[....] Starting enhanced syslogd: rsyslogd[?25l[?1c7[ ok 8[?25h[?0c. [ 41.685172] audit: type=1800 audit(1546089881.704:25): pid=8073 uid=0 auid=4294967295 ses=4294967295 subj=_ op=collect_data cause=failed(directio) comm="startpar" name="cron" dev="sda1" ino=2414 res=0 [ 41.721922] audit: type=1800 audit(1546089881.714:26): pid=8073 uid=0 auid=4294967295 ses=4294967295 subj=_ op=collect_data cause=failed(directio) comm="startpar" name="mcstrans" dev="sda1" ino=2457 res=0 [ 41.761691] audit: type=1800 audit(1546089881.714:27): pid=8073 uid=0 auid=4294967295 ses=4294967295 subj=_ op=collect_data cause=failed(directio) comm="startpar" name="restorecond" dev="sda1" ino=2436 res=0 [....] Starting periodic command scheduler: cron[?25l[?1c7[ ok 8[?25h[?0c. [....] Starting OpenBSD Secure Shell server: sshd[?25l[?1c7[ ok 8[?25h[?0c. Debian GNU/Linux 7 syzkaller ttyS0 syzkaller login: [ 47.494702] sshd (8210) used greatest stack depth: 15720 bytes left Warning: Permanently added '10.128.10.54' (ECDSA) to the list of known hosts. 2018/12/29 13:24:54 fuzzer started 2018/12/29 13:24:56 dialing manager at 10.128.0.26:40175 2018/12/29 13:24:56 syscalls: 1 2018/12/29 13:24:56 code coverage: enabled 2018/12/29 13:24:56 comparison tracing: enabled 2018/12/29 13:24:56 setuid sandbox: enabled 2018/12/29 13:24:56 namespace sandbox: enabled 2018/12/29 13:24:56 Android sandbox: /sys/fs/selinux/policy does not exist 2018/12/29 13:24:56 fault injection: enabled 2018/12/29 13:24:56 leak checking: CONFIG_DEBUG_KMEMLEAK is not enabled 2018/12/29 13:24:56 net packet injection: enabled 2018/12/29 13:24:56 net device setup: enabled 13:28:13 executing program 0: r0 = openat$vicodec1(0xffffffffffffff9c, &(0x7f0000000000)='/dev/video37\x00', 0x2, 0x0) ioctl$VIDIOC_G_FREQUENCY(r0, 0xc02c5638, &(0x7f0000000040)={0x1ff, 0x1, 0x2}) r1 = syz_open_dev$media(&(0x7f0000000080)='/dev/media#\x00', 0x7, 0x10000) setsockopt$IP_VS_SO_SET_FLUSH(r1, 0x0, 0x485, 0x0, 0x0) r2 = ioctl$LOOP_CTL_GET_FREE(r1, 0x4c82) ioctl$LOOP_CTL_REMOVE(r1, 0x4c81, r2) ioctl$SNDRV_CTL_IOCTL_PCM_PREFER_SUBDEVICE(r1, 0x40045532, &(0x7f00000000c0)=0x1) ioctl$SNDRV_RAWMIDI_IOCTL_PVERSION(r1, 0x80045700, &(0x7f0000000100)) ioctl$VIDIOC_ENUMINPUT(r0, 0xc050561a, &(0x7f0000000140)={0x5, "f40c57d2a811df456aeec5b9bdb13966153d8ba718fa1897443206a27f41b830", 0x3, 0x100000000, 0x3, 0x10, 0x4, 0x2}) bind$alg(r1, &(0x7f00000001c0)={0x26, 'hash\x00', 0x0, 0x0, 'sha384-ssse3\x00'}, 0x58) getpeername$unix(r1, &(0x7f0000000240)=@abs, &(0x7f00000002c0)=0x6e) ioctl$DRM_IOCTL_GET_STATS(r1, 0x80f86406, &(0x7f0000000300)=""/124) ioctl$VIDIOC_S_PARM(r1, 0xc0cc5616, &(0x7f0000000380)={0xa, @output={0x1000, 0x1, {0x3, 0x6}, 0x0, 0x7}}) setsockopt$RDS_CONG_MONITOR(r1, 0x114, 0x6, &(0x7f0000000480)=0x1, 0x4) arch_prctl$ARCH_GET_FS(0x1003, &(0x7f00000004c0)) getsockopt$inet6_IPV6_XFRM_POLICY(r1, 0x29, 0x23, &(0x7f0000001c80)={{{@in=@local, @in6=@loopback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@dev}}}, &(0x7f0000001d80)=0xe8) getsockopt$sock_cred(r1, 0x1, 0x11, &(0x7f0000001dc0)={0x0, 0x0}, &(0x7f0000001e00)=0xc) syz_mount_image$msdos(&(0x7f0000000500)='msdos\x00', &(0x7f0000000540)='./file0\x00', 0x7, 0x9, &(0x7f0000001b80)=[{&(0x7f0000000580)="1ce1a3b4bac3a4de9b105380aad9101d2f18b73400ae558c9a7b66baff8a0e739bae3e7d28411df2cad0626be6c7d8dcb63aaa36890821f1da74f640a112cfe1a6baf96d00c2fb9cff386f3f931a1c322c529d259c9e7691aa1f72954aa4a27e4a57b921189e61f954a2ae8e7e8869a1a274455f2ca37dc4d740c1ebcb77e55b41d58c782796f8fbdaa06b6c2842b93696470adf8e40a790b5ef30e369701377710cde5f2464bb62fad3812902badf266818f37445a0eafa97c47e21019e2c5d0337c734bc26bc259c5d6fd73870b19324c582b8135e87899bec88dd23f4868f", 0xe0, 0x1}, {&(0x7f0000000680)="a0958b5014532010cdc7583e641415983dbad00e8357ae3549be311616e6b1457c1c6ff52bb60a8f65a51c08ea53ea75faf33b1c2ec5a1efd64cd414686eeeae3890601908adf7b6e31d2bfa8dd86064c5a6e63739bc209219b7582f516806225fe761c8049d572c925e648c99a0c5ae34d8214a5a8f7215f70ab980f76c9fe63d87543934a87ac336fc56bba94ce35be71ac8525d5758c5e8c7cb8fbf348f3b804620a34cce2f42a39680064124437536a9ce04dc9ad995b5bbaba67e7bfd5d171b994a688ec70b1ee6c51aba954dbd78d72e16dd55492e491b756fc51d57803065868937deb3d7927340c36f4cb63e5369ce6312577a29e16b821d92e0", 0xfe, 0x200}, {&(0x7f0000000780)="9923de6c479b5310dba25b47994443996f2c32af8cf5574f10f58748b589c3f71184a9c861ba87e740d015f04172103656d47dd98caf1b26888d0581c350097a43df6bc4a424f7ae88ddd3df96752162f8f3d135ad03fe89359d8120b86cb17f7ab5829ad282c15fa785d8e32bc62ea33748740119475d44a349452ca2f5349f90440fc1ed81a6c22b80b8ee0e39bfb7ee5fe43bd3e4ea69d626b87d34382530347c23710119c7568116f43c61445f9e11e95e8fed060420e0756e180e97f7b70bc20858d1431df18f07368d2e940c314656769fe63259f746111b85bc9565beead0be60", 0xe4, 0x6}, {&(0x7f0000000880)="267254aec40f1968ffb9eb0645b119f4d43b8b5410b0bf297561abd28751c34bcdd886a4715b0a2fbccc6b000f73d676dc709cfe22c0d7442624d2964249a8b9056ab727ef5414bb71fc1de0430ddc2d84c87ae3c1ca7b9a00919f0ea3af237a8d5fe6459009f745e1ace8c4f54e1d69", 0x70, 0x7}, {&(0x7f0000000900)="4c0f99c21897c6ef6d8fa3101be6c839e698b0b93306dbc3f5ce0ee1d0be09dc647cec6c31d23e9785615a67972376dc18242a5c6f55fbbbe1d1f6bb30759a0b8adfc9ac454e2f7c0cefb6f059b749ebd452c36a20e9b56877bd40fe9b8b306f4eeb288dcbb254b897b9739d0a0cae157b88503de2032e175b6fc2d70fd06742ad31483316b5df61da6de214ed2ba6b29c4e20082ba41b627814724084f168a5996e40de2f7b7b5ae8f8b1d664e9c66c6bd0f3dca92f9e6c5c9635674eb08f", 0xbf, 0x4}, {&(0x7f00000009c0)="884a048cbac5e62c6cdb4cb4eb41291672ae2f433d496bfe81c8547fe149d31f9776ab91971ff40ca335fdb79272601cff4c1897c1bccadeb3e7638c7d00f8a098a96403673783055d636fd805f011298d4e38231966072c6a7201485237a074d7f1b437401f18269286b6f12b0792ba60441948b263e1db03e1a1bd49220af833ce9a7746171e28696c4138e2c7357aebb09cc55b6870d36ccb86a7d484c9c76f8e4ca2836fa2d3d3a471673286d26ffb9ae539afa73c9a50bed7690a", 0xbd, 0xfffffffffffffff9}, {&(0x7f0000000a80)="818ffd2f4c7e8116329cecdb97de0ea5074522a7ca249e67e75facba109ed959d1df95dbc635867445fe0ff1ea73f690a88e70accec53c1310ce3937d5fa8b2b4298940605e1b67cd159ffcea3cfc0222084d1fd2b3c204f54dd456ee3d4a197ec0d7a17e9c70e6ae78e85388b4be71deb30a4ccccab5e6364f9b2df4b1af11d662d26e8e2a430f77d106b760e86d5a0665943dca28994ab9b335bd24754a2da40565c4126e3fe65", 0xa8, 0x20}, {&(0x7f0000000b40)="e1e2a22c86489139aa42dddad1792ff7f3ebd248c24ea60e1759169df28e61dc494fe8b5", 0x24, 0x7}, {&(0x7f0000000b80)="594040d5774f380c53643660088ba48b655c5b84532dabb038215dd46358100780fb3fa147cbb27769e301c57a4cfbc965b9fb26d9f72a09ba2b472d5b80cb69e88695fffebe8e0e7c1ce70888d1141531cddfd8f55d100429b25e1440f753c888a3e7939bb43c852757167af513fc509345bc633b1300d7b4372ae993863860a810b2d5104b2b849a795c297af9f9a7e7f847e21cde7620b15808ec9a620ae02084fcbd82d5f611379c9f3b0c93981f3ce150586b16bd68b82c1c92b03a98b67a9b419a8793c61e295675d6d4b2a509028a92eb463fd82496a6c44739521324fc960d9ba53084189fe318baf156aa8ff6729235fad5a7d236d53f4f9faeb0027ba059c6e4e1a7b2578e81cb0c25ed4aa27d59a7dca3baaa0e9bb66e017d62953f9c9d7a9d7ac031662a4c65671eb85521c9aea38222cf9418262c23cf727fc963dd0013450161964af20e0f62d56c7b05ade2fd6fd22b5a9423f06cd14f41a261d4504f7ac931b47690e4e4e6b0f2edadc1538fd03505fb5c91610d7a0397e455fdee3ef238424c55354e5c857f62cf3fb7b5ba1a32f2f5a938e0438826b30946c05119c2b1b93d5638cd4deaa954f4541615a44bf281c4d674b0b00945ca6e19c80d92f1001dc34a6fa8edebaf093c853bbd611e5990f15b4aa6c9b31a2089dea3227ef9c057c2eca411acd6bf8b9e70e3b4f8cb4afd51c4fe467cb4a436f5a9e88ff86321be897666cdbd5f0b24be895041c02027be493beb391cfe67f7349f445899fd39e5e18e0c01eaeaafce670bbb4ec25b7f1cecb8aebb860fa9fc93269af9a5976ef4185666cd3a3b28891cbbf23edc5c94e9171325ed0a6f5e40c6bb4683594da8df7fbecb84f9f776daa6ffbc58a47c267969d5d364483cf7b873e9ed629a5a83ac6ede5e56dc5975ccfd9d5123c7361c42fc789d63aadd51e84a55d5b7b479a9416f11904069159d3be5d725994776d2b6e2efb44c0d443e72dc983baab0598877a91ceceea5c406965db3d62b48a5f2d7d1fb74583b742310b24c3810cdac49dd2b6ab77420c3acc2088125863e5c6fe1081af490ab0fe09fab236ca136cdc25b35ee6339530f4cc372d6f941fb0f218a77b593f87ef8f8c19f5acbeac953e646e7a0b0c10ecea371f9be312f9ed9d65d7c8753543a3cfdd4cafe1957f4f3e098bcd0d069acdcb938f205b9d0f47b3e402bed96b56ce8eb2b04bd15b822be034741a694f0fa2f5ca9e24314ee5ffd0753ed1b753a86765a0c1a439d37f61f3d58e0932238cb66f54cd93d9790e5bd2917c4950b81264fd93f30da9d6568c898b38def87acc6804acdeef837d32687a503d69302fd12b8563f9dba27751410a7872c72d49833be372c1f9decca7ae55e84d33a7efa69a85beaeb5aa1151e81e83e2d0749d1debbd6f2506901f22b009f3f86634bfbfd4776b609c9d33e48ef15ac3740e7427b5563d5f4c23811ed284f8732a99e134399dabadd3be48c33fb2ce4d5e65e80e42e013447da182c0922e4d8a132467a7529ef2d4f9de1af285f30984a2098ff2af9c89c44aeb211233ef0325cba174c1d5112afe2db95b133153ac7b792bb5415780daab554ffd5d84a7c4d822ddfb1ee61269048269baeec99e2e8e2f91d5f253644c118d5915f93753b29108f4fa8487563897274363d2753b1416e2a6245bd4fd8f6fb221879c2fcb2afc6b2dd911b24c01089357b9020cf6624c2a218fcf48993fc3f5a12ccf13a8a115d00d71dd52a76ab150d008625fd92cc6231915a53de7459873d7e684b3ac4e5b6ca6af3af2fa320472520b66cd4420e5017a4b4109a835c8d2f621ab51aa5f89cec8cf587bac73f6e2f6ce96b75a0f9a31f9744d7492f386eb4662c3125d3fde0493f99f4073eb4817febe5d953ff0f4359a6673d22ebf7ae74231f0c984038b23eb1430e0a9974bfb14fe8dfe59a2520c0f46a5c6a158585db1c91c055a0b17d4a8a394c0d39ac05803fc829bf9164ee33eeee8092d2204e79563a87c2f65e6f354e579c220b0fbf312d8552730ef8fae0f8fb8502ae558f2b442ab86694dd2f04e0cf2ea97adcb311db3b38c543f3555ba2d7c077cea2549e23db8d2722534037dd9e724e95ae3fdc9108eb2f926aa57f38a383cb7750e8ad9de6434e1457626db3b7aa2d1ea43324a2e631e4ee51d43d773073f9fc92197ff8473e11d719a15314b76d67d92116b5a4762a5da2d26a7084c0b3bee6e7dd5afae7cec9fa7433211900ec33341b9210c984ad1a630005291b1d54cbfa8f1d837216e6789285728f54a3afb4d8f4c081b36c0f2144787999812d9871e08d36f8c23c112f6ccdcebfd337043725f2c069674f8ced397598dbcb6f674e4281871dad48ea0d97339735ae64176fbf22bd30297e99b85a407f0835785164be4fbe724350c442a56bb2112d164d97b1903124dd7840f32d4c6fea58f5473c543030b3e7b486b513c620350c9039e60817c8f04c0f747010054d5d9702d5b710ae83d13b257e2758a2f9f4288119e654e9c51eeac53af5908382c4b3710682231ac74c9e64e3e393b404b2cf9355330a86c795101917a4359abbba4f08400164197b298196b0b46fffd2428d5aea2a69fcf4dde11fe561965da6c57c6ddf618cbb58107915bf72ff1acb6f1dca4df8ec42b53e39deeb2887e39d1743653d33106523239b6987b519e064068e08e760b14ebda3e12db2b22810ec6603aa81336f93a7279699745feb19bfd774c076a602c4017302869cea1cdb8c3e9cec8603676d97e14f3516daf00c7f304b4483ebd87e000d5b23355e68c62ba77c8a80621c376c4db69ecde0a5ab96fa24a50381e959b1707c1074181901fa0f248c220b0757911e2ad4d16bce803b9bb53424e0c7d0dfb0568e988d1f5283f2f0ad84c73ce4150949a32bced2c0876293e21b815fd72ba388d72a27d7e910a6898f0b23d65f24eb709d413af876d19859c157d6afa4f50d326cc5431e157f0be61126617b51aa92c3246efab9f8ca5a7d279afe06c0e0faf7aaf9aec3d45842a091c4498b05c1ae8677efc3412936b1ceb1cc1754271bc899c6c729878451e9c642c7ce478ea8b78ab0f7ac265c320667f0deb54e02a370ab44b3d860f043daf4c98b71352047738ae9ff2f708f6ae1e14ca15ef828ef4a4d5e575b526aa6005de4b663780f77c34a6d52a22c3785fedf80c1a555dca1d49d438c07563d8662698bf3460270765eb9661d0c4bb136a9733cfce22ec487ba9dc48c2bac4e8870130799e330854223011ad13ef8d264b0083d4535586e08f3828996591a42aae057db1e6fb2908a12570f8c3deef71e1c37c376133b9e4f70fae50e513f46d3699a2e79688433753132b1931de51809a78cfff87b4b40709457fd1afe7d3bbd7ecb83a9bd18ce0d7f5fda8e8d63c88627d5f5c5cecf539ad1c79d1c255dfde385ba0eb33130cf509c5e4a7a36285ac7de43b06c30cb3b6b89d670128d09cd21af7347516b71a7131c866bb6b2f32b6061a541c277b3eb5e8052751186120da6ae461f7fb1c41c4b8bb4d514713cb6703409454467b136b358f1fd1f7ab3189e88a960b43139fc03376d12a277211515fb23e031f60a03e479e455513ae7d8efd396fa3f6350c5a6d6f0b49e7d382b7ed4b596f2726231939d46367939042379e03b89a0626dc4bcbf92506a3b04b13cce865a5c07c963000622cc27a63fe80743a85acf7d6accbd7a45cb50ddd17ae1899dbf0f403864e4cbbfca3eb270680bfa5510c6355f6149ba3883ccedbe059d5060e60509944371955689016576736f10b6e1199b2ef43e0b6f08d7149b2f953c4712e562d526dc8208238d994ba765adf06a12e78275cd2fae456acb86d4279ed60d45582b52a20ac77f1a7a864b6e00f2698b4d7d7499e4f8423853b048bf755f1337d3d9dfe4e4517bfe9bf68e9f3676d0138cf55aed3e09e8aa46d7e51e057888160333dd6caf7b20ea036865f009c4af51671651776e63e484c1c951b9d11f3758388b3f10f4354710f0e7de2cdcb86bfa6b81d9f4dd0b98d9a57089225861fd2ef53f0e9959021e57c0798b14a55a7aa05f7840c1b96d40d8735776927a7fa53cfd42f1865b3fd1f7fc2b5aeaf59036a340c57a87e5e690093784d41913389b461fa36754cc43cedde72f69e5f52c7e56b7991f56c9a5e2c7ef5d958fa6d32df4543a7e6438f07d59165a6f98306bc07a69964a570f349b4172b2554ff1ace8e55d27f309252dc943e7064353f22280cb5d2638d101e4550c7d420d7343f5b7385ba1184660821468965094ce7984124468a3297b422eccb226f5bd6ce3e7e301dfc761e4c4ae1b76b413f894924ccaf387aa46faf21b32d3de2ec8c6954b8726045274d1cae3746b97cf70ff00f09fe91d54d6cac4c949b94da658133622fdd2aba13432e5db2a138cbe0e12ccb9152e68f14246066ca59679d68e8637868c70aa635cbaa60fbe7abf4b46492874bf088cc2e9c8760fdd4f2f28aa2e9f8c82a905715818ce1c5fca0d5bfeb5549dd8fdb3e45f27e71cae0ae1986c386c4f88861f1a9a267995cc8907d864d83801a2aa5e20f7f8aa04415b2b903cf836ef7a00b2ce7a1517da724eb1dbbd4fa402731d44bf71ad41a8f9b702eca494b3d9288960a198ce288be6bb83f0b11d2a250e53664fdf24b669592904c5e6d0158c6975198f80ac8466bc65fece5a6b5c4dfaca84549590930918e6fc883b976b9f92231fd94d50c17236ac5a299cc8b9ffd7d5a479eb59ca0d1cc81be08ee55f142872c2fd39bb1c40c7e5afdb468e8a063689c7068e723bce8571ea72dc148b54cf1962455ef2c22757a8fedec6984be6d8f386fbdaca1d8a948044110417695fcdf794ccd2ddfebe1fcd360e5586e70a86ed2bdf65362367f5043a977e571651cbcd3cc27db92905746e846cac1292e6f0e8fe60dc5393ba6d3fe07d6ade57dd3e9fed50a752377cfc3e86857b31886d93bbc62d5660fba7e3aad386f4d188404993c1ac143df11085e1e66cd299c0322fe0237ff861730a53d518188058f05719638de4b4181534c37083745e163cd506d30b64e68fe01fa72e18541d4c17453258f2775ebabe5c4dffec3fdc2dbaeb6bf04a57ab4e35177fb3ef679ce0be71383376bdc04cdbdf75b219afae086972599116eb797be9e8f2eedb6d4729766d07155129eb522057443985e3076f61564857c4a83f510ef4fb35d7c6a55ce4d20ddc45fbcda5ae92f52b50b51005080848eb4c6a9796a748786c748f218ba8e5dd328e60124b124e7a82c349a94a112c8034bf7f088325ce9bed4512f3e4981e569a4b5a1a836352352c8a27c7935316e6ca61d6191e6215cb2c6630b31bbe0b16982c1f46257c5b71f005d13c496e603dfd7720d3fb5a9f1b677953a43ee849b94ffbbda571f740945aae7cf1b9599201788384dd5f1d568fee00bf6c9406b7d6b8a2867afd69536e590ad5a3c24f8b62771763259f63b8134feb90d49007e274cb92e226d3da1bd202a4a184c605cdc49e8356e176b535087977ff80c394d3e773209698fde1a54ef1bc36d8a47770388b69e7ba7e5c393d40c2c07b720ef479673111f901c344a1555e748f5e5cbca8b256315498b2ca5a110bdf9b7019317b0ae88526b3d66f2d2747bb1eab91df6fa5391dd24d1997bf65f4a05e349fe145e2791d72cbab7c7699cc0bab3ecb7012dd962625370df7d3793e8f3f30f2210e7b9733b317dd82e3023abbb79b2645f941789256698c7260ac878329529a3a2e79bff5dafc", 0x1000, 0x80000000}], 0x210a4, &(0x7f0000001e40)={[{@nodots='nodots'}, {@fat=@check_normal='check=normal'}], [{@hash='hash'}, {@pcr={'pcr', 0x3d, 0x32}}, {@uid_eq={'uid', 0x3d, r3}}, {@permit_directio='permit_directio'}, {@uid_gt={'uid>', r4}}, {@rootcontext={'rootcontext', 0x3d, 'unconfined_u'}}, {@permit_directio='permit_directio'}]}) getsockopt$inet6_dccp_int(r1, 0x21, 0xb, &(0x7f0000001f00), &(0x7f0000001f40)=0x4) getsockopt$inet_sctp_SCTP_PEER_AUTH_CHUNKS(r1, 0x84, 0x1a, &(0x7f0000001f80)={0x0, 0xc3, "bfdc602f1842f891bdfb554dcf94ef1e6f167e3077287c74c1b9e804e272c291f661010f9bc95d09958fe5941899f4c0ce2470f3a55dd14548fb0fbf8ae7380a8bb96e80bfa6b24e6071688f11d84d57d864cbd3ca0322232f4f9548393b0c5ae62eca5a5f55ee57915c466080037887a18add68b806f423f631ce3a7f1a6eedf8c87800ca9cbc53b2c70bfd557b737c12ca5a748b61910a9b9facaf5f7d6292c5e149392aa645fb462897b00118329ebb2c1d62d1173d02121c48168c3f969644f626"}, &(0x7f0000002080)=0xcb) getsockopt$inet_sctp_SCTP_ASSOCINFO(r1, 0x84, 0x1, &(0x7f00000020c0)={r5, 0x1, 0x1f, 0x400, 0x7, 0x8001}, &(0x7f0000002100)=0x14) ioctl$LOOP_CTL_GET_FREE(r1, 0x4c82) setsockopt$l2tp_PPPOL2TP_SO_REORDERTO(r1, 0x111, 0x5, 0x4, 0x4) getsockopt$inet_sctp_SCTP_DISABLE_FRAGMENTS(r1, 0x84, 0x8, &(0x7f0000002140), &(0x7f0000002180)=0x4) ioctl$VIDIOC_G_PARM(r1, 0xc0cc5615, &(0x7f00000021c0)={0x44d42beabdeadd34, @capture={0x0, 0x1, {0x6, 0x3ff}, 0x8ef4, 0x1000}}) timerfd_gettime(r1, &(0x7f00000022c0)) write$P9_RREADLINK(r1, &(0x7f0000002300)={0x10, 0x17, 0x1, {0x7, './file0'}}, 0x10) ioctl$KVM_GET_PIT(r1, 0xc048ae65, &(0x7f0000002340)) ioctl$sock_SIOCDELDLCI(r1, 0x8981, &(0x7f00000023c0)={'eql\x00', 0x1}) setsockopt$SO_VM_SOCKETS_CONNECT_TIMEOUT(r1, 0x28, 0x6, &(0x7f0000002400), 0x10) 13:28:13 executing program 1: r0 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x400200, 0x0) write$P9_RAUTH(r0, &(0x7f0000000040)={0x14, 0x67, 0x1, {0x7b, 0x0, 0x6}}, 0x14) ioctl$KDSIGACCEPT(r0, 0x4b4e, 0x27) getsockopt$inet_sctp6_SCTP_RESET_STREAMS(r0, 0x84, 0x77, &(0x7f0000000080)={0x0, 0x8}, &(0x7f00000000c0)=0x8) getsockopt$inet_sctp6_SCTP_AUTH_ACTIVE_KEY(r0, 0x84, 0x18, &(0x7f0000000100)={r1, 0x1000}, &(0x7f0000000140)=0x8) write$FUSE_INTERRUPT(r0, &(0x7f0000000180)={0x10, 0xfffffffffffffff5, 0x5}, 0x10) syz_genetlink_get_family_id$ipvs(&(0x7f00000001c0)='IPVS\x00') r3 = shmget$private(0x0, 0x4000, 0x78000400, &(0x7f0000ff9000/0x4000)=nil) shmctl$IPC_INFO(r3, 0x3, &(0x7f0000000200)=""/67) ioctl$VIDIOC_S_PARM(r0, 0xc0cc5616, &(0x7f0000000280)={0x9, @raw_data="ae30853ced239a3e74e48cf388482043299e2c25ef9f30df6fc2c4e1e7beab31e7041ebeaf236ee325b26e7e24348dce19ced249d02c28a2f6fd3ce6d251fa2d9793aa88fc224b8cf2b5252a0c1d3557cbf5aadce8dcc0a73e566fda8e2154ba0b0748e651db2e344dbd6e5026b2ffcbaad50473eb2027c40aa93de3f90972b328f94d27e7617e7dccf24430765545d3c94e2e9cb8367f75ee4eef01bdb4429edf31efa6154a4f9130b8426e7c06932da0e979732be87f7f2a2e83decacef537cee52582c2b99796"}) setsockopt$inet_sctp6_SCTP_MAXSEG(r0, 0x84, 0xd, &(0x7f0000000380)=@assoc_id=r1, 0x4) ioctl$UI_SET_PHYS(r0, 0x4008556c, &(0x7f00000003c0)='syz1\x00') shmget$private(0x0, 0x1000, 0x0, &(0x7f0000ff9000/0x1000)=nil) ioctl$UI_SET_KEYBIT(r0, 0x40045565, 0x2b4) r4 = syz_genetlink_get_family_id$tipc(&(0x7f0000000440)='TIPC\x00') sendmsg$TIPC_CMD_SHOW_STATS(r0, &(0x7f0000000500)={&(0x7f0000000400)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f00000004c0)={&(0x7f0000000480)={0x1c, r4, 0x0, 0x70bd28, 0x25dfdbfd, {}, [""]}, 0x1c}, 0x1, 0x0, 0x0, 0x20000000}, 0x1) prctl$PR_GET_FP_MODE(0x2e) r5 = semget(0x0, 0x1, 0x120) semctl$SEM_STAT(r5, 0x4, 0x12, &(0x7f0000000540)=""/231) ioctl$VIDIOC_OVERLAY(r0, 0x4004560e, &(0x7f0000000640)) getsockopt$inet_sctp6_SCTP_MAX_BURST(r0, 0x84, 0x14, &(0x7f0000000680)=@assoc_value, &(0x7f00000006c0)=0x8) ioctl$SNDRV_CTL_IOCTL_HWDEP_INFO(r0, 0x80dc5521, &(0x7f0000000700)=""/7) ioctl$sock_SIOCETHTOOL(r0, 0x8946, &(0x7f00000007c0)={'ip6gretap0\x00', &(0x7f0000000740)=@ethtool_coalesce={0xe, 0x200000000, 0x0, 0xfe000000000000, 0x3, 0x6, 0x3, 0xa568, 0x81, 0x4, 0x5, 0x1000, 0x5, 0x6, 0x7, 0x0, 0xfffffffffffffffa, 0xfff, 0x1000, 0x1b3, 0x8, 0x1, 0x4}}) ioctl$SIOCX25GDTEFACILITIES(r0, 0x89ea, &(0x7f0000000800)) openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000840)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) setsockopt$inet_sctp6_SCTP_AUTH_KEY(r0, 0x84, 0x17, &(0x7f0000000880)={r2, 0x0, 0x26, "e0d51756ce0f68efd0b25653873f70d2a7b2606ce2cf6485ad0bb1dd1697a4ca56b5fd381d8a"}, 0x2e) setsockopt$inet_udp_int(r0, 0x11, 0x0, &(0x7f00000008c0)=0x80000001, 0x4) lstat(&(0x7f0000000900)='./file0\x00', &(0x7f0000000940)) ioctl$DRM_IOCTL_CONTROL(r0, 0x40086414, &(0x7f00000009c0)={0x1, 0x7f}) getsockopt$inet_sctp_SCTP_SOCKOPT_CONNECTX3(r0, 0x84, 0x6f, &(0x7f0000000a40)={r2, 0x30, &(0x7f0000000a00)=[@in={0x2, 0x4e21, @rand_addr=0xfffffffffffff8e0}, @in={0x2, 0x4e23, @multicast1}, @in={0x2, 0x4e22, @dev={0xac, 0x14, 0x14, 0x16}}]}, &(0x7f0000000a80)=0x10) [ 253.478072] IPVS: ftp: loaded support on port[0] = 21 13:28:13 executing program 2: getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000000080)={{{@in6, @in6=@mcast2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{}, 0x0, @in=@broadcast}}, &(0x7f0000000180)=0xe8) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f00000001c0)={0x0, 0x0, 0x0}, &(0x7f0000000200)=0xc) getsockopt$inet_IP_IPSEC_POLICY(0xffffffffffffff9c, 0x0, 0x10, &(0x7f0000000240)={{{@in6=@initdev, @in6=@remote, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@initdev}, 0x0, @in6=@dev}}, &(0x7f0000000340)=0xe8) mount$overlay(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040)='overlay\x00', 0x2200000, &(0x7f0000000380)={[{@redirect_dir={'redirect_dir', 0x3d, './file0'}}, {@index_on='index=on'}, {@xino_on='xino=on'}, {@redirect_dir={'redirect_dir', 0x3d, './file0'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@xino_off='xino=off'}, {@index_off='index=off'}, {@xino_auto='xino=auto'}, {@metacopy_off='metacopy=off'}], [{@fowner_gt={'fowner>', r1}}, {@defcontext={'defcontext', 0x3d, 'user_u'}}, {@fsuuid={'fsuuid', 0x3d, {[0x38, 0x3f, 0x32, 0x39, 0x37, 0x7d, 0x37, 0x3c], 0x2d, [0x77, 0x3f, 0x3b, 0x35], 0x2d, [0x0, 0x3f, 0x33, 0x66], 0x2d, [0x37, 0x0, 0x66], 0x2d, [0x0, 0x0, 0x37, 0x3f, 0x0, 0x39, 0x63, 0x77]}}}, {@uid_lt={'uid<', r3}}, {@fowner_gt={'fowner>', r5}}]}) r6 = accept4(0xffffffffffffff9c, 0x0, &(0x7f00000004c0), 0x800) getpeername$inet(r6, &(0x7f0000000500)={0x2, 0x0, @remote}, &(0x7f0000000540)=0x10) getsockopt$inet_sctp6_SCTP_STATUS(r6, 0x84, 0xe, &(0x7f0000000580)={0x0, 0xe0000000000, 0x3f, 0x128, 0x8, 0x6, 0x4, 0xfffffffffffffff7, {0x0, @in6={{0xa, 0x4e22, 0x6, @initdev={0xfe, 0x88, [], 0x0, 0x0}, 0x1}}, 0x5, 0x4, 0x4, 0xe9, 0xf6c}}, &(0x7f0000000640)=0xb0) setsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(r6, 0x84, 0x9, &(0x7f0000000680)={r7, @in={{0x2, 0x4e24, @loopback}}, 0x1, 0x4, 0x497, 0xfffffffffffffff9, 0x20}, 0x98) r8 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000740)='/dev/snapshot\x00', 0x4000, 0x0) ioctl$BLKRRPART(r8, 0x125f, 0x0) ioctl$KVM_SET_XCRS(r8, 0x4188aea7, &(0x7f0000000780)={0x1, 0x1, [{0x9, 0x0, 0xfffffffffffffff9}]}) getsockopt$inet_IP_XFRM_POLICY(r8, 0x0, 0x11, &(0x7f00000007c0)={{{@in=@multicast1, @in=@multicast2}}, {{@in6=@initdev}}}, &(0x7f00000008c0)=0xe8) r9 = accept(r6, &(0x7f0000000900)=@ipx, &(0x7f0000000980)=0x80) r10 = getpgrp(r2) getsockopt$inet_mreq(r9, 0x0, 0x0, &(0x7f00000009c0)={@multicast1, @broadcast}, &(0x7f0000000a00)=0x8) close(r9) ioctl$FICLONE(r9, 0x40049409, r9) getsockname$packet(r9, &(0x7f0000000a40), &(0x7f0000000a80)=0x14) socket$pptp(0x18, 0x1, 0x2) ioctl$DRM_IOCTL_DROP_MASTER(r8, 0x641f) ptrace$getregset(0x4204, r2, 0x0, &(0x7f0000000bc0)={&(0x7f0000000ac0)=""/252, 0xfc}) pipe2$9p(&(0x7f0000000c00), 0x4800) socket$pppoe(0x18, 0x1, 0x0) ioctl$DRM_IOCTL_GET_CAP(r8, 0xc010640c, &(0x7f0000000c40)={0x3ff, 0x3}) setgid(r4) sendmsg$can_raw(r6, &(0x7f0000000d40)={&(0x7f0000000c80)={0x1d, r0}, 0x10, &(0x7f0000000d00)={&(0x7f0000000cc0)=@can={{0x1, 0x5fc, 0x80000001, 0x7}, 0x0, 0x1, 0x0, 0x0, "4ea2e066dcb085cf"}, 0x10}, 0x1, 0x0, 0x0, 0x4008000}, 0x800) ioctl$SNDRV_TIMER_IOCTL_TREAD(r8, 0x40045402, &(0x7f0000000d80)) syz_open_procfs(r10, &(0x7f0000000dc0)='net/if_inet6\x00') r11 = syz_open_dev$dspn(&(0x7f0000000e00)='/dev/dsp#\x00', 0x7f, 0x200000) getpeername$inet(r11, &(0x7f0000000e40)={0x2, 0x0, @multicast2}, &(0x7f0000000e80)=0x10) 13:28:14 executing program 3: r0 = syz_open_dev$rtc(&(0x7f0000000000)='/dev/rtc#\x00', 