001400)=@ipx, 0x80, 0x0}}], 0x1, 0x0, 0x0)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = syz_open_procfs(0x0, &(0x7f00000004c0)='net/rt_cache\x00')
preadv(r0, &(0x7f00000017c0), 0x89, 0x0)

[  371.457079] binder: BINDER_SET_CONTEXT_MGR already set
[  371.462512] binder: 16809:16822 ioctl 40046207 0 returned -16
[  371.464758] binder: BINDER_SET_CONTEXT_MGR already set
05:02:21 executing program 3:
recvmmsg(0xffffffffffffffff, &(0x7f0000003140)=[{{&(0x7f0000001400)=@ipx, 0x80, 0x0}}], 0x1, 0x0, 0x0)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = syz_open_procfs(0x0, &(0x7f00000004c0)='net/rt_cache\x00')
preadv(r0, &(0x7f00000017c0), 0x89, 0x0)

05:02:21 executing program 4:
r0 = socket$inet(0x2, 0x4000000000000001, 0x0)
sched_setaffinity(0x0, 0x8, &(0x7f0000000140)=0x40000000000009)
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
ioctl$UI_ABS_SETUP(0xffffffffffffffff, 0x401c5504, &(0x7f0000000500)={0x3, {0x0, 0x0, 0x0, 0x1ff, 0x6}})
openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000004c0)='./cgroup/syz0\x00', 0x200002, 0x0)
write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x18, 0xfa00, {0x0, 0x0, 0x106, 0x100b}}, 0x20)
accept4(r0, &(0x7f00000001c0)=@hci, &(0x7f0000000100)=0x80, 0x0)
r1 = socket$inet6_tcp(0xa, 0x1, 0x0)
setsockopt$inet6_tcp_int(r1, 0x6, 0x2, &(0x7f00000000c0)=0x201, 0x4)
bind$inet6(r1, &(0x7f0000000000)={0xa, 0x4e22}, 0x1c)
personality(0x0)
listen(r1, 0x0)
getitimer(0x2, &(0x7f0000000380))
r2 = socket$inet6_tcp(0xa, 0x1, 0x0)
setsockopt$inet6_tcp_TCP_CONGESTION(r2, 0x6, 0xd, &(0x7f0000000240)='hybla\x00', 0x6)
r3 = userfaultfd(0x0)
ioctl$UFFDIO_API(r3, 0xc018aa3f, &(0x7f00000000c0))
r4 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000040)='/dev/cuse\x00', 0x0, 0x0)
read(r3, &(0x7f0000000180)=""/223, 0xdf)
ioctl$UFFDIO_REGISTER(r3, 0xc020aa00, &(0x7f0000000000)={{&(0x7f0000068000/0x800000)=nil, 0x800000}, 0x1})
read(r4, &(0x7f0000465f8e)=""/114, 0x72)
ioctl$UFFDIO_UNREGISTER(r3, 0x8010aa01, &(0x7f0000000080)={&(0x7f000001d000/0xc00000)=nil, 0xc00000})
getsockopt$inet6_tcp_int(r1, 0x6, 0x17, &(0x7f0000000400), &(0x7f0000000440)=0x4)
sendto$inet6(r2, &(0x7f0000000280), 0x0, 0x20000004, 0x0, 0x0)
r5 = gettid()
timer_create(0x0, &(0x7f0000000000)={0x0, 0x12, 0x0, @thr={&(0x7f0000000340), 0x0}}, &(0x7f0000044000))
timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x1c9c380}}, &(0x7f0000040000))
tkill(r5, 0x401104000000016)
bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1}, 0x48)
socket$kcm(0xa, 0x5, 0x0)

[  371.558720] binder: BINDER_SET_CONTEXT_MGR already set
[  371.564776] binder: 16816:16824 ioctl 40046207 0 returned -16
[  371.564913] binder: 16809:16837 BC_INCREFS_DONE u0000000000000000 no match
05:02:22 executing program 0:
recvmmsg(0xffffffffffffffff, &(0x7f0000003140)=[{{&(0x7f0000001400)=@ipx, 0x80, 0x0}}], 0x1, 0x0, 0x0)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = syz_open_procfs(0x0, &(0x7f00000004c0)='net/rt_cache\x00')
preadv(r0, &(0x7f00000017c0), 0x8a, 0x0)

[  371.610128] binder: 16807:16834 Release 1 refcount change on invalid ref 1 ret -22
[  371.643857] binder: 16807:16826 ioctl 40046207 0 returned -16
[  371.644291] binder: 16816:16824 Release 1 refcount change on invalid ref 1 ret -22
[  371.680749] binder: 16809:16822 Release 1 refcount change on invalid ref 1 ret -22
[  372.119260] binder: release 16807:16834 transaction 538 out, still active
[  372.133079] binder: release 16809:16822 transaction 537 out, still active
05:02:22 executing program 2:
r0 = syz_open_dev$sndtimer(&(0x7f0000026000)='/dev/snd/timer\x00', 0x0, 0x0)
r1 = dup3(r0, r0, 0x80000)
ioctl$UI_GET_SYSNAME(r1, 0x8040552c, 0x0)
perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8)
bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c)
bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={0xffffffffffffffff, &(0x7f0000000040), 0x0, 0x1}, 0x20)
openat$cgroup_ro(r1, &(0x7f00000004c0)='cpuset.effective_cpus\x00', 0x0, 0x0)
unlink(&(0x7f0000000900)='./file0/file0\x00')
r2 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r3 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r3, 0x0)
ioctl$BINDER_GET_NODE_DEBUG_INFO(r2, 0xc018620b, &(0x7f0000000780))
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f00000000c0)=[@enter_looper], 0x48, 0x0, &(0x7f0000000700)="2ba063fb309ec7fdbfb08e6e91baee7d7d4599fe14129a4d426834556ae420e087d59c0c7be7fcad1abb7e1f8f446f373f611ca1ee9c2231708e18a47bc68a2a79a0b48931f6ff6d"})
ioctl$sock_inet_tcp_SIOCOUTQNSD(r1, 0x894b, &(0x7f0000000480))
getsockopt$inet_IP_IPSEC_POLICY(0xffffffffffffffff, 0x0, 0x10, &(0x7f0000000540)={{{@in6, @in=@remote}}, {{@in6=@ipv4={[], [], @local}}, 0x0, @in6}}, &(0x7f0000000000)=0xe8)
ioctl$BINDER_SET_CONTEXT_MGR(r3, 0x40046207, 0x0)
r4 = dup(r3)
shutdown(r4, 0x1)
prctl$PR_SET_NAME(0xf, &(0x7f0000000380)='/group.stat\x00')
syz_open_dev$binder(&(0x7f0000000880)='/dev/binder#\x00', 0x0, 0x2)
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)})
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, &(0x7f0000000780)})
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f0000000680)})
creat(&(0x7f00000000c0)='./file0\x00', 0x0)
openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000100)='/group.stat\x00', 0x2761, 0x0)
clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000080), 0xffffffffffffffff)
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000003c0)={0x14, 0x0, &(0x7f0000000680)=[@acquire_done], 0x0, 0x0, 0x0})

05:02:22 executing program 3:
recvmmsg(0xffffffffffffffff, &(0x7f0000003140)=[{{&(0x7f0000001400)=@ipx, 0x80, 0x0}}], 0x1, 0x0, 0x0)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = syz_open_procfs(0x0, &(0x7f00000004c0)='net/rt_cache\x00')
preadv(r0, &(0x7f00000017c0), 0x8a, 0x0)

05:02:22 executing program 0:
recvmmsg(0xffffffffffffffff, &(0x7f0000003140)=[{{&(0x7f0000001400)=@ipx, 0x80, 0x0}}], 0x1, 0x0, 0x0)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = syz_open_procfs(0x0, &(0x7f00000004c0)='net/rt_cache\x00')
preadv(r0, &(0x7f00000017c0), 0x8b, 0x0)

05:02:22 executing program 4:
r0 = syz_open_dev$sndtimer(&(0x7f0000026000)='/dev/snd/timer\x00', 0x0, 0x0)
r1 = dup3(r0, r0, 0x80000)
ioctl$UI_GET_SYSNAME(r1, 0x8040552c, 0x0)
perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x0, 0x9, 0x0, 0x0, 0x0, 0x7, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8)
r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c)
bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r2, &(0x7f0000000040), 0x0, 0x1}, 0x20)
openat$cgroup_ro(r1, &(0x7f00000004c0)='cpuset.effective_cpus\x00', 0x0, 0x0)
unlink(&(0x7f0000000900)='./file0/file0\x00')
r3 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r4 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r4, 0x0)
ioctl$BINDER_GET_NODE_DEBUG_INFO(r3, 0xc018620b, &(0x7f0000000780))
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f00000000c0)=[@enter_looper], 0x48, 0x0, &(0x7f0000000700)="2ba063fb309ec7fdbfb08e6e91baee7d7d4599fe14129a4d426834556ae420e087d59c0c7be7fcad1abb7e1f8f446f373f611ca1ee9c2231708e18a47bc68a2a79a0b48931f6ff6d"})
ioctl$sock_inet_tcp_SIOCOUTQNSD(r1, 0x894b, &(0x7f0000000480))
getsockopt$inet_IP_IPSEC_POLICY(0xffffffffffffffff, 0x0, 0x10, &(0x7f0000000540)={{{@in6, @in=@remote}}, {{@in6=@ipv4={[], [], @local}}, 0x0, @in6}}, &(0x7f0000000000)=0xe8)
ioctl$BINDER_SET_CONTEXT_MGR(r4, 0x40046207, 0x0)
r5 = dup(r4)
shutdown(r5, 0x1)
prctl$PR_SET_NAME(0xf, &(0x7f0000000380)='/group.stat\x00')
syz_open_dev$binder(&(0x7f0000000880)='/dev/binder#\x00', 0x0, 0x2)
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)})
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, &(0x7f0000000780)})
ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f0000000680)})
creat(&(0x7f00000000c0)='./file0\x00', 0x0)
openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000100)='/group.stat\x00', 0x2761, 0x0)
clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000080), 0xffffffffffffffff)
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000003c0)={0x14, 0x0, &(0x7f0000000680)=[@acquire_done], 0x0, 0x0, 0x0})

05:02:22 executing program 5:
r0 = syz_open_dev$sndtimer(&(0x7f0000026000)='/dev/snd/timer\x00', 0x0, 0x0)
r1 = dup3(r0, r0, 0x80000)
ioctl$UI_GET_SYSNAME(r1, 0x8040552c, 0x0)
perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x0, 0x9, 0x0, 0x0, 0x0, 0x7, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8)
r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c)
bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r2, &(0x7f0000000040), 0x0, 0x1}, 0x20)
openat$cgroup_ro(r1, &(0x7f00000004c0)='cpuset.effective_cpus\x00', 0x0, 0x0)
unlink(&(0x7f0000000900)='./file0/file0\x00')
r3 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r4 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r4, 0x0)
ioctl$BINDER_GET_NODE_DEBUG_INFO(r3, 0xc018620b, &(0x7f0000000780))
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f00000000c0)=[@enter_looper], 0x48, 0x0, &(0x7f0000000700)="2ba063fb309ec7fdbfb08e6e91baee7d7d4599fe14129a4d426834556ae420e087d59c0c7be7fcad1abb7e1f8f446f373f611ca1ee9c2231708e18a47bc68a2a79a0b48931f6ff6d"})
ioctl$sock_inet_tcp_SIOCOUTQNSD(r1, 0x894b, &(0x7f0000000480))
getsockopt$inet_IP_IPSEC_POLICY(0xffffffffffffffff, 0x0, 0x10, &(0x7f0000000540)={{{@in6, @in=@remote}}, {{@in6=@ipv4={[], [], @local}}, 0x0, @in6}}, &(0x7f0000000000)=0xe8)
ioctl$BINDER_SET_CONTEXT_MGR(r4, 0x40046207, 0x0)
r5 = dup(r4)
shutdown(r5, 0x1)
prctl$PR_SET_NAME(0xf, &(0x7f0000000380)='/group.stat\x00')
syz_open_dev$binder(&(0x7f0000000880)='/dev/binder#\x00', 0x0, 0x2)
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)})
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, &(0x7f0000000780)})
ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f0000000680)})
creat(&(0x7f00000000c0)='./file0\x00', 0x0)
openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000100)='/group.stat\x00', 0x2761, 0x0)
clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000080), 0xffffffffffffffff)
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000003c0)={0x14, 0x0, &(0x7f0000000680)=[@acquire_done], 0x0, 0x0, 0x0})

05:02:22 executing program 1 (fault-call:3 fault-nth:0):
r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000200)='/dev/nullb0\x00', 0x5000000084002, 0x0)
mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x200000e, 0x13, r0, 0x0)
r1 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x4000, 0x0)
preadv(r1, &(0x7f0000000040)=[{&(0x7f0000000400)=""/4096, 0x3ffc00}], 0x1, 0x0)

[  372.173693] binder: release 16816:16824 transaction 543 out, still active
05:02:22 executing program 3:
recvmmsg(0xffffffffffffffff, &(0x7f0000003140)=[{{&(0x7f0000001400)=@ipx, 0x80, 0x0}}], 0x1, 0x0, 0x0)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = syz_open_procfs(0x0, &(0x7f00000004c0)='net/rt_cache\x00')
preadv(r0, &(0x7f00000017c0), 0x8b, 0x0)

[  372.298852] FAULT_INJECTION: forcing a failure.
[  372.298852] name fail_page_alloc, interval 1, probability 0, space 0, times 0
[  372.310687] CPU: 0 PID: 16872 Comm: syz-executor.1 Not tainted 5.0.0-rc7+ #85
[  372.317968] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
[  372.327323] Call Trace:
[  372.329952]  dump_stack+0x172/0x1f0
[  372.333623]  should_fail.cold+0xa/0x1b
[  372.337568]  ? fault_create_debugfs_attr+0x1e0/0x1e0
[  372.342693]  ? perf_trace_lock+0xeb/0x510
05:02:22 executing program 3:
recvmmsg(0xffffffffffffffff, &(0x7f0000003140)=[{{&(0x7f0000001400)=@ipx, 0x80, 0x0}}], 0x1, 0x0, 0x0)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = syz_open_procfs(0x0, &(0x7f00000004c0)='net/rt_cache\x00')
preadv(r0, &(0x7f00000017c0), 0x8c, 0x0)

[  372.346841]  ? mark_held_locks+0x100/0x100
[  372.351088]  should_fail_alloc_page+0x50/0x60
[  372.355588]  __alloc_pages_nodemask+0x1a1/0x710
[  372.360266]  ? find_held_lock+0x35/0x130
[  372.364335]  ? __alloc_pages_slowpath+0x2900/0x2900
[  372.368037] binder: BINDER_SET_CONTEXT_MGR already set
[  372.369374]  cache_grow_begin+0x9c/0x8c0
[  372.369391]  ? __sanitizer_cov_trace_const_cmp8+0x18/0x20
[  372.369409]  ? check_preemption_disabled+0x48/0x290
[  372.377298] binder: BINDER_SET_CONTEXT_MGR already set
[  372.379020]  kmem_cache_alloc+0x62d/0x6f0
[  372.379114]  alloc_buffer_head+0x24/0xf0
[  372.379163]  alloc_page_buffers+0x16a/0x5d0
[  372.385458] binder: 16865:16879 ioctl 40046207 0 returned -16
[  372.389712]  create_empty_buffers+0x2f/0x840
[  372.389726]  ? zap_class+0x460/0x460
[  372.389748]  create_page_buffers+0x222/0x390
[  372.398617] binder: 16866:16880 ioctl 40046207 0 returned -16
[  372.399165]  __block_write_full_page+0xdd/0x1020
[  372.403981] binder: BINDER_SET_CONTEXT_MGR already set
[  372.407514]  ? check_disk_change+0x140/0x140
05:02:22 executing program 3:
recvmmsg(0xffffffffffffffff, &(0x7f0000003140)=[{{&(0x7f0000001400)=@ipx, 0x80, 0x0}}], 0x1, 0x0, 0x0)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = syz_open_procfs(0x0, &(0x7f00000004c0)='net/rt_cache\x00')
preadv(r0, &(0x7f00000017c0), 0x8d, 0x0)

[  372.407530]  ? __getblk_gfp+0x960/0x960
[  372.407553]  block_write_full_page+0x21f/0x270
[  372.419280] binder: 16859:16883 ioctl 40046207 0 returned -16
[  372.421544]  ? check_disk_change+0x140/0x140
[  372.421564]  blkdev_writepage+0x25/0x30
[  372.421580]  __writepage+0x67/0xe0
[  372.421598]  write_cache_pages+0x8af/0x1560
[  372.448425] binder: 16866:16880 Release 1 refcount change on invalid ref 1 ret -22
[  372.450237]  ? check_noncircular+0x20/0x20
[  372.450258]  ? __wb_update_bandwidth+0x670/0x670
[  372.450282]  ? clear_page_dirty_for_io+0xff0/0xff0
05:02:22 executing program 3:
recvmmsg(0xffffffffffffffff, &(0x7f0000003140)=[{{&(0x7f0000001400)=@ipx, 0x80, 0x0}}], 0x1, 0x0, 0x0)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = syz_open_procfs(0x0, &(0x7f00000004c0)='net/rt_cache\x00')
preadv(r0, &(0x7f00000017c0), 0x8e, 0x0)

[  372.464805] binder: 16859:16883 Release 1 refcount change on invalid ref 1 ret -22
[  372.465147]  ? perf_trace_lock+0xeb/0x510
[  372.478102] binder: 16865:16879 Release 1 refcount change on invalid ref 1 ret -22
[  372.484687]  ? __lock_acquire+0x53b/0x4700
[  372.484706]  ? __sanitizer_cov_trace_const_cmp4+0x16/0x20
[  372.484721]  ? check_preemption_disabled+0x48/0x290
[  372.484735]  ? __sanitizer_cov_trace_const_cmp4+0x16/0x20
[  372.484783]  generic_writepages+0xed/0x160
[  372.543049]  ? write_cache_pages+0x1560/0x1560
05:02:22 executing program 3:
recvmmsg(0xffffffffffffffff, &(0x7f0000003140)=[{{&(0x7f0000001400)=@ipx, 0x80, 0x0}}], 0x1, 0x0, 0x0)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = syz_open_procfs(0x0, &(0x7f00000004c0)='net/rt_cache\x00')
preadv(r0, &(0x7f00000017c0), 0x8f, 0x0)

[  372.547658]  ? zap_class+0x460/0x460
[  372.551385]  ? perf_trace_lock+0xeb/0x510
[  372.555557]  ? wbc_attach_and_unlock_inode+0x51a/0x930
[  372.560840]  ? find_held_lock+0x35/0x130
[  372.564911]  ? blkdev_readpages+0x40/0x40
[  372.569070]  blkdev_writepages+0x1e/0x30
[  372.573144]  do_writepages+0xfc/0x2a0
[  372.576969]  ? page_writeback_cpu_online+0x20/0x20
[  372.581933]  ? kasan_check_read+0x11/0x20
[  372.586096]  ? do_raw_spin_unlock+0x57/0x270
[  372.586115]  ? _raw_spin_unlock+0x2d/0x50
[  372.586131]  ? __sanitizer_cov_trace_const_cmp8+0x18/0x20
[  372.586149]  ? wbc_attach_and_unlock_inode+0x5c4/0x930
[  372.586172]  __filemap_fdatawrite_range+0x26d/0x340
[  372.586191]  ? delete_from_page_cache_batch+0x10e0/0x10e0
[  372.586215]  ? zap_class+0x460/0x460
[  372.594758]  ? __lock_acquire+0x53b/0x4700
[  372.594780]  filemap_write_and_wait_range+0x4b/0xd0
[  372.594800]  generic_file_read_iter+0x11a5/0x2870
[  372.594822]  ? lock_downgrade+0x810/0x810
[  372.594853]  ? filemap_write_and_wait_range+0xd0/0xd0
[  372.594946]  ? aa_path_link+0x460/0x460
[  372.594968]  ? __sanitizer_cov_trace_const_cmp4+0x16/0x20
[  372.652873]  ? fsnotify+0x395/0xbd0
[  372.656563]  blkdev_read_iter+0x120/0x190
[  372.660719]  do_iter_readv_writev+0x700/0x8e0
[  372.665238]  ? vfs_dedupe_file_range+0x780/0x780
[  372.670008]  ? rw_verify_area+0x118/0x360
[  372.674158]  do_iter_read+0x27c/0x660
[  372.674174]  ? dup_iter+0x260/0x260
[  372.674200]  vfs_readv+0xf0/0x160
[  372.674218]  ? compat_rw_copy_check_uvector+0x3f0/0x3f0
[  372.674236]  ? kasan_check_read+0x11/0x20
[  372.674254]  ? __fget+0x367/0x540
[  372.698092]  ? iterate_fd+0x360/0x360
[  372.701902]  ? check_preemption_disabled+0x48/0x290
[  372.706941]  ? wait_for_completion+0x440/0x440
[  372.711540]  ? __fget_light+0x1a9/0x230
[  372.715533]  do_preadv+0x1c4/0x280
[  372.719092]  ? do_readv+0x290/0x290
[  372.722726]  ? trace_hardirqs_on_thunk+0x1a/0x1c
[  372.727484]  ? trace_hardirqs_on_thunk+0x1a/0x1c
[  372.732259]  ? do_syscall_64+0x26/0x610
[  372.736237]  ? entry_SYSCALL_64_after_hwframe+0x49/0xbe
[  372.741603]  ? do_syscall_64+0x26/0x610
[  372.745615]  __x64_sys_preadv+0x9a/0xf0
[  372.745636]  do_syscall_64+0x103/0x610
[  372.745666]  entry_SYSCALL_64_after_hwframe+0x49/0xbe
[  372.745678] RIP: 0033:0x457e29
[  372.745694] Code: ad b8 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 7b b8 fb ff c3 66 2e 0f 1f 84 00 00 00 00
[  372.780787] RSP: 002b:00007f0190b9ac78 EFLAGS: 00000246 ORIG_RAX: 0000000000000127
[  372.788493] RAX: ffffffffffffffda RBX: 00007f0190b9ac90 RCX: 0000000000457e29
05:02:23 executing program 3:
recvmmsg(0xffffffffffffffff, &(0x7f0000003140)=[{{&(0x7f0000001400)=@ipx, 0x80, 0x0}}], 0x1, 0x0, 0x0)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = syz_open_procfs(0x0, &(0x7f00000004c0)='net/rt_cache\x00')
preadv(r0, &(0x7f00000017c0), 0x90, 0x0)

[  372.795747] RDX: 0000000000000001 RSI: 0000000020000040 RDI: 0000000000000004
[  372.803008] RBP: 000000000073bf00 R08: 0000000000000000 R09: 0000000000000000
[  372.810270] R10: 0000000000000000 R11: 0000000000000246 R12: 00007f0190b9b6d4
[  372.817542] R13: 00000000004c4933 R14: 00000000004d8210 R15: 0000000000000005
[  373.014511] binder: release 16859:16883 transaction 549 out, still active
05:02:23 executing program 2:
r0 = syz_open_dev$sndtimer(&(0x7f0000026000)='/dev/snd/timer\x00', 0x0, 0x0)
r1 = dup3(r0, r0, 0x80000)
ioctl$UI_GET_SYSNAME(r1, 0x8040552c, 0x0)
perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8)
bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c)
bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={0xffffffffffffffff, &(0x7f0000000040), 0x0, 0x1}, 0x20)
openat$cgroup_ro(r1, &(0x7f00000004c0)='cpuset.effective_cpus\x00', 0x0, 0x0)
unlink(&(0x7f0000000900)='./file0/file0\x00')
r2 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r3 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r3, 0x0)
ioctl$BINDER_GET_NODE_DEBUG_INFO(r2, 0xc018620b, &(0x7f0000000780))
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f00000000c0)=[@enter_looper], 0x48, 0x0, &(0x7f0000000700)="2ba063fb309ec7fdbfb08e6e91baee7d7d4599fe14129a4d426834556ae420e087d59c0c7be7fcad1abb7e1f8f446f373f611ca1ee9c2231708e18a47bc68a2a79a0b48931f6ff6d"})
ioctl$sock_inet_tcp_SIOCOUTQNSD(r1, 0x894b, &(0x7f0000000480))
getsockopt$inet_IP_IPSEC_POLICY(0xffffffffffffffff, 0x0, 0x10, &(0x7f0000000540)={{{@in6, @in=@remote}}, {{@in6=@ipv4={[], [], @local}}, 0x0, @in6}}, &(0x7f0000000000)=0xe8)
ioctl$BINDER_SET_CONTEXT_MGR(r3, 0x40046207, 0x0)
r4 = dup(r3)
shutdown(r4, 0x1)
prctl$PR_SET_NAME(0xf, &(0x7f0000000380)='/group.stat\x00')
syz_open_dev$binder(&(0x7f0000000880)='/dev/binder#\x00', 0x0, 0x2)
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)})
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, &(0x7f0000000780)})
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f0000000680)})
creat(&(0x7f00000000c0)='./file0\x00', 0x0)
openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000100)='/group.stat\x00', 0x2761, 0x0)
clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000080), 0xffffffffffffffff)
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000003c0)={0x14, 0x0, &(0x7f0000000680)=[@acquire_done], 0x0, 0x0, 0x0})

05:02:23 executing program 3:
recvmmsg(0xffffffffffffffff, &(0x7f0000003140)=[{{&(0x7f0000001400)=@ipx, 0x80, 0x0}}], 0x1, 0x0, 0x0)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = syz_open_procfs(0x0, &(0x7f00000004c0)='net/rt_cache\x00')
preadv(r0, &(0x7f00000017c0), 0x91, 0x0)

05:02:23 executing program 0:
recvmmsg(0xffffffffffffffff, &(0x7f0000003140)=[{{&(0x7f0000001400)=@ipx, 0x80, 0x0}}], 0x1, 0x0, 0x0)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = syz_open_procfs(0x0, &(0x7f00000004c0)='net/rt_cache\x00')
preadv(r0, &(0x7f00000017c0), 0x8c, 0x0)

05:02:23 executing program 1 (fault-call:3 fault-nth:1):
r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000200)='/dev/nullb0\x00', 0x5000000084002, 0x0)
mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x200000e, 0x13, r0, 0x0)
r1 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x4000, 0x0)
preadv(r1, &(0x7f0000000040)=[{&(0x7f0000000400)=""/4096, 0x3ffc00}], 0x1, 0x0)

05:02:23 executing program 5:
clock_gettime(0xb, &(0x7f0000000340))
r0 = syz_open_dev$dmmidi(&(0x7f00000002c0)='/dev/dmmidi#\x00', 0xb, 0xffffffffffffffff)
ioctl$UI_SET_RELBIT(r0, 0x40045566, 0x6)
llistxattr(&(0x7f0000000100)='./file0\x00', &(0x7f0000000140)=""/73, 0x49)
lsetxattr$trusted_overlay_opaque(&(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='trusted.overlay.opaque\x00', &(0x7f0000000080)='y\x00', 0x29d, 0xecdd891fb50c840a)

05:02:23 executing program 4:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000500)=[@textreal={0x8, &(0x7f0000000080)="baa100b000eef36cba2100ec66b9800000c00f326635001000000f30bad104ecc80080d267d9f8f30f1bb429000f20c06635200000000f22c067f3af", 0x3c}], 0x1, 0x0, 0x0, 0x0)
ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60)
ioctl$KVM_SET_IRQCHIP(r1, 0x8208ae63, &(0x7f0000000540)={0x0, 0x0, @pic={0x0, 0xfffffffffffffffd, 0x0, 0x0, 0xb3c}})
r2 = syz_open_dev$midi(&(0x7f00000004c0)='/dev/midi#\x00', 0x0, 0x60100)
bind$bt_rfcomm(r2, 0x0, 0x0)
r3 = syz_open_dev$admmidi(&(0x7f0000000100)='/dev/admmidi#\x00', 0x0, 0x105040)
r4 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
getsockopt$IP6T_SO_GET_REVISION_MATCH(r3, 0x29, 0x44, 0x0, 0x0)
write$USERIO_CMD_SEND_INTERRUPT(0xffffffffffffffff, 0x0, 0x0)
r5 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x484b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
ioctl$KVM_SET_REGS(r4, 0x4090ae82, &(0x7f0000000380)={[], 0x0, 0x680})
write$RDMA_USER_CM_CMD_CREATE_ID(r5, &(0x7f00000016c0)={0x0, 0x18, 0xfa00, {0x0, 0x0, 0x111}}, 0x20)
ioctl$KVM_RUN(r4, 0xae80, 0x0)
ioctl$KVM_GET_MSRS(r5, 0xc008ae88, &(0x7f0000000140)=ANY=[@ANYBLOB="070000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000c17a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000"])
syz_open_dev$audion(&(0x7f0000000000)='/dev/audio#\x00', 0x0, 0x0)

[  373.137905] FAULT_INJECTION: forcing a failure.
[  373.137905] name failslab, interval 1, probability 0, space 0, times 0
05:02:23 executing program 5:
r0 = syz_open_dev$sndtimer(&(0x7f0000026000)='/dev/snd/timer\x00', 0x0, 0x0)
r1 = dup3(r0, r0, 0x80000)
ioctl$UI_GET_SYSNAME(r1, 0x8040552c, 0x0)
perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8)
bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c)
bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={0xffffffffffffffff, &(0x7f0000000040), 0x0, 0x1}, 0x20)
openat$cgroup_ro(r1, &(0x7f00000004c0)='cpuset.effective_cpus\x00', 0x0, 0x0)
unlink(&(0x7f0000000900)='./file0/file0\x00')
r2 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r3 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r3, 0x0)
ioctl$BINDER_GET_NODE_DEBUG_INFO(r2, 0xc018620b, &(0x7f0000000780))
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f00000000c0)=[@enter_looper], 0x48, 0x0, &(0x7f0000000700)="2ba063fb309ec7fdbfb08e6e91baee7d7d4599fe14129a4d426834556ae420e087d59c0c7be7fcad1abb7e1f8f446f373f611ca1ee9c2231708e18a47bc68a2a79a0b48931f6ff6d"})
ioctl$sock_inet_tcp_SIOCOUTQNSD(r1, 0x894b, &(0x7f0000000480))
getsockopt$inet_IP_IPSEC_POLICY(0xffffffffffffffff, 0x0, 0x10, &(0x7f0000000540)={{{@in6, @in=@remote}}, {{@in6=@ipv4={[], [], @local}}, 0x0, @in6}}, &(0x7f0000000000)=0xe8)
ioctl$BINDER_SET_CONTEXT_MGR(r3, 0x40046207, 0x0)
r4 = dup(r3)
shutdown(r4, 0x1)
prctl$PR_SET_NAME(0xf, &(0x7f0000000380)='/group.stat\x00')
syz_open_dev$binder(&(0x7f0000000880)='/dev/binder#\x00', 0x0, 0x2)
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)})
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, &(0x7f0000000780)})
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f0000000680)})
creat(&(0x7f00000000c0)='./file0\x00', 0x0)
openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000100)='/group.stat\x00', 0x2761, 0x0)
clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000080), 0xffffffffffffffff)
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000003c0)={0x14, 0x0, &(0x7f0000000680)=[@acquire_done], 0x0, 0x0, 0x0})

05:02:23 executing program 3:
recvmmsg(0xffffffffffffffff, &(0x7f0000003140)=[{{&(0x7f0000001400)=@ipx, 0x80, 0x0}}], 0x1, 0x0, 0x0)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = syz_open_procfs(0x0, &(0x7f00000004c0)='net/rt_cache\x00')
preadv(r0, &(0x7f00000017c0), 0x92, 0x0)

[  373.183813] binder_set_nice: 3 callbacks suppressed
[  373.183879] binder: 16924 RLIMIT_NICE not set
05:02:23 executing program 0:
recvmmsg(0xffffffffffffffff, &(0x7f0000003140)=[{{&(0x7f0000001400)=@ipx, 0x80, 0x0}}], 0x1, 0x0, 0x0)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = syz_open_procfs(0x0, &(0x7f00000004c0)='net/rt_cache\x00')
preadv(r0, &(0x7f00000017c0), 0x8d, 0x0)

[  373.265563] binder: BINDER_SET_CONTEXT_MGR already set
[  373.283692] CPU: 1 PID: 16917 Comm: syz-executor.1 Not tainted 5.0.0-rc7+ #85
[  373.290980] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
[  373.300328] Call Trace:
[  373.302971]  dump_stack+0x172/0x1f0
[  373.306622]  should_fail.cold+0xa/0x1b
[  373.310532]  ? write_cache_pages+0x8af/0x1560
[  373.315036]  ? fault_create_debugfs_attr+0x1e0/0x1e0
[  373.320153]  ? find_held_lock+0x35/0x130
[  373.324281]  ? blk_queue_enter+0xbd0/0xe90
[  373.324366] binder: 16933 RLIMIT_NICE not set
[  373.328546]  __should_failslab+0x121/0x190
[  373.328566]  should_failslab+0x9/0x14
[  373.328581]  kmem_cache_alloc_node+0x56/0x710
[  373.328608]  create_task_io_context+0x33/0x450
[  373.328627]  generic_make_request_checks+0x1a80/0x2140
[  373.328661]  ? trace_event_raw_event_block_rq_requeue+0x640/0x640
[  373.328676]  ? perf_trace_lock+0xeb/0x510
[  373.365845]  ? mark_held_locks+0x100/0x100
[  373.370085]  ? zap_class+0x460/0x460
[  373.373808]  generic_make_request+0x24c/0x12d0
[  373.378392]  ? find_held_lock+0x35/0x130
[  373.382514]  ? bio_associate_blkg_from_css+0x513/0x9d0
[  373.387799]  ? blk_queue_enter+0xe90/0xe90
[  373.392041]  ? lock_downgrade+0x810/0x810
[  373.396200]  submit_bio+0xba/0x480
[  373.399740]  ? submit_bio+0xba/0x480
[  373.403465]  ? generic_make_request+0x12d0/0x12d0
[  373.408313]  ? bio_reset+0x3b0/0x3b0
[  373.412037]  ? __sanitizer_cov_trace_cmp8+0x18/0x20
[  373.417059]  ? __sanitizer_cov_trace_cmp4+0x16/0x20
[  373.422082]  ? wbc_account_io+0x17e/0x2a0
[  373.426245]  submit_bh_wbc+0x5f7/0x7f0
[  373.430148]  __block_write_full_page+0x771/0x1020
[  373.434993]  ? check_disk_change+0x140/0x140
[  373.439413]  block_write_full_page+0x21f/0x270
[  373.444004]  ? check_disk_change+0x140/0x140
[  373.448437]  blkdev_writepage+0x25/0x30
[  373.452488]  __writepage+0x67/0xe0
[  373.456047]  write_cache_pages+0x8af/0x1560
[  373.460368]  ? check_noncircular+0x20/0x20
[  373.464608]  ? __wb_update_bandwidth+0x670/0x670
[  373.469382]  ? clear_page_dirty_for_io+0xff0/0xff0
[  373.474316]  ? perf_trace_lock+0xeb/0x510
[  373.478472]  ? __lock_acquire+0x53b/0x4700
[  373.482712]  ? __sanitizer_cov_trace_const_cmp4+0x16/0x20
[  373.488251]  ? check_preemption_disabled+0x48/0x290
[  373.493268]  ? __sanitizer_cov_trace_const_cmp4+0x16/0x20
[  373.498814]  generic_writepages+0xed/0x160
[  373.503560]  ? write_cache_pages+0x1560/0x1560
[  373.508147]  ? zap_class+0x460/0x460
[  373.511865]  ? perf_trace_lock+0xeb/0x510
[  373.516021]  ? wbc_attach_and_unlock_inode+0x51a/0x930
[  373.521303]  ? find_held_lock+0x35/0x130
[  373.525366]  ? blkdev_readpages+0x40/0x40
[  373.529514]  blkdev_writepages+0x1e/0x30
[  373.533595]  do_writepages+0xfc/0x2a0
[  373.537445]  ? page_writeback_cpu_online+0x20/0x20
[  373.542410]  ? kasan_check_read+0x11/0x20
[  373.546576]  ? do_raw_spin_unlock+0x57/0x270
[  373.550989]  ? _raw_spin_unlock+0x2d/0x50
[  373.555139]  ? __sanitizer_cov_trace_const_cmp8+0x18/0x20
[  373.560700]  ? wbc_attach_and_unlock_inode+0x5c4/0x930
[  373.565987]  __filemap_fdatawrite_range+0x26d/0x340
[  373.571033]  ? delete_from_page_cache_batch+0x10e0/0x10e0
[  373.576597]  ? zap_class+0x460/0x460
[  373.580333]  ? __lock_acquire+0x53b/0x4700
[  373.584573]  filemap_write_and_wait_range+0x4b/0xd0
[  373.589611]  generic_file_read_iter+0x11a5/0x2870
[  373.594468]  ? lock_downgrade+0x810/0x810
[  373.598629]  ? filemap_write_and_wait_range+0xd0/0xd0
[  373.603848]  ? aa_path_link+0x460/0x460
[  373.607834]  ? __sanitizer_cov_trace_const_cmp4+0x16/0x20
[  373.613375]  ? fsnotify+0x395/0xbd0
[  373.617011]  blkdev_read_iter+0x120/0x190
[  373.621163]  do_iter_readv_writev+0x700/0x8e0
[  373.625673]  ? vfs_dedupe_file_range+0x780/0x780
[  373.630448]  ? rw_verify_area+0x118/0x360
[  373.634599]  do_iter_read+0x27c/0x660
[  373.638402]  ? dup_iter+0x260/0x260
[  373.642084]  vfs_readv+0xf0/0x160
[  373.645547]  ? compat_rw_copy_check_uvector+0x3f0/0x3f0
[  373.650959]  ? kasan_check_read+0x11/0x20
[  373.655113]  ? __fget+0x367/0x540
[  373.658575]  ? iterate_fd+0x360/0x360
[  373.662374]  ? check_preemption_disabled+0x48/0x290
[  373.667392]  ? wait_for_completion+0x440/0x440
[  373.672005]  ? __fget_light+0x1a9/0x230
[  373.675984]  do_preadv+0x1c4/0x280
[  373.679528]  ? do_readv+0x290/0x290
[  373.683157]  ? trace_hardirqs_on_thunk+0x1a/0x1c
[  373.687916]  ? trace_hardirqs_on_thunk+0x1a/0x1c
[  373.692687]  ? do_syscall_64+0x26/0x610
[  373.696687]  ? entry_SYSCALL_64_after_hwframe+0x49/0xbe
[  373.702064]  ? do_syscall_64+0x26/0x610
[  373.706052]  __x64_sys_preadv+0x9a/0xf0
[  373.710046]  do_syscall_64+0x103/0x610
[  373.713938]  entry_SYSCALL_64_after_hwframe+0x49/0xbe
[  373.719140] RIP: 0033:0x457e29
[  373.722332] Code: ad b8 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 7b b8 fb ff c3 66 2e 0f 1f 84 00 00 00 00
[  373.741234] RSP: 002b:00007f0190b9ac78 EFLAGS: 00000246 ORIG_RAX: 0000000000000127
[  373.748943] RAX: ffffffffffffffda RBX: 00007f0190b9ac90 RCX: 0000000000457e29
[  373.756212] RDX: 0000000000000001 RSI: 0000000020000040 RDI: 0000000000000004
[  373.763478] RBP: 000000000073bf00 R08: 0000000000000000 R09: 0000000000000000
[  373.770765] R10: 0000000000000000 R11: 0000000000000246 R12: 00007f0190b9b6d4
[  373.778030] R13: 00000000004c4933 R14: 00000000004d8210 R15: 0000000000000005
[  373.785798] binder: 16923:16929 ioctl 40046207 0 returned -16
05:02:24 executing program 3:
recvmmsg(0xffffffffffffffff, &(0x7f0000003140)=[{{&(0x7f0000001400)=@ipx, 0x80, 0x0}}], 0x1, 0x0, 0x0)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = syz_open_procfs(0x0, &(0x7f00000004c0)='net/rt_cache\x00')
preadv(r0, &(0x7f00000017c0), 0x93, 0x0)

[  373.809626] binder: BINDER_SET_CONTEXT_MGR already set
05:02:24 executing program 3:
recvmmsg(0xffffffffffffffff, &(0x7f0000003140)=[{{&(0x7f0000001400)=@ipx, 0x80, 0x0}}], 0x1, 0x0, 0x0)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = syz_open_procfs(0x0, &(0x7f00000004c0)='net/rt_cache\x00')
preadv(r0, &(0x7f00000017c0), 0x94, 0x0)

[  373.838865] binder: 16932:16934 ioctl 40046207 0 returned -16
05:02:24 executing program 0:
recvmmsg(0xffffffffffffffff, &(0x7f0000003140)=[{{&(0x7f0000001400)=@ipx, 0x80, 0x0}}], 0x1, 0x0, 0x0)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = syz_open_procfs(0x0, &(0x7f00000004c0)='net/rt_cache\x00')
preadv(r0, &(0x7f00000017c0), 0x8e, 0x0)

05:02:24 executing program 2:
r0 = syz_open_dev$sndtimer(&(0x7f0000026000)='/dev/snd/timer\x00', 0x0, 0x0)
r1 = dup3(r0, r0, 0x80000)
ioctl$UI_GET_SYSNAME(r1, 0x8040552c, 0x0)
perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8)
bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c)
bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={0xffffffffffffffff, &(0x7f0000000040), 0x0, 0x1}, 0x20)
openat$cgroup_ro(r1, &(0x7f00000004c0)='cpuset.effective_cpus\x00', 0x0, 0x0)
unlink(&(0x7f0000000900)='./file0/file0\x00')
r2 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r3 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r3, 0x0)
ioctl$BINDER_GET_NODE_DEBUG_INFO(r2, 0xc018620b, &(0x7f0000000780))
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f00000000c0)=[@enter_looper], 0x48, 0x0, &(0x7f0000000700)="2ba063fb309ec7fdbfb08e6e91baee7d7d4599fe14129a4d426834556ae420e087d59c0c7be7fcad1abb7e1f8f446f373f611ca1ee9c2231708e18a47bc68a2a79a0b48931f6ff6d"})
ioctl$sock_inet_tcp_SIOCOUTQNSD(r1, 0x894b, &(0x7f0000000480))
getsockopt$inet_IP_IPSEC_POLICY(0xffffffffffffffff, 0x0, 0x10, &(0x7f0000000540)={{{@in6, @in=@remote}}, {{@in6=@ipv4={[], [], @local}}, 0x0, @in6}}, &(0x7f0000000000)=0xe8)
ioctl$BINDER_SET_CONTEXT_MGR(r3, 0x40046207, 0x0)
r4 = dup(r3)
shutdown(r4, 0x1)
prctl$PR_SET_NAME(0xf, &(0x7f0000000380)='/group.stat\x00')
syz_open_dev$binder(&(0x7f0000000880)='/dev/binder#\x00', 0x0, 0x2)
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)})
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, &(0x7f0000000780)})
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f0000000680)})
creat(&(0x7f00000000c0)='./file0\x00', 0x0)
openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000100)='/group.stat\x00', 0x2761, 0x0)
clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000080), 0xffffffffffffffff)
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000003c0)={0x14, 0x0, &(0x7f0000000680)=[@acquire_done], 0x0, 0x0, 0x0})

05:02:24 executing program 1:
r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000200)='/dev/nullb0\x00', 0x5000000084002, 0x0)
mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x200000e, 0x13, r0, 0x0)
r1 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x4000, 0x0)
preadv(r1, &(0x7f0000000040)=[{&(0x7f0000000400)=""/4096, 0x3ffc00}], 0x1, 0x0)

05:02:24 executing program 3:
recvmmsg(0xffffffffffffffff, &(0x7f0000003140)=[{{&(0x7f0000001400)=@ipx, 0x80, 0x0}}], 0x1, 0x0, 0x0)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = syz_open_procfs(0x0, &(0x7f00000004c0)='net/rt_cache\x00')
preadv(r0, &(0x7f00000017c0), 0x95, 0x0)

05:02:24 executing program 0:
recvmmsg(0xffffffffffffffff, &(0x7f0000003140)=[{{&(0x7f0000001400)=@ipx, 0x80, 0x0}}], 0x1, 0x0, 0x0)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = syz_open_procfs(0x0, &(0x7f00000004c0)='net/rt_cache\x00')
preadv(r0, &(0x7f00000017c0), 0x8f, 0x0)

05:02:24 executing program 4:
r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x0, 0x0)
ioctl$SNDRV_CTL_IOCTL_PCM_PREFER_SUBDEVICE(r0, 0x40045532, &(0x7f0000000300))
openat$audio(0xffffffffffffff9c, &(0x7f0000000140)='/dev/audio\x00', 0x40000000040201, 0x0)
r1 = syz_open_dev$sndpcmp(&(0x7f00000000c0)='/dev/snd/pcmC#D#p\x00', 0x0, 0x405)
write$RDMA_USER_CM_CMD_CREATE_ID(r1, &(0x7f0000000180)={0x0, 0x18, 0xfa00, {0x0, 0x0}}, 0x20)
write$RDMA_USER_CM_CMD_CONNECT(r1, &(0x7f00000001c0)={0x6, 0x118, 0xfa00, {{0x0, 0x0, "9a52577beddb95185a1f4cdd98d73f259d3d6d3a27292326f8fd2f10c1dfc0114ef4869253edce9fe650a99fe723bf2a5578c61d6e186f679c5aa62becab3960d46b3814c2bbad28d2e135909f6093f88db2381eab723b07ab1abd8e5f2ba1fd29fe202b2ac9d27a6af9e8f76fb64cab5cf9c23a8f7f1892abb571ddd348f80cd2dcee5196027b43c8d035546d00be1834a46a9461aa26faee238d8df1f52210168bdb540ec4132db80ec40dc2beb4ed9b3480f8275be7a4e55fc8dc472c4a6c7640733dee49387939cde49accc0c6c4a190ecb413a99434dbca1aa97e1fcf9e169ff86b3504fa80f0d32faa3252af2971eb731139a0c996ddd262df650f6147"}}}, 0x120)
ppoll(&(0x7f0000000100)=[{r1}], 0x1, 0x0, 0x0, 0x0)

[  374.213943] binder: 16967 RLIMIT_NICE not set
05:02:24 executing program 3:
recvmmsg(0xffffffffffffffff, &(0x7f0000003140)=[{{&(0x7f0000001400)=@ipx, 0x80, 0x0}}], 0x1, 0x0, 0x0)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = syz_open_procfs(0x0, &(0x7f00000004c0)='net/rt_cache\x00')
preadv(r0, &(0x7f00000017c0), 0x96, 0x0)

05:02:24 executing program 5:
perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x3, 0x31, 0xffffffffffffffff, 0x0)
futex(&(0x7f000000cffc)=0x4, 0xb, 0x4, 0x0, &(0x7f0000048000), 0x0)
pipe(&(0x7f0000000000)={<r0=>0xffffffffffffffff})
ioctl$VHOST_SET_VRING_ERR(r0, 0x4008af22, &(0x7f0000000040)={0x3, 0xffffffffffffff9c})
setsockopt$inet_msfilter(r0, 0x0, 0x29, &(0x7f0000000080)={@broadcast, @rand_addr=0x7fffffff, 0x0, 0x2, [@dev={0xac, 0x14, 0x14, 0x14}, @dev={0xac, 0x14, 0x14, 0x27}]}, 0x18)
futex(&(0x7f000000cffc), 0xc, 0x1, 0x0, &(0x7f0000048000), 0x0)

05:02:24 executing program 4:
r0 = socket$inet6(0xa, 0x3, 0xbb)
clock_adjtime(0x0, 0x0)
r1 = openat$full(0xffffffffffffff9c, &(0x7f0000000000)='/dev/full\x00', 0x100, 0x0)
ioctl$SCSI_IOCTL_GET_PCI(r1, 0x5387, &(0x7f0000000040))
recvmmsg(r0, &(0x7f0000000200), 0x38c, 0x0, 0x0)
connect$inet6(r0, &(0x7f0000000080)={0xa, 0x0, 0x0, @loopback}, 0x1c)
sendmmsg(r0, &(0x7f0000004ec0)=[{{0x0, 0x0, &(0x7f0000000580), 0x0, &(0x7f0000000600)=[{0x0, 0x199, 0x5, "7eb873ada173e8784938a5949e72844c6b5fe4e90192e1e43d4c86a9887d77d999ee79355031bdfc176a33713061ae6887ca61d0f7a3e69918f2ec19a97911aaedfe1d15f59793fa9e0b173889ed5061e2fce665e3ccabf934b9ca705609187c35441b4999b30e6ba8b67b2e290571d51934ee6bedffd2fc62aee96c400fb6b11c"}, {0x0, 0x10a, 0x7, "ba60a096c1ff096cb5b1fd726770f633cb83c780"}, {0x0, 0x1, 0x1f, "a673966c25425a0cbe0b152c825e21caae9d2f3f8799dd51f7c8400cb0172d3bd2698546d0045e81ec89825d8afd463f7c314aaf00a919e09b6c4076a87171a3ad63c6f4bfb7c69d373af629544bc36596c1b673e61528a703786a6b"}, {0x0, 0x119, 0x3ff, "425cc4af3a5e58cacbfddcd41f02246ae37cefebc2d90886a842509f2647254c0772fb2bdf03b2865cef11a1cb5a8e765c084c255f5f3f25b254fa46e9eddd650c4c4f9faee15c5cf9769de0ffdbf192cf1cfed1b2c4828ee76a1cfc6b811eea7a146e705157ceb62c1ac828383bebb0408ef587a4f107e31a382dc1a38bd33d2d20552d27a33ca659689ea312d2a1e0bbedd5316cf4fda0f69e7fb844f2fc552a2a3f25c0138e7dff"}, {0x0, 0x110, 0x9, "97cca63993a862fcff6ca1fe34bd8cb798fb11068886faaf4d9da92275b697a40cee5e03314148b9b7070ff27d3afa1f43a3d17001eb7580c01fcf19"}, {0x0, 0x11f, 0x100000001, "15b2e708e091e7ed50004e0e848c7b8b1118e6411ff22a31fad2be81bb89415b90dcbd6e84d86b5622043f22063a7280dccc0455ce923b32c47b0a19b42275539e8015495c4482b3ce299ac8fc2f01c867a55013aebf3718f81901f097e9212c6b3ad67cd1aee0b6f01109376fe794d6046f971fcb452b6c69c201275d7b7791c0054d803831dc20bce3f4fcc4b23f6b9189f15223b8e827c6af54dee355ef05f4ce87469fb9812aa1adc710"}, {0x0, 0x0, 0x7ff, "9168ca0aab29a11d18b0ed20df133b6ac908e77d14a30cb51ebd72ab1ab2302847731a42e69a460f9cb28e2a689517745f5536fdc40f3a89c66472816770e968c4137c5e92e8172c45127312e59e"}, {0x0, 0x117, 0x6, "d0209e97047d3b207809d24c8f7099d2caa250b52e40113ab306394104aabd58dbc44e13c893a8ed86cd2f3237a36a3b8fc5bc907d88e1a1db6a965b68c62719c2c7af5fd28b6fb034a4543f0311e7add85df99670c3e5ffcc6b082351d51e526cbd71b9be77ba4c870e0edcfb51760a1af6252e1fef1ef039fe47d11f376256cd5e913b60e19648f70b9b2c49f6953da1c267c98422a8cb7cc354caf6879ea345716c46ad2f94312d4813185464b12c0d342fa5601ef7247452da5804612eafd49ae05bd0eb02b64164af41f1fba0cb6fdf57cb831a74aa843e58e13d93"}, {0x0, 0x105, 0x9, "c87f7cc3ba9daca695a97b53907cfa3d2baee577869a4e7d6ba233e1e5a1b8d043c1359f047fbb77cc32a41f8b77eb6d15b3f4c146083edfb90053e67089cbf2ba162c"}]}, 0x5}, {{&(0x7f0000000ac0)=@in={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0x17}}, 0x0, &(0x7f0000000fc0)=[{&(0x7f0000000b40)="a0c1d298bf16ab0d50cf08aba9b4ff60209af43cb0306558ea52079f028ff4682f44a1890dc798000e44a22ad81393befe99c086fa8eeba900a6459d5629eaaa2a08d213ae51e5523581bf9a4f116064faaa9278f8d303d1990a44fdd9da60e3861240b49ef0bf05cc046f5226275d58b6660419c21e1888ec847c7239a19968"}, {&(0x7f0000000bc0)="a0ebe39b5d51e267e0b1ba9c3fc5e8c76881d040cae34ec38458071d7bd8f8570073434db0c5d9e9d1bff1251724067843dbfef9b2dc5a618af42712465e3ca69b5a445fd39865ad89e735aa1b5ff945c486617f"}, {&(0x7f0000000c40)="31ec9f13a5bf627112317db16683ecae9d5554185589e43598067c817b9e"}, {&(0x7f0000000c80)="c60443a93b7346f040daebafbc4a44d54d03a8e1"}, {&(0x7f0000000cc0)="97f3cf2a5c9e122e9f294941b97d9c4112fe0efcc0d6f1bd1ca9f0b7bd347a69f7a8c34ecb42bd671f6779ecdb2666eb1f8db52cc58e143c350b59e6a6728ccbe43caa09baac7a4e44864aaee3ebd4aade37cc38d714b946e2a1f76f4b23c986deacbcc24295241f712cc4dfe5d41202ee"}, {&(0x7f0000000d40)="1a69fff69e739867c18886528052e7bd03d2c0a8afc572ec1a7ed60de0d204ad19376021f085eb228c3f24a3741b553e3ad54e691f5b3d059e55ab5633c156f4525e64096896ba9a87313d83b0f875b349c001473a48694306961d163ba974c7537b48168e11436b97bf330df5508a5eefface04ec64dabd754bb580796186f845363cec4daa70809739b86d841cefbf63365698c141ef368ac7bbf441da"}, {&(0x7f0000000e00)="601dcea56c5bee6144f587af27b103bd07de309cd6aa439e2ebd465cb2beef0d0ae79a039efd38018f2e8f99c52afd6424c5654590af336746335e64a35356170a7b83f9ed3b4a0f0485c8e78f683290c167c1e6e530ebd77a686a0fec7355c250d9c74a4940579ee46dd388e8a012481b0f4493f59c8212eb9159662fa4cd0f38537f42ffd7d25115286986d8a6077fb342a41ec9604b0512526557120c154407dabdbc45829a5d55bbb070f5e06e7c3ee2e17ba1375303e97791239cdb10109ba36828eb030683cb7f"}, {&(0x7f0000000f00)="79b59136c90c9be61961e66fb88b0d6994d80eb4d3b8d5ac56ffd49a512ec3545f7faa21919d7642d182c6f5755e08df614e93fb9b0422a9779a51e9c000b8c73c34ae157f4fba458001adc3b507b92cd91887a9b67c86f1eeffcc8263564cd8343a8e4db1fb6107e2a67474d61fcf73b1dab9ae689ab24838914da3b8cb5133ceb0f429391bac432ff4c7ab4698c6f68b2809827f846bd69cee2051e45f12d23b3f9780b8f92ec3351b7d04cf8d613e1466a15c57454fecdb43f59e"}]}, 0x1}, {{&(0x7f0000001040)=@pptp={0x18, 0x2, {0x2, @rand_addr=0xfff}}, 0x0, &(0x7f0000001100)=[{&(0x7f00000010c0)="461638ac6fcf98311113d44eaa68264bea8025676f7057aac29894fad87b3581551309f8db"}], 0x0, &(0x7f0000001140)=[{0x0, 0x195, 0x6, "1e8459d95fb8826a93ecf258b9918608a5a10b122da662a7ceae5c1df31313b1f45480f184ef1a48b2dd0f2bf93331dd59b3047826567d92aa0f9442d64d8bec7d316ffffcaa2c8e8faff62c0d61feb017c1e1d0ab58438bc81255aea2e160ae644a8202ddb7d3d07970ca39ffa6d18779e02de15a3bbe33141010462adba27fc2580897f9a60639991112f7de8708319039bd32f6c078f9492fe8b31c5a16193b1dde974012d1c2484a7f1bbb982cfc37abac9468538b3c798b66c29dd5ff20438929fd1b18e9675068f40c818540d6bdbf44eea7970885a23f83fae00a77011027d739a81d8468979e842f71952ad7c34cdc43e09263abdc16e7c0c876f1961be46de3a32788d8681836508651056c2934adc25f385e8ae9462f977782f2d20eb8f3706a3fb277ebd5881ad93895ae0f4a1030627acf89c5f0c0f1a69a6b84e0422a969cc2328ea245b3fd6ac150916f49b0557eb924e220c67902c8f47a5f9786796ddd14ec1c997ce60d834f376082ff9cb1c63117527b9b0167b04177534e6f568bea399c0dc60fac1469d3523cd1ac190950c1e23be7af9061b2240709df53eec4eb22999080f3e565390d4915e6bd8134e418460b5095fb7b7dc27ad371ab81cc63dc0566f527f40175e60e906de642f44e4fe79a5b7aa10fb9c4b5359e6805dcb59d22318f24be0766b6a76621610b374c7b58c40018567e5e35cb4655c81b6aa41fa7c94d396e2d10b552348bba9be279b460e651f29fce5513ffc02b4ef4b563b24adca6224054de8dbb9f41dd5124817d14012253fcd4055a5dfd1d7fa2baf2fa0fca6141254146baa463606a7f227aa71b12707388052c04996f16c922100d0123b7cf131e32944ffc2001a399a61440bbbacaf69ad92197002cb403f120a0e07ac9308ac6fb9be11fd10752e77ce268cb471d5b528261f4c0d06e40ac15b37d5072ebdedb9ec3b0d41fcbc124991d2fae62a2d6a1884699bbae6069bf5eecb7e8c07c1acefb214e4af3b49e8ddb08220f1976066e1edd1765d1e8767e3b9b558880ab6e728097c1f6456e5b9bfb9d2d976c6177d8da617cd0e284fff94c491d3da00e7f3412168a3102f2025c84be305b2054b3fb0b030fd595beb4b7b6fb621bb04f46ff205396e9bd7f6f3c9b4c6c38ec1c291c205f568fcbc61917f94206e6ac9fa7836d692f312049fac2834d56a6ece04901eeb83851c047cd4d224a0380842aa7c30e573271c2a3c48c82496b8b0cfefeab95b487210bd8f41304e6c7b8a79053117411b6451076c533539b70693fbaf17b6d960666ff1332e8843e15f66e8cd059bc43b286301a1e952acfd75f703864e0a4923e0f6ca6442e01ae094c47de88e424d77ef93eadfd1a8590040a635b7e827e3d99a298620a297815a530d529221ad7f23054367d017fcefd7e90702f3cd024a49ecbd5995d20861e36bd185f47dc11e8ab92b7a00534de6490288e350afbb1d5915ea2ae73cebf60c396514848b470f2119f437c01a90606e2fd772bf156b8e408cc8825854cf2386f9dc711db3182d706bcb02dd25063759acae7c5f626e1a2347687e9656467a2f51ff3254e7611a30a6ddc7ae2afc6d7aaead276c975192157f29d109779f0359348322e3f538a23702663e929199581fbc8dbfb8c2716ce6fb4628f1880264eaa3acb80e032c2273a69c6699354632b5a2767e215d685c1dc229dfa3c2fa32bf28f2e84579675f38f5e100f3feb424269c4163e796205bbd8aaae419e1ebb660acd3bee21791d605c6aa9eb4a860ce0e0ec4d307ba57cccb300c2772917324b4df07b4e0bdb93d479bd9797bdf73db6cc9860ee00d023aba459f3205f6421964d51a4a804051c001f8512413b4fd7e270dd0d57b767928858e288b9fa3c445b8f63a9e59d72ed7adb4e3be3c080e91fcfdbff3fe9b693ffa8e940b0271e9a80b33bd967f9083d6cd437688945e92397fd1574a7215a792179a02b913299ab29f35b3a1875e9c9b00b14720c4d33c65c6d7f645b4b60b2e0b23bec7c00235c9c68a768827ef991450090fd5c529bcd7cf4961b1482ceeafa79fab193b6b69f66abde510ea6242db8339fc66186bf780fb7fe8d2c30ec4bfc159b37052343d209fa1155694fed74bc00e8207475f1b92bd04a882c6a8e0f24c65c7edbd3cec521d64e781e8a38e82f53e31ae10d54e60aaabe28e02faf6ed1e4e663dcc5bfa547021477e9d225a8a1a5e206f03be5f425a1b1ac222b8342b5a2b8e71c6bb4647c12450630718f5ac2dc8e608938c939c2ebff92e5b6c1168b46b1e79904479f1fdde73b461cfa9e3e915f8946e505832aa94171e362abddceca77e5dc58054ae62e4e5ebd5c924c8ac1bc1d2c3b38a08d266a862b6e2eced27d943af7583f6b36fa35903f8dce37b99d6368becd6498f6674f6d5ea9609cc6bc877963c1ba3dc39ce8bc698a9472f567557594437d8d49507d541b83c04685aad0b05edb76f40b57e92dcc7fba10bb227884611fb9c5cdd2d50de19165bce370637839f49b4064659bca685f2cb6498e8cc6113037fa1f493d308df40ff9c551f0dd5710b080d999d8427f76a4a2fe30f5f5a3c708010f0b1952f04bd8e1804c5324a50ef64cfef3dc9fce9c49e39f204ca332a377944568607681d5ee5b0dc39f0689a16b1487b3674d9ec149969049dd48a49041fd6bb83dd63b1640a642978480e9aa079cd07c4eea76e87eabfd53ddb8202c2fe7bac33ba51524ee1aa46d4976186980942ff0cf50239d5ba8a920b878fa78415f3b12fa7479f620cde0a2dd1490dc67e44c3240b66667e6cc70fd2411be4de4513bd9108fdec304b5eb9693e7a82deea680a48a96ca054d70519a1dddfe91a2d3628bbb45782d329ac2f70ff585847b552e753a588cdb23abbc736ebfcbd5c21835fb80b04d364a262f443f207cc7cf9ea6fe9b4cd6b122c82d651752641789bf37d82705736cc2a1b79967fb19e79a12fc216083a1debf95e2696cc89997c8211c497b090a5cab6da9fb9e28770168996b93e07e00babe1daef0de8014de8775bf45dc477d4e2f1b7b76adb90e633689007f3027a960bee14b259e74bbcf9e2c3d82287116f92b344eb53bfa23d491abfa00c96c17a57eb0f733cdd2aee1a343802e83b506e5b4e7ef5a08527c4217613c234d409174945e5e3f2b24fa9660928d8da423191245b497e7e2016ac397ca808a37cdeb70108f76a8b3c022e1cd7ccdeb2ab604f8d41feee6d415353efdd8ce971bfbd24665eb372660cec2e91d72bd7ee29801ec77e96744ecd180851385b41db8ea3ae1a8408d85bad364fa5418ef2452b6d096f7a873fe15752edb0c95172105f4852d7d7ec4301ec91bd2ad67e4d12e4214079ba30545e1a6bc35d72c87b814e4683613f5fc36c1af58aefb88e2a9c46e7310b3846e9fcd3691c55e610e97885bbe22f12d4b706c51811665459419d2217381413f2d9f494383b11b9d201a22f60d5fdcca549b586d9d9a69d6135a774b4105008b73963a57741af52bf6e77c2176507c4531cda3ace2be3f831a7af98856d11ad7f6e3c015ce0132300edb781a0c97be420874a0032d99ab528ebc2f4df2d98ab5fcbf1fcb29a275fd6d9c3c4e5460a17d40a75ece8d779d38ebc80c95f1f314458e153af0ab29ce69a5fd354900e7b8e8e68c55ab1e64d74e5ec4ad96ae3f9694d6216d620153a0d5bd7aba1cbb1d07494290db1306d1ae6e20d3667e21b7c73f75d425a44e9628dbdd1e2aba1d37b257167404ad7b7e4e0c280868611ab35d433a3c573e77284ca2867df59b2095d8e1e986f2324d1b849539369dfbc880c3a8c7b36c85381b296166f59c73ff331624a89a67e3db4bd338e69c232c53b8cd86c6f3c3cf6f0634d469f4d977050022af7c51174e35fc8fb570d22ff970a66bf7bbde87b110194740024aa1a3e915b365fc94587be46d2e6fb2364c8e1338cc0df8436ec3d8be45a652582847f2718a82e9ca92ceadcde6f52bf1524333094890d848f9da10a5d9da5c38099e0986517285ba3934860bbb5cf749214e5c469c50d0c98ebf6eb62f57d895929806bece0d3d8ae19044cfcf6dc1e730bf158f3cf53016a5105203a97d053cce39c586a3ff65d6a2e88d6b09e55ac0b72ca695211a9c024685328e04022ae0f2a342c3f3ebc9f50fbb38cc413cc6d934c531183e4bdffffb200d59b19bb63e2a222845fe88d9e57d8758e5830e339438b17b9bd61c698a402319b2785af0fa808c6367aec9bd87a21c7e6b8f167e2e634c88b984914f4a87a913935d9e4cf92eed1b61d3b768273009c8765edc5ad46b15242b54e10545d8db2d000a4e8ad52d5aedf00320a850b10c5e41945901c9a46a4df3fcfd19232106e8a3f8dcdda812c893af4e795d7cf5dc995028f35455c1606f245d475645cf0835b93bc9376f632ee61a88a4c470ccbc591a08bd1308e384729174cbcd5c560b33b9cc3d0afd35851fb60d7c9d8ee53388ef3c944612d1c02cd9cb3114a0c64d115cd5aee28f09b8135f7e08a7f2ad65e909dc62c7d776a0e2d958c90c3658110ed9a1feb680f6f0e2396280dcbb1202f1bcc7d16f1dbd4cdaf085745cff89cb1d80c1612c5d4f56e92df3ec916d37bba267bfa062595b9b3fc0aae90514c61a45cb0d159473c983e2619b6e17417cd4c5982996d4eaf4f76edf0a9b6bd4ad6825f1d7c5d2f6486b483b4ffd7b6c29b3270038f1eaad018112bb76c9136c2020129216fe4dda41a96a70a3794f31725703775869ae0ca1836fffa60a58e52d06f5e0912b3df6f9ab75238a59dcaec0b4756329ee0084fd7666b22781e83334a47a9ec05b163c4fd6f5fd135d955f2a03d819aef82e5c40698e6747e6c59669f6d961ca98cd50b0db477e4c51eb4ed44d58cdb8ccf704de65feb0af4ed135b21c1c1961b5f859707c5fb0e69554edc69ce0de4762e6e73f0b7f1f2f929682cb64069b39cd0e3e5782d27defeb4afee7173627651c21e489f6eb0b488fefd8f36a4aa769e98054fc9e5f32ab74de15cffee68607d3efc839fb9b20ad7b6d1362892e7634e0d5ff0d1d3d6d68e380e95b054ea8000a5a0aa8c3061e58b987bc9042659f5a29eb6b3964e8c1843451b6899f8ba1a9942cb027ca63ef01f2c3d6da85eb6016a562ddfabde443b70e3288eef57c54bceb00a90c1ed6ca048f9fb48aeeb47fb2b3c42ddeea676ad2d0d1993f92e50ff7c125baa69dc9f2fa2d81b76612a6d1f58ca04125d418dde1a462ba73024702541eee8eb020ffa4c6a296ba5609069497ef3b5b32c480865574bf9df20b3725d775bddcdee20ed47bb4f2aaf8fa55ad1b52601c6c5fc28d9ccc207bb65454423080e0e0fe845b9eaf048b114cf9730cd547ab2a9c9d556a13f0819d3ddc74260931c0f6f5de77b7fcb8aa3627ded88885bd53e6b81c34fda1893680155445f648a3fd924be70ec2e1c4e30ab4798510092c67a96092f1f90bea27bf7833a9243fbd824706792593aa8a4817d0ce6a99b73e08f5340a2bfe5d193440aba01e14f7eb8f57d4689deede23e3dff113e7531a8ee24915545926c780fbc867b1eeed719c60c5aff1a5dd33e63df2ba5225fc0e459c6764110d6c6c495ef30e6a8aff3ba49842c495d3bfe73a8a90c068e2d82e9215e739264389fea251566fcb6d2f83987439d19976a8073da7f3416caaf880edb10db2d4df223110141dadd11304a54aafa085fbc60974616389728fb51edbfdd091bb4603a8ef9a525f5ea4c72bd8cd4c89909a4e05b8e42633ba5a"}, {0x0, 0x11, 0x5, "5e4d50a671d208bd20eb6ca493f1383c638f370c01e41cef7fc356e155151e65fdae2cc3cb22eba0ea2c2b10f19f4c9d3a89fac21a29c2da130ebf127fe565acd10788a01816b755726ca70642f0cf2bd979cb2c96c9d91652f4cceb9c7511d505d25f0c3ee440bce75d74998a0d1b73b2df4e3c8c0bcd5049175c089a2a97b32a12849dc69145f4cf903bf6c431c8"}, {0x0, 0x10e, 0x6, "9d8192ffa8d88bce19c278863cbd9fc32e3c210510f047189e57db44234b1fe347c6532438034879d9d7e786277ca2baa6a758aa7cc7da4fb2c87a2f54a30890458bd5749ed8a8aed71bd68bb9920a3dc98c80b1bbeac94a8555a86965395f1b14297f4d1121a3797881183ff17fcd4a99de691382290a133ffb9e6b28b5d8724b8811f2b4c6d830afb3c256395e20ffa436e0d971bd1501393d0fc595f77632d856ad8e"}]}, 0x1}, {{&(0x7f00000022c0)=@sco={0x1f, {0x2, 0x1, 0x1, 0x0, 0x101, 0x3}}, 0x0, &(0x7f0000003740)=[{&(0x7f0000002340)="42ea0fcf5ef6f25f378483d4b7cab569c0b86a50c614c51efa1dfe157e9d070eb5bfb5f18f069aa40e13502b5db55a9c6e94fcdeab0d99312ace5dc65e289370cbd8970ec18c34f555fb9d"}, {&(0x7f00000023c0)="b1f8b48b6e8fd72ea67851765f37b7c81466be8c3310bcbc430d7545c916372fb6cc9139ab238be7560d0c69b8e93324ada6d7e4ba53dead29874f6a485ebfe23867db3f6e91c09d53b1c5a6f545e96c9bdcc474d795bcf7904dfa18c3ba29e1216bc385e9e900bafca7903ef3a45a1b275ca8707f2c5a2321ec0e0cb9bd3a39933925520b573a1dd035f126dc19adaf53999cb38cc1d0447f62e747dcfa6f94503f525aed73c5e6cffe295dedbc"}, {&(0x7f0000002480)="2491d0b40e2b47d4547ff89a895c046eb22f5eda8e93b4d8477555ea8182e38d808bab58557df125b7be46ba399f795f21377799c8004f19198a74c02132e65673b225ea6e4b5314db22f9fa36402a552a39a5efea028e77d16a67d1a36815baf0ddf44755ed4cc731856de912170604a0728bdd7d2819c4de370cf8f429bbcc7d5dd72e7bb4c6de1a3fd46ac7486344e61fd1af5bf87c2ebc87f842d32cd9a5b0ed18fc0d55eed975b7d6973d5e87c37621e8c0f67803bde371331c0c3302b808f2eb028ba3a66254520c06cdf30de4a18cfd1488bda0aef661ace5626b11556ac4dfe4169504aa50e6ad11a6643305fc0301ecebdde46dfeb0f8688074e716697e43dababd5fc43912ab86f7cfaaf5ce8fb9858d8176d0e64633bf73b90cb8310869bdfa8e37ebb820e613ff82bb219c4521a2cf875547d246b4fd6b64aa116018d5607d0dce052077e89269abe4a51e6aa165c59e0be0d43a47c6c699f175971549744de1f5eeaf56ed3b886d1e7f7aa848440d6ab36bc14e848368af1e15b95f277d6c83c2bed3f2883755aa83583a125ab5da884ef808e99d9bc9f0dcd30fbfb7df71e82c7184b7258ff882ded2593c5ba8d43bfb662beb160d4f0572ee820355f97db3bc1032283b4a533ceacf49429e0f8d73fab46ebd0bf53af2a1b3bb864750f235e728fe60a90aa544a47931a93270a4b3e8b570f7dbf2fa12ff10ca70da97a9e36e32681774b291619553d9ee672dda74ba0655780550e113f6079d3f0ee6e0b0a262def300f1f9ad4d45dd8314c1f7185e6cdcdefd00c0afd655bd50d2e3731406b72e1a23ae6d00b5e964bb05482663ddcd2e7d64a4fc63dc0836ee1eb0900d73605fccd4d023cb08a3a5f6efd70802b93c6304406ebd6cfa9e0b26019dc1ff906a290809bd22e10f3f4c31f9f07dbc9ddb4848b2aa6a3c00f70a60fcc8012d9c291a02e3d4dcf345070db5aea1e20060fddbeb89c8f80e3ccfb04d84b19520022dec98d52924560913600de0d22197779a483f2130740f08672d207019c3545114f44228d23e9d3687d38c36a3486f64a3b0f6a27d377eea546649a63fc6938d5d6c468f185082d67631b231d10faca051a49c3381e694199e45c4f0f3d180d60e59627ed343eef798949b5396a3815e99c38bd8625d0b02b80abc672a56fbc2af538af0a364f3b5d359bf3dbec1578105682782a32255161e67a895bf06852716dfda045c74a758aa98ef74ab3107dd59a6938b488a2f833aab0eb3ea6640ed715d4a1840f1798e97e42dc9d125174662b1dd067421cdf37058219276fe4cc1be5331da1c564fe11f61acc5c2660d0d706362c9aa6ecd68dd1c562afc82d7ee0f53c9261135168eb777f892911c498bc47b701c3dd8436bc373888b4d56e3554b8cd07777daf767437987d64ba1124c59fe92ddf2c31b7146468a6ca88c75e0e85bd5859bff16514391c2f17a7bc2fab8498354de1dc370587a87acae85cbbdd27adfe787bdd06462e0e3d37d66cb3544cc6458b9c5e4a2b31fdbeb46cc8aa95cf96d957ea7018533613c2d0cde3eb132a72f7cebb6640380443356e6a12f8aea1cdcda1404b8a8f00ccfd56f34c08c7d8fe52ae5706baef6eaa7d6545cd36abc4ca78485f5d87461bdbfcfab03c4adca505b4bd9f0c8ce4be7b7113ce52bcf757cd48c7374d6b7572b5d6ab8dadb19f03cb8d6d77f3258180d805c56cfd96d6d3d3832ec7577700ed30c2e32ff3b1452149438e37e30b599de79955491acb4b5cc842d3f1fe882b7f46c790909f3bf9e933f7ae1b3dbef72a3764fd7783d3b675be166b9e508227efbf42b4fa8ec72bcd4e49e7daa3ce501911574879b7defe6511eac793427d6d1665a59cd45fd6606129c105b97c538918351fc97d2b7e02a87f4379656fc6c7540567e34b5302e5a529cebcdfc9156ec7c087cf49f6b9c1e793647cd6d8dda35327505669342812e874f5dc0a91e56eeb5fcc2a6f00acee5df0eb86ed4680442913e3e79d5ba6c2d472509e191f7907e1d25ea25a7c574005440ffafcca69b270b2575d2946730379cff77afc98bf51fffc11d703d02f2f9ca40144a7ed8ddf107812c8d5dad331401c880bd1bf8b11b1c86f69473ecad719d2cd42a5d0cc799c7a74bba6bd80f6593d2f84f0c1258dbd987e37755cbb112cf6e5bd03194fa501e6938b6e586ae9fc9258bd5864ee53ed525f1ae2797fcc586faf6d49338f35df924a790d027416a566d5b85bc9feb495af1a8b0b19a48f2d68913eb53ff09b118599c9ea91f10debc64e6fab1c842b2ffadfe0aa99619892fd838eae34ed5e7ae6e82f8b69924e5a2cd156590dee554bddf238a315115fc0e6ed71a910d8036d2897a2872264f9a4a37c77e52761b241d7d850a047f17669bdda3b1e3162bf2bb4b31c86459f81b30d12bb513d026df5b610b17011e524c1377147c67727b01eed5315130ca7f82dff42585b62ccfc798ded68861c86a80bb864e769690596edbec31fa5920b7fdcce806c5f22b58af50d8e430e63b4d8c391f466d26c36a8439443fbd536fbbedcaa545da0389ac08d17bbf089052f4ebd8fc11014cf75cb84b0458f0ea3bea1059bfde740448d2d1d68e78383c84dc0eef84ac7a6e3f57e0b6d3fab2a37039dc31516ac6c64271ac28683115dce5866cbf231ecc03d4473ea72bfca6f71b52ed6ece55e226c84f66fc22f51e75a58075034f46498d67af4caf16ac6987975727981eca6ee0ca9e0488ce214de05250d68f81ce1d7abeec5b7a9cb23a3b32d96a0286aaa0423902a8fa383fd03400777252789f9943ee06595561c79f59834cd99c7038bd9abd6031feb17c215cffaf5e909763faedba6e6006d757ac42cef5b1a5c567df6d270e7794c511d9c0cd210c3ecb98d36b8e5363d4c6aa78981772ea8bb0ce0ff81be2694556b47dc04668852ddff0c3b3e07ab489fd081db6c366f5b458ba2cf9fe12793f4298cbdd97ac873d2ee93c81cbe299792149e4104be96fe0e8d4b98dc61a31679a4b507d5482084b8d229c5bc1939015601e169b8a8550914bf9a51be8121c6498da233ef3e1d8e864a2e91b1a25488aa3b3c545b710d6e35fd402e978b1093d58c65d04d08a2db0ab091d6de97cb75d256dcb6cf0310d3b767b7fe6bd71ec0878a75bd154bc09423a718dee1720b1167d30f56a58e61a3f67dd30772843c33878ebf9f06e7f5b47738bc9cb1bf432ba78daee48ab9af9965716b67109df8cde8be25c2b5934918e49764bf6981acac3c58d7632b8e951de6a81aca3926eafc5e0ddac96ea6486619f2c3681741dd13f76a8e5473fc8487a5364a6f082a813925f856ae52043227b02ce50bc536dee65713cf1ec9495797043f3dc67d97a33715d522f1f5ed7228f2655fb7df74b5375a6589fbf38424cae9068252508c9640cd569ae688f765d4ca34c459c78a15e20bd89c45e28043a97c7d9a632edecfcd703dbef4a22c5ff5b90da4241415968dd380b6acd3dadbc7f1b72d060de96a41f8f3a49b1f35df1305a427e542dfb1817051f9f7723412ad7981d98563d7e1cd30b9ba69beaceea6986b06b982674f3dae5e273914795187912e16b93691f7c01dcc6ba419882297a647590755d65592990c61d8e05c4371839eab884f84015030396c177a92b3bc97d03c49baaebc3108d7f3730e3c300f6995dc6f3e2a51b82bb9804e5f69e58dfdd4e52615fe3aeebea0bc738dbd2e9e7e3e23c78cbcb01b3774afcbf0da1d34509165f6abb3d4ff91cd5eb46924963d35e364e17606190aa2a2318e528be702c9e541b05a0bd526114f32071cf852ab506cf4644aff1e1a0b988665c0bb0416981035b721586651e20e7ec3b3392a6e7304a68095c73c002288888bf5046f849a1b7ce91f36fac053ea5d5d33643ef3d2aff5e67664a60b1f2285d9259fc298e798238b27c8608c087d1e15dabc1b24a3d899ae44930b24ca142e6441b7546c4832f4f5510217da16ea732ab73a6bda0f6e45b4ee6496ed2d1ec97714a0f067289c7d8d0a5aa579234f9001a5dc36ba2a7ae7aedde6d243cfc8670a5af3e0b74826328e1e81560945caae0af7ff034b0f693bf5c40ebc23acd4637216d6d61325d2ed8d592968fc641ed7cb5a85f7f3dc7b5baf2d96a022fd7c96cd5ab18aa03ff94b7c33431a007520f6b58ae7038c49145449eadb450b2e67fd840b5f1002d84578c9ab19e5753dcab75fbf28521855d5d6b34ed48f8c27150074a135621cc3d2bc76054afe8665ac848c1019df488b1c7ddd65a587b816eed0e654a938f9389709cd609c56b1d3ab78786969394f16820b4269f785d0c9b761c0423ab1c432580cbdc3db20deb570b1023f1d8f5613753902eebb4410cdcb758250864d717e27538894aff6173f17064bbb374e69f8f221d164ec17e632eda94eae8482df1531246a162d248091e7018b83bc8b81d56edf7920165163d5a16eb7932a96b992587081dc19a155200ead53ce6a4859a1c16b2d116a899925c036526e0e429fd408c5064dd9c7a90af0ef94f99ab0f4461c687996950b45ca056f462f606501612e3a7a3825c9f3abeaeb7b4139ed9e410c1cf5866b351cf9dd96b839cc5cb2a9bbcc826723c4215985c969a93762a80038c4227c1e559138a73ad717f71c993dccdcd7d93adba90758e5fdeea75499663d0b44cc8ea6524a6a1139336d8fd16f4c392c9ad04977df388b25096c9924d8d8d89274ffdb43674dfca6169e921961805e5849d97b97fb2b18b8e69f8a1011741dc9fd3aab0549c4f02bdb8dc036021c8d59a9d57820535103840ac9b926a7aeef68fd1151ee94c04b4342d818c3b4da54207b47e0785e48dc15f1fef49627d81d5ef67306ce63f985b1f4bed160f62f5e7587c6d3acd8b5d1ec2ea4b87d0abbb792fd202d976171fb4a98ea52091a889a870afc9e41106800674522bb646aad140e88f44966d81f5d0252174d03712e99662eef57993bd1a8e14e31c0392df56afa290756b19de043242b33e7a2a14ba4f775962edab23f5cb5be1b8355ad8216b7b32e460a00f4ecf14cfeba2ceedef6b65ea203d42d01b9d0518585d5a745ff87f12a6c708cdfbd2c5a6b896d07855edded738640ffebca1ccfe5d72d35ef6dc3fdc1919286cc017d622f88b2b71b418e5643ec7eb0b24d599514dce6c80d6ef7413fa631d7c51145cebc9deb7eb46ca3442df0076f55d27a60c22e2c38fddd32ebcf58ae33d3db3cac3f7072cd7b60a1feec8a45e56a3540e94328ca631800c3519fad069a82048070b173ddbe3f15cdc011b0bf7e62fd7f07146c3767fa01ca9d5c5063f28f2fa381dbec5dcceb3ee0282a49797575632b7c9a70fed4ec5bbac0a8888d69722416ff80c19441f30ba8d3e0b051a28d854cbedc383dbf09c54b8c70ebe8d021858c26232ce483e7fc4edd7d21e1e4fc702e2b2a9cfb28fbd48d1193cefdb1c3b9f3acbe382f9173c866bbb54bb60646496663cd038995cbb7dafc4304bef82ac2d203ec7f04fa02b7470ed96aa8eb6cb9e024b6b8feefc2500e1d0ca636d8d1eb70c714e63c23012a09c79aa7857a62ea1ab257d166b44756d1931f6167456bfbe91902eb9fbc9746171c575743c94c9cc1cc365f81f6db355ddc99f1d40ad59610ceb9792ae6f071aa98c9cff057ae060f4a29d82b8c9da812ef1200457fb9b630571fe82101cc2a8d027dc4bebccea511a286620425da3a25532ef8bd630b3767ea4e0b671e3351d371a45551333b5e52cbb80ddc4ff995f8d8f1781"}, {&(0x7f0000003480)="81e2710e552c65990c0382ac1fc50e088caaee197978197e6853326e3fa01420ed245783e0e29c252036c692d0acf6aa4f8256ce76624fc6de16e0276e9a6596a649a5b7fb4c54ab32d611b1dc6ee54e080fd97422c9700ba7a6544d37badc86e06eedee397cde678beb010e0c33892a24d065cea8d7222991b24241b2465279f44863bc4e8ec03253445295061531f78cbcef020118f1a5b43e8adf9de1fdac9fee154f9169d38699b91c918b286483f2b259ba0413845e7b2da4f0ba7b568f3c4bbd80546dfe940ec30df196f9b42341702754c211eeeff064c5b2bf"}, {&(0x7f0000003580)="b415113092f7f867c2911ed64de17a85c20ab13087e8f2ef6a3731eaaffe337bbcf044f95bc1b65c7561a89a0f684c11cdf3293484d4cc8242e1c989ec47b70941a969b3f5472c0880eaf8c90697f647d7b6cb66712ea757d22bbe4e6967ce381a488e6f1395920a531d21e6419672b962940c2892ebe9a963fae4d03fde87"}, {&(0x7f0000003600)="42a7bc604935f97f78736c8781df699317bda1c83a2638a428f1e9286f2864f0b3e7c7bf14a8944d06fda117abe8df31199c56aa493ee118759d8589c15e18ca84e052a1446515a1d4346e54ad9caeeb59a43e8d8fd467698480ff19471c906400bd7d342524fbf5d71c"}, {&(0x7f0000003680)="f83a62c8d3ec99e36cae40ba2465ecb973b5d19ee1508b865060b6da3aef5452f59c787a094f00ab4e458c313b17fb3adb91aea244dff7ef0c99f7d331f02adf93705e8dc6b1249c378a6681adf20b03b0163ff2ab45a19674536abe1574b83108236a1089f653eace5db3d983a0374a6dc57b9782d85464c58eec7114629d1cb464d6c86c34122ef197e235a3037c74f49cd4a26155f885f5ade5a604954de713e8ff84bb20d5dfb189"}], 0x0, &(0x7f00000037c0)=[{0x0, 0x6, 0x8, "3dee5a5dff37f89ee0d3beaabbbf2a491785f3bf7474749706ae523285e914e9aa567c14f3c9510c6ad8c96ef13ea7a9c2adeb0c69ef0cee4bda8d0a9bd993201cf41bc0697790b488446cecf532a9949f5db7d63d368a629ad99f409e1f1762adcb37b000d6c13997e4452fa4d3a0f941303a8eeb95771bed00f2e4b1c70b7322864408621dbc637c7f2d8eeb68a65763566b3a3de78dad47b91bde2ddfe2"}, {0x0, 0x117, 0xfffffffffffffff9, "93b4bd349086d9181d7d9e9e38e61e349aa381eebbad607c8a27651bbc0d7777ac1f6bca44cefcbfd721129619d9a4a9cf232dea6ea452407d440b508d42"}, {0x0, 0x101, 0x0, "776f924b4d5629bd51b279024cdd609b81f6f44f0ac77f25d02788274794c1851c4ea1606d18ee06392bd2c0dc21d910e15bb60b0ac010e73eae7b00d254ba76f9c3083093a7e934b099fb08f3f8a76a85dc5b93702a432122587a5c5b432cbfe85a61b923b1a95ca0ddfa68a848f105dd3bd7a20e83b9d1593a75c1acebad4f259e5b4afaf5fc10b48426413da746dc621f04ccc889aedd3e56069902f7edae8ce31cd6ab980f918ea9e6db7c88516011592eed583ff37ea701cb7b171c67ebb6bcbe05601ae415c020e3404384f13cb3530dd1f093d5"}, {0x0, 0x1, 0x7, "91b7a122a0f74ebb19bb8c165bd7ddc6d0f0c74bf1298938326f8148c922f90bd4ee6f4f0f00a481da724fc9cc96cd33958ce34b7d557993cdda"}, {0x0, 0x13f, 0x3f, "3e7d217dc4cfa55fe5efceb9bb46845e3280fe5de58aa0037485c801a01dfe595618a78fe8b86cbad0e7a481d3583df0dc3bdf2e04381af8b74ab5a02bf7e1f9428de25c641bca2711ee9c07667952d3de5060b53eba6d231f172800a01877abc622c464ed4e5b2ee9ef29b3b0cb6e0e4fa756934ab6d176228d1db757261d97a51a178405c4373d8538345f8e969cbcc9c7f77f919dbe6479474ecc67c277f555e9a64a88e9601a25717d12dcd22a6e"}, {0x0, 0x109, 0x2, "2a714563574e1b1da1cd853a"}, {0x0, 0x88, 0x7, "5d9d0f040d08b71714a43101741e9163ed95177e5322e3158e2f8359536fe650122a82846474ae2d705b97889b7bb79d9c6ab2e8a7ee04a8dcbecb225a09e1851843465756c52694f2d24a549320f9398b90aec0c2e624eeb2d624ef4d9f780faf49a6ac4264e19a326f06ae484002c94d8cfba3bb05fe2bc1423f4b0c3bbc799841665b7be9958fee8b0333c7ade9c2305ddd9f6147f4ec366df673d29efa6421a83f6e0cf815874a6321e196"}, {0x0, 0x117, 0x7f, "d266b9dd9fb288d6bb57c37325e2bfa0e6ce2a393cca6e3eca4c80c9d9cc12801064f49df2051dc2ef4be5b6fe"}]}, 0x7f}, {{&(0x7f0000003c00)=@alg={0x26, 'rng\x00', 0x0, 0x0, 'drbg_nopr_hmac_sha512\x00'}, 0x0, &(0x7f0000005000)=[{&(0x7f0000003c80)="2d3eb403181fd1477424c6b6b05f14e30a9b8f78bd272374dc4bf54ef78cb0b9e390bc4d6860d44d21f2f5316269e204f9ce73084b9022395ee41b1559c30ded171488d489d50d6f3fbe0aa9366208bf34f21aa2ff20d9d24d633570e18ef896153a9c6d4d9ef5e7a9da9faf6543c0963d7ba2bbbc803505f3fbc7fc26d532bc43005c22ea5cb6076079267231b6c2512c9fcd4b6dba32ed2ad7bf87d840b83befd37ad1ec83f36d2063dddbfd46d194f0aaf3be7572bbf8bd77c1e6fdf4b181411a4bc6626aed767d033d5ea9efb0d19be7788706e5d580abca639e"}, {&(0x7f0000003d80)="ef09d18e82d691b38f9d4d8e2b01bf8346ef3298386595b66ab1e3e5b3afd3055a3cf89181816725e40a269e8e17cb76875350cbd2ba6f45eede1a3fdd3bb6234b2090d4c3d84cbebf30a512edce892a6e1d5cd70b1ad0224b4277db9b7beb53421e1f3ff11b28634da858b6fe8ee0eab29f233ef91aed2d5b8b5d60d72f7087c9d2245fe1b41acd37705c68437898"}], 0x0, &(0x7f0000003e80)=[{0x0, 0x117, 0x9, "59f3d148594fc6c1d4f62aa3d14730757f2b70d503a318db88f89ea2fa52711362cd61355f9e10f7c127554f404b31712f154dffd4ab0d3a280df2e5bc7efdcf23a0c22134846a1499415eed816b426424034bdf8fe4f048c9940664343a0278a7f863a71b7113db3284c3c35f6dc21125df8848b87d7b0c045630bf53e3ec7aecef73f5abbab4e6a66ad75ff9d813f051f1acc45a4fbd5dda2816baf44ce689a08906cd6ea6b425b684b05a21cdc59a7103516098e2ec075efffd15162dfefbf193b6a7553def2dc0cca90dd63f0d32c2c0527af863e476ecf74b91243944e0db37be44bd17f054265618eb34a1805213113643539264619d1d08d78eaa8266ab60d02851899df794a471602c24d472f2bc5cb34d521e39c920864ddd2f2c4b8ad9ee7dc21ab7a0af12cdab1239117bbd98306af594912a9ac0482e218daf67e110a44696eae6a9a876ace7cd65599d7e89e482b872ff0dd056c293f2746709604bd97d9bd2e44d6ab4f0bc6c95b428ebd8af25f94710e027a03ef6b18a458199fe204183a851f5def0d9232d7446ca56ea3645899c65a8a41bdc9357b750d4d64fe55e469b6a09233c930330724f24e74979b69e0a8e2dadbc6a85dbcc982939242be050a2b37a8a3591b0a4b47a8c26f3523aee456f8865256160778723f2e6729457d4355c76f86d5f70752f60e36ff30235cb1067bb26e1c65eda13bcbf2f4fc75a8f742239257569c797bf4f955379e9fa976ee57402ae7493ac6f9baf0e6da7b0f66b715e2be448e99a8688e24a19b9d830623df699c9fffa079d977153ec09b733c7b8f00b4edb166592ea17ab5aa94a52d23022ba3455aeca4a26b39050d23dd27e33d403fafa93db23e9e734d120dc20b3ad6d450856ea0fdea916f54c0e0fc40a3fd2087cef7f41e2fb7497e7fef4ec91e27903d0d595a22a446a6a180b6ac9f4b1ffe902095eff991b74d7222f744236e3349d2aa1c73e32ebf61d4bf19428b1e5c0b17080c9f29ddebe08c16de45dcbafb7d0baf4e494902e677c9ae8fef5a22b15f23d845a388a7775e39337eea69292369f0e2854bc5cb9006c75c070db80361d40d63be72c9fad2dc380af5f3c7b7b8138228a80f495ba41280a203f37879ca541acbc4bd3b9a25e7060e7a013dbe25e5576756d23df66641a095d76f020b6644db2b5339c87efab8289305c4a9729550d142569c0e8f895777b83fbd3efc9c5c72b9482d29fbd186fed041f90f0b8fcf48a47d7c3076e74c0234fe3f7d8535d7f13b46924205966af25b704a35635d99350ab110df14add843b2d95ded23b8af0afb8a3fbfcc8c3f34f9bc3dcc8028155ab96fcd266a37cbfb19fca4727834ee88de70d5df25ad6cfcd71ebdc39920c61f0673153381f78bc2802f18cafc08da8aade2159db5b8551b2df729a5a4bd031cfd0dc12885f4ec5c9f17d8a109bb672321158c60c81a14ae52c5e7a69aee4daaa5b16b4c4c9e652ef600002f0f605b7c9d22e346e22e1347a450e85a70f02cba20c34d2f7ac88d004b7bbd56f51dbccb4e7eb9c83c2d5571c3e298758dbdc451311904659471ffa49e3bfd16dd14eca77dbbd28107d4c0e61761b6ab864cc743cbf40f26d4fcb85169dfa8a024ee3e13c74e25d4beab98d7afc7f4535cfed277e0ebc06bb92ad53b8ddeacc5c4640276e6710a3f708f5372e8680670ff5f6be455e83ed21af5813c58c6e42109c067b4f3f711fbc4ed84ee08ec07df594c9573f78f6ec06095023dddc35f51b0b9b88506fa9144facb65fbb1def836f29c45d7d3f814c9d45c69e5d1da8674b5934d33a2ed0762efc3670f43e34b46d4439e114fa508ab2029fec3b7a5410602a5f555b744eb49282d1a8c0d3becbb1a8c7c0abae67be63d69f7b1d783ab1b1bd023f50fd44be4a6c901b08f35d4e68a5f0e9f408a34855842f4b178d19aabe751cb380fb3d2ff4870ba0aaa9203a4cee097054f7cf52e251a5572fa1aea2065ea578308792fa94ccbf2b6db7b0d56d60a45a57a997c1c4af04c2eaf1eca0fc991da0ddb2ab44f667153783152782f5b154554dd727f99b8d8070bb295a7030d5bc2253c83022aa391e4518e41d5efa0c9090c32702798e300ffb9dc38599d15314dc0ca89d17456cb876dae2808b2af49eec33617d9a5e2c31f28d50fcc2bff9197316213b7d146039153a20fa7169ccafdf693701361aaabce710bf865c37bc2cc7c8225742e589d26c5d26568da26c8b50bc8dc886d30b3ffaaab25f6e8c3e50719ecd08421ae927515b8f1294fc81eed2102d0fcc1e98325a0d857d6ee91f1823fb4ccfb0c9f6ce157776088358a250c70f97af02f8dbd9fa01aaab103052a6d343832c3e75c486209c3d2655b2082a4885645989a71c9cc4e3298d2027482d584143461b84990621001478447cd9de30b16df9048c15615e1a43e69453437ccc310bff3776e89ce2e7d69413d4fd49f8e194ba9e7176bf35e3126f1faddeeecd04a6844e6347be89f71d09ba68bf7a92eac8af59aaf3c07153c5aedcd26b1c0c53440575a354645f790db70cb7b5b85fd2990f5c2d6d74ffa1a8630a0d6f48ff1fdb56bd85f2f99c76d03c7bf001136c3fbf0e5d4c36acb049931c72993ef5dcc065a117338a6afa189a35ce97509cceb01f1aa588e087846f03f75eee30552900e0a33dc9540927984139ebb322002c1d4cd781b368e30a8fcb8668aeb7f7ac3b5e4b4285ca839acdbf765db9f8135181aa429014143fa398d7eed712b4487b45c923a3f63738a4b74177f5c617322161e58b9c9fb4e51eae1abe36ba988c5f2bef9ded8b97b50b083b7d33835cb3d1c3015ee2891c3fcb8395799a727a767a7f748e4f6a31a22ded94e8dc80513945779c6848fe6809a97ae4bd0554855f5845950ca5c0bf2a44867b47a38e26c16ae47b3da00223c41f89d37de8e273d80c2802bbba964bb28ce4be065e169eff0c262254e5ee94ee9660fb6a0ece04dd1f14dcd754c905ac8792c91e4767372a283d3dff0043647df84a155cf4c8b0c4b3efeb9d2e06c1f5c2a56975602a9d10bf610117bde8863c1ae61e9d71a7e0e9c94e748ebd0a85d54031e65929d43a08b33903e51f4dc5c52e4c2d2d029b0969b21f8aec5c793c669b33ab6cea59018758a85596413c2991452a34af6114df3b2e6e319555936ec95c94b79e16d90b5f9cf6dbf296c96591b6b6b44cae862930f654f03fd3a7103cdc09a9ea2ba39cc3fbdfd8fe356c07f585567ab40f25adaa7a88bdb8ece2058a0abdf32939de33b611c53e9a98bb211e45876d0f9ae60bf3f275e4b3b4899f05acf51de652e62b6cbaa0e3a12d305581969f53deb33c056c04b2ab70b82cac1de5b469b6d3cd4997c8e7c33581478a76004c40a5f0b384447d6d42b2a254a8c4f605022213aa8110964cfe48ca9c7bc1976a097382cf729c2f9ab8bf9cb0e123b2eb239a8e72ba4c29885cd1dbf4b7351ed34d59f267c916c819db1b18a9b8bfdec881fcc55338d71ad13930743d01c1d69e2a095a1bae2b88384c92609645502a86641f6384150b587a46b348be767859281b1f4cced0b79bfa411d77614cff5e762c1105a6997bb2a1968054e8e7b4d5b3f880fde0eb1708c5027cf56da4acacc7ce6f7b2757cf0b5f145957a0c72339247b2ae4d16b92e200622b252f712d268005a093f799dcb6f3d3c73cd1c86b89416eb858cd5ca6eb2e2f320c5ed3836e2a87305e05754ae3a11af36f21365698ca716f0a582da1dc5ef469f54071cefd7b93e3341774ee28f8abe3b5c619c74dc983ea0487838e389908b9de164e07a55671678a21cf7fc352ef9dad309e7883ae5531699350da61065fb09be0a13ec7e7f295c02992f2540518dc5f7c26b00af32576c57617ebc6066f68363632c3673f138b33f82c6d8c894f0a7be6d360364924d5c6436ede5acc0904bdce94b7a93f8144f487d684f09edf606b3d267b4b8ca42fad0e104b9b3c8df3f9914f82e8801fe3d9fe6744bf5d5b44b91effe9d6e1772f845a62853e3df56aecc56a24b8f0c29203f0310789bdf2f9f48ac027e4dbcdb426bd279031a733a76e4d0ea474322b995bf5905885c42d649e135359d9e9df97560baff0d3a15907d674ab40148bf4aa4d3e0f3e671af88c24175eb6556a8b2ec93f0a67640cab5f6d54ccc5bc6bb0d6d030f33d2e1b3b35ea3498e5a6f93425a38f8dd3316ec2a7c95a4e842ced6428ffb32b18c2253be1f72556a18b078de348456e105f97b8bb3107401db50d1639214686ae38c54e3904b2f7ca2d70b3965aa6955c084549ecba5c0a864b59e4b348818f9767b69ee4f87503b28af69973acbe9d9e9dccbaf70a23fc0544cd886982e6e62a1dd56c0230fa52252113897afe882aef7c0bf0bcdbfe6e2a703a00dab49966bbff84f03e28633ec34cd3100f60d4a7cc01cbdb6a5a41891f9e10ecd25bc039d932c728888f5501e3586cb3287a460c991d884122d243bf0020a8585abeaddbba50e8fbb1a89e98e4658fb6d87cb8d0f13eca461dbc954585375b0a1f25631cc15a38d3e83135bf55072b2308a32dd6df6c5d4e4794bdb8070f2e2a932a19da71754c6132c800b1e64e9e5c6f812c550776b68e312169f4531c1febc2fbbd3496090a7b6d814ace8ee639f71ac0a4d4bf48417f2d5053b99d209fd73db8292558aef7e2f71c58d58d34a08b4e46995bf09dc76739c499b4cb9a7d8c599d3eb0f2a4b6a8197431d307f969434de09ad1ad308c3ea33962beb964359ebd722bf5b779cc156ba3af5fa4739510c71d2278c0870889ae0cbc1ae703cd1804963758986be12c46a780bdd5ab433f9ae16b0bd416c0bb2119ded7e963774f8c27e28accf679ccfa40d12d96e198d8ddb4213319f84552e87712c251d52722b9c8aec05aaf31c33ba87dbd2960040f31dc4df44d698ee041363fda348732c47efd34855ba499c2ed5be81692f0eec5809fd909ae13ce5338a77441c5724349aaad906bbc226f43b3497f1f4abea84db502062498a3b56ae8c14e108bf9960fc84ab4e203db83776962e838609655c47bcd46fd57c6719fac516add027a99c88a0172b11d15d9a85f5f1b3b3fd32860d49f0c4f10895c71d920b54e89140fa2659467490a737ec64355312dec2a18cbf8630887fefcc3b9d0c8ad35aafd58485849acbae07726ed82230f6fa5de9c41c4c233d6f56425d9366aa48601a234adc280c79529aa82c2eb1c6b04f8fcedf24e1552d207d8e736a8f9aefc9dd1e2728c771adc329ee8837b4bb5d60e24e536828e707ac1258a9b1d7d329d5c394dd76af11527261591167097372332a13a5b3fc50acda3e3e5bc95301be8373a4948842d7a945a970f7ffcd64058a655281cc6627e82aa86698cff488e0456a5c8c773191ec87fd1769e9b1e81a317b61c9fb3f520944e612acb0b261aef488ec0e8ef94a8b873a328a367ac02512ca0d70949b7567928d4a30bc9c8536f585fbeea5b91d3a2581a04c9f324ef4435c20c2963096826914bf2ac16960fce4e8b01568422896036f5dfbad5299d3b6a4a88a68ff2a49d57a7df5fb21cd8da09226af6df0373257aac0d3e4e673eab7f6ae6818d5c5275c5b5e826fc4ddb25692d9aaa65790b094cd4ee52d95758527033e1a990aeefdb643b27968f38669cd9dc3ce9ccbae609e5a351d1429e3a07499f79e7b9d5fdea3de6d0b3304f6f2187aaf1c7832150d6c41db0dffc675db1c9cf1226fda560938c9fe9f7f70e99912dcd77e2e47422d831db49a4357d06b764"}]}, 0x1}], 0x213, 0x0)

[  374.266525] binder: BINDER_SET_CONTEXT_MGR already set
[  374.282080] binder: 16962:16974 ioctl 40046207 0 returned -16
05:02:24 executing program 0:
recvmmsg(0xffffffffffffffff, &(0x7f0000003140)=[{{&(0x7f0000001400)=@ipx, 0x80, 0x0}}], 0x1, 0x0, 0x0)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = syz_open_procfs(0x0, &(0x7f00000004c0)='net/rt_cache\x00')
preadv(r0, &(0x7f00000017c0), 0x90, 0x0)

05:02:24 executing program 3:
recvmmsg(0xffffffffffffffff, &(0x7f0000003140)=[{{&(0x7f0000001400)=@ipx, 0x80, 0x0}}], 0x1, 0x0, 0x0)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = syz_open_procfs(0x0, &(0x7f00000004c0)='net/rt_cache\x00')
preadv(r0, &(0x7f00000017c0), 0x97, 0x0)

05:02:24 executing program 0:
recvmmsg(0xffffffffffffffff, &(0x7f0000003140)=[{{&(0x7f0000001400)=@ipx, 0x80, 0x0}}], 0x1, 0x0, 0x0)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = syz_open_procfs(0x0, &(0x7f00000004c0)='net/rt_cache\x00')
preadv(r0, &(0x7f00000017c0), 0x91, 0x0)

05:02:24 executing program 3:
recvmmsg(0xffffffffffffffff, &(0x7f0000003140)=[{{&(0x7f0000001400)=@ipx, 0x80, 0x0}}], 0x1, 0x0, 0x0)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = syz_open_procfs(0x0, &(0x7f00000004c0)='net/rt_cache\x00')
preadv(r0, &(0x7f00000017c0), 0x98, 0x0)

05:02:25 executing program 2:
r0 = syz_open_dev$sndtimer(&(0x7f0000026000)='/dev/snd/timer\x00', 0x0, 0x0)
r1 = dup3(r0, r0, 0x80000)
ioctl$UI_GET_SYSNAME(r1, 0x8040552c, 0x0)
perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8)
r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c)
bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r2, 0x0, 0x0, 0x1}, 0x20)
openat$cgroup_ro(r1, &(0x7f00000004c0)='cpuset.effective_cpus\x00', 0x0, 0x0)
unlink(&(0x7f0000000900)='./file0/file0\x00')
r3 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r4 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r4, 0x0)
ioctl$BINDER_GET_NODE_DEBUG_INFO(r3, 0xc018620b, &(0x7f0000000780))
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f00000000c0)=[@enter_looper], 0x48, 0x0, &(0x7f0000000700)="2ba063fb309ec7fdbfb08e6e91baee7d7d4599fe14129a4d426834556ae420e087d59c0c7be7fcad1abb7e1f8f446f373f611ca1ee9c2231708e18a47bc68a2a79a0b48931f6ff6d"})
ioctl$sock_inet_tcp_SIOCOUTQNSD(r1, 0x894b, &(0x7f0000000480))
getsockopt$inet_IP_IPSEC_POLICY(0xffffffffffffffff, 0x0, 0x10, &(0x7f0000000540)={{{@in6, @in=@remote}}, {{@in6=@ipv4={[], [], @local}}, 0x0, @in6}}, &(0x7f0000000000)=0xe8)
ioctl$BINDER_SET_CONTEXT_MGR(r4, 0x40046207, 0x0)
r5 = dup(r4)
shutdown(r5, 0x1)
prctl$PR_SET_NAME(0xf, &(0x7f0000000380)='/group.stat\x00')
syz_open_dev$binder(&(0x7f0000000880)='/dev/binder#\x00', 0x0, 0x2)
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)})
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, &(0x7f0000000780)})
ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f0000000680)})
creat(&(0x7f00000000c0)='./file0\x00', 0x0)
openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000100)='/group.stat\x00', 0x2761, 0x0)
clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000080), 0xffffffffffffffff)
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000003c0)={0x14, 0x0, &(0x7f0000000680)=[@acquire_done], 0x0, 0x0, 0x0})

05:02:25 executing program 5:
socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000005c0)={0xffffffffffffffff, <r0=>0xffffffffffffffff})
ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200)
r1 = socket$kcm(0x10, 0x3, 0x0)
sendmsg$kcm(r1, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f00000000c0)="23000000420081aee405e9a4000000000a00c6ff07d800400300000000000000000000", 0x23}], 0x1}, 0x0)
recvmsg$kcm(r1, &(0x7f0000000300)={0x0, 0x0, 0x0}, 0x0)
recvmsg(r1, &(0x7f000000db40)={0x0, 0x0, 0x0}, 0x0)
recvmsg$kcm(r1, &(0x7f00000002c0)={0x0, 0x0, 0x0}, 0x0)
pipe2(&(0x7f0000000040)={<r2=>0xffffffffffffffff, <r3=>0xffffffffffffffff}, 0x4000)
setsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX(r2, 0x84, 0x6e, &(0x7f0000000100)=[@in={0x2, 0x4e21, @multicast1}, @in={0x2, 0x4e24, @empty}, @in={0x2, 0x4e20, @loopback}, @in={0x2, 0x4e21, @multicast1}, @in6={0xa, 0x4e22, 0x8, @initdev={0xfe, 0x88, [], 0x1, 0x0}, 0x8001}, @in6={0xa, 0x4e21, 0x8, @local, 0x40}], 0x78)
ioctl$sock_inet_SIOCRTMSG(r3, 0x890d, &(0x7f00000001c0)={0x0, {0x2, 0x4e24, @initdev={0xac, 0x1e, 0x1, 0x0}}, {0x2, 0x4e23, @loopback}, {0x2, 0x4e23, @multicast1}, 0x0, 0x0, 0x0, 0x0, 0x8000, &(0x7f0000000180)='dummy0\x00', 0x3f, 0x8, 0x81})

05:02:25 executing program 0:
recvmmsg(0xffffffffffffffff, &(0x7f0000003140)=[{{&(0x7f0000001400)=@ipx, 0x80, 0x0}}], 0x1, 0x0, 0x0)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = syz_open_procfs(0x0, &(0x7f00000004c0)='net/rt_cache\x00')
preadv(r0, &(0x7f00000017c0), 0x92, 0x0)

05:02:25 executing program 1:
r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000200)='/dev/nullb0\x00', 0x5000000084002, 0x0)
mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x200000e, 0x13, r0, 0x0)
r1 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x4000, 0x0)
preadv(r1, &(0x7f0000000040)=[{&(0x7f0000000400)=""/4096, 0x3ffc02}], 0x1, 0x0)

05:02:25 executing program 3:
recvmmsg(0xffffffffffffffff, &(0x7f0000003140)=[{{&(0x7f0000001400)=@ipx, 0x80, 0x0}}], 0x1, 0x0, 0x0)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = syz_open_procfs(0x0, &(0x7f00000004c0)='net/rt_cache\x00')
preadv(r0, &(0x7f00000017c0), 0x99, 0x0)

05:02:25 executing program 4:
r0 = socket$inet6_tcp(0xa, 0x1, 0x0)
setsockopt$inet6_tcp_TCP_MD5SIG(r0, 0x6, 0xe, &(0x7f0000000200)={@in6={{0xa, 0x0, 0x0, @ipv4={[], [], @broadcast}}}, 0x0, 0x7, 0x0, "4877bb1f560200b1fa5fac62b013ec6b7a9ee231ea85a1c7f5c8fdf3bcaf6c5bb203dab4011d7c6096609012d3e979295204ae936681b23832f322a5020f3f6af0b1d2fb5a00eb0900"}, 0xd8)
setsockopt$inet6_tcp_TCP_MD5SIG(r0, 0x6, 0xe, &(0x7f0000000100)={@in6={{0xa, 0x0, 0x0, @ipv4={[], [], @broadcast}}}, 0x0, 0x0, 0x0, "1c56400ef08dc0d7f6ffea3199772f0577915623cdca191dcc06ee3e04cd4eb98b6e444bdb49a176ca0be49468681ed3a055edd05610db8ffb464f1417af72c5677bdc0183e8da9f6e9d0d8071771351"}, 0xd8)
setsockopt$inet6_tcp_TCP_MD5SIG(r0, 0x6, 0xe, &(0x7f0000000000)={@in6={{0xa, 0x0, 0x0, @loopback}}, 0x0, 0x9, 0x0, "a761538f0cb965fa3245641fad2608e0e103e7516c4aa6c2493dcc15b8a1220ff2f1cecde4de877ba4b3ff161d972cf338d68f07708d05c9fc5c2736f47f15a262086958dca7c1a000fc71717c4a8e26"}, 0xd8)
prctl$PR_SVE_SET_VL(0x32, 0x18bee)
openat$autofs(0xffffffffffffff9c, &(0x7f0000000300)='/dev/autofs\x00', 0x200, 0x0)

[  374.973667] binder_thread_release: 4 callbacks suppressed
[  374.973675] binder: release 16962:16974 transaction 561 out, still active
05:02:25 executing program 4:
r0 = syz_open_dev$video4linux(&(0x7f0000000200)='/dev/v4l-subdev#\x00', 0x1, 0x400103)
ioctl$VIDIOC_QUERYMENU(r0, 0x4020565a, &(0x7f0000000040)={0x23, 0xf0f000, @name="8b628a533249afdbdd19ccf8acf18b5d31f23021c7c49fae38880c27c076c8b9"})
r1 = openat$apparmor_thread_current(0xffffffffffffff9c, &(0x7f0000000000)='/proc/thread-self/attr/current\x00', 0x2, 0x0)
r2 = syz_open_dev$admmidi(&(0x7f0000000080)='/dev/admmidi#\x00', 0x80000001, 0x14000)
getsockopt$inet6_IPV6_XFRM_POLICY(r2, 0x29, 0x23, &(0x7f0000000240)={{{@in=@initdev, @in=@initdev, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, <r3=>0x0}}, {{@in=@multicast1}, 0x0, @in=@multicast1}}, &(0x7f0000000340)=0xe8)
r4 = geteuid()
getsockopt$inet_IP_IPSEC_POLICY(r1, 0x0, 0x10, &(0x7f0000000380)={{{@in=@loopback, @in=@local, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, <r5=>0x0}}, {{@in6=@local}, 0x0, @in=@dev}}, &(0x7f0000000480)=0xe8)
setresuid(r3, r4, r5)
getsockopt$inet_sctp_SCTP_CONTEXT(0xffffffffffffff9c, 0x84, 0x11, &(0x7f00000000c0)={<r6=>0x0, 0x20}, &(0x7f00000004c0)=0x8)
getsockopt$inet_sctp_SCTP_RESET_STREAMS(r0, 0x84, 0x77, &(0x7f0000000100)={r6, 0x17c3, 0x9, [0x4, 0x2, 0xfe, 0x8, 0x20, 0x4, 0x4, 0x5, 0x5]}, &(0x7f00000001c0)=0x1a)
setsockopt$inet_sctp6_SCTP_DEFAULT_PRINFO(r2, 0x84, 0x72, &(0x7f0000000180)={r6, 0x2, 0x30}, 0xc)

05:02:25 executing program 3:
recvmmsg(0xffffffffffffffff, &(0x7f0000003140)=[{{&(0x7f0000001400)=@ipx, 0x80, 0x0}}], 0x1, 0x0, 0x0)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = syz_open_procfs(0x0, &(0x7f00000004c0)='net/rt_cache\x00')
preadv(r0, &(0x7f00000017c0), 0x9a, 0x0)

05:02:25 executing program 0:
recvmmsg(0xffffffffffffffff, &(0x7f0000003140)=[{{&(0x7f0000001400)=@ipx, 0x80, 0x0}}], 0x1, 0x0, 0x0)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = syz_open_procfs(0x0, &(0x7f00000004c0)='net/rt_cache\x00')
preadv(r0, &(0x7f00000017c0), 0x93, 0x0)

05:02:25 executing program 5:
r0 = socket$kcm(0x10, 0x3, 0x0)
sendmsg$kcm(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000140)="230000005e0081aee4050c00000f0000709110ecab372942b44ee4a0008bc609f6d8ff", 0x23}], 0x1}, 0x0)
recvmsg$kcm(r0, &(0x7f0000001340)={0x0, 0x0, 0x0}, 0x0)

[  375.157380] binder: 17028 RLIMIT_NICE not set
[  375.202768] binder: BINDER_SET_CONTEXT_MGR already set
05:02:25 executing program 4:
r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x62, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0)
ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r1, 0xc0a85320, &(0x7f00000001c0)={{0x80}, 'por\xff\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\v\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00\x00\xff\xff\xff\x03\x00\x00\x00\xef\x00\x00\x03\xff\x02\x00\x00\x00\x00\x00\x12\x00\x00\x00\x00\x00\x00\x00@\x00\x00\x06\x00', 0xc7, 0x80003})
r2 = syz_open_dev$swradio(&(0x7f0000000000)='/dev/swradio#\x00', 0x0, 0x2)
ioctl$TIOCMBIS(r2, 0x5416, &(0x7f0000000480)=0x6)
r3 = dup2(r1, r0)
ioctl$SG_GET_SG_TABLESIZE(r3, 0x227f, &(0x7f0000000180))
close(0xffffffffffffffff)
r4 = syz_open_dev$usbmon(&(0x7f00000000c0)='/dev/usbmon#\x00', 0x100000001, 0x80001)
ioctl$FS_IOC_GETFSLABEL(r4, 0x81009431, &(0x7f0000000380))
statx(r4, &(0x7f0000000140)='./file0\x00', 0x1000, 0xfff, &(0x7f0000000280))
r5 = openat$vsock(0xffffffffffffff9c, 0x0, 0x0, 0x0)
getsockopt$IP6T_SO_GET_REVISION_MATCH(r5, 0x29, 0x44, &(0x7f0000000040)={'icmp6\x00'}, &(0x7f0000000080)=0x1e)
getegid()
open(&(0x7f0000000100)='./file0\x00', 0x0, 0x0)
openat$sequencer(0xffffffffffffff9c, &(0x7f0000000500)='/dev/sequencer\x00', 0x1ffffe, 0x0)

05:02:25 executing program 1:
r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000200)='/dev/nullb0\x00', 0x5000000084002, 0x0)
mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x200000e, 0x13, r0, 0x0)
r1 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x4000, 0x0)
preadv(r1, &(0x7f0000000040)=[{&(0x7f0000000400)=""/4096, 0x3ffc03}], 0x1, 0x0)

[  375.223759] binder: 17025:17031 ioctl 40046207 0 returned -16
05:02:26 executing program 2:
r0 = syz_open_dev$sndtimer(&(0x7f0000026000)='/dev/snd/timer\x00', 0x0, 0x0)
r1 = dup3(r0, r0, 0x80000)
ioctl$UI_GET_SYSNAME(r1, 0x8040552c, 0x0)
perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8)
r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c)
bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r2, 0x0, 0x0, 0x1}, 0x20)
openat$cgroup_ro(r1, &(0x7f00000004c0)='cpuset.effective_cpus\x00', 0x0, 0x0)
unlink(&(0x7f0000000900)='./file0/file0\x00')
r3 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r4 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r4, 0x0)
ioctl$BINDER_GET_NODE_DEBUG_INFO(r3, 0xc018620b, &(0x7f0000000780))
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f00000000c0)=[@enter_looper], 0x48, 0x0, &(0x7f0000000700)="2ba063fb309ec7fdbfb08e6e91baee7d7d4599fe14129a4d426834556ae420e087d59c0c7be7fcad1abb7e1f8f446f373f611ca1ee9c2231708e18a47bc68a2a79a0b48931f6ff6d"})
ioctl$sock_inet_tcp_SIOCOUTQNSD(r1, 0x894b, &(0x7f0000000480))
getsockopt$inet_IP_IPSEC_POLICY(0xffffffffffffffff, 0x0, 0x10, &(0x7f0000000540)={{{@in6, @in=@remote}}, {{@in6=@ipv4={[], [], @local}}, 0x0, @in6}}, &(0x7f0000000000)=0xe8)
ioctl$BINDER_SET_CONTEXT_MGR(r4, 0x40046207, 0x0)
r5 = dup(r4)
shutdown(r5, 0x1)
prctl$PR_SET_NAME(0xf, &(0x7f0000000380)='/group.stat\x00')
syz_open_dev$binder(&(0x7f0000000880)='/dev/binder#\x00', 0x0, 0x2)
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)})
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, &(0x7f0000000780)})
ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f0000000680)})
creat(&(0x7f00000000c0)='./file0\x00', 0x0)
openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000100)='/group.stat\x00', 0x2761, 0x0)
clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000080), 0xffffffffffffffff)
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000003c0)={0x14, 0x0, &(0x7f0000000680)=[@acquire_done], 0x0, 0x0, 0x0})

05:02:26 executing program 3:
recvmmsg(0xffffffffffffffff, &(0x7f0000003140)=[{{&(0x7f0000001400)=@ipx, 0x80, 0x0}}], 0x1, 0x0, 0x0)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = syz_open_procfs(0x0, &(0x7f00000004c0)='net/rt_cache\x00')
preadv(r0, &(0x7f00000017c0), 0x9b, 0x0)

05:02:26 executing program 0:
recvmmsg(0xffffffffffffffff, &(0x7f0000003140)=[{{&(0x7f0000001400)=@ipx, 0x80, 0x0}}], 0x1, 0x0, 0x0)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = syz_open_procfs(0x0, &(0x7f00000004c0)='net/rt_cache\x00')
preadv(r0, &(0x7f00000017c0), 0x94, 0x0)

05:02:26 executing program 5:
r0 = socket$inet6(0xa, 0x802, 0x0)
connect$inet6(r0, &(0x7f0000000000)={0xa, 0x0, 0x0, @mcast2, 0x4}, 0x1c)
setsockopt$sock_int(r0, 0x1, 0x7, &(0x7f0000000580), 0xf8e682be2d3a23da)
connect$inet6(r0, &(0x7f0000000140)={0xa, 0x0, 0x0, @remote}, 0x1c)
sendmmsg(r0, &(0x7f0000000040), 0x2a0ef9f0260e2dc, 0x0)

05:02:26 executing program 1:
r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000200)='/dev/nullb0\x00', 0x5000000084002, 0x0)
mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x200000e, 0x13, r0, 0x0)
r1 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x4000, 0x0)
preadv(r1, &(0x7f0000000040)=[{&(0x7f0000000400)=""/4096, 0x3ffc04}], 0x1, 0x0)

05:02:26 executing program 4:
r0 = socket$inet6(0xa, 0x2, 0x0)
connect$inet6(r0, &(0x7f0000000000)={0xa, 0x0, 0x0, @mcast2, 0x3}, 0x1c)
syz_open_dev$sndtimer(&(0x7f0000000040)='/dev/snd/timer\x00', 0x0, 0x400)

[  375.837236] binder: release 17025:17031 transaction 564 out, still active
05:02:26 executing program 4:
r0 = socket$inet_udplite(0x2, 0x2, 0x88)
r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0)
r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0)
r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0)
syz_kvm_setup_cpu$x86(r2, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, 0x0, 0x0, 0x0, &(0x7f0000000080), 0x0)
ioctl$SCSI_IOCTL_SEND_COMMAND(0xffffffffffffffff, 0x1, 0x0)
write$P9_RREAD(0xffffffffffffffff, &(0x7f0000000140)=ANY=[], 0x0)
r4 = dup3(r2, r0, 0x0)
ioctl$SNDRV_TIMER_IOCTL_STATUS(r4, 0x80605414, &(0x7f0000000200))
syz_kvm_setup_cpu$x86(0xffffffffffffffff, r3, &(0x7f000000a000/0x18000)=nil, 0x0, 0x0, 0x8, &(0x7f0000000280)=[@vmwrite={0x8, 0x0, 0x2, 0x0, 0x17a, 0x0, 0x9}], 0x1)
setsockopt$TIPC_IMPORTANCE(r4, 0x10f, 0x7f, &(0x7f0000000000)=0x800, 0x4)
getsockopt$inet_buf(r0, 0x0, 0x0, &(0x7f0000000200)=""/116, &(0x7f0000000100)=0x74)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
syz_kvm_setup_cpu$x86(0xffffffffffffffff, r3, &(0x7f0000000000/0x18000)=nil, &(0x7f00000002c0)=[@text64={0x40, &(0x7f00000001c0)="650fc75c276766b882000f00d0c4423d3c56eef22ede9a002000000f01cf0f3042802100660f38802afb0f23d4", 0x2d}], 0x1, 0xffffffffffffffff, &(0x7f0000000040), 0x0)
ioctl$PPPIOCGL2TPSTATS(0xffffffffffffffff, 0x80487436, &(0x7f0000000080)="68bd0000d7eb")
ioctl$SNDRV_TIMER_IOCTL_SELECT(0xffffffffffffffff, 0x40345410, &(0x7f00000000c0)={{0x0, 0x3, 0x0, 0x0, 0x5}})
ioctl$KVM_RUN(r3, 0xae80, 0x0)
r5 = socket(0x0, 0x0, 0x0)
perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x200000000000, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
openat$sequencer(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/sequencer\x00', 0x0, 0x0)
write$RDMA_USER_CM_CMD_QUERY(0xffffffffffffffff, &(0x7f0000002480)={0x13, 0x10, 0xfa00, {0x0}}, 0x18)
openat$nullb(0xffffffffffffff9c, &(0x7f0000000080)='/dev/nullb0\x00', 0x4000000004002, 0x0)
fcntl$setownex(0xffffffffffffffff, 0xf, 0x0)
fsetxattr$trusted_overlay_redirect(r5, &(0x7f0000000140)='trusted.overlay.redirect\x00', &(0x7f0000000300)='./file0\x00', 0x8, 0x1)
prctl$PR_GET_NO_NEW_PRIVS(0x27)
bind$rds(0xffffffffffffffff, &(0x7f0000000180)={0x2, 0x4e24, @remote}, 0x10)
set_mempolicy(0x2, &(0x7f0000000100)=0x9, 0x5)

05:02:26 executing program 1:
r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000200)='/dev/nullb0\x00', 0x5000000084002, 0x0)
mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x200000e, 0x13, r0, 0x0)
r1 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x4000, 0x0)
preadv(r1, &(0x7f0000000040)=[{&(0x7f0000000400)=""/4096, 0x3ffc05}], 0x1, 0x0)

05:02:26 executing program 5:
perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10000003, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = socket$inet6(0xa, 0x80003, 0xff)
connect$inet6(r0, &(0x7f0000000140)={0xa, 0x0, 0x0, @mcast1, 0x9}, 0x1c)
sendmsg(r0, &(0x7f000001b000)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000200)="f67f986af9dc3ba1fe8000000000000087209739ae649266f062bcd978b94585b9bf1100ed8bc3b5", 0x28}], 0x1}, 0x0)

05:02:26 executing program 3:
recvmmsg(0xffffffffffffffff, &(0x7f0000003140)=[{{&(0x7f0000001400)=@ipx, 0x80, 0x0}}], 0x1, 0x0, 0x0)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = syz_open_procfs(0x0, &(0x7f00000004c0)='net/rt_cache\x00')
preadv(r0, &(0x7f00000017c0), 0x9c, 0x0)

[  375.971262] binder: 17078 RLIMIT_NICE not set
05:02:26 executing program 0:
recvmmsg(0xffffffffffffffff, &(0x7f0000003140)=[{{&(0x7f0000001400)=@ipx, 0x80, 0x0}}], 0x1, 0x0, 0x0)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = syz_open_procfs(0x0, &(0x7f00000004c0)='net/rt_cache\x00')
preadv(r0, &(0x7f00000017c0), 0x95, 0x0)

[  376.024242] binder: BINDER_SET_CONTEXT_MGR already set
[  376.029559] binder: 17077:17087 ioctl 40046207 0 returned -16
[  376.070846] binder_thread_write: 4 callbacks suppressed
[  376.070861] binder: 17077:17097 Release 1 refcount change on invalid ref 1 ret -22
05:02:26 executing program 3:
recvmmsg(0xffffffffffffffff, &(0x7f0000003140)=[{{&(0x7f0000001400)=@ipx, 0x80, 0x0}}], 0x1, 0x0, 0x0)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = syz_open_procfs(0x0, &(0x7f00000004c0)='net/rt_cache\x00')
preadv(r0, &(0x7f00000017c0), 0x9d, 0x0)

05:02:27 executing program 2:
r0 = syz_open_dev$sndtimer(&(0x7f0000026000)='/dev/snd/timer\x00', 0x0, 0x0)
r1 = dup3(r0, r0, 0x80000)
ioctl$UI_GET_SYSNAME(r1, 0x8040552c, 0x0)
perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8)
r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c)
bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r2, 0x0, 0x0, 0x1}, 0x20)
openat$cgroup_ro(r1, &(0x7f00000004c0)='cpuset.effective_cpus\x00', 0x0, 0x0)
unlink(&(0x7f0000000900)='./file0/file0\x00')
r3 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r4 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r4, 0x0)
ioctl$BINDER_GET_NODE_DEBUG_INFO(r3, 0xc018620b, &(0x7f0000000780))
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f00000000c0)=[@enter_looper], 0x48, 0x0, &(0x7f0000000700)="2ba063fb309ec7fdbfb08e6e91baee7d7d4599fe14129a4d426834556ae420e087d59c0c7be7fcad1abb7e1f8f446f373f611ca1ee9c2231708e18a47bc68a2a79a0b48931f6ff6d"})
ioctl$sock_inet_tcp_SIOCOUTQNSD(r1, 0x894b, &(0x7f0000000480))
getsockopt$inet_IP_IPSEC_POLICY(0xffffffffffffffff, 0x0, 0x10, &(0x7f0000000540)={{{@in6, @in=@remote}}, {{@in6=@ipv4={[], [], @local}}, 0x0, @in6}}, &(0x7f0000000000)=0xe8)
ioctl$BINDER_SET_CONTEXT_MGR(r4, 0x40046207, 0x0)
r5 = dup(r4)
shutdown(r5, 0x1)
prctl$PR_SET_NAME(0xf, &(0x7f0000000380)='/group.stat\x00')
syz_open_dev$binder(&(0x7f0000000880)='/dev/binder#\x00', 0x0, 0x2)
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)})
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, &(0x7f0000000780)})
ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f0000000680)})
creat(&(0x7f00000000c0)='./file0\x00', 0x0)
openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000100)='/group.stat\x00', 0x2761, 0x0)
clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000080), 0xffffffffffffffff)
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000003c0)={0x14, 0x0, &(0x7f0000000680)=[@acquire_done], 0x0, 0x0, 0x0})

