipvs(&(0x7f00000002c0)='IPVS\x00') 16:21:04 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) r2 = dup2(0xffffffffffffffff, r0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000380)=ANY=[@ANYBLOB="04630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000300)={0x8, 0x0, &(0x7f00000004c0)=[@acquire={0x40046304}], 0x0, 0x0, 0x0}) [ 1774.853158] binder: 11402:11405 Release 1 refcount change on invalid ref 0 ret -22 [ 1774.869065] binder: 11402:11405 unknown command 1850775417 [ 1774.875935] binder: 11402:11405 ioctl c0306201 200000c0 returned -22 16:21:04 executing program 1: setxattr$security_evm(&(0x7f0000000080)='./file0\x00', 0x0, 0x0, 0x0, 0x0) recvmmsg(0xffffffffffffffff, 0x0, 0x0, 0x40, &(0x7f00000077c0)) r0 = socket$inet(0x2, 0x4000000000000001, 0x0) ioctl$sock_inet_SIOCDARP(r0, 0x8953, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x80000000000002, &(0x7f0000000300)=0x80, 0x4) bind$inet(r0, &(0x7f0000000000)={0x2, 0x4e23, @broadcast}, 0x10) r1 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0xe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) getsockopt$sock_cred(r0, 0x1, 0x11, 0x0, &(0x7f0000000a00)) fstat(r1, &(0x7f00000004c0)) clock_getres(0x5, &(0x7f00000001c0)) lstat(&(0x7f0000000740)='./file0\x00', &(0x7f0000000780)) setsockopt$inet_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f0000000040)='bbr\x00', 0x4) r2 = open(&(0x7f00000000c0)='./file0\x00', 0x400, 0x50) r3 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000380)='IPVS\x00') sendmsg$IPVS_CMD_DEL_DEST(0xffffffffffffffff, &(0x7f00000004c0)={0x0, 0x0, &(0x7f0000000480)={&(0x7f0000000780)=ANY=[@ANYBLOB="576e77206e671f2e47eb1d3e3605946eb97dfc8bd41bf208b00a92389a14ea62227dff79e45a801605bdf3d603bbca46cf177d80be25a7011fd46bd0914c3d297395d4662e61ee4caa4d900753c62a97bad3b3d1055cd1d8afa127774c9d07f6516f15f86128f8cd6fdd810300d96549996d7565b19505666740be5bf1a0080024408f255775bc5e6341387ac33f7b63c90eb787a12e035667f5ff892f4400"/180, @ANYRES16=r3, @ANYBLOB="00022bbd7000ffdbdf2507000000ff139c470ae354f47540ee0b0400020004000100080001000a00000008000500020000000c00020008000b003a4b004008000500030000002400020008000b000200a50c067bd87df74268f6bc6699280000080004004e0000000800070007000000080006000900000008000600090000002000030008000500ac1e0101"], 0x3}, 0x1, 0x0, 0x0, 0x4000000}, 0x880) sendmsg$IPVS_CMD_DEL_DAEMON(r2, &(0x7f0000000240)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0xe6000900}, 0xc, &(0x7f0000000200)={&(0x7f0000000600)=ANY=[@ANYBLOB="24000000fca59c3da116ad063c75b07ac7c9d1e45fc38c80ba0ae074a2c31cd765ef2df9a5c111f6daa5ba5a1a9960fc98d449ff7a2856d0033ed95189f860c373487f9932510540d99aff79c366c215f29b", @ANYRES16=r3, @ANYBLOB="0000000800060008000000081150e91d8ca0c3784d000000a66cc955d51029532e88ee25e86ae059a94ba864e45501658505668196f9f885e266098826f0e521d1aff763c3fccaf8e42c83edec9823fb82491ded5353283f901575e05999ab"], 0x24}, 0x1, 0x0, 0x0, 0x1}, 0x0) sendto$inet(r0, 0x0, 0x0, 0x200007fd, &(0x7f0000e68000)={0x2, 0x4e23, @local}, 0x10) write$binfmt_elf64(r0, &(0x7f0000000100)=ANY=[@ANYRES32, @ANYRES16=0x0], 0x2bcf) shutdown(r0, 0x1) setsockopt$sock_timeval(r0, 0x1, 0x15, 0x0, 0x0) futex(&(0x7f0000000340)=0x1, 0x4, 0x0, 0x0, &(0x7f0000000400), 0x1) openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000440)='/selinux/enforce\x00', 0x0, 0x0) mmap(&(0x7f0000ffc000/0x2000)=nil, 0x2000, 0x0, 0x11, 0xffffffffffffffff, 0x0) pipe(&(0x7f0000000480)={0xffffffffffffffff, 0xffffffffffffffff}) write(r4, &(0x7f0000000340), 0x41395527) ioctl$KDSETLED(r4, 0x4b32, 0x0) recvmsg(r0, &(0x7f0000001440)={0x0, 0xa, &(0x7f00000015c0)=[{&(0x7f0000001600)=""/4096, 0xf99e}], 0x1, 0x0, 0xff96ce4aaaa47475, 0x7115}, 0x100) r5 = creat(&(0x7f0000000040)='./bus\x00', 0x0) ftruncate(r5, 0x2081ff) r6 = open(&(0x7f00000006c0)='./bus\x00', 0x0, 0x0) sendfile(r5, r6, 0x0, 0x8000fffffffa) syz_genetlink_get_family_id$ipvs(&(0x7f00000002c0)='IPVS\x00') [ 1774.937071] binder: 11402:11416 Acquire 1 refcount change on invalid ref 0 ret -22 [ 1774.963762] binder: 11402:11416 IncRefs 0 refcount change on invalid ref 0 ret -22 [ 1774.978024] binder: 11427:11429 IncRefs 0 refcount change on invalid ref 0 ret -22 16:21:04 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) r2 = dup2(0xffffffffffffffff, r0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000380)=ANY=[@ANYBLOB="04630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000300)={0x8, 0x0, &(0x7f00000004c0)=[@acquire={0x40046304}], 0x0, 0x0, 0x0}) [ 1774.990336] binder: 11402:11416 Release 1 refcount change on invalid ref 0 ret -22 [ 1774.998668] binder: 11427:11429 IncRefs 0 refcount change on invalid ref 0 ret -22 [ 1775.007663] binder: 11402:11416 unknown command 1850775417 [ 1775.024971] binder: 11402:11416 ioctl c0306201 200000c0 returned -22 16:21:04 executing program 2: r0 = syz_open_procfs(0x0, &(0x7f0000000080)='net/dev_snmp6\x00') r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r1, 0x40045431, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, 0x0, 0x7}) r2 = syz_open_pts(r1, 0x0) r3 = dup3(r2, r0, 0x0) ioctl$TCXONC(r3, 0x540a, 0x0) pselect6(0x40, &(0x7f0000000340)={0x9}, 0x0, 0x0, 0x0, 0x0) [ 1775.077976] binder: 11432:11433 IncRefs 0 refcount change on invalid ref 0 ret -22 [ 1775.100646] binder: 11432:11433 IncRefs 0 refcount change on invalid ref 0 ret -22 16:21:05 executing program 4: pipe(&(0x7f0000000480)={0xffffffffffffffff}) vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) ioctl$UI_SET_ABSBIT(r0, 0x40045567, 0x2) r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000000040)=0xf) 16:21:05 executing program 2: r0 = syz_open_procfs(0x0, &(0x7f0000000080)='net/dev_snmp6\x00') r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r1, 0x40045431, &(0x7f00000000c0)) r2 = syz_open_pts(r1, 0x0) r3 = dup3(r2, r0, 0x0) r4 = openat$selinux_avc_hash_stats(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/avc/hash_stats\x00', 0x0, 0x0) ioctl$PIO_FONTX(r4, 0x4b6c, &(0x7f0000000100)="13acb4d659e538495e9068c1e378823bd888be399dae7cbeade371c740a99c9a02ee25cbd9072930c53fa12d1cdbd4602c5663b11b89abdc51a1e4427960ee9c3bd9521afa6413022c9103b8af46efb72c1ec48dc2ba8ba22d164ccec79bb02240857f5c2061ededb05be07ae71403524d37b0a1495e6986ddad477d18128dc4b08dfbba180a2c5cae4aab8dc16dfeb8c05d9f1b05bb2f9d6aece26dd14bed1f4da0eee82523c4934105fe46361003") ioctl$TCXONC(r3, 0x540a, 0x0) pselect6(0x40, &(0x7f0000000340)={0x0, 0x0, 0x7, 0x0, 0x0, 0x3, 0x0, 0x1}, 0x0, 0x0, 0x0, 0x0) 16:21:05 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) r2 = dup2(r1, 0xffffffffffffffff) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000380)=ANY=[@ANYBLOB="04630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000300)={0x8, 0x0, &(0x7f00000004c0)=[@acquire={0x40046304}], 0x0, 0x0, 0x0}) 16:21:05 executing program 3: pipe(&(0x7f0000000480)={0xffffffffffffffff, 0xffffffffffffffff}) write(r0, &(0x7f0000000340), 0x41395527) write$P9_RVERSION(r0, &(0x7f0000000000)={0x13, 0x65, 0xffff, 0xfffffffffffffff8, 0x6, '9P2000'}, 0x13) socket$inet_udplite(0x2, 0x2, 0x88) r1 = socket$inet6_udplite(0xa, 0x2, 0x88) ioctl(r1, 0x1000008911, &(0x7f0000000180)="68ea6b81d4ac216cfe82e9909ceea2798f724a09d569a1749921e89be467be7f9271b68e4e48d1822b67a132a448ba36a6e2f4b0d448a85cde45d5901138cb1f83af5d50eb42a93536f6baa55d05fca5801b263a97226abee51835b5144e63512dcc46a9df97e3e573802bf0da32fd5d1bd35191c8aa53b912ea01f0abeaa8995ee56fbb1f5931cbe472996ff3eef7eeaf5744990781cf8098a98f6265e7e2d3fe115d10997accc75889d13a0bd7bc4600000000000000000000f8cf5640041d974639dc6e2da1342f309b1b86564bf9e88bfc66a5d01b8f874ca6e6d56aa580f25481c7c84ba9bfa3328d9aee9408acedbf523a") openat$selinux_checkreqprot(0xffffffffffffff9c, &(0x7f0000000040)='/selinux/checkreqprot\x00', 0x381000, 0x0) r2 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r2, &(0x7f0000000100)={0x2, 0x4e20}, 0x10) connect$inet(r2, &(0x7f0000000cc0)={0x2, 0x4e20, @local}, 0x10) setsockopt$SO_TIMESTAMPING(r2, 0x1, 0x25, &(0x7f00000010c0)=0x19ff, 0x4) sendto$inet(r2, &(0x7f0000000140)="b0", 0x1, 0x0, 0x0, 0x0) recvmmsg(r2, &(0x7f0000003b40)=[{{0x0, 0x0, 0x0}}], 0x1, 0x2000, 0x0) 16:21:05 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) r2 = dup2(r1, 0xffffffffffffffff) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000380)=ANY=[@ANYBLOB="04630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000300)={0x8, 0x0, &(0x7f00000004c0)=[@acquire={0x40046304}], 0x0, 0x0, 0x0}) [ 1775.578725] binder: 11442:11446 IncRefs 0 refcount change on invalid ref 0 ret -22 [ 1775.591716] binder: 11442:11446 IncRefs 0 refcount change on invalid ref 0 ret -22 16:21:05 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) r2 = dup2(r1, r0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000380)=ANY=[@ANYBLOB="04630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000300)={0x8, 0x0, &(0x7f00000004c0)=[@acquire={0x40046304}], 0xb19b868c1a8b328c, 0x0, 0x0}) 16:21:05 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) r2 = dup2(r1, r0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) r3 = openat$zero(0xffffffffffffff9c, &(0x7f0000000040)='/dev/zero\x00', 0x100000, 0x0) r4 = getpid() waitid(0x0, r4, &(0x7f00000000c0), 0x1, &(0x7f0000000180)) ioctl$PPPIOCNEWUNIT(r3, 0xc004743e, &(0x7f0000000080)) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000380)=ANY=[@ANYBLOB="04630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000300)={0x8, 0x0, &(0x7f00000004c0)=[@acquire={0x40046304}], 0xb19b868c1a8b328c, 0x0, 0x0}) 16:21:05 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) r2 = dup2(r1, 0xffffffffffffffff) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000380)=ANY=[@ANYBLOB="04630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000300)={0x8, 0x0, &(0x7f00000004c0)=[@acquire={0x40046304}], 0x0, 0x0, 0x0}) [ 1775.676293] binder: 11455:11457 IncRefs 0 refcount change on invalid ref 0 ret -22 [ 1775.681585] binder: 11456:11459 ioctl c0306201 20000300 returned -14 [ 1775.686892] binder: 11455:11457 IncRefs 0 refcount change on invalid ref 0 ret -22 16:21:05 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) pipe(&(0x7f0000000480)={0xffffffffffffffff}) vmsplice(r1, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) ioctl$sock_inet_tcp_SIOCATMARK(r1, 0x8905, &(0x7f0000000080)) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) pipe(&(0x7f0000000480)={0xffffffffffffffff, 0xffffffffffffffff}) write(r3, &(0x7f0000000340), 0x41395527) accept4$packet(r3, &(0x7f00000000c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000100)=0x14, 0x1c1000) r4 = bpf$PROG_LOAD(0x5, &(0x7f0000000400)={0x15, 0x1, &(0x7f0000000180)=@raw=[@generic={0x2, 0x686, 0x8, 0x5}], &(0x7f00000001c0)='GPL\x00', 0x4, 0xd8, &(0x7f0000000200)=""/216, 0x40f00, 0x1, [], 0x0, 0x16, 0xffffffffffffffff, 0x8, &(0x7f00000009c0)={0x9, 0x1}, 0x8, 0x10, &(0x7f00000003c0)={0x3, 0xf, 0x1, 0x2}, 0x10}, 0x70) r5 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r5, 0x40045431, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1}) syz_open_pts(r5, 0x0) r6 = dup2(r4, r5) ioctl$FS_IOC_FSGETXATTR(r2, 0x801c581f, &(0x7f0000000040)={0x4, 0xffffffffffffffe1, 0x8, 0x100, 0x113f78bc}) r7 = socket$nl_route(0x10, 0x3, 0x0) r8 = gettid() ptrace$setopts(0x4206, r8, 0x0, 0x0) tkill(r8, 0x3c) ptrace$cont(0x18, r8, 0x0, 0x0) ptrace$setregs(0xd, r8, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r8, 0x0, 0x0) r9 = socket(0x10, 0x2, 0x0) getsockopt$sock_cred(r9, 0x1, 0x11, &(0x7f0000caaffb)={0x0, 0x0}, &(0x7f0000cab000)=0xc) chown(&(0x7f00000001c0)='./file0\x00', r10, 0x0) getgroups(0x1, &(0x7f0000000880)=[0xffffffffffffffff]) r12 = gettid() ptrace$setopts(0x4206, r12, 0x0, 0x0) tkill(r12, 0x3c) ptrace$cont(0x18, r12, 0x0, 0x0) ptrace$setregs(0xd, r12, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r12, 0x0, 0x0) r13 = socket(0x10, 0x2, 0x0) getsockopt$sock_cred(r13, 0x1, 0x11, &(0x7f0000caaffb)={0x0, 0x0}, &(0x7f0000cab000)=0xc) chown(&(0x7f00000001c0)='./file0\x00', r14, 0x0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f00000008c0)={0x0, 0x0, 0x0}, &(0x7f0000000900)=0xc) sendmsg$netlink(r7, &(0x7f0000000980)={&(0x7f0000000500)=@kern={0x10, 0x0, 0x0, 0xc0000269}, 0xc, &(0x7f0000000840)=[{&(0x7f0000000540)={0x28c, 0x2c, 0x4, 0x70bd2a, 0x25dfdbfb, "", [@generic="83246e07232d84ed07755daa51e1597f29e0cc899ed20c8ca7b307473640da3a8c4524b49f6acfee1cfd1c26424cca3f28ce6ec8ad25994de77220acc536cf20bfbcb65684b379b96d5b43592cd58c8c9b3a526b5453920f377d71a03ba0e4a640fd3b6e3a26349235c59cd7713e9176d9c421fc6d188be0b019c7fd2e85e1777843d4eb30b5ff1e3bb2c35edbf3f22acab7c580e074e984d6263468bbd90ce48311228b3f5553c7f26f163f63f21f267962719ca0b8ff84943d64f97a02625527f9018a42b0f5901da5947e66041a36d67f", @generic="e11199cfeda0896aa1a8480c7a115a329288ce40faa7016b97c45bb55dc9e8b62f7ec3d89a5f39df33a7080ff00e4ba614caeae3c5986d75021c1d7ca1b68f618d574406cf549de0c01ed673d04e3bb7ddb9ea7ea5e7d17e31caa59b9cd71473a40162c8b9", @generic="c9e7ce6d6fc807bbfb0ac18bcddbce04c26a4d6790473a6410450ddf8dcdae6db6620d7d278ddb6bb398ee3acc483c60d2e79abdae9a0c2f631e79164b82edaead889b2191dc02d67927f8772c2bfe72b3ff08b8b5e377b000ab5c2d03eed019e788bde5020d17d27484e4500e2bdc0f82b7a187591182", @generic="a57d51d63b556eaf7e8c60a655199317ee40e800c94ed3d5aba1df6b2016b15b7b17afeb7ef19daf5f46cb88591e24c57ab7eae6266a12799ebfd4045018e3d3e2e9dd18d39dbf24c8caa2509aaefa05dd0b54b87aeeff789c1f668fe9367aaa9383ed885b91a16d48bae2fe9b6debc20747850c6e4fe946cd07e9cac913e31a6af0195e20cc46e4b197f3dc46de8a5c5d9d011d7f27ca694e1325ab6c5af543e190f40d154bd295ed71d6976a67e9fe4d823c371e90c6358ced4ab12bad774040a241137e7d3b0d74dfe26239"]}, 0x28c}, {&(0x7f0000000800)={0x10, 0x37, 0x306, 0x70bd26, 0x25dfdbfb, "", [@generic]}, 0x10}], 0x2, &(0x7f0000000940)=[@cred={{0x1c, 0x1, 0x2, {r8, r10, r11}}}, @cred={{0x1c, 0x1, 0x2, {r12, r14, r15}}}], 0x40, 0x1}, 0x10) ioctl$BINDER_SET_CONTEXT_MGR(r6, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000380)=ANY=[@ANYBLOB="04630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000300)={0x8, 0x0, &(0x7f00000004c0)=[@acquire={0x40046304}], 0xb19b868c1a8b328c, 0x0, 0x0}) [ 1775.730661] binder: 11462:11464 ioctl c0306201 20000300 returned -14 [ 1775.748567] binder: 11466:11468 IncRefs 0 refcount change on invalid ref 0 ret -22 [ 1775.764983] binder: 11466:11468 IncRefs 0 refcount change on invalid ref 0 ret -22 16:21:08 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) pipe(&(0x7f0000000480)={0xffffffffffffffff, 0xffffffffffffffff}) write(r2, &(0x7f0000000340), 0x41395527) pipe(&(0x7f0000000480)={0xffffffffffffffff}) vmsplice(r3, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) accept$inet6(r3, &(0x7f0000000100)={0xa, 0x0, 0x0, @loopback}, &(0x7f0000000180)=0x1c) openat$selinux_enforce(0xffffffffffffff9c, &(0x7f00000001c0)='/selinux/enforce\x00', 0x0, 0x0) r4 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r4, 0x40045431, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1}) syz_open_pts(r4, 0x0) r5 = socket$inet6_udp(0xa, 0x2, 0x0) r6 = dup2(r1, r5) r7 = openat$rtc(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/rtc0\x00', 0x40, 0x0) write$binfmt_elf32(r7, &(0x7f0000000500)={{0x7f, 0x45, 0x4c, 0x46, 0x4, 0x8, 0xfffffffffffff801, 0x4, 0x4, 0x3, 0xd7ffeacc66cbc93a, 0x1f, 0xaa, 0x38, 0x248, 0x0, 0x0, 0x20, 0x1, 0x100000000, 0x80000000, 0x9}, [{0x6, 0x40, 0xff, 0x1, 0x2, 0x1f, 0x10000, 0x8}], "1838ffa169c98f7bf086a12cd72feff921c869d32e3f8e024d2963cae587ef2c45fc79a94b83a7b923d74f47db67aff7db78a7a749081f3d4f7a600fa80a773cd7128eef12b2fd16bee035da2d2375f4332aab8528105ff36476e5836f40a040e16f938e312230d34397ba2fa562653543dc", [[], [], [], [], [], [], [], [], []]}, 0x9ca) ioctl$BINDER_SET_CONTEXT_MGR(r6, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000380)=ANY=[@ANYBLOB="04630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000300)={0x8, 0x0, &(0x7f00000004c0)=[@acquire={0x40046304}], 0xb19b868c1a8b328c, 0x0, 0x0}) r8 = openat$null(0xffffffffffffff9c, &(0x7f0000000040)='/dev/null\x00', 0x40181, 0x0) connect$inet(r8, &(0x7f0000000080)={0x2, 0x4e21, @multicast2}, 0x10) 16:21:08 executing program 1: r0 = syz_open_procfs(0x0, &(0x7f0000000080)='net/dev_snmp6\x00') socket(0x10, 0x80002, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) socket$nl_generic(0x10, 0x3, 0x10) syz_open_procfs(0x0, &(0x7f0000000980)='net/sofH\x16tnet_sua') socket$inet6_tcp(0xa, 0x1, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) request_key(&(0x7f0000000000)='user\x00', &(0x7f0000000040)={'syz'}, &(0x7f0000000a80), 0xfffffffffffffffd) socket$inet(0x2, 0x4000000000000001, 0x0) perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x1ee6b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000000c0)={0xeb, 0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB="0563044000000000046304400000000006630440000000007997506ea39438033ada635f7cd4c9d1de50cf51e7a773b356e7348d3b19cbdc76ed97a6a08da8997815ea9e6d3b6a1d5a7c1cdf78337a6166cfd70cf41b6cb958e69b7dae4fe74a09c8e4db4c323ba219438b49c2f1736eb01b18c098512160aad1c0394bd4c9b785ea39e6f5b1f809658351bcb5f101899004e6a8542081ceec87f1a675538ce9264c7f128392c875c23507fc8a694ef2d13b127563b2da420a3df952f062dd3d46202a3466fa9a9c985dde3cc577a1fdf40687931bbc4303dbab0e28bb6757bc226d9bba4db1603de1a9c7"], 0x1, 0x0, &(0x7f00000003c0)='L'}) r2 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r2, 0x40045431, &(0x7f00000000c0)) r3 = syz_open_pts(r2, 0x0) r4 = dup3(r3, r0, 0x0) ioctl$TCXONC(r4, 0x540a, 0x0) pselect6(0x40, &(0x7f0000000340)={0x9}, 0x0, 0x0, 0x0, 0x0) 16:21:08 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) dup2(r1, r0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000380)=ANY=[@ANYBLOB="04630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000300)={0x8, 0x0, &(0x7f00000004c0)=[@acquire={0x40046304}], 0x0, 0x0, 0x0}) 16:21:08 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f00000003c0)="11dca50d5e0bcfe47bf070") open(&(0x7f00000000c0)='./file0\x00', 0xe5968fc84ebe6822, 0x2d1) epoll_create1(0x1ebf93cada39b7bc) r1 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r1, &(0x7f0000000100)={0x2, 0x4e20}, 0x10) setsockopt$SO_TIMESTAMPING(r1, 0x1, 0x25, &(0x7f00000010c0)=0x19ff, 0x4) pipe(&(0x7f0000000480)={0xffffffffffffffff}) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) r3 = syz_genetlink_get_family_id$tipc(&(0x7f0000000200)='TIPC\x00') sendmsg$TIPC_CMD_GET_BEARER_NAMES(r2, &(0x7f00000002c0)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x10010}, 0xc, &(0x7f0000000280)={&(0x7f0000000240)={0x1c, r3, 0x8, 0x70bd29, 0x25dfdbff, {}, ["", "", "", "", "", "", "", "", "", ""]}, 0x1c}, 0x1, 0x0, 0x0, 0x20011}, 0x8048008) openat$selinux_context(0xffffffffffffff9c, &(0x7f0000000080)='/selinux/context\x00', 0x2, 0x0) write$P9_RSYMLINK(0xffffffffffffffff, &(0x7f0000000180)={0x14, 0x11, 0x1, {0x2, 0x1, 0x4}}, 0x14) sendto$inet(r1, &(0x7f0000000140)="b0", 0x1, 0x0, 0x0, 0x0) setsockopt$SO_ATTACH_FILTER(r0, 0x1, 0x1a, &(0x7f0000000040)={0x5, &(0x7f0000000000)=[{0x7, 0x9, 0xad00000000000000, 0xd9d9}, {0x3, 0x1, 0x1ff, 0x5}, {0x2, 0x3, 0x0, 0xfffffffffffffffc}, {0x8000, 0xe4, 0x3, 0x4}, {0x7, 0x4, 0x5, 0x3}]}, 0x10) epoll_create1(0xc0000) recvmmsg(r1, &(0x7f0000003b40)=[{{0x0, 0x0, 0x0}}], 0x1, 0x2000, 0x0) 16:21:08 executing program 4: pipe(&(0x7f0000000480)={0xffffffffffffffff}) r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r1, 0x40045431, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1}) syz_open_pts(r1, 0x0) ioctl$FS_IOC_GETFSMAP(r1, 0xc0c0583b, &(0x7f00000004c0)={0x0, 0x0, 0x6, 0x0, [], [{0x9, 0x6, 0x0, 0x2, 0x9, 0x200}, {0x7fff, 0x2, 0x337, 0x7, 0xf5ad, 0x5}], [[], [], [], [], [], []]}) vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) ioctl$KDSKBMODE(r0, 0x4b45, &(0x7f0000000080)=0x4) r2 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000140)) pipe(&(0x7f0000000480)={0xffffffffffffffff}) r4 = socket$nl_route(0x10, 0x3, 0x0) ioctl$KDSETMODE(r3, 0x4b3a, 0x9) vmsplice(r4, &(0x7f0000000000)=[{&(0x7f0000000300)="e3bdc966733fe063bdd0688083e2c6120cf4572a9bb65ae8d0d99269ca79311715ce5a48c504f8a419364137f80665610659637b45ae486bbbcd3c83e45cffde6c76a9bcb5721d943f0f2516329b4bd16c2808a139fdf74f2730b4711deb0e078e9c58553bedc0f75155784b72d29c188606c292f664d8309b139e09e7a7e52c13254cecfda0e287ed46e6898b0672373bcfc692867375f59d9def162123000333562e2d57b2", 0xffffffffffffff81}], 0x205, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$TIOCSETD(r2, 0x5423, &(0x7f0000000040)=0xf) 16:21:08 executing program 2: r0 = gettid() ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x3c) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r0, 0x0, 0x0) getpgid(r0) r1 = gettid() ptrace$setopts(0x4206, r1, 0x0, 0x0) tkill(r1, 0x3c) ptrace$cont(0x18, r1, 0x0, 0x0) ptrace$setregs(0xd, r1, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r1, 0x0, 0x0) getpgrp(r1) r2 = fcntl$getown(0xffffffffffffffff, 0x9) r3 = syz_open_procfs(r2, &(0x7f0000000080)='statm\x00') pipe(&(0x7f0000000480)={0xffffffffffffffff}) vmsplice(r4, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) syz_open_pts(r4, 0x180a00) r5 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='\x00\x00\b\x00\x00\x00\x00\x12\x00', 0x2000, 0x0) ioctl$TCSETS(r5, 0x40045431, &(0x7f00000000c0)={0x0, 0x0, 0x8, 0x554c, 0x0, 0x0, 0x0, 0x0, 0x20, 0xfffffffffffffffd}) syz_open_pts(r5, 0x0) r6 = socket$inet6_udp(0xa, 0x2, 0x0) r7 = dup3(r6, r3, 0x0) ioctl$TCXONC(r7, 0x540a, 0x0) eventfd(0x8000) pselect6(0x40, &(0x7f0000000340)={0x9}, 0x0, 0x0, 0x0, 0x0) 16:21:08 executing program 2: r0 = syz_open_procfs(0x0, &(0x7f0000000080)='net/dev_snmp6\x00') r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ptmx\x00', 0x0, 0x0) getsockopt$inet_IP_IPSEC_POLICY(r0, 0x0, 0x10, &(0x7f0000000180)={{{@in6=@empty, @in=@loopback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@empty}}}, &(0x7f0000000280)=0xe8) r3 = getgid() getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f00000002c0)={0x0, 0x0, 0x0}, &(0x7f0000000300)=0xc) r5 = socket$inet(0x2, 0x4000000000000001, 0x0) r6 = add_key$user(&(0x7f0000000400)='user\x00', &(0x7f0000000500)={'syz', 0x2}, &(0x7f0000000740)="adf1f298ac1bac9c3d6f3dd7088ea654b4d0c0216fd6039c9f3599f4eb90e9fa9662a65d09962ab7985f28190c268be092caad1a44a30b9cb7ffb74ba55a08d87a17b142b3767782e5b9dca7bf952e0c54fe24c41f7ec528036c0641a850e7e13bb3e1f8d628563930c484d5f4c7e6f57eb8210ae214170116934c7c4b9ecd38ebe379a4e370e6b036d4558d2c6a22f98bff9a1e6c0f32bd9fc1f1c2d3d42b351434a95544db8db01a6370828055e048246b9cca39ce36a812f2ce6975c8f20d8b1c156a842cc2ddce5ad756caa98ba0b4ceedb3f59dc50e2f832f77145425903391f84e4488e41d389923ee22c813923b0ddf78781242793b4a58b7d1b32f3c9e0e11f3ccd2bb9cb92364453a89cc9e9188cf075959f164daeb894937ef7ccfe675d841879bf5d9f41d427bee1a707fb5cdb87a369e7ad0778906f92d743ae9da5bd145c344ae748c41e4980816e6e5f30548125d8a8e78f08e742e876c3708db6934b9eadb446b7d406ded73d01f989936ca214b1c4cc24c741f9992e238a2d44fd9bdc474e11d3de5b86b97bb1468f0da8236c48e3dbe4925212dca23d462b8f87feefee83487ab429cb57aeb02c17e53ba39778e546ec827ffc5c0cc0ec0ddd876a0268ed27a1ffdd200d546ef1d9df96e0db747465df2e2ebdef50c907f5a23b0f23cefe866dc6a9e6e2fdb0e525ff5533e2bcb5df452e5601a840cca9fd0052ff1211276ec405e5816e41c010b242a63fa3b97b0a4d79fef738f263a16fbdb734fb11ef174bfd09709d8ebabe8e9b774c3a34d7f3146ead0cc4c6b329ec5ab3b4a58b40cf9f47199a794ccd89326d9e57d5d8faee65a21c34e49cb8994d6e69df42d0927cbe82e667cbd2ec0ecd89c8ba490ee78e4a11635587e5ccbb5fa3f93d3b776d4e522748e2bbf1dc2cb6d826a1d60d010981cf4305ec59f948f80a21c36ad3b10227825cde0c3f82f2960ddbc9e6dc31038f4b184440562cc3e74604b9162cec885324cfdf48da6c18c78fee359b53d8fe80e6b7a1d9fa37eda00179e517d9ef87c31486f184817051b7ff4421d016fad8728ce2d71435a102387084a9819b87c7858c267e1706455ee0a6dd069c057bb88df0fc7cddfd7298d273994e726fe747fffaff6b91d1bc6efe5e98f68ed762d20f8ee47ac5efd7bde79e106b84b886ab8cb69d8f3955ffd6eaca423b35d9a2d48444d296b5ac40877a137cdb150182c670abf67fdd8156a1a1da6eef74e1f6e01b771789d6b39fda761b0de124086c86d02e3912473efdc8082b3b9c97231464b6e286dbba0fa079d273ec82d620f459dda008d3975ac848794c9b47ac13bb401b1ed54544cfb010a929596a77ab12f8d78629ff81524fa66743e8197adaf9014fa51e590d6c54996dc52bca8cd965bcdcdc6d711d9b40b6fb5834e62e0ba5c41a25376393b1d79be14fee3400536f758c9c483a85d451b8f764241c2266e26449f588827ad7f2433c7810ef6f892d2da86b1109c14cef4c78796474b2f6d5c6761ea8debc6ad9a201395dbcc58d5dd098b965d76876d50dbd4cd1f3184a87cbd9d2c845d005ffece73dc9644c6d3876ea79c630d885ccf2ca10432094801bd0407f932f623132b66f690f59f163f942dd14f7a50881721e65ed674815fc0b70e57d2afdd90a58ea22cbefd117e7e2b3bbd08cf0287788d2e770cbc25bd10f5a0bf9d4fd604ff415b6e32bee283e8079c2f176911820de7d9a71d392796f396d0a4aebb1e54e1daf5a50712390e8294b288887da5ad9990b61846701c79de2f77c2fe259cb06e438b11d2b9fb9ef0dcd5666f3339326a46da9bd09d5004156eec0a4e09880a2a838fefc2d3a491eff358919d4c15ce6f0c9d32abdac334887be04601cfaf4092a8f4df25e8c4ea28ea8eb0d003d603ccc91a1555b2dc3b055c05d8b908a1d19890d7e31e6539e90021d57f040df5c2554d083c4345579c815c677d6e6a42e5b2e9f76635ec5908bd80bcb4fdb25012ea02104f86f9e31643608c1b18fcd94d04f59bc8658ebf09ca78837830c6453d8e143a474f715bacabc76f88e6742ac68fef2f6644bd0d3de978ff5f269b27ec6f1a5e025c2a0c01f1e9bf0ea7b4d54a80b4498a85307aad5f6098b335d22f0d31625ca95ed1856b55cd02dbf6431da0b536b7f5e073d22cbe7b09784f389a4935f5d854c64c7a3753f28dc2bac480343374d86f3278170233a3e74eaa461fad0590f8ce715981532203edaa762d23db1705e8efee53a85a8f5548a71d12a9644b025e782d88c87e46698ce1260a3ef37d8add19f895b712325e26ca5b6165e7ec28061925e18ca70f44c02d082cbb74e78915894a3a3de96f5ce3198d0b7e11d97a708dad811cc66424e1a741e979fdac0a15a62a5252b8f34deb23798f84469ddfc968e8961268868715affd8dc6a43b5c8716dd94372e331a6e0cebf4fd8696bc9133984e060efaee80f9921dbf3b18d510eff7fb414b961eba0e88f83dec6c66121ffe068f3a646eb86b631362d49cd38e1aa6704f0397908a0babf9cb962de4aec4b20530e2225e3ba7c8263d9a8a90640b12a9d0633eef22a42ccc478d1b0d1bf6a9590e0b9803479509c89b0187fb35ffe1aa6703e7d48c75281cdbbc6cce1e2e5f0bcd8689071747cdbac317a7d71430312927b95b1cd0fc15603da8395825aeb6499acc811e6974d4e46c8f6a7c17c8edc9727b9a68d65e7a1efb2b8085bbc0640e6fc56550a2e4e93d4b11bace5a9676716c44b1f2d5b2ab18ed45c6c71f6a58078d5814f925a52b1a601cd675c3e8ce218013895c071abcf2501cf24499cb5c3531b98a9b97dd762ed9af6f8d22c720f156c38eb7a27eabe22fa93d292497e8da1285ac223ad30a624542e2082f78adbe1059b2e7e6e831a850f0e9d71ade8c011cfbcb0718707fd6bf5b865c4af381bf431a5b22be6143ef12acb4e992c0361fabc14cfefeca590217c7416598a12623066e6b31b77c6839d6cc63e4a494d16616bcd0eab082b946bc90f324c3ffa131378b02937f677f6803f80d802cda7dac607aabe9df8bc19594711d12c85726ce4bcd6f686d13bbf391721f634b89216e1c947f88134c8b9df912306974a9140c68fe1badf8c0f693a197131846881f3ef0b3ae3ed3fbbde90b6acfa4e018000f1ac0b63bc4810690014d44dc8fe8ca5ac88f584a890f47786737a507cde305991ea0156db425e9f540b32ae01acf493db8bae8705fe46724dfdcb453cf4ee93b9305d29746b3628ea8e322ac70170ec02797e1c897e476f74d8b4d70eef872c4305015391304647c5c55171790e24188cd3e08db1b507f022b2b81c5d88abc776a41e0070c86c297ef832e548497a8b65e6bdc249c1a90ca0d72a0f2ff4b04206aad4c5bf55c7b84dde974a2e87504d2145aea3d3b478ebc028e88728b3e834d0f9f6ace8e0b570923b07e390971b035d9e4d1b6fd77db56f4196e55622c34897204690bfd3c69665a66e04f97d4b5e193f20632f5c57ab9aa496e274978b147f84bcf7e3be85bfa9245c2f55296619bdc9bdf1fb0986573206cc95ca47cb13cd663f82ea8042e42a3e8bc61c832f1745f83f1b8529d623406fa8184779141b58269adbd220afc546aa6a4d3be27567793a8fff83d71cec3ab7e59e5943f388ed3b1f3e8e254d6c6143fd0e63b4a2da47dbbebad178a323e2ccce33adeb1d4974c5cf6ab59c732afab6854a55cc165cefc17641bdb17e907d9d18b5dcc3155b8101153c30ccdc3e0bbf749bad08b4d201b35b564cb74323bdf6346bf956a3448ec6f7ca99f7e37a069b7771b32c15e2e0e5c9d6898e70e6ed0641516da2f95b7a34516883366b0b22358fd12e934934a4642ee1a8eb78225f74e8aa34e3906ed6d9585869a752e7db2b8c99a02c62512c1a435ae09fc7ef06caf578a4c7965ad684c044d336b8cf7e540cf14e6c6ebced155eb0c7b33a12754d451310adc3e5a737a31e978483004cc1a12c80c97cf316830a780b9dff407bf394b84ecbf37703849e3c37a4401d010f05be8cd5f9a011e2bfb7df829cc3efeb9479eca41e44c459329a0d2008073f156adfe0928ee8d5234cc568fc0ec128b5fbc23f445fcf8d4cfaeaacf3ea691ebfc7efc75dbf17d50f1d9eaa783c5116c086738b3434f7d71316fc96930f18f91f77ad6a2d6f30287f54b97f91f8062cbea7c4fa5ef38c970ef64aaef5a7ffdf2ffb999ae82e6f4227f69b2a3c330be24c34afc5eee54fdf8939ee4770a3b5f0f6cf07319530b1b4758d3c1ce2832300c3a2a54d9861335b12c72c3ba6105a1a1eae961fcfdae3e92390302c50ec28111549532411a505dd33b61e948e49afc8e3523e906c0bed14c7aad27aff202db4d3a415c41bedec87d37afe26915da864d812e9d1b4e5a140b1769935cdfb7223cd94d00657f9b70641759a481266b7026bb1a0fd0bbb643d0364b7b3d3535866d73db248f4bdd71f6fff2ef618b1556b92f337a4b4bbd8fa0d3c8ec1b9d01521044e1133bae69c52e44dabc3e7d4ad9503cefa382e0e7cd395dde86539c6f1d5b74315988766d3f5e7da0a45e2cce2ccb2090d8100abd35e0d40a3fc2d86258cf7d5d86cb033bf6057542768067a4ecb56e7e1b88ac0e7033adf86a59aa451ac2552b85de4e9bf88ac301733f05c99be883565d1637b522924f950aaac8cfd606b701c39192b55184a8c2366875c1e6d90e667f66d46596a0c155efa0ca09914a19d971220cad2b67d200489cdd70b59416d5442267d0a06cb2e6b8dfe7064736a40c7b1780fbc2600f659cffe8d79d620cee33c7504d6dc65023d4d8234ec04478ec25ec0e162abd0220c3c46e3901a0803be8bb5e7c45a19e7facce5593d48f04b4203983bbf5d9849742301d6e11436c2cae72d6af88f02ac1d3e50bbc489398dab9e5662d2c6062fdb187d30f607409723a817704bf742ad32f654a3e5a8c8743851e0d0391058f7eda7d686a4d544d7ad261bd818ce7df60e9f9467810f41da6315fd72a80a1a276619b4a39d7123d2ccd5bd15022edd65bfa93c068958564d2fb4c4f002512f6f9846529c6c1d5c051af467786d7d1ed5b66fa9834e6a9240bc56dbbd15d2a3ea6cdfadb2a19fd3b8df2c42e27f5833b93ce70ce0e7cf0bf6bafca369c82ccde75a119e589a7321f060979c5bf8dfc64112aabc269e8f1f83f304e17ae20a828396bb9721fdcf56861f2e5aae062a46b29cfb6c74a873ce2dc7da69a27fa7d5081e9c1a9dce056bea2cf6e9397c70d4317f322e73faaeb906c922e0e47149f4acf42f9517be203aea8aa759baafd63abdd3be6bc5a7cd34f2d01865fe8fbbe671935bb7ba1f889c0018fd0dc9ca365cd7b9a787fbb7a923661b681cb82b0d0c29b9e67431fc94de4c1291246a463dd8029cafd0a67954c4397b444c911aea08d7aba2661ec34b5153de3060a84e0f91d36bb5dc782953f32461cb3826d8b4d1364dccd9e84ea54273f93717c2b050b22a9ff773ff6ed6e29c06b406026b2b984aed2d43a6af6ff461c81e67f582ed161e92069e9bb8f5f33e3979b2f174336bf9a79a06ca842f75877a504b3ae4fe2fe18d936c2036af6cfda84ff93d64734a5b3c6ad267cde9e1127ffe4773a93ac640961d1c8f01285633ab9506956f8d772e017dbfa85a1b7dac433e27b7b0d64c31fa7654812c05bf0d395b98bc667ff836fa1a920bdfbfc0f38e96002a48a993e13e88a4e4f31fd3ee03b128bd17627fc10abb7e690fee7bfe5d38c305473da919581a9238cb361", 0xffc, 0xfffffffffffffffb) getsockopt$inet_IP_XFRM_POLICY(r5, 0x0, 0x11, &(0x7f0000000540)={{{@in6=@loopback, @in6=@ipv4={[], [], @broadcast}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@empty}, 0x0, @in6=@dev}}, &(0x7f0000000680)=0xe8) r8 = getgid() keyctl$chown(0x4, r6, r7, r8) getgroups(0x1, &(0x7f0000000340)=[r8]) r10 = socket$inet(0x2, 0x4000000000000001, 0x0) r11 = add_key$user(&(0x7f0000000400)='user\x00', &(0x7f0000000500)={'syz', 0x2}, &(0x7f0000000740)="adf1f298ac1bac9c3d6f3dd7088ea654b4d0c0216fd6039c9f3599f4eb90e9fa9662a65d09962ab7985f28190c268be092caad1a44a30b9cb7ffb74ba55a08d87a17b142b3767782e5b9dca7bf952e0c54fe24c41f7ec528036c0641a850e7e13bb3e1f8d628563930c484d5f4c7e6f57eb8210ae214170116934c7c4b9ecd38ebe379a4e370e6b036d4558d2c6a22f98bff9a1e6c0f32bd9fc1f1c2d3d42b351434a95544db8db01a6370828055e048246b9cca39ce36a812f2ce6975c8f20d8b1c156a842cc2ddce5ad756caa98ba0b4ceedb3f59dc50e2f832f77145425903391f84e4488e41d389923ee22c813923b0ddf78781242793b4a58b7d1b32f3c9e0e11f3ccd2bb9cb92364453a89cc9e9188cf075959f164daeb894937ef7ccfe675d841879bf5d9f41d427bee1a707fb5cdb87a369e7ad0778906f92d743ae9da5bd145c344ae748c41e4980816e6e5f30548125d8a8e78f08e742e876c3708db6934b9eadb446b7d406ded73d01f989936ca214b1c4cc24c741f9992e238a2d44fd9bdc474e11d3de5b86b97bb1468f0da8236c48e3dbe4925212dca23d462b8f87feefee83487ab429cb57aeb02c17e53ba39778e546ec827ffc5c0cc0ec0ddd876a0268ed27a1ffdd200d546ef1d9df96e0db747465df2e2ebdef50c907f5a23b0f23cefe866dc6a9e6e2fdb0e525ff5533e2bcb5df452e5601a840cca9fd0052ff1211276ec405e5816e41c010b242a63fa3b97b0a4d79fef738f263a16fbdb734fb11ef174bfd09709d8ebabe8e9b774c3a34d7f3146ead0cc4c6b329ec5ab3b4a58b40cf9f47199a794ccd89326d9e57d5d8faee65a21c34e49cb8994d6e69df42d0927cbe82e667cbd2ec0ecd89c8ba490ee78e4a11635587e5ccbb5fa3f93d3b776d4e522748e2bbf1dc2cb6d826a1d60d010981cf4305ec59f948f80a21c36ad3b10227825cde0c3f82f2960ddbc9e6dc31038f4b184440562cc3e74604b9162cec885324cfdf48da6c18c78fee359b53d8fe80e6b7a1d9fa37eda00179e517d9ef87c31486f184817051b7ff4421d016fad8728ce2d71435a102387084a9819b87c7858c267e1706455ee0a6dd069c057bb88df0fc7cddfd7298d273994e726fe747fffaff6b91d1bc6efe5e98f68ed762d20f8ee47ac5efd7bde79e106b84b886ab8cb69d8f3955ffd6eaca423b35d9a2d48444d296b5ac40877a137cdb150182c670abf67fdd8156a1a1da6eef74e1f6e01b771789d6b39fda761b0de124086c86d02e3912473efdc8082b3b9c97231464b6e286dbba0fa079d273ec82d620f459dda008d3975ac848794c9b47ac13bb401b1ed54544cfb010a929596a77ab12f8d78629ff81524fa66743e8197adaf9014fa51e590d6c54996dc52bca8cd965bcdcdc6d711d9b40b6fb5834e62e0ba5c41a25376393b1d79be14fee3400536f758c9c483a85d451b8f764241c2266e26449f588827ad7f2433c7810ef6f892d2da86b1109c14cef4c78796474b2f6d5c6761ea8debc6ad9a201395dbcc58d5dd098b965d76876d50dbd4cd1f3184a87cbd9d2c845d005ffece73dc9644c6d3876ea79c630d885ccf2ca10432094801bd0407f932f623132b66f690f59f163f942dd14f7a50881721e65ed674815fc0b70e57d2afdd90a58ea22cbefd117e7e2b3bbd08cf0287788d2e770cbc25bd10f5a0bf9d4fd604ff415b6e32bee283e8079c2f176911820de7d9a71d392796f396d0a4aebb1e54e1daf5a50712390e8294b288887da5ad9990b61846701c79de2f77c2fe259cb06e438b11d2b9fb9ef0dcd5666f3339326a46da9bd09d5004156eec0a4e09880a2a838fefc2d3a491eff358919d4c15ce6f0c9d32abdac334887be04601cfaf4092a8f4df25e8c4ea28ea8eb0d003d603ccc91a1555b2dc3b055c05d8b908a1d19890d7e31e6539e90021d57f040df5c2554d083c4345579c815c677d6e6a42e5b2e9f76635ec5908bd80bcb4fdb25012ea02104f86f9e31643608c1b18fcd94d04f59bc8658ebf09ca78837830c6453d8e143a474f715bacabc76f88e6742ac68fef2f6644bd0d3de978ff5f269b27ec6f1a5e025c2a0c01f1e9bf0ea7b4d54a80b4498a85307aad5f6098b335d22f0d31625ca95ed1856b55cd02dbf6431da0b536b7f5e073d22cbe7b09784f389a4935f5d854c64c7a3753f28dc2bac480343374d86f3278170233a3e74eaa461fad0590f8ce715981532203edaa762d23db1705e8efee53a85a8f5548a71d12a9644b025e782d88c87e46698ce1260a3ef37d8add19f895b712325e26ca5b6165e7ec28061925e18ca70f44c02d082cbb74e78915894a3a3de96f5ce3198d0b7e11d97a708dad811cc66424e1a741e979fdac0a15a62a5252b8f34deb23798f84469ddfc968e8961268868715affd8dc6a43b5c8716dd94372e331a6e0cebf4fd8696bc9133984e060efaee80f9921dbf3b18d510eff7fb414b961eba0e88f83dec6c66121ffe068f3a646eb86b631362d49cd38e1aa6704f0397908a0babf9cb962de4aec4b20530e2225e3ba7c8263d9a8a90640b12a9d0633eef22a42ccc478d1b0d1bf6a9590e0b9803479509c89b0187fb35ffe1aa6703e7d48c75281cdbbc6cce1e2e5f0bcd8689071747cdbac317a7d71430312927b95b1cd0fc15603da8395825aeb6499acc811e6974d4e46c8f6a7c17c8edc9727b9a68d65e7a1efb2b8085bbc0640e6fc56550a2e4e93d4b11bace5a9676716c44b1f2d5b2ab18ed45c6c71f6a58078d5814f925a52b1a601cd675c3e8ce218013895c071abcf2501cf24499cb5c3531b98a9b97dd762ed9af6f8d22c720f156c38eb7a27eabe22fa93d292497e8da1285ac223ad30a624542e2082f78adbe1059b2e7e6e831a850f0e9d71ade8c011cfbcb0718707fd6bf5b865c4af381bf431a5b22be6143ef12acb4e992c0361fabc14cfefeca590217c7416598a12623066e6b31b77c6839d6cc63e4a494d16616bcd0eab082b946bc90f324c3ffa131378b02937f677f6803f80d802cda7dac607aabe9df8bc19594711d12c85726ce4bcd6f686d13bbf391721f634b89216e1c947f88134c8b9df912306974a9140c68fe1badf8c0f693a197131846881f3ef0b3ae3ed3fbbde90b6acfa4e018000f1ac0b63bc4810690014d44dc8fe8ca5ac88f584a890f47786737a507cde305991ea0156db425e9f540b32ae01acf493db8bae8705fe46724dfdcb453cf4ee93b9305d29746b3628ea8e322ac70170ec02797e1c897e476f74d8b4d70eef872c4305015391304647c5c55171790e24188cd3e08db1b507f022b2b81c5d88abc776a41e0070c86c297ef832e548497a8b65e6bdc249c1a90ca0d72a0f2ff4b04206aad4c5bf55c7b84dde974a2e87504d2145aea3d3b478ebc028e88728b3e834d0f9f6ace8e0b570923b07e390971b035d9e4d1b6fd77db56f4196e55622c34897204690bfd3c69665a66e04f97d4b5e193f20632f5c57ab9aa496e274978b147f84bcf7e3be85bfa9245c2f55296619bdc9bdf1fb0986573206cc95ca47cb13cd663f82ea8042e42a3e8bc61c832f1745f83f1b8529d623406fa8184779141b58269adbd220afc546aa6a4d3be27567793a8fff83d71cec3ab7e59e5943f388ed3b1f3e8e254d6c6143fd0e63b4a2da47dbbebad178a323e2ccce33adeb1d4974c5cf6ab59c732afab6854a55cc165cefc17641bdb17e907d9d18b5dcc3155b8101153c30ccdc3e0bbf749bad08b4d201b35b564cb74323bdf6346bf956a3448ec6f7ca99f7e37a069b7771b32c15e2e0e5c9d6898e70e6ed0641516da2f95b7a34516883366b0b22358fd12e934934a4642ee1a8eb78225f74e8aa34e3906ed6d9585869a752e7db2b8c99a02c62512c1a435ae09fc7ef06caf578a4c7965ad684c044d336b8cf7e540cf14e6c6ebced155eb0c7b33a12754d451310adc3e5a737a31e978483004cc1a12c80c97cf316830a780b9dff407bf394b84ecbf37703849e3c37a4401d010f05be8cd5f9a011e2bfb7df829cc3efeb9479eca41e44c459329a0d2008073f156adfe0928ee8d5234cc568fc0ec128b5fbc23f445fcf8d4cfaeaacf3ea691ebfc7efc75dbf17d50f1d9eaa783c5116c086738b3434f7d71316fc96930f18f91f77ad6a2d6f30287f54b97f91f8062cbea7c4fa5ef38c970ef64aaef5a7ffdf2ffb999ae82e6f4227f69b2a3c330be24c34afc5eee54fdf8939ee4770a3b5f0f6cf07319530b1b4758d3c1ce2832300c3a2a54d9861335b12c72c3ba6105a1a1eae961fcfdae3e92390302c50ec28111549532411a505dd33b61e948e49afc8e3523e906c0bed14c7aad27aff202db4d3a415c41bedec87d37afe26915da864d812e9d1b4e5a140b1769935cdfb7223cd94d00657f9b70641759a481266b7026bb1a0fd0bbb643d0364b7b3d3535866d73db248f4bdd71f6fff2ef618b1556b92f337a4b4bbd8fa0d3c8ec1b9d01521044e1133bae69c52e44dabc3e7d4ad9503cefa382e0e7cd395dde86539c6f1d5b74315988766d3f5e7da0a45e2cce2ccb2090d8100abd35e0d40a3fc2d86258cf7d5d86cb033bf6057542768067a4ecb56e7e1b88ac0e7033adf86a59aa451ac2552b85de4e9bf88ac301733f05c99be883565d1637b522924f950aaac8cfd606b701c39192b55184a8c2366875c1e6d90e667f66d46596a0c155efa0ca09914a19d971220cad2b67d200489cdd70b59416d5442267d0a06cb2e6b8dfe7064736a40c7b1780fbc2600f659cffe8d79d620cee33c7504d6dc65023d4d8234ec04478ec25ec0e162abd0220c3c46e3901a0803be8bb5e7c45a19e7facce5593d48f04b4203983bbf5d9849742301d6e11436c2cae72d6af88f02ac1d3e50bbc489398dab9e5662d2c6062fdb187d30f607409723a817704bf742ad32f654a3e5a8c8743851e0d0391058f7eda7d686a4d544d7ad261bd818ce7df60e9f9467810f41da6315fd72a80a1a276619b4a39d7123d2ccd5bd15022edd65bfa93c068958564d2fb4c4f002512f6f9846529c6c1d5c051af467786d7d1ed5b66fa9834e6a9240bc56dbbd15d2a3ea6cdfadb2a19fd3b8df2c42e27f5833b93ce70ce0e7cf0bf6bafca369c82ccde75a119e589a7321f060979c5bf8dfc64112aabc269e8f1f83f304e17ae20a828396bb9721fdcf56861f2e5aae062a46b29cfb6c74a873ce2dc7da69a27fa7d5081e9c1a9dce056bea2cf6e9397c70d4317f322e73faaeb906c922e0e47149f4acf42f9517be203aea8aa759baafd63abdd3be6bc5a7cd34f2d01865fe8fbbe671935bb7ba1f889c0018fd0dc9ca365cd7b9a787fbb7a923661b681cb82b0d0c29b9e67431fc94de4c1291246a463dd8029cafd0a67954c4397b444c911aea08d7aba2661ec34b5153de3060a84e0f91d36bb5dc782953f32461cb3826d8b4d1364dccd9e84ea54273f93717c2b050b22a9ff773ff6ed6e29c06b406026b2b984aed2d43a6af6ff461c81e67f582ed161e92069e9bb8f5f33e3979b2f174336bf9a79a06ca842f75877a504b3ae4fe2fe18d936c2036af6cfda84ff93d64734a5b3c6ad267cde9e1127ffe4773a93ac640961d1c8f01285633ab9506956f8d772e017dbfa85a1b7dac433e27b7b0d64c31fa7654812c05bf0d395b98bc667ff836fa1a920bdfbfc0f38e96002a48a993e13e88a4e4f31fd3ee03b128bd17627fc10abb7e690fee7bfe5d38c305473da919581a9238cb361", 0xffc, 0xfffffffffffffffb) getsockopt$inet_IP_XFRM_POLICY(r10, 0x0, 0x11, &(0x7f0000000540)={{{@in6=@loopback, @in6=@ipv4={[], [], @broadcast}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@empty}, 0x0, @in6=@dev}}, &(0x7f0000000680)=0xe8) r13 = getgid() keyctl$chown(0x4, r11, r12, r13) stat(&(0x7f0000000380)='./file0\x00', &(0x7f00000003c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) setxattr$system_posix_acl(&(0x7f0000000100)='./file0\x00', &(0x7f0000000140)='system.posix_acl_access\x00', &(0x7f0000000440)={{}, {0x1, 0x5}, [{0x2, 0x1, r2}], {0x4, 0x4}, [{0x8, 0x4, r3}, {0x8, 0x1, r4}, {0x8, 0x3, 0xee00}, {0x8, 0x1, r9}, {0x8, 0x2, r13}, {0x8, 0x2, r14}], {0x10, 0x2}, {0x20, 0x2}}, 0x5c, 0x2) ioctl$TCSETS(r1, 0x40045431, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1}) r15 = syz_open_pts(r1, 0x0) r16 = dup3(r15, r0, 0x0) ioctl$TCXONC(r16, 0x540a, 0x0) pselect6(0xffffffffffffff5f, &(0x7f0000000000)={0x9, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x1}, 0x0, 0x0, 0x0, 0x0) 16:21:08 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) dup2(r1, r0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000380)=ANY=[@ANYBLOB="04630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000300)={0x8, 0x0, &(0x7f00000004c0)=[@acquire={0x40046304}], 0x0, 0x0, 0x0}) [ 1779.180286] binder: 11646:11651 IncRefs 0 refcount change on invalid ref 0 ret -22 [ 1779.206832] binder: 11646:11651 IncRefs 0 refcount change on invalid ref 0 ret -22 16:21:08 executing program 2: r0 = syz_open_procfs(0x0, &(0x7f0000000080)='net/dev_snmp6\x00') r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r1, 0x40045431, &(0x7f00000000c0)) r2 = syz_open_pts(r1, 0x0) r3 = dup3(r2, r0, 0x0) ioctl$TCXONC(r3, 0x540a, 0x0) perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0xee6b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r4 = socket(0x3, 0x0, 0x0) r5 = openat$selinux_avc_hash_stats(0xffffffffffffff9c, 0x0, 0x0, 0x0) perf_event_open(&(0x7f0000000300)={0x2, 0x70, 0x6ad, 0xa9c, 0x800, 0xcf5, 0x0, 0x3, 0x92, 0x8, 0x1000, 0x80, 0x0, 0x922, 0xffffffffffffffff, 0x88c, 0x7ff, 0x80000001, 0x3, 0x8, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x4, 0xcc, 0x1f, 0x389, 0x1, 0xffff, 0x800, 0x3, 0x0, 0x800, 0x5, 0xfffffffffffffffa, 0x0, 0x2, 0x0, @perf_config_ext={0x706, 0x988}, 0x8000, 0x0, 0xb67, 0x4, 0x9}, 0xffffffffffffffff, 0x3, r5, 0x9) syz_genetlink_get_family_id$SEG6(&(0x7f0000000400)='SEG6\x00') open$dir(0x0, 0x0, 0x0) connect$unix(r5, &(0x7f0000000380)=@abs={0x1, 0x0, 0x4e24}, 0x6e) setsockopt$netlink_NETLINK_ADD_MEMBERSHIP(r4, 0x10e, 0x1, &(0x7f0000000100)=0x7, 0x4) r6 = socket$inet6(0xa, 0x400000000001, 0x0) r7 = dup(r6) setsockopt$inet6_tcp_int(r6, 0x6, 0xc, 0x0, 0x0) ioctl$PERF_EVENT_IOC_PERIOD(0xffffffffffffffff, 0x40082404, 0x0) prctl$PR_SET_MM_MAP(0x23, 0xe, 0x0, 0x0) lsetxattr$trusted_overlay_redirect(&(0x7f00000001c0)='./bus\x00', &(0x7f0000000200)='trusted.overlay.redirect\x00', &(0x7f0000000240)='./file1\x00', 0x8, 0x2) bind$inet6(r6, &(0x7f00000000c0)={0xa, 0x8000000004e20, 0x6bf}, 0x1c) sendto$inet6(r6, 0x0, 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) setsockopt$inet6_opts(r6, 0x29, 0x36, &(0x7f0000000440)=@fragment, 0x8) open(&(0x7f0000000040)='./bus\x00', 0x141042, 0x0) ioctl$sock_SIOCGIFBR(r4, 0x8940, &(0x7f00000005c0)=@generic={0x3, 0x9, 0x800}) ioctl$KDSETKEYCODE(r5, 0x4b4d, &(0x7f0000000140)={0xfff, 0xfff}) setsockopt$sock_linger(r7, 0x1, 0xd, &(0x7f0000000000)={0x0, 0x45}, 0x8) stat(&(0x7f00000004c0)='./file1\x00', &(0x7f0000000500)={0x0, 0x0, 0x0, 0x0, 0x0}) lsetxattr$security_capability(&(0x7f00000002c0)='./bus\x00', &(0x7f0000000480)='security.capability\x00', &(0x7f0000000580)=@v3={0x3000000, [{0xff, 0xffff}, {0x0, 0x2}], r8}, 0x18, 0x1) [ 1779.279255] binder: 11663:11666 IncRefs 0 refcount change on invalid ref 0 ret -22 [ 1779.280009] binder: 11658:11662 Acquire 1 refcount change on invalid ref 0 ret -22 [ 1779.286577] binder: 11644:11670 ioctl c0306201 20000300 returned -14 [ 1779.307373] binder: 11658:11662 IncRefs 0 refcount change on invalid ref 0 ret -22 [ 1779.316903] binder: 11658:11662 Release 1 refcount change on invalid ref 0 ret -22 16:21:08 executing program 3: r0 = gettid() ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x3c) ptrace$cont(0x18, r0, 0x0, 0x6135) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r0, 0x0, 0x0) r1 = getpgrp(r0) ptrace$PTRACE_SECCOMP_GET_METADATA(0x420d, r1, 0x10, &(0x7f0000000000)={0x5}) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f00000003c0)="11dca50d5e0bcfe47bf070") r3 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r3, &(0x7f0000000100)={0x2, 0x4e20}, 0x10) connect$inet(r3, &(0x7f0000000cc0)={0x2, 0x4e20, @local}, 0x10) setsockopt$SO_TIMESTAMPING(r3, 0x1, 0x25, &(0x7f00000010c0)=0x19ff, 0x4) sendto$inet(r3, &(0x7f0000000140)="b0", 0x1, 0x0, 0x0, 0x0) recvmmsg(r3, &(0x7f0000003b40)=[{{0x0, 0x0, 0x0}}], 0x1, 0x2000, 0x0) 16:21:08 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) dup2(r1, r0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000380)=ANY=[@ANYBLOB="04630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000300)={0x8, 0x0, &(0x7f00000004c0)=[@acquire={0x40046304}], 0x0, 0x0, 0x0}) [ 1779.326927] binder: 11663:11673 IncRefs 0 refcount change on invalid ref 0 ret -22 [ 1779.347205] binder: 11658:11662 unknown command 1850775417 [ 1779.362010] binder: 11658:11662 ioctl c0306201 200000c0 returned -22 16:21:08 executing program 1: r0 = syz_open_procfs(0x0, &(0x7f0000000080)='net/dev_snmp6\x00') socket(0x10, 0x80002, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) socket$nl_generic(0x10, 0x3, 0x10) syz_open_procfs(0x0, &(0x7f0000000980)='net/sofH\x16tnet_sua') socket$inet6_tcp(0xa, 0x1, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) request_key(&(0x7f0000000000)='user\x00', &(0x7f0000000040)={'syz'}, &(0x7f0000000a80), 0xfffffffffffffffd) socket$inet(0x2, 0x4000000000000001, 0x0) perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x1ee6b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000000c0)={0xeb, 0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB="0563044000000000046304400000000006630440000000007997506ea39438033ada635f7cd4c9d1de50cf51e7a773b356e7348d3b19cbdc76ed97a6a08da8997815ea9e6d3b6a1d5a7c1cdf78337a6166cfd70cf41b6cb958e69b7dae4fe74a09c8e4db4c323ba219438b49c2f1736eb01b18c098512160aad1c0394bd4c9b785ea39e6f5b1f809658351bcb5f101899004e6a8542081ceec87f1a675538ce9264c7f128392c875c23507fc8a694ef2d13b127563b2da420a3df952f062dd3d46202a3466fa9a9c985dde3cc577a1fdf40687931bbc4303dbab0e28bb6757bc226d9bba4db1603de1a9c7"], 0x1, 0x0, &(0x7f00000003c0)='L'}) r2 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r2, 0x40045431, &(0x7f00000000c0)) r3 = syz_open_pts(r2, 0x0) r4 = dup3(r3, r0, 0x0) ioctl$TCXONC(r4, 0x540a, 0x0) pselect6(0x40, &(0x7f0000000340)={0x9}, 0x0, 0x0, 0x0, 0x0) [ 1779.441608] binder: 11681:11683 IncRefs 0 refcount change on invalid ref 0 ret -22 [ 1779.460405] binder: 11681:11683 IncRefs 0 refcount change on invalid ref 0 ret -22 [ 1779.492891] binder: 11684:11685 Acquire 1 refcount change on invalid ref 0 ret -22 [ 1779.508773] binder: 11684:11685 IncRefs 0 refcount change on invalid ref 0 ret -22 [ 1779.530426] binder: 11684:11685 Release 1 refcount change on invalid ref 0 ret -22 [ 1779.538987] binder: 11684:11685 unknown command 1850775417 [ 1779.545450] binder: 11684:11685 ioctl c0306201 200000c0 returned -22 16:21:09 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) r2 = dup2(r1, r0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="3ed2854064c44ab35114f0f375602b5ed8fb5acda92cc98e6fa43c88216124490b53c4ca818962ffe550e4f5331fd77541ab3a4962123ff1f3bd5404658aa538d2f703993ed55f1421fee15a615561ff0695ebf49010b68f45d2e5a9179ba648ccf4d82d3f2f82eddf0d7bf65ce10f2099d4e47f5b35109132d5e992138193e1e43633238fb2014ca12a5f35e49523046b3c98809f1087cd612472ad9eb796259583b1cc16c86affddd3477eb2b4c7835633525334af2a225d4c35a6451463ef91b19a3e0e0befd4c4d1550f1fb3fb9fe1c216cb8f8c0949bde1e1197b5cd9553e20f1"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000300)={0x8, 0x0, &(0x7f0000000180)=[@increfs={0x40046304, 0x2}], 0x0, 0x0, 0x0}) 16:21:09 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f00000003c0)="11dca50d5e0bcfe47bf070") r1 = socket$inet_tcp(0x2, 0x1, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) bind$inet(r1, &(0x7f0000000100)={0x2, 0x4e20}, 0x10) connect$inet(r1, &(0x7f0000000cc0)={0x2, 0x4e20, @local}, 0x10) setsockopt$SO_TIMESTAMPING(r1, 0x1, 0x25, &(0x7f00000010c0)=0x19ff, 0x4) sendto$inet(r0, &(0x7f0000000140)="b0", 0x1, 0x0, 0x0, 0x2aa) recvmmsg(r1, &(0x7f0000003b40)=[{{0x0, 0x0, 0x0}}], 0x1, 0x2000, 0x0) 16:21:09 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) r2 = dup2(r1, r0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000380)=ANY=[@ANYBLOB="04630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000300)={0x8, 0x0, &(0x7f00000004c0)=[@acquire={0x40046304}], 0x0, 0x0, 0x0}) 16:21:09 executing program 2: r0 = syz_open_procfs(0x0, &(0x7f0000000080)='net/dev_snmp6\x00') r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ptmx\x00', 0x0, 0x0) rmdir(&(0x7f0000000140)='./file0\x00') ioctl$TCSETS(r1, 0x40045431, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1}) r2 = syz_open_pts(r1, 0x0) pivot_root(&(0x7f0000000000)='./file0\x00', &(0x7f0000000100)='./file0\x00') r3 = dup3(r2, r0, 0x0) ioctl$TCXONC(r3, 0x540a, 0x0) pselect6(0x23e, &(0x7f0000000340)={0x9, 0x40, 0x2, 0x0, 0x0, 0x0, 0x7}, 0x0, 0x0, 0x0, 0x0) 16:21:09 executing program 4: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0xfffffffffffffff7) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0xf) 16:21:09 executing program 1: r0 = syz_open_procfs(0x0, &(0x7f0000000080)='net/dev_snmp6\x00') socket(0x10, 0x80002, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) socket$nl_generic(0x10, 0x3, 0x10) syz_open_procfs(0x0, &(0x7f0000000980)='net/sofH\x16tnet_sua') socket$inet6_tcp(0xa, 0x1, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) request_key(&(0x7f0000000000)='user\x00', &(0x7f0000000040)={'syz'}, &(0x7f0000000a80), 0xfffffffffffffffd) socket$inet(0x2, 0x4000000000000001, 0x0) perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x1ee6b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000000c0)={0xeb, 0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB="0563044000000000046304400000000006630440000000007997506ea39438033ada635f7cd4c9d1de50cf51e7a773b356e7348d3b19cbdc76ed97a6a08da8997815ea9e6d3b6a1d5a7c1cdf78337a6166cfd70cf41b6cb958e69b7dae4fe74a09c8e4db4c323ba219438b49c2f1736eb01b18c098512160aad1c0394bd4c9b785ea39e6f5b1f809658351bcb5f101899004e6a8542081ceec87f1a675538ce9264c7f128392c875c23507fc8a694ef2d13b127563b2da420a3df952f062dd3d46202a3466fa9a9c985dde3cc577a1fdf40687931bbc4303dbab0e28bb6757bc226d9bba4db1603de1a9c7"], 0x1, 0x0, &(0x7f00000003c0)='L'}) r2 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r2, 0x40045431, &(0x7f00000000c0)) r3 = syz_open_pts(r2, 0x0) r4 = dup3(r3, r0, 0x0) ioctl$TCXONC(r4, 0x540a, 0x0) pselect6(0x40, &(0x7f0000000340)={0x9}, 0x0, 0x0, 0x0, 0x0) 16:21:09 executing program 2: r0 = syz_open_procfs(0x0, &(0x7f0000000080)='net/dev_snmp6\x00') r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040)='/d/\x17S\xcb\xd9k\xa8Q', 0x0, 0x0) ioctl$TCSETS(r1, 0x40045431, &(0x7f00000000c0)) r2 = syz_open_pts(r1, 0x0) r3 = dup3(r2, r0, 0x0) ioctl$TCXONC(r3, 0x540a, 0x0) pselect6(0x40, &(0x7f0000000340)={0x9}, 0x0, 0x0, 0x0, 0x0) 16:21:09 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) r2 = dup2(r1, r0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000380)=ANY=[@ANYBLOB="04630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000300)={0x8, 0x0, &(0x7f00000004c0)=[@acquire={0x40046304}], 0x0, 0x0, 0x0}) [ 1780.033977] binder: 11703:11704 unknown command 1082511934 [ 1780.039672] binder: 11703:11704 ioctl c0306201 20000140 returned -22 [ 1780.056452] binder: 11703:11704 IncRefs 0 refcount change on invalid ref 2 ret -22 [ 1780.073007] binder: 11703:11709 unknown command 1082511934 16:21:09 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) r2 = dup2(r1, r0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000380)=ANY=[@ANYBLOB="04630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000300)={0x8, 0x0, &(0x7f00000004c0)=[@acquire={0x40046304}], 0x0, 0x0, 0x0}) [ 1780.090497] binder: 11703:11709 ioctl c0306201 20000140 returned -22 [ 1780.122681] binder: 11708:11712 Acquire 1 refcount change on invalid ref 0 ret -22 16:21:09 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binder(0x0, 0x0, 0x0) r2 = dup2(r1, r0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) r3 = openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000080)='/selinux/commit_pending_bools\x00', 0x1, 0x0) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000140)={0x8, 0x0, &(0x7f00000000c0)=ANY=[@ANYRES64=0x0], 0x23a, 0x0, 0x0}) pipe(&(0x7f0000000480)={0xffffffffffffffff, 0xffffffffffffffff}) write(r4, &(0x7f0000000340), 0x41395527) write$UHID_GET_REPORT_REPLY(r4, &(0x7f0000000040)={0xa, 0x7, 0x80, 0xacd4}, 0xa) pipe(&(0x7f0000000480)={0xffffffffffffffff, 0xffffffffffffffff}) write(r5, &(0x7f0000000340), 0x41395527) write$binfmt_script(r5, &(0x7f0000000180)={'#! ', './file0', [{0x20, '^vboxnet1'}, {0x20, '/dev/binder#\x00'}, {}, {0x20, '/dev/binder#\x00'}, {}, {0x20, '/dev/binder#\x00'}], 0xa, "60de9ba3c661da5bf604b2770bcf9d28350003b10f6fab785c5a69b9ac1a4ca6932815ea8cc57d3afa5b98e4d85afa71951e30f3e2d6dabeeab5cb13b91f605bc84b9e76cf73c620f7ef35b240cd89a600bf758014b1d340c0f92af429c21c180c4d855ffaeb3f10fb79911884e93841665e98bf99052e426727bca8554d3f8792f7ad10d86c5629f76e2db673cb5b27adc6d6a3cf25ff29cc5fdbe9250289b035c7ecb034cf77f5a9b2c56131f919b5fcceb34c0ce7ef6d7fd2d8ef68507436fb8d5c87d1f80f7ced3504f6ba41e3340ca9b963d4b2898f77c9dd4199"}, 0x11e) 16:21:09 executing program 2: r0 = syz_open_procfs(0x0, &(0x7f0000000080)='net/dev_snmp6\x00') r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r1, 0x40045431, &(0x7f00000000c0)) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000000), &(0x7f0000000100)=0xc) r2 = syz_open_pts(r1, 0x0) r3 = dup3(r2, r0, 0x0) ioctl$TCXONC(r3, 0x540a, 0x0) pselect6(0x40, &(0x7f0000000340)={0x9}, 0x0, 0x0, 0x0, 0x0) [ 1780.137771] binder: 11708:11712 IncRefs 0 refcount change on invalid ref 0 ret -22 [ 1780.158895] binder: 11708:11712 Release 1 refcount change on invalid ref 0 ret -22 [ 1780.184737] binder: 11708:11712 unknown command 1850775417 16:21:09 executing program 4: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TCSETSF(r0, 0x5404, &(0x7f0000000000)={0x0, 0xa0, 0x5, 0x5, 0x0, 0x200, 0x0, 0x1, 0x8, 0x5, 0x1, 0x80000000}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) prctl$PR_GET_SECUREBITS(0x1b) socketpair(0x8, 0x6, 0x2, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000180)='\t\x00') sendmsg$IPVS_CMD_NEW_DEST(r2, &(0x7f0000000240)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f0000000200)={&(0x7f00000001c0)=ANY=[@ANYBLOB='(\x00\x00\x00', @ANYRES16=r3, @ANYBLOB="05002abd7000fbdbdf2505000000080005ff14141d"], 0x28}, 0x1, 0x0, 0x0, 0x40800}, 0x40008) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0xf) 16:21:09 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) r2 = dup2(r1, r0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000300)={0x8, 0x0, &(0x7f00000004c0)=[@acquire={0x40046304}], 0x0, 0x0, 0x0}) [ 1780.224265] binder: 11708:11712 ioctl c0306201 200000c0 returned -22 [ 1780.344426] binder: 11739:11742 ioctl c0306201 0 returned -14 16:21:10 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f00000003c0)="11dca50d5e0bcfe47bf070") r1 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r1, &(0x7f0000000100)={0x2, 0x4e20}, 0x10) connect$inet(r1, &(0x7f0000000cc0)={0x2, 0x4e20, @local}, 0x10) setsockopt$SO_TIMESTAMPING(r1, 0x1, 0x25, &(0x7f00000010c0)=0x19ff, 0x4) sendto$inet(r1, &(0x7f0000000140)="b0", 0x1, 0x0, 0x0, 0x0) recvmmsg(r1, &(0x7f0000003b40)=[{{0x0, 0x0, 0x0}}], 0x0, 0x2000, 0x0) 16:21:10 executing program 1: r0 = syz_open_procfs(0x0, &(0x7f0000000080)='net/dev_snmp6\x00') socket(0x10, 0x80002, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) socket$nl_generic(0x10, 0x3, 0x10) syz_open_procfs(0x0, &(0x7f0000000980)='net/sofH\x16tnet_sua') socket$inet6_tcp(0xa, 0x1, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) request_key(&(0x7f0000000000)='user\x00', &(0x7f0000000040)={'syz'}, &(0x7f0000000a80), 0xfffffffffffffffd) socket$inet(0x2, 0x4000000000000001, 0x0) perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x1ee6b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000000c0)={0xeb, 0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB="0563044000000000046304400000000006630440000000007997506ea39438033ada635f7cd4c9d1de50cf51e7a773b356e7348d3b19cbdc76ed97a6a08da8997815ea9e6d3b6a1d5a7c1cdf78337a6166cfd70cf41b6cb958e69b7dae4fe74a09c8e4db4c323ba219438b49c2f1736eb01b18c098512160aad1c0394bd4c9b785ea39e6f5b1f809658351bcb5f101899004e6a8542081ceec87f1a675538ce9264c7f128392c875c23507fc8a694ef2d13b127563b2da420a3df952f062dd3d46202a3466fa9a9c985dde3cc577a1fdf40687931bbc4303dbab0e28bb6757bc226d9bba4db1603de1a9c7"], 0x1, 0x0, &(0x7f00000003c0)='L'}) r2 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r2, 0x40045431, &(0x7f00000000c0)) r3 = syz_open_pts(r2, 0x0) r4 = dup3(r3, r0, 0x0) ioctl$TCXONC(r4, 0x540a, 0x0) 16:21:10 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) r2 = dup2(r1, r0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000300)={0x8, 0x0, &(0x7f00000004c0)=[@acquire={0x40046304}], 0x0, 0x0, 0x0}) 16:21:10 executing program 2: r0 = syz_open_procfs(0x0, &(0x7f0000000080)='net/dev_snmp6\x00') r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r1, 0x40045431, &(0x7f00000000c0)) r2 = syz_open_pts(r1, 0x0) stat(&(0x7f0000000000)='./file0\x00', &(0x7f0000000100)) pipe(&(0x7f0000000480)={0xffffffffffffffff, 0xffffffffffffffff}) pipe(&(0x7f0000000480)={0xffffffffffffffff}) vmsplice(r4, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) r5 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r5, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000100)=@newlink={0x40, 0x10, 0xe3b, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x243}, [@IFLA_MASTER={0x8, 0xa, 0x6}, @IFLA_LINKINFO={0x18, 0x12, @vti={{0x8, 0x1, 'vti\x00'}, {0xc, 0x2, [@IFLA_VTI_LOCAL={0x8, 0x4, @multicast2}]}}}]}, 0x40}, 0x1, 0x0, 0x0, 0x4000000}, 0x800) r6 = syz_genetlink_get_family_id$ipvs(&(0x7f0000001500)='IPVS\x00') r7 = accept(r5, &(0x7f0000000000)=@in={0x2, 0x0, @broadcast}, &(0x7f00000000c0)=0x80) sendmsg$IPVS_CMD_SET_INFO(r7, &(0x7f0000000240)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x2002006}, 0xc, &(0x7f0000000200)={&(0x7f00000001c0)={0x1c, r6, 0xf08, 0x70bd2b, 0x25dfdbff, {}, [@IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x5}]}, 0x1c}, 0x1, 0x0, 0x0, 0x40080}, 0x0) sendmsg$IPVS_CMD_SET_SERVICE(r4, &(0x7f00000002c0)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f0000000280)={&(0x7f0000000200)={0x5c, r6, 0x0, 0x70bd28, 0x25dfdbfd, {}, [@IPVS_CMD_ATTR_SERVICE={0x14, 0x1, [@IPVS_SVC_ATTR_SCHED_NAME={0x8, 0x6, 'fo\x00'}, @IPVS_SVC_ATTR_PORT={0x8, 0x4, 0x4e24}]}, @IPVS_CMD_ATTR_SERVICE={0x1c, 0x1, [@IPVS_SVC_ATTR_AF={0x8, 0x1, 0x49ad7951512afc9b}, @IPVS_SVC_ATTR_PORT={0x8, 0x4, 0x4e24}, @IPVS_SVC_ATTR_NETMASK={0x8, 0x9, 0x70}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x8}, @IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0x4}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x7ff}]}, 0x5c}, 0x1, 0x0, 0x0, 0x24008801}, 0xf699469884e56624) write(r3, &(0x7f0000000340), 0x41395527) ioctl$LOOP_CHANGE_FD(r0, 0x4c06, r3) r8 = dup3(r2, r0, 0x0) ioctl$TCXONC(r8, 0x540a, 0x0) pselect6(0x40, &(0x7f0000000340)={0x9}, 0x0, 0x0, 0x0, 0x0) open$dir(&(0x7f0000000180)='./file0\x00', 0x490800, 0x106) 16:21:10 executing program 4: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/p\x00\x04\x00', 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0xf) pipe(&(0x7f0000000480)={0xffffffffffffffff, 0xffffffffffffffff}) vmsplice(r2, &(0x7f0000002d00)=[{&(0x7f0000000380)="2c9a236d0b1244a26c0c0131ddd4f05d8efe3a1fe6bbb6b1a61d88ea043aa7d02d9eb32a8624d50e209c9fda76c912eca47a87f93e39073ebb01f0ee5d19f7771ec1c1a10af488e8efb3e51134b8fa9109bfe4bb9cd6ba79735bac79cd160615feede0eaf751f466520aa9b50a963dcd172cb24163526936b248137cfcafc78e85964b30b13448676fe4232b8c6fe175f3895d8831f951f4929f8abe5b9db6849ddd12fa65a88728c0051c46a7794d0c559d74dff0b06bd7d652df5cf1863c4270b2dde561", 0xc5}, {&(0x7f00000004c0)="fea26e32ee0b0b2a02e3355a5cf69df0b41291965dee52025d15c141200687ade2f5a0f75f1bd44a25eb65b6af519eca16a47070dbbd9f0d1867d6e74baed6a445172060bebeef04d736b9", 