c000, &(0x7f0000000040)=@pppol2tpv3={0x18, 0x1, {0x0, r1, {0x2, 0x4e22, @broadcast}, 0x0, 0x2, 0x2, 0x2}}, 0x80) r2 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000440)={0x8, 0x0, &(0x7f0000000340)=[@register_looper, @enter_looper], 0x0, 0x0, &(0x7f0000000400)}) 18:19:59 executing program 2: r0 = syz_open_dev$binder(&(0x7f00000002c0)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000300)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, &(0x7f0000012fc7)}) r2 = fcntl$dupfd(r0, 0x0, r0) execveat(r2, &(0x7f0000000000)='./file0\x00', &(0x7f0000000380)=[&(0x7f0000000080)='-em0security\x00', &(0x7f0000000100)='^$$vmnet0\x00', &(0x7f0000000140)="5e6e6f646576747275737465645b6370757365746d696d655f74797065706f7369785f61636c5f6163636573735c2e6367726f7570707070312821766d6e6574316b657972696e67288d00", &(0x7f00000001c0)='/dev/binder#\x00', &(0x7f0000000200)='ppp0vmnet1\x00', &(0x7f0000000240)='-md5sumself&^/#(\x00', &(0x7f0000000280)='vboxnet0loeth0eth0)\x00', &(0x7f0000000340)='/dev/binder#\x00'], &(0x7f0000000440)=[&(0x7f00000003c0)='\x00', &(0x7f0000000400)='/dev/binder#\x00'], 0x400) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000000c0)={0x8, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], 0x0, 0x0, &(0x7f0000000140)}) [ 467.467503] binder: 30516:30520 got reply transaction with no transaction stack [ 467.467511] binder: 30516:30520 transaction failed 29201/-71, size 0-40 line 2922 [ 467.477639] binder: 30515:30519 ioctl c0306201 20000440 returned -22 [ 467.487460] binder: 30515:30519 unknown command 322743572 [ 467.487469] binder: 30515:30519 ioctl c0306201 20000440 returned -22 [ 467.509278] binder: BINDER_SET_CONTEXT_MGR already set [ 467.509287] binder: 30524:30525 ioctl 40046207 0 returned -16 [ 467.509760] binder: 30524:30525 unknown command -1887476987 [ 467.509768] binder: 30524:30525 ioctl c0306201 20012000 returned -22 [ 467.510360] binder: 30524:30525 BC_INCREFS_DONE u0000000000000000 no match [ 467.510369] binder: 30524:30525 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 [ 467.510377] binder: 30524:30525 got reply transaction with no transaction stack [ 467.510385] binder: 30524:30525 transaction failed 29201/-71, size 0-40 line 2922 [ 467.538704] binder: 30528:30530 ERROR: BC_REGISTER_LOOPER called without request [ 467.538742] binder: 30528:30530 ERROR: BC_ENTER_LOOPER called after BC_REGISTER_LOOPER [ 467.540101] binder: 30528:30530 ERROR: BC_REGISTER_LOOPER called without request [ 467.540107] binder: 30528:30530 ERROR: BC_ENTER_LOOPER called after BC_REGISTER_LOOPER [ 467.548902] binder: BINDER_SET_CONTEXT_MGR already set [ 467.548911] binder: 30529:30532 ioctl 40046207 0 returned -16 [ 467.549556] binder: 30529:30532 unknown command -1887476987 [ 467.549564] binder: 30529:30532 ioctl c0306201 20012000 returned -22 [ 467.550874] binder: 30529:30532 BC_INCREFS_DONE u0000000000000000 no match [ 467.550885] binder: 30529:30532 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 [ 467.550892] binder: 30529:30532 got reply transaction with no transaction stack [ 467.550900] binder: 30529:30532 transaction failed 29201/-71, size 0-40 line 2922 [ 467.584947] binder: BINDER_SET_CONTEXT_MGR already set [ 467.584956] binder: 30518:30522 ioctl 40046207 0 returned -16 [ 467.597540] binder: 30518:30522 unknown command -1945869564 [ 467.597549] binder: 30518:30522 ioctl c0306201 200000c0 returned -22 [ 467.620176] binder: BINDER_SET_CONTEXT_MGR already set [ 467.620295] binder: 30536:30538 ioctl 40046207 0 returned -16 [ 467.621537] binder: 30536:30538 unknown command 0 [ 467.621546] binder: 30536:30538 ioctl c0306201 200000c0 returned -22 [ 467.622689] binder: BINDER_SET_CONTEXT_MGR already set [ 467.622698] binder: 30536:30538 ioctl 40046207 0 returned -16 [ 467.624068] binder: 30537:30539 ERROR: BC_REGISTER_LOOPER called without request [ 467.624074] binder: 30537:30539 ERROR: BC_ENTER_LOOPER called after BC_REGISTER_LOOPER [ 467.695290] binder: undelivered TRANSACTION_ERROR: 29201 [ 467.695855] binder: undelivered TRANSACTION_ERROR: 29201 18:19:59 executing program 0: socketpair$inet6_icmp_raw(0xa, 0x3, 0x3a, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) sendto(r0, &(0x7f0000000100)="3b5d8b591a80cd7ceb4dd5d0dec931d05d86cddb4748a956980de58f8362e1ded3ab16be86f69a197a0c629b5808db3dc859333a712d4c562f32e7bcdde600c7c6c385e83c394ec0da4ecd14ce6e293d9a400beedcf82c2a2d2bcabdbfd44a29b8f5ce62244fa59e6f57485265daa72331f1f3100710138ca7e4ad998fcdbd6af2997d4b5e7dd8e337b28b3add", 0x411, 0xc000, &(0x7f0000000040)=@pppol2tpv3={0x18, 0x1, {0x0, r1, {0x2, 0x4e22, @broadcast}, 0x0, 0x2, 0x2, 0x2}}, 0x80) r2 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000440)={0x8, 0x0, &(0x7f0000000340)=[@register_looper, @enter_looper], 0x0, 0x0, &(0x7f0000000400)}) 18:19:59 executing program 3: add_key(&(0x7f00000000c0)='user\x00', &(0x7f0000000100)={'syz'}, &(0x7f0000000200)="82", 0x1, 0xfffffffffffffffb) r0 = creat(&(0x7f0000000000)='./file0\x00', 0x20) ioctl$TIOCMSET(r0, 0x5418, &(0x7f0000000080)=0x2) r1 = getegid() ioctl$TUNSETGROUP(r0, 0x400454ce, r1) ioctl$TUNGETSNDBUF(r0, 0x800454d3, &(0x7f0000000040)) 18:19:59 executing program 5: r0 = syz_open_dev$binder(&(0x7f00000002c0)='/dev/binder#\x00', 0x0, 0x0) ioctl$sock_proto_private(r0, 0x89e7, &(0x7f0000000100)="fa098b226b0bcac17adb3b037602175ee7ecb8ecd66e4b867b6f714de389c0364d4e9040d32741ff556671168dabfc5a7fc0e0e3e24a677f1f8e5e9eda4864bfd006b6dd32c761890d2da98c0a3a3f4ee178ef8240d165031f5d3475f5c2cb820b7a5df0b77a996930d9087c199f3f7c73f782e83ab86249bcb6") ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000300)='/dev/binder#\x00', 0x0, 0x800) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, &(0x7f0000012fc7)}) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000000c0)={0x8, 0x0, &(0x7f0000000040)=[@increfs], 0x0, 0x0, &(0x7f0000000140)}) 18:19:59 executing program 2: r0 = syz_open_dev$binder(&(0x7f00000002c0)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000300)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, &(0x7f0000012fc7)}) clock_gettime(0x3, &(0x7f0000000000)) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000000c0)={0x8, 0x0, &(0x7f0000000040)=[@increfs], 0x0, 0x0, &(0x7f0000000140)}) 18:19:59 executing program 4: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x8, 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="c92cbf939029fb1c8103252500a0cbbf407977737675fc5831e7400a8e2b6ef21e436897366e5a2bfbaeec04022acaed7a31d3d01387aa0260c7ef9632a5a15ddfd5888be033bd18fe2a7f2a5194f9d379a9cecbf299d0e145c758f6ec37a41080a2cb29727dd68139e108ce38d9d8b507c5556e3d41a3ee91900e72be009663ef91f2fb91f45a43c445e0c082bff51c80d974aef98e5ff050a62a138390525d1886aadd8985f5808faaa81d5e33d92b7e25c3a10746ccd177cc7b6ca8e187821fe30f098e07b94d59fa4ce2d236c670071b01b1c5d8aaef685f2235c6cb7d3a10f04dfbd8940c282113519dcfa2c2c285b5fac1a0ebfdb8cb99c83bf9fa7f124ff61a241ea8814addf725965722cf4833b73e3412ca2b9cb90c697fcb0000000000000000000000000000b1b2721d492dab5869aa658e7584f77c719a3d4f6c878e5d46547baeb5f0de167de2d2be8b8c056cc87adda27dfc6891"], 0x0, 0x0, &(0x7f0000000400)}) 18:19:59 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000300)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, &(0x7f0000012fc7)}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, &(0x7f0000000f4d)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x8, 0x0, &(0x7f0000000140)=[@release], 0x0, 0x0, &(0x7f0000000340)}) [ 467.696475] binder: undelivered TRANSACTION_ERROR: 29201 [ 467.799347] binder: 30544:30545 Acquire 1 refcount change on invalid ref 0 ret -22 [ 467.812220] binder: 30544:30545 Release 1 refcount change on invalid ref 0 ret -22 [ 467.820448] binder: 30547:30550 ioctl 89e7 20000100 returned -22 18:19:59 executing program 4: r0 = syz_open_dev$binder(&(0x7f00000002c0)='/dev/binder#\x00', 0x0, 0x3) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000300)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, &(0x7f0000012fc7)}) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000000c0)={0x8, 0x0, &(0x7f0000000040)=[@increfs], 0x0, 0x0, &(0x7f0000000140)}) 18:19:59 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000300)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, &(0x7f0000012fc7)}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, &(0x7f0000000f4d)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x8, 0x0, &(0x7f0000000140)=[@release], 0x0, 0x0, &(0x7f0000000340)}) 18:19:59 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000200)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000300)='/dev/binder#\x00', 0x0, 0x0) r2 = openat$selinux_avc_hash_stats(0xffffffffffffff9c, &(0x7f0000000380)='/selinux/avc/hash_stats\x00', 0x0, 0x0) ioctl$sock_SIOCADDDLCI(r2, 0x8980, &(0x7f00000003c0)={'bridge_slave_0\x00', 0xffffffffc389ad92}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x12, 0x0, &(0x7f0000000400)="54c45fa54d25229ba35c41ec48d2851e9d86"}) r3 = openat$full(0xffffffffffffff9c, &(0x7f0000000180)='/dev/full\x00', 0x10000, 0x0) faccessat(r3, &(0x7f00000001c0)='./file0/file0\x00', 0x2, 0x300) write$binfmt_misc(r3, &(0x7f0000000240)=ANY=[@ANYBLOB="73797a308d555c7f7efa9468cce5d476578a2c8922a8e3f2fbb7926afcf142b23f28056b37e5c8ba92622601df894e2213168670273141e14460777ac09bda785fa393"], 0x43) close(r3) stat(&(0x7f0000000000)='./file0\x00', &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, 0x0}) setfsuid(r4) getsockopt$IPT_SO_GET_REVISION_TARGET(r3, 0x0, 0x43, &(0x7f00000002c0)={'TPROXY\x00'}, &(0x7f0000000340)=0x1e) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000000c0)={0x8, 0x0, &(0x7f0000000040)=[@increfs], 0x0, 0x0, &(0x7f0000000140)}) 18:19:59 executing program 3: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x8, 0x0, &(0x7f0000000340)=[@register_looper, @enter_looper], 0x0, 0x0, &(0x7f0000000400)}) r1 = creat(&(0x7f0000000000)='./file0\x00', 0x124) sendmsg$nl_netfilter(r1, &(0x7f0000000300)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f0000000080)={&(0x7f0000000100)={0x1f4, 0x0, 0x6, 0x1, 0x70bd25, 0x25dfdbfe, {0x3, 0x0, 0x9}, [@nested={0x48, 0x85, [@typed={0x8, 0x6e, @ipv4=@rand_addr=0x8000}, @typed={0xc, 0x19, @str='(eth1]\x00'}, @generic="5c7bdab48f34a6a06ba727cfd87aedef6081d0141d55a90d6e7a77f2555ec4c5fbcc1787c816", @typed={0x8, 0xb, @str='\x00'}]}, @generic="292b8e43f9e3a912258f0222eec303bad11b98eb54e0864109d052e2dc8d6c7d8341c51b77b712a42e121c73b99a56210bf56a563688eaa5a572493e8d666ec5b3", @generic="9cbd5f3784e87595163284c2f661c0791eecdd0ee64d247784970b5b935d2f6f7abbf96d092c7fc389273daa74749dda786a6ea65a265082951563bfeb12fe2a093e858f98cd0168b14d66e6a0e0cf1ea1284479b35f61d2fe7e6f2ab5d2568f21a98233af408bff2d8d6863713d04e82e", @generic="913ec61735c7c268ec2713", @generic="5012fa691e969e59a583ad49a78529fec9554ab8fa2efed634cf2789ac7433ad941c8a7c194cf799010aed596c67d6bf727961ed9fd88eddc7849c68f439455139acc90e5ca92e7fb3cada3e600437cb4f82facc56543d36f7ce81ebb0a05c78cd50f5910f757a0901c9384472027787383bae8f2121c3f6d2dbfc1cfe91f6402e50746c145cdf35fef44057bf8a00fecc3b86205404e43dedbe1ab66e953f822f62dd8a383470d1468704c125f955faeb43435692610dd5ccd70a926ce18edfa3c3fe3521d210971678fdd423dbeffe617eb5c83f53451ab314"]}, 0x1f4}, 0x1, 0x0, 0x0, 0x4008000}, 0x840) [ 467.822437] binder: 30549:30552 unknown command -1816187703 [ 467.822452] binder: 30549:30552 ioctl c0306201 20000440 returned -22 [ 467.852356] binder: 30554:30558 ERROR: BC_REGISTER_LOOPER called without request 18:20:00 executing program 2: r0 = syz_open_dev$binder(&(0x7f00000002c0)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000300)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0xfffffdf1, 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="0567054000000000e32de6313c968e898b11aa5c1d5c5c67e7bd7d291e79bf9bc18a7250083674c543f7ffb0491577f7341b62984aa0e4c76054e61fd185dada719a5a2321bbcb7962e2f869b5bfb91e2c11da0ed9eab24bc0906513a4541b24dfc9edc89fd3f52d"], 0x0, 0x0, &(0x7f00000001c0)="b9caf6d2796f619292224bb40801e2eb07698fdda9c7e7d4d2b4490df299232f039d50fb83e7ff142c78308707d9c9ba7b9967ee73006d477e2e59f743260cb20c85e1dce3645b00739510c0c7d0e0df49e640a2fdc5b4827083b5e64554"}) close(r0) r2 = openat$ppp(0xffffffffffffff9c, &(0x7f0000004640)='/dev/ppp\x00', 0x1, 0x0) sendto$unix(r2, &(0x7f0000004680)="467c0267de274324e9deef0f162e7f8079b9d53658fd7cdf1e2dd8c94e4813b3a0ab28667eaf738b626d59d83c43800a85853e1221202f699e65a4a1d683afe88161189f847e9bc5f7ac01f0b23077956887219e26ff4a24373a0f469c566dcb3508ef1b7d96c9032826bae0a1567bde3072d2709222788161e930f6eb519e9906f177581b89e3f9", 0x88, 0x40, &(0x7f0000004740)=@abs={0x0, 0x0, 0x4e24}, 0x6e) socketpair$inet_udplite(0x2, 0x2, 0x88, &(0x7f0000000180)) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000000c0)={0x8, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="04ef34725d4a01010000"], 0x0, 0x0, &(0x7f0000000140)}) r3 = openat$selinux_status(0xffffffffffffff9c, &(0x7f0000000040)='/selinux/status\x00', 0x0, 0x0) ioctl$TUNSETVNETLE(r3, 0x400454dc, &(0x7f0000000080)=0x1) 18:20:00 executing program 4: syz_open_dev$binder(&(0x7f00000002c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) r0 = syz_open_dev$binder(&(0x7f0000000300)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, &(0x7f0000012fc7)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, &(0x7f0000000f4d)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x54, 0x0, &(0x7f0000000140)=[@free_buffer, @release, @clear_death={0x400c630f, 0x3, 0x2}, @decrefs, @enter_looper, @free_buffer, @release={0x40046306, 0x1}, @register_looper, @dead_binder_done={0x40086310, 0x4}], 0xba, 0x0, &(0x7f0000000340)="551e9c230a268682d4ca8dac5d65e0b3417a3d9bab94b645b91a745103b729d331f4cf2574a41b38ebf6e6dc238ff9184132ab592adbeaaeb7e2b7087e94ff850b7aa113c6e3bd3c66ee700cba545de36f233786481656315cfc1cc2463ff145014eb9ab5fd0704d932c38db06aacc63570991b70e9d248d22731cbcbe565c30d882ed80ebcc4f5e26caddade657efc1b3311899a164e70953a242790d0e85c112908c3005d3cd6a7d98cd3ac7657abefe4bd77d4967e86e661b"}) [ 467.892776] binder: 30560:30566 Acquire 1 refcount change on invalid ref 0 ret -22 [ 467.901446] binder: 30554:30558 ERROR: BC_ENTER_LOOPER called after BC_REGISTER_LOOPER [ 467.904042] binder: BINDER_SET_CONTEXT_MGR already set [ 467.904051] binder: 30563:30567 ioctl 40046207 0 returned -16 [ 467.918487] binder: 30560:30566 Release 1 refcount change on invalid ref 0 ret -22 [ 467.950754] binder: 30547:30550 ioctl 89e7 20000100 returned -22 [ 467.959771] binder: 30547:30571 tried to acquire reference to desc 0, got 1 instead [ 467.969867] binder: 30572:30575 ERROR: BC_REGISTER_LOOPER called without request [ 467.977420] binder: 30572:30575 ERROR: BC_ENTER_LOOPER called after BC_REGISTER_LOOPER [ 467.981465] binder: 30574:30577 Acquire 1 refcount change on invalid ref 0 ret -22 [ 467.981765] binder: 30574:30577 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 467.981887] binder: 30574:30577 BC_FREE_BUFFER u0000000000000000 no match [ 467.981896] binder: 30574:30577 Release 1 refcount change on invalid ref 0 ret -22 [ 467.981904] binder: 30574:30577 BC_CLEAR_DEATH_NOTIFICATION invalid ref 3 [ 467.981913] binder: 30574:30577 DecRefs 0 refcount change on invalid ref 0 ret -22 [ 467.981921] binder: 30574:30577 BC_FREE_BUFFER u0000000000000000 no match [ 467.981930] binder: 30574:30577 Release 1 refcount change on invalid ref 1 ret -22 18:20:00 executing program 0: r0 = syz_open_dev$binder(&(0x7f00000002c0)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000300)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="05630440400000005365753563b36fd9d73f2ba8dad3e15c67e2de180866e2a94b149620af3a906700e5197a585310da5a9c8ae8e2b9336c497364aeb745aeaaf13bb90ad7b34b9a42c647f4fb296c536d6b8540b70cb4f0936a8ffc0a952c4bcd0692360d8625e8de81df23e4efcd0ffcd0a45348c661d28dcde1f699978feb4b7bc6277ea61ae2316bae2e38c1ba46d4c617a22425a267e30a8bc312587c512b"], 0x0, 0x0, &(0x7f0000012fc7)}) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000140)=[@register_looper], 0xfffffffffffffedd, 0x0, &(0x7f0000000080)='\x00\x00\x00\x00'}) 18:20:00 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000300)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, &(0x7f0000012fc7)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008fd0)={0x0, 0x0, &(0x7f000000dff8), 0x0, 0x0, &(0x7f0000000f4d)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x8, 0x0, &(0x7f0000000140)=[@release], 0x0, 0x0, &(0x7f0000000340)}) 18:20:00 executing program 2: r0 = openat$selinux_status(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/status\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000480)={0xb0, 0x0, &(0x7f0000000340)=ANY=[@ANYBLOB="0d6300000463044003000000066304400300000001634040040000000000000000000000000000000000000010000000000000000000000000000000000000001000000000000000", @ANYPTR=&(0x7f0000000080)=ANY=[], @ANYPTR=&(0x7f0000000100)=ANY=[@ANYBLOB="18000000000000004800000000000000"], @ANYBLOB="10630840000000000000000011634840040000000000000000000000000000000000000001000000000000000000000050000000000000005000000000000000", @ANYPTR=&(0x7f00000004c0)=ANY=[@ANYBLOB="0600000000000000c7dc99303cf1bc9c4be2cc9fff4f6961cb968eb8424bd4f89619c24326a1010af447851c926300dd314f00f6f4bb7c204a364fb48e347915f0111381bc17829949d2b7c7fa9b83a50de8305f72757a21b1fcf9866a6f7fbda2ccca593dbc9c81c79150dabee250a86c373cfc2d36c6c87d7f0fd7991f8fbeaf8025d690d95e79a164215e568cf1686b0624508daad2c5e83cd1b3f5f07e3c2121b6e357d224b32a3f51788a62f7fbc0034da76575b5286ad662648bf6be92b7b837ebb29c71b5bd6a19ffcb55cab148688b1cabd3cc70531ef46949d4f6624475810110a0416ec485a9b81827c61c95030972507f5af6489179ce5ee6fc1b9a2d17e7b57569894e6c62174b63d7cffa1eee77439399c396068fdff594f894c368d2110ed817dbd82e4a26d408160f25f2b15ff4e80834ffc3a68f931e9eb72342a50fdd84cd648261d8689f5d2c", @ANYPTR=&(0x7f0000000140)=ANY=[@ANYBLOB='\x00'], @ANYBLOB="010000000000000000000000000000003700000000000000852a747001000000", @ANYPTR=&(0x7f0000000180)=ANY=[@ANYBLOB='\x00'], @ANYBLOB="010000000000000002000000000000000000000000000000"], @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB="7800000000000000280000000000000000000000000000002800000000000000000000000000000028000000000000007800000000000000000000000000000018000000000000007800000000000000"], @ANYBLOB="0200000000000000"], 0x7e, 0x0, &(0x7f0000000400)="8d3bc69ab1c1ea8201d6e5433701053153537fb275bbc7a1224f11082db683572be36ae871912107f49d7088800bf356736ffd9d8de056b68c5571f1d38f8f19673c68ca9d5c89453a92f8f28b0f36af019ca8ab6685f224c4fc43a6abe422ef7ba34904eed483cd33b5b93130c0f78783e2acf264a55698df1cc31d19d6"}) r1 = syz_open_dev$binder(&(0x7f00000002c0)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = syz_open_dev$binder(&(0x7f0000000300)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB="05630440000000008c5153f5410bd23cc00b8b41b575f3210c31bbf8bd225da2e9313cb429c042aaefdba00374fb2c56162d0000000000000000000000"], 0x0, 0x0, &(0x7f0000012fc7)}) close(r1) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000000c0)={0x8, 0x0, &(0x7f0000000040)=[@increfs], 0x0, 0x0, &(0x7f0000000140)}) 18:20:00 executing program 5: r0 = syz_open_dev$binder(&(0x7f00000002c0)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) socketpair(0x3, 0x6, 0x9, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) close(r0) setsockopt$packet_tx_ring(r2, 0x107, 0xd, &(0x7f0000000080)=@req={0x3, 0x3, 0x6, 0x5}, 0x10) r3 = syz_open_dev$binder(&(0x7f0000000300)='/dev/binder#\x00', 0x0, 0x0) ioctl$FS_IOC_GETFSMAP(r2, 0xc0c0583b, &(0x7f0000000340)={0x0, 0x0, 0x4, 0x0, [], [{0x0, 0x5, 0xbc2, 0x80000000, 0x7, 0x8}, {0xffffffffffffff7f, 0x7fff, 0x4c9372e5, 0xc8e, 0x1, 0x2b7}], [[], [], [], []]}) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, &(0x7f0000012fc7)}) ioctl$EVIOCRMFF(r1, 0x40044581, &(0x7f0000000180)=0x3) close(r0) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000040)=[@increfs], 0x0, 0x0, &(0x7f0000000140)}) getsockopt$IP6T_SO_GET_REVISION_TARGET(r2, 0x29, 0x45, &(0x7f0000000100)={'ipvs\x00'}, &(0x7f0000000200)=0x1e) [ 467.981936] binder: 30574:30577 ERROR: BC_REGISTER_LOOPER called after BC_ENTER_LOOPER [ 467.981943] binder: 30574:30577 BC_DEAD_BINDER_DONE 0000000000000004 not found [ 467.985137] binder: 30576:30578 unknown command 1074095877 [ 467.985145] binder: 30576:30578 ioctl c0306201 20012000 returned -22 [ 467.991342] binder: 30576:30578 unknown command 1916071684 [ 467.991350] binder: 30576:30578 ioctl c0306201 200000c0 returned -22 [ 468.000767] binder: 30576:30578 unknown command 1074095877 [ 468.000774] binder: 30576:30578 ioctl c0306201 20012000 returned -22 18:20:00 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000300)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, &(0x7f0000012fc7)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008fd0)={0x0, 0x0, &(0x7f000000dff8), 0x0, 0x0, &(0x7f0000000f4d)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x8, 0x0, &(0x7f0000000140)=[@release], 0x0, 0x0, &(0x7f0000000340)}) [ 468.002199] binder: 30576:30579 unknown command 1916071684 [ 468.002207] binder: 30576:30579 ioctl c0306201 200000c0 returned -22 [ 468.112079] binder: 30585:30587 Acquire 1 refcount change on invalid ref 0 ret -22 [ 468.121922] binder: BINDER_SET_CONTEXT_MGR already set [ 468.127267] binder: 30583:30589 ioctl 40046207 0 returned -16 [ 468.133029] binder: 30586:30588 Acquire 1 refcount change on invalid ref 64 ret -22 [ 468.134416] binder: 30586:30588 ERROR: BC_REGISTER_LOOPER called without request 18:20:00 executing program 2: r0 = syz_open_dev$binder(&(0x7f00000002c0)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000300)='/dev/binder#\x00', 0x0, 0x0) r2 = dup2(r0, r0) ioctl$EVIOCSFF(r2, 0x40304580, &(0x7f0000000000)={0x51, 0x55ee, 0x7, {0x3, 0x6}, {0x7ff, 0x7}, @ramp={0x401, 0x8, {0x96f8, 0x1000, 0x9218, 0x100}}}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, &(0x7f0000012fc7)}) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000000c0)={0x8, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], 0x0, 0x0, &(0x7f0000000140)}) 18:20:00 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000300)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, &(0x7f0000012fc7)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008fd0)={0x0, 0x0, &(0x7f000000dff8), 0x0, 0x0, &(0x7f0000000f4d)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x8, 0x0, &(0x7f0000000140)=[@release], 0x0, 0x0, &(0x7f0000000340)}) [ 468.134900] binder: 30585:30587 Release 1 refcount change on invalid ref 0 ret -22 [ 468.156646] binder: 30583:30591 Acquire 1 refcount change on invalid ref 0 ret -22 [ 468.170164] binder: 30584:30596 Acquire 1 refcount change on invalid ref 0 ret -22 [ 468.179771] binder: 30594:30597 Acquire 1 refcount change on invalid ref 0 ret -22 [ 468.190521] binder: 30594:30597 Release 1 refcount change on invalid ref 0 ret -22 18:20:00 executing program 5: ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) r0 = syz_open_dev$binder(&(0x7f0000000300)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, &(0x7f0000012fc7)}) close(0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x8, 0x0, &(0x7f0000000040)=[@increfs], 0x0, 0x0, &(0x7f0000000140)}) r1 = openat$selinux_avc_hash_stats(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/avc/hash_stats\x00', 0x0, 0x0) ioctl$TCSETAW(r1, 0x5407, &(0x7f0000000080)={0x8, 0x8, 0xd, 0x200, 0x4, 0xffffffffffffffc1, 0x4, 0x40, 0x6, 0x5}) 18:20:00 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000300)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, &(0x7f0000012fc7)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, &(0x7f0000000f4d)}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f00000000c0)={0x8, 0x0, &(0x7f0000000140)=[@release], 0x0, 0x0, &(0x7f0000000340)}) 18:20:00 executing program 3: add_key(&(0x7f00000000c0)='user\x00', &(0x7f0000000100)={'syz'}, &(0x7f0000000200)="82", 0x1, 0xfffffffffffffffb) r0 = openat$selinux_avc_cache_stats(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/avc/cache_stats\x00', 0x0, 0x0) r1 = dup(r0) ioctl$LOOP_CLR_FD(r1, 0x4c01) ioctl$LOOP_SET_FD(r1, 0x4c00, r0) [ 468.222877] binder: 30603:30604 Acquire 1 refcount change on invalid ref 0 ret -22 [ 468.232210] binder: 30603:30604 Release 1 refcount change on invalid ref 0 ret -22 [ 468.252888] binder: 30599:30600 ioctl 40304580 20000000 returned -22 [ 468.264802] binder: 30605:30608 Acquire 1 refcount change on invalid ref 0 ret -22 18:20:00 executing program 2: r0 = syz_open_dev$binder(&(0x7f00000002c0)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000300)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, &(0x7f0000012fc7)}) close(r0) r2 = creat(&(0x7f0000000000)='./file0\x00', 0x80) getsockopt$inet_tcp_buf(r2, 0x6, 0x21, &(0x7f0000000080)=""/40, &(0x7f0000000100)=0x28) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000000c0)={0x8, 0x0, &(0x7f0000000040)=[@increfs], 0x0, 0x0, &(0x7f0000000140)}) [ 468.285721] binder: 30605:30608 IncRefs 0 refcount change on invalid ref 0 ret -22 [ 468.293446] binder: 30599:30600 Acquire 1 refcount change on invalid ref 0 ret -22 [ 468.294016] binder: 30599:30600 unknown command 0 [ 468.294025] binder: 30599:30600 ioctl c0306201 200000c0 returned -22 [ 468.297803] binder: 30599:30614 ioctl 40304580 20000000 returned -22 [ 468.303004] binder: 30610:30613 Acquire 1 refcount change on invalid ref 0 ret -22 [ 468.303846] binder: 30610:30613 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 468.368932] binder: 30605:30615 Acquire 1 refcount change on invalid ref 0 ret -22 [ 468.379998] binder: 30605:30622 IncRefs 0 refcount change on invalid ref 0 ret -22 18:20:00 executing program 4: r0 = syz_open_dev$binder(&(0x7f00000002c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000300)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, &(0x7f0000012fc7)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, &(0x7f0000000f4d)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000000c0)={0x8, 0x0, &(0x7f0000000140)=[@release], 0x0, 0x0, &(0x7f0000000340)}) r2 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/enforce\x00', 0x501080, 0x0) getsockopt$EBT_SO_GET_ENTRIES(r2, 0x0, 0x81, &(0x7f0000000340)={'broute\x00', 0x0, 0x4, 0xe5, [], 0x3, &(0x7f0000000040)=[{}, {}, {}], &(0x7f0000000180)=""/229}, &(0x7f0000000080)=0x78) [ 468.783992] binder: BINDER_SET_CONTEXT_MGR already set [ 468.789733] binder: 30627:30630 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 468.792572] binder: 30627:30628 ioctl 40046207 0 returned -16 18:20:01 executing program 0: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)) openat$ppp(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ppp\x00', 0x8000, 0x0) openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000240)='cpu.stat\x00', 0x0, 0x0) openat$selinux_mls(0xffffffffffffff9c, &(0x7f00000002c0)='/selinux/mls\x00', 0x0, 0x0) openat$pfkey(0xffffffffffffff9c, &(0x7f0000000300)='/proc/self/net/pfkey\x00', 0x1, 0x0) openat$selinux_checkreqprot(0xffffffffffffff9c, &(0x7f0000000340)='/selinux/checkreqprot\x00', 0x18103, 0x0) pipe2(&(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}, 0x4000) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x7) add_key$keyring(&(0x7f0000000100)='keyring\x00', &(0x7f0000000140)={'syz', 0x1}, 0x0, 0x0, 0xffffffffffffffff) r1 = add_key(&(0x7f0000000180)='pkcs7_test\x00', &(0x7f00000001c0)={'syz', 0x2}, 0x0, 0x0, 0xfffffffffffffff8) add_key$keyring(&(0x7f0000000200)='keyring\x00', &(0x7f00000000c0)={'syz', 0x2}, 0x0, 0x0, r1) socketpair(0x10, 0x80003, 0x100, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_QUERY_BPF(r2, 0xc008240a, &(0x7f0000000280)={0x4000000000000144}) 18:20:01 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000300)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, &(0x7f0000012fc7)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, &(0x7f0000000f4d)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000140), 0x0, 0x0, &(0x7f0000000340)}) 18:20:01 executing program 3: add_key(&(0x7f00000000c0)='user\x00', &(0x7f0000000100)={'syz'}, &(0x7f0000000200)="82", 0x1, 0xfffffffffffffffb) r0 = openat$selinux_checkreqprot(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/checkreqprot\x00', 0x101000, 0x0) read$eventfd(r0, &(0x7f0000000040), 0x8) 18:20:01 executing program 2: r0 = syz_open_dev$binder(&(0x7f00000002c0)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000300)='/dev/binder#\x00', 0x0, 0x0) ioctl$EXT4_IOC_PRECACHE_EXTENTS(r0, 0x6612) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000100)={0x4, 0x0, &(0x7f0000005fd4), 0x2b, 0x0, &(0x7f0000000080)="0c8716e04c1cdd23316f6b372fe2470d003c6bbb5dcaec4a3e7298db4ee942ff447f27e098b74547505645"}) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000000c0)={0x8, 0x0, &(0x7f0000000040)=[@increfs], 0x0, 0x0, &(0x7f0000000140)}) ioctl$EXT4_IOC_SWAP_BOOT(r0, 0x6611) 18:20:01 executing program 5: r0 = syz_open_dev$binder(&(0x7f00000002c0)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000300)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, &(0x7f0000012fc7)}) r2 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rtc0\x00', 0x0, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r2, 0x0, 0x80, &(0x7f0000000100)=@filter={'filter\x00', 0xe, 0x5, 0x820, [0x0, 0x20000340, 0x20000728, 0x200008b0], 0x0, &(0x7f0000000080), &(0x7f0000000340)=ANY=[@ANYBLOB="0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000020000000900000040000000080676657468315f746f5f7465616d000000627269646765300000000000000000007465716c30000000000000000000000064756d6d793000000000000000000000ffffffffffff00ff0000ffffaaaaaaaaaabbffffffffffff0000a8000000d8010000080200007265616c6d0000000000000000000000000000000000000000000000000000001000000000000000ff0700000500000001000000000000005345434d41524b000000000000000000000000080000000000000000000000000801000000000000010000000900000073797374656d6d753a6f626a6563745f723a6c6f67726f746174655f657865635f743a733000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000434f4e4e5345434d41524b000000000000000000000000000000000000000000080000000000000001000000000000000300000008000000809b65727370616e3000000000000000000065727370616e3000000000000000000079616d3000000000000000000000000076657468315f746f5f626f6e64000000aaaaaaaaaa1dff00ffff00ff0180c200000f000000ff00ff0000c000000080010000b00100006e66616363740000000000000000000000000000000000000000000000000000280000000000000073797a300000000000000000000000000000000000000000000000000000000008000000000000006e666c6f670000000003000000000000000000000000000000000000000000005000000000000000fbffffff9d738c420000000083d764abe86e66c08e5e4edd088e9295b14b2dfdfb0b0ccb4ca3b66404917ac12f3a20172dbf22f7dc907e2344e4f9a7f1f478b6f826ad575c65fce99667907c000000005241544545535400000000000000000000000000000000000000000000000000200000000000000073797a31000000000000000000000000cb030000000000000000000000000000434f4e4e5345434d41524b0000000000000000000000000000000000000000000800000000000000010000000000000000000000000000000000000000000000000000000000000000000000000000000000000002000000ffffffff010000000000000000000000886f626f6e645f736c6176655f30000000007465616d5f736c6176655f310000000065727370616e3000000000000000000062637366300000000000000000000000aaaaaaaaaa0cffff00ff0000aaaaaaaaaa1a00ffff0000ff0000a80000002801000058010000636c757374657200000000000000000000000000000000000000000000000000100000000000000073f5000006000000ce5c000000000000646e61740000000000008008341c000000000000000000000000000000000000000000001000000000000000ffffffffffff0000fcffffff000000004552524f52f9000000000000000000000000000000000000000000000000000020000000000000001dd3437f3f9ae67d3c2430246e4599afb858b2a815d1b83d14cf01dd8bbd0000434c41535349465900000000000000000000000000000000000000000000000008000000000000008100000000000000000000000000000000000000000000000000000000000000000000000000000000000000030000000000000002000000110000001400000088fe64756d6d7930000000000000000000006272696467655f736c6176655f30000069726c616e300000000000000000000069706464703000000000000000000000aaaaaaaaaabb0000ffff00ffaaaaaaaaaabbff00ff00ffff0000700000001801000090010000434c41535349465900000000000000000000000000000000000000000000000008000000000000003f000000000000004e464c4f4700000000000000000000000000000000000000000000000000000001000000000000000900000007000000010000006d8feac9f533e93fffcc842306c961436a5adb012ed431a86eae04465b7c9631f44163348ed9216bce205a38086dd5a2334003aa65140b9d37cfa5aaea151cce000000004e464c4f4700000000000000000000000000000000000000000000000000000050000000000000000700000007000300000000002ab6ca120402f344d80daa9422a1dfdfd5f9d80ef22dd59592ba325b9f5a0b32520313b5a48e88df4eab4af2d766bd16b196a91739fd645a533fb0189e3c6b7200000000070000001c000000001a7465616d5f736c6176655f3100000000726f7365300000040000000000000000766c616e30000000000000000000000076657468300000000000000000000000aaaaaaaaaaaaffffffff00ff0180c2000003000000ffffff00007000000070000000c00000006c6f670000000000000000000000000000000000000000000000000d0000000028000000000000000052c38d209bc99b100ed7b1e85333babc55c20f0f32c58c85f2ae9f73787b00040000000000000000000000000000000000000000000000000000000000000000000000000000000000000005000000fcffffff0000000000"]}, 0x898) close(r0) openat$fuse(0xffffffffffffff9c, &(0x7f0000000180)='/dev/fuse\x00', 0x2, 0x0) ioctl$FIONREAD(r2, 0x541b, &(0x7f0000000200)) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000000c0)={0x8, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="f362044000000000"], 0x0, 0x0, &(0x7f0000000140)}) ioctl$LOOP_SET_FD(r2, 0x4c00, r1) 18:20:01 executing program 4: r0 = syz_open_dev$binder(&(0x7f00000002c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000300)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, &(0x7f0000012fc7)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, &(0x7f0000000f4d)}) openat$selinux_relabel(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/relabel\x00', 0x2, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000000c0)={0x8, 0x0, &(0x7f0000000140)=[@release], 0x0, 0x0, &(0x7f0000000340)}) [ 468.931001] binder: 30635:30638 ioctl 6612 0 returned -22 [ 468.936752] binder: 30636:30639 Acquire 1 refcount change on invalid ref 0 ret -22 [ 468.939917] binder: 30632:30643 unknown command 1074029299 [ 468.939925] binder: 30632:30643 ioctl c0306201 200000c0 returned -22 [ 468.941201] binder: BINDER_SET_CONTEXT_MGR already set [ 468.941209] binder: 30634:30642 ioctl 40046207 0 returned -16 [ 468.941263] binder: BINDER_SET_CONTEXT_MGR already set [ 468.941270] binder: 30632:30643 ioctl 40046207 0 returned -16 18:20:01 executing program 5: r0 = syz_open_dev$binder(&(0x7f00000002c0)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000300)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, &(0x7f0000012fc7)}) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000000c0)={0x8, 0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB="9c0de8c400001c10559f985645e21f0a935e9f830552d7fb054b616061422835ed47b261f4a87b2adc88692ea069c62dab2dd4be6c53bc36634a2b1c174983bee3c3146105d52ef8e5395bf627735a87"], 0x0, 0x0, &(0x7f0000000140)}) r2 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) setsockopt$inet6_MCAST_LEAVE_GROUP(r2, 0x29, 0x2d, &(0x7f0000000100)={0x3782, {{0xa, 0x4e24, 0xb9f, @ipv4={[], [], @dev={0xac, 0x14, 0x14, 0xd}}, 0x5}}}, 0x88) syz_open_dev$evdev(&(0x7f0000000000)='/dev/input/event#\x00', 0x1, 0x501000) 18:20:01 executing program 3: add_key(&(0x7f00000000c0)='user\x00', &(0x7f0000000100)={'syz'}, &(0x7f0000000200)="82", 0x1, 0xfffffffffffffffb) socket$inet_icmp_raw(0x2, 0x3, 0x1) 18:20:01 executing program 0: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = dup(r0) getsockopt$inet6_mreq(0xffffffffffffff9c, 0x29, 0x15, &(0x7f0000000000)={@remote, 0x0}, &(0x7f0000000040)=0x14) r4 = getuid() setsockopt$inet6_IPV6_IPSEC_POLICY(r2, 0x29, 0x22, &(0x7f0000000080)={{{@in6=@loopback, @in6=@ipv4={[], [], @local}, 0x4e20, 0x2, 0x4e21, 0x0, 0x0, 0x20, 0xa0, 0xff, r3, r4}, {0x1, 0xfffffffffffffe97, 0x8, 0x0, 0x2, 0x6, 0x9, 0x9}, {0xb235, 0x1, 0x8, 0xffffffff}, 0x9, 0x6e6bb8, 0x0, 0x1, 0x3, 0x3}, {{@in=@local, 0x4d2}, 0xa, @in6, 0x3500, 0x2, 0x3, 0x0, 0x8, 0xb94, 0x3}}, 0xe8) add_key$keyring(&(0x7f0000000200)='keyring\x00', &(0x7f0000000240)={'syz'}, 0x0, 0x0, 0xfffffffffffffffb) [ 468.945132] binder: 30632:30643 unknown command 1074029299 [ 468.945139] binder: 30632:30643 ioctl c0306201 200000c0 returned -22 [ 469.003047] binder: 30648:30649 unknown command -991425124 [ 469.012828] binder: 30636:30651 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 18:20:01 executing program 4: r0 = syz_open_dev$binder(&(0x7f00000002c0)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = open(&(0x7f0000000040)='./file0\x00', 0x100, 0x40) getsockopt$IPT_SO_GET_REVISION_TARGET(r1, 0x0, 0x43, &(0x7f0000000080)={'IDLETIMER\x00'}, &(0x7f0000000180)=0x1e) r2 = syz_open_dev$binder(&(0x7f0000000300)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000005fd4)=ANY=[@ANYBLOB="0563040e00000000"], 0x0, 0x0, &(0x7f0000012fc7)}) lseek(r0, 0x2a, 0x0) fsetxattr$trusted_overlay_opaque(r2, &(0x7f0000000000)='trusted.overlay.opaque\x00', &(0x7f0000000100)='y\x00', 0x2, 0x2) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, &(0x7f0000000f4d)}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000000c0)={0x8, 0x0, &(0x7f0000000140)=ANY=[@ANYBLOB="4fbce0afc5000000"], 0x0, 0x0, &(0x7f0000000340)}) 18:20:01 executing program 3: r0 = request_key(&(0x7f0000000080)='logon\x00', &(0x7f0000000140)={'syz', 0x1}, &(0x7f0000000180)='syz', 0xfffffffffffffff9) add_key(&(0x7f00000001c0)='\x00\x00\b\x00\x00', &(0x7f0000000100)={'syz'}, &(0x7f0000000040)="82", 0xfffffffffffffe56, r0) r1 = syz_open_dev$sndtimer(&(0x7f0000000200)='/dev/snd/timer\x00', 0x0, 0x40) r2 = openat$selinux_checkreqprot(0xffffffffffffff9c, &(0x7f0000000240)='/selinux/checkreqprot\x00', 0x40800, 0x0) ioctl$BINDER_SET_MAX_THREADS(r2, 0x40046205, 0xdcb2) ioctl$SNDRV_TIMER_IOCTL_GPARAMS(r1, 0x40485404, &(0x7f0000000340)={{0x3, 0x3, 0x5, 0x2, 0xe90}, 0x1, 0x20000fffd}) r3 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000000)='hugetlb.2MB.usage_in_bytes\x00', 0x0, 0x0) write$P9_RAUTH(r3, &(0x7f00000000c0)={0x14, 0x67, 0x2, {0xc4, 0x3}}, 0x14) [ 469.029373] binder: 30635:30652 unknown command 0 [ 469.039776] binder: 30635:30638 IncRefs 0 refcount change on invalid ref 0 ret -22 [ 469.058708] binder: 30635:30652 ioctl c0306201 20000100 returned -22 [ 469.067794] binder: 30648:30649 ioctl c0306201 200000c0 returned -22 18:20:01 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000300)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, &(0x7f0000012fc7)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, &(0x7f0000000f4d)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000140), 0x0, 0x0, &(0x7f0000000340)}) [ 469.076699] binder: 30662:30666 unknown command 235168517 [ 469.099844] binder: 30635:30652 unknown command 0 [ 469.099995] binder: 30635:30638 ioctl 6612 0 returned -22 [ 469.115419] binder: 30648:30660 Acquire 1 refcount change on invalid ref 0 ret -22 [ 469.118300] binder: 30648:30649 unknown command -991425124 18:20:01 executing program 2: r0 = syz_open_dev$binder(&(0x7f00000002c0)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000300)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, &(0x7f0000012fc7)}) close(r0) r2 = openat$selinux_checkreqprot(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/checkreqprot\x00', 0x0, 0x0) getsockopt$inet6_IPV6_FLOWLABEL_MGR(r2, 0x29, 0x20, &(0x7f0000000080)={@dev={0xfe, 0x80, [], 0x17}, 0x100, 0x3, 0xff, 0x8, 0x800, 0x4, 0x7f}, &(0x7f0000000100)=0x20) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000000c0)={0x8, 0x0, &(0x7f0000000040)=[@increfs], 0x0, 0x0, &(0x7f0000000140)}) 18:20:01 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000300)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, &(0x7f0000012fc7)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, &(0x7f0000000f4d)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000140), 0x0, 0x0, &(0x7f0000000340)}) 18:20:01 executing program 0: socketpair$unix(0x1, 0x4, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = openat$full(0xffffffffffffff9c, &(0x7f0000000240)='/dev/full\x00', 0x80, 0x0) getsockopt$inet_IP_IPSEC_POLICY(0xffffffffffffff9c, 0x0, 0x10, &(0x7f0000000340)={{{@in6=@local, @in=@local, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@dev}, 0x0, @in6=@loopback}}, &(0x7f0000000440)=0xe8) connect$packet(r1, &(0x7f0000000480)={0x11, 0x8, r2, 0x1, 0x9}, 0x14) socketpair(0x1f, 0x0, 0x1000, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$BLKPBSZGET(r3, 0x127b, &(0x7f0000000040)) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) request_key(&(0x7f0000000080)='ceph\x00', &(0x7f00000000c0)={'syz', 0x3}, &(0x7f0000000100)='ppp0trustedem0-\x00', 0xfffffffffffffffd) add_key$keyring(&(0x7f00000001c0)='keyring\x00', &(0x7f0000000280)={'syz', 0x1}, 0x0, 0x0, 0xfffffffffffffff9) r4 = add_key$keyring(&(0x7f00000002c0)='keyring\x00', &(0x7f0000000300)={'syz', 0x0}, 0x0, 0x0, 0xfffffffffffffffd) r5 = getpid() wait4(r5, &(0x7f00000004c0), 0x8, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r6, 0x8912, 0x400200) r7 = socket$inet6(0xa, 0x1, 0x0) getsockopt$inet6_int(r7, 0x29, 0x43, &(0x7f0000534000), &(0x7f0000000080)=0x3) add_key$keyring(&(0x7f0000000200)='keyring\x00', &(0x7f0000000140)={'syz'}, 0x0, 0x0, r4) 18:20:01 executing program 3: add_key(&(0x7f00000000c0)='user\x00', &(0x7f0000000100)={'syz'}, &(0x7f0000000200)="82", 0x1, 0xfffffffffffffffb) r0 = openat$cgroup_subtree(0xffffffffffffff9c, &(0x7f0000000000)='cgroup.subtree_control\x00', 0x2, 0x0) fsetxattr$security_evm(r0, &(0x7f0000000040)='security.evm\x00', &(0x7f0000000080)=@md5={0x1, "a59365d61bdbdf43de956821ab78fea7"}, 0x11, 0x1) [ 469.119633] binder: 30648:30649 ioctl c0306201 200000c0 returned -22 [ 469.122533] binder: 30671:30672 Acquire 1 refcount change on invalid ref 0 ret -22 [ 469.122653] binder: 30671:30672 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 469.124076] binder: 30635:30652 ioctl c0306201 20000100 returned -22 [ 469.136936] binder: 30662:30673 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 469.156116] binder: 30662:30673 unknown command -1344226225 [ 469.156125] binder: 30662:30673 ioctl c0306201 200000c0 returned -22 18:20:01 executing program 2: r0 = syz_open_dev$binder(&(0x7f00000002c0)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000300)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="0562044000000000395d2b92001b11bb8c31e3c8c39dc4e23f7c09e54b585883f12716fe13c7884037398a7ef211cd579421a0ce4ac4cb460d628aa714580ff1cfadde914e"], 0x0, 0x0, &(0x7f0000012fc7)}) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000000c0)={0x8, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB='3\x00\x00\x00\x00\x00\x00\x00'], 0x0, 0x0, &(0x7f0000000140)}) [ 469.185698] binder: 30662:30666 ioctl c0306201 20012000 returned -22 [ 469.208282] binder: 30674:30679 Acquire 1 refcount change on invalid ref 0 ret -22 18:20:01 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000300)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="0563044000000000e6844627335e1d0f1b45c39b796fa6fd4545c7aa4b2cd4dd733bf5fd6190e242cebbe82776b153da2b7668f52ea03cb8713ed1e2a87cd2ca8db1e9df72443980945a7c910d755d43861a3b8d7ba6d73a8bfec912b59206eaeff6f76fe3eed5db6ca77163d472993396df0c"], 0x0, 0x0, &(0x7f0000012fc7)}) r1 = dup3(r0, r0, 0x80000) r2 = syz_genetlink_get_family_id$nbd(&(0x7f0000000140)='nbd\x00') socketpair$nbd(0x2, 0x1, 0x0, &(0x7f0000000340)={0xffffffffffffffff}) r4 = dup3(r0, r0, 0x80000) sendmsg$NBD_CMD_DISCONNECT(r1, &(0x7f0000000440)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x428}, 0xc, &(0x7f0000000400)={&(0x7f0000000380)={0x74, r2, 0x200, 0x70bd2c, 0x25dfdbfd, {}, [@NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_DEAD_CONN_TIMEOUT={0xc, 0x8, 0x10001}, @NBD_ATTR_TIMEOUT={0xc, 0x4, 0x8001}, @NBD_ATTR_SOCKETS={0x1c, 0x7, [{0x8, 0x1, r3}, {0x8, 0x1, r0}, {0x8, 0x1, r4}]}, @NBD_ATTR_BLOCK_SIZE_BYTES={0xc, 0x3, 0x6ad}, @NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0xfffffffffffeffff}, @NBD_ATTR_TIMEOUT={0xc, 0x4, 0x2}]}, 0x74}, 0x1, 0x0, 0x0, 0x4000000}, 0x20000840) r5 = openat$selinux_status(0xffffffffffffff9c, &(0x7f0000000040)='/selinux/status\x00', 0x0, 0x0) ioctl$TIOCMBIC(r5, 0x5417, &(0x7f0000000080)=0x3) ioctl$RTC_PLL_GET(r5, 0x80207011, &(0x7f0000000480)) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008fd0)={0x0, 0x0, &(0x7f000000dff8), 0x0, 0x0, &(0x7f0000000080)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x8, 0x0, &(0x7f0000000200)=[@release], 0xa5, 0x0, &(0x7f0000000240)="48aa6d33aa84e5ed48b7f47821d170414fb4d50bd210f0398f65614f944d952f8ccc7ec512b3c7f83e010ef729794d1d3a8d18472ca787cb0599088d3de2c19da917a7025d95b87ae4e734be40c4fbf2310e3b3c325cafd73438e47d042683d711d47ece836b3e1d55e629c96f4be84b6e016c9c56076767d8b9ca1ff71b0ed857453dd1e021ef3d8293858dd311abe7f9a4502eac35000000000000000000000000000000"}) openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/enforce\x00', 0x88400, 0x0) 18:20:01 executing program 5: r0 = syz_open_dev$binder(&(0x7f00000002c0)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x40) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, &(0x7f0000012fc7)}) fremovexattr(r1, &(0x7f0000000040)=@known='user.syz\x00') close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000000c0)={0x8, 0x0, &(0x7f0000000340)=ANY=[@ANYBLOB="04630457ea9c677fd97adae3080c43be26e886d72fcc7cf5e232dbe208bca6cd09cbcfb3d3d05c332185faefe2c22a9eb162935fa5c81047cb72f4fe1a5260cd5301d5d93275f6ccc068ce7a9cb9210cb55902cc11737e07cf1a3de07d434e74f5171c90c9f9f421aeb2efcd7c047c46c8df67dd44e338017bbb57cdcc8b6500396bbe8217e9ec42aef42e9dc6afbb9798ec591539f7e9fc32d67f0bc4b8591430d635742dc6e8ef155fc14fdd58f93a182acc733fecd65b0cd8a0bcad1514ab6933ce72986dc682aadfa5a00e8da0846913c3cac6bb22207c58eaa7b47401e29e671a8a267315d5b7e0703fa65dfab0316bc8c2a3206a8b09f4ab77b27ebc88ab94347fa68177abad8d1c196bf537cc38aed67ff7d4d93c8dea125de16e77c6353802dabd85e035364fbc07ec465589d46ab44f381853368324dbbffa1fb76e8a06a7a56aeda4d6a20c33514fa322806a115c1775b0b88c5bf9175ee602de6bc77df01a58d8e0745c13cb914c59c1658c442178829e76eaadeb7244929a51cfea25f08ec892b672850c5c34fefb0bbad35794270707a4d32663d9fa32cd4895bf4bd4771d134be166d80a2623f2ec22b73dc745018c1ab495e155ff9c7f41347d6176c167711f3bb3425577c0c2e4ce6122f0c7777dfc540d5828226d6d61217861371741b268db4a41629260713dcdfcf3f43894143edf2aea5c6901873cdce5c2d6c9a4659c2ad8fbe19ab4abadf0b91397831185b869ebbe44418d3abdaaeafe17092d6095efde9b0420a476853a6881d480d3efb32794a58f2be574fc23b383ef0b6622387676ae288dd672e01f91119d983f638bc59453c834ba4dd03997e862a4af282fe427c56edfbb546f064c163301a9b6e28313e178cb46ce0577505b1c938b4cb8815201bfe01b6d3505cad48b613fb14c0aadca2f16489a51000000000000000000000000000000"], 0x0, 0x0, &(0x7f0000000140)}) r2 = openat$keychord(0xffffffffffffff9c, &(0x7f0000000080)='/dev/keychord\x00', 0x20000, 0x0) accept4$packet(r2, &(0x7f0000000240)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000280)=0x14, 0x80000) setsockopt$inet6_IPV6_PKTINFO(r2, 0x29, 0x32, &(0x7f0000000300)={@remote, r3}, 0x14) ioctl$EVIOCGSND(r2, 0x8040451a, &(0x7f0000000180)=""/143) ioctl$FIDEDUPERANGE(r0, 0xc0189436, &(0x7f0000000100)={0x676f, 0x80, 0x3, 0x0, 0x0, [{r1, 0x0, 0xcd6d}, {r0, 0x0, 0x2}, {r1, 0x0, 0x8}]}) 18:20:01 executing program 0: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400201) r1 = add_key$keyring(&(0x7f0000000200)='keyring\x00', &(0x7f0000000240)={'syz'}, 0x0, 0x0, 0xfffffffffffffffb) stat(&(0x7f0000000000)='./file0\x00', &(0x7f0000000040)={0x0, 0x0, 0x0, 0x0, 0x0}) keyctl$get_persistent(0x16, r2, r1) 18:20:01 executing program 3: r0 = openat$selinux_avc_cache_threshold(0xffffffffffffff9c, &(0x7f0000002840)='/selinux/avc/cache_threshold\x00', 0x2, 0x0) setsockopt$netlink_NETLINK_NO_ENOBUFS(r0, 0x10e, 0x5, &(0x7f0000002880)=0x3, 0x4) add_key(&(0x7f0000000140)='user\x00', &(0x7f0000000080)={'syz'}, &(0x7f0000000200)="82", 0xfffffffffffffe96, 0xfffffffffffffffb) init_module(&(0x7f0000000000)='user\x00', 0xffffffffffffffd0, &(0x7f0000000240)="73656c6670707030736563757269747924216574683176626f786e657430776c616e316d696d655f7479104066a964eb34faaed80b6ede1a0568d4bfa8213375b466b6820ad191365d665d872cc2f0767a843cf9843ebf92908cf0b6a5029c7b8ce99d3e40c14a7ccaa6752a1da1944e2f710125588df39fa85ce15d4fbdab13e16d140ad02cf6d28d383fc12940868723f1877c1677d4341ba9bf33026bf31637fcb92d") [ 469.232596] binder: BINDER_SET_CONTEXT_MGR already set [ 469.235210] binder: 30662:30673 unknown command 235168517 [ 469.235219] binder: 30662:30673 ioctl c0306201 20012000 returned -22 [ 469.235397] binder: 30662:30690 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 469.236549] binder: 30674:30679 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 469.259212] binder: 30691:30692 Acquire 1 refcount change on invalid ref 0 ret -22 [ 469.271634] binder: 30691:30692 Release 1 refcount change on invalid ref 0 ret -22 [ 469.305172] binder: 30697:30698 unknown command 1074029061 [ 469.315410] binder: 30697:30698 ioctl c0306201 20012000 returned -22 [ 469.331921] binder: 30697:30698 unknown command 51 [ 469.346027] binder: 30697:30698 ioctl c0306201 200000c0 returned -22 [ 469.353812] binder: BINDER_SET_CONTEXT_MGR already set [ 469.357676] binder: 30704:30708 unknown command 1459905284 [ 469.357684] binder: 30704:30708 ioctl c0306201 200000c0 returned -22 [ 469.360932] binder: BINDER_SET_CONTEXT_MGR already set [ 469.360939] binder: 30704:30708 ioctl 40046207 0 returned -16 [ 469.385156] binder: 30704:30711 unknown command 1459905284 [ 469.385277] binder: 30697:30710 unknown command 1074029061 [ 469.385285] binder: 30697:30710 ioctl c0306201 20012000 returned -22 18:20:01 executing program 4: r0 = syz_open_dev$binder(&(0x7f00000002c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000300)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/commit_pending_bools\x00', 0x1, 0x0) ioctl$RTC_VL_CLR(r2, 0x7014) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, &(0x7f0000012fc7)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, &(0x7f0000000f4d)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000000c0)={0x8, 0x0, &(0x7f0000000140)=[@release], 0x0, 0x0, &(0x7f0000000340)}) 18:20:01 executing program 3: add_key(&(0x7f00000000c0)='user\x00', &(0x7f0000000100)={'syz'}, &(0x7f0000000200)="82", 0x1, 0xfffffffffffffffb) execve(&(0x7f0000000000)='./file0\x00', &(0x7f0000000300)=[&(0x7f0000000040)='syz', &(0x7f0000000080)='syz', &(0x7f0000000140)=',eth0cgroupnodev\x00', &(0x7f0000000180)='user\x00', &(0x7f00000001c0)='#wlan0-vboxnet1%wlan0eth1{(user.user\x00', &(0x7f0000000240)='user\x00', &(0x7f0000000280)='.&keyring%:wlan0/vmnet0.\x00', &(0x7f00000002c0)='\'\x00'], &(0x7f0000000380)=[&(0x7f0000000340)='em1securityem1,.(\x00']) 18:20:01 executing program 2: r0 = syz_open_dev$binder(&(0x7f00000002c0)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000300)='/dev/binder#\x00', 0x0, 0x0) r2 = openat$selinux_avc_hash_stats(0xffffffffffffff9c, &(0x7f0000000080)='/selinux/avc/hash_stats\x00', 0x0, 0x0) setsockopt$IP6T_SO_SET_ADD_COUNTERS(r2, 0x29, 0x41, &(0x7f0000000100)=ANY=[@ANYBLOB="6d616e676c65000000000000000000000000000000000000000000000000000005000000d933cbb0d0b329c400000000000000000000000000000000000000000000000000000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000"], 0x78) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000005fd4)=ANY=[@ANYBLOB="0580044000000000"], 0x0, 0x0, &(0x7f0000012fc7)}) close(r0) fcntl$getflags(r2, 0x408) r3 = dup3(r0, r0, 0x80000) r4 = openat(r2, &(0x7f00000003c0)='./file0\x00', 0x551fd34f930f5e41, 0x0) r5 = getpgrp(0xffffffffffffffff) getsockopt$sock_cred(r3, 0x1, 0x11, &(0x7f0000000440)={0x0, 0x0}, &(0x7f0000000480)=0xc) fstat(r0, &(0x7f00000004c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) setsockopt$sock_cred(r4, 0x1, 0x11, &(0x7f0000000540)={r5, r6, r7}, 0xc) sendmsg$nl_netfilter(r2, &(0x7f0000000380)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x400126}, 0xc, &(0x7f0000000340)={&(0x7f00000001c0)={0xf4, 0x9, 0x6, 0x0, 0x70bd2b, 0x25dfdbfd, {0xa, 0x0, 0x7}, [@generic="1a4531fe7caac312c5cf694f10192043616908a20f90c8333f06fae02de0be172b7c573c9d3232241a20c2c21575674c96b77b7b853539d0c9bd9f8776253eac2e2b5e378943a4629ef3b7f760e9b89a0538f8152a9610d475f991261a1ca43b286de9d7be912cda86b2aff88f9002edf7d9195aec1046fc6f8391bc917acb5f17030d74b7c6ef0736a7dc2c493476f56856ca85121b29db77f6bf386cfafe44bfead00410ba23feb1c9b2388a08b2ec7658cc9fbd90331596cf04f90c7b9672a586f7d5c981d804371a265f9435c84ca25a70d6b0daf570a48c10e3b9"]}, 0xf4}, 0x1, 0x0, 0x0, 0x74e3d0e6794f0e96}, 0x880) syz_open_pts(r3, 0xe0800) openat$ptmx(0xffffffffffffff9c, &(0x7f0000000400)='/dev/ptmx\x00', 0x24000, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000000c0)={0x8, 0x0, &(0x7f0000000040)=[@increfs], 0x19, 0x0, &(0x7f0000000000)="56f190566753c91008f5b6b2d54589d670ab49073000000000"}) 18:20:01 executing program 0: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = openat$null(0xffffffffffffff9c, &(0x7f0000000000)='/dev/null\x00', 0x410042, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x0) add_key$keyring(&(0x7f0000000200)='keyring\x00', &(0x7f0000000240)={'syz'}, 0x0, 0x0, 0xfffffffffffffffb) fcntl$getownex(r0, 0x10, &(0x7f0000000080)) 18:20:01 executing program 3: r0 = syz_open_dev$mice(&(0x7f0000000040)='/dev/input/mice\x00', 0x0, 0x2000) ioctl$SNDRV_TIMER_IOCTL_PARAMS(r0, 0x40505412, &(0x7f0000000140)={0x1, 0xaf, 0x9, 0x0, 0x4}) add_key(&(0x7f00000000c0)='user\x00', &(0x7f0000000100)={'syz', 0x0}, &(0x7f0000000200)="82", 0x1, 0xfffffffffffffffb) truncate(&(0x7f0000000000)='./file0\x00', 0x13d519d100) [ 469.385336] binder: 30662:30666 ioctl 40046207 0 returned -16 [ 469.389314] binder: 30697:30698 ioctl 40046207 0 returned -16 [ 469.427148] binder: 30704:30711 ioctl c0306201 200000c0 returned -22 18:20:01 executing program 5: r0 = syz_open_dev$binder(&(0x7f00000002c0)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000300)='/dev/binder#\x00', 0x0, 0x0) r2 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/enforce\x00', 0x101000, 0x0) ioctl$IOC_PR_PREEMPT_ABORT(r2, 0x401870cc, &(0x7f0000000340)={0xfff, 0x6, 0x8001, 0xb5bb}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, &(0x7f0000012fc7)}) ioctl(r1, 0x8271eb1, &(0x7f00000001c0)="35ae8abdc1d10b1805cb22bdae878a378f70efc3d2d58fbf6e385f713f13e43d5937f527470d5e7d5b526f292ed14966156e0ef6b7f91420a3be496a241813cb7b48ff5dfebae363e8aeff235355612b9aacb957461707989a7b83d0cb06f0dd87822144d0c6a9bf3d9d7111307afebf39a60030972a136935ba15bf02ae21edf126d62ef26ae5a084d37f717cd1f2f9308594e34c68b6bd265932c06a4e188c6009fc6d5925b6245e2cd93f208f1f96028d42532ac5f5999f1089c927c4705a809963c2f3afb346c82016135cea70d11f35") close(r0) ioctl$ASHMEM_PURGE_ALL_CACHES(r1, 0x770a, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0xd12a3be5c926ea6d, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="07630440000000002bd69829ef0ad552a93c10b669d0262d3289eea77f04b9ce674848c8f201fde3ff261b071174ad94cd2ed52633b7ba203ab1ae08d102a2673e201594e3bbab0a95"], 0xa0, 0x0, &(0x7f0000000100)="403ac3ab8bf673ce61110c24d1177043ae5cfe9df4394d592ec1aff621d2028cca8bcb0e77d3b06f810a2edbffe437d16e1af7b32508be3f646a6984ce92a17e3298e6554c75aae23e00f235977f09d1f5233f4b2cc94d7b7a8c17bc39c8aaf1afa89bdec58b6bf3bc7b717cd43081a927dd450b7c84b4d2ef34d0a09e31ee4edd796f98f9c0d55e6a37ecee7ede966b324dc8840ff52e22c0ad40dacb81283a"}) 18:20:01 executing program 0: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180)={0xffffffffffffffff}) r1 = fcntl$dupfd(r0, 0x406, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x4001fe) add_key$keyring(&(0x7f0000000200)='keyring\x00', &(0x7f0000000240)={'syz'}, 0x0, 0x0, 0xfffffffffffffffb) [ 469.458571] binder: BINDER_SET_CONTEXT_MGR already set [ 469.478167] binder: 30719:30729 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 469.485622] binder: 30719:30722 ioctl 40046207 0 returned -16 [ 469.499638] binder: 30718:30731 unknown command 1074036741 18:20:01 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000300)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, &(0x7f0000012fc7)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, &(0x7f0000000f4d)}) r2 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ppp\x00', 0x88000, 0x0) ioctl$VT_OPENQRY(r2, 0x5600, &(0x7f0000000200)) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000000c0)={0x8, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="066304400000000006bfe2c9966386c3b76fe39d282f1d85cd2a15f8aa78cf41d66209c38de0b8e88410d2b556cc7a1c895542c11a3d684d59ed3aaa2e394aaf04033ccd"], 0x0, 0x0, &(0x7f0000000340)}) dup2(r1, r1) [ 469.520986] binder: 30718:30731 ioctl c0306201 20012000 returned -22 [ 469.527760] binder: 30732:30734 ioctl 8271eb1 200001c0 returned -22 [ 469.558955] binder: 30732:30734 ioctl 770a 0 returned -22 [ 469.563539] binder: 30718:30731 IncRefs 0 refcount change on invalid ref 0 ret -22 [ 469.573454] binder: 30740:30742 Acquire 1 refcount change on invalid ref 0 ret -22 [ 469.581749] binder: 30740:30742 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 469.581808] binder: 30732 invalid dec weak, ref 1314 desc 0 s 1 w 0 [ 469.581815] binder: 30732:30734 unknown command 697882155 [ 469.581823] binder: 30732:30734 ioctl c0306201 20000080 returned -22 [ 469.582988] binder: 30732:30743 ioctl 8271eb1 200001c0 returned -22 [ 469.583224] binder: 30732:30743 ioctl 770a 0 returned -22 [ 469.627012] binder: 30740:30742 Release 1 refcount change on invalid ref 0 ret -22 [ 469.635601] binder: BINDER_SET_CONTEXT_MGR already set [ 469.641420] binder: 30740:30746 Acquire 1 refcount change on invalid ref 0 ret -22 [ 469.647390] binder: 30740:30747 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 469.647815] binder: 30740:30747 Release 1 refcount change on invalid ref 0 ret -22 [ 469.648716] binder: 30740:30742 ioctl 40046207 0 returned -16 18:20:02 executing program 5: r0 = syz_open_dev$binder(&(0x7f00000002c0)='/dev/binder#\x00', 0x0, 0x0) pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TIOCNOTTY(r1, 0x5422) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r2 = syz_open_dev$binder(&(0x7f0000000300)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, &(0x7f0000012fc7)}) close(r0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000000c0)={0x8, 0x0, &(0x7f0000000040)=[@increfs], 0x0, 0x0, &(0x7f0000000140)}) 18:20:02 executing program 0: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180)) pipe(&(0x7f0000000000)={0xffffffffffffffff}) setsockopt$inet6_mtu(r0, 0x29, 0x17, &(0x7f0000000040)=0x1, 0x4) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0xee) r1 = request_key(&(0x7f0000000080)='cifs.spnego\x00', &(0x7f00000000c0)={'syz', 0x2}, &(0x7f0000000100)='syz', 0xfffffffffffffff8) statfs(&(0x7f00000001c0)='./file0\x00', &(0x7f0000000240)=""/60) add_key$keyring(&(0x7f0000000200)='keyring\x00', &(0x7f0000000140)={'syz'}, 0x0, 0x0, r1) fcntl$setstatus(r0, 0x4, 0x40000) 18:20:02 executing program 3: r0 = openat$selinux_status(0xffffffffffffff9c, &(0x7f0000000240)='/selinux/status\x00', 0x0, 0x0) ioctl$EVIOCGABS20(r0, 0x80184560, &(0x7f0000000140)=""/174) write$UHID_CREATE(r0, &(0x7f0000000280)={0x0, 'syz1\x00', 'syz1\x00', 'syz1\x00', &(0x7f0000000000)=""/110, 0x6e, 0x6, 0x100, 0x4, 0x100000001, 0x5}, 0x120) add_key(&(0x7f00000000c0)='user\x00', &(0x7f0000000100)={'syz'}, &(0x7f0000000200)="82", 0x1, 0xfffffffffffffffb) 18:20:02 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000300)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, &(0x7f0000012fc7)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x148}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x8, 0x0, &(0x7f0000000140)=[@release], 0x0, 0x0, &(0x7f0000000340)}) 18:20:02 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x802) r1 = mmap$binder(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x0, 0x13, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0xc8, 0x0, &(0x7f0000000340)=[@acquire={0x40046305, 0x2}, @clear_death, @reply_sg={0x40486312, {{0x2, 0x0, 0x2, 0x0, 0x1, 0x0, 0x0, 0x28, 0x18, &(0x7f0000000080)=[@ptr={0x70742a85, 0x0, &(0x7f0000000040), 0x1, 0x2, 0x31}], &(0x7f0000000100)=[0x38, 0x40, 0x0]}, 0x5}}, @reply={0x40406301, {0x4, 0x0, 0x1, 0x0, 0x11, 0x0, 0x0, 0x40, 0x8, &(0x7f00000001c0)=[@flat={0x73622a85, 0x10b, r1, 0x4}, @ptr={0x70742a85, 0x0, &(0x7f0000000180), 0x1, 0x1, 0x1b}], &(0x7f0000000200)=[0x38]}}, @decrefs={0x40046307, 0x1}, @release, @clear_death={0x400c630f, 0x0, 0x2}], 0x86, 0x0, &(0x7f0000000440)="06e22bfc6a3613bfc8bc16c8d239dfcf671e254f4bf0fde508b017026262386f209e731774fd88f41224a8e233fa83de43e930f070581607a7b7f1987ee33e9fe4c18747356b113ce36c50e17036ae24d1cf1bcb296d1e957f36017a2844d468a484d720501e35c495b74f6cd50425cd5ebfd9696adb54e2b82086f3ccf37d23e5467fd45569"}) r2 = syz_open_dev$binder(&(0x7f00000002c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) r3 = syz_open_dev$binder(&(0x7f0000000300)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, &(0x7f0000012fc7)}) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, &(0x7f0000000f4d)}) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000000c0)={0x8, 0x0, &(0x7f0000000140)=[@release], 0x0, 0x0, &(0x7f0000000340)}) 18:20:02 executing program 0: r0 = openat$null(0xffffffffffffff9c, &(0x7f0000000000)='/dev/null\x00', 0x105102, 0x0) r1 = geteuid() setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x11, &(0x7f0000000080)={{{@in6=@remote, @in=@multicast1, 0x4e24, 0x1, 0x4e23, 0x0, 0xa, 0x20, 0x80, 0x3b, 0x0, r1}, {0xff, 0xfc7, 0xfffffffffffffffa, 0x7ff, 0x7ff, 0x7, 0x4, 0x1f}, {0x3, 0x401, 0xfffffffffffffff9, 0x2}, 0x7, 0x6e6bb7, 0x2, 0x0, 0x3, 0x2}, {{@in=@remote, 0x4d5, 0x33}, 0xa, @in=@local, 0x3504, 0x1, 0x3, 0x40ac, 0x5, 0xfffffffffffffffa, 0xfffffffffffffffa}}, 0xe8) setsockopt$IP_VS_SO_SET_EDIT(r0, 0x0, 0x483, &(0x7f0000000040)={0x0, @dev={0xac, 0x14, 0x14, 0x1a}, 0x4e22, 0x1, 'dh\x00', 0x8, 0x8, 0x21}, 0x2c) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180)) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x7) add_key$keyring(&(0x7f0000000200)='keyring\x00', &(0x7f0000000240)={'syz'}, 0x0, 0x0, 0xfffffffffffffffb) getsockopt$inet6_IPV6_IPSEC_POLICY(r0, 0x29, 0x22, &(0x7f0000000280)={{{@in6=@loopback, @in=@rand_addr, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@remote}, 0x0, @in6=@remote}}, &(0x7f00000001c0)=0xe8) getsockopt$inet_IP_IPSEC_POLICY(r0, 0x0, 0x10, &(0x7f0000000380)={{{@in6=@mcast1, @in, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@mcast2}, 0x0, @in6}}, &(0x7f0000000480)=0xe8) setsockopt$inet6_IPV6_IPSEC_POLICY(r0, 0x29, 0x22, &(0x7f00000004c0)={{{@in6=@dev={0xfe, 0x80, [], 0x19}, @in6, 0x4e20, 0x81, 0x4e23, 0x0, 0xa, 0x0, 0xa0, 0x6f, r2, r3}, {0x80, 0x80000000, 0x40, 0x2, 0xffffffff00000000, 0x401, 0x5, 0xab}, {0x3, 0x1, 0x769bd007}, 0x4, 0x0, 0x1, 0x0, 0x3}, {{@in6=@loopback, 0x4d3, 0x7e}, 0xa, @in=@remote, 0x3505, 0x0, 0x2, 0x400, 0x2, 0x2, 0x2}}, 0xe8) [ 470.059668] binder: 30691:30700 Acquire 1 refcount change on invalid ref 0 ret -22 [ 470.068098] binder: 30691:30700 Release 1 refcount change on invalid ref 0 ret -22 [ 470.122510] binder: 30755:30762 Acquire 1 refcount change on invalid ref 2 ret -22 [ 470.127923] binder: 30764:30767 Acquire 1 refcount change on invalid ref 0 ret -22 [ 470.128085] binder: 30764:30767 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 470.153935] binder: 30755:30762 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 [ 470.170964] binder: 30755:30762 got reply transaction with no transaction stack [ 470.179528] binder: 30764:30773 Release 1 refcount change on invalid ref 0 ret -22 [ 470.187371] binder: 30755:30762 transaction failed 29201/-71, size 40-24 line 2922 [ 470.201646] binder: 30755:30772 Acquire 1 refcount change on invalid ref 2 ret -22 [ 470.209845] binder: 30755:30772 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 [ 470.216771] binder: 30755:30772 got reply transaction with no transaction stack [ 470.224255] binder: 30755:30772 transaction failed 29201/-71, size 40-24 line 2922 [ 470.232609] binder: BINDER_SET_CONTEXT_MGR already set [ 470.237892] binder: 30755:30772 ioctl 40046207 0 returned -16 [ 470.244493] binder: 30755:30762 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 470.252017] binder: 30755:30772 Release 1 refcount change on invalid ref 0 ret -22 18:20:02 executing program 2: r0 = syz_open_dev$binder(&(0x7f00000002c0)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000300)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="05630440000000003dd607648834fe8ea03cd05379d0ce2888fa924bc310a349504b1afcc9b355dd0a15dbcc4ce790d6816ba773579601"], 0x0, 0x0, &(0x7f0000012fc7)}) r2 = request_key(&(0x7f0000000080)='encrypted\x00', &(0x7f0000000100)={'syz', 0x0}, &(0x7f0000000140)='/dev/binder#\x00', 0xfffffffffffffffc) keyctl$read(0xb, r2, &(0x7f0000000180)=""/15, 0xf) r3 = socket$inet_udplite(0x2, 0x2, 0x88) getsockopt$ARPT_SO_GET_REVISION_TARGET(r3, 0x0, 0x63, &(0x7f00000001c0)={'TPROXY\x00'}, &(0x7f0000000200)=0x1e) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000000c0)={0x8, 0x0, &(0x7f0000000040)=[@increfs], 0x0, 0x0, &(0x7f0000000140)}) 18:20:02 executing program 0: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000000)) r0 = openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000280)='/selinux/commit_pending_bools\x00', 0x1, 0x0) ioctl$EVIOCGKEYCODE_V2(r0, 0x80284504, &(0x7f00000002c0)=""/122) ioperm(0x3, 0x9, 0x7) r1 = openat$full(0xffffffffffffff9c, &(0x7f0000000040)='/dev/full\x00', 0x2, 0x0) openat$keychord(0xffffffffffffff9c, &(0x7f0000000080)='/dev/keychord\x00', 0x410202, 0x0) openat$full(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/full\x00', 0x2280, 0x0) ioctl$EVIOCGABS0(r1, 0x80184540, &(0x7f0000000140)=""/183) r2 = openat$selinux_mls(0xffffffffffffff9c, &(0x7f0000000100)='/selinux/mls\x00', 0x0, 0x0) ioctl$sock_inet_SIOCRTMSG(r0, 0x890d, &(0x7f0000000380)={0x2, {0x2, 0x4e23, @broadcast}, {0x2, 0x4e24, @remote}, {0x2, 0x4e22, @multicast2}, 0x20, 0x1, 0x3e8, 0x8001, 0x10000, &(0x7f0000000340)='team_slave_1\x00', 0x8, 0x1, 0x200}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x22) add_key$keyring(&(0x7f0000000200)='keyring\x00', &(0x7f0000000240)={'syz'}, 0x0, 0x0, 0xfffffffffffffffb) 18:20:02 executing program 5: r0 = openat$zero(0xffffffffffffff9c, &(0x7f0000000080)='/dev/zero\x00', 0x40, 0x0) ioctl$RTC_AIE_ON(r0, 0x7001) r1 = syz_open_dev$binder(&(0x7f00000002c0)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r2 = syz_open_dev$binder(&(0x7f0000000300)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000005fd4)=ANY=[@ANYBLOB="1963044080000000"], 0x0, 0x0, &(0x7f0000012fc7)}) close(r1) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000000c0)={0x8, 0x0, &(0x7f0000000040)=[@increfs], 0x0, 0x0, &(0x7f0000000140)}) 18:20:02 executing program 3: r0 = add_key$keyring(&(0x7f0000000280)='keyring\x00', &(0x7f00000002c0)={'syz', 0x0}, 0x0, 0x0, 0xfffffffffffffffa) r1 = add_key(&(0x7f0000000080)='id_resolver\x00', &(0x7f0000000140)={'syz', 0x0}, &(0x7f0000000180)="59a162df137c24ee3583721cf5a11752b5b9bdafce40d4924390a0537dc121ccc1df0c1ec2e7870972f95ef5684972ec0397892d627ba9871a963fa2169095b5ba1f31007d62da411f3a3459c3a672eba5c365bc7d3700455e6cc449473a3f471e585cc9b5", 0x65, r0) add_key$keyring(&(0x7f0000000000)='keyring\x00', &(0x7f0000000040)={'syz', 0x3}, 0x0, 0x0, r1) r2 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./file0\x00', 0x40, 0x40) write$binfmt_script(r2, &(0x7f00000003c0)=ANY=[@ANYBLOB="2321202e2f66696c6530200ae3f6ec6f1f47809ed4496d64256388493653235e07a4e8c3cb5097b7c92f8074f62e311abcdd05d56ea2c801653b5ee5023a06952a9b925dbf1db5fe5d624fc767b36800000000d6fb54bac1e7c43513ef2eb6d0cdaa0ade696901918d3a6cd1d83fd910e8c49e38baf8ffe37301a5a42d3ba2ad7d852c5aab2071fe619aeae98bcdde2173b8d764eb52d5c6fb3ccf83eb9f92a3aa20ff4aab4e11c642672503785e3d79b8a9f0386306ea1e99"], 0x60) ioctl$ASHMEM_GET_SIZE(r2, 0x7704, 0x0) add_key(&(0x7f00000000c0)='user\x00', &(0x7f0000000100)={'syz'}, &(0x7f0000000200)="82", 0x1, 0xfffffffffffffffb) 18:20:02 executing program 4: r0 = syz_open_dev$binder(&(0x7f00000002c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000300)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, &(0x7f0000012fc7)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, &(0x7f0000000f4d)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000000c0)={0x8, 0x0, &(0x7f0000000140)=[@release], 0x0, 0x0, &(0x7f0000000340)}) r2 = openat$keychord(0xffffffffffffff9c, &(0x7f0000000000)='/dev/keychord\x00', 0x400, 0x0) write$P9_RLCREATE(r2, &(0x7f0000000040)={0x18, 0xf, 0x2, {{0x0, 0x3, 0x3}, 0x6}}, 0x18) [ 470.276769] binder: 30718:30741 unknown command 1074036741 [ 470.283233] binder: 30718:30741 ioctl c0306201 20012000 returned -22 [ 470.308755] binder: BINDER_SET_CONTEXT_MGR already set [ 470.314749] binder: 30781:30789 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 18:20:02 executing program 3: add_key(&(0x7f00000000c0)='user\x00', &(0x7f0000000100)={'syz'}, &(0x7f0000000200)="82", 0x1, 0xfffffffffffffffb) r0 = openat$keychord(0xffffffffffffff9c, &(0x7f0000000000)='/dev/keychord\x00', 0x2000, 0x0) openat$uhid(0xffffffffffffff9c, &(0x7f0000000040)='/dev/uhid\x00', 0x802, 0x0) r1 = syz_genetlink_get_family_id$team(&(0x7f0000000140)='team\x00') getsockopt$inet_pktinfo(r0, 0x0, 0x8, &(0x7f0000000400)={0x0, @loopback, @dev}, &(0x7f0000000440)=0xc) getsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x11, &(0x7f0000000480)={{{@in6=@local, @in=@remote, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@remote}, 0x0, @in6=@loopback}}, &(0x7f0000000580)=0xe8) getsockopt$inet_IP_IPSEC_POLICY(r0, 0x0, 0x10, &(0x7f0000000680)={{{@in=@multicast2, @in=@broadcast, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@remote}, 0x0, @in=@loopback}}, &(0x7f0000000780)=0xe8) getsockopt$inet_IP_IPSEC_POLICY(r0, 0x0, 0x10, &(0x7f0000000800)={{{@in6=@mcast2, @in=@rand_addr, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@remote}}}, &(0x7f0000000900)=0xe8) ioctl$ifreq_SIOCGIFINDEX_team(r0, 0x8933, &(0x7f0000000940)={'team0\x00', 0x0}) getsockopt$inet_pktinfo(r0, 0x0, 0x8, &(0x7f0000000a40)={0x0, @remote, @dev}, &(0x7f0000000a80)=0xc) getsockname$packet(r0, &(0x7f0000000ac0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @link_local}, &(0x7f0000000b00)=0x14) getsockopt$inet_IP_IPSEC_POLICY(r0, 0x0, 0x10, &(0x7f0000000c00)={{{@in=@remote, @in6=@loopback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@broadcast}, 0x0, @in=@multicast2}}, &(0x7f0000000d00)=0xe8) getsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x11, &(0x7f0000000ec0)={{{@in6=@remote, @in=@local, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@remote}, 0x0, @in=@multicast1}}, &(0x7f0000000fc0)=0xe8) sendmsg$TEAM_CMD_PORT_LIST_GET(r0, &(0x7f00000015c0)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x4801000}, 0xc, &(0x7f0000001580)={&(0x7f0000001000)={0x544, r1, 0x420, 0x70bd26, 0x25dfdbff, {}, [{{0x8, 0x1, r2}, {0x1fc, 0x2, [{0x3c, 0x1, @lb_tx_method={{0x24, 0x1, 'lb_tx_method\x00'}, {0x8}, {0xc, 0x4, 'hash\x00'}}}, {0x4c, 0x1, @lb_tx_method={{0x24, 0x1, 'lb_tx_method\x00'}, {0x8}, {0x1c, 0x4, 'hash_to_port_mapping\x00'}}}, {0x38, 0x1, @mcast_rejoin_count={{0x24, 0x1, 'mcast_rejoin_count\x00'}, {0x8}, {0x8, 0x4, 0xdb2}}}, {0x38, 0x1, @mcast_rejoin_count={{0x24, 0x1, 'mcast_rejoin_count\x00'}, {0x8}, {0x8, 0x4, 0xffffffff}}}, {0x38, 0x1, @notify_peers_interval={{0x24, 0x1, 'notify_peers_interval\x00'}, {0x8}, {0x8, 0x4, 0x1}}}, {0x4c, 0x1, @bpf_hash_func={{0x24, 0x1, 'bpf_hash_func\x00'}, {0x8}, {0x1c, 0x4, [{0x100, 0x4, 0x0, 0x655}, {0x0, 0x101, 0x6, 0x8}, {0x8, 0x1f, 0x1, 0x3ff}]}}}, {0x40, 0x1, @name={{0x24, 0x1, 'mode\x00'}, {0x8}, {0x10, 0x4, 'loadbalance\x00'}}}, {0x3c, 0x1, @lb_tx_method={{0x24, 0x1, 'lb_tx_method\x00'}, {0x8}, {0xc, 0x4, 'hash\x00'}}}]}}, {{0x8, 0x1, r3}, {0x80, 0x2, [{0x40, 0x1, @name={{0x24, 0x1, 'mode\x00'}, {0x8}, {0x10, 0x4, 'broadcast\x00'}}}, {0x3c, 0x1, @bpf_hash_func={{0x24, 0x1, 'bpf_hash_func\x00'}, {0x8}, {0xc, 0x4, [{0x1, 0x6, 0x20, 0x2}]}}}]}}, {{0x8, 0x1, r4}, {0x258, 0x2, [{0x38, 0x1, @notify_peers_interval={{0x24, 0x1, 'notify_peers_interval\x00'}, {0x8}, {0x8, 0x4, 0x9}}}, {0x38, 0x1, @lb_stats_refresh_interval={{0x24, 0x1, 'lb_stats_refresh_interval\x00'}, {0x8}, {0x8, 0x4, 0x3}}}, {0x3c, 0x1, @user_linkup_enabled={{{0x24, 0x1, 'user_linkup_enabled\x00'}, {0x8}, {0x4}}, {0x8, 0x6, r5}}}, {0x3c, 0x1, @enabled={{{0x24, 0x1, 'enabled\x00'}, {0x8}, {0x4}}, {0x8, 0x6, r6}}}, {0x3c, 0x1, @enabled={{{0x24, 0x1, 'enabled\x00'}, {0x8}, {0x4}}, {0x8, 0x6, r7}}}, {0x3c, 0x1, @lb_tx_method={{0x24, 0x1, 'lb_tx_method\x00'}, {0x8}, {0xc, 0x4, 'hash\x00'}}}, {0x40, 0x1, @name={{0x24, 0x1, 'mode\x00'}, {0x8}, {0x10, 0x4, 'loadbalance\x00'}}}, {0x3c, 0x1, @user_linkup_enabled={{{0x24, 0x1, 'user_linkup_enabled\x00'}, {0x8}, {0x4}}, {0x8, 0x6, r8}}}, {0x38, 0x1, @mcast_rejoin_count={{0x24, 0x1, 'mcast_rejoin_count\x00'}, {0x8}, {0x8, 0x4, 0x80000001}}}, {0x40, 0x1, @queue_id={{{0x24, 0x1, 'queue_id\x00'}, {0x8}, {0x8, 0x4, 0xae6c}}, {0x8, 0x6, r9}}}]}}, {{0x8, 0x1, r10}, {0x3c, 0x2, [{0x38, 0x1, @mcast_rejoin_count={{0x24, 0x1, 'mcast_rejoin_count\x00'}, {0x8}, {0x8, 0x4, 0x7fff}}}]}}]}, 0x544}}, 0x20000000) 18:20:02 executing program 0: socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000005c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) recvfrom(r1, &(0x7f0000000040)=""/211, 0xd3, 0x2000, &(0x7f0000000140)=@pppol2tpv3in6={0x18, 0x1, {0x0, r1, 0x2, 0x4, 0x2, 0x2, {0xa, 0x4e20, 0x3, @local, 0xf4}}}, 0x80) r2 = accept$packet(0xffffffffffffffff, &(0x7f00000001c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @link_local}, &(0x7f0000000480)=0x14) recvfrom(r1, &(0x7f0000000280)=""/222, 0xde, 0x0, &(0x7f00000003c0)=@xdp={0x2c, 0x4, r3, 0x14}, 0x80) add_key$keyring(&(0x7f0000000200)='keyring\x00', &(0x7f0000000240)={'syz'}, 0x0, 0x0, 0xfffffffffffffffb) getsockopt$SO_BINDTODEVICE(r2, 0x1, 0x19, &(0x7f0000000000), 0x10) r4 = openat$full(0xffffffffffffff9c, &(0x7f0000000380)='/dev/full\x00', 0x10000, 0x0) ioctl$KDGETLED(r4, 0x4b31, &(0x7f00000004c0)) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000440)={'yam0\x00', r3}) 18:20:02 executing program 4: r0 = syz_open_dev$binder(&(0x7f00000002c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socket$packet(0x11, 0x3, 0x300) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000300)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) pread64(r0, &(0x7f0000000000)=""/81, 0x51, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="9ffbfffff9493b9aebff5de37620c2d28402fd8dd2ed3a44e80127fe8c869d326e80c3feefb28cd7be6bb910c9bcbe00af3631e149d5f302612988054dd4377e7aa21bf7be7607030700000018e25384acc020fb9f8a9255f5edc8880f7976ac654aa7107a7c79d8275638bdf48a5736e986b2a5c0db3cc7c8fa03a5c7300d335a9820a7ed3dafc2f163a45ce5e86f8caf11420fc820744074ee60bca8b9f9bf76455561c4ecce862a9854cbdd5e2b2c296494df7061325cf28c9ec81131569d3b20e40612b8a4cfe0feb475caed46a9f44beca2e19cb25b39cd920ad49030ca0910d7103f9402bac145de5249c5e502000c9bd795e75a339518b243a9d48c15c975f184d452a364307e4d61fdd818e3870828ad3e4a"], 0x0, 0x0, &(0x7f0000012fc7)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, &(0x7f0000000f4d)}) syz_open_dev$rtc(&(0x7f0000000080)='/dev/rtc#\x00', 0x7, 0x101000) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000000c0)={0x8, 0x0, &(0x7f0000000340)=ANY=[@ANYBLOB="0663044000000000e80b22fbc0c639346eed1377ee03201f268a193919f904236d1902b042c68ee0aa2dee6fc03171d4696cbfbb5b22afb576ff30034284b28c67ef85405e27ad42d7c8a052a2b40893458002c9d4807ac0c8c79affda3bf23b98e21aceb7e0a270bd72fd67dbc857621140d60a580fde797c0c09b452d8f70a74099931ba05c0d9f9966e51c40eeafb6a642fc85809"], 0x0, 0x0, &(0x7f0000000340)}) [ 470.322630] binder: 30780:30787 unknown command 1074029337 [ 470.325532] binder: 30781:30782 ioctl 40046207 0 returned -16 [ 470.343606] binder: 30780:30787 ioctl c0306201 20012000 returned -22 [ 470.352170] binder: 30780:30787 IncRefs 0 refcount change on invalid ref 0 ret -22 [ 470.363215] binder: 30780:30787 unknown command 1074029337 [ 470.370867] binder: 30780:30787 ioctl c0306201 20012000 returned -22 18:20:02 executing program 5: r0 = syz_open_dev$binder(&(0x7f00000002c0)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000300)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, &(0x7f0000012fc7)}) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000000c0)={0x8, 0x0, &(0x7f0000000040)=[@increfs], 0x0, 0x0, &(0x7f0000000140)}) syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x2) [ 470.430694] binder: 30803:30806 unknown command -1121 [ 470.460778] binder: 30803:30806 ioctl c0306201 20012000 returned -22 [ 470.472041] binder: 30803:30806 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 470.501643] binder: 30803:30806 Release 1 refcount change on invalid ref 0 ret -22 [ 470.513841] binder: BINDER_SET_CONTEXT_MGR already set [ 470.519449] binder: 30803:30819 ioctl 40046207 0 returned -16 [ 470.525756] binder: 30803:30806 unknown command -1121 [ 470.526733] binder: 30803:30819 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 470.527171] binder: 30803:30820 Release 1 refcount change on invalid ref 0 ret -22 [ 470.546767] binder: 30803:30806 ioctl c0306201 20012000 returned -22 18:20:03 executing program 1: socketpair$inet6(0xa, 0x2, 0xb8, &(0x7f0000000040)) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000100)={0x110, 0x0, &(0x7f0000000080), 0x0, 0x0, &(0x7f0000012fc7)}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, &(0x7f0000000f4d)}) socket$inet6_tcp(0xa, 0x1, 0x0) pipe2(&(0x7f00000004c0)={0xffffffffffffffff}, 0x84000) ioctl$EVIOCSMASK(r0, 0x40104593, &(0x7f0000000580)={0x3, 0x7c, &(0x7f0000000500)="9421b64d087b3616e798c60025dccfe0602981135bf23a233ab06dd96ef4f7d20ba2ce3f823988294c94411fc6b4769f14d8c6f03b4cb63d9add351fdece4766bd9b59fa794e3e5d28a749cacd1b47da29e0c2e4d42f77c1652850cbfd858a0e6c5215e2457ba326cf5d08468d3d5d171e8a4136efb18417152b507c"}) r1 = syz_open_procfs(0x0, &(0x7f0000000000)='mountstats\x00') setsockopt$inet_buf(r1, 0x0, 0x4, &(0x7f0000000180)="01c691c68a1cbb92069bc41a276c0956ed6e55186d17248747f7ffcee27ee40e8f83d81000d6926a5b3742a97853ec8743622e3fe8de86289325bbaf87b11dcada19a2a6a8f885743afe9fca7be29133f137131a805257a026a9df72982b2f9a17cd1036a5eb800f652a9abca78873ed924d4fbd4c483aa3fddd73ca17bc8fe301224e636a28831cb62109164f84974049abb512114202f22833b2ec9bdf6b3917dac3402b015d67911e55913dc37a67b2ec2388e30ec32e2ee68e6291a53d3b9ced16893d9c6875a75ddf74f479416037d5352a0ee2934fd357cc3c364567d9e5e6e963", 0xe4) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f00000000c0)={0x8, 0x0, &(0x7f0000000340)=ANY=[@ANYBLOB="666d594e17e8a236a8a53ccf739e8699e717ec9bcd6599ada9ee396d8ff5826d73461d957f9e609c98b6ba6078a2bfd60b882f9e59e82512e615db5a63c80f16642dff345ed46a21e7ba3059f1c9d68ea6aa4f3c0c10624716a11b6cfbe315a18fe83d53ca7e536ab6552a6382d3ba5a06b2683b465f1f448c18c19e49a796ea612f7e39eefbe4bf47711c20b243a3b1c611b402254c4fa32a4b423eb24c6e5f1e1081f0c5ed3feea99764acfb9dba0f31d7a3a1d8e28eb97e271315c87ec3cf7d51ad44673dfc5a367ee72094047564fe9632756b48c79404a029bfbd989563a12e21b72bacb8dae3ed531f6673e8af9f83f39c9e69df1d3360e815c6099a"], 0x0, 0x0, &(0x7f0000000340)}) r2 = syz_genetlink_get_family_id$fou(&(0x7f0000000140)='fou\x00') sendmsg$FOU_CMD_GET(r1, &(0x7f0000000480)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000000440)={&(0x7f0000000280)={0x4c, r2, 0x300, 0x5, 0x25dfdbfe, {}, [@FOU_ATTR_TYPE={0x8, 0x4, 0x1}, @FOU_ATTR_IPPROTO={0x8, 0x3, 0xff}, @FOU_ATTR_PORT={0x8, 0x1, 0x4e20}, @FOU_ATTR_AF={0x8, 0x2, 0xa}, @FOU_ATTR_TYPE={0x8, 0x4, 0x1}, @FOU_ATTR_PORT={0x8, 0x1, 0x4e22}, @FOU_ATTR_PORT={0x8, 0x1, 0x4e21}]}, 0x4c}, 0x1, 0x0, 0x0, 0x44080}, 0x81) ioctl$EXT4_IOC_MOVE_EXT(r1, 0xc028660f, &(0x7f00000005c0)={0x0, 0xffffffffffffffff, 0x7fffffff, 0x8c, 0x0, 0x9}) 18:20:03 executing program 5: r0 = syz_open_dev$binder(&(0x7f00000002c0)='/dev/binder#\x00', 0x0, 0x0) pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TIOCNOTTY(r1, 0x5422) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r2 = syz_open_dev$binder(&(0x7f0000000300)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, &(0x7f0000012fc7)}) close(r0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000000c0)={0x8, 0x0, &(0x7f0000000040)=[@increfs], 0x0, 0x0, &(0x7f0000000140)}) 18:20:03 executing program 2: r0 = syz_open_dev$binder(&(0x7f00000002c0)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000300)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0xf5, 0x0, &(0x7f0000000100)="014f2789861ff15df4ee9ab929ac0262173a0c6eac7d1171f1d0fbadbc629b332f49cbea3507f1b1bf3380d9b641d378a0a0c12ea51ea45a39cce8bd94a37ae206b3eb3e466176524cd9d6d74425ffda5abdb9b40295fe4df4d22ead09ab46e9f3c787f2aa69c1a82f5a89a79788d52776cb5a0162f8330000002d40bf42e79423ba0bf851aa4c67d097c83af96fce1c8f6aa54c2665262cc56fdd31650c66ea421aa3c34dbeb6a717ae011b9a0ac23f3b75e2803c419f1e70ae86838e78cc912bf19c399691d86f87b63f00fdecb7b6f5f41bcc428f148dba55ea2cf1829123e5b3f53117e49bb3e7436be45c8200000000000000"}) close(r0) r2 = socket$inet6(0xa, 0x0, 0x7) getsockopt$inet6_opts(r2, 0x29, 0x39, &(0x7f0000000340)=""/216, &(0x7f0000000000)=0xd8) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000000c0)={0x8, 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB="04000000000000005a70756a4206aa56be8099601e85a1e380c142457d31822c3618ff577b9c6199ae"], 0x0, 0x0, &(0x7f0000000140)}) 18:20:03 executing program 3: add_key(&(0x7f0000000000)='.request_key_auth\x00', &(0x7f0000000100)={'syz'}, &(0x7f0000000200)="82", 0xffffffa8, 0xfffffffffffffffb) r0 = openat$full(0xffffffffffffff9c, &(0x7f0000000040)='/dev/full\x00', 0x222000, 0x0) ioctl$SNDRV_TIMER_IOCTL_GPARAMS(r0, 0x40485404, &(0x7f0000000080)={{0x3, 0x3, 0x7, 0x1, 0x6}, 0x6f28, 0x80000001}) syz_open_dev$sndtimer(&(0x7f0000000140)='/dev/snd/timer\x00', 0x0, 0x10000) 18:20:03 executing program 4: syz_open_dev$binder(&(0x7f00000002c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000000300)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, &(0x7f0000012fc7)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=ANY=[@ANYBLOB="9c630c4000000100"], 0x0, 0x0, &(0x7f0000000f4d)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x8, 0x0, &(0x7f0000000140)=[@release], 0x0, 0x0, &(0x7f0000000340)}) 18:20:03 executing program 3: keyctl$join(0x1, &(0x7f00000001c0)={'syz', 0x0}) r0 = add_key$keyring(&(0x7f0000000140)='keyring\x00', &(0x7f0000000180)={'syz', 0x0}, 0x0, 0x0, 0xffffffffffffffff) socketpair(0x2, 0x1, 0x80, &(0x7f0000000240)={0xffffffffffffffff}) mmap$binder(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x53, r1, 0x1) request_key(&(0x7f0000000000)='.dead\x00', &(0x7f0000000040)={'syz', 0x3}, &(0x7f0000000080)='\x00', r0) add_key(&(0x7f00000000c0)='user\x00', &(0x7f0000000100)={'syz'}, &(0x7f0000000200)="82", 0x1, 0xfffffffffffffffb) [ 470.919871] binder: 30764:30773 Acquire 1 refcount change on invalid ref 0 ret -22 [ 470.920141] binder: 30764:30823 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 470.958586] binder: 30825:30830 Acquire 1 refcount change on invalid ref 0 ret -22 18:20:03 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000300)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="0563044000000000e6844627335e1d0f1b45c39b796fa6fd4545c7aa4b2cd4dd733bf5fd6190e242cebbe82776b153da2b7668f52ea03cb8713ed1e2a87cd2ca8db1e9df72443980945a7c910d755d43861a3b8d7ba6d73a8bfec912b59206eaeff6f76fe3eed5db6ca77163d472993396df0c"], 0x0, 0x0, &(0x7f0000012fc7)}) r1 = dup3(r0, r0, 0x80000) r2 = syz_genetlink_get_family_id$nbd(&(0x7f0000000140)='nbd\x00') socketpair$nbd(0x2, 0x1, 0x0, &(0x7f0000000340)={0xffffffffffffffff}) r4 = dup3(r0, r0, 0x80000) sendmsg$NBD_CMD_DISCONNECT(r1, &(0x7f0000000440)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x428}, 0xc, &(0x7f0000000400)={&(0x7f0000000380)={0x74, r2, 0x200, 0x70bd2c, 0x25dfdbfd, {}, [@NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_DEAD_CONN_TIMEOUT={0xc, 0x8, 0x10001}, @NBD_ATTR_TIMEOUT={0xc, 0x4, 0x8001}, @NBD_ATTR_SOCKETS={0x1c, 0x7, [{0x8, 0x1, r3}, {0x8, 0x1, r0}, {0x8, 0x1, r4}]}, @NBD_ATTR_BLOCK_SIZE_BYTES={0xc, 0x3, 0x6ad}, @NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0xfffffffffffeffff}, @NBD_ATTR_TIMEOUT={0xc, 0x4, 0x2}]}, 0x74}, 0x1, 0x0, 0x0, 0x4000000}, 0x20000840) r5 = openat$selinux_status(0xffffffffffffff9c, &(0x7f0000000040)='/selinux/status\x00', 0x0, 0x0) ioctl$TIOCMBIC(r5, 0x5417, &(0x7f0000000080)=0x3) ioctl$RTC_PLL_GET(r5, 0x80207011, &(0x7f0000000480)) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008fd0)={0x0, 0x0, &(0x7f000000dff8), 0x0, 0x0, &(0x7f0000000080)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x8, 0x0, &(0x7f0000000200)=[@release], 0xa5, 0x0, &(0x7f0000000240)="48aa6d33aa84e5ed48b7f47821d170414fb4d50bd210f0398f65614f944d952f8ccc7ec512b3c7f83e010ef729794d1d3a8d18472ca787cb0599088d3de2c19da917a7025d95b87ae4e734be40c4fbf2310e3b3c325cafd73438e47d042683d711d47ece836b3e1d55e629c96f4be84b6e016c9c56076767d8b9ca1ff71b0ed857453dd1e021ef3d8293858dd311abe7f9a4502eac35000000000000000000000000000000"}) openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/enforce\x00', 0x88400, 0x0) [ 470.977511] binder: 30825:30830 unknown command 1074553756 [ 471.003119] binder: 30825:30830 ioctl c0306201 20008fd0 returned -22 [ 471.009514] binder: 30827:30843 unknown command 4 [ 471.009524] binder: 30827:30843 ioctl c0306201 200000c0 returned -22 18:20:03 executing program 2: r0 = syz_open_dev$binder(&(0x7f00000002c0)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000300)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000005fd4)=ANY=[@ANYBLOB="056304400000008c"], 0x0, 0x0, &(0x7f0000012fc7)}) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040), 0x0, 0x0, &(0x7f0000000140)}) [ 471.019390] binder: 30827:30843 Acquire 1 refcount change on invalid ref 0 ret -22 [ 471.033664] binder: 30825:30850 Release 1 refcount change on invalid ref 0 ret -22 [ 471.063568] binder: 30851:30853 Acquire 1 refcount change on invalid ref 0 ret -22 18:20:03 executing program 2: r0 = syz_open_dev$binder(&(0x7f00000002c0)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000300)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, &(0x7f0000012fc7)}) close(r1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000000c0)={0x8, 0x0, &(0x7f0000000040)=[@increfs], 0x0, 0x0, &(0x7f0000000140)}) [ 471.080864] binder: 30854:30858 Acquire 1 refcount change on invalid ref -1946157056 ret -22 [ 471.096591] binder: 30854:30858 Acquire 1 refcount change on invalid ref -1946157056 ret -22 [ 471.115632] binder: 30851:30853 Release 1 refcount change on invalid