05:02:27 executing program 0:
recvmmsg(0xffffffffffffffff, &(0x7f0000003140)=[{{&(0x7f0000001400)=@ipx, 0x80, 0x0}}], 0x1, 0x0, 0x0)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = syz_open_procfs(0x0, &(0x7f00000004c0)='net/rt_cache\x00')
preadv(r0, &(0x7f00000017c0), 0x96, 0x0)

05:02:27 executing program 1:
r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000200)='/dev/nullb0\x00', 0x5000000084002, 0x0)
mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x200000e, 0x13, r0, 0x0)
r1 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x4000, 0x0)
preadv(r1, &(0x7f0000000040)=[{&(0x7f0000000400)=""/4096, 0x3ffc06}], 0x1, 0x0)

05:02:27 executing program 5:
r0 = socket$inet_udplite(0x2, 0x2, 0x88)
ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f3188b070")
r1 = dup2(r0, r0)
getsockopt$inet_sctp6_SCTP_NODELAY(r1, 0x84, 0x3, &(0x7f0000000240), &(0x7f0000000280)=0x4)
mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x4, 0x32, 0xffffffffffffffff, 0x0)
r2 = userfaultfd(0x0)
ioctl$UFFDIO_API(r2, 0xc018aa3f, &(0x7f0000003fe8))
ioctl$UFFDIO_REGISTER(r2, 0xc020aa00, &(0x7f0000001fe2)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1})
r3 = socket$inet6_sctp(0xa, 0x1, 0x84)
setsockopt$inet_sctp6_SCTP_DISABLE_FRAGMENTS(r3, 0x84, 0x8, &(0x7f0000013e95), 0x4)
setsockopt$inet_MCAST_MSFILTER(r1, 0x0, 0x30, &(0x7f00000002c0)={0x9, {{0x2, 0x4e21, @empty}}, 0x0, 0x6, [{{0x2, 0x4e22, @empty}}, {{0x2, 0x4e24, @empty}}, {{0x2, 0x4e24, @rand_addr=0x5}}, {{0x2, 0x4e24, @broadcast}}, {{0x2, 0x4e21, @loopback}}, {{0x2, 0x4e20, @remote}}]}, 0x390)
getsockopt$inet_sctp6_SCTP_RECVRCVINFO(r3, 0x84, 0x20, &(0x7f0000000080), &(0x7f00000000c0)=0x4)
ioctl$sock_SIOCETHTOOL(r3, 0x8946, &(0x7f0000000040)={'veth1_to_bond:\x00', &(0x7f0000000100)=ANY=[@ANYBLOB='L']})
r4 = syz_open_dev$mice(&(0x7f0000000140)='/dev/input/mice\x00', 0x0, 0x100)
ioctl$EVIOCGKEY(r4, 0x80404518, &(0x7f0000000180)=""/183)
close(r3)
close(r2)

05:02:27 executing program 3:
recvmmsg(0xffffffffffffffff, &(0x7f0000003140)=[{{&(0x7f0000001400)=@ipx, 0x80, 0x0}}], 0x1, 0x0, 0x0)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = syz_open_procfs(0x0, &(0x7f00000004c0)='net/rt_cache\x00')
preadv(r0, &(0x7f00000017c0), 0x9e, 0x0)

05:02:27 executing program 4:
mkdir(&(0x7f0000000000)='./file0\x00', 0x0)
r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000140)='/dev/fuse\x00', 0x2, 0x0)
mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r0, @ANYBLOB=',rootmode=00000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',grkup_id=', @ANYRESDEC=0x0, @ANYBLOB=',\x00'])
clone(0x4000002102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
openat(0xffffffffffffff9c, &(0x7f0000000040)='./file0/file0\x00', 0x115000, 0x0)

[  376.703227] binder: release 17077:17097 transaction 567 out, still active
05:02:27 executing program 4:
r0 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000040)='/dev/sequencer\x00', 0x0, 0x0)
getsockopt$bt_rfcomm_RFCOMM_CONNINFO(r0, 0x12, 0x2, &(0x7f0000000180)=""/216, &(0x7f0000000080)=0xd8)
r1 = socket$nl_netfilter(0x10, 0x3, 0xc)
syz_open_dev$cec(&(0x7f00000000c0)='/dev/cec#\x00', 0x0, 0x2)
getsockopt$sock_cred(r1, 0x1, 0x11, &(0x7f0000000000)={0x0, <r2=>0x0}, &(0x7f0000000140)=0xc)
setreuid(r2, 0x0)

05:02:27 executing program 3:
recvmmsg(0xffffffffffffffff, &(0x7f0000003140)=[{{&(0x7f0000001400)=@ipx, 0x80, 0x0}}], 0x1, 0x0, 0x0)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = syz_open_procfs(0x0, &(0x7f00000004c0)='net/rt_cache\x00')
preadv(r0, &(0x7f00000017c0), 0x9f, 0x0)

[  376.814641] binder: 17127 RLIMIT_NICE not set
05:02:27 executing program 0:
recvmmsg(0xffffffffffffffff, &(0x7f0000003140)=[{{&(0x7f0000001400)=@ipx, 0x80, 0x0}}], 0x1, 0x0, 0x0)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = syz_open_procfs(0x0, &(0x7f00000004c0)='net/rt_cache\x00')
preadv(r0, &(0x7f00000017c0), 0x97, 0x0)

[  376.860125] binder: BINDER_SET_CONTEXT_MGR already set
05:02:27 executing program 1:
r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000200)='/dev/nullb0\x00', 0x5000000084002, 0x0)
mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x200000e, 0x13, r0, 0x0)
r1 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x4000, 0x0)
preadv(r1, &(0x7f0000000040)=[{&(0x7f0000000400)=""/4096, 0x3ffc07}], 0x1, 0x0)

[  376.881832] binder: 17125:17150 ioctl 40046207 0 returned -16
[  376.910490] binder: 17125:17150 Release 1 refcount change on invalid ref 1 ret -22
05:02:27 executing program 4:
r0 = openat$dlm_plock(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm_plock\x00', 0x10000, 0x0)
fcntl$F_GET_RW_HINT(r0, 0x40b, &(0x7f0000000040))
ioctl$NBD_CLEAR_SOCK(r0, 0xab04)
setsockopt$inet_tcp_int(r0, 0x6, 0xc, &(0x7f0000000080), 0x4)
fremovexattr(r0, &(0x7f00000000c0)=@random={'user.', '/dev/dlm_plock\x00'})
getsockopt$inet_sctp6_SCTP_PARTIAL_DELIVERY_POINT(r0, 0x84, 0x13, &(0x7f0000000100)={<r1=>0x0, 0xffffffffffffff00}, &(0x7f0000000140)=0x8)
setsockopt$inet_sctp_SCTP_ASSOCINFO(r0, 0x84, 0x1, &(0x7f0000000180)={r1, 0xfffffffffffffff7, 0x4cde, 0xaa, 0x9, 0x6}, 0x14)
ioctl$DRM_IOCTL_ADD_CTX(r0, 0xc0086420, &(0x7f00000001c0))
r2 = getpid()
ptrace$peek(0x1, r2, &(0x7f0000000200))
ioctl$SIOCGIFMTU(r0, 0x8921, &(0x7f0000000240))
setsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX(r0, 0x84, 0x6e, &(0x7f0000000280)=[@in6={0xa, 0x4e22, 0x1f, @mcast1, 0x4}, @in6={0xa, 0x4e24, 0x9e, @empty, 0x7f}, @in={0x2, 0x4e23, @rand_addr=0xdcbd}], 0x48)
ioctl$KDENABIO(r0, 0x4b36)
ioctl$ION_IOC_HEAP_QUERY(r0, 0xc0184908, &(0x7f0000000340)={0x34, 0x0, &(0x7f0000000300)})
prctl$PR_SET_NO_NEW_PRIVS(0x26, 0x1)
getsockopt$inet6_tcp_TCP_ZEROCOPY_RECEIVE(r0, 0x6, 0x23, &(0x7f0000000380)={&(0x7f0000ffc000/0x4000)=nil, 0x4000}, &(0x7f00000003c0)=0x10)
setsockopt$inet6_tcp_TCP_FASTOPEN_KEY(r0, 0x6, 0x21, &(0x7f0000000400)="1f6611c68cfc2f1a753d6655b0226470", 0x10)
ioctl$VHOST_SET_VRING_ERR(r0, 0x4008af22, &(0x7f0000000440)={0x2, 0xffffffffffffff9c})
ioctl$sock_inet_udp_SIOCINQ(r0, 0x541b, &(0x7f0000000480))
syz_genetlink_get_family_id$nbd(&(0x7f00000004c0)='nbd\x00')
setsockopt$IP_VS_SO_SET_ADDDEST(r0, 0x0, 0x487, &(0x7f0000000500)={{0x2f, @multicast1, 0x4e20, 0x4, 'wrr\x00', 0x24, 0x800, 0x13}, {@loopback, 0x4e24, 0x10000, 0x2, 0x93e, 0x8}}, 0x44)
ioctl$VIDIOC_SUBDEV_S_EDID(r0, 0xc0285629, &(0x7f00000005c0)={0x0, 0x9, 0x6, [], &(0x7f0000000580)=0x3})
sendto$inet6(r0, &(0x7f0000000600)="62150e02c53df3f1cb181d43d2763480270bb7cae0e978d4785ed3c858cdf8e2aaa0a1f8c8f750bc4729cfc74534cd3eaadf293ebb6290ecb6ca6a17f2b181bd03197542f2dd1034c824bc19074958d0d9a756e7798ae833216b70dcc0aea5fdc67237439824e7745cd8d94d2832120cf7feb90dc6c9eeea4b95ba8285b9820662a36642062d9c9f800067cd323a4376b6464ba7a5ad5042eafc5071b63f6f1c88139e00fa0821648cc8e25af51165caee53e327088cc6fd0107e541b1fd4723a6d62b4fb1cf", 0xc6, 0x90, 0x0, 0x0)
ioctl$KVM_GET_NESTED_STATE(r0, 0xc080aebe, &(0x7f0000000700)={0x0, 0x0, 0x2080})
ioctl$EVIOCSKEYCODE_V2(r0, 0x40284504, &(0x7f0000002780)={0x6, 0x0, 0x4, 0x100000000, "9c482ac214ad717d06c02bee667efce631bb6a301057d83e31d2853ceec1312b"})
r3 = dup(r0)
ioctl$SNDRV_SEQ_IOCTL_GET_CLIENT_POOL(r0, 0xc058534b, &(0x7f00000027c0)={0x7fffffff, 0x401, 0xdeb3, 0x101, 0x3ff, 0x5})
ioctl$UI_GET_SYSNAME(r0, 0x8040552c, &(0x7f0000002840))
ioctl$VIDIOC_G_PARM(r3, 0xc0cc5615, &(0x7f0000002880)={0x0, @raw_data="a0ba1a0888ccf0c77834a37a77c04cf35b9dff266dd502d3ae59dcab47ac047d79ebad64120e5ac22fe9d6b351d3b095fa4f33e2a80975b0fe2812b6582f12e58217536313e6156c84d595a50aff9dca98063008f1d785e56312cd713de018bc610d2cdc72153f1d6457197a99aabb48c773c4245338fe45d7e8d9e4778aafcff0a007c78862d1bf8866e138f99864b6f48be421383650dd1fa7d7ec4138be7d6b0d2ed4e3ec3650ed65a69000a7deb8b44d0fd923433b74fd16e5d2f752c5f4399dcd374f372c5c"})
setsockopt$inet_udp_int(r3, 0x11, 0x67, &(0x7f0000002980)=0xffffffffffff6ca6, 0x4)

05:02:27 executing program 0:
recvmmsg(0xffffffffffffffff, &(0x7f0000003140)=[{{&(0x7f0000001400)=@ipx, 0x80, 0x0}}], 0x1, 0x0, 0x0)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = syz_open_procfs(0x0, &(0x7f00000004c0)='net/rt_cache\x00')
preadv(r0, &(0x7f00000017c0), 0x98, 0x0)

05:02:27 executing program 2:
r0 = syz_open_dev$sndtimer(&(0x7f0000026000)='/dev/snd/timer\x00', 0x0, 0x0)
r1 = dup3(r0, r0, 0x80000)
ioctl$UI_GET_SYSNAME(r1, 0x8040552c, 0x0)
perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8)
r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c)
bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r2, &(0x7f0000000040), 0x0}, 0x20)
openat$cgroup_ro(r1, &(0x7f00000004c0)='cpuset.effective_cpus\x00', 0x0, 0x0)
unlink(&(0x7f0000000900)='./file0/file0\x00')
r3 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r4 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r4, 0x0)
ioctl$BINDER_GET_NODE_DEBUG_INFO(r3, 0xc018620b, &(0x7f0000000780))
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f00000000c0)=[@enter_looper], 0x48, 0x0, &(0x7f0000000700)="2ba063fb309ec7fdbfb08e6e91baee7d7d4599fe14129a4d426834556ae420e087d59c0c7be7fcad1abb7e1f8f446f373f611ca1ee9c2231708e18a47bc68a2a79a0b48931f6ff6d"})
ioctl$sock_inet_tcp_SIOCOUTQNSD(r1, 0x894b, &(0x7f0000000480))
getsockopt$inet_IP_IPSEC_POLICY(0xffffffffffffffff, 0x0, 0x10, &(0x7f0000000540)={{{@in6, @in=@remote}}, {{@in6=@ipv4={[], [], @local}}, 0x0, @in6}}, &(0x7f0000000000)=0xe8)
ioctl$BINDER_SET_CONTEXT_MGR(r4, 0x40046207, 0x0)
r5 = dup(r4)
shutdown(r5, 0x1)
prctl$PR_SET_NAME(0xf, &(0x7f0000000380)='/group.stat\x00')
syz_open_dev$binder(&(0x7f0000000880)='/dev/binder#\x00', 0x0, 0x2)
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)})
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, &(0x7f0000000780)})
ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f0000000680)})
creat(&(0x7f00000000c0)='./file0\x00', 0x0)
openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000100)='/group.stat\x00', 0x2761, 0x0)
clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000080), 0xffffffffffffffff)
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000003c0)={0x14, 0x0, &(0x7f0000000680)=[@acquire_done], 0x0, 0x0, 0x0})

05:02:27 executing program 3:
recvmmsg(0xffffffffffffffff, &(0x7f0000003140)=[{{&(0x7f0000001400)=@ipx, 0x80, 0x0}}], 0x1, 0x0, 0x0)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = syz_open_procfs(0x0, &(0x7f00000004c0)='net/rt_cache\x00')
preadv(r0, &(0x7f00000017c0), 0xa0, 0x0)

05:02:27 executing program 1:
r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000200)='/dev/nullb0\x00', 0x5000000084002, 0x0)
mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x200000e, 0x13, r0, 0x0)
r1 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x4000, 0x0)
preadv(r1, &(0x7f0000000040)=[{&(0x7f0000000400)=""/4096, 0x3ffc08}], 0x1, 0x0)

05:02:27 executing program 5:
r0 = syz_open_dev$sndpcmc(&(0x7f0000001fee)='/dev/snd/pcmC#D#c\x00', 0x0, 0x0)
ioctl$sock_inet_SIOCADDRT(0xffffffffffffffff, 0x890b, 0x0)
ioctl$UI_GET_SYSNAME(r0, 0x8040552c, &(0x7f0000000080))
preadv(0xffffffffffffffff, &(0x7f0000000000)=[{&(0x7f0000009f7c)=""/132, 0x84}, {&(0x7f0000012000)=""/252, 0xfc}, {&(0x7f0000012000)=""/155, 0x400000}, {&(0x7f0000009000)=""/11, 0xb}, {&(0x7f0000000000)=""/102, 0x66}], 0x5, 0x0)
syz_genetlink_get_family_id$team(&(0x7f00000000c0)='team\x00')
ioctl(r0, 0xc2604110, &(0x7f0000000000))
fgetxattr(r0, &(0x7f0000000100)=@known='system.sockprotoname\x00', &(0x7f0000000140)=""/102, 0x66)

05:02:27 executing program 4:
r0 = openat$proc_capi20ncci(0xffffffffffffff9c, &(0x7f0000000000)='/proc/capi/capi20ncci\x00', 0x4000, 0x0)
ioctl$EVIOCSKEYCODE_V2(r0, 0x40284504, &(0x7f0000000040)={0x6, 0x2, 0x71, 0x0, "8a901b581d7a42b2e300d98838f048fce8ae44fef6d384dbbb89fdc1b89e1871"})
perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10000003, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
syz_open_procfs(0x0, &(0x7f00000003c0)='net/if_in\xf1\xb6\x92\x1c')

05:02:27 executing program 0:
recvmmsg(0xffffffffffffffff, &(0x7f0000003140)=[{{&(0x7f0000001400)=@ipx, 0x80, 0x0}}], 0x1, 0x0, 0x0)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = syz_open_procfs(0x0, &(0x7f00000004c0)='net/rt_cache\x00')
preadv(r0, &(0x7f00000017c0), 0x99, 0x0)

[  377.532717] binder: release 17125:17150 transaction 570 out, still active
05:02:28 executing program 4:
r0 = socket$inet_udplite(0x2, 0x2, 0x88)
r1 = openat$full(0xffffffffffffff9c, &(0x7f0000000100)='/dev/full\x00', 0x880, 0x0)
setsockopt$TIPC_GROUP_JOIN(r1, 0x10f, 0x87, &(0x7f0000000140)={0x40, 0x1, 0x1}, 0x10)
ioctl$sock_ifreq(r0, 0x8936, &(0x7f0000000080)={'veth0_to_bridge\x00', @ifru_map={0x1, 0xf0d5, 0x3, 0x3, 0xc94c, 0x1}})
ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c12a41d88b470")
r2 = gettid()
write$cgroup_pid(r1, &(0x7f0000000180)=r2, 0x12)
socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={<r3=>0xffffffffffffffff})
prctl$PR_SET_MM_AUXV(0x23, 0xc, &(0x7f0000000200), 0x0)
getsockopt$SO_BINDTODEVICE(r3, 0x1, 0x2a, &(0x7f0000000000), 0x20395dd4)
ioctl$TIOCGSID(0xffffffffffffff9c, 0x5429, &(0x7f00000000c0)=<r4=>0x0)
ptrace$pokeuser(0x6, r4, 0x1, 0x8)
ioctl$SG_GET_NUM_WAITING(r1, 0x227d, &(0x7f00000001c0))

05:02:28 executing program 0:
recvmmsg(0xffffffffffffffff, &(0x7f0000003140)=[{{&(0x7f0000001400)=@ipx, 0x80, 0x0}}], 0x1, 0x0, 0x0)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = syz_open_procfs(0x0, &(0x7f00000004c0)='net/rt_cache\x00')
preadv(r0, &(0x7f00000017c0), 0x9a, 0x0)

05:02:28 executing program 3:
recvmmsg(0xffffffffffffffff, &(0x7f0000003140)=[{{&(0x7f0000001400)=@ipx, 0x80, 0x0}}], 0x1, 0x0, 0x0)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = syz_open_procfs(0x0, &(0x7f00000004c0)='net/rt_cache\x00')
preadv(r0, &(0x7f00000017c0), 0xa1, 0x0)

[  377.702351] binder: 17199 RLIMIT_NICE not set
05:02:28 executing program 1:
r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000200)='/dev/nullb0\x00', 0x5000000084002, 0x0)
mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x200000e, 0x13, r0, 0x0)
r1 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x4000, 0x0)
preadv(r1, &(0x7f0000000040)=[{&(0x7f0000000400)=""/4096, 0x3ffc09}], 0x1, 0x0)

05:02:28 executing program 5:
unshare(0x44000000)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x0)
bpf$MAP_UPDATE_ELEM(0x2, 0x0, 0x0)
r0 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a)
getsockopt$SO_TIMESTAMPING(r0, 0x1, 0x25, &(0x7f0000000440), &(0x7f0000000480)=0x4)
bind$inet6(0xffffffffffffffff, 0x0, 0x0)
write$UHID_SET_REPORT_REPLY(0xffffffffffffffff, &(0x7f0000000600)=ANY=[@ANYBLOB="0e0000000900000000aafc032eb67a225d0c726391109ef81d39abec34b7695e3096b91d685df38014cbb537ac4cdabec05eb059ee868fc2561f4640cf97277275ebd9c036fa506402bce2446ddf5cb9a274a51068d5fe2648f3209cec4f1d1109da008d5da0b4afad05dd694212438e6faefc3767203f3bc9735a2b331e6e656dee506280c947ed7e524cb5a9d5dc60558e84380f8804a2d49db00df7c438050ba35ba7f6f84375ba4a0c9f27eb4a2df348ab4ee0813d00bd054bcacf9405958f600aac95ac2b43835b7352fbbb04c9f366b6a0404ec5900dad557e3bf68e2dcb644dfefca9e201a1d30b63b33585a8a246b3051626d5b8c0b881b538e076a7e952d3497e6a7936c4676b579c43e27d35df48e2710def22876ffb988c43925abad9ae0e82cda9bb9dc45d5e2ba91ff229efaf066bce7980358195250cd6ad3cf8054597353acdfc4a01330c225b1809a821707ff37a418ae1ed50d36984ac77f8ba3b37e22cd1c5351bba415d0c24f4c1b3be69c5672612b074177e2b8fa76ec17cd61ba06732683269481531badc472dfa049dd30e2f7a1a7f3621f5cf65c368e99b3b617f2b1b83b569947eda94e7110955c5f0aaa2d444a034be2d705124188c64a514d7a8c406b2dde9ca97068e58f4add6089b21779a79464e800c2915c571afa8c18d009f88d0c2dfbd021559efeb7ceaee7d6e725bdb74cbfd162057d21ca7ce1b1221e3daafeed1ef3a29d65600decf1937094232768ac19339645c0ffa680ec122850bc42312e0443c30ff87d075d4d4788a0d73e72cacb67fa2875ab56f7514d169c606d06ed286cc0d98b776ba204214f350cb74a0cf5ab472b574430832383356bae154fb973b279955c6ae9a743c70bd5255662e91c48e53f24a77862ec41992c53fccb6d7db812c82db87758ed9c22b88898f55015104baa2e50e8e592237bea43745184121c716a712791e984fa9f016706e519c23abfebc3987c71f3b1fa2b8b18fe46ee79e66f6799f57a8b2ade34602bce0002150f385e55bc42717526886bea6f85c1cdd2cbd73b97fa76cfa920b43e477b8d70077d0a4fc8aa3d539ab61ba0629554cc21f3d7dfd46e5cfd9176cada944f4677f9b3383ecad0a129c927c942d318e8b869f1afd4f482e9ecfcfda8aff1aa00d10a07efd837957d5764c9571261db15558c5558d70db442ed48aeb7b3fb1e47a701fe1e236e03456077c5ea767b7834d8f94bb97e650f854bfa352526d978ef1f5004863487b442fda341ab0810f4d84ee7e03f8b64600aefa9b27ea4ca36314d4878f1910c2428b23c35e94aceb6e0bf9252a22d988d0e304240f77a1c9c5b9198152def5a5f05d84c5ab58cd7b7691e55fbc25ffefed31ec94ba36dd1f8bdca91b3d1219078a10e4172c5c3476bd484f4a27530783ab81b9cecb5b93e963906b399323e5ae44412595a8307500c310e3f5a84820a473f8ebe0b176dc8904595951fe3c928f0a9ce6cdae24d4090c8c065d2b764c327cae2c1591394b05fc805f4f9a0432622dd6766404a2b0956cbaad02d6e8160e65c0cf94920bd9de61ffc0a2d5f5d63092425742b44021ac476998f3cd39a850d41395a5b7b5fbdf34dc88fad9f7d0678d4c69047705dabea71b6ff65b0da4f295beece9e830f2fb6fb75e25d81e388af3aed680a514a74117"], 0x1)
r1 = openat$cachefiles(0xffffffffffffff9c, 0x0, 0x4005, 0x0)
ioctl$SNDRV_CTL_IOCTL_ELEM_REMOVE(r1, 0xc0405519, &(0x7f0000000200)={0x6, 0x4, 0x10000, 0x0, 'syz0\x00', 0x6})
ioctl$GIO_FONTX(0xffffffffffffffff, 0x4b6b, 0x0)
setsockopt$inet6_tcp_TCP_CONGESTION(0xffffffffffffffff, 0x6, 0xd, &(0x7f0000000000)='lp\x00', 0x3)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r2 = syz_open_dev$radio(&(0x7f00000000c0)='/dev/radio#\x00', 0x2, 0x2)
getsockopt$inet_IP_IPSEC_POLICY(r1, 0x0, 0x10, &(0x7f0000000f80)={{{@in=@initdev, @in=@multicast1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, <r3=>0x0}}, {{@in=@initdev}, 0x0, @in=@local}}, &(0x7f00000004c0)=0x53)
sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000080)=0x2, 0x0)
connect$unix(0xffffffffffffffff, &(0x7f0000000b00)=@file={0x1, './bus\x00'}, 0x6e)
r4 = syz_open_procfs(0x0, &(0x7f0000000000)='net\x00')
fsetxattr(r4, &(0x7f0000000280)=@known='user.syz\x00', &(0x7f00000002c0)='\x00', 0x398, 0x0)
write$9p(0xffffffffffffffff, &(0x7f0000000300), 0x0)
bpf$MAP_UPDATE_ELEM(0x2, 0x0, 0xffd26dabc41432bf)
bpf$MAP_GET_NEXT_KEY(0x4, &(0x7f0000dc3000)={0xffffffffffffffff, 0x0, 0x0}, 0x18)
msgget$private(0x0, 0x80)
msgget(0x0, 0x442)
r5 = msgget(0x0, 0x400)
msgctl$MSG_STAT(r5, 0xb, &(0x7f00000005c0)=""/51)
ioctl$SIOCGSTAMPNS(r2, 0x8907, &(0x7f00000001c0))
ioctl$TUNGETIFF(r1, 0x800454d2, &(0x7f0000000400))
socket$pptp(0x18, 0x1, 0x2)
sendmsg$key(0xffffffffffffffff, 0x0, 0x0)
r6 = socket$nl_route(0x10, 0x3, 0x0)
ioctl$ifreq_SIOCGIFINDEX_team(0xffffffffffffffff, 0x8933, &(0x7f0000000580)={'team0\x00', r3})
accept$unix(0xffffffffffffffff, 0x0, &(0x7f0000000140))
sendmsg$nl_route(r6, &(0x7f0000000100)={0x0, 0xc9000000, &(0x7f0000000000)={&(0x7f0000000b80)=ANY=[@ANYBLOB="2800000010005fba00d598c0c6c6e1425258b58e850000000000000000000000631ead77df4cbc9db92345287faa6d1fcfba6c3226d10c4a7d84f1071ff9dcdcc4073cb09484048b7cabc13a8b55c4fb1f385446fa73f3a6db4677dff765c4051227209fb8a3c20aa75c7c91728a17ebae16fc2fd7c5b5050c3f413f21acc652e7cd5eaa0a7afc6d69f41ca0c7e7b77d052483aaeba7bcdd3772430f9d08e74b365e97b728666535344b558a94b4cb299cad284713d6a66fe798c6d3084b0ae869d6953029e5fe8450f6cf84dbc8dd3a16cc00985db2067d61b7978dd31ea012031f7972b5921df5eaab3c424cbd265af2e9188c33b6e6f47f128d082a3106e2aa97bca7e984a108ccc39dc6befad16187688e86d9d5feebc368d7915cc99eef571848ed522e8d95173f757c48e68c018d0f83375c3cfecfed93cdcf6bb7d4f83a8a289a999ffc775b6647ded56150c0d7c487a8e98e928b1b99e77717e364d299f0e23be7820e6ec2ddb7edf5f71df06d1a091a98c041862aa3", @ANYRES32=0x0, @ANYBLOB="030000000000000008001b0000000000"], 0x28}}, 0x0)

[  377.762154] binder: BINDER_SET_CONTEXT_MGR already set
[  377.778394] binder: 17197:17209 ioctl 40046207 0 returned -16
05:02:28 executing program 4:
socket$inet(0x2, 0x20000000000003, 0xfffffffffffeffff)
ioctl$ASHMEM_SET_SIZE(0xffffffffffffffff, 0x40087703, 0x100000fffffffe)
ioctl$ASHMEM_SET_NAME(0xffffffffffffffff, 0x41007701, 0x0)
r0 = socket$inet6_udp(0xa, 0x2, 0x0)
pipe(&(0x7f00000001c0))
syz_open_dev$cec(&(0x7f0000000340)='/dev/cec#\x00', 0x1, 0x2)
r1 = syz_open_dev$radio(&(0x7f0000000380)='/dev/radio#\x00', 0x0, 0x2)
ioctl$TCXONC(r1, 0x540a, 0x0)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
connect$inet6(r0, &(0x7f00000000c0)={0xa, 0x0, 0x0, @dev, 0x4}, 0x1c)
connect$l2tp(0xffffffffffffffff, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @multicast2}, 0x4}}, 0x26)
sendmmsg(r0, &(0x7f0000005fc0), 0x8000000000000fc, 0x0)
r2 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000400)='/dev/sequencer2\x00', 0x0, 0x0)
ioctl$VIDIOC_S_AUDIO(0xffffffffffffffff, 0x40345622, 0x0)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000000200)={<r3=>0x0}, &(0x7f0000000300)=0xc)
ioctl$BLKBSZGET(r2, 0x80081270, &(0x7f0000000000))
syz_open_dev$swradio(&(0x7f0000000480)='/dev/swradio#\x00', 0x0, 0x2)
name_to_handle_at(0xffffffffffffffff, &(0x7f0000000240)='./file0\x00', 0x0, 0x0, 0x1400)
r4 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080)='/dev/nullb0\x00', 0x4000000004002, 0x0)
connect$l2tp(0xffffffffffffffff, &(0x7f0000000100)=@pppol2tpv3in6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x4, 0x1, 0x0, 0x0, {0xa, 0x0, 0x0, @dev={0xfe, 0x80, [], 0x1e}, 0x1}}}, 0xfff1)
mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x200000e, 0x13, r4, 0x0)
syz_open_dev$vbi(0x0, 0x1, 0x2)
connect$can_bcm(0xffffffffffffffff, &(0x7f0000002ff0), 0x10)
timer_create(0x1, &(0x7f00000003c0)={0x0, 0x22, 0x3, @tid=r3}, &(0x7f0000000440))
write$binfmt_misc(r4, &(0x7f0000000500)=ANY=[@ANYBLOB="73797a311acd91af1740efbfd5f7bb53bff4a1743c6663370b94d120ad4481beb9bb759849fdefb1d027ad67a651c719dffb307ca7934a9b2b50d4c3b2ae8c2a812215e2aa8d88ba3b7768ef87f1017ae67f259dd50021880ccd40a109f8dc69544a4b4156a99ab20421b99fd6790b2bf9dfb1352c4a76f27e32c4c96043d1a1d162f64ccfda38120f56031f1652"], 0x8e)
ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0)
pwritev(r0, &(0x7f0000000140)=[{&(0x7f00000005c0)="2703e7b1bee8d4afc6fe3ea59556e5b32a4a54c35bca66cd983ad4ba9ad421f9dd0ac7824933c27cd08d86f8ebec1ccd024dce0dece1c4e5696f3643f07cc77c578eca040617ca560d342087b756ded52a8505823147245b5a17949d20012cb7d6833eed67b94d322848d8d7cd9372c2e3b779c2d3a6e8d89a7e24116632c77980ccd4b3702a57c9dcff2e3c60660d2c624063d1e4aaf37e761f65711bc0c2f5c3734754791254deb1bf36cc284f35f2b4e7e5164b331d11cbd5e728fb593adfa4c433", 0xc3}, {&(0x7f0000000280)="b27625690245bd727f73cff5e31bee38f89afac84a98679b6ce78dd7c4845a9c40a3f83f3c52062b10ce19d72fb1c033d096c0619a6e22f6e50b29769d2d2cb45a5766f84ecdb18c9ad2a71439389e248f64af6dddf75ae365bed76d85c9c072af38c5ea", 0x64}], 0x2, 0x0)

[  377.832238] IPVS: ftp: loaded support on port[0] = 21
[  377.838617] binder: 17197:17209 Release 1 refcount change on invalid ref 1 ret -22
[  378.346591] netlink: 8 bytes leftover after parsing attributes in process `syz-executor.5'.
[  378.414131] binder: release 17197:17209 transaction 573 out, still active
05:02:28 executing program 2:
r0 = syz_open_dev$sndtimer(&(0x7f0000026000)='/dev/snd/timer\x00', 0x0, 0x0)
r1 = dup3(r0, r0, 0x80000)
ioctl$UI_GET_SYSNAME(r1, 0x8040552c, 0x0)
perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8)
r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c)
bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r2, &(0x7f0000000040), 0x0}, 0x20)
openat$cgroup_ro(r1, &(0x7f00000004c0)='cpuset.effective_cpus\x00', 0x0, 0x0)
unlink(&(0x7f0000000900)='./file0/file0\x00')
r3 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r4 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r4, 0x0)
ioctl$BINDER_GET_NODE_DEBUG_INFO(r3, 0xc018620b, &(0x7f0000000780))
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f00000000c0)=[@enter_looper], 0x48, 0x0, &(0x7f0000000700)="2ba063fb309ec7fdbfb08e6e91baee7d7d4599fe14129a4d426834556ae420e087d59c0c7be7fcad1abb7e1f8f446f373f611ca1ee9c2231708e18a47bc68a2a79a0b48931f6ff6d"})
ioctl$sock_inet_tcp_SIOCOUTQNSD(r1, 0x894b, &(0x7f0000000480))
getsockopt$inet_IP_IPSEC_POLICY(0xffffffffffffffff, 0x0, 0x10, &(0x7f0000000540)={{{@in6, @in=@remote}}, {{@in6=@ipv4={[], [], @local}}, 0x0, @in6}}, &(0x7f0000000000)=0xe8)
ioctl$BINDER_SET_CONTEXT_MGR(r4, 0x40046207, 0x0)
r5 = dup(r4)
shutdown(r5, 0x1)
prctl$PR_SET_NAME(0xf, &(0x7f0000000380)='/group.stat\x00')
syz_open_dev$binder(&(0x7f0000000880)='/dev/binder#\x00', 0x0, 0x2)
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)})
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, &(0x7f0000000780)})
ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f0000000680)})
creat(&(0x7f00000000c0)='./file0\x00', 0x0)
openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000100)='/group.stat\x00', 0x2761, 0x0)
clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000080), 0xffffffffffffffff)
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000003c0)={0x14, 0x0, &(0x7f0000000680)=[@acquire_done], 0x0, 0x0, 0x0})

05:02:28 executing program 0:
recvmmsg(0xffffffffffffffff, &(0x7f0000003140)=[{{&(0x7f0000001400)=@ipx, 0x80, 0x0}}], 0x1, 0x0, 0x0)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = syz_open_procfs(0x0, &(0x7f00000004c0)='net/rt_cache\x00')
preadv(r0, &(0x7f00000017c0), 0x9b, 0x0)

05:02:28 executing program 3:
recvmmsg(0xffffffffffffffff, &(0x7f0000003140)=[{{&(0x7f0000001400)=@ipx, 0x80, 0x0}}], 0x1, 0x0, 0x0)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = syz_open_procfs(0x0, &(0x7f00000004c0)='net/rt_cache\x00')
preadv(r0, &(0x7f00000017c0), 0xa2, 0x0)

05:02:28 executing program 1:
r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000200)='/dev/nullb0\x00', 0x5000000084002, 0x0)
mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x200000e, 0x13, r0, 0x0)
r1 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x4000, 0x0)
preadv(r1, &(0x7f0000000040)=[{&(0x7f0000000400)=""/4096, 0x3ffc0a}], 0x1, 0x0)

05:02:28 executing program 4:
r0 = add_key(&(0x7f0000000080)='big_key\x00', &(0x7f00000000c0)={'\xff\xff\xff'}, &(0x7f0000000340)='F', 0x1, 0xfffffffffffffffd)
keyctl$set_timeout(0xf, r0, 0x40000000000055a)
keyctl$read(0x3, r0, &(0x7f0000005340)=""/4096, 0x1000)
r1 = openat$rfkill(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rfkill\x00', 0x10000, 0x0)
ioctl$TIOCGLCKTRMIOS(r1, 0x5456, &(0x7f0000000040)={0xffffffff00000001, 0x8, 0x3, 0x8000, 0xa, 0x4, 0x4, 0x100, 0x0, 0x101, 0x4, 0x1d45})
setsockopt$IP6T_SO_SET_REPLACE(r1, 0x29, 0x40, &(0x7f0000000380)=@nat={'nat\x00', 0x1b, 0x5, 0x5d8, 0x0, 0x0, 0x270, 0x110, 0x110, 0x508, 0x508, 0x508, 0x508, 0x508, 0x5, &(0x7f0000000100), {[{{@uncond, 0x0, 0xc8, 0x110}, @unspec=@SNAT1={0x48, 'SNAT\x00', 0x1, {0x8, @ipv6=@dev={0xfe, 0x80, [], 0x1f}, @ipv4=@broadcast, @gre_key=0x7fff, @gre_key=0xffffffffffffeb33}}}, {{@uncond, 0x0, 0x138, 0x160, 0x0, {}, [@common=@dst={0x48, 'dst\x00', 0x0, {0x8000, 0x5, 0x0, [0x391, 0x1, 0x7f, 0x1, 0x9, 0x1960, 0xfff, 0x9, 0x5, 0x6, 0x8, 0x100, 0xc16, 0x0, 0x4f, 0xd1], 0x6}}, @common=@eui64={0x28, 'eui64\x00'}]}, @common=@unspec=@CONNSECMARK={0x28, 'CONNSECMARK\x00', 0x0, {0x2}}}, {{@uncond, 0x0, 0x158, 0x180, 0x0, {}, [@common=@srh1={0x90, 'srh\x00', 0x1, {0x2c, 0xdbaf, 0x6, 0x1ff, 0x0, @ipv4={[], [], @multicast2}, @ipv4={[], [], @dev={0xac, 0x14, 0x14, 0x14}}, @dev={0xfe, 0x80, [], 0x1b}, [0xff, 0x0, 0xff0000ff], [0xffffffff, 0xff000000, 0xffffff00, 0xffffffff], [0xffffff00, 0xffffffff, 0xffffffff, 0xffffff00], 0x13c, 0x800}}]}, @common=@unspec=@CLASSIFY={0x28, 'CLASSIFY\x00', 0x0, {0x5c5}}}, {{@ipv6={@mcast1, @dev={0xfe, 0x80, [], 0x1b}, [0x0, 0xff000000, 0xffffff00], [0xff, 0x0, 0x0, 0xffffffff], 'ip6_vti0\x00', 'nr0\x00', {0xff}, {}, 0x0, 0x400, 0x6, 0x20}, 0x0, 0xf0, 0x118, 0x0, {}, [@common=@icmp6={0x28, 'icmp6\x00', 0x0, {0xe909c78abe7fad64, 0x7fffffff, 0x8000}}]}, @common=@inet=@SET1={0x28, 'SET\x00', 0x1, {{0x7, 0x1, 0x200}, {0x1, 0x2, 0x1}}}}], {{[], 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x638)

05:02:28 executing program 0:
recvmmsg(0xffffffffffffffff, &(0x7f0000003140)=[{{&(0x7f0000001400)=@ipx, 0x80, 0x0}}], 0x1, 0x0, 0x0)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = syz_open_procfs(0x0, &(0x7f00000004c0)='net/rt_cache\x00')
preadv(r0, &(0x7f00000017c0), 0x9c, 0x0)

05:02:28 executing program 4:
r0 = syz_open_dev$sndtimer(&(0x7f0000026000)='/dev/snd/timer\x00', 0x0, 0x0)
r1 = dup3(r0, r0, 0x80000)
ioctl$UI_GET_SYSNAME(r1, 0x8040552c, 0x0)
perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8)
r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c)
bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r2, &(0x7f0000000040), 0x0}, 0x20)
openat$cgroup_ro(r1, &(0x7f00000004c0)='cpuset.effective_cpus\x00', 0x0, 0x0)
unlink(&(0x7f0000000900)='./file0/file0\x00')
r3 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r4 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r4, 0x0)
ioctl$BINDER_GET_NODE_DEBUG_INFO(r3, 0xc018620b, &(0x7f0000000780))
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f00000000c0)=[@enter_looper], 0x48, 0x0, &(0x7f0000000700)="2ba063fb309ec7fdbfb08e6e91baee7d7d4599fe14129a4d426834556ae420e087d59c0c7be7fcad1abb7e1f8f446f373f611ca1ee9c2231708e18a47bc68a2a79a0b48931f6ff6d"})
ioctl$sock_inet_tcp_SIOCOUTQNSD(r1, 0x894b, &(0x7f0000000480))
getsockopt$inet_IP_IPSEC_POLICY(0xffffffffffffffff, 0x0, 0x10, &(0x7f0000000540)={{{@in6, @in=@remote}}, {{@in6=@ipv4={[], [], @local}}, 0x0, @in6}}, &(0x7f0000000000)=0xe8)
ioctl$BINDER_SET_CONTEXT_MGR(r4, 0x40046207, 0x0)
r5 = dup(r4)
shutdown(r5, 0x1)
prctl$PR_SET_NAME(0xf, &(0x7f0000000380)='/group.stat\x00')
syz_open_dev$binder(&(0x7f0000000880)='/dev/binder#\x00', 0x0, 0x2)
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)})
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, &(0x7f0000000780)})
ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f0000000680)})
creat(&(0x7f00000000c0)='./file0\x00', 0x0)
openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000100)='/group.stat\x00', 0x2761, 0x0)
clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000080), 0xffffffffffffffff)
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000003c0)={0x14, 0x0, &(0x7f0000000680)=[@acquire_done], 0x0, 0x0, 0x0})

[  378.567461] IPVS: ftp: loaded support on port[0] = 21
[  378.583017] binder: 17253 RLIMIT_NICE not set
05:02:29 executing program 1:
r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000200)='/dev/nullb0\x00', 0x5000000084002, 0x0)
mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x200000e, 0x13, r0, 0x0)
r1 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x4000, 0x0)
preadv(r1, &(0x7f0000000040)=[{&(0x7f0000000400)=""/4096, 0x3ffc0b}], 0x1, 0x0)

[  378.636163] binder: BINDER_SET_CONTEXT_MGR already set
05:02:29 executing program 3:
recvmmsg(0xffffffffffffffff, &(0x7f0000003140)=[{{&(0x7f0000001400)=@ipx, 0x80, 0x0}}], 0x1, 0x0, 0x0)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = syz_open_procfs(0x0, &(0x7f00000004c0)='net/rt_cache\x00')
preadv(r0, &(0x7f00000017c0), 0xa3, 0x0)

[  378.709442] binder: 17250:17259 ioctl 40046207 0 returned -16
[  378.710557] binder: 17250:17266 Release 1 refcount change on invalid ref 1 ret -22
05:02:29 executing program 0:
recvmmsg(0xffffffffffffffff, &(0x7f0000003140)=[{{&(0x7f0000001400)=@ipx, 0x80, 0x0}}], 0x1, 0x0, 0x0)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = syz_open_procfs(0x0, &(0x7f00000004c0)='net/rt_cache\x00')
preadv(r0, &(0x7f00000017c0), 0x9d, 0x0)

[  378.791404] binder: 17265 RLIMIT_NICE not set
[  378.840387] binder: BINDER_SET_CONTEXT_MGR already set
[  378.874147] binder: 17264:17277 ioctl 40046207 0 returned -16
[  378.885382] binder: 17264:17281 Release 1 refcount change on invalid ref 1 ret -22
[  379.199587] netlink: 8 bytes leftover after parsing attributes in process `syz-executor.5'.
05:02:29 executing program 5:
unshare(0x44000000)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x0)
bpf$MAP_UPDATE_ELEM(0x2, 0x0, 0x0)
r0 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a)
getsockopt$SO_TIMESTAMPING(r0, 0x1, 0x25, &(0x7f0000000440), &(0x7f0000000480)=0x4)
bind$inet6(0xffffffffffffffff, 0x0, 0x0)
write$UHID_SET_REPORT_REPLY(0xffffffffffffffff, &(0x7f0000000600)=ANY=[@ANYBLOB="0e0000000900000000aafc032eb67a225d0c726391109ef81d39abec34b7695e3096b91d685df38014cbb537ac4cdabec05eb059ee868fc2561f4640cf97277275ebd9c036fa506402bce2446ddf5cb9a274a51068d5fe2648f3209cec4f1d1109da008d5da0b4afad05dd694212438e6faefc3767203f3bc9735a2b331e6e656dee506280c947ed7e524cb5a9d5dc60558e84380f8804a2d49db00df7c438050ba35ba7f6f84375ba4a0c9f27eb4a2df348ab4ee0813d00bd054bcacf9405958f600aac95ac2b43835b7352fbbb04c9f366b6a0404ec5900dad557e3bf68e2dcb644dfefca9e201a1d30b63b33585a8a246b3051626d5b8c0b881b538e076a7e952d3497e6a7936c4676b579c43e27d35df48e2710def22876ffb988c43925abad9ae0e82cda9bb9dc45d5e2ba91ff229efaf066bce7980358195250cd6ad3cf8054597353acdfc4a01330c225b1809a821707ff37a418ae1ed50d36984ac77f8ba3b37e22cd1c5351bba415d0c24f4c1b3be69c5672612b074177e2b8fa76ec17cd61ba06732683269481531badc472dfa049dd30e2f7a1a7f3621f5cf65c368e99b3b617f2b1b83b569947eda94e7110955c5f0aaa2d444a034be2d705124188c64a514d7a8c406b2dde9ca97068e58f4add6089b21779a79464e800c2915c571afa8c18d009f88d0c2dfbd021559efeb7ceaee7d6e725bdb74cbfd162057d21ca7ce1b1221e3daafeed1ef3a29d65600decf1937094232768ac19339645c0ffa680ec122850bc42312e0443c30ff87d075d4d4788a0d73e72cacb67fa2875ab56f7514d169c606d06ed286cc0d98b776ba204214f350cb74a0cf5ab472b574430832383356bae154fb973b279955c6ae9a743c70bd5255662e91c48e53f24a77862ec41992c53fccb6d7db812c82db87758ed9c22b88898f55015104baa2e50e8e592237bea43745184121c716a712791e984fa9f016706e519c23abfebc3987c71f3b1fa2b8b18fe46ee79e66f6799f57a8b2ade34602bce0002150f385e55bc42717526886bea6f85c1cdd2cbd73b97fa76cfa920b43e477b8d70077d0a4fc8aa3d539ab61ba0629554cc21f3d7dfd46e5cfd9176cada944f4677f9b3383ecad0a129c927c942d318e8b869f1afd4f482e9ecfcfda8aff1aa00d10a07efd837957d5764c9571261db15558c5558d70db442ed48aeb7b3fb1e47a701fe1e236e03456077c5ea767b7834d8f94bb97e650f854bfa352526d978ef1f5004863487b442fda341ab0810f4d84ee7e03f8b64600aefa9b27ea4ca36314d4878f1910c2428b23c35e94aceb6e0bf9252a22d988d0e304240f77a1c9c5b9198152def5a5f05d84c5ab58cd7b7691e55fbc25ffefed31ec94ba36dd1f8bdca91b3d1219078a10e4172c5c3476bd484f4a27530783ab81b9cecb5b93e963906b399323e5ae44412595a8307500c310e3f5a84820a473f8ebe0b176dc8904595951fe3c928f0a9ce6cdae24d4090c8c065d2b764c327cae2c1591394b05fc805f4f9a0432622dd6766404a2b0956cbaad02d6e8160e65c0cf94920bd9de61ffc0a2d5f5d63092425742b44021ac476998f3cd39a850d41395a5b7b5fbdf34dc88fad9f7d0678d4c69047705dabea71b6ff65b0da4f295beece9e830f2fb6fb75e25d81e388af3aed680a514a74117"], 0x1)
r1 = openat$cachefiles(0xffffffffffffff9c, 0x0, 0x4005, 0x0)
ioctl$SNDRV_CTL_IOCTL_ELEM_REMOVE(r1, 0xc0405519, &(0x7f0000000200)={0x6, 0x4, 0x10000, 0x0, 'syz0\x00', 0x6})
ioctl$GIO_FONTX(0xffffffffffffffff, 0x4b6b, 0x0)
setsockopt$inet6_tcp_TCP_CONGESTION(0xffffffffffffffff, 0x6, 0xd, &(0x7f0000000000)='lp\x00', 0x3)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r2 = syz_open_dev$radio(&(0x7f00000000c0)='/dev/radio#\x00', 0x2, 0x2)
getsockopt$inet_IP_IPSEC_POLICY(r1, 0x0, 0x10, &(0x7f0000000f80)={{{@in=@initdev, @in=@multicast1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, <r3=>0x0}}, {{@in=@initdev}, 0x0, @in=@local}}, &(0x7f00000004c0)=0x53)
sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000080)=0x2, 0x0)
connect$unix(0xffffffffffffffff, &(0x7f0000000b00)=@file={0x1, './bus\x00'}, 0x6e)
r4 = syz_open_procfs(0x0, &(0x7f0000000000)='net\x00')
fsetxattr(r4, &(0x7f0000000280)=@known='user.syz\x00', &(0x7f00000002c0)='\x00', 0x398, 0x0)
write$9p(0xffffffffffffffff, &(0x7f0000000300), 0x0)
bpf$MAP_UPDATE_ELEM(0x2, 0x0, 0xffd26dabc41432bf)
bpf$MAP_GET_NEXT_KEY(0x4, &(0x7f0000dc3000)={0xffffffffffffffff, 0x0, 0x0}, 0x18)
msgget$private(0x0, 0x80)
msgget(0x0, 0x442)
r5 = msgget(0x0, 0x400)
msgctl$MSG_STAT(r5, 0xb, &(0x7f00000005c0)=""/51)
ioctl$SIOCGSTAMPNS(r2, 0x8907, &(0x7f00000001c0))
ioctl$TUNGETIFF(r1, 0x800454d2, &(0x7f0000000400))
socket$pptp(0x18, 0x1, 0x2)
sendmsg$key(0xffffffffffffffff, 0x0, 0x0)
r6 = socket$nl_route(0x10, 0x3, 0x0)
ioctl$ifreq_SIOCGIFINDEX_team(0xffffffffffffffff, 0x8933, &(0x7f0000000580)={'team0\x00', r3})
accept$unix(0xffffffffffffffff, 0x0, &(0x7f0000000140))
sendmsg$nl_route(r6, &(0x7f0000000100)={0x0, 0xc9000000, &(0x7f0000000000)={&(0x7f0000000b80)=ANY=[@ANYBLOB="2800000010005fba00d598c0c6c6e1425258b58e850000000000000000000000631ead77df4cbc9db92345287faa6d1fcfba6c3226d10c4a7d84f1071ff9dcdcc4073cb09484048b7cabc13a8b55c4fb1f385446fa73f3a6db4677dff765c4051227209fb8a3c20aa75c7c91728a17ebae16fc2fd7c5b5050c3f413f21acc652e7cd5eaa0a7afc6d69f41ca0c7e7b77d052483aaeba7bcdd3772430f9d08e74b365e97b728666535344b558a94b4cb299cad284713d6a66fe798c6d3084b0ae869d6953029e5fe8450f6cf84dbc8dd3a16cc00985db2067d61b7978dd31ea012031f7972b5921df5eaab3c424cbd265af2e9188c33b6e6f47f128d082a3106e2aa97bca7e984a108ccc39dc6befad16187688e86d9d5feebc368d7915cc99eef571848ed522e8d95173f757c48e68c018d0f83375c3cfecfed93cdcf6bb7d4f83a8a289a999ffc775b6647ded56150c0d7c487a8e98e928b1b99e77717e364d299f0e23be7820e6ec2ddb7edf5f71df06d1a091a98c041862aa3", @ANYRES32=0x0, @ANYBLOB="030000000000000008001b0000000000"], 0x28}}, 0x0)

05:02:29 executing program 3:
recvmmsg(0xffffffffffffffff, &(0x7f0000003140)=[{{&(0x7f0000001400)=@ipx, 0x80, 0x0}}], 0x1, 0x0, 0x0)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = syz_open_procfs(0x0, &(0x7f00000004c0)='net/rt_cache\x00')
preadv(r0, &(0x7f00000017c0), 0xa4, 0x0)

05:02:29 executing program 2:
r0 = syz_open_dev$sndtimer(&(0x7f0000026000)='/dev/snd/timer\x00', 0x0, 0x0)
r1 = dup3(r0, r0, 0x80000)
ioctl$UI_GET_SYSNAME(r1, 0x8040552c, 0x0)
perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8)
r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c)
bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r2, &(0x7f0000000040), 0x0}, 0x20)
openat$cgroup_ro(r1, &(0x7f00000004c0)='cpuset.effective_cpus\x00', 0x0, 0x0)
unlink(&(0x7f0000000900)='./file0/file0\x00')
r3 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r4 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r4, 0x0)
ioctl$BINDER_GET_NODE_DEBUG_INFO(r3, 0xc018620b, &(0x7f0000000780))
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f00000000c0)=[@enter_looper], 0x48, 0x0, &(0x7f0000000700)="2ba063fb309ec7fdbfb08e6e91baee7d7d4599fe14129a4d426834556ae420e087d59c0c7be7fcad1abb7e1f8f446f373f611ca1ee9c2231708e18a47bc68a2a79a0b48931f6ff6d"})
ioctl$sock_inet_tcp_SIOCOUTQNSD(r1, 0x894b, &(0x7f0000000480))
getsockopt$inet_IP_IPSEC_POLICY(0xffffffffffffffff, 0x0, 0x10, &(0x7f0000000540)={{{@in6, @in=@remote}}, {{@in6=@ipv4={[], [], @local}}, 0x0, @in6}}, &(0x7f0000000000)=0xe8)
ioctl$BINDER_SET_CONTEXT_MGR(r4, 0x40046207, 0x0)
r5 = dup(r4)
shutdown(r5, 0x1)
prctl$PR_SET_NAME(0xf, &(0x7f0000000380)='/group.stat\x00')
syz_open_dev$binder(&(0x7f0000000880)='/dev/binder#\x00', 0x0, 0x2)
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)})
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, &(0x7f0000000780)})
ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f0000000680)})
creat(&(0x7f00000000c0)='./file0\x00', 0x0)
openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000100)='/group.stat\x00', 0x2761, 0x0)
clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000080), 0xffffffffffffffff)
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000003c0)={0x14, 0x0, &(0x7f0000000680)=[@acquire_done], 0x0, 0x0, 0x0})

05:02:29 executing program 1:
r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000200)='/dev/nullb0\x00', 0x5000000084002, 0x0)
mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x200000e, 0x13, r0, 0x0)
r1 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x4000, 0x0)
preadv(r1, &(0x7f0000000040)=[{&(0x7f0000000400)=""/4096, 0x3ffc0c}], 0x1, 0x0)

05:02:29 executing program 0:
recvmmsg(0xffffffffffffffff, &(0x7f0000003140)=[{{&(0x7f0000001400)=@ipx, 0x80, 0x0}}], 0x1, 0x0, 0x0)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = syz_open_procfs(0x0, &(0x7f00000004c0)='net/rt_cache\x00')
preadv(r0, &(0x7f00000017c0), 0x9e, 0x0)

[  379.333709] binder: release 17250:17266 transaction 576 out, still active
05:02:29 executing program 3:
recvmmsg(0xffffffffffffffff, &(0x7f0000003140)=[{{&(0x7f0000001400)=@ipx, 0x80, 0x0}}], 0x1, 0x0, 0x0)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = syz_open_procfs(0x0, &(0x7f00000004c0)='net/rt_cache\x00')
preadv(r0, &(0x7f00000017c0), 0xa5, 0x0)

[  379.447885] IPVS: ftp: loaded support on port[0] = 21
05:02:29 executing program 0:
recvmmsg(0xffffffffffffffff, &(0x7f0000003140)=[{{&(0x7f0000001400)=@ipx, 0x80, 0x0}}], 0x1, 0x0, 0x0)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = syz_open_procfs(0x0, &(0x7f00000004c0)='net/rt_cache\x00')
preadv(r0, &(0x7f00000017c0), 0x9f, 0x0)

[  379.494767] binder: release 17264:17281 transaction 579 out, still active
05:02:29 executing program 1:
r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000200)='/dev/nullb0\x00', 0x5000000084002, 0x0)
mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x200000e, 0x13, r0, 0x0)
r1 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x4000, 0x0)
preadv(r1, &(0x7f0000000040)=[{&(0x7f0000000400)=""/4096, 0x3ffc0d}], 0x1, 0x0)

[  379.542556] binder: 17306 RLIMIT_NICE not set
05:02:29 executing program 4:
r0 = socket$inet6_udp(0xa, 0x2, 0x0)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
connect$inet6(r0, &(0x7f0000000000)={0xa, 0x0, 0x2, @dev, 0x3}, 0x1c)
r1 = socket$l2tp(0x18, 0x1, 0x1)
recvmsg$kcm(r1, &(0x7f0000000440)={&(0x7f0000000080)=@ipx, 0x80, &(0x7f00000003c0)=[{&(0x7f0000000100)=""/103, 0x67}, {&(0x7f00000001c0)=""/251, 0xfb}], 0x2, &(0x7f0000000400)=""/40, 0x28}, 0x100)
connect$l2tp(r1, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x0, @multicast2}, 0x4}}, 0x26)
setsockopt$inet6_IPV6_XFRM_POLICY(r0, 0x29, 0x23, &(0x7f00000002c0)={{{@in6=@local, @in, 0x0, 0x0, 0x0, 0x0, 0x800000000000000a}, {}, {}, 0x0, 0x0, 0x1}, {{@in6=@remote, 0x0, 0x2b}, 0x2, @in, 0x0, 0x4}}, 0xe8)
r2 = openat$audio(0xffffffffffffff9c, &(0x7f0000000480)='/dev/audio\x00', 0x200000, 0x0)
ioctl$SNDRV_CTL_IOCTL_ELEM_WRITE(r2, 0xc4c85513, &(0x7f00000004c0)={{0xa, 0x6, 0xfffffffffffffff7, 0x14d732ea, 'syz1\x00', 0x4}, 0x1, [0x1, 0x2c8a, 0x7, 0x9, 0x101, 0x1, 0x7, 0x0, 0x8, 0xfffffffffffffffb, 0xfffffffffffffff7, 0x4, 0x7, 0x4, 0x9, 0x400, 0x0, 0x5, 0x0, 0x2, 0x8, 0x2, 0x3, 0xffffffff, 0x0, 0x2, 0x8, 0x40, 0x7, 0x8000, 0x7, 0x6c6, 0xfffffffffffffff8, 0xff, 0x9, 0x4, 0x8000, 0xd3f0, 0x1, 0x9, 0x597f6e31, 0x5fdc, 0xcb, 0x3, 0x8, 0x9, 0x3, 0x15, 0x8bf8, 0x5c, 0x0, 0x7, 0x1cc14245, 0x7, 0x9, 0x401, 0x4, 0x8000, 0xffff, 0x1, 0x3ff, 0x40, 0xa9d1, 0x6, 0x3, 0xaf73, 0xffffffffffffff78, 0x80000001, 0xfffffffffffffffc, 0x3, 0x1277, 0x9, 0x101, 0x6529, 0xfffffffffffffff7, 0x5e40000000000, 0x4, 0x5, 0x200, 0x6, 0x3, 0x1, 0x5, 0x8, 0xfff, 0x400, 0x5439, 0x5, 0xfffffffffffffacd, 0x7, 0x7, 0x9, 0x1f, 0x9, 0x401, 0x3ff, 0x3, 0xe21d, 0x1a96000, 0x0, 0x10001, 0x3, 0x9, 0x80, 0x0, 0x2, 0xcc2c, 0x7, 0x9, 0x1, 0x6, 0x0, 0xfffffffffffffffa, 0x7fffffff, 0x4, 0x200, 0x0, 0x7, 0x8, 0x2c, 0x569, 0xf2, 0x3, 0xfffffffffffffffd, 0x7, 0x4, 0x60]})
get_thread_area(&(0x7f0000000040)={0x2, 0xffffffffffffffff, 0x2000, 0x120000000000, 0x401, 0x2, 0x0, 0x0, 0x2, 0x8000})
sendmmsg(r1, &(0x7f0000006500)=[{{0x0, 0x0, &(0x7f0000002d80)=[{&(0x7f00000009c0)="81de6163bd4b86314d48777fc87488e75ceb25e717b13a33ffeb145aeec9b0ebf5855646eeadcd11ee1fcbc61068da01d05144a453bbfbb2cd677597691d9f68848d53aba6febacf14aec56601151d74d67d7dc9b129ce2283bb2e0c894df46547d35d5fca", 0x65}, {&(0x7f0000000a40)="dbf55bc7d769b529e5ecccac1e0d71d57c37fb8cdb39f65c3d104bccb56577517ff866e4b8f6954807fb2fed96666d2d51aab33c101080a56e97a983a5aa1ba62e1cda7ea13324543bd33e08f4e327e2f640e69685ebc9c8bdcd871e751cf03e10b7539712f46632aab4fc254997e78f5692e60c772a7c0ece164a3617c2f43679ae7ad36058459477cc503ae017ef0f94a368567c9db1c678232c0307908b4805b2a04074ba41acc55c0bf8c903642a141996f44b82b790fdbfa15c97ad0b8c01b5a5a6d3d5e7d6", 0xc8}, {&(0x7f0000000b40)="d38d55538bff1139561e71b3ccef6a8ec4bf2531ad48a2edb2b1e401e8a7230f8a39d1c850169f301bd37511ef68c4e29f960559eab29ca6ece9c3921c125954339656dbf39502a601429a0f824c40540e68ab91d0a5fe61de7917dd9c70358d7f8e7da9bb5fa19318026a4d8d39a8223f34610d2f2dc24baecec25c2e41316b5f7f3df917edafbaa6021cc2472da131c1e0a611c6ef62637a2c6eedeb69faef456e910955f3ca3903a158159dae89b692fc349b1b307f2e42bd04e752da1d0d90bcc28a196ca57632e0ad07e42ddbcc428d212d1fec150930a51f8c648547f3bdad395c2753f27b6f2520", 0xeb}, {&(0x7f0000000c40)="8631f87f862c39ad25db45", 0xb}, {&(0x7f0000000c80)="e5639d9a272fc937cd845de082737945f86d5152d01d928782970037b3a0cdb8c941de28a4eb93581876ec1d0745554a83c60987ccd6bf0316998e1ef8905b5c6eda8eacfa50d13958d6c6f794b69aaf87a168a043e16368c91261c8b66a1d9ce0d490e5a8ca645d5f371b96cbfc18806229c3e0337d484dbd6a2408942e1fde230bb671d468028490ea5cced4fbc328a3019f90365b2105d40c4977920fb746a833f94d4fcf527c8dfeebee3fb322cb2afcb5c6a4abe5e3894d5aaef1fa36a11d99de764df86961ecc5e3bb3e523eaa56ea84a0b33ad769b93646241865050242b86be4c126b504245fd3ab8e1b6fe849310d6569da9d786ddfa68a8d638c52584d08ab7b90661582cc9332526fbcf24cfcadd3b1ea23ffb17cfe3040dbb90ebdc5bd8c32e80ca21c25ff57b350529430ec6de2303576db5dcb172d91c187020fe0d20250d03aea173030826a7a47eb5a2d7cea43a75b5d3a0e7b6dcb699e700b888c3c2e9835ef67da4cb8e7281ee98b4a6354a4cdfb12a60125ce48b0fd002886394e19054599635c9a3fdb0a3f0e47e8ed5608dac2ed362d9049b8988ddf3afd56d3278d36149bd7b34bb92c1f3a92e88708b5fa6022218c5fca685791bf3b608934542254a1422be073b05b47c4dac5bc1daaae05998faf11928901af6ceb8756e320f033ef5668f1ec2635284c2fe3e92dc468387cf386c34dd7fd095a52442053d4fae3f36c3718aa2ce6792a00e2049aa8af2b824602fad6ef57560fcd6a093d9074743d6b56f23111ede39e3c9891001954162b8e312e30fdd3ddb61a77e02a9069919e2f50478653b1701f0d9611ca81d7fc74973d0b75c24ef82c4ef8c7a4190cde29e198eefee044af96dd5cda5d59c01fb7876812ff58b5e0e72b6a73084038251489931e2c139efa80c7310d0624d9095b32f17b93cf3767ade9d594e8a6d9131bc3fc24250052471581a39d99b48af5ff27fda069b5d6c8ff0f23ce2fd21a58bf593d232ac680d7f3e8ff40bdb19d6f110c663375a1d03a6bd091379186ad339683ec7de58e4d29526e8b188d3e42f608fc9fdf84fcde7bd07f293139fc16e4c67ade750201fac83457070bc4febadd6c40c6e50aa4638796c3de585192111018482abe39292e01acf9510bbc7868dd2e74b17b0b9717f02557a87c5326cf583a8b61ddbc4b6cbb27e827dd49052de1fe7dd5dad4eadf04c96d15428c5be8ec7f412b6f5ee57f414528fccb798e3d0b90a5e0c82fda9a536c5c9be90d4666623bdc87c0c550ab4a10d3994ca33db71483e0a0c1b0ee9aa00a6099335ed65fc3218b6373e50e1722c1db65c0d88f02374e293e69ef8f9ec3529d0edfcb31ea7a5dda73b58892d3c0544a727872fdce2cfec17f0b6cdac481ff79214d5ac3f637d26da6a60e7fe1de8153bee7406b499a69c31436367e1c2c644fc55e3f1a755792dfafeb99b11b180eb90732e7345d380653d9a9dd5992ba0494e03b60e7525b209721399566ec28615c7ffb030098aaa0c759bc473ad89aed344f342cadac573396659ea140bf641f0940d541bb5f4b4bc14eafb5ba55c70d6b087ab144e8204d36967f07bb640a04ab71afea3b866a33813c015fb63b8f0eb032395bed037b77e69811da1cbd388f05ee9b03615c92f16d0ab7bd982d626488b4c4dc0ccf5643d3272614625fbaaea07264b535d2d35a5e97d83633074371b9a309dae56e2b19e6173c4a343e35a1af786b388c51a201c6ed730e3d72baecbebd7ab8ab23e3b592e0ab1f0ad544493187287133cc526ac4e83a7646e68fc857e8a68e1a7e645d66e83a3689c631ad07ec5e13ca0f757e907f19a0707a1b2732883705018d1d924376046f5e3086a203d49eedfe56646886ca96db65a157f8f3931082b0332e2e8c453f4a95642a09794cdc736ea4b453d376ea9a7fbb90e4493a7ad2579f25c52a3750b1b082891e1577cd796c225461141ba0246a42fbcde304c342fb4c9eb35d3f752a8db7e8895fbbefb2c3ca31ef2962a3a8f10de38f378141c2d2b9971d534ac7022a53544b8c66fec90aeeced318aefc11f4662828c3e2febf9d22511585cef5bdb6744d6c6d851c9817f1fed0f9af4617e587ab913d9985b29fee8c7e8886b2c3ba87838e850b60b76fbfa6c35553919abaabdfa5e265e5fed0f6eedecd37cd498d68a86a2e17c0359051cd8d9cd0d8c9d44c19cfbce6b890fe446c50f24507ab7430ce659aaafa34d32d8cdf114ee3df33e03000c4502f61e43529d10e2dd916bc4423aab6dad37ccb4a9df243c27cbd67c1c87aced78bf7e8c5379402be109bb698ca4aeb7b21af3090a5789fd315a9436a871eff51d8b4cbc842eb834db1071092a4574dde07c3dba6ec660c1a87b00228a51cd994e89d5e1afec855c703e368562cecd00dc2fc221d05596b02008158f261c053071843b12b3c046a98b6b775fe6bd49a73cc3a460855d251862dabf94583fd9ea7e10a9b9368e5680b8a63d41e17b07fd89ce70e31e0f9893f444af11cec0b434ae86d86c6027aeb7c68f3f9755a7f17471a1ad0a4514d75a56e0150d1d9610d38f1a5a4bc6ab3a5d91b0c0709eec848271f44e1a045323d6653451d2f1d8c231462a558b7e31ebfbd6eeeb478296187ecc2622e37a0edba49a31ffc4b0d7a925c69edfa2fa804da7df80583996fd0672deb55065e44c7141b5f8015d1c0fcd22381223c4d22e9efa44373daca0d8af39e3ed60b3030c9b61a2816a8678b97eb5e61b8f70ad579ac4b651c142d311f68b6075641136ed23f3f62839ff93a76264bdf1a9c47e23090bcb3b004e210773820808466068c511f0abc21fa71cc4ed85db6c887e5bbb312c7b1ba63e1cfe2b98e59a4d5cc8391470cb47c70b7ae4e32c09b6fa1a64f334451426e9e466778714213f25c54991a29e88e5c5a229d1e621606b73d22bad71b6b6325769e3d47e72ad00996a38d6463ecf00194b39a2b62ced9bf336e1fcdb9ef290dcda0bda29784cbd265fe7b39725057289a941e0cc66deb93591c156d2588923088a4b63b925392fa3fc8bd44d5b246cd529d692bb71fbde99973ae370c1cc7d3b1e3375aa6cd585550c92c3438d28377540acbd1da22ff230c34013ff79030e55bcb124172bfdb2c0395fc183c2809ccdedda700f7f4adf01c79a770914fda191b6a4425f248fa10aa42c08204a566f71b8b0010c810d54c4ca9f20f9fd112cdb49ec81a2de021916e744bc7cd9a77b3e209fea877a12bb7bfd494d8594bf01dd29da47f5cf5bdbe8da6ffbb3644d29a610006bb808985c51d995903b3df9f045bc6f638912e504cbf92f50b5e49165c6af99bdceec8346b9dff88f670ed50c51fab631a04ffb5e8f01368a90dfd3a1b2ab9ac01ec7ff25298677966b5da44519df4133553e088bb37ab698b13938ae3026206c37483f837b6aa7b631df1bf4ed64065b153d7639f89dfa6eb9d6061e502ce6f5b6e0973b00c33e7ecf1a6c138ef7d6b53be9c852e5aac21bc889ab02d316846a49ddbadd65cab99d696342d8d654dae0e2de249b34e6140bb8cf0cfefeadb661649736b375ecd2bb026481940c22815f3ae07e7e07c7c73a82ac8e7ba343f36b3798f98189b44edf81332b68ce01428675e7ef86ccb2da6d318bbce8f170c14cbca3c0f59056fd78f77e9f5d77c71773fdc000eeccbaaea790e6f0199752814cf9547f6d8317b4607d20f037a3e3adc556a476d0a382090d0022469c17dcdfa95daa06e578f3f46acfa4f6cd86192321e4300724ea73282a24e44369f733b12764c5998c5def28285f677b801813fa9edee448d8fda430ede500df25301716cc8802d96960da9ac5fdbc76e2e86c07107df3adcd8af876c593d49ce5bcc0d8932c0a92fde4b701a46451bcb39d1e7a4d8f730d5ec9e1aef6f89dd01802ace79652eebcce327fd984dd854c481d322360de4a1c8bb008a016383aabf6d4b8dfaf016ae2bf3147ebb6a395aad42864780a97254bb9bad985c29211cfe946a8814205b0b6f14e5729e3723f3d4e9f95b320713c54cba9bc6f2db35dee110627c823f4fb14d5a95bdba8a4a213cb5383d4342afb7d9654c7d4213a14ac2e6833de253f695ff2cdecdf9e91bf2423b5f214c578a985efbfd8efa7cf1cdeacdd8684db2a8c9c590e800363582ee4892656a73a4a49da65858d3fde0ce0cd423fb1d1c97b523b02a8e623a7fcba0d211ff658b71c7361586a97552ba5d15e398e832c15e86d18d753f28ee2233819a6c4fe043dc1249656789b5fb2ddacfffcd9bd8ab185cf0678c96197e0d60482cd8c09080cc3c918a56c2cde836ad3939c74f427da4175752d5efe877f30944e2aeebb7e1b88d9bdd85a0363b4405ea87deabcceb1e84202a1847476ff35e4ea964e218974202a4bfbe76262e2b28f3e3bfc560727b7b7efdaa88c67718234e1ea339787031473792cad70866e45231dc71f46ff1bcd148cf75a93976564558d6a3faaca440d2ee02ca5a84a012a5e982594773ec17939af1646bd51e7266e6a4663f4fa72ab2b6b5903ad37945a58488beba7a3909ec9b75d8d39edbd0efd287125dd77386df232de84b1e323ca335614fdffafb6611358da4c6f0224c09caed442b1a51055ef82034a7c2cb3d676a200ea762568f36ab0f43590c3af1a493d1800d45c6995ce97f41d0a5f8ce1a539c2d4a2d5800f9d32898ff6f2dc4fe1b68bf88c14a5ddff330015d5b42b43cd89fafbc75e9a262bd7a28f5ba7d805fd02359c54fa5e34f5a0cc83337b7f8d060ced3325b7ec52ecf88e6bb0f73067fed74b6e1fb6e561d443afe358a2afac2e3bc6a31336986e0722aa74892739f3fff7462b8751864118de47d0d0662977244ed402b0fcc004c4203e83df9bcc40579d37cb4797a00dcdf558c2b5db0535047f707e3c28ff7dc00114a4ef55dc366e239c1fcfdbce9c0c501c15616b27d1ab2b80a50402b691cde500bb544084e2fe570c0712b5186fe70318b33c16c1319f398c6ac78ccf9ce23880935def74e2caffd85791b06fb2ddd03671757ec09fe78b7cc9e29dd7cbd0d140ea40a24c46fed659b93d69e1f370f59d10d51298bd9e1b450f2491fd02f6c686f2a4b7e7635d745ef90ff52fcebc82504ddf1e757505e9ebf31716701d3b6e7a3e2b2441741fc398f63b328bb56b9254ab4a4452140b8b4c4f95fa085ae6f1929e6ac7d333fa591a72113ecf621bdf8cbdd84d6788ac6de202fa4949d843ba62bc57cf9c1e61ba9d059c252cfa50c00790e6b24e5b7e93999dc27f5f57ed98add53a276d4a26feb308054f3d72e6ecae853b4d9aff542532e30eeba8e31903aaafacc6cf8d5f155b3b7f481fe581fa9ab905656ad37b13eb8345d43e420f0d49c605134d2fabe5ad81553a37fb083b4c3dcaf239dd2b46eb800b325f297a2b6d606f228dcdb858b15a411b0bc9feaf55f2dd747c8f9d13d44958e3db055c4b420c12f9e3255c625df6b434e7dc950a11032f589e5e056e6ec51e78f88a7fa0b7f1018e28ceb21dfab04f70ac4eb53f8b748da805e6bdd2a83bdbbb4218e7f5125b9e268443ca9783c8543bd8078de7176852961b90cdf554e1c0bb54fb49be5ee855b043649ae1fa46fd487e3f79104d9627c74ca21b5efdc2bd788809e2df2bc888272a4d22ca01b954a7e1239b9d8bf687d9d38b75eda1d64e9dad3495915137bc65419af6aa50ca34852cb1c150e47b15d64de3dc33281c283f5cd405c07e6a44d1a5c270b2ef332af5d1fc4767dfffa11a4841af1c63d9aa54b7f", 0x1000}, {&(0x7f0000001c80)="02b839738a7f0b756ab5bd9ce5b798640cedb870428e9490db55cf7bcd9beff6aba4352577ae6a92ae70e7143c20864fe7e22e43b826ee8cd258373d1da15259d7ee2943b595dedb5f0857e2bd66aa6223d6fd21e104a2ed7ed5e273c7d1ff629dc26d9ff04cd079bd595bdbeb31e8505f76e26d4126f1fa6a86a414ecede14e9bc2049f979051cfe64d6f07a117d99fc3df6db25594e76d5115d7d65b9adf34e68ba694b6c75a45528f5492df39c477a761cea3b35c87f0997a35d02c8253e2be6ce5b1ddde4906fb3050e0fc904124f397513ededf8e8ad4b038e5d707c241d4c4ab1f4afae6938b4414539ad941d51652c932d24560a40a1a27a5dcf94e54d0a270e546f4052246928e7c79ed4aaa20b792e969cdd23aa658704bce76f2435fd959b14533e44748d0d6ced4ec459a8701fae35d29ed22c60cb3cb342cf423b03816003d7680c6a226fbb6eea05616358611c616690396db122d4a795f1c816916fed9fd6790b79190869e12b2c75f8f74093698c18a140f4b970b30b0e508128f1515c3084cd065aed522de3c8ef180914be980ed763e20cdddf7af9c2358b0dbc2f99e7774937249209bc1af93967dc10c05ff93f1dd020e4375205e8ae93189c912e05dd5c476dd37b6480bf3c968e7cd9ebdbd33972307e69f94987630a94e9c88888cff32faa9381bdd680b9ca351397540ffe9c2bf63cc95f1c7ccfe5e98c56d05fee57b3955983adf96d10ebc4e40a99da5ce2386306c61c6d2035d25e70bab98d372deddeeab3b67e3853af4bd3d38ee0965650acbc5a30f30f32b3ed51c560a6857e055766ad390abaaf41dc1dd9b1b2e3cbe6148717b36b06d59ce6ffa9c4622df6d4c98af130112c4286f2286416891f86b0d610c533a01a97203c59a80e402533885f65fd32bb600cdeb41d2cd3bb1951e299decf2c3309566dfaad5007f5ec8d64678b09a5e59fe462fadfda3fe4064f26854bce86cc1123059eb61fc52cf0daf375de92fa709afea5f14f70b39d1573f4a1bf224a3295a8f8c6c87652f0f8c19e5920e87b76e383a0f1601f11d6ffa5148d17f93b6bc9df2284ae6ef3d9b443c5113f5abceb53f745f2c3c79ca8cef7ff66f25c5bc3279907ba1ff1d87e7abca54d71169f208f6f7f47726ea8b265e478f16d482422a2559fea0dc8732d49cf1a91f1f5f7d50060a7e0807ef9b6a0d62fb7c1b47cddfff7a978da6249020508350efc5eb68805b8e1061586369185c86c6bce47d89f4552301c8d3cc754cd8403ce330e03f7f9c3074fea9f8a9d1251a4538c2940020d9b00502420f43bc7838452453da921946cbedf171eb6a82f4a4e974c22afa7adb675c2d87fa0b8ef8f682eff3cf9a3320a2a56321f9bedce41cfacf691adf8c11c2797529ba1485a2bdee203dd060321bdb20d7560752a64dace7c38abe24dac6e816d1109f6891036d9a686c414349531bb4354fe5822e79464a95891609589e70fd293f1dd69f50665d2e256ed1b0fce1784940bddabb7eced13a77a6016938a04690ffae778b5958f1c731b1eb4ec7c8aa37161c871c965c5476b41027494f64a244760dee81e647b794b7fadd9fedbbc9d73644c95e44d7b4bd518cbd6cde81761c0df137dbf73a7471f84c610e2f4ae03f01c1d5dbb1e30c01873f1033abdb059154b36101b17a90af0c5240aa15f771e39d5d3e807bda81b6a08a8b0072153be78db70d49f0403d9887c43cbfa34a8ae36fef8c03f905588e422ed143a624673fe405fc111469135aa294d1df59fd034b42656caaa3cb5ada130001f698fb85f5d7d5651b7d9425985ee8182220f59613750ee0cd846cc25750d902557aac061532a1b58fdeb1a434c43020b843fe84f53478ee2edf9b814f52c9982b40884effae70cc66d56461e0c22e1439a348b747821c1e71dca12a705be86e8941ef13902753b8cb58e86f4a2182c666bdae91dfbd419add00dcb6dd59742d5630685dc8f5be2b742998aec5264394b364d2f89c0699189523865049f43b7786682eeabcc6339672cc5b022b61058f173d29e30d80f01e6e63adf7acf7da313f25ac8418072e7e8f04cbc946a1080ae68f8377944af7d06acfb6fc221611b892e2a5135dafe43b644436e9886f82ad6d741a2211378dd7212c5aa2d5efa3b5ab8f5fff455b8622e5e2e9f0aeb4a51a47c285ecf7e142575abf6608e7c25963f38a7d231d0e809cd9c4075bb626eb0d22f71f0f280ff07e9aacd9800d4ea3bd317bbc73adaf49fe91eccdbbbe1fb3fbb4066160a40700161a13bc27eb9ee608db22b919c7e7eaae21de770a97b19e32c1a4f5256376a9813112a37df8612bdb65d6bbd7d1fc93e1ea445d0adc4c2a252937a8b29d86cf79aa43fad2256c27adcd54aa63f84a7d2571ee144d82fbe0893e4f136500d94d502cce20d1b63c894ede7be06e5a1a6e7104b51b41aea7d4791ffbee84bb5dd08dc266b9891bd25f75e867069f858581d3c7a44428f56e771fe7dcc2e4141f84bfed47503871c780b5594879ab77c4988f889cbd0aae272f4ecaa201439da29a079dbf639f90383fa68d5dfd6d7aafef8c489afdfe90acff18063e1460930c9a8496df1d969ee4f72fb3475f5ef32d0b029304bf3323a11f83172f7e08b6131cf3a15d46a7cfbf20aa94af8c5637796c1b93ae395485d4b60928d0b8cc8fd6c8b8328ea1ce5b70b4f4ac6eab0b57052c395fe2b6d7422981e41e645ab00c4aebc2c086c5ac5da5e55665b286a8600e53364e0ea4db9554806150150bf2e61569ef02131885a96a6969ca2e62a48d539119a8153d6bf33802ef0c8d0dbf2b9bb44c71e16cf89b22d42aa98858b779798845b65a157faf5f6713d9bb60a2a51e9e17f64ef48e1c30e6fe8816c77faa48b5f78c484a7b9a765797f3832c872c67e307f23693690188596f737727194acb21290b6988aa419943263610d591b77180595cfe971f14a16591faac52720f7748ffc8cdc8a505209265a4ce69709681042d2feda69423c657ca13762ec3633c3501d58a4ef55c75d9686c199b84387ad1c7dbfab72117de37aa94a6f4d6db1073a17c39e957f4467ed7eccb7dd31a4883c7e63862c326e6e6b35fdad8086056487dae8e4284cc10a0995cc6122aaf60256d4a0b35907a7c5c5b83092fd3d9d1c38bce791db037489c2a0ec053c51a36d5c22b4b9336cc1e1468c6c865debcbf7c9f90cfec4845c647fe62523af63e49f33288b12d3bebd70c3567841f59ed23430f060b9c7789fcb9244e9b7bc759f898e2c5ad1a00b723c53613d4f186a29bd8e8bc0d774110d502786a62fce3761b58e390c4f2a47da00f2c8d3cb05a17394447fda0268d8e8cc14d6ebd9067919437354719053a6d85d6ebae1e79e1352e108dcaecf755bc5314226d14bacc66fd43d3c0392adf2e9c1b67c66a87163327061962d9f847cd17f73ee9a90687e27694098099cf873bec76321e4b2a7101264a16cba56c86654669fde2dde38e1c7c49eadaf5361143edba3448e91d4aa31c7cb91c8360ba643185852c3cd6bea9a289f6196f477821eb3c4999b9cbaaca477035a5e123d5604e0233cc20797128a7813d26567c4aed2a1cadb0e8fa9a04917f41402d8cc38f6b385c4a7276056e561245231e9045e1f2658452b03f081bea1141f703180d39ba12d1c320941c2256e74ac928061364e500ac00c319755dff600e3ea543a203e4b4e9e8eedf5679b5513b96f22f43bd748b4963363d3baf468bc37e91949fb0c51dca6edaa5a648183503c45d55f9de15c2889a942e049787274f3c49e46c7972c252789bfc3f87b3816218faf90de832a9f1ea3b1b16ff2a755dd6493fd4a8cd511a0088bcc0f306547903713a904cbc117c7411a146ca517d1f7429eb92861d56274ee36d56c474e358b3d3a477999cdb192b2012b1ce1c43062f03c63cbf9fc22914168ce6f24d0e576e07a54abb4601610da529d9c7702430cc68da485a8ec37874c313aafb29ffca4c76bd063fecc6bc657a454fd632e1e0bf40cfc88e7e1d7345a6765a3ff1ad3d8d8a3ae52b4d23d89a28fe50dc9ff6781ab6714bd9ace363ff3ab957be5032e8bf6ce12e790f1a1b6d0747cc79bdc557463269b83f7799d9e4dffd96334828517198914cc275fb309e5f6147412100f2103b9f66cee08e2dea9677a51ff06bb7132fed610d889e508f28f51479ccfb7e023e87879aa97f17af7ba2adaa3660bc76dc83ad5a7eb8ff387a69f2ee03931e65fbc7f7e361df7e912edd08440e253e589f08192ea2841c92d5faa07dca8e4531ab1b718e90dbc5c332a8f5276226c4a0fe8b012835d1e1743f888e0d3d63d9fddb8d0a902544e43ff1334556115aff2502791e3515c30b61910db6c678e21b4dac312137c571f3f93c38eff26028fb4f06b8f0b3cac8b62d115140a1b026531eb1609a332e80f0f9139a27f85edc1ccf96005e76f559944cfad5bee83e9172154c2f709ab26b658ee30db5238b03e876d7784baba5fbec8924e71981458a205489a5cb07d547bf50327c839e296cca1b164e034bcf8d8ef0040bd4a57fffa95d57d1f046c172863e6e7f6ec9ca089271328144fc25f3e24decb652f336fade4e0b7b3472774827dade20b20a2407577bbbf4a50da6ea7913bf3374906c5d62873c0c818bf1f5fdb78f158254fe2ca6402ab903a33882c500de48a7209dc0fc0edfd333cf7a50d26931ff7b9461b7674b376bdac7a2a2b8f5e038fe97d430cf281095003b8b3d11efcee7d22ba9d095eff124cabe13df9d140bed060b356657fe1542778f76f3ddcdbaf7438eb007945ac4fb1ce1358f8e9523ec62971c8ea985a9de5bed3a6ecd575fa4d1e7e808dee8d3536e5c616fd1dfd433e4e8056cc228459f06cac8194192007e270a2f8218aa8f6fd1192aaee1e84f83592294a186818c6227b02f328cc9aa5bca24d768bf153e864bff60dde08e863bf82b8f214ec5daeac1bb96fed7c14b83ea9b1c876b76df573eaa6ea7e7873b2562d30b1617931b22c3869bd3d40f8a655365fb237191759e190a2a418425ada38e4f507d2fe5c7b253ad234f3241a38cf3de805a37d9928c2eb1887a894cd323ee7f287f1c62122f4f3ca62133e7d2e97c0cbd12896f302ac3a2c0a8d0e7ea6f659cbaef01410a63b35b99d8a2cfbc01156931fa065689176bad6157681c56480481f28a046fe8ce8c412519cf7fc8694373f21bb4abfec81471b046cf5f65156a49ca03558b1af58a33ce54680d17c325441000bbc8e13553d1927f4652e34120d83182a1c90b29a3ff991aa7f483767bb7ffb1711c81ebd81d0ac37e869f684408b6497e0b45ae21fe6ac56bc39b3c5f842e7798263d269566b78288fca965052f253cdcf51cab5e13f12df81903bfc38b3fd6312ee21e6e92132ac4d91b5f0ad364a580c96365e4db7db080f3a51c6c5857e2ee61670baf78a0059d1ff7f5802ad95fa84254c6ffa5faaf54676d852e12867ffbd857b73cf5261f34f31b4779e9691f9ac67bb2b6b597bd605ffd6cc464c9602f2cfa0d07ebdd5fd981186421b2292e08e62abce7e5fe33c19a1bd1dc66385ad53cdbc3962ee3de0eb0b8c70017a4c244c540ff04a0aec2359e473741141960f247afe4b39e126b6874fb1dce5baa68ffd10b59c5c9c56f4d004927cfd1e0c5dd65c5270bd98f28afcbe1e50e9746a8361bfbddd8128bd81bdd2b70502c109532515eb40b826d3ca43ff77f2464f0f1a0dec544f05e7ff815887bd16f34b13ee76b64edc488c1d216489c5c", 0x1000}, {&(0x7f0000002c80)="c558bd900acf9dc5a0f46e34e584e13b23bbbf4faf6544b85d3f062f9d48fc7aa6a7c94c28c7467778c7e9a2e1", 0x2d}, {&(0x7f0000002cc0)="44d5889a92706d4de136908ccf583a289e1316fb1a3ed8c8fb2fbf596eac750cdab10f6495bde0f61ce30d028bbb14e1f945f7df4ebb2a3b10a07c0d0c43a20d61079b73586e6f60877f94be095104e555bce86c2a003c4f17c6e19934d3bd292d3174f004a2c4487eaa1f0eacd4fb041ba1fdab63404c76b53b257510860056b1bf88e9770727212e8ba3494ea9c25be435c634526830f25ea87834245900b3fa5435e3104e88585b3780f396b91a306620", 0xb2}], 0x8, &(0x7f0000002e00)=[{0xd8, 0x1, 0x6, "3465acba8213181682dec54af9c99ba9a0b65307f29508ec5da369c799be1714e1099ee2daa86927d961432793d779ee3b2bba2f016d70add0092421da428e22777313cce5efe18f7ec9ff74704ea711b7d98e3af133f9a6629b46fb3a4f505a98115accf63569ad51038dd44a1e6341101b8da3147548703a917710882a6fe412f6d05aad028ec65b30d92f97728d361c01b5a35c6172fd691fb5eeed1aec1bd784e12e14a0a81f275c840ae128131e3dddc4f4ad27a6b93a82a8dda78cd2109e5c34"}, {0xd8, 0x11f, 0x3ff, "b02e5f97e945d05c055ae2c9a67525b4e11c31211089ca814c0f010e603f353bfec2f7c09534e7b0fc4a8efa7fb834aad37a23aed031fa87fa453f4a44d9d1796e9d647dc5dbd9e2dcf12bc69421996d896694b8cd19a0e17b865235a87fccaf5a8a3fb9ddb7817cb3b17c21520327a6fed05e0b8eb579f31b0cae63195a66f2136814f19229df400e77de88ef41bedcc3f5c1fa9fdff7826835b18e979731a8875e69185c00040772f2f7fb0930a3457d34d64cf3c4da8d2998d07d3f26726b5eb89d"}, {0xd8, 0x0, 0x5, "d179032ae861d73d3eefd2df4b4a55457bbc7227447598f8292fde81e8228b43634fd4882a188ed35842e586b05666b6e03247e7f297a12b27eac6de892e4ccb435fcd38d01236fa0a42b340bd8dda7787b0c62a9a36d9198d3b8907d063d5e3a89513f2652cf46cb099d6acf97bf5ae092b8d30afef1c205a337147feaf8065bf5460d1cf205cec673de300040b7ccf0fe2ca5bc86e9c5aed1f82d1d4d92fcb69cdd9cd6255de749dee0509d40ee9fd14e8bd42d665f1ab52779d53caf1556a6636"}, {0xd8, 0x10e, 0x7fffffff, "d8528beb5f9316fdb48fa7cb5525d1fc4b4cafab13b2254043c1c628dd68b6198bd2831ede703764d7ba6472aa974db9abc0cd49eadf718582898965499d3e486811798aba03779bc9703795347a91468f95cc160a389f428e2d93dd308475f7d662c791e5a3b8bba348a1b31f182766efe04f1659ddc2f24f2db6b1210e625de43ed096e93986b5925b7d401c5f727cc79174cb9eaf7b65edb9365ab063556eb70bbbb350d02920a1945753102fa2599c3adb3c2c8ce337b92b0d828ff34de6d4ef"}, {0xf8, 0x6, 0x100000001, "5be7d423443596ab78fa90ade4b7a0cfe0d6e8900b9e08d7905a1674a9849e0254630868b6499390bdf914c2dc4dfe9799093c994338b08c38bc3de873de8d1c534a9b56f9ecf875c527cfcace308946db7806a5ca195e059df2df1efa4242db8fe5d76c8ffa291dafcf43f28c34578db645b1d20526c05c53f46317ac69c973c07cc638a9d0554eafc5723aa867b9fd692c1fdd27c7749e68a1b79f8f319a50227c710106050d0e1a7a05af67232fddb7e8a5a51653ba75127b5c9924f88aeff506252f5d41fb7e4a10c3f4812e5c8b67b4b7f783049c101347738e1d97b743d3ef98d207e043de"}, {0x78, 0x109, 0x1, "955839ce82c32fc42e0e5fa3f1eb0cbe3f192934bc8fe9233628c388e5775776355e5cd30a6031e251131ee86ebf7133b6b991251e916e0384c6c60d8031987d49111194437a4280d91a6ef64e94fd471a6ffceea30a7fad95a9a42656df9127d019ab38c348c1"}, {0x30, 0x88, 0x9, "0b437073a3e7c15b7c677c0cff4b16ea78e2ec554c3cff82a17a96692988227f"}, {0x88, 0x84, 0x2, "8b68c2edcbe848825419c4942fe864ac7901e273bcdecf66776c8dd2da27c4a9e47865b70f03063c07448424e47d457e51bf14d9cdc62a719465735f3d9ae797fee5228a41282d3e6e37a8e8fcfef6e5d9332b1662d71cad444dc39a0fd4b056d6a121fac83cb9cbc5fb9a98c5e7972401451b9799f6"}, {0x10, 0x107, 0x2}], 0x598}, 0x4}, {{&(0x7f00000033c0)=@pppoe={0x18, 0x0, {0x3, @dev={[], 0x28}, 'team_slave_1\x00'}}, 0x80, &(0x7f0000003480)=[{&(0x7f0000003440)="ac473fcd54431f22c6a16dc44cd96f61", 0x10}], 0x1, &(0x7f00000034c0)=[{0x60, 0x0, 0x5, "edd0700626b792457b79de874a2dee5e5207b50bae65dcdbdcc03f3a78fcf45de0cf6fc0bb740e66748a20e233099b4e0e7b7b771b71f01001ab02a07af3e09836e8ddf9f9976457e368c121"}], 0x60}, 0x401}, {{&(0x7f0000003540)=@pptp={0x18, 0x2, {0x3, @remote}}, 0x80, &(0x7f00000046c0)=[{&(0x7f00000035c0)="f410347747326bba9857d60c4285ecd87819a3c7dfbaa7929ee8dea8963eae41944d8970def46c67830cdc43998b33bc908e4aafab4eecfd02a5f4761707fe37abc46820829be514cc043c8b6b143838787667f565d3bc4aeab82acdcc01a7a6e0619cd468694a7551dfd0749b8c435aee1c4e50a2349f450900944a8199f549f0d933cd4ab29d536a8b81ea80f56cb0bc5720d65c650c86f2125f7475a490b8d8bf949d09d3fb65f8f69310b4ceb00034353416363767859cc76457231ae2f0d842d72864c05417b570d758c76841005211cf92f7d434fc5398ec9ac16da0e97ffbe138fe90324380e98c0574dcb02b5dd313055ba57765093b9bb893975b395d917dfe855427e131ef4c8e11124d7eed5692f1619833c8dba39a467fe66cad33f48020d4df06be7d16cacbfee37aaec435c71fda087c8ee68fbcf44cbc4e4bd80619b371981ad44685f90d3bac36e79b583d6a02f557c3e3337ba8193eef5ffc225be05a1ce2bf5127c06e52f0e525ec5eb35ce84236119fc27335e7fbcadd42861a34732c76c873476eccf36a95f43fd6b366f86115747018d0cead1a054160122dc1f8572d493fbed85b0e0d6a774ffcc0dab9a16df190c67bcc989aaa51f2ebb2702b8c4a61f4b8eabc51edc0ab5fb10b5c682cc32be0a76dc829671051ad9a509ce73af356c3f406b1e79adc0181a3213c566021937e57cfd8f3454cb75115665981d484ffb0362af90b9a4c66e7c26d58da4594615a2de4aa6fe1810d396165f966ecb815fce43ee955fb61e3c9a4e590217fe1a63870f66202e7c074a75b9a1e0343ca9dbaa234b044056c4920316517fac1a23907295e4813f8b62bf8d0d0849c6daff01aba40bd2d05166778a0ea3a9b02af81a730d057ad0032797275cf925054a9ba1e7b050cc11bb75b6b8d35c5835f2a786d67be86d3f2a141b8a8f63502de75e279aca33ce3e6537db7c8079395b5a118026a8ca45cb5b44ad9ecd129430316bed0613a1759dbf5996d403b55a5cbd1536189036b554737b185937e550e05802db66291edbd9517cda9ce70ad01f4c0e66922697b567753b5c115412b1051c51989116784a7a34580ed862c9c90e85921c6148d4e14ed8a24a8bfebd1192e5c49d23186ac12b1e1d41f09f45ccd9ae80baee97fff56f5e5e0dfabdce32154c36190c5756b3fb2121e47bb61f5c47aa8d3d9555bc847a03ecada9e2fea6c22a3d32954b8705a6076a4828ac1321cd0368a93b500bfa49ab34a5bf9c0be1aa2c02c9872fbce3a27aef6af3995aa9bcce2904ada7052c90f678f628540a75d9d3470fe6775f9330ad93c9af613f82b5aa25915f555bd7ad2464f9f13a862af7874f33fc2d9de9541dba0a98c48b96c7915b6804496211223b9371f8874af811b94449bcf55f6d6ea3b778739f977b7247af14686313f08c2d778dfd79069042f3d00a5417d7789c0efa2b182effacd7d4356df05ddff1e52f5376c9ff65829da4a4ed9b1d0df3bd498ead6b31b54fedc593df13ff9af1323028f6e70a5db96c1f0ab00b59a669a33f7668401e7324343e741b85f9d68b08b6a6433ad14e2c9497a580a044f66629406268d47f60a2f0083fd010dfe2851db6eb006e884271ed4e6326fd29f56bb057e7cee4089e23efb48f99d8fd4fdb5fb9b5652495898ed65699d337e8ab557365987c0c79c3b68ffd63c9a5daf88f1e936d10d6a7aaf66db4abd1356b282c29039bfef8a4e44645ff91c230f1986dec7bb4d16791f980e163433328651583cca7f24c4554df70eab9401ac5a5529e8772cf41f7e6efc552c06f39eeac214265b408f40e66a251ea5473f6a31e5da2d3d0bc98e83ab32fee43b14b71a1d36db13eb6377a7f49c24fb2eabd7dc1d252672861d7d54092a5a7f0a109f832db7452bf0ab5ddf1da7d057a859ce6930f0deede8b87bc52cf884095c715220e4450cf50c57ea604aa4cb236a406d98526353edb8afe5781910388c4a562f87ba11d933af8db9fa4452c107e0941beed1f54ca0e65d27cb24ab36025dd9be12fa14b0c719e311b33e1d13953943f28e46d25596003325f0b2095d0bd3009152cd09e9688eb85cce9c97809c66dd721415571d75db95b8b04868e6248c928e1ede54ae8dbd6a87ab23ba64f1a67e0ea2d81a67a459e1a904fcab95431b936822538833c2b4c6ea32769a56f7861ce8f3a73de76cabe0a2e9481a9d9298870243107a1b08deb556d73d18ac139bbb584e3b2f5a954a0bebec5676b8b840c97a2dd3f31062ea0d5677ccc04fd4705197d0c2357a1ca3cf83ed4821d70d574d9a4ce0bab1cd909a3a6bc0fa75c85f3c7730200297022d78f7e1b8737e157143f23d778e38ebd88f6201cd17ec92c93b952937cd34dbc31efe5ed6db13b2b2e049b6556c2943066b5e0efe68ee1e4316395c7bab9f1b2c4d90259608678dee434742f5a9665cbc8e7b1cfae20ae109d50d907a1fe5571894a1e0f5bb6c66ced5af116ad05c9bf1c9d5429287642f1e2921631c934f49e30fb4e044101fce8edafd99583051c02b1aa9464065ab6c80b6f018aa45726a94c13165e2dc75a0b499739b7669ce202b9b6af02dad7997afbc971cc9ee41d756f42e756f4b2ee046ce42a9a678f9d9b90f6039e465214db9ec23d057bb6a3d56098bc57322ed56c80e3b5ae5e891baabe3b6ed1266c71f4dc17f80260ef7bd961f1de69dbedeb1dc16569467fb158265a520ec7edc6eadc149200f639e01be0956e46c2b2796f7a368bec2e07cf9258720fd1b06a632bb0c81497aa6335a12fb82318b0683714b9096361da287a1ac7316addbca612bd1ce5bdb9aa548971f0ba207942c336e5437385cc7a1535395e5d18fe532b7c24cfaeac48107b77143f91895faedc989c108dd3c1c77cd5b692df4c3f2fd57a658128169446badc652f4510a5b509d707e6c1108bd2193ad0123f08fcdfc6279db7d27ad88f393dfa9b6e34bb35913d105293dda7570777cff42dda0512fd43cd55f55701ac40e1c53bb63145ce579a93de0220e77598b7e1e03403c025fca1a7373b102e297cc553d9b4eccff07b0f960a650058ffa4216d572edf65bfe4ad1796d356492c4c191608d519177623694af763b77f3027400ebcb5fceb02d7afc06483b3981f85a989cf50a0e463dddb48a09a7cd2a345801eaad36edf1857c4bd08707c6561f3989ce256af8654f49779d15c0995328dd346fae6ea4d4ab19c6388fcc619395d62f16b3e33066c14669752d44a019ee31fa77ae57279462dbe8ccd8413ab7c717e887b6be1a59fa65e5949c5ac35eeed20983e06f6e053e5a7e7a537aa183dd06ebc696c4d1858969c947b12d3918594f2ed1738c25de3abd43f02f4ba1f708c0c15f0ff6bde4624fa2cbaf5deec94a15ce486d64aa54c190e529f3d03bb9bdccf512e034a51fdfd56acf0de64d784c66ed81d8063ffaac8148a91c3d6cce7e3c1a6dc9a06266a62c2b1847afdf0b0bbe9b4b6fee8b76dd84834e9b9a0cceaf6cb157f5572541d31ad0c51583951e6a8a154480abf720ad05fc024c8827f4382b15980acb1c8baf642d28e7de9c2e5235bcef7346577642bef638e735d0fdf22a9b3dc592dacffb42116aa04e8f41108ffbb637b0fe370df40275f776be464c4843f6f9dfe32e18d32679630e5edc3f68c45b9e6499e4bb2636b4f078f469a785f11426e7039a39adaeb6b2b04243d7309cd09726aa043c4cb5c43175af41cfca9327e9098613a8c37e4bce6b6818c46429ef54d2e8bb3c08a8b44d19a15a761167c39978c0faf1320e523bfc8e5c4d6bcd18036f02a28258b1e8f7bb6f400b2b0fa36424b9980e7e8772e6f7b3dd46fa3b5c4a6af2923ae3018a6db8c9a419271157ae834a70ef86c26471aa1266592d8bb597315a850ced8e437717662deabfc7b1934dabffd1a665a352511822374f01878501261ad580de9a5e4c7160efe3954a4104bdbaacd66d6d745e29d272f215679d9343074af8495aa5dacf889ca82cf0c145f73c14c27e0b1dc4a0f39f4d33f02ce7d069aa64a4ae802a657e15c837e9c696c9e92d33c34c758acc1d46dcf49f83cabcafb4ffe53e831344d71906474fb3c88c6b4aa6c1e308d18e9d72ca42417f119ee8ee9090578c08222f30adebe0ad6f2be320229c450e11788f2c80944832077eff5470ac62ccdc806c63383163dcd4f58b0b4ba0621530d3c8903afc822f8a02f355516fb6bd88efbc9d085a4b52074f54e2ddafb0e75c8113b9e8707fbb59d80c00d5b0b635ac64d0324f3f6be93d50395a76bc9b2ac58fb293d740a0b7d2475780195082e1bf20965e51bccb28e767cc46019925493e577c1e8b2e0538cc7b9a3f30250908812dd83f244a0abfc2d516221bbd5ede3af83912b2edac9cb966a44111c4ca9445b9d91fb4e53dbb487280cdd78d8b8d1d58b8b3d2b8aa2f1e0d0ca7246baa824588be47e219ba325d9ab8f1c669868c1255546715bd7e00b2ff9a604c1cb859c718dbe6b6c03c21633fb6bc1509f365ebe46198f4098a444753e70957d78dbd037a1f141d95bb3036a2b7ac02265f120e20579d0008c88987d831d7c10fd1d8c571a3932362e68bb59daab7d49c3d2125a0b320c7f7ae1d3bc38b5c8a92fcca89b6f82521ab09f87c53c93f0f27ebb2c309b13bff6742dbecdfd3910b5eb35699069bdea27aa5c4716b56d6088b377a949d67919aad06351b79a2b0488c06de12e270a430e2dd89833c6a21019497b31ae78605cad9e13c1947e104b15f34764468e2f9da6480fa47b8374ba6b5171cac67f029203b6a3fe2634801ac72ebd7fe7d479c491cf9afecd8bae21591e009ab18fab15d4ab64d7565e4b03a200f605b9af2fd93067ec4f7ee135cdf58397dfabab72919a6ed23f2ccea1a60c48a1dcb69f92acfddcf210e30811acda34d178920c1fb09bd1885ece557b69240aa7257e6395ee44fbc9016f223d799a418a36763e36dd565e2f8299e8c3b472b29454455d0610ca7a51e491ee3aef9cfa00d4219e278ba6add11767ba73aec71f3c732306de96c624416d078eb1e316e74e42a6196d6db25aa30c764c1a745be49bf69513a6febe5ff0e846f5c7f5ff8736360269b5814af9e36618f3c40d1b7c94317ea19d54436c31f8d53a258c14c89fa06f7fbba397a1b53429f39509b2996d73c43c541e5ec6452a6aeaa499ad2bb292f7a9cd3cb4e54c52a8717ea081e99623683571efb680979238b88006e99fe4a5995ada4ea40a3372a9b2f2521aaec7e37d4da6b0e57623596729ac2a8eb51a775841ccbe27a0dee2e1ad8a5867826929f4868a315c3ef7620a4d61d2018cdbcc8ab4d4f1b63506e8fb0536ff352fddfbc42499a2d11864538e05aa2443a911529a5eec56a96ebec7230283b85868da488622dff0d759a14b42d27aa614b8402e78acd6df234eccbef0250ac2e03473955cdf5ba38c2b15fcd711b964383df6f5f1d7101679a033bd210cce6115cc3fd19584bbd031ea71a8a2bcf4b68bc6a8d4dc925193d8711afff60e4aeb675a32200a1d69e34df3e8dbf987641dcd2a32b74a3d560efec217fcc485ff2d5a1b0ce0b9f1eccb6a8d8d70295a8197f9fd2b449bd8922f7dda423c0058f395fa30f43b23b8f87096b3aeaf061e7d6da39c699e527fdfba779974599df73463493c35025bd2066e8dc2af9c6e9fdee376681d1ab99f9c6edcc1164dc0454113d30792957baa8e0569a27475ca30d32c72dcff89a736b63411a35781222fbba67cf575d7e23d0bea239b8f91d", 0x1000}, {&(0x7f00000045c0)="ded29e17c5495e36bc25fb86f90be4b9eb0bbddbe821e8b2bdaec502be12d9e95046a7ae9c393bcb1f1abadbfd5aad63c26dc823c5307e7da90cb84c59b6bfc6b6b26a0516fbd10527e1301e963265bbbd5c849dbdbbb2917c819ee228ea7f161c2a59cd849678b1c3df0f06f1803fbc0025910d7caf13c145effba6ef28c8beeb490411f5a7f8337c55df39673ed57ad048e3ea9e6393ce58bbfc3176625d5186e99d153badf5c80224be7c8a2ab282ff711002ddab69e3e70ccc3df343290e18f0bdf2cbc191ebb43ca25481ded3050dd0c9b85502b8f52ef74535f06405c2aa3c7ad2be055f9220f9d151e38cc82edcb4ab07cc", 0xf5}], 0x2, &(0x7f0000004700)=[{0xb8, 0x103, 0x0, "b876cde19befb339af27e714f699d16d04653d602ded73faab9c1b2ad02905d2b8c88587367103160d1c55b31182cd3c4e2663f1e6d369dda560f2bb57fdf19d5382f2c9b4f6e81494f92a7d82f1444c4457f26844fbdf7bc2f5e44bbdddc706415e6c288b28a5c6684d8de47897ad1a6464af9b7950b073753edd770d16833fdf95f12aeeb17a5b482acdb7bc0fda1bae471e6a4065fb5124706965368a3d363bd630b3c47c"}, {0x40, 0x0, 0x1f, "0b9db7114c2aa840b27e15006b8f54a39c85a6b20c59d0098c98865335ffafc9bec992e98e48948c14"}], 0xf8}, 0x523}, {{&(0x7f0000004800)=@ipx={0x4, 0x800, 0x0, "7f2c0e4d8c68", 0x9}, 0x80, &(0x7f0000004900)=[{&(0x7f0000004880)="a34d912fca7087f452e9eaab5ef41a3669099b8b0101d78f63a9eed011e4d038efd610d759f3db400b10781f7fe166354be120402f17c79e3d5579f8c0444afa0b47c1d75d4a1484121e7315b61264c1f5b1011599729822cd8e161ec877d017eb5b1c3bc67bb7", 0x67}], 0x1, &(0x7f0000004940)=[{0x20, 0x10f, 0x5, "3de6538c6b0ba0bd62e7f4c11201e9d6"}, {0x18, 0x10f, 0x100, "5a22a8"}, {0x58, 0x11f, 0x401, "8ddd8142069ccbf14899bad993eb6656f953f34c93e711722d3e1ff690332fc21009b746a3fe54bd6bb5e6b01935b9735148ccb07bc14f122149b4dab3708a1d0a9d74c67ce3"}, {0x90, 0x0, 0x10000, "6bcf04916997d1244d03cfbada03168e8dbdd86fec664d621478a62a3d98ad5794c090dc2ed46d0d0af45cd45d1cedb61431b72bcca416f1a101a82b13904f22d2854000dc25428ba3af1ea0259fc237c1708f3905c1ef21fea6131336b6d805b8d5de0920fb59b81d37c3929d054cab4849b4a20cb899e5d57d28bb"}, {0xd0, 0x0, 0x1, "193549819b49a47dff1453f370e11f1d238b9e361b2404e7bd3f21162c210b9435160e2c73facd0e189080ef803f130675bbcf0ae3771ca2141ac14fd3668dc47992f88af826011f140c1d61a081300b7ebf8c91a3cf920a84e036854895beb115d8fc4b4ad8da07e634cf9a729a6738d0292dcf90d245f4d6866e2f0dde2bb26dfddb0471b87ee8f3db02e6d6cb96ec7aab974d59a086cb262ebfcf3f3bed7058f5a105b1fe4cdd49f17e612059173064d31dd6c9bdeebeeb64824328d6a1"}, {0x108, 0x117, 0x5830133d, "ed8c7b807a89a84422db2cedb107c093a5324303686557c44c3842dea73ecc58a1bf8a681415902226d34e949edcdc0ff23885b4f189d1d5ab8e00153e037a817319b1f2a0806a9562bb89d494c7b29149e9dadf616d86aa7dddfc6132d2c334349f36c1a699d704de740f6681b1b24e7d975edb7d45d3ba6600b3e21dcc1f3797c257bd3b4165bca73fb4125cfa5fa9cdac22ee6d65b44ea4a4b8684ef5ac64d585cde322eec8044fa4fa837341bce430f61ddeba96b6b283eeec813b6363f071137af7a4b59795dd05a3e53eec2ef63269b2a75ea8eab744e9d4b68e36387716e339422dc4aa88b6ca3306509b3a4a119c1a66"}], 0x2f8}, 0x6}, {{0x0, 0x0, &(0x7f0000005080)=[{&(0x7f0000004c40)="01f609a5b961fa8c92439c488a28b7b4acf1f87ef613529fd7ab14ddb6300440957d6b141fa951ca79d06a7775da8cfed28de87eed5ed5211f847ffa306a8255f10dc71d0529cae32ad37dd7a2906560d600c274f5d6342c2319b302e02896cc88222182ee9bcf836b2cbd9114b339388b98133ebf311b5fb70fc7711115b32df9fc0320a41775631a51e3224adb1c9230c0c90a8171f285c200054cbdb426b0eecf8aecca45790b9ccf73a88c75a7700bd885e11903fa311b3bfe1db31314f3303d2343fc939a8aa09a299f90019cfcb33656ffd7f3899d3f8fbcdf24b8f15b4ece7863743166eb3a8d86d7f35997c4bc810cd5954f", 0xf6}, {&(0x7f0000004d40)="f46091d11a3b1f36ade479d4ea8f6f54", 0x10}, {&(0x7f0000004d80)="7104ff49250fd43558265fd59003fb1a307e03b99b82bd8e6b70bee9ed314b9aa9dc5ec310d4b85884779ef3d02aceb754becc0a60f3e6ffaf5132f3f8e8416db81bce04981ae46973c91f86b44fe79ce2dad18754c48c3df57060dc7046f5e0f0923057602e55648657012647b865ff6fbbf106902d589da6d446ab82dde21505b0f28f3cec3588d495a04639c6e0e43888df9614a4d97afd22f15d1a25bc8f20527bd94237b964cc2cb200b519ad6f0abe476ba53f78bca3c09dd235f9b00e8434c4c642aed4821f7ad86e45069add82adcdbb344bf8adbd1335ef59e7cf71f181b350051c7b9a51e2961b39de313e3f424e432891", 0xf6}, {&(0x7f0000004e80)="b73ee22d60995b14445bf70466a302588e804522d89c9077ac68623a97234f2cfcdcf66b6e099f006f6b31b0ceec7036c919a9a0311a20513713973a27b7f29ab23c497b87f501bda55a0754718f0166f1d64fc5a9656fe69412d0faa2bf9dca6e55b2c9509872c4998e7d784d438350471037888523ab10f5d3c5d4cb43740dd7217bf6b12fdadafbbac49379ac45fc7cf6663001d813808705e39d030a3ab19f78ca1ab69d82759de9b697d618cf51314e1576ce289cb8b6", 0xb9}, {&(0x7f0000004f40)="63b9a8009baf1e2d72aac12243f6d204b87e38edbe2054e2fd6bc1233761bec345ce789994def2bf2828e5b99f40fe7cfe567a1eb098f8f05e338c251732a1208f0845e0cbed33ebac87beb4e7b3591cad7220ddb4e9591e2c7d4c6e28388b3427aaa095f21921e04c782c9213a91c989097fb42b6991c86274d2d57f1cbb900283160a19db5533626080e79e8fbd01847fc4c41b4db4c3ddc18c61cf9c590b439eb63ebf5612bfd69a0d774e5de37dfcfd817c42a43e6b5c46bc9f0c8532a0036dbaef30f30fd68d31fcc886fb9e39a8d24c8ecaccaf1a5c4688499a7061ab77a795b972e6fef4f726f912f4f8c9efd816c7e03d1252d1a01527f", 0xfb}, {&(0x7f0000005040)="3d7a24130e40b10ebf5b6caf192fe80d7e3251c83fff01c1f6d792721a7c144a87ff5c56", 0x24}], 0x6}, 0x4b0}, {{&(0x7f0000005100)=@pppoe={0x18, 0x0, {0x2, @random="616e983654a2", 'hsr0\x00'}}, 0x80, &(0x7f00000054c0)=[{&(0x7f0000005180)="b31eaced53dea1f074d8d9f4d5", 0xd}, {&(0x7f00000051c0)="a34c981c917cfb535999946a16e07a871e53ce3a018032ef7a3a09aac91b6d615e277a29fada5fcfde67913e540e78a5f20355993eaf0a42d0d57bc3834338b8ee3268654851c72c24621e21b604809709acd7372d0b77f1c9f7573b43f26c3b830399fa1884dd4818cf021e0514a020ae54be636b395bf903f8eca611780db9d12f83f371049b06f30a517fbe7a28f545799bc62629f3ae5b8b477bdf4d6e7e3598b5e25625411f8641bd1f37ec5983ee7eb3741719ebc49d8abda7645550e996447f17bf0e02aee24a76", 0xcb}, {&(0x7f00000052c0)="207cb8a7066c4c1636d8de01aba152a1039b9aa30ad892", 0x17}, {&(0x7f0000005300)="65a1b5337f438704f5ce562183fe574fcd2abb26ca85eb2583824649a60afda5ecd89281f57020b2f816f7593ed573ce571117cc57d400ce691bbe905e39e2f0b3c00982435df9602087505fe2991a5e4cdcbd0b5d05a671965137e1bf56e1ac6260dec0a44e316ba39bb9271930052149d2d43efe6aedd9b6352923a556430325f1a1f8d1360b8d1bd07bc58d2c2ef9e1a966fe61bbaebda7d6a2ecbb5c0415fa2b2a4c47ae2d60eff838926d5a006b1f3a079ec173567533229161e21fee84629476aa67d5ae997b9f398d563c0479ff5619d4e3612f4039b3e97c65df6c15c4d3666c9b74864d516a644c9f2fc7e6486f6e3fb283e11222", 0xf9}, {&(0x7f0000005400)="06f31c5090597a07398011f2ea0d129c08e18516f7e70e33375168b41ef621d67eca2295c9f13ec9667b94aa81f0315f788f187cd83da1d280f63216898b8811d65220fbceb3673cd98c3fa3002f2e2f037400809bac8dac907c381119c094b1cd7bcf6e00a35611a86e125a8f423f8ac0604656843c54b331371ad4b73bb74ba315835ebbdd3ceb1f79f2", 0x8b}], 0x5, &(0x7f0000005540)=[{0xb0, 0x103, 0x7, "6b133f976ab596f9759fecfc0d6172e7bb0cd961a1c1fc70e09cc69fd5eb75efad907f671c92585d80e4358624cd3e5cbea2410b60220a59be6d5a10b87bbacfba9dd310329c149a521134841c4802741ee88482dd95f81754b5c1d9700eb07978e4a82d577cd55ed5503b36bbf09aef2db9db79278bbe4337b4f9a277dcd7d45a54a7ff468b9fef69c14a010c57b406461f91d45732d16a38ef69"}], 0xb0}, 0x8}, {{&(0x7f0000005600)=@ethernet={0x307, @local}, 0x80, &(0x7f0000005b40)=[{&(0x7f0000005680)="4f0377e9a173eabe90f8d5270d2bfefc7954b9dedc27da470b08c1287b6d652150e00df017812ddf70e217b025ca9d99bcc92097939396dcd58ce595bd06332f17bd492451ea12ebaf95f62017e3da70d3aa94bf20485c28ec15ce6486c9f97e46b1dec90d9fb8f106f6dc0fba4a48ea1f7d45c0b34af7f2f8de2f367d720135ca3593fcc1eb0ab84c7f77b0e957cff7a27d5b28901bc1954b2efe15b15d36a91db3a0f0a9612c0218da277e402e65c5af00d5d9974129b437e5d2b1bad6d49c39fdc1271209", 0xc6}, {&(0x7f0000005780)="67cb3051a755f6f838b1a11050ac491d1f2657a37d040b53823c2f02407ae5c52d46a5c5c300627189e9a84ed10e0b1c4ecf185c7f539386f33417a505b695534da71f3661866a358eb5fbcbb39667cf1bfec9435dbc5776818d3aefcf12e75aa710a3ad92644c3083175e59cc9f24004660e2d3ba938ed885309c2b3e15860d350474ad3ade71d0e93e405667749e73c06c494112b18dd80f8321fec3498b561b1943640664a60cf3425b021fb97886b8c357df", 0xb4}, {&(0x7f0000005840)="403126b3d30dd93a31839f8f7dd4f73e8a7e67cb1696a3466f97238c334812ad338d9cd41b9c49460677d2d65b6f9a664488c7e0871316c2fc8e7a137b4d8fd7ad6b0caf3b38022624178198508fc2498be78e418e2e9b75ad354b01b676759452b6dbf3ac7072b7a3dc8d80685bf9bfdb0d200f4035dd8f7f173e7a29e20c03d68f726d2a2c660622710491f2cc8d040dffd7dc44fc818bf3299ee356f251205a62489174f33f54ab06d0f86bbb3a942cd1d53439365ab2d6c3695aa5b9ea195376a2a833b0ff718f3936c97093da1a277ba4e701562d168efda37fb2a7002d7448d3dfb44126049648e879", 0xec}, {&(0x7f0000005940)="2be292ed6048d80a5493184494b0", 0xe}, {&(0x7f0000005980)="8619e45adc30fe295b9e68e8217cc307b560c8b94769e9afc617185d95b0030efbd4a2b8b5298152dc66b83b6f0db9e557c84dbd1c77c4355cd5db589f54eee1172251d57f3f051db8d89d355ec338ae55f22bc0fa322afb05534efe0b52c58c7f1ee34f2c99e6e8f525e53558866d1811aedf6b0f6e06bee5a1f13edd9f0416727cfdc9706d38f56aa6967fa88ea7bb03ac6909af54e09eecf422be67c668c701ce26eae5614c36f3bf59ef8babe84a590c0458e1", 0xb5}, {&(0x7f0000005a40)="74d25d737570c68d176801d875b41b20df1c682f1ea51b5ba23c1ff17a41bb1bbf5f529348c426600e5c9249ecb8ec8063361ddae0381236bc2a449e934aa9f52094122bd7319785ac6fcddd305bc064fca4bbf126151758399d783d", 0x5c}, {&(0x7f0000005ac0)="ff70bb803ba2b50b9b8de5fdf4f75ceff6e4ca8bc5977422d4f83a15f92029c7f41248b0f94d219a91f5dbe94c8065031b517518405e04fbfbd55a7e53f439b88cd57c2f7d5eaaaf78e07ba6fecdd46c5c7ea4e3", 0x54}], 0x7, &(0x7f0000005bc0)=[{0xf0, 0x11, 0x4, "567f19b1197e6b34a1a6ad82fa0758b50c35b8784cae7805499e395c85dd872f3484e5ba11cd38665527105ca441b27b05b56d8d734d2a10f4ae900fb51981d7fa6c3fc11065013f3b0034ffb0c953d8df380152c6cf6f2fa29b3778410d52449b371e9791112aa9f2ea14aa4a1de148de8cc3f0445fd6c8335fe539d6466e44e0aa011973cc32596c9904bbb891d29f54fbf08c7de611c6c35781a406138b0e962765ff60aa102e6acfdc46abee25ede439a785f1ce7dd0331631cdff4b24727df4884a3e6d98a2971dcb19c93b462e5d3dfac125385c4c7c23e33c32258b"}, {0x28, 0x116, 0x9, "b9b45b84f363142b3d6551fa21b265d9a834ed68b6"}, {0x28, 0x119, 0x8, "8c23ad9e9f236621bbbd3855212737508c"}, {0x70, 0x13d, 0x79f8, "1d6bf00fdcc4e2a4e80d221a19d505e7bc4752d056d76bad8159046b99c613b68f1391df3c4eff69cc2052741997d21a51e9dfa00f1fcf12be812a403065d485a21e9800e9ae4548af42cd9d4020b9e6ac9e541d599efe7f34d3"}], 0x1b0}, 0x4}, {{&(0x7f0000005d80)=@nfc={0x27, 0x0, 0x1, 0x5}, 0x80, &(0x7f00000061c0)=[{&(0x7f0000005e00)="d9ce2f1326596402edad9fdd2c58591abb2fabedb38f941d06c66cd0a7eecdc1edaa40ad438b3aceb5f5ddde90a87bb9b737a5d5b412632b767fce5ec2616aac14e43b4ef24f269857d0e2f9ecf0c06c8de5f0b63bef8631de22dff31f8df6dad7d8f3d4cfac79080706bd3f4bd69c2c4957ad68fdff5c99ed9eab09c638a6bfc9ea5b34036d31a342c2c846685240eb0575e7df88fa516f1c9c983077", 0x9d}, {&(0x7f0000005ec0)="157d6f", 0x3}, {&(0x7f0000005f00)="9f79c4857dc737ee519d2a44c82b263cd03e9b5662c175fd8bc40b2e56e9e6d16bf284cb74c0ff6cdaa767d4dc4777fa76eea96a1d24dc7b1ddd70de7a", 0x3d}, {&(0x7f0000005f40)="df6a78860e0dbdfaf85e0b1a0435a26022d0821bbc4b5a123be9a00e8e1177611455a65ff07de7794e26f1b2ae6715791f34711d4f3a14a499676d00cae20c4a21a548afb856e55238eba23688cd7034cf9aa57e293dc4c97fc228fb184fd7cd862f5ed0ec67637e1afb7fb339373f7ecd0da91d93397a91f7d3f79b7b181b3a4f31410c8dafcf6539e400c5bd2c7b559d4785d739d37118d5e850bcd5a1f1483dc9319036c9d4e002e205f748992fc5936aff8f3feb29a4846677bf0c1a7492c35cf6d61eade92b45c8f679919ab7ca8e999a76ea566f6cdbb954ae773bc228b54d15ace3866e149dae2b2ce914213bf29329d558ddb56a0b4c74f5e7", 0xfd}, {&(0x7f0000006040)="12188b03888915eb57e2c015c688eeaf16b470604256608e51d0cab99c5d3a0df9e8e338abcfdd394e89e80adbae63ec7bab28c0b0da5d87886df60371309255a98508f7bf6ed3148d48adb5af0cb0aa8a415f2f5c57ab02acd7e9226b5b7cf38cdb6343482bc394e8b655cd33b853c773a5e4da826504c11bf3caaec76091a481babb49fabf91", 0x87}, {&(0x7f0000006100)="02a3892fa7b05856f7addd359d9c26278e417201b7b624533c63b5c97cedd28d1ff69289b35473b449ffeff82a3e8c16c641463ae9555dea3ae2882cdcea11124b67754709fac3a17fd6c93d3be0061da1e94d614730d2959f58b6362d0c9825110117743b1ec1a3ecc1b5a9bf15d366988661ed8252df3555f21cc030f65511c25bd56fb9aaf72fb52334ff7359ef6d602f8f2bc58e28db39ed277a44b22b7c1492e4c2990a4c953f45f921cd68fe5ab73ff3", 0xb3}], 0x6}, 0x7fff}, {{&(0x7f0000006240)=@pppol2tpv3={0x18, 0x1, {0x0, r1, {0x2, 0x4e21, @multicast2}, 0x4, 0x1, 0x4, 0x2}}, 0x80, &(0x7f00000064c0)=[{&(0x7f00000062c0)="ff7d89c4e3deaa1a671d1a05d5586ade52e70ca67916dcd9b1d8f2d80b840e632b3c19b3cd869679c956a106b004c287d687c95e170ee3358751c9d165a0", 0x3e}, {&(0x7f0000006300)="affa88384669573a84d18436665276443a0cca007986b8b6630708ce1b02bdd4bd08aec77f9182592c05ae0d8599a274c507e25e16c9b7e478576dd92c274e03f4e9e2e7a309bd78e8f233228a8a8ac1f7d95ee11f90b215bddfc494de4564b55ccdd0ce7649027c06ee06d3d11d2bb922e5e7f1ca46f55428c351244497e61f6c802b8bcea6ea4f57624122cc68356a162986a15415fd726209d6cf7a36195284a3e62a91a3703d21ce5778af308841d3b213edb071f3204385630bc39da8a3742c718e4a911bb587a648a3ef6cdc8c886693a0924296951346dab5afb5f167c0de1017a9a8318336e1e998795723f173e9cf63d93640040bb5d1", 0xfb}, {&(0x7f0000006400)="c533ad71ebc9728ad6c262b40c1991640d7bb204c8bcf09a31cadf68ac079c6b13913805ba91600a2b3a701e50038eadd76987c0ac38f62741dbb023b38b422335c99b5448545fcd80db38b4bb22a3a814219014df7470575e302d32f1231ab5c917d8be1aa51b08e61000f8c14cc0ba3075c8a83446158044c61e86c5cf100cfe32d6c3cf34531176c8eac81b075a71a47f457d8242000ac5abf24323f7cc8b7d09d0afb0e88fd668dda8b7fbf28f", 0xaf}], 0x3}, 0x3}], 0x9, 0x0)