0x4b}, {&(0x7f0000000b00)="343be5bbd80f75702f99aaf27a76bba425a14899d5f4df74731fd560d58ce9119c02411933bd083f17d12507b36e555f208ad557c7f22215a3dbaf2442a6c1927e1e7f469f8babbcaaab691935a8a29a89a0a6e04ebe5c5e98f42f8ee43530f8fd0646695c664350047d70da08cc632c89fcff84e45c318f6d571234008000001fc547946753cbf8b625dfa2d750aee212c4e5b9583b3a45ff3af3dfb1c9d54b8c2f58c388dc3c2a42b72e8203dfe8921de7a722bf957aa9457de950d1628ee8fb26af1c711c6a393058e96e97cf0666f20d12cad64d117d9c7c96aa7b493fd9c4a695009bc6b4146b7521a7f6b2c7f1b6ea87fc90bdb7d65206076d668cac63ccf7cc15ae16cc33143ed8de78eb5f87bb9aa7535f0c3ddf66bf8fd2f951b3c34b72c4921ddfd17a351f1f805b1e28eb9a0006d01c437c6419f8a4ff8d2d772d895c94867bdd830eacffa0dacf76d2924eb90534ea2a81777d5f9bc6a733e2c181455657866b474662d39bffbc82e85a7f22db5589f8061ec6cd905d7e82535d6bc3033d3fe54c20ec864f89534ef77498134d30841b38dc2c6e1f70ac9634697fe87f5e2db4e8b412154109dd9ea9c043de24bf169386f135d9f4fc9a2f9229f66f51ded407a8f7a5f54478d667aebe9a2f6e168b564096c6a03a5f61202c8e97ec5e065c76d7cfd939321b48585c3a3f6c2ebec1a0e2fbbce4c32dfc9327a6e166565ed2e29c14c7d84249dd186a91c5345b18145085ff21204902e15b20b9e3b1379708729ed33c551291300f12f5e351fa71751380c8da51f469a64784df9aeb9fd0e7c0b3ed40d798b117f4045e79373238cc92fde3cd6aefa5b2062f7b34f5ed411aa60391edee8e347199ae597d256af8a020413c26d746bbd51c57754490bfdd96a22cc32606e462828636c2b3cbe48d1297ac3e42022a2b3977919e362a926cb0cbbbc387968754184e30bd0925c8cd1c891280a942a3253e0e97a7c68a4780255ae38a6fa6b3fdc8fe5c1b25f5f3353a0596164fb829d0aea9f5cd84e2c4d569564ff6bba64211b010033e537da5b74297bbd60acc18e3e41ea4e86a9830b69afdcb25b2eb67c70de526448e898916f34d8be291b12814ac6b0165b77450cd357e8ab5580b8ee0d2e8c213c7f57c0ee519ef3a4fd3008ddb70e8d69c795295372a28eb3efbf9ea1c6d393aca21e72f8d9e9706f44744fe3ec458d055464de14f98c51222a6496791128dea15dc484d4d57856a507cc18885255df9cc41b888d8719a775b4557a2dafd07f2764a61db20130746bccb05728ff9b3bf1e47515f6b95a6583ee3ddfaa10c0adf583c5f7d9631433823235c2f88fb10b202607d4f3964d07553454260a7266916caa1dfd1792c78a9570003327f1c5bc7df2933331a8726839d9e417d1fa61e8ee1d11348f0a2337c65da16efa8e4798326d3dbd36b2a4cceeb4bd6f6828edee7c78e57474920ef01fea7e701f79f0e1db4df675d1d9c00010000000000002a9b95268adb2375145155936bf001fe775aff26fcd985bce8c87382ee49e637ab2843ca3713361a25e4d00229f67e43141ba12180ba112ab25fdf37912216a8551d05b05f6132d498e7336ba82bc3b2cc719c4d7450bfec2bc1bf620ef198981a414bc6b32e9c583a74c84faffde95edda2de151b489cd401471d557d1d6793582df751801df2697974c32d899000d0873fd4467d79239ac23027b257cec936548dd86d581e6f7aa0f64c9a01177cff9caea6897f7574a5f09fb03c6286b8b5df0f92c3b745cbc6c56886c7c97af4b04554b9733dc313ab65bb12ed2f2f3dd9a283a9efa0f85c7eabf6118f7114041936a4720f0e7da12caa5fa7b2a4b0ff53bb3413a814a263b4b395e901a6d7a87128ae7e59cad7a5de3e714193f2958b65d3678a2015c07480d2110240d8d037c937dba588a2a42a3774089d0d4410084b3d8e180d0d92557d94e0bc8af0f3c14b7b1385c59366195c5969ae267a95c0f0e962806eb7ba9d5ceb58c4437970c23acb6b2399a7c4c645a9e633daf58f6253bbe2bf64ad734532d0b5b87b9b1a0d951ba28ebb9c1b1c93cbd0a80413ade83addf3273020cf91f6318f0af1fb3ca43cdc1583f112f90864a0887bebac6ab6aef2806c74fd57e32322db711f044c64c16b86ff909e9018f0d4f456e489df6f1cb72b4e8ba5e4263eda5c2df3ff3b53ef193b6e2f004651e088a91ad6025fabe423cd5b1b9b5d46db2e29893850332b7fc67ec600098091a2ec9766eed1ab0d874dff7a88649db3784a68be107f3e6b82e7624572e7a417bbcaf300033e7fb739c1d6eac23c810c8855114dcee51a3907c697b9b4a2331c31a10af50ddf845eb24d7a8ae0c5b963f2e216527799fc8309d6210da8b281f2b193057ea9147b9ab9b80f7f3e3bc8448056d39992ba2c20846a6337dd695dd2a664a44e9fae07c33958cd6eff57ea8f6d53b7fb6ac476bbdad3750e687be783bf9389ca7fba4beba1263bf226d028145000748ac30801e7d31585d8996c4fd801158b55e6e332d6f4c23b0e3e64e40e91136eb7870b3b363de6ee7fdb63133d44ae54fd2340993c6b6b18d71cd689c5c7542d99b9873ec2319dd8ac6bae5f148ca7f5eff2bf17fda67476c31bb97dbe54b598fc2201beda3dc526a2fd31533eacd5c813b4210faf7f860198eae4f6b2945df79d60abf123683815921ed6e495aeeb09c4e2b8e7c111af38bf6832fc2f11641376c50478297ab252b755b76a98a16423a9450c25625670614223692602c4c2954556794b45d1955e9721e365ffb989f4e1dda2c2775d138271456fbfdb6787212e3f9370523e4cdd9201667046e9d702de76ff8466a53c53e3c52319436e1757cd43ef7d85b70c4ad49aea966dbd37334f7f526b55a3b5d4ea850db182a8d3cd07f100f0c7f19751f6aa598178da62bb73ca34f47613300d1ea0abf4096ed4b846f85fe4d61980ef0aea15deee6550cf1946243decb4b10a4daac2928236681914f33f24d9682d730661abd16d92480c7d860170db926813b147e25792180802bc12f075fec8bbf530993036d73b3d78cda0bf56d6473694302d7b1dc0c4d775421416e466878f7638c9e8c39e1ca8cb0248701200767a2cda1bf36be3e2092234298478a84ab9b6d32ac780e2ccb7c39984d5318506a77f20d4a2efed54cad7c3c6f8dcc93ef5cc3614798cf07c717c2e0ec3f2229fb8d7be57bbc96328ff29797873838e3dc74afc954615cad7739600e1be8a363ec68c880f622f16c491d0c609ab73efbf06edb253e3e058e64d056db5f8c4291fbe05514e95e9eecb925e263741efce49893e769a872eb49cf79e3800434b86fc547316da132a2feedada9222480c11013a89a3baf99b9398c2bdfff82615189ca43bb16b46ba638101009489c138adc281e8ef155a1f9c406c0526fcac2de06ae192110723f6fd2b68d63154de81887320e2ffdf8c90a967b9c668022c148adafe5391f146a61854b5a5ed04064b4fc69d1c2a0b6f3117b8aa1dd6553834f82e4b52a1b7207a1440c355244576f999bd1b3a9ef7b8389dd95e8eba7badb9ed7876b5346910a99e5590e8423387ec6cd5f1702d75c2536bc74ca96f869ed6dafe9e096d65bc48da8d6cb9ec7a2c045bcb9c5ead6b7562e8a0b972ae69cb22d1024178332212bf47df087c4400264b0276fd5107b7bfdbd2c5cd70d425bca7950b9d6c0399b3cb9cccf4c4e1277dc9029346280d007081e766222959e58d9dafc7d6240fb16b7b444a66c9af00e8ee06b0ed9be60aecbe94c53c74cac87d374bded09f889a0a648d70f9b3fe86e08246615aec7d27e5115b4dfb811c5692cb363a7d6e8dc2720ec61180cebaa826057db84e05b53cc3b4396161332bef74e2deb8d94f640d6301491fbb6630c7cb36fdb3247cebd2eef8b551b891f5e39c4c41cf514c671a1478fc744fa1a2d06014407ceeae7e1d2dafc646209330b3458763e602cc8b20e0a53675ea80d2f4fe462093b5713334e69e149251063dc1abb10a034bbd32505a63b7b2777c39a6459461c7cf788cacae033bb95c378b07f348ebbb4ebba9c3812304d1ef46e948a84ae55c559a024aaf7da21062f5a5a0b2b407c91fcf386f2f87457937e83305597d5cb6b48977f291c462914fd37fa7c4120dc5b53eea7bf4da8a262363ac0bb84c80d41c463a10c9be01850f31b342d1677f9ad470c69151150036288ea36562a3cd70c42128875d05a789cf80c6e1bd3fa121f3ff70fbf726353a61f5bcec2722a55fa0c964be2cff42b625e162dcf4aca1de4635830ec8eb231d28e9e6d46524c061b2512cf3aabde0b53bb8a3cee5eaef3fcf80a0c5c445047bec0e9737fe954d00032dd7fb51f85de092c1d60a28f6756ce5572954affaded8e7754bb3bb446f263de9b4eb88f83c154031f8e75f320dd77c03e19d564c58cca19f6a12f35f1ddd2b7c316b17eceb517b5ecd871e82498366c200bf92890b0fc94e6fd2a40d7fa327cc3badd21728ffebe651ff282a809e2ee8ab89b2d9a46a0e93d4a5f2c7890b16bdf6aa56c69f5797f88968b34d571e4120dfeddc668af549f059310bd4fac6c2e2703712387c226082743002126aa494d3d39403a1500d527e80afcfc4ef8fbdd90a5cba8beb72af2cbd3a24730075ff29646f23ba703b692467435f3a0dfbcbc35c692024391f9f4540789f9c5e3ecf3f139e0271cf6183f660c9d462a23d4484bd6479fda765ae17fd0c19dc4d274f673a3afc9b171847c388a24125aa99e8d029184c644b9669dd59e700fc14c173a403c864846d8cb6e30258fba0affc86fb200e4c1c93785fd152b09a57461fa9b79c12114d62d5d24d52ccce3f16fff599f7e65da71b5c1507101a84ae10cb605a1d951089ca9f7b248c979489f14f17ba955a8ded9201a1999bc7eddd82d7c7c08078cd5b988f9e804031b299aaacb8446a8e6b7f77eceaef900be5129d1995fb51a0bf58b2b30b9387cdae5fc81f2d0cc665586533a0e1d12644c1dc89a5cda754fe3744b10fd55c387586a5471dbb393a2d2d243f806d1d6639aaded4e26c9154ad7e205a61ad43aaa21b6d0c225ff7c771a4a9fa9fe14ad71e087684963db480b48bae38085a6b04242ebf3ceef0b426673a3e513dfaaa9f7c4ee204f0cf6bdff103708274804fb2be0cc05ec6129f98ae86443aa84459b1e843ebdf7f7c27c1e45450987f86f7085145e7584a4d80b2ee0a6f2ef496a9577bc343abfb561feea7e03c7f03d161bbcc5ff4d54eb41445a58e4d9e0ad1740ceccaa1606e53f857eba6e5ba33a00cab8e270bbbae53f82b9865b9ad13ee6c075eb4fc1c106fb803fd18768f413b59c2341965b5c5e6d0a824b8e7579d995d93aff72efef607d996783efcd04133b676190b4ae8a062c451abc5d79c48075ec4ecc3ddc3893d9b261794b8198971c74f710da4a497c4ddc967e6fa43bae32173adb48611a0f6338cca12f4b74c1e61f9a6e2f705417047113a3f7620e83518a528972f343b1854234921ab7abb6162edfeb65cdecfb42bd500153d8f22b9c1c7525a6bfe2e06263d9b1f56a5be9ea423864be6282404398b3ae2fbb647978303222e930fa7b187bbaf8a228875b71f4b99a16ddc93cc7f373a0b2cd3e9e12a48bcc873b548f2b8dda92afbd955eed4cc078d799ee7697407a408395e1a05f2bc45e66e2b6466f00b3ce5c78e7f604138d69dcafb12a9679e61a433d3a4494b7447e32931161f0366b9ad8287d300"/4096, 0x1000}, {&(0x7f0000001b00)="2739e97e15b09d332366d1fd72dace7e64f78e22af60e33c1f075d663ac9479077856d8a7bcea72a92960ba4047901d23484abbe3a92167d88bf98ae4e4e6bee220c7da53eacbc98e4304594981e44a6bb836c9cd3e9c546487ff086f6446d8e2ccedf4cf0755282516d612ce8d8c89b98dd8b3e4b6109d95320709f3d656464e3bf678e5e25ce97e14519f5870875c32bfccf7c65d984ed16e91a0411b39ba832e16a82ff5cd8eef6eedc5f8220579b9a7ca55dacffac713bab8ea0543893e9557c273ac8e78b6664ed64a31eafa0bc10f26df81b0e2a585bf5a1b9e5110e43022d3eb878e519df15ac14bc2528b8bcfb1949c6", 0xf4}, {&(0x7f00000008c0)="0e7e9e2436a4060417d33bb877e52b64a9f4064c8d5847ce12bec99a57d10e0888d90820059e7e855da570b23d76a88c7ba1d8b47154a6d0a64474a27df933d1a44209254ce05e3c36eb9a3970a50a3a3a366f163647abe21be6500a73ad174235d7e10187c84f955db2056b0dfe983b710b201b398d54095951099168898b9c69160987eb9daf273aa93d812203282a70c04e642b835fd9", 0x98}, {&(0x7f0000001c00)="d0088491b198a9d6fc6614e8021ca5220211ecadeabf2d8d0a02392958c43f6216a69a54802110a26897c1e40e5652f65b7512d8d5ac87793bb05a1500e544c07b5540ee242686bb932342c3d22607f61b91fd549a653b56abe85069153072963de66a00a1c8693734", 0x69}, {&(0x7f0000001c80)="74525d68f7dd92d16ad21aaa710d17cf4fc1e046f1016a9e080dd3efe0a17b2c14d6a0386781c14515ad9113663a0a903bcb44139c16a466b3c961696734d295dfa7440f", 0x44}, {&(0x7f0000001d00)="60d1334975dcca952bd2831a15cb4f90a971f4e8b9f6e9f96ea00954d0ce20244a4a669ba8df736197cdfa5540281b6de2d45a7869865502d5e481dfbe940c3731b62e0021ae8c659e815cbe55fbbbb41aa6b33058fcb27aee4efb1d960e0fb5412a96c9ef6a9584588ebd9f12bfd6fab2f4333e1e130047a7b885921eaf061bedd6d28f71ce50708a80a633dd35a6d71bb128cdf8187915be79e3a5ab4eda7b0f86066b9fb01a2bb886fd22d773816a8242b14e565abd9beb114812dc193c4242ee97b64597b6aacbe00ece03c6a3dd3e42a67ea84bc646abb8a43d0780b9e8f6056dfb3893fe511be924c90d318290eb9e71a332cd4c4c18d43ef982cc15fbbd46c97576258c5d8b52dac08dd6c1e7bf6f50d16dac80d09a43a5bed38db17bf45266fb34464f31c8815ed2ee27a02e2dd3246ebcad7df2e7f4736a077e9ec4fa5e76322ddbdbfcd37b29f5813c8d4008d5f837256e8eeaa1d56df7f7c6a1c6ef55dc23468f445e5c09344b2809bc27f8760177ca7733e41ab640c30a1fbe6e3523ff545957a1545001098f24873992b756ecdb165d6bff98c42ae3b5ff39cf018b727731239bd8eed0924c76b3d26c2da730dc6806c5032ed42c2025e8602f55416f3f585894e6f4b050aa2983b390c364fe3a1fdc599bb82232042a78d87bb2ebca1fba59a5db4691fc64b95dc1a80d1c8b288e5bd6c22442f11be59e2ed72a51d9c84f1b1db5614946d4366836159c85af01a90099d1d1ddaf42b76b6992519289fb427bc450205b23ebafd4f75084012656dbd6c27c459f21973a6fe8e544da6438d5f6b80e2eb33886071d220577c4bfdf9961ad71db7ac039643664ee113b1e6e14f003babc24f083c347564a38e33d951a3089b2ff655d051a482d06725e12a9573ed8cab1140b81eb268da042909b69daaf5a7639d1e0c82330be6a48e6560e8aa3c20a81f5827fdf70b45375b5bbcb73e49d8a26e9ed285b86681496c3702047fe8b1e91eb733edffbe3122389808e5259a03b9e7a436f5a309ea16795f37008704de41b5f55103ad04ff32ddab8c237336e64542a37a8b293d8d02f13882bd9a9878e482265c88e6609b01adca02f220cb609c6aa5b23ed73ab7904343cf49860ab65b2dfacb2095b48a8d5f711314608c17008c4992b6c69bded55f1fd5feada28de6569682ec8bcffd483b57d96052143d0e36cacbb531c19df4c4139360426bf38c3b63b4e0f251d245d620c8c1a95c19efd61e2c31075c24a9d9ede72dc696251335d384c2cba775ad997ccce57d430c0bf247f13008aea87feb9c3c944b6ac2ef163c76105b071c73f411d7c7c188d63e0efed7a458037a3a852d8025ab843fa935b35163118ad618a983b3a977ae2a5d5d2ae7e5d9e69183523ddd9e6f4adf03ca80967f693c256f853710ace7470e5a845420a0f739f517f9f52eae5d20b5d34e776ad5c850005785ff0f1319eacb56274428ab0ee965ef28a1bf888b7f2abb9165584a6a1046fdd036e5cd1f2fb6387e5e4d62be1d7fa939f16cb8aece40801052852882d12ca0ae0198cbac09c4c2057854ecdf6942a265d7dccb223d6a41a2a41e3248931b665fb42e3369df8901672f8f3b978b86fb6e65d4f08dfe5e1f9214d919808c5474cc3f5ba489fe6a7f055f472bc15a0bb353ed0a2c50fe35f73f8ab86302290614bbe985d2bf12788a9b29c2c98699e83035eaf316c80d34987d072b0c29bca6f87e6e8f333e36a4260f160505f5f1e1fbf9d4293796f4494bae1549aa4ea3eaca9d18cb889406ae7c21d712c98b5fd0b3c4e62fbad907ff2db2ac4217bc3c615073b6bc5ce835c32472210d233c59996c9e97f37efbcbc3ea1d6b222859300b9e872186e5228f39125fd85afb445426b04d07377cc1ed616c3ddf51ea77bd504d54c624efef950393238aedbe661fe41de930bf335424ee46e851f13b4d6a6ae06c68da0d8682c9d4e764d2f56cf0236eaa2f0db43e102ab70c225014e01208d67c818a358ca4feda5924db9fb55f61a384922df94707e4c115983bd2fbbea2470b3d5d5c408e0c6cb20b3fea34a02dca385f49d83ea2aea3ee500ac51b58dfce510ebcac62d1ed0ab6a94822685e5670e6558c55d95359ea0983d8d0bd6b9f8b78c6b9967a92f03b939f454248e723d656c9ad16e356f5c4a8a7f76dc097d3d4c59cbde143af45fe1c8a509a2b3676f68df3ec57d127ef08e7c3841eae026232e052416b2d26292114f5410c0efac36dcc54cfe6200192f3a2e647c42779b3abf76db41ec3d047f5c05e8059146cd54a4273648210a568520a9e50a60e66676a0ce843d92e2f8b159b110d0014b35983822bf1657cb14e6b3a3faf4d05a3ee03959fec1ce3e458a90549951e325fbb42d7d93a2903cd251f3cee5d6e70d2000fb52d6dd9f31bc9ea396a751b3c3e61081ee7f87f99badfaf00c03d788d40068d8e5682b3b7c7b415d37d8b9250a2544e24260f3aaac0e17f2f8fc2c8bebcc322b0320a064433d25f3950bf9a2ab92ef37872e30a84a08a3fc65c02577b5f0befcfec9c5c395be180ee7b617e07b8c809bfc8b385fe7847b30537867a56d23ee5550d372a9e854dee2efcd98a10900e5c170989d86f6661d7365e9f8fbff9b5507697ed53fcde7dc4dab5bfc323f83d789217188d26b2fdfa9212763c9585cd4900fed05cb7e3d9da7307b19cff97d305f1f0674fa4f2099870cd3966402041e0b5090113f4a5d3ae33953af3a13c543b0add1cbe0a4550867867240ccb82ad1008fcc929ce1760589a1a9cb37e64efe9406450b20ee162a24c2aa5c285a71edd60f8e58f02638fb703e3c59a78b0aeb0ac8c1ac0d3e27eb03833927ba46978c0cfae6b8bdf99ab4aa3fb2f7818106047c4ee3b411e28f4e7f77523ab58dcf02a20c5df3398911d4c3af64636f79929344f09b4db0ee80fcfd0e9308cd6d78729186c752667db82fe6c4d69fec8bd53254ad153007de86f477207dd86e5b02b8722c0aff46b5fa1f5667b90e866e3d00c2a13aec0bae293266cc223806af7cd031550086c3c6cb10a74e2bca1730c7c4b4ced56a174a6ecc1ae07266faf61dab358435b8465ce131e8dc1c94851139e1e3574ff211587a986948b69527d54e85b98cefbd09e523b10e4f8b0487990dcff836d7ed9cf26697ae6fab09b29e5defcd1843d8ee189f6fdc3592aba75df3a90f9525e624050ceb9f6b320db3e66b4445098a8fea53c8b7409dd41c4db6fac50aa09d76f58f4b8d828f159a05a2820157522b82e6ce8132e526c805fd9c9d51f12294568ee68301e1c687ec3870e16a79ac1cd6c92b2fde33d6c8b912f2b25ab5f17971fe7495aa28e2f1618ab8bd0035744e7a7345047a8982192084004a393fa05db34a4f59f684178c31c4772c39fe8b67fe82c9c738191de402b4933018ccbd8d606e4742fb6420b6d0373a1f1c1487407e536b2850bbe878146ffbdbde1ccd21bbafac795497d2d518942066404b612c8ebff835c744c445e9d5aaadd8a72b14c12938c5cdd336b3555ce36e9ddfe53ba36bda900ec72a897b032fcebc0fd38d3d270eb1277bafcbf7aeac7cfefa9fa66431823ff025f21b6c2079291cf116d46a34405c2f3eb3dda1d47887fa54d6323a576c94d42e2b5b4c8054a016079d5e4b70fcf9a6f58f82f0606f8973607f7a847cc6e2f43f1d202e78435bec333a592914f11633616cfe83ffaa7fbe559baa376b982940e9dbda73e291bd3a4e1929605d029383f1dcbccfad5403ec459c94963c5c241da6e87afcaa560a702a9ad817ec03c5c547ad25b1702c05c19e930ff3dd267728c03bc0a25b0c6c73ca2ab7485dd960a07138c1e76f71b34d0b27cd6871a9ccd0bc51e15c86d12129e2854e383de92b9c9466fc4b99517bde2ea8b2d888f5496d1cfe00ca8623a8226cb45052eddaa6abee3a91837120db0341448cd39a08409a0498445008e88d5f554992b7bcab1aa938dc8843426fffe3a9e0d4dd5058f26a7fcab7643be24780312cc3cf2dbe034344da340deadd436d2f4b754c64106bd5db873b2a4e5318990985669f8a89b28160722ad414e487a0f5bdc9437cdca956d035884b3af96f895ef312a0c6b626abd0ff76df156492148c7a9b0f2edf3579a9b9e2ba6c4aa6f40edaf3227cc05d05e32dd5b26c8cc1831d4670a2421be1f89c0f6637a42286bab318040e6873d1a00bb19c4b5b190da2e819a52b8d6154ea228b5945e7baabf2ee68da18b7cba051e74982a5d3b30b20b44a84d101042144b97868b0dfc96a479cbb082020caf0ae8dd3ce3805a540bda9ad33a3be162b6293664f007e4dfff8d162003b80145dd86dd9b1d9716f28d8c182d752b0f2735e6d7ec55deeef48a60fbea1fe161525c5a1321f1348a98027666dcf2fa9bdcccb6dcd56373cb99a5241bc899c5b1537e785a67fead6ca511339afe99722c979d7747bde4b4d3e0178b7ca28fd84d90ce709aed75dc4c2f4c45f902d6a0c5b8b55d62b4cf633b57a9ab1eac50c0b27852a092caa4229f6be0674895f6fe85eb59c23035c4ef5c878f4bd76708593594e42659a9365e123e0dc565d4f6fa791b3ba7ce5247fdc18535bbb1279022e21e545c6df5a069aeba7f18f82ff1774dbe8473a61452dfcdd2435ba8c6170d4c7c968f2df2ad8dce58b09dbacafe64698f3b1e94d752a4471190be761f6907d1eb69c9b544ebe72319a0a1f9eca72e54ce419294e3537ab92980b5e10ba153bdb8f08c56aca5eaf69ce764ec1962af3608242c3a2fda537f0cceddbb7c0bd094f68ba05ff51c75817bddb97cd8f23a59cb03b80caf687d2632aa75ccb67a6433c72b2b4fcbe21bb4d21aa588ca8785576448bb1c113123f0b4225f123605a280f9fcf2f0b3936d47623aae52637291c77fc60b24456f895428fc78cdb29e9f99be0150e4dd870327d696eb287baec613cb01e78ede6cd5f51ac3fcf68fd1626cd3c83baf2c43ae46f2ddfd65721a7e2639b8fffa899c75040e0b5cb82a57bd7d1e1cc751014b2babe61417b2a2fa48bb5c066785816cefa63a03e21e0ba18591738ff638698d144511401258d8c84f2d208d927f49935791e248972f9b6823e869ecc62abf408eab6b24c55e2e1bc195c2049802e1aa92819b16a3256e1b6f4e40e101592da024b78ae759a0f5a7ed435b2fb2155ffcf14570f8e3d98080f3702741d1531a367f6fb3cec29341d1899b69be030795aad1103f33068fa8abe8d7b3ce5bed0d55bbcc033a992c1530918f4da0d9d864376f06ec965666ec3923f545f8107312f2cc3e755c97776724bb272725591ed9925af34f52038da843ec66e23b9cd4f4baa8f53150cd0fdd20972b12313af06e8f8f05f09deca9c632dcf678da4bba9eac3bd0e46553f2af18dda8c6e04d0d15e0a7a33b31eb8ebafc2fdd9f725000bbef8f2db40f69c715062a90cd2b5e4880575e997add0139e90baa5d817ceb882fa3421200fb30c72102a5e26cdd82ea8d9f1e60feb6cd9b652b584e3c51228ab06f78fb4228c16e13c284fe895f75e8bbd1e74648495d7919fd89c8bd14d506f137201af612f2c080bed5c1c1b9e6c4a684efa8e069bfce34959f428be614afbd70916df7942f2ff247d1e10be0087bb760c4c88ad0e60527e5d5980afe00cef4d9c8ead4a6032f692682ff090df4bfeb80190ed8eb294df1cb58825252652500f5473d0de4eace052dab50af9d57be0628bb6d27906303058fb191281521fe83dbd6f1309ef0502c580a5cbc83fe812a280054dd6d3", 0x1000}], 0x8, 0x0) pipe(&(0x7f0000000480)={0xffffffffffffffff}) vmsplice(r4, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) read$char_usb(r4, &(0x7f0000002d80)=""/4096, 0x1000) ioctl$VT_ACTIVATE(r2, 0x5606, 0xfff) ioctl$TUNSETNOCSUM(r3, 0x400454c8, 0x0) ioctl$TIOCCONS(r2, 0x541d) openat$selinux_status(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/status\x00', 0x0, 0x0) 16:21:10 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) r2 = dup2(r1, r0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000300)={0x8, 0x0, &(0x7f00000004c0)=[@acquire={0x40046304}], 0x0, 0x0, 0x0}) [ 1780.823666] binder: 11757:11764 ioctl c0306201 0 returned -14 [ 1780.824674] binder: 11756:11760 Acquire 1 refcount change on invalid ref 0 ret -22 [ 1780.842910] binder: 11756:11760 IncRefs 0 refcount change on invalid ref 0 ret -22 [ 1780.851473] binder: 11756:11760 Release 1 refcount change on invalid ref 0 ret -22 [ 1780.866642] binder: 11767:11769 ioctl c0306201 0 returned -14 16:21:10 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) r2 = dup2(r1, r0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000300)={0x8, 0x0, &(0x7f00000004c0)=[@acquire={0x40046304}], 0x0, 0x0, 0x0}) 16:21:10 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) r2 = dup2(r1, r0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000300)={0x8, 0x0, &(0x7f00000004c0)=[@acquire={0x40046304}], 0x0, 0x0, 0x0}) [ 1780.867078] binder: 11756:11760 unknown command 1850775417 [ 1780.881136] binder: 11756:11760 ioctl c0306201 200000c0 returned -22 16:21:10 executing program 1: r0 = syz_open_procfs(0x0, &(0x7f0000000080)='net/dev_snmp6\x00') socket(0x10, 0x80002, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) socket$nl_generic(0x10, 0x3, 0x10) syz_open_procfs(0x0, &(0x7f0000000980)='net/sofH\x16tnet_sua') socket$inet6_tcp(0xa, 0x1, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) request_key(&(0x7f0000000000)='user\x00', &(0x7f0000000040)={'syz'}, &(0x7f0000000a80), 0xfffffffffffffffd) socket$inet(0x2, 0x4000000000000001, 0x0) perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x1ee6b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000000c0)={0xeb, 0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB="0563044000000000046304400000000006630440000000007997506ea39438033ada635f7cd4c9d1de50cf51e7a773b356e7348d3b19cbdc76ed97a6a08da8997815ea9e6d3b6a1d5a7c1cdf78337a6166cfd70cf41b6cb958e69b7dae4fe74a09c8e4db4c323ba219438b49c2f1736eb01b18c098512160aad1c0394bd4c9b785ea39e6f5b1f809658351bcb5f101899004e6a8542081ceec87f1a675538ce9264c7f128392c875c23507fc8a694ef2d13b127563b2da420a3df952f062dd3d46202a3466fa9a9c985dde3cc577a1fdf40687931bbc4303dbab0e28bb6757bc226d9bba4db1603de1a9c7"], 0x1, 0x0, &(0x7f00000003c0)='L'}) r2 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r2, 0x40045431, &(0x7f00000000c0)) r3 = syz_open_pts(r2, 0x0) r4 = dup3(r3, r0, 0x0) ioctl$TCXONC(r4, 0x540a, 0x0) 16:21:10 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) r2 = dup2(r1, r0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000300)={0x8, 0x0, &(0x7f00000004c0)=[@acquire={0x40046304}], 0x0, 0x0, 0x0}) 16:21:10 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) r2 = dup2(r1, r0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000380)=ANY=[@ANYBLOB="04630440"], 0x0, 0x0, 0x0}) pipe(&(0x7f0000000480)={0xffffffffffffffff}) vmsplice(r3, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) pipe(&(0x7f0000000480)={0xffffffffffffffff, 0xffffffffffffffff}) write(r4, &(0x7f0000000340), 0x41395527) pipe(&(0x7f0000000080)) socket$inet6_udp(0xa, 0x2, 0x0) pipe(&(0x7f0000000480)={0xffffffffffffffff}) vmsplice(r5, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) fstat(r5, &(0x7f00000001c0)) pipe(&(0x7f0000000480)={0xffffffffffffffff, 0xffffffffffffffff}) write(r6, &(0x7f0000000340), 0x41395527) fsetxattr$security_selinux(r6, &(0x7f00000000c0)='security.selinux\x00', &(0x7f0000000180)='system_u:object_r:apt_var_log_t:s0\x00', 0x23, 0x1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000300)={0x8, 0x0, &(0x7f00000004c0)=[@acquire={0x40046304}], 0xb19b868c1a8b328c, 0x0, 0x0}) 16:21:10 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) r2 = dup2(r1, r0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000380)=ANY=[], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000300)={0x8, 0x0, &(0x7f00000004c0)=[@acquire={0x40046304}], 0x0, 0x0, 0x0}) [ 1781.063255] binder: 11786:11789 Acquire 1 refcount change on invalid ref 0 ret -22 [ 1781.075457] binder: 11786:11789 IncRefs 0 refcount change on invalid ref 0 ret -22 [ 1781.093101] binder: 11786:11789 Release 1 refcount change on invalid ref 0 ret -22 [ 1781.104441] binder: 11786:11789 unknown command 1850775417 [ 1781.113137] binder: 11786:11789 ioctl c0306201 200000c0 returned -22 [ 1781.251901] audit: type=1400 audit(1568823670.708:121): avc: denied { relabelfrom } for pid=11790 comm="syz-executor.0" name="" dev="pipefs" ino=181741 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=fifo_file permissive=1 [ 1781.254140] binder: 11790:11803 ioctl c0306201 20000300 returned -14 16:21:11 executing program 1: r0 = syz_open_procfs(0x0, &(0x7f0000000080)='net/dev_snmp6\x00') socket(0x10, 0x80002, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) socket$nl_generic(0x10, 0x3, 0x10) syz_open_procfs(0x0, &(0x7f0000000980)='net/sofH\x16tnet_sua') socket$inet6_tcp(0xa, 0x1, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) request_key(&(0x7f0000000000)='user\x00', &(0x7f0000000040)={'syz'}, &(0x7f0000000a80), 0xfffffffffffffffd) socket$inet(0x2, 0x4000000000000001, 0x0) perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x1ee6b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000000c0)={0xeb, 0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB="0563044000000000046304400000000006630440000000007997506ea39438033ada635f7cd4c9d1de50cf51e7a773b356e7348d3b19cbdc76ed97a6a08da8997815ea9e6d3b6a1d5a7c1cdf78337a6166cfd70cf41b6cb958e69b7dae4fe74a09c8e4db4c323ba219438b49c2f1736eb01b18c098512160aad1c0394bd4c9b785ea39e6f5b1f809658351bcb5f101899004e6a8542081ceec87f1a675538ce9264c7f128392c875c23507fc8a694ef2d13b127563b2da420a3df952f062dd3d46202a3466fa9a9c985dde3cc577a1fdf40687931bbc4303dbab0e28bb6757bc226d9bba4db1603de1a9c7"], 0x1, 0x0, &(0x7f00000003c0)='L'}) r2 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r2, 0x40045431, &(0x7f00000000c0)) r3 = syz_open_pts(r2, 0x0) dup3(r3, r0, 0x0) 16:21:11 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) r2 = dup2(r1, r0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000380)=ANY=[], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000300)={0x8, 0x0, &(0x7f00000004c0)=[@acquire={0x40046304}], 0x0, 0x0, 0x0}) 16:21:11 executing program 2: r0 = syz_open_procfs(0x0, &(0x7f0000000080)='net/dev_snmp6\x00') r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r1, 0x40045431, &(0x7f00000000c0)) r2 = syz_open_pts(r1, 0x0) dup3(r2, r0, 0x0) pselect6(0x40, &(0x7f0000000340)={0x9}, 0x0, 0x0, 0x0, 0x0) 16:21:11 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f00000003c0)="11dca50d5e0bcfe47bf070") bind(r0, &(0x7f0000000000)=@pppol2tp={0x18, 0x1, {0x0, r0, {0x2, 0x4e20, @local}, 0x4, 0x4}}, 0x80) r1 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r1, &(0x7f0000000100)={0x2, 0x4e20}, 0x10) connect$inet(r1, &(0x7f0000000cc0)={0x2, 0x4e20, @local}, 0x10) setsockopt$SO_TIMESTAMPING(r1, 0x1, 0x25, &(0x7f00000010c0)=0x19ff, 0x4) sendto$inet(r1, &(0x7f0000000140)="b0", 0x1, 0x0, 0x0, 0x0) recvmmsg(r1, &(0x7f0000003b40)=[{{0x0, 0x0, 0x0}}], 0x1, 0x2000, 0x0) 16:21:11 executing program 4: r0 = openat$selinux_avc_cache_threshold(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/avc/cache_thresh]\x91d\x00', 0x2, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) getsockopt$sock_timeval(r1, 0x1, 0x37dc88f1b47b0bb6, &(0x7f0000000180), &(0x7f0000000280)=0xf) r2 = socket$inet_udplite(0x2, 0x2, 0x88) r3 = socket(0x10, 0x3, 0x0) ioctl$sock_ifreq(r3, 0x20000000000089f0, &(0x7f0000000080)={'sit0\x00', @ifru_data=&(0x7f0000000000)="b06f31673d3da2b793d4f9a507e3c9133ba7ce8f5e6e538ecf8829b08f7f4aae"}) r4 = eventfd(0x0) write(r4, &(0x7f0000000640)="b0f2b5e756f08b1eb08abf708dbcc9e8273492d170242d4d9e2cfb904c099eabdc3211ae9523bc21ba3337860b942307589e589a763bb08840b31123589ccce57e9d951c458885b2b9e53a31b775f7e58a78bfac3e7a6fdbaf4fe8090bc51084b69ab1a809c4fc7702275a9297bf32525fad8eef2def39e5f7f2a4eece0e47bcb28a18df919a853e9c95c862e256c037645b0d6489c8d471eaaf3f8827eae0dfd67db75778baffc2", 0xa8) clock_gettime(0x0, &(0x7f00000005c0)={0x0, 0x0}) recvmmsg(r3, &(0x7f0000000540)=[{{&(0x7f0000000200)=@alg, 0x80, &(0x7f0000000280), 0x0, &(0x7f00000002c0)=""/150, 0x96}, 0x84}, {{&(0x7f0000000380)=@ll={0x11, 0x0, 0x0}, 0x80, &(0x7f0000000500)=[{&(0x7f0000000400)=""/117, 0x75}, {&(0x7f0000000480)=""/103, 0x67}], 0x2}, 0x7}], 0x2, 0x2001, &(0x7f0000000600)={r5, r6+10000000}) ioctl$sock_ifreq(0xffffffffffffffff, 0x0, &(0x7f0000000000)={'vedh1fto_bria3e\x00', @ifru_addrs=@hci={0x1f, r7, 0x1}}) r8 = open(&(0x7f0000000040)='./file0\x00', 0x40042, 0x80) write$P9_RRENAME(r8, &(0x7f00000000c0)={0x7, 0x15, 0x1}, 0x7) ioctl$DMA_BUF_IOCTL_SYNC(0xffffffffffffffff, 0x40086200, &(0x7f0000000140)=0xb) r9 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r9, 0x1000008912, &(0x7f0000000100)="11dca50d6c0bcfe47bf070") setsockopt$IP_VS_SO_SET_ADD(r9, 0x0, 0x482, &(0x7f0000000100)={0x89, @multicast1, 0x4e20, 0x3, 'sed\x00', 0x28, 0x4, 0x48}, 0x2c) ioctl$sock_ifreq(r2, 0x89f1, &(0x7f0000000080)={'sit0\x00', @ifru_flags}) ioctl$TCSETA(r0, 0x5406, &(0x7f0000000080)={0x6, 0x800, 0x200, 0x8, 0xa, 0x100000001, 0x23c, 0x2, 0x1, 0x4}) ioctl$SNDRV_TIMER_IOCTL_PAUSE(r0, 0x54a3) r10 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r11, 0x8912, 0x400200) rmdir(&(0x7f00000001c0)='./file0\x00') ioctl$TIOCSETD(r10, 0x5423, &(0x7f0000000040)=0xf) 16:21:11 executing program 2: r0 = syz_open_procfs(0x0, &(0x7f0000000080)='net/dev_snmp6\x00') r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r1, 0x40045431, &(0x7f00000000c0)) r2 = syz_open_pts(r1, 0x0) fcntl$getownex(r0, 0x10, &(0x7f0000000000)) r3 = dup3(r2, r0, 0x0) getsockopt$sock_linger(r0, 0x1, 0xd, &(0x7f0000000100), &(0x7f0000000140)=0x8) ioctl$TCXONC(r3, 0x540a, 0x0) pselect6(0x40, &(0x7f0000000340)={0x9}, 0x0, 0x0, 0x0, 0x0) 16:21:11 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) r2 = dup2(r1, r0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000380)=ANY=[], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000300)={0x8, 0x0, &(0x7f00000004c0)=[@acquire={0x40046304}], 0x0, 0x0, 0x0}) [ 1781.777781] binder: 11809:11815 Acquire 1 refcount change on invalid ref 0 ret -22 [ 1781.803604] binder: 11809:11815 IncRefs 0 refcount change on invalid ref 0 ret -22 [ 1781.828210] binder: 11809:11815 Release 1 refcount change on invalid ref 0 ret -22 16:21:11 executing program 2: ioctl$sock_FIOGETOWN(0xffffffffffffffff, 0x8903, &(0x7f0000000180)) r0 = getpgrp(0x0) r1 = syz_open_procfs(r0, &(0x7f0000000300)='gd\x93\x8e\xe2/\xf4\xb4') r2 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r2, 0x40045431, &(0x7f00000000c0)={0x3}) r3 = syz_open_pts(r2, 0x400) fcntl$getownex(0xffffffffffffffff, 0x10, &(0x7f0000000000)={0x0, 0x0}) ptrace(0x10, r4) r5 = dup3(r3, r1, 0x0) pipe(&(0x7f0000000480)={0xffffffffffffffff}) r7 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r7, 0x40045431, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1}) syz_open_pts(r7, 0x0) close(r7) ioctl$RTC_IRQP_SET(r5, 0x4008700c, 0xfbd) vmsplice(r6, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) ioctl$TCXONC(r6, 0x540a, 0xfffffffffffffffc) pselect6(0x40, &(0x7f0000000340)={0x9, 0x3, 0x200, 0x0, 0x0, 0x20, 0xfffffffffffffffe}, 0x0, 0x0, 0x0, 0x0) 16:21:11 executing program 4: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$VT_OPENQRY(r0, 0x5600, &(0x7f0000000000)) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) fcntl$notify(r0, 0x402, 0xccd166fa4d0c4114) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0xf) 16:21:11 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) r2 = dup2(r1, r0) r3 = socket$packet(0x11, 0x0, 0x300) setsockopt$sock_void(r3, 0x1, 0x24, 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000380)=ANY=[@ANYBLOB="04630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000300)={0x8, 0x0, &(0x7f00000004c0)=[@acquire={0x40046304}], 0xb19b868c1a8b328c, 0x0, 0x0}) 16:21:11 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) r2 = dup2(r1, r0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000380)=ANY=[@ANYBLOB], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000300)={0x8, 0x0, &(0x7f00000004c0)=[@acquire={0x40046304}], 0x0, 0x0, 0x0}) [ 1781.881585] binder: 11809:11815 unknown command 1850775417 [ 1781.898280] binder: 11809:11815 ioctl c0306201 200000c0 returned -22 16:21:11 executing program 1: r0 = syz_open_procfs(0x0, &(0x7f0000000080)='net/dev_snmp6\x00') socket(0x10, 0x80002, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) socket$nl_generic(0x10, 0x3, 0x10) syz_open_procfs(0x0, &(0x7f0000000980)='net/sofH\x16tnet_sua') socket$inet6_tcp(0xa, 0x1, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) request_key(&(0x7f0000000000)='user\x00', &(0x7f0000000040)={'syz'}, &(0x7f0000000a80), 0xfffffffffffffffd) socket$inet(0x2, 0x4000000000000001, 0x0) perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x1ee6b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000000c0)={0xeb, 0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB="0563044000000000046304400000000006630440000000007997506ea39438033ada635f7cd4c9d1de50cf51e7a773b356e7348d3b19cbdc76ed97a6a08da8997815ea9e6d3b6a1d5a7c1cdf78337a6166cfd70cf41b6cb958e69b7dae4fe74a09c8e4db4c323ba219438b49c2f1736eb01b18c098512160aad1c0394bd4c9b785ea39e6f5b1f809658351bcb5f101899004e6a8542081ceec87f1a675538ce9264c7f128392c875c23507fc8a694ef2d13b127563b2da420a3df952f062dd3d46202a3466fa9a9c985dde3cc577a1fdf40687931bbc4303dbab0e28bb6757bc226d9bba4db1603de1a9c7"], 0x1, 0x0, &(0x7f00000003c0)='L'}) r2 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r2, 0x40045431, &(0x7f00000000c0)) r3 = syz_open_pts(r2, 0x0) dup3(r3, r0, 0x0) 16:21:11 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) r2 = dup2(r1, r0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000380)=ANY=[@ANYBLOB], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000300)={0x8, 0x0, &(0x7f00000004c0)=[@acquire={0x40046304}], 0x0, 0x0, 0x0}) [ 1781.967296] binder: 11843:11847 ioctl c0306201 20000300 returned -14 16:21:11 executing program 0: r0 = openat(0xffffffffffffffff, &(0x7f0000000040)='./file0\x00', 0x24120, 0x104) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) r3 = dup2(r2, r1) ioctl$BINDER_SET_CONTEXT_MGR(r3, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000380)=ANY=[@ANYBLOB="04630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000300)={0x8, 0x0, &(0x7f00000004c0)=[@acquire={0x40046304}], 0xb19b868c1a8b328c, 0x0, 0x0}) 16:21:11 executing program 4: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) lstat(&(0x7f0000000000)='./file0\x00', &(0x7f0000000180)) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0xf) [ 1782.077968] binder: 11860:11863 ioctl c0306201 20000300 returned -14 [ 1782.078770] binder: 11855:11856 Acquire 1 refcount change on invalid ref 0 ret -22 [ 1782.127297] binder: 11855:11856 IncRefs 0 refcount change on invalid ref 0 ret -22 [ 1782.142633] binder: 11855:11856 Release 1 refcount change on invalid ref 0 ret -22 [ 1782.156094] binder: 11855:11856 unknown command 1850775417 [ 1782.169389] binder: 11855:11856 ioctl c0306201 200000c0 returned -22 16:21:12 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f00000003c0)="11dca50d5e0bcfe47bf070") r1 = socket$inet_tcp(0x2, 0x1, 0x0) pipe(&(0x7f0000000480)={0xffffffffffffffff, 0xffffffffffffffff}) pipe(&(0x7f0000000480)={0xffffffffffffffff}) vmsplice(r3, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) fsetxattr$security_ima(r3, &(0x7f0000000080)='security.ima\x00', &(0x7f00000000c0)=@sha1={0x1, "ec5458667dca9b0667d2ec60fb3270b83c3cb296"}, 0x15, 0x1) write(r2, &(0x7f0000000340), 0x41395527) r4 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000040)='TIPCv2\x00') sendmsg$TIPC_NL_LINK_SET(r2, &(0x7f00000001c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x1000}, 0xc, &(0x7f0000000180)={&(0x7f00000005c0)={0x23, r4, 0x300, 0x70bd25, 0x25dfdbf8, {}, [@TIPC_NLA_MEDIA={0x0, 0x5, [@TIPC_NLA_MEDIA_NAME={0x0, 0x1, 'udp\x00'}, @TIPC_NLA_MEDIA_PROP={0x0, 0x2, [@TIPC_NLA_PROP_MTU={0x0, 0x4, 0xfffffffffffffffe}]}, @TIPC_NLA_MEDIA_NAME={0x0, 0x1, 'eth\x00'}]}, @TIPC_NLA_LINK={0x98, 0x4, [@TIPC_NLA_LINK_NAME={0xc, 0x1, 'syz0\x00'}, @TIPC_NLA_LINK_NAME={0x14, 0x1, 'broa\x86\xf8\x14\xa9\xb1\xfe\x06g\xe4T\xd4'}, @TIPC_NLA_LINK_NAME={0x14, 0x1, 'broadcast-link\x00'}, @TIPC_NLA_LINK_NAME={0xc, 0x1, 'syz0\x00'}, @TIPC_NLA_LINK_PROP={0x54, 0x7, [@TIPC_NLA_PROP_TOL={0x7, 0x2, 0x7}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x5}, @TIPC_NLA_PROP_PRIO={0x0, 0x1, 0x1}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x4}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x3}, @TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x100000000000}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x4}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x40006}]}]}, @TIPC_NLA_NODE={0x18, 0x6, [@TIPC_NLA_NODE_UP={0xffffffffffffffac}, @TIPC_NLA_NODE_ADDR={0x0, 0x1, 0x4}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_ADDR={0x8, 0x1, 0x100000001}]}]}, 0xcc}, 0x1, 0x0, 0x0, 0x488d1}, 0x4000) bind$inet(r1, &(0x7f0000000100)={0x2, 0x4e20}, 0x10) r5 = socket(0x10, 0x2, 0x0) getsockopt$sock_cred(r5, 0x1, 0x11, &(0x7f0000caaffb)={0x0, 0x0}, &(0x7f0000cab000)=0xc) chown(&(0x7f00000001c0)='./file0\x00', r6, 0x0) lstat(&(0x7f0000000380)='./file0\x00', &(0x7f0000000400)={0x0, 0x0, 0x0, 0x0, 0x0}) getsockopt$inet_IP_XFRM_POLICY(0xffffffffffffffff, 0x0, 0x11, &(0x7f00000004c0)={{{@in=@local, @in6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@empty}, 0x0, @in6=@mcast1}}, &(0x7f00000006c0)=0xe8) syz_mount_image$f2fs(&(0x7f0000000200)='f2fs\x00', &(0x7f0000000240)='./file0\x00', 0xffff, 0x1, &(0x7f0000000340)=[{&(0x7f0000000280)="1dfca69f561aa8645ae73027edfe337e55b8408f001184f0cc7ec02702a568b68dedb7e65df2e7dbe2489534565368302c63714b9614736b1e6a7564458887a37519082a9e2da5b73b267a8a74a5e568c8a46f435d2d9a052c1a9579af5dba7d0a36f5b290bfe6480f17a71a37b33e60283faae348c9b26d15074410b68b1b953b5cf8133b092c1551e1cc9d4c932907b5b4d9a3cc046d4c7335771b76b44764408535b6aa746335159647552d81821416", 0xb1}], 0x3100020, &(0x7f0000000700)={[{@heap='heap'}, {@two_active_logs='active_logs=2'}, {@prjquota={'prjquota', 0x3d, '/vmnet0system'}}, {@inline_xattr='inline_xattr'}, {@noheap='noheap'}, {@inline_xattr='inline_xattr'}], [{@uid_lt={'uid<', r6}}, {@uid_gt={'uid>', r7}}, {@fowner_eq={'fowner', 0x3d, r8}}, {@hash='hash'}, {@permit_directio='permit_directio'}]}) connect$inet(r1, &(0x7f0000000cc0)={0x2, 0x4e20, @local}, 0x10) setsockopt$SO_TIMESTAMPING(r1, 0x1, 0x25, &(0x7f00000010c0)=0x19ff, 0x4) sendto$inet(r1, &(0x7f0000000140)="b0", 0x1, 0x0, 0x0, 0x0) recvmmsg(r1, &(0x7f0000003b40)=[{{0x0, 0x0, 0x0}}], 0x1, 0x2000, 0x0) prctl$PR_GET_THP_DISABLE(0x2a) 16:21:12 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) r2 = dup2(r1, r0) pipe(&(0x7f0000000480)={0xffffffffffffffff}) vmsplice(r3, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) ioctl$EXT4_IOC_SWAP_BOOT(r3, 0x6611) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000380)=ANY=[@ANYBLOB="04630440"], 0x0, 0x0, 0x0}) pipe(&(0x7f0000000480)={0xffffffffffffffff, 0xffffffffffffffff}) write(r4, &(0x7f0000000340), 0x41395527) ioctl$BINDER_SET_CONTEXT_MGR(r4, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000300)={0x8, 0x0, &(0x7f00000004c0)=[@acquire={0x40046304}], 0xb19b868c1a8b328c, 0x0, 0x0}) 16:21:12 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) r2 = dup2(r1, r0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000380)=ANY=[@ANYBLOB], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000300)={0x8, 0x0, &(0x7f00000004c0)=[@acquire={0x40046304}], 0x0, 0x0, 0x0}) 16:21:12 executing program 4: r0 = openat$selinux_avc_cache_stats(0xffffffffffffff9c, &(0x7f0000000240)='/selinux/avc/cache_stats\x00', 0x0, 0x0) ioctl$UI_DEV_CREATE(r0, 0x5501) openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) creat(&(0x7f0000000180)='./file0\x00', 0x10) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) pipe(&(0x7f0000000100)) openat$uinput(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/uinput\x00', 0x802, 0x0) r2 = dup3(r1, 0xffffffffffffffff, 0x80000) renameat2(r2, &(0x7f0000000000)='./file0\x00', 0xffffffffffffff9c, &(0x7f0000000140)='./file0\x00', 0x1) ioctl$TIOCSETD(r2, 0x5423, &(0x7f0000000040)=0xd) [ 1782.693409] binder: 11877:11890 ioctl c0306201 20000300 returned -14 16:21:12 executing program 2: r0 = syz_open_procfs(0x0, &(0x7f0000000080)='net/dev_snmp6\x00') r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r1, 0x40045431, &(0x7f00000000c0)) r2 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r2, 0x40045431, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1}) syz_open_pts(r2, 0x0) fchmod(r2, 0x2) r3 = syz_open_pts(r1, 0x0) dup3(r3, r0, 0x0) r4 = openat$pfkey(0xffffffffffffff9c, &(0x7f0000000280)='/proc/self/net/pfkey\x00', 0x101000, 0x0) ioctl$BLKGETSIZE64(r4, 0x80081272, &(0x7f00000002c0)) pselect6(0x40, &(0x7f0000000340)={0x9}, 0x0, 0x0, 0x0, 0x0) pipe(&(0x7f0000000480)={0xffffffffffffffff}) vmsplice(r5, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) recvfrom(r5, &(0x7f0000000100)=""/224, 0xe0, 0x40006021, &(0x7f0000000200)=@x25={0x9, @null=' \x00'}, 0x80) pipe(&(0x7f0000000480)={0xffffffffffffffff}) vmsplice(r6, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) ioctl$KIOCSOUND(r6, 0x4b2f, 0xff) 16:21:12 executing program 1: r0 = syz_open_procfs(0x0, &(0x7f0000000080)='net/dev_snmp6\x00') socket(0x10, 0x80002, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) socket$nl_generic(0x10, 0x3, 0x10) syz_open_procfs(0x0, &(0x7f0000000980)='net/sofH\x16tnet_sua') socket$inet6_tcp(0xa, 0x1, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) request_key(&(0x7f0000000000)='user\x00', &(0x7f0000000040)={'syz'}, &(0x7f0000000a80), 0xfffffffffffffffd) socket$inet(0x2, 0x4000000000000001, 0x0) perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x1ee6b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000000c0)={0xeb, 0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB="0563044000000000046304400000000006630440000000007997506ea39438033ada635f7cd4c9d1de50cf51e7a773b356e7348d3b19cbdc76ed97a6a08da8997815ea9e6d3b6a1d5a7c1cdf78337a6166cfd70cf41b6cb958e69b7dae4fe74a09c8e4db4c323ba219438b49c2f1736eb01b18c098512160aad1c0394bd4c9b785ea39e6f5b1f809658351bcb5f101899004e6a8542081ceec87f1a675538ce9264c7f128392c875c23507fc8a694ef2d13b127563b2da420a3df952f062dd3d46202a3466fa9a9c985dde3cc577a1fdf40687931bbc4303dbab0e28bb6757bc226d9bba4db1603de1a9c7"], 0x1, 0x0, &(0x7f00000003c0)='L'}) r2 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r2, 0x40045431, &(0x7f00000000c0)) r3 = syz_open_pts(r2, 0x0) dup3(r3, r0, 0x0) 16:21:12 executing program 4: io_setup(0x0, &(0x7f0000000000)=0x0) io_destroy(r0) r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) mkdir(&(0x7f00000000c0)='./file0\x00', 0x0) r4 = open$dir(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) getdents64(r4, 0x0, 0x0) futimesat(r4, 0x0, &(0x7f0000000300)={{0x0, 0x2710}, {0x77359400}}) getdents64(r4, 0x0, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000000040)=0xf) 16:21:12 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) r2 = dup2(r1, r0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x2, 0x0, &(0x7f0000000380)=ANY=[@ANYBLOB="0463"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000300)={0x8, 0x0, &(0x7f00000004c0)=[@acquire={0x40046304}], 0x0, 0x0, 0x0}) 16:21:12 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) r2 = dup2(r1, r0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x2, 0x0, &(0x7f0000000380)=ANY=[@ANYBLOB="0463"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000300)={0x8, 0x0, &(0x7f00000004c0)=[@acquire={0x40046304}], 0x0, 0x0, 0x0}) [ 1782.801997] binder: 11897:11900 unknown command 25348 [ 1782.807793] binder: 11897:11900 ioctl c0306201 20000140 returned -22 [ 1782.818846] binder: 11898:11902 Acquire 1 refcount change on invalid ref 0 ret -22 [ 1782.832722] binder: 11898:11902 IncRefs 0 refcount change on invalid ref 0 ret -22 16:21:12 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) r2 = dup2(r1, r0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x2, 0x0, &(0x7f0000000380)=ANY=[@ANYBLOB="0463"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000300)={0x8, 0x0, &(0x7f00000004c0)=[@acquire={0x40046304}], 0x0, 0x0, 0x0}) 16:21:12 executing program 4: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0xf) prctl$PR_SET_NO_NEW_PRIVS(0x26, 0x1) [ 1782.851486] binder: 11898:11902 Release 1 refcount change on invalid ref 0 ret -22 [ 1782.857781] binder: 11908:11910 unknown command 25348 [ 1782.869123] binder: 11908:11910 ioctl c0306201 20000140 returned -22 [ 1782.876855] binder: 11898:11902 unknown command 1850775417 16:21:12 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) r2 = dup2(r1, r0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x3, 0x0, &(0x7f0000000380)=ANY=[@ANYBLOB="046304"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000300)={0x8, 0x0, &(0x7f00000004c0)=[@acquire={0x40046304}], 0x0, 0x0, 0x0}) [ 1782.923348] binder: 11898:11902 ioctl c0306201 200000c0 returned -22 [ 1782.941420] binder: 11917:11919 unknown command 25348 [ 1782.947469] binder: 11917:11919 ioctl c0306201 20000140 returned -22 [ 1783.013509] binder: 11926:11927 unknown command 287492 [ 1783.027041] binder: 11926:11927 ioctl c0306201 20000140 returned -22 16:21:12 executing program 1: syz_open_procfs(0x0, &(0x7f0000000080)='net/dev_snmp6\x00') socket(0x10, 0x80002, 0x0) r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) socket$nl_generic(0x10, 0x3, 0x10) syz_open_procfs(0x0, &(0x7f0000000980)='net/sofH\x16tnet_sua') socket$inet6_tcp(0xa, 0x1, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) request_key(&(0x7f0000000000)='user\x00', &(0x7f0000000040)={'syz'}, &(0x7f0000000a80), 0xfffffffffffffffd) socket$inet(0x2, 0x4000000000000001, 0x0) perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x1ee6b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0xeb, 0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB="0563044000000000046304400000000006630440000000007997506ea39438033ada635f7cd4c9d1de50cf51e7a773b356e7348d3b19cbdc76ed97a6a08da8997815ea9e6d3b6a1d5a7c1cdf78337a6166cfd70cf41b6cb958e69b7dae4fe74a09c8e4db4c323ba219438b49c2f1736eb01b18c098512160aad1c0394bd4c9b785ea39e6f5b1f809658351bcb5f101899004e6a8542081ceec87f1a675538ce9264c7f128392c875c23507fc8a694ef2d13b127563b2da420a3df952f062dd3d46202a3466fa9a9c985dde3cc577a1fdf40687931bbc4303dbab0e28bb6757bc226d9bba4db1603de1a9c7"], 0x1, 0x0, &(0x7f00000003c0)='L'}) r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r1, 0x40045431, &(0x7f00000000c0)) syz_open_pts(r1, 0x0) ioctl$TCXONC(0xffffffffffffffff, 0x540a, 0x0) 16:21:12 executing program 4: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000100)='/dev/ptmx\x00', 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = dup2(r1, 0xffffffffffffffff) getsockopt$inet6_IPV6_FLOWLABEL_MGR(r2, 0x29, 0x20, &(0x7f0000000000)={@rand_addr="2967a273f186aebf16ccb50b1e5bede6", 0x83, 0x0, 0x0, 0xb, 0x8000, 0x680}, &(0x7f0000000080)=0x20) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0xf) 16:21:12 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) r2 = dup2(r1, r0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x3, 0x0, &(0x7f0000000380)=ANY=[@ANYBLOB="046304"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000300)={0x8, 0x0, &(0x7f00000004c0)=[@acquire={0x40046304}], 0x0, 0x0, 0x0}) 16:21:12 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) r2 = dup2(r1, r0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="43358242c1b7e1945a5a566f9b13765391a9843d20a805e3461964691b3958ee2d061edab54fbd59f5135762da5e02c1dad001010000000000005bb4264bf6b53977dea103fc20b426c281b099296b474521b5b1f16d5dc509de2ef1631d65a587d8a52db5a4fc81ae8f9c772a28ace9a90858d09f62f6b5dedc52f8007df6e43d0648c81fc547a6457440879ef0255f0649f7348b7f2eb2972995a9ff435cf4ce2c58251c4e24cefc5fe3c1a1e3cfd8eb599cd1863069d6d4f77a4c889641115f464786a5b66b5e9d66c66bd58807008488f1ad9e530914811e17e53cabe03bfeb731bc87b5a11f47d51eaac6052123444e40ac9c877bbf506df549afaed8e810d07319901b5848aff50633deb2"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000300)={0x8, 0x0, &(0x7f00000004c0)=[@acquire={0x40046304}], 0xb19b868c1a8b328c, 0x0, 0x0}) open$dir(&(0x7f0000000040)='./file0\x00', 0x1, 0x119) [ 1783.459600] binder: 11935:11938 unknown command 1115829571 [ 1783.467070] binder: 11932:11939 unknown command 287492 [ 1783.470212] binder: 11935:11938 ioctl c0306201 20000140 returned -22 [ 1783.473022] binder: 11933:11936 Acquire 1 refcount change on invalid ref 0 ret -22 [ 1783.481669] binder: 11935:11938 ioctl c0306201 20000300 returned -14 [ 1783.491485] binder: 11932:11939 ioctl c0306201 20000140 returned -22 [ 1783.496467] binder: 11935:11943 unknown command 1115829571 [ 1783.505786] binder: 11935:11943 ioctl c0306201 20000140 returned -22 [ 1783.512919] binder: 11933:11936 IncRefs 0 refcount change on invalid ref 0 ret -22 [ 1783.533376] binder: 11933:11936 Release 1 refcount change on invalid ref 0 ret -22 [ 1783.542380] binder: 11935:11938 ioctl c0306201 20000300 returned -14 16:21:13 executing program 2: r0 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000140)='net/nfsfs\x00') pipe(&(0x7f0000000480)={0xffffffffffffffff}) vmsplice(r1, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) ioctl$TUNSETFILTEREBPF(r0, 0x800454e1, &(0x7f0000000080)=r1) r2 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ptmx\x00', 0x80000, 0x0) ioctl$TCSETS(r2, 0x40045431, &(0x7f00000000c0)) r3 = syz_open_pts(r2, 0x0) rt_sigprocmask(0x1, &(0x7f0000000100)={0x5}, &(0x7f0000000180), 0x8) r4 = dup3(r3, r0, 0x0) ioctl$TCXONC(r4, 0x540a, 0x0) ioctl$TIOCLINUX6(r3, 0x541c, &(0x7f0000000000)={0x6, 0x223c}) pselect6(0x40, &(0x7f0000000340)={0x9}, 0x0, 0x0, 0x0, 0x0) 16:21:13 executing program 4: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = accept$inet6(0xffffffffffffffff, &(0x7f0000000000)={0xa, 0x0, 0x0, @remote}, &(0x7f0000000080)=0x1c) fcntl$F_GET_FILE_RW_HINT(r2, 0x40d, &(0x7f0000000100)) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000180)) 16:21:13 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f00000003c0)="11dca50d5e0bcfe47bf070") r1 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r1, &(0x7f0000000100)={0x2, 0x4e20}, 0x10) pipe(&(0x7f0000000480)={0xffffffffffffffff, 0xffffffffffffffff}) pipe(&(0x7f0000000480)={0xffffffffffffffff}) vmsplice(r3, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) r4 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000240)='TIPCv2\x00') sendmsg$TIPC_NL_LINK_GET(r3, &(0x7f00000002c0)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x100022}, 0xc, &(0x7f0000000280)={&(0x7f0000000540)={0x17c, r4, 0x10, 0x70bd2b, 0x25dfdbfc, {}, [@TIPC_NLA_LINK={0x4}, @TIPC_NLA_NODE={0x24, 0x6, [@TIPC_NLA_NODE_ADDR={0x8, 0x1, 0xab}, @TIPC_NLA_NODE_ADDR={0x8, 0x1, 0xc83}, @TIPC_NLA_NODE_ADDR={0x8, 0x1, 0x7}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}]}, @TIPC_NLA_MEDIA={0xac, 0x5, [@TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'ib\x00'}, @TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'udp\x00'}, @TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'ib\x00'}, @TIPC_NLA_MEDIA_PROP={0x44, 0x2, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0x7}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x4}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x8cbd}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0xb}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x4}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x80}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x1}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x1f}]}, @TIPC_NLA_MEDIA_PROP={0x14, 0x2, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x14}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x5}]}, @TIPC_NLA_MEDIA_PROP={0x34, 0x2, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x3}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x1000}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x6}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x7}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x5c}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x3}]}, @TIPC_NLA_MEDIA_PROP={0x4}]}, @TIPC_NLA_BEARER={0x68, 0x1, [@TIPC_NLA_BEARER_UDP_OPTS={0x38, 0x4, {{0x20, 0x1, @in6={0xa, 0x4e24, 0xfffffffffffffffd, @mcast1, 0x3}}, {0x14, 0x2, @in={0x2, 0x4e22, @remote}}}}, @TIPC_NLA_BEARER_NAME={0x10, 0x1, @udp='udp:syz2\x00'}, @TIPC_NLA_BEARER_PROP={0x1c, 0x2, [@TIPC_NLA_PROP_TOL={0x8, 0x2, 0x7fff}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x1b}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x3f}]}]}, @TIPC_NLA_NODE={0x2c, 0x6, [@TIPC_NLA_NODE_ADDR={0x8, 0x1, 0x4}, @TIPC_NLA_NODE_ADDR={0x8, 0x1, 0x5}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_ADDR={0x8, 0x1, 0x800000000}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_ADDR={0x8, 0x1, 0x10000}]}]}, 0x17c}, 0x1, 0x0, 0x0, 0x40000000}, 0x0) write(r2, &(0x7f0000000340), 0x41395527) ioctl$PERF_EVENT_IOC_SET_FILTER(r2, 0x40082406, &(0x7f0000000000)='trusted{\x00') connect$inet(r1, &(0x7f0000000cc0)={0x2, 0x4e20, @local}, 0x10) setsockopt$SO_TIMESTAMPING(r1, 0x1, 0x25, &(0x7f00000010c0)=0x19ff, 0x4) sendto$inet(r1, &(0x7f0000000140)="b0", 0x1, 0x0, 0x0, 0x0) pipe(&(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) write(r5, &(0x7f0000000340), 0x41395527) r6 = openat(0xffffffffffffff9c, &(0x7f00000003c0)='./file0/file0\x00', 0x20000, 0x60) accept$packet(0xffffffffffffffff, &(0x7f0000000400)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000440)=0x14) ioctl$sock_inet6_SIOCSIFDSTADDR(r6, 0x8918, &(0x7f0000000480)={@mcast2, 0x3f, r7}) setsockopt$inet_mreqn(r5, 0x0, 0x16858ab27a32d72d, &(0x7f0000000040)={@multicast1, @remote, r7}, 0xc) recvmmsg(r1, &(0x7f0000003b40)=[{{0x0, 0x0, 0x0}}], 0x1, 0x2000, 0x0) r8 = openat$null(0xffffffffffffff9c, &(0x7f0000000080)='/dev/null\x00', 0x240600, 0x0) getsockopt$inet_udp_int(r8, 0x11, 0x1, &(0x7f0000000180), &(0x7f00000001c0)=0x4) pipe(&(0x7f0000000480)={0xffffffffffffffff}) vmsplice(r9, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) socketpair(0x8, 0xb, 0x8, &(0x7f0000000400)={0xffffffffffffffff}) ioctl$FIDEDUPERANGE(0xffffffffffffffff, 0xc0189436, &(0x7f00000004c0)={0x100000001, 0x5, 0x2, 0x0, 0x0, [{r9, 0x0, 0x3}, {r10, 0x0, 0x400}]}) 16:21:13 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) r2 = dup2(r1, r0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x3, 0x0, &(0x7f0000000380)=ANY=[@ANYBLOB="046304"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000300)={0x8, 0x0, &(0x7f00000004c0)=[@acquire={0x40046304}], 0x0, 0x0, 0x0}) 16:21:13 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) fchmod(r0, 0x20) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) r2 = dup2(r1, r0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000380)=ANY=[@ANYBLOB="04630440"], 0x0, 0x0, 0x0}) pipe(&(0x7f0000000480)={0xffffffffffffffff, 0xffffffffffffffff}) write(r3, &(0x7f0000000340), 0x41395527) ioctl$FS_IOC_SETVERSION(r3, 0x40087602, &(0x7f0000000080)=0xac) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000300)={0x8, 0x0, &(0x7f00000004c0)=[@acquire={0x40046304}], 0xb19b868c1a8b328c, 0x0, 0x0}) pipe(&(0x7f0000000480)={0xffffffffffffffff}) vmsplice(r4, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) ioctl$sock_inet_udp_SIOCINQ(r4, 0x541b, &(0x7f0000000040)) [ 1783.577490] binder: 11933:11936 unknown command 1850775417 [ 1783.585075] binder: 11933:11936 ioctl c0306201 200000c0 returned -22 16:21:13 executing program 1: syz_open_procfs(0x0, &(0x7f0000000080)='net/dev_snmp6\x00') socket(0x10, 0x80002, 0x0) r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) socket$nl_generic(0x10, 0x3, 0x10) syz_open_procfs(0x0, &(0x7f0000000980)='net/sofH\x16tnet_sua') socket$inet6_tcp(0xa, 0x1, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) request_key(&(0x7f0000000000)='user\x00', &(0x7f0000000040)={'syz'}, &(0x7f0000000a80), 0xfffffffffffffffd) socket$inet(0x2, 0x4000000000000001, 0x0) perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x1ee6b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0xeb, 0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB="0563044000000000046304400000000006630440000000007997506ea39438033ada635f7cd4c9d1de50cf51e7a773b356e7348d3b19cbdc76ed97a6a08da8997815ea9e6d3b6a1d5a7c1cdf78337a6166cfd70cf41b6cb958e69b7dae4fe74a09c8e4db4c323ba219438b49c2f1736eb01b18c098512160aad1c0394bd4c9b785ea39e6f5b1f809658351bcb5f101899004e6a8542081ceec87f1a675538ce9264c7f128392c875c23507fc8a694ef2d13b127563b2da420a3df952f062dd3d46202a3466fa9a9c985dde3cc577a1fdf40687931bbc4303dbab0e28bb6757bc226d9bba4db1603de1a9c7"], 0x1, 0x0, &(0x7f00000003c0)='L'}) r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r1, 0x40045431, &(0x7f00000000c0)) syz_open_pts(r1, 0x0) ioctl$TCXONC(0xffffffffffffffff, 0x540a, 0x0) 16:21:13 executing program 4: pipe(&(0x7f0000000480)={0xffffffffffffffff, 0xffffffffffffffff}) write(r0, &(0x7f0000000340), 0x41395527) ioctl$TIOCGPKT(r0, 0x80045438, &(0x7f0000000000)) r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) creat(&(0x7f0000000080)='./file0\x00', 0x1) setxattr$trusted_overlay_opaque(&(0x7f0000000100)='./file0\x00', &(0x7f0000000180)='trusted.overlay.opaque\x00', &(0x7f00000001c0)='y\x00', 0x2, 0x2) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000000040)=0xf) [ 1783.649388] binder: 11952:11959 unknown command 287492 [ 1783.655289] binder: 11952:11959 ioctl c0306201 20000140 returned -22 16:21:13 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) r2 = dup2(r1, r0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000380)=ANY=[@ANYBLOB="04630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000300)={0x8, 0x0, &(0x7f00000004c0)=[@acquire={0x40046304}], 0x0, 0x0, 0x0}) [ 1783.697276] binder: 11953:11965 ioctl c0306201 20000300 returned -14 [ 1783.711975] binder: 11963:11964 Acquire 1 refcount change on invalid ref 0 ret -22 16:21:13 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) r2 = dup2(r1, r0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000380)=ANY=[@ANYBLOB="04630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000300)={0x8, 0x0, &(0x7f00000004c0)=[@acquire={0x40046304}], 0x0, 0x0, 0x0}) [ 1783.747658] binder: 11963:11964 IncRefs 0 refcount change on invalid ref 0 ret -22 [ 1783.764428] binder: 11963:11964 Release 1 refcount change on invalid ref 0 ret -22 [ 1783.773660] binder: 11963:11964 unknown command 1850775417 [ 1783.786303] binder: 11963:11964 ioctl c0306201 200000c0 returned -22 16:21:13 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) r2 = dup2(r1, r0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000380)=ANY=[@ANYBLOB="04630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000300)={0x8, 0x0, &(0x7f00000004c0)=[@acquire={0x40046304}], 0x0, 0x0, 0x0}) 16:21:13 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) r2 = dup2(r1, r0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000380)=ANY=[@ANYBLOB="04630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) 16:21:13 executing program 1: syz_open_procfs(0x0, &(0x7f0000000080)='net/dev_snmp6\x00') socket(0x10, 0x80002, 0x0) r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) socket$nl_generic(0x10, 0x3, 0x10) syz_open_procfs(0x0, &(0x7f0000000980)='net/sofH\x16tnet_sua') socket$inet6_tcp(0xa, 0x1, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) request_key(&(0x7f0000000000)='user\x00', &(0x7f0000000040)={'syz'}, &(0x7f0000000a80), 0xfffffffffffffffd) socket$inet(0x2, 0x4000000000000001, 0x0) perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x1ee6b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0xeb, 0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB="0563044000000000046304400000000006630440000000007997506ea39438033ada635f7cd4c9d1de50cf51e7a773b356e7348d3b19cbdc76ed97a6a08da8997815ea9e6d3b6a1d5a7c1cdf78337a6166cfd70cf41b6cb958e69b7dae4fe74a09c8e4db4c323ba219438b49c2f1736eb01b18c098512160aad1c0394bd4c9b785ea39e6f5b1f809658351bcb5f101899004e6a8542081ceec87f1a675538ce9264c7f128392c875c23507fc8a694ef2d13b127563b2da420a3df952f062dd3d46202a3466fa9a9c985dde3cc577a1fdf40687931bbc4303dbab0e28bb6757bc226d9bba4db1603de1a9c7"], 0x1, 0x0, &(0x7f00000003c0)='L'}) r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r1, 0x40045431, &(0x7f00000000c0)) ioctl$TCXONC(0xffffffffffffffff, 0x540a, 0x0) [ 1783.898307] binder: 11989:11992 ioctl c0306201 0 returned -14 [ 1783.914985] binder: 11993:11994 Acquire 1 refcount change on invalid ref 0 ret -22 [ 1783.931406] binder: 11993:11994 IncRefs 0 refcount change on invalid ref 0 ret -22 [ 1783.943175] binder: 11993:11994 Release 1 refcount change on invalid ref 0 ret -22 [ 1783.952444] binder: 11993:11994 unknown command 1850775417 [ 1783.958157] binder: 11993:11994 ioctl c0306201 200000c0 returned -22 16:21:13 executing program 1: syz_open_procfs(0x0, &(0x7f0000000080)='net/dev_snmp6\x00') socket(0x10, 0x80002, 0x0) r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) socket$nl_generic(0x10, 0x3, 0x10) syz_open_procfs(0x0, &(0x7f0000000980)='net/sofH\x16tnet_sua') socket$inet6_tcp(0xa, 0x1, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) request_key(&(0x7f0000000000)='user\x00', &(0x7f0000000040)={'syz'}, &(0x7f0000000a80), 0xfffffffffffffffd) socket$inet(0x2, 0x4000000000000001, 0x0) perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x1ee6b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0xeb, 0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB="0563044000000000046304400000000006630440000000007997506ea39438033ada635f7cd4c9d1de50cf51e7a773b356e7348d3b19cbdc76ed97a6a08da8997815ea9e6d3b6a1d5a7c1cdf78337a6166cfd70cf41b6cb958e69b7dae4fe74a09c8e4db4c323ba219438b49c2f1736eb01b18c098512160aad1c0394bd4c9b785ea39e6f5b1f809658351bcb5f101899004e6a8542081ceec87f1a675538ce9264c7f128392c875c23507fc8a694ef2d13b127563b2da420a3df952f062dd3d46202a3466fa9a9c985dde3cc577a1fdf40687931bbc4303dbab0e28bb6757bc226d9bba4db1603de1a9c7"], 0x1, 0x0, &(0x7f00000003c0)='L'}) openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCXONC(0xffffffffffffffff, 0x540a, 0x0) 16:21:13 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) r2 = dup2(r1, r0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000380)=ANY=[@ANYBLOB="04630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) 16:21:13 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) r2 = dup2(r1, r0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000380)=ANY=[], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000300)={0x8, 0x0, &(0x7f00000004c0)=[@acquire={0x40046304}], 0xb19b868c1a8b328c, 0x0, 0x0}) 16:21:13 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="110000000000009c0000001269c92caf16acda9ba2c48d3820539211f97b3d3e017bed9cd41d771ba34c80d8ea446f2570a7106bee20263e5c12049aea4108dfd5706880909466531ae51b3d9655") r1 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r1, &(0x7f0000000100)={0x2, 0x4e20}, 0x10) connect$inet(r1, &(0x7f0000000cc0)={0x2, 0x4e20, @local}, 0x10) setsockopt$SO_TIMESTAMPING(r1, 0x1, 0x25, &(0x7f00000010c0)=0x19ff, 0x4) sendto$inet(r1, &(0x7f0000000140)="b0", 0x1, 0x0, 0x0, 0x0) recvmmsg(r1, &(0x7f0000003b40)=[{{0x0, 0x0, 0x0}}], 0x1, 0x2000, 0x0) 16:21:14 executing program 2: r0 = syz_open_procfs(0x0, &(0x7f0000000080)='net/dev_snmp6\x00') ioctl$sock_SIOCINQ(0xffffffffffffffff, 0x541b, &(0x7f0000000000)) r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r1, 0x40045431, &(0x7f00000000c0)) pipe(&(0x7f0000000480)={0xffffffffffffffff, 0xffffffffffffffff}) write(r2, &(0x7f0000000340), 0x41395527) preadv(r2, &(0x7f00000001c0)=[{&(0x7f0000000140)=""/117, 0x75}], 0x1, 0x0) r3 = syz_open_pts(r1, 0x0) r4 = dup3(r3, r0, 0x0) pipe(&(0x7f0000000480)={0xffffffffffffffff}) vmsplice(r5, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) r6 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r6, 0x40045431, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1}) syz_open_pts(r6, 0x0) pipe(&(0x7f0000000480)={0xffffffffffffffff}) vmsplice(r7, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) ioctl$PPPIOCSPASS(r7, 0x40107447, &(0x7f0000000240)={0x3, &(0x7f0000000200)=[{0x1ff, 0x1, 0x4, 0x9}, {0x9, 0x2a00000000000000, 0x80000000, 0x4}, {0xa91, 0x2, 0x20, 0x8}]}) openat(r4, &(0x7f0000000100)='./file0\x00', 0x40880, 0x12e) ioctl$TCXONC(0xffffffffffffffff, 0x540a, 0x370) pselect6(0x40, &(0x7f0000000340)={0x9}, 0x0, 0x0, 0x0, 0x0) 16:21:14 executing program 4: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0xf) r2 = open(&(0x7f0000000000)='./file0\x00', 0x80002, 0x28) ioctl$void(r2, 0x5450) pipe(&(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) write(r3, &(0x7f0000000340), 0x41395527) ioctl$TIOCSTI(r3, 0x5412, 0x2) 16:21:14 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) r2 = dup2(r1, r0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000380)=ANY=[@ANYBLOB="04630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) [ 1784.543824] binder: 12004:12012 ioctl c0306201 0 returned -14 [ 1784.551095] binder: 12003:12007 Acquire 1 refcount change on invalid ref 0 ret -22 [ 1784.560744] binder: 12006:12013 ioctl c0306201 20000300 returned -14 [ 1784.568796] binder: 12003:12007 IncRefs 0 refcount change on invalid ref 0 ret -22 16:21:14 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) r1 = gettid() ptrace$setopts(0x4206, r1, 0x0, 0x0) tkill(r1, 0x3c) ptrace$cont(0x18, r1, 0x0, 0x0) ptrace$setregs(0xd, r1, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r1, 0x0, 0x0) sched_rr_get_interval(r1, &(0x7f0000000040)) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) r3 = dup2(r2, r0) ioctl$BINDER_SET_CONTEXT_MGR(r3, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000380)=ANY=[@ANYBLOB='@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000300)={0x8, 0x0, &(0x7f00000004c0)=[@acquire={0x40046304}], 0xb19b868c1a8b328c, 0x0, 0x0}) [ 1784.604435] binder: 12003:12007 Release 1 refcount change on invalid ref 0 ret -22 16:21:14 executing program 0: syz_open_procfs(0x0, &(0x7f0000000080)='net/dev_snmp6\x00') socket(0x10, 0x80002, 0x0) r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) socket$nl_generic(0x10, 0x3, 0x10) syz_open_procfs(0x0, &(0x7f0000000980)='net/sofH\x16tnet_sua') socket$inet6_tcp(0xa, 0x1, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) request_key(&(0x7f0000000000)='user\x00', &(0x7f0000000040)={'syz'}, &(0x7f0000000a80), 0xfffffffffffffffd) socket$inet(0x2, 0x4000000000000001, 0x0) perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x1ee6b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0xeb, 0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB="0563044000000000046304400000000006630440000000007997506ea39438033ada635f7cd4c9d1de50cf51e7a773b356e7348d3b19cbdc76ed97a6a08da8997815ea9e6d3b6a1d5a7c1cdf78337a6166cfd70cf41b6cb958e69b7dae4fe74a09c8e4db4c323ba219438b49c2f1736eb01b18c098512160aad1c0394bd4c9b785ea39e6f5b1f809658351bcb5f101899004e6a8542081ceec87f1a675538ce9264c7f128392c875c23507fc8a694ef2d13b127563b2da420a3df952f062dd3d46202a3466fa9a9c985dde3cc577a1fdf40687931bbc4303dbab0e28bb6757bc226d9bba4db1603de1a9c7"], 0x1, 0x0, &(0x7f00000003c0)='L'}) r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r1, 0x40045431, &(0x7f00000000c0)) ioctl$TCXONC(0xffffffffffffffff, 0x540a, 0x0) 16:21:14 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) r2 = dup2(r1, r0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000380)=ANY=[@ANYBLOB="04630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000300)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) [ 1784.644905] binder: 12003:12007 unknown command 1850775417 [ 1784.663839] binder: 12003:12007 ioctl c0306201 200000c0 returned -22 [ 1784.679042] binder: 12027:12029 ioctl c0306201 0 returned -14 16:21:14 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) r2 = dup2(r1, r0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000380)=ANY=[@ANYBLOB="04630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000300)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) 16:21:14 executing program 1: syz_open_procfs(0x0, &(0x7f0000000080)='net/dev_snmp6\x00') socket(0x10, 0x80002, 0x0) r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) socket$nl_generic(0x10, 0x3, 0x10) syz_open_procfs(0x0, &(0x7f0000000980)='net/sofH\x16tnet_sua') socket$inet6_tcp(0xa, 0x1, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) request_key(&(0x7f0000000000)='user\x00', &(0x7f0000000040)={'syz'}, &(0x7f0000000a80), 0xfffffffffffffffd) socket$inet(0x2, 0x4000000000000001, 0x0) perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x1ee6b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0xeb, 0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB="0563044000000000046304400000000006630440000000007997506ea39438033ada635f7cd4c9d1de50cf51e7a773b356e7348d3b19cbdc76ed97a6a08da8997815ea9e6d3b6a1d5a7c1cdf78337a6166cfd70cf41b6cb958e69b7dae4fe74a09c8e4db4c323ba219438b49c2f1736eb01b18c098512160aad1c0394bd4c9b785ea39e6f5b1f809658351bcb5f101899004e6a8542081ceec87f1a675538ce9264c7f128392c875c23507fc8a694ef2d13b127563b2da420a3df952f062dd3d46202a3466fa9a9c985dde3cc577a1fdf40687931bbc4303dbab0e28bb6757bc226d9bba4db1603de1a9c7"], 0x1, 0x0, &(0x7f00000003c0)='L'}) openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCXONC(0xffffffffffffffff, 0x540a, 0x0) 16:21:14 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) r2 = dup2(r1, r0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000380)=ANY=[@ANYBLOB="04630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000300)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) [ 1784.778411] binder: 12032:12033 Acquire 1 refcount change on invalid ref 0 ret -22 [ 1784.801892] binder: 12032:12033 IncRefs 0 refcount change on invalid ref 0 ret -22 16:21:14 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) r2 = dup2(r1, r0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000380)=ANY=[@ANYBLOB="04630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000004c0), 0x0, 0x0, 0x0}) [ 1784.821293] binder: 12032:12033 Release 1 refcount change on invalid ref 0 ret -22 [ 1784.833453] binder: 12032:12033 unknown command 1850775417 [ 1784.846248] binder: 12032:12033 ioctl c0306201 200000c0 returned -22 [ 1784.849577] binder: 12041:12044 Acquire 1 refcount change on invalid ref 0 ret -22 16:21:14 executing program 0: syz_open_procfs(0x0, &(0x7f0000000080)='net/dev_snmp6\x00') socket(0x10, 0x80002, 0x0) r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) socket$nl_generic(0x10, 0x3, 0x10) syz_open_procfs(0x0, &(0x7f0000000980)='net/sofH\x16tnet_sua') socket$inet6_tcp(0xa, 0x1, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) request_key(&(0x7f0000000000)='user\x00', &(0x7f0000000040)={'syz'}, &(0x7f0000000a80), 0xfffffffffffffffd) socket$inet(0x2, 0x4000000000000001, 0x0) perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x1ee6b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0xeb, 0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB="0563044000000000046304400000000006630440000000007997506ea39438033ada635f7cd4c9d1de50cf51e7a773b356e7348d3b19cbdc76ed97a6a08da8997815ea9e6d3b6a1d5a7c1cdf78337a6166cfd70cf41b6cb958e69b7dae4fe74a09c8e4db4c323ba219438b49c2f1736eb01b18c098512160aad1c0394bd4c9b785ea39e6f5b1f809658351bcb5f101899004e6a8542081ceec87f1a675538ce9264c7f128392c875c23507fc8a694ef2d13b127563b2da420a3df952f062dd3d46202a3466fa9a9c985dde3cc577a1fdf40687931bbc4303dbab0e28bb6757bc226d9bba4db1603de1a9c7"], 0x1, 0x0, &(0x7f00000003c0)='L'}) openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCXONC(0xffffffffffffffff, 0x540a, 0x0) [ 1784.891768] binder: 12041:12044 IncRefs 0 refcount change on invalid ref 0 ret -22 [ 1784.919391] binder: 12041:12044 Release 1 refcount change on invalid ref 0 ret -22 [ 1784.931983] binder: 12041:12044 unknown command 1850775417 [ 1784.950764] binder: 12041:12044 ioctl c0306201 200000c0 returned -22 [ 1784.993319] binder: 12056:12057 Acquire 1 refcount change on invalid ref 0 ret -22 [ 1785.015215] binder: 12056:12057 IncRefs 0 refcount change on invalid ref 0 ret -22 [ 1785.029817] binder: 12056:12057 Release 1 refcount change on invalid ref 0 ret -22 [ 1785.038625] binder: 12056:12057 unknown command 1850775417 [ 1785.044555] binder: 12056:12057 ioctl c0306201 200000c0 returned -22 16:21:14 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f00000003c0)="11dca50d5e0bcfe47bf070") r1 = socket$inet_tcp(0x2, 0x1, 0x0) r2 = fcntl$dupfd(r1, 0x0, 0xffffffffffffffff) setsockopt$inet6_MCAST_JOIN_GROUP(r2, 0x29, 0x2a, &(0x7f0000000000)={0x3, {{0xa, 0x4e23, 0x2, @initdev={0xfe, 0x88, [], 0x1, 0x0}, 0x1}}}, 0x88) bind$inet(r1, &(0x7f0000000100)={0x2, 0x4e20}, 0x10) connect$inet(r1, &(0x7f0000000cc0)={0x2, 0x4e20, @local}, 0x10) setsockopt$SO_TIMESTAMPING(r1, 0x1, 0x25, &(0x7f00000010c0)=0x19ff, 0x4) sendto$inet(r1, &(0x7f0000000140)="b0", 0x1, 0x0, 0x0, 0x0) recvmmsg(r1, &(0x7f0000003b40)=[{{0x0, 0x0, 0x0, 0xfd79}}], 0x1, 0x2000, 0x0) 16:21:14 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) r2 = dup2(r1, r0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000380)=ANY=[@ANYBLOB="04630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000004c0), 0x0, 0x0, 0x0}) 16:21:14 executing program 4: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000000)) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0xf) 16:21:14 executing program 1: syz_open_procfs(0x0, &(0x7f0000000080)='net/dev_snmp6\x00') socket(0x10, 0x80002, 0x0) r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) socket$nl_generic(0x10, 0x3, 0x10) syz_open_procfs(0x0, &(0x7f0000000980)='net/sofH\x16tnet_sua') socket$inet6_tcp(0xa, 0x1, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) request_key(&(0x7f0000000000)='user\x00', &(0x7f0000000040)={'syz'}, &(0x7f0000000a80), 0xfffffffffffffffd) socket$inet(0x2, 0x4000000000000001, 0x0) perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x1ee6b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0xeb, 0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB="0563044000000000046304400000000006630440000000007997506ea39438033ada635f7cd4c9d1de50cf51e7a773b356e7348d3b19cbdc76ed97a6a08da8997815ea9e6d3b6a1d5a7c1cdf78337a6166cfd70cf41b6cb958e69b7dae4fe74a09c8e4db4c323ba219438b49c2f1736eb01b18c098512160aad1c0394bd4c9b785ea39e6f5b1f809658351bcb5f101899004e6a8542081ceec87f1a675538ce9264c7f128392c875c23507fc8a694ef2d13b127563b2da420a3df952f062dd3d46202a3466fa9a9c985dde3cc577a1fdf40687931bbc4303dbab0e28bb6757bc226d9bba4db1603de1a9c7"], 0x1, 0x0, &(0x7f00000003c0)='L'}) ioctl$TCXONC(0xffffffffffffffff, 0x540a, 0x0) 16:21:14 executing program 0: syz_open_procfs(0x0, &(0x7f0000000080)='net/dev_snmp6\x00') socket(0x10, 0x80002, 0x0) r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) socket$nl_generic(0x10, 0x3, 0x10) syz_open_procfs(0x0, &(0x7f0000000980)='net/sofH\x16tnet_sua') socket$inet6_tcp(0xa, 0x1, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) request_key(&(0x7f0000000000)='user\x00', &(0x7f0000000040)={'syz'}, &(0x7f0000000a80), 0xfffffffffffffffd) socket$inet(0x2, 0x4000000000000001, 0x0) perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x1ee6b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0xeb, 0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB="0563044000000000046304400000000006630440000000007997506ea39438033ada635f7cd4c9d1de50cf51e7a773b356e7348d3b19cbdc76ed97a6a08da8997815ea9e6d3b6a1d5a7c1cdf78337a6166cfd70cf41b6cb958e69b7dae4fe74a09c8e4db4c323ba219438b49c2f1736eb01b18c098512160aad1c0394bd4c9b785ea39e6f5b1f809658351bcb5f101899004e6a8542081ceec87f1a675538ce9264c7f128392c875c23507fc8a694ef2d13b127563b2da420a3df952f062dd3d46202a3466fa9a9c985dde3cc577a1fdf40687931bbc4303dbab0e28bb6757bc226d9bba4db1603de1a9c7"], 0x1, 0x0, &(0x7f00000003c0)='L'}) openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCXONC(0xffffffffffffffff, 0x540a, 0x0) 16:21:14 executing program 2: r0 = openat(0xffffffffffffff9c, &(0x7f0000000580)='./file0/file0\x00', 0x20402, 0x0) ioctl$TIOCLINUX4(r0, 0x541c, &(0x7f00000005c0)) r1 = syz_open_procfs(0x0, &(0x7f0000000080)='net/dev_snmp6\x00') r2 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r2, 0x40045431, &(0x7f00000000c0)) ioctl$SIOCGSTAMPNS(r0, 0x8907, &(0x7f0000000600)) r3 = syz_open_pts(r2, 0x0) r4 = dup3(r3, r1, 0x0) ioctl$TCXONC(r4, 0x540a, 0x0) pselect6(0x40, &(0x7f0000000340)={0x9}, 0x0, 0x0, 0x0, 0x0) syz_mount_image$ext4(&(0x7f0000000000)='ext2\x00', &(0x7f0000000100)='./file0\x00', 0x5, 0x5, &(0x7f0000000500)=[{&(0x7f0000000140)="e938480c544e08befc0730fd1be4734966a88a23e6556baafad00bfdecd049ce9270af2b7a694f004a599b25994124b4d8d2c6138e70734b65c8165e5e0b8e88b93331ef54ed064bce0f0453a5c054152f7b3c1235eae555a118ab1b466ac17953bf37919f5077cf98664f3ec21edb3908a5", 0x72, 0x3}, {&(0x7f00000001c0)="2fe3ae61", 0x4, 0xd08d}, {&(0x7f0000000200)="ab7793b00cfbd8a2fb355037b8b267ddedd36252e0fcb5331ee8164a4d94eac46cc05ca7c622f78eed674b1303983d6394ea55ac4ea98f5532a00d9ccb575f1c2eae830550d48d048a25facc567db18ebe225969456103af4a2380b9f20f587f8af08876ba7538102aff20032765e6ada2f9a2f08f7c3ccbb0f94efe51b72fa5a63cfae261413608dda87596f083d9c8627625292ee739448be53c68b0d74a3d166bafd40483cd1f111b7efdfe3567825f621bea10d53c4db2dc7a696e2d76a53653638e2514b51c3e602a57f48241214e9dc3007815e6db4053077469f64322691229e53c1723b6c5d47d1e88e18fe3f60faa816a86a78ee21eb1ea72a6", 0xfe, 0x8}, {&(0x7f0000000380)="ffd27a8d0fe98b72ef0ea197687eb67ce79e9ed1a62df58b5519501efc15c8c8fb5c8256b8cc4cb2a0d558203d1e59541369cb8f8fdf3024f70887cbbf07ef5e31e5fdaefdbe256a53dd5a541488d02e77fc539553afbf0e2dadc20cfaac3896b5803940a9d15f92bda15377e680a06d620c07b1d0c8a68d481540be686641f1b4314294424665c4ae5b73590eb2a63181b3e14e4b9addbfc4c53a2c0d7805a6d688bb2fcf2c7183bc30062cf3ef45a6cd14e1ae6b5384eb3b01", 0xba, 0x6}, {&(0x7f0000000440)="fdb92b29734b393a78db58f3e322fabf869f54866c7fa5fc403d297f9adee4ec5f4c83ca76eec9d4a03ef2751016b586e6b62775fff887d7e2d93d913544c38e3b8060a831405ae5f2c9818ead65aa49878badbefe3e78783bdcb19cbc2377d1fccd190eb862df71abbb69c9185b328a74af428d496b9d29706dbf707be0772f4c7171a77a762e6e6d0cb6ae6e68a1f0ad2b747b36fef2a55189d2e7c494cc061af888e68b6772750b9b966e4c8d344be89e2256f31f", 0xb6, 0x3}], 0x40, &(0x7f0000000300)=ANY=[@ANYBLOB="64626a1f726f6c653d2f6465762f70746d78002c00"]) openat$ptmx(0xffffffffffffff9c, &(0x7f0000000640)='/dev/ptmx\x00', 0x200000, 0x0) 16:21:14 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) r2 = dup2(r1, r0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000380)=ANY=[@ANYBLOB="04630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000004c0), 0x0, 0x0, 0x0}) [ 1785.500713] binder: 12071:12075 Acquire 1 refcount change on invalid ref 0 ret -22 [ 1785.503115] EXT4-fs (loop2): VFS: Can't find ext4 filesystem [ 1785.519228] binder: 12071:12075 IncRefs 0 refcount change on invalid ref 0 ret -22 [ 1785.532800] binder: 12073:12076 Acquire 1 refcount change on invalid ref 0 ret -22 [ 1785.535491] binder: 12071:12075 Release 1 refcount change on invalid ref 0 ret -22 16:21:15 executing program 4: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) r1 = socket$inet(0x2, 0xa, 0x400) getsockopt$SO_COOKIE(r1, 0x1, 0x39, &(0x7f0000000000), &(0x7f0000000080)=0x8) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0xf) 16:21:15 executing program 5: r0 = syz_open_procfs(0x0, &(0x7f0000000080)='net/dev_snmp6\x00') socket(0x10, 0x80002, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) socket$nl_generic(0x10, 0x3, 0x10) syz_open_procfs(0x0, &(0x7f0000000980)='net/sofH\x16tnet_sua') socket$inet6_tcp(0xa, 0x1, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) request_key(&(0x7f0000000000)='user\x00', &(0x7f0000000040)={'syz'}, &(0x7f0000000a80), 0xfffffffffffffffd) socket$inet(0x2, 0x4000000000000001, 0x0) perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x1ee6b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000000c0)={0xeb, 0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB="0563044000000000046304400000000006630440000000007997506ea39438033ada635f7cd4c9d1de50cf51e7a773b356e7348d3b19cbdc76ed97a6a08da8997815ea9e6d3b6a1d5a7c1cdf78337a6166cfd70cf41b6cb958e69b7dae4fe74a09c8e4db4c323ba219438b49c2f1736eb01b18c098512160aad1c0394bd4c9b785ea39e6f5b1f809658351bcb5f101899004e6a8542081ceec87f1a675538ce9264c7f128392c875c23507fc8a694ef2d13b127563b2da420a3df952f062dd3d46202a3466fa9a9c985dde3cc577a1fdf40687931bbc4303dbab0e28bb6757bc226d9bba4db1603de1a9c7"], 0x1, 0x0, &(0x7f00000003c0)='L'}) r2 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r2, 0x40045431, &(0x7f00000000c0)) r3 = syz_open_pts(r2, 0x0) dup3(r3, r0, 0x0) [ 1785.579061] binder: 12073:12076 IncRefs 0 refcount change on invalid ref 0 ret -22 [ 1785.590661] binder: 12071:12075 unknown command 1850775417 [ 1785.591449] binder: 12073:12076 Release 1 refcount change on invalid ref 0 ret -22 [ 1785.602453] binder: 12071:12075 ioctl c0306201 200000c0 returned -22 16:21:15 executing program 2: r0 = syz_open_procfs(0x0, &(0x7f0000000080)='net/dev_snmp6\x00') r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r1, 0x40045431, &(0x7f00000000c0)) r2 = syz_open_pts(r1, 0x0) r3 = dup3(r2, r0, 0x0) ioctl$TCXONC(r3, 0x540a, 0x0) r4 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r5 = openat(0xffffffffffffff9c, 0x0, 0x0, 0x50) r6 = socket$key(0xf, 0x3, 0x2) sendmsg$key(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, 0x0}, 0x0) sendmsg$key(0xffffffffffffffff, 0x0, 0x0) ioctl$TIOCGPGRP(r5, 0x540f, 0x0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000740), 0x0) ioctl$TIOCGSID(r5, 0x5429, 0x0) geteuid() fstat(r6, &(0x7f0000000bc0)) ioctl$TIOCGSID(r5, 0x5429, &(0x7f0000000c40)) getsockopt$inet_IP_XFRM_POLICY(r5, 0x0, 0x11, &(0x7f0000000c80)={{{@in6=@ipv4={[], [], @multicast2}, @in=@empty}}, {{@in=@multicast1}, 0x0, @in=@loopback}}, &(0x7f0000000d80)=0x401) getresgid(0x0, &(0x7f0000001540), 0x0) fcntl$getownex(0xffffffffffffffff, 0x10, &(0x7f00000015c0)) r7 = bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0x6, 0x3, &(0x7f0000001fd8)=ANY=[@ANYBLOB="850000002a0000006f000000000000009500000000000000"], &(0x7f0000003ff6)='GPL\x00', 0x1, 0xc3, &(0x7f000000cf3d)=""/195}, 0x48) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000340)={r7, 0x0, 0xe, 0x0, &(0x7f00000001c0)="0a1986a8dd630832ff108ce7035f", 0x0}, 0x28) fstat(r6, &(0x7f0000001600)) getegid() ioctl$sock_SIOCGPGRP(r5, 0x8904, &(0x7f0000001680)) getgroups(0x1, &(0x7f0000001800)=[0xee00]) ioctl$TIOCGPGRP(r4, 0x540f, &(0x7f0000002d40)) fcntl$getownex(0xffffffffffffffff, 0x10, &(0x7f0000002d80)) getsockopt$inet6_IPV6_IPSEC_POLICY(r6, 0x29, 0x22, &(0x7f0000002dc0)={{{@in6=@loopback, @in=@multicast1}}, {{@in6=@local}, 0x0, @in=@loopback}}, &(0x7f0000002ec0)=0xe8) [ 1785.616412] binder: 12073:12076 unknown command 1850775417 [ 1785.637963] binder: 12073:12076 ioctl c0306201 200000c0 returned -22 16:21:15 executing program 1: syz_open_procfs(0x0, &(0x7f0000000080)='net/dev_snmp6\x00') socket(0x10, 0x80002, 0x0) r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) socket$nl_generic(0x10, 0x3, 0x10) syz_open_procfs(0x0, &(0x7f0000000980)='net/sofH\x16tnet_sua') socket$inet6_tcp(0xa, 0x1, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) request_key(&(0x7f0000000000)='user\x00', &(0x7f0000000040)={'syz'}, &(0x7f0000000a80), 0xfffffffffffffffd) socket$inet(0x2, 0x4000000000000001, 0x0) perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x1ee6b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0xeb, 0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB="0563044000000000046304400000000006630440000000007997506ea39438033ada635f7cd4c9d1de50cf51e7a773b356e7348d3b19cbdc76ed97a6a08da8997815ea9e6d3b6a1d5a7c1cdf78337a6166cfd70cf41b6cb958e69b7dae4fe74a09c8e4db4c323ba219438b49c2f1736eb01b18c098512160aad1c0394bd4c9b785ea39e6f5b1f809658351bcb5f101899004e6a8542081ceec87f1a675538ce9264c7f128392c875c23507fc8a694ef2d13b127563b2da420a3df952f062dd3d46202a3466fa9a9c985dde3cc577a1fdf40687931bbc4303dbab0e28bb6757bc226d9bba4db1603de1a9c7"], 0x1, 0x0, &(0x7f00000003c0)='L'}) ioctl$TCXONC(0xffffffffffffffff, 0x540a, 0x0) 16:21:15 executing program 0: r0 = syz_open_procfs(0x0, &(0x7f0000000080)='net/dev_snmp6\x00') socket(0x10, 0x80002, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) socket$nl_generic(0x10, 0x3, 0x10) syz_open_procfs(0x0, &(0x7f0000000980)='net/sofH\x16tnet_sua') socket$inet6_tcp(0xa, 0x1, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) request_key(&(0x7f0000000000)='user\x00', &(0x7f0000000040)={'syz'}, &(0x7f0000000a80), 0xfffffffffffffffd) socket$inet(0x2, 0x4000000000000001, 0x0) perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x1ee6b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000000c0)={0xeb, 0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB="0563044000000000046304400000000006630440000000007997506ea39438033ada635f7cd4c9d1de50cf51e7a773b356e7348d3b19cbdc76ed97a6a08da8997815ea9e6d3b6a1d5a7c1cdf78337a6166cfd70cf41b6cb958e69b7dae4fe74a09c8e4db4c323ba219438b49c2f1736eb01b18c098512160aad1c0394bd4c9b785ea39e6f5b1f809658351bcb5f101899004e6a8542081ceec87f1a675538ce9264c7f128392c875c23507fc8a694ef2d13b127563b2da420a3df952f062dd3d46202a3466fa9a9c985dde3cc577a1fdf40687931bbc4303dbab0e28bb6757bc226d9bba4db1603de1a9c7"], 0x1, 0x0, &(0x7f00000003c0)='L'}) r2 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r2, 0x40045431, &(0x7f00000000c0)) r3 = syz_open_pts(r2, 0x0) dup3(r3, r0, 0x0) [ 1785.746041] binder: 12100:12102 Acquire 1 refcount change on invalid ref 0 ret -22 [ 1785.756506] binder: 12107:12109 Acquire 1 refcount change on invalid ref 0 ret -22 [ 1785.756852] binder: 12107:12109 IncRefs 0 refcount change on invalid ref 0 ret -22 [ 1785.757141] binder: 12107:12109 Release 1 refcount change on invalid ref 0 ret -22 [ 1785.757152] binder: 12107:12109 unknown command 1850775417 [ 1785.757165] binder: 12107:12109 ioctl c0306201 200000c0 returned -22 [ 1785.885986] binder: 12100:12102 IncRefs 0 refcount change on invalid ref 0 ret -22 [ 1785.888846] binder: 12111:12117 Acquire 1 refcount change on invalid ref 0 ret -22 [ 1785.912632] binder: 12111:12117 IncRefs 0 refcount change on invalid ref 0 ret -22 [ 1785.917913] binder: 12100:12102 Release 1 refcount change on invalid ref 0 ret -22 [ 1785.923010] binder: 12111:12117 Release 1 refcount change on invalid ref 0 ret -22 [ 1785.934624] binder: 12100:12102 unknown command 1850775417 [ 1785.943270] binder: 12111:12117 unknown command 1850775417 [ 1785.943828] binder: 12111:12117 ioctl c0306201 200000c0 returned -22 [ 1786.000568] binder: 12100:12102 ioctl c0306201 200000c0 returned -22 16:21:15 executing program 4: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r2, 0x40045431, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1}) syz_open_pts(r2, 0x0) ioctl$TIOCSIG(r2, 0x40045436, 0x1e) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0xf) 16:21:15 executing program 1: syz_open_procfs(0x0, &(0x7f0000000080)='net/dev_snmp6\x00') socket(0x10, 0x80002, 0x0) r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) socket$nl_generic(0x10, 0x3, 0x10) syz_open_procfs(0x0, &(0x7f0000000980)='net/sofH\x16tnet_sua') socket$inet6_tcp(0xa, 0x1, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) request_key(&(0x7f0000000000)='user\x00', &(0x7f0000000040)={'syz'}, &(0x7f0000000a80), 0xfffffffffffffffd) socket$inet(0x2, 0x4000000000000001, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0xeb, 0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB="0563044000000000046304400000000006630440000000007997506ea39438033ada635f7cd4c9d1de50cf51e7a773b356e7348d3b19cbdc76ed97a6a08da8997815ea9e6d3b6a1d5a7c1cdf78337a6166cfd70cf41b6cb958e69b7dae4fe74a09c8e4db4c323ba219438b49c2f1736eb01b18c098512160aad1c0394bd4c9b785ea39e6f5b1f809658351bcb5f101899004e6a8542081ceec87f1a675538ce9264c7f128392c875c23507fc8a694ef2d13b127563b2da420a3df952f062dd3d46202a3466fa9a9c985dde3cc577a1fdf40687931bbc4303dbab0e28bb6757bc226d9bba4db1603de1a9c7"], 0x1, 0x0, &(0x7f00000003c0)='L'}) ioctl$TCXONC(0xffffffffffffffff, 0x540a, 0x0) 16:21:15 executing program 0: syz_open_procfs(0x0, &(0x7f0000000080)='net/dev_snmp6\x00') socket(0x10, 0x80002, 0x0) r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) socket$nl_generic(0x10, 0x3, 0x10) syz_open_procfs(0x0, &(0x7f0000000980)='net/sofH\x16tnet_sua') socket$inet6_tcp(0xa, 0x1, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) request_key(&(0x7f0000000000)='user\x00', &(0x7f0000000040)={'syz'}, &(0x7f0000000a80), 0xfffffffffffffffd) socket$inet(0x2, 0x4000000000000001, 0x0) perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x1ee6b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0xeb, 0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB="0563044000000000046304400000000006630440000000007997506ea39438033ada635f7cd4c9d1de50cf51e7a773b356e7348d3b19cbdc76ed97a6a08da8997815ea9e6d3b6a1d5a7c1cdf78337a6166cfd70cf41b6cb958e69b7dae4fe74a09c8e4db4c323ba219438b49c2f1736eb01b18c098512160aad1c0394bd4c9b785ea39e6f5b1f809658351bcb5f101899004e6a8542081ceec87f1a675538ce9264c7f128392c875c23507fc8a694ef2d13b127563b2da420a3df952f062dd3d46202a3466fa9a9c985dde3cc577a1fdf40687931bbc4303dbab0e28bb6757bc226d9bba4db1603de1a9c7"], 0x1, 0x0, &(0x7f00000003c0)='L'}) ioctl$TCXONC(0xffffffffffffffff, 0x540a, 0x0) 16:21:15 executing program 5: r0 = syz_open_procfs(0x0, &(0x7f0000000080)='net/dev_snmp6\x00') socket(0x10, 0x80002, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) socket$nl_generic(0x10, 0x3, 0x10) syz_open_procfs(0x0, &(0x7f0000000980)='net/sofH\x16tnet_sua') socket$inet6_tcp(0xa, 0x1, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) request_key(&(0x7f0000000000)='user\x00', &(0x7f0000000040)={'syz'}, &(0x7f0000000a80), 0xfffffffffffffffd) socket$inet(0x2, 0x4000000000000001, 0x0) perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x1ee6b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000000c0)={0xeb, 0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB="0563044000000000046304400000000006630440000000007997506ea39438033ada635f7cd4c9d1de50cf51e7a773b356e7348d3b19cbdc76ed97a6a08da8997815ea9e6d3b6a1d5a7c1cdf78337a6166cfd70cf41b6cb958e69b7dae4fe74a09c8e4db4c323ba219438b49c2f1736eb01b18c098512160aad1c0394bd4c9b785ea39e6f5b1f809658351bcb5f101899004e6a8542081ceec87f1a675538ce9264c7f128392c875c23507fc8a694ef2d13b127563b2da420a3df952f062dd3d46202a3466fa9a9c985dde3cc577a1fdf40687931bbc4303dbab0e28bb6757bc226d9bba4db1603de1a9c7"], 0x1, 0x0, &(0x7f00000003c0)='L'}) r2 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r2, 0x40045431, &(0x7f00000000c0)) r3 = syz_open_pts(r2, 0x0) dup3(r3, r0, 0x0) 16:21:15 executing program 2: r0 = syz_open_procfs(0x0, &(0x7f0000000080)='net/dev_snmp6\x00') r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ptmx\x00', 0x0, 0x0) clone(0x7fc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = gettid() wait4(0x0, 0x0, 0x40000000, 0x0) sendmsg$nl_netfilter(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000280)=ANY=[@ANYBLOB="cce9e06959811b2edc48f1ce64966dbc3b96cad5ee32525c9dd0ed584fe4b273fc1e2ed7209ae3aa9c93ef0904fe6e1df8510077897a882d5396bf5013b651e8c639168a7c7d78c184f70acbaf50aa68e5c58b1842703f4e622d6cdafaca808158939ddfca61ab2a6177a32dc6c842e9f79411b1abd80649853440b01f381a550b470f6467d31d13b181c6c014fb515c6340e7b3e0c95ec33eb082925d66b43bc5c6f0dcd4f8f45fb0aaa3be519ab1a8"], 0xb0}}, 0x0) ptrace$setopts(0x4206, r2, 0x0, 0x0) tkill(r2, 0x3b) ptrace$setregs(0xd, r2, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r2, 0x0, 0x0) ptrace$PTRACE_SECCOMP_GET_FILTER(0x420c, 0x0, 0x0, 0x0) ioctl$TCSETS(r1, 0x40045431, &(0x7f00000000c0)) r3 = syz_open_pts(r1, 0x0) r4 = dup3(r3, r0, 0x0) ioctl$TCXONC(r4, 0x540a, 0x0) pselect6(0x40, &(0x7f0000000340)={0x9}, 0x0, 0x0, 0x0, 0x0) 16:21:15 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f00000003c0)="11dca50d5e0bcfe47bf070") r1 = socket$inet_tcp(0x2, 0x1, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f0000002e80)=[{{&(0x7f0000000040)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @link_local}, 0x80, &(0x7f00000000c0)=[{&(0x7f0000000180)=""/165, 0xa5}, {&(0x7f0000000240)=""/235, 0xeb}, {&(0x7f0000000400)=""/151, 0x97}, {&(0x7f0000000340)=""/87, 0x57}], 0x4, &(0x7f00000004c0)=""/62, 0x3e}, 0x4}, {{&(0x7f0000000500)=@pppoe={0x18, 0x0, {0x0, @random}}, 0x80, &(0x7f00000006c0)=[{&(0x7f0000000580)=""/87, 0x57}, {&(0x7f0000000600)}, {&(0x7f0000000640)=""/66, 0x42}], 0x3, &(0x7f0000000700)=""/231, 0xe7}, 0x9}, {{&(0x7f0000000800)=@llc={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @random}, 0x80, &(0x7f0000000c40)=[{&(0x7f0000000880)=""/239, 0xef}, {&(0x7f0000000980)=""/26, 0x1a}, {&(0x7f00000009c0)=""/207, 0xcf}, {&(0x7f0000000ac0)=""/236, 0xec}, {&(0x7f0000000bc0)=""/90, 0x5a}, {&(0x7f0000000d00)=""/195, 0xc3}], 0x6, &(0x7f0000000e00)=""/69, 0x45}, 0x1}, {{&(0x7f0000000e80)=@in, 0x80, &(0x7f0000001000)=[{&(0x7f0000000f00)=""/5, 0x5}, {&(0x7f0000000f40)=""/183, 0xb7}], 0x2, &(0x7f0000001040)=""/125, 0x7d}, 0x4}, {{&(0x7f0000001100)=@nfc, 0x80, &(0x7f0000001500)=[{&(0x7f0000001180)=""/212, 0xd4}, {&(0x7f0000001280)=""/118, 0x76}, {&(0x7f0000001300)=""/233, 0xe9}, {&(0x7f0000001400)=""/231, 0xe7}], 0x4, &(0x7f0000001540)=""/31, 0x1f}, 0x1}, {{0x0, 0x0, &(0x7f0000001740)=[{&(0x7f0000001580)=""/175, 0xaf}, {&(0x7f0000001640)=""/172, 0xac}, {&(0x7f0000001700)=""/2, 0x2}], 0x3, &(0x7f0000001780)=""/37, 0x25}, 0x100000000}, {{&(0x7f00000017c0)=@pppol2tpin6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @loopback}}}, 0x80, &(0x7f0000002b80)=[{&(0x7f0000001840)=""/72, 0x48}, {&(0x7f00000018c0)=""/109, 0x6d}, {&(0x7f0000001940)=""/174, 0xae}, {&(0x7f0000001a00)=""/4096, 0x1000}, {&(0x7f0000002a00)=""/90, 0x5a}, {&(0x7f0000002a80)=""/98, 0x62}, {&(0x7f0000002b00)=""/98, 0x62}], 0x7, &(0x7f0000002c00)=""/139, 0x8b}, 0x100000000}, {{0x0, 0x0, &(0x7f0000002e40)=[{&(0x7f0000002cc0)=""/245, 0xf5}, {&(0x7f0000002dc0)=""/1, 0x1}, {&(0x7f0000002e00)=""/58, 0x3a}], 0x3, &(0x7f0000003b80)=""/4096, 0x1000}, 0x5}], 0x8, 0x6002, 0x0) pipe(&(0x7f0000000480)={0xffffffffffffffff, 0xffffffffffffffff}) write(r2, &(0x7f0000000340), 0x41395527) pipe(&(0x7f0000000480)={0xffffffffffffffff, 0xffffffffffffffff}) write(r3, &(0x7f0000000340), 0x41395527) bind$inet(r3, &(0x7f0000000100)={0x2, 0x4e22, @remote}, 0xfffffed4) connect$inet(r1, &(0x7f0000000cc0)={0x2, 0x4e20, @local}, 0x10) setsockopt$SO_TIMESTAMPING(r1, 0x1, 0x25, &(0x7f00000010c0)=0x19ff, 0x4) sendto$inet(r1, &(0x7f0000000140)="b0", 0x1, 0x0, 0x0, 0x0) pipe(&(0x7f0000000480)={0xffffffffffffffff, 0xffffffffffffffff}) write(r4, &(0x7f0000000340), 0x41395527) recvmmsg(r4, &(0x7f0000003b40)=[{{0x0, 0x0, 0x0}, 0xffffffffffffffff}], 0x1, 0x40, 0x0) [ 1786.392351] binder: 12130:12132 Acquire 1 refcount change on invalid ref 0 ret -22 [ 1786.393622] binder: 12129:12136 Acquire 1 refcount change on invalid ref 0 ret -22 [ 1786.408876] binder: 12129:12136 IncRefs 0 refcount change on invalid ref 0 ret -22 [ 1786.411688] binder: 12130:12132 IncRefs 0 refcount change on invalid ref 0 ret -22 [ 1786.428435] binder: 12131:12137 Acquire 1 refcount change on invalid ref 0 ret -22 [ 1786.428902] binder: 12131:12137 IncRefs 0 refcount change on invalid ref 0 ret -22 [ 1786.429759] binder: 12131:12137 Release 1 refcount change on invalid ref 0 ret -22 [ 1786.429771] binder: 12131:12137 unknown command 1850775417 [ 1786.429790] binder: 12131:12137 ioctl c0306201 200000c0 returned -22 [ 1786.438699] binder: 12129:12136 Release 1 refcount change on invalid ref 0 ret -22 [ 1786.447331] binder: 12130:12132 Release 1 refcount change on invalid ref 0 ret -22 [ 1786.478919] binder: 12129:12136 unknown command 1850775417 [ 1786.488616] binder: 12130:12132 unknown command 1850775417 [ 1786.498710] binder: 12130:12132 ioctl c0306201 200000c0 returned -22 [ 1786.508811] binder: 12129:12136 ioctl c0306201 200000c0 returned -22 16:21:16 executing program 0: r0 = syz_open_procfs(0x0, &(0x7f0000000080)='net/dev_snmp6\x00') r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r1, 0x40045431, &(0x7f00000000c0)) r2 = syz_open_pts(r1, 0x0) r3 = dup3(r2, r0, 0x0) ioctl$TCXONC(r3, 0x540a, 0x0) r4 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r5 = openat(0xffffffffffffff9c, 0x0, 0x0, 0x50) r6 = socket$key(0xf, 0x3, 0x2) sendmsg$key(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, 0x0}, 0x0) sendmsg$key(0xffffffffffffffff, 0x0, 0x0) ioctl$TIOCGPGRP(r5, 0x540f, 0x0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000740), 0x0) ioctl$TIOCGSID(r5, 0x5429, 0x0) geteuid() fstat(r6, &(0x7f0000000bc0)) ioctl$TIOCGSID(r5, 0x5429, &(0x7f0000000c40)) getsockopt$inet_IP_XFRM_POLICY(r5, 0x0, 0x11, &(0x7f0000000c80)={{{@in6=@ipv4={[], [], @multicast2}, @in=@empty}}, {{@in=@multicast1}, 0x0, @in=@loopback}}, &(0x7f0000000d80)=0x401) getresgid(0x0, &(0x7f0000001540), 0x0) fcntl$getownex(0xffffffffffffffff, 0x10, &(0x7f00000015c0)) r7 = bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0x6, 0x3, &(0x7f0000001fd8)=ANY=[@ANYBLOB="850000002a0000006f000000000000009500000000000000"], &(0x7f0000003ff6)='GPL\x00', 0x1, 0xc3, &(0x7f000000cf3d)=""/195}, 0x48) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000340)={r7, 0x0, 0xe, 0x0, &(0x7f00000001c0)="0a1986a8dd630832ff108ce7035f", 0x0}, 0x28) fstat(r6, &(0x7f0000001600)) getegid() ioctl$sock_SIOCGPGRP(r5, 0x8904, &(0x7f0000001680)) getgroups(0x1, &(0x7f0000001800)=[0xee00]) ioctl$TIOCGPGRP(r4, 0x540f, &(0x7f0000002d40)) fcntl$getownex(0xffffffffffffffff, 0x10, &(0x7f0000002d80)) getsockopt$inet6_IPV6_IPSEC_POLICY(r6, 0x29, 0x22, &(0x7f0000002dc0)={{{@in6=@loopback, @in=@multicast1}}, {{@in6=@local}, 0x0, @in=@loopback}}, &(0x7f0000002ec0)=0xe8) 16:21:16 executing program 1: syz_open_procfs(0x0, &(0x7f0000000080)='net/dev_snmp6\x00') socket(0x10, 0x80002, 0x0) r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) socket$nl_generic(0x10, 0x3, 0x10) syz_open_procfs(0x0, &(0x7f0000000980)='net/sofH\x16tnet_sua') socket$inet6_tcp(0xa, 0x1, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) request_key(&(0x7f0000000000)='user\x00', &(0x7f0000000040)={'syz'}, &(0x7f0000000a80), 0xfffffffffffffffd) socket$inet(0x2, 0x4000000000000001, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0xeb, 0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB="0563044000000000046304400000000006630440000000007997506ea39438033ada635f7cd4c9d1de50cf51e7a773b356e7348d3b19cbdc76ed97a6a08da8997815ea9e6d3b6a1d5a7c1cdf78337a6166cfd70cf41b6cb958e69b7dae4fe74a09c8e4db4c323ba219438b49c2f1736eb01b18c098512160aad1c0394bd4c9b785ea39e6f5b1f809658351bcb5f101899004e6a8542081ceec87f1a675538ce9264c7f128392c875c23507fc8a694ef2d13b127563b2da420a3df952f062dd3d46202a3466fa9a9c985dde3cc577a1fdf40687931bbc4303dbab0e28bb6757bc226d9bba4db1603de1a9c7"], 0x1, 0x0, &(0x7f00000003c0)='L'}) ioctl$TCXONC(0xffffffffffffffff, 0x540a, 0x0) 16:21:16 executing program 4: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) pipe(&(0x7f0000000480)={0xffffffffffffffff, 0xffffffffffffffff}) write(r2, &(0x7f0000000340), 0x41395527) write$P9_RRENAMEAT(r2, &(0x7f0000000000)={0x7, 0x4b, 0xfffffffffffffffe}, 0x6) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0xf) 16:21:16 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) r2 = dup2(r1, r0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000380)=ANY=[], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000300)={0x8, 0x0, &(0x7f00000004c0)=[@acquire={0x40046304}], 0x0, 0x0, 0x0}) [ 1786.630965] binder: 12156:12161 Acquire 1 refcount change on invalid ref 0 ret -22 [ 1786.639519] binder: 12156:12161 IncRefs 0 refcount change on invalid ref 0 ret -22 [ 1786.649970] binder: 12156:12161 Release 1 refcount change on invalid ref 0 ret -22 [ 1786.657983] binder: 12156:12161 unknown command 1850775417 [ 1786.675239] binder: 12156:12161 ioctl c0306201 200000c0 returned -22 16:21:16 executing program 1: syz_open_procfs(0x0, &(0x7f0000000080)='net/dev_snmp6\x00') socket(0x10, 0x80002, 0x0) r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) socket$nl_generic(0x10, 0x3, 0x10) syz_open_procfs(0x0, &(0x7f0000000980)='net/sofH\x16tnet_sua') socket$inet6_tcp(0xa, 0x1, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) request_key(&(0x7f0000000000)='user\x00', &(0x7f0000000040)={'syz'}, &(0x7f0000000a80), 0xfffffffffffffffd) socket$inet(0x2, 0x4000000000000001, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0xeb, 0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB="0563044000000000046304400000000006630440000000007997506ea39438033ada635f7cd4c9d1de50cf51e7a773b356e7348d3b19cbdc76ed97a6a08da8997815ea9e6d3b6a1d5a7c1cdf78337a6166cfd70cf41b6cb958e69b7dae4fe74a09c8e4db4c323ba219438b49c2f1736eb01b18c098512160aad1c0394bd4c9b785ea39e6f5b1f809658351bcb5f101899004e6a8542081ceec87f1a675538ce9264c7f128392c875c23507fc8a694ef2d13b127563b2da420a3df952f062dd3d46202a3466fa9a9c985dde3cc577a1fdf40687931bbc4303dbab0e28bb6757bc226d9bba4db1603de1a9c7"], 0x1, 0x0, &(0x7f00000003c0)='L'}) ioctl$TCXONC(0xffffffffffffffff, 0x540a, 0x0) 16:21:16 executing program 0: syz_open_procfs(0x0, &(0x7f0000000080)='net/dev_snmp6\x00') socket(0x10, 0x80002, 0x0) r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) socket$nl_generic(0x10, 0x3, 0x10) syz_open_procfs(0x0, &(0x7f0000000980)='net/sofH\x16tnet_sua') socket$inet6_tcp(0xa, 0x1, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) request_key(&(0x7f0000000000)='user\x00', &(0x7f0000000040)={'syz'}, &(0x7f0000000a80), 0xfffffffffffffffd) socket$inet(0x2, 0x4000000000000001, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0xeb, 0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB="0563044000000000046304400000000006630440000000007997506ea39438033ada635f7cd4c9d1de50cf51e7a773b356e7348d3b19cbdc76ed97a6a08da8997815ea9e6d3b6a1d5a7c1cdf78337a6166cfd70cf41b6cb958e69b7dae4fe74a09c8e4db4c323ba219438b49c2f1736eb01b18c098512160aad1c0394bd4c9b785ea39e6f5b1f809658351bcb5f101899004e6a8542081ceec87f1a675538ce9264c7f128392c875c23507fc8a694ef2d13b127563b2da420a3df952f062dd3d46202a3466fa9a9c985dde3cc577a1fdf40687931bbc4303dbab0e28bb6757bc226d9bba4db1603de1a9c7"], 0x1, 0x0, &(0x7f00000003c0)='L'}) ioctl$TCXONC(0xffffffffffffffff, 0x540a, 0x0) 16:21:16 executing program 5: r0 = syz_open_procfs(0x0, &(0x7f0000000080)='net/dev_snmp6\x00') socket(0x10, 0x80002, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) socket$nl_generic(0x10, 0x3, 0x10) syz_open_procfs(0x0, &(0x7f0000000980)='net/sofH\x16tnet_sua') socket$inet6_tcp(0xa, 0x1, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) request_key(&(0x7f0000000000)='user\x00', &(0x7f0000000040)={'syz'}, &(0x7f0000000a80), 0xfffffffffffffffd) socket$inet(0x2, 0x4000000000000001, 0x0) perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x1ee6b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000000c0)={0xeb, 0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB="0563044000000000046304400000000006630440000000007997506ea39438033ada635f7cd4c9d1de50cf51e7a773b356e7348d3b19cbdc76ed97a6a08da8997815ea9e6d3b6a1d5a7c1cdf78337a6166cfd70cf41b6cb958e69b7dae4fe74a09c8e4db4c323ba219438b49c2f1736eb01b18c098512160aad1c0394bd4c9b785ea39e6f5b1f809658351bcb5f101899004e6a8542081ceec87f1a675538ce9264c7f128392c875c23507fc8a694ef2d13b127563b2da420a3df952f062dd3d46202a3466fa9a9c985dde3cc577a1fdf40687931bbc4303dbab0e28bb6757bc226d9bba4db1603de1a9c7"], 0x1, 0x0, &(0x7f00000003c0)='L'}) r2 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r2, 0x40045431, &(0x7f00000000c0)) r3 = syz_open_pts(r2, 0x0) r4 = dup3(r3, r0, 0x0) ioctl$TCXONC(r4, 0x540a, 0x0) [ 1786.753250] binder: 12173:12175 Acquire 1 refcount change on invalid ref 0 ret -22 [ 1786.775132] binder: 12180:12182 Acquire 1 refcount change on invalid ref 0 ret -22 [ 1786.777799] binder: 12173:12175 IncRefs 0 refcount change on invalid ref 0 ret -22 [ 1786.789802] binder: 12180:12182 IncRefs 0 refcount change on invalid ref 0 ret -22 [ 1786.792054] binder: 12173:12175 Release 1 refcount change on invalid ref 0 ret -22 [ 1786.804850] binder: 12180:12182 Release 1 refcount change on invalid ref 0 ret -22 [ 1786.808347] binder: 12173:12175 unknown command 1850775417 [ 1786.817417] binder: 12180:12182 unknown command 1850775417 [ 1786.823112] binder: 12173:12175 ioctl c0306201 200000c0 returned -22 [ 1786.834911] binder: 12180:12182 ioctl c0306201 200000c0 returned -22 [ 1786.835758] binder: 12184:12185 Acquire 1 refcount change on invalid ref 0 ret -22 16:21:16 executing program 1: syz_open_procfs(0x0, &(0x7f0000000080)='net/dev_snmp6\x00') socket(0x10, 0x80002, 0x0) r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) socket$nl_generic(0x10, 0x3, 0x10) syz_open_procfs(0x0, &(0x7f0000000980)='net/sofH\x16tnet_sua') socket$inet6_tcp(0xa, 0x1, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) request_key(&(0x7f0000000000)='user\x00', &(0x7f0000000040)={'syz'}, &(0x7f0000000a80), 0xfffffffffffffffd) perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x1ee6b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0xeb, 0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB="0563044000000000046304400000000006630440000000007997506ea39438033ada635f7cd4c9d1de50cf51e7a773b356e7348d3b19cbdc76ed97a6a08da8997815ea9e6d3b6a1d5a7c1cdf78337a6166cfd70cf41b6cb958e69b7dae4fe74a09c8e4db4c323ba219438b49c2f1736eb01b18c098512160aad1c0394bd4c9b785ea39e6f5b1f809658351bcb5f101899004e6a8542081ceec87f1a675538ce9264c7f128392c875c23507fc8a694ef2d13b127563b2da420a3df952f062dd3d46202a3466fa9a9c985dde3cc577a1fdf40687931bbc4303dbab0e28bb6757bc226d9bba4db1603de1a9c7"], 0x1, 0x0, &(0x7f00000003c0)='L'}) ioctl$TCXONC(0xffffffffffffffff, 0x540a, 0x0) 16:21:16 executing program 0: r0 = syz_open_procfs(0x0, &(0x7f0000000080)='net/dev_snmp6\x00') socket(0x10, 0x80002, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) socket$nl_generic(0x10, 0x3, 0x10) syz_open_procfs(0x0, &(0x7f0000000980)='net/sofH\x16tnet_sua') socket$inet6_tcp(0xa, 0x1, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) request_key(&(0x7f0000000000)='user\x00', &(0x7f0000000040)={'syz'}, &(0x7f0000000a80), 0xfffffffffffffffd) socket$inet(0x2, 0x4000000000000001, 0x0) perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x1ee6b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000000c0)={0xeb, 0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB="0563044000000000046304400000000006630440000000007997506ea39438033ada635f7cd4c9d1de50cf51e7a773b356e7348d3b19cbdc76ed97a6a08da8997815ea9e6d3b6a1d5a7c1cdf78337a6166cfd70cf41b6cb958e69b7dae4fe74a09c8e4db4c323ba219438b49c2f1736eb01b18c098512160aad1c0394bd4c9b785ea39e6f5b1f809658351bcb5f101899004e6a8542081ceec87f1a675538ce9264c7f128392c875c23507fc8a694ef2d13b127563b2da420a3df952f062dd3d46202a3466fa9a9c985dde3cc577a1fdf40687931bbc4303dbab0e28bb6757bc226d9bba4db1603de1a9c7"], 0x1, 0x0, &(0x7f00000003c0)='L'}) r2 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r2, 0x40045431, &(0x7f00000000c0)) r3 = syz_open_pts(r2, 0x0) r4 = dup3(r3, r0, 0x0) ioctl$TCXONC(r4, 0x540a, 0x0) [ 1786.850855] binder: 12184:12185 IncRefs 0 refcount change on invalid ref 0 ret -22 [ 1786.859298] binder: 12184:12185 Release 1 refcount change on invalid ref 0 ret -22 [ 1786.868238] binder: 12184:12185 unknown command 1850775417 [ 1786.874714] binder: 12184:12185 ioctl c0306201 200000c0 returned -22 16:21:16 executing program 5: r0 = syz_open_procfs(0x0, &(0x7f0000000080)='net/dev_snmp6\x00') socket(0x10, 0x80002, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) socket$nl_generic(0x10, 0x3, 0x10) syz_open_procfs(0x0, &(0x7f0000000980)='net/sofH\x16tnet_sua') socket$inet6_tcp(0xa, 0x1, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) request_key(&(0x7f0000000000)='user\x00', &(0x7f0000000040)={'syz'}, &(0x7f0000000a80), 0xfffffffffffffffd) socket$inet(0x2, 0x4000000000000001, 0x0) perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x1ee6b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000000c0)={0xeb, 0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB="0563044000000000046304400000000006630440000000007997506ea39438033ada635f7cd4c9d1de50cf51e7a773b356e7348d3b19cbdc76ed97a6a08da8997815ea9e6d3b6a1d5a7c1cdf78337a6166cfd70cf41b6cb958e69b7dae4fe74a09c8e4db4c323ba219438b49c2f1736eb01b18c098512160aad1c0394bd4c9b785ea39e6f5b1f809658351bcb5f101899004e6a8542081ceec87f1a675538ce9264c7f128392c875c23507fc8a694ef2d13b127563b2da420a3df952f062dd3d46202a3466fa9a9c985dde3cc577a1fdf40687931bbc4303dbab0e28bb6757bc226d9bba4db1603de1a9c7"], 0x1, 0x0, &(0x7f00000003c0)='L'}) r2 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r2, 0x40045431, &(0x7f00000000c0)) r3 = syz_open_pts(r2, 0x0) r4 = dup3(r3, r0, 0x0) ioctl$TCXONC(r4, 0x540a, 0x0) [ 1786.969705] binder: 12193:12195 Acquire 1 refcount change on invalid ref 0 ret -22 [ 1786.979339] binder: 12191:12194 Acquire 1 refcount change on invalid ref 0 ret -22 [ 1786.985008] binder: 12193:12195 IncRefs 0 refcount change on invalid ref 0 ret -22 [ 1787.000470] binder: 12193:12195 Release 1 refcount change on invalid ref 0 ret -22 [ 1787.009126] binder: 12193:12195 unknown command 1850775417 [ 1787.015916] binder: 12191:12194 IncRefs 0 refcount change on invalid ref 0 ret -22 [ 1787.017740] binder: 12193:12195 ioctl c0306201 200000c0 returned -22 [ 1787.041254] binder: 12191:12194 Release 1 refcount change on invalid ref 0 ret -22 [ 1787.053853] binder: 12191:12194 unknown command 1850775417 [ 1787.061018] binder: 12191:12194 ioctl c0306201 200000c0 returned -22 [ 1787.117657] binder: 12201:12202 Acquire 1 refcount change on invalid ref 0 ret -22 [ 1787.133864] binder: 12201:12202 IncRefs 0 refcount change on invalid ref 0 ret -22 [ 1787.143528] binder: 12201:12202 Release 1 refcount change on invalid ref 0 ret -22 [ 1787.152351] binder: 12201:12202 unknown command 1850775417 [ 1787.158145] binder: 12201:12202 ioctl c0306201 200000c0 returned -22 16:21:18 executing program 2: pipe(&(0x7f0000000480)={0xffffffffffffffff, 0xffffffffffffffff}) write(r0, &(0x7f0000000340), 0x41395527) ioctl$IOC_PR_RESERVE(r0, 0x401070c9, &(0x7f0000000100)={0x3ff, 0x91}) r1 = syz_open_procfs(0x0, &(0x7f0000000080)='net/dev_snmp6\x00') r2 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r2, 0x40045431, &(0x7f00000000c0)) r3 = syz_open_pts(r2, 0x0) r4 = dup3(r3, r1, 0x0) ioctl$TCXONC(r4, 0x540a, 0x0) pselect6(0x40, &(0x7f0000000340)={0x9}, 0x0, 0x0, 0x0, 0x0) r5 = openat$full(0xffffffffffffff9c, &(0x7f0000000000)='/dev/full\x00', 0x2e200, 0x0) ioctl$RTC_PIE_ON(r5, 0x7005) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000300)={r4, &(0x7f00000001c0)="d556b381b8321177114f98681d51a8fab312c69df16ad746f625e2b68d0f24ee7811224ab135382416080b5eb7e9b4cc7f6951e62b1f356db3f23f02d382", &(0x7f0000000200)="2402a2cd08e2021d979b0dc6faa010c739931cfc431b668318ec09d3248ac10ed6bb41eaaecf07e07335c0dcba935d50afae8bbeead8487dc3a0a1d52f90e40621bc3f9fbe8842986ab42a62b3ee672d461b473cd30a77cd405575d77bc6499b5d9df202b051729f2f4450e77e9429c9645c0b4d815c9808d71cf0d627f01fc2c9d5c004b5f2e272c4273b342b0ba0d1fd29275c1ef48f225eec3ab0e4c5e4e5b0f74020c5346fb6a6c0663a546f1712b57013b0569d466d3a0ccbd52137bd8f667933adead9bc1c441409d93dfe9f07ebab7d9b4d2ca9608f79e83b1e582e577035ba4d12db6cb5e2345d4fc4c2f0fe0a77ccec", 0x1}, 0x20) r6 = socket$inet6_udp(0xa, 0x2, 0x0) getpeername$inet6(r6, &(0x7f0000000140)={0xa, 0x0, 0x0, @loopback}, &(0x7f0000000180)=0x1c) 16:21:18 executing program 0: r0 = syz_open_procfs(0x0, &(0x7f0000000080)='net/dev_snmp6\x00') socket(0x10, 0x80002, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) socket$nl_generic(0x10, 0x3, 0x10) syz_open_procfs(0x0, &(0x7f0000000980)='net/sofH\x16tnet_sua') socket$inet6_tcp(0xa, 0x1, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) request_key(&(0x7f0000000000)='user\x00', &(0x7f0000000040)={'syz'}, &(0x7f0000000a80), 0xfffffffffffffffd) socket$inet(0x2, 0x4000000000000001, 0x0) perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x1ee6b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000000c0)={0xeb, 0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB="0563044000000000046304400000000006630440000000007997506ea39438033ada635f7cd4c9d1de50cf51e7a773b356e7348d3b19cbdc76ed97a6a08da8997815ea9e6d3b6a1d5a7c1cdf78337a6166cfd70cf41b6cb958e69b7dae4fe74a09c8e4db4c323ba219438b49c2f1736eb01b18c098512160aad1c0394bd4c9b785ea39e6f5b1f809658351bcb5f101899004e6a8542081ceec87f1a675538ce9264c7f128392c875c23507fc8a694ef2d13b127563b2da420a3df952f062dd3d46202a3466fa9a9c985dde3cc577a1fdf40687931bbc4303dbab0e28bb6757bc226d9bba4db1603de1a9c7"], 0x1, 0x0, &(0x7f00000003c0)='L'}) r2 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r2, 0x40045431, &(0x7f00000000c0)) r3 = syz_open_pts(r2, 0x0) r4 = dup3(r3, r0, 0x0) ioctl$TCXONC(r4, 0x540a, 0x0) 16:21:18 executing program 1: syz_open_procfs(0x0, &(0x7f0000000080)='net/dev_snmp6\x00') socket(0x10, 0x80002, 0x0) r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) socket$nl_generic(0x10, 0x3, 0x10) syz_open_procfs(0x0, &(0x7f0000000980)='net/sofH\x16tnet_sua') socket$inet6_tcp(0xa, 0x1, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) request_key(&(0x7f0000000000)='user\x00', &(0x7f0000000040)={'syz'}, &(0x7f0000000a80), 0xfffffffffffffffd) perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x1ee6b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0xeb, 0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB="0563044000000000046304400000000006630440000000007997506ea39438033ada635f7cd4c9d1de50cf51e7a773b356e7348d3b19cbdc76ed97a6a08da8997815ea9e6d3b6a1d5a7c1cdf78337a6166cfd70cf41b6cb958e69b7dae4fe74a09c8e4db4c323ba219438b49c2f1736eb01b18c098512160aad1c0394bd4c9b785ea39e6f5b1f809658351bcb5f101899004e6a8542081ceec87f1a675538ce9264c7f128392c875c23507fc8a694ef2d13b127563b2da420a3df952f062dd3d46202a3466fa9a9c985dde3cc577a1fdf40687931bbc4303dbab0e28bb6757bc226d9bba4db1603de1a9c7"], 0x1, 0x0, &(0x7f00000003c0)='L'}) ioctl$TCXONC(0xffffffffffffffff, 0x540a, 0x0) 16:21:18 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f00000003c0)="11dca50d5e0bcfe47bf070") r1 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r1, &(0x7f0000000100)={0x2, 0x4e20}, 0x10) connect$inet(r1, &(0x7f0000000cc0)={0x2, 0x4e20, @local}, 0x10) setsockopt$SO_TIMESTAMPING(r1, 0x1, 0x25, &(0x7f00000010c0)=0x19ff, 0x181fad7b9bff35c2) pipe(&(0x7f0000000480)={0xffffffffffffffff}) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) sendto$inet(r2, &(0x7f0000000140)="b0", 0x1, 0x0, 0x0, 0x0) recvmmsg(r1, &(0x7f0000003b40)=[{{0x0, 0x0, 0x0}}], 0x1, 0x2000, 0x0) 16:21:18 executing program 5: r0 = syz_open_procfs(0x0, &(0x7f0000000080)='net/dev_snmp6\x00') socket(0x10, 0x80002, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) socket$nl_generic(0x10, 0x3, 0x10) syz_open_procfs(0x0, &(0x7f0000000980)='net/sofH\x16tnet_sua') socket$inet6_tcp(0xa, 0x1, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) request_key(&(0x7f0000000000)='user\x00', &(0x7f0000000040)={'syz'}, &(0x7f0000000a80), 0xfffffffffffffffd) socket$inet(0x2, 0x4000000000000001, 0x0) perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x1ee6b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000000c0)={0xeb, 0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB="0563044000000000046304400000000006630440000000007997506ea39438033ada635f7cd4c9d1de50cf51e7a773b356e7348d3b19cbdc76ed97a6a08da8997815ea9e6d3b6a1d5a7c1cdf78337a6166cfd70cf41b6cb958e69b7dae4fe74a09c8e4db4c323ba219438b49c2f1736eb01b18c098512160aad1c0394bd4c9b785ea39e6f5b1f809658351bcb5f101899004e6a8542081ceec87f1a675538ce9264c7f128392c875c23507fc8a694ef2d13b127563b2da420a3df952f062dd3d46202a3466fa9a9c985dde3cc577a1fdf40687931bbc4303dbab0e28bb6757bc226d9bba4db1603de1a9c7"], 0x1, 0x0, &(0x7f00000003c0)='L'}) r2 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r2, 0x40045431, &(0x7f00000000c0)) r3 = syz_open_pts(r2, 0x0) r4 = dup3(r3, r0, 0x0) ioctl$TCXONC(r4, 0x540a, 0x0) 16:21:18 executing program 4: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080)='/dex\x00\x00\x00\x00\xec\xff', 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0xf) [ 1789.413535] binder: 12212:12217 Acquire 1 refcount change on invalid ref 0 ret -22 [ 1789.417329] binder: 12211:12216 Acquire 1 refcount change on invalid ref 0 ret -22 [ 1789.424586] binder: 12212:12217 IncRefs 0 refcount change on invalid ref 0 ret -22 [ 1789.437802] binder: 12211:12216 IncRefs 0 refcount change on invalid ref 0 ret -22 [ 1789.437819] binder: 12211:12216 Release 1 refcount change on invalid ref 0 ret -22 16:21:18 executing program 4: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0xf) getsockopt$IPT_SO_GET_REVISION_TARGET(r0, 0x0, 0x43, &(0x7f0000000000)={'ipvs\x00'}, &(0x7f0000000080)=0x1e) [ 1789.438163] binder: 12211:12216 unknown command 1850775417 [ 1789.438850] binder: 12211:12216 ioctl c0306201 200000c0 returned -22 [ 1789.460492] binder: 12210:12218 Acquire 1 refcount change on invalid ref 0 ret -22 [ 1789.467344] binder: 12212:12217 Release 1 refcount change on invalid ref 0 ret -22 [ 1789.493547] binder: 12212:12217 unknown command 1850775417 [ 1789.505170] binder: 12212:12217 ioctl c0306201 200000c0 returned -22 16:21:19 executing program 1: syz_open_procfs(0x0, &(0x7f0000000080)='net/dev_snmp6\x00') socket(0x10, 0x80002, 0x0) r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) socket$nl_generic(0x10, 0x3, 0x10) syz_open_procfs(0x0, &(0x7f0000000980)='net/sofH\x16tnet_sua') socket$inet6_tcp(0xa, 0x1, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) request_key(&(0x7f0000000000)='user\x00', &(0x7f0000000040)={'syz'}, &(0x7f0000000a80), 0xfffffffffffffffd) perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x1ee6b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0xeb, 0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB="0563044000000000046304400000000006630440000000007997506ea39438033ada635f7cd4c9d1de50cf51e7a773b356e7348d3b19cbdc76ed97a6a08da8997815ea9e6d3b6a1d5a7c1cdf78337a6166cfd70cf41b6cb958e69b7dae4fe74a09c8e4db4c323ba219438b49c2f1736eb01b18c098512160aad1c0394bd4c9b785ea39e6f5b1f809658351bcb5f101899004e6a8542081ceec87f1a675538ce9264c7f128392c875c23507fc8a694ef2d13b127563b2da420a3df952f062dd3d46202a3466fa9a9c985dde3cc577a1fdf40687931bbc4303dbab0e28bb6757bc226d9bba4db1603de1a9c7"], 0x1, 0x0, &(0x7f00000003c0)='L'}) ioctl$TCXONC(0xffffffffffffffff, 0x540a, 0x0) [ 1789.515117] binder: 12210:12218 IncRefs 0 refcount change on invalid ref 0 ret -22 16:21:19 executing program 4: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0xf) [ 1789.578123] binder: 12210:12218 Release 1 refcount change on invalid ref 0 ret -22 [ 1789.598573] binder: 12210:12218 unknown command 1850775417 [ 1789.611007] binder: 12210:12218 ioctl c0306201 200000c0 returned -22 16:21:19 executing program 5: syz_open_procfs(0x0, &(0x7f0000000080)='net/dev_snmp6\x00') socket(0x10, 0x80002, 0x0) r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) socket$nl_generic(0x10, 0x3, 0x10) syz_open_procfs(0x0, &(0x7f0000000980)='net/sofH\x16tnet_sua') socket$inet6_tcp(0xa, 0x1, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) request_key(&(0x7f0000000000)='user\x00', &(0x7f0000000040)={'syz'}, &(0x7f0000000a80), 0xfffffffffffffffd) socket$inet(0x2, 0x4000000000000001, 0x0) perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x1ee6b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0xeb, 0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB="0563044000000000046304400000000006630440000000007997506ea39438033ada635f7cd4c9d1de50cf51e7a773b356e7348d3b19cbdc76ed97a6a08da8997815ea9e6d3b6a1d5a7c1cdf78337a6166cfd70cf41b6cb958e69b7dae4fe74a09c8e4db4c323ba219438b49c2f1736eb01b18c098512160aad1c0394bd4c9b785ea39e6f5b1f809658351bcb5f101899004e6a8542081ceec87f1a675538ce9264c7f128392c875c23507fc8a694ef2d13b127563b2da420a3df952f062dd3d46202a3466fa9a9c985dde3cc577a1fdf40687931bbc4303dbab0e28bb6757bc226d9bba4db1603de1a9c7"], 0x1, 0x0, &(0x7f00000003c0)='L'}) r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r1, 0x40045431, &(0x7f00000000c0)) syz_open_pts(r1, 0x0) ioctl$TCXONC(0xffffffffffffffff, 0x540a, 0x0) 16:21:19 executing program 0: r0 = syz_open_procfs(0x0, &(0x7f0000000080)='net/dev_snmp6\x00') socket(0x10, 0x80002, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) socket$nl_generic(0x10, 0x3, 0x10) syz_open_procfs(0x0, &(0x7f0000000980)='net/sofH\x16tnet_sua') socket$inet6_tcp(0xa, 0x1, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) request_key(&(0x7f0000000000)='user\x00', &(0x7f0000000040)={'syz'}, &(0x7f0000000a80), 0xfffffffffffffffd) socket$inet(0x2, 0x4000000000000001, 0x0) perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x1ee6b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000000c0)={0xeb, 0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB="0563044000000000046304400000000006630440000000007997506ea39438033ada635f7cd4c9d1de50cf51e7a773b356e7348d3b19cbdc76ed97a6a08da8997815ea9e6d3b6a1d5a7c1cdf78337a6166cfd70cf41b6cb958e69b7dae4fe74a09c8e4db4c323ba219438b49c2f1736eb01b18c098512160aad1c0394bd4c9b785ea39e6f5b1f809658351bcb5f101899004e6a8542081ceec87f1a675538ce9264c7f128392c875c23507fc8a694ef2d13b127563b2da420a3df952f062dd3d46202a3466fa9a9c985dde3cc577a1fdf40687931bbc4303dbab0e28bb6757bc226d9bba4db1603de1a9c7"], 0x1, 0x0, &(0x7f00000003c0)='L'}) r2 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r2, 0x40045431, &(0x7f00000000c0)) r3 = syz_open_pts(r2, 0x0) r4 = dup3(r3, r0, 0x0) ioctl$TCXONC(r4, 0x540a, 0x0) [ 1789.683249] binder: 12241:12243 Acquire 1 refcount change on invalid ref 0 ret -22 [ 1789.694343] binder: 12247:12249 Acquire 1 refcount change on invalid ref 0 ret -22 [ 1789.695732] binder: 12241:12243 IncRefs 0 refcount change on invalid ref 0 ret -22 [ 1789.718328] binder: 12241:12243 Release 1 refcount change on invalid ref 0 ret -22 [ 1789.721772] binder: 12247:12249 IncRefs 0 refcount change on invalid ref 0 ret -22 [ 1789.751269] binder: 12241:12243 unknown command 1850775417 [ 1789.768406] binder: 12241:12243 ioctl c0306201 200000c0 returned -22 16:21:19 executing program 4: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000000)=0x9) pipe(&(0x7f0000000480)={0xffffffffffffffff}) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) r3 = syz_genetlink_get_family_id$tipc(&(0x7f0000000080)='TIPC\x00') sendmsg$TIPC_CMD_GET_NODES(r2, &(0x7f00000001c0)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x9000a001}, 0xc, &(0x7f0000000180)={&(0x7f0000000100)={0x1c, r3, 0x10, 0x70bd2c, 0x25dfdbfe, {}, ["", "", "", "", "", "", "", "", ""]}, 0x1c}, 0x1, 0x0, 0x0, 0x8000}, 0x40001) [ 1789.776015] binder: 12247:12249 Release 1 refcount change on invalid ref 0 ret -22 [ 1789.776177] binder: 12247:12249 unknown command 1850775417 [ 1789.776288] binder: 12247:12249 ioctl c0306201 200000c0 returned -22 [ 1789.849197] binder: 12255:12257 Acquire 1 refcount change on invalid ref 0 ret -22 [ 1789.859706] binder: 12255:12257 IncRefs 0 refcount change on invalid ref 0 ret -22 [ 1789.868653] binder: 12255:12257 Release 1 refcount change on invalid ref 0 ret -22 [ 1789.882317] binder: 12255:12257 unknown command 1850775417 [ 1789.889303] binder: 12255:12257 ioctl c0306201 200000c0 returned -22 16:21:19 executing program 2: pipe2(&(0x7f0000000000)={0xffffffffffffffff}, 0x1000) write$P9_RWRITE(r0, &(0x7f0000000100)={0xb, 0x77, 0x1, 0xd9}, 0xb) r1 = syz_open_procfs(0x0, &(0x7f0000000080)='net/dev_snmp6\x00') r2 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r2, 0x40045431, &(0x7f00000000c0)={0x0, 0xfffffffffffffffc, 0x0, 0x0, 0x0, 0xfffffffffffff800}) r3 = syz_open_pts(r2, 0x0) r4 = dup3(r3, r1, 0x0) ioctl$TCXONC(r4, 0x540a, 0x0) pselect6(0x40, &(0x7f0000000340)={0x9}, 0x0, 0x0, 0x0, 0x0) 16:21:19 executing program 5: syz_open_procfs(0x0, &(0x7f0000000080)='net/dev_snmp6\x00') socket(0x10, 0x80002, 0x0) r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) socket$nl_generic(0x10, 0x3, 0x10) syz_open_procfs(0x0, &(0x7f0000000980)='net/sofH\x16tnet_sua') socket$inet6_tcp(0xa, 0x1, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) request_key(&(0x7f0000000000)='user\x00', &(0x7f0000000040)={'syz'}, &(0x7f0000000a80), 0xfffffffffffffffd) socket$inet(0x2, 0x4000000000000001, 0x0) perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x1ee6b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0xeb, 0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB="0563044000000000046304400000000006630440000000007997506ea39438033ada635f7cd4c9d1de50cf51e7a773b356e7348d3b19cbdc76ed97a6a08da8997815ea9e6d3b6a1d5a7c1cdf78337a6166cfd70cf41b6cb958e69b7dae4fe74a09c8e4db4c323ba219438b49c2f1736eb01b18c098512160aad1c0394bd4c9b785ea39e6f5b1f809658351bcb5f101899004e6a8542081ceec87f1a675538ce9264c7f128392c875c23507fc8a694ef2d13b127563b2da420a3df952f062dd3d46202a3466fa9a9c985dde3cc577a1fdf40687931bbc4303dbab0e28bb6757bc226d9bba4db1603de1a9c7"], 0x1, 0x0, &(0x7f00000003c0)='L'}) r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r1, 0x40045431, &(0x7f00000000c0)) syz_open_pts(r1, 0x0) ioctl$TCXONC(0xffffffffffffffff, 0x540a, 0x0) 16:21:19 executing program 1: syz_open_procfs(0x0, &(0x7f0000000080)='net/dev_snmp6\x00') socket(0x10, 0x80002, 0x0) r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) socket$nl_generic(0x10, 0x3, 0x10) syz_open_procfs(0x0, &(0x7f0000000980)='net/sofH\x16tnet_sua') socket$inet6_tcp(0xa, 0x1, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x1ee6b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0xeb, 0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB="0563044000000000046304400000000006630440000000007997506ea39438033ada635f7cd4c9d1de50cf51e7a773b356e7348d3b19cbdc76ed97a6a08da8997815ea9e6d3b6a1d5a7c1cdf78337a6166cfd70cf41b6cb958e69b7dae4fe74a09c8e4db4c323ba219438b49c2f1736eb01b18c098512160aad1c0394bd4c9b785ea39e6f5b1f809658351bcb5f101899004e6a8542081ceec87f1a675538ce9264c7f128392c875c23507fc8a694ef2d13b127563b2da420a3df952f062dd3d46202a3466fa9a9c985dde3cc577a1fdf40687931bbc4303dbab0e28bb6757bc226d9bba4db1603de1a9c7"], 0x1, 0x0, &(0x7f00000003c0)='L'}) ioctl$TCXONC(0xffffffffffffffff, 0x540a, 0x0) 16:21:19 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f00000003c0)="11dca50d5e0bcfe47bf070") socket$inet(0x2, 0x4, 0x1) r1 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r1, &(0x7f0000000100)={0x2, 0x4e20}, 0x10) connect$inet(r1, &(0x7f0000000cc0)={0x2, 