ref 0 ret -22 [ 471.136742] binder: 30825:30850 Acquire 1 refcount change on invalid ref 0 ret -22 [ 471.150586] binder: 30825:30830 unknown command 1074553756 [ 471.156515] binder: 30825:30830 ioctl c0306201 20008fd0 returned -22 [ 471.163894] binder: 30825:30850 Release 1 refcount change on invalid ref 0 ret -22 [ 471.165035] binder: BINDER_SET_CONTEXT_MGR already set [ 471.165043] binder: 30865:30869 ioctl 40046207 0 returned -16 18:20:03 executing program 0: r0 = add_key(&(0x7f00000000c0)='logon\x00', &(0x7f0000000100)={'syz', 0x1}, &(0x7f0000000280)="5b462e0076fc1b7ed6a5b8fe6a13334e3800781a0279c2e11619775ad092c5d0feabff4a564dcff6309356c324490c65ccab613e893c521bbd0f4365f3a6aec7d839ce5c995d69e838fb3e66359412e9b49ebd6b6978253ad3b6ef058f4abfd65137dd48f3f2f09566a097e1290eb11acb62d31bce71ebff04277c2cc525889f6dd84cfe625ee4c522de62478e5b886fca232ccd07d8451aff1d4431cfd588bd1b675a3593c560cd4ebdfd3c63546c23270877ca44c334341282c1d5beaecc2e12771b6089f8e783cf269cc65c2bc145dc154b88be2a9e328e624f0132552cca63846bb585d8ce95823df841c23549c5bad5d4a75928d5d879a8c714a0cde9a6333eefb9c57478516bfebd1763cbdb5f9d487034c436412e96c047878211e8f8b6e759642b7406a740570144c4690b83bd852169c4f1c54f3c82759bfd537466676573727f2759a56df5e235f733878d24a07988309347b0b2d789df6460fc275a476307bcac41dc40228ac6b13f72ccfef8bf5fed913679a7e08bd8ed2f2e91e5af00619d8f5f9c4a9ec0557215a688826bf195438b19daae955d21268f0b22675a70b76ceb64e5a56a68ae423b518808b99ad41d3728a7d0b5c1533b2a84742d6e40c39bfcbebe77373c88eab9f39b1c6b430161f1805b2b1e86f023c8cf0496fcdcc0e02025b8cda0c5af73bee4562f8015888110124b58427fa87508dd3d4864dd3eb14745d92098abf4fc002c40cbfef9332d03378ed070e0a521fb0f5937108e999dc1f3d8a1d1a3a2d95a615cd6cf6e389b2aa534f35c0c5f741a138c203cdde92d58d438e31d92f581b350088b439ed8cb59bfdd7f2ae6a4dde51fe2d352a0ef854c121e556bd5f4f397ae3428d36266807f8e57f5b77c5b5877107077fd4316acbc88670cfda4af21f995fb3c47ee899ef0ab1dac8e04b4fc20dd7ec251c78af2ac7352d6edfb93b53879c0c125c5da2f9125379b9570f8f90111a3c0e5018dc70ecc8f486796eb62ec454fd7008a0e3486fcc3e6f46402ad73586174686aa56045b7a33a8d66154cac379a27c2c9e499253b24d511d19584fb7cffbd89b6a94de2de6009567fe3fce22c0546c02e2102e57c585ce16d6aa2c92f3fb7e65f832b158606b56d373cd1e240ec6f83984dc33cf3823bf1d2d5f70625c4e04185f31169bf2872ec9dce95bddfce62f4e4371103314ee1aa3132c26b5983467bfd644d44ab2adc3d424a6fb944bc2b44876525c67aa8df9df25806db90651c81378dda8726ceaff6fb40c464facdf599670708720cc4ea8299a103965ffc60b0b96db1f79518128fc4fbe784ad011e3bd9f71e3a5c262a60cc5ff3b260d407252c8287706d665a265b21386bce0f9b8044ef1efe88746fd33f831a917e2afed761279e93234662a74ad61754fcdbcd65fdad307a20653998ae8ca558ce9ef5987935cffd0be08f3ebf13d0d68484b8575dd3e07589ae15cbaaba0d805659738683c91dc0a4f48f9869582396644baafbe8c174ac71b2253c5e5b04a1e6d7e84b44796ee9f4c02201a14594db5c5445f6c9070423b5186bf29412d773fa28333f32967f57dc51e68d9e2e33efac248240af2a6785d37c9bbce363457f127ccdbadd2526199f1c79823fccb2673867348ab9d3b77fbc192abb56705ad8f11a0ad3829460dcabefe17c771b54539feb40ff8985c770d51543f833a1e007678154bf2a5f443058b2910054bff7a2e688a7698bad0115c8631dd681b49848db460ddf96f1aba66595721383617caf8cba72ec60ff1849b0cfd4665b47f6f5d2be2c94eff059a4ccf653342c64c51e188fc4ba73a9c7f535a675ff37b815e179456abae525e2ad04d116acb60ca753d02d5afd95b85019848be8f39a17cc7cf8d8b315a049072b50ab3f8c51aa073b3c0e99b130dd9fa90ecad1f396254110db1addfb9f17e9e284be6eead591f4047841e86160357bfbaf383354f741f7622e640ae2c3da3fee8c88e9d3f9b445866b81ff6508a161199bda0e4b5837d2d72c18a9ba7eca3d77a82e06c88aec2e3aa7530fef0a9497912b8c9a13af3a87aed7e6663d63d6c9739bb2528542a35a25c392c5db244f26bed8384f84585a9b88080309dff6663427e3775a191746189316d0df74e69e63b86b4f170bb586f8dcaced6a2c5a11f7ad62c35f996243cba4f7f1f9068c0e2ab6caf7571f94201625f320b4f03cfa1a355b8fccd0216f23e3f115c5aea903236a2174a5562fd19d257ece04bb25344c7360e63233c9b26bc857c53eb0c2d1c327918944ee18f602d6da31a613e7ffdbaa8a9d08910767fcc69494723bcf808d72919a8919a4e3124b5eecc76c2b7ef520ef3ed09dad1bd85caed95ff3a33787b0a0b2c4472efd552c5d54cd43df768b56dabddbaf91ec132f2b710e72c182eef28f13219ada625f2962da9241858aeb73e211193942e32933d25a261668cb5c9cef376e35e888226da1914da3004a68c5db51ba8f500ac2d4ef3d8dc3b2aee5f0410e33b08a721e09ae20a36208477b0fa84dcc8e270ada97c7ecedf3b12282ccc3a5bb923a434a32254cb02465d03e83685bf7abdf8cc3fdae9a89409e3e0fe39879664e85b9b8ff29fef45ba055aa8800938828b8ac812adff0bb65bb3d7efd43354c8e7ac0a83e87845a2ea11c75901ee4bd7053dd151b669feb1abdaef51151ff9c3f4a1c49750bfe4e5760b22d9144a84640254b36e279b8e95d247b987aabd8326bb57998d03461ee003caa63d75ce03e16f23639913af705fd217e209920acb172d5d3fcee4a096dae8aaa6573b1fefdf72ccf66d86a4b3bf37701869aac1566117a39465797dd3ce9f1a7b9e825d90a68ea2e0e8eefa1f75545626403a0ea9d12c623e2eeec98f70c8eef258e1f47d6be9cb8adc55dbd10aef7a0d8a69b42607bc8aeb8b17d2e2a50ca7b961d7e152bfe3695680ec5eb28d4748b8f16bbb8df4f067b14cb00b87980a6d266f35af2937e949d4dced00973dbfa030d15d8179f3daeb0892d184a1c1677b3ebe1c0a2ceafd246649f30818ae73ccbd24087750452916a03083b1b8f2814d8e351a01ed0bdae6d003a8bd1adf85a841d4e06e9ff7611c370b4b07d740e9270eff860de0bfc1d2142ef957212b1d1ffd2f460a1ce570cf50c14c2e10bedfdfd29aa37293db8d9d1999182bc443d2f171df70d3a17a1db3e1bc5c432b767726c2175d97db3132d5295f431f6d1e0217858599bea2139653f5b6ce2bde5d6cbd0b93ec17c992fffd9530e60fb0bb88f7de2b5a140e2b121fce20f9ff0ff9539e214bab8b57ba25ef2e18b0ca444921b26188555ed4b148658030a9f128e291fdc516b687647305ac84f04088e7b2c2f8cc3a8028ea21ef0b2a7fbef736c7c227512b662a4a6c64889485119053ece38fa80ae867b3509f21c788aece0a5f0b87a4f3b9b7f21e4de5467b1a2c55b2e6624bb7ccb076c5577666d2a397f2c4d4d050d1de28e12b72292ed50a56ce3304c116d322dad6d86bdc55fc973efa1b3ce4690f0d91e122135221072b3aefbc99cf20e7aa9d46887d52247a490d013a5ef5ca9619f547b3ded1220947dad90dce20ae7cd4e0ce8688cc522ca5520f60d8b8550b53ad900146f9fd19664e8ba0655eb6ad9eb72ee6f02fcc79d17ceaa9662f5f093b39f380e8187d44c5bdbe37696bf7dc0d01ec7f6dca5497969488e3639d50f3d5e5f56354295e6f2ab9767d38b83e0f15505880e543db73c9cff9a0a1b541ae2efd94d3fd79d7805b9ff22631cfa1baef8c3206f74003ac67f43550849ce18ffc4b27a6b9e5a2b3e7614b5197c47910af37bce275ff21f68691c450200cc18166e5e8500f3c5353d34ac5b26515b1ae53581ccc168acbf059ac1825be337f22dd5fb5c3fcc21658f4bfed6dd7fa0871866dd70a38c392a4c8d43d610a17f44af987a9217f5d65dd2753ec86e290dabaf4b9fca8c005dc7d112f2bc224cd20247ab5a080689ceb4b83d68d2c80d5d7ab15608310d097bb494776fd5b8047f96a102282bc8409b8e4a5a5c0bd9ad7fecfdcecb41134d9c4d997e134255e3b735573e8331f44872997b6f3a29b0ae922faa288099bc759e02c9af906d33a444c2a26eef3488e7a74c1738a8b72987fd09bc23d28b6e3bb9ad17f5b8945b4630b5d46474667f61558b476bc4d6712f62546dec0fc601c4a264cb51043dd4f6cdb3f9803aac29f0aff727f6e548748ec3751ba4117c75b39bc124b1a0287d9c64117d8adb47144ab1fdd90ad890bb5563e579a90a044e5c45ac5170f1ee8f58cedb229787c24ff7f4eacd11e9713d355cfc0fb605d0097e62009652a28c1674362a8d3e5d56ed1feead6c3df5220933ba0430f518e0c5cbe89828a8de1ba00f9d4e53cf682a662f1aee6743733971ab12f940766bb001ea88401e1a6e01fb3656e18c5149092e256d30cb460fef2560ca84836326ebbeb96b3cee9b6647b535ff4769842894085b463466b16a97c31f0e1ead145c5e3684af4563e5e23e1a1f7790bd5b5be10cf6100509f3d92f2b1bc3f186f22b6a4324abcef490f9fa0f473fa0b3cd43440997ab941062b8d8c858d7bf08ff09480067a7eb942791ef64c9a9a665f5f25153132ba07a23d4044578b8130a40aa4bbc1585777d1d60e1da8a6d62aa2b2476a3a988842265260a6bd7e9d9ce9e66af2142165c54e957eb720a4d726a6d3b06c3cfb3a03543adc9de718e1c5f0f0a1ebe99dff3482ebf50064025e8d92b5158ade73178e4277fbb9b4096b5b431400bb69f59667bab1a83daf1efc192ba0882a5d7475ab55de3dd2a08e1062d2b1cd6098bec3e42bd03313cf7621230dd6c2d758d6e2479566d2f5412b0b09d72b5359e840fdbabd686239b42b5b021d540259fd212f99fbff1bcec9a0b755e899c6e2ea943a9841c362f13e3501b2f0a2420b3b5bd273e2fb9a9a9a276e9c83366ffb9a7997444a0d0ec7d0d1a792df8339130a8b3be243cdfbb7661d365c93780608c0dc1439633b8304a752e8c777ea72aac12a1cce241f3d2103cdeda4fb9f1253b450d53d527a2fb01388ae35a094a8f9fd0393e533a32cb79357f69177ceab1b95f90d751d66c2b6543830ca63b571f697096b9fe20be7ba669269f91e430a0b5f29482e9d5150e14691cb94d3cf38f03aa8a2778651c58b836edfe78988a120008d8dead58eafa5160336f448b8209f5f839597b38e00c65f6fc920749be32f95e2597cc58720d3ef261047f059c1c65b872771f1e0ff8ceae3cf6268c86410f271231140ec0edf3427c98c7a892ca949bd90ef0930c5b8fdd68d47f56f6e2d91ff1acc2a5766edfa8e9df6df0c86f5a00db0026af38940b8c2cc88e8a566a16e0ed16a4067bf9daeef291c024198c579d13ca366f63e34b0e67b47ea3e9ea4e58e1955cdc3c03194fdc92a792fdfabce6da1db68e006b53d8f893e263524af646bccd66e429969522dbe45e09cd3ec4e5ff0afb25dab1a31e568d4c51861334eee713d65e01980513ccd0cab65ad4493d76b6e80fe080e5fd43ea57b3eb15d11a07df10cf508e6206a8586cb39e4ee1b3a80d225a21c86bdf7d927f4faa41a3d5eb81873b89e64d8bdfd6be59a26b192ad60abe4b140d4ed4a81635bf1153bbbf1fee2239a2eaeabe70cfb02e0e2b195782c88ef8ebebf5d448a9c4e37e9c5681da1cccf4c54953f2f098b2eb836b6f48436b0330d5cb818f598752232666f36adc87d7add2d4d6c13c4d9eceaff53c28da8dd695c36794e663511b5d9347369b4698e76c9f", 0x1000, 0xfffffffffffffffb) request_key(&(0x7f0000000140)='dns_resolver\x00', &(0x7f0000000180)={'syz', 0x0}, &(0x7f0000000080)='wlan1,/ppp0vmnet1keyring\x00', r0) r1 = openat$selinux_policy(0xffffffffffffff9c, &(0x7f0000001280)='/selinux/policy\x00', 0x0, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x4001fe) add_key$keyring(&(0x7f0000000200)='keyring\x00', &(0x7f0000000240)={'syz'}, 0x0, 0x0, 0xfffffffffffffffb) r2 = openat$full(0xffffffffffffff9c, &(0x7f0000000040)='/dev/full\x00', 0x10001, 0x0) setsockopt$SO_TIMESTAMPING(r2, 0x1, 0x25, &(0x7f00000001c0)=0x10009, 0x506c58df45b22744) ioctl$sock_FIOGETOWN(r1, 0x8903, &(0x7f00000012c0)=0x0) fcntl$setown(r2, 0x8, r3) r4 = syz_open_procfs(0x0, &(0x7f0000000000)='status\x00') syz_open_pts(r4, 0x101080) 18:20:03 executing program 3: add_key(&(0x7f00000000c0)='user\x00', &(0x7f0000000080)={'syz', 0x0}, &(0x7f0000000000)="ff260000e94704006bc9f783479dffc1125290a900000000", 0x18, 0xfffffffffffffffa) 18:20:03 executing program 2: r0 = syz_open_dev$binder(&(0x7f00000002c0)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000300)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, &(0x7f0000012fc7)}) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000000c0)={0x8, 0x0, &(0x7f0000000040)=[@increfs], 0x0, 0x0, &(0x7f0000000140)}) dup2(r1, r1) 18:20:03 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000300)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = openat$keychord(0xffffffffffffff9c, &(0x7f0000000000)='/dev/keychord\x00', 0x8000, 0x0) ioctl$UI_SET_MSCBIT(r1, 0x40045568, 0x16) ioctl$TCSBRKP(r1, 0x5425, 0x2) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, &(0x7f0000012fc7)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="0e630c6fab9056e838610000003111cfafaaacab3ee2a5ffe7ac3f61f2de0967f4a76fe66a02ffee2da55bb6884c2b87a77cc97f8bb72963f04741898fd6b383792f9d369275a308dc3fa6ab51ef1084e00f5e6d4d92edefdd53b01715da21bb2807501f251080d9ceff3826dcb5c93076e5f68954de3896af7949598d6e7ee2598f2c060f33775ac203a4db9d3a5ca49a905c18022233243b8b7c58a6009d6e35bbbf6223c4a92fab2b2bf3cf40e2dbaa0cd8fffb474b4efb6df8b956ca9341d42de4ce27bf053c30e9b875c8b1c24042dd6a3d0c947db831cff2683439e0c66ac320ef8496f110af8bf7"], 0x0, 0x0, &(0x7f0000000f4d)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x8, 0x0, &(0x7f0000000140)=[@release], 0x0, 0x0, &(0x7f0000000340)}) 18:20:03 executing program 4: r0 = syz_open_dev$binder(&(0x7f00000002c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000300)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = getpgid(0x0) ptrace$PTRACE_SECCOMP_GET_FILTER(0x420c, r2, 0xce, &(0x7f0000000000)=""/40) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000005fd4)=ANY=[@ANYBLOB="056e954200000000"], 0x0, 0x0, &(0x7f0000012fc7)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=ANY=[@ANYBLOB="0e4b0c4000000000"], 0x0, 0x0, &(0x7f0000000f4d)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000000c0)={0x8, 0x0, &(0x7f0000000140)=[@release], 0x0, 0x0, &(0x7f0000000340)}) 18:20:03 executing program 4: r0 = syz_open_dev$binder(&(0x7f00000002c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = openat$null(0xffffffffffffff9c, &(0x7f0000000000)='/dev/null\x00', 0x4000, 0x0) getsockopt$inet_buf(r1, 0x0, 0x27, &(0x7f0000000180)=""/227, &(0x7f0000000040)=0xe3) r2 = syz_open_dev$binder(&(0x7f0000000300)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, &(0x7f0000012fc7)}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, &(0x7f0000000f4d)}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000000c0)={0x8, 0x0, &(0x7f0000000140)=[@release], 0x0, 0x0, &(0x7f0000000340)}) [ 471.327981] binder: 30881:30886 Acquire 1 refcount change on invalid ref 0 ret -22 [ 471.334600] binder: 30882:30887 unknown command 1117089285 [ 471.334608] binder: 30882:30887 ioctl c0306201 20012000 returned -22 [ 471.334793] binder: 30882:30887 unknown command 1074547470 [ 471.334801] binder: 30882:30887 ioctl c0306201 20008fd0 returned -22 [ 471.335210] binder: 30882:30887 Release 1 refcount change on invalid ref 0 ret -22 [ 471.336633] binder: BINDER_SET_CONTEXT_MGR already set 18:20:03 executing program 4: r0 = syz_open_dev$binder(&(0x7f00000002c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000300)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, &(0x7f0000012fc7)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, &(0x7f0000000f4d)}) r2 = open(&(0x7f0000000000)='./file0\x00', 0x0, 0x8) ioctl$UI_SET_FFBIT(r2, 0x4004556b, 0x69) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000000c0)={0x8, 0x0, &(0x7f0000000140)=[@release], 0x0, 0x0, &(0x7f0000000340)}) 18:20:03 executing program 3: r0 = add_key(&(0x7f00000000c0)='user\x00', &(0x7f0000000100)={'syz'}, &(0x7f0000000200)="82", 0x1, 0xfffffffffffffffb) keyctl$read(0xb, r0, &(0x7f0000000000)=""/77, 0x4d) [ 471.336641] binder: 30882:30887 ioctl 40046207 0 returned -16 [ 471.342909] binder: 30882:30887 unknown command 1117089285 [ 471.342917] binder: 30882:30887 ioctl c0306201 20012000 returned -22 [ 471.342974] binder: 30882:30889 unknown command 1074547470 [ 471.342995] binder: 30882:30889 ioctl c0306201 20008fd0 returned -22 [ 471.390420] binder: BINDER_SET_CONTEXT_MGR already set [ 471.390440] binder: 30891:30892 ioctl 40046207 0 returned -16 [ 471.391750] binder: BINDER_SET_CONTEXT_MGR already set [ 471.391759] binder: 30891:30892 ioctl 40046207 0 returned -16 18:20:03 executing program 3: add_key(&(0x7f00000000c0)='user\x00', &(0x7f0000000100)={'syz'}, &(0x7f0000000200)="82", 0x1, 0xfffffffffffffffb) r0 = socket$packet(0x11, 0x3, 0x300) writev(r0, &(0x7f0000000500)=[{&(0x7f0000000040)="7322bb09c888733416d356f9bb17eb1ea96c80ecde7999640f38a3783c3f5cfb1470", 0x22}, {&(0x7f0000000140)="6d53a3d062424fe65f76b6bae88dd7c61def7a6348452bba263431ee0712db33a03cb88c3fa604c1f6d95d7733fcf7be638b15ddd0a18d547b305a3687fb0fa00902bd48969590bb931d9f1c7ad528a4bd5570d7232c4b7573614e0f4793d2fee64e9ca300877c839b6437b202944efe39d628ce22053e1a18e7823e57c02a58bb5e73652ebb861d52", 0x89}, {&(0x7f0000000080)="d8360504525cb0a496bf91319bdaeb65e1852c232a91cfeabd6ad21112a5ab3403e5fd190523af1c1fd250e0ef756c7216fcfcf2", 0x34}, {&(0x7f0000000240)="ff6d4eb6cd803847db353ce6e731c2d4e448bd5044329caf47f914826cf89a48b8ace53f63226e9b4906947124775fc7ac89513f7b9c7f745caa22d0dcb167421ccda09769", 0x45}, {&(0x7f00000002c0)="0b07a2cbdcfe2d24b1f851327ed72ea725bfc9e9d615b2c1cada3846f27b86b3965c8a74182f91bbf0a9430f3ad7dc1e3980f18b0db9748f4179937a237b7151604839d04bcf87b1b47a57fd498601293bf591c2a182193f9b12d1b935b3629d6dcaf10808827d803f0be6c42563e8643cba3d8f27696cef3643a40bc99cab2f1cc47a440b1b660f60a7e7cf6c6cab15f5cb599c7c86fc9c76ca036cbf89bf6a7e3e5f4ae028d356b83101de94cc0928abf615388ec33a8f914cf368d26a1472317f445ac9b75d0ef81c42a9f75c35d94aae7cb43db6c745d4f9f52a791849dfbb5f5bd5c9090c1f5485500510d8764037938bfa4d8a3884b40650e6", 0xfc}, {&(0x7f00000003c0)="82875be770227fff62bade034837a68abd1e1ad3ef724fd74c43f098d39ecd3b66f2f2e9204e1f2e637cd13063289d9ef9d5526552fc8b64a78e46a3ff2625f6868bb96c", 0x44}, {&(0x7f0000000440)="1e84c8e5f2cfb97f7686c2df37c23e9f735813f7c93e5dc03dbb12c9cd57e090fd7d88e03e8ce069e550a580a525a9443b0abfe50fa8baffc05f9839b1fbf3b37f4abfd7d1f886f9f6e1b717d41b4e0ed9aea6f537a2638a0bc88fcbf4fe59d2f7d3bfa31579df21d7cfb212105d302ec577563fae857af903bc2b3f44147165eb08b2968b0d80baec52c9f2aa9c15272ac23cb3a260fb868a69b281b4800699666bdc938b27c6", 0xa7}], 0x7) prctl$getreaper(0x13, &(0x7f0000000000)) [ 471.440312] binder: 30881:30898 unknown command 1863082766 [ 471.451569] binder: BINDER_SET_CONTEXT_MGR already set [ 471.462644] binder: 30895:30904 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 471.481413] binder: 30881:30908 Release 1 refcount change on invalid ref 0 ret -22 [ 471.498080] binder: 30881:30898 ioctl c0306201 20008fd0 returned -22 [ 471.507179] binder: 30895:30896 ioctl 40046207 0 returned -16 [ 471.524995] binder: 30881:30898 Acquire 1 refcount change on invalid ref 0 ret -22 [ 471.533896] binder: 30881:30886 unknown command 1863082766 [ 471.539797] binder: 30881:30886 ioctl c0306201 20008fd0 returned -22 [ 471.546364] binder: 30881:30898 Release 1 refcount change on invalid ref 0 ret -22 18:20:03 executing program 5: r0 = syz_open_dev$binder(&(0x7f00000002c0)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000300)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, &(0x7f0000012fc7)}) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000000c0)={0x8, 0x0, &(0x7f0000000040)=[@increfs], 0x0, 0x0, &(0x7f0000000140)}) dup2(r1, r1) 18:20:03 executing program 2: r0 = syz_open_dev$binder(&(0x7f00000002c0)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000300)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, &(0x7f0000012fc7)}) r2 = openat$selinux_mls(0xffffffffffffff9c, &(0x7f0000000b40)='/selinux/mls\x00', 0x0, 0x0) setsockopt$netlink_NETLINK_RX_RING(r2, 0x10e, 0x6, &(0x7f0000000b80)={0x1ff, 0x4, 0x2, 0x7}, 0x10) setsockopt$inet_tcp_TCP_MD5SIG(r2, 0x6, 0xe, &(0x7f0000000180)={@in6={{0xa, 0x4e22, 0xffffffffffffe3eb, @empty, 0x81}}, 0x7, 0x2, 0x400, "7bcda4f8eedcf97a78c8fc27a8093e2b942b391b0b98481019dda9a7616c09edac4729b219b4da9314ec619d135bba820051d651e9ffe612c75d3d5eb26f97a8e9e86cb0e732f18338447cd8fa09d4c7"}, 0xd8) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000000c0)={0x8, 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="04630440000000008d272c92c240035c18117f352dac812d8e6d9600fe440cbace5d8583194352fe79c546858a232708000000000000001eb81c4375a110f173de662e65ca900284"], 0x0, 0x0, &(0x7f0000000140)}) 18:20:03 executing program 0: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) socketpair$inet6_udplite(0xa, 0x2, 0x88, &(0x7f0000000000)) r1 = add_key$keyring(&(0x7f00000000c0)='keyring\x00', &(0x7f0000000100)={'syz', 0x0}, 0x0, 0x0, 0x0) add_key$keyring(&(0x7f00000001c0)='keyring\x00', &(0x7f0000000080)={'syz', 0x1}, 0x0, 0x0, r1) r2 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ppp\x00', 0x800000042400, 0x0) getpeername$packet(r2, &(0x7f0000000140)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @random}, &(0x7f0000000240)=0xfffffffffffffcbc) 18:20:03 executing program 4: r0 = syz_open_dev$binder(&(0x7f00000002c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x1) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000300)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, &(0x7f0000012fc7)}) poll(&(0x7f0000000040)=[{r1, 0x5230}, {r1, 0x5}, {r1}, {r0, 0x8}], 0x4, 0xb9) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, &(0x7f0000000f4d)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000000c0)={0x8, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0500000000000000c3a3f869236da121ae05af5cf13ddf4e2780d89a"], 0x0, 0x0, &(0x7f0000000340)}) 18:20:03 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000300)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, &(0x7f0000012fc7)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=ANY=[@ANYPTR], 0x0, 0x0, &(0x7f0000000f4d)}) r1 = openat$selinux_mls(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/mls\x00', 0x0, 0x0) write$P9_RLOCK(r1, &(0x7f0000000040)={0x8, 0x35, 0x1}, 0x8) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x8, 0x0, &(0x7f0000000140)=[@release], 0x0, 0x0, &(0x7f0000000340)}) 18:20:03 executing program 3: r0 = request_key(&(0x7f0000000000)='rxrpc\x00', &(0x7f0000000040)={'syz', 0x0}, &(0x7f0000000080)='user\x00', 0xffffffffffffffff) add_key(&(0x7f00000000c0)='user\x00', &(0x7f0000000100)={'syz'}, &(0x7f0000000200)="82", 0x1, r0) 18:20:03 executing program 3: r0 = add_key(&(0x7f0000000000)='encrypted\x00', &(0x7f0000000040)={'syz', 0x1}, &(0x7f0000000240)="d00894d0c970ee66f35a01ba203424bc940140dc063a7c826007745618e968e610611194859739e80069c48aca5b531031e0861f9ba59a5331ad8a49826ce93a51697c5bc0777b828e64ab14c06bc42450652948168b67627adcb2a36c9251c758c0273007671d7cad30f4bd553aff2cb403f4497f971ef9df8ac4bfb46842c1c35252f473f84a5729f0e720ebd6bf8e28fef3812964b447bd208e9581721192e6915d4b2c41be4599a31a19e0adaf04823d04d4e8625d407668cf6c7dde54214c56a254a92cea08174436b6b87b378b6a23830fcca79b80350c1d31070236dd36e0004ab086be82ec208b6ca8d3b19128de9dec2d21de2fa05a5420683a00", 0xff, 0xfffffffffffffffc) r1 = add_key(&(0x7f0000000180)='cifs.spnego\x00', &(0x7f00000001c0)={'syz', 0x0}, 0x0, 0x0, 0xfffffffffffffffd) keyctl$search(0xa, r0, &(0x7f0000000080)='dns_resolver\x00', &(0x7f0000000140)={'syz', 0x2}, r1) add_key(&(0x7f0000000340)='trusted\x00', &(0x7f0000000100)={'syz'}, &(0x7f00000003c0)="82", 0x1, r0) 18:20:03 executing program 2: r0 = syz_open_dev$binder(&(0x7f00000002c0)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000300)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, &(0x7f0000012fc7)}) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000000c0)={0x8, 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="000000000000000285ddbd3df9ca01453242f126804294c9bf919c92e77fbd22bfb3ca69cbb133ef89e0a68a4bc6599e1d6724ff6f7085fb4bbacb4a3d05ab6637b16ef65d6a25d70f65d2ff05980d0f56b6e2bb80fcba15f54c04ebf68ea740209b885c8be01fe72b87e99f20227b4c99fe256b332c7e2c350bfc4d7f4772ee948cf6cc3295a2a4fb209510aa8d140973a28fdf9fac1d2e9eeb9bff469b7d02dda86a3080168177fbb76f755999fd69dfa86a4c83a8c5ae65512398"], 0x0, 0x0, &(0x7f0000000140)}) 18:20:04 executing program 5: socketpair$unix(0x1, 0x4, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = openat$full(0xffffffffffffff9c, &(0x7f0000000240)='/dev/full\x00', 0x80, 0x0) getsockopt$inet_IP_IPSEC_POLICY(0xffffffffffffff9c, 0x0, 0x10, &(0x7f0000000340)={{{@in6=@local, @in=@local, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@dev}, 0x0, @in6=@loopback}}, &(0x7f0000000440)=0xe8) connect$packet(r1, &(0x7f0000000480)={0x11, 0x8, r2, 0x1, 0x9}, 0x14) socketpair(0x1f, 0x0, 0x1000, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$BLKPBSZGET(r3, 0x127b, &(0x7f0000000040)) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) request_key(&(0x7f0000000080)='ceph\x00', &(0x7f00000000c0)={'syz', 0x3}, &(0x7f0000000100)='ppp0trustedem0-\x00', 0xfffffffffffffffd) add_key$keyring(&(0x7f00000001c0)='keyring\x00', &(0x7f0000000280)={'syz', 0x1}, 0x0, 0x0, 0xfffffffffffffff9) r4 = add_key$keyring(&(0x7f00000002c0)='keyring\x00', &(0x7f0000000300)={'syz', 0x0}, 0x0, 0x0, 0xfffffffffffffffd) r5 = getpid() wait4(r5, &(0x7f00000004c0), 0x8, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r6, 0x8912, 0x400200) r7 = socket$inet6(0xa, 0x1, 0x0) getsockopt$inet6_int(r7, 0x29, 0x43, &(0x7f0000534000), &(0x7f0000000080)=0x3) add_key$keyring(&(0x7f0000000200)='keyring\x00', &(0x7f0000000140)={'syz'}, 0x0, 0x0, r4) 18:20:04 executing program 0: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = getpid() ptrace$pokeuser(0x6, r2, 0x100, 0x2) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) fcntl$getownex(r0, 0x10, &(0x7f0000000000)={0x0, 0x0}) r4 = openat$selinux_avc_cache_stats(0xffffffffffffff9c, &(0x7f0000000040)='/selinux/avc/cache_stats\x00', 0x0, 0x0) pipe(&(0x7f00000000c0)={0xffffffffffffffff}) renameat2(r4, &(0x7f0000000080)='./file0\x00', r5, &(0x7f0000000100)='./file0\x00', 0x2) ptrace$pokeuser(0x6, r3, 0xd9b, 0x10000) add_key$keyring(&(0x7f0000000200)='keyring\x00', &(0x7f0000000240)={'syz'}, 0x0, 0x0, 0xfffffffffffffffb) 18:20:04 executing program 3: r0 = add_key$keyring(&(0x7f0000000040)='keyring\x00', &(0x7f0000000080)={'syz', 0x0}, 0x0, 0x0, 0x0) r1 = openat$full(0xffffffffffffff9c, &(0x7f0000000100)='/dev/full\x00', 0x0, 0x0) close(r1) r2 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ptmx\x00', 0x0, 0x0) read(r2, &(0x7f0000000300)=""/11, 0xb) ioctl$TIOCSETD(r2, 0x5423, &(0x7f0000000180)) openat$selinux_status(0xffffffffffffff9c, &(0x7f0000000340)='/selinux/status\x00', 0x0, 0x0) clone(0x3102001ffe, 0x0, 0xfffffffffffffffe, &(0x7f0000000140), 0xffffffffffffffff) ioctl$TIOCSCTTY(r1, 0x540e, 0x0) add_key(&(0x7f0000000180)='trusted\x00', &(0x7f00000001c0)={'syz', 0x1}, &(0x7f0000000240)="60f3ce1283f149b9e28e7257021b6f761ea9b34c5aca66d2ec0aa6b5220b74ea7f0d3761b325bf5e2ed285f23c50416620c7108a786e267ef09973241d3db5129264c63fc9c35e1bb76fea91e5bfd3a8c2f6792863c21ffc2814f91e4f284da00da120eb5f84c4922ade81a1c6e799d76f2b4b2a0a7603fed6f5804b59e06c88557194fd7dbc9b6d4a08d1d66318e531de096fe56ec6855343b3622ba470e4883deb70e079", 0xa5, r0) add_key(&(0x7f0000000000)='user\x00', &(0x7f0000000100)={'syz', 0x0}, &(0x7f0000000200)="82", 0x1, r0) r3 = openat$uhid(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/uhid\x00', 0x2, 0x0) write$UHID_DESTROY(r3, &(0x7f0000000140), 0x4) [ 471.900540] binder: 30920:30927 unknown command 0 [ 471.915358] binder: 30920:30927 ioctl c0306201 20008fd0 returned -22 [ 471.936155] binder: 30919:30939 unknown command 5 [ 471.941768] binder: 30919:30939 ioctl c0306201 200000c0 returned -22 [ 471.962193] binder: 30936:30943 Acquire 1 refcount change on invalid ref 0 ret -22 [ 471.984972] binder: 30936:30938 unknown command 0 [ 471.990776] binder: 30936:30938 ioctl c0306201 200000c0 returned -22 [ 471.997541] binder: 30920:30940 unknown command 0 [ 472.002905] binder: 30920:30940 ioctl c0306201 20008fd0 returned -22 18:20:04 executing program 0: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) add_key$keyring(&(0x7f0000000200)='keyring\x00', &(0x7f0000000000)={'syz'}, 0x0, 0x0, 0xfffffffffffffffb) r2 = fcntl$dupfd(r1, 0x0, r0) getsockopt$IPT_SO_GET_INFO(r2, 0x0, 0x40, &(0x7f0000000040)={'nat\x00'}, &(0x7f00000000c0)=0x54) 18:20:04 executing program 5: r0 = add_key(&(0x7f0000000000)='encrypted\x00', &(0x7f0000000040)={'syz', 0x1}, &(0x7f0000000240)="d00894d0c970ee66f35a01ba203424bc940140dc063a7c826007745618e968e610611194859739e80069c48aca5b531031e0861f9ba59a5331ad8a49826ce93a51697c5bc0777b828e64ab14c06bc42450652948168b67627adcb2a36c9251c758c0273007671d7cad30f4bd553aff2cb403f4497f971ef9df8ac4bfb46842c1c35252f473f84a5729f0e720ebd6bf8e28fef3812964b447bd208e9581721192e6915d4b2c41be4599a31a19e0adaf04823d04d4e8625d407668cf6c7dde54214c56a254a92cea08174436b6b87b378b6a23830fcca79b80350c1d31070236dd36e0004ab086be82ec208b6ca8d3b19128de9dec2d21de2fa05a5420683a00", 0xff, 0xfffffffffffffffc) r1 = add_key(&(0x7f0000000180)='cifs.spnego\x00', &(0x7f00000001c0)={'syz', 0x0}, 0x0, 0x0, 0xfffffffffffffffd) keyctl$search(0xa, r0, &(0x7f0000000080)='dns_resolver\x00', &(0x7f0000000140)={'syz', 0x2}, r1) add_key(&(0x7f0000000340)='trusted\x00', &(0x7f0000000100)={'syz'}, &(0x7f00000003c0)="82", 0x1, r0) 18:20:04 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000300)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, &(0x7f0000012fc7)}) r1 = openat$selinux_avc_hash_stats(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/avc/hash_stats\x00', 0x0, 0x0) ioctl$TIOCSCTTY(r1, 0x540e, 0x4) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, &(0x7f0000000f4d)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x8, 0x0, &(0x7f0000000140)=[@release], 0x0, 0x0, &(0x7f0000000340)}) [ 472.024623] binder: 30936:30943 Acquire 1 refcount change on invalid ref 0 ret -22 [ 472.060940] binder: BINDER_SET_CONTEXT_MGR already set [ 472.065637] binder: 30919:30960 unknown command 5 18:20:04 executing program 2: r0 = syz_open_dev$binder(&(0x7f00000002c0)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000300)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, &(0x7f0000012fc7)}) close(r0) r2 = getuid() ioprio_get$uid(0x3, r2) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000000c0)={0x8, 0x0, &(0x7f0000000040)=[@increfs], 0x0, 0x0, &(0x7f0000000140)}) 18:20:04 executing program 4: r0 = syz_open_dev$binder(&(0x7f00000002c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = mmap$binder(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x2000008, 0x102130, r0, 0x0) r2 = mmap$binder(&(0x7f0000ff7000/0x4000)=nil, 0x4000, 0x1000004, 0x81010, r0, 0x0) r3 = mmap$binder(&(0x7f0000ff8000/0x2000)=nil, 0x2000, 0x2, 0x1833, r0, 0x0) r4 = openat(0xffffffffffffffff, &(0x7f0000000640)='./file0\x00', 0x400, 0x2) write$FUSE_STATFS(r4, &(0x7f0000000680)={0x60, 0x0, 0x6, {{0x2, 0xfffffffffffffe01, 0x2, 0x5, 0x1, 0x0, 0x856, 0x7}}}, 0x60) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000600)={0xc8, 0x0, &(0x7f0000000480)=[@enter_looper, @acquire_done={0x40106309, r1}, @transaction={0x40406300, {0x4, 0x0, 0x4, 0x0, 0x11, 0x0, 0x0, 0x68, 0x10, &(0x7f0000000240)=[@ptr={0x70742a85, 0x0, &(0x7f00000001c0), 0x1, 0x4, 0x33}, @ptr={0x70742a85, 0x0, &(0x7f0000000200), 0x1, 0x3, 0x1b}, @flat={0x77622a85, 0x100, r2, 0x2}], &(0x7f0000000340)=[0x38, 0x0]}}, @decrefs={0x40046307, 0x3}, @reply_sg={0x40486312, {{0x1, 0x0, 0x3, 0x0, 0x11, 0x0, 0x0, 0x48, 0x10, &(0x7f00000003c0)=[@fda={0x66646185, 0x1, 0x4, 0x29}, @ptr={0x70742a85, 0x0, &(0x7f0000000380), 0x1, 0x4, 0x1}], &(0x7f0000000440)=[0x18, 0x18]}, 0x6}}, @decrefs={0x40046307, 0x1}, @exit_looper, @free_buffer={0x40086303, r3}], 0x75, 0x0, &(0x7f0000000580)="e8872cc8321aa65179139d5f8c056a3d4c44cb5bbb4870b6a8bbfbe4de26b253c17703a6b0fe08cd3fe3d249fcace2512e5ed24bac357438706000ee6c81eca7bfae3e30670d18bee5c67e8779fedd9d239f4c3a9d0ee5eb1dd649f4441fbd0e85e27c6c36fe40073580071c9c3be328a5f9b2eff3"}) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r5 = syz_open_dev$binder(&(0x7f0000000300)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, &(0x7f0000012fc7)}) ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, &(0x7f0000000f4d)}) r6 = openat$selinux_policy(0xffffffffffffff9c, &(0x7f0000000100)='/selinux/policy\x00', 0x0, 0x0) ioctl$SNDRV_TIMER_IOCTL_STATUS(r6, 0x80605414, &(0x7f0000000180)=""/51) ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f00000000c0)={0x8, 0x0, &(0x7f0000000140)=[@release], 0x0, 0x0, &(0x7f00000001c0)}) r7 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/enforce\x00', 0x80, 0x0) sendfile(r5, r0, &(0x7f0000000080), 0x7fff) write$P9_RMKDIR(r7, &(0x7f0000000040)={0x14, 0x49, 0x1}, 0x14) 18:20:04 executing program 5: lsetxattr$trusted_overlay_redirect(&(0x7f0000000000)='./file0\x00', &(0x7f0000000040)='trusted.overlay.redirect\x00', &(0x7f0000000080)='./file0\x00', 0x8, 0x3) request_key(&(0x7f0000000240)='keyring\x00', &(0x7f0000000280)={'syz', 0x0}, &(0x7f00000002c0)='vboxnet1\x00', 0xfffffffffffffffe) 18:20:04 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000300)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000005fd4)=ANY=[@ANYBLOB="0002000000000000"], 0x34d}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, &(0x7f0000000f4d)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x8, 0x0, &(0x7f0000000140)=[@release], 0x0, 0x0, &(0x7f0000000340)}) r1 = mmap$binder(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x2000004, 0x3013, r0, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, &(0x7f0000000200)={0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000004c0)={0x150, 0x0, &(0x7f0000000340)=[@increfs_done={0x40106308, r1, 0x1}, @reply={0x40406301, {0x4, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x20, 0x38, &(0x7f0000000000)=[@fda={0x66646185, 0x0, 0x2, 0x21}], &(0x7f0000000040)=[0x40, 0x30, 0x40, 0x78, 0x0, 0x48, 0x20]}}, @transaction={0x40406300, {0x2, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x28, &(0x7f0000000080), &(0x7f0000000100)=[0x78, 0x18, 0x28, 0x78, 0x40]}}, @reply_sg={0x40486312, {{0x4, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x20, 0x30, &(0x7f0000000180)=[@fda={0x66646185, 0x4, 0x0, 0x23}], &(0x7f00000001c0)=[0x0, 0x40, 0x70, 0x48, 0x28, 0x38]}, 0xb12}}, @increfs_done={0x40106308, r2}, @reply_sg={0x40486312, {{0x2, 0x0, 0x4, 0x0, 0x10, 0x0, 0x0, 0x40, 0x18, &(0x7f0000000240)=[@fda={0x66646185, 0x1, 0x3, 0x1d}, @fda={0x66646185, 0x1, 0x1, 0x39}], &(0x7f0000000280)=[0x68, 0x0, 0x18]}, 0x7}}, @release], 0x4, 0x0, &(0x7f00000002c0)="e77e3993"}) 18:20:04 executing program 0: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) add_key$keyring(&(0x7f0000000200)='keyring\x00', &(0x7f0000000240)={'syz'}, 0x0, 0x0, 0xfffffffffffffffb) r1 = syz_open_dev$sndtimer(&(0x7f0000000000)='/dev/snd/timer\x00', 0x0, 0x40000) ioctl$SNDRV_TIMER_IOCTL_PVERSION(r1, 0x80045400, &(0x7f0000000040)) [ 472.065647] binder: 30919:30960 ioctl c0306201 200000c0 returned -22 [ 472.094713] binder: 30919:30922 ioctl 40046207 0 returned -16 [ 472.140757] binder: BINDER_SET_CONTEXT_MGR already set [ 472.150850] binder: 30967:30972 ioctl 40046207 0 returned -16 [ 472.156922] binder: 30967:30974 Acquire 1 refcount change on invalid ref 0 ret -22 [ 472.176187] binder: 30982:30984 unknown command 512 [ 472.179226] binder: 30973:30979 BC_ACQUIRE_DONE u0000000000000000 no match 18:20:04 executing program 2: r0 = syz_open_dev$binder(&(0x7f00000002c0)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/enforce\x00', 0x488000, 0x0) ioctl$sock_inet_SIOCADDRT(r1, 0x890b, &(0x7f0000000100)={0x100000001, {0x2, 0x4e21, @remote}, {0x2, 0x4e22}, {0x2, 0x4e23, @rand_addr=0xeac}, 0x20, 0x6, 0x400, 0x8, 0x401, &(0x7f0000000080)='bridge_slave_1\x00', 0x7, 0x8, 0x5}) r2 = syz_open_dev$binder(&(0x7f0000000300)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, &(0x7f0000012fc7)}) close(r0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000000c0)={0x8, 0x0, &(0x7f0000000040)=[@increfs], 0x0, 0x0, &(0x7f0000000140)}) 18:20:04 executing program 5: memfd_create(&(0x7f0000000140)=',\x00', 0x4) request_key(&(0x7f0000000000)='keyring\x00', &(0x7f0000000040)={'syz', 0x3}, &(0x7f0000000080)='vboxnet1\x00', 0x0) r0 = memfd_create(&(0x7f00000000c0)='keyring\x00', 0x4) getsockopt$IP6T_SO_GET_ENTRIES(r0, 0x29, 0x41, &(0x7f0000000140)=ANY=[], &(0x7f0000000240)) ioctl$IOC_PR_RESERVE(r0, 0x401070c9, &(0x7f0000000100)={0x8, 0xe191, 0x1}) [ 472.179235] binder: 30973:30979 got transaction to invalid handle [ 472.179244] binder: 30973:30979 transaction failed 29201/-22, size 104-16 line 3014 [ 472.179451] binder: BINDER_SET_CONTEXT_MGR already set [ 472.179459] binder: 30973:30979 ioctl 40046207 0 returned -16 [ 472.228907] binder: 30982:30986 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 18:20:04 executing program 0: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = add_key(&(0x7f0000000000)='.request_key_auth\x00', &(0x7f0000000040)={'syz', 0x2}, &(0x7f0000000080)="48d18f60f3e26892e84f2917a017e8e78682788bf2ba430e774a7ea9be2c752bf13c1c2044c722947021f4e6fefcbb729b0606f5", 0x34, 0xfffffffffffffffd) add_key$keyring(&(0x7f0000000100)='keyring\x00', &(0x7f00000001c0)={'syz', 0x2}, 0x0, 0x0, r1) [ 472.245145] binder: 30982:30986 Release 1 refcount change on invalid ref 0 ret -22 [ 472.263219] binder: 30973:30987 BC_ACQUIRE_DONE u0000000000000000 no match [ 472.276974] binder: 30973:30987 got transaction to invalid handle [ 472.284495] binder: 30982:30986 BC_INCREFS_DONE u0000000000000000 no match [ 472.296174] binder: 30973:30987 transaction failed 29201/-22, size 104-16 line 3014 [ 472.312153] binder: 30982:30986 got reply transaction with no transaction stack [ 472.322278] binder: 30982:30986 transaction failed 29201/-71, size 32-56 line 2922 [ 472.334971] binder: 30982:30984 ioctl c0306201 20012000 returned -22 [ 472.360055] binder: 30982:30986 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 472.367292] binder: 30982:30984 unknown command 512 [ 472.373399] binder: 30982:30986 Release 1 refcount change on invalid ref 0 ret -22 [ 472.376028] binder: 30982:31005 BC_INCREFS_DONE u0000000000000000 no match [ 472.376039] binder: 30982:31005 got reply transaction with no transaction stack [ 472.376048] binder: 30982:31005 transaction failed 29201/-71, size 32-56 line 2922 [ 472.376300] binder: undelivered TRANSACTION_ERROR: 29201 [ 472.376546] binder: 30982:30984 ioctl c0306201 20012000 returned -22 [ 472.416885] binder: undelivered TRANSACTION_ERROR: 29201 18:20:04 executing program 3: io_setup(0x63, &(0x7f00000000c0)=0x0) r1 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000100)='/dev/uinput\x00', 0x2, 0x0) r2 = dup2(0xffffffffffffffff, 0xffffffffffffff9c) ioctl$ION_IOC_ALLOC(0xffffffffffffff9c, 0xc0184900, &(0x7f0000001300)={0x3, 0x8, 0x1, 0xffffffffffffff9c}) r4 = openat$selinux_create(0xffffffffffffff9c, &(0x7f0000001400)='/selinux/create\x00', 0x2, 0x0) socketpair$inet6_udplite(0xa, 0x2, 0x88, &(0x7f00000015c0)) io_submit(r0, 0x3, &(0x7f0000001580)=[&(0x7f00000012c0)={0x0, 0x0, 0x0, 0x2, 0xb5, r1, &(0x7f00000011c0)="779ec009c950573d96dc364f0d3e732310e283f06d0d71e275749084837f37ae3a52dba8c89aa3c32ee5007845485a9a5525a4d38e3f94bbfd1efe5e486b73dfdb6556f2a2a2813ee7182a62bdeb674b12c32198f83792070c4a5a832053dc7423ef4b4d1f2c4bd9c08be91591bd87de9786222aceef14ae165e694a71cc45d5ab4b7a437155723e51eba5d9748f0904804e9cce91542fa696326e81479a8ff4cd3f54ae389e09d8faf8180fb58a368d8c6277cc7aeafa04dce3ae4ccb43c419b0efa1b5214676e12c999e841af71a7c984f8792cacb9d8229839cfe4a9cb25e3951796f28c59704dd8d5ccd810bd7340fba8e1cc9b70d3d", 0xf8, 0x5, 0x0, 0x1, r2}, &(0x7f00000013c0)={0x0, 0x0, 0x0, 0x7, 0x401, r3, &(0x7f0000001340)="707650a4cd021dff9fc4f181f745ded17eeb22cb05c65d5217ac46d7e0edbac375fa4adb759b55eedc084deb176c64a0895787ada0a62f98462dcba98956a54619c464556c1430b7c348e60adaae05e2a41b4d98b58f942edd72757a21b95c5e2b947ef43d39ea7d", 0x68, 0x401, 0x0, 0xb972f62d41eeb0c2, 0xffffffffffffff9c}, &(0x7f0000001540)={0x0, 0x0, 0x0, 0x5, 0x80, r4, &(0x7f0000001440)="144ffdf7ef0535d6906df8ebcd3d0fe778c07750f9549c19273196217fbf902ce5a8b2ece1377c23bfec7dd8c57e3aac1675733fcd6abb5b250b4c09e16ce28f8819b665b1230d4d89251db38cf642264818a35455d863b32916a47c4add03161f252801a6b0315149d32ac213a9d07f5ba5b9ecdfa59fd2b7a0fd00dedf7fa88c3a5361639594ed2eae78e2791f63e7bab5ae1c03fd7589ef26d328596723f0f064f9e3a2f45cb33a13bb54a4c5f39384b93f9df856e087b06cdb771bae18120ebabd4f2c088e53", 0xc8, 0x80000000, 0x0, 0x1, 0xffffffffffffff9c}]) r5 = add_key$keyring(&(0x7f0000000000)='keyring\x00', &(0x7f0000000040)={'syz', 0x1}, 0x0, 0x0, 0xfffffffffffffff9) keyctl$read(0xb, r5, &(0x7f00000001c0)=""/4096, 0x1000) keyctl$setperm(0x5, r5, 0x200) add_key(&(0x7f0000000080)='.request_key_auth\x00', &(0x7f0000000140)={'syz', 0x3}, &(0x7f0000000180)='\x00', 0x1, 0xfffffffffffffffb) 18:20:04 executing program 5: r0 = request_key(&(0x7f0000000240)='keyring\x00', &(0x7f0000000280)={'syz', 0x0}, &(0x7f00000002c0)='vboxnet1\x00', 0xfffffffffffffffe) request_key(&(0x7f0000000180)="636866732e13b5b569646d617000", &(0x7f00000001c0)={'syz', 0x3}, &(0x7f0000000140)='md5sumem1proc\x00', r0) 18:20:04 executing program 2: r0 = syz_open_dev$binder(&(0x7f00000002c0)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000300)='/dev/binder#\x00', 0x0, 0x0) r2 = openat$keychord(0xffffffffffffff9c, &(0x7f0000000000)='/dev/keychord\x00', 0x80000, 0x0) ioctl$KDMKTONE(r2, 0x4b30, 0x9) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, &(0x7f0000012fc7)}) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000000c0)={0x8, 0x0, &(0x7f0000000040)=[@increfs], 0x0, 0x0, &(0x7f0000000140)}) ioctl$FS_IOC_GET_ENCRYPTION_PWSALT(r1, 0x40106614, &(0x7f0000000080)={0x0, @speck128}) 18:20:04 executing program 0: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) add_key$keyring(&(0x7f0000000200)='keyring\x00', &(0x7f0000000240)={'syz'}, 0x0, 0x0, 0xfffffffffffffffb) getsockopt$IP_VS_SO_GET_SERVICE(r1, 0x0, 0x483, &(0x7f0000000000), &(0x7f0000000080)=0x68) getsockopt$IP_VS_SO_GET_DAEMON(r0, 0x0, 0x487, &(0x7f00000000c0), &(0x7f0000000100)=0x30) 18:20:04 executing program 4: r0 = syz_open_dev$binder(&(0x7f00000002c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) fdatasync(r0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000300)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000005fd4)=ANY=[@ANYBLOB="8344044000000000"], 0x0, 0x0, &(0x7f0000012fc7)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=ANY=[@ANYBLOB="0e630c404000cf0b"], 0x0, 0x0, &(0x7f0000000f4d)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000000)={0x8, 0x0, &(0x7f0000000140)=[@release], 0x0, 0x0, &(0x7f0000000340)}) 18:20:04 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000300)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, &(0x7f0000012fc7)}) r1 = dup3(r0, r0, 0x80000) write$eventfd(r1, &(0x7f0000000000)=0x1, 0x8) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, &(0x7f0000000f4d)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x8, 0x0, &(0x7f0000000140)=[@release], 0x0, 0x0, &(0x7f0000000340)}) 18:20:04 executing program 2: r0 = syz_open_dev$binder(&(0x7f00000002c0)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000300)='/dev/binder#\x00', 0x0, 0x0) r2 = accept(0xffffffffffffff9c, &(0x7f00000001c0)=@pppol2tpin6, &(0x7f0000000080)=0x80) r3 = syz_genetlink_get_family_id$fou(&(0x7f0000000280)='fou\x00') sendmsg$FOU_CMD_ADD(r2, &(0x7f00000003c0)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x8a800000}, 0xc, &(0x7f0000000380)={&(0x7f0000000340)={0x34, r3, 0x200, 0x70bd25, 0x25dfdbff, {}, [@FOU_ATTR_TYPE={0x8, 0x4, 0x3}, @FOU_ATTR_AF={0x8, 0x2, 0xa}, @FOU_ATTR_PORT={0x8, 0x1, 0x4e20}, @FOU_ATTR_AF={0x8, 0x2, 0x2}]}, 0x34}, 0x1, 0x0, 0x0, 0x40}, 0x1) r4 = openat$selinux_avc_cache_stats(0xffffffffffffff9c, &(0x7f0000000400)='/selinux/avc/cache_stats\x00', 0x0, 0x0) ioctl$TIOCLINUX3(r4, 0x541c, &(0x7f0000000440)) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, &(0x7f0000012fc7)}) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000000c0)={0x8, 0x0, &(0x7f0000000040)=[@increfs], 0x0, 0x0, &(0x7f0000000140)}) r5 = openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/commit_pending_bools\x00', 0x1, 0x0) ioctl$EVIOCGSND(r5, 0x8040451a, &(0x7f0000000100)=""/187) 18:20:04 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000300)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, &(0x7f0000012fc7)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x8, 0x0, &(0x7f0000000040)=[@release={0x400c630e}], 0x0, 0x0, &(0x7f0000000f4d)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x8, 0x0, &(0x7f0000000140)=[@release], 0x0, 0x0, &(0x7f0000000340)}) [ 472.858939] binder: 31013:31018 unknown command 1074021507 [ 472.860048] binder: 31017:31021 ioctl 40106614 20000080 returned -22 [ 472.860703] binder: BINDER_SET_CONTEXT_MGR already set [ 472.860711] binder: 31017:31021 ioctl 40046207 0 returned -16 [ 472.862864] binder: 31017:31026 ioctl 40106614 20000080 returned -22 18:20:05 executing program 5: request_key(&(0x7f0000000000)='keyring\x00', &(0x7f0000000280)={'syz', 0x0}, &(0x7f00000002c0)='vboxnet1\x00', 0xfffffffffffffffe) 18:20:05 executing program 0: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180)) r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x101480, 0x100) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x401) add_key$keyring(&(0x7f0000000200)='keyring\x00', &(0x7f0000000240)={'syz'}, 0x0, 0x0, 0xfffffffffffffffb) [ 472.904508] binder: 31013:31018 ioctl c0306201 20012000 returned -22 [ 472.912138] binder: 31013:31031 BC_REQUEST_DEATH_NOTIFICATION invalid ref 198115392 [ 472.926796] binder: 31013:31018 Release 1 refcount change on invalid ref 0 ret -22 [ 472.952712] binder: BINDER_SET_CONTEXT_MGR already set 18:20:05 executing program 3: keyctl$set_reqkey_keyring(0xe, 0x1) add_key(&(0x7f00000000c0)='user\x00', &(0x7f0000000100)={'syz'}, &(0x7f0000000200)="82", 0x1, 0xfffffffffffffffb) r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/raw\x00') clock_gettime(0x1, &(0x7f0000000080)) ioctl$EVIOCRMFF(r0, 0x40044581, &(0x7f0000000040)=0x401) 18:20:05 executing program 5: request_key(&(0x7f0000000240)='keyring\x00', &(0x7f0000000280)={'syz', 0x0}, &(0x7f00000002c0)='vboxnet1\x00', 0xfffffffffffffffe) r0 = accept4$packet(0xffffffffffffffff, &(0x7f0000003240)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000003280)=0x14, 0x80800) r1 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/enforce\x00', 0x40, 0x0) ioctl$RTC_VL_READ(r1, 0x80047013, &(0x7f0000000040)) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f00000032c0)='lo\x00', 0x10) 18:20:05 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000300)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) openat$smack_thread_current(0xffffffffffffff9c, &(0x7f0000000080)='/proc/thread-self/attr/current\x00', 0x2, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, &(0x7f0000012fc7)}) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000000)='memory.current\x00', 0x0, 0x0) openat$cgroup_ro(r1, &(0x7f0000000040)='cgroup.controllers\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=ANY=[@ANYBLOB="0e45fbfd9e000000"], 0x0, 0x0, &(0x7f0000000f4d)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x8, 0x0, &(0x7f0000000140)=[@release], 0x0, 0x0, &(0x7f0000000340)}) 18:20:05 executing program 0: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180)={0xffffffffffffffff}) r1 = creat(&(0x7f0000000040)='.\x00', 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x2) ioctl$FS_IOC_GETFLAGS(r0, 0x80086601, &(0x7f0000000000)) ioctl$GIO_UNIMAP(r1, 0x4b66, &(0x7f00000000c0)={0x7, &(0x7f0000000080)=[{}, {}, {}, {}, {}, {}, {}]}) add_key$keyring(&(0x7f0000000200)='keyring\x00', &(0x7f0000000240)={'syz'}, 0x0, 0x0, 0xfffffffffffffffb) [ 472.959008] binder: 31013:31031 ioctl 40046207 0 returned -16 [ 472.992233] binder: 31013:31031 unknown command 1074021507 18:20:05 executing program 5: request_key(&(0x7f0000000240)='keyring\x00', &(0x7f0000000280)={'syz', 0x0}, &(0x7f00000002c0)='vboxnet1\x00', 0xfffffffffffffffe) getxattr(&(0x7f0000000000)='./file0\x00', &(0x7f0000000040)=@known='user.syz\x00', &(0x7f0000000080)=""/96, 0x60) 18:20:05 executing program 3: add_key(&(0x7f00000000c0)='user\x00', &(0x7f0000000100)={'syz'}, &(0x7f0000000200)="82", 0x1, 0xfffffffffffffffb) r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x6800, 0x9) ioctl$GIO_UNIMAP(r0, 0x4b66, &(0x7f0000000080)={0xa, &(0x7f0000000040)=[{}, {}, {}, {}, {}, {}, {}, {}, {}, {}]}) r1 = geteuid() stat(&(0x7f0000000240)='./file0\x00', &(0x7f0000000280)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) fstat(r0, &(0x7f0000000300)={0x0, 0x0, 0x0, 0x0, 0x0}) r4 = getuid() getsockopt$inet6_IPV6_XFRM_POLICY(r0, 0x29, 0x23, &(0x7f0000000380)={{{@in=@multicast1, @in=@rand_addr, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@remote}, 0x0, @in=@local}}, &(0x7f0000000480)=0xe8) getresuid(&(0x7f00000004c0)=0x0, &(0x7f0000000500), &(0x7f0000000540)) mount$fuseblk(&(0x7f0000000140)='/dev/loop0\x00', &(0x7f0000000180)='./file0\x00', &(0x7f00000001c0)='fuseblk\x00', 0x10000, &(0x7f0000000580)={{'fd', 0x3d, r0}, 0x2c, {'rootmode', 0x3d, 0x8000}, 0x2c, {'user_id', 0x3d, r1}, 0x2c, {'group_id', 0x3d, r2}, 0x2c, {[{@max_read={'max_read', 0x3d, 0x7}}, {@allow_other='allow_other'}, {@blksize={'blksize', 0x3d, 0x800}}, {@blksize={'blksize'}}, {@default_permissions='default_permissions'}, {@blksize={'blksize', 0x3d, 0x600}}, {@max_read={'max_read'}}, {@max_read={'max_read', 0x3d, 0x2}}, {@max_read={'max_read', 0x3d, 0x7ff}}, {@allow_other='allow_other'}], [{@fsname={'fsname', 0x3d, 'vmnet1'}}, {@pcr={'pcr', 0x3d, 0x33}}, {@obj_user={'obj_user', 0x3d, 'proc'}}, {@euid_eq={'euid', 0x3d, r3}}, {@fowner_gt={'fowner>', r4}}, {@uid_gt={'uid>', r5}}, {@defcontext={'defcontext', 0x3d, 'user_u'}}, {@subj_role={'subj_role', 0x3d, 'syz'}}, {@uid_lt={'uid<', r6}}, {@defcontext={'defcontext', 0x3d, 'unconfined_u'}}]}}) [ 473.027510] binder: 31013:31031 ioctl c0306201 20012000 returned -22 [ 473.037690] binder: 31013:31018 BC_REQUEST_DEATH_NOTIFICATION invalid ref 198115392 [ 473.046320] binder: 31013:31056 Release 1 refcount change on invalid ref 0 ret -22 18:20:05 executing program 4: r0 = syz_open_dev$binder(&(0x7f00000002c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000300)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, &(0x7f0000012fc7)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000040)={0xfffffffffffffef9, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, &(0x7f0000000340)="88f8d5d073dc65717aba068a7484a1e6bcc894eb2c2e853a40ea0ce9d0d67c4f5bc9ce631d4c51a270a6ff4183bbbb1fe535a70e7b6c135bcfd9c218aad1be94aee1f7857e744c346d4c588aed3718948e7768b543f421d77dda6342d578d47ee8bf7701ba2551bb519af1087ed33de04f640acca250120c8d15baee6c2df226e295115b8b4b9ef88a48e1f0ec05dddb27d1035506159b6e4bbd4f8ee7c6cf156b61c9d0e97f03192e6644ccf293d20022021d4a6822ffbca5344a23367ca9e00b9f3027b7b8decaa3c701c74cea543a4874222f5b5371ab0049dfd8cbae6f86a3f9595ae876fb67da93bd4da85e47ab266ac27463e916461880d18d97dd894ae1040a6d88cbb1622dd16f62e342444ca4791ad58b4d51bb97591aabeb9fe45bc0386e20174a79c065cca273d5934b46f578f3d76c5425cad10962903b66bae4a2c76c83b36a601123afe743f58a15250479b13497d00a95c29b81efe7694da56b269de0e45dbf9cbf086b45d9e25f4034165e3f1344d190d4c25e3e7d134416d000000000000000000000429d5fb0e26482e9fa823e60b8e7788a5d4e64e0cb09ed9658c73bcc3deb545923a46a6c159fe43bbea7859d4b92ca4c8eb60b5b353d53beeff7bd4f40832577c1a7e6de441c87"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000000c0)={0x8, 0x0, &(0x7f0000000140)=[@release], 0x0, 0x0, &(0x7f0000000340)}) 18:20:05 executing program 2: r0 = syz_open_dev$binder(&(0x7f00000002c0)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000300)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, &(0x7f0000012fc7)}) setxattr$security_smack_transmute(&(0x7f0000000180)='./file0\x00', &(0x7f00000001c0)='security.SMACK64TRANSMUTE\x00', &(0x7f0000000200)='TRUE', 0x4, 0x1) close(r0) socketpair$inet_tcp(0x2, 0x1, 0x0, &(0x7f0000000240)={0xffffffffffffffff}) setsockopt$ARPT_SO_SET_REPLACE(r2, 0x0, 0x60, &(0x7f0000000340)={'filter\x00', 0x7, 0x4, 0x438, 0x238, 0x118, 0x118, 0x350, 0x350, 0x350, 0x4, &(0x7f0000000280), {[{{@uncond, 0xf0, 0x118}, @unspec=@CONNSECMARK={0x28, 'CONNSECMARK\x00', 0x0, {0x2}}}, {{@arp={@broadcast, @empty, 0xff000000, 0x0, @empty, {[0xff, 0x0, 0xff, 0xff, 0xff, 0xff]}, @mac=@broadcast, {[0x0, 0x0, 0x0, 0xff, 0x0, 0xff]}, 0x6, 0x3, 0x80, 0x100000000, 0x4, 0x2, 'bridge_slave_1\x00', 'bond_slave_1\x00', {0xff}, {0xff}}, 0xf0, 0x120}, @unspec=@CONNMARK={0x30, 'CONNMARK\x00', 0x1, {0x1, 0x1, 0x8, 0x2}}}, {{@arp={@multicast2, @remote, 0xffffffff, 0xffffff00, @empty, {[0xff, 0xff, 0xff, 0xff, 0xff, 0xff]}, @mac=@dev={[], 0xe}, {[0xff, 0xff, 0xff, 0xff, 0xff]}, 0x8, 0x1, 0xad9, 0x4c, 0x52, 0x2, 'sit0\x00', 'veth0_to_bond\x00', {0xff}, {}, 0x0, 0x40}, 0xf0, 0x118}, @unspec=@STANDARD={0x28, '\x00', 0x0, 0xffffffffffffffff}}], {{[], 0xc0, 0xe8}, {0x28}}}}, 0x488) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000000c0)={0x8, 0x0, &(0x7f0000000040)=[@increfs], 0x0, 0x0, &(0x7f0000000140)}) r3 = openat$selinux_checkreqprot(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/checkreqprot\x00', 0x14000, 0x0) setsockopt$netlink_NETLINK_DROP_MEMBERSHIP(r3, 0x10e, 0x2, &(0x7f0000000080), 0x4) ioctl$sock_inet_tcp_SIOCOUTQNSD(r3, 0x894b, &(0x7f0000000100)) creat(&(0x7f0000000140)='./file0\x00', 0x24) 18:20:05 executing program 0: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) add_key$keyring(&(0x7f0000000200)='keyring\x00', &(0x7f0000000240)={'syz'}, 0x0, 0x0, 0xfffffffffffffffb) syz_genetlink_get_family_id$ipvs(&(0x7f0000000000)='IPVS\x00') [ 473.086424] binder: 31057:31062 Acquire 1 refcount change on invalid ref 0 ret -22 18:20:05 executing program 5: socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) mmap(&(0x7f0000ffb000/0x2000)=nil, 0x2000, 0x300000d, 0x10, r0, 0x0) r1 = memfd_create(&(0x7f0000000100)='{\x00', 0x7) connect$inet6(r1, &(0x7f0000000140)={0xa, 0x4e23, 0x32f9, @empty, 0x40}, 0x1c) r2 = syz_open_dev$rtc(&(0x7f0000000000)='/dev/rtc#\x00', 0x5, 0x8000) ioctl$RTC_SET_TIME(r2, 0x4024700a, &(0x7f0000000080)={0x1e, 0x2f, 0x7, 0x14, 0x2, 0x8000, 0x1, 0x64, 0xffffffffffffffff}) ioctl$FS_IOC_SETVERSION(r0, 0x40087602, &(0x7f0000000040)=0x1) [ 473.141145] binder: 31057:31062 unknown command -33864434 [ 473.167649] binder: 31057:31062 ioctl c0306201 20008fd0 returned -22 18:20:05 executing program 3: add_key(&(0x7f0000000080)='wser\x00', &(0x7f0000000100)={'syz', 0x1}, &(0x7f0000000200)="82", 0xffffffffffffff22, 0xfffffffffffffffb) [ 473.186448] binder: 31057:31071 Release 1 refcount change on invalid ref 0 ret -22 [ 473.197403] binder: BINDER_SET_CONTEXT_MGR already set [ 473.229187] binder: 31075:31081 ioctl 40046207 0 returned -16 [ 473.230459] binder: 31057:31071 unknown command -33864434 18:20:05 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x805) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000300)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, &(0x7f0000012fc7)}) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000000c0)={0x8, 0x0, &(0x7f0000000040)=[@increfs], 0x0, 0x0, &(0x7f0000000140)}) 18:20:05 executing program 5: request_key(&(0x7f0000000240)='keyring\x00', &(0x7f0000000280)={'syz', 0x0}, &(0x7f00000002c0)='vboxnet1\x00', 0xfffffffffffffffe) ioctl$TIOCGSID(0xffffffffffffff9c, 0x5429, &(0x7f0000000000)=0x0) sched_rr_get_interval(r0, &(0x7f0000000040)) 18:20:05 executing program 3: add_key(&(0x7f00000000c0)='user\x00', &(0x7f0000000100)={'syz'}, &(0x7f0000000200)="82", 0x1, 0xfffffffffffffffb) pipe2(&(0x7f0000000000)={0xffffffffffffffff}, 0x84000) getsockopt$inet_IP_IPSEC_POLICY(r0, 0x0, 0x10, &(0x7f0000000240)={{{@in=@dev, @in=@dev, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@loopback}, 0x0, @in6=@mcast2}}, &(0x7f0000000040)=0xe8) getsockopt$sock_cred(0xffffffffffffff9c, 0x1, 0x11, &(0x7f0000000080)={0x0, 0x0, 0x0}, &(0x7f0000000140)=0xc) getsockopt$inet_IP_XFRM_POLICY(0xffffffffffffffff, 0x0, 0x11, &(0x7f0000000340)={{{@in6=@local, @in6=@ipv4={[], [], @broadcast}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@multicast2}, 0x0, @in6=@mcast2}}, &(0x7f0000000180)=0xfffffea4) write$P9_RSTATu(r0, &(0x7f0000000540)=ANY=[@ANYBLOB="5d0000007d0200000045000000000800008802000000060000000000000000000020ff7f0000ee000000ffffffff00000000030073797f00000c00707070317365637572697479030073797a030073797a38d0f6ea2ff0a0a65dc3787282cdaa1965492b9c6fb19fae42b38a8d7424c00d66f32d3d1ab8e4ad5e82ee2d0a74389ff65575441c318bb6f2d90f26ff7f5350704fd49a20920a4bedbfe59e25298703a468ae18c4deb3c1a1d2b99a815a8e92eecdfa37ca2ec6faf0dbd53ad69e162ca14614d9a85a5f55f3b4fec9cea6b7f8fcc25fd3ce8adfb6fdd9e513bfd5a717927df2698f", @ANYRES32=r1, @ANYRES32=r2, @ANYRES32=r3], 0x5d) 18:20:05 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000300)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, &(0x7f0000012fc7)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, &(0x7f0000000f4d)}) r1 = mmap$binder(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x2, 0x2010, r0, 0x0) r2 = socket$inet(0x2, 0x6, 0xffff) ioctl$sock_SIOCADDDLCI(r2, 0x8980, &(0x7f0000000000)={'\x00', 0x7}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x2, 0x0, &(0x7f0000000240)=[@acquire_done={0x40106309, r1}, @exit_looper, @release={0x40046306, 0x3}, @increfs_done={0x40106308, r1, 0x3}, @acquire_done={0x40106309, r1}, @reply={0x40406301, {0x2, 0x0, 0x3, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, &(0x7f00000001c0)=[@ptr={0x70742a85, 0x1, &(0x7f0000000180), 0x0, 0x0, 0x30}], &(0x7f0000000200)=[0x78, 0x40, 0x38, 0x38, 0x28, 0x30, 0x78, 0x38]}}], 0x0, 0x0, &(0x7f0000000340)}) 18:20:05 executing program 0: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180)) r0 = open(&(0x7f0000000040)='./file0\x00', 0x4000, 0x0) ioctl$sock_inet_SIOCDARP(r0, 0x8953, &(0x7f0000000080)={{0x2, 0x4e21, @multicast2}, {0x6, @dev={[], 0xe}}, 0x2, {0x2, 0x4e24}, 'bcsf0\x00'}) r1 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x400000, 0x5) setsockopt$inet_buf(r0, 0x0, 0x2e, &(0x7f0000000100)="2c95d36b8dad0513fc51d34d0f8d4ced6cb19108034942edcb202df7d64559e22bead9", 0x23) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) add_key$keyring(&(0x7f0000000200)='keyring\x00', &(0x7f0000000240)={'syz'}, 0x0, 0x0, 0xfffffffffffffffb) [ 473.230467] binder: 31057:31071 ioctl c0306201 20008fd0 returned -22 18:20:05 executing program 4: r0 = syz_open_dev$binder(&(0x7f00000002c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000300)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, &(0x7f0000012fc7)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, &(0x7f0000000f4d)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000000c0)={0x8, 0x0, &(0x7f0000000140)=[@release], 0x0, 0x0, &(0x7f0000000340)}) 18:20:05 executing program 5: r0 = openat(0xffffffffffffffff, &(0x7f0000000000)='./file0\x00', 0x40000, 0x80) ioctl$TIOCGPGRP(0xffffffffffffffff, 0x540f, &(0x7f0000000040)=0x0) ioctl$TIOCSPGRP(r0, 0x5410, &(0x7f0000000080)=r1) request_key(&(0x7f0000000240)='keyring\x00', &(0x7f0000000280)={'syz', 0x0}, &(0x7f00000002c0)='vboxnet1\x00', 0xfffffffffffffffe) [ 473.311178] binder: 31098:31104 Acquire 1 refcount change on invalid ref 0 ret -22 18:20:05 executing program 2: r0 = syz_open_dev$binder(&(0x7f00000002c0)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000300)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000005fd4)=ANY=[@ANYBLOB="2b63044000000000"], 0x0, 0x0, &(0x7f0000012fc7)}) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000000c0)={0x8, 0x0, &(0x7f0000000040)=[@increfs], 0x0, 0x0, &(0x7f0000000140)}) 18:20:05 executing program 3: add_key(&(0x7f00000000c0)='user\x00', &(0x7f0000000100)={'syz', 0x1}, &(0x7f0000000200)="82", 0x1, 0xfffffffffffffffb) 18:20:05 executing program 0: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) add_key$keyring(&(0x7f0000000200)='keyring\x00', &(0x7f0000000240)={'syz'}, 0x0, 0x0, 0xfffffffffffffffb) ioctl$FS_IOC_SETFLAGS(r0, 0x40086602, &(0x7f0000000000)=0x7fff) r1 = accept4(r0, &(0x7f0000000040)=@hci, &(0x7f00000000c0)=0x80, 0x80800) setsockopt$netlink_NETLINK_LISTEN_ALL_NSID(r1, 0x10e, 0x8, &(0x7f0000000100)=0x4, 0x4) [ 473.360809] binder: 31098:31112 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 473.391240] binder: 31115:31119 unknown command 1074029355 [ 473.397897] binder: 31115:31119 ioctl c0306201 20012000 returned -22 18:20:05 executing program 5: request_key(&(0x7f0000000240)='keyring\x00', &(0x7f0000000280)={'syz', 0x0}, &(0x7f00000002c0)='vboxnet1\x00', 0xfffffffffffffffe) getresuid(&(0x7f0000000000), &(0x7f0000000040), &(0x7f0000000080)) [ 473.406981] binder: 31098:31104 BC_ACQUIRE_DONE u0000000000000000 no match [ 473.415837] binder: BINDER_SET_CONTEXT_MGR already set [ 473.428849] binder: 31116:31120 ioctl 40046207 0 returned -16 [ 473.449544] binder: 31098:31129 BC_ACQUIRE_DONE u0000000000000000 no match 18:20:05 executing program 3: r0 = accept$unix(0xffffffffffffffff, &(0x7f0000000000)=@abs, &(0x7f0000000080)=0x6e) fsetxattr$security_smack_transmute(r0, &(0x7f0000000140)='security.SMACK64TRANSMUTE\x00', &(0x7f0000000180)='TRUE', 0x4, 0x0) add_key(&(0x7f00000000c0)='user\x00', &(0x7f0000000100)={'syz'}, &(0x7f0000000200)="82", 0x1, 0xfffffffffffffffb) 18:20:05 executing program 0: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) pwrite64(r0, &(0x7f0000000000)="c0b1ca598f73259ac803479f8214325a339e9f53a618299be510d6f6a1283b70aec84062dc86eef5d2183db3598505510106d5b7f5f68c6f0f4ae8313ec7f325b64c5c048a3108e24667283e4c12ba05bb974877502ef5bb601ba6", 0x5b, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) add_key$keyring(&(0x7f0000000200)='keyring\x00', &(0x7f0000000240)={'syz'}, 0x0, 0x0, 0xfffffffffffffffb) 18:20:05 executing program 4: r0 = syz_open_dev$binder(&(0x7f00000002c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000300)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0563044000000000b0c8011fb1aaccfe9001d10a76ab976f72afc98a53c685"], 0x0, 0x0, &(0x7f0000012fc7)}) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, &(0x7f0000000f4d)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000000c0)={0x8, 0x0, &(0x7f0000000140)=[@release], 0x0, 0x0, &(0x7f0000000340)}) [ 473.457452] binder: 31115:31128 IncRefs 0 refcount change on invalid ref 0 ret -22 18:20:05 executing program 5: r0 = dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x80000) r1 = openat$cgroup_ro(r0, &(0x7f0000000000)='memory.swap.current\x00', 0x0, 0x0) ioctl$EVIOCGABS20(r1, 0x80184560, &(0x7f0000000040)=""/34) r2 = request_key(&(0x7f0000000240)='keyring\x00', &(0x7f0000000280)={'syz', 0x0}, &(0x7f00000002c0)='vboxnet1\x00', 0xfffffffffffffffe) add_key$keyring(&(0x7f0000000080)='keyring\x00', &(0x7f00000000c0)={'syz', 0x2}, 0x0, 0x0, r2) 18:20:05 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000300)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, &(0x7f0000012fc7)}) r1 = socket$netlink(0x10, 0x3, 0x4) writev(r1, &(0x7f0000000000)=[{&(0x7f0000000200)="580000001400192340834b80040d8c5602067fffffff81000000000000dca87086a5c000004f6400940005891550f4a8000000006700008000f0fffeffff09000080fff5dd00000010000100000c0900fcff0000040e05a5", 0x58}], 0x1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, &(0x7f0000000f4d)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x8, 0x0, &(0x7f0000000140)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], 0x0, 0x0, &(0x7f0000000340)}) 18:20:05 executing program 2: r0 = syz_open_dev$binder(&(0x7f00000002c0)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000300)='/dev/binder#\x00', 0x0, 0x20000000000) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, &(0x7f0000012fc7)}) syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x800) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000000c0)={0x8, 0x0, &(0x7f0000000040)=[@increfs], 0x0, 0x0, &(0x7f0000000140)}) 18:20:05 executing program 0: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount(&(0x7f00000001c0)=ANY=[], &(0x7f0000000240)='./file0\x00', &(0x7f0000000600)='ramfs\x00', 0x1000002, &(0x7f00000002c0)='selinux%\x00') chdir(&(0x7f00000000c0)='./file0\x00') clone(0x2102001ffb, 0x0, 0xfffffffffffffffe, &(0x7f0000000140), 0xffffffffffffffff) mknod(&(0x7f0000000280)='./file0\x00', 0xffc, 0x0) getsockopt$inet_IP_IPSEC_POLICY(0xffffffffffffffff, 0x0, 0x10, &(0x7f0000000300)={{{@in, @in6=@local, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6}, 0x0, @in6=@remote}}, &(0x7f0000000080)=0xe8) quotactl(0x1000, &(0x7f0000000040)='./file0\x00', r1, &(0x7f0000000640)="715be25b73a67a32c0d1d81b78e7bb05d0b2cc3aceb478adefeb3ff5630d7187ea54f24817c03f3052e34cdbada870f049721679914395d19912984024d24b30176bb25bf1bfa91cee6dd084ce09f816ddae537670406e38949795a1fb9dc52f95c148e02cad28e346563de479ac765cf560fb1a0bce554fd2120b0e0766d25f69d13e2256bf4b35b6cbf4d3842a1fedf1fe6a96e6311561dbe142fd90178dd1350f4f110cbda162f441eefb7510ce4241fdd2894b565f0298ce5909ed25b17b916153583283bda2962e3e00413a4830eb05225beb9ec887c3fe4db1112ba085b1bdf69d444da0e0cc96741285ead53ca8bd4415eeb1e0dbadf878ff478e859e6a6a61a6e94d90a22c561ea00de601042dc9a22e5ac410d91bce04fcdae5aaa3a1af91d8f06ae35805ae2d30c32cdfa19073b361f1fd6e39cee12f2d6684d357301fecc729d7f6d5c67e2ec7dc6eb00b74a96f0c0519ca468c7872a4d0a4f206a3c18d64550f0cfe7efd114651a5630a90187fa4228f1665292cdd5d1fcc784abd8c8c44154a6666ebc484ace822032e41810d60e345a45505c1034668e0c67f23968cc2ebf91cde98d7badebdc1be9be0386beaa1ee528fdde0c147c7fd4d916a34a10d1d5d5602cb817bff46388bce210fc1ecaf1e5bfa88811e856ebd34b8d04b5f14b1f52f4d302c2b39e5ce5fb2c70485128c422d3dd53a9ad2a129d18ee88c7b7b269631be2937d859b359653bf213c48c6b893444e4b7ee6dea6d489373d8ff26bb663185095b7cdc3688bfbbbfe6f93b65ba627afe24b0f0ba613fe4d4270e0c5f91fc97d4cfd38c5d0b8fb91f77e92f0bf2c652e7aff3b1e8128c22675605e3b37f4b8b176493ea8b8ba9c3b970fc5c18cebdfce9bef27553c22c4d5f8260966461bf694975078b0690bcc2bcd3061d87aa1b00798405a87e33531b9af4dcfe208c6192c2d645d25061f6a32e770dfc025932b0762d78b57b83f0545c28199897c9d199e61ac43bf43d5a42f2664eacdb72ac2815d79082651897f4a0603117acfa5412c67d54a3af8eaa26b73be14645c7570b2e7229bb5073a094c2161592cf2da4227ec43610e3706b138cba16c6d28699ca8d8241c57f64d4f79c456cf70f292bca7322b830a7339e34999634eac584edf583560c8d08d70d7178b6833e89059a2f10723636db909de7a2183cfdbd3f6da98f4dce1b1be2a9f924811ed27d9b95f2a9064f0198e916baec0a855fa7c358675a1c616ed0362e4b724a49edc6fc26c2aa17efb6a13364bdc113e45294d39a8e4a78a36e10d9e7ece1a89b30f57e80e27ea74be1172f3fc7c40a01e217ead3ee0b347a157643679a65bcdb620c0e58b1ae8874c95ade8e806cdbcc3b28ae2efbc6c478e4076c8717cf7eaa64f642d997ec998379a56847d976adc1155c514f59d3c9c4bd84760ecebd44fdcd4062a6efe2e850e77c0f0e80cd2d00b68022bd8102400bfd0d3002d6472dc833242988644b088288fd0a33f6075e321b156a24b44b92a826eddcec6e7ff8aae6e0f4d11d21ae8ff25c6789d475fec81080b6437069ab45d75fac1e85731e946393effe97e167a78274811e9b0de80d8a5bb1df7aaa97733a6fe17d8992ec3140c5d94861c3d6f897f68ff2ed316c86aea7297625e75b08a917e11838e4d02043e4906a6f5d1e0501799f920664cad8a622bbd16891725833f4a352a61ec9edb4616376ea529f1f05a02006200a6218f431c90a426fa1fdc88b872ced03cd72319ce8177771cd507e74c32e44ebd69c320e1243521bf24102acf883e1ce52abe1a2bee3122f199c141e7b193c45ca40002772131c1d5a9ecc6a6d636aa8e6c6987f52bca49cc67bff3b6773f43d96daa3a5d0519e3bdc8ae7a095ffd3563975df166a7dea31a03558b49802a3aa613ff0ad370000904a6ae065fdfc4beb8a91983e24d9c234a0bb2848cbbfab408ae466ea2cb98b19232d26e64978bae079df1cb3877b529d62c71b6d0d15161fc6d6f6c5b3ceccb8d064016f04006aa3b4aa0fb4425887981d92e339b5c8ba5021cddd83523afabc2c3920e42299b787829c5541b8ae7a6ee174f01d0a5d3fb0a4299578b9cbd007b40def3cce6c786b534fdff0588cb5595e579ffcef44ee01e7200604377662f0143b61585bb00fed860691b08ff5c1f967d45832ecc048ecd035c3cc75acef47aa2e135785157ff8212d4d0e7f23c1a49223f9abf8eed0467521ee47ad4d826914ab836cc27e4373e8fbd1e67f673e37bf552f50e86f7581184fd23065c450b4f55eb9cec366c0e7a72e7f525327e2e9e131e7ef737dc979ec4011bafca6db02409dc8594aa207d908bd098f739005939bab2a301a3f80181394f587d83bc7e54589b5f7597c940fcaadb7eb96d1f07b48c2c168f8d975696cc52ac6f7b3c232def5f290583a3cd8e48461cd82e91c6263afaea202bda69f940cf80721325911e11be3d19b94f02be1e4ef6ec11b8ea6004c047f2ebc9de5f102f708677e731162086f80142829bf212b04966fa6d481f515b500ea6214dac52d294d81f78634529bc8fc8592de12d98596274260ff8e66afcf335ea61fe111155f1719c19263a25aaf80d8e6f19db8a6bed65f25be50ba931f479a076a19101a0ae429d1833078c10228d4ca3dc82df9f1911478f369510a7c34e8ffac8a28a856f16570453c87ad9c5452de26af4084bf6477a043a27e40d930cc3fe09eb3ac63d9e111cbe21e834cc02fed96ba8ef2ab6004c36d681a9e3e4dfafd26f64eba5aeeeb96623ae62827be6444c4fffa04034f9fbae762ee063ebe4f037bc6bd4b6f8d870e033f8f8996f71abd9e1f7fb1c0808274cfbbd9fc89f1e6b1b4b702d8a9a23d8ed35e0b01bb087f9960528f01b63961ee1691a445422449cf784a8dffaf56d1696301ba16f9d799a2e996771b6ee1fcfc6567a842b8d25ac443823c6ffd50f21267b49b56ec9e9fd6117230f006b7a3cf1bf1bb41579fc5c6e8d9bebeabf54dc215d28c1beb7af7aaf4f11fa2cb99d9ebcbea04d1f4efe81cb60dfdf1c5663d03bf9d986462024a67f8cdb875b7d6142715d7608059954323259bd12ecc6db1f90a574d01ac9baf0fb3c8998592e24120488b384ed3342fa46fae0960221024557763c6d46c01b4bae4ce25cd0cae16cd7f436ccd189b3b2ebeb03f0cbefff67bbc2800b760886157dd8383c6dbe21e8da29eebbabab0379bd6b1b4753899bb4a5915458ef3e36e7bc17e64b9c340742d0a1c20cc6ab4e1f402cc17bac7aeec2321f58796d59a5f85a85dcfeecd3140edccc6b068b8fb9540427ea36f229014550d46838b1453664af025672bdebf6b81b967009fd51a5b3dbc037527f96e3517e17df92bc26cc7ee860904c3551a9c22430ae8411bd6dd0b84ba1e48f04d905f1f1d85cccd7a82c72f9092931808c63d91264d6898c0a9694909e3178dd098a78bb7320f01317b34c1dd418f052b92704ac4ea6d4946a21929c3e3a369bcb3c451c14d3b76a7ff6d6c9ca8faf2368918bfc86e4309550060450d767bbf721e5b0a07f109226b7a62ddfe35ff7035a0391e3b68d9e72cc841f5902fe7a0bdf3ea6fc022377aea9ecd5564a45fd63d5c29b274b483dceee094710f38bfa8aed7d668f045488acef8a5f4fdd01a0a6768d4860ffbc554259eda4b65a93e7c5440432d5c504660d3b83460c12f64efa504e411e7430c7dfb051a02f2fd11ce1b4d3fdfc468bba754b3bb8f4b042b615b5c4ca985c33b500b3b40391309b31a2684ff23fe21e118b578c6a2fbd68d2aec49f5c7c7603e9f273fc5496bff90e30b1a2df12d7c39063897badc79faeace31a0b39846f989aec6f7630e7f9ced8453eda743d6dfd6e840f0970a4866ae3c43a77eaf5692412a5ec4b57a698d6d60303a48b5582cd04553bdf92efd832d52d39a33336a884a9e668e9ffdae2d026c222faa916c3d1475963c7b098f16c2c9e1dd3c75a80ef56ca98f0d7c5ec5c670fa92d48c7848208591a8c56396dd456dbe7c561ad5be5de4c6fdb75634098f1a00e225fc86c65b4eb57d7b5ecf2c85219be1e2e218160bf7976e8ee6153768fdabef5dfa567636efeb76c69967acc0514249575c0091d26f8949b687a706ccda4e7e7e41301b98d6af91e39e0902d6e55a1451c6d467d9ddaef6ba45456bf81d3e41573c4a53749206722febb197dd4f4f8dd494f1cd5254617553be51a1f458044981319171bbf676b57d6d1242f107207531b22b17fbacc54b7551299156fbcda3c69c35235fbbac25f4450dfda675266dcc6e03c0c591eebd0602111410feea7b25eb657a897b1a9b4f7d3f3d322dfe92796f7cd9865a18b0653fec32807e7da62ffdc2e3849d6c17fcaa2458b7fdfa12519cfabb527686f2edd2da129cb88c1a875e0bdee1c85f28dab58c3379c5ba3a00606460ae8816f7720c8db6cc42158651a2045091f69565c4f38a740ea559d5a2d2aeda5325cf80e8d6d227546f2819b148a1491ba1682f3db358c210334222048d3df670be748adc4948487e2b259d41ad171bc7ac96e2567c75a95b9e2123523e7f56d06f97207422e9c366f89d8f6c99fdad75a7081d059fc37d024fb550f206f4cdc1c731b7ef9177c65c188c20992fd30d30b1248ced7127b6bb4245c26a8efc73c286fb726f60459ee0b290545ff9eb3dc7fd29a99980fdfbe3419f9e136be5ef2950737ea9ce192cc2861ba6d54f4f52c1c64bafbbaea59b6fc325fc56858f040ee3622191663892b9e73742c8a9c9cb01a6337f20eb5508647052c04df1e6567c4757fe2689e38fa09bf565cb6d9d79d544c5920102225080ae2051fbf9b1fabc3b86a3e123b850e508382d621b1bcf5fe4ce94e47eb3179413eb7f338606fe2ee29e1f8672bce7dc1115671f8b549944263bf0e9ac75cd691a0d077f59c423125e1b24c86bb4dda6078e7f1da8b4b646bbe65ebadccea915a942f5eb6d2acf1dfef0bea5ada68f5751ce339123228da371581555f8934eacb72cdde76d96adebdea8ded133dc20d3fa839cfeb5e17106c9f92a5d21f722ed303f65e851c73d9129737c68eb21f153e78a20d0a5dda1e59f06f1ecbb110a34e3fb4c5801674bfe8712c101e43ffb973c66ec988ba8eec0ba0857679f63de08df5504b1cc6a8e5df0633981310065074eeb77acb36c6fd196e2a67c65c716bd9e2e6ed4484624d4edf42bd1ee35a2cefd554f4ebedc36982952824d067b704edf1a89ca5dd66d45e5d6bb67be9150d0212e72dd3e64e8c78d0b79d512a536ad974c16c884eb02215a1daefc776342107ea05eaa84aa5519a8c4e01852e0c28300dc3051cb8307db153cce348c0323193ec2f33d8cb74571852d2e71fd6fb7c29a73d3c0ce19924c18fc355e9d40127ad2546e8afe895d5981c0fe5b46dc37bff51dd6da7d0bb2e09ee96d4d46e45e1b8abfacfee5fe3de49946781c2b68244009377d27c4729e681757f58263826e23c003947b2c0f97fc23130032299bfb3ddcffd17b95ff6b75bb2d78b7ad3d44919933b5fe9c09318c869afdb97e2de4a7a6edffe391a295c045148b759592899cd84504be239a08ea209dafd97689a566f4faabd5dec3ea19fb4ae4e9859935588622e3339428d8137864f6a7bcc7f5c023e27c64c495e12f1e8c3102b8a245d2a2fc188466fdc147e7ec1fb01fc7e4f030d09c575b7e67919f4ba503d0a3c6cabb2e3f4b6c9ae2eba9aa204de8a4983705bdf579448be6280fa4b3a02ee54cc9d802925e15675db98708e5e2d4") execve(&(0x7f0000000100)='./file0\x00', &(0x7f00000009c0), &(0x7f0000000840)) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) add_key$keyring(&(0x7f0000000200)='keyring\x00', &(0x7f0000000240)={'syz'}, 0x0, 0x0, 0xfffffffffffffffb) 18:20:05 executing program 3: r0 = socket$inet6_udplite(0xa, 0x2, 0x88) r1 = syz_open_dev$mice(&(0x7f0000000040)='/dev/input/mice\x00', 0x0, 0x20040) epoll_ctl$EPOLL_CTL_MOD(r1, 0x3, r0, &(0x7f0000000080)={0xc}) add_key(&(0x7f00000000c0)='user\x00', &(0x7f0000000100)={'syz'}, &(0x7f0000000200)="82", 0x1, 0xfffffffffffffffb) syz_open_dev$rtc(&(0x7f0000000000)='/dev/rtc#\x00', 0x10000, 0x400) [ 473.528588] binder: BINDER_SET_CONTEXT_MGR already set [ 473.528733] binder: 31115:31119 unknown command 1074029355 [ 473.528741] binder: 31115:31119 ioctl c0306201 20012000 returned -22 [ 473.555036] binder: 31137:31141 ioctl 40046207 0 returned -16 [ 473.597455] binder: BINDER_SET_CONTEXT_MGR already set 18:20:05 executing program 5: request_key(&(0x7f0000000180)="6b657972696e670053002bafbde6367649d8175f46982c68a9ee681ec09d6dc11b4c17b322a93edd51b8821e8a8e97a7f3052f36dc21d8748dfda916601fa157e556b6fe7aa47281cfe45041faad9921e7a3680d084063ebd36cdd5317ffd9b3cb1f741a982c0ced749b7c6cd1cc79fc7bcf0e25bd2512b444749bf767dee0f720bfb3f65ad4cb630c3eda3079663270ef24c0076d4e832aa47d2e52e73a63f67f8e94031e50eafe043ee5c75ab2787cad087906d2aaf572fbdad013ba7b", &(0x7f0000000280)={'syz', 0x3}, &(0x7f00000002c0)='vboxnet1\x00', 0xfffffffffffffffe) r0 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/enforce\x00', 0x400c00, 0x0) setsockopt$inet_MCAST_LEAVE_GROUP(r0, 0x0, 0x2d, &(0x7f0000000300)={0x0, {{0x2, 0x4e21, @rand_addr=0x5}}}, 0x88) ioctl$SNDRV_TIMER_IOCTL_STOP(r0, 0x54a1) ioctl$GIO_UNISCRNMAP(r0, 0x4b69, &(0x7f0000000040)=""/174) 18:20:05 executing program 2: rt_sigreturn() r0 = syz_open_dev$binder(&(0x7f00000002c0)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000300)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x0, 0x0, &(0x7f0000000100), 0x0, 0x0, &(0x7f0000012fc7)}) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000000c0)={0x8, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="6304400000000000"], 0x0, 0x0, &(0x7f0000000140)}) r2 = socket$inet_icmp_raw(0x2, 0x3, 0x1) getsockopt$IPT_SO_GET_REVISION_TARGET(r2, 0x0, 0x43, &(0x7f0000000000)={'icmp6\x00'}, &(0x7f0000000080)=0x1e) [ 473.620581] binder: BINDER_SET_CONTEXT_MGR already set [ 473.636919] binder: 31137:31141 ioctl 40046207 0 returned -16 [ 473.650678] binder: 31137:31158 ioctl 40046207 0 returned -16 18:20:05 executing program 0: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180)) clone(0x802102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000000), 0xffffffffffffffff) wait4(0x0, &(0x7f00000001c0), 0x40000000, &(0x7f0000000200)) syz_open_procfs$namespace(0x0, &(0x7f0000000040)='ns/user\x00') r0 = gettid() syz_open_procfs$namespace(r0, &(0x7f0000000100)='ns/uts\x00') r1 = getpid() socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) rt_sigqueueinfo(r1, 0xa, &(0x7f0000000180)) r3 = openat$selinux_avc_cache_threshold(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/avc/cache_threshold\x00', 0x2, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x80000000000) add_key$keyring(&(0x7f0000000200)='keyring\x00', &(0x7f0000000240)={'syz'}, 0x0, 0x0, 0xfffffffffffffffb) request_key(&(0x7f0000000000)='trusted\x00', &(0x7f0000000040)={'syz', 0x1}, &(0x7f0000000080)=':$\x00', 0xfffffffffffffffd) 18:20:05 executing program 4: r0 = syz_open_dev$binder(&(0x7f00000002c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000300)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, &(0x7f0000012fc7)}) r2 = syz_open_dev$mice(&(0x7f0000000000)='/dev/input/mice\x00', 0x0, 0x40500) fsetxattr$trusted_overlay_origin(r0, &(0x7f0000000080)='trusted.overlay.origin\x00', &(0x7f0000000100)='y\x00', 0x2, 0x1) ioctl$RNDADDENTROPY(r2, 0x40085203, &(0x7f0000000040)={0x5, 0x16, "9613d54c32024e449cdc0757909d3b378d5c0bb11259"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, &(0x7f0000000f4d)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000000c0)={0x8, 0x0, &(0x7f0000000140)=[@release], 0x0, 0x0, &(0x7f0000000340)}) 18:20:05 executing program 2: r0 = syz_open_dev$binder(&(0x7f00000002c0)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000300)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, &(0x7f0000012fc7)}) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000000c0)={0x8, 0x0, &(0x7f0000000040)=[@increfs], 0x0, 0x0, &(0x7f0000000140)}) r2 = openat$selinux_status(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/status\x00', 0x0, 0x0) readlinkat(r2, &(0x7f0000000080)='./file0\x00', &(0x7f0000000100)=""/50, 0x32) [ 473.669056] binder: 31160:31162 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 473.682170] binder: 31160:31162 unknown command 0 [ 473.695638] binder: 31160:31162 ioctl c0306201 200000c0 returned -22 18:20:05 executing program 5: r0 = creat(&(0x7f0000000200)='./file0\x00', 0x119) faccessat(r0, &(0x7f0000000240)='./file0\x00', 0x24, 0x800) r1 = openat$selinux_avc_cache_threshold(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/avc/cache_threshold\x00', 0x2, 0x0) ioctl$TCGETA(r1, 0x5405, &(0x7f0000000040)) readv(r1, &(0x7f00000001c0)=[{&(0x7f00000000c0)=""/211, 0xd3}], 0x1) ioctl$TCSETS(r1, 0x5402, &(0x7f0000000080)={0x10000, 0x3, 0x1, 0x3, 0x8000000000000000, 0x9, 0x8, 0x0, 0x8001, 0x0, 0x8, 0x6}) 18:20:05 executing program 3: [ 473.723735] binder: 31160:31162 Acquire 1 refcount change on invalid ref 0 ret -22 [ 473.751555] binder: BINDER_SET_CONTEXT_MGR already set [ 473.761510] binder: 31160:31180 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 18:20:05 executing program 3: add_key(&(0x7f0000000000)='user\x00', &(0x7f0000000080)={'syz', 0x1}, &(0x7f0000000040)="82", 0x1, 0xfffffffffffffffb) set_tid_address(&(0x7f00000000c0)) [ 473.773529] binder: BINDER_SET_CONTEXT_MGR already set [ 473.782212] binder: 31176:31178 ioctl 40046207 0 returned -16 18:20:05 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0xfffffffffffffffd) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, &(0x7f0000012fc7)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, &(0x7f0000000f4d)}) 18:20:05 executing program 0: socketpair$packet(0x11, 0x3, 0x300, &(0x7f0000000000)={0xffffffffffffffff}) r1 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/vga_arbiter\x00', 0x20000, 0x0) write$FUSE_WRITE(r1, &(0x7f0000000100)={0x18, 0x0, 0x3, {0x400}}, 0x18) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000080)='sit0\x00', 0x10) getsockopt$sock_cred(r1, 0x1, 0x11, &(0x7f0000000140)={0x0, 0x0}, &(0x7f0000000180)=0xc) getresgid(&(0x7f00000001c0)=0x0, &(0x7f0000000280), &(0x7f00000002c0)) write$FUSE_CREATE_OPEN(r1, &(0x7f0000000300)={0xa0, 0xfffffffffffffffe, 0x1, {{0x4, 0x1, 0x7fffffff, 0x7, 0x1, 0x4, {0x1, 0x3, 0x20, 0x7fffffff, 0x81, 0x7, 0x7, 0x60, 0x7, 0x7, 0x6, r2, r3, 0x2, 0x2}}, {0x0, 0x1}}}, 0xa0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) add_key$keyring(&(0x7f0000000200)='keyring\x00', &(0x7f0000000240)={'syz'}, 0x0, 0x0, 0xfffffffffffffffb) socket$inet_tcp(0x2, 0x1, 0x0) 18:20:05 executing program 4: r0 = syz_open_dev$binder(&(0x7f00000002c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000300)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="7504000000346b1cb18d0a99c0e0ce88dc84be86781d41ce4de17bbcc7c5bf7256bd49775e7a44839f1f3265faf5152b051c1ba1f621fb74b776f92b5ad3b6eb99ac80e1a426d8d95503e57d1f44aaf5d5997712877a7dd743542a026c16f8422e2411df9fecff76a2d4a1f8a05b1651fd16bf933852bbd296ea1fa929fdc861a7ac11ded2208564aa19eabc68"], 0x0, 0x0, &(0x7f0000012fc7)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, &(0x7f0000000f4d)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000000c0)={0x8, 0x0, &(0x7f0000000140)=[@release], 0x0, 0x0, &(0x7f0000000340)}) r2 = dup3(r0, r0, 0x80000) ioctl$TCSETAW(r2, 0x5407, &(0x7f0000000100)={0x0, 0x7, 0x4, 0x900, 0x4, 0x240000000, 0x34, 0x7, 0xff, 0x5}) 18:20:05 executing program 5: r0 = add_key$keyring(&(0x7f0000000100)='keyring\x00', &(0x7f0000000180)={'syz', 0x0}, 0x0, 0x0, 0xfffffffffffffff9) request_key(&(0x7f00000001c0)='keyring\x00', &(0x7f0000000080)={'syz', 0x0}, &(0x7f0000000040)='vboxnet1\x00', r0) r1 = openat$selinux_avc_cache_stats(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/avc/cache_stats\x00', 0x0, 0x0) setsockopt$netlink_NETLINK_BROADCAST_ERROR(r1, 0x10e, 0x4, &(0x7f00000000c0)=0x5, 0x4) [ 473.815105] binder: 31182:31192 Acquire 1 refcount change on invalid ref 0 ret -22 [ 473.824761] binder: 31182:31196 IncRefs 0 refcount change on invalid ref 0 ret -22 [ 473.833599] binder: 31182:31183 ioctl 40046207 0 returned -16 18:20:05 executing program 3: add_key(&(0x7f00000000c0)='user\x00', &(0x7f0000000100)={'syz'}, &(0x7f0000000200)="82", 0x1, 0xfffffffffffffffb) pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$IP6T_SO_SET_ADD_COUNTERS(r0, 0x29, 0x41, &(0x7f0000000040)={'mangle\x00', 0x2, [{}, {}]}, 0x48) 18:20:06 executing program 2: r0 = syz_open_dev$binder(&(0x7f00000002c0)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000300)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, &(0x7f0000012fc7)}) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000000c0)={0x8, 0x0, &(0x7f0000000040)=[@increfs], 0x0, 0x0, &(0x7f0000000140)}) readahead(r1, 0x0, 0x926e) [ 473.883590] binder: 31207:31209 unknown command 1141 18:20:06 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000300)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, &(0x7f0000012fc7)}) r1 = creat(&(0x7f0000000000)='./file0\x00', 0x4) ioctl$sock_FIOSETOWN(r1, 0x8901, &(0x7f0000000040)) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, &(0x7f0000000f4d)}) io_setup(0x1ff, &(0x7f0000000100)=0x0) r3 = syz_genetlink_get_family_id$nbd(&(0x7f0000000480)='nbd\x00') sendmsg$NBD_CMD_DISCONNECT(r1, &(0x7f0000000580)={&(0x7f0000000440)={0x10, 0x0, 0x0, 0x800000}, 0xc, &(0x7f0000000540)={&(0x7f00000004c0)={0x74, r3, 0x400, 0x70bd27, 0x25dfdbfe, {}, [@NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x9}, @NBD_ATTR_BLOCK_SIZE_BYTES={0xc, 0x3, 0x1f}, @NBD_ATTR_SOCKETS={0x3c, 0x7, [{0x8, 0x1, r1}, {0x8, 0x1, r1}, {0x8, 0x1, r1}, {0x8, 0x1, r1}, {0x8, 0x1, r1}, {0x8, 0x1, r1}, {0x8, 0x1, r1}]}, @NBD_ATTR_DEAD_CONN_TIMEOUT={0xc}]}, 0x74}, 0x1, 0x0, 0x0, 0x2101c3d5fd6fb819}, 0x1) ioctl$TUNSETTXFILTER(r1, 0x400454d1, &(0x7f00000002c0)={0x1, 0x1, [@broadcast]}) io_cancel(r2, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0xb, 0xfffffffffffffff9, r0, &(0x7f0000000180)="9335852aa7a40865e41c003486fccc1117aa5a8592c039e6aebe1eeed5d2903b", 0x20, 0xab, 0x0, 0x2, r1}, &(0x7f0000000200)) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x8, 0x0, &(0x7f0000000140)=[@release], 0x0, 0x0, &(0x7f0000000340)}) io_cancel(r2, &(0x7f0000000240)={0x0, 0x0, 0x0, 0x6, 0x9, r1, &(0x7f0000000340)="0877ea9d832af81b9ef3c23246f140595743ef3c4fc505a121aef1cf1bbdcb991c4e312bad9c25f279a7b18c220bb691808cfd33d880013db1bf6dd4d05ea2c53d2ae01746f050143808dd1514e2df5832ffd19a3a163afa1bc9ed0bc37300f1cabbdc72ae9e49dfe5d9eae97077d17dfcbd66cf4cab6ea00b19d372c42a842c1cf7ff85eef713161e39f62af9e7c07eb47cafb0dc17b1d3341b29a8679e8866c582733e46526c7ba2128c9f6777d8f399e28db7a3ae8dcb4374f2e67ee558093581d5a7eeb453e84dc5d108e9e3dc8d6cd50c24c9f8b7a57b0f24cfa482300220b2ec5a84130a1151aa1c9693e6f01ad0a3", 0xf2, 0x1, 0x0, 0x1, r1}, &(0x7f0000000280)) setsockopt$inet_tcp_TCP_ULP(r1, 0x6, 0x1f, &(0x7f0000000080)='tls\x00', 0x4) 18:20:06 executing program 5: r0 = openat$keychord(0xffffffffffffff9c, &(0x7f0000000300)='/dev/keychord\x00', 0x0, 0x0) getsockopt$IP6T_SO_GET_REVISION_MATCH(r0, 0x29, 0x44, &(0x7f0000000340)={'IDLETIMER\x00'}, &(0x7f0000000380)=0x1e) stat(&(0x7f0000000000)='./file0\x00', &(0x7f0000000040)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r3 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000100)='maps\x00') write$binfmt_script(r3, &(0x7f0000000140)={'#! ', './file0', [{0x20, 'keyring\x00'}], 0xa, "58e7314ae82ab914dfddee5b360ecc6e864e3defb6a9ad8001cd5516531e69bcab365f22903ef34608aa9f10f15e6a6d3b75186af5d7b2c17cc4d92454714bf1638d5dddef55e0a49c47fb13907705a2345f002dd32664a5c1d90489369ec5628b0953942ff50fa717b1bcb0f1d8c24a6c96876b1731d586c6af863300c7cab8915cfa3b7759c3f90f181a6131097e2589ec22d869790f595cc8b34f9cc4c69eb0ba29879cc402e4c7e39c5dc3bd42f712631066fdcb910b"}, 0xcc) ioctl$EVIOCGABS3F(r0, 0x8018457f, &(0x7f00000003c0)=""/81) ioprio_set$uid(0x3, r1, 0x3f38) setresgid(r2, r2, r2) request_key(&(0x7f0000000240)='keyring\x00', &(0x7f0000000280)={'syz', 0x0}, &(0x7f00000002c0)='vboxnet1\x00', 0xfffffffffffffffe) r4 = openat$zero(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/zero\x00', 0x2, 0x0) lseek(r4, 0x58, 0x2) 18:20:06 executing program 2: r0 = syz_open_dev$binder(&(0x7f00000002c0)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000300)='/dev/binder#\x00', 0x0, 0x0) r2 = mmap$binder(&(0x7f0000ffb000/0x2000)=nil, 0x2000, 0x2000008, 0x10, r1, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r1, 0xc018620b, &(0x7f0000000000)={r2}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, &(0x7f0000012fc7)}) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000000c0)={0x8, 0x0, &(0x7f0000000140)=ANY=[@ANYBLOB="0463040286929ca3569ff82731680921b1189640000000009d9263149c26ad53f8dc0a4a3f0c37aa69153ddf603a924332ba15bed26d42d492b2fecd28edab3e81845019de28788e4c2252f1b6cec396a8883e310fdfe9f27575c2ede243e1546fbcb7eba006abf24bb923fc13e92b0d22f4f9b0cbf58d94425b5fbdc74714049890613787053d1cef9c6a3014a5716c3105a99291f5a034286983f31b2836d32bd9f2cf5faf4e8490fb478a150e9173c31552b76be15164372f901fa819885e27d77fb8f94212506179b6e2d5c072db2df9dde9ae4988"], 0x0, 0x0, &(0x7f0000000140)}) [ 473.913977] binder: 31207:31209 ioctl c0306201 20012000 returned -22 [ 473.952895] binder: 31207:31222 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 18:20:06 executing program 3: r0 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vga_arbiter\x00', 0x40, 0x0) read$FUSE(r0, &(0x7f0000000240), 0x1000) openat$ppp(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ppp\x00', 0x800, 0x0) add_key(&(0x7f00000000c0)='user\x00', &(0x7f0000000100)={'syz'}, &(0x7f0000000200)="82", 0x1, 0xfffffffffffffffb) [ 473.980329] binder: 31207:31209 Release 1 refcount change on invalid ref 0 ret -22 [ 474.010158] binder: 31207:31222 unknown command 1141 [ 474.010285] binder: BINDER_SET_CONTEXT_MGR already set [ 474.010293] binder: 31207:31209 ioctl 40046207 0 returned -16 18:20:06 executing program 5: r0 = epoll_create(0x19) write$binfmt_elf64(r0, &(0x7f0000000300)={{0x7f, 0x45, 0x4c, 0x46, 0xfffffffffffffff8, 0x100000001, 0x200, 0xfffffffffffffe00, 0x2, 0x3, 0x3e, 0x83d, 0x146, 0x40, 0x36f, 0x8, 0x8af, 0x38, 0x1, 0x131, 0x6, 0x5}, [{0x70000007, 0x9, 0x2, 0x9, 0x6, 0x8001, 0x6, 0x9}, {0x6474e557, 0x20, 0x6, 0x3630000000, 0x0, 0x6, 0x0, 0x713}], "bc421ab4651cfad9dd88c2fcc65ea9ce8bdb5b0501832710a10430e969d1122ff81697060804caf08c098a29351badd082ca9f4694cea52738271d2284c1accd6ccce7fe92922bcfa694a743ab846a85597fdbf92173b7d0a2510a5fcaa592f4badeff0648fa94e765d66a7ab4ecde922eed1e413381e5812151e3eab7448d4b74250c1120240b602cd5b41a4c2248358e9b160daa51c684ae7d3755de7d", [[], [], [], []]}, 0x54e) ftruncate(r0, 0x8) request_key(&(0x7f0000000240)='keyring\x00', &(0x7f0000000280)={'syz', 0x0}, &(0x7f00000002c0)='vboxnet1\x00', 0xfffffffffffffffe) 18:20:06 executing program 0: r0 = openat$selinux_avc_hash_stats(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/avc/hash_stats\x00', 0x0, 0x0) getsockopt$inet_IP_IPSEC_POLICY(0xffffffffffffff9c, 0x0, 0x10, &(0x7f0000000280)={{{@in=@local, @in, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@ipv4={[], [], @remote}}, 0x0, @in=@local}}, &(0x7f0000000100)=0xe8) getgroups(0x4, &(0x7f0000000140)=[0xffffffffffffffff, 0xee01, 0xee00, 0xee00]) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffff9c, 