[  379.590281] binder: BINDER_SET_CONTEXT_MGR already set
[  379.634178] binder: 17301:17302 ioctl 40046207 0 returned -16
05:02:30 executing program 3:
recvmmsg(0xffffffffffffffff, &(0x7f0000003140)=[{{&(0x7f0000001400)=@ipx, 0x80, 0x0}}], 0x1, 0x0, 0x0)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = syz_open_procfs(0x0, &(0x7f00000004c0)='net/rt_cache\x00')
preadv(r0, &(0x7f00000017c0), 0xa6, 0x0)

05:02:30 executing program 0:
recvmmsg(0xffffffffffffffff, &(0x7f0000003140)=[{{&(0x7f0000001400)=@ipx, 0x80, 0x0}}], 0x1, 0x0, 0x0)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = syz_open_procfs(0x0, &(0x7f00000004c0)='net/rt_cache\x00')
preadv(r0, &(0x7f00000017c0), 0xa0, 0x0)

[  379.692961] binder: 17301:17302 Release 1 refcount change on invalid ref 1 ret -22
05:02:30 executing program 1:
r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000200)='/dev/nullb0\x00', 0x5000000084002, 0x0)
mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x200000e, 0x13, r0, 0x0)
r1 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x4000, 0x0)
preadv(r1, &(0x7f0000000040)=[{&(0x7f0000000400)=""/4096, 0x3ffc0e}], 0x1, 0x0)

[  380.150821] netlink: 8 bytes leftover after parsing attributes in process `syz-executor.5'.
05:02:30 executing program 3:
recvmmsg(0xffffffffffffffff, &(0x7f0000003140)=[{{&(0x7f0000001400)=@ipx, 0x80, 0x0}}], 0x1, 0x0, 0x0)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = syz_open_procfs(0x0, &(0x7f00000004c0)='net/rt_cache\x00')
preadv(r0, &(0x7f00000017c0), 0xa7, 0x0)

05:02:30 executing program 4:
r0 = socket$inet_udplite(0x2, 0x2, 0x88)
ioctl(r0, 0x1000008912, &(0x7f0000000080)="0adcff1bfb7d728b860850d470")
r1 = socket$inet6(0xa, 0x6, 0x0)
setsockopt$inet6_opts(r1, 0x29, 0x3b, &(0x7f0000000140)=@dstopts, 0x8)
connect$inet6(r1, &(0x7f00000020c0)={0xa, 0x0, 0x0, @loopback}, 0x1c)

[  380.264140] binder: release 17301:17302 transaction 582 out, still active
05:02:30 executing program 2:
r0 = syz_open_dev$sndtimer(&(0x7f0000026000)='/dev/snd/timer\x00', 0x0, 0x0)
r1 = dup3(r0, r0, 0x80000)
ioctl$UI_GET_SYSNAME(r1, 0x8040552c, 0x0)
perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8)
r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c)
bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r2, &(0x7f0000000040), 0x0, 0x1}, 0x20)
openat$cgroup_ro(0xffffffffffffffff, &(0x7f00000004c0)='cpuset.effective_cpus\x00', 0x0, 0x0)
unlink(&(0x7f0000000900)='./file0/file0\x00')
r3 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r4 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r4, 0x0)
ioctl$BINDER_GET_NODE_DEBUG_INFO(r3, 0xc018620b, &(0x7f0000000780))
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f00000000c0)=[@enter_looper], 0x48, 0x0, &(0x7f0000000700)="2ba063fb309ec7fdbfb08e6e91baee7d7d4599fe14129a4d426834556ae420e087d59c0c7be7fcad1abb7e1f8f446f373f611ca1ee9c2231708e18a47bc68a2a79a0b48931f6ff6d"})
ioctl$sock_inet_tcp_SIOCOUTQNSD(r1, 0x894b, &(0x7f0000000480))
getsockopt$inet_IP_IPSEC_POLICY(0xffffffffffffffff, 0x0, 0x10, &(0x7f0000000540)={{{@in6, @in=@remote}}, {{@in6=@ipv4={[], [], @local}}, 0x0, @in6}}, &(0x7f0000000000)=0xe8)
ioctl$BINDER_SET_CONTEXT_MGR(r4, 0x40046207, 0x0)
r5 = dup(r4)
shutdown(r5, 0x1)
prctl$PR_SET_NAME(0xf, &(0x7f0000000380)='/group.stat\x00')
syz_open_dev$binder(&(0x7f0000000880)='/dev/binder#\x00', 0x0, 0x2)
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)})
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, &(0x7f0000000780)})
ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f0000000680)})
creat(&(0x7f00000000c0)='./file0\x00', 0x0)
openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000100)='/group.stat\x00', 0x2761, 0x0)
clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000080), 0xffffffffffffffff)
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000003c0)={0x14, 0x0, &(0x7f0000000680)=[@acquire_done], 0x0, 0x0, 0x0})

05:02:30 executing program 0:
recvmmsg(0xffffffffffffffff, &(0x7f0000003140)=[{{&(0x7f0000001400)=@ipx, 0x80, 0x0}}], 0x1, 0x0, 0x0)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = syz_open_procfs(0x0, &(0x7f00000004c0)='net/rt_cache\x00')
preadv(r0, &(0x7f00000017c0), 0xa1, 0x0)

05:02:30 executing program 1:
r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000200)='/dev/nullb0\x00', 0x5000000084002, 0x0)
mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x200000e, 0x13, r0, 0x0)
r1 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x4000, 0x0)
preadv(r1, &(0x7f0000000040)=[{&(0x7f0000000400)=""/4096, 0x3ffc0f}], 0x1, 0x0)

05:02:30 executing program 5:
r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = memfd_create(0x0, 0x0)
ioctl$SG_EMULATED_HOST(r1, 0x2203, &(0x7f00000002c0))
lseek(0xffffffffffffffff, 0x0, 0x0)
mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x7, 0x31, 0xffffffffffffffff, 0x0)
remap_file_pages(&(0x7f00002ec000/0x200000)=nil, 0x200000, 0x0, 0x0, 0x0)
getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(0xffffffffffffffff, 0x84, 0x6f, &(0x7f0000000000)={0x0, 0x0, 0x0}, &(0x7f0000000080)=0x10)
ioctl$sock_inet6_udp_SIOCOUTQ(0xffffffffffffffff, 0x5411, 0x0)
mbind(&(0x7f0000012000/0xc00000)=nil, 0xc00010, 0x1, &(0x7f00000000c0), 0x1, 0x2000000000002)
fcntl$setpipe(r1, 0x407, 0x2)
ioctl$TIOCMGET(0xffffffffffffffff, 0x5415, 0x0)
fdatasync(r0)
getsockopt$inet_dccp_buf(r0, 0x21, 0xf, &(0x7f0000000300)=""/232, &(0x7f0000000180)=0xe8)
bpf$BPF_GET_PROG_INFO(0xf, &(0x7f0000000040)={0xffffffffffffffff, 0x50, &(0x7f0000000100)}, 0x10)
setsockopt$inet6_buf(0xffffffffffffffff, 0x29, 0x2a, &(0x7f0000000400)="91d4e84d2cbea06e0400000040000000d443be9ba6a2c9963cc96d913308d12eb358314d7898027c71c740d55b3fad6d2b8689f2cad23b98c7b576df405bc490d175e3cfa6e8ef53e82459abb77b2d3f49c43bae092682c3ef33b30534fb7a95b5d4b672274fed9aa3ef516a5c", 0x6d)
rseq(&(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={0x0, 0x3, 0x5, 0x0, 0xaaa}, 0x2}, 0x20, 0x0, 0x0)

05:02:30 executing program 4:
r0 = syz_open_dev$sndtimer(&(0x7f0000026000)='/dev/snd/timer\x00', 0x0, 0x0)
r1 = dup3(r0, r0, 0x80000)
ioctl$UI_GET_SYSNAME(r1, 0x8040552c, 0x0)
perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8)
r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c)
bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r2, &(0x7f0000000040), 0x0}, 0x20)
openat$cgroup_ro(r1, &(0x7f00000004c0)='cpuset.effective_cpus\x00', 0x0, 0x0)
unlink(&(0x7f0000000900)='./file0/file0\x00')
r3 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r4 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r4, 0x0)
ioctl$BINDER_GET_NODE_DEBUG_INFO(r3, 0xc018620b, &(0x7f0000000780))
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f00000000c0)=[@enter_looper], 0x48, 0x0, &(0x7f0000000700)="2ba063fb309ec7fdbfb08e6e91baee7d7d4599fe14129a4d426834556ae420e087d59c0c7be7fcad1abb7e1f8f446f373f611ca1ee9c2231708e18a47bc68a2a79a0b48931f6ff6d"})
ioctl$sock_inet_tcp_SIOCOUTQNSD(r1, 0x894b, &(0x7f0000000480))
getsockopt$inet_IP_IPSEC_POLICY(0xffffffffffffffff, 0x0, 0x10, &(0x7f0000000540)={{{@in6, @in=@remote}}, {{@in6=@ipv4={[], [], @local}}, 0x0, @in6}}, &(0x7f0000000000)=0xe8)
ioctl$BINDER_SET_CONTEXT_MGR(r4, 0x40046207, 0x0)
r5 = dup(r4)
shutdown(r5, 0x1)
prctl$PR_SET_NAME(0xf, &(0x7f0000000380)='/group.stat\x00')
syz_open_dev$binder(&(0x7f0000000880)='/dev/binder#\x00', 0x0, 0x2)
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)})
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, &(0x7f0000000780)})
ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f0000000680)})
creat(&(0x7f00000000c0)='./file0\x00', 0x0)
openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000100)='/group.stat\x00', 0x2761, 0x0)
clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000080), 0xffffffffffffffff)
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000003c0)={0x14, 0x0, &(0x7f0000000680)=[@acquire_done], 0x0, 0x0, 0x0})

05:02:30 executing program 0:
recvmmsg(0xffffffffffffffff, &(0x7f0000003140)=[{{&(0x7f0000001400)=@ipx, 0x80, 0x0}}], 0x1, 0x0, 0x0)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = syz_open_procfs(0x0, &(0x7f00000004c0)='net/rt_cache\x00')
preadv(r0, &(0x7f00000017c0), 0xa2, 0x0)

05:02:30 executing program 3:
recvmmsg(0xffffffffffffffff, &(0x7f0000003140)=[{{&(0x7f0000001400)=@ipx, 0x80, 0x0}}], 0x1, 0x0, 0x0)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = syz_open_procfs(0x0, &(0x7f00000004c0)='net/rt_cache\x00')
preadv(r0, &(0x7f00000017c0), 0xa8, 0x0)

[  380.433889] binder: 17362 RLIMIT_NICE not set
05:02:30 executing program 1:
r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000200)='/dev/nullb0\x00', 0x5000000084002, 0x0)
mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x200000e, 0x13, r0, 0x0)
r1 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x4000, 0x0)
preadv(r1, &(0x7f0000000040)=[{&(0x7f0000000400)=""/4096, 0x3ffc10}], 0x1, 0x0)

[  380.494511] binder: BINDER_SET_CONTEXT_MGR already set
[  380.499828] binder: 17361:17369 ioctl 40046207 0 returned -16
[  380.618080] binder: 17368 RLIMIT_NICE not set
05:02:31 executing program 3:
recvmmsg(0xffffffffffffffff, &(0x7f0000003140)=[{{&(0x7f0000001400)=@ipx, 0x80, 0x0}}], 0x1, 0x0, 0x0)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = syz_open_procfs(0x0, &(0x7f00000004c0)='net/rt_cache\x00')
preadv(r0, &(0x7f00000017c0), 0xa9, 0x0)

[  380.649174] binder: BINDER_SET_CONTEXT_MGR already set
05:02:31 executing program 0:
recvmmsg(0xffffffffffffffff, &(0x7f0000003140)=[{{&(0x7f0000001400)=@ipx, 0x80, 0x0}}], 0x1, 0x0, 0x0)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = syz_open_procfs(0x0, &(0x7f00000004c0)='net/rt_cache\x00')
preadv(r0, &(0x7f00000017c0), 0xa3, 0x0)

05:02:31 executing program 1:
r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000200)='/dev/nullb0\x00', 0x5000000084002, 0x0)
mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x200000e, 0x13, r0, 0x0)
r1 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x4000, 0x0)
preadv(r1, &(0x7f0000000040)=[{&(0x7f0000000400)=""/4096, 0x3ffc11}], 0x1, 0x0)

[  380.716644] binder: 17361:17369 Release 1 refcount change on invalid ref 1 ret -22
[  380.717421] binder: 17367:17387 Release 1 refcount change on invalid ref 1 ret -22
[  380.733329] binder: 17367:17384 ioctl 40046207 0 returned -16
05:02:31 executing program 3:
recvmmsg(0xffffffffffffffff, &(0x7f0000003140)=[{{&(0x7f0000001400)=@ipx, 0x80, 0x0}}], 0x1, 0x0, 0x0)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = syz_open_procfs(0x0, &(0x7f00000004c0)='net/rt_cache\x00')
preadv(r0, &(0x7f00000017c0), 0xaa, 0x0)

[  381.185952] binder: release 17361:17369 transaction 585 out, still active
[  381.293544] binder: release 17367:17387 transaction 588 out, still active
05:02:31 executing program 2:
r0 = syz_open_dev$sndtimer(&(0x7f0000026000)='/dev/snd/timer\x00', 0x0, 0x0)
r1 = dup3(r0, r0, 0x80000)
ioctl$UI_GET_SYSNAME(r1, 0x8040552c, 0x0)
perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8)
r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c)
bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r2, &(0x7f0000000040), 0x0, 0x1}, 0x20)
openat$cgroup_ro(0xffffffffffffffff, &(0x7f00000004c0)='cpuset.effective_cpus\x00', 0x0, 0x0)
unlink(&(0x7f0000000900)='./file0/file0\x00')
r3 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r4 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r4, 0x0)
ioctl$BINDER_GET_NODE_DEBUG_INFO(r3, 0xc018620b, &(0x7f0000000780))
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f00000000c0)=[@enter_looper], 0x48, 0x0, &(0x7f0000000700)="2ba063fb309ec7fdbfb08e6e91baee7d7d4599fe14129a4d426834556ae420e087d59c0c7be7fcad1abb7e1f8f446f373f611ca1ee9c2231708e18a47bc68a2a79a0b48931f6ff6d"})
ioctl$sock_inet_tcp_SIOCOUTQNSD(r1, 0x894b, &(0x7f0000000480))
getsockopt$inet_IP_IPSEC_POLICY(0xffffffffffffffff, 0x0, 0x10, &(0x7f0000000540)={{{@in6, @in=@remote}}, {{@in6=@ipv4={[], [], @local}}, 0x0, @in6}}, &(0x7f0000000000)=0xe8)
ioctl$BINDER_SET_CONTEXT_MGR(r4, 0x40046207, 0x0)
r5 = dup(r4)
shutdown(r5, 0x1)
prctl$PR_SET_NAME(0xf, &(0x7f0000000380)='/group.stat\x00')
syz_open_dev$binder(&(0x7f0000000880)='/dev/binder#\x00', 0x0, 0x2)
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)})
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, &(0x7f0000000780)})
ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f0000000680)})
creat(&(0x7f00000000c0)='./file0\x00', 0x0)
openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000100)='/group.stat\x00', 0x2761, 0x0)
clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000080), 0xffffffffffffffff)
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000003c0)={0x14, 0x0, &(0x7f0000000680)=[@acquire_done], 0x0, 0x0, 0x0})

05:02:31 executing program 0:
recvmmsg(0xffffffffffffffff, &(0x7f0000003140)=[{{&(0x7f0000001400)=@ipx, 0x80, 0x0}}], 0x1, 0x0, 0x0)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = syz_open_procfs(0x0, &(0x7f00000004c0)='net/rt_cache\x00')
preadv(r0, &(0x7f00000017c0), 0xa4, 0x0)

05:02:31 executing program 1:
r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000200)='/dev/nullb0\x00', 0x5000000084002, 0x0)
mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x200000e, 0x13, r0, 0x0)
r1 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x4000, 0x0)
preadv(r1, &(0x7f0000000040)=[{&(0x7f0000000400)=""/4096, 0x3ffc12}], 0x1, 0x0)

[  381.512283] binder: 17418 RLIMIT_NICE not set
[  381.558045] binder: BINDER_SET_CONTEXT_MGR already set
[  381.563370] binder: 17417:17422 ioctl 40046207 0 returned -16
[  381.601828] binder: 17417:17422 Release 1 refcount change on invalid ref 1 ret -22
05:02:32 executing program 5:
r0 = socket$inet_udplite(0x2, 0x2, 0x88)
ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f3188b070")
r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000)='/dev/kvm\x00', 0x0, 0x0)
socket$inet_dccp(0x2, 0x6, 0x0)
r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0)
ioctl$KVM_SET_CLOCK(r2, 0x4030ae7b, &(0x7f0000000040)={0xc1, 0x6})
r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0)
ioctl$KVM_ENABLE_CAP_CPU(r3, 0xc008ae88, &(0x7f0000000100)={0x7e, 0x600000000000000, [0xc0000103], [0xc2]})

05:02:32 executing program 3:
recvmmsg(0xffffffffffffffff, &(0x7f0000003140)=[{{&(0x7f0000001400)=@ipx, 0x80, 0x0}}], 0x1, 0x0, 0x0)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = syz_open_procfs(0x0, &(0x7f00000004c0)='net/rt_cache\x00')
preadv(r0, &(0x7f00000017c0), 0xab, 0x0)

05:02:32 executing program 4:
r0 = syz_open_dev$sndtimer(&(0x7f0000026000)='/dev/snd/timer\x00', 0x0, 0x0)
r1 = dup3(r0, r0, 0x80000)
ioctl$UI_GET_SYSNAME(r1, 0x8040552c, 0x0)
perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8)
r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c)
bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r2, &(0x7f0000000040), 0x0}, 0x20)
openat$cgroup_ro(r1, &(0x7f00000004c0)='cpuset.effective_cpus\x00', 0x0, 0x0)
unlink(&(0x7f0000000900)='./file0/file0\x00')
r3 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r4 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r4, 0x0)
ioctl$BINDER_GET_NODE_DEBUG_INFO(r3, 0xc018620b, &(0x7f0000000780))
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f00000000c0)=[@enter_looper], 0x48, 0x0, &(0x7f0000000700)="2ba063fb309ec7fdbfb08e6e91baee7d7d4599fe14129a4d426834556ae420e087d59c0c7be7fcad1abb7e1f8f446f373f611ca1ee9c2231708e18a47bc68a2a79a0b48931f6ff6d"})
ioctl$sock_inet_tcp_SIOCOUTQNSD(r1, 0x894b, &(0x7f0000000480))
getsockopt$inet_IP_IPSEC_POLICY(0xffffffffffffffff, 0x0, 0x10, &(0x7f0000000540)={{{@in6, @in=@remote}}, {{@in6=@ipv4={[], [], @local}}, 0x0, @in6}}, &(0x7f0000000000)=0xe8)
ioctl$BINDER_SET_CONTEXT_MGR(r4, 0x40046207, 0x0)
r5 = dup(r4)
shutdown(r5, 0x1)
prctl$PR_SET_NAME(0xf, &(0x7f0000000380)='/group.stat\x00')
syz_open_dev$binder(&(0x7f0000000880)='/dev/binder#\x00', 0x0, 0x2)
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)})
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, &(0x7f0000000780)})
ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f0000000680)})
creat(&(0x7f00000000c0)='./file0\x00', 0x0)
openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000100)='/group.stat\x00', 0x2761, 0x0)
clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000080), 0xffffffffffffffff)
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000003c0)={0x14, 0x0, &(0x7f0000000680)=[@acquire_done], 0x0, 0x0, 0x0})

05:02:32 executing program 1:
r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000200)='/dev/nullb0\x00', 0x5000000084002, 0x0)
mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x200000e, 0x13, r0, 0x0)
r1 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x4000, 0x0)
preadv(r1, &(0x7f0000000040)=[{&(0x7f0000000400)=""/4096, 0x3ffc13}], 0x1, 0x0)

05:02:32 executing program 0:
recvmmsg(0xffffffffffffffff, &(0x7f0000003140)=[{{&(0x7f0000001400)=@ipx, 0x80, 0x0}}], 0x1, 0x0, 0x0)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = syz_open_procfs(0x0, &(0x7f00000004c0)='net/rt_cache\x00')
preadv(r0, &(0x7f00000017c0), 0xa5, 0x0)

05:02:32 executing program 3:
recvmmsg(0xffffffffffffffff, &(0x7f0000003140)=[{{&(0x7f0000001400)=@ipx, 0x80, 0x0}}], 0x1, 0x0, 0x0)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = syz_open_procfs(0x0, &(0x7f00000004c0)='net/rt_cache\x00')
preadv(r0, &(0x7f00000017c0), 0xac, 0x0)

05:02:32 executing program 0:
recvmmsg(0xffffffffffffffff, &(0x7f0000003140)=[{{&(0x7f0000001400)=@ipx, 0x80, 0x0}}], 0x1, 0x0, 0x0)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = syz_open_procfs(0x0, &(0x7f00000004c0)='net/rt_cache\x00')
preadv(r0, &(0x7f00000017c0), 0xa6, 0x0)

05:02:32 executing program 1:
r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000200)='/dev/nullb0\x00', 0x5000000084002, 0x0)
mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x200000e, 0x13, r0, 0x0)
r1 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x4000, 0x0)
preadv(r1, &(0x7f0000000040)=[{&(0x7f0000000400)=""/4096, 0x3ffc14}], 0x1, 0x0)

[  382.255053] binder: 17433 RLIMIT_NICE not set
[  382.263945] binder: release 17417:17422 transaction 591 out, still active
[  382.292156] binder: BINDER_SET_CONTEXT_MGR already set
[  382.297701] binder: 17425:17443 ioctl 40046207 0 returned -16
05:02:32 executing program 2:
r0 = syz_open_dev$sndtimer(&(0x7f0000026000)='/dev/snd/timer\x00', 0x0, 0x0)
r1 = dup3(r0, r0, 0x80000)
ioctl$UI_GET_SYSNAME(r1, 0x8040552c, 0x0)
perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8)
r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c)
bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r2, &(0x7f0000000040), 0x0, 0x1}, 0x20)
openat$cgroup_ro(0xffffffffffffffff, &(0x7f00000004c0)='cpuset.effective_cpus\x00', 0x0, 0x0)
unlink(&(0x7f0000000900)='./file0/file0\x00')
r3 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r4 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r4, 0x0)
ioctl$BINDER_GET_NODE_DEBUG_INFO(r3, 0xc018620b, &(0x7f0000000780))
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f00000000c0)=[@enter_looper], 0x48, 0x0, &(0x7f0000000700)="2ba063fb309ec7fdbfb08e6e91baee7d7d4599fe14129a4d426834556ae420e087d59c0c7be7fcad1abb7e1f8f446f373f611ca1ee9c2231708e18a47bc68a2a79a0b48931f6ff6d"})
ioctl$sock_inet_tcp_SIOCOUTQNSD(r1, 0x894b, &(0x7f0000000480))
getsockopt$inet_IP_IPSEC_POLICY(0xffffffffffffffff, 0x0, 0x10, &(0x7f0000000540)={{{@in6, @in=@remote}}, {{@in6=@ipv4={[], [], @local}}, 0x0, @in6}}, &(0x7f0000000000)=0xe8)
ioctl$BINDER_SET_CONTEXT_MGR(r4, 0x40046207, 0x0)
r5 = dup(r4)
shutdown(r5, 0x1)
prctl$PR_SET_NAME(0xf, &(0x7f0000000380)='/group.stat\x00')
syz_open_dev$binder(&(0x7f0000000880)='/dev/binder#\x00', 0x0, 0x2)
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)})
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, &(0x7f0000000780)})
ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f0000000680)})
creat(&(0x7f00000000c0)='./file0\x00', 0x0)
openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000100)='/group.stat\x00', 0x2761, 0x0)
clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000080), 0xffffffffffffffff)
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000003c0)={0x14, 0x0, &(0x7f0000000680)=[@acquire_done], 0x0, 0x0, 0x0})

[  382.372083] binder: 17425:17443 Release 1 refcount change on invalid ref 1 ret -22
05:02:32 executing program 0:
recvmmsg(0xffffffffffffffff, &(0x7f0000003140)=[{{&(0x7f0000001400)=@ipx, 0x80, 0x0}}], 0x1, 0x0, 0x0)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = syz_open_procfs(0x0, &(0x7f00000004c0)='net/rt_cache\x00')
preadv(r0, &(0x7f00000017c0), 0xa7, 0x0)

05:02:32 executing program 3:
recvmmsg(0xffffffffffffffff, &(0x7f0000003140)=[{{&(0x7f0000001400)=@ipx, 0x80, 0x0}}], 0x1, 0x0, 0x0)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = syz_open_procfs(0x0, &(0x7f00000004c0)='net/rt_cache\x00')
preadv(r0, &(0x7f00000017c0), 0xad, 0x0)

05:02:32 executing program 5:
r0 = socket$inet_udplite(0x2, 0x2, 0x88)
r1 = socket(0x10, 0x3, 0x0)
ioctl$sock_SIOCGSKNS(r0, 0x894c, 0x0)
write(r1, &(0x7f0000000000)="240000005a001f001007f4f9002304000a04f51108000400020100020800038005000000", 0x24)
r2 = syz_genetlink_get_family_id$SEG6(&(0x7f0000000080)='SEG6\x00')
sendmsg$SEG6_CMD_SETHMAC(r1, &(0x7f00000001c0)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x400}, 0xc, &(0x7f0000000180)={&(0x7f00000000c0)={0x84, r2, 0x400, 0x70bd25, 0x25dfdbfe, {}, [@SEG6_ATTR_DST={0x14, 0x1, @empty}, @SEG6_ATTR_ALGID={0x8, 0x6, 0x3}, @SEG6_ATTR_DST={0x14, 0x1, @mcast2}, @SEG6_ATTR_SECRET={0x10, 0x4, [0x100000001, 0x80000000, 0x3]}, @SEG6_ATTR_SECRETLEN={0x8, 0x5, 0x1}, @SEG6_ATTR_SECRET={0x8, 0x4, [0x20]}, @SEG6_ATTR_HMACKEYID={0x8, 0x3, 0x400}, @SEG6_ATTR_HMACKEYID={0x8, 0x3, 0x8}, @SEG6_ATTR_ALGID={0x8, 0x6, 0x7fffffff}, @SEG6_ATTR_DSTLEN={0x8, 0x2, 0xff}]}, 0x84}, 0x1, 0x0, 0x0, 0x80}, 0x1)

[  382.475876] binder: 17458 RLIMIT_NICE not set
05:02:32 executing program 1:
r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000200)='/dev/nullb0\x00', 0x5000000084002, 0x0)
mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x200000e, 0x13, r0, 0x0)
r1 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x4000, 0x0)
preadv(r1, &(0x7f0000000040)=[{&(0x7f0000000400)=""/4096, 0x3ffc15}], 0x1, 0x0)

[  382.526903] binder: BINDER_SET_CONTEXT_MGR already set
[  382.556945] binder: 17456:17464 ioctl 40046207 0 returned -16
[  382.574425] binder: 17456:17469 Release 1 refcount change on invalid ref 1 ret -22
05:02:33 executing program 5:
r0 = syz_open_dev$vcsn(&(0x7f0000000000)='/dev/vcs#\x00', 0x9, 0x0)
setsockopt$inet6_MCAST_LEAVE_GROUP(r0, 0x29, 0x2d, &(0x7f0000000040)={0x9, {{0xa, 0x4e23, 0x6, @initdev={0xfe, 0x88, [], 0x1, 0x0}, 0x5}}}, 0x88)
getsockopt$inet6_IPV6_XFRM_POLICY(r0, 0x29, 0x23, &(0x7f0000000100)={{{@in=@empty, @in=@loopback}}, {{@in=@remote}, 0x0, @in=@local}}, &(0x7f0000000200)=0xe8)
ioctl$KDGKBSENT(r0, 0x4b48, &(0x7f0000000240)={0x40, 0x4, 0x2b2})
fsetxattr$security_capability(r0, &(0x7f0000000280)='security.capability\x00', &(0x7f00000002c0)=@v1={0x1000000, [{0x80000000}]}, 0xc, 0x3)
getsockopt$inet_sctp_SCTP_AUTH_ACTIVE_KEY(r0, 0x84, 0x18, &(0x7f0000000300)={<r1=>0x0, 0x7}, &(0x7f0000000340)=0x8)
setsockopt$inet_sctp6_SCTP_DEFAULT_SEND_PARAM(r0, 0x84, 0xa, &(0x7f0000000380)={0x71, 0x1, 0x8000, 0x3, 0x10000, 0x3, 0x80000001, 0x800, r1}, 0x20)
r2 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f00000003c0)='/dev/ubi_ctrl\x00', 0x400000, 0x0)
r3 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000400)='/dev/mixer\x00', 0x0, 0x0)
setsockopt$inet6_MCAST_MSFILTER(r2, 0x29, 0x30, &(0x7f0000000440)={0xcb2, {{0xa, 0x4e20, 0x3, @ipv4={[], [], @dev={0xac, 0x14, 0x14, 0x2a}}, 0x800}}, 0x1, 0x3, [{{0xa, 0x4e20, 0x4, @mcast1, 0x101}}, {{0xa, 0x4e23, 0x0, @mcast1, 0x3}}, {{0xa, 0x4e24, 0x3, @loopback, 0x7}}]}, 0x210)
ioctl$UI_ABS_SETUP(r0, 0x401c5504, &(0x7f0000000680)={0x4, {0x9, 0x7fffffff, 0x4ad2, 0xbf, 0x80000001, 0x4}})
ioctl$RTC_VL_READ(r2, 0x80047013, &(0x7f00000006c0))
bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000900)={&(0x7f0000000700)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0xd0, 0xe8, 0x82, {"ec9b013e3c1d4980fab7e6e0f7aed7873784af7b4e82b92652fd96f107512e3391183da93c6771a48f1d03cafa4e3bd2a31a8e998bed34f07c2894d3cf5de145c79b4db20cf0c7959f7afd7b6d872a446040d8450554d7ebf1a8e5eb39f8c94997ab4dd4caec7d9054bee8d65d651cab3ed8ddc8e33f61f97f3c9460b8102b5b91aa9a3399b000d714c0fc7508ea817102395df833af5addd645d515ca588c375d5d448075eafd923c8303fd18d06f98688d9eedb85aca729c35080faf796a7c1501ce4b25820307d6a2984c214d"}}, {0x0, "6c07bfeb69e5dca07c7d5b65f3f79474f3c17c633678293373452f40fba8861d30d7d7a9828bb215c45274dcf36b5526088176c6850eb8dc6d25cde4f1c3a499d7d4c2e0812df4e89f7d81a818b7bfc437af1983d43efbede93421589a93cd548d512efe4b2b62ab78c29000aa41cf8313cc9c18c86483916b238df36fcdd59a7760ef7ba8a5c64d707018009b79906fa91653acf40572d9074df96263fa619399a644c5f4051ebdc66958b44e40d58434845211db"}}, &(0x7f00000008c0)=""/39, 0x19f, 0x27}, 0x20)
openat$selinux_attr(0xffffffffffffff9c, &(0x7f0000000940)='/proc/self/attr/sockcreate\x00', 0x2, 0x0)
getsockopt$inet_sctp6_SCTP_DEFAULT_SEND_PARAM(r3, 0x84, 0xa, &(0x7f0000000980)={0x4, 0xd1, 0x2, 0x3f, 0x80000001, 0x80, 0x81, 0x7, <r4=>r1}, &(0x7f00000009c0)=0x20)
bind$unix(r3, &(0x7f0000000a00)=@abs={0x1, 0x0, 0x4e24}, 0x6e)
ioctl$KVM_S390_INTERRUPT_CPU(r3, 0x4010ae94, &(0x7f0000000a80)={0x8, 0x7ff, 0x5})
ioctl$VIDIOC_G_INPUT(r2, 0x80045626, &(0x7f0000000ac0))
ioctl$TUNSETQUEUE(r3, 0x400454d9, &(0x7f0000000b00)={'\x00', 0x600})
setsockopt$inet_opts(r2, 0x0, 0x9, &(0x7f0000000b40)="55115d8f726a3d7b3beb4e5af6a419cfa0d33724a17b6b56b2efe2a954fe11a1d37b5041abf6b4d55446c0f1dd9005cf65c6094d169b9cc235799e2c98f125c00557500faf7200c7f45892a12ead2bc5d79d3f00b4912df2acd74f802d66a9aedbc93452038912789ec31edefe105f5f505be98fdfe873bea656d549464feb3ed240a1231e78169f2c902a", 0x8b)
ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0)
ioctl$TUNSETLINK(r2, 0x400454cd, 0x337)
setsockopt$inet6_MRT6_DEL_MFC_PROXY(r2, 0x29, 0xd3, &(0x7f0000000c00)={{0xa, 0x4e22, 0x1, @initdev={0xfe, 0x88, [], 0x0, 0x0}, 0xc1b6}, {0xa, 0x4e21, 0x4, @dev={0xfe, 0x80, [], 0x1d}, 0x9}, 0x2, [0x400000, 0x3ff, 0xfffffffffffffffb, 0x6, 0x2, 0x1, 0x4, 0x1]}, 0x5c)
setsockopt$inet_sctp_SCTP_DEFAULT_PRINFO(r0, 0x84, 0x72, &(0x7f0000000c80)={r4, 0x100000001, 0x30}, 0xc)
r5 = syz_genetlink_get_family_id$tipc(&(0x7f0000000d00)='TIPC\x00')
sendmsg$TIPC_CMD_ENABLE_BEARER(r0, &(0x7f0000000dc0)={&(0x7f0000000cc0)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000d80)={&(0x7f0000000d40)={0x34, r5, 0x0, 0x70bd25, 0x25dfdbff, {{}, 0x0, 0x4101, 0x0, {0x18, 0x17, {0xc, 0x8, @l2={'eth', 0x3a, 'hsr0\x00'}}}}, ["", "", "", "", ""]}, 0x34}, 0x1, 0x0, 0x0, 0x8040}, 0x1)
accept4$unix(r3, &(0x7f0000000e00)=@abs, &(0x7f0000000e80)=0x6e, 0x0)
bpf$OBJ_GET_MAP(0x7, &(0x7f0000000f00)={&(0x7f0000000ec0)='./file0\x00', 0x0, 0x18}, 0x10)
arch_prctl$ARCH_SET_CPUID(0x1012, 0x1)
setsockopt$inet_sctp6_SCTP_PR_SUPPORTED(r2, 0x84, 0x71, &(0x7f0000000f40)={r1, 0x9d}, 0x8)

05:02:33 executing program 4:
r0 = openat$audio(0xffffffffffffff9c, &(0x7f0000000180)='/dev/audio\x00', 0x400, 0x0)
r1 = syz_open_dev$sndpcmp(&(0x7f00000001c0)='/dev/snd/pcmC#D#p\x00', 0x9, 0x20000)
ioctl$NBD_SET_SOCK(r0, 0xab00, r1)
r2 = socket$kcm(0x10, 0x2, 0x10)
sendmsg$kcm(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)=[{&(0x7f0000001240)="2e0000002a00810600002000000000cf0500b0eba0b4d65cdbaa18b29c473da67e3d743298cbb3001be63e75c80b", 0x2e}], 0x1}, 0x0)
r3 = openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000080)='/proc/capi/capi20\x00', 0x400400, 0x0)
ioctl$SIOCGETLINKNAME(r3, 0x89e0, &(0x7f00000000c0)={0x1})
ioctl$UI_ABS_SETUP(r3, 0x401c5504, &(0x7f0000000140)={0x1, {0xffff, 0x7, 0x7ff, 0x0, 0x4}})

05:02:33 executing program 1:
r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000200)='/dev/nullb0\x00', 0x5000000084002, 0x0)
mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x200000e, 0x13, r0, 0x0)
r1 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x4000, 0x0)
preadv(r1, &(0x7f0000000040)=[{&(0x7f0000000400)=""/4096, 0x3ffc16}], 0x1, 0x0)

05:02:33 executing program 0:
recvmmsg(0xffffffffffffffff, &(0x7f0000003140)=[{{&(0x7f0000001400)=@ipx, 0x80, 0x0}}], 0x1, 0x0, 0x0)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = syz_open_procfs(0x0, &(0x7f00000004c0)='net/rt_cache\x00')
preadv(r0, &(0x7f00000017c0), 0xa8, 0x0)

05:02:33 executing program 5:
socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000000)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200)
fcntl$getownex(r0, 0x10, &(0x7f0000000040))
ioctl$TIOCGPGRP(0xffffffffffffffff, 0x540f, &(0x7f00000000c0))
ioctl$sock_FIOGETOWN(r0, 0x8903, &(0x7f0000000100)=<r2=>0x0)
r3 = syz_open_procfs(r2, &(0x7f0000000180)='net/dev\x00')
preadv(r3, &(0x7f0000331000)=[{&(0x7f0000723f20)=""/127, 0x7f}], 0x1, 0x0)

05:02:33 executing program 3:
recvmmsg(0xffffffffffffffff, &(0x7f0000003140)=[{{&(0x7f0000001400)=@ipx, 0x80, 0x0}}], 0x1, 0x0, 0x0)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = syz_open_procfs(0x0, &(0x7f00000004c0)='net/rt_cache\x00')
preadv(r0, &(0x7f00000017c0), 0xae, 0x0)

[  382.976779] binder: release 17425:17443 transaction 594 out, still active
05:02:33 executing program 3:
recvmmsg(0xffffffffffffffff, &(0x7f0000003140)=[{{&(0x7f0000001400)=@ipx, 0x80, 0x0}}], 0x1, 0x0, 0x0)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = syz_open_procfs(0x0, &(0x7f00000004c0)='net/rt_cache\x00')
preadv(r0, &(0x7f00000017c0), 0xaf, 0x0)

[  383.124111] netlink: 26 bytes leftover after parsing attributes in process `syz-executor.4'.
[  383.200459] netlink: 26 bytes leftover after parsing attributes in process `syz-executor.4'.
[  383.210574] binder: release 17456:17469 transaction 597 out, still active
05:02:33 executing program 2:
r0 = syz_open_dev$sndtimer(&(0x7f0000026000)='/dev/snd/timer\x00', 0x0, 0x0)
r1 = dup3(r0, r0, 0x80000)
ioctl$UI_GET_SYSNAME(r1, 0x8040552c, 0x0)
perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8)
r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c)
bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r2, &(0x7f0000000040), 0x0, 0x1}, 0x20)
openat$cgroup_ro(r1, 0x0, 0x0, 0x0)
unlink(&(0x7f0000000900)='./file0/file0\x00')
r3 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r4 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r4, 0x0)
ioctl$BINDER_GET_NODE_DEBUG_INFO(r3, 0xc018620b, &(0x7f0000000780))
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f00000000c0)=[@enter_looper], 0x48, 0x0, &(0x7f0000000700)="2ba063fb309ec7fdbfb08e6e91baee7d7d4599fe14129a4d426834556ae420e087d59c0c7be7fcad1abb7e1f8f446f373f611ca1ee9c2231708e18a47bc68a2a79a0b48931f6ff6d"})
ioctl$sock_inet_tcp_SIOCOUTQNSD(r1, 0x894b, &(0x7f0000000480))
getsockopt$inet_IP_IPSEC_POLICY(0xffffffffffffffff, 0x0, 0x10, &(0x7f0000000540)={{{@in6, @in=@remote}}, {{@in6=@ipv4={[], [], @local}}, 0x0, @in6}}, &(0x7f0000000000)=0xe8)
ioctl$BINDER_SET_CONTEXT_MGR(r4, 0x40046207, 0x0)
r5 = dup(r4)
shutdown(r5, 0x1)
prctl$PR_SET_NAME(0xf, &(0x7f0000000380)='/group.stat\x00')
syz_open_dev$binder(&(0x7f0000000880)='/dev/binder#\x00', 0x0, 0x2)
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)})
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, &(0x7f0000000780)})
ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f0000000680)})
creat(&(0x7f00000000c0)='./file0\x00', 0x0)
openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000100)='/group.stat\x00', 0x2761, 0x0)
clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000080), 0xffffffffffffffff)
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000003c0)={0x14, 0x0, &(0x7f0000000680)=[@acquire_done], 0x0, 0x0, 0x0})

05:02:33 executing program 0:
recvmmsg(0xffffffffffffffff, &(0x7f0000003140)=[{{&(0x7f0000001400)=@ipx, 0x80, 0x0}}], 0x1, 0x0, 0x0)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = syz_open_procfs(0x0, &(0x7f00000004c0)='net/rt_cache\x00')
preadv(r0, &(0x7f00000017c0), 0xa9, 0x0)

05:02:33 executing program 5:
connect$inet6(0xffffffffffffffff, &(0x7f0000000080)={0xa, 0x0, 0x0, @local, 0x7}, 0x1c)
r0 = syz_open_dev$mice(&(0x7f00000001c0)='/dev/input/mice\x00', 0x0, 0x800)
ioctl$SCSI_IOCTL_SYNC(r0, 0x4)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$nl_generic(r1, &(0x7f0000000080)={&(0x7f0000000480)={0x10, 0xbb7f, 0x6c00000000000000, 0x14000000}, 0xc, &(0x7f0000000440)={&(0x7f00000004c0)=ANY=[@ANYBLOB="1400000015000100000000001300110004000000"], 0x14}}, 0x0)
getsockopt$sock_cred(r1, 0x1, 0x11, &(0x7f0000000140)={<r2=>0x0}, &(0x7f0000000180)=0xc)
r3 = syz_open_procfs(r2, &(0x7f0000000100)='f\xc5*\x02')
ioctl$UI_BEGIN_FF_ERASE(r3, 0xc00c55ca, &(0x7f00000000c0)={0x0, 0x0, 0x1000000005})
getsockopt$inet_pktinfo(0xffffffffffffffff, 0x0, 0x8, &(0x7f0000001e80)={0x0, @initdev, @dev}, 0x0)
accept4$packet(0xffffffffffffffff, &(0x7f0000005cc0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @random}, &(0x7f0000005d00)=0x14, 0x80800)
sendmmsg(0xffffffffffffffff, &(0x7f0000008b00)=[{{&(0x7f0000008900)=@nfc={0x27, 0x1, 0x1, 0x7}, 0x80, &(0x7f0000008ac0)=[{&(0x7f00000089c0)="225044bdb881bbbee551b72413f85d73ebde47a4ced9370b7874f86a34a641d1490abd9fa6ea236cdd62ef4b1a7af60ae55d2173691e044af6f3155f05fe2c18fdfaba01ad6cab7b26dfaacf7c41679a05e5c72c167c71fc6678b4ef40d3cd3018413b59377222ba80310992aeb1fff40aba51f16d7c7bfd8ff321bb10b0e1100f3980368d0ce27fdbdf08629a90fb2ebf8174046b424c93e328a9bde94853af69d5b9068e5258ac1b1a5f6dfea14e4818abda86217369f7651f5ee9398b5657e1ae8cb80331f1072bae50e1519bcc22ded9babaad177635934a226856873036", 0xe0}], 0x1}, 0x5}], 0x1, 0x4000000)
ioctl$TCSETAF(r3, 0x5408, &(0x7f0000000280)={0x6, 0x7, 0x7ff, 0x3ff, 0x3, 0x6, 0x4, 0x7fff, 0x6, 0x3a})
setsockopt$inet_sctp_SCTP_HMAC_IDENT(0xffffffffffffffff, 0x84, 0x16, &(0x7f0000005b40)=ANY=[@ANYBLOB="00000000d668eb1a6f7553b0bda8f20583ba917f6a1bf3ac2de8d3d6824e9010a18c42380c7bf5b34f60bfa06fac4000000000000000bcc116e6deb22736cf97f7cb2633334297cb6402b1fa48a5cb0000004000000000000000000000"], 0x1)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
connect$inet6(0xffffffffffffffff, &(0x7f0000000000)={0xa, 0x0, 0x0, @mcast1}, 0x1c)
r4 = openat(0xffffffffffffffff, &(0x7f0000000040)='./file0\x00', 0x0, 0x0)
ioctl$SNDRV_CTL_IOCTL_ELEM_UNLOCK(r4, 0x40405515, &(0x7f0000000400)={0x9, 0x4, 0x3, 0x10000, 'syz1\x00'})
r5 = socket$kcm(0x29, 0x2, 0x0)
ioctl$UI_DEV_DESTROY(r3, 0x5502)
epoll_ctl$EPOLL_CTL_ADD(r5, 0x1, r4, &(0x7f00000003c0))
socket$inet_dccp(0x2, 0x6, 0x0)
dup(r4)
r6 = memfd_create(&(0x7f0000000240)='t\bnu\x00\x00\x00\x00\x00\x00\x00\x00\x00\x8c\x00', 0x0)
readlink(&(0x7f0000000300)='./file0\x00', &(0x7f0000000340)=""/100, 0x64)
sendfile(r5, r6, &(0x7f00000002c0), 0x1ffe00)
ioctl$PPPIOCGCHAN(0xffffffffffffffff, 0x80047437, &(0x7f0000000200))
getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000000080)={{{@in6=@dev, @in6=@remote}}, {{@in6=@ipv4={[], [], @local}}, 0x0, @in=@loopback}}, &(0x7f0000000180)=0xe8)
ioctl$SNDRV_RAWMIDI_IOCTL_STATUS(r3, 0xc0385720, &(0x7f0000000000)={0x1, {0x77359400}, 0x1ff, 0x1ff})
connect$inet6(0xffffffffffffffff, &(0x7f0000000000)={0xa, 0x0, 0x0, @local, 0x7}, 0x1c)

05:02:33 executing program 1:
r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000200)='/dev/nullb0\x00', 0x5000000084002, 0x0)
mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x200000e, 0x13, r0, 0x0)
r1 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x4000, 0x0)
preadv(r1, &(0x7f0000000040)=[{&(0x7f0000000400)=""/4096, 0x3ffc17}], 0x1, 0x0)

05:02:33 executing program 4:
r0 = syz_open_dev$sndtimer(&(0x7f0000026000)='/dev/snd/timer\x00', 0x0, 0x0)
r1 = dup3(r0, r0, 0x80000)
ioctl$UI_GET_SYSNAME(r1, 0x8040552c, 0x0)
perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8)
r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c)
bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r2, &(0x7f0000000040), 0x0, 0x1}, 0x20)
openat$cgroup_ro(0xffffffffffffffff, &(0x7f00000004c0)='cpuset.effective_cpus\x00', 0x0, 0x0)
unlink(&(0x7f0000000900)='./file0/file0\x00')
r3 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r4 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r4, 0x0)
ioctl$BINDER_GET_NODE_DEBUG_INFO(r3, 0xc018620b, &(0x7f0000000780))
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f00000000c0)=[@enter_looper], 0x48, 0x0, &(0x7f0000000700)="2ba063fb309ec7fdbfb08e6e91baee7d7d4599fe14129a4d426834556ae420e087d59c0c7be7fcad1abb7e1f8f446f373f611ca1ee9c2231708e18a47bc68a2a79a0b48931f6ff6d"})
ioctl$sock_inet_tcp_SIOCOUTQNSD(r1, 0x894b, &(0x7f0000000480))
getsockopt$inet_IP_IPSEC_POLICY(0xffffffffffffffff, 0x0, 0x10, &(0x7f0000000540)={{{@in6, @in=@remote}}, {{@in6=@ipv4={[], [], @local}}, 0x0, @in6}}, &(0x7f0000000000)=0xe8)
ioctl$BINDER_SET_CONTEXT_MGR(r4, 0x40046207, 0x0)
r5 = dup(r4)
shutdown(r5, 0x1)
prctl$PR_SET_NAME(0xf, &(0x7f0000000380)='/group.stat\x00')
syz_open_dev$binder(&(0x7f0000000880)='/dev/binder#\x00', 0x0, 0x2)
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)})
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, &(0x7f0000000780)})
ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f0000000680)})
creat(&(0x7f00000000c0)='./file0\x00', 0x0)
openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000100)='/group.stat\x00', 0x2761, 0x0)
clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000080), 0xffffffffffffffff)
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000003c0)={0x14, 0x0, &(0x7f0000000680)=[@acquire_done], 0x0, 0x0, 0x0})

[  383.382739] binder: 17522 RLIMIT_NICE not set
[  383.428475] binder: BINDER_SET_CONTEXT_MGR already set
05:02:33 executing program 3:
recvmmsg(0xffffffffffffffff, &(0x7f0000003140)=[{{&(0x7f0000001400)=@ipx, 0x80, 0x0}}], 0x1, 0x0, 0x0)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = syz_open_procfs(0x0, &(0x7f00000004c0)='net/rt_cache\x00')
preadv(r0, &(0x7f00000017c0), 0xb0, 0x0)

[  383.502349] binder: 17519:17530 ioctl 40046207 0 returned -16
05:02:33 executing program 1:
r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000200)='/dev/nullb0\x00', 0x5000000084002, 0x0)
mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x200000e, 0x13, r0, 0x0)
r1 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x4000, 0x0)
preadv(r1, &(0x7f0000000040)=[{&(0x7f0000000400)=""/4096, 0x3ffc18}], 0x1, 0x0)

[  383.568037] binder: 17519:17537 Release 1 refcount change on invalid ref 1 ret -22
05:02:34 executing program 5:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
syz_open_dev$sndseq(0x0, 0x0, 0x0)
r0 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000180)='/dev/sequencer2\x00', 0x2000000080003, 0x0)
close(r0)
setsockopt(0xffffffffffffffff, 0x2000000000010d, 0x4000800000000a, &(0x7f0000000040)='\a\x00\x00\x00', 0x4)
open(0x0, 0x101000, 0x8)
ioctl$FITRIM(0xffffffffffffffff, 0xc0185879, &(0x7f0000000000)={0x9, 0xfffffffffffffffb, 0x4})

[  383.669876] binder: 17533 RLIMIT_NICE not set
05:02:34 executing program 3:
recvmmsg(0xffffffffffffffff, &(0x7f0000003140)=[{{&(0x7f0000001400)=@ipx, 0x80, 0x0}}], 0x1, 0x0, 0x0)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = syz_open_procfs(0x0, &(0x7f00000004c0)='net/rt_cache\x00')
preadv(r0, &(0x7f00000017c0), 0xb1, 0x0)

[  383.736556] binder: BINDER_SET_CONTEXT_MGR already set
05:02:34 executing program 0:
recvmmsg(0xffffffffffffffff, &(0x7f0000003140)=[{{&(0x7f0000001400)=@ipx, 0x80, 0x0}}], 0x1, 0x0, 0x0)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = syz_open_procfs(0x0, &(0x7f00000004c0)='net/rt_cache\x00')
preadv(r0, &(0x7f00000017c0), 0xaa, 0x0)

05:02:34 executing program 1:
r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000200)='/dev/nullb0\x00', 0x5000000084002, 0x0)
mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x200000e, 0x13, r0, 0x0)
r1 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x4000, 0x0)
preadv(r1, &(0x7f0000000040)=[{&(0x7f0000000400)=""/4096, 0x3ffc19}], 0x1, 0x0)

[  383.776908] binder: 17531:17548 ioctl 40046207 0 returned -16
[  383.830170] binder: 17531:17558 Release 1 refcount change on invalid ref 1 ret -22
05:02:34 executing program 5:
r0 = socket$inet_udplite(0x2, 0x2, 0x88)
ioctl$sock_SIOCETHTOOL(r0, 0x8946, &(0x7f0000000080)={'team_slave_0\x00', &(0x7f0000000000)=ANY=[@ANYBLOB="500000000000000000000000000080000000000000000000000000000000000000000000000000000000000000000000"]})
r1 = accept(r0, &(0x7f00000000c0)=@l2, &(0x7f0000000040)=0x80)
r2 = syz_open_dev$adsp(&(0x7f0000000300)='/dev/adsp#\x00', 0x7, 0x0)
ioctl$TIOCLINUX4(r2, 0x541c, &(0x7f0000000340))
r3 = syz_genetlink_get_family_id$tipc(&(0x7f0000000480)='TIPC\x00')
sendmsg$TIPC_CMD_GET_NODES(r1, &(0x7f0000000240)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x30000800}, 0xc, &(0x7f0000000200)={&(0x7f00000001c0)={0x1c, r3, 0x804, 0x70bd28, 0x25dfdbfc, {}, ["", "", "", ""]}, 0x1c}, 0x1, 0x0, 0x0, 0x40000}, 0x8050)
splice(r1, &(0x7f0000000280), r1, &(0x7f00000002c0), 0x9, 0x8)

05:02:34 executing program 2:
r0 = syz_open_dev$sndtimer(&(0x7f0000026000)='/dev/snd/timer\x00', 0x0, 0x0)
r1 = dup3(r0, r0, 0x80000)
ioctl$UI_GET_SYSNAME(r1, 0x8040552c, 0x0)
perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8)
r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c)
bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r2, &(0x7f0000000040), 0x0, 0x1}, 0x20)
openat$cgroup_ro(r1, 0x0, 0x0, 0x0)
unlink(&(0x7f0000000900)='./file0/file0\x00')
r3 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r4 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r4, 0x0)
ioctl$BINDER_GET_NODE_DEBUG_INFO(r3, 0xc018620b, &(0x7f0000000780))
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f00000000c0)=[@enter_looper], 0x48, 0x0, &(0x7f0000000700)="2ba063fb309ec7fdbfb08e6e91baee7d7d4599fe14129a4d426834556ae420e087d59c0c7be7fcad1abb7e1f8f446f373f611ca1ee9c2231708e18a47bc68a2a79a0b48931f6ff6d"})
ioctl$sock_inet_tcp_SIOCOUTQNSD(r1, 0x894b, &(0x7f0000000480))
getsockopt$inet_IP_IPSEC_POLICY(0xffffffffffffffff, 0x0, 0x10, &(0x7f0000000540)={{{@in6, @in=@remote}}, {{@in6=@ipv4={[], [], @local}}, 0x0, @in6}}, &(0x7f0000000000)=0xe8)
ioctl$BINDER_SET_CONTEXT_MGR(r4, 0x40046207, 0x0)
r5 = dup(r4)
shutdown(r5, 0x1)
prctl$PR_SET_NAME(0xf, &(0x7f0000000380)='/group.stat\x00')
syz_open_dev$binder(&(0x7f0000000880)='/dev/binder#\x00', 0x0, 0x2)
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)})
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, &(0x7f0000000780)})
ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f0000000680)})
creat(&(0x7f00000000c0)='./file0\x00', 0x0)
openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000100)='/group.stat\x00', 0x2761, 0x0)
clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000080), 0xffffffffffffffff)
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000003c0)={0x14, 0x0, &(0x7f0000000680)=[@acquire_done], 0x0, 0x0, 0x0})

05:02:34 executing program 3:
recvmmsg(0xffffffffffffffff, &(0x7f0000003140)=[{{&(0x7f0000001400)=@ipx, 0x80, 0x0}}], 0x1, 0x0, 0x0)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = syz_open_procfs(0x0, &(0x7f00000004c0)='net/rt_cache\x00')
preadv(r0, &(0x7f00000017c0), 0xb2, 0x0)

05:02:34 executing program 0:
recvmmsg(0xffffffffffffffff, &(0x7f0000003140)=[{{&(0x7f0000001400)=@ipx, 0x80, 0x0}}], 0x1, 0x0, 0x0)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = syz_open_procfs(0x0, &(0x7f00000004c0)='net/rt_cache\x00')
preadv(r0, &(0x7f00000017c0), 0xab, 0x0)

05:02:34 executing program 1:
r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000200)='/dev/nullb0\x00', 0x5000000084002, 0x0)
mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x200000e, 0x13, r0, 0x0)
r1 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x4000, 0x0)
preadv(r1, &(0x7f0000000040)=[{&(0x7f0000000400)=""/4096, 0x3ffc1a}], 0x1, 0x0)

[  384.122138] binder: release 17519:17537 transaction 600 out, still active
[  384.264939] binder: 17588 RLIMIT_NICE not set
[  384.279691] binder: release 17531:17558 transaction 603 out, still active
05:02:34 executing program 4:
clone(0x4000024100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r0 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0)
getsockopt$inet_sctp_SCTP_GET_ASSOC_STATS(r0, 0x84, 0x70, &(0x7f0000000180)={<r1=>0x0, @in6={{0xa, 0x4e20, 0x9, @mcast2, 0x7}}, [0x401, 0xa0c, 0x6, 0x1, 0x4, 0x8c, 0x7, 0x8, 0x3, 0x6, 0x1ff, 0xfffffffffffffff9, 0xe6a9, 0x8, 0x3]}, &(0x7f00000000c0)=0x100)
ioctl$KVM_SET_TSS_ADDR(r0, 0xae47, 0xd000)
getsockopt$inet_sctp6_SCTP_AUTH_ACTIVE_KEY(r0, 0x84, 0x18, &(0x7f0000000100)={r1, 0x42a7}, &(0x7f0000000280)=0x8)
sendmsg$key(r0, &(0x7f0000001480)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000001500)=ANY=[@ANYBLOB="0218ae07280200002abd7000ffdbdf2502001300ff0000002cbd70000335000002001300ff00000027bd7000000000000800120001000700b66b6e000100010006007e00040100000000000000000000fe880000000000000000000000000101ac1e01010000000000000000000000000400020005000000ff000000000000000400000000000000030000000000000002001000000004d6000000060000000002001300040000002bbd7000043500000102180003080010d0053d2c2c7a5ee909c0eeadb8c3f8c78c4dd77daa36b917dac034534faba5a138c3b7ff874df665effcf91c5111b27e8f725b2f772c5cc281dc74422d97207a8cfb7435a0781cffe3a7843a828a0af6fc2b159519ed1b1507744bd2e70fa4464b30647cd0705c9736bb3ae8478fc29b0c0ba82a115b4de07b2434b7ceb08c3c48c25f785689b429818285c11187afa15a5b5b3b79923c1e46623a6b513c5d7dd6ccb1f0406836a69e685c101783d9451807508a39be36167c9507e61dfb6f7a9e0e8df0614ae8bf105d4e91c7f391018198a769f6e45a098b2356e89fa12553c3cfb82db16d67ab6f506b106b9312c982b64ff70c924183a49c6055949efcd9d11a70834d9c9d070d909de6272c85cdb3bd2bf999785496dd69492ae1cd39fd6353a22ef055fa62bcb66c91e975588eb002eb954c290418d217b84e67659fafb9c26526bb61e406bca9c878b00f91bdda1170f3a1fad6af7e2d194877b0cc0a660efe59c3b9a451d2ac9014d570d167e24f3a3fe7b05708bc33838d457539988ef0bce8440f205579d811254fe62b753be8d7f438f0766e8c63025f7007af2841194e40515a36685429af38bdf0a4c68c4bc8ff3e5a449eb99b108b8fda61bb5470bfd63d5d6bf7c02eeccfcbf3382f8a317fd8a01950ac49338f576ffb132f588fc810d00238e430733a04134e07016d37594cac0942d649ed6d83927815c54868e5f3d286d732c76ea10e9e31747984bfcb5113971c00527bb5d1e3fdd85e2c04aa48775386e8ff47927a9b5cf82f45c5387c4b3211ca0a9269ddbeb4ee18ee88b6db8fa1242ce0bf85f225f47937719fe99c154017282ec0a1632e068062c2073d9c6dffe4e06f6cdad10c707759573e8ca8907dd17e110600e0bf7b11092a994fc28cdd154604b650d49ef7f4c80ae91f3415a0d1a232ee1b3ebc7060b771af1d776d54f05a16109d84ea7afeac5357ae682d6d703ddda0fc96476137eff6f0c7996f9af17b59f384581a52756dc6fc9ad0328a3ee71cf5e5bb80573080f1e9aad6615443d12fcff4a1df1e9d6d8bb3cb41a20d217f476bde8b4170ccdecd1f2799b5e3afe13fa6fe84066bbe2ecd98f31fb1099d53c7ce55be090eab138811b02c9bfb562d5ea10c7cc475fe5af6d46ea02dd15d110c5530311cc1afbcfefef3eaeab2de811a75a3d470d07e71ce3d7fc36dd124c8c840151a9121ce1acc1122e0b4e19a1b5a35039e4b52e2233639b34724b8cca7c98fb3d3331fee11d715c295c249b996bc9f466edbacf96c7cfe8bdf8d357e97ea561809c20b152f9cec90f6e85ebc04b7393ea7ad8b7010db95f9a68e4bfa67cb4d4e2d3bc8e1a2be7244046e872f591535b78564bb52b17221d2bf42ea6db5d20618c81a3f3130af49c7a2adaedd80c9cd54eb035d83e5dee052e0b8bf2d1b35a2abcd6b68c9dee2c6d8c3cf35312f65a98f47de87d9f41d9bd97676a9f6a39c7ce5375829961e66f3fa81697d50318d5f6726129e8c6f307c1c005d82b49d21b2423d354508e95146eca7a040edf87b77d8a556eabfe43fa365b58d85465a438023c21df3574b9ff42d89286e88f8354d8696c6d9b43051494503ec37694fb44b069b520a1d3336cd55b49a9f6d9e8bc6681296edca36882b9baa940adc3432189875b4a0e576b8af0f55e9209e5c559f4431f84ac2f0bf3d10bcd6a8e3af29acb375184d740c261cad21d54eec5e95d1ceb0f053067e10be562473da62016686ad10dca247fa42f0f250d149ea4e744e1822f3b38ff4bc8c5e0ea664ffb21fc1c21cf5ed7cb7fb7eb1f513a6da6cd8a503623f1a86414b37b632d9e0d2b619e0a73b9b363541228a0b175317a68deafdb4d42e49f12f8e00e575db5c02a84ce0d520000f395da1bbba041d53686f1d78e2c22f1fefde4ba58abdd66f558fd79a1545300ab500874cc5e5fdf964d29bb44c02903c1bf10183a30fc9ce6c0dfea00bb4635fcdd3e25ae699cbba8d2858c2f6192463bb4acf312483123babea6300c4c209d4a66b645988adb7ea3a0e50f3c85474b294d0606a8d90705fc373cd261db5ff35ca855e9062d98517bdfd404b7afec7fa70ab46d964d2daa1f6b5ed49a501d0de64de93d253186e2d711ea0acf488bdd60fc3f8cdd07f8550e0d4a48d57db2e08e22be04d83476c6368b7ec5d6870a866fd574df42540400d0da5ba26d33e2b21bd45b3903b25ba0839e8ebd0650bf6ede7a862f4494e01c1cc789403c6ce145f79a07855a39224b9ddcb76a0cbd93270f5173df49c72c34a6e9d12c9464d2bf9fdd2a523685af2089eba3867e1f3cd09fed29c60c23c8ef39c014f80eba52c265a81e5fb040d8c1a00fa6d66c61e53f0cefe50ff5b441b7f58aedb9a002c5e2c4d0d90bbd8c4e4003427623ba51bacc8b9e50fca0f1633fd447e8e74b6e547cbfe34c48ef4b5fff857f8c153bce48fb4651bcfa3944e11ef66724846e7cd09e52ea6789c8efe72473f817b555ba53a9a15ed092f7de8224a61a3373822a829a34cc7730822ba9f24ac3674e9be5026f0f9a169f1095af0501292649fd381bd1d732474fa16fa8e2c6ba27788d7c492329fce0309b4afff1c09a06e98e141ad3ee8299854451a97eb0f41c7ac26b982a354362dd76449f7246bfc8d39bdc1c6af27f096efe9af189db74743152c8568b23a48095c56423ac5beb89adfa27d2a024a215ca8771553348187fe03551aee1d55e882ca71df698ec24cdb423bb32d8c4d70b90a03789783ef7627bd5d304b4e0b98b21a79af34398f0cc17781d52561c94031d4af0d0f98d0df32db76462263bdffb7689dbe846c065698cd0820435c884876b63c5f099e18be343f600b31c52ffed79d1fa0391e32a2814018647ae0067a4792dc35d35c58b297ff8d965bbd73ad32009992196298795c919ebe85f0765732cccb8f71ae4d52dedf9e9b7b2dc8b9fed8cdf09b85e259eb1c8aa7a3f71032a0572222dc703baa4c63219f18bd01e1f769d4cb6a78c0b4ce1e8854c264cf3583b01fd0ac60db585af5a96527c40775e5bb2f2abc2643716d175457a625f7eed84481114a74adaa89ffea996b11abad15a6f679d71fad158bc5d2697a68bece3e255d9698465a39eda61b6e2322a48b65557dc6c30621013f6d0b882a4820b0bc1b756bb7d3f4c773a36b4ede243365a1f4113d00ab991f5f1e80a26c7ce5a3fbbb752ad8846673bc5feb5b11115bd847d2fa57df614cf359356bbf387ed2bfbab06203a06e4595dd275bc42c33c5154457a8103317dbe7264ee5d4625af1373b26b6988b705b59cd19752e72eb0c45f8c61bdc7ed7209699c5aca780aad441558cd63f38db065eaf47c2c442b9e41a611e40446d3e1472e36f0c4a42648474e9192374f017ae349d8c6fae45bc0638268d0a0f20bff23ff82d7666839ae97b70fbb6be5728c8bbf944dbe68946f3fbf88df3802e54141c436a4198d7533b44025bc18e65e66074c2b17f540dce9eeba5a26f54bb0442e772aa68e21d4b133b7a4f0596647a4d65176bf3733b64912a0c125daf30758b8ea7162195512946900d180a657182339823b5396ec0c265686d6d9bdeb89ad041b6f81219e85e8214e34a4a92dbced774b1b666b70d431785da335f963c307a070c5efc8126f673f7eaf364b7a803f60dc29d9407381f5aa8a0d9e53a0492c7f326d53ab88afb3383fb3726247b979655d6f9d0dd6dafa8abde742c105d6a7d889ec7ab3da448332cac3e5413a1c5f1ac7270056707b512b77582ac3cd688910bc63c4bf49fbc133805f21c7cbd6e11d01e96c8f2944b54e7533dec51433982b4d784ec7edd997894521aafd0f169ff617f640a5956d93533add6262c06259b2f934a0542b9dc03219cc4731cb4965c9ddd1b1090a724c1f8f6a979c2bca8ebbb7c6bc39a9932536a6e8d24a824dd1f148e91b08ca7fcd65c370492e1841f97be5df51eb3d67e90a48dcb04342513d4bee8d266363c8ce9e76a61110e99fdd016e1bc3f90ff2ef4d3a04f9e166a30f8eeab78acdba65a5b14ecfb3165634122562c423f01841dc256631503bdbe6b06845312314bcae6d37a55f68f0585c88aef8a41b9095c3f6f635c4177cd7ea2ff5bb0fa8cd8706a5d7783544f872a7cac17fa574567c2f8ed4ede2b1b38ad31e25e253b6abee0ac010eff20ce9b53dd05ab96cb3e489d698da973297c242c4a9831fb9a482f37c2b4dab3935e1d0f06dbe2d08bae4cbeda4e1f4dd04a1643b55a39bc02f94bfebf152aaea7d394dba7d655ca5482932b909f31f4ac68d0ea8563e50057524ce08c2e4bf7620e52fd39fa627fcf2a88e0e341f8b7f893f7c8e593596fdc492c82756a3647fd20bf3968fb466851b583824fc764376ff77588e662e782d52f7af5915801e6feffce8cf5bf9f04cc0dfd04edeb692df660a3e796d9450b65b1ffc4ea8530c3fff4bc588facbc7c662b19aa4dfab7c5a0896bd45d3c3ba6f1f9c64d73c44a96bbd7b4fef9aa0cb9ac7cb2cee462486ae80cf78a218a6eb48f5f7d861ca18e27c3661fca7425093360f4f5b9132ffd4625444a32e932dba566a9abf846146c1ea03ada8faad337f9a7d7ed776aee601907a600e200b24d52d6f3b502d092c3a1f90d219ed4c1217607f6990712f71a1ccb239103ed78f5eb934717df7f77f36fe0feab0a6c3a3b69ecd62fe659218165a73300bbfc9b79c6892980611616eeafdd249a1d631526a3751f0209869606fbba19d5569505d86279e15ca84347be0db031b41d74a1de53456fc8ad48fbc68f0aa724acac0a4e31b559b5fadb49226ebfd8e5c27e54373b2a19877e558e13fcc8331acf2c4d958fe39c67a693356518d6ae2268a4741ef7e581f8f54147659a34d242e5f6e855846688230d2af94e439b4d6f39ad78b7b1f491e49b497205a32a80248ad1f8781b65abbfdb8d8e84f4d52bca12bdd8bd1d5e7005ea67a971ad966db97c8f05833285804858d5e172b5688ed17c8f17ada5973db6aef01f70efbc32ba538132e75de0c5d6450921f73aeb66766f08990ec029dce4806c28eb1cec042bf6a39e36d5b21c0df19a33d414c4c4420697df6c0575d6e85bb03563bffaf3684f779dd1289dc01dc21fb045aecf4ff57c2cebcf2de50c0ced48753b6b76811c3a805aa236a5925055dc93f3299e5ca45ea70f8a1e5b3d39993bb3001a01b7a0cb55d8c31485579bfce88bd5111c876c82cb72b6e644661eb66ef76cd5104c3709cb8cf6f32760768a4d432d6499035e37a595ed2192648c10f8932645a43e350513f2841d62f355ce217a360498e7d8b4378e75de477e560cd64453247d4000274ff87fae1625bd79afb13f2c854a6bb2279cbf2faf384f2cba1d4c5ac16018f307fecc3d0515c4d2507e463355dcfd2f798a664851d67eea7407671d7f369960a2e43e7569d5d42b95d9478b57c694d6c9da97dead9f9478e0fb4cdbbbc5a742b9e43142f92bd8b8ed73d65dcc1b923d119813d81f36c82fba39cd10d16052e3f422d66374fcec8b653be41c6a218c8974bbc38f0cd478a9765df99a5c9e18a1f920d61347dc9f4fb02a62dd3f9bd4b7d57748393388602193ef86902bf1dd0287a3d52fc7a10f62fe2c051d07c569abaaaadf3c63f00ebf8614d2380bbeb00b42f3c6a27a485f685a1a01e61d8901b4594a2eae36ea71aa5d3576fe38b2b70502cc1d587bae25e9423c5c2ad3a0a8a49c6df064300f1affc0154b74ffc730629b7c2025b8d34579250961e8a83099c56bbeafc0cee9b10e45552160b47966ce27f1a6cbf411b20b0b000800480200004956395f019de56fc03cd40686ddf8104324db4c0c1c5ef5f86a5a52b0b56a8c413659678ac97fafdac8d75d62938f876f1470f9f5f49ef67bd150f674b97748cf5b7c03e3003f597d0000000000000005000000ff2000000a004e2300000004fe80000000000000000000000000001e0700000000000000010015004e23000062bf9a6593e1ae126d760aa97431926118c5a6996842ee79e5775effd6f7889db38a45e33d0d4c4e0527dd36adb8efdc12b424b8d2887c59ba58"], 0x1140}}, 0x8001)
getsockopt$inet_sctp_SCTP_RECVNXTINFO(r0, 0x84, 0x21, &(0x7f0000000040), &(0x7f0000000080)=0x4)
ioctl$TUNGETSNDBUF(r0, 0x800454d3, &(0x7f0000000140))
tkill(0x0, 0x22)
r2 = getpid()
kcmp$KCMP_EPOLL_TFD(0x0, r2, 0x7, 0xffffffffffffffff, &(0x7f0000000300))

05:02:34 executing program 5:
r0 = syz_open_dev$amidi(&(0x7f00000002c0)='/dev/amidi#\x00', 0x0, 0x402000)
getsockopt$inet_sctp_SCTP_PARTIAL_DELIVERY_POINT(r0, 0x84, 0x13, &(0x7f0000000300)={0x0, 0x803}, &(0x7f0000000340)=0xff46)
r1 = socket$nl_generic(0x10, 0x3, 0x10)
r2 = syz_genetlink_get_family_id$tipc(&(0x7f00000000c0)='TIPC\x00')
sendmsg$TIPC_CMD_GET_NETID(r1, &(0x7f0000000180)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x8001000c}, 0xc, &(0x7f0000000080)={&(0x7f0000000040)={0x1c, r2, 0x400, 0x70bd2c, 0x25dfdbfc, {}, ["", "", "", "", "", "", ""]}, 0x1c}}, 0x40)
sendmsg$TIPC_CMD_SHOW_NAME_TABLE(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000100)={0x30, r2, 0x101, 0x0, 0x0, {{}, 0x0, 0x5, 0x0, {0x14, 0x19, {0x0, 0x1, 0xbfab}}}}, 0x30}}, 0x0)

05:02:34 executing program 0:
recvmmsg(0xffffffffffffffff, &(0x7f0000003140)=[{{&(0x7f0000001400)=@ipx, 0x80, 0x0}}], 0x1, 0x0, 0x0)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = syz_open_procfs(0x0, &(0x7f00000004c0)='net/rt_cache\x00')
preadv(r0, &(0x7f00000017c0), 0xac, 0x0)

05:02:34 executing program 1:
r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000200)='/dev/nullb0\x00', 0x5000000084002, 0x0)
mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x200000e, 0x13, r0, 0x0)
r1 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x4000, 0x0)
preadv(r1, &(0x7f0000000040)=[{&(0x7f0000000400)=""/4096, 0x3ffc1b}], 0x1, 0x0)

05:02:34 executing program 3:
recvmmsg(0xffffffffffffffff, &(0x7f0000003140)=[{{&(0x7f0000001400)=@ipx, 0x80, 0x0}}], 0x1, 0x0, 0x0)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = syz_open_procfs(0x0, &(0x7f00000004c0)='net/rt_cache\x00')
preadv(r0, &(0x7f00000017c0), 0xb3, 0x0)

[  384.325138] binder: BINDER_SET_CONTEXT_MGR already set
[  384.390105] binder: 17587:17592 ioctl 40046207 0 returned -16
[  384.391818] binder: 17587:17600 Release 1 refcount change on invalid ref 1 ret -22
05:02:34 executing program 4:
r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
preadv(r0, &(0x7f0000000140)=[{&(0x7f0000000340)=""/148, 0x94}], 0x1, 0x1)
r1 = syz_open_dev$cec(0x0, 0x2, 0x2)
getsockopt$inet_sctp6_SCTP_DEFAULT_SNDINFO(r1, 0x84, 0x22, &(0x7f0000000040)={0x1ff, 0x1, 0x1}, 0x0)
getsockopt$inet_sctp6_SCTP_DEFAULT_SEND_PARAM(r1, 0x84, 0xa, &(0x7f00000000c0)={0x4, 0x7, 0x8, 0xa6, 0x9, 0x4, 0xffffffff00000000, 0xb924}, 0x0)
r2 = syz_open_procfs(0x0, &(0x7f0000000240)='status\x00')
setsockopt$netlink_NETLINK_RX_RING(r1, 0x10e, 0x6, 0x0, 0x0)
preadv(r2, &(0x7f0000000480), 0x10000000000001ed, 0x0)

05:02:34 executing program 5:
r0 = socket$inet_udplite(0x2, 0x2, 0x88)
ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c12a41d88b070")
syz_open_dev$binder(&(0x7f0000000700)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
setsockopt$sock_void(r0, 0x1, 0x1b, 0x0, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
dup3(r0, r1, 0x0)

05:02:34 executing program 1:
r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000200)='/dev/nullb0\x00', 0x5000000084002, 0x0)
mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x200000e, 0x13, r0, 0x0)
r1 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x4000, 0x0)
preadv(r1, &(0x7f0000000040)=[{&(0x7f0000000400)=""/4096, 0x3ffc1c}], 0x1, 0x0)

05:02:35 executing program 2:
r0 = syz_open_dev$sndtimer(&(0x7f0000026000)='/dev/snd/timer\x00', 0x0, 0x0)
r1 = dup3(r0, r0, 0x80000)
ioctl$UI_GET_SYSNAME(r1, 0x8040552c, 0x0)
perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8)
r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c)
bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r2, &(0x7f0000000040), 0x0, 0x1}, 0x20)
openat$cgroup_ro(r1, 0x0, 0x0, 0x0)
unlink(&(0x7f0000000900)='./file0/file0\x00')
r3 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r4 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r4, 0x0)
ioctl$BINDER_GET_NODE_DEBUG_INFO(r3, 0xc018620b, &(0x7f0000000780))
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f00000000c0)=[@enter_looper], 0x48, 0x0, &(0x7f0000000700)="2ba063fb309ec7fdbfb08e6e91baee7d7d4599fe14129a4d426834556ae420e087d59c0c7be7fcad1abb7e1f8f446f373f611ca1ee9c2231708e18a47bc68a2a79a0b48931f6ff6d"})
ioctl$sock_inet_tcp_SIOCOUTQNSD(r1, 0x894b, &(0x7f0000000480))
getsockopt$inet_IP_IPSEC_POLICY(0xffffffffffffffff, 0x0, 0x10, &(0x7f0000000540)={{{@in6, @in=@remote}}, {{@in6=@ipv4={[], [], @local}}, 0x0, @in6}}, &(0x7f0000000000)=0xe8)
ioctl$BINDER_SET_CONTEXT_MGR(r4, 0x40046207, 0x0)
r5 = dup(r4)
shutdown(r5, 0x1)
prctl$PR_SET_NAME(0xf, &(0x7f0000000380)='/group.stat\x00')
syz_open_dev$binder(&(0x7f0000000880)='/dev/binder#\x00', 0x0, 0x2)
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)})
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, &(0x7f0000000780)})
ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f0000000680)})
creat(&(0x7f00000000c0)='./file0\x00', 0x0)
openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000100)='/group.stat\x00', 0x2761, 0x0)
clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000080), 0xffffffffffffffff)
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000003c0)={0x14, 0x0, &(0x7f0000000680)=[@acquire_done], 0x0, 0x0, 0x0})

05:02:35 executing program 0:
recvmmsg(0xffffffffffffffff, &(0x7f0000003140)=[{{&(0x7f0000001400)=@ipx, 0x80, 0x0}}], 0x1, 0x0, 0x0)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = syz_open_procfs(0x0, &(0x7f00000004c0)='net/rt_cache\x00')
preadv(r0, &(0x7f00000017c0), 0xad, 0x0)

05:02:35 executing program 3:
recvmmsg(0xffffffffffffffff, &(0x7f0000003140)=[{{&(0x7f0000001400)=@ipx, 0x80, 0x0}}], 0x1, 0x0, 0x0)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = syz_open_procfs(0x0, &(0x7f00000004c0)='net/rt_cache\x00')
preadv(r0, &(0x7f00000017c0), 0xb4, 0x0)

05:02:35 executing program 5:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
openat$apparmor_thread_exec(0xffffffffffffff9c, 0x0, 0x2, 0x0)
write$apparmor_exec(0xffffffffffffffff, 0x0, 0x0)
r0 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/sys/net/ipv4/vs/cache_bypass\x00', 0x2, 0x0)
ioctl$EVIOCGREP(r0, 0x80084503, &(0x7f0000000180)=""/226)
ioctl$PPPIOCGDEBUG(0xffffffffffffffff, 0x80047441, &(0x7f0000000280))
r1 = openat$zero(0xffffffffffffff9c, 0x0, 0x800, 0x0)
pipe(&(0x7f00000000c0)={<r2=>0xffffffffffffffff, <r3=>0xffffffffffffffff})
getpeername$inet(r1, &(0x7f0000000100)={0x2, 0x0, @broadcast}, &(0x7f0000000140)=0x10)
close(r3)
pipe(&(0x7f0000000000)={0xffffffffffffffff, <r4=>0xffffffffffffffff})
inotify_init1(0x0)
splice(r2, 0x0, r4, 0x0, 0x3, 0x0)

05:02:35 executing program 1:
r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000200)='/dev/nullb0\x00', 0x5000000084002, 0x0)
mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x200000e, 0x13, r0, 0x0)
r1 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x4000, 0x0)
preadv(r1, &(0x7f0000000040)=[{&(0x7f0000000400)=""/4096, 0x3ffc1d}], 0x1, 0x0)

05:02:35 executing program 4:
r0 = socket$inet6_tcp(0xa, 0x1, 0x0)
setsockopt$inet6_tcp_int(r0, 0x6, 0x13, &(0x7f00000000c0)=0x100000001, 0x1d4)
connect$inet6(r0, &(0x7f0000000080), 0x1c)
setsockopt$inet6_tcp_TCP_ULP(r0, 0x6, 0x1f, &(0x7f0000000200)='tls\x00', 0x4)
setsockopt$inet6_tcp_TLS_TX(r0, 0x11a, 0x2, &(0x7f0000000100), 0x28)
recvmmsg(r0, &(0x7f0000002fc0)=[{{&(0x7f0000000900)=@alg, 0x80, &(0x7f0000002a80)=[{&(0x7f0000000280)=""/124, 0xfeab}, {&(0x7f0000000780)=""/217}, {&(0x7f0000000980)=""/241, 0x3b9ac9ff}, {&(0x7f0000000a80)=""/4096}, {&(0x7f0000001a80)=""/4096}, {&(0x7f0000000880)=""/70}, {&(0x7f0000000300)=""/54}], 0x0, &(0x7f0000000340)=""/160, 0xa0}}], 0x569, 0x10102, &(0x7f00000001c0)={0x77359400})
shutdown(r0, 0x0)
write$binfmt_script(r0, &(0x7f0000000400)={'#! ', './file0', [{0x20, '{#+'}], 0xa, "24c25c71b67864e5fce5b48bc34fc28004b9a0e96fb63104622cc4ba45b6285ff492bb56029d2bae74a6c9dced5a475cbc474c149a0fad521678f0e059fe7f0491c57e38749e72c136d20857923b66f37a49bdc3718463a7bc254de87b04cefc63bfe7cc1932e0b6541e11cfc408d365207c152685a4286941c9be2b18fce9ad3e580f336c8f28918ff8e69e12fc26cf1507fe7a916c0f91306b7af54c9c6f3460c5adf7f01a25ed0d063f1d3f27dda1a885398832d358c65ee6e1c0348f9a2748bce98f55a2ae49eb08e4e773799052c87f688f4531d65bdeda45a235597d295ae8d5f4163e3867"}, 0xf7)
r1 = openat$vsock(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vsock\x00', 0x400000, 0x0)
getsockopt$inet_sctp_SCTP_MAX_BURST(0xffffffffffffffff, 0x84, 0x14, &(0x7f0000000040)=@assoc_value={<r2=>0x0}, &(0x7f0000000140)=0x8)
setsockopt$inet_sctp6_SCTP_DEFAULT_PRINFO(r1, 0x84, 0x72, &(0x7f0000000180)={r2, 0x8c90, 0x30}, 0xc)

[  385.031806] binder: release 17587:17600 transaction 606 out, still active
[  385.097419] tls_set_device_offload_rx: netdev lo with no TLS offload
05:02:35 executing program 1:
r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000200)='/dev/nullb0\x00', 0x5000000084002, 0x0)
mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x200000e, 0x13, r0, 0x0)
r1 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x4000, 0x0)
preadv(r1, &(0x7f0000000040)=[{&(0x7f0000000400)=""/4096, 0x3ffc1e}], 0x1, 0x0)

[  385.154330] tls_set_device_offload_rx: netdev lo with no TLS offload
[  385.168595] binder: 17650 RLIMIT_NICE not set
05:02:35 executing program 0:
recvmmsg(0xffffffffffffffff, &(0x7f0000003140)=[{{&(0x7f0000001400)=@ipx, 0x80, 0x0}}], 0x1, 0x0, 0x0)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = syz_open_procfs(0x0, &(0x7f00000004c0)='net/rt_cache\x00')
preadv(r0, &(0x7f00000017c0), 0xae, 0x0)

05:02:35 executing program 3:
recvmmsg(0xffffffffffffffff, &(0x7f0000003140)=[{{&(0x7f0000001400)=@ipx, 0x80, 0x0}}], 0x1, 0x0, 0x0)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = syz_open_procfs(0x0, &(0x7f00000004c0)='net/rt_cache\x00')
preadv(r0, &(0x7f00000017c0), 0xb5, 0x0)

[  385.214593] binder: BINDER_SET_CONTEXT_MGR already set
05:02:35 executing program 5:
r0 = socket$kcm(0x2b, 0x1ffffffffffffff, 0x0)
socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180)={0xffffffffffffffff, <r1=>0xffffffffffffffff})
ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200)
sendmsg$kcm(r0, &(0x7f0000002900)={&(0x7f0000000000)=@in={0x2, 0x0, @remote}, 0x80, 0x0}, 0x20000054)
ioctl$sock_kcm_SIOCKCMUNATTACH(r0, 0x5452, &(0x7f0000000080))
dup3(r1, r0, 0x0)
socket$pppoe(0x18, 0x1, 0x0)

[  385.262398] binder: 17647:17653 ioctl 40046207 0 returned -16
[  385.304589] binder: 17647:17661 Release 1 refcount change on invalid ref 1 ret -22
05:02:35 executing program 1:
r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000200)='/dev/nullb0\x00', 0x5000000084002, 0x0)
mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x200000e, 0x13, r0, 0x0)
r1 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x4000, 0x0)
preadv(r1, &(0x7f0000000040)=[{&(0x7f0000000400)=""/4096, 0x3ffc21}], 0x1, 0x0)

05:02:35 executing program 0:
recvmmsg(0xffffffffffffffff, &(0x7f0000003140)=[{{&(0x7f0000001400)=@ipx, 0x80, 0x0}}], 0x1, 0x0, 0x0)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = syz_open_procfs(0x0, &(0x7f00000004c0)='net/rt_cache\x00')
preadv(r0, &(0x7f00000017c0), 0xaf, 0x0)

05:02:36 executing program 2:
r0 = syz_open_dev$sndtimer(&(0x7f0000026000)='/dev/snd/timer\x00', 0x0, 0x0)
r1 = dup3(r0, r0, 0x80000)
ioctl$UI_GET_SYSNAME(r1, 0x8040552c, 0x0)
perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8)
r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c)
bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r2, &(0x7f0000000040), 0x0, 0x1}, 0x20)
openat$cgroup_ro(r1, &(0x7f00000004c0)='cpuset.effective_cpus\x00', 0x0, 0x0)
unlink(0x0)
r3 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r4 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r4, 0x0)
ioctl$BINDER_GET_NODE_DEBUG_INFO(r3, 0xc018620b, &(0x7f0000000780))
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f00000000c0)=[@enter_looper], 0x48, 0x0, &(0x7f0000000700)="2ba063fb309ec7fdbfb08e6e91baee7d7d4599fe14129a4d426834556ae420e087d59c0c7be7fcad1abb7e1f8f446f373f611ca1ee9c2231708e18a47bc68a2a79a0b48931f6ff6d"})
ioctl$sock_inet_tcp_SIOCOUTQNSD(r1, 0x894b, &(0x7f0000000480))
getsockopt$inet_IP_IPSEC_POLICY(0xffffffffffffffff, 0x0, 0x10, &(0x7f0000000540)={{{@in6, @in=@remote}}, {{@in6=@ipv4={[], [], @local}}, 0x0, @in6}}, &(0x7f0000000000)=0xe8)
ioctl$BINDER_SET_CONTEXT_MGR(r4, 0x40046207, 0x0)
r5 = dup(r4)
shutdown(r5, 0x1)
prctl$PR_SET_NAME(0xf, &(0x7f0000000380)='/group.stat\x00')
syz_open_dev$binder(&(0x7f0000000880)='/dev/binder#\x00', 0x0, 0x2)
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)})
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, &(0x7f0000000780)})
ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f0000000680)})
creat(&(0x7f00000000c0)='./file0\x00', 0x0)
openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000100)='/group.stat\x00', 0x2761, 0x0)
clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000080), 0xffffffffffffffff)
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000003c0)={0x14, 0x0, &(0x7f0000000680)=[@acquire_done], 0x0, 0x0, 0x0})

05:02:36 executing program 4:
r0 = openat(0xffffffffffffffff, &(0x7f0000000180)='./file0\x00', 0x80000, 0x0)
bind$can_raw(r0, 0xfffffffffffffffd, 0x0)
r1 = socket$inet6_udp(0xa, 0x2, 0x0)
r2 = socket$l2tp(0x18, 0x1, 0x1)
r3 = socket$l2tp(0x18, 0x1, 0x1)
connect$inet6(r0, &(0x7f00000001c0)={0xa, 0x0, 0x0, @loopback}, 0x349)
connect$l2tp(r3, &(0x7f00000000c0)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @multicast1}, 0x4, 0x8}}, 0x2e)
getsockopt$inet6_IPV6_IPSEC_POLICY(r1, 0x29, 0x22, &(0x7f00000002c0)={{{@in6=@dev, @in6=@empty, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, <r4=>0x0}}, {{@in=@loopback}, 0x0, @in6=@local}}, &(0x7f00000003c0)=0xe8)
getsockopt$inet_IP_IPSEC_POLICY(r0, 0x0, 0x10, &(0x7f0000000400)={{{@in6=@ipv4, @in=@dev, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, <r5=>0x0}}, {{@in6=@initdev}, 0x0, @in6=@remote}}, &(0x7f0000000500)=0xe8)
getsockopt$inet6_IPV6_XFRM_POLICY(r3, 0x29, 0x23, &(0x7f0000000a00)={{{@in6=@local, @in6=@mcast1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, <r6=>0x0}}, {{@in=@dev}, 0x0, @in6=@dev}}, &(0x7f0000000640)=0xfffffd07)
getsockopt$inet6_IPV6_XFRM_POLICY(r0, 0x29, 0x23, &(0x7f0000000680)={{{@in6=@dev, @in=@broadcast, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, <r7=>0x0}}, {{@in=@loopback}, 0x0, @in6=@remote}}, &(0x7f0000000780)=0xe8)
getsockopt$sock_cred(r2, 0x1, 0x11, &(0x7f00000007c0)={0x0, <r8=>0x0}, &(0x7f0000000800)=0xc)
getresuid(&(0x7f0000000840), &(0x7f0000000880)=<r9=>0x0, &(0x7f00000008c0))
r10 = getegid()
fstat(r0, &(0x7f0000000900)={0x0, 0x0, 0x0, 0x0, 0x0, <r11=>0x0})
fstat(r1, &(0x7f0000000980)={0x0, 0x0, 0x0, 0x0, 0x0, <r12=>0x0})
rmdir(&(0x7f0000000080)='./file0\x00')
setxattr$system_posix_acl(&(0x7f0000000040)='./file0\x00', &(0x7f0000000280)='system.posix_acl_access\x00', &(0x7f0000000540)=ANY=[@ANYBLOB="02000000010006000000000002000100", @ANYRES32=r4, @ANYBLOB="02000100", @ANYRES32=r5, @ANYBLOB="0200020037", @ANYRES32=r6, @ANYBLOB="02000600", @ANYRES32=r7, @ANYBLOB="02000500", @ANYRES32=r8, @ANYBLOB="02000200ce3cbe4daf88b88ff45a0096eca671867decf0e5d30a0605ae54968ad26f4947d0060044eb1b512604ead50bd8e67fb1c9640bc12c00000000000000f14d4fb117b82f702b60b64be1c2fabd84c429f914f87c119d913426b12f44c8777fdec46854e979f7f3c167466ad9bf6a8ff86490e03271", @ANYRES32=r9, @ANYBLOB="040001000000000008000400", @ANYRES32=r10, @ANYBLOB='\b\x00\a\x00', @ANYRES32=r11, @ANYBLOB="0800e61765546e0186a318733a02009f653c", @ANYRES32=r12, @ANYBLOB="10000100000000002000010000000000"], 0x6c, 0x0)
r13 = openat$qat_adf_ctl(0xffffffffffffff9c, &(0x7f0000000000)='/dev/qat_adf_ctl\x00', 0x80000, 0x0)
write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffff9c, &(0x7f0000000100)={0x0, 0x18, 0xfa00, {0xffffffffffffffff, &(0x7f0000000240)={<r14=>0xffffffffffffffff}, 0x2, 0xf}}, 0xfffffffffffffe54)
write$RDMA_USER_CM_CMD_DISCONNECT(r13, &(0x7f0000000140)={0xa, 0x4, 0xfa00, {r14}}, 0xc)
openat$zero(0xffffffffffffff9c, &(0x7f0000000200)='/dev/zero\x00', 0x8000, 0x0)

05:02:36 executing program 3:
recvmmsg(0xffffffffffffffff, &(0x7f0000003140)=[{{&(0x7f0000001400)=@ipx, 0x80, 0x0}}], 0x1, 0x0, 0x0)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = syz_open_procfs(0x0, &(0x7f00000004c0)='net/rt_cache\x00')
preadv(r0, &(0x7f00000017c0), 0xb6, 0x0)

05:02:36 executing program 5:
r0 = semget(0x1, 0x1004, 0x1)
r1 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000540)='/dev/rtc0\x00', 0x10000, 0x0)
ioctl$KVM_GET_SUPPORTED_CPUID(r1, 0xc008ae05, &(0x7f0000000580)=""/40)
semctl$GETPID(r0, 0x4, 0xb, &(0x7f0000000040)=""/73)
r2 = bpf$OBJ_GET_PROG(0x7, &(0x7f0000000500)={&(0x7f00000004c0)='./file0\x00', 0x0, 0x10}, 0x10)
r3 = dup3(0xffffffffffffffff, r2, 0x80000)
r4 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000100)='TIPCv2\x00')
semctl$SEM_STAT(r0, 0x7, 0x12, &(0x7f0000000440)=""/110)
sendmsg$TIPC_NL_BEARER_GET(r3, &(0x7f0000000400)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f00000003c0)={&(0x7f0000000140)={0x26c, r4, 0x804, 0x70bd2c, 0x25dfdbfe, {}, [@TIPC_NLA_MEDIA={0x58, 0x5, [@TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'udp\x00'}, @TIPC_NLA_MEDIA_PROP={0x4c, 0x2, [@TIPC_NLA_PROP_TOL={0x8, 0x2, 0x8}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x4a}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x8}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0xb8}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x1000}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0xd84e}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x2}, @TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x4}]}]}, @TIPC_NLA_NODE={0x24, 0x6, [@TIPC_NLA_NODE_ADDR={0x8, 0x1, 0x1}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_ADDR={0x8, 0x1, 0x6}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}]}, @TIPC_NLA_BEARER={0x60, 0x1, [@TIPC_NLA_BEARER_DOMAIN={0x8, 0x3, 0xdb}, @TIPC_NLA_BEARER_NAME={0x10, 0x1, @udp='udp:syz2\x00'}, @TIPC_NLA_BEARER_NAME={0x10, 0x1, @udp='udp:syz0\x00'}, @TIPC_NLA_BEARER_PROP={0x34, 0x2, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x12}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0xc}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x1f}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x55}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x9}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x3f}]}]}, @TIPC_NLA_SOCK={0x34, 0x2, [@TIPC_NLA_SOCK_REF={0x8, 0x2, 0xfffffffffffffffd}, @TIPC_NLA_SOCK_ADDR={0x8}, @TIPC_NLA_SOCK_ADDR={0x8}, @TIPC_NLA_SOCK_REF={0x8, 0x2, 0x8000}, @TIPC_NLA_SOCK_ADDR={0x8}, @TIPC_NLA_SOCK_REF={0x8, 0x2, 0x3}]}, @TIPC_NLA_LINK={0x38, 0x4, [@TIPC_NLA_LINK_NAME={0xc, 0x1, 'syz0\x00'}, @TIPC_NLA_LINK_NAME={0xc, 0x1, 'syz0\x00'}, @TIPC_NLA_LINK_PROP={0x1c, 0x7, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x14}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x5}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x1}]}]}, @TIPC_NLA_LINK={0x68, 0x4, [@TIPC_NLA_LINK_NAME={0x14, 0x1, 'broadcast-link\x00'}, @TIPC_NLA_LINK_NAME={0x14, 0x1, 'broadcast-link\x00'}, @TIPC_NLA_LINK_PROP={0x24, 0x7, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x19}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x8}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x6}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x8}]}, @TIPC_NLA_LINK_NAME={0xc, 0x1, 'syz0\x00'}, @TIPC_NLA_LINK_PROP={0xc, 0x7, [@TIPC_NLA_PROP_TOL={0x8, 0x2, 0x526}]}]}, @TIPC_NLA_BEARER={0x9c, 0x1, [@TIPC_NLA_BEARER_DOMAIN={0x8, 0x3, 0x39e}, @TIPC_NLA_BEARER_UDP_OPTS={0x38, 0x4, {{0x20, 0x1, @in6={0xa, 0x4e22, 0x9, @rand_addr="8dfbb355a9c674ea98ac744b11f7884a", 0x7}}, {0x14, 0x2, @in={0x2, 0x4e22, @loopback}}}}, @TIPC_NLA_BEARER_NAME={0x10, 0x1, @udp='udp:syz1\x00'}, @TIPC_NLA_BEARER_UDP_OPTS={0x38, 0x4, {{0x14, 0x1, @in={0x2, 0x4e22, @initdev={0xac, 0x1e, 0x1, 0x0}}}, {0x20, 0x2, @in6={0xa, 0x4e20, 0x1, @empty, 0x101}}}}, @TIPC_NLA_BEARER_NAME={0x10, 0x1, @l2={'eth', 0x3a, 'rose0\x00'}}]}, @TIPC_NLA_MEDIA={0xc, 0x5, [@TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'eth\x00'}]}]}, 0x26c}, 0x1, 0x0, 0x0, 0x20008010}, 0x8000)
socketpair(0x2, 0x0, 0x400000002, &(0x7f0000000000))

05:02:36 executing program 0:
recvmmsg(0xffffffffffffffff, &(0x7f0000003140)=[{{&(0x7f0000001400)=@ipx, 0x80, 0x0}}], 0x1, 0x0, 0x0)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = syz_open_procfs(0x0, &(0x7f00000004c0)='net/rt_cache\x00')
preadv(r0, &(0x7f00000017c0), 0xb0, 0x0)

05:02:36 executing program 1:
r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000200)='/dev/nullb0\x00', 0x5000000084002, 0x0)
mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x200000e, 0x13, r0, 0x0)
r1 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x4000, 0x0)
preadv(r1, &(0x7f0000000040)=[{&(0x7f0000000400)=""/4096, 0x3ffc22}], 0x1, 0x0)

[  385.917925] binder: release 17647:17661 transaction 609 out, still active
05:02:36 executing program 4:

05:02:36 executing program 3:
recvmmsg(0xffffffffffffffff, &(0x7f0000003140)=[{{&(0x7f0000001400)=@ipx, 0x80, 0x0}}], 0x1, 0x0, 0x0)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = syz_open_procfs(0x0, &(0x7f00000004c0)='net/rt_cache\x00')
preadv(r0, &(0x7f00000017c0), 0xb7, 0x0)

[  386.047002] binder: 17704 RLIMIT_NICE not set
05:02:36 executing program 0:
recvmmsg(0xffffffffffffffff, &(0x7f0000003140)=[{{&(0x7f0000001400)=@ipx, 0x80, 0x0}}], 0x1, 0x0, 0x0)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = syz_open_procfs(0x0, &(0x7f00000004c0)='net/rt_cache\x00')
preadv(r0, &(0x7f00000017c0), 0xb1, 0x0)

05:02:36 executing program 1:
r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000200)='/dev/nullb0\x00', 0x5000000084002, 0x0)
mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x200000e, 0x13, r0, 0x0)
r1 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x4000, 0x0)
preadv(r1, &(0x7f0000000040)=[{&(0x7f0000000400)=""/4096, 0x3ffc23}], 0x1, 0x0)

[  386.093445] binder: BINDER_SET_CONTEXT_MGR already set
05:02:36 executing program 5:
r0 = socket$inet6_tcp(0xa, 0x1, 0x0)
r1 = openat$full(0xffffffffffffff9c, &(0x7f0000000000)='/dev/full\x00', 0x4000, 0x0)
write$P9_RWRITE(r1, &(0x7f0000000040)={0xb, 0x77, 0x1, 0x1000}, 0xb)
setsockopt$inet6_IPV6_XFRM_POLICY(r0, 0x29, 0x23, &(0x7f0000000340)={{{@in=@empty, @in6=@local, 0x0, 0x0, 0x0, 0x0, 0xa}, {}, {}, 0x0, 0x0, 0x1}, {{@in6=@loopback, 0x0, 0xff}, 0x0, @in6=@mcast2}}, 0xe8)

[  386.153000] binder: 17702:17710 ioctl 40046207 0 returned -16
05:02:36 executing program 4:
r0 = socket$inet(0x2, 0x801, 0x0)
setsockopt$inet_tcp_TCP_MD5SIG(r0, 0x6, 0xe, &(0x7f0000000100)={@in={{0x2, 0x0, @multicast2}}, 0x0, 0xfffffffffffeffff, 0x0, "d8daf6e318c0c06ce85bed8133e2bbb41e0f89f035ad486350236ce942ac81791ae76e84a4eaec3318becd396ada684151daded40ee3713d3aa4d6186f900ad4738108e15783d894a62706586397b9ec"}, 0xd8)
getsockopt$IPT_SO_GET_REVISION_MATCH(r0, 0x0, 0x42, &(0x7f0000000080)={'icmp\x00'}, &(0x7f0000000040)=0x1e)

[  386.208359] binder: 17702:17718 Release 1 refcount change on invalid ref 1 ret -22
05:02:37 executing program 2:
r0 = syz_open_dev$sndtimer(&(0x7f0000026000)='/dev/snd/timer\x00', 0x0, 0x0)
r1 = dup3(r0, r0, 0x80000)
ioctl$UI_GET_SYSNAME(r1, 0x8040552c, 0x0)
perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8)
r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c)
bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r2, &(0x7f0000000040), 0x0, 0x1}, 0x20)
openat$cgroup_ro(r1, &(0x7f00000004c0)='cpuset.effective_cpus\x00', 0x0, 0x0)
unlink(0x0)
r3 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r4 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r4, 0x0)
ioctl$BINDER_GET_NODE_DEBUG_INFO(r3, 0xc018620b, &(0x7f0000000780))
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f00000000c0)=[@enter_looper], 0x48, 0x0, &(0x7f0000000700)="2ba063fb309ec7fdbfb08e6e91baee7d7d4599fe14129a4d426834556ae420e087d59c0c7be7fcad1abb7e1f8f446f373f611ca1ee9c2231708e18a47bc68a2a79a0b48931f6ff6d"})
ioctl$sock_inet_tcp_SIOCOUTQNSD(r1, 0x894b, &(0x7f0000000480))
getsockopt$inet_IP_IPSEC_POLICY(0xffffffffffffffff, 0x0, 0x10, &(0x7f0000000540)={{{@in6, @in=@remote}}, {{@in6=@ipv4={[], [], @local}}, 0x0, @in6}}, &(0x7f0000000000)=0xe8)
ioctl$BINDER_SET_CONTEXT_MGR(r4, 0x40046207, 0x0)
r5 = dup(r4)
shutdown(r5, 0x1)
prctl$PR_SET_NAME(0xf, &(0x7f0000000380)='/group.stat\x00')
syz_open_dev$binder(&(0x7f0000000880)='/dev/binder#\x00', 0x0, 0x2)
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)})
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, &(0x7f0000000780)})
ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f0000000680)})
creat(&(0x7f00000000c0)='./file0\x00', 0x0)
openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000100)='/group.stat\x00', 0x2761, 0x0)
clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000080), 0xffffffffffffffff)
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000003c0)={0x14, 0x0, &(0x7f0000000680)=[@acquire_done], 0x0, 0x0, 0x0})

05:02:37 executing program 3:
recvmmsg(0xffffffffffffffff, &(0x7f0000003140)=[{{&(0x7f0000001400)=@ipx, 0x80, 0x0}}], 0x1, 0x0, 0x0)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = syz_open_procfs(0x0, &(0x7f00000004c0)='net/rt_cache\x00')
preadv(r0, &(0x7f00000017c0), 0xb8, 0x0)

05:02:37 executing program 5:
r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x75c, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$vcsa(&(0x7f00000001c0)='/dev/vcsa#\x00', 0x80006, 0x0)
setsockopt$inet_sctp_SCTP_DELAYED_SACK(r1, 0x84, 0x10, 0x0, 0x0)
r2 = socket$inet6(0xa, 0x1, 0x8010000000000084)
bind$inet6(r2, &(0x7f0000ef8cfd)={0xa, 0x4e23, 0x0, @loopback}, 0x1c)
listen(r2, 0x5)
r3 = socket$inet6_sctp(0xa, 0x5, 0x84)
r4 = accept4(r2, 0x0, 0x0, 0x0)
setsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX_OLD(r3, 0x84, 0x6b, &(0x7f000055bfe4)=[@in6={0xa, 0x4e23, 0x0, @loopback}], 0x1c)
recvmmsg(r3, &(0x7f0000006940)=[{{0x0, 0x0, 0x0}}], 0x500, 0x0, 0x0)
ioctl$KVM_SET_SIGNAL_MASK(r0, 0x4004ae8b, &(0x7f0000000080)=ANY=[@ANYBLOB="59000000e2e49c2cf2a3c41fe14a683c9a16da471a87c856a67835dd44f9a7c930b6b42f4a9bb78c4434562d65ade5411f3ac6905520e49c226f38f10e29d91b4e6946e59d28c67269d270f63dd781880872d510057aa96aebb918a5176396bb899c4b304f07775ed5"])
write$nbd(r4, &(0x7f0000000140)=ANY=[@ANYPTR=&(0x7f0000000100)=ANY=[@ANYRESOCT=0x0, @ANYRES16=r0]], 0x1)

05:02:37 executing program 0:
recvmmsg(0xffffffffffffffff, &(0x7f0000003140)=[{{&(0x7f0000001400)=@ipx, 0x80, 0x0}}], 0x1, 0x0, 0x0)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = syz_open_procfs(0x0, &(0x7f00000004c0)='net/rt_cache\x00')
preadv(r0, &(0x7f00000017c0), 0xb2, 0x0)

05:02:37 executing program 1:
r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000200)='/dev/nullb0\x00', 0x5000000084002, 0x0)
mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x200000e, 0x13, r0, 0x0)
r1 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x4000, 0x0)
preadv(r1, &(0x7f0000000040)=[{&(0x7f0000000400)=""/4096, 0x3ffc24}], 0x1, 0x0)

05:02:37 executing program 4:
r0 = perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
ioctl$BLKIOMIN(r0, 0x1278, &(0x7f0000000000))
r1 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vhost-net\x00', 0x2, 0x0)
ioctl$VHOST_SET_FEATURES(r1, 0x4008af00, &(0x7f0000000080)=0x1fffffffd)
write$vnet(r1, &(0x7f00000004c0)={0x1, {0x0, 0x0, 0x0, 0x0, 0x3}}, 0x68)

[  386.813675] binder: release 17702:17718 transaction 612 out, still active
[  386.923155] binder: 17758 RLIMIT_NICE not set
05:02:37 executing program 3:
recvmmsg(0xffffffffffffffff, &(0x7f0000003140)=[{{&(0x7f0000001400)=@ipx, 0x80, 0x0}}], 0x1, 0x0, 0x0)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = syz_open_procfs(0x0, &(0x7f00000004c0)='net/rt_cache\x00')
preadv(r0, &(0x7f00000017c0), 0xb9, 0x0)

05:02:37 executing program 0:
recvmmsg(0xffffffffffffffff, &(0x7f0000003140)=[{{&(0x7f0000001400)=@ipx, 0x80, 0x0}}], 0x1, 0x0, 0x0)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = syz_open_procfs(0x0, &(0x7f00000004c0)='net/rt_cache\x00')
preadv(r0, &(0x7f00000017c0), 0xb3, 0x0)

05:02:37 executing program 1:
r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000200)='/dev/nullb0\x00', 0x5000000084002, 0x0)
mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x200000e, 0x13, r0, 0x0)
r1 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x4000, 0x0)
preadv(r1, &(0x7f0000000040)=[{&(0x7f0000000400)=""/4096, 0x3ffc25}], 0x1, 0x0)

[  386.994903] binder: BINDER_SET_CONTEXT_MGR already set
[  387.047697] binder: 17757:17763 ioctl 40046207 0 returned -16
[  387.049118] binder: 17757:17769 Release 1 refcount change on invalid ref 1 ret -22
05:02:37 executing program 2:
r0 = syz_open_dev$sndtimer(&(0x7f0000026000)='/dev/snd/timer\x00', 0x0, 0x0)
r1 = dup3(r0, r0, 0x80000)
ioctl$UI_GET_SYSNAME(r1, 0x8040552c, 0x0)
perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8)
r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c)
bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r2, &(0x7f0000000040), 0x0, 0x1}, 0x20)
openat$cgroup_ro(r1, &(0x7f00000004c0)='cpuset.effective_cpus\x00', 0x0, 0x0)
unlink(0x0)
r3 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r4 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r4, 0x0)
ioctl$BINDER_GET_NODE_DEBUG_INFO(r3, 0xc018620b, &(0x7f0000000780))
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f00000000c0)=[@enter_looper], 0x48, 0x0, &(0x7f0000000700)="2ba063fb309ec7fdbfb08e6e91baee7d7d4599fe14129a4d426834556ae420e087d59c0c7be7fcad1abb7e1f8f446f373f611ca1ee9c2231708e18a47bc68a2a79a0b48931f6ff6d"})
ioctl$sock_inet_tcp_SIOCOUTQNSD(r1, 0x894b, &(0x7f0000000480))
getsockopt$inet_IP_IPSEC_POLICY(0xffffffffffffffff, 0x0, 0x10, &(0x7f0000000540)={{{@in6, @in=@remote}}, {{@in6=@ipv4={[], [], @local}}, 0x0, @in6}}, &(0x7f0000000000)=0xe8)
ioctl$BINDER_SET_CONTEXT_MGR(r4, 0x40046207, 0x0)
r5 = dup(r4)
shutdown(r5, 0x1)
prctl$PR_SET_NAME(0xf, &(0x7f0000000380)='/group.stat\x00')
syz_open_dev$binder(&(0x7f0000000880)='/dev/binder#\x00', 0x0, 0x2)
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)})
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, &(0x7f0000000780)})
ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f0000000680)})
creat(&(0x7f00000000c0)='./file0\x00', 0x0)
openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000100)='/group.stat\x00', 0x2761, 0x0)
clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000080), 0xffffffffffffffff)
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000003c0)={0x14, 0x0, &(0x7f0000000680)=[@acquire_done], 0x0, 0x0, 0x0})

05:02:37 executing program 4:
r0 = openat$audio(0xffffffffffffff9c, &(0x7f0000000140)='/dev/audio\x00', 0x0, 0x0)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
read$eventfd(r0, &(0x7f0000000000), 0x3)
ioctl$CAPI_NCCI_OPENCOUNT(r0, 0x80044326, &(0x7f0000000040)=0x5)

05:02:37 executing program 3:
recvmmsg(0xffffffffffffffff, &(0x7f0000003140)=[{{&(0x7f0000001400)=@ipx, 0x80, 0x0}}], 0x1, 0x0, 0x0)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = syz_open_procfs(0x0, &(0x7f00000004c0)='net/rt_cache\x00')
preadv(r0, &(0x7f00000017c0), 0xba, 0x0)

05:02:37 executing program 1:
r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000200)='/dev/nullb0\x00', 0x5000000084002, 0x0)
mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x200000e, 0x13, r0, 0x0)
r1 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x4000, 0x0)
preadv(r1, &(0x7f0000000040)=[{&(0x7f0000000400)=""/4096, 0x3ffc26}], 0x1, 0x0)

05:02:37 executing program 0:
recvmmsg(0xffffffffffffffff, &(0x7f0000003140)=[{{&(0x7f0000001400)=@ipx, 0x80, 0x0}}], 0x1, 0x0, 0x0)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = syz_open_procfs(0x0, &(0x7f00000004c0)='net/rt_cache\x00')
preadv(r0, &(0x7f00000017c0), 0xb4, 0x0)

[  387.374752] binder: 17787 RLIMIT_NICE not set
[  387.387853] binder: BINDER_SET_CONTEXT_MGR already set
[  387.412136] binder: 17783:17787 ioctl 40046207 0 returned -16
05:02:37 executing program 5:
r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x75c, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$vcsa(&(0x7f00000001c0)='/dev/vcsa#\x00', 0x80006, 0x0)
setsockopt$inet_sctp_SCTP_DELAYED_SACK(r1, 0x84, 0x10, 0x0, 0x0)
r2 = socket$inet6(0xa, 0x1, 0x8010000000000084)
bind$inet6(r2, &(0x7f0000ef8cfd)={0xa, 0x4e23, 0x0, @loopback}, 0x1c)
listen(r2, 0x5)
r3 = socket$inet6_sctp(0xa, 0x5, 0x84)
r4 = accept4(r2, 0x0, 0x0, 0x0)
setsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX_OLD(r3, 0x84, 0x6b, &(0x7f000055bfe4)=[@in6={0xa, 0x4e23, 0x0, @loopback}], 0x1c)
recvmmsg(r3, &(0x7f0000006940)=[{{0x0, 0x0, 0x0}}], 0x500, 0x0, 0x0)
ioctl$KVM_SET_SIGNAL_MASK(r0, 0x4004ae8b, &(0x7f0000000080)=ANY=[@ANYBLOB="59000000e2e49c2cf2a3c41fe14a683c9a16da471a87c856a67835dd44f9a7c930b6b42f4a9bb78c4434562d65ade5411f3ac6905520e49c226f38f10e29d91b4e6946e59d28c67269d270f63dd781880872d510057aa96aebb918a5176396bb899c4b304f07775ed5"])
write$nbd(r4, &(0x7f0000000140)=ANY=[@ANYPTR=&(0x7f0000000100)=ANY=[@ANYRESOCT=0x0, @ANYRES16=r0]], 0x1)

05:02:37 executing program 3:
recvmmsg(0xffffffffffffffff, &(0x7f0000003140)=[{{&(0x7f0000001400)=@ipx, 0x80, 0x0}}], 0x1, 0x0, 0x0)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = syz_open_procfs(0x0, &(0x7f00000004c0)='net/rt_cache\x00')
preadv(r0, &(0x7f00000017c0), 0xbb, 0x0)

05:02:37 executing program 0:
recvmmsg(0xffffffffffffffff, &(0x7f0000003140)=[{{&(0x7f0000001400)=@ipx, 0x80, 0x0}}], 0x1, 0x0, 0x0)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = syz_open_procfs(0x0, &(0x7f00000004c0)='net/rt_cache\x00')
preadv(r0, &(0x7f00000017c0), 0xb5, 0x0)

05:02:37 executing program 1:
r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000200)='/dev/nullb0\x00', 0x5000000084002, 0x0)
mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x200000e, 0x13, r0, 0x0)
r1 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x4000, 0x0)
preadv(r1, &(0x7f0000000040)=[{&(0x7f0000000400)=""/4096, 0x3ffc27}], 0x1, 0x0)

[  387.502562] binder: 17783:17798 BC_INCREFS_DONE node 619 has no pending increfs request
05:02:37 executing program 0:
recvmmsg(0xffffffffffffffff, &(0x7f0000003140)=[{{&(0x7f0000001400)=@ipx, 0x80, 0x0}}], 0x1, 0x0, 0x0)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = syz_open_procfs(0x0, &(0x7f00000004c0)='net/rt_cache\x00')
preadv(r0, &(0x7f00000017c0), 0xb6, 0x0)

05:02:37 executing program 3:
recvmmsg(0xffffffffffffffff, &(0x7f0000003140)=[{{&(0x7f0000001400)=@ipx, 0x80, 0x0}}], 0x1, 0x0, 0x0)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = syz_open_procfs(0x0, &(0x7f00000004c0)='net/rt_cache\x00')
preadv(r0, &(0x7f00000017c0), 0xbc, 0x0)

[  387.589559] binder: 17783:17812 Release 1 refcount change on invalid ref 1 ret -22
[  387.595998] binder: 17783:17798 BC_ACQUIRE_DONE node 619 has no pending acquire request
05:02:38 executing program 2:
r0 = syz_open_dev$sndtimer(&(0x7f0000026000)='/dev/snd/timer\x00', 0x0, 0x0)
r1 = dup3(r0, r0, 0x80000)
ioctl$UI_GET_SYSNAME(r1, 0x8040552c, 0x0)
perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8)
r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c)
bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r2, &(0x7f0000000040), 0x0, 0x1}, 0x20)
openat$cgroup_ro(r1, &(0x7f00000004c0)='cpuset.effective_cpus\x00', 0x0, 0x0)
unlink(&(0x7f0000000900)='./file0/file0\x00')
r3 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
r4 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r4, 0x0)
ioctl$BINDER_GET_NODE_DEBUG_INFO(r3, 0xc018620b, &(0x7f0000000780))
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f00000000c0)=[@enter_looper], 0x48, 0x0, &(0x7f0000000700)="2ba063fb309ec7fdbfb08e6e91baee7d7d4599fe14129a4d426834556ae420e087d59c0c7be7fcad1abb7e1f8f446f373f611ca1ee9c2231708e18a47bc68a2a79a0b48931f6ff6d"})
ioctl$sock_inet_tcp_SIOCOUTQNSD(r1, 0x894b, &(0x7f0000000480))
getsockopt$inet_IP_IPSEC_POLICY(0xffffffffffffffff, 0x0, 0x10, &(0x7f0000000540)={{{@in6, @in=@remote}}, {{@in6=@ipv4={[], [], @local}}, 0x0, @in6}}, &(0x7f0000000000)=0xe8)
ioctl$BINDER_SET_CONTEXT_MGR(r4, 0x40046207, 0x0)
r5 = dup(r4)
shutdown(r5, 0x1)
prctl$PR_SET_NAME(0xf, &(0x7f0000000380)='/group.stat\x00')
syz_open_dev$binder(&(0x7f0000000880)='/dev/binder#\x00', 0x0, 0x2)
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)})
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, &(0x7f0000000780)})
ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f0000000680)})
creat(&(0x7f00000000c0)='./file0\x00', 0x0)
openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000100)='/group.stat\x00', 0x2761, 0x0)
clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000080), 0xffffffffffffffff)
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000003c0)={0x14, 0x0, &(0x7f0000000680)=[@acquire_done], 0x0, 0x0, 0x0})

05:02:38 executing program 1:
r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000200)='/dev/nullb0\x00', 0x5000000084002, 0x0)
mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x200000e, 0x13, r0, 0x0)
r1 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x4000, 0x0)
preadv(r1, &(0x7f0000000040)=[{&(0x7f0000000400)=""/4096, 0x3ffc28}], 0x1, 0x0)

[  387.893448] binder: BINDER_SET_CONTEXT_MGR already set
05:02:38 executing program 4:
perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10000003, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$audion(&(0x7f00000000c0)='/dev/audio#\x00', 0x9, 0x40000)
ioctl$TIOCMBIS(r0, 0x5416, &(0x7f0000000100)=0x5)
r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000003c0)='./cgroup\x00', 0x200002, 0x0)
fchdir(r1)
r2 = open(&(0x7f0000000000)='./file0\x00', 0x0, 0x0)
r3 = openat$cgroup_procs(r2, &(0x7f0000000080)='cgroup.procs\x00', 0x2, 0x0)
write$cgroup_pid(r3, &(0x7f0000000040), 0x12)

05:02:38 executing program 3:
recvmmsg(0xffffffffffffffff, &(0x7f0000003140)=[{{&(0x7f0000001400)=@ipx, 0x80, 0x0}}], 0x1, 0x0, 0x0)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = syz_open_procfs(0x0, &(0x7f00000004c0)='net/rt_cache\x00')
preadv(r0, &(0x7f00000017c0), 0xbd, 0x0)

05:02:38 executing program 0:
recvmmsg(0xffffffffffffffff, &(0x7f0000003140)=[{{&(0x7f0000001400)=@ipx, 0x80, 0x0}}], 0x1, 0x0, 0x0)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = syz_open_procfs(0x0, &(0x7f00000004c0)='net/rt_cache\x00')
preadv(r0, &(0x7f00000017c0), 0xb7, 0x0)

05:02:38 executing program 1:
r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000200)='/dev/nullb0\x00', 0x5000000084002, 0x0)
mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x200000e, 0x13, r0, 0x0)
r1 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x4000, 0x0)
preadv(r1, &(0x7f0000000040)=[{&(0x7f0000000400)=""/4096, 0x3ffc29}], 0x1, 0x0)

[  387.930863] binder: 17832:17835 ioctl 40046207 0 returned -16
[  387.975630] binder: 17832:17835 Release 1 refcount change on invalid ref 1 ret -22
05:02:38 executing program 5:
r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x75c, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$vcsa(&(0x7f00000001c0)='/dev/vcsa#\x00', 0x80006, 0x0)
setsockopt$inet_sctp_SCTP_DELAYED_SACK(r1, 0x84, 0x10, 0x0, 0x0)
r2 = socket$inet6(0xa, 0x1, 0x8010000000000084)
bind$inet6(r2, &(0x7f0000ef8cfd)={0xa, 0x4e23, 0x0, @loopback}, 0x1c)
listen(r2, 0x5)
r3 = socket$inet6_sctp(0xa, 0x5, 0x84)
r4 = accept4(r2, 0x0, 0x0, 0x0)
setsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX_OLD(r3, 0x84, 0x6b, &(0x7f000055bfe4)=[@in6={0xa, 0x4e23, 0x0, @loopback}], 0x1c)
recvmmsg(r3, &(0x7f0000006940)=[{{0x0, 0x0, 0x0}}], 0x500, 0x0, 0x0)
ioctl$KVM_SET_SIGNAL_MASK(r0, 0x4004ae8b, &(0x7f0000000080)=ANY=[@ANYBLOB="59000000e2e49c2cf2a3c41fe14a683c9a16da471a87c856a67835dd44f9a7c930b6b42f4a9bb78c4434562d65ade5411f3ac6905520e49c226f38f10e29d91b4e6946e59d28c67269d270f63dd781880872d510057aa96aebb918a5176396bb899c4b304f07775ed5"])
write$nbd(r4, &(0x7f0000000140)=ANY=[@ANYPTR=&(0x7f0000000100)=ANY=[@ANYRESOCT=0x0, @ANYRES16=r0]], 0x1)

05:02:38 executing program 2:
r0 = syz_open_dev$sndtimer(&(0x7f0000026000)='/dev/snd/timer\x00', 0x0, 0x0)
r1 = dup3(r0, r0, 0x80000)
ioctl$UI_GET_SYSNAME(r1, 0x8040552c, 0x0)
perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8)
r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c)
bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r2, &(0x7f0000000040), 0x0, 0x1}, 0x20)
openat$cgroup_ro(r1, &(0x7f00000004c0)='cpuset.effective_cpus\x00', 0x0, 0x0)
unlink(&(0x7f0000000900)='./file0/file0\x00')
r3 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
r4 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r4, 0x0)
ioctl$BINDER_GET_NODE_DEBUG_INFO(r3, 0xc018620b, &(0x7f0000000780))
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f00000000c0)=[@enter_looper], 0x48, 0x0, &(0x7f0000000700)="2ba063fb309ec7fdbfb08e6e91baee7d7d4599fe14129a4d426834556ae420e087d59c0c7be7fcad1abb7e1f8f446f373f611ca1ee9c2231708e18a47bc68a2a79a0b48931f6ff6d"})
ioctl$sock_inet_tcp_SIOCOUTQNSD(r1, 0x894b, &(0x7f0000000480))
getsockopt$inet_IP_IPSEC_POLICY(0xffffffffffffffff, 0x0, 0x10, &(0x7f0000000540)={{{@in6, @in=@remote}}, {{@in6=@ipv4={[], [], @local}}, 0x0, @in6}}, &(0x7f0000000000)=0xe8)
ioctl$BINDER_SET_CONTEXT_MGR(r4, 0x40046207, 0x0)
r5 = dup(r4)
shutdown(r5, 0x1)
prctl$PR_SET_NAME(0xf, &(0x7f0000000380)='/group.stat\x00')
syz_open_dev$binder(&(0x7f0000000880)='/dev/binder#\x00', 0x0, 0x2)
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)})
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, &(0x7f0000000780)})
ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f0000000680)})
creat(&(0x7f00000000c0)='./file0\x00', 0x0)
openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000100)='/group.stat\x00', 0x2761, 0x0)
clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000080), 0xffffffffffffffff)
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000003c0)={0x14, 0x0, &(0x7f0000000680)=[@acquire_done], 0x0, 0x0, 0x0})

05:02:38 executing program 3:
recvmmsg(0xffffffffffffffff, &(0x7f0000003140)=[{{&(0x7f0000001400)=@ipx, 0x80, 0x0}}], 0x1, 0x0, 0x0)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = syz_open_procfs(0x0, &(0x7f00000004c0)='net/rt_cache\x00')
preadv(r0, &(0x7f00000017c0), 0xbe, 0x0)

05:02:38 executing program 1:
r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000200)='/dev/nullb0\x00', 0x5000000084002, 0x0)
mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x200000e, 0x13, r0, 0x0)
r1 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x4000, 0x0)
preadv(r1, &(0x7f0000000040)=[{&(0x7f0000000400)=""/4096, 0x3ffc2a}], 0x1, 0x0)

05:02:38 executing program 0:
recvmmsg(0xffffffffffffffff, &(0x7f0000003140)=[{{&(0x7f0000001400)=@ipx, 0x80, 0x0}}], 0x1, 0x0, 0x0)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = syz_open_procfs(0x0, &(0x7f00000004c0)='net/rt_cache\x00')
preadv(r0, &(0x7f00000017c0), 0xb8, 0x0)

05:02:38 executing program 4:
r0 = syz_open_dev$audion(&(0x7f0000000000)='/dev/audio#\x00', 0x0, 0x4a2000)
ioctl$DRM_IOCTL_WAIT_VBLANK(r0, 0xc018643a, &(0x7f0000000080)={0x0, 0xfffffffffffffffa, 0x27})
r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0)
r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0)
ioctl$KVM_CREATE_IRQCHIP(r2, 0xae60)
r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0)
ioctl$KVM_SET_CPUID(r3, 0x4008ae8a, &(0x7f0000000280)=ANY=[@ANYBLOB="05000000400052d425910040050000d90000004000fa000000000040000300000100000054571cd5fa94d773ffb0ffffaba10000000000000a00000006ed"])
ioctl$KVM_SET_MSRS(r3, 0x4008ae89, &(0x7f0000000100)={0x1, 0x0, [{0x186, 0x0, 0x800000004403000}]})

05:02:38 executing program 3:
recvmmsg(0xffffffffffffffff, &(0x7f0000003140)=[{{&(0x7f0000001400)=@ipx, 0x80, 0x0}}], 0x1, 0x0, 0x0)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = syz_open_procfs(0x0, &(0x7f00000004c0)='net/rt_cache\x00')
preadv(r0, &(0x7f00000017c0), 0xbf, 0x0)

[  388.476665] binder: BINDER_SET_CONTEXT_MGR already set
05:02:38 executing program 1:
r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000200)='/dev/nullb0\x00', 0x5000000084002, 0x0)
mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x200000e, 0x13, r0, 0x0)
r1 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x4000, 0x0)
preadv(r1, &(0x7f0000000040)=[{&(0x7f0000000400)=""/4096, 0x3ffc2b}], 0x1, 0x0)

[  388.500845] binder: 17861:17870 ioctl 40046207 0 returned -16
[  388.527109] binder: 17861:17882 Release 1 refcount change on invalid ref 1 ret -22
05:02:38 executing program 0:
recvmmsg(0xffffffffffffffff, &(0x7f0000003140)=[{{&(0x7f0000001400)=@ipx, 0x80, 0x0}}], 0x1, 0x0, 0x0)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = syz_open_procfs(0x0, &(0x7f00000004c0)='net/rt_cache\x00')
preadv(r0, &(0x7f00000017c0), 0xb9, 0x0)

05:02:39 executing program 3:
recvmmsg(0xffffffffffffffff, &(0x7f0000003140)=[{{&(0x7f0000001400)=@ipx, 0x80, 0x0}}], 0x1, 0x0, 0x0)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = syz_open_procfs(0x0, &(0x7f00000004c0)='net/rt_cache\x00')
preadv(r0, &(0x7f00000017c0), 0xc0, 0x0)