0x200, 0x10003) fcntl$setlease(r0, 0x400, 0x0) r1 = socket$inet_sctp(0x2, 0x1, 0x84) sendto$inet(r1, &(0x7f0000000040)='_', 0x1, 0x8805, &(0x7f0000000080)={0x2, 0x4e24, @initdev={0xac, 0x1e, 0x0, 0x0}}, 0x10) prctl$PR_GET_TID_ADDRESS(0x28, &(0x7f00000000c0)) getsockopt$inet_sctp_SCTP_STREAM_SCHEDULER_VALUE(r1, 0x84, 0x7c, &(0x7f0000000100)={0x0, 0x8, 0x2}, &(0x7f0000000140)=0x8) setsockopt$inet_sctp_SCTP_PEER_ADDR_THLDS(r1, 0x84, 0x1f, &(0x7f0000000180)={r2, @in6={{0xa, 0x4e21, 0x8, @local, 0x6}}, 0x4, 0x1f}, 0x90) r3 = syz_open_dev$swradio(&(0x7f0000000240)='/dev/swradio#\x00', 0x0, 0x2) getsockopt$sock_cred(r1, 0x1, 0x11, &(0x7f0000000280)={0x0, 0x0}, &(0x7f00000002c0)=0xc) ioctl$SIOCAX25DELUID(r3, 0x89e2, &(0x7f0000000300)={0x3, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x3}, r5}) ioctl$PERF_EVENT_IOC_RESET(r3, 0x2403, 0x1) syz_open_pts(r3, 0x8402) ioctl$EXT4_IOC_PRECACHE_EXTENTS(r0, 0x6612) clock_gettime(0x0, &(0x7f0000000340)={0x0, 0x0}) write$evdev(r3, &(0x7f0000000380)=[{{r6, r7/1000+10000}, 0x5, 0x0, 0x20}, {{}, 0x17, 0x0, 0x401}, {{}, 0x1f, 0x5ca, 0x3}, {{0x77359400}, 0x2, 0x9, 0xe49}, {{}, 0x3, 0x33, 0x9948}], 0x78) futex(&(0x7f0000000400)=0x2, 0x8d, 0x1, &(0x7f0000000440)={0x0, 0x1c9c380}, &(0x7f0000000480)=0x2, 0x2) getsockopt$inet_sctp_SCTP_AUTO_ASCONF(r1, 0x84, 0x1e, &(0x7f00000004c0), &(0x7f0000000500)=0x4) syz_open_dev$sg(&(0x7f0000000540)='/dev/sg#\x00', 0x8, 0xaf9c52d2cb1f9f93) r8 = syz_open_dev$media(&(0x7f0000000580)='/dev/media#\x00', 0x7, 0x101882) ioctl$VT_RELDISP(r3, 0x5605) ioctl$VIDIOC_S_AUDOUT(r3, 0x40345632, &(0x7f00000005c0)={0x70f, "66a78c29d332fd0ce598c37f6ef5700f470f10b13851dbc5353e2c3cb7dbcaf5", 0x3}) setsockopt$bt_BT_CHANNEL_POLICY(r3, 0x112, 0xa, &(0x7f0000000600)=0xffffffffffffffff, 0x4) ioctl$KDGKBENT(r3, 0x4b46, &(0x7f0000000640)={0x1, 0xffffffffffffe5a9, 0x80}) ioctl$VIDIOC_TRY_ENCODER_CMD(r3, 0xc028564e, &(0x7f0000000680)={0x1, 0x1, [0x6, 0xff, 0x43, 0x3, 0x3, 0x8001, 0x6, 0xe080000000000000]}) ptrace(0xffffffffffffffff, r4) ioctl$PERF_EVENT_IOC_SET_BPF(r8, 0x40042408, r8) socket$inet_sctp(0x2, 0x5, 0x84) r9 = openat$ipvs(0xffffffffffffff9c, &(0x7f00000006c0)='/proc/sys/net/ipv4/vs/expire_nodest_conn\x00', 0x2, 0x0) r10 = syz_genetlink_get_family_id$team(&(0x7f0000000740)='team\x00') getpeername$packet(r9, &(0x7f0000000940)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @remote}, &(0x7f0000000980)=0x14) getsockopt$inet_IP_IPSEC_POLICY(r1, 0x0, 0x10, &(0x7f00000009c0)={{{@in=@multicast1, @in6=@remote, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@initdev}, 0x0, @in=@multicast1}}, &(0x7f0000000ac0)=0xe8) accept4$packet(r8, &(0x7f0000000b00)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @random}, &(0x7f0000000b40)=0x14, 0x80000) getsockopt$inet_IP_IPSEC_POLICY(r9, 0x0, 0x10, &(0x7f0000000b80)={{{@in=@multicast1, @in=@remote, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@mcast1}, 0x0, @in6=@mcast1}}, &(0x7f0000000c80)=0xe8) getsockopt$inet_mreqn(r9, 0x0, 0x23, &(0x7f0000000cc0)={@loopback, @remote, 0x0}, &(0x7f0000000d00)=0xc) getsockopt$inet_IP_IPSEC_POLICY(r3, 0x0, 0x10, &(0x7f0000001400)={{{@in6, @in=@dev, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@initdev}, 0x0, @in=@multicast1}}, &(0x7f0000001500)=0xe8) sendmsg$TEAM_CMD_OPTIONS_GET(r3, &(0x7f0000001740)={&(0x7f0000000700), 0xc, &(0x7f0000001700)={&(0x7f0000001540)={0x198, r10, 0x100, 0x70bd29, 0x25dfdbfc, {}, [{{0x8, 0x1, r11}, {0xc4, 0x2, [{0x40, 0x1, @priority={{{0x24, 0x1, 'priority\x00'}, {0x8}, {0x8, 0x4, 0x400}}, {0x8, 0x6, r12}}}, {0x40, 0x1, @lb_tx_hash_to_port_mapping={{{0x24, 0x1, 'lb_tx_hash_to_port_mapping\x00'}, {0x8}, {0x8, 0x4, r13}}, {0x8}}}, {0x40, 0x1, @lb_tx_hash_to_port_mapping={{{0x24, 0x1, 'lb_tx_hash_to_port_mapping\x00'}, {0x8}, {0x8, 0x4, r14}}, {0x8}}}]}}, {{0x8, 0x1, r15}, {0xb0, 0x2, [{0x38, 0x1, @mcast_rejoin_interval={{0x24, 0x1, 'mcast_rejoin_interval\x00'}, {0x8}, {0x8, 0x4, 0x4}}}, {0x3c, 0x1, @user_linkup_enabled={{{0x24, 0x1, 'user_linkup_enabled\x00'}, {0x8}, {0x4}}, {0x8, 0x6, r16}}}, {0x38, 0x1, @notify_peers_count={{0x24, 0x1, 'notify_peers_count\x00'}, {0x8}, {0x8, 0x4, 0x3}}}]}}]}, 0x198}, 0x1, 0x0, 0x0, 0x4}, 0x4000000) [ 254.095480] IPVS: ftp: loaded support on port[0] = 21 13:28:14 executing program 4: ioctl$TIOCGSID(0xffffffffffffffff, 0x5429, &(0x7f0000000000)=0x0) sched_getaffinity(r0, 0x8, &(0x7f0000000040)) r1 = syz_open_dev$mice(&(0x7f0000000080)='/dev/input/mice\x00', 0x0, 0x0) setsockopt$bt_BT_POWER(r1, 0x112, 0x9, &(0x7f00000000c0)=0xb77, 0x1) ioctl$VIDIOC_RESERVED(r1, 0x5601, 0x0) setsockopt$inet6_dccp_buf(r1, 0x21, 0xc0, &(0x7f0000000100)="764e688db381b7251038b59ee58ff34322b736f510c7b16f53c647538064f4a51f3b9b83e49292e60c38d9c343b976e80c1c1fd9b561da711fe970044b30b2b940437c57e67308ff9ee9704e412461547eb4089fc7763f9a9f54a6908fcb87fcc6d2d0e8a62b4ecb758a7d0810d8d7dc87768c732e7baca7b9abd823f18828d9e0e6219b1c1f3f7e80e8fe95242ac717a8f01ec0ed02e88af815ce53928096d2a73a175d4e66cce9083d6c057d57777f8bdce2962fbc7d58be4023b89969d6f766b2834997384ca35898af9b", 0xcc) r2 = socket$rds(0x15, 0x5, 0x0) openat$md(0xffffffffffffff9c, &(0x7f0000000200)='/dev/md0\x00', 0x1, 0x0) accept4$unix(r1, &(0x7f0000000240), &(0x7f00000002c0)=0x6e, 0x80000) lsetxattr$trusted_overlay_nlink(&(0x7f0000000300)='./file0\x00', &(0x7f0000000340)='trusted.overlay.nlink\x00', &(0x7f0000000380)={'U+', 0x1}, 0x28, 0x2) ioctl$VIDIOC_SUBDEV_G_FRAME_INTERVAL(r1, 0xc0305615, &(0x7f00000003c0)={0x0, {0x4, 0xfff}}) r3 = syz_open_dev$radio(&(0x7f0000000400)='/dev/radio#\x00', 0x0, 0x2) getsockopt$inet6_IPV6_IPSEC_POLICY(r3, 0x29, 0x22, &(0x7f0000000480)={{{@in=@initdev, @in=@initdev, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@multicast2}, 0x0, @in6=@remote}}, &(0x7f0000000580)=0xe8) quotactl(0x10001, &(0x7f0000000440)='./file0\x00', r4, &(0x7f00000005c0)="fa6ff1d8fdfd6be1f2f9d12022e2853606be0cbe5b69b161e14a54713a7a228e692ee14bb75c8e153c317197bbfdd7ceef31221e0a5057fcbb78") write$RDMA_USER_CM_CMD_CREATE_ID(r2, &(0x7f0000000640)={0x0, 0x18, 0xfa00, {0x4, &(0x7f0000000600)={0xffffffffffffffff}, 0x13f}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_ADDR(r3, &(0x7f0000000680)={0x15, 0x110, 0xfa00, {r5, 0x0, 0x0, 0x0, 0x0, @in={0x2, 0x4e21, @multicast2}, @ib={0x1b, 0x6, 0x0, {"36f75ec31357c14b65970ff1d053bc6c"}, 0x2b58, 0x1, 0x4}}}, 0x118) syz_open_dev$video4linux(&(0x7f00000007c0)='/dev/v4l-subdev#\x00', 0x10001, 0x101000) getsockopt$bt_sco_SCO_CONNINFO(r1, 0x11, 0x2, &(0x7f0000000800)=""/88, &(0x7f0000000880)=0x58) socketpair(0xd, 0x8000a, 0x8f8, &(0x7f00000008c0)={0xffffffffffffffff}) getsockopt$bt_BT_VOICE(r1, 0x112, 0xb, &(0x7f0000000900)=0x1000000000000000, &(0x7f0000000940)=0x2) pipe(&(0x7f0000000980)={0xffffffffffffffff, 0xffffffffffffffff}) socketpair(0x7b1194b10ec4f954, 0x5, 0x1, &(0x7f00000009c0)={0xffffffffffffffff}) write$cgroup_subtree(r1, &(0x7f0000000a00)={[{0x2b, 'memory'}, {0x2d, 'rdma'}, {0x2d, 'io'}, {0x0, 'pids'}, {0x2d, 'cpu'}, {0x2d, 'pids'}, {0x2b, 'memory'}]}, 0x2b) getsockopt$inet_sctp_SCTP_DEFAULT_PRINFO(r8, 0x84, 0x72, &(0x7f0000000a40)={0x0, 0x100000000, 0x20}, &(0x7f0000000a80)=0xc) getsockopt$inet_sctp6_SCTP_ASSOCINFO(r6, 0x84, 0x1, &(0x7f0000000ac0)={r10, 0x5, 0x4, 0x4c3, 0xffffffffffffc374, 0x7}, &(0x7f0000000b00)=0x14) ioctl$sock_inet_SIOCDELRT(r9, 0x890c, &(0x7f0000000b80)={0x0, {0x2, 0x4e23, @rand_addr=0x4}, {0x2, 0x4e21, @dev={0xac, 0x14, 0x14, 0x26}}, {0x2, 0x4e20, @initdev={0xac, 0x1e, 0x0, 0x0}}, 0x2, 0x0, 0x0, 0x0, 0x8, &(0x7f0000000b40)='veth0_to_hsr\x00', 0x6, 0x3, 0x8}) ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_INFO(r1, 0xc08c5335, &(0x7f0000000c00)={0x9701, 0x173, 0x4, 'queue1\x00', 0x4800000000000}) setsockopt$inet_icmp_ICMP_FILTER(r6, 0x1, 0x1, &(0x7f0000000cc0)={0x7f}, 0x4) ioctl$TUNSETTXFILTER(r7, 0x400454d1, &(0x7f0000000d00)={0x1, 0x7, [@local, @empty, @dev={[], 0x1a}, @random="bd8059f95e4b", @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x3}, @link_local, @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0xf}]}) setsockopt$inet_sctp_SCTP_CONTEXT(r9, 0x84, 0x11, &(0x7f0000000d40)={r11, 0x6}, 0x8) [ 254.895907] IPVS: ftp: loaded support on port[0] = 21 13:28:15 executing program 5: r0 = openat$vsock(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vsock\x00', 0x2200, 0x0) r1 = openat$pfkey(0xffffffffffffff9c, &(0x7f0000000040)='/proc/self/net/pfkey\x00', 0x4000, 0x0) ioctl$EVIOCSABS2F(r0, 0x401845ef, &(0x7f0000000080)={0x2, 0x4, 0xffffffffe471f7e3, 0x1ff, 0x6, 0xffffffffffff0c66}) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f00000000c0)={'veth0_to_team\x00', 0x0}) ioctl$sock_inet6_SIOCSIFADDR(r0, 0x8916, &(0x7f0000000100)={@initdev={0xfe, 0x88, [], 0x10000, 0x0}, 0x40, r2}) ioctl$RTC_UIE_ON(r0, 0x7003) getsockopt$EBT_SO_GET_INFO(r0, 0x0, 0x80, &(0x7f0000000140)={'broute\x00'}, &(0x7f00000001c0)=0x78) ioctl$NBD_SET_SIZE_BLOCKS(r0, 0xab07, 0x7) r3 = openat$cgroup_subtree(r0, &(0x7f0000000200)='cgroup.subtree_control\x00', 0x2, 0x0) prctl$PR_GET_ENDIAN(0x13, &(0x7f0000000240)) fcntl$notify(r0, 0x402, 0x2) ioctl$sock_SIOCOUTQNSD(r0, 0x894b, &(0x7f0000000280)) ioctl$NBD_SET_SIZE_BLOCKS(r0, 0xab07, 0x80000000) getsockopt$inet_sctp_SCTP_PR_SUPPORTED(r1, 0x84, 0x71, &(0x7f00000002c0)={0x0, 0xfffffffffffffffa}, &(0x7f0000000300)=0x8) getsockopt$inet_sctp6_SCTP_LOCAL_AUTH_CHUNKS(r1, 0x84, 0x1b, &(0x7f0000000340)={r4, 0xc1, "38ebadeb388f9ddfba7239dfa9d7e1a677db3bcc981327762512487cfe1d558dbda97b8e6ab6a41765e448b69ece5dffda5391f51f20774fc21eeee02c4c964240c82467b1c721c0c7ac7e398c977adf336ea6866f95ac9aef88b92d0601854f6d3767bd8aa14af881fcf87a551f074b28dd428187ac6aad87bd9e6b9f54a6c367b7a75f9e25b91b66114444bae26f2c650e9d5381371f9a71a0ed684adb8a98b1eb2060ca061c4880fcc55f56496e9c191bf3738c94f613a006167d7522a3994b"}, &(0x7f0000000440)=0xc9) fadvise64(r1, 0x0, 0x39b, 0x7) ioctl$PERF_EVENT_IOC_ID(r1, 0x80082407, &(0x7f0000000480)) ioctl$EVIOCGBITSND(r3, 0x80404532, &(0x7f00000004c0)=""/151) r5 = getuid() quotactl(0x3ff, &(0x7f0000000580)='./file0\x00', r5, &(0x7f00000005c0)="56151f9a347c872dd4b0a22b9ec7150441fb95125d2b58fb92fce2e04bf9de73bc284cca3651dc793d67468d18f9ef0a3ded4a4f3f93fa013d9755d325acefcfaaf4c2e363810660ba2e668e4762af4eb04c9d97b5520fbd75a34a8cd3b4d52b1061ac6167c7dfe5454f72c8ac725e1f750f4785f08e95921f5c3f3831bed1feca9d35589fc43a4104b4e06bd70fbd8ce83fab4dcd7a47c3498b1b31e90e50d4998941ab4943263d29db2b2793b228c99a00a84658598b5f161a29f6125528709ca0161a80a045c9d347c9a4abb9627446cef9aae754e2995f75ac7537f27ed1072d8690b5838e792c") setsockopt$bt_BT_FLUSHABLE(r1, 0x112, 0x8, &(0x7f00000006c0)=0x6, 0x4) pivot_root(&(0x7f0000000700)='./file0\x00', &(0x7f0000000740)='./file0\x00') ioctl$KVM_GET_DEVICE_ATTR(r0, 0x4018aee2, &(0x7f00000007c0)={0x0, 0x3, 0x0, &(0x7f0000000780)=0x1ff}) lsetxattr$trusted_overlay_upper(&(0x7f0000000800)='./file1\x00', &(0x7f0000000840)='trusted.overlay.upper\x00', &(0x7f0000000880)={0x0, 0xfb, 0x1015, 0x2, 0x1, "b5d6729a176df19ba5955c8282ecbc08", "df7dd2e6ac34da3628317e14eb3213bbd0ba1b0bcd5e75a8ed8e013cc41a17d7099b9afb9c842c34940c82f7544d226e792cb066ddfabf89ddecf12ec14d901d3a2f079a047afe2908f479dbd6fb0e9631992590c0bd56cfef87592fe5e12c01195085b150f0726e8e42f3428318b3abc842bf7a20f9d657e433aef756e12cace31f6031578b4a9151da8857907048fe5d7d05b21d28c2842e2702673fe71e4b6f21191ca66d1e6402baf4dda32f8ee564578d6e5bafbeaf50f52e6794522949f7834e88cfa3efeb450809cea36ee8a9c5e0ff8329cbb3f6fc98cf930b7d9fd1f99b6f91616028082e6df19eea888982be983d2b99a3a22c28da17634332cf1d5a5eddbd15894f5dac4dbc1aca5ec327687a9147cfdf7099a7c88b4583ccecb22fba10312a6792f2301a63b2dff0b8dfed0ddc9690afe2588c8f9f7fd935981c4cece8d8b3a8301165572958744e66890d446df4e554ba92230a321130a921ba8501441953a321d7d64f41889574298eb06700d14fe7a5c57e4cb7968d0feb6881f453212682609d36ca78fe691f8e9e0b02957078dc7bd926e3fae497c9a207d05c47a3e876c787bf6f2cb748aabe2e08fc0a58c7f43a99abc6047ff9d4189d3538f116b006f901d68e1e0a92bce5db71c11d4e3116fc4876a51e24f89a803dd1367da099444c533cc66b175db02958346ee23d8a0c477debc7cc664b60bf7c00909f6bb2295926bba2071eb10191a17fc2ceb6a6e486d76ab592d3b805878a0cf730d066d0c96862235693c2b12c3de1ca53127206b0f5febb38b17a52c31470cc9f89bf238df58ba14985a18f0b0ab6645ad974593d8d93e844e56149e94507df2b1a29c08be2c3a21e1d444465f275a00c1177c84c0f66d88b06a2ad4c33294b639d567c1b3ad201430be3af7e6494315b311be60b3e8927f8394bfa3cc8ce129d99ea770684cda0bed0dfa55fd4a1f5ec08613f45b60e189f129874abd77e8ead5a493a62c9db9e098797ac80e1e0f5b3110f865ddd34858575ebbf69c8fbd2f275d97ca84d22fffdaf944099debad7e99ac85cc97a7b3f2eabfe7bfb98794d8a89aba9704a37dfa47095da4623d48dfffa1a70d8a91cea099c70db4b8925cd4a9e5a96cfccdf74843642a1ae4c6b0c7a5a9c19c7c60131b76210618226d8515bb5739b0fde62ef5a233a03d481acadf8382c624fb6d0a3058db771ac656993216f63c4b7e9da50020e43247151c09826fbfa9a5932aa4fe7a2e931f694ac86d2367809bb7c2ac98a6af65b8d3a4106e1f34c38d5a7ca71801d417cccca507c0a0fd94cf77196b2806d88b284490d3c0783eea4092a8e00b2ef790160e5d5e50e3fac82171c0550a03587c2035b3f7e5ffd41ef00e11592349696821401d53416da93702493a7ac83ee94795d74ca90426a525555ce311ce394783647693a027ad11090e388eaa8f67655bda9049483a6527de6421b113c5e9d44ae787c5cc5a4af001371af373bf49b5856b7bd4a431c7cb456de4672fe987cd0c2de8082e8ac139ee86d048c6c4914123ab9b694bb8fe6c1ba18faa62f55a584f980d5124c19aa6285890a58d7c2b68e49122c28374ac854e99b219e6d24bb13cbaf7d48f0698dcbc302bb5601e2a953166ed85fff99453d29ffb938637b05bdb96ffd07e08fa017da2d614913f622ac4c86832faa567f6817d98b59da98e1b771f78b29385631437987cdccad1df634dff3d686e1f68608f8917ef4915643e2d3f52ca7a21cb6795d29d2e2599e184615e6a933316631c09fafadbba0e6cfe9d1412c87682a2de259d9236ff0ecc33ad70be95e270adb115647f2a189ba8fea0094279242def08de0af1db91ac3f54ac58f58710fd7b3355ef1a534bcb0df5ac21eb28f3cb9f5f85ca301456fad2cbc69a099586b8375706762e843ba17488f0ed333041f443a8f310550d94a9feb7fca1d54621147331a3b2fa5f461733391dad338fa72d5a45e24b67b9523a3665cc2171a89c34b05a6938903ed0d63f30ad53c4629bab40ce04c0862a99286b509913b1cabff19bb026690fe044ea0ae9359b2f0165119b9431f00b3db5ce8dc0628c3b824503450cb9cac321cb34f07272a749f5c58176f90c474bb487ffc4d9e6f0d3633889669ee4e05f3436276df9412e036253e403f7db81045603b0d6e816d1a4f698feb19d2eb83682421df66c49bbde0ce6d67b65e28734c4241be4252ed5cd4a6f13f20df8dc1c5b0eeb15a785fc6658d87e96b245af29951b7ab4458b837e943d1a70b4b4e2bd41d2904256304d3da9bd33d940553ef4c913a306d05391267b7ab71c120d24d168c37e8e49af846791a06c148478bea66e0e8fccc8948971d7b16ee8afa3d6b29792e9f73283b439a0336d6e9ed149715703621762dc38cd002b8a175c6f947ae91fe380baf89664e69c4a97b418b70e8d5c6052ff8a586da27611a6da3de419f200017fca7b5a60ba98dde0014ce580333ff5ca21d9502d39ff59d55998f7ead1ec385b9070d6d1416c229ad431caf4e073a84222c1b960fe17cbda85656436a1ff91cc4e079f84488bfc02e9359b9501541171346b77143c1c5f46fafefa768de9885a116471a0376c3a8b97d095fa41e4f06f76f5e08fa97f3b9aa0bd308ad39378694159ae5be526eff896525729bc40aec3efd6eed3201a6af4fea4c4690d64bc91a6d9a60a5aa959bfea2d0f00631502d33a92a50b889f2baf6a638311e2390c8578ea8fb265a340ce7e69e3eb098265a5cddc8d49b0686ab475150fddbcf887fb18500f790ef46f330a7cc4920f930eab8d6cddec960b0f7c3b67031654a48f9970acbdd804dfd0578915a5ad6c2c46674bfbfd030cef49385939dd2461097f3677859dc2c8e53017da2a1f1273fa5798e4a422a1814307e2c13d41bb39da7e8187cde0bac61fa3500c8570a1fc608d522eda3311c95bc108bcb3f8bd60365483f3eba57ce9bd935843423aaefe7dae52311237e4d8c0c2c970782fca207942e9b0a4f952e38d73337621c1868e847a6070130e94e4d3d87d175e88d96bca471b1d9ba4fbc9f695d0d785d9988d2958e1c07ca6e0796eab57b8c6395a0f5e2aaa692708fde3f725ede5098d282d6ced5210fc5913ef80240573512735cda9c4cbe61b1a3706e441ab09b419d8e1500f684ea9768ae3c61081402f4e2d658e21484b01c47f9d021f93f4fa1d7114e471583e0a1e959973c87ffb5fc83d30461388faf0259d466a5de81992bb3437d320d202a0429dee52fc9c877e950832678b02917b19193dcbdabbfb884bcf07aa3d7e0be03b9320d7b68d8df09f62b1fde057dd894afdaaa73bc245a2442bfd5600765d4418df6c3392fcf14b2d1c8b36c93ec307e38940fb5ba70b4b7d103dc8cb75ab6a05f76aaf580898da6863862050c8780fa75710e0e6c1a2b2f38a3d7d4b8b8684bfd108294d90cfc1fc677205737a46321cde5ca3fa33384eb08b4effcda1a049a6a26d1f91c69b258460bba5c63eabbf484e3acf88ca57ca8ad3867c7db492d4fe3a5171e9305fde1d273d9df1a631e4b3c1343d860aae4f3fb14268515beae01d4d0eb8a189f7880c0faa2169ea42bdbc8438da3236e9df4ad1bfa5fbe1657849e5f5a11ec2fd1960683cbfce3922122951924d9607194c00a49b3103086f6f67af143d4816230e9ea0739743ae1ac9c83062f13f4fa3239e0b9ef8652c43ca9c47ecf3df850c22c6a5356c8c780beb06e1b49c5b7d17006da106d2dfbde2f5a964cc48ee1ce44cf6a6fabc5a43439c14dc071dff649e098c64d413828f92ab2160a2e1e9a385ab6053c092013f772c01999eab7180d30a70eae51067b48c8e16f59f2f6d6abb6818e0f481e97e5699ac8a3fe04307f85cbc12f536164641ba543d22134c9028d0a3e6adcd878b4047d0b830e742b0b639669a50968fb222d8d52d3fdf953ec0e7a94f1f6d02ba72e3edf1443496969384a0396c97737ad6abd1ac146cdfb5980115088b7461e1fc7fbf50da474c288706e241c83c180ce2a8ad0d17a2ded62657796622cc895e0a33def4a123c13d00307fb384e4ef71a8395f51b42b712aaf7b50de51b271502c7967d2a24adbe927b756fe88664e9f285e88e534b138e2ebac18900891e56138fc1ee730a704e995201bfe51283a66237f2f35b3cdab7d552d7c4e62b46b5018dda8dc07eea42f45d9d76da9d1085e73800b6ddd219862dc0016fc21ae5f3acc700767f0fac668a6288856b9b00794d85c91172997e8ebe250b0424345fe8e55f901751e08e4ef431c6ae163e9591e1ff018d8d17e780282b290e8afd400c5f44fb721c12a12cd8d7162e83edd0eb30429965b10e5fb31cc27f56bef22c62f3a2eea1c7b9d27277022e49b74f93904c6eaaa10c2b3779c06942e2fefb9e259f19679e14aadbd7d156618bbde8418643e1780edbd52adc8b51c3029d4eecf323f64bd982be6625b09ea5d10845d93d6d8765f6d83c11dc902882f83be46af70b141a02b22cab8423eec40b3d10b9a54d090ab231478bd27e833d08f8594d6452febbf8236e30d5ea0f3390b46c7e0bf2ab52595cfe773a0421c7f0cca364914498a71c00a289eaf7339a12ddef16c323065e4d3b0df17aab59cdf731303f34b20fd38a83528fc76f57ec59455c5d581397759b45707bc6a8ab3603b736528c03a1199b784530f5b1cf3ad760917889d440b3556413e84ce25a652577a285b654cb0b3c63b63edf38e783aea91f57917d98e5c1c3fb83d4008240982590c84794c97a2eaf815743dc56d2e7ec66f7c0532c6b3b9c0dfec7e64bea52818d14e9b582c18d51253f9315d55459cc15869a5de0110d1f50b9c0a6c1ee2e894f63f805687c729a4cff994dff4c9e7cfd65382296e5ec7de01a0eea9a85273705a69a488bf855c46e5a5cd6867e7556475168e8e7f3d63bda81dacda01c18abdb8181d288287c7d09bc09b67a90b076318d57162d26fa671431b7a5b9bd9b9bfc452952e4f5d157ac5b8bcdac18b20ab4d7a26ca4032fc65d0a641a461bd2848c125ee6ed24361930b26f24462111a1c8bc3ac50458f66d91cc5eb5b23ffcf245852450d5b73265107a73ae6ae0d1c1771bd33b1edd7dd5e245fd0544eca8e308083cf00eb037a251497805c73057d7bb21a9479657084697027f6f05655de52d7256054f9e884e3d39d79efc7a6e405278452b4ee7729bb1d85b55942c124cf978793c4c82d8c7f2c331c2d50aa67d1cdfb067b00a899ed2c6bf0290e24b9a1a2204528934f99658b7eb644c25420f788be97cc199d42aef4be6ad9a891cc4433a745e33c17695a20032797271245d8519ef08377e00b98fe64d323873cb94e128986c302fd927129854a66ac4faac54a192325d972618e37fda0e0ab5110c571929a0279d269df733f4744dd7cf3e0397050938468134916bb790eb37eeb4065900d26c205899f77cc49250c41deb0808a82bae22f240568b25cc7c62110201accde20fa860d064aab454f19d310440611bd466a9f5a71d18f2243ccbe88e2a48254b6131d04e778cb34ea9ddc5ee5db64796b8a4039b378a1c310422f110c508cd10368a4b29d9901143d942d632a48af512220d45d34ac6c4b4036d30364664737ae1deb90bf515a316d578ceb191db7631bdc5d006941f9d374e9fa7d02361416c3d4eeaf96a8360bb02f455324add97556f41e0c74f62a7f367a0fa73c17e1f5885a9194db828344c7fd6efc8f9194b2e511dadb9412183ee2b91fbff52efea1e2bb25c95"}, 0x1015, 0x2) pwrite64(r1, &(0x7f00000018c0)="d10094906583abc084698d32b5c48bf19a2132219cad1f425d6f2ef867886c", 0x1f, 0x0) ioctl$VIDIOC_QUERYCAP(r0, 0x80685600, &(0x7f0000001900)) ioctl$KVM_SET_ONE_REG(r1, 0x4010aeac, &(0x7f0000001980)={0x7, 0x4}) setsockopt$inet_sctp6_SCTP_PARTIAL_DELIVERY_POINT(r0, 0x84, 0x13, &(0x7f00000019c0)=0x8000, 0x4) setsockopt$inet6_group_source_req(r0, 0x29, 0x2f, &(0x7f0000001a00)={0x5c0dd4d7, {{0xa, 0x4e22, 0x6, @initdev={0xfe, 0x88, [], 0x1, 0x0}, 0xe1af}}, {{0xa, 0x4e21, 0x6, @local, 0x10}}}, 0x108) pwrite64(r3, &(0x7f0000001b40)="e7e0c5d046130e3f6cbe9ab1bcdffa49688d8f54b0e99cd2c5d9f4e814414eaac31ae4d7", 0x24, 0x0) [ 255.088444] IPVS: ftp: loaded support on port[0] = 21 [ 255.427124] chnl_net:caif_netlink_parms(): no params data found [ 255.520859] IPVS: ftp: loaded support on port[0] = 21 [ 256.175595] IPVS: ftp: loaded support on port[0] = 21 [ 256.334709] bridge0: port 1(bridge_slave_0) entered blocking state [ 256.357117] bridge0: port 1(bridge_slave_0) entered disabled state [ 256.368739] device bridge_slave_0 entered promiscuous mode [ 256.407039] chnl_net:caif_netlink_parms(): no params data found [ 256.443298] bridge0: port 2(bridge_slave_1) entered blocking state [ 256.469100] bridge0: port 2(bridge_slave_1) entered disabled state [ 256.480165] device bridge_slave_1 entered promiscuous mode [ 256.968348] bond0: Enslaving bond_slave_0 as an active interface with an up link [ 257.099742] bond0: Enslaving bond_slave_1 as an active interface with an up link [ 257.354651] chnl_net:caif_netlink_parms(): no params data found [ 257.427376] chnl_net:caif_netlink_parms(): no params data found [ 257.512005] bridge0: port 1(bridge_slave_0) entered blocking state [ 257.520238] bridge0: port 1(bridge_slave_0) entered disabled state [ 257.527878] device bridge_slave_0 entered promiscuous mode [ 257.553485] IPv6: ADDRCONF(NETDEV_UP): team_slave_0: link is not ready [ 257.579580] team0: Port device team_slave_0 added [ 257.707088] bridge0: port 2(bridge_slave_1) entered blocking state [ 257.723220] bridge0: port 2(bridge_slave_1) entered disabled state [ 257.731246] device bridge_slave_1 entered promiscuous mode [ 257.737994] IPv6: ADDRCONF(NETDEV_UP): team_slave_1: link is not ready [ 257.752946] team0: Port device team_slave_1 added [ 257.760739] chnl_net:caif_netlink_parms(): no params data found [ 257.897438] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_0: link is not ready [ 258.155905] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_1: link is not ready [ 258.379892] bond0: Enslaving bond_slave_0 as an active interface with an up link [ 258.500888] bridge0: port 1(bridge_slave_0) entered blocking state [ 258.507348] bridge0: port 1(bridge_slave_0) entered disabled state [ 258.516002] device bridge_slave_0 entered promiscuous mode [ 258.559523] bond0: Enslaving bond_slave_1 as an active interface with an up link [ 258.623169] bridge0: port 2(bridge_slave_1) entered blocking state [ 258.653842] bridge0: port 2(bridge_slave_1) entered disabled state [ 258.679152] device bridge_slave_1 entered promiscuous mode [ 258.737389] bridge0: port 1(bridge_slave_0) entered blocking state [ 258.745140] bridge0: port 1(bridge_slave_0) entered disabled state [ 258.756861] device bridge_slave_0 entered promiscuous mode [ 258.766157] bridge0: port 1(bridge_slave_0) entered blocking state [ 258.776793] bridge0: port 1(bridge_slave_0) entered disabled state [ 258.785830] device bridge_slave_0 entered promiscuous mode [ 258.798042] IPv6: ADDRCONF(NETDEV_UP): hsr_slave_0: link is not ready [ 258.832063] chnl_net:caif_netlink_parms(): no params data found [ 258.857048] bridge0: port 2(bridge_slave_1) entered blocking state [ 258.891521] bridge0: port 2(bridge_slave_1) entered disabled state [ 258.904316] device bridge_slave_1 entered promiscuous mode [ 258.950347] bridge0: port 2(bridge_slave_1) entered blocking