0x29, 0x23, &(0x7f0000000380)={{{@in6=@mcast2, @in=@multicast2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@multicast2}, 0x0, @in=@local}}, &(0x7f00000001c0)=0xe8) mount$fuseblk(&(0x7f0000000000)='/dev/loop0\x00', &(0x7f0000000040)='./file0\x00', &(0x7f0000000080)='fuseblk\x00', 0x8000, &(0x7f0000000600)=ANY=[@ANYBLOB="66643d8d98cf58c66e2528e49d0e551eb0ff538312adf3b74ca35e8e889b647d953dd8c87227e6809a87ba3b81cd790b75af4d873ff26cf1299dbd4a242bed54c8a435002bb01f483a9654f768255715ee1e37b14628767315d82f759943e4a1494c9ae22da0b6a7b49e4e27e8c3b694b81d704c", @ANYRESHEX=r0, @ANYBLOB=',rootmode=00000000000000000060000,user_id=', @ANYRESDEC=r1, @ANYBLOB=',group_id=', @ANYRESDEC=r2, @ANYBLOB=',max_read=0x0000000000000009,blksize=0x0000000000001e00,blksize=0x0000000000000400,uid=', @ANYRESDEC=r3, @ANYBLOB=',permit_directio,\x00']) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) add_key$keyring(&(0x7f0000000200)='keyring\x00', &(0x7f0000000240)={'syz'}, 0x0, 0x0, 0xfffffffffffffffb) fcntl$notify(r0, 0x402, 0x9) 18:20:06 executing program 3: r0 = add_key(&(0x7f00000000c0)='user\x00', &(0x7f0000000100)={'syz'}, &(0x7f0000000200)="82", 0x1, 0xfffffffffffffffb) keyctl$set_timeout(0xf, r0, 0x2) r1 = creat(&(0x7f0000000000)='./file0\x00', 0x8) write$P9_RWALK(r1, &(0x7f0000000040)={0x3d, 0x6f, 0x1, {0x4, [{0x4, 0x3, 0x2}, {0x20, 0x3, 0x6}, {0x0, 0x1, 0x1}, {0x0, 0x3, 0x5}]}}, 0x3d) write$binfmt_aout(r1, &(0x7f0000000240)={{0x108, 0x81, 0x7, 0x388, 0x190, 0xef, 0x63, 0x1}, "4fe9a38f45faca1d56fe26c724b4624d1430cea8bf42825ec631480a568f64c5caf7fac67daff394cfa21436afece3a9c8de7836075e9f0fe224cd50905df244d8671da2b9f747b4242872ea375d9c561a60e77959ea6c8ce011ff19a37ee5cbcdbab191de763623c3b60183bdd17bc06aeab648b9a7da23fc38f88ae7658b0c27130c602948ba785a4fa62f9aebe08f734c76b80ccf8f26bd2382851585187e7d27d9cd18a7595fb70bfa2b6f9f0eb5f0154cccec22c9c9621674c5af7c6930ca3c3f48eaa595f3811f02dfd30fa2223f920416def8be2250168a2e5d4a1da703fc2672115ac9a5350712edd7ad1db9c4a008f032da8d", [[], [], [], [], [], [], [], [], []]}, 0xa17) 18:20:06 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000300)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, &(0x7f0000012fc7)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, &(0x7f0000000f4d)}) write$binfmt_aout(r0, &(0x7f0000000340)={{0x10b, 0x0, 0x0, 0x26a, 0x2b6, 0x2, 0x2da, 0x3}, "bc7337a748fe062abd1c27a08b678e6752761a2c6183ab5f464ee2b1f9a9458270f77bfd698a81dcecee502e", [[], [], [], [], [], [], [], [], []]}, 0x94c) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x8, 0x0, &(0x7f0000000140)=[@release], 0x0, 0x0, &(0x7f0000000340)}) [ 474.021011] binder: 31207:31239 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 474.021123] binder: 31207:31209 Release 1 refcount change on invalid ref 0 ret -22 [ 474.053412] binder: 31207:31222 ioctl c0306201 20012000 returned -22 [ 474.072936] binder: 31235:31236 Acquire 1 refcount change on invalid ref 0 ret -22 18:20:06 executing program 4: r0 = syz_open_dev$binder(&(0x7f00000002c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000300)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) getsockname(0xffffffffffffffff, &(0x7f0000000000)=@generic, &(0x7f0000000080)=0x80) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, &(0x7f0000012fc7)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, &(0x7f0000000f4d)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000000c0)={0x8, 0x0, &(0x7f0000000140)=[@release], 0x0, 0x0, &(0x7f0000000340)}) [ 474.092344] binder: 31235:31236 unknown command 33841924 18:20:06 executing program 5: r0 = add_key(&(0x7f0000000040)='.dead\x00', &(0x7f0000000080)={'syz', 0x0}, &(0x7f00000000c0)="9afcfc1932c910204d2f7c118e278fdd694b1633524c141990644e7d63bd2cb01a1a215eee9f42c006a505c9ffcdb061bd3f49440cbc7b312ed6a0ad93e1b15acf777852", 0x44, 0xfffffffffffffffa) r1 = request_key(&(0x7f0000000140)='keyring\x00', &(0x7f0000000280)={'syz', 0x0}, &(0x7f0000000180)='vboxnet1\x00', r0) r2 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000000)='cpuacct.usage_sys\x00', 0x0, 0x0) setsockopt$inet_buf(r2, 0x0, 0x0, &(0x7f00000001c0)="9c480dadcfa5d645f658ef5bdf1e42586ee25b3e940df544dddee856532d660f4c57dd09a25bb8aa911134d8bee13a71", 0x30) keyctl$reject(0x13, r0, 0x80000000, 0x3ff, r1) r3 = ioctl$LOOP_CTL_GET_FREE(r2, 0x4c82) ioctl$LOOP_CTL_ADD(r2, 0x4c80, r3) socket$key(0xf, 0x3, 0x2) 18:20:06 executing program 0: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) add_key$keyring(&(0x7f0000000200)='keyring\x00', &(0x7f0000000240)={'syz'}, 0x0, 0x0, 0xfffffffffffffffb) r1 = memfd_create(&(0x7f0000000000)='keyring\x00', 0x0) ioctl$RTC_AIE_ON(r1, 0x7001) 18:20:06 executing program 3: r0 = add_key(&(0x7f00000000c0)='user\x00', &(0x7f0000000100)={'syz'}, &(0x7f0000000200)="82", 0x1, 0xfffffffffffffffb) keyctl$invalidate(0x15, r0) [ 474.133252] binder: 31235:31236 ioctl c0306201 200000c0 returned -22 [ 474.160368] binder: 31255:31258 Acquire 1 refcount change on invalid ref 0 ret -22 18:20:06 executing program 3: add_key(&(0x7f00000000c0)='user\x00', &(0x7f0000000100)={'syz'}, &(0x7f0000000200)="82", 0x1, 0xfffffffffffffffb) socketpair(0x11, 0x0, 0xffffffffffff7fff, &(0x7f0000000000)={0xffffffffffffffff}) openat(r0, &(0x7f0000000040)='./file0\x00', 0x10000, 0x100) 18:20:06 executing program 4: r0 = syz_open_dev$binder(&(0x7f00000002c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000300)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$int_in(r1, 0x5473, &(0x7f0000000000)=0x6) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=ANY=[@ANYBLOB="0e630c4004000000"], 0x0, 0x0, &(0x7f0000000f4d)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000000c0)={0x8, 0x0, &(0x7f0000000140)=ANY=[@ANYBLOB="0000000000000003"], 0x0, 0x0, &(0x7f0000000340)}) r2 = dup(r0) getsockopt$inet_IP_IPSEC_POLICY(r2, 0x0, 0x10, &(0x7f0000000180)={{{@in=@multicast2, @in6=@mcast1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@loopback}, 0x0, @in6}}, &(0x7f0000000280)=0xe8) setsockopt$packet_add_memb(r2, 0x107, 0x1, &(0x7f0000000340)={r3, 0x1, 0x6, @remote}, 0x10) epoll_ctl$EPOLL_CTL_DEL(r2, 0x2, r1) 18:20:06 executing program 2: r0 = syz_open_dev$binder(&(0x7f00000002c0)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000300)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000000000)=[@acquire], 0x3af, 0x0, &(0x7f0000012fc7)}) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000000c0)={0x8, 0x0, &(0x7f0000000040)=[@increfs], 0x0, 0x0, &(0x7f0000000140)}) 18:20:06 executing program 0: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = add_key$keyring(&(0x7f0000000040)='keyring\x00', &(0x7f0000000080)={'syz', 0x1}, 0x0, 0x0, 0xfffffffffffffffa) add_key$keyring(&(0x7f0000000000)='keyring\x00', &(0x7f0000000240)={'syz'}, 0x0, 0x0, r1) [ 474.190728] binder: 31255:31258 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 474.194782] binder: BINDER_SET_CONTEXT_MGR already set [ 474.194790] binder: 31268:31269 ioctl 40046207 0 returned -16 18:20:06 executing program 5: request_key(&(0x7f0000000240)='keyring\x00', &(0x7f0000000280)={'syz', 0x3}, &(0x7f00000002c0)='vboxnet1\x00', 0xfffffffffffffffe) r0 = syz_open_dev$mice(&(0x7f0000000000)='/dev/input/mice\x00', 0x0, 0x40) accept4$unix(r0, &(0x7f0000000040)=@abs, &(0x7f00000000c0)=0x6e, 0x80000) [ 474.243342] binder: 31255:31277 Release 1 refcount change on invalid ref 0 ret -22 [ 474.276271] binder: 31255:31258 Acquire 1 refcount change on invalid ref 0 ret -22 [ 474.289367] binder: 31255:31277 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 474.295147] binder: 31282:31289 ioctl 5473 20000000 returned -22 [ 474.295250] binder: 31282:31289 BC_REQUEST_DEATH_NOTIFICATION invalid ref 4 [ 474.295532] binder: 31282:31289 unknown command 0 [ 474.295540] binder: 31282:31289 ioctl c0306201 200000c0 returned -22 [ 474.297285] binder: BINDER_SET_CONTEXT_MGR already set [ 474.297300] binder: 31282:31289 ioctl 40046207 0 returned -16 [ 474.318923] binder: 31282:31289 ioctl 5473 20000000 returned -22 18:20:06 executing program 2: r0 = syz_open_dev$binder(&(0x7f00000002c0)='/dev/binder#\x00', 0x0, 0x0) socketpair(0xa, 0x802, 0x28d800, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) getsockopt$IPT_SO_GET_ENTRIES(r1, 0x0, 0x41, &(0x7f0000000140)={'mangle\x00', 0xa7, "ce7332380a9a72ba00cedc806554c24f09e278bbce66e60b341352d6d00b548c01711eab978c0e11f72d2f67cc50d4a5398fe63cca675432f2c29495622233273a8a2282c94cd71b6afaf5eb47084ffcc62dca19fabf345f95c62e58156a58dfe752cdb0772e12f37c0e2a7c000af22cdb33f18f99db69eeeefe7c21b9467900d2110dafb6a9ae20b1e76e886048b9bbda1009d068166d65a06583fcd553e1511ed46c01dfa9c1"}, &(0x7f0000000240)=0xcb) r2 = openat$keychord(0xffffffffffffff9c, &(0x7f0000000000)='/dev/keychord\x00', 0x8000, 0x0) ioctl$TIOCLINUX6(r2, 0x541c, &(0x7f0000000080)={0x6, 0x2}) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r3 = syz_open_dev$binder(&(0x7f0000000300)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000000340)=ANY=[@ANYBLOB="0563044000000000b0f04307bb3ce20627509787b731c0de6c1cb8e3d21a50f11089e385cd40380f3645f0d1869847c79b63a013bc24d296089a1fc4f154b21d7f9f69215fc2157f535f0e7a7469cae0d1583ddbbfc927b6009ca9a0e2"], 0x0, 0x0, &(0x7f0000012fc7)}) ioctl$EXT4_IOC_GROUP_ADD(r1, 0x40286608, &(0x7f0000000280)={0x9, 0x5, 0x1, 0xdc8, 0x0, 0x5}) close(r0) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000000c0)={0x8, 0x0, &(0x7f0000000040)=[@increfs], 0x0, 0x0, &(0x7f0000000140)}) 18:20:06 executing program 3: r0 = add_key(&(0x7f00000000c0)='user\x00', &(0x7f0000000100)={'syz'}, &(0x7f0000000200)="82", 0x1, 0xfffffffffffffffb) keyctl$describe(0x6, r0, &(0x7f0000000000)=""/176, 0xb0) 18:20:06 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000300)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, &(0x7f0000012fc7)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, &(0x7f0000000f4d)}) pipe2(&(0x7f0000000000), 0x4800) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x8, 0x0, &(0x7f0000000140)=ANY=[@ANYBLOB="066304400033f3ff"], 0x5c, 0x0, &(0x7f0000000040)="7f3e32f2c83e2ddafc17878d5ef2b520f52adf51e32a908df691515eb6134cdf9f2bb8ae614826cc5aca0e2af70754f6f2c9e077214e1c359298bb00030d7fcc57cd8fce34ff54db23410335a82d3d636c939d64d925d94826165fe4"}) 18:20:06 executing program 4: r0 = syz_open_dev$binder(&(0x7f00000002c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000300)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, &(0x7f0000012fc7)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="b8a32eeeab8a7ab8a1da0831cca175fffb8acbf2d21be3ed065b7c5f3ece2b0497bdcaf385663bbe1ffc67021e6c56ab1c42ba0f7cc5751075d9844e4efb51168eb243d17380a8555e650668d72f57034eebf7bcfcce8b5bb3aae7a53bfc09ee8b7d1037c5b313c0035992b4e1b0a037e300d368e65adc283845d114f6fe97719746a226548845b62d3b2a2ab7fdc9493eaeac6a62a2afa31e1d563fb7d9db489fd7a6b35d3616fd6cc7d3eec10102ca9940c4605108ba5c6d2022fbdd3aa4bf2214840e682a161b8d984d02d9917ab00476c58f3bac9866fbffffff72"], 0x0, 0x0, &(0x7f0000000f4d)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000000c0)={0x8, 0x0, &(0x7f0000000140)=[@release], 0x0, 0x0, &(0x7f0000000340)}) 18:20:06 executing program 3: r0 = socket$nl_generic(0x10, 0x3, 0x10) getsockopt$IP_VS_SO_GET_SERVICE(r0, 0x0, 0x483, &(0x7f0000000180), &(0x7f0000000140)=0x68) add_key(&(0x7f00000000c0)='user\x00', &(0x7f0000000100)={'syz'}, &(0x7f0000000200)="82", 0x1, 0xfffffffffffffffb) 18:20:06 executing program 2: r0 = syz_open_dev$binder(&(0x7f00000002c0)='/dev/binder#\x00', 0x0, 0x0) socketpair(0xa, 0x802, 0x28d800, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) getsockopt$IPT_SO_GET_ENTRIES(r1, 0x0, 0x41, &(0x7f0000000140)={'mangle\x00', 0xa7, "ce7332380a9a72ba00cedc806554c24f09e278bbce66e60b341352d6d00b548c01711eab978c0e11f72d2f67cc50d4a5398fe63cca675432f2c29495622233273a8a2282c94cd71b6afaf5eb47084ffcc62dca19fabf345f95c62e58156a58dfe752cdb0772e12f37c0e2a7c000af22cdb33f18f99db69eeeefe7c21b9467900d2110dafb6a9ae20b1e76e886048b9bbda1009d068166d65a06583fcd553e1511ed46c01dfa9c1"}, &(0x7f0000000240)=0xcb) r2 = openat$keychord(0xffffffffffffff9c, &(0x7f0000000000)='/dev/keychord\x00', 0x8000, 0x0) ioctl$TIOCLINUX6(r2, 0x541c, &(0x7f0000000080)={0x6, 0x2}) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r3 = syz_open_dev$binder(&(0x7f0000000300)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000000340)=ANY=[@ANYBLOB="0563044000000000b0f04307bb3ce20627509787b731c0de6c1cb8e3d21a50f11089e385cd40380f3645f0d1869847c79b63a013bc24d296089a1fc4f154b21d7f9f69215fc2157f535f0e7a7469cae0d1583ddbbfc927b6009ca9a0e2"], 0x0, 0x0, &(0x7f0000012fc7)}) ioctl$EXT4_IOC_GROUP_ADD(r1, 0x40286608, &(0x7f0000000280)={0x9, 0x5, 0x1, 0xdc8, 0x0, 0x5}) close(r0) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000000c0)={0x8, 0x0, &(0x7f0000000040)=[@increfs], 0x0, 0x0, &(0x7f0000000140)}) 18:20:06 executing program 0: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) add_key$keyring(&(0x7f0000000200)='keyring\x00', &(0x7f0000000240)={'syz'}, 0x0, 0x0, 0xfffffffffffffffb) r2 = dup(r0) epoll_ctl$EPOLL_CTL_MOD(r2, 0x3, r0, &(0x7f0000000000)={0x10}) [ 474.319372] binder: 31282:31290 BC_REQUEST_DEATH_NOTIFICATION invalid ref 4 [ 474.319462] binder: 31282:31289 unknown command 0 [ 474.319470] binder: 31282:31289 ioctl c0306201 200000c0 returned -22 [ 474.375334] binder: 31255:31298 Release 1 refcount change on invalid ref 0 ret -22 18:20:06 executing program 5: request_key(&(0x7f0000000240)='keyring\x00', &(0x7f0000000280)={'syz', 0x0}, &(0x7f0000000000)='vboxnet1\x00', 0xfffffffffffffffe) 18:20:06 executing program 3: r0 = add_key(&(0x7f00000000c0)='user\x00', &(0x7f0000000100)={'syz'}, &(0x7f0000000200)="82", 0x1, 0xfffffffffffffffb) request_key(&(0x7f0000000000)='keyring\x00', &(0x7f0000000040)={'syz', 0x0}, &(0x7f0000000080)='/\x00', r0) 18:20:06 executing program 0: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) accept$unix(r0, &(0x7f0000000000)=@abs, &(0x7f0000000080)=0x6e) add_key$keyring(&(0x7f0000000200)='keyring\x00', &(0x7f0000000240)={'syz'}, 0x0, 0x0, 0xfffffffffffffffb) [ 474.437331] binder: 31306:31310 Acquire 1 refcount change on invalid ref 0 ret -22 [ 474.446131] binder: 31307:31311 unknown command -298933320 18:20:06 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000300)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, &(0x7f0000012fc7)}) r1 = socket$netlink(0x10, 0x3, 0x4) writev(r1, &(0x7f0000000000)=[{&(0x7f0000000200)="580000001400192340834b80040d8c5602067fffffff81000000000000dca87086a5c000004f6400940005891550f4a8000000006700008000f0fffeffff09000080fff5dd00000010000100000c0900fcff0000040e05a5", 0x58}], 0x1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, &(0x7f0000000f4d)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x8, 0x0, &(0x7f0000000140)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], 0x0, 0x0, &(0x7f0000000340)}) 18:20:06 executing program 5: request_key(&(0x7f0000000240)='keyring\x00', &(0x7f0000000280)={'syz', 0x0}, &(0x7f00000002c0)='vboxnet1\x00', 0xfffffffffffffffe) r0 = accept4$inet6(0xffffffffffffff9c, &(0x7f0000000000)={0xa, 0x0, 0x0, @local}, &(0x7f0000000040)=0x1c, 0x800) r1 = eventfd(0x7) r2 = accept4$packet(0xffffffffffffff9c, 0x0, &(0x7f0000000080), 0x0) ioctl$FIDEDUPERANGE(r0, 0xc0189436, &(0x7f00000000c0)={0xc9c8, 0x0, 0x2, 0x0, 0x0, [{r1, 0x0, 0x100000000}, {r2, 0x0, 0x80}]}) ioctl$EVIOCGEFFECTS(r1, 0x80044584, &(0x7f0000000140)=""/82) [ 474.493911] binder: 31306:31321 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 474.502709] binder: 31307:31311 ioctl c0306201 20008fd0 returned -22 [ 474.529131] binder: 31306:31310 Release 1 refcount change on invalid ref -838912 ret -22 18:20:06 executing program 5: request_key(&(0x7f0000000140)='keyring\x00', &(0x7f0000000100)={'syz', 0x3}, &(0x7f00000002c0)='vboxnet1\x00', 0xfffffffffffffffe) r0 = getpid() capget(&(0x7f0000000080)={0x399f1336, r0}, &(0x7f00000000c0)={0x6, 0x401, 0x8, 0xfffffffffffffffb, 0x7ff, 0x634}) r1 = openat$selinux_policy(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/policy\x00', 0x0, 0x0) ioctl$BLKFLSBUF(r1, 0x1261, &(0x7f0000000040)=0x1) 18:20:06 executing program 3: add_key(&(0x7f00000000c0)='user\x00', &(0x7f0000000000)={'syz'}, &(0x7f0000000200)="82", 0x1, 0xfffffffffffffffb) [ 474.555320] binder: BINDER_SET_CONTEXT_MGR already set [ 474.560815] binder: 31323:31330 unknown command 0 [ 474.569977] binder: 31307:31334 unknown command -298933320 [ 474.574113] binder: 31307:31311 ioctl 40046207 0 returned -16 [ 474.585021] binder: 31323:31330 ioctl c0306201 200000c0 returned -22 [ 474.599576] binder: 31307:31334 ioctl c0306201 20008fd0 returned -22 18:20:07 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000300)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, &(0x7f0000012fc7)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, &(0x7f0000000f4d)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x8, 0x0, &(0x7f0000000140)=[@release], 0x0, 0x0, &(0x7f0000000340)}) r1 = openat$null(0xffffffffffffff9c, &(0x7f0000000000)='/dev/null\x00', 0x0, 0x0) getpeername$packet(0xffffffffffffffff, &(0x7f0000000440)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000480)=0x14) ioctl$TUNSETIFINDEX(r1, 0x400454da, &(0x7f00000004c0)=r2) 18:20:07 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000300)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, &(0x7f0000012fc7)}) r1 = socket$netlink(0x10, 0x3, 0x4) writev(r1, &(0x7f0000000000)=[{&(0x7f0000000200)="580000001400192340834b80040d8c5602067fffffff81000000000000dca87086a5c000004f6400940005891550f4a8000000006700008000f0fffeffff09000080fff5dd00000010000100000c0900fcff0000040e05a5", 0x58}], 0x1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, &(0x7f0000000f4d)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x8, 0x0, &(0x7f0000000140)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], 0x0, 0x0, &(0x7f0000000340)}) 18:20:07 executing program 4: r0 = syz_open_dev$binder(&(0x7f00000002c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000300)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, &(0x7f0000012fc7)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, &(0x7f0000000f4d)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000000c0)={0x8, 0x0, &(0x7f0000000140)=ANY=[@ANYBLOB="0d5b22663e9fd974"], 0x0, 0x0, &(0x7f0000000340)}) 18:20:07 executing program 0: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180)) r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x381000, 0x80) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x100000040003bb) add_key$keyring(&(0x7f0000000200)='keyring\x00', &(0x7f0000000240)={'syz'}, 0x0, 0x0, 0xfffffffffffffffb) 18:20:07 executing program 3: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) write$tun(r0, &(0x7f0000000100)={@val={0x0, 0x809b}, @void, @arp=@generic={0x205, 0x89af, 0x6, 0xd, 0xa, @broadcast, "9f73328c48bd74cac6eeba72c8", @broadcast, "99d51123e42e8739d7b52703aed140fb"}}, 0x35) getsockopt$inet6_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000000), &(0x7f0000000040)=0x14) r1 = openat$selinux_status(0xffffffffffffff9c, &(0x7f0000000080)='/selinux/status\x00', 0x0, 0x0) ioctl$TUNGETSNDBUF(r1, 0x800454d3, &(0x7f00000000c0)) 18:20:07 executing program 5: r0 = dup(0xffffffffffffff9c) write$selinux_load(r0, &(0x7f0000000300)={0xf97cff8c, 0x8, 'SE Linux', "65c76b63a6c269af7e375dab05a7b0078685f1ba4c282af2ba7eb50d61639041b4a26352e76124528c683c7769fc1e5e47491b7dd7e42097503a2f5a09f8e09344c21e121cc033dc9f248aa736f41028c9d7ccf07b69a8fb3ba26e2d72b7d09f704a1076dc3d9226a81bb6dc85ca5409aa74b8b41a9547c6a0e348ff59f0f5d3c594222b87bb8f1764d30a792685cc320eedf7c1d97f6e1827b23cfb7eb13e284e1df30f9bed85bcd1d5e43b5e876cd7a7d0499ef0a48521f773b935f02022423c8542316326fd27b57d56e6ea2d6b2e29f369f1156529e197c9ac5219eacfe28047eda985c0621c78fa7a3fe3d209522b4d8e699e7135888c853fd3a85e96eab98b3451834e8704a711015f4b814a2d49f298c0466d3b11bb795bc0eba98f7090f0b68e025ad6f99890c4ab6551bf6f60f7fbd23442a0b85f81ac1a565153718cae5868d5b4edc2f308e5c06c3ed19e747e33c6cdfbbba09b059563b115426efc619f336ea0b85ac84a713f91e4c5de5b7f86ed30a86f7c8726633e43146f4c1bc880f641bd2ba3f6f4a4464b05cfe2875cfbf57fd12dc683cad57da4cd2d511b13b21cdc8846eb7a4304cec0bdf5b384aaac0e5a8d07055ca0b15dc9e3826357060c612507d026b05ac14d2f18134fad01361f84344a692dec04738373cf828aab279fba67912781a34eec4ca73defbc5e1acb0ef463bbef253171ce512ec36877f11ed52f055bc55fb73345cf81facefd50198ea45eff908f2e7d69bc6bf4522e4b81b8f92d63107ab09535feb25e0ba717145db506410b581a6fbfb91af8d642361a9fc06c6a27c77df27b5c4a4bc9ebfdd1873fc1ef7ce6c7975648633666dfe2da8836aa3ad8f9b19a0b611dc9f3ee1cec5c989272d97d58d3a322267a81bfd16e4f54fafbe5c49dcd3a6273b696364657db61547bde254fae3e2c9813a5a66e17b5b2aecdea0e710c72b5f6f729e7042e868483818ee8707785905c66fd9521884bedb3b021127c37281dec2dd70fba26f66dce700af95a1b3e25ebd8e3d02dbedb144baf3d38652bf94fa6dd70826c011e2980b9dabd9fcd9d8bcf8b0cb06db6b894b13491d36090f83a28d594b216e2c25a51fcce7e94a7536711bd80102fb43f8bcc147ce67518aad5eb94e7bb1f60e6e2dac42dbdcdc97f04e133a6f9509cd5c0d27e3c8597fe41c90b464665acd48cd449f8f0679b2551124604d7fe3c811f0e4368007d461318a175ac28fe9f2848c34765b334b99c449ad2adbaaa7c1f4633922a039d29bd24629187717c9106b0ef0d597d92def41f8dd4ff64ef9f1b0bc9244884c3e6bbed0fcb0d92d96c3c12715349d27f722321b523f259c81b72ce3edf4ccc0028025b4b6fb7e584825231ba693bd68451c04b976908f65706fbe32111c465af3fa6200d087335dfc5ac9008dacf7a13b60af827a1c1f1239e488a6514fafcdf8c5f8b933e5436b9bec843c09a0dd5423029737b9e80dba0133cea9381015790ccc4c066b7bfbfb630b4e88af5f901815af98c7958763f0f5bdac878095c687caa1970bcf39d91c0c45f91387cc1a46ef7664f6f8d74be38838103912f0e57a79ae1f5d30c14022717ca257e0dd4f72ffbb0d08395c8da737f5821752758e064c9ee9bf6f9dd55d1bedad44d749d831e0de9763f5a68c9a79731c61c5a3521fa84595069d99eeb62c0275accb8a12f4c5b3d03504632ec74b4f573bdac2c4383197e853f7e17e176b5770b61b1b8ca24d3cc2482c6f077b6f2d2a72cb64eff74528b22bf4e003e3cafe25d389df0eab45e7ed2b820ad19a4f77b5f3ed6c4ddec1f28bfef1fcba9f55125cd0de6a3e26d5612f0e8fa3cea58410ab5f770bb205279584760a8759095c709a9b8048bfab1ab0ae9ac3f9b8fec740cc83439323266ac54493257c9f8ac1079034831e319074948a54048004eff777df4426d0e9404fef0a078452126d41a46dc548efe8dec4fee4806908c2531dc5756f1938aba6d47a585bb177c83fad4663afc3a5516ad2e49f27c2a9fd7a56d949ba7cbb0231a1c4eb28285a0cd757c230610154a9cbd1fd66b966eb09c27e3e0359e35b81e755f73de79fc6f308c9dfcb9ba235f61fc205e1857ec38c15d95fcaa9d8cb456f4e2f72eb509376c08bda3c1b48534e0dd687119f6bfb3efde58baab828021b4d16f4b8e9ec5b38786e00aedb388a8444f0f41dee2e27893c4682063ac5ab2a30b6fb25d5fa0dfc06dab72c51e3347407112c5f0b0689ecd9791aa2bba7d693a3a58cb17f120747a55990414a303b346e970a57bebf448ec97f59ade18422ec2a566d5dce3957fba0dc7ba3d8e504250c52e726b3ff821c2391104d95d56e68f59b0105500c6504355e6c5e14beb940b1566d41fde31578bded49cde4459a3d1c0c79f06e61abb609c05ffcc1768701f1b816cbe3ff743d851f780b4351e6cf2369e14a978ab70d8b4f2095f43722de81a252ff77341d7e3b0e5bf72e11303c42beabb541135410980376a491f3b0fd263dd5936891ed3df033983bf1ce9a72e6537b8dbf294aa15b005b3876323b06d0f0e739bd4d0b2283b7b53c799e0cb2c5ecd95805dfac3ef493c7381146525d776d7943423501796b33f529e7b6d32bb92fd35843eb0a7db7c79efe3c8ab671e99b82a84389f391871d1f843ea67e19f651230949bb69d3e3dbcc2a8c5bb259b19b757bdd62080d8fb177cb2ae4a7194ca1e75d214b488b78943babddde850973a639abc949b563cb861aff91b7e1efbb769b00676a72a049b58d7e50f2773aa1b096ce04fe768bbd719f9413925fd751d0b21e404611e18f397d3d44334ab584225e71b3a05d1a2b40b49fbf3cd2d9a2fbfabeb0ff0c5d1b71620bcac362ab0f274dd377fb10de77714d21215d05f2aefb290dcbc2aeb495c273f93d46685644e3ca34f49a231d1f9903b51bd1c4225cd83eded9844013fc537340eeaf941c74cbce6ed6d95bc208545e6110ec8bc1ab96e064a3e5bbc1f5356000624af4e102303162c43f2a0863337247164e95f388ee447c94aeb26c0f97bbeaccc93ac31afa6f01276144a61a75d1f6f03785e300bcb15b65db5e0ed836ddd9be5f58ae2a7900f263bb3821f49346e753a47238bef067a8cdc0915abd5bd7652fdcfc4076c5de59bfbbf93c1f93637ef273eea1911f0e55075cea17582925788927c76c3a38f7760dc26245829f870302b29c40509527ae7e28a48268979ed94e687d9420103de891d677ba4a554f464154f08eb77917bc4513a11a9ed76e1ea7a85ef7bab5b71d0d3ff033d41dcdc75b24159bc0363e61cfbba7ae6c402f07fc3ea045c4bfd7a612f6f27b22585a91522eebd6cb20711f823ae9f3c57ef8e064c1d9b20f712a59068123bc059d7161df0ccdeb448dcde08c1ee07508be7bf889514576f4701801c9afd13613b4d43588c97bf0aff45264d0d3903939d1bdf34d4284fd508a0003906744c942cd50c590918b01cdfdc154ed7e38eff9938183620a265bc441a8bb22c1622877dce0161bade6e2a199cf1805298fed07ebcdefdab4cda04d168aebb70f5a79c8dff4406d2041041e119628b1565ddad9be3b64e197bc1ff68a40e0e8238c7018838720813058391acb20a5531476b17fc7d39048c88fa23f4e471caabb9f6e9c3e6b81b0f78fa0c86cd3f7531f117f7d415b11faa5e9a9be1ea7f2021cc5d2ff20dfde34cf085341cf7e88a51f441dfc84541564c4c9eb0e1903f90a9309617512a02a3d7ac488ad288ee61bb545b97e7996aea8376302df0ec2b28abf3c001e1c7387ca5d73a24f235ef19609b3dd899705c2e51cd5f0cc6e53293e3c95988d8842cedfd914309430fea3e95c3949fea2ddc30095728d420f60859407769c237beaa7c2080dbf3a18be4d69d52d61b023b7bcdf5660f1ed00aaf68949cfaa52e9d2be176097de6cfe61f0b7151e32a0a6a9b2afc5ce6b8d1f0409d3e988526e20a59f0953d07b106e230eb1897e49cbeff8a70d7d80cf0ee914d0515c409654d346d614377a10b14d934e7994d2f797b1a6f4b97863b9e9cfd2e1c9c554a40ef4445dc486e63a4ed5cd161ab6af3e7a8dfa2e46b25338738fb8005f1cd99e633bda957a5543716415c5490cbbbda848e32147c28c727f4e64458c161bf919d73c40f1d2cdc333490d60827e326d98404d146fc67a93485216d961e89874d625e42857e1c0f3a1213d7dd55428305b178668b790b98b13b1be99f5251d084ee77004acdfce70b71b0fffec94748c7f5a9f6463f9178ef22f522a77ed3b1b4126946940764b5700e63f757bca1982f98c00dd2000ac6de8686cf202580bde50f0016c3a442ad79c694e73e1781cc971e5ffb417a93fafa4bcc91955d013a1e616bbf61444e4602268cdf129f9e139587212c3118ae1d7b7274c294a4dd40eabd79c021414fa8c71cb7fe8844827903e524a5925f580a6dcb48fb6b539a726b7c1f1be8b6e9eeb6df394350b24d5de596646dc236e0a0772cfab327004ac1a49d6b464e24f422d3adc126ba8ab379b665b224e3ba7bc677151e10f72af34155cb9201b493edecde507c0af7e813ca6616a7a098d2cbbbbf1ca253688786d99a57db7a0a6225542384c3094b5ba7ad686c87e1ebce432d15fb5ddc27a9bc0749a8bce273eb17cb9ce257e43b071a108a4e82c574e5d5c4c137f4968a3b85fb20081dedfbcf914dcf2295700eb5e9155dcf3ddd47ccfb6a8199bc9d407f8fea8fcedd097861fa6eee9bd6b06733afd855219de68c56ab5e65d3303c47a73c98b9c4254d0ea8222c034a5993ce06f6c06bf52714ea1d9e3660990df89cc7dc08a0e6f07e96289c5fbb73ae79e683eb7e0f2a7caa8cbf8ef6dfa5718748657656c233cad1cf05ad82ab8c052f9bc04d7a3a20b8da92e5aa30c070abf04356e0fdbaa6aaf8002c28de6a6471ef71a294e728feab34e620b92074174bfd0fe9b5acb19ad451f73e2603d20179f7e33342605d288aeff7322a4c4809c81ccbac1a384adb3097ff17aa7761a6d265030acf968c4d7902deda954b51be4fee03c58f6873e890084491f510d6d50ed2eccdbe8bad986fa86606684388ea0b35c360866d03d4d087aa43b406db3198bb6787c756e038c5234809daea91e3be7e2f3be464eabf6731edf10c1b6dc8ca88f9e93f6b317ad1f74e186e00b28a1a7ab84fc3dbd06b0bebb82cca17fdf5814c0f1d937426ffe131f82a2296aa870543d6e8bd0adf7ae9ddefda06901c6c858327e7790cdde45ffcea7e2328f51f4e9ad479013837b3e0d91be18d724c786e3434c5d0e4e3de4c3d57583796a9b260dd430c14ff63481a93ead00f7000ad5a9caf5d469b4215089787d7df9e2fccb5a0f72ef5e7fec86fd814eb55fefa0a2f82a67f25d09dfc0014517ade228c7fb6c98ff64c25611e4f2e95ccc7749ccec847d6168ff67f1b8829da0f4cb42c7928775973a659e38813790b8b5b8bc74cf456906a0deed98bb6bb55ee71c902390dc064248f11ff9c1b380f60d577cce8c8fa86494c6eb26d84db17c3b5cd52615f54c37fe55f734e67cdc7e0663d2348fa292fa26421ab0d4853b8b4974bb1b992c1cb9e08234204095a92f398113281386d7786c1132b7c6076349a396b644da8cc2a638032d003316da40caa27734eb31da0ca396c2d5ec8caf6b917ee0c5a700afb11cd70cbd35de265f4b8f20a582c47602f8a242adff2a65279c6ee157135a30226b308ce0de7d79d35598b2a35fc506144a83007b6a201bdbe1b166ea6fb72d9877ddf76"}, 0x1010) openat$selinux_load(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/load\x00', 0x2, 0x0) request_key(&(0x7f0000000240)='keyring\x00', &(0x7f0000000280)={'syz', 0x0}, &(0x7f00000002c0)='vboxnet1\x00', 0xfffffffffffffffe) [ 475.234255] binder: 31306:31321 Acquire 1 refcount change on invalid ref 0 ret -22 [ 475.234627] binder: 31306:31349 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 475.235110] binder: 31306:31350 Release 1 refcount change on invalid ref -838912 ret -22 18:20:07 executing program 3: add_key(&(0x7f0000000000)='pkcs7_test\x00', &(0x7f0000000040)={'syz', 0x1}, &(0x7f0000000240)="99a234fec0c6aea29e297d9ca87d82183f953bfded48b02e053dd05321e06caeed0bd6dbd3fce251ff0b1d540bd8cc7791e79122a3ac5440a98f50f643fd39abccad8cfbf2f491d21038c8e812892e7089255a3ea2a10945e72621a6157c817e3e831e07719cac7dc1dfa8fd61453f2c6b66bf2484a7562cfde55f4b286e80439832514173e8915a61b6edaef713dba4ffa3dae57c77ece16f34f1dacaa2139da7ad0ccff06f8bd1a62f5b227f1c2b7e6db2e3c69ffb90ea3657485a9844b885c1ab665186773b305369d3ceee057e8a228fa1d095e85b00d3e2f80166a3663f12d8a07eb032", 0xe6, 0xfffffffffffffffc) 18:20:07 executing program 5: request_key(&(0x7f0000000240)='keyring\x00', &(0x7f0000000280)={'syz', 0x0}, &(0x7f00000002c0)='vboxnet1\x00', 0xfffffffffffffffe) openat$null(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/null\x00', 0x800, 0x0) r0 = openat$zero(0xffffffffffffff9c, &(0x7f0000000100)='/dev/zero\x00', 0xa6dd28abde75cfd4, 0x0) r1 = openat$cgroup_ro(r0, &(0x7f0000000140)="0cd38ca261334c2182e358617400", 0x0, 0x0) r2 = getpgid(0xffffffffffffffff) getpgid(r2) setsockopt$inet6_int(r1, 0x29, 0xcf, &(0x7f0000000080)=0x100000001, 0x4) ioctl$BLKIOOPT(r1, 0x1279, &(0x7f0000000040)) 18:20:07 executing program 0: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x80000001) add_key$keyring(&(0x7f0000000200)='keyring\x00', &(0x7f0000000240)={'syz'}, 0x0, 0x0, 0xfffffffffffffffb) [ 475.283684] binder: 31352:31360 Acquire 1 refcount change on invalid ref 0 ret -22 [ 475.293966] binder: 31351:31359 unknown command 1713527565 [ 475.311698] binder: 31351:31359 ioctl c0306201 200000c0 returned -22 18:20:07 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000300)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, &(0x7f0000012fc7)}) r1 = socket$netlink(0x10, 0x3, 0x4) writev(r1, &(0x7f0000000000)=[{&(0x7f0000000200)="580000001400192340834b80040d8c5602067fffffff81000000000000dca87086a5c000004f6400940005891550f4a8000000006700008000f0fffeffff09000080fff5dd00000010000100000c0900fcff0000040e05a5", 0x58}], 0x1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, &(0x7f0000000f4d)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x8, 0x0, &(0x7f0000000140)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], 0x0, 0x0, &(0x7f0000000340)}) 18:20:07 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000300)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, &(0x7f0000012fc7)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, &(0x7f0000000f4d)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x8, 0x0, &(0x7f0000000140)=ANY=[@ANYBLOB], 0x0, 0x0, &(0x7f0000000340)}) 18:20:07 executing program 3: add_key(&(0x7f00000000c0)='user\x00', &(0x7f0000000100)={'syz'}, &(0x7f0000000200)="82", 0x1, 0xfffffffffffffffb) r0 = dup3(0xffffffffffffff9c, 0xffffffffffffff9c, 0x0) r1 = memfd_create(&(0x7f0000000000)='\x00', 0x4) fcntl$dupfd(r0, 0x406, r1) [ 475.347007] binder: BINDER_SET_CONTEXT_MGR already set [ 475.351521] binder: 31352:31360 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 475.352983] binder: 31352:31360 unknown command 0 [ 475.352991] binder: 31352:31360 ioctl c0306201 200000c0 returned -22 18:20:07 executing program 0: r0 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000040)='/selinux/enforce\x00', 0x0, 0x0) fcntl$getflags(r0, 0x40b) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) add_key$keyring(&(0x7f0000000200)='keyring\x00', &(0x7f0000000240)={'syz'}, 0x0, 0x0, 0xfffffffffffffffb) syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x800) 18:20:07 executing program 5: r0 = dup(0xffffffffffffff9c) setsockopt$sock_void(r0, 0x1, 0x24, 0x0, 0x0) request_key(&(0x7f0000000240)='keyring\x00', &(0x7f0000000280)={'syz', 0x0}, &(0x7f00000002c0)='vboxnet1\x00', 0xfffffffffffffffe) [ 475.403212] binder: 31351:31382 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 475.415019] binder: 31351:31374 Acquire 1 refcount change on invalid ref 0 ret -22 [ 475.423093] binder: 31383:31387 Acquire 1 refcount change on invalid ref 0 ret -22 [ 475.447151] binder: 31351:31359 ioctl 40046207 0 returned -16 18:20:07 executing program 4: r0 = syz_open_dev$binder(&(0x7f00000002c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000300)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, &(0x7f0000012fc7)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, &(0x7f0000000f4d)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000000c0)={0x8, 0x0, &(0x7f0000000140)=ANY=[@ANYBLOB="0663044017000000"], 0x0, 0x0, &(0x7f0000000340)}) [ 475.456987] binder: 31383:31387 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 475.467739] binder: 31381:31389 Acquire 1 refcount change on invalid ref 0 ret -22 [ 475.482277] binder: 31383:31387 unknown command 0 [ 475.497476] binder: 31381:31389 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 18:20:07 executing program 0: r0 = openat$selinux_status(0xffffffffffffff9c, &(0x7f0000000040)='/selinux/status\x00', 0x0, 0x0) socketpair$unix(0x1, 0x0, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) getsockopt$inet_pktinfo(r0, 0x0, 0x8, &(0x7f0000000080)={0x0, @local, @broadcast}, &(0x7f00000000c0)=0xc) add_key$keyring(&(0x7f0000000200)='keyring\x00', &(0x7f0000000240)={'syz'}, 0x0, 0x0, 0xfffffffffffffffb) 18:20:07 executing program 5: request_key(&(0x7f0000000240)='keyring\x00', &(0x7f0000000280)={'syz', 0x0}, &(0x7f00000002c0)='vboxnet1\x00', 0xfffffffffffffffe) r0 = getpid() r1 = eventfd2(0x1, 0x1) lseek(r1, 0x0, 0x2) ptrace$PTRACE_SECCOMP_GET_FILTER(0x420c, r0, 0x8, &(0x7f0000000000)=""/173) 18:20:07 executing program 3: r0 = memfd_create(&(0x7f0000000000)='user\x00', 0x6) ioctl$RTC_UIE_OFF(r0, 0x7004) add_key(&(0x7f00000000c0)='user\x00', &(0x7f0000000100)={'syz'}, &(0x7f0000000200)="82", 0x1, 0xfffffffffffffffb) getsockopt$inet6_tcp_buf(r0, 0x6, 0x1e, &(0x7f0000000040)=""/40, &(0x7f0000000080)=0x28) [ 475.507127] binder: 31383:31387 ioctl c0306201 200000c0 returned -22 [ 475.535379] binder: 31381:31389 unknown command 0 [ 475.542320] binder: 31381:31389 ioctl c0306201 200000c0 returned -22 18:20:07 executing program 3: add_key(&(0x7f00000000c0)='user\x00', &(0x7f0000000000)={'syz'}, &(0x7f0000000100)="82", 0x1, 0xfffffffffffffffb) syz_emit_ethernet(0x5a, &(0x7f0000000040)={@broadcast, @remote, [{[], {0x8100, 0xf15, 0x400, 0x3}}], {@canfd={0xd, {{0x0, 0xfffffffffffffffd, 0x7, 0x101}, 0x1c, 0x3, 0x0, 0x0, "6e121999b23954dbb5fee9ba5ad1130ca3b1fbd1cd8e352ff6785dab1469e33e29027cb979b90df4f22b5ea2282000d0e1b17a38f4695ecd940c06fc38978593"}}}}, &(0x7f0000000140)={0x1, 0x1, [0x23c, 0xb41, 0x348, 0xbce]}) [ 475.551255] binder: 31383:31387 Acquire 1 refcount change on invalid ref 0 ret -22 [ 475.567595] binder: 31383:31404 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 475.575765] binder: 31400:31402 Release 1 refcount change on invalid ref 23 ret -22 18:20:07 executing program 0: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x9) add_key$keyring(&(0x7f0000000200)='keyring\x00', &(0x7f0000000240)={'syz'}, 0x0, 0x0, 0xfffffffffffffffb) 18:20:07 executing program 5: r0 = openat$selinux_avc_cache_threshold(0xffffffffffffff9c, &(0x7f0000000300)='/selinux/avc/cache_threshold\x00', 0x2, 0x0) accept$packet(r0, 0x0, &(0x7f0000000040)) setsockopt$inet6_MRT6_DEL_MFC(r0, 0x29, 0xcd, &(0x7f0000000080)={{0xa, 0x4e23}, {0xa, 0x4e22, 0x1, @local, 0x3}, 0x1, [0x1, 0x101, 0x800, 0x100000000, 0x7, 0xffffffffffffffff, 0x7, 0xfffffffffffffffa]}, 0x5c) request_key(&(0x7f0000000240)='keyring\x00', &(0x7f0000000280)={'syz', 0x0}, &(0x7f0000000000)='vboxnet1\x00', 0xfffffffffffffffe) [ 475.614232] binder: BINDER_SET_CONTEXT_MGR already set 18:20:07 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000300)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, &(0x7f0000012fc7)}) r1 = socket$netlink(0x10, 0x3, 0x4) writev(r1, &(0x7f0000000000)=[{&(0x7f0000000200)="580000001400192340834b80040d8c5602067fffffff81000000000000dca87086a5c000004f6400940005891550f4a8000000006700008000f0fffeffff09000080fff5dd00000010000100000c0900fcff0000040e05a5", 0x58}], 0x1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, &(0x7f0000000f4d)}) 18:20:07 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000300)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000000340)=ANY=[@ANYBLOB="24f0e383e1b4a1249d4d6abe21b7b14c3da8655d2bb6ce38dc86c077eac1f4f9f2b471b9f868afa06c6ab402f07c483b665aeb939cf4435b3eccfe878650ec5bba39f6403fe36d7581441fe143d1d65f623b8840efb3bf9d3b489a51d2c54c233a05b5ed7fa966846cfaf0760c90973dcfeef34e54e6c3e30e64a72378a9360a13345f5c9efc165455931ad8ed730841ec26ccd91af10ab13857131d31ff4c278d61cc2e8be75b64628a9ca48e30836d470b64c8b643d578c91329444cf66157c55176b3"], 0x0, 0x0, &(0x7f0000012fc7)}) openat$selinux_status(0xffffffffffffff9c, &(0x7f0000000040)='/selinux/status\x00', 0x0, 0x0) fcntl$F_SET_RW_HINT(r0, 0x40c, &(0x7f0000000000)=0x2) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="882f3ac2b2fc0741190c49d2a2d757af87b8cfc391901212d2ccadc97f347bbbee8df716268babcce57daba553d0d2e49c9fda83e8866500387cabe43aac7be555dfd5a66de3f75b41fe8a4f607c13314f71d9fe91efe7ecaf60364c14865249d4f75283b7347dc839ef268b568c6c54a37c0d66254fb738745797db58307a44c8cfb4e8b71111fed075c6b780376c303a14a81a1f3c64dfa0b03a646e0bce"], 0x0, 0x0, &(0x7f0000000f4d)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x8, 0x0, &(0x7f0000000140)=ANY=[@ANYBLOB="0c9b49319d190100"], 0x0, 0x0, &(0x7f0000000340)}) 18:20:07 executing program 3: add_key(&(0x7f00000000c0)='user\x00', &(0x7f0000000100)={'syz'}, &(0x7f0000000200)="82", 0x1, 0xfffffffffffffffb) getrandom(0xfffffffffffffffd, 0x0, 0x3) r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x2000, 0x41) ioctl$TUNDETACHFILTER(r0, 0x401054d6, 0x0) [ 475.636913] binder: 31400:31402 ioctl 40046207 0 returned -16 18:20:07 executing program 0: socketpair$unix(0x1, 0x7, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) add_key$keyring(&(0x7f0000000200)='keyring\x00', &(0x7f0000000240)={'syz'}, 0x0, 0x0, 0xfffffffffffffffb) fcntl$setflags(r0, 0x2, 0x1) lsetxattr$trusted_overlay_origin(&(0x7f0000000140)='./file0\x00', &(0x7f00000001c0)='trusted.overlay.origin\x00', &(0x7f0000000280)='y\x00', 0x2, 0x2) fsetxattr$trusted_overlay_opaque(r0, &(0x7f0000000000)='trusted.overlay.opaque\x00', &(0x7f0000000040)='y\x00', 0x2, 0x3) r2 = openat$selinux_status(0xffffffffffffff9c, &(0x7f0000000080)='/selinux/status\x00', 0x0, 0x0) setsockopt$inet_tcp_TCP_FASTOPEN_KEY(r2, 0x6, 0x21, &(0x7f00000000c0)="a021830a22090cd8195125ca41ed82b7", 0xfffffffffffffecc) accept$packet(r2, &(0x7f0000000380)={0x11, 0x0, 0x0}, &(0x7f00000003c0)=0x14) lstat(&(0x7f0000000400)='./file0\x00', &(0x7f0000000440)={0x0, 0x0, 0x0, 0x0, 0x0}) mknod$loop(&(0x7f00000002c0)='./file0\x00', 0x8040, 0x1) sendmsg$nl_xfrm(r2, &(0x7f0000001740)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x40000000}, 0xc, &(0x7f0000001700)={&(0x7f00000004c0)=@newpolicy={0x1230, 0x13, 0x8, 0x70bd2c, 0x25dfdbfc, {{@in6=@remote, @in6, 0x4e22, 0x4, 0x4e23, 0xfffffffffffffffd, 0x0, 0x20, 0xa0, 0x0, r3, r4}, {0x268, 0x6, 0x9, 0x1a, 0x9, 0xfffffffffffffc00, 0x4, 0x5129}, {0xd1, 0x9, 0x7b18, 0xfffffffffffffff8}, 0x80000000000000, 0x6e6bba, 0x2, 0x1, 0x2}, [@algo_auth_trunc={0x104c, 0x14, {{'wp384\x00'}, 0x8000, 0x80, "c858a735a9d3f43d04932c81a8c8c5d61149bf9193c469535c39cad51a9619763dfb7e31afed7c06da984609888c2a3b70f7adfd42f264aae9a50841d3fcb1444260d50beba2968a2efa6be0401f23d5dca88b02e766db540f608469bbf2ff9a4b63eba5ea48eb523cb397edfcb407f00836389d9ea466ce7e446d409363714729f3edcb741e34594811e12eedad7c06bf062c46426c414804abd0991338499086a0c4a1399c7d95bb4fb05b58d4f32d0d235bd461b7a994289927c7628f4a2be3b8b545879ad4c20c879b4779a9e446be835c275edc4d2f96993db922c696cb4bcba8a6bc8096f37cf11b177c6a855c63488b21b7ef0f46b26a38157e8ca42997fc6d6058f9faebaf349325cda891f18db6da5fe3cd744372819719034981a7d3f22e9d7d496eb94c3e9e1422821286888686acd7ad7d203ec6e506422fa1c2530e94d1796f5f37214e80dc8d7a70c3e8f6592587fed4f4b11ba950e2b200bdc40ab6eb5f3714f899c1e61fa0b7bf3aadf647528e66063c5d72f2e86e72083f3792dc6c566b158cb5a8ce95ab66d9f768a5cbc0504a69505f80ad99280b93b843195ca21d449d84ef53f27fb8631faa329ae4249986e018a2bc0c7cae7a3c81cf7124f9483a04ce32a2b77adc4a1c2644a28750f78707e208a984e43a0bc70be4276cb6b3571f49216824fdc7381e8f3f4ad6b08899be3c8578ded20ce3ea4b78525891092a32caf42e56626b114b15ff6606699fe0df348a8b5b104f6629c9b1753ea09f755a28f61fb8b6d7a3cfd99b8e3996e5f4b890541f9ab34bd70b223a366375e6112e47c9dfdf53f13dab32829bc66c495afb8abf6802d749b3df391b902b02f87b3cd887dd9c5218a8881206839c4aafc98a7032639600b5b92dfd352b28f7400b6ce1d4a47b7a7499ad7937e48f1f5fba16fe32beeaa1915dab1c573eb1b763e6d4974bca61eeb84ce07061ce1b4309f898ade473bcae71b7fe6b0e1d3fcf6d85d91dcc3aa90931b66a45b8080ec29eaf0982129fe24ade4e924619316dfb6e2ce050f4e9d77192b7118712116eae22f4a023f4f202373610c8a52f04ec104d052e798c36d337a70011f76ed327b949b2be5b641cf6b9f1b63c2fcdb5ac8e0473a2ebbb25d3d5ba34ade74c0d9d9c7ceca4f0c233d9db7d6e6e1ba54434f5167ce834827036171dd1336e6bc5571a64f557e1b101f55ee09667422ef0fc1e664446abbf538ed080daa46deff6ef0fcf6cbeae5a1ff79f9b9a505c05352019941e82d7aed078b983c840b583bcd8ffa4bd2baba7baabbea9165c0087ccb6098fbef2374db29b781c02209312b16338b538db86b2f51a43a0b909a57a18ba7b7b1df0316eca935c6531f2ab625570ce3573c13790be22187b3af6a1d79574642eb33cbf2be1348eb1b745fbebe5f2be45d87c3fd1a283007d256f54a06eb38bf2bf799076e771ba9a55bbfb3f142886972e1ed13599b282b2e381e06893cd6ff44e80f1fd1b96d3040ddc81d25505a4150b56ab943f0a0ee0823f910fb9c350f49b36c659e630a0139cfdae667cf4bd8ed4b86ead604243fb071dabc1c357604497c04c10086361702cac67a934599bfe4578d0361b63dd37a9a356e22e968e842995b4ce12d6cf436b73ecea3fcb060e4cafd7f74983c3908feb7aece631be10d304f48b860e9dfb5548df9c4e38ff648b49b1a0508ae52cfb3c3c233db35bb4f11162644f4732ec29cc0f2917636944068e229505cb4816922e28d78a4db0d9a25496db0b3897b229b32d8667b5d31f44b26e7d1683c6eb5dd39d399d9c55a51a6fc80a32903b4c5e95d023bcb2bc838b6d5d043295e37298c1c9197fe3960b704bea0bdea2e3391c2939e876566b1ffdd09390e06575219754f6b2405074d1f55c4b946cb19cc5f20951a37d67e64595bf2bb85b1d66b1dc422db2528d42c2bd4e45a48098e9430cfe8c7ee87da11303f2246806c15518ac5b7a1c56c25e0ea13133f609f11e11e491f0647fcb137b291a57e8a8ed543db28619301f34e283f68131472d60a194c4fd5640430096b468b5b6f680e5ee33639877cf986c9f43aa3608042f200abfd1692c32134d83c873a06b815beee2cd3c85d2444931f788c6dd3cf30dbe4f115647b1e4af89f16e044dfb5186c9e2ad0f2a3bf93c704492117c0021198ea0c90bf1e64e9dd6528d80a022bd247631f5560310e9dd372dda74bddb28978ffb156444231f8a4d1909cda7dba82df71e1d2fbe00cf5ddb841f5bbcfc75c56e172c66923fdca5fe964c4e352ded176d2fc23447aac057085aa5be2535122a16b8bc6dd88241dbd82470e08e83de56034acdc5ed671f4c5872ef93f4ef3fffd9c662f52e2ecf22fbd76a654cc6730017d2a05176a0a927cfc0afb2f0743d184901f03b60ec9625dcc3b73c652e928a715ba9b16fbe1a98a4452d74b4c5be5ae2551ae0ca41ac29346be4bc7a6d24680c58b463274b5ac9a1d2ad5d286e7e572b314e4128701110503f43379ed58677d14fdefcd13398156e99c573f9d9825f23c538f6eec689323cd5d0dbc31d50abffba9c0548142302f88a439fe204710457625ac2662c284c477c34689753e0f3e0a68d438c1bae6c3b27bc5e6483e7e1c5a948d15d44688430fac9d2ca3a12f88b59740004ccdd79fba3b0bc163f5f7d53b98d58056b6772148ce6121b2a68a80e88517e37f1012571e394bccb9a62803a3c67f7ffd6de75b7776fc02785d0a574fb5db7ece16e2096cccdc6b0e132259ddcc4aaa3191d110d15556edda9d05b7efade3369123e23679f81058109af2a74b568a83eeea79739b7491f981ccc80affa02765ae6986f88430d15f0707615861e3c45538bca26dc1dfcc8b410176bab69e3d45a588f45f2d436c568e602e6186613db52127799ab23027a29f05a674d5728d06ebe5ff6d17f7f06e4c84d71b6be8b05317a287186c1fde40a646060e7259edf94aa765943cf4212a58a619f42f1fdd5f570ca375ea92c0a5ab509b0c373b9720c5781d8c9c20c46d2eb54a198546565e65269b3cb892451ded364d5ae49109169ee489f9fee00a3ee43c1f8a323ec95a1567b4f3e7bb13c9873c85a9f576c25f7ce33b9fad7d22cbc9c4a3ebca062eff7c8866cb6e31a02f39df99f5560110c556370256cb3d37ba4f0d3e6133b68b6b5abee1747d88010896060b374427a550f5d3aff09294b3e0fd81ba54612ef30a42a089347f2a85adb64718ee72770b2e5fdb39ae68cd0ec3df228606d9ca444c1f07d6c09aa119cf3fa707442c218829a6daa1cded897b640e84a3cbc6838f2121ae89362b63cf97308315ac96a21b3508c44ca43341f265388bc8b923566c74fa5bbc7998707e1e72b0132ee20edcf088d8639d1241d25e3dc152d76fc69a7399689bdad999ecf642296535c345aad7a0a54623d0f28065650d8bc37090c76bd913b901bd45797f7cf37a19e316679b050c3b676fbda15bf7f548d04e729c96a5f5263b3c4a99d66cf94d69831a166bbd4418110679f3042531b4d59e2b81777bcd584b252c6efa50c99e16e65b99fa8b7d060fadc954baaebe19befdb39792bedd2f27779e973c4df7d8fa1a3c9db11124a9f6014b8583b0e8a0e6aacd113cc030ec1af3cfaad950d4da75b4cd00e570013e50b8aaf92a5a324e529aa6a56714104e4d428f830d30c68f937bede92d9aa8970d66fcc2c6aea1eb77805af753e1ab221e73ffcd4366af468f5760ac020dfebad9bd04d6fc7ea121a9801fc40e18026325cd39e47153d4463859eccd766988c5b3d2da08297b1944d12e7398b28a27bdb233bf3326bb7b0bfe1d6e8a02134ea7f5f5ee6fc22586e7a939b065ce97b872160a20534cbc9301800bd593520ec381c26bf0b7b88bb712d2afe9787b824870c0a34b97d04a729c99769732206c05b7573b2f6b43267053c055bfa5bf624070fdbac182dbf724580f35c0131485fa6cdc94aa5a60f0e1e3a300392c0a4987f00827b17acf635aedf6f7cb926763c297a7482b89f9e69f360e2c30385b945175abe8c9a38f206569927a30079b3ab410e0d20670709eeb2ae0c26ef83bde23ed0627fc9a891dc7806dfe8b89572f2b499adb72b39c65fca62049abacbb19e4cf557ad6c406a385e55dcb18497ae8c9d050bf48adf2f5f7900cbbd91def24e2cee127927138bc80b5db7339a8a186d6dbf0f436147ba274342f4479d3845dcfb8406673fcd28248a5d9a816a0fea70b559457dc8e810e1f6a7146a6492cbaaa9e6b5c48f6f9e1f0ecd6285ac11920d87c41c323b10cddc6361d3a3e031b341507649cb4aed836a09a36e6bd4ababb9da7e0ab5c2d7ad130049681c266c919bc25a9172e70c76a4e4b76bd1694e94e5198f6821ac5900118207c2279331e34bc1dbcd3b715eac374a62c69c63ab3d89a5123753d84524d3a14674611d2c67869db887f7932be7867e5351d502019507819ee41bd705b61beae2b3b1fb849880b364d5a865c147130626aed4a811ccc583587f073f12e48f1d87004707f6d9b270712e03255deb9759b0bfaa506a897bbf035edea692fda980846366a8d9a5ca8e54fe0c1797b1af8f38b9fe08bd18318a975453d607b73b3f235f97c24c8f11a2112de4c4dd2554447c45e142cb2b5806e71455462721326c21b59b11d5b40ee9aaff0f65a6c77e9b4538bc4301659ec0b0d530c86c45f2e49c3f74c8be2733db3b200fe98da1de2c0006c2514658c9b7e91a9cee6fc7e7d10fb6025922731bf224c3219fb00029db1971364999f13fc1358ec3f0a4c5b1744fbdc0f75acf449880be4f8097b8695494a27692658b0e5366022d9da23905c0af56e495a69914080319fcc8ce3a64fa595e6cd772c1c2fb28e68d47042a3a74e9eab15a6156e42041e41a3f32183a28452b00c0bba11ac17e92950b2e4c9e4565d7af2d0d4cc74b22822887376e76b0606d1bfc1acb5a643c0c2a46def77c1194d273caba5b6426e244c094413f16901cd4e32e70d82c16ad05b7c4f43d9f550f39d6bf341a584718603b69d2ef2d9023545026294221cdf8ed615620ce0bc1908dd5f489dd6122c71714fdf091d04f7f1ea983b22edc8c21b8e9f7fa6e9885416a6b551df102b06cada90c8c8ed6b533956214ec30fae00e57fe316d8d648aaebd5167fdda42b60a00d8b1740fcf54e2bb926ca313aac2a33681272eabb8b3bcb0c8e223004e68e5d9e93914461ebd2c81c0322a8cb3a47025c556c8dfbd6cbc81f29dbbbd839dc86358ebf33c759c3a864d5c97ebfcf65794bc606406b9819da6482d28413fd3487525c0f2b5cbf2973bdab0c315cd66303e5a2d3d535959631169a0959b7fbe39e472eb8df1fda2bf697b85967fdfbda6e984d279d05d9e9063dcd90722499e44b12a15b08b975015b98a4148afd95ba5f707cd677c70b2f38afd29cbf4d176cc0405f908cf5d447a8e96930dbb67f8761bee1bb52cd0f3ae16e0f612c3d1edba067dc71d4fb314cb22ac378075f7e9c4c2f4d02ebffbf76acfa638c9fa19a5e01ebca4f9ec28a9c26a0053cd9b9bf38b3ac845f666f36c9357845094d6efe5e3b2200ec80cd7b9ba7e020f3bedb7378282c75901fb182e732fdae3a5467ed86792c57656f2bbd7def2cb8b8ffa7fb92b8c53fdb1a4b0c55afb7da72cdc847db5a6155318cd5b4e231439aeb83695a6d67613c8faf8767a497bd1814ad81ed1802d062868a24db3b8d0e9db615796a7a5c72c7616c766e78c70c3dcdb7aa021a1c129b7eab3f9a2c99123977b22e4"}}, @algo_comp={0x104, 0x3, {{'lzjh\x00'}, 0x5e0, "59614ed1fd27c4e7978d10fbfbddcd7e3f3bdd2cd01f0f8618f525580d83f64ae3f084e0f217ee5850ef72e1493c37af305bccbcecc8924550ce3fda7ff372ca7105bca5c24ea2e1e151d8bc104aff2bc6c05c4f1e4cbaf5cf7aebc811934175dc7205adb937985f8a302ebe620b9f38b9d6c6b6728a3dda367f7063119ecca91a7d6192182426d31f003d9e24e52c8f53e8d8b14cc3d644c713a0268c2f65c43203bb7d69942f5ac866d2b089b9043dc70c80f99381ec6821bbd79e"}}, @address_filter={0x28, 0x1a, {@in6=@mcast1, @in6=@mcast1, 0xa, 0x0, 0xea}}]}, 0x1230}, 0x1, 0x0, 0x0, 0xc0}, 0x20000000) 18:20:07 executing program 4: r0 = syz_open_dev$binder(&(0x7f00000002c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000300)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, &(0x7f0000012fc7)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=ANY=[@ANYBLOB="0e630c4008000000"], 0x0, 0x0, &(0x7f0000000f4d)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000000c0)={0x8, 0x0, &(0x7f0000000140)=[@release], 0x0, 0x0, &(0x7f0000000340)}) r2 = openat$pfkey(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/net/pfkey\x00', 0x4000, 0x0) ioctl$KDGETKEYCODE(r2, 0x4b4c, &(0x7f0000000040)={0x8, 0x4}) r3 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000080)='/dev/rtc0\x00', 0x200, 0x0) r4 = syz_genetlink_get_family_id$team(&(0x7f0000000180)='team\x00') getsockopt$inet_IP_IPSEC_POLICY(r3, 0x0, 0x10, &(0x7f0000000880)={{{@in6=@ipv4={[], [], @multicast1}, @in6=@remote, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@local}, 0x0, @in=@rand_addr}}, &(0x7f0000000980)=0xe8) getsockopt$inet6_mreq(r2, 0x29, 0x15, &(0x7f00000009c0)={@dev, 0x0}, &(0x7f0000000a00)=0x14) ioctl$FICLONE(r1, 0x40049409, r0) sendmsg$TEAM_CMD_NOOP(r2, &(0x7f0000000b00)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x30}, 0xc, &(0x7f0000000ac0)={&(0x7f0000000a40)={0x60, r4, 0x4, 0x70bd29, 0x25dfdbfb, {}, [{{0x8, 0x1, r5}, {0x44, 0x2, [{0x40, 0x1, @lb_port_stats={{{0x24, 0x1, 'lb_port_stats\x00'}, {0x8}, {0x8}}, {0x8, 0x6, r6}}}]}}]}, 0x60}, 0x1, 0x0, 0x0, 0x20040015}, 0x54) ioctl$sock_inet6_tcp_SIOCOUTQ(r2, 0x5411, &(0x7f00000001c0)) 18:20:07 executing program 5: r0 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) fcntl$getown(r0, 0x9) r1 = add_key$keyring(&(0x7f0000000080)='keyring\x00', &(0x7f00000000c0)={'syz', 0x1}, 0x0, 0x0, 0xfffffffffffffff9) r2 = add_key$keyring(&(0x7f0000000000)='keyring\x00', &(0x7f0000000040)={'syz', 0x3}, 0x0, 0x0, r1) add_key$keyring(&(0x7f00000001c0)='keyring\x00', &(0x7f0000000140)={'syz', 0x0}, 0x0, 0x0, r2) request_key(&(0x7f0000000240)='keyring\x00', &(0x7f0000000280)={'syz', 0x0}, &(0x7f00000002c0)='vboxnet1\x00', 0xfffffffffffffffe) fcntl$F_SET_FILE_RW_HINT(r0, 0x40e, &(0x7f0000000100)=0x7) [ 475.681684] binder: 31426:31428 Acquire 1 refcount change on invalid ref 0 ret -22 [ 475.713910] binder: 31427:31434 unknown command -2082213852 18:20:07 executing program 3: add_key(&(0x7f00000000c0)='user\x00', &(0x7f0000000100)={'syz'}, &(0x7f0000000200)="82", 0x1, 0xfffffffffffffffb) r0 = openat$selinux_load(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/load\x00', 0x2, 0x0) fsetxattr$security_ima(r0, &(0x7f0000000040)='security.ima\x00', &(0x7f0000000080)=@ng={0x4, 0x12, "dc6daa79dfc875b8c9"}, 0x270, 0x2) 18:20:07 executing program 0: r0 = add_key$keyring(&(0x7f0000000040)='keyring\x00', &(0x7f00000000c0)={'syz', 0x1}, 0x0, 0x0, 0x0) r1 = request_key(&(0x7f0000000100)='logon\x00', &(0x7f0000000140)={'syz', 0x1}, &(0x7f0000000180)='syz', 0xfffffffffffffffb) keyctl$reject(0x13, r0, 0x100, 0x1436, r1) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000080)='/selinux/commit_pending_bools\x00', 0x1, 0x0) prctl$void(0x27) ioctl$PERF_EVENT_IOC_PAUSE_OUTPUT(r3, 0x40042409, 0x1) add_key$keyring(&(0x7f0000000200)='keyring\x00', &(0x7f0000000240)={'syz'}, 0x0, 0x0, 0xfffffffffffffffb) [ 475.737964] binder: 31426:31439 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 475.742363] binder: 31436:31440 BC_REQUEST_DEATH_NOTIFICATION invalid ref 8 [ 475.753988] binder: 31427:31434 ioctl c0306201 20012000 returned -22 [ 475.765362] binder: 31427:31447 unknown command -1036374136 18:20:07 executing program 3: r0 = add_key(&(0x7f0000000040)='user\x00', &(0x7f0000000080)={'syz', 0x3}, 0x0, 0x0, 0xfffffffffffffffa) add_key(&(0x7f0000000240)="6396097e83d17a61c1494357b803d4df9c3ff3f0dcf5e5fbe50fdc00e7908d22f07eefd4ffd1dc743a3c5411ca287d566de2799e3db44b1f28430273496f50254aad8a36dd465fef6dbdeae78e996fc23e16c28357c56d197ed93df383bb089e12ed490f9640024e6a57ede9263a88ce5adeae36fbb72ab0623b8f748d11b095862138a4addf16f18fc1529139e73a8569124241d5b37edf9b26ba9663e3d15d6b677e6dc8b856d18878a20d7dd52324e8afb623d4f0bb1100064ba521fa9bbdd91cb938a6111d7196ef495630e5ce5ab71e21cd5a", &(0x7f0000000000)={'syz'}, &(0x7f0000000340)="0c1b03bd8a1128436307000000000000005ef7357269e115df712e2d52cf1aa69e157b082c2f0fbe778ffa7219d8a3b9ea390fe2196d7ef05cdaf33b24e49af4caa4e600b61520175d51735226e5499c421c26c0246211661e6cf8706adc62648dfdac885cf04f175e0dc457d3d8aa51ff276c0370df7c7e3e8db85ff97ec1d027503c0487d497bb2aeee388538a5b8f456fc22bce7b8a967241eb1ceec758d8255726ad6e07ed90c10dc2232bb3dfd38b644e129aab0e4fe4457c7e634e1fc06acdc24fef580b72bd9a1c9f571afb179d31bf118f2b422113674d76f058392b122b2d51fb285eecf0395b6830bfbe542846b7caf70a2a61be", 0xf9, r0) 18:20:07 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000300)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, &(0x7f0000012fc7)}) r1 = socket$netlink(0x10, 0x3, 0x4) writev(r1, &(0x7f0000000000)=[{&(0x7f0000000200)="580000001400192340834b80040d8c5602067fffffff81000000000000dca87086a5c000004f6400940005891550f4a8000000006700008000f0fffeffff09000080fff5dd00000010000100000c0900fcff0000040e05a5", 0x58}], 0x1) 18:20:07 executing program 5: request_key(&(0x7f0000000240)='keyring\x00', &(0x7f0000000280)={'syz', 0x0}, &(0x7f00000002c0), 0xfffffffffffffffe) [ 475.799897] binder: 31436:31451 ioctl 40049409 3 returned -22 [ 475.810903] binder: 31427:31447 ioctl c0306201 20008fd0 returned -22 [ 475.817392] binder: BINDER_SET_CONTEXT_MGR already set [ 475.817401] binder: 31436:31440 ioctl 40046207 0 returned -16 [ 475.818517] binder: 31436:31451 BC_REQUEST_DEATH_NOTIFICATION invalid ref 8 [ 475.825478] binder: 31436:31457 ioctl 40049409 6 returned -22 [ 475.843599] binder: 31427:31434 unknown command 826907404 18:20:07 executing program 4: r0 = syz_open_dev$binder(&(0x7f00000002c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000300)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, &(0x7f0000012fc7)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, &(0x7f0000000f4d)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000000c0)={0x8, 0x0, &(0x7f0000000180)=[@register_looper], 0x185, 0x0, &(0x7f0000000200)="2aeaf8cebd47c03203897f1dfb4f27e7c3216b9fae8f31c33680245379084e4d115fe59d60c3500532322b217cc018700648361b4b96e3bbcb07596efb870e1c3db9148741f0d582b81ff89d4150645a53bee7923d3a81a4d370a6b0438ec948e3755ae66c0200000000000000"}) 18:20:08 executing program 0: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = syz_open_dev$evdev(&(0x7f0000000000)='/dev/input/event#\x00', 0x5, 0x181000) ioctl$EVIOCGBITSW(r1, 0x80404525, &(0x7f0000000040)=""/187) add_key$keyring(&(0x7f0000000200)='keyring\x00', &(0x7f0000000240)={'syz'}, 0x0, 0x0, 0xfffffffffffffffb) [ 475.860470] binder: 31427:31434 ioctl c0306201 200000c0 returned -22 [ 475.907730] binder: 31462:31469 Acquire 1 refcount change on invalid ref 0 ret -22 [ 475.921816] binder: 31465:31468 ERROR: BC_REGISTER_LOOPER called without request [ 475.949089] binder: 31427:31434 unknown command -2082213852 [ 475.950932] binder: 31465:31468 unknown command 0 [ 475.950941] binder: 31465:31468 ioctl c0306201 200000c0 returned -22 [ 475.951797] binder: BINDER_SET_CONTEXT_MGR already set [ 475.951805] binder: 31465:31468 ioctl 40046207 0 returned -16 [ 475.972829] binder: 31427:31474 unknown command -1036374136 [ 475.972838] binder: 31427:31474 ioctl c0306201 20008fd0 returned -22 18:20:08 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000300)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, &(0x7f0000012fc7)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, &(0x7f0000000f4d)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x8, 0x0, &(0x7f0000000140)=[@release], 0x0, 0x0, &(0x7f0000000340)}) r1 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x18000, 0x0) setsockopt$inet6_MCAST_LEAVE_GROUP(r1, 0x29, 0x2d, &(0x7f0000000180)={0x8, {{0xa, 0x4e21, 0x4, @loopback, 0x7}}}, 0x88) 18:20:08 executing program 3: add_key(&(0x7f00000000c0)='user\x00', &(0x7f0000000100)={'syz'}, &(0x7f0000000200)="82", 0x1, 0xfffffffffffffffb) r0 = openat$full(0xffffffffffffff9c, &(0x7f0000000000)='/dev/full\x00', 0x0, 0x0) ioctl$EVIOCGREP(r0, 0x80084503, &(0x7f0000000240)=""/4096) 18:20:08 executing program 5: request_key(&(0x7f0000000000)='syzkaller\x00', &(0x7f0000000280)={'syz', 0x0}, &(0x7f00000002c0)='vboxnet1\x00', 0xfffffffffffffffe) r0 = openat(0xffffffffffffffff, &(0x7f0000000040)='./file0\x00', 0x0, 0x10) shutdown(r0, 0x0) lsetxattr$security_selinux(&(0x7f0000000100)='./file0\x00', &(0x7f0000000140)='security.selinux\x00', &(0x7f0000000180)='system_u:object_r:cgroup_t:s0\x00', 0x1e, 0x1) getsockopt$IP6T_SO_GET_REVISION_TARGET(r0, 0x29, 0x45, &(0x7f0000000080)={'icmp6\x00'}, &(0x7f00000000c0)=0x1e) 18:20:08 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000300)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, &(0x7f0000012fc7)}) writev(0xffffffffffffffff, &(0x7f0000000000)=[{&(0x7f0000000200)="580000001400192340834b80040d8c5602067fffffff81000000000000dca87086a5c000004f6400940005891550f4a8000000006700008000f0fffeffff09000080fff5dd00000010000100000c0900fcff0000040e05a5", 0x58}], 0x1) 18:20:08 executing program 0: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) add_key$keyring(&(0x7f0000000200)='keyring\x00', &(0x7f0000000240)={'syz'}, 0x0, 0x0, 0xfffffffffffffffb) socketpair$unix(0x1, 0x7, 0x0, &(0x7f0000000000)) 18:20:08 executing program 4: r0 = syz_open_dev$binder(&(0x7f00000002c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000300)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, &(0x7f0000012fc7)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, &(0x7f0000000f4d)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000000c0)={0x8, 0x0, &(0x7f0000000140)=[@release], 0x0, 0x0, &(0x7f0000000340)}) r2 = openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/commit_pending_bools\x00', 0x1, 0x0) epoll_ctl$EPOLL_CTL_ADD(r2, 0x1, r1, &(0x7f0000000040)={0x2006}) 18:20:08 executing program 3: add_key(&(0x7f00000000c0)='user\x00', &(0x7f0000000100)={'syz'}, &(0x7f0000000200)="82", 0x1, 0xfffffffffffffffb) r0 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x10200, 0x0) ioctl$RTC_PIE_ON(r0, 0x7005) 18:20:08 executing program 2: syz_open_dev$binder(&(0x7f0000000300)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = socket$netlink(0x10, 0x3, 0x4) writev(r0, &(0x7f0000000000)=[{&(0x7f0000000200)="580000001400192340834b80040d8c5602067fffffff81000000000000dca87086a5c000004f6400940005891550f4a8000000006700008000f0fffeffff09000080fff5dd00000010000100000c0900fcff0000040e05a5", 0x58}], 0x1) [ 476.018923] binder: 31427:31434 ioctl c0306201 20012000 returned -22 [ 476.054710] binder: BINDER_SET_CONTEXT_MGR already set 18:20:08 executing program 0: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000000)='ifb0\x00', 0x10) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) add_key$keyring(&(0x7f0000000200)='keyring\x00', &(0x7f0000000240)={'syz'}, 0x0, 0x0, 0xfffffffffffffffb) 18:20:08 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000300)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, &(0x7f0000012fc7)}) r1 = add_key(&(0x7f0000000000)='rxrpc_s\x00', &(0x7f0000000040)={'syz', 0x3}, 0x0, 0x0, 0xfffffffffffffff9) keyctl$revoke(0x3, r1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, &(0x7f0000000f4d)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x8, 0x0, &(0x7f0000000140)=[@release], 0x0, 0x0, &(0x7f0000000340)}) [ 476.085152] binder: 31483:31495 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 476.087202] binder: 31483:31487 ioctl 40046207 0 returned -16 18:20:08 executing program 2: r0 = socket$netlink(0x10, 0x3, 0x4) writev(r0, &(0x7f0000000000)=[{&(0x7f0000000200)="580000001400192340834b80040d8c5602067fffffff81000000000000dca87086a5c000004f6400940005891550f4a8000000006700008000f0fffeffff09000080fff5dd00000010000100000c0900fcff0000040e05a5", 0x58}], 0x1) 18:20:08 executing program 5: r0 = request_key(&(0x7f0000000240)='keyring\x00', &(0x7f0000000280)={'syz', 0x0}, &(0x7f00000002c0)='vboxnet1\x00', 0xfffffffffffffffe) request_key(&(0x7f0000000000)='logon\x00', &(0x7f0000000040)={'syz', 0x1}, &(0x7f0000000080)='syz', r0) 18:20:08 executing program 0: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) add_key$keyring(&(0x7f0000000200)='keyring\x00', &(0x7f0000000240)={'syz'}, 0x0, 0x0, 0xfffffffffffffffb) [ 476.133474] binder: 31506:31509 Acquire 1 refcount change on invalid ref 0 ret -22 18:20:08 executing program 3: add_key(&(0x7f00000000c0)='user\x00', &(0x7f0000000100)={'syz'}, &(0x7f0000000200)="82", 0x1, 0xfffffffffffffffb) r0 = dup(0xffffffffffffff9c) ioctl$FS_IOC_SETFSLABEL(r0, 0x41009432, &(0x7f0000000240)="3c071e587741397c43e7c651ecc70615a6f3e2046e50f5356a67e0026371a5dce87c9991324c9aaadcb075673799cdb9baae331b6762dc48c84fe02b0c4408a966b0d992e18c495d825fb37c4f1b01f39c4d908cf9a5a6aae70073d56f750d0ccc56fea5fe95950dd859b167ddd13058d9d8afe771941a64c3318b45562f2641fc68a7638e930360ffe3baa48fe694e6d5513746fbf29b1d2e9d8e072ae74b7fdbe68f89284ec74633c7d0f0002959dc3743ea72124db197643e69349f6e19f68fea552138faa422317577f31915dea42d07b1d6ebc103cd6a1c4cc27a975489311c6749cb8dc4bc2181739f614eb2ece040ebe860e6ae12102669a9fa89c85a") 18:20:08 executing program 4: r0 = syz_open_dev$binder(&(0x7f00000002c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000300)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rtc0\x00', 0x400, 0x0) setsockopt$inet_mtu(r2, 0x0, 0xa, &(0x7f0000000040)=0x1, 0x4) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, &(0x7f0000012fc7)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=ANY=[@ANYBLOB="0502e98867b9e541"], 0x0, 0x0, &(0x7f0000000f4d)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000000c0)={0x8, 0x0, &(0x7f0000000140)=[@release], 0x0, 0x0, &(0x7f0000000340)}) [ 476.177774] binder: 31506:31509 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 18:20:08 executing program 5: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000000)='memory.events\x00', 0x0, 0x0) ioctl$PERF_EVENT_IOC_MODIFY_ATTRIBUTES(r0, 0x4008240b, &(0x7f0000000080)={0x2, 0x70, 0x2, 0x0, 0x9, 0x9, 0x0, 0x1f, 0x48, 0x2, 0xae2b, 0x7, 0x1ff, 0x7, 0x10001, 0x1ff, 0x2, 0x3f, 0x1, 0x2, 0x1, 0x708, 0xf0d8, 0x5, 0xbff, 0x0, 0x5491, 0x1, 0x1000, 0x8, 0x47ecf87, 0xf37a, 0xfffffffffffffffe, 0x1, 0x6, 0x8, 0x9f40, 0x9, 0x0, 0x5f, 0x2, @perf_bp={&(0x7f0000000040), 0x4}, 0x210, 0x6, 0x1c, 0x7, 0xa0e, 0x20, 0x4}) request_key(&(0x7f0000000240)='keyring\x00', &(0x7f0000000280)={'syz', 0x0}, &(0x7f00000002c0)='vboxnet1\x00', 0xfffffffffffffffe) 18:20:08 executing program 2: r0 = socket$netlink(0x10, 0x3, 0x0) writev(r0, &(0x7f0000000000)=[{&(0x7f0000000200)="580000001400192340834b80040d8c5602067fffffff81000000000000dca87086a5c000004f6400940005891550f4a8000000006700008000f0fffeffff09000080fff5dd00000010000100000c0900fcff0000040e05a5", 0x58}], 0x1) 18:20:08 executing program 3: r0 = add_key(&(0x7f00000000c0)='user\x00', &(0x7f0000000100)={'syz'}, &(0x7f0000000200)="82", 0x1, 0xfffffffffffffffb) request_key(&(0x7f0000000000)='keyring\x00', &(0x7f0000000040)={'syz', 0x0}, &(0x7f0000000080)='user\x00', r0) 18:20:08 executing program 0: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180)) openat$selinux_mls(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/mls\x00', 0x0, 0x0) pipe(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) add_key$keyring(&(0x7f0000000200)='keyring\x00', &(0x7f0000000240)={'syz'}, 0x0, 0x0, 0xfffffffffffffffb) 18:20:08 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000300)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, &(0x7f0000012fc7)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, &(0x7f0000000f4d)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x8, 0x0, &(0x7f0000000140)=[@release], 0x0, 0x0, &(0x7f0000000340)}) r1 = open(&(0x7f0000000000)='./file0\x00', 0x10000, 0x4) mkdirat$cgroup(r1, &(0x7f0000000040)='syz0\x00', 0x1ff) [ 476.221492] binder: 31506:31509 Release 1 refcount change on invalid ref 0 ret -22 [ 476.232374] binder: 31522:31524 unknown command -1997995515 [ 476.249414] binder: 31522:31524 ioctl c0306201 20008fd0 returned -22 18:20:08 executing program 5: request_key(&(0x7f0000000240)='user\x00', &(0x7f0000000140)={'syz', 0x0}, &(0x7f00000002c0)='vboxnet1\x00', 0xfffffffffffffffe) r0 = memfd_create(&(0x7f0000000000)='vboxnet1\x00', 0x1) write$P9_RREAD(r0, &(0x7f0000000100)={0x33, 0x75, 0x1, {0x28, "48bcc9c9ec5543a1008ab33c0d0d62ace735713cb71ef02ec4e2eadd1023ad65984ea0200b0a6d04"}}, 0x33) ioctl$KDGKBDIACR(r0, 0x4b4a, &(0x7f0000000040)=""/184) [ 476.300119] binder: BINDER_SET_CONTEXT_MGR already set [ 476.312715] binder: 31522:31540 unknown command -1997995515 [ 476.329890] netlink: 64 bytes leftover after parsing attributes in process `syz-executor2'. [ 476.341864] binder: 31522:31524 ioctl 40046207 0 returned -16 18:20:08 executing program 3: keyctl$join(0x1, &(0x7f00000001c0)={'syz', 0x0}) r0 = add_key$keyring(&(0x7f0000000000)='keyring\x00', &(0x7f0000000040)={'syz', 0x0}, 0x0, 0x0, 0xfffffffffffffffd) add_key(&(0x7f00000000c0)='user\x00', &(0x7f0000000080)={'syz'}, &(0x7f0000000200)="82", 0x1, r0) r1 = accept4$inet6(0xffffffffffffff9c, &(0x7f0000000100)={0xa, 0x0, 0x0, @loopback}, &(0x7f0000000140)=0x1c, 0x80800) fsetxattr$trusted_overlay_upper(r1, &(0x7f0000000180)='trusted.overlay.upper\x00', &(0x7f00000003c0)=ANY=[@ANYBLOB="00fbf40001cbf16f63cad2e00469db39bc183cbf01501056435626d737425ba53cbf0818d026e3c833f215f241c12555ba6feac0d0d4d5429b343c3c3de41e1d76541348ea531b86fa19a7b9a68afb97733f7b62f93248468d6596215f9638f723f1c559b8f50e709e0a3776d4f8eb7995c2be5d4231eb4647a4901b0fca38fb1f9f52cf2b41629244aa6fbde18603003ecd40c45c38969442f34dc81ba3ae10f225768f0a5d9736aba42d33047a8a9f54e864a28607afc4a2451a6bfd148e38a93b6f1259e355f1f819ac74a5e9ab8c77b1710eb339de0d29f29640f7e8ffa21b6f84d07f93ec40dc2be03ddc4b11b5da7119d2cb77982564d55644ac9c2b0cf329a062e105056db25a90523cd85d58fd19ba3cb0ab251510a4a00a7c42ccc0b0b08ba7258d5bcf326ae551f76aa28ffc496858a49fc166e5c63409000000c4edaaf33a9b33d3581ad3f3f8b114333be3"], 0xf4, 0x2) 18:20:08 executing program 0: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$FIDEDUPERANGE(r0, 0xc0189436, &(0x7f0000000000)=ANY=[@ANYBLOB="020000000000000004000000000000000200000000000000", @ANYRES32=r1, @ANYBLOB="00000000080000000000000000000000000000eaffffff0000000000", @ANYRES32=r0, @ANYBLOB="00000000010000000000000000000000000000000000000000000000"]) r2 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000080)='/dev/rtc0\x00', 0x50000, 0x0) getdents64(r2, &(0x7f00000000c0)=""/24, 0x18) add_key$keyring(&(0x7f0000000200)='keyring\x00', &(0x7f0000000240)={'syz'}, 0x0, 0x0, 0xfffffffffffffffb) ioctl$FS_IOC_SET_ENCRYPTION_POLICY(r1, 0x800c6613, &(0x7f00000001c0)={0x0, @aes256, 0x2, "5b19f358ab82c077"}) 18:20:08 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000300)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000005fd4)=ANY=[@ANYBLOB="056320000000"], 0x0, 0x0, &(0x7f0000012fc7)}) ioctl$FS_IOC_SETFSLABEL(r0, 0x41009432, &(0x7f0000000180)="36daaaa32dc05bd4e5dd46e0ace75d9ae2a9377a4a2c58adf59f00749c6e18e8106c10162b53fad4b8383bbbd8ac3f4d9893b1b605f1e119b178ce9bef0fc2f24efc0e0cd1273326889d92e07319c61a38416533d6346f06e397e21d314e2e34a142553af5d4e3fd32ffc306c02a50d0f7c247d470f7ca84bd2dde2c245145e4ae4f18c1daebe3a30c51d2500c381d0f01616f451bb89142cebf06aa61063567370a40a0392ec8f75fe51d28fbb419244e4f119b8164315dc89d7c3a7f9d8ac6ff7f73cc2a591423281c84c6fa686da532898cf1f053f6d9fdf4974f6a9ce3d23958508c6e2af23954b4bb337298681054f2c5c50c79f579030e2bc632cebe6b") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0e630c4000000000db34e3a64f3f17821753098b00000000"], 0x0, 0x0, &(0x7f0000000f4d)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x8, 0x0, &(0x7f0000000140)=[@release], 0x0, 0x0, &(0x7f0000000340)}) 18:20:08 executing program 2: r0 = socket$netlink(0x10, 0x3, 0x0) writev(r0, &(0x7f0000000000)=[{&(0x7f0000000200)="580000001400192340834b80040d8c5602067fffffff81000000000000dca87086a5c000004f6400940005891550f4a8000000006700008000f0fffeffff09000080fff5dd00000010000100000c0900fcff0000040e05a5", 0x58}], 0x1) [ 476.351701] binder: 31522:31540 ioctl c0306201 20008fd0 returned -22 18:20:08 executing program 4: r0 = syz_open_dev$binder(&(0x7f00000002c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000300)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000005fd4)=ANY=[@ANYBLOB="00000000edffffff"], 0x0, 0x0, &(0x7f0000012fc7)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, &(0x7f0000000f4d)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000000c0)={0x8, 0x0, &(0x7f0000000140)=[@release], 0x0, 0x0, &(0x7f0000000340)}) 18:20:08 executing program 5: r0 = openat$rtc(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/rtc0\x00', 0x400000, 0x0) perf_event_open$cgroup(&(0x7f0000000040)={0x4, 0x70, 0xfff, 0x8, 0x5, 0x1, 0x0, 0xff, 0x0, 0x0, 0x80000001, 0x400, 0x6, 0xffff, 0x3, 0x2, 0x5, 0x7, 0x8, 0x80000001, 0x8, 0xf3d5, 0x7, 0x1, 0x8, 0x6, 0x2, 0x2, 0x9, 0x1, 0x400, 0x9, 0xffff, 0x1, 0x6, 0x7f, 0x100, 0x7fff, 0x0, 0x1, 0x0, @perf_bp={&(0x7f0000000000), 0xa}, 0x2000, 0x1, 0x0, 0x0, 0x7, 0x8}, r0, 0xe, 0xffffffffffffff9c, 0xa) request_key(&(0x7f0000000240)='keyring\x00', &(0x7f0000000280)={'syz', 0x0}, &(0x7f00000002c0)='vboxnet1\x00', 0xfffffffffffffffe) [ 476.434611] binder: 31557:31562 unknown command 2122501 [ 476.450426] netlink: 64 bytes leftover after parsing attributes in process `syz-executor2'. [ 476.473099] binder: 31563:31568 unknown command 0 18:20:08 executing program 3: socket$inet6(0xa, 0x800, 0x8000) r0 = openat$selinux_avc_hash_stats(0xffffffffffffff9c, &(0x7f0000000100)='/selinux/avc/hash_stats\x00', 0x0, 0x0) setsockopt$inet6_IPV6_ADDRFORM(r0, 0x29, 0x1, &(0x7f0000000040), 0x4) [ 476.482995] binder: 31557:31571 ioctl 41009432 20000180 returned -22 [ 476.494256] binder: 31557:31562 ioctl c0306201 20012000 returned -22 [ 476.506458] binder: 31557:31571 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 476.507880] binder: 31563:31568 ioctl c0306201 20012000 returned -22 [ 476.509725] binder: 31563:31568 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 18:20:08 executing program 2: r0 = socket$netlink(0x10, 0x3, 0x0) writev(r0, &(0x7f0000000000)=[{&(0x7f0000000200)="580000001400192340834b80040d8c5602067fffffff81000000000000dca87086a5c000004f6400940005891550f4a8000000006700008000f0fffeffff09000080fff5dd00000010000100000c0900fcff0000040e05a5", 0x58}], 0x1) 18:20:08 executing program 0: pipe(&(0x7f0000000000)={0xffffffffffffffff}) ioctl$GIO_UNISCRNMAP(r0, 0x4b69, &(0x7f0000000040)=""/244) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) truncate(&(0x7f00000002c0)='./file0\x00', 0x8) fsetxattr$security_selinux(r2, &(0x7f00000001c0)='security.selinux\x00', &(0x7f0000000280)='system_u:object_r:lirc_device_t:s0\x00', 0x23, 0x1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$FS_IOC_SETFLAGS(r1, 0x40086602, &(0x7f0000000180)=0x1) add_key$keyring(&(0x7f0000000200)='keyring\x00', &(0x7f0000000240)={'syz'}, 0x0, 0x0, 0xfffffffffffffffb) 18:20:08 executing program 5: request_key(&(0x7f0000000240)='keyring\x00', &(0x7f0000000280)={'syz', 0x0}, &(0x7f00000002c0)='vboxnet1\x00', 0xfffffffffffffffe) r0 = syz_open_dev$sndtimer(&(0x7f0000000000)='/dev/snd/timer\x00', 0x0, 0x10000) finit_module(r0, &(0x7f0000000040)='vboxnet1\x00', 0x1) [ 476.509813] binder: 31563:31568 Release 1 refcount change on invalid ref 0 ret -22 [ 476.511459] binder: BINDER_SET_CONTEXT_MGR already set [ 476.511468] binder: 31563:31568 ioctl 40046207 0 returned -16 [ 476.549827] binder: 31557:31562 Release 1 refcount change on invalid ref 0 ret -22 [ 476.555629] binder: 31563:31568 unknown command 0 [ 476.555639] binder: 31563:31568 ioctl c0306201 20012000 returned -22 [ 476.575484] binder: 31563:31581 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 18:20:08 executing program 4: r0 = syz_open_dev$binder(&(0x7f00000002c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000300)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, &(0x7f0000012fc7)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, &(0x7f0000000f4d)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000000c0)={0x8, 0x0, &(0x7f0000000140)=ANY=[@ANYBLOB="10"], 0x0, 0x0, &(0x7f0000000340)}) 18:20:08 executing program 3: r0 = add_key(&(0x7f00000000c0)='user\x00', &(0x7f0000000100)={'syz', 0x2}, &(0x7f0000000080)="82", 0xfffffffffffffdc3, 0xfffffffffffffffb) keyctl$revoke(0x3, r0) 18:20:08 executing program 5: request_key(&(0x7f0000000240)='keyring\x00', &(0x7f0000000280)={'syz', 0x0}, &(0x7f00000002c0)='vboxnet1\x00', 0xfffffffffffffffe) r0 = openat$selinux_avc_cache_threshold(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/avc/cache_threshold\x00', 0x2, 0x0) ioctl$TCXONC(r0, 0x540a, 0x8001) 18:20:08 executing program 2: socket$netlink(0x10, 0x3, 0x4) writev(0xffffffffffffffff, &(0x7f0000000000)=[{&(0x7f0000000200)="580000001400192340834b80040d8c5602067fffffff81000000000000dca87086a5c000004f6400940005891550f4a8000000006700008000f0fffeffff09000080fff5dd00000010000100000c0900fcff0000040e05a5", 0x58}], 0x1) [ 476.601188] audit: type=1400 audit(1539627608.693:51): avc: denied { relabelto } for pid=31585 comm="syz-executor0" name="UNIX" dev="sockfs" ino=125947 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=system_u:object_r:lirc_device_t:s0 tclass=unix_dgram_socket permissive=1 [ 476.632225] netlink: 64 bytes leftover after parsing attributes in process `syz-executor2'. [ 476.666603] binder: 31557:31571 ioctl 41009432 20000180 returned -22 [ 476.673223] binder: 31557:31562 unknown command 2122501 [ 476.679997] binder: 31557:31562 ioctl c0306201 20012000 returned -22 [ 476.688078] binder: 31557:31571 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 476.700776] binder: 31557:31600 Release 1 refcount change on invalid ref 0 ret -22 [ 476.701324] binder: 31591:31601 unknown command 16 [ 476.701332] binder: 31591:31601 ioctl c0306201 200000c0 returned -22 [ 476.702736] binder: BINDER_SET_CONTEXT_MGR already set [ 476.702744] binder: 31591:31601 ioctl 40046207 0 returned -16 [ 476.734545] binder: 31591:31603 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 18:20:08 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000300)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, &(0x7f0000012fc7)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, &(0x7f0000000f4d)}) r1 = openat$zero(0xffffffffffffff9c, &(0x7f0000000000)='/dev/zero\x00', 0x300, 0x0) getsockopt$inet6_tcp_int(r1, 0x6, 0x7, &(0x7f0000000040), &(0x7f0000000080)=0x4) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x8, 0x0, &(0x7f0000000140)=[@release], 0x0, 0x0, &(0x7f0000000340)}) 18:20:08 executing program 3: r0 = add_key(&(0x7f0000000040)='big_key\x00', &(0x7f0000000100)={'syz', 0x3}, &(0x7f0000000080)="82", 0x1ba, 0x0) r1 = socket$inet_udp(0x2, 0x2, 0x0) read(r1, &(0x7f0000000380)=""/147, 0x93) add_key(&(0x7f0000000000)='.dead\x00', &(0x7f00000000c0)={'syz', 0x2}, &(0x7f0000000140)="d64db0b00c5e7945d4964f0f68e3f0303a2a5e31c118d19e3a898809cadfbdd48dfa5de47d46f714b6058ca236231b23044ef46b59131a1d5153fba97aa2e6", 0x3f, r0) r2 = openat$selinux_avc_cache_stats(0xffffffffffffff9c, &(0x7f0000000300)='/selinux/avc/cache_stats\x00', 0x0, 0x0) r3 = accept$inet(r2, &(0x7f0000000200)={0x2, 0x0, @rand_addr}, &(0x7f0000000340)=0x10) ioctl$sock_inet_tcp_SIOCINQ(r3, 0x541b, &(0x7f0000000280)) add_key$keyring(&(0x7f0000000180)='keyring\x00', &(0x7f00000001c0)={'syz', 0x0}, 0x0, 0x0, r0) 18:20:08 executing program 2: r0 = socket$netlink(0x10, 0x3, 0x4) writev(r0, &(0x7f0000000000), 0x0) 18:20:08 executing program 0: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = add_key$keyring(&(0x7f0000000000)='keyring\x00', &(0x7f0000000040)={'syz', 0x1}, 0x0, 0x0, 0xfffffffffffffff9) add_key$keyring(&(0x7f0000000200)='keyring\x00', &(0x7f0000000080)={'syz'}, 0x0, 0x0, r1) 18:20:08 executing program 4: r0 = syz_open_dev$binder(&(0x7f00000002c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000300)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, &(0x7f0000012fc7)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, &(0x7f0000000f4d)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000000c0)={0x8, 0x0, &(0x7f0000000140)=[@release], 0x0, 0x0, &(0x7f0000000340)}) 18:20:08 executing program 5: r0 = creat(&(0x7f0000000200)='./file0\x00', 0x87) ioctl$BINDER_SET_MAX_THREADS(r0, 0x40046205, 0x3) r1 = accept4(0xffffffffffffffff, &(0x7f0000000000)=@l2, &(0x7f0000000080)=0x80, 0x800) getsockopt$inet6_IPV6_IPSEC_POLICY(r1, 0x29, 0x22, &(0x7f00000000c0)={{{@in, @in6=@mcast1}}, {{@in=@broadcast}, 0x0, @in6=@ipv4={[], [], @dev}}}, &(0x7f00000001c0)=0xe8) request_key(&(0x7f0000000240)='keyring\x00', &(0x7f0000000280)={'syz', 0x0}, &(0x7f00000002c0)='vboxnet1\x00', 0xfffffffffffffffe) [ 476.811560] binder: BINDER_SET_CONTEXT_MGR already set 18:20:08 executing program 0: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) setxattr$security_ima(&(0x7f0000000000)='./file0\x00', &(0x7f0000000040)='security.ima\x00', &(0x7f0000000080)=@md5={0x1, "552265d0dbfd3c20fae47277cac53cbd"}, 0x11, 0x1) add_key$keyring(&(0x7f0000000200)='keyring\x00', &(0x7f0000000240)={'syz'}, 0x0, 0x0, 0xfffffffffffffffb) 18:20:08 executing program 2: r0 = socket$netlink(0x10, 0x3, 0x4) writev(r0, &(0x7f0000000000), 0x0) [ 476.841657] binder: 31611:31625 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 476.867642] binder: 31611:31619 ioctl 40046207 0 returned -16 [ 476.875389] binder: 31620:31626 Acquire 1 refcount change on invalid ref 0 ret -22 18:20:09 executing program 2: r0 = socket$netlink(0x10, 0x3, 0x4) writev(r0, &(0x7f0000000000), 0x0) 18:20:09 executing program 0: r0 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ppp\x00', 0x101080, 0x0) ioctl$LOOP_SET_CAPACITY(r0, 0x4c07) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180)) ioctl$LOOP_SET_STATUS(r0, 0x4c02, &(0x7f0000000280)={0x0, 0x0, 0x0, 0x0, 0x8, 0x9, 0x10, 0x3, "d1d673085d6c0fb10cdc31f244a2df6f7e21ebe18c53782cad5c26a393920491bdff68aa27860e3d1e8504dd438edf7a3700", "a62f6cea3699118fa5479cbf17a366841d64939d85010037d137f50e1dccb2b9", [0x8, 0x9]}) add_key$keyring(&(0x7f0000000200)='keyring\x00', &(0x7f0000000240)={'syz'}, 0x0, 0x0, 0xfffffffffffffffb) 18:20:09 executing program 4: r0 = syz_open_dev$binder(&(0x7f00000002c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000300)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, &(0x7f0000012fc7)}) r2 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rtc0\x00', 0x80802, 0x0) ioctl$IOC_PR_RELEASE(r2, 0x401070ca, &(0x7f0000000040)={0x8000, 0x60, 0x1}) fcntl$getownex(r0, 0x10, &(0x7f0000000080)) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, &(0x7f0000000f4d)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000000c0)={0x8, 0x0, &(0x7f0000000140)=[@release], 0x0, 0x0, &(0x7f0000000340)}) 18:20:09 executing program 5: r0 = add_key(&(0x7f0000000100)='rxrpc\x00', &(0x7f0000000140)={'syz', 0x0}, &(0x7f0000000300)="56d6e4279b373cb0ce7928ef9279a290de03418008cbe84ff3ffc8d90a7da02be18cd924cdba05a6dc8d939882b6888fcee4efe0a687a827768fe370391e8e550d6da0ad2744dc4823617469722628880608416a4a85559a263bb272fc7bdb366c45ee6a6ffcef64249bb2b4a8ab063316f2e998c98ed204bd0f4cfc82dca4222a4777a7ab4cf2669fc542b2bfa4e8838563218e45268950fdcf34bf727a8b151843201233ed740161eaa098d1a116fdf096a270c71378709422206b0df80ccb1eca9073331d74745496965a9262", 0xce, 0xfffffffffffffffb) request_key(&(0x7f0000000240)='keyring\x00', &(0x7f0000000280)={'syz', 0x0}, &(0x7f00000002c0)='vboxnet1\x00', r0) r1 = openat$selinux_policy(0xffffffffffffff9c, &(0x7f0000000080)='/selinux/policy\x00', 0x0, 0x0) memfd_create(&(0x7f0000000180)=',vmnet1-em1^vmnet0./bdevposix_acl_access[{$@\x00', 0x5) r2 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0x0, 0x800) ioctl$LOOP_SET_FD(r1, 0x4c00, r2) r3 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rtc0\x00', 0x24000, 0x0) ioctl$PERF_EVENT_IOC_QUERY_BPF(r3, 0xc008240a, &(0x7f0000000040)={0x2, 0x0, [0x0, 0x0]}) [ 476.907897] binder: 31620:31634 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 476.963440] binder: BINDER_SET_CONTEXT_MGR already set 18:20:09 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000300)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, &(0x7f0000000f4d)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x8, 0x0, &(0x7f0000000140)=[@release], 0x0, 0x0, &(0x7f0000000340)}) [ 476.992244] binder: 31646:31650 ioctl 40046207 0 returned -16 [ 477.046277] binder: 31661:31662 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 477.069269] binder: 31661:31662 Release 1 refcount change on invalid ref 0 ret -22 [ 477.085582] binder: 31661:31662 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 477.093329] binder: 31661:31666 Release 1 refcount change on invalid ref 0 ret -22 18:20:09 executing program 3: r0 = openat$full(0xffffffffffffff9c, &(0x7f0000000040)='/dev/full\x00', 0x800, 0x0) ioctl$TIOCMSET(r0, 0x5418, &(0x7f0000000080)=0x1000) r1 = dup3(0xffffffffffffff9c, 0xffffffffffffff9c, 0x80000) ioctl$TIOCCONS(r1, 0x541d) ioctl$TIOCEXCL(r1, 0x540c) add_key(&(0x7f00000000c0)='user\x00', &(0x7f0000000100)={'syz'}, &(0x7f0000000200)="82", 0x1, 0xfffffffffffffffb) openat$ion(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ion\x00', 0x81, 0x0) 18:20:09 executing program 2: r0 = socket$netlink(0x10, 0x3, 0x4) writev(r0, &(0x7f0000000000)=[{&(0x7f0000000200)}], 0x1) 18:20:09 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000300)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0563044000000000e525d9da7bc4eb8b675c7c6be9c3b3196c6704dd0da85abfccde12442e4329cac0150d28aee4a3fa0702d57b34cc95c69b11827246fc3eb8edf03c3e8eb405d4adbe8a29642a691d5c28efd1124a43799e3321"], 0x0, 0x0, &(0x7f0000012fc7)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=ANY=[@ANYBLOB="0e63124000000000"], 0x0, 0x0, &(0x7f0000000f4d)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x8, 0x0, &(0x7f0000000140)=[@release], 0x0, 0x0, &(0x7f0000000340)}) 18:20:09 executing program 4: r0 = syz_open_dev$binder(&(0x7f00000002c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) openat$zero(0xffffffffffffff9c, &(0x7f0000000000)='/dev/zero\x00', 0x101000, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000300)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000005fd4)=ANY=[@ANYBLOB="0000000000000200"], 0x0, 0x0, &(0x7f0000012fc7)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, &(0x7f0000000f4d)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000000c0)={0x8, 0x0, &(0x7f0000000140)=[@release], 0x0, 0x0, &(0x7f0000000340)}) 18:20:09 executing program 5: request_key(&(0x7f0000000040)='keyring\x00', &(0x7f0000000000)={'syz', 0x0}, &(0x7f00000002c0)='vboxnet1\x00', 0xfffffffffffffffe) pipe(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) syz_open_dev$sndtimer(&(0x7f0000000280)='/dev/snd/timer\x00', 0x0, 0x20002) write$FUSE_OPEN(r0, &(0x7f0000000080)={0x20, 0x0, 0x8000000000000004, {0x0, 0x6}}, 0xfffffffffffffe60) r2 = openat$tun(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/net/tun\x00', 0x800, 0x0) ppoll(&(0x7f0000000140)=[{r2, 0x14}, {r1, 0x4000}, {r1, 0x8000}, {r1, 0x10}, {r0, 0x200}, {r1, 0x100d}, {r0, 0x40}, {r1, 0x6000}], 0x8, &(0x7f0000000180)={0x77359400}, &(0x7f00000001c0)={0x8}, 0x8) 18:20:09 executing program 0: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = add_key$keyring(&(0x7f0000000200)='keyring\x00', &(0x7f0000000240)={'syz'}, 0x0, 0x0, 0xfffffffffffffffb) pipe2$9p(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}, 0x4000) write$P9_RATTACH(r2, &(0x7f0000000040)={0x14, 0x69, 0x2, {0x10, 0x0, 0x2}}, 0x14) keyctl$instantiate(0xc, r1, &(0x7f0000000080)=@encrypted_new={'new ', 'default', 0x20, 'trusted:', 'syz', 0x20, 0x90db}, 0x2d, r1) 18:20:09 executing program 3: add_key(&(0x7f0000000000)='user\x00', &(0x7f0000000100)={'syz', 0x1}, &(0x7f0000000200)="82", 0x1, 0xfffffffffffffffb) r0 = memfd_create(&(0x7f0000000040)='user\x00', 0x2) close(r0) 18:20:09 executing program 2: r0 = socket$netlink(0x10, 0x3, 0x4) writev(r0, &(0x7f0000000000)=[{&(0x7f0000000200)}], 0x1) 18:20:09 executing program 0: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = openat$keychord(0xffffffffffffff9c, &(0x7f0000000000)='/dev/keychord\x00', 0x0, 0x0) ioctl$TIOCGSOFTCAR(r1, 0x5419, &(0x7f0000000040)) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) add_key$keyring(&(0x7f0000000200)='keyring\x00', &(0x7f0000000240)={'syz'}, 0x0, 0x0, 0xfffffffffffffffb) sync() [ 477.714860] binder: 31676:31683 unknown command 0 [ 477.721418] binder: 31674:31685 unknown command 1074946830 18:20:09 executing program 2: r0 = socket$netlink(0x10, 0x3, 0x4) writev(r0, &(0x7f0000000000)=[{&(0x7f0000000200)}], 0x1) 18:20:09 executing program 5: request_key(&(0x7f0000000240)='keyring\x00', &(0x7f0000000280)={'syz', 0x0}, &(0x7f00000002c0)='vboxnet1\x00', 0xfffffffffffffffe) r0 = dup(0xffffffffffffffff) ioctl$BLKIOOPT(r0, 0x1279, &(0x7f0000000000)) 18:20:09 executing program 3: add_key(&(0x7f00000000c0)='user\x00', &(0x7f0000000100)={'syz'}, &(0x7f0000000200)="82", 0x1, 0xfffffffffffffffb) r0 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000040)='io.stat\x00', 0x0, 0x0) write$FUSE_LSEEK(r0, &(0x7f0000000080)={0x18, 0xfffffffffffffff5, 0x4, {0x1}}, 0x18) ioctl$PERF_EVENT_IOC_DISABLE(r0, 0x2401, 0x8000) openat$uhid(0xffffffffffffff9c, &(0x7f0000000000)='/dev/uhid\x00', 0x802, 0x0) [ 477.754373] binder: 31676:31683 ioctl c0306201 20012000 returned -22 [ 477.785622] binder: 31676:31697 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 477.791041] binder: 31674:31685 ioctl c0306201 20008fd0 returned -22 [ 477.793335] binder: 31674:31699 unknown command 1074946830 18:20:09 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000300)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, &(0x7f0000012fc7)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, &(0x7f0000000f4d)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x8, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="9e523f1675257273d3791bf422000f86a514"], 0x0, 0x0, &(0x7f0000000340)}) [ 477.793344] binder: 31674:31699 ioctl c0306201 20008fd0 returned -22 18:20:09 executing program 5: r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ion\x00', 0x3, 0x0) fcntl$setsig(r0, 0xa, 0x28) request_key(&(0x7f0000000240)='keyring\x00', &(0x7f0000000280)={'syz', 0x0}, &(0x7f00000002c0)='vboxnet1\x00', 0xfffffffffffffffe) r1 = openat$null(0xffffffffffffff9c, &(0x7f0000000040)='/dev/null\x00', 0x400000, 