0x4e20, @local}, 0x10) r2 = openat$selinux_checkreqprot(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/checkreqprot\x00', 0x2000, 0x0) getsockname$inet6(r2, &(0x7f0000000180)={0xa, 0x0, 0x0, @initdev}, &(0x7f00000001c0)=0x1c) setsockopt$SO_TIMESTAMPING(r1, 0x1, 0x25, &(0x7f00000010c0)=0x197b, 0x3c8) sendto$inet(r1, &(0x7f0000000140)="b0", 0x1, 0x0, 0x0, 0x0) recvmmsg(r1, &(0x7f0000003b40)=[{{0x0, 0x0, 0x0}}], 0x1, 0x2000, 0x0) 16:21:19 executing program 0: syz_open_procfs(0x0, &(0x7f0000000080)='net/dev_snmp6\x00') socket(0x10, 0x80002, 0x0) r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) socket$nl_generic(0x10, 0x3, 0x10) syz_open_procfs(0x0, &(0x7f0000000980)='net/sofH\x16tnet_sua') socket$inet6_tcp(0xa, 0x1, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) request_key(&(0x7f0000000000)='user\x00', &(0x7f0000000040)={'syz'}, &(0x7f0000000a80), 0xfffffffffffffffd) perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x1ee6b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0xeb, 0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB="0563044000000000046304400000000006630440000000007997506ea39438033ada635f7cd4c9d1de50cf51e7a773b356e7348d3b19cbdc76ed97a6a08da8997815ea9e6d3b6a1d5a7c1cdf78337a6166cfd70cf41b6cb958e69b7dae4fe74a09c8e4db4c323ba219438b49c2f1736eb01b18c098512160aad1c0394bd4c9b785ea39e6f5b1f809658351bcb5f101899004e6a8542081ceec87f1a675538ce9264c7f128392c875c23507fc8a694ef2d13b127563b2da420a3df952f062dd3d46202a3466fa9a9c985dde3cc577a1fdf40687931bbc4303dbab0e28bb6757bc226d9bba4db1603de1a9c7"], 0x1, 0x0, &(0x7f00000003c0)='L'}) ioctl$TCXONC(0xffffffffffffffff, 0x540a, 0x0) [ 1790.263305] binder: 12269:12273 Acquire 1 refcount change on invalid ref 0 ret -22 [ 1790.283285] binder: 12269:12273 IncRefs 0 refcount change on invalid ref 0 ret -22 [ 1790.288690] binder: 12271:12275 Acquire 1 refcount change on invalid ref 0 ret -22 [ 1790.302863] binder: 12269:12273 Release 1 refcount change on invalid ref 0 ret -22 16:21:19 executing program 2: r0 = syz_open_procfs(0x0, &(0x7f0000000080)='net/dev_snmp6\x00') r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r1, 0x40045431, &(0x7f00000000c0)={0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}) r2 = syz_open_pts(r1, 0x0) r3 = dup3(r2, r0, 0x0) ioctl$TCXONC(r3, 0x540a, 0x0) pselect6(0x40, &(0x7f0000000000)={0x8, 0x0, 0x3, 0x0, 0x0, 0xfffffffffffffffe}, 0x0, 0x0, 0x0, 0x0) [ 1790.311923] binder: 12269:12273 unknown command 1850775417 [ 1790.318389] binder: 12269:12273 ioctl c0306201 200000c0 returned -22 [ 1790.327265] binder: 12271:12275 IncRefs 0 refcount change on invalid ref 0 ret -22 [ 1790.327288] binder: 12271:12275 Release 1 refcount change on invalid ref 0 ret -22 [ 1790.338643] binder: 12271:12275 unknown command 1850775417 16:21:19 executing program 5: syz_open_procfs(0x0, &(0x7f0000000080)='net/dev_snmp6\x00') socket(0x10, 0x80002, 0x0) r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) socket$nl_generic(0x10, 0x3, 0x10) syz_open_procfs(0x0, &(0x7f0000000980)='net/sofH\x16tnet_sua') socket$inet6_tcp(0xa, 0x1, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) request_key(&(0x7f0000000000)='user\x00', &(0x7f0000000040)={'syz'}, &(0x7f0000000a80), 0xfffffffffffffffd) socket$inet(0x2, 0x4000000000000001, 0x0) perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x1ee6b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0xeb, 0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB="0563044000000000046304400000000006630440000000007997506ea39438033ada635f7cd4c9d1de50cf51e7a773b356e7348d3b19cbdc76ed97a6a08da8997815ea9e6d3b6a1d5a7c1cdf78337a6166cfd70cf41b6cb958e69b7dae4fe74a09c8e4db4c323ba219438b49c2f1736eb01b18c098512160aad1c0394bd4c9b785ea39e6f5b1f809658351bcb5f101899004e6a8542081ceec87f1a675538ce9264c7f128392c875c23507fc8a694ef2d13b127563b2da420a3df952f062dd3d46202a3466fa9a9c985dde3cc577a1fdf40687931bbc4303dbab0e28bb6757bc226d9bba4db1603de1a9c7"], 0x1, 0x0, &(0x7f00000003c0)='L'}) r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r1, 0x40045431, &(0x7f00000000c0)) syz_open_pts(r1, 0x0) ioctl$TCXONC(0xffffffffffffffff, 0x540a, 0x0) [ 1790.338851] binder: 12271:12275 ioctl c0306201 200000c0 returned -22 16:21:19 executing program 1: syz_open_procfs(0x0, &(0x7f0000000080)='net/dev_snmp6\x00') socket(0x10, 0x80002, 0x0) r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) socket$nl_generic(0x10, 0x3, 0x10) syz_open_procfs(0x0, &(0x7f0000000980)='net/sofH\x16tnet_sua') socket$inet6_tcp(0xa, 0x1, 0x0) perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x1ee6b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0xeb, 0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB="0563044000000000046304400000000006630440000000007997506ea39438033ada635f7cd4c9d1de50cf51e7a773b356e7348d3b19cbdc76ed97a6a08da8997815ea9e6d3b6a1d5a7c1cdf78337a6166cfd70cf41b6cb958e69b7dae4fe74a09c8e4db4c323ba219438b49c2f1736eb01b18c098512160aad1c0394bd4c9b785ea39e6f5b1f809658351bcb5f101899004e6a8542081ceec87f1a675538ce9264c7f128392c875c23507fc8a694ef2d13b127563b2da420a3df952f062dd3d46202a3466fa9a9c985dde3cc577a1fdf40687931bbc4303dbab0e28bb6757bc226d9bba4db1603de1a9c7"], 0x1, 0x0, &(0x7f00000003c0)='L'}) ioctl$TCXONC(0xffffffffffffffff, 0x540a, 0x0) [ 1790.435243] binder: 12279:12282 Acquire 1 refcount change on invalid ref 0 ret -22 [ 1790.451867] binder: 12279:12282 IncRefs 0 refcount change on invalid ref 0 ret -22 [ 1790.460557] binder: 12279:12282 Release 1 refcount change on invalid ref 0 ret -22 [ 1790.468877] binder: 12279:12282 unknown command 1850775417 [ 1790.475012] binder: 12279:12282 ioctl c0306201 200000c0 returned -22 [ 1790.488404] binder: 12297:12298 Acquire 1 refcount change on invalid ref 0 ret -22 [ 1790.497719] binder: 12297:12298 IncRefs 0 refcount change on invalid ref 0 ret -22 [ 1790.507573] binder: 12297:12298 Release 1 refcount change on invalid ref 0 ret -22 [ 1790.508619] binder: 12293:12294 Acquire 1 refcount change on invalid ref 0 ret -22 [ 1790.516384] binder: 12297:12298 unknown command 1850775417 [ 1790.529462] binder: 12297:12298 ioctl c0306201 200000c0 returned -22 16:21:20 executing program 0: syz_open_procfs(0x0, &(0x7f0000000080)='net/dev_snmp6\x00') socket(0x10, 0x80002, 0x0) r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) socket$nl_generic(0x10, 0x3, 0x10) syz_open_procfs(0x0, &(0x7f0000000980)='net/sofH\x16tnet_sua') socket$inet6_tcp(0xa, 0x1, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) request_key(&(0x7f0000000000)='user\x00', &(0x7f0000000040)={'syz'}, &(0x7f0000000a80), 0xfffffffffffffffd) perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x1ee6b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0xeb, 0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB="0563044000000000046304400000000006630440000000007997506ea39438033ada635f7cd4c9d1de50cf51e7a773b356e7348d3b19cbdc76ed97a6a08da8997815ea9e6d3b6a1d5a7c1cdf78337a6166cfd70cf41b6cb958e69b7dae4fe74a09c8e4db4c323ba219438b49c2f1736eb01b18c098512160aad1c0394bd4c9b785ea39e6f5b1f809658351bcb5f101899004e6a8542081ceec87f1a675538ce9264c7f128392c875c23507fc8a694ef2d13b127563b2da420a3df952f062dd3d46202a3466fa9a9c985dde3cc577a1fdf40687931bbc4303dbab0e28bb6757bc226d9bba4db1603de1a9c7"], 0x1, 0x0, &(0x7f00000003c0)='L'}) ioctl$TCXONC(0xffffffffffffffff, 0x540a, 0x0) [ 1790.536487] binder: 12293:12294 IncRefs 0 refcount change on invalid ref 0 ret -22 [ 1790.552786] binder: 12293:12294 Release 1 refcount change on invalid ref 0 ret -22 16:21:20 executing program 1: syz_open_procfs(0x0, &(0x7f0000000080)='net/dev_snmp6\x00') socket(0x10, 0x80002, 0x0) r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) socket$nl_generic(0x10, 0x3, 0x10) syz_open_procfs(0x0, &(0x7f0000000980)='net/sofH\x16tnet_sua') socket$inet6_tcp(0xa, 0x1, 0x0) perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x1ee6b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0xeb, 0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB="0563044000000000046304400000000006630440000000007997506ea39438033ada635f7cd4c9d1de50cf51e7a773b356e7348d3b19cbdc76ed97a6a08da8997815ea9e6d3b6a1d5a7c1cdf78337a6166cfd70cf41b6cb958e69b7dae4fe74a09c8e4db4c323ba219438b49c2f1736eb01b18c098512160aad1c0394bd4c9b785ea39e6f5b1f809658351bcb5f101899004e6a8542081ceec87f1a675538ce9264c7f128392c875c23507fc8a694ef2d13b127563b2da420a3df952f062dd3d46202a3466fa9a9c985dde3cc577a1fdf40687931bbc4303dbab0e28bb6757bc226d9bba4db1603de1a9c7"], 0x1, 0x0, &(0x7f00000003c0)='L'}) ioctl$TCXONC(0xffffffffffffffff, 0x540a, 0x0) [ 1790.582354] binder: 12293:12294 unknown command 1850775417 [ 1790.593573] binder: 12293:12294 ioctl c0306201 200000c0 returned -22 [ 1790.604248] binder: 12303:12305 Acquire 1 refcount change on invalid ref 0 ret -22 [ 1790.614719] binder: 12303:12305 IncRefs 0 refcount change on invalid ref 0 ret -22 16:21:20 executing program 5: r0 = syz_open_procfs(0x0, &(0x7f0000000080)='net/dev_snmp6\x00') socket(0x10, 0x80002, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) socket$nl_generic(0x10, 0x3, 0x10) syz_open_procfs(0x0, &(0x7f0000000980)='net/sofH\x16tnet_sua') socket$inet6_tcp(0xa, 0x1, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) request_key(&(0x7f0000000000)='user\x00', &(0x7f0000000040)={'syz'}, &(0x7f0000000a80), 0xfffffffffffffffd) socket$inet(0x2, 0x4000000000000001, 0x0) perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x1ee6b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000000c0)={0xeb, 0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB="0563044000000000046304400000000006630440000000007997506ea39438033ada635f7cd4c9d1de50cf51e7a773b356e7348d3b19cbdc76ed97a6a08da8997815ea9e6d3b6a1d5a7c1cdf78337a6166cfd70cf41b6cb958e69b7dae4fe74a09c8e4db4c323ba219438b49c2f1736eb01b18c098512160aad1c0394bd4c9b785ea39e6f5b1f809658351bcb5f101899004e6a8542081ceec87f1a675538ce9264c7f128392c875c23507fc8a694ef2d13b127563b2da420a3df952f062dd3d46202a3466fa9a9c985dde3cc577a1fdf40687931bbc4303dbab0e28bb6757bc226d9bba4db1603de1a9c7"], 0x1, 0x0, &(0x7f00000003c0)='L'}) r2 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r2, 0x40045431, &(0x7f00000000c0)) r3 = dup3(0xffffffffffffffff, r0, 0x0) ioctl$TCXONC(r3, 0x540a, 0x0) [ 1790.629844] binder: 12308:12309 Acquire 1 refcount change on invalid ref 0 ret -22 [ 1790.634634] binder: 12303:12305 Release 1 refcount change on invalid ref 0 ret -22 [ 1790.639392] binder: 12308:12309 IncRefs 0 refcount change on invalid ref 0 ret -22 [ 1790.671957] binder: 12308:12309 Release 1 refcount change on invalid ref 0 ret -22 [ 1790.679173] binder: 12303:12305 unknown command 1850775417 [ 1790.690602] binder: 12308:12309 unknown command 1850775417 [ 1790.695233] binder: 12303:12305 ioctl c0306201 200000c0 returned -22 [ 1790.697373] binder: 12308:12309 ioctl c0306201 200000c0 returned -22 [ 1790.715238] binder: 12315:12317 Acquire 1 refcount change on invalid ref 0 ret -22 16:21:20 executing program 4: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1}) r1 = fcntl$getown(r0, 0x9) r2 = getpid() setpgid(r1, r2) r3 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) ioctl$TIOCSETD(r3, 0x5423, &(0x7f0000000040)=0xf) pipe(&(0x7f0000000480)={0xffffffffffffffff, 0xffffffffffffffff}) write(r5, &(0x7f0000000340), 0x41395527) ioctl$VT_OPENQRY(r5, 0x5600, &(0x7f0000000000)) 16:21:20 executing program 0: pipe(&(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) write(r1, &(0x7f0000000340), 0x41395527) vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) 16:21:20 executing program 1: syz_open_procfs(0x0, &(0x7f0000000080)='net/dev_snmp6\x00') socket(0x10, 0x80002, 0x0) r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) socket$nl_generic(0x10, 0x3, 0x10) syz_open_procfs(0x0, &(0x7f0000000980)='net/sofH\x16tnet_sua') socket$inet6_tcp(0xa, 0x1, 0x0) perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x1ee6b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0xeb, 0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB="0563044000000000046304400000000006630440000000007997506ea39438033ada635f7cd4c9d1de50cf51e7a773b356e7348d3b19cbdc76ed97a6a08da8997815ea9e6d3b6a1d5a7c1cdf78337a6166cfd70cf41b6cb958e69b7dae4fe74a09c8e4db4c323ba219438b49c2f1736eb01b18c098512160aad1c0394bd4c9b785ea39e6f5b1f809658351bcb5f101899004e6a8542081ceec87f1a675538ce9264c7f128392c875c23507fc8a694ef2d13b127563b2da420a3df952f062dd3d46202a3466fa9a9c985dde3cc577a1fdf40687931bbc4303dbab0e28bb6757bc226d9bba4db1603de1a9c7"], 0x1, 0x0, &(0x7f00000003c0)='L'}) ioctl$TCXONC(0xffffffffffffffff, 0x540a, 0x0) [ 1790.752734] binder: 12315:12317 IncRefs 0 refcount change on invalid ref 0 ret -22 [ 1790.784137] binder: 12315:12317 Release 1 refcount change on invalid ref 0 ret -22 [ 1790.817511] binder: 12315:12317 unknown command 1850775417 [ 1790.833947] binder: 12326:12329 Acquire 1 refcount change on invalid ref 0 ret -22 [ 1790.838764] binder: 12315:12317 ioctl c0306201 200000c0 returned -22 [ 1790.842153] binder: 12326:12329 IncRefs 0 refcount change on invalid ref 0 ret -22 [ 1790.842180] binder: 12326:12329 Release 1 refcount change on invalid ref 0 ret -22 16:21:20 executing program 1: syz_open_procfs(0x0, &(0x7f0000000080)='net/dev_snmp6\x00') socket(0x10, 0x80002, 0x0) r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) socket$nl_generic(0x10, 0x3, 0x10) syz_open_procfs(0x0, &(0x7f0000000980)='net/sofH\x16tnet_sua') perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x1ee6b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0xeb, 0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB="0563044000000000046304400000000006630440000000007997506ea39438033ada635f7cd4c9d1de50cf51e7a773b356e7348d3b19cbdc76ed97a6a08da8997815ea9e6d3b6a1d5a7c1cdf78337a6166cfd70cf41b6cb958e69b7dae4fe74a09c8e4db4c323ba219438b49c2f1736eb01b18c098512160aad1c0394bd4c9b785ea39e6f5b1f809658351bcb5f101899004e6a8542081ceec87f1a675538ce9264c7f128392c875c23507fc8a694ef2d13b127563b2da420a3df952f062dd3d46202a3466fa9a9c985dde3cc577a1fdf40687931bbc4303dbab0e28bb6757bc226d9bba4db1603de1a9c7"], 0x1, 0x0, &(0x7f00000003c0)='L'}) ioctl$TCXONC(0xffffffffffffffff, 0x540a, 0x0) [ 1790.842191] binder: 12326:12329 unknown command 1850775417 [ 1790.842205] binder: 12326:12329 ioctl c0306201 200000c0 returned -22 [ 1790.898711] binder: 12332:12334 Acquire 1 refcount change on invalid ref 0 ret -22 [ 1790.908096] binder: 12332:12334 IncRefs 0 refcount change on invalid ref 0 ret -22 [ 1790.920675] binder: 12332:12334 Release 1 refcount change on invalid ref 0 ret -22 [ 1790.937251] binder: 12332:12334 unknown command 1850775417 [ 1790.950617] binder: 12332:12334 ioctl c0306201 200000c0 returned -22 16:21:20 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f00000003c0)="11dca50d5e0bcfe47bf070") r1 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r1, &(0x7f0000000000)={0x2, 0x4e20}, 0x10) connect$inet(r1, &(0x7f0000000cc0)={0x2, 0x4e20, @local}, 0x10) setsockopt$SO_TIMESTAMPING(0xffffffffffffffff, 0x1, 0x25, &(0x7f0000000040)=0x80, 0x4) socket$inet_udp(0x2, 0x2, 0x0) setsockopt$SO_TIMESTAMPING(r1, 0x1, 0x25, &(0x7f00000010c0)=0x19ff, 0x4) sendto$inet(r1, &(0x7f0000000140)="b0", 0x1, 0x0, 0x0, 0x0) recvmmsg(r1, &(0x7f0000003b40)=[{{0x0, 0x0, 0x0}}], 0x1, 0x2000, 0x0) 16:21:20 executing program 5: r0 = syz_open_procfs(0x0, &(0x7f0000000080)='net/dev_snmp6\x00') socket(0x10, 0x80002, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) socket$nl_generic(0x10, 0x3, 0x10) syz_open_procfs(0x0, &(0x7f0000000980)='net/sofH\x16tnet_sua') socket$inet6_tcp(0xa, 0x1, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) request_key(&(0x7f0000000000)='user\x00', &(0x7f0000000040)={'syz'}, &(0x7f0000000a80), 0xfffffffffffffffd) socket$inet(0x2, 0x4000000000000001, 0x0) perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x1ee6b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000000c0)={0xeb, 0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB="0563044000000000046304400000000006630440000000007997506ea39438033ada635f7cd4c9d1de50cf51e7a773b356e7348d3b19cbdc76ed97a6a08da8997815ea9e6d3b6a1d5a7c1cdf78337a6166cfd70cf41b6cb958e69b7dae4fe74a09c8e4db4c323ba219438b49c2f1736eb01b18c098512160aad1c0394bd4c9b785ea39e6f5b1f809658351bcb5f101899004e6a8542081ceec87f1a675538ce9264c7f128392c875c23507fc8a694ef2d13b127563b2da420a3df952f062dd3d46202a3466fa9a9c985dde3cc577a1fdf40687931bbc4303dbab0e28bb6757bc226d9bba4db1603de1a9c7"], 0x1, 0x0, &(0x7f00000003c0)='L'}) r2 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r2, 0x40045431, &(0x7f00000000c0)) r3 = dup3(0xffffffffffffffff, r0, 0x0) ioctl$TCXONC(r3, 0x540a, 0x0) 16:21:20 executing program 2: r0 = syz_open_procfs(0x0, &(0x7f0000000080)='net/dev_snmp6\x00') r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r1, 0x40045431, &(0x7f00000000c0)) r2 = syz_open_pts(r1, 0x0) r3 = dup3(r2, r0, 0x0) ioctl$TCXONC(r3, 0x540a, 0x0) pipe(&(0x7f0000000480)={0xffffffffffffffff, 0xffffffffffffffff}) write(r4, &(0x7f0000000340), 0x41395527) getsockopt$IPT_SO_GET_ENTRIES(r4, 0x0, 0x41, &(0x7f0000000100)={'filter\x00', 0x34, "857da8b2f9c1667e6ee9887f87a3016903b20163f90bd5c35fc86043b2608d68c59c46c3f5c8fd9ac9979d055ab91cb646aba3a6"}, &(0x7f0000000180)=0x58) pselect6(0x40, &(0x7f0000000340)={0x9}, 0x0, 0x0, 0x0, 0x0) uname(&(0x7f0000000000)=""/60) 16:21:20 executing program 1: syz_open_procfs(0x0, &(0x7f0000000080)='net/dev_snmp6\x00') socket(0x10, 0x80002, 0x0) r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) socket$nl_generic(0x10, 0x3, 0x10) syz_open_procfs(0x0, &(0x7f0000000980)='net/sofH\x16tnet_sua') perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x1ee6b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0xeb, 0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB="0563044000000000046304400000000006630440000000007997506ea39438033ada635f7cd4c9d1de50cf51e7a773b356e7348d3b19cbdc76ed97a6a08da8997815ea9e6d3b6a1d5a7c1cdf78337a6166cfd70cf41b6cb958e69b7dae4fe74a09c8e4db4c323ba219438b49c2f1736eb01b18c098512160aad1c0394bd4c9b785ea39e6f5b1f809658351bcb5f101899004e6a8542081ceec87f1a675538ce9264c7f128392c875c23507fc8a694ef2d13b127563b2da420a3df952f062dd3d46202a3466fa9a9c985dde3cc577a1fdf40687931bbc4303dbab0e28bb6757bc226d9bba4db1603de1a9c7"], 0x1, 0x0, &(0x7f00000003c0)='L'}) ioctl$TCXONC(0xffffffffffffffff, 0x540a, 0x0) 16:21:20 executing program 0: syz_open_procfs$namespace(0x0, &(0x7f0000000080)='ns/pid_for_children\x00') [ 1791.217824] binder: 12345:12346 Acquire 1 refcount change on invalid ref 0 ret -22 [ 1791.226198] binder: 12345:12346 IncRefs 0 refcount change on invalid ref 0 ret -22 [ 1791.237160] binder: 12345:12346 Release 1 refcount change on invalid ref 0 ret -22 [ 1791.248139] binder: 12345:12346 unknown command 1850775417 [ 1791.271506] binder: 12345:12346 ioctl c0306201 200000c0 returned -22 [ 1791.289255] binder: 12353:12356 Acquire 1 refcount change on invalid ref 0 ret -22 [ 1791.304208] binder: 12353:12356 IncRefs 0 refcount change on invalid ref 0 ret -22 16:21:20 executing program 5: r0 = syz_open_procfs(0x0, &(0x7f0000000080)='net/dev_snmp6\x00') socket(0x10, 0x80002, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) socket$nl_generic(0x10, 0x3, 0x10) syz_open_procfs(0x0, &(0x7f0000000980)='net/sofH\x16tnet_sua') socket$inet6_tcp(0xa, 0x1, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) request_key(&(0x7f0000000000)='user\x00', &(0x7f0000000040)={'syz'}, &(0x7f0000000a80), 0xfffffffffffffffd) socket$inet(0x2, 0x4000000000000001, 0x0) perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x1ee6b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000000c0)={0xeb, 0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB="0563044000000000046304400000000006630440000000007997506ea39438033ada635f7cd4c9d1de50cf51e7a773b356e7348d3b19cbdc76ed97a6a08da8997815ea9e6d3b6a1d5a7c1cdf78337a6166cfd70cf41b6cb958e69b7dae4fe74a09c8e4db4c323ba219438b49c2f1736eb01b18c098512160aad1c0394bd4c9b785ea39e6f5b1f809658351bcb5f101899004e6a8542081ceec87f1a675538ce9264c7f128392c875c23507fc8a694ef2d13b127563b2da420a3df952f062dd3d46202a3466fa9a9c985dde3cc577a1fdf40687931bbc4303dbab0e28bb6757bc226d9bba4db1603de1a9c7"], 0x1, 0x0, &(0x7f00000003c0)='L'}) r2 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r2, 0x40045431, &(0x7f00000000c0)) r3 = dup3(0xffffffffffffffff, r0, 0x0) ioctl$TCXONC(r3, 0x540a, 0x0) 16:21:20 executing program 0: bpf$PROG_LOAD(0x5, &(0x7f0000000440)={0x1, 0x4, &(0x7f0000000400)=ANY=[@ANYBLOB="b400000000000000af00000000000000070000000000ce079500000000000000"], &(0x7f0000000080)='GPL\x00', 0x3, 0x3f7, &(0x7f000000cf3d)=""/195}, 0x48) [ 1791.316578] binder: 12353:12356 Release 1 refcount change on invalid ref 0 ret -22 [ 1791.327328] binder: 12353:12356 unknown command 1850775417 [ 1791.340557] binder: 12353:12356 ioctl c0306201 200000c0 returned -22 16:21:20 executing program 0: ioctl$TIOCGLCKTRMIOS(0xffffffffffffffff, 0x5456, 0x0) ioctl$FS_IOC_GETFSLABEL(0xffffffffffffffff, 0x81009431, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) ptrace$setregs(0xffffffffffffffff, 0x0, 0x0, 0x0) write$P9_RWALK(r0, 0x0, 0x0) [ 1791.411241] binder: 12364:12366 Acquire 1 refcount change on invalid ref 0 ret -22 [ 1791.427707] binder: 12364:12366 IncRefs 0 refcount change on invalid ref 0 ret -22 [ 1791.444850] binder: 12364:12366 Release 1 refcount change on invalid ref 0 ret -22 [ 1791.458525] binder: 12364:12366 unknown command 1850775417 [ 1791.472033] binder: 12364:12366 ioctl c0306201 200000c0 returned -22 16:21:21 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x201000008912, &(0x7f0000000000)="11dca5055e0bcfe47bf070") r1 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r1, &(0x7f0000000000)={0xa, 0x0, 0x0, @mcast2, 0x6}, 0x1c) setsockopt$sock_int(r1, 0x1, 0x29, &(0x7f0000000080)=0x2, 0x4) 16:21:21 executing program 1: syz_open_procfs(0x0, &(0x7f0000000080)='net/dev_snmp6\x00') socket(0x10, 0x80002, 0x0) r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) socket$nl_generic(0x10, 0x3, 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x1ee6b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0xeb, 0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB="0563044000000000046304400000000006630440000000007997506ea39438033ada635f7cd4c9d1de50cf51e7a773b356e7348d3b19cbdc76ed97a6a08da8997815ea9e6d3b6a1d5a7c1cdf78337a6166cfd70cf41b6cb958e69b7dae4fe74a09c8e4db4c323ba219438b49c2f1736eb01b18c098512160aad1c0394bd4c9b785ea39e6f5b1f809658351bcb5f101899004e6a8542081ceec87f1a675538ce9264c7f128392c875c23507fc8a694ef2d13b127563b2da420a3df952f062dd3d46202a3466fa9a9c985dde3cc577a1fdf40687931bbc4303dbab0e28bb6757bc226d9bba4db1603de1a9c7"], 0x1, 0x0, &(0x7f00000003c0)='L'}) ioctl$TCXONC(0xffffffffffffffff, 0x540a, 0x0) 16:21:21 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) listen(r0, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000200)='net/tcp6\x00') preadv(r1, &(0x7f0000000000)=[{&(0x7f0000000240)=""/169, 0xa9}], 0x1, 0x0) 16:21:21 executing program 5: r0 = syz_open_procfs(0x0, &(0x7f0000000080)='net/dev_snmp6\x00') socket(0x10, 0x80002, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) socket$nl_generic(0x10, 0x3, 0x10) syz_open_procfs(0x0, &(0x7f0000000980)='net/sofH\x16tnet_sua') socket$inet6_tcp(0xa, 0x1, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) request_key(&(0x7f0000000000)='user\x00', &(0x7f0000000040)={'syz'}, &(0x7f0000000a80), 0xfffffffffffffffd) socket$inet(0x2, 0x4000000000000001, 0x0) perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x1ee6b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000000c0)={0xeb, 0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB="0563044000000000046304400000000006630440000000007997506ea39438033ada635f7cd4c9d1de50cf51e7a773b356e7348d3b19cbdc76ed97a6a08da8997815ea9e6d3b6a1d5a7c1cdf78337a6166cfd70cf41b6cb958e69b7dae4fe74a09c8e4db4c323ba219438b49c2f1736eb01b18c098512160aad1c0394bd4c9b785ea39e6f5b1f809658351bcb5f101899004e6a8542081ceec87f1a675538ce9264c7f128392c875c23507fc8a694ef2d13b127563b2da420a3df952f062dd3d46202a3466fa9a9c985dde3cc577a1fdf40687931bbc4303dbab0e28bb6757bc226d9bba4db1603de1a9c7"], 0x1, 0x0, &(0x7f00000003c0)='L'}) r2 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ptmx\x00', 0x0, 0x0) r3 = syz_open_pts(r2, 0x0) r4 = dup3(r3, r0, 0x0) ioctl$TCXONC(r4, 0x540a, 0x0) [ 1791.643309] binder: 12377:12381 Acquire 1 refcount change on invalid ref 0 ret -22 [ 1791.663682] binder: 12377:12381 IncRefs 0 refcount change on invalid ref 0 ret -22 [ 1791.666269] binder: 12380:12385 Acquire 1 refcount change on invalid ref 0 ret -22 [ 1791.681076] binder: 12380:12385 IncRefs 0 refcount change on invalid ref 0 ret -22 [ 1791.696205] binder: 12380:12385 Release 1 refcount change on invalid ref 0 ret -22 [ 1791.697337] binder: 12377:12381 Release 1 refcount change on invalid ref 0 ret -22 [ 1791.719635] binder: 12380:12385 unknown command 1850775417 [ 1791.726216] binder: 12377:12381 unknown command 1850775417 [ 1791.738385] binder: 12380:12385 ioctl c0306201 200000c0 returned -22 [ 1791.742380] binder: 12377:12381 ioctl c0306201 200000c0 returned -22 16:21:21 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x8001000008916, &(0x7f00000001c0)="0bce4c73b0651350c16537f6d3269e79a6a904ebd9377cdb7bdaa392f198eb7afe4dbe6a5a40c44a3826440844233f311da745ff5c0ae33d9b258720fa31bdc239a51d5e905c063995583111110bb77a02708e65a4acfec3da1a4fa08d99785cebc8e589ec9e1f592276fa348f3fcc44d9a340783a13b912a641f6ddc271072cfb5b34f51c4451621e93f021e28823611e31000000000000") r1 = socket$inet_tcp(0x2, 0x1, 0x0) pipe2$9p(&(0x7f0000000a40)={0xffffffffffffffff, 0xffffffffffffffff}, 0x40800) write$P9_RLINK(r2, &(0x7f0000000a80)={0x7, 0x47, 0x2}, 0x7) bind$inet(r1, &(0x7f0000000100)={0x2, 0x4e20}, 0x10) openat$selinux_status(0xffffffffffffff9c, &(0x7f0000000ac0)='/selinux/status\x00', 0x0, 0x0) connect$inet(r1, &(0x7f0000000cc0)={0x2, 0x4e20, @local}, 0x10) setsockopt$SO_TIMESTAMPING(r1, 0x1, 0x25, &(0x7f00000010c0)=0x4000, 0x4) sendto$inet(r1, &(0x7f0000000140)="b0", 0x1, 0x0, 0x0, 0x0) r3 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) pipe(&(0x7f0000000480)={0xffffffffffffffff}) syz_mount_image$ext4(&(0x7f0000000340)='ext2\x00', &(0x7f0000000380)='./file0\x00', 0xdd, 0x7, &(0x7f00000008c0)=[{&(0x7f00000003c0)="1a0ef54fdcb261265ef92b9bbbad724247b602fe7daa6b475fc2d1dc5a4c27958ee9c984e03c7da55a799368284ab1b929f6db1400b24073df9d5b", 0x3b, 0x7}, {&(0x7f00000004c0)="4b4402f293fcf036e2ec4abf9be65771ee912075dfc145821cf379d0f65aff1bcd7a626f99f42102997ffc091b91cfd0ab79109240e1f5d55fd53d48f83261b8459e20c6c70cf4ebdee2818163be846133445f0d1fb6f4b8816f778531a18ba80f3cd2755c734a06b703679d9dc8f848badb32e946b5c0cc4444a8c7f2781a6a1fcd", 0x82, 0x1}, {&(0x7f0000000580)="134f3c489224c415b808da2545ff4ba2a8d3b441202d7962bb6c3c5c40d061795ae2482f9bb5123e2c87f7d36f189032e62ede062bfe284c79641c72036514b13666f5e6ad109d337f2a8bf0f45cb5648e83a68deea758bba4e81478c9e522bc91a715272f3faca0c1d72233ce41ee839d4ac797aa135c777a6e42cbf4db8af56407b9f05d2dfb8a00804d0868ca884cd48f42bd8a6e21088513aec0bf361bc048e349965f55b988b4bdc9fbe9730b36d86e2f4ca9edf635b479eb93521b6899cb38840ef8b00b8049253471dea3784ae05b9a3849c8c1f7ca9145a629fef87325632f758c69db524948479b", 0xec, 0x9}, {&(0x7f0000000680)="9549d52c58c14e57692e073288e5febaab602273790edf86bcc830e3b7d6442ca587405b0f8cf36ddacb42d92420e20781b760ac3a4771c3f4507437c7013afd2a658e49b47052e0e87448632d8e0a1ac1be1eed8f6ef6b103521f2675f87167bc1091ad2c314283e6a3b390601084145dff03cc2bbf26697344381d1ceb98350a4efcf487e21231d231985f6944ccea2f8c49f1c34d810e72413d3efabf84acf40a6b224a66b2e1746761f523078201840441711f86307ef51f8208f7", 0xbd, 0x401}, {&(0x7f0000000400)="f13b6f566307745f231fe976a0c90a3567ba5f72ef779c70a50e034f7bfb4f833bb8306215866595a0f7808fbab75218407006ecac1aececf6598975a73655b5b9e23cbc26a0172f13c14f641a80a568548f395e036708c52ef6ec0d1968119ad5a793b1b40ec53957", 0x69, 0xfffffffffffffffa}, {&(0x7f0000000740)="1224cf84c3489ba613a80d606fe90cbdcd373e562c3a2f9fd7c622ad4824e75a9995a8408da7d656fd93db293dbb75f10f7d1e7f0b3ac435baf9e1d5a765350c68c8e5ee563834c4c6348a79658797fc83a944a6b278fe34c8d1bf603a200fd9e5a1eac2ca459723d2162db4966b286af411d856ee7561b46a5a05a79fa175f2a3d6d01dc583a7ad0ff02b5cfd15079ba848db423e999e2fbc", 0x99, 0x9}, {&(0x7f0000000800)="250ab045e7a4bf26bac9fcd21743797833ae3bfce5dca429956b304b05fcd0d04421faea615bf4d75e82efb1c33d66c700303d076c63cf358cb8df2e2fea127fb5cbb0c85c79855f606b3d5a4f351e54e7e254c69d32404a3cef9d1999b136ce4685372afeef21d390f1b3eae13e30b3403b22c7f7e9abca1ba011e8b3b9315458f03ed68836e0ed34219b4f", 0x8c}], 0x0, &(0x7f0000000980)={[{@orlov='orlov'}, {@init_itable='init_itable'}, {@min_batch_time={'min_batch_time', 0x3d, 0x9}}, {@debug='debug'}], [{@obj_role={'obj_role', 0x3d, 'ib'}}, {@appraise='appraise'}, {@context={'context', 0x3d, 'user_u'}}, {@defcontext={'defcontext', 0x3d, 'unconfined_u'}}, {@fsname={'fsname'}}, {@audit='audit'}]}) lsetxattr$trusted_overlay_origin(&(0x7f0000000280)='./file0\x00', &(0x7f00000002c0)='trusted.overlay.origin\x00', &(0x7f0000000300)='y\x00', 0x2, 0x2) vmsplice(r4, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) accept(r4, 0x0, &(0x7f0000000180)) sendmsg$TIPC_NL_MON_PEER_GET(r0, &(0x7f00000000c0)={&(0x7f0000000040), 0xc, &(0x7f0000000080)={&(0x7f0000000d00)=ANY=[@ANYBLOB="b000008032d43a0b361358caf2455e56a20fae2c5ea9554613ee65c587eb75eb79f7a460511e9fd653956cafb245ab83f00e69ddf65b62c36de4bd20b22fb83dbb9ca548d60b0686859cd8b35ad2cc620ed74e4e8b6b99681cedeeffa89bbd8f948f185420ab6b3df97ea1ba2ce73db3e4df04549147483e687214901517dfedb84aa23c983b1cf46e5e037821cc03dc052baddb53cc6bc7b6b7ce06ae1c2fe353de041fc06ac6922f294ab59d548bc281daa92dfc050d856a9a77f6c7af4d45bfba72d6baf670568bc53c398f1ca0c15250931809dd4cc0bd35df99b29bcfef9588597f1fb8bf1a529233715d5efaa6f96c703367a4d7e649196c55454f43c083fbaa59bdcfb999c3cbdaef5859caab234775f50b5e528815c84974b516ede687bfc176d8e5152c986300"/313, @ANYRES16=0x0, @ANYBLOB="00012cbd7000fddbdf25130000009c0001000800030009000000100001007564703a73797a31000000000c00010069623a62707130003c00020008000300080000000800040040000000080001001900000008000100050000000800020004000000080004000010000008000200825a000038000400200001000a004e21000001fffe8000000000000000000000000000bb030000001400020002004e20000000060000000000000000"], 0xb0}, 0x1, 0x0, 0x0, 0x80}, 0x4004080) recvmmsg(r3, &(0x7f0000000000)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0) munlockall() 16:21:21 executing program 0: clone(0x41bc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = getpid() rt_tgsigqueueinfo(r0, r0, 0x16, &(0x7f00000001c0)) ptrace(0x4206, r0) ptrace$setregs(0xf, r0, 0x0, &(0x7f0000000040)="6dcc41f84bf8db12a41257fdbad65720057a485ca95b4a4b32240315f00e8cff328a04d5b4") ptrace$getregset(0x4205, r0, 0x2, &(0x7f0000000000)={0x0}) 16:21:21 executing program 4: r0 = socket$inet6(0xa, 0x0, 0x0) bind$inet6(r0, &(0x7f0000fa0fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) open(&(0x7f0000002000)='./bus\x00', 0x0, 0x0) syz_mount_image$ext4(0x0, 0x0, 0x0, 0x1, &(0x7f00000007c0)=[{&(0x7f0000000580)="62f23e748cdfecc0d3bcb88248f9f8f8e87edc5637656d6e511dcdc6041c8d8a0957939950c15c7ac6360c7820e1d5957ba4167f17600b58767db91e29eb92a20f86dddfb0f8dda322d3ddeadba924051c7894f228f090746b1a55e851e7dcaae4d8411f6806d216b4f2e7eca231a301cc0c9bb4bb5598a94336a99790d3b77dcda45483c1fb1194c56ddfddb5", 0x8d, 0x9}], 0x0, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_mount_image$ext4(&(0x7f0000000080)='ext4\x00', &(0x7f0000000000)='./file0\x00', 0x0, 0xaaaaaaaaaaaab31, &(0x7f0000000100)=[{&(0x7f00000000c0)="800000003804000019000300e60100006c000000000000000100000001000000004000000040000080000000000000006d5ebe5a0000ffff53ef", 0x2c3, 0x400}], 0x1, 0x0) 16:21:21 executing program 5: r0 = syz_open_procfs(0x0, &(0x7f0000000080)='net/dev_snmp6\x00') socket(0x10, 0x80002, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) socket$nl_generic(0x10, 0x3, 0x10) syz_open_procfs(0x0, &(0x7f0000000980)='net/sofH\x16tnet_sua') socket$inet6_tcp(0xa, 0x1, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) request_key(&(0x7f0000000000)='user\x00', &(0x7f0000000040)={'syz'}, &(0x7f0000000a80), 0xfffffffffffffffd) socket$inet(0x2, 0x4000000000000001, 0x0) perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x1ee6b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000000c0)={0xeb, 0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB="0563044000000000046304400000000006630440000000007997506ea39438033ada635f7cd4c9d1de50cf51e7a773b356e7348d3b19cbdc76ed97a6a08da8997815ea9e6d3b6a1d5a7c1cdf78337a6166cfd70cf41b6cb958e69b7dae4fe74a09c8e4db4c323ba219438b49c2f1736eb01b18c098512160aad1c0394bd4c9b785ea39e6f5b1f809658351bcb5f101899004e6a8542081ceec87f1a675538ce9264c7f128392c875c23507fc8a694ef2d13b127563b2da420a3df952f062dd3d46202a3466fa9a9c985dde3cc577a1fdf40687931bbc4303dbab0e28bb6757bc226d9bba4db1603de1a9c7"], 0x1, 0x0, &(0x7f00000003c0)='L'}) r2 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ptmx\x00', 0x0, 0x0) r3 = syz_open_pts(r2, 0x0) r4 = dup3(r3, r0, 0x0) ioctl$TCXONC(r4, 0x540a, 0x0) 16:21:21 executing program 1: syz_open_procfs(0x0, &(0x7f0000000080)='net/dev_snmp6\x00') socket(0x10, 0x80002, 0x0) r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x1ee6b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0xeb, 0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB="0563044000000000046304400000000006630440000000007997506ea39438033ada635f7cd4c9d1de50cf51e7a773b356e7348d3b19cbdc76ed97a6a08da8997815ea9e6d3b6a1d5a7c1cdf78337a6166cfd70cf41b6cb958e69b7dae4fe74a09c8e4db4c323ba219438b49c2f1736eb01b18c098512160aad1c0394bd4c9b785ea39e6f5b1f809658351bcb5f101899004e6a8542081ceec87f1a675538ce9264c7f128392c875c23507fc8a694ef2d13b127563b2da420a3df952f062dd3d46202a3466fa9a9c985dde3cc577a1fdf40687931bbc4303dbab0e28bb6757bc226d9bba4db1603de1a9c7"], 0x1, 0x0, &(0x7f00000003c0)='L'}) ioctl$TCXONC(0xffffffffffffffff, 0x540a, 0x0) 16:21:21 executing program 2: r0 = syz_open_procfs(0x0, &(0x7f0000000080)='net/dev_snmp6\x00') r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r1, 0x40045431, &(0x7f00000000c0)) r2 = syz_open_pts(r1, 0x0) r3 = dup3(r2, r0, 0x0) ioctl$TCXONC(r3, 0x540a, 0x0) pipe(&(0x7f0000000480)={0xffffffffffffffff, 0xffffffffffffffff}) write(r4, &(0x7f0000000340), 0x41395527) write$uinput_user_dev(r4, &(0x7f0000000380)={'syz0\x00', {0x6, 0x19, 0xdd9, 0x4}, 0x23, [0x7, 0x1, 0xa2b, 0x3ff, 0x5, 0x5, 0xf1f6, 0x7d8b, 0x2, 0x91000000000, 0x0, 0x1, 0x2, 0x6, 0x400, 0x1, 0xce8, 0x1, 0x2, 0x67a5, 0xd5f, 0x1f, 0x4, 0x100000000, 0x8, 0xfff, 0x2, 0x5, 0x7, 0xffffffffffff40c6, 0xffffffffffffffff, 0x5, 0x6, 0x2, 0x846, 0x100000000, 0xfffffffffffffffa, 0x0, 0x3, 0x3800000000000000, 0xff, 0x8, 0x2, 0x80, 0x8, 0x8, 0xfffffffffffffff9, 0x1ff, 0x2, 0xfff, 0x8, 0x7ff, 0x20, 0x2, 0x6, 0x3, 0x6, 0x0, 0x6673, 0x1, 0x3ff, 0x7, 0x401, 0x9], [0xfffffffffffff800, 0x4, 0x2, 0x5f36, 0x1f, 0x80000000, 0x3, 0x8, 0x5, 0x6, 0x9, 0x101, 0x8, 0x5, 0x7ff, 0x4, 0x1, 0x3, 0x6cef, 0x2, 0x52, 0x7, 0x7, 0x4, 0x1, 0xfff, 0x100000000, 0x81, 0x1d, 0x2, 0xa8, 0x1ff, 0x4, 0xa07, 0x4, 0x100000001, 0x0, 0x2, 0x2, 0xa3a1, 0x6, 0x2, 0x7, 0x4, 0x5, 0xb08, 0x2, 0x0, 0x81, 0x3ff, 0x3, 0x8, 0x2, 0x800, 0x6e27, 0x2, 0x3ff, 0x80, 0x93, 0xfffffffffffffffa, 0xff, 0x6, 0x1, 0x5], [0x1000, 0x9, 0xffff, 0x2f6b3c0f, 0x9, 0xf731, 0x5, 0x9, 0x1f, 0xba2, 0x7f, 0x8, 0xea, 0x3ff, 0x3, 0x4, 0x1, 0x1ff, 0x5466, 0xb, 0x9ed6, 0xffff, 0x7, 0x4, 0x2, 0x0, 0x5, 0x8, 0x10000, 0x2, 0x2, 0x246, 0x0, 0x0, 0x6, 0x5, 0x2996, 0x401, 0xaf5e, 0x6, 0x4, 0xc4, 0x100000001, 0x66fb773b, 0x8b, 0x7fffffff, 0x2, 0x3, 0x3ff, 0x0, 0x7fff, 0x1, 0x80, 0x3, 0x7, 0x9, 0x7ff, 0x1f, 0x1, 0x7fffffff, 0xc3d8, 0x0, 0xff, 0x5], [0x4, 0x7, 0x1ff, 0x6, 0x0, 0x491, 0x8, 0x7fffffff, 0x33, 0x2, 0xcd, 0x2, 0x1, 0x2, 0x5, 0x1f, 0x3ff, 0x9, 0x400, 0x8, 0x6, 0x0, 0xb4c8, 0x9, 0x80, 0x2, 0x3, 0x0, 0x1a0, 0xfffffffffffffffb, 0x7, 0x9, 0x0, 0x0, 0x7, 0x400, 0x101, 0x10000, 0x3, 0x8, 0x0, 0x7ff, 0x9, 0x3, 0x2, 0x8001, 0x3f, 0x2, 0xb1a, 0xd8, 0x7fff, 0x1, 0x7fffffff, 0x3ff, 0x7, 0x2, 0x100000001, 0x8, 0x7, 0x2, 0x101, 0x6, 0x8, 0x2]}, 0x45c) ioctl$TIOCVHANGUP(r1, 0x5437, 0x0) pselect6(0x40, &(0x7f0000000340)={0x9}, 0x0, 0x0, 0x0, 0x0) [ 1792.141073] binder: 12399:12405 Acquire 1 refcount change on invalid ref 0 ret -22 [ 1792.154842] binder: 12399:12405 IncRefs 0 refcount change on invalid ref 0 ret -22 [ 1792.166943] binder: 12399:12405 Release 1 refcount change on invalid ref 0 ret -22 [ 1792.177677] binder: 12400:12403 Acquire 1 refcount change on invalid ref 0 ret -22 [ 1792.182202] binder: 12399:12405 unknown command 1850775417 16:21:21 executing program 1: syz_open_procfs(0x0, &(0x7f0000000080)='net/dev_snmp6\x00') socket(0x10, 0x80002, 0x0) r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x1ee6b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0xeb, 0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB="0563044000000000046304400000000006630440000000007997506ea39438033ada635f7cd4c9d1de50cf51e7a773b356e7348d3b19cbdc76ed97a6a08da8997815ea9e6d3b6a1d5a7c1cdf78337a6166cfd70cf41b6cb958e69b7dae4fe74a09c8e4db4c323ba219438b49c2f1736eb01b18c098512160aad1c0394bd4c9b785ea39e6f5b1f809658351bcb5f101899004e6a8542081ceec87f1a675538ce9264c7f128392c875c23507fc8a694ef2d13b127563b2da420a3df952f062dd3d46202a3466fa9a9c985dde3cc577a1fdf40687931bbc4303dbab0e28bb6757bc226d9bba4db1603de1a9c7"], 0x1, 0x0, &(0x7f00000003c0)='L'}) ioctl$TCXONC(0xffffffffffffffff, 0x540a, 0x0) [ 1792.192469] binder: 12399:12405 ioctl c0306201 200000c0 returned -22 [ 1792.245584] binder: 12400:12403 IncRefs 0 refcount change on invalid ref 0 ret -22 [ 1792.266030] binder: 12400:12403 Release 1 refcount change on invalid ref 0 ret -22 [ 1792.275373] binder: 12400:12403 unknown command 1850775417 [ 1792.282575] binder: 12400:12403 ioctl c0306201 200000c0 returned -22 16:21:21 executing program 5: r0 = syz_open_procfs(0x0, &(0x7f0000000080)='net/dev_snmp6\x00') socket(0x10, 0x80002, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) socket$nl_generic(0x10, 0x3, 0x10) syz_open_procfs(0x0, &(0x7f0000000980)='net/sofH\x16tnet_sua') socket$inet6_tcp(0xa, 0x1, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) request_key(&(0x7f0000000000)='user\x00', &(0x7f0000000040)={'syz'}, &(0x7f0000000a80), 0xfffffffffffffffd) socket$inet(0x2, 0x4000000000000001, 0x0) perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x1ee6b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000000c0)={0xeb, 0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB="0563044000000000046304400000000006630440000000007997506ea39438033ada635f7cd4c9d1de50cf51e7a773b356e7348d3b19cbdc76ed97a6a08da8997815ea9e6d3b6a1d5a7c1cdf78337a6166cfd70cf41b6cb958e69b7dae4fe74a09c8e4db4c323ba219438b49c2f1736eb01b18c098512160aad1c0394bd4c9b785ea39e6f5b1f809658351bcb5f101899004e6a8542081ceec87f1a675538ce9264c7f128392c875c23507fc8a694ef2d13b127563b2da420a3df952f062dd3d46202a3466fa9a9c985dde3cc577a1fdf40687931bbc4303dbab0e28bb6757bc226d9bba4db1603de1a9c7"], 0x1, 0x0, &(0x7f00000003c0)='L'}) r2 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ptmx\x00', 0x0, 0x0) r3 = syz_open_pts(r2, 0x0) r4 = dup3(r3, r0, 0x0) ioctl$TCXONC(r4, 0x540a, 0x0) [ 1792.290480] binder: 12425:12427 Acquire 1 refcount change on invalid ref 0 ret -22 [ 1792.302553] binder: 12425:12427 IncRefs 0 refcount change on invalid ref 0 ret -22 [ 1792.316990] binder: 12425:12427 Release 1 refcount change on invalid ref 0 ret -22 [ 1792.339291] binder: 12425:12427 unknown command 1850775417 [ 1792.345745] binder: 12425:12427 ioctl c0306201 200000c0 returned -22 16:21:21 executing program 1: syz_open_procfs(0x0, &(0x7f0000000080)='net/dev_snmp6\x00') socket(0x10, 0x80002, 0x0) r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x1ee6b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0xeb, 0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB="0563044000000000046304400000000006630440000000007997506ea39438033ada635f7cd4c9d1de50cf51e7a773b356e7348d3b19cbdc76ed97a6a08da8997815ea9e6d3b6a1d5a7c1cdf78337a6166cfd70cf41b6cb958e69b7dae4fe74a09c8e4db4c323ba219438b49c2f1736eb01b18c098512160aad1c0394bd4c9b785ea39e6f5b1f809658351bcb5f101899004e6a8542081ceec87f1a675538ce9264c7f128392c875c23507fc8a694ef2d13b127563b2da420a3df952f062dd3d46202a3466fa9a9c985dde3cc577a1fdf40687931bbc4303dbab0e28bb6757bc226d9bba4db1603de1a9c7"], 0x1, 0x0, &(0x7f00000003c0)='L'}) ioctl$TCXONC(0xffffffffffffffff, 0x540a, 0x0) [ 1792.389070] binder: 12430:12432 Acquire 1 refcount change on invalid ref 0 ret -22 [ 1792.402597] binder: 12430:12432 IncRefs 0 refcount change on invalid ref 0 ret -22 [ 1792.417787] binder: 12430:12432 Release 1 refcount change on invalid ref 0 ret -22 [ 1792.433068] binder: 12430:12432 unknown command 1850775417 16:21:21 executing program 5: r0 = syz_open_procfs(0x0, &(0x7f0000000080)='net/dev_snmp6\x00') socket(0x10, 0x80002, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) socket$nl_generic(0x10, 0x3, 0x10) syz_open_procfs(0x0, &(0x7f0000000980)='net/sofH\x16tnet_sua') socket$inet6_tcp(0xa, 0x1, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) request_key(&(0x7f0000000000)='user\x00', &(0x7f0000000040)={'syz'}, &(0x7f0000000a80), 0xfffffffffffffffd) socket$inet(0x2, 0x4000000000000001, 0x0) perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x1ee6b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000000c0)={0xeb, 0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB="0563044000000000046304400000000006630440000000007997506ea39438033ada635f7cd4c9d1de50cf51e7a773b356e7348d3b19cbdc76ed97a6a08da8997815ea9e6d3b6a1d5a7c1cdf78337a6166cfd70cf41b6cb958e69b7dae4fe74a09c8e4db4c323ba219438b49c2f1736eb01b18c098512160aad1c0394bd4c9b785ea39e6f5b1f809658351bcb5f101899004e6a8542081ceec87f1a675538ce9264c7f128392c875c23507fc8a694ef2d13b127563b2da420a3df952f062dd3d46202a3466fa9a9c985dde3cc577a1fdf40687931bbc4303dbab0e28bb6757bc226d9bba4db1603de1a9c7"], 0x1, 0x0, &(0x7f00000003c0)='L'}) ioctl$TCSETS(0xffffffffffffffff, 0x40045431, &(0x7f00000000c0)) r2 = syz_open_pts(0xffffffffffffffff, 0x0) r3 = dup3(r2, r0, 0x0) ioctl$TCXONC(r3, 0x540a, 0x0) [ 1792.449749] binder: 12430:12432 ioctl c0306201 200000c0 returned -22 [ 1792.460612] binder: 12436:12439 Acquire 1 refcount change on invalid ref 0 ret -22 [ 1792.477401] binder: 12436:12439 IncRefs 0 refcount change on invalid ref 0 ret -22 [ 1792.512169] binder: 12436:12439 Release 1 refcount change on invalid ref 0 ret -22 [ 1792.544729] EXT4-fs (loop4): ext4_check_descriptors: Block bitmap for group 0 overlaps superblock [ 1792.550086] binder: 12436:12439 unknown command 1850775417 [ 1792.560527] binder: 12436:12439 ioctl c0306201 200000c0 returned -22 [ 1792.561612] EXT4-fs (loop4): ext4_check_descriptors: Inode bitmap for group 0 overlaps superblock [ 1792.577682] EXT4-fs (loop4): ext4_check_descriptors: Inode table for group 0 overlaps superblock [ 1792.602576] EXT4-fs error (device loop4): ext4_iget:4749: inode #2: comm syz-executor.4: root inode unallocated 16:21:22 executing program 1: syz_open_procfs(0x0, &(0x7f0000000080)='net/dev_snmp6\x00') socket(0x10, 0x80002, 0x0) socket$nl_generic(0x10, 0x3, 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x1ee6b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f00000000c0)={0xeb, 0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB="0563044000000000046304400000000006630440000000007997506ea39438033ada635f7cd4c9d1de50cf51e7a773b356e7348d3b19cbdc76ed97a6a08da8997815ea9e6d3b6a1d5a7c1cdf78337a6166cfd70cf41b6cb958e69b7dae4fe74a09c8e4db4c323ba219438b49c2f1736eb01b18c098512160aad1c0394bd4c9b785ea39e6f5b1f809658351bcb5f101899004e6a8542081ceec87f1a675538ce9264c7f128392c875c23507fc8a694ef2d13b127563b2da420a3df952f062dd3d46202a3466fa9a9c985dde3cc577a1fdf40687931bbc4303dbab0e28bb6757bc226d9bba4db1603de1a9c7"], 0x1, 0x0, &(0x7f00000003c0)='L'}) ioctl$TCXONC(0xffffffffffffffff, 0x540a, 0x0) [ 1792.614579] EXT4-fs (loop4): get root inode failed [ 1792.619671] EXT4-fs (loop4): mount failed [ 1792.630304] binder: 12444:12448 Acquire 1 refcount change on invalid ref 0 ret -22 [ 1792.648663] binder: 12444:12448 IncRefs 0 refcount change on invalid ref 0 ret -22 16:21:22 executing program 1: syz_open_procfs(0x0, &(0x7f0000000080)='net/dev_snmp6\x00') socket(0x10, 0x80002, 0x0) socket$nl_generic(0x10, 0x3, 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x1ee6b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f00000000c0)={0xeb, 0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB="0563044000000000046304400000000006630440000000007997506ea39438033ada635f7cd4c9d1de50cf51e7a773b356e7348d3b19cbdc76ed97a6a08da8997815ea9e6d3b6a1d5a7c1cdf78337a6166cfd70cf41b6cb958e69b7dae4fe74a09c8e4db4c323ba219438b49c2f1736eb01b18c098512160aad1c0394bd4c9b785ea39e6f5b1f809658351bcb5f101899004e6a8542081ceec87f1a675538ce9264c7f128392c875c23507fc8a694ef2d13b127563b2da420a3df952f062dd3d46202a3466fa9a9c985dde3cc577a1fdf40687931bbc4303dbab0e28bb6757bc226d9bba4db1603de1a9c7"], 0x1, 0x0, &(0x7f00000003c0)='L'}) ioctl$TCXONC(0xffffffffffffffff, 0x540a, 0x0) [ 1792.661307] binder: 12444:12448 Release 1 refcount change on invalid ref 0 ret -22 [ 1792.669163] binder: 12444:12448 unknown command 1850775417 [ 1792.677423] binder: 12444:12448 ioctl c0306201 200000c0 returned -22 16:21:22 executing program 4: setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x0, &(0x7f0000000140), 0x4) syz_mount_image$ext4(0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_mount_image$ext4(&(0x7f0000000080)='ext4\x00', &(0x7f0000000000)='./file0\x00', 0x0, 0xaaaaaaaaaaaab31, &(0x7f0000000100)=[{&(0x7f00000000c0)="800000003804000019000300e60100006c000000000000000100000001000000004000000040000080000000000000006d5ebe5a0000ffff53ef", 0x2c3, 0x400}], 0x1, 0x0) utimes(&(0x7f0000000040)='./file1\x00', &(0x7f0000000140)={{0x0, 0x7530}, {0x77359400}}) 16:21:22 executing program 5: r0 = syz_open_procfs(0x0, &(0x7f0000000080)='net/dev_snmp6\x00') socket(0x10, 0x80002, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) socket$nl_generic(0x10, 0x3, 0x10) syz_open_procfs(0x0, &(0x7f0000000980)='net/sofH\x16tnet_sua') socket$inet6_tcp(0xa, 0x1, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) request_key(&(0x7f0000000000)='user\x00', &(0x7f0000000040)={'syz'}, &(0x7f0000000a80), 0xfffffffffffffffd) socket$inet(0x2, 0x4000000000000001, 0x0) perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x1ee6b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000000c0)={0xeb, 0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB="0563044000000000046304400000000006630440000000007997506ea39438033ada635f7cd4c9d1de50cf51e7a773b356e7348d3b19cbdc76ed97a6a08da8997815ea9e6d3b6a1d5a7c1cdf78337a6166cfd70cf41b6cb958e69b7dae4fe74a09c8e4db4c323ba219438b49c2f1736eb01b18c098512160aad1c0394bd4c9b785ea39e6f5b1f809658351bcb5f101899004e6a8542081ceec87f1a675538ce9264c7f128392c875c23507fc8a694ef2d13b127563b2da420a3df952f062dd3d46202a3466fa9a9c985dde3cc577a1fdf40687931bbc4303dbab0e28bb6757bc226d9bba4db1603de1a9c7"], 0x1, 0x0, &(0x7f00000003c0)='L'}) ioctl$TCSETS(0xffffffffffffffff, 0x40045431, &(0x7f00000000c0)) r2 = syz_open_pts(0xffffffffffffffff, 0x0) r3 = dup3(r2, r0, 0x0) ioctl$TCXONC(r3, 0x540a, 0x0) 16:21:22 executing program 1: syz_open_procfs(0x0, &(0x7f0000000080)='net/dev_snmp6\x00') socket(0x10, 0x80002, 0x0) socket$nl_generic(0x10, 0x3, 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x1ee6b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f00000000c0)={0xeb, 0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB="0563044000000000046304400000000006630440000000007997506ea39438033ada635f7cd4c9d1de50cf51e7a773b356e7348d3b19cbdc76ed97a6a08da8997815ea9e6d3b6a1d5a7c1cdf78337a6166cfd70cf41b6cb958e69b7dae4fe74a09c8e4db4c323ba219438b49c2f1736eb01b18c098512160aad1c0394bd4c9b785ea39e6f5b1f809658351bcb5f101899004e6a8542081ceec87f1a675538ce9264c7f128392c875c23507fc8a694ef2d13b127563b2da420a3df952f062dd3d46202a3466fa9a9c985dde3cc577a1fdf40687931bbc4303dbab0e28bb6757bc226d9bba4db1603de1a9c7"], 0x1, 0x0, &(0x7f00000003c0)='L'}) ioctl$TCXONC(0xffffffffffffffff, 0x540a, 0x0) 16:21:22 executing program 0: r0 = syz_open_dev$evdev(&(0x7f00000000c0)='/dev/input/event#\x00', 0x0, 0x0) ioctl$void(r0, 0x5451) 16:21:22 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f00000003c0)="11dca50d5e0bcfe47bf070") r1 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r1, &(0x7f0000000100)={0x2, 0x4e20}, 0x10) connect$inet(r1, &(0x7f0000000cc0)={0x2, 0x4e20, @local}, 0x10) setsockopt$SO_TIMESTAMPING(r1, 0x1, 0x25, &(0x7f00000010c0)=0x19ff, 0x4) sendto$inet(r1, &(0x7f0000000140)="b0", 0x1, 0x0, 0x0, 0x0) recvmmsg(r1, &(0x7f0000003b40)=[{{0x0, 0x0, 0x0}}], 0x1, 0x2000, 0x0) setsockopt$sock_timeval(r0, 0x1, 0x15, &(0x7f0000000000), 0x10) 16:21:22 executing program 2: r0 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x8200, 0x0) recvfrom$inet(r0, &(0x7f0000000100)=""/171, 0xab, 0x40012100, &(0x7f00000001c0)={0x2, 0x4e22, @empty}, 0x10) syz_open_procfs(0x0, &(0x7f0000000080)='net/dev_snmp6\x00') r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r1, 0x40045431, &(0x7f00000000c0)) pipe2(&(0x7f0000000280)={0xffffffffffffffff, 0xffffffffffffffff}, 0x82800) syz_open_pts(r2, 0x977740fbfeffb2a4) syz_open_pts(r1, 0x0) pipe(&(0x7f0000000480)={0xffffffffffffffff}) vmsplice(r3, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) epoll_wait(r3, &(0x7f0000000200)=[{}, {}, {}, {}, {}, {}, {}], 0x7, 0x100000001) r4 = dup3(r1, r1, 0x180000) ioctl$TCXONC(r4, 0x540a, 0x0) pselect6(0x40, &(0x7f0000000340)={0x9}, 0x0, 0x0, 0x0, 0x0) pipe(&(0x7f0000000480)={0xffffffffffffffff, 0xffffffffffffffff}) r6 = gettid() ptrace$setopts(0x4206, r6, 0x0, 0x0) tkill(r6, 0x3c) ptrace$cont(0x18, r6, 0x0, 0x0) ptrace$setregs(0xd, r6, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r6, 0x0, 0x0) ptrace$getenv(0x4201, r6, 0x0, &(0x7f0000000300)) write(r5, &(0x7f0000000340), 0x41395527) ioctl$TCSETS(r5, 0x5402, &(0x7f00000002c0)={0xba3, 0x4, 0x7, 0x4, 0x1b, 0x100000001, 0x0, 0x2, 0x7, 0x2, 0x3ff, 0xfffffffffffffff9}) 16:21:22 executing program 1: syz_open_procfs(0x0, &(0x7f0000000080)='net/dev_snmp6\x00') r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) socket$nl_generic(0x10, 0x3, 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x1ee6b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0xeb, 0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB="0563044000000000046304400000000006630440000000007997506ea39438033ada635f7cd4c9d1de50cf51e7a773b356e7348d3b19cbdc76ed97a6a08da8997815ea9e6d3b6a1d5a7c1cdf78337a6166cfd70cf41b6cb958e69b7dae4fe74a09c8e4db4c323ba219438b49c2f1736eb01b18c098512160aad1c0394bd4c9b785ea39e6f5b1f809658351bcb5f101899004e6a8542081ceec87f1a675538ce9264c7f128392c875c23507fc8a694ef2d13b127563b2da420a3df952f062dd3d46202a3466fa9a9c985dde3cc577a1fdf40687931bbc4303dbab0e28bb6757bc226d9bba4db1603de1a9c7"], 0x1, 0x0, &(0x7f00000003c0)='L'}) ioctl$TCXONC(0xffffffffffffffff, 0x540a, 0x0) 16:21:22 executing program 0: syz_open_procfs(0x0, &(0x7f0000000080)='net/dev_snmp6\x00') r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00000000c0)) r1 = syz_open_pts(r0, 0x0) ioctl$TCSETS2(r1, 0x402c542b, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, 0x0, "36b71128cfa8bdd3b2da4fd6a1cb228fb9755b"}) pipe(&(0x7f00000002c0)) epoll_create(0xe) pselect6(0x40, &(0x7f00000000c0)={0x3}, 0x0, &(0x7f0000000140)={0x1b7}, 0x0, 0x0) [ 1793.063280] binder: 12472:12479 Acquire 1 refcount change on invalid ref 0 ret -22 [ 1793.089428] binder: 12472:12479 IncRefs 0 refcount change on invalid ref 0 ret -22 [ 1793.148623] binder: 12472:12479 Release 1 refcount change on invalid ref 0 ret -22 16:21:22 executing program 2: r0 = syz_open_procfs(0x0, &(0x7f0000000080)='net/dev_snmp6\x00') r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r1, 0x40045431, &(0x7f00000000c0)) r2 = syz_open_pts(r1, 0x0) r3 = dup3(r2, r0, 0x0) ioctl$TCXONC(r3, 0x540a, 0x0) pselect6(0x40, &(0x7f0000000340)={0x9}, 0x0, 0x0, 0x0, 0x0) r4 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000100)='/dev/ppp\x00', 0x0, 0x0) getresuid(&(0x7f0000000140), &(0x7f0000000180), &(0x7f00000001c0)=0x0) pipe2(&(0x7f0000005e00)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80000) pipe(&(0x7f0000000480)={0xffffffffffffffff}) vmsplice(r7, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) r8 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r8, 0x40045431, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1}) syz_open_pts(r8, 0x0) pipe(&(0x7f0000000480)={0xffffffffffffffff}) vmsplice(r9, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) r10 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r10, 0x40045431, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1}) syz_open_pts(r10, 0x0) pipe(&(0x7f0000000480)={0xffffffffffffffff}) vmsplice(r11, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) r12 = openat$pfkey(0xffffffffffffff9c, &(0x7f0000005e40)='/proc/self/net/pfkey\x00', 0x101000, 0x0) r13 = socket$inet6_udp(0xa, 0x2, 0x0) r14 = syz_open_dev$evdev(&(0x7f0000005e80)='/dev/input/event#\x00', 0xfffffffffffffffe, 0x115284) r15 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r15, 0x40045431, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1}) syz_open_pts(r15, 0x0) pipe(&(0x7f0000000480)={0xffffffffffffffff}) vmsplice(r16, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) ioctl$sock_FIOGETOWN(0xffffffffffffffff, 0x8903, &(0x7f0000005ec0)=0x0) r18 = geteuid() r19 = socket$inet(0x2, 0x4000000000000001, 0x0) r20 = add_key$user(&(0x7f0000000400)='user\x00', &(0x7f0000000500)={'syz', 0x2}, &(0x7f0000000740)="adf1f298ac1bac9c3d6f3dd7088ea654b4d0c0216fd6039c9f3599f4eb90e9fa9662a65d09962ab7985f28190c268be092caad1a44a30b9cb7ffb74ba55a08d87a17b142b3767782e5b9dca7bf952e0c54fe24c41f7ec528036c0641a850e7e13bb3e1f8d628563930c484d5f4c7e6f57eb8210ae214170116934c7c4b9ecd38ebe379a4e370e6b036d4558d2c6a22f98bff9a1e6c0f32bd9fc1f1c2d3d42b351434a95544db8db01a6370828055e048246b9cca39ce36a812f2ce6975c8f20d8b1c156a842cc2ddce5ad756caa98ba0b4ceedb3f59dc50e2f832f77145425903391f84e4488e41d389923ee22c813923b0ddf78781242793b4a58b7d1b32f3c9e0e11f3ccd2bb9cb92364453a89cc9e9188cf075959f164daeb894937ef7ccfe675d841879bf5d9f41d427bee1a707fb5cdb87a369e7ad0778906f92d743ae9da5bd145c344ae748c41e4980816e6e5f30548125d8a8e78f08e742e876c3708db6934b9eadb446b7d406ded73d01f989936ca214b1c4cc24c741f9992e238a2d44fd9bdc474e11d3de5b86b97bb1468f0da8236c48e3dbe4925212dca23d462b8f87feefee83487ab429cb57aeb02c17e53ba39778e546ec827ffc5c0cc0ec0ddd876a0268ed27a1ffdd200d546ef1d9df96e0db747465df2e2ebdef50c907f5a23b0f23cefe866dc6a9e6e2fdb0e525ff5533e2bcb5df452e5601a840cca9fd0052ff1211276ec405e5816e41c010b242a63fa3b97b0a4d79fef738f263a16fbdb734fb11ef174bfd09709d8ebabe8e9b774c3a34d7f3146ead0cc4c6b329ec5ab3b4a58b40cf9f47199a794ccd89326d9e57d5d8faee65a21c34e49cb8994d6e69df42d0927cbe82e667cbd2ec0ecd89c8ba490ee78e4a11635587e5ccbb5fa3f93d3b776d4e522748e2bbf1dc2cb6d826a1d60d010981cf4305ec59f948f80a21c36ad3b10227825cde0c3f82f2960ddbc9e6dc31038f4b184440562cc3e74604b9162cec885324cfdf48da6c18c78fee359b53d8fe80e6b7a1d9fa37eda00179e517d9ef87c31486f184817051b7ff4421d016fad8728ce2d71435a102387084a9819b87c7858c267e1706455ee0a6dd069c057bb88df0fc7cddfd7298d273994e726fe747fffaff6b91d1bc6efe5e98f68ed762d20f8ee47ac5efd7bde79e106b84b886ab8cb69d8f3955ffd6eaca423b35d9a2d48444d296b5ac40877a137cdb150182c670abf67fdd8156a1a1da6eef74e1f6e01b771789d6b39fda761b0de124086c86d02e3912473efdc8082b3b9c97231464b6e286dbba0fa079d273ec82d620f459dda008d3975ac848794c9b47ac13bb401b1ed54544cfb010a929596a77ab12f8d78629ff81524fa66743e8197adaf9014fa51e590d6c54996dc52bca8cd965bcdcdc6d711d9b40b6fb5834e62e0ba5c41a25376393b1d79be14fee3400536f758c9c483a85d451b8f764241c2266e26449f588827ad7f2433c7810ef6f892d2da86b1109c14cef4c78796474b2f6d5c6761ea8debc6ad9a201395dbcc58d5dd098b965d76876d50dbd4cd1f3184a87cbd9d2c845d005ffece73dc9644c6d3876ea79c630d885ccf2ca10432094801bd0407f932f623132b66f690f59f163f942dd14f7a50881721e65ed674815fc0b70e57d2afdd90a58ea22cbefd117e7e2b3bbd08cf0287788d2e770cbc25bd10f5a0bf9d4fd604ff415b6e32bee283e8079c2f176911820de7d9a71d392796f396d0a4aebb1e54e1daf5a50712390e8294b288887da5ad9990b61846701c79de2f77c2fe259cb06e438b11d2b9fb9ef0dcd5666f3339326a46da9bd09d5004156eec0a4e09880a2a838fefc2d3a491eff358919d4c15ce6f0c9d32abdac334887be04601cfaf4092a8f4df25e8c4ea28ea8eb0d003d603ccc91a1555b2dc3b055c05d8b908a1d19890d7e31e6539e90021d57f040df5c2554d083c4345579c815c677d6e6a42e5b2e9f76635ec5908bd80bcb4fdb25012ea02104f86f9e31643608c1b18fcd94d04f59bc8658ebf09ca78837830c6453d8e143a474f715bacabc76f88e6742ac68fef2f6644bd0d3de978ff5f269b27ec6f1a5e025c2a0c01f1e9bf0ea7b4d54a80b4498a85307aad5f6098b335d22f0d31625ca95ed1856b55cd02dbf6431da0b536b7f5e073d22cbe7b09784f389a4935f5d854c64c7a3753f28dc2bac480343374d86f3278170233a3e74eaa461fad0590f8ce715981532203edaa762d23db1705e8efee53a85a8f5548a71d12a9644b025e782d88c87e46698ce1260a3ef37d8add19f895b712325e26ca5b6165e7ec28061925e18ca70f44c02d082cbb74e78915894a3a3de96f5ce3198d0b7e11d97a708dad811cc66424e1a741e979fdac0a15a62a5252b8f34deb23798f84469ddfc968e8961268868715affd8dc6a43b5c8716dd94372e331a6e0cebf4fd8696bc9133984e060efaee80f9921dbf3b18d510eff7fb414b961eba0e88f83dec6c66121ffe068f3a646eb86b631362d49cd38e1aa6704f0397908a0babf9cb962de4aec4b20530e2225e3ba7c8263d9a8a90640b12a9d0633eef22a42ccc478d1b0d1bf6a9590e0b9803479509c89b0187fb35ffe1aa6703e7d48c75281cdbbc6cce1e2e5f0bcd8689071747cdbac317a7d71430312927b95b1cd0fc15603da8395825aeb6499acc811e6974d4e46c8f6a7c17c8edc9727b9a68d65e7a1efb2b8085bbc0640e6fc56550a2e4e93d4b11bace5a9676716c44b1f2d5b2ab18ed45c6c71f6a58078d5814f925a52b1a601cd675c3e8ce218013895c071abcf2501cf24499cb5c3531b98a9b97dd762ed9af6f8d22c720f156c38eb7a27eabe22fa93d292497e8da1285ac223ad30a624542e2082f78adbe1059b2e7e6e831a850f0e9d71ade8c011cfbcb0718707fd6bf5b865c4af381bf431a5b22be6143ef12acb4e992c0361fabc14cfefeca590217c7416598a12623066e6b31b77c6839d6cc63e4a494d16616bcd0eab082b946bc90f324c3ffa131378b02937f677f6803f80d802cda7dac607aabe9df8bc19594711d12c85726ce4bcd6f686d13bbf391721f634b89216e1c947f88134c8b9df912306974a9140c68fe1badf8c0f693a197131846881f3ef0b3ae3ed3fbbde90b6acfa4e018000f1ac0b63bc4810690014d44dc8fe8ca5ac88f584a890f47786737a507cde305991ea0156db425e9f540b32ae01acf493db8bae8705fe46724dfdcb453cf4ee93b9305d29746b3628ea8e322ac70170ec02797e1c897e476f74d8b4d70eef872c4305015391304647c5c55171790e24188cd3e08db1b507f022b2b81c5d88abc776a41e0070c86c297ef832e548497a8b65e6bdc249c1a90ca0d72a0f2ff4b04206aad4c5bf55c7b84dde974a2e87504d2145aea3d3b478ebc028e88728b3e834d0f9f6ace8e0b570923b07e390971b035d9e4d1b6fd77db56f4196e55622c34897204690bfd3c69665a66e04f97d4b5e193f20632f5c57ab9aa496e274978b147f84bcf7e3be85bfa9245c2f55296619bdc9bdf1fb0986573206cc95ca47cb13cd663f82ea8042e42a3e8bc61c832f1745f83f1b8529d623406fa8184779141b58269adbd220afc546aa6a4d3be27567793a8fff83d71cec3ab7e59e5943f388ed3b1f3e8e254d6c6143fd0e63b4a2da47dbbebad178a323e2ccce33adeb1d4974c5cf6ab59c732afab6854a55cc165cefc17641bdb17e907d9d18b5dcc3155b8101153c30ccdc3e0bbf749bad08b4d201b35b564cb74323bdf6346bf956a3448ec6f7ca99f7e37a069b7771b32c15e2e0e5c9d6898e70e6ed0641516da2f95b7a34516883366b0b22358fd12e934934a4642ee1a8eb78225f74e8aa34e3906ed6d9585869a752e7db2b8c99a02c62512c1a435ae09fc7ef06caf578a4c7965ad684c044d336b8cf7e540cf14e6c6ebced155eb0c7b33a12754d451310adc3e5a737a31e978483004cc1a12c80c97cf316830a780b9dff407bf394b84ecbf37703849e3c37a4401d010f05be8cd5f9a011e2bfb7df829cc3efeb9479eca41e44c459329a0d2008073f156adfe0928ee8d5234cc568fc0ec128b5fbc23f445fcf8d4cfaeaacf3ea691ebfc7efc75dbf17d50f1d9eaa783c5116c086738b3434f7d71316fc96930f18f91f77ad6a2d6f30287f54b97f91f8062cbea7c4fa5ef38c970ef64aaef5a7ffdf2ffb999ae82e6f4227f69b2a3c330be24c34afc5eee54fdf8939ee4770a3b5f0f6cf07319530b1b4758d3c1ce2832300c3a2a54d9861335b12c72c3ba6105a1a1eae961fcfdae3e92390302c50ec28111549532411a505dd33b61e948e49afc8e3523e906c0bed14c7aad27aff202db4d3a415c41bedec87d37afe26915da864d812e9d1b4e5a140b1769935cdfb7223cd94d00657f9b70641759a481266b7026bb1a0fd0bbb643d0364b7b3d3535866d73db248f4bdd71f6fff2ef618b1556b92f337a4b4bbd8fa0d3c8ec1b9d01521044e1133bae69c52e44dabc3e7d4ad9503cefa382e0e7cd395dde86539c6f1d5b74315988766d3f5e7da0a45e2cce2ccb2090d8100abd35e0d40a3fc2d86258cf7d5d86cb033bf6057542768067a4ecb56e7e1b88ac0e7033adf86a59aa451ac2552b85de4e9bf88ac301733f05c99be883565d1637b522924f950aaac8cfd606b701c39192b55184a8c2366875c1e6d90e667f66d46596a0c155efa0ca09914a19d971220cad2b67d200489cdd70b59416d5442267d0a06cb2e6b8dfe7064736a40c7b1780fbc2600f659cffe8d79d620cee33c7504d6dc65023d4d8234ec04478ec25ec0e162abd0220c3c46e3901a0803be8bb5e7c45a19e7facce5593d48f04b4203983bbf5d9849742301d6e11436c2cae72d6af88f02ac1d3e50bbc489398dab9e5662d2c6062fdb187d30f607409723a817704bf742ad32f654a3e5a8c8743851e0d0391058f7eda7d686a4d544d7ad261bd818ce7df60e9f9467810f41da6315fd72a80a1a276619b4a39d7123d2ccd5bd15022edd65bfa93c068958564d2fb4c4f002512f6f9846529c6c1d5c051af467786d7d1ed5b66fa9834e6a9240bc56dbbd15d2a3ea6cdfadb2a19fd3b8df2c42e27f5833b93ce70ce0e7cf0bf6bafca369c82ccde75a119e589a7321f060979c5bf8dfc64112aabc269e8f1f83f304e17ae20a828396bb9721fdcf56861f2e5aae062a46b29cfb6c74a873ce2dc7da69a27fa7d5081e9c1a9dce056bea2cf6e9397c70d4317f322e73faaeb906c922e0e47149f4acf42f9517be203aea8aa759baafd63abdd3be6bc5a7cd34f2d01865fe8fbbe671935bb7ba1f889c0018fd0dc9ca365cd7b9a787fbb7a923661b681cb82b0d0c29b9e67431fc94de4c1291246a463dd8029cafd0a67954c4397b444c911aea08d7aba2661ec34b5153de3060a84e0f91d36bb5dc782953f32461cb3826d8b4d1364dccd9e84ea54273f93717c2b050b22a9ff773ff6ed6e29c06b406026b2b984aed2d43a6af6ff461c81e67f582ed161e92069e9bb8f5f33e3979b2f174336bf9a79a06ca842f75877a504b3ae4fe2fe18d936c2036af6cfda84ff93d64734a5b3c6ad267cde9e1127ffe4773a93ac640961d1c8f01285633ab9506956f8d772e017dbfa85a1b7dac433e27b7b0d64c31fa7654812c05bf0d395b98bc667ff836fa1a920bdfbfc0f38e96002a48a993e13e88a4e4f31fd3ee03b128bd17627fc10abb7e690fee7bfe5d38c305473da919581a9238cb361", 