state [ 258.956781] bridge0: port 2(bridge_slave_1) entered disabled state [ 258.966719] device bridge_slave_1 entered promiscuous mode [ 258.982181] IPv6: ADDRCONF(NETDEV_UP): hsr_slave_1: link is not ready [ 259.043586] IPv6: ADDRCONF(NETDEV_UP): team_slave_0: link is not ready [ 259.086790] team0: Port device team_slave_0 added [ 259.224322] bond0: Enslaving bond_slave_0 as an active interface with an up link [ 259.281501] IPv6: ADDRCONF(NETDEV_UP): team_slave_1: link is not ready [ 259.302807] team0: Port device team_slave_1 added [ 259.351293] bond0: Enslaving bond_slave_1 as an active interface with an up link [ 259.407315] bond0: Enslaving bond_slave_0 as an active interface with an up link [ 259.457057] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_0: link is not ready [ 259.514471] bond0: Enslaving bond_slave_0 as an active interface with an up link [ 259.642494] bond0: Enslaving bond_slave_1 as an active interface with an up link [ 259.661408] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_1: link is not ready [ 259.670445] bond0: Enslaving bond_slave_1 as an active interface with an up link [ 259.833526] IPv6: ADDRCONF(NETDEV_UP): team_slave_0: link is not ready [ 259.858048] team0: Port device team_slave_0 added [ 260.018693] IPv6: ADDRCONF(NETDEV_UP): team_slave_1: link is not ready [ 260.032907] team0: Port device team_slave_1 added [ 260.044374] IPv6: ADDRCONF(NETDEV_UP): team_slave_0: link is not ready [ 260.067052] team0: Port device team_slave_0 added [ 260.075830] bridge0: port 1(bridge_slave_0) entered blocking state [ 260.099265] bridge0: port 1(bridge_slave_0) entered disabled state [ 260.117956] device bridge_slave_0 entered promiscuous mode [ 260.172754] IPv6: ADDRCONF(NETDEV_UP): hsr_slave_0: link is not ready [ 260.184094] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_0: link is not ready [ 260.199938] IPv6: ADDRCONF(NETDEV_UP): team_slave_1: link is not ready [ 260.207445] team0: Port device team_slave_1 added [ 260.246183] bridge0: port 2(bridge_slave_1) entered blocking state [ 260.255042] bridge0: port 2(bridge_slave_1) entered disabled state [ 260.286247] device bridge_slave_1 entered promiscuous mode [ 260.312958] IPv6: ADDRCONF(NETDEV_UP): hsr_slave_1: link is not ready [ 260.326433] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_1: link is not ready [ 260.347704] IPv6: ADDRCONF(NETDEV_UP): team_slave_0: link is not ready [ 260.369943] team0: Port device team_slave_0 added [ 260.381911] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_0: link is not ready [ 260.532988] IPv6: ADDRCONF(NETDEV_UP): team_slave_1: link is not ready [ 260.556998] team0: Port device team_slave_1 added [ 260.568293] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_1: link is not ready [ 260.689905] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_0: link is not ready [ 260.735625] bond0: Enslaving bond_slave_0 as an active interface with an up link [ 260.847319] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_1: link is not ready [ 260.877335] bond0: Enslaving bond_slave_1 as an active interface with an up link [ 260.901723] IPv6: ADDRCONF(NETDEV_UP): bridge0: link is not ready [ 261.083147] IPv6: ADDRCONF(NETDEV_UP): hsr_slave_0: link is not ready [ 261.238277] IPv6: ADDRCONF(NETDEV_UP): hsr_slave_1: link is not ready [ 261.285273] IPv6: ADDRCONF(NETDEV_UP): hsr_slave_0: link is not ready [ 261.355966] IPv6: ADDRCONF(NETDEV_UP): hsr_slave_0: link is not ready [ 261.392476] IPv6: ADDRCONF(NETDEV_UP): team_slave_0: link is not ready [ 261.406004] team0: Port device team_slave_0 added [ 261.422496] IPv6: ADDRCONF(NETDEV_UP): hsr_slave_1: link is not ready [ 261.528210] IPv6: ADDRCONF(NETDEV_UP): team_slave_1: link is not ready [ 261.554302] team0: Port device team_slave_1 added [ 261.581119] IPv6: ADDRCONF(NETDEV_UP): hsr_slave_1: link is not ready [ 261.680838] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_0: link is not ready [ 261.749123] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_1: link is not ready [ 261.942936] IPv6: ADDRCONF(NETDEV_UP): bridge0: link is not ready [ 262.396866] IPv6: ADDRCONF(NETDEV_UP): hsr_slave_0: link is not ready [ 262.596601] IPv6: ADDRCONF(NETDEV_UP): hsr_slave_1: link is not ready [ 263.021725] IPv6: ADDRCONF(NETDEV_UP): bridge0: link is not ready [ 263.059356] IPv6: ADDRCONF(NETDEV_UP): bridge0: link is not ready [ 263.381605] IPv6: ADDRCONF(NETDEV_UP): bridge0: link is not ready [ 264.212914] IPv6: ADDRCONF(NETDEV_UP): bridge0: link is not ready [ 266.910368] 8021q: adding VLAN 0 to HW filter on device bond0 [ 267.403729] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready [ 267.908061] IPv6: ADDRCONF(NETDEV_UP): veth1: link is not ready [ 267.927329] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 267.950925] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 268.095964] 8021q: adding VLAN 0 to HW filter on device bond0 [ 268.510416] IPv6: ADDRCONF(NETDEV_UP): team0: link is not ready [ 268.516543] 8021q: adding VLAN 0 to HW filter on device team0 [ 268.625544] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready [ 269.061283] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bridge: link is not ready [ 269.069148] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 269.077056] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 269.094414] bridge0: port 1(bridge_slave_0) entered blocking state [ 269.100943] bridge0: port 1(bridge_slave_0) entered forwarding state [ 269.119717] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 269.162128] 8021q: adding VLAN 0 to HW filter on device bond0 [ 269.170074] 8021q: adding VLAN 0 to HW filter on device bond0 [ 269.350317] IPv6: ADDRCONF(NETDEV_UP): veth1: link is not ready [ 269.356487] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 269.375216] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 269.462332] 8021q: adding VLAN 0 to HW filter on device bond0 [ 269.606090] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bridge: link is not ready [ 269.614940] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 269.625460] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 269.638459] bridge0: port 2(bridge_slave_1) entered blocking state [ 269.644868] bridge0: port 2(bridge_slave_1) entered forwarding state [ 269.669069] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready [ 269.825725] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready [ 269.971004] IPv6: ADDRCONF(NETDEV_UP): team0: link is not ready [ 269.977111] 8021q: adding VLAN 0 to HW filter on device team0 [ 270.045533] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready [ 270.197254] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bond: link is not ready [ 270.204285] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 270.240486] IPv6: ADDRCONF(NETDEV_UP): veth1: link is not ready [ 270.250758] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 270.259336] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 270.348344] 8021q: adding VLAN 0 to HW filter on device bond0 [ 270.440325] IPv6: ADDRCONF(NETDEV_UP): veth1: link is not ready [ 270.446487] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 270.459463] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 270.520319] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bridge: link is not ready [ 270.543628] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 270.554532] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 270.574543] bridge0: port 1(bridge_slave_0) entered blocking state [ 270.580979] bridge0: port 1(bridge_slave_0) entered forwarding state [ 270.617647] IPv6: ADDRCONF(NETDEV_UP): veth1: link is not ready [ 270.649285] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 270.656638] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 270.689183] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 270.945366] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bond: link is not ready [ 270.952980] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 270.976920] IPv6: ADDRCONF(NETDEV_UP): team0: link is not ready [ 271.005461] 8021q: adding VLAN 0 to HW filter on device team0 [ 271.026555] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready [ 271.063506] IPv6: ADDRCONF(NETDEV_UP): team0: link is not ready [ 271.089316] 8021q: adding VLAN 0 to HW filter on device team0 [ 271.198093] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bridge: link is not ready [ 271.212355] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 271.227995] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 271.242943] bridge0: port 2(bridge_slave_1) entered blocking state [ 271.249342] bridge0: port 2(bridge_slave_1) entered forwarding state [ 271.272064] IPv6: ADDRCONF(NETDEV_UP): team0: link is not ready [ 271.279369] 8021q: adding VLAN 0 to HW filter on device team0 [ 271.516858] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bridge: link is not ready [ 271.534730] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 271.556006] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 271.584771] bridge0: port 1(bridge_slave_0) entered blocking state [ 271.591205] bridge0: port 1(bridge_slave_0) entered forwarding state [ 271.626899] IPv6: ADDRCONF(NETDEV_UP): veth0_to_team: link is not ready [ 271.642653] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bridge: link is not ready [ 271.664535] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 271.672234] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 271.688270] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 271.696996] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 271.715353] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 271.727790] bridge0: port 1(bridge_slave_0) entered blocking state [ 271.734236] bridge0: port 1(bridge_slave_0) entered forwarding state [ 271.769601] IPv6: ADDRCONF(NETDEV_UP): veth1: link is not ready [ 271.777592] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 271.809367] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 271.816553] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 271.838531] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 271.877340] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bridge: link is not ready [ 271.910094] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bond: link is not ready [ 271.917025] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 271.949252] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 271.984827] bridge0: port 1(bridge_slave_0) entered blocking state [ 271.991249] bridge0: port 1(bridge_slave_0) entered forwarding state [ 272.005136] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 272.013550] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 272.166625] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bridge: link is not ready [ 272.197560] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 272.229138] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 272.236865] bridge0: port 2(bridge_slave_1) entered blocking state [ 272.243285] bridge0: port 2(bridge_slave_1) entered forwarding state [ 272.273422] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bridge: link is not ready [ 272.305122] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 272.326047] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 272.345812] bridge0: port 2(bridge_slave_1) entered blocking state [ 272.352249] bridge0: port 2(bridge_slave_1) entered forwarding state [ 272.361444] IPv6: ADDRCONF(NETDEV_UP): team0: link is not ready [ 272.367531] 8021q: adding VLAN 0 to HW filter on device team0 [ 272.511209] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bond: link is not ready [ 272.518075] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 272.551002] IPv6: ADDRCONF(NETDEV_UP): veth1_to_team: link is not ready [ 272.558120] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 272.581192] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 272.604830] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bridge: link is not ready [ 272.645235] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 272.655173] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 272.679449] bridge0: port 2(bridge_slave_1) entered blocking state [ 272.685806] bridge0: port 2(bridge_slave_1) entered forwarding state [ 272.709803] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bond: link is not ready [ 272.718975] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 272.870190] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bond: link is not ready [ 272.877080] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 273.066850] IPv6: ADDRCONF(NETDEV_UP): veth0_to_team: link is not ready [ 273.078427] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 273.094602] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 273.119904] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 273.143891] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bridge: link is not ready [ 273.154795] IPv6: ADDRCONF(NETDEV_UP): veth0_to_hsr: link is not ready [ 273.168673] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 273.176624] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 273.192747] bridge0: port 1(bridge_slave_0) entered blocking state [ 273.199166] bridge0: port 1(bridge_slave_0) entered forwarding state [ 273.218973] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 273.226711] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 273.257411] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 273.424052] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bond: link is not ready [ 273.431611] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 273.472790] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bond: link is not ready [ 273.515491] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 273.534840] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bond: link is not ready [ 273.551059] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 273.609247] IPv6: ADDRCONF(NETDEV_UP): veth1_to_team: link is not ready [ 273.616109] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 273.640232] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 273.723268] IPv6: ADDRCONF(NETDEV_UP): veth1_to_hsr: link is not ready [ 273.743713] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 273.759896] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 273.790074] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bridge: link is not ready [ 273.799223] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 273.807089] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 273.847978] bridge0: port 2(bridge_slave_1) entered blocking state [ 273.854392] bridge0: port 2(bridge_slave_1) entered forwarding state [ 274.034075] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bond: link is not ready [ 274.072939] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 274.147083] IPv6: ADDRCONF(NETDEV_UP): veth0_to_team: link is not ready [ 274.165871] IPv6: ADDRCONF(NETDEV_UP): veth0_to_hsr: link is not ready [ 274.175504] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 274.197979] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 274.239514] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 274.247207] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 274.274362] IPv6: ADDRCONF(NETDEV_UP): veth0_to_team: link is not ready [ 274.290927] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 274.298141] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 274.340917] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 274.373102] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 274.480643] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bond: link is not ready [ 274.487502] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 274.659444] IPv6: ADDRCONF(NETDEV_UP): veth1_to_team: link is not ready [ 274.666329] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 274.679745] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 274.691298] IPv6: ADDRCONF(NETDEV_UP): veth1_to_hsr: link is not ready [ 274.699340] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 274.715122] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 274.779713] IPv6: ADDRCONF(NETDEV_UP): veth0_to_team: link is not ready [ 274.786588] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 274.809710] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 274.817728] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 274.905240] IPv6: ADDRCONF(NETDEV_UP): veth1_to_team: link is not ready [ 274.915906] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 274.936957] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 275.084824] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bond: link is not ready [ 275.099505] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 275.246769] IPv6: ADDRCONF(NETDEV_UP): veth0_to_hsr: link is not ready [ 275.268798] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 275.276585] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 275.459926] IPv6: ADDRCONF(NETDEV_UP): veth1_to_team: link is not ready [ 275.466885] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 275.490557] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 275.543877] IPv6: ADDRCONF(NETDEV_UP): veth0_to_hsr: link is not ready [ 275.558413] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 275.568199] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 275.746461] IPv6: ADDRCONF(NETDEV_UP): veth0_to_team: link is not ready [ 275.784165] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 275.799569] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 275.817428] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 275.977920] IPv6: ADDRCONF(NETDEV_UP): veth1_to_hsr: link is not ready [ 275.994170] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 276.005470] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 276.116335] IPv6: ADDRCONF(NETDEV_UP): veth1_to_hsr: link is not ready [ 276.125775] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 276.141362] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 276.184934] IPv6: ADDRCONF(NETDEV_UP): veth0_to_hsr: link is not ready [ 276.198186] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 276.229228] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 276.472482] IPv6: ADDRCONF(NETDEV_UP): veth1_to_team: link is not ready [ 276.483783] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 276.504080] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 276.917678] IPv6: ADDRCONF(NETDEV_UP): veth1_to_hsr: link is not ready [ 276.937796] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 276.946882] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 276.978357] IPv6: ADDRCONF(NETDEV_UP): veth0_to_hsr: link is not ready [ 276.989453] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 276.997148] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 277.156426] IPv6: ADDRCONF(NETDEV_UP): vxcan1: link is not ready [ 277.588388] IPv6: ADDRCONF(NETDEV_UP): veth1_to_hsr: link is not ready [ 277.613021] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 277.649676] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 278.173335] IPv6: ADDRCONF(NETDEV_UP): vxcan1: link is not ready [ 278.313661] 8021q: adding VLAN 0 to HW filter on device batadv0 13:28:39 executing program 0: syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x802) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x4c, 0x0, &(0x7f0000000100)=[@transaction_sg={0x40486311, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x1, 0x0, &(0x7f0000000180)='0'}) 13:28:39 executing program 0: [ 279.286967] binder: 10363:10365 transaction failed 29189/-22, size 0-0 line 2896 [ 279.297588] binder: 10363:10368 transaction failed 29189/-22, size 0-0 line 2896 [ 279.338831] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 279.348802] IPv6: ADDRCONF(NETDEV_UP): vxcan1: link is not ready [ 279.377068] IPv6: ADDRCONF(NETDEV_UP): vxcan1: link is not ready 13:28:39 executing program 0: 13:28:39 executing program 0: 13:28:39 executing program 0: 13:28:39 executing program 0: 13:28:39 executing program 0: 13:28:40 executing program 1: [ 280.417136] IPv6: ADDRCONF(NETDEV_UP): vxcan1: link is not ready [ 280.506218] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 280.595666] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 280.832386] IPv6: ADDRCONF(NETDEV_UP): vxcan1: link is not ready 13:28:41 executing program 2: [ 281.204851] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 281.487143] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 281.699722] Unknown ioctl 1075332591 [ 281.703916] Unknown ioctl 35094 [ 281.707609] Unknown ioctl 28675 [ 281.711745] Unknown ioctl 43783 [ 281.715638] Unknown ioctl 35147 [ 281.720996] Unknown ioctl 43783 [ 281.725477] Unknown ioctl 1075359458 [ 281.730204] Unknown ioctl -2140645888 [ 281.735307] Unknown ioctl 1075332591 [ 281.741982] Unknown ioctl 35094 [ 281.745455] Unknown ioctl 28675 [ 281.746982] Unknown ioctl 43783 [ 281.753095] Unknown ioctl 35147 [ 281.753127] Unknown ioctl 43783 [ 281.763221] Unknown ioctl 1075359458 [ 281.767166] Unknown ioctl -2140645888 13:28:42 executing program 3: 13:28:42 executing program 0: 13:28:42 executing program 1: 13:28:42 executing program 2: 13:28:42 executing program 4: 13:28:42 executing program 5: 13:28:42 executing program 4: 13:28:42 executing program 5: 13:28:42 executing program 1: 13:28:42 executing program 0: 13:28:42 executing program 2: 13:28:42 executing program 3: 13:28:42 executing program 0: 13:28:42 executing program 5: 13:28:42 executing program 1: 13:28:42 executing program 2: 13:28:42 executing program 4: 13:28:42 executing program 3: 13:28:42 executing program 5: 13:28:42 executing program 1: 13:28:42 executing program 0: 13:28:42 executing program 2: 13:28:42 executing program 4: 13:28:43 executing program 0: 13:28:43 executing program 5: 13:28:43 executing program 3: 13:28:43 executing program 1: 13:28:43 executing program 4: 13:28:43 executing program 2: 13:28:43 executing program 1: 13:28:43 executing program 0: 13:28:43 executing program 3: 13:28:43 executing program 5: 13:28:43 executing program 4: 13:28:43 executing program 1: 13:28:43 executing program 0: 13:28:43 executing program 2: 13:28:43 executing program 3: 13:28:43 executing program 4: 13:28:43 executing program 5: 13:28:43 executing program 1: 13:28:43 executing program 0: 13:28:43 executing program 2: 13:28:43 executing program 5: 13:28:43 executing program 3: 13:28:43 executing program 4: 13:28:43 executing program 0: 13:28:43 executing program 1: 13:28:43 executing program 2: 13:28:43 executing program 5: 13:28:43 executing program 3: 13:28:43 executing program 4: 13:28:43 executing program 0: 13:28:43 executing program 1: 13:28:44 executing program 2: 13:28:44 executing program 4: 13:28:44 executing program 3: 13:28:44 executing program 5: 13:28:44 