0x0) connect$unix(r1, &(0x7f0000000080)=@abs={0x0, 0x0, 0x4e23}, 0x6e) dup3(r1, r0, 0x80000) 18:20:09 executing program 2: r0 = socket$netlink(0x10, 0x3, 0x4) writev(r0, &(0x7f0000000000)=[{&(0x7f0000000200)="580000001400192340834b80040d8c5602067fffffff81000000000000dca87086a5c000004f640094000589", 0x2c}], 0x1) [ 477.834503] binder: 31676:31707 Release 1 refcount change on invalid ref 0 ret -22 [ 477.860143] binder: 31710:31712 unknown command 373248670 [ 477.922239] binder: 31710:31712 ioctl c0306201 200000c0 returned -22 [ 477.964172] binder: BINDER_SET_CONTEXT_MGR already set [ 477.964267] binder: 31676:31707 unknown command 0 [ 477.964277] binder: 31676:31707 ioctl c0306201 20012000 returned -22 [ 477.964581] binder: 31676:31707 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 477.969182] binder: 31676:31723 Release 1 refcount change on invalid ref 0 ret -22 18:20:10 executing program 4: r0 = syz_open_dev$binder(&(0x7f00000002c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000300)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, &(0x7f0000012fc7)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, &(0x7f0000000f4d)}) r2 = accept$unix(r0, &(0x7f0000000000), &(0x7f0000000080)=0x6e) getsockopt$bt_hci(r2, 0x0, 0x2, &(0x7f0000000180)=""/93, &(0x7f0000000100)=0x5d) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000000c0)={0x8, 0x0, &(0x7f0000000140)=[@release], 0x0, 0x0, &(0x7f0000000340)}) 18:20:10 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000300)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = dup3(r0, r0, 0x80000) r2 = syz_genetlink_get_family_id$team(&(0x7f0000000040)='team\x00') accept$packet(0xffffffffffffff9c, &(0x7f00000001c0)={0x11, 0x0, 0x0}, &(0x7f0000000200)=0x14) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f00000004c0)={'ip_vti0\x00', 0x0}) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000000500)={{{@in6=@mcast2, @in=@local, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@dev}, 0x0, @in=@multicast2}}, &(0x7f0000000600)=0xe8) getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffff9c, 0x29, 0x22, &(0x7f0000000640)={{{@in=@rand_addr, @in6=@mcast2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@rand_addr}, 0x0, @in=@multicast2}}, &(0x7f0000000740)=0xe8) getsockopt$inet6_mreq(0xffffffffffffff9c, 0x29, 0x1f, &(0x7f0000000780)={@empty, 0x0}, &(0x7f00000007c0)=0x14) accept4$packet(0xffffffffffffff9c, &(0x7f00000034c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @local}, &(0x7f0000003500)=0x14, 0x0) getsockopt$inet6_mreq(r1, 0x29, 0x1c, &(0x7f0000003540)={@loopback, 0x0}, &(0x7f00000002c0)=0xffffffffffffffc6) getsockopt$inet_mreqn(0xffffffffffffff9c, 0x0, 0x24, &(0x7f00000035c0)={@empty, @rand_addr, 0x0}, &(0x7f0000003600)=0xc) getsockopt$inet_pktinfo(r0, 0x0, 0x8, &(0x7f0000003640)={0x0, @dev, @dev}, &(0x7f0000003680)=0xc) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f00000036c0)={'veth0_to_bond\x00', 0x0}) clock_gettime(0x0, &(0x7f0000008ec0)={0x0, 0x0}) recvmmsg(0xffffffffffffff9c, &(0x7f0000008c40)=[{{&(0x7f0000003700)=@nfc_llcp, 0x80, &(0x7f0000003c00)=[{&(0x7f0000003780)=""/72, 0x48}, {&(0x7f0000003800)=""/75, 0x4b}, {&(0x7f0000003880)=""/181, 0xb5}, {&(0x7f0000003940)=""/83, 0x53}, {&(0x7f00000039c0)=""/100, 0x64}, {&(0x7f0000003a40)=""/133, 0x85}, {&(0x7f0000003b00)=""/162, 0xa2}, {&(0x7f0000003bc0)=""/17, 0x11}], 0x8, &(0x7f0000003c80)=""/8, 0x8, 0x100000001}, 0x200}, {{&(0x7f0000003cc0)=@ipx, 0x80, &(0x7f0000005e00)=[{&(0x7f0000003d40)=""/169, 0xa9}, {&(0x7f0000003e00)=""/4096, 0x1000}, {&(0x7f0000004e00)=""/4096, 0x1000}], 0x3, &(0x7f0000005e40)=""/7, 0x7, 0x7fff}, 0x3}, {{&(0x7f0000005e80)=@pptp={0x18, 0x2, {0x0, @multicast1}}, 0x80, &(0x7f0000007140)=[{&(0x7f0000005f00)=""/119, 0x77}, {&(0x7f0000006000)=""/4096, 0x1000}, {&(0x7f0000005f80)=""/12, 0xc}, {&(0x7f0000007000)=""/5, 0x5}, {&(0x7f0000007040)=""/202, 0xca}], 0x5, 0x0, 0x0, 0x800}, 0x1}, {{&(0x7f00000071c0)=@pptp={0x18, 0x2, {0x0, @multicast2}}, 0x80, &(0x7f0000007400)=[{&(0x7f0000007240)=""/60, 0x3c}, {&(0x7f0000007280)=""/60, 0x3c}, {&(0x7f00000072c0)=""/234, 0xea}, {&(0x7f00000073c0)=""/34, 0x22}], 0x4, &(0x7f0000007440)=""/106, 0x6a, 0x100000001}, 0x7}, {{&(0x7f00000074c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @local}, 0x80, &(0x7f0000007740)=[{&(0x7f0000007540)=""/35, 0x23}, {&(0x7f0000007580)=""/122, 0x7a}, {&(0x7f0000007600)=""/134, 0x86}, {&(0x7f00000076c0)=""/68, 0x44}], 0x4, &(0x7f0000007780)=""/44, 0x2c, 0x80000001}, 0x1}, {{&(0x7f00000077c0)=@can, 0x80, &(0x7f0000007e00)=[{&(0x7f0000007840)=""/111, 0x6f}, {&(0x7f00000078c0)=""/34, 0x22}, {&(0x7f0000007900)=""/212, 0xd4}, {&(0x7f0000007a00)=""/204, 0xcc}, {&(0x7f0000007b00)=""/249, 0xf9}, {&(0x7f0000007c00)=""/206, 0xce}, {&(0x7f0000007d00)=""/227, 0xe3}], 0x7, &(0x7f0000007e80)=""/140, 0x8c, 0x3}, 0xbf}, {{&(0x7f0000007f40)=@can={0x1d, 0x0}, 0x80, &(0x7f0000008080)=[{&(0x7f0000007fc0)=""/143, 0x8f}], 0x1, &(0x7f00000080c0)=""/117, 0x75, 0x6}, 0x81}, {{&(0x7f0000008140)=@in={0x2, 0x0, @multicast2}, 0x80, &(0x7f00000085c0)=[{&(0x7f00000081c0)=""/13, 0xd}, {&(0x7f0000008200)=""/193, 0xc1}, {&(0x7f0000008300)=""/57, 0x39}, {&(0x7f0000008340)=""/135, 0x87}, {&(0x7f0000008400)=""/179, 0xb3}, {&(0x7f00000084c0)=""/71, 0x47}, {&(0x7f0000008540)}, {&(0x7f0000008580)=""/50, 0x32}], 0x8, &(0x7f0000008640)=""/81, 0x51}, 0xa3}, {{&(0x7f00000086c0)=@nfc, 0x80, &(0x7f0000008980)=[{&(0x7f0000008740)}, {&(0x7f0000008780)=""/113, 0x71}, {&(0x7f0000008800)=""/132, 0x84}, {&(0x7f00000088c0)=""/160, 0xa0}], 0x4, &(0x7f00000089c0)=""/47, 0x2f, 0x7}, 0x4}, {{&(0x7f0000008a00)=@nfc_llcp, 0x80, &(0x7f0000008b00)=[{&(0x7f0000008a80)=""/115, 0x73}], 0x1, &(0x7f0000008b40)=""/219, 0xdb, 0xfffffffffffffffd}}], 0xa, 0x40, &(0x7f0000008f00)={r13, r14+30000000}) getsockname$packet(0xffffffffffffff9c, &(0x7f0000008f40)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @link_local}, &(0x7f0000008f80)=0x14) recvmsg(0xffffffffffffffff, &(0x7f00000091c0)={&(0x7f0000009000)=@xdp={0x2c, 0x0, 0x0}, 0x80, &(0x7f0000009180)=[{&(0x7f0000009080)=""/254, 0xfe}], 0x1}, 0x101) getsockopt$inet_pktinfo(0xffffffffffffffff, 0x0, 0x8, &(0x7f0000009200)={0x0, @dev}, &(0x7f0000009240)=0xc) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffff9c, 0x29, 0x23, &(0x7f0000009340)={{{@in=@local, @in6=@mcast1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@remote}, 0x0, @in6=@mcast1}}, &(0x7f0000009440)=0xe8) setsockopt$inet_MCAST_LEAVE_GROUP(r1, 0x0, 0x2d, &(0x7f0000000a80)={0xfffffffffffffffd, {{0x2, 0x4e21, @loopback}}}, 0x88) r20 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000180)='IPVS\x00') sendmsg$IPVS_CMD_FLUSH(r1, &(0x7f0000000280)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f0000000240)={&(0x7f0000000900)={0x15c, r20, 0x310, 0x70bd28, 0x25dfdbfb, {}, [@IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x1}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5, 0x1}, @IPVS_CMD_ATTR_DAEMON={0x64, 0x3, [@IPVS_DAEMON_ATTR_MCAST_IFN={0x14, 0x2, 'bridge_slave_0\x00'}, @IPVS_DAEMON_ATTR_SYNC_MAXLEN={0x8, 0x4, 0x5}, @IPVS_DAEMON_ATTR_MCAST_GROUP={0x8, 0x5, @remote}, @IPVS_DAEMON_ATTR_MCAST_GROUP={0x8, 0x5, @remote}, @IPVS_DAEMON_ATTR_MCAST_IFN={0x14, 0x2, 'bpq0\x00'}, @IPVS_DAEMON_ATTR_SYNC_ID={0x8, 0x3, 0x3}, @IPVS_DAEMON_ATTR_MCAST_TTL={0x8, 0x8, 0x1c000000000}, @IPVS_DAEMON_ATTR_MCAST_TTL={0x8, 0x8, 0xfffffffffffffffd}, @IPVS_DAEMON_ATTR_STATE={0x8, 0x1, 0x1}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x20}, @IPVS_CMD_ATTR_DAEMON={0x68, 0x3, [@IPVS_DAEMON_ATTR_MCAST_IFN={0x14, 0x2, 'team0\x00'}, @IPVS_DAEMON_ATTR_SYNC_MAXLEN={0x8}, @IPVS_DAEMON_ATTR_MCAST_GROUP={0x8, 0x5, @broadcast}, @IPVS_DAEMON_ATTR_MCAST_TTL={0x8, 0x8, 0x8}, @IPVS_DAEMON_ATTR_MCAST_PORT={0x8, 0x7, 0x4e23}, @IPVS_DAEMON_ATTR_MCAST_TTL={0x8, 0x8, 0x2d0000}, @IPVS_DAEMON_ATTR_MCAST_GROUP6={0x14, 0x6, @local}, @IPVS_DAEMON_ATTR_MCAST_GROUP6={0x14, 0x6, @local}]}, @IPVS_CMD_ATTR_SERVICE={0x5c, 0x1, [@IPVS_SVC_ATTR_ADDR={0x14, 0x3, @ipv6=@local}, @IPVS_SVC_ATTR_NETMASK={0x8, 0x9, 0x3d}, @IPVS_SVC_ATTR_ADDR={0x14, 0x3, @ipv4=@multicast1}, @IPVS_SVC_ATTR_SCHED_NAME={0x8, 0x6, 'dh\x00'}, @IPVS_SVC_ATTR_PROTOCOL={0x8, 0x2, 0x3c}, @IPVS_SVC_ATTR_FWMARK={0x8, 0x5, 0x2}, @IPVS_SVC_ATTR_SCHED_NAME={0x8, 0x6, 'ovf\x00'}, @IPVS_SVC_ATTR_PE_NAME={0x8, 0xb, 'sip\x00'}]}, @IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0x3}]}, 0x15c}, 0x1, 0x0, 0x0, 0x4000000}, 0x8011) getsockopt$inet_pktinfo(0xffffffffffffff9c, 0x0, 0x8, &(0x7f0000009580)={0x0, @remote}, &(0x7f00000095c0)=0xc) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f00000096c0)={'team_slave_0\x00', 0x0}) accept$packet(0xffffffffffffff9c, &(0x7f00000097c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000009800)=0x14) sendmsg$TEAM_CMD_PORT_LIST_GET(r1, &(0x7f0000009f80)={&(0x7f0000000000), 0xc, &(0x7f0000009f40)={&(0x7f0000009840)={0x6dc, r2, 0x1, 0x70bd2a, 0x25dfdbfc, {}, [{{0x8, 0x1, r3}, {0x13c, 0x2, [{0x40, 0x1, @lb_hash_stats={{{0x24, 0x1, 'lb_hash_stats\x00'}, {0x8}, {0x8, 0x4, 0x9}}, {0x8}}}, {0x38, 0x1, @notify_peers_count={{0x24, 0x1, 'notify_peers_count\x00'}, {0x8}, {0x8, 0x4, 0x5}}}, {0x40, 0x1, @queue_id={{{0x24, 0x1, 'queue_id\x00'}, {0x8}, {0x8, 0x4, 0x1ff}}, {0x8, 0x6, r4}}}, {0x40, 0x1, @lb_tx_hash_to_port_mapping={{{0x24, 0x1, 'lb_tx_hash_to_port_mapping\x00'}, {0x8}, {0x8, 0x4, r5}}, {0x8}}}, {0x40, 0x1, @name={{0x24, 0x1, 'mode\x00'}, {0x8}, {0x10, 0x4, 'roundrobin\x00'}}}]}}, {{0x8, 0x1, r6}, {0x44, 0x2, [{0x40, 0x1, @queue_id={{{0x24, 0x1, 'queue_id\x00'}, {0x8}, {0x8, 0x4, 0x9}}, {0x8, 0x6, r7}}}]}}, {{0x8, 0x1, r8}, {0x13c, 0x2, [{0x38, 0x1, @notify_peers_count={{0x24, 0x1, 'notify_peers_count\x00'}, {0x8}, {0x8, 0x4, 0x2}}}, {0x4c, 0x1, @bpf_hash_func={{0x24, 0x1, 'bpf_hash_func\x00'}, {0x8}, {0x1c, 0x4, [{0x80, 0x3, 0x287a, 0x40}, {0x1b2, 0x10000, 0x8, 0x3}, {0xd87549d, 0x5, 0xc5b, 0x1000}]}}}, {0x38, 0x1, @lb_stats_refresh_interval={{0x24, 0x1, 'lb_stats_refresh_interval\x00'}, {0x8}, {0x8, 0x4, 0x5}}}, {0x40, 0x1, @priority={{{0x24, 0x1, 'priority\x00'}, {0x8}, {0x8, 0x4, 0x8}}, {0x8, 0x6, r9}}}, {0x3c, 0x1, @user_linkup={{{0x24, 0x1, 'user_linkup\x00'}, {0x8}, {0x4}}, {0x8, 0x6, r10}}}]}}, {{0x8, 0x1, r11}, {0x22c, 0x2, [{0x38, 0x1, @notify_peers_count={{0x24, 0x1, 'notify_peers_count\x00'}, {0x8}, {0x8, 0x4, 0x1ff}}}, {0x3c, 0x1, @user_linkup={{{0x24, 0x1, 'user_linkup\x00'}, {0x8}, {0x4}}, {0x8, 0x6, r12}}}, {0x40, 0x1, @lb_port_stats={{{0x24, 0x1, 'lb_port_stats\x00'}, {0x8}, {0x8, 0x4, 0x494}}, {0x8, 0x6, r15}}}, {0x38, 0x1, @lb_stats_refresh_interval={{0x24, 0x1, 'lb_stats_refresh_interval\x00'}, {0x8}, {0x8, 0x4, 0xb}}}, {0x40, 0x1, @lb_tx_hash_to_port_mapping={{{0x24, 0x1, 'lb_tx_hash_to_port_mapping\x00'}, {0x8}, {0x8, 0x4, r16}}, {0x8}}}, {0x3c, 0x1, @user_linkup={{{0x24, 0x1, 'user_linkup\x00'}, {0x8}, {0x4}}, {0x8, 0x6, r17}}}, {0x40, 0x1, @lb_hash_stats={{{0x24, 0x1, 'lb_hash_stats\x00'}, {0x8}, {0x8, 0x4, 0x5}}, {0x8}}}, {0x40, 0x1, @lb_hash_stats={{{0x24, 0x1, 'lb_hash_stats\x00'}, {0x8}, {0x8, 0x4, 0x40}}, {0x8}}}, {0x40, 0x1, @lb_tx_hash_to_port_mapping={{{0x24, 0x1, 'lb_tx_hash_to_port_mapping\x00'}, {0x8}, {0x8, 0x4, r18}}, {0x8}}}]}}, {{0x8, 0x1, r19}, {0xb4, 0x2, [{0x38, 0x1, @mcast_rejoin_interval={{0x24, 0x1, 'mcast_rejoin_interval\x00'}, {0x8}, {0x8, 0x4, 0xff}}}, {0x38, 0x1, @mcast_rejoin_interval={{0x24, 0x1, 'mcast_rejoin_interval\x00'}, {0x8}, {0x8, 0x4, 0x63}}}, {0x40, 0x1, @lb_port_stats={{{0x24, 0x1, 'lb_port_stats\x00'}, {0x8}, {0x8, 0x4, 0x5}}, {0x8, 0x6, r21}}}]}}, {{0x8, 0x1, r22}, {0xfc, 0x2, [{0x40, 0x1, @lb_tx_hash_to_port_mapping={{{0x24, 0x1, 'lb_tx_hash_to_port_mapping\x00'}, {0x8}, {0x8, 0x4, r23}}, {0x8}}}, {0x40, 0x1, @lb_hash_stats={{{0x24, 0x1, 'lb_hash_stats\x00'}, {0x8}, {0x8, 0x4, 0x14b}}, {0x8}}}, {0x40, 0x1, @lb_hash_stats={{{0x24, 0x1, 'lb_hash_stats\x00'}, {0x8}, {0x8}}, {0x8}}}, {0x38, 0x1, @notify_peers_count={{0x24, 0x1, 'notify_peers_count\x00'}, {0x8}, {0x8, 0x4, 0x8}}}]}}]}, 0x6dc}, 0x1, 0x0, 0x0, 0x10}, 0x40850) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000000800)=ANY=[@ANYBLOB="0563044000000000250000008aa8a4ad134da79d7ebd41dd435576385e23e7cded955ed3f7fd05a1e903e483e7fe45f26d277f5120cd00af6d50fc223417bc022f7d41e95f4a1a46cf5acbf495129cae787d5b3796c5bcdc549c47d71f6730591c0822a31376e9c7ee4d2ceeb6ad77856086e643a024701a7cb1f6a14be2abf1bba8902585122ab0c9e0f8bc6fcac8f320b371fff781ffd6d369670a4225c6a2e0a00c24b5607d52028246ccb7f6d8c19a8353980344f2de067d5d79bfde984f9def844ff0d259050ec4e0f9204da302d1a02453bc97f104de24c3cc5281b7d2201ac83f06b386899c01c2672df1"], 0x0, 0x0, &(0x7f0000012fc7)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008fd0)={0xe9, 0x0, &(0x7f0000000340)=ANY=[@ANYBLOB="0e630c4000000000e1eb0263795b323fde368e82865dec956269eee7004d9d9fddd63e53c180632ba916056a87a8a98e463db3f0d9eccff6a5c5203193acb3c9ab1bb06ededf3b9136f84acf6a0f626f19819edfcc7cad723c8f1b987b6c61cbf29629be06896558c3f7d273e9046b82a388ac5be52c87b27778cde0877937896e72508c0af6e6fdc32b0586c2d85fcd349ed6c6984170a8b86cdca04b26916a2bddf53d972818e102fcd1e6d5ed323b8eb8b9db6d16e6463f6aad728109ee8db4fbfd0e66c1da8e713f9ffd422a45a15ec15cc50581502710805053df753a36a840df4820e9fe160b"], 0xffffffffffffff5a, 0x0, &(0x7f0000000f4d)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x8, 0x0, &(0x7f0000000140)=[@release], 0x0, 0x0, &(0x7f0000000340)}) ioctl$EXT4_IOC_RESIZE_FS(r0, 0x40086610, &(0x7f0000000080)=0x9) [ 478.009959] binder: 31676:31683 ioctl 40046207 0 returned -16 18:20:10 executing program 0: r0 = syz_open_dev$loop(&(0x7f00000001c0)='/dev/loop#\x00', 0x9, 0x40002) ioctl$BLKGETSIZE(r0, 0x1260, &(0x7f0000000200)) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) pipe2(&(0x7f0000000280)={0xffffffffffffffff}, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x2400, 0x7) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) request_key(&(0x7f0000000000)='.request_key_auth\x00', &(0x7f0000000040)={'syz', 0x1}, &(0x7f0000000080)='mime_type\x00', 0xfffffffffffffffe) r3 = add_key$keyring(&(0x7f00000000c0)='keyring\x00', &(0x7f0000000100)={'syz', 0x3}, 0x0, 0x0, 0x0) add_key$keyring(&(0x7f0000000140)='keyring\x00', &(0x7f0000000240)={'syz'}, 0x0, 0x0, r3) 18:20:10 executing program 3: r0 = openat$smack_thread_current(0xffffffffffffff9c, &(0x7f0000000000)='/proc/thread-self/attr/current\x00', 0x2, 0x0) fcntl$F_GET_FILE_RW_HINT(r0, 0x40d, &(0x7f0000000040)) add_key(&(0x7f00000000c0)='user\x00', &(0x7f0000000100)={'syz'}, &(0x7f0000000200)="82", 0x1, 0xfffffffffffffffb) 18:20:10 executing program 2: r0 = socket$netlink(0x10, 0x3, 0x4) writev(r0, &(0x7f0000000000)=[{&(0x7f0000000200)="580000001400192340834b80040d8c5602067fffffff81000000000000dca87086a5c000004f640094000589", 0x2c}], 0x1) 18:20:10 executing program 5: r0 = request_key(&(0x7f0000000240)='keyring\x00', &(0x7f0000000280)={'syz', 0x0}, &(0x7f00000002c0)='vboxnet1\x00', 0xfffffffffffffffe) keyctl$reject(0x13, r0, 0xfc, 0x7, r0) 18:20:10 executing program 0: ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) add_key$keyring(&(0x7f0000000200)='keyring\x00', &(0x7f0000000240)={'syz'}, 0x0, 0x0, 0xfffffffffffffffb) 18:20:10 executing program 2: r0 = socket$netlink(0x10, 0x3, 0x4) writev(r0, &(0x7f0000000000)=[{&(0x7f0000000200)="580000001400192340834b80040d8c5602067fffffff81000000000000dca87086a5c000004f640094000589", 0x2c}], 0x1) 18:20:10 executing program 5: r0 = request_key(&(0x7f0000000040)='encrypted\x00', &(0x7f0000000080)={'syz', 0x3}, &(0x7f00000000c0)='trusted\x00', 0xfffffffffffffff9) request_key(&(0x7f0000000240)='keyring\x00', &(0x7f0000000280)={'syz', 0x2}, &(0x7f0000000100)='vboxnet1\x00', r0) 18:20:10 executing program 3: r0 = openat$zero(0xffffffffffffff9c, &(0x7f0000000040)='/dev/zero\x00', 0x8000, 0x0) clock_gettime(0x0, &(0x7f0000000100)={0x0, 0x0}) clock_gettime(0x0, &(0x7f0000000140)={0x0, 0x0}) futimesat(r0, &(0x7f0000000080)='./file0\x00', &(0x7f0000000180)={{r1, r2/1000+30000}, {r3, r4/1000+30000}}) add_key(&(0x7f00000000c0)='user\x00', &(0x7f0000000000)={'syz'}, &(0x7f0000000200)="82", 0xffffffffffffff07, 0xfffffffffffffffb) [ 478.086344] binder: BINDER_SET_CONTEXT_MGR already set [ 478.105381] binder: 31728:31735 ioctl 40046207 0 returned -16 [ 478.107489] binder: 31728:31742 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 18:20:10 executing program 5: r0 = timerfd_create(0x7, 0x800) r1 = request_key(&(0x7f0000000040)='user\x00', &(0x7f0000000080)={'syz', 0x2}, &(0x7f00000000c0)='vmnet1vboxnet0%-\x00', 0xfffffffffffffffd) request_key(&(0x7f0000000240)='keyring\x00', &(0x7f0000000280)={'syz', 0x0}, &(0x7f00000002c0)='vboxnet1\x00', r1) r2 = openat$null(0xffffffffffffff9c, &(0x7f0000000000)='/dev/null\x00', 0x500, 0x0) ioctl$RTC_VL_READ(r2, 0x80047013, &(0x7f0000000100)) timerfd_create(0x7, 0x0) ioctl$LOOP_SET_FD(r2, 0x4c00, r0) 18:20:10 executing program 0: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) add_key$keyring(&(0x7f0000000200)='keyring\x00', &(0x7f0000000240)={'syz'}, 0x0, 0x0, 0xfffffffffffffffb) 18:20:10 executing program 4: r0 = syz_open_dev$binder(&(0x7f00000002c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000300)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, &(0x7f0000012fc7)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, &(0x7f0000000f4d)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000000c0)={0x8, 0x0, &(0x7f0000000140)=[@release], 0x0, 0x0, &(0x7f0000000340)}) [ 478.161709] binder: 31727:31730 Acquire 1 refcount change on invalid ref 0 ret -22 [ 478.171255] binder: 31727:31730 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 478.221149] binder: 31727:31751 Release 1 refcount change on invalid ref 0 ret -22 [ 478.234109] binder: 31727:31730 unknown command -2104609058 [ 478.243525] binder: 31727:31751 ioctl 40086610 20000080 returned -22 [ 478.254019] binder: 31727:31730 ioctl c0306201 20008fd0 returned -22 [ 478.262199] binder: BINDER_SET_CONTEXT_MGR already set [ 478.269227] binder: 31765:31767 ioctl 40046207 0 returned -16 18:20:10 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x7fe) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000000140)=ANY=[@ANYBLOB="056304620e000000eff362cc6bcb1a833d5d8dfe2ff05f98ccc4fa095c11668eb7a3d2a5e5e48c9b371240e1cbb1ed50a8eaa5c1a5e7676d3234b5923f7a8d29b0c11ad62fd46f9446539539fee7238dd26bb865476d72644bdbf324dc75732977d14b1a"], 0x0, 0x0, &(0x7f0000012fc7)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, &(0x7f0000000f4d)}) r1 = openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000340)='/selinux/commit_pending_bools\x00', 0x1, 0x0) ioctl$sock_SIOCADDDLCI(r1, 0x8980, &(0x7f0000000100)={'veth1_to_bond\x00', 0x8}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x8, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="066304400000000072d3fb72fc34a18ce46c0c1c1c02d73597232c48f7a0929e2daae2d025123a6189fded6486857dabe9869e0e8d4e1078ea"], 0x0, 0x0, &(0x7f0000000340)}) r2 = syz_genetlink_get_family_id$nbd(&(0x7f0000000200)='nbd\x00') sendmsg$NBD_CMD_STATUS(r1, &(0x7f0000000300)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f00000002c0)={&(0x7f0000000240)={0x58, r2, 0x820, 0x70bd2b, 0x25dfdbfb, {}, [@NBD_ATTR_DEAD_CONN_TIMEOUT={0xc, 0x8, 0x2}, @NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x8}, @NBD_ATTR_SERVER_FLAGS={0xc, 0x5, 0xa}, @NBD_ATTR_SERVER_FLAGS={0xc, 0x5, 0x1}, @NBD_ATTR_BLOCK_SIZE_BYTES={0xc, 0x3, 0x8}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}]}, 0x58}, 0x1, 0x0, 0x0, 0x40000}, 0x24008001) 18:20:10 executing program 3: arch_prctl(0x0, &(0x7f0000000240)="2b4eb8eaee47c2edc7df19b7ee23e306c86a3bc7eda21bbecd4ea6086fa50182b84cf85f264f5688eae564da816e90a11b206edab2faae8f09195967dd3d3f7133ebc02653ecfa12a21ed7e71f3e362030b8c880260f4d8b317e49780e77d014855d1903b8851aaf495a49ecf5b3099924776adcbaa2f36384bc3f97422252340f5e9771f4ffc499162da9ff303e7fc7ee5fa0b3f52891d6bf7756fd4d709524b2c0745ed277ccc02ebcd5474c5d183e69289bcb212c6d905be7624ee2e287b805e05eb725e61b3e893ae8f264f5b30c4c27c34cc52167768fcd67c343") add_key(&(0x7f00000000c0)='user\x00', &(0x7f0000000100)={'syz'}, &(0x7f0000000200)="82", 0x1, 0xfffffffffffffffb) 18:20:10 executing program 2: r0 = socket$netlink(0x10, 0x3, 0x4) writev(r0, &(0x7f0000000000)=[{&(0x7f0000000200)="580000001400192340834b80040d8c5602067fffffff81000000000000dca87086a5c000004f6400940005891550f4a8000000006700008000f0fffeffff09000080", 0x42}], 0x1) 18:20:10 executing program 5: request_key(&(0x7f0000000240)='keyring\x00', &(0x7f0000000280)={'syz', 0x0}, &(0x7f00000002c0)='vboxnet1\x00', 0xfffffffffffffffe) socketpair$inet_udp(0x2, 0x2, 0x0, &(0x7f0000000000)) 18:20:10 executing program 0: r0 = socket$inet(0x2, 0x802, 0x108) r1 = dup(r0) ioctl$DMA_BUF_IOCTL_SYNC(r1, 0x40086200, &(0x7f0000000080)=0x1) ioctl$PERF_EVENT_IOC_DISABLE(r1, 0x2401, 0x3) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) sendfile(r2, r1, &(0x7f0000000040)=0x4, 0x4) add_key$keyring(&(0x7f0000000200)='keyring\x00', &(0x7f0000000240)={'syz'}, 0x0, 0x0, 0xfffffffffffffffb) clock_gettime(0x0, &(0x7f0000000100)={0x0, 0x0}) write$input_event(r1, &(0x7f00000001c0)={{r4, r5/1000+10000}, 0x4, 0x0, 0x3}, 0xfffffffffffffe38) ioctl$EXT4_IOC_GROUP_ADD(r1, 0x40286608, &(0x7f0000000000)={0x7, 0x52, 0x4, 0xfa5, 0x20, 0x6}) 18:20:10 executing program 4: r0 = syz_open_dev$binder(&(0x7f00000002c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000300)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, &(0x7f0000012fc7)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, &(0x7f0000000f4d)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000000c0)={0x8, 0x0, &(0x7f0000000140)=[@release], 0x0, 0x0, &(0x7f0000000340)}) [ 478.304560] binder: 31727:31751 Acquire 1 refcount change on invalid ref 0 ret -22 [ 478.313490] binder: 31727:31730 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 478.321071] binder: 31727:31751 Release 1 refcount change on invalid ref 0 ret -22 [ 478.321200] binder: 31727:31730 unknown command -2104609058 [ 478.321210] binder: 31727:31730 ioctl c0306201 20008fd0 returned -22 [ 478.341642] binder: 31727:31730 ioctl 40086610 20000080 returned -22 18:20:10 executing program 2: r0 = socket$netlink(0x10, 0x3, 0x4) writev(r0, &(0x7f0000000000)=[{&(0x7f0000000200)="580000001400192340834b80040d8c5602067fffffff81000000000000dca87086a5c000004f6400940005891550f4a8000000006700008000f0fffeffff09000080", 0x42}], 0x1) 18:20:10 executing program 0: openat$selinux_avc_hash_stats(0xffffffffffffff9c, &(0x7f0000000080)='/selinux/avc/hash_stats\x00', 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180)) openat$pfkey(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/net/pfkey\x00', 0x10000, 0x0) r0 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ppp\x00', 0x80000, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0xffffffffffffffff) add_key$keyring(&(0x7f0000000200)='keyring\x00', &(0x7f0000000240)={'syz'}, 0x0, 0x0, 0xfffffffffffffffb) ioctl$TUNGETFILTER(r0, 0x801054db, &(0x7f0000000100)=""/38) 18:20:10 executing program 3: r0 = request_key(&(0x7f0000000140)='trusted\x00', &(0x7f0000000180)={'syz', 0x0}, &(0x7f00000001c0)='%{#/\x00', 0xfffffffffffffff8) request_key(&(0x7f0000000000)='user\x00', &(0x7f0000000040)={'syz', 0x0}, &(0x7f0000000080)='trustedvmnet1/+\x00', r0) add_key(&(0x7f00000000c0)='user\x00', &(0x7f0000000100)={'syz'}, &(0x7f0000000200)="82", 0x1, 0xfffffffffffffffb) 18:20:10 executing program 5: r0 = request_key(&(0x7f0000000000)='keyring\x00', &(0x7f0000000280)={'syz', 0x0}, &(0x7f00000002c0)='vboxnet1\x00', 0xfffffffffffffffe) keyctl$assume_authority(0x10, r0) 18:20:10 executing program 2: r0 = socket$netlink(0x10, 0x3, 0x4) writev(r0, &(0x7f0000000000)=[{&(0x7f0000000200)="580000001400192340834b80040d8c5602067fffffff81000000000000dca87086a5c000004f6400940005891550f4a8000000006700008000f0fffeffff09000080", 0x42}], 0x1) [ 478.377387] binder: BINDER_SET_CONTEXT_MGR already set [ 478.396548] binder: 31778:31792 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 478.415385] binder: 31778:31784 ioctl 40046207 0 returned -16 18:20:10 executing program 2: r0 = socket$netlink(0x10, 0x3, 0x4) writev(r0, &(0x7f0000000000)=[{&(0x7f0000000200)="580000001400192340834b80040d8c5602067fffffff81000000000000dca87086a5c000004f6400940005891550f4a8000000006700008000f0fffeffff09000080fff5dd0000001000010000", 0x4d}], 0x1) 18:20:10 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000300)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000012000)={0xfffffec1, 0x0, &(0x7f0000000000)=[@acquire], 0x0, 0x0, &(0x7f0000012fc7)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x1eb6c38dc891479d, 0x0, &(0x7f00000001c0)=[@release], 0xfffffffffffffdd4, 0x0, &(0x7f0000000080)="e1a27a37cdb4561df74a8b3ede3df416c5958254edf67059073076d8c5808fb06a22ab8a2db8df21e98bddfb211038ce474e49a478d5a0ab"}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x8, 0x0, &(0x7f0000000140)=[@release], 0x0, 0x0, &(0x7f0000000340)}) r1 = accept4(0xffffffffffffffff, &(0x7f0000000200)=@vsock={0x28, 0x0, 0x0, @hyper}, &(0x7f0000000040)=0x80, 0x80800) r2 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000280)='IPVS\x00') sendmsg$IPVS_CMD_SET_SERVICE(r1, &(0x7f0000000500)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x1002800}, 0xc, &(0x7f00000002c0)={&(0x7f0000000340)={0x18c, r2, 0x10, 0x70bd28, 0x25dfdbfb, {}, [@IPVS_CMD_ATTR_DAEMON={0x3c, 0x3, [@IPVS_DAEMON_ATTR_MCAST_IFN={0x14, 0x2, 'eql\x00'}, @IPVS_DAEMON_ATTR_MCAST_GROUP={0x8, 0x5, @multicast1}, @IPVS_DAEMON_ATTR_MCAST_GROUP6={0x14, 0x6, @mcast2}, @IPVS_DAEMON_ATTR_MCAST_GROUP={0x8, 0x5, @local}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x4}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x7ff8000}, @IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0x101}, @IPVS_CMD_ATTR_SERVICE={0x2c, 0x1, [@IPVS_SVC_ATTR_SCHED_NAME={0xc, 0x6, 'lblcr\x00'}, @IPVS_SVC_ATTR_TIMEOUT={0x8, 0x8, 0x4}, @IPVS_SVC_ATTR_ADDR={0x14, 0x3, @ipv6=@mcast2}]}, @IPVS_CMD_ATTR_SERVICE={0x5c, 0x1, [@IPVS_SVC_ATTR_SCHED_NAME={0x8, 0x6, 'lc\x00'}, @IPVS_SVC_ATTR_FWMARK={0x8}, @IPVS_SVC_ATTR_ADDR={0x14, 0x3, @ipv6=@ipv4={[], [], @rand_addr=0x71b}}, @IPVS_SVC_ATTR_SCHED_NAME={0xc, 0x6, 'lblc\x00'}, @IPVS_SVC_ATTR_FLAGS={0xc, 0x7, {0x4, 0x8}}, @IPVS_SVC_ATTR_TIMEOUT={0x8, 0x8, 0x4}, @IPVS_SVC_ATTR_SCHED_NAME={0x8, 0x6, 'lc\x00'}, @IPVS_SVC_ATTR_SCHED_NAME={0xc, 0x6, 'lblc\x00'}]}, @IPVS_CMD_ATTR_DAEMON={0x38, 0x3, [@IPVS_DAEMON_ATTR_SYNC_MAXLEN={0x8}, @IPVS_DAEMON_ATTR_MCAST_GROUP6={0x14, 0x6, @mcast1}, @IPVS_DAEMON_ATTR_MCAST_TTL={0x8, 0x8, 0x10000}, @IPVS_DAEMON_ATTR_STATE={0x8, 0x1, 0x2}, @IPVS_DAEMON_ATTR_MCAST_GROUP={0x8, 0x5, @rand_addr=0x3}]}, @IPVS_CMD_ATTR_DAEMON={0x5c, 0x3, [@IPVS_DAEMON_ATTR_MCAST_PORT={0x8, 0x7, 0x4e20}, @IPVS_DAEMON_ATTR_MCAST_GROUP6={0x14, 0x6, @dev={0xfe, 0x80, [], 0x18}}, @IPVS_DAEMON_ATTR_STATE={0x8, 0x1, 0x2}, @IPVS_DAEMON_ATTR_SYNC_MAXLEN={0x8, 0x4, 0x9d21}, @IPVS_DAEMON_ATTR_STATE={0x8}, @IPVS_DAEMON_ATTR_MCAST_GROUP6={0x14, 0x6, @mcast2}, @IPVS_DAEMON_ATTR_MCAST_GROUP={0x8, 0x5, @broadcast}, @IPVS_DAEMON_ATTR_SYNC_ID={0x8}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5, 0x1}]}, 0x18c}, 0x1, 0x0, 0x0, 0x40}, 0x0) 18:20:10 executing program 3: add_key(&(0x7f00000000c0)='user\x00', &(0x7f0000000100)={'syz'}, &(0x7f0000000200)="82", 0x1, 0xfffffffffffffffb) r0 = memfd_create(&(0x7f0000000000)='em1bdev\x00', 0x5) ioctl$RTC_ALM_READ(r0, 0x80247008, &(0x7f0000000040)) 18:20:10 executing program 4: r0 = syz_open_dev$binder(&(0x7f00000002c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000300)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, &(0x7f0000012fc7)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, &(0x7f0000000f4d)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000000c0)={0x8, 0x0, &(0x7f0000000140)=[@release], 0x0, 0x0, &(0x7f0000000340)}) socketpair(0x1b, 0x3, 0x1f, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) write$evdev(r2, &(0x7f0000000180)=[{{0x77359400}, 0x11, 0x6, 0x2}, {{0x0, 0x7530}, 0x17, 0x7, 0x3}, {{}, 0x15, 0x7ff}, {{}, 0x17, 0x1, 0x5}, {{0x0, 0x7530}, 0x1f, 0x1, 0x7}, {{0x77359400}, 0x3, 0x100000000, 0x5}], 0x90) 18:20:10 executing program 5: r0 = request_key(&(0x7f0000000240)="38edafc84f77e387", &(0x7f0000000280)={'syz', 0x0}, &(0x7f00000002c0)='vboxnet1\x00', 0xfffffffffffffffe) keyctl$search(0xa, r0, &(0x7f0000000000)='encrypted\x00', &(0x7f0000000040)={'syz', 0x0}, r0) 18:20:10 executing program 0: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) syz_open_dev$mice(&(0x7f0000000240)='/dev/input/mice\x00', 0x0, 0x400000) openat$null(0xffffffffffffff9c, &(0x7f0000000840)='/dev/null\x00', 0x440001, 0x0) syz_open_procfs(0xffffffffffffffff, &(0x7f0000000a40)='net/dev_snmp6\x00') perf_event_open$cgroup(&(0x7f0000000ac0)={0x2, 0x70, 0xfffffffffffffff8, 0x5, 0x8, 0x100, 0x0, 0x25, 0x240, 0x2, 0x6, 0x2, 0xdb9, 0x6, 0x4, 0x100000001, 0xffffffffffff1077, 0x3, 0x9f80, 0x400, 0x7, 0x5, 0x54, 0x4, 0x7f, 0x4, 0xfffffffffffffbff, 0x343, 0xfffffffffffffff7, 0x3c8, 0x1, 0xff, 0xeaa, 0x8, 0x4, 0x20, 0x6, 0x1, 0x0, 0x9, 0x1, @perf_bp={&(0x7f0000000a80), 0x6}, 0x11000, 0xfffffffffffffffa, 0x400, 0x5, 0x3, 0x4, 0x9}, 0xffffffffffffffff, 0x7, 0xffffffffffffffff, 0x4) dup3(r1, r0, 0x80000) open(&(0x7f0000000b40)='./file0\x00', 0x4000, 0x100) openat$rtc(0xffffffffffffff9c, &(0x7f0000000b80)='/dev/rtc0\x00', 0x200, 0x0) r2 = openat$selinux_policy(0xffffffffffffff9c, &(0x7f0000000bc0)='/selinux/policy\x00', 0x0, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0xfe) r3 = accept$inet(0xffffffffffffffff, &(0x7f0000000000)={0x2, 0x0, @local}, &(0x7f0000000040)=0x10) setsockopt$EBT_SO_SET_ENTRIES(r3, 0x0, 0x80, &(0x7f00000000c0)=@broute={'broute\x00', 0x20, 0x2, 0x4e8, [0x0, 0x0, 0x0, 0x0, 0x0, 0x20000280], 0x0, &(0x7f0000000080), &(0x7f0000000280)=[{0x0, '\x00', 0x0, 0xffffffffffffffff}, {0x0, '\x00', 0x0, 0xffffffffffffffff, 0x1, [{{{0x5, 0x42, 0xdada, 'ifb0\x00', 'syzkaller1\x00', 'ip6tnl0\x00', 'sit0\x00', @broadcast, [0x0, 0x0, 0xff, 0x0, 0x0, 0xff], @dev={[], 0x16}, [0xff, 0xff, 0xf437ba9f73149428, 0xff, 0xff, 0xff], 0x1e8, 0x248, 0x280, [@comment={'comment\x00', 0x100}, @ipvs={'ipvs\x00', 0x28, {{@ipv6=@loopback, [0x0, 0xffffffff, 0xffffffff, 0xff], 0x4e21, 0xaf, 0x5, 0x4e21, 0x10, 0x10}}}]}, [@common=@STANDARD={'\x00', 0x8}, @common=@NFQUEUE0={'NFQUEUE\x00', 0x8, {{0xd1}}}]}, @common=@mark={'mark\x00', 0x10, {{0xfffffff0, 0xfffffffffffffffd}}}}]}, {0x0, '\x00', 0x1, 0xfffffffffffffffc}, {0x0, '\x00', 0x1, 0x0, 0x1, [{{{0x9, 0x1, 0x200, 'syz_tun\x00', 'ip_vti0\x00', 'eql\x00', 'veth0_to_bridge\x00', @link_local, [0x0, 0xff, 0x0, 0x0, 0xff], @dev={[], 0x19}, [0x0, 0xff, 0xff, 0xff, 0xff], 0x148, 0x178, 0x1a8, [@physdev={'physdev\x00', 0x70, {{'ip6gre0\x00', {0xff}, 'ifb0\x00', {0xff}, 0x12, 0x2}}}, @quota={'quota\x00', 0x18, {{0x0, 0x0, 0x9, 0x9}}}]}, [@common=@AUDIT={'AUDIT\x00', 0x8, {{0x1}}}]}, @common=@redirect={'redirect\x00', 0x8, {{0xfffffffffffffffe}}}}]}]}, 0x560) add_key(&(0x7f0000000140)='logon\x00', &(0x7f00000001c0)={'syz', 0x2}, &(0x7f0000000780)="e72682736526f728274e601c28d7da47516fb977dfe694896a95c30d9a4e83e1ac713d0c77200296fff3a0de228a152d6970259093b57b872dfa44ab353ad1d10f13f3cbcda939f3296ed69fa19e21ce9af5919dbce41a2368978ae38f5f5fc8e6e569616d10689ecba3f21300383e7885c1c3a4115ed9012010bc76dae7ae6cb07d72a8", 0x84, 0xfffffffffffffffa) r4 = add_key(&(0x7f00000008c0)='syzkaller\x00', &(0x7f0000000900)={'syz', 0x2}, &(0x7f0000000940)="6da338e8128f225b6b2f9b6f819c0f76aae0fe7cc8ebae43e1695a2d826a5fe3366a7a201ebb0d039e44d0a67eb08493eef72abff0a9938bf8b09612cdca68b1b1e7655f446d2bfd8ee9750e35a65f462ac5b2f4a66a2a9130225376e70046f4b847c09967ec7273ef2c8c42a8ed7909e0b4390545a669d792c467dfac13597870e68876df446d3609e66bf4cc4cd41b047dc183a2345be0b42f785983153152c4d9a92f5bef6c5060d3a37b181893439cff5322453b6b6ad983f5972d1e28ad403d1ffb", 0xc4, 0xfffffffffffffffb) add_key$keyring(&(0x7f0000000200)='keyring\x00', &(0x7f0000000880)={'syz'}, 0x0, 0x0, r4) 18:20:10 executing program 2: r0 = socket$netlink(0x10, 0x3, 0x4) writev(r0, &(0x7f0000000000)=[{&(0x7f0000000200)="580000001400192340834b80040d8c5602067fffffff81000000000000dca87086a5c000004f6400940005891550f4a8000000006700008000f0fffeffff09000080fff5dd0000001000010000", 0x4d}], 0x1) [ 478.533411] binder: 31812:31814 Acquire 1 refcount change on invalid ref 0 ret -22 18:20:10 executing program 3: r0 = add_key(&(0x7f00000000c0)='user\x00', &(0x7f0000000100)={'syz'}, &(0x7f0000000200)="82", 0x1, 0xfffffffffffffffb) add_key(&(0x7f0000000000)='id_legacy\x00', &(0x7f0000000040)={'syz', 0x3}, &(0x7f0000000140)="4ffe1e56940e25868e2cb616f43e4e454eea73e6d1c3d3de8e123f0821ce5d65fb5d3bfcd63d75f6d3f134a3e41cbe4252bfff28f41fc97c024335fdcb6046964fb1d732018d41", 0x47, r0) socketpair(0xa, 0x0, 0xffffffff, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) accept4$packet(0xffffffffffffffff, &(0x7f0000000380)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000001c0)=0x14, 0x80000) setsockopt$packet_drop_memb(r1, 0x107, 0x2, &(0x7f0000000400)={r2, 0x1, 0x6, @local}, 0x10) 18:20:10 executing program 2: r0 = socket$netlink(0x10, 0x3, 0x4) writev(r0, &(0x7f0000000000)=[{&(0x7f0000000200)="580000001400192340834b80040d8c5602067fffffff81000000000000dca87086a5c000004f6400940005891550f4a8000000006700008000f0fffeffff09000080fff5dd0000001000010000", 0x4d}], 0x1) 18:20:10 executing program 5: request_key(&(0x7f0000000240)='keyring\x00', &(0x7f0000000280)={'syz', 0x0}, &(0x7f00000002c0)='vboxnet1\x00', 0xfffffffffffffffe) r0 = openat$null(0xffffffffffffff9c, &(0x7f0000000000)='/dev/null\x00', 0x0, 0x0) clock_gettime(0x0, &(0x7f0000001c80)={0x0, 0x0}) recvmmsg(0xffffffffffffff9c, &(0x7f0000001b40)=[{{&(0x7f0000000040)=@hci={0x1f, 0x0}, 0x80, &(0x7f0000000300)=[{&(0x7f00000000c0)=""/29, 0x1d}, {&(0x7f0000000100)=""/198, 0xc6}, {&(0x7f0000000200)}], 0x3, &(0x7f0000000340)=""/164, 0xa4, 0x1}, 0x2}, {{0x0, 0x0, &(0x7f0000000480)=[{&(0x7f0000000400)=""/81, 0x51}], 0x1, 0x0, 0x0, 0x3}, 0x5f}, {{&(0x7f00000004c0)=@alg, 0x80, &(0x7f0000000600)=[{&(0x7f0000000540)=""/190, 0xbe}], 0x1, &(0x7f0000000640)=""/180, 0xb4, 0x181a}, 0x5c}, {{0x0, 0x0, &(0x7f0000001800)=[{&(0x7f0000000700)=""/58, 0x3a}, {&(0x7f0000000740)=""/165, 0xa5}, {&(0x7f0000000800)=""/4096, 0x1000}], 0x3, &(0x7f0000001840)=""/140, 0x8c, 0x2}, 0x77b}, {{&(0x7f0000001900)=@in6={0xa, 0x0, 0x0, @loopback}, 0x80, &(0x7f0000001b00)=[{&(0x7f0000001980)=""/85, 0x55}, {&(0x7f0000001a00)=""/206, 0xce}], 0x2, 0x0, 0x0, 0x1f}, 0xcb}], 0x5, 0x40010021, &(0x7f0000001cc0)={r1, r2+30000000}) setsockopt$inet_mreqn(r0, 0x0, 0x20, &(0x7f0000001d00)={@multicast2, @loopback, r3}, 0xc) setsockopt$inet_mreqn(r0, 0x0, 0x24, &(0x7f0000000200)={@local, @multicast1, r3}, 0xc) [ 478.588299] binder: 31812:31814 unknown command 0 [ 478.601843] binder: 31812:31830 Release 1 refcount change on invalid ref 0 ret -22 [ 478.634131] binder: 31812:31814 ioctl c0306201 20012000 returned -22 [ 478.642595] binder: 31812:31830 unknown command 0 [ 478.659228] binder: 31812:31834 Release 1 refcount change on invalid ref 0 ret -22 [ 478.667354] binder: 31812:31830 ioctl c0306201 20000100 returned -22 [ 478.671266] binder: BINDER_SET_CONTEXT_MGR already set 18:20:10 executing program 5: request_key(&(0x7f0000000000)='keyring\x00', &(0x7f0000000280)={'syz', 0x0}, &(0x7f00000002c0)='vboxnet1\x00', 0xfffffffffffffffe) 18:20:10 executing program 2: r0 = socket$netlink(0x10, 0x3, 0x4) writev(r0, &(0x7f0000000000)=[{&(0x7f0000000200)="580000001400192340834b80040d8c5602067fffffff81000000000000dca87086a5c000004f6400940005891550f4a8000000006700008000f0fffeffff09000080fff5dd00000010000100000c0900fcff00", 0x53}], 0x1) [ 478.671274] binder: 31819:31826 ioctl 40046207 0 returned -16 18:20:10 executing program 4: r0 = syz_open_dev$binder(&(0x7f00000002c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000300)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, &(0x7f0000012fc7)}) r2 = memfd_create(&(0x7f0000000000)='vboxnet1user\x00', 0x0) ioctl$BLKGETSIZE64(r2, 0x80081272, &(0x7f0000000040)) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], 0x0, 0x0, &(0x7f0000000f4d)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000000c0)={0x8, 0x0, &(0x7f0000000140)=[@release], 0x0, 0x0, &(0x7f0000000340)}) [ 478.771508] binder: 31852:31855 unknown command 0 [ 478.780162] binder: 31812:31814 unknown command 0 [ 478.787279] binder: 31812:31830 unknown command 0 [ 478.793622] binder: 31812:31814 ioctl c0306201 20012000 returned -22 [ 478.806702] binder: 31852:31855 ioctl c0306201 20008fd0 returned -22 18:20:10 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000300)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, &(0x7f0000012fc7)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, &(0x7f0000000f4d)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x8, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="9d5008d8efe989644b687681d28ca6b5709e"]}) openat$null(0xffffffffffffff9c, &(0x7f0000000000)='/dev/null\x00', 0x8000, 0x0) 18:20:10 executing program 3: r0 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000080)='/dev/vga_arbiter\x00', 0x401, 0x0) r1 = getuid() getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000140)={0x0, 0x0, 0x0}, &(0x7f0000000180)=0xc) mount$fuse(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040)='fuse\x00', 0x0, &(0x7f0000000240)={{'fd', 0x3d, r0}, 0x2c, {'rootmode', 0x3d, 0x2000}, 0x2c, {'user_id', 0x3d, r1}, 0x2c, {'group_id', 0x3d, r2}, 0x2c, {[{@blksize={'blksize', 0x3d, 0x200}}, {@max_read={'max_read', 0x3d, 0x14ac000000000}}, {@max_read={'max_read', 0x3d, 0x2}}, {@max_read={'max_read', 0x3d, 0x100000001}}, {@blksize={'blksize'}}], [{@audit='audit'}]}}) add_key(&(0x7f00000000c0)='user\x00', &(0x7f0000000100)={'syz'}, &(0x7f0000000200)="82", 0x1, 0xfffffffffffffffb) 18:20:10 executing program 0: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) socketpair(0x2, 0xa, 0x5, &(0x7f0000000000)={0xffffffffffffffff}) ioctl$sock_FIOGETOWN(r1, 0x8903, &(0x7f0000000080)=0x0) setpriority(0x1, r2, 0x401) ptrace$setopts(0x4206, r2, 0x0, 0x0) openat$cgroup_ro(r1, &(0x7f0000000040)='cpuacct.usage_sys\x00', 0x0, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) request_key(&(0x7f00000000c0)='id_legacy\x00', &(0x7f0000000100)={'syz', 0x3}, &(0x7f0000000140)='syz', 0x0) r3 = add_key$keyring(&(0x7f0000000280)='keyring\x00', &(0x7f00000002c0)={'syz', 0x1}, 0x0, 0x0, 0xfffffffffffffffe) add_key$keyring(&(0x7f0000000300)='keyring\x00', &(0x7f0000000240)={'syz', 0x2}, 0x0, 0x0, r3) 18:20:10 executing program 2: r0 = socket$netlink(0x10, 0x3, 0x4) writev(r0, &(0x7f0000000000)=[{&(0x7f0000000200)="580000001400192340834b80040d8c5602067fffffff81000000000000dca87086a5c000004f6400940005891550f4a8000000006700008000f0fffeffff09000080fff5dd00000010000100000c0900fcff00", 0x53}], 0x1) 18:20:10 executing program 5: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff}) bind$unix(r0, &(0x7f0000000040)=@abs={0x1, 0x0, 0x4e22}, 0x6e) request_key(&(0x7f0000000240)='keyring\x00', &(0x7f0000000280)={'syz', 0x0}, &(0x7f00000002c0)='vboxnet1\x00', 0xfffffffffffffffe) 18:20:10 executing program 4: r0 = syz_open_dev$binder(&(0x7f00000002c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000300)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, &(0x7f0000012fc7)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, &(0x7f0000000f4d)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000000c0)={0x8, 0x0, &(0x7f0000000140)=[@release], 0x0, 0x0, &(0x7f0000000340)}) fstat(r0, &(0x7f0000000040)={0x0, 0x0, 0x0, 0x0, 0x0}) getsockopt$inet_IP_IPSEC_POLICY(0xffffffffffffff9c, 0x0, 0x10, &(0x7f0000000180)={{{@in6=@mcast1, @in=@remote, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{}, 0x0, @in6=@remote}}, &(0x7f0000000100)=0xfde2) getsockopt$sock_cred(0xffffffffffffff9c, 0x1, 0x11, &(0x7f0000000280)={0x0, 0x0}, &(0x7f0000000340)=0xc) r5 = openat$selinux_avc_cache_stats(0xffffffffffffff9c, &(0x7f0000000980)='/selinux/avc/cache_stats\x00', 0x0, 0x0) setsockopt$sock_int(r5, 0x1, 0xa, &(0x7f00000009c0)=0x7, 0x4) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffff9c, 0x29, 0x23, &(0x7f0000000380)={{{@in=@loopback, @in=@rand_addr, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@broadcast}, 0x0, @in=@multicast2}}, &(0x7f0000000480)=0xe8) r7 = getuid() getsockopt$inet_IP_XFRM_POLICY(0xffffffffffffffff, 0x0, 0x11, &(0x7f00000004c0)={{{@in6=@mcast2, @in6=@mcast1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@dev}, 0x0, @in6=@mcast2}}, &(0x7f00000005c0)=0xe8) stat(&(0x7f0000000600)='./file0\x00', &(0x7f0000000640)={0x0, 0x0, 0x0, 0x0, 0x0}) fstat(r0, &(0x7f00000006c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) lstat(&(0x7f0000000740)='./file0\x00', &(0x7f0000000780)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) getgroups(0x2, &(0x7f0000000800)=[0xee01, 0x0]) getresgid(&(0x7f0000000840)=0x0, &(0x7f0000000880), &(0x7f00000008c0)) bind$packet(r5, &(0x7f0000000a00)={0x11, 0x7, r8, 0x1, 0x7}, 0x14) fsetxattr$system_posix_acl(r0, &(0x7f0000000000)='system.posix_acl_default\x00', &(0x7f0000000900)={{}, {}, [{0x2, 0x7, r2}, {0x2, 0x3, r3}, {0x2, 0xbe56dc0aba6cb8fb, r4}, {0x2, 0x1, r6}, {0x2, 0x4, r7}, {0x2, 0x5, r9}, {0x2, 0x4, r10}], {0x4, 0x1}, [{0x8, 0x1, r11}, {0x8, 0x7, r12}, {0x8, 0x1, r13}, {0x8, 0x0, r14}], {0x10, 0x4}, {0x20, 0x7}}, 0x7c, 0x1) 18:20:10 executing program 5: request_key(&(0x7f0000000240)='keyring\x00', &(0x7f0000000280)={'syz', 0x0}, &(0x7f00000002c0)='vboxnet1\x00', 0xfffffffffffffffe) r0 = socket(0xa, 0x80800, 0x3ff) getsockopt$inet6_tcp_buf(r0, 0x6, 0x40, &(0x7f00000001c0)=""/33, &(0x7f0000000040)=0xfffffffffffffff5) sendto(r0, &(0x7f0000000080)="6a982571db2f024c7e3f1075c1389c2159df7bb1350ecc98dc613118ae17e7ef2a8a697973c1e0760e995d35f1198bb402e15d8644a51000f829f4bbada94b25fc8ba04b1af3b8329d7f9f504c9a0021d907d9e47d03d1b7b2c4b5b4186955111f8588a3ce6713feefa719b738428325cf9ef1d4587cfe5dea218302c870d97816c5814bf20c33cfb8633b4943c4ea5aaea624e01f648ba429371f5fe69c6483e580f3fcd66d64b6a8adfc84dca5c363442e7c55571e86a133ded7ab63b0a918d2d6169b50c1710975b1f19c5e902dbe506f9489921120", 0xffffffffffffff02, 0x4000, 0x0, 0x0) 18:20:10 executing program 2: r0 = socket$netlink(0x10, 0x3, 0x4) writev(r0, &(0x7f0000000000)=[{&(0x7f0000000200)="580000001400192340834b80040d8c5602067fffffff81000000000000dca87086a5c000004f6400940005891550f4a8000000006700008000f0fffeffff09000080fff5dd00000010000100000c0900fcff00", 0x53}], 0x1) [ 478.815531] binder: 31812:31830 ioctl c0306201 20000100 returned -22 [ 478.824927] binder: 31812:31814 Release 1 refcount change on invalid ref 0 ret -22 [ 478.837630] binder: BINDER_SET_CONTEXT_MGR already set [ 478.839112] binder: 31852:31863 unknown command 0 [ 478.839120] binder: 31852:31863 ioctl c0306201 20008fd0 returned -22 [ 478.857804] binder: 31852:31855 ioctl 40046207 0 returned -16 18:20:11 executing program 3: add_key(&(0x7f00000001c0)="6b65797201000000", &(0x7f0000000100)={'syz', 0x0}, &(0x7f0000000140)="6567e14839ec6a28a27085304b58a14a8ddd8e1bf71f7342a29bb15dbf95e60100ce8468d8ff99fb76bc2d2ab1b08b8d99a6d269f591c5f6d69bd8866f5a0dd609bbeeea3b90859e50e4c5243e5ddb03e6f88b985ac0f77b89341e7da2", 0xfcbb, 0xfffffffffffffffb) r0 = syz_open_dev$mice(&(0x7f0000000000)='/dev/input/mice\x00', 0x0, 0x40) ioctl$PIO_FONTX(r0, 0x4b6c, &(0x7f0000000340)="b95e0e0d242397fa4e5821f3163fe6b3f25ded0d4fbfda2765ea13bd9ce93f45cd00d9a033c6cc21395816eb1d08296af43084593f776ac69021c318c280bad8f24d8890c12227d7039d99053301ee9db51bebfbd956ab99cefbdefe4932e94a01e8ea0d863a179e4d3c5527b4e89bda943a6abbf0c6411e243608183aded5ed4fb191660159ed8e18bfacf14274d6ecda01d94975586627c16de5a5c0f7b28b705b") write$P9_RWRITE(r0, &(0x7f0000000040)={0xb, 0x77, 0x2, 0x3}, 0xb) lsetxattr$security_smack_transmute(&(0x7f0000000240)='./file0\x00', &(0x7f0000000280)='security.SMACK64TRANSMUTE\x00', &(0x7f00000002c0)='TRUE', 0x4, 0x2) ioctl$BLKRESETZONE(r0, 0x40101283, &(0x7f0000000300)={0x4, 0x52d7}) lgetxattr(&(0x7f0000000080)='./file0\x00', &(0x7f00000000c0)=@known='trusted.overlay.nlink\x00', &(0x7f0000000200)=""/36, 0x24) 18:20:11 executing program 2: r0 = socket$netlink(0x10, 0x3, 0x4) writev(r0, &(0x7f0000000000)=[{&(0x7f0000000200)="580000001400192340834b80040d8c5602067fffffff81000000000000dca87086a5c000004f6400940005891550f4a8000000006700008000f0fffeffff09000080fff5dd00000010000100000c0900fcff0000040e", 0x56}], 0x1) 18:20:11 executing program 5: r0 = accept4(0xffffffffffffffff, &(0x7f0000000140)=@alg, &(0x7f00000001c0)=0x80, 0x80800) ioctl$FS_IOC_GETFLAGS(r0, 0x80086601, &(0x7f0000000200)) socket$nl_route(0x10, 0x3, 0x0) keyctl$session_to_parent(0x12) close(r0) request_key(&(0x7f0000000380)="0036f0dd4aa9f2100d300adf6439d7e9ab8a6cf2b4cd023c42947b53642ccb1ea47648f0cd307b9b2a8753a0019c05777c1bc2b56ffcd4181ef93ad45b22af4909bb0b68ed9bb6e618c6236e39569d4714da897e9959e3d3e530737fbd0e15c6353ddcb2dc71f7bacfed3971406b08fcee1329f6e0d3d71188a77236df63decea7ca7fe13d7079c2c5b62c73731c", &(0x7f0000000280)={'syz', 0x0}, &(0x7f00000002c0)='vboxnet1\x00', 0xfffffffffffffffe) r1 = openat$selinux_checkreqprot(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/checkreqprot\x00', 0x0, 0x0) ioctl$EVIOCGVERSION(r1, 0x80044501, 0xfffffffffffffffe) fsetxattr$security_capability(r0, &(0x7f0000000300)='security.capability\x00', &(0x7f0000000340)=@v1={0x1000000, [{0x7, 0x6}]}, 0xc, 0x1) ioctl$EVIOCGBITSND(r1, 0x80404532, &(0x7f0000000040)=""/229) 18:20:11 executing program 4: r0 = syz_open_dev$binder(&(0x7f00000002c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000300)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x10, 0x0, &(0x7f0000000000)=[@request_death={0x400c630e, 0x4, 0x2}], 0x0, 0x0, &(0x7f0000012fc7)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=ANY=[@ANYBLOB="ff00000000000000"], 0x0, 0x0, &(0x7f0000000f4d)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000000c0)={0x8, 0x0, &(0x7f0000000140)=[@release], 0x0, 0x0, &(0x7f0000000340)}) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) setsockopt(r2, 0x2, 0xffffffffffff7fff, &(0x7f0000000040)="4c731bb7b2f995c87b221163e27b755b2aa33a341e701947ed16f336dc33831e76b891fe929f0ee9b2d82381bf60c8bc5f75e2758d466b6fd8710e55c3a1b646d0e80eef65da181e68", 0x49) [ 478.937071] binder: 31874:31884 unknown command -670543715 [ 478.951561] binder: BINDER_SET_CONTEXT_MGR already set [ 478.965340] binder: 31874:31884 ioctl c0306201 200000c0 returned -22 [ 478.971710] binder: 31878:31885 ioctl 40046207 0 returned -16 [ 478.996725] binder: 31874:31884 Acquire 1 refcount change on invalid ref 0 ret -22 [ 479.012122] binder: 31874:31896 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 479.029191] binder: 31897:31902 BC_REQUEST_DEATH_NOTIFICATION invalid ref 4 [ 479.036596] binder: 31874:31884 unknown command -670543715 18:20:11 executing program 1: r0 = openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000040)='/selinux/commit_pending_bools\x00', 0x1, 0x0) creat(&(0x7f0000000080)='./file0\x00', 0x1) ioctl$RTC_VL_CLR(r0, 0x7014) r1 = syz_open_dev$binder(&(0x7f0000000300)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, &(0x7f0000012fc7)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, &(0x7f0000000f4d)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000000c0)={0x8, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0663044000b677adc66e03c309000000"], 0x0, 0x0, &(0x7f0000000340)}) 18:20:11 executing program 2: r0 = socket$netlink(0x10, 0x3, 0x4) writev(r0, &(0x7f0000000000)=[{&(0x7f0000000200)="580000001400192340834b80040d8c5602067fffffff81000000000000dca87086a5c000004f6400940005891550f4a8000000006700008000f0fffeffff09000080fff5dd00000010000100000c0900fcff0000040e", 0x56}], 0x1) [ 479.044708] binder: 31874:31884 ioctl c0306201 200000c0 returned -22 [ 479.061510] binder: 31897:31902 unknown command 255 [ 479.068858] binder: 31897:31902 ioctl c0306201 20008fd0 returned -22 [ 479.089331] binder: 31897:31902 Release 1 refcount change on invalid ref 0 ret -22 [ 479.103147] binder: BINDER_SET_CONTEXT_MGR already set [ 479.117895] binder: 31911:31912 Release 1 refcount change on invalid ref -1384663552 ret -22 [ 479.125773] binder: 31897:31913 BC_REQUEST_DEATH_NOTIFICATION invalid ref 4 [ 479.125839] binder: 31897:31914 unknown command 255 [ 479.125848] binder: 31897:31914 ioctl c0306201 20008fd0 returned -22 [ 479.125918] binder: 31897:31913 Release 1 refcount change on invalid ref 0 ret -22 18:20:11 executing program 0: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180)) openat$pfkey(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/net/pfkey\x00', 0x40000, 0x0) r0 = openat$selinux_avc_cache_threshold(0xffffffffffffff9c, &(0x7f0000000040)='/selinux/avc/cache_threshold\x00', 0x2, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400202) add_key$keyring(&(0x7f0000000200)='keyring\x00', &(0x7f0000000240)={'syz'}, 0x0, 0x0, 0xfffffffffffffffb) 18:20:11 executing program 5: 18:20:11 executing program 3: add_key(&(0x7f00000000c0)='user\x00', &(0x7f0000000100)={'syz'}, &(0x7f0000000200)="82", 0x1, 0xfffffffffffffffb) r0 = dup3(0xffffffffffffff9c, 0xffffffffffffffff, 0x80000) ioctl$BLKSECDISCARD(r0, 0x127d, &(0x7f0000000000)=0x5) 18:20:11 executing program 2: r0 = socket$netlink(0x10, 0x3, 0x4) writev(r0, &(0x7f0000000000)=[{&(0x7f0000000200)="580000001400192340834b80040d8c5602067fffffff81000000000000dca87086a5c000004f6400940005891550f4a8000000006700008000f0fffeffff09000080fff5dd00000010000100000c0900fcff0000040e", 0x56}], 0x1) 18:20:11 executing program 5: r0 = memfd_create(&(0x7f0000000000)='syz', 0x2) ioctl$SNDRV_TIMER_IOCTL_TREAD(r0, 0x40045402, &(0x7f0000000040)=0x1) request_key(&(0x7f0000000240)='keyring\x00', &(0x7f0000000280)={'syz', 0x0}, &(0x7f00000002c0)='vboxnet1\x00', 0xfffffffffffffffe) 18:20:11 executing program 4: r0 = syz_open_dev$binder(&(0x7f00000002c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$EXT4_IOC_PRECACHE_EXTENTS(r0, 0x6612) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000300)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, &(0x7f0000012fc7)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\b\x00'], 0x0, 0x0, &(0x7f0000000f4d)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000000c0)={0x8, 0x0, &(0x7f0000000140)=[@release], 0x0, 0x0, &(0x7f0000000340)}) r2 = socket$inet6(0xa, 0x6, 0x7) setsockopt$inet6_tcp_int(r2, 0x6, 0x1b, &(0x7f0000000080)=0xffff, 0x4) flistxattr(r0, &(0x7f0000000000)=""/79, 0x4f) ioctl$FS_IOC_GETFSMAP(r0, 0xc0c0583b, &(0x7f0000000340)={0x0, 0x0, 0x5, 0x0, [], [{0x6, 0x6, 0xcb, 0x1f, 0x4, 0x3bc}, {0x7, 0x2, 0x9, 0x5, 0x7ff}], [[], [], [], [], []]}) 18:20:11 executing program 2: r0 = socket$netlink(0x10, 0x3, 0x4) writev(r0, &(0x7f0000000000)=[{&(0x7f0000000200)="580000001400192340834b80040d8c5602067fffffff81000000000000dca87086a5c000004f6400940005891550f4a8000000006700008000f0fffeffff09000080fff5dd00000010000100000c0900fcff0000040e05", 0x57}], 0x1) [ 479.145747] binder: 31897:31902 ioctl 40046207 0 returned -16 18:20:11 executing program 5: r0 = request_key(&(0x7f0000000240)='keyring\x00', &(0x7f0000000280)={'syz', 0x0}, &(0x7f00000002c0)='vboxnet1\x00', 0xfffffffffffffffe) request_key(&(0x7f0000000000)='syzkaller\x00', &(0x7f0000000040)={'syz', 0x2}, &(0x7f0000000080)='syz', r0) 18:20:11 executing program 3: add_key(&(0x7f00000000c0)='user\x00', &(0x7f0000000100)={'syz'}, &(0x7f0000000200)="82", 0x1, 0xfffffffffffffffb) r0 = openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000040)='/selinux/commit_pending_bools\x00', 0x1, 0x0) ioctl$TCSBRK(r0, 0x5409, 0xffffffffffff0001) 18:20:11 executing program 0: r0 = openat$apparmor_thread_exec(0xffffffffffffff9c, &(0x7f0000000100)='/proc/thread-self/attr/exec\x00', 0x2, 0x0) pwrite64(r0, &(0x7f0000000380)="8770b30fd03c126557d43862c9cf1398d0b5317899aa9435917a8d1590601f5d402ff1488da2aa815820dfc96274132abc1d", 0x32, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) request_key(&(0x7f0000000080)='keyring\x00', &(0x7f00000000c0)={'syz', 0x0}, &(0x7f0000000000)="776c616e305be9215b256e6f646576757365726c6f00", 0x0) r3 = fcntl$dupfd(r0, 0x0, r1) ioctl$EVIOCGLED(r3, 0x80404519, &(0x7f00000005c0)=""/158) r4 = request_key(&(0x7f00000001c0)='user\x00', &(0x7f0000000280)={'syz', 0x3}, &(0x7f00000002c0)='syz', 0xfffffffffffffffb) add_key$keyring(&(0x7f0000000300)='keyring\x00', &(0x7f0000000340)={'syz', 0x3}, 0x0, 0x0, r4) r5 = openat$pfkey(0xffffffffffffff9c, &(0x7f0000000580)='/proc/self/net/pfkey\x00', 0x20000, 0x0) r6 = accept4$inet(r5, &(0x7f0000000140)={0x2, 0x0, @multicast2}, &(0x7f0000000040)=0x10, 0x80800) sendto$inet(r6, &(0x7f0000000400)="b79eea18d69b2fee78da2bbcd54f50f384e7336c7fc9278940f7149ac8262cbada9c61187ef35fa6545bc1e9f882532c74679ff5e9cfa14a7e4bfacda434752ef24f17ece7ca16a8f437cd0b91a724cb47c5f97e0138d54e91ddbfdec80ace7951ba0dcddc651cc30987bc64d9c020a4fd88ab07e8889adc19e71ff94b2f77de439981495070640fc32e456e9f6125052570e52a51ce9512af9c679852c66b91bac0717198735539207d6f10cb624cb8f0c40aa7afbcc9df32398d8c1916b1a4f81b3886e9e7a243a911d8a18fd5ddc2b398f0", 0xd3, 0x4800, &(0x7f0000000240)={0x2, 0x4e22, @loopback}, 0x10) ioctl$EXT4_IOC_SETFLAGS(r0, 0x40086602, &(0x7f00000003c0)=0x4000) getpid() [ 479.243463] binder: 31928:31932 ioctl 6612 0 returned -22 [ 479.257166] binder: 31928:31932 unknown command 0 [ 479.268844] binder: 31928:31932 ioctl c0306201 20008fd0 returned -22 18:20:11 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000300)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0xfffffffffffffd9d, 0x0, &(0x7f0000000140)="b6cf767f236f5c9edee95155edceae2f"}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, &(0x7f0000000f4d)}) r1 = memfd_create(&(0x7f0000000040)='/dev/binder#\x00', 0x6) getsockopt$SO_COOKIE(r1, 0x1, 0x39, &(0x7f0000000080), &(0x7f00000000c0)=0x23f) signalfd4(r0, &(0x7f0000000000)={0xffffffff}, 0x8, 0x800) write$P9_ROPEN(r1, &(0x7f0000000100)={0x18, 0x71, 0x1, {{0x89, 0x4, 0x6}, 0xffffffff}}, 0x18) write$P9_RREADLINK(r1, &(0x7f0000000180)={0x10, 0x17, 0x2, {0x7, './file0'}}, 0x10) 18:20:11 executing program 2: r0 = socket$netlink(0x10, 0x3, 0x4) writev(r0, &(0x7f0000000000)=[{&(0x7f0000000200)="580000001400192340834b80040d8c5602067fffffff81000000000000dca87086a5c000004f6400940005891550f4a8000000006700008000f0fffeffff09000080fff5dd00000010000100000c0900fcff0000040e05", 0x57}], 0x1) 18:20:11 executing program 3: r0 = add_key(&(0x7f0000000080)="75736572c1992f438a62d208", &(0x7f0000000100)={'syz'}, &(0x7f0000000200)="82", 0x1, 0xfffffffffffffffb) keyctl$instantiate_iov(0x14, r0, &(0x7f0000000040)=[{&(0x7f0000000000)="17ca16322794f8be2f9e", 0xa}, {&(0x7f0000000240)="244baaf6a8444d94e59dbaeb51cfc97347adb1eb85f53e0e931ce9955c0a3ac6741fccf8451412f83784d7274b1940bbeaf5e17c85eb52d1ccba9e8cbd8f106c709ae58a0fce102270f211d6b155b16d17f3c41dea1ac8a9dc9e0235e25441dfbf9a9da1a66117dd9ae701222c836e8377f9e029058ce7a4457265b1a07e8095754292dd8b0c60c585c25c3a541fac3f2d288c7c80709ead71264c2ea7bb128098ab8a3deb931904b389d402f20dfa2a62766bb6cd4d63f7cbfc1ec8052df725e094a5c1c22e184124ecb639", 0xcc}, {&(0x7f0000000140)="cfd3eaa113a7396d1e2d1c2bbf3723cbf57b2cc12d90ffb506bb3e6e0bcfc78026c1c26a34b2e2018716606e93cbb2f65de04f4f6e57bea44aaa8fd8cd99dcf3f47915033cbea80d07c7dfe98d6131b71710ffe5806746ce203b982e3726a22fef60e55dc5101e1fb03e84c09ca2281d78d98d044a15f548c3e2f1ac1131cee51849b877e5c7cd30afba", 0x8a}], 0x3, r0) 18:20:11 executing program 5: request_key(&(0x7f0000000240)='keyring\x00', &(0x7f0000000280)={'syz', 0x0}, &(0x7f00000002c0)='vboxnet1\x00', 0xfffffffffffffffe) 18:20:11 executing program 0: socketpair$unix(0x1, 0x80000000002, 0x0, &(0x7f0000000280)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$F_SET_RW_HINT(r0, 0x40c, &(0x7f0000000000)=0x7) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) add_key$keyring(&(0x7f0000000200)='keyring\x00', &(0x7f0000000240)={'syz'}, 0x0, 0x0, 0xfffffffffffffffb) 18:20:11 executing program 3: add_key(&(0x7f00000000c0)='user\x00', &(0x7f0000000100)={'syz'}, &(0x7f0000000200)="82", 0x1, 0xfffffffffffffffb) add_key(&(0x7f0000000000)="65d818a3ed7074656401", &(0x7f0000000040)={'syz', 0x3}, 0x0, 0x298, 0xfffffffffffffffc) socketpair$inet6_udp(0xa, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) setsockopt$inet6_udp_encap(r0, 0x11, 0x64, &(0x7f0000000140)=0x5, 0x4) [ 479.331530] binder: 31911:31949 tried to acquire reference to desc 0, got 1 instead [ 479.343785] binder: 31911:31912 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 479.351187] binder: 31928:31953 ioctl c0c0583b 20000340 returned -22 [ 479.353457] binder: 31911:31949 Release 1 refcount change on invalid ref -1384663552 ret -22 18:20:11 executing program 0: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ppp\x00', 0x800, 0x0) ioctl$ASHMEM_PURGE_ALL_CACHES(r1, 0x770a, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r2 = openat$selinux_status(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/status\x00', 0x0, 0x0) getsockopt$inet_tcp_TCP_ZEROCOPY_RECEIVE(r2, 0x6, 0x23, &(0x7f0000000100)={&(0x7f0000ffc000/0x2000)=nil, 0x2000}, &(0x7f0000000140)=0x10) ioctl$void(r0, 0xc0045c78) add_key$keyring(&(0x7f0000000200)='keyring\x00', &(0x7f0000000240)={'syz'}, 0x0, 0x0, 0xfffffffffffffffb) [ 479.396637] binder: 31928:31932 ioctl 6612 0 returned -22 [ 479.402923] binder: BINDER_SET_CONTEXT_MGR already set [ 479.417239] binder: 31928:31953 ioctl 40046207 0 returned -16 [ 479.441586] binder: 31928:31932 unknown command 0 [ 479.451047] binder: 31928:31932 ioctl c0306201 20008fd0 returned -22 [ 479.457679] binder: 31928:31953 Release 1 refcount change on invalid ref 0 ret -22 18:20:11 executing program 4: r0 = syz_open_dev$binder(&(0x7f00000002c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000300)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0xffffffffffffff7b, 0x0, &(0x7f0000000000)=[@acquire], 0x341, 0x0, &(0x7f0000012fc7)}) r2 = openat$full(0xffffffffffffff9c, &(0x7f0000000040)='/dev/full\x00', 0x80, 0x0) ioctl$SNDRV_TIMER_IOCTL_GINFO(r2, 0xc0f85403, &(0x7f0000000180)={{0x3, 0x2, 0x3a9, 0x0, 0xf08}, 0x13, 0x3, 'id1\x00', 'timer0\x00', 0x0, 0x40, 0xfffffffffffffc01, 0x40, 0x3ff}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, &(0x7f0000000f4d)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000000c0)={0x8, 0x0, &(0x7f0000000140)=[@release], 0x0, 0x0, &(0x7f0000000340)}) 18:20:11 executing program 5: socketpair(0x11, 0x3, 0x6, &(0x7f0000000000)={0xffffffffffffffff}) pipe(&(0x7f0000000080)) ioctl$TUNGETVNETHDRSZ(r0, 0x800454d7, &(0x7f0000000040)) request_key(&(0x7f0000000240)='keyring\x00', &(0x7f0000000280)={'syz', 0x0}, &(0x7f00000002c0)='vboxnet1\x00', 0xfffffffffffffffe) 18:20:11 executing program 2: r0 = socket$netlink(0x10, 0x3, 0x4) writev(r0, &(0x7f0000000000)=[{&(0x7f0000000200)="580000001400192340834b80040d8c5602067fffffff81000000000000dca87086a5c000004f6400940005891550f4a8000000006700008000f0fffeffff09000080fff5dd00000010000100000c0900fcff0000040e05", 0x57}], 0x1) 18:20:11 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000300)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(0xffffffffffffff9c, 0xc018620b, &(0x7f0000000000)={0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000012000)={0xffffff1b, 0x0, &(0x7f0000000040)=[@free_buffer={0x40086303, r1}], 0x3dd, 0x0, &(0x7f0000000080)}) fsetxattr$trusted_overlay_redirect(r0, &(0x7f0000000440)='trusted.overlay.redirect\x00', &(0x7f0000000400)='./file0/../file0\x00', 0x1, 0x1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="ea6875013f25f1f998a6115cd29866ccc4e7163dcec7512fa47055db60b3855845a8fbef89d5e808521371586014937548b7e1760cece6e7dac7634e6043a5bfcecd3e29a0270d70da6f4596b0df96124f5c9b2d999bde7728b7fad4153447fed84f72e3a8e1ba64fa5070d756d8fc0bbbe1eebbd9e37f9ce483b692557f1406e74ca372d3ba2f6842edb35e54a848391c4d718b2db18ec6c575139324448f8819c676fc0e0f489fc7fd75cdfc5fbf25c477b7d2e5ee6e1262e591c7361eaa9184f61a9c847611375a5fa49cc5a85fa3dcec74828382ec8edb0f3c97ae3c6266430b352f46c05d58b59df48ff2c6e7dd02b82ef7e814967c77d7b431a25215dc6b"], 0x0, 0x0, &(0x7f0000000f4d)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x8, 0x0, &(0x7f0000000380)=ANY=[@ANYBLOB="0663044000000000b9c060ae7928694b9c6a595f1f6a31a2c8d91bd1f26880ab646ec6f5891d3adcf2cf5229dc336d940ab95fdf2583904f192aee6496b89c97890978116873983354cbab7094dbd5984516c2edae0901f8a1641cb4d88b75d85080de57d47956161ea5e372491d4eb1cb38c6d5835c"], 0x0, 0x0, &(0x7f0000000340)}) r2 = openat(0xffffffffffffffff, &(0x7f0000000080)='./file0\x00', 0x630100, 0x4) ioctl$EVIOCSCLOCKID(r2, 0x400445a0, &(0x7f0000000100)=0x7) 18:20:11 executing program 3: r0 = add_key(&(0x7f00000000c0)='cifs.spnego\x00', &(0x7f0000000140)={'syz', 0x0}, &(0x7f0000000180), 0x0, 0xfffffffffffffffa) add_key$keyring(&(0x7f0000000040)='keyring\x00', &(0x7f0000000080)={'syz', 0x2}, 0x0, 0x0, r0) add_key(&(0x7f0000000000)='user\x00', &(0x7f0000000100)={'syz'}, &(0x7f0000000200)="82", 0xfffffffffffffff7, 0xfffffffffffffffb) 18:20:11 executing program 0: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = openat$selinux_avc_cache_threshold(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/avc/cache_threshold\x00', 0x2, 0x0) ioctl$PERF_EVENT_IOC_DISABLE(r1, 0x2401, 0x396) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) add_key$keyring(&(0x7f0000000200)='keyring\x00', &(0x7f0000000240)={'syz'}, 0x0, 0x0, 0xfffffffffffffffb) [ 479.497294] binder: 31928:31978 ioctl c0c0583b 20000340 returned -22 18:20:11 executing program 3: r0 = request_key(&(0x7f0000000000)='asymmetric\x00', &(0x7f0000000040)={'syz', 0x3}, &(0x7f0000000080)="b92700", 0xffffffffffffffff) add_key(&(0x7f00000000c0)='user\x00', &(0x7f0000000100)={'syz'}, &(0x7f0000000200)="82", 0x1, r0) 18:20:11 executing program 2: r0 = openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000040)='/selinux/commit_pending_bools\x00', 0x1, 0x0) creat(&(0x7f0000000080)='./file0\x00', 0x1) ioctl$RTC_VL_CLR(r0, 0x7014) r1 = syz_open_dev$binder(&(0x7f0000000300)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, &(0x7f0000012fc7)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, &(0x7f0000000f4d)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000000c0)={0x8, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0663044000b677adc66e03c309000000"], 0x0, 0x0, &(0x7f0000000340)}) 18:20:11 executing program 0: r0 = openat$selinux_policy(0xffffffffffffff9c, &(0x7f00000002c0)='/selinux/policy\x00', 0x0, 0x0) r1 = syz_open_dev$mice(&(0x7f0000000080)='/dev/input/mice\x00', 0x0, 0x80300) sendto$inet6(r0, &(0x7f0000000100), 0xffffffffffffff3e, 0x4000000, &(0x7f0000000040)={0xa, 0x4e23, 0x81, @dev={0xfe, 0x80, [], 0xb}, 0xffffffffffffff5d}, 0x13) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x80000000400200) add_key$keyring(&(0x7f0000000200)='keyring\x00', &(0x7f0000000240)={'syz'}, 0x0, 0x0, 0xfffffffffffffffb) ioctl$sock_SIOCSIFBR(0xffffffffffffffff, 0x8941, &(0x7f0000000000)=@generic={0x0, 0x9, 0xffffffff9bc45140}) [ 479.565154] binder: 31988:31992 BC_FREE_BUFFER u0000000000000000 no match [ 479.582675] binder: 31985:31996 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 479.599756] binder: 31988:31992 unknown command 0 [ 479.605604] binder: 31985:31996 Release 1 refcount change on invalid ref 0 ret -22 18:20:11 executing program 3: add_key(&(0x7f00000000c0)='user\x00', &(0x7f0000000100)={'syz'}, &(0x7f0000000000)="7f00000033", 0x5, 0xfffffffffffffffb) [ 479.632581] binder: 31988:32003 unknown command 24471786 [ 479.635193] binder: 31988:31992 ioctl c0306201 20012000 returned -22 [ 479.656256] binder: BINDER_SET_CONTEXT_MGR already set [ 479.669215] binder: 31985:32012 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 479.669964] binder: 31985:31996 ioctl 40046207 0 returned -16 [ 479.670242] binder: 31988:32003 ioctl c0306201 20008fd0 returned -22 [ 479.676569] binder: 31988:31992 Release 1 refcount change on invalid ref 0 ret -22 [ 479.676984] binder: 31988:32003 BC_FREE_BUFFER u0000000000000000 no match [ 479.676991] binder: 31988:32003 unknown command 0 [ 479.676999] binder: 31988:32003 ioctl c0306201 20012000 returned -22 [ 479.688749] binder: 31988:32003 unknown command 24471786 [ 479.688758] binder: 31988:32003 ioctl c0306201 20008fd0 returned -22 18:20:11 executing program 3: add_key(&(0x7f00000000c0)='user\x00', &(0x7f0000000100)={'syz'}, &(0x7f0000000200)="82", 0x1, 0xfffffffffffffffb) socketpair$inet6(0xa, 0xf, 0x7, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = openat$selinux_create(0xffffffffffffff9c, &(0x7f0000000040)='/selinux/create\x00', 0x2, 0x0) ioctl$EXT4_IOC_MOVE_EXT(r0, 0xc028660f, &(0x7f0000000080)={0x0, r1, 0x3f, 0x0, 0x5, 0x1000}) 18:20:11 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000300)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = openat(0xffffffffffffffff, &(0x7f0000000100)='./file0\x00', 0xa101, 0x10) write$FUSE_WRITE(r1, &(0x7f0000000180)={0x18, 0xffffffffffffffd9, 0x1, {0x6}}, 0x18) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB="05634aa9790d0003bec1d165a4a1ff0581b1085ce5964b168ce9d4686e9f2f"], 0x0, 0x0, &(0x7f0000012fc7)}) r2 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vga_arbiter\x00', 0x1c1880, 0x0) ioctl$TCSBRKP(r2, 0x5425, 0x1) ioctl$TUNSETVNETBE(r1, 0x400454de, &(0x7f00000001c0)) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, &(0x7f0000000f4d)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x8, 0x0, &(0x7f0000000140)=[@release], 0x0, 0x0, &(0x7f0000000200)}) socketpair(0x5, 0x5, 0x8, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TCSBRKP(r3, 0x5425, 0x7f) [ 479.688875] binder: 31988:31992 Release 1 refcount change on invalid ref 0 ret -22 [ 479.722469] binder: 32017:32019 unknown command -1454742779 [ 479.722478] binder: 32017:32019 ioctl c0306201 20012000 returned -22 [ 479.723192] binder: 32017:32019 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 479.723272] binder: 32017:32019 Release 1 refcount change on invalid ref 0 ret -22 [ 479.766677] binder: 32005:32008 Release 1 refcount change on invalid ref -1384663552 ret -22 18:20:11 executing program 4: r0 = syz_open_dev$binder(&(0x7f00000002c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ppoll(&(0x7f0000000000)=[{r0, 0x6438}, {r0}, {r0, 0x220}], 0x3, &(0x7f0000000040), &(0x7f0000000080)={0x20}, 0x8) r1 = syz_open_dev$binder(&(0x7f0000000300)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, &(0x7f0000012fc7)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, &(0x7f0000000f4d)}) io_setup(0x80, &(0x7f0000000100)=0x0) io_destroy(r2) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000000c0)={0x8, 0x0, &(0x7f0000000140)=[@release], 0x0, 0x0, &(0x7f0000000340)}) 18:20:11 executing program 3: socketpair$inet_udp(0x2, 0x2, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) getsockopt$IP_VS_SO_GET_SERVICES(r0, 0x0, 0x482, &(0x7f0000000240)=""/205, &(0x7f0000000040)=0xcd) add_key(&(0x7f00000000c0)='user\x00', &(0x7f0000000100)={'syz'}, &(0x7f0000000200)="82", 0x1, 0xfffffffffffffffb) 18:20:11 executing program 2: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = openat$selinux_avc_cache_threshold(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/avc/cache_threshold\x00', 0x2, 0x0) ioctl$PERF_EVENT_IOC_DISABLE(r1, 0x2401, 0x396) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) add_key$keyring(&(0x7f0000000200)='keyring\x00', &(0x7f0000000240)={'syz'}, 0x0, 0x0, 0xfffffffffffffffb) 18:20:11 executing program 5: request_key(&(0x7f0000000240)='keyring\x00', &(0x7f0000000280)={'syz', 0x0}, &(0x7f00000002c0)='vboxnet1\x00', 0xfffffffffffffffe) getgroups(0x1, &(0x7f0000000000)=[0xee01]) getgroups(0x0, &(0x7f0000000040)) lstat(&(0x7f0000000080)='./file0\x00', &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) getresgid(&(0x7f0000000140), &(0x7f0000000180), &(0x7f00000001c0)=0x0) getresgid(&(0x7f0000000200)=0x0, &(0x7f0000000300), &(0x7f0000000340)=0x0) setgroups(0x5, &(0x7f0000000380)=[r0, r3, r1, r2, r4]) 18:20:11 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000300)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, &(0x7f0000012fc7)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, &(0x7f0000000f4d)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x8, 0x0, &(0x7f0000000140)=[@release], 0x0, 0x0, &(0x7f0000000340)}) socketpair$inet6(0xa, 0x80007, 0x7fffffff, &(0x7f0000000000)={0xffffffffffffffff}) sendmmsg(r1, &(0x7f0000000b80)=[{{&(0x7f0000000040)=@in6={0xa, 0x4e20, 0xffff, @dev={0xfe, 0x80, [], 0x16}, 0x9}, 0x80, &(0x7f0000000200)=[{&(0x7f0000000100)}, {&(0x7f0000000180)="3fdb9f0a058103296d57ae3f1ed00dbd76861cdd6ca5120bac2d4075e259f59d47bfeccbdde1ec892eb11df374dfd3aad403370b76fae79e0fe4cd3643bfeb8478ffa47695c14ad54d7bfd4ae1df9983561cd3eaa205a89048a8ac709a7b", 0x5e}], 0x2, 0x0, 0x0, 0x4}, 0x3}, {{0x0, 0x0, &(0x7f00000005c0)=[{&(0x7f0000000240)="a6488c9457dce660bdef67fe1dfe830a9cb6793dad39a971465f4304e42d9c53a14a1cb9753904929e85a53333e09e5394bc4e6803472fbcc1508dfa330ddd0c4f8c1de7327782e0b85c96099571b93c146bf444aecea2bfc722374e39478d4318df22f7531ad54907cce28150ed8cfc4f22fddd0e8109ff7227037b759b5b36ea6d47c79759ff0be13b96e865d5f948c7e50b", 0x93}, {&(0x7f0000000340)="eeb6453ab606248d4d960e5650fe044dc5daed77cb20781f22e706f3546987691413f7db689cb45f8b9d16c9191602eb3f59a6f6d64e92679f15e11406fd50346a702655017dbdc8f894941e7bda95a7f6e9e211f23f1e498e97275895c2477feb846dbbebeef34213a89407825b63fcf4f217cfdaeeb0bfae7e72d569c7f029efa721dffd949e5c592e5f127fbad8824123aaf44fe771649423386a12db7b479fa8349e8a26e53b3d93e9dfd3db51d7b09d5cf14b27f8e9f4", 0xb9}, {&(0x7f0000000400)="31cf87dab2f8be2f26244bbf98e69aa73dbe1af8c3e4f7c653c14abf5ddf6962b299c79a95b6200f4facd30825bc94b65a2eb19d6bbf07021a72018acf4f8e18df5e9affe9f3564e66ae42827f339a43bbbffc561990422f05379fdd87f2db13db18aa71212428630e58ce4feab495c9d8e70ff023a07fe9478be583d760b18995c7a579f2a4564a45ea5a2c2583286c39a4382eef2f4eddf9b073805df8ce757dbab535b1fb6ae63b5f96cc88ac6735160c48645d572980c6971c33b8f60289a5c91b50c7d2d40459089fcdb3225d467f3dcb273566a2087e0d786c939ded4a", 0xe0}, {&(0x7f0000000500)="7df8d7e4f4ca9c626eae7502d1ee68f84f3141aedd2fd3ce91acd80ed86ce15dc00440f75c62323bd67d9b35717589ab6e3a70e8252e4423cfc9359d14e5ebf8c46a0a433acb38efe612ff2a851c28d3cc2d333bc543828c715bb979e31f5d76e15a2d0f94fc4d80df961edbab0011d51de0a14fec58fb1ffcbf939f8f88698d9f16e0b37a7d3f7e2c21a0d1fd0a2e3280ba28f10be55f465a4c39d693a7e76919ef96c78365bc2640b9c2cdf9502d20a585d3dfec32abbf54", 0xb9}], 0x4, &(0x7f0000000600)=[{0x30, 0x2b6b2d5e1b49771d, 0x1, "3dc1166c4f1f7481077b109e733507b37eb9b48ea0bb9e9d755d78553392"}, {0x48, 0x1ff, 0xffff, "6443d07235975bbca3853cd5710028bb69252c9eb066dbe9d634e8e5f106d6ce989335e8e3d39ffd99cb2215e23a40df9033d0dd51b31c"}, {0xc8, 0x107, 0xfffffffffffff25d, "9b165c50e5b9cca17cfd28481ccebe6d3ae714ff93213c9d83094b6a3c61986f727462d2c6eb28beca0545994cbf7135267eb61e5bbbf43674cc7bff0d7a87ec88169ed07610a3bab8e2593bdc4ea26251830da7063cc7fedc0c8a028497d2c9c737da3840b7b8676c17e0f031c25884d4d8f698e1f66746f58f47daad57ea2c0a98db22469a752e3f880f2f23f4941977b727646f3d83fcc5b3f27f2a371ff2299f3902828ed502696d4a5879a3ae8d99fe"}, {0x68, 0x197, 0x6, "e24520a7ff00b80e95ad1894c10c0170087bfe6164e638b553f9bd3269cf9d3823db624facd1c22436cbb56e9e6e0be4a4dc9a453bfd20c431e856cdd83cc9845a4e21a524882069dae9dfa50cb235f0dc048ce702"}, {0x100, 0x0, 0x4, "73df14883b6611cc09c93083ab4cf90c1c58a559e7a1b4223f0199b9b96aa2131d062d1c323a677612808df6cbb30f02ed749626f627f8fec3ffbb337383ed806d20c84666cc5cc748733f2bae10dc36101fac6b9ef6fb739f7bc24429c22690c30f8e383adf02e78a942f7647dd146bf3dbbf2d080cabe8c87b41b971edd2279fb88d81332f586ba1e2aebbb01d6585f08a586a9fac529144e7e1d5304ea244deff600cc77c30c57ba4384443b890d67ca78203eba67bdfecebb955028d812a409a3366a2e396cfec1cd491bad39eb8ee11ba2b5672ee1f07c9d7b58469fd3f2aaa821a3a129a6f8f3d3f"}, {0x28, 0x109, 0xf25, "ec3372554a28c33a441779c14e3a2442be5cea"}, {0x58, 0x107, 0x200, "faa23db21575b122c8a5b08e8d3dba41b1bc0a24ae9cf3ab81a450d60b6ee55676485c937fe020a380a126da49c10c8349e47dcb5cb071ac369d3bde36814ee15b5a"}, {0x88, 0x1, 0x8, "b71cdd1358cd398ba4800e2e08bfdd8381c45fb8952043468965eb145813796d63abb61eaa7c5fd81ffc7254470d04ed5aefd3b73dff72ddaaac98bca7680a875d2231d7868ad2fc9f4941472f9375a058e5e19f73c8a7710c7f3ad3006b83d492ae0d83829d258760e8948a9cb14e342e"}], 0x3b0, 0x40000}}, {{&(0x7f00000009c0)=@rc={0x1f, {0x0, 0x5, 0x1edb, 0x3ff, 0xffff, 0x9}, 0x7ff}, 0x80, &(0x7f0000000b40)=[{&(0x7f0000000a40)="206ddfeacf3cb51ff5c0af9e0b7b74b0e4c9fa0d07fa0f77746e01e474041fd9096784131f2eac498d28d279b86276eef27b7c74307506ff9ff7b0926d77e022467224edd3d9717e2b6631c4c5e818d6b00491ca5c1f15b1c31a9d921aea248aed5b28a8c5789e17cb9ebe913697cfd2455eebb04225c60a9fb3ffc62fa8a1d03c5419fb1646870f9359d2af1c6e7b1a0c927f60d5b42ecd34c1bc2f7e8573b10958bd74f2b887b7f2fb182c4a26069441c90c68d7f3a204d992c4e387fe5dd6e8535c4e3ff34643", 0xc8}], 0x1, 0x0, 0x0, 0x5}, 0x5351}], 0x3, 0x800) [ 479.784271] binder: 32017:32019 unknown command -1454742779 [ 479.786533] binder: 32017:32024 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 479.786594] binder: 32017:32026 Release 1 refcount change on invalid ref 0 ret -22 [ 479.810464] binder: 32017:32019 ioctl c0306201 20012000 returned -22 18:20:11 executing program 0: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) dup3(r1, r0, 0x80000) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) 18:20:11 executing program 2: r0 = syz_open_dev$binder(&(0x7f00000002c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000300)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0xffffffffffffff7b, 0x0, &(0x7f0000000000)=[@acquire], 0x341, 0x0, &(0x7f0000012fc7)}) r2 = openat$full(0xffffffffffffff9c, &(0x7f0000000040)='/dev/full\x00', 0x80, 0x0) ioctl$SNDRV_TIMER_IOCTL_GINFO(r2, 0xc0f85403, &(0x7f0000000180)={{0x3, 0x2, 0x3a9, 0x0, 0xf08}, 0x13, 0x3, 'id1\x00', 'timer0\x00', 0x0, 0x40, 0xfffffffffffffc01, 0x40, 0x3ff}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, &(0x7f0000000f4d)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000000c0)={0x8, 0x0, &(0x7f0000000140)=[@release], 0x0, 0x0, &(0x7f0000000340)}) 18:20:11 executing program 3: add_key(&(0x7f0000000140)="58772290690bc1a3597be47573657200464731661c598b58a1acd62f9beb1cb25358641d0e92611e1c9ac640682cc8478aa1f5e72194e50d5949ed01ae0c030a4380d209d5aee0e8737bc06b03d6b4e8e9de8fe072084dfc1cee455a4f071704c10dba748949e79fa45d25d15d1cd460d07b2371fb8c2b346fb419253389e22dba97dc36378769231b09a0", &(0x7f00000000c0)={'syz'}, &(0x7f0000000200)="82", 0xfffffffffffffdca, 0xfffffffffffffffb) setxattr$trusted_overlay_upper(&(0x7f0000000000)='./file0\x00', &(0x7f0000000040)='trusted.overlay.upper\x00', &(0x7f0000000340)=ANY=[@ANYBLOB="00fb8105050b3b15d746e99cf6a36cf652fc8c0592946eba2763fa141e67306dc8381c2af53703f94d677e8150cee415283a1eeea522d8bcc0d3595806df64de3eb717d07b495eb41a130226e67b6da65e5385854b27f636c5a6fb8f00a84ce427bb075c59a01039e825ee0619c094cd36dbf5d39a87da985d75aa5ded21a6c2ec8c8495b62945816daab9f4f99ed7b08c7e6a70da9cba8889e13ab37f2150ec587519fe63bbdfbca5c7e2916f4563c72e0c5646d0ead62dda396f41f9a5cf49ec06e344868b3856a070205bd6ee38b676e28ace0c6462d9"], 0x81, 0x2) 18:20:12 executing program 3: prctl$getreaper(0xfffffffffffffffe, &(0x7f0000000040)) add_key(&(0x7f00000000c0)='user\x00', &(0x7f0000000100)={'syz'}, &(0x7f0000000200)="82", 0x1, 0xfffffffffffffffb) socket$nl_netfilter(0x10, 0x3, 0xc) 18:20:12 executing program 0: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) add_key$keyring(&(0x7f0000000200)='keyring\x00', &(0x7f0000000240)={'syz'}, 0x0, 0x0, 0xfffffffffffffffb) r1 = getuid() r2 = getuid() setreuid(r1, r2) socketpair$unix(0x1, 0x7, 0x0, &(0x7f0000000000)) 18:20:12 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000300)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000005fd4)=ANY=[@ANYBLOB="158a29b1c1575f0e"], 0x0, 0x0, &(0x7f0000012fc7)}) r1 = openat$full(0xffffffffffffff9c, &(0x7f0000000080)='/dev/full\x00', 0x20340, 0x0) ioctl$TUNSETQUEUE(r1, 0x400454d9, &(0x7f0000000100)={'syz_tun\x00', 0x600}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, &(0x7f0000000f4d)}) syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0x0, 0x2) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x8, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="886f279b6f3f99f33387b8b7b51d22fa601510d6e88698a3466df89749419e9c"], 0xfde4, 0x0, &(0x7f0000000340)}) setsockopt$SO_ATTACH_FILTER(r1, 0x1, 0x1a, &(0x7f0000000180)={0x8, &(0x7f0000000140)=[{0x9, 0x0, 0x2, 0x2}, {0x7, 0x4, 0x81, 0x5}, {0x7fff, 0x1f, 0x4, 0x7}, {0x5, 0x8, 0xfffffffffffffffe, 0x44a0}, {0x7, 0x9, 0x8, 0x81}, {0x0, 0x7f, 0xe0, 0x8}, {0x8, 0x10001, 0x9}, {0xac8, 0x34, 0x9, 0x8000}]}, 0x10) [ 479.924504] binder: BINDER_SET_CONTEXT_MGR already set 18:20:12 executing program 5: request_key(&(0x7f0000000000)='keyring\x00', &(0x7f0000000280)={'syz', 0x0}, &(0x7f00000002c0)='vboxnet1\x00', 0xfffffffffffffffe) 18:20:12 executing program 4: r0 = syz_open_dev$binder(&(0x7f00000002c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000300)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, &(0x7f0000012fc7)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0xfffffffffffffd97, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x3d4, 0x0, &(0x7f0000000f4d)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000000c0)={0x8, 0x0, &(0x7f0000000140)=[@release], 0x0, 0x0, &(0x7f0000000340)}) [ 479.946755] binder: BINDER_SET_CONTEXT_MGR already set [ 479.952396] binder: 32033:32053 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 479.961912] binder: 32033:32037 ioctl 40046207 0 returned -16 [ 479.977714] binder: 32052:32064 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 479.984267] binder: 32052:32055 ioctl 40046207 0 returned -16 18:20:12 executing program 3: r0 = dup3(0xffffffffffffff9c, 0xffffffffffffffff, 0x80000) getpeername$packet(0xffffffffffffff9c, &(0x7f0000000000)={0x11, 0x0, 0x0}, &(0x7f0000000040)=0x14) openat$selinux_relabel(0xffffffffffffff9c, &(0x7f0000000180)='/selinux/relabel\x00', 0x2, 0x0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000080)={0x0, 0x0}, &(0x7f0000000140)=0xc) setsockopt$inet_IP_IPSEC_POLICY(r0, 0x0, 0x10, &(0x7f0000000240)={{{@in=@broadcast, @in=@dev={0xac, 0x14, 0x14, 0xe}, 0x4e24, 0x9, 0x4e23, 0x7fffffff, 0xa, 0xa0, 0x20, 0x0, r1, r2}, {0x4, 0xb03, 0x0, 0x5, 0x1d12, 0x1, 0x7, 0x4}, {0x33, 0xca, 0x7, 0x3}, 0x81, 0x6e6bb2, 0x2, 0x1, 0x2, 0x1}, {{@in=@broadcast, 0x4d2, 0xff}, 0xa, @in6=@loopback, 0x0, 0x7, 0x0, 0x5fb, 0x6, 0x80000000, 0xff}}, 0xe8) add_key(&(0x7f00000000c0)='user\x00', &(0x7f0000000100)={'syz'}, &(0x7f0000000200)="82", 0x1, 0xfffffffffffffffb) [ 479.984372] binder: 32033:32063 Release 1 refcount change on invalid ref 0 ret -22 [ 480.024619] binder: 32052:32055 Release 1 refcount change on invalid ref 0 ret -22 [ 480.024815] binder: 32062:32068 unknown command -1322677739 [ 480.024824] binder: 32062:32068 ioctl c0306201 20012000 returned -22 [ 480.025200] binder: 32062:32068 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 480.025475] binder: 32062:32068 unknown command -1691914360 [ 480.025483] binder: 32062:32068 ioctl c0306201 200000c0 returned -22 [ 480.025993] binder: 32062:32068 unknown command -1322677739 18:20:12 executing program 0: pipe(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f00000002c0)=@file={0x1, './file0\x00'}, 0x6e) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = request_key(&(0x7f0000000100)='trusted\x00', &(0x7f0000000140)={'syz', 0x3}, &(0x7f00000001c0)='%".