[  388.629738] cgroup: fork rejected by pids controller in /syz2
05:02:39 executing program 4:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route(r0, &(0x7f00000005c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000000)=ANY=[@ANYBLOB="2800000010000108000000000000000000000000", @ANYRES32=0x0, @ANYBLOB="000000000040000008001b0000000000655de216ab831edbd7426d8eb96ac0a231896e7afe0e26ded060c9e7a3418df22c306b5e3e4e9b05433f86e38a97f7106c19bdc8b110ed56d4a3f234880bda2dadff6000fb4ee375574e985fd35ee9d21011a24e5490bcecf3f8e91caa92edfa11538edea967b13cbc389beaae31e92ddd44a12e6b4ca3260325a31f655c36d4d962"], 0x28}}, 0x0)

05:02:39 executing program 1:
r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000200)='/dev/nullb0\x00', 0x5000000084002, 0x0)
mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x200000e, 0x13, r0, 0x0)
r1 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x4000, 0x0)
preadv(r1, &(0x7f0000000040)=[{&(0x7f0000000400)=""/4096, 0x3ffc2c}], 0x1, 0x0)

[  388.806452] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready
[  388.938319] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready
05:02:39 executing program 5:
r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x75c, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$vcsa(&(0x7f00000001c0)='/dev/vcsa#\x00', 0x80006, 0x0)
setsockopt$inet_sctp_SCTP_DELAYED_SACK(r1, 0x84, 0x10, 0x0, 0x0)
r2 = socket$inet6(0xa, 0x1, 0x8010000000000084)
bind$inet6(r2, &(0x7f0000ef8cfd)={0xa, 0x4e23, 0x0, @loopback}, 0x1c)
listen(r2, 0x5)
r3 = socket$inet6_sctp(0xa, 0x5, 0x84)
r4 = accept4(r2, 0x0, 0x0, 0x0)
setsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX_OLD(r3, 0x84, 0x6b, &(0x7f000055bfe4)=[@in6={0xa, 0x4e23, 0x0, @loopback}], 0x1c)
recvmmsg(r3, &(0x7f0000006940)=[{{0x0, 0x0, 0x0}}], 0x500, 0x0, 0x0)
ioctl$KVM_SET_SIGNAL_MASK(r0, 0x4004ae8b, &(0x7f0000000080)=ANY=[@ANYBLOB="59000000e2e49c2cf2a3c41fe14a683c9a16da471a87c856a67835dd44f9a7c930b6b42f4a9bb78c4434562d65ade5411f3ac6905520e49c226f38f10e29d91b4e6946e59d28c67269d270f63dd781880872d510057aa96aebb918a5176396bb899c4b304f07775ed5"])
write$nbd(r4, &(0x7f0000000140)=ANY=[@ANYPTR=&(0x7f0000000100)=ANY=[@ANYRESOCT=0x0, @ANYRES16=r0]], 0x1)

05:02:39 executing program 0:
recvmmsg(0xffffffffffffffff, &(0x7f0000003140)=[{{&(0x7f0000001400)=@ipx, 0x80, 0x0}}], 0x1, 0x0, 0x0)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = syz_open_procfs(0x0, &(0x7f00000004c0)='net/rt_cache\x00')
preadv(r0, &(0x7f00000017c0), 0xba, 0x0)

05:02:39 executing program 2:
r0 = syz_open_dev$sndtimer(&(0x7f0000026000)='/dev/snd/timer\x00', 0x0, 0x0)
r1 = dup3(r0, r0, 0x80000)
ioctl$UI_GET_SYSNAME(r1, 0x8040552c, 0x0)
perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8)
r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c)
bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r2, &(0x7f0000000040), 0x0, 0x1}, 0x20)
openat$cgroup_ro(r1, &(0x7f00000004c0)='cpuset.effective_cpus\x00', 0x0, 0x0)
unlink(&(0x7f0000000900)='./file0/file0\x00')
r3 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
r4 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r4, 0x0)
ioctl$BINDER_GET_NODE_DEBUG_INFO(r3, 0xc018620b, &(0x7f0000000780))
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f00000000c0)=[@enter_looper], 0x48, 0x0, &(0x7f0000000700)="2ba063fb309ec7fdbfb08e6e91baee7d7d4599fe14129a4d426834556ae420e087d59c0c7be7fcad1abb7e1f8f446f373f611ca1ee9c2231708e18a47bc68a2a79a0b48931f6ff6d"})
ioctl$sock_inet_tcp_SIOCOUTQNSD(r1, 0x894b, &(0x7f0000000480))
getsockopt$inet_IP_IPSEC_POLICY(0xffffffffffffffff, 0x0, 0x10, &(0x7f0000000540)={{{@in6, @in=@remote}}, {{@in6=@ipv4={[], [], @local}}, 0x0, @in6}}, &(0x7f0000000000)=0xe8)
ioctl$BINDER_SET_CONTEXT_MGR(r4, 0x40046207, 0x0)
r5 = dup(r4)
shutdown(r5, 0x1)
prctl$PR_SET_NAME(0xf, &(0x7f0000000380)='/group.stat\x00')
syz_open_dev$binder(&(0x7f0000000880)='/dev/binder#\x00', 0x0, 0x2)
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)})
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, &(0x7f0000000780)})
ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f0000000680)})
creat(&(0x7f00000000c0)='./file0\x00', 0x0)
openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000100)='/group.stat\x00', 0x2761, 0x0)
clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000080), 0xffffffffffffffff)
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000003c0)={0x14, 0x0, &(0x7f0000000680)=[@acquire_done], 0x0, 0x0, 0x0})

05:02:39 executing program 3:
recvmmsg(0xffffffffffffffff, &(0x7f0000003140)=[{{&(0x7f0000001400)=@ipx, 0x80, 0x0}}], 0x1, 0x0, 0x0)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = syz_open_procfs(0x0, &(0x7f00000004c0)='net/rt_cache\x00')
preadv(r0, &(0x7f00000017c0), 0xc1, 0x0)

05:02:39 executing program 1:
r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000200)='/dev/nullb0\x00', 0x5000000084002, 0x0)
mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x200000e, 0x13, r0, 0x0)
r1 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x4000, 0x0)
preadv(r1, &(0x7f0000000040)=[{&(0x7f0000000400)=""/4096, 0x3ffc2d}], 0x1, 0x0)

05:02:39 executing program 4:
r0 = syz_open_dev$sndtimer(&(0x7f0000026000)='/dev/snd/timer\x00', 0x0, 0x0)
r1 = dup3(r0, r0, 0x80000)
ioctl$UI_GET_SYSNAME(r1, 0x8040552c, 0x0)
perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8)
r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c)
bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r2, &(0x7f0000000040), 0x0, 0x1}, 0x20)
openat$cgroup_ro(r1, &(0x7f00000004c0)='cpuset.effective_cpus\x00', 0x0, 0x0)
unlink(&(0x7f0000000900)='./file0/file0\x00')
r3 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
r4 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r4, 0x0)
ioctl$BINDER_GET_NODE_DEBUG_INFO(r3, 0xc018620b, &(0x7f0000000780))
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f00000000c0)=[@enter_looper], 0x48, 0x0, &(0x7f0000000700)="2ba063fb309ec7fdbfb08e6e91baee7d7d4599fe14129a4d426834556ae420e087d59c0c7be7fcad1abb7e1f8f446f373f611ca1ee9c2231708e18a47bc68a2a79a0b48931f6ff6d"})
ioctl$sock_inet_tcp_SIOCOUTQNSD(r1, 0x894b, &(0x7f0000000480))
getsockopt$inet_IP_IPSEC_POLICY(0xffffffffffffffff, 0x0, 0x10, &(0x7f0000000540)={{{@in6, @in=@remote}}, {{@in6=@ipv4={[], [], @local}}, 0x0, @in6}}, &(0x7f0000000000)=0xe8)
ioctl$BINDER_SET_CONTEXT_MGR(r4, 0x40046207, 0x0)
r5 = dup(r4)
shutdown(r5, 0x1)
prctl$PR_SET_NAME(0xf, &(0x7f0000000380)='/group.stat\x00')
syz_open_dev$binder(&(0x7f0000000880)='/dev/binder#\x00', 0x0, 0x2)
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)})
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, &(0x7f0000000780)})
ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f0000000680)})
creat(&(0x7f00000000c0)='./file0\x00', 0x0)
openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000100)='/group.stat\x00', 0x2761, 0x0)
clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000080), 0xffffffffffffffff)
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000003c0)={0x14, 0x0, &(0x7f0000000680)=[@acquire_done], 0x0, 0x0, 0x0})

[  389.342138] binder: BINDER_SET_CONTEXT_MGR already set
[  389.398125] binder: BINDER_SET_CONTEXT_MGR already set
05:02:39 executing program 0:
recvmmsg(0xffffffffffffffff, &(0x7f0000003140)=[{{&(0x7f0000001400)=@ipx, 0x80, 0x0}}], 0x1, 0x0, 0x0)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = syz_open_procfs(0x0, &(0x7f00000004c0)='net/rt_cache\x00')
preadv(r0, &(0x7f00000017c0), 0xbb, 0x0)

[  389.424551] binder: 17919:17920 ioctl 40046207 0 returned -16
[  389.425975] binder: 17919:17935 Release 1 refcount change on invalid ref 1 ret -22
[  389.438573] binder: 17925:17927 ioctl 40046207 0 returned -16
05:02:39 executing program 1:
r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000200)='/dev/nullb0\x00', 0x5000000084002, 0x0)
mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x200000e, 0x13, r0, 0x0)
r1 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x4000, 0x0)
preadv(r1, &(0x7f0000000040)=[{&(0x7f0000000400)=""/4096, 0x3ffc2e}], 0x1, 0x0)

[  389.545982] binder: 17925:17927 Release 1 refcount change on invalid ref 1 ret -22
05:02:40 executing program 0:
recvmmsg(0xffffffffffffffff, &(0x7f0000003140)=[{{&(0x7f0000001400)=@ipx, 0x80, 0x0}}], 0x1, 0x0, 0x0)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = syz_open_procfs(0x0, &(0x7f00000004c0)='net/rt_cache\x00')
preadv(r0, &(0x7f00000017c0), 0xbc, 0x0)

05:02:40 executing program 3:
recvmmsg(0xffffffffffffffff, &(0x7f0000003140)=[{{&(0x7f0000001400)=@ipx, 0x80, 0x0}}], 0x1, 0x0, 0x0)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = syz_open_procfs(0x0, &(0x7f00000004c0)='net/rt_cache\x00')
preadv(r0, &(0x7f00000017c0), 0xc2, 0x0)

05:02:40 executing program 4:
ioctl$DRM_IOCTL_SET_VERSION(0xffffffffffffffff, 0xc0106407, &(0x7f0000000140)={0x100000001, 0x2})
ioctl$DRM_IOCTL_GET_UNIQUE(0xffffffffffffffff, 0xc0106401, &(0x7f0000000180)={0xeeba9721698b2470, 0x0})
r0 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000040)='/dev/snapshot\x00', 0x400000, 0x0)
ioctl$TIOCGPGRP(r0, 0x540f, &(0x7f00000001c0)=<r1=>0x0)
sched_setaffinity(r1, 0x8, &(0x7f0000000200)=0x80000001)
bpf$BPF_GET_PROG_INFO(0xf, &(0x7f0000000100)={r0, 0x50, &(0x7f0000000080)}, 0x10)

05:02:40 executing program 0:
recvmmsg(0xffffffffffffffff, &(0x7f0000003140)=[{{&(0x7f0000001400)=@ipx, 0x80, 0x0}}], 0x1, 0x0, 0x0)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = syz_open_procfs(0x0, &(0x7f00000004c0)='net/rt_cache\x00')
preadv(r0, &(0x7f00000017c0), 0xbd, 0x0)

05:02:40 executing program 5:
r0 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rtc0\x00', 0x400, 0x0)
ioctl$PIO_UNIMAP(r0, 0x4b67, &(0x7f0000000080)={0x1, &(0x7f0000000040)=[{0x2, 0x80000000}]})
ioctl$KDSETLED(r0, 0x4b32, 0x9)
r1 = semget$private(0x0, 0x2, 0x52)
semctl$SETVAL(r1, 0x1, 0x10, &(0x7f00000000c0)=0x4)
semctl$GETNCNT(0x0, 0xfffffffffffffffe, 0xe, 0x0)

05:02:40 executing program 1:
r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000200)='/dev/nullb0\x00', 0x5000000084002, 0x0)
mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x200000e, 0x13, r0, 0x0)
r1 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x4000, 0x0)
preadv(r1, &(0x7f0000000040)=[{&(0x7f0000000400)=""/4096, 0x3ffc2f}], 0x1, 0x0)

05:02:40 executing program 2:
r0 = syz_open_dev$sndtimer(&(0x7f0000026000)='/dev/snd/timer\x00', 0x0, 0x0)
r1 = dup3(r0, r0, 0x80000)
ioctl$UI_GET_SYSNAME(r1, 0x8040552c, 0x0)
perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8)
r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c)
bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r2, &(0x7f0000000040), 0x0, 0x1}, 0x20)
openat$cgroup_ro(r1, &(0x7f00000004c0)='cpuset.effective_cpus\x00', 0x0, 0x0)
unlink(&(0x7f0000000900)='./file0/file0\x00')
r3 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r4 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r4, 0x0)
ioctl$BINDER_GET_NODE_DEBUG_INFO(r3, 0xc018620b, &(0x7f0000000780))
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f00000000c0)=[@enter_looper], 0x48, 0x0, &(0x7f0000000700)="2ba063fb309ec7fdbfb08e6e91baee7d7d4599fe14129a4d426834556ae420e087d59c0c7be7fcad1abb7e1f8f446f373f611ca1ee9c2231708e18a47bc68a2a79a0b48931f6ff6d"})
ioctl$sock_inet_tcp_SIOCOUTQNSD(r1, 0x894b, &(0x7f0000000480))
getsockopt$inet_IP_IPSEC_POLICY(0xffffffffffffffff, 0x0, 0x10, &(0x7f0000000540)={{{@in6, @in=@remote}}, {{@in6=@ipv4={[], [], @local}}, 0x0, @in6}}, &(0x7f0000000000)=0xe8)
ioctl$BINDER_SET_CONTEXT_MGR(r4, 0x40046207, 0x0)
r5 = dup(r4)
shutdown(r5, 0x1)
prctl$PR_SET_NAME(0xf, &(0x7f0000000380)='/group.stat\x00')
syz_open_dev$binder(&(0x7f0000000880)='/dev/binder#\x00', 0x0, 0x2)
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)})
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, &(0x7f0000000780)})
ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f0000000680)})
creat(&(0x7f00000000c0)='./file0\x00', 0x0)
openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000100)='/group.stat\x00', 0x2761, 0x0)
clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000080), 0xffffffffffffffff)
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000003c0)={0x14, 0x0, &(0x7f0000000680)=[@acquire_done], 0x0, 0x0, 0x0})

05:02:40 executing program 3:
recvmmsg(0xffffffffffffffff, &(0x7f0000003140)=[{{&(0x7f0000001400)=@ipx, 0x80, 0x0}}], 0x1, 0x0, 0x0)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = syz_open_procfs(0x0, &(0x7f00000004c0)='net/rt_cache\x00')
preadv(r0, &(0x7f00000017c0), 0xc3, 0x0)

05:02:40 executing program 0:
recvmmsg(0xffffffffffffffff, &(0x7f0000003140)=[{{&(0x7f0000001400)=@ipx, 0x80, 0x0}}], 0x1, 0x0, 0x0)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = syz_open_procfs(0x0, &(0x7f00000004c0)='net/rt_cache\x00')
preadv(r0, &(0x7f00000017c0), 0xbe, 0x0)

05:02:40 executing program 4:
r0 = gettid()
timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000))
bind$inet6(0xffffffffffffffff, 0x0, 0x0)
ioctl$sock_inet_SIOCSIFBRDADDR(0xffffffffffffffff, 0x891a, 0x0)
setsockopt$inet6_tcp_int(0xffffffffffffffff, 0x6, 0x0, 0x0, 0x0)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
futex(0x0, 0x80000000000b, 0x4, &(0x7f0000000040)={0x77359400}, 0x0, 0x0)
futex(&(0x7f000000cffc), 0xc, 0x1, &(0x7f000000d000)={0x0, 0x7f}, &(0x7f0000048000)=0x1c0000000, 0x0)
r1 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000080)='/dev/vhost-vsock\x00', 0x2, 0x0)
ioctl$VHOST_VSOCK_SET_GUEST_CID(r1, 0x4008af60, &(0x7f0000000040)={@my=0x0})
openat$udambuf(0xffffffffffffff9c, &(0x7f0000000000)='/dev/udmabuf\x00', 0x2)
r2 = socket$vsock_stream(0x28, 0x1, 0x0)
connect$vsock_dgram(r2, &(0x7f0000000200)={0x28, 0x0, 0x0, @my=0x0}, 0x10)
timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, 0x0)
shutdown(r2, 0x0)
tkill(r0, 0x1004000000016)

05:02:40 executing program 1:
r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000200)='/dev/nullb0\x00', 0x5000000084002, 0x0)
mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x200000e, 0x13, r0, 0x0)
r1 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x4000, 0x0)
preadv(r1, &(0x7f0000000040)=[{&(0x7f0000000400)=""/4096, 0x3ffc30}], 0x1, 0x0)

[  390.123163] binder: 17972 RLIMIT_NICE not set
05:02:40 executing program 5:
mmap(&(0x7f0000000000/0xff5000)=nil, 0xff5000, 0x0, 0x5c831, 0xffffffffffffffff, 0x0)
madvise(&(0x7f00006c0000/0x2000)=nil, 0x2000, 0x100000000000c)
r0 = socket$vsock_dgram(0x28, 0x2, 0x0)
r1 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000080)='/dev/snapshot\x00', 0x20000, 0x0)
ioctl$FIDEDUPERANGE(r1, 0xc0189436, &(0x7f0000000340)={0x81, 0x4, 0x2, 0x0, 0x0, [{r0, 0x0, 0x1}, {r0, 0x0, 0xfffffffffffff51b}]})
getsockopt$inet_mreqn(0xffffffffffffff9c, 0x0, 0x27, &(0x7f00000000c0)={@remote, @dev, <r2=>0x0}, &(0x7f0000000100)=0xc)
lstat(&(0x7f0000000140)='./file0\x00', &(0x7f0000000180)={0x0, 0x0, 0x0, 0x0, <r3=>0x0})
setsockopt$inet6_IPV6_IPSEC_POLICY(r1, 0x29, 0x22, &(0x7f0000000200)={{{@in6=@mcast2, @in6=@mcast1, 0x4e24, 0x20, 0x4e22, 0x401, 0xa, 0x80, 0x80, 0x67, r2, r3}, {0x0, 0x2, 0x2, 0x9, 0x1, 0xd17, 0x3, 0x4}, {0x1e2, 0x4}, 0xc4, 0x6e6bba, 0x1, 0x1, 0x2, 0x3}, {{@in=@multicast2, 0x4d3, 0x6c}, 0xa, @in6=@rand_addr="766a72c834ab4aab097c3e5639e2316f", 0x34ff, 0x2, 0x3, 0x6, 0x8, 0x7, 0x800}}, 0xe8)
ioctl$FS_IOC_GETFLAGS(r0, 0x80086601, &(0x7f0000000000))
setsockopt$IP_VS_SO_SET_DEL(r1, 0x0, 0x484, &(0x7f0000000300)={0x3f, @rand_addr=0x2, 0x4e24, 0x1, 'ovf\x00', 0x6, 0x7, 0x7d}, 0x2c)
openat$dlm_plock(0xffffffffffffff9c, &(0x7f0000000040)='/dev/dlm_plock\x00', 0x4b4500, 0x0)

05:02:40 executing program 0:
recvmmsg(0xffffffffffffffff, &(0x7f0000003140)=[{{&(0x7f0000001400)=@ipx, 0x80, 0x0}}], 0x1, 0x0, 0x0)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = syz_open_procfs(0x0, &(0x7f00000004c0)='net/rt_cache\x00')
preadv(r0, &(0x7f00000017c0), 0xbf, 0x0)

05:02:40 executing program 3:
recvmmsg(0xffffffffffffffff, &(0x7f0000003140)=[{{&(0x7f0000001400)=@ipx, 0x80, 0x0}}], 0x1, 0x0, 0x0)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = syz_open_procfs(0x0, &(0x7f00000004c0)='net/rt_cache\x00')
preadv(r0, &(0x7f00000017c0), 0xc4, 0x0)

[  390.172212] binder: BINDER_SET_CONTEXT_MGR already set
[  390.189941] binder: 17971:17993 ioctl 40046207 0 returned -16
[  390.241527] binder: 17971:17993 Release 1 refcount change on invalid ref 1 ret -22
05:02:40 executing program 1:
r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000200)='/dev/nullb0\x00', 0x5000000084002, 0x0)
mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x200000e, 0x13, r0, 0x0)
r1 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x4000, 0x0)
preadv(r1, &(0x7f0000000040)=[{&(0x7f0000000400)=""/4096, 0x3ffc31}], 0x1, 0x0)

05:02:40 executing program 5:
r0 = syz_open_dev$dri(&(0x7f0000000240)='/dev/dri/card#\x00', 0x1, 0x0)
ioctl$DRM_IOCTL_WAIT_VBLANK(r0, 0xc018643a, &(0x7f0000000000)={0x40000000, 0x0, 0x400000000000})

05:02:40 executing program 4:
r0 = gettid()
timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000))
bind$inet6(0xffffffffffffffff, 0x0, 0x0)
ioctl$sock_inet_SIOCSIFBRDADDR(0xffffffffffffffff, 0x891a, 0x0)
setsockopt$inet6_tcp_int(0xffffffffffffffff, 0x6, 0x0, 0x0, 0x0)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
futex(0x0, 0x80000000000b, 0x4, &(0x7f0000000040)={0x77359400}, 0x0, 0x0)
futex(&(0x7f000000cffc), 0xc, 0x1, &(0x7f000000d000)={0x0, 0x7f}, &(0x7f0000048000)=0x1c0000000, 0x0)
r1 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000080)='/dev/vhost-vsock\x00', 0x2, 0x0)
ioctl$VHOST_VSOCK_SET_GUEST_CID(r1, 0x4008af60, &(0x7f0000000040)={@my=0x0})
openat$udambuf(0xffffffffffffff9c, &(0x7f0000000000)='/dev/udmabuf\x00', 0x2)
r2 = socket$vsock_stream(0x28, 0x1, 0x0)
connect$vsock_dgram(r2, &(0x7f0000000200)={0x28, 0x0, 0x0, @my=0x0}, 0x10)
timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, 0x0)
shutdown(r2, 0x0)
tkill(r0, 0x1004000000016)

05:02:40 executing program 0:
recvmmsg(0xffffffffffffffff, &(0x7f0000003140)=[{{&(0x7f0000001400)=@ipx, 0x80, 0x0}}], 0x1, 0x0, 0x0)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = syz_open_procfs(0x0, &(0x7f00000004c0)='net/rt_cache\x00')
preadv(r0, &(0x7f00000017c0), 0xc0, 0x0)

05:02:41 executing program 5:
r0 = gettid()
timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000))
bind$inet6(0xffffffffffffffff, 0x0, 0x0)
ioctl$sock_inet_SIOCSIFBRDADDR(0xffffffffffffffff, 0x891a, 0x0)
setsockopt$inet6_tcp_int(0xffffffffffffffff, 0x6, 0x0, 0x0, 0x0)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
futex(0x0, 0x80000000000b, 0x4, &(0x7f0000000040)={0x77359400}, 0x0, 0x0)
futex(&(0x7f000000cffc), 0xc, 0x1, &(0x7f000000d000)={0x0, 0x7f}, &(0x7f0000048000)=0x1c0000000, 0x0)
r1 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000080)='/dev/vhost-vsock\x00', 0x2, 0x0)
ioctl$VHOST_VSOCK_SET_GUEST_CID(r1, 0x4008af60, &(0x7f0000000040)={@my=0x0})
openat$udambuf(0xffffffffffffff9c, &(0x7f0000000000)='/dev/udmabuf\x00', 0x2)
r2 = socket$vsock_stream(0x28, 0x1, 0x0)
connect$vsock_dgram(r2, &(0x7f0000000200)={0x28, 0x0, 0x0, @my=0x0}, 0x10)
timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, 0x0)
shutdown(r2, 0x0)
tkill(r0, 0x1004000000016)

05:02:41 executing program 3:
recvmmsg(0xffffffffffffffff, &(0x7f0000003140)=[{{&(0x7f0000001400)=@ipx, 0x80, 0x0}}], 0x1, 0x0, 0x0)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = syz_open_procfs(0x0, &(0x7f00000004c0)='net/rt_cache\x00')
preadv(r0, &(0x7f00000017c0), 0xc5, 0x0)

05:02:41 executing program 1:
r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000200)='/dev/nullb0\x00', 0x5000000084002, 0x0)
mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x200000e, 0x13, r0, 0x0)
r1 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x4000, 0x0)
preadv(r1, &(0x7f0000000040)=[{&(0x7f0000000400)=""/4096, 0x3ffc32}], 0x1, 0x0)

05:02:41 executing program 0:
recvmmsg(0xffffffffffffffff, &(0x7f0000003140)=[{{&(0x7f0000001400)=@ipx, 0x80, 0x0}}], 0x1, 0x0, 0x0)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = syz_open_procfs(0x0, &(0x7f00000004c0)='net/rt_cache\x00')
preadv(r0, &(0x7f00000017c0), 0xc1, 0x0)

05:02:41 executing program 2:
r0 = syz_open_dev$sndtimer(&(0x7f0000026000)='/dev/snd/timer\x00', 0x0, 0x0)
r1 = dup3(r0, r0, 0x80000)
ioctl$UI_GET_SYSNAME(r1, 0x8040552c, 0x0)
perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8)
r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c)
bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r2, &(0x7f0000000040), 0x0, 0x1}, 0x20)
openat$cgroup_ro(r1, &(0x7f00000004c0)='cpuset.effective_cpus\x00', 0x0, 0x0)
unlink(&(0x7f0000000900)='./file0/file0\x00')
r3 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r4 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r4, 0x0)
ioctl$BINDER_GET_NODE_DEBUG_INFO(r3, 0xc018620b, &(0x7f0000000780))
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f00000000c0)=[@enter_looper], 0x48, 0x0, &(0x7f0000000700)="2ba063fb309ec7fdbfb08e6e91baee7d7d4599fe14129a4d426834556ae420e087d59c0c7be7fcad1abb7e1f8f446f373f611ca1ee9c2231708e18a47bc68a2a79a0b48931f6ff6d"})
ioctl$sock_inet_tcp_SIOCOUTQNSD(r1, 0x894b, &(0x7f0000000480))
getsockopt$inet_IP_IPSEC_POLICY(0xffffffffffffffff, 0x0, 0x10, &(0x7f0000000540)={{{@in6, @in=@remote}}, {{@in6=@ipv4={[], [], @local}}, 0x0, @in6}}, &(0x7f0000000000)=0xe8)
ioctl$BINDER_SET_CONTEXT_MGR(r4, 0x40046207, 0x0)
r5 = dup(r4)
shutdown(r5, 0x1)
prctl$PR_SET_NAME(0xf, &(0x7f0000000380)='/group.stat\x00')
syz_open_dev$binder(&(0x7f0000000880)='/dev/binder#\x00', 0x0, 0x2)
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)})
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, &(0x7f0000000780)})
ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f0000000680)})
creat(&(0x7f00000000c0)='./file0\x00', 0x0)
openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000100)='/group.stat\x00', 0x2761, 0x0)
clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000080), 0xffffffffffffffff)
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000003c0)={0x14, 0x0, &(0x7f0000000680)=[@acquire_done], 0x0, 0x0, 0x0})

05:02:41 executing program 4:
syz_open_dev$sndseq(&(0x7f0000000200)='/dev/snd/seq\x00', 0x0, 0x200)
r0 = syz_open_dev$amidi(0x0, 0x0, 0x0)
ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, 0x0)
unshare(0x8020000)
getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r0, 0x84, 0x6f, &(0x7f00000000c0)={<r1=>0x0, 0x74, &(0x7f0000000000)=[@in6={0xa, 0x4e21, 0x0, @empty, 0x829f}, @in={0x2, 0x4e22, @broadcast}, @in6={0xa, 0x4e21, 0x81, @remote, 0xc7}, @in6={0xa, 0x4e22, 0x4, @initdev={0xfe, 0x88, [], 0x1, 0x0}, 0x9}, @in={0x2, 0x4e20, @broadcast}]}, &(0x7f0000000100)=0x10)
getsockopt$inet_sctp_SCTP_DEFAULT_SNDINFO(r0, 0x84, 0x22, &(0x7f0000000140)={0xfffffffffffffe00, 0x0, 0xc2, 0x0, r1}, &(0x7f0000000180)=0x10)
semget$private(0x0, 0x403, 0x0)
semop(0x0, &(0x7f0000000080)=[{0x0, 0x0, 0x1800}], 0x1)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
unshare(0x8020400)
ioctl$UFFDIO_WAKE(0xffffffffffffffff, 0x8010aa02, &(0x7f0000001680)={&(0x7f0000011000/0x2000)=nil, 0x2000})

[  390.819999] binder: release 17971:17993 transaction 621 out, still active
05:02:41 executing program 3:
recvmmsg(0xffffffffffffffff, &(0x7f0000003140)=[{{&(0x7f0000001400)=@ipx, 0x80, 0x0}}], 0x1, 0x0, 0x0)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = syz_open_procfs(0x0, &(0x7f00000004c0)='net/rt_cache\x00')
preadv(r0, &(0x7f00000017c0), 0xc6, 0x0)

05:02:41 executing program 0:
recvmmsg(0xffffffffffffffff, &(0x7f0000003140)=[{{&(0x7f0000001400)=@ipx, 0x80, 0x0}}], 0x1, 0x0, 0x0)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = syz_open_procfs(0x0, &(0x7f00000004c0)='net/rt_cache\x00')
preadv(r0, &(0x7f00000017c0), 0xc2, 0x0)

[  390.968130] binder: 18047 RLIMIT_NICE not set
05:02:41 executing program 1:
r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000200)='/dev/nullb0\x00', 0x5000000084002, 0x0)
mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x200000e, 0x13, r0, 0x0)
r1 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x4000, 0x0)
preadv(r1, &(0x7f0000000040)=[{&(0x7f0000000400)=""/4096, 0x3ffc33}], 0x1, 0x0)

[  391.026122] binder: BINDER_SET_CONTEXT_MGR already set
05:02:41 executing program 5:
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x25d1}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = socket(0x4, 0x80800, 0x0)
setsockopt$SO_VM_SOCKETS_BUFFER_SIZE(r0, 0x28, 0x0, &(0x7f0000000100)=0x8, 0x8)
r1 = memfd_create(&(0x7f0000000080)='\x00\x00\x06\x00\x00\x00\x00\x00\x00\x00', 0x7)
getsockopt$inet_sctp_SCTP_PEER_AUTH_CHUNKS(r0, 0x84, 0x1a, &(0x7f0000000140)={<r2=>0x0, 0x4, "71ec6d58"}, &(0x7f0000000180)=0xc)
setsockopt$inet_sctp_SCTP_CONTEXT(r0, 0x84, 0x11, &(0x7f00000001c0)={r2, 0x7}, 0x8)
setsockopt$XDP_RX_RING(0xffffffffffffffff, 0x11b, 0x2, 0x0, 0x0)
execveat(r1, &(0x7f0000000000)='\x00', 0x0, 0x0, 0x1000)
openat$null(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/null\x00', 0x400001, 0x0)

[  391.074034] binder: 18046:18053 ioctl 40046207 0 returned -16
[  391.106169] binder: 18046:18053 Release 1 refcount change on invalid ref 1 ret -22
05:02:41 executing program 3:
recvmmsg(0xffffffffffffffff, &(0x7f0000003140)=[{{&(0x7f0000001400)=@ipx, 0x80, 0x0}}], 0x1, 0x0, 0x0)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = syz_open_procfs(0x0, &(0x7f00000004c0)='net/rt_cache\x00')
preadv(r0, &(0x7f00000017c0), 0xc7, 0x0)

05:02:41 executing program 1:
r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000200)='/dev/nullb0\x00', 0x5000000084002, 0x0)
mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x200000e, 0x13, r0, 0x0)
r1 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x4000, 0x0)
preadv(r1, &(0x7f0000000040)=[{&(0x7f0000000400)=""/4096, 0x3ffc34}], 0x1, 0x0)

05:02:41 executing program 0:
recvmmsg(0xffffffffffffffff, &(0x7f0000003140)=[{{&(0x7f0000001400)=@ipx, 0x80, 0x0}}], 0x1, 0x0, 0x0)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = syz_open_procfs(0x0, &(0x7f00000004c0)='net/rt_cache\x00')
preadv(r0, &(0x7f00000017c0), 0xc3, 0x0)

05:02:41 executing program 3:
recvmmsg(0xffffffffffffffff, &(0x7f0000003140)=[{{&(0x7f0000001400)=@ipx, 0x80, 0x0}}], 0x1, 0x0, 0x0)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = syz_open_procfs(0x0, &(0x7f00000004c0)='net/rt_cache\x00')
preadv(r0, &(0x7f00000017c0), 0xc8, 0x0)

05:02:41 executing program 5:
r0 = socket$inet_udplite(0x2, 0x2, 0x88)
ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070")
openat$ashmem(0xffffffffffffff9c, 0x0, 0x0, 0x0)
write$P9_RREAD(0xffffffffffffffff, &(0x7f00000001c0)=ANY=[], 0x0)
getsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x11, &(0x7f0000000200)={{{@in, @in=@multicast2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, <r1=>0x0}}, {{@in6}, 0x0, @in=@remote}}, &(0x7f0000000300)=0xe8)
sendmmsg(0xffffffffffffffff, &(0x7f00000058c0), 0x0, 0x0)
perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r2 = socket$inet6_tcp(0xa, 0x1, 0x0)
r3 = dup2(r2, r2)
clone(0x2102001ffd, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
setsockopt$EBT_SO_SET_COUNTERS(r3, 0x0, 0x81, &(0x7f00000000c0)=ANY=[@ANYBLOB="62726f6eaf29b0000000000000000000000000000000000000f40fe4fe0000000000000000000000000000000000000000000000000000000000000000000000000000000000ee2187a9f437b575a9a71f313e836f990000000000000000000000000000000000000000000000000000010000000000000000000000000000000000000000000000"], 0x88)
ioctl$KVM_SET_CPUID(0xffffffffffffffff, 0x4008ae8a, 0x0)
r4 = socket$alg(0x26, 0x5, 0x0)
ioctl$SNDRV_SEQ_IOCTL_CLIENT_ID(r3, 0x80045301, &(0x7f0000000080))
ioctl$KVM_SIGNAL_MSI(r3, 0x4020aea5, &(0x7f0000000000)={0x6002, 0x10002, 0x800, 0x6, 0x6})
openat$null(0xffffffffffffff9c, 0x0, 0x0, 0x0)
sendmsg$nl_route_sched(0xffffffffffffffff, 0x0, 0x0)
bind$alg(0xffffffffffffffff, 0x0, 0x0)
bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000400)={r3, &(0x7f0000000180)="8ee5eb4388ee76e2ae5b18a23a5e329f76bc1ef734ba39a85f058c850ab6aec1334cfb4f15741733d8614ed5249f26c74adc7ec294678a2086146dc1434e86a68deedddd01e7310670cc16b4c3022384bdfcf5e8a75dcaebbad744232a41046cd529ba52069bedbd165967b4993969", &(0x7f0000000340)="5264479c229e9d34ad43c195ef4ebee499e175dfeed69b885b7bf0e2448cb79b23b2c505109873c3af4cf001b3b6df585d18c177642f78800f6a8d507ae36c5faad5484a02d14d417018a88733151d3e3bcde14c02569dfa39f79ec6002d1ae7e46a183c0a6d8fe13280a5880631e494c137c659f5bfb991d45b5e461bd09315123a98fe322aaed9777821ac2f779194eb90c3d2574c09fcba129b08e87b7d3f3d7f2ab9d36200a501a45f5852ce9a0bbdf15e706d8a57978686", 0x2}, 0x20)
r5 = accept4(0xffffffffffffffff, 0x0, 0x0, 0x0)
r6 = getegid()
write$FUSE_ATTR(r3, &(0x7f00000004c0)={0x78, 0x0, 0x8, {0xffffffff, 0x2, 0x0, {0x1, 0x6, 0x7f, 0x5, 0x7, 0x6, 0x8000, 0x7, 0x0, 0x0, 0x4, r1, r6, 0x1, 0x100}}}, 0x78)
sendmsg$xdp(r5, 0x0, 0x3)
getsockopt$inet_sctp6_SCTP_PR_SUPPORTED(r3, 0x84, 0x71, &(0x7f0000000540)={<r7=>0x0, 0x1000}, &(0x7f0000000580)=0x8)
setsockopt$inet_sctp_SCTP_AUTH_DEACTIVATE_KEY(r5, 0x84, 0x23, &(0x7f00000005c0)={r7, 0x6}, 0x8)
ppoll(0x0, 0x0, 0x0, 0x0, 0x0)
r8 = fcntl$getown(r4, 0x9)
prlimit64(r8, 0x0, &(0x7f0000000440)={0x2, 0x8}, &(0x7f0000000480))

05:02:41 executing program 1:
r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000200)='/dev/nullb0\x00', 0x5000000084002, 0x0)
mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x200000e, 0x13, r0, 0x0)
r1 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x4000, 0x0)
preadv(r1, &(0x7f0000000040)=[{&(0x7f0000000400)=""/4096, 0x3ffc35}], 0x1, 0x0)

05:02:42 executing program 2:
r0 = syz_open_dev$sndtimer(&(0x7f0000026000)='/dev/snd/timer\x00', 0x0, 0x0)
r1 = dup3(r0, r0, 0x80000)
ioctl$UI_GET_SYSNAME(r1, 0x8040552c, 0x0)
perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8)
r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c)
bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r2, &(0x7f0000000040), 0x0, 0x1}, 0x20)
openat$cgroup_ro(r1, &(0x7f00000004c0)='cpuset.effective_cpus\x00', 0x0, 0x0)
unlink(&(0x7f0000000900)='./file0/file0\x00')
r3 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r4 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r4, 0x0)
ioctl$BINDER_GET_NODE_DEBUG_INFO(r3, 0xc018620b, &(0x7f0000000780))
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f00000000c0)=[@enter_looper], 0x48, 0x0, &(0x7f0000000700)="2ba063fb309ec7fdbfb08e6e91baee7d7d4599fe14129a4d426834556ae420e087d59c0c7be7fcad1abb7e1f8f446f373f611ca1ee9c2231708e18a47bc68a2a79a0b48931f6ff6d"})
ioctl$sock_inet_tcp_SIOCOUTQNSD(r1, 0x894b, &(0x7f0000000480))
getsockopt$inet_IP_IPSEC_POLICY(0xffffffffffffffff, 0x0, 0x10, &(0x7f0000000540)={{{@in6, @in=@remote}}, {{@in6=@ipv4={[], [], @local}}, 0x0, @in6}}, &(0x7f0000000000)=0xe8)
ioctl$BINDER_SET_CONTEXT_MGR(r4, 0x40046207, 0x0)
r5 = dup(r4)
shutdown(r5, 0x1)
prctl$PR_SET_NAME(0xf, &(0x7f0000000380)='/group.stat\x00')
syz_open_dev$binder(&(0x7f0000000880)='/dev/binder#\x00', 0x0, 0x2)
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)})
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, &(0x7f0000000780)})
ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f0000000680)})
creat(&(0x7f00000000c0)='./file0\x00', 0x0)
openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000100)='/group.stat\x00', 0x2761, 0x0)
clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000080), 0xffffffffffffffff)
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000003c0)={0x14, 0x0, &(0x7f0000000680)=[@acquire_done], 0x0, 0x0, 0x0})

05:02:42 executing program 1:
r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000200)='/dev/nullb0\x00', 0x5000000084002, 0x0)
mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x200000e, 0x13, r0, 0x0)
r1 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x4000, 0x0)
preadv(r1, &(0x7f0000000040)=[{&(0x7f0000000400)=""/4096, 0x3ffc36}], 0x1, 0x0)

05:02:42 executing program 0:
recvmmsg(0xffffffffffffffff, &(0x7f0000003140)=[{{&(0x7f0000001400)=@ipx, 0x80, 0x0}}], 0x1, 0x0, 0x0)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = syz_open_procfs(0x0, &(0x7f00000004c0)='net/rt_cache\x00')
preadv(r0, &(0x7f00000017c0), 0xc4, 0x0)

05:02:42 executing program 4:
syz_open_dev$sndseq(&(0x7f0000000200)='/dev/snd/seq\x00', 0x0, 0x200)
r0 = syz_open_dev$amidi(0x0, 0x0, 0x0)
ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, 0x0)
unshare(0x8020000)
getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r0, 0x84, 0x6f, &(0x7f00000000c0)={<r1=>0x0, 0x74, &(0x7f0000000000)=[@in6={0xa, 0x4e21, 0x0, @empty, 0x829f}, @in={0x2, 0x4e22, @broadcast}, @in6={0xa, 0x4e21, 0x81, @remote, 0xc7}, @in6={0xa, 0x4e22, 0x4, @initdev={0xfe, 0x88, [], 0x1, 0x0}, 0x9}, @in={0x2, 0x4e20, @broadcast}]}, &(0x7f0000000100)=0x10)
getsockopt$inet_sctp_SCTP_DEFAULT_SNDINFO(r0, 0x84, 0x22, &(0x7f0000000140)={0xfffffffffffffe00, 0x0, 0xc2, 0x0, r1}, &(0x7f0000000180)=0x10)
semget$private(0x0, 0x403, 0x0)
semop(0x0, &(0x7f0000000080)=[{0x0, 0x0, 0x1800}], 0x1)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
unshare(0x8020400)
ioctl$UFFDIO_WAKE(0xffffffffffffffff, 0x8010aa02, &(0x7f0000001680)={&(0x7f0000011000/0x2000)=nil, 0x2000})

05:02:42 executing program 5:
r0 = syz_open_procfs(0x0, &(0x7f00000001c0)='map_files\x00')
fchdir(r0)
quotactl(0x2080000206, &(0x7f0000000100)='./file1\x00', 0x0, &(0x7f0000000000)="2d9d")
write$FUSE_DIRENT(r0, &(0x7f0000000040)={0x88, 0xfffffffffffffffe, 0x7, [{0x5, 0xfff, 0xa, 0x400000000000000, 'map_files\x00'}, {0x1, 0x20c, 0xa, 0x4, 'map_files\x00'}, {0x1, 0x959, 0xa, 0x7, 'map_files\x00'}]}, 0x88)
getsockopt$inet_sctp6_SCTP_PR_STREAM_STATUS(r0, 0x84, 0x74, &(0x7f0000000200)=""/221, &(0x7f0000000140)=0xdd)

05:02:42 executing program 3:
recvmmsg(0xffffffffffffffff, &(0x7f0000003140)=[{{&(0x7f0000001400)=@ipx, 0x80, 0x0}}], 0x1, 0x0, 0x0)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = syz_open_procfs(0x0, &(0x7f00000004c0)='net/rt_cache\x00')
preadv(r0, &(0x7f00000017c0), 0xc9, 0x0)

[  391.743708] binder: release 18046:18053 transaction 624 out, still active
05:02:42 executing program 3:
recvmmsg(0xffffffffffffffff, &(0x7f0000003140)=[{{&(0x7f0000001400)=@ipx, 0x80, 0x0}}], 0x1, 0x0, 0x0)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = syz_open_procfs(0x0, &(0x7f00000004c0)='net/rt_cache\x00')
preadv(r0, &(0x7f00000017c0), 0xca, 0x0)

05:02:42 executing program 5:
r0 = socket$inet6(0xa, 0x8000000001, 0x0)
mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x1, 0x32, 0xffffffffffffffff, 0x0)
r1 = userfaultfd(0x0)
ioctl$UFFDIO_API(r1, 0xc018aa3f, &(0x7f0000000000))
ioctl$UFFDIO_REGISTER(r1, 0xc020aa00, &(0x7f0000001000)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x2})
r2 = socket$inet_tcp(0x2, 0x1, 0x0)
setsockopt$inet_mreqsrc(r2, 0x0, 0x2000000000000004, &(0x7f0000013ff4)={@local, @rand_addr, @remote}, 0xc)
r3 = openat$zero(0xffffffffffffff9c, &(0x7f0000000140)='/dev/zero\x00', 0x10080, 0x0)
r4 = syz_genetlink_get_family_id$fou(&(0x7f00000001c0)='fou\x00')
sendmsg$FOU_CMD_GET(r3, &(0x7f0000000280)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f0000000240)={&(0x7f0000000200)={0x38, r4, 0x22, 0x70bd2d, 0x25dfdbfb, {}, [@FOU_ATTR_PORT={0x8, 0x1, 0x4e20}, @FOU_ATTR_REMCSUM_NOPARTIAL={0x4}, @FOU_ATTR_IPPROTO={0x8, 0x3, 0x7f}, @FOU_ATTR_PORT={0x8, 0x1, 0x4e21}, @FOU_ATTR_PORT={0x8, 0x1, 0x4e24}]}, 0x38}, 0x1, 0x0, 0x0, 0x40001}, 0x4004051)
setsockopt$inet_tcp_TCP_ULP(r2, 0x6, 0x1f, &(0x7f00000000c0)='tls\x0f', 0x4)
r5 = syz_open_dev$midi(&(0x7f0000000080)='/dev/midi#\x00', 0x0, 0x420000)
ioctl$ASHMEM_GET_NAME(r5, 0x81007702, &(0x7f0000000100)=""/24)
close(r2)
socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, <r6=>0xffffffffffffffff})
ioctl$PERF_EVENT_IOC_ENABLE(r6, 0x8912, 0x400200)
ioctl$KVM_PPC_ALLOCATE_HTAB(r5, 0xc004aea7, &(0x7f00000002c0)=0x3)
dup3(r0, r0, 0x20)

05:02:42 executing program 0:
recvmmsg(0xffffffffffffffff, &(0x7f0000003140)=[{{&(0x7f0000001400)=@ipx, 0x80, 0x0}}], 0x1, 0x0, 0x0)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = syz_open_procfs(0x0, &(0x7f00000004c0)='net/rt_cache\x00')
preadv(r0, &(0x7f00000017c0), 0xc5, 0x0)

[  391.877199] binder: 18121 RLIMIT_NICE not set
05:02:42 executing program 1:
r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000200)='/dev/nullb0\x00', 0x5000000084002, 0x0)
mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x200000e, 0x13, r0, 0x0)
r1 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x4000, 0x0)
preadv(r1, &(0x7f0000000040)=[{&(0x7f0000000400)=""/4096, 0x3ffc37}], 0x1, 0x0)

[  391.918103] binder: BINDER_SET_CONTEXT_MGR already set
[  391.954124] binder: 18118:18127 ioctl 40046207 0 returned -16
05:02:42 executing program 4:
r0 = socket(0x1e, 0x805, 0x0)
listen(r0, 0x4)
r1 = syz_open_dev$media(&(0x7f0000000000)='/dev/media#\x00', 0x3, 0x400000)
setsockopt$sock_attach_bpf(r0, 0x1, 0x32, &(0x7f0000000040)=r1, 0x4)
r2 = socket$nl_generic(0x10, 0x3, 0x10)
r3 = syz_genetlink_get_family_id$ipvs(&(0x7f00000000c0)='IPVS\x00')
sendmsg$IPVS_CMD_NEW_SERVICE(r2, &(0x7f0000000200)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x20}, 0xc, &(0x7f0000000100)={&(0x7f0000000180)=ANY=[@ANYBLOB='x\x00\x00\x00', @ANYRES16=r3, @ANYBLOB="e6002cbd7000fddbdf250100000038000200080002004e200000080009004000000014000100ffffffdf000000000000000000000000080003000000000008000b000a0000002c00030008000100010000000800030004000000080004f6f601f02343826353783800000800000800030002"], 0x78}, 0x1, 0x0, 0x0, 0x80}, 0x20000000)
sendmsg(r0, &(0x7f0000000140)={&(0x7f00004f5000)=@generic={0x10000000001e, "0200000900000000000000000226cc573c080000003724c71e14dd6a739effea1b48006be61ffe0000e103000000f8000004003f010039d8f986ff01000300000004af50d50700000000000000e3ad316a1983000000001d00e0dfcb24281e27800000100076c3979ac40000bd15020078a1dfd300881a8365b1b16d7436"}, 0x80, 0x0}, 0x0)

[  392.004157] binder: 18118:18127 Release 1 refcount change on invalid ref 1 ret -22
05:02:42 executing program 5:
pipe(&(0x7f0000000000)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
r2 = socket$inet_udp(0x2, 0x2, 0x0)
writev(0xffffffffffffffff, &(0x7f0000e11ff0)=[{&(0x7f0000000140)="580000001400add427323b470c458c560a06", 0x12}], 0x1)
close(r2)
socket$netlink(0x10, 0x3, 0x2000000004)
write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x4240a2a0)
splice(r0, 0x0, r2, 0x0, 0x10005, 0x0)
ioctl$GIO_SCRNMAP(r1, 0x4b40, &(0x7f0000000040)=""/187)

05:02:42 executing program 2:
r0 = syz_open_dev$sndtimer(&(0x7f0000026000)='/dev/snd/timer\x00', 0x0, 0x0)
r1 = dup3(r0, r0, 0x80000)
ioctl$UI_GET_SYSNAME(r1, 0x8040552c, 0x0)
perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8)
r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c)
bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r2, &(0x7f0000000040), 0x0, 0x1}, 0x20)
openat$cgroup_ro(r1, &(0x7f00000004c0)='cpuset.effective_cpus\x00', 0x0, 0x0)
unlink(&(0x7f0000000900)='./file0/file0\x00')
r3 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r4 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10, r4, 0x0)
ioctl$BINDER_GET_NODE_DEBUG_INFO(r3, 0xc018620b, &(0x7f0000000780))
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f00000000c0)=[@enter_looper], 0x48, 0x0, &(0x7f0000000700)="2ba063fb309ec7fdbfb08e6e91baee7d7d4599fe14129a4d426834556ae420e087d59c0c7be7fcad1abb7e1f8f446f373f611ca1ee9c2231708e18a47bc68a2a79a0b48931f6ff6d"})
ioctl$sock_inet_tcp_SIOCOUTQNSD(r1, 0x894b, &(0x7f0000000480))
getsockopt$inet_IP_IPSEC_POLICY(0xffffffffffffffff, 0x0, 0x10, &(0x7f0000000540)={{{@in6, @in=@remote}}, {{@in6=@ipv4={[], [], @local}}, 0x0, @in6}}, &(0x7f0000000000)=0xe8)
ioctl$BINDER_SET_CONTEXT_MGR(r4, 0x40046207, 0x0)
r5 = dup(r4)
shutdown(r5, 0x1)
prctl$PR_SET_NAME(0xf, &(0x7f0000000380)='/group.stat\x00')
syz_open_dev$binder(&(0x7f0000000880)='/dev/binder#\x00', 0x0, 0x2)
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)})
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, &(0x7f0000000780)})
ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f0000000680)})
creat(&(0x7f00000000c0)='./file0\x00', 0x0)
openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000100)='/group.stat\x00', 0x2761, 0x0)
clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000080), 0xffffffffffffffff)
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000003c0)={0x14, 0x0, &(0x7f0000000680)=[@acquire_done], 0x0, 0x0, 0x0})

05:02:42 executing program 0:
recvmmsg(0xffffffffffffffff, &(0x7f0000003140)=[{{&(0x7f0000001400)=@ipx, 0x80, 0x0}}], 0x1, 0x0, 0x0)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = syz_open_procfs(0x0, &(0x7f00000004c0)='net/rt_cache\x00')
preadv(r0, &(0x7f00000017c0), 0xc6, 0x0)

05:02:42 executing program 3:
recvmmsg(0xffffffffffffffff, &(0x7f0000003140)=[{{&(0x7f0000001400)=@ipx, 0x80, 0x0}}], 0x1, 0x0, 0x0)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = syz_open_procfs(0x0, &(0x7f00000004c0)='net/rt_cache\x00')
preadv(r0, &(0x7f00000017c0), 0xcb, 0x0)

05:02:42 executing program 1:
r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000200)='/dev/nullb0\x00', 0x5000000084002, 0x0)
mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x200000e, 0x13, r0, 0x0)
r1 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x4000, 0x0)
preadv(r1, &(0x7f0000000040)=[{&(0x7f0000000400)=""/4096, 0x3ffc38}], 0x1, 0x0)

05:02:42 executing program 4:
r0 = syz_open_dev$vbi(&(0x7f0000000100)='/dev/vbi#\x00', 0x3, 0x2)
preadv(r0, &(0x7f0000000040)=[{&(0x7f0000000000)=""/21, 0x15}], 0x1, 0x0)
ioctl$TIOCGPGRP(r0, 0x540f, &(0x7f0000000080)=<r1=>0x0)
getsockname$packet(r0, &(0x7f0000000140)={0x11, 0x0, <r2=>0x0, 0x1, 0x0, 0x6, @link_local}, &(0x7f0000000180)=0x14)
getsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x11, &(0x7f00000001c0)={{{@in=@remote, @in6=@mcast1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, <r3=>0x0}}, {{@in=@remote}, 0x0, @in6=@loopback}}, &(0x7f00000002c0)=0xe8)
setsockopt$inet_IP_IPSEC_POLICY(r0, 0x0, 0x10, &(0x7f0000000300)={{{@in=@remote, @in6=@mcast1, 0x4e22, 0x0, 0x4e21, 0x5, 0x2, 0xa0, 0x20, 0x3b, r2, r3}, {0x400, 0x3f, 0xfff, 0x3, 0x2, 0x200, 0x1, 0x4bdb}, {0x7fff, 0x5, 0xce, 0x5}, 0xfffffffffffffe00, 0x6e6bb2, 0x0, 0x0, 0x3, 0x3}, {{@in6=@loopback, 0x4d6, 0x7f}, 0x0, @in6=@rand_addr="8d020df7bfeedb2157d13d00018843fd", 0x3500, 0x0, 0x1, 0x2, 0x3e0, 0x54, 0x80000000}}, 0xe8)
r4 = syz_open_procfs(r1, &(0x7f00000000c0)='net/raw6\x00')
io_setup(0x8d, &(0x7f0000000400)=<r5=>0x0)
setsockopt$sock_attach_bpf(r0, 0x1, 0x32, &(0x7f0000001800)=r4, 0x4)
io_submit(r5, 0x5, &(0x7f00000017c0)=[&(0x7f0000000480)={0x0, 0x0, 0x0, 0xf, 0x8001, r0, &(0x7f0000000440)="d290eb659d3075fde0a6376c9d4ffdd481831f51ebe68f5f06f848b74e236271cfe11b07", 0x24, 0x6, 0x0, 0x0, r0}, &(0x7f0000000540)={0x0, 0x0, 0x0, 0x2, 0x5, r4, &(0x7f00000004c0)="28aedde34edee7e8aca13309f728808c44f1e4ebe04976eae93d36f65e42c3cadb0a7347a17e5c62c1081fd000ad916a8bf1be5b69f287dabb800273894d11e5844e0f87845d4aa3567e3a", 0x4b, 0x6, 0x0, 0x1, r0}, &(0x7f0000000600)={0x0, 0x0, 0x0, 0xa4e6605cd44da1fa, 0x7ff, r0, &(0x7f0000000580)="e8716869590c91f36759836d783ead6b1275ffeefac20b1961dc94aab0fc78b54ba3509a762abc20921b9bb3bd20b6bd6fdfdf0507e37e7b15ac7babb0eca2197d2623a190e3d5fbdd2fd8570af63f2eb7f6daddd437b2820bb5e3fa57af0be609a636e4639ddb", 0x67, 0x1, 0x0, 0x1, r0}, &(0x7f0000001640)={0x0, 0x0, 0x0, 0x1, 0xffffffff, r0, &(0x7f0000000640)="759c6ccb47ee52202aa813362c6fbb06c45c57698ffe028831ed5e817ba218914ca0a87b1060556173ca5a4eb82e56d13a8b21b421b627be188b02624cede14b726d9ce941999b1f45d08f25a6230018a6ecc9fdebd4b5ba7d755c1ff7a38db1cd7085a30835f2ccfbefd49a14bfdfac2da390ad5568de13e90e6c83f0fc288233e78ee24703bab065b2a963354bafcc49c94155f1429b742e75c90cfeeb191dad5ce6fb63c8bb03ae9460296b9a2fa5e302c48e7afcd5f27d0b93770b7ee5fcf05f35fdb1390f3311301c8a1de28f6c042dcc1a2fd9df4df3bb38928b76892a0d7728d367c85d1df1e72790c1969a22cc8fdc64a1221f4c9e84c9ab65f78dd6bbb701ab39242c480f028cf922cf9728bfc532e2f9b9b53067beced5b97b6436cbb0b85bca3e18c54e55c0ef6ce13f490749814fb27dfea45f474cde6d0a1a3d609a911afdd9044b20895be37d54d2ef209cc4736736c57799aee3169581758090305cef02fb7abf33d3c084ced487dc90b55931453b3eeaf57b7c198cf9abc0f5a48e7aeb8c5e3c56acd8488e6344ca00904a50ea67d3ba5ef71c3555f4a619bfd1a4fdd5f3b524c13f5a4d5b0d739d7bf7003d799d0b073e36cefa3baf7eb29080e1a72b1c6bc8f1da2beabd53b49ba2fd87e239b12a3c9bfaa284f476ef215f6b865087a7178db906303781853894446f54bc7e18c5d6d23c8a772b38c157435faa77185e43d60a0d64a8b16ddb0b51d0647d57e910cf628c29af9bb3b36c249cf40a3a04aff55e1fb4a9b38eb216b9d7659c5621ee24ab57fcf6d3d07f1b9f850b70ecfbe83d5639292c29e3fb83250cc479dccc34a9057ab43b9e032b478b8d670c62ba57ef1fade5108650873adde899eced0584acac92543c26e665d37c39306a929a9db1b44fc93547e3cae64b1659af31134a77c8580e253570aeb6379c798be98687198bed1cc359550c4d0588cf90d28aae329a1d5f51f1e9bf400e009a08726c6906f713d1e3ba1a5bac56212d3710093054d65e5e1ce6e6d5e88231dfcfe5f36290ee455ed7d0a34238eba1c07892231c460282132e229ba2e6f12a6ab785391b736a3366f5125adea55907ed2573ee51c1e19e8470269769cb6b87ce15b6661d22ff7f1646922b1fb89af1b724e41952a3b096b23f1f3cb9c08ee1aacc65b33fe00bd3e8be8d6ef24caa7beaad920c4786c11fe58e23b6bab73b27b7fd9e081543ac9273d70b362cea0dbe6f61c518eabeadee839e8bea8753ea9643642a06cad2026c81c11d66306c1cfe88e3e7913ffdf8012d373f62202b80dd305689365e6a00233b8c7a085fcf52fc10e1c2affd20c76e03b144ced69d7d6277d28b4d4ae2065aa22d2678c550f66732e044b0565e82732c5edc65da5051e49c19c36e468601afa6ec7f2ab0d678cd81ca36b9adc0870b7ab3cc77bc020a909e966c4847dd865ccf6e3c95381dddf267e45490415aaa392da1a5910d6f263baf1842dfb6439b0d8842c3db320cc8f26907c7e1a3b91da1040bbc814c7e2421423fccfca70ba9e0cd33c558d1fd30e29e29e42a8a111d964b14f74fc536ab55f3020cd6e2529325c797fcffc20b889fa50ee7afd778cfd5420e8abfa2508701c9aa65750d48de6297362c3e01402b50339986192a762aff6355929d81cff2286e75ded0ce9537212d561b3be5463744570d23bddf64e5b55fda90a54feb5cba08739c199e1dceac7e8902cc09b485174e65d710f9f6745b97c8148b4b428926d2c57ae2610bae4ba97441a74b2667aa94cd2c0ee60ede10d4dc5d2ee1e872f2596b50bdd238ada4ced309d9c4c28ad92071211b7be2fbe5aec057fbd6471e78fad950be97386d7c1ce7bc003d63905372bf2172348ca1f92a6f2899c3b53da8c14ffa2a7191fe7c79d4aeffba3820e599d562e842a98ebc0fefce673ec3289b992362009ef444838c5d6ed5f51f3d987a67f05e98c4f01896ee2e65ca2e9256b55b7505d1d7f7e61bd539a9773d413f25adc3b718bedf90a2b772e5ff8f22d51c984dc5f9354913bdf1c385e92b4bddd60181265690b41cb0500dd5f2206eef42f51538008bf6588c6a10bc905ca9cc1bce8b86d74b0b514a0a748a20f44bc97b796ca1e2fb63f51db52e44f86840120ab956b9df5a0cdc83e8d662d2cc0398001d048a79e632199c4ee4bcfe33e483d31b1a4ede99a7b15513a2e076422402abacbe6bfd813c9d12d4391c4bccaf51583f8aa71d19ac99daf94d97518e472d6d362e67f8353b48e6aa99d96f3c82bf73f808a8eaf99c792f454b6b01c5c9bf7b061daac5c9065e2b4b8507851bb5907feeb3a45a482e722531ee7c441b5aecb1bd47a6a133d2785a59ca60729321fc5d7d3d18beef78fcf1d75786289c5f847ef1aa6ac3c19eacc4670f44e32f71c0ff01c3d7d616cc9427b44188bb94803fe0e3d86478e9b67cb3ac50d0e17ac013fe2aa4edb1d0603967162ab30d175e7376804399cfb6ada287774975ca4b447e63019296180dfac74aaf52af14eb91ae87e989254f167c39329f23bba90a105aa524dbe3ef5e9c91f42cf434a85aeeedf66f34b86bac46263a58dfac94fc59736883bcb76271ddd3662760845fd5f38117d321ecb2cc65550d1ca098bdb839dbfb99441476d7460f2443d87bc1e22edc2ac4b6dbe1989d6b4d391e102e8c9fe9309d21988cc1aeb41f82465b4fa494b06ad0ac4addc7c54b5ae2322cdfd56fccacd32f7b33432cfde783f28d15af3be34c58a7aeaabd6bf2d0a0d712be4881f859e1d9ec14517dae9c93ce4e070bca0be3620261cc1b9a58f1968a36a7f82dfba7d141702969014c6be1121aff74d0756f742f76c4a9b77b0ea0c0a2f14f5784203a385b57af464f59fa5c4804ed216117b0c68bcc6121b8b90d353bdb5fc967b00910e0b503332d8a407515dc18f95250ba5cdc6ee5b628fc04e88491522709bb82f60c0377fe9131afe200a0dfc6d4ecd4259fb3c667fa88946b59ec9fe7fd3b6e8d0146bea8e83ee37f7364c1513af9ff24bdfba9f1e25e0900d6afa56501f7441294748849f37ff01a9552538f4b96ee081e1ac95ec188589f9228fef6eceff477ca648961a044a77983bb2602dc02db3b28b16e8b12a7815c62ca986eaedb540092a847369b371c0cd8d78708fdfe768c9fb61aafa8f9229a546abc9c4af997065caafa8ec089e012ce5201e5deb8ee78e2a3fce15ca6354285ad20702ef3ac8ced653da5a9536527e83e50d3d676caa5fb1cf65b0ab6693f407876ad2062da889da298f6496dfa96f0cf5b9fa94a886e88c96b80e7dada11568f9c2cf77cf4a80eaccf1f1d3f27b8f69cf0c59e8afe1cc6c2b11986087a24ad4be45e29d67f6b3dadae8eb2aadb447f447d4e6fe7c593dc18c3f7da88619f297d751cf65ed4e2131b973be50f533da8319d925b712cfd7e41bbaf844b5e9cae92acc6f7ce53a66b8ff79dc5e8e9dcfe681b800dbf11e02996c9df6ebce53f373cf402fe7647f0b100f77eb0567ffc1d44f8749972912fe12a45b384d4562d3b657671389a200f196164cfce2b407deaf9fe6c061aa6e2e3246f45e8a2bc0cf2a4c1ce92b2e869ab25d0f9c9df99c35735e803bc869a5b37abd02f76492a77e631c0482cb750b7b94c9aa5f89d85b7464b42829182643c54b93df1e7e0f8303de9fd57467b8bf898f1cbb8ebc9edf410ca60129b6bac6a6db7634a2dbeffc9a945f374e6d8c25973750901738165c3299b6c4675da9c0b389fcf6747c0df1620df0ee5fe79f7a549e04bf0821bfd777c4177c86cb1bbb051f9d2c037eaf8d7cffb59a64dde683801f5404ce1332e5e3d8e5980b3cbf3f35a32f7f2265a5442c99e5019bb7b4c1327e83eb21d523c58a4f88d2efbfd9a04eb5bf1daddb95656abc2aafa6bdd8526a46a73383274eeec808ef4c10827a33e29e3bf265826cbd3a6e8efea5cfa9270466d850f8a8f1c3fc719a79ed16eed111a1ab0e3a04b3cfb8df0a497df11862d037fe16c679356034f6e39be47a244f06dd4fc429e1a38d92103e88d7c2888c1e64f47fd7ac7f3c6833fcfdc0f34f36e9c94d3275e200b72a2303b8e0647f89ad0aa5c0c9e93e6e808f918c9ebb07ebd766ad013b7ddc0a53ba0488da850623aadd19518d44156d0e67c7fb73087e8806fb46033ca5c2c5307196d6f456159c95c2018f0ff5ea3ee74bfc0f7304cfa2efbb20fc6545b58dcaa22ed8257333731a108c0a99d019fd48747edbf00800f292beae0193a7ff265d61914848dd0e0ad208396d7e930f7ff884955056c98da03685f1af88491119d7e2c55eb905cce0fce2180850e4103c93bc169fdaa6edbbb070f4df4cc6fce537cbb1ba514185e9f11119961392048594086643d0a7141685748326641bec09169c6e0725968b15d51d2a4ca6ddf9823d31f70eea7220a6ce555952fa036d3e56b440e628ef79e9f946c8e9d07f7e463a78b33f814a0a23045a1dad356c90bcc19c84244813b68380a1010c9b13c9406f17e22d90f0d8cb6f3eac27cf8cc7294bae3d3c532bc7f80723a6c4cfcb8513c1e672b08dbf1cbc681c06b45afff284c336734a6d0f3a56ea304b38347b91f81771768635cf33e6fd0706f07697d18bfb4952deb39f826580977db623437f66ea74de18135488032a6f344cec1e108c6fae1f0a2e4d4d1dbf8a8abfb2bb3f04e2cd7ad09b7834f2841c513a7df6284cd688bdb2479f78102a345c16b4708c7734b09ea17a3ae1d4afa02eb761a9077f41cea80d01b8f98e5d2cb8164da30aa40205d87e89afca6db4011f8fcf138b33e0cc20acce9399350da6a641fbebc769bfe12e3e0d07b08b9b945502fe843f271534b2213099bcda5af270d4266adcd5a3a53868ae7c52cd60d0652afe3ea16b60ad90b9e0298ce72063ae83d44eb93f6d48abfe2fa262a1c154662cb6c082af36c59f53250d38b9c71decd09d995e730464b311f574eb01bd974186b60075e5b21c0a411b3bf2deb4065884449bf4dfe3b334d5d732178950d69aaa6be618bfd8714bc26e28f12dd53bee3432d65d07c86bbd920eede02cc8e076fff5783909a70195a043ceeb4f030016fb0a87e370b14554bdba58820aced835ffbea396e9d8c608e77e7845c3ece90d9d5a7118fff3d71efed68f5920045ecc305f5ebcd296c76481744680c75fcc196073ef402ee0075c0b43ac4f59b5f285f318e8d10f2561ab8f7f92e1b1aca52a6894f319d32f7b8882d844a0325eee18d4e00273f36201ac6e0f298237da8b1d0c08e7b0dead67ac7b3c10c05b4c89b69887418d1ff3ae2ec4eda98c5bf88a3e36ac2506bd17ea0510ad2f304d13d4cb124d3e46101f98890b25bc087bb2ce93dc9a8f50e4fd9449ab41e407521d602e28111bc5408e20ff88019f3a2eacf7ab6a75e0f9da964b31d9718ae56939ebe04934355b103e4ba61a914944ca6d1428ab7b9760508b2d97cb7f87a5d8560a009d82dc13deba0424185d4cbe12a24c9e69433e0a815eb6ee1c3bf68b60231125e9bb7afd889e12d14d4c139d18ba9f0e8efb9e53afa001a7f009b94904d3b0f68756ac2c26b7adb9a3aacbcc799e02193a63956005bfc40315ba51779151cb6c9c01ac725b91c7888a3bc1c30d6f06f46687eab675f93a80360dd9973648ea1aec2f942b919ace047b0ed555ce01f2dba2845eab3cf111dc3bcc9e3517e04d9d3ccaeb5c2bf1ca1b35ba6a099b3f84a8f18d1a03f9b557f127778879694c17f9820b4beab1928e5e39c4dedb37c5bbe3f276da5b22892a2f2", 0x1000, 0xfffffffffffff5f4, 0x0, 0x1}, &(0x7f0000001780)={0x0, 0x0, 0x0, 0x7, 0x4, r0, &(0x7f0000001680)="4f15dab9f8c4b0251be9adebbf18d127c856ea307626669eeae9e553987bbf791eed9fb4a64c61ee94ce6fa4f5bede3029a895c452d14509c115568b00872c5e44ba4e03b2c406609318f03f734980ab135b1ebcee5085c14faac011f3a1ced7c0c6b73fc2cd69b51d401c7de0a7f48dbc8ab819df025547a6f68c70d2a9c6622b0c65f1994f1c75c3b4753c534cd4d4d6dcc048c9e90e702625a8ecb6fc30ba8e6d958275e2f0bc087e5e49b555dd0ae9c915bcebe5fd1cd1aa6223fd4be7ba77a5ce38a5a9c687958598903f10d760b61b60050f9c053f46923f279cc1a98193f098a5a852a17b17c547b43f3ea4ed0b7ff0cc8c6b02", 0xf7, 0x4, 0x0, 0x1, 0xffffffffffffff9c}])

[  392.617296] binder: release 18118:18127 transaction 627 out, still active
05:02:43 executing program 3:
recvmmsg(0xffffffffffffffff, &(0x7f0000003140)=[{{&(0x7f0000001400)=@ipx, 0x80, 0x0}}], 0x1, 0x0, 0x0)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = syz_open_procfs(0x0, &(0x7f00000004c0)='net/rt_cache\x00')
preadv(r0, &(0x7f00000017c0), 0xcc, 0x0)

05:02:43 executing program 0:
recvmmsg(0xffffffffffffffff, &(0x7f0000003140)=[{{&(0x7f0000001400)=@ipx, 0x80, 0x0}}], 0x1, 0x0, 0x0)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = syz_open_procfs(0x0, &(0x7f00000004c0)='net/rt_cache\x00')
preadv(r0, &(0x7f00000017c0), 0xc7, 0x0)

05:02:43 executing program 1:
r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000200)='/dev/nullb0\x00', 0x5000000084002, 0x0)
mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x200000e, 0x13, r0, 0x0)
r1 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x4000, 0x0)
preadv(r1, &(0x7f0000000040)=[{&(0x7f0000000400)=""/4096, 0x3ffc39}], 0x1, 0x0)

05:02:43 executing program 4:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = socket$inet(0x2, 0x4000000000000001, 0x0)
bind$inet(r0, &(0x7f0000000080)={0x2, 0x4e23, @dev}, 0x10)
sendto$inet(r0, 0x0, 0x0, 0x200007fa, &(0x7f0000000140)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0x1e}}, 0x10)
setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000200)='sit0\x00', 0x6)
sysfs$2(0x2, 0x1f, &(0x7f00000002c0)=""/113)
r1 = syz_open_dev$loop(&(0x7f0000000000)='/dev/loop#\x00', 0x4, 0x0)
r2 = syz_open_dev$sndpcmp(0x0, 0x2, 0x0)
add_key(&(0x7f0000000440)='pkcs7_test\x00', 0x0, 0x0, 0x0, 0xfffffffffffffffb)
getsockopt$inet_sctp_SCTP_DEFAULT_PRINFO(r0, 0x84, 0x72, &(0x7f00000001c0)={0x0, 0x7}, 0x0)
geteuid()
getsockopt$inet_IP_XFRM_POLICY(0xffffffffffffffff, 0x0, 0x11, &(0x7f0000000a00)={{{@in6=@ipv4={[], [], @multicast1}, @in=@dev}}, {{@in=@broadcast}}}, 0x0)
getuid()
memfd_create(&(0x7f00000000c0)='\'\n\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00', 0x0)
ioctl$UI_END_FF_ERASE(r2, 0x400c55cb, &(0x7f0000000280))
prctl$PR_SET_ENDIAN(0x14, 0x1)
pwritev(0xffffffffffffffff, 0x0, 0x0, 0x81003)
sendfile(r0, r1, 0x0, 0x102000002)
ioctl$FITRIM(r2, 0xc0185879, &(0x7f0000000040)={0x5, 0x9, 0x1})
socket$inet_udplite(0x2, 0x2, 0x88)

05:02:43 executing program 0:
recvmmsg(0xffffffffffffffff, &(0x7f0000003140)=[{{&(0x7f0000001400)=@ipx, 0x80, 0x0}}], 0x1, 0x0, 0x0)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = syz_open_procfs(0x0, &(0x7f00000004c0)='net/rt_cache\x00')
preadv(r0, &(0x7f00000017c0), 0xc8, 0x0)

05:02:43 executing program 1:
r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000200)='/dev/nullb0\x00', 0x5000000084002, 0x0)
mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x200000e, 0x13, r0, 0x0)
r1 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x4000, 0x0)
preadv(r1, &(0x7f0000000040)=[{&(0x7f0000000400)=""/4096, 0x3ffc3a}], 0x1, 0x0)

05:02:43 executing program 5:
socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000600)={0xffffffffffffffff, <r0=>0xffffffffffffffff})
add_key$keyring(&(0x7f0000000000)='keyring\x00', &(0x7f0000000080)={'syz', 0x1}, 0x0, 0x0, 0xfffffffffffffffc)
ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200)
r1 = openat$nullb(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/nullb0\x00', 0x4000000004002, 0x0)
mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x200000b, 0x13, r1, 0x0)
ioctl$BLKIOMIN(r1, 0x1278, &(0x7f0000000040))
r2 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000100)='/dev/ubi_ctrl\x00', 0x82, 0x0)
ioctl$IMCLEAR_L2(r2, 0x80044946, &(0x7f0000000140)=0x10001)

[  393.289610] binder: release 11001:11002 transaction 157 out, still active
[  393.296808] binder: unexpected work type, 4, not freed
[  393.302098] binder: undelivered TRANSACTION_COMPLETE
[  393.307819] binder: release 12737:12745 transaction 268 out, still active
[  393.321246] binder: release 17783:17787 transaction 618 out, still active
[  393.328838] binder: unexpected work type, 4, not freed
[  393.335541] binder: undelivered TRANSACTION_COMPLETE
[  393.340873] binder: release 11038:11041 transaction 163 out, still active
[  393.350202] binder: unexpected work type, 4, not freed
[  393.355582] binder: undelivered TRANSACTION_COMPLETE
[  393.360886] binder: release 9176:9184 transaction 54 out, still active
[  393.368077] binder: release 15902:15920 transaction 475 out, still active
[  393.375264] binder: release 17757:17769 transaction 615 out, still active
[  393.691525] binder: release 15947:15956 transaction 478 out, still active
[  393.700746] binder: unexpected work type, 4, not freed
[  393.706095] binder: undelivered TRANSACTION_COMPLETE
[  394.006021] bridge0: port 3(gretap0) entered disabled state
[  394.024915] device gretap0 left promiscuous mode
[  394.029745] bridge0: port 3(gretap0) entered disabled state
[  394.224370] device bridge_slave_1 left promiscuous mode
[  394.230176] bridge0: port 2(bridge_slave_1) entered disabled state
[  394.334749] device bridge_slave_0 left promiscuous mode
[  394.340201] bridge0: port 1(bridge_slave_0) entered disabled state
[  394.489164] device hsr_slave_1 left promiscuous mode
[  394.549414] device hsr_slave_0 left promiscuous mode
[  394.608863] team0 (unregistering): Port device team_slave_1 removed
[  394.619529] team0 (unregistering): Port device team_slave_0 removed
[  394.631688] bond0 (unregistering): Releasing backup interface bond_slave_1
[  394.658591] bond0 (unregistering): Releasing backup interface bond_slave_0
[  394.742149] bond0 (unregistering): Released all slaves
[  395.363426] IPVS: ftp: loaded support on port[0] = 21
[  395.466745] chnl_net:caif_netlink_parms(): no params data found
[  395.510762] bridge0: port 1(bridge_slave_0) entered blocking state
[  395.519314] bridge0: port 1(bridge_slave_0) entered disabled state
[  395.526929] device bridge_slave_0 entered promiscuous mode
[  395.534742] bridge0: port 2(bridge_slave_1) entered blocking state
[  395.541159] bridge0: port 2(bridge_slave_1) entered disabled state
[  395.548728] device bridge_slave_1 entered promiscuous mode
[  395.575889] bond0: Enslaving bond_slave_0 as an active interface with an up link
[  395.592112] bond0: Enslaving bond_slave_1 as an active interface with an up link
[  395.618878] team0: Port device team_slave_0 added
[  395.632017] team0: Port device team_slave_1 added
[  395.686191] device hsr_slave_0 entered promiscuous mode
[  395.744007] device hsr_slave_1 entered promiscuous mode
[  395.802703] bridge0: port 2(bridge_slave_1) entered blocking state
[  395.809233] bridge0: port 2(bridge_slave_1) entered forwarding state
[  395.815938] bridge0: port 1(bridge_slave_0) entered blocking state
[  395.822304] bridge0: port 1(bridge_slave_0) entered forwarding state
[  395.858228] bridge0: port 1(bridge_slave_0) entered disabled state
[  395.865466] bridge0: port 2(bridge_slave_1) entered disabled state
[  395.904258] 8021q: adding VLAN 0 to HW filter on device bond0
[  395.923191] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready
[  395.931743] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready
[  395.948760] 8021q: adding VLAN 0 to HW filter on device team0
[  395.963697] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready
[  395.971573] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready
[  395.987271] bridge0: port 1(bridge_slave_0) entered blocking state
[  395.993707] bridge0: port 1(bridge_slave_0) entered forwarding state
[  396.032073] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready
[  396.040364] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready
[  396.055625] bridge0: port 2(bridge_slave_1) entered blocking state
[  396.062006] bridge0: port 2(bridge_slave_1) entered forwarding state
[  396.077632] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready
[  396.089095] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready
[  396.100862] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready
[  396.112341] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready
[  396.120418] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready
[  396.128389] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready
[  396.136376] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready
[  396.152595] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready
[  396.160547] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready
[  396.175412] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network
[  396.186039] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready
[  396.193123] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready
[  396.202324] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready
[  396.222561] 8021q: adding VLAN 0 to HW filter on device batadv0
[  396.270977] binder: 18216 RLIMIT_NICE not set
[  396.317079] binder: BINDER_SET_CONTEXT_MGR already set
[  396.322434] binder: 18215:18217 ioctl 40046207 0 returned -16
[  396.330591] binder: 18215:18217 Release 1 refcount change on invalid ref 1 ret -22
05:02:47 executing program 4:
r0 = socket(0x848000000015, 0x805, 0x0)
r1 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r2 = syz_genetlink_get_family_id$tipc(&(0x7f0000000180)='TIPC\x00')
sendmsg$TIPC_CMD_GET_REMOTE_MNG(r0, &(0x7f0000000240)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x10481004}, 0xc, &(0x7f0000000200)={&(0x7f00000001c0)={0x1c, r2, 0x100, 0x70bd25, 0x25dfdbff, {}, ["", "", "", "", ""]}, 0x1c}, 0x1, 0x0, 0x0, 0x24040800}, 0x1)
getsockopt$inet_sctp6_SCTP_MAXSEG(r0, 0x84, 0xd, &(0x7f0000000080)=@assoc_id=<r3=>0x0, &(0x7f0000000140)=0xfffffe59)
setsockopt$inet_sctp6_SCTP_RESET_STREAMS(r1, 0x84, 0x77, &(0x7f0000000100)=ANY=[@ANYRES32=r3, @ANYBLOB="0600070006000101010008"], 0x16)
getsockopt(r0, 0x114, 0x271c, &(0x7f0000000040)=""/13, &(0x7f0000000000)=0xd)

05:02:47 executing program 3:
recvmmsg(0xffffffffffffffff, &(0x7f0000003140)=[{{&(0x7f0000001400)=@ipx, 0x80, 0x0}}], 0x1, 0x0, 0x0)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = syz_open_procfs(0x0, &(0x7f00000004c0)='net/rt_cache\x00')
preadv(r0, &(0x7f00000017c0), 0xcd, 0x0)

05:02:47 executing program 0:
recvmmsg(0xffffffffffffffff, &(0x7f0000003140)=[{{&(0x7f0000001400)=@ipx, 0x80, 0x0}}], 0x1, 0x0, 0x0)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = syz_open_procfs(0x0, &(0x7f00000004c0)='net/rt_cache\x00')
preadv(r0, &(0x7f00000017c0), 0xc9, 0x0)

05:02:47 executing program 5:
r0 = socket$inet6(0xa, 0x800000000000002, 0x0)
ioctl$int_in(r0, 0x5421, &(0x7f0000000000)=0xffff)
connect$inet6(r0, &(0x7f0000000040)={0xa, 0x0, 0x0, @ipv4={[], [], @local}}, 0x1c)
setsockopt$sock_linger(r0, 0x1, 0x3c, &(0x7f0000000080)={0x1}, 0x8)
connect$inet6(r0, &(0x7f0000000180)={0xa, 0x4e22, 0x0, @ipv4={[], [], @multicast2}}, 0x1c)
sendto$inet6(r0, 0x0, 0x0, 0x7000000, 0x0, 0xfffffffffffffe45)
getsockopt$inet6_dccp_buf(r0, 0x21, 0xce, &(0x7f00000000c0)=""/91, &(0x7f0000000140)=0x5b)

05:02:47 executing program 2:
r0 = syz_open_dev$sndtimer(&(0x7f0000026000)='/dev/snd/timer\x00', 0x0, 0x0)
r1 = dup3(r0, r0, 0x80000)
ioctl$UI_GET_SYSNAME(r1, 0x8040552c, 0x0)
perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8)
r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c)
bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r2, &(0x7f0000000040), 0x0, 0x1}, 0x20)
openat$cgroup_ro(r1, &(0x7f00000004c0)='cpuset.effective_cpus\x00', 0x0, 0x0)
unlink(&(0x7f0000000900)='./file0/file0\x00')
r3 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r4 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10, r4, 0x0)
ioctl$BINDER_GET_NODE_DEBUG_INFO(r3, 0xc018620b, &(0x7f0000000780))
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f00000000c0)=[@enter_looper], 0x48, 0x0, &(0x7f0000000700)="2ba063fb309ec7fdbfb08e6e91baee7d7d4599fe14129a4d426834556ae420e087d59c0c7be7fcad1abb7e1f8f446f373f611ca1ee9c2231708e18a47bc68a2a79a0b48931f6ff6d"})
ioctl$sock_inet_tcp_SIOCOUTQNSD(r1, 0x894b, &(0x7f0000000480))
getsockopt$inet_IP_IPSEC_POLICY(0xffffffffffffffff, 0x0, 0x10, &(0x7f0000000540)={{{@in6, @in=@remote}}, {{@in6=@ipv4={[], [], @local}}, 0x0, @in6}}, &(0x7f0000000000)=0xe8)
ioctl$BINDER_SET_CONTEXT_MGR(r4, 0x40046207, 0x0)
r5 = dup(r4)
shutdown(r5, 0x1)
prctl$PR_SET_NAME(0xf, &(0x7f0000000380)='/group.stat\x00')
syz_open_dev$binder(&(0x7f0000000880)='/dev/binder#\x00', 0x0, 0x2)
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)})
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, &(0x7f0000000780)})
ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f0000000680)})
creat(&(0x7f00000000c0)='./file0\x00', 0x0)
openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000100)='/group.stat\x00', 0x2761, 0x0)
clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000080), 0xffffffffffffffff)
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000003c0)={0x14, 0x0, &(0x7f0000000680)=[@acquire_done], 0x0, 0x0, 0x0})

05:02:47 executing program 1:
r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000200)='/dev/nullb0\x00', 0x5000000084002, 0x0)
mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x200000e, 0x13, r0, 0x0)
r1 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x4000, 0x0)
preadv(r1, &(0x7f0000000040)=[{&(0x7f0000000400)=""/4096, 0x3ffc3b}], 0x1, 0x0)

[  397.063225] binder: release 18215:18217 transaction 630 out, still active
05:02:47 executing program 5:
r0 = syz_open_dev$sndtimer(&(0x7f0000026000)='/dev/snd/timer\x00', 0x0, 0x0)
r1 = dup3(r0, r0, 0x80000)
ioctl$UI_GET_SYSNAME(r1, 0x8040552c, 0x0)
perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8)
r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c)
bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r2, &(0x7f0000000040), 0x0, 0x1}, 0x20)
openat$cgroup_ro(r1, &(0x7f00000004c0)='cpuset.effective_cpus\x00', 0x0, 0x0)
unlink(&(0x7f0000000900)='./file0/file0\x00')
r3 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r4 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10, r4, 0x0)
ioctl$BINDER_GET_NODE_DEBUG_INFO(r3, 0xc018620b, &(0x7f0000000780))
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f00000000c0)=[@enter_looper], 0x48, 0x0, &(0x7f0000000700)="2ba063fb309ec7fdbfb08e6e91baee7d7d4599fe14129a4d426834556ae420e087d59c0c7be7fcad1abb7e1f8f446f373f611ca1ee9c2231708e18a47bc68a2a79a0b48931f6ff6d"})
ioctl$sock_inet_tcp_SIOCOUTQNSD(r1, 0x894b, &(0x7f0000000480))
getsockopt$inet_IP_IPSEC_POLICY(0xffffffffffffffff, 0x0, 0x10, &(0x7f0000000540)={{{@in6, @in=@remote}}, {{@in6=@ipv4={[], [], @local}}, 0x0, @in6}}, &(0x7f0000000000)=0xe8)
ioctl$BINDER_SET_CONTEXT_MGR(r4, 0x40046207, 0x0)
r5 = dup(r4)
shutdown(r5, 0x1)
prctl$PR_SET_NAME(0xf, &(0x7f0000000380)='/group.stat\x00')
syz_open_dev$binder(&(0x7f0000000880)='/dev/binder#\x00', 0x0, 0x2)
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)})
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, &(0x7f0000000780)})
ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f0000000680)})
creat(&(0x7f00000000c0)='./file0\x00', 0x0)
openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000100)='/group.stat\x00', 0x2761, 0x0)
clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000080), 0xffffffffffffffff)
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000003c0)={0x14, 0x0, &(0x7f0000000680)=[@acquire_done], 0x0, 0x0, 0x0})

05:02:47 executing program 1:
r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000200)='/dev/nullb0\x00', 0x5000000084002, 0x0)
mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x200000e, 0x13, r0, 0x0)
r1 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x4000, 0x0)
preadv(r1, &(0x7f0000000040)=[{&(0x7f0000000400)=""/4096, 0x3ffc3c}], 0x1, 0x0)

05:02:47 executing program 4:
r0 = socket(0x848000000015, 0x805, 0x0)
r1 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r2 = syz_genetlink_get_family_id$tipc(&(0x7f0000000180)='TIPC\x00')
sendmsg$TIPC_CMD_GET_REMOTE_MNG(r0, &(0x7f0000000240)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x10481004}, 0xc, &(0x7f0000000200)={&(0x7f00000001c0)={0x1c, r2, 0x100, 0x70bd25, 0x25dfdbff, {}, ["", "", "", "", ""]}, 0x1c}, 0x1, 0x0, 0x0, 0x24040800}, 0x1)
getsockopt$inet_sctp6_SCTP_MAXSEG(r0, 0x84, 0xd, &(0x7f0000000080)=@assoc_id=<r3=>0x0, &(0x7f0000000140)=0xfffffe59)
setsockopt$inet_sctp6_SCTP_RESET_STREAMS(r1, 0x84, 0x77, &(0x7f0000000100)=ANY=[@ANYRES32=r3, @ANYBLOB="0600070006000101010008"], 0x16)
getsockopt(r0, 0x114, 0x271c, &(0x7f0000000040)=""/13, &(0x7f0000000000)=0xd)

[  397.170201] binder: 18238 RLIMIT_NICE not set
05:02:47 executing program 0:
recvmmsg(0xffffffffffffffff, &(0x7f0000003140)=[{{&(0x7f0000001400)=@ipx, 0x80, 0x0}}], 0x1, 0x0, 0x0)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = syz_open_procfs(0x0, &(0x7f00000004c0)='net/rt_cache\x00')
preadv(r0, &(0x7f00000017c0), 0xca, 0x0)

05:02:47 executing program 3:
recvmmsg(0xffffffffffffffff, &(0x7f0000003140)=[{{&(0x7f0000001400)=@ipx, 0x80, 0x0}}], 0x1, 0x0, 0x0)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = syz_open_procfs(0x0, &(0x7f00000004c0)='net/rt_cache\x00')
preadv(r0, &(0x7f00000017c0), 0xce, 0x0)

[  397.232471] binder: BINDER_SET_CONTEXT_MGR already set
[  397.284828] binder: 18237:18243 ioctl 40046207 0 returned -16
[  397.316867] binder: 18245 RLIMIT_NICE not set
[  397.336214] binder: 18237:18243 Release 1 refcount change on invalid ref 1 ret -22
[  397.363005] binder: BINDER_SET_CONTEXT_MGR already set
[  397.370064] binder: 18244:18259 ioctl 40046207 0 returned -16
05:02:47 executing program 1:
r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000200)='/dev/nullb0\x00', 0x5000000084002, 0x0)
mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x200000e, 0x13, r0, 0x0)
r1 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x4000, 0x0)
preadv(r1, &(0x7f0000000040)=[{&(0x7f0000000400)=""/4096, 0x3ffc3d}], 0x1, 0x0)

05:02:47 executing program 0:
recvmmsg(0xffffffffffffffff, &(0x7f0000003140)=[{{&(0x7f0000001400)=@ipx, 0x80, 0x0}}], 0x1, 0x0, 0x0)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = syz_open_procfs(0x0, &(0x7f00000004c0)='net/rt_cache\x00')
preadv(r0, &(0x7f00000017c0), 0xcb, 0x0)

05:02:47 executing program 4:
pipe(&(0x7f0000000180)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x200000e, 0x12, 0xffffffffffffffff, 0x0)
write(r1, &(0x7f0000000040), 0x12d0780e)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
read(r0, &(0x7f0000000500)=""/250, 0xfffffffffffffe65)
ioctl$KVM_INTERRUPT(r1, 0x4004ae86, &(0x7f0000000000)=0x6)
ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000002840)={'vcan0\x00', <r2=>0x0})
ioctl$sock_inet6_SIOCADDRT(r0, 0x890b, &(0x7f0000002880)={@loopback, @local, @mcast2, 0x4, 0x7, 0x995, 0x0, 0x792e, 0x8, r2})
ioctl$KVM_S390_INTERRUPT_CPU(r1, 0x4010ae94, &(0x7f0000000080)={0x0, 0x2, 0x9})

05:02:47 executing program 3:
recvmmsg(0xffffffffffffffff, &(0x7f0000003140)=[{{&(0x7f0000001400)=@ipx, 0x80, 0x0}}], 0x1, 0x0, 0x0)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = syz_open_procfs(0x0, &(0x7f00000004c0)='net/rt_cache\x00')
preadv(r0, &(0x7f00000017c0), 0xcf, 0x0)

[  397.466871] binder: 18244:18259 Release 1 refcount change on invalid ref 1 ret -22
05:02:47 executing program 0:
recvmmsg(0xffffffffffffffff, &(0x7f0000003140)=[{{&(0x7f0000001400)=@ipx, 0x80, 0x0}}], 0x1, 0x0, 0x0)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = syz_open_procfs(0x0, &(0x7f00000004c0)='net/rt_cache\x00')
preadv(r0, &(0x7f00000017c0), 0xcc, 0x0)

05:02:48 executing program 1:
r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000200)='/dev/nullb0\x00', 0x5000000084002, 0x0)
mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x200000e, 0x13, r0, 0x0)
r1 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x4000, 0x0)
preadv(r1, &(0x7f0000000040)=[{&(0x7f0000000400)=""/4096, 0x3ffc3e}], 0x1, 0x0)

05:02:48 executing program 3:
recvmmsg(0xffffffffffffffff, &(0x7f0000003140)=[{{&(0x7f0000001400)=@ipx, 0x80, 0x0}}], 0x1, 0x0, 0x0)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = syz_open_procfs(0x0, &(0x7f00000004c0)='net/rt_cache\x00')
preadv(r0, &(0x7f00000017c0), 0xd0, 0x0)

[  397.954303] binder: release 18237:18243 transaction 633 out, still active
05:02:48 executing program 5:
r0 = socket$key(0xf, 0x3, 0x2)
sendmsg$key(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000000)=ANY=[@ANYBLOB="02000000000000000100010000000000"]}}, 0x0)
sendmsg$key(0xffffffffffffffff, &(0x7f00000001c0)={0x40000000, 0x0, &(0x7f0000000040)={&(0x7f0000000080)=ANY=[@ANYBLOB="020306091000000002000000000000000200130002000000000000000000000105000600200000000a00000000000000000500e50000070000001f000000000000030000000000000200010000000000000000020000000005000500000000000a00000000000000ff1700000000000000000000000000170000000000000000"], 0x80}}, 0x0)
sendmsg$FOU_CMD_GET(0xffffffffffffffff, 0x0, 0x0)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
sendmmsg(r0, &(0x7f0000000180), 0x400000000000117, 0x4c000000)
r1 = shmget(0x2, 0x8000, 0x54000000, &(0x7f0000ff6000/0x8000)=nil)
shmctl$IPC_STAT(r1, 0x2, &(0x7f0000000100)=""/110)
socket$inet_udp(0x2, 0x2, 0x0)

05:02:48 executing program 0:
recvmmsg(0xffffffffffffffff, &(0x7f0000003140)=[{{&(0x7f0000001400)=@ipx, 0x80, 0x0}}], 0x1, 0x0, 0x0)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = syz_open_procfs(0x0, &(0x7f00000004c0)='net/rt_cache\x00')
preadv(r0, &(0x7f00000017c0), 0xcd, 0x0)

05:02:48 executing program 2:
r0 = syz_open_dev$sndtimer(&(0x7f0000026000)='/dev/snd/timer\x00', 0x0, 0x0)
r1 = dup3(r0, r0, 0x80000)
ioctl$UI_GET_SYSNAME(r1, 0x8040552c, 0x0)
perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8)
r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c)
bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r2, &(0x7f0000000040), 0x0, 0x1}, 0x20)
openat$cgroup_ro(r1, &(0x7f00000004c0)='cpuset.effective_cpus\x00', 0x0, 0x0)
unlink(&(0x7f0000000900)='./file0/file0\x00')
r3 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r4 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10, r4, 0x0)
ioctl$BINDER_GET_NODE_DEBUG_INFO(r3, 0xc018620b, &(0x7f0000000780))
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f00000000c0)=[@enter_looper], 0x48, 0x0, &(0x7f0000000700)="2ba063fb309ec7fdbfb08e6e91baee7d7d4599fe14129a4d426834556ae420e087d59c0c7be7fcad1abb7e1f8f446f373f611ca1ee9c2231708e18a47bc68a2a79a0b48931f6ff6d"})
ioctl$sock_inet_tcp_SIOCOUTQNSD(r1, 0x894b, &(0x7f0000000480))
getsockopt$inet_IP_IPSEC_POLICY(0xffffffffffffffff, 0x0, 0x10, &(0x7f0000000540)={{{@in6, @in=@remote}}, {{@in6=@ipv4={[], [], @local}}, 0x0, @in6}}, &(0x7f0000000000)=0xe8)
ioctl$BINDER_SET_CONTEXT_MGR(r4, 0x40046207, 0x0)
r5 = dup(r4)
shutdown(r5, 0x1)
prctl$PR_SET_NAME(0xf, &(0x7f0000000380)='/group.stat\x00')
syz_open_dev$binder(&(0x7f0000000880)='/dev/binder#\x00', 0x0, 0x2)
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)})
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, &(0x7f0000000780)})
ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f0000000680)})
creat(&(0x7f00000000c0)='./file0\x00', 0x0)
openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000100)='/group.stat\x00', 0x2761, 0x0)
clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000080), 0xffffffffffffffff)
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000003c0)={0x14, 0x0, &(0x7f0000000680)=[@acquire_done], 0x0, 0x0, 0x0})

05:02:48 executing program 3:
recvmmsg(0xffffffffffffffff, &(0x7f0000003140)=[{{&(0x7f0000001400)=@ipx, 0x80, 0x0}}], 0x1, 0x0, 0x0)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = syz_open_procfs(0x0, &(0x7f00000004c0)='net/rt_cache\x00')
preadv(r0, &(0x7f00000017c0), 0xd1, 0x0)

05:02:48 executing program 1:
r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000200)='/dev/nullb0\x00', 0x5000000084002, 0x0)
mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x200000e, 0x13, r0, 0x0)
r1 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x4000, 0x0)
preadv(r1, &(0x7f0000000040)=[{&(0x7f0000000400)=""/4096, 0x3ffc60}], 0x1, 0x0)

[  398.063805] binder: release 18244:18259 transaction 636 out, still active
[  398.152466] binder: 18303 RLIMIT_NICE not set
05:02:48 executing program 0:
recvmmsg(0xffffffffffffffff, &(0x7f0000003140)=[{{&(0x7f0000001400)=@ipx, 0x80, 0x0}}], 0x1, 0x0, 0x0)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = syz_open_procfs(0x0, &(0x7f00000004c0)='net/rt_cache\x00')
preadv(r0, &(0x7f00000017c0), 0xce, 0x0)

05:02:48 executing program 3:
recvmmsg(0xffffffffffffffff, &(0x7f0000003140)=[{{&(0x7f0000001400)=@ipx, 0x80, 0x0}}], 0x1, 0x0, 0x0)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = syz_open_procfs(0x0, &(0x7f00000004c0)='net/rt_cache\x00')
preadv(r0, &(0x7f00000017c0), 0xd2, 0x0)

[  398.199404] binder: BINDER_SET_CONTEXT_MGR already set
[  398.229386] binder: 18302:18314 ioctl 40046207 0 returned -16
[  398.308938] binder: 18302:18314 Release 1 refcount change on invalid ref 1 ret -22
05:02:48 executing program 4:
pipe(&(0x7f0000000140)={<r0=>0xffffffffffffffff})
r1 = socket$inet_tcp(0x2, 0x1, 0x0)
setsockopt$inet_tcp_int(r1, 0x6, 0x10000000013, &(0x7f0000d06000)=0x1, 0xd7)
setsockopt$SO_BINDTODEVICE(r1, 0x1, 0x19, &(0x7f0000000000)='vcan0\x00', 0x1000001c3)
connect$inet(r1, &(0x7f0000000040)={0x2, 0x0, @loopback}, 0x10)
r2 = socket$inet_udplite(0x2, 0x2, 0x88)
ioctl(r2, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070")
setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r1, 0x6, 0x1d, &(0x7f0000000400)={0x0, 0x8d9c, 0x10001}, 0x14)
write$binfmt_misc(r1, &(0x7f0000000100)=ANY=[], 0xd6)
splice(r0, 0x0, r1, 0x0, 0x10005, 0x0)

05:02:48 executing program 1:
r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000200)='/dev/nullb0\x00', 0x5000000084002, 0x0)
mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x200000e, 0x13, r0, 0x0)
r1 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x4000, 0x0)
preadv(r1, &(0x7f0000000040)=[{&(0x7f0000000400)=""/4096, 0x3ffcf0}], 0x1, 0x0)

05:02:48 executing program 3:
recvmmsg(0xffffffffffffffff, &(0x7f0000003140)=[{{&(0x7f0000001400)=@ipx, 0x80, 0x0}}], 0x1, 0x0, 0x0)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = syz_open_procfs(0x0, &(0x7f00000004c0)='net/rt_cache\x00')
preadv(r0, &(0x7f00000017c0), 0xd3, 0x0)

05:02:48 executing program 0:
recvmmsg(0xffffffffffffffff, &(0x7f0000003140)=[{{&(0x7f0000001400)=@ipx, 0x80, 0x0}}], 0x1, 0x0, 0x0)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = syz_open_procfs(0x0, &(0x7f00000004c0)='net/rt_cache\x00')
preadv(r0, &(0x7f00000017c0), 0xcf, 0x0)

05:02:48 executing program 5:
r0 = socket$key(0xf, 0x3, 0x2)
sendmsg$key(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000000)=ANY=[@ANYBLOB="02000000000000000100010000000000"]}}, 0x0)
sendmsg$key(0xffffffffffffffff, &(0x7f00000001c0)={0x40000000, 0x0, &(0x7f0000000040)={&(0x7f0000000080)=ANY=[@ANYBLOB="020306091000000002000000000000000200130002000000000000000000000105000600200000000a00000000000000000500e50000070000001f000000000000030000000000000200010000000000000000020000000005000500000000000a00000000000000ff1700000000000000000000000000170000000000000000"], 0x80}}, 0x0)
sendmsg$FOU_CMD_GET(0xffffffffffffffff, 0x0, 0x0)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
sendmmsg(r0, &(0x7f0000000180), 0x400000000000117, 0x4c000000)
r1 = shmget(0x2, 0x8000, 0x54000000, &(0x7f0000ff6000/0x8000)=nil)
shmctl$IPC_STAT(r1, 0x2, &(0x7f0000000100)=""/110)
socket$inet_udp(0x2, 0x2, 0x0)

05:02:49 executing program 0:
recvmmsg(0xffffffffffffffff, &(0x7f0000003140)=[{{&(0x7f0000001400)=@ipx, 0x80, 0x0}}], 0x1, 0x0, 0x0)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = syz_open_procfs(0x0, &(0x7f00000004c0)='net/rt_cache\x00')
preadv(r0, &(0x7f00000017c0), 0xd0, 0x0)

05:02:49 executing program 3:
recvmmsg(0xffffffffffffffff, &(0x7f0000003140)=[{{&(0x7f0000001400)=@ipx, 0x80, 0x0}}], 0x1, 0x0, 0x0)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = syz_open_procfs(0x0, &(0x7f00000004c0)='net/rt_cache\x00')
preadv(r0, &(0x7f00000017c0), 0xd4, 0x0)

05:02:49 executing program 5:
r0 = syz_open_dev$swradio(&(0x7f0000000080)='/dev/swradio#\x00', 0xffffffffffffffff, 0x2)
ioctl$VIDIOC_CREATE_BUFS(r0, 0xc100565c, &(0x7f0000000340)={0x0, 0x9, 0x1, {0xb, @pix={0x0, 0x1f}}})
r1 = syz_genetlink_get_family_id$nbd(&(0x7f0000000100)='nbd\x00')
sendmsg$NBD_CMD_RECONFIGURE(r0, &(0x7f00000001c0)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f0000000180)={&(0x7f0000000140)={0x20, r1, 0x510, 0x70bd26, 0x25dfdbfe, {}, [@NBD_ATTR_DEAD_CONN_TIMEOUT={0xc, 0x8, 0x400}]}, 0x20}, 0x1, 0x0, 0x0, 0x800}, 0x8800)
ioctl$VIDIOC_DECODER_CMD(r0, 0xc0485660, &(0x7f0000000000)={0x4, 0x3, @stop_pts=0x80000000})
setsockopt$SO_RDS_TRANSPORT(r0, 0x114, 0x8, &(0x7f0000000200)=0xffffffffffffffff, 0x4)
mmap(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0xfffffffffffffffd, 0x11, r0, 0x4000)

05:02:49 executing program 1:
r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000200)='/dev/nullb0\x00', 0x5000000084002, 0x0)
mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x200000e, 0x13, r0, 0x0)
r1 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x4000, 0x0)
preadv(r1, &(0x7f0000000040)=[{&(0x7f0000000400)=""/4096, 0x20400000}], 0x1, 0x0)

05:02:49 executing program 0:
recvmmsg(0xffffffffffffffff, &(0x7f0000003140)=[{{&(0x7f0000001400)=@ipx, 0x80, 0x0}}], 0x1, 0x0, 0x0)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = syz_open_procfs(0x0, &(0x7f00000004c0)='net/rt_cache\x00')
preadv(r0, &(0x7f00000017c0), 0xd1, 0x0)

05:02:49 executing program 2:
r0 = syz_open_dev$sndtimer(&(0x7f0000026000)='/dev/snd/timer\x00', 0x0, 0x0)
r1 = dup3(r0, r0, 0x80000)
ioctl$UI_GET_SYSNAME(r1, 0x8040552c, 0x0)
perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8)
r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c)
bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r2, &(0x7f0000000040), 0x0, 0x1}, 0x20)
openat$cgroup_ro(r1, &(0x7f00000004c0)='cpuset.effective_cpus\x00', 0x0, 0x0)
unlink(&(0x7f0000000900)='./file0/file0\x00')
r3 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r4 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0)
ioctl$BINDER_GET_NODE_DEBUG_INFO(r3, 0xc018620b, &(0x7f0000000780))
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f00000000c0)=[@enter_looper], 0x48, 0x0, &(0x7f0000000700)="2ba063fb309ec7fdbfb08e6e91baee7d7d4599fe14129a4d426834556ae420e087d59c0c7be7fcad1abb7e1f8f446f373f611ca1ee9c2231708e18a47bc68a2a79a0b48931f6ff6d"})
ioctl$sock_inet_tcp_SIOCOUTQNSD(r1, 0x894b, &(0x7f0000000480))
getsockopt$inet_IP_IPSEC_POLICY(0xffffffffffffffff, 0x0, 0x10, &(0x7f0000000540)={{{@in6, @in=@remote}}, {{@in6=@ipv4={[], [], @local}}, 0x0, @in6}}, &(0x7f0000000000)=0xe8)
ioctl$BINDER_SET_CONTEXT_MGR(r4, 0x40046207, 0x0)
r5 = dup(r4)
shutdown(r5, 0x1)
prctl$PR_SET_NAME(0xf, &(0x7f0000000380)='/group.stat\x00')
syz_open_dev$binder(&(0x7f0000000880)='/dev/binder#\x00', 0x0, 0x2)
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)})
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, &(0x7f0000000780)})
ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f0000000680)})
creat(&(0x7f00000000c0)='./file0\x00', 0x0)
openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000100)='/group.stat\x00', 0x2761, 0x0)
clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000080), 0xffffffffffffffff)
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000003c0)={0x14, 0x0, &(0x7f0000000680)=[@acquire_done], 0x0, 0x0, 0x0})

05:02:49 executing program 3:
recvmmsg(0xffffffffffffffff, &(0x7f0000003140)=[{{&(0x7f0000001400)=@ipx, 0x80, 0x0}}], 0x1, 0x0, 0x0)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = syz_open_procfs(0x0, &(0x7f00000004c0)='net/rt_cache\x00')
preadv(r0, &(0x7f00000017c0), 0xd5, 0x0)

[  398.913987] binder: release 18302:18314 transaction 639 out, still active
[  399.042704] binder: 18375 RLIMIT_NICE not set
[  399.089257] binder: BINDER_SET_CONTEXT_MGR already set
[  399.107263] binder: 18374:18379 ioctl 40046207 0 returned -16
[  399.115307] binder: 18374:18379 Release 1 refcount change on invalid ref 1 ret -22
05:02:49 executing program 4:
r0 = socket$inet6(0xa, 0x80002, 0x100000000000088)
bind$inet6(r0, &(0x7f00000000c0)={0xa, 0x4e23}, 0xfffffffffffffeee)
r1 = syz_open_dev$mice(&(0x7f0000000040)='/dev/input/mice\x00', 0x0, 0x430080)
read$eventfd(r1, &(0x7f0000000080), 0x8)
socketpair$unix(0x1, 0x4000000001, 0x0, &(0x7f0000000000)={0xffffffffffffffff, <r2=>0xffffffffffffffff})
ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200)
r3 = socket$inet6(0xa, 0x802, 0x88)
recvfrom$inet6(r0, 0x0, 0xfffffffffffffcb1, 0x0, 0x0, 0x0)
dup2(r2, r0)
sendto$inet6(r3, 0x0, 0x0, 0x0, &(0x7f0000000000)={0xa, 0x4e23, 0x0, @ipv4}, 0x1c)

05:02:49 executing program 3:
recvmmsg(0xffffffffffffffff, &(0x7f0000003140)=[{{&(0x7f0000001400)=@ipx, 0x80, 0x0}}], 0x1, 0x0, 0x0)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = syz_open_procfs(0x0, &(0x7f00000004c0)='net/rt_cache\x00')
preadv(r0, &(0x7f00000017c0), 0xd6, 0x0)

05:02:49 executing program 0:
recvmmsg(0xffffffffffffffff, &(0x7f0000003140)=[{{&(0x7f0000001400)=@ipx, 0x80, 0x0}}], 0x1, 0x0, 0x0)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = syz_open_procfs(0x0, &(0x7f00000004c0)='net/rt_cache\x00')
preadv(r0, &(0x7f00000017c0), 0xd2, 0x0)

05:02:49 executing program 5:
timer_create(0x0, &(0x7f0000ec5000)={0x0, 0x12}, &(0x7f0000044000))
recvmmsg(0xffffffffffffffff, 0x0, 0x0, 0x2, &(0x7f0000006600)={0x0, 0x989680})
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = socket$inet6_tcp(0xa, 0x1, 0x0)
r1 = socket$inet6_tcp(0xa, 0x1, 0x0)
bind$inet6(r1, &(0x7f00000000c0)={0xa, 0x4e22}, 0x1c)
listen(r1, 0x0)
sendto$inet6(r0, 0x0, 0x0, 0x20000003, &(0x7f0000000080)={0xa, 0x100000004e22, 0x0, @loopback}, 0x1c)
setsockopt$inet6_tcp_TCP_ULP(r0, 0x6, 0x1f, &(0x7f0000000080)='tls\x00', 0x410)
setsockopt$inet6_tcp_TLS_TX(r0, 0x11a, 0x1, &(0x7f0000000100), 0x28)
sendto$inet6(r0, &(0x7f00000005c0), 0xc005002000003eee, 0x0, 0x0, 0x0)
r2 = gettid()
timer_settime(0x0, 0x0, &(0x7f0000000100)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0)
r3 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r4 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r4, 0x0)
syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0x0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r4, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000800000000000000", @ANYPTR=&(0x7f0000000200)=ANY=[@ANYBLOB="852a627300000000", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], @ANYPTR=&(0x7f0000000140)=ANY=[@ANYBLOB="000100000004ed7db858bd678eb16da7f59e2160d83f598a0ce0e308c64d84f672f68a9da6d55326a5f71ded6b0b"]], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000380)={0x8, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0673ed310093c899e9192c000000"], 0x0, 0x0, 0x0})
tkill(r2, 0x14)

05:02:49 executing program 0:
recvmmsg(0xffffffffffffffff, &(0x7f0000003140)=[{{&(0x7f0000001400)=@ipx, 0x80, 0x0}}], 0x1, 0x0, 0x0)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = syz_open_procfs(0x0, &(0x7f00000004c0)='net/rt_cache\x00')
preadv(r0, &(0x7f00000017c0), 0xd3, 0x0)

[  399.511825] TCP: request_sock_TCPv6: Possible SYN flooding on port 20002. Sending cookies.  Check SNMP counters.
05:02:49 executing program 3:
recvmmsg(0xffffffffffffffff, &(0x7f0000003140)=[{{&(0x7f0000001400)=@ipx, 0x80, 0x0}}], 0x1, 0x0, 0x0)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = syz_open_procfs(0x0, &(0x7f00000004c0)='net/rt_cache\x00')
preadv(r0, &(0x7f00000017c0), 0xd7, 0x0)

[  399.651102] binder: BINDER_SET_CONTEXT_MGR already set
[  399.688987] binder: 18389:18397 ioctl 40046207 0 returned -16
05:02:50 executing program 3:
recvmmsg(0xffffffffffffffff, &(0x7f0000003140)=[{{&(0x7f0000001400)=@ipx, 0x80, 0x0}}], 0x1, 0x0, 0x0)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = syz_open_procfs(0x0, &(0x7f00000004c0)='net/rt_cache\x00')
preadv(r0, &(0x7f00000017c0), 0xd8, 0x0)

[  399.708602] binder: 18389:18407 got transaction with invalid offset (9073913222267928832, min 0 max 24) or object.
05:02:50 executing program 0:
recvmmsg(0xffffffffffffffff, &(0x7f0000003140)=[{{&(0x7f0000001400)=@ipx, 0x80, 0x0}}], 0x1, 0x0, 0x0)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = syz_open_procfs(0x0, &(0x7f00000004c0)='net/rt_cache\x00')
preadv(r0, &(0x7f00000017c0), 0xd4, 0x0)

[  399.755482] binder: 18389:18397 unknown command 837645062
[  399.793884] binder: release 18374:18379 transaction 642 out, still active
[  399.819493] binder: 18389:18397 ioctl c0306201 20000380 returned -22
[  399.831315] binder: 18389:18407 transaction failed 29201/-22, size 24-8 line 3097
05:02:50 executing program 1:
r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000200)='/dev/nullb0\x00', 0x5000000084002, 0x0)
mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x200000e, 0x13, r0, 0x0)
r1 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x4000, 0x0)
preadv(r1, &(0x7f0000000040)=[{&(0x7f0000000400)=""/4096, 0x7ffff000}], 0x1, 0x0)

05:02:50 executing program 2:
r0 = syz_open_dev$sndtimer(&(0x7f0000026000)='/dev/snd/timer\x00', 0x0, 0x0)
r1 = dup3(r0, r0, 0x80000)
ioctl$UI_GET_SYSNAME(r1, 0x8040552c, 0x0)
perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8)
r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c)
bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r2, &(0x7f0000000040), 0x0, 0x1}, 0x20)
openat$cgroup_ro(r1, &(0x7f00000004c0)='cpuset.effective_cpus\x00', 0x0, 0x0)
unlink(&(0x7f0000000900)='./file0/file0\x00')
r3 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r4 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0)
ioctl$BINDER_GET_NODE_DEBUG_INFO(r3, 0xc018620b, &(0x7f0000000780))
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f00000000c0)=[@enter_looper], 0x48, 0x0, &(0x7f0000000700)="2ba063fb309ec7fdbfb08e6e91baee7d7d4599fe14129a4d426834556ae420e087d59c0c7be7fcad1abb7e1f8f446f373f611ca1ee9c2231708e18a47bc68a2a79a0b48931f6ff6d"})
ioctl$sock_inet_tcp_SIOCOUTQNSD(r1, 0x894b, &(0x7f0000000480))
getsockopt$inet_IP_IPSEC_POLICY(0xffffffffffffffff, 0x0, 0x10, &(0x7f0000000540)={{{@in6, @in=@remote}}, {{@in6=@ipv4={[], [], @local}}, 0x0, @in6}}, &(0x7f0000000000)=0xe8)
ioctl$BINDER_SET_CONTEXT_MGR(r4, 0x40046207, 0x0)
r5 = dup(r4)
shutdown(r5, 0x1)
prctl$PR_SET_NAME(0xf, &(0x7f0000000380)='/group.stat\x00')
syz_open_dev$binder(&(0x7f0000000880)='/dev/binder#\x00', 0x0, 0x2)
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)})
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, &(0x7f0000000780)})
ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f0000000680)})
creat(&(0x7f00000000c0)='./file0\x00', 0x0)
openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000100)='/group.stat\x00', 0x2761, 0x0)
clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000080), 0xffffffffffffffff)
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000003c0)={0x14, 0x0, &(0x7f0000000680)=[@acquire_done], 0x0, 0x0, 0x0})

05:02:50 executing program 3:
recvmmsg(0xffffffffffffffff, &(0x7f0000003140)=[{{&(0x7f0000001400)=@ipx, 0x80, 0x0}}], 0x1, 0x0, 0x0)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = syz_open_procfs(0x0, &(0x7f00000004c0)='net/rt_cache\x00')
preadv(r0, &(0x7f00000017c0), 0xd9, 0x0)

05:02:50 executing program 0:
recvmmsg(0xffffffffffffffff, &(0x7f0000003140)=[{{&(0x7f0000001400)=@ipx, 0x80, 0x0}}], 0x1, 0x0, 0x0)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = syz_open_procfs(0x0, &(0x7f00000004c0)='net/rt_cache\x00')
preadv(r0, &(0x7f00000017c0), 0xd5, 0x0)

[  400.134463] binder: 18431 RLIMIT_NICE not set
[  400.182151] binder: BINDER_SET_CONTEXT_MGR already set
[  400.200157] binder: 18422:18434 ioctl 40046207 0 returned -16
[  400.209324] binder: 18422:18434 Release 1 refcount change on invalid ref 1 ret -22
05:02:50 executing program 4:
socketpair$unix(0x1, 0x200000000002, 0x0, &(0x7f0000000100)={0xffffffffffffffff, <r0=>0xffffffffffffffff})
ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200)
mkdir(&(0x7f0000000000)='./file0\x00', 0x0)
mount(0x0, &(0x7f0000026ff8)='./file0\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0)
r1 = inotify_init1(0x0)
inotify_add_watch(r1, &(0x7f00000002c0)='./file0\x00', 0xa500295c)
r2 = dup2(r0, r1)
fremovexattr(r2, &(0x7f00000000c0)=@random={'osx.', 'ppp0vmnet0\x00'})
bpf$BPF_PROG_DETACH(0x9, &(0x7f0000000040)={0x0, r2, 0x0, 0x5b476472bf1eb013}, 0x14)
chmod(&(0x7f00000001c0)='./file0\x00', 0x0)

05:02:50 executing program 3:
recvmmsg(0xffffffffffffffff, &(0x7f0000003140)=[{{&(0x7f0000001400)=@ipx, 0x80, 0x0}}], 0x1, 0x0, 0x0)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = syz_open_procfs(0x0, &(0x7f00000004c0)='net/rt_cache\x00')
preadv(r0, &(0x7f00000017c0), 0xda, 0x0)

05:02:50 executing program 0:
recvmmsg(0xffffffffffffffff, &(0x7f0000003140)=[{{&(0x7f0000001400)=@ipx, 0x80, 0x0}}], 0x1, 0x0, 0x0)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = syz_open_procfs(0x0, &(0x7f00000004c0)='net/rt_cache\x00')
preadv(r0, &(0x7f00000017c0), 0xd6, 0x0)

[  400.359620] binder: BINDER_SET_CONTEXT_MGR already set
[  400.375083] binder: 18389:18413 ioctl 40046207 0 returned -16
[  400.390258] binder: 18389:18439 got transaction with invalid offset (9073913222267928832, min 0 max 24) or object.
[  400.431364] binder: 18389:18446 unknown command 837645062
[  400.431578] cgroup: fork rejected by pids controller in /syz5
[  400.473183] binder: 18389:18446 ioctl c0306201 20000380 returned -22
[  400.503113] binder: 18389:18439 transaction failed 29201/-22, size 24-8 line 3097
05:02:51 executing program 5:
timer_create(0x0, &(0x7f0000ec5000)={0x0, 0x12}, &(0x7f0000044000))
recvmmsg(0xffffffffffffffff, 0x0, 0x0, 0x2, &(0x7f0000006600)={0x0, 0x989680})
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = socket$inet6_tcp(0xa, 0x1, 0x0)
r1 = socket$inet6_tcp(0xa, 0x1, 0x0)
bind$inet6(r1, &(0x7f00000000c0)={0xa, 0x4e22}, 0x1c)
listen(r1, 0x0)
sendto$inet6(r0, 0x0, 0x0, 0x20000003, &(0x7f0000000080)={0xa, 0x100000004e22, 0x0, @loopback}, 0x1c)
setsockopt$inet6_tcp_TCP_ULP(r0, 0x6, 0x1f, &(0x7f0000000080)='tls\x00', 0x410)
setsockopt$inet6_tcp_TLS_TX(r0, 0x11a, 0x1, &(0x7f0000000100), 0x28)
sendto$inet6(r0, &(0x7f00000005c0), 0xc005002000003eee, 0x0, 0x0, 0x0)
r2 = gettid()
timer_settime(0x0, 0x0, &(0x7f0000000100)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0)
r3 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r4 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r4, 0x0)
syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0x0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r4, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000800000000000000", @ANYPTR=&(0x7f0000000200)=ANY=[@ANYBLOB="852a627300000000", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], @ANYPTR=&(0x7f0000000140)=ANY=[@ANYBLOB="000100000004ed7db858bd678eb16da7f59e2160d83f598a0ce0e308c64d84f672f68a9da6d55326a5f71ded6b0b"]], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000380)={0x8, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0673ed310093c899e9192c000000"], 0x0, 0x0, 0x0})
tkill(r2, 0x14)

05:02:51 executing program 0:
recvmmsg(0xffffffffffffffff, &(0x7f0000003140)=[{{&(0x7f0000001400)=@ipx, 0x80, 0x0}}], 0x1, 0x0, 0x0)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = syz_open_procfs(0x0, &(0x7f00000004c0)='net/rt_cache\x00')
preadv(r0, &(0x7f00000017c0), 0xd7, 0x0)

05:02:51 executing program 3:
recvmmsg(0xffffffffffffffff, &(0x7f0000003140)=[{{&(0x7f0000001400)=@ipx, 0x80, 0x0}}], 0x1, 0x0, 0x0)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = syz_open_procfs(0x0, &(0x7f00000004c0)='net/rt_cache\x00')
preadv(r0, &(0x7f00000017c0), 0xdb, 0x0)

05:02:51 executing program 4:
r0 = socket$inet_udplite(0x2, 0x2, 0x88)
ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070")
r1 = socket$inet6(0xa, 0x80002, 0x0)
connect$inet6(r1, &(0x7f0000000100)={0xa, 0x0, 0x0, @loopback}, 0x1c)
r2 = gettid()
fcntl$setown(r0, 0x8, r2)
r3 = socket$nl_xfrm(0x10, 0x3, 0x6)
sendmsg$nl_xfrm(r3, &(0x7f000014f000)={0x0, 0x0, &(0x7f00000bfff0)={&(0x7f0000006440)=@updpolicy={0xb8, 0x19, 0x1, 0x0, 0x0, {{@in6=@mcast1, @in=@multicast1, 0x0, 0x0, 0x0, 0x0, 0xa}}}, 0xb8}}, 0x0)
setsockopt$inet6_IPV6_FLOWLABEL_MGR(r1, 0x29, 0x20, &(0x7f00000000c0)={@mcast2={0xff, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xa4ffffff]}, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfc}, 0x20)

[  400.630740] binder: undelivered TRANSACTION_ERROR: 29201
[  400.646641] binder: undelivered TRANSACTION_ERROR: 29201
05:02:51 executing program 0:
recvmmsg(0xffffffffffffffff, &(0x7f0000003140)=[{{&(0x7f0000001400)=@ipx, 0x80, 0x0}}], 0x1, 0x0, 0x0)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = syz_open_procfs(0x0, &(0x7f00000004c0)='net/rt_cache\x00')
preadv(r0, &(0x7f00000017c0), 0xd8, 0x0)

[  400.759898] TCP: request_sock_TCPv6: Possible SYN flooding on port 20002. Sending cookies.  Check SNMP counters.
[  400.869153] binder: BINDER_SET_CONTEXT_MGR already set
[  400.899676] binder: 18563:18568 ioctl 40046207 0 returned -16
[  400.906798] binder: release 18422:18434 transaction 646 out, still active
[  400.947875] binder: 18563:18574 got transaction with invalid offset (9073913222267928832, min 0 max 24) or object.
[  400.973722] binder: 18563:18574 transaction failed 29201/-22, size 24-8 line 3097
[  401.013614] binder: 18563:18568 unknown command 837645062
[  401.019292] binder: 18563:18568 ioctl c0306201 20000380 returned -22
[  401.150658] binder: undelivered TRANSACTION_ERROR: 29201
05:02:51 executing program 1:
r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000200)='/dev/nullb0\x00', 0x5000000084002, 0x0)
mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x200000e, 0x13, r0, 0x0)
r1 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x4000, 0x0)
preadv(r1, &(0x7f0000000040)=[{&(0x7f0000000400)=""/4096, 0x3e80000000}], 0x1, 0x0)

05:02:51 executing program 3:
recvmmsg(0xffffffffffffffff, &(0x7f0000003140)=[{{&(0x7f0000001400)=@ipx, 0x80, 0x0}}], 0x1, 0x0, 0x0)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = syz_open_procfs(0x0, &(0x7f00000004c0)='net/rt_cache\x00')
preadv(r0, &(0x7f00000017c0), 0xdc, 0x0)

05:02:51 executing program 4:
r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route(r1, &(0x7f0000001cc0)={0x0, 0x5b13, &(0x7f0000000040)={&(0x7f0000000380)=ANY=[@ANYBLOB="3000000010000108020000000000000000000000", @ANYRES32=0x0, @ANYBLOB="0000000000050000083c6d1b9a81f2fca154356a8c06e500"], 0x30}}, 0x0)
ioctl$FS_IOC_SETVERSION(r0, 0x40087602, &(0x7f0000000000)=0x40)

05:02:51 executing program 0:
recvmmsg(0xffffffffffffffff, &(0x7f0000003140)=[{{&(0x7f0000001400)=@ipx, 0x80, 0x0}}], 0x1, 0x0, 0x0)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = syz_open_procfs(0x0, &(0x7f00000004c0)='net/rt_cache\x00')
preadv(r0, &(0x7f00000017c0), 0xd9, 0x0)

05:02:51 executing program 2:
r0 = syz_open_dev$sndtimer(&(0x7f0000026000)='/dev/snd/timer\x00', 0x0, 0x0)
r1 = dup3(r0, r0, 0x80000)
ioctl$UI_GET_SYSNAME(r1, 0x8040552c, 0x0)
perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8)
r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c)
bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r2, &(0x7f0000000040), 0x0, 0x1}, 0x20)
openat$cgroup_ro(r1, &(0x7f00000004c0)='cpuset.effective_cpus\x00', 0x0, 0x0)
unlink(&(0x7f0000000900)='./file0/file0\x00')
r3 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r4 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0)
ioctl$BINDER_GET_NODE_DEBUG_INFO(r3, 0xc018620b, &(0x7f0000000780))
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f00000000c0)=[@enter_looper], 0x48, 0x0, &(0x7f0000000700)="2ba063fb309ec7fdbfb08e6e91baee7d7d4599fe14129a4d426834556ae420e087d59c0c7be7fcad1abb7e1f8f446f373f611ca1ee9c2231708e18a47bc68a2a79a0b48931f6ff6d"})
ioctl$sock_inet_tcp_SIOCOUTQNSD(r1, 0x894b, &(0x7f0000000480))
getsockopt$inet_IP_IPSEC_POLICY(0xffffffffffffffff, 0x0, 0x10, &(0x7f0000000540)={{{@in6, @in=@remote}}, {{@in6=@ipv4={[], [], @local}}, 0x0, @in6}}, &(0x7f0000000000)=0xe8)
ioctl$BINDER_SET_CONTEXT_MGR(r4, 0x40046207, 0x0)
r5 = dup(r4)
shutdown(r5, 0x1)
prctl$PR_SET_NAME(0xf, &(0x7f0000000380)='/group.stat\x00')
syz_open_dev$binder(&(0x7f0000000880)='/dev/binder#\x00', 0x0, 0x2)
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)})
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, &(0x7f0000000780)})
ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f0000000680)})
creat(&(0x7f00000000c0)='./file0\x00', 0x0)
openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000100)='/group.stat\x00', 0x2761, 0x0)
clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000080), 0xffffffffffffffff)
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000003c0)={0x14, 0x0, &(0x7f0000000680)=[@acquire_done], 0x0, 0x0, 0x0})