executing program 0: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(r0, 0x540b, 0x2) 13:28:44 executing program 1: r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_HEAP_QUERY(r0, 0xc0184908, &(0x7f0000000180)={0x34, 0x0, &(0x7f0000000140)}) 13:28:44 executing program 2: clock_getres(0x80400000000008, 0x0) 13:28:44 executing program 4: 13:28:44 executing program 3: 13:28:44 executing program 5: 13:28:44 executing program 0: 13:28:44 executing program 1: ioctl$sock_SIOCGIFCONF(0xffffffffffffffff, 0x8912, &(0x7f0000000100)=@req={0x28, &(0x7f0000000040)={'team0\x00', @ifru_settings={0x0, 0x0, @fr_pvc_info=0x0}}}) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ptmx\x00', 0x0, 0x0) readv(r0, &(0x7f00000000c0)=[{&(0x7f0000000200)=""/255, 0x443}], 0x140) ioctl$TCSETS(r0, 0x40045431, &(0x7f00003b9fdc)) r1 = syz_open_pts(r0, 0x2) dup3(r1, r0, 0x0) write(r0, &(0x7f0000c34fff), 0x1000002c1) 13:28:44 executing program 2: perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f0000000180)=""/148, 0x94}], 0x33e, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000140)='oom_score_adj\x00') preadv(r0, &(0x7f0000000480), 0x1000000000000268, 0x0) 13:28:44 executing program 4: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00003b9fdc)) perf_event_open(&(0x7f0000000500)={0x2, 0x70, 0x71, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_open_pts(r0, 0x0) 13:28:44 executing program 5: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00003b9fdc)) perf_event_open(&(0x7f0000000500)={0x2, 0x70, 0x71, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_open_pts(r0, 0x101) 13:28:44 executing program 0: r0 = perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f0000000180)=""/148, 0x94}], 0x33e, 0x0) preadv(r0, 0x0, 0x0, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000100)='cmdline\x00') preadv(r1, &(0x7f0000000480), 0x1000000000000268, 0x0) 13:28:44 executing program 3: clone(0x7ff, 0x0, 0xfffffffffffffffe, 0xfffffffffffffffe, 0xffffffffffffffff) socket$netlink(0x10, 0x3, 0xe) 13:28:44 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00003b9fdc)) r1 = syz_open_pts(r0, 0x0) dup3(r1, r0, 0x0) readv(r0, &(0x7f00000001c0)=[{&(0x7f00000000c0)=""/32, 0x20}], 0x1) 13:28:44 executing program 1: perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f0000000180)=""/148, 0x94}], 0x33e, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000100)='cmdline\x00') preadv(r0, &(0x7f0000000480), 0x1000000000000268, 0x6cefff7f) [ 284.518861] hrtimer: interrupt took 29597 ns 13:28:44 executing program 3: perf_event_open(&(0x7f0000000500)={0x2, 0x70, 0x71, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_open_procfs(0xffffffffffffffff, &(0x7f00000000c0)='attr/fscreate\x00') 13:28:44 executing program 4: perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f0000000180)=""/148, 0x94}], 0x33e, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000100)='cmdline\x00') preadv(r0, &(0x7f0000000480), 0x1000000000000268, 0x0) 13:28:44 executing program 5: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ptmx\x00', 0x0, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) perf_event_open(&(0x7f0000000500)={0x2, 0x70, 0x71, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$TCGETA(r0, 0x5405, &(0x7f0000000040)) 13:28:44 executing program 2: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = openat$ion(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_HEAP_QUERY(r1, 0xc0184908, 0x0) 13:28:44 executing program 1: perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f0000000180)=""/148, 0x94}], 0x33e, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000100)='cmdline\x00') preadv(r0, &(0x7f0000000480), 0x1000000000000268, 0x6cefff7f) 13:28:44 executing program 0: pipe(&(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) epoll_create(0x0) dup3(r1, r0, 0x0) pipe(&(0x7f0000000400)={0xffffffffffffffff, 0xffffffffffffffff}) epoll_create1(0x0) write(r3, &(0x7f0000000340), 0x10000014c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) clock_gettime(0x0, &(0x7f0000000040)={0x0, 0x0}) pselect6(0x40, &(0x7f00000000c0), 0x0, &(0x7f0000000140)={0x1b7}, &(0x7f0000000200)={0x0, r4+30000000}, 0x0) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0) clock_getres(0x0, 0x0) 13:28:44 executing program 3: preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f0000000180)=""/148, 0x94}], 0x33e, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000300)='net/unix\x00') preadv(r0, &(0x7f0000000480), 0x1000000000000268, 0x6cefff7f) 13:28:44 executing program 5: pipe(&(0x7f0000000080)) pipe(&(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) dup3(r1, r0, 0x0) pipe(&(0x7f0000000400)={0xffffffffffffffff, 0xffffffffffffffff}) write(r3, &(0x7f0000000340), 0x10000014c) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clock_gettime(0x0, &(0x7f0000000040)={0x0, 0x0}) pselect6(0x40, &(0x7f00000000c0), 0x0, &(0x7f0000000140)={0x1b7}, &(0x7f0000000200)={0x0, r4+30000000}, 0x0) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) 13:28:44 executing program 2: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) perf_event_open(&(0x7f0000000500)={0x0, 0x70, 0x71, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000001, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x9) openat$ion(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ion\x00', 0x80000, 0x0) 13:28:45 executing program 1: pipe(&(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) epoll_create(0x0) dup3(r1, r0, 0x0) pipe(&(0x7f0000000400)={0xffffffffffffffff, 0xffffffffffffffff}) epoll_create1(0x0) write(r3, &(0x7f0000000340), 0x10000014c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clock_gettime(0x0, &(0x7f0000000040)={0x0, 0x0}) ioctl$TIOCGSID(0xffffffffffffffff, 0x5429, 0x0) pselect6(0x40, &(0x7f00000000c0), 0x0, &(0x7f0000000140)={0x1b7}, &(0x7f0000000200)={0x0, r4+30000000}, 0x0) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) 13:28:45 executing program 4: perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f0000000180)=""/148, 0x94}], 0x33e, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000100)='cmdline\x00') preadv(r0, &(0x7f0000000480), 0x1000000000000268, 0x0) 13:28:45 executing program 3: syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x4, 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) 13:28:45 executing program 2: perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_open_procfs(0x0, &(0x7f00000003c0)='coredump_filter\x00') preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f0000000180)=""/148, 0x94}], 0x33e, 0x0) syz_genetlink_get_family_id$tipc2(0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000100)='net/dev_mcast\x00') preadv(r0, &(0x7f0000000480), 0x1000000000000268, 0x6cefff7f) 13:28:45 executing program 4: syz_open_dev$binder(&(0x7f0000008ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x4, 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) [ 285.189564] binder: 10778:10781 Acquire 1 refcount change on invalid ref 0 ret -22 [ 285.245929] binder: 10778:10785 Acquire 1 refcount change on invalid ref 0 ret -22 13:28:45 executing program 3: preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f0000000180)=""/148, 0x94}], 0x33e, 0x0) r0 = syz_open_procfs(0x0, &(0x7f00000000c0)='mountstats\x00') preadv(r0, &(0x7f0000000480), 0x1000000000000268, 0x6cefff7f) [ 285.294235] binder: 10786:10789 Acquire 1 refcount change on invalid ref 0 ret -22 [ 285.323038] binder: 10786:10790 Acquire 1 refcount change on invalid ref 0 ret -22 13:28:45 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000500)={0x2, 0x70, 0x71, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$TIOCGPGRP(r0, 0x540f, &(0x7f0000000040)) 13:28:45 executing program 4: perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) write$P9_RWSTAT(0xffffffffffffffff, 0x0, 0x0) syz_open_procfs(0x0, &(0x7f0000000180)='stat\x00') preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f0000000180)=""/148, 0x94}], 0x33e, 0x0) fcntl$getown(0xffffffffffffffff, 0x9) r0 = syz_open_procfs(0x0, 0x0) preadv(r0, &(0x7f0000000480), 0x1000000000000268, 0x6cefff7f) 13:28:45 executing program 3: preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f0000000180)=""/148, 0x94}], 0x33e, 0x0) r0 = syz_open_procfs(0x0, &(0x7f00000000c0)='mountstats\x00') preadv(r0, &(0x7f0000000480), 0x1000000000000268, 0x6cefff7f) 13:28:45 executing program 2: perf_event_open(&(0x7f0000000500)={0x2, 0x70, 0x71, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x4000, 0x0) 13:28:45 executing program 5: preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f0000000180)=""/148, 0x94}], 0x33e, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000100)='cmdline\x00') preadv(r0, &(0x7f0000000480), 0x1000000000000268, 0x6cefff7f) 13:28:45 executing program 0: preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f0000000180)=""/148, 0x94}], 0x33e, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000100)='net/dev_mcast\x00') socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) preadv(r0, &(0x7f0000000480), 0x1000000000000268, 0x6cefff7f) 13:28:45 executing program 4: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) read$eventfd(r1, &(0x7f0000000040), 0x8) ioctl$TIOCGLCKTRMIOS(r0, 0x5437, 0x0) 13:28:45 executing program 1: pipe(&(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) epoll_create(0x0) dup3(r1, r0, 0x0) pipe(&(0x7f0000000400)={0xffffffffffffffff, 0xffffffffffffffff}) epoll_create1(0x0) write(r3, &(0x7f0000000340), 0x10000014c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clock_gettime(0x0, &(0x7f0000000040)={0x0, 0x0}) ioctl$TIOCGSID(0xffffffffffffffff, 0x5429, 0x0) pselect6(0x40, &(0x7f00000000c0), 0x0, &(0x7f0000000140)={0x1b7}, &(0x7f0000000200)={0x0, r4+30000000}, 0x0) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) 13:28:45 executing program 3: syz_open_dev$binder(&(0x7f0000008ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x4, 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000c6dfd0)={0x8, 0x0, &(0x7f0000dd0000)=[@acquire={0x40046307}], 0x0, 0x0, 0x0}) 13:28:45 executing program 2: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000140)) r0 = syz_open_procfs(0x0, &(0x7f00000000c0)='comm\x00') writev(r0, &(0x7f0000000080), 0x100000000000028d) [ 285.880139] binder: 10819:10820 Acquire 1 refcount change on invalid ref 0 ret -22 13:28:45 executing program 5: r0 = socket$inet(0x2, 0x4000000000000001, 0x0) syncfs(r0) setsockopt$inet_tcp_int(r0, 0x6, 0x80000000000002, &(0x7f0000000300)=0x72, 0x197) bind$inet(r0, &(0x7f0000000180)={0x2, 0x4e23, @multicast1}, 0xfffffffffffffd58) setsockopt$SO_ATTACH_FILTER(r0, 0x1, 0x1a, &(0x7f0000b86000)={0x1, &(0x7f0000f40ff8)=[{0x6, 0x0, 0x0, 0xe8}]}, 0x10) sendto$inet(r0, 0x0, 0x0, 0x200007fd, &(0x7f0000e68000)={0x2, 0x4e23, @local}, 0x10) setsockopt$sock_int(r0, 0x1, 0x2f, &(0x7f0000000040), 0x4) clone(0x2102001fff, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socket(0xa, 0x0, 0x0) r1 = open(&(0x7f000000fffa)='./bus\x00', 0x141042, 0x0) close(r1) r2 = syz_open_dev$loop(&(0x7f0000ca9ff5)='/dev/loop#\x00', 0x0, 0x105082) r3 = memfd_create(&(0x7f0000000140)='\x00\x00\x00\x00\x8c\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00', 0x0) pwritev(r3, &(0x7f0000000080)=[{&(0x7f00000000c0)="a8", 0x1}], 0x1, 0x81003) ioctl$LOOP_CHANGE_FD(r2, 0x4c00, r3) mmap(&(0x7f0000002000/0x2000)=nil, 0x2000, 0x800002, 0x11, r1, 0x0) socketpair$unix(0x1, 0x0, 0x0, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x40000000000040) ppoll(0x0, 0x0, 0x0, 0x0, 0x0) fcntl$setstatus(r1, 0x4, 0x0) pipe(&(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) write(r5, &(0x7f00000001c0), 0x526987c9) read(r4, &(0x7f0000000200)=""/250, 0x50c7e3e3) sendfile(r2, r3, 0x0, 0x80003) r6 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000040)='environ\x00') ioctl$sock_SIOCGIFBR(r6, 0x8940, &(0x7f00000000c0)=@add_del={0x2, &(0x7f0000000000)='ipddp0\x00', 0x4}) ioctl$VT_WAITACTIVE(r3, 0x5607) ioctl$VT_WAITACTIVE(r5, 0x5607) openat$null(0xffffffffffffff9c, &(0x7f0000000080)='/dev/null\x00', 0x48a880, 0x0) exit(0x8002) 13:28:46 executing program 0: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000100)='./cgroup.cpu\x00', 0x200002, 0x0) fchdir(r1) r2 = open(&(0x7f0000000040)='./bus\x00', 0x4000, 0x0) pread64(r2, &(0x7f0000005000)=""/4096, 0xffffffc7, 0x0) [ 285.926207] binder: 10819:10820 DecRefs 0 refcount change on invalid ref 0 ret -22 [ 285.959123] binder: 10819:10834 Acquire 1 refcount change on invalid ref 0 ret -22 13:28:46 executing program 2: r0 = socket$inet6(0xa, 0x80002, 0x0) connect$inet6(r0, &(0x7f00000000c0), 0x1c) r1 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r1, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000bfff0)={&(0x7f0000006440)=@updpolicy={0xb8, 0x19, 0x1, 0x0, 0x0, {{@in6=@mcast1, @in=@multicast1, 0x0, 0x0, 0x0, 0x0, 0xa}}}, 0xb8}}, 0x0) r2 = dup3(r0, r1, 0x0) write$P9_RREADDIR(r2, 0x0, 0x0) 13:28:46 executing program 4: sendmsg$key(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000000)={0x0}}, 0x0) sendmsg$key(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000200)=ANY=[@ANYBLOB="020f00001000000000000000000000000800120000000100000000000000000006000000010000000000000000000200e00040010000000000000000000010000000ada8008004000000200000000000030006000000000002000080ac14ff9af0000e000000000003000500000000000200423b1d632bd7b8200000000000c7"], 0x80}}, 0x0) r0 = socket$key(0xf, 0x3, 0x2) sendmmsg(r0, &(0x7f0000000180), 0x8001, 0x0) 13:28:46 executing program 3: socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_int(r1, 0x107, 0xf, &(0x7f0000000040)=0x100, 0xff1f) sendto$inet6(r1, &(0x7f0000000080)="02030000070000005b000000fff55b4202938207d9fb3780398d5375000060007929301ee616d5c01843e06590080053c0e385472da7222a2bb42f2d1594c3b50035110f118d0000f55dc62600009b000000faffffff00010000aeb46245004bae1356642490a7b5fc88046a", 0x6c, 0x0, 0x0, 0x0) 13:28:46 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0a5c1f023c120085719070") r1 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r1, &(0x7f0000deb000)={0x2, 0x4e23, @broadcast}, 0x10) setsockopt$inet_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f00000000c0)='dctcp\x00', 0x6) recvmmsg(r1, &(0x7f0000000480)=[{{&(0x7f0000000040)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @loopback}}}, 0x80, 0x0, 0x0, &(0x7f0000000600)=""/90, 0x5a}}], 0x1, 0x1, 0x0) sendto$inet(r1, 0x0, 0x0, 0x400200007fd, &(0x7f0000000000)={0x2, 0x4e23, @local}, 0x10) write$binfmt_elf64(r1, &(0x7f00000016c0)=ANY=[@ANYPTR=&(0x7f00000005c0)=ANY=[@ANYPTR=&(0x7f00000004c0)=ANY=[@ANYRES16], @ANYRES32, @ANYRES64=0x0, @ANYPTR=&(0x7f0000000580)=ANY=[@ANYPTR64, @ANYRESHEX, @ANYPTR64, @ANYRES32=0x0]], @ANYRESDEC, @ANYRES16], 0x120001644) recvmsg(r1, &(0x7f0000000240)={&(0x7f0000000740)=@nfc, 0x80, &(0x7f00000001c0)=[{&(0x7f0000003ac0)=""/4096, 0x20013a5a}], 0x1, &(0x7f0000000200)=""/20, 0x8034}, 0x100) syz_init_net_socket$x25(0x9, 0x5, 0x0) 13:28:46 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0a5c1f023c126285719070") bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x3, 0x16, &(0x7f0000000140)=ANY=[@ANYBLOB="61124c000000000061138c0000000000bf2000000000000007000000080000002d0301000000000095000000000000006916000000000000bf67000000000000570600000f0000006706000002000000070600000ee60000bf050000000000001f650000000000006707000002000000070700004c0000001f75000000000000bf54000000000000070400000400f9ffbd43010000000000950000000000000005000000000000009500000000000000"], 0x0}, 0x48) 13:28:46 executing program 2: r0 = socket$inet6(0xa, 0x5, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) socket$inet6_sctp(0xa, 0x0, 0x84) setsockopt$inet_sctp6_SCTP_MAX_BURST(r0, 0x84, 0x14, &(0x7f0000000100), 0x4) 13:28:46 executing program 3: sigaltstack(&(0x7f0000ff7000/0x4000)=nil, 0x0) syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mlock(&(0x7f0000ffb000/0x4000)=nil, 0x4000) r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000040)='./cgroup.cpu\x00', 0x200002, 0x0) fchdir(r0) openat$cgroup(0xffffffffffffffff, 0x0, 0x200002, 0x0) r1 = open(&(0x7f0000000140)='./bus\x00', 0x141042, 0x0) r2 = creat(&(0x7f0000000300)='./file0\x00', 0x0) setsockopt$sock_linger(0xffffffffffffffff, 0x1, 0xd, 0x0, 0x0) write$P9_RREMOVE(r2, &(0x7f0000000280)={0x1}, 0xff7f) r3 = creat(&(0x7f0000000080)='./bus\x00', 0x0) r4 = open(&(0x7f0000000000)='./file0\x00', 0x141042, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x800002, 0x11, r4, 0x0) madvise(&(0x7f0000001000/0x1000)=nil, 0x1000, 0x9) fcntl$setstatus(r3, 0x4, 0x6100) fdatasync(r2) write$cgroup_type(r3, &(0x7f0000000200)='threaded\x00', 0xf642e7e) ioctl$EXT4_IOC_MOVE_EXT(r1, 0xc028660f, &(0x7f0000000200)={0x0, r2}) [ 286.388492] sctp: [Deprecated]: syz-executor2 (pid 10874) Use of int in max_burst socket option deprecated. [ 286.388492] Use struct sctp_assoc_value instead [ 286.575071] sctp: [Deprecated]: syz-executor2 (pid 10874) Use of int in max_burst socket option deprecated. [ 286.575071] Use struct sctp_assoc_value instead 13:28:46 executing program 1: pipe(&(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) epoll_create(0x0) dup3(r1, r0, 0x0) pipe(&(0x7f0000000400)={0xffffffffffffffff, 0xffffffffffffffff}) epoll_create1(0x0) write(r3, &(0x7f0000000340), 0x10000014c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clock_gettime(0x0, &(0x7f0000000040)={0x0, 0x0}) ioctl$TIOCGSID(0xffffffffffffffff, 0x5429, 0x0) pselect6(0x40, &(0x7f00000000c0), 0x0, &(0x7f0000000140)={0x1b7}, &(0x7f0000000200)={0x0, r4+30000000}, 0x0) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) 13:28:46 executing program 4: r0 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x1, &(0x7f0000000300)=0x2, 0x4) bind$inet(r0, &(0x7f0000000180)={0x2, 0x4e23, @multicast1}, 0x10) setsockopt$SO_ATTACH_FILTER(r0, 0x1, 0x1a, &(0x7f0000003c80)={0x0, &(0x7f0000003c40)}, 0x8) sendto$inet(r0, 0x0, 0x0, 0x200007fd, &(0x7f0000e68000)={0x2, 0x4e26, @local}, 0xd) setsockopt$sock_int(r0, 0x1, 0x2d, &(0x7f0000000040), 0x4) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = socket(0x0, 0x0, 0x0) r2 = open(&(0x7f000000fffa)='./bus\x00', 0x400000000141042, 0x0) close(r2) r3 = syz_open_dev$loop(&(0x7f0000000100)='/dev/loop#\x00', 0x101, 0x105082) r4 = memfd_create(&(0x7f0000000140)='\x00\x00\x00\x00\x8c\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00', 0x0) pwritev(r4, &(0x7f0000000080)=[{&(0x7f00000000c0)="a8", 0x1}], 0x1, 0x81003) ioctl$LOOP_CHANGE_FD(r3, 0x4c00, r4) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x800002, 0x11, r2, 0x0) socketpair$unix(0x1, 0x3, 0x0, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x0) ppoll(0x0, 0x0, 0x0, 0x0, 0x0) fcntl$setstatus(r2, 0x4, 0x0) pipe(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) syz_genetlink_get_family_id$tipc2(&(0x7f0000003b80)='TIPCv2\x00') fcntl$setstatus(r0, 0x4, 0x4c00) sendmsg$TIPC_NL_MON_GET(r5, &(0x7f0000003fc0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x21}, 0xc, &(0x7f0000003f80)={&(0x7f0000004480)=ANY=[@ANYBLOB="000026bd7000ffdbdf2512000000100001000c00020008000200be19261ecce9b29b441f00000000640005000800010065746800080001007564700008000100756470002c000200080002000100000008000400400000000800010018000000080004004800000008000100200000001c00020008000100010000000800030003000000080001001a000000380006000800010056a5000004000200080001000008000008000100332b0000080001000000000004000200080001000104000004000200a0000100340002000800030009030000080000080002001d9000fc07000403000000000800030002000000180001006574683a7465616d5f736c61002c000200080002003f00000075000000080003000104000008000300d75c000008000400e0ffffff240002000800020003000000080003001600000008000200ffff00000800020000010000200007000c000300a50d000000000000080001008400000008000100c6090000b00004001400010062726f6164636173df422c74eaad91b30c00010073797a31000000000c00010073797a30000000001c0007000800020003000000080004000000000008000200000000000c00010073797a31000000001c000700080002000400000008000400010001000800040900000000000000000800020005000000080002000000000008000008001800160000000800020005000000080002000100007f0000009e7ebc34d1bfb37acce1b675341b000c00020008000300ffffff7f080003008343000044000200080003000020000008000200008000000800de6b0000000000000200ffffffff08000200031d00000800010003000000080004000300000008000400ffff000008000300030000002400050008000100657468000800010069620000080001007564700008000000000038000001040014000700e50002003f03000008000100190000000c00010073797a30000000001400010062726f6164636173742d6c696e6b00003400070008004400070000000800010000000000080003002700000008000300ffffffff080002000700000008000200800000000c000700080001000a0000000c00070008010400040000000c00010073797a31000000005400070008000400090000000800040002000000080004000100008008000400ffff000008000400fcffffff080002000900000008000300010400000800030000000000080001000900000008000400060000001400070008000200ff0f000008000200000186f874fb4bf231c11bc0217ae8f758fc665cbc30edd6676c11498e8782ef7fa3db9743fd24b492a7b2e3b872252d0dc674db216f0450e7339653d9c73f7d0055481acc0886ff5f59918ca50dde62831ec4c744069cffbef9b35e86ace67e91dc05b8f181fd27227edc68dada44e12c6e4beed116ef6c9f640558a7386d824cf2b77da67f9369bbd4a49936e86954ad9312c098241986bc0cc07ddbac507a45d65d060cdee67af68bf24b46ee43749b1ef2a2d2ee695164e8fda3c850f696c691c010942de12007a8d4b80ed500000000000000"], 0x1}, 0x1, 0x0, 0x0, 0x800}, 0x800) write(r6, &(0x7f00000001c0), 0x526987c9) read(r5, &(0x7f0000000200)=""/250, 0x50c7e3e3) sendfile(r3, r4, 0x0, 0x80003) syz_open_procfs(0xffffffffffffffff, &(0x7f0000000040)='environ\x00') recvmmsg(r0, &(0x7f0000003b00)=[{{&(0x7f0000000340)=@generic, 0x80, &(0x7f0000002440)=[{&(0x7f00000003c0)=""/4096, 0x1000}, {&(0x7f00000013c0)=""/4096, 0x1000}, {&(0x7f00000023c0)=""/75, 0x4b}], 0x3}, 0xfffffffffffffff8}, {{&(0x7f0000002480)=@pppol2tpv3in6, 0x80, &(0x7f0000002ac0)=[{&(0x7f0000002500)=""/208, 0xd0}, {&(0x7f0000002600)=""/219, 0xdb}, {&(0x7f0000002700)=""/193, 0xc1}, {&(0x7f0000002800)=""/194, 0xc2}, {&(0x7f0000002900)=""/211, 0xd3}, {&(0x7f0000002a00)=""/134, 0x86}], 0x6, &(0x7f0000002b00)=""/4096, 0x1000}, 0x4}], 0x2, 0x0, &(0x7f0000003b40)={0x0, 0x989680}) ioctl$sock_SIOCGIFBR(r0, 0x8940, &(0x7f00000000c0)=@generic={0x0, 0xfffffffffffffffb, 0x6}) syz_open_procfs(0x0, &(0x7f00000001c0)='net/dev_mcast\x00') 13:28:46 executing program 3: sigaltstack(&(0x7f0000ff7000/0x4000)=nil, 0x0) syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mlock(&(0x7f0000ffb000/0x4000)=nil, 0x4000) r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000040)='./cgroup.cpu\x00', 0x200002, 0x0) fchdir(r0) openat$cgroup(r0, &(0x7f00000002c0)='syz0\x00', 0x200002, 0x0) r1 = open(&(0x7f0000000140)='./bus\x00', 0x141042, 0x0) r2 = creat(&(0x7f0000000300)='./file0\x00', 0x0) setsockopt$sock_linger(0xffffffffffffffff, 0x1, 0xd, 0x0, 0x0) write$P9_RREMOVE(r2, &(0x7f0000000280)={0x1}, 0xff7f) r3 = creat(&(0x7f0000000080)='./bus\x00', 0x0) r4 = open(&(0x7f0000000000)='./file0\x00', 0x141042, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x800002, 0x11, r4, 0x0) madvise(&(0x7f0000001000/0x1000)=nil, 