\x00', 0xfffffffffffffffe) add_key$keyring(&(0x7f00000000c0)='keyring\x00', &(0x7f0000000280)={'syz'}, 0x0, 0x0, r2) 18:20:12 executing program 0: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) add_key$keyring(&(0x7f0000000200)='keyring\x00', &(0x7f0000000240)={'syz'}, 0x0, 0x0, 0xfffffffffffffffb) lsetxattr$trusted_overlay_upper(&(0x7f0000000000)='./file0\x00', &(0x7f0000000040)='trusted.overlay.upper\x00', &(0x7f0000000080)={0x0, 0xfb, 0x2e, 0x5, 0xd147, "31b00d4eeb4ec8a62c18028040dc32c1", "9dac8b7020f9a800ac2da8302973740fd7307c700284ddd09c"}, 0x2e, 0x3) 18:20:12 executing program 5: request_key(&(0x7f0000000240)='keyring\x00', &(0x7f0000000280)={'syz', 0x0}, &(0x7f00000002c0)='vboxnet1\x00', 0xfffffffffffffffe) r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000180)='/dev/uinput\x00', 0x802, 0x0) fgetxattr(r0, &(0x7f00000001c0)=@known='trusted.overlay.metacopy\x00', &(0x7f0000000300)=""/110, 0x6e) r1 = syz_open_dev$mice(&(0x7f0000000000)='/dev/input/mice\x00', 0x0, 0x40000) fchdir(r1) ioctl$sock_inet_SIOCRTMSG(r1, 0x890d, &(0x7f0000000100)={0x5, {0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0xb}}, {0x2, 0x4e23, @broadcast}, {0x2, 0x4e22, @multicast2}, 0x104, 0x4, 0x2, 0x7fff, 0x7, &(0x7f00000000c0)='bond0\x00', 0x9, 0xb3df, 0x3}) getsockopt$inet_pktinfo(r1, 0x0, 0x8, &(0x7f0000000040)={0x0, @remote, @multicast2}, &(0x7f0000000080)=0xc) [ 480.026001] binder: 32062:32068 ioctl c0306201 20012000 returned -22 [ 480.080835] binder: 32062:32079 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 480.108800] binder: 32062:32074 unknown command -1691914360 18:20:12 executing program 3: add_key(&(0x7f00000000c0)='user\x00', &(0x7f0000000100)={'syz'}, &(0x7f0000000200)="82", 0x1, 0xfffffffffffffffb) r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = fcntl$dupfd(0xffffffffffffff9c, 0x0, r0) fcntl$addseals(r1, 0x409, 0x1) 18:20:12 executing program 2: request_key(&(0x7f0000000000)='keyring\x00', &(0x7f0000000280)={'syz', 0x0}, &(0x7f00000002c0)='vboxnet1\x00', 0xfffffffffffffffe) [ 480.124090] binder: 32062:32074 ioctl c0306201 200000c0 returned -22 18:20:12 executing program 0: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180)) openat$null(0xffffffffffffff9c, &(0x7f0000000000)='/dev/null\x00', 0x0, 0x0) r0 = perf_event_open$cgroup(&(0x7f0000000040)={0x0, 0x70, 0x5076, 0x5, 0x1, 0x9, 0x0, 0xfffffffffffffff9, 0x8002, 0x4, 0x7fff, 0x8000, 0x9, 0x0, 0x14, 0x493a, 0x401, 0x7, 0xfc9f, 0xbd, 0x5, 0x0, 0x1, 0xffffffff, 0x9, 0x7, 0x7, 0x3, 0x7, 0x81, 0x3ff, 0x7fff, 0x0, 0x4, 0xffffffffffffff62, 0x3f, 0x10001, 0x7, 0x0, 0x80000000, 0x2, @perf_config_ext={0xb4e2, 0x7}, 0x1010, 0x0, 0x3, 0x7, 0x1000, 0xff, 0x2}, 0xffffffffffffff9c, 0x3, 0xffffffffffffffff, 0x1) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) add_key$keyring(&(0x7f0000000200)='keyring\x00', &(0x7f0000000240)={'syz'}, 0x0, 0x0, 0xfffffffffffffffb) 18:20:12 executing program 3: r0 = socket$inet6(0x10, 0x6, 0x0) unshare(0x600) unshare(0x40400) sendmsg(r0, &(0x7f000000bfc8)={&(0x7f0000000000)=@nl=@proc, 0x80, &(0x7f0000002000)=[{&(0x7f0000000100)="5500000018007fafb72d1cb2a4a280930206000000a843096c26234d2500080008000c00080000000000a3c728f1c46b7b31afdc1338d54400009b84136ef75afb83de448daa7227c43ab8220000bf0cec6bab91d4", 0x55}], 0x1, &(0x7f00000007c0)}, 0x0) add_key(&(0x7f00000000c0)='user\x00', &(0x7f0000000100)={'syz'}, &(0x7f0000000200)="82", 0x1, 0xfffffffffffffffb) openat$selinux_checkreqprot(0xffffffffffffff9c, &(0x7f0000000080)='/selinux/checkreqprot\x00', 0x400400, 0x0) stat(&(0x7f00000001c0)='./file0\x00', &(0x7f0000000240)={0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$FS_IOC_RESVSP(r0, 0x40305828, &(0x7f0000000300)={0x0, 0x6, 0x7, 0x9}) getgroups(0x1, &(0x7f00000002c0)=[0xee01]) chown(&(0x7f0000000180)='./file0\x00', r1, r2) 18:20:12 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000300)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$sock_FIOGETOWN(r0, 0x8903, &(0x7f0000000000)=0x0) fcntl$setown(r0, 0x8, r1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, &(0x7f0000012fc7)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, &(0x7f0000000f4d)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x8, 0x0, &(0x7f0000000140)=[@release], 0x0, 0x0, &(0x7f0000000340)}) 18:20:12 executing program 2: request_key(&(0x7f0000000000)='keyring\x00', &(0x7f0000000280)={'syz', 0x0}, &(0x7f00000002c0)='vboxnet1\x00', 0xfffffffffffffffe) 18:20:12 executing program 5: request_key(&(0x7f0000000300)='logon\x00', &(0x7f0000000280)={'syz', 0x3}, &(0x7f0000000200)="00000000e8ff000000", 0xfffffffffffffffe) setxattr$security_smack_transmute(&(0x7f00000000c0)='./file0\x00', &(0x7f0000000100)='security.SMACK64TRANSMUTE\x00', &(0x7f0000000140)='TRUE', 0x4, 0x3) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000000)={0x0}, &(0x7f0000000040)=0xc) ptrace$poke(0x5, r0, &(0x7f00000002c0), 0x9) socketpair$inet6_tcp(0xa, 0x1, 0x0, &(0x7f0000000180)) [ 480.256015] binder: 32104:32107 ioctl 8903 20000000 returned -22 [ 480.308036] binder: 32104:32107 ioctl 8903 20000000 returned -22 18:20:13 executing program 4: r0 = syz_open_dev$binder(&(0x7f00000002c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000300)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, &(0x7f0000012fc7)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, &(0x7f0000000f4d)}) r2 = openat$full(0xffffffffffffff9c, &(0x7f0000000000)='/dev/full\x00', 0x80, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000180)={'yam0\x00', 0x0}) setsockopt$inet6_IPV6_PKTINFO(r2, 0x29, 0x32, &(0x7f00000001c0)={@dev={0xfe, 0x80, [], 0x17}, r3}, 0x14) getsockopt$inet_mtu(r2, 0x0, 0xa, &(0x7f0000000040), &(0x7f0000000080)=0x4) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000000c0)={0x8, 0x0, &(0x7f0000000140)=[@release], 0x0, 0x0, &(0x7f0000000340)}) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000100)={'ip6gretap0\x00', 0x4400}) 18:20:13 executing program 3: add_key(&(0x7f00000000c0)='user\x00', &(0x7f0000000100)={'syz', 0x3}, &(0x7f0000000000), 0x0, 0xfffffffffffffffb) 18:20:13 executing program 2: request_key(&(0x7f0000000000)='keyring\x00', &(0x7f0000000280)={'syz', 0x0}, &(0x7f00000002c0)='vboxnet1\x00', 0xfffffffffffffffe) 18:20:13 executing program 0: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180)={0xffffffffffffffff}) mprotect(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x9) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000000)='rdma.current\x00', 0x0, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x80000000) add_key$keyring(&(0x7f0000000200)='keyring\x00', &(0x7f0000000240)={'syz'}, 0x0, 0x0, 0xfffffffffffffffb) 18:20:13 executing program 5: r0 = request_key(&(0x7f0000000000)='id_legacy\x00', &(0x7f0000000040)={'syz', 0x3}, &(0x7f0000000080)='syz', 0xfffffffffffffffa) request_key(&(0x7f0000000240)='keyring\x00', &(0x7f0000000280)={'syz', 0x0}, &(0x7f00000002c0)='vboxnet1\x00', 0xfffffffffffffffe) keyctl$negate(0xd, r0, 0x3ff, r0) r1 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000100)='/dev/fuse\x00', 0x2, 0x0) r2 = fcntl$dupfd(0xffffffffffffffff, 0x406, r1) r3 = openat$full(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/full\x00', 0x40, 0x0) ioctl$RTC_PLL_GET(r2, 0x80207011, &(0x7f0000000140)) ioctl$RTC_EPOCH_SET(r3, 0x4008700e, 0x66) 18:20:13 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000300)='/dev/binder#\x00', 0x0, 0x10000000003) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, &(0x7f0000012fc7)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, &(0x7f0000000f4d)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x8, 0x0, &(0x7f0000000140)=[@release], 0x0, 0x0, &(0x7f0000000340)}) 18:20:13 executing program 3: add_key(&(0x7f00000000c0)='user\x00', &(0x7f0000000100)={'syz'}, &(0x7f0000000200)="82", 0x1, 0xfffffffffffffffb) request_key(&(0x7f0000000000)='rxrpc\x00', &(0x7f0000000040)={'syz', 0x0}, &(0x7f0000000080)='syz', 0xfffffffffffffffe) 18:20:13 executing program 2: add_key(&(0x7f00000000c0)='user\x00', &(0x7f0000000100)={'syz'}, &(0x7f0000000200)="82", 0x1, 0xfffffffffffffffb) r0 = dup3(0xffffffffffffff9c, 0xffffffffffffffff, 0x80000) ioctl$BLKSECDISCARD(r0, 0x127d, &(0x7f0000000000)=0x5) 18:20:13 executing program 5: request_key(&(0x7f0000000240)='keyring\x00', &(0x7f0000000280)={'syz', 0x0}, &(0x7f00000002c0)='vboxnet1\x00', 0xfffffffffffffffe) prctl$intptr(0x3d, 0x1000) r0 = openat(0xffffffffffffffff, &(0x7f0000000000)='./file0\x00', 0x8000, 0x90) ioctl$TIOCCBRK(r0, 0x5428) r1 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ppp\x00', 0x0, 0x0) renameat2(r0, &(0x7f0000000040)='\x00', r1, &(0x7f00000000c0)='./file0\x00', 0x4) 18:20:13 executing program 3: r0 = openat$selinux_avc_cache_threshold(0xffffffffffffff9c, &(0x7f0000000140)='/selinux/avc/cache_threshold\x00', 0x2, 0x0) ioctl$EVIOCREVOKE(r0, 0x40044591, &(0x7f0000000180)=0x6d) r1 = dup3(0xffffffffffffff9c, 0xffffffffffffffff, 0x80000) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000000)={'team_slave_1\x00', 0x0}) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000040)={'sit0\x00', r2}) memfd_create(&(0x7f0000000080)='/)-^//&lo\x00', 0x4) add_key(&(0x7f00000000c0)='user\x00', &(0x7f0000000100)={'syz'}, &(0x7f0000000200)="82", 0x1, 0xfffffffffffffffb) [ 480.885688] binder: BINDER_SET_CONTEXT_MGR already set [ 480.891058] binder: 32072:32089 ioctl 40046207 0 returned -16 [ 480.920112] binder: 32128:32133 Acquire 1 refcount change on invalid ref 0 ret -22 18:20:13 executing program 2: add_key(&(0x7f00000001c0)="6b65797201000000", &(0x7f0000000100)={'syz', 0x0}, &(0x7f0000000140)="6567e14839ec6a28a27085304b58a14a8ddd8e1bf71f7342a29bb15dbf95e60100ce8468d8ff99fb76bc2d2ab1b08b8d99a6d269f591c5f6d69bd8866f5a0dd609bbeeea3b90859e50e4c5243e5ddb03e6f88b985ac0f77b89341e7da2", 0xfcbb, 0xfffffffffffffffb) r0 = syz_open_dev$mice(&(0x7f0000000000)='/dev/input/mice\x00', 0x0, 0x40) ioctl$PIO_FONTX(r0, 0x4b6c, &(0x7f0000000340)="b95e0e0d242397fa4e5821f3163fe6b3f25ded0d4fbfda2765ea13bd9ce93f45cd00d9a033c6cc21395816eb1d08296af43084593f776ac69021c318c280bad8f24d8890c12227d7039d99053301ee9db51bebfbd956ab99cefbdefe4932e94a01e8ea0d863a179e4d3c5527b4e89bda943a6abbf0c6411e243608183aded5ed4fb191660159ed8e18bfacf14274d6ecda01d94975586627c16de5a5c0f7b28b705b") write$P9_RWRITE(r0, &(0x7f0000000040)={0xb, 0x77, 0x2, 0x3}, 0xb) lsetxattr$security_smack_transmute(&(0x7f0000000240)='./file0\x00', &(0x7f0000000280)='security.SMACK64TRANSMUTE\x00', &(0x7f00000002c0)='TRUE', 0x4, 0x2) ioctl$BLKRESETZONE(r0, 0x40101283, &(0x7f0000000300)={0x4, 0x52d7}) lgetxattr(&(0x7f0000000080)='./file0\x00', &(0x7f00000000c0)=@known='trusted.overlay.nlink\x00', &(0x7f0000000200)=""/36, 0x24) [ 480.968101] binder: BINDER_SET_CONTEXT_MGR already set [ 480.974848] binder: 32128:32145 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 480.983281] binder: 32131:32150 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 481.000408] binder: 32131:32135 ioctl 40046207 0 returned -16 18:20:13 executing program 5: r0 = openat$selinux_status(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/status\x00', 0x0, 0x0) ioctl$TUNSETSNDBUF(r0, 0x400454d4, &(0x7f0000000040)=0x80000001) request_key(&(0x7f0000000240)='keyring\x00', &(0x7f0000000280)={'syz', 0x0}, &(0x7f00000002c0)='vboxnet1\x00', 0xfffffffffffffffe) [ 481.012978] binder: 32128:32133 Release 1 refcount change on invalid ref 0 ret -22 18:20:13 executing program 4: r0 = syz_open_dev$binder(&(0x7f00000002c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000300)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, &(0x7f0000012fc7)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, &(0x7f0000000f4d)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000000c0)={0x8, 0x0, &(0x7f0000000140)=[@release], 0x0, 0x0, &(0x7f0000000340)}) syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x802) 18:20:13 executing program 0: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) add_key$keyring(&(0x7f0000000200)='keyring\x00', &(0x7f0000000240)={'syz'}, 0x0, 0x0, 0xfffffffffffffffb) r1 = openat$selinux_avc_cache_stats(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/avc/cache_stats\x00', 0x0, 0x0) getsockopt$inet_buf(r1, 0x0, 0x2a, &(0x7f0000000100)=""/27, &(0x7f0000000140)=0x1b) write$P9_RUNLINKAT(r0, &(0x7f00000001c0)={0x7, 0x4d, 0x2}, 0x7) r2 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/enforce\x00', 0x0, 0x0) r3 = gettid() sched_setparam(r3, &(0x7f0000000600)=0xeb3) ioctl$FS_IOC_GETFSMAP(r0, 0xc0c0583b, &(0x7f0000000280)={0x0, 0x0, 0x6, 0x0, [], [{0x7, 0xbc, 0xc16, 0x7ff, 0x7ff, 0x5}, {0x6, 0x0, 0xffffffffffff8000, 0x2, 0x332e, 0x1}], [[], [], [], [], [], []]}) ioctl$RTC_WKALM_SET(r2, 0x4028700f, &(0x7f0000000640)={0x1, 0x0, {0x19, 0x1e, 0x8, 0xa, 0x0, 0xfffffffffffffffc, 0x4, 0x103, 0x1}}) write$binfmt_misc(r0, &(0x7f0000000080)={'syz0', "02292506f64ce93f9cdfe047a0a8416a35342dc302b01bd73544ab"}, 0x1f) ioctl$FS_IOC_GETFSMAP(r2, 0xc0c0583b, &(0x7f00000004c0)={0x0, 0x0, 0x2, 0x0, [], [{0xeb55, 0x2, 0x4, 0x3, 0x9, 0x5}, {0x7ff, 0x57c0, 0x20, 0x1000000005a58, 0x80000000, 0xffffffffffffff7f}], [[], []]}) ioctl$TUNGETIFF(r2, 0x800454d2, &(0x7f0000000040)) 18:20:13 executing program 3: add_key(&(0x7f0000000140)="f41a7968ce4c7a7afe4a04c47c1c2de97ef4650c47af25a1fab8835268ca5f090d39f110f3ceb01549d09b2137709526f5e9c2b2f4861e234a8d4680182e1e3ccbe2baf9b8cdd17dbff96d15b715098421936ce5b66e5981153c28addac9b0913c", &(0x7f0000000100)={'syz'}, &(0x7f0000000200)="82", 0x1, 0xfffffffffffffffb) 18:20:13 executing program 5: r0 = request_key(&(0x7f0000000240)='keyring\x00', &(0x7f0000000280)={'syz', 0x0}, &(0x7f00000002c0)='vboxnet1\x00', 0xfffffffffffffffe) r1 = openat$pfkey(0xffffffffffffff9c, &(0x7f00000001c0)='/proc/self/net/pfkey\x00', 0x0, 0x0) ioctl$SNDRV_TIMER_IOCTL_STOP(r1, 0x54a1) r2 = add_key$user(&(0x7f0000000000)='user\x00', &(0x7f0000000040)={'syz', 0x2}, &(0x7f0000000080)="7e764a8bc6bb98adcb01596ef3514a308109db6858768068e8aa6f1cfcc1c48c7d01d3297ce9407a6d1828bb5fd23d177d1710a55713", 0x36, r0) keyctl$dh_compute(0x17, &(0x7f00000000c0)={r2, r2, r0}, &(0x7f0000000300)=""/4096, 0x1000, &(0x7f0000000180)={&(0x7f0000000100)={'wp384-generic\x00'}, &(0x7f0000000140)="7cbfb07477ab0b4eded8dcfab6076aa2a0cc9f0ab5ba0f68669b11f40328", 0x1e}) 18:20:13 executing program 0: socketpair$unix(0x1, 0x40002, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) add_key$keyring(&(0x7f0000000200)='keyring\x00', &(0x7f0000000240)={'syz'}, 0x0, 0x0, 0xfffffffffffffffb) sendmsg$unix(r0, &(0x7f00000001c0)={&(0x7f0000000000)=@file={0x1, './file0\x00'}, 0x6e, &(0x7f0000000780)=[{&(0x7f0000000080)="8d28f65c6e390426e050a9dd1f621147a569d339a2915caf3ca712165417f796f98aef2a830dfde1aa9c3997329e137b8e7d96b9eaf189695329610161ad10ad0a3b42b5cf2075f39390fcb2ae21877e9c4d22381635be2ed75db78c9aa3d05bbb0b6d0cbd67e56aa4c42c99cec892d03be7a696b64c4504368d4b0024e513e233816d3416db7c140d031481a9adf3f2e890f7304d9566be6bd021a600", 0x9d}, {&(0x7f0000000280)="3b91a502a958220e72c609e59a0c356a7dc2afaf8d845475cf4882b20f327c758af3b178fe1cbe042bae099816996f68141f2333af48d415d350349b68e92fbadbf55263386f0048a5ce3047b5f0242c1c84287f8554ea7d00b6de79ac0958673615c72b3b7fbde4a4e858a608806ff39821bee4eefdf47d9ab4985fa568e6be5d9dc012cd44bf7b", 0x88}, {&(0x7f0000000340)="07cb312ccbca4c94b8f9ca69c131ab02c4c2cf48113a6583dfc35bb1c1fe7a7eaccee0f08f5cdd3c707dea229e189a86499ceebe675ee4eecb79816bf35c9b6068a772d91506bceeb5d22cb7d6389d424e858d4c16743bd0c0c1d2f98e8e4a77d6a193dca827d042da6c3231bcf0ee751a6a233562c3f8d9a445bec9bb6edc3fbddae1186d2290b7ee73b606ecf6f071affc271a017bb29f1f3aec1dbc5881f6d1c8718802de8893a42e721874ffe533e7d77dd77d11912e64ce1a852d1bdb26a9e5de49aaee89c53a8a3f87094dc226dc52b67b8d", 0xd5}, {&(0x7f0000000440)="7f2b38dd5b3227d74c97363ce02086dc7040d1b9170199749aeabaa5ff011ca82c27e5a350dd2f105e1e820adfb1dc59cadfae162c0c2eeeb8ae353dc4dd27f61c8bc2cf0710f4941a2727cc1ed578a4ff81a9f36027e334b7a1d17d7eb75239aaaa811103efc278a6abad3564d1321d915cd630a79a6eb2b47f9f08d2a0f6e772c3d00d6172713475ec9908da930bf5bbb14b3b4cb7f04cd984b141e6e4698611fa", 0xa2}, {&(0x7f0000000500)="4ceca0243cf1a2d2b0e630efd903eda1182669da61ab3cd378909d74555921abb0238a3f778ff755e92148566c80f1534aa3811ab7db53bc834bbda980aa8726771466dc94cb6fbf0e08c27cf934d8f0fd3c8127deb766853c938c6e92ac4df9cf57a8c1e98820f84fdffb30047fadada4b5dae67e13abc7d4d2feda8cffd5e5c60a328a345923b91f244f5874fcfa77a012cb79484e3de5d4043f9139dff7bcfa3d75a3a8d361594906a77b70753fd0beee6e4123808f03349ca4df7f3f8d97487f8a3d", 0xc4}, {&(0x7f0000000600)="16a0753728a79efeacb887221d0f926b92019145ebd51c51a39170767de5ab6ad31f34afe03c2c923e0c7536f74534aa434017eab816630c39c7359d1ab975409ec420d903fc1d803f5fd3363d12fb5901b69fb1aa7044f6493d788e114c3ac0438f674570a10d2f5948f37110ccc4a56c91b9e10a29650e7f9ec17922ae94847b8cc62629dcb1677714ec2ed000c92d33b8e7ac083ac3ef47cd3dfa5c08f7248915f4820025999944ea4107a5e8038a9babefff351c213c052e9a86a2580716895067772d", 0xc5}, {&(0x7f0000000700)="d5caf9f109080bd6344b4e881e72f92a1553c6bcb05792f82c6f9a3ecad0c1e9457f2119c859246092a5ec86d3b34dd171f7953b05776060af89100de5b138568e31bd1a74f7dd10c63249a15f0d4beedcdbc8e641a019721d6f5b5c2499ec485ed1802825b2227048fa15503aa30c34a233a1", 0x73}], 0x7, &(0x7f0000000140)}, 0x80) [ 481.076536] binder: 32128:32145 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 481.084117] binder: 32128:32133 Acquire 1 refcount change on invalid ref 0 ret -22 18:20:13 executing program 1: openat$ppp(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ppp\x00', 0x8c41, 0x0) r0 = syz_open_dev$binder(&(0x7f0000000300)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, &(0x7f0000012fc7)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, &(0x7f0000000f4d)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x8, 0x0, &(0x7f0000000140)=[@release], 0x0, 0x0, &(0x7f0000000340)}) 18:20:13 executing program 5: request_key(&(0x7f0000000240)='keyring\x00', &(0x7f0000000280)={'syz', 0x0}, &(0x7f00000002c0)='vboxnet1\x00', 0xfffffffffffffffe) socketpair(0x11, 0x80800, 0x1f, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) sendto(r0, &(0x7f0000000040), 0x0, 0x1, &(0x7f0000000080)=@un=@file={0x1, './file0\x00'}, 0x80) 18:20:13 executing program 2: request_key(&(0x7f0000000240)='keyring\x00', &(0x7f0000000280)={'syz', 0x0}, &(0x7f00000002c0)='vboxnet1\x00', 0xfffffffffffffffe) r0 = openat$null(0xffffffffffffff9c, &(0x7f0000000000)='/dev/null\x00', 0x0, 0x0) clock_gettime(0x0, &(0x7f0000001c80)={0x0, 0x0}) recvmmsg(0xffffffffffffff9c, &(0x7f0000001b40)=[{{&(0x7f0000000040)=@hci={0x1f, 0x0}, 0x80, &(0x7f0000000300)=[{&(0x7f00000000c0)=""/29, 0x1d}, {&(0x7f0000000100)=""/198, 0xc6}, {&(0x7f0000000200)}], 0x3, &(0x7f0000000340)=""/164, 0xa4, 0x1}, 0x2}, {{0x0, 0x0, &(0x7f0000000480)=[{&(0x7f0000000400)=""/81, 0x51}], 0x1, 0x0, 0x0, 0x3}, 0x5f}, {{&(0x7f00000004c0)=@alg, 0x80, &(0x7f0000000600)=[{&(0x7f0000000540)=""/190, 0xbe}], 0x1, &(0x7f0000000640)=""/180, 0xb4, 0x181a}, 0x5c}, {{0x0, 0x0, &(0x7f0000001800)=[{&(0x7f0000000700)=""/58, 0x3a}, {&(0x7f0000000740)=""/165, 0xa5}, {&(0x7f0000000800)=""/4096, 0x1000}], 0x3, &(0x7f0000001840)=""/140, 0x8c, 0x2}, 0x77b}, {{&(0x7f0000001900)=@in6={0xa, 0x0, 0x0, @loopback}, 0x80, &(0x7f0000001b00)=[{&(0x7f0000001980)=""/85, 0x55}, {&(0x7f0000001a00)=""/206, 0xce}], 0x2, 0x0, 0x0, 0x1f}, 0xcb}], 0x5, 0x40010021, &(0x7f0000001cc0)={r1, r2+30000000}) setsockopt$inet_mreqn(r0, 0x0, 0x20, &(0x7f0000001d00)={@multicast2, @loopback, r3}, 0xc) setsockopt$inet_mreqn(r0, 0x0, 0x24, &(0x7f0000000200)={@local, @multicast1, r3}, 0xc) 18:20:13 executing program 3: r0 = add_key(&(0x7f0000000040)='rxrpc_s\x00', &(0x7f0000000080)={'syz', 0x1}, &(0x7f0000000140)="28af4a65dba0f021091a8af154034fdb53802f0dc772f89b218c6e8107f5cef529fdd59cb1821b791527d195d644b21bae0838a00115b22b4c2cfb1a95ee9e477bbafb963679464feed86a3e53cf5b928746af2d80a9eeeb070754cb5f7f1fad98772e35726bc7cb3fd07ef5dca72e016af662cdc41977b1342ab1eb609bf369495c6cc9422c8d5c3764ce6737235e50977a8960210366cec3e64260dab9d4aae64dea2435b6689d74c7b1af818590928f9671399eca0de3b4", 0xb9, 0xfffffffffffffffc) keyctl$read(0xb, r0, &(0x7f0000000200)=""/222, 0xde) add_key(&(0x7f00000000c0)='user\x00', &(0x7f0000000100)={'syz'}, &(0x7f0000000000)="82", 0x1, 0xfffffffffffffffb) [ 481.131855] binder: BINDER_SET_CONTEXT_MGR already set 18:20:13 executing program 0: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180)) add_key$keyring(&(0x7f0000000200)='keyring\x00', &(0x7f0000000240)={'syz'}, 0x0, 0x0, 0xfffffffffffffffb) 18:20:13 executing program 5: request_key(&(0x7f0000000240)='keyring\x00', &(0x7f0000000280)={'syz', 0x0}, &(0x7f00000002c0)='vboxnet1\x00', 0xfffffffffffffffe) r0 = openat$selinux_avc_hash_stats(0xffffffffffffff9c, &(0x7f0000000100)='/selinux/avc/hash_stats\x00', 0x0, 0x0) sendto$inet(r0, &(0x7f0000000140)="06b97aedf9f1b0ec537b4e32400e14189f21c37bd5db2cdc8be3f3ca7a053154a34ccb17d14b35c100d57a09353477084686e772373855daff9f3293a9d0b3", 0x3f, 0x4000000, 0x0, 0x0) fchmodat(r0, &(0x7f00000001c0)='./file0\x00', 0x101) r1 = openat$selinux_avc_cache_stats(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/avc/cache_stats\x00', 0x0, 0x0) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000300)='veth1_to_bond\x00', 0x10) r2 = fcntl$getown(r1, 0x9) ioctl$sock_FIOSETOWN(r0, 0x8901, &(0x7f0000000200)=r2) setsockopt$IP_VS_SO_SET_ADD(r1, 0x0, 0x482, &(0x7f00000000c0)={0x0, @broadcast, 0x4e23, 0x2, 'dh\x00', 0xc14cd22ba6b747d1, 0xfffffffffffffffb, 0x31}, 0x2c) keyctl$set_reqkey_keyring(0xe, 0x1) ioctl$BLKGETSIZE64(r1, 0x80081272, &(0x7f0000000180)) ioctl$sock_netdev_private(r1, 0x89f6, &(0x7f0000000040)="a38406ee10b3e9ed925ab1387cbb3e6ab55640b0c57b885a52832daf5c6248a1d54122b49a59e87b3cd5d5fe69927e550f0bb4fc61920b8cd82a7478de6e6c3b1459a98b126af68958c8c20e5b6507eebdaf552a0fef8cc38c9f7b0d537e10ab9c8aee6ff75227748c664957f80ca0eaad08c645a6fdfa454cdc22b58c49") [ 481.165860] binder: 32173:32182 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 481.179784] binder: 32173:32174 ioctl 40046207 0 returned -16 18:20:13 executing program 0: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) symlink(&(0x7f0000000000)='./file0\x00', &(0x7f0000000040)='./file0\x00') ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x10000400203) r2 = openat$selinux_status(0xffffffffffffff9c, &(0x7f00000001c0)='/selinux/status\x00', 0x0, 0x0) epoll_ctl$EPOLL_CTL_DEL(r2, 0x2, r0) add_key$keyring(&(0x7f0000000200)='keyring\x00', &(0x7f0000000240)={'syz'}, 0x0, 0x0, 0xfffffffffffffffb) fsetxattr$security_smack_entry(r0, &(0x7f0000000100)='security.SMACK64IPOUT\x00', &(0x7f0000000140)='keyring\x00', 0x8, 0x3) symlink(&(0x7f0000000080)='./file0/file0\x00', &(0x7f00000000c0)='./file0\x00') ioctl$FS_IOC_SETFSLABEL(r2, 0x41009432, &(0x7f0000000280)="b368d85946454a6775817f34e05973bdf4466bb50d7486a8afb53e7eabc399d50d10f7d8d4ccebe931d685d477cbe43d0eca82524bea2752d4ee9a68be1734c0fc09d1771ebab99c27e202507a1caf71a01c8a5361fb7527d27cb9182228358288ea9ae4871d1d9963484fcd1b972fea82a1155c07c38feea7412e8fdeff4721afec960491a8439b4623d1f8147cba4fa291c1b0e2dcf291a1e2b3ddae15871c60c496acefa20bb4a839244fb24d936d2825732283bad9f824f5887456db61bb79be062ad2437e022e6d12ba1b282d95e9571535d2ec7b170175ae925419df51623f8bf6619e7afb0d065573148d3e89be16d33e8d41d5879af223661ba4517d") 18:20:13 executing program 4: r0 = syz_open_dev$binder(&(0x7f00000002c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000300)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, &(0x7f0000012fc7)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, &(0x7f0000000f4d)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000000c0)={0x8, 0x0, &(0x7f0000000140)=[@release], 0x0, 0x0, &(0x7f0000000340)}) 18:20:13 executing program 3: add_key(&(0x7f0000000000)='encrypted\x00', &(0x7f0000000100)={'syz'}, &(0x7f0000000040)="82", 0xfffffffffffffec1, 0xfffffffffffffffb) 18:20:13 executing program 2: request_key(&(0x7f0000000240)='keyring\x00', &(0x7f0000000280)={'syz', 0x0}, &(0x7f00000002c0)='vboxnet1\x00', 0xfffffffffffffffe) r0 = openat$null(0xffffffffffffff9c, &(0x7f0000000000)='/dev/null\x00', 0x0, 0x0) clock_gettime(0x0, &(0x7f0000001c80)={0x0, 0x0}) recvmmsg(0xffffffffffffff9c, &(0x7f0000001b40)=[{{&(0x7f0000000040)=@hci={0x1f, 0x0}, 0x80, &(0x7f0000000300)=[{&(0x7f00000000c0)=""/29, 0x1d}, {&(0x7f0000000100)=""/198, 0xc6}, {&(0x7f0000000200)}], 0x3, &(0x7f0000000340)=""/164, 0xa4, 0x1}, 0x2}, {{0x0, 0x0, &(0x7f0000000480)=[{&(0x7f0000000400)=""/81, 0x51}], 0x1, 0x0, 0x0, 0x3}, 0x5f}, {{&(0x7f00000004c0)=@alg, 0x80, &(0x7f0000000600)=[{&(0x7f0000000540)=""/190, 0xbe}], 0x1, &(0x7f0000000640)=""/180, 0xb4, 0x181a}, 0x5c}, {{0x0, 0x0, &(0x7f0000001800)=[{&(0x7f0000000700)=""/58, 0x3a}, {&(0x7f0000000740)=""/165, 0xa5}, {&(0x7f0000000800)=""/4096, 0x1000}], 0x3, &(0x7f0000001840)=""/140, 0x8c, 0x2}, 0x77b}, {{&(0x7f0000001900)=@in6={0xa, 0x0, 0x0, @loopback}, 0x80, &(0x7f0000001b00)=[{&(0x7f0000001980)=""/85, 0x55}, {&(0x7f0000001a00)=""/206, 0xce}], 0x2, 0x0, 0x0, 0x1f}, 0xcb}], 0x5, 0x40010021, &(0x7f0000001cc0)={r1, r2+30000000}) setsockopt$inet_mreqn(r0, 0x0, 0x20, &(0x7f0000001d00)={@multicast2, @loopback, r3}, 0xc) setsockopt$inet_mreqn(r0, 0x0, 0x24, &(0x7f0000000200)={@local, @multicast1, r3}, 0xc) [ 481.213082] binder: 32181:32190 Acquire 1 refcount change on invalid ref 0 ret -22 18:20:13 executing program 5: r0 = accept(0xffffffffffffff9c, 0x0, &(0x7f0000000000)) setsockopt$IP_VS_SO_SET_STOPDAEMON(r0, 0x0, 0x48c, &(0x7f0000000040)={0x1, 'veth1\x00', 0x4}, 0x18) request_key(&(0x7f0000000240)='keyring\x00', &(0x7f0000000280)={'syz', 0x2}, &(0x7f0000000080)='vboxnet1\x00', 0xfffffffffffffffe) getsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f00000000c0), 0x10) 18:20:13 executing program 2: request_key(&(0x7f0000000240)='keyring\x00', &(0x7f0000000280)={'syz', 0x0}, &(0x7f00000002c0)='vboxnet1\x00', 0xfffffffffffffffe) r0 = openat$null(0xffffffffffffff9c, &(0x7f0000000000)='/dev/null\x00', 0x0, 0x0) clock_gettime(0x0, &(0x7f0000001c80)={0x0, 0x0}) recvmmsg(0xffffffffffffff9c, &(0x7f0000001b40)=[{{&(0x7f0000000040)=@hci={0x1f, 0x0}, 0x80, &(0x7f0000000300)=[{&(0x7f00000000c0)=""/29, 0x1d}, {&(0x7f0000000100)=""/198, 0xc6}, {&(0x7f0000000200)}], 0x3, &(0x7f0000000340)=""/164, 0xa4, 0x1}, 0x2}, {{0x0, 0x0, &(0x7f0000000480)=[{&(0x7f0000000400)=""/81, 0x51}], 0x1, 0x0, 0x0, 0x3}, 0x5f}, {{&(0x7f00000004c0)=@alg, 0x80, &(0x7f0000000600)=[{&(0x7f0000000540)=""/190, 0xbe}], 0x1, &(0x7f0000000640)=""/180, 0xb4, 0x181a}, 0x5c}, {{0x0, 0x0, &(0x7f0000001800)=[{&(0x7f0000000700)=""/58, 0x3a}, {&(0x7f0000000740)=""/165, 0xa5}, {&(0x7f0000000800)=""/4096, 0x1000}], 0x3, &(0x7f0000001840)=""/140, 0x8c, 0x2}, 0x77b}, {{&(0x7f0000001900)=@in6={0xa, 0x0, 0x0, @loopback}, 0x80, &(0x7f0000001b00)=[{&(0x7f0000001980)=""/85, 0x55}, {&(0x7f0000001a00)=""/206, 0xce}], 0x2, 0x0, 0x0, 0x1f}, 0xcb}], 0x5, 0x40010021, &(0x7f0000001cc0)={r1, r2+30000000}) setsockopt$inet_mreqn(r0, 0x0, 0x20, &(0x7f0000001d00)={@multicast2, @loopback, r3}, 0xc) setsockopt$inet_mreqn(r0, 0x0, 0x24, &(0x7f0000000200)={@local, @multicast1, r3}, 0xc) [ 481.270790] binder: 32181:32203 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 481.304048] binder: 32181:32190 Release 1 refcount change on invalid ref 0 ret -22 [ 481.313565] binder: 32209:32211 Acquire 1 refcount change on invalid ref 0 ret -22 18:20:13 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000300)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) pwrite64(r0, &(0x7f0000000000)="4c5a059ce60948f37d0496eff8d2b7ed996145e8af282e8f66e032e4ac96313e24752d791db3b75578821162b9e1956ffe55820c38e71695c6a106cd1d9a4ca7740a4795ee3798c88a192c3e10d79d4b0888604cab24b427a0482988b063dc7fb661d692587df5dd92614509c957f60901003b39eebf16d7c8ff7a03a49b813c55ce7efbe9c8f303c168d6d5b1e72fcae213fbd1a2835d8587ba973fa9e993e058f3", 0xa2, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, &(0x7f0000012fc7)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, &(0x7f0000000f4d)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x8, 0x0, &(0x7f0000000140)=[@release], 0x0, 0x0, &(0x7f0000000340)}) 18:20:13 executing program 0: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = dup(r0) r3 = getpgrp(0x0) sendmsg$nl_generic(r2, &(0x7f0000000140)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x1000}, 0xc, &(0x7f0000000100)={&(0x7f0000000000)=ANY=[@ANYBLOB="b00000003800000025bd7000fcdbdf2509000000c89f71d639ab8f662910ae75d4c12eac799cf9b5383f0800290073797a00a0130f861de26079bd57edd62765b50f7df558a622a6d575450f8153d488cca659143e5d9e97294576ce027ed3c9ce1d31015f7880dd0f8832bf115f96a2de6596a2e7734abd179e58f2733115fe2b5320352a642343e624fa22f8b9a42ac2d1dd6763b8542b6b0ba66975201ca75e94c0e5d4d5c467cfa19508004100000000000000000000", @ANYRES32=r3, @ANYBLOB='\x00\x00\x00'], 0xb0}, 0x1, 0x0, 0x0, 0x4000800}, 0x4000000) add_key$keyring(&(0x7f0000000200)='keyring\x00', &(0x7f0000000240)={'syz'}, 0x0, 0x0, 0xfffffffffffffffb) 18:20:13 executing program 3: add_key(&(0x7f00000000c0)='user\x00', &(0x7f0000000100)={'syz'}, &(0x7f0000000200)="82", 0x1, 0xfffffffffffffffb) r0 = dup(0xffffffffffffffff) write$P9_RVERSION(r0, &(0x7f0000000000)={0x13, 0x65, 0xffff, 0x8001, 0x6, '9P2000'}, 0x13) 18:20:13 executing program 5: r0 = dup(0xffffffffffffff9c) r1 = syz_genetlink_get_family_id$nbd(&(0x7f0000000040)='nbd\x00') r2 = openat$selinux_mls(0xffffffffffffff9c, &(0x7f0000000080)='/selinux/mls\x00', 0x0, 0x0) r3 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f00000000c0)='cpuset.memory_pressure\x00', 0x0, 0x0) r4 = openat$keychord(0xffffffffffffff9c, &(0x7f0000000100)='/dev/keychord\x00', 0x0, 0x0) r5 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000140)='/dev/rtc0\x00', 0x0, 0x0) socketpair$nbd(0x2, 0x1, 0x0, &(0x7f0000000180)={0xffffffffffffffff}) r7 = openat$full(0xffffffffffffff9c, &(0x7f0000000340)='/dev/full\x00', 0x80040, 0x0) sendmsg$NBD_CMD_RECONFIGURE(r0, &(0x7f0000000440)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x80020}, 0xc, &(0x7f0000000400)={&(0x7f0000000380)={0x74, r1, 0x210, 0x70bd25, 0x25dfdbfd, {}, [@NBD_ATTR_DEAD_CONN_TIMEOUT={0xc, 0x8, 0x4}, @NBD_ATTR_BLOCK_SIZE_BYTES={0xc, 0x3, 0x7ff}, @NBD_ATTR_SIZE_BYTES={0xc}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_SOCKETS={0x34, 0x7, [{0x8, 0x1, r2}, {0x8, 0x1, r3}, {0x8, 0x1, r4}, {0x8, 0x1, r5}, {0x8, 0x1, r6}, {0x8, 0x1, r7}]}]}, 0x74}, 0x1, 0x0, 0x0, 0x8005}, 0x40) request_key(&(0x7f0000000240)='keyring\x00', &(0x7f0000000280)={'syz', 0x0}, &(0x7f00000002c0)='vboxnet1\x00', 0xfffffffffffffffe) 18:20:13 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000300)='/dev/binder#\x00', 0x0, 0x10000000003) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, &(0x7f0000012fc7)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, &(0x7f0000000f4d)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x8, 0x0, &(0x7f0000000140)=[@release], 0x0, 0x0, &(0x7f0000000340)}) [ 481.364309] binder: 32209:32222 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 18:20:13 executing program 3: add_key(&(0x7f00000000c0)='user\x00', &(0x7f0000000100)={'syz'}, &(0x7f0000000200)="82", 0x1, 0xfffffffffffffffb) memfd_create(&(0x7f0000000000)='user\x00', 0x1) [ 481.405046] binder: 32209:32211 Release 1 refcount change on invalid ref 0 ret -22 [ 481.420806] binder: 32209:32222 Acquire 1 refcount change on invalid ref 0 ret -22 [ 481.429093] binder: BINDER_SET_CONTEXT_MGR already set [ 481.437531] binder: 32209:32236 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 18:20:13 executing program 0: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_SIOCSIFBR(r0, 0x8941, &(0x7f0000000000)=@generic={0x3, 0x20, 0xffff}) fsetxattr$trusted_overlay_origin(r0, &(0x7f0000000040)='trusted.overlay.origin\x00', &(0x7f0000000080)='y\x00', 0x2, 0x0) ioctl$FIBMAP(r1, 0x1, &(0x7f0000000140)=0x8) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$sock_inet_SIOCDARP(r1, 0x8953, &(0x7f00000000c0)={{0x2, 0x4e24, @multicast1}, {0x306, @dev={[], 0x1b}}, 0x20, {0x2, 0x4e21, @rand_addr=0x4}, 'veth1_to_bond\x00'}) r2 = openat$selinux_mls(0xffffffffffffff9c, &(0x7f00000001c0)='/selinux/mls\x00', 0x0, 0x0) ioctl$PERF_EVENT_IOC_QUERY_BPF(r2, 0xc008240a, &(0x7f0000000280)={0x2, 0x0, [0x0, 0x0]}) add_key$keyring(&(0x7f0000000200)='keyring\x00', &(0x7f0000000240)={'syz'}, 0x0, 0x0, 0xfffffffffffffffb) [ 481.450849] binder: 32235:32238 Acquire 1 refcount change on invalid ref 0 ret -22 [ 481.460479] binder: 32209:32211 ioctl 40046207 0 returned -16 [ 481.475887] binder: 32232:32243 Acquire 1 refcount change on invalid ref 0 ret -22 [ 481.482951] binder: 32235:32238 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 481.483105] binder: 32235:32238 Release 1 refcount change on invalid ref 0 ret -22 18:20:13 executing program 4: r0 = syz_open_dev$binder(&(0x7f00000002c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000300)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, &(0x7f0000012fc7)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, &(0x7f0000000f4d)}) ioctl$SNDRV_TIMER_IOCTL_PARAMS(r0, 0x40505412, &(0x7f0000000000)={0x4, 0x5, 0x8fbd, 0x0, 0xf}) r2 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./file0\x00', 0x82000, 0x52) write$evdev(r2, &(0x7f0000000180)=[{{}, 0x5, 0xc3, 0x6}, {{}, 0x1f, 0xfffffffffffffff7, 0xffff}, {{0x77359400}, 0x12, 0x81, 0x80000001}], 0x48) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000000c0)={0x8, 0x0, &(0x7f0000000140)=[@release], 0x0, 0x0, &(0x7f0000000340)}) 18:20:13 executing program 2: r0 = syz_open_dev$binder(&(0x7f00000002c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000300)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, &(0x7f0000012fc7)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, &(0x7f0000000f4d)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000000c0)={0x8, 0x0, &(0x7f0000000140)=[@release], 0x0, 0x0, &(0x7f0000000340)}) 18:20:13 executing program 3: add_key(&(0x7f00000000c0)='user\x00', &(0x7f0000000040)={'syz'}, &(0x7f0000000000)="82", 0x1, 0xfffffffffffffffb) 18:20:13 executing program 5: request_key(&(0x7f0000000240)='keyring\x00', &(0x7f0000000280)={'syz', 0x0}, &(0x7f00000002c0)='vboxnet1\x00', 0xfffffffffffffffe) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) fsetxattr$security_selinux(r0, &(0x7f0000000000)='security.selinux\x00', &(0x7f0000000040)='system_u:object_r:etc_mail_t:s0\x00', 0x20, 0xc774ac481ded5b0a) [ 481.506583] binder: 32232:32237 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 481.523275] binder: 32232:32251 Release 1 refcount change on invalid ref 0 ret -22 18:20:13 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000300)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, &(0x7f0000012fc7)}) r1 = socket$netlink(0x10, 0x3, 0x4) writev(r1, &(0x7f0000000000)=[{&(0x7f0000000200)="580000001400192340834b80040d8c5602067fffffff81000000000000dca87086a5c000004f6400940005891550f4a8000000006700008000f0fffeffff09000080fff5dd00000010000100000c0900fcff0000040e05a5", 0x58}], 0x1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, &(0x7f0000000f4d)}) 18:20:13 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000300)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = dup3(r0, r0, 0x80000) prctl$seccomp(0x16, 0x2, &(0x7f0000000140)={0x1, &(0x7f00000000c0)=[{0x6, 0x0, 0x0, 0xfffffffffffffff9}]}) io_setup(0x7, &(0x7f0000000380)=0x0) io_submit(r2, 0x0, &(0x7f00000003c0)) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000005fd4)=ANY=[@ANYBLOB="0500020000000000"], 0x0, 0x0, &(0x7f0000012fc7)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, &(0x7f0000000f4d)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x8, 0x0, &(0x7f0000000140)=ANY=[@ANYBLOB="1754ff0300000000"], 0x0, 0x0, &(0x7f0000000340)}) sendmsg(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000540)=[{&(0x7f0000000f80)="6ff9181217620ceb6af75f578a20a7b75307bcdcd43c32e82104fd54fe9d4e113476f188f6291005cd88b0e580d5e7b087033e8d01d240bc8522fe3792a538acbdd9d85b983323b08bd524701e3df108d8ea9fb0124b37684b2148691760d6c1f85eedce0eaa6dc2af8612942545702ecc774cf171ad6377eb890111e7e877b8e2047e3aed3ea3c31b7a458c1da01243f1b8b246b4dc4f49e525b681403b56e22276340f8f8c14fc3e0a86826acff2e6a73486919d7aff5667416db5b0cfa56b30f72e5254c4644adb21aa11caa8a5c2519a13bdde8d7e70d5885144e7cc26865ecc39d834bed3597903f3d346051eb0bd5bac63eceacf5831efc3bcfe368ac11e75d23f967ed28e848b2f80d52d404fe36209345f245cd179eabf50e61a9b11c1f55317e170233b30148102eaed9520c8210f53cedfd839335dee911764827de1c628b4ba7bf0f473da9a8049f45e1a412cd72edea56b0ac6209cc576eb5a8b557f5faaf8a8396e0014ab62955670ae5e4467752e5a559277d7275abeadf5d30a4c2eadc70406e16cc91b6357f1b1ceaeec057f76272d62d9f24345062045adc42d0d81c5b0c6183ce8e61e5715ed3d12ec58480b602f9859c4914019a978db7a878c7990eb27b48769b75ca8b607949a72d14440a0bb15571ce44759c9b221a22f9a8e54c7c8b46e9d6257cfa6b63907483f523708391255e1b48d8da224b9b843620264054bb3043ebf62077cefb4415a7041f6aeabf57ed5562a80a1f33836484ba2bfd4ccc6d5a05cbaca2c60ca98ed930087f7e3f2cb11ab45747973d7341eab427b09d352062dce4475c51626a2a0d6cf7c31cd3c0cf26a80eca3f7ce14593eef90ea91d602257826e61ea2ad93115c33e62a905a72fe68a9ffe367a52450cc5e9e3f5f231a28bca730a55d7cd649d9307f08c08b036a00ae08909d6fa886479eb299d8b838fe636182f8291e9863de1fccfc1812398552fe7e2ed7e59cffba66f27823de1f6c59b7858ad84553c779fe26f462123e887b9f441f6ee99818acbf83e364d7909da801e86b0ca4d955764f6aa411add9241ea3932589d8af3c58cedf4c04781cdb641f5c7f89cced3ed5ff7d635cb2f472f46f31ace720ac6fadc5055af8871629e720d3266445d349052a2f3d44a14f26e54386f0b2bf97d2c5c8be5a515df5bfe5f14a932a3032e181982c4a610442cae9cc7bff87359c74df6d4d4ec051c83b7340ae2cf2da301e8e9e14edbb0ac0c1765e40813063a3e6283ea30966c16ef4005396950430c734a49a3d7779938009b9d30bb3233f43fffd94ab6ffc33669eeb49a367abde9b80b426431ea49ed9d5c4d94cdd847f9df70dd7c7066a1927e5e7e754efdc36290374e8c1480b9bb546c618647b5de391827441032dd5cfdc5aebd390f6ee1dd69e9822e7b1463dcad3e2ae222d18d0d2e7d63bff31bc4d95c04376b880639bc50885632f0ee45e3cae1c7ec9d55b04537ab765eaa418e31cabce9c26384081927db4ed66c17050a3fa7040e9854706756dd759f2f8f2b23fb27eb4ea3c2ab907d724fdd0f86da63eaa4d72946f4ce27494e3e69d78fe6643022cf0486ab4c9900db6d61bf9433e271e66f4e1a16528227bc04d73e0b491ab1d7c418aa14cc85037e6b03587fc32d21a3975cd0a6c384f72771fa410c97fc04e4e2f9922dac5df19ce79c679ac0826d01fd7ec9a35c038da6f4510d5f5a6c452fbaaf8ef8b1790fa2af4025860dd188f8ee6cbbc950187f6611227216b25c372eef7bec2f8342c6bb2f349c3b9d93adc08f4632e6596a41e3d4abcbf6a7f3c2d3565a64b4cb034b106a3371843f5d3e8bec1a49066ff9a7f6f77dc53ed03ca9665a108a11aafcbcd79de594db7566c984b12bc9422d99a3f3d38d1ca9801ed4bfc59abf52a215bebbd42fd03a5ccd75d5512da7315daf560a50449d5718a82a2c9a9f11e3b3a2049946049fa2af2d837725d9c308a61383dd2bb3114805a670f3e391a45e7387228a6f08bb88203b7916103313d61e49b16ffa50a86e4f2f2b80c8408f73b9e19d10ba46a06150c49a91ac92e2157773abf861cc886cb74449a11cd04de7565dec6798333ccdfb6683bb03c2c28532ffdb939cefe6919ced119e3257bcfed5c362b919e89a1b4eb2f7d45faaae1013b332a005d6346f71f772525ac5b0f0d011659448069605e4354000782432acae9a84289cda9a2326adbbacf13b181c68f030e6830c0e7eea34a90aeca1d6584ac313f0e7c0b2f1c93b1586bdc09aab2f878326224e9170863d5d0fa1e87c4c6fd083127bc73ba513b8c1ad40e923d0fdae27ac3d5122d33ae389e20937f4d228fb4d8ae7e0462de479ea7d39895ddb21ddfed2b397da2642355d85028be624c5ca64a8198e87d6ac1b636454b3f5cf669bbc013d09e782d239c3f2aa0f354d9af33fdb7a91c686c580e759a6334e3eae884f095a2150bc4f292aa8ef36f690798e19f14ec64e85d8bd3e47c3bde78f1a366e4696f56fa9cece90b8eb02fe8073ccfad4b35af5320753a7dacdf1c85a7e15502a4c6d60f4f1ef096fd124690cf45db869f55565e0722954fab0071ce425be4d3378b250a7f4bfa69a19bd047824d85642190522c0db11539886c8c1599b118e3335840c508566fb94ccf0a6e415616b57d1ee3539644900b36a06ad375fbae0fd55ed5b7b024234bdc789ef83da95a51f29f28ff31fd449e40293499fced5c2db608cbbcb94adfeaba8f2db8b64c5c1c25fc0316a3526f5132fb1ee984a747638c7f9b8e4a421f0b481fbf5536ecc960c45ca50f02b0c666e91cbe2f8efaf9c75d01a3475b458f80d33794bf45232557acc7b696662c02d1e3a93856a279c0878f9fa4e6ec151c34e7ae793f5c8cba668a74f63bec8ea4f58f97a76b86210dda51b53cc45f691e5446db0074fce1a0db1f6c4ca18493b9026401f0bcf6ad0c550ad22135146f5e468cd728c4fe40151ea235f53fd85164dd8f1d6abda3b9791703aa3106183c2e5b33334e8e50cddb1841969e38e5807c9565a7de176f58af5b36e67f4197eb44988d79cb34bd1d3d37dc7f0107228bdef35f8ef9658840b8c382b38717a27c8ef3695d8eb9462d2d6ba9c237e84f6aa24ac6c33adfb02e7fbe400e140b7979236970b9c0e5e68cd96e20003aecc9d65cf319da5dce2f18678c36d78ad9bd3b4ee7f96869e1be43d3a8466264818efaec6319691446dc2410509029691bb9bb0552faa20c84b249c34220781c0fa7a24b6280270a70a8174dce3729ed235e89cecf9682eb811bba1ec5846e1ea81d6edfb9b87bbeea5c81d1367d34781194173d48f5d36bf854d84d20426eba7fc1e854db826a501a6864247f8df830912cc25cf38ebf0572f97367c44db3fe527c52b9db3a50b8f56fa5d080df18a5ed56d51779a7ac38ae5d4bde4eb18c4586642d3bef98ff480d90a2f175c3028981521df57f8e2fd57cb20ea5d953d4df94c9b8b5165ff573286a5e1160c3ea873f3fbf24ee1ad1317c36c7e3fcdd2361ab4f0a84590ada8c35e0959baecdf5b8ea10ed22386bb8d39a78896a5a2c5fd7bbd602d98e102e0266cf1b7089b0121e1dcc6de4a6f34621cb933940354d943f0d6d290d374e198b902cfaac50c1bc066651c6ad9382407d415c7178112bdc38efd324f0b7ec55b27a7b14827cc627b579edaceeb2f04c3a030d82d97efd34cbde3e97e920f12e290e711460ddc0e754a794dd1c3c8afbaaada723cbaff383331d20d1b7ec8a362a8b94074eb97989785dbb9aa700b63bc5b5d60f81efec2cba2a8010d77b7b98692f5c6aa0e921d3c259f5c373c7c7c1c4464ea5c093aab84262d2b7fb849cf9ed79352c25a98485dbf8d0f713e94aae83c3f6467753f762226dc0bb558a96f9e9a1d5e5231ae35c65f99694a311d3d60f4a521ecc782ecefcda75efe081c6651d5bda304dec0db3767a3765f542ec9ee74894fc861a4ce8fa6e876eb8aa6a2e26d2f912f88143619fb98691927df00efe721c0569cc51fba8d03daebac76edf0fac59c4feafe8b5b5f62a220ce91f563670bd4fbcc8de2aa84373da10071b049317281ed26aa7674f859a43e9e3c2fdb3db5735568155dcf6fc49e03f9d63956b53c5f4f102d8e1a792a7eea04d6f76b74546b2ccd227983195cb9b545f7b74262236a846ff24653e4f41be58cd4ee790bd07a98be357dc5283424a9ef63217db2cab73244d8bdb4a6e242faa8943a16ce7ec9cf0725c82d7574a8ad34e3902a3f369c6c6566b9d4f7942d734fc36cea747ecb434d4a628e3c926d1843b111be49fec4493907bb74f4ff76b6f6fb09ce1d0698009a0c0ed483f32ed7c55385fc752a6a55d4a05d428392eab5dd27b9baa5c99dd0ed5a5a50defc30aea9d577d44de07b8b436c209e6b9bd5fe72680417a8736c31f2a0ebf718cf904b11c1821bc058c2ed86ddafd4875b15781034e3dcf2650685320fee774bcaea77a38fc4e8edfd50486183d5b4348c3f773c1dde0d6c8c43e061cdf11d07bb797a58da221f0335ac82e93fadc121f42ba4e44acb67834a40f264433ef437ce62ade4afb77f502d268864bcaac83e7615e8628f1ddc58250762218d1bff86a40dc1b35bf6d2d00ee3b556afbd4e093f2f18a8989ffb87a02ebb6b28225c7d0891a52af94a0fd03b18d9d56a76882d98c9a994bfcd5623245acd73e48bd1a2207f2ef0c689e1517fc8f298e269ce6193745d6c603bc23be981df855ac2741e8f48335f3cc643d8042bdf7f2320a9fa383661cbe7366c797fdd431e205bee35ca99de1ae8b9e9d55b883af2dde8539a9f1ee479dbb0069500212482555d56ccfe36a02eb31740fc93849ea97819ea1fb4d40246b47fbc0aae43ed1d714e52c81f77dbfe1a1ec8d2f8dc3edeed19508fb9dc381c5e3d991ad8217900dbea32086fa52c269493fcda0527779ceab8374ddc0d00ea148ae534d3828e9db28c1a9cdc7a0fbeabe5d308a774179fbf978519f58e02a8aab77b374b3bb0e7d022d6aac2e465105feaf21ee2349eada17c074088fe2e7a096255d05ac3c71f432f9ecc4232b90cb63d8020da56afa6319932c3e52b17c32aed58502b4ed028510fef330a30a930fc8a7af8c845e7464f2fca184bf29806cc173ab293476919e1a15d4c57507a22dd95705b4db9064ac9a550edbc7180c924a6d6f07d5c224701a27c56c966d4380fd825210f6605c4dfa7d0f9a7b403d7e87dcd0a8a7471e8f3d8f8d640638dd7be88bd9c863987593e0fa9fe9e1dea33f231b73c4f3aceefcae422101004edf99e69fde1ddc5b846b0b0618d1dd7b5610a618651e09a59778b6203f22843b080befd68d2851be4126376c0a6cc43a62d9cb9426f5c87d5d590dcaf30836fd6dcdab9caa0e3ce24f0859144dac667c8bfdbb76e3c5fe4a8d1eca5b3d5b326d2ce2188b272f6e32883ba1b6e14d23a95482a8285b5284c782cb2211fd6c1a6ee73ca0dcd6733e0a57fe5af191e6222d941d0f8121b2773b11f68ab9cd2a9e11d8150cbf765db7d1cc39069dee605f0e539f033b894a60b2cead6ab47815ceb625753060856b96fe504a0d0140fdb16c33473c2140ea2eefb509753b65041eb13409e3c45c12669e395199dc3311cb23f651e1b022d79c947b7b52c4574886c28c2fddc0702c47a3d9cd81e8eb13ef47ec9a9950f0e1302580da4178d6fb3be0678784b5e29d67f33c1916571c8d63a9a64f06b08172672296550c63ed01ea831c04c558c4b3b8b66c2fee15c691cbb7c251a63d4a2d25cc", 0x1000}, {&(0x7f0000000180)="799a47fe29e6d43c8817353d781839a13f39fd2b410f74916bd96058570eb0fc4a83a8ee1f9312dfd9b3d293fdc37c4474b1554d44f892b35350892f4c875a2bc49dc02c733392cc307044fb621629b7fec15c0d86b26f3a6ac5239a28c5ff33f261128cefdab67805492eb55b15e84096f3cac74be9d34ab5633959988461480132e307457cfceeecadc549a253a70516bf252d9e1df67c8fee9089f73c54676da1a8196e51d0a8e764fd", 0xab}, {&(0x7f0000000240)="15d060a01e619254d79c4cc745ee6c14f4f44654828133c8ea1deb61e6418d727b575012513c785eee64545e89e486827aa8a4bc22c641248fdae078e40bddb577", 0x41}, {&(0x7f00000003c0)="cedf8ec23f1f391cb760a6b21a721016c6dfab51a9f0855b2688a938fb14c34b78c354398deda1a721dbd4f1cf5ae162be38344cff4b1f942a1e9a7e461c06b647e351f85ea606ce7c50f157", 0x4c}, {&(0x7f0000000000)="7de853bb11a42f5e618c6c7e54e16e7971043db771ee09b0f66e8e8980e185f459f4ca3969cafb629a3355226467b5144085bce07183df", 0x37}, {&(0x7f0000000440)="f6382638fa3e030e38ae8789af2029a144b096df52dae754119b638b7d109e25015b99dd60d3415e3706b32ab5f3eca562553143f156ce01b76c0d540c3232c5af36aeabca48766fd58608843722b85e443eb621f5354306eeb57a040b5ed68fd6f796e8b6bd553102708142b2c167c5281ed71c56dcb58846bd92063ffcb715798758073ca8f5d3916cbda0ff9065645b397334025e23060ecc45eafae1668c4b09837973eabf86592adcbe43cf3f0e1518ed0726766fc567de8452afcc91fb4cb5f08baa0a08a1cbff55beb7", 0xcd}], 0x6, &(0x7f00000005c0)=[{0xf8, 0x1ff, 0x8, "798b86595c8cff5b09c1702d238cad7720e633e7a7c22220bef18535d9aefa35d4c2f38b64d360b138bc2ea44ff2515c92a6eacbbab46badab93505231413bdcffaa58edcb0ac2a4ef9a14c8442e30bcee559a88178450dc222f4ee5e975ee957b1687ce2755643653685af0922385595661e721c51eef42bd133dbabe5a523a9b5c11f6c99fff2227194b4b6ab269f1b9232032299e9cff76e283cf2066fed1a152f0bd65723e8af785cef6978e3beea4fa1f16ba9c2968dcc65666e5445aedc7d554d06f2d687b57e0a539d6b762d65bc7a819be84dbca863bfbffb8184113a259"}, {0x48, 0x10a, 0x0, "078c6d5f3328b19cd9022c4037f6d9e72f8d3f74f8d422192de5d79355fcd3a8f4f0bffd3d3d9f14309157a0c3a68284c467b0794f"}], 0x140, 0x11}, 0x20000094) connect(r1, &(0x7f0000000040)=@ipx={0x4, 0x40, 0x0, "23f051cafbff", 0x2e}, 0x80) 18:20:13 executing program 3: add_key(&(0x7f00000000c0)='user\x00', &(0x7f0000000100)={'syz'}, &(0x7f0000000200)="82", 0x1, 0xfffffffffffffffb) r0 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ppp\x00', 0x1000000000020200, 0x0) setsockopt$inet6_tcp_TLS_TX(r0, 0x6, 0x1, &(0x7f0000000040), 0x4) getsockopt$inet6_IPV6_XFRM_POLICY(r0, 0x29, 0x23, &(0x7f0000000240)={{{@in=@broadcast, @in6=@dev, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@mcast1}, 0x0, @in6}}, &(0x7f0000000080)=0xe8) r2 = getegid() getsockopt$inet6_IPV6_XFRM_POLICY(r0, 0x29, 0x23, &(0x7f0000000340)={{{@in=@remote, @in=@multicast2}}, {{@in=@rand_addr}, 0x0, @in6}}, &(0x7f0000000000)=0xe8) fchown(r0, r1, r2) 18:20:13 executing program 5: r0 = add_key(&(0x7f0000000440)='id_resolver\x00', &(0x7f0000000480)={'syz', 0x0}, &(0x7f00000004c0)="800800ee3404bdf85aab70056ff0fdc12ff89786caa0edc74a3b101cb73f81a4d13602226b13ea94d36b9ed65a413faf8d113d3b8824e04e34dc4fbe85a1fccef4c72762a4d28838d0091937bbc3fa40920b71cf197860ac9a86dbbec3dd81bbd3c4b599548bf031186bcbe2f891bed9279cdf1ca4a8cd67996a2b21b5b85b6c0986c7a939438f9d5973630d0fd596f3b7a245cae1f06f2b5a118e88ac8a5fbd8f3daad9ba9d", 0xa6, 0x0) request_key(&(0x7f0000000580)="670035af41f1e6c8a9c35bfc1169b7a6295f4cf08f514ac7dbf3135bc66d725c604b70d2d695649efe7dbe9f1d92", &(0x7f0000000340)={'syz', 0x0}, &(0x7f00000002c0)='vboxnet1\x00', r0) pipe(&(0x7f0000000400)={0xffffffffffffffff}) setsockopt$inet6_MRT6_ADD_MFC_PROXY(r1, 0x29, 0xd2, &(0x7f0000000380)={{0xa, 0x4e21, 0x8, @ipv4={[], [], @dev={0xac, 0x14, 0x14, 0x1e}}, 0x81}, {0xa, 0x4e20, 0x6, @mcast1, 0x200}, 0xffffffff, [0x9, 0x9bc, 0x400, 0x8, 0x1, 0x4800000000, 0x4, 0x7]}, 0x5c) r2 = openat$apparmor_thread_current(0xffffffffffffff9c, &(0x7f0000000040)='/proc/thread-self/attr/current\x00', 0x2, 0x0) writev(r2, &(0x7f0000000300)=[{&(0x7f0000000080)="4e1001ada0280ba1e49b50a91c05210c81d2a8ade7451925db9773ff80b83b51df6337df8f59850f0a63c65c4a0ef4b8f55bb745526839dd44dea956398dac5b8d85eb3a9c89ffa95ccc86d5e10f93adf1c1e856f53b7bb5f652a12db7dc4dd7344fa3f07a9eb898ac", 0x69}, {&(0x7f0000000100)="ee5436241fd08746677c7a65e79500d746364da28f28a17b2ac0d2bac4cc96408db636db9b14b0a24364fd04da4338cbbc7540dccb43c7a4e17a58d91bffeb19782699a6fc0afae5b908ff2187f2e3322da15f2f1f0936155649a5930a31e9961dd69ee5eb7b25e4e2d47f44e0c19eada21516b22654b18df73a52e4dc20e3258f667c9371664c787dc0d97eddee5d24d044769d322e0cbd91a43055d65e7abd5d08413e4344fefd37d2779207f20b895ed12be1458f4da905879a94a1d1e7be", 0xc0}, {&(0x7f00000001c0)="729a023c3873545a59b478fad10b2157160f98a16d20b6766ec2e21734f71ed5cf4c873b26b3e3bc617d4baa21409750b5902321d31e96e863cc938bb894c799fd74baf68139b3d31df5777aa7a59b96957a", 0x52}], 0x3) sync_file_range(r1, 0x6, 0x8001, 0x3) socketpair$inet6_icmp_raw(0xa, 0x3, 0x3a, &(0x7f0000000000)) [ 481.583123] binder: 32259:32264 ioctl 40505412 20000000 returned -22 [ 481.618099] binder: BINDER_SET_CONTEXT_MGR already set 18:20:13 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000300)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, &(0x7f0000012fc7)}) r1 = socket$netlink(0x10, 0x3, 0x4) writev(r1, &(0x7f0000000000)=[{&(0x7f0000000200)="580000001400192340834b80040d8c5602067fffffff81000000000000dca87086a5c000004f6400940005891550f4a8000000006700008000f0fffeffff09000080fff5dd00000010000100000c0900fcff0000040e05a5", 0x58}], 0x1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, &(0x7f0000000f4d)}) [ 481.645860] binder: 32259:32278 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 481.663612] binder: 32259:32264 ioctl 40046207 0 returned -16 [ 481.685886] binder: 32277:32283 unknown command 131077 18:20:13 executing program 5: r0 = socket$inet6(0xa, 0x6, 0x1ff) r1 = openat$cgroup(0xffffffffffffffff, &(0x7f0000000000)='syz0\x00', 0x200002, 0x0) sendfile(r0, r1, &(0x7f0000000040), 0x5) request_key(&(0x7f0000000240)='keyring\x00', &(0x7f0000000280)={'syz', 0x0}, &(0x7f00000002c0)='vboxnet1\x00', 0xfffffffffffffffe) 18:20:13 executing program 0: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180)) pipe2(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}, 0x4000) fremovexattr(r0, &(0x7f00000001c0)=@known='system.posix_acl_default\x00') ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = add_key(&(0x7f0000000040)='rxrpc\x00', &(0x7f0000000080)={'syz', 0x1}, &(0x7f00000000c0)="63027e24e43a82a04e3de30df474a12e95faaaaea2e99bb6cc5b21fc4c35b2e4b3c6d4a7d4dcfe5c06c1ff5a3c42d56df03689fe7b9038c54a64b00c9aa5dafa7aa761c8651e9c39f567a289f13346280152e4b503e72c35975affc0c513e2d2bfab28f39c36a5d0436d8054c9823dc36528b02d27b672fe850b043894bae08cf5ca790b5bd031f57b4a880beae01f", 0x8f, 0xfffffffffffffffb) add_key$keyring(&(0x7f0000000200)='keyring\x00', &(0x7f0000000240)={'syz'}, 0x0, 0x0, r1) [ 481.692355] binder: 32259:32264 ioctl 40505412 20000000 returned -22 18:20:13 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000300)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, &(0x7f0000012fc7)}) r1 = socket$netlink(0x10, 0x3, 0x4) writev(r1, &(0x7f0000000000)=[{&(0x7f0000000200)="580000001400192340834b80040d8c5602067fffffff81000000000000dca87086a5c000004f6400940005891550f4a8000000006700008000f0fffeffff09000080fff5dd00000010000100000c0900fcff0000040e05a5", 0x58}], 0x1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, &(0x7f0000000f4d)}) 18:20:13 executing program 4: r0 = syz_open_dev$binder(&(0x7f00000002c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000300)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, &(0x7f0000012fc7)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, &(0x7f0000000f4d)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000000c0)={0x8, 0x0, &(0x7f0000000140)=[@release], 0x0, 0x0, &(0x7f0000000340)}) r2 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x80, 0x0) ioctl$LOOP_SET_BLOCK_SIZE(r2, 0x4c09, 0x0) 18:20:13 executing program 3: add_key(&(0x7f00000000c0)='user\x00', &(0x7f0000000100)={'syz'}, &(0x7f0000000200)="82", 0x1, 0xfffffffffffffffb) socketpair$inet6_tcp(0xa, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) getsockopt$inet6_mreq(0xffffffffffffffff, 0x29, 0x14, &(0x7f0000000040)={@dev, 0x0}, &(0x7f0000000080)=0x14) ioctl$sock_inet6_SIOCSIFADDR(r0, 0x8916, &(0x7f0000000140)={@mcast1, 0x47, r1}) 18:20:13 executing program 0: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = open(&(0x7f0000000000)='./file0\x00', 0x2100, 0x91) ioctl$GIO_SCRNMAP(r1, 0x4b40, &(0x7f0000000040)=""/213) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) add_key$keyring(&(0x7f0000000200)='keyring\x00', &(0x7f0000000240)={'syz'}, 0x0, 0x0, 0xfffffffffffffffb) [ 481.724146] binder: 32277:32283 ioctl c0306201 20012000 returned -22 [ 481.747054] binder: 32277:32297 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 18:20:13 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0x0, 0x0) ioctl$FICLONE(r0, 0x40049409, r0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$FICLONE(r0, 0x40049409, r0) r1 = syz_open_procfs(0xffffffffffffffff, &(0x7f00000001c0)='net/packet\x00') ioctl$TUNGETSNDBUF(r1, 0x800454d3, &(0x7f0000000200)) r2 = syz_open_dev$binder(&(0x7f0000000300)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000000240)=ANY=[@ANYBLOB="056304400000000089062c930e503f22da5a7142b942b9155a1308000000006b0df7663d2a7d8629aa0e9ae19ed6ae150552d0cc932f96f0cb2744b9a770b752b3c2d923ab256957ef443148ba173d3b09666141f36f3a47900b5a96dc29b46a9ea28624828bfc9b238459f2631a68a09b2679fa05dc7879cbe2d033e37f2799d6"], 0x0, 0x0, &(0x7f0000012fc7)}) fremovexattr(r0, &(0x7f0000000000)=@known='system.advise\x00') ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=ANY=[@ANYBLOB="0e63fdff00000000"], 0x0, 0x0, &(0x7f0000000f4d)}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000000c0)={0x8, 0x0, &(0x7f0000000140)=[@release], 0x0, 0x0, &(0x7f0000000340)}) r3 = dup(r0) write$FUSE_WRITE(r3, &(0x7f0000000100)={0x18, 0xfffffffffffffff5, 0x5, {0xdf8}}, 0x18) 18:20:13 executing program 0: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) add_key$keyring(&(0x7f0000000200)='keyring\x00', &(0x7f0000000240)={'syz'}, 0x0, 0x0, 0xfffffffffffffffb) finit_module(r0, &(0x7f0000000000)='syz', 0x1) [ 481.786062] binder: 32277:32304 unknown command 67064855 [ 481.797291] binder: 32277:32304 ioctl c0306201 200000c0 returned -22 [ 481.812155] binder: 32299:32302 Acquire 1 refcount change on invalid ref 0 ret -22 [ 481.819372] binder: BINDER_SET_CONTEXT_MGR already set [ 481.819380] binder: 32310:32311 ioctl 40046207 0 returned -16 [ 481.856805] binder: 32277:32283 unknown command 131077 [ 481.856819] binder: 32277:32297 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 481.868778] binder: 32299:32318 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 481.878304] binder: 32277:32297 unknown command 67064855 [ 481.887070] binder: 32277:32297 ioctl c0306201 200000c0 returned -22 [ 481.889222] binder: 32314:32316 ioctl 40049409 3 returned -22 [ 481.889422] binder: 32314:32316 ioctl 40049409 3 returned -22 [ 481.891718] binder: 32314:32316 Acquire 1 refcount change on invalid ref 0 ret -22 [ 481.891861] binder: 32314:32316 unknown command -171250 [ 481.891869] binder: 32314:32316 ioctl c0306201 20008fd0 returned -22 [ 481.892620] binder: 32314:32316 Release 1 refcount change on invalid ref 0 ret -22 [ 481.893782] binder: 32314:32316 ioctl 40049409 7 returned -22 [ 481.896086] binder: 32277:32283 ioctl c0306201 20012000 returned -22 [ 481.903470] binder: BINDER_SET_CONTEXT_MGR already set [ 481.903480] binder: 32314:32322 ioctl 40046207 0 returned -16 [ 481.903552] binder: 32314:32316 ioctl 40049409 7 returned -22 [ 481.904504] binder: 32314:32316 Acquire 1 refcount change on invalid ref 0 ret -22 [ 481.904631] binder: 32314:32316 unknown command -171250 [ 481.904638] binder: 32314:32316 ioctl c0306201 20008fd0 returned -22 [ 481.904684] binder: 32314:32322 Release 1 refcount change on invalid ref 0 ret -22 18:20:14 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000300)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, &(0x7f0000012fc7)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008fd0)={0xfffffe74, 0x0, &(0x7f0000000080)=ANY=[@ANYRESHEX=r0], 0x9d, 0x0, &(0x7f0000000180)="1cf1be47b446eea8649558003d3aa955c5666771de4c9cdd6e6a7c7ca5259dbf5dcf5ab4da070000009d9fb0a63be572606bdff39a92ad5cea3d2b23310969e82cca6a54d9f5e08d937248e4083ed488c6045e387d53a019daf25baac4c1961edda8ef21008e8e56700a6b7333fd181db8ea25c5e57264420883fd8521fb58e6ab57c7e6448ce62b000000000000000000000000000000000000000000"}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x8, 0x0, &(0x7f0000000140)=[@release], 0x0, 0x0, &(0x7f0000000340)}) ioctl$int_out(r0, 0x0, &(0x7f0000000240)) mkdir(&(0x7f0000000000)='./file0\x00', 0x40) ioctl$FS_IOC_SETVERSION(r0, 0x40087602, &(0x7f0000000040)=0x5) listxattr(&(0x7f0000000100)='./file0\x00', &(0x7f0000000440)=""/215, 0xf19edea) flock(r0, 0x4) 18:20:14 executing program 5: request_key(&(0x7f0000000040)="6b657b72696e7700393fc8fbea9b952edfc9a17b78c09d41f6526410cf2c319fb96deb1a7f79cb68df4b6caec6518c94075753995243ea61d6e2d590b3cc5d95e2fed231c342b47b9de40dda361877557b8ddfe60db06424929e38214150ba73d60e1fbbb5ebf12f098d4d4de8823203068d4a1e175fc967b071770a4c71db6821ac4b6adec756ab66ad94c562a6a101da6534d8406e346f0d7135f9fa6fd885d8e95d57cfeab10e0f9308d404534130b721cd327c2c01f30d7adc65e5b1d6ee65", &(0x7f0000000000)={'syz', 0x0}, &(0x7f00000002c0)='vboxnet1\x00', 0xfffffffffffffffe) r0 = openat$null(0xffffffffffffff9c, &(0x7f0000000140)='/dev/null\x00', 0x40000, 0x0) clock_gettime(0x0, &(0x7f0000000180)={0x0, 0x0}) timerfd_settime(r0, 0x1, &(0x7f00000001c0)={{r1, r2+10000000}}, &(0x7f0000000200)) 18:20:14 executing program 3: add_key(&(0x7f00000000c0)='user\x00', &(0x7f0000000100)={'syz'}, &(0x7f0000000200)="82", 0x1, 0xfffffffffffffffb) r0 = memfd_create(&(0x7f0000000000)='syz', 0x4) read$eventfd(r0, &(0x7f0000000040), 0x8) ioctl$TUNSETLINK(r0, 0x400454cd, 0x31b) ioctl$TIOCSSOFTCAR(r0, 0x541a, &(0x7f0000000280)=0x12) ioctl$GIO_FONTX(r0, 0x4b6b, &(0x7f0000000140)=""/187) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000000080), &(0x7f0000000240)=0xc) 18:20:14 executing program 4: r0 = syz_open_dev$binder(&(0x7f00000002c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000300)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) fcntl$F_GET_RW_HINT(r1, 0x40b, &(0x7f0000000080)) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="0563044000010075fe02b4cb16536f54631cdfd8ff719f0000"], 0x0, 0x0, &(0x7f0000012fc7)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, &(0x7f0000000f4d)}) socketpair$nbd(0x2, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$sock_timeval(r2, 0x1, 0x15, &(0x7f0000000040)={0x77359400}, 0x183) fadvise64(r0, 0x0, 0x7, 0x7) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000000c0)={0x8, 0x0, &(0x7f0000000140)=[@release], 0x0, 0x0, &(0x7f0000000340)}) 18:20:14 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000300)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, &(0x7f0000012fc7)}) r1 = socket$netlink(0x10, 0x3, 0x4) writev(r1, &(0x7f0000000000)=[{&(0x7f0000000200)="580000001400192340834b80040d8c5602067fffffff81000000000000dca87086a5c000004f6400940005891550f4a8000000006700008000f0fffeffff09000080fff5dd00000010000100000c0900fcff0000040e05a5", 0x58}], 0x1) 18:20:14 executing program 0: r0 = add_key$keyring(&(0x7f0000000300)='keyring\x00', &(0x7f0000000340)={'syz', 0x1}, 0x0, 0x0, 0x0) r1 = openat$pfkey(0xffffffffffffff9c, &(0x7f0000000380)='/proc/self/net/pfkey\x00', 0x0, 0x0) ioctl$EVIOCSCLOCKID(r1, 0x400445a0, &(0x7f00000003c0)=0x200) add_key$user(&(0x7f0000000140)='user\x00', &(0x7f00000001c0)={'syz', 0x3}, &(0x7f0000000280)="dbd4cc382bd8a790e519f03ca776184134c2ae20f5ef780615a6cf231506acc5eceacb1514af561287cdf752c3e14c2e746d", 0x32, r0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$inet_msfilter(r2, 0x0, 0x29, &(0x7f00000000c0)={@rand_addr=0x40, @broadcast, 0x0, 0x2, [@remote, @rand_addr=0xffff]}, 0x18) r4 = openat$selinux_avc_cache_stats(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/avc/cache_stats\x00', 0x0, 0x0) ioctl$VT_DISALLOCATE(r4, 0x5608) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) add_key$keyring(&(0x7f0000000200)='keyring\x00', &(0x7f0000000240)={'syz'}, 0x0, 0x0, 0xfffffffffffffffb) getsockopt$inet_tcp_TCP_ZEROCOPY_RECEIVE(r4, 0x6, 0x23, &(0x7f0000000100)={&(0x7f0000ffe000/0x1000)=nil, 0x1000}, &(0x7f00000002c0)=0x10) statfs(&(0x7f0000000040)='./file0\x00', &(0x7f0000000080)=""/20) 18:20:14 executing program 3: add_key(&(0x7f0000000040)='user\x00', &(0x7f0000000100)={'syz'}, &(0x7f0000000200)="82", 0x1, 0xfffffffffffffffb) r0 = dup2(0xffffffffffffff9c, 0xffffffffffffff9c) write$FUSE_NOTIFY_RETRIEVE(r0, &(0x7f0000000000)={0xffffff2e, 0x5, 0x0, {0x0, 0x6, 0x0, 0x56d}}, 0x3c2) 18:20:14 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000300)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, &(0x7f0000012fc7)}) writev(0xffffffffffffffff, &(0x7f0000000000)=[{&(0x7f0000000200)="580000001400192340834b80040d8c5602067fffffff81000000000000dca87086a5c000004f6400940005891550f4a8000000006700008000f0fffeffff09000080fff5dd00000010000100000c0900fcff0000040e05a5", 0x58}], 0x1) 18:20:14 executing program 5: request_key(&(0x7f0000000240)='keyring\x00', &(0x7f0000000180)={'syz', 0x0}, &(0x7f00000002c0)='&md5sum\x00', 0xfffffffffffffffe) r0 = openat$selinux_policy(0xffffffffffffff9c, &(0x7f00000001c0)='/selinux/policy\x00', 0x0, 0x0) fcntl$addseals(r0, 0x409, 0xc) r1 = socket(0x9, 0x7, 0x6) r2 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/enforce\x00', 0x400000, 0x0) ioctl$TIOCMGET(r2, 0x5415, &(0x7f0000000140)) lsetxattr$security_smack_entry(&(0x7f0000000080)='./file0\x00', &(0x7f00000000c0)='security.SMACK64\x00', &(0x7f0000000100)='&md5sum\x00', 0x8, 0x2) ioctl$BLKRAGET(r2, 0x1263, &(0x7f0000000040)) ioctl$FS_IOC_FIEMAP(r1, 0xc020660b, &(0x7f0000000300)={0x8, 0x100, 0x7, 0xe4, 0xa, [{0x1, 0x0, 0x0, 0x0, 0x0, 0x1000}, {0x6, 0xcf7, 0x5, 0x0, 0x0, 0x2201}, {0x1, 0x200, 0x22, 0x0, 0x0, 0x200}, {0x8000, 0x2, 0x7, 0x0, 0x0, 0x4}, {0x80, 0x800, 0x4e6, 0x0, 0x0, 0x1000}, {0x3, 0x3, 0x1f, 0x0, 0x0, 0x801}, {0x1, 0xafa0, 0xf6}, {0x9, 0x800, 0x1, 0x0, 0x0, 0x400}, {0x8, 0x5, 0xd164}, {0x20, 0x9, 0x2, 0x0, 0x0, 0x2000}]}) [ 482.066508] binder: 32332:32335 Acquire 1 refcount change on invalid ref 1962934528 ret -22 [ 482.089285] binder: 32332:32335 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 482.108039] binder: 32332:32335 Release 1 refcount change on invalid ref 0 ret -22 18:20:14 executing program 3: r0 = accept4(0xffffffffffffff9c, 0x0, &(0x7f0000000000)=0x1ac, 0x800) ioctl$sock_SIOCGIFCONF(r0, 0x8910, &(0x7f0000000040)=@buf={0x1000, &(0x7f0000000240)="d301f4dd439d7a60bf2bc106994f1cabe24e680caac2c9fe8ec7214f027732f356fe432454a9918d936a18acf0f2d6fc9485bd9ae9e49b8bdb0023fa392ba8698bbd35974dae4dcb0e344df8fc595541d8d589fa53c3a4b1ce07c919eb4794fa2653ec1eba7d256f161482c693c4fa894fdfaf2a43f04dda942f28e01f0df5fe516c90a10bd1f89f640cc755094b2fb93b2d15ececbabc4bff99f9f751c97b4a3bdcdc38b8924709836668daeb40985a66eb63e263bdd456704b71cf99a0fd7dceb75c478ed6f085b819164fabfec0aa963a2e1b53eb5d0bc12f6e26003ff213f2a8878cac1a9e94ad8c0794d92e0d0b7c32d3279090cd5b95be6475d630af05dcb6fa61b764467d5d7a254df6d5c94e08635f500eba459bb5abb1392dd57435444363d47a25f69a15106f127d6052a3c8b7b8cd95cecec82771c8ad548a75bae7023639aa05696b239c1ec0219f62f8db4d87bceadcd8a24863b2ee0b709ba3943254ff985637d7e37fc1c592e3065dc50458a7d7ddd23db76773ec56e02aff9cfbde8dbd7a00ee7d70bbba105a6341c821eeff1d57e950452f07b6b4e855402abed0a466ec9c6379261bf72fde268b0acc3a22f958412367eba9955aea2e56062a619049faf129c57bc19878aece34570624b8787c8b7bc77c91d2e8f3004ff47543341af0b9d914c7a200338522f4fdd28ac991016e7af9d2a9ca6891debd3307f12c578e3e7440dd7b47d1a0bce2c8a54ba1e51eb7180a0ab6249f9b63728eb6d0deb6f9ad830b251be3a20a713adecfe5b6dd29c594fd11fdcf2b5b0992f03d0a935f20d1e553c59e00967d530566466883d6478f7043b12a328645da36facf2bcb59653d98ce09694c3e271c7ef1fc3efec26155c69f05cec43dc5d75c5b0829ad51696b65a8cf1363df2ddcbe845a95c8715905dbeea06bf4e6b9c3effffeb83cae6a23f7859227030f0a2a2e16b4b923670a9d6a6b4240073ec4d94ddef7ebf59f1fc75838eab23d5954737e36b555a48096d48658ed5ce0a56eac20a0e7a72f89701bf0878ed19b1d18ad3b7d096130eed63bb8730ebef3caaecf5dd0da0b435bd80af2e161ad940b01eb45a897ea55e92ce5afc0b1ad15e8cf1e8b9a24edda78d6a47032215a62225f45faadbdd223ca14046fb37a4b1c22951e64e2665c92d07cbe722104a5d7fd396685c5c4659b242d7c66a3b73b7531468330bb60a820e71cc4ecea69ff21075094e39a5a1f39869f00f3437f439722b25d60c254d1b924b8fc6ad60e174b2490689f1414d5be7b1f3293d6707d68ee54e8c4c0ba933fcedac429770d618d9449b29e3c87baa219860d6b5a37813374abadbe606bb3517a9fe281e92d07d2eb45219e52379ec2d3715c7fbfabd6091d835310791542121f808552f714a86c3b09af75418ee6c58772c0601f8e4585847359d7f94eadc71c8a3ab4df8f05edd2f03ada2a0bfc059c9dfc72de8bf6077f3a57f1700a273350db55aa2b814a25c3b6037592bedc655603516bedc3f3435622af396ff1f2ec1483ee1936557a7ea1458a1b366c2fee933ff6b745cacf0e68dcf69a8db7f0bc2963a1bc441fff0c15ee294bd507028e3f9f35cff7a18d9ebc6bc223996a39d63234230b185f62e5a294ec3c30a80baee2ea4cfa7cd3dd42a62e2359dc1fa835df4d058559757014e641594f0a293d69875d4b08dba240e7d26f7fad6e68521407571edc74c484bf5b90299eba9f6975b3cf658186b7f14597c2a27da77be5f02c3fd6044fd30fb637f942d76a0eddb46c255c73f362098e26fff8ae73f9cb9430ab6a46f346925490aea1708bb27115d2baf5a5f61f9644b1ac3e19d115019c2463f5355c90c84f5cf2b88ea7c5aea7ca2462ae988762f0936fd6a35c3aee66d671f4d9fabe5f115b035d2d43d121e0c34f3c6128f549452d71a25af541b08bc79e31d818f25fda0f53229f32780cdae80f12616ef234e7db3379c36fc3e17b64e30f67f05104affe026570e06b8e03eb37a3d785647b857bc1f8cea28c3adc2ba15d6eff22aadb7b0db4e81e41bacc625bb4a93c94eaa25a697115b0b34925864b4a3671dac4483767521a078ea1d9b4074a625bb75ca672b8f0ebf38b588e2eaf3a3c8f9d0316d50061b7917d3961105ed3ad74cd3cfd0a20be0392fe4eac8f304ed38154ef9dd8d99e35352d9ce41a3e16c57d757a06ff3d6c02db3f03ecb4b43cded2fef28289d34b905170d7d40d80e3b5e0339ae5d3af0331a3ead7ce274f7759c240f49df943e5173242ff76d996d213673f44e385b5db577bf1983e6bfd041bf12ee21b35674bcc66f2474c29c4110f630ef9df14674592a959ac5cb63eb93de2b818f89ddfa80c824c29377fb64efc2be4945ad1ae3bd461d257a387d951da2c00e31dca05dc2e3bd27ace1b2258a238cf3013b872a8429f0ffee4300418f9c83ca1009084b5471cb24189c5bb1b41d8fe7980b3fa8aeb854064d40dd81363c2be9dff3a5ef52094fe3a3b787baab60f6de0aa45f85a3ed63ab319ae15e32c22e5e1223f636fc92dd067d509da392976c13bc20c58860c9e8842a43b391a8b8a0135d59629db27a145b5b6bb1a35c296c3448a442b50f20b36610313e4853389f0e9d1df15876e3f819e44f384c36abbcbcf1a9cf2f15811fdd62f2143ddc55afa94d49126256609ed066bf860a2fb3b877294c874811de2678e6bb01ff96e9f2b5e56d2ccf5ed575801768118ed52c445a8ac687482044670b2ffa9738f49bb8af5f05d2fdb7fa582b31af2c33b7acf7645118e6d60d270eb5d416c4cfa709498a93f67da12dabbabe9e7f4436587ebfd237c330a48240bfd2ea56cd5220c93dcad7882186a6b5714444f0cb0af99c83d4319c0322d97adcedb66dcd5e9a9d9ba485cb8fae178809107167563be20c00c873c8cb0791f7c77f5ed215410aa043a09732a5f728e9a3f61f7ac869b7643e6a8a78e8715cfb3f9d3e366f656c46099da1a8ba6e2e27045977161e791f900c6edf4f29d191a6c8e2e2e75415744beab69a7f33a282686aee2f16d38095a3ad4009411fe2901a60dd9bb1f343f75f92e0afb681304d28eb93b9cec93d4daa23a113105d5fe99d82f2629c6f871b092b8e2a2ef4d8cb44745e68c967b86f788006e7aa6388657703ec11f18f7df2ca8b1917b79da3ac6c5b73786057e5b5e7f8e77bea6ac6cbb3467089f26ae80484004f5c15cdc16ca713435ad5cbad24df028367f26beedcc3eafb7cb295d8adc9aab5b0e1e9d61686a289cf688347722780acd01ce613c80887e75371a8e5c875c620c18c041f895d2bd00bba83c96e8a87ebbbc6eb44af8ceff146ecfbfe95e34e1e6e20683a8a9cdee354b5f10ad663240441f13e5e5b81c245f46864513b4dfe2e92c58616646ead3633708ae6bce06fa6e76ff7a47c6afc8521e2b88c3935c6faa97bded26ca475cc494d655f7d5393eb84f27b8061008efbd4f8071c65eca8c0bf0478d433e1b777319ad8a632d7c61d37f95e1a59db21e7508d07341e0f21dd500a1cc9f904477a9ba7fbaf21bb41a465aeffaf81c2d5323e7a5ffecfb8adde5498b9c9ac31435de89b71300458de8b05d35dee15d3b2434df20ec038ed8e61994af023e924ff1c9aa8e64d75a52e0bce97c7e6fd154c76a094282a40cbb224a34dce03cf82c72666a7a8015488480df40230866049300636c90cb4929c556f63dd5d91fa20c134f201f7f59b29c78faa615331b5577a854112148ba86217b9cfc19f45e654a233ad4aa4565d4c0671e75ddd181e2bde0c1848c195870080f6e98d67108e10610c0fea4c7fe077a0417381ed3bcdac41a3f2b8b2d19586f135844f5099a7656a0601f36116bc725b880fd8e61a7afcc49a5e85b05cf21d8e608c7b9bd082b4c9410e340d9ce7cb5f3b1e7ffcacd469e1d32c9efbe2fec49be16ae6df4cc86d669ef0f7b7ad98e359b0feb1f8a3672f23a5ea48229c492fe708ba0aac19328a322b0ca5aa7e48c8e4661bfcd3559aed11010e2a16e91800ce45b35c3b64535898b4e70879ee1239b33e1f1e1489c705f34128c18fbc9554d79413b1d3ad3d738c9aebf2762193a52fbd61cfcc2a55d51c4de787eaa5bf35df7861843769c857e149fdd45986a3390ee7c6b5e5674e7e4c05b556207cdc236cd80dfb7d66754a0bd9b69c1220100eec3ccdc4d206ad7e11a7f90be8e2532e861e71dbbc67c8ac9f9669f3c38934b99b3326b2adbc2b79bb5e7e7644ac54aa90ee5d85ff4a792832f81ad96c7d3d51c475c08410084b7f49eb23b6c046d2aec5f8a6fd5259514a263b2091ee694692a020d3d677305d57693b9708141d9a41a418c577862c851e966540b2fe55640f4d1ef20814f5f4547182a803d9c88d6aa6446028b6cc69d267aca909d9489459b523e4b30bcd37288ac73f46f739a6b01807c6d8d7b0cb1a63dbecaa01841573efdd67719fe970efc6ca8ceac2bf0f1206b8f851f3a55f44f1a6f6ddd5604aed31ae00397b348f14ce81de25feaa52555da23584c9a4ea0594a2ad5d578505142150ea3e81edafa5503292b350a4cc657e401a1b56cc376ea303a9f0f1740c1abe207fc51d61cf4331e0b87e7f6beb5c636b04c6089400cdbd58a912dc91e86b2c784c3aae1d7657244b40dc6ee37dce58ae032794ae28ac7b49d57026a0be82f0397a94392005a2fe28e3d36383f037c8346034602ea5b76d7b3ef81ec09ff5c9b3f1ab82012949b8f4eb010fe072f26fc99a9de897aacd957fc6b590c183dc95c4b45cd59b364ba5944b94fcd80d304b101ac40fc42a9db78bcee6f4902d006106b9cf7c3eeffec05e240f364aa3fc7ca9e8039ac273a30ac37037590b77f37822b5cbb78e9260560fd10dc6ed610922f50a4badce8d17d9b59a481410e415837cc04a1e80baed56bd742d19fcd9dcb84502bddbbf613c403c3508e4e459fc22d01fe645aca143bc9a9b94a6b0a9eb832fb4b72ee5b9b08d3fb502052294fa343a10ea3d47025cc362aed99fa8c555432a73b99113577220dae7530c8ef259fb2672d53e421c4a547445ce5289df34916215370c01cc9549581cb75ca84d8b6afef70de09b985115dbf173a4737b20d41749f0f60b295c31c3ce577e4d424768304daaa63406f4b8b93686fc737059d54cc216b636e55c86d6262a0e336abd511ef682045d2b93d94e83d3049ed1d129367e4ffbf15d8654011112549a49e11b7eb1fd098f16e535b2c759ffe6762e47e84b7c981150fa1cff19aa565b47163d07b80608d4f717ef090c8181bac0fc2d5a45980ad99b1eb9335775a12f60c9ba1fb6a2a75caf2806cd26f7b7f3f660a52b22038b94f192faa36870f4f19deb8983593febadfa88326b55b3bc5777f2ac79beda8f275c970f60c0065e94cce6a63d58f59740c8b7a4c39e3807c8f4609a1531c99165b0bf4e0e7547326e948d6501373298db450e85f1c68c2347f4a0e66fc4ff91f15955b9befece158cee97a91041e80e7c525da772a03d4aec0b9af57b57e248dee0823e8e296d27aaf660834fe0fb36bbe9e3756aa999adfe7b22f1c15366b0aa14891f0846a2939484ab952ae20051154b067b4f021102d79cb9baa61c9a84b44cbc64fc68681b83b31be30c352117ce6d068e58940672539b823657cbb7da3372ae93bde00121becb3202d729b1d6fac86b6cdd328dc0452bed63922341652affb9eb87048ff33ff77e836ae6d9822df547a2cbb12f6e560ab0d093def6fe78c5c44ddcb369c4907d0b6f6cc3dd6b4a04a"}) add_key(&(0x7f00000000c0)='user\x00', &(0x7f0000000100)={'syz'}, &(0x7f0000000200)="82", 0x1, 0xfffffffffffffffb) 18:20:14 executing program 0: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180)) openat$selinux_status(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/status\x00', 0x0, 0x0) r0 = openat$selinux_mls(0xffffffffffffff9c, &(0x7f0000000040)='/selinux/mls\x00', 0x0, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) add_key$keyring(&(0x7f0000000200)='keyring\x00', &(0x7f0000000240)={'syz'}, 0x0, 0x0, 0xfffffffffffffffb) [ 482.127341] binder: BINDER_SET_CONTEXT_MGR already set [ 482.162563] binder: 32332:32355 Acquire 1 refcount change on invalid ref 1962934528 ret -22 [ 482.184800] binder: 32332:32335 ioctl 40046207 0 returned -16 [ 482.190982] binder: 32340:32350 unknown command 808482864 [ 482.201752] binder: 32340:32350 ioctl c0306201 20008fd0 returned -22 18:20:14 executing program 2: syz_open_dev$binder(&(0x7f0000000300)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = socket$netlink(0x10, 0x3, 0x4) writev(r0, &(0x7f0000000000)=[{&(0x7f0000000200)="580000001400192340834b80040d8c5602067fffffff81000000000000dca87086a5c000004f6400940005891550f4a8000000006700008000f0fffeffff09000080fff5dd00000010000100000c0900fcff0000040e05a5", 0x58}], 0x1) [ 482.209325] binder: 32332:32348 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 482.226837] binder: 32340:32350 ioctl 0 20000240 returned -22 [ 482.236000] binder: 32340:32350 ioctl 40087602 20000040 returned -22 [ 482.262658] binder: 32340:32350 Acquire 1 refcount change on invalid ref 0 ret -22 [ 482.278224] binder: 32340:32368 unknown command 808482864 [ 482.289927] binder: 32340:32368 ioctl c0306201 20008fd0 returned -22 [ 482.299310] binder: 32340:32350 Release 1 refcount change on invalid ref 0 ret -22 [ 482.307058] binder: 32340:32368 ioctl 0 20000240 returned -22 18:20:14 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000300)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0xffffffffffffff84, 0x0, &(0x7f0000012fc7)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, &(0x7f0000000f4d)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x8, 0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="137304400000000052b2c1"], 0x0, 0x0, &(0x7f0000000340)}) r1 = openat$zero(0xffffffffffffff9c, &(0x7f0000000100)='/dev/zero\x00', 0x100, 0x0) write$P9_RLINK(r1, &(0x7f0000000140)={0x7, 0x47, 0x2}, 0x7) signalfd4(r0, &(0x7f0000000080)={0x100}, 0x8, 0x80800) 18:20:14 executing program 4: r0 = syz_open_dev$binder(&(0x7f00000002c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000300)='/dev/binder#\x00', 0x0, 0x3) r2 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000280)='IPVS\x00') sendmsg$IPVS_CMD_DEL_DAEMON(r0, &(0x7f0000000180)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x8}, 0xc, &(0x7f0000000100)={&(0x7f0000000080)={0x14, r2, 0x101, 0x70bd2a, 0x25dfdbfd}, 0x14}, 0x1, 0x0, 0x0, 0x80}, 0x4801) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, &(0x7f0000012fc7)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB="0e630c400000c99617f90548d7139085cec8af0100000000"], 0x0, 0x0, &(0x7f0000000f4d)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000000c0)={0x8, 0x0, &(0x7f0000000140)=[@release], 0x0, 0x0, &(0x7f0000000340)}) 18:20:14 executing program 3: add_key(&(0x7f00000000c0)='user\x00', &(0x7f0000000100)={'syz'}, &(0x7f0000000200)="82", 0x1, 0xfffffffffffffffb) r0 = openat$selinux_policy(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/policy\x00', 0x0, 0x0) write$FUSE_INTERRUPT(r0, &(0x7f0000000040)={0x10, 0x0, 0x3}, 0x10) 18:20:14 executing program 0: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) writev(r0, &(0x7f0000000140)=[{&(0x7f0000000000)="bac1088202e3df3f4a243617f9e7297be480f3a18f665775347703e57727be914d5d08d11d391dc11d8ae2978d6626442c6e1b0dcc15115bccb7ac3cbdca6ac70fc5a0ee24b1e5299f19296c54cc95f12e19c8843b3f55d5a639497bfd27654417363311643acb9604acf4974ee904c0c14cab79ea5928d5abef809b88dea5fdb99e2542a0366c2ea7", 0x89}, {&(0x7f00000000c0)="56ae14cf0917cc70bfe1c1adcd073c8a8fc79226422ce59d55befa55a7d42bcdea4da4001362b287ec450858ea1d474911cb73e2fba69692247af29ba0f541052913733289f5c3dc4506b898bcd9284a46c16afc002a5125de3ace447d", 0x5d}], 0x2) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) add_key$keyring(&(0x7f0000000200)='keyring\x00', &(0x7f0000000240)={'syz'}, 0x0, 0x0, 0xfffffffffffffffb) 18:20:14 executing program 2: r0 = socket$netlink(0x10, 0x3, 0x4) writev(r0, &(0x7f0000000000)=[{&(0x7f0000000200)="580000001400192340834b80040d8c5602067fffffff81000000000000dca87086a5c000004f6400940005891550f4a8000000006700008000f0fffeffff09000080fff5dd00000010000100000c0900fcff0000040e05a5", 0x58}], 0x1) 18:20:14 executing program 5: request_key(&(0x7f0000000240)='keyring\x00', &(0x7f0000000280)={'syz', 0x0}, &(0x7f00000002c0)='vboxnet1\x00', 0xfffffffffffffffe) r0 = openat$dir(0xffffffffffffff9c, &(0x7f0000000080)='./file0\x00', 0x0, 0xffffffffffffffff) getdents64(r0, &(0x7f0000000040)=""/55, 0x37) [ 482.314323] binder: 32340:32368 ioctl 40087602 20000040 returned -22 18:20:14 executing program 5: socketpair$inet_tcp(0x2, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_SIOCBRDELBR(r0, 0x89a1, &(0x7f00000000c0)='team_slave_1\x00') request_key(&(0x7f0000000240)='keyring\x00', &(0x7f0000000280)={'syz', 0x0}, &(0x7f00000002c0)='vboxnet1\x00', 0xfffffffffffffffe) r1 = socket$inet_tcp(0x2, 0x1, 0x0) bind(r1, &(0x7f0000000000)=@nl=@unspec, 0x80) getsockopt$IPT_SO_GET_ENTRIES(r1, 0x0, 0x41, &(0x7f0000000180)=ANY=[@ANYBLOB="66696c74657200000000000000000000000000000000000000000000000000006102000053914c5c0e0d3cae2249d8ec02cbd40f42ab8bd094a35c5f1e87594b6706efac4b02000000000000004e1ace00e05d38d2c5e653c6bf6bff91a3ebb585287f92f0f104c09b7e67ad000440cc307e65eda7c1a6f5c7a7adbcbfb53a845cffd6b5276c"], &(0x7f0000000140)=0x85) 18:20:14 executing program 0: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) add_key$keyring(&(0x7f0000000200)='keyring\x00', &(0x7f0000000240)={'syz'}, 0x0, 0x0, 0xfffffffffffffffb) r1 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rtc0\x00', 0x10100, 0x0) ioctl$sock_inet_SIOCRTMSG(r1, 0x890d, &(0x7f0000000280)={0xfffffffffffffffd, {0x2, 0x4e24, @multicast2}, {0x2, 0x4e23, @broadcast}, {0x2, 0x4e20}, 0x82, 0x0, 0x3, 0x6c0, 0xffff, &(0x7f0000000100)='team_slave_1\x00', 0x9, 0x8, 0x5}) getsockopt$EBT_SO_GET_INIT_INFO(r1, 0x0, 0x82, &(0x7f0000000040)={'filter\x00'}, &(0x7f00000000c0)=0x78) [ 482.368807] binder: 32385:32388 unknown command 1074033427 [ 482.403401] binder: 32385:32388 ioctl c0306201 20000000 returned -22 [ 482.404445] binder: 32377:32381 Acquire 1 refcount change on invalid ref 0 ret -22 18:20:14 executing program 3: add_key(&(0x7f0000000040)='keyring\x00', &(0x7f0000000100)={'syz', 0x2}, &(0x7f0000000080)="06dd09005008be", 0x7, 0xfffffffffffffffb) 18:20:14 executing program 2: r0 = socket$netlink(0x10, 0x3, 0x0) writev(r0, &(0x7f0000000000)=[{&(0x7f0000000200)="580000001400192340834b80040d8c5602067fffffff81000000000000dca87086a5c000004f6400940005891550f4a8000000006700008000f0fffeffff09000080fff5dd00000010000100000c0900fcff0000040e05a5", 0x58}], 0x1) [ 482.404558] binder: 32377:32381 BC_REQUEST_DEATH_NOTIFICATION invalid ref -1765212160 [ 482.404646] binder: 32377:32381 Release 1 refcount change on invalid ref 0 ret -22 [ 482.405162] binder: BINDER_SET_CONTEXT_MGR already set [ 482.405170] binder: 32377:32381 ioctl 40046207 0 returned -16 18:20:14 executing program 5: prctl$seccomp(0x16, 0x2, &(0x7f0000000080)={0x3, &(0x7f0000000000)=[{0x80000001, 0x3, 0x81, 0x5}, {0x80, 0xbcb, 0x80000000000000, 0x100000001}, {0x3f, 0x2, 0x92, 0x8000}]}) request_key(&(0x7f0000000240)='keyring\x00', &(0x7f0000000280)={'syz', 0x0}, &(0x7f0000000040)="6370757365743a73656c6628656d3129626465766367725f9bacd68e0c48f228f8037f75702e6d643573756d00", 0xfffffffffffffffe) 18:20:14 executing program 4: r0 = syz_open_dev$binder(&(0x7f00000002c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000300)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, &(0x7f0000012fc7)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, &(0x7f0000000f4d)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000000c0)={0x8, 0x0, &(0x7f0000000140)=[@release], 0x0, 0x0, &(0x7f0000000340)}) r2 = syz_open_dev$loop(&(0x7f0000000000)='/dev/loop#\x00', 0x20, 0x100) ioctl$LOOP_SET_DIRECT_IO(r2, 0x4c08, 0x8000) [ 482.464808] netlink: 64 bytes leftover after parsing attributes in process `syz-executor2'. [ 482.467426] binder: 32377:32401 BC_REQUEST_DEATH_NOTIFICATION invalid ref -1765212160 [ 482.533149] binder: BINDER_SET_CONTEXT_MGR already set [ 482.553035] binder: 32413:32418 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 482.564973] binder: 32413:32415 ioctl 40046207 0 returned -16 18:20:14 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000300)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = dup2(r0, r0) setsockopt$EBT_SO_SET_ENTRIES(r1, 0x0, 0x80, &(0x7f0000000040)=@nat={'nat\x00', 0x19, 0x5, 0x598, [0x20000340, 0x0, 0x0, 0x200005f0, 0x200007d8], 0x0, &(0x7f0000000000), &(0x7f0000000340)=[{0x0, '\x00', 0x0, 0xffffffffffffffff, 0x2, [{{{0x17, 0xa, 0x8848, 'bridge_slave_0\x00', 'dummy0\x00', 'syzkaller0\x00', 'erspan0\x00', @remote, [0xff, 0xff], @broadcast, [0xff, 0xff, 0x0, 0x0, 0xff], 0x70, 0xa8, 0xe0}, [@snat={'snat\x00', 0x10, {{@dev={[], 0xf}, 0xffffffffffffffff}}}]}, @arpreply={'arpreply\x00', 0x10, {{@remote, 0xffffffffffffffff}}}}, {{{0x0, 0x0, 0x88f7, 'team_slave_1\x00', 'bond0\x00', 'ip_vti0\x00', 'ip_vti0\x00', @local, [0x0, 0xff, 0xff, 0xff, 0xff, 0xff], @dev={[], 0x1d}, [0x0, 0x0, 0xff, 0xff, 0xff, 0xff], 0xe0, 0x168, 0x1a0, [@cpu={'cpu\x00', 0x8, {{0x3}}}, @quota={'quota\x00', 0x18, {{0x1, 0x0, 0x61d, 0x7}}}]}, [@arpreply={'arpreply\x00', 0x10, {{@random="77f4ffc07357", 0xfffffffffffffffc}}}, @common=@LED={'LED\x00', 0x28, {{'syz0\x00', 0x1, 0x7ff, 0x6}}}]}, @snat={'snat\x00', 0x10, {{@empty, 0xffffffffffffffff}}}}]}, {0x0, '\x00', 0x2, 0xfffffffffffffffc, 0x2, [{{{0x1f, 0x28, 0x6001, 'veth1_to_bond\x00', 'syz_tun\x00', 'veth1_to_bridge\x00', 'dummy0\x00', @random="654da4864abf", [0xff, 0xff, 0x0, 0xff, 0xff, 0xff], @remote, [0x0, 0xff, 0xff, 0x0, 0xff], 0x70, 0x70, 0xa8}}, @snat={'snat\x00', 0x10, {{@remote, 0x10}}}}, {{{0x5, 0x2, 0xf6, 'gre0\x00', 'bridge_slave_1\x00', 'team_slave_1\x00', 'ipddp0\x00', @remote, [0xff, 0x0, 0x0, 0xff, 0xff], @dev={[], 0x17}, [0xff, 0xff, 0xff, 0xff, 0x0, 0xff], 0x70, 0xd8, 0x110}, [@snat={'snat\x00', 0x10, {{@dev={[], 0x16}, 0x10}}}, @common=@NFQUEUE0={'NFQUEUE\x00', 0x8, {{0xf8ae}}}]}, @arpreply={'arpreply\x00', 0x10, {{@local, 0xfffffffffffffffe}}}}]}, {0x0, '\x00', 0x4, 0xfffffffffffffffe, 0x1, [{{{0x5, 0x21, 0x88e7, 'bond_slave_1\x00', 'rose0\x00', 'gre0\x00', 'ip6gretap0\x00', @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x3}, [0xff, 0xff, 0x0, 0xff, 0x0, 0xff], @local, [0x0, 0xff, 0xff, 0xff, 0xff, 0xff], 0xa0, 0xa0, 0xd0, [@cpu={'cpu\x00', 0x8, {{0xf63}}}]}}, @common=@redirect={'redirect\x00', 0x8, {{0xffffffffffffffff}}}}]}]}, 0x610) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, &(0x7f0000012fc7)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, &(0x7f0000000f4d)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x8, 0x0, &(0x7f0000000140)=[@release], 0x0, 0x0, &(0x7f0000000340)}) 18:20:14 executing program 3: add_key(&(0x7f00000000c0)='user\x00', &(0x7f0000000040)={'syz'}, &(0x7f0000000000)="82", 0x1, 0xfffffffffffffffb) 18:20:14 executing program 5: request_key(&(0x7f0000000240)='keyring\x00', &(0x7f0000000280)={'syz', 0x0}, &(0x7f00000002c0)='vboxnet1\x00', 0xfffffffffffffffe) r0 = openat$zero(0xffffffffffffff9c, &(0x7f0000000000)='/dev/zero\x00', 0x40000, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = gettid() timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) r4 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) read(r4, &(0x7f0000000140)=""/125, 0x7d) fcntl$lock(r4, 0x7, &(0x7f00000000c0)={0x2, 0x3, 0xfb3, 0x20, r3}) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, &(0x7f0000040000)) dup3(r1, r4, 0x0) tkill(r3, 0x1000000000016) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000000040), &(0x7f0000000080)=0xc) 18:20:14 executing program 0: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$sock_timeval(r0, 0x1, 0x14, &(0x7f0000000000)={0x77359400}, 0x10) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) add_key$keyring(&(0x7f0000000200)='keyring\x00', &(0x7f0000000240)={'syz'}, 0x0, 0x0, 0xfffffffffffffffb) 18:20:14 executing program 2: r0 = socket$netlink(0x10, 0x3, 0x0) writev(r0, &(0x7f0000000000)=[{&(0x7f0000000200)="580000001400192340834b80040d8c5602067fffffff81000000000000dca87086a5c000004f6400940005891550f4a8000000006700008000f0fffeffff09000080fff5dd00000010000100000c0900fcff0000040e05a5", 0x58}], 0x1) 18:20:14 executing program 4: r0 = syz_open_dev$binder(&(0x7f00000002c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000300)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$inet_udp(0x2, 0x2, 0x0, &(0x7f0000000000)) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, &(0x7f0000012fc7)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, &(0x7f0000000f4d)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000000c0)={0x8, 0x0, &(0x7f0000000140)=[@release], 0x0, 0x0, &(0x7f0000000340)}) [ 482.607035] binder: 32385:32400 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 482.614351] binder: 32385:32388 Acquire 1 refcount change on invalid ref 0 ret -22 [ 482.614969] binder: 32385:32400 unknown command 1074033427 [ 482.614978] binder: 32385:32400 ioctl c0306201 20000000 returned -22 18:20:14 executing program 3: r0 = syz_open_procfs(0x0, &(0x7f0000000000)='smaps_rollup\x00') r1 = dup2(r0, r0) sendmsg$nl_netfilter(r0, &(0x7f0000001100)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f00000010c0)={&(0x7f00000013c0)=ANY=[@ANYBLOB="14100000080f04002bbd7000fbdbdf2500000000a5e4524859c9a65b504cea70658bdd6ac092f0963e21b94d25ba281642083d61ad1848712b26a4262bd871c77e59400b25a880d85d7d3aaf649a40422eace4d93eeb03326baeea2a9d1e919933b5d8d786ed71333c1886f1b127123c41d9346c6c6dd75c0add01bf331e20bd52467336bcb8eea7b84449919db2fc84211d725021e454e369c6045d6e861354baec4e963dea17804a65e7914c72a445dc8190f7a86d16c69e0047041faa991bf1dd7839ef8ab0fd1fc60d849a049b741d0a05e864e2090b4f012be04839a7a298ee66443ca248924af251f4a81783afe3afc6b7e9ef26eb4c3e0ed78b013e12d387521c51afc882985413b9bffef5d57f9a66adac2d86b2637a28f9450640b4e942462cd4b8ff3efb7af718f76dbc97f61c59b0939c974254155adc813b0cd811e0c0ada9ac4c47e8135d5393c4fa501bf886fb1e1b8ee0846b86779fd482cc9f7289af0fda340a0322a4b66774d231e368fd10b52620f84b8ed316a5fc779a0dd017d1359d33f3ae7ee8a177aa824b5427e40d687b37b3493216e516003724424401228ddcd0d806f77679fd92f058368572d61e2458c5a46587b52f7c29032d0f0a7d527431e9260a17cb0e82f0eaae4145be02aefb1ef59df095f36ad5d08651c32708c700c1a9b11fb8d4875e38543e3f6e02ef0334e8d71f42b229cf2ac8b0535f1fefd377dc9bde93e3b8eaf8a22ae10a519f68865a1edf65e8757ec884bd65aed7d1cb58c12e8df79646569d29a914be3b1eb8383d42020a8952a003a9bde339aa061d3aa6cad6b3cf4f43cddb67abeebdf014e22add804acb83732cd23f644c5c97c6e6a401f410151c93dad7ec462f9361238ed4a97df50351e437bdc1d3bda3a6bc5f1904dcf8d0cd12b9a34a32c4ea7d0f5e1a52a41479e87101a595330ab6e954953083e27b80574265d1261d3f0d910f3b86f12213978e2c240e0e5df9c4905894dd2b5738dd42b86bdc617c76eb2ad03bc628c94aea2e3f433122780176f055b3633f2e8e48efeff6eef9a2e50b5cab6987ad0f8e3fe7dc1825a3d47c591a6f4d9ad0686b2193aead427f0b68b5576eacac58a8fccc35b67278239ffd3e7dd3dbd61b63d195029c874c68a27a6983e99cd28aa5ca90e1dd1a59ec0ed6303de9ee8b90ed516184b0032a8e37ab210d0283b37074cd28d0f26a78b4a261b40e6117552e83fd9d8572ac373e973f49c159f2c638ed107ae2492a61cdfa391655d17d1c1d181be793a01f08cbc27462bfe9db541772675a3ae9117474e05e34dca6249a64f8db7137c4f77277a538d874398df92b91512544c9d900b7fb824f0224e1d85ad62d1a429b125e2ba889876ac00f8d0b1e1320e588a323b141fc3555ddc53cf433b2131e1e7ebaafca41f56d79946a152fe07daea49ee67925458e7f14323aef1b30c2db35b261fe270d203040129e9779f3a1b1df14b3228697e7df5a9cbcb6d6fb70fe1edd7c8fefad7f2f68821d1bd9657f902092253dfe96e53f5470ed95b1ad9291a286cc79a5e25e8f763e2ccbfef04064b999da4ad1e9d4f037cb3407d094bdfc48ce055748861a9f0603413738d59c050bccca16a37fb4c789ddaf2ce7c5e2453a0b58eec490806cf3fb2731dc543aa0cbde610ad54cc702c3939838501c6d78748fdb4b28b0ad78aa818b4652b5cb8519efd5f2c271bc4ba00bcd5e77ede9ec2b6edaf4c7109fe3ddfbce1e89698f3dd06fbcdb20acdb6ca17ed160c9c1b9dc45a2a7ffaa12ca480f81106eb81e2f237c39d15fc3432a676e1e299d1fe6c9d243d522c9f5a59cd1e5e559582e29c1d117bca38311bf9c4d544e20fc913e83f946bd3f0b5a63daa04a37fe382cc1254139e50646d9d9dcbf7299a5951d5056d54484d253cb4685d4354269907bbd0a3dfb2a34dc07e5ca3aa79be10147580bb0b2546943b68740439de423dc039dc9736ec1f1a5558703ed7bdd1ea408ced7388d58356d910d039e635b6754f678a6bf6093f867c5f5ce695b7f8b15823dd9eba4f66c98b6f759ca8676030d0578ed5fe2ed447eacddbe0e8fffaf0f43f03a3d31512d6c310b33153e6744ba6ff1d033168c3cd42ede667060fa19e73a71fc305cd93b7e50836bc448f69643c723fca3edb916885ddeef716ca9e5084a2a55f41aefb077989cb863f4684abaef452a93ab448c1d4b44a8c0b2bd402f86496c5ce475e74c0c99295d5de25a3f0fb1230c9c6a6e810790b8b766862b31eb40df44c0f495d087cf475653dcafd4769bfefa732afef7995ac69a07703285c03d993fef5c285be928150a4c46335bf5e80aeac46676efdb9e669bdf599af9d7739be851ea50e153d5b66c7098f9f70a885ff8cbb2953403764c570e51f11902880949452c0d9d49238445a7884a8a06c3a292847f413e828ae89195ba7dd3a1c375352ee8458d04c67cc512d037e8e5e0f6460afc67d1ece6d2bcf3ed932c8051370b3e6f7b0065af4b596c872bf63b7512c80ebde311cb18862f58e12ee660359b7133c9043f390b5799f2f8f038bd15b06fe4f0e173e954e8586fc2c6c1a7d93256028539542eea2885bc81dcca9816863ccca05108f8e806cbdb2e422401c98d68ae44691893d2d8c73976f4e44f1a635c7d91535814b236b6757d79cfbb406d42cf96f3f39d352cab8060c961ae810eb1fc93e03a1a85756a596d42c49978e250a70471d153b53eb0d2dd92c6bbfdb5d5cd57302abb30942805152e1647615da37d9d06617a884b819978e16dd70dc5047479091483135d2ce0898991e2117455e7eec2f7c5c3cd8575b99781706a37e3f71f8e9a1408b4f7a230753fb7bd19839e4069f9deef8436185b428aa42610979f36d640f53419a6d8f79dae341460b6be7b56990924e20ca65cee345f4d957e5f7747b11cf71ae699a2073429f853e2c0125c137e1c6927bfb47d36b3770c49e23e5a6732945a887fd668173b9546e215081fa28b64ad4ec171720a48fd6c7b22c5cdc7f7824345711e7e3e0fa40f7e4b2e09ecf5cc152b1ebf376914e6d318865cb43f3845f6df69c08f4faa1adef326e3dfedd443e2d24cb4ad5275bd857fbb168579610c6da437fe0f7d079b4175c96228b8f90286e804b4eaa4b1465bd1ce7b949fbc412352f1ccfda1aa704db5619cd5f23c991eaa7214e47e7aedfb39bb5dde9d952b5facde0fb26ff50b5388cd4701e26fca7425909b2880c816b6e43534746c6f2a4693870a744512ae6f56c3acd420637a79c12e2381a372d7a7e435ffb9d924f1b578c7242f90f7d483c367a4054c7898bd2cb7d08bec141f3f5ede28e349f951d95c1453e0fd87ea824bb85e3fc0177eedc610abcca38c4e5d54a0f91aeaba1293052fef58d240e36f9f44270406d34e1c363d62573c54bf13f36e2da1f240de2585ede581df42473cd69ebfb0e22960cbb360468a28653057ab9378ecd7d5da0ebe008fd8ae1b032633c4242e194b39d4a61a2ce25e976bf7bf071dbb3c6a2fb8fc667e83a5e51e892b68c16f31d5e8eda3b2ba2dac23b922494842d7ef78b2047818b5d87ef75d3ea33d2c2e3153d4dc318a70d66e6daae120e0fe71bc1204f37a3abeb26fe126ba33823c96eff5bbace00b69784c52d8b3e3d0cdc05834c0a65a4ab8b564b4e62c8fd3f8f77e9df1772b315fa5a0fb2eb77ae3f53f19552d905f5c2d1042aa2ea3de9f4721c1387e87f2b857dd8523988121828f9e35f43025c6bead5901b8ec041ccff793230f9c1e3a611e23b71fd562ce178cd920feed35b5d945968034a8a1d405ca40200faa05e53a6a1b34574f901e14f827e37784e94b89c85dc6bdab136db3b31a783c8229d030729a20ac887e49f991ec269c8f7e45c5996bf103a7e943ed1109b109805bd7bb9de8988bb8370f881c00a777cbc75663420ad7c702ac482d272fab335b84502dc5074e3b7cdcf9b9c3a68f3dc078132f99eede09ae20aa8308b66bbe99edf72e256364b63df888af16db5230180d9eac090b22bda08d1580a5bffdf1536b186e2e362f51b01fe7ecb1968daafc9e563ae4ce9aac4eb785c2e4d7afe4c95221fb85add9596013d91213b491ec7f110ffd2c9df03493ee45ce56af01af6df153e94051cbd860d13a1c88d1b715c415e65e91ae1a8ca399c9721dd851b9bb19ed866432aba073077ffce8143a71e9071a381b68a31fda9a497c53b93f62654bfaf6566ce9141b00b467cd9ed48ad08759bf8845da041b28c371fd98bf74b8c5bca81cd5bfb1179a57718f03498f2f0648bc3d7c2ae0c78fd5cf39ff2a08437f279ced6a70071fad40c119ff0586421985e00674225162b0a01de8dcf2c91266933f12f88549016e27c73f45219b77955376b2ca48833f69604a1e48b03b1dbcc059d9b52edcdfe9d557589538aff5cb83ce46ac2e8d90545c141be3e961862d29c611523b448d6f978433a0eab3d7448ce0adf48eff13939515a802aa4c995f1c787579f0c8e777be138eaee4c255c73b0b9ea505b104efa43313076ea98cf046450331aa49441d7cbeb2362d7e4a1b761a96a7dcd94351a6c71daa4cb8f9dbbf7216a08c3ba1fc1cd91b88ad6f872b09a8505724d61938cfabfaf1ad71a90ae977e34064af67ea3f4f4a1e97acaa6e9f013e9d0a6852eb9f22b1af13f4941440b3d872d47a71e6a3cef71c76aef28e09f0fab4281b1b8c60f4db923b88af1249f77a2721abcfacaa320a0e798148582c2daa03fc2d32445c38d0f04fa1f64e51f15f4a5601ba4ff17d4ac6c07c02741f0263b17c30892816fd8703c9933346f848d594e8ab69890e20baaa21a9da995dc3b5ef5bea6438f3a03a9f5f83a1cf73b14311abccf89c42acf0fb32c359370c268397369056fdf864d28ba0372d6e356a42cef6b6d1ecdc56c9a0b16a48e22a2b149ddef800c9df6196611bf7d16b16fbc86f013cec1c64b97cae97ccc908d8ec0f06d52029e7ca73891c371a60da1549f91c2f85a85354587cb20672868f687a26fecc0849305d5d279cd852c697f40333e93d7e6fd2e88836eb21fcfbaf4c5b1b7b91ae14ba63f687367fdbf9ec84605ce4c8441ccff32e92b01c0c1009d2d13c542b3dd3931da7cac9833147040048036ab414c789b6eb3c1a807ea73e0a8e6e8a2b1e908f1f2a7c75cf03fc2a110d6dd3b99cdec9e930fd8d890bacb826ffbcf8e64b5c0aa6f6fcac7433106dd96fbb3b385d588cff32e65c3ad619f446257c8c95ea3559e661f5a136507f1990e6dbb274157a2c5450f90b3a9503b03c7c17715b860a2d00f739b201389872a93c7e4fe26c67984d13028014f23b5d4cc4f0566f15cf81310dbc26fa302ce6804e65ffcfbc97e8fa58226ddf8de29ce6b4eeffcd34754d87685feb5c9262cdd56cacd0471026c6ef0f93551a236d3cb28bab0fc380d0169a053383a31ad8ba2163fca7b633aa31947e7f34a606070394d5b781bae27ceb7bee1f3f22c616f980b512a104922713e267c661762da0e6063ee50dd3070067ac679b500e1592e7f2e20042049c04345d1647f223c191051a0bc195efd4283fbec5c23915391ef6b0a126dda3b6f7063cb105762ebc8b3c9b8373b8686ba1b5c5d02335fd30246ae5a570d28e4f3926d63127b51d39c49e1cf49758e3fd3d902adc54c29e6edcfcf91211ff1cc510184dbba25a5cdbd1f6355e2bda3a47a45a3888b26204b6c2af0f8fd69b2268b1122e2209efe95468380c03e69b9026b9904ccde4c2a40cfb17062982e5b59f2051a350081156a4758df9e90a8ac948da06278570af4dec8f84387afbac4cb09d"], 0x1014}, 0x1, 0x0, 0x0, 0x840}, 0x1) vmsplice(r1, &(0x7f0000001380)=[{&(0x7f0000001140)="44f8a026b2a9557f74a7b3deaa4dc384700a039fb43cc594ea3928238c43d9e8efe252bd4c09c4df430d5d92f01856682be54dc6ce1dad166576ef8ada0ba41c6e5075df452542f1c8edf6511b774914ad077b88a775c18b859eee28cc2ff558a002eaa3b4a56f2ff9532f9bf01fde585153a6f7b91964d5ac89c850f4c1c726c12769dece4a2603fbb50af74b79cfb70f4a67168e6d49ab65f099643793d3a48d1fe4ec381daa08d48c1c6b8558c1977423c33f3f686ef91fe8b55ab00a520ee146d81e58a7bd38941d9bde6cc0cc2148", 0xd1}, {&(0x7f0000001240)="49ee171fc97739edf631", 0xa}, {&(0x7f0000001280)="2a0685a18949db4828d16ac11c32cf428c3daffb7b54a3fe0c", 0x19}, {&(0x7f00000012c0)="5fc816ccc78b7b4431a3c8d03c8dbf1c7cb0bd39a4e3fdb814772bec2078fbefd013b293045f1ec2227977209549eca45c5974ed2265f6d825c4e6423fb514c69a4aebe7aa1af4cdd52042eb1df7aa6c56f71f0a8d9097a55b1fc3a6da8ffae4428a2b7c7469f1b6485bc7ca6babc12fcc96a1bf3c52f8b9478d6112f9963337f5533c6f9946c9b84a1f7ee06e1f", 0x8e}], 0x4, 0x1) 