05:02:51 executing program 5:
timer_create(0x0, &(0x7f0000ec5000)={0x0, 0x12}, &(0x7f0000044000))
recvmmsg(0xffffffffffffffff, 0x0, 0x0, 0x2, &(0x7f0000006600)={0x0, 0x989680})
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = socket$inet6_tcp(0xa, 0x1, 0x0)
r1 = socket$inet6_tcp(0xa, 0x1, 0x0)
bind$inet6(r1, &(0x7f00000000c0)={0xa, 0x4e22}, 0x1c)
listen(r1, 0x0)
sendto$inet6(r0, 0x0, 0x0, 0x20000003, &(0x7f0000000080)={0xa, 0x100000004e22, 0x0, @loopback}, 0x1c)
setsockopt$inet6_tcp_TCP_ULP(r0, 0x6, 0x1f, &(0x7f0000000080)='tls\x00', 0x410)
setsockopt$inet6_tcp_TLS_TX(r0, 0x11a, 0x1, &(0x7f0000000100), 0x28)
sendto$inet6(r0, &(0x7f00000005c0), 0xc005002000003eee, 0x0, 0x0, 0x0)
r2 = gettid()
timer_settime(0x0, 0x0, &(0x7f0000000100)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0)
r3 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r4 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r4, 0x0)
syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0x0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r4, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000800000000000000", @ANYPTR=&(0x7f0000000200)=ANY=[@ANYBLOB="852a627300000000", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], @ANYPTR=&(0x7f0000000140)=ANY=[@ANYBLOB="000100000004ed7db858bd678eb16da7f59e2160d83f598a0ce0e308c64d84f672f68a9da6d55326a5f71ded6b0b"]], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000380)={0x8, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0673ed310093c899e9192c000000"], 0x0, 0x0, 0x0})
tkill(r2, 0x14)

[  401.332465] netlink: 16 bytes leftover after parsing attributes in process `syz-executor.4'.
[  401.357089] binder: 18578 RLIMIT_NICE not set
05:02:51 executing program 3:
recvmmsg(0xffffffffffffffff, &(0x7f0000003140)=[{{&(0x7f0000001400)=@ipx, 0x80, 0x0}}], 0x1, 0x0, 0x0)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = syz_open_procfs(0x0, &(0x7f00000004c0)='net/rt_cache\x00')
preadv(r0, &(0x7f00000017c0), 0xdd, 0x0)

05:02:51 executing program 0:
recvmmsg(0xffffffffffffffff, &(0x7f0000003140)=[{{&(0x7f0000001400)=@ipx, 0x80, 0x0}}], 0x1, 0x0, 0x0)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = syz_open_procfs(0x0, &(0x7f00000004c0)='net/rt_cache\x00')
preadv(r0, &(0x7f00000017c0), 0xda, 0x0)

[  401.381726] TCP: request_sock_TCPv6: Possible SYN flooding on port 20002. Sending cookies.  Check SNMP counters.
[  401.403182] binder: BINDER_SET_CONTEXT_MGR already set
[  401.413505] binder: 18577:18590 ioctl 40046207 0 returned -16
[  401.459281] binder: 18577:18590 Release 1 refcount change on invalid ref 1 ret -22
[  401.459921] netlink: 16 bytes leftover after parsing attributes in process `syz-executor.4'.
05:02:51 executing program 0:
recvmmsg(0xffffffffffffffff, &(0x7f0000003140)=[{{&(0x7f0000001400)=@ipx, 0x80, 0x0}}], 0x1, 0x0, 0x0)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = syz_open_procfs(0x0, &(0x7f00000004c0)='net/rt_cache\x00')
preadv(r0, &(0x7f00000017c0), 0xdb, 0x0)

05:02:51 executing program 3:
recvmmsg(0xffffffffffffffff, &(0x7f0000003140)=[{{&(0x7f0000001400)=@ipx, 0x80, 0x0}}], 0x1, 0x0, 0x0)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = syz_open_procfs(0x0, &(0x7f00000004c0)='net/rt_cache\x00')
preadv(r0, &(0x7f00000017c0), 0xde, 0x0)

[  401.558497] binder: BINDER_SET_CONTEXT_MGR already set
[  401.578146] binder: 18584:18597 ioctl 40046207 0 returned -16
[  401.596865] binder: 18584:18597 got transaction with invalid offset (9073913222267928832, min 0 max 24) or object.
05:02:52 executing program 4:
fcntl$getownex(0xffffffffffffff9c, 0x10, &(0x7f0000000480))
ioctl$TIOCGSID(0xffffffffffffff9c, 0x5429, &(0x7f00000005c0)=<r0=>0x0)
r1 = getpgid(r0)
r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000280)='cpuacct.usage_user\x00', 0x0, 0x0)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0xb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000600)}, 0x2020}, 0x0, 0xffffffffffffffff, r2, 0x0)
r3 = socket$inet_tcp(0x2, 0x1, 0x0)
setsockopt$inet_sctp6_SCTP_FRAGMENT_INTERLEAVE(r2, 0x84, 0x12, &(0x7f0000000300)=0x4, 0x272)
setsockopt$IP_VS_SO_SET_STOPDAEMON(r3, 0x0, 0x48c, &(0x7f0000000080)={0x0, 'ip6gre0\x00', 0x2}, 0xfffffffffffffc51)
ioctl(r3, 0x800000000008982, &(0x7f0000000080))
r4 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000400)='/dev/ppp\x00', 0x0, 0x0)
write$FUSE_NOTIFY_DELETE(r4, &(0x7f00000003c0)=ANY=[@ANYRES16=r1], 0x231)
mount(&(0x7f0000001180)=ANY=[@ANYBLOB="cb2b4d8d30ea9b5255175d43fca389e342de5ec740fe96132329bdfbaa11c5521288697c83a9f28c7ee9d8df70f2c6849d443d5bc274a1f1576385a885b764dc4babfdf01646fa85765072f75f3267f1ced252e7419523d2075fb98f5696f4bf38817b25525ef2a46b39c1d223d17b505512d51acb6f5e0a1e53f8e26cded92ba381b83d2692b7fa7ffd3f81026e3e999bc357521a8e9799fe114e204db050bf9a50c94d3d01f8a436ccaf26a8bd4cd371f401cff939fa559e71ce024fc3c4540465cd73fd53aa2a73fdb229d7b8fbcad172ee88d3a2c1108134b2e349048cb3fd136752e22ad37130a3014904c8afeb6943fc0d38cea7e868b819004d05a190fcb27e1b682765f16ba1733cc86ddf9b7cbfc1cea713a927999c129c37652b78963ed3d352daa19eb5b567f8156ef8661d30269dacb35b9eb5efb6ed7a40f42386c06e90c13ede70e584d826126e0acc8d9d6c446b45fa4912d4c3f59995b4cd7c7313a0c375fc672a4905617dbefd2030c5593984e80b4932fdd35a0864cad3db9d9b14c550c89efb9d79987bd170f9f580ef8fe820fffb7aff479d3d0b77cbfab7c263b06b28e41bcf9beb1232ca4a6e129cd719b48d5b28c6ae0db6028873d9ef9a2d85679395f05b4fa857f333aca961427cba61ef75b215861b2bb8ce0545af9ccaca0c2d87524f6b23c17997f988e42f22fa55ae0e57099661d3f982869fc3b6b96f4c88b901a2da76a358b8d68b1c31880e8e177700c6f32a8dab9eb2b917516734badbf94fe95b76f375f1dee7b85c1d95a7896742b513d057ab4e7ff42a897957768533baea66650d9a220ec6b8b18d1d9126c0bf93f6cee9d2f850e2815e0195402eef1d568e2b49ba818af39715783b43c92a1b0a7788f5c10c6ed644a13e44a54bccbb8aa4d49aa32877e6918df26bac2714fe4ae716914f82ff6bb0fd768984dd3d42b5a8f5a0437aaa29578b331aa71b1b7cad15be885293d50ed8abb5ab5982de19056c7d05aa0e0276130000000000c6b0b523ea1a67dfe447c9dbc4909185ec314bf87fe42f8b06b985c6633f8b8a7f10d453498a9b21122751832784fc0f28dd1326e2137dcd57974f959e53a570a53048f8b14dafa095db2c710e63f41ad38763d148887aa6985a830deb4a84fe59301a57f20ee54a5d7d52c750d866196003f486694c817fc90747cbd3f946512fcc2cc718cced99c6e9ed6c718fce295a856012e9d85d214432e5a17735cdca4eab1846415c65a356c1f40822e747ed27967330fb23ea97f9b08b05b98b"], 0x0, 0x0, 0x4000000000002, 0x0)
ioctl$TIOCNXCL(r2, 0x540d)
r5 = perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r6 = syz_open_dev$loop(&(0x7f0000000300)='/dev/loop#\x00', 0x0, 0x82)
getsockopt$inet_sctp6_SCTP_PEER_AUTH_CHUNKS(0xffffffffffffffff, 0x84, 0x1a, &(0x7f0000000a80)=ANY=[], &(0x7f0000000100))
ioctl$PERF_EVENT_IOC_RESET(r5, 0x2403, 0x22)
r7 = memfd_create(&(0x7f0000000880)='cgroup2\x00u\xb56\xe0\x8f\x97\xe1\fB\x89\xe2\x96F/<\x8f\xc6\xa4\x18\"\x80\'\xbfMu\x93\x1e#\x8bA\xcfU\xaf\xcf}\xd2(Eg\xedZs\x8f3\x82\xaa\xe64\x9e\x103j\xdfhd\x99\xeb\x1d\x93y\xeb(HRU\xd03&%\xf8\xbc\xef\xd1\xef\xf8uj\x06\xc1\x8a\\Kq\x17\x1a\'[\xa7p\x0e\xdc\x11>5\x15)3Bjg\x81q\xe4\xbd\x11/\xe6\xe8\xf1\xe8\x80\xdaX\xdd\xb9tD\xbb\xc4[}\xecoV\xdd\'\xd4l\x80\x12\xdc\x7f\x1e\x05y\xae\xcc\xdfm\x16;w\x01\xa8B\xf7\x12\x13\xf9\xe3\x1eg\xe2r\x92\x91\xbc\x84\xfc\xf91\x17\f\xd9\xef0\x82\x17\x7f#h\"\xb6\xdd\xcc\xbe\x95', 0x1)
syz_open_dev$usbmon(&(0x7f0000000140)='/dev/usbmon#\x00', 0x0, 0x40087d)
io_setup(0x5, &(0x7f0000000000)=<r8=>0x0)
getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(0xffffffffffffff9c, 0x84, 0x6f, &(0x7f0000000440)={0x0, 0x84, &(0x7f0000000880)}, &(0x7f0000000100)=0xffffffffffffff55)
io_submit(r8, 0x64, &(0x7f00000000c0)=[&(0x7f0000000780)={0x0, 0x0, 0x0, 0x0, 0x3, r3, &(0x7f0000001000), 0x0, 0x4, 0x0, 0x100000001, r7}])
pwritev(r7, &(0x7f0000000340)=[{&(0x7f0000000040)='\'', 0x1}], 0x1, 0x81808)
sendmsg(0xffffffffffffffff, &(0x7f0000000940)={&(0x7f00000004c0)=@nl=@kern={0x10, 0x0, 0x0, 0x80000}, 0x80, &(0x7f00000003c0), 0x0, &(0x7f0000000980)=ANY=[], 0x0, 0x840}, 0x0)
ioctl$LOOP_CHANGE_FD(r6, 0x4c00, r7)
memfd_create(&(0x7f00000001c0)='veth1_to_bond\x00', 0x2)
openat$dsp(0xffffffffffffff9c, &(0x7f0000000240)='/dev/dsp\x00', 0x0, 0x0)
sendfile(r6, r7, &(0x7f0000000380), 0x2000005)
syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)

05:02:52 executing program 0:
recvmmsg(0xffffffffffffffff, &(0x7f0000003140)=[{{&(0x7f0000001400)=@ipx, 0x80, 0x0}}], 0x1, 0x0, 0x0)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = syz_open_procfs(0x0, &(0x7f00000004c0)='net/rt_cache\x00')
preadv(r0, &(0x7f00000017c0), 0xdc, 0x0)

[  401.701022] binder: 18584:18614 unknown command 837645062
[  401.701048] binder: 18584:18597 transaction failed 29201/-22, size 24-8 line 3097
[  401.819338] binder: 18584:18614 ioctl c0306201 20000380 returned -22
[  402.103879] binder: release 18577:18590 transaction 651 out, still active
[  402.190860] binder: undelivered TRANSACTION_ERROR: 29201
05:02:52 executing program 1:
r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000200)='/dev/nullb0\x00', 0x5000000084002, 0x0)
mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x200000e, 0x13, r0, 0x0)
r1 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x4000, 0x0)
preadv(r1, &(0x7f0000000040)=[{&(0x7f0000000400)=""/4096, 0x3ffc00}], 0x2, 0x0)

05:02:52 executing program 3:
recvmmsg(0xffffffffffffffff, &(0x7f0000003140)=[{{&(0x7f0000001400)=@ipx, 0x80, 0x0}}], 0x1, 0x0, 0x0)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = syz_open_procfs(0x0, &(0x7f00000004c0)='net/rt_cache\x00')
preadv(r0, &(0x7f00000017c0), 0xdf, 0x0)

05:02:52 executing program 0:
recvmmsg(0xffffffffffffffff, &(0x7f0000003140)=[{{&(0x7f0000001400)=@ipx, 0x80, 0x0}}], 0x1, 0x0, 0x0)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = syz_open_procfs(0x0, &(0x7f00000004c0)='net/rt_cache\x00')
preadv(r0, &(0x7f00000017c0), 0xdd, 0x0)

05:02:52 executing program 2:
r0 = syz_open_dev$sndtimer(&(0x7f0000026000)='/dev/snd/timer\x00', 0x0, 0x0)
r1 = dup3(r0, r0, 0x80000)
ioctl$UI_GET_SYSNAME(r1, 0x8040552c, 0x0)
perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8)
r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c)
bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r2, &(0x7f0000000040), 0x0, 0x1}, 0x20)
openat$cgroup_ro(r1, &(0x7f00000004c0)='cpuset.effective_cpus\x00', 0x0, 0x0)
unlink(&(0x7f0000000900)='./file0/file0\x00')
r3 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r4 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r4, 0x0)
ioctl$BINDER_GET_NODE_DEBUG_INFO(0xffffffffffffffff, 0xc018620b, &(0x7f0000000780))
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f00000000c0)=[@enter_looper], 0x48, 0x0, &(0x7f0000000700)="2ba063fb309ec7fdbfb08e6e91baee7d7d4599fe14129a4d426834556ae420e087d59c0c7be7fcad1abb7e1f8f446f373f611ca1ee9c2231708e18a47bc68a2a79a0b48931f6ff6d"})
ioctl$sock_inet_tcp_SIOCOUTQNSD(r1, 0x894b, &(0x7f0000000480))
getsockopt$inet_IP_IPSEC_POLICY(0xffffffffffffffff, 0x0, 0x10, &(0x7f0000000540)={{{@in6, @in=@remote}}, {{@in6=@ipv4={[], [], @local}}, 0x0, @in6}}, &(0x7f0000000000)=0xe8)
ioctl$BINDER_SET_CONTEXT_MGR(r4, 0x40046207, 0x0)
r5 = dup(r4)
shutdown(r5, 0x1)
prctl$PR_SET_NAME(0xf, &(0x7f0000000380)='/group.stat\x00')
syz_open_dev$binder(&(0x7f0000000880)='/dev/binder#\x00', 0x0, 0x2)
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)})
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, &(0x7f0000000780)})
ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f0000000680)})
creat(&(0x7f00000000c0)='./file0\x00', 0x0)
openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000100)='/group.stat\x00', 0x2761, 0x0)
clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000080), 0xffffffffffffffff)
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000003c0)={0x14, 0x0, &(0x7f0000000680)=[@acquire_done], 0x0, 0x0, 0x0})

05:02:52 executing program 5:
r0 = socket$pppoe(0x18, 0x1, 0x0)
ioctl$PPPIOCGCHAN(r0, 0x80047437, &(0x7f0000000080))
recvmmsg(r0, &(0x7f0000000b00)=[{{0x0, 0x0, 0x0}}], 0x300, 0x0, 0x0)
r1 = openat$cachefiles(0xffffffffffffff9c, &(0x7f0000000000)='/dev/cachefiles\x00', 0x0, 0x0)
r2 = syz_open_dev$usbmon(&(0x7f0000000140)='/dev/usbmon#\x00', 0x1, 0x1)
ioctl$VHOST_SET_VRING_KICK(r2, 0x4008af20, &(0x7f0000000100)={0x2, r2})
getsockopt$inet_sctp6_SCTP_DELAYED_SACK(r2, 0x84, 0x10, &(0x7f0000000040)=@assoc_value={<r3=>0x0, 0x405}, &(0x7f00000000c0)=0x8)
setsockopt$inet_sctp_SCTP_PR_SUPPORTED(r1, 0x84, 0x71, &(0x7f0000000180)={r3, 0x3ff}, 0x8)

[  402.379272] binder: 18636 RLIMIT_NICE not set
05:02:52 executing program 4:
fcntl$getownex(0xffffffffffffff9c, 0x10, &(0x7f0000000480))
ioctl$TIOCGSID(0xffffffffffffff9c, 0x5429, &(0x7f00000005c0)=<r0=>0x0)
r1 = getpgid(r0)
r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000280)='cpuacct.usage_user\x00', 0x0, 0x0)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0xb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000600)}, 0x2020}, 0x0, 0xffffffffffffffff, r2, 0x0)
r3 = socket$inet_tcp(0x2, 0x1, 0x0)
setsockopt$inet_sctp6_SCTP_FRAGMENT_INTERLEAVE(r2, 0x84, 0x12, &(0x7f0000000300)=0x4, 0x272)
setsockopt$IP_VS_SO_SET_STOPDAEMON(r3, 0x0, 0x48c, &(0x7f0000000080)={0x0, 'ip6gre0\x00', 0x2}, 0xfffffffffffffc51)
ioctl(r3, 0x800000000008982, &(0x7f0000000080))
r4 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000400)='/dev/ppp\x00', 0x0, 0x0)
write$FUSE_NOTIFY_DELETE(r4, &(0x7f00000003c0)=ANY=[@ANYRES16=r1], 0x231)
mount(&(0x7f0000001180)=ANY=[@ANYBLOB="cb2b4d8d30ea9b5255175d43fca389e342de5ec740fe96132329bdfbaa11c5521288697c83a9f28c7ee9d8df70f2c6849d443d5bc274a1f1576385a885b764dc4babfdf01646fa85765072f75f3267f1ced252e7419523d2075fb98f5696f4bf38817b25525ef2a46b39c1d223d17b505512d51acb6f5e0a1e53f8e26cded92ba381b83d2692b7fa7ffd3f81026e3e999bc357521a8e9799fe114e204db050bf9a50c94d3d01f8a436ccaf26a8bd4cd371f401cff939fa559e71ce024fc3c4540465cd73fd53aa2a73fdb229d7b8fbcad172ee88d3a2c1108134b2e349048cb3fd136752e22ad37130a3014904c8afeb6943fc0d38cea7e868b819004d05a190fcb27e1b682765f16ba1733cc86ddf9b7cbfc1cea713a927999c129c37652b78963ed3d352daa19eb5b567f8156ef8661d30269dacb35b9eb5efb6ed7a40f42386c06e90c13ede70e584d826126e0acc8d9d6c446b45fa4912d4c3f59995b4cd7c7313a0c375fc672a4905617dbefd2030c5593984e80b4932fdd35a0864cad3db9d9b14c550c89efb9d79987bd170f9f580ef8fe820fffb7aff479d3d0b77cbfab7c263b06b28e41bcf9beb1232ca4a6e129cd719b48d5b28c6ae0db6028873d9ef9a2d85679395f05b4fa857f333aca961427cba61ef75b215861b2bb8ce0545af9ccaca0c2d87524f6b23c17997f988e42f22fa55ae0e57099661d3f982869fc3b6b96f4c88b901a2da76a358b8d68b1c31880e8e177700c6f32a8dab9eb2b917516734badbf94fe95b76f375f1dee7b85c1d95a7896742b513d057ab4e7ff42a897957768533baea66650d9a220ec6b8b18d1d9126c0bf93f6cee9d2f850e2815e0195402eef1d568e2b49ba818af39715783b43c92a1b0a7788f5c10c6ed644a13e44a54bccbb8aa4d49aa32877e6918df26bac2714fe4ae716914f82ff6bb0fd768984dd3d42b5a8f5a0437aaa29578b331aa71b1b7cad15be885293d50ed8abb5ab5982de19056c7d05aa0e0276130000000000c6b0b523ea1a67dfe447c9dbc4909185ec314bf87fe42f8b06b985c6633f8b8a7f10d453498a9b21122751832784fc0f28dd1326e2137dcd57974f959e53a570a53048f8b14dafa095db2c710e63f41ad38763d148887aa6985a830deb4a84fe59301a57f20ee54a5d7d52c750d866196003f486694c817fc90747cbd3f946512fcc2cc718cced99c6e9ed6c718fce295a856012e9d85d214432e5a17735cdca4eab1846415c65a356c1f40822e747ed27967330fb23ea97f9b08b05b98b"], 0x0, 0x0, 0x4000000000002, 0x0)
ioctl$TIOCNXCL(r2, 0x540d)
r5 = perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r6 = syz_open_dev$loop(&(0x7f0000000300)='/dev/loop#\x00', 0x0, 0x82)
getsockopt$inet_sctp6_SCTP_PEER_AUTH_CHUNKS(0xffffffffffffffff, 0x84, 0x1a, &(0x7f0000000a80)=ANY=[], &(0x7f0000000100))
ioctl$PERF_EVENT_IOC_RESET(r5, 0x2403, 0x22)
r7 = memfd_create(&(0x7f0000000880)='cgroup2\x00u\xb56\xe0\x8f\x97\xe1\fB\x89\xe2\x96F/<\x8f\xc6\xa4\x18\"\x80\'\xbfMu\x93\x1e#\x8bA\xcfU\xaf\xcf}\xd2(Eg\xedZs\x8f3\x82\xaa\xe64\x9e\x103j\xdfhd\x99\xeb\x1d\x93y\xeb(HRU\xd03&%\xf8\xbc\xef\xd1\xef\xf8uj\x06\xc1\x8a\\Kq\x17\x1a\'[\xa7p\x0e\xdc\x11>5\x15)3Bjg\x81q\xe4\xbd\x11/\xe6\xe8\xf1\xe8\x80\xdaX\xdd\xb9tD\xbb\xc4[}\xecoV\xdd\'\xd4l\x80\x12\xdc\x7f\x1e\x05y\xae\xcc\xdfm\x16;w\x01\xa8B\xf7\x12\x13\xf9\xe3\x1eg\xe2r\x92\x91\xbc\x84\xfc\xf91\x17\f\xd9\xef0\x82\x17\x7f#h\"\xb6\xdd\xcc\xbe\x95', 0x1)
syz_open_dev$usbmon(&(0x7f0000000140)='/dev/usbmon#\x00', 0x0, 0x40087d)
io_setup(0x5, &(0x7f0000000000)=<r8=>0x0)
getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(0xffffffffffffff9c, 0x84, 0x6f, &(0x7f0000000440)={0x0, 0x84, &(0x7f0000000880)}, &(0x7f0000000100)=0xffffffffffffff55)
io_submit(r8, 0x64, &(0x7f00000000c0)=[&(0x7f0000000780)={0x0, 0x0, 0x0, 0x0, 0x3, r3, &(0x7f0000001000), 0x0, 0x4, 0x0, 0x100000001, r7}])
pwritev(r7, &(0x7f0000000340)=[{&(0x7f0000000040)='\'', 0x1}], 0x1, 0x81808)
sendmsg(0xffffffffffffffff, &(0x7f0000000940)={&(0x7f00000004c0)=@nl=@kern={0x10, 0x0, 0x0, 0x80000}, 0x80, &(0x7f00000003c0), 0x0, &(0x7f0000000980)=ANY=[], 0x0, 0x840}, 0x0)
ioctl$LOOP_CHANGE_FD(r6, 0x4c00, r7)
memfd_create(&(0x7f00000001c0)='veth1_to_bond\x00', 0x2)
openat$dsp(0xffffffffffffff9c, &(0x7f0000000240)='/dev/dsp\x00', 0x0, 0x0)
sendfile(r6, r7, &(0x7f0000000380), 0x2000005)
syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)

[  402.405776] binder: BINDER_SET_CONTEXT_MGR already set
[  402.422000] binder: 18635:18636 ioctl 40046207 0 returned -16
05:02:52 executing program 0:
recvmmsg(0xffffffffffffffff, &(0x7f0000003140)=[{{&(0x7f0000001400)=@ipx, 0x80, 0x0}}], 0x1, 0x0, 0x0)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = syz_open_procfs(0x0, &(0x7f00000004c0)='net/rt_cache\x00')
preadv(r0, &(0x7f00000017c0), 0xde, 0x0)

05:02:52 executing program 3:
recvmmsg(0xffffffffffffffff, &(0x7f0000003140)=[{{&(0x7f0000001400)=@ipx, 0x80, 0x0}}], 0x1, 0x0, 0x0)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = syz_open_procfs(0x0, &(0x7f00000004c0)='net/rt_cache\x00')
preadv(r0, &(0x7f00000017c0), 0xe0, 0x0)

05:02:52 executing program 5:
r0 = dup(0xffffffffffffffff)
gettid()
write$FUSE_LK(0xffffffffffffffff, 0x0, 0x0)
tee(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x0)
ioctl$TUNSETPERSIST(r0, 0x400454cb, 0x1)
sendto$inet6(0xffffffffffffffff, 0x0, 0x38d, 0x20000002, 0x0, 0x0)
write$FUSE_STATFS(r0, &(0x7f0000000040)={0x60, 0xffffffffffffffda, 0x1, {{0x0, 0x0, 0x5, 0x8, 0x0, 0x1, 0x8, 0x5}}}, 0x60)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$sndmidi(&(0x7f0000000000)='/dev/snd/midiC#D#\x00', 0x200, 0x0)
read(r1, 0x0, 0x0)
r2 = openat$sequencer2(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/sequencer2\x00', 0x2, 0x0)
r3 = dup2(r1, r2)
getsockopt$inet_sctp_SCTP_RECVRCVINFO(r3, 0x84, 0x20, &(0x7f0000000180), &(0x7f00000001c0)=0x4)

[  402.505990] binder: 18635:18655 BC_INCREFS_DONE node 656 has no pending increfs request
[  402.539479] binder: 18635:18655 Release 1 refcount change on invalid ref 1 ret -22
[  402.597539] binder: 18635:18655 BC_ACQUIRE_DONE node 656 has no pending acquire request
05:02:53 executing program 0:
recvmmsg(0xffffffffffffffff, &(0x7f0000003140)=[{{&(0x7f0000001400)=@ipx, 0x80, 0x0}}], 0x1, 0x0, 0x0)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = syz_open_procfs(0x0, &(0x7f00000004c0)='net/rt_cache\x00')
preadv(r0, &(0x7f00000017c0), 0xdf, 0x0)

05:02:53 executing program 5:
r0 = socket$inet6_udp(0xa, 0x2, 0x0)
get_mempolicy(&(0x7f00000003c0), &(0x7f0000000400), 0x3, &(0x7f0000ffd000/0x2000)=nil, 0x2)
r1 = dup3(r0, r0, 0x80000)
getsockopt$inet_sctp6_SCTP_RECVRCVINFO(r1, 0x84, 0x20, &(0x7f0000000000), &(0x7f0000000080)=0x4)
r2 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
connect$inet6(r0, &(0x7f00000000c0)={0xa, 0x4e24, 0x0, @local, 0x3}, 0x1c)
r3 = socket$l2tp(0x18, 0x1, 0x1)
r4 = creat(&(0x7f0000000040)='./file0\x00', 0x20)
getsockopt$inet_sctp6_SCTP_MAXSEG(0xffffffffffffff9c, 0x84, 0xd, &(0x7f0000000140)=@assoc_value={<r5=>0x0, 0xfffffffffffffffa}, &(0x7f0000000240)=0x8)
r6 = msgget(0x2, 0x1)
msgctl$IPC_RMID(r6, 0x0)
r7 = syz_genetlink_get_family_id$tipc(&(0x7f00000001c0)='TIPC\x00')
sendmsg$TIPC_CMD_GET_LINKS(r0, &(0x7f0000000500)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f00000004c0)={&(0x7f0000000480)={0x24, r7, 0x201, 0x70bd25, 0x25dfdbfd, {{}, 0x0, 0x4, 0x0, {0x8, 0x11, 0x400}}, [""]}, 0x24}}, 0x810)
ioctl$FS_IOC_ENABLE_VERITY(r2, 0x6685)
ioctl$ASHMEM_GET_PROT_MASK(r4, 0x7706, &(0x7f0000000200))
getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(r4, 0x84, 0x73, &(0x7f0000000280)={r5, 0x5, 0x0, 0x0, 0x3ff}, &(0x7f0000000440)=0x18)
r8 = openat$snapshot(0xffffffffffffff9c, 0x0, 0x82000, 0x0)
fchdir(0xffffffffffffffff)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
mkdirat(0xffffffffffffff9c, 0x0, 0x0)
socketpair(0x22, 0x2, 0x21, &(0x7f0000000000)={<r9=>0xffffffffffffffff})
getsockopt$inet6_mreq(r1, 0x29, 0x0, &(0x7f0000000540)={@mcast1}, &(0x7f0000000580)=0x14)
ioctl$sock_SIOCGSKNS(r0, 0x894c, &(0x7f00000005c0)=0x1)
getsockopt$inet_sctp6_SCTP_PR_STREAM_STATUS(r9, 0x84, 0x74, &(0x7f0000000640)=""/214, &(0x7f0000000740)=0xd6)
connect$l2tp(r3, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x0, @multicast2}, 0x4}}, 0x26)
setsockopt$inet6_IPV6_XFRM_POLICY(r0, 0x29, 0x23, &(0x7f00000002c0)={{{@in=@broadcast, @in, 0x0, 0x0, 0x0, 0x0, 0x800000000000000a}, {}, {}, 0x0, 0x0, 0x1}, {{@in, 0x0, 0x2b}, 0x0, @in, 0x0, 0x4}}, 0xe8)
ioctl$VIDIOC_ENCODER_CMD(r8, 0xc028564d, &(0x7f0000000600)={0x2, 0x1, [0x4, 0x1, 0xffffffff8040c68b, 0x3ff, 0x7ff, 0x105e5fb3, 0x2, 0x7]})
sendmmsg(r3, &(0x7f0000005fc0), 0x800000000000059, 0x0)

05:02:53 executing program 3:
recvmmsg(0xffffffffffffffff, &(0x7f0000003140)=[{{&(0x7f0000001400)=@ipx, 0x80, 0x0}}], 0x1, 0x0, 0x0)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = syz_open_procfs(0x0, &(0x7f00000004c0)='net/rt_cache\x00')
preadv(r0, &(0x7f00000017c0), 0xe1, 0x0)

[  402.825790] delete_channel: no stack
[  402.837170] delete_channel: no stack
[  402.994236] delete_channel: no stack
[  402.999503] delete_channel: no stack
[  403.149933] binder: release 18635:18636 transaction 655 out, still active
[  403.181287] binder: unexpected work type, 4, not freed
05:02:53 executing program 1:
r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000200)='/dev/nullb0\x00', 0x5000000084002, 0x0)
mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x200000e, 0x13, r0, 0x0)
r1 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x4000, 0x0)
preadv(r1, &(0x7f0000000040)=[{&(0x7f0000000400)=""/4096, 0x3ffc00}], 0x3, 0x0)

05:02:53 executing program 0:
recvmmsg(0xffffffffffffffff, &(0x7f0000003140)=[{{&(0x7f0000001400)=@ipx, 0x80, 0x0}}], 0x1, 0x0, 0x0)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = syz_open_procfs(0x0, &(0x7f00000004c0)='net/rt_cache\x00')
preadv(r0, &(0x7f00000017c0), 0xe0, 0x0)

05:02:53 executing program 3:
recvmmsg(0xffffffffffffffff, &(0x7f0000003140)=[{{&(0x7f0000001400)=@ipx, 0x80, 0x0}}], 0x1, 0x0, 0x0)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = syz_open_procfs(0x0, &(0x7f00000004c0)='net/rt_cache\x00')
preadv(r0, &(0x7f00000017c0), 0xe2, 0x0)

05:02:53 executing program 5:
r0 = syz_open_dev$sndseq(&(0x7f0000000180)='/dev/snd/seq\x00', 0x0, 0x0)
read(r0, &(0x7f0000000000)=""/28, 0x1c)
ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(r0, 0x4040534e, &(0x7f0000000080)={0x200000000bf})
ioctl$SNDRV_SEQ_IOCTL_GET_QUEUE_TIMER(r0, 0x80045301, &(0x7f0000000380)={0x0, 0x0, {}, [0x4000000000000000]})
ioctl$SNDRV_SEQ_IOCTL_GET_SUBSCRIPTION(r0, 0xc0bc5310, &(0x7f0000000300))
r1 = gettid()
socketpair(0x10, 0xe, 0x9, &(0x7f0000000040)={0xffffffffffffffff, <r2=>0xffffffffffffffff})
r3 = syz_genetlink_get_family_id$tipc(&(0x7f0000000140)='TIPC\x00')
sendmsg$TIPC_CMD_GET_REMOTE_MNG(r2, &(0x7f0000000400)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x88200}, 0xc, &(0x7f0000000280)={&(0x7f0000000200)={0x1c, r3, 0x2, 0x70bd26, 0x25dfdbff, {}, ["", "", "", "", "", "", "", ""]}, 0x1c}, 0x1, 0x0, 0x0, 0x40}, 0x4)
timer_create(0x0, &(0x7f00000002c0)={0x0, 0x12}, &(0x7f00000001c0))
timer_settime(0x0, 0x0, &(0x7f0000000240)={{}, {0x0, 0x1c9c380}}, 0x0)
tkill(r1, 0x1000000000013)

05:02:53 executing program 4:
fcntl$getownex(0xffffffffffffff9c, 0x10, &(0x7f0000000480))
ioctl$TIOCGSID(0xffffffffffffff9c, 0x5429, &(0x7f00000005c0)=<r0=>0x0)
r1 = getpgid(r0)
r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000280)='cpuacct.usage_user\x00', 0x0, 0x0)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0xb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000600)}, 0x2020}, 0x0, 0xffffffffffffffff, r2, 0x0)
r3 = socket$inet_tcp(0x2, 0x1, 0x0)
setsockopt$inet_sctp6_SCTP_FRAGMENT_INTERLEAVE(r2, 0x84, 0x12, &(0x7f0000000300)=0x4, 0x272)
setsockopt$IP_VS_SO_SET_STOPDAEMON(r3, 0x0, 0x48c, &(0x7f0000000080)={0x0, 'ip6gre0\x00', 0x2}, 0xfffffffffffffc51)
ioctl(r3, 0x800000000008982, &(0x7f0000000080))
r4 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000400)='/dev/ppp\x00', 0x0, 0x0)
write$FUSE_NOTIFY_DELETE(r4, &(0x7f00000003c0)=ANY=[@ANYRES16=r1], 0x231)
mount(&(0x7f0000001180)=ANY=[@ANYBLOB="cb2b4d8d30ea9b5255175d43fca389e342de5ec740fe96132329bdfbaa11c5521288697c83a9f28c7ee9d8df70f2c6849d443d5bc274a1f1576385a885b764dc4babfdf01646fa85765072f75f3267f1ced252e7419523d2075fb98f5696f4bf38817b25525ef2a46b39c1d223d17b505512d51acb6f5e0a1e53f8e26cded92ba381b83d2692b7fa7ffd3f81026e3e999bc357521a8e9799fe114e204db050bf9a50c94d3d01f8a436ccaf26a8bd4cd371f401cff939fa559e71ce024fc3c4540465cd73fd53aa2a73fdb229d7b8fbcad172ee88d3a2c1108134b2e349048cb3fd136752e22ad37130a3014904c8afeb6943fc0d38cea7e868b819004d05a190fcb27e1b682765f16ba1733cc86ddf9b7cbfc1cea713a927999c129c37652b78963ed3d352daa19eb5b567f8156ef8661d30269dacb35b9eb5efb6ed7a40f42386c06e90c13ede70e584d826126e0acc8d9d6c446b45fa4912d4c3f59995b4cd7c7313a0c375fc672a4905617dbefd2030c5593984e80b4932fdd35a0864cad3db9d9b14c550c89efb9d79987bd170f9f580ef8fe820fffb7aff479d3d0b77cbfab7c263b06b28e41bcf9beb1232ca4a6e129cd719b48d5b28c6ae0db6028873d9ef9a2d85679395f05b4fa857f333aca961427cba61ef75b215861b2bb8ce0545af9ccaca0c2d87524f6b23c17997f988e42f22fa55ae0e57099661d3f982869fc3b6b96f4c88b901a2da76a358b8d68b1c31880e8e177700c6f32a8dab9eb2b917516734badbf94fe95b76f375f1dee7b85c1d95a7896742b513d057ab4e7ff42a897957768533baea66650d9a220ec6b8b18d1d9126c0bf93f6cee9d2f850e2815e0195402eef1d568e2b49ba818af39715783b43c92a1b0a7788f5c10c6ed644a13e44a54bccbb8aa4d49aa32877e6918df26bac2714fe4ae716914f82ff6bb0fd768984dd3d42b5a8f5a0437aaa29578b331aa71b1b7cad15be885293d50ed8abb5ab5982de19056c7d05aa0e0276130000000000c6b0b523ea1a67dfe447c9dbc4909185ec314bf87fe42f8b06b985c6633f8b8a7f10d453498a9b21122751832784fc0f28dd1326e2137dcd57974f959e53a570a53048f8b14dafa095db2c710e63f41ad38763d148887aa6985a830deb4a84fe59301a57f20ee54a5d7d52c750d866196003f486694c817fc90747cbd3f946512fcc2cc718cced99c6e9ed6c718fce295a856012e9d85d214432e5a17735cdca4eab1846415c65a356c1f40822e747ed27967330fb23ea97f9b08b05b98b"], 0x0, 0x0, 0x4000000000002, 0x0)
ioctl$TIOCNXCL(r2, 0x540d)
r5 = perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r6 = syz_open_dev$loop(&(0x7f0000000300)='/dev/loop#\x00', 0x0, 0x82)
getsockopt$inet_sctp6_SCTP_PEER_AUTH_CHUNKS(0xffffffffffffffff, 0x84, 0x1a, &(0x7f0000000a80)=ANY=[], &(0x7f0000000100))
ioctl$PERF_EVENT_IOC_RESET(r5, 0x2403, 0x22)
r7 = memfd_create(&(0x7f0000000880)='cgroup2\x00u\xb56\xe0\x8f\x97\xe1\fB\x89\xe2\x96F/<\x8f\xc6\xa4\x18\"\x80\'\xbfMu\x93\x1e#\x8bA\xcfU\xaf\xcf}\xd2(Eg\xedZs\x8f3\x82\xaa\xe64\x9e\x103j\xdfhd\x99\xeb\x1d\x93y\xeb(HRU\xd03&%\xf8\xbc\xef\xd1\xef\xf8uj\x06\xc1\x8a\\Kq\x17\x1a\'[\xa7p\x0e\xdc\x11>5\x15)3Bjg\x81q\xe4\xbd\x11/\xe6\xe8\xf1\xe8\x80\xdaX\xdd\xb9tD\xbb\xc4[}\xecoV\xdd\'\xd4l\x80\x12\xdc\x7f\x1e\x05y\xae\xcc\xdfm\x16;w\x01\xa8B\xf7\x12\x13\xf9\xe3\x1eg\xe2r\x92\x91\xbc\x84\xfc\xf91\x17\f\xd9\xef0\x82\x17\x7f#h\"\xb6\xdd\xcc\xbe\x95', 0x1)
syz_open_dev$usbmon(&(0x7f0000000140)='/dev/usbmon#\x00', 0x0, 0x40087d)
io_setup(0x5, &(0x7f0000000000)=<r8=>0x0)
getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(0xffffffffffffff9c, 0x84, 0x6f, &(0x7f0000000440)={0x0, 0x84, &(0x7f0000000880)}, &(0x7f0000000100)=0xffffffffffffff55)
io_submit(r8, 0x64, &(0x7f00000000c0)=[&(0x7f0000000780)={0x0, 0x0, 0x0, 0x0, 0x3, r3, &(0x7f0000001000), 0x0, 0x4, 0x0, 0x100000001, r7}])
pwritev(r7, &(0x7f0000000340)=[{&(0x7f0000000040)='\'', 0x1}], 0x1, 0x81808)
sendmsg(0xffffffffffffffff, &(0x7f0000000940)={&(0x7f00000004c0)=@nl=@kern={0x10, 0x0, 0x0, 0x80000}, 0x80, &(0x7f00000003c0), 0x0, &(0x7f0000000980)=ANY=[], 0x0, 0x840}, 0x0)
ioctl$LOOP_CHANGE_FD(r6, 0x4c00, r7)
memfd_create(&(0x7f00000001c0)='veth1_to_bond\x00', 0x2)
openat$dsp(0xffffffffffffff9c, &(0x7f0000000240)='/dev/dsp\x00', 0x0, 0x0)
sendfile(r6, r7, &(0x7f0000000380), 0x2000005)
syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)

05:02:53 executing program 2:
r0 = syz_open_dev$sndtimer(&(0x7f0000026000)='/dev/snd/timer\x00', 0x0, 0x0)
r1 = dup3(r0, r0, 0x80000)
ioctl$UI_GET_SYSNAME(r1, 0x8040552c, 0x0)
perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8)
r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c)
bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r2, &(0x7f0000000040), 0x0, 0x1}, 0x20)
openat$cgroup_ro(r1, &(0x7f00000004c0)='cpuset.effective_cpus\x00', 0x0, 0x0)
unlink(&(0x7f0000000900)='./file0/file0\x00')
r3 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r4 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r4, 0x0)
ioctl$BINDER_GET_NODE_DEBUG_INFO(0xffffffffffffffff, 0xc018620b, &(0x7f0000000780))
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f00000000c0)=[@enter_looper], 0x48, 0x0, &(0x7f0000000700)="2ba063fb309ec7fdbfb08e6e91baee7d7d4599fe14129a4d426834556ae420e087d59c0c7be7fcad1abb7e1f8f446f373f611ca1ee9c2231708e18a47bc68a2a79a0b48931f6ff6d"})
ioctl$sock_inet_tcp_SIOCOUTQNSD(r1, 0x894b, &(0x7f0000000480))
getsockopt$inet_IP_IPSEC_POLICY(0xffffffffffffffff, 0x0, 0x10, &(0x7f0000000540)={{{@in6, @in=@remote}}, {{@in6=@ipv4={[], [], @local}}, 0x0, @in6}}, &(0x7f0000000000)=0xe8)
ioctl$BINDER_SET_CONTEXT_MGR(r4, 0x40046207, 0x0)
r5 = dup(r4)
shutdown(r5, 0x1)
prctl$PR_SET_NAME(0xf, &(0x7f0000000380)='/group.stat\x00')
syz_open_dev$binder(&(0x7f0000000880)='/dev/binder#\x00', 0x0, 0x2)
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)})
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, &(0x7f0000000780)})
ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f0000000680)})
creat(&(0x7f00000000c0)='./file0\x00', 0x0)
openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000100)='/group.stat\x00', 0x2761, 0x0)
clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000080), 0xffffffffffffffff)
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000003c0)={0x14, 0x0, &(0x7f0000000680)=[@acquire_done], 0x0, 0x0, 0x0})

[  403.202398] binder: undelivered TRANSACTION_COMPLETE
[  403.289199] binder: 18700 RLIMIT_NICE not set
05:02:53 executing program 3:
recvmmsg(0xffffffffffffffff, &(0x7f0000003140)=[{{&(0x7f0000001400)=@ipx, 0x80, 0x0}}], 0x1, 0x0, 0x0)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = syz_open_procfs(0x0, &(0x7f00000004c0)='net/rt_cache\x00')
preadv(r0, &(0x7f00000017c0), 0xe3, 0x0)

[  403.315543] binder: BINDER_SET_CONTEXT_MGR already set
05:02:53 executing program 0:
recvmmsg(0xffffffffffffffff, &(0x7f0000003140)=[{{&(0x7f0000001400)=@ipx, 0x80, 0x0}}], 0x1, 0x0, 0x0)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = syz_open_procfs(0x0, &(0x7f00000004c0)='net/rt_cache\x00')
preadv(r0, &(0x7f00000017c0), 0xe1, 0x0)

[  403.364506] binder: 18698:18700 ioctl 40046207 0 returned -16
[  403.397499] binder: 18698:18710 Release 1 refcount change on invalid ref 1 ret -22
05:02:53 executing program 2:
r0 = syz_open_dev$sndtimer(&(0x7f0000026000)='/dev/snd/timer\x00', 0x0, 0x0)
r1 = dup3(r0, r0, 0x80000)
ioctl$UI_GET_SYSNAME(r1, 0x8040552c, 0x0)
perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8)
r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c)
bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r2, &(0x7f0000000040), 0x0, 0x1}, 0x20)
openat$cgroup_ro(r1, &(0x7f00000004c0)='cpuset.effective_cpus\x00', 0x0, 0x0)
unlink(&(0x7f0000000900)='./file0/file0\x00')
r3 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r4 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r4, 0x0)
ioctl$BINDER_GET_NODE_DEBUG_INFO(0xffffffffffffffff, 0xc018620b, &(0x7f0000000780))
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f00000000c0)=[@enter_looper], 0x48, 0x0, &(0x7f0000000700)="2ba063fb309ec7fdbfb08e6e91baee7d7d4599fe14129a4d426834556ae420e087d59c0c7be7fcad1abb7e1f8f446f373f611ca1ee9c2231708e18a47bc68a2a79a0b48931f6ff6d"})
ioctl$sock_inet_tcp_SIOCOUTQNSD(r1, 0x894b, &(0x7f0000000480))
getsockopt$inet_IP_IPSEC_POLICY(0xffffffffffffffff, 0x0, 0x10, &(0x7f0000000540)={{{@in6, @in=@remote}}, {{@in6=@ipv4={[], [], @local}}, 0x0, @in6}}, &(0x7f0000000000)=0xe8)
ioctl$BINDER_SET_CONTEXT_MGR(r4, 0x40046207, 0x0)
r5 = dup(r4)
shutdown(r5, 0x1)
prctl$PR_SET_NAME(0xf, &(0x7f0000000380)='/group.stat\x00')
syz_open_dev$binder(&(0x7f0000000880)='/dev/binder#\x00', 0x0, 0x2)
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)})
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, &(0x7f0000000780)})
ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f0000000680)})
creat(&(0x7f00000000c0)='./file0\x00', 0x0)
openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000100)='/group.stat\x00', 0x2761, 0x0)
clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000080), 0xffffffffffffffff)
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000003c0)={0x14, 0x0, &(0x7f0000000680)=[@acquire_done], 0x0, 0x0, 0x0})

[  403.458619] binder: release 18698:18710 transaction 658 out, still active
05:02:53 executing program 3:
recvmmsg(0xffffffffffffffff, &(0x7f0000003140)=[{{&(0x7f0000001400)=@ipx, 0x80, 0x0}}], 0x1, 0x0, 0x0)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = syz_open_procfs(0x0, &(0x7f00000004c0)='net/rt_cache\x00')
preadv(r0, &(0x7f00000017c0), 0xe4, 0x0)

05:02:53 executing program 0:
recvmmsg(0xffffffffffffffff, &(0x7f0000003140)=[{{&(0x7f0000001400)=@ipx, 0x80, 0x0}}], 0x1, 0x0, 0x0)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = syz_open_procfs(0x0, &(0x7f00000004c0)='net/rt_cache\x00')
preadv(r0, &(0x7f00000017c0), 0xe2, 0x0)

[  403.599587] binder: 18726 RLIMIT_NICE not set
[  403.613023] binder: BINDER_SET_CONTEXT_MGR already set
05:02:54 executing program 3:
recvmmsg(0xffffffffffffffff, &(0x7f0000003140)=[{{&(0x7f0000001400)=@ipx, 0x80, 0x0}}], 0x1, 0x0, 0x0)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = syz_open_procfs(0x0, &(0x7f00000004c0)='net/rt_cache\x00')
preadv(r0, &(0x7f00000017c0), 0xe5, 0x0)

[  403.653078] binder: 18725:18726 ioctl 40046207 0 returned -16
[  403.744558] binder: 18725:18735 BC_INCREFS_DONE node 662 has no pending increfs request
[  403.778779] binder: 18725:18735 Release 1 refcount change on invalid ref 1 ret -22
[  403.801286] binder: 18725:18735 BC_ACQUIRE_DONE node 662 has no pending acquire request
05:02:54 executing program 1:
r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000200)='/dev/nullb0\x00', 0x5000000084002, 0x0)
mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x200000e, 0x13, r0, 0x0)
r1 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x4000, 0x0)
preadv(r1, &(0x7f0000000040)=[{&(0x7f0000000400)=""/4096, 0x3ffc00}], 0x4, 0x0)

05:02:54 executing program 0:
recvmmsg(0xffffffffffffffff, &(0x7f0000003140)=[{{&(0x7f0000001400)=@ipx, 0x80, 0x0}}], 0x1, 0x0, 0x0)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = syz_open_procfs(0x0, &(0x7f00000004c0)='net/rt_cache\x00')
preadv(r0, &(0x7f00000017c0), 0xe3, 0x0)

05:02:54 executing program 4:
fcntl$getownex(0xffffffffffffff9c, 0x10, &(0x7f0000000480))
ioctl$TIOCGSID(0xffffffffffffff9c, 0x5429, &(0x7f00000005c0)=<r0=>0x0)
r1 = getpgid(r0)
r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000280)='cpuacct.usage_user\x00', 0x0, 0x0)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0xb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000600)}, 0x2020}, 0x0, 0xffffffffffffffff, r2, 0x0)
r3 = socket$inet_tcp(0x2, 0x1, 0x0)
setsockopt$inet_sctp6_SCTP_FRAGMENT_INTERLEAVE(r2, 0x84, 0x12, &(0x7f0000000300)=0x4, 0x272)
setsockopt$IP_VS_SO_SET_STOPDAEMON(r3, 0x0, 0x48c, &(0x7f0000000080)={0x0, 'ip6gre0\x00', 0x2}, 0xfffffffffffffc51)
ioctl(r3, 0x800000000008982, &(0x7f0000000080))
r4 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000400)='/dev/ppp\x00', 0x0, 0x0)
write$FUSE_NOTIFY_DELETE(r4, &(0x7f00000003c0)=ANY=[@ANYRES16=r1], 0x231)
mount(&(0x7f0000001180)=ANY=[@ANYBLOB="cb2b4d8d30ea9b5255175d43fca389e342de5ec740fe96132329bdfbaa11c5521288697c83a9f28c7ee9d8df70f2c6849d443d5bc274a1f1576385a885b764dc4babfdf01646fa85765072f75f3267f1ced252e7419523d2075fb98f5696f4bf38817b25525ef2a46b39c1d223d17b505512d51acb6f5e0a1e53f8e26cded92ba381b83d2692b7fa7ffd3f81026e3e999bc357521a8e9799fe114e204db050bf9a50c94d3d01f8a436ccaf26a8bd4cd371f401cff939fa559e71ce024fc3c4540465cd73fd53aa2a73fdb229d7b8fbcad172ee88d3a2c1108134b2e349048cb3fd136752e22ad37130a3014904c8afeb6943fc0d38cea7e868b819004d05a190fcb27e1b682765f16ba1733cc86ddf9b7cbfc1cea713a927999c129c37652b78963ed3d352daa19eb5b567f8156ef8661d30269dacb35b9eb5efb6ed7a40f42386c06e90c13ede70e584d826126e0acc8d9d6c446b45fa4912d4c3f59995b4cd7c7313a0c375fc672a4905617dbefd2030c5593984e80b4932fdd35a0864cad3db9d9b14c550c89efb9d79987bd170f9f580ef8fe820fffb7aff479d3d0b77cbfab7c263b06b28e41bcf9beb1232ca4a6e129cd719b48d5b28c6ae0db6028873d9ef9a2d85679395f05b4fa857f333aca961427cba61ef75b215861b2bb8ce0545af9ccaca0c2d87524f6b23c17997f988e42f22fa55ae0e57099661d3f982869fc3b6b96f4c88b901a2da76a358b8d68b1c31880e8e177700c6f32a8dab9eb2b917516734badbf94fe95b76f375f1dee7b85c1d95a7896742b513d057ab4e7ff42a897957768533baea66650d9a220ec6b8b18d1d9126c0bf93f6cee9d2f850e2815e0195402eef1d568e2b49ba818af39715783b43c92a1b0a7788f5c10c6ed644a13e44a54bccbb8aa4d49aa32877e6918df26bac2714fe4ae716914f82ff6bb0fd768984dd3d42b5a8f5a0437aaa29578b331aa71b1b7cad15be885293d50ed8abb5ab5982de19056c7d05aa0e0276130000000000c6b0b523ea1a67dfe447c9dbc4909185ec314bf87fe42f8b06b985c6633f8b8a7f10d453498a9b21122751832784fc0f28dd1326e2137dcd57974f959e53a570a53048f8b14dafa095db2c710e63f41ad38763d148887aa6985a830deb4a84fe59301a57f20ee54a5d7d52c750d866196003f486694c817fc90747cbd3f946512fcc2cc718cced99c6e9ed6c718fce295a856012e9d85d214432e5a17735cdca4eab1846415c65a356c1f40822e747ed27967330fb23ea97f9b08b05b98b"], 0x0, 0x0, 0x4000000000002, 0x0)
ioctl$TIOCNXCL(r2, 0x540d)
r5 = perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r6 = syz_open_dev$loop(&(0x7f0000000300)='/dev/loop#\x00', 0x0, 0x82)
getsockopt$inet_sctp6_SCTP_PEER_AUTH_CHUNKS(0xffffffffffffffff, 0x84, 0x1a, &(0x7f0000000a80)=ANY=[], &(0x7f0000000100))
ioctl$PERF_EVENT_IOC_RESET(r5, 0x2403, 0x22)
r7 = memfd_create(&(0x7f0000000880)='cgroup2\x00u\xb56\xe0\x8f\x97\xe1\fB\x89\xe2\x96F/<\x8f\xc6\xa4\x18\"\x80\'\xbfMu\x93\x1e#\x8bA\xcfU\xaf\xcf}\xd2(Eg\xedZs\x8f3\x82\xaa\xe64\x9e\x103j\xdfhd\x99\xeb\x1d\x93y\xeb(HRU\xd03&%\xf8\xbc\xef\xd1\xef\xf8uj\x06\xc1\x8a\\Kq\x17\x1a\'[\xa7p\x0e\xdc\x11>5\x15)3Bjg\x81q\xe4\xbd\x11/\xe6\xe8\xf1\xe8\x80\xdaX\xdd\xb9tD\xbb\xc4[}\xecoV\xdd\'\xd4l\x80\x12\xdc\x7f\x1e\x05y\xae\xcc\xdfm\x16;w\x01\xa8B\xf7\x12\x13\xf9\xe3\x1eg\xe2r\x92\x91\xbc\x84\xfc\xf91\x17\f\xd9\xef0\x82\x17\x7f#h\"\xb6\xdd\xcc\xbe\x95', 0x1)
syz_open_dev$usbmon(&(0x7f0000000140)='/dev/usbmon#\x00', 0x0, 0x40087d)
io_setup(0x5, &(0x7f0000000000)=<r8=>0x0)
getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(0xffffffffffffff9c, 0x84, 0x6f, &(0x7f0000000440)={0x0, 0x84, &(0x7f0000000880)}, &(0x7f0000000100)=0xffffffffffffff55)
io_submit(r8, 0x64, &(0x7f00000000c0)=[&(0x7f0000000780)={0x0, 0x0, 0x0, 0x0, 0x3, r3, &(0x7f0000001000), 0x0, 0x4, 0x0, 0x100000001, r7}])
pwritev(r7, &(0x7f0000000340)=[{&(0x7f0000000040)='\'', 0x1}], 0x1, 0x81808)
sendmsg(0xffffffffffffffff, &(0x7f0000000940)={&(0x7f00000004c0)=@nl=@kern={0x10, 0x0, 0x0, 0x80000}, 0x80, &(0x7f00000003c0), 0x0, &(0x7f0000000980)=ANY=[], 0x0, 0x840}, 0x0)
ioctl$LOOP_CHANGE_FD(r6, 0x4c00, r7)
memfd_create(&(0x7f00000001c0)='veth1_to_bond\x00', 0x2)
openat$dsp(0xffffffffffffff9c, &(0x7f0000000240)='/dev/dsp\x00', 0x0, 0x0)
sendfile(r6, r7, &(0x7f0000000380), 0x2000005)
syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)

05:02:54 executing program 5:
r0 = syz_open_dev$sndtimer(&(0x7f0000026000)='/dev/snd/timer\x00', 0x0, 0x0)
r1 = dup3(r0, r0, 0x80000)
ioctl$UI_GET_SYSNAME(r1, 0x8040552c, 0x0)
perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8)
r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c)
bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r2, &(0x7f0000000040), 0x0, 0x1}, 0x20)
openat$cgroup_ro(r1, &(0x7f00000004c0)='cpuset.effective_cpus\x00', 0x0, 0x0)
unlink(&(0x7f0000000900)='./file0/file0\x00')
r3 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r4 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r4, 0x0)
ioctl$BINDER_GET_NODE_DEBUG_INFO(0xffffffffffffffff, 0xc018620b, &(0x7f0000000780))
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f00000000c0)=[@enter_looper], 0x48, 0x0, &(0x7f0000000700)="2ba063fb309ec7fdbfb08e6e91baee7d7d4599fe14129a4d426834556ae420e087d59c0c7be7fcad1abb7e1f8f446f373f611ca1ee9c2231708e18a47bc68a2a79a0b48931f6ff6d"})
ioctl$sock_inet_tcp_SIOCOUTQNSD(r1, 0x894b, &(0x7f0000000480))
getsockopt$inet_IP_IPSEC_POLICY(0xffffffffffffffff, 0x0, 0x10, &(0x7f0000000540)={{{@in6, @in=@remote}}, {{@in6=@ipv4={[], [], @local}}, 0x0, @in6}}, &(0x7f0000000000)=0xe8)
ioctl$BINDER_SET_CONTEXT_MGR(r4, 0x40046207, 0x0)
r5 = dup(r4)
shutdown(r5, 0x1)
prctl$PR_SET_NAME(0xf, &(0x7f0000000380)='/group.stat\x00')
syz_open_dev$binder(&(0x7f0000000880)='/dev/binder#\x00', 0x0, 0x2)
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)})
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, &(0x7f0000000780)})
ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f0000000680)})
creat(&(0x7f00000000c0)='./file0\x00', 0x0)
openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000100)='/group.stat\x00', 0x2761, 0x0)
clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000080), 0xffffffffffffffff)
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000003c0)={0x14, 0x0, &(0x7f0000000680)=[@acquire_done], 0x0, 0x0, 0x0})

05:02:54 executing program 2:
r0 = syz_open_dev$sndtimer(&(0x7f0000026000)='/dev/snd/timer\x00', 0x0, 0x0)
r1 = dup3(r0, r0, 0x80000)
ioctl$UI_GET_SYSNAME(r1, 0x8040552c, 0x0)
perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8)
r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c)
bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r2, &(0x7f0000000040), 0x0, 0x1}, 0x20)
openat$cgroup_ro(r1, &(0x7f00000004c0)='cpuset.effective_cpus\x00', 0x0, 0x0)
unlink(&(0x7f0000000900)='./file0/file0\x00')
r3 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r4 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r4, 0x0)
ioctl$BINDER_GET_NODE_DEBUG_INFO(r3, 0xc018620b, 0x0)
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f00000000c0)=[@enter_looper], 0x48, 0x0, &(0x7f0000000700)="2ba063fb309ec7fdbfb08e6e91baee7d7d4599fe14129a4d426834556ae420e087d59c0c7be7fcad1abb7e1f8f446f373f611ca1ee9c2231708e18a47bc68a2a79a0b48931f6ff6d"})
ioctl$sock_inet_tcp_SIOCOUTQNSD(r1, 0x894b, &(0x7f0000000480))
getsockopt$inet_IP_IPSEC_POLICY(0xffffffffffffffff, 0x0, 0x10, &(0x7f0000000540)={{{@in6, @in=@remote}}, {{@in6=@ipv4={[], [], @local}}, 0x0, @in6}}, &(0x7f0000000000)=0xe8)
ioctl$BINDER_SET_CONTEXT_MGR(r4, 0x40046207, 0x0)
r5 = dup(r4)
shutdown(r5, 0x1)
prctl$PR_SET_NAME(0xf, &(0x7f0000000380)='/group.stat\x00')
syz_open_dev$binder(&(0x7f0000000880)='/dev/binder#\x00', 0x0, 0x2)
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)})
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, &(0x7f0000000780)})
ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f0000000680)})
creat(&(0x7f00000000c0)='./file0\x00', 0x0)
openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000100)='/group.stat\x00', 0x2761, 0x0)
clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000080), 0xffffffffffffffff)
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000003c0)={0x14, 0x0, &(0x7f0000000680)=[@acquire_done], 0x0, 0x0, 0x0})

05:02:54 executing program 3:
recvmmsg(0xffffffffffffffff, &(0x7f0000003140)=[{{&(0x7f0000001400)=@ipx, 0x80, 0x0}}], 0x1, 0x0, 0x0)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = syz_open_procfs(0x0, &(0x7f00000004c0)='net/rt_cache\x00')
preadv(r0, &(0x7f00000017c0), 0xe6, 0x0)

05:02:54 executing program 0:
recvmmsg(0xffffffffffffffff, &(0x7f0000003140)=[{{&(0x7f0000001400)=@ipx, 0x80, 0x0}}], 0x1, 0x0, 0x0)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = syz_open_procfs(0x0, &(0x7f00000004c0)='net/rt_cache\x00')
preadv(r0, &(0x7f00000017c0), 0xe4, 0x0)

[  404.297860] binder: 18864:18865 ioctl c018620b 0 returned -14
05:02:54 executing program 4:
r0 = syz_open_dev$sndtimer(&(0x7f0000026000)='/dev/snd/timer\x00', 0x0, 0x0)
r1 = dup3(r0, r0, 0x80000)
ioctl$UI_GET_SYSNAME(r1, 0x8040552c, 0x0)
perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8)
r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c)
bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r2, &(0x7f0000000040), 0x0, 0x1}, 0x20)
openat$cgroup_ro(r1, &(0x7f00000004c0)='cpuset.effective_cpus\x00', 0x0, 0x0)
unlink(&(0x7f0000000900)='./file0/file0\x00')
r3 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r4 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r4, 0x0)
ioctl$BINDER_GET_NODE_DEBUG_INFO(0xffffffffffffffff, 0xc018620b, &(0x7f0000000780))
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f00000000c0)=[@enter_looper], 0x48, 0x0, &(0x7f0000000700)="2ba063fb309ec7fdbfb08e6e91baee7d7d4599fe14129a4d426834556ae420e087d59c0c7be7fcad1abb7e1f8f446f373f611ca1ee9c2231708e18a47bc68a2a79a0b48931f6ff6d"})
ioctl$sock_inet_tcp_SIOCOUTQNSD(r1, 0x894b, &(0x7f0000000480))
getsockopt$inet_IP_IPSEC_POLICY(0xffffffffffffffff, 0x0, 0x10, &(0x7f0000000540)={{{@in6, @in=@remote}}, {{@in6=@ipv4={[], [], @local}}, 0x0, @in6}}, &(0x7f0000000000)=0xe8)
ioctl$BINDER_SET_CONTEXT_MGR(r4, 0x40046207, 0x0)
r5 = dup(r4)
shutdown(r5, 0x1)
prctl$PR_SET_NAME(0xf, &(0x7f0000000380)='/group.stat\x00')
syz_open_dev$binder(&(0x7f0000000880)='/dev/binder#\x00', 0x0, 0x2)
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)})
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, &(0x7f0000000780)})
ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f0000000680)})
creat(&(0x7f00000000c0)='./file0\x00', 0x0)
openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000100)='/group.stat\x00', 0x2761, 0x0)
clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000080), 0xffffffffffffffff)
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000003c0)={0x14, 0x0, &(0x7f0000000680)=[@acquire_done], 0x0, 0x0, 0x0})

05:02:54 executing program 3:
recvmmsg(0xffffffffffffffff, &(0x7f0000003140)=[{{&(0x7f0000001400)=@ipx, 0x80, 0x0}}], 0x1, 0x0, 0x0)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = syz_open_procfs(0x0, &(0x7f00000004c0)='net/rt_cache\x00')
preadv(r0, &(0x7f00000017c0), 0xe7, 0x0)

[  404.340915] binder: 18865 RLIMIT_NICE not set
[  404.360204] binder: 18873 RLIMIT_NICE not set
05:02:54 executing program 0:
recvmmsg(0xffffffffffffffff, &(0x7f0000003140)=[{{&(0x7f0000001400)=@ipx, 0x80, 0x0}}], 0x1, 0x0, 0x0)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = syz_open_procfs(0x0, &(0x7f00000004c0)='net/rt_cache\x00')
preadv(r0, &(0x7f00000017c0), 0xe5, 0x0)

[  404.389220] binder: BINDER_SET_CONTEXT_MGR already set
[  404.444202] binder: 18864:18876 ioctl 40046207 0 returned -16
[  404.450846] binder: BINDER_SET_CONTEXT_MGR already set
[  404.474858] binder: 18868:18873 ioctl 40046207 0 returned -16
[  404.475807] binder: 18864:18876 Release 1 refcount change on invalid ref 1 ret -22
05:02:54 executing program 0:
recvmmsg(0xffffffffffffffff, &(0x7f0000003140)=[{{&(0x7f0000001400)=@ipx, 0x80, 0x0}}], 0x1, 0x0, 0x0)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = syz_open_procfs(0x0, &(0x7f00000004c0)='net/rt_cache\x00')
preadv(r0, &(0x7f00000017c0), 0xe6, 0x0)

[  404.497087] binder: 18868:18888 Release 1 refcount change on invalid ref 1 ret -22
[  404.497373] binder: 18879 RLIMIT_NICE not set
[  404.532994] binder: BINDER_SET_CONTEXT_MGR already set
05:02:54 executing program 3:
recvmmsg(0xffffffffffffffff, &(0x7f0000003140)=[{{&(0x7f0000001400)=@ipx, 0x80, 0x0}}], 0x1, 0x0, 0x0)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = syz_open_procfs(0x0, &(0x7f00000004c0)='net/rt_cache\x00')
preadv(r0, &(0x7f00000017c0), 0xe8, 0x0)

[  404.559350] binder: 18878:18879 ioctl 40046207 0 returned -16
[  404.605125] binder: release 18868:18888 transaction 667 out, still active
[  404.626076] binder: 18878:18896 BC_INCREFS_DONE node 671 has no pending increfs request
05:02:55 executing program 1:
r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000200)='/dev/nullb0\x00', 0x5000000084002, 0x0)
mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x200000e, 0x13, r0, 0x0)
r1 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x4000, 0x0)
preadv(r1, &(0x7f0000000040)=[{&(0x7f0000000400)=""/4096, 0x3ffc00}], 0x5, 0x0)

05:02:55 executing program 5:
r0 = socket$inet6_sctp(0xa, 0x5, 0x84)
r1 = dup3(r0, r0, 0x80000)
setsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX(r0, 0x84, 0x6e, &(0x7f0000961fe4)=[@in={0x2, 0x0, @dev}], 0x10)
getsockopt$inet_sctp6_SCTP_GET_ASSOC_ID_LIST(r0, 0x84, 0x1d, &(0x7f000095dff8)=ANY=[@ANYBLOB='\x00\x00\x00\x00', @ANYRES32=<r2=>0x0], &(0x7f0000000080)=0x8)
ioctl$GIO_UNISCRNMAP(r1, 0x4b69, &(0x7f0000000300)=""/252)
ioctl$UI_SET_MSCBIT(r1, 0x40045568, 0x9)
getsockopt$inet_sctp6_SCTP_PRIMARY_ADDR(r0, 0x84, 0x6, &(0x7f0000000200)={<r3=>r2, @in={{0x2, 0x0, @local}}}, &(0x7f00000002c0)=0x84)
getsockopt$inet_sctp6_SCTP_MAX_BURST(r0, 0x84, 0x14, &(0x7f0000000140), &(0x7f0000000180)=0x4)
getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(0xffffffffffffffff, 0x84, 0x73, &(0x7f0000000000)={<r4=>r3, 0x4, 0x30, 0x7, 0x9}, &(0x7f00000000c0)=0x18)
setsockopt$inet_sctp6_SCTP_ASSOCINFO(r0, 0x84, 0x1, &(0x7f0000000100)={r4, 0x7fff, 0x5, 0x80000000, 0x0, 0x1000}, 0x14)
setsockopt$inet_sctp6_SCTP_MAX_BURST(r0, 0x84, 0x75, &(0x7f0000000040)=@assoc_value={r3}, 0x8)

05:02:55 executing program 3:
recvmmsg(0xffffffffffffffff, &(0x7f0000003140)=[{{&(0x7f0000001400)=@ipx, 0x80, 0x0}}], 0x1, 0x0, 0x0)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = syz_open_procfs(0x0, &(0x7f00000004c0)='net/rt_cache\x00')
preadv(r0, &(0x7f00000017c0), 0xe9, 0x0)

[  404.670794] binder: 18878:18896 Release 1 refcount change on invalid ref 1 ret -22
05:02:55 executing program 0:
recvmmsg(0xffffffffffffffff, &(0x7f0000003140)=[{{&(0x7f0000001400)=@ipx, 0x80, 0x0}}], 0x1, 0x0, 0x0)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = syz_open_procfs(0x0, &(0x7f00000004c0)='net/rt_cache\x00')
preadv(r0, &(0x7f00000017c0), 0xe7, 0x0)

[  404.729170] binder: 18878:18896 BC_ACQUIRE_DONE node 671 has no pending acquire request
[  404.771482] sctp: [Deprecated]: syz-executor.5 (pid 18909) Use of int in max_burst socket option.
[  404.771482] Use struct sctp_assoc_value instead
05:02:55 executing program 2:
r0 = syz_open_dev$sndtimer(&(0x7f0000026000)='/dev/snd/timer\x00', 0x0, 0x0)
r1 = dup3(r0, r0, 0x80000)
ioctl$UI_GET_SYSNAME(r1, 0x8040552c, 0x0)
perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8)
r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c)
bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r2, &(0x7f0000000040), 0x0, 0x1}, 0x20)
openat$cgroup_ro(r1, &(0x7f00000004c0)='cpuset.effective_cpus\x00', 0x0, 0x0)
unlink(&(0x7f0000000900)='./file0/file0\x00')
r3 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r4 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r4, 0x0)
ioctl$BINDER_GET_NODE_DEBUG_INFO(r3, 0xc018620b, 0x0)
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f00000000c0)=[@enter_looper], 0x48, 0x0, &(0x7f0000000700)="2ba063fb309ec7fdbfb08e6e91baee7d7d4599fe14129a4d426834556ae420e087d59c0c7be7fcad1abb7e1f8f446f373f611ca1ee9c2231708e18a47bc68a2a79a0b48931f6ff6d"})
ioctl$sock_inet_tcp_SIOCOUTQNSD(r1, 0x894b, &(0x7f0000000480))
getsockopt$inet_IP_IPSEC_POLICY(0xffffffffffffffff, 0x0, 0x10, &(0x7f0000000540)={{{@in6, @in=@remote}}, {{@in6=@ipv4={[], [], @local}}, 0x0, @in6}}, &(0x7f0000000000)=0xe8)
ioctl$BINDER_SET_CONTEXT_MGR(r4, 0x40046207, 0x0)
r5 = dup(r4)
shutdown(r5, 0x1)
prctl$PR_SET_NAME(0xf, &(0x7f0000000380)='/group.stat\x00')
syz_open_dev$binder(&(0x7f0000000880)='/dev/binder#\x00', 0x0, 0x2)
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)})
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, &(0x7f0000000780)})
ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f0000000680)})
creat(&(0x7f00000000c0)='./file0\x00', 0x0)
openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000100)='/group.stat\x00', 0x2761, 0x0)
clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000080), 0xffffffffffffffff)
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000003c0)={0x14, 0x0, &(0x7f0000000680)=[@acquire_done], 0x0, 0x0, 0x0})

05:02:55 executing program 0:
recvmmsg(0xffffffffffffffff, &(0x7f0000003140)=[{{&(0x7f0000001400)=@ipx, 0x80, 0x0}}], 0x1, 0x0, 0x0)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = syz_open_procfs(0x0, &(0x7f00000004c0)='net/rt_cache\x00')
preadv(r0, &(0x7f00000017c0), 0xe8, 0x0)

05:02:55 executing program 3:
recvmmsg(0xffffffffffffffff, &(0x7f0000003140)=[{{&(0x7f0000001400)=@ipx, 0x80, 0x0}}], 0x1, 0x0, 0x0)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = syz_open_procfs(0x0, &(0x7f00000004c0)='net/rt_cache\x00')
preadv(r0, &(0x7f00000017c0), 0xea, 0x0)

[  405.032801] binder: release 18864:18883 transaction 664 out, still active
[  405.171351] binder: 18927:18929 ioctl c018620b 0 returned -14
[  405.195190] binder: 18929 RLIMIT_NICE not set
[  405.214014] binder: release 18878:18879 transaction 670 out, still active
05:02:55 executing program 4:
r0 = syz_open_dev$sndtimer(&(0x7f0000026000)='/dev/snd/timer\x00', 0x0, 0x0)
r1 = dup3(r0, r0, 0x80000)
ioctl$UI_GET_SYSNAME(r1, 0x8040552c, 0x0)
perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8)
r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c)
bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r2, &(0x7f0000000040), 0x0, 0x1}, 0x20)
openat$cgroup_ro(r1, &(0x7f00000004c0)='cpuset.effective_cpus\x00', 0x0, 0x0)
unlink(&(0x7f0000000900)='./file0/file0\x00')
r3 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r4 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r4, 0x0)
ioctl$BINDER_GET_NODE_DEBUG_INFO(0xffffffffffffffff, 0xc018620b, &(0x7f0000000780))
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f00000000c0)=[@enter_looper], 0x48, 0x0, &(0x7f0000000700)="2ba063fb309ec7fdbfb08e6e91baee7d7d4599fe14129a4d426834556ae420e087d59c0c7be7fcad1abb7e1f8f446f373f611ca1ee9c2231708e18a47bc68a2a79a0b48931f6ff6d"})
ioctl$sock_inet_tcp_SIOCOUTQNSD(r1, 0x894b, &(0x7f0000000480))
getsockopt$inet_IP_IPSEC_POLICY(0xffffffffffffffff, 0x0, 0x10, &(0x7f0000000540)={{{@in6, @in=@remote}}, {{@in6=@ipv4={[], [], @local}}, 0x0, @in6}}, &(0x7f0000000000)=0xe8)
ioctl$BINDER_SET_CONTEXT_MGR(r4, 0x40046207, 0x0)
r5 = dup(r4)
shutdown(r5, 0x1)
prctl$PR_SET_NAME(0xf, &(0x7f0000000380)='/group.stat\x00')
syz_open_dev$binder(&(0x7f0000000880)='/dev/binder#\x00', 0x0, 0x2)
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)})
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, &(0x7f0000000780)})
ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f0000000680)})
creat(&(0x7f00000000c0)='./file0\x00', 0x0)
openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000100)='/group.stat\x00', 0x2761, 0x0)
clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000080), 0xffffffffffffffff)
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000003c0)={0x14, 0x0, &(0x7f0000000680)=[@acquire_done], 0x0, 0x0, 0x0})

05:02:55 executing program 0:
recvmmsg(0xffffffffffffffff, &(0x7f0000003140)=[{{&(0x7f0000001400)=@ipx, 0x80, 0x0}}], 0x1, 0x0, 0x0)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = syz_open_procfs(0x0, &(0x7f00000004c0)='net/rt_cache\x00')
preadv(r0, &(0x7f00000017c0), 0xe9, 0x0)

05:02:55 executing program 1:
r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000200)='/dev/nullb0\x00', 0x5000000084002, 0x0)
mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x200000e, 0x13, r0, 0x0)
r1 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x4000, 0x0)
preadv(r1, &(0x7f0000000040)=[{&(0x7f0000000400)=""/4096, 0x3ffc00}], 0x6, 0x0)

05:02:55 executing program 3:
recvmmsg(0xffffffffffffffff, &(0x7f0000003140)=[{{&(0x7f0000001400)=@ipx, 0x80, 0x0}}], 0x1, 0x0, 0x0)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = syz_open_procfs(0x0, &(0x7f00000004c0)='net/rt_cache\x00')
preadv(r0, &(0x7f00000017c0), 0xeb, 0x0)

[  405.220992] binder: unexpected work type, 4, not freed
[  405.226395] binder: undelivered TRANSACTION_COMPLETE
[  405.243835] binder: BINDER_SET_CONTEXT_MGR already set
[  405.249133] binder: 18927:18932 ioctl 40046207 0 returned -16
05:02:55 executing program 0:
recvmmsg(0xffffffffffffffff, &(0x7f0000003140)=[{{&(0x7f0000001400)=@ipx, 0x80, 0x0}}], 0x1, 0x0, 0x0)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = syz_open_procfs(0x0, &(0x7f00000004c0)='net/rt_cache\x00')
preadv(r0, &(0x7f00000017c0), 0xea, 0x0)

05:02:55 executing program 1:
r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000200)='/dev/nullb0\x00', 0x5000000084002, 0x0)
mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x200000e, 0x13, r0, 0x0)
r1 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x4000, 0x0)
preadv(r1, &(0x7f0000000040)=[{&(0x7f0000000400)=""/4096, 0x3ffc00}], 0x7, 0x0)

[  405.306089] binder: 18927:18932 Release 1 refcount change on invalid ref 1 ret -22
[  405.385076] binder: 18943 RLIMIT_NICE not set
[  405.423008] binder: BINDER_SET_CONTEXT_MGR already set
[  405.442221] binder: 18940:18943 ioctl 40046207 0 returned -16
[  405.521939] binder: 18940:18957 BC_INCREFS_DONE node 677 has no pending increfs request
[  405.545511] binder: 18940:18957 Release 1 refcount change on invalid ref 1 ret -22
[  405.556846] binder: 18940:18957 BC_ACQUIRE_DONE node 677 has no pending acquire request
[  405.565776] sctp: [Deprecated]: syz-executor.5 (pid 18917) Use of int in max_burst socket option.
[  405.565776] Use struct sctp_assoc_value instead
05:02:55 executing program 3:
recvmmsg(0xffffffffffffffff, &(0x7f0000003140)=[{{&(0x7f0000001400)=@ipx, 0x80, 0x0}}], 0x1, 0x0, 0x0)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = syz_open_procfs(0x0, &(0x7f00000004c0)='net/rt_cache\x00')
preadv(r0, &(0x7f00000017c0), 0xec, 0x0)

05:02:55 executing program 0:
recvmmsg(0xffffffffffffffff, &(0x7f0000003140)=[{{&(0x7f0000001400)=@ipx, 0x80, 0x0}}], 0x1, 0x0, 0x0)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = syz_open_procfs(0x0, &(0x7f00000004c0)='net/rt_cache\x00')
preadv(r0, &(0x7f00000017c0), 0xeb, 0x0)

05:02:55 executing program 5:
open$dir(0x0, 0x100, 0x0)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8e9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$apparmor_thread_exec(0xffffffffffffff9c, &(0x7f0000007f80)='/proc/thread-self/attr/exec\x00', 0x2, 0x0)
r1 = dup(r0)
ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(r1, 0xc058534f, &(0x7f0000000440)={{0x5}, 0x0, 0x3, 0x0, {0x1000, 0x3}, 0x3, 0xfffffffffffff5d6})
getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, 0x0, 0x0)
write$apparmor_exec(r0, &(0x7f00000002c0)={'stack ', '::\x00\xd0\x9c\xd3r\xc2\xefU\t\xdb\x8a\xb2N0\rYD\xdf\x8f4d\x97\xda\x98\xf0\xb4S\xadm\x8a/\xcb\x12su\xb2\xae\x8b\xfc\x03\x0e\x9a#\x05\x14(\x9d0\v\x06wD\x94\xf1\xee\x8a\xd57\x9d\xfe\xd2\x04\xddN\xe8\xd1\xbb\x83\xd5\x94\xcc \x86\xc6uu\rL.\x9a\xf2\x81\xfa\x93}\x1b\x01\x00\x00\x80\x00\x00\x00\x00\xba\xecsb\x02\xc1\x83\xa1\xa0h\x9c`\x94\x8f<\xd9\xc5\xf3\x18\xfe\x02\xa9\x8c\xbe\xfa\xd7\xc7\xe6\xf3\xf4\xcd\x05\xf5\xf1\xe0\xd2;n=$_\xc7aS\xe6\x13\xae\x18r\"\xe4\xd5\xf25#x\xcf\x04C\xfc\xd2K\x9aLB\x93\x1d\xc0\xbcX\xc3\xbfS\xca+\x0f4\xd8EW\xf9\xbaMy\xa9\xe8wsMB\xaac\xa9\xd6p\x02n\xa1f\xae2X 5Oam\xebW\x14O\x83\x7fX9\xb0\xb3\x90\x1c1_r\xc8s=\xc6\xb5\xb3'}, 0xe6)
r2 = syz_open_dev$vcsn(0x0, 0x9, 0x0)
ioctl$SG_GET_KEEP_ORPHAN(r2, 0x2288, 0x0)
close(r2)
get_mempolicy(0x0, &(0x7f00000001c0), 0xffffffff80000000, &(0x7f0000ffc000/0x3000)=nil, 0x0)
close(r0)
getsockopt$inet_sctp_SCTP_PEER_ADDR_THLDS(0xffffffffffffff9c, 0x84, 0x1f, 0x0, 0x0)
getsockopt$inet_IP_IPSEC_POLICY(0xffffffffffffffff, 0x0, 0x10, 0x0, 0x0)
ioctl$KVM_S390_VCPU_FAULT(0xffffffffffffffff, 0x4008ae52, &(0x7f0000000000)=0x1)
clone(0x8000000001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r3 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000007f00)='/dev/vga_arbiter\x00', 0x305200, 0x0)
r4 = syz_genetlink_get_family_id$tipc(&(0x7f0000000080)='TIPC\x00')
sendmsg$TIPC_CMD_GET_MEDIA_NAMES(r3, &(0x7f0000000140)={&(0x7f0000000040), 0xc, &(0x7f0000000100)={&(0x7f00000000c0)={0x1c, r4, 0xb09, 0x70bd2b, 0x25dfdbfb, {}, ["", "", "", "", "", ""]}, 0x1c}, 0x1, 0x0, 0x0, 0x80}, 0x48040)

05:02:56 executing program 2:
r0 = syz_open_dev$sndtimer(&(0x7f0000026000)='/dev/snd/timer\x00', 0x0, 0x0)
r1 = dup3(r0, r0, 0x80000)
ioctl$UI_GET_SYSNAME(r1, 0x8040552c, 0x0)
perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8)
r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c)
bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r2, &(0x7f0000000040), 0x0, 0x1}, 0x20)
openat$cgroup_ro(r1, &(0x7f00000004c0)='cpuset.effective_cpus\x00', 0x0, 0x0)
unlink(&(0x7f0000000900)='./file0/file0\x00')
r3 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r4 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r4, 0x0)
ioctl$BINDER_GET_NODE_DEBUG_INFO(r3, 0xc018620b, 0x0)
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f00000000c0)=[@enter_looper], 0x48, 0x0, &(0x7f0000000700)="2ba063fb309ec7fdbfb08e6e91baee7d7d4599fe14129a4d426834556ae420e087d59c0c7be7fcad1abb7e1f8f446f373f611ca1ee9c2231708e18a47bc68a2a79a0b48931f6ff6d"})
ioctl$sock_inet_tcp_SIOCOUTQNSD(r1, 0x894b, &(0x7f0000000480))
getsockopt$inet_IP_IPSEC_POLICY(0xffffffffffffffff, 0x0, 0x10, &(0x7f0000000540)={{{@in6, @in=@remote}}, {{@in6=@ipv4={[], [], @local}}, 0x0, @in6}}, &(0x7f0000000000)=0xe8)
ioctl$BINDER_SET_CONTEXT_MGR(r4, 0x40046207, 0x0)
r5 = dup(r4)
shutdown(r5, 0x1)
prctl$PR_SET_NAME(0xf, &(0x7f0000000380)='/group.stat\x00')
syz_open_dev$binder(&(0x7f0000000880)='/dev/binder#\x00', 0x0, 0x2)
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)})
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, &(0x7f0000000780)})
ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f0000000680)})
creat(&(0x7f00000000c0)='./file0\x00', 0x0)
openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000100)='/group.stat\x00', 0x2761, 0x0)
clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000080), 0xffffffffffffffff)
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000003c0)={0x14, 0x0, &(0x7f0000000680)=[@acquire_done], 0x0, 0x0, 0x0})

05:02:56 executing program 4:
r0 = syz_open_dev$sndtimer(&(0x7f0000026000)='/dev/snd/timer\x00', 0x0, 0x0)
r1 = dup3(r0, r0, 0x80000)
ioctl$UI_GET_SYSNAME(r1, 0x8040552c, 0x0)
perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8)
r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c)
bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r2, &(0x7f0000000040), 0x0, 0x1}, 0x20)
openat$cgroup_ro(r1, &(0x7f00000004c0)='cpuset.effective_cpus\x00', 0x0, 0x0)
unlink(&(0x7f0000000900)='./file0/file0\x00')
r3 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r4 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r4, 0x0)
ioctl$BINDER_GET_NODE_DEBUG_INFO(0xffffffffffffffff, 0xc018620b, &(0x7f0000000780))
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f00000000c0)=[@enter_looper], 0x48, 0x0, &(0x7f0000000700)="2ba063fb309ec7fdbfb08e6e91baee7d7d4599fe14129a4d426834556ae420e087d59c0c7be7fcad1abb7e1f8f446f373f611ca1ee9c2231708e18a47bc68a2a79a0b48931f6ff6d"})
ioctl$sock_inet_tcp_SIOCOUTQNSD(r1, 0x894b, &(0x7f0000000480))
getsockopt$inet_IP_IPSEC_POLICY(0xffffffffffffffff, 0x0, 0x10, &(0x7f0000000540)={{{@in6, @in=@remote}}, {{@in6=@ipv4={[], [], @local}}, 0x0, @in6}}, &(0x7f0000000000)=0xe8)
ioctl$BINDER_SET_CONTEXT_MGR(r4, 0x40046207, 0x0)
r5 = dup(r4)
shutdown(r5, 0x1)
prctl$PR_SET_NAME(0xf, &(0x7f0000000380)='/group.stat\x00')
syz_open_dev$binder(&(0x7f0000000880)='/dev/binder#\x00', 0x0, 0x2)
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)})
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, &(0x7f0000000780)})
ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f0000000680)})
creat(&(0x7f00000000c0)='./file0\x00', 0x0)
openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000100)='/group.stat\x00', 0x2761, 0x0)
clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000080), 0xffffffffffffffff)
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000003c0)={0x14, 0x0, &(0x7f0000000680)=[@acquire_done], 0x0, 0x0, 0x0})

05:02:56 executing program 3:
recvmmsg(0xffffffffffffffff, &(0x7f0000003140)=[{{&(0x7f0000001400)=@ipx, 0x80, 0x0}}], 0x1, 0x0, 0x0)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = syz_open_procfs(0x0, &(0x7f00000004c0)='net/rt_cache\x00')
preadv(r0, &(0x7f00000017c0), 0xed, 0x0)

05:02:56 executing program 5:
pipe(&(0x7f0000000040)={0xffffffffffffffff, <r0=>0xffffffffffffffff})
close(r0)
r1 = socket$inet_tcp(0x2, 0x1, 0x0)
bind$inet(r1, &(0x7f0000942000)={0x2, 0x4e20, @multicast1}, 0x10)
setsockopt$sock_int(r1, 0x1, 0x3c, &(0x7f0000000100)=0x1, 0x4)
mmap(&(0x7f0000077000/0x4000)=nil, 0x4000, 0x0, 0x12, r1, 0x0)
fsetxattr$trusted_overlay_nlink(r0, &(0x7f0000000000)='trusted.overlay.nlink\x00', &(0x7f0000000140)={'U-', 0xfffffffffffffff7}, 0x28, 0x2)
connect$inet(r1, &(0x7f00000004c0)={0x2, 0x4e20, @empty}, 0x10)
sendmmsg$unix(r0, &(0x7f0000005c40)=[{0x0, 0x0, &(0x7f0000000500)=[{&(0x7f0000001740)="8c686968bb8a3fdb416bd022d10acce5aab5d63f693f943d72e41e6e1db62ecb2c9a424b1c4ce2ffca8ffc5cb72cd2249f5b0099a2a18a60bf83a98324155350833b35bad97bdb5e0b19b3666f4cced0859cd1b155f81101c96777d75681d8f5599a14aa09801e44892cd2b4104060a38518c885b1bb0264c4d68b5149b2e652330034401fed3db2870b851a47b4a749f686638065b18ebefc86158ebf9ee98a502b3289ee932df03ae982497f88929045cc405f23944d31ad1a2d458e28a636b81924ec7cda1355f53a452d64beb593f9da797cb27a67ec4b9a8d3e8afa1445ef6ac7039113d5075e923195ad8c8f739c4bf2f892e143650051c597ab6b0c14f17c213321042d1cc9819ee024daefb6ccd1a89f83a31eb6092c4a8e0af3bbfc05837cbebe8e576d38432396b8d72fe6d699915f333151fc84e424f6dc3e32c1df4140e2801839aadbec13a10b692ea87eb672402f08fa7ce376ca693a2d046b46fff1547d3b836f29e26b8c67a76fee4435a528ad7c968cc18cbad7254e3874b507f9b291fb288375abae84058c41099d5c596602b24b1f2ee5f3657e2396f6f34e6bcc7da23b6383d7d14f46841057e4ac3978dd906a811306671080203f55818b0c691872c2ade03173918d788caf7b67425561d4e13097cf45fe6ee599783e0b2ff8a2693b52fd23e8636078f34d69c2af1a838abc2e37149f3572fbacf39102395dfe86a4915f50e21fd1dbc50c6f31cab16cfc3a71d7cd1863c3b32db2835b25e6f2b2fdacbcae4cc4dbec4c751dc27c0ec2e4ed9fcba740379dede9d985ed21cba1ea3f811a608c0d2643ba2aebdabf986526cec755951bdf5f305dbb11e81e2dcb6fe43ce8b4989c730613af201d3f5a931278f6534750884396739b888680c175907c611cbde87204f873d7d0b5a09c541b5ce7061e2ed29a58dcc544d31632e2dd115738e14c62b24cf31b93c500c0c58fa405cafbae28d01f7a69f2f85743f9fbd5f4aee5ba7750e0c4c56e4910be251ad786846b82bd4474cbbfb0b0a762429e87693c1ce98db2162e8ffea28b95aa312838d813b1a802490344799b4b9dadb07bf717ba5d1ebe058cf1c0d2615cf24cb851ac8c95714877117e25941e478b805230ab1dfb7c227946278dfdd8d861599f48464aecd7bff0323be0e4c50d2298ec4b32fd3deec32c61862477e5b4ace45040d3dff838783258aca60d0ee19c92429848f47540b94fe72a8cb987a1d1e925ed683343a38f2e0218339ddbfee8ea7fb03977de0960737c49341ae6b3f3c78c004540b4c4b036ba5219109821b48dc637d419c03a3bc9015b7bb713463bdc5af5cd034b8690b6b83a1b84197efb49fecee7358715cf400ebe9f972105bf9088968068bde0c6895579cc68fba2ba4d9e4d3132f08749867d681b0916aa148ebdb54f2f8267b0480c22de696f0938e694ab0faa63f82d12a0e7f0b314282e18328efd7fcade3ffd5b0d7ccd3c7acfb4fa9882201e23ead4278de567e97f1c6db1eafff11b6a61bbf18533bdf67a419dab9c6c2fad4c50b23e9bfd8fff4998dec72360d132b0e97020f2895ed4e43a5176af90b5ffc9143e3ec8dd71bf7addd7031a66605738f3e7026b85b2a07a54ce96e29cb5f71f8fdba420dbafab9ee2d68a4b587aae7bf74a4c013656e5889e3348a761d24eda086a61a62dd8a8fd4783551ccdeff8206b998413439ae4dfb51f1842a9669fbf8da365d8575bdfad90743f521638becbac42dc96451f5996953cf1a45469dac2d93960252e6d044fbe1734a46c60048ae0264bc23c323cf88826e5f6979b9134b4a4649fe7df2a3498dceb5ea6bed23418a77c92e048f70d24040de174b8f61bbe03c2c9578d8c6195a63b7f0405dd6298b594d73e8dc92b1da3d6ed06e87fce80904bef27bf52a0ab6ad584b01dd7af9653f6b837492dadfa13d6dedebef0f1b57561e0c5ebbac731f3a2223c2627474125bc645cfbb94afb3007af3761dd79b23a0f90695d8a02d3f317dd2c898cb70fc2178505a1bdcd36cf22bc48956872a758d071791c0a926dee731b87590ac60d601608b33bb9458f8a1b9d10422fb26f52c410cccb3cb6c8db0d8175ed092fee90bc98763359c7970f2479c9f4411e3e288c11b12bd34c5d223c37e5082e8bf9938b7a36c68eb9dd844f09bd2c9a4053e281c779507877d5e21bb2f9e32222eb6cdf7f24015d267d97abd3942ed4a27426661b2a014eb79ead9a8e4a3299bca4137d8f32532f47ae33f46db2f48c27e8151eb0e15537debadb59251d895030168cb3295997c88a864015e52f131604c1373ae76b4b725cc62ca2d45da89c30ee1083dead0166897c2c8b25425a4a111b69b3a2cb457ad5b8ac1a07a152cb3f35a3bf424d5fd8cc9f7f90830cd9d6dc694e5d141404ea55acfdf3828e7b4551e2c74b5acf4d0144e3e39e04d186231e054c29f47972b6971c93a481fe687b239972be4ac26d4691845fbda9366d0c990b92b0974821d13c9e225b7df3786f38688a2ac36797b47180a6c99e0933e336f55a39b953dfc4d63c32a01cf9b54c05dad7f5c5615e2f2e97ee25c51898a2afc5514536da03aeed9abdeac10c52f980e551bdab3a8398e3f38f51eff725f472f60539abfc36a3ed5ee3d760ceb77f6d4e34d85ae21e4ebf059fd1f1c1afbe05d47b2b9a0883cb6167729ebca402472eac3eca1b3062599760d30e178d54c35a33b1d9da6b3a63fb30b7ab902a20bde2c6af41f230957198798e9a21f020204bd08092e702a0ff8436750441a1e3896c2f6006955e42b1e46983dcd1407f6cfac743a710458a1533378606da2bf8cd6544c2b085ef32bdb1c72442dce3dbe22d5da90227a74c6f19859c3cea33c3251c5b2217b53806ef080bc0dfa3125cea169139fca3df72292160f4c250f713faf1970c62edf40d24546058d0b15f2868bc589fe8c2919e14f80aa4709bb221c8913f81eabb6a34cb46fdbe36b4b54d7038a971626ed70ed0f60630c637f826b0ed05817f6f728af08072aded958d69f8d250d0fb51aa5b9523a12051cad4e3d1a972b4fa509c66aa49f8124533eb79a4bc551359f41c7e1af744fb6158492611676eb0400c2d9a81122f25255e84b748a6f8e55f234767742b73d2b4b7aa405037d883a9ec7eca2b86c44c5b3354b7e84ba46a4771e0d09e77110c573a7adcaf5b0b4a215512ab149160c3ac4935760ae9cef7647cca6a08755de12be42eaf1a17d11deb508680180f99161f48c4099f8e6ab9372cba235b9c06fe426d1f58aeccdedc93cbf1e1b70d05fef893d71b31ff3dc100dc60aaa541e705dace19db4c022f16e9aa30d72f9957c84ea708bfbad323f01932dd3b716968583b2a2c2586d9c2d334ca058b80509cd0cecf6adc5ca6483f3ad34e37602cb212cae64bd96fd2aa45955db0d98a2d12c6e56963779396fbb7ebd5534b534406e3d35185e5f98a0e13be9478b4610d8695ea597d3d98076ca75c3d42d087e0f60786f315042596dad03f424195277aca45c37667684625b2041eb2704a2c93f86309ff359ce695896e8577d43a67fe4a1f23e48f3d37e30ce5258d9076a744490c54d76af358d19810e994123c028104f8021b044ffaeb976405edf085044e849d57c02c4d76cfef704e956f6b07c51fe3d083ec8b53751086ecd8550615ef940bd9248ca48076c1ee46f00f1e5b6c652ae1bda9fb09a9ab313d91f69ff1b43593b2816a2ddb15f53ba65239cd447d2a48fc4e86163c1712bf76143d2fade0445e20c6e265cdf4b3aa2d2fe0728bc18582c42a0eb396c771930826fbc5d194d18261988b2b08d318e573550a1e9150033d97899ff61da2fb718296a248ab683d4dcde37f2d2b9e89ec17cfc73351f98ee39c135d0dd77566d622ea9dd7b9c89a1b10985a3812b8d9ad54ba181a9325a53d96f478da593ca8e263a2f6ee32abf9ac776c0aa0a5a5934df153271188d66a6e6ad98eb29950b6f83331fc87677654b9afad5c5587d36e415083b81c0cc99be0d1ac7815981a3936e22f660de319d1761e4a5f9be75ec032dcff84699775b241550f9a978e4f6d266a115a1794b94e910e106cc413dac79781c3110faf8aca55dc768a09bc45ce2c686076956a4b7c6cb51ba735e31af4a58a68f6f43db2df3df2f8e114640bb5b3868dd985b473c65f51dd055ab5c5de5b3d38fe2b5e285c202a6a5745fe2cc4321851907b88faa83f68c3ae26cfe076303b8822229947380c1c37c0dcd473ddc3bf6507285f040c58c9e8edcce081bafb33d2c32804cc8f80857310edcf0d70c482a7056c5e9a08798f1cd97264674f6676dc5757fcb941e405f5aaa3a7124df08a3424aff17edef0627fddb4487320f63a74c7230131bb18301616a27a39d78cf4c0cee5af042ca4df06495faa2289bfaeb769cd0c2d38f55bad88967ef343e5bf6c752baee0810618bf02f268266057bb7d4d5d9999b151ac135f67afaa3ecc857249165e3428221508c301d8abb61dc2d7cc7d5a892e4cf0a2a7faaaf3a0e17ee06e0be3d1bdb8617f9d628a26f9fca496ab34f2199ea71cfbd90e0460f71cec34d8efe094bc0fa19498325bf4686a85511fd5f9b242a48eefdaea3ee19fed4478b7cf02dda659d2ff9d8dd1871e0bf3a0d892e9e587d082d89b83935215c3222f9795bcd64ff118109f19c0e8f3e4198dc697bc62d89f032f12f71560d8d2fd192402c039060ec88422d64130ff64c0526775a97f617b03bf8cb429ae4943e0d84c80ec9c4dcbb08a4f295b54e72b460dda620a5442c39858e1a29b5204ed61a4a69b7906dab061654d2e3c12413538e77dfe02194fece0a7719b431f1f9389b704b4d3ed5261ff0868e73a1eec8f503d8e56dff914f9ce8e1d5c1b12e2994c29e5af972c004c974f3e8e596b267ce0024a0681961213c7fc162bb2f84d640dfeae40ee41aaadb889c0ece9cbf779dffe448779aae998852c9d55782a21d1cbfbe68920751ff8c03524bd0532872a553b6df481e11b9951b4140299873ba598cc268c06af44d8ae8832504972ad52fb205bf6be19f6795c70569e45841a0c36aa094e9265a14162b255e2d78b91145a203bbe4af84623468860f6491ff4bfc9c77bc779b6d82a63f08b6c36e4aa7d15a301504c7c1cd33ec1771e37cb196ad24c7939fc12ced2df72cb460aebb97bc9b8fca254bbebdfa50c09f5418903cc695c966f7ce109b26bbd5bba0f64155a0850da06e68e05837815abe22111aae04f1e223d5a0c9ef40017edc77ea5d19150b5f7f1ddcf215bfa1fe6bd829d50e5e8562ef9e7039d2bd2caef7f52125008e15b5b47d99f9357c017f06f9728987ceb2914a2bba1ccffa1492d75012f47e4a8977941134ec10f9a672fcfb1a513050ac34650c63f9a7c19ee179f289383df3b440119a6a45760d3889637b1408e9987d40f3b8a7a29970df5a3b292aeefa05d55800200d40a30303d9c94c47779d68d11ef3e9bf0511822e316327e682ae760a25a64ac00875a02fe741fbe4ba7cdadad39bd279c6d35e4deda38062aaf33f798e3369cd5b1d201f16ae0a7e3bdb694eebabcdc5bcab364c7e24a2540edc41fd1d240eede5c0c72f871846859a7f53354d1c6a23459b60dc73e0637083cf1ed2a802d929dcf374de1ba891a83923236f65170f8b77f83c1474d22cfc3d289cc6654311237ef7dd24466329f71a6d9c0e60f2e352c01925f28ff2b8e83b7e8ba7a7ff49cd09a9b8dbea64988e3c8930d8e47106d149b585fd8f5893ad822f408", 0xfff}], 0x1}], 0x1, 0x4000000)
sendmsg$nl_netfilter(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000002740)=ANY=[@ANYBLOB="c1"], 0x1}}, 0x0)
getsockopt$inet_tcp_TCP_ZEROCOPY_RECEIVE(r0, 0x6, 0x23, &(0x7f0000000080)={&(0x7f0000077000/0x3000)=nil, 0x3000}, &(0x7f00000000c0)=0x10)

05:02:56 executing program 0:
recvmmsg(0xffffffffffffffff, &(0x7f0000003140)=[{{&(0x7f0000001400)=@ipx, 0x80, 0x0}}], 0x1, 0x0, 0x0)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = syz_open_procfs(0x0, &(0x7f00000004c0)='net/rt_cache\x00')
preadv(r0, &(0x7f00000017c0), 0xec, 0x0)

05:02:56 executing program 1:
r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000200)='/dev/nullb0\x00', 0x5000000084002, 0x0)
mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x200000e, 0x13, r0, 0x0)
r1 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x4000, 0x0)
preadv(r1, &(0x7f0000000040)=[{&(0x7f0000000400)=""/4096, 0x3ffc00}], 0x8, 0x0)

[  405.943764] binder: release 18927:18932 transaction 673 out, still active
05:02:56 executing program 5:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000180)='/dev/kvm\x00', 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
r2 = socket$inet_udplite(0x2, 0x2, 0x88)
ioctl(r2, 0x1000008912, &(0x7f0000000040)="0adc1f123c12a41d88b070")
r3 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
r4 = openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000080)='/proc/capi/capi20\x00', 0x4200, 0x0)
ioctl$CAPI_GET_SERIAL(r4, 0xc0044308, &(0x7f00000000c0)=0x6179)
ioctl$KVM_ENABLE_CAP_CPU(r3, 0x4008ae89, &(0x7f0000000000)={0x400000000000003, 0x600000000000000, [0x48, 0x1, 0x3a], [0xc2]})
getsockopt$inet_sctp_SCTP_GET_PEER_ADDRS(r4, 0x84, 0x6c, &(0x7f00000001c0)={<r5=>0x0, 0xf1, "c2c32dbbfa9bdd747a71166abe908a501ea70779c16e6aca2c2f38a09e3ddc09fd2a44aba5968ec722b61211768537138137dd3e83b829e3a89df7c6d898c6a12bb4a09844ac8d1d8143354e5a85c6cfac2b74a74b18fa4521c7ca1e8598ca735a1095c90f0f4a68cfd7a6ebc60ae1c88b317c972d20dbd62a72497537e76a88f947297ca3ef38c39edaec9add98c5109d3a2a0fd475ee6bae5acdc4d5decfe085b148e6ecd572c22cd7e285a4fd74c57d1dddab8830ea0650c1715aef541f0bbbcec855d9ea9571f851b16c784449abee7c00cc485909c276532ca40f19f7ca30787d9cc27eb78d6f0099960c60334b4c"}, &(0x7f0000000100)=0xf9)
setsockopt$inet_sctp6_SCTP_RECVNXTINFO(r4, 0x84, 0x21, &(0x7f00000003c0)=0x1000, 0x4)
getsockopt$inet_sctp6_SCTP_GET_ASSOC_STATS(r4, 0x84, 0x70, &(0x7f00000002c0)={r5, @in6={{0xa, 0x4e20, 0x7, @dev={0xfe, 0x80, [], 0x21}, 0x3}}, [0x0, 0x6, 0x4, 0xb607, 0x5, 0xfff, 0x4, 0xc9b, 0x4, 0x1, 0x7ff, 0x401, 0x8, 0x8, 0xff]}, &(0x7f0000000140)=0x100)

05:02:56 executing program 3:
recvmmsg(0xffffffffffffffff, &(0x7f0000003140)=[{{&(0x7f0000001400)=@ipx, 0x80, 0x0}}], 0x1, 0x0, 0x0)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = syz_open_procfs(0x0, &(0x7f00000004c0)='net/rt_cache\x00')
preadv(r0, &(0x7f00000017c0), 0xee, 0x0)

[  406.090246] binder: 18984 RLIMIT_NICE not set
05:02:56 executing program 0:
recvmmsg(0xffffffffffffffff, &(0x7f0000003140)=[{{&(0x7f0000001400)=@ipx, 0x80, 0x0}}], 0x1, 0x0, 0x0)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = syz_open_procfs(0x0, &(0x7f00000004c0)='net/rt_cache\x00')
preadv(r0, &(0x7f00000017c0), 0xed, 0x0)

[  406.118040] binder: 18992:18995 ioctl c018620b 0 returned -14
[  406.139225] binder: BINDER_SET_CONTEXT_MGR already set
05:02:56 executing program 1:
r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000200)='/dev/nullb0\x00', 0x5000000084002, 0x0)
mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x200000e, 0x13, r0, 0x0)
r1 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x4000, 0x0)
preadv(r1, &(0x7f0000000040)=[{&(0x7f0000000400)=""/4096, 0x3ffc00}], 0x9, 0x0)

[  406.170344] binder: 18980:18984 ioctl 40046207 0 returned -16
[  406.170363] binder: BINDER_SET_CONTEXT_MGR already set
[  406.170409] binder: 18992:18995 ioctl 40046207 0 returned -16
05:02:56 executing program 0:
recvmmsg(0xffffffffffffffff, &(0x7f0000003140)=[{{&(0x7f0000001400)=@ipx, 0x80, 0x0}}], 0x1, 0x0, 0x0)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = syz_open_procfs(0x0, &(0x7f00000004c0)='net/rt_cache\x00')
preadv(r0, &(0x7f00000017c0), 0xee, 0x0)

[  406.274830] kvm [19004]: vcpu0, guest rIP: 0xfff0 disabled perfctr wrmsr: 0xc2 data 0x0
[  406.286939] binder: 18992:18995 BC_INCREFS_DONE node 680 has no pending increfs request
[  406.296611] binder: 18980:19007 BC_INCREFS_DONE node 683 has no pending increfs request
[  406.312374] binder: 18980:19007 Release 1 refcount change on invalid ref 1 ret -22
05:02:56 executing program 2:
r0 = syz_open_dev$sndtimer(&(0x7f0000026000)='/dev/snd/timer\x00', 0x0, 0x0)
r1 = dup3(r0, r0, 0x80000)
ioctl$UI_GET_SYSNAME(r1, 0x8040552c, 0x0)
perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8)
r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c)
bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r2, &(0x7f0000000040), 0x0, 0x1}, 0x20)
openat$cgroup_ro(r1, &(0x7f00000004c0)='cpuset.effective_cpus\x00', 0x0, 0x0)
unlink(&(0x7f0000000900)='./file0/file0\x00')
r3 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r4 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r4, 0x0)
ioctl$BINDER_GET_NODE_DEBUG_INFO(r3, 0xc018620b, &(0x7f0000000780))
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f00000000c0)=[@enter_looper], 0x48, 0x0, &(0x7f0000000700)="2ba063fb309ec7fdbfb08e6e91baee7d7d4599fe14129a4d426834556ae420e087d59c0c7be7fcad1abb7e1f8f446f373f611ca1ee9c2231708e18a47bc68a2a79a0b48931f6ff6d"})
ioctl$sock_inet_tcp_SIOCOUTQNSD(r1, 0x894b, &(0x7f0000000480))
getsockopt$inet_IP_IPSEC_POLICY(0xffffffffffffffff, 0x0, 0x10, &(0x7f0000000540)={{{@in6, @in=@remote}}, {{@in6=@ipv4={[], [], @local}}, 0x0, @in6}}, &(0x7f0000000000)=0xe8)
ioctl$BINDER_SET_CONTEXT_MGR(r4, 0x40046207, 0x0)
r5 = dup(r4)
shutdown(r5, 0x1)
prctl$PR_SET_NAME(0xf, &(0x7f0000000380)='/group.stat\x00')
syz_open_dev$binder(&(0x7f0000000880)='/dev/binder#\x00', 0x0, 0x2)
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)})
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, &(0x7f0000000780)})
ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f0000000680)})
creat(&(0x7f00000000c0)='./file0\x00', 0x0)
openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000100)='/group.stat\x00', 0x2761, 0x0)
clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000080), 0xffffffffffffffff)
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000003c0)={0x14, 0x0, &(0x7f0000000680)=[@acquire_done], 0x0, 0x0, 0x0})

[  406.356950] binder: 18992:18995 BC_ACQUIRE_DONE node 680 has no pending acquire request
[  406.366961] binder: 18980:19007 BC_ACQUIRE_DONE node 683 has no pending acquire request
[  406.389748] kvm [19004]: vcpu0, guest rIP: 0xfff0 disabled perfctr wrmsr: 0xc2 data 0x0
05:02:56 executing program 4:
r0 = syz_open_dev$sndtimer(&(0x7f0000026000)='/dev/snd/timer\x00', 0x0, 0x0)
r1 = dup3(r0, r0, 0x80000)
ioctl$UI_GET_SYSNAME(r1, 0x8040552c, 0x0)
perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8)
r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c)
bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r2, &(0x7f0000000040), 0x0, 0x1}, 0x20)
openat$cgroup_ro(r1, &(0x7f00000004c0)='cpuset.effective_cpus\x00', 0x0, 0x0)
unlink(&(0x7f0000000900)='./file0/file0\x00')
r3 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r4 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r4, 0x0)
ioctl$BINDER_GET_NODE_DEBUG_INFO(0xffffffffffffffff, 0xc018620b, &(0x7f0000000780))
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f00000000c0)=[@enter_looper], 0x48, 0x0, &(0x7f0000000700)="2ba063fb309ec7fdbfb08e6e91baee7d7d4599fe14129a4d426834556ae420e087d59c0c7be7fcad1abb7e1f8f446f373f611ca1ee9c2231708e18a47bc68a2a79a0b48931f6ff6d"})
ioctl$sock_inet_tcp_SIOCOUTQNSD(r1, 0x894b, &(0x7f0000000480))
getsockopt$inet_IP_IPSEC_POLICY(0xffffffffffffffff, 0x0, 0x10, &(0x7f0000000540)={{{@in6, @in=@remote}}, {{@in6=@ipv4={[], [], @local}}, 0x0, @in6}}, &(0x7f0000000000)=0xe8)
ioctl$BINDER_SET_CONTEXT_MGR(r4, 0x40046207, 0x0)
r5 = dup(r4)
shutdown(r5, 0x1)
prctl$PR_SET_NAME(0xf, &(0x7f0000000380)='/group.stat\x00')
syz_open_dev$binder(&(0x7f0000000880)='/dev/binder#\x00', 0x0, 0x2)
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)})
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, &(0x7f0000000780)})
ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f0000000680)})
creat(&(0x7f00000000c0)='./file0\x00', 0x0)
openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000100)='/group.stat\x00', 0x2761, 0x0)
clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000080), 0xffffffffffffffff)

05:02:56 executing program 3:
recvmmsg(0xffffffffffffffff, &(0x7f0000003140)=[{{&(0x7f0000001400)=@ipx, 0x80, 0x0}}], 0x1, 0x0, 0x0)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = syz_open_procfs(0x0, &(0x7f00000004c0)='net/rt_cache\x00')
preadv(r0, &(0x7f00000017c0), 0xef, 0x0)

05:02:56 executing program 0:
recvmmsg(0xffffffffffffffff, &(0x7f0000003140)=[{{&(0x7f0000001400)=@ipx, 0x80, 0x0}}], 0x1, 0x0, 0x0)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = syz_open_procfs(0x0, &(0x7f00000004c0)='net/rt_cache\x00')
preadv(r0, &(0x7f00000017c0), 0xef, 0x0)

05:02:56 executing program 5:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
r1 = syz_genetlink_get_family_id$tipc(&(0x7f0000000080)='TIPC\x00')
r2 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000240)='IPVS\x00')
sendmsg$IPVS_CMD_NEW_SERVICE(r0, &(0x7f0000000140)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x4}, 0xc, &(0x7f0000000100)={&(0x7f00000000c0)=ANY=[@ANYBLOB="01fc0000", @ANYRES16=r2, @ANYBLOB="2c0325bd7000fedbdf25010000000800060009000000140001000800020073000000080009006100000008000500ff010000"], 0x38}, 0x1, 0x0, 0x0, 0x20040000}, 0x4000)
ioctl$EVIOCGPHYS(0xffffffffffffffff, 0x80404507, 0x0)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
sendmsg$TIPC_CMD_SHOW_NAME_TABLE(r0, &(0x7f0000000500)={0x0, 0x0, &(0x7f00000004c0)={&(0x7f0000000480)={0x30, r1, 0x805, 0x0, 0x0, {{}, 0x0, 0x5, 0x0, {0x14}}}, 0x30}}, 0x0)

[  406.570509] binder_set_nice: 1 callbacks suppressed
[  406.570517] binder: 19028 RLIMIT_NICE not set
[  406.607679] binder: BINDER_SET_CONTEXT_MGR already set
[  406.638185] binder: BINDER_SET_CONTEXT_MGR already set
[  406.644054] binder: 19027:19028 ioctl 40046207 0 returned -16
[  406.671306] binder: 19025:19034 ioctl 40046207 0 returned -16
[  406.713539] binder_thread_write: 1 callbacks suppressed
05:02:57 executing program 3:
recvmmsg(0xffffffffffffffff, &(0x7f0000003140)=[{{&(0x7f0000001400)=@ipx, 0x80, 0x0}}], 0x1, 0x0, 0x0)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = syz_open_procfs(0x0, &(0x7f00000004c0)='net/rt_cache\x00')
preadv(r0, &(0x7f00000017c0), 0xf0, 0x0)

05:02:57 executing program 5:
r0 = openat$capi20(0xffffffffffffff9c, &(0x7f0000000000)='/dev/capi20\x00', 0x0, 0x0)
ioctl$CAPI_REGISTER(r0, 0x400c4301, 0x0)
syz_open_dev$mouse(&(0x7f0000000080)='/dev/input/mouse#\x00', 0x100000001, 0x0)
perf_event_open(&(0x7f000001d000)={0x1, 0x14a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
close(r0)
pipe(&(0x7f0000000040)={0xffffffffffffffff, <r1=>0xffffffffffffffff})
ioctl(0xffffffffffffffff, 0x0, 0x0)
syz_open_dev$sndctrl(&(0x7f00000000c0)='/dev/snd/controlC#\x00', 0x0, 0x0)
epoll_create(0x5)
perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0)
ioctl$ASHMEM_GET_PROT_MASK(r1, 0x7706, &(0x7f0000000100))
perf_event_open(&(0x7f00000001c0)={0x5, 0x70, 0x0, 0x9, 0x0, 0x80, 0x0, 0x9, 0x20020, 0x9, 0x0, 0x0, 0xdf, 0x0, 0x9, 0x9, 0x1, 0x0, 0x7, 0xd9, 0x0, 0x0, 0x3, 0x7, 0x100000000, 0x1, 0x0, 0x0, 0x9, 0x5, 0x0, 0x0, 0x7fffffff, 0xaa1, 0x0, 0x3, 0x5, 0x8, 0x0, 0x0, 0x0, @perf_config_ext={0x0, 0x40}, 0x8800, 0x0, 0x0, 0x0, 0x5, 0x1, 0x3}, 0x0, 0xf, 0xffffffffffffff9c, 0x0)

05:02:57 executing program 0:
recvmmsg(0xffffffffffffffff, &(0x7f0000003140)=[{{&(0x7f0000001400)=@ipx, 0x80, 0x0}}], 0x1, 0x0, 0x0)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = syz_open_procfs(0x0, &(0x7f00000004c0)='net/rt_cache\x00')
preadv(r0, &(0x7f00000017c0), 0xf0, 0x0)

[  406.734988] binder: 19027:19041 BC_INCREFS_DONE node 686 has no pending increfs request
[  406.743503] binder: 19025:19026 Release 1 refcount change on invalid ref 1 ret -22
[  406.753188] binder: 19027:19041 Release 1 refcount change on invalid ref 1 ret -22
[  406.800143] binder: release 19025:19026 transaction 688 out, still active
05:02:57 executing program 2:
r0 = syz_open_dev$sndtimer(&(0x7f0000026000)='/dev/snd/timer\x00', 0x0, 0x0)
r1 = dup3(r0, r0, 0x80000)
ioctl$UI_GET_SYSNAME(r1, 0x8040552c, 0x0)
perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8)
r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c)
bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r2, &(0x7f0000000040), 0x0, 0x1}, 0x20)
openat$cgroup_ro(r1, &(0x7f00000004c0)='cpuset.effective_cpus\x00', 0x0, 0x0)
unlink(&(0x7f0000000900)='./file0/file0\x00')
r3 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r4 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r4, 0x0)
ioctl$BINDER_GET_NODE_DEBUG_INFO(r3, 0xc018620b, &(0x7f0000000780))
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f00000000c0)=[@enter_looper], 0x48, 0x0, &(0x7f0000000700)="2ba063fb309ec7fdbfb08e6e91baee7d7d4599fe14129a4d426834556ae420e087d59c0c7be7fcad1abb7e1f8f446f373f611ca1ee9c2231708e18a47bc68a2a79a0b48931f6ff6d"})
ioctl$sock_inet_tcp_SIOCOUTQNSD(r1, 0x894b, &(0x7f0000000480))
getsockopt$inet_IP_IPSEC_POLICY(0xffffffffffffffff, 0x0, 0x10, &(0x7f0000000540)={{{@in6, @in=@remote}}, {{@in6=@ipv4={[], [], @local}}, 0x0, @in6}}, &(0x7f0000000000)=0xe8)
ioctl$BINDER_SET_CONTEXT_MGR(r4, 0x40046207, 0x0)
r5 = dup(r4)
shutdown(r5, 0x1)
prctl$PR_SET_NAME(0xf, &(0x7f0000000380)='/group.stat\x00')
syz_open_dev$binder(&(0x7f0000000880)='/dev/binder#\x00', 0x0, 0x2)
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)})
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, &(0x7f0000000780)})
ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f0000000680)})
creat(&(0x7f00000000c0)='./file0\x00', 0x0)
openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000100)='/group.stat\x00', 0x2761, 0x0)
clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000080), 0xffffffffffffffff)
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000003c0)={0x14, 0x0, &(0x7f0000000680)=[@acquire_done], 0x0, 0x0, 0x0})

05:02:57 executing program 0:
recvmmsg(0xffffffffffffffff, &(0x7f0000003140)=[{{&(0x7f0000001400)=@ipx, 0x80, 0x0}}], 0x1, 0x0, 0x0)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = syz_open_procfs(0x0, &(0x7f00000004c0)='net/rt_cache\x00')
preadv(r0, &(0x7f00000017c0), 0xf1, 0x0)

[  407.012208] binder: BINDER_SET_CONTEXT_MGR already set
[  407.046595] binder: 19064:19066 ioctl 40046207 0 returned -16
05:02:57 executing program 1:
r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000200)='/dev/nullb0\x00', 0x5000000084002, 0x0)
mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x200000e, 0x13, r0, 0x0)
r1 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x4000, 0x0)
preadv(r1, &(0x7f0000000040)=[{&(0x7f0000000400)=""/4096, 0x3ffc00}], 0xa, 0x0)

05:02:57 executing program 3:
recvmmsg(0xffffffffffffffff, &(0x7f0000003140)=[{{&(0x7f0000001400)=@ipx, 0x80, 0x0}}], 0x1, 0x0, 0x0)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = syz_open_procfs(0x0, &(0x7f00000004c0)='net/rt_cache\x00')
preadv(r0, &(0x7f00000017c0), 0xf1, 0x0)

05:02:57 executing program 5:
r0 = syz_open_dev$sndtimer(&(0x7f0000026000)='/dev/snd/timer\x00', 0x0, 0x0)
r1 = dup3(r0, r0, 0x80000)
ioctl$UI_GET_SYSNAME(r1, 0x8040552c, 0x0)
perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8)
r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c)
bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r2, &(0x7f0000000040), 0x0, 0x1}, 0x20)
openat$cgroup_ro(r1, &(0x7f00000004c0)='cpuset.effective_cpus\x00', 0x0, 0x0)
unlink(&(0x7f0000000900)='./file0/file0\x00')
r3 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r4 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r4, 0x0)
ioctl$BINDER_GET_NODE_DEBUG_INFO(r3, 0xc018620b, &(0x7f0000000780))
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f00000000c0)=[@enter_looper], 0x48, 0x0, &(0x7f0000000700)="2ba063fb309ec7fdbfb08e6e91baee7d7d4599fe14129a4d426834556ae420e087d59c0c7be7fcad1abb7e1f8f446f373f611ca1ee9c2231708e18a47bc68a2a79a0b48931f6ff6d"})
ioctl$sock_inet_tcp_SIOCOUTQNSD(r1, 0x894b, &(0x7f0000000480))
getsockopt$inet_IP_IPSEC_POLICY(0xffffffffffffffff, 0x0, 0x10, &(0x7f0000000540)={{{@in6, @in=@remote}}, {{@in6=@ipv4={[], [], @local}}, 0x0, @in6}}, &(0x7f0000000000)=0xe8)
ioctl$BINDER_SET_CONTEXT_MGR(r4, 0x40046207, 0x0)
r5 = dup(r4)
shutdown(r5, 0x1)
prctl$PR_SET_NAME(0xf, &(0x7f0000000380)='/group.stat\x00')
syz_open_dev$binder(&(0x7f0000000880)='/dev/binder#\x00', 0x0, 0x2)
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)})
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, &(0x7f0000000780)})
ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f0000000680)})
creat(&(0x7f00000000c0)='./file0\x00', 0x0)
openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000100)='/group.stat\x00', 0x2761, 0x0)
clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000080), 0xffffffffffffffff)
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000003c0)={0x14, 0x0, &(0x7f0000000680)=[@acquire_done], 0x0, 0x0, 0x0})

[  407.130601] binder: 19064:19073 BC_INCREFS_DONE node 692 has no pending increfs request
[  407.139823] binder: 19064:19073 Release 1 refcount change on invalid ref 1 ret -22
[  407.149652] binder: 19064:19073 BC_ACQUIRE_DONE node 692 has no pending acquire request
[  407.260856] binder: BINDER_SET_CONTEXT_MGR already set
[  407.281021] binder: 19077:19078 ioctl 40046207 0 returned -16
05:02:57 executing program 4:
r0 = syz_open_dev$sndtimer(&(0x7f0000026000)='/dev/snd/timer\x00', 0x0, 0x0)
r1 = dup3(r0, r0, 0x80000)
ioctl$UI_GET_SYSNAME(r1, 0x8040552c, 0x0)
perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8)
r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c)
bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r2, &(0x7f0000000040), 0x0, 0x1}, 0x20)
openat$cgroup_ro(r1, &(0x7f00000004c0)='cpuset.effective_cpus\x00', 0x0, 0x0)
unlink(&(0x7f0000000900)='./file0/file0\x00')
r3 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r4 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r4, 0x0)
ioctl$BINDER_GET_NODE_DEBUG_INFO(0xffffffffffffffff, 0xc018620b, &(0x7f0000000780))
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f00000000c0)=[@enter_looper], 0x48, 0x0, &(0x7f0000000700)="2ba063fb309ec7fdbfb08e6e91baee7d7d4599fe14129a4d426834556ae420e087d59c0c7be7fcad1abb7e1f8f446f373f611ca1ee9c2231708e18a47bc68a2a79a0b48931f6ff6d"})
ioctl$sock_inet_tcp_SIOCOUTQNSD(r1, 0x894b, &(0x7f0000000480))
getsockopt$inet_IP_IPSEC_POLICY(0xffffffffffffffff, 0x0, 0x10, &(0x7f0000000540)={{{@in6, @in=@remote}}, {{@in6=@ipv4={[], [], @local}}, 0x0, @in6}}, &(0x7f0000000000)=0xe8)
ioctl$BINDER_SET_CONTEXT_MGR(r4, 0x40046207, 0x0)
r5 = dup(r4)
shutdown(r5, 0x1)
prctl$PR_SET_NAME(0xf, &(0x7f0000000380)='/group.stat\x00')
syz_open_dev$binder(&(0x7f0000000880)='/dev/binder#\x00', 0x0, 0x2)
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)})
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, &(0x7f0000000780)})
ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f0000000680)})
creat(&(0x7f00000000c0)='./file0\x00', 0x0)
openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000100)='/group.stat\x00', 0x2761, 0x0)
clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000080), 0xffffffffffffffff)

05:02:57 executing program 0:
recvmmsg(0xffffffffffffffff, &(0x7f0000003140)=[{{&(0x7f0000001400)=@ipx, 0x80, 0x0}}], 0x1, 0x0, 0x0)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = syz_open_procfs(0x0, &(0x7f00000004c0)='net/rt_cache\x00')
preadv(r0, &(0x7f00000017c0), 0xf2, 0x0)

05:02:57 executing program 2:
r0 = syz_open_dev$sndtimer(&(0x7f0000026000)='/dev/snd/timer\x00', 0x0, 0x0)
r1 = dup3(r0, r0, 0x80000)
ioctl$UI_GET_SYSNAME(r1, 0x8040552c, 0x0)
perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8)
r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c)
bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r2, &(0x7f0000000040), 0x0, 0x1}, 0x20)
openat$cgroup_ro(r1, &(0x7f00000004c0)='cpuset.effective_cpus\x00', 0x0, 0x0)
unlink(&(0x7f0000000900)='./file0/file0\x00')
r3 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r4 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r4, 0x0)
ioctl$BINDER_GET_NODE_DEBUG_INFO(r3, 0xc018620b, &(0x7f0000000780))
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f00000000c0)=[@enter_looper], 0x48, 0x0, &(0x7f0000000700)="2ba063fb309ec7fdbfb08e6e91baee7d7d4599fe14129a4d426834556ae420e087d59c0c7be7fcad1abb7e1f8f446f373f611ca1ee9c2231708e18a47bc68a2a79a0b48931f6ff6d"})
ioctl$sock_inet_tcp_SIOCOUTQNSD(r1, 0x894b, &(0x7f0000000480))
getsockopt$inet_IP_IPSEC_POLICY(0xffffffffffffffff, 0x0, 0x10, &(0x7f0000000540)={{{@in6, @in=@remote}}, {{@in6=@ipv4={[], [], @local}}, 0x0, @in6}}, &(0x7f0000000000)=0xe8)
ioctl$BINDER_SET_CONTEXT_MGR(r4, 0x40046207, 0x0)
r5 = dup(r4)
shutdown(r5, 0x1)
prctl$PR_SET_NAME(0xf, &(0x7f0000000380)='/group.stat\x00')
syz_open_dev$binder(&(0x7f0000000880)='/dev/binder#\x00', 0x0, 0x2)
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)})
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, &(0x7f0000000780)})
ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f0000000680)})
creat(&(0x7f00000000c0)='./file0\x00', 0x0)
openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000100)='/group.stat\x00', 0x2761, 0x0)
clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000080), 0xffffffffffffffff)
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000003c0)={0x14, 0x0, &(0x7f0000000680)=[@acquire_done], 0x0, 0x0, 0x0})

05:02:57 executing program 3:
recvmmsg(0xffffffffffffffff, &(0x7f0000003140)=[{{&(0x7f0000001400)=@ipx, 0x80, 0x0}}], 0x1, 0x0, 0x0)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = syz_open_procfs(0x0, &(0x7f00000004c0)='net/rt_cache\x00')
preadv(r0, &(0x7f00000017c0), 0xf2, 0x0)