0x1000, 0x9) fcntl$setstatus(r3, 0x4, 0x6100) fdatasync(r2) write$cgroup_type(r3, &(0x7f0000000200)='threaded\x00', 0xf642e7e) ioctl$EXT4_IOC_MOVE_EXT(r1, 0xc028660f, &(0x7f0000000200)={0x0, r2}) 13:28:46 executing program 5: r0 = creat(&(0x7f0000000140)='./file0\x00', 0x0) ioctl$TIOCCBRK(0xffffffffffffffff, 0x5428) getsockopt$IP_VS_SO_GET_DESTS(0xffffffffffffffff, 0x0, 0x484, 0x0, 0x0) pipe(&(0x7f0000000100)={0xffffffffffffffff}) getsockopt$inet6_mreq(0xffffffffffffffff, 0x29, 0x0, 0x0, 0x0) setsockopt$IP6T_SO_SET_ADD_COUNTERS(r1, 0x29, 0x41, 0x0, 0x488) ioctl$sock_SIOCSPGRP(r0, 0x8902, &(0x7f00000000c0)) 13:28:46 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000200)='/dev/ptmx\x00', 0x0, 0x0) read(r0, &(0x7f0000000040)=""/11, 0xb) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000100)) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) clone(0x20002100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) ioctl$TIOCGETD(r0, 0x541f, 0xfffffffffffffffe) 13:28:46 executing program 3: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) syz_mount_image$vfat(&(0x7f0000000000)='vfat\x00', &(0x7f00000004c0)='./file0\x00', 0xe000, 0x1, &(0x7f0000000040)=[{&(0x7f0000000100)="eb3c906d6b66732e666174000204010002", 0x11}], 0x0, 0x0) [ 287.021220] FAT-fs (loop3): invalid media value (0x00) [ 287.044254] FAT-fs (loop3): Can't find a valid FAT filesystem 13:28:47 executing program 5: socket$kcm(0x29, 0x2, 0x0) r0 = socket$kcm(0x10, 0x100000000002, 0x4) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) close(r1) sendmsg(r2, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x0) socket$kcm(0x29, 0x80000000008, 0x0) sendmsg$kcm(r0, &(0x7f00000039c0)={0x0, 0x0, &(0x7f0000003a00)=[{&(0x7f0000004d80)="39000000140081ae00002c000500018701546fabcae5e54f7e0592616652e285af71583c7d06a6580e883795c0c54c1960b89c40ebb3735858", 0x39}], 0x1}, 0x0) [ 287.116388] FAT-fs (loop3): invalid media value (0x00) 13:28:47 executing program 2: pipe(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$alg(0x26, 0x5, 0x0) bind$alg(r2, &(0x7f0000000300)={0x26, 'hash\x00', 0x0, 0x0, 'cmac(seed)\x00'}, 0x58) accept$unix(0xffffffffffffffff, 0x0, 0x0) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x300000d, 0x40031, 0xffffffffffffffff, 0x0) r3 = accept4(r2, 0x0, 0x0, 0x0) vmsplice(0xffffffffffffffff, 0x0, 0x0, 0x0) write$binfmt_script(r1, &(0x7f0000000280)=ANY=[], 0xfffffffc) setsockopt$ALG_SET_KEY(r2, 0x117, 0x1, &(0x7f0000000200)="ad56b6cc0400aeb995298992ea5400c2", 0x10) splice(r0, 0x0, r3, 0x0, 0x20000000003, 0x0) 13:28:47 executing program 0: pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) vmsplice(r1, &(0x7f0000001800)=[{&(0x7f0000000800)='+', 0x1}], 0x1, 0x0) r2 = socket$alg(0x26, 0x5, 0x0) bind$alg(r2, &(0x7f0000000240)={0x26, 'hash\x00', 0x0, 0x0, 'cryptd(hmac(sha256-generic))\x00'}, 0x58) setsockopt$ALG_SET_KEY(r2, 0x117, 0x1, 0x0, 0x0) r3 = accept4(r2, 0x0, 0x0, 0x0) r4 = accept4$alg(r3, 0x0, 0x0, 0x0) splice(r0, 0x0, r4, 0x0, 0x8, 0x0) [ 287.186935] FAT-fs (loop3): Can't find a valid FAT filesystem 13:28:47 executing program 3: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000200)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCGETD(r0, 0x541f, 0xfffffffffffffffe) 13:28:47 executing program 5: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000000)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_DEV_SETUP(0xffffffffffffffff, 0x5501, 0x0) ioctl$UI_DEV_DESTROY(r0, 0x5502) 13:28:47 executing program 3: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) syz_mount_image$vfat(&(0x7f0000000000)='vfat\x00', &(0x7f00000004c0)='./file0\x00', 0xe000, 0x1, &(0x7f0000000040)=[{&(0x7f0000000100)="eb3c906d6b66732e666174000204010002000270f7f8", 0x16}], 0x0, 0x0) umount2(&(0x7f0000000280)='./file0\x00', 0x0) 13:28:47 executing program 1: pipe(&(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) epoll_create(0x0) dup3(r1, r0, 0x0) pipe(&(0x7f0000000400)={0xffffffffffffffff, 0xffffffffffffffff}) epoll_create1(0x0) write(r3, &(0x7f0000000340), 0x10000014c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clock_gettime(0x0, &(0x7f0000000040)={0x0, 0x0}) ioctl$TIOCGSID(0xffffffffffffffff, 0x5429, 0x0) pselect6(0x40, &(0x7f00000000c0), 0x0, &(0x7f0000000140)={0x1b7}, &(0x7f0000000200)={0x0, r4+30000000}, 0x0) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) 13:28:47 executing program 5: r0 = syz_open_procfs(0x0, &(0x7f0000000200)='net/tcp6\x00') preadv(r0, &(0x7f0000000480)=[{0x0}, {&(0x7f0000000240)=""/186, 0xba}, {&(0x7f0000000300)=""/225, 0xe1}, {&(0x7f0000000400)=""/112, 0x70}], 0x4, 0x0) 13:28:47 executing program 0: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000380)='/dev/kvm\x00', 0x0, 0x0) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) perf_event_open(&(0x7f000001d000)={0x2, 0x70, 0x41, 0x8001, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sched_setaffinity(0x0, 0x0, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) 13:28:47 executing program 4: socketpair$unix(0x1, 0x0, 0x0, 0x0) openat$rtc(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) syz_mount_image$vfat(&(0x7f0000000000)='vfat\x00', &(0x7f00000004c0)='./file0\x00', 0xe000, 0x1, &(0x7f0000000040)=[{&(0x7f0000000100)="eb3c906d6b66732e666174000204010002000270f7f8", 0x16}], 0x0, 0x0) chroot(&(0x7f0000000140)='./file0\x00') umount2(&(0x7f0000000280)='./file0\x00', 0x0) 13:28:47 executing program 3: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) syz_mount_image$vfat(&(0x7f0000000000)='vfat\x00', &(0x7f00000004c0)='./file0\x00', 0xe000, 0x1, &(0x7f0000000040)=[{&(0x7f0000000100)="eb3c906d6b66732e666174000204010002000270f7f8", 0x16}], 0x0, 0x0) umount2(&(0x7f0000000280)='./file0\x00', 0x0) [ 287.975649] L1TF CPU bug present and SMT on, data leak possible. See CVE-2018-3646 and https://www.kernel.org/doc/html/latest/admin-guide/l1tf.html for details. 13:28:48 executing program 5: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0x5) ioctl$TIOCGLCKTRMIOS(r0, 0x5423, &(0x7f00000000c0)) 13:28:48 executing program 4: socketpair$unix(0x1, 0x0, 0x0, 0x0) openat$rtc(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) syz_mount_image$vfat(&(0x7f0000000000)='vfat\x00', &(0x7f00000004c0)='./file0\x00', 0xe000, 0x1, &(0x7f0000000040)=[{&(0x7f0000000100)="eb3c906d6b66732e666174000204010002000270f7f8", 0x16}], 0x0, 0x0) chroot(&(0x7f0000000140)='./file0\x00') umount2(&(0x7f0000000280)='./file0\x00', 0x0) [ 288.291223] mkiss: ax0: crc mode is auto. [ 288.556089] mkiss: ax0: crc mode is auto. 13:28:48 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) ioctl$TIOCGLCKTRMIOS(r0, 0x402c542c, &(0x7f00000000c0)) 13:28:48 executing program 3: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) syz_mount_image$vfat(&(0x7f0000000000)='vfat\x00', &(0x7f00000004c0)='./file0\x00', 0xe000, 0x1, &(0x7f0000000040)=[{&(0x7f0000000100)="eb3c906d6b66732e666174000204010002000270f7f8", 0x16}], 0x0, 0x0) umount2(&(0x7f0000000280)='./file0\x00', 0x0) 13:28:48 executing program 0: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f0000000180)=""/148, 0x94}], 0x1, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000040)='attr/current\x00') preadv(r0, &(0x7f0000000480), 0x1000000000000268, 0x0) 13:28:48 executing program 4: socketpair$unix(0x1, 0x0, 0x0, 0x0) openat$rtc(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) syz_mount_image$vfat(&(0x7f0000000000)='vfat\x00', &(0x7f00000004c0)='./file0\x00', 0xe000, 0x1, &(0x7f0000000040)=[{&(0x7f0000000100)="eb3c906d6b66732e666174000204010002000270f7f8", 0x16}], 0x0, 0x0) chroot(&(0x7f0000000140)='./file0\x00') umount2(&(0x7f0000000280)='./file0\x00', 0x0) 13:28:48 executing program 5: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0x5) ioctl$TIOCGLCKTRMIOS(r0, 0x5423, &(0x7f00000000c0)) 13:28:48 executing program 1: pipe(&(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) epoll_create(0x0) dup3(r1, r0, 0x0) pipe(&(0x7f0000000400)={0xffffffffffffffff, 0xffffffffffffffff}) epoll_create1(0x0) write(r2, &(0x7f0000000340), 0x10000014c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clock_gettime(0x0, &(0x7f0000000040)={0x0, 0x0}) ioctl$TIOCGSID(0xffffffffffffffff, 0x5429, 0x0) pselect6(0x40, &(0x7f00000000c0), 0x0, &(0x7f0000000140)={0x1b7}, &(0x7f0000000200)={0x0, r3+30000000}, 0x0) 13:28:49 executing program 3: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) syz_mount_image$vfat(&(0x7f0000000000)='vfat\x00', &(0x7f00000004c0)='./file0\x00', 0xe000, 0x1, &(0x7f0000000040)=[{&(0x7f0000000100)="eb3c906d6b66732e666174000204010002000270f7f8", 0x16}], 0x0, 0x0) umount2(&(0x7f0000000280)='./file0\x00', 0x0) 13:28:49 executing program 0: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f0000000180)=""/148, 0x94}], 0x1, 0x0) ioctl$TIOCGSID(0xffffffffffffff9c, 0x5429, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000040)='attr/current\x00') preadv(r0, &(0x7f0000000480), 0x1000000000000268, 0x6cefff7f) 13:28:49 executing program 5: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000080)=0x6) ioctl$TIOCGLCKTRMIOS(r0, 0x5423, &(0x7f00000000c0)) 13:28:49 executing program 4: socketpair$unix(0x1, 0x0, 0x0, 0x0) openat$rtc(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) syz_mount_image$vfat(&(0x7f0000000000)='vfat\x00', &(0x7f00000004c0)='./file0\x00', 0xe000, 0x1, &(0x7f0000000040)=[{&(0x7f0000000100)="eb3c906d6b66732e666174000204010002000270f7f8", 0x16}], 0x0, 0x0) chroot(&(0x7f0000000140)='./file0\x00') umount2(&(0x7f0000000280)='./file0\x00', 0x0) 13:28:49 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) ioctl$TIOCGLCKTRMIOS(r0, 0x402c542c, &(0x7f00000000c0)) 13:28:49 executing program 5: syz_open_dev$binder(&(0x7f0000008ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0046209, &(0x7f0000c6dfd0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) 13:28:49 executing program 0: r0 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = socket$inet6_udplite(0xa, 0x2, 0x88) sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x200007fd, 0x0, 0x0) dup2(0xffffffffffffffff, 0xffffffffffffffff) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r1, 0x29, 0x20, &(0x7f0000000140)={@loopback, 0x0, 0x0, 0x0, 0x4}, 0x20) 13:28:49 executing program 4: socketpair$unix(0x1, 0x0, 0x0, 0x0) openat$rtc(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) syz_mount_image$vfat(&(0x7f0000000000)='vfat\x00', &(0x7f00000004c0)='./file0\x00', 0xe000, 0x1, &(0x7f0000000040)=[{&(0x7f0000000100)="eb3c906d6b66732e666174000204010002000270f7f8", 0x16}], 0x0, 0x0) umount2(&(0x7f0000000280)='./file0\x00', 0x0) 13:28:49 executing program 3: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f0000000180)=""/148, 0x94}], 0x1, 0x0) ioctl$TIOCGSID(0xffffffffffffff9c, 0x5429, &(0x7f0000000000)) r0 = syz_open_procfs(0x0, &(0x7f0000000040)='attr/current\x00') preadv(r0, &(0x7f0000000480), 0x1000000000000268, 0x0) [ 289.598885] Can not set IPV6_FL_F_REFLECT if flowlabel_consistency sysctl is enable 13:28:49 executing program 5: socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000023c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) getegid() socket$vsock_dgram(0x28, 0x2, 0x0) 13:28:49 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) ioctl$TIOCGLCKTRMIOS(r0, 0x402c542c, &(0x7f00000000c0)) 13:28:49 executing program 1: pipe(&(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) epoll_create(0x0) dup3(r1, r0, 0x0) pipe(&(0x7f0000000400)={0xffffffffffffffff, 0xffffffffffffffff}) epoll_create1(0x0) write(r2, &(0x7f0000000340), 0x10000014c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clock_gettime(0x0, &(0x7f0000000040)={0x0, 0x0}) ioctl$TIOCGSID(0xffffffffffffffff, 0x5429, 0x0) pselect6(0x40, &(0x7f00000000c0), 0x0, &(0x7f0000000140)={0x1b7}, &(0x7f0000000200)={0x0, r3+30000000}, 0x0) 13:28:49 executing program 0: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f0000000180)=""/148, 0x94}], 0x1, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000040)='attr/current\x00') preadv(r0, &(0x7f0000000480), 0x1000000000000268, 0x6cefff7f) 13:28:49 executing program 3: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000080)=0x6) 13:28:49 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000008ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000007000)={0x4, 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) dup2(r1, r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000c6dfd0)={0x8, 0x0, &(0x7f0000dd0000)=[@acquire={0x40046304}], 0x0, 0x0, 0x0}) 13:28:50 executing program 4: socketpair$unix(0x1, 0x0, 0x0, 0x0) openat$rtc(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) chroot(&(0x7f0000000140)='./file0\x00') umount2(&(0x7f0000000280)='./file0\x00', 0x0) 13:28:50 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) ioctl$TIOCGLCKTRMIOS(r0, 0x402c542c, &(0x7f00000000c0)) [ 290.070455] binder: 11123:11128 tried to acquire reference to desc 0, got 1 instead 13:28:50 executing program 3: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000080)=0x6) 13:28:50 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000008ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000007000)={0x4, 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) dup2(r1, r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000c6dfd0)={0x8, 0x0, &(0x7f0000dd0000)=[@acquire={0x40046304}], 0x0, 0x0, 0x0}) 13:28:50 executing program 0: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f0000000180)=""/148, 0x94}], 0x1, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000040)='attr/current\x00') preadv(r0, &(0x7f0000000480), 0x1000000000000268, 0x6cefff7f) 13:28:50 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$TIOCGLCKTRMIOS(r0, 0x402c542c, &(0x7f00000000c0)) 13:28:50 executing program 4: socketpair$unix(0x1, 0x0, 0x0, 0x0) openat$rtc(0xffffffffffffff9c, 0x0, 0x0, 0x0) syz_mount_image$vfat(&(0x7f0000000000)='vfat\x00', &(0x7f00000004c0)='./file0\x00', 0xe000, 0x1, &(0x7f0000000040)=[{&(0x7f0000000100)="eb3c906d6b66732e666174000204010002000270f7f8", 0x16}], 0x0, 0x0) chroot(&(0x7f0000000140)='./file0\x00') umount2(&(0x7f0000000280)='./file0\x00', 0x0) 13:28:50 executing program 3: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000080)=0x6) 13:28:50 executing program 1: pipe(&(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) epoll_create(0x0) dup3(r1, r0, 0x0) pipe(&(0x7f0000000400)={0xffffffffffffffff, 0xffffffffffffffff}) epoll_create1(0x0) write(r2, &(0x7f0000000340), 0x10000014c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clock_gettime(0x0, &(0x7f0000000040)={0x0, 0x0}) ioctl$TIOCGSID(0xffffffffffffffff, 0x5429, 0x0) pselect6(0x40, &(0x7f00000000c0), 0x0, &(0x7f0000000140)={0x1b7}, &(0x7f0000000200)={0x0, r3+30000000}, 0x0) 13:28:50 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000008ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000007000)={0x4, 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) dup2(r1, r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000c6dfd0)={0x8, 0x0, &(0x7f0000dd0000)=[@acquire={0x40046304}], 0x0, 0x0, 0x0}) 13:28:50 executing program 4: socketpair$unix(0x1, 0x0, 0x0, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) syz_mount_image$vfat(&(0x7f0000000000)='vfat\x00', &(0x7f00000004c0)='./file0\x00', 0xe000, 0x1, &(0x7f0000000040)=[{&(0x7f0000000100)="eb3c906d6b66732e666174000204010002000270f7f8", 0x16}], 0x0, 0x0) chroot(&(0x7f0000000140)='./file0\x00') umount2(&(0x7f0000000280)='./file0\x00', 0x0) 13:28:50 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$TIOCGLCKTRMIOS(r0, 0x402c542c, &(0x7f00000000c0)) 13:28:50 executing program 3: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000080)=0x6) 13:28:50 executing program 0: mmap(&(0x7f0000000000/0xc1f000)=nil, 0xc1f000, 0x0, 0x71, 0xffffffffffffffff, 0x0) 13:28:50 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000008ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000007000)={0x4, 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) dup2(r1, r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000c6dfd0)={0x8, 0x0, &(0x7f0000dd0000)=[@acquire={0x40046304}], 0x0, 0x0, 0x0}) 13:28:51 executing program 0: getpid() syz_open_dev$evdev(&(0x7f0000000280)='/dev/input/event#\x00', 0x3, 0x0) 13:28:51 executing program 3: ioctl$TIOCSETD(0xffffffffffffffff, 0x5423, &(0x7f0000000080)=0x6) 13:28:51 executing program 4: ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) syz_mount_image$vfat(&(0x7f0000000000)='vfat\x00', &(0x7f00000004c0)='./file0\x00', 0xe000, 0x1, &(0x7f0000000040)=[{&(0x7f0000000100)="eb3c906d6b66732e666174000204010002000270f7f8", 0x16}], 0x0, 0x0) chroot(&(0x7f0000000140)='./file0\x00') umount2(&(0x7f0000000280)='./file0\x00', 0x0) 13:28:51 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$TIOCGLCKTRMIOS(r0, 0x402c542c, &(0x7f00000000c0)) 13:28:51 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000008ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000007000)={0x4, 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000c6dfd0)={0x8, 0x0, &(0x7f0000dd0000)=[@acquire={0x40046304}], 0x0, 0x0, 0x0}) 13:28:51 executing program 1: pipe(&(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) epoll_create(0x0) dup3(r1, r0, 0x0) pipe(&(0x7f0000000400)={0xffffffffffffffff, 0xffffffffffffffff}) epoll_create1(0x0) write(r3, &(0x7f0000000340), 0x10000014c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clock_gettime(0x0, &(0x7f0000000040)={0x0, 0x0}) pselect6(0x40, &(0x7f00000000c0), 0x0, &(0x7f0000000140)={0x1b7}, &(0x7f0000000200)={0x0, r4+30000000}, 0x0) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) 13:28:51 executing program 3: r0 = openat$ptmx(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000080)=0x6) 13:28:51 executing program 0: open(0x0, 0x0, 0x0) write$9p(0xffffffffffffffff, 0x0, 0x0) r0 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rtc\x00', 0x0, 0x0) ioctl$RTC_IRQP_SET(r0, 0x4008700c, 0x0) 13:28:51 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) ioctl$TIOCGLCKTRMIOS(r0, 0x402c542c, &(0x7f00000000c0)) 13:28:51 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000008ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000007000)={0x4, 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000c6dfd0)={0x8, 0x0, &(0x7f0000dd0000)=[@acquire={0x40046304}], 0x0, 0x0, 0x0}) 13:28:51 executing program 4: ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) syz_mount_image$vfat(0x0, &(0x7f00000004c0)='./file0\x00', 0xe000, 0x1, &(0x7f0000000040)=[{&(0x7f0000000100)="eb3c906d6b66732e666174000204010002000270f7f8", 0x16}], 0x0, 0x0) chroot(&(0x7f0000000140)='./file0\x00') umount2(&(0x7f0000000280)='./file0\x00', 0x0) 13:28:51 executing program 0: syz_open_dev$evdev(&(0x7f0000000280)='/dev/input/event#\x00', 0x3, 0x0) 13:28:51 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) ioctl$TIOCGLCKTRMIOS(r0, 0x402c542c, &(0x7f00000000c0)) 13:28:51 executing program 3: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(0xffffffffffffffff, 0x5423, &(0x7f0000000080)=0x6) 13:28:51 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000008ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000007000)={0x4, 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000c6dfd0)={0x8, 0x0, &(0x7f0000dd0000)=[@acquire={0x40046304}], 0x0, 0x0, 0x0}) 13:28:52 executing program 4: ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) syz_mount_image$vfat(&(0x7f0000000000)='vfat\x00', 0x0, 0xe000, 0x1, &(0x7f0000000040)=[{&(0x7f0000000100)="eb3c906d6b66732e666174000204010002000270f7f8", 0x16}], 0x0, 0x0) chroot(&(0x7f0000000140)='./file0\x00') umount2(&(0x7f0000000280)='./file0\x00', 0x0) 13:28:52 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) ioctl$TIOCGLCKTRMIOS(r0, 0x402c542c, &(0x7f00000000c0)) 13:28:52 executing program 1: pipe(&(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) epoll_create(0x0) dup3(r1, r0, 0x0) pipe(&(0x7f0000000400)={0xffffffffffffffff, 0xffffffffffffffff}) epoll_create1(0x0) write(r3, &(0x7f0000000340), 0x10000014c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$TIOCGSID(0xffffffffffffffff, 0x5429, 0x0) pselect6(0x40, &(0x7f00000000c0), 0x0, &(0x7f0000000140)={0x1b7}, &(0x7f0000000200), 0x0) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) 13:28:52 executing program 3: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, 0x0) 13:28:52 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000008ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) dup2(r1, r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000c6dfd0)={0x8, 0x0, &(0x7f0000dd0000)=[@acquire={0x40046304}], 0x0, 0x0, 0x0}) 13:28:52 executing program 0: perf_event_open(&(0x7f0000940000)={0x2, 0x70, 0xee6a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = getpid() rt_tgsigqueueinfo(r0, 0x0, 0x0, 0x0) syz_execute_func(&(0x7f0000000140)="cd8075fcb0b06969ef69dc00d9c4017d50ee8adcd0d01192000880410fd1b0b5d90000797c2a0f0fcdc4e3a95fd965eae23c3b4d4d408064797f41dfdf400f01efe5e59d7d2f2f1c0a1a63460fc4c161fccddfde9f") syz_execute_func(&(0x7f0000000140)="cd80c20000b0b06969ef69dc00d9c4017d50ee8adcd0d01192000880410fd1b02db5d90000007cc481c653fb0fcdc4e3a95fd965eabe3c3b4d4d408064797f41dfdf400e01efc4a1fd28d29d7d2f67450f483b1c0a1a63460fc4c161fc4d96040476789f") 13:28:52 executing program 4: ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) syz_mount_image$vfat(&(0x7f0000000000)='vfat\x00', &(0x7f00000004c0)='./file0\x00', 0x0, 0x1, &(0x7f0000000040)=[{&(0x7f0000000100)="eb3c906d6b66732e666174000204010002000270f7f8", 0x16}], 0x0, 0x0) chroot(&(0x7f0000000140)='./file0\x00') umount2(&(0x7f0000000280)='./file0\x00', 0x0) 13:28:52 executing program 2: perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) ioctl$TIOCGLCKTRMIOS(0xffffffffffffffff, 0x402c542c, &(0x7f00000000c0)) [ 292.634316] binder: 11256:11263 IncRefs 0 refcount change on invalid ref 0 ret -22 13:28:52 executing program 3: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000080)) [ 292.686763] FAT-fs (loop4): bogus number of reserved sectors 13:28:52 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, 0x0, 0x0, 0x0) perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) ioctl$TIOCGLCKTRMIOS(r0, 0x402c542c, &(0x7f00000000c0)) 13:28:52 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000008ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) dup2(r1, r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000c6dfd0)={0x8, 0x0, &(0x7f0000dd0000)=[@acquire={0x40046304}], 0x0, 0x0, 0x0}) [ 292.745290] FAT-fs (loop4): Can't find a valid FAT filesystem 13:28:52 executing program 0: perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x2, 0x88) bind$inet6(0xffffffffffffffff, 0x0, 0x0) connect$inet6(r0, &(0x7f0000000080)={0xa, 0x4e24}, 0x1c) sendmmsg(r0, &(0x7f00000092c0), 0x4ff, 0x0) 13:28:52 executing program 3: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000080)) 13:28:52 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000008ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) dup2(r1, r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000c6dfd0)={0x8, 