18:20:14 executing program 0: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x101) add_key$keyring(&(0x7f0000000200)='keyring\x00', &(0x7f0000000240)={'syz'}, 0x0, 0x0, 0xfffffffffffffffb) socket$key(0xf, 0x3, 0x2) [ 482.661096] binder: 32427:32433 Acquire 1 refcount change on invalid ref 0 ret -22 [ 482.673515] binder: BINDER_SET_CONTEXT_MGR already set [ 482.684129] binder: 32431:32434 ioctl 40046207 0 returned -16 [ 482.691018] binder: 32427:32433 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 18:20:14 executing program 4: r0 = syz_open_dev$binder(&(0x7f00000002c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000300)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, &(0x7f0000012fc7)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, &(0x7f0000000f4d)}) sync_file_range(r0, 0x9a, 0x2, 0x2) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000000c0)={0x8, 0x0, &(0x7f0000000140)=[@release], 0x0, 0x0, &(0x7f0000000340)}) r2 = openat$keychord(0xffffffffffffff9c, &(0x7f0000000040)='/dev/keychord\x00', 0x400000, 0x0) ioctl$UI_SET_LEDBIT(r2, 0x40045569, 0x8) socketpair$packet(0x11, 0x2, 0x300, &(0x7f0000000000)) 18:20:14 executing program 3: add_key(&(0x7f0000000040)="75738816ca", &(0x7f0000000100)={'syz', 0x1}, &(0x7f0000000240)="808c34a301f28e370409b4868312f99f017db64aa51db8a37cd91adcea375fe61be44c67f55173349b8c19b0cc8c0a3b6438596a1ec4f4d2722e04004b7b270363b461a7e5a8c15f48ef15e3b1892f873f49aaf25321435e3ccd530d42b539a22ea17014f6aa4243cad63704b3ac0a51a6b1f11b429594419129089e6169fbaef200", 0x17, 0x0) [ 482.705421] netlink: 64 bytes leftover after parsing attributes in process `syz-executor2'. [ 482.714347] binder: 32427:32433 Release 1 refcount change on invalid ref 0 ret -22 18:20:14 executing program 2: r0 = socket$netlink(0x10, 0x3, 0x0) writev(r0, &(0x7f0000000000)=[{&(0x7f0000000200)="580000001400192340834b80040d8c5602067fffffff81000000000000dca87086a5c000004f6400940005891550f4a8000000006700008000f0fffeffff09000080fff5dd00000010000100000c0900fcff0000040e05a5", 0x58}], 0x1) 18:20:14 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000300)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000012000)={0x36, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="92a0ff8c873cdc23c58af355f646d51ad4337c5265cc9af68d4b509c3f9cceecbf110324afb69d656b890029d29b2238d11ddb62b2e3"], 0x0, 0x0, &(0x7f0000000040)}) r1 = mmap$binder(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x1000002, 0x110, r0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008fd0)={0xc, 0x0, &(0x7f0000000040)=[@free_buffer={0x40086303, r1}], 0x0, 0x0, &(0x7f0000000f4d)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x8, 0x0, &(0x7f0000000140)=[@release], 0x0, 0x0, &(0x7f0000000340)}) 18:20:14 executing program 3: add_key(&(0x7f00000000c0)='user\x00', &(0x7f0000000100)={'syz'}, &(0x7f0000000200)="82", 0x1, 0xfffffffffffffffb) syz_genetlink_get_family_id$team(&(0x7f0000000040)='team\x00') utime(&(0x7f0000000000)='./file0\x00', &(0x7f0000000080)={0x7, 0x5}) [ 482.755536] binder: 32427:32433 Acquire 1 refcount change on invalid ref 0 ret -22 [ 482.771359] binder: 32427:32451 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 18:20:14 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000300)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="0563044000000000eeb831c08b011e11211ed53bbe3beeb860915bbf139a6bf1f41bdcdc4a9aa4c302c08f91dd6da2d6f629478fd2569ce5cae79ef0916e7e9f6e64b35265ceac6c12d9b03b5d2db11148a4078e6cf210e36b4f8f9abd2914ab7b38db548b3e80256ed8710ba77fbfbc6171fad712ac3fa65de3d675d39bd32128fbb6f9e150461afc2ace42d935eaf44f78b576216a3df38d774fc4841facc3bc5c80dcd0c9809f5da8114f224a643b029dc24a46b053b780f885753d19248436e8"], 0x0, 0x0, &(0x7f0000012fc7)}) setsockopt$netlink_NETLINK_NO_ENOBUFS(0xffffffffffffffff, 0x10e, 0x5, &(0x7f0000000040)=0x5, 0x4) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x0, 0x0, &(0x7f000000dff8), 0x0, 0x0, &(0x7f0000000f4d)}) ioctl$BLKPG(0xffffffffffffffff, 0x1269, &(0x7f0000000080)={0x2, 0x1, 0x1000, &(0x7f0000000f80)="236e760ed2e51ea0004a9fd513c2e9337b96a232796e11ee6f927c3796c7ae4b97896fec796053b0dac4fac287cdc873088c3cacb13f1e2e95305f0e30721cdae3d06bce445b00fc4d79c4ce875615a191424106ba491a9d44b02a487f827e8ee3a89f3536f3e132ab621a525a2d4e9a21561224d36c08ef41fa7d91945908cfcb25faa22162dd9ef25215d150312cedfcdd2fbf6df75810431fb52c2671cea4f2b457684c6eafa91024e52bfdfc37ed3fa451cbc28e59c6ee1c0e408894bc108cc9fb515ad4f2199b3617b47d281f99099456c5d12f4fa28b4914d07cbe312dcaa24a889e4a7845a985d05b98f7222542928c865bd456af6a10e03bb1e96418616908e683c2aee55f8deebc57ee16bd685865925b5503dd25779a9c189cef15fceeee207907b37f1193bce0b329c637202de0c69af1179362685f4665a3c802cbf0e442b62838ec16cceed6c612418c640595b502e03851a934e91be763a50449ad7e03f1a29c5e6708a373768cb584c65e6276e7e655b22dad7590704b9f4a4ef126205652601d8a59398cca719c4199b63fefef797b5e55474ae0b816f206c4508905df95b23d1d3cb98e353b469c81de5ea48fdf0f88873a046c82e8fbc3757b8074914c82aebd34f22915bb110f755963f1dfa6248f58370504738f7912c9cef5b600e1197874276c4da29a9993dfaee06bff809453d91105e64d8b5dc09f3249cad7ebe0185725d52db0bbc4ccb63c8143ac1fd15d844541318d8b89d9d5e26790190f3b3fe04caae9f97671450e17f392005f510db2f5e3db8ac13969664751d99739fdbc3172f93d7f9d0fa26518e242326d2dc6a0b301d141ab9765fbda14689b2080399c4909fdddd196219bebe0f77103910bf1e3403a3a25d74d0e354adbd63b973077286ffc5e38bea7d68b9ed85f7581f54ee9676affe64c80120585834aef75c9d81916d236ceb783490556444ef932f6ee48843910b3ca2a45211495977111baeaa28c5e99d0821c1988a053e1993bc3a83ac687831e8add3570fc8554bc4417e26e095535a07d75f0f88d62ae59f15d97295392be703e8c4737162ddaaf2aa478bf3d03e284799c64f0fd0b5930b2ce3566665dc26ccb5196b18edc179f386c949bf9be5aac24936e2ba839bf69b1c688f51c27a82aa33ce758a091dc79a5fb9282517cd2ace67cfcf2ceacadede967cc11aeaa27e3b6710c6dff6604e1528d538f6f58bf5768ffbe606d6fbe9ffea5b036e52199cde7930f890c5aff2583a39fadc4f463005cf87aeffce4ccedcef999d66ed5a0263a8998bbcd5500986198c23dbf2e7c4073b086a8ba886383411efdc134fe35dbd20131c70948e7ea589aff91bbfac5c6389089a797fb7ced233f685f32fcaa391bd10e3fa8f6a641b7c51ce1c791f91f5f2393745febfed01b9a5e2c4ec16c27a641c57afd6cf761960f9951b889ce050cc06ba6dca50ce937b2de7d2bc0ecde47ef18e5658e58dbdf6f03288f7b18d37b41aaf9a36d823c2f91a4999f6d4ed3bfed6163e2a91ad9e126eef443bfc141bd83eac8c49f1270cc7f0c98699e08306d85af45bda5988e06418da23f5e66ebb06cad8eb0ac85d63ed7d294c0fce349313de225f0877ef9dedff25b20df980b12f5ab031b0cba5132359882894eb59c6ac23fcbc8931ecaaaff6b9214ee72afc9a0a27bfd00c22d5e024bc30e01d913a66e8a9a1056a8e4bddd6707be12cfcbfc6dec12bf7b4c78f64a7d40cbf6209d1447c6d4826e36131e9b67d75b903569e1f25cad17086b283706af844bc77745a0712819f7aadb7399f3b375ff849024abf0471cbf4c662a5885571d8bc83c983051e17f3b74161da421556bdcc5916efa6178b8394628939f88aacaaf1299a2b0b1b1a77ef72ac75311ffaeefd50dcb48b0e6efc691020c36794f4187022f00cd05ba01f59e4f3c15453f4a9b4c2281cdd176ac5116d64b5d3ca8f4ff01cb313c461e3c6ac84cbe43d272cc531aa908dca0698a5fb0f030c066d50f82c8093b48fa4d4b94f885604cc5b8eaff5bfb9b1966b50e787580083277111a3c3bd12821d50ea1e102e215bab191ba1cce59411364cef80acef5a78a6e144d2858dfb65f0cf7f86cbea0cf1c95f841342ef67c958e36c3b94f5b050cb771d6acfbb770f379ad2a0218a1cdc0f9436eb2c808eaf52619e3a15a2e1c9297b5e87334606225dcb75165a637bfc457161218508f7529b9f9797bb7623a5d0c81876786ffac4009a121afe088e059bc69725ba932f9c6442511927cc74561b23e4e705cfdb40d0e2ae45cbef2991cd0cb07cb55073cc038ab97a6018887eff4c26b0b882a6a71e5b7db3ba9f2b5bb6064387018d54773e73fc2a9ec047c50e86c1239a1ee69f63e034b347a89d256ae5b18ce440ac6bf33c211eba66952df595d2188078c6821c8ac72b31104874abf195179a3278295cf63bf4e67d821ec8d4652b700178b7ff68abf7f89c7d4877cc9352cc164f1ab0a0f1205270fd205b5188190eacb613fd55afe56d7190604784985c51fab801095f5ab2bc545ffd00bbd516f8bdbae5880c02a3a4a3eebfaf99e74fa42005cd012ee76ccb11f2d094297e20938eea3bcf08d7be7b2ca80d5c5e4dc189defe09e9db6b9291b08bfe60840b539d3eed26bef5e1cbc6ef0613814273dd20080a8a4542ae931c2e84a1e73ee56d008ee378ea2b8e60bbd1f2da8445f9e309cf624cbea9ef022633d913d652b144b09bb86f8248ebeb9d3b3578d50965ce8476c3719dd2dc9dc3787c04ca6f0e21bfe44d8cb7a34b8b03ae37e971ea3f96dab89593a9875fd898a5c61c3f3b4195244d563c8b40bcd879a261bf45f59996d6108f42be880e96f70b9883a5c8b4cfe35fdacecf955a40b8a875b97bd9f18dc8c86e5c8f4e3d274d7e04b7d169386c19748cc551e37d7ad0dda00b162c6d91fc9cdef122779caf82ff1c95a0f47c7ccdaf95f69c80b5b356c803bc30184cc11ffb58432f3b346ca43b7d737479c91d8d00de25a4cc8b8d1cae8c8b92977f27d41bde4f985d3ff77ea8a83f9eefd9a723263a6845ca58f906882ada1358606a7607d17f1871b339e6df87d3a29ccc7242f48372d6d0b4dd1aa43964da7d886bd7e0382cb1d35213b80191409cc9e06b8e5fc7a4543c28988ced0a39017aebb37223b05117711dbb939c1d373598aae819716fb3ff273b0a77b3f18c2272b2432288b484a0876b4b98b1677036172933b5bcaff332e34b563f94310369575599009fcbcdfae0b404a74dd67b5f5df281f69f4a7ad746797e4785e2b0a97670c29e819de9bb9dd853f862fc78df7b47dd937544de59ce7f954c00378452344738931cca46a79db1083443f86f0dc8214b6dd61f5598cf1091ee349bc5081cd61b183511d784ff7f37d16cab9d4777be77e59ef1665b9af0d4ab6d6847d9762f7dd728f34b973d27241b0958bef39188f3f95033a087e0303e569eece421e06e5641410e7d5e4263568d9692a9f8d5d1159ab506e71293af28f2ce15129310a7107398ea1cf702df34c7019ef167e6e7fc3255ac9a7c95e1d98d9666a17d2f8ba4b78bce1e5dde39513e40c7d7eed3b772eedae836cd9c72f886de3a4c79abd5adba792e3dd60f810eceab98fb626789057d5e1c8361466bc7b2ef2748659ee4cd4a9c22f3f2272f02141da211ebfb0ba50fe4be292a786652066a22326e79122dee22b7f36668656690d493ed5d07043a986deb89ebf1de69b0aa0d74390f45fa03cc229e93d5f66e0ff2ec7d2e3088ef8f950a73cb027a40158177c1b9a519bb04c49023ede84a83d3c7f3093c45f2fd2d6d2f9fcc4ce08dfc1eb598d7306298ff519362dbbc5cd469d412615deafdeb671f76a339d9df70051a223541680db53179049f34529b1dc1aafda3f26cb7ca46ae012fd7500bd5cce1dbb259d8515df403d4b51c3fdfc8a9156a094e49a1dea93b0ea4ef02bb440577b5a255673f9f5316f7aa0a2fa03b0a182ed7166a17640d722d8279fea81dfbc8e4aa664e2afb392daf23f48ef20f53d0165ce100870e4eaa40122b3d3196b61599c4949e3e2e2db4796eb095b40f136dda584987acc7da8e25eae6a1bea50ac1d7fd44a2a014ca642be66a900685a797256cc23b913c895e4709d51d443df3f2a395e39ef327611d7ec601a36662b301fa573d0172ad2059a2f9f25d7d86940b4c554d837e8609e7a3c72d7d5514c1e47dc350f88bd06f0ea73c21fc5e4b1905991a7e2406162078f70ba2a901b0eca0b779bcffdff34432ef503a3527368b29e2c72a21ea8ef349e9985d0e7416ef15a0df43d2cc5abe37b46ca55c6e366795f99bf9ac9fe31fa7b85cf7525948eaa821ae88268cda5459fe1a3da948a2f92f3ab1e7bd8a8afce79f148559337f1f8aca4c915e3a5d50d5c82bc9e6587f95ca71938c7cb53e9a1cc89df0549e7fd78ded78a85c011d0915eb36fb339e3add4dba44041f35674108cbfbfa77b08d5093cd3a64cda81d62e6e79d2cd657c964deef9afbb708dbc8bc524931041f584b96048f80ff44031c2f46a93e77f56cccd53468c05f2f60dfe84d095267c41e6b27f8a95c41be16f3e5619fc90bd715cedf58b6d296f28f9c81ad4b02285a6e3e0572c75b070385ab2afcb20e1cf927326472711ec6bae4b7e456dd4874b90afe8e332f0d2d1f17fc12d9b5e54d8c6025a4be780fb66bbbbc519a80190220d81a79f75786f787f702965ae226c6c25e630cdd631695dbbe5358f9327cc8c71a4de6d33d2eaf87c1390e176664813ef060fb3d1414e2ac2e61359ae45ba9af01950fd3bfdd2e4b6e7998c1a790bb9893e79d3042dfd7eb542400bff566ab6e9852fc14c0be1b7332d96e8b45eaa285bc56354e33888fb8e14b021aec1c1ed5bb997b3bc09b72c5477618de7d86629ad56dd56aa92dbf2d71b7858df74ef27708da973d8df07d1709fef5d333bb110ccee033253d4bfc56887b2fcbcc2fcf817eacf43c1ae263d38bede38b725856665e50d1ab66664e2e74a329f0fe55747fac293cbbaf729163eb3e6ade592ac60b5d164ad370b28bb318ff9fda07233a625e44a3680f708b86daca538dcc8c674d49dda384758b8d0db87ff991fd9b3877bf0f1a868a62e6892fe132b93367940f524430be0d5f192e7b1b12a66464d8981e1601ca80f6e14d5a6615924030c9e016978e9bcd5c6d116b1621e5b909f9f4833c193bb8795cb23fbe222afdaebf4e57c78dbe0c7e38a6702a7873009f1e21a5471071df81c2dd19b7133dd4c2748e7b860b1eb84d50a15f643ea6ded214d272635b4e02f53edc2687a2cc892add3d445694eb319d25d45812bae1ddbb6b9e5d62ad7d8a0af419b96f62bce8a28798e65d8c8f27d1fb3fac38402ccc8667aea1f465612c65aa413a93e9d32f665ad14c716d958c0ea1f243c37b6420b0fed466750ee43fb260a2b70e513f93030a50212dad6a4a96631b235c679e9fe4e6d57b4f506adf7c9f02a8e36cbba00a945fba13718b95411dcb4104481ff1b820af0de0775fcb3a6e212a9de4d88bb1f148cdb2c489da4762acf9bbf0a5ab426191fa809ee622b4e46423f161040c7fcc585790197c424e550b0598b75497c675c98c4e9abaecac0609df8e31ded791ce1e9290843496c22de14e4f5207898e7176237b59caebe688bf1ae825e6478a7ab8ca0f939e2deae092f02747982324897580407b55a95d1068bdc69e00dc703127e482a0e10609c3d564cb7a4ed90778432261895d1a9a9732b5b506cdb32f1"}) ioctl$EVIOCSFF(0xffffffffffffffff, 0x40304580, &(0x7f0000000100)={0x56, 0x6a6, 0x0, {0x76, 0x3ff}, {0x2, 0x4}, @const={0x8, {0xfffffffffffffffe, 0x80ec, 0xffffffff, 0x800}}}) ioctl$ION_IOC_HEAP_QUERY(0xffffffffffffffff, 0xc0184908, &(0x7f0000000340)={0x34, 0x0, &(0x7f00000002c0)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x8, 0x0, &(0x7f0000000380)=ANY=[@ANYBLOB="06630440000000003a4605e94fd2985fe172c7b7ed5979fa603d1cbf5c6c1d68c5b2fa0290c1a02b43ce39a72f9948571fa0b0ef616457d3"], 0x0, 0x0, &(0x7f0000000340)}) [ 482.819484] binder: 32459:32461 unknown command -1929404270 [ 482.825538] netlink: 64 bytes leftover after parsing attributes in process `syz-executor2'. [ 482.829309] binder: 32459:32461 ioctl c0306201 20012000 returned -22 [ 482.829715] binder: 32459:32461 BC_FREE_BUFFER u0000000000000000 no match [ 482.829780] binder: 32459:32461 Release 1 refcount change on invalid ref 0 ret -22 [ 482.830347] binder: 32459:32461 unknown command -1929404270 [ 482.830354] binder: 32459:32461 ioctl c0306201 20012000 returned -22 [ 482.830458] binder: 32459:32461 BC_FREE_BUFFER u0000000000000000 no match [ 482.830506] binder: 32459:32465 Release 1 refcount change on invalid ref 0 ret -22 [ 482.886937] binder: BINDER_SET_CONTEXT_MGR already set [ 482.892648] binder: 32450:32452 ioctl 40046207 0 returned -16 18:20:15 executing program 5: r0 = add_key$user(&(0x7f0000000000)='user\x00', &(0x7f0000000040)={'syz', 0x1}, &(0x7f0000000080)="0c63ab4656550e7068e98bb3e6221a992d13cbde7a6d8cbb1de72b063919f6d9047106f245c96c9fee31ec7e51f2914ccef29e3e6ecac96ba5fc7a33f0587b295d", 0x41, 0xfffffffffffffffa) keyctl$set_reqkey_keyring(0xe, 0xffffffffffffffff) keyctl$get_security(0x11, r0, &(0x7f00000001c0)=""/10, 0x8) request_key(&(0x7f0000000240)='keyring\x00', &(0x7f0000000280)={'syz', 0x0}, &(0x7f00000002c0)='vboxnet1\x00', 0xfffffffffffffffe) 18:20:15 executing program 0: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) write$binfmt_script(r1, &(0x7f0000006800)={'#! ', './file0', [{0x20, 'vmnet0'}], 0xa, "c43b45cccf7fd46f3017fc3997e88f4510c7d41741051704bd4bee5aa4b9c5e3f41a89b9450b493f2a77e797bcb8da875c8b2b460a72bbea6850a25722397a1063baabbb3e17f8d319c1615ccba16aed826e8694bf57719b030b4e8cb041571c8411e5c0e2d503137dbb1cefae195799ae9926ad5f3e8e79a2bf946298f62f7b2fba5f8965bb5b2743c3e9da54bd558f11b1c977365d89f3c3a6ab06713f8ab5f01576efbcfd7645a29fcf792715b425bacc8fc22fd5bed342dc7771355fb792458073517f8ea5f7"}, 0xda) r2 = dup2(r1, r1) r3 = getpid() ioctl$TIOCGPGRP(0xffffffffffffff9c, 0x540f, &(0x7f00000000c0)=0x0) getsockopt$inet_IP_XFRM_POLICY(0xffffffffffffff9c, 0x0, 0x11, &(0x7f0000001440)={{{@in=@dev, @in=@remote, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@ipv4={[], [], @rand_addr}}, 0x0, @in=@dev}}, &(0x7f0000000100)=0xe8) ioctl$TIOCGSID(r2, 0x5429, &(0x7f0000004900)=0x0) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000001540)={0x0, 0x0}, &(0x7f0000001580)=0xc) ioctl$sock_FIOGETOWN(r1, 0x8903, &(0x7f0000004080)=0x0) getsockopt$IPT_SO_GET_ENTRIES(r2, 0x0, 0x41, &(0x7f0000003b00)={'filter\x00', 0x27, "6e3223371c0a45930b33775c124eae99622c707815a9d7dde6e520192f47251e75c5ec8d33bafc"}, &(0x7f0000003b80)=0x4b) getsockopt$inet_IP_XFRM_POLICY(0xffffffffffffffff, 0x0, 0x11, &(0x7f00000040c0)={{{@in6=@ipv4={[], [], @multicast2}, @in=@multicast1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@ipv4={[], [], @rand_addr}}, 0x0, @in6}}, &(0x7f00000041c0)=0xe8) sched_setparam(r6, &(0x7f0000000140)=0x2) getsockopt$sock_cred(r1, 0x1, 0x11, &(0x7f0000004200)={0x0, 0x0, 0x0}, &(0x7f0000004240)=0xc) r14 = gettid() getsockopt$inet_IP_XFRM_POLICY(0xffffffffffffff9c, 0x0, 0x11, &(0x7f0000004280)={{{@in=@remote, @in6=@loopback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@multicast1}, 0x0, @in6=@ipv4={[], [], @local}}}, &(0x7f0000004380)=0xe8) sendmmsg$unix(r1, &(0x7f0000006540)=[{&(0x7f0000003bc0)=@file={0x1, './file0/file0\x00'}, 0x6e, &(0x7f0000004dc0)=[{&(0x7f0000003c40)="b5b8ce5d34272f2dc1e443f5ab24a85ae14eec8a8c1a707902b6138c73d4a388314167825aa2c7a1522dfebd25d8309c1d4c260370cae41a735cfc48fc61c2c417a0c30ed1c1e7f7c2c01d120aa0f21688e57fd690882473dca4b4467890850a8f693bb2025fe019bc5e257e4d8d00052fb358d1d410db87ee892d8940ad98c7652b32a9f5a45f5b129a017e27ec21ddc4f49e39e48b1e2dab6bdb9f94a6c0527e90fa6549553b842e5d3c01", 0xac}, {&(0x7f0000004800)="2d4fa8a648eda281646a873a9c5f84a638e2e0bcf83b57736120943e472d54eeccd1ed280bc64b094f2d59dc6b00a82a1c73df3250311044d321490432c174131b13bfe80283be6301f6e5bb5a2a4e485f25d9c1ffe290deca413cb70935b8c9c26f270a36203c118a38f4734136259aea6735d7a1c589b996ee8041dd65350c42f7e7feee06112365b512d8cfd16d0e63ca65e3f520ada6e452a961995f367e8c4a5002eab3e4ba87a5aa2d9519c4309b575171652f4941e5fef91773754312b22e1a25d476cace979e2980e01f44e4ecc9389072a3eb6276ca315da56be090ac34f46fde12c6fa4de2222358", 0xed}, {&(0x7f0000003d00)="bee851a706ed8a6358d627dd2d861edd6cc8ff2bf2067f3095d401bcf1127c82075424f9a9fa5b8ecb1eaa7c5efa59f3", 0x30}, {&(0x7f0000004c80)="2a59ed6fba10eae2b57ba54e67739b51f4c47f45aedc706d34a2a29c62de9266dec037b3160072c1cbfeb24a1a75017ef1e77a72ed4018e92eb2fcfb626d32cc7108650bb84cfc6573d4137b4bd5f6e7841d85cfd674b6a96c89ea0e0381cf884e06e9eaa82e5c", 0x67}, {&(0x7f0000004d00)="9862f4674a03484becdc8132f623fe8916e651de0564a569cb4eaa7f862e0502d42de2344419ae3612e2117c6ce9a0d9bac11e12e943dbfe809fc3439c12858b4719cc43f4959d80763e6c20c49de6a6b850e00239ef3b013d8706d6d2c77a59072da4a74df80241a0f9bebc0dff352df8bc3ab8", 0x74}, {&(0x7f0000004d80)="378e12fe40fc8a6d56be0c286cd503b22d51e698ecf3f9800a7e1282b2bbacf6ceb9d5e27c544c33", 0x28}], 0x6, 0x0, 0x0, 0x20000890}, {&(0x7f0000004e40)=@abs={0x1, 0x0, 0x4e22}, 0x6e, &(0x7f0000005280)=[{&(0x7f0000004ec0)="59474c0cc94862eee06f8ccc28157237445eafc39a0e9f77691da8c6df8afbd757c753858d37a333454eeec5ac60d96dd9e13baca12802471dc21ff24b698f1f03cd93146d31152b766002d880172ebeca78600dcfe9ab7e08263305cc0950dd7718b17d29d85f4676b8c66387faaa19ebbb", 0x72}, {&(0x7f0000004f40)="ba9eef525b4f50cf72246d4a70e02ad6ff54ac8647c0e5a0873936b1c4ddefebc0545bc32bf283a3919aa322339d6cb713c6b3ab671de55bafe4", 0x3a}, {&(0x7f0000004f80)="3360da9085baeff84fe2b5265a8163673b944ef22957910915cd5781cff8fc3914fee39ad0be5787fbd728f8207d371674da9f4e63ff4bea4c1f99b91c4cadaeb2f19e9d9c3f564d377023e6f89badefcd442a009785147d0f407863b4f64981257a92e726ceb6e09a7fd2a746070b451aa0d51790a7cc8e1751c03b19c7f5", 0x7f}, {&(0x7f0000005000)="80e72a3f92ac7848b21c1bea57bb96b752f09076e26fb7e37190176b90710235b60a94f4bddc3fc210332d2e308b435fbf1904207f86181a803ef790f66146647a243bcc784329cfc893b3f615512f124bb50673e639df6dd59e499824f3dd6915e502d67b0e96c6ce8b3068928cd152874db4bca6c7733d708012cc99453126839e64a5b80f0c87b0aa5963f2878436350772b9ff09a686f59837d7ed4c08154e10103b40d5e4134df64413940fbf9f45", 0xb1}, {&(0x7f00000050c0)="b2ec247b4e66644142d4fd1a93f02f65393b26", 0x13}, {&(0x7f0000005100)}, {&(0x7f0000005140)="74280cf8cc42448c4e4f78101ca4b5a8ad25fb3de63a50297ca546ce8b61", 0x1e}, {&(0x7f0000005180)="ef7c389e1092a3ba92c8d1b84032fb05c6241fe89942627885e50b961e951c423501bd1308830623bd984700e8e894431b731e191cbcde1cf990330f0271b3dc7dcb7e18f975634aa867d8836b718ce04fde6d5f906e3d284df8a57c164e5849e7d39b1e57811a6708d62fa2008cd851fed13b4dfc2336052b2ad665be4c66b7084b9b2a1079367de716ddfc4afae1f399a03c33cbbce2d9cc3f47c05d8ae44bc35affe2e4db5d7f7394825ac3451f30bebff0d3f7c4154e5975f919058247cd77df15a3bc968301ba859a872df5d772feaa6099", 0xd4}], 0x8}, {&(0x7f0000005300)=@abs={0x1, 0x0, 0x4e22}, 0x6e, &(0x7f0000006440)=[{&(0x7f0000005380)="2082fc408c197252d5039c7e87323cdc31059f6b9e081de44173ed663ecb593e49fdc79e835e2e08d2d316095d671a9e92bbc0f13677486fdf667382e8e42dae981e9f28e2cb44cf33d49e5a535ed13d93e17f3f9b96", 0x56}, {&(0x7f0000005400)="4573b69e313aed5c72f4e8064cf2d85710b3a4e6af55fdc97a0f1e8b77b7a68024f6fe065cfd557a0e33be430c509cfb67bbc55de92d93b0bbf34a8c58476f0950c2cbc4df92eee99dbaedd04ebe68ecbe552f1fcd557640f74a0b2a7a86245259ba40534b43fbf44c7e3e5054ec2aaf3d7e3bae5d1e874e3b283551d9964f430a75f647defef5bb2f1442b12a7525378cc4177938a419c88811cbf0bf82a9c486f71455fff0b2e2e1481fb5a3cca506c45393ff5cebdaddd02d55a47fa0f7880a0a0f38863be262269dd6428c5525f99084fea27fa13e5197f40bb1176eeda818d07c1d0f543e19e0222532784c458a7256a2e7212054fcf43f5f1b013f6ddb2ca0e09edfad21b6a4fd24f54343fd5ec52cad06c7ade0332bfe56dcfa20e1558fafc3378a6ae8c69b334f50867d7dcb9f0c8f4169d5823a85a55153604e859db87bc349640ceb2cf7bbdb33219b63e22869df88a2fb8c7e1cadbd5e832a3c346bd74fa48218fedd187ab57db75bd503c0b84bae917491f399c8948da99dd3fe4a5cd5bcc9c5275d7ede28c12a2b94207e57711a7ee32a1f9294d28f18e17d70d2b7d490b0b58c2fa5855bc6d1b21b4a01b9c3d138d9bdf22aa1a6aa9aee8f0005a6376e5cdb5e6f5f2bf09bc3b05eb779de02d44dd494585b40a3588a5acc040e34409525805bc4ec1f2101898a6d9708b22aa65cb4c40626c92caca6578dfab8ccf97eb57840d6f835cc788e54157078ab2712dabbde26550f9c2c132885714c2c6a796006f7ddfbc981b50b02f3b56b980d2b5128fca4878d69c799f55ce43e21f4746f176da1d9ae871c982f815a3b12ce221aa1a0cdab3757710c8323a955de0710c38f58ff7305b40a515c814de70fbefefa80e279ec36052d345edbf9f9bebea8abe6ee9f26570ca0dd45993bb910b9bfea5d75e350c96a81099934e4e34a1c51ad6cccc7da8065214d80ce3cc602d6a1e626f68379b1b0d64cf6057504410d0f1534cd0a7069f2fa96c49ecd7e4155958de32a9a97957dca3113f3692c7025e0d24290c46d9df2cdceb09159c926ad79393e48e4d5b70fe084324ff38f1d072a970f96a54e467ed0784c5d524e4bcc56698f5611034eda4c1986dc1f7b87e3ae4ebd1d05c42c522882392215f54acee91b9e578ed1077b9923f9aa0b85e8b61d7f8f42ddc6adbfe214df7fcf3ae1091694c31462e038c9895c050aaefa1cb0aed03c5844cacf2c9bb409e2e8d503e5cfbea3c383fdc9e2ae2b33b111fcab464869e3467dac3c878baab2297b068900277d2d20744477ab6cee63e351b67d5a1eccd6896c9f2cfc8b1c6d7c5c4ec2d2be4d39ebe97598dfe84b89b4391315a659bae5040efe2f2e673121fac52d50f09e84a62766d305f69b9869c3e92954fd1f5ab541a878c057a8f5c53472c09e8aa3c4fc622258402c0aae4c2064119db75e2ec66eee69307de1939f7d50ad53ee40035401c047f4f018bf084c63f885ba2832c7feb63cf4e99efc783d56fd7d5c3182e31579456785dd824f3e304936dff469766344adf30904239091b3bdb08f12d1449669a6f3596639a1da389c345fbf8ed59a0d98adb157dd71758359222f8a6aaf62ae5467fc40c33a7b2e15407d45d5b581bf4c7e7eedb11ee81daa0ad697716587ce0a160421810796679dfbfe6f3febcef922cc94439b70bd1f6485a075c06ca334a3f69d080f4016d23a55d3964ea5395eee29a33045cdd69c48d114a1d99c5ef144045c62c50d1bf384ecf89c8472464ebddfa6d4e131a47df9e314e77dd0989271e341614129aa17bcddef371090c43da2bd61798a7c88e766e83f9e842449e79f1907cad898148192ba630475d05f72293aee86dd5dd5caa44e1b480c5c62964bbabe1bb1f0e169c6235e2e7313a783163835548d14a90757f7af1933b15b38fcbdd48d37728421d0c5da262168eae4af24c3d2b297f32884688ac84fe4e69e5b72facbdeba91f10b3dd17d4887b526dba7907e79e54f7179e42998e42d4453c6c717a2e75c296e0660275627b3434e7bcaf8190001d6d149a7129333534eaf32eb55f148a61fb83b143471b118b16e04d0915212f129ebd52025913912293628d0d7ce63f7dfd3478f1a7e8420190b2ecc900615ee88227d851476caa5e68ac6684c9537c5835bfb5301e0be063c38be6e6e5dcebd85f8d98f9b3c71fb7a39d681a6ad033fb69cfd0d41f98388334817cd8138ebd25e42d18259e7ab9c36327820d687f0a046ff1fa26e76fe4e04da56a262b4e1e562a20751c7222bd63500c34242e3a0ae78baa40f55dedfa1a0c5697a9e672db4c33174bf06dd7a232832d9a03c83dafffbecae3e91bc904e9a23924510f6431b108f6e676e53605d00fb8e608512cdb71699a859d8930f4872f146cfcc3b32780fe61e9572f89bbd1de942d43032bada397305a866a168cd60e75de4433362be2979db6b9f9e2013c606d50010558c8e1f3e2c5366fb47bbd175b5a7be88ec4c1489dd1e278be30cee242132ed110dac56251e7bf55462999f09575bace806f4e4e7e19cc8c14d613be02e5c777e9de48fc04eac25eae2ab5a696279b2ec7ad9dbfe6e11af1a95e17a784c7330464507c6e32eca1ede59f1ebf4121ef4b7b8941e40e2338aeb4697e076bd9703a4dd8bfc1f7ff689d7b2ef13d8be24bccd602996dfa2e3adda0329893fdf70447600423655ecd7c37badda95526cc8271ae0afcaa03bc9879d18f2e4e6dd5161c2e72484d7b2cc95e16708e01733c3b5122776be6d9157730c456b806eae1a5d03aeb699dfacf8bb946086a2cd0d05a6e3caae02bddb8f71b5854e6bbc5a58af22edf4af35b6ace8e826d53aa2ad657f893adcff992256ec4b298b0e983dcd49a5e516ba1aea04754e3f275b69ee1a4bed13e47d9fcc300e28a7b049d1f5ad4cf48e25ad1ffc150d79daffcf40b0c0af8a6fc7d065e1743e5ffc0be182393a4816e35aad238d888f343aafeda844dc7a4535ce2943684340e983407cb15d5eb42b7c3bf01993e41348f282cf9fe42cf4d1626384d6af1a33fbd22d28ea5a64d1bf0c16c693ece3dd31633671a10c60a930495f8408d745bf6e17e40c0e73424f17bb27aee942a93f85ec1dcd3a88400542a74ac68c2879eec1b89c08a45975a755c1a031637de73653aee530eae84d828ab871e70e9eb2d536b789b87b6d4a8881e3c59ab0fc6c4c02032071fe026a4ff23dfe831e9c2400494527d0c90232784d415176a7f2fbe9fb939b7c556809087b1ef4fdd8b05dfd110c5c109d3e1f4d06c84c57824833d177f60898a7b639e0afb3b89e888b9cb32e8da105a540c0153b188f05fcb94770851bcd809629f8c33462f8e48a42b513734029d30edb32ee87f18cf347bf5d97a282234ad30c0946ba206122d1b55ca561aa2e62fefc5caa92b6f224d383d50415a62d968b640c514c99e81534a59cfe7213ddafbe143ca7ee370f42b3d2f624185f02d91e2d67fa08acd967911ccc95851ccd938bd18ce5e2cda4694582b151a1b0cc75c6c81642087f587fd3462ac13a7c3824105a2dc383cceec6d4e6622d83104ddc254494646930ad65d67a840a65f4e7074f4f632d3617c2d535eb32066751263e048cb745a0c4ffbf07ff65082f66140a2b70c50db631b7d4a9d06bf25e97af291da3e50217b4cb0a3212b9e957c561c5f2ff655bcea363ed55357384da03c843b30bc04a501818282852a59299102a66be64729da84b1c13ce8fb703529b9b93c1292720016c6f2bc077ce863f53cbf53f8058fed4e0ce801fe7c3d67f60796e13beabe61a5986580547c135012087afcfc5ac2334a6460ca3bd35d039210085f49a8e82dcbd6053abf613e0a859dcb4367ce19377439cf3fb7530158708ec6c78b8c65e4746527b1860b6ac23ced9b6cf2b99d54f1f45eb6cb7235b2571eed93170045d0ce250f79e1aa5d045681d5c4f6893ab1f90df96a87fb909f682c222909054a5d480dd4efeafdaf3be045aca9879340d0740f5623cef36b9b61597fef278f34fc52719c6725ba6a2a9e8502b97682c66e5dd4f7b079f5ebbec783760c85d4e5898cc26828a7935bdca01d49145e5830d8ba18fc01b233ca026358d80cec76ceebc9c48f4c32c8dc910afab39d1e0762de84ec3f174f449457c47eb72ab786107b18d7f560bbb9bf16420661faed3d3e7fea95f83114db74650cea11ed9c888e1852d8ad14e58d1a91062f50f602688167468b0a712098db562cba3b0c03fc39cb4d8666ea9571a92bfb56bea69d46258143a6a25feee65cb525165641adc7ce66e38347a9108b6966e0320acee6e17f3941c2503c9943ebd3048413b89b7629b58f9f770b374143f26c4164ef31c75377379e923d0b0007ca38a792193aebc3c8c5fc0c9a967b17035ee3aa7591f3c761bb4eeeeacd48829b3f7c4766f2ccd9597934326f68ba9c4b0d47f87af2b8a846f5aa25c6dbc7f9c0ff040d81efd2b23d18a6097c0812b6b073a3fb9f093d523207470f1c52f1eeb61bfd9c9dcb6e38ee2b358f6042ddda00bde0ddd7211d32fab157bd48b7f3f75f52c64192a6f1e24ff17d287d5b6e051577a3460824c66302ca1405960065c2344acf5b73887468982e394711fe08fcc092ec0e231193d987d825986566c2e9af339237ea814bb7db29b92706cbf2366ecda00342ac7ffb18cb544d837c7d9efb86f8814477cf0f4b0f46fd0fadc74e6170cfc77b86b4adadff4ecf2e6e4899c4712318f06b97bbd7ec5f40283875c244a7d41484c2c840b5bd24b2c81cdc2d6e124c76b185d7c49596cab8c0851a5cd91d05314de03d8ec26762aeba5af94a04773f60f1704d15f054da8a00b47b03da069bbd852520b3264c6ed9c86f63ae2809f383132e4e29a4b393ae34c6bd2c8d4b1eb7131081dc96b322f5f9563e9c918423ed53bc06a6bfcd197054ec03d0976c9bdaafeae7ca9c58ed7eeab11570686e5fb0327ef3a22cd74960485eecf6cd3f0e5c798aeb52fd746d5086569260b14f5a16b5b9221ef25fdd86541f15d92bb5958d2527cfbba26121ea4bd240673358ef8dafdb2a884de178692300871ea52ad7ee93bcf93645c619c81d98792d7b1bbbdbdb77b08feb24663954a00774851b2fd9a64691290f8e9eaf2f0e952af75afe15c25c912f343904ddd35376331d901d1b5d9305011657e707521460fd515d30bddcb419f30e51de7de60baeebb655dc1ea2c8d3c44d8ef7079500cc354c8198b4e870e8f989224909703376670d0ba4791516e5afe4f3928e6b8d59585bf98285a9dfe9eb45cae5825ea3f279a9e98c9ee01c545d9c69e2d04c2cd5d4cfab7a2dba72ad14d342525976fd77d5f40c59feb96fd125a963e655c33a3d9302cadb9c27e7b3d98e3303cd936420931ea21d3137d2ec2cc05a1d264e4816652be1f72834170a0fbd1f999f45a9e755dee6aee7b2663e3d4261f70e6998c2cb6964865b67181591648f0d2bc6269539c06729deed6f51385800bccb901789b6a817531a6ae1fe6c52b8b5957b1144f3f8976e40b23247a9fa8886884a40e271ca162161832ca240106d44f6a51962d26e2124ac448161b7e25d210cdc2e95736ce96edc7a3a74bba0accf1f400ad310ed10a62d77b0c1aeb6add511164c60e489598265fefceb7b36afac530385da2265513ad065d75ebc42b879afed57fe06e0d95a8e1f3d3244a276f3f394c730bfeb6b68ff52db25c351422c2ac8eaab9fefe79f7d1cf78975e94d121b2c7056bade2171eebca9b45a8ca1390d13c", 0x1000}, {&(0x7f0000006400)="7429f70ed4e79abe9d9ca72025228bdd1c7bc97131bd19668aa9e74406b2a4fb43e9", 0x22}], 0x3, &(0x7f0000006480)=[@rights={0x28, 0x1, 0x1, [r1, r0, r0, r0, r1]}, @cred={0x20, 0x1, 0x2, r11, r5, r13}, @cred={0x20, 0x1, 0x2, r4, r8, r13}, @cred={0x20, 0x1, 0x2, r11, r12, r13}, @cred={0x20, 0x1, 0x2, r14, r8, r13}], 0xa8, 0x8000}], 0x3, 0x4000) r16 = getegid() r17 = getpgrp(0xffffffffffffffff) getsockopt$inet_IP_IPSEC_POLICY(0xffffffffffffff9c, 0x0, 0x10, &(0x7f00000043c0)={{{@in6=@local, @in=@dev, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6}, 0x0, @in6=@ipv4={[], [], @loopback}}}, &(0x7f00000044c0)=0xe8) r19 = getegid() r20 = gettid() getsockopt$inet_IP_XFRM_POLICY(0xffffffffffffffff, 0x0, 0x11, &(0x7f0000004500)={{{@in6=@local, @in=@local, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@local}, 0x0, @in=@multicast2}}, &(0x7f0000004600)=0xe8) getgroups(0x1, &(0x7f0000004640)=[0xee00]) sendmsg$netlink(r2, &(0x7f00000047c0)={&(0x7f0000000040)=@proc={0x10, 0x0, 0x25dfdbff, 0x4000}, 0xc, &(0x7f0000004000)=[{&(0x7f0000000080)={0x18, 0x24, 0x400, 0x70bd26, 0x25dfdbfe, "", [@typed={0x8, 0x15, @u32=0xffffffff}]}, 0x18}, {&(0x7f00000001c0)={0x1278, 0x20, 0x2, 0x70bd26, 0x25dfdbff, "", [@generic="12caa6cd362c40e1d2ba60a58cc659b3a02f51b91a70847fe656e98f2b2cb71808e60fc6f9090a8b87bf73b0ee50677ca92ad6368540d5eae97b2325f8620d4752ed900ea00970df6db6da41c6fce11ff8277ee2e3e9285c4ed26168889c1dec4bd683bcecf8eb4b197990957ea2aa11c58aa0f6844a3915908776e1e3578f21cbe80320eaa71f6dceab9ebd24e10af1ecf77dfa79cc2b4e15f38eeb2495da1199f0264a045b11567675591659", @typed={0x4, 0x12}, @generic="0ec4c645dd5f31de171a5f7378f9aa40690e5290174ad5e580342f763a572478498da5027c2d9178692bff997cd84f09cdaaac0dfadeb3d2cd53d892e751b6e0a5d4272efc46fd7ec4389370ef87a6ee53a10b54a85dca4729c8e0d713bf8ab800f9e3a9630b96bfd30940580ea030509528b742590bed01c74d884174f124aeb4ee61a0f81aa1ca289101f73f648f71c428a978b2ccc5898615cc77c735", @typed={0x8, 0x3f, @pid=r3}, @typed={0x8, 0x39, @fd=r0}, @nested={0x1028, 0x46, [@typed={0x8, 0x74, @str='}\x00'}, @typed={0x8, 0x46, @pid=r4}, @typed={0x14, 0x48, @ipv6}, @generic="8d2c60bef2c676c7c01bfe870195cb3d2f1eccbeb3316545269ad92f939ea244f9946b91bb99b2f6f67f2e19c072d271ed229166e066de31d7947cff520d92570d5bc9b547114133cd28a757ddb2aed746d6ef91b15662e7a8836b8454f29c5abbe59f060d75813542324830f193514bb786459213895771d1d01681daa5def54853eaa9a07bfbb414f165488d184fdbb3ba763df9a06ddeeb3185090c0e07f2f9c2803920b131d581737c393f8c62444e81713a731f7f03f1c968e786d76dc25207716fcc1fef95fa74308eddcd5fc3a504c4f31f2c5dc165371ddae4ab6f2cc91022ea7c73f2ba52b30f2d71a1bdd42bd23f219711a6d6c6869e1dd9e9f09b95f7a811506caeda6f0ce7449af9ec1b9eab18ab95758262c0ab671801912b4ae0d92f91485327e98f60af6ab60980859c89b6367abfb99c9d15ecfdc55f30f652f7147d5d5e6058fd03e391f3e1f8b7ece86d63a66e5b468edf7e1ecc36c9083b82bb48acc90304ba3237b6a967a13b6880abe5e36da7604d5d92bba9eb3e92b5c6d8d6aa5d5f3df206008dbb32c9573fd6f8ec26cd0c731e40f1ffc5666759a85e668337d8543fab3e0918f15dc4e898cee9af3566afb099ba07ed29c7325197ef8dc5e2d0eac72cb9a940fb466226c24bea1bd3d7b6ae6903b5889c7efdb059cdbc074c2a1a5e89b3c05f4ed5cf1ee1b871c2e29715bde3e3b5076cd5302e98547bb8d363d72f5ddb5315e50f769e5965937747cbf69f8b1893cb15327238c888e436425dd2aff412d19ed73f0bd4f0212bcd4d7e66050ed3552d0292d2457d6b3337cfb17bcf5b4d38fbac9af7457f6b20024955e444e3f4cb7b1587e386e34da660291c361b628d677fb49874f82607406e7a110e2a9e9462cb554bac9bcfd312677e95639ddf7c77522e7b5c2cb5472cb93d898e37d26e06529a4e8ad7b2088b40fe6800da9cc597ceb1733dae3097ef18d99abffcc317c35d0b8eb780ce37d4f625b79cf1e2e2ebf8807b13ead8dd82a04f3a42bb97433b84e5d93baa7aadf58b96ce8bcba0ce4c43a1ec59b16acf0bb5a8ba0906900fbdcc6d56c8c9e061f19174146c96305f1df593cf197fb0098eeed75367c8f9c5c3daed53d1c9a5cbd560973660f114bba7719975f5173c8d7b0363a01f38e712ecb54a476cd5e5120ba8413f39b8b91d00c6cebf66fe17bd8cca4975884155f96b11e59d368d3c287d716ff82f5450cb38667502a38131fcf83cd6ac7ef6c7c9a66811dfe255d1569989c2a1fa9d8a4dff19d4d5d14925860a8c26383200b3cb793cb15f72af23c9c48a189ee18c3ab500f934930577bf1f6b31af59ae8fb91be463057b7c7930ebe09ce1dd9e7a2fface6cc5acc920007a1cb764cd17ea4e749e94e4be0ec8b0b0b42cfeaf7734c197d0f6b6af307a8073991b58a342a90b91cd11a90846020fd152438efcfab5459928af2a323e6197c91127f823c40651384c47bcc620b16e3dcf71bfc11a9482a206be204f7993158fe6a8374de5c9f5ca4444f096254fe5f894c82e7dffa8eba8723b8b19654d8e56d5ee3f56fc1d9c6e256c9cffeefe529276602e20a5e51ca80f51215c3b90f2d0a0c43c6698bb6de4964e98e73a6b0a15323a99a85c730898687da81db4d276fd24e60828a70871e07b02aba71a4fb458bdd93ea1078d4eebc726d6a9a4f21a44cb0edffde2c581063116801719e8c46680954ee574111d209a98fb7a73a381715a5aadf0083c0f91c523b7724899f312e19b4dc76af766c6c7cd1040eac310dc6af1b58de649a3c8ea6b454186e3830cb39883597ddf6fa2607f85e7b6769affe92cdd4df9bdcd08f7333de1b20c986bc037df9515a7e93c31cdc2cfb0f88ef0de1eab027db2d7bd26eb975cfaf3400a1b7d77c3188698410de5314948901ef1ae3d8238838fb8a974df9153e345af7fe84a02aced2d7db963b83bb57e9f08e1814eb395e99eabdf83fda4f225e05bc83037fb9c57ac7614562fc38eff77f9851996dbb9e04486f54db2c414f299e582a6652641e1602671a749c212a6320c4123064fc6e35d87bafdadc40d37e11b97b63a070f513390ba6ca61824994ae5bca25641cddb3bdbc389ac78ddcf45f91afa1cfca88e928a0faa9af988bb6d1ffe9f08d47fc81ec2e002792c82f00e8cd467828f961921ffa3c11ffe4ab84603ef3e62f132e936fa540565fa0260e6617a9bcb0a7cc828b89b74bde00701b286b5232404f77f641c87d1158bd09860a9421ddccd23363f49a8b4dd9bc8d77b66da267420ba6d23176653b7ee774b586171343c397dedc829e0589e12cfb47a0ec0a7e16ec7b33e65c9001f7e5c66edddd7524110ce296b41b19ea34d1d863a7042706884e0664c76bb5946c6e9dde5708e4e4713da61ccecf830d8cc2a6180efbb70e5bb235e7dcf4bdd4348b111f9c483a25127f4ac0006960b1e09ff9d2ab2bb5cf2a09fcbbf172708058d538fa36018f73cfe9e41e4d4434131c92cb046431d010245a3b1ff720511564214d770c6ddd7ddaadc0d160a8a06d923d0750a5358e34780725c9a2730ba423717337cad83858c486643065795ed01e06ea5e157bcd549bb12b8d7ba7dbe2b3029a0f5c5685170ec6feee62ae354e2567693a83d1434d269b46dd9073413f91e22ab5b871972a9cd9e9adcc678e5d89fa4ede5574a9e128a333abbd121149680c4dc4de6cff78676836e9c7a9697c3ef2f54f5debbf5fe438d800129679d35004711c7448bbfe82b9d66ff8e84a18a8f0f7afcd61fcbd18097691a7661d8c12caf6f1000d8057392a850db37320419f8c75019db46d156e6109358df8993b0112ee0f9f2e2f2588ff84b42d46e57cb938dcb882979aed2f5dfe2c7da21f60645bcc696c9e98327442604d770194fd369e946e4b2e9e426a48d3a94d00838cae65bb290a20993eb56d1a5ec5494d6d366d06218394fd9c75923a11ec9e04265dfb0b49ffc52d8d2f149a442e66418b8b4ec96c0f3647026f0b48db1c62c5d80644684207da497c46883d56c7dc9531244d668ae4bc57c64dbb7d59430ccdee0daff8b4f60f315a88e525bf25645dff49d8277630309f3fb7df6e88a244cac2394878ffd37fb98c3227acdcaa9dd4438fed8c277a16a00e0a398c17e65e13c8f02db67db6e0a5c054e6d6093faceffea91e12a7ed1a7b9733a45e6b6a5385283755fb42df02e87e224107bd40a7d2de1cd9769513b634b7738f645c2fd2db41db571723c1777c1c1ad57accec00bfac330a63cb65139cf3e4aa3a3d3234e5c97847ae20b68553a0b1b518d402bdc2641ca8485644bfffc348a2291bd145d996426f673c231308cd7659a0875620a110c9290f6f7bdfd551e76a3481748f8bb5bcc8c5d5c9ecb421b02fecb973ccc058151da51d87861eb1736c51efd9c370b8b2a77531531d051c4ca1ebd2c2a1dcdbe4e80e1e30b363cd1ba462a157015710f1d3e783ccc557adf6a6cdc126e782e02992730cc116ccd01778f53d4febdd7635aa9334a911414cd7e3e7587f74abadb33efc1be260c1ce638892831b40e6480ae6e2e104dc82e30f7a9e2614c3dfb42b2ca5492e9e62dcb6fa412a43ba7b32e28df5eaeddfa4c77149ff5d3469eb8442d2f6d485be24841591772222f98cd26739fb73d8e57ad61e79b7fda062768555fd593be513aab211caea96dcabe8c3870ab7d77473d578b2cd664652b6b292df1f27f9d3cdf0382b74762e397581056c85826bfe040249a447a7bb93197cc24441271104683f2e6a83c929ca07497ecdc036af3e10b4c42e9dcb17391720a725b8d908c650a97abe86c3d870c6c83ac6e021fdd36e4082e1a5f89117a89cd25fbb4ff6ba03c7b6a94f81da23fcbf993491e48ad71a83136854dfbd19d52d01b3ac3587e0f0e79f08454d3a654d52b94dabf3f22b23cb4aa39937b7f769303020326d1321941c4ac26df3306aef9608fc942c88c8d81aa4f453c6fbb8280e0b206eb560019dddbf00fd61e5ab4822eba20940bdc53b7e797afb9aa6cf12f825e089d1e88e448cae8a7ce51251359aaddb4130284ecd91cd0329883b3ebf8a05ad0d9fcb8db92b5908271986193df89de9e632f9614fda1b0da631622ee921b41fd050f78f9af7f6f3de84e9e078d2f519e271ed965808f0d37367dbe78c7b562706167b5f3dd3fd7647a99c6d02ad63168cf4fc1bdf2e2fc45f1e29f911d78163c65faddda8b027fd26376d20936e49ab259119d36e2587d695f90596f454c4a6d9af6c00e5cc067fba44a9809a9ddfa928dd98a4f61d2430e4280fdc421947a15bca24b58ef0d6ff164a9ec94e7a321407b629d8793202f1802f2a17fdcfbfab7fa0ed9f85b8322de98116d7959e43a5b3935e7152dab5a2e855e15a56f5d61aae15232e86f9e1f20d7ea5e7b56b031cc37ad6b511378c29189309e620e9b5da808a6eb6b19a48c75443cbf5a9f26c8392e88d9b32709ca2f7744df004b23b60e0cac8a785d3efac74c8546bbbbb98fe0b4429dcfa711660abdc255c66fe38f2632e56f1311a2abbce0a3487c05ff260deed9aef34a696cadc8dfc531fa57c824e76c8ba0c1759a44a8d479f7a274416e6324da1dff2546fa4d1ca769d65a29ad2369572129c900bafbfc30cd0732284dd78ed8cc5b9fa943ad17dc0a131b3987221a3f95e60cbbaf4cc98c6a48ce027c3599d82f611d28ce7b752375620d9ed53fe602da03feb52835a4326d786f4418ffa780822991086fda6aafc049741efeb4b845f58e1d30ae012cb2ead0043821ea04046e9d1ad7b39c5761f27e58b3579e69c7ac16bf9ea1c590de97c29e659f7094346c1568e9c9e400bf403b512cb48f2fa1b78f1719a04dd2f9622f05444a19e8ff4260f4edb372b977763e19c12cff3d27e69a8fb8355ce2d6ae714d97a328b6d1482fe1d4433f948f401c5fcf0009a7b540a8daebdd462a72a4bbd9f62c537d8188417150fd5bcac20b13e472477edb1e8a9d6e632e48eb24359927f950cbfdced8b036003738ba74f78369a38ab58c81b60c320423dd73e806e1458308d7e3d83178e352ad91eb5baae35e0a677712746432e1ef8c444d7f5a5afcc0f8e6dd1de532816714b88f1478bac2dcde0fc0b6dd42918cacba7273589e4406acd73e07a6c8d22c722efff0d37e4a19f5c3355cf37c0c0c3b5c88eb4995a0982eba3cf15bcd45d7a094660fba93bc565fae4a8d8ff0384782da527a182475ad66ea7745cf62e9469efe627768c091b0259d4bd06fe18014c59ed035cd266fe6f8da6a8e3a5e5c204165fb44e449cef5a0491422ebecbc561980ffef2e67e599fe88e35adc4a720a6322262bbdc871e702d8def6dec63b399c83a1867ec4a2c527891caac59c037920f19eb19418284d2c363a10df7a5bf3e1db80367af6aa7691646380cb2078e0cc03a2a5e25ea9696a75638499a71228fa820be2fe1f25cd6d8c512f748979db3da9ecb755b483a9e4613efe46ae333b6310e85d1baae210b46de88d117cecd53ac4967d8773d7cc29c717d3eeb28482783bbb6a38a181c74e8f9c65be11a4da87b180fe4d573475d815bd17f559826d0d45c7d4872ad8d555072eccb620f9a822ec8913c38d4274611f2f6cd4ec929848cab14d486cf9b29a29a2ba6e8ab933b01cffc3b325d9c78561a217a4fafcfee5d143930783af6d66347e813853d5853a193f3f2a7f939a292e299be9f4631357351b885ac30cbc01ebd82157d3b4efab56fa17c49886cfc464b10245545438d603c84c22e1b0cb76e30883"]}, @typed={0xe0, 0x24, @binary="c6aa7f3819a428a60b5627f7754760bb54d5bde8f6ecc50bf70f83c54517f6e2916c4b49abdccce3eda72428cd21517caed474e12f16ae7daf6a731d85e0e1844e6dc541ee9e9944800fb2adad9d5eccf6e0a30d9f494bd20431146397664d97ace93e600300979f01311fd430da584a172c5cb533a24976c197269d593f8e4a07b7e516bd0b0f48ada562955fe1b10893ef4ca027d535a61905c748bb85cb9385ee75cf8696377a96f5903908485854bd0881c153fde4ead19d924ce1fe26c4d90e1bb0c10d71709b58608d945863a02cfa84a073f9fdd33b01"}]}, 0x1278}, {&(0x7f00000015c0)={0x12f8, 0x23, 0x21, 0x70bd2b, 0x25dfdbfb, "", [@nested={0x11c, 0x1e, [@typed={0x8, 0x93, @uid=r5}, @typed={0x8, 0x6, @pid=r6}, @typed={0x14, 0x83, @ipv6=@remote}, @generic="aff20f910a719146f454ff", @typed={0x14, 0x94, @ipv6=@loopback}, @typed={0x8, 0x93, @pid=r7}, @generic="958672641a769090778a107a3eda0b8b868fdcf3fb8d9ab479517db224a80efa75ea715bbb24cda3cf88fb1de76af912e75489d4bdb663731588b928924183b2f4274d5ad47d", @generic="a7dc541da6103756a08dc9961d3ed848576758dfe259216828fe9a2f154a7d782e6a18bd44e9a057e5a6148e19b40d47e6906c83ccc307f5f1419e0e5cfb072ad2bb0a9995", @generic="ed17fb04e04c4698e65d9f5b68e1654f30455e3d85930c3d47468252825f718f18bcd49cf25cfe7dea51ae08a495d67ef71c8ea44286bc36a967f1efea8d3c"]}, @generic="696b1da76939c5cd093311610efd43eb4541be133333d0e0a9a407b0b5a8d99d357a18eacdea60ca694b45889cb34b50ddf44a4df35644e76d7dc4f9363d7817dfaf63216d5d5a78b89f67a72ddc033eb068ddbdb162f701e826422defdbf938de21fc126c3c13080bd095179671b34b6a78ca56acbfe78deb3cf6d8e9008bd33699348012cce4a90d73f2d7eb90a0b7b9264b50e122be18ff7e7c3c99afb32fb57f45d3558cc1dc107b53a4cb52607996612e408a42eeff9633cb8848d388773014dee2923ea468b19ad29dd79893aa1f7cc6334a2b83b8fb32a749e08b140a537aee47a17eaee29ee2df16b7d53045b6593d6655fc512653c0c351191f6a6b4fe7f1fecebf0d91e07f6c76557a43dae0139a1093cada3a64a705590ea4ee1b3b5bccc407a330e849c9d66c49dde24d6268deace0bc851139e29968bcac85eea88c8f2a22a658887c00a210bc13d620d0d5175791e62db7865261410a6856ce19bb17cfcd426d68922e1a962dc666f418b04abecc2b4f38561e25e8a79279eaadc07f5b8f9d1de18c9f5c3d6e6f73efedac29c4f89ddc5fe8e77f7d5e7a6c93b347c0ffca32a0713da78d76b183200eebda4de8a2dd88dec47b75658b20db34364cc4a25612fc1692d7b67e7c6f20e24bad2613283a1af88657ab0af377265d403dbb9f7ca292db97de8cc9b2088aae3969c56bbfd0e9c7a0e2cc806e9d7c44d3d00d4aad3c8dbda92083ca460a610879abe3f929a17b182b750dacb542923edec160e0a97a287a95cd896aa93fea4d59c1efd9024ee9b23acc2848fc629ab6e955c5dc29cb0d3319dd776fe7b3c91392eb134c60cc0e4978668dde2017753f8bed7c809056b437eb97b46f3e4d539c0fd8cf4a039e22170c99dfd03e07639c6f309b18a82df6b9849ba6c29bf2e357dff70d72b2d3848b5f5198937ae687529f51cd9721531595fe508fac5a62b81cfb91057162c23488977fd57c52abbbff30e8ecb925b6e694ae5a930cd73f6b46ac01a371623ea0e85388b0a07e0743577c7f2e39df0de3286c782f969a932fdf838c8d9cc13bba9159131a25786638402e7f3c1af880acfa42f48797d2cf1612a50211978d9b3b23f075a8cc9ece81911c578e7638cd0a2cb3fd13e44449ecb2bba4f4ab0b2c3323ad3d1769f6be4a3ec747089057b03188951ae3e01d2ca8510f27bb1bd97af161f3dc2e918f511e18fb84eae10b6e5deec9e5dce25964f1565326fe104b6b9119def0f1c3142c698ff7db9cd6ee33866ce0e30628ad2154c6044ddc7cd42d3e2f9b1d04626e20e18ce36e2130190a5c008b016255a651065827b6a85f7d4f0b9be760919914b130d2d81361d2b3cf2ac6b7b1160242b99fd3af7aa6b9e575ee3cb2d4423a9e512a18062c5c320e801f2c88afc61e10f1f73103a64426d6bc6ccc0febf68e110627e227438c58cf62acf839e68acca99975231a7b68dff8815f7175b85a12b8ae034d5f6aa467aa8ab2cefba7f3243cbfb1cd3e426ab6b053c690845e08065c6aa62def7644714d9e07ca013a06ca72816c83a78cb2c8604177d26a619b517d99717c211d71685766389b8177a7759cf05a98c4df7e138386878864d7919224eca2d017b407a88b73e526e6685b9b02ff79c350e6b49e24d7e6c138092c028b48d73e1bca2a0647e260580d138deb1638347477f6bb82fc2854d56719df826c1b909246a43738b63286f6339bcfd0e7674d3faaa75d6471d6e637609681550aa6550e044b934ee6db2e72d85896de2d82a80910149f0e06930b7f7e2142400598449682d13d6679ec516b1c9e9750f0c92323732db5ee1a03ea43770e63dd776599a50c07358e95df150ecb09c4315124f4b04e02db06a64a720657ab47722b80162d4c6c7c4ac3947b3308b3f5a29a8b4a29ba7d1206ac083061de1c607f30abc29b03e4a7ab490d3bbac6f2f96d2093ac167e33b5ff04938a2811294346431e8176f05355b6e18db33a8678bcd5db119e5e750c5f13d4be979364fdd252594c3d410b58770c4f555f7cdc1be94a2f3399e765d6e50481394354353ca41c3d35512ff862d8c6f05a171dba44fc39e65e71e4b945b482a3474b65e6255fe4fd51f6451b467d4c98f742c71b67be2f765e6c5a5ce1c7677c250bca90dcbb05fe0e0f8c783145b81963949780e076e8910cf06b4d2b30bbb6848739cbae38ac01209cfb36d4ff69be45caa1f58d10a69617384820b2c01a03841cc8e20d4363827b3dfbdcaa35e986c677fbb61dca576423b11ad39193520630608a1efe4106a9c16d726d46d6e2685800694869e90918a6cfdc166bc3a02ca87eb1722004b21b24e10b81239b5f8ab76185d0044d8005f5ebbfb95b090509a71d37998f7f1840813f8ed4b97dadb1dc8898cd6bc744d3c6d0e4cebe20d84ec628cade776d67e3a0afba05d73f3c6ab9d4c4ccdcb1410c97cd160e76755c4d77e37cf44bd62125892e8998c0ed3ff6896e31cd42c061e37714472bd0e5a2237fb97bd0476a4a774e9d872487e70f49dd7d19dd1ec8d13d3282878333b342e06d39fbb06063e204229e360f8463e7ed3c7bbbd49b7e1f144f5f46a39439713fa57c2a3877e31a4ceb263d94b301a7f632f7f42179eb70e52b854d0f7bb93c7c9245f61cf95dcff0a8b934ec10f80c3f579c7d29b64f31d0cce4e19f2334f0e5529b7878ab46616eb14bdbe44cfa598041b649ba365256d610d52f0d5c2941aafdbeb830187779001b22382b35a5cd9984da26eb8e3119a38babfa0ce7bf29b5e23d67b52debf8ef9561d4c876696ae58a81eebcd7e58efb8fb72eeebad744d0f5e2e5ed1022f55f8d0ebe69642d57e900b26af4b021b233c3e7a495f8d3c2fd8d1dd32f9f9419ae21b91fa0a3dc34f883fb9596ba91997d1136025d0a8b68488c31b256823a05068f627be95cf9a49df88af340ad994a407606587cc407072e39a161e034807c710b947b8d21e0d168826c9792f6a75979b945831e5b1b7dcc02fd88d0dc7fea7ef5b8fd7f5434d29f1029c5d692e2efdbe01306601dccae91c691682b626251526cc81bb69f8cf335aff491068951dc78a7fa6c8da467fedd9c099957fe99d5d2130bb1d94246b00721f874d5fb70db9cb236f6c9be88abfefa0ff9252d95dadb11fd1840e2ca2782b64c85d09e37039ebe7278408c179512643cf40fc18900b2dc9a3851891a61fb317bb2ea3b9028ea4a4dc819726a36fe07374bf973c961347352bc5d13a5859e8626ea3ef7e467e07f0588ddc17b2afb204dda0d042175392dcc3bda9d47f6211d51fd8f08c4479dd4a571f25fb8461c80747f3f16cebed36fff9f186903fe919c6b6fa4a19564f38552bf4b72c3045122fd3ddffc411fa716406a0a056a645a491bdba699aebd1d017c3c3033971540d80cda253a75e6117a17238bc404b9ea0c826604aa8176a0b2b26cafef10cc98b2da2c08e9a49dc89fe48e1f8e4b5d31d5902b13436e7f0057611a2d937fc2434c17146d33ca608356e72206c2cbc7039a7739af755f65a7c0f29c3b75d3af7a1e2fc4301700a6b5ea9956c43ae597d7c9aef72b61176010870ba8947bcac45eb9eaabca62b490430d8379fdbe4003bbd92d22da2b8d6ceddf6d5ea41d3c5b68dbeddc1829efd4fd4153cefe462b60b47c0e0ab2f2921d05f05bbaf6b1e117eb04033e0db1fd23d5ac920ed51fb6a247ceeb683060c90282bb139497eb2b018bae6f9a0f38bb4485ada5f26228a6bb874cb794f77095be30dd199e74956eb3f18cfb715de19fb44c7f7c66982ad8340dcacc4c88be84b65c17d293e793cb32f38c6e639a8426f281342d408d8fc1794e054a6c23b0421d570d2203ea3a0c175f2e5d6107922eed75b954e06f62661ed36c12eea64f22a640975d473fd3705d8e9402a29b12c6b1d270dba93cc868085f6faf354d81f3784db05727fb2b39c334e16305f5c536e9731b39e5ebda2bd2e6562dc0a73a3d51437a034d38866a3efdcad2534f7006697deaf8ae416e44bf11b460be7b502d8e926fb9945a16dc3dc4f1711ecc3cf344f9a028ac431013dc4966b6ee799ed9e86e2274ab813f56b5a97e1ae5dcf9c2fe75d57871a83c71c987b299ae92f4a09bc48b3582b3de52a2dbd527c59819e6ceecfc19f43bbb8b90d0428a8a7922283c89f1f16fc55171f4b5814a0b63577d58255bb6ebfcea915dcf5efc130430e91a78d4f478b25093129b4c42296964cfea3498782c09559f66617b0903fab54f4beef1f585140677a6f7df4737291b36332157bae90b438d5b6a11fa064c1d89666385dc8b984c9401bb399bb81ff11fbb18323f77b647896a98c40c764964453741d53667796a9d6f1ffe6b9bf3719ac1a72a9c0a0f034e6ed9750382c8aed5ad2970873423141ebfdd417991d57bf6e3792cc67ece40aeb30773e89c7fe39c04cc0548bd270ed57196331281502e2f1df5f29b726ac243118ed7a1f4106a66afdee3331d8ee598d9a5758eb1d881c89ddc185a34c9df3e071feae0d9b72a37ebbf47b70fa51cd37694d481973c7746fee81b00c68e7cf3b8c3a0ea7b6b2c59001439f04ed728ec1d0b3ff90c4bbf746ec71dc757a0590b1b5f53e13a9afe2300c84e36edc2770891f25ded67e5996a9ccb6b578dafec3b8571c32ccff6add1924bf4eba17cd77680e8d974958b73100b9b91c5691b5ac5e30605a6bf68610f77c93a352ab1c25fe998f52614097751baf096b6a6c9df8970dc31ec11ea1618db590472dcdd7f61dd03dc179e948f60a81d0519c3fd8c1d7d2e8c76c613c9f44494d054c1aa0703e2946a79dd62b6cd102006ea349753e0bbc8c4f3b9bc8e7f7298f93fd3f8d40041dc602af16416d3e39ad691758cd2a4a98d0634090205105b0d96acb54aa51c03f89008ac15aa6f308be8f4fb1fb8f91cdd4bc2fa361660b4205dc78106e5319c36dd85c7752d2bcfd58daa988a48f173cfa4ed8b00eb5a39fafca07b35f3fbe7f08618795381cd0ffde14272a94d08d9d37ce767890dd6f48ebdda1dde20e1f007bbcf8f277306f7ee02dfe78c0e3445dfe4ec79c5758d88df8f0a78b9ae6d6030482f1024384c430f42673e7f5128c065a1f920ca59c340abe61bcaac418580502368152d204a393314ee7d1f6adbcbeefee364bc1ef5c32df990b210918dd8b7c94595b833850c76d4470a0933719ba7a1e1c241a7ee0ee5566d649e35c2ffb9335fe72b5750269d34034fd74642dab6dfe3f3a03ac4fc53210bb589ab9181eb06970a84f9e98988d3157af5f8592476e12d888fb1ae3b36d4a51b09f42a904fefcd1328653456a7bccf31444af6c074d8d29531dbdd09b209aa387d222197e95e56c50dc889375154306a5a74fb1ad2d05fd0a48a6c8d57b4f0e78f7cc49dad541424dfcf0bbe0f8e83699ad2d8a490f2373abc80741a30df50b610782b3f85d8f0373839e455a6a7e7aad1c5cacdb41182ca0e48391491452f2ab687e21b1d5208deb934f58fab0373cbb7e7c6f6447df35fc3ffb3962e1eb66a5496eac3a563936ed8cc2a9155f363ab0cd57593de5e89aef7c8aa4f47acfef9cc681d0991cdb5ea3a9361dea59bfc364327a69f31a6454afd4332a92b0f11e0cf382346b6ce7e788200e3e2026ce50841a728c00e61cdabd3793d7d5adc95bf82f8dbee8ef0be8f3e5dc1cf4120083d6feab0f25443a989a1a8d8cc4fe690c706448bd2219fc937ac04be77df447e370b22ccae9d1d6859cb1d2396cefd097b0f7778f4abda7d757a13bbf8754baf10", @nested={0xc, 0x20, [@typed={0x8, 0x4b, @str='#! '}]}, @generic="b9ac68e75049a7db78dbfe02ecfbe47263f0239373de", @nested={0x1a8, 0x37, [@typed={0xc, 0x37, @str='trusted\x00'}, @typed={0x14, 0x11, @ipv6=@dev={0xfe, 0x80, [], 0x14}}, @typed={0x8, 0x1b, @fd=r0}, @generic="540a215f6b1c5a7a36a6dc0d6eade7430bb991afeb7d4bf52982ab8aee7f43fed30dc4c066a977c8a8f7c299bb726b477d65bd198d314baa04124499333a9678c410db921ff59acf7fe08953f786de5985b451a1e69ff3f494838f6fb200362d6ba725af85a7", @generic="6925b42ad4e1f2cf75015235670e491e42b20492697270011299ebf907e29da3b7b53428ec52b4a7ab6ae378ff74699befd5d8630c26294ff1cd1a67b804cb18e892b68378b06f952be9eb0854d4458ce3e755acea8746f003525214f6fe2099d65a3b3870b9accac43382b17c919ae87f8cb39c2f61b869afeae6bb47543c5b0e0aac299861f84e3912d0efbc25c43d68c0e94fc99b47e42881e9c416bba4c861a298c91492c8bbfbb1080a3de22447eab75ed87df620589dffc0d9a1052d1046d4b369a7b4398d7f11388b1d913ebeed74b6f87f721fddab847384e1c7356da975d7070b06c0091904", @generic="cb10625e3f1302ef4e89a8cd61509bb30710fe2550445aed93980c114322e5c8cf19d11b0f6bfe2818139b"]}]}, 0x12f8}, {&(0x7f00000028c0)={0x1240, 0x21, 0x400, 0x70bd26, 0x25dfdbfc, "", [@generic="8f32018800a2faf74f5729df9468a269e8f89112d558d7a3b4be6d2c3b402420883ce51279b20e996017ae82b18c58ef46bdd047d08a2018cacf36f4c294048edd4398c13cfec1f3098e935a092917431db1dffb9af65cd0edde447e5af665d8e5256a1022", @typed={0x8, 0x30, @ipv4=@multicast2}, @nested={0x4, 0xadb}, @nested={0x11bc, 0x7, [@typed={0x8, 0x72, @str='#! '}, @generic="99516066e3a84b8e455537ddbcda05338b77b6690c710181d1cb4969c176b98ab6fd6aa3ff153b5130eb715bca2a786f5b97a502b63f6badc1e9335a42397c4ccde6a93093a9b03ec39eec67a5d0d1a9cc5d90781094b5cbde6a709579591412437eafa544d36e446b138d2e662e969e748f0a2eebe705110abe55eb4483a26e9f95ef8cd2e69992959fcfd58f1e40977dcb0a8d1ee42157102116effe3d3747e1c157b8a2cab2151bffc9f15956bc41d86cbdbb82856b1c", @typed={0x4, 0x22}, @generic="154f41920e7efa6253fb28e9d670fb01d2a7d46d110e5518772f831577bc142b641dfda2efe3df18f0c2e4b17efbe80c76429972c9d990f34fb742f20f6b4f547296dcc4fd41352dffed8dbb74ee547527a64d8616ceaaf5efb03cf4d2cc5a504a6d122d91435f7da072a23304a2ae0466c2b32d567b3383ac3ebceded6e9e442bb70a8bf842fa56edd213b977685d19e677d779e6b7095dc75d9b4f66844bad4b50894e40fdcc98f40ab41c4ebaab755072d497486b6dd3ca409f6d8c", @typed={0x8, 0x83, @ipv4=@multicast2}, @generic="a7a6edb2232af47f2937dbe7d241265f4ce4dba82e4f207f2835b2ea834f6a4c81f3", @generic="fa2f2a85551cf4d9d5b07c87781b6d9c084b191576eb3610ae1e3433c281b8d8f9d55f7f373a232154523af6b0e65602ac3b26f32f10532387082710909bc3f96da1835464bb7337b36938088db3e773bd7d11041fdd0b8b168eb443c1d1866975786bb5b38da3f8dc2b8ad0db6c00f2484bdbff8c73f026f10533784410b35146f008fc59a3b9953d2441b81a43e1d8a737f10ec75a3a994f592bb7cd9c88a4b1d368850560d96afa93a74d39f762c3f6a36f1d559354ebea95d57ec7a7c068051d7994ba4bc4f98783965faeb332890cdb61c2cd9ec2c1dac96b704256acf8d9bcf133b38a3735f1a124cbd83a976262ee926b90ddacb87c0d83f0c4f4705dfa2d8bf0bdae0bfe9593e8fb2638bafbf86642b8b4bb4a8a77493f86b6640373ad12096e01ba6fd97f4eb423c09568526a8e742e55c75964b8d11d4484cfca7859bc5d3de22d4e8a6b68ca7fc83365760e88a04c45bd1130788cd6f6c41038538f6d63ca3aa88b87c45201ded2ba35f3268bc7ad48c20b9e5b2f27b2b9b1ddfbf31bf2af6d9d81463f6835b78ebbccc87cab0d069f498698ad2de72569993ecae51e7a8b819134cb8c9e106eaadd08d7f8246a444a02a20e97fa813509ade6b6391d4abda36b62fee1da4511729a731bb9508a8cc24c8e247727f53893b255e08e729d15ef241af5448707285d2fc44a3c0473fbbeabcc318cdf7438854fa2f47c486669e57695b616436b1e402b78bb0b457e143efdacd897899d9c1875f3657148d8164ffc26b85e4289dff3438ffe7bae6b506cba5f4317a2f55b1072b99246eab7ac0a3c9a9a8a181e021f2dfd1998d9e592efccb19df5b7eabe6655e660a5390ef5693a97e7e0f4144e1132ac409ea882dab570b93aa5f986c3608a922ec8860bffe76be35ff09526d89810b48a371a0e22c0c0c0084f6679c65351b5396a000072c112803a02e53675d8510cfc47f7239a688c1c4a5a41e2d13f30467d4f64d91ed1edfb7e3a22cb5da209a02f02141cd6309491530415538a2126ecba0bc14de42f7be1cc49b8e00f7b748bfd187f8165702abe694e6f3fd5c4e5d4761ea58a785c9815c7c5332cad2fe7129998eb66bbfd3962804bebc232c501937ed885d9386003f7335b2de94b504bffff41d30aa6b511bd0181cab2cc35a03c68ba6ce11fdaa4ef51e53b6dcd95a8d51b81d956478ab6f516a70d09e3f6908bf74623c9a241facb4730deb311f62051dec7e8f1c2b1b3c50f31207bcbb215a55a53a7178394254a3988591c4659c8ddfdbd3cb561c640d09c310ed9aaa763880d479457f1500e4a2b7119e541f9b8c7c4c20b4d4530d342f8c6d8dcfa8511a49c69abc15d43f413e19d5b20b48b75236d08171121e0dd8b56ae62d4840e8005944af4c48974b1dbd1bc3acde146eeef686619c8ec2db5148ffa31de4aa9ba3f711c930a02f7a4f54a085fdee9b2ccbdcc9a88e9d47bffa7adc24669365b169e4cb6e2a90a266038445b90fd34cd391d4ccf63119c85ef286e5b50657cfea62b8d72dfe8f9cbd007018989f210fbf9eb796d2e68a0caa7d67c305973f31c379c5164e7433bbe1f6c0c5a122b4a0e6f4c963dc53808a0edd363d0ce7bcc86ea86c2279fff40bed86c2451ba006e0e42132008bff8843df46861db7db52db9125b24e774e9bf9d60da5bb54f10f9d7a47c21e72c2646be01ac40e35bd74c97df196dfdd001b680c7bb23ecdb27ed2c31524245ec8677cefd2eb9da231f803f1ea4ebf31316f98dc43c7cecd43a6d95c30a3cae5916844a35ba2a3735002032fb275969668c8affadef177531a6b69bb6b687683f2d738f14ef4f8ceb301e19f84a0d3173a6bac2777ee2cf8da40c40fb45a060d3b9d99eb8b43d59ae1b1f5ab9f4280e1c47401767bb71263c60e1f08aa4440df3455923893a5671c85eb6f6cf6f091ef8a7c439e06f9bb05d07a3da2fd1343dcaa24075219fb7f81c45f14ca1ed251c17fd990b97212e90ba1acb1786e9c7953146b5527cdaeeee0487350f4baace8de9ded3282d454d9d494a4ad58e2edcfd3ebc737693778268bf320789639cc345b0cf68418a48dc1e966cce6ce8bee056ee93b36a46d6ec4467a7da02d28ba5ea5c701a9c1836b713f76a79491c1b6228a974dd3a5e606e8bc57fe1d01ed051d1054b679295602b431d77f9d8fac0ea64b6acbc5e41a5b6f0512c2bc8405220322a9d7068a2f58caaac9fbc943d655224439587974ecd2c44a412b28c468f9094245d2d8b79897078268f610d49225a42d60875f62cf6b6a30586099b30fcc0d718f53cfd19d443b650b11083b39c099107cc23c4e08e31e2199362b9787b8717e6d4c8a1ae66fa48f550122b69edbd882db3838833067c7ef636197243145ba67e2b12855a7e6377e015832ffac418fcf58aa97affaa75a7113c678272e092c340797b93e3a0d19594094076d5fad9887eb8705514ed19ab9963f3b8f3aae57f552f528bd76a28a744d6b51c16f29465e2e1ae0f057a1234c825248ba44103d61268123e15b916bd9cbe57864d40b87ef84c09683fd544871b690ed9f168bdbb666d2c8419659292173f585d1a83970cb8a16b6d975cd0b0ca2cdedb392959663b3d224bd4cbb9017f11a77596823ee9aba8a76245a4c1a57947c25c35a38bc0ce610822e6446ce749bc22bf52b76400048c8450ec68602ee66ecb09cdc0ce7d38c28f9a42c35dbf8626d35efe18dc5ad0c0738155ecbfa96315abcb1f92fbd9d06ecbea44a52db8dfd827a31687214fecd74f9cc0b0f02cd5970b539f03e210a4bac38aea9b5ad2aeb4179753a71d5d6681ef9d339a98edda8655e164fa16f08617c40776427dd3c5657a79a2bb4017c60b82ce66c5592d2e79e600c7e4807d44b50adb5452185c7f12fbb2b9803e419385dfa6b59721d5f0a347ba221185684d608d93b01bf3dbf3e9d6f798d1bfac4e19d8735a05a9fa39f1422be9bf6ef47dd33d84a44e6fc81a4375fbf69b5202db197780ac42567f8160e2c646e8544334123b3cc371e8df1c721fbd1d2008426c8bbf49c89d34bd137584631273ea8f9d75f4274678130dcea303086f20e51212bf59de686f0702d139b219ee8ead00b8fd4bed0ac564e639c423f5ed79d5d1e24565f8e1fb48323fe97457a0d75f394428d46870036640dde61bbef0a995e9ddc77ea4181c7e7465116e8f13dbbe03322f229e032ee38e3eedb1bfcf228343a30aa0f80ef3c17409dfd7bd8dfe61be42d891dc4dc93c3942b1a9e0c5dfe17608ed300986c9fa2998e7956d924c447fbb0e18c246872cb6de311a1db4fc9a0321bdb6a280cac78c3ee7a2c9a27d5115dca1a4afdd83aceed1ef0d581e7d2550d52be242ffb78337ee3fcf1a3cfa72646bed588c39c200f23dd9e73006fe664c903e7a7a1107f803482b4c1126dbdb6eaf990fd8af5a304bfd6cd29ee6a980a23009e38b831728de39ad7e3c31c887204f350b2ea92270871479af489c2c7858a95f609092cb6bdd2dfb2158997939a333ea674c3c4de292ee61a8c60e05d764c5c979c1d1d1314dafa9efe97fbe26cdac6c62c06876db059a39706da8ef368ec3a5b0778bc3d747a3eab8d051cafb53b26ff4e49d3baca04c3182ee45af4d4e959174518d3ef512d14d0448e3a7f08530cc781ba4e09ca9deb07fe914b0a9aa00abab4c5ddf75073d34137f18cbec211be6c52ce5fe9d8df2b8604484e29418205e700b7436b0db67b7f0d53d9efb6906df0737951713034ae9f1899b7b3c05e94a940e245b97f196859309418b67b4ad1dd12b9605e3eced1f23e4e3e5882a87880c69de5854693d3f97bc5e549efd766e8e88daf2e04321afa875d783cb6239c6b6b871ffa1f2e7f640f631f170ad6be59c23017aaa87504db93e78a1bba52ff2342fe9700bf60772c4bb39f89475d9baf1c039e4defff1b2b15e0a64d0398d054bca307079ad3e4c535efc55efee8c0f93ba3cefa9100cc6e0a64a279cde991767d5dfe66deb8ac08823c6a4e9927669f9e554f47fd3f8ec0cf4f17991cd4daf709037235402ba4d3f92c4d3b3dbd92249ae7a406db4f4eef3e2a19b0e902bbbded320a772a76cca76ee43e6a0d7f1b13bbdd4b070f28c1097b5b41e14035737e98d008f41acebdf5684d5dffaf713020dda9551127622b1a34805db8f897163c052f65e9221d390e9c56234fa64cc2c37e9ed8a4626594b97b53983a5742859b18d3f5d2ace83f1cae56f49e837509153ef7a72f2dfcbcf2646f4973d00ebe660ad2bfa7ef3b39d5edf19540f6b3e3ecbe38a19bc0863d910ab65b99bc47ebd4575d762c318ac6fefe32791851f6e9934f4eca1f78d27ee95f08b74ae994dec9f2586a8cdd70c2d1f792083cbcfc90163a323c2785b4d328797289e08af5cf02acbb786412e7ce8d58bb317463d3aaf70d9071328ee3c2bbae881fa617781899ad4715188119eadbf45ad9defc1ff20a07b0ecd48bfd9efb8bb9e903536686502c8fbcac3423f91597b5da5a445cfcf528e6d9d38205c6ac86b347e8afaa3bf4e6aba0a584faa3631bb13f2fdab6f3790a55094eb84da34d56ea8f74d1ac33c37ab209d65aedd4920d55434ecac542f9046a5526174b7757a6560ac4fd182e49f774b126389655fd868d25c4beb1ebc12f6b30ee66c13d68142c4a17f97f34ba8a93cdf83f947fa956e0003b612330d452068b7a6e5c855e5c667f3f3bee62451a5f48e93df8367e4c6e2fb21197eea0fa1a031301e24c56c981adc29fac2fd304d142eb87fcd12eec190bc13e2694db064b0958632e12e46dff08351d443857aa04980c0673b908ab63d70e8ed861444d7c41b6294d87e540a6c4a7c88d866f57f617cb9d28061127f5f8722ab9f624b57bc7b9dbb2e4c854af4ee72f2f4406089b1c19ff36d9cfc8c3ee85a631dec6ec8ab27be4d3e9e18d256228328664d0bb04cc33c574e5023185548ce3eccfffa0c5c918ff2bf75ffd5f4683844e33dbc91d6e6ff4c530ef94f455ba363d48fbf35c95e88863a08a8de4462e5bd4ede0f0854452fb9fcfd9be477bf064bc42b3495348205dd45dfb0cff1a677df6be49a847d928529d6923b55104f2a44503914cb18e66e5faeaaaed95e20fc0dffde983a9b1f25e3bb83a486ed2a4868388de1bb67d0361b59ddbd537b2c81929fafc288c773ad33a2d0116e7175a3bf6d78796741400de856d080152beb0a36d9263acb7f92f26ec1f7f8748e381945893c0a1842dad7060507f93a1d67377f9cca2d02ddfea91aa304d739623b2cada16519679cdab0db1e27847d87a060dbedb7c1df1a33395dfbfee4c67045e3834806c81a7d94821546070bc1a88a7e37a4cec7f6d71fd3cf8318f15c7a98ae071335cb292e0f065bb61c792ececf55462223f9794021ae33bc6cc3bbd1410d54f5de845f9c3fca09edd16b44dbc4d9ca87fbd655329931e22665b40503de52cb0efb2b3fd7de063d9e50f79c016021ac28f0b160dd7b70d3be86128036a90b1ac911d54b49828b39b93dc569276cc23bb3e0361d9aebca7d16ef4cbe56323eb49fe4cf2a3f6e58758887977962653489e4be1d6df5d51f914f3a9762114d058820e9c8dbfdafb117332e901351b732db43ba891e47fb59a519f3c889f73149a1cc4c2fde9763318b48eae4c8bdb30f70321b0562e85d41eb6ca8dec1ee6f8de7f0328e86fb7cc711dc4f085110eccebce93e862a963766037759876a49cb361e9aef25847175db021b0963e54aed8ba24873bf7debce0273f7b2a9b8172833", @typed={0xc, 0x8b, @u64=0x7}]}]}, 0x1240}, {&(0x7f0000004940)=ANY=[@ANYBLOB="1c020000260010012cbd7000fcdbdf256e3b223509ca8c0226d62a5a8105bb9ea081f97f88a561e66a324b989f3cf7a4c3f63ce7257abe6602abdb666556e21c6759f9d81a2991783b883655213d282eb88666e8766aa0a0c8105cc7be3e64ce11aa993a694dbdc5982e08c4dda8c98ca984c3f88a36546334cd3bfd14f5820d5a0567b92464fa23926c9bd8b47d3d99206a692475f1ef7d17b383d74644b578c4e9518fd4f7514597d45b5a59553d60737de8ac8347a2f64597bcecbe09adf8a6670e2bfe0d14000700fe8000000000000000000000000000aaf457c8046e3d6c0a7093a4d2804ad2e9c8f203831a8f7e06f342c521779a2c0761db5c579caa219b7b2f30597803212af57006d7da5c6aebb69baf60c2d8b27a6b1a0c65a6eedd2065d2924b0be1a6749178df52ba920f094982b5411c43366bd5f4bb112c31e076c5c76d0c4debe5193561659c6d99bf179f22379838b7695b822959a199fd0102f840823d3ea904d283ef7511ccc21cb69a1fa5c47a402cc302377e0060de08eb39d175745867b1c537f2544e7e4b9f8e2724173c046de6865c48aa6141dbea00d5d44b9f4210dcbafb2ea2cf959d76f42d64cd21ba1466a9bb205cf3d4bbbb71ea573b061a781cc28795d253b381c751d606fbbcca061eb699e7154ebb05751281139ec45e13575fd3fa8bd61c21171e19a68a67b4a5d869ebbcff7931e7cc480dc4c3b9998816ca793d1da0e65ff354b87c6c839eeb38baf308ab9b2e7ec2f10195b10a089c4463152cd9178ef4c3715268c208e95b0b328ffd417a75410d5489b43bfc9e26747d8ac9d9c1389e6eb6bc8783b6819e14c0abd0144735332e4796ce1c3cdc003735049d16391cc986396126a412f8a0ade86d7706b990a840c88be658b9b9c08b1c73bf2fca22baa0f657ecc309dd1ad117529a4343d477e19fe2146c8e44ac68d155ed860f89564bfc449d0a8cb267b4a6d839a87c7252e68936ab76819bf8a036da594fd35eb410ad721a27d55002b26deb49b93ff4235ef96ef42685499df534639c89c1203c5d201385cf7f079b737e62d2213fdac6369bbab475"], 0x21c}, {&(0x7f0000003d40)={0x2b4, 0x1b, 0x0, 0x70bd28, 0x25dfdbfd, "", [@nested={0x288, 0x1f, [@typed={0x8, 0x3f, @u32=0x8e}, @generic="56b9008c0263135dc74e5c900174dc3a436226a703a7c2c28a70256b90c3db15b0b93afe3feca3ea32c6a016571d4ed01e3c5783cbe175b99bee17ceb4701259b9a5606706e720fc316695e6220e92a2cb9e690aa3863cbdc109e2b0a4ca58f5610dfa6c879ec69e366e77dafed8c4e4399b9d4864f6ae4fc53c6fdc508fc393e748d2dcb1b8e880753a011e4f36a1f66a1725af", @typed={0x14, 0xb, @ipv6=@dev={0xfe, 0x80, [], 0xa}}, @generic="11f7cffe880133c241f960ecaecf79cb5467b9ff3044038983eb16464e6d1e52c6955a6d27f50d7e8a91d5cd8678b649ca9a1f8138b3d5ca4ca39ba8541444889d9804e3acc3a25c3350443df9c7ed8486aa7c33363ba5c250d6579960eb15e70cb2dcc176452230051ac264b5de7e78d3b4027edf94420cd5ae3289aa1c533a69c3e0fea0cd249766fb5742755778deeed8cc48389413978c49a56eb1fbab1a018a84687387b27bf13d50d8631f9d35e8d0f1694b68333cc89f6b02e30879fb6a0eb534944069c2232ab106a7448b19779b3bdd3557c44417a38981366c22a82dee341343e3111132e86004d5cf2484e32187", @generic="03374602258443720edc9851bd1709b366c3438da431ffd393610877a18b1ee4f4077efc6b4b43e9d593447129419403985258da9e970d9f44254e835f618bde8ef594d94ddb4398fbc9e88ef933d89887d05522bfbdbf732eeb12054daabc16af5e5cac822c0a41d4b2484043044900b5e2e0f0bdb68db4a491548f50c7f930392adba1484126a6e014291781abe3153c132733305d0540b66924bef19dacba3a546409c716ce1f82cbbe77ec6d72cbb491762288658e2700861c6596ded307de6c7b7d3fb4ebc0e6ec9178d1654586ab966370a313c5a693ea21d69e780fa9f1"]}, @typed={0x8, 0x53, @fd=r1}, @typed={0x14, 0x3c, @ipv6=@remote}, @generic]}, 0x2b4}], 0x6, &(0x7f0000004680)=[@cred={0x20, 0x1, 0x2, r9, r10, r13}, @rights={0x28, 0x1, 0x1, [r0, r0, r1, r0, r1]}, @cred={0x20, 0x1, 0x2, r14, r15, r16}, @rights={0x28, 0x1, 0x1, [r0, r1, r1, r0, r1]}, @cred={0x20, 0x1, 0x2, r17, r18, r19}, @rights={0x38, 0x1, 0x1, [r0, r1, r0, r1, r0, r1, r0, r1, r1]}, @rights={0x20, 0x1, 0x1, [r1, r1, r1]}, @cred={0x20, 0x1, 0x2, r20, r21, r22}], 0x128, 0x8000}, 0x4811) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) 18:20:15 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000300)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000000000)=[@acquire]}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, &(0x7f0000000f4d)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x8, 0x0, &(0x7f0000000140)=[@release], 0x0, 0x0, &(0x7f0000000340)}) r1 = openat$null(0xffffffffffffff9c, &(0x7f0000000100)='/dev/null\x00', 0x101000, 0x0) recvfrom$inet6(r1, &(0x7f0000000400)=""/171, 0xab, 0x1, &(0x7f0000000280)={0xa, 0x4e22, 0x0, @mcast1, 0xffff}, 0x1c) r2 = openat$selinux_avc_cache_stats(0xffffffffffffff9c, &(0x7f0000000040)='/selinux/avc/cache_stats\x00', 0x0, 0x0) getsockopt$inet6_IPV6_XFRM_POLICY(r0, 0x29, 0x23, &(0x7f0000002080)={{{@in=@local, @in=@broadcast, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@loopback}, 0x0, @in6=@ipv4={[], [], @multicast1}}}, &(0x7f0000000f00)=0xe8) getsockopt$inet_IP_IPSEC_POLICY(r2, 0x0, 0x10, &(0x7f0000000180)={{{@in6=@mcast2, @in=@loopback}}, {{@in=@multicast1}, 0x0, @in6=@remote}}, &(0x7f0000000080)=0xe8) setsockopt$inet6_IPV6_PKTINFO(r2, 0x29, 0x32, &(0x7f0000002180)={@loopback, r3}, 0x14) write$tun(r2, &(0x7f0000000340)={@val={0x0, 0x600}, @val={0x3, 0x7, 0x5a4, 0x3ff, 0x7f, 0x100000001}, @mpls={[{0xff, 0x80000001, 0x40, 0x4}, {0x80000000, 0x7, 0x7, 0x98}, {0x5, 0x8, 0x3, 0x100000000}, {0x7, 0x1ff, 0xa1, 0x1f}, {0x87f, 0x10001, 0xb18, 0x2}], @llc={@snap={0xaa, 0xab, "79ea", "7d2eac", 0x0, "497ff226f40791e459d0f789d8fe1fa63c35c26293154ea87aa260ca34590f1ac07f4688d563dba45e414b9299c0bb2a282c46f37dc87707d44495007a2185484b9a991f4bc8cb1f1b1441f17761c2c655b4247b744978f6014f012220"}}}}, 0x88) 18:20:15 executing program 3: r0 = socket$unix(0x1, 0x2, 0x0) ioctl$sock_SIOCGPGRP(0xffffffffffffff9c, 0x8904, &(0x7f00000001c0)=0x0) stat(&(0x7f0000000880)='./file0\x00', &(0x7f00000008c0)={0x0, 0x0, 0x0, 0x0, 0x0}) fstat(0xffffffffffffffff, &(0x7f0000000940)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) sendmsg$unix(r0, &(0x7f0000000a00)={&(0x7f0000000140)=@file={0x1, './file0\x00'}, 0x6e, &(0x7f0000000800)=[{&(0x7f0000000240)="b256d15bbccfe2d74578ddc88d328e032b5d1631104dff28b94d6be84ee3a17323f2f0653e895536542cefdac28603b1ce10d4b6c951e931b89ed47748e59edcbdf7dcb693fea59a9f76c3a95d9c217abe6061dffaa96c57b826c7b3e355a90a5b5a5aff959ed540a8f2fddb4adf32945d7da2a9e909d1c4c664690f25845221977945283cb12de907a74da2ed7a654fbbe844fc66f90901c41d85e4549557f1af22d3a17cd554b1675b6f9a2ede3041c866f025ed560d5015ee9e7b7a1218451dd6876931384bdc195cba", 0xcb}, {&(0x7f0000000340)="2c535ba401e104d22bc5038bdcc000034aabb07e9cfd26d9d4df7715f622e5192a624fa1b3ca8d78d722af761b5244324409cb2cd23e5c9505bf98fb4a8a8af69747662f410665335c177bfbc282e645d50bdc4639016970341a0d05ca603ac1183d003da3bdf248c4b96eae97", 0x6d}, {&(0x7f00000003c0)="5976e02e012031f1544ce51945ba1f0945e7ccd2db8d40c385e5e4496916cba0fa5e48126da395344b9af8283bbe5e269873e097925eb242a826e75ae3191de07b7325870944979e6dcc9a317b1620a27934308682c88aa5addcdc75772aa7eb880877f7fff0b0a93a05dd5788df9d8dddffb8aa5852b59a03cf8ead5c612866e339f54eea031f8d588b77e55d0e07005ea7a39bf845c9451fb13e9e518b1a2c31f58cca7b6345aa7785a30c4f7733af284102dd927f", 0xb6}, {&(0x7f0000000480)="6884a79813235a4aef93383c111f970063ae305bf93394fcdd219c1741d1ee90e2994b0f0091c050b65cc3d495193cf5104e1a68171f4e77483fc4ac7d022f3e64e15742e2bac3c8207c1a753977b76fab267b941e97e802ed8183b2b6abed81c6a9b963a2f978d4f73e9e2e975c229bcb5dc112f6495aa325bb5e437ef0945c04e8641089a2009abc66d1fdd0e80778fd53d634a69f21924984fa3dd29680d0256b6fa9c3fbbf7f362c0c3c16c62f404c529f1ed5c6c8664668d8d7fa991d00f22ba50b6c354697395913a9eef18adaacc28b88a6415afb41b798f8d30cf1511fefe1f5", 0xe4}, {&(0x7f0000000580)="21f621e8c434f6f72f27588c403e06807becddd1c7e15c4eac3ba228f0a30c8aa0d764d57f0e54ef414bc3f341c7f2539b1356835d2a682ce816514dabd50b4bda19b4a90549791dcba93e546d426dbd14ac5b5da4d9684402f8", 0x5a}, {&(0x7f0000000600)="681a6afa27c7dbc2d356d60eb57ad87a27fbe42517c130e503b14ed91e2242cdd950dcf2ce1953c20e4cb0ad19c1f443ee9890c03b277fa493cbb93916c62044f83c1f65806bf55facef24af6909b3c44b4bba3d9af9098eef18adc1e7abeae4d35cf8987378851a6fc3eacdb53fb029c9cc41a64c0907997cd94c152496bcb6ea75c127ae58d67b6c2ee4b8f91b67636a92cdba78d0ec725c319ab1c106a5a4a687bcce20c8c0dd8f7279beec506af716250c8e527ca3b04edaa3d30b9cd0b6e7298f88f3e3dcc1788a975389932b088e31e98a5982bd2834a8", 0xda}, {&(0x7f0000000700)="f81f556a2ed58c916240867db7c1b75ffcaf5cb2d66af27db5aceecf8f99ce09478fdf886e9eb2a076d6c0ea83e0caa505eba20d1742acfc05595a5e633b3f935c12eb9d8146d4b84ffe42049bb2b1884e7d3c006d4cb9146a319594fcdc934665d1f4d5afe9471cfffb15bed0c0ca88312e386447b367a445177262db2d8991c14c957f0e14dbbab56f4305a68758e8623f087cbb5fe519f62a3cc65c45b0766fa2532242a139e4ea379ff69f751772e6a9b2ff4419e6e20c9c556c018ae9a05d2cf1066a2c8a2049cdbc5a64aa97", 0xcf}, {&(0x7f0000000080)="4c44c81905521b0593730f429f295cfa2ef3d5a542ba5eb8b9767e1bf026aabba67db08fd5f0cbbad65a958a8a7f2e9e983dd4c922e46c2bab19bf", 0x3b}], 0x8, &(0x7f00000009c0)=[@cred={0x20, 0x1, 0x2, r1, r2, r3}], 0x20, 0x84}, 0x40001) add_key(&(0x7f00000000c0)='user\x00', &(0x7f0000000100)={'syz'}, &(0x7f0000000200)="82", 0xfe, 0xfffffffffffffffb) utime(&(0x7f0000000000)='./file0\x00', &(0x7f0000000040)={0xf8fe, 0x6}) 18:20:15 executing program 4: r0 = syz_open_dev$binder(&(0x7f00000002c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000300)='/dev/binder#\x00', 0x0, 0x2) syz_open_dev$mice(&(0x7f0000000000)='/dev/input/mice\x00', 0x0, 0x10500) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, &(0x7f0000012fc7)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, &(0x7f0000000f4d)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000000c0)={0x8, 0x0, &(0x7f0000000140)=[@release], 0x0, 0x0, &(0x7f0000000340)}) 18:20:15 executing program 2: socket$netlink(0x10, 0x3, 0x4) writev(0xffffffffffffffff, &(0x7f0000000000)=[{&(0x7f0000000200)="580000001400192340834b80040d8c5602067fffffff81000000000000dca87086a5c000004f6400940005891550f4a8000000006700008000f0fffeffff09000080fff5dd00000010000100000c0900fcff0000040e05a5", 0x58}], 0x1) 18:20:15 executing program 2: r0 = socket$netlink(0x10, 0x3, 0x4) writev(r0, &(0x7f0000000000), 0x0) 18:20:15 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000300)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000005fd4)=ANY=[@ANYBLOB="0000080000000100"], 0x0, 0x0, &(0x7f0000012fc7)}) r1 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rtc0\x00', 0x0, 0x0) clock_gettime(0x0, &(0x7f00000013c0)={0x0, 0x0}) recvmmsg(r1, &(0x7f0000001100)=[{{&(0x7f0000000040)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff}}, 0x80, &(0x7f0000000780)=[{&(0x7f0000000340)=""/246, 0xf6}, {&(0x7f0000000440)=""/97, 0x61}, {&(0x7f00000004c0)=""/239, 0xef}, {&(0x7f00000005c0)=""/80, 0x50}, {&(0x7f0000000640)=""/59, 0x3b}, {&(0x7f0000000680)=""/61, 0x3d}, {&(0x7f00000006c0)=""/164, 0xa4}], 0x7, &(0x7f0000000800)=""/177, 0xb1, 0xaac}, 0x81}, {{&(0x7f00000008c0)=@in={0x2, 0x0, @rand_addr}, 0x80, &(0x7f0000000b00)=[{&(0x7f0000000940)=""/122, 0x7a}, {&(0x7f00000009c0)=""/94, 0x5e}, {&(0x7f0000000a40)=""/188, 0xbc}], 0x3, &(0x7f0000000b40)=""/240, 0xf0, 0x3}}, {{&(0x7f0000000c40)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @local}, 0x80, &(0x7f0000000d40)=[{&(0x7f0000000cc0)=""/98, 0x62}], 0x1, &(0x7f0000000d80)=""/11, 0xb, 0x772}, 0x17}, {{&(0x7f0000000dc0)=@xdp, 0x80, &(0x7f0000000f00)=[{&(0x7f0000000e40)=""/38, 0x26}, {&(0x7f0000000e80)=""/75, 0x4b}, {&(0x7f0000000f80)=""/236, 0xec}], 0x3, &(0x7f0000001080)=""/112, 0x70, 0x2}, 0x1}], 0x4, 0x0, &(0x7f0000001240)={r2, r3+30000000}) ioctl$TCFLSH(r1, 0x540b, 0xffff) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f0000001380)=ANY=[@ANYBLOB="1c0000209630bbb1eeb8c57d520e00"], 0x0, 0x0, &(0x7f0000000f4d)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x8, 0x0, &(0x7f0000000140)=ANY=[@ANYBLOB="0663001500"], 0x0, 0x0, &(0x7f0000000340)}) r5 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000100)='/dev/vga_arbiter\x00', 0x80000, 0x0) r6 = syz_genetlink_get_family_id$ipvs(&(0x7f00000001c0)='IPVS\x00') fsetxattr$trusted_overlay_redirect(r5, &(0x7f0000001200)='trusted.overlay.redirect\x00', &(0x7f0000001400)='./file0\x00', 0x8, 0x2) sendmsg$IPVS_CMD_SET_SERVICE(r5, &(0x7f00000002c0)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000280)={&(0x7f0000000200)={0x70, r6, 0x800, 0x70bd28, 0x25dfdbff, {}, [@IPVS_CMD_ATTR_SERVICE={0x5c, 0x1, [@IPVS_SVC_ATTR_PROTOCOL={0x8, 0x2, 0x2f}, @IPVS_SVC_ATTR_SCHED_NAME={0x8, 0x6, 'nq\x00'}, @IPVS_SVC_ATTR_AF={0x8, 0x1, 0x2}, @IPVS_SVC_ATTR_PE_NAME={0x8, 0xb, 'sip\x00'}, @IPVS_SVC_ATTR_PROTOCOL={0x8, 0x2, 0x2c}, @IPVS_SVC_ATTR_SCHED_NAME={0xc, 0x6, 'lblcr\x00'}, @IPVS_SVC_ATTR_FLAGS={0xc, 0x7, {0x12, 0x3b}}, @IPVS_SVC_ATTR_PORT={0x8, 0x4, 0x4e21}, @IPVS_SVC_ATTR_PORT={0x8, 0x4, 0x4e24}, @IPVS_SVC_ATTR_AF={0x8, 0x1, 0xa}]}]}, 0x70}, 0x1, 0x0, 0x0, 0x20000000}, 0x4000) setsockopt$SO_BINDTODEVICE(r4, 0x1, 0x19, &(0x7f0000001280)="620000140000000100", 0xfffffffffffffc96) rt_sigprocmask(0x0, &(0x7f00000012c0), &(0x7f0000001300), 0x8) ioctl$VT_RESIZE(r5, 0x5609, &(0x7f0000001340)={0x20, 0x3f}) 18:20:15 executing program 3: add_key(&(0x7f00000000c0)='user\x00', &(0x7f0000000100)={'syz'}, &(0x7f0000000200)="82", 0x1, 0xfffffffffffffffb) add_key$user(&(0x7f0000000000)='user\x00', &(0x7f0000000040)={'syz', 0x3}, &(0x7f0000000240)="f68fae98b81a10d28568af4ea48702869edadef11d592a3cad28aa3183c803d6fa53484b47666dbd707a0eb1c886d29bd3146292c395a27aa4d47e03d2b966b30b9753ce41db2f7f07eac939eae304693b739164332c9dea9a73f45380a67a2b2f185958ad2dff6db8388976095f726bb291ecb302dc60648fcb6aafd88bde932aa1ee1ea99a52d86c484491b1f4f25322773dc1a8c7832ad7bdd407259142ee7c0ea93c618c7ed83575575edcf8dfda85c4fa347cf24bc2f73593c3933f87e261a51c3ed73e2ec74727053e4e84a5e792082b0b8f41f3d0de88dcb371440b2700284e529349df0407e9860c2df63111380858fc9c4addb716c8bc899aca5df74c70f87590dd6e6c33b542b48cb9af98d784c09823129ccdfbba11080d737f22dc0808b47eafbb6bc32be06ce9e3c4b332ad2ab33ec51c1aac3f0aa87fd2ce617b5b830045640b793a8e585ecd78be515619af967b3ee189da664d05787d3f1755d9f5d738ec7c9c2d9f0ea70508f5f7672f86a612c19830024c35650a50c5445f8840d5fa1edb5c794d9b2b7a61bd0dcb8ee8a2864edf6a4bcf23721b43b53ee9a186519d637cf26ddd635c600ef382f7f9ca09227b83a815fbd19c0f5367822ea8069c6d61dc8361edd409da0625309460ea3625ba4bca1cb3289027eee1d2d899735895af8ac08d39ec874b76dd477344f16758e665e5977bf9c9ac57522c402bdefe3f56a996718d47d77ac075189eca21874b81a929438d4bcd3f0ce74e31155989ba077ec879157a940d8fcf01e972ce31cbc2d9167e569aea4c9024b6e622ba2214522b96fc9206c969a668563061636d8cd5d6493158c7887a3a47b4e004b268b08b1066f28ab4f28c7b03def134cb133063282ac4d7d0926f09deef4baf7bce0c807f08ab11fefdebdcec9858c11b036b9d997f30f7506ee5e014c9a41e5d297db6cee75515090d551facf1b27a05b97d3a4e17656131e302da39229b5052783721e93be09e72dbfc82be1a131a5c0979cec56c4ecc9dad95b89a4fd1837e94d07892b7136045d9841a42034a155a1c1f19d9627e614012188e655a551d8152f4d7be9a5aeed9d6c18b32d7f03a605af08a19a0cb0550db1601a2d6beba09f8c67948f05049cc9951e5f47a565c20e8caaed85d5056c8ebd918b6cf2a37c5627babc6e1ff0563c8e07ea25dbe3f1f566df109415fb81ca194c69eb4c628d6f44bfb4209ff730d544129d31e38a09cd57a4d590b200392c2650c9de0e7f9e849c2ecceeb55a544b97533bc119c7563b993289a2c48b5b97dcfba3e67f3dcc260687616d30e88561ee7a3316ae253b4d8675e3fa84da31a818b953602caa8513ea5fad67bb7740836ecf8d2a15222f7643acf52eb8816037c2cc1c61ea253ef5727542a3fb9eaf8170e52c565deba2604e2afe2dd8737d3601d3a592ba5d067f77f9c0c4640e1bea1200c105c532026a3ce777fd3952c8be929290d6080f7d7cebccd0e7b8da00e2be23c313737a9f02fb3114464a479d9f48833b7cc13cab4b697556f65963ddd1461b65f2a141b9e1e48e0905e5cf9ce0f2032aae2899c3d5ead16887bcfa68f966109df3c7fe7b02175f42486974a414c6029770433922a57ddf916d2209b979f51350e8752b52bb40c9c024d42f08f914a9aeaa3335798770cbebe97bf4f7e222437106ec8574a4f363ec0472bd510d0592e58126f95bb656478c532330295a7fd8e73283695bb82a2ce249b538706783fcae71d51cdf003e4bad7fefd8613ef5818591fe0be575af4c1d45b370a59ddf8231b6a843ce4a4bab09638f29045287fca2b0ca6ab8ae532cdb472a871c5c17b5a2eacada5985dc5b7b360720808876be844207bdc00509d82395c472b4da3e47c8c03bbb53dc0a746c958c5e9535e0fca3701e26de6d3d071b8edc7d74ff5a2c710b547956e92f5077beb4d36cf909a53099b1deaf72de9c6b754801f82a69704e09ef688e0769bbee575cf63e4933155a3ce61547af505b6566628e98671b8080438be1818a65fd27d0253a5b96f0fecf8a8e253ad056915001e4fdbf012e9c2ecd7969f4b954a7848c0bb382952fa2d4d91b30c6b36b3bd84e635c5c5fbb39b6e5a211fdf7d6f71ba794097417cacfcdb8492b487842c7fe61fb3b604e3a9977f4dfba31ec0d10b94e2e38d2940812a8efebe39144c02fa59e4db0d12d0bdb6ccf6b4f8e930df08496be7b1a7b1b94efb81cea40ad22c17a33b76758435493207e7746b3328a5c7c1f34740425cf5a9e26bbee1ba1f6f8a24508f9849709868f6dcd24a656570dcb8f8ce85787001b32364d56d383c0a75db1118d81ff9baa8b48a92f4b8b4fbf74245f48e4b65e3c93b1747e7b89487e02289eea9586cc6e921b698150b124b751beda405fde827183318535d376086f031d9fc22b4d9a2bacf82451fb15b1cf191cfc4df71511cc8ff6cbf46c1c08a6effdf0bfc858a7b71318123dd64482fc990a481cd641730c122c1104dd3eb1971bffc6ad0288c1796a00fdb2b2b9343eb16a66f32d9281aba0548a546f254fe9253c0b8f45d826fd93cfd93799f79c4c82d8ce671b40f5f31de038c6f7b8cfe03a49cf3ed29e77ca16c4d4fbea8ee8c0415a0c28a65dd4da252e8a5ccc628e97922f9fda01d3b7f111467a7a28575cf06c217e1d5c0c93ac4759c885c2f9733244f606a9446f4ca305fd10a6ecbfdf4bdd54d19215f8be2fec82f66924455363454897042322fe26fcdf6cd84a75fda5039e87241076736feeb04247ee9db830362e3c5f3fba0af38ce7aaec1ef2d6801db7e10cbb24f2dac56ed6c3c4d9b22d44511ef47860956fd66f6f5a0bc5d7f70e4ce43ef8fb6df1e4092d69dd36afe8630b98e083f1d1f35f9e0da28f333be977412a1234038790f3e8262893095a9430966815f45c2eb07929be8f0db3dcd47520ef9e14657afbc6bf00afeb0523649ae6251ac6d68abce8c00236cedeafdb87de533356ad5e45725fe01d643d46e7324c957c76d0f74cdf04d8bc38c98347e5c068627e09f650d0fd2a1bbee887029ea9e24f4a57e7f07bb2994728c0fa07c9036121146ff43c6b22e751440f71597f84bc39e56a8bdeae53d9a9abbea1df8289ccab39e27d9c5da8bd888a317eaffa1c880bbb1a0cf2ddbbd4f89e459b83cfc31683e63fd53d39ca4e8e6fef9a24412f45630c56cf7e136e8e125f04993641939a03aac69d39115adddad34443da1f9d2779b5b56a001d5d9a8e1b01edf1a74d4be8cf06635534e4d3d11897a23ef70703456fde2f3489283a214e54d863a13ce45f3b1628bea7352e1a9b166accc265e0b7e6cc1c9e13d8ece6f47df1bc7ed3030b6c39e29cd909c4df657075cbcb5e7b55cc1816c8467012a2d6a86c0851993fc30f088ca791695937e188b2a873e15fbe4a94f79a20ba34c4035b3509db5d110d90405b05d0a48990ffe8a12441883243cf9c2a0af1401ed1d03cdfb2b38bbd5287ba44b0fd28b0960c3a46340f1263ce8ee1d39ed2c822d5dfd731dad16839e4184ec6444c9631a7e21177e089c66c5af332e2db3a4a612b3e4f3b777912c15b6bba86bc0109c7b267b277ee8ee897cd2698ed9a088e331840d0f95768a6b147f0292548b06f95891bd342241fe39c8ba2ca09f03cdfc0f2d3ef17cff6e813ce6a52a8e4935fec0f0b00721cb4c0215cbfd0760f2e068f29e0630d6909b6a4d9b354ce00a74142ca1d946664c807c386fd4e3d323ad6ac54029169ed0cf560af6943b91aa07ca8a5ac214c9caeb9bf242f3db8f5d15fe866fbbe6d27d9638f7423c590ce49215a2fc926bfcff00077d7d41afd33c5e2db486fafc438f294cb98e12de1ac6ae15d830f271411ff58f834238f0723c5d5e4f95f9f722c046784d1d87532b49bfcd3d1ce56d9c084c3b7743c004f3206e5ed5a68dc1930e3eaf780baf76f5e0e21abb53abf98bb0c255ca6b5f799250fdab373710981fa684b83c1afa4253b32b606bd59cf70e363f0b27c51fd2bf2f4955833cea75701e7266772bb780743ca7b6e30e27e0368ff3c5b101539d0cc4321723b139436c3a05ec3dc235d099759fbe1527e244d2d0621305a9f2d54db5e31cf5dcbfb861da203f0828d609362171eb7b4ebb4d050f4103ad08d88884232ea9df6fa8494fdd98318fa4a57fc603aff7a837d667b3f8dba2b66304053b4a736084eadcae33ea2f31bd411b6b7c63d9ab240c8e56b9f877dfa87a107e6281c7d84342b6b3f65bb2f1c073ca026a88d2f1dd6720237e61d6425cf76d00f536ec0b0e72d0360b52da5c147b487061fe68076ed331a006ac9262eb72cd502509e1cf38be20a625c36b987e4610ab8864db060cfadb74d811ccc1a12a383330803659bd6849baa424b9dd4dacb28417899363d4a553697d0c853816ab5ae53418e3ba6ac701de57c8bb097c6caabe5d1c61ae3e9ed8b82c5ac482bfa7510e702259d143233777ba5c3b7692083b466154af3badb211e1fa5f13e8f935c9760d041e8018ba40374c74907dea533267d1b922ef9a8f77ca149be0aefd8cac0571a76ca295ae68adf84f63293decb0e410af5ea0015e3042fab36767a19124ef8f2acd9eec4e222c27884f81d53db6a1286a4b52330657807de2f6a534b34e5a5f80875861984ef2a11599cd84985079e5874b8f08a1decd350b5958da552a1cadbf2c1d8e69d074302ff84bf1fd50e716d41fb9002a2f61c61a52eedab63682e8e6c32a9c05f1fe351f8919de287e637def4e7476a3d6e5c3f16031210db0a5a485e868096267e777bcbcfd43c52150c516339e0d15c18c8e1a1d8675dbe63c0f5bc899e54e37f85eb013009cb9eaa4c29c82c4a7df1a45aefa68633cb2dafb76aaa93277982881006dc68b14b0b63db2b5bb018e3f9b77c74039427f3ef03e2c04d145a0d4d3e3051a881d70325c457b106582c978f23a7d5a6268d22fc2fd9af3cb537dc117911c1af27090779b5a11001549eda79b283c688cfc8aaec53ac557142ac2db4fa65e1613864ad933155e0f772f90380001eb7db75031889e8bc358e8d079e44f12b8643d1799f6c1a77f866b50291cc0896da70fa1c6017bb269deac63fcb6de26bc790b1262a5b9a10abad8a092bd29705f0b61e5104b29749a6afb5ce747d9e2389d4e74ac6a7e12a30d8c573c3b026d930a1fa76f1115475aa7e66b5c2dbce64ffab29ccc85876fa1eb62d493c1c30f092a71b42bd5ed1a25f8f6402df099bf6a68d8b50fee36f185090d7ed8cb01a68e85a5dc366f96eb56956f25c8901df33f8249b5af29fc4e5b8eb20fe4798cff3ec99c47c5c241cd67d4e2a8a500f0ad97b8d1f5710d762352492e79068ea311f13003eca659eda95e2f802d042edfe89ccce5764fbd1697f4e747aeba39a663413ec41012f6dfa4bccab10dddf8e5f8514ea6f53ce16dae3a22f8e92eaa2649c51fccdea9bee550d14d24579f4b48e712bc29e5de7ca3a41db430df6953375b08b31e40c6b100192191133939e1b0ca86f8d9e67e61c50ffce6f903fdc5140fed91f628cad7872bd1cf2a1ac00caf339d8c5510a4bff92b1b7a60e6968c8f8300a2e98d5203076f556416fed985bff82e924450dda9396a0a736c6ce404d65db0ca99f9c3bf94db766d7217e03fb379624a83e8a158bf5b0289337c3b8a1cac0d5c08be9195650ca92327985e1b72eab051c93900af660369ea998988bf469ea7001c0ea74b09edcefc7ca6112e0fa37eb7bb179d5c96a05e19300f6c9fa5a628d50f64b540fb429bc52de8", 0x1000, 0xfffffffffffffffc) r0 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000080)='/selinux/enforce\x00', 0x50040, 0x0) setsockopt$inet_mtu(r0, 0x0, 0xa, &(0x7f0000000140)=0x1, 0x4) 18:20:15 executing program 0: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) add_key$keyring(&(0x7f0000000040)='keyring\x00', &(0x7f0000000000)={'syz'}, 0x0, 0x0, 0xfffffffffffffffb) r1 = openat$full(0xffffffffffffff9c, &(0x7f0000000080)='/dev/full\x00', 0x440400, 0x0) r2 = inotify_add_watch(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x5000020) inotify_rm_watch(r1, r2) [ 483.494010] binder: 32479:32484 Acquire 1 refcount change on invalid ref 0 ret -22 18:20:15 executing program 5: r0 = request_key(&(0x7f0000000240)='keyring\x00', &(0x7f0000000280)={'syz', 0x0}, &(0x7f00000002c0)='vboxnet1\x00', 0xfffffffffffffffe) request_key(&(0x7f0000000000)='cifs.spnego\x00', &(0x7f0000000040)={'syz', 0x3}, &(0x7f0000000080)='cpusetselfem1@GPL:\x00', r0) [ 483.557168] binder: 32479:32498 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 483.577106] binder: 32497:32504 unknown command 524288 [ 483.585695] binder: 32479:32484 Release 1 refcount change on invalid ref 0 ret -22 18:20:15 executing program 2: r0 = socket$netlink(0x10, 0x3, 0x4) writev(r0, &(0x7f0000000000), 0x0) [ 483.611563] binder: BINDER_SET_CONTEXT_MGR already set [ 483.629882] binder: 32497:32504 ioctl c0306201 20012000 returned -22 [ 483.630260] binder: 32479:32513 Acquire 1 refcount change on invalid ref 0 ret -22 [ 483.630377] binder: 32479:32498 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 483.630418] binder: 32479:32513 Release 1 refcount change on invalid ref 0 ret -22 18:20:15 executing program 0: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = openat$selinux_avc_cache_stats(0xffffffffffffff9c, &(0x7f0000000040)='/selinux/avc/cache_stats\x00', 0x0, 0x0) r2 = syz_genetlink_get_family_id$ipvs(&(0x7f00000000c0)='IPVS\x00') setsockopt$inet6_MRT6_DEL_MFC(r1, 0x29, 0xcd, &(0x7f0000000280)={{0xa, 0x4e22, 0x200, @loopback, 0xffff}, {0xa, 0x4e21, 0x0, @loopback, 0xffffffff}, 0x1, [0x8, 0x5, 0x3, 0x2, 0x2, 0x1, 0x80000001, 0x1]}, 0x5c) sendmsg$IPVS_CMD_SET_CONFIG(r1, &(0x7f00000001c0)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x100001}, 0xc, &(0x7f0000000180)={&(0x7f0000000100)={0x7c, r2, 0x200, 0x70bd2b, 0x25dfdbfb, {}, [@IPVS_CMD_ATTR_SERVICE={0x2c, 0x1, [@IPVS_SVC_ATTR_PORT={0x8, 0x4, 0x4e23}, @IPVS_SVC_ATTR_ADDR={0x14, 0x3, @ipv6=@ipv4={[], [], @dev={0xac, 0x14, 0x14, 0x13}}}, @IPVS_SVC_ATTR_FLAGS={0xc, 0x7, {0x10, 0x2}}]}, @IPVS_CMD_ATTR_SERVICE={0x14, 0x1, [@IPVS_SVC_ATTR_AF={0x8, 0x1, 0xa}, @IPVS_SVC_ATTR_PROTOCOL={0x8, 0x2, 0x7d}]}, @IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0x5}, @IPVS_CMD_ATTR_SERVICE={0x18, 0x1, [@IPVS_SVC_ATTR_FLAGS={0xc, 0x7, {0x4, 0x28}}, @IPVS_SVC_ATTR_PROTOCOL={0x8, 0x2, 0x2e}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8}]}, 0x7c}, 0x1, 0x0, 0x0, 0x4}, 0x20008000) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) add_key$keyring(&(0x7f0000000200)='keyring\x00', &(0x7f0000000240)={'syz'}, 0x0, 0x0, 0xfffffffffffffffb) 18:20:15 executing program 4: r0 = syz_open_dev$binder(&(0x7f00000002c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000300)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, &(0x7f0000012fc7)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, &(0x7f0000000f4d)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000000c0)={0x8, 0x0, &(0x7f0000000140)=[@release], 0x0, 0x0, &(0x7f0000000340)}) r2 = openat$full(0xffffffffffffff9c, &(0x7f0000000000)='/dev/full\x00', 0x450001, 0x0) write$selinux_attr(r2, &(0x7f0000000040)='system_u:object_r:syslogd_initrc_exec_t:s0\x00', 0x2b) 18:20:15 executing program 3: add_key(&(0x7f00000000c0)='user\x00', &(0x7f0000000100)={'syz'}, &(0x7f0000000200)="82", 0x1, 0xfffffffffffffffb) syz_genetlink_get_family_id$team(&(0x7f0000000040)='team\x00') utime(&(0x7f0000000000)='./file0\x00', &(0x7f0000000080)={0x7, 0x5}) 18:20:15 executing program 5: r0 = openat$selinux_status(0xffffffffffffff9c, &(0x7f0000001500)='/selinux/status\x00', 0x0, 0x0) write$P9_RCLUNK(r0, &(0x7f0000001540)={0x7, 0x79, 0x1}, 0x7) r1 = add_key$keyring(&(0x7f00000003c0)='keyring\x00', &(0x7f0000000400)={'syz', 0x0}, 0x0, 0x0, 0xfffffffffffffffc) r2 = add_key(&(0x7f00000000c0)="e597718a6b", &(0x7f0000000100)={'syz', 0x1}, &(0x7f0000000440)="b621aa0e62dd4cf32924fd4132398db3f36bf9d3ddcfebef20aa387b87deb181b8fa018e9d8b40c3c720279ba7d932da40f66379e88aaacc283ca105d59e5dc8e67492f53f2b39c3bb7d408f19a05bf7b364184207bd045a1538c17fec33f23adaa42fb302e7c9575349f7f47e9fb2a47852812fd70eb5665e", 0x79, r1) r3 = socket$inet_udplite(0x2, 0x2, 0x88) setsockopt$inet_buf(r3, 0x0, 0x26, &(0x7f0000000500)="e49be67e1b11cd2c6de98fe5619411caa406e8c79c4145b5143423467be2b9b281373be9a6aa6a9af67906d706f860b73d9dbde2fd95dbff575cdb8867656f4999330f578d5d4919aa2ace2e66c524cf1da4c6c7e777007eaf8c76a56969965a39f7b600b266fb8c3eb2d6f30f7e50e74d02e1d6d9238d426673ee897c746fe5d29639a594d1fe67453605a222664821f0d98bc659b6f57c7abcbc4611f4d9a5e144944b3b9bbd1a5c9bd77f725fe21dd6d577c9ecf80bdd7df9cdbb0542a9d959f590378bdb186156b8810387119ce663eecccd965726c0313c50008bf087874b2189b8ca294f095646e221da5fd9a0bc7d1d0cf7392023a72aad48241fc0fc4ca6448a3e473206540dc791f79579a9c5b3f3a66ee8ff837070652ed580954bbb12a7ae924cc0c29869c173ca6c964d6ed1f055cc3ea7f81d404195f75a0abaf2f8f2139fb8ca904a984ec45bb0549b07a494dea5de4d32220d09e67985bf5272e7f1fc47794a43b4072f5ddb800d15b9e8770370fda85e902bc3ae899240d138be27873df864a85b75d6f37fa2a01da33409ad22616ec4d400c6eb2436a8e1824f30269aa3fbeb325d66b38c1926d4100cdfe4a07d704e4ad912528667615acc95c922640b6a3eca51a2bd1c2cdf271e4d7330e930546ae285908fb8ed6f324bd433a5a351817a9295f059351bb5a2342ba603cad7230e94e28f1d07b603768ad276aa1d01d84b05740f45b982f1d6dc027925a111005f4893ccb90642518e43b9095468b530b22aa4d3191458f71876d3f65c6ba763dc6bf789a30cda0f720f8215c55dadde14a10c4f289574ba7d0c425c9416f10aef8f843c9a46bfab3837ed23aff0730aba1bb2f36a7b8b4f64585aae8e3d8d2e5f78d84daa4095338f4df4d21daedb979fd89602caa7e9497d6ef6a1251c18f8bb0536fd3d59eeeb3950b38c960a6c7a18efa22f2db14905c6864916179e9b21ab77a902cf1c227460ccc70c924b9b0aae0021cd21d0d64eaf5dae6ca345f24ed1b2b8db1f328c11b1bd57f20702e8979aa1e827b2f6010e5f0cd79a8d5b99cefb374edb024d0ec196e7c976e19f87f27faa6c61027dead4da4b019b63a328de5544d3301587625c4acb6d390501b9735618ca9753cba329b47c1086a0ac8e7561ef7aa55e0a9cdf4239ff8bc186bbb0ba224d196402e67acbf02d8f0cff7ed0853f4f5574485670062350cc9adc49f85efc57153430c06870ec2a939298f0f77b2b81e0c9eb10d60b76000941dafe4fc6c9394c1817d6e2a1603d4a9e5b56d3b5e0192cf924b1a43b76600940dde6a9435453fb59eead8af3dde4923275579e9d26f889a9b2709b77ad78455d90e9dfd6b2a606de502a382d4943cb7d8ff3f99ad9c3d056b410a7876d8436aa9ca99aaa4788ab5ac1d2aab5e6c605156870ac6c9b67d34ce99fe291af3cfe3530578400589d01671b73e3d2a2c6ae175f0fd53d58bcbee769df44a1701524006f0e67a9a7e7914c41678a7a973e9e2236562356dba85950403bd57588afb52af12d0808f6e0d3da7abf3f146de0035699a9ca449cb26b201b065c059d67d7ac0dd8c9d6fa4e950ff73a2d4d089d766dacdda841f2c9101c76814eac2af67efc47c8a22120fe9af521e2294dde6d5d75e83edbbabe52dc59f22649f2247603a74c3a6a75c23042c16ede2eb17dd2f52032e7d638c790ee421899e6c1e0019482a58012ba4f1a63043502d5f4d25c0683ebbe4857ae0051477383ba85221b617a582693d230dc8d7740fd8e167d0fa952c394659fe144c60448ad0bfa68735d0f81e3899c0fca958495ee6568dbc5549cd05202fba95b6c1e8a90d4af99af58f9b269bed65f25de8ebeb88ea14fdcb869f2bedf19618206c3d9531847d28a46a00bcef0c43e035b50514f9be24c233d11c4bf293f56d2e221e93b5626dde4c2a3de8b2974b0fdb4e80aefe0a80739cb7bd5ec2e0ea92a641c715384f9ba42a378261f33c10b891cdbbfa036cabcb1962b8abd2a929cc55ca4920025634d6a2fe33099f8fd08d7b6df3f6df23a1fb38203251cc0a9c517a48b18dee452024a6dd1692b46d28fdcc41f02810ad2eb74932c729cfb3d3b30e34f150c0e4cf4db9ee1823a851190fa18681e56241bc36cbabcd02cdc73eb5cd6b229e5390476875087396cd8b9f3dc9eb4b2d2a0e9dffaa5d2672081af94987448f5316613e02123e485af28b5a2b039bd49c2bd1df3652ce7edac03989a2f7c929f663ffc26858655138d6826a20ddcc8968308ff0dd79faf10b83a8b2c124f44ef33e14a1e4b586d6949c081dd583afe95cc0ef9ec8cfc21b3b4c982316fe51ec74f9050bd2b3a3a893c95d6f53a77a683fbce1c385865dacf4a750f6965d95d169515be7a72db875893c5217370a0d764d114934351c1c88dfbdd95af73f8d1e69c7290a1f76090dceef3baf85a269bc5452bedef79b719af126c389ca0f83ba1512d34c86a70daf515be1b3bd62605313e59edb95251861f5df543636d540b8f67484991c71406f63aa19ea32e1d44905896b6d66ca7836e0fa59f4ae21fb64e989381eb737d4a527adad1caf89daa4aca26396fe7a40ea3ce06d6b6f4f8ad400348e03954df850e817e337528a7bc8f2d7cbc0bcfd849ea782c496b68122575a17e71726be7219299544a56c197e533559cbc1072e829c06b456add4a77c48e697ca8a84586af8a718b28a70ffda3d655f1e02d76942cf96956f758fcfe50f99c43a0a77ef870a8c00fb413c5b52aacb17762e2b783a04781d31bf455918912bbf7f27705f4a054b76f8e93645c02c1c64479ca6c72357d0afd9ce45d7798ef4a3ee62f93f2dd39e2d378c2b87cb8dcd71be9e55f95fb9820a75ae0987ab80656a1a758e835811f185bfd1b1a4c947882a167fc13ca3a23b7e466b548b9352374aa9900443e10afb5e2347c0f012137596a7ff67ea0efe74eb71601ae47b2b658161b150dc9274928df97d1cf5d1603651e0b4df311afb1ebf46a8f4cdad1a1c932f3445c5611b6c2322026091cc4f7168b5d6b183d4f411448e9e2cb0a8d169a687ddd33576ed8e821e71b1707c0874c86700dd42c745b8e0a255824a19d0a15511766b4cba7b9628ff80435c594d4029c5078472d0828e34c3cc76309a55e8dfc96ad3a25ece90703b0742e54265621b4e47f7426a7551d39a0fd78822352521702a404a7fb7112e0f2d75b03fa94bd67763e956dc128aff23ddd9c16934df196965cc1e7ee8e5d411aca806fdf891aeae5f819b1c37cfdae0b7113eb3330ea12435e5ca4a6291771ddc1dce37f7b4f629a12b85eed221cee7ed5754ba372658d33ea67599504a569f3ec28b379f11045d06d6694e9843f6c420425daec7e4caeb0d261fa08ea52899899ad916a29387f095febdfc5215b617d0246c06b5c8b9877d1e86290c91ce513e17f7554573dd3d8658242fa3cdfbed7dc13c447c4cf2cbfc5ec593bf5dac17f4e00e031cb86d25de73ffdb520e6acfb60165b3a3652730fbb5f68c0a17c2da2fe5e483dfafb4a0c099564e5582e72e0faebf3e28fd2c95c290523b119e046e1b0fb1c5878433345793931a164c70939efd5acfd97d75e0ef4370515813763050293c7c245c553794edf612e70627936705c0a829a810d62eaedba057aec8c416fcd16adf97563dcb0d19221b026b3553a3874d3cab935922d059698d0f694b137512d277b8e4f73938062f1b6ac004a8c67e0b9d093b89db9a2e8b302df3d885c51ba526f20b4abc39c9c1ebfceb93fe053e3b4dfd3d1804d9dfc8f7b0390de8c0467f8c4c70b8ef571d84adf8132e7c128322cad6e58e9e52ea98c231b7790a7392ac8ade3da7ab3d69c0a26ea4551cc28d182fbfd7a16b93d51b3775306d3057ddb5251c2afdf27f9afaad4ea66106e08eb5fd76378284060033dce7a168df801ac7b2e1643d630567a7f3f23059f055299266eca5a9af944e0ea03f4c00e6fb46a80ff3328d655223f2ef9cd732a680c382550415b00b374cc4a367312ed64c48260a34e658cd611950f23b38d89baf2f168ff117808e157cc033491198bb13d330891322f74279ac6be47c233714d4de47b181225ab357a6ef14ff7c7cbcbfc4669d4ba78b0b76a6665b1b0eaae9c4884eb3d816313076843c53530ac7a1bc4d35e04426de439ac8a1fab69826553d8a7da5d52fbf5f54f07ddf048751e0f74a2233df33ec54f79172ecb905d7cb68126a8145c93addcaedf865db083deff5d93faba7a06d9029903720fd9d00919c5e838dee93980c88a8a78c6bafd4790e45d439caa3bdeaa825b3f1c8c51f2a1bc49704a5bd508c38a916f5a01a354a0e58464ad402741d9f7fa01d1aff02025caefa0d37343e436bee3e1ab27707289b14933219b4d6596175a2579a8540dd958a712336caa8e92f9c2aeef6a943d85d74b69ac3257f14112f831cb3dca09615e3bcae0ef4024ab2cb048f6abc83604141029406c8b738b97a8de53c82e3727d57ee1eae21c639e7170e0513df25a7cb2f57e60a15e13e49989f4ece986e6b290979d1839d49ae9cf445a153f1ab9b781ff2369acc58f755840bd89f0930185ef2e72b6f591f868372d190e0818bacd70d495c8c907574a78cc9f5516f06332e31173ce8cfb5477fe287f769fb75d0d80beacffe9782ff2a1d469faf9a2bf70c2110ab1f493210c540f7f5a941df82bcb85f75425d589df5f95b85a9f536f7c71677f622756e17f2baa7254d782f59e001c416283536adee568b8cc1137df7a7511209799c38dc69955289f8f364c0f85d3d6287643dbe50c7802d2f50a9a8f1efdb93407cc503622fdfc268c4c39becbdf3bfe08c69647eb5ba9166ad631423d3a606a9c6d3fe757e2df5266b693fca9352230506ef27433819494dec7ac4c6d1bf490d9a93f6bb09dbd8505753824e59928cf48aefb35b08d8b1d48b068069bfc18358e58fb09e3498fb551bc5efdcc59022c2ea64862ce9cdfcaf8b7b402525b11172cdc0ebf8d3e02d001910b28054216b53b703400011dd4e8f8050b35b55b1bfefbde6e7ef97ec5b27018b23312e54efef0b9e39b2382da0fb810d37a52739a53e7d2b137bee5f269dd7e52cc106c22fa6801587b839dba4c25e19bbb8638fb2a9b041cf4685e2f72ca58c7c3d7b8adcbd2776e1021d971b5f181d70959f61e31fe7e0666767cd2037549aa7f1483abf95c49a6473023ceab16ac7104ad6bb2ae41edfd552acd06d087dc60e28c705bfcb8020357427d5b88a77490eba4bc698edadf01eb37e270ff291c4c8397d7c827e7caea5164e269fb500ed6965fb07918106c5a28e5f88337e57fb57d16c53d85c101e392b2c29c58e389e3347cad44e4489144bad3aeee1cbc533367f8d1bcb37540c0a849822aec56e7449cc0a25a4f89d65a03445c331303b2bc8c35d9c4c8c48a53c6beb708b646729da261849c438fe8221bc83d90e22873de444ee73c635a3f1d2a045d3b095941b035de833aaef5bd7856a40214590382ee1c793338e4a3caf6bdc9d259281589c98ad5e26aa25ff384c31fa03406d2eaada28e504a4407885d65fb2fd67256e5c61ce793e5d3503dc9d1f2a378a62e0b4a7220eecd3502abcbe3bde29a17086656d5f3ac07f5bf45c89dac6a1ceabef48315bf7ae5dfd2b6c40e6439b46609c3ac6b81510bcff438010d4e6008f5488acca1759aae82dfa7b345838f0fee0e17c1f2b77730daf200e93b759115030f76868d6a9edd94533b06783c6743cde4689fa183ed62955cb5ac", 0x1000) r4 = request_key(&(0x7f0000000240)='keyring\x00', &(0x7f0000000280)={'syz', 0x0}, &(0x7f00000001c0)='vboxnet1\x00', r2) socketpair$inet6_tcp(0xa, 0x1, 0x0, &(0x7f0000000340)={0xffffffffffffffff, 0xffffffffffffffff}) dup(r5) ioctl$UI_SET_EVBIT(r5, 0x40045564, 0x9) r6 = request_key(&(0x7f0000000140)='rxrpc\x00', &(0x7f0000000180)={'syz', 0x1}, &(0x7f00000004c0)=')!:mime_type+!