0xffc, 0xfffffffffffffffb) getsockopt$inet_IP_XFRM_POLICY(r19, 0x0, 0x11, &(0x7f0000000540)={{{@in6=@loopback, @in6=@ipv4={[], [], @broadcast}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@empty}, 0x0, @in6=@dev}}, &(0x7f0000000680)=0xe8) r22 = getgid() keyctl$chown(0x4, r20, r21, r22) r23 = dup(r0) ioctl$TIOCGSID(0xffffffffffffffff, 0x5429, &(0x7f0000005f00)=0x0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000005f40)={0x0, 0x0}, &(0x7f0000005f80)=0xc) pipe(&(0x7f0000000480)={0xffffffffffffffff, 0xffffffffffffffff}) write(r26, &(0x7f0000000340), 0x41395527) getsockopt$sock_cred(r26, 0x1, 0x11, &(0x7f0000005fc0)={0x0, 0x0, 0x0}, &(0x7f0000006000)=0xc) sendmsg$netlink(0xffffffffffffffff, &(0x7f0000006180)={&(0x7f0000000000)=@proc={0x10, 0x0, 0x25dfdbfd, 0x40000008}, 0xc, &(0x7f0000005d40)=[{&(0x7f0000000380)={0x22f8, 0x42, 0x4, 0x70bd2b, 0x25dfdbfc, "", [@generic="ce7a92892db2630b66b6b1a87ad1a7edbab0910d80187c7b869b9458343a6ec7c1fd97bde0f50e7def9194d295d24d936cc2e6298d5f41ce2504a322aa64f3b8061eb090d403eefc646915eea091c23820242656f0a5e68d99460c3f508be040bbcd5700737730e128cc37d777ca150aec6ccf9666dec7119ea7a1d2e95fe861fadd96da3a7277b1a23daec6c3fd1d40e6cac7404df715e5d369bc19ec591b2fa0ca23c6", @generic="2961e32b57e16e8f7055cae1707289ff5d08d96ce3d4bf2869bef779b5f7a10d4d3df9dd02963dc28223204b6062d793eb917be33ffc9e02a3cab53882839a09518aae8a8da43dd22fcf442ffdbd6e", @nested={0x5c, 0x84, [@generic="171750789742e2b0ee03f8297dec26032a53192f9877643cb774ae4fa56aca3bf57917efbe519159998c2ab5d552d0204f4966fd38555e75b5af0f4004767896d9fbe71b60fbb39ececb41c78f1edb1442a5f45875"]}, @nested={0x58, 0x2c, [@generic="2a0e748d3c473e1b8e063a8d245edf2dc2c28b256a8fd6a6feba9baa540fd4ba26ce15a5c9160ad1e6857ea4967e8d612f31c1ef38907cf6661a62d529f48cd2091b5c6f141878f4fa8b5a15a77dfbcee6a4b3"]}, @nested={0x2140, 0x8e, [@generic="dc87226e3b49d71096595e4ed96dacdecf48545623da7993718f2c6b7082863cc5e78fb0fc524a2c7d4d1ab8ba7f507857bcf515548078c31db0588cf5a04ac549952ff2998b1579df6a857e4c0a7f3fb2ece06d57375ae273006da221565692f226730580e2ae6a1da9ac8a6630d35459fd98fa9ccf81f764ec479d790b4893c82db57064621fe33bed6b8bf0b4021b07d4848a7a537127e7b967c36233ec55a6cbd2a7bc81047a6808e904ae323751e5378f8c09b7ced9b0e73b75fcec1fddc57fa28034e77f", @typed={0x8, 0x11, @ipv4=@multicast1}, @generic="75e6983b0e74092fe2984e85ab12bf06c4dd34f5e60b55baf4986115b1f8600c0256a2b1bf003adbe6f6e739c825e7182a0ef8a9967ff9c89f13f064789773ed01354de87fb26843be373b688975a983c6ced57cb74138532a88b168", @generic="3486c6e225b4e9963a74d4ea201a9b1d584b657ee25bef7592c61b65f514a6b907b9f1f794efe5c23e45a7b5c877b967e4827ba57453c07696ab64a47a77de52894a996c73294d5ca54a8d09fa888ddc803203ed593081f2918470a8da8cc3c5eb24557d7499850bfe12c90f0a1933574d1bcc5c045f2be0e3e5b0883717a9c0fb6b1e20bdbcee16578f6e786e2dcafc274dde9b116765da9c10c7cc0c6e272b7ddbd5935d34164a1155e5707e5593886abd70993609d9b6d0be017363c75107177b63a1eb55543e5cff7038b53fbf6cee484a94bd40c63bc70044d615fc8ab00d82bae49fa8511aa31daee8ab8b47ad18b7173f1ece04300dd93cc49c97bb3798bb574acbe3d2a40d7c1f1583726b6174489f3fd6203f44ace1f2cfb806be4efb6fcc2ec503adc473783f272dd29bc9274302c8072b49441018b2539497c00ebe075cf538e6e2ede1072eeae13f5e6d03869ce399f177681560cadd82524583f1d4b27bb177e1da7e8624ba6e2322f2b784b06bf653040b8a4b1c494fbc0514c5a453263f775f9983053c061b293e1cc57c4dcd8ada659aa1bebf42cdc82a62f6c31d60927554ac77161c1060d49cdc9ce13ef576982181d50109e88c852a1712e410e2c01ec3417a33f2eec90a9324aed4fd681b545d3e430a32a8899a774ff9f8ff186d6d2701b1c3ec63b3da7b2d304169394cda79a2899b052a7f4bdaa323fe4f534e93d73413a527c270ae57c1fb75f04c30d7398c98a5de34c67bd37763caeb51fed75b1a2aa2c92c98ddeed7780a6876c544fc76648668a3a0c54689cb5c90eb47b9938c0247531bdd094143d58cdcd9ad7a1e351769b8973be54592f4ca68c2988287b1dce94aeaf71d6f9dce565394d7a1ec73a199ec1acf15dc29aba87c445bdb1543503100e5c00824e9964049c779ffedf645e8a9b67df97cc7665ee8c1f7d8370be52fc8bacb5ba4ab94f9b176901367e530e8bef69d239a8700f25eb28ffca420949f101401bfdd7733de411541ecffa7272bbc290672ca8e8fccf4ba240a6bb5cdb283a0d554979e9cd793107fd348c4127890f9d2da06f80906d5c66d62248bf76f0c848012d445609397865d2849a8f314198b89c1b56f3d5f17dca28516968c09de937385e8c1c0ae5ea891c413221b6f79de28228efb5932ef071e165f9f94136e132fe8725e40e29cafb94ceaa1653e0cefb29940d9ff2cd6a8bd7f1e2bb2367e3b0aa746b9db93093fe3d7c63492cfb902f1b66b6b0d9b85189784655fece0c11aed6bde046dae71846fa51f265b0385957d8017e3f1f23582ad5cedcffd73d38af5db67804d034281b26e404c6bb00c4a0c10de967f477562ed72eee66c55a22d1abf16510cb05e540593072e6bb0e85fd107d3a21c8605808da18582ac6331d753448e900bdd9a7f958aa40d748df45168ffb78d61ba382586d47fc0da2e89f0ce6eb7a3da47fb4c5f8fe4f98d01579809aa29e62a717658a4206ac4dce502e3951de563433ac7333000c359a1beb1682eead4e2bac0c6cc16b9c5c4e607d22cb9a350be3cc36c3be198b9e93b993eee5f098c955d8f36ea429180fd478d017c9e095b3c4fef79077ff60bb7d1906a44b7de1faa84c6e407163ef2f1d75cfb51e0df8de47675124b5d93facae5548362df34f4a961fd99b83e0331216eae1e629ebec4ec6fcecce2fccc920438b50b0e703b6e5b4ab6c6da043a1f1d36b69a04687cadadedd2db4c03d9e68f7f58707142f7e9c1fa88f5b9301bd658606b96a868f6f169e3664e7f807b97cb6b551aafd1cf0cf5eef39e9157cd958a3c3c47c0ac0daa4c871230c839eebab0a89924261468f6b89539f98a4804af79989e155957e7215dc56b87b845a4c791ef980e095560ac753037f5ec3d9cb5910c245f87bcc58971ba4dd1469f5e7ed73d7600a507c09c5ac5128ad99e0523b058471ebe01334eed29f51593138c3a731260188b3e5378989c66cb1b8d958d97c0af24decaa09fdf58e26f76cb29610d60503b23746edae717657d3162bd338ede5467b24a5292358cfdac530428a496607a9ed1fbdf98c318467689621af8443bb7f015b5b6f44aef53f5aab2ca6eb2ecf0b98cbbd4e8bb4872eb73d06939d26f40735ddc20fb56706b0c655f4f42315ce50113297fd9e35c19e8fcdb6d4a953f3edf108b394f59f9317550ff981a013a498754d08aa32a93fd751e3b27d427054ac63ee52aba0269f38dff1d50321a2980fee7612b8a3de3cbec145acb2673f52170614de4f0b752cbb68b76e1aa2a1e0176c7867353eb2bf273571a1f1e5805c667cf13bf6376a1c15eea6883ffb1b1b0e027682a1a785fa04ebab37d5016591544aea823b7bbd36399fc1b51ef2e56721753c99f825a9f1faf852f91ee4715337df4c7c42d17aa83a15ec91ba66f281c43c6bcd6e8f0c5c3e8efe58526ec2461f73cdb571ce7b2924ef6806dd1c9d5a6fca8f3d4617811d45b0ce8a4bc450ee741996c49b85e315bbe4907cb341f26f3a35392d1ca5c540a244b689070b0df7b489fd2ed6c48b128fbe4c86e72834a4a4c4f4bfa959a10bf0c798a1fb551b7d54eefd17e3790fd6f4979f821b6547f75bc0836cfecb48b5eadbe1af3a99386c02966dd52956da3314a6c8ff19692c90fd0413159dadfabf05c0e580c6ce76666c122d431bfdbfd5cbbad46d5cfc6f22aec7b370977f8af9b4ba6ee18fc974fc709370f8a88dfe4e658945e7b0e3fae671e990e5498e8f3c950d699d1e2fc53b5f9d41952113ca770654fe4ad692bbe15d884b4631ef229345c3f63edcbffb646db44fa0bc312e6db56fb7b20f8384d3cec359053f0b84e7eaddc8c0d059279fa84c74893b3ba5b804a26364ab11d95490bb5074630d0c3ae8c20063b5912738ea6eda524075759015e28730d27d12b7d4c447f6ab0848f28b25dffc0b3ad3b3b5f02063f4484ed0669be44f9d2a141706109c3b9398003e9e21ae231f32695f3d3992931255c1f98c30c0d5c25057887d453e6b636f1868c2d26dad986d5d0a91f5c7b81b3d31020405ca6730da630eebb91ad785c53d8737bf6d41bfcd511b869d2a5f10ce0ec3d9a69f7213226184dae6b6399c76baad0fab25f85ef04601fc96c7eff0ceab3aa54c7b843fb01fdc97d80486c3d3d2e1bc8806e03066ef225e5ec4417dac0b3881ec5c3639e7daf966e436e148422b234950a78cb36514e91eb9559470fc31ce77ac92d7c3b5b05914e4e67cbed53d90b067ab72492c650123ed27a355eda53640c553bacaa822fb65462c48e15cc1a41f043ad99fa4b3223ba279b9b516316dd1e32cbd189885437e353d768b8555948125262003ee189820acd527c176adbc132e9e516501a193846656bf48d796643e32c9d7e0d0481c027a64052ffe81a8271f5944d5dd11f1df96b56101bc3921c9acb7c5bc4c57b7fdd8d0fe50859c222ec73178b707c4bcec19fa191a5973f9afcb55da0b4b9e642b48cbef8076b9df53d8aa4f617b9133160fbc558deb7db10b8add3242a6267bfec52b208483b9ae9c80f553ec9f899dfa11cf6bb108a5bff2f0cddbffaee45b9ce7dcef7f468090bc8f485870be5b96c2bfaeaf130038d6cbe139b10788f11ff6567a1780895c43f5aeb28215050dc2997f3369927880fb0a4704307ab60c80afa4f6e87a0fba7703c6b64a6d247881f584a7b8b549fe1c4baab40d1640283d8ff2ce78b2214d6a36f499d141ed42b94381214834cdb1868e138253f29c4a8bf26ec8a724ce77ac46c563ac44f3982cd04a710f1d78f10cce070b647fa980c7f1f00ab9b9509cafcdadec44efd0536dd88a14649650c42a43ccfa40bb2056f1e67ebd1c7eec52f03a7091282a62c41ba959b43f4e98df8ca1b18642bcbe862338edc7c792befd81b6c5f20e1cb5b51235099ca0e5b20af15e09d2a5213dbb103b1460d029bfcc8f669262e10e5133bf424311695629e3903bd287a758b6c0483d8a9f9f6dce4aee2337757971276588e80add4deb636b08cbfc9ee2e904276c115db0b105adb102e7667d3e2845af7364e6963f2aa532f3d7bb5379bf821d873b4b2928b4e70875c8de7277c2d6994d12766f8d4defc1fdd1e276e2fdb6ee76966b347735da04025be1de4cfc1597afd22ea7aa03e66296b081af03410825c3cf59f436254ee6d2fffac4140d04fd0f0d3f66863f1ee52dd4f3ddf032f878840aadb1d5eb341ce748e22e6f425cb3db684d3e05e415509123044881f8727ed6961d6ee42dc041069c0b065c1fceb055c9fe5ec973dbe0c72e7e8bae5a647da2eb0607fd3671d429b88f7289acf5eaa73a253d8b39adb97c4abc6c7e2cacc56ef80e22a1d01ff94778e621e922e9f9d657e9e01d8aeb7f4668f079c82f9793544e032b61c1a5020789b1507b827292118de0b971b9bb5db3f3a5426ced0ca13c6b41c60575bb35ef832013c4280b18d036e9ea3c38edcdc466f28f89f0b3e69f939c8df006aa23b7ac84648bf80b8977f5d9d4d6ffb6d51e495012490308a64754c90721b9be6d766d66cc0c37b99a2b587702a970236b227da3f7da5435327cf1dba828b78c892c226ec51fdd75b1bc052bf5e6a3acca9b0adb3610fb8cd8b63a20f452c46bc1a76696a09d8580af5f11072c7c6d1edd1f0d976f7605a096b255c4a8082a107bbe651ac36b8eadc2463d0f6a9e4dfaac27f6b2d02dba03f7d125f731bc679c9de3ecebd496e0f0b87ec8bc3d614abf9caaf8ff28dea7a91d32b42fb172dc786d360c5b0e867dd4a9d85deaa41113dca650015c6681b93d92cd35fec0d331863ab456669640ce20bbe38f8cab2c3f695b71c20ac76c7ae853566ac679580a73cbe10bdc7bf0a1563cce9a70da795371a2ffa43b675d801f779ac5a68ada74a0b9bc84c69e3a9eb27c1b2dfb0831d6fcb23531b0e07b9e4540d566719fb79078a92400e01bcaa0fd7254f36158e608798a5b0e9951c2c6cbec482749932bc0b7af267cd9283236833caad4e1daf84936f2722905a9f195bb547ea9153d41cb43f1cd19c1bb6c8af2afa3e1cc4ae7271f3e40a2430af663f721dcf3eee555d26ae1f51a1512228a6def502e53fd25c1b83dc0e8256dcd196fc75e8c27906b318bb628a60f4b48ad67fed72112e9355ecd3f8ba4980958eaeb8794de65d7da82f7f65edf83e61377a3e4ccf27379fa70eaf27570c2d4b2fd938fb3f1a22e8b4c38a0c467f3e3fa5674cebb305ae3f43379ba34e175949b9844ba8ac1c5d2ac1e55893cb104b6e9d02230f58b8f284485d264bd61c7337b473ffee75cf4007dfd0cec456545750886a72577bf50bdc8a56e4d0026907a1c7e878d05e171515f903c2126df632549ce4033d221fc1082e295d5f8869f222b3aecda9173ec0394b6a6bd5fe8f511e1ab2fd6ace5abcebd7526766f71019c0f91cd7f917f89e4f263a03b50bf7752e86c15b336f8e9d598f2ad05ecc050360daf5314298122a6c181935f946798b2e35db8bee855a8a3fd8a0eaac3c0158540e9441a549bc91b1345ca7ba49667f39806bd31b4a4490425d53f2ffd01afb190276f850ac4342fe1971edeef614559c5b3b60258703f13694ae8d3a9b380c28b9363a782dae1ddc07c90afb69feffc1270421d186565d6f678b4a59a991786602762ef76e44c5259dac086bb13f81801abf3237e7408203fe7488ebe402cb1ffe0ea0d904e28a8b83c714f58dc92912b72ab462786cbeaa4d1432bd56246c0b56935eb0988bcd685339c425abf14d9b0ddb6f7f88c7c1dda8168e", @generic="970b026fbf54d2e85636f261", @typed={0x4, 0x17}, @generic="dfb49fa013a29a4586dea809c159640a1d382c5f8827c90ec0df90b5c1af008840588aa118a589eb227580d92fa7f417bcbb4957b82004388e80c10e6a03222841b2de7a16e679f388a25a3899ed690c7244a1223c23c0e06bfb35eb159f1a9c4efb704cf1263257b049e70009a44f5011179a90ec97ff3923ac895c4172c9dac2c545ea948e70df7e6fb7e4d4069fe6f13851e8f3afe140c3fe1ea6e46d344dd45f77df8ab05952bb7152092937c68980ce6a234270864afa53deb322cdc31f6b620ce712e29602d3607fd596808fa5a7fdcea192090d7aa3b7688b0f16c67a859a411e29010f0dc9e44fc8cea1ae76dbe413495d207575c63a4addc5e18cd731e7117c9a94ac49a1a03d454281029ad14daad2f5af879e83a8fe6912ef82c269a5a11e813bd596b8d71d50ef0d196b5e3fe8dcbf33588756f0d03cc406fa5c7db4cc6318b13cdb32a5795f5e913e26de4ca954a89ca8d527f730f7912918396a3f49a4831719f222030d60572eb850969474fc7b2701bd4636a47240e24539fd4d19f2e5fa2b40df6d691b0d76ce71940c2cc52315f943fac8b34727325991e6c2534d02f526d9906f4161a4fddf213bca74cd7be6ecba7842744340bde553c41c07764cfca7c1c32702fb902997ce1bd4610ca93ae7b8d35ab7dc45fd0bdafe518f460895803c7112fb2eb0acc2cee537d9c39e43c14244b024d2cccd153762bfe7de695b2e154fcb1dd46949a8a0ccbfb03a8e52bf61ac190cfbef90953558277217dd4c43e64e1c33ccd2652947e71597eeb98f164416409edf2e9724a72a4f4c7fe7c1a218db28d92773b768df04f2ad9927e9827e0262d2015e35501dda7dedbdf743e22eb3cf01f251f6333571969ed2cc4c26d9d2b2b9cf0f57b6f9a820358da205122433c70fd31935f902f546a5d113e933bac1a07bd41e309e1023738642ab9d0981e555014d35903eccd587e49070c2d591d4c65b5701be992d1cac1665f3ae3e9c035f437ee8900df66b5fadf30e4b36cb6d4c84446d5903599360bff69a191966288b3e8ce3e4e4fd13503983f6e9d5433a90b8df9ce4f9972e5d166474f8967db396ba4d0993579606cce3294eefa628692d7e3fa22c681303d9a6c31d255592c12befa27b7f353d3226c90420ebc6e79db7a743e298dfaee12934c1f0c99ce02966096d81dc0eff8b3d98a9a05d37695225069e08ff8e9ac6156f472dd432241e3fa7158260d0226b8550e36d7fe165d7b23913e1d4b89ddb12b4200da1e3deb1f003a8dc29c3143991fdf5c0fa8c68140404d4da149177b6c1aabd8350c565603affd9655d567d5ccdc82fdf53723079164c92774ec9a90c1f2c67a88ab5f895e126b385b90e2fc291a9928cf56c84d3a7d284602dca0b43845292ee398c1538d66792bb3cca9866c025e20b945d142edbd265bf3d75cac0679d3b781cc366b37cf15cdc7b053561a32a924a60b20ec028dafb0beee71bb30d432f25f5b169506c290f693afa83e864e550fd04de29ec7908349f8759348ec26dd19aa02737f999e657f0a567c5e5bbecd204b10be1904d39d63b961370bf721b0105ce73863470fa6fe7b0a05b597750fd9aec35de3d2a3b97a617952849dd9c2d2fb16530810b7e0b780a1b9fb272016eb024e6fa1f50d0314000d0ee648511e5b762126891ee2b778b43f3956a635ad1a705cec7c8333b5d0fb67b30fa4a8bbf73c18226ff7a089e89ab833a40abf1f8b4cf6487ab4fb0360a3cb3b750f81e4b979f199f4be27becba5a30bf51e956657c21f44db5b4aa86c2594cee0cec02d08014154369302908f5fe094b51a5f70efe4eae972c0ed3f21b76a922e178081e4088fcb66e03a7c28b19e5527a6001517b5bc01eb6d5b197686d948ee4a75b8069176b06b42a06eb1883856d84c84563bb70e462c7b178823cea3c9622fc1f60cb9b2ebf774b9b4269922d193ca29c6af1acf7ddb4b3b09d9b50c4a434003a6d23ef7ef70a2ccdb716db55c84e13e2bc18f59803e8284f61a458b9fcc9e633f1384c040f6129bd510e4fff5c2bfd2eb142eecb658e978c337719ddbaabd9ab88a6d929ed077048bebedfd8e6b54b2df83e55275ad8398dea7241485e4df5ccff9a98ae1577aef88d5fce51ed484eeddf4623072ea44fb656004bd2e680fba7d9b541875487b48e10e319d6a9bcd41ce124f2458e59b6c2a156bea7166a7d0da098b347447953c158ac2aa66bb48b0a9514ad0dcf5e408808f0552428d7ccf2ef8b0771f9f51d676cd33305fa4e098a6614c72b99e28790c5288e4e45d42204be807ed697deb90e55fe421f9e394c8f6ac17eaaeee85246a73150ade0277fd2c15fa2154849dec219d796d3ac091a50387201186a7112616c3f7010e48abbe57c5d402d919cce803f060b1d9eb8b6b938a3432d955d9afff8e821bfbecf47fe3480b67500d6880674e418753631fbd74574dbb867174307eed6530721c452785da9a486a866574405f48de1fbd14e647c248093cd6647e0388d2fbcb5725a33a441598c991ccfc74299f4e13c49dbcd4edf84095087c3129dc65e4ad1f447948fa3a718440962544c4cdaf9e8c25c76c16ffd3bf2942a89cc9560e2f764d2d7a1352e4d59b2da2c4263201576122e326f117f5526ada0a32ac6202112e750da0a7b2a0a95c90c8f85c332da9feacc30030c2f1602a5b2ab2acba7640116426bd0f3bd3518f28f14d2c016a3284128d14e1d20c1cc1dfa752a866b24b853649aba4fdd08cc9577fd7af0c4dd94acd01fa0ec42a2f4421451bd2943a23f9bd81685d4d103a5e1f9dd698b153bfc616bb1f0e078932ab38625a2c4a8bca9366c69fa35f3d3c294e5fa1eca2b1b5635a60e915241a76ed1b5b8e95ead8aaae105409cc82990f4f72398ee878c8ce8b2a10b76930dbe1a30a9033e5c76ae8d16f4637327097110c0d081d07d9e45001c223fd2e4ca02f17d964cc68d953946dd8e5b105a1d13b2a18cb7e89ae64d2b4552b21dc53c5df1a969302d8e35079572b907e8b099d3dcdb3bb086449ccadde60332fffcc0b9644b8cade6446b48451df76cc9b754749056670b58547213198c21d87f7d018d93597b970527e53f7bf534185c568f19b6e98567495d8c6673c1ddcbaf817b77eb54253d26093e0ab2b7b18ea01fc3d981ad516950ff48e1db8c2a43d8037ec0ebf727a00eba38f6627c332d1192f6c0dd0875a0fd399855c5c387a5dcfc4d5e44d4f5513a8eda0fa6121a236cd17fd2443d52f4bff47b4c42619b3de3e0f6beee8ff71c8010474b5b2fb1d58b2c080d95a2371de856d1addf88ed3ad84fe0708954c7bf572485c00952957fe8776b726848c29c41546f900a94410a8091eeeb79fa82c54518579bc08579f6f37651d57ac170abca21707250713f07e66dbaea5aa0eed976e58e6ebe247a93d5a61505c2c7a0d8fac03d540ba193b9dcc7f24609bbdf33a0b8376978ec63c20daeca5b406d86befb263d5b51a927a32adcabb5c6568daf2d697f9f4dc39be747d98b1041f7e3ab0158e3def57ee8b49bd036c57f34597b35f7644af81ef7fb36963897b37a0cfa61255d61378a4d824b3154c2ded87da027695d50a92a5e41f4ba041af3bbd27042fe6c6fbc7631bb10ae747415598f0f1e0297bae81a782011b5e39ca0e86c60a7964b44adc6e1a1b503c032c01bc8dae291137be44cf2e76fcb22a2056e4ee5898240dcf5b06127d22a1fd9441d01abfaefde1a720fd5ded3a922e2e39c92704dd1a5404e6190ef8a01356b0623c4af0841cffd8845d5b32fefdfcaaa2a21bf57152a8e8be1644d789fa80683591367668ff9843199fda314fadaa5e89672c8ce860562afca9e81884a0bbb04aa9eb34d302dd3cd0ab11053c4af8891020714f3ca345c8550f69be40793f05ccea4caf06da129fcedeab16cef44c61ce73fb1d0a70b7dd719f677783823ccf02f1212214664d9566ca3aad8da4b0aab633fc6feb4cfd01186f50ec27032ef6e19f9f87981091e266d04d2dad388f62167c3df0e67e47347135e50238f75ce94c8887b1ae08cadc0e1f4f234abc49d3a36bcc5137ae6d93f6bf1cfe3bc2a6777fbc089746492e6ee10d3cdf851fd63179612c0a0753b217b0d4db8beca681072dab91381951d0070ff371c1c930fca0e3d41ad06d9eeaf86757fad030f60681f72e979e3dcd534e021604dc4e312114f46f555bcd51f041973a37d3502e6539f6a5bb7e12622c5e728c192f8d920857d755668d4bda37e440d11977d0dae0a287fdc7ef98239f38100e4cb41f90d56b7fda69e8a2ec1acca8fa7c6795e354d81fb1adf69071183693adc04254393643976ed0e385fa1b6827e0fcd86838f116138136c307d531c94ad6e3ce84e8173e652c5fa515d5ffe9c0e229fa21099082a7be3f8d773b1dd913f0e94e65c262949a0c2e9a07841c4380e633f24886ea275b8d6e42e71ca8f039dace689e8d71e234a6b0288e0d44e5d20cbe47c6dc613bca6a630c33730243cf32e5f6da16608f8de3b60aaccd9cac751a1ed20dcc5cfe6d617233e1954d3fb785def7925b265d76d5873fc23b8cbe442483277e4bd562e51f2f0449bef9214ee52772657e5c9f032dba9898666712778184b932d4526a841245ea9a4ba2bc319c041875cd859354a3e33932411c4d4e54e5c6bea0091afcb650d2e84b2f345c833bbc053031ee3f4c4e9666e6ac04e07bc644e31ff970ed82a3a3e66326ec0338e6391360b2114694c073764dad96d8a4853447b3ede418b1db567f2865bec87c08e8fe7d7b5ef6a2cb3a0e2f088f688b687cd0a2817585cb2e43004519731dcb93b196f931906b57ed598fe41dc16f8ac6f56bbd846371c43e48391fffabc62f2a6b70563e87a8086b597a8ab77379a4352efe370fad081595541367a99abbb44d698e47a0006a39c2b9d24f2933eec4841aca38d2a6098f7cdd78e0aa7dbb71041847547d4ed4012926680bc6ba061a610418f6857a4a9465c3ea787d6715e9534dea2f85364e9ef2a37985340a143c7c350e8c5f8cb1ec322106958f2e6343213407dfb50d7a42021e34e88cb66e94669bea7a6a3883faca60f893452e80f99b43e6eb67c0d6441fff7e1e4767bd2cb0c71404134a1f0e7468970575bda51568a4c52d1f5dbe82aa7e4289f51eb934e39edc53559b1094995bbb1665ac3d38cdcca606e628e456aeb43d1bbd41640a940bea981f5521922ae52ec1ad68a853594bdd72fbe99fd169441e3909c09df0295b6500d8e635e785d2848853cb7462f29ae160cb99b926bface82fbb3a80ffb685f0686f0b8dd87cb9c68b4f531ebd3d22983c1b074cc9a7faeacdd67c7a79b8cae4b88047b9371d6ca96a4f95ecec014b2a7976036df0af02917724f28124bb511a472df297c0d2d448c6b4fb9fe3240e9034d9d652492bf46c9353c342e67aaf7fdd42aa1c99565bcd2e09cbab9606dc0a37097d664e8362c75fa5ccb005b2de183945fbe32c3eba3b10da8903c1453694a99767ee0247b6a9a342b4128aec1754de380c140f6582c961be5191f4f0f8df1e3194e75f3b0042672b4617f37da0dc9f87d3ab880a95275407b08a4a33b76caca955f9f2059132cc68761d3d87a10fbb5714ab6b37e87c73f7c23ca6d917c8e06fdf88f12194019d17cc46dcdfc34d72d64164e769bfe1f1a2c8f614a14d7f2208ca537b220c9de45caeedd5a298d01caf9ccb8b01e10ada69ac9ba4d5391123303840249087e750edc93a220aff723a267e290354c27a3b11e0b"]}]}, 0x22f8}, {&(0x7f0000002680)={0x134c, 0x32, 0x0, 0x70bd2d, 0x25dfdbfd, "", [@generic="ec1f3ed2c26bb35cfbe6793e80fe60c9a1fc28fb14411cc027deb44c6bba603539cfdad6f949ad5dfa83f7f2aeec57ff643b2f426595410234e5c38c1a60733cee3f719dba25e262d9a6b46282ce60880db634946c58fa1c023939785bc4fb337549c44505e27cb8778b37ecbc4ed3b1", @nested={0xb4, 0x9, [@generic="d9b85d24cce2f19159755e97a627182b1071045b56b2e7b7074225cecba773944f514a975ca239bbaa8039ba6db9f3306d39a108bd58e873a6c7e6040ce3b4d04f24721701bdc063f6e34df201a049b079cb5004a49fa19661fd5f715104b2c522c3cccfc503dd3dfa4d8a03ce2357592d06d447eb207b5e5509914313062c51950fd36962a626a27ad0dc9f162bb738b890d01e37a8434d56dc8927918b729d", @typed={0xc, 0x4d, @u64}, @generic="747d06"]}, @typed={0x14, 0x74, @ipv6=@rand_addr="47abad1e97e96789cca889270148fe1a"}, @generic="c81e33eb149b3e84bb471eac87511c3b2fce48b126cb6bd0413149783395435c1f2815f9de230337a5675b2998e07cf862271b5e152e7c4baac25045fd96c9c9877ad272af63b2d24f", @typed={0x40, 0x39, @binary="cb362dfaf329f43d5cd513872c5861552074742a298c2fad35fbd5107418d387ee4812c720f931d26b16a3279e8213b72e0b19a961d4ba411d"}, @nested={0x1178, 0x0, [@generic="17a08b22817733efbf00a6f368f38b71e98923e950e6ba771aac3a0cad209508295b2159d01b2ff039616b2c9ff35a2befec4dbdc581f305e462316babc84f9fe4089ca067063f6f6e6c9febfb6cc22998348def6e0ee166ebafd183ba3bc71c012cd8a69983acedfd7c5f953802057b9250986e", @generic="b9b43d72be", @generic="e0b62d97ea074f7d05d1cb71ac3b0d8891680ffdc49f4fa49159f8efd0d76cb095a0ea531b47ccd3f8c7634aa07ac3be4edea814d218f73d0575b9430f6a89943429753e9045db93d26c37c6e1a624304afc2c636d9820d047fd751ca75a02f02ca2b5c31b6a84cf8625f0d0d1f3748ff871e964ba7344ce004c6a6405498880774008fbd36c2dde7f42b37f7a62a3dd4b42e248feb7d1c87d871ca3e0af1274c52b56431719bd1f5c80d705237f54e87b0c363fd629203fa1083a1e2c8f96d6a71ef08d966e3f4d430a8802d3010dc5af11350c4f658ac90c3f346f7c29f6ba4d2d6757e4499c14b6aed6d04de2104559", @generic="04f82f937f575f228637b3d2e11ba87c50a7e484d6d8ece5b50b2ce37b0848b90a87570ef2821a5ffbde2f59957ba76001391d56bad7373aa9d04cc28b3626da9ac6f5eb6be12fed174904ebc096ddc3149362bf5b3961cedf4dee44dc53d5fc8fad810a621b1e5e924c776562937460f8b0f440f95cf7533fab92a85788cc4da39862e7f7a18405fe4d3e1e5249b7e7fb833ccb48d3be1ac7b71bd84f016eca0806b68c5f118eed4ab0909dd0753620a4d4ca59f4d6e971c354233d9d525a047913eece9474535ff36b921b08753e08aaeccc47de241bf24d38a940377cd932aa03e926aa109d339f6d2881dd509c588ec69979890ce628d870b567a3d75050a7cb04132f62e9e37e6d77186fb4816e0320271fcce1c38cc17992dfc1ce686642d29aea69390a57917d5bccc783a5e82010c7c77d5e21065b67a159f1c90896ce101a834169a9bbf5e49869c4b70fcd731e73e3e8e841c526194e807d102f4cef08981b7499ab1fa4e63fcffa0aebbf04df2a87dc2d8dca999fd408ce719039ff48548699f14cc72aac5c274842dbe8956f6b5baf5aec257fc10c8cfdfa5d8900f2c142410217ce84514c5001c440fe10e39a89f996d86f936ee1da9afcd8a3b9c5a5125669f290ccc64550e05315766efee275f38444245268fa8b8df1daf87cefbacd944988203bd5b821814078ad9ed8e269685d8f1896424a73c3bf989b0f5f8f1701a6afc6d7eae47b92fa1a676965ea609406680c62d255f325a5f358972360c82707ffef1b584f3afeb25bffd4811fddf4f13bdd599f430bddfd90f44eaadad306b2ce9e305122ee865921ede06b25d032183af69d052af1c9d9ea14c5a3b2f33b480ac7fcd9ec2f9b258c80f3d38d6ef4607e612bd1c9bad743c3f6465bed1d09f78c89a9c9f86a8375d192721d9e0e5ed12bf598776fe75e6f1c76af8b5bd73dde47036e84adcc23dabe711d62b11d7ba2d0f71b729529a4d6c0d0ab91eefca517f46abc0ad4436d0e5dd054ad059e6e4ebc323b5f6e9cd8ada0b90ed1e5d9177789437291874cd444d9d57cb9ba03a1536350d857ae0723ef0a80b35564417bf64adac927e01ae8fae03c6fdab984edea17731afb2882cdedff937b58337fd5e7665c78f4ed5e6964ae9e44646b3eec43fa4d27c49887b7d7e50603bda7c9ee9224da4a8120205c79551ebbe72463e0ecdaa60ee5b9c5c5d7a9c9b8e47e54331bfbb864151e99a54b47ed34ecc27fd4fed4cc418fb9aefd048bce528ebef6a8feb810de879d913d7c2be4060e226b7c2bfde7f14b22ea338c0ca0a28ca0e078078d20da30e0339e6d3d9095226e44bf7ea46d1cbc042add5326ad7ab67e25b627c275dd5b4290349095c4b0d618ca2933e28e099013a2b5fe485d19a9349f90bb15e7de9787b6dfb49536297a2c9534039d09057f1e844732ced9c73dfbfb05b921e7a225a7afcc63ee1b644ddf5ed85366de49aa027a17c19d990214ec10eedf7be4395f4b09d5e3636e915dce26031a0cb9c473807b4f435c2a8dff31008775643522e0e519c72f8483dee5270f277eaabb1d95f5e4e0f414657e4afe260990b2b291f3604bc0e03f132ea344135b9b285e8bb909443f99a3df1094b5ea87d4eef02491cab76059046050726cb3e7e3dc12af22927b8fce717a8fe0e1281d4bc92e39133aa9435579ec0bc75dd3f8b2fe2b260421aa0c888102334715a98cca46a04708eca0506ad31a81072572863588ed46a7161ad3f786dc1f9ef422c2b6bc8c5701fa96178790ba7ab8b79271bbb0ad5e4d7ee526fc2a44c184526a747c060b8db24c425f05a4ec3b785b779ed5b03d5a374f4c868c349aad524a8576cdbd22e91dee70897492f14607b35b5eaa12b643a8fc23b6769c72407737e59e8d5d7f4a4bc054c02918d9e34802d353ebc63c8cd1e80809d2b038d94327a206725873e2feb0dedec031843f37cfeb102103cdadba752e39c074ba6b61221afac1f7a052781872a8ed37e8437cd2a22d812116b5bd18818e4660071df73c5a450cbe2694d043eef4e5ec2c61b343c115f8f2d813f2d90080ec1f32d08a1b90eef36b6241459ec7f65476b5eff6c7eaa76196873000b6eaa4dc3926a83ffecd713f456674e4385497ffdc8dea4209714dc09eadd77aec2e22242733471b98309afedc8ade3f811d53638cc0672fc812e818ea23c892dc299586b31fa2b99e119e604a8e999dc783dc1b51e471c61d73b8585bc6b3fcbfa46ed1d2ab9a7aa743167392f04ecb5fdcd74bacc5ed6d0c6ce83b9662fe69d007878f02df17df44088c75d368623480b46cf8ee1486b8a100f56d51a11ee479c79f7c5933992b47bdcb8c053d2df8c34a119d2f06183a882634077abc14d3f468b60518c4e8757c5a1792b644f79bd7e0b113c93eed440763d8efc8dcbc89b423e3094a6b7760da4d51c8aa83cb743e99e0c0004dd6159d762c1752f61c4a89dd609a33864aa5e04ebe9651bb18fab71743a83c899814f3e6b04d51f589075fc82208796b6dcc6b27bc17eed7c011232f849c1033faa4ee91e3982a028effe98ea6d566bf077cd955dc2fb9312bb4322c9368a03426c72c2547264e9135afb79b7b62f8708265e8e02974e5b2c8ad93d72bff8c4c63520d18ffc621f03ecdb185d801906e4a3fd780e8ef4724154aab2f0d2c7b3d587257e2dd3db32ea0b1800641a1929b67d03d18cdb28f3abf0d54033c326da03b4d87a568de4349e52a1b7ac0ae0f6f7d4f1f27b39287c507d427b491cedefc0deb48d045decf4315e0a4e1b3614ca38215e70ed53162aada6c6892e4148d89a2464cea6e5595573e40a3775a547a6caff82f983823b8a46f35bd32cb988276031d470ed0e0ac0779317c465da3b05a80d46f38f36f74e5c5ccf654ad0e35db1fb18e8020aeef01ca9911a41ca3cfe1bd1635dd854ffb6b482dc7e0e21c8b56b6cf6781b773b6e932e29fd709cc8e497425949d648d8dc2756e034f9b57efe3b38cd735a0c822bc2db4dcb6fb5333d368fc83a717dc50ff2fc0eb04e865c2f79d1352c099d21210b7f17440b5c04b1df7f783f54328cc4ccb68355c22928604618544f670287942377fb1c3d40edd081be2919d19face91154406f2c66d73fddc8abb086349f5862fd8dcaf4493aef5db51f3d54519473177959410d9a175d25c2415dc7b26d2808f5433080f3e4826b5ea0417777492c24f018bb414895b93a6371e649fb3e0cc77639d7337e35d6aec7f775fa08624a4a250122d5a27e29d9e88374727bb4b306f7af0d95df77aad3bf9ffe048ca32ba760833f2651cf0a5f65a8d61f5d74518b6d10a287a16a3d5fb961d2617092fcfe4e9fae27f4555265d670b45ebb68217cad536255815c25db01eb4934c8e9fe2ce51e460520c862d78568d674041dedfff194e91da4e25ca7477682eef52033ec5e91e08a956f571e5241ccb1c91b901fc8303b0bf1b03096949656e6b55db42f0ca57dcc3615b415b28fa90643aea0d5fc6cadff456dbbe3db30ba4f8aa6e0ad1da07e9dbbfd107673233d113f947e7e3f89cd6b26c3cdda39a3ce28f0a61928de457703a7cde83743d8f6cf5babe78ed6b7c4c6224f9d8e3c65ed2f62779e8a09f182e4215df6a55354fbd3e6fca39844632c68ea6cb64b285960d788a66269dd70cd4eeeb811cf488e46d36de2270fb197f8e47e088a09e26f2c685ad7cb54d7304d6c0fd8da6f243a5ed06c410a80160305886309fd6fbcc9ffeb45f9c47e3c029e4348df1e20f3e9fd4423c906a7ce0f6010321ed4344ad3412b63bac270cc6f931ad65a5db99dbf820a2a63b362164c028d4379f699779c18158aa542f70ffd29f07afffb695407f05368d1208f7cc805230f634c33eded0116cb5391acd4acbb244b64e79d18f73a4760aba25fc451bbdaa26ddc9feeb2877f9df45134f1855bf6838709e62e790ac0a094d98113fa82c7f1885fa6505dba966c44bd3bdf35e42b9d621d5639fcec11cecada8c07d4f5cc1f00bbbbb490b95d685a142cf19570b6704792788c76211344b0af57ad0e01b1236123706f89f5be1c8a1727287ce9417a2732ed7bd8a92796579f419eae73bba1d6879266aa346742b68b2f9138d8b8069cd3e5e3214c7baff900cc1d49a86dcae3b2cdb0e1fe89f74f70672b0d35b1df4c6e39ed10e29e9fb5463f817ee7347513ba072b7020f29d17520201b46406d2a5efdd0a2bead38dac11e04a7252ab4ca0dafd54ad4cc94d570e159db2dd35fb624ac1acb4610534b9439331cdba5016980c2f03abe63f67a497f0f1b4dc4149f98c2ed1bb64508b3e1429653c815da6b41dae7c856fb02e54b3d62681c6b8dda5ae02260953fe351d2ab9987d2539995945e896e43c76c8af67e83c8662a1c93f872eeef1a1e8f1d6d843a6cef0978a4e11dc2c4aaf21c95dd98d9d1411a98f1ba867496649515a0418eddeed331b8107b56f5368f81b9f24d1a93321929519a87beae7527e1b63f65ecf92bd91c324bcd80c4f5408c5120252de3cea989725ecb2fb5c07b55c6c2e4f320f23e1a3ba6946409919793d665b1a2d6fdedaf70d4f72de417a508d33a7976805073cd700d0159c970a1730cd422a5df2e8b59b8a5ac1cee741e16082440ecc14fdc31f44cf9685a4edefc4b0073a1ff2d4d890ba7441a9ee85a600932b06ae3cf4322fcb3082f3baf9d0ef05ce3514169f3cfc4d922d71b67ce8c8815ee420ae3bb4c62c29e98bff27202f51d6ba0f5643a170ae70e65edfd12b9d127b0f3c49f861050f95cf65e176614fed530bd9d902b5742e84244055271b4fb6a2defd781fdc0321eeb208b5040ca5a6173fe823c318d07d9e6def6c3f8ab6d679b0d97e38edb1a5c554307b90bfe675781350550374120ac735648270774d85c159ffec3eabcc08495d227541b5d1e6834567aee8656bdafd56c21942311f9505aca8cbe38a8ccd84d1d98875e1a333bed728a0edcf4363d4c608cdd375b729de0e47a7ab56708f3d2882a0d5cbd8b002bb29c94abfa25bb30983a6878c8f8a0636bb8eea195da4647b7d1a1f784327e52d0852a10b04d5bb0d9d2fa5cd5e9b27ae8f86693a79ad288f721ef336262f9f6481e37b61a02866fb8640502c64e89569fbcd10a3c818aaaff9fab6009341aa7bf0e11649aafe9bb4a12155c6fc8df17c71165a506c383c22a0d5b4e749a46a79057f4ed8a9b8dff0e81218f231b2d0c0c85558fca229b376f4d398b643664e51fd5fe0dab6e12cf433221d89a1cd4dcbca1f45aafe502c9351af2192409b6f5ef713fde83ad7a0a0a698cea31fd5ff612454e203f663806caa3b116dd04466beefca6e789425496fc93bf6814599828e69e642a0e4004be1155cc6a897b98cac4b3230327c5d3238748a663237f6ff34ba5dbafe7a1ba203a29d1fc4f2ea9423a69a69d1269d2742bce77a9cbbeabf5d321f9f880be4eb47a49746d69aa0c585a1684c04c4d46ee776b3f063c87a2e5b797fb68ab67fcefc90742024ec6c12b56cd0a5b15e3c5a549e7fa0c693be5848b8f5134604eb819f7f9af244dcbac31583004356adfe65ade91dbe7d6898889b17313404f4c3925bf01f324844187cd0271bf6c99b23101256c60f35c8ce657a9be5b0f5ea4cb092d5b9936d66f4d91794ccd4c9c972846cf878ca7148e37a5cc716e0011a1999b955aa9574592705d794e76db27184d17fc8e9b5c84449f5403d18b8102e698979eb59fbdcf6bdbcd2d37d5a54bbab35a06385d4043e59138c8889edfc3ab5ba54b", @generic="818bb4c6", @typed={0x4, 0xb}]}]}, 0x134c}, {&(0x7f0000003a00)={0x11c4, 0x2a, 0x100, 0x70bd2d, 0x25dfdbff, "", [@typed={0xd4, 0x2a, @binary="1985c8fd913cb255824c43f68d6697942931800bfaef2a2de3456e9f365b2b7d77eadf7e3ee88eb60ab69f0281bcfe91ebf156850dff469429bfc4accf3c68de7ccec43e49cf7fd1a7e82a2d42d6bbf28ac404b9720e98278ad47bfced245d30a1d1cc69277733a566bb22f6be475f151b42b708ffb58614a3dff1d310205a52532ad500425b35c8fdc15ff89b9ea1a71cb7eacc73729f7de3cede40fec350bc643619ff92e829bf2a01de36ef15b5dccac08d3ad9a348976f2291848b4d84e975f951814af9da80a90867228d3eb5"}, @generic="c79402e182c70bbb5b6b97a59d41caf3e429e73c0b767075e02b91be82b383cc1b41ea762f91bde40c0b2e337c1b040dc30a4b78d150a4f5d7f2b19c63a717bfe8eb7d012ffefa5dfb2a974887d1bdfb2ecf39a43164968ae3800908d0574bee94ab3deadd61d704ae1fc0d07079db5f5ebf2f1957a0abae7f10f9162be04abcd400c5ecb53768a351d5943fc584facdc753803439eef4942f90dfb3c9a7189cdd36a50dfcbe35b7ef83447761560fcb6704d3abe6df44a7145bb3f67a39e32f12ac89cae4e73c1001ae45d5c460a90fdb6f0efa3fa2ee", @generic="f32fc57629c429768c7840d37d86103ddbbb1ee23763f664a92735c1e33c6e2d1cb393537101a0660f829ea7f2170878c426d94bc0b72e0c27723efb1582978284e5bc9acf6550686e87900e47fcf6e31129552069238aebacc5445dc8928a57c6e18d8354624e06f0dcb199d842d59b9e0d41ae847bc46a7632c89d39268e68c10d6fca9f0ade236fc218005c38d94d6bc0f9dc0a787f72b2e8095e43d5f2ddddcb7fb1d15c2f3fc6ba0a2975779a48501ae5446512b9663c78413883ab99df3c2cd3eeb67ad8c142aa621d34623465ec0a304091f71b1c1e33c30774d4b9713f43084c48655074041a3f109f0954e4981cd4f707a86e5c7c099c8cd0663e438501c84e25adc94d7ea621c976699f299c50606647f62d51eebf1ea68ea07ccf853ad03a25ee6bf519303bd8a0d5107e4d7706e77d4702e2c1454a9c685110a41765cef502ab84a17ec7f021caf4c29546d5a120d0e965e2519746ba0f2632e6f8c7051fe0f75d648ff45db37f5a1716a54aca027ca5e398ffcb5d5aa2406462d9547350864b0fc64bf8f9d4589492260d5e4e39bd8434c55f7a3889763d646b0bee737da925b96ae8e27ac64250e120105ae784bf95677ab7970aae1f4c694be4b3c2fc044efd37686c773c967fd63027c3fd91e9e54a1266730ef9a817e33d6ebd617c2e26a25806fb959b0b23f47941b0bce4aca6247f8e5bbbebbf1e194efbc3fc1eb3dca834483240042f213bd3834a86c21bec014982b894165ea5fa7edd65f77803252cd35eea7d545e7d24c046e691df058cf33fa000108080b531c475c8b0e91790f38cada62d86ad69005679dbc57805de1a929cbd6adec4066bb6c50b4bcbe5fa5ff15b926bc44120630ea117aa3c83d75b078bc4b640f0ee8833ca389d3b041d0bf31a9e725072aab82889b3a03308b557373989f40f56ef17160bcaf81e9f0eeda24cf08880856c207694610edda03310662f2c404358cda7a7019ede3be60d9b57576931e3f0f5e8075926614678c8b874693009b16224e7973e978d9c9bc808b9d47e746b3182654ffe679a6bf5ae9855410f59d970fd00d245c0628e40dbe5ea3a9885306259676968e10862316c42e5ad8a6bc4b0c90177ff56393d3df4ae43f4e4d5c979930be7890ea6896f1e414a0722f1f22817ef63044f32d9445501f75ae011af89d49ac9e14ac0b79286ec70954932fdedecad85574229ea26ce2c9839be87e048632f0706257293c1134b4db07a39f964bdefe8487152d02befcc7537c69d5715016dd6abd0201b820600cd38653bdba1834fcf8e58a8a3de8d56d5ff29abbe0319855debadeac90704f03f3a93ab98a6b852193d9a81efd4fd979f5b8ce0c09e6fe34cf2cca15be1c9a59b22b5c4d3235558c25ccc76e892878f036d62056246f54bf4f68dd14b21d08d68340d07eba996ed703d72e44391af188038bcd59c29521d112c2c442123a8569d814447a47dcca54b1d2ade0cb02fa4aa5224c6014387fa283afde82322870614b702dd7ee05cd079a4eb8ad5af127648469cbdfd151d913013c033df8069d5905315ccd0cea322958dde6873933bba35a3d64e621f28bf31cfdd0445d72718ae50ced4e68643e20d6dfd9d75b8eee6aa382ece9777887e36ceda51585d1f2f6d7548461e0d46c6e29f5bba38ab7692ae7366ece845a1d9c9ab53d0ae81f91ff393690870c46ecf4a683778d0c366f64cd2a557ecb809c6f430e7d704c62f05226411cdd1ae26a3ad858f08a678ecbcc03a9505367edc7ee175fc007e9de9bfc88d61715b525d0b57beeeab70590e72da59bd8d8c57c90c82d24c4f8576a21548ad79ff2e6ad1fa1fb00a672a2ebfffad07b328379a65d4fe717f7056d568a30ddb5bd529262a1e38c0c89a83eb2b41da922c6e0f0045accfe13e5780834868b757a0762dfa16efd6f0764f74ba66540f28d8452e29350c8a7695409ae0d62067bf0e9aff2c209fbf87091b4239856a0c9226974d79912a6b1b14870d93fa38edcc2921f7af66ec838501b496ae5e17894e87f7d0f2a710a72c5f134cbe98e728f8a664d9d4f327310bd43ef67cad9159b21a4951d4f476d66fdbca3ae30fb4a6c70b9fbbaaa8f20f6683b803f392a43ce80269e3d21bfc4e7ea6ab8aad79baf5267570a7bacdac0c391e9fde0bf4bfbff139207475d7baf704a9b7b3744a4ead6d04553345aae3491c533b23820d4270d58e399e9d4d1eeceb516648f4d45a2263cb864c8df22830cae86703de646c1070e0bd1c1e711f14c59114bb53789375e79a1717a5eeb6ea41c682e82f9cc9a1742d3d9f8018281c023597731c1004d654707dc2facf812ab554a2f1c98481738c8510de862649dabc702c3dca3f99220f70a577aa4a0bcf56a6e937200a427f8a8a27361440970043b9e0350083ef6a9e1a57c673153d9d8595d2a78778ce8afe460883029424f70f101a151d955be2278701d094b601e4d40d508328cab9ecd596a3174428dec1eab8db152322001a852f20762a98fe9ca938df56013f272d5b125db649949757600acc20d82be75328faa9e5e34521232f7d7a7b1a6a962053c4f00e3d0b9e1431f4580153872fa682a25fe8c441fba47bf3f7de35b19494b8680104280bd39d2cca6704ed9d2dfa72e23c0f792ac9de0371016dcac653ed3275276fe1b1708936904bf88b44e4761a745ba7717a37d8276a60c5321cbe0b897ca81728cecdf3a926aa785a6c925dce62ae3609a55e09a357f317680b1a2c4e7d80a6bd5619ec0ead266d7f88c29a2000b8214d04178776932e9b9b54931843e44881fc80a0b332c62fb27da8e08d99994634a4a253ac002a52539a88a2ee08bed57a61bf221df95b1be37e61b78616f68e527e30ac64c29e4e89743aac4ea17d00131d3a402bfbbd849defe8681fd3c0ec31a970c5a22c9e0049cd69849a6e724b7dda5a1b91fefab85d8ace115e2cf2809ab62f1b0597eaf74b94f8c418a8eb863103c18f794b267ea458efa7ba09280fbcd2d5180dbccba973f8ac5d1f339356b2e73422ce88bb2576b71873c0f188a86c19c4fb8ddc71b4ce06cdb5b9055312f9f58f66232a8db355998d3f21d60fc8350950fe98dc102988ddc67d023e8c7ecda829ba249ab7124790fc8101c66595259474405ab390965609482936c85da0383a752019bd0d064baba02be788c0a743507daa5508d5b7f836fe1b6c13a978cc5bee7d101c2c681d9234aab15fad367fc46d8f78c3e3923beec1e142103d2da2931530ef1ea3d34f0c63a54b69f94374285ad8c5c0cd640c16bd736766dc44eec5ce67d5b346b41ddf284cab216f42e034db3fef9f4f7ee12743bbe7f4cf09c4c394f105bd72ff1a6e95134a48c962b0ca025e39b22a7d80e47f1d03cd67df5850692d781789eb819ee0ff8519dc783af70958514b02363fe04e38c684e196e577b8d82d82357308563673385c643bd73af034e217226ce9062e21f78ad814f141ddee2a62431516260ac1f0e47a9cf7f77107be969c25dd0ee3e9b476edd476d705fd77eafe88219beebf44aa240511b2724d47841ed238686aabb46330d7d0111e71537bb34d1165c95ceacec2e08172b9f820671044d028ac61f82fdf53f3d6dd5a9d26ea5011c3b05b0142c95f7aa7aa9da7834c3f6fa4a07be82fb17b3ff4c80e0b8bf080e1b4f74b0d00ac11e890197a6700069a4fa58117546af6e9a49f56f9384aba33fc43dfcad1dd822288f56ff8b3a30bfc73551ae3b5c748dc80ea0a2d59f637c86d684d9ff1c3b99988c9160c5a1717d3b8eb237a6df8655a5295129a564c045fc00ef2ad64b9057b4c1592bd6f177a8107001b4e1c24e2963f99c96a7f0896c6c4d9aee82b209994e7c759ebabf50cb60dc28329f4833b2c832b193f9079bb12ddf581a4da3c1f59ee3bd293dae99fcc8eee50a8c498bc1dfaa1189577d437736cc6a88b82c42c65e12110b64d64a43c2ad8e3cb9a774d8f89ab2cde93d87a57d5cdaaae285dc404e86817380d2dbd415a5aede6245fe30199efc7c45ab48997ea0fcf8703a8d7f5ccbd9f1d17e043e9b7e0cf645fb779796cd70d2a969468232d834f327602a076ae122fcebd1bdcf521bd2421db0f0a25b59d265f1657775b09d6fa654dae0abc05dbc3d0ee275b43df2bdcb406cd07a75f5730ebbfa1cb35b2e137cf9bdc3b458e2ed4013aa6cae58704c9d9a134c3ca3fe106987ae21694ef9c146597e586936142f7031caa8616ab44f6b1b593fff2e551f4d20234e18e55eec20943d1fc76248c846b8b92b0fbf32c2e4828bcd305d1a61300150f5ca722c562890429d39358ead5faad9940207a9ae89f155ad81ea7be0f3a199179ba623499d3b014134486fab2ea742ffd5765b8b65e2515323bdbed658f230bb6dedc491a32904864f4b30b3d0e487987c20055bb83eb3380a806ea2ef299ca2d554f803dba332298faec26cf2e92a6d8384bd9e548615556944d8c6cccf5a86ceeb9d1192664a46e85cc603acde26396e6ffa952e395fe294ab1cee9ce5cdfa73cf7d777eab4b2dff03778d197ebc53b1adb33f98c3a92c6e0e5e4270d4cf4d9c62866cf9ab724574bbfaedaba3b86de8aea0a80c92ce0c2077e6b6f50f95372f47ff8e4e7746f2c88bbfb5e4ee91a089a7979693002a82b4e0b3627dbb78ff27109e5d993012e381f1b646483178f9064a83d137eade7bf132c22555403436005f9288313c0afefc0e500a9bb302647877de65e8d57eb419770a03a43643041da4de75c919b456f2076ae803f78c2d845cd2df1dfca4d665f95cca1b4e380ecf388a8e13d47189962c916a17c573d06582d324cd73180b121a5180463060dfead06f5880da6265a3efc64c479fab2e9c749a7b83d8647a50874942495826cfb81f6ce30558c6df3f60750ec00ae9fc85f1dc73bd6a22d2c4cc845a3682c54e8689e2b666f8fda0874f214b3e52829e9fa844d88aaa9c2490ce8e60ef112b3e1e761e570cd77379cc7e2413c5e785497521f5badeab57c168be0ebe71df0b550ba7bb149050d3deeba7de038618181757975d2bf7ac8c4f8770121fcdf652e248001bca3ab64347b2055232572fe8a590c49f0d939a6c0a2d411d9d3acf011b49d7540f0a25f53616523f40bc6d5152b34067c30854d6e4a41c78aae964fd46afa0a2fb6f6089ee1be4a6ac74e4e24a1668e7048f79820364020d951bb0ed0f8698dc706fcec44c5381b5803799204646466bc54ae23d862362c62f3e785b090c51063d94886eb3c5914b1a26d0e092efbd7b1511b890d15fae0364385cbdcf418df5a816ef83a2818729773360f048d34428473c8c5e56f55005ee1a98d9517a3cc9d74ec4f1847166d22b4f054a999e190b3c806cca1814e95cb0f983d1f918e299646619d956c4e04b183d3e32bcf2bee753e8397d41dd49fa5ed84555a489ee0456d769e1f0fb826dbdc386544b80e8a8286cf8b273bf98cc5741fc6717ed8052ed84ea8d3495ed06f28bcc7f8ac2e16de71f24b8aa26d9c4bcfc255c786341ae01031b4858e65a62b0dc625df3813381eae63ddc7b10ee19fbfcb91ae299b8f118408a687e01b41ca9482e155587650eb555ee82ddb35d8569b68aad4dfb24cc34eeff392f8d8e4aca26caa5df65ef20142a396ec4ad126b56686edfafdb7a4b8ef9933226fde1182b39ac3d134224a2c32b2eeaa5bce3177fa7a430db2932acb9119ef1f236bbac5d8dc5b765c604a84dbfb34f520bcaa92b7365c4f2a90afc1085473c097889e82ccbe38", @typed={0x8, 0x42, @fd=r4}]}, 0x11c4}, {&(0x7f0000000200)={0x64, 0x2e, 0x20, 0x4, 0x25dfdbfe, "", [@typed={0x4, 0x51}, @typed={0x8, 0x61, @uid=r5}, @generic="204dd4ad5143cb41fc07d95ad8f6acfc8f87a30b73f549603ad0dcc9129759e707320611be56ebbb738b694b2bc8495cf2f51477849495f3ceb7408eb4b24a93ff2ae31c71"]}, 0x64}, {&(0x7f0000000280)={0x24, 0x3f, 0x100, 0x70bd29, 0x25dfdbff, "", [@typed={0x8, 0x84, @pid=0xffffffffffffffff}, @nested={0xc, 0x1a, [@typed={0x8, 0x3, @u32=0x7fffffff}]}]}, 0x24}, {&(0x7f00000002c0)={0x1c, 0x2f, 0xb7cd06ae99157b05, 0x70bd26, 0x25dfdbfb, "", [@typed={0xc, 0x9, @u64=0x7fffffff}]}, 0x1c}, {&(0x7f0000004c00)={0x1074, 0x18, 0x400, 0x70bd26, 0x25dfdbfb, "", [@generic="abc5e2216a60553f2f7ffe991b532420988528bdcdbc011c9f887684e94a61600c06ebed347a14b523370e62dacd8b71444142a29d1ee37b534d0ee4c53a5903ab8c692141744ff9f80664226a64db71b8ae58eabc56ab5439d35274cca626d82fd4c3c0a164b7f3fe12a72d621ed03e7c40c309ad2832d93f55b72f4bfaa67239030b23c63faefd21eba47aeb715a68d17928901f3b0cd512f3868c34fbb99663d42af19dadf4560f9a85a45a4ce41f17c4328bad3fb0114bd2e9bbcdc39e9b615d5abedd9e6e6c47ea2a3afc6f1a57ba834a2e6e06c7634e304275ebd4d3edc13d43efba309a11b4d168ccfb727dca6acf4f688b3d89c1107d8714cbc782213667472ca184e40dc9d638b00e47a6578e08262da5455b8935503ba82bd2898170c215d87ed51175dd37111507b60899668bb64152a263a47f056ba20af47db23dd8b099f781eb411b9b5ef7364f5007420058558a318b87e124fe03573653c7b8e4c84ce60c54b37d28f08d3cf0939a35f372f773baf281b25d3bf1e4f03642553068a36990a7621284750404f84bea3d7aff12fc2017a4aa1e7b2c1df6e44fb131b3f96ce84ea42efafab89346ba0f811f48b65ae8d8bd9f6b8d7bb8d1d078b40a92e9cb3bf3625bdfd2149eea341b716a43893b2739ccab1baa8dce3f615b6d1284d8d7655109dbf9c57e62ef897e7c22c96bdb69b8547b1760202f3933e986a59039bab45b8075f3f4ae49bc5400c9a98197ab1b38d65e1f26065fbba43344c974ea5073a641f98485aaf52b99c90dbcc457d95b6773fe98b0d0f80e4ea3c684ebc1182508865d625938aae81d32673faea364152b9e0e11e5cdc23267fccd2522c2b5df71bb07dfbe19567b56eb4ce1a19508e728f43cf3add9d89d509fa120e1a772876f16b8c0bf16be70617a8498d205c24d0cfab020683a3f5dfbf776a69c41864b1a10ab0e41e590f9679cfe091b6f50183d8777816ec75eb91eeae344e0e91a11dcd7cf4698f099890f4db978143f12fe1433b7120e1e0f445c6e1f7c8d09c8e9255bb84f9695fe29a732d495a2a313e33b63fc6185f97a1b85ed53a7146719d0bfc7ef01bcbb6c13584aadb9303e786ac6a7535faec272e758b65e23685f351a8880c0885a22767a125eb78ef8e3f018d7f5723cf9707ec9185a0750ab7e88746d1c446764ab4375d9b87215ed76fea1e61903e47625ff2c09549aae6b50274822f57547c2f314688af504f352c8081069a60b4388eaecdffdc7ae61ba206b1a5d052b4d09b490e137b72b5862334ad62bef1b2463c90b3c229f533532ca87ae8e28960e189f8a8f653ef8cefc277212d3fb34a912981be4c02081c656027ba4cbbab0680faab8f15453de563c53a30d938f340a377de0d0cc657d211c7dd0ba6027b72c1712165b2e9ae91f8f892ae08dcf79337bb48ce3795963878f0f8c62876a5df719183f342b060d9b5e6e4ff28d5e327d7d758c3d8c0d553fa3fc7a6ccd218625744daca703ca20a2aca3876fe6339b6a162962d7d57f713b67cf494221b2ee37ba5b600847957dd0bc87e840c9e934a58793e4775e605e034ea72b59215c0df893c0e1542dd2fe1c46176b601e81159b4d22aeb99ccebf79dea33bae52632a91ed7d1586a90a8373b9947bd38d5b9edb1e01c3de84fd3b16197a58525c8852745c0db2296f89df01d896dfb24c9c3a7bdbdad1f28b32631a91b107e4cddbdbf3c3681472d00c02225b5ee9a49808ae5e41e8480891f574bffeafda13234c4ff421f6ed424a50fd5026dfcadcb51048206756701252a541866015d545f038deba180cadf38077637ff7df28caeaffebcbbf78d25d1f0e4bed8579802bc95ca4cb6d16fe9c8a4586697eb6fa8ea084349443839209152246aeac748cacca9f82320014520909a91513df7ab284a51e1474303577e5f69a3d9137d557a707b9eaf060f4a73cc20c1a8f41c712f10074bcbbbb05a83a0b8cf5667c7b31f4e0df0a6fbec39cc118535db75ccfbb12a3c49f23026c462ee0b05a2ff24108e9efd2c3028662779c97f613288d171b3f6c606dc8995c39bb7e0a384a52ffdf02a8c2e3fc6ff0435be79026b5e399c2708ad91f64ddb048113a7f6ebc42c77846a9c455b713d1c97fc0bc4dd6f2488506033e71b2be2c3310e29d86301aae8d59044b1f60bff2e6d6504b743dadd328a94024e2f05334f16d14013db9817383f4849a67fb76776a26b0fd658840298613bbfe67dc494ee6ca010867a2e74e705bb657b14ca75adec1a3fe42d537d7541a7c44d2fee68cf8cb636c31a5236bdc3aef02152e8d706aa2ec03369bff87c7e4063a376765ed313449174bbd8bbb34df13879a300968acab042b2ea10903eb18277c4a2099219a7141898fc486a511ddc592fc5a7f62748ec45d8117b6da82d2d224774a966bd9d5fdf5f962d0b9713d9b795900897bb0668d7c277f62be5ffe83bd5d311f1da9df2aa70904591f4814d3b56b0ce1f336f21bbdf32850be9a06a2489f74b9d6b04d7dfbd367514b9be28e55b3cdbf7055a29ac19f5ec6fa61d9f63ec7fb3b90e47208b36605eeb4b7f6851c18a65967a7c17a162499176a171cfc33f9a9e3be80fb1c25bc64371a3da9600af288d23791311bff588e81b22b256bff7719a2176c3166e584a2eb0d1c44525affeb0b93807843c6ec29844b36c639dbced4a75fcd89b138f0bb1580b39141ab06a47e648abb7acf80ca73864ad464481bdeb39b71c2ce4adadb1696afb6b7aaae4a34eb2aa41b569c6e3f392ab6fbda062d8ff7486b2901eeb8ec0d82898cbd15d83e3ea79be117843b29e2ab72b25735140631b5bbf282e3a3fb93b240dd8d2d1cf4bbdec133875e66d41431ecd973d96e79282116a376ece56959a88ad8654b26d6307347449024617f6d8a0742fc1e4c2af92bd3add30cf25ea6fc099cda3b36eb7eeccc022f69499fb12541d0a480f557a278e141e9d3676190b1c1e051eb0c7bac3e40b86afbafacbd2140e8d1bdb1b5064873cfa12f723c0f0b30718b60360b88edbd7cda22327514b65d69354b5220fc019579817f6d9c0840bb61a1d6444c11867e8617c030e49b936e8fa8874ff3652f8cc3e1726719e4e1002c1594c238925d15c0102011b26ab02bfa8aa994d72cb78d114cfbc0da1c7319b91109949dfa9a356e5f9dee40b4f288c4c3257bc66f72f1b22dd410f65ec2bef94c883e7cb2dcbae72124eca6e6acdabc27aec63d8f2c1f4ac34be50ce5f2f77fd6cd59d0eeb6e574248ea2c0eb2c7aae4fb0e191af06703c3ef2f51af0aa26809bfca7c8db60b950d4526eb0bea480c7f90b5a54955e16730b34c268e8c6f8f73bb162e88e95949e34112326fb96540980c6a4e22bfabc3c8bd14cfa479fb0969b9f7d210aa9e2356e00f66c9de8016f39869bc7f0fbf670e2e011e62c0a3c7a81dca5b9c7be7cab9e1a97d8b3253cee5a4aba03cc0da2a3437bf84b2145f47982315a8785964b8c1c70f41944094dffa42f37daa5c3c3fa45b20c1fceaf0386fa75b42858a5fa54fd76800c10e2adf488e5b0f36b834c6d5f1bb26ef3453333ca68a3df502becc133f7489640322607152a3bdaee74ab04c1fc3a83569c63846a72e3b268334876e7328a1e369cedd285035d511959dfe763dd7ab04275b837c428ef20394be788c0791cd7c5635c7eb5b002d87e97533c33784d0263fe820ef41600163357919ed27208d79ad49f6cd0a92a8b0aa5380b8b197b7dce856eb954a79cd456723f4c61ec51b9854fe2acb4e8c9774dde56b641615e9d69a785dbab707219b4bdfd26da2c7fc20c6edae0fb77334832a8ff657e057b278a74068ed967c567420dc50d9ff228b56d622dc53634e660cff965edbc8eac0325757bd860da3ac0c8623f9e1c772820d62c1839d24c96b02aed1f7bd36a12884ccc444ecbcc32c27aea0a642e8fff4e0262d5dcba1a5b090fddefce349a112c77415e3c9bd863cd370335bb25d3aea5338297ed2eff490f69f6449572a80ca6925055fedb1aa158eb4fc73f85511d2fa2ca397b5d3fee5e922bfe155cd06f7a9a845da906f42db5b5387e7460201e33ae3dbaaabcbb548f4353a255e9b87eeec9925376392a7a1841ef195c992ed967a94834be6a36394cdac7af7d3f56074264abd07ea85bb0a4d7062f2b08af121c42e96e7ee705c40878cb30095a9d946888056616915d5fc1ddc7473377a22b77bede7e86547e4af062fe4951dfeced70551df8c965b455f109b22ed4edb2fa4aec26e4b45ffba22bbbbfd3227e2d5e552b12a69a1577065d6ea699bd966a43c6ae88ba9f9885d0ffd01d8e4de026db2193f6db570e15a2e19f5a690b3e28b45636c441026bd3b20991fafd7a6e31f27d5436089163e227a1b5644a420bf3b41d894045dee48c0e0ddc38bd275a38c01174d6fd04e3011f3f8a7fec310da567b0adc18b72d441ce1b2a603d40719ba375d011c2251c9f6dbcc38bc98a8774d7b58ab664d97a977b947221d77c3a14de1cdc6180f8e659567397c24f70f65b2dcca5c129862eab342f3b2a4262a355b1751ac4f86395e71cf7600969037b63742f3c287137c0bce86a6615d3d24df21ff9fd2d98d22ef153a063a14baa3e30a672bf37c9adb12e2ba3d0606870364b4f64f171028f24d11557e8b8e5ae4efef06ac405f2a11148bf39066e0c17c31292cd3bb41794065eed120c952a2d4008db4884c1bc128bf57572da0547259aeb2cd9cbb19da1dda6937b6bd1991af19752c9a96d6fdadefa93528fd4e01dac1d7b01e9ce8e11aa164f88f7e69cebb65a86c27349b3b81e3f0a2e1c794e20cc1ed1dff20cfd274a380f051e5f1b63142041d7f768fff02466afd7b208203c32931b6906e0b540f31bef66e33a605cce584381e616dcdd38d5b8e89e96d8ac4166d6c851026a2f7a5b61e967ba9fa383c28960b3d56eb51ee9775f4a025f53bbf9513dc1909eaa613ad42a5980726c002759c94231eb0209673d2e67131e8b0045720a1d90b5720862d303a9ff8b71204868914d60f0e995e9da8d2219c2404be366786f2a1c84fe710a9c004da283baee8950abb93b6b13504f4f1156e7091a2d7931667d8a21c7e1e67f2409da35d894351800b066fc9d80d14f3a3ff3174750ec7ddb4f078551e45702f828917788f0e42a89a46d27977b151fa586347c11927b1ab94fa1c1cdc020a98985858c49807408a4340e69fafd41a0001cda8a94079d960efffa63d34c07643cfd4a2c2fe7b1a4aa4bbe99cd0229cb9ea061ba948e69b757e31ac0de571442688bc7e551a8178389dd753f7148778b49a5fb103f2637597176fa8b558ca53beb148de6c792aedbf426691842dccf464c31fdac81df43362ac32ad25b5fdad5f1b68315e72e1218cc4616e41e3c910f2deb622ec6d2be835646c385d1b1e13a978c1c3da4bf13a3a1e061dc40e7db71b2d320ef75dae8867d448c695d66f1b2f05d00253ac09f3968302a3c4ff284b7df8d79118128f9278a023f8aceb2d7b90720ed421637bab083cef018ce111e5d70054054891abd1fdea0397485848e22b5d0b37585eddb00dc75612db64232fbafd1ab1f77755a40b941d5ec0f8e79ac719936cc21e7d047037ddad85d669e96391c1bf749abe89b73385d69b01c8a21b13b8c17151b51dd010b9b39ffe88630bcb6ab93042387098f8604bf77804e96eb65080f3080fd2ec271661ef1046358430b50bf7ae2fcb5bca9665d343142b280ac8dcb04c460294c07a162a71348796bc962c57b", @generic="1b377690407f26f9c9cd8fe5f04f327258c5fbe26f48112b3cf6dfd837f5fdd4333f8bc217151235f224402117cfa32bb8694695d09b9459c60fe8016badcbbdc91ea2329e23f62db66afe9a59e9ba47887aecd573a83ffad2ca6138267cb02adb9f52"]}, 0x1074}, {&(0x7f0000005c80)={0xb4, 0x28, 0x200, 0x70bd25, 0x25dfdbff, "", [@typed={0x14, 0xc, @ipv6=@local}, @generic="5af01f3e726de1ddb3ec65b17e1c0d65ab970a032cbdb56897beca93a3e82ed57240e060f4e4c63c30a7e6b79daa91350b2da3cc68f920920fb64143f514792b2b3d9ef0ffbdb8214fb2c6ef9d16ce160c2ebcd4396bf9699f568e3780a72b87a6007a43345f5dfce153e167225a6e7cb80d67c780babc56b00433afb46e934080409076e7d9b70b6f9ec5ddce"]}, 0xb4}, {&(0x7f0000000300)={0x24, 0x19, 0xf88, 0x70bd2c, 0x25dfdbfe, "", [@typed={0x8, 0x46, @ipv4=@initdev={0xac, 0x1e, 0x0, 0x0}}, @typed={0xc, 0x2b, @u64=0xffffffff}]}, 0x24}], 0x9, &(0x7f0000006040)=[@rights={{0x20, 0x1, 0x1, [r6, r1, r1, 0xffffffffffffffff]}}, @rights={{0x38, 0x1, 0x1, [0xffffffffffffffff, r0, r2, r7, r8, r2, r9, r10, r0, r11]}}, @rights={{0x2c, 0x1, 0x1, [r2, r2, r12, r2, r13, r14, r15]}}, @rights={{0x18, 0x1, 0x1, [r3, r16]}}, @cred={{0x1c, 0x1, 0x2, {r17, r18, r22}}}, @rights={{0x20, 0x1, 0x1, [r3, r2, r23, r0]}}, @rights={{0x18, 0x1, 0x1, [r0, r1]}}, @cred={{0x1c, 0x1, 0x2, {r24, r25, r27}}}], 0x118, 0x40000}, 0x2) [ 1793.189707] binder: 12497:12499 Acquire 1 refcount change on invalid ref 0 ret -22 [ 1793.198423] binder: 12472:12479 unknown command 1850775417 [ 1793.207660] binder: 12497:12499 IncRefs 0 refcount change on invalid ref 0 ret -22 [ 1793.218927] binder: 12472:12479 ioctl c0306201 200000c0 returned -22 16:21:22 executing program 0: syz_open_procfs(0x0, &(0x7f0000000080)='net/dev_snmp6\x00') r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00000000c0)) r1 = syz_open_pts(r0, 0x0) ioctl$TCSETS2(r1, 0x402c542b, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, 0x0, "36b71128cfa8bdd3b2da4fd6a1cb228fb9755b"}) pipe(&(0x7f00000002c0)) epoll_create(0xe) pselect6(0x40, &(0x7f00000000c0)={0x3}, 0x0, &(0x7f0000000140)={0x1b7}, 0x0, 0x0) 16:21:22 executing program 5: r0 = syz_open_procfs(0x0, &(0x7f0000000080)='net/dev_snmp6\x00') socket(0x10, 0x80002, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) socket$nl_generic(0x10, 0x3, 0x10) syz_open_procfs(0x0, &(0x7f0000000980)='net/sofH\x16tnet_sua') socket$inet6_tcp(0xa, 0x1, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) request_key(&(0x7f0000000000)='user\x00', &(0x7f0000000040)={'syz'}, &(0x7f0000000a80), 0xfffffffffffffffd) socket$inet(0x2, 0x4000000000000001, 0x0) perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x1ee6b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000000c0)={0xeb, 0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB="0563044000000000046304400000000006630440000000007997506ea39438033ada635f7cd4c9d1de50cf51e7a773b356e7348d3b19cbdc76ed97a6a08da8997815ea9e6d3b6a1d5a7c1cdf78337a6166cfd70cf41b6cb958e69b7dae4fe74a09c8e4db4c323ba219438b49c2f1736eb01b18c098512160aad1c0394bd4c9b785ea39e6f5b1f809658351bcb5f101899004e6a8542081ceec87f1a675538ce9264c7f128392c875c23507fc8a694ef2d13b127563b2da420a3df952f062dd3d46202a3466fa9a9c985dde3cc577a1fdf40687931bbc4303dbab0e28bb6757bc226d9bba4db1603de1a9c7"], 0x1, 0x0, &(0x7f00000003c0)='L'}) ioctl$TCSETS(0xffffffffffffffff, 0x40045431, &(0x7f00000000c0)) r2 = syz_open_pts(0xffffffffffffffff, 0x0) r3 = dup3(r2, r0, 0x0) ioctl$TCXONC(r3, 0x540a, 0x0) [ 1793.234987] binder: 12497:12499 Release 1 refcount change on invalid ref 0 ret -22 [ 1793.249440] binder: 12497:12499 unknown command 1850775417 [ 1793.274150] binder: 12497:12499 ioctl c0306201 200000c0 returned -22 16:21:22 executing program 1: syz_open_procfs(0x0, &(0x7f0000000080)='net/dev_snmp6\x00') r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) socket$nl_generic(0x10, 0x3, 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x1ee6b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0xeb, 0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB="0563044000000000046304400000000006630440000000007997506ea39438033ada635f7cd4c9d1de50cf51e7a773b356e7348d3b19cbdc76ed97a6a08da8997815ea9e6d3b6a1d5a7c1cdf78337a6166cfd70cf41b6cb958e69b7dae4fe74a09c8e4db4c323ba219438b49c2f1736eb01b18c098512160aad1c0394bd4c9b785ea39e6f5b1f809658351bcb5f101899004e6a8542081ceec87f1a675538ce9264c7f128392c875c23507fc8a694ef2d13b127563b2da420a3df952f062dd3d46202a3466fa9a9c985dde3cc577a1fdf40687931bbc4303dbab0e28bb6757bc226d9bba4db1603de1a9c7"], 0x1, 0x0, &(0x7f00000003c0)='L'}) ioctl$TCXONC(0xffffffffffffffff, 0x540a, 0x0) [ 1793.335127] binder: 12509:12514 Acquire 1 refcount change on invalid ref 0 ret -22 [ 1793.352772] binder: 12509:12514 IncRefs 0 refcount change on invalid ref 0 ret -22 [ 1793.364825] binder: 12509:12514 Release 1 refcount change on invalid ref 0 ret -22 [ 1793.392925] binder: 12509:12514 unknown command 1850775417 [ 1793.403310] binder: 12509:12514 ioctl c0306201 200000c0 returned -22 [ 1793.421100] binder: 12520:12521 Acquire 1 refcount change on invalid ref 0 ret -22 [ 1793.442326] binder: 12520:12521 IncRefs 0 refcount change on invalid ref 0 ret -22 [ 1793.467095] binder: 12520:12521 Release 1 refcount change on invalid ref 0 ret -22 [ 1793.489566] binder: 12520:12521 unknown command 1850775417 [ 1793.496407] binder: 12520:12521 ioctl c0306201 200000c0 returned -22 [ 1793.535293] EXT4-fs (loop4): bad geometry: block count 1080 exceeds size of device (1 blocks) 16:21:23 executing program 4: perf_event_open(&(0x7f0000000140)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0xfffffffffffff32f}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) clone(0x41bc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = getpid() rt_tgsigqueueinfo(r0, r0, 0x16, &(0x7f00000001c0)) ptrace(0x4206, r0) ptrace$setregs(0xf, r0, 0x0, &(0x7f0000000140)) ptrace$getregset(0x4205, r0, 0x2, &(0x7f0000000000)={0x0}) 16:21:23 executing program 0: syz_open_procfs(0x0, &(0x7f0000000080)='net/dev_snmp6\x00') r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00000000c0)) r1 = syz_open_pts(r0, 0x0) ioctl$TCSETS2(r1, 0x402c542b, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, 0x0, "36b71128cfa8bdd3b2da4fd6a1cb228fb9755b"}) pipe(&(0x7f00000002c0)) epoll_create(0xe) pselect6(0x40, &(0x7f00000000c0)={0x3}, 0x0, &(0x7f0000000140)={0x1b7}, 0x0, 0x0) 16:21:23 executing program 5: r0 = syz_open_procfs(0x0, &(0x7f0000000080)='net/dev_snmp6\x00') socket(0x10, 0x80002, 0x0) syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) socket$nl_generic(0x10, 0x3, 0x10) syz_open_procfs(0x0, &(0x7f0000000980)='net/sofH\x16tnet_sua') socket$inet6_tcp(0xa, 0x1, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) request_key(&(0x7f0000000000)='user\x00', &(0x7f0000000040)={'syz'}, &(0x7f0000000a80), 0xfffffffffffffffd) socket$inet(0x2, 0x4000000000000001, 0x0) perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x1ee6b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r1, 0x40045431, &(0x7f00000000c0)) r2 = syz_open_pts(r1, 0x0) r3 = dup3(r2, r0, 0x0) ioctl$TCXONC(r3, 0x540a, 0x0) 16:21:23 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) socket$nl_generic(0x10, 0x3, 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x1ee6b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0xeb, 0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB="0563044000000000046304400000000006630440000000007997506ea39438033ada635f7cd4c9d1de50cf51e7a773b356e7348d3b19cbdc76ed97a6a08da8997815ea9e6d3b6a1d5a7c1cdf78337a6166cfd70cf41b6cb958e69b7dae4fe74a09c8e4db4c323ba219438b49c2f1736eb01b18c098512160aad1c0394bd4c9b785ea39e6f5b1f809658351bcb5f101899004e6a8542081ceec87f1a675538ce9264c7f128392c875c23507fc8a694ef2d13b127563b2da420a3df952f062dd3d46202a3466fa9a9c985dde3cc577a1fdf40687931bbc4303dbab0e28bb6757bc226d9bba4db1603de1a9c7"], 0x1, 0x0, &(0x7f00000003c0)='L'}) ioctl$TCXONC(0xffffffffffffffff, 0x540a, 0x0) [ 1793.667979] binder: 12537:12541 Acquire 1 refcount change on invalid ref 0 ret -22 [ 1793.686522] binder: 12537:12541 IncRefs 0 refcount change on invalid ref 0 ret -22 [ 1793.702407] binder: 12537:12541 Release 1 refcount change on invalid ref 0 ret -22 [ 1793.716515] binder: 12537:12541 unknown command 1850775417 [ 1793.722857] binder: 12537:12541 ioctl c0306201 200000c0 returned -22 16:21:23 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f00000003c0)="11dca50d5e0bcfe47bf070") r1 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r1, &(0x7f0000000100)={0x2, 0x4e20}, 0x10) connect$inet(r1, &(0x7f0000000cc0)={0x2, 0x4e20, @local}, 0x10) setsockopt$SO_TIMESTAMPING(r1, 0x1, 0x25, &(0x7f00000010c0)=0x19ff, 0x4) sendto$inet(r1, &(0x7f0000000140)="b0", 0x1, 0x0, 0x0, 0x0) r2 = openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/commit_pending_bools\x00', 0x1, 0x0) write$P9_RSETATTR(r2, &(0x7f0000000040)={0x7, 0x1b, 0x2}, 0x7) recvmmsg(r1, &(0x7f0000003b40)=[{{0x0, 0x0, 0x0, 0x133}}], 0x1, 0x2000, 0x0) 16:21:23 executing program 0: syz_open_procfs(0x0, &(0x7f0000000080)='net/dev_snmp6\x00') r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00000000c0)) r1 = syz_open_pts(r0, 0x0) ioctl$TCSETS2(r1, 0x402c542b, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, 0x0, "36b71128cfa8bdd3b2da4fd6a1cb228fb9755b"}) pipe(&(0x7f00000002c0)) epoll_create(0xe) pselect6(0x40, &(0x7f00000000c0)={0x3}, 0x0, &(0x7f0000000140)={0x1b7}, 0x0, 0x0) 16:21:23 executing program 1: r0 = syz_open_dev$binder(0x0, 0x0, 0x0) socket$nl_generic(0x10, 0x3, 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x1ee6b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0xeb, 0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB="0563044000000000046304400000000006630440000000007997506ea39438033ada635f7cd4c9d1de50cf51e7a773b356e7348d3b19cbdc76ed97a6a08da8997815ea9e6d3b6a1d5a7c1cdf78337a6166cfd70cf41b6cb958e69b7dae4fe74a09c8e4db4c323ba219438b49c2f1736eb01b18c098512160aad1c0394bd4c9b785ea39e6f5b1f809658351bcb5f101899004e6a8542081ceec87f1a675538ce9264c7f128392c875c23507fc8a694ef2d13b127563b2da420a3df952f062dd3d46202a3466fa9a9c985dde3cc577a1fdf40687931bbc4303dbab0e28bb6757bc226d9bba4db1603de1a9c7"], 0x1, 0x0, &(0x7f00000003c0)='L'}) ioctl$TCXONC(0xffffffffffffffff, 0x540a, 0x0) 16:21:23 executing program 5: r0 = syz_open_procfs(0x0, &(0x7f0000000080)='net/dev_snmp6\x00') socket(0x10, 0x80002, 0x0) syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) socket$nl_generic(0x10, 0x3, 0x10) syz_open_procfs(0x0, &(0x7f0000000980)='net/sofH\x16tnet_sua') socket$inet6_tcp(0xa, 0x1, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) request_key(&(0x7f0000000000)='user\x00', &(0x7f0000000040)={'syz'}, &(0x7f0000000a80), 0xfffffffffffffffd) socket$inet(0x2, 0x4000000000000001, 0x0) perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x1ee6b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r1, 0x40045431, &(0x7f00000000c0)) r2 = syz_open_pts(r1, 0x0) r3 = dup3(r2, r0, 0x0) ioctl$TCXONC(r3, 0x540a, 0x0) 16:21:23 executing program 2: r0 = syz_open_procfs(0x0, &(0x7f0000000000)='attr/keycreate\x03') r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r1, 0x40045431, &(0x7f00000000c0)={0x0, 0xfffffffffffffffc, 0x26, 0x4, 0x0, 0x8000}) r2 = syz_open_pts(r1, 0x0) r3 = dup3(r2, r0, 0x0) ioctl$TCXONC(r3, 0x540a, 0x0) pselect6(0x40, &(0x7f0000000340)={0x9}, 0x0, 0x0, 0x0, 0x0) pipe(&(0x7f0000000480)={0xffffffffffffffff}) vmsplice(r4, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) ioctl$BLKSECDISCARD(r4, 0x127d, &(0x7f0000000280)=0x1) pipe(&(0x7f0000000480)={0xffffffffffffffff}) vmsplice(r5, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) ioctl$TIOCGSID(r5, 0x5429, &(0x7f00000002c0)=0x0) syz_open_procfs(r6, &(0x7f0000000300)='net/fib_trie\x00') r7 = creat(&(0x7f0000000080)='./file0\x00', 0x44) ioctl$ifreq_SIOCGIFINDEX_team(r0, 0x8933, &(0x7f0000000100)={'team0\x00', 0x0}) r9 = openat$zero(0xffffffffffffff9c, &(0x7f0000000180)='/dev/zero\x00', 0x0, 0x0) sendto$inet6(r9, &(0x7f00000001c0)="a9f988e82ad38ae6554eeea79a04008658669e79630e4ed0f686649f3b36ddd3607ef08fd02c3a6d8fd5e2a3d9765d0a4750607e7493a902ef641a61151783abbd55681a0073a5fa4628da3bc21b2720e9d714d2117ca504074e75502423b72d038fcd3693bf9dfe4bc50450c91965ed4e93b8cbdd8c94", 0x77, 0x40044, &(0x7f0000000240)={0xa, 0x4e21, 0x3bfe, @empty, 0x81}, 0x1c) setsockopt$packet_add_memb(r7, 0x107, 0x1, &(0x7f0000000140)={r8, 0x1, 0x6, @link_local}, 0x10) 16:21:23 executing program 0: syz_open_procfs(0x0, &(0x7f0000000080)='net/dev_snmp6\x00') r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00000000c0)) r1 = syz_open_pts(r0, 0x0) ioctl$TCSETS2(r1, 0x402c542b, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, 0x0, "36b71128cfa8bdd3b2da4fd6a1cb228fb9755b"}) pipe(&(0x7f00000002c0)) pselect6(0x40, &(0x7f00000000c0)={0x3}, 0x0, &(0x7f0000000140)={0x1b7}, 0x0, 0x0) 16:21:23 executing program 1: r0 = syz_open_dev$binder(0x0, 0x0, 0x0) socket$nl_generic(0x10, 0x3, 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x1ee6b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0xeb, 0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB="0563044000000000046304400000000006630440000000007997506ea39438033ada635f7cd4c9d1de50cf51e7a773b356e7348d3b19cbdc76ed97a6a08da8997815ea9e6d3b6a1d5a7c1cdf78337a6166cfd70cf41b6cb958e69b7dae4fe74a09c8e4db4c323ba219438b49c2f1736eb01b18c098512160aad1c0394bd4c9b785ea39e6f5b1f809658351bcb5f101899004e6a8542081ceec87f1a675538ce9264c7f128392c875c23507fc8a694ef2d13b127563b2da420a3df952f062dd3d46202a3466fa9a9c985dde3cc577a1fdf40687931bbc4303dbab0e28bb6757bc226d9bba4db1603de1a9c7"], 0x1, 0x0, &(0x7f00000003c0)='L'}) ioctl$TCXONC(0xffffffffffffffff, 0x540a, 0x0) 16:21:23 executing program 0: syz_open_procfs(0x0, &(0x7f0000000080)='net/dev_snmp6\x00') r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00000000c0)) r1 = syz_open_pts(r0, 0x0) ioctl$TCSETS2(r1, 0x402c542b, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, 