0x0, &(0x7f0000dd0000)=[@acquire={0x40046304}], 0x0, 0x0, 0x0}) [ 292.972234] binder: 11285:11287 IncRefs 0 refcount change on invalid ref 0 ret -22 13:28:53 executing program 1: pipe(&(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) epoll_create(0x0) dup3(r1, r0, 0x0) pipe(&(0x7f0000000400)={0xffffffffffffffff, 0xffffffffffffffff}) epoll_create1(0x0) write(r3, &(0x7f0000000340), 0x10000014c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$TIOCGSID(0xffffffffffffffff, 0x5429, 0x0) pselect6(0x40, &(0x7f00000000c0), 0x0, &(0x7f0000000140)={0x1b7}, &(0x7f0000000200), 0x0) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) 13:28:53 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) ioctl$TIOCGLCKTRMIOS(r0, 0x402c542c, &(0x7f00000000c0)) 13:28:53 executing program 4: ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) syz_mount_image$vfat(&(0x7f0000000000)='vfat\x00', &(0x7f00000004c0)='./file0\x00', 0xe000, 0x0, 0x0, 0x0, 0x0) chroot(&(0x7f0000000140)='./file0\x00') umount2(&(0x7f0000000280)='./file0\x00', 0x0) 13:28:53 executing program 3: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000080)) 13:28:53 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000008ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000007000)={0x4, 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) dup2(0xffffffffffffffff, r0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000c6dfd0)={0x8, 0x0, &(0x7f0000dd0000)=[@acquire={0x40046304}], 0x0, 0x0, 0x0}) 13:28:53 executing program 3: socket$inet_udp(0x2, 0x2, 0x0) r0 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_fanout(r0, 0x107, 0x12, &(0x7f0000000000)={0x0, 0x0, 0xfffffffffffffffc}, 0x4) [ 293.621170] FAT-fs (loop4): bogus number of reserved sectors 13:28:53 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000008ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000007000)={0x4, 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) dup2(0xffffffffffffffff, r0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000c6dfd0)={0x8, 0x0, &(0x7f0000dd0000)=[@acquire={0x40046304}], 0x0, 0x0, 0x0}) [ 293.707949] FAT-fs (loop4): Can't find a valid FAT filesystem 13:28:53 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) ioctl$TIOCGLCKTRMIOS(r0, 0x402c542c, &(0x7f00000000c0)) 13:28:54 executing program 3: r0 = socket$inet6(0xa, 0x2, 0x0) getsockopt$inet6_opts(r0, 0x29, 0x3e, 0x0, &(0x7f0000000080)) 13:28:54 executing program 0: perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x2, 0x88) bind$inet6(0xffffffffffffffff, 0x0, 0x0) connect$inet6(r0, &(0x7f0000000080)={0xa, 0x4e24}, 0x1c) sendmmsg(r0, &(0x7f00000092c0), 0x4ff, 0x0) 13:28:54 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000008ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000007000)={0x4, 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) dup2(0xffffffffffffffff, r0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000c6dfd0)={0x8, 0x0, &(0x7f0000dd0000)=[@acquire={0x40046304}], 0x0, 0x0, 0x0}) 13:28:54 executing program 4: ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) syz_mount_image$vfat(&(0x7f0000000000)='vfat\x00', &(0x7f00000004c0)='./file0\x00', 0xe000, 0x0, &(0x7f0000000040), 0x0, 0x0) chroot(&(0x7f0000000140)='./file0\x00') umount2(&(0x7f0000000280)='./file0\x00', 0x0) [ 294.280117] FAT-fs (loop4): bogus number of reserved sectors [ 294.290654] FAT-fs (loop4): Can't find a valid FAT filesystem 13:28:54 executing program 1: pipe(&(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) epoll_create(0x0) dup3(r1, r0, 0x0) pipe(&(0x7f0000000400)={0xffffffffffffffff, 0xffffffffffffffff}) epoll_create1(0x0) write(r3, &(0x7f0000000340), 0x10000014c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$TIOCGSID(0xffffffffffffffff, 0x5429, 0x0) pselect6(0x40, &(0x7f00000000c0), 0x0, &(0x7f0000000140)={0x1b7}, &(0x7f0000000200), 0x0) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) 13:28:54 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) ioctl$TIOCGLCKTRMIOS(r0, 0x402c542c, &(0x7f00000000c0)) 13:28:54 executing program 3: perf_event_open(&(0x7f0000aaa000)={0x2, 0x70, 0x85a, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mincore(&(0x7f0000ffd000/0x3000)=nil, 0x3000, &(0x7f0000000040)=""/156) 13:28:54 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000008ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000007000)={0x4, 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) dup2(r1, r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000c6dfd0)={0x8, 0x0, &(0x7f0000dd0000)=[@acquire={0x40046304}], 0x0, 0x0, 0x0}) 13:28:54 executing program 4: ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) syz_mount_image$vfat(&(0x7f0000000000)='vfat\x00', &(0x7f00000004c0)='./file0\x00', 0xe000, 0x1, &(0x7f0000000040)=[{0x0}], 0x0, 0x0) chroot(&(0x7f0000000140)='./file0\x00') umount2(&(0x7f0000000280)='./file0\x00', 0x0) [ 294.573947] binder: 11346:11350 Acquire 1 refcount change on invalid ref 0 ret -22 [ 294.591121] FAT-fs (loop4): bogus number of reserved sectors 13:28:54 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) perf_event_open(&(0x7f000025c000)={0x0, 0x70, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) ioctl$TIOCGLCKTRMIOS(r0, 0x402c542c, &(0x7f00000000c0)) 13:28:54 executing program 3: perf_event_open(&(0x7f0000aaa000)={0x2, 0x70, 0x859, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = msgget$private(0x0, 0x0) msgrcv(r0, 0x0, 0x0, 0x0, 0x3800) [ 294.636937] binder: 11346:11350 IncRefs 0 refcount change on invalid ref 0 ret -22 [ 294.641993] FAT-fs (loop4): Can't find a valid FAT filesystem 13:28:54 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000008ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000007000)={0x4, 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) dup2(r1, r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000c6dfd0)={0x8, 0x0, &(0x7f0000dd0000)=[@acquire={0x40046304}], 0x0, 0x0, 0x0}) 13:28:54 executing program 4: ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) syz_mount_image$vfat(&(0x7f0000000000)='vfat\x00', &(0x7f00000004c0)='./file0\x00', 0xe000, 0x1, &(0x7f0000000040)=[{&(0x7f0000000100)}], 0x0, 0x0) chroot(&(0x7f0000000140)='./file0\x00') umount2(&(0x7f0000000280)='./file0\x00', 0x0) [ 294.953333] binder: 11368:11369 Acquire 1 refcount change on invalid ref 0 ret -22 [ 295.050393] binder: 11368:11369 IncRefs 0 refcount change on invalid ref 0 ret -22 [ 295.110301] FAT-fs (loop4): bogus number of reserved sectors [ 295.158116] FAT-fs (loop4): Can't find a valid FAT filesystem 13:28:55 executing program 0: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f00000002c0)={0x0, 0x3, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) prctl$PR_SET_MM_AUXV(0x23, 0xc, &(0x7f0000000080)="560d5d28abd5", 0x6) ioctl$KVM_REGISTER_COALESCED_MMIO(r1, 0x4010ae67, &(0x7f0000000100)={0x0, 0x100000}) ioctl$KVM_RUN(r2, 0xae80, 0x0) ioctl$KVM_NMI(r2, 0xae9a) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r2, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000000)=[@textreal={0x8, 0x0}], 0xaaaaaaaaaaaab6d, 0x0, 0x0, 0xfffffffffffffcd8) ioctl$KVM_RUN(r2, 0xae80, 0x0) 13:28:55 executing program 3: shmctl$SHM_INFO(0x0, 0xe, &(0x7f0000000100)=""/16) migrate_pages(0x0, 0x3ff, 0x0, &(0x7f00000000c0)) 13:28:55 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) perf_event_open(&(0x7f000025c000)={0x0, 0x70, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) ioctl$TIOCGLCKTRMIOS(r0, 0x402c542c, &(0x7f00000000c0)) 13:28:55 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000008ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000007000)={0x4, 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) dup2(r1, r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000c6dfd0)={0x8, 0x0, &(0x7f0000dd0000)=[@acquire={0x40046304}], 0x0, 0x0, 0x0}) 13:28:55 executing program 1: pipe(&(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) epoll_create(0x0) dup3(r1, r0, 0x0) pipe(&(0x7f0000000400)={0xffffffffffffffff, 0xffffffffffffffff}) epoll_create1(0x0) write(r3, &(0x7f0000000340), 0x10000014c) clock_gettime(0x0, &(0x7f0000000040)={0x0, 0x0}) ioctl$TIOCGSID(0xffffffffffffffff, 0x5429, 0x0) pselect6(0x40, &(0x7f00000000c0), 0x0, &(0x7f0000000140)={0x1b7}, &(0x7f0000000200)={0x0, r4+30000000}, 0x0) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) 13:28:55 executing program 4: ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) syz_mount_image$vfat(&(0x7f0000000000)='vfat\x00', &(0x7f00000004c0)='./file0\x00', 0xe000, 0x1, &(0x7f0000000040)=[{&(0x7f0000000100)="eb3c906d6b66732e666174", 0xb}], 0x0, 0x0) chroot(&(0x7f0000000140)='./file0\x00') umount2(&(0x7f0000000280)='./file0\x00', 0x0) [ 295.591520] binder: 11389:11391 Acquire 1 refcount change on invalid ref 0 ret -22 [ 295.614916] binder: 11389:11391 IncRefs 0 refcount change on invalid ref 0 ret -22 [ 295.636167] FAT-fs (loop4): bogus number of reserved sectors 13:28:55 executing program 3: 13:28:55 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) perf_event_open(&(0x7f000025c000)={0x0, 0x70, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) ioctl$TIOCGLCKTRMIOS(r0, 0x402c542c, &(0x7f00000000c0)) 13:28:55 executing program 5: ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x4, 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) dup2(r0, 0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000c6dfd0)={0x8, 0x0, &(0x7f0000dd0000)=[@acquire={0x40046304}], 0x0, 0x0, 0x0}) [ 295.704337] FAT-fs (loop4): Can't find a valid FAT filesystem 13:28:55 executing program 4: ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) syz_mount_image$vfat(&(0x7f0000000000)='vfat\x00', &(0x7f00000004c0)='./file0\x00', 0xe000, 0x1, &(0x7f0000000040)=[{&(0x7f0000000100)="eb3c906d6b66732e666174000204010002", 0x11}], 0x0, 0x0) chroot(&(0x7f0000000140)='./file0\x00') umount2(&(0x7f0000000280)='./file0\x00', 0x0) 13:28:55 executing program 3: perf_event_open(&(0x7f0000aaa000)={0x2, 0x70, 0x85a, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) prlimit64(0x0, 0x0, 0x0, &(0x7f0000000040)) 13:28:55 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) ioctl$TIOCGLCKTRMIOS(r0, 0x402c542c, &(0x7f00000000c0)) [ 295.968707] FAT-fs (loop4): invalid media value (0x00) [ 295.987274] FAT-fs (loop4): Can't find a valid FAT filesystem 13:28:56 executing program 0: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) r3 = signalfd4(0xffffffffffffffff, &(0x7f0000006000), 0x8, 0x0) r4 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(r4, 0x1, r3, &(0x7f0000000040)) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r2, &(0x7f0000fe8000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0x0) socket$inet(0x2, 0xfffffffffffffffd, 0x0) 13:28:56 executing program 5: ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x4, 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) dup2(r0, 0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000c6dfd0)={0x8, 0x0, &(0x7f0000dd0000)=[@acquire={0x40046304}], 0x0, 0x0, 0x0}) 13:28:56 executing program 3: pipe(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x4240a5d8) r3 = socket$inet(0x2, 0x3, 0x1) bind$inet(r2, &(0x7f00000001c0)={0x2, 0x0, @local}, 0x10) connect$inet(r3, &(0x7f0000000000)={0x2, 0x0, @multicast1}, 0x10) splice(r0, 0x0, r2, 0x0, 0x10005, 0x0) 13:28:56 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) ioctl$TIOCGLCKTRMIOS(r0, 0x402c542c, &(0x7f00000000c0)) 13:28:56 executing program 1: pipe(&(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) epoll_create(0x0) dup3(r1, r0, 0x0) pipe(&(0x7f0000000400)={0xffffffffffffffff}) epoll_create1(0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clock_gettime(0x0, &(0x7f0000000040)={0x0, 0x0}) ioctl$TIOCGSID(0xffffffffffffffff, 0x5429, 0x0) pselect6(0x40, &(0x7f00000000c0), 0x0, &(0x7f0000000140)={0x1b7}, &(0x7f0000000200)={0x0, r3+30000000}, 0x0) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) 13:28:56 executing program 4: ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) syz_mount_image$vfat(&(0x7f0000000000)='vfat\x00', &(0x7f00000004c0)='./file0\x00', 0xe000, 0x1, &(0x7f0000000040)=[{&(0x7f0000000100)="eb3c906d6b66732e666174000204010002000270", 0x14}], 0x0, 0x0) chroot(&(0x7f0000000140)='./file0\x00') umount2(&(0x7f0000000280)='./file0\x00', 0x0) [ 296.203332] FAT-fs (loop4): invalid media value (0x00) 13:28:56 executing program 5: ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x4, 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) dup2(r0, 0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000c6dfd0)={0x8, 0x0, &(0x7f0000dd0000)=[@acquire={0x40046304}], 0x0, 0x0, 0x0}) 13:28:56 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) ioctl$TIOCGLCKTRMIOS(r0, 0x402c542c, &(0x7f00000000c0)) [ 296.253360] FAT-fs (loop4): Can't find a valid FAT filesystem 13:28:56 executing program 0: r0 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_inet_SIOCDARP(r0, 0x8953, &(0x7f0000000200)={{0x2, 0x0, @empty}, {0x0, @remote}, 0x0, {0x2, 0x0, @broadcast}, 'gretap0\x00'}) 13:28:56 executing program 4: ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) syz_mount_image$vfat(&(0x7f0000000000)='vfat\x00', &(0x7f00000004c0)='./file0\x00', 0xe000, 0x1, &(0x7f0000000040)=[{&(0x7f0000000100)="eb3c906d6b66732e666174000204010002000270f7", 0x15}], 0x0, 0x0) chroot(&(0x7f0000000140)='./file0\x00') umount2(&(0x7f0000000280)='./file0\x00', 0x0) 13:28:56 executing program 5: r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000007000)={0x4, 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) dup2(r1, r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000c6dfd0)={0x8, 0x0, &(0x7f0000dd0000)=[@acquire={0x40046304}], 0x0, 0x0, 0x0}) 13:28:56 executing program 2: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) ioctl$TIOCGLCKTRMIOS(0xffffffffffffffff, 0x402c542c, &(0x7f00000000c0)) 13:28:56 executing program 0: clone(0x7ff, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socketpair(0x0, 0x0, 0x0, 0x0) r0 = getpid() rt_tgsigqueueinfo(r0, r0, 0x16, &(0x7f00000000c0)) ptrace(0x10, r0) open(&(0x7f0000000000)='./file0\x00', 0x20000, 0x20) ptrace$getsig(0x2, r0, 0xffffffffff600003, &(0x7f0000000280)) 13:28:56 executing program 5: r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000007000)={0x4, 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) dup2(r1, r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000c6dfd0)={0x8, 0x0, &(0x7f0000dd0000)=[@acquire={0x40046304}], 0x0, 0x0, 0x0}) [ 296.542427] FAT-fs (loop4): invalid media value (0x00) [ 296.547995] FAT-fs (loop4): Can't find a valid FAT filesystem 13:28:56 executing program 0: 13:28:56 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) ioctl$TIOCGLCKTRMIOS(r0, 0x402c542c, 0x0) 13:28:57 executing program 1: pipe(&(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) epoll_create(0x0) dup3(r1, r0, 0x0) pipe(&(0x7f0000000400)={0xffffffffffffffff}) epoll_create1(0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clock_gettime(0x0, &(0x7f0000000040)={0x0, 0x0}) ioctl$TIOCGSID(0xffffffffffffffff, 0x5429, 0x0) pselect6(0x40, &(0x7f00000000c0), 0x0, &(0x7f0000000140)={0x1b7}, &(0x7f0000000200)={0x0, r3+30000000}, 0x0) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) 13:28:57 executing program 4: ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) syz_mount_image$vfat(&(0x7f0000000000)='vfat\x00', &(0x7f00000004c0)='./file0\x00', 0xe000, 0x1, &(0x7f0000000040)=[{&(0x7f0000000100)="eb3c906d6b66732e666174000204010002000270f7f8", 0x16}], 0x0, 0x0) chroot(0x0) umount2(&(0x7f0000000280)='./file0\x00', 0x0) 13:28:57 executing program 3: 13:28:57 executing program 5: r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000007000)={0x4, 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) dup2(r1, r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000c6dfd0)={0x8, 0x0, &(0x7f0000dd0000)=[@acquire={0x40046304}], 0x0, 0x0, 0x0}) 13:28:57 executing program 0: 13:28:57 executing program 3: 13:28:57 executing program 0: 13:28:57 executing program 2: 13:28:57 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000008ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000007000)={0x4, 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) dup2(r1, r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000c6dfd0)={0x8, 0x0, &(0x7f0000dd0000)=[@acquire={0x40046304}], 0x0, 0x0, 0x0}) 13:28:57 executing program 4: ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) syz_mount_image$vfat(&(0x7f0000000000)='vfat\x00', &(0x7f00000004c0)='./file0\x00', 0xe000, 0x1, &(0x7f0000000040)=[{&(0x7f0000000100)="eb3c906d6b66732e666174000204010002000270f7f8", 0x16}], 0x0, 0x0) chroot(&(0x7f0000000140)='./file0\x00') umount2(0x0, 0x0) 13:28:57 executing program 0: 13:28:57 executing program 3: [ 297.280250] binder: 11507:11508 Acquire 1 refcount change on invalid ref 0 ret -22 [ 297.342189] binder: 11507:11508 IncRefs 0 refcount change on invalid ref 0 ret -22 13:28:57 executing program 1: pipe(&(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) epoll_create(0x0) dup3(r1, r0, 0x0) pipe(&(0x7f0000000400)={0xffffffffffffffff}) epoll_create1(0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clock_gettime(0x0, &(0x7f0000000040)={0x0, 0x0}) ioctl$TIOCGSID(0xffffffffffffffff, 0x5429, 0x0) pselect6(0x40, &(0x7f00000000c0), 0x0, &(0x7f0000000140)={0x1b7}, &(0x7f0000000200)={0x0, r3+30000000}, 0x0) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) 13:28:57 executing program 2: 13:28:57 executing program 0: 13:28:57 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000008ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000007000)={0x4, 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) dup2(r1, r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000c6dfd0)={0x8, 0x0, &(0x7f0000dd0000)=[@acquire={0x40046304}], 0x0, 0x0, 0x0}) 13:28:57 executing program 3: 13:28:57 executing program 4: [ 297.979100] binder: 11525:11526 Acquire 1 refcount change on invalid ref 0 ret -22 13:28:58 executing program 0: 13:28:58 executing program 2: 13:28:58 executing program 3: 13:28:58 executing program 4: [ 298.025727] binder: 11525:11526 IncRefs 0 refcount change on invalid ref 0 ret -22 13:28:58 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000008ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000007000)={0x4, 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) dup2(r1, r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000c6dfd0)={0x8, 0x0, &(0x7f0000dd0000)=[@acquire={0x40046304}], 0x0, 0x0, 0x0}) 13:28:58 executing program 0: [ 298.283741] binder: 11546:11548 Acquire 1 refcount change on invalid ref 0 ret -22 [ 298.309528] binder: 11546:11548 IncRefs 0 refcount change on invalid ref 0 ret -22 13:28:58 executing program 1: pipe(&(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) epoll_create(0x0) dup3(r1, r0, 0x0) pipe(&(0x7f0000000400)={0xffffffffffffffff, 0xffffffffffffffff}) write(r3, &(0x7f0000000340), 0x10000014c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clock_gettime(0x0, &(0x7f0000000040)={0x0, 0x0}) ioctl$TIOCGSID(0xffffffffffffffff, 0x5429, 0x0) pselect6(0x40, &(0x7f00000000c0), 0x0, &(0x7f0000000140)={0x1b7}, &(0x7f0000000200)={0x0, r4+30000000}, 0x0) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) 13:28:58 executing program 2: 13:28:58 executing program 4: 13:28:58 executing program 3: 13:28:58 executing program 0: 13:28:58 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000008ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000007000)={0x4, 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) dup2(r1, r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000c6dfd0)={0x8, 0x0, &(0x7f0000dd0000)=[@acquire={0x40046304}], 0x0, 0x0, 0x0}) 13:28:58 executing program 3: 13:28:58 executing program 4: 13:28:58 executing program 0: [ 298.843935] binder: 11553:11554 IncRefs 0 refcount change on invalid ref 0 ret -22 13:28:58 executing program 2: 13:28:59 executing program 4: 13:28:59 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000008ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000007000)={0x4, 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) dup2(r1, r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000c6dfd0)={0x8, 0x0, &(0x7f0000dd0000)=[@acquire={0x40046304}], 0x0, 0x0, 0x0}) [ 299.136442] binder: 11573:11575 IncRefs 0 refcount change on invalid ref 0 ret -22 13:28:59 executing program 1: pipe(&(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) epoll_create(0x0) dup3(r1, r0, 0x0) epoll_create1(0x0) write(0xffffffffffffffff, &(0x7f0000000340), 0x10000014c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clock_gettime(0x0, &(0x7f0000000040)={0x0, 0x0}) ioctl$TIOCGSID(0xffffffffffffffff, 0x5429, 0x0) pselect6(0x40, &(0x7f00000000c0), 0x0, &(0x7f0000000140)={0x1b7}, &(0x7f0000000200)={0x0, r2+30000000}, 0x0) vmsplice(0xffffffffffffffff, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) 13:28:59 executing program 2: 13:28:59 executing program 0: 13:28:59 executing program 3: 13:28:59 executing program 4: 13:28:59 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000008ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000007000)={0x4, 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) dup2(r1, r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000c6dfd0)={0x8, 0x0, &(0x7f0000dd0000)=[@acquire={0x40046304}], 0x0, 0x0, 0x0}) 13:28:59 executing program 3: 13:28:59 executing program 0: 13:28:59 executing program 4: 13:28:59 executing program 2: 13:28:59 executing program 3: 13:28:59 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000008ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) dup2(r1, r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000c6dfd0)={0x8, 0x0, &(0x7f0000dd0000)=[@acquire={0x40046304}], 0x0, 0x0, 0x0}) 13:28:59 executing program 1: pipe(&(0x7f00000000c0)) epoll_create(0x0) pipe(&(0x7f0000000400)={0xffffffffffffffff, 0xffffffffffffffff}) epoll_create1(0x0) write(r1, &(0x7f0000000340), 0x10000014c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clock_gettime(0x0, &(0x7f0000000040)={0x0, 0x0}) ioctl$TIOCGSID(0xffffffffffffffff, 0x5429, 0x0) pselect6(0x40, &(0x7f00000000c0), 0x0, &(0x7f0000000140)={0x1b7}, &(0x7f0000000200)={0x0, r2+30000000}, 0x0) vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) 13:28:59 executing program 0: 13:28:59 executing program 4: 13:28:59 executing program 2: [ 299.840200] binder: 11600:11601 ioctl c0306201 0 returned -14 13:28:59 executing program 3: 13:28:59 executing program 0: [ 299.897702] binder: 11600:11601 IncRefs 0 refcount change on invalid ref 0 ret -22 13:29:00 executing program 2: 13:29:00 executing program 3: 13:29:00 executing program 4: 13:29:00 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000008ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) dup2(r1, r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000c6dfd0)={0x8, 