[  407.323710] binder: release 19027:19028 transaction 685 out, still active
[  407.331387] binder: unexpected work type, 4, not freed
[  407.337427] binder: undelivered TRANSACTION_COMPLETE
[  407.370373] binder: 19077:19092 BC_INCREFS_DONE node 695 has no pending increfs request
05:02:57 executing program 3:
recvmmsg(0xffffffffffffffff, &(0x7f0000003140)=[{{&(0x7f0000001400)=@ipx, 0x80, 0x0}}], 0x1, 0x0, 0x0)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = syz_open_procfs(0x0, &(0x7f00000004c0)='net/rt_cache\x00')
preadv(r0, &(0x7f00000017c0), 0xf3, 0x0)

[  407.431181] binder: 19077:19100 Release 1 refcount change on invalid ref 1 ret -22
[  407.432650] binder: BINDER_SET_CONTEXT_MGR already set
[  407.468122] binder: 19087:19088 ioctl 40046207 0 returned -16
05:02:57 executing program 0:
recvmmsg(0xffffffffffffffff, &(0x7f0000003140)=[{{&(0x7f0000001400)=@ipx, 0x80, 0x0}}], 0x1, 0x0, 0x0)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = syz_open_procfs(0x0, &(0x7f00000004c0)='net/rt_cache\x00')
preadv(r0, &(0x7f00000017c0), 0xf3, 0x0)

[  407.479354] binder: 19077:19092 BC_ACQUIRE_DONE node 695 has no pending acquire request
[  407.505543] binder: 19097 RLIMIT_NICE not set
[  407.542421] binder: BINDER_SET_CONTEXT_MGR already set
[  407.565759] binder: 19096:19097 ioctl 40046207 0 returned -16
[  407.572006] binder: 19087:19104 BC_INCREFS_DONE node 698 has no pending increfs request
[  407.590818] binder: 19087:19104 Release 1 refcount change on invalid ref 1 ret -22
05:02:57 executing program 3:
recvmmsg(0xffffffffffffffff, &(0x7f0000003140)=[{{&(0x7f0000001400)=@ipx, 0x80, 0x0}}], 0x1, 0x0, 0x0)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = syz_open_procfs(0x0, &(0x7f00000004c0)='net/rt_cache\x00')
preadv(r0, &(0x7f00000017c0), 0xf4, 0x0)

05:02:57 executing program 2:
r0 = syz_open_dev$sndtimer(&(0x7f0000026000)='/dev/snd/timer\x00', 0x0, 0x0)
r1 = dup3(r0, r0, 0x80000)
ioctl$UI_GET_SYSNAME(r1, 0x8040552c, 0x0)
perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8)
r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c)
bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r2, &(0x7f0000000040), 0x0, 0x1}, 0x20)
openat$cgroup_ro(r1, &(0x7f00000004c0)='cpuset.effective_cpus\x00', 0x0, 0x0)
unlink(&(0x7f0000000900)='./file0/file0\x00')
r3 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r4 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r4, 0x0)
ioctl$BINDER_GET_NODE_DEBUG_INFO(r3, 0xc018620b, &(0x7f0000000780))
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, 0x0)
ioctl$sock_inet_tcp_SIOCOUTQNSD(r1, 0x894b, &(0x7f0000000480))
getsockopt$inet_IP_IPSEC_POLICY(0xffffffffffffffff, 0x0, 0x10, &(0x7f0000000540)={{{@in6, @in=@remote}}, {{@in6=@ipv4={[], [], @local}}, 0x0, @in6}}, &(0x7f0000000000)=0xe8)
ioctl$BINDER_SET_CONTEXT_MGR(r4, 0x40046207, 0x0)
r5 = dup(r4)
shutdown(r5, 0x1)
prctl$PR_SET_NAME(0xf, &(0x7f0000000380)='/group.stat\x00')
syz_open_dev$binder(&(0x7f0000000880)='/dev/binder#\x00', 0x0, 0x2)
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)})
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, &(0x7f0000000780)})
ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f0000000680)})
creat(&(0x7f00000000c0)='./file0\x00', 0x0)
openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000100)='/group.stat\x00', 0x2761, 0x0)
clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000080), 0xffffffffffffffff)
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000003c0)={0x14, 0x0, &(0x7f0000000680)=[@acquire_done], 0x0, 0x0, 0x0})

05:02:58 executing program 0:
recvmmsg(0xffffffffffffffff, &(0x7f0000003140)=[{{&(0x7f0000001400)=@ipx, 0x80, 0x0}}], 0x1, 0x0, 0x0)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = syz_open_procfs(0x0, &(0x7f00000004c0)='net/rt_cache\x00')
preadv(r0, &(0x7f00000017c0), 0xf4, 0x0)

[  407.628086] binder: 19087:19104 BC_ACQUIRE_DONE node 698 has no pending acquire request
[  407.654191] binder: 19096:19111 BC_INCREFS_DONE node 701 has no pending increfs request
[  407.698115] binder: 19096:19111 Release 1 refcount change on invalid ref 1 ret -22
05:02:58 executing program 1:
r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000200)='/dev/nullb0\x00', 0x5000000084002, 0x0)
mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x200000e, 0x13, r0, 0x0)
r1 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x4000, 0x0)
preadv(r1, &(0x7f0000000040)=[{&(0x7f0000000400)=""/4096, 0x3ffc00}], 0xb, 0x0)

05:02:58 executing program 3:
recvmmsg(0xffffffffffffffff, &(0x7f0000003140)=[{{&(0x7f0000001400)=@ipx, 0x80, 0x0}}], 0x1, 0x0, 0x0)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = syz_open_procfs(0x0, &(0x7f00000004c0)='net/rt_cache\x00')
preadv(r0, &(0x7f00000017c0), 0xf5, 0x0)

[  407.756777] binder: 19118:19119 ioctl c0306201 0 returned -14
[  407.785806] binder: BINDER_SET_CONTEXT_MGR already set
[  407.797232] binder: 19118:19119 ioctl 40046207 0 returned -16
[  407.871951] binder: 19118:19132 BC_INCREFS_DONE node 704 has no pending increfs request
[  407.891485] binder: 19118:19132 Release 1 refcount change on invalid ref 1 ret -22
[  407.909266] binder: 19118:19132 BC_ACQUIRE_DONE node 704 has no pending acquire request
05:02:58 executing program 5:
r0 = syz_open_dev$sndtimer(&(0x7f0000026000)='/dev/snd/timer\x00', 0x0, 0x0)
r1 = dup3(r0, r0, 0x80000)
ioctl$UI_GET_SYSNAME(r1, 0x8040552c, 0x0)
perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8)
r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c)
bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r2, &(0x7f0000000040), 0x0, 0x1}, 0x20)
openat$cgroup_ro(r1, &(0x7f00000004c0)='cpuset.effective_cpus\x00', 0x0, 0x0)
unlink(&(0x7f0000000900)='./file0/file0\x00')
r3 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r4 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r4, 0x0)
ioctl$BINDER_GET_NODE_DEBUG_INFO(r3, 0xc018620b, &(0x7f0000000780))
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f00000000c0)=[@enter_looper], 0x48, 0x0, &(0x7f0000000700)="2ba063fb309ec7fdbfb08e6e91baee7d7d4599fe14129a4d426834556ae420e087d59c0c7be7fcad1abb7e1f8f446f373f611ca1ee9c2231708e18a47bc68a2a79a0b48931f6ff6d"})
ioctl$sock_inet_tcp_SIOCOUTQNSD(r1, 0x894b, &(0x7f0000000480))
getsockopt$inet_IP_IPSEC_POLICY(0xffffffffffffffff, 0x0, 0x10, &(0x7f0000000540)={{{@in6, @in=@remote}}, {{@in6=@ipv4={[], [], @local}}, 0x0, @in6}}, &(0x7f0000000000)=0xe8)
ioctl$BINDER_SET_CONTEXT_MGR(r4, 0x40046207, 0x0)
r5 = dup(r4)
shutdown(r5, 0x1)
prctl$PR_SET_NAME(0xf, &(0x7f0000000380)='/group.stat\x00')
syz_open_dev$binder(&(0x7f0000000880)='/dev/binder#\x00', 0x0, 0x2)
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)})
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, &(0x7f0000000780)})
ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f0000000680)})
creat(&(0x7f00000000c0)='./file0\x00', 0x0)
openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000100)='/group.stat\x00', 0x2761, 0x0)
clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000080), 0xffffffffffffffff)
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000003c0)={0x14, 0x0, &(0x7f0000000680)=[@acquire_done], 0x0, 0x0, 0x0})

[  407.979533] binder: release 19077:19078 transaction 694 out, still active
[  407.992239] binder: unexpected work type, 4, not freed
[  408.007628] binder: undelivered TRANSACTION_COMPLETE
[  408.065945] binder: BINDER_SET_CONTEXT_MGR already set
[  408.076332] binder: 19140:19141 ioctl 40046207 0 returned -16
[  408.151040] binder: 19140:19144 BC_INCREFS_DONE node 707 has no pending increfs request
[  408.161564] binder: 19140:19144 Release 1 refcount change on invalid ref 1 ret -22
[  408.172927] binder: 19140:19144 BC_ACQUIRE_DONE node 707 has no pending acquire request
05:02:58 executing program 4:
r0 = syz_open_dev$sndtimer(&(0x7f0000026000)='/dev/snd/timer\x00', 0x0, 0x0)
r1 = dup3(r0, r0, 0x80000)
ioctl$UI_GET_SYSNAME(r1, 0x8040552c, 0x0)
perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8)
r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c)
bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r2, &(0x7f0000000040), 0x0, 0x1}, 0x20)
openat$cgroup_ro(r1, &(0x7f00000004c0)='cpuset.effective_cpus\x00', 0x0, 0x0)
unlink(&(0x7f0000000900)='./file0/file0\x00')
r3 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r4 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r4, 0x0)
ioctl$BINDER_GET_NODE_DEBUG_INFO(0xffffffffffffffff, 0xc018620b, &(0x7f0000000780))
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f00000000c0)=[@enter_looper], 0x48, 0x0, &(0x7f0000000700)="2ba063fb309ec7fdbfb08e6e91baee7d7d4599fe14129a4d426834556ae420e087d59c0c7be7fcad1abb7e1f8f446f373f611ca1ee9c2231708e18a47bc68a2a79a0b48931f6ff6d"})
ioctl$sock_inet_tcp_SIOCOUTQNSD(r1, 0x894b, &(0x7f0000000480))
getsockopt$inet_IP_IPSEC_POLICY(0xffffffffffffffff, 0x0, 0x10, &(0x7f0000000540)={{{@in6, @in=@remote}}, {{@in6=@ipv4={[], [], @local}}, 0x0, @in6}}, &(0x7f0000000000)=0xe8)
ioctl$BINDER_SET_CONTEXT_MGR(r4, 0x40046207, 0x0)
r5 = dup(r4)
shutdown(r5, 0x1)
prctl$PR_SET_NAME(0xf, &(0x7f0000000380)='/group.stat\x00')
syz_open_dev$binder(&(0x7f0000000880)='/dev/binder#\x00', 0x0, 0x2)
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)})
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, &(0x7f0000000780)})
ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f0000000680)})
creat(&(0x7f00000000c0)='./file0\x00', 0x0)
openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000100)='/group.stat\x00', 0x2761, 0x0)
clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000080), 0xffffffffffffffff)

05:02:58 executing program 0:
recvmmsg(0xffffffffffffffff, &(0x7f0000003140)=[{{&(0x7f0000001400)=@ipx, 0x80, 0x0}}], 0x1, 0x0, 0x0)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = syz_open_procfs(0x0, &(0x7f00000004c0)='net/rt_cache\x00')
preadv(r0, &(0x7f00000017c0), 0xf5, 0x0)

05:02:58 executing program 2:
r0 = syz_open_dev$sndtimer(&(0x7f0000026000)='/dev/snd/timer\x00', 0x0, 0x0)
r1 = dup3(r0, r0, 0x80000)
ioctl$UI_GET_SYSNAME(r1, 0x8040552c, 0x0)
perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8)
r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c)
bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r2, &(0x7f0000000040), 0x0, 0x1}, 0x20)
openat$cgroup_ro(r1, &(0x7f00000004c0)='cpuset.effective_cpus\x00', 0x0, 0x0)
unlink(&(0x7f0000000900)='./file0/file0\x00')
r3 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r4 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r4, 0x0)
ioctl$BINDER_GET_NODE_DEBUG_INFO(r3, 0xc018620b, &(0x7f0000000780))
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, 0x0)
ioctl$sock_inet_tcp_SIOCOUTQNSD(r1, 0x894b, &(0x7f0000000480))
getsockopt$inet_IP_IPSEC_POLICY(0xffffffffffffffff, 0x0, 0x10, &(0x7f0000000540)={{{@in6, @in=@remote}}, {{@in6=@ipv4={[], [], @local}}, 0x0, @in6}}, &(0x7f0000000000)=0xe8)
ioctl$BINDER_SET_CONTEXT_MGR(r4, 0x40046207, 0x0)
r5 = dup(r4)
shutdown(r5, 0x1)
prctl$PR_SET_NAME(0xf, &(0x7f0000000380)='/group.stat\x00')
syz_open_dev$binder(&(0x7f0000000880)='/dev/binder#\x00', 0x0, 0x2)
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)})
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, &(0x7f0000000780)})
ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f0000000680)})
creat(&(0x7f00000000c0)='./file0\x00', 0x0)
openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000100)='/group.stat\x00', 0x2761, 0x0)
clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000080), 0xffffffffffffffff)
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000003c0)={0x14, 0x0, &(0x7f0000000680)=[@acquire_done], 0x0, 0x0, 0x0})

05:02:58 executing program 3:
recvmmsg(0xffffffffffffffff, &(0x7f0000003140)=[{{&(0x7f0000001400)=@ipx, 0x80, 0x0}}], 0x1, 0x0, 0x0)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = syz_open_procfs(0x0, &(0x7f00000004c0)='net/rt_cache\x00')
preadv(r0, &(0x7f00000017c0), 0xf6, 0x0)

05:02:58 executing program 5:
r0 = syz_open_dev$sndtimer(&(0x7f0000026000)='/dev/snd/timer\x00', 0x0, 0x0)
r1 = dup3(r0, r0, 0x80000)
ioctl$UI_GET_SYSNAME(r1, 0x8040552c, 0x0)
perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8)
r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c)
bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r2, &(0x7f0000000040), 0x0, 0x1}, 0x20)
openat$cgroup_ro(r1, &(0x7f00000004c0)='cpuset.effective_cpus\x00', 0x0, 0x0)
unlink(&(0x7f0000000900)='./file0/file0\x00')
r3 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r4 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r4, 0x0)
ioctl$BINDER_GET_NODE_DEBUG_INFO(r3, 0xc018620b, &(0x7f0000000780))
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f00000000c0)=[@enter_looper], 0x48, 0x0, &(0x7f0000000700)="2ba063fb309ec7fdbfb08e6e91baee7d7d4599fe14129a4d426834556ae420e087d59c0c7be7fcad1abb7e1f8f446f373f611ca1ee9c2231708e18a47bc68a2a79a0b48931f6ff6d"})
ioctl$sock_inet_tcp_SIOCOUTQNSD(r1, 0x894b, &(0x7f0000000480))
getsockopt$inet_IP_IPSEC_POLICY(0xffffffffffffffff, 0x0, 0x10, &(0x7f0000000540)={{{@in6, @in=@remote}}, {{@in6=@ipv4={[], [], @local}}, 0x0, @in6}}, &(0x7f0000000000)=0xe8)
ioctl$BINDER_SET_CONTEXT_MGR(r4, 0x40046207, 0x0)
r5 = dup(r4)
shutdown(r5, 0x1)
prctl$PR_SET_NAME(0xf, &(0x7f0000000380)='/group.stat\x00')
syz_open_dev$binder(&(0x7f0000000880)='/dev/binder#\x00', 0x0, 0x2)
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)})
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, &(0x7f0000000780)})
ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f0000000680)})
creat(&(0x7f00000000c0)='./file0\x00', 0x0)
openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000100)='/group.stat\x00', 0x2761, 0x0)
clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000080), 0xffffffffffffffff)
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000003c0)={0x14, 0x0, &(0x7f0000000680)=[@acquire_done], 0x0, 0x0, 0x0})

05:02:58 executing program 1:
r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000200)='/dev/nullb0\x00', 0x5000000084002, 0x0)
mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x200000e, 0x13, r0, 0x0)
r1 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x4000, 0x0)
preadv(r1, &(0x7f0000000040)=[{&(0x7f0000000400)=""/4096, 0x3ffc00}], 0xc, 0x0)

[  408.227577] binder: release 19096:19097 transaction 700 out, still active
[  408.244542] binder: unexpected work type, 4, not freed
[  408.249837] binder: undelivered TRANSACTION_COMPLETE
05:02:58 executing program 3:
recvmmsg(0xffffffffffffffff, &(0x7f0000003140)=[{{&(0x7f0000001400)=@ipx, 0x80, 0x0}}], 0x1, 0x0, 0x0)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = syz_open_procfs(0x0, &(0x7f00000004c0)='net/rt_cache\x00')
preadv(r0, &(0x7f00000017c0), 0xf7, 0x0)

05:02:58 executing program 0:
recvmmsg(0xffffffffffffffff, &(0x7f0000003140)=[{{&(0x7f0000001400)=@ipx, 0x80, 0x0}}], 0x1, 0x0, 0x0)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = syz_open_procfs(0x0, &(0x7f00000004c0)='net/rt_cache\x00')
preadv(r0, &(0x7f00000017c0), 0xf6, 0x0)

05:02:58 executing program 1:
r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000200)='/dev/nullb0\x00', 0x5000000084002, 0x0)
mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x200000e, 0x13, r0, 0x0)
r1 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x4000, 0x0)
preadv(r1, &(0x7f0000000040)=[{&(0x7f0000000400)=""/4096, 0x3ffc00}], 0xd, 0x0)

[  408.365345] binder: BINDER_SET_CONTEXT_MGR already set
[  408.368612] binder: 19157:19163 ioctl c0306201 0 returned -14
[  408.384434] binder: 19164 RLIMIT_NICE not set
[  408.391768] binder: 19158:19159 ioctl 40046207 0 returned -16
[  408.404792] binder: BINDER_SET_CONTEXT_MGR already set
[  408.451452] binder: 19162:19165 Release 1 refcount change on invalid ref 1 ret -22
[  408.477968] binder: 19157:19177 Release 1 refcount change on invalid ref 1 ret -22
[  408.502635] binder: BINDER_SET_CONTEXT_MGR already set
[  408.518335] binder: 19162:19164 ioctl 40046207 0 returned -16
[  408.533029] binder: 19158:19181 BC_INCREFS_DONE node 716 has no pending increfs request
[  408.539651] binder: 19157:19163 ioctl 40046207 0 returned -16
05:02:58 executing program 0:
recvmmsg(0xffffffffffffffff, &(0x7f0000003140)=[{{&(0x7f0000001400)=@ipx, 0x80, 0x0}}], 0x1, 0x0, 0x0)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = syz_open_procfs(0x0, &(0x7f00000004c0)='net/rt_cache\x00')
preadv(r0, &(0x7f00000017c0), 0xf7, 0x0)

[  408.557065] binder: release 19162:19165 transaction 709 out, still active
05:02:58 executing program 3:
recvmmsg(0xffffffffffffffff, &(0x7f0000003140)=[{{&(0x7f0000001400)=@ipx, 0x80, 0x0}}], 0x1, 0x0, 0x0)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = syz_open_procfs(0x0, &(0x7f00000004c0)='net/rt_cache\x00')
preadv(r0, &(0x7f00000017c0), 0xf8, 0x0)

05:02:58 executing program 4:
r0 = syz_open_dev$sndtimer(&(0x7f0000026000)='/dev/snd/timer\x00', 0x0, 0x0)
r1 = dup3(r0, r0, 0x80000)
ioctl$UI_GET_SYSNAME(r1, 0x8040552c, 0x0)
perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8)
r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c)
bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r2, &(0x7f0000000040), 0x0, 0x1}, 0x20)
openat$cgroup_ro(r1, &(0x7f00000004c0)='cpuset.effective_cpus\x00', 0x0, 0x0)
unlink(&(0x7f0000000900)='./file0/file0\x00')
r3 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r4 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r4, 0x0)
ioctl$BINDER_GET_NODE_DEBUG_INFO(0xffffffffffffffff, 0xc018620b, &(0x7f0000000780))
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f00000000c0)=[@enter_looper], 0x48, 0x0, &(0x7f0000000700)="2ba063fb309ec7fdbfb08e6e91baee7d7d4599fe14129a4d426834556ae420e087d59c0c7be7fcad1abb7e1f8f446f373f611ca1ee9c2231708e18a47bc68a2a79a0b48931f6ff6d"})
ioctl$sock_inet_tcp_SIOCOUTQNSD(r1, 0x894b, &(0x7f0000000480))
getsockopt$inet_IP_IPSEC_POLICY(0xffffffffffffffff, 0x0, 0x10, &(0x7f0000000540)={{{@in6, @in=@remote}}, {{@in6=@ipv4={[], [], @local}}, 0x0, @in6}}, &(0x7f0000000000)=0xe8)
ioctl$BINDER_SET_CONTEXT_MGR(r4, 0x40046207, 0x0)
r5 = dup(r4)
shutdown(r5, 0x1)
prctl$PR_SET_NAME(0xf, &(0x7f0000000380)='/group.stat\x00')
syz_open_dev$binder(&(0x7f0000000880)='/dev/binder#\x00', 0x0, 0x2)
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)})
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, &(0x7f0000000780)})
ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f0000000680)})
creat(&(0x7f00000000c0)='./file0\x00', 0x0)
openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000100)='/group.stat\x00', 0x2761, 0x0)
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000003c0)={0x14, 0x0, &(0x7f0000000680)=[@acquire_done], 0x0, 0x0, 0x0})

[  408.598271] binder: 19158:19181 BC_ACQUIRE_DONE node 716 has no pending acquire request
[  408.610600] binder: release 19157:19177 transaction 712 out, still active
05:02:59 executing program 0:
recvmmsg(0xffffffffffffffff, &(0x7f0000003140)=[{{&(0x7f0000001400)=@ipx, 0x80, 0x0}}], 0x1, 0x0, 0x0)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = syz_open_procfs(0x0, &(0x7f00000004c0)='net/rt_cache\x00')
preadv(r0, &(0x7f00000017c0), 0xf8, 0x0)

05:02:59 executing program 2:
r0 = syz_open_dev$sndtimer(&(0x7f0000026000)='/dev/snd/timer\x00', 0x0, 0x0)
r1 = dup3(r0, r0, 0x80000)
ioctl$UI_GET_SYSNAME(r1, 0x8040552c, 0x0)
perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8)
r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c)
bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r2, &(0x7f0000000040), 0x0, 0x1}, 0x20)
openat$cgroup_ro(r1, &(0x7f00000004c0)='cpuset.effective_cpus\x00', 0x0, 0x0)
unlink(&(0x7f0000000900)='./file0/file0\x00')
r3 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r4 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r4, 0x0)
ioctl$BINDER_GET_NODE_DEBUG_INFO(r3, 0xc018620b, &(0x7f0000000780))
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, 0x0)
ioctl$sock_inet_tcp_SIOCOUTQNSD(r1, 0x894b, &(0x7f0000000480))
getsockopt$inet_IP_IPSEC_POLICY(0xffffffffffffffff, 0x0, 0x10, &(0x7f0000000540)={{{@in6, @in=@remote}}, {{@in6=@ipv4={[], [], @local}}, 0x0, @in6}}, &(0x7f0000000000)=0xe8)
ioctl$BINDER_SET_CONTEXT_MGR(r4, 0x40046207, 0x0)
r5 = dup(r4)
shutdown(r5, 0x1)
prctl$PR_SET_NAME(0xf, &(0x7f0000000380)='/group.stat\x00')
syz_open_dev$binder(&(0x7f0000000880)='/dev/binder#\x00', 0x0, 0x2)
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)})
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, &(0x7f0000000780)})
ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f0000000680)})
creat(&(0x7f00000000c0)='./file0\x00', 0x0)
openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000100)='/group.stat\x00', 0x2761, 0x0)
clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000080), 0xffffffffffffffff)
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000003c0)={0x14, 0x0, &(0x7f0000000680)=[@acquire_done], 0x0, 0x0, 0x0})

[  408.762117] binder: 19194 RLIMIT_NICE not set
05:02:59 executing program 3:
recvmmsg(0xffffffffffffffff, &(0x7f0000003140)=[{{&(0x7f0000001400)=@ipx, 0x80, 0x0}}], 0x1, 0x0, 0x0)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = syz_open_procfs(0x0, &(0x7f00000004c0)='net/rt_cache\x00')
preadv(r0, &(0x7f00000017c0), 0xf9, 0x0)

[  408.785373] binder: BINDER_SET_CONTEXT_MGR already set
[  408.803802] binder: 19193:19194 ioctl 40046207 0 returned -16
[  408.840263] binder: 19200:19201 ioctl c0306201 0 returned -14
[  408.871834] binder: BINDER_SET_CONTEXT_MGR already set
05:02:59 executing program 0:
recvmmsg(0xffffffffffffffff, &(0x7f0000003140)=[{{&(0x7f0000001400)=@ipx, 0x80, 0x0}}], 0x1, 0x0, 0x0)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = syz_open_procfs(0x0, &(0x7f00000004c0)='net/rt_cache\x00')
preadv(r0, &(0x7f00000017c0), 0xf9, 0x0)

[  408.884336] binder: 19193:19206 BC_INCREFS_DONE node 719 has no pending increfs request
[  408.885116] binder: 19193:19206 BC_ACQUIRE_DONE node 719 has no pending acquire request
[  408.999343] binder: 19200:19201 ioctl 40046207 0 returned -16
[  409.042379] binder: release 19200:19214 transaction 721 out, still active
05:02:59 executing program 5:
r0 = syz_open_dev$sndtimer(&(0x7f0000026000)='/dev/snd/timer\x00', 0x0, 0x0)
r1 = dup3(r0, r0, 0x80000)
ioctl$UI_GET_SYSNAME(r1, 0x8040552c, 0x0)
perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8)
r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c)
bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r2, &(0x7f0000000040), 0x0, 0x1}, 0x20)
openat$cgroup_ro(r1, &(0x7f00000004c0)='cpuset.effective_cpus\x00', 0x0, 0x0)
unlink(&(0x7f0000000900)='./file0/file0\x00')
r3 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r4 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r4, 0x0)
ioctl$BINDER_GET_NODE_DEBUG_INFO(0xffffffffffffffff, 0xc018620b, &(0x7f0000000780))
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f00000000c0)=[@enter_looper], 0x48, 0x0, &(0x7f0000000700)="2ba063fb309ec7fdbfb08e6e91baee7d7d4599fe14129a4d426834556ae420e087d59c0c7be7fcad1abb7e1f8f446f373f611ca1ee9c2231708e18a47bc68a2a79a0b48931f6ff6d"})
ioctl$sock_inet_tcp_SIOCOUTQNSD(r1, 0x894b, &(0x7f0000000480))
getsockopt$inet_IP_IPSEC_POLICY(0xffffffffffffffff, 0x0, 0x10, &(0x7f0000000540)={{{@in6, @in=@remote}}, {{@in6=@ipv4={[], [], @local}}, 0x0, @in6}}, &(0x7f0000000000)=0xe8)
ioctl$BINDER_SET_CONTEXT_MGR(r4, 0x40046207, 0x0)
r5 = dup(r4)
shutdown(r5, 0x1)
prctl$PR_SET_NAME(0xf, &(0x7f0000000380)='/group.stat\x00')
syz_open_dev$binder(&(0x7f0000000880)='/dev/binder#\x00', 0x0, 0x2)
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)})
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, &(0x7f0000000780)})
ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f0000000680)})
creat(&(0x7f00000000c0)='./file0\x00', 0x0)
openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000100)='/group.stat\x00', 0x2761, 0x0)
clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000080), 0xffffffffffffffff)

05:02:59 executing program 1:
r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000200)='/dev/nullb0\x00', 0x5000000084002, 0x0)
mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x200000e, 0x13, r0, 0x0)
r1 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x4000, 0x0)
preadv(r1, &(0x7f0000000040)=[{&(0x7f0000000400)=""/4096, 0x3ffc00}], 0xe, 0x0)

05:02:59 executing program 3:
recvmmsg(0xffffffffffffffff, &(0x7f0000003140)=[{{&(0x7f0000001400)=@ipx, 0x80, 0x0}}], 0x1, 0x0, 0x0)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = syz_open_procfs(0x0, &(0x7f00000004c0)='net/rt_cache\x00')
preadv(r0, &(0x7f00000017c0), 0xfa, 0x0)

05:02:59 executing program 0:
recvmmsg(0xffffffffffffffff, &(0x7f0000003140)=[{{&(0x7f0000001400)=@ipx, 0x80, 0x0}}], 0x1, 0x0, 0x0)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = syz_open_procfs(0x0, &(0x7f00000004c0)='net/rt_cache\x00')
preadv(r0, &(0x7f00000017c0), 0xfa, 0x0)

05:02:59 executing program 2:
r0 = syz_open_dev$sndtimer(&(0x7f0000026000)='/dev/snd/timer\x00', 0x0, 0x0)
r1 = dup3(r0, r0, 0x80000)
ioctl$UI_GET_SYSNAME(r1, 0x8040552c, 0x0)
perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8)
r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c)
bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r2, &(0x7f0000000040), 0x0, 0x1}, 0x20)
openat$cgroup_ro(r1, &(0x7f00000004c0)='cpuset.effective_cpus\x00', 0x0, 0x0)
unlink(&(0x7f0000000900)='./file0/file0\x00')
r3 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r4 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r4, 0x0)
ioctl$BINDER_GET_NODE_DEBUG_INFO(r3, 0xc018620b, &(0x7f0000000780))
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x48, 0x0, &(0x7f0000000700)="2ba063fb309ec7fdbfb08e6e91baee7d7d4599fe14129a4d426834556ae420e087d59c0c7be7fcad1abb7e1f8f446f373f611ca1ee9c2231708e18a47bc68a2a79a0b48931f6ff6d"})
ioctl$sock_inet_tcp_SIOCOUTQNSD(r1, 0x894b, &(0x7f0000000480))
getsockopt$inet_IP_IPSEC_POLICY(0xffffffffffffffff, 0x0, 0x10, &(0x7f0000000540)={{{@in6, @in=@remote}}, {{@in6=@ipv4={[], [], @local}}, 0x0, @in6}}, &(0x7f0000000000)=0xe8)
ioctl$BINDER_SET_CONTEXT_MGR(r4, 0x40046207, 0x0)
r5 = dup(r4)
shutdown(r5, 0x1)
prctl$PR_SET_NAME(0xf, &(0x7f0000000380)='/group.stat\x00')
syz_open_dev$binder(&(0x7f0000000880)='/dev/binder#\x00', 0x0, 0x2)
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)})
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, &(0x7f0000000780)})
ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f0000000680)})
creat(&(0x7f00000000c0)='./file0\x00', 0x0)
openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000100)='/group.stat\x00', 0x2761, 0x0)
clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000080), 0xffffffffffffffff)
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000003c0)={0x14, 0x0, &(0x7f0000000680)=[@acquire_done], 0x0, 0x0, 0x0})

[  409.103838] binder: release 19158:19159 transaction 715 out, still active
[  409.110812] binder: unexpected work type, 4, not freed
[  409.143966] binder: undelivered TRANSACTION_COMPLETE
05:02:59 executing program 0:
recvmmsg(0xffffffffffffffff, &(0x7f0000003140)=[{{&(0x7f0000001400)=@ipx, 0x80, 0x0}}], 0x1, 0x0, 0x0)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = syz_open_procfs(0x0, &(0x7f00000004c0)='net/rt_cache\x00')
preadv(r0, &(0x7f00000017c0), 0xfb, 0x0)

05:02:59 executing program 3:
recvmmsg(0xffffffffffffffff, &(0x7f0000003140)=[{{&(0x7f0000001400)=@ipx, 0x80, 0x0}}], 0x1, 0x0, 0x0)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = syz_open_procfs(0x0, &(0x7f00000004c0)='net/rt_cache\x00')
preadv(r0, &(0x7f00000017c0), 0xfb, 0x0)

[  409.277218] binder: BINDER_SET_CONTEXT_MGR already set
[  409.284873] binder: 19220:19235 ioctl 40046207 0 returned -16
[  409.328796] binder: 19233 RLIMIT_NICE not set
[  409.384125] binder: BINDER_SET_CONTEXT_MGR already set
[  409.402434] binder: 19231:19233 ioctl 40046207 0 returned -16
[  409.471543] binder: 19231:19238 BC_INCREFS_DONE node 728 has no pending increfs request
05:02:59 executing program 4:
r0 = syz_open_dev$sndtimer(&(0x7f0000026000)='/dev/snd/timer\x00', 0x0, 0x0)
r1 = dup3(r0, r0, 0x80000)
ioctl$UI_GET_SYSNAME(r1, 0x8040552c, 0x0)
perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8)
r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c)
bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r2, &(0x7f0000000040), 0x0, 0x1}, 0x20)
openat$cgroup_ro(r1, &(0x7f00000004c0)='cpuset.effective_cpus\x00', 0x0, 0x0)
unlink(&(0x7f0000000900)='./file0/file0\x00')
r3 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r4 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r4, 0x0)
ioctl$BINDER_GET_NODE_DEBUG_INFO(0xffffffffffffffff, 0xc018620b, &(0x7f0000000780))
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f00000000c0)=[@enter_looper], 0x48, 0x0, &(0x7f0000000700)="2ba063fb309ec7fdbfb08e6e91baee7d7d4599fe14129a4d426834556ae420e087d59c0c7be7fcad1abb7e1f8f446f373f611ca1ee9c2231708e18a47bc68a2a79a0b48931f6ff6d"})
ioctl$sock_inet_tcp_SIOCOUTQNSD(r1, 0x894b, &(0x7f0000000480))
getsockopt$inet_IP_IPSEC_POLICY(0xffffffffffffffff, 0x0, 0x10, &(0x7f0000000540)={{{@in6, @in=@remote}}, {{@in6=@ipv4={[], [], @local}}, 0x0, @in6}}, &(0x7f0000000000)=0xe8)
ioctl$BINDER_SET_CONTEXT_MGR(r4, 0x40046207, 0x0)
r5 = dup(r4)
shutdown(r5, 0x1)
prctl$PR_SET_NAME(0xf, &(0x7f0000000380)='/group.stat\x00')
syz_open_dev$binder(&(0x7f0000000880)='/dev/binder#\x00', 0x0, 0x2)
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)})
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, &(0x7f0000000780)})
ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f0000000680)})
creat(&(0x7f00000000c0)='./file0\x00', 0x0)
openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000100)='/group.stat\x00', 0x2761, 0x0)
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000003c0)={0x14, 0x0, &(0x7f0000000680)=[@acquire_done], 0x0, 0x0, 0x0})

05:02:59 executing program 1:
r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000200)='/dev/nullb0\x00', 0x5000000084002, 0x0)
mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x200000e, 0x13, r0, 0x0)
r1 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x4000, 0x0)
preadv(r1, &(0x7f0000000040)=[{&(0x7f0000000400)=""/4096, 0x3ffc00}], 0xf, 0x0)

05:02:59 executing program 0:
recvmmsg(0xffffffffffffffff, &(0x7f0000003140)=[{{&(0x7f0000001400)=@ipx, 0x80, 0x0}}], 0x1, 0x0, 0x0)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = syz_open_procfs(0x0, &(0x7f00000004c0)='net/rt_cache\x00')
preadv(r0, &(0x7f00000017c0), 0xfc, 0x0)

05:02:59 executing program 3:
recvmmsg(0xffffffffffffffff, &(0x7f0000003140)=[{{&(0x7f0000001400)=@ipx, 0x80, 0x0}}], 0x1, 0x0, 0x0)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = syz_open_procfs(0x0, &(0x7f00000004c0)='net/rt_cache\x00')
preadv(r0, &(0x7f00000017c0), 0xfc, 0x0)

[  409.514114] binder: release 19193:19194 transaction 718 out, still active
[  409.521080] binder: unexpected work type, 4, not freed
[  409.528637] binder: undelivered TRANSACTION_COMPLETE
05:02:59 executing program 0:
recvmmsg(0xffffffffffffffff, &(0x7f0000003140)=[{{&(0x7f0000001400)=@ipx, 0x80, 0x0}}], 0x1, 0x0, 0x0)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = syz_open_procfs(0x0, &(0x7f00000004c0)='net/rt_cache\x00')
preadv(r0, &(0x7f00000017c0), 0xfd, 0x0)

[  409.648697] binder: 19261 RLIMIT_NICE not set
[  409.674752] binder: BINDER_SET_CONTEXT_MGR already set
[  409.686389] binder: 19260:19261 ioctl 40046207 0 returned -16
[  409.762982] binder: 19260:19266 BC_INCREFS_DONE node 731 has no pending increfs request
[  409.784775] binder: 19260:19266 BC_ACQUIRE_DONE node 731 has no pending acquire request
[  409.973759] binder: release 19220:19235 transaction 724 out, still active
05:03:00 executing program 5:
r0 = syz_open_dev$sndtimer(&(0x7f0000026000)='/dev/snd/timer\x00', 0x0, 0x0)
r1 = dup3(r0, r0, 0x80000)
ioctl$UI_GET_SYSNAME(r1, 0x8040552c, 0x0)
perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8)
r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c)
bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r2, &(0x7f0000000040), 0x0, 0x1}, 0x20)
openat$cgroup_ro(r1, &(0x7f00000004c0)='cpuset.effective_cpus\x00', 0x0, 0x0)
unlink(&(0x7f0000000900)='./file0/file0\x00')
r3 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r4 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r4, 0x0)
ioctl$BINDER_GET_NODE_DEBUG_INFO(0xffffffffffffffff, 0xc018620b, &(0x7f0000000780))
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f00000000c0)=[@enter_looper], 0x48, 0x0, &(0x7f0000000700)="2ba063fb309ec7fdbfb08e6e91baee7d7d4599fe14129a4d426834556ae420e087d59c0c7be7fcad1abb7e1f8f446f373f611ca1ee9c2231708e18a47bc68a2a79a0b48931f6ff6d"})
ioctl$sock_inet_tcp_SIOCOUTQNSD(r1, 0x894b, &(0x7f0000000480))
getsockopt$inet_IP_IPSEC_POLICY(0xffffffffffffffff, 0x0, 0x10, &(0x7f0000000540)={{{@in6, @in=@remote}}, {{@in6=@ipv4={[], [], @local}}, 0x0, @in6}}, &(0x7f0000000000)=0xe8)
ioctl$BINDER_SET_CONTEXT_MGR(r4, 0x40046207, 0x0)
r5 = dup(r4)
shutdown(r5, 0x1)
prctl$PR_SET_NAME(0xf, &(0x7f0000000380)='/group.stat\x00')
syz_open_dev$binder(&(0x7f0000000880)='/dev/binder#\x00', 0x0, 0x2)
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)})
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, &(0x7f0000000780)})
ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f0000000680)})
creat(&(0x7f00000000c0)='./file0\x00', 0x0)
openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000100)='/group.stat\x00', 0x2761, 0x0)
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000003c0)={0x14, 0x0, &(0x7f0000000680)=[@acquire_done], 0x0, 0x0, 0x0})

05:03:00 executing program 0:
recvmmsg(0xffffffffffffffff, &(0x7f0000003140)=[{{&(0x7f0000001400)=@ipx, 0x80, 0x0}}], 0x1, 0x0, 0x0)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = syz_open_procfs(0x0, &(0x7f00000004c0)='net/rt_cache\x00')
preadv(r0, &(0x7f00000017c0), 0xfe, 0x0)

05:03:00 executing program 3:
recvmmsg(0xffffffffffffffff, &(0x7f0000003140)=[{{&(0x7f0000001400)=@ipx, 0x80, 0x0}}], 0x1, 0x0, 0x0)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = syz_open_procfs(0x0, &(0x7f00000004c0)='net/rt_cache\x00')
preadv(r0, &(0x7f00000017c0), 0xfd, 0x0)

05:03:00 executing program 1:
r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000200)='/dev/nullb0\x00', 0x5000000084002, 0x0)
mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x200000e, 0x13, r0, 0x0)
r1 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x4000, 0x0)
preadv(r1, &(0x7f0000000040)=[{&(0x7f0000000400)=""/4096, 0x3ffc00}], 0x10, 0x0)

05:03:00 executing program 2:
r0 = syz_open_dev$sndtimer(&(0x7f0000026000)='/dev/snd/timer\x00', 0x0, 0x0)
r1 = dup3(r0, r0, 0x80000)
ioctl$UI_GET_SYSNAME(r1, 0x8040552c, 0x0)
perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8)
r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c)
bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r2, &(0x7f0000000040), 0x0, 0x1}, 0x20)
openat$cgroup_ro(r1, &(0x7f00000004c0)='cpuset.effective_cpus\x00', 0x0, 0x0)
unlink(&(0x7f0000000900)='./file0/file0\x00')
r3 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r4 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r4, 0x0)
ioctl$BINDER_GET_NODE_DEBUG_INFO(r3, 0xc018620b, &(0x7f0000000780))
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x48, 0x0, &(0x7f0000000700)="2ba063fb309ec7fdbfb08e6e91baee7d7d4599fe14129a4d426834556ae420e087d59c0c7be7fcad1abb7e1f8f446f373f611ca1ee9c2231708e18a47bc68a2a79a0b48931f6ff6d"})
ioctl$sock_inet_tcp_SIOCOUTQNSD(r1, 0x894b, &(0x7f0000000480))
getsockopt$inet_IP_IPSEC_POLICY(0xffffffffffffffff, 0x0, 0x10, &(0x7f0000000540)={{{@in6, @in=@remote}}, {{@in6=@ipv4={[], [], @local}}, 0x0, @in6}}, &(0x7f0000000000)=0xe8)
ioctl$BINDER_SET_CONTEXT_MGR(r4, 0x40046207, 0x0)
r5 = dup(r4)
shutdown(r5, 0x1)
prctl$PR_SET_NAME(0xf, &(0x7f0000000380)='/group.stat\x00')
syz_open_dev$binder(&(0x7f0000000880)='/dev/binder#\x00', 0x0, 0x2)
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)})
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, &(0x7f0000000780)})
ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f0000000680)})
creat(&(0x7f00000000c0)='./file0\x00', 0x0)
openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000100)='/group.stat\x00', 0x2761, 0x0)
clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000080), 0xffffffffffffffff)
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000003c0)={0x14, 0x0, &(0x7f0000000680)=[@acquire_done], 0x0, 0x0, 0x0})

[  410.037439] binder: release 19231:19233 transaction 727 out, still active
[  410.044711] binder: unexpected work type, 4, not freed
[  410.050112] binder: undelivered TRANSACTION_COMPLETE
05:03:00 executing program 0:
recvmmsg(0xffffffffffffffff, &(0x7f0000003140)=[{{&(0x7f0000001400)=@ipx, 0x80, 0x0}}], 0x1, 0x0, 0x0)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = syz_open_procfs(0x0, &(0x7f00000004c0)='net/rt_cache\x00')
preadv(r0, &(0x7f00000017c0), 0x102, 0x0)

05:03:00 executing program 3:
recvmmsg(0xffffffffffffffff, &(0x7f0000003140)=[{{&(0x7f0000001400)=@ipx, 0x80, 0x0}}], 0x1, 0x0, 0x0)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = syz_open_procfs(0x0, &(0x7f00000004c0)='net/rt_cache\x00')
preadv(r0, &(0x7f00000017c0), 0xfe, 0x0)

[  410.178229] binder: 19286 RLIMIT_NICE not set
[  410.194330] binder: BINDER_SET_CONTEXT_MGR already set
[  410.207546] binder: BINDER_SET_CONTEXT_MGR already set
[  410.213152] binder: 19282:19288 ioctl 40046207 0 returned -16
[  410.220726] binder: 19284:19286 ioctl 40046207 0 returned -16
05:03:00 executing program 4:
r0 = syz_open_dev$sndtimer(&(0x7f0000026000)='/dev/snd/timer\x00', 0x0, 0x0)
r1 = dup3(r0, r0, 0x80000)
ioctl$UI_GET_SYSNAME(r1, 0x8040552c, 0x0)
perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8)
r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c)
bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r2, &(0x7f0000000040), 0x0, 0x1}, 0x20)
openat$cgroup_ro(r1, &(0x7f00000004c0)='cpuset.effective_cpus\x00', 0x0, 0x0)
unlink(&(0x7f0000000900)='./file0/file0\x00')
r3 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r4 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r4, 0x0)
ioctl$BINDER_GET_NODE_DEBUG_INFO(0xffffffffffffffff, 0xc018620b, &(0x7f0000000780))
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f00000000c0)=[@enter_looper], 0x48, 0x0, &(0x7f0000000700)="2ba063fb309ec7fdbfb08e6e91baee7d7d4599fe14129a4d426834556ae420e087d59c0c7be7fcad1abb7e1f8f446f373f611ca1ee9c2231708e18a47bc68a2a79a0b48931f6ff6d"})
ioctl$sock_inet_tcp_SIOCOUTQNSD(r1, 0x894b, &(0x7f0000000480))
getsockopt$inet_IP_IPSEC_POLICY(0xffffffffffffffff, 0x0, 0x10, &(0x7f0000000540)={{{@in6, @in=@remote}}, {{@in6=@ipv4={[], [], @local}}, 0x0, @in6}}, &(0x7f0000000000)=0xe8)
ioctl$BINDER_SET_CONTEXT_MGR(r4, 0x40046207, 0x0)
r5 = dup(r4)
shutdown(r5, 0x1)
prctl$PR_SET_NAME(0xf, &(0x7f0000000380)='/group.stat\x00')
syz_open_dev$binder(&(0x7f0000000880)='/dev/binder#\x00', 0x0, 0x2)
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)})
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, &(0x7f0000000780)})
ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f0000000680)})
creat(&(0x7f00000000c0)='./file0\x00', 0x0)
openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000100)='/group.stat\x00', 0x2761, 0x0)
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000003c0)={0x14, 0x0, &(0x7f0000000680)=[@acquire_done], 0x0, 0x0, 0x0})

05:03:00 executing program 5:
r0 = syz_open_dev$sndtimer(&(0x7f0000026000)='/dev/snd/timer\x00', 0x0, 0x0)
r1 = dup3(r0, r0, 0x80000)
ioctl$UI_GET_SYSNAME(r1, 0x8040552c, 0x0)
perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8)
r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c)
bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r2, &(0x7f0000000040), 0x0, 0x1}, 0x20)
openat$cgroup_ro(r1, &(0x7f00000004c0)='cpuset.effective_cpus\x00', 0x0, 0x0)
unlink(&(0x7f0000000900)='./file0/file0\x00')
r3 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r4 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r4, 0x0)
ioctl$BINDER_GET_NODE_DEBUG_INFO(r3, 0xc018620b, &(0x7f0000000780))
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, 0x0)
ioctl$sock_inet_tcp_SIOCOUTQNSD(r1, 0x894b, &(0x7f0000000480))
getsockopt$inet_IP_IPSEC_POLICY(0xffffffffffffffff, 0x0, 0x10, &(0x7f0000000540)={{{@in6, @in=@remote}}, {{@in6=@ipv4={[], [], @local}}, 0x0, @in6}}, &(0x7f0000000000)=0xe8)
ioctl$BINDER_SET_CONTEXT_MGR(r4, 0x40046207, 0x0)
r5 = dup(r4)
shutdown(r5, 0x1)
prctl$PR_SET_NAME(0xf, &(0x7f0000000380)='/group.stat\x00')
syz_open_dev$binder(&(0x7f0000000880)='/dev/binder#\x00', 0x0, 0x2)
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)})
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, &(0x7f0000000780)})
ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f0000000680)})
creat(&(0x7f00000000c0)='./file0\x00', 0x0)
openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000100)='/group.stat\x00', 0x2761, 0x0)
clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000080), 0xffffffffffffffff)
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000003c0)={0x14, 0x0, &(0x7f0000000680)=[@acquire_done], 0x0, 0x0, 0x0})

05:03:00 executing program 3:
recvmmsg(0xffffffffffffffff, &(0x7f0000003140)=[{{&(0x7f0000001400)=@ipx, 0x80, 0x0}}], 0x1, 0x0, 0x0)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = syz_open_procfs(0x0, &(0x7f00000004c0)='net/rt_cache\x00')
preadv(r0, &(0x7f00000017c0), 0x102, 0x0)

05:03:00 executing program 0:
recvmmsg(0xffffffffffffffff, &(0x7f0000003140)=[{{&(0x7f0000001400)=@ipx, 0x80, 0x0}}], 0x1, 0x0, 0x0)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = syz_open_procfs(0x0, &(0x7f00000004c0)='net/rt_cache\x00')
preadv(r0, &(0x7f00000017c0), 0x103, 0x0)

[  410.413914] binder: unexpected work type, 4, not freed
[  410.419226] binder: undelivered TRANSACTION_COMPLETE
05:03:00 executing program 0:
recvmmsg(0xffffffffffffffff, &(0x7f0000003140)=[{{&(0x7f0000001400)=@ipx, 0x80, 0x0}}], 0x1, 0x0, 0x0)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = syz_open_procfs(0x0, &(0x7f00000004c0)='net/rt_cache\x00')
preadv(r0, &(0x7f00000017c0), 0x104, 0x0)

05:03:00 executing program 3:
recvmmsg(0xffffffffffffffff, &(0x7f0000003140)=[{{&(0x7f0000001400)=@ipx, 0x80, 0x0}}], 0x1, 0x0, 0x0)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = syz_open_procfs(0x0, &(0x7f00000004c0)='net/rt_cache\x00')
preadv(r0, &(0x7f00000017c0), 0x103, 0x0)

[  410.532581] binder: 19308:19309 ioctl c0306201 0 returned -14
[  410.540643] binder: 19315 RLIMIT_NICE not set
[  410.566410] binder: BINDER_SET_CONTEXT_MGR already set
[  410.584262] binder: BINDER_SET_CONTEXT_MGR already set
[  410.590735] binder: 19314:19315 ioctl 40046207 0 returned -16
[  410.623916] binder: 19308:19309 ioctl 40046207 0 returned -16
05:03:01 executing program 0:
recvmmsg(0xffffffffffffffff, &(0x7f0000003140)=[{{&(0x7f0000001400)=@ipx, 0x80, 0x0}}], 0x1, 0x0, 0x0)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = syz_open_procfs(0x0, &(0x7f00000004c0)='net/rt_cache\x00')
preadv(r0, &(0x7f00000017c0), 0x105, 0x0)

[  410.671520] binder: 19314:19326 BC_INCREFS_DONE node 740 has no pending increfs request
05:03:01 executing program 1:
r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000200)='/dev/nullb0\x00', 0x5000000084002, 0x0)
mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x200000e, 0x13, r0, 0x0)
r1 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x4000, 0x0)
preadv(r1, &(0x7f0000000040)=[{&(0x7f0000000400)=""/4096, 0x3ffc00}], 0x11, 0x0)

05:03:01 executing program 5:
r0 = syz_open_dev$sndtimer(&(0x7f0000026000)='/dev/snd/timer\x00', 0x0, 0x0)
r1 = dup3(r0, r0, 0x80000)
ioctl$UI_GET_SYSNAME(r1, 0x8040552c, 0x0)
perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8)
r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c)
bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r2, &(0x7f0000000040), 0x0, 0x1}, 0x20)
openat$cgroup_ro(r1, &(0x7f00000004c0)='cpuset.effective_cpus\x00', 0x0, 0x0)
unlink(&(0x7f0000000900)='./file0/file0\x00')
r3 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r4 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r4, 0x0)
ioctl$BINDER_GET_NODE_DEBUG_INFO(0xffffffffffffffff, 0xc018620b, &(0x7f0000000780))
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f00000000c0)=[@enter_looper], 0x48, 0x0, &(0x7f0000000700)="2ba063fb309ec7fdbfb08e6e91baee7d7d4599fe14129a4d426834556ae420e087d59c0c7be7fcad1abb7e1f8f446f373f611ca1ee9c2231708e18a47bc68a2a79a0b48931f6ff6d"})
ioctl$sock_inet_tcp_SIOCOUTQNSD(r1, 0x894b, &(0x7f0000000480))
getsockopt$inet_IP_IPSEC_POLICY(0xffffffffffffffff, 0x0, 0x10, &(0x7f0000000540)={{{@in6, @in=@remote}}, {{@in6=@ipv4={[], [], @local}}, 0x0, @in6}}, &(0x7f0000000000)=0xe8)
ioctl$BINDER_SET_CONTEXT_MGR(r4, 0x40046207, 0x0)
r5 = dup(r4)
shutdown(r5, 0x1)
prctl$PR_SET_NAME(0xf, &(0x7f0000000380)='/group.stat\x00')
syz_open_dev$binder(&(0x7f0000000880)='/dev/binder#\x00', 0x0, 0x2)
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)})
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, &(0x7f0000000780)})
ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f0000000680)})
creat(&(0x7f00000000c0)='./file0\x00', 0x0)
openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000100)='/group.stat\x00', 0x2761, 0x0)
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000003c0)={0x14, 0x0, &(0x7f0000000680)=[@acquire_done], 0x0, 0x0, 0x0})

[  410.742389] binder: 19314:19326 BC_ACQUIRE_DONE node 740 has no pending acquire request
[  410.909247] binder: 19337 RLIMIT_NICE not set
05:03:01 executing program 2:
r0 = syz_open_dev$sndtimer(&(0x7f0000026000)='/dev/snd/timer\x00', 0x0, 0x0)
r1 = dup3(r0, r0, 0x80000)
ioctl$UI_GET_SYSNAME(r1, 0x8040552c, 0x0)
perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8)
r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c)
bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r2, &(0x7f0000000040), 0x0, 0x1}, 0x20)
openat$cgroup_ro(r1, &(0x7f00000004c0)='cpuset.effective_cpus\x00', 0x0, 0x0)
unlink(&(0x7f0000000900)='./file0/file0\x00')
r3 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r4 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r4, 0x0)
ioctl$BINDER_GET_NODE_DEBUG_INFO(r3, 0xc018620b, &(0x7f0000000780))
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x48, 0x0, &(0x7f0000000700)="2ba063fb309ec7fdbfb08e6e91baee7d7d4599fe14129a4d426834556ae420e087d59c0c7be7fcad1abb7e1f8f446f373f611ca1ee9c2231708e18a47bc68a2a79a0b48931f6ff6d"})
ioctl$sock_inet_tcp_SIOCOUTQNSD(r1, 0x894b, &(0x7f0000000480))
getsockopt$inet_IP_IPSEC_POLICY(0xffffffffffffffff, 0x0, 0x10, &(0x7f0000000540)={{{@in6, @in=@remote}}, {{@in6=@ipv4={[], [], @local}}, 0x0, @in6}}, &(0x7f0000000000)=0xe8)
ioctl$BINDER_SET_CONTEXT_MGR(r4, 0x40046207, 0x0)
r5 = dup(r4)
shutdown(r5, 0x1)
prctl$PR_SET_NAME(0xf, &(0x7f0000000380)='/group.stat\x00')
syz_open_dev$binder(&(0x7f0000000880)='/dev/binder#\x00', 0x0, 0x2)
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)})
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, &(0x7f0000000780)})
ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f0000000680)})
creat(&(0x7f00000000c0)='./file0\x00', 0x0)
openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000100)='/group.stat\x00', 0x2761, 0x0)
clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000080), 0xffffffffffffffff)
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000003c0)={0x14, 0x0, &(0x7f0000000680)=[@acquire_done], 0x0, 0x0, 0x0})

05:03:01 executing program 1:
r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000200)='/dev/nullb0\x00', 0x5000000084002, 0x0)
mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x200000e, 0x13, r0, 0x0)
r1 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x4000, 0x0)
preadv(r1, &(0x7f0000000040)=[{&(0x7f0000000400)=""/4096, 0x3ffc00}], 0x12, 0x0)

05:03:01 executing program 3:
recvmmsg(0xffffffffffffffff, &(0x7f0000003140)=[{{&(0x7f0000001400)=@ipx, 0x80, 0x0}}], 0x1, 0x0, 0x0)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = syz_open_procfs(0x0, &(0x7f00000004c0)='net/rt_cache\x00')
preadv(r0, &(0x7f00000017c0), 0x104, 0x0)

[  410.971394] binder: BINDER_SET_CONTEXT_MGR already set
[  411.052090] binder: 19333:19337 ioctl 40046207 0 returned -16
[  411.195339] binder: BINDER_SET_CONTEXT_MGR already set
[  411.207887] binder: 19347:19353 ioctl 40046207 0 returned -16
05:03:01 executing program 4:
r0 = syz_open_dev$sndtimer(&(0x7f0000026000)='/dev/snd/timer\x00', 0x0, 0x0)
r1 = dup3(r0, r0, 0x80000)
ioctl$UI_GET_SYSNAME(r1, 0x8040552c, 0x0)
perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8)
r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c)
bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r2, &(0x7f0000000040), 0x0, 0x1}, 0x20)
openat$cgroup_ro(r1, &(0x7f00000004c0)='cpuset.effective_cpus\x00', 0x0, 0x0)
unlink(&(0x7f0000000900)='./file0/file0\x00')
r3 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r4 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r4, 0x0)
ioctl$BINDER_GET_NODE_DEBUG_INFO(0xffffffffffffffff, 0xc018620b, &(0x7f0000000780))
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f00000000c0)=[@enter_looper], 0x48, 0x0, &(0x7f0000000700)="2ba063fb309ec7fdbfb08e6e91baee7d7d4599fe14129a4d426834556ae420e087d59c0c7be7fcad1abb7e1f8f446f373f611ca1ee9c2231708e18a47bc68a2a79a0b48931f6ff6d"})
ioctl$sock_inet_tcp_SIOCOUTQNSD(r1, 0x894b, &(0x7f0000000480))
getsockopt$inet_IP_IPSEC_POLICY(0xffffffffffffffff, 0x0, 0x10, &(0x7f0000000540)={{{@in6, @in=@remote}}, {{@in6=@ipv4={[], [], @local}}, 0x0, @in6}}, &(0x7f0000000000)=0xe8)
ioctl$BINDER_SET_CONTEXT_MGR(r4, 0x40046207, 0x0)
r5 = dup(r4)
shutdown(r5, 0x1)
prctl$PR_SET_NAME(0xf, &(0x7f0000000380)='/group.stat\x00')
syz_open_dev$binder(&(0x7f0000000880)='/dev/binder#\x00', 0x0, 0x2)
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)})
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, &(0x7f0000000780)})
ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f0000000680)})
creat(&(0x7f00000000c0)='./file0\x00', 0x0)
clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000080), 0xffffffffffffffff)
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000003c0)={0x14, 0x0, &(0x7f0000000680)=[@acquire_done], 0x0, 0x0, 0x0})

05:03:01 executing program 1:
r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000200)='/dev/nullb0\x00', 0x5000000084002, 0x0)
mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x200000e, 0x13, r0, 0x0)
r1 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x4000, 0x0)
preadv(r1, &(0x7f0000000040)=[{&(0x7f0000000400)=""/4096, 0x3ffc00}], 0x13, 0x0)

05:03:01 executing program 3:
recvmmsg(0xffffffffffffffff, &(0x7f0000003140)=[{{&(0x7f0000001400)=@ipx, 0x80, 0x0}}], 0x1, 0x0, 0x0)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = syz_open_procfs(0x0, &(0x7f00000004c0)='net/rt_cache\x00')
preadv(r0, &(0x7f00000017c0), 0x105, 0x0)

05:03:01 executing program 5:
r0 = syz_open_dev$sndtimer(&(0x7f0000026000)='/dev/snd/timer\x00', 0x0, 0x0)
r1 = dup3(r0, r0, 0x80000)
ioctl$UI_GET_SYSNAME(r1, 0x8040552c, 0x0)
perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8)
r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c)
bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r2, &(0x7f0000000040), 0x0, 0x1}, 0x20)
openat$cgroup_ro(r1, &(0x7f00000004c0)='cpuset.effective_cpus\x00', 0x0, 0x0)
unlink(&(0x7f0000000900)='./file0/file0\x00')
r3 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r4 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r4, 0x0)
ioctl$BINDER_GET_NODE_DEBUG_INFO(0xffffffffffffffff, 0xc018620b, &(0x7f0000000780))
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f00000000c0)=[@enter_looper], 0x48, 0x0, &(0x7f0000000700)="2ba063fb309ec7fdbfb08e6e91baee7d7d4599fe14129a4d426834556ae420e087d59c0c7be7fcad1abb7e1f8f446f373f611ca1ee9c2231708e18a47bc68a2a79a0b48931f6ff6d"})
ioctl$sock_inet_tcp_SIOCOUTQNSD(r1, 0x894b, &(0x7f0000000480))
getsockopt$inet_IP_IPSEC_POLICY(0xffffffffffffffff, 0x0, 0x10, &(0x7f0000000540)={{{@in6, @in=@remote}}, {{@in6=@ipv4={[], [], @local}}, 0x0, @in6}}, &(0x7f0000000000)=0xe8)
ioctl$BINDER_SET_CONTEXT_MGR(r4, 0x40046207, 0x0)
r5 = dup(r4)
shutdown(r5, 0x1)
prctl$PR_SET_NAME(0xf, &(0x7f0000000380)='/group.stat\x00')
syz_open_dev$binder(&(0x7f0000000880)='/dev/binder#\x00', 0x0, 0x2)
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)})
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, &(0x7f0000000780)})
ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f0000000680)})
creat(&(0x7f00000000c0)='./file0\x00', 0x0)
openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000100)='/group.stat\x00', 0x2761, 0x0)
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000003c0)={0x14, 0x0, &(0x7f0000000680)=[@acquire_done], 0x0, 0x0, 0x0})

05:03:01 executing program 0:
recvmmsg(0xffffffffffffffff, &(0x7f0000003140)=[{{&(0x7f0000001400)=@ipx, 0x80, 0x0}}], 0x1, 0x0, 0x0)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = syz_open_procfs(0x0, &(0x7f00000004c0)='net/rt_cache\x00')
preadv(r0, &(0x7f00000017c0), 0x106, 0x0)

[  411.312943] binder: unexpected work type, 4, not freed
[  411.350414] binder: undelivered TRANSACTION_COMPLETE
[  411.414801] binder: 19367 RLIMIT_NICE not set
05:03:01 executing program 0:
recvmmsg(0xffffffffffffffff, &(0x7f0000003140)=[{{&(0x7f0000001400)=@ipx, 0x80, 0x0}}], 0x1, 0x0, 0x0)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = syz_open_procfs(0x0, &(0x7f00000004c0)='net/rt_cache\x00')
preadv(r0, &(0x7f00000017c0), 0x107, 0x0)

[  411.442487] binder: BINDER_SET_CONTEXT_MGR already set
[  411.467889] binder: 19363:19367 ioctl 40046207 0 returned -16
[  411.499254] binder: BINDER_SET_CONTEXT_MGR already set
[  411.524015] binder: 19370:19371 ioctl 40046207 0 returned -16
05:03:01 executing program 3:
recvmmsg(0xffffffffffffffff, &(0x7f0000003140)=[{{&(0x7f0000001400)=@ipx, 0x80, 0x0}}], 0x1, 0x0, 0x0)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = syz_open_procfs(0x0, &(0x7f00000004c0)='net/rt_cache\x00')
preadv(r0, &(0x7f00000017c0), 0x106, 0x0)

05:03:01 executing program 0:
recvmmsg(0xffffffffffffffff, &(0x7f0000003140)=[{{&(0x7f0000001400)=@ipx, 0x80, 0x0}}], 0x1, 0x0, 0x0)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = syz_open_procfs(0x0, &(0x7f00000004c0)='net/rt_cache\x00')
preadv(r0, &(0x7f00000017c0), 0x108, 0x0)

[  411.579525] binder: 19363:19374 BC_INCREFS_DONE node 752 has no pending increfs request
[  411.611396] binder: 19370:19377 BC_ACQUIRE_DONE node 755 has no pending acquire request
[  411.630835] binder: 19363:19374 BC_ACQUIRE_DONE node 752 has no pending acquire request
05:03:02 executing program 0:
recvmmsg(0xffffffffffffffff, &(0x7f0000003140)=[{{&(0x7f0000001400)=@ipx, 0x80, 0x0}}], 0x1, 0x0, 0x0)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = syz_open_procfs(0x0, &(0x7f00000004c0)='net/rt_cache\x00')
preadv(r0, &(0x7f00000017c0), 0x109, 0x0)

05:03:02 executing program 2:
r0 = syz_open_dev$sndtimer(&(0x7f0000026000)='/dev/snd/timer\x00', 0x0, 0x0)
r1 = dup3(r0, r0, 0x80000)
ioctl$UI_GET_SYSNAME(r1, 0x8040552c, 0x0)
perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8)
r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c)
bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r2, &(0x7f0000000040), 0x0, 0x1}, 0x20)
openat$cgroup_ro(r1, &(0x7f00000004c0)='cpuset.effective_cpus\x00', 0x0, 0x0)
unlink(&(0x7f0000000900)='./file0/file0\x00')
r3 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r4 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r4, 0x0)
ioctl$BINDER_GET_NODE_DEBUG_INFO(r3, 0xc018620b, &(0x7f0000000780))
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000000c0), 0x48, 0x0, &(0x7f0000000700)="2ba063fb309ec7fdbfb08e6e91baee7d7d4599fe14129a4d426834556ae420e087d59c0c7be7fcad1abb7e1f8f446f373f611ca1ee9c2231708e18a47bc68a2a79a0b48931f6ff6d"})
ioctl$sock_inet_tcp_SIOCOUTQNSD(r1, 0x894b, &(0x7f0000000480))
getsockopt$inet_IP_IPSEC_POLICY(0xffffffffffffffff, 0x0, 0x10, &(0x7f0000000540)={{{@in6, @in=@remote}}, {{@in6=@ipv4={[], [], @local}}, 0x0, @in6}}, &(0x7f0000000000)=0xe8)
ioctl$BINDER_SET_CONTEXT_MGR(r4, 0x40046207, 0x0)
r5 = dup(r4)
shutdown(r5, 0x1)
prctl$PR_SET_NAME(0xf, &(0x7f0000000380)='/group.stat\x00')
syz_open_dev$binder(&(0x7f0000000880)='/dev/binder#\x00', 0x0, 0x2)
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)})
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, &(0x7f0000000780)})
ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f0000000680)})
creat(&(0x7f00000000c0)='./file0\x00', 0x0)
openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000100)='/group.stat\x00', 0x2761, 0x0)
clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000080), 0xffffffffffffffff)
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000003c0)={0x14, 0x0, &(0x7f0000000680)=[@acquire_done], 0x0, 0x0, 0x0})

05:03:02 executing program 3:
recvmmsg(0xffffffffffffffff, &(0x7f0000003140)=[{{&(0x7f0000001400)=@ipx, 0x80, 0x0}}], 0x1, 0x0, 0x0)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = syz_open_procfs(0x0, &(0x7f00000004c0)='net/rt_cache\x00')
preadv(r0, &(0x7f00000017c0), 0x107, 0x0)

05:03:02 executing program 0:
recvmmsg(0xffffffffffffffff, &(0x7f0000003140)=[{{&(0x7f0000001400)=@ipx, 0x80, 0x0}}], 0x1, 0x0, 0x0)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = syz_open_procfs(0x0, &(0x7f00000004c0)='net/rt_cache\x00')
preadv(r0, &(0x7f00000017c0), 0x10a, 0x0)

[  412.087071] binder: BINDER_SET_CONTEXT_MGR already set
[  412.092470] binder: 19404:19408 ioctl 40046207 0 returned -16
[  412.104696] binder_thread_write: 14 callbacks suppressed
[  412.104710] binder: 19404:19408 Release 1 refcount change on invalid ref 1 ret -22
[  412.148125] binder: unexpected work type, 4, not freed
[  412.153706] binder: undelivered TRANSACTION_COMPLETE
05:03:02 executing program 4:
r0 = syz_open_dev$sndtimer(&(0x7f0000026000)='/dev/snd/timer\x00', 0x0, 0x0)
r1 = dup3(r0, r0, 0x80000)
ioctl$UI_GET_SYSNAME(r1, 0x8040552c, 0x0)
perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8)
r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c)
bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r2, &(0x7f0000000040), 0x0, 0x1}, 0x20)
openat$cgroup_ro(r1, &(0x7f00000004c0)='cpuset.effective_cpus\x00', 0x0, 0x0)
unlink(&(0x7f0000000900)='./file0/file0\x00')
r3 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r4 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r4, 0x0)
ioctl$BINDER_GET_NODE_DEBUG_INFO(0xffffffffffffffff, 0xc018620b, &(0x7f0000000780))
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f00000000c0)=[@enter_looper], 0x48, 0x0, &(0x7f0000000700)="2ba063fb309ec7fdbfb08e6e91baee7d7d4599fe14129a4d426834556ae420e087d59c0c7be7fcad1abb7e1f8f446f373f611ca1ee9c2231708e18a47bc68a2a79a0b48931f6ff6d"})
ioctl$sock_inet_tcp_SIOCOUTQNSD(r1, 0x894b, &(0x7f0000000480))
getsockopt$inet_IP_IPSEC_POLICY(0xffffffffffffffff, 0x0, 0x10, &(0x7f0000000540)={{{@in6, @in=@remote}}, {{@in6=@ipv4={[], [], @local}}, 0x0, @in6}}, &(0x7f0000000000)=0xe8)
ioctl$BINDER_SET_CONTEXT_MGR(r4, 0x40046207, 0x0)
r5 = dup(r4)
shutdown(r5, 0x1)
prctl$PR_SET_NAME(0xf, &(0x7f0000000380)='/group.stat\x00')
syz_open_dev$binder(&(0x7f0000000880)='/dev/binder#\x00', 0x0, 0x2)
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)})
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, &(0x7f0000000780)})
ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f0000000680)})
creat(&(0x7f00000000c0)='./file0\x00', 0x0)
clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000080), 0xffffffffffffffff)
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000003c0)={0x14, 0x0, &(0x7f0000000680)=[@acquire_done], 0x0, 0x0, 0x0})

05:03:02 executing program 1:
r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000200)='/dev/nullb0\x00', 0x5000000084002, 0x0)
mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x200000e, 0x13, r0, 0x0)
r1 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x4000, 0x0)
preadv(r1, &(0x7f0000000040)=[{&(0x7f0000000400)=""/4096, 0x3ffc00}], 0x14, 0x0)

05:03:02 executing program 3:
recvmmsg(0xffffffffffffffff, &(0x7f0000003140)=[{{&(0x7f0000001400)=@ipx, 0x80, 0x0}}], 0x1, 0x0, 0x0)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = syz_open_procfs(0x0, &(0x7f00000004c0)='net/rt_cache\x00')
preadv(r0, &(0x7f00000017c0), 0x108, 0x0)

05:03:02 executing program 0:
recvmmsg(0xffffffffffffffff, &(0x7f0000003140)=[{{&(0x7f0000001400)=@ipx, 0x80, 0x0}}], 0x1, 0x0, 0x0)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = syz_open_procfs(0x0, &(0x7f00000004c0)='net/rt_cache\x00')
preadv(r0, &(0x7f00000017c0), 0x10b, 0x0)

05:03:02 executing program 5:
r0 = syz_open_dev$sndtimer(&(0x7f0000026000)='/dev/snd/timer\x00', 0x0, 0x0)
r1 = dup3(r0, r0, 0x80000)
ioctl$UI_GET_SYSNAME(r1, 0x8040552c, 0x0)
perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8)
r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c)
bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r2, &(0x7f0000000040), 0x0, 0x1}, 0x20)
openat$cgroup_ro(r1, &(0x7f00000004c0)='cpuset.effective_cpus\x00', 0x0, 0x0)
unlink(&(0x7f0000000900)='./file0/file0\x00')
r3 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r4 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r4, 0x0)
ioctl$BINDER_GET_NODE_DEBUG_INFO(0xffffffffffffffff, 0xc018620b, &(0x7f0000000780))
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f00000000c0)=[@enter_looper], 0x48, 0x0, &(0x7f0000000700)="2ba063fb309ec7fdbfb08e6e91baee7d7d4599fe14129a4d426834556ae420e087d59c0c7be7fcad1abb7e1f8f446f373f611ca1ee9c2231708e18a47bc68a2a79a0b48931f6ff6d"})
ioctl$sock_inet_tcp_SIOCOUTQNSD(r1, 0x894b, &(0x7f0000000480))
getsockopt$inet_IP_IPSEC_POLICY(0xffffffffffffffff, 0x0, 0x10, &(0x7f0000000540)={{{@in6, @in=@remote}}, {{@in6=@ipv4={[], [], @local}}, 0x0, @in6}}, &(0x7f0000000000)=0xe8)
ioctl$BINDER_SET_CONTEXT_MGR(r4, 0x40046207, 0x0)
r5 = dup(r4)
shutdown(r5, 0x1)
prctl$PR_SET_NAME(0xf, &(0x7f0000000380)='/group.stat\x00')
syz_open_dev$binder(&(0x7f0000000880)='/dev/binder#\x00', 0x0, 0x2)
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)})
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, &(0x7f0000000780)})
ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f0000000680)})
creat(&(0x7f00000000c0)='./file0\x00', 0x0)
openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000100)='/group.stat\x00', 0x2761, 0x0)
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000003c0)={0x14, 0x0, &(0x7f0000000680)=[@acquire_done], 0x0, 0x0, 0x0})

[  412.199016] binder: unexpected work type, 4, not freed
[  412.204420] binder: undelivered TRANSACTION_COMPLETE
[  412.316173] binder_set_nice: 1 callbacks suppressed
[  412.316198] binder: 19423 RLIMIT_NICE not set
[  412.331905] binder: 19413 RLIMIT_NICE not set
[  412.355618] binder: BINDER_SET_CONTEXT_MGR already set
05:03:02 executing program 3:
recvmmsg(0xffffffffffffffff, &(0x7f0000003140)=[{{&(0x7f0000001400)=@ipx, 0x80, 0x0}}], 0x1, 0x0, 0x0)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = syz_open_procfs(0x0, &(0x7f00000004c0)='net/rt_cache\x00')
preadv(r0, &(0x7f00000017c0), 0x109, 0x0)

[  412.361198] binder: 19411:19413 ioctl 40046207 0 returned -16
[  412.383139] binder: BINDER_SET_CONTEXT_MGR already set
[  412.406499] binder: 19415:19423 ioctl 40046207 0 returned -16
[  412.461221] binder: 19411:19426 Release 1 refcount change on invalid ref 1 ret -22
05:03:02 executing program 0:
recvmmsg(0xffffffffffffffff, &(0x7f0000003140)=[{{&(0x7f0000001400)=@ipx, 0x80, 0x0}}], 0x1, 0x0, 0x0)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = syz_open_procfs(0x0, &(0x7f00000004c0)='net/rt_cache\x00')
preadv(r0, &(0x7f00000017c0), 0x10c, 0x0)

05:03:02 executing program 3:
recvmmsg(0xffffffffffffffff, &(0x7f0000003140)=[{{&(0x7f0000001400)=@ipx, 0x80, 0x0}}], 0x1, 0x0, 0x0)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = syz_open_procfs(0x0, &(0x7f00000004c0)='net/rt_cache\x00')
preadv(r0, &(0x7f00000017c0), 0x10a, 0x0)

[  412.505965] binder: 19411:19426 BC_ACQUIRE_DONE node 761 has no pending acquire request
[  412.526780] binder: 19415:19424 Release 1 refcount change on invalid ref 1 ret -22
05:03:02 executing program 0:
recvmmsg(0xffffffffffffffff, &(0x7f0000003140)=[{{&(0x7f0000001400)=@ipx, 0x80, 0x0}}], 0x1, 0x0, 0x0)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = syz_open_procfs(0x0, &(0x7f00000004c0)='net/rt_cache\x00')
preadv(r0, &(0x7f00000017c0), 0x10d, 0x0)

05:03:03 executing program 2:
r0 = syz_open_dev$sndtimer(&(0x7f0000026000)='/dev/snd/timer\x00', 0x0, 0x0)
r1 = dup3(r0, r0, 0x80000)
ioctl$UI_GET_SYSNAME(r1, 0x8040552c, 0x0)
perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8)
r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c)
bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r2, &(0x7f0000000040), 0x0, 0x1}, 0x20)
openat$cgroup_ro(r1, &(0x7f00000004c0)='cpuset.effective_cpus\x00', 0x0, 0x0)
unlink(&(0x7f0000000900)='./file0/file0\x00')
r3 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r4 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r4, 0x0)
ioctl$BINDER_GET_NODE_DEBUG_INFO(r3, 0xc018620b, &(0x7f0000000780))
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000000c0), 0x48, 0x0, &(0x7f0000000700)="2ba063fb309ec7fdbfb08e6e91baee7d7d4599fe14129a4d426834556ae420e087d59c0c7be7fcad1abb7e1f8f446f373f611ca1ee9c2231708e18a47bc68a2a79a0b48931f6ff6d"})
ioctl$sock_inet_tcp_SIOCOUTQNSD(r1, 0x894b, &(0x7f0000000480))
getsockopt$inet_IP_IPSEC_POLICY(0xffffffffffffffff, 0x0, 0x10, &(0x7f0000000540)={{{@in6, @in=@remote}}, {{@in6=@ipv4={[], [], @local}}, 0x0, @in6}}, &(0x7f0000000000)=0xe8)
ioctl$BINDER_SET_CONTEXT_MGR(r4, 0x40046207, 0x0)
r5 = dup(r4)
shutdown(r5, 0x1)
prctl$PR_SET_NAME(0xf, &(0x7f0000000380)='/group.stat\x00')
syz_open_dev$binder(&(0x7f0000000880)='/dev/binder#\x00', 0x0, 0x2)
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)})
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, &(0x7f0000000780)})
ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f0000000680)})
creat(&(0x7f00000000c0)='./file0\x00', 0x0)
openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000100)='/group.stat\x00', 0x2761, 0x0)
clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000080), 0xffffffffffffffff)
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000003c0)={0x14, 0x0, &(0x7f0000000680)=[@acquire_done], 0x0, 0x0, 0x0})

05:03:03 executing program 3:
recvmmsg(0xffffffffffffffff, &(0x7f0000003140)=[{{&(0x7f0000001400)=@ipx, 0x80, 0x0}}], 0x1, 0x0, 0x0)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = syz_open_procfs(0x0, &(0x7f00000004c0)='net/rt_cache\x00')
preadv(r0, &(0x7f00000017c0), 0x10b, 0x0)

05:03:03 executing program 0:
recvmmsg(0xffffffffffffffff, &(0x7f0000003140)=[{{&(0x7f0000001400)=@ipx, 0x80, 0x0}}], 0x1, 0x0, 0x0)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = syz_open_procfs(0x0, &(0x7f00000004c0)='net/rt_cache\x00')
preadv(r0, &(0x7f00000017c0), 0x10e, 0x0)

[  412.794021] binder_thread_release: 9 callbacks suppressed
[  412.794033] binder: release 19404:19408 transaction 757 out, still active
[  412.958290] binder: BINDER_SET_CONTEXT_MGR already set
[  412.964100] binder: 19453:19458 ioctl 40046207 0 returned -16
[  412.971889] binder: 19453:19458 Release 1 refcount change on invalid ref 1 ret -22
05:03:03 executing program 3:
recvmmsg(0xffffffffffffffff, &(0x7f0000003140)=[{{&(0x7f0000001400)=@ipx, 0x80, 0x0}}], 0x1, 0x0, 0x0)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = syz_open_procfs(0x0, &(0x7f00000004c0)='net/rt_cache\x00')
preadv(r0, &(0x7f00000017c0), 0x10c, 0x0)

05:03:03 executing program 0:
recvmmsg(0xffffffffffffffff, &(0x7f0000003140)=[{{&(0x7f0000001400)=@ipx, 0x80, 0x0}}], 0x1, 0x0, 0x0)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = syz_open_procfs(0x0, &(0x7f00000004c0)='net/rt_cache\x00')
preadv(r0, &(0x7f00000017c0), 0x10f, 0x0)

05:03:03 executing program 1:
r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000200)='/dev/nullb0\x00', 0x5000000084002, 0x0)
mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x200000e, 0x13, r0, 0x0)
r1 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x4000, 0x0)
preadv(r1, &(0x7f0000000040)=[{&(0x7f0000000400)=""/4096, 0x3ffc00}], 0x15, 0x0)

05:03:03 executing program 4:
r0 = syz_open_dev$sndtimer(&(0x7f0000026000)='/dev/snd/timer\x00', 0x0, 0x0)
r1 = dup3(r0, r0, 0x80000)
ioctl$UI_GET_SYSNAME(r1, 0x8040552c, 0x0)
perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8)
r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c)
bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r2, &(0x7f0000000040), 0x0, 0x1}, 0x20)
openat$cgroup_ro(r1, &(0x7f00000004c0)='cpuset.effective_cpus\x00', 0x0, 0x0)
unlink(&(0x7f0000000900)='./file0/file0\x00')
r3 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r4 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r4, 0x0)
ioctl$BINDER_GET_NODE_DEBUG_INFO(0xffffffffffffffff, 0xc018620b, &(0x7f0000000780))
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f00000000c0)=[@enter_looper], 0x48, 0x0, &(0x7f0000000700)="2ba063fb309ec7fdbfb08e6e91baee7d7d4599fe14129a4d426834556ae420e087d59c0c7be7fcad1abb7e1f8f446f373f611ca1ee9c2231708e18a47bc68a2a79a0b48931f6ff6d"})
ioctl$sock_inet_tcp_SIOCOUTQNSD(r1, 0x894b, &(0x7f0000000480))
getsockopt$inet_IP_IPSEC_POLICY(0xffffffffffffffff, 0x0, 0x10, &(0x7f0000000540)={{{@in6, @in=@remote}}, {{@in6=@ipv4={[], [], @local}}, 0x0, @in6}}, &(0x7f0000000000)=0xe8)
ioctl$BINDER_SET_CONTEXT_MGR(r4, 0x40046207, 0x0)
r5 = dup(r4)
shutdown(r5, 0x1)
prctl$PR_SET_NAME(0xf, &(0x7f0000000380)='/group.stat\x00')
syz_open_dev$binder(&(0x7f0000000880)='/dev/binder#\x00', 0x0, 0x2)
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)})
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, &(0x7f0000000780)})
ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f0000000680)})
creat(&(0x7f00000000c0)='./file0\x00', 0x0)
clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000080), 0xffffffffffffffff)
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000003c0)={0x14, 0x0, &(0x7f0000000680)=[@acquire_done], 0x0, 0x0, 0x0})

05:03:03 executing program 5:
r0 = syz_open_dev$sndtimer(&(0x7f0000026000)='/dev/snd/timer\x00', 0x0, 0x0)
r1 = dup3(r0, r0, 0x80000)
ioctl$UI_GET_SYSNAME(r1, 0x8040552c, 0x0)
perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8)
r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c)
bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r2, &(0x7f0000000040), 0x0, 0x1}, 0x20)
openat$cgroup_ro(r1, &(0x7f00000004c0)='cpuset.effective_cpus\x00', 0x0, 0x0)
unlink(&(0x7f0000000900)='./file0/file0\x00')
r3 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r4 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r4, 0x0)
ioctl$BINDER_GET_NODE_DEBUG_INFO(0xffffffffffffffff, 0xc018620b, &(0x7f0000000780))
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f00000000c0)=[@enter_looper], 0x48, 0x0, &(0x7f0000000700)="2ba063fb309ec7fdbfb08e6e91baee7d7d4599fe14129a4d426834556ae420e087d59c0c7be7fcad1abb7e1f8f446f373f611ca1ee9c2231708e18a47bc68a2a79a0b48931f6ff6d"})
ioctl$sock_inet_tcp_SIOCOUTQNSD(r1, 0x894b, &(0x7f0000000480))
getsockopt$inet_IP_IPSEC_POLICY(0xffffffffffffffff, 0x0, 0x10, &(0x7f0000000540)={{{@in6, @in=@remote}}, {{@in6=@ipv4={[], [], @local}}, 0x0, @in6}}, &(0x7f0000000000)=0xe8)
ioctl$BINDER_SET_CONTEXT_MGR(r4, 0x40046207, 0x0)
r5 = dup(r4)
shutdown(r5, 0x1)
prctl$PR_SET_NAME(0xf, &(0x7f0000000380)='/group.stat\x00')
syz_open_dev$binder(&(0x7f0000000880)='/dev/binder#\x00', 0x0, 0x2)
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)})
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, &(0x7f0000000780)})
ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f0000000680)})
creat(&(0x7f00000000c0)='./file0\x00', 0x0)
clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000080), 0xffffffffffffffff)
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000003c0)={0x14, 0x0, &(0x7f0000000680)=[@acquire_done], 0x0, 0x0, 0x0})

[  413.043721] binder: release 19411:19413 transaction 760 out, still active
[  413.050693] binder: unexpected work type, 4, not freed
[  413.060630] binder: undelivered TRANSACTION_COMPLETE
[  413.066641] binder: release 19415:19423 transaction 763 out, still active
[  413.076079] binder: unexpected work type, 4, not freed
[  413.081378] binder: undelivered TRANSACTION_COMPLETE
[  413.210006] binder: 19470 RLIMIT_NICE not set
[  413.223013] binder: 19474 RLIMIT_NICE not set
[  413.235214] binder: BINDER_SET_CONTEXT_MGR already set
[  413.248235] binder: BINDER_SET_CONTEXT_MGR already set
05:03:03 executing program 3:
recvmmsg(0xffffffffffffffff, &(0x7f0000003140)=[{{&(0x7f0000001400)=@ipx, 0x80, 0x0}}], 0x1, 0x0, 0x0)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = syz_open_procfs(0x0, &(0x7f00000004c0)='net/rt_cache\x00')
preadv(r0, &(0x7f00000017c0), 0x10d, 0x0)

[  413.255394] binder: 19473:19474 ioctl 40046207 0 returned -16
[  413.261869] binder: 19462:19470 ioctl 40046207 0 returned -16
[  413.325680] binder_thread_write: 3 callbacks suppressed
[  413.325709] binder: 19473:19477 BC_INCREFS_DONE node 770 has no pending increfs request
[  413.340072] binder: 19462:19478 BC_INCREFS_DONE node 773 has no pending increfs request
[  413.359297] binder: 19462:19478 Release 1 refcount change on invalid ref 1 ret -22
[  413.373357] binder: 19473:19481 Release 1 refcount change on invalid ref 1 ret -22
05:03:03 executing program 3:
recvmmsg(0xffffffffffffffff, &(0x7f0000003140)=[{{&(0x7f0000001400)=@ipx, 0x80, 0x0}}], 0x1, 0x0, 0x0)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = syz_open_procfs(0x0, &(0x7f00000004c0)='net/rt_cache\x00')
preadv(r0, &(0x7f00000017c0), 0x10e, 0x0)

05:03:03 executing program 0:
recvmmsg(0xffffffffffffffff, &(0x7f0000003140)=[{{&(0x7f0000001400)=@ipx, 0x80, 0x0}}], 0x1, 0x0, 0x0)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = syz_open_procfs(0x0, &(0x7f00000004c0)='net/rt_cache\x00')
preadv(r0, &(0x7f00000017c0), 0x110, 0x0)

[  413.406205] binder_thread_write: 1 callbacks suppressed
[  413.406216] binder: 19462:19478 BC_ACQUIRE_DONE node 773 has no pending acquire request
[  413.426877] binder: 19473:19477 BC_ACQUIRE_DONE node 770 has no pending acquire request
05:03:03 executing program 4:
r0 = syz_open_dev$sndtimer(&(0x7f0000026000)='/dev/snd/timer\x00', 0x0, 0x0)
r1 = dup3(r0, r0, 0x80000)
ioctl$UI_GET_SYSNAME(r1, 0x8040552c, 0x0)
perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8)
r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c)
bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r2, &(0x7f0000000040), 0x0, 0x1}, 0x20)
openat$cgroup_ro(r1, &(0x7f00000004c0)='cpuset.effective_cpus\x00', 0x0, 0x0)
unlink(&(0x7f0000000900)='./file0/file0\x00')
r3 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r4 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r4, 0x0)
ioctl$BINDER_GET_NODE_DEBUG_INFO(0xffffffffffffffff, 0xc018620b, &(0x7f0000000780))
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f00000000c0)=[@enter_looper], 0x48, 0x0, &(0x7f0000000700)="2ba063fb309ec7fdbfb08e6e91baee7d7d4599fe14129a4d426834556ae420e087d59c0c7be7fcad1abb7e1f8f446f373f611ca1ee9c2231708e18a47bc68a2a79a0b48931f6ff6d"})
ioctl$sock_inet_tcp_SIOCOUTQNSD(r1, 0x894b, &(0x7f0000000480))
getsockopt$inet_IP_IPSEC_POLICY(0xffffffffffffffff, 0x0, 0x10, &(0x7f0000000540)={{{@in6, @in=@remote}}, {{@in6=@ipv4={[], [], @local}}, 0x0, @in6}}, &(0x7f0000000000)=0xe8)
ioctl$BINDER_SET_CONTEXT_MGR(r4, 0x40046207, 0x0)
r5 = dup(r4)
shutdown(r5, 0x1)
prctl$PR_SET_NAME(0xf, &(0x7f0000000380)='/group.stat\x00')
syz_open_dev$binder(&(0x7f0000000880)='/dev/binder#\x00', 0x0, 0x2)
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)})
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, &(0x7f0000000780)})
ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f0000000680)})
openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000100)='/group.stat\x00', 0x2761, 0x0)
clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000080), 0xffffffffffffffff)
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000003c0)={0x14, 0x0, &(0x7f0000000680)=[@acquire_done], 0x0, 0x0, 0x0})

[  413.619419] binder: 19496 RLIMIT_NICE not set
[  413.638550] binder: BINDER_SET_CONTEXT_MGR already set
[  413.645104] binder: 19495:19496 ioctl 40046207 0 returned -16
05:03:04 executing program 2:
r0 = syz_open_dev$sndtimer(&(0x7f0000026000)='/dev/snd/timer\x00', 0x0, 0x0)
r1 = dup3(r0, r0, 0x80000)
ioctl$UI_GET_SYSNAME(r1, 0x8040552c, 0x0)
perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8)
r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c)
bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r2, &(0x7f0000000040), 0x0, 0x1}, 0x20)
openat$cgroup_ro(r1, &(0x7f00000004c0)='cpuset.effective_cpus\x00', 0x0, 0x0)
unlink(&(0x7f0000000900)='./file0/file0\x00')
r3 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r4 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r4, 0x0)
ioctl$BINDER_GET_NODE_DEBUG_INFO(r3, 0xc018620b, &(0x7f0000000780))
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000000c0), 0x48, 0x0, &(0x7f0000000700)="2ba063fb309ec7fdbfb08e6e91baee7d7d4599fe14129a4d426834556ae420e087d59c0c7be7fcad1abb7e1f8f446f373f611ca1ee9c2231708e18a47bc68a2a79a0b48931f6ff6d"})
ioctl$sock_inet_tcp_SIOCOUTQNSD(r1, 0x894b, &(0x7f0000000480))
getsockopt$inet_IP_IPSEC_POLICY(0xffffffffffffffff, 0x0, 0x10, &(0x7f0000000540)={{{@in6, @in=@remote}}, {{@in6=@ipv4={[], [], @local}}, 0x0, @in6}}, &(0x7f0000000000)=0xe8)
ioctl$BINDER_SET_CONTEXT_MGR(r4, 0x40046207, 0x0)
r5 = dup(r4)
shutdown(r5, 0x1)
prctl$PR_SET_NAME(0xf, &(0x7f0000000380)='/group.stat\x00')
syz_open_dev$binder(&(0x7f0000000880)='/dev/binder#\x00', 0x0, 0x2)
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)})
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, &(0x7f0000000780)})
ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f0000000680)})
creat(&(0x7f00000000c0)='./file0\x00', 0x0)
openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000100)='/group.stat\x00', 0x2761, 0x0)
clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000080), 0xffffffffffffffff)
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000003c0)={0x14, 0x0, &(0x7f0000000680)=[@acquire_done], 0x0, 0x0, 0x0})

05:03:04 executing program 5:
r0 = syz_open_dev$sndtimer(&(0x7f0000026000)='/dev/snd/timer\x00', 0x0, 0x0)
r1 = dup3(r0, r0, 0x80000)
ioctl$UI_GET_SYSNAME(r1, 0x8040552c, 0x0)
perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8)
r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c)
bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r2, &(0x7f0000000040), 0x0, 0x1}, 0x20)
openat$cgroup_ro(r1, &(0x7f00000004c0)='cpuset.effective_cpus\x00', 0x0, 0x0)
unlink(&(0x7f0000000900)='./file0/file0\x00')
r3 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r4 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r4, 0x0)
ioctl$BINDER_GET_NODE_DEBUG_INFO(0xffffffffffffffff, 0xc018620b, &(0x7f0000000780))
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f00000000c0)=[@enter_looper], 0x48, 0x0, &(0x7f0000000700)="2ba063fb309ec7fdbfb08e6e91baee7d7d4599fe14129a4d426834556ae420e087d59c0c7be7fcad1abb7e1f8f446f373f611ca1ee9c2231708e18a47bc68a2a79a0b48931f6ff6d"})
ioctl$sock_inet_tcp_SIOCOUTQNSD(r1, 0x894b, &(0x7f0000000480))
getsockopt$inet_IP_IPSEC_POLICY(0xffffffffffffffff, 0x0, 0x10, &(0x7f0000000540)={{{@in6, @in=@remote}}, {{@in6=@ipv4={[], [], @local}}, 0x0, @in6}}, &(0x7f0000000000)=0xe8)
ioctl$BINDER_SET_CONTEXT_MGR(r4, 0x40046207, 0x0)
r5 = dup(r4)
shutdown(r5, 0x1)
prctl$PR_SET_NAME(0xf, &(0x7f0000000380)='/group.stat\x00')
syz_open_dev$binder(&(0x7f0000000880)='/dev/binder#\x00', 0x0, 0x2)
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)})
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, &(0x7f0000000780)})
ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f0000000680)})
creat(&(0x7f00000000c0)='./file0\x00', 0x0)
clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000080), 0xffffffffffffffff)
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000003c0)={0x14, 0x0, &(0x7f0000000680)=[@acquire_done], 0x0, 0x0, 0x0})

[  413.664157] binder: release 19453:19458 transaction 766 out, still active
05:03:04 executing program 3:
recvmmsg(0xffffffffffffffff, &(0x7f0000003140)=[{{&(0x7f0000001400)=@ipx, 0x80, 0x0}}], 0x1, 0x0, 0x0)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = syz_open_procfs(0x0, &(0x7f00000004c0)='net/rt_cache\x00')
preadv(r0, &(0x7f00000017c0), 0x10f, 0x0)

05:03:04 executing program 0:
recvmmsg(0xffffffffffffffff, &(0x7f0000003140)=[{{&(0x7f0000001400)=@ipx, 0x80, 0x0}}], 0x1, 0x0, 0x0)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = syz_open_procfs(0x0, &(0x7f00000004c0)='net/rt_cache\x00')
preadv(r0, &(0x7f00000017c0), 0x111, 0x0)

[  413.722666] binder: 19495:19503 BC_INCREFS_DONE node 776 has no pending increfs request
05:03:04 executing program 3:
recvmmsg(0xffffffffffffffff, &(0x7f0000003140)=[{{&(0x7f0000001400)=@ipx, 0x80, 0x0}}], 0x1, 0x0, 0x0)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = syz_open_procfs(0x0, &(0x7f00000004c0)='net/rt_cache\x00')
preadv(r0, &(0x7f00000017c0), 0x110, 0x0)

[  413.807834] binder: 19495:19530 Release 1 refcount change on invalid ref 1 ret -22
[  413.813848] binder: 19495:19503 BC_ACQUIRE_DONE node 776 has no pending acquire request
[  413.854516] binder: BINDER_SET_CONTEXT_MGR already set
[  413.876557] binder: 19534:19615 ioctl 40046207 0 returned -16
[  413.900969] binder: 19534:19620 Release 1 refcount change on invalid ref 1 ret -22
05:03:04 executing program 5:
r0 = syz_open_dev$sndtimer(&(0x7f0000026000)='/dev/snd/timer\x00', 0x0, 0x0)
r1 = dup3(r0, r0, 0x80000)
ioctl$UI_GET_SYSNAME(r1, 0x8040552c, 0x0)
perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8)
r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c)
bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r2, &(0x7f0000000040), 0x0, 0x1}, 0x20)
openat$cgroup_ro(r1, &(0x7f00000004c0)='cpuset.effective_cpus\x00', 0x0, 0x0)
unlink(&(0x7f0000000900)='./file0/file0\x00')
r3 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r4 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r4, 0x0)
ioctl$BINDER_GET_NODE_DEBUG_INFO(0xffffffffffffffff, 0xc018620b, &(0x7f0000000780))
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f00000000c0)=[@enter_looper], 0x48, 0x0, &(0x7f0000000700)="2ba063fb309ec7fdbfb08e6e91baee7d7d4599fe14129a4d426834556ae420e087d59c0c7be7fcad1abb7e1f8f446f373f611ca1ee9c2231708e18a47bc68a2a79a0b48931f6ff6d"})
ioctl$sock_inet_tcp_SIOCOUTQNSD(r1, 0x894b, &(0x7f0000000480))
getsockopt$inet_IP_IPSEC_POLICY(0xffffffffffffffff, 0x0, 0x10, &(0x7f0000000540)={{{@in6, @in=@remote}}, {{@in6=@ipv4={[], [], @local}}, 0x0, @in6}}, &(0x7f0000000000)=0xe8)
ioctl$BINDER_SET_CONTEXT_MGR(r4, 0x40046207, 0x0)
r5 = dup(r4)
shutdown(r5, 0x1)
prctl$PR_SET_NAME(0xf, &(0x7f0000000380)='/group.stat\x00')
syz_open_dev$binder(&(0x7f0000000880)='/dev/binder#\x00', 0x0, 0x2)
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)})
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, &(0x7f0000000780)})
ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f0000000680)})
creat(&(0x7f00000000c0)='./file0\x00', 0x0)
clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000080), 0xffffffffffffffff)
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000003c0)={0x14, 0x0, &(0x7f0000000680)=[@acquire_done], 0x0, 0x0, 0x0})

05:03:04 executing program 0:
recvmmsg(0xffffffffffffffff, &(0x7f0000003140)=[{{&(0x7f0000001400)=@ipx, 0x80, 0x0}}], 0x1, 0x0, 0x0)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = syz_open_procfs(0x0, &(0x7f00000004c0)='net/rt_cache\x00')
preadv(r0, &(0x7f00000017c0), 0x112, 0x0)

05:03:04 executing program 1:
r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000200)='/dev/nullb0\x00', 0x5000000084002, 0x0)
mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x200000e, 0x13, r0, 0x0)
r1 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x4000, 0x0)
preadv(r1, &(0x7f0000000040)=[{&(0x7f0000000400)=""/4096, 0x3ffc00}], 0x16, 0x0)

05:03:04 executing program 3:
recvmmsg(0xffffffffffffffff, &(0x7f0000003140)=[{{&(0x7f0000001400)=@ipx, 0x80, 0x0}}], 0x1, 0x0, 0x0)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = syz_open_procfs(0x0, &(0x7f00000004c0)='net/rt_cache\x00')
preadv(r0, &(0x7f00000017c0), 0x111, 0x0)

05:03:04 executing program 4:
r0 = syz_open_dev$sndtimer(&(0x7f0000026000)='/dev/snd/timer\x00', 0x0, 0x0)
r1 = dup3(r0, r0, 0x80000)
ioctl$UI_GET_SYSNAME(r1, 0x8040552c, 0x0)
perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8)
r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c)
bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r2, &(0x7f0000000040), 0x0, 0x1}, 0x20)
openat$cgroup_ro(r1, &(0x7f00000004c0)='cpuset.effective_cpus\x00', 0x0, 0x0)
unlink(&(0x7f0000000900)='./file0/file0\x00')
r3 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r4 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r4, 0x0)
ioctl$BINDER_GET_NODE_DEBUG_INFO(0xffffffffffffffff, 0xc018620b, &(0x7f0000000780))
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f00000000c0)=[@enter_looper], 0x48, 0x0, &(0x7f0000000700)="2ba063fb309ec7fdbfb08e6e91baee7d7d4599fe14129a4d426834556ae420e087d59c0c7be7fcad1abb7e1f8f446f373f611ca1ee9c2231708e18a47bc68a2a79a0b48931f6ff6d"})
ioctl$sock_inet_tcp_SIOCOUTQNSD(r1, 0x894b, &(0x7f0000000480))
getsockopt$inet_IP_IPSEC_POLICY(0xffffffffffffffff, 0x0, 0x10, &(0x7f0000000540)={{{@in6, @in=@remote}}, {{@in6=@ipv4={[], [], @local}}, 0x0, @in6}}, &(0x7f0000000000)=0xe8)
ioctl$BINDER_SET_CONTEXT_MGR(r4, 0x40046207, 0x0)
r5 = dup(r4)
shutdown(r5, 0x1)
prctl$PR_SET_NAME(0xf, &(0x7f0000000380)='/group.stat\x00')
syz_open_dev$binder(&(0x7f0000000880)='/dev/binder#\x00', 0x0, 0x2)
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)})
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, &(0x7f0000000780)})
ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f0000000680)})
openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000100)='/group.stat\x00', 0x2761, 0x0)
clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000080), 0xffffffffffffffff)
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000003c0)={0x14, 0x0, &(0x7f0000000680)=[@acquire_done], 0x0, 0x0, 0x0})

[  414.071127] binder: 19639 RLIMIT_NICE not set
05:03:04 executing program 0:
recvmmsg(0xffffffffffffffff, &(0x7f0000003140)=[{{&(0x7f0000001400)=@ipx, 0x80, 0x0}}], 0x1, 0x0, 0x0)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = syz_open_procfs(0x0, &(0x7f00000004c0)='net/rt_cache\x00')
preadv(r0, &(0x7f00000017c0), 0x113, 0x0)

[  414.094229] binder: BINDER_SET_CONTEXT_MGR already set
05:03:04 executing program 3:
recvmmsg(0xffffffffffffffff, &(0x7f0000003140)=[{{&(0x7f0000001400)=@ipx, 0x80, 0x0}}], 0x1, 0x0, 0x0)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = syz_open_procfs(0x0, &(0x7f00000004c0)='net/rt_cache\x00')
preadv(r0, &(0x7f00000017c0), 0x112, 0x0)

[  414.122052] binder: 19628:19639 ioctl 40046207 0 returned -16
[  414.213845] binder: 19628:19737 BC_INCREFS_DONE node 782 has no pending increfs request
[  414.239213] binder: 19628:19737 Release 1 refcount change on invalid ref 1 ret -22
[  414.274955] binder: 19628:19737 BC_ACQUIRE_DONE node 782 has no pending acquire request
05:03:04 executing program 2:
r0 = syz_open_dev$sndtimer(&(0x7f0000026000)='/dev/snd/timer\x00', 0x0, 0x0)
r1 = dup3(r0, r0, 0x80000)
ioctl$UI_GET_SYSNAME(r1, 0x8040552c, 0x0)
perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8)
r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c)
bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r2, &(0x7f0000000040), 0x0, 0x1}, 0x20)
openat$cgroup_ro(r1, &(0x7f00000004c0)='cpuset.effective_cpus\x00', 0x0, 0x0)
unlink(&(0x7f0000000900)='./file0/file0\x00')
r3 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r4 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r4, 0x0)
ioctl$BINDER_GET_NODE_DEBUG_INFO(r3, 0xc018620b, &(0x7f0000000780))
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f00000000c0)=[@enter_looper], 0x0, 0x0, 0x0})
ioctl$sock_inet_tcp_SIOCOUTQNSD(r1, 0x894b, &(0x7f0000000480))
getsockopt$inet_IP_IPSEC_POLICY(0xffffffffffffffff, 0x0, 0x10, &(0x7f0000000540)={{{@in6, @in=@remote}}, {{@in6=@ipv4={[], [], @local}}, 0x0, @in6}}, &(0x7f0000000000)=0xe8)
ioctl$BINDER_SET_CONTEXT_MGR(r4, 0x40046207, 0x0)
r5 = dup(r4)
shutdown(r5, 0x1)
prctl$PR_SET_NAME(0xf, &(0x7f0000000380)='/group.stat\x00')
syz_open_dev$binder(&(0x7f0000000880)='/dev/binder#\x00', 0x0, 0x2)
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)})
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, &(0x7f0000000780)})
ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f0000000680)})
creat(&(0x7f00000000c0)='./file0\x00', 0x0)
openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000100)='/group.stat\x00', 0x2761, 0x0)
clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000080), 0xffffffffffffffff)
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000003c0)={0x14, 0x0, &(0x7f0000000680)=[@acquire_done], 0x0, 0x0, 0x0})

05:03:04 executing program 5:
r0 = syz_open_dev$sndtimer(&(0x7f0000026000)='/dev/snd/timer\x00', 0x0, 0x0)
r1 = dup3(r0, r0, 0x80000)
ioctl$UI_GET_SYSNAME(r1, 0x8040552c, 0x0)
perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8)
r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c)
bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r2, &(0x7f0000000040), 0x0, 0x1}, 0x20)
openat$cgroup_ro(r1, &(0x7f00000004c0)='cpuset.effective_cpus\x00', 0x0, 0x0)
unlink(&(0x7f0000000900)='./file0/file0\x00')
r3 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r4 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r4, 0x0)
ioctl$BINDER_GET_NODE_DEBUG_INFO(0xffffffffffffffff, 0xc018620b, &(0x7f0000000780))
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f00000000c0)=[@enter_looper], 0x48, 0x0, &(0x7f0000000700)="2ba063fb309ec7fdbfb08e6e91baee7d7d4599fe14129a4d426834556ae420e087d59c0c7be7fcad1abb7e1f8f446f373f611ca1ee9c2231708e18a47bc68a2a79a0b48931f6ff6d"})
ioctl$sock_inet_tcp_SIOCOUTQNSD(r1, 0x894b, &(0x7f0000000480))
getsockopt$inet_IP_IPSEC_POLICY(0xffffffffffffffff, 0x0, 0x10, &(0x7f0000000540)={{{@in6, @in=@remote}}, {{@in6=@ipv4={[], [], @local}}, 0x0, @in6}}, &(0x7f0000000000)=0xe8)
ioctl$BINDER_SET_CONTEXT_MGR(r4, 0x40046207, 0x0)
r5 = dup(r4)
shutdown(r5, 0x1)
prctl$PR_SET_NAME(0xf, &(0x7f0000000380)='/group.stat\x00')
syz_open_dev$binder(&(0x7f0000000880)='/dev/binder#\x00', 0x0, 0x2)
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)})
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, &(0x7f0000000780)})
ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f0000000680)})
creat(&(0x7f00000000c0)='./file0\x00', 0x0)
clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000080), 0xffffffffffffffff)
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000003c0)={0x14, 0x0, &(0x7f0000000680)=[@acquire_done], 0x0, 0x0, 0x0})

05:03:04 executing program 3:
recvmmsg(0xffffffffffffffff, &(0x7f0000003140)=[{{&(0x7f0000001400)=@ipx, 0x80, 0x0}}], 0x1, 0x0, 0x0)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = syz_open_procfs(0x0, &(0x7f00000004c0)='net/rt_cache\x00')
preadv(r0, &(0x7f00000017c0), 0x113, 0x0)

05:03:04 executing program 0:
recvmmsg(0xffffffffffffffff, &(0x7f0000003140)=[{{&(0x7f0000001400)=@ipx, 0x80, 0x0}}], 0x1, 0x0, 0x0)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = syz_open_procfs(0x0, &(0x7f00000004c0)='net/rt_cache\x00')
preadv(r0, &(0x7f00000017c0), 0x114, 0x0)

05:03:04 executing program 1:
r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000200)='/dev/nullb0\x00', 0x5000000084002, 0x0)
mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x200000e, 0x13, r0, 0x0)
r1 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x4000, 0x0)
preadv(r1, &(0x7f0000000040)=[{&(0x7f0000000400)=""/4096, 0x3ffc00}], 0x17, 0x0)

[  414.572224] binder: release 19534:19620 transaction 778 out, still active
05:03:05 executing program 3:
recvmmsg(0xffffffffffffffff, &(0x7f0000003140)=[{{&(0x7f0000001400)=@ipx, 0x80, 0x0}}], 0x1, 0x0, 0x0)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = syz_open_procfs(0x0, &(0x7f00000004c0)='net/rt_cache\x00')
preadv(r0, &(0x7f00000017c0), 0x114, 0x0)

[  414.748782] binder: BINDER_SET_CONTEXT_MGR already set
05:03:05 executing program 5:
r0 = syz_open_dev$sndtimer(&(0x7f0000026000)='/dev/snd/timer\x00', 0x0, 0x0)
r1 = dup3(r0, r0, 0x80000)
ioctl$UI_GET_SYSNAME(r1, 0x8040552c, 0x0)
perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8)
r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c)
bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r2, &(0x7f0000000040), 0x0, 0x1}, 0x20)
openat$cgroup_ro(r1, &(0x7f00000004c0)='cpuset.effective_cpus\x00', 0x0, 0x0)
unlink(&(0x7f0000000900)='./file0/file0\x00')
r3 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r4 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r4, 0x0)
ioctl$BINDER_GET_NODE_DEBUG_INFO(0xffffffffffffffff, 0xc018620b, &(0x7f0000000780))
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f00000000c0)=[@enter_looper], 0x48, 0x0, &(0x7f0000000700)="2ba063fb309ec7fdbfb08e6e91baee7d7d4599fe14129a4d426834556ae420e087d59c0c7be7fcad1abb7e1f8f446f373f611ca1ee9c2231708e18a47bc68a2a79a0b48931f6ff6d"})
ioctl$sock_inet_tcp_SIOCOUTQNSD(r1, 0x894b, &(0x7f0000000480))
getsockopt$inet_IP_IPSEC_POLICY(0xffffffffffffffff, 0x0, 0x10, &(0x7f0000000540)={{{@in6, @in=@remote}}, {{@in6=@ipv4={[], [], @local}}, 0x0, @in6}}, &(0x7f0000000000)=0xe8)
ioctl$BINDER_SET_CONTEXT_MGR(r4, 0x40046207, 0x0)
r5 = dup(r4)
shutdown(r5, 0x1)
prctl$PR_SET_NAME(0xf, &(0x7f0000000380)='/group.stat\x00')
syz_open_dev$binder(&(0x7f0000000880)='/dev/binder#\x00', 0x0, 0x2)
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)})
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, &(0x7f0000000780)})
ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f0000000680)})
creat(&(0x7f00000000c0)='./file0\x00', 0x0)
clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000080), 0xffffffffffffffff)
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000003c0)={0x14, 0x0, &(0x7f0000000680)=[@acquire_done], 0x0, 0x0, 0x0})

[  414.794015] binder: 19768:19781 ioctl 40046207 0 returned -16
[  414.834093] binder: release 19628:19639 transaction 781 out, still active
[  414.857088] binder: 19768:19781 BC_INCREFS_DONE node 785 has no pending increfs request
05:03:05 executing program 4:
r0 = syz_open_dev$sndtimer(&(0x7f0000026000)='/dev/snd/timer\x00', 0x0, 0x0)
r1 = dup3(r0, r0, 0x80000)
ioctl$UI_GET_SYSNAME(r1, 0x8040552c, 0x0)
perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8)
r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c)
bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r2, &(0x7f0000000040), 0x0, 0x1}, 0x20)
openat$cgroup_ro(r1, &(0x7f00000004c0)='cpuset.effective_cpus\x00', 0x0, 0x0)
unlink(&(0x7f0000000900)='./file0/file0\x00')
r3 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r4 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r4, 0x0)
ioctl$BINDER_GET_NODE_DEBUG_INFO(0xffffffffffffffff, 0xc018620b, &(0x7f0000000780))
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f00000000c0)=[@enter_looper], 0x48, 0x0, &(0x7f0000000700)="2ba063fb309ec7fdbfb08e6e91baee7d7d4599fe14129a4d426834556ae420e087d59c0c7be7fcad1abb7e1f8f446f373f611ca1ee9c2231708e18a47bc68a2a79a0b48931f6ff6d"})
ioctl$sock_inet_tcp_SIOCOUTQNSD(r1, 0x894b, &(0x7f0000000480))
getsockopt$inet_IP_IPSEC_POLICY(0xffffffffffffffff, 0x0, 0x10, &(0x7f0000000540)={{{@in6, @in=@remote}}, {{@in6=@ipv4={[], [], @local}}, 0x0, @in6}}, &(0x7f0000000000)=0xe8)
ioctl$BINDER_SET_CONTEXT_MGR(r4, 0x40046207, 0x0)
r5 = dup(r4)
shutdown(r5, 0x1)
prctl$PR_SET_NAME(0xf, &(0x7f0000000380)='/group.stat\x00')
syz_open_dev$binder(&(0x7f0000000880)='/dev/binder#\x00', 0x0, 0x2)
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)})
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, &(0x7f0000000780)})
ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f0000000680)})
openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000100)='/group.stat\x00', 0x2761, 0x0)
clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000080), 0xffffffffffffffff)
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000003c0)={0x14, 0x0, &(0x7f0000000680)=[@acquire_done], 0x0, 0x0, 0x0})

05:03:05 executing program 3:
recvmmsg(0xffffffffffffffff, &(0x7f0000003140)=[{{&(0x7f0000001400)=@ipx, 0x80, 0x0}}], 0x1, 0x0, 0x0)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = syz_open_procfs(0x0, &(0x7f00000004c0)='net/rt_cache\x00')
preadv(r0, &(0x7f00000017c0), 0x115, 0x0)

[  414.902985] binder: 19768:19873 Release 1 refcount change on invalid ref 1 ret -22
05:03:05 executing program 0:
recvmmsg(0xffffffffffffffff, &(0x7f0000003140)=[{{&(0x7f0000001400)=@ipx, 0x80, 0x0}}], 0x1, 0x0, 0x0)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = syz_open_procfs(0x0, &(0x7f00000004c0)='net/rt_cache\x00')
preadv(r0, &(0x7f00000017c0), 0x115, 0x0)

05:03:05 executing program 2:
r0 = syz_open_dev$sndtimer(&(0x7f0000026000)='/dev/snd/timer\x00', 0x0, 0x0)
r1 = dup3(r0, r0, 0x80000)
ioctl$UI_GET_SYSNAME(r1, 0x8040552c, 0x0)
perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8)
r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c)
bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r2, &(0x7f0000000040), 0x0, 0x1}, 0x20)
openat$cgroup_ro(r1, &(0x7f00000004c0)='cpuset.effective_cpus\x00', 0x0, 0x0)
unlink(&(0x7f0000000900)='./file0/file0\x00')
r3 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r4 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r4, 0x0)
ioctl$BINDER_GET_NODE_DEBUG_INFO(r3, 0xc018620b, &(0x7f0000000780))
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f00000000c0)=[@enter_looper], 0x0, 0x0, 0x0})
ioctl$sock_inet_tcp_SIOCOUTQNSD(r1, 0x894b, &(0x7f0000000480))
getsockopt$inet_IP_IPSEC_POLICY(0xffffffffffffffff, 0x0, 0x10, &(0x7f0000000540)={{{@in6, @in=@remote}}, {{@in6=@ipv4={[], [], @local}}, 0x0, @in6}}, &(0x7f0000000000)=0xe8)
ioctl$BINDER_SET_CONTEXT_MGR(r4, 0x40046207, 0x0)
r5 = dup(r4)
shutdown(r5, 0x1)
prctl$PR_SET_NAME(0xf, &(0x7f0000000380)='/group.stat\x00')
syz_open_dev$binder(&(0x7f0000000880)='/dev/binder#\x00', 0x0, 0x2)
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)})
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, &(0x7f0000000780)})
ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f0000000680)})
creat(&(0x7f00000000c0)='./file0\x00', 0x0)
openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000100)='/group.stat\x00', 0x2761, 0x0)
clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000080), 0xffffffffffffffff)
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000003c0)={0x14, 0x0, &(0x7f0000000680)=[@acquire_done], 0x0, 0x0, 0x0})

[  414.956242] binder: 19768:19781 BC_ACQUIRE_DONE node 785 has no pending acquire request
05:03:05 executing program 0:
recvmmsg(0xffffffffffffffff, &(0x7f0000003140)=[{{&(0x7f0000001400)=@ipx, 0x80, 0x0}}], 0x1, 0x0, 0x0)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = syz_open_procfs(0x0, &(0x7f00000004c0)='net/rt_cache\x00')
preadv(r0, &(0x7f00000017c0), 0x116, 0x0)

[  415.050269] binder: 19882 RLIMIT_NICE not set
05:03:05 executing program 3:
recvmmsg(0xffffffffffffffff, &(0x7f0000003140)=[{{&(0x7f0000001400)=@ipx, 0x80, 0x0}}], 0x1, 0x0, 0x0)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = syz_open_procfs(0x0, &(0x7f00000004c0)='net/rt_cache\x00')
preadv(r0, &(0x7f00000017c0), 0x116, 0x0)

[  415.106081] binder: BINDER_SET_CONTEXT_MGR already set
[  415.131992] binder: BINDER_SET_CONTEXT_MGR already set
[  415.137860] binder: 19887:19888 ioctl 40046207 0 returned -16
[  415.154630] binder: 19881:19882 ioctl 40046207 0 returned -16
05:03:05 executing program 0:
recvmmsg(0xffffffffffffffff, &(0x7f0000003140)=[{{&(0x7f0000001400)=@ipx, 0x80, 0x0}}], 0x1, 0x0, 0x0)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = syz_open_procfs(0x0, &(0x7f00000004c0)='net/rt_cache\x00')
preadv(r0, &(0x7f00000017c0), 0x117, 0x0)

[  415.189145] binder: release 19881:19889 transaction 787 out, still active
[  415.228603] binder: 19887:19897 BC_INCREFS_DONE node 791 has no pending increfs request
05:03:05 executing program 3:
recvmmsg(0xffffffffffffffff, &(0x7f0000003140)=[{{&(0x7f0000001400)=@ipx, 0x80, 0x0}}], 0x1, 0x0, 0x0)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = syz_open_procfs(0x0, &(0x7f00000004c0)='net/rt_cache\x00')
preadv(r0, &(0x7f00000017c0), 0x117, 0x0)

05:03:05 executing program 4:
r0 = syz_open_dev$sndtimer(&(0x7f0000026000)='/dev/snd/timer\x00', 0x0, 0x0)
r1 = dup3(r0, r0, 0x80000)
ioctl$UI_GET_SYSNAME(r1, 0x8040552c, 0x0)
perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8)
r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c)
bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r2, &(0x7f0000000040), 0x0, 0x1}, 0x20)
openat$cgroup_ro(r1, &(0x7f00000004c0)='cpuset.effective_cpus\x00', 0x0, 0x0)
unlink(&(0x7f0000000900)='./file0/file0\x00')
r3 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r4 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r4, 0x0)
ioctl$BINDER_GET_NODE_DEBUG_INFO(0xffffffffffffffff, 0xc018620b, &(0x7f0000000780))
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f00000000c0)=[@enter_looper], 0x48, 0x0, &(0x7f0000000700)="2ba063fb309ec7fdbfb08e6e91baee7d7d4599fe14129a4d426834556ae420e087d59c0c7be7fcad1abb7e1f8f446f373f611ca1ee9c2231708e18a47bc68a2a79a0b48931f6ff6d"})
ioctl$sock_inet_tcp_SIOCOUTQNSD(r1, 0x894b, &(0x7f0000000480))
getsockopt$inet_IP_IPSEC_POLICY(0xffffffffffffffff, 0x0, 0x10, &(0x7f0000000540)={{{@in6, @in=@remote}}, {{@in6=@ipv4={[], [], @local}}, 0x0, @in6}}, &(0x7f0000000000)=0xe8)
ioctl$BINDER_SET_CONTEXT_MGR(r4, 0x40046207, 0x0)
r5 = dup(r4)
shutdown(r5, 0x1)
prctl$PR_SET_NAME(0xf, &(0x7f0000000380)='/group.stat\x00')
syz_open_dev$binder(&(0x7f0000000880)='/dev/binder#\x00', 0x0, 0x2)
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)})
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, &(0x7f0000000780)})
creat(&(0x7f00000000c0)='./file0\x00', 0x0)
openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000100)='/group.stat\x00', 0x2761, 0x0)
clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000080), 0xffffffffffffffff)
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000003c0)={0x14, 0x0, &(0x7f0000000680)=[@acquire_done], 0x0, 0x0, 0x0})

[  415.281539] binder: 19887:19897 BC_ACQUIRE_DONE node 791 has no pending acquire request
[  415.379574] cgroup: fork rejected by pids controller in /syz4
05:03:05 executing program 1:
r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000200)='/dev/nullb0\x00', 0x5000000084002, 0x0)
mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x200000e, 0x13, r0, 0x0)
r1 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x4000, 0x0)
preadv(r1, &(0x7f0000000040)=[{&(0x7f0000000400)=""/4096, 0x3ffc00}], 0x18, 0x0)

05:03:05 executing program 2:
r0 = syz_open_dev$sndtimer(&(0x7f0000026000)='/dev/snd/timer\x00', 0x0, 0x0)
r1 = dup3(r0, r0, 0x80000)
ioctl$UI_GET_SYSNAME(r1, 0x8040552c, 0x0)
perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8)
r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c)
bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r2, &(0x7f0000000040), 0x0, 0x1}, 0x20)
openat$cgroup_ro(r1, &(0x7f00000004c0)='cpuset.effective_cpus\x00', 0x0, 0x0)
unlink(&(0x7f0000000900)='./file0/file0\x00')
r3 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r4 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r4, 0x0)
ioctl$BINDER_GET_NODE_DEBUG_INFO(r3, 0xc018620b, &(0x7f0000000780))
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f00000000c0)=[@enter_looper], 0x0, 0x0, 0x0})
ioctl$sock_inet_tcp_SIOCOUTQNSD(r1, 0x894b, &(0x7f0000000480))
getsockopt$inet_IP_IPSEC_POLICY(0xffffffffffffffff, 0x0, 0x10, &(0x7f0000000540)={{{@in6, @in=@remote}}, {{@in6=@ipv4={[], [], @local}}, 0x0, @in6}}, &(0x7f0000000000)=0xe8)
ioctl$BINDER_SET_CONTEXT_MGR(r4, 0x40046207, 0x0)
r5 = dup(r4)
shutdown(r5, 0x1)
prctl$PR_SET_NAME(0xf, &(0x7f0000000380)='/group.stat\x00')
syz_open_dev$binder(&(0x7f0000000880)='/dev/binder#\x00', 0x0, 0x2)
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)})
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, &(0x7f0000000780)})
ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f0000000680)})
creat(&(0x7f00000000c0)='./file0\x00', 0x0)
openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000100)='/group.stat\x00', 0x2761, 0x0)
clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000080), 0xffffffffffffffff)
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000003c0)={0x14, 0x0, &(0x7f0000000680)=[@acquire_done], 0x0, 0x0, 0x0})

[  415.551861] binder: 19980 RLIMIT_NICE not set
[  415.559561] binder: BINDER_SET_CONTEXT_MGR already set
[  415.605039] binder: 19912:19980 ioctl 40046207 0 returned -16
[  415.625156] binder: BINDER_SET_CONTEXT_MGR already set
[  415.642799] binder: 19982:19984 ioctl 40046207 0 returned -16
[  415.662544] binder: 19912:19985 BC_INCREFS_DONE node 794 has no pending increfs request
[  415.678361] binder: 19912:19985 BC_ACQUIRE_DONE node 794 has no pending acquire request
[  415.704291] binder: 19982:19989 BC_INCREFS_DONE node 797 has no pending increfs request
[  415.723800] binder: 19982:19989 BC_ACQUIRE_DONE node 797 has no pending acquire request
[  415.808990] binder: release 19462:19470 transaction 772 out, still active
[  415.822911] binder: unexpected work type, 4, not freed
[  415.828582] binder: undelivered TRANSACTION_COMPLETE
[  415.838454] binder: release 19140:19141 transaction 706 out, still active
[  415.846805] binder: unexpected work type, 4, not freed
[  415.852237] binder: undelivered TRANSACTION_COMPLETE
[  417.788908] IPVS: ftp: loaded support on port[0] = 21
[  417.848215] chnl_net:caif_netlink_parms(): no params data found
[  417.873149] bridge0: port 1(bridge_slave_0) entered blocking state
[  417.879661] bridge0: port 1(bridge_slave_0) entered disabled state
[  417.886920] device bridge_slave_0 entered promiscuous mode
[  417.895806] bridge0: port 2(bridge_slave_1) entered blocking state
[  417.902167] bridge0: port 2(bridge_slave_1) entered disabled state
[  417.909195] device bridge_slave_1 entered promiscuous mode
[  417.925834] bond0: Enslaving bond_slave_0 as an active interface with an up link
[  417.935167] bond0: Enslaving bond_slave_1 as an active interface with an up link
[  417.951152] team0: Port device team_slave_0 added
[  417.957407] team0: Port device team_slave_1 added
[  418.035073] device hsr_slave_0 entered promiscuous mode
[  418.093798] device hsr_slave_1 entered promiscuous mode
[  418.159895] bridge0: port 2(bridge_slave_1) entered blocking state
[  418.166293] bridge0: port 2(bridge_slave_1) entered forwarding state
[  418.172851] bridge0: port 1(bridge_slave_0) entered blocking state
[  418.179259] bridge0: port 1(bridge_slave_0) entered forwarding state
[  418.210474] 8021q: adding VLAN 0 to HW filter on device bond0
[  418.220745] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready
[  418.230056] bridge0: port 1(bridge_slave_0) entered disabled state
[  418.237211] bridge0: port 2(bridge_slave_1) entered disabled state
[  418.245719] IPv6: ADDRCONF(NETDEV_CHANGE): bond0: link becomes ready
[  418.255822] 8021q: adding VLAN 0 to HW filter on device team0
[  418.264654] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready
[  418.272165] bridge0: port 1(bridge_slave_0) entered blocking state
[  418.278538] bridge0: port 1(bridge_slave_0) entered forwarding state
[  418.288543] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready
[  418.297037] bridge0: port 2(bridge_slave_1) entered blocking state
[  418.303368] bridge0: port 2(bridge_slave_1) entered forwarding state
[  418.325024] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready
[  418.334286] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready
[  418.341793] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready
[  418.352700] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready
[  418.359996] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready
[  418.370442] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready
[  418.388342] 8021q: adding VLAN 0 to HW filter on device batadv0
[  418.444465] binder: 20002 RLIMIT_NICE not set
[  418.451486] binder: BINDER_SET_CONTEXT_MGR already set
[  418.458403] binder: 20001:20002 ioctl 40046207 0 returned -16
05:03:08 executing program 5:
r0 = syz_open_dev$sndtimer(&(0x7f0000026000)='/dev/snd/timer\x00', 0x0, 0x0)
r1 = dup3(r0, r0, 0x80000)
ioctl$UI_GET_SYSNAME(r1, 0x8040552c, 0x0)
perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8)
r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c)
bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r2, &(0x7f0000000040), 0x0, 0x1}, 0x20)
openat$cgroup_ro(r1, &(0x7f00000004c0)='cpuset.effective_cpus\x00', 0x0, 0x0)
unlink(&(0x7f0000000900)='./file0/file0\x00')
r3 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r4 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r4, 0x0)
ioctl$BINDER_GET_NODE_DEBUG_INFO(0xffffffffffffffff, 0xc018620b, &(0x7f0000000780))
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f00000000c0)=[@enter_looper], 0x48, 0x0, &(0x7f0000000700)="2ba063fb309ec7fdbfb08e6e91baee7d7d4599fe14129a4d426834556ae420e087d59c0c7be7fcad1abb7e1f8f446f373f611ca1ee9c2231708e18a47bc68a2a79a0b48931f6ff6d"})
ioctl$sock_inet_tcp_SIOCOUTQNSD(r1, 0x894b, &(0x7f0000000480))
getsockopt$inet_IP_IPSEC_POLICY(0xffffffffffffffff, 0x0, 0x10, &(0x7f0000000540)={{{@in6, @in=@remote}}, {{@in6=@ipv4={[], [], @local}}, 0x0, @in6}}, &(0x7f0000000000)=0xe8)
ioctl$BINDER_SET_CONTEXT_MGR(r4, 0x40046207, 0x0)
r5 = dup(r4)
shutdown(r5, 0x1)
prctl$PR_SET_NAME(0xf, &(0x7f0000000380)='/group.stat\x00')
syz_open_dev$binder(&(0x7f0000000880)='/dev/binder#\x00', 0x0, 0x2)
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)})
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, &(0x7f0000000780)})
ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f0000000680)})
creat(&(0x7f00000000c0)='./file0\x00', 0x0)
clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000080), 0xffffffffffffffff)
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000003c0)={0x14, 0x0, &(0x7f0000000680)=[@acquire_done], 0x0, 0x0, 0x0})