0x0, "36b71128cfa8bdd3b2da4fd6a1cb228fb9755b"}) pipe(&(0x7f00000002c0)) pselect6(0x40, &(0x7f00000000c0)={0x3}, 0x0, &(0x7f0000000140)={0x1b7}, 0x0, 0x0) 16:21:23 executing program 4: openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000080)='./cgroup.cpu\x00', 0x200002, 0x0) socket$packet(0x11, 0x3, 0x300) pipe(&(0x7f0000000680)) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) pselect6(0x40, &(0x7f00000000c0), 0x0, &(0x7f0000000140)={0xff}, &(0x7f0000000200), 0x0) 16:21:23 executing program 5: r0 = syz_open_procfs(0x0, &(0x7f0000000080)='net/dev_snmp6\x00') socket(0x10, 0x80002, 0x0) syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) socket$nl_generic(0x10, 0x3, 0x10) syz_open_procfs(0x0, &(0x7f0000000980)='net/sofH\x16tnet_sua') socket$inet6_tcp(0xa, 0x1, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) request_key(&(0x7f0000000000)='user\x00', &(0x7f0000000040)={'syz'}, &(0x7f0000000a80), 0xfffffffffffffffd) socket$inet(0x2, 0x4000000000000001, 0x0) r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r1, 0x40045431, &(0x7f00000000c0)) r2 = syz_open_pts(r1, 0x0) r3 = dup3(r2, r0, 0x0) ioctl$TCXONC(r3, 0x540a, 0x0) 16:21:23 executing program 0: syz_open_procfs(0x0, &(0x7f0000000080)='net/dev_snmp6\x00') r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00000000c0)) r1 = syz_open_pts(r0, 0x0) ioctl$TCSETS2(r1, 0x402c542b, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, 0x0, "36b71128cfa8bdd3b2da4fd6a1cb228fb9755b"}) pipe(&(0x7f00000002c0)) pselect6(0x40, &(0x7f00000000c0)={0x3}, 0x0, &(0x7f0000000140)={0x1b7}, 0x0, 0x0) 16:21:23 executing program 1: r0 = syz_open_dev$binder(0x0, 0x0, 0x0) socket$nl_generic(0x10, 0x3, 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x1ee6b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0xeb, 0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB="0563044000000000046304400000000006630440000000007997506ea39438033ada635f7cd4c9d1de50cf51e7a773b356e7348d3b19cbdc76ed97a6a08da8997815ea9e6d3b6a1d5a7c1cdf78337a6166cfd70cf41b6cb958e69b7dae4fe74a09c8e4db4c323ba219438b49c2f1736eb01b18c098512160aad1c0394bd4c9b785ea39e6f5b1f809658351bcb5f101899004e6a8542081ceec87f1a675538ce9264c7f128392c875c23507fc8a694ef2d13b127563b2da420a3df952f062dd3d46202a3466fa9a9c985dde3cc577a1fdf40687931bbc4303dbab0e28bb6757bc226d9bba4db1603de1a9c7"], 0x1, 0x0, &(0x7f00000003c0)='L'}) ioctl$TCXONC(0xffffffffffffffff, 0x540a, 0x0) 16:21:24 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) socket$nl_generic(0x10, 0x3, 0x10) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x1ee6b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0xeb, 0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB="0563044000000000046304400000000006630440000000007997506ea39438033ada635f7cd4c9d1de50cf51e7a773b356e7348d3b19cbdc76ed97a6a08da8997815ea9e6d3b6a1d5a7c1cdf78337a6166cfd70cf41b6cb958e69b7dae4fe74a09c8e4db4c323ba219438b49c2f1736eb01b18c098512160aad1c0394bd4c9b785ea39e6f5b1f809658351bcb5f101899004e6a8542081ceec87f1a675538ce9264c7f128392c875c23507fc8a694ef2d13b127563b2da420a3df952f062dd3d46202a3466fa9a9c985dde3cc577a1fdf40687931bbc4303dbab0e28bb6757bc226d9bba4db1603de1a9c7"], 0x1, 0x0, &(0x7f00000003c0)='L'}) ioctl$TCXONC(0xffffffffffffffff, 0x540a, 0x0) 16:21:24 executing program 0: syz_open_procfs(0x0, &(0x7f0000000080)='net/dev_snmp6\x00') r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00000000c0)) r1 = syz_open_pts(r0, 0x0) ioctl$TCSETS2(r1, 0x402c542b, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, 0x0, "36b71128cfa8bdd3b2da4fd6a1cb228fb9755b"}) epoll_create(0xe) pselect6(0x40, &(0x7f00000000c0)={0x3}, 0x0, &(0x7f0000000140)={0x1b7}, 0x0, 0x0) 16:21:24 executing program 5: r0 = syz_open_procfs(0x0, &(0x7f0000000080)='net/dev_snmp6\x00') socket(0x10, 0x80002, 0x0) syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) socket$nl_generic(0x10, 0x3, 0x10) syz_open_procfs(0x0, &(0x7f0000000980)='net/sofH\x16tnet_sua') socket$inet6_tcp(0xa, 0x1, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) request_key(&(0x7f0000000000)='user\x00', &(0x7f0000000040)={'syz'}, &(0x7f0000000a80), 0xfffffffffffffffd) socket$inet(0x2, 0x4000000000000001, 0x0) r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r1, 0x40045431, &(0x7f00000000c0)) r2 = syz_open_pts(r1, 0x0) r3 = dup3(r2, r0, 0x0) ioctl$TCXONC(r3, 0x540a, 0x0) 16:21:24 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f00000003c0)="11dca50d5e0bcfe47bf070") r1 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r1, &(0x7f0000000100)={0x2, 0x4e20}, 0x10) connect$inet(r1, &(0x7f0000000cc0)={0x2, 0x4e20, @local}, 0x10) r2 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000000)='/dev/uinput\x00', 0x803, 0x0) ioctl$UI_GET_SYSNAME(r2, 0x8040552c, &(0x7f0000000040)) setsockopt$SO_TIMESTAMPING(r1, 0x1, 0x25, &(0x7f00000010c0)=0x19ff, 0x4) sendto$inet(r1, &(0x7f0000000140)="b0", 0x1, 0x0, 0x0, 0x0) recvmmsg(r1, &(0x7f0000003b40)=[{{0x0, 0x0, 0x0}}], 0x1, 0x2000, 0x0) [ 1794.864755] binder: 12610:12616 Acquire 1 refcount change on invalid ref 0 ret -22 [ 1794.873585] binder: 12610:12616 IncRefs 0 refcount change on invalid ref 0 ret -22 [ 1794.882816] binder: 12610:12616 Release 1 refcount change on invalid ref 0 ret -22 [ 1794.891408] binder: 12610:12616 unknown command 1850775417 16:21:24 executing program 2: r0 = syz_open_procfs(0x0, &(0x7f0000000080)='net/dev_snmp6\x00') r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000100)='/dev/ptmx\x00', 0x8000, 0x0) ioctl$TCSETS(r1, 0x40045431, &(0x7f00000000c0)) r2 = syz_open_pts(r1, 0x0) r3 = dup3(r2, r0, 0x0) r4 = openat$selinux_status(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/status\x00', 0x0, 0x0) ioctl$TIOCMIWAIT(r4, 0x545c, 0x0) ioctl$TCXONC(r3, 0x540a, 0x0) pselect6(0x40, &(0x7f0000000340)={0x9}, 0x0, 0x0, 0x0, 0x0) 16:21:24 executing program 4: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x5, &(0x7f0000000000)=0x8400000000000002, 0x4) 16:21:24 executing program 0: syz_open_procfs(0x0, &(0x7f0000000080)='net/dev_snmp6\x00') r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00000000c0)) r1 = syz_open_pts(r0, 0x0) ioctl$TCSETS2(r1, 0x402c542b, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, 0x0, "36b71128cfa8bdd3b2da4fd6a1cb228fb9755b"}) epoll_create(0xe) pselect6(0x40, &(0x7f00000000c0)={0x3}, 0x0, &(0x7f0000000140)={0x1b7}, 0x0, 0x0) 16:21:24 executing program 5: r0 = syz_open_procfs(0x0, &(0x7f0000000080)='net/dev_snmp6\x00') socket(0x10, 0x80002, 0x0) syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) socket$nl_generic(0x10, 0x3, 0x10) syz_open_procfs(0x0, &(0x7f0000000980)='net/sofH\x16tnet_sua') socket$inet6_tcp(0xa, 0x1, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) request_key(&(0x7f0000000000)='user\x00', &(0x7f0000000040)={'syz'}, &(0x7f0000000a80), 0xfffffffffffffffd) socket$inet(0x2, 0x4000000000000001, 0x0) r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r1, 0x40045431, &(0x7f00000000c0)) r2 = syz_open_pts(r1, 0x0) r3 = dup3(r2, r0, 0x0) ioctl$TCXONC(r3, 0x540a, 0x0) [ 1794.920778] binder: 12610:12616 ioctl c0306201 200000c0 returned -22 16:21:24 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) socket$nl_generic(0x10, 0x3, 0x10) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x1ee6b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0xeb, 0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB="0563044000000000046304400000000006630440000000007997506ea39438033ada635f7cd4c9d1de50cf51e7a773b356e7348d3b19cbdc76ed97a6a08da8997815ea9e6d3b6a1d5a7c1cdf78337a6166cfd70cf41b6cb958e69b7dae4fe74a09c8e4db4c323ba219438b49c2f1736eb01b18c098512160aad1c0394bd4c9b785ea39e6f5b1f809658351bcb5f101899004e6a8542081ceec87f1a675538ce9264c7f128392c875c23507fc8a694ef2d13b127563b2da420a3df952f062dd3d46202a3466fa9a9c985dde3cc577a1fdf40687931bbc4303dbab0e28bb6757bc226d9bba4db1603de1a9c7"], 0x1, 0x0, &(0x7f00000003c0)='L'}) ioctl$TCXONC(0xffffffffffffffff, 0x540a, 0x0) 16:21:24 executing program 4: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x10000000013, &(0x7f00000001c0)=0x1, 0x4) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) r2 = dup2(r1, r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) connect$inet(r0, &(0x7f0000000040)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x18}}, 0x10) setsockopt$inet_tcp_TCP_REPAIR_OPTIONS(r0, 0x6, 0x16, &(0x7f00000000c0)=[@sack_perm, @window, @sack_perm], 0x19a) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000140)={0x0, 0x9, 0x80ffffffff}, 0x14) shutdown(r0, 0x1) 16:21:24 executing program 0: syz_open_procfs(0x0, &(0x7f0000000080)='net/dev_snmp6\x00') r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00000000c0)) r1 = syz_open_pts(r0, 0x0) ioctl$TCSETS2(r1, 0x402c542b, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, 0x0, "36b71128cfa8bdd3b2da4fd6a1cb228fb9755b"}) epoll_create(0xe) pselect6(0x40, &(0x7f00000000c0)={0x3}, 0x0, &(0x7f0000000140)={0x1b7}, 0x0, 0x0) 16:21:24 executing program 2: r0 = syz_open_procfs(0x0, &(0x7f0000000080)='net/dev_snmp6\x00') r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040)='/d\xb2\x80[4tmx\x00', 0x0, 0x0) ioctl$TCSETS(r1, 0x40045431, &(0x7f00000000c0)={0xfffffffffffffffb}) r2 = syz_open_pts(r1, 0x0) r3 = dup3(r2, r0, 0x0) close(0xffffffffffffffff) ioctl$TCXONC(r3, 0x540a, 0x0) pselect6(0x40, &(0x7f0000000340)={0x9}, 0x0, 0x0, 0x0, 0x0) [ 1795.039119] binder: 12643:12648 Acquire 1 refcount change on invalid ref 0 ret -22 [ 1795.048598] binder: 12643:12648 IncRefs 0 refcount change on invalid ref 0 ret -22 [ 1795.056622] binder: 12643:12648 Release 1 refcount change on invalid ref 0 ret -22 [ 1795.065396] binder: 12643:12648 unknown command 1850775417 16:21:24 executing program 4: r0 = socket$inet6(0xa, 0x2, 0x0) r1 = socket$packet(0x11, 0x3, 0x300) recvmmsg(r1, &(0x7f0000000300), 0x121, 0x0, 0x0) connect$inet6(r0, &(0x7f0000000100)={0xa, 0x0, 0x0, @mcast2, 0x2}, 0x1c) sendmmsg(r0, &(0x7f00000092c0), 0x4000000000001b9, 0x0) 16:21:24 executing program 0: syz_open_procfs(0x0, &(0x7f0000000080)='net/dev_snmp6\x00') r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00000000c0)) syz_open_pts(r0, 0x0) pipe(&(0x7f00000002c0)) epoll_create(0xe) pselect6(0x40, &(0x7f00000000c0)={0x3}, 0x0, &(0x7f0000000140)={0x1b7}, 0x0, 0x0) [ 1795.098924] binder: 12643:12648 ioctl c0306201 200000c0 returned -22 16:21:24 executing program 5: r0 = syz_open_procfs(0x0, &(0x7f0000000080)='net/dev_snmp6\x00') socket(0x10, 0x80002, 0x0) syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) socket$nl_generic(0x10, 0x3, 0x10) syz_open_procfs(0x0, &(0x7f0000000980)='net/sofH\x16tnet_sua') socket$inet6_tcp(0xa, 0x1, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) request_key(&(0x7f0000000000)='user\x00', &(0x7f0000000040)={'syz'}, &(0x7f0000000a80), 0xfffffffffffffffd) perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x1ee6b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r1, 0x40045431, &(0x7f00000000c0)) r2 = syz_open_pts(r1, 0x0) r3 = dup3(r2, r0, 0x0) ioctl$TCXONC(r3, 0x540a, 0x0) 16:21:25 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f00000003c0)="11dca50d5e0bcfe47bf070") r1 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r1, &(0x7f0000000100)={0x2, 0x4e20}, 0x10) connect$inet(r1, &(0x7f0000000cc0)={0x2, 0x4e20, @local}, 0x10) setsockopt$SO_TIMESTAMPING(r1, 0x1, 0x25, &(0x7f00000010c0)=0x19ff, 0x4) sendto$inet(r1, &(0x7f0000000140)="b0", 0x1, 0x0, 0x0, 0x0) r2 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x8000, 0x0) ioctl$TIOCGPGRP(r2, 0x540f, &(0x7f0000000040)) recvmmsg(r1, &(0x7f0000003b40)=[{{0x0, 0x0, 0x0}}], 0x1, 0x2000, 0x0) 16:21:25 executing program 0: syz_open_procfs(0x0, &(0x7f0000000080)='net/dev_snmp6\x00') r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00000000c0)) syz_open_pts(r0, 0x0) pipe(&(0x7f00000002c0)) epoll_create(0xe) pselect6(0x40, &(0x7f00000000c0)={0x3}, 0x0, &(0x7f0000000140)={0x1b7}, 0x0, 0x0) 16:21:25 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) socket$nl_generic(0x10, 0x3, 0x10) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x1ee6b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0xeb, 0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB="0563044000000000046304400000000006630440000000007997506ea39438033ada635f7cd4c9d1de50cf51e7a773b356e7348d3b19cbdc76ed97a6a08da8997815ea9e6d3b6a1d5a7c1cdf78337a6166cfd70cf41b6cb958e69b7dae4fe74a09c8e4db4c323ba219438b49c2f1736eb01b18c098512160aad1c0394bd4c9b785ea39e6f5b1f809658351bcb5f101899004e6a8542081ceec87f1a675538ce9264c7f128392c875c23507fc8a694ef2d13b127563b2da420a3df952f062dd3d46202a3466fa9a9c985dde3cc577a1fdf40687931bbc4303dbab0e28bb6757bc226d9bba4db1603de1a9c7"], 0x1, 0x0, &(0x7f00000003c0)='L'}) ioctl$TCXONC(0xffffffffffffffff, 0x540a, 0x0) 16:21:25 executing program 2: r0 = syz_open_procfs(0x0, &(0x7f0000000080)='net/dev_snmp6\x00') r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r1, 0x40045431, &(0x7f00000000c0)) r2 = syz_open_pts(r1, 0x0) r3 = dup3(r2, r0, 0x0) ioctl$TCXONC(r3, 0x540a, 0x0) bpf$BPF_GET_PROG_INFO(0xf, &(0x7f00000005c0)={0xffffffffffffffff, 0xc0, &(0x7f0000000500)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, ""/16, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000380)=0x8, 0x0, 0x0, 0x0, &(0x7f00000003c0)={0x1, 0x2}, 0x0, 0x0, &(0x7f0000000400)={0x3, 0xf, 0x439}, &(0x7f0000000440)=0x2, 0x0, 0x0, 0x0, 0x0, &(0x7f00000004c0)=0x2}}, 0x10) bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f0000000600)={r4}, 0xc) pipe(&(0x7f0000000480)={0xffffffffffffffff}) vmsplice(r5, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) r6 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r6, 0x40045431, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1}) syz_open_pts(r6, 0x0) pipe(&(0x7f0000000480)={0xffffffffffffffff}) vmsplice(r7, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) r8 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r9 = dup2(r8, 0xffffffffffffffff) ioctl$UI_SET_MSCBIT(r9, 0x40045568, 0x4021) ioctl$KDSKBSENT(r9, 0x4b49, &(0x7f0000000480)="1365d965a9d3b1eb3893b67f070cff3707b41c60443e4496179acf15e8a3852a2972551c2aac9607fcd214cb5fcac3aa157cc4e7b722d7a30756fdf786c11dd0ca05b68910fd2b20fbfeb774816a901fc75cf29c06de38155f8b949413f84af6777d6c427af98b187bc95b4b") r10 = syz_genetlink_get_family_id$nbd(&(0x7f0000000540)='nbd\x00') sendmsg$NBD_CMD_STATUS(r9, &(0x7f0000000640)={&(0x7f0000000500)={0x10, 0x0, 0x0, 0x2000}, 0xc, &(0x7f0000000600)={&(0x7f0000000580)={0x38, r10, 0x28, 0x70bd29, 0x25dfdbfe, {}, [@NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x3}, @NBD_ATTR_SIZE_BYTES={0xc}, @NBD_ATTR_CLIENT_FLAGS={0xc}]}, 0x38}, 0x1, 0x0, 0x0, 0x891}, 0x8081) pipe(&(0x7f0000000480)={0xffffffffffffffff}) vmsplice(r11, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) r12 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000740)='memory.events\x00', 0x0, 0x0) pipe(&(0x7f0000000480)={0xffffffffffffffff, 0xffffffffffffffff}) write(r13, &(0x7f0000000340), 0x41395527) sendmsg$NBD_CMD_RECONFIGURE(r7, &(0x7f0000000840)={&(0x7f0000000640)={0x10, 0x0, 0x0, 0x20}, 0xc, &(0x7f0000000800)={&(0x7f0000000780)={0x64, r10, 0x100, 0x70bd2c, 0x25dfdbff, {}, [@NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_SERVER_FLAGS={0xc, 0x5, 0x4}, @NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x4}, @NBD_ATTR_SOCKETS={0x24, 0x7, [{0x8, 0x1, r11}, {0x8, 0x1, r5}, {0x8, 0x1, r12}, {0x8, 0x1, r13}]}, @NBD_ATTR_TIMEOUT={0xc, 0x4, 0x9}]}, 0x64}, 0x1, 0x0, 0x0, 0x80}, 0x44000) ioctl$TCSETS2(r6, 0x402c542b, &(0x7f0000000300)={0xff, 0x6, 0x5, 0x5, 0x1, "c230137f2c9b75a3b892dbecfeb3f01b8418a5", 0x2, 0x7}) r14 = signalfd(r6, &(0x7f00000001c0)={0x2}, 0x8) pipe(&(0x7f0000000480)={0xffffffffffffffff, 0xffffffffffffffff}) write(r15, &(0x7f0000000340), 0x41395527) r16 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r16, 0x40045431, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1}) syz_open_pts(r16, 0x0) ioctl$FIDEDUPERANGE(0xffffffffffffffff, 0xc0189436, &(0x7f0000000200)={0xffb, 0x7c, 0x7, 0x0, 0x0, [{r5, 0x0, 0xeff}, {0xffffffffffffffff, 0x0, 0x3}, {r14, 0x0, 0x8}, {r15, 0x0, 0x6}, {r0, 0x0, 0x2}, {r16, 0x0, 0x2}, {r1, 0x0, 0xa2}]}) pselect6(0x40, &(0x7f0000000340)={0x9}, 0x0, 0x0, 0x0, 0x0) sendmsg$nl_route(r3, &(0x7f0000000180)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0xc0000080}, 0xc, &(0x7f0000000140)={&(0x7f0000000100)=@getroute={0x14, 0x1a, 0x811, 0x70bd25, 0x25dfdbff, {}, ["", "", "", "", "", "", "", "", ""]}, 0x14}, 0x1, 0x0, 0x0, 0x4002}, 0x40) 16:21:25 executing program 5: r0 = syz_open_procfs(0x0, &(0x7f0000000080)='net/dev_snmp6\x00') socket(0x10, 0x80002, 0x0) syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) socket$nl_generic(0x10, 0x3, 0x10) syz_open_procfs(0x0, &(0x7f0000000980)='net/sofH\x16tnet_sua') socket$inet6_tcp(0xa, 0x1, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) request_key(&(0x7f0000000000)='user\x00', &(0x7f0000000040)={'syz'}, &(0x7f0000000a80), 0xfffffffffffffffd) perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x1ee6b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r1, 0x40045431, &(0x7f00000000c0)) r2 = syz_open_pts(r1, 0x0) r3 = dup3(r2, r0, 0x0) ioctl$TCXONC(r3, 0x540a, 0x0) 16:21:25 executing program 4: socket(0x0, 0x0, 0x0) stat(0x0, 0x0) r0 = gettid() sendmsg$unix(0xffffffffffffffff, 0x0, 0x0) timer_create(0x0, &(0x7f0000044000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f0000044000)) ioctl$FS_IOC_SETFSLABEL(0xffffffffffffffff, 0x41009432, 0x0) timer_settime(0x0, 0x0, &(0x7f0000000240)={{0x0, 0x1c9c380}, {0x0, 0x9}}, 0x0) r1 = openat$full(0xffffffffffffff9c, &(0x7f0000000000)='/dev/full\x00', 0x0, 0x0) dup3(0xffffffffffffffff, r1, 0x40000) ioctl$KIOCSOUND(0xffffffffffffffff, 0x4b2f, 0x0) prctl$PR_CAPBSET_DROP(0x18, 0x13) r2 = open(&(0x7f0000000140)='.\x00', 0x0, 0x0) sched_setaffinity(r0, 0x8, &(0x7f00000002c0)=0x401) close(r2) ioctl$PERF_EVENT_IOC_ID(r2, 0x80082407, 0x0) tkill(r0, 0x1020000000016) 16:21:25 executing program 0: syz_open_procfs(0x0, &(0x7f0000000080)='net/dev_snmp6\x00') r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00000000c0)) syz_open_pts(r0, 0x0) pipe(&(0x7f00000002c0)) epoll_create(0xe) pselect6(0x40, &(0x7f00000000c0)={0x3}, 0x0, &(0x7f0000000140)={0x1b7}, 0x0, 0x0) [ 1795.787930] binder: 12678:12687 Acquire 1 refcount change on invalid ref 0 ret -22 [ 1795.801873] binder: 12678:12687 IncRefs 0 refcount change on invalid ref 0 ret -22 [ 1795.818064] binder: 12678:12687 Release 1 refcount change on invalid ref 0 ret -22 16:21:25 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) socket$nl_generic(0x10, 0x3, 0x10) perf_event_open(&(0x7f000001d000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x1ee6b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0xeb, 0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB="0563044000000000046304400000000006630440000000007997506ea39438033ada635f7cd4c9d1de50cf51e7a773b356e7348d3b19cbdc76ed97a6a08da8997815ea9e6d3b6a1d5a7c1cdf78337a6166cfd70cf41b6cb958e69b7dae4fe74a09c8e4db4c323ba219438b49c2f1736eb01b18c098512160aad1c0394bd4c9b785ea39e6f5b1f809658351bcb5f101899004e6a8542081ceec87f1a675538ce9264c7f128392c875c23507fc8a694ef2d13b127563b2da420a3df952f062dd3d46202a3466fa9a9c985dde3cc577a1fdf40687931bbc4303dbab0e28bb6757bc226d9bba4db1603de1a9c7"], 0x1, 0x0, &(0x7f00000003c0)='L'}) ioctl$TCXONC(0xffffffffffffffff, 0x540a, 0x0) [ 1795.838784] binder: 12678:12687 unknown command 1850775417 [ 1795.847212] binder: 12678:12687 ioctl c0306201 200000c0 returned -22 16:21:25 executing program 0: syz_open_procfs(0x0, &(0x7f0000000080)='net/dev_snmp6\x00') r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00000000c0)) ioctl$TCSETS2(0xffffffffffffffff, 0x402c542b, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, 0x0, "36b71128cfa8bdd3b2da4fd6a1cb228fb9755b"}) pipe(&(0x7f00000002c0)) epoll_create(0xe) pselect6(0x40, &(0x7f00000000c0)={0x3}, 0x0, &(0x7f0000000140)={0x1b7}, 0x0, 0x0) 16:21:25 executing program 5: r0 = syz_open_procfs(0x0, &(0x7f0000000080)='net/dev_snmp6\x00') socket(0x10, 0x80002, 0x0) syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) socket$nl_generic(0x10, 0x3, 0x10) syz_open_procfs(0x0, &(0x7f0000000980)='net/sofH\x16tnet_sua') socket$inet6_tcp(0xa, 0x1, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) request_key(&(0x7f0000000000)='user\x00', &(0x7f0000000040)={'syz'}, &(0x7f0000000a80), 0xfffffffffffffffd) perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x1ee6b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r1, 0x40045431, &(0x7f00000000c0)) r2 = syz_open_pts(r1, 0x0) r3 = dup3(r2, r0, 0x0) ioctl$TCXONC(r3, 0x540a, 0x0) 16:21:25 executing program 0: syz_open_procfs(0x0, &(0x7f0000000080)='net/dev_snmp6\x00') r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00000000c0)) ioctl$TCSETS2(0xffffffffffffffff, 0x402c542b, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, 0x0, "36b71128cfa8bdd3b2da4fd6a1cb228fb9755b"}) pipe(&(0x7f00000002c0)) epoll_create(0xe) pselect6(0x40, &(0x7f00000000c0)={0x3}, 0x0, &(0x7f0000000140)={0x1b7}, 0x0, 0x0) [ 1795.921790] binder: 12701:12704 Acquire 1 refcount change on invalid ref 0 ret -22 [ 1795.933813] binder: 12701:12704 IncRefs 0 refcount change on invalid ref 0 ret -22 16:21:25 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) socket$nl_generic(0x10, 0x3, 0x10) perf_event_open(&(0x7f000001d000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x1ee6b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0xeb, 0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB="0563044000000000046304400000000006630440000000007997506ea39438033ada635f7cd4c9d1de50cf51e7a773b356e7348d3b19cbdc76ed97a6a08da8997815ea9e6d3b6a1d5a7c1cdf78337a6166cfd70cf41b6cb958e69b7dae4fe74a09c8e4db4c323ba219438b49c2f1736eb01b18c098512160aad1c0394bd4c9b785ea39e6f5b1f809658351bcb5f101899004e6a8542081ceec87f1a675538ce9264c7f128392c875c23507fc8a694ef2d13b127563b2da420a3df952f062dd3d46202a3466fa9a9c985dde3cc577a1fdf40687931bbc4303dbab0e28bb6757bc226d9bba4db1603de1a9c7"], 0x1, 0x0, &(0x7f00000003c0)='L'}) ioctl$TCXONC(0xffffffffffffffff, 0x540a, 0x0) [ 1795.975072] binder: 12701:12704 Release 1 refcount change on invalid ref 0 ret -22 [ 1795.991213] binder: 12701:12704 unknown command 1850775417 [ 1795.997077] binder: 12701:12704 ioctl c0306201 200000c0 returned -22 [ 1796.091781] binder: 12722:12723 Acquire 1 refcount change on invalid ref 0 ret -22 [ 1796.099723] binder: 12722:12723 IncRefs 0 refcount change on invalid ref 0 ret -22 [ 1796.108953] binder: 12722:12723 Release 1 refcount change on invalid ref 0 ret -22 [ 1796.123749] binder: 12722:12723 unknown command 1850775417 [ 1796.129806] binder: 12722:12723 ioctl c0306201 200000c0 returned -22 16:21:26 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f00000003c0)="11dca50d5e0bcfe47bf070") r1 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r1, &(0x7f0000000100)={0x2, 0x4e20}, 0x10) connect$inet(r1, &(0x7f0000000cc0)={0x2, 0x4e20, @local}, 0x10) setsockopt$SO_TIMESTAMPING(r1, 0x1, 0x25, &(0x7f00000010c0)=0x19ff, 0x4) sendto$inet(r1, &(0x7f0000000140)="b0", 0x1, 0x0, 0x0, 0x0) recvmmsg(r1, &(0x7f0000003b40)=[{{0x0, 0x0, 0x0}}], 0x1, 0x2000, 0x0) setsockopt$inet_msfilter(r1, 0x0, 0x29, &(0x7f0000000000)={@loopback, @broadcast, 0x0, 0x2, [@empty, @multicast1]}, 0x18) 16:21:26 executing program 0: syz_open_procfs(0x0, &(0x7f0000000080)='net/dev_snmp6\x00') r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00000000c0)) ioctl$TCSETS2(0xffffffffffffffff, 0x402c542b, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, 0x0, "36b71128cfa8bdd3b2da4fd6a1cb228fb9755b"}) pipe(&(0x7f00000002c0)) epoll_create(0xe) pselect6(0x40, &(0x7f00000000c0)={0x3}, 0x0, &(0x7f0000000140)={0x1b7}, 0x0, 0x0) 16:21:26 executing program 5: r0 = syz_open_procfs(0x0, &(0x7f0000000080)='net/dev_snmp6\x00') socket(0x10, 0x80002, 0x0) syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) socket$nl_generic(0x10, 0x3, 0x10) syz_open_procfs(0x0, &(0x7f0000000980)='net/sofH\x16tnet_sua') socket$inet6_tcp(0xa, 0x1, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$inet(0x2, 0x4000000000000001, 0x0) perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x1ee6b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r1, 0x40045431, &(0x7f00000000c0)) r2 = syz_open_pts(r1, 0x0) r3 = dup3(r2, r0, 0x0) ioctl$TCXONC(r3, 0x540a, 0x0) 16:21:26 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) socket$nl_generic(0x10, 0x3, 0x10) perf_event_open(&(0x7f000001d000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x1ee6b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0xeb, 0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB="0563044000000000046304400000000006630440000000007997506ea39438033ada635f7cd4c9d1de50cf51e7a773b356e7348d3b19cbdc76ed97a6a08da8997815ea9e6d3b6a1d5a7c1cdf78337a6166cfd70cf41b6cb958e69b7dae4fe74a09c8e4db4c323ba219438b49c2f1736eb01b18c098512160aad1c0394bd4c9b785ea39e6f5b1f809658351bcb5f101899004e6a8542081ceec87f1a675538ce9264c7f128392c875c23507fc8a694ef2d13b127563b2da420a3df952f062dd3d46202a3466fa9a9c985dde3cc577a1fdf40687931bbc4303dbab0e28bb6757bc226d9bba4db1603de1a9c7"], 0x1, 0x0, &(0x7f00000003c0)='L'}) ioctl$TCXONC(0xffffffffffffffff, 0x540a, 0x0) 16:21:26 executing program 2: r0 = gettid() ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x3c) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r0, 0x0, 0x0) r1 = syz_open_procfs(r0, &(0x7f0000000000)='net/rfcomm\x00') sendmsg$IPVS_CMD_GET_DAEMON(r1, &(0x7f0000000280)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000240)={&(0x7f0000000140)={0xc4, 0x0, 0x100, 0x70bd2b, 0x25dfdbff, {}, [@IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0x4}, @IPVS_CMD_ATTR_SERVICE={0x10, 0x1, [@IPVS_SVC_ATTR_FLAGS={0xc, 0x7, {0x4a532095e7e26c50, 0x4}}]}, @IPVS_CMD_ATTR_DEST={0x38, 0x2, [@IPVS_DEST_ATTR_ADDR={0x14, 0x1, @ipv6=@local}, @IPVS_DEST_ATTR_FWD_METHOD={0x8, 0x3, 0x6}, @IPVS_DEST_ATTR_PORT={0x8, 0x2, 0x4e24}, @IPVS_DEST_ATTR_ACTIVE_CONNS={0x8}, @IPVS_DEST_ATTR_WEIGHT={0x8, 0x4, 0x7}]}, @IPVS_CMD_ATTR_SERVICE={0x30, 0x1, [@IPVS_SVC_ATTR_NETMASK={0x8, 0x9, 0x3f}, @IPVS_SVC_ATTR_NETMASK={0x8, 0x9, 0x72}, @IPVS_SVC_ATTR_FLAGS={0xc, 0x7, {0x22, 0x2a}}, @IPVS_SVC_ATTR_SCHED_NAME={0x8, 0x6, 'nq\x00'}, @IPVS_SVC_ATTR_TIMEOUT={0x8, 0x8, 0x7f}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x401}, @IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0x1}, @IPVS_CMD_ATTR_DEST={0x20, 0x2, [@IPVS_DEST_ATTR_ADDR={0x14, 0x1, @ipv6=@rand_addr="a74a36dcf9ec96f8e6c2e34834f8f7d5"}, @IPVS_DEST_ATTR_ADDR_FAMILY={0x8, 0xb, 0xa}]}]}, 0xc4}, 0x1, 0x0, 0x0, 0x810}, 0x2) r2 = syz_open_procfs(0x0, &(0x7f0000000080)='net/dev_snmp6\x00') r3 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r3, 0x40045431, &(0x7f00000000c0)) r4 = syz_open_pts(r3, 0x0) r5 = dup3(r4, r2, 0x0) ioctl$TCXONC(r5, 0x540a, 0x0) pselect6(0x40, &(0x7f0000000340)={0x9}, 0x0, 0x0, 0x0, 0x0) [ 1796.730675] binder: 12734:12740 Acquire 1 refcount change on invalid ref 0 ret -22 [ 1796.738647] binder: 12734:12740 IncRefs 0 refcount change on invalid ref 0 ret -22 [ 1796.756732] binder: 12734:12740 Release 1 refcount change on invalid ref 0 ret -22 [ 1796.770496] binder: 12734:12740 unknown command 1850775417 [ 1796.776632] binder: 12734:12740 ioctl c0306201 200000c0 returned -22 16:21:28 executing program 4: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCGPKT(r0, 0x80045438, &(0x7f0000000100)) 16:21:28 executing program 0: syz_open_procfs(0x0, &(0x7f0000000080)='net/dev_snmp6\x00') r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ptmx\x00', 0x0, 0x0) r1 = syz_open_pts(r0, 0x0) ioctl$TCSETS2(r1, 0x402c542b, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, 0x0, "36b71128cfa8bdd3b2da4fd6a1cb228fb9755b"}) pipe(&(0x7f00000002c0)) epoll_create(0xe) pselect6(0x40, &(0x7f00000000c0)={0x3}, 0x0, &(0x7f0000000140)={0x1b7}, 0x0, 0x0) 16:21:28 executing program 2: r0 = syz_open_procfs(0x0, &(0x7f0000000080)='net/dev_snmp6\x00') r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ptmx\x00', 0x400, 0x0) ioctl$TCSETS(r1, 0x40045431, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7}) r2 = syz_open_pts(r1, 0x0) r3 = dup3(r2, r0, 0x0) ioctl$TCXONC(r3, 0x540a, 0x0) pselect6(0x40, &(0x7f0000000340)={0x9}, 0x0, 0x0, 0x0, 0x0) 16:21:28 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) socket$nl_generic(0x10, 0x3, 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x1ee6b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0xeb, 0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB="0563044000000000046304400000000006630440000000007997506ea39438033ada635f7cd4c9d1de50cf51e7a773b356e7348d3b19cbdc76ed97a6a08da8997815ea9e6d3b6a1d5a7c1cdf78337a6166cfd70cf41b6cb958e69b7dae4fe74a09c8e4db4c323ba219438b49c2f1736eb01b18c098512160aad1c0394bd4c9b785ea39e6f5b1f809658351bcb5f101899004e6a8542081ceec87f1a675538ce9264c7f128392c875c23507fc8a694ef2d13b127563b2da420a3df952f062dd3d46202a3466fa9a9c985dde3cc577a1fdf40687931bbc4303dbab0e28bb6757bc226d9bba4db1603de1a9c7"], 0x1, 0x0, &(0x7f00000003c0)='L'}) ioctl$TCXONC(0xffffffffffffffff, 0x540a, 0x0) 16:21:28 executing program 5: r0 = syz_open_procfs(0x0, &(0x7f0000000080)='net/dev_snmp6\x00') socket(0x10, 0x80002, 0x0) syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) socket$nl_generic(0x10, 0x3, 0x10) syz_open_procfs(0x0, &(0x7f0000000980)='net/sofH\x16tnet_sua') socket$inet6_tcp(0xa, 0x1, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$inet(0x2, 0x4000000000000001, 0x0) perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x1ee6b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r1, 0x40045431, &(0x7f00000000c0)) r2 = syz_open_pts(r1, 0x0) r3 = dup3(r2, r0, 0x0) ioctl$TCXONC(r3, 0x540a, 0x0) 16:21:28 executing program 3: socket$inet_udplite(0x2, 0x2, 0x88) r0 = openat$selinux_validatetrans(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/validatetrans\x00', 0x1, 0x0) ioctl(r0, 0x20, &(0x7f00000003c0)="11dca50d5e0bcfe47bf070") r1 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r1, &(0x7f0000000100)={0x2, 0x4e22, @multicast2}, 0x10) connect$inet(r1, &(0x7f0000000cc0)={0x2, 0x4e20, @local}, 0x10) setsockopt$SO_TIMESTAMPING(r1, 0x1, 0x25, &(0x7f00000010c0)=0x19ff, 0x4) sendto$inet(r1, &(0x7f0000000140)="b0", 0x1, 0x0, 0x0, 0x0) recvmmsg(r1, &(0x7f0000003b40)=[{{0x0, 0x0, 0x0}}], 0x1, 0x2000, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) [ 1798.823984] binder: 12757:12763 Acquire 1 refcount change on invalid ref 0 ret -22 [ 1798.834305] binder: 12757:12763 IncRefs 0 refcount change on invalid ref 0 ret -22 [ 1798.842762] binder: 12757:12763 Release 1 refcount change on invalid ref 0 ret -22 [ 1798.850760] binder: 12757:12763 unknown command 1850775417 16:21:28 executing program 0: syz_open_procfs(0x0, &(0x7f0000000080)='net/dev_snmp6\x00') r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ptmx\x00', 0x0, 0x0) r1 = syz_open_pts(r0, 0x0) ioctl$TCSETS2(r1, 0x402c542b, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, 0x0, "36b71128cfa8bdd3b2da4fd6a1cb228fb9755b"}) pipe(&(0x7f00000002c0)) epoll_create(0xe) pselect6(0x40, &(0x7f00000000c0)={0x3}, 0x0, &(0x7f0000000140)={0x1b7}, 0x0, 0x0) 16:21:28 executing program 5: r0 = syz_open_procfs(0x0, &(0x7f0000000080)='net/dev_snmp6\x00') socket(0x10, 0x80002, 0x0) syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) socket$nl_generic(0x10, 0x3, 0x10) syz_open_procfs(0x0, &(0x7f0000000980)='net/sofH\x16tnet_sua') socket$inet6_tcp(0xa, 0x1, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$inet(0x2, 0x4000000000000001, 0x0) perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x1ee6b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r1, 0x40045431, &(0x7f00000000c0)) r2 = syz_open_pts(r1, 0x0) r3 = dup3(r2, r0, 0x0) ioctl$TCXONC(r3, 0x540a, 0x0) [ 1798.869231] binder: 12757:12763 ioctl c0306201 200000c0 returned -22 16:21:28 executing program 0: syz_open_procfs(0x0, &(0x7f0000000080)='net/dev_snmp6\x00') r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ptmx\x00', 0x0, 0x0) r1 = syz_open_pts(r0, 0x0) ioctl$TCSETS2(r1, 0x402c542b, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, 0x0, "36b71128cfa8bdd3b2da4fd6a1cb228fb9755b"}) pipe(&(0x7f00000002c0)) epoll_create(0xe) pselect6(0x40, &(0x7f00000000c0)={0x3}, 0x0, &(0x7f0000000140)={0x1b7}, 0x0, 0x0) 16:21:28 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="11dca50d5e0bcfe47bf070") sendmsg$key(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000000)={0x0, 0xd}}, 0x0) sendmsg$key(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000880)=ANY=[@ANYBLOB="020a0c0002000000cd100006000000f44734a56bba22ec768c028f6996cfe6a301000000000000007938ac638f3d988f4f0aaabae570050000004096066c905b049fdddd15e7bccc7b2339dd21b8148588a244e738650fc97eb9e2f513e609f88f1e3764582713656eab94255517623c7aecd5e99f49a524608fb89ced5d55ae0aab46bacd1b4c5579b8d5c181a0406b8efe3ff921777c6a417cf8ee1f5174637001000000340498970800000000000000a92ad66067419b1eee0f64253c7effc8aac79856687a9a55522b94a95721d42e847d5b1a89681e5a7a00bb0efdc57b33e715a9658074b64ca565cee3baae66fe2ccdbea9a9c486d96fe345cabd182ba5b8d0a43dc73ce6d09b1fbf8fe2291ae15f971950fc8d8f320ae28bf1e271e467872a54ce6689c1e70be12df9210f1f1d897bc377c444921c40b333c4ad58fd11eb2a0b9e4999f57b291f6ffa2e17190576af587ebdf6cbb3000000065f0500000000000000658df404f2a968d13c0ecadaedfd768c116b75b8a2d495e67190033c32c29be4afb58fc6040009cd8e2307e8031dd0c11538aedcfb94e69333877e31cd97409ba5e2b41a1a38fe4823c5425a070000000000000023cab437bb6829d07c204084ef5d20af60b5d743908a2e9ab388bf1e72fb184ff906fdc4333a1c5f4c00b23f3dcefc632978f2f1b969fbc05d1d19c1fac15475ef6b2269402ebd2f04480537ea624c001658795a68e4a2ab96d241805409e1cafb8a9a3f1f1156f8660481a69ca75d28542cdbe5b804cb73f7a3b24343ecd64e2c8eef608dc9f14e4eded30b434e61b13e1d4b997da792b5cd6b9cfcc478a4cc7e72aa2b4562c69d12ef506d72d2369e3d5247e97042122450eb5086dc0005fffdf466e015858965c799becc813321ef9c20d0145d2300000000000000000000000000000827032f004771bf06b6ab418afdfb919c38fd2a2d09000000bd50d5408fba0217a6f88ee4dd082d674f59515fc4e18f1a818098690600000096a5eb83e8980777d26259ed898c000000fd13297cb7f57a5ec78c60b8b9a30100c49de65e492265c34268ff31c750687db1e362ed545898d8cfbef08d660ba9b12a3b1243ffc5d87c31ca99fb84a1ae581716da3bf234d7573886dc50c5d3a194a8df607aa424c0826e34cf9ea1e0ba9144abae10ad04de70abafe8ad4b26878b31cdaa52171a037af72dc6b029df2dd0ef0125b44f1c8de7a765c0848862c733df81a0cfcc3be8aa0f7ab9bfdc6ea5c3447d1393c07f30e853000000007e688ca05c948b9ba61f3e8d5b889b8b4e43b94a67f09bd9301f72d85ca2f080a3050e7437ea2b0b96dbcf6f4f7cbeabfb42fcce139b8ea504e7e9527a9b71b4456dcc5083a01cec4d6fac69477dc001c82e5540945e0383a8fe67ecf34ccca6f01efdc5de434b862cf44593be81a8e104d3c61d1edb19599cdea97220a50c3694c5b314b458680443875b93bbb3d40b4df77702d40fdeb3e284dc57dec1000000f9754d436b78ab53a9a4000000000000000000000094a0db2b5857e3f79e10b8838d3c9f0536b1038e534b18fa6e63c8d931eb699e45171d76c730d6d49320f9ede905a46c273fbb9d7a52a152494d0941803095460272cad84f8af8ecca6cce0657bdde6a995344407125702b741ce7898fc627dd334295e7ccf3986967bbcb27575ed9e70f175a26518cf5d4432e8cf392788def32d981735dd031efe3a520d712d2ad9f5b90d56ffa457364b96ab7ad3356d0b1b011a3e39936a03f002733516121e6df834a8d10131ee888b9d81dacf7140f440763a08b62e93258656c940decd1513408e0ec57f195df327e679b5dc1a015543f5cce155e9c4473e9a99df66ddf9f612e91826f40cdd95abc8c9d6d4e200bf9939f10bdaa3d7a76167f61db3e7bc14e2368080000e08a21075ae984c7e3bf919940247d774bb4dafc20b217e9609e9121baddf50065f2067b3d688276ac1577fc6d67b3fcd142b4d4cd1ac8f25c3e280978363656557f38995f2fc40e59b5af550741ad48c271f299587d4bfcabaed65139e1ef39050e7316b6835c88030d9f16573721d2977511a6a85fb40e47a22f425d0469c547834a4851ead5a36d2e3827cba513a335dabb550bf85d7cceb9c725a0577bd7bc0cc2836d06519cf4055abfad247d9fd29997f4605b5d3f2bdbcdf50f4cd5095a6a1be72f6c468012d75bdab8247ce7c3ca1cce2c9bff0897e34648f580e96e88ef4346af68d2a8ac6fdf543281c813a6dfc7a3a3ca3810bfe905494fca0b1110c50fc3cf42288a3ba98e30457917a29692bd175a83ba4256"], 0x10}}, 0x0) r1 = socket$key(0xf, 0x3, 0x2) sendmmsg(r1, &(0x7f0000000180), 0x39d691fb8bff151, 0x0) 16:21:28 executing program 2: perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x42, 0x8001, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) creat(&(0x7f00000004c0)='./bus\x00', 0x0) 16:21:28 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) socket$nl_generic(0x10, 0x3, 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x1ee6b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0xeb, 0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB="0563044000000000046304400000000006630440000000007997506ea39438033ada635f7cd4c9d1de50cf51e7a773b356e7348d3b19cbdc76ed97a6a08da8997815ea9e6d3b6a1d5a7c1cdf78337a6166cfd70cf41b6cb958e69b7dae4fe74a09c8e4db4c323ba219438b49c2f1736eb01b18c098512160aad1c0394bd4c9b785ea39e6f5b1f809658351bcb5f101899004e6a8542081ceec87f1a675538ce9264c7f128392c875c23507fc8a694ef2d13b127563b2da420a3df952f062dd3d46202a3466fa9a9c985dde3cc577a1fdf40687931bbc4303dbab0e28bb6757bc226d9bba4db1603de1a9c7"], 0x1, 0x0, &(0x7f00000003c0)='L'}) ioctl$TCXONC(0xffffffffffffffff, 0x540a, 0x0) 16:21:28 executing program 0: syz_open_procfs(0x0, &(0x7f0000000080)='net/dev_snmp6\x00') ioctl$TCSETS(0xffffffffffffffff, 0x40045431, &(0x7f00000000c0)) r0 = syz_open_pts(0xffffffffffffffff, 0x0) ioctl$TCSETS2(r0, 0x402c542b, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, 0x0, "36b71128cfa8bdd3b2da4fd6a1cb228fb9755b"}) pipe(&(0x7f00000002c0)) epoll_create(0xe) pselect6(0x40, &(0x7f00000000c0)={0x3}, 0x0, &(0x7f0000000140)={0x1b7}, 0x0, 0x0) 16:21:28 executing program 2: r0 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_fanout(r0, 0x107, 0x12, &(0x7f0000000000)={0x0, 0x3}, 0x4) syz_emit_ethernet(0x300cce, &(0x7f0000000080)=ANY=[@ANYBLOB="aaaaaaaaaaaa0000000000008100000086dd60b409000008000002024300800080000000ffffe0000002ff02000000000000deffffffffffff003c0090780007040060b680fa0000000000000000000000000000ffffffffffff000000000000000000000000ac14ffbb"], 0x0) 16:21:28 executing program 5: r0 = syz_open_procfs(0x0, &(0x7f0000000080)='net/dev_snmp6\x00') socket(0x10, 0x80002, 0x0) syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) socket$nl_generic(0x10, 0x3, 0x10) syz_open_procfs(0x0, &(0x7f0000000980)='net/sofH\x16tnet_sua') socket$inet6_tcp(0xa, 0x1, 0x0) socket$inet(0x2, 0x4000000000000001, 0x0) perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x1ee6b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r1, 0x40045431, &(0x7f00000000c0)) r2 = syz_open_pts(r1, 0x0) r3 = dup3(r2, r0, 0x0) ioctl$TCXONC(r3, 0x540a, 0x0) [ 1799.031286] binder: 12786:12788 Acquire 1 refcount change on invalid ref 0 ret -22 [ 1799.050968] binder: 12786:12788 IncRefs 0 refcount change on invalid ref 0 ret -22 [ 1799.071021] binder: 12786:12788 Release 1 refcount change on invalid ref 0 ret -22 16:21:28 executing program 0: syz_open_procfs(0x0, &(0x7f0000000080)='net/dev_snmp6\x00') ioctl$TCSETS(0xffffffffffffffff, 0x40045431, &(0x7f00000000c0)) r0 = syz_open_pts(0xffffffffffffffff, 0x0) ioctl$TCSETS2(r0, 0x402c542b, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, 0x0, "36b71128cfa8bdd3b2da4fd6a1cb228fb9755b"}) pipe(&(0x7f00000002c0)) epoll_create(0xe) pselect6(0x40, &(0x7f00000000c0)={0x3}, 0x0, &(0x7f0000000140)={0x1b7}, 0x0, 0x0) 16:21:28 executing program 4: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000300)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(0xffffffffffffffff, 0x5423, 0x0) ioctl$KDDISABIO(r0, 0x4b37) [ 1799.115457] binder: 12786:12788 unknown command 1850775417 [ 1799.129212] binder: 12786:12788 ioctl c0306201 200000c0 returned -22 16:21:29 executing program 0: syz_open_procfs(0x0, &(0x7f0000000080)='net/dev_snmp6\x00') ioctl$TCSETS(0xffffffffffffffff, 0x40045431, &(0x7f00000000c0)) r0 = syz_open_pts(0xffffffffffffffff, 0x0) ioctl$TCSETS2(r0, 0x402c542b, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, 0x0, "36b71128cfa8bdd3b2da4fd6a1cb228fb9755b"}) pipe(&(0x7f00000002c0)) epoll_create(0xe) pselect6(0x40, &(0x7f00000000c0)={0x3}, 0x0, &(0x7f0000000140)={0x1b7}, 0x0, 0x0) 16:21:29 executing program 5: r0 = syz_open_procfs(0x0, &(0x7f0000000080)='net/dev_snmp6\x00') socket(0x10, 0x80002, 0x0) syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) socket$nl_generic(0x10, 0x3, 0x10) syz_open_procfs(0x0, &(0x7f0000000980)='net/sofH\x16tnet_sua') socket$inet(0x2, 0x4000000000000001, 0x0) perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x1ee6b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r1, 0x40045431, &(0x7f00000000c0)) r2 = syz_open_pts(r1, 0x0) r3 = dup3(r2, r0, 0x0) ioctl$TCXONC(r3, 0x540a, 0x0) 16:21:29 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00000000c0)) r1 = syz_open_pts(r0, 0x0) ioctl$TCSETS(r1, 0x5402, &(0x7f0000000000)={0x0, 0x0, 0x0, 0xd6d7}) 16:21:29 executing program 4: socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000005c0)={0xffffffffffffffff, 0xffffffffffffffff}) pipe(&(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) splice(r0, 0x0, r2, 0x0, 0x5, 0x0) r3 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r3, 0x1000008912, &(0x7f0000000000)="11dca50d5e0bcfe47bf070") write$P9_RWSTAT(r1, &(0x7f0000000040)={0xffffff30}, 0x4) 16:21:29 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) socket$nl_generic(0x10, 0x3, 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x1ee6b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0xeb, 0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB="0563044000000000046304400000000006630440000000007997506ea39438033ada635f7cd4c9d1de50cf51e7a773b356e7348d3b19cbdc76ed97a6a08da8997815ea9e6d3b6a1d5a7c1cdf78337a6166cfd70cf41b6cb958e69b7dae4fe74a09c8e4db4c323ba219438b49c2f1736eb01b18c098512160aad1c0394bd4c9b785ea39e6f5b1f809658351bcb5f101899004e6a8542081ceec87f1a675538ce9264c7f128392c875c23507fc8a694ef2d13b127563b2da420a3df952f062dd3d46202a3466fa9a9c985dde3cc577a1fdf40687931bbc4303dbab0e28bb6757bc226d9bba4db1603de1a9c7"], 0x1, 0x0, &(0x7f00000003c0)='L'}) ioctl$TCXONC(0xffffffffffffffff, 0x540a, 0x0) 16:21:29 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f00000003c0)="11dca50d5e0bcfe47bf070") r1 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r1, &(0x7f0000000100)={0x2, 0x4e20}, 0x10) connect$inet(r1, &(0x7f0000000cc0)={0x2, 0x4e20, @local}, 0x10) setsockopt$SO_TIMESTAMPING(r1, 0x1, 0x25, &(0x7f00000010c0)=0x19ff, 0x4) sendto$inet(r1, &(0x7f0000000140)="b0", 0x1, 0x0, 0x0, 0x0) mincore(&(0x7f0000fff000/0x1000)=nil, 0x1000, &(0x7f0000000000)=""/126) recvmmsg(r1, &(0x7f0000003b40), 0x0, 0x2000, 0x0) socket$nl_xfrm(0x10, 0x3, 0x6) r2 = openat$full(0xffffffffffffff9c, &(0x7f0000000080)='/dev/full\x00', 0x12040, 0x0) r3 = openat$selinux_mls(0xffffffffffffff9c, &(0x7f0000000140)='/selinux/mls\x00', 0x0, 0x0) r4 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000200)='TIPCv2\x00') sendmsg$TIPC_NL_BEARER_SET(r3, &(0x7f00000002c0)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x20000}, 0xc, &(0x7f0000000240)={&(0x7f00000003c0)={0x128, r4, 0x100, 0x70bd29, 0x25dfdbff, {}, [@TIPC_NLA_MEDIA={0x38, 0x5, [@TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'ib\x00'}, @TIPC_NLA_MEDIA_PROP={0x24, 0x2, [@TIPC_NLA_PROP_WIN={0x8, 0x3, 0x7a2d627a}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x1}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x3}, @TIPC_NLA_PROP_PRIO={0x8}]}, @TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'ib\x00'}]}, @TIPC_NLA_NODE={0x14, 0x6, [@TIPC_NLA_NODE_ADDR={0x8, 0x1, 0x3}, @TIPC_NLA_NODE_ADDR={0x8, 0x1, 0x4a49}]}, @TIPC_NLA_LINK={0x28, 0x4, [@TIPC_NLA_LINK_PROP={0x24, 0x7, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x11}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x1f}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_WIN={0x8}]}]}, @TIPC_NLA_LINK={0xa0, 0x4, [@TIPC_NLA_LINK_PROP={0x14, 0x7, [@TIPC_NLA_PROP_WIN={0x8}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x8}]}, @TIPC_NLA_LINK_PROP={0x24, 0x7, [@TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x5}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x4}]}, @TIPC_NLA_LINK_NAME={0xc, 0x1, 'syz1\x00'}, @TIPC_NLA_LINK_PROP={0x1c, 0x7, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0x92ce}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x5}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x8}]}, @TIPC_NLA_LINK_PROP={0x3c, 0x7, [@TIPC_NLA_PROP_TOL={0x8, 0x2, 0x8}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x8}, @TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x4}, @TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_TOL={0x8}]}]}]}, 0x128}}, 0x0) getsockopt$IP_VS_SO_GET_VERSION(0xffffffffffffffff, 0x0, 0x480, &(0x7f0000000340), &(0x7f0000000380)=0x40) sendmsg$TIPC_NL_BEARER_ADD(r2, &(0x7f0000000300)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f00000002c0)={&(0x7f0000000180)={0x130, r4, 0x400, 0x70bd29, 0x25dfdbff, {}, [@TIPC_NLA_MEDIA={0x38, 0x5, [@TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'eth\x00'}, @TIPC_NLA_MEDIA_PROP={0x2c, 0x2, [@TIPC_NLA_PROP_TOL={0x8, 0x2, 0xc0000000000000}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x4}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x4a}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x1}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0xff}]}]}, @TIPC_NLA_NET={0x34, 0x7, [@TIPC_NLA_NET_NODEID={0xc, 0x3, 0x1}, @TIPC_NLA_NET_ID={0x8, 0x1, 0x3f}, @TIPC_NLA_NET_ADDR={0x8, 0x2, 0x6}, @TIPC_NLA_NET_NODEID_W1={0xc, 0x4, 0x4}, @TIPC_NLA_NET_ID={0x8, 0x1, 0xc}]}, @TIPC_NLA_NET={0x50, 0x7, [@TIPC_NLA_NET_NODEID={0xc, 0x3, 0x4}, @TIPC_NLA_NET_NODEID={0xc, 0x3, 0x401}, @TIPC_NLA_NET_ID={0x8, 0x1, 0xfffffffffffffffc}, @TIPC_NLA_NET_NODEID={0xc, 0x3, 0x2afe}, @TIPC_NLA_NET_ID={0x8, 0x1, 0x340}, @TIPC_NLA_NET_ADDR={0x8, 0x2, 0x6}, @TIPC_NLA_NET_ADDR={0x8, 0x2, 0x6180b416}, @TIPC_NLA_NET_ID={0x8, 0x1, 0x6}]}, @TIPC_NLA_NODE={0x28, 0x6, [@TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_ADDR={0x8, 0x1, 0xffffffffffffffff}, @TIPC_NLA_NODE_ADDR={0x8, 0x1, 0x8}, @TIPC_NLA_NODE_ADDR={0x8, 0x1, 0x800}, @TIPC_NLA_NODE_ADDR={0x8, 0x1, 0x7}]}, @TIPC_NLA_MEDIA={0x38, 0x5, [@TIPC_NLA_MEDIA_PROP={0x34, 0x2, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0x25}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x3ff}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x8}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x3}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x3}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x400}]}]}]}, 0x130}, 0x1, 0x0, 0x0, 0x8008090}, 0x20000000) 16:21:29 executing program 0: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00000000c0)) r1 = syz_open_pts(r0, 0x0) ioctl$TCSETS2(r1, 0x402c542b, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, 0x0, "36b71128cfa8bdd3b2da4fd6a1cb228fb9755b"}) pipe(&(0x7f00000002c0)) epoll_create(0xe) pselect6(0x40, &(0x7f00000000c0)={0x3}, 0x0, &(0x7f0000000140)={0x1b7}, 0x0, 0x0) [ 1799.627159] binder: 12815:12818 Acquire 1 refcount change on invalid ref 0 ret -22 [ 1799.652201] binder: 12815:12818 IncRefs 0 refcount change on invalid ref 0 ret -22 [ 1799.660936] binder: 12815:12818 Release 1 refcount change on invalid ref 0 ret -22 [ 1799.668921] binder: 12815:12818 unknown command 1850775417 16:21:29 executing program 2: r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.cpu\x00', 0x200002, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000080)='./bus\x00', 0x0) r2 = creat(&(0x7f0000000180)='./bus\x00', 0x0) r3 = open(&(0x7f000000fffa)='./bus\x00', 0x141042, 0x0) ioctl$FS_IOC_RESVSP(r3, 0x40305828, &(0x7f0000000040)={0x0, 0x0, 0x0, 0x40e}) r4 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r4, 0x1000008912, &(0x7f0000000040)="11dca50d5e0bcfe47bf070") write$cgroup_type(r2, &(0x7f0000000340)='threaded\x00', 0x100000078) ioctl$FS_IOC_FIEMAP(r1, 0xc020660b, &(0x7f0000000280)=ANY=[@ANYBLOB="000000000000000051ff"]) 16:21:29 executing program 5: r0 = syz_open_procfs(0x0, &(0x7f0000000080)='net/dev_snmp6\x00') socket(0x10, 0x80002, 0x0) syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) socket$nl_generic(0x10, 0x3, 0x10) socket$inet(0x2, 0x4000000000000001, 0x0) perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x1ee6b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r1, 0x40045431, &(0x7f00000000c0)) r2 = syz_open_pts(r1, 0x0) r3 = dup3(r2, r0, 0x0) ioctl$TCXONC(r3, 0x540a, 0x0) 16:21:29 executing program 0: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00000000c0)) r1 = syz_open_pts(r0, 0x0) ioctl$TCSETS2(r1, 0x402c542b, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, 0x0, "36b71128cfa8bdd3b2da4fd6a1cb228fb9755b"}) pipe(&(0x7f00000002c0)) epoll_create(0xe) pselect6(0x40, &(0x7f00000000c0)={0x3}, 0x0, &(0x7f0000000140)={0x1b7}, 0x0, 0x0) [ 1799.682081] binder: 12815:12818 ioctl c0306201 200000c0 returned -22 16:21:29 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) socket$nl_generic(0x10, 0x3, 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x1ee6b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0xeb, 0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB="0563044000000000046304400000000006630440000000007997506ea39438033ada635f7cd4c9d1de50cf51e7a773b356e7348d3b19cbdc76ed97a6a08da8997815ea9e6d3b6a1d5a7c1cdf78337a6166cfd70cf41b6cb958e69b7dae4fe74a09c8e4db4c323ba219438b49c2f1736eb01b18c098512160aad1c0394bd4c9b785ea39e6f5b1f809658351bcb5f101899004e6a8542081ceec87f1a675538ce9264c7f128392c875c23507fc8a694ef2d13b127563b2da420a3df952f062dd3d46202a3466fa9a9c985dde3cc577a1fdf40687931bbc4303dbab0e28bb6757bc226d9bba4db1603de1a9c7"], 0x1, 0x0, &(0x7f00000003c0)='L'}) ioctl$TCXONC(0xffffffffffffffff, 0x540a, 0x0) 16:21:29 executing program 4: r0 = perf_event_open(&(0x7f0000000000)={0x2, 0x70, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$PERF_EVENT_IOC_SET_FILTER(r0, 0x40082406, &(0x7f0000000080)='vboxnet0%@)eth0selinux\x00') 16:21:29 executing program 5: r0 = syz_open_procfs(0x0, &(0x7f0000000080)='net/dev_snmp6\x00') socket(0x10, 0x80002, 0x0) syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) socket$inet(0x2, 0x4000000000000001, 0x0) perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x1ee6b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r1, 0x40045431, &(0x7f00000000c0)) r2 = syz_open_pts(r1, 0x0) r3 = dup3(r2, r0, 0x0) ioctl$TCXONC(r3, 0x540a, 0x0) 16:21:29 executing program 0: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00000000c0)) r1 = syz_open_pts(r0, 0x0) ioctl$TCSETS2(r1, 0x402c542b, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, 0x0, "36b71128cfa8bdd3b2da4fd6a1cb228fb9755b"}) pipe(&(0x7f00000002c0)) epoll_create(0xe) pselect6(0x40, &(0x7f00000000c0)={0x3}, 0x0, &(0x7f0000000140)={0x1b7}, 0x0, 0x0) [ 1799.865236] binder: 12842:12849 Acquire 1 refcount change on invalid ref 0 ret -22 [ 1799.882177] binder: 12842:12849 IncRefs 0 refcount change on invalid ref 0 ret -22 16:21:29 executing program 0: syz_open_procfs(0x0, 0x0) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00000000c0)) r1 = syz_open_pts(r0, 0x0) ioctl$TCSETS2(r1, 0x402c542b, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, 0x0, "36b71128cfa8bdd3b2da4fd6a1cb228fb9755b"}) pipe(&(0x7f00000002c0)) epoll_create(0xe) pselect6(0x40, &(0x7f00000000c0)={0x3}, 0x0, &(0x7f0000000140)={0x1b7}, 0x0, 0x0) 16:21:29 executing program 5: r0 = syz_open_procfs(0x0, &(0x7f0000000080)='net/dev_snmp6\x00') socket(0x10, 0x80002, 0x0) socket$inet(0x2, 0x4000000000000001, 0x0) perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x1ee6b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r1, 0x40045431, &(0x7f00000000c0)) r2 = syz_open_pts(r1, 0x0) r3 = dup3(r2, r0, 0x0) ioctl$TCXONC(r3, 0x540a, 0x0) 16:21:29 executing program 4: io_setup(0x5, &(0x7f0000000180)=0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/net/tun\x00', 0x129202, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000000)={'hsr0\x00', 0xd432}) io_submit(r0, 0x477, &(0x7f00000001c0)=[&(0x7f00000003c0)={0x0, 0x0, 0x0, 0x800000000001, 0x0, r1, &(0x7f0000000080), 0x200100be}]) [ 1799.906063] binder: 12842:12849 Release 1 refcount change on invalid ref 0 ret -22 [ 1799.922753] binder: 12842:12849 unknown command 1850775417 [ 1799.969874] binder: 12842:12849 ioctl c0306201 200000c0 returned -22 16:21:30 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f00000003c0)="11dca50d5e0bcfe47bf070") r1 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r1, &(0x7f0000000100)={0x2, 0x4e20}, 0x10) connect$inet(r1, &(0x7f0000000cc0)={0x2, 0x4e20, @local}, 0x10) setsockopt$SO_TIMESTAMPING(r1, 0x1, 0x25, &(0x7f00000010c0)=0x19ff, 0x4) sendto$inet(r1, &(0x7f0000000140)="b0", 0xfffffffffffffe33, 0x0, 0x0, 0x0) recvmmsg(r1, &(0x7f0000003b40)=[{{0x0, 0x0, 0x0}}], 0x1, 0x2000, 0x0) 16:21:30 executing program 0: syz_open_procfs(0x0, 0x0) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00000000c0)) r1 = syz_open_pts(r0, 0x0) ioctl$TCSETS2(r1, 0x402c542b, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, 0x0, "36b71128cfa8bdd3b2da4fd6a1cb228fb9755b"}) pipe(&(0x7f00000002c0)) epoll_create(0xe) pselect6(0x40, &(0x7f00000000c0)={0x3}, 0x0, &(0x7f0000000140)={0x1b7}, 0x0, 0x0) 16:21:30 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) socket$nl_generic(0x10, 0x3, 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0xeb, 0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB="0563044000000000046304400000000006630440000000007997506ea39438033ada635f7cd4c9d1de50cf51e7a773b356e7348d3b19cbdc76ed97a6a08da8997815ea9e6d3b6a1d5a7c1cdf78337a6166cfd70cf41b6cb958e69b7dae4fe74a09c8e4db4c323ba219438b49c2f1736eb01b18c098512160aad1c0394bd4c9b785ea39e6f5b1f809658351bcb5f101899004e6a8542081ceec87f1a675538ce9264c7f128392c875c23507fc8a694ef2d13b127563b2da420a3df952f062dd3d46202a3466fa9a9c985dde3cc577a1fdf40687931bbc4303dbab0e28bb6757bc226d9bba4db1603de1a9c7"], 0x1, 0x0, &(0x7f00000003c0)='L'}) ioctl$TCXONC(0xffffffffffffffff, 0x540a, 0x0) 16:21:30 executing program 5: r0 = syz_open_procfs(0x0, &(0x7f0000000080)='net/dev_snmp6\x00') socket$inet(0x2, 0x4000000000000001, 0x0) perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x1ee6b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r1, 0x40045431, &(0x7f00000000c0)) r2 = syz_open_pts(r1, 0x0) r3 = dup3(r2, r0, 0x0) ioctl$TCXONC(r3, 0x540a, 0x0) 16:21:30 executing program 4: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) chroot(&(0x7f0000000280)='./file0\x00') r0 = socket$inet6(0xa, 0x2, 0x0) syz_open_procfs(0xffffffffffffffff, 0x0) connect$inet6(r0, &(0x7f0000000000), 0x1c) syz_open_procfs(0xffffffffffffffff, &(0x7f0000000140)='status\x00B#g9\xc1m\x17\xf9\r\xc2#\"\xc9O\x135 x^\x91\xea\x85\xae\x10|\xc3\x81\x98\x19\xc2cT\v\x1d\xe1\xba \x1em\xe4\xb7ZP\x11P\x91\xee\xd50\xaaH.6YF\x01\xce\xb5\xd1i\xc5\xba\xf4\x1b5\xd8\xa5\xa0\x9a\x82If\x13\xd8`#\x86[W\xef&\x9f\x90\xd3\x04\x96\x9fh}\xf5;a\x1b@\xa4B\x91\xb5\xa8\x82 \x8f\xbb\x83^T\xa4\x13\x10\xa3\xb4\x81\xd5\xbd\xbb\t\x81t)\t\xa6;|\xd1\xa1\x8d@^[\x01\x1b\xfb\xe5\xa4\xd5\xbf)\x94G\xe4\xc0\xddKc\xa3g!\x1c\x00x#\x8bP\x9daA\x00\xd3KU\x84\xaa;<\xb9\xb9\x9en_\x84q\x92\x94\xd4\x1b\'\x11|G\xfbO++\xe4u\xeb%\xd5\x01\x00\x00\x00\xcf\x84\"\xca\xdeW\f\b{\x03\xf6\xb1\x81\x8b\xc9pw\xdb#,I\xee\x06\xd1\xad\xd2_\xa7\xf7U\xe1\x00O\xbc\x01\x93K\xc7\x99[\xf2\x87\x97\x86;\xbb\xca\xc0\x1c\xe05\xf6n\xc3\xa9\x83{xe\xdd\xc1\xe3!