0x0, &(0x7f0000dd0000)=[@acquire={0x40046304}], 0x0, 0x0, 0x0}) 13:29:00 executing program 0: 13:29:00 executing program 2: [ 300.184702] binder: 11621:11626 ioctl c0306201 0 returned -14 [ 300.222438] binder: 11621:11626 IncRefs 0 refcount change on invalid ref 0 ret -22 13:29:00 executing program 1: pipe(&(0x7f00000000c0)) epoll_create(0x0) pipe(&(0x7f0000000400)={0xffffffffffffffff, 0xffffffffffffffff}) epoll_create1(0x0) write(r1, &(0x7f0000000340), 0x10000014c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clock_gettime(0x0, &(0x7f0000000040)={0x0, 0x0}) ioctl$TIOCGSID(0xffffffffffffffff, 0x5429, 0x0) pselect6(0x40, &(0x7f00000000c0), 0x0, &(0x7f0000000140)={0x1b7}, &(0x7f0000000200)={0x0, r2+30000000}, 0x0) vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) 13:29:00 executing program 3: 13:29:00 executing program 0: 13:29:00 executing program 4: 13:29:00 executing program 2: 13:29:00 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000008ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) dup2(r1, r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000c6dfd0)={0x8, 0x0, &(0x7f0000dd0000)=[@acquire={0x40046304}], 0x0, 0x0, 0x0}) 13:29:00 executing program 2: 13:29:00 executing program 3: 13:29:00 executing program 0: 13:29:00 executing program 4: [ 300.730284] binder: 11637:11638 ioctl c0306201 0 returned -14 [ 300.760445] binder: 11637:11638 IncRefs 0 refcount change on invalid ref 0 ret -22 13:29:00 executing program 3: 13:29:00 executing program 4: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ptmx\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000500)={0x2, 0x70, 0x71, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) read(r0, &(0x7f0000000040)=""/48, 0x30) 13:29:01 executing program 1: pipe(&(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) dup3(r1, r0, 0x0) pipe(&(0x7f0000000400)={0xffffffffffffffff, 0xffffffffffffffff}) epoll_create1(0x0) write(r3, &(0x7f0000000340), 0x10000014c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clock_gettime(0x0, &(0x7f0000000040)={0x0, 0x0}) ioctl$TIOCGSID(0xffffffffffffffff, 0x5429, 0x0) pselect6(0x40, &(0x7f00000000c0), 0x0, &(0x7f0000000140)={0x1b7}, &(0x7f0000000200)={0x0, r4+30000000}, 0x0) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) 13:29:01 executing program 0: r0 = creat(&(0x7f0000000140)='./file0\x00', 0x0) close(r0) fchmod(r0, 0x0) 13:29:01 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000008ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000007000)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) dup2(r1, r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000c6dfd0)={0x8, 0x0, &(0x7f0000dd0000)=[@acquire={0x40046304}], 0x0, 0x0, 0x0}) 13:29:01 executing program 2: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) write$binfmt_aout(0xffffffffffffffff, 0x0, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) clone(0x3102001ffe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = socket$inet(0x2, 0x200000002, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r1, 0x0, 0x80, &(0x7f0000000700)=@broute={'broute\x00', 0x20, 0x1, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x200002c0], 0x0, 0x0, 0x0}, 0x78) openat$apparmor_task_current(0xffffffffffffff9c, 0x0, 0x2, 0x0) 13:29:01 executing program 3: r0 = syz_open_dev$sg(&(0x7f0000000100)='/dev/sg#\x00', 0x0, 0x10008002) ioctl$SG_SET_FORCE_PACK_ID(r0, 0x227b, &(0x7f00000000c0)=0xffffffffffffffff) write(r0, &(0x7f0000000000)="b63db85e1e8d020000000000003ef0011dcc606aed69d2bc7037cebc9bc2feffffffffffffffe22c9b160096aa1fae1a", 0x30) readv(r0, &(0x7f000085dff0)=[{&(0x7f0000e94000)=""/62, 0x10024}], 0x146) 13:29:01 executing program 2: r0 = socket$kcm(0xa, 0x805, 0x0) sendmsg(r0, &(0x7f0000000680)={&(0x7f0000000000)=@in6={0xa, 0x0, 0x0, @remote, 0x3}, 0x80, &(0x7f00000008c0)=[{&(0x7f0000000800)="cf", 0x1}], 0x1}, 0x0) sendmsg(r0, &(0x7f00000005c0)={&(0x7f0000000080)=@in6={0xa, 0x0, 0x0, @remote, 0x5}, 0x80, &(0x7f0000000540)=[{&(0x7f0000000200)='o', 0x1}], 0x1}, 0x0) 13:29:01 executing program 0: pipe(&(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) epoll_create(0x0) dup3(r1, r0, 0x0) pipe(&(0x7f0000000400)={0xffffffffffffffff, 0xffffffffffffffff}) write(r3, &(0x7f0000000340), 0x10000014c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clock_gettime(0x0, &(0x7f0000000040)={0x0, 0x0}) ioctl$TIOCGSID(0xffffffffffffffff, 0x5429, 0x0) pselect6(0x40, &(0x7f00000000c0), 0x0, &(0x7f0000000140)={0x1b7}, &(0x7f0000000200)={0x0, r4+30000000}, 0x0) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) [ 301.635205] kernel msg: ebtables bug: please report to author: Entries_size never zero [ 301.653293] binder: 11667:11671 IncRefs 0 refcount change on invalid ref 0 ret -22 13:29:01 executing program 3: pipe(&(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) epoll_create(0x0) dup3(r1, r0, 0x0) pipe(&(0x7f0000000400)={0xffffffffffffffff}) epoll_create1(0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clock_gettime(0x0, &(0x7f0000000040)={0x0, 0x0}) ioctl$TIOCGSID(0xffffffffffffffff, 0x5429, 0x0) pselect6(0x40, &(0x7f00000000c0), 0x0, &(0x7f0000000140)={0x1b7}, &(0x7f0000000200)={0x0, r3+30000000}, 0x0) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) 13:29:01 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000008ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000007000)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) dup2(r1, r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000c6dfd0)={0x8, 0x0, &(0x7f0000dd0000)=[@acquire={0x40046304}], 0x0, 0x0, 0x0}) [ 301.855839] syz-executor2 (11683) used greatest stack depth: 13032 bytes left 13:29:01 executing program 2: pipe(&(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) epoll_create(0x0) dup3(r1, r0, 0x0) pipe(&(0x7f0000000400)={0xffffffffffffffff, 0xffffffffffffffff}) epoll_create1(0x0) write(r3, &(0x7f0000000340), 0x10000014c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clock_gettime(0x0, &(0x7f0000000040)={0x0, 0x0}) pselect6(0x40, &(0x7f00000000c0), 0x0, &(0x7f0000000140)={0x1b7}, &(0x7f0000000200)={0x0, r4+30000000}, 0x0) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) 13:29:01 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000008ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000007000)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) dup2(r1, r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000c6dfd0)={0x8, 0x0, &(0x7f0000dd0000)=[@acquire={0x40046304}], 0x0, 0x0, 0x0}) 13:29:01 executing program 4: r0 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x400200, 0x0) write$P9_RAUTH(r0, &(0x7f0000000040)={0x14, 0x67, 0x1, {0x7b, 0x0, 0x6}}, 0x14) ioctl$KDSIGACCEPT(r0, 0x4b4e, 0x27) getsockopt$inet_sctp6_SCTP_RESET_STREAMS(r0, 0x84, 0x77, &(0x7f0000000080)={0x0, 0x8}, &(0x7f00000000c0)=0x8) getsockopt$inet_sctp6_SCTP_AUTH_ACTIVE_KEY(r0, 0x84, 0x18, &(0x7f0000000100)={r1, 0x1000}, &(0x7f0000000140)=0x8) write$FUSE_INTERRUPT(r0, &(0x7f0000000180)={0x10, 0xfffffffffffffff5, 0x5}, 0x10) syz_genetlink_get_family_id$ipvs(&(0x7f00000001c0)='IPVS\x00') r3 = shmget$private(0x0, 0x4000, 0x78000400, &(0x7f0000ff9000/0x4000)=nil) shmctl$IPC_INFO(r3, 0x3, &(0x7f0000000200)=""/67) ioctl$VIDIOC_S_PARM(r0, 0xc0cc5616, &(0x7f0000000280)={0x9, @raw_data="ae30853ced239a3e74e48cf388482043299e2c25ef9f30df6fc2c4e1e7beab31e7041ebeaf236ee325b26e7e24348dce19ced249d02c28a2f6fd3ce6d251fa2d9793aa88fc224b8cf2b5252a0c1d3557cbf5aadce8dcc0a73e566fda8e2154ba0b0748e651db2e344dbd6e5026b2ffcbaad50473eb2027c40aa93de3f90972b328f94d27e7617e7dccf24430765545d3c94e2e9cb8367f75ee4eef01bdb4429edf31efa6154a4f9130b8426e7c06932da0e979732be87f7f2a2e83decacef537cee52582c2b99796"}) setsockopt$inet_sctp6_SCTP_MAXSEG(r0, 0x84, 0xd, &(0x7f0000000380)=@assoc_id=r1, 0x4) ioctl$UI_SET_PHYS(r0, 0x4008556c, &(0x7f00000003c0)='syz1\x00') shmget$private(0x0, 0x1000, 0x0, &(0x7f0000ff9000/0x1000)=nil) ioctl$UI_SET_KEYBIT(r0, 0x40045565, 0x2b4) r4 = syz_genetlink_get_family_id$tipc(&(0x7f0000000440)='TIPC\x00') sendmsg$TIPC_CMD_SHOW_STATS(r0, &(0x7f0000000500)={&(0x7f0000000400)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f00000004c0)={&(0x7f0000000480)={0x1c, r4, 0x0, 0x70bd28, 0x25dfdbfd, {}, [""]}, 0x1c}, 0x1, 0x0, 0x0, 0x20000000}, 0x1) prctl$PR_GET_FP_MODE(0x2e) r5 = semget(0x0, 0x1, 0x120) semctl$SEM_STAT(r5, 0x4, 0x12, &(0x7f0000000540)=""/231) ioctl$VIDIOC_OVERLAY(r0, 0x4004560e, &(0x7f0000000640)) getsockopt$inet_sctp6_SCTP_MAX_BURST(r0, 0x84, 0x14, &(0x7f0000000680)=@assoc_value, &(0x7f00000006c0)=0x8) ioctl$SNDRV_CTL_IOCTL_HWDEP_INFO(r0, 0x80dc5521, &(0x7f0000000700)=""/7) ioctl$sock_SIOCETHTOOL(r0, 0x8946, &(0x7f00000007c0)={'ip6gretap0\x00', &(0x7f0000000740)=@ethtool_coalesce={0xe, 0x200000000, 0x0, 0xfe000000000000, 0x3, 0x6, 0x3, 0xa568, 0x81, 0x4, 0x5, 0x1000, 0x5, 0x6, 0x7, 0x0, 0xfffffffffffffffa, 0xfff, 0x1000, 0x1b3, 0x8, 0x1, 0x4}}) ioctl$SIOCX25GDTEFACILITIES(r0, 0x89ea, &(0x7f0000000800)) openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000840)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) setsockopt$inet_sctp6_SCTP_AUTH_KEY(r0, 0x84, 0x17, &(0x7f0000000880)={r2, 0x0, 0x26, "e0d51756ce0f68efd0b25653873f70d2a7b2606ce2cf6485ad0bb1dd1697a4ca56b5fd381d8a"}, 0x2e) setsockopt$inet_udp_int(r0, 0x11, 0x0, &(0x7f00000008c0)=0x80000001, 0x4) lstat(&(0x7f0000000900)='./file0\x00', &(0x7f0000000940)) ioctl$DRM_IOCTL_CONTROL(r0, 0x40086414, &(0x7f00000009c0)={0x1, 0x7f}) getsockopt$inet_sctp_SCTP_SOCKOPT_CONNECTX3(r0, 0x84, 0x6f, &(0x7f0000000a40)={r2, 0x30, &(0x7f0000000a00)=[@in={0x2, 0x4e21, @rand_addr=0xfffffffffffff8e0}, @in={0x2, 0x4e23, @multicast1}, @in={0x2, 0x4e22, @dev={0xac, 0x14, 0x14, 0x16}}]}, &(0x7f0000000a80)=0x10) 13:29:02 executing program 1: epoll_create(0x0) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x0) pipe(&(0x7f0000000400)={0xffffffffffffffff, 0xffffffffffffffff}) epoll_create1(0x0) write(r1, &(0x7f0000000340), 0x10000014c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clock_gettime(0x0, &(0x7f0000000040)={0x0, 0x0}) ioctl$TIOCGSID(0xffffffffffffffff, 0x5429, 0x0) pselect6(0x40, &(0x7f00000000c0), 0x0, &(0x7f0000000140)={0x1b7}, &(0x7f0000000200)={0x0, r2+30000000}, 0x0) vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) 13:29:02 executing program 4 (fault-call:3 fault-nth:0): ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) syz_mount_image$vfat(&(0x7f0000000000)='vfat\x00', &(0x7f00000004c0)='./file0\x00', 0xe000, 0x1, &(0x7f0000000040)=[{&(0x7f0000000100)="eb3c906d6b66732e666174000204010002000270f7f8", 0x16}], 0x0, 0x0) chroot(&(0x7f0000000140)='./file0\x00') umount2(&(0x7f0000000280)='./file0\x00', 0x0) 13:29:02 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000008ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000007000)={0x0, 0x0, &(0x7f0000000080)=ANY=[], 0x0, 0x0, 0x0}) dup2(r1, r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000c6dfd0)={0x8, 0x0, &(0x7f0000dd0000)=[@acquire={0x40046304}], 0x0, 0x0, 0x0}) 13:29:02 executing program 2: pipe(&(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) epoll_create(0x0) dup3(r1, r0, 0x0) pipe(&(0x7f0000000400)={0xffffffffffffffff, 0xffffffffffffffff}) epoll_create1(0x0) write(r3, &(0x7f0000000340), 0x10000014c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clock_gettime(0x0, &(0x7f0000000040)={0x0, 0x0}) pselect6(0x40, &(0x7f00000000c0), 0x0, &(0x7f0000000140)={0x1b7}, &(0x7f0000000200)={0x0, r4+30000000}, 0x0) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) 13:29:02 executing program 3: pipe(&(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) epoll_create(0x0) dup3(r1, r0, 0x0) pipe(&(0x7f0000000400)={0xffffffffffffffff}) epoll_create1(0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clock_gettime(0x0, &(0x7f0000000040)={0x0, 0x0}) ioctl$TIOCGSID(0xffffffffffffffff, 0x5429, 0x0) pselect6(0x40, &(0x7f00000000c0), 0x0, &(0x7f0000000140)={0x1b7}, &(0x7f0000000200)={0x0, r3+30000000}, 0x0) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) 13:29:02 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000008ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000007000)={0x0, 0x0, &(0x7f0000000080)=ANY=[], 0x0, 0x0, 0x0}) dup2(r1, r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000c6dfd0)={0x8, 0x0, &(0x7f0000dd0000)=[@acquire={0x40046304}], 0x0, 0x0, 0x0}) 13:29:02 executing program 0: pipe(&(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) epoll_create(0x0) dup3(r1, r0, 0x0) pipe(&(0x7f0000000400)={0xffffffffffffffff, 0xffffffffffffffff}) write(r3, &(0x7f0000000340), 0x10000014c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clock_gettime(0x0, &(0x7f0000000040)={0x0, 0x0}) ioctl$TIOCGSID(0xffffffffffffffff, 0x5429, 0x0) pselect6(0x40, &(0x7f00000000c0), 0x0, &(0x7f0000000140)={0x1b7}, &(0x7f0000000200)={0x0, r4+30000000}, 0x0) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) 13:29:02 executing program 4: ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) syz_mount_image$vfat(&(0x7f0000000000)='vfat\x00', &(0x7f00000004c0)='./file0\x00', 0xe000, 0x1, &(0x7f0000000040)=[{&(0x7f0000000100)="eb3c906d6b66732e666174000204010002000270f7f8", 0x16}], 0x0, 0x0) chroot(&(0x7f0000000140)='./file0\x00') umount2(&(0x7f0000000280)='./file0\x00', 0x0) 13:29:02 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000008ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000007000)={0x0, 0x0, &(0x7f0000000080)=ANY=[], 0x0, 0x0, 0x0}) dup2(r1, r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000c6dfd0)={0x8, 0x0, &(0x7f0000dd0000)=[@acquire={0x40046304}], 0x0, 0x0, 0x0}) [ 302.996255] binder_thread_write: 4 callbacks suppressed [ 302.996270] binder: 11736:11742 IncRefs 0 refcount change on invalid ref 0 ret -22 13:29:03 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000008ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000007000)={0x0, 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB], 0x0, 0x0, 0x0}) dup2(r1, r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000c6dfd0)={0x8, 0x0, &(0x7f0000dd0000)=[@acquire={0x40046304}], 0x0, 0x0, 0x0}) 13:29:03 executing program 4: ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) syz_mount_image$vfat(&(0x7f0000000000)='vfat\x00', &(0x7f00000004c0)='./file0\x00', 0xe000, 0x1, &(0x7f0000000040)=[{&(0x7f0000000100)="eb3c906d6b66732e666174000204010002000270f7f8", 0x16}], 0x0, 0x0) chroot(&(0x7f0000000140)='./file0\x00') umount2(&(0x7f0000000280)='./file0\x00', 0xf6ffffff) [ 303.229732] binder: 11748:11749 IncRefs 0 refcount change on invalid ref 0 ret -22 13:29:03 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000008ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000007000)={0x0, 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB], 0x0, 0x0, 0x0}) dup2(r1, r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000c6dfd0)={0x8, 0x0, &(0x7f0000dd0000)=[@acquire={0x40046304}], 0x0, 0x0, 0x0}) 13:29:03 executing program 1: pipe(0x0) epoll_create(0x0) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x0) pipe(&(0x7f0000000400)={0xffffffffffffffff, 0xffffffffffffffff}) epoll_create1(0x0) write(r1, &(0x7f0000000340), 0x10000014c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clock_gettime(0x0, &(0x7f0000000040)={0x0, 0x0}) ioctl$TIOCGSID(0xffffffffffffffff, 0x5429, 0x0) pselect6(0x40, &(0x7f00000000c0), 0x0, &(0x7f0000000140)={0x1b7}, &(0x7f0000000200)={0x0, r2+30000000}, 0x0) vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) 13:29:03 executing program 4: ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) syz_mount_image$vfat(&(0x7f0000000000)='vfat\x00', &(0x7f00000004c0)='./file0\x00', 0xe000, 0x1, &(0x7f0000000040)=[{&(0x7f0000000100)="eb3c906d6b66732e666174000204010002000270f7f8", 0x16}], 0x0, 0x0) chroot(&(0x7f0000000140)='./file0\x00') umount2(&(0x7f0000000280)='./file0\x00', 0x1000000) [ 303.474702] binder: 11757:11758 IncRefs 0 refcount change on invalid ref 0 ret -22 13:29:03 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000008ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000007000)={0x0, 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB], 0x0, 0x0, 0x0}) dup2(r1, r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000c6dfd0)={0x8, 0x0, &(0x7f0000dd0000)=[@acquire={0x40046304}], 0x0, 0x0, 0x0}) 13:29:03 executing program 2: pipe(&(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) epoll_create(0x0) dup3(r1, r0, 0x0) pipe(&(0x7f0000000400)={0xffffffffffffffff, 0xffffffffffffffff}) epoll_create1(0x0) write(r3, &(0x7f0000000340), 0x10000014c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clock_gettime(0x0, &(0x7f0000000040)={0x0, 0x0}) pselect6(0x40, &(0x7f00000000c0), 0x0, &(0x7f0000000140)={0x1b7}, &(0x7f0000000200)={0x0, r4+30000000}, 0x0) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) 13:29:03 executing program 3: pipe(&(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) epoll_create(0x0) dup3(r1, r0, 0x0) pipe(&(0x7f0000000400)={0xffffffffffffffff}) epoll_create1(0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clock_gettime(0x0, &(0x7f0000000040)={0x0, 0x0}) ioctl$TIOCGSID(0xffffffffffffffff, 0x5429, 0x0) pselect6(0x40, &(0x7f00000000c0), 0x0, &(0x7f0000000140)={0x1b7}, &(0x7f0000000200)={0x0, r3+30000000}, 0x0) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) 13:29:03 executing program 4: ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) syz_mount_image$vfat(&(0x7f0000000000)='vfat\x00', &(0x7f00000004c0)='./file0\x00', 0xe000, 0x1, &(0x7f0000000040)=[{&(0x7f0000000100)="eb3c906d6b66732e666174000204010002000270f7f8", 0x16}], 0x0, 0x0) chroot(&(0x7f0000000140)='./file0\x00') umount2(&(0x7f0000000280)='./file0\x00', 0x2) [ 303.726784] binder: 11774:11775 IncRefs 0 refcount change on invalid ref 0 ret -22 13:29:04 executing program 0: pipe(&(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) epoll_create(0x0) dup3(r1, r0, 0x0) pipe(&(0x7f0000000400)={0xffffffffffffffff, 0xffffffffffffffff}) write(r3, &(0x7f0000000340), 0x10000014c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clock_gettime(0x0, &(0x7f0000000040)={0x0, 0x0}) ioctl$TIOCGSID(0xffffffffffffffff, 0x5429, 0x0) pselect6(0x40, &(0x7f00000000c0), 0x0, &(0x7f0000000140)={0x1b7}, &(0x7f0000000200)={0x0, r4+30000000}, 0x0) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) 13:29:04 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000008ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000007000)={0x2, 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB="0563"], 0x0, 0x0, 0x0}) dup2(r1, r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000c6dfd0)={0x8, 0x0, &(0x7f0000dd0000)=[@acquire={0x40046304}], 0x0, 0x0, 0x0}) [ 304.002983] binder: 11788:11789 unknown command 25349 [ 304.015812] binder: 11788:11789 ioctl c0306201 20007000 returned -22 [ 304.027197] binder: 11788:11789 IncRefs 0 refcount change on invalid ref 0 ret -22 13:29:04 executing program 4: ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) syz_mount_image$vfat(&(0x7f0000000000)='vfat\x00', &(0x7f00000004c0)='./file0\x00', 0xe000, 0x1, &(0x7f0000000040)=[{&(0x7f0000000100)="eb3c906d6b66732e666174000204010002000270f7f8", 0x16}], 0x0, 0x0) chroot(&(0x7f0000000140)='./file0\x00') umount2(&(0x7f0000000280)='./file0\x00', 0xffffff8c) 13:29:04 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000008ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000007000)={0x2, 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB="0563"], 0x0, 0x0, 0x0}) dup2(r1, r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000c6dfd0)={0x8, 0x0, &(0x7f0000dd0000)=[@acquire={0x40046304}], 0x0, 0x0, 0x0}) [ 304.307636] binder: 11802:11803 unknown command 25349 13:29:04 executing program 1: pipe(&(0x7f00000000c0)={0xffffffffffffffff}) epoll_create(0x0) dup3(0xffffffffffffffff, r0, 0x0) pipe(&(0x7f0000000400)={0xffffffffffffffff, 0xffffffffffffffff}) epoll_create1(0x0) write(r2, &(0x7f0000000340), 0x10000014c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clock_gettime(0x0, &(0x7f0000000040)={0x0, 0x0}) ioctl$TIOCGSID(0xffffffffffffffff, 0x5429, 0x0) pselect6(0x40, &(0x7f00000000c0), 0x0, &(0x7f0000000140)={0x1b7}, &(0x7f0000000200)={0x0, r3+30000000}, 0x0) vmsplice(r1, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) [ 304.339318] binder: 11802:11803 ioctl c0306201 20007000 returned -22 [ 304.374864] binder: 11802:11803 IncRefs 0 refcount change on invalid ref 0 ret -22 13:29:04 executing program 4: ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) syz_mount_image$vfat(&(0x7f0000000000)='vfat\x00', &(0x7f00000004c0)='./file0\x00', 0xe000, 0x1, &(0x7f0000000040)=[{&(0x7f0000000100)="eb3c906d6b66732e666174000204010002000270f7f8", 0x16}], 0x0, 0x0) chroot(&(0x7f0000000140)='./file0\x00') umount2(&(0x7f0000000280)='./file0\x00', 0xf6ffffff00000000) 13:29:04 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000008ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000007000)={0x2, 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB="0563"], 0x0, 0x0, 0x0}) dup2(r1, r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000c6dfd0)={0x8, 0x0, &(0x7f0000dd0000)=[@acquire={0x40046304}], 0x0, 0x0, 0x0}) [ 304.557177] binder: 11811:11812 unknown command 25349 13:29:04 executing program 3 (fault-call:3 fault-nth:0): r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) ioctl$TIOCGLCKTRMIOS(r0, 0x402c542c, &(0x7f00000000c0)) [ 304.618370] binder: 11811:11812 ioctl c0306201 20007000 returned -22 [ 304.694415] binder: 11811:11818 IncRefs 0 refcount change on invalid ref 0 ret -22 13:29:04 executing program 4: ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) syz_mount_image$vfat(&(0x7f0000000000)='vfat\x00', &(0x7f00000004c0)='./file0\x00', 0xe000, 0x1, &(0x7f0000000040)=[{&(0x7f0000000100)="eb3c906d6b66732e666174000204010002000270f7f8", 0x16}], 0x0, 0x0) chroot(&(0x7f0000000140)='./file0\x00') umount2(&(0x7f0000000280)='./file0\x00', 0x200000000000000) 13:29:05 executing program 2: pipe(&(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) epoll_create(0x0) dup3(r1, r0, 0x0) pipe(&(0x7f0000000400)={0xffffffffffffffff, 0xffffffffffffffff}) epoll_create1(0x0) write(r2, &(0x7f0000000340), 0x10000014c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clock_gettime(0x0, &(0x7f0000000040)={0x0, 0x0}) pselect6(0x40, &(0x7f00000000c0), 0x0, &(0x7f0000000140)={0x1b7}, &(0x7f0000000200)={0x0, r3+30000000}, 0x0) 13:29:05 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000008ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000007000)={0x3, 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB="056304"], 0x0, 0x0, 0x0}) dup2(r1, r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000c6dfd0)={0x8, 0x0, &(0x7f0000dd0000)=[@acquire={0x40046304}], 0x0, 0x0, 0x0}) 13:29:05 executing program 3: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) ioctl$TIOCGLCKTRMIOS(r0, 0x402c542c, &(0x7f00000000c0)) [ 305.036475] binder: 11830:11833 unknown command 287493 [ 305.074203] binder: 11830:11833 ioctl c0306201 20007000 returned -22 13:29:05 executing program 4: ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) syz_mount_image$vfat(&(0x7f0000000000)='vfat\x00', &(0x7f00000004c0)='./file0\x00', 0xe000, 0x1, &(0x7f0000000040)=[{&(0x7f0000000100)="eb3c906d6b66732e666174000204010002000270f7f8", 0x16}], 0x0, 0x0) chroot(&(0x7f0000000140)='./file0\x00') umount2(&(0x7f0000000280)='./file0\x00', 0x8cffffff) 13:29:05 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000008ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000007000)={0x3, 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB="056304"], 0x0, 0x0, 0x0}) dup2(r1, r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000c6dfd0)={0x8, 0x0, &(0x7f0000dd0000)=[@acquire={0x40046304}], 0x0, 0x0, 0x0}) 13:29:05 executing program 3: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) ioctl$TIOCGLCKTRMIOS(r0, 0x5425, &(0x7f00000000c0)) 13:29:05 executing program 0 (fault-call:1 fault-nth:0): r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000080)=0x6) [ 305.290000] binder: 11844:11846 unknown command 287493 [ 305.328959] binder: 11844:11846 ioctl c0306201 20007000 returned -22 [ 305.369054] FAULT_INJECTION: forcing a failure. 