\x00', r4) keyctl$update(0x2, r4, &(0x7f0000000000)="f048ee635a9891b0f66e2873bb4280db7e018582827bc6aaabd845fd4f0cc52340f0edeed7fb839addb9dc3b265dfa50b31602eaf620cb347b1c6c71d8ef73e01642c279046179246d8552f41aeacc4c0e646073d5e0a1badb0b656890dc2b346b96c0c2bf72515207fc4bd51816a54b6921a676990348f24a8a3217e578f224f43f01b4d3840ebf3418f4b016314cc2cde384734a5892", 0x97) keyctl$unlink(0x9, r2, r6) r7 = openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000200)='/selinux/commit_pending_bools\x00', 0x1, 0x0) epoll_create(0x1) fsetxattr$trusted_overlay_redirect(r7, &(0x7f00000002c0)='trusted.overlay.redirect\x00', &(0x7f0000000300)='./file0\x00', 0x8, 0x3) keyctl$update(0x2, r2, &(0x7f0000000380)="f2e9d349ee2cbd0b60cf4d50efe80963de184b1ff92ea3ca4d357f91d3433657a3e73617a47e5eae7f4c704a426303ec10d79582c180517125a5671f401a180f", 0x40) [ 483.634590] binder: 32497:32514 unknown command 536870940 [ 483.634598] binder: 32497:32514 ioctl c0306201 20008fd0 returned -22 [ 483.634666] binder: 32497:32514 unknown command 352346886 [ 483.634674] binder: 32497:32514 ioctl c0306201 200000c0 returned -22 [ 483.668645] binder: 32479:32484 ioctl 40046207 0 returned -16 18:20:15 executing program 2: r0 = socket$netlink(0x10, 0x3, 0x4) writev(r0, &(0x7f0000000000), 0x0) 18:20:15 executing program 4: socket$netlink(0x10, 0x3, 0x7) r0 = syz_open_dev$binder(&(0x7f00000002c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000300)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) tee(r0, r0, 0x3, 0x8) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000005fd4)=ANY=[@ANYBLOB="4563044000000000"], 0x0, 0x0, &(0x7f0000012fc7)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, &(0x7f0000000f4d)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000000c0)={0x8, 0x0, &(0x7f0000000140)=[@release], 0x0, 0x0, &(0x7f0000000340)}) [ 483.738081] binder: 32497:32504 unknown command 524288 [ 483.744702] binder: 32497:32521 unknown command 536870940 [ 483.761978] binder: 32497:32521 ioctl c0306201 20008fd0 returned -22 [ 483.767445] binder: 32497:32504 ioctl c0306201 20012000 returned -22 [ 483.768255] binder: BINDER_SET_CONTEXT_MGR already set [ 483.768263] binder: 32528:32533 ioctl 40046207 0 returned -16 [ 483.791727] binder: 32497:32504 unknown command 352346886 [ 483.797296] binder: 32497:32504 ioctl c0306201 200000c0 returned -22 [ 483.831160] binder: 32544:32545 unknown command 1074029381 [ 483.840044] binder: 32544:32545 ioctl c0306201 20012000 returned -22 [ 483.848028] binder: 32544:32545 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 483.855722] binder: 32544:32545 Release 1 refcount change on invalid ref 0 ret -22 [ 483.866688] binder: BINDER_SET_CONTEXT_MGR already set [ 483.872169] binder: 32544:32548 ioctl 40046207 0 returned -16 [ 483.878553] binder: 32544:32545 unknown command 1074029381 [ 483.884346] binder: 32544:32545 ioctl c0306201 20012000 returned -22 18:20:16 executing program 4: r0 = syz_open_dev$binder(&(0x7f00000002c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000300)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000040)='cpuacct.stat\x00', 0x0, 0x0) ioctl$VT_GETSTATE(r2, 0x5603, &(0x7f0000000080)={0x3ff, 0x80000000, 0x6}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, &(0x7f0000012fc7)}) r3 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rtc0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, &(0x7f0000000f4d)}) ioctl$VT_RESIZE(r3, 0x5609, &(0x7f0000000100)={0x80, 0x5, 0x1f}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000000c0)={0x8, 0x0, &(0x7f0000000140)=[@release], 0x0, 0x0, &(0x7f0000000340)}) 18:20:16 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000300)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000005fd4)=ANY=[@ANYBLOB="0563044000005802"], 0x0, 0x0, &(0x7f0000012fc7)}) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, &(0x7f0000000040)={0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x54, 0x0, &(0x7f00000003c0)=ANY=[@ANYBLOB="0c630000046304400100000010630840040000000000000008631040", @ANYRES64=r1, @ANYBLOB="010000000000000005050053b35d508a148dce001063084003000000000000000f630c40000000000200000000000000376f1605"], 0x0, 0x0, &(0x7f0000000f4d)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x8, 0x0, &(0x7f0000000140)=ANY=[@ANYBLOB="06634000000000"], 0x0, 0x0, &(0x7f0000000340)}) write$binfmt_elf64(r0, &(0x7f0000000180)={{0x7f, 0x45, 0x4c, 0x46, 0x3, 0x1f, 0x3, 0x2, 0x8000, 0x3, 0x6, 0x81, 0x275, 0x40, 0xd7, 0x80000000, 0x7fffffff, 0x38, 0x1, 0x100000001, 0x953}, [{0x7, 0x2, 0x1cc0000000000000, 0x1, 0x482, 0x3, 0xfffffffffffffffd, 0x2}, {0x4, 0x7, 0x8, 0x81, 0x5ff, 0x0, 0x0, 0x101}], "601068abba823c406f83362fe3a84905191ecedd710950984678930f0b44bac0b7cb66518ba1206da0bb689b131f9c1595eb84b06c3525fa26d2e970eccc67aa4d74884b11b24192aaac568508cc136a7af076a17baa3a5644acffb78bafe368f5e4af5357ca80121705e946472c2ff09ee1e844649d17ff97bafabb210f4cad4828a1df3885a33caa492ac3d22cc86cb3b93238b5bd53b80a5248dd62baf2b75873234665dd511ad90f46ac681c15"}, 0x15f) 18:20:16 executing program 0: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000002500)={0xffffffffffffffff, 0xffffffffffffffff}) sendmmsg(r0, &(0x7f00000001c0)=[{{&(0x7f0000000000)=@in6={0xa, 0x4e23, 0x0, @mcast1, 0x3b}, 0x80, &(0x7f0000000140)=[{&(0x7f0000000080)="0e6a3d9a1ddd4c4502ba0f227d246e8732ffe584da871670df343af81310bc514464376be37d41306e59cdd7a70f8f8eebdad335369d98bf388f3be3f59d80b92b4bfea5cd9867413bb8426fe793c429143fc41b5f3b566a01f3cff392730ca5ebe93de831a386b08634727a61a2ace16c7a970a330d6da07947a905235d2d28ec6265e6a1848d9bb2", 0x89}], 0x1, &(0x7f0000000280)=[{0x1010, 0x10e, 0x8, "ac3b3660e5e593e64397a6f4b799b64567d14b61a5dda519d6d18b9ae8b4fb663677d68ba05261c567aeac9f30fe7aa7389eecf0915830f52cc4ed88cab83ff5a11c67e4ca20f424ee0cedb6a384411daddc8e5685a92370a5d8e8fe3c7b265ed5ce45403eb8613b0ad39674201a06cbd7fe47eb7ce05518cd8c62fa0597d0813a800bceaed63dca6409aae6c770c81e25e795f0a9e87bde04910012c108a581aec2666afebc48a24a0171b6cfeacd3f12572fe2b44a2605bfc90da368c11c3fac1380c25ed7eb25b33e7b46a03101cb811afb6419eaaed574d1f9952313c1c970989781b70a9ff78b94cdf0676b69d373718dab443f0deef3f93216c95ce60bdda84120d73ccb73cb053c6446a74c5e9e64efdbdc91c1e3d455f88752bdf63183321c548b64292fc1c83abfea70072aefb6eb66ce6254c34ce9228f174cee48eb79467c389e83604a1a7a33c425a49855feefcfbc9474ddb18b29d8d3c23eb42a8009c93c0a1d5b0510456d3e4328397a054754dd1a44ba2a5474833cfedc6f5a3e9bdc75c605a8c7cca12a23834a31eaa8058924034b22a26786745c565b76d7bc99fc37a31c1f674b3c37b8ac8cf438480acbf5a3ee8af6554f2019e6a3b1151e62f8bb6949b51c48d777e003dffa8bf1153ad181550f933a707b2b250c88e2f2fa309f11febe91c5155dcc8ff73e0aa106f04e8eb1ae87197fa7c39ca2066b32a91de72835aa6ead247d146f297f731fe4fa6346245f38f4197c29620787b50966e2abd02334f07941e1c43bee9ab733b951c706c6cbdca335b556f4a315988f2f320fd385b1f074d585f5feed72d5872c8a0e8bf93941df604cfd136550d48c5fd4b54f7bb7745880e1718907a58575e1afa7e223f32d91ab2e223aaa5eb15190e7a73ee0ac68d7f4a581b7a5140d472f2c35a5bc326cb4546ce26279ec4e518cd0a91928392e8f1d29f89d73085365131fa65a13c2f7504978b2df0b62c37d88488357def85d8cca703b1fb27baf5c0aded8118217427f42dc0fb1841a7a97c0c4100f4cba183e2138ebf443317077e2a4191bef035092d7d7667211a501710c04ad9731fcb0f8d04f9291dcb45e9a155e670d2ef4747c508d3f31aed592f3e143d24e6cd89db33abaae2a2e89a2b06d7fcd59a59705e90f64f586045f324eb4715c66fd515faa939c20bfc81786253a74721cc179ab238a9ee1dc09cb1a17a803c7daffc43f7d44a7f4497104b5c3673b667633500d6cdfd39e68ba8ad8a2ca6d14d111e5bc6750959f2a6499149cb75f49fc022d958b670cf16fff918e54c367cbb906064ce6e8199286fbcfea3d2049651df6dac55867f0eb37519e885c2f4f29c4b619d33dbd88bcda1885670bd26663c811084dd20f076e178e0cba4b397fa5deb949e3e4aa666059e26ec28020e4c85c31ee219fb37d8e466b1aed0a741a47353a574e8cc99084f36649ed0b3d02a79b212752ff19ea353543f1d2c093d1c8b0c34b3c4bf330901f2b3ac7a82eb3c4275e00130e2e66e0bab3107b9ce10d90cc18365d1b47dcf4ecc50f01383f03000e14846bdf525739c2c633493043219ca7c73026d0a19e0e0b5b7cebff110b4aec3937b959fa6d0afcd0270d1ba6130c89aa23ca4e4ea40e8d0272bd91f49173da9dee88f11ca78a433ffc2844cec732cfadf2a16a115c0adfe2d519bbdfd2f3c4f347e5ad33e52cf7d7cf5b4912d599e1d56a32453ad97af2dcd7136a0bd7314db7e3ab7e6ce0c26639cad7f7f27aa444747adf427791be142c9c54e9786f25611126fe38508cc9d94530c04f50c9fdf196607d3fc9ac1b024fbe8001291a755bf832a797057b6f8f562ac77654c05985947eb31c6f540ae7b1f34edc9e6ce24ac706ca7f2803e21539a6d1876c3fc210e2763f34471a5b24eb23885e41fa2880cf68c835f3ae4e0592c6810d3ced9a310ac57c3c2ee4e8157724cd5f8eaa2fcb9b3bad775de1cfbce1ed70cc42e45ab6c4d7ebf413a998388573d77b9b736cb121b00dd9b3432a12ed34c1720350f7712bfd981c8e3d67525ac62263b841e3f44859162b09f33814aafdecc2bea7acf28932c52a54272e9efc8d92c285784ccc31e2d71218d841357db57aded720a84332744bfc140b0b26ff4e668e563c76a6710906474f6801bda6bbf1185143282b685d0de651e213c4a92f6ee098b5e7f4cb5bb8e430b5e36da0d71baf5053de2c74cb6f6520c1568815bd3599dcb8896b8ee150c224de6b99f46b3e875c434a9c94abea74e6895cc483fc26f26b349bf3ff0316f2b2d560c63fd92efc79883062d71ef492c578a2b54f80d2be10e388bc585cc49526641a2c0749e56030575bf316d887a0a7ee00fbf6a8959f80060cb8b7d8e51a5bf3644b490110b9882b3f84e87ecc55b6a730ef22ee6d0076035e0cf597dcea73c8002d85a4f6658555e8ab256f29b7ca17fe939195fcfece0993e52a438bbf975f23ffc509a938d59102f7f0fb3026b6276644a73b466f6f4bfa4531bb6568a39f4f4a2328923556890b2499127417a35947e392c076d1eb44081b724e0b40cc7edaea93047980b63196bc5ffea1f3beaaa8c044b442278782a0960f204adc46e2278f52ecb5281481fcfde66e24c853e2f397354955b7f681a55cc293e33b01af62a1f5434b77bc692632537c42df9fcdd7af85bfda5817eee328957eb6f90d3508f8df16f6277f69691c3a0c7934ea304ccb1f552684cd13a222fae158b0a389043aa1c72f02de4217ee2ff60d2c34b6184f6fd16051b4b0ab0fedb1b3c00304acc3b6a3fca9ee113469d172d30bce5cde775253038510b42184e7d2e687989ad4df8101623ee228c058bc15379f692f97a9729d8544ac424323a7fed5e36ae03a547969ae49bf67bc2642cad7f4a60af1a911468b4b76397e547daf3e7e0bdc6ef2e07f8235789736914d37786068fa1cd67826c7fff902fec89e3611baccffdf2575bf92194730c6d30a5b1c5fe8510927deb97b0b648a286d07ecb5733055a09a522762a6fa1fac0dbad07a341d14730bd16424e42da35df18d0c617294833a7887a06f2babf51a58f404e3d6bb64be1db515b0d3df08d4f8fe8bce9d1255c941375edc83c818af37cde4563e39004e8736c8ba9b377a3516f145e9bf02957c57299dced9dae413832de1437938a5bafc4388610c8d76cd8dc69608f970e888e5c137b434dd6ba8375c6e738e759996ca8817a0e245eee07730a22f9293cd7be1aa83570d70ecc72ca274538c8a9ad05c42e669244d1e73b1bd1fb44bbca638774d07ab10a15ee5a3c4a66709950970ff88dc7d503e0c7d60d4d9f710bf8cfae2e0215f9c91fbfaefc4ce5cc7e232448760bc2e01644275f88e70c3bffe379b2d4f70eed1956fafc1807b0459cd7838335ac8f84dea023b1e5bc51046b3f8ff07104be4db16c45fbcf02fff1f1d3c437f2cc9c8f6ae4c8c2a783fe12ab8e2f4100a6a3dc554db06bb662354228006ecff8a8c15d3046d7471cab11f57ed9ca244cb823f76045dac89933424888dd944021603f5e5c7be0da801e4db51ae409e9a133ab0e076f79307993fcaf22abcb4a73ae7bb81477f8ea219b41e171879d43792b71a7f255ddc106d3ecf6449ab1deab30ad40bbe1bfbb4dd56345691375e86003f8f583582884524912b82a79a1d8acb518dbcc5c2e3cc76ab2d00a469e9f201eb1b6078fe653a760c78603f57366d8065660bdfd41fa1ed99b2c7a81c86bdf00e06ee692168b8c2666469caefe0ac73dabc640b13c42d71befa0f353b6b18b2dcfe71e421948856d3257941d0ce772dd74adede158cfef302eacb1ffd62b83ebfe31026741f9785959ec97bc20ad2ca8676a14f7d480da71b96857720a03f26ed3310f3b07b2e4244e63d6c61a773a8f0676c19614f3a96f5a7b90bc752cca2862fa1dbe21702ade5ba96b56c5e54afc40d8fe94bef929368dddc47f3feec05176b8399f6b65c876ff3571767010bff4c5351f95b74ce5557fdd1f9c502468881e4aeefd29f299620cf6dfc4b33a10f624c1dce020f4edb2c8a9b6b2f7fdec27f856a276dfa3f3be939a39a3a34720aa2ce604f597696dca69f0b2ebb38e1f0d773d6f8a600c11640253c617979c9a35a32530ddcd226d876b1200f02672eb41eea5dc3f1b788d3d9c88f19a63af3f5302d3d7e628269624de4e4063bb2af998d74dbd9d80450cd50c9ccfe6384c2756dc048529c6cad0749549d0117ef5943b8580c11ff3ec889ab7463fdb054fb071f3a1d122ecfd7f3528b99356c68b8bf8dcc7e30791e406a9614c4f64f477e966b7ddded670c8f428f0f7379aa7d69beed89626aef0655b5e78b5de334f289791beb6ff10d68810da6c7e0f3b9abcd8d3ec257afa6e407037adf8bab3ec7184a7e66ab6dfd7ba10d71717ead9be547dbbf43c214620aa98da51fb45820d6bac67e01cce9b51013f45a00521d6e71c7292421f3bd2c69e3d4ab0ae8b64ba5ecebc4e231f2f45bde184a97b674c0ff790933b268d69522f7b703f958bb2d8d327f41dbaf20a6bd2d3301da6cf902983cdf1091a63be49cf875daae233b3ca83215ff9953b0f97af1ea7f1772e8852074d07b5b2a69bb552e146cb21f8ce1c36234ff1c641fd52cb08783bbaa9f69c806d806901f3fa7b725ab18cccc6904e3968f096bab93bd771142546234c15808863e7a7ba4520dfe9224e0588b35837d47f0358fd9dfb3fdad714c6c037d83731976ac2bde206d3baac5f3e433419b2d53bef5abdcb9ffe07bfcaa34eb53fd0b6a9e791f428e84ff2987c80827eb0cef950be94e2c0d04f59e126a8267a8560cdcd131029bc2a0119782e7b218b91f7971137d761b4e31fabf3ad27c04aeb8912d6dd073d204911df1fee8b89402a7610fdb5550816ae6e3fd23419e65883b0c4fb204ac021d1ae6f9176da574a72e74a2dead71e0ffb17a789e15e6dcdf741d990988d591fab1bb90320fbb79eb624ec4cf03cf68063ce12da5c58cc222f41078811f5de055d75e008a5013d451d95dbe3705430f81c11019738ffdd2081cb37d2403e54583980d44620c206198461a7df3ffc3ce40bebb06db797d59a224ddc0004841a0d81e7c8759e6b06ab3d27e7b38b0ca3e0cf0442ffd518c199faa54ece08a73dc55d8404a11116f2a3a9a7ca1d61b570da99a1441b8973b82d26976ae82944cb91c135aaa869dc7659b9be085f7bda1f3a92b211e3d4ac8a5d165ec07afd6d425c13339fe3a1a5d274376d1dbacd47ce1cf7f322b637066662fe7ee3dcf1e1764e3758f71a343f6f7855ff5d3cdb3d196b82d2edb5317bfc3e318f59ec7ffa12e0c69954f24a9fd9d278460095eecbac785568fd3dbc9c62f39ebdb57f7816ba5fd293398309e1e48f0af2690ba5cce7d861304910264bd0dd7ea153ccec8ab7ff31db986f422b2380fb14ec87cbd57953efe89f7c3797f09e6b9bbebf84e292d8996edcf728e990a3b658711c01cac617604cf040a15914fd37cd85681c9d009e5c315ef48ca1df51e8341e3f54b350799cdea829f744631834320ba1c52bfa91aa82c3922112270054fb166e3116d2b6c19c1cbf7f3a045e90fb55632239bc160e5d5e712227e0a41feb8aafd5bb28e25a2ae36a96e06b0244ee07055cb160a65cfa8b9f36c9852721e7df9261e4b2569d813a1dc26aa9f4e923bc705cf4e9436cac4b0c3053079e25c89091b3d1bef600729d022a0aeac56b9b2ced9d2bebe58a3488ebb945ec8d79afbb7ac4703d68be12657dacf03a683fdffd89566"}, {0x50, 0x1ff, 0x3, "4c8df4ea3fa9ab306e96589bdafe92ac2c4a5851524e5246f98fbc077ff36b6b347d8aefc8b6306a6ac39395ff50bbff4cde08301dfd0239d40559"}, {0xe0, 0x13f, 0x8, "f5dd897e459c2612d20165e7db91b99fa6114c8fbfd5de779dc013b9df200068d6ae08b2a06ac495e310b1ae25b24549e9a01ab2a75e5417678aed07fc61a8b1a514d3389e3c1db495eb99357037086665edc0481899414ba1f0b78cacd9c0a5791160502fee6abbe8cc008e72d76738c383993ea38b453b2e173385a6c3f8bf58e802fb8bab01dece6439dff063dc239a0563eb7fc8f12227955ea355b38e3e8bcfabfe22fa8db0c6d8cad6c4ace74b1a52ca9bd1c6890579d0cc8c66fc171ac5485f34bf6bbb7c31ea"}, {0x1010, 0x10f, 0x2, "160d36a8450b19d4a8d6cc6b86ceaf2c56478c740c5b6db4599e03f332b347416b25dc9865ff9a83153e6607bd112bc0cc3f6d09d90743cc6f847cd1ab317eacd7619b7e223e70cfb8299ed5c60ec9bb973289b962e20da99655a520964caba62a1cf4d0ce5b87284a18edab2f43f732d0f0be0cb7d705466cc7945c9d56945aa1f579e1e56b78d0d550e88c358e4a1c846b5b0c094c56f468d2b23472729ff4ba6c4fb011fb9e4481fa8e7b8ddfe97555f0854a57206824dd953ffb247995ed0097796195927f887fd1d1aed2f130ed400398eb2ab95f185ee644c31897746dac2dc0ffe822e915c05fbc2ef04571151b4141d59cdbfa33e1df760b6564384d18063a06910f7bcfbd3e97df5bb145cde0c9db0f7a04ca7277f06488ffe49787c751ff39bc0f32f99580f5ddc3365acb3e6afe71ffc4ec32f0225a65af9675670c5933584982b2743b06dc17acaac32bd822baecd07191b7c947e5a655b97935f014bd7981191277145ae93a1fe707aaf2082525edcb5ec0fd507241c9192621630b011ad09129cf3c495112a23a7ca62ca25b60bc76251777e79c774c0a6cc1ba447f15ec294dbeca17da65d4dc3735d7ca1dfdd6c441e82d21144123eb3301dddfde8c46b8c91ac9f168779960974a82eb30afd2cc9ae5ee6c9219c76b337b8e31ba2598047a05916f4795f206012f56792d4e72c08922d843f8fbd27c8bac433375c77c60d3b98bcae171961065171c7d401af7f5ec9e6ac2a2825f23a367f575277e652e9208fd479c63aaf971474e9f1cd6fe69f67d14e84a91af8abf60450f378ad8fbdc06f738828e241a51f298f7ae27e3b838c73bf8c1dfb123d0d9380ecbfff8ea45398d95b26b7505e5d07d7c89c9d4efce6b15174e1bee662872d0cfa18a25884e74fe63572f53f5daf360d015da21145d9953b81bfc4320e65407c7207d9f2c45dd4016bd628615c503f443fee1f7f9d3e414703770b180836151cc9bec595eec8c011acd44841a1d04f29beb95644bff35e25d4e06ce2ebb383ffccc151a4a9d7036d6f8c7a71187b7e7ea3dc472eef8e3d744a3b90892fbbc9ca52a3f4a10040b1c67be85dbbcf1e09cc87dcce7e584b04fcac506eb2cfd66ae95ded5ac767e6b703b7174748f11e36a8e605238c546f0ef420ab4fa1e661e750f9e04f8e87fb6ddd0173bd6209fdaa187e4d465d22fbde56e43e7f25d676af9d2fe3f375f88f506d2d81c90f7f1b0a3141e4603c35dbd2af11eb24f0c8cac227cb645d907e864eb0bf51151483267ddce41a04f11ba3f9658c907c5c85ce74d94295e5cd48999a030d0c7a6074cbf77c1b4f1ee30e40e2526bd121bff4bb618b2bd7ffb0a70e83efdab5658b92b766a77f289b7b71ee9dc735c965eab3b8010f3b6bc278d1b3b7e3370f1404ad4e7db9a5c888b3f621457d24e44d114d342fc66ff29edbfacc3fab1a978963fc7d387baa301038bf9322d31a8e2700fbdcec07a55c385b0ff4ea2b7425f6782768051de45b1a2475c6cd8025439e0a70b9f1425b4f856b2cad86037d8fcbbfc4ebd97a35d11c4820a57fad5cce9b762cce30e174e6134398cba88c7e0daf7587484e739ecf63423fdf2b8a8553740335fe726cb92837496cc5b04c755c8abc154db4c3e53b4afd084fc4c369ca49b10a878761458199c2b17b27818e7ed2217bbf4dffbbc0c16959cc591611082eb77e184cd42c1acdb346a71a4d891321801d0c833a17b916fc97685ff8c189abd802cfb460b011711062b1d4d34a2af8b389e9c5125cdd8d184276ff49930b411269fdcaffc18fcb5d11da32b1435d45a9718c885fa48f723c1a4c03431225bf91aa1189f22a6fc5ff017fa4dfa762dfc8e13af6aab10b90f84e6e2acf0bd108d22bbb67c1ef45ffc3fb79242d0cafc4a685ff28a52e926e64f96a11c03f1e08eb7b8ea62c2e3a821c98d27bfb95ba7a5a94268ac8be43646b9e9db854dcdcb07f5be231ac60f996cb38e6e2d291dc9c75116ca75861dcb48ba87bb9d0f7c4fe612e0caeaeb434b9c2e8662cd637172c43beb4aff5be8beeccbe8fc20bcffd94b8a81b4c6dd3af36b9e8aa2976a7da079dc278499ec88c56f39f19563c28ae13fa5adf245e9e75598572d6290f59e69e2f0e809c987ac5028cc45c276163b6878e71feb317a842aac5b1ec7a0c460d6bb5ee5169e63ee072c99df42c9e82751d3a54e307a437a440193a9e2bde0887a1424910c8f91ac5db47edaf46da991d4d8380e24a3206837472bc064151ce1fe5b620a9751d9a6809f5f540f6590159c101eaa5b59897cd7e693139053c57c8820568a40a405c3e7341bfbba59689bccb6637803e3014f69e746078c93c7ad354e7d7510025f78b2e0c91f66718262fe71d2f12bef297f747e1292e7f3760c374c35cf776e48fc08cda7868138994d29d5911ff9624ebd1cf8788570c40196f731bf0e69eeb3d46f166991424aeca2bdd3d8c44d4f2c6ffc5b3b94f65cb88a36a29380fa31999e96251d547a982d993a7a8b685e1d22a1487c407ebdda5d045d7f33dcffe6ed879bbf4820af28b0464b4e9ce3b358600fca3b970a841b5b1b4052a46e81d2f6d4e90d7819a96fd67a45fb411fd71791a9be63e09b272810591d0d77d45f4971f839bc6e9bb4fe46d0f324fa3eba9369d55c51bd0280249a65703428e63055a1819f998a5447c1762175a3c26f2a634a0222d74c1548b5cf96985aca13e2aef3bb5eedcd29b37d51d83a580933f22ef6be75f2985b62373b7ead66d0c57b7dd85066c414b4afebe5579bef051f323a52f01ed15acf453b9340f3d318facb85468404d6e2540abe91cd9decf0e2282ffd4c4022a5d7be6c68b6690feaa23ad46df7b8b6e2f73205d8077148825e6ae574e43ac5ac8021de0aa05e7666d667ba06e18e13643c9f79da364fe701e7a3dc21e1f33a4aebb71aa650c02876207c9fe0257f032d2c6e47a53c5ae50097b46bba4b6d413bdaaa9e0e405d35e34ae85fc4e2d18aa9a2123d6379d1052d6206dace9ca595da353b795f1d8c510a10dd1d827002f531ffcb684cec391582596173d0e68333426d12274af0369934ceffbc0fa8b7a1b24083f247a46fd069eeb603172b028aae323fd05e4f339c62a084cbd5765ed447a7c0f34cd78fcc112b1e05fab036fad7a40875676e78f17945c438fd392439cd1528aed660f7564b1bddcdd4af6b4add6ee7d26bc71b1b6200e587a8b02d0a420c4840ce66273c0116916354e176cb49c9eba8111053a618faccb3e17db1e24b2db8ba2b3475ef956038b57723d90799d501a110d2680ff56bd556b091f85ccb8c35a4bc642498ecc370a80fdd80ba97238926d2dbdfee66fbc84d0951718b95b572d73848bbe89d42680b000c5e1109667d6f42c1f905e12c49f361695beeb58a5eebc0ab6b2834bd693d2d4cac9a00b51b27838c3fdd84032c5748b9f3fb4cecdde8a18fec77b80ce69065cd0b983cd968944b64b2e6a5c93828fc50e77025623085a152732edb1c34eea131c81bd6c7cc5b58bd0cb8b34281c0879949c14e1f667e96dc113a60a3a80f3b2011704e16cbf8446ebbc16a2ec9d188339d397491eb38aba61f254e542edb451da2c665a44384bf7ccdf7017c946ab4baa58a7ff8b4d0ffacff59c64a351ea3004e0cb191694cfb1e078dea61e57e3a7bf9bb5ba494926eaebf58f21d9bd3a3f1b49d348af89e5a25730f3a2798dda0c79462b2c929622e4324624cd1e03d3244161d0bb7937d7796be21bf05fc6eec8f20c34ea8e058a692a8fbec84096ad554a3a6d96ca4043c80d3e149b15d4a62ac4fd9c76efcc063de724074396fe6a3b6fb2fd5f78aeb29ffc5d0c1a16baa733657b53b4e17cb0d1d69df49aba306c4a2e5c1a660dc8fa22da47e3fb83ab75fa427f91ba22f184791d38e1114b651a60acd8c2e6047b16fcc7646085f60b7b7f2c1c3b0d208129db33f25af2132e0fc8bbd4b6bb3624a88df4282c6d3200352a4f1e96e2697905c4e48df2320828e1bebb47d2f886d1c3e789e799e8a823358c8391b22d93f3facf37553a8c72eb92ea6c6d62a4377005a8ac92259d7a44384d1fbf6aa7dcbc70481627425cc8aecbf1693dd2c9d723b7281ea3c5d1984c2bae326614bc471bfb1ec865381f8bb7491c696b9994f49f12a0fa19e66c2dbbafccdb16f320f1160696118c0a5b9596d27e367e7fd5095ce9c42ccd83b3c877837144290e448cec233e4e763122aac6cb6d248601cb8be598d06224b0c929f04701f909b4c054c9c3a0e56d93ca8f667030b3e28af36c9b3a4876e57923e6cfe0b9a051a780b48e9405b432f52eff0c584c38afe9c196654764f99e4eee8492e31e3fbe2ae9b38039dfc0d1e9ffbc2c1351abfc8b03a81f04d6806fb21a4e1092864ac029c960603f850b2fe1c4699bd5369398831edd283ae68b4df827298b7eccbdf3a68167c22a679af187687b3ea602697619bed018a44d27864f1b9373fa765a112d6e16d72e872dbb187923728c209f0d7f2b4106dddb97a70b46776f5ef8a82f15d2de2b89fea6894bb01967eabb06ae5fa2bae6b86dd7053e73d97fa34bb4519b126b3c312c0a518a91b7ab9bc4e324e4778c64659f106a7690f9899fbd6959709fc1064eb35010fd015fd745814c56a08f00a881c0eef9f8a99f2591453e50597abf72d9216c7e39101240fb507c9db1103f772e8062b05d1bd9963fcdc78c54db4e57471e02fe29091ee0dd017a5a2428a2bdb31417a4dd7d9b221665d13da6be052c98120f61810d8f68714f5f0db63e44775d06f96bb5d7cfe51b0152cea5a3aff6f37ed8d6400b4539542aa164aedca600401e9fb75ec978b058e52100687327e5dd98cb19c847448522a5ce2d19b43fdacea86eb793c0ac58ff0fc2512b132f4bc60530d2338e320a49bb661ac35d42d3c42690cc16b60451a50a7a61563c5f3b2ece8519620722a5611c79972b623612545fdfd02312ede349de3af7d12b9377833e045889f24832a5f91902ee753ed3b738dd368d1abcff9420983f87a195073ea35cf9459e4061a3c7b3ae2562c7a93705eef022019795c24f898ae24dfc52a56d06a3e2f7d2a5035443d947e0b0e727a942c3c7530955e2d61b2f1a78f2666e9871ab6f5cd40b52da485c2103494f750ef7889567cd702221a0f69e7abcd88d1149ee8aa4d4283143b14c903c18e76bed1d27b4c49e285783e8cc5e626cefe000f079a70ae59c1204e1ac1400923ccc6df88d341657d70b7d75f7f67a147f6fc9d8408bfd6c719f92a84560083b6a22515338f95d19b0d6f7bf0cac2b1f7d4b6f28182491e4ba540e809420264503785654c435057b2d2bbb2da6f5324964a9820af84946956a13e8ebba23222271531ad51faef161a73b5e183ee5cc90b8d25dc218f69672a7ba9adef7d232884d6505a88b7d2f0de3bd58195eb0909ef8d541577981e9ad336aa5746df26ea261f1c5c77d34dc8172626cadc46918f70f9a77ca3fc5172a4ed72f3ccbae1b1174375d826a550e826550813aa1d6e0862270e18d20a8a7b8c8c09ebf5206cde1db58ffc196fa644b13e5f8d01617de8350056eeb4620c3b57b39d1ee0cf4f1202ff3f7b5cdf7422d0bf1f332885a293d3a4edbcf898ac37ed9266a8b2c263af1718659358e285be27782f2614df91fff2ed90b3793443e966deb786c5de9523b5f8bdb1676e1ad524daf851ee917581c229c43702d1b798aadc2e9e8375b350d180d08499eb8e5af9479d63a16cd526df87693fd089de10ba"}, {0xc0, 0x187, 0xa20c, "817a2350c2524217db71bea2f0a82afd46ef036ef44c0f6b2f348b5217a9c6fccf70195ad559995e6259ff62e517f8d1f376b7b7f9c39a7ecae4877be574a8216be7f7f6eb46d432250278456d7f89570362d043f60049e99bd285fd1af22304d8b184a1991a0032097485f93a49edd194e6839c217f6d8c5bb094832a2993a29a8414500f885e7678eb865a3152adb4d8fe63a4f639ba378a249466464e15833a0fac75119a6e3138e82c047c03"}], 0x2210, 0x40051}, 0x81}], 0x1, 0x800) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) add_key$keyring(&(0x7f0000000200)='keyring\x00', &(0x7f0000000240)={'syz'}, 0x0, 0x0, 0xfffffffffffffffb) 18:20:16 executing program 5: iopl(0xfff) request_key(&(0x7f0000000240)='keyring\x00', &(0x7f0000000280)={'syz', 0x0}, &(0x7f00000002c0)='vboxnet1\x00', 0xfffffffffffffffe) r0 = openat$selinux_avc_cache_stats(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/avc/cache_stats\x00', 0x0, 0x0) write$P9_RREADDIR(r0, &(0x7f0000000040)={0xdd, 0x29, 0x2, {0x1, [{{0x30, 0x2, 0x7}, 0x9, 0x5, 0x7, './file0'}, {{0x4, 0x0, 0x4}, 0x200, 0x9, 0x7, './file0'}, {{0x80, 0x0, 0x8}, 0x9, 0x0, 0x7, './file0'}, {{0xc, 0x1, 0x6}, 0x2, 0x7}, {{0x80, 0x0, 0x8001}, 0x7, 0x8, 0x7, './file0'}, {{0x8, 0x3, 0x7}, 0x34, 0x9, 0x7, './file0'}, {{0x1, 0x2, 0x2}, 0x80, 0xff, 0x7, './file0'}]}}, 0xdd) [ 483.891079] binder: 32544:32548 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 18:20:16 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000300)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="0563044000000000eeb831c08b011e11211ed53bbe3beeb860915bbf139a6bf1f41bdcdc4a9aa4c302c08f91dd6da2d6f629478fd2569ce5cae79ef0916e7e9f6e64b35265ceac6c12d9b03b5d2db11148a4078e6cf210e36b4f8f9abd2914ab7b38db548b3e80256ed8710ba77fbfbc6171fad712ac3fa65de3d675d39bd32128fbb6f9e150461afc2ace42d935eaf44f78b576216a3df38d774fc4841facc3bc5c80dcd0c9809f5da8114f224a643b029dc24a46b053b780f885753d19248436e8"], 0x0, 0x0, &(0x7f0000012fc7)}) setsockopt$netlink_NETLINK_NO_ENOBUFS(0xffffffffffffffff, 0x10e, 0x5, &(0x7f0000000040)=0x5, 0x4) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x0, 0x0, &(0x7f000000dff8), 0x0, 0x0, &(0x7f0000000f4d)}) ioctl$BLKPG(0xffffffffffffffff, 0x1269, &(0x7f0000000080)={0x2, 0x1, 0x1000, &(0x7f0000000f80)="236e760ed2e51ea0004a9fd513c2e9337b96a232796e11ee6f927c3796c7ae4b97896fec796053b0dac4fac287cdc873088c3cacb13f1e2e95305f0e30721cdae3d06bce445b00fc4d79c4ce875615a191424106ba491a9d44b02a487f827e8ee3a89f3536f3e132ab621a525a2d4e9a21561224d36c08ef41fa7d91945908cfcb25faa22162dd9ef25215d150312cedfcdd2fbf6df75810431fb52c2671cea4f2b457684c6eafa91024e52bfdfc37ed3fa451cbc28e59c6ee1c0e408894bc108cc9fb515ad4f2199b3617b47d281f99099456c5d12f4fa28b4914d07cbe312dcaa24a889e4a7845a985d05b98f7222542928c865bd456af6a10e03bb1e96418616908e683c2aee55f8deebc57ee16bd685865925b5503dd25779a9c189cef15fceeee207907b37f1193bce0b329c637202de0c69af1179362685f4665a3c802cbf0e442b62838ec16cceed6c612418c640595b502e03851a934e91be763a50449ad7e03f1a29c5e6708a373768cb584c65e6276e7e655b22dad7590704b9f4a4ef126205652601d8a59398cca719c4199b63fefef797b5e55474ae0b816f206c4508905df95b23d1d3cb98e353b469c81de5ea48fdf0f88873a046c82e8fbc3757b8074914c82aebd34f22915bb110f755963f1dfa6248f58370504738f7912c9cef5b600e1197874276c4da29a9993dfaee06bff809453d91105e64d8b5dc09f3249cad7ebe0185725d52db0bbc4ccb63c8143ac1fd15d844541318d8b89d9d5e26790190f3b3fe04caae9f97671450e17f392005f510db2f5e3db8ac13969664751d99739fdbc3172f93d7f9d0fa26518e242326d2dc6a0b301d141ab9765fbda14689b2080399c4909fdddd196219bebe0f77103910bf1e3403a3a25d74d0e354adbd63b973077286ffc5e38bea7d68b9ed85f7581f54ee9676affe64c80120585834aef75c9d81916d236ceb783490556444ef932f6ee48843910b3ca2a45211495977111baeaa28c5e99d0821c1988a053e1993bc3a83ac687831e8add3570fc8554bc4417e26e095535a07d75f0f88d62ae59f15d97295392be703e8c4737162ddaaf2aa478bf3d03e284799c64f0fd0b5930b2ce3566665dc26ccb5196b18edc179f386c949bf9be5aac24936e2ba839bf69b1c688f51c27a82aa33ce758a091dc79a5fb9282517cd2ace67cfcf2ceacadede967cc11aeaa27e3b6710c6dff6604e1528d538f6f58bf5768ffbe606d6fbe9ffea5b036e52199cde7930f890c5aff2583a39fadc4f463005cf87aeffce4ccedcef999d66ed5a0263a8998bbcd5500986198c23dbf2e7c4073b086a8ba886383411efdc134fe35dbd20131c70948e7ea589aff91bbfac5c6389089a797fb7ced233f685f32fcaa391bd10e3fa8f6a641b7c51ce1c791f91f5f2393745febfed01b9a5e2c4ec16c27a641c57afd6cf761960f9951b889ce050cc06ba6dca50ce937b2de7d2bc0ecde47ef18e5658e58dbdf6f03288f7b18d37b41aaf9a36d823c2f91a4999f6d4ed3bfed6163e2a91ad9e126eef443bfc141bd83eac8c49f1270cc7f0c98699e08306d85af45bda5988e06418da23f5e66ebb06cad8eb0ac85d63ed7d294c0fce349313de225f0877ef9dedff25b20df980b12f5ab031b0cba5132359882894eb59c6ac23fcbc8931ecaaaff6b9214ee72afc9a0a27bfd00c22d5e024bc30e01d913a66e8a9a1056a8e4bddd6707be12cfcbfc6dec12bf7b4c78f64a7d40cbf6209d1447c6d4826e36131e9b67d75b903569e1f25cad17086b283706af844bc77745a0712819f7aadb7399f3b375ff849024abf0471cbf4c662a5885571d8bc83c983051e17f3b74161da421556bdcc5916efa6178b8394628939f88aacaaf1299a2b0b1b1a77ef72ac75311ffaeefd50dcb48b0e6efc691020c36794f4187022f00cd05ba01f59e4f3c15453f4a9b4c2281cdd176ac5116d64b5d3ca8f4ff01cb313c461e3c6ac84cbe43d272cc531aa908dca0698a5fb0f030c066d50f82c8093b48fa4d4b94f885604cc5b8eaff5bfb9b1966b50e787580083277111a3c3bd12821d50ea1e102e215bab191ba1cce59411364cef80acef5a78a6e144d2858dfb65f0cf7f86cbea0cf1c95f841342ef67c958e36c3b94f5b050cb771d6acfbb770f379ad2a0218a1cdc0f9436eb2c808eaf52619e3a15a2e1c9297b5e87334606225dcb75165a637bfc457161218508f7529b9f9797bb7623a5d0c81876786ffac4009a121afe088e059bc69725ba932f9c6442511927cc74561b23e4e705cfdb40d0e2ae45cbef2991cd0cb07cb55073cc038ab97a6018887eff4c26b0b882a6a71e5b7db3ba9f2b5bb6064387018d54773e73fc2a9ec047c50e86c1239a1ee69f63e034b347a89d256ae5b18ce440ac6bf33c211eba66952df595d2188078c6821c8ac72b31104874abf195179a3278295cf63bf4e67d821ec8d4652b700178b7ff68abf7f89c7d4877cc9352cc164f1ab0a0f1205270fd205b5188190eacb613fd55afe56d7190604784985c51fab801095f5ab2bc545ffd00bbd516f8bdbae5880c02a3a4a3eebfaf99e74fa42005cd012ee76ccb11f2d094297e20938eea3bcf08d7be7b2ca80d5c5e4dc189defe09e9db6b9291b08bfe60840b539d3eed26bef5e1cbc6ef0613814273dd20080a8a4542ae931c2e84a1e73ee56d008ee378ea2b8e60bbd1f2da8445f9e309cf624cbea9ef022633d913d652b144b09bb86f8248ebeb9d3b3578d50965ce8476c3719dd2dc9dc3787c04ca6f0e21bfe44d8cb7a34b8b03ae37e971ea3f96dab89593a9875fd898a5c61c3f3b4195244d563c8b40bcd879a261bf45f59996d6108f42be880e96f70b9883a5c8b4cfe35fdacecf955a40b8a875b97bd9f18dc8c86e5c8f4e3d274d7e04b7d169386c19748cc551e37d7ad0dda00b162c6d91fc9cdef122779caf82ff1c95a0f47c7ccdaf95f69c80b5b356c803bc30184cc11ffb58432f3b346ca43b7d737479c91d8d00de25a4cc8b8d1cae8c8b92977f27d41bde4f985d3ff77ea8a83f9eefd9a723263a6845ca58f906882ada1358606a7607d17f1871b339e6df87d3a29ccc7242f48372d6d0b4dd1aa43964da7d886bd7e0382cb1d35213b80191409cc9e06b8e5fc7a4543c28988ced0a39017aebb37223b05117711dbb939c1d373598aae819716fb3ff273b0a77b3f18c2272b2432288b484a0876b4b98b1677036172933b5bcaff332e34b563f94310369575599009fcbcdfae0b404a74dd67b5f5df281f69f4a7ad746797e4785e2b0a97670c29e819de9bb9dd853f862fc78df7b47dd937544de59ce7f954c00378452344738931cca46a79db1083443f86f0dc8214b6dd61f5598cf1091ee349bc5081cd61b183511d784ff7f37d16cab9d4777be77e59ef1665b9af0d4ab6d6847d9762f7dd728f34b973d27241b0958bef39188f3f95033a087e0303e569eece421e06e5641410e7d5e4263568d9692a9f8d5d1159ab506e71293af28f2ce15129310a7107398ea1cf702df34c7019ef167e6e7fc3255ac9a7c95e1d98d9666a17d2f8ba4b78bce1e5dde39513e40c7d7eed3b772eedae836cd9c72f886de3a4c79abd5adba792e3dd60f810eceab98fb626789057d5e1c8361466bc7b2ef2748659ee4cd4a9c22f3f2272f02141da211ebfb0ba50fe4be292a786652066a22326e79122dee22b7f36668656690d493ed5d07043a986deb89ebf1de69b0aa0d74390f45fa03cc229e93d5f66e0ff2ec7d2e3088ef8f950a73cb027a40158177c1b9a519bb04c49023ede84a83d3c7f3093c45f2fd2d6d2f9fcc4ce08dfc1eb598d7306298ff519362dbbc5cd469d412615deafdeb671f76a339d9df70051a223541680db53179049f34529b1dc1aafda3f26cb7ca46ae012fd7500bd5cce1dbb259d8515df403d4b51c3fdfc8a9156a094e49a1dea93b0ea4ef02bb440577b5a255673f9f5316f7aa0a2fa03b0a182ed7166a17640d722d8279fea81dfbc8e4aa664e2afb392daf23f48ef20f53d0165ce100870e4eaa40122b3d3196b61599c4949e3e2e2db4796eb095b40f136dda584987acc7da8e25eae6a1bea50ac1d7fd44a2a014ca642be66a900685a797256cc23b913c895e4709d51d443df3f2a395e39ef327611d7ec601a36662b301fa573d0172ad2059a2f9f25d7d86940b4c554d837e8609e7a3c72d7d5514c1e47dc350f88bd06f0ea73c21fc5e4b1905991a7e2406162078f70ba2a901b0eca0b779bcffdff34432ef503a3527368b29e2c72a21ea8ef349e9985d0e7416ef15a0df43d2cc5abe37b46ca55c6e366795f99bf9ac9fe31fa7b85cf7525948eaa821ae88268cda5459fe1a3da948a2f92f3ab1e7bd8a8afce79f148559337f1f8aca4c915e3a5d50d5c82bc9e6587f95ca71938c7cb53e9a1cc89df0549e7fd78ded78a85c011d0915eb36fb339e3add4dba44041f35674108cbfbfa77b08d5093cd3a64cda81d62e6e79d2cd657c964deef9afbb708dbc8bc524931041f584b96048f80ff44031c2f46a93e77f56cccd53468c05f2f60dfe84d095267c41e6b27f8a95c41be16f3e5619fc90bd715cedf58b6d296f28f9c81ad4b02285a6e3e0572c75b070385ab2afcb20e1cf927326472711ec6bae4b7e456dd4874b90afe8e332f0d2d1f17fc12d9b5e54d8c6025a4be780fb66bbbbc519a80190220d81a79f75786f787f702965ae226c6c25e630cdd631695dbbe5358f9327cc8c71a4de6d33d2eaf87c1390e176664813ef060fb3d1414e2ac2e61359ae45ba9af01950fd3bfdd2e4b6e7998c1a790bb9893e79d3042dfd7eb542400bff566ab6e9852fc14c0be1b7332d96e8b45eaa285bc56354e33888fb8e14b021aec1c1ed5bb997b3bc09b72c5477618de7d86629ad56dd56aa92dbf2d71b7858df74ef27708da973d8df07d1709fef5d333bb110ccee033253d4bfc56887b2fcbcc2fcf817eacf43c1ae263d38bede38b725856665e50d1ab66664e2e74a329f0fe55747fac293cbbaf729163eb3e6ade592ac60b5d164ad370b28bb318ff9fda07233a625e44a3680f708b86daca538dcc8c674d49dda384758b8d0db87ff991fd9b3877bf0f1a868a62e6892fe132b93367940f524430be0d5f192e7b1b12a66464d8981e1601ca80f6e14d5a6615924030c9e016978e9bcd5c6d116b1621e5b909f9f4833c193bb8795cb23fbe222afdaebf4e57c78dbe0c7e38a6702a7873009f1e21a5471071df81c2dd19b7133dd4c2748e7b860b1eb84d50a15f643ea6ded214d272635b4e02f53edc2687a2cc892add3d445694eb319d25d45812bae1ddbb6b9e5d62ad7d8a0af419b96f62bce8a28798e65d8c8f27d1fb3fac38402ccc8667aea1f465612c65aa413a93e9d32f665ad14c716d958c0ea1f243c37b6420b0fed466750ee43fb260a2b70e513f93030a50212dad6a4a96631b235c679e9fe4e6d57b4f506adf7c9f02a8e36cbba00a945fba13718b95411dcb4104481ff1b820af0de0775fcb3a6e212a9de4d88bb1f148cdb2c489da4762acf9bbf0a5ab426191fa809ee622b4e46423f161040c7fcc585790197c424e550b0598b75497c675c98c4e9abaecac0609df8e31ded791ce1e9290843496c22de14e4f5207898e7176237b59caebe688bf1ae825e6478a7ab8ca0f939e2deae092f02747982324897580407b55a95d1068bdc69e00dc703127e482a0e10609c3d564cb7a4ed90778432261895d1a9a9732b5b506cdb32f1"}) ioctl$EVIOCSFF(0xffffffffffffffff, 0x40304580, &(0x7f0000000100)={0x56, 0x6a6, 0x0, {0x76, 0x3ff}, {0x2, 0x4}, @const={0x8, {0xfffffffffffffffe, 0x80ec, 0xffffffff, 0x800}}}) ioctl$ION_IOC_HEAP_QUERY(0xffffffffffffffff, 0xc0184908, &(0x7f0000000340)={0x34, 0x0, &(0x7f00000002c0)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x8, 0x0, &(0x7f0000000380)=ANY=[@ANYBLOB="06630440000000003a4605e94fd2985fe172c7b7ed5979fa603d1cbf5c6c1d68c5b2fa0290c1a02b43ce39a72f9948571fa0b0ef616457d3"], 0x0, 0x0, &(0x7f0000000340)}) 18:20:16 executing program 2: r0 = socket$netlink(0x10, 0x3, 0x4) writev(r0, &(0x7f0000000000)=[{&(0x7f0000000200)}], 0x1) 18:20:16 executing program 2: r0 = socket$netlink(0x10, 0x3, 0x4) writev(r0, &(0x7f0000000000)=[{&(0x7f0000000200)}], 0x1) [ 484.024171] binder: 32555:32557 Acquire 1 refcount change on invalid ref 0 ret -22 [ 484.043301] binder: 32555:32557 Release 1 refcount change on invalid ref 0 ret -22 [ 484.051971] binder: 32558:32560 Acquire 1 refcount change on invalid ref 39321600 ret -22 18:20:16 executing program 3: r0 = syz_open_dev$binder(&(0x7f00000002c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000300)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, &(0x7f0000012fc7)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, &(0x7f0000000f4d)}) ioctl$SNDRV_TIMER_IOCTL_PARAMS(r0, 0x40505412, &(0x7f0000000000)={0x4, 0x5, 0x8fbd, 0x0, 0xf}) r2 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./file0\x00', 0x82000, 0x52) write$evdev(r2, &(0x7f0000000180)=[{{}, 0x5, 0xc3, 0x6}, {{}, 0x1f, 0xfffffffffffffff7, 0xffff}, {{0x77359400}, 0x12, 0x81, 0x80000001}], 0x48) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000000c0)={0x8, 0x0, &(0x7f0000000140)=[@release], 0x0, 0x0, &(0x7f0000000340)}) [ 484.083532] binder: 32558:32560 IncRefs 0 refcount change on invalid ref 1 ret -22 [ 484.123145] binder: 32558:32560 BC_DEAD_BINDER_DONE 0000000000000004 not found 18:20:16 executing program 2: r0 = socket$netlink(0x10, 0x3, 0x4) writev(r0, &(0x7f0000000000)=[{&(0x7f0000000200)}], 0x1) 18:20:16 executing program 0: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) add_key$keyring(&(0x7f0000000200)='keyring\x00', &(0x7f0000000240)={'syz'}, 0x0, 0x0, 0xfffffffffffffffb) r1 = getpid() fcntl$setown(r0, 0x8, r1) [ 484.135111] binder: 32558:32573 unknown command 4219654 [ 484.143189] binder: 32565:32570 ioctl 40505412 20000000 returned -22 [ 484.155941] binder: BINDER_SET_CONTEXT_MGR already set [ 484.174794] binder: 32558:32573 ioctl c0306201 200000c0 returned -22 18:20:16 executing program 3: request_key(&(0x7f0000000240)='keyring\x00', &(0x7f0000000280)={'syz', 0x0}, &(0x7f00000002c0)='vboxnet1\x00', 0xfffffffffffffffe) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) fsetxattr$security_selinux(r0, &(0x7f0000000000)='security.selinux\x00', &(0x7f0000000040)='system_u:object_r:etc_mail_t:s0\x00', 0x20, 0xc774ac481ded5b0a) 18:20:16 executing program 4: r0 = syz_open_dev$binder(&(0x7f00000002c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = memfd_create(&(0x7f0000000000)='\x00', 0x6) listen(r1, 0x4c92) r2 = syz_open_dev$binder(&(0x7f0000000300)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, &(0x7f0000012fc7)}) ioctl$ASHMEM_SET_PROT_MASK(r1, 0x40087705, &(0x7f0000000040)={0x2, 0x6}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, &(0x7f0000000f4d)}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000000c0)={0x8, 0x0, &(0x7f0000000140)=[@release], 0x0, 0x0, &(0x7f0000000340)}) 18:20:16 executing program 5: r0 = add_key(&(0x7f0000000000)='encrypted\x00', &(0x7f0000000040)={'syz', 0x2}, &(0x7f0000000080)="8424df012958d244c24d792e02d6a78beebe1b9bec7d3b5df6bf16d807a74444cb3bde691f610c676f437e5e57e5d6dcd960f5ebb3e7538bfe7134e3c47987f7f2f5a2df915ac3b8830b4dff5e4f8306f31f76e64004e300bd3430dc69069b166aee3a5aff10f743d8cef2f1758bac24f2f81a388b2e5621b36cbb3e196a61aa941076d02b54d4009ba6e16d72d5a9c33a2aed2caf69da5d4b9b3bbfbac0ada268fc2143edfa6a09342ea5930395d5bbd8b0fbb521a42eb2ff6f38628b770f13702f969c6d89841a0982615556715ca54be30bd89a058932e02ac39e318113031676bd6ba0474ea1c5d03d3fc7d90fb0b6c7", 0xf2, 0xfffffffffffffffb) request_key(&(0x7f0000000340)='rxrpc_s\x00', &(0x7f0000000380)={'syz', 0x1}, &(0x7f00000003c0)='.lo(]\x00', 0xfffffffffffffffc) request_key(&(0x7f0000000240)='keyring\x00', &(0x7f0000000280)={'syz', 0x0}, &(0x7f00000002c0)="0f0000000000000000", r0) r1 = creat(&(0x7f0000000180)='./file0\x00', 0x1) r2 = accept$packet(r1, &(0x7f00000001c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @random}, &(0x7f0000000200)=0x254843144085cd33) fcntl$dupfd(r2, 0x406, r2) setsockopt$packet_fanout_data(r1, 0x107, 0x16, &(0x7f0000000440)={0x7, &(0x7f0000000400)=[{0x3d1, 0x100000001, 0x3fd, 0x6}, {0x3, 0x0, 0x8001, 0x7}, {0x8001, 0x8, 0x7fff, 0x5}, {0x7, 0x4, 0x400, 0x26b}, {0x100000001, 0x7, 0x2, 0x5}, {0x8, 0x4, 0x40, 0x7857}, {0xf7, 0x7fffffff, 0xfffffffffffffff8}]}, 0x10) ioctl$sock_FIOGETOWN(r1, 0x8903, &(0x7f0000000300)) [ 484.176685] binder: 32567:32571 ioctl 40046207 0 returned -16 [ 484.177186] binder: 32558:32560 BC_INCREFS_DONE u0000000000000000 no match [ 484.177193] binder: 32558:32560 unknown command 1392510213 [ 484.177202] binder: 32558:32560 ioctl c0306201 20000000 returned -22 [ 484.177857] binder: 32567:32571 Acquire 1 refcount change on invalid ref 0 ret -22 [ 484.178803] binder: 32567:32571 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 484.179000] binder: 32567:32571 Release 1 refcount change on invalid ref 0 ret -22 [ 484.296181] binder: BINDER_SET_CONTEXT_MGR already set [ 484.311098] binder: 32588:32597 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 484.318394] binder: 32588:32593 ioctl 40046207 0 returned -16 [ 484.360468] binder: 32558:32560 Acquire 1 refcount change on invalid ref 39321600 ret -22 [ 484.371351] binder: 32558:32560 IncRefs 0 refcount change on invalid ref 1 ret -22 [ 484.371710] binder: 32558:32573 unknown command 4219654 [ 484.371718] binder: 32558:32573 ioctl c0306201 200000c0 returned -22 [ 484.391863] binder: 32558:32560 BC_DEAD_BINDER_DONE 0000000000000004 not found [ 484.400126] binder: 32558:32560 BC_INCREFS_DONE u0000000000000000 no match 18:20:16 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000300)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$FS_IOC_GET_ENCRYPTION_POLICY(r0, 0x400c6615, &(0x7f0000000000)) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="056304400000000016b9767a4a36eb234c02d86293e7f9b02c56a1aa32b039fd43b0e0866a9cd5eee3228716f8b457d3b57ea5fc42bab454a018da739efb87ddf00367ceeb27664a0df18b5c6cd910da8fbf4be71ff5048926be3c2ed76497f6c66993524ed8d92ecb66d5b45d7b805e245b6e1f07852e05d93bdb092d040c31ecb60569d1dd9c1a9962d8f20fab03923ac4e43cabdaaa7ea879c54928de850615548c5c143dd81bd88bd25c0419f59b7b0cb31d09bee9e8ca2343a13276f3bb6e4d5fa10d54b2154d18b98dd9ffbecd55c48c39453ac7f9d529482a022b17e15be1"], 0x0, 0x0, &(0x7f0000012fc7)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, &(0x7f0000000f4d)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000), 0x0, 0x0, &(0x7f0000000340)}) 18:20:16 executing program 0: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) listen(r0, 0x7) add_key$keyring(&(0x7f0000000200)='keyring\x00', &(0x7f0000000240)={'syz'}, 0x0, 0x0, 0xfffffffffffffffb) 18:20:16 executing program 3: r0 = syz_open_dev$binder(&(0x7f00000002c0)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000300)='/dev/binder#\x00', 0x0, 0x20000000000) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, &(0x7f0000012fc7)}) syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x800) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000000c0)={0x8, 0x0, &(0x7f0000000040)=[@increfs], 0x0, 0x0, &(0x7f0000000140)}) 18:20:16 executing program 2: r0 = socket$netlink(0x10, 0x3, 0x4) writev(r0, &(0x7f0000000000)=[{&(0x7f0000000200)="580000001400192340834b80040d8c5602067fffffff81000000000000dca87086a5c000004f640094000589", 0x2c}], 0x1) 18:20:16 executing program 5: r0 = request_key(&(0x7f0000000040)='rxrpc_s\x00', &(0x7f0000000080)={'syz', 0x1}, &(0x7f00000000c0)='keyring\x00', 0x0) r1 = getpid() r2 = openat$null(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/null\x00', 0x20400, 0x0) lstat(&(0x7f00000005c0)='./file0\x00', &(0x7f0000000600)={0x0, 0x0, 0x0, 0x0, 0x0}) r4 = getegid() r5 = dup2(0xffffffffffffff9c, 0xffffffffffffff9c) r6 = accept$packet(0xffffffffffffffff, &(0x7f0000000680)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f00000006c0)=0x14) r7 = socket$inet6_tcp(0xa, 0x1, 0x0) r8 = socket$inet_udplite(0x2, 0x2, 0x88) r9 = syz_open_dev$sndtimer(&(0x7f0000000700)='/dev/snd/timer\x00', 0x0, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000740)={0xffffffffffffffff, 0xffffffffffffffff}) r11 = perf_event_open$cgroup(&(0x7f0000000780)={0x5, 0x70, 0x3, 0x6, 0x4, 0x101, 0x0, 0x0, 0x8, 0x4, 0xfffffffffffffff7, 0x1, 0xfff, 0xfffffffffffffff7, 0x4, 0x3, 0x8, 0x617, 0x9, 0x2, 0x9, 0x3ff, 0x3, 0x4, 0x6, 0x4, 0x80000000, 0x7, 0xfffffffffffffffe, 0x10001, 0x0, 0x101, 0x0, 0x4, 0x3, 0xfffffffffffffffa, 0x17b, 0xffffffff7fffffff, 0x0, 0x7, 0x1, @perf_config_ext={0x5, 0x400}, 0x4002, 0x88, 0x800, 0x7, 0x8, 0x18, 0x4fce}, 0xffffffffffffffff, 0xc, 0xffffffffffffffff, 0x1) r12 = openat$selinux_checkreqprot(0xffffffffffffff9c, &(0x7f0000000800)='/selinux/checkreqprot\x00', 0x200, 0x0) r13 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000840)='/dev/loop-control\x00', 0x105000, 0x0) sendmmsg$unix(r2, &(0x7f0000000900)=[{&(0x7f0000000200)=@abs={0x1, 0x0, 0x4e24}, 0x6e, &(0x7f0000000580)=[{&(0x7f0000000280)="a2", 0x1}, {&(0x7f00000002c0)="6c50ef5111fff50a3e1d53a71cee652e2243bd7e6025b866c1ea31c2bacc4079c846a5769cbe7f014d92265fc7d34a136954fa1ab745a7db41a639061821037ecb16a6dd4e6d494a39f59eab5f9b6f92141175692f36b8a5343022efc0209a15de7ce1615f5d49a6efc75e0539beef66244f2bfecd53cb7b220b4b375ac9b81f8154e918118f5d7ef377863d6c2d7931b50e86d720ae9d720d63d3a26d1af479473926cc9cd9f027dc35e38fe08ed32c20c2d1745746b42beaee8d23587a69439628aa32f12e6eddbab3c39f8cda9985bb3bd20841a1113f197b909b7d9f0d9edfd79c9eee40b283c7f5c3fe2428b1e32b288fdbdbfaf3c84b7f", 0xfa}, {&(0x7f00000003c0)="addda8238d8eb46d6fc3cbd0560f24e85e0a396a4c9bbaf8d5924c699675d93b56c613f8e9b894b9f08bbb3edc4806f8d28f0ef6e95e9e020116b0ad645d4a4f19736570048c6956508140385bf5eed9a15970aaa3a1ade16309870d874ed38d8270b3f243ee952e7681bc96f307ee7205b805514d7e8976727082cd3e97ed787f3552eab35a4cb4b17b", 0x8a}, {&(0x7f0000000480)="cd4a886dda90acf441accd4b5281f24a02211158601d334993fa559bf5a2e4934996f1e7bdb1a0e8ebe1ad45a77597e704974b170c8e5389ba6967226d0a547e1aa5db07c45aa0362a261f408b49f66e9bd60e3b2e52b622ffdb5ad0a29c78b56077afcb24a9932a6072799f607bc60f87b00c800a34ecc77025d93f7cff12e3e1a41b97e15e83d09c4a791fac08c7147ef74c43c4d5b322587a7824be04a5f1489fa492dc18f0c387d4f6e3400c5a0274e23925aa69b67bb0bbda5aa14c4a78dc33d5b0ae92de25849ab66b4ab1c4495d972eaa9bc6c09af4b2add66e47a5602e6bc1f2b193f7b0c24ebae7dc43a7c7b5c2bab27e804bf7c31b47", 0xfb}], 0x4, &(0x7f0000000880)=[@cred={0x20, 0x1, 0x2, r1, r3, r4}, @rights={0x10}, @rights={0x38, 0x1, 0x1, [r5, r6, r7, r8, r9, r10, r11, r12, r13]}], 0x68, 0x4}], 0x1, 0x0) ptrace$pokeuser(0x6, r1, 0x5e85, 0x5) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000140)='./cgroup.cpu/syz0\x00', 0x200002, 0x0) request_key(&(0x7f0000000180)='asymmetric\x00', &(0x7f0000000100)={'syz', 0x0}, &(0x7f0000000000)='vboxnet1\x00', r0) 18:20:16 executing program 4: r0 = syz_open_dev$binder(&(0x7f00000002c0)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) openat$apparmor_task_exec(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/attr/exec\x00', 0x2, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000300)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, &(0x7f0000012fc7)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=ANY=[@ANYBLOB="0e67fd1637d949f4"], 0x0, 0x0, &(0x7f0000000f4d)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000000c0)={0x8, 0x0, &(0x7f0000000140)=[@release], 0x0, 0x0, &(0x7f0000000340)}) [ 484.407130] binder: 32558:32560 unknown command 1392510213 [ 484.412805] binder: 32558:32560 ioctl c0306201 20000000 returned -22 [ 484.448163] binder: 32605:32608 Acquire 1 refcount change on invalid ref 0 ret -22 18:20:16 executing program 5: request_key(&(0x7f0000000240)='keyring\x00', &(0x7f0000000280)={'syz', 0x0}, &(0x7f0000000080)='vboxnet1\x00', 0xfffffffffffffffe) 18:20:16 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000300)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, &(0x7f0000012fc7)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, &(0x7f0000000f4d)}) r1 = openat$ashmem(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ashmem\x00', 0x80000, 0x0) ioctl$ASHMEM_GET_NAME(r1, 0x81007702, &(0x7f0000000040)=""/113) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x8, 0x0, &(0x7f0000000140)=[@release], 0x0, 0x0, &(0x7f0000000340)}) inotify_init() 18:20:16 executing program 2: r0 = socket$netlink(0x10, 0x3, 0x4) writev(r0, &(0x7f0000000000)=[{&(0x7f0000000200)="580000001400192340834b80040d8c5602067fffffff81000000000000dca87086a5c000004f640094000589", 0x2c}], 0x1) [ 484.448938] binder: 32604:32613 ioctl 400c6615 20000000 returned -22 [ 484.449042] binder: 32604:32613 Acquire 1 refcount change on invalid ref 0 ret -22 [ 484.449143] binder: 32604:32613 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 484.449872] binder: 32604:32613 ioctl 400c6615 20000000 returned -22 [ 484.456825] binder: 32604:32616 Acquire 1 refcount change on invalid ref 0 ret -22 [ 484.456919] binder: 32604:32613 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 18:20:16 executing program 0: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) dup(r0) ioctl$EXT4_IOC_PRECACHE_EXTENTS(r1, 0x6612) r2 = dup(r0) write$UHID_CREATE(r2, &(0x7f00000001c0)={0x0, 'syz0\x00', 'syz0\x00', 'syz0\x00', &(0x7f0000000000)=""/171, 0xab, 0x1, 0xffff, 0x4, 0x0, 0x2}, 0x120) 18:20:16 executing program 5: request_key(&(0x7f0000000000)="6b480ae2946ee700", &(0x7f0000000080)={'syz', 0x0}, &(0x7f0000000040)="76627431000945e241e3df7badb25422ce0531f3d55661c24700397fa110618568be26dd8de0ad3b91635bc4e750ffdb1675242d1689ce0d191420f49d02", 0xfffffffffffffffe) 18:20:16 executing program 2: r0 = socket$netlink(0x10, 0x3, 0x4) writev(r0, &(0x7f0000000000)=[{&(0x7f0000000200)="580000001400192340834b80040d8c5602067fffffff81000000000000dca87086a5c000004f640094000589", 0x2c}], 0x1) [ 484.513611] binder: 32605:32621 unknown command 385705742 [ 484.544008] binder: 32620:32622 Acquire 1 refcount change on invalid ref 0 ret -22 [ 484.546602] binder: 32605:32630 Release 1 refcount change on invalid ref 0 ret -22 18:20:16 executing program 5: r0 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_FIOGETOWN(0xffffffffffffffff, 0x8903, &(0x7f0000000000)=0x0) fcntl$setownex(r0, 0xf, &(0x7f0000000040)={0x1, r1}) request_key(&(0x7f0000000240)='keyring\x00', &(0x7f0000000280)={'syz', 0x0}, &(0x7f00000002c0)='vboxnet1\x00', 0xfffffffffffffffe) 18:20:16 executing program 0: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = accept$inet6(0xffffffffffffffff, &(0x7f0000000000)={0xa, 0x0, 0x0, @mcast2}, &(0x7f0000000140)=0x1c) setsockopt$inet6_tcp_int(r2, 0x6, 0x1d, &(0x7f00000001c0)=0x20, 0x4) r3 = add_key(&(0x7f0000000040)='cifs.idmap\x00', &(0x7f0000000080)={'syz', 0x2}, &(0x7f00000000c0)="94e6730f6f5909765c00fc40706892d8e4652fff0a", 0x15, 0x0) add_key$keyring(&(0x7f0000000200)='keyring\x00', &(0x7f0000000100)={'syz'}, 0x0, 0x0, r3) r4 = dup3(r0, r0, 0x80000) r5 = syz_genetlink_get_family_id$team(&(0x7f0000000280)='team\x00') getsockopt$inet6_IPV6_IPSEC_POLICY(r2, 0x29, 0x22, &(0x7f0000000300)={{{@in=@multicast1, @in6=@ipv4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@mcast2}, 0x0, @in=@multicast1}}, &(0x7f0000000400)=0xe8) getsockopt$inet_IP_IPSEC_POLICY(0xffffffffffffff9c, 0x0, 0x10, &(0x7f0000000440)={{{@in6=@mcast1, @in=@loopback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@multicast1}, 0x0, @in=@broadcast}}, &(0x7f0000000540)=0xe8) ioctl$ifreq_SIOCGIFINDEX_team(r2, 0x8933, &(0x7f0000000580)={'team0\x00', 0x0}) getsockopt$inet_IP_XFRM_POLICY(0xffffffffffffffff, 0x0, 0x11, &(0x7f00000006c0)={{{@in=@multicast1, @in6=@loopback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@mcast1}, 0x0, @in6=@remote}}, &(0x7f00000007c0)=0xe8) sendmsg$TEAM_CMD_PORT_LIST_GET(r4, &(0x7f0000000980)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x2000}, 0xc, &(0x7f0000000940)={&(0x7f0000000800)={0x108, r5, 0x132e09a4f1385715, 0x70bd27, 0x25dfdbfd, {}, [{{0x8, 0x1, r6}, {0xec, 0x2, [{0x38, 0x1, @mcast_rejoin_interval={{0x24, 0x1, 'mcast_rejoin_interval\x00'}, {0x8}, {0x8, 0x4, 0x6}}}, {0x40, 0x1, @priority={{{0x24, 0x1, 'priority\x00'}, {0x8}, {0x8, 0x4, 0x2}}, {0x8, 0x6, r7}}}, {0x38, 0x1, @activeport={{0x24, 0x1, 'activeport\x00'}, {0x8}, {0x8, 0x4, r8}}}, {0x38, 0x1, @activeport={{0x24, 0x1, 'activeport\x00'}, {0x8}, {0x8, 0x4, r9}}}]}}]}, 0x108}, 0x1, 0x0, 0x0, 0x8004}, 0x4090) [ 484.564078] binder: 32609:32624 Acquire 1 refcount change on invalid ref 0 ret -22 [ 484.581035] binder: 32605:32621 ioctl c0306201 20008fd0 returned -22 [ 484.597184] binder: 32609:32624 IncRefs 0 refcount change on invalid ref 0 ret -22 [ 484.606164] binder: 32620:32636 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 18:20:16 executing program 3: r0 = openat(0xffffffffffffffff, &(0x7f0000000000)='./file0\x00', 0x40000, 0x80) ioctl$TIOCGPGRP(0xffffffffffffffff, 0x540f, &(0x7f0000000040)=0x0) ioctl$TIOCSPGRP(r0, 0x5410, &(0x7f0000000080)=r1) request_key(&(0x7f0000000240)='keyring\x00', &(0x7f0000000280)={'syz', 0x0}, &(0x7f00000002c0)='vboxnet1\x00', 0xfffffffffffffffe) 18:20:16 executing program 2: r0 = socket$netlink(0x10, 0x3, 0x4) writev(r0, &(0x7f0000000000)=[{&(0x7f0000000200)="580000001400192340834b80040d8c5602067fffffff81000000000000dca87086a5c000004f6400940005891550f4a8000000006700008000f0fffeffff09000080", 0x42}], 0x1) 18:20:16 executing program 5: exit(0x2) request_key(&(0x7f0000000240)='keyring\x00', &(0x7f0000000280)={'syz', 0x0}, &(0x7f00000002c0)='vboxnet1\x00', 0xfffffffffffffffe) [ 484.623107] binder: 32620:32636 Release 1 refcount change on invalid ref 0 ret -22 [ 484.635777] binder: 32620:32636 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 484.645191] binder: 32620:32622 Acquire 1 refcount change on invalid ref 0 ret -22 [ 484.653305] binder: BINDER_SET_CONTEXT_MGR already set [ 484.658819] binder: 32605:32630 Acquire 1 refcount change on invalid ref 0 ret -22 [ 484.667161] binder: 32605:32621 unknown command 385705742 [ 484.672790] binder: 32605:32621 ioctl c0306201 20008fd0 returned -22 [ 484.680305] binder: 32605:32630 Release 1 refcount change on invalid ref 0 ret -22 [ 484.686832] binder: 32620:32636 Release 1 refcount change on invalid ref 0 ret -22 [ 484.707060] binder: 32605:32608 ioctl 40046207 0 returned -16 18:20:16 executing program 4: r0 = syz_open_dev$binder(&(0x7f00000002c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, &(0x7f0000012fc7)}) r2 = syz_open_procfs(0x0, &(0x7f0000000080)='net/udplite6\x00') ioctl$BLKRRPART(r2, 0x125f, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, &(0x7f0000000f4d)}) r3 = mmap$binder(&(0x7f0000ffc000/0x1000)=nil, 0x1000, 0x1000008, 0x10110, r1, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000000c0)={0x14, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="a5d5a4d5435cbacf8e117ce897b08af2b3cab0a7bbc802c8", @ANYRES64=r3, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], 0x0, 0x0, &(0x7f0000000340)}) 18:20:16 executing program 0: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) stat(&(0x7f0000000000)='./file0\x00', &(0x7f0000000040)) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) add_key$keyring(&(0x7f0000000200)='keyring\x00', &(0x7f0000000240)={'syz'}, 0x0, 0x0, 0xfffffffffffffffb) 18:20:16 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000003c0)='/dev/binder#\x00', 0x0, 0x7ffffffffffffffd) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, &(0x7f0000012fc7)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, &(0x7f0000000f4d)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x8, 0x0, &(0x7f0000000140)=[@release], 0x0, 0x0, &(0x7f0000000340)}) r1 = openat$pfkey(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/net/pfkey\x00', 0x1, 0x0) r2 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000080)='IPVS\x00') sendmsg$IPVS_CMD_DEL_DEST(r1, &(0x7f0000000340)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x8500002}, 0xc, &(0x7f0000000100)={&(0x7f0000000180)={0x168, r2, 0x204, 0x70bd26, 0x25dfdbfb, {}, [@IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0x744d}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0xffff}, @IPVS_CMD_ATTR_DEST={0x40, 0x2, [@IPVS_DEST_ATTR_ADDR_FAMILY={0x8, 0xb, 0x2}, @IPVS_DEST_ATTR_WEIGHT={0x8, 0x4, 0xc10}, @IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8, 0x1000}, @IPVS_DEST_ATTR_ADDR={0x14, 0x1, @ipv6}, @IPVS_DEST_ATTR_FWD_METHOD={0x8, 0x3, 0x3}, @IPVS_DEST_ATTR_FWD_METHOD={0x8, 0x3, 0x3}]}, @IPVS_CMD_ATTR_SERVICE={0x38, 0x1, [@IPVS_SVC_ATTR_AF={0x8, 0x1, 0x2}, @IPVS_SVC_ATTR_NETMASK={0x8, 0x9, 0x2c}, @IPVS_SVC_ATTR_FWMARK={0x8, 0x5, 0x1}, @IPVS_SVC_ATTR_TIMEOUT={0x8, 0x8, 0x6}, @IPVS_SVC_ATTR_FWMARK={0x8}, @IPVS_SVC_ATTR_FLAGS={0xc, 0x7, {0xa, 0x8}}]}, @IPVS_CMD_ATTR_SERVICE={0x60, 0x1, [@IPVS_SVC_ATTR_TIMEOUT={0x8, 0x8, 0x81}, @IPVS_SVC_ATTR_PE_NAME={0x8, 0xb, 'sip\x00'}, @IPVS_SVC_ATTR_PORT={0x8, 0x4, 0x4e20}, @IPVS_SVC_ATTR_NETMASK={0x8, 0x9, 0x72}, @IPVS_SVC_ATTR_SCHED_NAME={0x8, 0x6, 'rr\x00'}, @IPVS_SVC_ATTR_SCHED_NAME={0x8, 0x6, 'rr\x00'}, @IPVS_SVC_ATTR_PROTOCOL={0x8, 0x2, 0x7}, @IPVS_SVC_ATTR_TIMEOUT={0x8, 0x8, 0x9}, @IPVS_SVC_ATTR_NETMASK={0x8, 0x9, 0x1a}, @IPVS_SVC_ATTR_ADDR={0x14, 0x3, @ipv6=@dev={0xfe, 0x80, [], 0x14}}]}, @IPVS_CMD_ATTR_DAEMON={0x5c, 0x3, [@IPVS_DAEMON_ATTR_SYNC_ID={0x8, 0x3, 0x1}, @IPVS_DAEMON_ATTR_SYNC_ID={0x8, 0x3, 0x1}, @IPVS_DAEMON_ATTR_MCAST_IFN={0x14, 0x2, 'vlan0\x00'}, @IPVS_DAEMON_ATTR_MCAST_GROUP6={0x14, 0x6, @ipv4}, @IPVS_DAEMON_ATTR_MCAST_GROUP={0x8, 0x5, @remote}, @IPVS_DAEMON_ATTR_MCAST_PORT={0x8, 0x7, 0x4e24}, @IPVS_DAEMON_ATTR_MCAST_TTL={0x8, 0x8, 0x7}, @IPVS_DAEMON_ATTR_SYNC_MAXLEN={0x8, 0x4, 0x800}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5, 0x400}]}, 0x168}, 0x1, 0x0, 0x0, 0x10}, 0x10) 18:20:16 executing program 2: r0 = socket$netlink(0x10, 0x3, 0x4) writev(r0, &(0x7f0000000000)=[{&(0x7f0000000200)="580000001400192340834b80040d8c5602067fffffff81000000000000dca87086a5c000004f6400940005891550f4a8000000006700008000f0fffeffff09000080", 0x42}], 0x1) 18:20:16 executing program 0: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = fcntl$dupfd(r1, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x4001fd) add_key$keyring(&(0x7f0000000200)='keyring\x00', &(0x7f0000000240)={'syz'}, 0x0, 0x0, 0xfffffffffffffffb) 18:20:16 executing program 3: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = accept$inet6(0xffffffffffffffff, &(0x7f0000000000)={0xa, 0x0, 0x0, @mcast2}, &(0x7f0000000140)=0x1c) setsockopt$inet6_tcp_int(r2, 0x6, 0x1d, &(0x7f00000001c0)=0x20, 0x4) r3 = add_key(&(0x7f0000000040)='cifs.idmap\x00', &(0x7f0000000080)={'syz', 0x2}, &(0x7f00000000c0)="94e6730f6f5909765c00fc40706892d8e4652fff0a", 0x15, 0x0) add_key$keyring(&(0x7f0000000200)='keyring\x00', &(0x7f0000000100)={'syz'}, 0x0, 0x0, r3) r4 = dup3(r0, r0, 0x80000) r5 = syz_genetlink_get_family_id$team(&(0x7f0000000280)='team\x00') getsockopt$inet6_IPV6_IPSEC_POLICY(r2, 0x29, 0x22, &(0x7f0000000300)={{{@in=@multicast1, @in6=@ipv4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@mcast2}, 0x0, @in=@multicast1}}, &(0x7f0000000400)=0xe8) getsockopt$inet_IP_IPSEC_POLICY(0xffffffffffffff9c, 0x0, 0x10, &(0x7f0000000440)={{{@in6=@mcast1, @in=@loopback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@multicast1}, 0x0, @in=@broadcast}}, &(0x7f0000000540)=0xe8) ioctl$ifreq_SIOCGIFINDEX_team(r2, 0x8933, &(0x7f0000000580)={'team0\x00', 0x0}) getsockopt$inet_IP_XFRM_POLICY(0xffffffffffffffff, 0x0, 0x11, &(0x7f00000006c0)={{{@in=@multicast1, @in6=@loopback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@mcast1}, 0x0, @in6=@remote}}, &(0x7f00000007c0)=0xe8) sendmsg$TEAM_CMD_PORT_LIST_GET(r4, &(0x7f0000000980)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x2000}, 0xc, &(0x7f0000000940)={&(0x7f0000000800)={0x108, r5, 0x132e09a4f1385715, 0x70bd27, 0x25dfdbfd, {}, [{{0x8, 0x1, r6}, {0xec, 0x2, [{0x38, 0x1, @mcast_rejoin_interval={{0x24, 0x1, 'mcast_rejoin_interval\x00'}, {0x8}, {0x8, 0x4, 0x6}}}, {0x40, 0x1, @priority={{{0x24, 0x1, 'priority\x00'}, {0x8}, {0x8, 0x4, 0x2}}, {0x8, 0x6, r7}}}, {0x38, 0x1, @activeport={{0x24, 0x1, 'activeport\x00'}, {0x8}, {0x8, 0x4, r8}}}, {0x38, 0x1, @activeport={{0x24, 0x1, 'activeport\x00'}, {0x8}, {0x8, 0x4, r9}}}]}}]}, 0x108}, 0x1, 0x0, 0x0, 0x8004}, 0x4090) 18:20:16 executing program 0: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = request_key(&(0x7f0000000040)='pkcs7_test\x00', &(0x7f0000000080)={'syz', 0x3}, &(0x7f00000000c0)='&}\x00', 0xfffffffffffffffb) add_key$keyring(&(0x7f0000000000)='keyring\x00', &(0x7f0000000240)={'syz'}, 0x0, 0x0, r1) 18:20:16 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000300)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$sock_FIOGETOWN(0xffffffffffffff9c, 0x8903, &(0x7f0000000000)=0x0) ptrace$PTRACE_SECCOMP_GET_METADATA(0x420d, r1, 0x10, &(0x7f0000000040)) openat$selinux_mls(0xffffffffffffff9c, &(0x7f0000000080)='/selinux/mls\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, &(0x7f0000012fc7)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x69, 0x0, &(0x7f0000000f4d)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000140), 0x0, 0x0, &(0x7f0000000340)}) 18:20:16 executing program 2: r0 = socket$netlink(0x10, 0x3, 0x4) writev(r0, &(0x7f0000000000)=[{&(0x7f0000000200)="580000001400192340834b80040d8c5602067fffffff81000000000000dca87086a5c000004f6400940005891550f4a8000000006700008000f0fffeffff09000080", 0x42}], 0x1) 18:20:16 executing program 3: r0 = socket(0x10, 0x100000003, 0x0) ioctl$sock_FIOGETOWN(r0, 0x8903, &(0x7f0000000100)=0x0) get_robust_list(r1, &(0x7f0000000280)=&(0x7f00000001c0)={&(0x7f0000000180)={&(0x7f0000000140)}}, &(0x7f00000002c0)=0x18) write(r0, &(0x7f0000000340)="240000002100255107000165ff00fc020200000900100f000ee1000c0800060000000000", 0x24) r2 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000300)='/dev/vga_arbiter\x00', 0x200, 0x0) setsockopt$IP_VS_SO_SET_DELDEST(r2, 0x0, 0x488, &(0x7f0000000080)={{0x0, @loopback, 0x4e21, 0x4, 'wlc\x00', 0x20, 0x4, 0x4d}, {@broadcast, 0x4e22, 0x2000, 0xbe2, 0x4, 0x100000000}}, 0x44) r3 = socket$netlink(0x10, 0x3, 0x4) writev(r3, &(0x7f0000000000)=[{&(0x7f0000000200)="580000001400192340834b80040d8c5602067fffffff81000000000000dca87086a5c000004f6400940005891550f4a8000000006700008000f0fffeffff09000080fff5dd00000010000100000c0900fcff0000040e05a5", 0x58}], 0x1) [ 484.840653] binder: 32674:32680 Acquire 1 refcount change on invalid ref 0 ret -22 [ 484.877291] binder: 32674:32680 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 18:20:17 executing program 0: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = openat$selinux_checkreqprot(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/checkreqprot\x00', 0x10000000000, 0x0) write$selinux_load(r1, &(0x7f0000000040)=ANY=[@ANYBLOB="8cdf7cf9080000005345204c696e7578d544e1375220b0edf81bf05a74aba2d3fe8faa040eb9fb74252122e42101c33c19aab979d46a6729dbe5a0dc91fc87a1e48a41d99fadd3ea1701af233dca82b5896189fb3b1db36e767296382dd6d4322fe4f86245fd617282070045c6cdd6e12b90e78c0f265b5f6754c0be01a7d26a8fa8a067ec967ae9219d44"], 0x8b) socketpair$inet_tcp(0x2, 0x1, 0x0, &(0x7f0000000100)) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) add_key$keyring(&(0x7f0000000200)='keyring\x00', &(0x7f0000000240)={'syz'}, 0x0, 0x0, 0xfffffffffffffffb) [ 484.911796] binder: 32674:32680 unknown command -710617691 [ 484.950177] binder: 32674:32680 ioctl c0306201 200000c0 returned -22 [ 484.972287] binder: BINDER_SET_CONTEXT_MGR already set [ 484.989834] binder: 32674:32703 Acquire 1 refcount change on invalid ref 0 ret -22 [ 484.997620] binder: 32674:32680 ioctl 40046207 0 returned -16 [ 484.999885] binder: 32674:32706 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 485.000000] binder: 32674:32706 unknown command -710617691 [ 485.000008] binder: 32674:32706 ioctl c0306201 200000c0 returned -22 18:20:17 executing program 5: r0 = add_key$keyring(&(0x7f0000001780)='keyring\x00', &(0x7f00000017c0)={'syz', 0x3}, 0x0, 0x0, 0xfffffffffffffff8) r1 = openat$selinux_avc_cache_stats(0xffffffffffffff9c, &(0x7f00000018c0)='/selinux/avc/cache_stats\x00', 0x0, 0x0) r2 = request_key(&(0x7f0000000240)='keyring\x00', &(0x7f0000001740)={'syz', 0x0}, &(0x7f00000002c0)='vboxnet1\x00', r0) ioctl$BLKTRACESTOP(r1, 0x1275, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./file0\x00', 0x0, 0x8) getsockopt$packet_buf(r3, 0x107, 0x16, &(0x7f0000001800)=""/121, &(0x7f0000001880)=0x79) keyctl$instantiate_iov(0x14, r2, &(0x7f0000001680)=[{&(0x7f0000000000)="313dfbad8a626b44044232257697c02d8e7b6df9c916f6729ed39db0a88df0dd45abc853b7316e8fad7234a5284f2a354eb34b5e98c7f64d2c8dc957cacfefca250d8150331e957641bf265c3f4bdbd54adfb7685dfda96e2dc65499d5b2ea84679f19da9b2e8a1b5410f29825fd7c4c7f3c3ae4d68869ae5f9b7eb576672a8f04fcee0a9f8e84f270815e664ab3e499bc9b30ea7eac6e2729e5ae3fe0d6ce3d7ede4c4b45dcb2d4d7b5f00decc63f17b2d9c9d6bd3798bcd5d7e70e", 0xbc}, {&(0x7f00000000c0)="9909a64b313d0e1d3d89e2929da1533a1f1e5305f257761ec4fe55ecf8912d5a9083d07b9ae3c586551b1e2cdbf3db1646bd47a71b3e42ab773c", 0x3a}, {&(0x7f0000000100)="c7f6fae775041ad87fc8c9cc337cbd63ba69289f18872b83edad394a5f3fadf3ae7c413dddd3f6ac406c3015616d8133fa69025a88db71e5b05e529001eb60add95152ce689dd9af72348c10227e68511dc666381325c17573d2c2a93ca6430b8a742a94f388c1f11b28d4c74923bb63096600d2327260d68a15e75ef03875af23b46661854b7874", 0x88}, {&(0x7f00000001c0)="f5924ad961fe993a64803a1876139e3f4eb60f3ebeccf054108ef4ebec6a19d2b1720b2e638e36bc230c1a828e3f253bd689199f70585ac6f3cad97cb3af55f77dc51bb928f24754e84b5ec91a366f01f3", 0x51}, {&(0x7f0000000300)="d99edad3dc2f7fd96fb07e53aba5ac917e5cecf242e082ab911008f39ddeea2b45f013d0b3482878744d0d777c252b43634ad8d29da42d582c8f01c7f853fe37471dc801510bef553dca32760271191eaa924f72af42620e552c936a4ea933745473afe1f374ed4c91a35b50ec8fa8fffdd6a1597cf636a36a5d37949b8790ffee74aa8298760ed24cd7df16c7eb6eccb9a34aa1b90f60828b07119a739be7d363f1f94446", 0xa5}, {&(0x7f00000003c0)="1707f8a495d124dd9dfe4ee9b414d1a9113b14907d825ca2a330ee645f72018a4b95a815810edc6b7d09a7c59ef0465c49ea14880078c6a5031579bb24c225f41ebdc94190e77cb2c56dd4a7462f04be533c1904571944d02f901cd658e4396968a8bb617274f252ef8c82738f78606a571b1fa67d9053eb71542b2a71202dcef16ec2dccb52cef7180b2f2b828d12ff36abe5c94d530c39aa3c8572db43f05f963aad3f51dbe59bd89a57e81fa410e1adb4e8f774575e12afd8eddff57fbdfdf21bb2e8856cd50f683089f59f3b1c098bd44fd28c4cf430c6f3d188cf80100e22332604c81844f4b9579d4a9b1fa291c0f9112a750698627a35e4887f8c060dc2f83727fbe01d1bcecdf453cc22f0df76765a89a68131d2b7ef511c5251ed801b45c824b3fcebadbf69972777843476fe1d5851512751e8f5f2343bb927b2377871bedbd223332aaf6a164bed9623fb7e34a52831c85c2bd679d3362d92a879db978d0e96a2f2a6cfc9ca815692fdb07c07e8091881b2b01edfe1930284634dd471eed11889beb77aa7114e368ba3bc0d16aa9966e5f13f4f73d222f55c09c5af8ca3638f690d352cf1906dbd3a0c0a96053ca0d33c80be3ab26d33179e7e7f922b08939c20e8dc6e9bca2fc0782a4f0dfa0e50c66f971bff7b013d3ec7b39056984ccbf7b88f587b9fc56f2dfdd93d9e23fb1e57c64f8c118258ee558a74e05cf270149c8f2542f5c9a893cae19b5c39556286d12f55728e7daee7c8ba6e8283d2c746184e802fa95848ce1288f558dd53da64ac43fbd92269ec2f9d8557804ede34203dc0f30b8c4093ed4b1aa93d3e8a0b3177b9f7971ba9af5ccae75c3b0377d93af956a6fa2a2463874afe3cb9b5f0270a91f24496d7bd2e2af3571d4946241c6918f5ed30bac5a57f8348e1ac37e8f9ee49df2ec2ccf36235115b80c279d6573a80e297b7ac241a1952fa1b5d01c990fa7cd4393dc648c8e852f7a375b25166ae14c68e704bbc26fdac7809d69bb1d28524ef0c5a3199c53b50ed471cbdd0d7daa29566b0272fa784ca50c7e93c3b61991f04f13a940011a1b21e5c6f784b624cfa3c622727696a7793656b219444e9e56cfaa1d41ae2a99d1288df8e77ec3de8f2a73ebda217734d23e5c3f956d2a454930d7e47237ae1184e2397178b0457a27df137b430bfb3874f4017177a6008aa27d6236e4070c9137a51276b3676b2071294d5c56510fc7b7ebac7d3b15e007fbb2a295ee97c41b5d9387f58fe7e14db067ca003006ee4a6ae28ce1b679f766e916adee322ee005ea7367f591df6c4cb127d09de2ce23f4fcc3457fff61eff8903dd0e6d317f5a47abfa73f7f48ed7279c6f7a080691c91f7b4fa81f7d9a5b7f2fc777ac502c4f28820fc5de478982eb0fe2a7870143e7fcc7f3a9543268693dbf94d4b623f9529ce0d4157775df9ff1022c3a1d2c256dcfdcbf28f274b4eb36897afa9cda959d821612e5fd4d9dd8860555d70f70e51169163dd7ec88863c04588ac23e38a355b215d7751991a29e9c0c2365fae7e9e90f152761353b8622ae69cc7d493789ae0811c320730aea74a4394c191837e80493f415ae61c198fc83366706634314f8c536ed3d4aa579a519ce3c5ad2b6324a543ece905dabd8e2c01f0255c26cec9e822c06a81dfa9bbfb42f85756a23b6dc4c795073bde429283c8509142587dc3f0937296f5a76d058f8dfaad839929407a546e7b329e71c99691ae00551c635bbbd779998ef449a0473741df73172f5acd37163bcfdc64178cbca3da5737a6478f95747b6232b89a2ea20564b81da3e12a496fc31174006da1bc53c690066f40dbfc67f35da43db62fffd18eb4659009349fa20e880ae1f23fc7612af09a8362162575d5995bd5f60df99bf3ae96ddf271f02ddc1b155f33cbda0fe5dfafaf98a9c2d7196d9809ed31deaccf4a4b3a101416e7de5b5b8f4cfe09fda2034fae186171bd4a3254dff80ee2a7524a97bb7611baaf9e6931c4acd38274d847d4d984a9978d5e51c61027b5fb157b786812073edc2431d227d0246e68a53f3b6daecc9569da0bca93396313ad05acf79358457bdc4fefc21b9774f14230808c2b5d349e0ddc53fb2a7fbf8a0e5bae305bfaadb69e545b5ff8ebb0996dd52001a2073545309f0bddaf38b0d8b48d41cd156bab3452eae46ad412a12a5c72fc47d003585be9e0af326a6182d768b3f4570913013890f6e9fb2759e5a92c674c53b73a8291559c0fe300a300b32df1d99b04c9032e85601b28cfd269d20736e755ee2bf7c08f318543791f4e53feadb1b891f68c8675c55640b8e6cd45c98e569cf3a51241854537a3353907ad53576e991190c4a9d55f2c02cac8a03d978ecb35d4dd06977f320137836bae6d95b8d476b6636a760c0d90b21a384b0e42c2fa1ee10302985b1e2b7280df1a68033a36b2b9fdf80be6c4b017e422f1a67a2d7be128d2e4a8daa0149a29a5e911e507ddbbff5002787af6e22ea8b89bc17a33b7c50f25d2c076f8e62af9b4e6f381b52bc23d1fcbfcda47daea2031bc793945df9a3ad95c3eb6e9e09bc7d9a23f24fa068561108dacca65233da434081475791910ba54dee8a22a75de44d7a12ceb0bea637301f7c9b7915bdc57182fcd57084901414c58989300c24de169f11be76bfef509cf56413042530953d6b10aa7b53dc827d2d288fe79130a8e6f06bd175832cc2d0cd9b1e383cd42953768df0e8e48092c73b6fa2faae887d8c0d699d98b3d6203d75ef6c55b4d1686c727887d7b9874265f1d3d4d157b28cbf77a19bb121d454901172970296986f1cdcd2465a54d7660c26f69c920f714f7dc31e44ddc78139caef49f487919566ec6796b86bd4fa28573f999f5d958b84ed06e96e6e5ac1fe71654bef4b8db0e0b1e135fa8b0f0897109b535d6d6127e238345698ee64d72f28055388ea6bbfc234cdae46fb58621e295be9b791e504dbd63be066023a9751b680b7d3d0d7a7eca05610ef21b0d9c6aa8473858c36efb1507f0d44a98c56e7cec80ab73876b965092945d9ee3b3cf08522b3021df74bd6ad6be19ceac1c46eb291b737fe8744a647408332463abe9f6bfae3f4df376cde5a5ea96c0d8195cd22f924c5a4ad3a85a42a2ddc0c0d11b9e0ba7de385aaeb635d51b16263f342a7ab2e582f2a356240f894d339811af10ea6b42ac6eb7dcaeb0096b207bd44e5f17357c34b8f533c1ed9819c97319024ce0933673d149a0acb20d341f246b240615eff9f5a7868b62e089deb169d0f48d22e9aebfcd202b6bed15861689df73ba777905abfa86fdf6912529cf86fac77655d7293fe8a330d5a21c5ebfec4d617571f51e39826b4d08f65925284a17e8b89afe38827623387423a108e2c41ddd4aac3695218033ad8f3cc1812a2a1a330047d92b47956413336ff2c1b957956914df85fee595551d28e172eb2392d7bcd69bba01cd9df5c6b9120590f34f1ec71eebee7955c0a9dfcde6157331af19e96a992ab8254d1c88b5024b6e8a49cfb5eaeae44cd8208b53f29ce6efc2db63f75c0d4d3bd3fc05bde4931646649bcadddc1db41d36302bfa71d628e869aec3dd6ac2ce2fabefa17d1c82b421f344a07b16243f9a0bdf1e603763d995b19abcef5a65232d471b22bf575a5aa399c387164d9e4a032ed936a72d29ba49fbcbc755d47cd6d2dedcf1abe5d2d30977abff0e64154a7661a8f1f99fac2b87e56d3bffe6f97b9f0402eb138bd954e01c1de637dfdeffad2d3b4131338246f0a1a3b4a75e54616c6c0792a1d112822b0000679d25809d01a9ee416046804ae7316eddb75baa9e117803f592ca8caf794b474c4cc83ea7274edb186480ce7304830e4cab31c73326d2193fa4e4d5e6e9bdda6478564729d63bbcb8a2e94796a8fd7dfd8ebe3d06247ea7a548cec94b00ae6ef7aad28528b0bbcc704012589b596ac837b4c48bbbf36b29a6f9e017c0bfb931c810af9a650a79e6b359c76f2581f2b425cc1921cc1dc2567dd4a60c8effbbe0cee75a0d4aa61ffa7146ced0a79e3bab7297f0a8d0e671e6a5d5673684dab5c01a166d19f91b9bc410b3997dec9c7c90be4bfef75bce47bb499eabace03aac40914205d6e371369a9e4e0415b81659ed12735ac98daf6a4d66ad1e59186d7a71176f2ec75a0d56f2f58942f64c51a1fad7ede30ca9dcfa4d1f270252defad37ed0433950c8c7a3d3510e9913b1d7c3633ff4e7b667299d62038c9831c765c8a0eb9747785c64a705b6cee1b6570113d80d74c02f62616b9fcffc12ec195ff082e7026e443bfbc9c3c4ce3a31a47e93862bce468c86e65eb183396217e99ea8799f56a0b30501b404f974eff58af25ec31b22b9da429a47966f686c12cdbfdbb26a00b6fd7e944e5daa60719cfc41cb2fe82ae4a7392ea225a855d9e5170c2a06794ea5b4c607169de117bb801eee89899d84e92b3994fb3d312d364dafdfe12d0bc4603e91579d662b8102853291c5692febb728f43a8c5959f5a85eb941e9e1035001a4dcac7890e483d6c8a3043941d6fbec05aa28da48aeeb5c160fc3fda1093bf33d831b75fc36bec32deac4680f7eb74ca4efccda8ef6dce7fe03cde5a9ab1fd3d7639454eea3471edf2269098d5849eba8d4c86c39b797d163d157118b6533055d310c4facf0167c5dc34acece4a32bcfc65a3ffcf669f4ad9baffc5dfd2f40ceda3d5b1772613f7d52c6cace524c11de3d9e71ae3b9ee4ac6ef48dcc34b7179d3a08e46f04958b002bbbb2dc931284dcd21ed4be3966929bc9daab0c2cabaa00d57f4eb1275baae754e81c461bb3dda61b82130cd97c13f7c4fd820519a4d1f4e25b37bae96f89c6bdf929416f924f63c4c53ae0b4ad19d8184fe82944089e8f1df04250da028c64ffcf4ed5c790408d28b4e932e765bca5ba368d443683415d51135fceb0c386948b28c54abed08334efbdad6cf8ae25bb3689704f951749e3016166778dcfaf290046daaf81d05e95176cdd1cb9bb1a0374cacea20fc771145b63bcb51c2fa8e2db58351e969483faf3a2b596ed402795b5896c99f11738375b4098740de0fa2fca17e5305d4baba74174137c503be45bf4ae51d887c7c497a4880ecd1a29b9491d7f320da480b90dc450c2e16fc5c34c952bc4e14db9f6c79b8fbb100a1c09ace3b3120ec81013726f3b6a67e4bd7c29803e70b53b85bf0df636c263a4287c6ca7eae9b4b84441761e87d49eb16f31b5a2bab44fe27a02264c08aa1587bbc6e89c3501e6abf352122207139cd638a0ded4c26fb66ab2ec8cee9a1ec744621dbe94a2ce271d8416f4f7a0c732e1842760928a3b960704d36c4a69930f2509d779e553df034d5089d826aa27fb16e8559abe1ee4ebe582eaac60dff6ec64f627a434b75feb12cd88cbb7e80846a4d2f109de1a3346b255c85c2caa017901d9730541fb0a638565e1873428e988e2db5fdb6ca97180e15b8821e087c2fdb1c229d7828547265d268251e42a4ba946983ff75f8e97e961d4d68c1e894b92e2d68b9f814117a8847988bc22db8cb279ffcaa45cdf110f3d09dfeeafcb52dcc8243bceef4a0dc2024d63fcab68e5fe0188d5ea6034b61e6bcfe27c7f02f7d9333c6f5c71559747626656d44521c7e47c195790c348412e9255f3289271b93af78020f5c7f1088b6a4758070e02a7f8445759e1bb17a7e7cbee79f8502e5bb0a26a4ae55abbcbaa2856679832854a47bc3ee1efc8cd7d240bece0a6c968fa02fea24d546a0cf4ab7b251013614912dd51219ce1", 0x1000}, {&(0x7f00000013c0)="956f532bdadf16b7b80a2a667c31a364f116358ab719d917fa272794aa8eb24aa07bce49e2e89ba07757910460214758f35040f0a08ebda37cb9ccc59da2502756eece3addb5a0e067d9ef7b1b5094ad2e7de5cfc92ed41f39d30a6b4129eedb09bfbdb1e4fdbb4f9992742f94bc42106f5be9b02063c347a218ad7f2f7d41239589c6e40785ba350027bad2f26a92425b9e24dda6cd41e3669ff68905873536e501582ef1640032d20086c63a44d556093fa6c86363fcd89ef774aaa03338a7431129554e3dd1654b20c1c400cba5cb602c0d64978025cd0c20d320ed9f0e0bad252a7db4a0dd9ad10383277e24cab428175dfe02aedc05d03a9e81", 0xfc}, {&(0x7f00000014c0)="c35e5e67b2fead8011563f6fdf3184a9e819198548227ba748983c328bf9066c3a6cf6e9a1d521ade93c03ffa079fe6eb598f004a66f8c1097b65fac2cc27f06323e753bec508084a90872e070fa55013c3a23769af1c6bee78439caf8593683da5f834641fb74304d2112460fad3c3351606fa144e60de7433274f2509b3d2dc2f2cae40a90a826c1f965418401b4c46781bb0b18c832d0647c9967b13181017ba32f74b1fc2f18d4c63d2a960b479fdebb5f8a1550cdf0b3acd1cb2a221a55e594121e95782eb6d9a1c2324399eb40faa990752601b723cf66", 0xda}, {&(0x7f00000015c0)="243582c3362f0f89e39977fe00498f2f914237566d147bffc2d568c116eb5a13eac665f8467e0b8691736816fd515a9349131f652da5b66fc101557856ae99509b482c91b408937e9851d658ea038717e5b4d21762c25e82d35a6cf5a67be5ee69477b92c184d1ab70d887139559ad0197cf73b1ae64854e4d9a9261fb290fc24bbb5296ab8d4e5079077d76f1afa04729fd9b74f1940efd5bd48c2a7548a7f09e5f87d3cd2eb8832d81ad", 0xab}], 0x9, r2) 18:20:17 executing program 2: r0 = socket$netlink(0x10, 0x3, 0x4) writev(r0, &(0x7f0000000000)=[{&(0x7f0000000200)="580000001400192340834b80040d8c5602067fffffff81000000000000dca87086a5c000004f6400940005891550f4a8000000006700008000f0fffeffff09000080fff5dd0000001000010000", 0x4d}], 0x1) 18:20:17 executing program 3: open(&(0x7f0000000000)='./file0\x00', 0x101000, 0x10) r0 = socket$netlink(0x10, 0x3, 0x40) writev(r0, &(0x7f0000000040)=[{&(0x7f0000000200)="580000001400192340834b80040d8c5602067fffffff81000000000000dca87086a5c000004f6400940005891550f4a8000000006700008000f0fffeffff09000080fff5dd00000010000100000c0900fcff0000040e05a5", 0x58}], 0x1) 18:20:17 executing program 0: r0 = openat$selinux_status(0xffffffffffffff9c, &(0x7f0000000300)='/selinux/status\x00', 0x0, 0x0) listen(r0, 0x0) ioctl$sock_inet_SIOCSIFBRDADDR(r0, 0x891a, &(0x7f0000000380)={'ip6gretap0\x00', {0x2, 0x4e20, @multicast1}}) r1 = creat(&(0x7f0000000000)='./file0\x00', 0x80) syncfs(r0) getsockopt$inet_mreqn(0xffffffffffffff9c, 0x0, 0x24, &(0x7f0000000100)={@empty, @local, 0x0}, &(0x7f0000000140)=0xc) write$P9_RWALK(r1, &(0x7f0000000340)={0x3d, 0x6f, 0x1, {0x4, [{0x1, 0x1, 0x5}, {0x80, 0x1}, {0x0, 0x3, 0x8}, {0x4, 0x4, 0x8}]}}, 0x3d) sendto$packet(r1, &(0x7f0000000040)="e435ac8122de2313ca9e712c9a62063df7071e887b7cf174098d90f9dc41c6dcd249c8445a97379b5318d4dd40ad9a9e8b72b913eb5fd18b1c185a5d76e215d85119fc49b68ef70dd7c4f08317ab7ed45cbedd62a400b24e9f3401ab00626b0687437baf9c6956be0d5921c8b7b9640aa74db2627fb0c6dd0fdb076bae13fc256ed05f7c1f6f29a10e6cba", 0x8b, 0x4000000, &(0x7f00000001c0)={0x11, 0xf8, r2, 0x1, 0x0, 0x6, @broadcast}, 0x14) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) add_key$keyring(&(0x7f0000000200)='keyring\x00', &(0x7f0000000240)={'syz'}, 0x0, 0x0, 0xfffffffffffffffb) ioctl$PERF_EVENT_IOC_MODIFY_ATTRIBUTES(r1, 0x4008240b, &(0x7f0000000280)={0x2, 0x70, 0x41, 0x7c7a, 0x6, 0x5, 0x0, 0x7, 0x5f209f2081c61d56, 0xa180f3c480207e1d, 0x6191, 0x2f4, 0x400, 0x8b04, 0xa4f, 0x3, 0x0, 0x7, 0x10001, 0xfffffffffffffffc, 0x81, 0x1, 0x7d7, 0x40, 0x10001, 0x7, 0x2, 0x100000000, 0x7, 0x5, 0x400, 0x100000000, 0xfffffffffffffe00, 0xe3, 0xf, 0x4, 0x229c, 0x7, 0x0, 0x7, 0x1, @perf_config_ext={0x1, 0xcff}, 0x800, 0x8, 0x1f, 0x5, 0x4, 0xfffffffffffffffd}) 18:20:17 executing program 4: r0 = syz_open_dev$binder(&(0x7f00000002c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) pipe(&(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TIOCMBIC(r1, 0x5417, &(0x7f0000000100)=0xffff) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r2 = syz_open_dev$binder(&(0x7f0000000300)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) lstat(&(0x7f0000000180)='./file0\x00', &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x0}) getsockopt$inet6_IPV6_IPSEC_POLICY(r1, 0x29, 0x22, &(0x7f0000000340)={{{@in=@rand_addr, @in=@loopback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{}, 0x0, @in=@broadcast}}, &(0x7f0000000240)=0xe8) getsockopt$inet6_IPV6_IPSEC_POLICY(r1, 0x29, 0x22, &(0x7f0000000440)={{{@in6=@dev, @in=@rand_addr, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@broadcast}, 0x0, @in=@multicast2}}, &(0x7f0000000280)=0xe8) setresuid(r3, r4, r5) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x67, 0x0, &(0x7f0000000000)="e17f1dd29b690259b99e00e486875e3156df61043372a77e40da4611f4cde02e49687e71dafa02df7e44cfd992b0dd245ac7282629c994d79fad62ffdae01bfb63d47a3707616ca597ff93ffa7efaf09b1eedb9a4d38ee12dd2f0583509b8fcf23fb003c3424ba"}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, &(0x7f0000000f4d)}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000000c0)={0x8, 0x0, &(0x7f0000000140)=[@release], 0x0, 0x0, &(0x7f0000000340)}) 18:20:17 executing program 2: r0 = socket$netlink(0x10, 0x3, 0x4) writev(r0, &(0x7f0000000000)=[{&(0x7f0000000200)="580000001400192340834b80040d8c5602067fffffff81000000000000dca87086a5c000004f6400940005891550f4a8000000006700008000f0fffeffff09000080fff5dd0000001000010000", 0x4d}], 0x1) 18:20:17 executing program 0: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = openat$selinux_avc_hash_stats(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/avc/hash_stats\x00', 0x0, 0x0) ioctl$PERF_EVENT_IOC_SET_FILTER(r1, 0x40082406, &(0x7f0000000040)='keyringposix_acl_accesssecurity\x00') add_key$keyring(&(0x7f0000000200)='keyring\x00', &(0x7f0000000240)={'syz', 0x3}, 0x0, 0x0, 0xfffffffffffffffb) 18:20:17 executing program 3: r0 = socket$netlink(0x10, 0x3, 0x4) writev(r0, &(0x7f0000000000)=[{&(0x7f0000000200)="580000001400192340834b80040d8c5602067fffffff81000000000000dca87086a5c000004f6400940005891550f4a8000000006700008000f0fffeffff09000080fff5dd00000010000100000c0900fcff0000040e05a5", 0x58}], 0x1) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffff9c, 0x29, 0x23, &(0x7f0000000280)={{{@in=@multicast2, @in6=@local, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@rand_addr}, 0x0, @in=@local}}, &(0x7f0000000180)=0x3b7) setfsuid(r1) [ 485.576453] binder: BINDER_SET_CONTEXT_MGR already set [ 485.596405] binder: 32713:32716 ioctl 40046207 0 returned -16 [ 485.627454] binder: 32713:32722 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 18:20:17 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000300)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="4753a0e9263a849d5824f0d2cedddff81c9a4e93d4b2282e6414c886aff0d2eeb5acda1ec3a3ef40054a7ab82ca144fbb1d6ab9ad2"], 0x0, 0x0, &(0x7f0000012fc7)}) socketpair(0x5, 0x3, 0x3, &(0x7f0000000080)={0xffffffffffffffff}) sendmsg$nl_xfrm(r1, &(0x7f0000000280)={&(0x7f0000000100), 0xc, &(0x7f0000000240)={&(0x7f0000000180)=@getsa={0x84, 0x12, 0x921, 0x70bd29, 0x25dfdbfc, {@in=@loopback, 0x4d4, 0x2, 0xff}, [@encap={0x1c, 0x4, {0x1, 0x4e23, 0x4e23, @in=@local}}, @lastused={0xc, 0xf, 0x9}, @output_mark={0x8, 0x1d, 0xf3}, @user_kmaddress={0x2c, 0x13, {@in=@loopback, @in6=@dev={0xfe, 0x80, [], 0x18}, 0x0, 0x2}}]}, 0x84}, 0x1, 0x0, 0x0, 0x80}, 0x8000) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, &(0x7f0000000f4d)}) ioctl$FS_IOC_SETFLAGS(r0, 0x40086602, &(0x7f0000000000)=0x8e) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x8, 0x0, &(0x7f0000000140)=[@release], 0x0, 0x0, &(0x7f0000000340)}) 18:20:17 executing program 5: request_key(&(0x7f00000000c0)='id_legacy\x00', &(0x7f0000000280)={'syz', 0x0}, &(0x7f0000000040)="00e815b778de615b0db656257dde9df7d395b7c7791c57c6426d63c2073ac29cb19557c01d6f37ed476ee98d4c060e72fbfbc781ba637757fb05ad9266a09917729a", 0xfffffffffffffffe) 18:20:17 executing program 3: r0 = syz_open_procfs(0x0, &(0x7f0000000180)='/exe\x00\x00\x00\x00\x00\x00') fcntl$setstatus(r0, 0x4, 0x40000000000467fe) io_setup(0x2, &(0x7f0000000040)=0x0) io_submit(r1, 0x35, &(0x7f0000000100)=[&(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, 0x0, r0, &(0x7f0000000200), 0xfffffdcc}]) r2 = socket$netlink(0x10, 0x3, 0x4) writev(r2, &(0x7f0000000000)=[{&(0x7f0000000200)="580000001400192340834b80040d8c5602067fffffff81000000000000dca87086a5c000004f6400940005891550f4a8000000006700008000f0fffeffff09000080fff5dd00000010000100000c0900fcff0000040e05a5", 