\xccS^\x9b\xc5\xe7\b\xad\xce') r1 = socket$packet(0x11, 0x3, 0x300) connect$inet6(r0, &(0x7f0000000080)={0xa, 0x4e22, 0x0, @ipv4={[], [], @dev={0xac, 0x14, 0x14, 0x14}}}, 0x1c) recvmmsg(r1, &(0x7f0000000300), 0x400006e, 0x0, 0x0) setsockopt$packet_int(r1, 0x107, 0x8, &(0x7f0000000040)=0x100, 0x4) sendmmsg(r0, &(0x7f00000092c0), 0x4000000000001b9, 0x0) syz_open_procfs(0xffffffffffffffff, 0x0) 16:21:30 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r0, &(0x7f0000000000), 0x1c) pread64(0xffffffffffffffff, 0x0, 0x0, 0x0) r1 = socket$packet(0x11, 0x3, 0x300) connect$inet6(0xffffffffffffffff, &(0x7f0000000080)={0xa, 0x4e22, 0x0, @ipv4={[], [], @dev={0xac, 0x14, 0x14, 0x14}}}, 0x1c) recvmmsg(r1, &(0x7f0000000300), 0x400006e, 0x0, 0x0) setsockopt$packet_int(r1, 0x107, 0x8, &(0x7f0000000040)=0x100, 0x4) sendmmsg(r0, &(0x7f00000092c0), 0x4000000000001b9, 0x0) syz_open_procfs(0xffffffffffffffff, 0x0) 16:21:30 executing program 0: syz_open_procfs(0x0, 0x0) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00000000c0)) r1 = syz_open_pts(r0, 0x0) ioctl$TCSETS2(r1, 0x402c542b, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, 0x0, "36b71128cfa8bdd3b2da4fd6a1cb228fb9755b"}) pipe(&(0x7f00000002c0)) epoll_create(0xe) pselect6(0x40, &(0x7f00000000c0)={0x3}, 0x0, &(0x7f0000000140)={0x1b7}, 0x0, 0x0) [ 1800.624398] binder: 12883:12888 Acquire 1 refcount change on invalid ref 0 ret -22 [ 1800.641025] binder: 12883:12888 IncRefs 0 refcount change on invalid ref 0 ret -22 [ 1800.657590] binder: 12883:12888 Release 1 refcount change on invalid ref 0 ret -22 [ 1800.665538] binder: 12883:12888 unknown command 1850775417 16:21:30 executing program 5: socket$inet(0x2, 0x4000000000000001, 0x0) perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x1ee6b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00000000c0)) r1 = syz_open_pts(r0, 0x0) r2 = dup3(r1, 0xffffffffffffffff, 0x0) ioctl$TCXONC(r2, 0x540a, 0x0) 16:21:30 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) socket$nl_generic(0x10, 0x3, 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0xeb, 0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB="0563044000000000046304400000000006630440000000007997506ea39438033ada635f7cd4c9d1de50cf51e7a773b356e7348d3b19cbdc76ed97a6a08da8997815ea9e6d3b6a1d5a7c1cdf78337a6166cfd70cf41b6cb958e69b7dae4fe74a09c8e4db4c323ba219438b49c2f1736eb01b18c098512160aad1c0394bd4c9b785ea39e6f5b1f809658351bcb5f101899004e6a8542081ceec87f1a675538ce9264c7f128392c875c23507fc8a694ef2d13b127563b2da420a3df952f062dd3d46202a3466fa9a9c985dde3cc577a1fdf40687931bbc4303dbab0e28bb6757bc226d9bba4db1603de1a9c7"], 0x1, 0x0, &(0x7f00000003c0)='L'}) ioctl$TCXONC(0xffffffffffffffff, 0x540a, 0x0) [ 1800.671657] binder: 12883:12888 ioctl c0306201 200000c0 returned -22 16:21:30 executing program 0: syz_open_procfs(0x0, &(0x7f0000000080)='net/dev_snmp6\x00') r0 = openat$ptmx(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00000000c0)) r1 = syz_open_pts(r0, 0x0) ioctl$TCSETS2(r1, 0x402c542b, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, 0x0, "36b71128cfa8bdd3b2da4fd6a1cb228fb9755b"}) pipe(&(0x7f00000002c0)) epoll_create(0xe) pselect6(0x40, &(0x7f00000000c0)={0x3}, 0x0, &(0x7f0000000140)={0x1b7}, 0x0, 0x0) 16:21:30 executing program 5: socket$inet(0x2, 0x4000000000000001, 0x0) perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x1ee6b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00000000c0)) r1 = syz_open_pts(r0, 0x0) r2 = dup3(r1, 0xffffffffffffffff, 0x0) ioctl$TCXONC(r2, 0x540a, 0x0) 16:21:30 executing program 0: syz_open_procfs(0x0, &(0x7f0000000080)='net/dev_snmp6\x00') r0 = openat$ptmx(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00000000c0)) r1 = syz_open_pts(r0, 0x0) ioctl$TCSETS2(r1, 0x402c542b, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, 0x0, "36b71128cfa8bdd3b2da4fd6a1cb228fb9755b"}) pipe(&(0x7f00000002c0)) epoll_create(0xe) pselect6(0x40, &(0x7f00000000c0)={0x3}, 0x0, &(0x7f0000000140)={0x1b7}, 0x0, 0x0) [ 1800.766990] binder: 12908:12909 Acquire 1 refcount change on invalid ref 0 ret -22 [ 1800.805016] binder: 12908:12909 IncRefs 0 refcount change on invalid ref 0 ret -22 [ 1800.833611] binder: 12908:12909 Release 1 refcount change on invalid ref 0 ret -22 [ 1800.861868] binder: 12908:12909 unknown command 1850775417 [ 1800.875184] binder: 12908:12909 ioctl c0306201 200000c0 returned -22 16:21:31 executing program 2: bpf$MAP_CREATE(0x0, &(0x7f00000002c0)={0x7, 0x4, 0x8, 0x2}, 0x3c) 16:21:31 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) socket$nl_generic(0x10, 0x3, 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0xeb, 0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB="0563044000000000046304400000000006630440000000007997506ea39438033ada635f7cd4c9d1de50cf51e7a773b356e7348d3b19cbdc76ed97a6a08da8997815ea9e6d3b6a1d5a7c1cdf78337a6166cfd70cf41b6cb958e69b7dae4fe74a09c8e4db4c323ba219438b49c2f1736eb01b18c098512160aad1c0394bd4c9b785ea39e6f5b1f809658351bcb5f101899004e6a8542081ceec87f1a675538ce9264c7f128392c875c23507fc8a694ef2d13b127563b2da420a3df952f062dd3d46202a3466fa9a9c985dde3cc577a1fdf40687931bbc4303dbab0e28bb6757bc226d9bba4db1603de1a9c7"], 0x1, 0x0, &(0x7f00000003c0)='L'}) ioctl$TCXONC(0xffffffffffffffff, 0x540a, 0x0) 16:21:31 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f00000003c0)="11dca50d5e0bcfe47bf070") r1 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r1, &(0x7f0000000100)={0x2, 0x4e20}, 0x10) connect$inet(r1, &(0x7f0000000cc0)={0x2, 0x4e20, @local}, 0xe1) setsockopt$SO_TIMESTAMPING(r1, 0x1, 0x25, &(0x7f00000010c0)=0x19ff, 0x4) sendto$inet(r1, &(0x7f0000000140)="b0", 0x1, 0x0, 0x0, 0x0) recvmmsg(r1, &(0x7f0000003b40)=[{{0x0, 0x0, 0x0, 0xfffffffffffffd45}}], 0x1, 0x2000, 0x0) 16:21:31 executing program 0: syz_open_procfs(0x0, &(0x7f0000000080)='net/dev_snmp6\x00') r0 = openat$ptmx(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00000000c0)) r1 = syz_open_pts(r0, 0x0) ioctl$TCSETS2(r1, 0x402c542b, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, 0x0, "36b71128cfa8bdd3b2da4fd6a1cb228fb9755b"}) pipe(&(0x7f00000002c0)) epoll_create(0xe) pselect6(0x40, &(0x7f00000000c0)={0x3}, 0x0, &(0x7f0000000140)={0x1b7}, 0x0, 0x0) [ 1801.569192] binder: 12926:12932 Acquire 1 refcount change on invalid ref 0 ret -22 [ 1801.590878] binder: 12926:12932 IncRefs 0 refcount change on invalid ref 0 ret -22 [ 1801.598880] binder: 12926:12932 Release 1 refcount change on invalid ref 0 ret -22 16:21:31 executing program 4: r0 = socket$inet6(0xa, 0x2, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = dup2(r2, r1) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) getsockopt$SO_TIMESTAMP(r0, 0x1, 0x5, &(0x7f0000000100), &(0x7f0000000140)=0x4) 16:21:31 executing program 5: socket$inet(0x2, 0x4000000000000001, 0x0) perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x1ee6b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00000000c0)) r1 = syz_open_pts(r0, 0x0) r2 = dup3(r1, 0xffffffffffffffff, 0x0) ioctl$TCXONC(r2, 0x540a, 0x0) 16:21:31 executing program 0: syz_open_procfs(0x0, &(0x7f0000000080)='net/dev_snmp6\x00') r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(0xffffffffffffffff, 0x40045431, &(0x7f00000000c0)) r1 = syz_open_pts(r0, 0x0) ioctl$TCSETS2(r1, 0x402c542b, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, 0x0, "36b71128cfa8bdd3b2da4fd6a1cb228fb9755b"}) pipe(&(0x7f00000002c0)) epoll_create(0xe) pselect6(0x40, &(0x7f00000000c0)={0x3}, 0x0, &(0x7f0000000140)={0x1b7}, 0x0, 0x0) 16:21:31 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f00000003c0)="11dca50d5e0bcfe47bf070") r1 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r1, &(0x7f0000000100)={0x2, 0x4e20}, 0x10) connect$inet(r1, &(0x7f0000000cc0)={0x2, 0x4e20, @local}, 0x10) setsockopt$SO_TIMESTAMPING(r1, 0x1, 0x25, &(0x7f00000010c0)=0x19ff, 0x4) sendto$inet(r1, &(0x7f0000000140)="b0", 0x1, 0x0, 0x0, 0x0) pipe(&(0x7f0000000480)={0xffffffffffffffff, 0xffffffffffffffff}) write(r2, &(0x7f0000000340), 0x41395527) getsockopt$IPT_SO_GET_INFO(r2, 0x0, 0x40, &(0x7f0000000000)={'nat\x00'}, &(0x7f0000000080)=0x54) recvmmsg(r1, &(0x7f0000003b40)=[{{0x0, 0x0, 0x0}}], 0x1, 0x2000, 0x0) fcntl$setown(r1, 0x8, 0xffffffffffffffff) 16:21:31 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000440)={0x2, 0x70, 0xb9, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x10000000013, &(0x7f0000d06000)=0x1, 0x4) setsockopt$inet_tcp_int(r0, 0x6, 0x4000000000014, &(0x7f0000000040)=0x80000000002, 0x4) recvmmsg(r0, &(0x7f00000001c0), 0x40000000000025c, 0xea225aec34b1dd0e, 0x0) 16:21:31 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) socket$nl_generic(0x10, 0x3, 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000140)={0x0, 0x70, 0x1ee6b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0xeb, 0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB="0563044000000000046304400000000006630440000000007997506ea39438033ada635f7cd4c9d1de50cf51e7a773b356e7348d3b19cbdc76ed97a6a08da8997815ea9e6d3b6a1d5a7c1cdf78337a6166cfd70cf41b6cb958e69b7dae4fe74a09c8e4db4c323ba219438b49c2f1736eb01b18c098512160aad1c0394bd4c9b785ea39e6f5b1f809658351bcb5f101899004e6a8542081ceec87f1a675538ce9264c7f128392c875c23507fc8a694ef2d13b127563b2da420a3df952f062dd3d46202a3466fa9a9c985dde3cc577a1fdf40687931bbc4303dbab0e28bb6757bc226d9bba4db1603de1a9c7"], 0x1, 0x0, &(0x7f00000003c0)='L'}) ioctl$TCXONC(0xffffffffffffffff, 0x540a, 0x0) [ 1801.624248] binder: 12926:12932 unknown command 1850775417 [ 1801.636648] binder: 12926:12932 ioctl c0306201 200000c0 returned -22 16:21:31 executing program 0: syz_open_procfs(0x0, &(0x7f0000000080)='net/dev_snmp6\x00') r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(0xffffffffffffffff, 0x40045431, &(0x7f00000000c0)) r1 = syz_open_pts(r0, 0x0) ioctl$TCSETS2(r1, 0x402c542b, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, 0x0, "36b71128cfa8bdd3b2da4fd6a1cb228fb9755b"}) pipe(&(0x7f00000002c0)) epoll_create(0xe) pselect6(0x40, &(0x7f00000000c0)={0x3}, 0x0, &(0x7f0000000140)={0x1b7}, 0x0, 0x0) 16:21:31 executing program 5: r0 = syz_open_procfs(0x0, 0x0) socket$inet(0x2, 0x4000000000000001, 0x0) perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x1ee6b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r1, 0x40045431, &(0x7f00000000c0)) r2 = syz_open_pts(r1, 0x0) r3 = dup3(r2, r0, 0x0) ioctl$TCXONC(r3, 0x540a, 0x0) [ 1801.709593] binder: 12949:12951 Acquire 1 refcount change on invalid ref 0 ret -22 [ 1801.731110] binder: 12949:12951 IncRefs 0 refcount change on invalid ref 0 ret -22 16:21:31 executing program 4: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r0, &(0x7f0000000000), 0x1c) r1 = socket$packet(0x11, 0x3, 0x300) preadv(0xffffffffffffffff, 0x0, 0x0, 0x0) recvmmsg(r1, &(0x7f0000000300), 0x400006e, 0x0, 0x0) setsockopt$packet_int(r1, 0x107, 0x8, &(0x7f0000000040)=0x100, 0x4) sendmmsg(r0, &(0x7f00000092c0), 0x4000000000001b9, 0x0) 16:21:31 executing program 2: futex(&(0x7f000000cffc), 0xa, 0x0, 0x0, 0x0, 0xfffffffffa) 16:21:31 executing program 5: r0 = syz_open_procfs(0x0, 0x0) socket$inet(0x2, 0x4000000000000001, 0x0) perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x1ee6b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r1, 0x40045431, &(0x7f00000000c0)) r2 = syz_open_pts(r1, 0x0) r3 = dup3(r2, r0, 0x0) ioctl$TCXONC(r3, 0x540a, 0x0) 16:21:31 executing program 0: syz_open_procfs(0x0, &(0x7f0000000080)='net/dev_snmp6\x00') r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(0xffffffffffffffff, 0x40045431, &(0x7f00000000c0)) r1 = syz_open_pts(r0, 0x0) ioctl$TCSETS2(r1, 0x402c542b, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, 0x0, "36b71128cfa8bdd3b2da4fd6a1cb228fb9755b"}) pipe(&(0x7f00000002c0)) epoll_create(0xe) pselect6(0x40, &(0x7f00000000c0)={0x3}, 0x0, &(0x7f0000000140)={0x1b7}, 0x0, 0x0) [ 1801.757685] binder: 12949:12951 Release 1 refcount change on invalid ref 0 ret -22 [ 1801.798045] binder: 12949:12951 unknown command 1850775417 16:21:31 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) socket$nl_generic(0x10, 0x3, 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000140)={0x0, 0x70, 0x1ee6b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0xeb, 0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB="0563044000000000046304400000000006630440000000007997506ea39438033ada635f7cd4c9d1de50cf51e7a773b356e7348d3b19cbdc76ed97a6a08da8997815ea9e6d3b6a1d5a7c1cdf78337a6166cfd70cf41b6cb958e69b7dae4fe74a09c8e4db4c323ba219438b49c2f1736eb01b18c098512160aad1c0394bd4c9b785ea39e6f5b1f809658351bcb5f101899004e6a8542081ceec87f1a675538ce9264c7f128392c875c23507fc8a694ef2d13b127563b2da420a3df952f062dd3d46202a3466fa9a9c985dde3cc577a1fdf40687931bbc4303dbab0e28bb6757bc226d9bba4db1603de1a9c7"], 0x1, 0x0, &(0x7f00000003c0)='L'}) ioctl$TCXONC(0xffffffffffffffff, 0x540a, 0x0) 16:21:31 executing program 2: socketpair$unix(0x1, 0x8000000000001, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) bpf$MAP_CREATE(0x0, &(0x7f0000000140)={0x5, 0x1f, 0x2084, 0x20000000000001, 0x0, 0x0}, 0x2c) [ 1801.809742] binder: 12949:12951 ioctl c0306201 200000c0 returned -22 16:21:31 executing program 5: r0 = syz_open_procfs(0x0, 0x0) socket$inet(0x2, 0x4000000000000001, 0x0) perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x1ee6b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r1, 0x40045431, &(0x7f00000000c0)) r2 = syz_open_pts(r1, 0x0) r3 = dup3(r2, r0, 0x0) ioctl$TCXONC(r3, 0x540a, 0x0) [ 1801.914680] binder: 12978:12980 Acquire 1 refcount change on invalid ref 0 ret -22 [ 1801.943369] binder: 12978:12980 IncRefs 0 refcount change on invalid ref 0 ret -22 [ 1801.952019] binder: 12978:12980 Release 1 refcount change on invalid ref 0 ret -22 [ 1801.959853] binder: 12978:12980 unknown command 1850775417 [ 1801.966185] binder: 12978:12980 ioctl c0306201 200000c0 returned -22 16:21:31 executing program 2: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = getpid() rt_tgsigqueueinfo(r1, r1, 0x12, &(0x7f0000001180)={0x0, 0x0, 0xffffbfffffffc58e}) 16:21:31 executing program 0: syz_open_procfs(0x0, &(0x7f0000000080)='net/dev_snmp6\x00') r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, 0x0) r1 = syz_open_pts(r0, 0x0) ioctl$TCSETS2(r1, 0x402c542b, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, 0x0, "36b71128cfa8bdd3b2da4fd6a1cb228fb9755b"}) pipe(&(0x7f00000002c0)) epoll_create(0xe) pselect6(0x40, &(0x7f00000000c0)={0x3}, 0x0, &(0x7f0000000140)={0x1b7}, 0x0, 0x0) 16:21:31 executing program 5: r0 = syz_open_procfs(0x0, &(0x7f0000000080)='net/dev_snmp6\x00') socket$inet(0x2, 0x0, 0x0) perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x1ee6b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r1, 0x40045431, &(0x7f00000000c0)) r2 = syz_open_pts(r1, 0x0) r3 = dup3(r2, r0, 0x0) ioctl$TCXONC(r3, 0x540a, 0x0) 16:21:31 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f00000003c0)="11dca50d5e0bcfe47bf070") statx(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x3be089b1e5a7aca1, 0x20, &(0x7f0000000180)) r1 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r1, &(0x7f0000000100)={0x2, 0x4e20}, 0x10) connect$inet(r1, &(0x7f0000000cc0)={0x2, 0x4e20, @local}, 0x10) setsockopt$SO_TIMESTAMPING(r1, 0x1, 0x25, &(0x7f00000010c0)=0x19ff, 0x4) sendto$inet(r1, &(0x7f0000000140)="b0", 0x1, 0x0, 0x0, 0x0) recvmmsg(r1, &(0x7f0000003b40)=[{{0x0, 0x0, 0x0}}], 0x1, 0x2000, 0x0) getitimer(0x2, 0xfffffffffffffffe) 16:21:31 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) socket$nl_generic(0x10, 0x3, 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000140)={0x0, 0x70, 0x1ee6b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0xeb, 0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB="0563044000000000046304400000000006630440000000007997506ea39438033ada635f7cd4c9d1de50cf51e7a773b356e7348d3b19cbdc76ed97a6a08da8997815ea9e6d3b6a1d5a7c1cdf78337a6166cfd70cf41b6cb958e69b7dae4fe74a09c8e4db4c323ba219438b49c2f1736eb01b18c098512160aad1c0394bd4c9b785ea39e6f5b1f809658351bcb5f101899004e6a8542081ceec87f1a675538ce9264c7f128392c875c23507fc8a694ef2d13b127563b2da420a3df952f062dd3d46202a3466fa9a9c985dde3cc577a1fdf40687931bbc4303dbab0e28bb6757bc226d9bba4db1603de1a9c7"], 0x1, 0x0, &(0x7f00000003c0)='L'}) ioctl$TCXONC(0xffffffffffffffff, 0x540a, 0x0) [ 1802.500459] binder: 12997:12998 Acquire 1 refcount change on invalid ref 0 ret -22 [ 1802.519363] binder: 12997:12998 IncRefs 0 refcount change on invalid ref 0 ret -22 [ 1802.528870] binder: 12997:12998 Release 1 refcount change on invalid ref 0 ret -22 [ 1802.543196] binder: 12997:12998 unknown command 1850775417 [ 1802.552473] binder: 12997:12998 ioctl c0306201 200000c0 returned -22 16:21:32 executing program 4: 16:21:32 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000440)={0x2, 0x70, 0xb9, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x80001, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000040)={0x0, 0xffffffffffffff84}}, 0x0) write(r0, &(0x7f0000000000)="bc", 0x1) ioctl$TCSETS(r0, 0x40045431, &(0x7f0000000a80)) r1 = syz_open_pts(r0, 0x0) readv(r1, &(0x7f00000001c0), 0xce) ioctl$TCSETS(r0, 0x5402, &(0x7f0000000080)) 16:21:32 executing program 0: syz_open_procfs(0x0, &(0x7f0000000080)='net/dev_snmp6\x00') r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, 0x0) r1 = syz_open_pts(r0, 0x0) ioctl$TCSETS2(r1, 0x402c542b, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, 0x0, "36b71128cfa8bdd3b2da4fd6a1cb228fb9755b"}) pipe(&(0x7f00000002c0)) epoll_create(0xe) pselect6(0x40, &(0x7f00000000c0)={0x3}, 0x0, &(0x7f0000000140)={0x1b7}, 0x0, 0x0) 16:21:32 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) socket$nl_generic(0x10, 0x3, 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000140)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0xeb, 0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB="0563044000000000046304400000000006630440000000007997506ea39438033ada635f7cd4c9d1de50cf51e7a773b356e7348d3b19cbdc76ed97a6a08da8997815ea9e6d3b6a1d5a7c1cdf78337a6166cfd70cf41b6cb958e69b7dae4fe74a09c8e4db4c323ba219438b49c2f1736eb01b18c098512160aad1c0394bd4c9b785ea39e6f5b1f809658351bcb5f101899004e6a8542081ceec87f1a675538ce9264c7f128392c875c23507fc8a694ef2d13b127563b2da420a3df952f062dd3d46202a3466fa9a9c985dde3cc577a1fdf40687931bbc4303dbab0e28bb6757bc226d9bba4db1603de1a9c7"], 0x1, 0x0, &(0x7f00000003c0)='L'}) ioctl$TCXONC(0xffffffffffffffff, 0x540a, 0x0) 16:21:32 executing program 5: r0 = syz_open_procfs(0x0, &(0x7f0000000080)='net/dev_snmp6\x00') socket$inet(0x2, 0x0, 0x0) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r1, 0x40045431, &(0x7f00000000c0)) r2 = syz_open_pts(r1, 0x0) r3 = dup3(r2, r0, 0x0) ioctl$TCXONC(r3, 0x540a, 0x0) [ 1802.708367] binder: 13015:13019 Acquire 1 refcount change on invalid ref 0 ret -22 [ 1802.717666] binder: 13015:13019 IncRefs 0 refcount change on invalid ref 0 ret -22 [ 1802.732008] binder: 13015:13019 Release 1 refcount change on invalid ref 0 ret -22 [ 1802.739963] binder: 13015:13019 unknown command 1850775417 16:21:32 executing program 4: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r0, 0x0, 0x0) r1 = socket$packet(0x11, 0x3, 0x300) connect$inet6(r0, &(0x7f0000000080)={0xa, 0x4e22, 0x0, @ipv4={[], [], @dev={0xac, 0x14, 0x14, 0x14}}}, 0x1c) recvmmsg(r1, &(0x7f0000000300), 0x400006e, 0x0, 0x0) setsockopt$packet_int(r1, 0x107, 0x8, &(0x7f0000000040)=0x100, 0x4) sendmmsg(r0, &(0x7f00000092c0), 0x4000000000001b9, 0x0) 16:21:32 executing program 5: r0 = syz_open_procfs(0x0, &(0x7f0000000080)='net/dev_snmp6\x00') socket$inet(0x2, 0x0, 0x0) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r1, 0x40045431, &(0x7f00000000c0)) r2 = syz_open_pts(r1, 0x0) r3 = dup3(r2, r0, 0x0) ioctl$TCXONC(r3, 0x540a, 0x0) 16:21:32 executing program 0: syz_open_procfs(0x0, &(0x7f0000000080)='net/dev_snmp6\x00') r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, 0x0) r1 = syz_open_pts(r0, 0x0) ioctl$TCSETS2(r1, 0x402c542b, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, 0x0, "36b71128cfa8bdd3b2da4fd6a1cb228fb9755b"}) pipe(&(0x7f00000002c0)) epoll_create(0xe) pselect6(0x40, &(0x7f00000000c0)={0x3}, 0x0, &(0x7f0000000140)={0x1b7}, 0x0, 0x0) [ 1802.753262] binder: 13015:13019 ioctl c0306201 200000c0 returned -22 16:21:32 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) socket$nl_generic(0x10, 0x3, 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000140)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0xeb, 0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB="0563044000000000046304400000000006630440000000007997506ea39438033ada635f7cd4c9d1de50cf51e7a773b356e7348d3b19cbdc76ed97a6a08da8997815ea9e6d3b6a1d5a7c1cdf78337a6166cfd70cf41b6cb958e69b7dae4fe74a09c8e4db4c323ba219438b49c2f1736eb01b18c098512160aad1c0394bd4c9b785ea39e6f5b1f809658351bcb5f101899004e6a8542081ceec87f1a675538ce9264c7f128392c875c23507fc8a694ef2d13b127563b2da420a3df952f062dd3d46202a3466fa9a9c985dde3cc577a1fdf40687931bbc4303dbab0e28bb6757bc226d9bba4db1603de1a9c7"], 0x1, 0x0, &(0x7f00000003c0)='L'}) ioctl$TCXONC(0xffffffffffffffff, 0x540a, 0x0) 16:21:32 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000440)={0x2, 0x70, 0xb9, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x80001, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000040)={0x0, 0xffffffffffffff84}}, 0x0) write(r0, &(0x7f0000000000)="bc", 0x1) ioctl$TCSETS(r0, 0x40045431, &(0x7f0000000a80)) r1 = syz_open_pts(r0, 0x0) readv(r1, &(0x7f00000001c0), 0xce) ioctl$TCSETS(r0, 0x5402, &(0x7f0000000080)) [ 1802.843315] binder: 13036:13039 Acquire 1 refcount change on invalid ref 0 ret -22 [ 1802.869768] binder: 13036:13039 IncRefs 0 refcount change on invalid ref 0 ret -22 [ 1802.883003] binder: 13036:13039 Release 1 refcount change on invalid ref 0 ret -22 [ 1802.895368] binder: 13036:13039 unknown command 1850775417 [ 1802.901300] binder: 13036:13039 ioctl c0306201 200000c0 returned -22 16:21:32 executing program 5: r0 = syz_open_procfs(0x0, &(0x7f0000000080)='net/dev_snmp6\x00') socket$inet(0x2, 0x0, 0x0) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r1, 0x40045431, &(0x7f00000000c0)) r2 = syz_open_pts(r1, 0x0) r3 = dup3(r2, r0, 0x0) ioctl$TCXONC(r3, 0x540a, 0x0) 16:21:32 executing program 0: syz_open_procfs(0x0, &(0x7f0000000080)='net/dev_snmp6\x00') r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00000000c0)) r1 = syz_open_pts(0xffffffffffffffff, 0x0) ioctl$TCSETS2(r1, 0x402c542b, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, 0x0, "36b71128cfa8bdd3b2da4fd6a1cb228fb9755b"}) pipe(&(0x7f00000002c0)) epoll_create(0xe) pselect6(0x40, &(0x7f00000000c0)={0x3}, 0x0, &(0x7f0000000140)={0x1b7}, 0x0, 0x0) 16:21:32 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) socket$nl_generic(0x10, 0x3, 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000140)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0xeb, 0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB="0563044000000000046304400000000006630440000000007997506ea39438033ada635f7cd4c9d1de50cf51e7a773b356e7348d3b19cbdc76ed97a6a08da8997815ea9e6d3b6a1d5a7c1cdf78337a6166cfd70cf41b6cb958e69b7dae4fe74a09c8e4db4c323ba219438b49c2f1736eb01b18c098512160aad1c0394bd4c9b785ea39e6f5b1f809658351bcb5f101899004e6a8542081ceec87f1a675538ce9264c7f128392c875c23507fc8a694ef2d13b127563b2da420a3df952f062dd3d46202a3466fa9a9c985dde3cc577a1fdf40687931bbc4303dbab0e28bb6757bc226d9bba4db1603de1a9c7"], 0x1, 0x0, &(0x7f00000003c0)='L'}) ioctl$TCXONC(0xffffffffffffffff, 0x540a, 0x0) 16:21:32 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000440)={0x2, 0x70, 0xb9, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x80001, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000040)={0x0, 0xffffffffffffff84}}, 0x0) write(r0, &(0x7f0000000000)="bc", 0x1) ioctl$TCSETS(r0, 0x40045431, &(0x7f0000000a80)) r1 = syz_open_pts(r0, 0x0) readv(r1, &(0x7f00000001c0), 0xce) ioctl$TCSETS(r0, 0x5402, &(0x7f0000000080)) 16:21:32 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f00000003c0)="11dca50d5e0bcfe47bf070") bind$inet(0xffffffffffffffff, &(0x7f0000000100)={0x2, 0x4e20}, 0x10) r1 = openat$selinux_avc_cache_stats(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/avc/cache_stats\x00', 0x0, 0x0) ioctl$RNDZAPENTCNT(r1, 0x5204, &(0x7f0000000040)=0x3) connect$inet(0xffffffffffffffff, &(0x7f0000000cc0)={0x2, 0x4e20, @local}, 0x10) setsockopt$SO_TIMESTAMPING(0xffffffffffffffff, 0x1, 0x25, &(0x7f00000010c0)=0x19ff, 0x4) r2 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r2, 0x40045431, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1}) ioctl$TIOCGPGRP(0xffffffffffffffff, 0x540f, &(0x7f0000000200)=0x0) fcntl$getownex(0xffffffffffffffff, 0x10, &(0x7f0000000240)={0x0, 0x0}) rt_tgsigqueueinfo(r3, r4, 0x11, &(0x7f0000000280)={0x3c, 0x100, 0x1}) syz_open_pts(r2, 0x0) close(r2) sendto$inet(0xffffffffffffffff, &(0x7f0000000140)="b0", 0x1, 0x0, 0x0, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f0000003b40)=[{{0x0, 0x0, 0x0}}], 0x1, 0x2000, 0x0) pipe(&(0x7f00000001c0)={0xffffffffffffffff}) pipe(&(0x7f0000000480)={0xffffffffffffffff}) vmsplice(r6, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) setsockopt$IP_VS_SO_SET_STARTDAEMON(r6, 0x0, 0x48b, &(0x7f00000000c0)={0x0, 'gre0\x00', 0x2}, 0x18) vmsplice(r5, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) setsockopt$inet_udp_int(r5, 0x11, 0x6c, &(0x7f0000000080)=0x6, 0x4) connect$inet(r0, &(0x7f0000000180)={0x2, 0x4e21, @local}, 0x10) 16:21:32 executing program 0: syz_open_procfs(0x0, &(0x7f0000000080)='net/dev_snmp6\x00') r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00000000c0)) r1 = syz_open_pts(0xffffffffffffffff, 0x0) ioctl$TCSETS2(r1, 0x402c542b, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, 0x0, "36b71128cfa8bdd3b2da4fd6a1cb228fb9755b"}) pipe(&(0x7f00000002c0)) epoll_create(0xe) pselect6(0x40, &(0x7f00000000c0)={0x3}, 0x0, &(0x7f0000000140)={0x1b7}, 0x0, 0x0) [ 1803.353042] binder: 13056:13059 Acquire 1 refcount change on invalid ref 0 ret -22 [ 1803.364649] binder: 13056:13059 IncRefs 0 refcount change on invalid ref 0 ret -22 [ 1803.387590] binder: 13056:13059 Release 1 refcount change on invalid ref 0 ret -22 16:21:32 executing program 0: syz_open_procfs(0x0, &(0x7f0000000080)='net/dev_snmp6\x00') r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00000000c0)) r1 = syz_open_pts(0xffffffffffffffff, 0x0) ioctl$TCSETS2(r1, 0x402c542b, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, 0x0, "36b71128cfa8bdd3b2da4fd6a1cb228fb9755b"}) pipe(&(0x7f00000002c0)) epoll_create(0xe) pselect6(0x40, &(0x7f00000000c0)={0x3}, 0x0, &(0x7f0000000140)={0x1b7}, 0x0, 0x0) [ 1803.406072] binder: 13056:13059 unknown command 1850775417 [ 1803.412051] binder: 13056:13059 ioctl c0306201 200000c0 returned -22 16:21:33 executing program 4: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000440)={0x2, 0x70, 0xb9, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x80001, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000040)={0x0, 0xffffffffffffff84}}, 0x0) write(r0, &(0x7f0000000000)="bc", 0x1) ioctl$TCSETS(r0, 0x40045431, &(0x7f0000000a80)) r1 = syz_open_pts(r0, 0x0) readv(r1, &(0x7f00000001c0), 0xce) ioctl$TCSETS(r0, 0x5402, &(0x7f0000000080)) 16:21:33 executing program 5: r0 = syz_open_procfs(0x0, &(0x7f0000000080)='net/dev_snmp6\x00') socket$inet(0x2, 0x0, 0x0) perf_event_open(&(0x7f0000000140)={0x0, 0x70, 0x1ee6b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r1, 0x40045431, &(0x7f00000000c0)) r2 = syz_open_pts(r1, 0x0) r3 = dup3(r2, r0, 0x0) ioctl$TCXONC(r3, 0x540a, 0x0) 16:21:33 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) socket$nl_generic(0x10, 0x3, 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000140)={0x0, 0x70, 0x1ee6b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0xeb, 0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB="0563044000000000046304400000000006630440000000007997506ea39438033ada635f7cd4c9d1de50cf51e7a773b356e7348d3b19cbdc76ed97a6a08da8997815ea9e6d3b6a1d5a7c1cdf78337a6166cfd70cf41b6cb958e69b7dae4fe74a09c8e4db4c323ba219438b49c2f1736eb01b18c098512160aad1c0394bd4c9b785ea39e6f5b1f809658351bcb5f101899004e6a8542081ceec87f1a675538ce9264c7f128392c875c23507fc8a694ef2d13b127563b2da420a3df952f062dd3d46202a3466fa9a9c985dde3cc577a1fdf40687931bbc4303dbab0e28bb6757bc226d9bba4db1603de1a9c7"], 0x1, 0x0, &(0x7f00000003c0)='L'}) ioctl$TCXONC(0xffffffffffffffff, 0x540a, 0x0) 16:21:33 executing program 0: syz_open_procfs(0x0, &(0x7f0000000080)='net/dev_snmp6\x00') r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00000000c0)) syz_open_pts(r0, 0x0) ioctl$TCSETS2(0xffffffffffffffff, 0x402c542b, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, 0x0, "36b71128cfa8bdd3b2da4fd6a1cb228fb9755b"}) pipe(&(0x7f00000002c0)) epoll_create(0xe) pselect6(0x40, &(0x7f00000000c0)={0x3}, 0x0, &(0x7f0000000140)={0x1b7}, 0x0, 0x0) 16:21:33 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000440)={0x2, 0x70, 0xb9, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x80001, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000040)={0x0, 0xffffffffffffff84}}, 0x0) write(r0, &(0x7f0000000000)="bc", 0x1) ioctl$TCSETS(r0, 0x40045431, &(0x7f0000000a80)) r1 = syz_open_pts(r0, 0x0) readv(r1, &(0x7f00000001c0), 0xce) ioctl$TCSETS(r0, 0x5402, &(0x7f0000000080)) 16:21:33 executing program 0: syz_open_procfs(0x0, &(0x7f0000000080)='net/dev_snmp6\x00') r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00000000c0)) syz_open_pts(r0, 0x0) ioctl$TCSETS2(0xffffffffffffffff, 0x402c542b, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, 0x0, "36b71128cfa8bdd3b2da4fd6a1cb228fb9755b"}) pipe(&(0x7f00000002c0)) epoll_create(0xe) pselect6(0x40, &(0x7f00000000c0)={0x3}, 0x0, &(0x7f0000000140)={0x1b7}, 0x0, 0x0) 16:21:33 executing program 5: r0 = syz_open_procfs(0x0, &(0x7f0000000080)='net/dev_snmp6\x00') socket$inet(0x2, 0x0, 0x0) perf_event_open(&(0x7f0000000140)={0x0, 0x70, 0x1ee6b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r1, 0x40045431, &(0x7f00000000c0)) r2 = syz_open_pts(r1, 0x0) r3 = dup3(r2, r0, 0x0) ioctl$TCXONC(r3, 0x540a, 0x0) [ 1803.726976] binder: 13084:13091 Acquire 1 refcount change on invalid ref 0 ret -22 [ 1803.739946] binder: 13084:13091 IncRefs 0 refcount change on invalid ref 0 ret -22 [ 1803.760643] binder: 13084:13091 Release 1 refcount change on invalid ref 0 ret -22 [ 1803.769516] binder: 13084:13091 unknown command 1850775417 16:21:33 executing program 0: syz_open_procfs(0x0, &(0x7f0000000080)='net/dev_snmp6\x00') r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00000000c0)) syz_open_pts(r0, 0x0) ioctl$TCSETS2(0xffffffffffffffff, 0x402c542b, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, 0x0, "36b71128cfa8bdd3b2da4fd6a1cb228fb9755b"}) pipe(&(0x7f00000002c0)) epoll_create(0xe) pselect6(0x40, &(0x7f00000000c0)={0x3}, 0x0, &(0x7f0000000140)={0x1b7}, 0x0, 0x0) 16:21:33 executing program 4: perf_event_open(&(0x7f0000000440)={0x2, 0x70, 0xb9, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) getpid() epoll_create1(0x0) r0 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000040)='/dev/rtc0\x00', 0x0, 0x0) ioctl$RTC_AIE_ON(r0, 0x7001) [ 1803.780530] binder: 13084:13091 ioctl c0306201 200000c0 returned -22 16:21:33 executing program 5: r0 = syz_open_procfs(0x0, &(0x7f0000000080)='net/dev_snmp6\x00') socket$inet(0x2, 0x0, 0x0) perf_event_open(&(0x7f0000000140)={0x0, 0x70, 0x1ee6b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r1, 0x40045431, &(0x7f00000000c0)) r2 = syz_open_pts(r1, 0x0) r3 = dup3(r2, r0, 0x0) ioctl$TCXONC(r3, 0x540a, 0x0) 16:21:33 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000440)={0x2, 0x70, 0xb9, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x80001, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000040)={0x0, 0xffffffffffffff84}}, 0x0) write(r0, &(0x7f0000000000)="bc", 0x1) ioctl$TCSETS(r0, 0x40045431, &(0x7f0000000a80)) r1 = syz_open_pts(r0, 0x0) readv(r1, &(0x7f00000001c0), 0xce) 16:21:33 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) socket$nl_generic(0x10, 0x3, 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000140)={0x0, 0x70, 0x1ee6b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0xeb, 0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB="0563044000000000046304400000000006630440000000007997506ea39438033ada635f7cd4c9d1de50cf51e7a773b356e7348d3b19cbdc76ed97a6a08da8997815ea9e6d3b6a1d5a7c1cdf78337a6166cfd70cf41b6cb958e69b7dae4fe74a09c8e4db4c323ba219438b49c2f1736eb01b18c098512160aad1c0394bd4c9b785ea39e6f5b1f809658351bcb5f101899004e6a8542081ceec87f1a675538ce9264c7f128392c875c23507fc8a694ef2d13b127563b2da420a3df952f062dd3d46202a3466fa9a9c985dde3cc577a1fdf40687931bbc4303dbab0e28bb6757bc226d9bba4db1603de1a9c7"], 0x1, 0x0, &(0x7f00000003c0)='L'}) ioctl$TCXONC(0xffffffffffffffff, 0x540a, 0x0) 16:21:33 executing program 4: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000440)={0x2, 0x70, 0xb9, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) getpid() r0 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000040)='/dev/rtc0\x00', 0x0, 0x0) ioctl$RTC_AIE_ON(r0, 0x7001) 16:21:33 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f00000003c0)="11dca50d5e0bcfe47bf070") r1 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r1, &(0x7f0000000100)={0x2, 0x4e20}, 0x10) connect$inet(r1, &(0x7f0000000cc0)={0x2, 0x4e20, @local}, 0x10) setsockopt$SO_TIMESTAMPING(r1, 0x1, 0x25, &(0x7f00000010c0)=0x19ff, 0x4) sendto$inet(r1, &(0x7f0000000140)="b0", 0x1, 0x0, 0x0, 0x0) pipe(&(0x7f0000000480)={0xffffffffffffffff}) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) recvmmsg(r2, &(0x7f0000003680)=[{{&(0x7f0000000000)=@nfc_llcp, 0x80, &(0x7f0000000300)=[{&(0x7f0000000080)=""/56, 0x38}, {&(0x7f00000000c0)=""/27, 0x1b}, {&(0x7f0000000180)=""/175, 0xaf}, {&(0x7f0000000240)=""/168, 0xa8}], 0x4, &(0x7f0000000340)}, 0x6}, {{&(0x7f0000000400)=@tipc=@id, 0x80, &(0x7f0000000380)=[{&(0x7f0000001100)=""/4096, 0x1000}, {&(0x7f0000000480)=""/71, 0x47}], 0x2, &(0x7f0000000500)=""/137, 0x89}}, {{&(0x7f00000005c0)=@in={0x2, 0x0, @remote}, 0x80, &(0x7f0000000ac0)=[{&(0x7f0000000640)=""/75, 0x4b}, {&(0x7f00000006c0)=""/151, 0x97}, {&(0x7f0000000780)=""/36, 0x24}, {&(0x7f00000007c0)=""/218, 0xda}, {&(0x7f00000008c0)=""/22, 0x16}, {&(0x7f0000000900)=""/69, 0x45}, {&(0x7f0000000980)=""/248, 0xf8}, {&(0x7f0000000a80)=""/26, 0xffffffffffffffcd}], 0x8}}, {{&(0x7f0000000b40)=@in6={0xa, 0x0, 0x0, @loopback}, 0x80, &(0x7f0000000c00)=[{&(0x7f0000000bc0)=""/7, 0x7}], 0x1, &(0x7f0000000c40)=""/36, 0x24}, 0x2}, {{&(0x7f0000000d00)=@rxrpc=@in4={0x21, 0x0, 0x2, 0x10, {0x2, 0x0, @broadcast}}, 0x80, &(0x7f0000000c80)=[{&(0x7f0000000d80)=""/139, 0x8b}, {&(0x7f0000002100)=""/4096, 0x1000}, {&(0x7f0000000e40)=""/237, 0xed}], 0x3, &(0x7f0000000f40)=""/191, 0xbf}, 0x48}, {{&(0x7f0000001000)=@tipc=@name, 0x80, &(0x7f0000003300)=[{&(0x7f0000001080)=""/9, 0x9}, {&(0x7f0000003100)=""/255, 0xff}, {&(0x7f0000003200)=""/196, 0xc4}], 0x3}, 0x4}, {{0x0, 0x0, &(0x7f0000003600)=[{&(0x7f0000003340)=""/144, 0x90}, {&(0x7f0000003400)=""/13, 0xd}, {&(0x7f0000003440)=""/65, 0x41}, {&(0x7f00000034c0)}, {&(0x7f0000003500)=""/199, 0xc7}], 0x5}, 0x1}], 0x7, 0x5763d7d95a58d631, &(0x7f0000003840)) recvmmsg(r1, &(0x7f0000003b40)=[{{0x0, 0x0, 0x0}}], 0x1, 0x2000, 0x0) 16:21:33 executing program 0: syz_open_procfs(0x0, &(0x7f0000000080)='net/dev_snmp6\x00') r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00000000c0)) r1 = syz_open_pts(r0, 0x0) ioctl$TCSETS2(r1, 0x402c542b, 0x0) pipe(&(0x7f00000002c0)) epoll_create(0xe) pselect6(0x40, &(0x7f00000000c0)={0x3}, 0x0, &(0x7f0000000140)={0x1b7}, 0x0, 0x0) 16:21:33 executing program 0: syz_open_procfs(0x0, &(0x7f0000000080)='net/dev_snmp6\x00') r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00000000c0)) r1 = syz_open_pts(r0, 0x0) ioctl$TCSETS2(r1, 0x402c542b, 0x0) pipe(&(0x7f00000002c0)) epoll_create(0xe) pselect6(0x40, &(0x7f00000000c0)={0x3}, 0x0, &(0x7f0000000140)={0x1b7}, 0x0, 0x0) 16:21:33 executing program 4: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000440)={0x2, 0x70, 0xb9, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x10000000013, &(0x7f0000d06000)=0x1, 0x4) setsockopt$sock_int(r0, 0x1, 0x2e, &(0x7f0000000140)=0x401, 0x4) setsockopt$inet_tcp_int(r0, 0x6, 0x4000000000014, &(0x7f0000000040)=0x80000000002, 0x4) recvmmsg(r0, &(0x7f00000001c0), 0x40000000000025c, 0xea225aec34b1dd0e, 0x0) 16:21:33 executing program 5: r0 = syz_open_procfs(0x0, &(0x7f0000000080)='net/dev_snmp6\x00') socket$inet(0x2, 0x0, 0x0) perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r1, 0x40045431, &(0x7f00000000c0)) r2 = syz_open_pts(r1, 0x0) r3 = dup3(r2, r0, 0x0) ioctl$TCXONC(r3, 0x540a, 0x0) [ 1804.284396] binder: 13128:13133 Acquire 1 refcount change on invalid ref 0 ret -22 [ 1804.307075] binder: 13128:13133 IncRefs 0 refcount change on invalid ref 0 ret -22 [ 1804.325372] binder: 13128:13133 Release 1 refcount change on invalid ref 0 ret -22 16:21:33 executing program 0: syz_open_procfs(0x0, &(0x7f0000000080)='net/dev_snmp6\x00') r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00000000c0)) r1 = syz_open_pts(r0, 0x0) ioctl$TCSETS2(r1, 0x402c542b, 0x0) pipe(&(0x7f00000002c0)) epoll_create(0xe) pselect6(0x40, &(0x7f00000000c0)={0x3}, 0x0, &(0x7f0000000140)={0x1b7}, 0x0, 0x0) 16:21:33 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) socket$nl_generic(0x10, 0x3, 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000140)={0x0, 0x70, 0x1ee6b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0xeb, 0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB="0563044000000000046304400000000006630440000000007997506ea39438033ada635f7cd4c9d1de50cf51e7a773b356e7348d3b19cbdc76ed97a6a08da8997815ea9e6d3b6a1d5a7c1cdf78337a6166cfd70cf41b6cb958e69b7dae4fe74a09c8e4db4c323ba219438b49c2f1736eb01b18c098512160aad1c0394bd4c9b785ea39e6f5b1f809658351bcb5f101899004e6a8542081ceec87f1a675538ce9264c7f128392c875c23507fc8a694ef2d13b127563b2da420a3df952f062dd3d46202a3466fa9a9c985dde3cc577a1fdf40687931bbc4303dbab0e28bb6757bc226d9bba4db1603de1a9c7"], 0x1, 0x0, &(0x7f00000003c0)='L'}) ioctl$TCXONC(0xffffffffffffffff, 0x540a, 0x0) [ 1804.372445] binder: 13128:13133 unknown command 1850775417 [ 1804.387979] binder: 13128:13133 ioctl c0306201 200000c0 returned -22 16:21:33 executing program 0: syz_open_procfs(0x0, &(0x7f0000000080)='net/dev_snmp6\x00') r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00000000c0)) r1 = syz_open_pts(r0, 0x0) ioctl$TCSETS2(r1, 0x402c542b, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, 0x0, "36b71128cfa8bdd3b2da4fd6a1cb228fb9755b"}) pipe(0x0) epoll_create(0xe) pselect6(0x40, &(0x7f00000000c0)={0x3}, 0x0, &(0x7f0000000140)={0x1b7}, 0x0, 0x0) 16:21:33 executing program 5: r0 = syz_open_procfs(0x0, &(0x7f0000000080)='net/dev_snmp6\x00') socket$inet(0x2, 0x0, 0x0) perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r1, 0x40045431, &(0x7f00000000c0)) r2 = syz_open_pts(r1, 0x0) r3 = dup3(r2, r0, 0x0) ioctl$TCXONC(r3, 0x540a, 0x0) [ 1804.478845] binder: 13159:13162 Acquire 1 refcount change on invalid ref 0 ret -22 [ 1804.510797] binder: 13159:13162 IncRefs 0 refcount change on invalid ref 0 ret -22 [ 1804.531718] binder: 13159:13162 Release 1 refcount change on invalid ref 0 ret -22 [ 1804.548524] binder: 13159:13162 unknown command 1850775417 [ 1804.559689] binder: 13159:13162 ioctl c0306201 200000c0 returned -22 16:21:34 executing program 0: syz_open_procfs(0x0, &(0x7f0000000080)='net/dev_snmp6\x00') r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00000000c0)) r1 = syz_open_pts(r0, 0x0) ioctl$TCSETS2(r1, 0x402c542b, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, 0x0, "36b71128cfa8bdd3b2da4fd6a1cb228fb9755b"}) pipe(0x0) epoll_create(0xe) pselect6(0x40, &(0x7f00000000c0)={0x3}, 0x0, &(0x7f0000000140)={0x1b7}, 0x0, 0x0) 16:21:34 executing program 4: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000440)={0x2, 0x70, 0xb9, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x80001, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000040)={0x0, 0xffffffffffffff84}}, 0x0) write(r0, &(0x7f0000000000)="bc", 0x1) ioctl$TCSETS(r0, 0x40045431, &(0x7f0000000a80)) r1 = syz_open_pts(r0, 0x0) readv(r1, &(0x7f00000001c0), 0xce) ioctl$TCSETS(r0, 0x5402, &(0x7f0000000080)) 16:21:34 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000440)={0x2, 0x70, 0xb9, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x80001, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000040)={0x0, 0xffffffffffffff84}}, 0x0) write(r0, &(0x7f0000000000)="bc", 0x1) ioctl$TCSETS(r0, 0x40045431, &(0x7f0000000a80)) r1 = syz_open_pts(r0, 0x0) readv(r1, &(0x7f00000001c0), 0xce) 16:21:34 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f00000003c0)="11dca50d5e0bcfe47bf070") socket$inet_udplite(0x2, 0x2, 0x88) r1 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r1, &(0x7f0000000100)={0x2, 0x4e20}, 0x10) time(&(0x7f0000000000)) connect$inet(r1, &(0x7f0000000cc0)={0x2, 0x4e20, @local}, 0x10) setsockopt$SO_TIMESTAMPING(r1, 0x1, 0x25, &(0x7f00000010c0)=0x19ff, 0x4) sendto$inet(r1, &(0x7f0000000140)="b0", 0x1, 0x0, 0x0, 0x0) recvmmsg(r1, &(0x7f0000003b40)=[{{0x0, 0x0, 0x0}}], 0x1, 0x2000, 0x0) 16:21:34 executing program 1: syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) socket$nl_generic(0x10, 0x3, 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000140)={0x0, 0x70, 0x1ee6b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f00000000c0)={0xeb, 0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB="0563044000000000046304400000000006630440000000007997506ea39438033ada635f7cd4c9d1de50cf51e7a773b356e7348d3b19cbdc76ed97a6a08da8997815ea9e6d3b6a1d5a7c1cdf78337a6166cfd70cf41b6cb958e69b7dae4fe74a09c8e4db4c323ba219438b49c2f1736eb01b18c098512160aad1c0394bd4c9b785ea39e6f5b1f809658351bcb5f101899004e6a8542081ceec87f1a675538ce9264c7f128392c875c23507fc8a694ef2d13b127563b2da420a3df952f062dd3d46202a3466fa9a9c985dde3cc577a1fdf40687931bbc4303dbab0e28bb6757bc226d9bba4db1603de1a9c7"], 0x1, 0x0, &(0x7f00000003c0)='L'}) ioctl$TCXONC(0xffffffffffffffff, 0x540a, 0x0) 16:21:34 executing program 5: r0 = syz_open_procfs(0x0, &(0x7f0000000080)='net/dev_snmp6\x00') socket$inet(0x2, 0x0, 0x0) perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r1, 0x40045431, &(0x7f00000000c0)) r2 = syz_open_pts(r1, 0x0) r3 = dup3(r2, r0, 0x0) ioctl$TCXONC(r3, 0x540a, 0x0) 16:21:34 executing program 0: syz_open_procfs(0x0, &(0x7f0000000080)='net/dev_snmp6\x00') r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00000000c0)) r1 = syz_open_pts(r0, 0x0) ioctl$TCSETS2(r1, 0x402c542b, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, 0x0, "36b71128cfa8bdd3b2da4fd6a1cb228fb9755b"}) pipe(0x0) epoll_create(0xe) pselect6(0x40, &(0x7f00000000c0)={0x3}, 0x0, &(0x7f0000000140)={0x1b7}, 0x0, 0x0) 16:21:34 executing program 4: 16:21:34 executing program 5: r0 = syz_open_procfs(0x0, &(0x7f0000000080)='net/dev_snmp6\x00') socket$inet(0x2, 0x0, 0x0) perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x1ee6b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r1, 0x40045431, &(0x7f00000000c0)) r2 = syz_open_pts(r1, 0x0) r3 = dup3(r2, r0, 0x0) ioctl$TCXONC(r3, 0x540a, 0x0) 16:21:34 executing program 0: syz_open_procfs(0x0, &(0x7f0000000080)='net/dev_snmp6\x00') r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00000000c0)) r1 = syz_open_pts(r0, 0x0) ioctl$TCSETS2(r1, 0x402c542b, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, 0x0, "36b71128cfa8bdd3b2da4fd6a1cb228fb9755b"}) pipe(&(0x7f00000002c0)) epoll_create(0x0) pselect6(0x40, &(0x7f00000000c0)={0x3}, 0x0, &(0x7f0000000140)={0x1b7}, 0x0, 0x0) 16:21:34 executing program 1: syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) socket$nl_generic(0x10, 0x3, 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000140)={0x0, 0x70, 0x1ee6b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f00000000c0)={0xeb, 0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB="0563044000000000046304400000000006630440000000007997506ea39438033ada635f7cd4c9d1de50cf51e7a773b356e7348d3b19cbdc76ed97a6a08da8997815ea9e6d3b6a1d5a7c1cdf78337a6166cfd70cf41b6cb958e69b7dae4fe74a09c8e4db4c323ba219438b49c2f1736eb01b18c098512160aad1c0394bd4c9b785ea39e6f5b1f809658351bcb5f101899004e6a8542081ceec87f1a675538ce9264c7f128392c875c23507fc8a694ef2d13b127563b2da420a3df952f062dd3d46202a3466fa9a9c985dde3cc577a1fdf40687931bbc4303dbab0e28bb6757bc226d9bba4db1603de1a9c7"], 0x1, 0x0, &(0x7f00000003c0)='L'}) ioctl$TCXONC(0xffffffffffffffff, 0x540a, 0x0) 16:21:34 executing program 4: 16:21:34 executing program 1: syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) socket$nl_generic(0x10, 0x3, 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000140)={0x0, 0x70, 0x1ee6b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f00000000c0)={0xeb, 0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB="0563044000000000046304400000000006630440000000007997506ea39438033ada635f7cd4c9d1de50cf51e7a773b356e7348d3b19cbdc76ed97a6a08da8997815ea9e6d3b6a1d5a7c1cdf78337a6166cfd70cf41b6cb958e69b7dae4fe74a09c8e4db4c323ba219438b49c2f1736eb01b18c098512160aad1c0394bd4c9b785ea39e6f5b1f809658351bcb5f101899004e6a8542081ceec87f1a675538ce9264c7f128392c875c23507fc8a694ef2d13b127563b2da420a3df952f062dd3d46202a3466fa9a9c985dde3cc577a1fdf40687931bbc4303dbab0e28bb6757bc226d9bba4db1603de1a9c7"], 0x1, 0x0, &(0x7f00000003c0)='L'}) ioctl$TCXONC(0xffffffffffffffff, 0x540a, 0x0) 16:21:34 executing program 0: syz_open_procfs(0x0, &(0x7f0000000080)='net/dev_snmp6\x00') r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00000000c0)) r1 = syz_open_pts(r0, 0x0) ioctl$TCSETS2(r1, 0x402c542b, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, 0x0, "36b71128cfa8bdd3b2da4fd6a1cb228fb9755b"}) pipe(&(0x7f00000002c0)) epoll_create(0x0) pselect6(0x40, &(0x7f00000000c0)={0x3}, 0x0, &(0x7f0000000140)={0x1b7}, 0x0, 0x0) 16:21:35 executing program 5: r0 = syz_open_procfs(0x0, &(0x7f0000000080)='net/dev_snmp6\x00') socket$inet(0x2, 0x0, 0x0) perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x1ee6b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = openat$ptmx(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$TCSETS(r1, 0x40045431, &(0x7f00000000c0)) r2 = syz_open_pts(r1, 0x0) r3 = dup3(r2, r0, 0x0) ioctl$TCXONC(r3, 0x540a, 0x0) 16:21:35 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f00000003c0)="11dca50d5e0bcfe47bf070") r1 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r1, &(0x7f0000000100)={0x2, 0x4e20}, 0x10) connect$inet(r1, &(0x7f0000000cc0)={0x2, 0x4e20, @local}, 0x10) lsetxattr$security_smack_transmute(&(0x7f0000000000)='./file0\x00', &(0x7f0000000040)='security.SMACK64TRANSMUTE\x00', &(0x7f0000000080)='TRUE', 0x4, 0x2) r2 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/vga_arbiter\x00', 0x140, 0x0) ioctl$BLKZEROOUT(r2, 0x127f, &(0x7f0000000180)={0x9}) sendto$inet(r1, &(0x7f0000000140)="b0", 0x1, 0x0, 0x0, 0x0) recvmmsg(r1, &(0x7f0000003b40)=[{{0x0, 0x0, 0x0}}], 0x1, 0x2000, 0x0) 16:21:35 executing program 4: 16:21:35 executing program 0: syz_open_procfs(0x0, &(0x7f0000000080)='net/dev_snmp6\x00') r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00000000c0)) r1 = syz_open_pts(r0, 0x0) ioctl$TCSETS2(r1, 0x402c542b, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, 0x0, "36b71128cfa8bdd3b2da4fd6a1cb228fb9755b"}) pipe(&(0x7f00000002c0)) epoll_create(0x0) pselect6(0x40, &(0x7f00000000c0)={0x3}, 0x0, &(0x7f0000000140)={0x1b7}, 0x0, 0x0) 16:21:35 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000440)={0x2, 0x70, 0xb9, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x80001, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000040)={0x0, 0xffffffffffffff84}}, 0x0) write(r0, &(0x7f0000000000)="bc", 0x1) ioctl$TCSETS(r0, 0x40045431, &(0x7f0000000a80)) r1 = syz_open_pts(r0, 0x0) readv(r1, &(0x7f00000001c0), 0xce) 16:21:35 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) socket$nl_generic(0x10, 0x3, 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000140)={0x0, 0x70, 0x1ee6b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) ioctl$TCXONC(0xffffffffffffffff, 0x540a, 0x0) 16:21:35 executing program 5: r0 = syz_open_procfs(0x0, &(0x7f0000000080)='net/dev_snmp6\x00') socket$inet(0x2, 0x0, 0x0) perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x1ee6b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = openat$ptmx(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$TCSETS(r1, 0x40045431, &(0x7f00000000c0)) r2 = syz_open_pts(r1, 0x0) r3 = dup3(r2, r0, 0x0) ioctl$TCXONC(r3, 0x540a, 0x0) 16:21:35 executing program 4: 16:21:35 executing program 0: syz_open_procfs(0x0, &(0x7f0000000080)='net/dev_snmp6\x00') r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00000000c0)) r1 = syz_open_pts(r0, 0x0) ioctl$TCSETS2(r1, 0x402c542b, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, 0x0, "36b71128cfa8bdd3b2da4fd6a1cb228fb9755b"}) pipe(&(0x7f00000002c0)) epoll_create(0xe) pselect6(0x0, 0x0, 0x0, &(0x7f0000000140)={0x1b7}, 0x0, 0x0) [ 1806.197988] binder: 13240:13243 ioctl c0306201 0 returned -14 16:21:35 executing program 4: 16:21:35 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000440)={0x2, 0x70, 0xb9, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x80001, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000040)={0x0, 0xffffffffffffff84}}, 0x0) write(r0, &(0x7f0000000000)="bc", 0x1) ioctl$TCSETS(r0, 0x40045431, &(0x7f0000000a80)) readv(0xffffffffffffffff, &(0x7f00000001c0), 0xce) ioctl$TCSETS(r0, 0x5402, &(0x7f0000000080)) 16:21:35 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) socket$nl_generic(0x10, 0x3, 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000140)={0x0, 0x70, 0x1ee6b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) ioctl$TCXONC(0xffffffffffffffff, 0x540a, 0x0) 16:21:35 executing program 5: r0 = syz_open_procfs(0x0, &(0x7f0000000080)='net/dev_snmp6\x00') socket$inet(0x2, 0x0, 0x0) perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x1ee6b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = openat$ptmx(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$TCSETS(r1, 0x40045431, &(0x7f00000000c0)) r2 = syz_open_pts(r1, 0x0) r3 = dup3(r2, r0, 0x0) ioctl$TCXONC(r3, 0x540a, 0x0) [ 1806.349035] binder: 13262:13267 ioctl c0306201 0 returned -14 16:21:36 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f00000003c0)="11dca50d5e0bcfe47bf070") r1 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r1, &(0x7f0000000100)={0x2, 0x4e20}, 0x10) connect$inet(r1, &(0x7f0000000cc0)={0x2, 0x4e20, @local}, 0x10) r2 = add_key$keyring(&(0x7f0000000000)='keyring\x00', &(0x7f0000000040)={'syz', 0x0}, 0x0, 0x0, 0xfffffffffffffffd) keyctl$clear(0x7, r2) setsockopt$SO_TIMESTAMPING(r1, 0x1, 0x25, &(0x7f00000010c0)=0x19ff, 0x4) sendto$inet(r1, &(0x7f0000000140)="b0", 0x1, 0x0, 0x0, 0x0) recvmmsg(r1, &(0x7f0000003b40)=[{{0x0, 0x0, 0x0}}], 0x1, 0x2000, 0x0) 16:21:36 executing program 4: 16:21:36 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000440)={0x2, 0x70, 0xb9, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x80001, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000040)={0x0, 0xffffffffffffff84}}, 0x0) write(r0, &(0x7f0000000000)="bc", 0x1) ioctl$TCSETS(r0, 0x40045431, &(0x7f0000000a80)) readv(0xffffffffffffffff, &(0x7f00000001c0), 0xce) ioctl$TCSETS(r0, 0x5402, &(0x7f0000000080)) 16:21:36 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) socket$nl_generic(0x10, 0x3, 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000140)={0x0, 0x70, 0x1ee6b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) ioctl$TCXONC(0xffffffffffffffff, 0x540a, 0x0) 16:21:36 executing program 5: r0 = syz_open_procfs(0x0, &(0x7f0000000080)='net/dev_snmp6\x00') socket$inet(0x2, 0x0, 0x0) perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x1ee6b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(0xffffffffffffffff, 0x40045431, &(0x7f00000000c0)) r2 = syz_open_pts(r1, 0x0) r3 = dup3(r2, r0, 0x0) ioctl$TCXONC(r3, 0x540a, 0x0) 16:21:36 executing program 0: syz_open_procfs(0x0, &(0x7f0000000080)='net/dev_snmp6\x00') r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00000000c0)) r1 = syz_open_pts(r0, 0x0) ioctl$TCSETS2(r1, 0x402c542b, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, 0x0, "36b71128cfa8bdd3b2da4fd6a1cb228fb9755b"}) pipe(&(0x7f00000002c0)) epoll_create(0xe) pselect6(0x0, 0x0, 0x0, &(0x7f0000000140)={0x1b7}, 0x0, 0x0) 16:21:36 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000440)={0x2, 0x70, 0xb9, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x80001, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000040)={0x0, 0xffffffffffffff84}}, 0x0) write(r0, &(0x7f0000000000)="bc", 0x1) ioctl$TCSETS(r0, 0x40045431, &(0x7f0000000a80)) readv(0xffffffffffffffff, &(0x7f00000001c0), 0xce) ioctl$TCSETS(r0, 0x5402, &(0x7f0000000080)) 16:21:36 executing program 4: r0 = socket(0x840000000002, 0x3, 0x200000000000ff) sendmmsg$inet(r0, &(0x7f0000001c00)=[{{&(0x7f0000000200)={0x2, 0x0, @local}, 0x10, &(0x7f00000012c0)=[{&(0x7f0000000240)="d2f474f2d23e0ee6f7a1ade6de2d762bc2212694", 0x14}], 0x1}}], 0x1, 0x0) 16:21:36 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) socket$nl_generic(0x10, 0x3, 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000140)={0x0, 0x70, 0x1ee6b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f00000003c0)='L'}) ioctl$TCXONC(0xffffffffffffffff, 0x540a, 0x0) [ 1807.133293] binder: 13282:13285 ioctl c0306201 0 returned -14 16:21:36 executing program 5: r0 = syz_open_procfs(0x0, &(0x7f0000000080)='net/dev_snmp6\x00') socket$inet(0x2, 0x0, 0x0) perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x1ee6b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(0xffffffffffffffff, 0x40045431, &(0x7f00000000c0)) r2 = syz_open_pts(r1, 0x0) r3 = dup3(r2, r0, 0x0) ioctl$TCXONC(r3, 0x540a, 0x0) 16:21:36 executing program 4: r0 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000140)='cmdline\x00') r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000000)="11dca50d5e0bcfe47bf070") pread64(r0, 0x0, 0x23a, 0x0) 16:21:36 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) socket$nl_generic(0x10, 0x3, 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000140)={0x0, 0x70, 0x1ee6b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f00000003c0)='L'}) ioctl$TCXONC(0xffffffffffffffff, 0x540a, 0x0) 16:21:37 executing program 3: pipe(&(0x7f0000000480)={0xffffffffffffffff}) vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) r1 = openat(r0, &(0x7f0000000000)='./file0\x00', 0x200, 0x2) setsockopt$inet_icmp_ICMP_FILTER(r1, 0x1, 0x1, &(0x7f0000000080)={0x6}, 0x4) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f00000003c0)="11dca50d5e0bcfe47bf070") r3 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r3, &(0x7f0000000100)={0x2, 0x4e20}, 0x10) connect$inet(r3, &(0x7f0000000cc0)={0x2, 0x4e20, @local}, 0x10) setsockopt$SO_TIMESTAMPING(r3, 0x1, 0x25, &(0x7f00000010c0)=0x19ff, 0x4) dup2(0xffffffffffffffff, r2) sendto$inet(r2, &(0x7f0000000040)="318f4304a95c6bbef847b490659f9ee1ae4ea67a91b0a75bfc5874a274d8416b05ea9ab1846f4f01212e76c1d22b5c9f1c94b377a068cfd89303a23f56", 0xffffffffffffffe9, 0x60041, 0x0, 0xffffffffffffffb3) recvmmsg(r3, &(0x7f0000003b40)=[{{0x0, 0x0, 0x0}}], 0x1, 0x2000, 0x0) 16:21:37 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000440)={0x2, 0x70, 0xb9, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x80001, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000040)={0x0, 0xffffffffffffff84}}, 0x0) write(r0, &(0x7f0000000000)="bc", 0x1) r1 = syz_open_pts(r0, 0x0) readv(r1, &(0x7f00000001c0), 0xce) ioctl$TCSETS(r0, 0x5402, &(0x7f0000000080)) 16:21:37 executing program 4: r0 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000140)='cmdline\x00') r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000000)="11dca50d5e0bcfe47bf070") pread64(r0, 0x0, 0x23a, 0x0) 16:21:37 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) socket$nl_generic(0x10, 0x3, 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000140)={0x0, 0x70, 0x1ee6b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f00000003c0)='L'}) ioctl$TCXONC(0xffffffffffffffff, 0x540a, 0x0) 16:21:37 executing program 5: r0 = syz_open_procfs(0x0, &(0x7f0000000080)='net/dev_snmp6\x00') socket$inet(0x2, 0x0, 0x0) perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x1ee6b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(0xffffffffffffffff, 0x40045431, &(0x7f00000000c0)) r2 = syz_open_pts(r1, 0x0) r3 = dup3(r2, r0, 0x0) ioctl$TCXONC(r3, 0x540a, 0x0) 16:21:37 executing program 0: syz_open_procfs(0x0, &(0x7f0000000080)='net/dev_snmp6\x00') r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00000000c0)) r1 = syz_open_pts(r0, 0x0) ioctl$TCSETS2(r1, 0x402c542b, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, 0x0, "36b71128cfa8bdd3b2da4fd6a1cb228fb9755b"}) pipe(&(0x7f00000002c0)) epoll_create(0xe) pselect6(0x0, 0x0, 0x0, &(0x7f0000000140)={0x1b7}, 0x0, 0x0) 16:21:37 executing program 4: r0 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000140)='cmdline\x00') r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000000)="11dca50d5e0bcfe47bf070") pread64(r0, 0x0, 0x23a, 0x0) 16:21:37 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) socket$nl_generic(0x10, 0x3, 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000140)={0x0, 0x70, 0x1ee6b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x0, 0x0, &(0x7f00000001c0)=ANY=[], 0x1, 0x0, &(0x7f00000003c0)='L'}) ioctl$TCXONC(0xffffffffffffffff, 0x540a, 0x0) 16:21:37 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000440)={0x2, 0x70, 0xb9, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x80001, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000040)={0x0, 0xffffffffffffff84}}, 0x0) write(r0, &(0x7f0000000000)="bc", 0x1) r1 = syz_open_pts(r0, 0x0) readv(r1, &(0x7f00000001c0), 0xce) ioctl$TCSETS(r0, 0x5402, &(0x7f0000000080)) 16:21:37 executing program 4: r0 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000140)='cmdline\x00') r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000000)="11dca50d5e0bcfe47bf070") pread64(r0, 0x0, 0x23a, 0x0) 16:21:37 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) socket$nl_generic(0x10, 0x3, 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000140)={0x0, 0x70, 0x1ee6b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x0, 0x0, &(0x7f00000001c0)=ANY=[], 0x1, 0x0, &(0x7f00000003c0)='L'}) ioctl$TCXONC(0xffffffffffffffff, 0x540a, 0x0) 16:21:37 executing program 5: r0 = syz_open_procfs(0x0, &(0x7f0000000080)='net/dev_snmp6\x00') socket$inet(0x2, 0x0, 0x0) perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x1ee6b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r1, 0x40045431, 0x0) r2 = syz_open_pts(r1, 0x0) r3 = dup3(r2, r0, 0x0) ioctl$TCXONC(r3, 0x540a, 0x0) 16:21:38 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f00000003c0)="11dca50d5e0bcfe47bf070") r1 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r1, &(0x7f0000000100)={0x2, 0x4e20}, 0x10) connect$inet(r1, &(0x7f0000000cc0)={0x2, 0x1004e22, @broadcast}, 0x10) setsockopt$SO_TIMESTAMPING(r1, 0x1, 0x25, &(0x7f00000010c0)=0x19ff, 0x4) sendto$inet(r1, &(0x7f0000000140)="b0", 0x1, 0x0, 0x0, 0x0) recvmmsg(r1, &(0x7f0000003b40)=[{{0x0, 0x0, 0x0}}], 0x1, 0x2000, 0x0) 16:21:38 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) socket$nl_generic(0x10, 0x3, 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000140)={0x0, 0x70, 0x1ee6b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x0, 0x0, &(0x7f00000001c0)=ANY=[], 0x1, 0x0, &(0x7f00000003c0)='L'}) ioctl$TCXONC(0xffffffffffffffff, 0x540a, 0x0) 16:21:38 executing program 4: r0 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000140)='cmdline\x00') socket$inet_udplite(0x2, 0x2, 0x88) pread64(r0, 0x0, 0x23a, 0x0) 16:21:38 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000440)={0x2, 0x70, 0xb9, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x80001, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000040)={0x0, 0xffffffffffffff84}}, 0x0) write(r0, &(0x7f0000000000)="bc", 0x1) r1 = syz_open_pts(r0, 0x0) readv(r1, &(0x7f00000001c0), 0xce) ioctl$TCSETS(r0, 0x5402, &(0x7f0000000080)) 16:21:38 executing program 5: r0 = syz_open_procfs(0x0, &(0x7f0000000080)='net/dev_snmp6\x00') socket$inet(0x2, 0x0, 0x0) perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x1ee6b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r1, 0x40045431, 0x0) r2 = syz_open_pts(r1, 0x0) r3 = dup3(r2, r0, 0x0) ioctl$TCXONC(r3, 0x540a, 0x0) 16:21:38 executing program 0: syz_open_procfs(0x0, &(0x7f0000000080)='net/dev_snmp6\x00') r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00000000c0)) r1 = syz_open_pts(r0, 0x0) ioctl$TCSETS2(r1, 0x402c542b, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, 0x0, "36b71128cfa8bdd3b2da4fd6a1cb228fb9755b"}) pipe(&(0x7f00000002c0)) epoll_create(0xe) pselect6(0x40, &(0x7f00000000c0), 0x0, &(0x7f0000000140)={0x1b7}, 0x0, 0x0) 16:21:38 executing program 4: r0 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000140)='cmdline\x00') socket$inet_udplite(0x2, 0x2, 0x88) pread64(r0, 0x0, 0x23a, 0x0) 16:21:38 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) socket$nl_generic(0x10, 0x3, 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000140)={0x0, 0x70, 0x1ee6b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x0, 0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB], 0x1, 0x0, &(0x7f00000003c0)='L'}) ioctl$TCXONC(0xffffffffffffffff, 0x540a, 0x0) 16:21:38 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000440)={0x2, 0x70, 0xb9, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x80001, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000040)={0x0, 0xffffffffffffff84}}, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f0000000a80)) r1 = syz_open_pts(r0, 0x0) readv(r1, &(0x7f00000001c0), 0xce) ioctl$TCSETS(r0, 0x5402, &(0x7f0000000080)) 16:21:38 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f00000003c0)="11dca50d5e0bcfe47bf070") r1 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r1, &(0x7f0000000100)={0x2, 0x4e20, @rand_addr=0x5}, 0x10) connect$inet(r1, &(0x7f0000000cc0)={0x2, 0x4e20, @local}, 0x10) setsockopt$SO_TIMESTAMPING(r1, 0x1, 0x25, &(0x7f00000010c0)=0x19ff, 0x4) sendto$inet(r1, &(0x7f0000000140)="b0", 0x1, 0x0, 0x0, 0x0) recvmmsg(r1, &(0x7f0000003b40)=[{{0x0, 0x0, 0x0}}], 0x1, 0x2000, 0x0) 16:21:38 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) socket$nl_generic(0x10, 0x3, 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000140)={0x0, 0x70, 0x1ee6b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x0, 0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB], 0x1, 0x0, &(0x7f00000003c0)='L'}) ioctl$TCXONC(0xffffffffffffffff, 0x540a, 0x0) 16:21:38 executing program 5: r0 = syz_open_procfs(0x0, &(0x7f0000000080)='net/dev_snmp6\x00') socket$inet(0x2, 0x0, 0x0) perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x1ee6b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r1, 0x40045431, 0x0) r2 = syz_open_pts(r1, 0x0) r3 = dup3(r2, r0, 0x0) ioctl$TCXONC(r3, 0x540a, 0x0) 16:21:38 executing program 4: r0 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000140)='cmdline\x00') socket$inet_udplite(0x2, 0x2, 0x88) pread64(r0, 0x0, 0x23a, 0x0) 16:21:38 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) socket$nl_generic(0x10, 0x3, 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000140)={0x0, 0x70, 0x1ee6b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x0, 0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB], 0x1, 0x0, &(0x7f00000003c0)='L'}) ioctl$TCXONC(0xffffffffffffffff, 0x540a, 0x0) 16:21:38 executing program 4: r0 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000140)='cmdline\x00') ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000000)="11dca50d5e0bcfe47bf070") pread64(r0, 0x0, 0x23a, 0x0) 16:21:38 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) socket$nl_generic(0x10, 0x3, 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000140)={0x0, 0x70, 0x1ee6b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x76, 0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB="0563044000000000046304400000000006630440000000007997506ea39438033ada635f7cd4c9d1de50cf51e7a773b356e7348d3b19cbdc76ed97a6a08da8997815ea9e6d3b6a1d5a7c1cdf78337a6166cfd70cf41b6cb958e69b7dae4fe74a09c8e4db4c323ba219438b49c2f1736eb01b18c09851"], 0x1, 0x0, &(0x7f00000003c0)='L'}) ioctl$TCXONC(0xffffffffffffffff, 0x540a, 0x0) 16:21:38 executing program 5: r0 = syz_open_procfs(0x0, &(0x7f0000000080)='net/dev_snmp6\x00') socket$inet(0x2, 0x0, 0x0) perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x1ee6b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r1, 0x40045431, &(0x7f00000000c0)) r2 = syz_open_pts(0xffffffffffffffff, 0x0) r3 = dup3(r2, r0, 0x0) ioctl$TCXONC(r3, 0x540a, 0x0) [ 1809.226552] binder: 13412:13418 Acquire 1 refcount change on invalid ref 0 ret -22 [ 1809.239944] binder: 13412:13418 IncRefs 0 refcount change on invalid ref 0 ret -22 [ 1809.250190] binder: 13412:13418 Release 1 refcount change on invalid ref 0 ret -22 [ 1809.258094] binder: 13412:13418 unknown command 1850775417 [ 1809.274782] binder: 13412:13418 ioctl c0306201 200000c0 returned -22 16:21:39 executing program 0: syz_open_procfs(0x0, &(0x7f0000000080)='net/dev_snmp6\x00') r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00000000c0)) r1 = syz_open_pts(r0, 0x0) ioctl$TCSETS2(r1, 0x402c542b, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, 0x0, "36b71128cfa8bdd3b2da4fd6a1cb228fb9755b"}) pipe(&(0x7f00000002c0)) epoll_create(0xe) pselect6(0x40, &(0x7f00000000c0), 0x0, &(0x7f0000000140)={0x1b7}, 0x0, 0x0) 16:21:39 executing program 4: r0 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000140)='cmdline\x00') ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000000)="11dca50d5e0bcfe47bf070") pread64(r0, 0x0, 0x23a, 0x0) 16:21:39 executing program 5: r0 = syz_open_procfs(0x0, &(0x7f0000000080)='net/dev_snmp6\x00') socket$inet(0x2, 0x0, 0x0) perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x1ee6b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r1, 0x40045431, &(0x7f00000000c0)) r2 = syz_open_pts(0xffffffffffffffff, 0x0) r3 = dup3(r2, r0, 0x0) ioctl$TCXONC(r3, 0x540a, 0x0) 16:21:39 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000440)={0x2, 0x70, 0xb9, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x80001, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000040)={0x0, 0xffffffffffffff84}}, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f0000000a80)) r1 = syz_open_pts(r0, 0x0) readv(r1, &(0x7f00000001c0), 0xce) ioctl$TCSETS(r0, 0x5402, &(0x7f0000000080)) 16:21:39 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) socket$nl_generic(0x10, 0x3, 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000140)={0x0, 0x70, 0x1ee6b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x76, 0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB="0563044000000000046304400000000006630440000000007997506ea39438033ada635f7cd4c9d1de50cf51e7a773b356e7348d3b19cbdc76ed97a6a08da8997815ea9e6d3b6a1d5a7c1cdf78337a6166cfd70cf41b6cb958e69b7dae4fe74a09c8e4db4c323ba219438b49c2f1736eb01b18c09851"], 0x1, 0x0, &(0x7f00000003c0)='L'}) ioctl$TCXONC(0xffffffffffffffff, 0x540a, 0x0) 16:21:39 executing program 4: r0 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000140)='cmdline\x00') ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000000)="11dca50d5e0bcfe47bf070") pread64(r0, 0x0, 0x23a, 0x0) 16:21:39 executing program 5: r0 = syz_open_procfs(0x0, &(0x7f0000000080)='net/dev_snmp6\x00') socket$inet(0x2, 0x0, 0x0) perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x1ee6b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r1, 