13:29:05 executing program 1: pipe(&(0x7f00000000c0)={0xffffffffffffffff}) epoll_create(0x0) dup3(0xffffffffffffffff, r0, 0x0) pipe(&(0x7f0000000400)={0xffffffffffffffff, 0xffffffffffffffff}) epoll_create1(0x0) write(r2, &(0x7f0000000340), 0x10000014c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clock_gettime(0x0, &(0x7f0000000040)={0x0, 0x0}) ioctl$TIOCGSID(0xffffffffffffffff, 0x5429, 0x0) pselect6(0x40, &(0x7f00000000c0), 0x0, &(0x7f0000000140)={0x1b7}, &(0x7f0000000200)={0x0, r3+30000000}, 0x0) vmsplice(r1, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) [ 305.369054] name failslab, interval 1, probability 0, space 0, times 1 [ 305.389179] binder: 11844:11846 IncRefs 0 refcount change on invalid ref 0 ret -22 [ 305.415183] CPU: 0 PID: 11851 Comm: syz-executor0 Not tainted 4.20.0+ #174 [ 305.422216] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 305.431659] Call Trace: [ 305.434362] dump_stack+0x1d3/0x2c6 [ 305.438013] ? dump_stack_print_info.cold.1+0x20/0x20 [ 305.443281] ? debug_smp_processor_id+0x1c/0x20 [ 305.447974] ? perf_trace_lock+0x14d/0x7a0 [ 305.452267] should_fail.cold.4+0xa/0x17 [ 305.456349] ? fault_create_debugfs_attr+0x1f0/0x1f0 [ 305.461476] ? check_preemption_disabled+0x48/0x280 [ 305.466503] ? perf_trace_lock+0x14d/0x7a0 [ 305.470749] ? graph_lock+0x270/0x270 [ 305.474615] ? kasan_check_write+0x14/0x20 13:29:05 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000008ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000007000)={0x3, 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB="056304"], 0x0, 0x0, 0x0}) dup2(r1, r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000c6dfd0)={0x8, 0x0, &(0x7f0000dd0000)=[@acquire={0x40046304}], 0x0, 0x0, 0x0}) 13:29:05 executing program 4: ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) syz_mount_image$vfat(&(0x7f0000000000)='vfat\x00', &(0x7f00000004c0)='./file0\x00', 0xe000, 0x1, &(0x7f0000000040)=[{&(0x7f0000000100)="eb3c906d6b66732e666174000204010002000270f7f8", 0x16}], 0x0, 0x0) chroot(&(0x7f0000000140)='./file0\x00') umount2(&(0x7f0000000280)='./file0\x00', 0xfffffff6) [ 305.478976] ? __mutex_unlock_slowpath+0x197/0x8c0 [ 305.483950] ? find_held_lock+0x36/0x1c0 [ 305.484028] ? __lock_is_held+0xb5/0x140 [ 305.484081] ? ___might_sleep+0x1ed/0x300 [ 305.484097] ? arch_local_save_flags+0x40/0x40 [ 305.492419] __should_failslab+0x124/0x180 [ 305.492461] should_failslab+0x9/0x14 [ 305.492477] __kmalloc+0x2e4/0x760 [ 305.492536] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 305.492627] ? x25_asy_open_tty+0x32a/0x7e7 [ 305.522735] x25_asy_open_tty+0x32a/0x7e7 [ 305.526895] ? x25_asy_close_tty+0x220/0x220 [ 305.531359] ? up_write+0x7b/0x220 [ 305.533858] binder: 11862:11863 unknown command 287493 [ 305.534915] ? down_write_nested+0x130/0x130 [ 305.534943] ? down_read+0x120/0x120 [ 305.534996] ? x25_asy_close_tty+0x220/0x220 [ 305.535068] tty_ldisc_open.isra.0+0x8b/0xe0 [ 305.535085] tty_set_ldisc+0x2d3/0x6a0 [ 305.540585] binder: 11862:11863 ioctl c0306201 20007000 returned -22 [ 305.544763] tty_ioctl+0x39d/0x17d0 [ 305.544782] ? tty_vhangup+0x30/0x30 [ 305.544795] ? find_held_lock+0x36/0x1c0 [ 305.544833] ? __fget+0x4aa/0x740 [ 305.544850] ? lock_downgrade+0x900/0x900 [ 305.577296] binder: 11862:11863 IncRefs 0 refcount change on invalid ref 0 ret -22 [ 305.579146] ? check_preemption_disabled+0x48/0x280 [ 305.579168] ? kasan_check_read+0x11/0x20 [ 305.579220] ? rcu_dynticks_curr_cpu_in_eqs+0xa2/0x170 [ 305.579254] ? rcu_read_unlock_special+0x370/0x370 [ 305.613957] ? __fget+0x4d1/0x740 [ 305.617423] ? ksys_dup3+0x680/0x680 [ 305.621190] ? __mutex_unlock_slowpath+0x197/0x8c0 [ 305.626132] ? tty_vhangup+0x30/0x30 13:29:05 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000008ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000007000)={0x4, 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) dup2(0xffffffffffffffff, r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000c6dfd0)={0x8, 0x0, &(0x7f0000dd0000)=[@acquire={0x40046304}], 0x0, 0x0, 0x0}) [ 305.629912] do_vfs_ioctl+0x1de/0x1790 [ 305.633812] ? ioctl_preallocate+0x300/0x300 [ 305.638230] ? memset+0x31/0x40 [ 305.641525] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 305.647145] ? smack_file_ioctl+0x210/0x3c0 [ 305.651477] ? fget_raw+0x20/0x20 [ 305.654939] ? smack_file_lock+0x2e0/0x2e0 [ 305.659226] ? fput+0x130/0x1a0 [ 305.662569] ? do_syscall_64+0x9a/0x820 [ 305.666584] ? do_syscall_64+0x9a/0x820 [ 305.670589] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 305.676184] ? security_file_ioctl+0x94/0xc0 [ 305.680622] ksys_ioctl+0xa9/0xd0 [ 305.684091] __x64_sys_ioctl+0x73/0xb0 [ 305.688003] do_syscall_64+0x1b9/0x820 [ 305.691904] ? entry_SYSCALL_64_after_hwframe+0x3e/0xbe [ 305.697278] ? syscall_return_slowpath+0x5e0/0x5e0 [ 305.702232] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 305.707101] ? trace_hardirqs_on_caller+0x310/0x310 [ 305.712130] ? prepare_exit_to_usermode+0x3b0/0x3b0 [ 305.717151] ? prepare_exit_to_usermode+0x291/0x3b0 [ 305.722176] ? trace_hardirqs_off_thunk+0x1a/0x1c 13:29:05 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000008ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000007000)={0x4, 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) dup2(0xffffffffffffffff, r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000c6dfd0)={0x8, 0x0, &(0x7f0000dd0000)=[@acquire={0x40046304}], 0x0, 0x0, 0x0}) [ 305.727030] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 305.732221] RIP: 0033:0x4579b9 [ 305.735420] Code: fd b3 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 cb b3 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 305.754329] RSP: 002b:00007fa3cf433c78 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 305.762057] RAX: ffffffffffffffda RBX: 00007fa3cf433c90 RCX: 00000000004579b9 [ 305.769329] RDX: 0000000020000080 RSI: 0000000000005423 RDI: 0000000000000003 [ 305.776610] RBP: 000000000073bf00 R08: 0000000000000000 R09: 0000000000000000 [ 305.783885] R10: 0000000000000000 R11: 0000000000000246 R12: 00007fa3cf4346d4 [ 305.791157] R13: 00000000004c1cbc R14: 00000000004d3fa8 R15: 0000000000000004 13:29:05 executing program 3: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) ioctl$TIOCGLCKTRMIOS(r0, 0x5434, &(0x7f00000000c0)) 13:29:05 executing program 0 (fault-call:1 fault-nth:1): r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000080)=0x6) 13:29:05 executing program 2: pipe(&(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) epoll_create(0x0) dup3(r1, r0, 0x0) pipe(&(0x7f0000000400)={0xffffffffffffffff, 0xffffffffffffffff}) epoll_create1(0x0) write(r2, &(0x7f0000000340), 0x10000014c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clock_gettime(0x0, &(0x7f0000000040)={0x0, 0x0}) pselect6(0x40, &(0x7f00000000c0), 0x0, &(0x7f0000000140)={0x1b7}, &(0x7f0000000200)={0x0, r3+30000000}, 0x0) 13:29:05 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000008ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000007000)={0x4, 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) dup2(0xffffffffffffffff, r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000c6dfd0)={0x8, 0x0, &(0x7f0000dd0000)=[@acquire={0x40046304}], 0x0, 0x0, 0x0}) 13:29:06 executing program 4: ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) syz_mount_image$vfat(&(0x7f0000000000)='vfat\x00', &(0x7f00000004c0)='./file0\x00', 0xe000, 0x1, &(0x7f0000000040)=[{&(0x7f0000000100)="eb3c906d6b66732e666174000204010002000270f7f8", 0x16}], 0x0, 0x0) chroot(&(0x7f0000000140)='./file0\x00') umount2(&(0x7f0000000280)='./file0\x00', 0x100000000000000) [ 306.050783] FAULT_INJECTION: forcing a failure. [ 306.050783] name failslab, interval 1, probability 0, space 0, times 0 13:29:06 executing program 3: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) ioctl$TIOCGLCKTRMIOS(r0, 0x40049409, &(0x7f00000000c0)) [ 306.095322] CPU: 0 PID: 11883 Comm: syz-executor0 Not tainted 4.20.0+ #174 [ 306.102364] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 306.111734] Call Trace: [ 306.114352] dump_stack+0x1d3/0x2c6 [ 306.117999] ? dump_stack_print_info.cold.1+0x20/0x20 [ 306.123348] ? __kernel_text_address+0xd/0x40 [ 306.127945] ? unwind_get_return_address+0x61/0xa0 [ 306.132899] should_fail.cold.4+0xa/0x17 [ 306.136988] ? fault_create_debugfs_attr+0x1f0/0x1f0 [ 306.137043] ? save_stack+0x43/0xd0 [ 306.137055] ? kasan_kmalloc+0xcb/0xd0 [ 306.137066] ? __kmalloc+0x15d/0x760 [ 306.137083] ? x25_asy_open_tty+0x32a/0x7e7 [ 306.157673] ? tty_ldisc_open.isra.0+0x8b/0xe0 [ 306.162261] ? graph_lock+0x270/0x270 [ 306.166078] ? ksys_ioctl+0xa9/0xd0 [ 306.169710] ? __x64_sys_ioctl+0x73/0xb0 [ 306.173778] ? do_syscall_64+0x1b9/0x820 [ 306.177874] ? entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 306.183248] ? __mutex_unlock_slowpath+0x197/0x8c0 [ 306.188200] ? find_held_lock+0x36/0x1c0 [ 306.192266] ? __lock_is_held+0xb5/0x140 [ 306.196345] ? ___might_sleep+0x1ed/0x300 [ 306.200496] ? arch_local_save_flags+0x40/0x40 [ 306.205115] __should_failslab+0x124/0x180 [ 306.209374] should_failslab+0x9/0x14 [ 306.213177] __kmalloc+0x2e4/0x760 [ 306.216724] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 306.222271] ? x25_asy_open_tty+0x372/0x7e7 [ 306.226611] x25_asy_open_tty+0x372/0x7e7 [ 306.230779] ? x25_asy_close_tty+0x220/0x220 [ 306.235212] ? up_write+0x7b/0x220 [ 306.238756] ? down_write_nested+0x130/0x130 [ 306.243167] ? down_read+0x120/0x120 [ 306.246885] ? x25_asy_close_tty+0x220/0x220 [ 306.251326] tty_ldisc_open.isra.0+0x8b/0xe0 [ 306.255751] tty_set_ldisc+0x2d3/0x6a0 [ 306.259649] tty_ioctl+0x39d/0x17d0 [ 306.263286] ? tty_vhangup+0x30/0x30 [ 306.266999] ? find_held_lock+0x36/0x1c0 [ 306.271074] ? __fget+0x4aa/0x740 [ 306.274528] ? lock_downgrade+0x900/0x900 [ 306.278692] ? check_preemption_disabled+0x48/0x280 [ 306.283719] ? kasan_check_read+0x11/0x20 [ 306.287873] ? rcu_dynticks_curr_cpu_in_eqs+0xa2/0x170 [ 306.293170] ? rcu_read_unlock_special+0x370/0x370 [ 306.298118] ? __fget+0x4d1/0x740 [ 306.301611] ? ksys_dup3+0x680/0x680 [ 306.305401] ? __mutex_unlock_slowpath+0x197/0x8c0 [ 306.310340] ? tty_vhangup+0x30/0x30 [ 306.314056] do_vfs_ioctl+0x1de/0x1790 [ 306.317948] ? __lock_is_held+0xb5/0x140 [ 306.322020] ? ioctl_preallocate+0x300/0x300 [ 306.326431] ? memset+0x31/0x40 [ 306.329719] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 306.335277] ? smack_file_ioctl+0x210/0x3c0 [ 306.339599] ? fget_raw+0x20/0x20 [ 306.343070] ? smack_file_lock+0x2e0/0x2e0 [ 306.347323] ? fput+0x130/0x1a0 [ 306.350606] ? do_syscall_64+0x9a/0x820 [ 306.354587] ? do_syscall_64+0x9a/0x820 [ 306.358602] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 306.364149] ? security_file_ioctl+0x94/0xc0 [ 306.368583] ksys_ioctl+0xa9/0xd0 [ 306.372050] __x64_sys_ioctl+0x73/0xb0 [ 306.375948] do_syscall_64+0x1b9/0x820 [ 306.379838] ? entry_SYSCALL_64_after_hwframe+0x3e/0xbe [ 306.385210] ? syscall_return_slowpath+0x5e0/0x5e0 [ 306.390142] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 306.394988] ? trace_hardirqs_on_caller+0x310/0x310 [ 306.400050] ? prepare_exit_to_usermode+0x3b0/0x3b0 [ 306.405086] ? prepare_exit_to_usermode+0x291/0x3b0 [ 306.410117] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 306.414974] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 306.420185] RIP: 0033:0x4579b9 [ 306.423397] Code: fd b3 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 cb b3 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 306.442315] RSP: 002b:00007fa3cf433c78 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 306.450026] RAX: ffffffffffffffda RBX: 00007fa3cf433c90 RCX: 00000000004579b9 [ 306.457292] RDX: 0000000020000080 RSI: 0000000000005423 RDI: 0000000000000003 [ 306.464572] RBP: 000000000073bf00 R08: 0000000000000000 R09: 0000000000000000 [ 306.471856] R10: 0000000000000000 R11: 0000000000000246 R12: 00007fa3cf4346d4 [ 306.479121] R13: 00000000004c1cbc R14: 00000000004d3fa8 R15: 0000000000000004 [ 306.500306] ================================================================== [ 306.507804] BUG: KASAN: double-free or invalid-free in x25_asy_free+0x37/0x140 [ 306.515186] [ 306.516825] CPU: 1 PID: 11883 Comm: syz-executor0 Not tainted 4.20.0+ #174 [ 306.523860] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 306.533219] Call Trace: [ 306.535856] dump_stack+0x1d3/0x2c6 [ 306.539508] ? dump_stack_print_info.cold.1+0x20/0x20 [ 306.544808] ? printk+0xa7/0xcf [ 306.548110] ? kmsg_dump_rewind_nolock+0xe4/0xe4 [ 306.552868] ? debug_check_no_obj_freed+0x305/0x58d [ 306.557901] print_address_description.cold.5+0x9/0x1ff [ 306.563287] ? x25_asy_free+0x37/0x140 [ 306.567180] kasan_report_invalid_free+0x64/0xa0 [ 306.571939] ? x25_asy_free+0x37/0x140 [ 306.575840] __kasan_slab_free+0x13a/0x150 [ 306.580083] ? x25_asy_free+0x37/0x140 [ 306.583974] kasan_slab_free+0xe/0x10 [ 306.587774] kfree+0xcf/0x230 [ 306.590887] x25_asy_free+0x37/0x140 [ 306.594605] x25_asy_open_tty+0x6ad/0x7e7 [ 306.598776] ? x25_asy_close_tty+0x220/0x220 [ 306.603203] ? up_write+0x7b/0x220 [ 306.606745] ? down_write_nested+0x130/0x130 [ 306.611152] ? down_read+0x120/0x120 [ 306.614880] ? x25_asy_close_tty+0x220/0x220 [ 306.619296] tty_ldisc_open.isra.0+0x8b/0xe0 [ 306.623709] tty_set_ldisc+0x2d3/0x6a0 [ 306.627614] tty_ioctl+0x39d/0x17d0 [ 306.631250] ? tty_vhangup+0x30/0x30 [ 306.634967] ? find_held_lock+0x36/0x1c0 [ 306.639065] ? __fget+0x4aa/0x740 [ 306.642534] ? lock_downgrade+0x900/0x900 [ 306.646689] ? check_preemption_disabled+0x48/0x280 [ 306.651717] ? kasan_check_read+0x11/0x20 [ 306.655872] ? rcu_dynticks_curr_cpu_in_eqs+0xa2/0x170 [ 306.661156] ? rcu_read_unlock_special+0x370/0x370 [ 306.666106] ? __fget+0x4d1/0x740 [ 306.669596] ? ksys_dup3+0x680/0x680 [ 306.673330] ? __mutex_unlock_slowpath+0x197/0x8c0 [ 306.678278] ? tty_vhangup+0x30/0x30 [ 306.681992] do_vfs_ioctl+0x1de/0x1790 [ 306.685885] ? __lock_is_held+0xb5/0x140 [ 306.689958] ? ioctl_preallocate+0x300/0x300 [ 306.694368] ? memset+0x31/0x40 [ 306.697654] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 306.703199] ? smack_file_ioctl+0x210/0x3c0 [ 306.707517] ? fget_raw+0x20/0x20 [ 306.710996] ? smack_file_lock+0x2e0/0x2e0 [ 306.715242] ? fput+0x130/0x1a0 [ 306.718529] ? do_syscall_64+0x9a/0x820 [ 306.722513] ? do_syscall_64+0x9a/0x820 [ 306.726499] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 306.732040] ? security_file_ioctl+0x94/0xc0 [ 306.736507] ksys_ioctl+0xa9/0xd0 [ 306.739967] __x64_sys_ioctl+0x73/0xb0 [ 306.743859] do_syscall_64+0x1b9/0x820 [ 306.747752] ? entry_SYSCALL_64_after_hwframe+0x3e/0xbe [ 306.753125] ? syscall_return_slowpath+0x5e0/0x5e0 [ 306.758061] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 306.762908] ? trace_hardirqs_on_caller+0x310/0x310 [ 306.767927] ? prepare_exit_to_usermode+0x3b0/0x3b0 [ 306.772950] ? prepare_exit_to_usermode+0x291/0x3b0 [ 306.777975] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 306.782834] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 306.788041] RIP: 0033:0x4579b9 [ 306.791240] Code: fd b3 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 cb b3 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 306.810143] RSP: 002b:00007fa3cf433c78 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 306.817852] RAX: ffffffffffffffda RBX: 00007fa3cf433c90 RCX: 00000000004579b9 [ 306.825135] RDX: 0000000020000080 RSI: 0000000000005423 RDI: 0000000000000003 [ 306.832404] RBP: 000000000073bf00 R08: 0000000000000000 R09: 0000000000000000 [ 306.839677] R10: 0000000000000000 R11: 0000000000000246 R12: 00007fa3cf4346d4 [ 306.846949] R13: 00000000004c1cbc R14: 00000000004d3fa8 R15: 0000000000000004 [ 306.854239] [ 306.855937] Allocated by task 11883: [ 306.859687] save_stack+0x43/0xd0 [ 306.863140] kasan_kmalloc+0xcb/0xd0 [ 306.866854] __kmalloc+0x15d/0x760 [ 306.870396] x25_asy_open_tty+0x32a/0x7e7 [ 306.874560] tty_ldisc_open.isra.0+0x8b/0xe0 [ 306.878973] tty_set_ldisc+0x2d3/0x6a0 [ 306.882876] tty_ioctl+0x39d/0x17d0 [ 306.886500] do_vfs_ioctl+0x1de/0x1790 [ 306.890385] ksys_ioctl+0xa9/0xd0 [ 306.893837] __x64_sys_ioctl+0x73/0xb0 [ 306.897724] do_syscall_64+0x1b9/0x820 [ 306.901615] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 306.906795] [ 306.908421] Freed by task 11883: [ 306.911784] save_stack+0x43/0xd0 [ 306.915239] __kasan_slab_free+0x102/0x150 [ 306.919763] kasan_slab_free+0xe/0x10 [ 306.923583] kfree+0xcf/0x230 [ 306.926690] x25_asy_open_tty+0x6a0/0x7e7 [ 306.930840] tty_ldisc_open.isra.0+0x8b/0xe0 [ 306.935246] tty_set_ldisc+0x2d3/0x6a0 [ 306.939134] tty_ioctl+0x39d/0x17d0 [ 306.942756] do_vfs_ioctl+0x1de/0x1790 [ 306.946658] ksys_ioctl+0xa9/0xd0 [ 306.950106] __x64_sys_ioctl+0x73/0xb0 [ 306.953990] do_syscall_64+0x1b9/0x820 [ 306.957879] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 306.963055] [ 306.964720] The buggy address belongs to the object at ffff8880a8a8e900 [ 306.964720] which belongs to the cache kmalloc-1k of size 1024 [ 306.977380] The buggy address is located 0 bytes inside of [ 306.977380] 1024-byte region [ffff8880a8a8e900, ffff8880a8a8ed00) [ 306.989188] The buggy address belongs to the page: [ 306.994119] page:ffffea0002a2a380 count:1 mapcount:0 mapping:ffff88812c3f0ac0 index:0x0 compound_mapcount: 0 [ 307.004092] flags: 0x1fffc0000010200(slab|head) [ 307.008769] raw: 01fffc0000010200 ffffea00028cf608 ffffea00027a5f08 ffff88812c3f0ac0 [ 307.016658] raw: 0000000000000000 ffff8880a8a8e000 0000000100000007 0000000000000000 [ 307.024533] page dumped because: kasan: bad access detected [ 307.030244] [ 307.031863] Memory state around the buggy address: [ 307.036805] ffff8880a8a8e800: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 307.044162] ffff8880a8a8e880: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 307.052001] >ffff8880a8a8e900: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 307.059355] ^ [ 307.062761] ffff8880a8a8e980: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 307.070119] ffff8880a8a8ea00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 307.077468] ================================================================== [ 307.084822] Disabling lock debugging due to kernel taint [ 307.090266] Kernel panic - not syncing: panic_on_warn set ... [ 307.096150] CPU: 1 PID: 11883 Comm: syz-executor0 Tainted: G B 4.20.0+ #174 [ 307.104555] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 307.113922] Call Trace: [ 307.116514] dump_stack+0x1d3/0x2c6 [ 307.120169] ? dump_stack_print_info.cold.1+0x20/0x20 [ 307.125369] ? x25_asy_data_transmit+0x660/0x6e0 [ 307.130223] panic+0x2ad/0x55f [ 307.133426] ? add_taint.cold.5+0x16/0x16 [ 307.137594] ? add_taint.cold.5+0x5/0x16 [ 307.141652] ? trace_hardirqs_off+0xaf/0x310 [ 307.146078] ? x25_asy_free+0x37/0x140 [ 307.149969] end_report+0x47/0x4f [ 307.153437] kasan_report_invalid_free+0x81/0xa0 [ 307.158204] ? x25_asy_free+0x37/0x140 [ 307.162096] __kasan_slab_free+0x13a/0x150 [ 307.166365] ? x25_asy_free+0x37/0x140 [ 307.170249] kasan_slab_free+0xe/0x10 [ 307.174065] kfree+0xcf/0x230 [ 307.177219] x25_asy_free+0x37/0x140 [ 307.180939] x25_asy_open_tty+0x6ad/0x7e7 [ 307.185091] ? x25_asy_close_tty+0x220/0x220 [ 307.189503] ? up_write+0x7b/0x220 [ 307.193066] ? down_write_nested+0x130/0x130 [ 307.197470] ? down_read+0x120/0x120 [ 307.201190] ? x25_asy_close_tty+0x220/0x220 [ 307.205604] tty_ldisc_open.isra.0+0x8b/0xe0 [ 307.210014] tty_set_ldisc+0x2d3/0x6a0 [ 307.213904] tty_ioctl+0x39d/0x17d0 [ 307.217533] ? tty_vhangup+0x30/0x30 [ 307.221249] ? find_held_lock+0x36/0x1c0 [ 307.225314] ? __fget+0x4aa/0x740 [ 307.228768] ? lock_downgrade+0x900/0x900 [ 307.232945] ? check_preemption_disabled+0x48/0x280 [ 307.237962] ? kasan_check_read+0x11/0x20 [ 307.242133] ? rcu_dynticks_curr_cpu_in_eqs+0xa2/0x170 [ 307.247410] ? rcu_read_unlock_special+0x370/0x370 [ 307.252346] ? __fget+0x4d1/0x740 [ 307.255803] ? ksys_dup3+0x680/0x680 [ 307.259527] ? __mutex_unlock_slowpath+0x197/0x8c0 [ 307.264583] ? tty_vhangup+0x30/0x30 [ 307.268299] do_vfs_ioctl+0x1de/0x1790 [ 307.272188] ? __lock_is_held+0xb5/0x140 [ 307.276253] ? ioctl_preallocate+0x300/0x300 [ 307.280704] ? memset+0x31/0x40 [ 307.283991] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 307.289533] ? smack_file_ioctl+0x210/0x3c0 [ 307.293872] ? fget_raw+0x20/0x20 [ 307.297322] ? smack_file_lock+0x2e0/0x2e0 [ 307.301580] ? fput+0x130/0x1a0 [ 307.304860] ? do_syscall_64+0x9a/0x820 [ 307.308855] ? do_syscall_64+0x9a/0x820 [ 307.312834] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 307.318379] ? security_file_ioctl+0x94/0xc0 [ 307.322795] ksys_ioctl+0xa9/0xd0 [ 307.326270] __x64_sys_ioctl+0x73/0xb0 [ 307.330158] do_syscall_64+0x1b9/0x820 [ 307.334047] ? entry_SYSCALL_64_after_hwframe+0x3e/0xbe [ 307.339416] ? syscall_return_slowpath+0x5e0/0x5e0 [ 307.344346] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 307.349189] ? trace_hardirqs_on_caller+0x310/0x310 [ 307.354204] ? prepare_exit_to_usermode+0x3b0/0x3b0 [ 307.359228] ? prepare_exit_to_usermode+0x291/0x3b0 [ 307.364281] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 307.369131] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 307.374318] RIP: 0033:0x4579b9 [ 307.377557] Code: fd b3 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 cb b3 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 307.396464] RSP: 002b:00007fa3cf433c78 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 307.404172] RAX: ffffffffffffffda RBX: 00007fa3cf433c90 RCX: 00000000004579b9 [ 307.411443] RDX: 0000000020000080 RSI: 0000000000005423 RDI: 0000000000000003 [ 307.418729] RBP: 000000000073bf00 R08: 0000000000000000 R09: 0000000000000000 [ 307.425996] R10: 0000000000000000 R11: 0000000000000246 R12: 00007fa3cf4346d4 [ 307.433263] R13: 00000000004c1cbc R14: 00000000004d3fa8 R15: 0000000000000004 [ 307.441579] Kernel Offset: disabled [ 307.445208] Rebooting in 86400 seconds..