05:03:08 executing program 0:
recvmmsg(0xffffffffffffffff, &(0x7f0000003140)=[{{&(0x7f0000001400)=@ipx, 0x80, 0x0}}], 0x1, 0x0, 0x0)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = syz_open_procfs(0x0, &(0x7f00000004c0)='net/rt_cache\x00')
preadv(r0, &(0x7f00000017c0), 0x118, 0x0)

05:03:08 executing program 3:
recvmmsg(0xffffffffffffffff, &(0x7f0000003140)=[{{&(0x7f0000001400)=@ipx, 0x80, 0x0}}], 0x1, 0x0, 0x0)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = syz_open_procfs(0x0, &(0x7f00000004c0)='net/rt_cache\x00')
preadv(r0, &(0x7f00000017c0), 0x118, 0x0)

05:03:08 executing program 4:
r0 = syz_open_dev$sndtimer(&(0x7f0000026000)='/dev/snd/timer\x00', 0x0, 0x0)
r1 = dup3(r0, r0, 0x80000)
ioctl$UI_GET_SYSNAME(r1, 0x8040552c, 0x0)
perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8)
r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c)
bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r2, &(0x7f0000000040), 0x0, 0x1}, 0x20)
openat$cgroup_ro(r1, &(0x7f00000004c0)='cpuset.effective_cpus\x00', 0x0, 0x0)
unlink(&(0x7f0000000900)='./file0/file0\x00')
r3 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r4 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r4, 0x0)
ioctl$BINDER_GET_NODE_DEBUG_INFO(0xffffffffffffffff, 0xc018620b, &(0x7f0000000780))
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f00000000c0)=[@enter_looper], 0x48, 0x0, &(0x7f0000000700)="2ba063fb309ec7fdbfb08e6e91baee7d7d4599fe14129a4d426834556ae420e087d59c0c7be7fcad1abb7e1f8f446f373f611ca1ee9c2231708e18a47bc68a2a79a0b48931f6ff6d"})
ioctl$sock_inet_tcp_SIOCOUTQNSD(r1, 0x894b, &(0x7f0000000480))
getsockopt$inet_IP_IPSEC_POLICY(0xffffffffffffffff, 0x0, 0x10, &(0x7f0000000540)={{{@in6, @in=@remote}}, {{@in6=@ipv4={[], [], @local}}, 0x0, @in6}}, &(0x7f0000000000)=0xe8)
ioctl$BINDER_SET_CONTEXT_MGR(r4, 0x40046207, 0x0)
r5 = dup(r4)
shutdown(r5, 0x1)
prctl$PR_SET_NAME(0xf, &(0x7f0000000380)='/group.stat\x00')
syz_open_dev$binder(&(0x7f0000000880)='/dev/binder#\x00', 0x0, 0x2)
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)})
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, &(0x7f0000000780)})
creat(&(0x7f00000000c0)='./file0\x00', 0x0)
openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000100)='/group.stat\x00', 0x2761, 0x0)
clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000080), 0xffffffffffffffff)
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000003c0)={0x14, 0x0, &(0x7f0000000680)=[@acquire_done], 0x0, 0x0, 0x0})

05:03:08 executing program 2:
r0 = syz_open_dev$sndtimer(&(0x7f0000026000)='/dev/snd/timer\x00', 0x0, 0x0)
r1 = dup3(r0, r0, 0x80000)
ioctl$UI_GET_SYSNAME(r1, 0x8040552c, 0x0)
perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8)
r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c)
bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r2, &(0x7f0000000040), 0x0, 0x1}, 0x20)
openat$cgroup_ro(r1, &(0x7f00000004c0)='cpuset.effective_cpus\x00', 0x0, 0x0)
unlink(&(0x7f0000000900)='./file0/file0\x00')
r3 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r4 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r4, 0x0)
ioctl$BINDER_GET_NODE_DEBUG_INFO(r3, 0xc018620b, &(0x7f0000000780))
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f00000000c0)=[@enter_looper], 0x0, 0x0, &(0x7f0000000700)})
ioctl$sock_inet_tcp_SIOCOUTQNSD(r1, 0x894b, &(0x7f0000000480))
getsockopt$inet_IP_IPSEC_POLICY(0xffffffffffffffff, 0x0, 0x10, &(0x7f0000000540)={{{@in6, @in=@remote}}, {{@in6=@ipv4={[], [], @local}}, 0x0, @in6}}, &(0x7f0000000000)=0xe8)
ioctl$BINDER_SET_CONTEXT_MGR(r4, 0x40046207, 0x0)
r5 = dup(r4)
shutdown(r5, 0x1)
prctl$PR_SET_NAME(0xf, &(0x7f0000000380)='/group.stat\x00')
syz_open_dev$binder(&(0x7f0000000880)='/dev/binder#\x00', 0x0, 0x2)
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)})
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, &(0x7f0000000780)})
ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f0000000680)})
creat(&(0x7f00000000c0)='./file0\x00', 0x0)
openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000100)='/group.stat\x00', 0x2761, 0x0)
clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000080), 0xffffffffffffffff)
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000003c0)={0x14, 0x0, &(0x7f0000000680)=[@acquire_done], 0x0, 0x0, 0x0})

05:03:08 executing program 1:
r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000200)='/dev/nullb0\x00', 0x5000000084002, 0x0)
mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x200000e, 0x13, r0, 0x0)
r1 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x4000, 0x0)
preadv(r1, &(0x7f0000000040)=[{&(0x7f0000000400)=""/4096, 0x3ffc00}], 0x19, 0x0)

[  418.518768] binder: 20001:20003 BC_INCREFS_DONE node 800 has no pending increfs request
[  418.529637] binder_thread_write: 3 callbacks suppressed
[  418.529644] binder: 20001:20003 Release 1 refcount change on invalid ref 1 ret -22
[  418.546841] binder: 20001:20003 BC_ACQUIRE_DONE node 800 has no pending acquire request
[  418.617474] binder: BINDER_SET_CONTEXT_MGR already set
[  418.623024] binder: 20009:20011 ioctl 40046207 0 returned -16
[  418.656897] binder: 20015 RLIMIT_NICE not set
05:03:09 executing program 0:
recvmmsg(0xffffffffffffffff, &(0x7f0000003140)=[{{&(0x7f0000001400)=@ipx, 0x80, 0x0}}], 0x1, 0x0, 0x0)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = syz_open_procfs(0x0, &(0x7f00000004c0)='net/rt_cache\x00')
preadv(r0, &(0x7f00000017c0), 0x119, 0x0)

05:03:09 executing program 3:
recvmmsg(0xffffffffffffffff, &(0x7f0000003140)=[{{&(0x7f0000001400)=@ipx, 0x80, 0x0}}], 0x1, 0x0, 0x0)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = syz_open_procfs(0x0, &(0x7f00000004c0)='net/rt_cache\x00')
preadv(r0, &(0x7f00000017c0), 0x119, 0x0)

[  418.676052] binder: BINDER_SET_CONTEXT_MGR already set
[  418.713222] binder: 20019 RLIMIT_NICE not set
[  418.722888] binder: 20005:20015 ioctl 40046207 0 returned -16
[  418.729395] binder: 20009:20020 BC_INCREFS_DONE node 803 has no pending increfs request
[  418.749067] binder: 20009:20020 Release 1 refcount change on invalid ref 1 ret -22
05:03:09 executing program 0:
recvmmsg(0xffffffffffffffff, &(0x7f0000003140)=[{{&(0x7f0000001400)=@ipx, 0x80, 0x0}}], 0x1, 0x0, 0x0)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = syz_open_procfs(0x0, &(0x7f00000004c0)='net/rt_cache\x00')
preadv(r0, &(0x7f00000017c0), 0x11a, 0x0)

[  418.778974] binder: BINDER_SET_CONTEXT_MGR already set
[  418.792794] binder: 20009:20020 BC_ACQUIRE_DONE node 803 has no pending acquire request
[  418.804402] binder: 20017:20019 ioctl 40046207 0 returned -16
[  418.820581] binder: 20005:20023 BC_INCREFS_DONE node 806 has no pending increfs request
05:03:09 executing program 3:
recvmmsg(0xffffffffffffffff, &(0x7f0000003140)=[{{&(0x7f0000001400)=@ipx, 0x80, 0x0}}], 0x1, 0x0, 0x0)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = syz_open_procfs(0x0, &(0x7f00000004c0)='net/rt_cache\x00')
preadv(r0, &(0x7f00000017c0), 0x11a, 0x0)

[  418.841526] binder: 20005:20023 BC_ACQUIRE_DONE node 806 has no pending acquire request
[  418.901490] binder: 20017:20027 BC_INCREFS_DONE node 809 has no pending increfs request
[  418.947977] binder: 20017:20027 Release 1 refcount change on invalid ref 1 ret -22
05:03:09 executing program 3:
recvmmsg(0xffffffffffffffff, &(0x7f0000003140)=[{{&(0x7f0000001400)=@ipx, 0x80, 0x0}}], 0x1, 0x0, 0x0)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = syz_open_procfs(0x0, &(0x7f00000004c0)='net/rt_cache\x00')
preadv(r0, &(0x7f00000017c0), 0x11b, 0x0)

05:03:09 executing program 0:
recvmmsg(0xffffffffffffffff, &(0x7f0000003140)=[{{&(0x7f0000001400)=@ipx, 0x80, 0x0}}], 0x1, 0x0, 0x0)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = syz_open_procfs(0x0, &(0x7f00000004c0)='net/rt_cache\x00')
preadv(r0, &(0x7f00000017c0), 0x11b, 0x0)

05:03:09 executing program 5:
r0 = syz_open_dev$sndtimer(&(0x7f0000026000)='/dev/snd/timer\x00', 0x0, 0x0)
r1 = dup3(r0, r0, 0x80000)
ioctl$UI_GET_SYSNAME(r1, 0x8040552c, 0x0)
perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8)
r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c)
bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r2, &(0x7f0000000040), 0x0, 0x1}, 0x20)
openat$cgroup_ro(r1, &(0x7f00000004c0)='cpuset.effective_cpus\x00', 0x0, 0x0)
unlink(&(0x7f0000000900)='./file0/file0\x00')
r3 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r4 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r4, 0x0)
ioctl$BINDER_GET_NODE_DEBUG_INFO(0xffffffffffffffff, 0xc018620b, &(0x7f0000000780))
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f00000000c0)=[@enter_looper], 0x48, 0x0, &(0x7f0000000700)="2ba063fb309ec7fdbfb08e6e91baee7d7d4599fe14129a4d426834556ae420e087d59c0c7be7fcad1abb7e1f8f446f373f611ca1ee9c2231708e18a47bc68a2a79a0b48931f6ff6d"})
ioctl$sock_inet_tcp_SIOCOUTQNSD(r1, 0x894b, &(0x7f0000000480))
getsockopt$inet_IP_IPSEC_POLICY(0xffffffffffffffff, 0x0, 0x10, &(0x7f0000000540)={{{@in6, @in=@remote}}, {{@in6=@ipv4={[], [], @local}}, 0x0, @in6}}, &(0x7f0000000000)=0xe8)
ioctl$BINDER_SET_CONTEXT_MGR(r4, 0x40046207, 0x0)
r5 = dup(r4)
shutdown(r5, 0x1)
prctl$PR_SET_NAME(0xf, &(0x7f0000000380)='/group.stat\x00')
syz_open_dev$binder(&(0x7f0000000880)='/dev/binder#\x00', 0x0, 0x2)
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)})
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, &(0x7f0000000780)})
ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f0000000680)})
creat(&(0x7f00000000c0)='./file0\x00', 0x0)
clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000080), 0xffffffffffffffff)
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000003c0)={0x14, 0x0, &(0x7f0000000680)=[@acquire_done], 0x0, 0x0, 0x0})

[  419.001322] binder: 20017:20027 BC_ACQUIRE_DONE node 809 has no pending acquire request
05:03:09 executing program 3:
recvmmsg(0xffffffffffffffff, &(0x7f0000003140)=[{{&(0x7f0000001400)=@ipx, 0x80, 0x0}}], 0x1, 0x0, 0x0)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = syz_open_procfs(0x0, &(0x7f00000004c0)='net/rt_cache\x00')
preadv(r0, &(0x7f00000017c0), 0x11c, 0x0)

05:03:09 executing program 0:
recvmmsg(0xffffffffffffffff, &(0x7f0000003140)=[{{&(0x7f0000001400)=@ipx, 0x80, 0x0}}], 0x1, 0x0, 0x0)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = syz_open_procfs(0x0, &(0x7f00000004c0)='net/rt_cache\x00')
preadv(r0, &(0x7f00000017c0), 0x11c, 0x0)

[  419.240575] binder: 20063 RLIMIT_NICE not set
[  419.271270] binder: BINDER_SET_CONTEXT_MGR already set
[  419.290998] binder: 20060:20063 ioctl 40046207 0 returned -16
[  419.375450] binder: release 20005:20015 transaction 805 out, still active
[  419.399862] binder: 20060:20065 BC_INCREFS_DONE node 812 has no pending increfs request
[  419.410920] binder: release 20009:20011 transaction 802 out, still active
[  419.448438] binder: 20060:20068 Release 1 refcount change on invalid ref 1 ret -22
[  419.456820] binder: unexpected work type, 4, not freed
[  419.462125] binder: undelivered TRANSACTION_COMPLETE
05:03:09 executing program 4:
r0 = syz_open_dev$sndtimer(&(0x7f0000026000)='/dev/snd/timer\x00', 0x0, 0x0)
r1 = dup3(r0, r0, 0x80000)
ioctl$UI_GET_SYSNAME(r1, 0x8040552c, 0x0)
perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8)
r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c)
bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r2, &(0x7f0000000040), 0x0, 0x1}, 0x20)
openat$cgroup_ro(r1, &(0x7f00000004c0)='cpuset.effective_cpus\x00', 0x0, 0x0)
unlink(&(0x7f0000000900)='./file0/file0\x00')
r3 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r4 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r4, 0x0)
ioctl$BINDER_GET_NODE_DEBUG_INFO(0xffffffffffffffff, 0xc018620b, &(0x7f0000000780))
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f00000000c0)=[@enter_looper], 0x48, 0x0, &(0x7f0000000700)="2ba063fb309ec7fdbfb08e6e91baee7d7d4599fe14129a4d426834556ae420e087d59c0c7be7fcad1abb7e1f8f446f373f611ca1ee9c2231708e18a47bc68a2a79a0b48931f6ff6d"})
ioctl$sock_inet_tcp_SIOCOUTQNSD(r1, 0x894b, &(0x7f0000000480))
getsockopt$inet_IP_IPSEC_POLICY(0xffffffffffffffff, 0x0, 0x10, &(0x7f0000000540)={{{@in6, @in=@remote}}, {{@in6=@ipv4={[], [], @local}}, 0x0, @in6}}, &(0x7f0000000000)=0xe8)
ioctl$BINDER_SET_CONTEXT_MGR(r4, 0x40046207, 0x0)
r5 = dup(r4)
shutdown(r5, 0x1)
prctl$PR_SET_NAME(0xf, &(0x7f0000000380)='/group.stat\x00')
syz_open_dev$binder(&(0x7f0000000880)='/dev/binder#\x00', 0x0, 0x2)
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)})
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, &(0x7f0000000780)})
creat(&(0x7f00000000c0)='./file0\x00', 0x0)
openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000100)='/group.stat\x00', 0x2761, 0x0)
clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000080), 0xffffffffffffffff)
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000003c0)={0x14, 0x0, &(0x7f0000000680)=[@acquire_done], 0x0, 0x0, 0x0})

05:03:09 executing program 1:
r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000200)='/dev/nullb0\x00', 0x5000000084002, 0x0)
mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x200000e, 0x13, r0, 0x0)
r1 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x4000, 0x0)
preadv(r1, &(0x7f0000000040)=[{&(0x7f0000000400)=""/4096, 0x3ffc00}], 0x1a, 0x0)

05:03:09 executing program 2:
r0 = syz_open_dev$sndtimer(&(0x7f0000026000)='/dev/snd/timer\x00', 0x0, 0x0)
r1 = dup3(r0, r0, 0x80000)
ioctl$UI_GET_SYSNAME(r1, 0x8040552c, 0x0)
perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8)
r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c)
bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r2, &(0x7f0000000040), 0x0, 0x1}, 0x20)
openat$cgroup_ro(r1, &(0x7f00000004c0)='cpuset.effective_cpus\x00', 0x0, 0x0)
unlink(&(0x7f0000000900)='./file0/file0\x00')
r3 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r4 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r4, 0x0)
ioctl$BINDER_GET_NODE_DEBUG_INFO(r3, 0xc018620b, &(0x7f0000000780))
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f00000000c0)=[@enter_looper], 0x0, 0x0, &(0x7f0000000700)})
ioctl$sock_inet_tcp_SIOCOUTQNSD(r1, 0x894b, &(0x7f0000000480))
getsockopt$inet_IP_IPSEC_POLICY(0xffffffffffffffff, 0x0, 0x10, &(0x7f0000000540)={{{@in6, @in=@remote}}, {{@in6=@ipv4={[], [], @local}}, 0x0, @in6}}, &(0x7f0000000000)=0xe8)
ioctl$BINDER_SET_CONTEXT_MGR(r4, 0x40046207, 0x0)
r5 = dup(r4)
shutdown(r5, 0x1)
prctl$PR_SET_NAME(0xf, &(0x7f0000000380)='/group.stat\x00')
syz_open_dev$binder(&(0x7f0000000880)='/dev/binder#\x00', 0x0, 0x2)
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)})
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, &(0x7f0000000780)})
ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f0000000680)})
creat(&(0x7f00000000c0)='./file0\x00', 0x0)
openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000100)='/group.stat\x00', 0x2761, 0x0)
clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000080), 0xffffffffffffffff)
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000003c0)={0x14, 0x0, &(0x7f0000000680)=[@acquire_done], 0x0, 0x0, 0x0})

05:03:09 executing program 0:
recvmmsg(0xffffffffffffffff, &(0x7f0000003140)=[{{&(0x7f0000001400)=@ipx, 0x80, 0x0}}], 0x1, 0x0, 0x0)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = syz_open_procfs(0x0, &(0x7f00000004c0)='net/rt_cache\x00')
preadv(r0, &(0x7f00000017c0), 0x11d, 0x0)

[  419.502974] binder: 20060:20065 BC_ACQUIRE_DONE node 812 has no pending acquire request
[  419.572074] binder: BINDER_SET_CONTEXT_MGR already set
05:03:09 executing program 3:
recvmmsg(0xffffffffffffffff, &(0x7f0000003140)=[{{&(0x7f0000001400)=@ipx, 0x80, 0x0}}], 0x1, 0x0, 0x0)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = syz_open_procfs(0x0, &(0x7f00000004c0)='net/rt_cache\x00')
preadv(r0, &(0x7f00000017c0), 0x11d, 0x0)

05:03:10 executing program 5:
r0 = syz_open_dev$sndtimer(&(0x7f0000026000)='/dev/snd/timer\x00', 0x0, 0x0)
r1 = dup3(r0, r0, 0x80000)
ioctl$UI_GET_SYSNAME(r1, 0x8040552c, 0x0)
perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8)
r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c)
bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r2, &(0x7f0000000040), 0x0, 0x1}, 0x20)
openat$cgroup_ro(r1, &(0x7f00000004c0)='cpuset.effective_cpus\x00', 0x0, 0x0)
unlink(&(0x7f0000000900)='./file0/file0\x00')
r3 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r4 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r4, 0x0)
ioctl$BINDER_GET_NODE_DEBUG_INFO(0xffffffffffffffff, 0xc018620b, &(0x7f0000000780))
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f00000000c0)=[@enter_looper], 0x48, 0x0, &(0x7f0000000700)="2ba063fb309ec7fdbfb08e6e91baee7d7d4599fe14129a4d426834556ae420e087d59c0c7be7fcad1abb7e1f8f446f373f611ca1ee9c2231708e18a47bc68a2a79a0b48931f6ff6d"})
ioctl$sock_inet_tcp_SIOCOUTQNSD(r1, 0x894b, &(0x7f0000000480))
getsockopt$inet_IP_IPSEC_POLICY(0xffffffffffffffff, 0x0, 0x10, &(0x7f0000000540)={{{@in6, @in=@remote}}, {{@in6=@ipv4={[], [], @local}}, 0x0, @in6}}, &(0x7f0000000000)=0xe8)
ioctl$BINDER_SET_CONTEXT_MGR(r4, 0x40046207, 0x0)
r5 = dup(r4)
shutdown(r5, 0x1)
prctl$PR_SET_NAME(0xf, &(0x7f0000000380)='/group.stat\x00')
syz_open_dev$binder(&(0x7f0000000880)='/dev/binder#\x00', 0x0, 0x2)
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)})
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, &(0x7f0000000780)})
creat(&(0x7f00000000c0)='./file0\x00', 0x0)
openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000100)='/group.stat\x00', 0x2761, 0x0)
clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000080), 0xffffffffffffffff)
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000003c0)={0x14, 0x0, &(0x7f0000000680)=[@acquire_done], 0x0, 0x0, 0x0})

[  419.614847] binder: 20071:20072 ioctl 40046207 0 returned -16
[  419.622956] binder: 20076 RLIMIT_NICE not set
05:03:10 executing program 3:
recvmmsg(0xffffffffffffffff, &(0x7f0000003140)=[{{&(0x7f0000001400)=@ipx, 0x80, 0x0}}], 0x1, 0x0, 0x0)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = syz_open_procfs(0x0, &(0x7f00000004c0)='net/rt_cache\x00')
preadv(r0, &(0x7f00000017c0), 0x11e, 0x0)

05:03:10 executing program 0:
recvmmsg(0xffffffffffffffff, &(0x7f0000003140)=[{{&(0x7f0000001400)=@ipx, 0x80, 0x0}}], 0x1, 0x0, 0x0)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = syz_open_procfs(0x0, &(0x7f00000004c0)='net/rt_cache\x00')
preadv(r0, &(0x7f00000017c0), 0x11e, 0x0)

[  419.690537] binder: 20071:20080 BC_INCREFS_DONE node 815 has no pending increfs request
[  419.705928] binder: BINDER_SET_CONTEXT_MGR already set
[  419.724510] binder: 20075:20076 ioctl 40046207 0 returned -16
05:03:10 executing program 2:
r0 = syz_open_dev$sndtimer(&(0x7f0000026000)='/dev/snd/timer\x00', 0x0, 0x0)
r1 = dup3(r0, r0, 0x80000)
ioctl$UI_GET_SYSNAME(r1, 0x8040552c, 0x0)
perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8)
r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c)
bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r2, &(0x7f0000000040), 0x0, 0x1}, 0x20)
openat$cgroup_ro(r1, &(0x7f00000004c0)='cpuset.effective_cpus\x00', 0x0, 0x0)
unlink(&(0x7f0000000900)='./file0/file0\x00')
r3 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r4 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r4, 0x0)
ioctl$BINDER_GET_NODE_DEBUG_INFO(r3, 0xc018620b, &(0x7f0000000780))
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f00000000c0)=[@enter_looper], 0x0, 0x0, &(0x7f0000000700)})
ioctl$sock_inet_tcp_SIOCOUTQNSD(r1, 0x894b, &(0x7f0000000480))
getsockopt$inet_IP_IPSEC_POLICY(0xffffffffffffffff, 0x0, 0x10, &(0x7f0000000540)={{{@in6, @in=@remote}}, {{@in6=@ipv4={[], [], @local}}, 0x0, @in6}}, &(0x7f0000000000)=0xe8)
ioctl$BINDER_SET_CONTEXT_MGR(r4, 0x40046207, 0x0)
r5 = dup(r4)
shutdown(r5, 0x1)
prctl$PR_SET_NAME(0xf, &(0x7f0000000380)='/group.stat\x00')
syz_open_dev$binder(&(0x7f0000000880)='/dev/binder#\x00', 0x0, 0x2)
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)})
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, &(0x7f0000000780)})
ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f0000000680)})
creat(&(0x7f00000000c0)='./file0\x00', 0x0)
openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000100)='/group.stat\x00', 0x2761, 0x0)
clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000080), 0xffffffffffffffff)
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000003c0)={0x14, 0x0, &(0x7f0000000680)=[@acquire_done], 0x0, 0x0, 0x0})

[  419.767890] binder: 20071:20080 Release 1 refcount change on invalid ref 1 ret -22
[  419.775650] binder: release 20075:20086 transaction 817 out, still active
[  419.797241] binder: 20071:20080 BC_ACQUIRE_DONE node 815 has no pending acquire request
[  419.806412] binder: 20091 RLIMIT_NICE not set
05:03:10 executing program 4:
r0 = syz_open_dev$sndtimer(&(0x7f0000026000)='/dev/snd/timer\x00', 0x0, 0x0)
r1 = dup3(r0, r0, 0x80000)
ioctl$UI_GET_SYSNAME(r1, 0x8040552c, 0x0)
perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8)
r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c)
bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r2, &(0x7f0000000040), 0x0, 0x1}, 0x20)
openat$cgroup_ro(r1, &(0x7f00000004c0)='cpuset.effective_cpus\x00', 0x0, 0x0)
unlink(&(0x7f0000000900)='./file0/file0\x00')
r3 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r4 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r4, 0x0)
ioctl$BINDER_GET_NODE_DEBUG_INFO(0xffffffffffffffff, 0xc018620b, &(0x7f0000000780))
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f00000000c0)=[@enter_looper], 0x48, 0x0, &(0x7f0000000700)="2ba063fb309ec7fdbfb08e6e91baee7d7d4599fe14129a4d426834556ae420e087d59c0c7be7fcad1abb7e1f8f446f373f611ca1ee9c2231708e18a47bc68a2a79a0b48931f6ff6d"})
ioctl$sock_inet_tcp_SIOCOUTQNSD(r1, 0x894b, &(0x7f0000000480))
getsockopt$inet_IP_IPSEC_POLICY(0xffffffffffffffff, 0x0, 0x10, &(0x7f0000000540)={{{@in6, @in=@remote}}, {{@in6=@ipv4={[], [], @local}}, 0x0, @in6}}, &(0x7f0000000000)=0xe8)
ioctl$BINDER_SET_CONTEXT_MGR(r4, 0x40046207, 0x0)
r5 = dup(r4)
shutdown(r5, 0x1)
prctl$PR_SET_NAME(0xf, &(0x7f0000000380)='/group.stat\x00')
syz_open_dev$binder(&(0x7f0000000880)='/dev/binder#\x00', 0x0, 0x2)
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)})
ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f0000000680)})
creat(&(0x7f00000000c0)='./file0\x00', 0x0)
openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000100)='/group.stat\x00', 0x2761, 0x0)
clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000080), 0xffffffffffffffff)
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000003c0)={0x14, 0x0, &(0x7f0000000680)=[@acquire_done], 0x0, 0x0, 0x0})

[  419.838110] binder: BINDER_SET_CONTEXT_MGR already set
05:03:10 executing program 0:
recvmmsg(0xffffffffffffffff, &(0x7f0000003140)=[{{&(0x7f0000001400)=@ipx, 0x80, 0x0}}], 0x1, 0x0, 0x0)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = syz_open_procfs(0x0, &(0x7f00000004c0)='net/rt_cache\x00')
preadv(r0, &(0x7f00000017c0), 0x11f, 0x0)

[  419.862086] binder: 20088:20091 ioctl 40046207 0 returned -16
[  419.913011] binder: 20102 RLIMIT_NICE not set
05:03:10 executing program 3:
recvmmsg(0xffffffffffffffff, &(0x7f0000003140)=[{{&(0x7f0000001400)=@ipx, 0x80, 0x0}}], 0x1, 0x0, 0x0)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = syz_open_procfs(0x0, &(0x7f00000004c0)='net/rt_cache\x00')
preadv(r0, &(0x7f00000017c0), 0x11f, 0x0)

[  419.934843] binder: BINDER_SET_CONTEXT_MGR already set
[  419.952413] binder: 20100:20102 ioctl 40046207 0 returned -16
[  419.970307] binder: BINDER_SET_CONTEXT_MGR already set
[  419.987244] binder: 20104:20105 ioctl 40046207 0 returned -16
[  419.993386] binder: 20088:20106 BC_INCREFS_DONE node 821 has no pending increfs request
05:03:10 executing program 0:
recvmmsg(0xffffffffffffffff, &(0x7f0000003140)=[{{&(0x7f0000001400)=@ipx, 0x80, 0x0}}], 0x1, 0x0, 0x0)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = syz_open_procfs(0x0, &(0x7f00000004c0)='net/rt_cache\x00')
preadv(r0, &(0x7f00000017c0), 0x120, 0x0)

[  420.045549] binder: 20100:20111 Release 1 refcount change on invalid ref 1 ret -22
[  420.060875] binder: 20088:20106 BC_ACQUIRE_DONE node 821 has no pending acquire request
[  420.074414] binder: 20100:20111 BC_ACQUIRE_DONE node 824 has no pending acquire request
[  420.083273] binder: 20104:20116 BC_INCREFS_DONE node 827 has no pending increfs request
[  420.102407] binder: 20104:20116 Release 1 refcount change on invalid ref 1 ret -22
[  420.149150] binder: 20104:20116 BC_ACQUIRE_DONE node 827 has no pending acquire request
05:03:10 executing program 1:
r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000200)='/dev/nullb0\x00', 0x5000000084002, 0x0)
mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x200000e, 0x13, r0, 0x0)
r1 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x4000, 0x0)
preadv(r1, &(0x7f0000000040)=[{&(0x7f0000000400)=""/4096, 0x3ffc00}], 0x1b, 0x0)

05:03:10 executing program 3:
recvmmsg(0xffffffffffffffff, &(0x7f0000003140)=[{{&(0x7f0000001400)=@ipx, 0x80, 0x0}}], 0x1, 0x0, 0x0)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = syz_open_procfs(0x0, &(0x7f00000004c0)='net/rt_cache\x00')
preadv(r0, &(0x7f00000017c0), 0x120, 0x0)

05:03:10 executing program 5:
r0 = syz_open_dev$sndtimer(&(0x7f0000026000)='/dev/snd/timer\x00', 0x0, 0x0)
r1 = dup3(r0, r0, 0x80000)
ioctl$UI_GET_SYSNAME(r1, 0x8040552c, 0x0)
perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8)
r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c)
bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r2, &(0x7f0000000040), 0x0, 0x1}, 0x20)
openat$cgroup_ro(r1, &(0x7f00000004c0)='cpuset.effective_cpus\x00', 0x0, 0x0)
unlink(&(0x7f0000000900)='./file0/file0\x00')
r3 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r4 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r4, 0x0)
ioctl$BINDER_GET_NODE_DEBUG_INFO(0xffffffffffffffff, 0xc018620b, &(0x7f0000000780))
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f00000000c0)=[@enter_looper], 0x48, 0x0, &(0x7f0000000700)="2ba063fb309ec7fdbfb08e6e91baee7d7d4599fe14129a4d426834556ae420e087d59c0c7be7fcad1abb7e1f8f446f373f611ca1ee9c2231708e18a47bc68a2a79a0b48931f6ff6d"})
ioctl$sock_inet_tcp_SIOCOUTQNSD(r1, 0x894b, &(0x7f0000000480))
getsockopt$inet_IP_IPSEC_POLICY(0xffffffffffffffff, 0x0, 0x10, &(0x7f0000000540)={{{@in6, @in=@remote}}, {{@in6=@ipv4={[], [], @local}}, 0x0, @in6}}, &(0x7f0000000000)=0xe8)
ioctl$BINDER_SET_CONTEXT_MGR(r4, 0x40046207, 0x0)
r5 = dup(r4)
shutdown(r5, 0x1)
prctl$PR_SET_NAME(0xf, &(0x7f0000000380)='/group.stat\x00')
syz_open_dev$binder(&(0x7f0000000880)='/dev/binder#\x00', 0x0, 0x2)
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)})
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, &(0x7f0000000780)})
creat(&(0x7f00000000c0)='./file0\x00', 0x0)
openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000100)='/group.stat\x00', 0x2761, 0x0)
clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000080), 0xffffffffffffffff)
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000003c0)={0x14, 0x0, &(0x7f0000000680)=[@acquire_done], 0x0, 0x0, 0x0})

05:03:10 executing program 2:
r0 = syz_open_dev$sndtimer(&(0x7f0000026000)='/dev/snd/timer\x00', 0x0, 0x0)
r1 = dup3(r0, r0, 0x80000)
ioctl$UI_GET_SYSNAME(r1, 0x8040552c, 0x0)
perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8)
r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c)
bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r2, &(0x7f0000000040), 0x0, 0x1}, 0x20)
openat$cgroup_ro(r1, &(0x7f00000004c0)='cpuset.effective_cpus\x00', 0x0, 0x0)
unlink(&(0x7f0000000900)='./file0/file0\x00')
r3 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r4 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r4, 0x0)
ioctl$BINDER_GET_NODE_DEBUG_INFO(r3, 0xc018620b, &(0x7f0000000780))
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f00000000c0)=[@enter_looper], 0x24, 0x0, &(0x7f0000000700)="2ba063fb309ec7fdbfb08e6e91baee7d7d4599fe14129a4d426834556ae420e087d59c0c"})
ioctl$sock_inet_tcp_SIOCOUTQNSD(r1, 0x894b, &(0x7f0000000480))
getsockopt$inet_IP_IPSEC_POLICY(0xffffffffffffffff, 0x0, 0x10, &(0x7f0000000540)={{{@in6, @in=@remote}}, {{@in6=@ipv4={[], [], @local}}, 0x0, @in6}}, &(0x7f0000000000)=0xe8)
ioctl$BINDER_SET_CONTEXT_MGR(r4, 0x40046207, 0x0)
r5 = dup(r4)
shutdown(r5, 0x1)
prctl$PR_SET_NAME(0xf, &(0x7f0000000380)='/group.stat\x00')
syz_open_dev$binder(&(0x7f0000000880)='/dev/binder#\x00', 0x0, 0x2)
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)})
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, &(0x7f0000000780)})
ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f0000000680)})
creat(&(0x7f00000000c0)='./file0\x00', 0x0)
openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000100)='/group.stat\x00', 0x2761, 0x0)
clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000080), 0xffffffffffffffff)
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000003c0)={0x14, 0x0, &(0x7f0000000680)=[@acquire_done], 0x0, 0x0, 0x0})

05:03:10 executing program 0:
recvmmsg(0xffffffffffffffff, &(0x7f0000003140)=[{{&(0x7f0000001400)=@ipx, 0x80, 0x0}}], 0x1, 0x0, 0x0)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = syz_open_procfs(0x0, &(0x7f00000004c0)='net/rt_cache\x00')
preadv(r0, &(0x7f00000017c0), 0x121, 0x0)

05:03:10 executing program 3:
recvmmsg(0xffffffffffffffff, &(0x7f0000003140)=[{{&(0x7f0000001400)=@ipx, 0x80, 0x0}}], 0x1, 0x0, 0x0)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = syz_open_procfs(0x0, &(0x7f00000004c0)='net/rt_cache\x00')
preadv(r0, &(0x7f00000017c0), 0x121, 0x0)

[  420.342363] binder: 20137 RLIMIT_NICE not set
05:03:10 executing program 0:
recvmmsg(0xffffffffffffffff, &(0x7f0000003140)=[{{&(0x7f0000001400)=@ipx, 0x80, 0x0}}], 0x1, 0x0, 0x0)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = syz_open_procfs(0x0, &(0x7f00000004c0)='net/rt_cache\x00')
preadv(r0, &(0x7f00000017c0), 0x122, 0x0)

05:03:10 executing program 1:
r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000200)='/dev/nullb0\x00', 0x5000000084002, 0x0)
mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x200000e, 0x13, r0, 0x0)
r1 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x4000, 0x0)
preadv(r1, &(0x7f0000000040)=[{&(0x7f0000000400)=""/4096, 0x3ffc00}], 0x1c, 0x0)

[  420.380378] binder: BINDER_SET_CONTEXT_MGR already set
[  420.417657] binder: 20136:20137 ioctl 40046207 0 returned -16
[  420.508108] binder: 20136:20250 BC_INCREFS_DONE node 830 has no pending increfs request
[  420.536746] binder: 20136:20250 BC_ACQUIRE_DONE node 830 has no pending acquire request
05:03:11 executing program 4:
r0 = syz_open_dev$sndtimer(&(0x7f0000026000)='/dev/snd/timer\x00', 0x0, 0x0)
r1 = dup3(r0, r0, 0x80000)
ioctl$UI_GET_SYSNAME(r1, 0x8040552c, 0x0)
perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8)
r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c)
bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r2, &(0x7f0000000040), 0x0, 0x1}, 0x20)
openat$cgroup_ro(r1, &(0x7f00000004c0)='cpuset.effective_cpus\x00', 0x0, 0x0)
unlink(&(0x7f0000000900)='./file0/file0\x00')
r3 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r4 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r4, 0x0)
ioctl$BINDER_GET_NODE_DEBUG_INFO(0xffffffffffffffff, 0xc018620b, &(0x7f0000000780))
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f00000000c0)=[@enter_looper], 0x48, 0x0, &(0x7f0000000700)="2ba063fb309ec7fdbfb08e6e91baee7d7d4599fe14129a4d426834556ae420e087d59c0c7be7fcad1abb7e1f8f446f373f611ca1ee9c2231708e18a47bc68a2a79a0b48931f6ff6d"})
ioctl$sock_inet_tcp_SIOCOUTQNSD(r1, 0x894b, &(0x7f0000000480))
getsockopt$inet_IP_IPSEC_POLICY(0xffffffffffffffff, 0x0, 0x10, &(0x7f0000000540)={{{@in6, @in=@remote}}, {{@in6=@ipv4={[], [], @local}}, 0x0, @in6}}, &(0x7f0000000000)=0xe8)
ioctl$BINDER_SET_CONTEXT_MGR(r4, 0x40046207, 0x0)
r5 = dup(r4)
shutdown(r5, 0x1)
prctl$PR_SET_NAME(0xf, &(0x7f0000000380)='/group.stat\x00')
syz_open_dev$binder(&(0x7f0000000880)='/dev/binder#\x00', 0x0, 0x2)
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)})
ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f0000000680)})
creat(&(0x7f00000000c0)='./file0\x00', 0x0)
openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000100)='/group.stat\x00', 0x2761, 0x0)
clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000080), 0xffffffffffffffff)
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000003c0)={0x14, 0x0, &(0x7f0000000680)=[@acquire_done], 0x0, 0x0, 0x0})

05:03:11 executing program 2:
r0 = syz_open_dev$sndtimer(&(0x7f0000026000)='/dev/snd/timer\x00', 0x0, 0x0)
r1 = dup3(r0, r0, 0x80000)
ioctl$UI_GET_SYSNAME(r1, 0x8040552c, 0x0)
perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8)
r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c)
bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r2, &(0x7f0000000040), 0x0, 0x1}, 0x20)
openat$cgroup_ro(r1, &(0x7f00000004c0)='cpuset.effective_cpus\x00', 0x0, 0x0)
unlink(&(0x7f0000000900)='./file0/file0\x00')
r3 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r4 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r4, 0x0)
ioctl$BINDER_GET_NODE_DEBUG_INFO(r3, 0xc018620b, &(0x7f0000000780))
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f00000000c0)=[@enter_looper], 0x24, 0x0, &(0x7f0000000700)="2ba063fb309ec7fdbfb08e6e91baee7d7d4599fe14129a4d426834556ae420e087d59c0c"})
ioctl$sock_inet_tcp_SIOCOUTQNSD(r1, 0x894b, &(0x7f0000000480))
getsockopt$inet_IP_IPSEC_POLICY(0xffffffffffffffff, 0x0, 0x10, &(0x7f0000000540)={{{@in6, @in=@remote}}, {{@in6=@ipv4={[], [], @local}}, 0x0, @in6}}, &(0x7f0000000000)=0xe8)
ioctl$BINDER_SET_CONTEXT_MGR(r4, 0x40046207, 0x0)
r5 = dup(r4)
shutdown(r5, 0x1)
prctl$PR_SET_NAME(0xf, &(0x7f0000000380)='/group.stat\x00')
syz_open_dev$binder(&(0x7f0000000880)='/dev/binder#\x00', 0x0, 0x2)
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)})
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, &(0x7f0000000780)})
ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f0000000680)})
creat(&(0x7f00000000c0)='./file0\x00', 0x0)
openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000100)='/group.stat\x00', 0x2761, 0x0)
clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000080), 0xffffffffffffffff)
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000003c0)={0x14, 0x0, &(0x7f0000000680)=[@acquire_done], 0x0, 0x0, 0x0})

05:03:11 executing program 3:
recvmmsg(0xffffffffffffffff, &(0x7f0000003140)=[{{&(0x7f0000001400)=@ipx, 0x80, 0x0}}], 0x1, 0x0, 0x0)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = syz_open_procfs(0x0, &(0x7f00000004c0)='net/rt_cache\x00')
preadv(r0, &(0x7f00000017c0), 0x122, 0x0)

05:03:11 executing program 0:
recvmmsg(0xffffffffffffffff, &(0x7f0000003140)=[{{&(0x7f0000001400)=@ipx, 0x80, 0x0}}], 0x1, 0x0, 0x0)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = syz_open_procfs(0x0, &(0x7f00000004c0)='net/rt_cache\x00')
preadv(r0, &(0x7f00000017c0), 0x123, 0x0)

[  420.673657] binder: release 20100:20102 transaction 823 out, still active
[  420.680665] binder: unexpected work type, 4, not freed
[  420.693066] binder: undelivered TRANSACTION_COMPLETE
[  420.818856] binder: 20331 RLIMIT_NICE not set
[  420.846256] binder: BINDER_SET_CONTEXT_MGR already set
05:03:11 executing program 2:
r0 = syz_open_dev$sndtimer(&(0x7f0000026000)='/dev/snd/timer\x00', 0x0, 0x0)
r1 = dup3(r0, r0, 0x80000)
ioctl$UI_GET_SYSNAME(r1, 0x8040552c, 0x0)
perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8)
r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c)
bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r2, &(0x7f0000000040), 0x0, 0x1}, 0x20)
openat$cgroup_ro(r1, &(0x7f00000004c0)='cpuset.effective_cpus\x00', 0x0, 0x0)
unlink(&(0x7f0000000900)='./file0/file0\x00')
r3 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r4 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r4, 0x0)
ioctl$BINDER_GET_NODE_DEBUG_INFO(r3, 0xc018620b, &(0x7f0000000780))
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f00000000c0)=[@enter_looper], 0x24, 0x0, &(0x7f0000000700)="2ba063fb309ec7fdbfb08e6e91baee7d7d4599fe14129a4d426834556ae420e087d59c0c"})
ioctl$sock_inet_tcp_SIOCOUTQNSD(r1, 0x894b, &(0x7f0000000480))
getsockopt$inet_IP_IPSEC_POLICY(0xffffffffffffffff, 0x0, 0x10, &(0x7f0000000540)={{{@in6, @in=@remote}}, {{@in6=@ipv4={[], [], @local}}, 0x0, @in6}}, &(0x7f0000000000)=0xe8)
ioctl$BINDER_SET_CONTEXT_MGR(r4, 0x40046207, 0x0)
r5 = dup(r4)
shutdown(r5, 0x1)
prctl$PR_SET_NAME(0xf, &(0x7f0000000380)='/group.stat\x00')
syz_open_dev$binder(&(0x7f0000000880)='/dev/binder#\x00', 0x0, 0x2)
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)})
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, &(0x7f0000000780)})
ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f0000000680)})
creat(&(0x7f00000000c0)='./file0\x00', 0x0)
openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000100)='/group.stat\x00', 0x2761, 0x0)
clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000080), 0xffffffffffffffff)
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000003c0)={0x14, 0x0, &(0x7f0000000680)=[@acquire_done], 0x0, 0x0, 0x0})

[  420.868431] binder: 20319:20331 ioctl 40046207 0 returned -16
05:03:11 executing program 1:
r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000200)='/dev/nullb0\x00', 0x5000000084002, 0x0)
mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x200000e, 0x13, r0, 0x0)
r1 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x4000, 0x0)
preadv(r1, &(0x7f0000000040)=[{&(0x7f0000000400)=""/4096, 0x3ffc00}], 0x1d, 0x0)

[  420.980543] binder: 20319:20374 Release 1 refcount change on invalid ref 1 ret -22
[  421.094162] binder: release 20136:20137 transaction 829 out, still active
[  421.105982] binder: unexpected work type, 4, not freed
05:03:11 executing program 5:
r0 = syz_open_dev$sndtimer(&(0x7f0000026000)='/dev/snd/timer\x00', 0x0, 0x0)
r1 = dup3(r0, r0, 0x80000)
ioctl$UI_GET_SYSNAME(r1, 0x8040552c, 0x0)
perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8)
r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c)
bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r2, &(0x7f0000000040), 0x0, 0x1}, 0x20)
openat$cgroup_ro(r1, &(0x7f00000004c0)='cpuset.effective_cpus\x00', 0x0, 0x0)
unlink(&(0x7f0000000900)='./file0/file0\x00')
r3 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r4 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r4, 0x0)
ioctl$BINDER_GET_NODE_DEBUG_INFO(0xffffffffffffffff, 0xc018620b, &(0x7f0000000780))
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f00000000c0)=[@enter_looper], 0x48, 0x0, &(0x7f0000000700)="2ba063fb309ec7fdbfb08e6e91baee7d7d4599fe14129a4d426834556ae420e087d59c0c7be7fcad1abb7e1f8f446f373f611ca1ee9c2231708e18a47bc68a2a79a0b48931f6ff6d"})
ioctl$sock_inet_tcp_SIOCOUTQNSD(r1, 0x894b, &(0x7f0000000480))
getsockopt$inet_IP_IPSEC_POLICY(0xffffffffffffffff, 0x0, 0x10, &(0x7f0000000540)={{{@in6, @in=@remote}}, {{@in6=@ipv4={[], [], @local}}, 0x0, @in6}}, &(0x7f0000000000)=0xe8)
ioctl$BINDER_SET_CONTEXT_MGR(r4, 0x40046207, 0x0)
r5 = dup(r4)
shutdown(r5, 0x1)
prctl$PR_SET_NAME(0xf, &(0x7f0000000380)='/group.stat\x00')
syz_open_dev$binder(&(0x7f0000000880)='/dev/binder#\x00', 0x0, 0x2)
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)})
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, &(0x7f0000000780)})
creat(&(0x7f00000000c0)='./file0\x00', 0x0)
openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000100)='/group.stat\x00', 0x2761, 0x0)
clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000080), 0xffffffffffffffff)
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000003c0)={0x14, 0x0, &(0x7f0000000680)=[@acquire_done], 0x0, 0x0, 0x0})

05:03:11 executing program 0:
recvmmsg(0xffffffffffffffff, &(0x7f0000003140)=[{{&(0x7f0000001400)=@ipx, 0x80, 0x0}}], 0x1, 0x0, 0x0)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = syz_open_procfs(0x0, &(0x7f00000004c0)='net/rt_cache\x00')
preadv(r0, &(0x7f00000017c0), 0x124, 0x0)

05:03:11 executing program 3:
recvmmsg(0xffffffffffffffff, &(0x7f0000003140)=[{{&(0x7f0000001400)=@ipx, 0x80, 0x0}}], 0x1, 0x0, 0x0)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = syz_open_procfs(0x0, &(0x7f00000004c0)='net/rt_cache\x00')
preadv(r0, &(0x7f00000017c0), 0x123, 0x0)

[  421.142173] binder: undelivered TRANSACTION_COMPLETE
05:03:11 executing program 2:
r0 = syz_open_dev$sndtimer(&(0x7f0000026000)='/dev/snd/timer\x00', 0x0, 0x0)
r1 = dup3(r0, r0, 0x80000)
ioctl$UI_GET_SYSNAME(r1, 0x8040552c, 0x0)
perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8)
r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c)
bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r2, &(0x7f0000000040), 0x0, 0x1}, 0x20)
openat$cgroup_ro(r1, &(0x7f00000004c0)='cpuset.effective_cpus\x00', 0x0, 0x0)
unlink(&(0x7f0000000900)='./file0/file0\x00')
r3 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r4 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r4, 0x0)
ioctl$BINDER_GET_NODE_DEBUG_INFO(r3, 0xc018620b, &(0x7f0000000780))
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f00000000c0)=[@enter_looper], 0x36, 0x0, &(0x7f0000000700)="2ba063fb309ec7fdbfb08e6e91baee7d7d4599fe14129a4d426834556ae420e087d59c0c7be7fcad1abb7e1f8f446f373f611ca1ee9c"})
ioctl$sock_inet_tcp_SIOCOUTQNSD(r1, 0x894b, &(0x7f0000000480))
getsockopt$inet_IP_IPSEC_POLICY(0xffffffffffffffff, 0x0, 0x10, &(0x7f0000000540)={{{@in6, @in=@remote}}, {{@in6=@ipv4={[], [], @local}}, 0x0, @in6}}, &(0x7f0000000000)=0xe8)
ioctl$BINDER_SET_CONTEXT_MGR(r4, 0x40046207, 0x0)
r5 = dup(r4)
shutdown(r5, 0x1)
prctl$PR_SET_NAME(0xf, &(0x7f0000000380)='/group.stat\x00')
syz_open_dev$binder(&(0x7f0000000880)='/dev/binder#\x00', 0x0, 0x2)
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)})
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, &(0x7f0000000780)})
ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f0000000680)})
creat(&(0x7f00000000c0)='./file0\x00', 0x0)
openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000100)='/group.stat\x00', 0x2761, 0x0)
clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000080), 0xffffffffffffffff)
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000003c0)={0x14, 0x0, &(0x7f0000000680)=[@acquire_done], 0x0, 0x0, 0x0})

05:03:11 executing program 4:
r0 = syz_open_dev$sndtimer(&(0x7f0000026000)='/dev/snd/timer\x00', 0x0, 0x0)
r1 = dup3(r0, r0, 0x80000)
ioctl$UI_GET_SYSNAME(r1, 0x8040552c, 0x0)
perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8)
r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c)
bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r2, &(0x7f0000000040), 0x0, 0x1}, 0x20)
openat$cgroup_ro(r1, &(0x7f00000004c0)='cpuset.effective_cpus\x00', 0x0, 0x0)
unlink(&(0x7f0000000900)='./file0/file0\x00')
r3 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r4 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r4, 0x0)
ioctl$BINDER_GET_NODE_DEBUG_INFO(0xffffffffffffffff, 0xc018620b, &(0x7f0000000780))
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f00000000c0)=[@enter_looper], 0x48, 0x0, &(0x7f0000000700)="2ba063fb309ec7fdbfb08e6e91baee7d7d4599fe14129a4d426834556ae420e087d59c0c7be7fcad1abb7e1f8f446f373f611ca1ee9c2231708e18a47bc68a2a79a0b48931f6ff6d"})
ioctl$sock_inet_tcp_SIOCOUTQNSD(r1, 0x894b, &(0x7f0000000480))
getsockopt$inet_IP_IPSEC_POLICY(0xffffffffffffffff, 0x0, 0x10, &(0x7f0000000540)={{{@in6, @in=@remote}}, {{@in6=@ipv4={[], [], @local}}, 0x0, @in6}}, &(0x7f0000000000)=0xe8)
ioctl$BINDER_SET_CONTEXT_MGR(r4, 0x40046207, 0x0)
r5 = dup(r4)
shutdown(r5, 0x1)
prctl$PR_SET_NAME(0xf, &(0x7f0000000380)='/group.stat\x00')
syz_open_dev$binder(&(0x7f0000000880)='/dev/binder#\x00', 0x0, 0x2)
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)})
ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f0000000680)})
creat(&(0x7f00000000c0)='./file0\x00', 0x0)
openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000100)='/group.stat\x00', 0x2761, 0x0)
clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000080), 0xffffffffffffffff)
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000003c0)={0x14, 0x0, &(0x7f0000000680)=[@acquire_done], 0x0, 0x0, 0x0})

05:03:11 executing program 0:
recvmmsg(0xffffffffffffffff, &(0x7f0000003140)=[{{&(0x7f0000001400)=@ipx, 0x80, 0x0}}], 0x1, 0x0, 0x0)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = syz_open_procfs(0x0, &(0x7f00000004c0)='net/rt_cache\x00')
preadv(r0, &(0x7f00000017c0), 0x125, 0x0)

05:03:11 executing program 3:
recvmmsg(0xffffffffffffffff, &(0x7f0000003140)=[{{&(0x7f0000001400)=@ipx, 0x80, 0x0}}], 0x1, 0x0, 0x0)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = syz_open_procfs(0x0, &(0x7f00000004c0)='net/rt_cache\x00')
preadv(r0, &(0x7f00000017c0), 0x124, 0x0)

[  421.290527] binder: release 20319:20331 transaction 832 out, still active
[  421.307119] binder: unexpected work type, 4, not freed
[  421.326260] binder: 20590 RLIMIT_NICE not set
[  421.339065] binder: undelivered TRANSACTION_COMPLETE
[  421.364808] binder: BINDER_SET_CONTEXT_MGR already set
05:03:11 executing program 0:
recvmmsg(0xffffffffffffffff, &(0x7f0000003140)=[{{&(0x7f0000001400)=@ipx, 0x80, 0x0}}], 0x1, 0x0, 0x0)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = syz_open_procfs(0x0, &(0x7f00000004c0)='net/rt_cache\x00')
preadv(r0, &(0x7f00000017c0), 0x126, 0x0)

[  421.398331] binder: 20589:20590 ioctl 40046207 0 returned -16
[  421.431422] binder: BINDER_SET_CONTEXT_MGR already set
05:03:11 executing program 2:
r0 = syz_open_dev$sndtimer(&(0x7f0000026000)='/dev/snd/timer\x00', 0x0, 0x0)
r1 = dup3(r0, r0, 0x80000)
ioctl$UI_GET_SYSNAME(r1, 0x8040552c, 0x0)
perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8)
r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c)
bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r2, &(0x7f0000000040), 0x0, 0x1}, 0x20)
openat$cgroup_ro(r1, &(0x7f00000004c0)='cpuset.effective_cpus\x00', 0x0, 0x0)
unlink(&(0x7f0000000900)='./file0/file0\x00')
r3 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r4 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r4, 0x0)
ioctl$BINDER_GET_NODE_DEBUG_INFO(r3, 0xc018620b, &(0x7f0000000780))
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f00000000c0)=[@enter_looper], 0x36, 0x0, &(0x7f0000000700)="2ba063fb309ec7fdbfb08e6e91baee7d7d4599fe14129a4d426834556ae420e087d59c0c7be7fcad1abb7e1f8f446f373f611ca1ee9c"})
ioctl$sock_inet_tcp_SIOCOUTQNSD(r1, 0x894b, &(0x7f0000000480))
getsockopt$inet_IP_IPSEC_POLICY(0xffffffffffffffff, 0x0, 0x10, &(0x7f0000000540)={{{@in6, @in=@remote}}, {{@in6=@ipv4={[], [], @local}}, 0x0, @in6}}, &(0x7f0000000000)=0xe8)
ioctl$BINDER_SET_CONTEXT_MGR(r4, 0x40046207, 0x0)
r5 = dup(r4)
shutdown(r5, 0x1)
prctl$PR_SET_NAME(0xf, &(0x7f0000000380)='/group.stat\x00')
syz_open_dev$binder(&(0x7f0000000880)='/dev/binder#\x00', 0x0, 0x2)
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)})
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, &(0x7f0000000780)})
ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f0000000680)})
creat(&(0x7f00000000c0)='./file0\x00', 0x0)
openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000100)='/group.stat\x00', 0x2761, 0x0)
clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000080), 0xffffffffffffffff)
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000003c0)={0x14, 0x0, &(0x7f0000000680)=[@acquire_done], 0x0, 0x0, 0x0})

05:03:11 executing program 3:
recvmmsg(0xffffffffffffffff, &(0x7f0000003140)=[{{&(0x7f0000001400)=@ipx, 0x80, 0x0}}], 0x1, 0x0, 0x0)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = syz_open_procfs(0x0, &(0x7f00000004c0)='net/rt_cache\x00')
preadv(r0, &(0x7f00000017c0), 0x125, 0x0)

[  421.455687] binder: 20652:20673 ioctl 40046207 0 returned -16
[  421.518542] binder: 20589:20704 BC_INCREFS_DONE node 836 has no pending increfs request
05:03:11 executing program 1:
r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000200)='/dev/nullb0\x00', 0x5000000084002, 0x0)
mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x200000e, 0x13, r0, 0x0)
r1 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x4000, 0x0)
preadv(r1, &(0x7f0000000040)=[{&(0x7f0000000400)=""/4096, 0x3ffc00}], 0x1e, 0x0)

[  421.566671] binder: 20652:20711 Release 1 refcount change on invalid ref 1 ret -22
05:03:11 executing program 0:
recvmmsg(0xffffffffffffffff, &(0x7f0000003140)=[{{&(0x7f0000001400)=@ipx, 0x80, 0x0}}], 0x1, 0x0, 0x0)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = syz_open_procfs(0x0, &(0x7f00000004c0)='net/rt_cache\x00')
preadv(r0, &(0x7f00000017c0), 0x127, 0x0)

[  422.048604] binder: release 20589:20590 transaction 835 out, still active
05:03:12 executing program 5:
r0 = syz_open_dev$sndtimer(&(0x7f0000026000)='/dev/snd/timer\x00', 0x0, 0x0)
r1 = dup3(r0, r0, 0x80000)
ioctl$UI_GET_SYSNAME(r1, 0x8040552c, 0x0)
perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8)
r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c)
bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r2, &(0x7f0000000040), 0x0, 0x1}, 0x20)
openat$cgroup_ro(r1, &(0x7f00000004c0)='cpuset.effective_cpus\x00', 0x0, 0x0)
unlink(&(0x7f0000000900)='./file0/file0\x00')
r3 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r4 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r4, 0x0)
ioctl$BINDER_GET_NODE_DEBUG_INFO(0xffffffffffffffff, 0xc018620b, &(0x7f0000000780))
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f00000000c0)=[@enter_looper], 0x48, 0x0, &(0x7f0000000700)="2ba063fb309ec7fdbfb08e6e91baee7d7d4599fe14129a4d426834556ae420e087d59c0c7be7fcad1abb7e1f8f446f373f611ca1ee9c2231708e18a47bc68a2a79a0b48931f6ff6d"})
ioctl$sock_inet_tcp_SIOCOUTQNSD(r1, 0x894b, &(0x7f0000000480))
getsockopt$inet_IP_IPSEC_POLICY(0xffffffffffffffff, 0x0, 0x10, &(0x7f0000000540)={{{@in6, @in=@remote}}, {{@in6=@ipv4={[], [], @local}}, 0x0, @in6}}, &(0x7f0000000000)=0xe8)
ioctl$BINDER_SET_CONTEXT_MGR(r4, 0x40046207, 0x0)
r5 = dup(r4)
shutdown(r5, 0x1)
prctl$PR_SET_NAME(0xf, &(0x7f0000000380)='/group.stat\x00')
syz_open_dev$binder(&(0x7f0000000880)='/dev/binder#\x00', 0x0, 0x2)
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)})
ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f0000000680)})
creat(&(0x7f00000000c0)='./file0\x00', 0x0)
openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000100)='/group.stat\x00', 0x2761, 0x0)
clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000080), 0xffffffffffffffff)
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000003c0)={0x14, 0x0, &(0x7f0000000680)=[@acquire_done], 0x0, 0x0, 0x0})

05:03:12 executing program 3:
recvmmsg(0xffffffffffffffff, &(0x7f0000003140)=[{{&(0x7f0000001400)=@ipx, 0x80, 0x0}}], 0x1, 0x0, 0x0)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = syz_open_procfs(0x0, &(0x7f00000004c0)='net/rt_cache\x00')
preadv(r0, &(0x7f00000017c0), 0x126, 0x0)

05:03:12 executing program 0:
recvmmsg(0xffffffffffffffff, &(0x7f0000003140)=[{{&(0x7f0000001400)=@ipx, 0x80, 0x0}}], 0x1, 0x0, 0x0)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = syz_open_procfs(0x0, &(0x7f00000004c0)='net/rt_cache\x00')
preadv(r0, &(0x7f00000017c0), 0x128, 0x0)

05:03:12 executing program 1:
r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000200)='/dev/nullb0\x00', 0x5000000084002, 0x0)
mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x200000e, 0x13, r0, 0x0)
r1 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x4000, 0x0)
preadv(r1, &(0x7f0000000040)=[{&(0x7f0000000400)=""/4096, 0x3ffc00}], 0x23, 0x0)

[  422.089787] binder: unexpected work type, 4, not freed
[  422.128405] binder: undelivered TRANSACTION_COMPLETE
[  422.157819] binder: release 19064:19066 transaction 691 out, still active
05:03:12 executing program 4:
r0 = syz_open_dev$sndtimer(&(0x7f0000026000)='/dev/snd/timer\x00', 0x0, 0x0)
r1 = dup3(r0, r0, 0x80000)
ioctl$UI_GET_SYSNAME(r1, 0x8040552c, 0x0)
perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8)
r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c)
bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r2, &(0x7f0000000040), 0x0, 0x1}, 0x20)
openat$cgroup_ro(r1, &(0x7f00000004c0)='cpuset.effective_cpus\x00', 0x0, 0x0)
unlink(&(0x7f0000000900)='./file0/file0\x00')
r3 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r4 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r4, 0x0)
ioctl$BINDER_GET_NODE_DEBUG_INFO(0xffffffffffffffff, 0xc018620b, &(0x7f0000000780))
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f00000000c0)=[@enter_looper], 0x48, 0x0, &(0x7f0000000700)="2ba063fb309ec7fdbfb08e6e91baee7d7d4599fe14129a4d426834556ae420e087d59c0c7be7fcad1abb7e1f8f446f373f611ca1ee9c2231708e18a47bc68a2a79a0b48931f6ff6d"})
ioctl$sock_inet_tcp_SIOCOUTQNSD(r1, 0x894b, &(0x7f0000000480))
getsockopt$inet_IP_IPSEC_POLICY(0xffffffffffffffff, 0x0, 0x10, &(0x7f0000000540)={{{@in6, @in=@remote}}, {{@in6=@ipv4={[], [], @local}}, 0x0, @in6}}, &(0x7f0000000000)=0xe8)
ioctl$BINDER_SET_CONTEXT_MGR(r4, 0x40046207, 0x0)
r5 = dup(r4)
shutdown(r5, 0x1)
prctl$PR_SET_NAME(0xf, &(0x7f0000000380)='/group.stat\x00')
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)})
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, &(0x7f0000000780)})
ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f0000000680)})
creat(&(0x7f00000000c0)='./file0\x00', 0x0)
openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000100)='/group.stat\x00', 0x2761, 0x0)
clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000080), 0xffffffffffffffff)
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000003c0)={0x14, 0x0, &(0x7f0000000680)=[@acquire_done], 0x0, 0x0, 0x0})

05:03:12 executing program 0:
recvmmsg(0xffffffffffffffff, &(0x7f0000003140)=[{{&(0x7f0000001400)=@ipx, 0x80, 0x0}}], 0x1, 0x0, 0x0)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = syz_open_procfs(0x0, &(0x7f00000004c0)='net/rt_cache\x00')
preadv(r0, &(0x7f00000017c0), 0x129, 0x0)

05:03:12 executing program 3:
recvmmsg(0xffffffffffffffff, &(0x7f0000003140)=[{{&(0x7f0000001400)=@ipx, 0x80, 0x0}}], 0x1, 0x0, 0x0)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = syz_open_procfs(0x0, &(0x7f00000004c0)='net/rt_cache\x00')
preadv(r0, &(0x7f00000017c0), 0x127, 0x0)

[  422.237149] binder: unexpected work type, 4, not freed
[  422.242485] binder: undelivered TRANSACTION_COMPLETE
[  422.253015] binder: BINDER_SET_CONTEXT_MGR already set
[  422.296295] binder: 20740:20741 ioctl 40046207 0 returned -16
[  422.302712] binder: release 19118:19119 transaction 703 out, still active
[  422.325663] binder: unexpected work type, 4, not freed
[  422.392211] binder: undelivered TRANSACTION_COMPLETE
[  422.437909] binder: release 20071:20072 transaction 814 out, still active
[  422.445371] binder: 20740:20756 Release 1 refcount change on invalid ref 1 ret -22
05:03:12 executing program 3:
recvmmsg(0xffffffffffffffff, &(0x7f0000003140)=[{{&(0x7f0000001400)=@ipx, 0x80, 0x0}}], 0x1, 0x0, 0x0)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = syz_open_procfs(0x0, &(0x7f00000004c0)='net/rt_cache\x00')
preadv(r0, &(0x7f00000017c0), 0x128, 0x0)

[  422.508626] binder: unexpected work type, 4, not freed
[  422.551223] binder: undelivered TRANSACTION_COMPLETE
[  422.577529] binder: unexpected work type, 4, not freed
[  422.619011] binder: undelivered TRANSACTION_COMPLETE
[  422.670513] binder: unexpected work type, 4, not freed
[  422.769988] binder: undelivered TRANSACTION_COMPLETE
[  422.826426] binder: unexpected work type, 4, not freed
[  422.868882] binder: undelivered TRANSACTION_COMPLETE
[  422.906617] binder: unexpected work type, 4, not freed
[  422.943961] binder: undelivered TRANSACTION_COMPLETE
[  422.949169] binder: unexpected work type, 4, not freed
[  422.984624] binder: unexpected work type, 4, not freed
[  422.990051] binder: unexpected work type, 4, not freed
[  422.996708] binder: unexpected work type, 4, not freed
[  423.010851] binder: unexpected work type, 4, not freed
[  423.486172] device bridge_slave_1 left promiscuous mode
[  423.491693] bridge0: port 2(bridge_slave_1) entered disabled state
[  423.554635] device bridge_slave_0 left promiscuous mode
[  423.560090] bridge0: port 1(bridge_slave_0) entered disabled state
[  423.690599] device hsr_slave_1 left promiscuous mode
[  423.748944] device hsr_slave_0 left promiscuous mode
[  423.808496] team0 (unregistering): Port device team_slave_1 removed
[  423.819775] team0 (unregistering): Port device team_slave_0 removed
[  423.831635] bond0 (unregistering): Releasing backup interface bond_slave_1
[  423.870770] bond0 (unregistering): Releasing backup interface bond_slave_0
[  423.951091] bond0 (unregistering): Released all slaves
[  424.630765] IPVS: ftp: loaded support on port[0] = 21
[  424.737133] chnl_net:caif_netlink_parms(): no params data found
[  424.775907] bridge0: port 1(bridge_slave_0) entered blocking state
[  424.782330] bridge0: port 1(bridge_slave_0) entered disabled state
[  424.789769] device bridge_slave_0 entered promiscuous mode
[  424.797328] bridge0: port 2(bridge_slave_1) entered blocking state
[  424.803894] bridge0: port 2(bridge_slave_1) entered disabled state
[  424.811032] device bridge_slave_1 entered promiscuous mode
[  424.830478] bond0: Enslaving bond_slave_0 as an active interface with an up link
[  424.840308] bond0: Enslaving bond_slave_1 as an active interface with an up link
[  424.872328] team0: Port device team_slave_0 added
[  424.881919] team0: Port device team_slave_1 added
[  424.956178] device hsr_slave_0 entered promiscuous mode
[  425.003960] device hsr_slave_1 entered promiscuous mode
[  425.102243] bridge0: port 2(bridge_slave_1) entered blocking state
[  425.108649] bridge0: port 2(bridge_slave_1) entered forwarding state
[  425.115336] bridge0: port 1(bridge_slave_0) entered blocking state
[  425.121700] bridge0: port 1(bridge_slave_0) entered forwarding state
[  425.138992] bridge0: port 1(bridge_slave_0) entered disabled state
[  425.149293] bridge0: port 2(bridge_slave_1) entered disabled state
[  425.205010] 8021q: adding VLAN 0 to HW filter on device bond0
[  425.217354] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready
[  425.225050] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready
[  425.234465] 8021q: adding VLAN 0 to HW filter on device team0
[  425.244725] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready
[  425.252679] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready
[  425.261957] bridge0: port 1(bridge_slave_0) entered blocking state
[  425.268357] bridge0: port 1(bridge_slave_0) entered forwarding state
[  425.276981] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready
[  425.284925] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready
[  425.292502] bridge0: port 2(bridge_slave_1) entered blocking state
[  425.298900] bridge0: port 2(bridge_slave_1) entered forwarding state
[  425.319912] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network
[  425.329647] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network
[  425.340709] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready
[  425.349777] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready
[  425.358565] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready
[  425.366301] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready
[  425.374179] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready
[  425.381804] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready
[  425.389543] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready
[  425.397468] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready
[  425.405195] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready
[  425.412607] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready
[  425.420538] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready
[  425.427872] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready
[  425.449523] 8021q: adding VLAN 0 to HW filter on device batadv0
[  425.528304] binder_set_nice: 2 callbacks suppressed
[  425.528327] binder: 20875 RLIMIT_NICE not set
[  425.574182] binder: BINDER_SET_CONTEXT_MGR already set
[  425.579568] binder: 20874:20876 ioctl 40046207 0 returned -16
[  425.587733] binder: 20874:20876 Release 1 refcount change on invalid ref 1 ret -22
05:03:16 executing program 2:
r0 = syz_open_dev$sndtimer(&(0x7f0000026000)='/dev/snd/timer\x00', 0x0, 0x0)
r1 = dup3(r0, r0, 0x80000)
ioctl$UI_GET_SYSNAME(r1, 0x8040552c, 0x0)
perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8)
r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c)
bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r2, &(0x7f0000000040), 0x0, 0x1}, 0x20)
openat$cgroup_ro(r1, &(0x7f00000004c0)='cpuset.effective_cpus\x00', 0x0, 0x0)
unlink(&(0x7f0000000900)='./file0/file0\x00')
r3 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r4 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r4, 0x0)
ioctl$BINDER_GET_NODE_DEBUG_INFO(r3, 0xc018620b, &(0x7f0000000780))
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f00000000c0)=[@enter_looper], 0x36, 0x0, &(0x7f0000000700)="2ba063fb309ec7fdbfb08e6e91baee7d7d4599fe14129a4d426834556ae420e087d59c0c7be7fcad1abb7e1f8f446f373f611ca1ee9c"})
ioctl$sock_inet_tcp_SIOCOUTQNSD(r1, 0x894b, &(0x7f0000000480))
getsockopt$inet_IP_IPSEC_POLICY(0xffffffffffffffff, 0x0, 0x10, &(0x7f0000000540)={{{@in6, @in=@remote}}, {{@in6=@ipv4={[], [], @local}}, 0x0, @in6}}, &(0x7f0000000000)=0xe8)
ioctl$BINDER_SET_CONTEXT_MGR(r4, 0x40046207, 0x0)
r5 = dup(r4)
shutdown(r5, 0x1)
prctl$PR_SET_NAME(0xf, &(0x7f0000000380)='/group.stat\x00')
syz_open_dev$binder(&(0x7f0000000880)='/dev/binder#\x00', 0x0, 0x2)
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)})
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, &(0x7f0000000780)})
ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f0000000680)})
creat(&(0x7f00000000c0)='./file0\x00', 0x0)
openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000100)='/group.stat\x00', 0x2761, 0x0)
clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000080), 0xffffffffffffffff)
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000003c0)={0x14, 0x0, &(0x7f0000000680)=[@acquire_done], 0x0, 0x0, 0x0})

05:03:16 executing program 0:
recvmmsg(0xffffffffffffffff, &(0x7f0000003140)=[{{&(0x7f0000001400)=@ipx, 0x80, 0x0}}], 0x1, 0x0, 0x0)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = syz_open_procfs(0x0, &(0x7f00000004c0)='net/rt_cache\x00')
preadv(r0, &(0x7f00000017c0), 0x12a, 0x0)

05:03:16 executing program 5:
r0 = syz_open_dev$sndtimer(&(0x7f0000026000)='/dev/snd/timer\x00', 0x0, 0x0)
r1 = dup3(r0, r0, 0x80000)
ioctl$UI_GET_SYSNAME(r1, 0x8040552c, 0x0)
perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8)
r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c)
bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r2, &(0x7f0000000040), 0x0, 0x1}, 0x20)
openat$cgroup_ro(r1, &(0x7f00000004c0)='cpuset.effective_cpus\x00', 0x0, 0x0)
unlink(&(0x7f0000000900)='./file0/file0\x00')
r3 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r4 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r4, 0x0)
ioctl$BINDER_GET_NODE_DEBUG_INFO(0xffffffffffffffff, 0xc018620b, &(0x7f0000000780))
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f00000000c0)=[@enter_looper], 0x48, 0x0, &(0x7f0000000700)="2ba063fb309ec7fdbfb08e6e91baee7d7d4599fe14129a4d426834556ae420e087d59c0c7be7fcad1abb7e1f8f446f373f611ca1ee9c2231708e18a47bc68a2a79a0b48931f6ff6d"})
ioctl$sock_inet_tcp_SIOCOUTQNSD(r1, 0x894b, &(0x7f0000000480))
getsockopt$inet_IP_IPSEC_POLICY(0xffffffffffffffff, 0x0, 0x10, &(0x7f0000000540)={{{@in6, @in=@remote}}, {{@in6=@ipv4={[], [], @local}}, 0x0, @in6}}, &(0x7f0000000000)=0xe8)
ioctl$BINDER_SET_CONTEXT_MGR(r4, 0x40046207, 0x0)
r5 = dup(r4)
shutdown(r5, 0x1)
prctl$PR_SET_NAME(0xf, &(0x7f0000000380)='/group.stat\x00')
syz_open_dev$binder(&(0x7f0000000880)='/dev/binder#\x00', 0x0, 0x2)
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)})
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, &(0x7f0000000780)})
creat(&(0x7f00000000c0)='./file0\x00', 0x0)
openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000100)='/group.stat\x00', 0x2761, 0x0)
clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000080), 0xffffffffffffffff)
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000003c0)={0x14, 0x0, &(0x7f0000000680)=[@acquire_done], 0x0, 0x0, 0x0})

05:03:16 executing program 3:
recvmmsg(0xffffffffffffffff, &(0x7f0000003140)=[{{&(0x7f0000001400)=@ipx, 0x80, 0x0}}], 0x1, 0x0, 0x0)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = syz_open_procfs(0x0, &(0x7f00000004c0)='net/rt_cache\x00')
preadv(r0, &(0x7f00000017c0), 0x129, 0x0)

05:03:16 executing program 4:
r0 = syz_open_dev$sndtimer(&(0x7f0000026000)='/dev/snd/timer\x00', 0x0, 0x0)
r1 = dup3(r0, r0, 0x80000)
ioctl$UI_GET_SYSNAME(r1, 0x8040552c, 0x0)
perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8)
r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c)
bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r2, &(0x7f0000000040), 0x0, 0x1}, 0x20)
openat$cgroup_ro(r1, &(0x7f00000004c0)='cpuset.effective_cpus\x00', 0x0, 0x0)
unlink(&(0x7f0000000900)='./file0/file0\x00')
r3 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r4 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r4, 0x0)
ioctl$BINDER_GET_NODE_DEBUG_INFO(0xffffffffffffffff, 0xc018620b, &(0x7f0000000780))
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f00000000c0)=[@enter_looper], 0x48, 0x0, &(0x7f0000000700)="2ba063fb309ec7fdbfb08e6e91baee7d7d4599fe14129a4d426834556ae420e087d59c0c7be7fcad1abb7e1f8f446f373f611ca1ee9c2231708e18a47bc68a2a79a0b48931f6ff6d"})
ioctl$sock_inet_tcp_SIOCOUTQNSD(r1, 0x894b, &(0x7f0000000480))
getsockopt$inet_IP_IPSEC_POLICY(0xffffffffffffffff, 0x0, 0x10, &(0x7f0000000540)={{{@in6, @in=@remote}}, {{@in6=@ipv4={[], [], @local}}, 0x0, @in6}}, &(0x7f0000000000)=0xe8)
ioctl$BINDER_SET_CONTEXT_MGR(r4, 0x40046207, 0x0)
r5 = dup(r4)
shutdown(r5, 0x1)
prctl$PR_SET_NAME(0xf, &(0x7f0000000380)='/group.stat\x00')
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)})
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, &(0x7f0000000780)})
ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f0000000680)})
creat(&(0x7f00000000c0)='./file0\x00', 0x0)
openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000100)='/group.stat\x00', 0x2761, 0x0)
clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000080), 0xffffffffffffffff)
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000003c0)={0x14, 0x0, &(0x7f0000000680)=[@acquire_done], 0x0, 0x0, 0x0})

05:03:16 executing program 1:
r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000200)='/dev/nullb0\x00', 0x5000000084002, 0x0)
mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x200000e, 0x13, r0, 0x0)
r1 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x4000, 0x0)
preadv(r1, &(0x7f0000000040)=[{&(0x7f0000000400)=""/4096, 0x3ffc00}], 0xf0, 0x0)

[  426.302329] binder_thread_release: 9 callbacks suppressed
[  426.302340] binder: release 20874:20876 transaction 844 out, still active
[  426.387584] binder: 20881 RLIMIT_NICE not set
05:03:16 executing program 1:
r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000200)='/dev/nullb0\x00', 0x5000000084002, 0x0)
mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x200000e, 0x13, r0, 0x0)
r1 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x4000, 0x0)
preadv(r1, &(0x7f0000000040)=[{&(0x7f0000000400)=""/4096, 0x3ffc00}], 0x1c1, 0x0)

[  426.416249] binder: 20889 RLIMIT_NICE not set
05:03:16 executing program 3:
recvmmsg(0xffffffffffffffff, &(0x7f0000003140)=[{{&(0x7f0000001400)=@ipx, 0x80, 0x0}}], 0x1, 0x0, 0x0)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = syz_open_procfs(0x0, &(0x7f00000004c0)='net/rt_cache\x00')
preadv(r0, &(0x7f00000017c0), 0x12a, 0x0)

[  426.442667] binder: 20892 RLIMIT_NICE not set
[  426.460944] binder: BINDER_SET_CONTEXT_MGR already set
05:03:16 executing program 0:
recvmmsg(0xffffffffffffffff, &(0x7f0000003140)=[{{&(0x7f0000001400)=@ipx, 0x80, 0x0}}], 0x1, 0x0, 0x0)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = syz_open_procfs(0x0, &(0x7f00000004c0)='net/rt_cache\x00')
preadv(r0, &(0x7f00000017c0), 0x12b, 0x0)

[  426.489471] binder: 20887:20889 ioctl 40046207 0 returned -16
[  426.489549] binder: BINDER_SET_CONTEXT_MGR already set
05:03:16 executing program 3:
recvmmsg(0xffffffffffffffff, &(0x7f0000003140)=[{{&(0x7f0000001400)=@ipx, 0x80, 0x0}}], 0x1, 0x0, 0x0)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = syz_open_procfs(0x0, &(0x7f00000004c0)='net/rt_cache\x00')
preadv(r0, &(0x7f00000017c0), 0x12b, 0x0)

[  426.550940] binder: BINDER_SET_CONTEXT_MGR already set
[  426.550965] binder: 20880:20881 ioctl 40046207 0 returned -16
[  426.601279] binder: 20888:20898 ioctl 40046207 0 returned -16
[  426.624648] binder: 20888:20898 Release 1 refcount change on invalid ref 1 ret -22
05:03:17 executing program 0:
recvmmsg(0xffffffffffffffff, &(0x7f0000003140)=[{{&(0x7f0000001400)=@ipx, 0x80, 0x0}}], 0x1, 0x0, 0x0)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = syz_open_procfs(0x0, &(0x7f00000004c0)='net/rt_cache\x00')
preadv(r0, &(0x7f00000017c0), 0x12c, 0x0)

05:03:17 executing program 3:
recvmmsg(0xffffffffffffffff, &(0x7f0000003140)=[{{&(0x7f0000001400)=@ipx, 0x80, 0x0}}], 0x1, 0x0, 0x0)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = syz_open_procfs(0x0, &(0x7f00000004c0)='net/rt_cache\x00')
preadv(r0, &(0x7f00000017c0), 0x12c, 0x0)

[  426.653718] binder: 20887:20918 BC_INCREFS_DONE node 854 has no pending increfs request
[  426.702166] binder_thread_write: 3 callbacks suppressed
[  426.702177] binder: 20887:20918 BC_ACQUIRE_DONE node 854 has no pending acquire request
[  426.991979] binder: release 20880:20895 transaction 847 out, still active
05:03:17 executing program 2:
r0 = syz_open_dev$sndtimer(&(0x7f0000026000)='/dev/snd/timer\x00', 0x0, 0x0)
r1 = dup3(r0, r0, 0x80000)
ioctl$UI_GET_SYSNAME(r1, 0x8040552c, 0x0)
perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8)
r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c)
bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r2, &(0x7f0000000040), 0x0, 0x1}, 0x20)
openat$cgroup_ro(r1, &(0x7f00000004c0)='cpuset.effective_cpus\x00', 0x0, 0x0)
unlink(&(0x7f0000000900)='./file0/file0\x00')
r3 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r4 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r4, 0x0)
ioctl$BINDER_GET_NODE_DEBUG_INFO(r3, 0xc018620b, &(0x7f0000000780))
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f00000000c0)=[@enter_looper], 0x3f, 0x0, &(0x7f0000000700)="2ba063fb309ec7fdbfb08e6e91baee7d7d4599fe14129a4d426834556ae420e087d59c0c7be7fcad1abb7e1f8f446f373f611ca1ee9c2231708e18a47bc68a"})
ioctl$sock_inet_tcp_SIOCOUTQNSD(r1, 0x894b, &(0x7f0000000480))
getsockopt$inet_IP_IPSEC_POLICY(0xffffffffffffffff, 0x0, 0x10, &(0x7f0000000540)={{{@in6, @in=@remote}}, {{@in6=@ipv4={[], [], @local}}, 0x0, @in6}}, &(0x7f0000000000)=0xe8)
ioctl$BINDER_SET_CONTEXT_MGR(r4, 0x40046207, 0x0)
r5 = dup(r4)
shutdown(r5, 0x1)
prctl$PR_SET_NAME(0xf, &(0x7f0000000380)='/group.stat\x00')
syz_open_dev$binder(&(0x7f0000000880)='/dev/binder#\x00', 0x0, 0x2)
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)})
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, &(0x7f0000000780)})
ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f0000000680)})
creat(&(0x7f00000000c0)='./file0\x00', 0x0)
openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000100)='/group.stat\x00', 0x2761, 0x0)
clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000080), 0xffffffffffffffff)
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000003c0)={0x14, 0x0, &(0x7f0000000680)=[@acquire_done], 0x0, 0x0, 0x0})

05:03:17 executing program 3:
recvmmsg(0xffffffffffffffff, &(0x7f0000003140)=[{{&(0x7f0000001400)=@ipx, 0x80, 0x0}}], 0x1, 0x0, 0x0)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = syz_open_procfs(0x0, &(0x7f00000004c0)='net/rt_cache\x00')
preadv(r0, &(0x7f00000017c0), 0x12d, 0x0)

05:03:17 executing program 0:
recvmmsg(0xffffffffffffffff, &(0x7f0000003140)=[{{&(0x7f0000001400)=@ipx, 0x80, 0x0}}], 0x1, 0x0, 0x0)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = syz_open_procfs(0x0, &(0x7f00000004c0)='net/rt_cache\x00')
preadv(r0, &(0x7f00000017c0), 0x12d, 0x0)

05:03:17 executing program 5:
r0 = socket$inet_udplite(0x2, 0x2, 0x88)
ioctl(r0, 0x1000008912, &(0x7f0000000080)="0adc1f123c123f3188b070")
r1 = socket$packet(0x11, 0x1000000002, 0x300)
setsockopt$packet_fanout(r1, 0x107, 0x12, &(0x7f0000000100)={0x0, 0x3}, 0x4)
setsockopt$packet_int(r1, 0x107, 0xa, &(0x7f00000000c0)=0x2, 0x4)
setsockopt$packet_tx_ring(r1, 0x107, 0x5, &(0x7f0000000040)=@req3={0x10000, 0x100000001, 0x10000, 0x1}, 0x1c)
r2 = socket$inet6(0xa, 0x3, 0x84)
connect$inet6(r2, &(0x7f0000000080), 0x1c)
sendmmsg(r2, &(0x7f00000092c0), 0x3fffffffffffe9f, 0x0)

05:03:17 executing program 1:
r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000200)='/dev/nullb0\x00', 0x5000000084002, 0x0)
mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x200000e, 0x13, r0, 0x0)
r1 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x4000, 0x0)
preadv(r1, &(0x7f0000000040)=[{&(0x7f0000000400)=""/4096, 0x3ffc00}], 0x1c2, 0x0)

05:03:17 executing program 4:
r0 = syz_open_dev$sndtimer(&(0x7f0000026000)='/dev/snd/timer\x00', 0x0, 0x0)
r1 = dup3(r0, r0, 0x80000)
ioctl$UI_GET_SYSNAME(r1, 0x8040552c, 0x0)
perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8)
r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c)
bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r2, &(0x7f0000000040), 0x0, 0x1}, 0x20)
openat$cgroup_ro(r1, &(0x7f00000004c0)='cpuset.effective_cpus\x00', 0x0, 0x0)
unlink(&(0x7f0000000900)='./file0/file0\x00')
r3 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r4 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r4, 0x0)
ioctl$BINDER_GET_NODE_DEBUG_INFO(0xffffffffffffffff, 0xc018620b, &(0x7f0000000780))
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f00000000c0)=[@enter_looper], 0x48, 0x0, &(0x7f0000000700)="2ba063fb309ec7fdbfb08e6e91baee7d7d4599fe14129a4d426834556ae420e087d59c0c7be7fcad1abb7e1f8f446f373f611ca1ee9c2231708e18a47bc68a2a79a0b48931f6ff6d"})
ioctl$sock_inet_tcp_SIOCOUTQNSD(r1, 0x894b, &(0x7f0000000480))
getsockopt$inet_IP_IPSEC_POLICY(0xffffffffffffffff, 0x0, 0x10, &(0x7f0000000540)={{{@in6, @in=@remote}}, {{@in6=@ipv4={[], [], @local}}, 0x0, @in6}}, &(0x7f0000000000)=0xe8)
ioctl$BINDER_SET_CONTEXT_MGR(r4, 0x40046207, 0x0)
r5 = dup(r4)
shutdown(r5, 0x1)
prctl$PR_SET_NAME(0xf, &(0x7f0000000380)='/group.stat\x00')
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)})
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, &(0x7f0000000780)})
ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f0000000680)})
creat(&(0x7f00000000c0)='./file0\x00', 0x0)
openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000100)='/group.stat\x00', 0x2761, 0x0)
clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000080), 0xffffffffffffffff)
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000003c0)={0x14, 0x0, &(0x7f0000000680)=[@acquire_done], 0x0, 0x0, 0x0})

[  427.185670] binder: release 20888:20902 transaction 848 out, still active
[  427.289427] binder: 21042 RLIMIT_NICE not set
[  427.296971] binder: 21043 RLIMIT_NICE not set
[  427.312876] binder: BINDER_SET_CONTEXT_MGR already set
[  427.323805] binder: 21041:21042 ioctl 40046207 0 returned -16
05:03:17 executing program 0:
recvmmsg(0xffffffffffffffff, &(0x7f0000003140)=[{{&(0x7f0000001400)=@ipx, 0x80, 0x0}}], 0x1, 0x0, 0x0)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = syz_open_procfs(0x0, &(0x7f00000004c0)='net/rt_cache\x00')
preadv(r0, &(0x7f00000017c0), 0x12e, 0x0)

05:03:17 executing program 3:
recvmmsg(0xffffffffffffffff, &(0x7f0000003140)=[{{&(0x7f0000001400)=@ipx, 0x80, 0x0}}], 0x1, 0x0, 0x0)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = syz_open_procfs(0x0, &(0x7f00000004c0)='net/rt_cache\x00')
preadv(r0, &(0x7f00000017c0), 0x12e, 0x0)

[  427.343248] binder: BINDER_SET_CONTEXT_MGR already set
[  427.367675] binder: 21040:21046 ioctl 40046207 0 returned -16
[  427.400890] binder: 21041:21052 BC_INCREFS_DONE node 857 has no pending increfs request
05:03:17 executing program 0:
recvmmsg(0xffffffffffffffff, &(0x7f0000003140)=[{{&(0x7f0000001400)=@ipx, 0x80, 0x0}}], 0x1, 0x0, 0x0)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = syz_open_procfs(0x0, &(0x7f00000004c0)='net/rt_cache\x00')
preadv(r0, &(0x7f00000017c0), 0x12f, 0x0)

[  427.432985] binder: 21040:21046 Release 1 refcount change on invalid ref 1 ret -22
05:03:17 executing program 3:
recvmmsg(0xffffffffffffffff, &(0x7f0000003140)=[{{&(0x7f0000001400)=@ipx, 0x80, 0x0}}], 0x1, 0x0, 0x0)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = syz_open_procfs(0x0, &(0x7f00000004c0)='net/rt_cache\x00')
preadv(r0, &(0x7f00000017c0), 0x12f, 0x0)

05:03:17 executing program 0:
recvmmsg(0xffffffffffffffff, &(0x7f0000003140)=[{{&(0x7f0000001400)=@ipx, 0x80, 0x0}}], 0x1, 0x0, 0x0)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = syz_open_procfs(0x0, &(0x7f00000004c0)='net/rt_cache\x00')
preadv(r0, &(0x7f00000017c0), 0x130, 0x0)

05:03:17 executing program 3:
recvmmsg(0xffffffffffffffff, &(0x7f0000003140)=[{{&(0x7f0000001400)=@ipx, 0x80, 0x0}}], 0x1, 0x0, 0x0)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = syz_open_procfs(0x0, &(0x7f00000004c0)='net/rt_cache\x00')
preadv(r0, &(0x7f00000017c0), 0x130, 0x0)

[  427.662443] binder: release 21041:21042 transaction 856 out, still active
[  427.675598] binder: unexpected work type, 4, not freed
[  427.699559] binder_release_work: 5 callbacks suppressed
[  427.699593] binder: undelivered TRANSACTION_COMPLETE
[  427.833717] protocol 88fb is buggy, dev hsr_slave_0
[  427.838866] protocol 88fb is buggy, dev hsr_slave_1
05:03:18 executing program 2:
r0 = syz_open_dev$sndtimer(&(0x7f0000026000)='/dev/snd/timer\x00', 0x0, 0x0)
r1 = dup3(r0, r0, 0x80000)
ioctl$UI_GET_SYSNAME(r1, 0x8040552c, 0x0)
perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8)
r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c)
bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r2, &(0x7f0000000040), 0x0, 0x1}, 0x20)
openat$cgroup_ro(r1, &(0x7f00000004c0)='cpuset.effective_cpus\x00', 0x0, 0x0)
unlink(&(0x7f0000000900)='./file0/file0\x00')
r3 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r4 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r4, 0x0)
ioctl$BINDER_GET_NODE_DEBUG_INFO(r3, 0xc018620b, &(0x7f0000000780))
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f00000000c0)=[@enter_looper], 0x3f, 0x0, &(0x7f0000000700)="2ba063fb309ec7fdbfb08e6e91baee7d7d4599fe14129a4d426834556ae420e087d59c0c7be7fcad1abb7e1f8f446f373f611ca1ee9c2231708e18a47bc68a"})
ioctl$sock_inet_tcp_SIOCOUTQNSD(r1, 0x894b, &(0x7f0000000480))
getsockopt$inet_IP_IPSEC_POLICY(0xffffffffffffffff, 0x0, 0x10, &(0x7f0000000540)={{{@in6, @in=@remote}}, {{@in6=@ipv4={[], [], @local}}, 0x0, @in6}}, &(0x7f0000000000)=0xe8)
ioctl$BINDER_SET_CONTEXT_MGR(r4, 0x40046207, 0x0)
r5 = dup(r4)
shutdown(r5, 0x1)
prctl$PR_SET_NAME(0xf, &(0x7f0000000380)='/group.stat\x00')
syz_open_dev$binder(&(0x7f0000000880)='/dev/binder#\x00', 0x0, 0x2)
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)})
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, &(0x7f0000000780)})
ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f0000000680)})
creat(&(0x7f00000000c0)='./file0\x00', 0x0)
openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000100)='/group.stat\x00', 0x2761, 0x0)
clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000080), 0xffffffffffffffff)
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000003c0)={0x14, 0x0, &(0x7f0000000680)=[@acquire_done], 0x0, 0x0, 0x0})

05:03:18 executing program 4:
r0 = syz_open_dev$sndtimer(&(0x7f0000026000)='/dev/snd/timer\x00', 0x0, 0x0)
r1 = dup3(r0, r0, 0x80000)
ioctl$UI_GET_SYSNAME(r1, 0x8040552c, 0x0)
perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8)
r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c)
bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r2, &(0x7f0000000040), 0x0, 0x1}, 0x20)
openat$cgroup_ro(r1, &(0x7f00000004c0)='cpuset.effective_cpus\x00', 0x0, 0x0)
unlink(&(0x7f0000000900)='./file0/file0\x00')
r3 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r4 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r4, 0x0)
ioctl$BINDER_GET_NODE_DEBUG_INFO(0xffffffffffffffff, 0xc018620b, &(0x7f0000000780))
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f00000000c0)=[@enter_looper], 0x48, 0x0, &(0x7f0000000700)="2ba063fb309ec7fdbfb08e6e91baee7d7d4599fe14129a4d426834556ae420e087d59c0c7be7fcad1abb7e1f8f446f373f611ca1ee9c2231708e18a47bc68a2a79a0b48931f6ff6d"})
ioctl$sock_inet_tcp_SIOCOUTQNSD(r1, 0x894b, &(0x7f0000000480))
getsockopt$inet_IP_IPSEC_POLICY(0xffffffffffffffff, 0x0, 0x10, &(0x7f0000000540)={{{@in6, @in=@remote}}, {{@in6=@ipv4={[], [], @local}}, 0x0, @in6}}, &(0x7f0000000000)=0xe8)
ioctl$BINDER_SET_CONTEXT_MGR(r4, 0x40046207, 0x0)
r5 = dup(r4)
shutdown(r5, 0x1)
syz_open_dev$binder(&(0x7f0000000880)='/dev/binder#\x00', 0x0, 0x2)
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)})
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, &(0x7f0000000780)})
ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f0000000680)})
creat(&(0x7f00000000c0)='./file0\x00', 0x0)
openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000100)='/group.stat\x00', 0x2761, 0x0)
clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000080), 0xffffffffffffffff)
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000003c0)={0x14, 0x0, &(0x7f0000000680)=[@acquire_done], 0x0, 0x0, 0x0})

05:03:18 executing program 3:
recvmmsg(0xffffffffffffffff, &(0x7f0000003140)=[{{&(0x7f0000001400)=@ipx, 0x80, 0x0}}], 0x1, 0x0, 0x0)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = syz_open_procfs(0x0, &(0x7f00000004c0)='net/rt_cache\x00')
preadv(r0, &(0x7f00000017c0), 0x131, 0x0)

[  428.040368] binder: release 21040:21046 transaction 859 out, still active
[  428.111665] binder: 21185 RLIMIT_NICE not set
[  428.124888] binder: 21188 RLIMIT_NICE not set
[  428.148355] binder: BINDER_SET_CONTEXT_MGR already set
05:03:18 executing program 5:

05:03:18 executing program 0:
recvmmsg(0xffffffffffffffff, &(0x7f0000003140)=[{{&(0x7f0000001400)=@ipx, 0x80, 0x0}}], 0x1, 0x0, 0x0)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = syz_open_procfs(0x0, &(0x7f00000004c0)='net/rt_cache\x00')
preadv(r0, &(0x7f00000017c0), 0x131, 0x0)

05:03:18 executing program 1:
r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000200)='/dev/nullb0\x00', 0x5000000084002, 0x0)
mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x200000e, 0x13, r0, 0x0)
r1 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x4000, 0x0)
preadv(r1, &(0x7f0000000040)=[{&(0x7f0000000400)=""/4096, 0x3ffc00}], 0x1c3, 0x0)

05:03:18 executing program 3:
recvmmsg(0xffffffffffffffff, &(0x7f0000003140)=[{{&(0x7f0000001400)=@ipx, 0x80, 0x0}}], 0x1, 0x0, 0x0)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = syz_open_procfs(0x0, &(0x7f00000004c0)='net/rt_cache\x00')
preadv(r0, &(0x7f00000017c0), 0x132, 0x0)

[  428.161054] binder: 21183:21185 ioctl 40046207 0 returned -16
[  428.178288] binder: BINDER_SET_CONTEXT_MGR already set
05:03:18 executing program 5:

[  428.223419] binder: 21187:21192 ioctl 40046207 0 returned -16
[  428.254035] binder: 21183:21203 BC_INCREFS_DONE node 863 has no pending increfs request
05:03:18 executing program 3:
recvmmsg(0xffffffffffffffff, &(0x7f0000003140)=[{{&(0x7f0000001400)=@ipx, 0x80, 0x0}}], 0x1, 0x0, 0x0)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = syz_open_procfs(0x0, &(0x7f00000004c0)='net/rt_cache\x00')
preadv(r0, &(0x7f00000017c0), 0x133, 0x0)

05:03:18 executing program 0:
recvmmsg(0xffffffffffffffff, &(0x7f0000003140)=[{{&(0x7f0000001400)=@ipx, 0x80, 0x0}}], 0x1, 0x0, 0x0)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = syz_open_procfs(0x0, &(0x7f00000004c0)='net/rt_cache\x00')
preadv(r0, &(0x7f00000017c0), 0x132, 0x0)

05:03:18 executing program 5:

[  428.278855] binder: 21187:21192 Release 1 refcount change on invalid ref 1 ret -22
[  428.287463] binder: 21183:21203 Release 1 refcount change on invalid ref 1 ret -22
[  428.305082] binder: 21183:21203 BC_ACQUIRE_DONE node 863 has no pending acquire request
05:03:18 executing program 3:
recvmmsg(0xffffffffffffffff, &(0x7f0000003140)=[{{&(0x7f0000001400)=@ipx, 0x80, 0x0}}], 0x1, 0x0, 0x0)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = syz_open_procfs(0x0, &(0x7f00000004c0)='net/rt_cache\x00')
preadv(r0, &(0x7f00000017c0), 0x134, 0x0)

05:03:19 executing program 2:
r0 = syz_open_dev$sndtimer(&(0x7f0000026000)='/dev/snd/timer\x00', 0x0, 0x0)
r1 = dup3(r0, r0, 0x80000)
ioctl$UI_GET_SYSNAME(r1, 0x8040552c, 0x0)
perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8)
r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c)
bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r2, &(0x7f0000000040), 0x0, 0x1}, 0x20)
openat$cgroup_ro(r1, &(0x7f00000004c0)='cpuset.effective_cpus\x00', 0x0, 0x0)
unlink(&(0x7f0000000900)='./file0/file0\x00')
r3 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r4 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r4, 0x0)
ioctl$BINDER_GET_NODE_DEBUG_INFO(r3, 0xc018620b, &(0x7f0000000780))
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f00000000c0)=[@enter_looper], 0x3f, 0x0, &(0x7f0000000700)="2ba063fb309ec7fdbfb08e6e91baee7d7d4599fe14129a4d426834556ae420e087d59c0c7be7fcad1abb7e1f8f446f373f611ca1ee9c2231708e18a47bc68a"})
ioctl$sock_inet_tcp_SIOCOUTQNSD(r1, 0x894b, &(0x7f0000000480))
getsockopt$inet_IP_IPSEC_POLICY(0xffffffffffffffff, 0x0, 0x10, &(0x7f0000000540)={{{@in6, @in=@remote}}, {{@in6=@ipv4={[], [], @local}}, 0x0, @in6}}, &(0x7f0000000000)=0xe8)
ioctl$BINDER_SET_CONTEXT_MGR(r4, 0x40046207, 0x0)
r5 = dup(r4)
shutdown(r5, 0x1)
prctl$PR_SET_NAME(0xf, &(0x7f0000000380)='/group.stat\x00')
syz_open_dev$binder(&(0x7f0000000880)='/dev/binder#\x00', 0x0, 0x2)
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)})
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, &(0x7f0000000780)})
ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f0000000680)})
creat(&(0x7f00000000c0)='./file0\x00', 0x0)
openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000100)='/group.stat\x00', 0x2761, 0x0)
clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000080), 0xffffffffffffffff)
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000003c0)={0x14, 0x0, &(0x7f0000000680)=[@acquire_done], 0x0, 0x0, 0x0})

05:03:19 executing program 0:
recvmmsg(0xffffffffffffffff, &(0x7f0000003140)=[{{&(0x7f0000001400)=@ipx, 0x80, 0x0}}], 0x1, 0x0, 0x0)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = syz_open_procfs(0x0, &(0x7f00000004c0)='net/rt_cache\x00')
preadv(r0, &(0x7f00000017c0), 0x133, 0x0)

05:03:19 executing program 5:

05:03:19 executing program 3:
recvmmsg(0xffffffffffffffff, &(0x7f0000003140)=[{{&(0x7f0000001400)=@ipx, 0x80, 0x0}}], 0x1, 0x0, 0x0)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = syz_open_procfs(0x0, &(0x7f00000004c0)='net/rt_cache\x00')
preadv(r0, &(0x7f00000017c0), 0x135, 0x0)

05:03:19 executing program 1:
r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000200)='/dev/nullb0\x00', 0x5000000084002, 0x0)
mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x200000e, 0x13, r0, 0x0)
r1 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x4000, 0x0)
preadv(r1, &(0x7f0000000040)=[{&(0x7f0000000400)=""/4096, 0x3ffc00}], 0x1c4, 0x0)

05:03:19 executing program 4:
r0 = syz_open_dev$sndtimer(&(0x7f0000026000)='/dev/snd/timer\x00', 0x0, 0x0)
r1 = dup3(r0, r0, 0x80000)
ioctl$UI_GET_SYSNAME(r1, 0x8040552c, 0x0)
perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8)
r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c)
bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r2, &(0x7f0000000040), 0x0, 0x1}, 0x20)
openat$cgroup_ro(r1, &(0x7f00000004c0)='cpuset.effective_cpus\x00', 0x0, 0x0)
unlink(&(0x7f0000000900)='./file0/file0\x00')
r3 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r4 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r4, 0x0)
ioctl$BINDER_GET_NODE_DEBUG_INFO(0xffffffffffffffff, 0xc018620b, &(0x7f0000000780))
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f00000000c0)=[@enter_looper], 0x48, 0x0, &(0x7f0000000700)="2ba063fb309ec7fdbfb08e6e91baee7d7d4599fe14129a4d426834556ae420e087d59c0c7be7fcad1abb7e1f8f446f373f611ca1ee9c2231708e18a47bc68a2a79a0b48931f6ff6d"})
ioctl$sock_inet_tcp_SIOCOUTQNSD(r1, 0x894b, &(0x7f0000000480))
getsockopt$inet_IP_IPSEC_POLICY(0xffffffffffffffff, 0x0, 0x10, &(0x7f0000000540)={{{@in6, @in=@remote}}, {{@in6=@ipv4={[], [], @local}}, 0x0, @in6}}, &(0x7f0000000000)=0xe8)
ioctl$BINDER_SET_CONTEXT_MGR(r4, 0x40046207, 0x0)
r5 = dup(r4)
shutdown(r5, 0x1)
syz_open_dev$binder(&(0x7f0000000880)='/dev/binder#\x00', 0x0, 0x2)
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)})
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, &(0x7f0000000780)})
ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f0000000680)})
creat(&(0x7f00000000c0)='./file0\x00', 0x0)
openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000100)='/group.stat\x00', 0x2761, 0x0)
clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000080), 0xffffffffffffffff)
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000003c0)={0x14, 0x0, &(0x7f0000000680)=[@acquire_done], 0x0, 0x0, 0x0})

[  428.869836] binder: release 21183:21185 transaction 862 out, still active
[  428.885538] binder: release 21187:21192 transaction 865 out, still active
05:03:19 executing program 5:

[  428.997659] binder: 21240 RLIMIT_NICE not set
05:03:19 executing program 3:
recvmmsg(0xffffffffffffffff, &(0x7f0000003140)=[{{&(0x7f0000001400)=@ipx, 0x80, 0x0}}], 0x1, 0x0, 0x0)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = syz_open_procfs(0x0, &(0x7f00000004c0)='net/rt_cache\x00')
preadv(r0, &(0x7f00000017c0), 0x136, 0x0)

05:03:19 executing program 0:
recvmmsg(0xffffffffffffffff, &(0x7f0000003140)=[{{&(0x7f0000001400)=@ipx, 0x80, 0x0}}], 0x1, 0x0, 0x0)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = syz_open_procfs(0x0, &(0x7f00000004c0)='net/rt_cache\x00')
preadv(r0, &(0x7f00000017c0), 0x134, 0x0)

[  429.038023] binder: BINDER_SET_CONTEXT_MGR already set
[  429.046888] binder: 21243 RLIMIT_NICE not set
[  429.077273] binder: 21239:21240 ioctl 40046207 0 returned -16
[  429.093074] binder: BINDER_SET_CONTEXT_MGR already set
05:03:19 executing program 5:

05:03:19 executing program 0:
recvmmsg(0xffffffffffffffff, &(0x7f0000003140)=[{{&(0x7f0000001400)=@ipx, 0x80, 0x0}}], 0x1, 0x0, 0x0)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = syz_open_procfs(0x0, &(0x7f00000004c0)='net/rt_cache\x00')
preadv(r0, &(0x7f00000017c0), 0x135, 0x0)

[  429.119946] binder: 21242:21248 ioctl 40046207 0 returned -16
[  429.151206] binder: 21242:21248 Release 1 refcount change on invalid ref 1 ret -22
[  429.175525] binder: 21239:21254 BC_INCREFS_DONE node 869 has no pending increfs request
[  429.214492] binder: 21239:21254 Release 1 refcount change on invalid ref 1 ret -22
05:03:19 executing program 5:
perf_event_open(&(0x7f000001d000)={0x2, 0x70, 0x41, 0x8001, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
sched_setaffinity(0x0, 0x0, 0x0)
r0 = socket$inet6_udp(0xa, 0x2, 0x0)
setsockopt$inet6_IPV6_FLOWLABEL_MGR(r0, 0x29, 0x20, &(0x7f0000000100)={@dev, 0x9, 0x1, 0x0, 0x0, 0x0, 0x3}, 0x20)

[  429.239571] binder: 21239:21254 BC_ACQUIRE_DONE node 869 has no pending acquire request
[  429.763991] binder: release 21239:21240 transaction 868 out, still active
[  429.770949] binder: unexpected work type, 4, not freed
[  429.787186] binder: undelivered TRANSACTION_COMPLETE
05:03:20 executing program 2:
r0 = syz_open_dev$sndtimer(&(0x7f0000026000)='/dev/snd/timer\x00', 0x0, 0x0)
r1 = dup3(r0, r0, 0x80000)
ioctl$UI_GET_SYSNAME(r1, 0x8040552c, 0x0)
perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8)
r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c)
bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r2, &(0x7f0000000040), 0x0, 0x1}, 0x20)
openat$cgroup_ro(r1, &(0x7f00000004c0)='cpuset.effective_cpus\x00', 0x0, 0x0)
unlink(&(0x7f0000000900)='./file0/file0\x00')
r3 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r4 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r4, 0x0)
ioctl$BINDER_GET_NODE_DEBUG_INFO(r3, 0xc018620b, &(0x7f0000000780))
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f00000000c0)=[@enter_looper], 0x44, 0x0, &(0x7f0000000700)="2ba063fb309ec7fdbfb08e6e91baee7d7d4599fe14129a4d426834556ae420e087d59c0c7be7fcad1abb7e1f8f446f373f611ca1ee9c2231708e18a47bc68a2a79a0b489"})
ioctl$sock_inet_tcp_SIOCOUTQNSD(r1, 0x894b, &(0x7f0000000480))
getsockopt$inet_IP_IPSEC_POLICY(0xffffffffffffffff, 0x0, 0x10, &(0x7f0000000540)={{{@in6, @in=@remote}}, {{@in6=@ipv4={[], [], @local}}, 0x0, @in6}}, &(0x7f0000000000)=0xe8)
ioctl$BINDER_SET_CONTEXT_MGR(r4, 0x40046207, 0x0)
r5 = dup(r4)
shutdown(r5, 0x1)
prctl$PR_SET_NAME(0xf, &(0x7f0000000380)='/group.stat\x00')
syz_open_dev$binder(&(0x7f0000000880)='/dev/binder#\x00', 0x0, 0x2)
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)})
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, &(0x7f0000000780)})
ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f0000000680)})
creat(&(0x7f00000000c0)='./file0\x00', 0x0)
openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000100)='/group.stat\x00', 0x2761, 0x0)
clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000080), 0xffffffffffffffff)
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000003c0)={0x14, 0x0, &(0x7f0000000680)=[@acquire_done], 0x0, 0x0, 0x0})

05:03:20 executing program 0:
recvmmsg(0xffffffffffffffff, &(0x7f0000003140)=[{{&(0x7f0000001400)=@ipx, 0x80, 0x0}}], 0x1, 0x0, 0x0)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = syz_open_procfs(0x0, &(0x7f00000004c0)='net/rt_cache\x00')
preadv(r0, &(0x7f00000017c0), 0x136, 0x0)

05:03:20 executing program 5:
capget(&(0x7f0000000040)={0x19980330}, &(0x7f0000003840))

05:03:20 executing program 1:
r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000200)='/dev/nullb0\x00', 0x5000000084002, 0x0)
mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x200000e, 0x13, r0, 0x0)
r1 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x4000, 0x0)
preadv(r1, &(0x7f0000000040)=[{&(0x7f0000000400)=""/4096, 0x3ffc00}], 0x1c5, 0x0)

05:03:20 executing program 3:
recvmmsg(0xffffffffffffffff, &(0x7f0000003140)=[{{&(0x7f0000001400)=@ipx, 0x80, 0x0}}], 0x1, 0x0, 0x0)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = syz_open_procfs(0x0, &(0x7f00000004c0)='net/rt_cache\x00')
preadv(r0, &(0x7f00000017c0), 0x137, 0x0)

05:03:20 executing program 4:
r0 = syz_open_dev$sndtimer(&(0x7f0000026000)='/dev/snd/timer\x00', 0x0, 0x0)
r1 = dup3(r0, r0, 0x80000)
ioctl$UI_GET_SYSNAME(r1, 0x8040552c, 0x0)
perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8)
r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c)
bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r2, &(0x7f0000000040), 0x0, 0x1}, 0x20)
openat$cgroup_ro(r1, &(0x7f00000004c0)='cpuset.effective_cpus\x00', 0x0, 0x0)
unlink(&(0x7f0000000900)='./file0/file0\x00')
r3 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r4 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r4, 0x0)
ioctl$BINDER_GET_NODE_DEBUG_INFO(0xffffffffffffffff, 0xc018620b, &(0x7f0000000780))
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f00000000c0)=[@enter_looper], 0x48, 0x0, &(0x7f0000000700)="2ba063fb309ec7fdbfb08e6e91baee7d7d4599fe14129a4d426834556ae420e087d59c0c7be7fcad1abb7e1f8f446f373f611ca1ee9c2231708e18a47bc68a2a79a0b48931f6ff6d"})
ioctl$sock_inet_tcp_SIOCOUTQNSD(r1, 0x894b, &(0x7f0000000480))
getsockopt$inet_IP_IPSEC_POLICY(0xffffffffffffffff, 0x0, 0x10, &(0x7f0000000540)={{{@in6, @in=@remote}}, {{@in6=@ipv4={[], [], @local}}, 0x0, @in6}}, &(0x7f0000000000)=0xe8)
ioctl$BINDER_SET_CONTEXT_MGR(r4, 0x40046207, 0x0)
r5 = dup(r4)
shutdown(r5, 0x1)
syz_open_dev$binder(&(0x7f0000000880)='/dev/binder#\x00', 0x0, 0x2)
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)})
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, &(0x7f0000000780)})
ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f0000000680)})
creat(&(0x7f00000000c0)='./file0\x00', 0x0)
openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000100)='/group.stat\x00', 0x2761, 0x0)
clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000080), 0xffffffffffffffff)
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000003c0)={0x14, 0x0, &(0x7f0000000680)=[@acquire_done], 0x0, 0x0, 0x0})

[  429.823876] binder: release 21242:21248 transaction 871 out, still active
05:03:20 executing program 5:
r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.cpu\x00', 0x200002, 0x0)
r1 = socket$nl_route(0x10, 0x3, 0x0)
r2 = socket$inet(0x2, 0x3, 0x2)
r3 = dup2(r2, r1)
r4 = openat$cgroup_int(r0, &(0x7f0000000040)='cpuset.cpus\x00', 0x2, 0x0)
sendfile(r3, r4, 0x0, 0x26624522)

[  429.921753] binder: BINDER_SET_CONTEXT_MGR already set
05:03:20 executing program 3:
recvmmsg(0xffffffffffffffff, &(0x7f0000003140)=[{{&(0x7f0000001400)=@ipx, 0x80, 0x0}}], 0x1, 0x0, 0x0)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = syz_open_procfs(0x0, &(0x7f00000004c0)='net/rt_cache\x00')
preadv(r0, &(0x7f00000017c0), 0x138, 0x0)

05:03:20 executing program 0:
recvmmsg(0xffffffffffffffff, &(0x7f0000003140)=[{{&(0x7f0000001400)=@ipx, 0x80, 0x0}}], 0x1, 0x0, 0x0)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = syz_open_procfs(0x0, &(0x7f00000004c0)='net/rt_cache\x00')
preadv(r0, &(0x7f00000017c0), 0x137, 0x0)

[  429.962268] binder: 21275:21283 ioctl 40046207 0 returned -16
[  430.037295] binder: BINDER_SET_CONTEXT_MGR already set
[  430.042708] binder: 21288:21298 ioctl 40046207 0 returned -16
[  430.065557] binder: 21275:21292 BC_INCREFS_DONE node 875 has no pending increfs request
05:03:20 executing program 5:
r0 = openat$ptmx(0xffffffffffffff9c, 0x0, 0x0, 0x0)
read(r0, &(0x7f00000008c0)=""/11, 0xb)
ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000100))
ioctl$TIOCSLCKTRMIOS(r0, 0x5457, 0x0)
ioctl$KDGKBSENT(r0, 0x4b48, 0x0)
r1 = socket$inet6_tcp(0xa, 0x1, 0x0)
execve(&(0x7f0000000400)='./file0\x00', 0x0, 0x0)
r2 = creat(&(0x7f0000000080)='\xe9\x1fq\x89Y\x1e\x923aK\x00', 0x109)
dup2(r1, r2)
execve(&(0x7f00000002c0)='\xe9\x1fq\x89Y\x1e\x923aK\x00', 0x0, 0x0)
open$dir(&(0x7f00000000c0)='./file0\x00', 0x841, 0x0)

05:03:20 executing program 0:
recvmmsg(0xffffffffffffffff, &(0x7f0000003140)=[{{&(0x7f0000001400)=@ipx, 0x80, 0x0}}], 0x1, 0x0, 0x0)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = syz_open_procfs(0x0, &(0x7f00000004c0)='net/rt_cache\x00')
preadv(r0, &(0x7f00000017c0), 0x138, 0x0)

[  430.102717] binder: 21275:21292 Release 1 refcount change on invalid ref 1 ret -22
[  430.123822] binder: 21288:21298 Release 1 refcount change on invalid ref 1 ret -22
05:03:20 executing program 3:
recvmmsg(0xffffffffffffffff, &(0x7f0000003140)=[{{&(0x7f0000001400)=@ipx, 0x80, 0x0}}], 0x1, 0x0, 0x0)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = syz_open_procfs(0x0, &(0x7f00000004c0)='net/rt_cache\x00')
preadv(r0, &(0x7f00000017c0), 0x139, 0x0)

[  430.365450] binder: release 21275:21283 transaction 874 out, still active
[  430.374670] binder: unexpected work type, 4, not freed
[  430.424098] binder: undelivered TRANSACTION_COMPLETE
05:03:21 executing program 2:
r0 = syz_open_dev$sndtimer(&(0x7f0000026000)='/dev/snd/timer\x00', 0x0, 0x0)
r1 = dup3(r0, r0, 0x80000)
ioctl$UI_GET_SYSNAME(r1, 0x8040552c, 0x0)
perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8)
r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c)
bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r2, &(0x7f0000000040), 0x0, 0x1}, 0x20)
openat$cgroup_ro(r1, &(0x7f00000004c0)='cpuset.effective_cpus\x00', 0x0, 0x0)
unlink(&(0x7f0000000900)='./file0/file0\x00')
r3 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r4 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r4, 0x0)
ioctl$BINDER_GET_NODE_DEBUG_INFO(r3, 0xc018620b, &(0x7f0000000780))
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f00000000c0)=[@enter_looper], 0x44, 0x0, &(0x7f0000000700)="2ba063fb309ec7fdbfb08e6e91baee7d7d4599fe14129a4d426834556ae420e087d59c0c7be7fcad1abb7e1f8f446f373f611ca1ee9c2231708e18a47bc68a2a79a0b489"})
ioctl$sock_inet_tcp_SIOCOUTQNSD(r1, 0x894b, &(0x7f0000000480))
getsockopt$inet_IP_IPSEC_POLICY(0xffffffffffffffff, 0x0, 0x10, &(0x7f0000000540)={{{@in6, @in=@remote}}, {{@in6=@ipv4={[], [], @local}}, 0x0, @in6}}, &(0x7f0000000000)=0xe8)
ioctl$BINDER_SET_CONTEXT_MGR(r4, 0x40046207, 0x0)
r5 = dup(r4)
shutdown(r5, 0x1)
prctl$PR_SET_NAME(0xf, &(0x7f0000000380)='/group.stat\x00')
syz_open_dev$binder(&(0x7f0000000880)='/dev/binder#\x00', 0x0, 0x2)
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)})
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, &(0x7f0000000780)})
ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f0000000680)})
creat(&(0x7f00000000c0)='./file0\x00', 0x0)
openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000100)='/group.stat\x00', 0x2761, 0x0)
clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000080), 0xffffffffffffffff)
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000003c0)={0x14, 0x0, &(0x7f0000000680)=[@acquire_done], 0x0, 0x0, 0x0})

05:03:21 executing program 0:
recvmmsg(0xffffffffffffffff, &(0x7f0000003140)=[{{&(0x7f0000001400)=@ipx, 0x80, 0x0}}], 0x1, 0x0, 0x0)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = syz_open_procfs(0x0, &(0x7f00000004c0)='net/rt_cache\x00')
preadv(r0, &(0x7f00000017c0), 0x139, 0x0)

05:03:21 executing program 3:
recvmmsg(0xffffffffffffffff, &(0x7f0000003140)=[{{&(0x7f0000001400)=@ipx, 0x80, 0x0}}], 0x1, 0x0, 0x0)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = syz_open_procfs(0x0, &(0x7f00000004c0)='net/rt_cache\x00')
preadv(r0, &(0x7f00000017c0), 0x13a, 0x0)

05:03:21 executing program 5:
r0 = socket$inet_udplite(0x2, 0x2, 0x88)
ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070")
setsockopt$inet_sctp_SCTP_RTOINFO(0xffffffffffffffff, 0x84, 0x0, 0x0, 0x0)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
socket$pppoe(0x18, 0x1, 0x0)
connect$pppoe(0xffffffffffffffff, 0x0, 0x0)
r1 = perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x125, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x37e}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
close(r1)
r2 = socket$kcm(0x2, 0x3, 0x2)
ioctl$PERF_EVENT_IOC_SET_FILTER(r1, 0x8914, &(0x7f0000000380)='nr0\x01\x00`\xa1\x9e\xf9\xd2\xc6s\xd9\xa1W\x1c\xb9\xe16\x9b\xcda\xef~Iy:\xe1\x87\x12\xec\xeb\x1d\xaav\x94\x97\x80\v\x7f\xbb\xd3[\x17\f\x10u\x1d9\xae\xb6`\xd8c\xe4\x9b\x8cO;<\xadH\x90+[-l\xfd\n\xbd7,c\xbc\xf5\xd7\r\xf3\xfdM.\x8dD<\x88\xc6\x0f\xd7\x14\x0f\xbc\x0eV7\xdd\x82\xfc45\xbe\xd4\xde]i<\x9ax\x1c\x86>\x05\xd8\xa6\xf8h\x9a[\xe2\x92\x16\x06\x1f?\xf5?\x8bk9fx\xe7\xba\x15^\xf9\x15-~C\xb1\xec\xcb#1\xeb\x8e\xb1\xedU\x86\xdc\xf8\xb3\xb0\xb9\x996\x1aD\xff,\"\xc2\xab\xbe\xf4-\xd2N\xab\xe6r3F\xa6\xe4l\x04\x99\xa2\x14B\xd8\xd0\r\xcbW\xf0\x13\xffu\x95\xed\xd0\xff\ai0\xde6u\xd3A\x17\xa4N\xb0\xe4\xf82\x93m\xa4N')
getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f00000006c0), 0x0)
r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x802, 0x0)
acct(0x0)
ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x802})
perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
syz_emit_ethernet(0x0, &(0x7f0000000000)=ANY=[], 0x0)
bpf$PROG_LOAD(0x5, 0x0, 0x0)
write$cgroup_int(r3, &(0x7f0000000000), 0xfdef)
ioctl$FICLONERANGE(r2, 0x4020940d, 0x0)
sendmsg$nl_generic(0xffffffffffffffff, &(0x7f0000000240)={&(0x7f0000000480)={0x10, 0xbbf4}, 0xc, &(0x7f0000000740)={&(0x7f00000000c0)={0x14, 0x0, 0x1, 0x0, 0x0, {0x4}}, 0x14}}, 0x0)
bind$packet(0xffffffffffffffff, 0x0, 0x0)
setsockopt(0xffffffffffffffff, 0x0, 0x5, 0x0, 0x0)

05:03:21 executing program 4:
r0 = syz_open_dev$sndtimer(&(0x7f0000026000)='/dev/snd/timer\x00', 0x0, 0x0)
r1 = dup3(r0, r0, 0x80000)
ioctl$UI_GET_SYSNAME(r1, 0x8040552c, 0x0)
perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8)
r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c)
bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r2, &(0x7f0000000040), 0x0, 0x1}, 0x20)
openat$cgroup_ro(r1, &(0x7f00000004c0)='cpuset.effective_cpus\x00', 0x0, 0x0)
unlink(&(0x7f0000000900)='./file0/file0\x00')
r3 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r4 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r4, 0x0)
ioctl$BINDER_GET_NODE_DEBUG_INFO(0xffffffffffffffff, 0xc018620b, &(0x7f0000000780))
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f00000000c0)=[@enter_looper], 0x48, 0x0, &(0x7f0000000700)="2ba063fb309ec7fdbfb08e6e91baee7d7d4599fe14129a4d426834556ae420e087d59c0c7be7fcad1abb7e1f8f446f373f611ca1ee9c2231708e18a47bc68a2a79a0b48931f6ff6d"})
ioctl$sock_inet_tcp_SIOCOUTQNSD(r1, 0x894b, &(0x7f0000000480))
getsockopt$inet_IP_IPSEC_POLICY(0xffffffffffffffff, 0x0, 0x10, &(0x7f0000000540)={{{@in6, @in=@remote}}, {{@in6=@ipv4={[], [], @local}}, 0x0, @in6}}, &(0x7f0000000000)=0xe8)
ioctl$BINDER_SET_CONTEXT_MGR(r4, 0x40046207, 0x0)
dup(r4)
prctl$PR_SET_NAME(0xf, &(0x7f0000000380)='/group.stat\x00')
syz_open_dev$binder(&(0x7f0000000880)='/dev/binder#\x00', 0x0, 0x2)
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)})
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, &(0x7f0000000780)})
ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f0000000680)})
creat(&(0x7f00000000c0)='./file0\x00', 0x0)
openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000100)='/group.stat\x00', 0x2761, 0x0)
clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000080), 0xffffffffffffffff)
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000003c0)={0x14, 0x0, &(0x7f0000000680)=[@acquire_done], 0x0, 0x0, 0x0})

05:03:21 executing program 1:
r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000200)='/dev/nullb0\x00', 0x5000000084002, 0x0)
mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x200000e, 0x13, r0, 0x0)
r1 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x4000, 0x0)
preadv(r1, &(0x7f0000000040)=[{&(0x7f0000000400)=""/4096, 0x3ffc00}], 0x1c6, 0x0)

05:03:21 executing program 0:
recvmmsg(0xffffffffffffffff, &(0x7f0000003140)=[{{&(0x7f0000001400)=@ipx, 0x80, 0x0}}], 0x1, 0x0, 0x0)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = syz_open_procfs(0x0, &(0x7f00000004c0)='net/rt_cache\x00')
preadv(r0, &(0x7f00000017c0), 0x13a, 0x0)

[  430.863449] binder_set_nice: 2 callbacks suppressed
[  430.863483] binder: 21436 RLIMIT_NICE not set
[  430.894127] binder: 21439 RLIMIT_NICE not set
[  430.905891] binder: BINDER_SET_CONTEXT_MGR already set
05:03:21 executing program 1:
r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000200)='/dev/nullb0\x00', 0x5000000084002, 0x0)
mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x200000e, 0x13, r0, 0x0)
r1 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x4000, 0x0)
preadv(r1, &(0x7f0000000040)=[{&(0x7f0000000400)=""/4096, 0x3ffc00}], 0x1c7, 0x0)

[  430.935046] binder: 21428:21436 ioctl 40046207 0 returned -16
[  430.951500] binder: BINDER_SET_CONTEXT_MGR already set
[  430.983850] binder: 21432:21446 ioctl 40046207 0 returned -16
[  431.023785] binder: 21428:21449 BC_INCREFS_DONE node 881 has no pending increfs request
05:03:21 executing program 0:
recvmmsg(0xffffffffffffffff, &(0x7f0000003140)=[{{&(0x7f0000001400)=@ipx, 0x80, 0x0}}], 0x1, 0x0, 0x0)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = syz_open_procfs(0x0, &(0x7f00000004c0)='net/rt_cache\x00')
preadv(r0, &(0x7f00000017c0), 0x13b, 0x0)

[  431.054534] binder: 21432:21446 Release 1 refcount change on invalid ref 1 ret -22
[  431.062397] binder: 21428:21449 Release 1 refcount change on invalid ref 1 ret -22
05:03:21 executing program 3:
recvmmsg(0xffffffffffffffff, &(0x7f0000003140)=[{{&(0x7f0000001400)=@ipx, 0x80, 0x0}}], 0x1, 0x0, 0x0)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = syz_open_procfs(0x0, &(0x7f00000004c0)='net/rt_cache\x00')
preadv(r0, &(0x7f00000017c0), 0x13b, 0x0)

[  431.095930] binder: 21428:21449 BC_ACQUIRE_DONE node 881 has no pending acquire request
05:03:21 executing program 0:
recvmmsg(0xffffffffffffffff, &(0x7f0000003140)=[{{&(0x7f0000001400)=@ipx, 0x80, 0x0}}], 0x1, 0x0, 0x0)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = syz_open_procfs(0x0, &(0x7f00000004c0)='net/rt_cache\x00')
preadv(r0, &(0x7f00000017c0), 0x13c, 0x0)

05:03:21 executing program 3:
recvmmsg(0xffffffffffffffff, &(0x7f0000003140)=[{{&(0x7f0000001400)=@ipx, 0x80, 0x0}}], 0x1, 0x0, 0x0)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = syz_open_procfs(0x0, &(0x7f00000004c0)='net/rt_cache\x00')
preadv(r0, &(0x7f00000017c0), 0x13c, 0x0)