0x40045431, &(0x7f00000000c0)) r2 = syz_open_pts(0xffffffffffffffff, 0x0) r3 = dup3(r2, r0, 0x0) ioctl$TCXONC(r3, 0x540a, 0x0) 16:21:39 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f00000003c0)="11dca50d5e0bcfe47bf070") r1 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r1, &(0x7f0000000100)={0x2, 0x4e20}, 0x10) connect$inet(r1, &(0x7f0000000cc0)={0x2, 0x4e20, @local}, 0x10) setsockopt$SO_TIMESTAMPING(r1, 0x1, 0x25, &(0x7f00000010c0)=0x19ff, 0x4) r2 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/enforce\x00', 0x2, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f00000003c0)='./file0/file0\x00', 0x20000, 0x60) r4 = openat$full(0xffffffffffffff9c, &(0x7f0000000200)='/dev/full\x00', 0x412002, 0x0) pipe(&(0x7f0000000480)={0xffffffffffffffff, 0xffffffffffffffff}) write(r5, &(0x7f0000000340), 0x41395527) accept4$packet(r5, &(0x7f0000000240)={0x11, 0x0, 0x0}, &(0x7f0000000280)=0x14, 0x0) ioctl$sock_inet6_SIOCDIFADDR(r4, 0x8936, &(0x7f00000002c0)={@empty, 0x3, r6}) accept$packet(0xffffffffffffffff, &(0x7f0000000400)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000440)=0x14) r8 = gettid() ptrace$setopts(0x4206, r8, 0x0, 0x0) tkill(r8, 0x3c) ptrace$cont(0x18, r8, 0x0, 0x0) ptrace$setregs(0xd, r8, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r8, 0x0, 0x0) pipe(&(0x7f0000000480)={0xffffffffffffffff}) vmsplice(r9, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) getsockopt$sock_cred(r9, 0x1, 0x11, &(0x7f00000004c0), &(0x7f0000000500)=0xc) perf_event_open(&(0x7f0000000340)={0x0, 0x70, 0xf5, 0x9, 0x10001, 0x4, 0x0, 0x6, 0x20002, 0x4, 0x4, 0x8, 0xc4ae, 0x3, 0x41ef, 0x3, 0x4, 0x7, 0x9e, 0x3, 0x80, 0x0, 0xffff, 0xfffffffffffffc05, 0x1, 0x80d, 0xfffffffffffffff7, 0x4c4, 0x2, 0x0, 0x10001, 0x2, 0x7e2f, 0x1, 0x8e, 0x2, 0x4, 0x8000, 0x0, 0x2, 0x0, @perf_config_ext={0x9, 0x7}, 0x2082, 0x0, 0x1000, 0x0, 0x7f, 0x6, 0x6}, r8, 0x2, 0xffffffffffffffff, 0x3) ioctl$sock_inet6_SIOCSIFDSTADDR(r3, 0x8918, &(0x7f0000000480)={@mcast2, 0x3f, r7}) sendmsg$nl_route_sched(r2, &(0x7f00000001c0)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x40000}, 0xc, &(0x7f0000000180)={&(0x7f0000000080)=@gettfilter={0x54, 0x2e, 0x304, 0x70bd2b, 0x25dfdbfe, {0x0, r7, {0x4, 0xe}, {0xffff, 0xffef}, {0xfff1, 0x5}}, [{0x8, 0xb, 0x2}, {0x8, 0xb, 0x7}, {0x8, 0xb, 0x400000010001}, {0x8, 0xb, 0x10001}, {0x8, 0xb, 0x40083}, {0xfffffffffffffdbe, 0xb, 0x6}]}, 0x54}, 0x1, 0x0, 0x0, 0x4000}, 0x34) pipe(&(0x7f0000000300)) sendto$inet(r1, &(0x7f0000000140)="b0", 0x1, 0x0, 0x0, 0x0) recvmmsg(r1, &(0x7f0000003b40)=[{{0x0, 0x0, 0x0}}], 0x1, 0x2000, 0x0) 16:21:39 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="11dca50d5e0bcfe47bf070") pread64(0xffffffffffffffff, 0x0, 0x23a, 0x0) [ 1809.961708] binder: 13447:13453 Acquire 1 refcount change on invalid ref 0 ret -22 [ 1809.976435] binder: 13447:13453 IncRefs 0 refcount change on invalid ref 0 ret -22 [ 1809.994409] binder: 13447:13453 Release 1 refcount change on invalid ref 0 ret -22 [ 1810.004525] binder: 13447:13453 unknown command 1850775417 16:21:39 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="11dca50d5e0bcfe47bf070") pread64(0xffffffffffffffff, 0x0, 0x23a, 0x0) 16:21:39 executing program 5: r0 = syz_open_procfs(0x0, &(0x7f0000000080)='net/dev_snmp6\x00') socket$inet(0x2, 0x0, 0x0) perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x1ee6b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r1, 0x40045431, &(0x7f00000000c0)) syz_open_pts(r1, 0x0) r2 = dup3(0xffffffffffffffff, r0, 0x0) ioctl$TCXONC(r2, 0x540a, 0x0) 16:21:39 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) socket$nl_generic(0x10, 0x3, 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000140)={0x0, 0x70, 0x1ee6b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x1, 0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB="05"], 0x1, 0x0, &(0x7f00000003c0)='L'}) ioctl$TCXONC(0xffffffffffffffff, 0x540a, 0x0) [ 1810.011158] binder: 13447:13453 ioctl c0306201 200000c0 returned -22 [ 1810.103668] binder: 13481:13482 unknown command 5 [ 1810.108771] binder: 13481:13482 ioctl c0306201 200000c0 returned -22 16:21:40 executing program 0: syz_open_procfs(0x0, &(0x7f0000000080)='net/dev_snmp6\x00') r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00000000c0)) r1 = syz_open_pts(r0, 0x0) ioctl$TCSETS2(r1, 0x402c542b, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, 0x0, "36b71128cfa8bdd3b2da4fd6a1cb228fb9755b"}) pipe(&(0x7f00000002c0)) epoll_create(0xe) pselect6(0x40, &(0x7f00000000c0), 0x0, &(0x7f0000000140)={0x1b7}, 0x0, 0x0) 16:21:40 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f00000003c0)="11dca50d5e0bcfe47bf070") r1 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r1, &(0x7f0000000100)={0x2, 0x4e20}, 0x10) connect$inet(r1, &(0x7f0000000cc0)={0x2, 0x4e20, @local}, 0x10) setsockopt$SO_TIMESTAMPING(r1, 0x1, 0x25, &(0x7f00000010c0)=0x19ff, 0x4) pipe(&(0x7f0000000480)={0xffffffffffffffff}) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) r3 = openat(r2, &(0x7f0000000000)='./file0\x00', 0x1400, 0x102) write$selinux_load(r3, &(0x7f0000000040)={0xf97cff8c, 0x8, 'SE Linux', "e15b45841999bbd75aceb77dabbb94d07f8a90fc1a230f6b9f6df6854d4e977c7158ded7518e15a033f8bf4afc8a797dc23431b809a576424e3ebc2652046eeedea05151579a81"}, 0x57) sendto$inet(r1, &(0x7f0000000140)="b0", 0x1, 0x0, 0x0, 0x0) recvmmsg(r1, &(0x7f0000003b40)=[{{0x0, 0x0, 0x0}}], 0x1, 0x2000, 0x0) 16:21:40 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="11dca50d5e0bcfe47bf070") pread64(0xffffffffffffffff, 0x0, 0x23a, 0x0) 16:21:40 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000440)={0x2, 0x70, 0xb9, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x80001, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000040)={0x0, 0xffffffffffffff84}}, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f0000000a80)) r1 = syz_open_pts(r0, 0x0) readv(r1, &(0x7f00000001c0), 0xce) ioctl$TCSETS(r0, 0x5402, &(0x7f0000000080)) 16:21:40 executing program 5: r0 = syz_open_procfs(0x0, &(0x7f0000000080)='net/dev_snmp6\x00') socket$inet(0x2, 0x0, 0x0) perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x1ee6b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r1, 0x40045431, &(0x7f00000000c0)) syz_open_pts(r1, 0x0) r2 = dup3(0xffffffffffffffff, r0, 0x0) ioctl$TCXONC(r2, 0x540a, 0x0) 16:21:40 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) socket$nl_generic(0x10, 0x3, 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000140)={0x0, 0x70, 0x1ee6b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x1, 0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB="05"], 0x1, 0x0, &(0x7f00000003c0)='L'}) ioctl$TCXONC(0xffffffffffffffff, 0x540a, 0x0) 16:21:40 executing program 4: r0 = syz_open_procfs(0xffffffffffffffff, 0x0) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000000)="11dca50d5e0bcfe47bf070") pread64(r0, 0x0, 0x23a, 0x0) 16:21:40 executing program 4: r0 = syz_open_procfs(0xffffffffffffffff, 0x0) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000000)="11dca50d5e0bcfe47bf070") pread64(r0, 0x0, 0x23a, 0x0) 16:21:40 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) socket$nl_generic(0x10, 0x3, 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000140)={0x0, 0x70, 0x1ee6b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x1, 0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB="05"], 0x1, 0x0, &(0x7f00000003c0)='L'}) ioctl$TCXONC(0xffffffffffffffff, 0x540a, 0x0) [ 1810.737632] binder: 13495:13502 unknown command 5 [ 1810.743637] binder: 13495:13502 ioctl c0306201 200000c0 returned -22 16:21:40 executing program 4: r0 = syz_open_procfs(0xffffffffffffffff, 0x0) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000000)="11dca50d5e0bcfe47bf070") pread64(r0, 0x0, 0x23a, 0x0) 16:21:40 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) socket$nl_generic(0x10, 0x3, 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000140)={0x0, 0x70, 0x1ee6b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x3c, 0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB="0563044000000000046304400000000006630440000000007997506ea39438033ada635f7cd4c9d1de50cf51e7a773b356e7348d3b19cbdc76ed97a6"], 0x1, 0x0, &(0x7f00000003c0)='L'}) ioctl$TCXONC(0xffffffffffffffff, 0x540a, 0x0) 16:21:40 executing program 5: r0 = syz_open_procfs(0x0, &(0x7f0000000080)='net/dev_snmp6\x00') socket$inet(0x2, 0x0, 0x0) perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x1ee6b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r1, 0x40045431, &(0x7f00000000c0)) syz_open_pts(r1, 0x0) r2 = dup3(0xffffffffffffffff, r0, 0x0) ioctl$TCXONC(r2, 0x540a, 0x0) [ 1810.813472] binder: 13516:13517 unknown command 5 [ 1810.818630] binder: 13516:13517 ioctl c0306201 200000c0 returned -22 [ 1810.894718] binder: 13526:13528 Acquire 1 refcount change on invalid ref 0 ret -22 [ 1810.906066] binder: 13526:13528 IncRefs 0 refcount change on invalid ref 0 ret -22 [ 1810.914490] binder: 13526:13528 Release 1 refcount change on invalid ref 0 ret -22 [ 1810.922495] binder: 13526:13528 unknown command 1850775417 [ 1810.928297] binder: 13526:13528 ioctl c0306201 200000c0 returned -22 16:21:40 executing program 0: syz_open_procfs(0x0, &(0x7f0000000080)='net/dev_snmp6\x00') r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00000000c0)) r1 = syz_open_pts(r0, 0x0) ioctl$TCSETS2(r1, 0x402c542b, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, 0x0, "36b71128cfa8bdd3b2da4fd6a1cb228fb9755b"}) pipe(&(0x7f00000002c0)) epoll_create(0xe) pselect6(0x40, &(0x7f00000000c0)={0x3}, 0x0, 0x0, 0x0, 0x0) 16:21:41 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) r1 = openat$selinux_mls(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/mls\x00', 0x0, 0x0) sendmsg$TIPC_CMD_GET_LINKS(r1, &(0x7f0000000180)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f00000000c0)={&(0x7f0000000080)={0x24, 0x0, 0x100, 0x70bd2b, 0x25dfdbfd, {{}, 0x0, 0x4, 0x0, {0x8, 0x11, 0x397c}}, ["", "", "", "", "", "", "", "", "", ""]}, 0x24}, 0x1, 0x0, 0x0, 0x800}, 0x4012010) ioctl(r0, 0x1000008912, &(0x7f00000003c0)="11dca50d5e0bcfe47bf070") r2 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r2, &(0x7f0000000100)={0x2, 0x4e20}, 0x10) connect$inet(r2, &(0x7f0000000cc0)={0x2, 0x4e20, @local}, 0x10) setsockopt$SO_TIMESTAMPING(r2, 0x1, 0x25, &(0x7f00000010c0)=0x19ff, 0x4) sendto$inet(r2, &(0x7f0000000140)="b0", 0x1, 0x0, 0x0, 0x0) recvmmsg(r2, &(0x7f0000003b40)=[{{0x0, 0x0, 0x0}}], 0x1, 0x2000, 0x0) 16:21:41 executing program 4: r0 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000140)='cmdline\x00') socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000000)="11dca50d5e0bcfe47bf070") pread64(r0, 0x0, 0x23a, 0x0) 16:21:41 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) socket$nl_generic(0x10, 0x3, 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000140)={0x0, 0x70, 0x1ee6b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x3c, 0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB="0563044000000000046304400000000006630440000000007997506ea39438033ada635f7cd4c9d1de50cf51e7a773b356e7348d3b19cbdc76ed97a6"], 0x1, 0x0, &(0x7f00000003c0)='L'}) ioctl$TCXONC(0xffffffffffffffff, 0x540a, 0x0) 16:21:41 executing program 5: syz_open_procfs(0x0, &(0x7f0000000080)='net/dev_snmp6\x00') socket$inet(0x2, 0x0, 0x0) perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x1ee6b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00000000c0)) r1 = syz_open_pts(r0, 0x0) r2 = dup3(r1, 0xffffffffffffffff, 0x0) ioctl$TCXONC(r2, 0x540a, 0x0) 16:21:41 executing program 0: syz_open_procfs(0x0, &(0x7f0000000080)='net/dev_snmp6\x00') r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00000000c0)) r1 = syz_open_pts(r0, 0x0) ioctl$TCSETS2(r1, 0x402c542b, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, 0x0, "36b71128cfa8bdd3b2da4fd6a1cb228fb9755b"}) pipe(&(0x7f00000002c0)) epoll_create(0xe) pselect6(0x40, &(0x7f00000000c0)={0x3}, 0x0, 0x0, 0x0, 0x0) 16:21:41 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000440)={0x2, 0x70, 0xb9, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x80001, 0x0) write(r0, &(0x7f0000000000)="bc", 0x1) ioctl$TCSETS(r0, 0x40045431, &(0x7f0000000a80)) r1 = syz_open_pts(r0, 0x0) readv(r1, &(0x7f00000001c0), 0xce) ioctl$TCSETS(r0, 0x5402, &(0x7f0000000080)) 16:21:41 executing program 4: r0 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000140)='cmdline\x00') socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000000)="11dca50d5e0bcfe47bf070") pread64(r0, 0x0, 0x23a, 0x0) 16:21:41 executing program 0: syz_open_procfs(0x0, &(0x7f0000000080)='net/dev_snmp6\x00') r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00000000c0)) r1 = syz_open_pts(r0, 0x0) ioctl$TCSETS2(r1, 0x402c542b, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, 0x0, "36b71128cfa8bdd3b2da4fd6a1cb228fb9755b"}) pipe(&(0x7f00000002c0)) epoll_create(0xe) pselect6(0x40, &(0x7f00000000c0)={0x3}, 0x0, 0x0, 0x0, 0x0) [ 1811.624598] binder: 13541:13551 Acquire 1 refcount change on invalid ref 0 ret -22 [ 1811.635888] binder: 13541:13551 IncRefs 0 refcount change on invalid ref 0 ret -22 [ 1811.656972] binder: 13541:13551 Release 1 refcount change on invalid ref 0 ret -22 16:21:41 executing program 5: syz_open_procfs(0x0, &(0x7f0000000080)='net/dev_snmp6\x00') socket$inet(0x2, 0x0, 0x0) perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x1ee6b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00000000c0)) r1 = syz_open_pts(r0, 0x0) r2 = dup3(r1, 0xffffffffffffffff, 0x0) ioctl$TCXONC(r2, 0x540a, 0x0) 16:21:41 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000440)={0x2, 0x70, 0xb9, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x80001, 0x0) write(r0, &(0x7f0000000000)="bc", 0x1) ioctl$TCSETS(r0, 0x40045431, &(0x7f0000000a80)) r1 = syz_open_pts(r0, 0x0) readv(r1, &(0x7f00000001c0), 0xce) ioctl$TCSETS(r0, 0x5402, &(0x7f0000000080)) 16:21:41 executing program 0: syz_open_procfs(0x0, &(0x7f0000000080)='net/dev_snmp6\x00') r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00000000c0)) r1 = syz_open_pts(r0, 0x0) ioctl$TCSETS2(r1, 0x402c542b, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, 0x0, "36b71128cfa8bdd3b2da4fd6a1cb228fb9755b"}) pipe(&(0x7f00000002c0)) epoll_create(0xe) pselect6(0x40, &(0x7f00000000c0)={0x3}, 0x0, &(0x7f0000000140), 0x0, 0x0) 16:21:41 executing program 4: r0 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000140)='cmdline\x00') socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000000)="11dca50d5e0bcfe47bf070") pread64(r0, 0x0, 0x23a, 0x0) [ 1811.675188] binder: 13541:13551 unknown command 1850775417 [ 1811.699430] binder: 13541:13551 ioctl c0306201 200000c0 returned -22 16:21:41 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f00000003c0)="11dca50d5e0bcfe47bf070") r1 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r1, &(0x7f0000000100)={0x2, 0x4e20}, 0x10) connect$inet(r1, &(0x7f0000000cc0)={0x2, 0x4e20, @local}, 0x10) setsockopt$SO_TIMESTAMPING(r1, 0x1, 0x25, &(0x7f00000010c0)=0x19ff, 0x4) sendto$inet(r1, &(0x7f0000000140)="b0", 0x1, 0x0, 0x0, 0x0) recvmmsg(r1, &(0x7f0000003b40), 0x1, 0x2000, 0x0) 16:21:41 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) socket$nl_generic(0x10, 0x3, 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000140)={0x0, 0x70, 0x1ee6b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x3c, 0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB="0563044000000000046304400000000006630440000000007997506ea39438033ada635f7cd4c9d1de50cf51e7a773b356e7348d3b19cbdc76ed97a6"], 0x1, 0x0, &(0x7f00000003c0)='L'}) ioctl$TCXONC(0xffffffffffffffff, 0x540a, 0x0) 16:21:41 executing program 0: syz_open_procfs(0x0, &(0x7f0000000080)='net/dev_snmp6\x00') r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00000000c0)) r1 = syz_open_pts(r0, 0x0) ioctl$TCSETS2(r1, 0x402c542b, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, 0x0, "36b71128cfa8bdd3b2da4fd6a1cb228fb9755b"}) pipe(&(0x7f00000002c0)) epoll_create(0xe) pselect6(0x40, &(0x7f00000000c0)={0x3}, 0x0, &(0x7f0000000140), 0x0, 0x0) 16:21:41 executing program 4: r0 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000140)='cmdline\x00') r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x0, &(0x7f0000000000)="11dca50d5e0bcfe47bf070") pread64(r0, 0x0, 0x23a, 0x0) 16:21:41 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000440)={0x2, 0x70, 0xb9, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x80001, 0x0) write(r0, &(0x7f0000000000)="bc", 0x1) ioctl$TCSETS(r0, 0x40045431, &(0x7f0000000a80)) r1 = syz_open_pts(r0, 0x0) readv(r1, &(0x7f00000001c0), 0xce) ioctl$TCSETS(r0, 0x5402, &(0x7f0000000080)) 16:21:41 executing program 5: syz_open_procfs(0x0, &(0x7f0000000080)='net/dev_snmp6\x00') socket$inet(0x2, 0x0, 0x0) perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x1ee6b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00000000c0)) r1 = syz_open_pts(r0, 0x0) r2 = dup3(r1, 0xffffffffffffffff, 0x0) ioctl$TCXONC(r2, 0x540a, 0x0) 16:21:42 executing program 4: r0 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000140)='cmdline\x00') r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x0, &(0x7f0000000000)="11dca50d5e0bcfe47bf070") pread64(r0, 0x0, 0x23a, 0x0) 16:21:42 executing program 0: syz_open_procfs(0x0, &(0x7f0000000080)='net/dev_snmp6\x00') r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00000000c0)) r1 = syz_open_pts(r0, 0x0) ioctl$TCSETS2(r1, 0x402c542b, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, 0x0, "36b71128cfa8bdd3b2da4fd6a1cb228fb9755b"}) pipe(&(0x7f00000002c0)) epoll_create(0xe) pselect6(0x40, &(0x7f00000000c0)={0x3}, 0x0, &(0x7f0000000140), 0x0, 0x0) [ 1812.538437] binder: 13589:13596 Acquire 1 refcount change on invalid ref 0 ret -22 [ 1812.563103] binder: 13589:13596 IncRefs 0 refcount change on invalid ref 0 ret -22 16:21:42 executing program 5: r0 = syz_open_procfs(0x0, &(0x7f0000000080)='net/dev_snmp6\x00') socket$inet(0x2, 0x0, 0x0) perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x1ee6b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r1, 0x40045431, &(0x7f00000000c0)) r2 = syz_open_pts(r1, 0x0) dup3(r2, r0, 0x0) ioctl$TCXONC(0xffffffffffffffff, 0x540a, 0x0) 16:21:42 executing program 4: r0 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000140)='cmdline\x00') r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x0, &(0x7f0000000000)="11dca50d5e0bcfe47bf070") pread64(r0, 0x0, 0x23a, 0x0) [ 1812.590476] binder: 13589:13596 Release 1 refcount change on invalid ref 0 ret -22 [ 1812.617725] binder: 13589:13596 unknown command 1850775417 16:21:42 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000440)={0x2, 0x70, 0xb9, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000040)={0x0, 0xffffffffffffff84}}, 0x0) write(0xffffffffffffffff, &(0x7f0000000000)="bc", 0x1) ioctl$TCSETS(0xffffffffffffffff, 0x40045431, &(0x7f0000000a80)) r0 = syz_open_pts(0xffffffffffffffff, 0x0) readv(r0, &(0x7f00000001c0), 0xce) ioctl$TCSETS(0xffffffffffffffff, 0x5402, &(0x7f0000000080)) 16:21:42 executing program 0: [ 1812.641241] binder: 13589:13596 ioctl c0306201 200000c0 returned -22 16:21:42 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f00000003c0)="11dca50d5e0bcfe47bf070") r1 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r1, &(0x7f0000000100)={0x2, 0x4e20}, 0x10) connect$inet(r1, &(0x7f0000000cc0)={0x2, 0x4e20, @local}, 0x10) setsockopt$SO_TIMESTAMPING(r1, 0x1, 0x25, &(0x7f00000010c0)=0x19ff, 0x4) sendto$inet(r1, &(0x7f0000000000)="4a138400b14f186f89830ad4eee1396907831fc555f3b2d2e1371e4c66f44632c331f9ee4a438d3dcb4c60b6792ccf202e0bee8e18c56e68aaf6c7ec8b94c73b4970d8dada6eb6348a42212f701d7cfd167cd692bfe8afe2620c07e2ee64e24ff25728ef9f31f616373b22897f853581a610d3870023624075b3e6743d3f72", 0x7f, 0x0, 0x0, 0x0) recvmmsg(r1, &(0x7f0000003b40)=[{{0x0, 0x0, 0x0}}], 0x1, 0x2000, 0x0) 16:21:42 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) socket$nl_generic(0x10, 0x3, 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000140)={0x0, 0x70, 0x1ee6b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x59, 0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB="0563044000000000046304400000000006630440000000007997506ea39438033ada635f7cd4c9d1de50cf51e7a773b356e7348d3b19cbdc76ed97a6a08da8997815ea9e6d3b6a1d5a7c1cdf78337a6166cfd70cf41b6cb958"], 0x1, 0x0, &(0x7f00000003c0)='L'}) ioctl$TCXONC(0xffffffffffffffff, 0x540a, 0x0) 16:21:42 executing program 4: r0 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000140)='cmdline\x00') r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, 0x0) pread64(r0, 0x0, 0x23a, 0x0) 16:21:42 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000440)={0x2, 0x70, 0xb9, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000040)={0x0, 0xffffffffffffff84}}, 0x0) write(0xffffffffffffffff, &(0x7f0000000000)="bc", 0x1) ioctl$TCSETS(0xffffffffffffffff, 0x40045431, &(0x7f0000000a80)) r0 = syz_open_pts(0xffffffffffffffff, 0x0) readv(r0, &(0x7f00000001c0), 0xce) ioctl$TCSETS(0xffffffffffffffff, 0x5402, &(0x7f0000000080)) 16:21:42 executing program 0: 16:21:42 executing program 5: r0 = syz_open_procfs(0x0, &(0x7f0000000080)='net/dev_snmp6\x00') socket$inet(0x2, 0x0, 0x0) perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x1ee6b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r1, 0x40045431, &(0x7f00000000c0)) r2 = syz_open_pts(r1, 0x0) dup3(r2, r0, 0x0) ioctl$TCXONC(0xffffffffffffffff, 0x540a, 0x0) 16:21:42 executing program 0: 16:21:42 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000440)={0x2, 0x70, 0xb9, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000040)={0x0, 0xffffffffffffff84}}, 0x0) write(0xffffffffffffffff, &(0x7f0000000000)="bc", 0x1) ioctl$TCSETS(0xffffffffffffffff, 0x40045431, &(0x7f0000000a80)) r0 = syz_open_pts(0xffffffffffffffff, 0x0) readv(r0, &(0x7f00000001c0), 0xce) ioctl$TCSETS(0xffffffffffffffff, 0x5402, &(0x7f0000000080)) 16:21:42 executing program 4: r0 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000140)='cmdline\x00') r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, 0x0) pread64(r0, 0x0, 0x23a, 0x0) [ 1813.481366] binder: 13634:13640 Acquire 1 refcount change on invalid ref 0 ret -22 [ 1813.512814] binder: 13634:13640 IncRefs 0 refcount change on invalid ref 0 ret -22 16:21:43 executing program 0: [ 1813.538161] binder: 13634:13640 Release 1 refcount change on invalid ref 0 ret -22 [ 1813.569154] binder: 13634:13640 unknown command 1850775417 [ 1813.582065] binder: 13634:13640 ioctl c0306201 200000c0 returned -22 16:21:43 executing program 5: r0 = syz_open_procfs(0x0, &(0x7f0000000080)='net/dev_snmp6\x00') socket$inet(0x2, 0x0, 0x0) perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x1ee6b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r1, 0x40045431, &(0x7f00000000c0)) r2 = syz_open_pts(r1, 0x0) dup3(r2, r0, 0x0) ioctl$TCXONC(0xffffffffffffffff, 0x540a, 0x0) 16:21:43 executing program 0: r0 = socket$nl_route(0x10, 0x3, 0x0) getpeername(r0, &(0x7f0000000280)=@pppol2tpin6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @initdev}}}, &(0x7f0000000000)=0x80) fcntl$lock(r1, 0x1, 0x0) 16:21:43 executing program 4: r0 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000140)='cmdline\x00') r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, 0x0) pread64(r0, 0x0, 0x23a, 0x0) 16:21:43 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x80001, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000040)={0x0, 0xffffffffffffff84}}, 0x0) write(r0, &(0x7f0000000000)="bc", 0x1) ioctl$TCSETS(r0, 0x40045431, &(0x7f0000000a80)) r1 = syz_open_pts(r0, 0x0) readv(r1, &(0x7f00000001c0), 0xce) ioctl$TCSETS(r0, 0x5402, &(0x7f0000000080)) 16:21:43 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) socket$nl_generic(0x10, 0x3, 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000140)={0x0, 0x70, 0x1ee6b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x59, 0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB="0563044000000000046304400000000006630440000000007997506ea39438033ada635f7cd4c9d1de50cf51e7a773b356e7348d3b19cbdc76ed97a6a08da8997815ea9e6d3b6a1d5a7c1cdf78337a6166cfd70cf41b6cb958"], 0x1, 0x0, &(0x7f00000003c0)='L'}) ioctl$TCXONC(0xffffffffffffffff, 0x540a, 0x0) 16:21:43 executing program 0: r0 = open(&(0x7f0000000140)='./file0\x00', 0x110162, 0x0) r1 = dup2(r0, 0xffffffffffffffff) preadv(r1, 0x0, 0x0, 0x0) 16:21:43 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f00000003c0)="11dca50d5e0bcfe47bf070") ioctl$sock_ifreq(r0, 0x8990, &(0x7f0000000240)={'ipddp0\x00', @ifru_mtu=0x6}) r1 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r1, &(0x7f0000000100)={0x2, 0x4e20}, 0x10) pipe(&(0x7f0000000480)={0xffffffffffffffff}) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) munlockall() accept4(r2, &(0x7f0000000000)=@nfc, &(0x7f0000000080)=0x80, 0xdc7d8b9d693f05c7) connect$inet(r1, &(0x7f0000000cc0)={0x2, 0x4e20, @local}, 0x10) setsockopt$SO_TIMESTAMPING(r1, 0x1, 0x25, &(0x7f00000010c0)=0x19ff, 0x4) sendto$inet(r1, &(0x7f0000000140)="b0", 0x1, 0x0, 0x0, 0x0) recvmmsg(r1, &(0x7f0000003b40)=[{{0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffcd6}}], 0x4000000000003a6, 0x2000, 0x0) readlink(&(0x7f00000000c0)='./file0\x00', &(0x7f0000000280)=""/152, 0x98) 16:21:43 executing program 5: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000bfff0)={&(0x7f0000000380)=ANY=[@ANYBLOB="b8000000190001040000000000000000ff010000000000000000000000000001e000000100000000000000000000000000000000000000000a004f0000000000", @ANYRES32, @ANYRES32=0x0, @ANYBLOB="000000000000000000000000000000000000000000000000fcffffffffffffff00000000000000000000000000000000ff0700000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000c7e1053f03d985710bbec307a4138033c30b61c50e95d8c81a93a98029c79e2fb5407bbaf604e0ada406cce4d95d3eefeb242dbc768b006f694e94cdd28bdb909a1b4c4c2c146eb7c138fd277d5e957ef757657504210512500a124ddd63657d1b5013cfd35b50d6f9536ce86c31d949ff0b009bbcba5fc484cb98a75156f300ad467a309d14b9f65470fe652422d8aa03f2e4ef9b5aa817d5b0ebe0ef57d93ba6c82a1b63f90aecd7e9dc493415d3454604dea6eecf3b601a264573260b863442064037fc3d07954445f5eb1c79c11ef6a913d48f6d5ab008b332a0242731f8b51753f7a24d6c6455ee817b79d658b25b276db5c9cd4845d0550de0f2ea24585e2bf0fa05097b69a61a4adc8e28cf704da6cf159a0247a896a6604f7d91182e10c388d6a91d05243914fd6d5c7052c2dca3f7140b48967"], 0xb8}}, 0x0) 16:21:43 executing program 0: openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000080)='./cgroup.cpu\x00', 0x200002, 0x0) fchdir(0xffffffffffffffff) r0 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_tx_ring(r0, 0x107, 0x5, &(0x7f0000000040)=@req3={0x10000, 0x100000001, 0x10000, 0x1}, 0x1c) pipe(&(0x7f0000000680)={0xffffffffffffffff, 0xffffffffffffffff}) write(r2, &(0x7f0000000340), 0x41395527) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clock_gettime(0x0, &(0x7f0000000600)={0x0, 0x0}) pselect6(0x40, &(0x7f00000000c0), 0x0, &(0x7f0000000140)={0xff}, &(0x7f0000000200)={0x0, r3+30000000}, 0x0) vmsplice(r1, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) 16:21:43 executing program 4: r0 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000140)='cmdline\x00') r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000000)) pread64(r0, 0x0, 0x23a, 0x0) [ 1814.425516] binder: 13680:13686 Acquire 1 refcount change on invalid ref 0 ret -22 16:21:43 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x80001, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000040)={0x0, 0xffffffffffffff84}}, 0x0) write(r0, &(0x7f0000000000)="bc", 0x1) ioctl$TCSETS(r0, 0x40045431, &(0x7f0000000a80)) r1 = syz_open_pts(r0, 0x0) readv(r1, &(0x7f00000001c0), 0xce) ioctl$TCSETS(r0, 0x5402, &(0x7f0000000080)) 16:21:43 executing program 5: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x10000000013, &(0x7f00000001c0)=0x1, 0x4) setsockopt$inet_tcp_int(r0, 0x6, 0x14, &(0x7f0000788ffc)=0x100000001, 0xfdf6) connect$inet(r0, &(0x7f0000000180)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x18}}, 0x10) sendmmsg$sock(r0, &(0x7f0000007e40)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0) [ 1814.480666] binder: 13680:13686 IncRefs 0 refcount change on invalid ref 0 ret -22 [ 1814.509724] binder: 13680:13686 Release 1 refcount change on invalid ref 0 ret -22 16:21:44 executing program 4: r0 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000140)='cmdline\x00') r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000000)) pread64(r0, 0x0, 0x23a, 0x0) [ 1814.529551] binder: 13680:13686 unknown command 1850775417 16:21:44 executing program 5: r0 = socket$inet_tcp(0x2, 0x1, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) mmap(&(0x7f00001ed000/0x4000)=nil, 0x4000, 0x0, 0x4012, r1, 0x0) bind$inet(r0, &(0x7f0000000080)={0x2, 0x4e20, @multicast2}, 0x10) connect$inet(r0, &(0x7f0000000100)={0x2, 0x4e20, @loopback}, 0x10) sendto(r0, &(0x7f0000001140)="130ce1df81faf91d959acd0064d4b8579ba48ecf96721b9005eb4f2b55d0df0b7d378bb7f6c9638465c75377cb1b061654d468277f7b7ee6c8ae6150d5580a8f700c70117bdba870d0aa337f6809398ea766d1ad3937f97d719a11ba604e3f5a357ad739498a99e107ced8feab5ba63793687709bf858b2e638d102860e8acd6257f32acf6927bf49f82da6c658f6556a7c65e175ac11538659ae36fbbc08a0dc7002762468bc772a6f8d790640b3e35c22535f6a3edf2d18d28ef1aad1a409693215ba2aed1ce946180268239d0ed635a62b7e6cd229a97830b8ee91f246b36e01f5c8345d812f8f9ccba4994e6e17239fe4ea8bb3a4905845372ea03fceebd36f4cf6c5832f31c93168684114c91fdeb07b4d7b5cac60f0fb2a010bf5d22babfd0c3c192dc5b9bac8d2791f6ca0043d30a0bb59f100d19e31f62c1e235466086c97ad29da831c04281126f44053bd53790d31ebc9f61288384296c28a320d7c157fecef74d4caa8bb7b22156e27cf1173ff266fee889b05b432aa4d9d36d5fe01fcbdf5dc1f8e688ad2bff1a57b7e944e8af1357cd5bb843444c160c6a39c69f8f72a1e9f306748559f58c436c7d60b5671728c27471a96b08d6d98dacc5b25119eb57f5fea48a55d30738caec7b303ba1f589e50b63dc73e1117e3044e290c37503c63215701fe1052c8059a649f3113487318db48b8b8b45a3c671b21920c8be45529b2d97b3d7b914b0ddc0b905c9d2f21325dd50d6ddba2abf69671d996a530dc5a7e49388c352141592a2de6982e7726a1f633176b978f4b945c8ee6827f7257f1a07bba0442fcfec478d9b948e0bafea5c7fa08783eca04e3eb8834ee219705419b5bcf6c250848d41e1fbbb7c5026944112dd5295dbe208f135edfa29a2f6e82f616def78aebaf5c0dfe9c13449474b5bdba8c195e9fe015725e628f5b4fa2aef003d2b6277c3b51f46f9e12c6c03e05ee270770f961355db83c7b2da8da161b35b5678784407813434e3581ac822aadd802d081765fc682176c2a0af6e4eeb1c60ff025f4e4d760e959b8956218c5d87474dd5bac574e741e4b410f33997cdbd5526328363d507d1afe7dc45fdb5e83f8eff24dbc7d3c2ca1d574c262575a1e5f472b156033c648f56ca77fc213adae7427c1694513b3439fdd9bf88de6bb743325c2a4273c2899f273b276776a0e0ba640d40f4b619d3e9354bd1885d77081c4f9c339e0a71b19bcfb66e5696f0251fdfc5cca9636144eb639bba8c3f12b8719dad89e0bd6dd9d3f279c105345796f93c7a510fdb709d2a063f6f8aae1be5f38c9cea42a758420693fa1eb9c8d3b6ca5128c1af8be4ec593f1ebb382a3afa2dab8cfc2fc1b869385775def2ccf39f4a3c0cb1bba2e9e055a293c478e6a77f6cd567b5b6426416bfd96007895e81a5b978194247ac645ae0475b36e0fd4876518dbbd32eaf51b854be4469780b6159422eff923a5a3d62b4976239f53155aae7e41854f7e2009eae464e92ee1caf5aac48d1e59267816da871e68dec00e76cf057615d1bc0d295da83f1eaf40f10f86bcebde86fe53a333bb94703e6acc83c0e5117e4f90867f794a23b14a37b719de56d2679edc8c9da18b86920c2635b970ab268881ebe79f3e6cacd1da1feaa321ca2136702d476b3a2c15ba1b92ab4729eb5ddbf80dec7b72bc59ace7a3a987765941320d6e2f696fb89e2dd37291dec6c8648eb11341925cd54fb030000007b0d0bfe22d812c9aa9f26529e80e9b52201b82b84607697aac03e63c80dbf32025b1596fd9fb444bc3ba60156bb838971a6f6a37cba0b6184a0da2987a2e3dea758c105ca6a41042c3c1b711ff6196d14b498a777d642dc729797ef7d0218dc322b14ed30baf34a211570e6fd013c08cbbbab4b3033e0de8f0243fb3caf795d6eb43d2c1b2290a713798e94e5248bddcd4e9201414c45ed0ce323958d019b9408ca0d75f2abcdcb3114ebef6239181c5691571e7d7c2a2d5830e3306542fd3e42da86c9fcd959f2b2f1bf8955fc0cb5ed6478cc55dbc45e16dadde9c217590a6ed6abf6d1759ab2b0ed7697232cf242b5c701c7b12a47949166b1f73873274f3ccc3153f14f73780489690e87da1e173118bb95dee045ec9d9c19e757d3d880ae5f7c093a5fd013c2b000aeed7729a4258ef8ffd9a4f7f64a4f36c4bb1e8f3a53c2ceb753079ff7bac4bf9561b2ddde0c52e4be348c22ab3c84b1f963ebe9b9b751c14a6319c02231142a5c6763a997480792caa3731f0a0afa7578705c82e2c143d4ee93dd983abfd75e7adb3af7efaefc6f115bca7448fcd2bef70cf085e41ffc4d243c9b89a8a1a3455d8bbe56457cede3626dd4ac6c7977627edd7ee872c99f633db0e4fe97d5ca16701c65296a2e9a3be4e5bcacefcc36e2aa7d650c0521bb22613c3b15f89acf21e1cf6ee09519bfed8ff0dadc914653288a3a9f9d8f2822ee7ab57af322ad49cfd2ba9ccfbf59ee34b971afc8675ecf5687b085845034d32b2297b357f88e5ef7baa082874b1e643c3b891927883e884bcf29280fa009b9a218d6bc9b8ef1d43113fce43c7ba6da0abac98721c4c50fc05aa1c07158ec175007974655cc4a63d7507a4ca00cba707d45aad9b16ae37077f3692796acf35d9d906a58b7dc45b0fccb33f3e5f488b8e750a99e3e1cdb9900e51cbf189e4870013a7b9ccfa1851843dded265e9a99b8a3c4fb7e77fb3f3993c25fa39a887190db141c611fcd81ea5e607f1a87b42d75eb947190c28e9a19c5522096c3981e6cc757077564c0685bcac7ce0943da53b3bd63ad812821dcbd64afe26a03e9602635df3bbda50ea632428ac453bcf42180406bf7dfa74c5290793514b7da1299e0b73193cba17a581e58ac84bd3b71b5aca080fd5c116dd36c47b9d2fa8df521ca5a0eb123ccd875b41f6ffb1b6bc5680a8154431e502cf4a3cc6a8624337847d72dfc093dff264e2f1e4734c0d8a370a8ac2fe7dc32f269634a2e2353cc4f6b3779b7a57bed731be41e656a92cbbb3beb5d7634624e022c7b75b7eac32e39b657703a584896f9e19a2e6298fa9e24f12d2f36c69d470c253711a7c9d7df15eb5a0207ddbba1a9106a96fb26093ae38f035b7f873c6b2ac8f762cebc02fd49f802637e710acb8165f893a08c178672948e7d22227bbe61922752d7b854ed62d6a0d7f9ff3629cac4211af06d39b07fd64488a2b4e72a1f8608b02009adc6859485bdf150f6767d166801969b3e2109acd5c49ced3fba6eb13bc8d61291c25c2dd70edcbb1355ab3cf44d1728b290a6b50f594ae88db5122b9e3f5a0f99ab93e8568536ce3640fe76c476860655e48d667b919fabd1a45ef5a5b6cecdb9100c779ccb44e23ed5c151601eebb1ab9eebb4a87203d1cc032bfc67b3488d7a33d475dd033432cff040d65e8e729c263ed414c11139c2790c5b09a1f4d0220a528b3c4134c67c1c6a926ffc888cf46ae3998569a0ace18e268419875d0022bcb52e412d93c5d73f18b0dbc4c296c2a2f68501e0520c1db027a61b66deb060a5b6cee396c8f9bff11c4379d60440fd16ee871a7a65d2777732680458e47a9308c1210fb158a503d4b5ab09e468303a9162f3fa80192f8212841096dbbb212d5ed63f76732dcb12520022c97b0397df556b160feb3bbb5de4343169a1a430812b9bf0cdeaef95088d9c5b446d2804adcb8dcd1329c17d167682928feff98a3de1677e6d1ead246a4d4cfc7d4d513b8c092bc6b8171dc9a1f3aba82d991af0e63ea0bfb50fb723279da478e01bd7ae64f93f9cdff631465283fce5e4a3c81596d09f86ac42bd1b76c2a05b8a27e82990faadc333e9711ba3af0fd3f6ba2babdfc1ba4fd0ff214527ce02416838edc792ed78f1199fa4c8272642442c507cad59f0dcaddd711bab55b3aa08414ac976aaffc9a7fb12cc8f9607fe417b8b7dcd18dc2cdae11c82428e182043d29a530b83ceec51256b30e0e16ffe7da26cb3253237da5af65efe8a394d94ea092a7c4839b4d16acdf3964f47d0b4924a1c52bcebcdb742b7e7e43af287aff9538492116931aa7235558da37d32ac2263f58e32b173502252d11a11738cf399fb908694c85eea145332bb9b6424bcfd38462464cc4f65599dc7f4d9dcf69fe89d7ab043a376e556ce0f599fb1dcb0cf162076e6470f8c27f3642d007d938172a95a29ce6a7a5d05023ee169ec1a21950041f5b6e2a1062460fe2d53597870603414a5dd577dac6ef84302f2112bfafea91b807b41c6c2edce1cd3d698186618a3bbc218d498c5f06eefabdd25610eb3a9351aeb80fd8a05e930d949ac01996e3e03177137fb76b24382c963d1b59d39cb2f9a75c739fc2d7fb930081ffa20da42650376c729bddc3b496a1c3b61f4af51e7dbddedef82b40196ec554163142d694e5c50d2da54d2bd1cba5bb125efb45137fe251a2b52ba248dfb917833deb607cc25c8c314674ba26b019c24f79d8a74b6b2b3f39e9e608881fecded644785793cdd03b938657544d88252be1127088a41ab316e3e67b240bda5622d4d37f53d3f2424b1d4dc9f50b4e2437600261062a3e566b0d2f8cb24af634bb739179ee3517c82bf0e67bf3c7dc7ce4605219efa4f048b1bf83c627daf672990b5a3db1a80cae4748163a2e40063265a94fd4bbb6bd059e8731e72332c0a22a0c5bd99da925eabe62ec0bdef5a4b7cf8bbd48f286aaff632f14b47b264c7f132d4f60571b8f72d63402a15cd2381582e613f4c2bbe135c67a3d69b4d56f4bfcfe56935f91a5d86dcb7977ec7cd25835c3fa590b8e61c752cffb436ef3f5f4974d268c24fa44281f3067c7825546edc0077b08123bbf258009e6f5da9a1f63beab9e2a7b5f1feec68c4096c541ed0459ea2f791a1ccf8c9d0717b1d5c281375d96d0a7a8c1c53146319b19c08ce612295da709beacb72d69802f72e716bc655d06a9921a1e837adc59ae74cfedf4ac870733750e507b549d1256705873156a4c4e6eebe18aa92a701014e0b71d74e19054185bafb916711f300a956071201e1b9db07a6a6e53a3bd3467920b01495f73dc15abddbd049414ced5220bc1cada5f5691c08a4cd470673df60438ab457d81c2cd3a021f23339f4262ef932a0fa1a70957ae207edd7e7f52c94458af9341921de99126a1406de8366bd80aea016d284f6ade493cf585471a3b2f8b8b9a331fe110c33f2ea1a0abaef34fb31565c8dd62051f3e72631ba81be7aaaa614bd319cde69338e90ceebdcea790a02417312a8b3cf60dffe1ccba3244338391684c49ac9225cb28a416d40b6d3d52a035fd95673917768109435eb004d999a7208eb4d6ef40ed7549c2b4c63fb6fcdfcad382cb7f8b08cc30b6f81369aacdd098415b5ecee7900c4db01e669b38ec9173a7c673d36c3f920b518e6d0a0f90be95577e1e0ec69498b4bea0ecc129dcf14604c3055603e0f57530850b4ad8f9e84ebf4ab16071658a95963feb041def2f2dee88ec007ee20ecd6a7ba57c812f995c754af6de0364dd847c05a139fc771941cd4dfde7874a5c9bfed0c4424acdbfa1d0f8d5986d64e42c68b45bcea645d7fabd505f4177eece9177e4ae505011fb2ae8bef166d7cb1fa83995d5759c8009bd48c170513634deb16aaa2736940d828c5cf524e448747fc7349ca575a3378995ff896038c7101f50c3573bc2ef82a98df605107f5b4335a6895d45a5df73a90adf2a52f15a9ffd64004f056cf508d9e424cda24499a7c848cdbe0fc54f6d4f17e5e83c0677a9553d93f1a", 0xffffffffffffff77, 0x40000, 0x0, 0x53) getsockopt$inet_tcp_TCP_ZEROCOPY_RECEIVE(r0, 0x6, 0x23, &(0x7f0000000000)={&(0x7f00001ee000/0x2000)=nil, 0x2000}, &(0x7f0000000040)=0x10) 16:21:44 executing program 4: r0 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000140)='cmdline\x00') r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000000)) pread64(r0, 0x0, 0x23a, 0x0) 16:21:44 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) socket$nl_generic(0x10, 0x3, 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000140)={0x0, 0x70, 0x1ee6b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x3c, 0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB="0563044000000000046304400000000006630440000000007997506ea39438033ada635f7cd4c9d1de50cf51e7a773b356e7348d3b19cbdc76ed97a6"], 0x1, 0x0, &(0x7f00000003c0)='L'}) ioctl$TCXONC(0xffffffffffffffff, 0x540a, 0x0) [ 1814.551867] binder: 13680:13686 ioctl c0306201 200000c0 returned -22 16:21:44 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x80001, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000040)={0x0, 0xffffffffffffff84}}, 0x0) write(r0, &(0x7f0000000000)="bc", 0x1) ioctl$TCSETS(r0, 0x40045431, &(0x7f0000000a80)) r1 = syz_open_pts(r0, 0x0) readv(r1, &(0x7f00000001c0), 0xce) ioctl$TCSETS(r0, 0x5402, &(0x7f0000000080)) 16:21:44 executing program 4: r0 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000140)='cmdline\x00') r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000000)="11dca50d5e0b") pread64(r0, 0x0, 0x23a, 0x0) [ 1814.638340] audit: type=1400 audit(1568823704.088:122): avc: denied { map } for pid=13714 comm="syz-executor.5" path="socket:[186718]" dev="sockfs" ino=186718 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=tcp_socket permissive=1 [ 1814.693355] binder: 13721:13726 Acquire 1 refcount change on invalid ref 0 ret -22 [ 1814.725807] binder: 13721:13726 IncRefs 0 refcount change on invalid ref 0 ret -22 [ 1814.764458] binder: 13721:13726 Release 1 refcount change on invalid ref 0 ret -22 [ 1814.779552] binder: 13721:13726 unknown command 1850775417 [ 1814.786323] binder: 13721:13726 ioctl c0306201 200000c0 returned -22 16:21:44 executing program 4: r0 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000140)='cmdline\x00') r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000000)="11dca50d5e0b") pread64(r0, 0x0, 0x23a, 0x0) 16:21:44 executing program 5: r0 = socket$inet6(0xa, 0x2, 0x0) r1 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_fanout(r1, 0x107, 0x12, &(0x7f0000000000)={0x0, 0x3}, 0x4) recvmmsg(r1, &(0x7f0000000300), 0x121, 0x0, 0x0) connect$inet6(r0, &(0x7f0000000100)={0xa, 0x0, 0x0, @mcast2, 0x2}, 0x1c) syz_emit_ethernet(0x300cce, &(0x7f0000000080)=ANY=[@ANYBLOB="aaaaaaaaaaaa0000000000008100000086dd60b409000008000002024300800080000000ffffe0000002ff02000000000000deffffffffffff003c0090780007040060b680fa0000000000000000000000000000ffffffffffff000000000000000000000000ac14ffbb"], 0x0) sendmmsg(r0, &(0x7f00000092c0), 0x4000000000001b9, 0x0) 16:21:44 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) socket$nl_generic(0x10, 0x3, 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000140)={0x0, 0x70, 0x1ee6b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x3c, 0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB="0563044000000000046304400000000006630440000000007997506ea39438033ada635f7cd4c9d1de50cf51e7a773b356e7348d3b19cbdc76ed97a6"], 0x1, 0x0, &(0x7f00000003c0)='L'}) ioctl$TCXONC(0xffffffffffffffff, 0x540a, 0x0) 16:21:44 executing program 2: perf_event_open(&(0x7f0000000440)={0x2, 0x70, 0xb9, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x80001, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000040)={0x0, 0xffffffffffffff84}}, 0x0) write(r0, &(0x7f0000000000)="bc", 0x1) ioctl$TCSETS(r0, 0x40045431, &(0x7f0000000a80)) r1 = syz_open_pts(r0, 0x0) readv(r1, &(0x7f00000001c0), 0xce) ioctl$TCSETS(r0, 0x5402, &(0x7f0000000080)) 16:21:44 executing program 0: socket$inet6_tcp(0xa, 0x1, 0x0) r0 = socket$inet6(0xa, 0x2, 0x0) r1 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_fanout(r1, 0x107, 0x12, &(0x7f0000000000)={0x0, 0x3}, 0x4) recvmmsg(r1, &(0x7f0000000300), 0x121, 0x0, 0x0) connect$inet6(r0, &(0x7f0000000100)={0xa, 0x0, 0x0, @mcast2, 0x2}, 0x1c) sendmmsg(r0, &(0x7f00000092c0), 0x4000000000001b9, 0x0) 16:21:44 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f00000003c0)="11dca50d5e0bcfe47bf070") r1 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r1, &(0x7f0000000100)={0x2, 0x4e20}, 0x10) connect$inet(r1, &(0x7f0000000cc0)={0x2, 0x4e20, @local}, 0x10) setsockopt$SO_TIMESTAMPING(r1, 0x1, 0x25, &(0x7f00000010c0)=0x19ff, 0x4) sendto$inet(r1, &(0x7f0000000140)="b0", 0x1, 0x0, 0x0, 0x0) pipe(&(0x7f0000000480)={0xffffffffffffffff}) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) r4 = creat(&(0x7f0000000200)='./file0\x00', 0x0) write$cgroup_type(r4, &(0x7f0000000180)='threaded\x00', 0x3d3427e) clone(0x1100100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) mount(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000100)='sockfs\x00', 0x0, 0x0) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) ftruncate(r2, 0x7) pipe(&(0x7f0000000480)={0xffffffffffffffff}) vmsplice(r5, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) r6 = openat$selinux_mls(0xffffffffffffff9c, &(0x7f0000000140)='/selinux/mls\x00', 0x0, 0x0) r7 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000200)='TIPCv2\x00') sendmsg$TIPC_NL_BEARER_SET(r6, &(0x7f00000002c0)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x20000}, 0xc, &(0x7f0000000240)={&(0x7f00000003c0)={0x128, r7, 0x100, 0x70bd29, 0x25dfdbff, {}, [@TIPC_NLA_MEDIA={0x38, 0x5, [@TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'ib\x00'}, @TIPC_NLA_MEDIA_PROP={0x24, 0x2, [@TIPC_NLA_PROP_WIN={0x8, 0x3, 0x7a2d627a}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x1}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x3}, @TIPC_NLA_PROP_PRIO={0x8}]}, @TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'ib\x00'}]}, @TIPC_NLA_NODE={0x14, 0x6, [@TIPC_NLA_NODE_ADDR={0x8, 0x1, 0x3}, @TIPC_NLA_NODE_ADDR={0x8, 0x1, 0x4a49}]}, @TIPC_NLA_LINK={0x28, 0x4, [@TIPC_NLA_LINK_PROP={0x24, 0x7, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x11}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x1f}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_WIN={0x8}]}]}, @TIPC_NLA_LINK={0xa0, 0x4, [@TIPC_NLA_LINK_PROP={0x14, 0x7, [@TIPC_NLA_PROP_WIN={0x8}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x8}]}, @TIPC_NLA_LINK_PROP={0x24, 0x7, [@TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x5}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x4}]}, @TIPC_NLA_LINK_NAME={0xc, 0x1, 'syz1\x00'}, @TIPC_NLA_LINK_PROP={0x1c, 0x7, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0x92ce}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x5}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x8}]}, @TIPC_NLA_LINK_PROP={0x3c, 0x7, [@TIPC_NLA_PROP_TOL={0x8, 0x2, 0x8}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x8}, @TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x4}, @TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_TOL={0x8}]}]}]}, 0x128}}, 0x0) sendmsg$TIPC_NL_MEDIA_SET(r5, &(0x7f0000000180)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x429a0008}, 0xc, &(0x7f00000000c0)={&(0x7f0000000080)={0x20, r7, 0x700, 0x70bd28, 0x25dfdbfd, {}, [@TIPC_NLA_MON={0xc, 0x9, [@TIPC_NLA_MON_REF={0x8, 0x2, 0x3f}]}]}, 0x20}, 0x1, 0x0, 0x0, 0x30}, 0x20008800) recvmmsg(r1, &(0x7f0000003b40)=[{{0x0, 0x0, 0x0}}], 0x1, 0x2000, 0x0) 16:21:44 executing program 4: r0 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000140)='cmdline\x00') r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000000)="11dca50d5e0b") pread64(r0, 0x0, 0x23a, 0x0) 16:21:44 executing program 4: r0 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000140)='cmdline\x00') r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000000)="11dca50d5e0bcfe47b") pread64(r0, 0x0, 0x23a, 0x0) 16:21:44 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) socket$nl_generic(0x10, 0x3, 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000140)={0x0, 0x70, 0x1ee6b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x3c, 0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB="0563044000000000046304400000000006630440000000007997506ea39438033ada635f7cd4c9d1de50cf51e7a773b356e7348d3b19cbdc76ed97a6"], 0x1, 0x0, &(0x7f00000003c0)='L'}) ioctl$TCXONC(0xffffffffffffffff, 0x540a, 0x0) [ 1815.322994] binder: 13747:13751 Acquire 1 refcount change on invalid ref 0 ret -22 [ 1815.333677] binder: 13747:13751 IncRefs 0 refcount change on invalid ref 0 ret -22 [ 1815.342156] binder: 13747:13751 Release 1 refcount change on invalid ref 0 ret -22 [ 1815.350335] binder: 13747:13751 unknown command 1850775417 [ 1815.356087] binder: 13747:13751 ioctl c0306201 200000c0 returned -22 16:21:44 executing program 2: perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x80001, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000040)={0x0, 0xffffffffffffff84}}, 0x0) write(r0, &(0x7f0000000000)="bc", 0x1) ioctl$TCSETS(r0, 0x40045431, &(0x7f0000000a80)) r1 = syz_open_pts(r0, 0x0) readv(r1, &(0x7f00000001c0), 0xce) ioctl$TCSETS(r0, 0x5402, &(0x7f0000000080)) 16:21:44 executing program 4: r0 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000140)='cmdline\x00') r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000000)="11dca50d5e0bcfe47b") pread64(r0, 0x0, 0x23a, 0x0) [ 1815.459308] binder: 13768:13771 Acquire 1 refcount change on invalid ref 0 ret -22 [ 1815.515036] binder: 13768:13771 IncRefs 0 refcount change on invalid ref 0 ret -22 [ 1815.546278] binder: 13768:13771 Release 1 refcount change on invalid ref 0 ret -22 16:21:45 executing program 4: r0 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000140)='cmdline\x00') r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000000)="11dca50d5e0bcfe47b") pread64(r0, 0x0, 0x23a, 0x0) 16:21:45 executing program 2: perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x80001, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000040)={0x0, 0xffffffffffffff84}}, 0x0) write(r0, &(0x7f0000000000)="bc", 0x1) ioctl$TCSETS(r0, 0x40045431, &(0x7f0000000a80)) r1 = syz_open_pts(r0, 0x0) readv(r1, &(0x7f00000001c0), 0xce) ioctl$TCSETS(r0, 0x5402, &(0x7f0000000080)) [ 1815.565243] binder: 13768:13771 unknown command 1850775417 [ 1815.603618] binder: 13768:13771 ioctl c0306201 200000c0 returned -22 16:21:45 executing program 5: openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000080)='./cgroup.cpu\x00', 0x200002, 0x0) syz_open_procfs(0xffffffffffffffff, &(0x7f0000000240)='mountinfo\x00') socket$packet(0x11, 0x3, 0x300) pipe(&(0x7f0000000680)) clock_gettime(0x0, &(0x7f0000000600)={0x0, 0x0}) pselect6(0x40, &(0x7f00000000c0), 0x0, &(0x7f0000000140)={0xff}, &(0x7f0000000200)={0x0, r0+30000000}, 0x0) bpf$BPF_MAP_GET_FD_BY_ID(0xe, 0x0, 0x0) ioctl$TIOCGSID(0xffffffffffffffff, 0x5429, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180)={0xffffffffffffffff}) r2 = dup2(r1, r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) 16:21:45 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) socket$nl_generic(0x10, 0x3, 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000140)={0x0, 0x70, 0x1ee6b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x4b, 0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB="0563044000000000046304400000000006630440000000007997506ea39438033ada635f7cd4c9d1de50cf51e7a773b356e7348d3b19cbdc76ed97a6a08da8997815ea9e6d3b6a1d5a7c1c"], 0x1, 0x0, &(0x7f00000003c0)='L'}) ioctl$TCXONC(0xffffffffffffffff, 0x540a, 0x0) 16:21:45 executing program 4: r0 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000140)='cmdline\x00') r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000000)="11dca50d5e0bcfe47bf0") pread64(r0, 0x0, 0x23a, 0x0) [ 1815.821273] binder: 13797:13800 Acquire 1 refcount change on invalid ref 0 ret -22 [ 1815.839875] binder: 13797:13800 IncRefs 0 refcount change on invalid ref 0 ret -22 16:21:45 executing program 0: bpf$BPF_BTF_LOAD(0x12, &(0x7f00000002c0)={&(0x7f00000001c0)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x0, 0x0, 0x2}}, 0x0, 0x1a}, 0x20) r0 = socket$packet(0x11, 0x3, 0x300) r1 = socket$packet(0x11, 0x3, 0x300) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000000)={'batadv0\x00', 0x0}) bind$packet(r1, &(0x7f0000000640)={0x11, 0x0, r2, 0x1, 0x0, 0x6, @link_local}, 0x14) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000140)=0x14) sendmsg$sock(r0, &(0x7f0000000480)={&(0x7f00000001c0)=@hci={0x1f, r3}, 0x80, &(0x7f00000003c0)=[{&(0x7f0000000240)='s', 0xe}], 0x1, &(0x7f0000000400)=[@timestamping={{0x14}}], 0x18}, 0x0) [ 1815.869560] binder: 13797:13800 Release 1 refcount change on invalid ref 0 ret -22 [ 1815.882358] binder: 13797:13800 unknown command 1850775417 [ 1815.888192] binder: 13797:13800 ioctl c0306201 200000c0 returned -22 16:21:45 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f00000003c0)="11dca50d5e0bcfe47bf070") pipe(&(0x7f0000000480)={0xffffffffffffffff, 0xffffffffffffffff}) write(r1, &(0x7f0000000340), 0x41395527) ioctl$sock_inet_SIOCGIFDSTADDR(r1, 0x8917, &(0x7f00000001c0)={'ip6_vti0\x00', {0x2, 0x4e20, @local}}) pipe(&(0x7f0000000480)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = openat$null(0xffffffffffffff9c, &(0x7f0000000080)='/dev/null\x00', 0xc8e8cbf8da2242d7, 0x0) setsockopt$inet_udp_encap(r3, 0x11, 0x64, &(0x7f00000000c0), 0x4) write(r2, &(0x7f0000000340), 0x41395527) pipe(&(0x7f0000000480)={0xffffffffffffffff}) vmsplice(r4, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) ioctl$sock_inet_udp_SIOCOUTQ(r4, 0x5411, &(0x7f0000000180)) flistxattr(r2, &(0x7f0000000000)=""/66, 0x42) r5 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r5, &(0x7f0000000100)={0x2, 0x4e20}, 0x10) connect$inet(r5, &(0x7f0000000cc0)={0x2, 0x4e20, @local}, 0x10) setsockopt$SO_TIMESTAMPING(r5, 0x1, 0x25, &(0x7f00000010c0)=0x19ff, 0x4) sendto$inet(r5, &(0x7f0000000140)="b0", 0x1, 0x0, 0x0, 0x0) recvmmsg(r5, &(0x7f0000003b40)=[{{0x0, 0x0, 0x0}}], 0x1, 0x2000, 0x0) 16:21:45 executing program 0: clone(0xffd, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = dup2(r0, r0) ioctl$sock_SIOCBRDELBR(r1, 0x89a1, 0x0) write$nbd(r1, 0x0, 0x0) 16:21:45 executing program 4: r0 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000140)='cmdline\x00') r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000000)="11dca50d5e0bcfe47bf0") pread64(r0, 0x0, 0x23a, 0x0) 16:21:45 executing program 2: perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x80001, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000040)={0x0, 0xffffffffffffff84}}, 0x0) write(r0, &(0x7f0000000000)="bc", 0x1) ioctl$TCSETS(r0, 0x40045431, &(0x7f0000000a80)) r1 = syz_open_pts(r0, 0x0) readv(r1, &(0x7f00000001c0), 0xce) ioctl$TCSETS(r0, 0x5402, &(0x7f0000000080)) 16:21:45 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) socket$nl_generic(0x10, 0x3, 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000140)={0x0, 0x70, 0x1ee6b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x3d, 0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB="0563044000000000046304400000000006630440000000007997506ea39438033ada635f7cd4c9d1de50cf51e7a773b356e7348d3b19cbdc76ed97a6a0"], 0x1, 0x0, &(0x7f00000003c0)='L'}) ioctl$TCXONC(0xffffffffffffffff, 0x540a, 0x0) 16:21:45 executing program 5: perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x2, 0x0) close(r0) socket$netlink(0x10, 0x3, 0x9) r1 = open(&(0x7f00000000c0)='./bus\x00', 0x800000141042, 0x0) ftruncate(r1, 0x200006) sendfile(r0, r1, 0x0, 0x8000fffffffe) 16:21:45 executing program 0: r0 = socket$inet6(0x10, 0x3, 0x0) sendmsg(r0, &(0x7f0000000040)={0x0, 0x3f000000, &(0x7f0000000000)=[{&(0x7f0000000140)="5500000018007fd500fe01b2a4a280930a06030000a843089100fe80390003000800100000dc13382d0000009b7a136ef75afb83de448daa72540d8102d2c55327c43ab8220000060cec4fab91d40000000000ffff", 0x55}], 0x1}, 0x0) [ 1816.337952] SELinux: unrecognized netlink message: protocol=9 nlmsg_type=0 sclass=netlink_audit_socket pig=13832 comm=syz-executor.5 [ 1816.342351] binder: 13825:13835 Acquire 1 refcount change on invalid ref 0 ret -22 [ 1816.357370] SELinux: unrecognized netlink message: protocol=9 nlmsg_type=0 sclass=netlink_audit_socket pig=13832 comm=syz-executor.5 [ 1816.358546] binder: 13825:13835 IncRefs 0 refcount change on invalid ref 0 ret -22 [ 1816.379254] binder: 13825:13835 Release 1 refcount change on invalid ref 0 ret -22 [ 1816.400142] ------------[ cut here ]------------ [ 1816.405118] WARNING: CPU: 0 PID: 1852 at net/ipv4/tcp_timer.c:429 tcp_retransmit_timer+0x1a66/0x2590 [ 1816.414384] Kernel panic - not syncing: panic_on_warn set ... [ 1816.414384] [ 1816.417629] SELinux: unrecognized netlink message: protocol=9 nlmsg_type=0 sclass=netlink_audit_socket pig=13832 comm=syz-executor.5 [ 1816.421739] CPU: 0 PID: 1852 Comm: syz-executor.3 Not tainted 4.14.144+ #0 [ 1816.421755] Call Trace: [ 1816.421761] [ 1816.421775] dump_stack+0xca/0x134 [ 1816.421790] panic+0x1ea/0x3d3 [ 1816.452301] ? add_taint.cold+0x16/0x16 [ 1816.456290] ? tcp_retransmit_timer+0x1a66/0x2590 [ 1816.461133] ? __probe_kernel_read+0x163/0x1c0 [ 1816.465727] ? tcp_retransmit_timer+0x1a66/0x2590 [ 1816.470568] __warn.cold+0x2f/0x3a [ 1816.474107] ? __lock_acquire+0x5d7/0x4320 [ 1816.474921] SELinux: unrecognized netlink message: protocol=9 nlmsg_type=0 sclass=netlink_audit_socket pig=13832 comm=syz-executor.5 [ 1816.478334] ? tcp_retransmit_timer+0x1a66/0x2590 [ 1816.478348] report_bug+0x20a/0x248 [ 1816.478364] do_error_trap+0x1bf/0x2d0 [ 1816.500451] SELinux: unrecognized netlink message: protocol=9 nlmsg_type=0 sclass=netlink_audit_socket pig=13832 comm=syz-executor.5 [ 1816.502748] ? math_error+0x2d0/0x2d0 [ 1816.502756] ? __lock_acquire+0x5d7/0x4320 [ 1816.502781] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 1816.515563] SELinux: unrecognized netlink message: protocol=9 nlmsg_type=0 sclass=netlink_audit_socket pig=13832 comm=syz-executor.5 [ 1816.518696] invalid_op+0x18/0x40 [ 1816.518706] RIP: 0010:tcp_retransmit_timer+0x1a66/0x2590 [ 1816.523430] SELinux: unrecognized netlink message: protocol=9 nlmsg_type=0 sclass=netlink_audit_socket pig=13832 comm=syz-executor.5 [ 1816.527770] RSP: 0018:ffff8881d7407c78 EFLAGS: 00010206 [ 1816.527780] RAX: ffff8881cb552f00 RBX: ffff88819ffb1d80 RCX: 0000000000000001 [ 1816.527785] RDX: 0000000000000100 RSI: 0000000000000000 RDI: ffff88819a2009c8 [ 1816.527790] RBP: ffff88819a200000 R08: ffff88821ffff01c R09: ffff88821ffff008 [ 1816.527797] R10: ffff88821ffff017 R11: ffff88821ffff010 R12: ffff88819a20069a [ 1816.540334] SELinux: unrecognized netlink message: protocol=9 nlmsg_type=0 sclass=netlink_audit_socket pig=13832 comm=syz-executor.5 [ 1816.543254] R13: ffff88819a200030 R14: 0000000000000000 R15: ffff88819a20080c [ 1816.543287] ? tcp_retransmit_timer+0x1a66/0x2590 [ 1816.549177] SELinux: unrecognized netlink message: protocol=9 nlmsg_type=0 sclass=netlink_audit_socket pig=13832 comm=syz-executor.5 [ 1816.560739] ? sched_clock+0x5/0x10 [ 1816.560748] ? sched_clock_cpu+0x31/0x1c0 [ 1816.560762] ? tcp_write_timer_handler+0x780/0x780 [ 1816.560771] tcp_write_timer_handler+0x43d/0x780 [ 1816.560786] tcp_write_timer+0xc9/0x170 [ 1816.566799] SELinux: unrecognized netlink message: protocol=9 nlmsg_type=0 sclass=netlink_audit_socket pig=13832 comm=syz-executor.5 [ 1816.573411] call_timer_fn+0x15b/0x6a0 [ 1816.573423] ? collect_expired_timers+0x280/0x280 [ 1816.573439] ? check_preemption_disabled+0x35/0x1f0 [ 1816.573451] ? _raw_spin_unlock_irq+0x24/0x50 [ 1816.683024] ? tcp_write_timer_handler+0x780/0x780 [ 1816.687955] expire_timers+0x227/0x4c0 [ 1816.691850] run_timer_softirq+0x1eb/0x5d0 [ 1816.696085] ? expire_timers+0x4c0/0x4c0 [ 1816.700145] ? check_preemption_disabled+0x35/0x1f0 [ 1816.705180] ? check_preemption_disabled+0x35/0x1f0 [ 1816.710213] __do_softirq+0x234/0x9ec [ 1816.714020] ? check_preemption_disabled+0x35/0x1f0 [ 1816.719044] irq_exit+0x114/0x150 [ 1816.722496] smp_apic_timer_interrupt+0x1a7/0x650 [ 1816.727337] apic_timer_interrupt+0x8c/0xa0 [ 1816.731649] [ 1816.733888] RIP: 0010:_raw_spin_unlock_irq+0x2b/0x50 [ 1816.738987] RSP: 0018:ffff8881a1607b20 EFLAGS: 00000246 ORIG_RAX: ffffffffffffff10 [ 1816.746695] RAX: 0000000000000007 RBX: 0000000000000001 RCX: 0000000000000000 [ 1816.753958] RDX: 0000000000000000 RSI: 0000000000000001 RDI: ffff8881cb55372c [ 1816.761222] RBP: ffff8881d742a240 R08: 0000000000000001 R09: 0000000000000000 [ 1816.768489] R10: 0000000000000000 R11: 0000000000000000 R12: ffff8881d742a240 [ 1816.775762] R13: ffff8881c34a2f00 R14: 0000000000000000 R15: ffff8881cb552f00 [ 1816.783084] finish_task_switch+0x204/0x660 [ 1816.787404] ? finish_task_switch+0x1d9/0x660 [ 1816.791893] ? __switch_to_asm+0x41/0x70 [ 1816.795955] ? __switch_to_asm+0x35/0x70 [ 1816.800017] __schedule+0x894/0x1f80 [ 1816.803731] ? _raw_spin_unlock_irqrestore+0x41/0x70 [ 1816.808843] ? __sched_text_start+0x8/0x8 [ 1816.812996] ? hrtimer_fixup_init+0x70/0x70 [ 1816.817323] ? lock_downgrade+0x5d0/0x5d0 [ 1816.821481] schedule+0x92/0x1c0 [ 1816.824867] do_nanosleep+0x201/0x640 [ 1816.828680] ? schedule_timeout_idle+0x80/0x80 [ 1816.833265] ? debug_object_free+0x2f0/0x2f0 [ 1816.837681] ? memset+0x20/0x40 [ 1816.840970] hrtimer_nanosleep+0x1f9/0x480 [ 1816.845204] ? nanosleep_copyout+0x100/0x100 16:21:46 executing program 0: openat(0xffffffffffffff9c, &(0x7f0000020500)='./file0\x00', 0x11000, 0x21) 16:21:46 executing program 2: perf_event_open(&(0x7f0000000440)={0x0, 0x70, 0xb9, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x80001, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000040)={0x0, 0xffffffffffffff84}}, 0x0) write(r0, &(0x7f0000000000)="bc", 0x1) ioctl$TCSETS(r0, 0x40045431, &(0x7f0000000a80)) r1 = syz_open_pts(r0, 0x0) readv(r1, &(0x7f00000001c0), 0xce) ioctl$TCSETS(r0, 0x5402, &(0x7f0000000080)) [ 1816.849619] ? enqueue_hrtimer+0x3c0/0x3c0 [ 1816.853859] ? timespec_trunc+0x140/0x140 [ 1816.858023] SyS_nanosleep+0x126/0x190 [ 1816.861916] ? hrtimer_nanosleep+0x480/0x480 [ 1816.866329] ? do_syscall_64+0x43/0x520 [ 1816.870310] ? hrtimer_nanosleep+0x480/0x480 [ 1816.874720] do_syscall_64+0x19b/0x520 [ 1816.878619] entry_SYSCALL_64_after_hwframe+0x42/0xb7 [ 1816.883804] RIP: 0033:0x457d90 [ 1816.886990] RSP: 002b:00007fff6f43d0f8 EFLAGS: 00000246 ORIG_RAX: 0000000000000023 [ 1816.894700] RAX: ffffffffffffffda RBX: 00000000001bb726 RCX: 0000000000457d90 16:21:46 executing program 0: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = dup2(r2, r1) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) sendmsg$nl_xfrm(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000bfff0)={&(0x7f0000000380)=ANY=[@ANYBLOB="b8000000190001040000000000000000ff010000000000000000000000000001e000000100000000000000000000000000000000000000000a004f0000000000", @ANYRES32, @ANYRES32=0x0, @ANYBLOB="000000000000000000000000000000000000000000000000fcffffffffffffff00000000000000000000000000000000ff0700000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000c7e1053f03d985710bbec307a4138033c30b61c50e95d8c81a93a98029c79e2fb5407bbaf604e0ada406cce4d95d3eefeb242dbc768b006f694e94cdd28bdb909a1b4c4c2c146eb7c138fd277d5e957ef757657504210512500a124ddd63657d1b5013cfd35b50d6f9536ce86c31d949ff0b009bbcba5fc484cb98a75156f300ad467a309d14b9f65470fe652422d8aa03f2e4ef9b5aa817d5b0ebe0ef57d93ba6c82a1b63f90aecd7e9dc493415d3454604dea6eecf3b601a264573260b863442064037fc3d07954445f5eb1c79c11ef6a913d48f6d5ab008b332a0242731f8b51753f7a24d6c6455ee817b79d658b25b276db5c9cd4845d0550de0f2ea24585e2bf0fa05097b69a61a4adc8e28cf704da6cf159a0247a896a6604f7d91182e10c388d6a91d05243914fd6d5c7052c2dca3f7140b48967"], 0xb8}}, 0x0) [ 1816.901967] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 00007fff6f43d100 [ 1816.909236] RBP: 0000000000001c55 R08: 0000000000000001 R09: 00000000020cf940 [ 1816.916503] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000003 [ 1816.923775] R13: 00007fff6f43d150 R14: 00000000001bb70f R15: 00007fff6f43d160 [ 1816.931788] Kernel Offset: 0x1b000000 from 0xffffffff81000000 (relocation range: 0xffffffff80000000-0xffffffffbfffffff) [ 1816.942775] Rebooting in 86400 seconds..