05:03:21 executing program 2:
r0 = syz_open_dev$sndtimer(&(0x7f0000026000)='/dev/snd/timer\x00', 0x0, 0x0)
r1 = dup3(r0, r0, 0x80000)
ioctl$UI_GET_SYSNAME(r1, 0x8040552c, 0x0)
perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8)
r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c)
bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r2, &(0x7f0000000040), 0x0, 0x1}, 0x20)
openat$cgroup_ro(r1, &(0x7f00000004c0)='cpuset.effective_cpus\x00', 0x0, 0x0)
unlink(&(0x7f0000000900)='./file0/file0\x00')
r3 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r4 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r4, 0x0)
ioctl$BINDER_GET_NODE_DEBUG_INFO(r3, 0xc018620b, &(0x7f0000000780))
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f00000000c0)=[@enter_looper], 0x44, 0x0, &(0x7f0000000700)="2ba063fb309ec7fdbfb08e6e91baee7d7d4599fe14129a4d426834556ae420e087d59c0c7be7fcad1abb7e1f8f446f373f611ca1ee9c2231708e18a47bc68a2a79a0b489"})
ioctl$sock_inet_tcp_SIOCOUTQNSD(r1, 0x894b, &(0x7f0000000480))
getsockopt$inet_IP_IPSEC_POLICY(0xffffffffffffffff, 0x0, 0x10, &(0x7f0000000540)={{{@in6, @in=@remote}}, {{@in6=@ipv4={[], [], @local}}, 0x0, @in6}}, &(0x7f0000000000)=0xe8)
ioctl$BINDER_SET_CONTEXT_MGR(r4, 0x40046207, 0x0)
r5 = dup(r4)
shutdown(r5, 0x1)
prctl$PR_SET_NAME(0xf, &(0x7f0000000380)='/group.stat\x00')
syz_open_dev$binder(&(0x7f0000000880)='/dev/binder#\x00', 0x0, 0x2)
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)})
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, &(0x7f0000000780)})
ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f0000000680)})
creat(&(0x7f00000000c0)='./file0\x00', 0x0)
openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000100)='/group.stat\x00', 0x2761, 0x0)
clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000080), 0xffffffffffffffff)
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000003c0)={0x14, 0x0, &(0x7f0000000680)=[@acquire_done], 0x0, 0x0, 0x0})

05:03:21 executing program 0:
recvmmsg(0xffffffffffffffff, &(0x7f0000003140)=[{{&(0x7f0000001400)=@ipx, 0x80, 0x0}}], 0x1, 0x0, 0x0)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = syz_open_procfs(0x0, &(0x7f00000004c0)='net/rt_cache\x00')
preadv(r0, &(0x7f00000017c0), 0x13d, 0x0)

05:03:21 executing program 3:
recvmmsg(0xffffffffffffffff, &(0x7f0000003140)=[{{&(0x7f0000001400)=@ipx, 0x80, 0x0}}], 0x1, 0x0, 0x0)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = syz_open_procfs(0x0, &(0x7f00000004c0)='net/rt_cache\x00')
preadv(r0, &(0x7f00000017c0), 0x13d, 0x0)

[  431.593934] binder_thread_release: 1 callbacks suppressed
[  431.593945] binder: release 21428:21436 transaction 880 out, still active
[  431.633793] binder: unexpected work type, 4, not freed
[  431.683672] binder: undelivered TRANSACTION_COMPLETE
[  431.704285] binder: release 21432:21446 transaction 883 out, still active
[  431.786178] binder: 21488 RLIMIT_NICE not set
[  431.831067] binder: BINDER_SET_CONTEXT_MGR already set
[  431.836714] binder: 21487:21492 ioctl 40046207 0 returned -16
[  431.846399] binder: 21487:21492 Release 1 refcount change on invalid ref 1 ret -22
05:03:22 executing program 5:
r0 = syz_open_dev$sndtimer(&(0x7f0000026000)='/dev/snd/timer\x00', 0x0, 0x0)
r1 = dup3(r0, r0, 0x80000)
ioctl$UI_GET_SYSNAME(r1, 0x8040552c, 0x0)
perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8)
r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c)
bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r2, &(0x7f0000000040), 0x0, 0x1}, 0x20)
openat$cgroup_ro(r1, &(0x7f00000004c0)='cpuset.effective_cpus\x00', 0x0, 0x0)
unlink(&(0x7f0000000900)='./file0/file0\x00')
r3 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r4 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r4, 0x0)
ioctl$BINDER_GET_NODE_DEBUG_INFO(r3, 0xc018620b, &(0x7f0000000780))
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f00000000c0)=[@enter_looper], 0x44, 0x0, &(0x7f0000000700)="2ba063fb309ec7fdbfb08e6e91baee7d7d4599fe14129a4d426834556ae420e087d59c0c7be7fcad1abb7e1f8f446f373f611ca1ee9c2231708e18a47bc68a2a79a0b489"})
ioctl$sock_inet_tcp_SIOCOUTQNSD(r1, 0x894b, &(0x7f0000000480))
getsockopt$inet_IP_IPSEC_POLICY(0xffffffffffffffff, 0x0, 0x10, &(0x7f0000000540)={{{@in6, @in=@remote}}, {{@in6=@ipv4={[], [], @local}}, 0x0, @in6}}, &(0x7f0000000000)=0xe8)
ioctl$BINDER_SET_CONTEXT_MGR(r4, 0x40046207, 0x0)
r5 = dup(r4)
shutdown(r5, 0x1)
prctl$PR_SET_NAME(0xf, &(0x7f0000000380)='/group.stat\x00')
syz_open_dev$binder(&(0x7f0000000880)='/dev/binder#\x00', 0x0, 0x2)
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)})
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, &(0x7f0000000780)})
ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f0000000680)})
creat(&(0x7f00000000c0)='./file0\x00', 0x0)
openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000100)='/group.stat\x00', 0x2761, 0x0)
clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000080), 0xffffffffffffffff)
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000003c0)={0x14, 0x0, &(0x7f0000000680)=[@acquire_done], 0x0, 0x0, 0x0})

05:03:22 executing program 4:
r0 = syz_open_dev$sndtimer(&(0x7f0000026000)='/dev/snd/timer\x00', 0x0, 0x0)
r1 = dup3(r0, r0, 0x80000)
ioctl$UI_GET_SYSNAME(r1, 0x8040552c, 0x0)
perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8)
r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c)
bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r2, &(0x7f0000000040), 0x0, 0x1}, 0x20)
openat$cgroup_ro(r1, &(0x7f00000004c0)='cpuset.effective_cpus\x00', 0x0, 0x0)
unlink(&(0x7f0000000900)='./file0/file0\x00')
r3 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r4 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r4, 0x0)
ioctl$BINDER_GET_NODE_DEBUG_INFO(0xffffffffffffffff, 0xc018620b, &(0x7f0000000780))
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f00000000c0)=[@enter_looper], 0x48, 0x0, &(0x7f0000000700)="2ba063fb309ec7fdbfb08e6e91baee7d7d4599fe14129a4d426834556ae420e087d59c0c7be7fcad1abb7e1f8f446f373f611ca1ee9c2231708e18a47bc68a2a79a0b48931f6ff6d"})
ioctl$sock_inet_tcp_SIOCOUTQNSD(r1, 0x894b, &(0x7f0000000480))
getsockopt$inet_IP_IPSEC_POLICY(0xffffffffffffffff, 0x0, 0x10, &(0x7f0000000540)={{{@in6, @in=@remote}}, {{@in6=@ipv4={[], [], @local}}, 0x0, @in6}}, &(0x7f0000000000)=0xe8)
ioctl$BINDER_SET_CONTEXT_MGR(r4, 0x40046207, 0x0)
dup(r4)
prctl$PR_SET_NAME(0xf, &(0x7f0000000380)='/group.stat\x00')
syz_open_dev$binder(&(0x7f0000000880)='/dev/binder#\x00', 0x0, 0x2)
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)})
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, &(0x7f0000000780)})
ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f0000000680)})
creat(&(0x7f00000000c0)='./file0\x00', 0x0)
openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000100)='/group.stat\x00', 0x2761, 0x0)
clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000080), 0xffffffffffffffff)
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000003c0)={0x14, 0x0, &(0x7f0000000680)=[@acquire_done], 0x0, 0x0, 0x0})

05:03:22 executing program 1:
r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000200)='/dev/nullb0\x00', 0x5000000084002, 0x0)
mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x200000e, 0x13, r0, 0x0)
r1 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x4000, 0x0)
preadv(r1, &(0x7f0000000040)=[{&(0x7f0000000400)=""/4096, 0x3ffc00}], 0x1c8, 0x0)

05:03:22 executing program 0:
recvmmsg(0xffffffffffffffff, &(0x7f0000003140)=[{{&(0x7f0000001400)=@ipx, 0x80, 0x0}}], 0x1, 0x0, 0x0)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = syz_open_procfs(0x0, &(0x7f00000004c0)='net/rt_cache\x00')
preadv(r0, &(0x7f00000017c0), 0x13e, 0x0)

05:03:22 executing program 3:
recvmmsg(0xffffffffffffffff, &(0x7f0000003140)=[{{&(0x7f0000001400)=@ipx, 0x80, 0x0}}], 0x1, 0x0, 0x0)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = syz_open_procfs(0x0, &(0x7f00000004c0)='net/rt_cache\x00')
preadv(r0, &(0x7f00000017c0), 0x13e, 0x0)

[  432.024149] binder: 21496 RLIMIT_NICE not set
05:03:22 executing program 3:
recvmmsg(0xffffffffffffffff, &(0x7f0000003140)=[{{&(0x7f0000001400)=@ipx, 0x80, 0x0}}], 0x1, 0x0, 0x0)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = syz_open_procfs(0x0, &(0x7f00000004c0)='net/rt_cache\x00')
preadv(r0, &(0x7f00000017c0), 0x13f, 0x0)

05:03:22 executing program 0:
recvmmsg(0xffffffffffffffff, &(0x7f0000003140)=[{{&(0x7f0000001400)=@ipx, 0x80, 0x0}}], 0x1, 0x0, 0x0)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = syz_open_procfs(0x0, &(0x7f00000004c0)='net/rt_cache\x00')
preadv(r0, &(0x7f00000017c0), 0x13f, 0x0)

[  432.052128] binder: BINDER_SET_CONTEXT_MGR already set
[  432.061176] binder: 21494:21496 ioctl 40046207 0 returned -16
[  432.118916] binder: 21506 RLIMIT_NICE not set
[  432.124233] binder: 21494:21509 BC_INCREFS_DONE node 890 has no pending increfs request
[  432.133997] binder: 21494:21509 Release 1 refcount change on invalid ref 1 ret -22
05:03:22 executing program 0:
recvmmsg(0xffffffffffffffff, &(0x7f0000003140)=[{{&(0x7f0000001400)=@ipx, 0x80, 0x0}}], 0x1, 0x0, 0x0)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = syz_open_procfs(0x0, &(0x7f00000004c0)='net/rt_cache\x00')
preadv(r0, &(0x7f00000017c0), 0x140, 0x0)

[  432.165446] binder: BINDER_SET_CONTEXT_MGR already set
[  432.174030] binder: 21494:21509 BC_ACQUIRE_DONE node 890 has no pending acquire request
[  432.184058] binder: 21505:21516 ioctl 40046207 0 returned -16
05:03:22 executing program 3:
recvmmsg(0xffffffffffffffff, &(0x7f0000003140)=[{{&(0x7f0000001400)=@ipx, 0x80, 0x0}}], 0x1, 0x0, 0x0)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = syz_open_procfs(0x0, &(0x7f00000004c0)='net/rt_cache\x00')
preadv(r0, &(0x7f00000017c0), 0x140, 0x0)

[  432.220710] binder: 21505:21516 Release 1 refcount change on invalid ref 1 ret -22
05:03:22 executing program 2:
r0 = syz_open_dev$sndtimer(&(0x7f0000026000)='/dev/snd/timer\x00', 0x0, 0x0)
r1 = dup3(r0, r0, 0x80000)
ioctl$UI_GET_SYSNAME(r1, 0x8040552c, 0x0)
perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8)
r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c)
bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r2, &(0x7f0000000040), 0x0, 0x1}, 0x20)
openat$cgroup_ro(r1, &(0x7f00000004c0)='cpuset.effective_cpus\x00', 0x0, 0x0)
unlink(&(0x7f0000000900)='./file0/file0\x00')
r3 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r4 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r4, 0x0)
ioctl$BINDER_GET_NODE_DEBUG_INFO(r3, 0xc018620b, &(0x7f0000000780))
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f00000000c0)=[@enter_looper], 0x46, 0x0, &(0x7f0000000700)="2ba063fb309ec7fdbfb08e6e91baee7d7d4599fe14129a4d426834556ae420e087d59c0c7be7fcad1abb7e1f8f446f373f611ca1ee9c2231708e18a47bc68a2a79a0b48931f6"})
ioctl$sock_inet_tcp_SIOCOUTQNSD(r1, 0x894b, &(0x7f0000000480))
getsockopt$inet_IP_IPSEC_POLICY(0xffffffffffffffff, 0x0, 0x10, &(0x7f0000000540)={{{@in6, @in=@remote}}, {{@in6=@ipv4={[], [], @local}}, 0x0, @in6}}, &(0x7f0000000000)=0xe8)
ioctl$BINDER_SET_CONTEXT_MGR(r4, 0x40046207, 0x0)
r5 = dup(r4)
shutdown(r5, 0x1)
prctl$PR_SET_NAME(0xf, &(0x7f0000000380)='/group.stat\x00')
syz_open_dev$binder(&(0x7f0000000880)='/dev/binder#\x00', 0x0, 0x2)
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)})
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, &(0x7f0000000780)})
ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f0000000680)})
creat(&(0x7f00000000c0)='./file0\x00', 0x0)
openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000100)='/group.stat\x00', 0x2761, 0x0)
clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000080), 0xffffffffffffffff)
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000003c0)={0x14, 0x0, &(0x7f0000000680)=[@acquire_done], 0x0, 0x0, 0x0})

05:03:22 executing program 0:
recvmmsg(0xffffffffffffffff, &(0x7f0000003140)=[{{&(0x7f0000001400)=@ipx, 0x80, 0x0}}], 0x1, 0x0, 0x0)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = syz_open_procfs(0x0, &(0x7f00000004c0)='net/rt_cache\x00')
preadv(r0, &(0x7f00000017c0), 0x141, 0x0)

05:03:22 executing program 3:
recvmmsg(0xffffffffffffffff, &(0x7f0000003140)=[{{&(0x7f0000001400)=@ipx, 0x80, 0x0}}], 0x1, 0x0, 0x0)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = syz_open_procfs(0x0, &(0x7f00000004c0)='net/rt_cache\x00')
preadv(r0, &(0x7f00000017c0), 0x141, 0x0)

[  432.524019] binder: release 21487:21492 transaction 886 out, still active
[  432.681898] binder: 21541 RLIMIT_NICE not set
[  432.728116] binder: BINDER_SET_CONTEXT_MGR already set
[  432.733563] binder: 21540:21544 ioctl 40046207 0 returned -16
[  432.741441] binder: 21540:21544 Release 1 refcount change on invalid ref 1 ret -22
[  432.783867] binder: release 21494:21496 transaction 889 out, still active
[  432.790804] binder: unexpected work type, 4, not freed
[  432.812020] binder: undelivered TRANSACTION_COMPLETE
05:03:23 executing program 5:
r0 = syz_open_dev$sndtimer(&(0x7f0000026000)='/dev/snd/timer\x00', 0x0, 0x0)
r1 = dup3(r0, r0, 0x80000)
ioctl$UI_GET_SYSNAME(r1, 0x8040552c, 0x0)
perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8)
r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c)
bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r2, &(0x7f0000000040), 0x0, 0x1}, 0x20)
openat$cgroup_ro(r1, &(0x7f00000004c0)='cpuset.effective_cpus\x00', 0x0, 0x0)
unlink(&(0x7f0000000900)='./file0/file0\x00')
r3 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r4 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r4, 0x0)
ioctl$BINDER_GET_NODE_DEBUG_INFO(0xffffffffffffffff, 0xc018620b, &(0x7f0000000780))
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f00000000c0)=[@enter_looper], 0x48, 0x0, &(0x7f0000000700)="2ba063fb309ec7fdbfb08e6e91baee7d7d4599fe14129a4d426834556ae420e087d59c0c7be7fcad1abb7e1f8f446f373f611ca1ee9c2231708e18a47bc68a2a79a0b48931f6ff6d"})
ioctl$sock_inet_tcp_SIOCOUTQNSD(r1, 0x894b, &(0x7f0000000480))
getsockopt$inet_IP_IPSEC_POLICY(0xffffffffffffffff, 0x0, 0x10, &(0x7f0000000540)={{{@in6, @in=@remote}}, {{@in6=@ipv4={[], [], @local}}, 0x0, @in6}}, &(0x7f0000000000)=0xe8)
ioctl$BINDER_SET_CONTEXT_MGR(r4, 0x40046207, 0x0)
dup(r4)
prctl$PR_SET_NAME(0xf, &(0x7f0000000380)='/group.stat\x00')
syz_open_dev$binder(&(0x7f0000000880)='/dev/binder#\x00', 0x0, 0x2)
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)})
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, &(0x7f0000000780)})
ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f0000000680)})
creat(&(0x7f00000000c0)='./file0\x00', 0x0)
openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000100)='/group.stat\x00', 0x2761, 0x0)
clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000080), 0xffffffffffffffff)
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000003c0)={0x14, 0x0, &(0x7f0000000680)=[@acquire_done], 0x0, 0x0, 0x0})

05:03:23 executing program 1:
r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000200)='/dev/nullb0\x00', 0x5000000084002, 0x0)
mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x200000e, 0x13, r0, 0x0)
r1 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x4000, 0x0)
preadv(r1, &(0x7f0000000040)=[{&(0x7f0000000400)=""/4096, 0x3ffc00}], 0x1c9, 0x0)

05:03:23 executing program 3:
recvmmsg(0xffffffffffffffff, &(0x7f0000003140)=[{{&(0x7f0000001400)=@ipx, 0x80, 0x0}}], 0x1, 0x0, 0x0)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = syz_open_procfs(0x0, &(0x7f00000004c0)='net/rt_cache\x00')
preadv(r0, &(0x7f00000017c0), 0x142, 0x0)

05:03:23 executing program 0:
recvmmsg(0xffffffffffffffff, &(0x7f0000003140)=[{{&(0x7f0000001400)=@ipx, 0x80, 0x0}}], 0x1, 0x0, 0x0)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = syz_open_procfs(0x0, &(0x7f00000004c0)='net/rt_cache\x00')
preadv(r0, &(0x7f00000017c0), 0x142, 0x0)

05:03:23 executing program 4:
r0 = syz_open_dev$sndtimer(&(0x7f0000026000)='/dev/snd/timer\x00', 0x0, 0x0)
r1 = dup3(r0, r0, 0x80000)
ioctl$UI_GET_SYSNAME(r1, 0x8040552c, 0x0)
perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8)
r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c)
bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r2, &(0x7f0000000040), 0x0, 0x1}, 0x20)
openat$cgroup_ro(r1, &(0x7f00000004c0)='cpuset.effective_cpus\x00', 0x0, 0x0)
unlink(&(0x7f0000000900)='./file0/file0\x00')
r3 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r4 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r4, 0x0)
ioctl$BINDER_GET_NODE_DEBUG_INFO(0xffffffffffffffff, 0xc018620b, &(0x7f0000000780))
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f00000000c0)=[@enter_looper], 0x48, 0x0, &(0x7f0000000700)="2ba063fb309ec7fdbfb08e6e91baee7d7d4599fe14129a4d426834556ae420e087d59c0c7be7fcad1abb7e1f8f446f373f611ca1ee9c2231708e18a47bc68a2a79a0b48931f6ff6d"})
ioctl$sock_inet_tcp_SIOCOUTQNSD(r1, 0x894b, &(0x7f0000000480))
getsockopt$inet_IP_IPSEC_POLICY(0xffffffffffffffff, 0x0, 0x10, &(0x7f0000000540)={{{@in6, @in=@remote}}, {{@in6=@ipv4={[], [], @local}}, 0x0, @in6}}, &(0x7f0000000000)=0xe8)
ioctl$BINDER_SET_CONTEXT_MGR(r4, 0x40046207, 0x0)
dup(r4)
prctl$PR_SET_NAME(0xf, &(0x7f0000000380)='/group.stat\x00')
syz_open_dev$binder(&(0x7f0000000880)='/dev/binder#\x00', 0x0, 0x2)
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)})
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, &(0x7f0000000780)})
ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f0000000680)})
creat(&(0x7f00000000c0)='./file0\x00', 0x0)
openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000100)='/group.stat\x00', 0x2761, 0x0)
clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000080), 0xffffffffffffffff)
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000003c0)={0x14, 0x0, &(0x7f0000000680)=[@acquire_done], 0x0, 0x0, 0x0})

[  432.838944] binder: release 21505:21516 transaction 892 out, still active
[  432.862540] bridge0: port 3(gretap0) entered disabled state
[  432.905649] device gretap0 left promiscuous mode
05:03:23 executing program 0:
recvmmsg(0xffffffffffffffff, &(0x7f0000003140)=[{{&(0x7f0000001400)=@ipx, 0x80, 0x0}}], 0x1, 0x0, 0x0)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = syz_open_procfs(0x0, &(0x7f00000004c0)='net/rt_cache\x00')
preadv(r0, &(0x7f00000017c0), 0x143, 0x0)

05:03:23 executing program 1:
r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000200)='/dev/nullb0\x00', 0x5000000084002, 0x0)
mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x200000e, 0x13, r0, 0x0)
r1 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x4000, 0x0)
preadv(r1, &(0x7f0000000040)=[{&(0x7f0000000400)=""/4096, 0x3ffc00}], 0x1ca, 0x0)

[  432.942181] bridge0: port 3(gretap0) entered disabled state
[  432.949467] binder: 21549 RLIMIT_NICE not set
[  432.963519] binder: BINDER_SET_CONTEXT_MGR already set
[  432.972381] binder: 21548:21549 ioctl 40046207 0 returned -16
05:03:23 executing program 3:
recvmmsg(0xffffffffffffffff, &(0x7f0000003140)=[{{&(0x7f0000001400)=@ipx, 0x80, 0x0}}], 0x1, 0x0, 0x0)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = syz_open_procfs(0x0, &(0x7f00000004c0)='net/rt_cache\x00')
preadv(r0, &(0x7f00000017c0), 0x143, 0x0)

[  433.065290] binder: 21561 RLIMIT_NICE not set
[  433.084742] binder: BINDER_SET_CONTEXT_MGR already set
[  433.090251] binder: 21560:21561 ioctl 40046207 0 returned -16
[  433.102964] binder: 21548:21571 BC_INCREFS_DONE node 899 has no pending increfs request
05:03:23 executing program 0:
recvmmsg(0xffffffffffffffff, &(0x7f0000003140)=[{{&(0x7f0000001400)=@ipx, 0x80, 0x0}}], 0x1, 0x0, 0x0)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = syz_open_procfs(0x0, &(0x7f00000004c0)='net/rt_cache\x00')
preadv(r0, &(0x7f00000017c0), 0x144, 0x0)

[  433.129734] binder: 21548:21571 Release 1 refcount change on invalid ref 1 ret -22
[  433.215555] binder: 21560:21575 BC_INCREFS_DONE node 902 has no pending increfs request
[  433.261910] binder: 21560:21575 Release 1 refcount change on invalid ref 1 ret -22
[  433.410778] binder: 21560:21575 BC_ACQUIRE_DONE node 902 has no pending acquire request
[  433.433394] binder: release 21540:21544 transaction 895 out, still active
05:03:23 executing program 2:
r0 = syz_open_dev$sndtimer(&(0x7f0000026000)='/dev/snd/timer\x00', 0x0, 0x0)
r1 = dup3(r0, r0, 0x80000)
ioctl$UI_GET_SYSNAME(r1, 0x8040552c, 0x0)
perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8)
r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c)
bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r2, &(0x7f0000000040), 0x0, 0x1}, 0x20)
openat$cgroup_ro(r1, &(0x7f00000004c0)='cpuset.effective_cpus\x00', 0x0, 0x0)
unlink(&(0x7f0000000900)='./file0/file0\x00')
r3 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r4 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r4, 0x0)
ioctl$BINDER_GET_NODE_DEBUG_INFO(r3, 0xc018620b, &(0x7f0000000780))
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f00000000c0)=[@enter_looper], 0x46, 0x0, &(0x7f0000000700)="2ba063fb309ec7fdbfb08e6e91baee7d7d4599fe14129a4d426834556ae420e087d59c0c7be7fcad1abb7e1f8f446f373f611ca1ee9c2231708e18a47bc68a2a79a0b48931f6"})
ioctl$sock_inet_tcp_SIOCOUTQNSD(r1, 0x894b, &(0x7f0000000480))
getsockopt$inet_IP_IPSEC_POLICY(0xffffffffffffffff, 0x0, 0x10, &(0x7f0000000540)={{{@in6, @in=@remote}}, {{@in6=@ipv4={[], [], @local}}, 0x0, @in6}}, &(0x7f0000000000)=0xe8)
ioctl$BINDER_SET_CONTEXT_MGR(r4, 0x40046207, 0x0)
r5 = dup(r4)
shutdown(r5, 0x1)
prctl$PR_SET_NAME(0xf, &(0x7f0000000380)='/group.stat\x00')
syz_open_dev$binder(&(0x7f0000000880)='/dev/binder#\x00', 0x0, 0x2)
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)})
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, &(0x7f0000000780)})
ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f0000000680)})
creat(&(0x7f00000000c0)='./file0\x00', 0x0)
openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000100)='/group.stat\x00', 0x2761, 0x0)
clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000080), 0xffffffffffffffff)
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000003c0)={0x14, 0x0, &(0x7f0000000680)=[@acquire_done], 0x0, 0x0, 0x0})

05:03:23 executing program 3:
recvmmsg(0xffffffffffffffff, &(0x7f0000003140)=[{{&(0x7f0000001400)=@ipx, 0x80, 0x0}}], 0x1, 0x0, 0x0)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = syz_open_procfs(0x0, &(0x7f00000004c0)='net/rt_cache\x00')
preadv(r0, &(0x7f00000017c0), 0x145, 0x0)

05:03:23 executing program 5:
r0 = syz_open_dev$sndtimer(&(0x7f0000026000)='/dev/snd/timer\x00', 0x0, 0x0)
r1 = dup3(r0, r0, 0x80000)
ioctl$UI_GET_SYSNAME(r1, 0x8040552c, 0x0)
perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8)
r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c)
bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r2, &(0x7f0000000040), 0x0, 0x1}, 0x20)
openat$cgroup_ro(r1, &(0x7f00000004c0)='cpuset.effective_cpus\x00', 0x0, 0x0)
unlink(&(0x7f0000000900)='./file0/file0\x00')
r3 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r4 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r4, 0x0)
ioctl$BINDER_GET_NODE_DEBUG_INFO(0xffffffffffffffff, 0xc018620b, &(0x7f0000000780))
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f00000000c0)=[@enter_looper], 0x48, 0x0, &(0x7f0000000700)="2ba063fb309ec7fdbfb08e6e91baee7d7d4599fe14129a4d426834556ae420e087d59c0c7be7fcad1abb7e1f8f446f373f611ca1ee9c2231708e18a47bc68a2a79a0b48931f6ff6d"})
ioctl$sock_inet_tcp_SIOCOUTQNSD(r1, 0x894b, &(0x7f0000000480))
getsockopt$inet_IP_IPSEC_POLICY(0xffffffffffffffff, 0x0, 0x10, &(0x7f0000000540)={{{@in6, @in=@remote}}, {{@in6=@ipv4={[], [], @local}}, 0x0, @in6}}, &(0x7f0000000000)=0xe8)
ioctl$BINDER_SET_CONTEXT_MGR(r4, 0x40046207, 0x0)
dup(r4)
prctl$PR_SET_NAME(0xf, &(0x7f0000000380)='/group.stat\x00')
syz_open_dev$binder(&(0x7f0000000880)='/dev/binder#\x00', 0x0, 0x2)
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)})
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, &(0x7f0000000780)})
ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f0000000680)})
creat(&(0x7f00000000c0)='./file0\x00', 0x0)
openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000100)='/group.stat\x00', 0x2761, 0x0)
clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000080), 0xffffffffffffffff)
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000003c0)={0x14, 0x0, &(0x7f0000000680)=[@acquire_done], 0x0, 0x0, 0x0})

05:03:23 executing program 1:
r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000200)='/dev/nullb0\x00', 0x5000000084002, 0x0)
mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x200000e, 0x13, r0, 0x0)
r1 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x4000, 0x0)
preadv(r1, &(0x7f0000000040)=[{&(0x7f0000000400)=""/4096, 0x3ffc00}], 0x1cb, 0x0)

05:03:24 executing program 0:
recvmmsg(0xffffffffffffffff, &(0x7f0000003140)=[{{&(0x7f0000001400)=@ipx, 0x80, 0x0}}], 0x1, 0x0, 0x0)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = syz_open_procfs(0x0, &(0x7f00000004c0)='net/rt_cache\x00')
preadv(r0, &(0x7f00000017c0), 0x145, 0x0)

[  433.699569] binder: 21692 RLIMIT_NICE not set
05:03:24 executing program 4:
r0 = syz_open_dev$sndtimer(&(0x7f0000026000)='/dev/snd/timer\x00', 0x0, 0x0)
r1 = dup3(r0, r0, 0x80000)
ioctl$UI_GET_SYSNAME(r1, 0x8040552c, 0x0)
perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8)
r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c)
bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r2, &(0x7f0000000040), 0x0, 0x1}, 0x20)
openat$cgroup_ro(r1, &(0x7f00000004c0)='cpuset.effective_cpus\x00', 0x0, 0x0)
unlink(&(0x7f0000000900)='./file0/file0\x00')
r3 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r4 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r4, 0x0)
ioctl$BINDER_GET_NODE_DEBUG_INFO(0xffffffffffffffff, 0xc018620b, &(0x7f0000000780))
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f00000000c0)=[@enter_looper], 0x48, 0x0, &(0x7f0000000700)="2ba063fb309ec7fdbfb08e6e91baee7d7d4599fe14129a4d426834556ae420e087d59c0c7be7fcad1abb7e1f8f446f373f611ca1ee9c2231708e18a47bc68a2a79a0b48931f6ff6d"})
ioctl$sock_inet_tcp_SIOCOUTQNSD(r1, 0x894b, &(0x7f0000000480))
getsockopt$inet_IP_IPSEC_POLICY(0xffffffffffffffff, 0x0, 0x10, &(0x7f0000000540)={{{@in6, @in=@remote}}, {{@in6=@ipv4={[], [], @local}}, 0x0, @in6}}, &(0x7f0000000000)=0xe8)
ioctl$BINDER_SET_CONTEXT_MGR(r4, 0x40046207, 0x0)
shutdown(0xffffffffffffffff, 0x1)
prctl$PR_SET_NAME(0xf, &(0x7f0000000380)='/group.stat\x00')
syz_open_dev$binder(&(0x7f0000000880)='/dev/binder#\x00', 0x0, 0x2)
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)})
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, &(0x7f0000000780)})
ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f0000000680)})
creat(&(0x7f00000000c0)='./file0\x00', 0x0)
openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000100)='/group.stat\x00', 0x2761, 0x0)
clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000080), 0xffffffffffffffff)
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000003c0)={0x14, 0x0, &(0x7f0000000680)=[@acquire_done], 0x0, 0x0, 0x0})

05:03:24 executing program 3:
recvmmsg(0xffffffffffffffff, &(0x7f0000003140)=[{{&(0x7f0000001400)=@ipx, 0x80, 0x0}}], 0x1, 0x0, 0x0)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = syz_open_procfs(0x0, &(0x7f00000004c0)='net/rt_cache\x00')
preadv(r0, &(0x7f00000017c0), 0x146, 0x0)

[  433.745571] binder: BINDER_SET_CONTEXT_MGR already set
[  433.753541] binder: 21691:21696 ioctl 40046207 0 returned -16
[  433.761152] binder: 21691:21696 Release 1 refcount change on invalid ref 1 ret -22
[  433.783140] binder: release 21548:21549 transaction 898 out, still active
[  433.799905] binder: unexpected work type, 4, not freed
[  433.816716] binder: BINDER_SET_CONTEXT_MGR already set
[  433.819751] binder: 21690 RLIMIT_NICE not set
[  433.822011] binder: 21688:21699 ioctl 40046207 0 returned -16
05:03:24 executing program 0:
recvmmsg(0xffffffffffffffff, &(0x7f0000003140)=[{{&(0x7f0000001400)=@ipx, 0x80, 0x0}}], 0x1, 0x0, 0x0)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = syz_open_procfs(0x0, &(0x7f00000004c0)='net/rt_cache\x00')
preadv(r0, &(0x7f00000017c0), 0x146, 0x0)

[  433.850487] binder: undelivered TRANSACTION_COMPLETE
05:03:24 executing program 3:
recvmmsg(0xffffffffffffffff, &(0x7f0000003140)=[{{&(0x7f0000001400)=@ipx, 0x80, 0x0}}], 0x1, 0x0, 0x0)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = syz_open_procfs(0x0, &(0x7f00000004c0)='net/rt_cache\x00')
preadv(r0, &(0x7f00000017c0), 0x147, 0x0)

[  433.958379] binder: BINDER_SET_CONTEXT_MGR already set
05:03:24 executing program 0:
recvmmsg(0xffffffffffffffff, &(0x7f0000003140)=[{{&(0x7f0000001400)=@ipx, 0x80, 0x0}}], 0x1, 0x0, 0x0)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = syz_open_procfs(0x0, &(0x7f00000004c0)='net/rt_cache\x00')
preadv(r0, &(0x7f00000017c0), 0x147, 0x0)

[  433.983748] binder: 21707:21744 ioctl 40046207 0 returned -16
[  434.048912] binder: 21707:21753 BC_INCREFS_DONE node 908 has no pending increfs request
05:03:24 executing program 3:
recvmmsg(0xffffffffffffffff, &(0x7f0000003140)=[{{&(0x7f0000001400)=@ipx, 0x80, 0x0}}], 0x1, 0x0, 0x0)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = syz_open_procfs(0x0, &(0x7f00000004c0)='net/rt_cache\x00')
preadv(r0, &(0x7f00000017c0), 0x148, 0x0)

05:03:24 executing program 1:
r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000200)='/dev/nullb0\x00', 0x5000000084002, 0x0)
mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x200000e, 0x13, r0, 0x0)
r1 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x4000, 0x0)
preadv(r1, &(0x7f0000000040)=[{&(0x7f0000000400)=""/4096, 0x3ffc00}], 0x1cc, 0x0)

[  434.093866] binder: 21688:21699 BC_INCREFS_DONE node 911 has no pending increfs request
[  434.141375] binder: 21688:21699 Release 1 refcount change on invalid ref 1 ret -22
[  434.232848] binder: 21688:21699 BC_ACQUIRE_DONE node 911 has no pending acquire request
[  434.421066] binder: release 21707:21744 transaction 907 out, still active
[  434.428394] binder: unexpected work type, 4, not freed
[  434.434211] binder: undelivered TRANSACTION_COMPLETE
[  434.474079] binder: release 21691:21696 transaction 904 out, still active
05:03:24 executing program 2:
r0 = syz_open_dev$sndtimer(&(0x7f0000026000)='/dev/snd/timer\x00', 0x0, 0x0)
r1 = dup3(r0, r0, 0x80000)
ioctl$UI_GET_SYSNAME(r1, 0x8040552c, 0x0)
perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8)
r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c)
bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r2, &(0x7f0000000040), 0x0, 0x1}, 0x20)
openat$cgroup_ro(r1, &(0x7f00000004c0)='cpuset.effective_cpus\x00', 0x0, 0x0)
unlink(&(0x7f0000000900)='./file0/file0\x00')
r3 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r4 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r4, 0x0)
ioctl$BINDER_GET_NODE_DEBUG_INFO(r3, 0xc018620b, &(0x7f0000000780))
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f00000000c0)=[@enter_looper], 0x46, 0x0, &(0x7f0000000700)="2ba063fb309ec7fdbfb08e6e91baee7d7d4599fe14129a4d426834556ae420e087d59c0c7be7fcad1abb7e1f8f446f373f611ca1ee9c2231708e18a47bc68a2a79a0b48931f6"})
ioctl$sock_inet_tcp_SIOCOUTQNSD(r1, 0x894b, &(0x7f0000000480))
getsockopt$inet_IP_IPSEC_POLICY(0xffffffffffffffff, 0x0, 0x10, &(0x7f0000000540)={{{@in6, @in=@remote}}, {{@in6=@ipv4={[], [], @local}}, 0x0, @in6}}, &(0x7f0000000000)=0xe8)
ioctl$BINDER_SET_CONTEXT_MGR(r4, 0x40046207, 0x0)
r5 = dup(r4)
shutdown(r5, 0x1)
prctl$PR_SET_NAME(0xf, &(0x7f0000000380)='/group.stat\x00')
syz_open_dev$binder(&(0x7f0000000880)='/dev/binder#\x00', 0x0, 0x2)
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)})
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, &(0x7f0000000780)})
ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f0000000680)})
creat(&(0x7f00000000c0)='./file0\x00', 0x0)
openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000100)='/group.stat\x00', 0x2761, 0x0)
clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000080), 0xffffffffffffffff)
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000003c0)={0x14, 0x0, &(0x7f0000000680)=[@acquire_done], 0x0, 0x0, 0x0})

05:03:24 executing program 5:
r0 = syz_open_dev$sndtimer(&(0x7f0000026000)='/dev/snd/timer\x00', 0x0, 0x0)
r1 = dup3(r0, r0, 0x80000)
ioctl$UI_GET_SYSNAME(r1, 0x8040552c, 0x0)
perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8)
r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c)
bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r2, &(0x7f0000000040), 0x0, 0x1}, 0x20)
openat$cgroup_ro(r1, &(0x7f00000004c0)='cpuset.effective_cpus\x00', 0x0, 0x0)
unlink(&(0x7f0000000900)='./file0/file0\x00')
r3 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r4 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r4, 0x0)
ioctl$BINDER_GET_NODE_DEBUG_INFO(0xffffffffffffffff, 0xc018620b, &(0x7f0000000780))
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f00000000c0)=[@enter_looper], 0x48, 0x0, &(0x7f0000000700)="2ba063fb309ec7fdbfb08e6e91baee7d7d4599fe14129a4d426834556ae420e087d59c0c7be7fcad1abb7e1f8f446f373f611ca1ee9c2231708e18a47bc68a2a79a0b48931f6ff6d"})
ioctl$sock_inet_tcp_SIOCOUTQNSD(r1, 0x894b, &(0x7f0000000480))
getsockopt$inet_IP_IPSEC_POLICY(0xffffffffffffffff, 0x0, 0x10, &(0x7f0000000540)={{{@in6, @in=@remote}}, {{@in6=@ipv4={[], [], @local}}, 0x0, @in6}}, &(0x7f0000000000)=0xe8)
ioctl$BINDER_SET_CONTEXT_MGR(r4, 0x40046207, 0x0)
dup(r4)
prctl$PR_SET_NAME(0xf, &(0x7f0000000380)='/group.stat\x00')
syz_open_dev$binder(&(0x7f0000000880)='/dev/binder#\x00', 0x0, 0x2)
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)})
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, &(0x7f0000000780)})
ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f0000000680)})
creat(&(0x7f00000000c0)='./file0\x00', 0x0)
openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000100)='/group.stat\x00', 0x2761, 0x0)
clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000080), 0xffffffffffffffff)
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000003c0)={0x14, 0x0, &(0x7f0000000680)=[@acquire_done], 0x0, 0x0, 0x0})

05:03:24 executing program 0:
recvmmsg(0xffffffffffffffff, &(0x7f0000003140)=[{{&(0x7f0000001400)=@ipx, 0x80, 0x0}}], 0x1, 0x0, 0x0)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = syz_open_procfs(0x0, &(0x7f00000004c0)='net/rt_cache\x00')
preadv(r0, &(0x7f00000017c0), 0x148, 0x0)

05:03:24 executing program 3:
recvmmsg(0xffffffffffffffff, &(0x7f0000003140)=[{{&(0x7f0000001400)=@ipx, 0x80, 0x0}}], 0x1, 0x0, 0x0)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = syz_open_procfs(0x0, &(0x7f00000004c0)='net/rt_cache\x00')
preadv(r0, &(0x7f00000017c0), 0x149, 0x0)

05:03:24 executing program 4:
r0 = syz_open_dev$sndtimer(&(0x7f0000026000)='/dev/snd/timer\x00', 0x0, 0x0)
r1 = dup3(r0, r0, 0x80000)
ioctl$UI_GET_SYSNAME(r1, 0x8040552c, 0x0)
perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8)
r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c)
bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r2, &(0x7f0000000040), 0x0, 0x1}, 0x20)
openat$cgroup_ro(r1, &(0x7f00000004c0)='cpuset.effective_cpus\x00', 0x0, 0x0)
unlink(&(0x7f0000000900)='./file0/file0\x00')
r3 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r4 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r4, 0x0)
ioctl$BINDER_GET_NODE_DEBUG_INFO(0xffffffffffffffff, 0xc018620b, &(0x7f0000000780))
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f00000000c0)=[@enter_looper], 0x48, 0x0, &(0x7f0000000700)="2ba063fb309ec7fdbfb08e6e91baee7d7d4599fe14129a4d426834556ae420e087d59c0c7be7fcad1abb7e1f8f446f373f611ca1ee9c2231708e18a47bc68a2a79a0b48931f6ff6d"})
ioctl$sock_inet_tcp_SIOCOUTQNSD(r1, 0x894b, &(0x7f0000000480))
getsockopt$inet_IP_IPSEC_POLICY(0xffffffffffffffff, 0x0, 0x10, &(0x7f0000000540)={{{@in6, @in=@remote}}, {{@in6=@ipv4={[], [], @local}}, 0x0, @in6}}, &(0x7f0000000000)=0xe8)
ioctl$BINDER_SET_CONTEXT_MGR(r4, 0x40046207, 0x0)
shutdown(0xffffffffffffffff, 0x1)
prctl$PR_SET_NAME(0xf, &(0x7f0000000380)='/group.stat\x00')
syz_open_dev$binder(&(0x7f0000000880)='/dev/binder#\x00', 0x0, 0x2)
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)})
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, &(0x7f0000000780)})
ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f0000000680)})
creat(&(0x7f00000000c0)='./file0\x00', 0x0)
openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000100)='/group.stat\x00', 0x2761, 0x0)
clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000080), 0xffffffffffffffff)
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000003c0)={0x14, 0x0, &(0x7f0000000680)=[@acquire_done], 0x0, 0x0, 0x0})

[  434.595337] binder: BINDER_SET_CONTEXT_MGR already set
[  434.600846] binder: 21873:21874 ioctl 40046207 0 returned -16
05:03:25 executing program 0:
recvmmsg(0xffffffffffffffff, &(0x7f0000003140)=[{{&(0x7f0000001400)=@ipx, 0x80, 0x0}}], 0x1, 0x0, 0x0)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = syz_open_procfs(0x0, &(0x7f00000004c0)='net/rt_cache\x00')
preadv(r0, &(0x7f00000017c0), 0x149, 0x0)

[  434.648484] binder: BINDER_SET_CONTEXT_MGR already set
05:03:25 executing program 3:
recvmmsg(0xffffffffffffffff, &(0x7f0000003140)=[{{&(0x7f0000001400)=@ipx, 0x80, 0x0}}], 0x1, 0x0, 0x0)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = syz_open_procfs(0x0, &(0x7f00000004c0)='net/rt_cache\x00')
preadv(r0, &(0x7f00000017c0), 0x14a, 0x0)

[  434.686472] binder: 21876:21879 ioctl 40046207 0 returned -16
[  434.706995] binder: 21873:21884 BC_INCREFS_DONE node 914 has no pending increfs request
[  434.736002] binder: BINDER_SET_CONTEXT_MGR already set
[  434.741298] binder: 21882:21890 ioctl 40046207 0 returned -16
05:03:25 executing program 1:
r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000200)='/dev/nullb0\x00', 0x5000000084002, 0x0)
mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x200000e, 0x13, r0, 0x0)
r1 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x4000, 0x0)
preadv(r1, &(0x7f0000000040)=[{&(0x7f0000000400)=""/4096, 0x3ffc00}], 0x1cd, 0x0)

05:03:25 executing program 3:
recvmmsg(0xffffffffffffffff, &(0x7f0000003140)=[{{&(0x7f0000001400)=@ipx, 0x80, 0x0}}], 0x1, 0x0, 0x0)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = syz_open_procfs(0x0, &(0x7f00000004c0)='net/rt_cache\x00')
preadv(r0, &(0x7f00000017c0), 0x14b, 0x0)

[  434.797540] binder: 21876:21888 BC_INCREFS_DONE node 917 has no pending increfs request
[  434.836615] binder: 21876:21888 BC_ACQUIRE_DONE node 917 has no pending acquire request
05:03:25 executing program 0:
recvmmsg(0xffffffffffffffff, &(0x7f0000003140)=[{{&(0x7f0000001400)=@ipx, 0x80, 0x0}}], 0x1, 0x0, 0x0)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = syz_open_procfs(0x0, &(0x7f00000004c0)='net/rt_cache\x00')
preadv(r0, &(0x7f00000017c0), 0x14a, 0x0)

05:03:25 executing program 5:
r0 = syz_open_dev$sndtimer(&(0x7f0000026000)='/dev/snd/timer\x00', 0x0, 0x0)
r1 = dup3(r0, r0, 0x80000)
ioctl$UI_GET_SYSNAME(r1, 0x8040552c, 0x0)
perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8)
r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c)
bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r2, &(0x7f0000000040), 0x0, 0x1}, 0x20)
openat$cgroup_ro(r1, &(0x7f00000004c0)='cpuset.effective_cpus\x00', 0x0, 0x0)
unlink(&(0x7f0000000900)='./file0/file0\x00')
r3 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r4 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r4, 0x0)
ioctl$BINDER_GET_NODE_DEBUG_INFO(0xffffffffffffffff, 0xc018620b, &(0x7f0000000780))
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f00000000c0)=[@enter_looper], 0x48, 0x0, &(0x7f0000000700)="2ba063fb309ec7fdbfb08e6e91baee7d7d4599fe14129a4d426834556ae420e087d59c0c7be7fcad1abb7e1f8f446f373f611ca1ee9c2231708e18a47bc68a2a79a0b48931f6ff6d"})
ioctl$sock_inet_tcp_SIOCOUTQNSD(r1, 0x894b, &(0x7f0000000480))
getsockopt$inet_IP_IPSEC_POLICY(0xffffffffffffffff, 0x0, 0x10, &(0x7f0000000540)={{{@in6, @in=@remote}}, {{@in6=@ipv4={[], [], @local}}, 0x0, @in6}}, &(0x7f0000000000)=0xe8)
ioctl$BINDER_SET_CONTEXT_MGR(r4, 0x40046207, 0x0)
dup(r4)
prctl$PR_SET_NAME(0xf, &(0x7f0000000380)='/group.stat\x00')
syz_open_dev$binder(&(0x7f0000000880)='/dev/binder#\x00', 0x0, 0x2)
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)})
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, &(0x7f0000000780)})
ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f0000000680)})
creat(&(0x7f00000000c0)='./file0\x00', 0x0)
openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000100)='/group.stat\x00', 0x2761, 0x0)
clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000080), 0xffffffffffffffff)
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000003c0)={0x14, 0x0, &(0x7f0000000680)=[@acquire_done], 0x0, 0x0, 0x0})

05:03:25 executing program 4:
r0 = syz_open_dev$sndtimer(&(0x7f0000026000)='/dev/snd/timer\x00', 0x0, 0x0)
r1 = dup3(r0, r0, 0x80000)
ioctl$UI_GET_SYSNAME(r1, 0x8040552c, 0x0)
perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8)
r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c)
bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r2, &(0x7f0000000040), 0x0, 0x1}, 0x20)
openat$cgroup_ro(r1, &(0x7f00000004c0)='cpuset.effective_cpus\x00', 0x0, 0x0)
unlink(&(0x7f0000000900)='./file0/file0\x00')
r3 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r4 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r4, 0x0)
ioctl$BINDER_GET_NODE_DEBUG_INFO(0xffffffffffffffff, 0xc018620b, &(0x7f0000000780))
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f00000000c0)=[@enter_looper], 0x48, 0x0, &(0x7f0000000700)="2ba063fb309ec7fdbfb08e6e91baee7d7d4599fe14129a4d426834556ae420e087d59c0c7be7fcad1abb7e1f8f446f373f611ca1ee9c2231708e18a47bc68a2a79a0b48931f6ff6d"})
ioctl$sock_inet_tcp_SIOCOUTQNSD(r1, 0x894b, &(0x7f0000000480))
getsockopt$inet_IP_IPSEC_POLICY(0xffffffffffffffff, 0x0, 0x10, &(0x7f0000000540)={{{@in6, @in=@remote}}, {{@in6=@ipv4={[], [], @local}}, 0x0, @in6}}, &(0x7f0000000000)=0xe8)
ioctl$BINDER_SET_CONTEXT_MGR(r4, 0x40046207, 0x0)
shutdown(0xffffffffffffffff, 0x1)
prctl$PR_SET_NAME(0xf, &(0x7f0000000380)='/group.stat\x00')
syz_open_dev$binder(&(0x7f0000000880)='/dev/binder#\x00', 0x0, 0x2)
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)})
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, &(0x7f0000000780)})
ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f0000000680)})
creat(&(0x7f00000000c0)='./file0\x00', 0x0)
openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000100)='/group.stat\x00', 0x2761, 0x0)
clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000080), 0xffffffffffffffff)
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000003c0)={0x14, 0x0, &(0x7f0000000680)=[@acquire_done], 0x0, 0x0, 0x0})

[  434.959880] binder: release 21873:21874 transaction 913 out, still active
[  434.978415] binder: unexpected work type, 4, not freed
[  435.007412] binder: undelivered TRANSACTION_COMPLETE
[  435.103086] binder: BINDER_SET_CONTEXT_MGR already set
[  435.159854] binder: BINDER_SET_CONTEXT_MGR already set
[  435.177168] binder: 22015:22016 ioctl 40046207 0 returned -16
[  435.197087] binder: 22013:22018 ioctl 40046207 0 returned -16
[  435.380622] binder: 22013:22021 BC_INCREFS_DONE node 926 has no pending increfs request
[  435.409734] binder: 22013:22021 BC_ACQUIRE_DONE node 926 has no pending acquire request
05:03:25 executing program 2:
r0 = syz_open_dev$sndtimer(&(0x7f0000026000)='/dev/snd/timer\x00', 0x0, 0x0)
r1 = dup3(r0, r0, 0x80000)
ioctl$UI_GET_SYSNAME(r1, 0x8040552c, 0x0)
perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8)
r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c)
bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r2, &(0x7f0000000040), 0x0, 0x1}, 0x20)
openat$cgroup_ro(r1, &(0x7f00000004c0)='cpuset.effective_cpus\x00', 0x0, 0x0)
unlink(&(0x7f0000000900)='./file0/file0\x00')
r3 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r4 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r4, 0x0)
ioctl$BINDER_GET_NODE_DEBUG_INFO(r3, 0xc018620b, &(0x7f0000000780))
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f00000000c0)=[@enter_looper], 0x47, 0x0, &(0x7f0000000700)="2ba063fb309ec7fdbfb08e6e91baee7d7d4599fe14129a4d426834556ae420e087d59c0c7be7fcad1abb7e1f8f446f373f611ca1ee9c2231708e18a47bc68a2a79a0b48931f6ff"})
ioctl$sock_inet_tcp_SIOCOUTQNSD(r1, 0x894b, &(0x7f0000000480))
getsockopt$inet_IP_IPSEC_POLICY(0xffffffffffffffff, 0x0, 0x10, &(0x7f0000000540)={{{@in6, @in=@remote}}, {{@in6=@ipv4={[], [], @local}}, 0x0, @in6}}, &(0x7f0000000000)=0xe8)
ioctl$BINDER_SET_CONTEXT_MGR(r4, 0x40046207, 0x0)
r5 = dup(r4)
shutdown(r5, 0x1)
prctl$PR_SET_NAME(0xf, &(0x7f0000000380)='/group.stat\x00')
syz_open_dev$binder(&(0x7f0000000880)='/dev/binder#\x00', 0x0, 0x2)
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)})
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, &(0x7f0000000780)})
ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f0000000680)})
creat(&(0x7f00000000c0)='./file0\x00', 0x0)
openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000100)='/group.stat\x00', 0x2761, 0x0)
clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000080), 0xffffffffffffffff)
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000003c0)={0x14, 0x0, &(0x7f0000000680)=[@acquire_done], 0x0, 0x0, 0x0})

05:03:25 executing program 0:
recvmmsg(0xffffffffffffffff, &(0x7f0000003140)=[{{&(0x7f0000001400)=@ipx, 0x80, 0x0}}], 0x1, 0x0, 0x0)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = syz_open_procfs(0x0, &(0x7f00000004c0)='net/rt_cache\x00')
preadv(r0, &(0x7f00000017c0), 0x14b, 0x0)

05:03:25 executing program 3:
recvmmsg(0xffffffffffffffff, &(0x7f0000003140)=[{{&(0x7f0000001400)=@ipx, 0x80, 0x0}}], 0x1, 0x0, 0x0)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = syz_open_procfs(0x0, &(0x7f00000004c0)='net/rt_cache\x00')
preadv(r0, &(0x7f00000017c0), 0x14c, 0x0)

05:03:25 executing program 4:
r0 = syz_open_dev$sndtimer(&(0x7f0000026000)='/dev/snd/timer\x00', 0x0, 0x0)
r1 = dup3(r0, r0, 0x80000)
ioctl$UI_GET_SYSNAME(r1, 0x8040552c, 0x0)
perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8)
r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c)
bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r2, &(0x7f0000000040), 0x0, 0x1}, 0x20)
openat$cgroup_ro(r1, &(0x7f00000004c0)='cpuset.effective_cpus\x00', 0x0, 0x0)
unlink(&(0x7f0000000900)='./file0/file0\x00')
r3 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r4 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r4, 0x0)
ioctl$BINDER_GET_NODE_DEBUG_INFO(0xffffffffffffffff, 0xc018620b, &(0x7f0000000780))
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f00000000c0)=[@enter_looper], 0x48, 0x0, &(0x7f0000000700)="2ba063fb309ec7fdbfb08e6e91baee7d7d4599fe14129a4d426834556ae420e087d59c0c7be7fcad1abb7e1f8f446f373f611ca1ee9c2231708e18a47bc68a2a79a0b48931f6ff6d"})
ioctl$sock_inet_tcp_SIOCOUTQNSD(r1, 0x894b, &(0x7f0000000480))
getsockopt$inet_IP_IPSEC_POLICY(0xffffffffffffffff, 0x0, 0x10, &(0x7f0000000540)={{{@in6, @in=@remote}}, {{@in6=@ipv4={[], [], @local}}, 0x0, @in6}}, &(0x7f0000000000)=0xe8)
r5 = dup(r4)
shutdown(r5, 0x1)
prctl$PR_SET_NAME(0xf, &(0x7f0000000380)='/group.stat\x00')
syz_open_dev$binder(&(0x7f0000000880)='/dev/binder#\x00', 0x0, 0x2)
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)})
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, &(0x7f0000000780)})
ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f0000000680)})
creat(&(0x7f00000000c0)='./file0\x00', 0x0)
openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000100)='/group.stat\x00', 0x2761, 0x0)
clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000080), 0xffffffffffffffff)
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000003c0)={0x14, 0x0, &(0x7f0000000680)=[@acquire_done], 0x0, 0x0, 0x0})

05:03:25 executing program 1:
r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000200)='/dev/nullb0\x00', 0x5000000084002, 0x0)
mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x200000e, 0x13, r0, 0x0)
r1 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x4000, 0x0)
preadv(r1, &(0x7f0000000040)=[{&(0x7f0000000400)=""/4096, 0x3ffc00}], 0x1ce, 0x0)

05:03:25 executing program 3:
recvmmsg(0xffffffffffffffff, &(0x7f0000003140)=[{{&(0x7f0000001400)=@ipx, 0x80, 0x0}}], 0x1, 0x0, 0x0)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = syz_open_procfs(0x0, &(0x7f00000004c0)='net/rt_cache\x00')
preadv(r0, &(0x7f00000017c0), 0x14d, 0x0)

05:03:25 executing program 0:
recvmmsg(0xffffffffffffffff, &(0x7f0000003140)=[{{&(0x7f0000001400)=@ipx, 0x80, 0x0}}], 0x1, 0x0, 0x0)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = syz_open_procfs(0x0, &(0x7f00000004c0)='net/rt_cache\x00')
preadv(r0, &(0x7f00000017c0), 0x14c, 0x0)

[  435.604644] IPVS: stopping master sync thread 7873 ...
[  435.610758] binder: 22032:22043 BC_INCREFS_DONE node 929 has no pending increfs request
[  435.620080] IPVS: stopping backup sync thread 8564 ...
[  435.626256] binder: BINDER_SET_CONTEXT_MGR already set
[  435.631556] binder: 22039:22044 ioctl 40046207 0 returned -16
[  435.639376] binder: 22032:22043 BC_ACQUIRE_DONE node 929 has no pending acquire request
05:03:26 executing program 3:
recvmmsg(0xffffffffffffffff, &(0x7f0000003140)=[{{&(0x7f0000001400)=@ipx, 0x80, 0x0}}], 0x1, 0x0, 0x0)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = syz_open_procfs(0x0, &(0x7f00000004c0)='net/rt_cache\x00')
preadv(r0, &(0x7f00000017c0), 0x14e, 0x0)

05:03:26 executing program 0:
recvmmsg(0xffffffffffffffff, &(0x7f0000003140)=[{{&(0x7f0000001400)=@ipx, 0x80, 0x0}}], 0x1, 0x0, 0x0)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = syz_open_procfs(0x0, &(0x7f00000004c0)='net/rt_cache\x00')
preadv(r0, &(0x7f00000017c0), 0x14d, 0x0)

05:03:26 executing program 3:
recvmmsg(0xffffffffffffffff, &(0x7f0000003140)=[{{&(0x7f0000001400)=@ipx, 0x80, 0x0}}], 0x1, 0x0, 0x0)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = syz_open_procfs(0x0, &(0x7f00000004c0)='net/rt_cache\x00')
preadv(r0, &(0x7f00000017c0), 0x14f, 0x0)

[  435.812136] binder: unexpected work type, 4, not freed
05:03:26 executing program 5:
r0 = syz_open_dev$sndtimer(&(0x7f0000026000)='/dev/snd/timer\x00', 0x0, 0x0)
r1 = dup3(r0, r0, 0x80000)
ioctl$UI_GET_SYSNAME(r1, 0x8040552c, 0x0)
perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8)
r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c)
bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r2, &(0x7f0000000040), 0x0, 0x1}, 0x20)
openat$cgroup_ro(r1, &(0x7f00000004c0)='cpuset.effective_cpus\x00', 0x0, 0x0)
unlink(&(0x7f0000000900)='./file0/file0\x00')
r3 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r4 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r4, 0x0)
ioctl$BINDER_GET_NODE_DEBUG_INFO(0xffffffffffffffff, 0xc018620b, &(0x7f0000000780))
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f00000000c0)=[@enter_looper], 0x48, 0x0, &(0x7f0000000700)="2ba063fb309ec7fdbfb08e6e91baee7d7d4599fe14129a4d426834556ae420e087d59c0c7be7fcad1abb7e1f8f446f373f611ca1ee9c2231708e18a47bc68a2a79a0b48931f6ff6d"})
ioctl$sock_inet_tcp_SIOCOUTQNSD(r1, 0x894b, &(0x7f0000000480))
getsockopt$inet_IP_IPSEC_POLICY(0xffffffffffffffff, 0x0, 0x10, &(0x7f0000000540)={{{@in6, @in=@remote}}, {{@in6=@ipv4={[], [], @local}}, 0x0, @in6}}, &(0x7f0000000000)=0xe8)
ioctl$BINDER_SET_CONTEXT_MGR(r4, 0x40046207, 0x0)
shutdown(0xffffffffffffffff, 0x1)
prctl$PR_SET_NAME(0xf, &(0x7f0000000380)='/group.stat\x00')
syz_open_dev$binder(&(0x7f0000000880)='/dev/binder#\x00', 0x0, 0x2)
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)})
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, &(0x7f0000000780)})
ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f0000000680)})
creat(&(0x7f00000000c0)='./file0\x00', 0x0)
openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000100)='/group.stat\x00', 0x2761, 0x0)
clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000080), 0xffffffffffffffff)
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000003c0)={0x14, 0x0, &(0x7f0000000680)=[@acquire_done], 0x0, 0x0, 0x0})

05:03:26 executing program 0:
recvmmsg(0xffffffffffffffff, &(0x7f0000003140)=[{{&(0x7f0000001400)=@ipx, 0x80, 0x0}}], 0x1, 0x0, 0x0)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = syz_open_procfs(0x0, &(0x7f00000004c0)='net/rt_cache\x00')
preadv(r0, &(0x7f00000017c0), 0x14e, 0x0)

[  435.852183] binder: undelivered TRANSACTION_COMPLETE
[  435.946906] binder_set_nice: 8 callbacks suppressed
[  435.946950] binder: 22070 RLIMIT_NICE not set
[  435.963259] binder: BINDER_SET_CONTEXT_MGR already set
[  435.970454] binder: 22069:22070 ioctl 40046207 0 returned -16
[  436.039224] binder: 22069:22076 BC_INCREFS_DONE node 935 has no pending increfs request
[  436.050115] device bridge_slave_1 left promiscuous mode
[  436.062836] bridge0: port 2(bridge_slave_1) entered disabled state
[  436.076615] binder_thread_write: 6 callbacks suppressed
[  436.076629] binder: 22069:22076 Release 1 refcount change on invalid ref 1 ret -22
[  436.095778] binder: 22069:22076 BC_ACQUIRE_DONE node 935 has no pending acquire request
[  436.120712] device bridge_slave_0 left promiscuous mode
[  436.126450] bridge0: port 1(bridge_slave_0) entered disabled state
[  436.284632] binder: unexpected work type, 4, not freed
[  436.290099] binder: undelivered TRANSACTION_COMPLETE
05:03:26 executing program 2:
r0 = syz_open_dev$sndtimer(&(0x7f0000026000)='/dev/snd/timer\x00', 0x0, 0x0)
r1 = dup3(r0, r0, 0x80000)
ioctl$UI_GET_SYSNAME(r1, 0x8040552c, 0x0)
perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8)
r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c)
bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r2, &(0x7f0000000040), 0x0, 0x1}, 0x20)
openat$cgroup_ro(r1, &(0x7f00000004c0)='cpuset.effective_cpus\x00', 0x0, 0x0)
unlink(&(0x7f0000000900)='./file0/file0\x00')
r3 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r4 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r4, 0x0)
ioctl$BINDER_GET_NODE_DEBUG_INFO(r3, 0xc018620b, &(0x7f0000000780))
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f00000000c0)=[@enter_looper], 0x47, 0x0, &(0x7f0000000700)="2ba063fb309ec7fdbfb08e6e91baee7d7d4599fe14129a4d426834556ae420e087d59c0c7be7fcad1abb7e1f8f446f373f611ca1ee9c2231708e18a47bc68a2a79a0b48931f6ff"})
ioctl$sock_inet_tcp_SIOCOUTQNSD(r1, 0x894b, &(0x7f0000000480))
getsockopt$inet_IP_IPSEC_POLICY(0xffffffffffffffff, 0x0, 0x10, &(0x7f0000000540)={{{@in6, @in=@remote}}, {{@in6=@ipv4={[], [], @local}}, 0x0, @in6}}, &(0x7f0000000000)=0xe8)
ioctl$BINDER_SET_CONTEXT_MGR(r4, 0x40046207, 0x0)
r5 = dup(r4)
shutdown(r5, 0x1)
prctl$PR_SET_NAME(0xf, &(0x7f0000000380)='/group.stat\x00')
syz_open_dev$binder(&(0x7f0000000880)='/dev/binder#\x00', 0x0, 0x2)
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)})
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, &(0x7f0000000780)})
ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f0000000680)})
creat(&(0x7f00000000c0)='./file0\x00', 0x0)
openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000100)='/group.stat\x00', 0x2761, 0x0)
clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000080), 0xffffffffffffffff)
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000003c0)={0x14, 0x0, &(0x7f0000000680)=[@acquire_done], 0x0, 0x0, 0x0})

05:03:26 executing program 3:
recvmmsg(0xffffffffffffffff, &(0x7f0000003140)=[{{&(0x7f0000001400)=@ipx, 0x80, 0x0}}], 0x1, 0x0, 0x0)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = syz_open_procfs(0x0, &(0x7f00000004c0)='net/rt_cache\x00')
preadv(r0, &(0x7f00000017c0), 0x150, 0x0)

05:03:26 executing program 5:
r0 = syz_open_dev$sndtimer(&(0x7f0000026000)='/dev/snd/timer\x00', 0x0, 0x0)
r1 = dup3(r0, r0, 0x80000)
ioctl$UI_GET_SYSNAME(r1, 0x8040552c, 0x0)
perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8)
r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c)
bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r2, &(0x7f0000000040), 0x0, 0x1}, 0x20)
openat$cgroup_ro(r1, &(0x7f00000004c0)='cpuset.effective_cpus\x00', 0x0, 0x0)
unlink(&(0x7f0000000900)='./file0/file0\x00')
r3 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r4 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r4, 0x0)
ioctl$BINDER_GET_NODE_DEBUG_INFO(0xffffffffffffffff, 0xc018620b, &(0x7f0000000780))
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f00000000c0)=[@enter_looper], 0x48, 0x0, &(0x7f0000000700)="2ba063fb309ec7fdbfb08e6e91baee7d7d4599fe14129a4d426834556ae420e087d59c0c7be7fcad1abb7e1f8f446f373f611ca1ee9c2231708e18a47bc68a2a79a0b48931f6ff6d"})
ioctl$sock_inet_tcp_SIOCOUTQNSD(r1, 0x894b, &(0x7f0000000480))
getsockopt$inet_IP_IPSEC_POLICY(0xffffffffffffffff, 0x0, 0x10, &(0x7f0000000540)={{{@in6, @in=@remote}}, {{@in6=@ipv4={[], [], @local}}, 0x0, @in6}}, &(0x7f0000000000)=0xe8)
ioctl$BINDER_SET_CONTEXT_MGR(r4, 0x40046207, 0x0)
shutdown(0xffffffffffffffff, 0x1)
prctl$PR_SET_NAME(0xf, &(0x7f0000000380)='/group.stat\x00')
syz_open_dev$binder(&(0x7f0000000880)='/dev/binder#\x00', 0x0, 0x2)
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)})
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, &(0x7f0000000780)})
ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f0000000680)})
creat(&(0x7f00000000c0)='./file0\x00', 0x0)
openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000100)='/group.stat\x00', 0x2761, 0x0)
clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000080), 0xffffffffffffffff)
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000003c0)={0x14, 0x0, &(0x7f0000000680)=[@acquire_done], 0x0, 0x0, 0x0})

05:03:26 executing program 0:
recvmmsg(0xffffffffffffffff, &(0x7f0000003140)=[{{&(0x7f0000001400)=@ipx, 0x80, 0x0}}], 0x1, 0x0, 0x0)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = syz_open_procfs(0x0, &(0x7f00000004c0)='net/rt_cache\x00')
preadv(r0, &(0x7f00000017c0), 0x14f, 0x0)

05:03:26 executing program 1:
r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000200)='/dev/nullb0\x00', 0x5000000084002, 0x0)
mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x200000e, 0x13, r0, 0x0)
r1 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x4000, 0x0)
preadv(r1, &(0x7f0000000040)=[{&(0x7f0000000400)=""/4096, 0x3ffc00}], 0x1cf, 0x0)

05:03:26 executing program 4:
r0 = syz_open_dev$sndtimer(&(0x7f0000026000)='/dev/snd/timer\x00', 0x0, 0x0)
r1 = dup3(r0, r0, 0x80000)
ioctl$UI_GET_SYSNAME(r1, 0x8040552c, 0x0)
perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8)
r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c)
bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r2, &(0x7f0000000040), 0x0, 0x1}, 0x20)
openat$cgroup_ro(r1, &(0x7f00000004c0)='cpuset.effective_cpus\x00', 0x0, 0x0)
unlink(&(0x7f0000000900)='./file0/file0\x00')
r3 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r4 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r4, 0x0)
ioctl$BINDER_GET_NODE_DEBUG_INFO(0xffffffffffffffff, 0xc018620b, &(0x7f0000000780))
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f00000000c0)=[@enter_looper], 0x48, 0x0, &(0x7f0000000700)="2ba063fb309ec7fdbfb08e6e91baee7d7d4599fe14129a4d426834556ae420e087d59c0c7be7fcad1abb7e1f8f446f373f611ca1ee9c2231708e18a47bc68a2a79a0b48931f6ff6d"})
ioctl$sock_inet_tcp_SIOCOUTQNSD(r1, 0x894b, &(0x7f0000000480))
getsockopt$inet_IP_IPSEC_POLICY(0xffffffffffffffff, 0x0, 0x10, &(0x7f0000000540)={{{@in6, @in=@remote}}, {{@in6=@ipv4={[], [], @local}}, 0x0, @in6}}, &(0x7f0000000000)=0xe8)
r5 = dup(r4)
shutdown(r5, 0x1)
prctl$PR_SET_NAME(0xf, &(0x7f0000000380)='/group.stat\x00')
syz_open_dev$binder(&(0x7f0000000880)='/dev/binder#\x00', 0x0, 0x2)
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)})
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, &(0x7f0000000780)})
ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f0000000680)})
creat(&(0x7f00000000c0)='./file0\x00', 0x0)
openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000100)='/group.stat\x00', 0x2761, 0x0)
clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000080), 0xffffffffffffffff)
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000003c0)={0x14, 0x0, &(0x7f0000000680)=[@acquire_done], 0x0, 0x0, 0x0})

[  436.441121] binder: 22085 RLIMIT_NICE not set
05:03:26 executing program 0:
recvmmsg(0xffffffffffffffff, &(0x7f0000003140)=[{{&(0x7f0000001400)=@ipx, 0x80, 0x0}}], 0x1, 0x0, 0x0)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = syz_open_procfs(0x0, &(0x7f00000004c0)='net/rt_cache\x00')
preadv(r0, &(0x7f00000017c0), 0x150, 0x0)

[  436.483499] binder: 22087 RLIMIT_NICE not set
[  436.487519] binder: BINDER_SET_CONTEXT_MGR already set
[  436.492116] binder: 22084:22085 ioctl 40046207 0 returned -16
05:03:26 executing program 3:
recvmmsg(0xffffffffffffffff, &(0x7f0000003140)=[{{&(0x7f0000001400)=@ipx, 0x80, 0x0}}], 0x1, 0x0, 0x0)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = syz_open_procfs(0x0, &(0x7f00000004c0)='net/rt_cache\x00')
preadv(r0, &(0x7f00000017c0), 0x151, 0x0)

[  436.538190] binder: 22096 RLIMIT_NICE not set
[  436.584344] binder: BINDER_SET_CONTEXT_MGR already set
[  436.611009] binder: 22095:22099 ioctl 40046207 0 returned -16
[  436.621147] binder: 22086:22107 Release 1 refcount change on invalid ref 1 ret -22
[  436.641716] binder: 22095:22099 Release 1 refcount change on invalid ref 1 ret -22
05:03:27 executing program 0:
recvmmsg(0xffffffffffffffff, &(0x7f0000003140)=[{{&(0x7f0000001400)=@ipx, 0x80, 0x0}}], 0x1, 0x0, 0x0)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = syz_open_procfs(0x0, &(0x7f00000004c0)='net/rt_cache\x00')
preadv(r0, &(0x7f00000017c0), 0x151, 0x0)

05:03:27 executing program 3:
recvmmsg(0xffffffffffffffff, &(0x7f0000003140)=[{{&(0x7f0000001400)=@ipx, 0x80, 0x0}}], 0x1, 0x0, 0x0)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = syz_open_procfs(0x0, &(0x7f00000004c0)='net/rt_cache\x00')
preadv(r0, &(0x7f00000017c0), 0x152, 0x0)

[  436.653979] binder: 22086:22107 BC_ACQUIRE_DONE node 938 has no pending acquire request
[  436.664226] binder: 22084:22085 Release 1 refcount change on invalid ref 1 ret -22
[  436.735676] binder_thread_release: 5 callbacks suppressed
[  436.735687] binder: release 22084:22101 transaction 940 out, still active
05:03:27 executing program 0:
recvmmsg(0xffffffffffffffff, &(0x7f0000003140)=[{{&(0x7f0000001400)=@ipx, 0x80, 0x0}}], 0x1, 0x0, 0x0)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = syz_open_procfs(0x0, &(0x7f00000004c0)='net/rt_cache\x00')
preadv(r0, &(0x7f00000017c0), 0x152, 0x0)

05:03:27 executing program 5:
r0 = syz_open_dev$sndtimer(&(0x7f0000026000)='/dev/snd/timer\x00', 0x0, 0x0)
r1 = dup3(r0, r0, 0x80000)
ioctl$UI_GET_SYSNAME(r1, 0x8040552c, 0x0)
perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8)
r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c)
bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r2, &(0x7f0000000040), 0x0, 0x1}, 0x20)
openat$cgroup_ro(r1, &(0x7f00000004c0)='cpuset.effective_cpus\x00', 0x0, 0x0)
unlink(&(0x7f0000000900)='./file0/file0\x00')
r3 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r4 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r4, 0x0)
ioctl$BINDER_GET_NODE_DEBUG_INFO(0xffffffffffffffff, 0xc018620b, &(0x7f0000000780))
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f00000000c0)=[@enter_looper], 0x48, 0x0, &(0x7f0000000700)="2ba063fb309ec7fdbfb08e6e91baee7d7d4599fe14129a4d426834556ae420e087d59c0c7be7fcad1abb7e1f8f446f373f611ca1ee9c2231708e18a47bc68a2a79a0b48931f6ff6d"})
ioctl$sock_inet_tcp_SIOCOUTQNSD(r1, 0x894b, &(0x7f0000000480))
getsockopt$inet_IP_IPSEC_POLICY(0xffffffffffffffff, 0x0, 0x10, &(0x7f0000000540)={{{@in6, @in=@remote}}, {{@in6=@ipv4={[], [], @local}}, 0x0, @in6}}, &(0x7f0000000000)=0xe8)
r5 = dup(r4)
shutdown(r5, 0x1)
prctl$PR_SET_NAME(0xf, &(0x7f0000000380)='/group.stat\x00')
syz_open_dev$binder(&(0x7f0000000880)='/dev/binder#\x00', 0x0, 0x2)
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)})
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, &(0x7f0000000780)})
ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f0000000680)})
creat(&(0x7f00000000c0)='./file0\x00', 0x0)
openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000100)='/group.stat\x00', 0x2761, 0x0)
clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000080), 0xffffffffffffffff)
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000003c0)={0x14, 0x0, &(0x7f0000000680)=[@acquire_done], 0x0, 0x0, 0x0})

[  436.994919] binder: 22129 RLIMIT_NICE not set
[  437.085082] binder: 22128:22131 Release 1 refcount change on invalid ref 1 ret -22
[  437.104338] binder: 22128:22131 BC_ACQUIRE_DONE node 947 has no pending acquire request
[  437.213851] binder: release 22086:22087 transaction 937 out, still active
[  437.220803] binder: unexpected work type, 4, not freed
[  437.249851] binder: undelivered TRANSACTION_COMPLETE
[  437.303721] binder: release 22095:22099 transaction 943 out, still active
05:03:27 executing program 2:
r0 = syz_open_dev$sndtimer(&(0x7f0000026000)='/dev/snd/timer\x00', 0x0, 0x0)
r1 = dup3(r0, r0, 0x80000)
ioctl$UI_GET_SYSNAME(r1, 0x8040552c, 0x0)
perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8)
r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c)
bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r2, &(0x7f0000000040), 0x0, 0x1}, 0x20)
openat$cgroup_ro(r1, &(0x7f00000004c0)='cpuset.effective_cpus\x00', 0x0, 0x0)
unlink(&(0x7f0000000900)='./file0/file0\x00')
r3 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r4 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r4, 0x0)
ioctl$BINDER_GET_NODE_DEBUG_INFO(r3, 0xc018620b, &(0x7f0000000780))
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f00000000c0)=[@enter_looper], 0x47, 0x0, &(0x7f0000000700)="2ba063fb309ec7fdbfb08e6e91baee7d7d4599fe14129a4d426834556ae420e087d59c0c7be7fcad1abb7e1f8f446f373f611ca1ee9c2231708e18a47bc68a2a79a0b48931f6ff"})
ioctl$sock_inet_tcp_SIOCOUTQNSD(r1, 0x894b, &(0x7f0000000480))
getsockopt$inet_IP_IPSEC_POLICY(0xffffffffffffffff, 0x0, 0x10, &(0x7f0000000540)={{{@in6, @in=@remote}}, {{@in6=@ipv4={[], [], @local}}, 0x0, @in6}}, &(0x7f0000000000)=0xe8)
ioctl$BINDER_SET_CONTEXT_MGR(r4, 0x40046207, 0x0)
r5 = dup(r4)
shutdown(r5, 0x1)
prctl$PR_SET_NAME(0xf, &(0x7f0000000380)='/group.stat\x00')
syz_open_dev$binder(&(0x7f0000000880)='/dev/binder#\x00', 0x0, 0x2)
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)})
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, &(0x7f0000000780)})
ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f0000000680)})
creat(&(0x7f00000000c0)='./file0\x00', 0x0)
openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000100)='/group.stat\x00', 0x2761, 0x0)
clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000080), 0xffffffffffffffff)
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000003c0)={0x14, 0x0, &(0x7f0000000680)=[@acquire_done], 0x0, 0x0, 0x0})

05:03:27 executing program 3:
recvmmsg(0xffffffffffffffff, &(0x7f0000003140)=[{{&(0x7f0000001400)=@ipx, 0x80, 0x0}}], 0x1, 0x0, 0x0)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = syz_open_procfs(0x0, &(0x7f00000004c0)='net/rt_cache\x00')
preadv(r0, &(0x7f00000017c0), 0x153, 0x0)

05:03:27 executing program 0:
recvmmsg(0xffffffffffffffff, &(0x7f0000003140)=[{{&(0x7f0000001400)=@ipx, 0x80, 0x0}}], 0x1, 0x0, 0x0)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = syz_open_procfs(0x0, &(0x7f00000004c0)='net/rt_cache\x00')
preadv(r0, &(0x7f00000017c0), 0x153, 0x0)

05:03:27 executing program 5:
r0 = syz_open_dev$sndtimer(&(0x7f0000026000)='/dev/snd/timer\x00', 0x0, 0x0)
r1 = dup3(r0, r0, 0x80000)
ioctl$UI_GET_SYSNAME(r1, 0x8040552c, 0x0)
perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8)
r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c)
bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r2, &(0x7f0000000040), 0x0, 0x1}, 0x20)
openat$cgroup_ro(r1, &(0x7f00000004c0)='cpuset.effective_cpus\x00', 0x0, 0x0)
unlink(&(0x7f0000000900)='./file0/file0\x00')
r3 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r4 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r4, 0x0)
ioctl$BINDER_GET_NODE_DEBUG_INFO(0xffffffffffffffff, 0xc018620b, &(0x7f0000000780))
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f00000000c0)=[@enter_looper], 0x48, 0x0, &(0x7f0000000700)="2ba063fb309ec7fdbfb08e6e91baee7d7d4599fe14129a4d426834556ae420e087d59c0c7be7fcad1abb7e1f8f446f373f611ca1ee9c2231708e18a47bc68a2a79a0b48931f6ff6d"})
ioctl$sock_inet_tcp_SIOCOUTQNSD(r1, 0x894b, &(0x7f0000000480))
getsockopt$inet_IP_IPSEC_POLICY(0xffffffffffffffff, 0x0, 0x10, &(0x7f0000000540)={{{@in6, @in=@remote}}, {{@in6=@ipv4={[], [], @local}}, 0x0, @in6}}, &(0x7f0000000000)=0xe8)
r5 = dup(r4)
shutdown(r5, 0x1)
prctl$PR_SET_NAME(0xf, &(0x7f0000000380)='/group.stat\x00')
syz_open_dev$binder(&(0x7f0000000880)='/dev/binder#\x00', 0x0, 0x2)
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)})
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, &(0x7f0000000780)})
ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f0000000680)})
creat(&(0x7f00000000c0)='./file0\x00', 0x0)
openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000100)='/group.stat\x00', 0x2761, 0x0)
clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000080), 0xffffffffffffffff)
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000003c0)={0x14, 0x0, &(0x7f0000000680)=[@acquire_done], 0x0, 0x0, 0x0})

05:03:27 executing program 4:
r0 = syz_open_dev$sndtimer(&(0x7f0000026000)='/dev/snd/timer\x00', 0x0, 0x0)
r1 = dup3(r0, r0, 0x80000)
ioctl$UI_GET_SYSNAME(r1, 0x8040552c, 0x0)
perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8)
r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c)
bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r2, &(0x7f0000000040), 0x0, 0x1}, 0x20)
openat$cgroup_ro(r1, &(0x7f00000004c0)='cpuset.effective_cpus\x00', 0x0, 0x0)
unlink(&(0x7f0000000900)='./file0/file0\x00')
r3 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r4 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r4, 0x0)
ioctl$BINDER_GET_NODE_DEBUG_INFO(0xffffffffffffffff, 0xc018620b, &(0x7f0000000780))
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f00000000c0)=[@enter_looper], 0x48, 0x0, &(0x7f0000000700)="2ba063fb309ec7fdbfb08e6e91baee7d7d4599fe14129a4d426834556ae420e087d59c0c7be7fcad1abb7e1f8f446f373f611ca1ee9c2231708e18a47bc68a2a79a0b48931f6ff6d"})
ioctl$sock_inet_tcp_SIOCOUTQNSD(r1, 0x894b, &(0x7f0000000480))
getsockopt$inet_IP_IPSEC_POLICY(0xffffffffffffffff, 0x0, 0x10, &(0x7f0000000540)={{{@in6, @in=@remote}}, {{@in6=@ipv4={[], [], @local}}, 0x0, @in6}}, &(0x7f0000000000)=0xe8)
r5 = dup(r4)
shutdown(r5, 0x1)
prctl$PR_SET_NAME(0xf, &(0x7f0000000380)='/group.stat\x00')
syz_open_dev$binder(&(0x7f0000000880)='/dev/binder#\x00', 0x0, 0x2)
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)})
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, &(0x7f0000000780)})
ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f0000000680)})
creat(&(0x7f00000000c0)='./file0\x00', 0x0)
openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000100)='/group.stat\x00', 0x2761, 0x0)
clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000080), 0xffffffffffffffff)
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000003c0)={0x14, 0x0, &(0x7f0000000680)=[@acquire_done], 0x0, 0x0, 0x0})

05:03:27 executing program 1:
r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000200)='/dev/nullb0\x00', 0x5000000084002, 0x0)
mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x200000e, 0x13, r0, 0x0)
r1 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x4000, 0x0)
preadv(r1, &(0x7f0000000040)=[{&(0x7f0000000400)=""/4096, 0x3ffc00}], 0x1d0, 0x0)

05:03:27 executing program 3:
recvmmsg(0xffffffffffffffff, &(0x7f0000003140)=[{{&(0x7f0000001400)=@ipx, 0x80, 0x0}}], 0x1, 0x0, 0x0)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = syz_open_procfs(0x0, &(0x7f00000004c0)='net/rt_cache\x00')
preadv(r0, &(0x7f00000017c0), 0x154, 0x0)

05:03:27 executing program 0:
recvmmsg(0xffffffffffffffff, &(0x7f0000003140)=[{{&(0x7f0000001400)=@ipx, 0x80, 0x0}}], 0x1, 0x0, 0x0)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = syz_open_procfs(0x0, &(0x7f00000004c0)='net/rt_cache\x00')
preadv(r0, &(0x7f00000017c0), 0x154, 0x0)

[  437.469075] binder: 22151 RLIMIT_NICE not set
[  437.486210] binder: 22179 RLIMIT_NICE not set
[  437.532376] binder: BINDER_SET_CONTEXT_MGR already set
05:03:27 executing program 5:
r0 = syz_open_dev$sndtimer(&(0x7f0000026000)='/dev/snd/timer\x00', 0x0, 0x0)
r1 = dup3(r0, r0, 0x80000)
ioctl$UI_GET_SYSNAME(r1, 0x8040552c, 0x0)
perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8)
r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c)
bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r2, &(0x7f0000000040), 0x0, 0x1}, 0x20)
openat$cgroup_ro(r1, &(0x7f00000004c0)='cpuset.effective_cpus\x00', 0x0, 0x0)
unlink(&(0x7f0000000900)='./file0/file0\x00')
r3 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r4 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r4, 0x0)
ioctl$BINDER_GET_NODE_DEBUG_INFO(0xffffffffffffffff, 0xc018620b, &(0x7f0000000780))
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f00000000c0)=[@enter_looper], 0x48, 0x0, &(0x7f0000000700)="2ba063fb309ec7fdbfb08e6e91baee7d7d4599fe14129a4d426834556ae420e087d59c0c7be7fcad1abb7e1f8f446f373f611ca1ee9c2231708e18a47bc68a2a79a0b48931f6ff6d"})
ioctl$sock_inet_tcp_SIOCOUTQNSD(r1, 0x894b, &(0x7f0000000480))
getsockopt$inet_IP_IPSEC_POLICY(0xffffffffffffffff, 0x0, 0x10, &(0x7f0000000540)={{{@in6, @in=@remote}}, {{@in6=@ipv4={[], [], @local}}, 0x0, @in6}}, &(0x7f0000000000)=0xe8)
r5 = dup(r4)
shutdown(r5, 0x1)
prctl$PR_SET_NAME(0xf, &(0x7f0000000380)='/group.stat\x00')
syz_open_dev$binder(&(0x7f0000000880)='/dev/binder#\x00', 0x0, 0x2)
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)})
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, &(0x7f0000000780)})
ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f0000000680)})
creat(&(0x7f00000000c0)='./file0\x00', 0x0)
openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000100)='/group.stat\x00', 0x2761, 0x0)
clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000080), 0xffffffffffffffff)
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000003c0)={0x14, 0x0, &(0x7f0000000680)=[@acquire_done], 0x0, 0x0, 0x0})

[  437.553779] binder: 22176:22253 ioctl 40046207 0 returned -16
[  437.560292] binder_thread_write: 2 callbacks suppressed
[  437.560306] binder: 22142:22257 BC_INCREFS_DONE node 950 has no pending increfs request
[  437.587440] binder: 22176:22253 Release 1 refcount change on invalid ref 1 ret -22
[  437.606068] binder: 22142:22257 Release 1 refcount change on invalid ref 1 ret -22
05:03:28 executing program 3:
recvmmsg(0xffffffffffffffff, &(0x7f0000003140)=[{{&(0x7f0000001400)=@ipx, 0x80, 0x0}}], 0x1, 0x0, 0x0)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = syz_open_procfs(0x0, &(0x7f00000004c0)='net/rt_cache\x00')
preadv(r0, &(0x7f00000017c0), 0x155, 0x0)

05:03:28 executing program 0:
recvmmsg(0xffffffffffffffff, &(0x7f0000003140)=[{{&(0x7f0000001400)=@ipx, 0x80, 0x0}}], 0x1, 0x0, 0x0)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = syz_open_procfs(0x0, &(0x7f00000004c0)='net/rt_cache\x00')
preadv(r0, &(0x7f00000017c0), 0x155, 0x0)

[  437.646828] binder: 22142:22257 BC_ACQUIRE_DONE node 950 has no pending acquire request
05:03:28 executing program 5:
r0 = syz_open_dev$sndtimer(&(0x7f0000026000)='/dev/snd/timer\x00', 0x0, 0x0)
r1 = dup3(r0, r0, 0x80000)
ioctl$UI_GET_SYSNAME(r1, 0x8040552c, 0x0)
perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8)
r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c)
bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r2, &(0x7f0000000040), 0x0, 0x1}, 0x20)
openat$cgroup_ro(r1, &(0x7f00000004c0)='cpuset.effective_cpus\x00', 0x0, 0x0)
unlink(&(0x7f0000000900)='./file0/file0\x00')
r3 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r4 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r4, 0x0)
ioctl$BINDER_GET_NODE_DEBUG_INFO(0xffffffffffffffff, 0xc018620b, &(0x7f0000000780))
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f00000000c0)=[@enter_looper], 0x48, 0x0, &(0x7f0000000700)="2ba063fb309ec7fdbfb08e6e91baee7d7d4599fe14129a4d426834556ae420e087d59c0c7be7fcad1abb7e1f8f446f373f611ca1ee9c2231708e18a47bc68a2a79a0b48931f6ff6d"})
ioctl$sock_inet_tcp_SIOCOUTQNSD(r1, 0x894b, &(0x7f0000000480))
getsockopt$inet_IP_IPSEC_POLICY(0xffffffffffffffff, 0x0, 0x10, &(0x7f0000000540)={{{@in6, @in=@remote}}, {{@in6=@ipv4={[], [], @local}}, 0x0, @in6}}, &(0x7f0000000000)=0xe8)
r5 = dup(r4)
shutdown(r5, 0x1)
prctl$PR_SET_NAME(0xf, &(0x7f0000000380)='/group.stat\x00')
syz_open_dev$binder(&(0x7f0000000880)='/dev/binder#\x00', 0x0, 0x2)
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)})
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, &(0x7f0000000780)})
ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f0000000680)})
creat(&(0x7f00000000c0)='./file0\x00', 0x0)
openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000100)='/group.stat\x00', 0x2761, 0x0)
clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000080), 0xffffffffffffffff)
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000003c0)={0x14, 0x0, &(0x7f0000000680)=[@acquire_done], 0x0, 0x0, 0x0})

05:03:28 executing program 2:
r0 = syz_open_dev$sndtimer(&(0x7f0000026000)='/dev/snd/timer\x00', 0x0, 0x0)
r1 = dup3(r0, r0, 0x80000)
ioctl$UI_GET_SYSNAME(r1, 0x8040552c, 0x0)
perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8)
r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c)
bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r2, &(0x7f0000000040), 0x0, 0x1}, 0x20)
openat$cgroup_ro(r1, &(0x7f00000004c0)='cpuset.effective_cpus\x00', 0x0, 0x0)
unlink(&(0x7f0000000900)='./file0/file0\x00')
r3 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r4 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r4, 0x0)
ioctl$BINDER_GET_NODE_DEBUG_INFO(r3, 0xc018620b, &(0x7f0000000780))
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f00000000c0)=[@enter_looper], 0x48, 0x0, &(0x7f0000000700)="2ba063fb309ec7fdbfb08e6e91baee7d7d4599fe14129a4d426834556ae420e087d59c0c7be7fcad1abb7e1f8f446f373f611ca1ee9c2231708e18a47bc68a2a79a0b48931f6ff6d"})
ioctl$sock_inet_tcp_SIOCOUTQNSD(0xffffffffffffffff, 0x894b, &(0x7f0000000480))
getsockopt$inet_IP_IPSEC_POLICY(0xffffffffffffffff, 0x0, 0x10, &(0x7f0000000540)={{{@in6, @in=@remote}}, {{@in6=@ipv4={[], [], @local}}, 0x0, @in6}}, &(0x7f0000000000)=0xe8)
ioctl$BINDER_SET_CONTEXT_MGR(r4, 0x40046207, 0x0)
r5 = dup(r4)
shutdown(r5, 0x1)
prctl$PR_SET_NAME(0xf, &(0x7f0000000380)='/group.stat\x00')
syz_open_dev$binder(&(0x7f0000000880)='/dev/binder#\x00', 0x0, 0x2)
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)})
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, &(0x7f0000000780)})
ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f0000000680)})
creat(&(0x7f00000000c0)='./file0\x00', 0x0)
openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000100)='/group.stat\x00', 0x2761, 0x0)
clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000080), 0xffffffffffffffff)
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000003c0)={0x14, 0x0, &(0x7f0000000680)=[@acquire_done], 0x0, 0x0, 0x0})

05:03:28 executing program 3:
recvmmsg(0xffffffffffffffff, &(0x7f0000003140)=[{{&(0x7f0000001400)=@ipx, 0x80, 0x0}}], 0x1, 0x0, 0x0)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = syz_open_procfs(0x0, &(0x7f00000004c0)='net/rt_cache\x00')
preadv(r0, &(0x7f00000017c0), 0x156, 0x0)

05:03:28 executing program 0:
recvmmsg(0xffffffffffffffff, &(0x7f0000003140)=[{{&(0x7f0000001400)=@ipx, 0x80, 0x0}}], 0x1, 0x0, 0x0)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = syz_open_procfs(0x0, &(0x7f00000004c0)='net/rt_cache\x00')
preadv(r0, &(0x7f00000017c0), 0x156, 0x0)

05:03:28 executing program 5:
r0 = syz_open_dev$sndtimer(&(0x7f0000026000)='/dev/snd/timer\x00', 0x0, 0x0)
r1 = dup3(r0, r0, 0x80000)
ioctl$UI_GET_SYSNAME(r1, 0x8040552c, 0x0)
perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8)
r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c)
bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r2, &(0x7f0000000040), 0x0, 0x1}, 0x20)
openat$cgroup_ro(r1, &(0x7f00000004c0)='cpuset.effective_cpus\x00', 0x0, 0x0)
unlink(&(0x7f0000000900)='./file0/file0\x00')
r3 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r4 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r4, 0x0)
ioctl$BINDER_GET_NODE_DEBUG_INFO(0xffffffffffffffff, 0xc018620b, &(0x7f0000000780))
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f00000000c0)=[@enter_looper], 0x48, 0x0, &(0x7f0000000700)="2ba063fb309ec7fdbfb08e6e91baee7d7d4599fe14129a4d426834556ae420e087d59c0c7be7fcad1abb7e1f8f446f373f611ca1ee9c2231708e18a47bc68a2a79a0b48931f6ff6d"})
ioctl$sock_inet_tcp_SIOCOUTQNSD(r1, 0x894b, &(0x7f0000000480))
getsockopt$inet_IP_IPSEC_POLICY(0xffffffffffffffff, 0x0, 0x10, &(0x7f0000000540)={{{@in6, @in=@remote}}, {{@in6=@ipv4={[], [], @local}}, 0x0, @in6}}, &(0x7f0000000000)=0xe8)
r5 = dup(r4)
shutdown(r5, 0x1)
prctl$PR_SET_NAME(0xf, &(0x7f0000000380)='/group.stat\x00')
syz_open_dev$binder(&(0x7f0000000880)='/dev/binder#\x00', 0x0, 0x2)
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)})
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, &(0x7f0000000780)})
ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f0000000680)})
creat(&(0x7f00000000c0)='./file0\x00', 0x0)
openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000100)='/group.stat\x00', 0x2761, 0x0)
clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000080), 0xffffffffffffffff)
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000003c0)={0x14, 0x0, &(0x7f0000000680)=[@acquire_done], 0x0, 0x0, 0x0})

05:03:28 executing program 1:
r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000200)='/dev/nullb0\x00', 0x5000000084002, 0x0)
mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x200000e, 0x13, r0, 0x0)
r1 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x4000, 0x0)
preadv(r1, &(0x7f0000000040)=[{&(0x7f0000000400)=""/4096, 0x3ffc00}], 0x1d1, 0x0)

05:03:28 executing program 4:
r0 = syz_open_dev$sndtimer(&(0x7f0000026000)='/dev/snd/timer\x00', 0x0, 0x0)
r1 = dup3(r0, r0, 0x80000)
ioctl$UI_GET_SYSNAME(r1, 0x8040552c, 0x0)
perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8)
r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c)
bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r2, &(0x7f0000000040), 0x0, 0x1}, 0x20)
openat$cgroup_ro(r1, &(0x7f00000004c0)='cpuset.effective_cpus\x00', 0x0, 0x0)
unlink(&(0x7f0000000900)='./file0/file0\x00')
r3 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r4 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r4, 0x0)
ioctl$BINDER_GET_NODE_DEBUG_INFO(0xffffffffffffffff, 0xc018620b, &(0x7f0000000780))
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f00000000c0)=[@enter_looper], 0x48, 0x0, &(0x7f0000000700)="2ba063fb309ec7fdbfb08e6e91baee7d7d4599fe14129a4d426834556ae420e087d59c0c7be7fcad1abb7e1f8f446f373f611ca1ee9c2231708e18a47bc68a2a79a0b48931f6ff6d"})
ioctl$sock_inet_tcp_SIOCOUTQNSD(r1, 0x894b, &(0x7f0000000480))
ioctl$BINDER_SET_CONTEXT_MGR(r4, 0x40046207, 0x0)
r5 = dup(r4)
shutdown(r5, 0x1)
prctl$PR_SET_NAME(0xf, &(0x7f0000000380)='/group.stat\x00')
syz_open_dev$binder(&(0x7f0000000880)='/dev/binder#\x00', 0x0, 0x2)
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)})
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, &(0x7f0000000780)})
ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f0000000680)})
creat(&(0x7f00000000c0)='./file0\x00', 0x0)
openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000100)='/group.stat\x00', 0x2761, 0x0)
clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000080), 0xffffffffffffffff)
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000003c0)={0x14, 0x0, &(0x7f0000000680)=[@acquire_done], 0x0, 0x0, 0x0})

[  438.213908] binder: release 22142:22151 transaction 949 out, still active
[  438.220873] binder: unexpected work type, 4, not freed
[  438.252932] binder: undelivered TRANSACTION_COMPLETE
[  438.295803] binder: release 22176:22259 transaction 952 out, still active
05:03:28 executing program 3:
recvmmsg(0xffffffffffffffff, &(0x7f0000003140)=[{{&(0x7f0000001400)=@ipx, 0x80, 0x0}}], 0x1, 0x0, 0x0)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = syz_open_procfs(0x0, &(0x7f00000004c0)='net/rt_cache\x00')
preadv(r0, &(0x7f00000017c0), 0x157, 0x0)

05:03:28 executing program 0:
recvmmsg(0xffffffffffffffff, &(0x7f0000003140)=[{{&(0x7f0000001400)=@ipx, 0x80, 0x0}}], 0x1, 0x0, 0x0)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = syz_open_procfs(0x0, &(0x7f00000004c0)='net/rt_cache\x00')
preadv(r0, &(0x7f00000017c0), 0x157, 0x0)

05:03:28 executing program 5:
r0 = syz_open_dev$sndtimer(&(0x7f0000026000)='/dev/snd/timer\x00', 0x0, 0x0)
r1 = dup3(r0, r0, 0x80000)
ioctl$UI_GET_SYSNAME(r1, 0x8040552c, 0x0)
perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8)
r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c)
bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r2, &(0x7f0000000040), 0x0, 0x1}, 0x20)
openat$cgroup_ro(r1, &(0x7f00000004c0)='cpuset.effective_cpus\x00', 0x0, 0x0)
unlink(&(0x7f0000000900)='./file0/file0\x00')
r3 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r4 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r4, 0x0)
ioctl$BINDER_GET_NODE_DEBUG_INFO(0xffffffffffffffff, 0xc018620b, &(0x7f0000000780))
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f00000000c0)=[@enter_looper], 0x48, 0x0, &(0x7f0000000700)="2ba063fb309ec7fdbfb08e6e91baee7d7d4599fe14129a4d426834556ae420e087d59c0c7be7fcad1abb7e1f8f446f373f611ca1ee9c2231708e18a47bc68a2a79a0b48931f6ff6d"})
ioctl$sock_inet_tcp_SIOCOUTQNSD(r1, 0x894b, &(0x7f0000000480))
getsockopt$inet_IP_IPSEC_POLICY(0xffffffffffffffff, 0x0, 0x10, &(0x7f0000000540)={{{@in6, @in=@remote}}, {{@in6=@ipv4={[], [], @local}}, 0x0, @in6}}, &(0x7f0000000000)=0xe8)
r5 = dup(r4)
shutdown(r5, 0x1)
prctl$PR_SET_NAME(0xf, &(0x7f0000000380)='/group.stat\x00')
syz_open_dev$binder(&(0x7f0000000880)='/dev/binder#\x00', 0x0, 0x2)
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)})
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, &(0x7f0000000780)})
ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f0000000680)})
creat(&(0x7f00000000c0)='./file0\x00', 0x0)
openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000100)='/group.stat\x00', 0x2761, 0x0)
clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000080), 0xffffffffffffffff)
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000003c0)={0x14, 0x0, &(0x7f0000000680)=[@acquire_done], 0x0, 0x0, 0x0})

[  438.422302] binder: 22576 RLIMIT_NICE not set
[  438.432233] binder: 22581 RLIMIT_NICE not set
[  438.476135] binder: BINDER_SET_CONTEXT_MGR already set
05:03:28 executing program 3:
recvmmsg(0xffffffffffffffff, &(0x7f0000003140)=[{{&(0x7f0000001400)=@ipx, 0x80, 0x0}}], 0x1, 0x0, 0x0)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = syz_open_procfs(0x0, &(0x7f00000004c0)='net/rt_cache\x00')
preadv(r0, &(0x7f00000017c0), 0x158, 0x0)

[  438.497433] binder: 22579:22605 ioctl 40046207 0 returned -16
[  438.515795] binder: BINDER_SET_CONTEXT_MGR already set
[  438.521224] binder: 22573:22576 ioctl 40046207 0 returned -16
[  438.526257] binder: 22579:22608 Release 1 refcount change on invalid ref 1 ret -22
05:03:28 executing program 0:
recvmmsg(0xffffffffffffffff, &(0x7f0000003140)=[{{&(0x7f0000001400)=@ipx, 0x80, 0x0}}], 0x1, 0x0, 0x0)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = syz_open_procfs(0x0, &(0x7f00000004c0)='net/rt_cache\x00')
preadv(r0, &(0x7f00000017c0), 0x158, 0x0)

[  438.616104] binder: 22573:22634 BC_INCREFS_DONE node 959 has no pending increfs request
[  438.647837] binder: 22573:22634 Release 1 refcount change on invalid ref 1 ret -22
05:03:29 executing program 0:
recvmmsg(0xffffffffffffffff, &(0x7f0000003140)=[{{&(0x7f0000001400)=@ipx, 0x80, 0x0}}], 0x1, 0x0, 0x0)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = syz_open_procfs(0x0, &(0x7f00000004c0)='net/rt_cache\x00')
preadv(r0, &(0x7f00000017c0), 0x159, 0x0)

[  438.662667] binder: 22573:22634 BC_ACQUIRE_DONE node 959 has no pending acquire request
05:03:29 executing program 2:
r0 = syz_open_dev$sndtimer(&(0x7f0000026000)='/dev/snd/timer\x00', 0x0, 0x0)
r1 = dup3(r0, r0, 0x80000)
ioctl$UI_GET_SYSNAME(r1, 0x8040552c, 0x0)
perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8)
r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c)
bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r2, &(0x7f0000000040), 0x0, 0x1}, 0x20)
openat$cgroup_ro(r1, &(0x7f00000004c0)='cpuset.effective_cpus\x00', 0x0, 0x0)
unlink(&(0x7f0000000900)='./file0/file0\x00')
r3 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r4 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r4, 0x0)
ioctl$BINDER_GET_NODE_DEBUG_INFO(r3, 0xc018620b, &(0x7f0000000780))
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f00000000c0)=[@enter_looper], 0x48, 0x0, &(0x7f0000000700)="2ba063fb309ec7fdbfb08e6e91baee7d7d4599fe14129a4d426834556ae420e087d59c0c7be7fcad1abb7e1f8f446f373f611ca1ee9c2231708e18a47bc68a2a79a0b48931f6ff6d"})
ioctl$sock_inet_tcp_SIOCOUTQNSD(0xffffffffffffffff, 0x894b, &(0x7f0000000480))
getsockopt$inet_IP_IPSEC_POLICY(0xffffffffffffffff, 0x0, 0x10, &(0x7f0000000540)={{{@in6, @in=@remote}}, {{@in6=@ipv4={[], [], @local}}, 0x0, @in6}}, &(0x7f0000000000)=0xe8)
ioctl$BINDER_SET_CONTEXT_MGR(r4, 0x40046207, 0x0)
r5 = dup(r4)
shutdown(r5, 0x1)
prctl$PR_SET_NAME(0xf, &(0x7f0000000380)='/group.stat\x00')
syz_open_dev$binder(&(0x7f0000000880)='/dev/binder#\x00', 0x0, 0x2)
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)})
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, &(0x7f0000000780)})
ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f0000000680)})
creat(&(0x7f00000000c0)='./file0\x00', 0x0)
openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000100)='/group.stat\x00', 0x2761, 0x0)
clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000080), 0xffffffffffffffff)
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000003c0)={0x14, 0x0, &(0x7f0000000680)=[@acquire_done], 0x0, 0x0, 0x0})

05:03:29 executing program 3:
recvmmsg(0xffffffffffffffff, &(0x7f0000003140)=[{{&(0x7f0000001400)=@ipx, 0x80, 0x0}}], 0x1, 0x0, 0x0)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = syz_open_procfs(0x0, &(0x7f00000004c0)='net/rt_cache\x00')
preadv(r0, &(0x7f00000017c0), 0x159, 0x0)

05:03:29 executing program 5:
r0 = syz_open_dev$sndtimer(&(0x7f0000026000)='/dev/snd/timer\x00', 0x0, 0x0)
r1 = dup3(r0, r0, 0x80000)
ioctl$UI_GET_SYSNAME(r1, 0x8040552c, 0x0)
perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8)
r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c)
bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r2, &(0x7f0000000040), 0x0, 0x1}, 0x20)
openat$cgroup_ro(r1, &(0x7f00000004c0)='cpuset.effective_cpus\x00', 0x0, 0x0)
unlink(&(0x7f0000000900)='./file0/file0\x00')
r3 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r4 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r4, 0x0)
ioctl$BINDER_GET_NODE_DEBUG_INFO(0xffffffffffffffff, 0xc018620b, &(0x7f0000000780))
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f00000000c0)=[@enter_looper], 0x48, 0x0, &(0x7f0000000700)="2ba063fb309ec7fdbfb08e6e91baee7d7d4599fe14129a4d426834556ae420e087d59c0c7be7fcad1abb7e1f8f446f373f611ca1ee9c2231708e18a47bc68a2a79a0b48931f6ff6d"})
ioctl$sock_inet_tcp_SIOCOUTQNSD(r1, 0x894b, &(0x7f0000000480))
getsockopt$inet_IP_IPSEC_POLICY(0xffffffffffffffff, 0x0, 0x10, &(0x7f0000000540)={{{@in6, @in=@remote}}, {{@in6=@ipv4={[], [], @local}}, 0x0, @in6}}, &(0x7f0000000000)=0xe8)
ioctl$BINDER_SET_CONTEXT_MGR(r4, 0x40046207, 0x0)
r5 = dup(r4)
shutdown(r5, 0x1)
syz_open_dev$binder(&(0x7f0000000880)='/dev/binder#\x00', 0x0, 0x2)
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)})
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, &(0x7f0000000780)})
ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f0000000680)})
creat(&(0x7f00000000c0)='./file0\x00', 0x0)
openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000100)='/group.stat\x00', 0x2761, 0x0)
clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000080), 0xffffffffffffffff)
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000003c0)={0x14, 0x0, &(0x7f0000000680)=[@acquire_done], 0x0, 0x0, 0x0})

05:03:29 executing program 1:
r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000200)='/dev/nullb0\x00', 0x5000000084002, 0x0)
mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x200000e, 0x13, r0, 0x0)
r1 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x4000, 0x0)
preadv(r1, &(0x7f0000000040)=[{&(0x7f0000000400)=""/4096, 0x3ffc00}], 0x1d2, 0x0)

05:03:29 executing program 0:
recvmmsg(0xffffffffffffffff, &(0x7f0000003140)=[{{&(0x7f0000001400)=@ipx, 0x80, 0x0}}], 0x1, 0x0, 0x0)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = syz_open_procfs(0x0, &(0x7f00000004c0)='net/rt_cache\x00')
preadv(r0, &(0x7f00000017c0), 0x15a, 0x0)

05:03:29 executing program 4:
r0 = syz_open_dev$sndtimer(&(0x7f0000026000)='/dev/snd/timer\x00', 0x0, 0x0)
r1 = dup3(r0, r0, 0x80000)
ioctl$UI_GET_SYSNAME(r1, 0x8040552c, 0x0)
perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8)
r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c)
bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r2, &(0x7f0000000040), 0x0, 0x1}, 0x20)
openat$cgroup_ro(r1, &(0x7f00000004c0)='cpuset.effective_cpus\x00', 0x0, 0x0)
unlink(&(0x7f0000000900)='./file0/file0\x00')
r3 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r4 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r4, 0x0)
ioctl$BINDER_GET_NODE_DEBUG_INFO(0xffffffffffffffff, 0xc018620b, &(0x7f0000000780))
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f00000000c0)=[@enter_looper], 0x48, 0x0, &(0x7f0000000700)="2ba063fb309ec7fdbfb08e6e91baee7d7d4599fe14129a4d426834556ae420e087d59c0c7be7fcad1abb7e1f8f446f373f611ca1ee9c2231708e18a47bc68a2a79a0b48931f6ff6d"})
ioctl$sock_inet_tcp_SIOCOUTQNSD(r1, 0x894b, &(0x7f0000000480))
ioctl$BINDER_SET_CONTEXT_MGR(r4, 0x40046207, 0x0)
r5 = dup(r4)
shutdown(r5, 0x1)
prctl$PR_SET_NAME(0xf, &(0x7f0000000380)='/group.stat\x00')
syz_open_dev$binder(&(0x7f0000000880)='/dev/binder#\x00', 0x0, 0x2)
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)})
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, &(0x7f0000000780)})
ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f0000000680)})
creat(&(0x7f00000000c0)='./file0\x00', 0x0)
openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000100)='/group.stat\x00', 0x2761, 0x0)
clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000080), 0xffffffffffffffff)
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000003c0)={0x14, 0x0, &(0x7f0000000680)=[@acquire_done], 0x0, 0x0, 0x0})

[  439.173885] binder: release 22573:22576 transaction 958 out, still active
[  439.180859] binder: unexpected work type, 4, not freed
[  439.213706] binder: undelivered TRANSACTION_COMPLETE
[  439.252851] binder: release 22579:22608 transaction 955 out, still active
05:03:29 executing program 0:
recvmmsg(0xffffffffffffffff, &(0x7f0000003140)=[{{&(0x7f0000001400)=@ipx, 0x80, 0x0}}], 0x1, 0x0, 0x0)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = syz_open_procfs(0x0, &(0x7f00000004c0)='net/rt_cache\x00')
preadv(r0, &(0x7f00000017c0), 0x15b, 0x0)

[  439.350939] binder: 22755 RLIMIT_NICE not set
05:03:29 executing program 1:
r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000200)='/dev/nullb0\x00', 0x5000000084002, 0x0)
mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x200000e, 0x13, r0, 0x0)
r1 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x4000, 0x0)
preadv(r1, &(0x7f0000000040)=[{&(0x7f0000000400)=""/4096, 0x3ffc00}], 0x1d3, 0x0)

[  439.376923] binder: BINDER_SET_CONTEXT_MGR already set
[  439.392995] binder: 22736:22755 ioctl 40046207 0 returned -16
[  439.403097] binder: BINDER_SET_CONTEXT_MGR already set
05:03:29 executing program 3:
recvmmsg(0xffffffffffffffff, &(0x7f0000003140)=[{{&(0x7f0000001400)=@ipx, 0x80, 0x0}}], 0x1, 0x0, 0x0)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = syz_open_procfs(0x0, &(0x7f00000004c0)='net/rt_cache\x00')
preadv(r0, &(0x7f00000017c0), 0x15a, 0x0)

[  439.421866] binder: 22737:22841 ioctl 40046207 0 returned -16
[  439.465990] binder: 22737:22841 Release 1 refcount change on invalid ref 1 ret -22
05:03:29 executing program 5:
r0 = syz_open_dev$sndtimer(&(0x7f0000026000)='/dev/snd/timer\x00', 0x0, 0x0)
r1 = dup3(r0, r0, 0x80000)
ioctl$UI_GET_SYSNAME(r1, 0x8040552c, 0x0)
perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8)
r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c)
bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r2, &(0x7f0000000040), 0x0, 0x1}, 0x20)
openat$cgroup_ro(r1, &(0x7f00000004c0)='cpuset.effective_cpus\x00', 0x0, 0x0)
unlink(&(0x7f0000000900)='./file0/file0\x00')
r3 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r4 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r4, 0x0)
ioctl$BINDER_GET_NODE_DEBUG_INFO(0xffffffffffffffff, 0xc018620b, &(0x7f0000000780))
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f00000000c0)=[@enter_looper], 0x48, 0x0, &(0x7f0000000700)="2ba063fb309ec7fdbfb08e6e91baee7d7d4599fe14129a4d426834556ae420e087d59c0c7be7fcad1abb7e1f8f446f373f611ca1ee9c2231708e18a47bc68a2a79a0b48931f6ff6d"})
ioctl$sock_inet_tcp_SIOCOUTQNSD(r1, 0x894b, &(0x7f0000000480))
getsockopt$inet_IP_IPSEC_POLICY(0xffffffffffffffff, 0x0, 0x10, &(0x7f0000000540)={{{@in6, @in=@remote}}, {{@in6=@ipv4={[], [], @local}}, 0x0, @in6}}, &(0x7f0000000000)=0xe8)
ioctl$BINDER_SET_CONTEXT_MGR(r4, 0x40046207, 0x0)
r5 = dup(r4)
shutdown(r5, 0x1)
syz_open_dev$binder(&(0x7f0000000880)='/dev/binder#\x00', 0x0, 0x2)
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)})
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, &(0x7f0000000780)})
ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f0000000680)})
creat(&(0x7f00000000c0)='./file0\x00', 0x0)
openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000100)='/group.stat\x00', 0x2761, 0x0)
clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000080), 0xffffffffffffffff)
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000003c0)={0x14, 0x0, &(0x7f0000000680)=[@acquire_done], 0x0, 0x0, 0x0})

[  439.508557] binder: 22736:22854 BC_INCREFS_DONE node 962 has no pending increfs request
05:03:29 executing program 0:
recvmmsg(0xffffffffffffffff, &(0x7f0000003140)=[{{&(0x7f0000001400)=@ipx, 0x80, 0x0}}], 0x1, 0x0, 0x0)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = syz_open_procfs(0x0, &(0x7f00000004c0)='net/rt_cache\x00')
preadv(r0, &(0x7f00000017c0), 0x15c, 0x0)

[  439.579299] binder: 22736:22854 BC_ACQUIRE_DONE node 962 has no pending acquire request
05:03:30 executing program 3:
recvmmsg(0xffffffffffffffff, &(0x7f0000003140)=[{{&(0x7f0000001400)=@ipx, 0x80, 0x0}}], 0x1, 0x0, 0x0)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = syz_open_procfs(0x0, &(0x7f00000004c0)='net/rt_cache\x00')
preadv(r0, &(0x7f00000017c0), 0x15b, 0x0)

[  440.026065] binder: release 22069:22070 transaction 934 out, still active
[  440.036624] binder: unexpected work type, 4, not freed
[  440.052475] binder: undelivered TRANSACTION_COMPLETE
[  440.069766] binder: release 20088:20091 transaction 820 out, still active
05:03:30 executing program 2:
r0 = syz_open_dev$sndtimer(&(0x7f0000026000)='/dev/snd/timer\x00', 0x0, 0x0)
r1 = dup3(r0, r0, 0x80000)
ioctl$UI_GET_SYSNAME(r1, 0x8040552c, 0x0)
perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8)
r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c)
bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r2, &(0x7f0000000040), 0x0, 0x1}, 0x20)
openat$cgroup_ro(r1, &(0x7f00000004c0)='cpuset.effective_cpus\x00', 0x0, 0x0)
unlink(&(0x7f0000000900)='./file0/file0\x00')
r3 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r4 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r4, 0x0)
ioctl$BINDER_GET_NODE_DEBUG_INFO(r3, 0xc018620b, &(0x7f0000000780))
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f00000000c0)=[@enter_looper], 0x48, 0x0, &(0x7f0000000700)="2ba063fb309ec7fdbfb08e6e91baee7d7d4599fe14129a4d426834556ae420e087d59c0c7be7fcad1abb7e1f8f446f373f611ca1ee9c2231708e18a47bc68a2a79a0b48931f6ff6d"})
ioctl$sock_inet_tcp_SIOCOUTQNSD(0xffffffffffffffff, 0x894b, &(0x7f0000000480))
getsockopt$inet_IP_IPSEC_POLICY(0xffffffffffffffff, 0x0, 0x10, &(0x7f0000000540)={{{@in6, @in=@remote}}, {{@in6=@ipv4={[], [], @local}}, 0x0, @in6}}, &(0x7f0000000000)=0xe8)
ioctl$BINDER_SET_CONTEXT_MGR(r4, 0x40046207, 0x0)
r5 = dup(r4)
shutdown(r5, 0x1)
prctl$PR_SET_NAME(0xf, &(0x7f0000000380)='/group.stat\x00')
syz_open_dev$binder(&(0x7f0000000880)='/dev/binder#\x00', 0x0, 0x2)
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)})
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, &(0x7f0000000780)})
ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f0000000680)})
creat(&(0x7f00000000c0)='./file0\x00', 0x0)
openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000100)='/group.stat\x00', 0x2761, 0x0)
clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000080), 0xffffffffffffffff)
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000003c0)={0x14, 0x0, &(0x7f0000000680)=[@acquire_done], 0x0, 0x0, 0x0})

05:03:30 executing program 0:
recvmmsg(0xffffffffffffffff, &(0x7f0000003140)=[{{&(0x7f0000001400)=@ipx, 0x80, 0x0}}], 0x1, 0x0, 0x0)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = syz_open_procfs(0x0, &(0x7f00000004c0)='net/rt_cache\x00')
preadv(r0, &(0x7f00000017c0), 0x15d, 0x0)

05:03:30 executing program 3:
recvmmsg(0xffffffffffffffff, &(0x7f0000003140)=[{{&(0x7f0000001400)=@ipx, 0x80, 0x0}}], 0x1, 0x0, 0x0)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = syz_open_procfs(0x0, &(0x7f00000004c0)='net/rt_cache\x00')
preadv(r0, &(0x7f00000017c0), 0x15c, 0x0)

[  440.113971] binder: unexpected work type, 4, not freed
05:03:30 executing program 4:
r0 = syz_open_dev$sndtimer(&(0x7f0000026000)='/dev/snd/timer\x00', 0x0, 0x0)
r1 = dup3(r0, r0, 0x80000)
ioctl$UI_GET_SYSNAME(r1, 0x8040552c, 0x0)
perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8)
r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c)
bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r2, &(0x7f0000000040), 0x0, 0x1}, 0x20)
openat$cgroup_ro(r1, &(0x7f00000004c0)='cpuset.effective_cpus\x00', 0x0, 0x0)
unlink(&(0x7f0000000900)='./file0/file0\x00')
r3 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r4 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r4, 0x0)
ioctl$BINDER_GET_NODE_DEBUG_INFO(0xffffffffffffffff, 0xc018620b, &(0x7f0000000780))
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f00000000c0)=[@enter_looper], 0x48, 0x0, &(0x7f0000000700)="2ba063fb309ec7fdbfb08e6e91baee7d7d4599fe14129a4d426834556ae420e087d59c0c7be7fcad1abb7e1f8f446f373f611ca1ee9c2231708e18a47bc68a2a79a0b48931f6ff6d"})
ioctl$sock_inet_tcp_SIOCOUTQNSD(r1, 0x894b, &(0x7f0000000480))
ioctl$BINDER_SET_CONTEXT_MGR(r4, 0x40046207, 0x0)
r5 = dup(r4)
shutdown(r5, 0x1)
prctl$PR_SET_NAME(0xf, &(0x7f0000000380)='/group.stat\x00')
syz_open_dev$binder(&(0x7f0000000880)='/dev/binder#\x00', 0x0, 0x2)
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)})
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, &(0x7f0000000780)})
ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f0000000680)})
creat(&(0x7f00000000c0)='./file0\x00', 0x0)
openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000100)='/group.stat\x00', 0x2761, 0x0)
clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000080), 0xffffffffffffffff)
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000003c0)={0x14, 0x0, &(0x7f0000000680)=[@acquire_done], 0x0, 0x0, 0x0})

[  440.151927] binder: undelivered TRANSACTION_COMPLETE
05:03:30 executing program 1:
r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000200)='/dev/nullb0\x00', 0x5000000084002, 0x0)
mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x200000e, 0x13, r0, 0x0)
r1 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x4000, 0x0)
preadv(r1, &(0x7f0000000040)=[{&(0x7f0000000400)=""/4096, 0x3ffc00}], 0x1d4, 0x0)

[  440.184361] binder: release 22736:22755 transaction 961 out, still active
[  440.224342] binder: unexpected work type, 4, not freed
05:03:30 executing program 3:
recvmmsg(0xffffffffffffffff, &(0x7f0000003140)=[{{&(0x7f0000001400)=@ipx, 0x80, 0x0}}], 0x1, 0x0, 0x0)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = syz_open_procfs(0x0, &(0x7f00000004c0)='net/rt_cache\x00')
preadv(r0, &(0x7f00000017c0), 0x15d, 0x0)

05:03:30 executing program 0:
recvmmsg(0xffffffffffffffff, &(0x7f0000003140)=[{{&(0x7f0000001400)=@ipx, 0x80, 0x0}}], 0x1, 0x0, 0x0)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = syz_open_procfs(0x0, &(0x7f00000004c0)='net/rt_cache\x00')
preadv(r0, &(0x7f00000017c0), 0x15e, 0x0)

[  440.272839] binder: BINDER_SET_CONTEXT_MGR already set
[  440.283194] binder: undelivered TRANSACTION_COMPLETE
[  440.308514] binder: unexpected work type, 4, not freed
[  440.314258] binder: 22889:22890 ioctl 40046207 0 returned -16
[  440.325181] binder: undelivered TRANSACTION_COMPLETE
[  440.330959] binder: BINDER_SET_CONTEXT_MGR already set
[  440.367866] binder: 22886:22898 ioctl 40046207 0 returned -16
[  440.367939] binder: unexpected work type, 4, not freed
[  440.383490] binder: undelivered TRANSACTION_COMPLETE
[  440.400365] binder: unexpected work type, 4, not freed
05:03:30 executing program 3:
recvmmsg(0xffffffffffffffff, &(0x7f0000003140)=[{{&(0x7f0000001400)=@ipx, 0x80, 0x0}}], 0x1, 0x0, 0x0)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = syz_open_procfs(0x0, &(0x7f00000004c0)='net/rt_cache\x00')
preadv(r0, &(0x7f00000017c0), 0x15e, 0x0)

[  440.410541] binder: 22889:22900 BC_INCREFS_DONE node 968 has no pending increfs request
[  440.424135] binder: undelivered TRANSACTION_COMPLETE
[  440.434607] binder: 22889:22900 BC_ACQUIRE_DONE node 968 has no pending acquire request
[  440.451655] binder: unexpected work type, 4, not freed
[  440.462863] binder: undelivered TRANSACTION_COMPLETE
[  440.483338] binder: unexpected work type, 4, not freed
[  440.501681] binder: undelivered TRANSACTION_COMPLETE
[  440.517416] binder: unexpected work type, 4, not freed
[  440.539598] binder: unexpected work type, 4, not freed
05:03:31 executing program 0:
recvmmsg(0xffffffffffffffff, &(0x7f0000003140)=[{{&(0x7f0000001400)=@ipx, 0x80, 0x0}}], 0x1, 0x0, 0x0)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = syz_open_procfs(0x0, &(0x7f00000004c0)='net/rt_cache\x00')
preadv(r0, &(0x7f00000017c0), 0x15f, 0x0)

[  441.003840] binder: unexpected work type, 4, not freed
[  443.055240] device hsr_slave_1 left promiscuous mode
[  443.116817] device hsr_slave_0 left promiscuous mode
[  443.170061] team0 (unregistering): Port device team_slave_1 removed
[  443.180629] team0 (unregistering): Port device team_slave_0 removed
[  443.191035] bond0 (unregistering): Releasing backup interface bond_slave_1
[  443.230816] bond0 (unregistering): Releasing backup interface bond_slave_0
[  443.329531] bond0 (unregistering): Released all slaves
[  443.495269] binder_thread_release: 10 callbacks suppressed
[  443.495280] binder: release 20001:20002 transaction 799 out, still active
[  443.523607] binder: unexpected work type, 4, not freed
[  443.528896] binder_release_work: 3 callbacks suppressed
[  443.528901] binder: undelivered TRANSACTION_COMPLETE
[  444.615351] WARNING: CPU: 0 PID: 222 at net/ipv6/xfrm6_tunnel.c:351 xfrm6_tunnel_net_exit+0x1df/0x370
[  444.624762] Kernel panic - not syncing: panic_on_warn set ...
[  444.630626] CPU: 0 PID: 222 Comm: kworker/u4:3 Not tainted 5.0.0-rc7+ #85
[  444.637530] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
[  444.646879] Workqueue: netns cleanup_net
[  444.650923] Call Trace:
[  444.653495]  dump_stack+0x172/0x1f0
[  444.657137]  ? xfrm6_tunnel_net_exit+0x1c0/0x370
[  444.661893]  panic+0x2cb/0x65c
[  444.665065]  ? __warn_printk+0xf3/0xf3
[  444.668947]  ? xfrm6_tunnel_net_exit+0x1df/0x370
[  444.673766]  ? __sanitizer_cov_trace_const_cmp4+0x16/0x20
[  444.679297]  ? __warn.cold+0x5/0x45
[  444.682921]  ? __warn+0xe8/0x1d0
[  444.686301]  ? xfrm6_tunnel_net_exit+0x1df/0x370
[  444.691036]  __warn.cold+0x20/0x45
[  444.694576]  ? xfrm6_tunnel_net_exit+0x1df/0x370
[  444.699311]  report_bug+0x263/0x2b0
[  444.702945]  do_error_trap+0x11b/0x200
[  444.706835]  do_invalid_op+0x37/0x50
[  444.710545]  ? xfrm6_tunnel_net_exit+0x1df/0x370
[  444.715278]  invalid_op+0x14/0x20
[  444.718727] RIP: 0010:xfrm6_tunnel_net_exit+0x1df/0x370
[  444.724070] Code: 4c 89 e0 48 c1 e8 03 42 80 3c 38 00 0f 85 73 01 00 00 4d 8b 34 24 31 ff 4c 89 f6 e8 0b b0 55 fb 4d 85 f6 74 b3 e8 61 ae 55 fb <0f> 0b eb aa 48 81 c3 00 08 00 00 45 31 e4 49 be 00 00 00 00 00 fc
[  444.742964] RSP: 0018:ffff8880a963fbe0 EFLAGS: 00010293
[  444.748307] RAX: ffff8880a962c540 RBX: ffff88805dd48dc0 RCX: ffffffff861a3315
[  444.755581] RDX: 0000000000000000 RSI: ffffffff861a331f RDI: 0000000000000007
[  444.762861] RBP: ffff8880a963fc08 R08: ffff8880a962c540 R09: ffff8880a962ce30
[  444.770108] R10: 0000000000000000 R11: 0000000000000000 R12: ffff88805dd495b8
[  444.777356] R13: 00000000000000ff R14: ffff888057c1e780 R15: dffffc0000000000
[  444.784613]  ? xfrm6_tunnel_net_exit+0x1d5/0x370
[  444.789348]  ? xfrm6_tunnel_net_exit+0x1df/0x370
[  444.794099]  ? xfrm6_tunnel_alloc_spi+0x920/0x920
[  444.798957]  ops_exit_list.isra.0+0xb0/0x160
[  444.803371]  cleanup_net+0x3fb/0x960
[  444.807065]  ? netns_install+0x1d0/0x1d0
[  444.811104]  ? __lock_is_held+0xb6/0x140
[  444.815150]  ? check_preemption_disabled+0x48/0x290
[  444.820171]  ? rcu_lockdep_current_cpu_online+0xe3/0x130
[  444.825606]  process_one_work+0x98e/0x1790
[  444.829830]  ? pwq_dec_nr_in_flight+0x320/0x320
[  444.834477]  ? lock_acquire+0x16f/0x3f0
[  444.838437]  worker_thread+0x98/0xe40
[  444.842222]  kthread+0x357/0x430
[  444.845568]  ? process_one_work+0x1790/0x1790
[  444.850056]  ? kthread_cancel_delayed_work_sync+0x20/0x20
[  444.855573]  ret_from_fork+0x3a/0x50
[  444.860847] Kernel Offset: disabled
[  444.864608] Rebooting in 86400 seconds..