0x58}], 0x1) 18:20:17 executing program 2: r0 = socket$netlink(0x10, 0x3, 0x4) writev(r0, &(0x7f0000000000)=[{&(0x7f0000000200)="580000001400192340834b80040d8c5602067fffffff81000000000000dca87086a5c000004f6400940005891550f4a8000000006700008000f0fffeffff09000080fff5dd0000001000010000", 0x4d}], 0x1) 18:20:17 executing program 4: r0 = syz_open_dev$binder(&(0x7f00000002c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000300)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, &(0x7f0000012fc7)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, &(0x7f0000000f4d)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000000c0)={0x8, 0x0, &(0x7f0000000140)=[@release], 0x0, 0x0, &(0x7f0000000340)}) r2 = open(&(0x7f0000000000)='./file0\x00', 0xc0000, 0xc) getsockopt$IP_VS_SO_GET_SERVICES(r2, 0x0, 0x482, &(0x7f0000000040)=""/58, &(0x7f0000000080)=0x3a) 18:20:17 executing program 0: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) add_key$keyring(&(0x7f0000000200)='keyring\x00', &(0x7f0000000240)={'syz'}, 0x0, 0x0, 0xfffffffffffffffb) syz_genetlink_get_family_id$nbd(&(0x7f0000000000)='nbd\x00') 18:20:17 executing program 2: r0 = socket$netlink(0x10, 0x3, 0x4) writev(r0, &(0x7f0000000000)=[{&(0x7f0000000200)="580000001400192340834b80040d8c5602067fffffff81000000000000dca87086a5c000004f6400940005891550f4a8000000006700008000f0fffeffff09000080fff5dd00000010000100000c0900fcff00", 0x53}], 0x1) 18:20:17 executing program 5: request_key(&(0x7f0000000240)='keyring\x00', &(0x7f0000000280)={'syz', 0x3}, &(0x7f0000000000)="76626f786e6574310074b7f4c07f3c8d3f1223b0f53df829a2631233fca3aa1f83d45a4dde574e34dacf177192d210161684fccdabe9a06a094046f4a46bb031d571cb", 0xfffffffffffffffe) [ 485.697259] binder: 32686:32740 Acquire 1 refcount change on invalid ref 0 ret -22 [ 485.705275] binder: 32686:32700 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 18:20:17 executing program 2: r0 = socket$netlink(0x10, 0x3, 0x4) writev(r0, &(0x7f0000000000)=[{&(0x7f0000000200)="580000001400192340834b80040d8c5602067fffffff81000000000000dca87086a5c000004f6400940005891550f4a8000000006700008000f0fffeffff09000080fff5dd00000010000100000c0900fcff00", 0x53}], 0x1) [ 485.751209] binder: BINDER_SET_CONTEXT_MGR already set [ 485.769240] binder: 32750:32758 unknown command -375368889 [ 485.771955] binder: 32744:32762 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 485.772265] binder: 32744:32762 Release 1 refcount change on invalid ref 0 ret -22 18:20:17 executing program 5: fcntl$getownex(0xffffffffffffffff, 0x10, &(0x7f0000000040)={0x0, 0x0}) openat$urandom(0xffffffffffffff9c, &(0x7f0000000200)='/dev/urandom\x00', 0x22080, 0x0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000080)={0x0, 0x0}, &(0x7f00000000c0)=0xc) lstat(&(0x7f0000000100)='./file0\x00', &(0x7f0000000140)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) setsockopt$inet6_tcp_TCP_CONGESTION(0xffffffffffffffff, 0x6, 0xd, &(0x7f0000000300)='lp\x00', 0x3) setsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f00000001c0)={r0, r1, r2}, 0xc) r3 = creat(&(0x7f0000000000)='./file0\x00', 0x19) setsockopt$inet_mreq(r3, 0x0, 0x27, &(0x7f0000000340)={@local, @multicast1}, 0x8) request_key(&(0x7f0000000240)='keyring\x00', &(0x7f0000000280)={'syz', 0x0}, &(0x7f00000002c0)='vboxnet1\x00', 0xfffffffffffffffe) 18:20:17 executing program 4: ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) r0 = syz_open_dev$binder(&(0x7f0000000300)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="8161c3106f85150d5c392452fa63044000000000"], 0x0, 0x0, &(0x7f0000012fc7)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, &(0x7f0000000f4d)}) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, &(0x7f0000000040)={0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x14, 0x0, &(0x7f0000000080)=[@increfs_done={0x40106308, r1, 0x3}], 0x0, 0x0, &(0x7f0000000340)}) 18:20:17 executing program 0: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x4001fe) add_key$keyring(&(0x7f0000000200)='keyring\x00', &(0x7f0000000240)={'syz'}, 0x0, 0x0, 0xfffffffffffffffb) [ 485.801270] binder: 32744:32748 ioctl 40046207 0 returned -16 [ 485.850033] binder: 32750:32767 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 485.867341] binder: 32750:32767 ioctl 40086602 20000000 returned -22 [ 485.890962] binder: 311:312 unknown command 281239937 [ 485.908019] binder: 32750:32758 ioctl c0306201 20012000 returned -22 [ 485.914883] binder: 32750:315 Release 1 refcount change on invalid ref 0 ret -22 [ 485.930531] binder: 311:312 ioctl c0306201 20012000 returned -22 [ 485.939034] binder: 311:316 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 485.948623] binder: 32750:32758 unknown command -375368889 [ 485.955465] binder: 311:312 BC_INCREFS_DONE u0000000000000000 no match [ 485.963782] binder: 32750:32758 ioctl c0306201 20012000 returned -22 [ 485.974290] binder: 32750:315 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 485.974618] binder: 311:316 unknown command 281239937 18:20:18 executing program 1: r0 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000080)='/dev/rtc0\x00', 0x80000, 0x0) epoll_pwait(r0, &(0x7f0000000100)=[{}, {}, {}, {}, {}], 0x5, 0x7f, &(0x7f0000000280)={0x5}, 0x8) r1 = syz_open_dev$binder(&(0x7f0000000300)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000005fd4), 0x86, 0x0, &(0x7f0000000340)="a71f5ce06431cba6d84d652c471889c0c17a997bec2ff43fee4565ef2b45c65cf66923542c9a7b9f2d12ded6ec6bda16d18c202556e0d99244f73a25d27a448cbd286a583eafd6dbcb32f40700000043adbbb9029d7b77d44638646691ff302b4831c933a6a3b62d2f9cae939c505d6f26b0c223bfa88f991c3450bdc11cdfaef6424204f640"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="0e630c4000000000288750714cbc7d0cd72961f15edff5808412d03377d160b0a56453a25611c2ce5510293bd175343eda2fac0d907485a5b53dbf0964562f268826097580bd2c22d55152c2200d5be39da1b3191a56b80f338f16d5206cd217158c44717180489686dd1d8604556b5acf27d022d6cfb552172962e342e5c502d81d3047a98d47c079699e9c50fdaaa29ce5708a55034b5a1b73864e8b31048270423b793835167b38c4fa7dbfa9b4ff5238809df2c716cac0e10322aae143a5d4cfe8480a595bcc81dc306f6054c6ac4b3237b3f325125a6d1a761c7472a4abeb102d03d8e567d7140ff13552"], 0x0, 0x0, &(0x7f0000000f4d)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000000c0)={0x8, 0x0, &(0x7f0000000140)=ANY=[@ANYBLOB="0663045000000000"], 0x0, 0x0, &(0x7f0000000340)}) openat$apparmor_task_current(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/attr/current\x00', 0x2, 0x0) 18:20:18 executing program 2: r0 = socket$netlink(0x10, 0x3, 0x4) writev(r0, &(0x7f0000000000)=[{&(0x7f0000000200)="580000001400192340834b80040d8c5602067fffffff81000000000000dca87086a5c000004f6400940005891550f4a8000000006700008000f0fffeffff09000080fff5dd00000010000100000c0900fcff00", 0x53}], 0x1) 18:20:18 executing program 3: r0 = socket$netlink(0x10, 0x3, 0x4) writev(r0, &(0x7f0000000000)=[{&(0x7f0000000200)="580000001400192340834b80040d8c5602067fffffff81000000000000dca87086a5c000004f6400940005891550f4a8000000006700008000f0fffeffff09000080fff5dd00000010000100000c0900fcff0000040e05a5", 0x58}], 0x1) r1 = openat$selinux_avc_hash_stats(0xffffffffffffff9c, &(0x7f0000000040)='/selinux/avc/hash_stats\x00', 0x0, 0x0) r2 = mmap$binder(&(0x7f0000c00000/0x400000)=nil, 0x400000, 0x2000002, 0x50, 0xffffffffffffff9c, 0x0) bind$inet6(r1, &(0x7f0000001400)={0xa, 0x4e22, 0x7fffffff, @loopback, 0xa4}, 0x1c) r3 = mmap$binder(&(0x7f0000fee000/0x1000)=nil, 0x1000, 0x1, 0x8030, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000003c0)={0xdc, 0x0, &(0x7f0000000280)=[@request_death, @exit_looper, @decrefs={0x40046307, 0x3}, @free_buffer={0x40086303, r2}, @increfs={0x40046304, 0x4}, @increfs_done={0x40106308, r3}, @reply={0x40406301, {0x0, 0x0, 0x4, 0x0, 0x11, 0x0, 0x0, 0x0, 0x8, &(0x7f0000000080), &(0x7f00000000c0)=[0x40]}}, @reply_sg={0x40486312, {{0x4, 0x0, 0x1, 0x0, 0x10, 0x0, 0x0, 0x68, 0x40, &(0x7f0000000140)=[@fda={0x66646185, 0x7, 0x4, 0x5}, @fda={0x66646185, 0x5, 0x3, 0x400}, @ptr={0x70742a85, 0x1, &(0x7f0000000100), 0x1, 0x0, 0x1a}], &(0x7f00000001c0)=[0x38, 0x0, 0x30, 0x20, 0x48, 0x18, 0x68, 0x28]}, 0x4}}, @increfs={0x40046304, 0x1}], 0x2e, 0x0, &(0x7f0000000380)="7f41924ce44c9156e1803be6854ce5609bca486cecd7707d2b6228490d9a05306c6fbb9a5353a574552b6ecfb986"}) recvfrom$inet(r1, &(0x7f0000000400)=""/4096, 0x1000, 0x103, &(0x7f0000000080)={0x2, 0x4e23, @broadcast}, 0x10) 18:20:18 executing program 5: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ptmx\x00', 0x800, 0x0) epoll_create(0x101) r0 = syz_open_procfs(0xffffffffffffffff, &(0x7f00000000c0)='syscall\x00') getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, &(0x7f0000000100)={{{@in6=@dev, @in6=@ipv4={[], [], @broadcast}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@multicast2}, 0x0, @in6=@local}}, &(0x7f0000000200)=0xe8) lstat(&(0x7f0000000240)='./file0\x00', &(0x7f0000000280)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) mount$fuse(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000080)='fuse\x00', 0x8, &(0x7f0000000300)={{'fd', 0x3d, r0}, 0x2c, {'rootmode', 0x3d, 0x2000}, 0x2c, {'user_id', 0x3d, r1}, 0x2c, {'group_id', 0x3d, r2}, 0x2c, {[], [{@fscontext={'fscontext', 0x3d, 'system_u'}}, {@dont_hash='dont_hash'}, {@smackfsdef={'smackfsdef'}}, {@smackfsfloor={'smackfsfloor', 0x3d, 'vmnet1'}}, {@pcr={'pcr', 0x3d, 0x35}}, {@defcontext={'defcontext', 0x3d, 'sysadm_u'}}, {@fsuuid={'fsuuid', 0x3d, {[0x39, 0x37, 0x65, 0x62, 0x62, 0x0, 0x64, 0x37], 0x2d, [0x0, 0x76, 0x63, 0x65], 0x2d, [0x35, 0x33, 0x66, 0x39], 0x2d, [0x76, 0x3b, 0x33, 0x63], 0x2d, [0x0, 0x73, 0x0, 0x36, 0x30, 0x36, 0x37, 0x76]}}}]}}) 18:20:18 executing program 0: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) request_key(&(0x7f00000004c0)='user\x00', &(0x7f0000000380)={'syz'}, &(0x7f00000001c0)="3fcb00faffffff00", 0x0) ioctl$sock_inet_SIOCGIFNETMASK(r0, 0x891b, &(0x7f0000000000)={'nr0\x00', {0x2, 0x4e20, @local}}) 18:20:18 executing program 4: ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) r0 = syz_open_dev$binder(&(0x7f0000000300)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) openat$urandom(0xffffffffffffff9c, &(0x7f0000000080)='/dev/urandom\x00', 0x2000, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0xc2, 0x0, &(0x7f0000000440)="d370590320160fd8a697b855c96bbeedd777405990212992e0df069853cb40e49b31f43485add82cbabb8507bf751747b4b111597ea0dbbb36c442c8dfb3b3b3e402505abb3cf50ed495aef7786e3b4ae4fc5748ed762cbcd748152753298fac7a4c03c2da2eca3a7b465a45366d0a6e7324beafa018348f2b85cea61b07919168c227c7d14cbf133c8bcbf102e04f4f79521f0a38b7174068e8e075e20ff0fa44e1d0c9459393bbf61f73975b393ea69a18239a1f93f14817532a5ba4a4afed0c6f"}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=ANY=[@ANYBLOB="0e41a1b62200009f"], 0x0, 0x0, &(0x7f0000000f4d)}) r1 = openat$selinux_avc_cache_stats(0xffffffffffffff9c, &(0x7f0000000040)='/selinux/avc/cache_stats\x00', 0x0, 0x0) setsockopt$inet_tcp_TCP_MD5SIG(r1, 0x6, 0xe, &(0x7f0000000180)={@in6={{0xa, 0x4e20, 0x6, @remote, 0x8}}, 0x101, 0xbfa3, 0x1, "8bc485aebae9c630af09311ce393b9dbda2310c2e00137442d738b9a8c934a59674a786dc80a62b41e5db500f35afb3d034a14046a5c30dc7506ecda5d03a545ea24e5187868fe33133dd2a9204bf3c9"}, 0xd8) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x8, 0x0, &(0x7f0000000140)=[@release], 0x0, 0x0, &(0x7f0000000340)}) getsockopt$IP6T_SO_GET_REVISION_TARGET(r1, 0x29, 0x45, &(0x7f0000000100)={'ipvs\x00'}, &(0x7f0000000280)=0x1e) utimensat(r1, &(0x7f00000002c0)='./file0\x00', &(0x7f0000000340)={{}, {0x77359400}}, 0x0) signalfd4(r0, &(0x7f0000000000)={0xfffffffffffffffb}, 0x8, 0x80008) munlockall() 18:20:18 executing program 2: r0 = socket$netlink(0x10, 0x3, 0x4) writev(r0, &(0x7f0000000000)=[{&(0x7f0000000200)="580000001400192340834b80040d8c5602067fffffff81000000000000dca87086a5c000004f6400940005891550f4a8000000006700008000f0fffeffff09000080fff5dd00000010000100000c0900fcff0000040e", 0x56}], 0x1) [ 485.974626] binder: 311:316 ioctl c0306201 20012000 returned -22 [ 485.993886] binder: 32750:32758 ioctl 40086602 20000000 returned -22 [ 485.993920] binder: 32750:32767 Release 1 refcount change on invalid ref 0 ret -22 18:20:18 executing program 5: r0 = add_key$keyring(&(0x7f00000001c0)='keyring\x00', &(0x7f0000000200)={'syz', 0x3}, 0x0, 0x0, 0xfffffffffffffffe) r1 = add_key$keyring(&(0x7f0000000380)='keyring\x00', &(0x7f0000000340)={'syz', 0x2}, 0x0, 0x0, r0) add_key$keyring(&(0x7f0000000080)='keyring\x00', &(0x7f00000000c0)={'syz', 0x1}, 0x0, 0x0, r1) r2 = add_key$keyring(&(0x7f0000000240)='keyring\x00', &(0x7f0000000280)={'syz', 0x0}, 0x0, 0x0, 0x0) r3 = add_key$keyring(&(0x7f00000002c0)='keyring\x00', &(0x7f0000000300)={'syz', 0x0}, 0x0, 0x0, r2) request_key(&(0x7f0000000140)='keyring\x00', &(0x7f0000000100)={'syz', 0x0}, &(0x7f0000000180)='vboxnet1\x00', r3) 18:20:18 executing program 0: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x1) request_key(&(0x7f00000004c0)='user\x00', &(0x7f0000000380)={'syz'}, &(0x7f00000001c0)="3fcb00faffffff00", 0x0) [ 486.045316] binder: 325:330 Acquire 1 refcount change on invalid ref 0 ret -22 [ 486.045813] binder: 324:332 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 486.046370] binder: 324:332 unknown command 1342464774 [ 486.046378] binder: 324:332 ioctl c0306201 200000c0 returned -22 [ 486.080144] binder: 324:334 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 18:20:18 executing program 2: r0 = socket$netlink(0x10, 0x3, 0x4) writev(r0, &(0x7f0000000000)=[{&(0x7f0000000200)="580000001400192340834b80040d8c5602067fffffff81000000000000dca87086a5c000004f6400940005891550f4a8000000006700008000f0fffeffff09000080fff5dd00000010000100000c0900fcff0000040e", 0x56}], 0x1) [ 486.097404] binder: 325:340 unknown command -1230946034 [ 486.103780] binder: 324:332 unknown command 1342464774 [ 486.109517] binder: 324:332 ioctl c0306201 200000c0 returned -22 [ 486.120512] binder: 325:340 ioctl c0306201 20008fd0 returned -22 18:20:18 executing program 3: r0 = socket$netlink(0x10, 0x3, 0x4) writev(r0, &(0x7f0000000000)=[{&(0x7f0000000200)="580000001400192340834b80040d8c5602067fffffff81000000000000dca87086a5c000004f6400940005891550f4a8000000006700008000f0fffeffff09000080fff5dd00000010000100000c0900fcff0000040e05a5", 0x58}], 0x1) fdatasync(r0) r1 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000080)='IPVS\x00') sendmsg$IPVS_CMD_ZERO(r0, &(0x7f0000000180)={&(0x7f0000000040), 0xc, &(0x7f0000000140)={&(0x7f00000000c0)={0x58, r1, 0x20c, 0x70bd26, 0x25dfdbff, {}, [@IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5, 0xffffffff}, @IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0x80000000}, @IPVS_CMD_ATTR_SERVICE={0x2c, 0x1, [@IPVS_SVC_ATTR_FWMARK={0x8, 0x5, 0x4}, @IPVS_SVC_ATTR_SCHED_NAME={0x8, 0x6, 'sh\x00'}, @IPVS_SVC_ATTR_PORT={0x8, 0x4, 0x4e22}, @IPVS_SVC_ATTR_AF={0x8, 0x1, 0x2}, @IPVS_SVC_ATTR_FWMARK={0x8, 0x5, 0x1}]}]}, 0x58}, 0x1, 0x0, 0x0, 0x4000815}, 0x480c0) 18:20:18 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0xfffffffffffffffe) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, &(0x7f0000012fc7)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, &(0x7f0000000f4d)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x8, 0x0, &(0x7f0000000140)=[@release], 0x0, 0x0, &(0x7f0000000340)}) [ 486.142558] binder: 325:340 Release 1 refcount change on invalid ref 0 ret -22 18:20:18 executing program 5: request_key(&(0x7f0000000240)='keyring\x00', &(0x7f0000000280)={'syz', 0x0}, &(0x7f00000002c0)='vboxnet1\x00', 0xfffffffffffffffe) pipe2(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80000) read$eventfd(r0, &(0x7f0000000040), 0x8) 18:20:18 executing program 0: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = openat$selinux_avc_hash_stats(0xffffffffffffff9c, &(0x7f0000000100)='/selinux/avc/hash_stats\x00', 0x0, 0x0) ioctl$UI_SET_PHYS(r1, 0x4008556c, &(0x7f0000000040)='syz1\x00') request_key(&(0x7f00000004c0)='user\x00', &(0x7f0000000380)={'syz'}, &(0x7f00000001c0)="3fcb00faffffff00", 0x0) 18:20:18 executing program 2: r0 = socket$netlink(0x10, 0x3, 0x4) writev(r0, &(0x7f0000000000)=[{&(0x7f0000000200)="580000001400192340834b80040d8c5602067fffffff81000000000000dca87086a5c000004f6400940005891550f4a8000000006700008000f0fffeffff09000080fff5dd00000010000100000c0900fcff0000040e", 0x56}], 0x1) [ 486.223830] binder: 325:359 unknown command -1230946034 [ 486.229405] binder: 325:340 Acquire 1 refcount change on invalid ref 0 ret -22 [ 486.237275] binder: 325:359 ioctl c0306201 20008fd0 returned -22 [ 486.261773] SELinux: unrecognized netlink message: protocol=4 nlmsg_type=0 sclass=netlink_tcpdiag_socket 18:20:18 executing program 4: r0 = syz_open_dev$binder(&(0x7f00000002c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000300)='/dev/binder#\x00', 0x0, 0x802) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x8, 0x0, &(0x7f0000005fd4), 0xffffffffffffffb5, 0x0, &(0x7f0000012fc7)}) clock_gettime(0x0, &(0x7f0000000040)={0x0, 0x0}) ppoll(&(0x7f0000000000)=[{r1, 0x530}, {r1, 0x2120}, {r0, 0x81}, {r1, 0x2}], 0x4, &(0x7f0000000080)={r2, r3+10000000}, &(0x7f0000000100)={0x1}, 0x8) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, &(0x7f0000000f4d)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000000c0)={0x8, 0x0, &(0x7f0000000140)=[@release], 0x0, 0x0, &(0x7f0000000340)}) 18:20:18 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000300)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, &(0x7f0000012fc7)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, &(0x7f0000000f4d)}) pipe2(&(0x7f0000000000)={0xffffffffffffffff}, 0x800) ioctl$VT_WAITACTIVE(r1, 0x5607) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x8, 0x0, &(0x7f0000000140)=[@release], 0x0, 0x0, &(0x7f0000000340)}) [ 486.271090] binder: 325:330 Release 1 refcount change on invalid ref 0 ret -22 18:20:18 executing program 2: r0 = socket$netlink(0x10, 0x3, 0x4) writev(r0, &(0x7f0000000000)=[{&(0x7f0000000200)="580000001400192340834b80040d8c5602067fffffff81000000000000dca87086a5c000004f6400940005891550f4a8000000006700008000f0fffeffff09000080fff5dd00000010000100000c0900fcff0000040e05", 0x57}], 0x1) 18:20:18 executing program 5: request_key(&(0x7f0000000000)='keyring\x00', &(0x7f0000000040)={'syz', 0x0}, &(0x7f00000002c0)='\x00', 0xfffffffffffffffe) 18:20:18 executing program 0: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) flock(r0, 0x4) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) request_key(&(0x7f00000004c0)='user\x00', &(0x7f0000000380)={'syz'}, &(0x7f00000001c0)="3fcb00faffffff00", 0x0) 18:20:18 executing program 5: 18:20:18 executing program 0: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) request_key(&(0x7f00000004c0)='user\x00', &(0x7f0000000000)={'syz', 0x1}, &(0x7f00000001c0)="3fcb00faffffff00", 0x0) [ 486.301076] SELinux: unrecognized netlink message: protocol=4 nlmsg_type=0 sclass=netlink_tcpdiag_socket [ 486.339733] binder: 385:394 Acquire 1 refcount change on invalid ref 0 ret -22 18:20:18 executing program 3: r0 = socket$netlink(0x10, 0x3, 0x4) writev(r0, &(0x7f0000000000), 0x0) fchdir(r0) ioctl$sock_SIOCGIFCONF(r0, 0x8910, &(0x7f0000000040)=@req={0x28, &(0x7f0000000000)={'bond_slave_0\x00', @ifru_ivalue}}) 18:20:18 executing program 2: r0 = socket$netlink(0x10, 0x3, 0x4) writev(r0, &(0x7f0000000000)=[{&(0x7f0000000200)="580000001400192340834b80040d8c5602067fffffff81000000000000dca87086a5c000004f6400940005891550f4a8000000006700008000f0fffeffff09000080fff5dd00000010000100000c0900fcff0000040e05", 0x57}], 0x1) [ 486.368670] binder: 388:398 unknown command 0 [ 486.385930] binder: 388:398 ioctl c0306201 20000180 returned -22 [ 486.393638] binder: 385:403 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 18:20:18 executing program 5: setxattr$security_smack_transmute(&(0x7f0000000000)='./file0\x00', &(0x7f0000000040)='security.SMACK64TRANSMUTE\x00', &(0x7f0000000080)='TRUE', 0x4, 0x3) r0 = inotify_init() openat$full(0xffffffffffffff9c, &(0x7f0000000100)='/dev/full\x00', 0x400, 0x0) ioctl$FS_IOC_SETFLAGS(r0, 0x40086602, &(0x7f0000000140)) ioctl$void(r0, 0x5450) 18:20:18 executing program 2: r0 = socket$netlink(0x10, 0x3, 0x4) writev(r0, &(0x7f0000000000)=[{&(0x7f0000000200)="580000001400192340834b80040d8c5602067fffffff81000000000000dca87086a5c000004f6400940005891550f4a8000000006700008000f0fffeffff09000080fff5dd00000010000100000c0900fcff0000040e05", 0x57}], 0x1) 18:20:18 executing program 3: timer_create(0x7, &(0x7f0000000080)={0x0, 0x16, 0x2}, &(0x7f00000000c0)=0x0) timer_gettime(r0, &(0x7f00000001c0)) r1 = socket$netlink(0x10, 0x3, 0x4) writev(r1, &(0x7f0000000000)=[{&(0x7f0000000200)="580000001400192340834b80040d8c5602067fffffff81000000000000dca87086a5c000004f6400940005891550f4a8000000006700008000f0fffeffff09000080fff5dd00000010000100000c0900fcff0000040e05a5", 0x58}], 0x1) ioctl$FIDEDUPERANGE(r1, 0xc0189436, &(0x7f0000000040)=ANY=[@ANYBLOB="0300001000e2fffffa0f0000000000000000000000000000"]) openat$selinux_avc_hash_stats(0xffffffffffffff9c, &(0x7f0000000140)='/selinux/avc/hash_stats\x00', 0x0, 0x0) r2 = openat$selinux_avc_cache_stats(0xffffffffffffff9c, &(0x7f0000000180)='/selinux/avc/cache_stats\x00', 0x0, 0x0) r3 = openat(r2, &(0x7f0000000100)='./file0\x00', 0x200bfc, 0x40) ioctl$RTC_AIE_OFF(r3, 0x7002) [ 486.416460] binder: 388:409 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 486.434225] binder: 385:394 Release 1 refcount change on invalid ref 0 ret -22 [ 486.452007] binder: 388:398 Release 1 refcount change on invalid ref 0 ret -22 [ 486.457640] binder: 385:403 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 486.484754] binder: 388:409 unknown command 0 [ 486.489358] binder: 388:409 ioctl c0306201 20000180 returned -22 [ 486.495599] binder: BINDER_SET_CONTEXT_MGR already set [ 486.521102] binder: 388:425 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 486.533369] binder: 388:398 ioctl 40046207 0 returned -16 18:20:18 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000300)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, &(0x7f0000012fc7)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, &(0x7f0000000f4d)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x8, 0x0, &(0x7f0000000140)=[@release], 0x0, 0x0, &(0x7f0000000340)}) r1 = openat$selinux_policy(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/policy\x00', 0x0, 0x0) ioctl$TIOCNXCL(r1, 0x540d) ioctl$TIOCMBIS(r1, 0x5416, &(0x7f0000000040)=0xf7eb) 18:20:18 executing program 0: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) request_key(&(0x7f00000004c0)='user\x00', &(0x7f0000000380)={'syz'}, &(0x7f00000001c0)="3fcb00faffffff00", 0x0) r1 = openat$selinux_checkreqprot(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/checkreqprot\x00', 0x0, 0x0) write$cgroup_type(r1, &(0x7f0000000040)='threaded\x00', 0x9) 18:20:18 executing program 2: r0 = socket$netlink(0x10, 0x3, 0x4) writev(r0, &(0x7f0000000000)=[{&(0x7f00000000c0)="580000000308b51103e3661400192340834b80040d8c5602067fffffff81000000000000dca87086a5c000004f6400940005891550f4a80000000067020080002c5a9bb7ff09000080fff5dd00000010b60100000c0900fcff0000040e0500", 0x5f}], 0x1) socket$netlink(0x10, 0x3, 0x1e) 18:20:18 executing program 3: r0 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0xc0) ioctl$PIO_UNIMAPCLR(r0, 0x4b68, &(0x7f0000000080)={0x100000001, 0x100, 0x800}) r1 = socket$netlink(0x10, 0x3, 0x4) writev(r1, &(0x7f0000000000)=[{&(0x7f0000000200)="580000001400192340834b80040d8c5602067fffffff81000000000000dca87086a5c000004f6400940005891550f4a8000000006700008000f0fffeffff09000080fff5dd00000010000100000c0900fcff0000040e05a5", 0x58}], 0x1) 18:20:18 executing program 4: r0 = syz_open_dev$binder(&(0x7f00000002c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000300)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, &(0x7f0000012fc7)}) r2 = openat$selinux_avc_cache_threshold(0xffffffffffffff9c, &(0x7f0000000040)='/selinux/avc/cache_threshold\x00', 0x2, 0x0) setsockopt$IP_VS_SO_SET_ADD(r2, 0x0, 0x482, &(0x7f0000000080)={0xff, @broadcast, 0x4e21, 0x1, 'nq\x00', 0x13, 0x81, 0x55}, 0x2c) r3 = gettid() waitid(0x2, r3, &(0x7f0000000000), 0x0, 0x0) read(r0, &(0x7f0000000180)=""/159, 0x9f) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, &(0x7f0000000f4d)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000000c0)={0x8, 0x0, &(0x7f0000000140)=[@release], 0x0, 0x0, &(0x7f0000000340)}) 18:20:18 executing program 5: request_key(&(0x7f0000000240)='keyring\x00', &(0x7f0000000280)={'syz', 0x0}, &(0x7f00000002c0)='vboxnet1\x00', 0xfffffffffffffffe) lsetxattr$security_evm(&(0x7f0000000000)='./file0\x00', &(0x7f0000000040)='security.evm\x00', &(0x7f0000000080)=@sha1={0x1, "f519dd40248119826b84cdeaf0a6def445a98ac3"}, 0x15, 0x3) 18:20:18 executing program 5: request_key(&(0x7f0000000240)='keyring\x00', &(0x7f0000000040)={'syz', 0x0}, &(0x7f0000000000)='vboxnet1\x00', 0xfffffffffffffffe) [ 486.593595] binder: 432:434 Acquire 1 refcount change on invalid ref 0 ret -22 [ 486.601662] SELinux: unrecognized netlink message: protocol=4 nlmsg_type=2051 sclass=netlink_tcpdiag_socket [ 486.623627] binder: 432:434 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 486.632894] binder: BINDER_SET_CONTEXT_MGR already set 18:20:18 executing program 0: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) request_key(&(0x7f00000004c0)='user\x00', &(0x7f0000000380)={'syz'}, &(0x7f00000001c0)="3fcb00faffffff00", 0x0) r1 = openat$null(0xffffffffffffff9c, &(0x7f0000000000)='/dev/null\x00', 0x0, 0x0) ioctl$ASHMEM_SET_NAME(r1, 0x41007701, &(0x7f0000000040)="8600") 18:20:18 executing program 3: r0 = socket$netlink(0x10, 0x3, 0x4) r1 = openat$selinux_mls(0xffffffffffffff9c, &(0x7f0000000040)='/selinux/mls\x00', 0x0, 0x0) ioctl$ION_IOC_HEAP_QUERY(r1, 0xc0184908, &(0x7f00000000c0)={0x34, 0x0, &(0x7f0000000080)}) writev(r0, &(0x7f0000000000)=[{&(0x7f0000000200)="580000001400192340834b80040d8c5602067fffffff81000000000000dca87086a5c000004f6400940005891550f4a8000000006700008000f0fffeffff09000080fff5dd00000010000100000c0900fcff0000040e05a5", 0x58}], 0x1) 18:20:18 executing program 5: request_key(&(0x7f0000000000)='syzkaller\x00', &(0x7f0000000040)={'syz', 0x3}, &(0x7f0000000080)='vboxnet1\x00', 0xfffffffffffffffa) request_key(&(0x7f0000000240)='keyring\x00', &(0x7f0000000280)={'syz', 0x0}, &(0x7f00000002c0)='vboxnet1\x00', 0xfffffffffffffffe) [ 486.650909] binder: 432:434 Release 1 refcount change on invalid ref 0 ret -22 [ 486.661553] binder: 440:452 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 486.675057] binder: 440:444 ioctl 40046207 0 returned -16 18:20:18 executing program 0: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) listen(r0, 0x8) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) request_key(&(0x7f00000004c0)='user\x00', &(0x7f0000000380)={'syz'}, &(0x7f00000001c0)="3fcb00faffffff00", 0x0) r1 = openat$selinux_checkreqprot(0xffffffffffffff9c, &(0x7f0000000040)='/selinux/checkreqprot\x00', 0x2000, 0x0) ioctl$LOOP_SET_BLOCK_SIZE(r1, 0x4c09, 0xfffffffdffffbffd) 18:20:18 executing program 4: r0 = syz_open_dev$binder(&(0x7f00000002c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000300)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = openat$zero(0xffffffffffffff9c, &(0x7f0000000200)='/dev/zero\x00', 0x4000, 0x0) ioctl$BLKRRPART(r2, 0x125f, 0x0) fcntl$getownex(r1, 0x10, &(0x7f0000000340)={0x0, 0x0}) ioctl$EVIOCGABS2F(r2, 0x8018456f, &(0x7f0000000000)=""/36) prlimit64(r3, 0xf, &(0x7f00000000c0)={0x7, 0x3}, &(0x7f0000000140)) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, &(0x7f0000012fc7)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x23b, 0x0, &(0x7f0000000f4d)}) r4 = openat$full(0xffffffffffffff9c, &(0x7f0000000180)='/dev/full\x00', 0x220200, 0x0) ioctl$SNDRV_TIMER_IOCTL_SELECT(r4, 0x40345410, &(0x7f00000001c0)={{0x0, 0x0, 0x141, 0x0, 0x1f}}) syz_open_dev$sndtimer(&(0x7f0000000240)='/dev/snd/timer\x00', 0x0, 0x401) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, &(0x7f0000000080)={0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000040)={0x14, 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="1b9c5781", @ANYRES64=r5, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']}) [ 486.714813] SELinux: unrecognized netlink message: protocol=4 nlmsg_type=2051 sclass=netlink_tcpdiag_socket [ 486.728923] binder: 432:434 Acquire 1 refcount change on invalid ref 0 ret -22 [ 486.739938] binder: 432:465 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 18:20:18 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000300)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0563044000000000aa8d06aa48f588cfb0282668d6e56c40f5fcb39700f4ce790e1d833091d705a25597f59ab10eabaea2b92ae2282777d67f27dc4382af5c319f370cf0a371a689e7ea0bd2fe631ba3408255e65b6d0eac17e192fbfce6176bdc38f1afd5909bd31f4569"], 0x0, 0x0, &(0x7f0000012fc7)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008fd0)={0x0, 0x0, &(0x7f000000dff8), 0xc5, 0x0, &(0x7f0000000340)="13f14367d5ffb7c2c12362b3f715fa121527ee25653d9c625179e5cc49d0ec344e57760caec0f46be6a457ac02d3066d52ea761be4cb4f876a485ef69d05b10f0b831c0582fc4d3588cf6f88321c7fdee87d9353fe8f29412b552059c592186d62618a60f1d4cd2e8ea3b81c94b014ade3c942305b71ec16d73cddf6472132e8d787e69a32bd8498199b231db71f49e240f9d05b4ff6e926445ada7a91575123008b7d68cbe2880053d5f64915a3b97e555a92b9614c11f2f9bf1816000000000000000000"}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x8, 0x0, &(0x7f0000000140)=[@release], 0x0, 0x0, &(0x7f0000000340)}) 18:20:18 executing program 2: r0 = socket$netlink(0x10, 0x3, 0x4) writev(r0, &(0x7f0000000000)=[{&(0x7f0000000200)="580000001400192340834b80040d8c5602067fffffff81000000000000dca87086a5c000004f6400940005891550f4a8000000006700008000f0fffeffff09000080fff5dd00000010000100000c0900fcff0000040e05a5", 0x58}], 0x1) r1 = openat$selinux_status(0xffffffffffffff9c, &(0x7f0000000140)='/selinux/status\x00', 0x0, 0x0) write$UHID_CREATE(r1, &(0x7f0000000380)={0x0, 'syz0\x00', 'syz1\x00', 'syz0\x00', &(0x7f0000000280)=""/251, 0xfb, 0x0, 0x800, 0x5, 0x8001, 0x7f}, 0x120) setxattr$trusted_overlay_upper(&(0x7f0000000040)='./file0\x00', &(0x7f0000000080)='trusted.overlay.upper\x00', &(0x7f00000000c0)={0x0, 0xfb, 0x60, 0x1, 0x9, "63299570223fcd2c32063c4147586fc4", "59e4dc98a9ea7a92526cd60d1976538d28628b07f5f609f638bc02c55fbcce5526d5fd623c802dec5ee54aa278e58930ea78acc1136f78fd8c887f3ee69a7985c419b66caad81bb8626401"}, 0x60, 0x1) 18:20:18 executing program 5: r0 = syz_open_dev$binder(&(0x7f00000002c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000300)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, &(0x7f0000012fc7)}) r2 = openat$selinux_avc_cache_threshold(0xffffffffffffff9c, &(0x7f0000000040)='/selinux/avc/cache_threshold\x00', 0x2, 0x0) setsockopt$IP_VS_SO_SET_ADD(r2, 0x0, 0x482, &(0x7f0000000080)={0xff, @broadcast, 0x4e21, 0x1, 'nq\x00', 0x13, 0x81, 0x55}, 0x2c) r3 = gettid() waitid(0x2, r3, &(0x7f0000000000), 0x0, 0x0) read(r0, &(0x7f0000000180)=""/159, 0x9f) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, &(0x7f0000000f4d)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000000c0)={0x8, 0x0, &(0x7f0000000140)=[@release], 0x0, 0x0, &(0x7f0000000340)}) 18:20:18 executing program 3: r0 = socket$netlink(0x10, 0x3, 0x4) writev(r0, &(0x7f0000000000)=[{&(0x7f0000000200)="580000001400192340834b80040d8c5602067fffffff81000000000000dca87086a5c000004f6400940005891550f4a8000000006700008000f0fffeffff09000080fff5dd00000010000100000c0900fcff0000040e05a5", 0x58}], 0x1) fcntl$addseals(r0, 0x409, 0x4) [ 486.772684] binder: 432:434 Release 1 refcount change on invalid ref 0 ret -22 18:20:18 executing program 0: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) dup3(0xffffffffffffffff, r0, 0x80000) dup2(r1, r1) openat$selinux_status(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/status\x00', 0x0, 0x0) r2 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vga_arbiter\x00', 0x40, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$EVIOCREVOKE(r2, 0x40044591, &(0x7f0000000080)=0xcc2) request_key(&(0x7f00000004c0)='user\x00', &(0x7f0000000380)={'syz'}, &(0x7f00000001c0)="3fcb00faffffff00", 0x0) 18:20:18 executing program 3: r0 = socket$netlink(0x10, 0x3, 0x6) writev(r0, &(0x7f0000000000)=[{&(0x7f0000000200)="580000001400192340834b80040d8c5602067fffffff81000000000000dca87086a5c000004f6400940005891550f4a8000000006700008000f0fffeffff09000080fff5dd00000010000100000c0900fcff0000040e05a5", 0x58}], 0x1) [ 486.856499] binder: BINDER_SET_CONTEXT_MGR already set [ 486.870118] binder: 471:488 unknown command -2124964837 [ 486.890311] binder: 483:487 ioctl 40046207 0 returned -16 [ 486.899393] binder: 471:488 ioctl c0306201 20000040 returned -22 18:20:19 executing program 0: r0 = accept4(0xffffffffffffff9c, &(0x7f0000000000)=@hci, &(0x7f0000000080)=0x80, 0x80000) r1 = socket$netlink(0x10, 0x3, 0xe) r2 = accept4$packet(0xffffffffffffffff, &(0x7f00000000c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @link_local}, &(0x7f0000000100)=0x14, 0x800) r3 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000140)='/dev/loop-control\x00', 0x80840, 0x0) r4 = socket$inet(0x2, 0x80003, 0x4) ioctl$FIDEDUPERANGE(r0, 0xc0189436, &(0x7f00000001c0)={0x53, 0x401, 0x4, 0x0, 0x0, [{r1}, {r2, 0x0, 0x100}, {r3, 0x0, 0x2}, {r4, 0x0, 0x2}]}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r5, 0x8912, 0x400200) 18:20:19 executing program 2: r0 = socket$netlink(0x10, 0x3, 0x4) writev(r0, &(0x7f0000000000)=[{&(0x7f0000000200)="580000001400192340834b80040d8c5602067fffffff81000000000000dca87086a5c000004f6400940005891550f4a8000000006700008000f0fffeffff09000080fff5dd00000010000100000c0900fcff0000040e05a5", 0x58}], 0x1) r1 = openat$selinux_avc_hash_stats(0xffffffffffffff9c, &(0x7f0000000040)='/selinux/avc/hash_stats\x00', 0x0, 0x0) ioctl$TIOCGSID(r1, 0x5429, &(0x7f0000000080)) 18:20:19 executing program 5: setxattr$security_smack_transmute(&(0x7f0000000000)='./file0\x00', &(0x7f0000000040)='security.SMACK64TRANSMUTE\x00', &(0x7f0000000080)='TRUE', 0x4, 0x3) r0 = inotify_init() openat$full(0xffffffffffffff9c, &(0x7f0000000100)='/dev/full\x00', 0x400, 0x0) ioctl$FS_IOC_SETFLAGS(r0, 0x40086602, &(0x7f0000000140)) ioctl$void(r0, 0x5450) 18:20:19 executing program 3: r0 = socket$netlink(0x10, 0x3, 0x3) ioctl$FIBMAP(r0, 0x1, &(0x7f0000000040)=0x4) writev(r0, &(0x7f0000000000)=[{&(0x7f0000000200)="580000001400192340834b80040d8c5602067fffffff81000000000000dca87086a5c000004f6400940005891550f4a8000000006700008000f0fffeffff09000080fff5dd00000010000100000c0900fcff0000040e05a5", 0x58}], 0x1) writev(r0, &(0x7f00000001c0)=[{&(0x7f0000000080)="b7ec70e574417eb367eb2e7c30724cea308a976c436c9fa74bf9b9b54581b94fade4fe1f673437469d2333e109e41ad924408cacaebedf773b7564568eb81cae1162be1730b69a46cba164cfc925af3cb86cb1e44691085d80d6463bd4bac7dfdb8447ee9c5ba0bb4a40fa1d2a4a256a468141dff224784fbe2867b66ff2e5b366e2fd4630de5b19703ad57a141a2a908e9be619e38391c88349bba954940a49708eaca0fcb70a8b881ddb000742f77b427270690d9d56af9657197d58bfc8681fd146e761c4ca17f051b3684bce11b17d5504", 0xd3}, {&(0x7f0000000180)="bfae00a584daa73b4608cfb6e8700f0ef19dfa64d3279de5ca9dd655e613eab020daa0ed42c860", 0x27}, {&(0x7f0000000280)="a62979d6b2a2ba5979eab178bc757048566c03c34a683abc36525c944ed15ee8c0dc1b625a36139cdd88a8578f0d05411311deb1720aba17679b6ebc0b7c043c2f139c28d57dacdae53f16f6b153d403ed8a6644fa90cae000f3a5674cfacf5131bc5899b8086fd3f55fa29c9bd36c56615d8ce4bee7cd8d0242b6e324ffb71f643b0a4e6f4c9f2dbce7532028b2c17038f9ac3d1de45c9e195f2a83bc47bddce08afc647e5585689d7e2c5a7f9e2e8f47dde472a4c5e16b5d3df220d3519782bb2cbfdebc076efba48c590d9486ad2da18b80cdc61e827c7cb49f", 0xdb}], 0x3) [ 486.924585] netlink: 8 bytes leftover after parsing attributes in process `syz-executor3'. 18:20:19 executing program 5: request_key(&(0x7f00000004c0)='user\x00', &(0x7f00000000c0)={'syz'}, &(0x7f0000000040)="3fcb00faffffff00", 0x0) 18:20:19 executing program 4: r0 = syz_open_dev$binder(&(0x7f00000002c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000300)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, &(0x7f0000012fc7)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, &(0x7f0000000f4d)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000000c0)={0x8, 0x0, &(0x7f0000000140)=[@release], 0x0, 0x0, &(0x7f0000000340)}) [ 487.601418] binder: BINDER_SET_CONTEXT_MGR already set [ 487.606791] binder: 471:488 ioctl 40046207 0 returned -16 [ 487.607350] binder: 471:532 unknown command -2124964837 [ 487.607358] binder: 471:532 ioctl c0306201 20000040 returned -22 [ 487.637847] binder: BINDER_SET_CONTEXT_MGR already set [ 487.643514] binder: 533:535 ioctl 40046207 0 returned -16 18:20:19 executing program 1: r0 = dup3(0xffffffffffffff9c, 0xffffffffffffff9c, 0x80000) openat$cgroup(r0, &(0x7f0000000040)='syz1\x00', 0x200002, 0x0) delete_module(&(0x7f0000000000)='/dev/binder#\x00', 0x800) r1 = syz_open_dev$binder(&(0x7f0000000300)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, &(0x7f0000012fc7)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB="0e630c4000005c1b797111c1e2fa1317fc864cde0000"], 0x0, 0x0, &(0x7f0000000f4d)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000000c0)={0x8, 0x0, &(0x7f0000000140)=[@release], 0xc8, 0x0, &(0x7f0000000180)="f000b9c1099f1d1c2fc4eae3e760c4bff8143371d7933d1201102f587d008f3f57f57297fe2de5ebdad1eb996b9be11e4039dec94d2c04ad377d337e83bf3e77f49b0e9cd28749b066a3beaf599045a6ef0f30f9e17a2aedc2732bea321347c4004475667632c024240174b084d2369f350a5576a237aa66df148789bb96fe3867c5fe991c9e0af02538336e0714067b2e4267d4cb7bdc160311c6379436510e9faaf8e3c3e3a19bbce17b4ec632d1b8257d7172489d45100ad2b315999dfd50c34079784a011971"}) 18:20:19 executing program 5: request_key(&(0x7f00000004c0)='user\x00', &(0x7f0000000380)={'syz'}, &(0x7f00000001c0)="3fcb00faffffff00", 0x0) r0 = openat$selinux_avc_cache_stats(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/avc/cache_stats\x00', 0x0, 0x0) fcntl$notify(r0, 0x402, 0x34) 18:20:19 executing program 2: r0 = socket$netlink(0x10, 0x3, 0x4) writev(r0, &(0x7f0000000000)=[{&(0x7f0000000200)="580000001400192340834b80040d8c5602067fffffff81000000000000dca87086a5c000004f6400940005891550f4a8000000006700008000f0fffeffff09000080fff5dd00000010000100000c0900fcff0000040e05a5", 0x58}], 0x1) r1 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000040)='/selinux/enforce\x00', 0x220040, 0x0) unlinkat(r1, &(0x7f0000000080)='./file0\x00', 0x200) 18:20:19 executing program 3: r0 = socket$netlink(0x10, 0x3, 0x4) getsockname(r0, &(0x7f0000002cc0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000002d40)=0x80) writev(r0, &(0x7f0000000000)=[{&(0x7f0000000200)="580000001400192340834b80040d8c5602067fffffff81000000000000dca87086a5c000004f6400940005891550f4a8000000006700008000f0fffeffff09000080fff5dd00000010000100000c0900fcff0000040e05a5", 0x58}], 0x1) stat(&(0x7f0000000100)='./file0\x00', &(0x7f0000000140)={0x0, 0x0, 0x0, 0x0, 0x0}) sendmsg$nl_generic(r0, &(0x7f0000002bc0)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f00000001c0)={&(0x7f0000000280)={0x290c, 0x2a, 0x100, 0x70bd2c, 0x25dfdbfb, {0x19}, [@typed={0x8, 0x1d, @uid=r1}, @nested={0x1100, 0x48, [@generic="9cc20c69397146d06e19b055278bf05e70da86794331cc2f70d5d999e500dcc8299c0558b0bbccae15e81d55221a3b607cf318f62d6bb13623bfc73ed8dc5ff1e8b80d4ec4daa3203ee1d94460d2d2f711ddf4b72a273f7d2ff3a86b847549926e42f686b2063ee3ba0014477d09148fcb81cd45812cac575b1d6af8bbdd04fc0cb20334572c240c42c9007a39140f9ed1b0ab2238f2b6522fb3138633cb5ef7000c1f5be103775497cde03edba135a52bd19ac95c7d7493e32b19d62759f5a5096a33d6e74b9ca2a1ab4d640639d32e6f78cc13e6ce1a4c9741f945cf5fba9d0fe454a6bbe57e", @generic="5cf1eb562737", @generic="9477ab0e9b0adacd6b199f", @typed={0x1004, 0x6a, @binary="a8da1113f71b9abdbd4e65c6c2b35bf8492a8e219d7ef8f321ba42c035798328c3bea73882a6ddf72b83d218f48d437406a4f62397362c1a11effed30d950720f22f3ccc7b07effb19bd36b928aa19b916ef35ae484e5c393b0c6dbe972b1be4e57cee77bdb532a12b274b6559a766e17f55d3809ddf66a0738a689bd3836e623a7f1c21181f180e4b7bffa3621314772d6b7bc1ea720ebbdcef9508c05252e0d5ebfad06314555a5c7e61a4c47f81a3af176b0ece237e1917cf977b34b9bb67b4b77db059e386b584c671a1d28cd7f5b03532fb92a8c454fb36974f8f6382ba45f3e53608e146e338dafdd3d454d4f7588f998d98e5e0fc1afd9b00eb2f8e3372e987e5ee4e3f112c99187f5c7755ce5844782c15dfa2b1c5061d42905be152237c48718636976f2009c72799bdfbe24a6ea12da8d17398f4ce5d83c3bc70805da721bf83463b213408038e619575815a724cb03cbfee8bbe2527702a6f7a87d3c6445d3938adcd13c285b1ef645a8bbabe16d4789a7d5b3d307ffb2025567bca9dabf69bd93fe3948b81960684ba922202bef4fd771001c759c9c37d0534525907afdc94bd691f99d1a6c030ffd081d47d577f46aca6c49d520514ab03623ca4c35ee917e2b24a9be51518a8e11016841eaf388d5de0926787fac8cef6981abfb0af6c0fa1479605a758d04146b5b16d587a180266d947f05835ded64ba96cc438cd752fcd8b0bceb5c6f87e5fc3715f8bc0af3ee3f3497b5f6fffcaf819f779a5a97f65e90e112a921a0410aaa779941dc118d041d3a75374af820d18ca57e8a6608d83cf08b263ff62d42fd1577b5b2b133b5e38dc5501ff1ff0c0dd5f1d5b6c8644ccd67dacd923ecea238668c3b262e8e2db322cce875683bb2b738c1d4962f6987a5591a8de10497489649a5c20c1c1422cc7f350d2925e8e2b0da4acc25ece39fcec7329befe12f26d97bf4a418fb5f82af1f6a52b068f3eeb4be4b5fec2f51534784dd2ece9b85ebb12e5e2917844fcc87d8225d40381e89c16434b96a140c757a66c2b0d662a5cdce26ec6853a729ade1d5d23859ab0192294268b9d6829dd2d58c135c551fcfa5d58ef588330479c98aee7a2db6530fbb13ac77728dc3b1992c498770fed01418ba2eeca2daba13c272a3e0947c2e1a9679365ec6d7954caf916250c81504783d7e20f23e68234f87264cb23afff004d03bd05ca64e31001899d4a08ee197f7b6716abb762d4989c236e8843b3f7667c4505d98b40fad36e1873a14cd84e7e1d782655d78cea8f9f69eeed85773b940c31fae5f7034180448968e82858d521c024a08fff1f0e0f0bf9eb78324fe56e3d62e81f921186ecee30d7be0a68b1b87ea245d69f7414966dafb1d38b026ce5d984128daf803c6edfd5086017b1559a886d56a9664e55963d3f67a73384d72aa8621034c7cd35170658483df6f42c5be019f215fa08f5e76f89d31d5f88cb66a8fdc094941ce21a5e7e4bf88288f17ed8dcc2504b96d814c8767357ffff0ab6cf3724bcad7add17b0dd6ec043b1a09223f01d45d245e7925631d25e1564b72f1ecf814ed45cb4f763c5fd6f99d876f77eadc72e645525924fe47de7c5675d184a73810d245d0c54fd853180b3d5cdfb7727ed7e6da80213a3b0ec1bf4c087d18c35437e3e7dec78136e71a05185d910c3de89754122177cde7d65bde92878c6e19d84beeb6ba552dbe2779852563bcf91c3caabd1f4f968c8205da64560eb6ce3f22f631f016bac10c2415ab29c4be06e3e1f6eae71427f9ba6c95833a910e4c69612036bc51d8f922ab391653297c9983f215b7657822d41f74fed68fd846b462bfda813bdfe0a1be7d7a50948412922bae2a3260c60dfe3dc0070cd860ada1bef200ee7edd6a06c6fe39f65662a6792b1a6eb41e8ec78f6ce3b9246de61b9b5b716a8e33a6fc4bfaef208246761b18d77bfdad204a3508f11aca04bff0971a9b8743e5740903e25147df5f7b3689ea3ec624b3bd0fe487c28c33bc875b677620a8cdaebe6fccc0cbad5f99d45080ba96e446664c0b2e5ea783a954f5085271481e353da243318067cc76dab02a7f32df8483b20c00441764a6bba4b49bcb815969c55ebccc868813bc2a97e94df08e40a4706ef0a910a16ffb0c7d1ee30571268241671f0f18708038ff1b109cbd008672512237ad428897ea2e5e14ba0d42c805fb46cfd43715d19b6595519b6030d8c019d1d28546bbacdbb62a8752d1bae34489224637b40b5eb3d1822222092477299865c3d8314dfd31617233c90d2caa2e66eb876fff3d03e0b3287733942d2a8cd11b1d822de4e92cc5290efcd0aaf4d0c53f6b51f01cedb0a2f293c7de24e6b09c0d42f5559b5986b7df4016938d6c8a90fc618e8ae26ebe807ed6908da6780505e1fd37953fdde18eb5e547527db2abd18c219b715aae8e8d36dc54804d5dbb048a9ffb782fd84638dd5091af267af066d982c1402c7a8cb1e8f184534df03150afeeddf6b186e57b76a06666b3d28888584dc83a579889f014cabfef4369bde6539896dd0046dc1781929cfad6e8d25107dc8ccb00a0016f43b1c1b3298f62b30a966660c92bac0fbba418599f53df0219f88d4652efb276dfff4569c59cda2f60366e216e67e4370c23207e6295a75044b79cc163e93657c49bb062812ebfe5cc53ba340eb1f2c74300bde806dd050e1cfafe33dc62538d59ad118efc491f1325f579402ddcf4cd7b5331699d16f7af1adabcfc1c99837d0e31f69fce97cb3eaf7b390de7d617e2fe54e23bd917e2833998e973802f0e63c52c006029e9a048f1d666a4727578833d37637f1bd491907883a3edd967a795b403ea7bedec9fb413d9775912a8be39394468fa83f6cdd01f1fbbaeb26ee67f4fc72110fda828eed4637c16e1db31def52d1d3127619efb98a6da1734dccdb6d7bc01cfda5b6c845d1820a43fb75ba623ef8d531c9354c17fd71cfe74854643e9099496aa43d44e02c3093eb64dec2f95b2f4c68057de414e6f4edeb1a756ff5798d03104e4e6c997e20a25594e17846c8e99032a9719f6a5a08ad015aa178828ee60fec0d6f6d6e09231a9d0a8288e14ac8edc7230c231596db974aee1be76efad6c65e0b6af6d62e31bfaf95e0af5b0d74f2339fd0ea6c61f7a6601c899305a21e90f5655e90d90bbb6de6cbce42772b20cab550abeefb443c6739223186b26f5158865dc60aee37de93f37502f76d5caa777e8788d9c15926469b7c1392d0fc9c20f7288fcbfcd46a4fb7ca3fd9c548729aec3a979a5106fd4c6c5605878ab59ad6a8ed266198b942ef9ef7b05ab17695b284acab246172e584d2ebc6944a7a832cb434df3f4a05dcdde7559f0cce44f60587932dc3c9bcb0d60c7303e00ea55a248204e4e31d9d53c5f159dcee881e483a719d735fea614bd1ad55abd6b363e41c2828d5a248d1c0143fbc1a9d33c314800429fd910cf6de88489832ef87d5a1644694c603267b79f27ec8328ba9a101bcefb8806f4250fa47fe42fa5df817139d041f9d2dafa70538928049fec311809efec6b6405f88eef9340b03a4dd49440f8e4741de4e52d93f45086e093ce686ea2af5d7b7b79a069f5d8badd2db8dc6a660fa3a73d175ea04c3fcfa43771f2059b27550c3648b6ca251a8b17c2b854f7438873f26b8b7714574c4df395a00ec8b93f1072eead2f71f8619710c9bf01e54914da7ec62f8e776af5dcf5928910a2b6c2111e03146bfc803d5bd9309415606e009221a09007e1ef4bf90f332e0786d9a9bf49d6e8a3ec712be354969493b45e02866b9306c6c8ecc22100d14ac3815e55d74ed9fbaa0a75c9420592dcc0d7f24416eddbe3d8ac9ec275a2c4bb7210a6ac478daea1b68640df338270537a5120b3e2419ee62f250dcdfbb4125e2a7464676bf0787b854079233f9cb8caa206dab6e34244982a38b04b693e5efa5360b339b6b567429ea232d60f0dd0312ace4f594ecade6e859b6353d3a09e04f7ffa4531e5a6d4c81b4a214d9000e596b016bf11052ace20f8526d20ea28a74b5005c4e4753b6bf41faa67a64b91a9ac5873e85afcf665c866ea958810df6945679cdb1a276846883e82f3c2f0a056c5b20254fbec0eb49b95779343ae83dc7bdb424077a47321074deb74fa461aa8ccb6205ac1fd8d56b07addbfc318e6bffffcbff28c4cc72b16f13f7a92b75b8898d9ed4ac49dbff27c9787fdfca0ef9d24d294125204379a6e14963cf00769d2a6dba40f4ea896773ee15abee9e2c0454e7216af7e9e0f7b39349fa687b66fa409fecf6f1b1908d847cd94c3acd02c8fa12a2596a9ff411b280bec2437a61abb900a7da0f99e91d2ee1b68ec5fec9a7e05cf9b9d76042efee03058f92f9a3320f4ec8419e25e954dda00adcb6a4b54126634afdc755165b3bd192d5d71c4c772ec5bde4d06c2c38d443465b2d6af87772f968269bf12b3906c68c376435beb6c2febc897158df8de308c027fee0668c0761e6477a4be509a213ee71f44bfda092bef14ca809e5c2b924cc1b05333a11b94584a1262f0e75f4ed000f730cfb4d7dd538e0d9979aec0138da09c49ecdfec93c4450e5ca5ce06b2459b5dbb8fa930f42ab29d356c0d37198c0856cce339494a13763f03eb1620b605f319f3324b0a8094523e1537ce7be8c800c2b695ca1bdd1fe42de408b9c279ef2a28e405fef99c204f660487be7ea5f1f8147f63f1d1dd9a744118d489ad3b53285c2487f1d12317dadac290f291f0300c38b471bf16c73a33fad8eae54ea2e192e1c436d7fe33d3e01d109a9be757491de3f157b36da8f88e7ab85d36ec776862c5a3b3b39a24148c17556df89cea239d01b14c3b3beb2931f97dbc61c0f97bae4f0fefebfe708dde757dcf8d719273ac070a6d67265931b4f83fbb09514b3cb467fbe5dd4d730840a40e5955b0c6386588080f38f93f7a2fa83402bf36fe9680638dea43a49e951840fa6a59699b2ad8de0c3e6b250c376b2a42a88e15850501029de78b06006b6e383d9042c69b94c5b731daf24a074086df8bdd63e56c27429379111e62f4cb6aa9caa3fb365901ec26c9d3a322cb3033a16a3c212c923c2ee81be83698ad81a9c2e9ae4bc78f9511113ee5cc3f443ac65878d10c2bc58fd694ee2316c91497a94f14e0c32c1c36a43fb2f0c57928586a891d52b5c3f3446d55890c124378259888194a2f2508df54c2b23d31b869bfb1021b836bd8cd431ccd9be46c2f276f431358120a3cc0a746199a63015233206954c7e2824a8ac0d11ecbd2df5381387ebaba02494e85b0ef8a17835d0ce4f67100b6c2eac2198aaea8e4f37b68e5071145352de0efc301156f69f5aabac3020dbdff4b047aa8834a1d9de74797142001ebc89ed4216146b555363e02205e4a7ed02825f090979b8bf586e6b1d09e954d2058399d77720dc48c7f59fdb12739d9c64e98a9ae7bf55ea8b57304974c7ece680d78743bb99b92fbcc553280ab23c1adaeffcf02cc82ae044489f04dd39779dc90474cf4f4c6528d2ab83ef3e9f9c48e58cda33c1b465f8844b0e9619977be6f10dbd15bb4eb58ecb87bdeefdeec67b15ca2f76b78303b7949a30f55cf439a74930e145c09d97bd03e5bfa346a5b6a1bfd3d61ac1d53890a4f72613526133d7aee62cad994a8a3c2757f3f874c10b23618f1efc0b7e776923eca1d8121700ec66eae5fd5e5b78b60f51f2f679116018f0197edda6b7150245e55f31b47a2788a8c8cbc97ee548a548a040da1c8c91940a7d2ef1f5d"}, @generic]}, @nested={0x34c, 0x3a, [@generic="b7c9fc249305bfdff04bcd3d822217709c0df3705176c3fe9c473f7ad430a80245d854d46be6219810ceb7a810119c8df940ba9d2fe2585b33ec195cfe3df0c66a97923ae0df37d4f78d597604b9f42cb91c3659cb9e481b33be53a28e315303fd3d086d285ce8d2b592cd1829ab32086497e2d473d5ef138b7088af505fa869870089427a5f15e3548f969c12459f39daece06e69f455250fcb14aa7efcc16a7de3c2923bfa15eb8a8d909d5acca325bd1d01fd2dce88c2b7ade598cb804817f7a00ca928d06f838741d373294ada872c18018427", @generic="57d6d52a59a10bd3ae82b18beb8860a7263bb1f63f6c0ed74757bf73562669588fd94684d442f02174d04da0c6359720706d9aa0a54f143fef4178a508878027c5f85c1373af0307339e2262da4721", @typed={0xb0, 0x40, @binary="c8227171522eb8ad31cfa371aee6bdef3ff60fd36ee578ba7e6bea84232e815d052287c0c69007728cdb79ce3d576b9ec7e0c3d9259cfa426c9819f126db027ef29cb1229b60801f34613626a2206dc1ff2adda0c90770bfaf31355e502eaa3609af8e87034f63b6eb08732d5992942da03e6e982133490e098fa2024b9ffd86c3424bd7ece47785014c00ae359dffd9a875eeb6a8ac77a1a41496f56e78b38f28dc85f2cbe0c553cbdb"}, @typed={0x44, 0x76, @binary="96b9b241f1289702b8f1010cbbdb5de995cd3a782be4a136e86ceffb82e8d666f1a59f8b7d9cc632b1d85c46dfdf90531841e17b600e54afea25a6cdd89b28"}, @generic="dcfaeb140a9dde72a5ee47c12f3b3cc56417de8906dbcd11ff5377fb7660cf80764b0f4a439e061a05eea74ae6fa5ba15a6df81402f9e54a5a2ab68c7fa6815340ca5e9ce6aef478923832399c24394182e66c4a992921dad2c607974434714ed7dc7247c23019ae7c9d59c0f8253b5cd80b30724f179841c844906dbed846f010620c2d21854cb064f90a0de13d660862ab1dd4564f9c3b8e316ba7bfbf9a09531a76ace13d0296bc7ce9c3a5bc38e8295464f69dd8ffb3", @generic="e408ae3454e967ed8ca67139227174fcc618a84f61cd5cbfede901809bb39347b6f04973235ed8d3f888c6f4056eed285071991e9e8b3857fde4dd2a52e4066fb04e14da591555a5abe9dbdb02262af41dfd770dbe8e07", @generic="de4b602430d9cf21d76277765a574b98de2225d172aa9e65cff0a9c7fb1f523a"]}, @nested={0x1e4, 0x6, [@generic="3cfa13482942e827c200323d0da66b7aaf533d0ea0eee1929bf412795b1ae6d8957f608c80bdd4eafd44385ac6fce1a21e7a4e212d801f59a48b70c8a571dfb9c7c38f53a0d0759e64500456fec64bd2cc8a314a858c24139127d22fa9db80d2a07b9d44af58ce8fd73f5307073fdece6b894018cc4fff01c09a1db3cb157be71a5eb3b525480f0963a7f35a336b65205c5d94461f3b9fda60df0d1ef962b658f16f5f0b8de78743defe6a349b67cf756f5f86099687a09c7b5ca4d1fde83ac3b2222dc676976c52", @generic="3b911367a5345c5cdd0a1f6ce296f9ee775c9331c0ff7f2fec90d8cf4c6ce00b37b8b7a59cf0a13ff981804a1220535b8005567490354497e585eb3d6f1d4785452ffa484c449c0967f713678ef49a9b5bf4f55f48759b6848ab7e618681e2b542b597df4bf0740867684dced43e753faebb967c58ed2ec491bf349b24474bd657c301133926bfd8924c861ad0c91add84fd80198b9d2a2718f87905b64cc3616f53e31d02b90dc6376ed133a156dfd7983b798eb6abddd10348e5fd7b9e1a5a15d8067254f34ad102ccbe89d74df315b1337a5c7682698ab6cc6beb04d46bedee5c606a18040f43b55a2a22167449a62af33571238fe50b67", @generic="5d196520498d35d163181718cb9e764b85be854f01eac568510d22e9034e"]}, @nested={0x12c0, 0x49, [@generic="1cbf6c19ed107483e0b497fb812cda0474c39ac8c07586b80048a4cc1923f5ffc88c427cc3af3d21758cf8d4590a545da2e948f243d3168eb9e9b799d302b4ed4fc9298827f7df86b75bb1d71a170f55a547bfa1458b72a046e914a57dab3f44530d81fff6d20a03cbfc28b75e2eca4f343a0802d434adddd0fc58ea2b69fac9dfda38c706d90ca0ab5f3dbc893abbb381199a46f442bb30e58e3a9e941d1bac30f9fefe83673ea2070fe30087b8c03a18839d72d3415cee28524913787e4c2800b4b30f42f17f7d2ba69b96c9dc320a94a153f30e28baf956c850ae69d204dcacd0fed8b64699dff73618ec5f091debc2cbcc3d13ad7fae2db1e0836d4f", @generic="a269083eee1ea2be63b1ba69d604e66e7ccafa00755452824be8326351a24a63fbcc304f60120215a419a2b554e7a721f653b91430026c8c6ec789e8c1b088bafec65211b0b5ac87a861142c04c2b36d7fb5ba61f7444c66c2936a8ebfb400f7e5404122909e92f3a26919fbf23b7488ebf306eb3341284b504158b2a77b0eec3da2ff153bc3a1776c574de08bb170654723e34568608d8361a1f2546885ab278a800293c216faa6253cf534107509dbf58abe321e8c86eddd66a6029bf1e6f9f015eaf8ee11250905d64794920aea5327ccac8948a8cb408d16ee7ae7deeb185ad8c2c541c910d92e608b27f888afba7dd347bdb4c138fa524cf0f3d25e103693ce99fb9d85cda1426314fdc9c5692e395835742af2f20eab520d1ad3ef08f5b2322425238cc99b2875db68d47431306e6313c86ebd2c6736eea7d786b8ffbf3ac1f12f5fb5c0f2db70b14f5012bdaba4021596538f0c3f47af80c02103df73da98a3cad57a2400fdbe149669c328c491ad00b7a8499edb986e833df1f10401cb67b6b52955b7b443249b6206051df8342fe5d22cc97c8b2f062a4f947900398fd04bda25ee17e83439bc0963be2bf2e72cc68d05635de3bacabaa17454c8175cf581903d2158821695c5d5cdea252102f2e91fa5cbe22261f002b08e5ce9c58befd28695e9532a7e4a9f29359a6005b2a1cc058172ae9e13ccf5a842a4b8a8b97c57affc56c947dd53d4a8b30c7694d406a1da588bad1feb55dc924af2c61de2489b27f3a71e99a9421cea4cde83aa49a6404ddf1ce292ebd6dfad6db121022e461a5a624db5637f224db1f5727acb8c77d49fae0ee271d35ede013515c06014ad4104b4f64d70f1021956c508715b3dd499191f27fc6fe930216638b3262490c2fd61caaa5e42f53a24d8249813fa54847be6b795e1267ccd0d5c138fc01cbe86409688d85024ec44322e1248e680ef4931421e7154da7b9ec77bbe63b51133294e562b9856ff4dd3c6acdde9ddb40a62e0b4d2666ca8c46e476c50dcd763c3010824e247424f79aed08d61fec231e86f343ae6226cb5cc709e08afe0c1eb86b5348f1c7b18d4db0901061e4c7fae3377af763b8344a6ae83556f9a9a0667a9befe8fec7e94b3f633e96f9c3445ede98ed2e3cfbee8abaf98bc03c938f7de830c6b8216eff510f377fdd7351c6b9fd57504ce1c9a4707b06f151f1006a80e99257371247bb024d4e75ca8c79f43f9b84a216bf6a604f9c2ff1ced46cefe248e62f9bca5e9c325e5c599f6db6ae39588a48b6b1ff71295309d12aa9024584dbc46b3db9c7888bc972e1c5d6fd03a641ed41d9425941898d46c055431f1bbc018931406bd437152989035313fe62847be33e1f7a0ca73ef6ed110b79ee2eba91bc118090a891ab0cd60d14d716ed40b92a8d434ee5fd27255a4fe640762385101344a5929fe0ba0ee887a02c6dad3a9174c433af2795fd29e95ab755be663dca4b408ed9793055a3c7358235ac0bb085993dda35bcea0f6a3f8e378cc86f9d1dcbc1467cc23e966f54ec1f19d293daa7f4f11ecf4c58d09dde81f407ceec5241b2d240125e5e2245a8418c82b869a7c143bffccfcd29b9c7ab07aa69a8dbc254253711413153fad3cdee969ccc97947caceafd8d9877caefbc47206a7fc6c12dca2feeeb8d45a91b77e4e081c0befe4c590e562ea7ee95c1b752f52732f304e115fd8d18b7304099aedc3ca5da34df895b2ac342ebab35a83baf76ee4650bb90abb95aca2fe0c692992a93550b1dc3f2d97a8d09febb0977ddabde4dd318a9392d33e5c0d3f83beb688d210acede3289b337669ca7ed8873fb60438667cec06d365a36fd34979aca66542885f389b6e3e8469db53043ccac983e0a9ff31237e0962b8c0eb9d1d1aa5738645778eb8e24011f7fb8a39d9b5d7945670d25f14c45fb4df2d680c996812deee3d8dfb9df89ccba36084698c90a8b0f4b26331ee443a13cbeb4b918591cf642017dbe07ba6b4143741d2fbc0ee45f8e2b2a1c3a8fc533550c6c8cf986f25f89ba823139b4287e1701b8900dc0a00cd9e5e0ec4198909380109dd9ba3be43771ef7f1b629e99932cbcf778f6dc708b7da09995bc7db5b8e6f511df1df981f1db0d2d9c8fb935d9527b4a3b4933d063c3c3959a9fe9886e073444828a847c59a382cb51796a967af6764f126d8582bbbdc040267aefcbbaf3a34ac3cd0711775e7431f8ec4aa3ab45d43394638e77db71ce06a4ae1b630578e73656eb5092a9bd15217d33cb526de97a61fbd1073bea3d78da8b0e0b9168a6b20f995dac73e52961d4ba5092c10a3efd2a6c7df38febd544924f0d741ada5b83bf48ac4c80301d34e721e3948d818b726baeb87298ab3ddec9dd4b15762c87c0465bc62b63d07ea7fdcdf6e284b6522458c55d8765845381797e838b770ace296006b25378f1996c9e5a9412ec40905fedc78371e6fbe1db984aedc6c3d0b47dee4b73da9a6f220a7d312a391aa0b6748d999a0da5d922458cf45dad7355c83df89fd454bbb55445945488dc3296b425ec33184c3bdf5ecab5be666a7093f80f2d8f62f7245ee863aa84f6043ae67e468ee5f97542b0ee4cca92b47ce66cf61ff4245b0627a27ec6d9147890f4ed8272d5f150532e4e780ae84a266cf88653aa5e6a37bc6fb91b3847b8bd87cec8df3369ed21c197d438afd9937acdc92b312c21b2074859d4046b382bf5f16c617800b4030548d4ce3aad27f959c43aa90d8a2c4d8062d9d10f8557a56b7f26959c3063d3e72394b9478bddff1a3cddc2b928b5126beeb554783c51335e1d482130c66ff8cfbcde783cbf9fbd3ee7c4190f55090620a07838fd5f899ff549080744c19daa5a583a288a4c16a7c0ef7c7fbd22f177209c6d3f83b476c6a8862b8a6770ce06507461859b3521e5fd197fc2b7520f967f0c83bdbedde6285cfffdad40ef88245bd382920f81f956f2bbcd21db9015acdf8b772dce0bd94a4bea5638d8404b3d682b69eb761451690e00ff0c11d7055075dcbcc1c1335c61a4bce7ef0ca2bcbbefba781d795b5ec2987942c26c1a0736f44348f6586aa8b5de2e691eff74b095407f13dba20b1fe64768f6e548be57af53a7f291e35c2a6bc4ac3214237f85fd44bc4d0759ea0055b0fcd7cd57abd9c1705b08be2b1c363e81db470cbfd3953315fbda9aa91a8b6eb778f793b4e00f1c355ffcfbad13d17351cc694f8b6b03c188b94ba607b73cd4b57b759fc79b1d63c5ce28a8d0881a1d8a45a5cea405f85efe8610b0b10d32fa422f80e9b3c7877059d965faf2399fc5f8d96a1022a519931865f865994718d3ef10c0a21b3f3afbfee632a4ac7cc323801d6c73a65929bfaa855499635af036e7cf402e76d0e01f9213e0be310a68ea454097b321fe1a2dacb1ac1b9c76f1b2cc2540effe3a222fb30419508113d054d6d35fc108faf000ac37043733130d6d22b48b6f2ef3991b9b781182928b2f98873c4689582eafa7f271f66a9cdb9640d8bd3285ce71d9bdb9a465584f91a2cded7fc5b700b1990b93183f416df4afb0fc4af67838e1959c7b7fdfdef5e136716023da6f9478e314551a2e37a8d51d3b379c6566d9b7a88424528a5b3b5f6c9843dc0111d03b7f04875a776024ae77244a68186ee76928544db3da98fd124081179a50c1b023c0573d3841a2ba81f6deadccf269652bab4a43809ee5c522e71e1cf7281573b8e98554390eccf0b3248402fc8d199697d04a4c17b4e85dda11a8bd0359b79f44d7409403a97bf352f05603b5035f053194892a206f5ae9829f4eb2c9c291df865e7df335a618e27a7ad31093f53b511ea7df8c1364d2430c5d595778fd63bf6a20f146f5638796f3f42d99763868606d7f2574bf43b7adf93d4b0db0ac3f388b3db96821c1eeb3ae643b37303231c107e88d4edc0e87ac16aa8def6559e5ece976d60b9f4b81ea15c78dea6709132dfc1846cc47bc0193c340d1d769a088d66fa4fd306169d4453bb51d952ba968bda9fcff5f9018928c6adcf8ff9174d8327c9c3e40184e73a37880f7fa0f3e15b1cf3005b72a23feb68c05489b070c8dd468ed34039f3696acf1f79c898286efa0811caf438cd1df450ad0bed9b8bb311f8ef6ded06cc875f580d463d84dfd1d8f26c5311a09feabb59318f93f6dc535f42ed4acef128608a1f2568e6f736bedd10a825d6435ea5295a59dfae07d179b948ade4254e0bcc82d43334518979764449f89c31527b394920fde396e31396a667a8b1be710cae03eafabf9605e90aa695aaae0cd7182430293f33b0e96f13b2cc11884c4530341aab973dd427ad488e985f5024e2d21de0d09ae4eba30e05131cd941ab8b2b248dd2a14199f19ff6f0ab01d6e91a5c9a975e809928d5ad2aa1a46b580179ed176873c2bd933f609adb9c80917ae2ff73464e9e9f11bd46ed28e94d3851fd551dcd3c3b74cd5007de6358cfd11869dfa61f6099a4b689aa4572b2f959409caecf68dbc3f2b16e217a29a37e33482baf5c5983611ebfe290fad314f7df2695bacb92dac61c6b621d73a51af69182d8e084b2b890063758798dfa6ba8fd68662f2eb15ba39a0f77d86be3364d52a6a19c90aa24eebf058725f36b92bd01dc6cea3a6e79255e1fe71803eabfb03a54c567bb462ddfe6ec332f06020c7d89e26739a74cd7d6703df03d25259c49094a82925464df802cb563fde83e30a774c07a1b4c8d2013747c4f29940beb0f318da0c7a50321a7511da4b5937fa3869859063847d47da2330c2cf9c93b202d4045c26267d9d31ba0b4e9debf68720ae14a6e9a1d15a2c67d45814f78ccea6dbafdccbd6e59014a59ea685995445ea7a2d82e0723f9dab172f7701f36201181ef524225d79616aa52ebc8bca5a1f3676335cc13ea93e292e1bfb2c3eb16c7155252c9d5a633532e50ccdc2bfaba34ed37ca75414b54d131599f60c774960b369d353684237e5e6691369b2aea64d2a43a587329fbe9b76a2c44e458fee6d7e5cea17c56a594a008b855fc3a7846d7097f2c7c25f1db6c96c5dd22f20c17aa3253cc400c6302a6b784780e69f66ed2816f58554e15289814d2b62fda423236cdd9c63bb4656c8b03a9588fe6d0fcb49dcda2994fcb8ffee13d5606ae5b2829529270712a687014b1521d7c3fac964ca9798576f67c127010efc861316c57c8c32ec41c8c7beeaf86b22054876395a52b194628f14b41fa42e34b8a5f4940463491bd34c99e827a74da48a49bc0da8b6982683f5a8e4a58d43e914c6297412284e145344059393281a49e069fecd564006650a8e6a2e26fc7fca0d4ba8e53890506a0a91b60abed76e8e24aa539268f657739e406edff415018005815548de206ec6508cf827e4ad62a0fd4de2c12ddb60b645c47e97f5abd731b726fe0923d688c570d01d7aa6c73cd1e57b0ec78bfa89bbafc6ebdbfa540c7fb50794d2dbb242811f4e6f83917571959db2245d4ef38aa45b17622de91e923917193d090aceef1920a5596f96ee4cd71850db168a6b334f9aa1877404685ee435aa26548df56f3fc18cb5a5c939cc553c549709dff3c83a9df68199b022402024ae9934ea5d6b9ba0dcef56ce94c5f87001edeedc6de8d97f57b9d1c24ad8107416ed6e108ccaf44cba7336166f988286f0bcb0a4b04ce50e05255fbffafc626ed7f6bd6431efd330e173fa32dc9b264f969ffedfa2cdd34a7cd153b5d606d590280c54ba87eb8ba5fbb9c03a9943ce1bcfdb747f4463bb979f36264112c96dcd3c0", @generic="3008d539027b3caeaa8950476d2a1480743302985856a9dcc5132de5cb47f8af5cddd13f1fed1b", @generic="62263ade20d1f67d9b3af0cfb0a4449bfdb2d9091cb9beda279c560ac3e64a3e1fcbe9d9a7992b1b6eb8fc30028f34c2ef6392245c9af98074060d1b1df8cbfdfcac511038ca4eae494a2df4f3706553f42e087ca66ad903bf5d45d4a49eac7c91e81ae547ec7279530ad95df34d26a266365c47073f59", @generic="5eecb2cd77cbfd46ed04238a8151263b48baa47255c1e959db6394ce7ac8ebdc5b400581b2d01aae511511025d64262559583ae610153dc343a945218be912fe464f8faf38a812f4c25b51b52be7f814ed05f5d8e8268844543ed9ccd68c6ff9d22c94e5b6ca9c7cbf9659f38e80b0bbdce5eb03ab4a5e0bd6c0b31a8614dc1ef9044420c4a85dd31ff2d65d2696c1d72c1f2f6c3e37cf777ac8c126be5c866abc6e1a87ce5370dcdfece6d3c522366e85d665815a66b18fac7b1610268328708fa6", @generic="5219a0500ae40435b47ce3c3ccc15ebfc74d76f97fcb5df260a33043670b4a8abe2e1773dc6bde141fb4358023668dc13ded24b8ab9136dd0584a8a0d2ccd81a982874e7c4edba7353f818399f3337bcba269fac36e47a7d7d69f196"]}]}, 0x290c}, 0x1, 0x0, 0x0, 0x4}, 0x24000044) getsockname(r0, &(0x7f0000002c00)=@pptp={0x18, 0x2, {0x0, @multicast2}}, &(0x7f0000002c80)=0x80) r2 = openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000040)='/selinux/commit_pending_bools\x00', 0x1, 0x0) setsockopt$inet6_tcp_TCP_REPAIR_WINDOW(r2, 0x6, 0x1d, &(0x7f0000000080)={0x1, 0xfffffffffffffffa, 0x5, 0x5, 0x3}, 0x14) 18:20:19 executing program 0: socketpair$unix(0x1, 0x7, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) prctl$void(0x15) signalfd4(r0, &(0x7f0000000000)={0x8}, 0x8, 0x80000) r2 = openat(0xffffffffffffffff, &(0x7f0000000080)='./file0\x00', 0x0, 0x80) getsockopt$inet_tcp_int(r2, 0x6, 0x18, &(0x7f0000000140), &(0x7f0000000100)=0x4) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r3 = request_key(&(0x7f00000004c0)='user\x00', &(0x7f0000000380)={'syz'}, &(0x7f00000001c0)="3fcb00faffffff00", 0x0) keyctl$reject(0x13, r3, 0x8000, 0x6, r3) 18:20:19 executing program 4: r0 = syz_open_dev$binder(&(0x7f00000002c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000300)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) openat$selinux_checkreqprot(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/checkreqprot\x00', 0x80000, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, &(0x7f0000012fc7)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, &(0x7f0000000f4d)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000000c0)={0x8, 0x0, &(0x7f0000000140)=[@release], 0x0, 0x0, &(0x7f0000000340)}) 18:20:19 executing program 0: r0 = accept4$packet(0xffffffffffffffff, &(0x7f00000000c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000100)=0x14, 0x80800) fstatfs(r0, &(0x7f0000000140)=""/41) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000000)='memory.stat\x00', 0x0, 0x0) getsockopt$inet6_IPV6_XFRM_POLICY(r3, 0x29, 0x23, &(0x7f0000000200)={{{@in=@remote, @in=@loopback}}, {{@in=@loopback}, 0x0, @in6}}, &(0x7f0000000040)=0xe8) request_key(&(0x7f00000004c0)='user\x00', &(0x7f0000000380)={'syz'}, &(0x7f00000001c0)="3fcb00faffffff00", 0x0) dup3(r3, r0, 0x80000) ioctl$UI_SET_MSCBIT(r0, 0x40045568, 0x36) read(r1, 0xffffffffffffffff, 0x0) 18:20:19 executing program 5: request_key(&(0x7f00000004c0)='user\x00', &(0x7f0000000380)={'syz'}, &(0x7f00000001c0)="3fcb00faffffff00", 0x0) r0 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000000)='cpuset.effective_cpus\x00', 0x0, 0x0) getdents64(r0, &(0x7f0000000040)=""/201, 0xc9) [ 487.660978] binder: 481:502 Acquire 1 refcount change on invalid ref 0 ret -22 [ 487.696319] SELinux: unrecognized netlink message: protocol=4 nlmsg_type=42 sclass=netlink_tcpdiag_socket 18:20:19 executing program 2: r0 = socket$netlink(0x10, 0x3, 0x4) r1 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000080)='/dev/vga_arbiter\x00', 0x2, 0x0) ioctl$TCSETSF(r1, 0x5404, &(0x7f00000000c0)={0x4e, 0x0, 0x3, 0x8, 0x9, 0x8, 0x9, 0x1f, 0x8, 0xfffffffffffffff7, 0x7ff, 0x1}) writev(r0, &(0x7f0000000000)=[{&(0x7f0000000200)="580000001400192340834b80040d8c5602067fffffff81000000000000dca87086a5c000004f6400940005891550f4a8000000006700008000f0fffeffff09000080fff5dd00000010000100000c0900fcff0000040e05a5", 0x58}], 0x1) r2 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vga_arbiter\x00', 0x80, 0x0) ioctl$UI_SET_MSCBIT(r2, 0x40045568, 0x32) ioctl$TIOCNXCL(r2, 0x540d) [ 487.721163] binder: BINDER_SET_CONTEXT_MGR already set [ 487.735549] binder: 547:550 ioctl 40046207 0 returned -16 [ 487.760546] binder: 551:559 BC_REQUEST_DEATH_NOTIFICATION invalid ref 459014144 18:20:19 executing program 0: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) fadvise64(r0, 0x0, 0x498256f4, 0x3) socketpair$inet_udp(0x2, 0x2, 0x0, &(0x7f0000000040)={0xffffffffffffffff}) setsockopt$IP_VS_SO_SET_EDIT(r2, 0x0, 0x483, &(0x7f0000000080)={0x0, @multicast1, 0x4e24, 0x2, 'fo\x00', 0x5, 0x3, 0x7b}, 0x2c) ioctl$sock_SIOCGIFBR(r1, 0x8940, &(0x7f0000000000)=@generic={0x0, 0x2d25, 0x7}) request_key(&(0x7f00000004c0)='user\x00', &(0x7f0000000380)={'syz'}, &(0x7f00000001c0)="3fcb00faffffff00", 0x0) 18:20:19 executing program 3: r0 = socket$netlink(0x10, 0x3, 0x4) writev(r0, &(0x7f0000000000)=[{&(0x7f0000000200)="580000001400192340834b80040d8c5602067fffffff81000000000000dca87086a5c000004f6400940005891550f4a8000000006700008000f0fffeffff09000080fff5dd00000010000100000c0900fcff0000040e05a5", 0x58}], 0x1) writev(r0, &(0x7f0000000440)=[{&(0x7f0000000040)="1d6570b29f474f6bee601095940f5f8add9a266cc24fcd2c44acdcb81be896da77f1c28ec8fb8012b5b51044c70ac3bbe0f8bbbcaa333461a48d1daadd996b9a5515e0f57d7330c8c3a81ff3cc2fc2bd076278d579cd2180461dab2731d1d21417dc9a", 0x63}, {&(0x7f00000000c0)="c184100baaae1fb9c0fc8a44281c81c6398261898a38e5e748ba41e107f39cd1dff2f8d521ed88551951c1db8e9a9300f30b4fe68871082090952ab83bbb0a40440ab1cce109d6fe6044bd514cbd80d8a361019a0afcba98445fe73ae85906335797fe34b96777b0e4013329c7c897e58915b2932cd78faf70e33dd41182ed289a95efa5159d35e8898c2d620e224b520e14682aacce71a2a96fc873aee53e7a4d30eb092e86d886ef2ee56f8babfa5aebc1c1af496971f7a42d04a58602c703544fde14c68a0930f99938dc17e8e820366623caf2d4877050e447c90ab902f9c3e39a4da0126d39ea20", 0xea}, {&(0x7f00000001c0)="f5e2826808b0e93163480b088e93", 0xe}, {&(0x7f0000000280)="a7a561063611b928e6c82ac6a3988d55381dd6c5305b69b584e06ddb829f214615850a594709e65d57d7bea6e1d7a3de1fbb004c312fa599685016400f1e61f856021a7bdaa3576450f507645b4cefaa40e1a6c564177e70b55214716b407abc4d277419be53b4aa4cc57d48959bb7cc1d", 0x71}, {&(0x7f0000000300)="56c5822f61f77b42f493cdf70bfef1d39f71c2444b6b1b4ff85c884703108f28562c933a56e07abf6a32e6b7c31d1fe62e015221b6368f64e31c6cc61fddad85eca52fcd320e6a69ab63d97d419fa82cf96b377d33ea5b757f284ed9f8be467dd3932fcacca9eae255504e0c02ae62bdacbcdf4d76b7e074936aa99855656d0114d93721dd119c088535f0ad3d31ee5768c07fc573a795e629b90094c175d1a6b313cad5107da3a2b866265550b8308b7a409f30c0", 0xb5}, {&(0x7f00000003c0)="d33d5bcb7a4ae7afe665b4c4f7c27114bcc2cc20515084c4f5512371c82b0d1da288f3dac57783619886ca893523091e40f5a928950166b6d00fc59d29764e9fb6935cfb8286aad6a2488b9991", 0x4d}], 0x6) 18:20:19 executing program 5: r0 = add_key$keyring(&(0x7f0000000100)='keyring\x00', &(0x7f0000000180)={'syz', 0x0}, 0x0, 0x0, 0xffffffffffffffff) clone(0x4004000, &(0x7f0000000080), &(0x7f00000000c0), &(0x7f0000000140), &(0x7f00000003c0)="68ccfa6b7b404b837b8cc0a6845642ea26dbfd46bd8c04f9f2ebefd0e35fad6b802e5c56e5399e3bb8c7a9ed53ce4bbdab96d7053a8a60336f74cf0e063c33eb4457fdf843dbba56812827bffa9c474eb6d839b05974b5a29e0ae5ae9c4b69f50bb34fdc5b38e78198968e7a37b1099951a2ac9fd3139a3358f2b978fd651314d5c00ab724f679deae1fe973b3da27ae4f2d26d22a62bd9f5879aa847422d7f7a6be2831f725a882e8b5f2ebf6518e859408a874774518b498e8cd315dc0e9d413d99a232ae046656a083ded3a60bd321e7604cc909114de616d242df11289d73ff94720c715a30ff0729aa191b40a5dbc652e084a1e17b2227e32f3df79fd4676961e8a4060d95b1b23e3bfdc865ebfbe2f928bc0164ec7dce98b5d576174c353cb276a68b39b999c9f1ee855ec4d48b73aa56309c4640da39102613d00995e9126b9e5188190865b0ebf0be082bbc8c725b6a56417d2372f481fb0e72d0ab87aaf33623596473583a020c031f0caa2321f79a118a1a346faa38f4d3532ddfa17e87f98a3aafa5e02ebbe8738e34a6bb6e6de46ccc62153e3eecdee13755e0ce3b4349fc0640243a8dc6a73caa5764f828e4258fe1a19fae668be94128791fd7385037427e90a58a321597dca9eb3e13dcd8bc3e35aeac8f91e0b787ad181c0c05a0b7454945ecd45d14ac7d069fe7093505f7952eb00a5c2ec578c08721248905e1a39cc564b57a56b48a595cd29a57675325c3ddc5794f464ce9ede7456bc50be8db9b3ab97a2e13603b7492f5d532a05e5102cf1b115f68d3fbfe313bf8b6de5050a47f2f0565920fbf6f8762c3a54b18e86df83fdd0d1de8a4bcb8607110ab14c91a3abd45e3b283b0a9fb7116a66e63062bf8b7c81d3be58e86a1f4398eef0cb10791edb2da62d12041c4339192d022dd6969bedd618596de7aff7dde6b3059cb67f7d209508858cd7d4c211a976d8bfe8ef9cc03b2a2a74000145dd27581ce0e4059ded2c9519c0b04d8b85f711875ac47fdf0e01d281cf79663d518d08ec1cb8eab6854c8698768422ff45a397b800ca9d858b8376c7baffbabc5f4fff19e46821c76245be7684e3fba05e137a9b26be098127ab3f729da5657ea23d7e10995d3d8342c19d325208ff9ba67532558b1e4bc78af9100663f4cad2079d4c7226ad25cf01a287912fd073ee707bf19bee4f285fa513d48b13db6ff5bca2d1733ccfe7b9df18f4b49e66d22945c5419d3d0ca7f173b148c685936c147a64358e5098155b251820f2a6aed4b767fbd39453d4d4de2c7fbfa88e5004b5a2ca40e7e74557262149e4d7644d6a6bc0a50c69ab01ce51b44fde28357405df7b8b59aa3bf57f37d243db4beaa6f1cce81046d2bef986a9e3e7cf2566f6e32a859cdf901ffe6e7a3d11ed9109085db1a90874e732e97f0b0a683a538789fa800b2957cc57c02fa0c83360e03b84a5300be1de4172e2823bc148ad7c0b976b8d9ed1987e104ea814dacbcd99f06744185fe00b0ad47db8274c3bdfa8aacdd9815b66cf3ecadfb2a995cfcb5ace345dc83e9bedacec79982575c38edf1e3743853601da0bd5bba673b74a7f1d31a9a8999b331803cf79ab3e4ed37dc2537cda28e69684cf56f0b83f9454e74b7ecec3c967a56a1a9e7c8ac7701ca65fb18ac19343d4e1d89e9bc7c534869fba9f87c631f0f77cce6ec7c954f6f3286f232fd3717dcb5658fb4eaca2b0f0781a32d52b1649e272890cfa80fbb9a602343354c53565d60011e2371862d78a14e229823a1c44b29e0c67b5995c50566a5a78b9003a975d0e109db2679fa113edc72a5c4b0b2a820117b4475defdbf35dd5e13dc9835864febf267880706757626e2d5822f085af58f3428f2db715ac4d9d1256a595a668cc27c3bf343d73d3d4562dcdcc1f24f21ecf0868653e2c0b97855a88f0bd1842b4d1150e40fa6a333913c21ad8a198b19c01cade3ccd1ff7bd1dc397274ad71a44b2600dfded00eb06d0ca5217819d19eb0feda1b74238a45a4b4048a1cb66b41890c8c44c8b6af7add5302478320f3470cf28c7fb6dd90911b3960e7d83d4c16ab89e5581a86deba8c6d5f6591936be689364a2402054f8b6fdad9eeaa67a7f70c2212255a514d998a9e2070c2d31396a54e6b71544e29632a3332e38dce7849a8652bfdcbba5352ecfa7e225c0e0a3c6b9126c031cef7f3b233b2f3bc697832c3c0c337e3033b63e487cd209b1939f37bcb8ac216458377cc9641083a88d644078f1b00a6bc8033d57a56f084f9e1a4ffe1142cb3ea5ae275cdf274ed8487cbe769037082d728decd20affb9fc9ef78427b49849024318af44ab2da77673312fad4f73f21699ec90ad8507af872ae224182f18344a29e094b09da4d372e76d57b6efa04a4d1103ff287f9d11e5665461040a60eac14ef9d6cb0d74aaaf34ea40468ace3ab2b85826435c3ea818b6ecc43a324a94d07cebadfb42b01e3fafbb8dbf841ce1d4743c4435cc7168514be59a0f3fabeac6c2bb394a33a49b4f02121108efae7d49ca8251d12afa5f28d46353084d1b14d3afcda452ff7b54a28c36fbc108bf0eb40c679a6df9674685a8090d38378d2f37d636eb719d41076e8894b11af3d10ff9ee6d1aa64b9e2dc75b2b71a72e8b0d5bc1335db510a6aa9facac2bedb078e26c52937551b92b33795a4a9473bdee26e321d063cd0fd48312619cb6aa9f3408b159a586dd9dce1e2c26cc24713d7c2a08c2e689a3042a9d56f0f60ae7d86456a81dfe36c17e69c3f865063d5f1e54de7758a98959b1705a2a271b2677124a5b55f5870d99e6e6164360d0eb0a24c69c5aa97575eada84897f32fb9f25472f3894bb82bb784e5931bc599bca7b603b5f1a79cf87847e6e3ccf06637662d38c3654bd6f916a6facd7ab8472e13ad0eb1b5653dc35e7e0a77d33e93e1cf15dcfc481be57937a4858958b60f4ca606448df63adc364470ce30dc10419cc2e5b8d3344116edfce79a96e39a8f3e897d10915f19021104dd4847b144bf5b2c4660a47b391f002059835678a4373663d59b494d1ec8db6b181f5f2cafc8686a1a73c1e5a9a5f18dfa0198517b198596f57c19860e9d56eeaed2176ab916745162147e8f20b003d2f130c7a3c7040f51c2aa3a2fb57445b16e9cd420c75247cce9726825005457b93596b6cf921ac42da0f5b4c9f6da5ccb8c68d5c89748f7e3a7d17dd35463a23faf18a0bb3625713cf3e7b7961755033581c21cc192ab052b91bab88711e78f807228f53a223686880c3be4d854e943b9fde195b0b95c4b86b080a9dd3ae7920922689c03420ae784e3bf19f406c6b52d62a67984446eeb34e7d461d549ff1f831b9753559a69e290bda4553f5004bb9137215f9704bb9fcd8464e53e073e2f33b4834ac4f779ffdffe07adef68036420280ecd7f3c13f356efc6869a13986fbaf18c87a9bd409bfbe2fd674f49085d1b521a8880eab62b34c4067ba87cd037cba891ae8d2d7030f73a12fa3aa2569b54ed5bdac27e89b2da6940c0ff48fcc9614411c469c560a983abcbe0aa32068128b67dc7dce96d856e10f170da545f4826a86e4ba83569900bbb7a820a01bd0dd28258fe0fbaa6d3fec3394249760ac11b2c2df1a321f6710700dfa23e11aa7d1a9777db97bbd49df7aca1f13430c5b2d2185f55dbcdc80cfdd32a46547492463fa16af08f32fbfd4c07d73865bc328e3a12f5c23f2e010691489dc6096232776769ff6443bbd1c01fc97119a116591b628bf4ac07de32cf4ccc361a5a6bda9c9d3e3c667968e93905bcfa4fc9c4d14b08a5b157738e78b9f9ab7dbcc16659ece089326897fb4a0381b4b621b856370534b5f90e1300193fa845656584ba8de51503e042e34c789c7767ee9e2349a286e4e833c48ef9b4fd9875a29defb82467e180933e74323ddab3f76db18a4033948b3a4edf32e67ef47aea3a878f67bb3df6f8bfd8f4ceb9baf22039f9a2ca059fff035a0cb513ba089698fd5907bdcbbc2fa7f04ec90569b35a897904b2826963b2a14e476db270024efd617be80e8d913f3afe27ed24b5abb4df50fdaac816d1e558422636b4a438f123bf7d5fbabf78000c3fc754da232ca85bf124d7e0f1c2e9806f29967a4259dc4bae596e8a5a03095421b5555419c98fcd76135531fdd3cf05ca3fa884406e1cc4d6ee56908a0eadbf1f35abd279bd91de0d4306b075ecf877dc87f301eddac12609f581bd11c83c66058002ceafd6b40d3a937cc2d9b199984eb54a6d3c589a7f15ddf626adc2aef3a5b30092fd0bdd5f0c3cb17827df697e183cebb4ce39cdb16eacfa92ad5ee695b2dfb9e911a3c88155e2f45faf76e688a73cf664ffa0f5151a649c09556a7d5aee1c7b4ec69461e769eca1f4872cf0316c5a1439aeed5f266a2336b913921a20792b20db37ee13306e3bd03746b439ad86965d46b4c1672f516b0f67c5f9544e5651d0ed88a2fc2a6608e36a7bda943dfdd2e94b5b3a3d87fe3f46826e0c6a615c06e57b1849f67e3ce29a343d2c2b68a9fd8a87e7883d7529f65962a4819c75f40d3c9a891ec421a3815e53bce90af63f9406b54937dd46e7dc1033c4d1fda4423fab0bdad8744431020d5e459dec92ea2784ff475f76ffc5fec81e2396420584cedf92d771b678505b2941795ce6b74b1bcda30b6508689bd6a03835c85fee73d317033197e204df93d5dfd328b9f92df6ea9d8244c48ad6db9a897f017708e3a33dbe3e803a52b12f7d16203c5f1a147559a4d65c68bd837fe08c520462e4ccd7f4736a4d9ecc690fbc019fcfb2c85dc7eda39b754dbce9768b651701b6f19118f42514f7c4fcbe4b1b659ae61f3be9837db6af16ab72848cc6d8530ea5c3a68ca0c1afe610bdb8a8c9b9557d573757fa24e127c57c671980871248c915e70da7be82aec97d95c7503d1e16dd72b025716cf759f12ec0516ad63886d99166f7647bf7a70c116db611729a861eae3952ab9e3555edd1c875f66761781f1daa08fd7cc6fd2b1e7cb9f5a74c6e91b316dc6325701ce62f659796070bbb36eeb4b49e128e18e85d803513c9b216109975f87964d41509c4481a6fa6a47fa9dcb723c163ad7733de5cc99c15f7c5c79bf61eb1a9645c013f3df8642000133c19be265136d1ccb5c5d6c5c06b955a9bc2144379d28710b934348f38c9a5134388342e30cc4d43026bc654267cf054b7f6dc1bf5b50d7a7f651feadab65a2c3f57f6a5d635624ddc16eceeeea0f087406ddc2dd9c369d542004136d3d994e1439097a593ca5c37dc0f29edbfedddd71a20353868a72658a82dbbfc19311aa6b9d99d263e54c77324955cce34542183c117196526aafe55b37682b9bcf6edb2d0152c763535c26282094a62637984c28fbbc7cdc385645f3aa0487313684bddfb07b714190dae9ed107c2f6f5f9b3e4c62d2e58cb436bc5f63f456c55579e8403b4ebb5a3753fac895df55a17bdfc325c4cc6eeb8c0bafcee23a45b91aa498e17dd10b4fe4470e612899f8921b5a96d09e364d9f3f43236c51e51bd7608a16daa8a45f76a7d042f02ce13c855089ccddd3cb63b08ce4e92079d3291eebfebf1cbc0ea7f59b3f38db4c2164f57f0e6868b497c7bff7b0bcea699aa6ccf6af304ea253aa4224d2db7740e6940e2d57954a41bee5f934755d17588f8907924f4ef9e0bb15e3c8dbc1e1d94dc07077ecc00b5f5c32093f503ee1ea719e9850cb7303984cda605f85ad476712f2b73764c5b0a077d16a00000000000000000000000000") request_key(&(0x7f0000000000)='user\x00', &(0x7f0000000380)={'syz'}, &(0x7f0000000040)="3fcb00faffffff00", r0) [ 487.764513] SELinux: unrecognized netlink message: protocol=4 nlmsg_type=42 sclass=netlink_tcpdiag_socket [ 487.801966] binder: 547:550 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 487.809771] binder: 547:557 Release 1 refcount change on invalid ref 0 ret -22 [ 487.832828] SELinux: unrecognized netlink message: protocol=4 nlmsg_type=18335 sclass=netlink_tcpdiag_socket [ 487.896903] SELinux: unrecognized netlink message: protocol=4 nlmsg_type=18335 sclass=netlink_tcpdiag_socket [ 487.926055] binder: 551:593 Acquire 1 refcount change on invalid ref 0 ret -22 18:20:20 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000300)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, &(0x7f0000012fc7)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="0e630c400000000049882c5c44c2f5d8aa8e3521ccedc534437089706fe253135b12973a0481a70fe0212f6f744de7f86304f987547e3fb95668a2d5646e510712fe87c267d7196e47ba36392862d5c507000087833a42eb07979b2e6bfe956957f2a34d6a56451e72115e77369e02ebdf880398"], 0x0, 0x0, &(0x7f0000000f4d)}) r1 = openat$selinux_avc_cache_threshold(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/avc/cache_threshold\x00', 0x2, 0x0) ioctl$KDSKBLED(r1, 0x4b65, 0x7) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x8, 0x0, &(0x7f0000000140)=ANY=[@ANYBLOB="066304ef2c5ce000"], 0x0, 0x0, &(0x7f0000000340)}) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'team_slave_1\x00'}) 18:20:20 executing program 2: pipe2$9p(&(0x7f0000000040), 0x4800) r0 = socket$netlink(0x10, 0x3, 0x4) r1 = syz_genetlink_get_family_id$ipvs(&(0x7f00000000c0)='IPVS\x00') sendmsg$IPVS_CMD_DEL_DAEMON(r0, &(0x7f0000000280)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x20000}, 0xc, &(0x7f00000001c0)={&(0x7f0000000100)={0xa8, r1, 0x20, 0x70bd29, 0x25dfdbfc, {}, [@IPVS_CMD_ATTR_SERVICE={0x14, 0x1, [@IPVS_SVC_ATTR_PROTOCOL={0x8, 0x2, 0xbf}, @IPVS_SVC_ATTR_PORT={0x8, 0x4, 0x4e23}]}, @IPVS_CMD_ATTR_DAEMON={0x38, 0x3, [@IPVS_DAEMON_ATTR_MCAST_PORT={0x8, 0x7, 0x4e21}, @IPVS_DAEMON_ATTR_MCAST_PORT={0x8, 0x7, 0x4e20}, @IPVS_DAEMON_ATTR_SYNC_ID={0x8, 0x3, 0x1}, @IPVS_DAEMON_ATTR_MCAST_IFN={0x14, 0x2, 'yam0\x00'}, @IPVS_DAEMON_ATTR_MCAST_GROUP={0x8, 0x5, @multicast1}]}, @IPVS_CMD_ATTR_DAEMON={0x1c, 0x3, [@IPVS_DAEMON_ATTR_MCAST_PORT={0x8, 0x7, 0x4e22}, @IPVS_DAEMON_ATTR_SYNC_MAXLEN={0x8, 0x4, 0x40}, @IPVS_DAEMON_ATTR_MCAST_PORT={0x8, 0x7, 0x4e21}]}, @IPVS_CMD_ATTR_DEST={0x2c, 0x2, [@IPVS_DEST_ATTR_ADDR_FAMILY={0x8, 0xb, 0xa}, @IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8, 0x8}, @IPVS_DEST_ATTR_ACTIVE_CONNS={0x8}, @IPVS_DEST_ATTR_INACT_CONNS={0x8}, @IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8, 0x9}]}]}, 0xa8}, 0x1, 0x0, 0x0, 0x8000}, 0x40) writev(r0, &(0x7f0000000000)=[{&(0x7f0000000200)="580000001400192340834b80040d8c5602067fffffff81000000000000dca87086a5c000004f6400940005891550f4a8000000006700008000f0fffeffff09000080fff5dd00000010000100000c0900fcff0000040e05a5", 0x58}], 0x1) 18:20:20 executing program 4: r0 = syz_open_dev$binder(&(0x7f00000002c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x3) flock(r0, 0x6) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, &(0x7f0000012fc7)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, &(0x7f0000000f4d)}) ioctl$FS_IOC_SETVERSION(r1, 0x40087602, &(0x7f0000000180)=0x8000) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000000c0)={0x8, 0x0, &(0x7f0000000140)=[@release], 0x0, 0x0, &(0x7f0000000340)}) r2 = openat$selinux_avc_cache_threshold(0xffffffffffffff9c, &(0x7f0000000040)='/selinux/avc/cache_threshold\x00', 0x2, 0x0) ioctl$EVIOCSABS20(r2, 0x401845e0, &(0x7f0000000100)={0x3, 0x400, 0xfff, 0x4, 0xffffffffffffffff, 0xfffffffffffffffe}) 18:20:20 executing program 0: r0 = request_key(&(0x7f0000000200)='.request_key_auth\x00', &(0x7f0000000240)={'syz', 0x1}, &(0x7f0000000280)='\x00', 0xfffffffffffffffe) add_key(&(0x7f0000000000)='id_legacy\x00', &(0x7f0000000040)={'syz', 0x3}, &(0x7f0000000080)="23d31271ec5a35579572306bf6f197aad4bcb48cacb8d003a229b8781820ba65bccac025d35a421228a7a79f01353627a68f130d9aeef08fd09086c388b78f10cc679a20e06d1ef325debf20ee0f1166b090e180ecaca5a86affab76086c7857af6d0b4d76e91a040adc70be67aedbad47d8c14ddbe8ad39f9971a925f8000c1568aaf9affaad152e5c00c860dd9e6d53e15b1a4d78797c7f117873f603ec1242132bfaf6436590e3d11aebda921c1ea346607657a667b7808b9c2fa72867547b7ce5e40040fd097057ebbd5513aecc8f6951d1a808544a46490218390a6b59f1ab82d2eb055f9e1f2cfef6c37bc4c8b08aa726cbc1336faf37c4c3a", 0xfc, r0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) request_key(&(0x7f00000004c0)='user\x00', &(0x7f0000000380)={'syz'}, &(0x7f00000001c0)="3fcb00faffffff00", 0x0) 18:20:20 executing program 5: request_key(&(0x7f00000004c0)='user\x00', &(0x7f0000000380)={'syz'}, &(0x7f00000001c0)="3fcb00faffffff00", 0x0) socketpair$inet6_udplite(0xa, 0x2, 0x88, &(0x7f0000000000)={0xffffffffffffffff}) setsockopt$inet6_udp_int(r0, 0x11, 0x66, &(0x7f0000000040)=0x8000, 0x4) 18:20:20 executing program 3: r0 = openat$selinux_avc_hash_stats(0xffffffffffffff9c, &(0x7f0000000100)='/selinux/avc/hash_stats\x00', 0x0, 0x0) getpeername$netlink(r0, &(0x7f00000003c0), &(0x7f00000004c0)=0xfffffffffffffe00) ioctl$EVIOCGKEYCODE(r0, 0x80084504, &(0x7f0000000140)=""/66) r1 = socket$netlink(0x10, 0x3, 0x1b) getsockname(r1, &(0x7f0000000040), &(0x7f00000000c0)=0x80) r2 = request_key(&(0x7f0000000300)='trusted\x00', &(0x7f0000000340)={'syz', 0x1}, &(0x7f0000000380)='user\x00', 0xfffffffffffffffc) request_key(&(0x7f00000001c0)='rxrpc\x00', &(0x7f0000000280)={'syz', 0x0}, &(0x7f00000002c0)='/selinux/avc/hash_stats\x00', r2) writev(r1, &(0x7f0000000000)=[{&(0x7f0000000200)="580000001400192340834b80040d8c5602067fffffff81000000000000dca87086a5c000004f6400940005891550f4a8000000006700008000f0fffeffff09000080fff5dd00000010000100000c0900fcff0000040e05a5", 0x58}], 0x1) r3 = syz_genetlink_get_family_id$team(&(0x7f0000000480)='team\x00') accept$packet(r0, &(0x7f0000000580)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @remote}, &(0x7f00000005c0)=0x14) getsockopt$inet_mreqn(r0, 0x0, 0x23, &(0x7f0000000640)={@local, @empty, 0x0}, &(0x7f0000000680)=0xc) getsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x11, &(0x7f00000006c0)={{{@in6, @in=@remote, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@rand_addr}, 0x0, @in6=@loopback}}, &(0x7f00000007c0)=0xe8) getsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x11, &(0x7f00000008c0)={{{@in=@rand_addr, @in6=@ipv4={[], [], @loopback}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@local}, 0x0, @in=@rand_addr}}, &(0x7f00000009c0)=0xe8) ioctl$ifreq_SIOCGIFINDEX_team(r1, 0x8933, &(0x7f0000000ac0)={'team0\x00', 0x0}) getsockopt$inet6_IPV6_XFRM_POLICY(r0, 0x29, 0x23, &(0x7f0000000b00)={{{@in=@local, @in6=@mcast2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@dev}, 0x0, @in=@local}}, &(0x7f0000000c00)=0xe8) getsockopt$inet_mreqn(r0, 0x0, 0x23, &(0x7f0000000c40)={@broadcast, @local, 0x0}, &(0x7f0000000c80)=0xc) accept4(r1, &(0x7f0000000cc0)=@hci={0x1f, 0x0}, &(0x7f0000000d40)=0x80, 0x80800) getpeername$packet(r0, &(0x7f0000000e40)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000e80)=0x14) getsockopt$inet6_mreq(r0, 0x29, 0x1b, &(0x7f0000000f00)={@remote, 0x0}, &(0x7f0000000f40)=0x14) ioctl$sock_SIOCGIFCONF(r1, 0x8910, &(0x7f0000000fc0)=@req={0x28, &(0x7f0000000f80)={'veth0_to_team\x00', @ifru_addrs=@xdp={0x2c, 0x2, 0x0, 0x1c}}}) getsockopt$inet_pktinfo(r0, 0x0, 0x8, &(0x7f0000001000)={0x0, @multicast1}, &(0x7f0000001040)=0xc) clock_gettime(0x0, &(0x7f0000001ac0)={0x0, 0x0}) recvmmsg(r1, &(0x7f0000001a00)=[{{&(0x7f00000014c0)=@pppol2tpin6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @loopback}}}, 0x80, &(0x7f0000001600)=[{&(0x7f0000001540)=""/183, 0xb7}], 0x1, 0x0, 0x0, 0x2}, 0x1000}, {{0x0, 0x0, &(0x7f00000016c0)=[{&(0x7f0000001640)=""/126, 0x7e}], 0x1, 0x0, 0x0, 0xa0a3}, 0x5}, {{&(0x7f0000001700)=@xdp={0x2c, 0x0, 0x0}, 0x80, &(0x7f00000019c0)=[{&(0x7f0000001780)=""/107, 0x6b}, {&(0x7f0000001800)=""/139, 0x8b}, {&(0x7f00000018c0)=""/74, 0x4a}, {&(0x7f0000001940)=""/82, 0x52}], 0x4}, 0x3}], 0x3, 0x2000, &(0x7f0000001b00)={r16, r17+10000000}) getsockopt$inet6_IPV6_IPSEC_POLICY(r0, 0x29, 0x22, &(0x7f0000001b40)={{{@in6=@mcast2, @in6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@remote}, 0x0, @in=@multicast1}}, &(0x7f0000001c40)=0xe8) getsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x11, &(0x7f0000001c80)={{{@in=@broadcast, @in=@local, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@loopback}, 0x0, @in6=@remote}}, &(0x7f0000001d80)=0xe8) getsockopt$inet6_IPV6_IPSEC_POLICY(r0, 0x29, 0x22, &(0x7f0000001dc0)={{{@in=@dev, @in6=@dev, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@rand_addr}, 0x0, @in6=@remote}}, &(0x7f0000001ec0)=0xe8) getsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x11, &(0x7f0000001f40)={{{@in=@dev, @in6=@mcast2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@ipv4={[], [], @dev}}, 0x0, @in6=@remote}}, &(0x7f0000002040)=0xe8) getsockopt$inet_mreqn(r0, 0x0, 0x24, &(0x7f0000003640)={@remote, @broadcast, 0x0}, &(0x7f0000003680)=0xc) getsockopt$inet_IP_IPSEC_POLICY(r0, 0x0, 0x10, &(0x7f00000036c0)={{{@in6=@mcast1, @in6=@mcast2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@mcast2}, 0x0, @in6=@dev}}, &(0x7f00000037c0)=0xe8) accept$packet(r0, &(0x7f0000003800)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000003840)=0x14) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000004f40)={'bond0\x00', 0x0}) getsockopt$inet_pktinfo(r0, 0x0, 0x8, &(0x7f0000004f80)={0x0, @broadcast, @multicast1}, &(0x7f0000004fc0)=0xc) sendmsg$TEAM_CMD_OPTIONS_SET(r1, &(0x7f0000005680)={&(0x7f0000000440)={0x10, 0x0, 0x0, 0x1094}, 0xc, &(0x7f0000005640)={&(0x7f0000005000)=ANY=[@ANYBLOB="0c060000", @ANYRES16=r3, @ANYBLOB="100026bd7000ffdbdf250100000008000100", @ANYRES32=r4, @ANYBLOB="0500000000000000", @ANYRES32=r5, @ANYBLOB="58020200400001002400010071756575655f69640000000000000000000000000000000000000000000000000800030003000000080004000101000008000600", @ANYRES32=r6, @ANYBLOB="40000100240001007072696f72697479000000000000000000000000000000000000000000000000080003000e000000080004000500000008000600", @ANYRES32=r7, @ANYBLOB="3c00010024000100757365725f6c696e6b75705f656e61626c65640000000000000000000000000008000300060000000400040008000600", @ANYRES32=r8, @ANYBLOB="3800010024000100616374697665706f727400000000000000000000000000000000000000000000080003000300000008000400", @ANYRES32=r9, @ANYBLOB="400001002400010071756575655f696400000000000000000000000000000000000000000000000008000300030000000800040030ffffff08000600", @ANYRES32=r10, @ANYBLOB="64000100240001006270665f686173685f66756e6300000000000000000000000000000000000000080003000b0000003400040095000909810000000800071cfeffffff0000fc01020000003f000009070000000104662000010000070000247f0000003c00010024000100757365725f6c696e6b75705f656e61626c65640000000000000000000000000008000300060000000400040008000600", @ANYRES32=r11, @ANYBLOB="40000100240001006c625f706f72745f737461747300000000000000000000000000000000000000080003000b000000080004000100000008000600", @ANYRES32=r12, @ANYBLOB="40000100240001006d6f646500000000000000000000000000000000000000000000000000000000080003000500000010000400726f756e64726f62696e000008000100", @ANYRES32=r13, @ANYBLOB="8800020084000100240001006270665f686173685f66756e6300000000000000000000000000000000000000080003000b000000540004004700d336060000002f33b50105000000090000ff030000000500090299cc000004002004030000000900070305000000870800a8040000007f0007017e020000ff7d65bd695e0000000003017b02000008000100", @ANYRES32=r14, @ANYBLOB="c4000200400001002400010071756575655f696400000000000000000000000000000000000000000000000008000300030000000800040009f9c6eb08000600", @ANYRES32=r15, @ANYBLOB="40000100240001006c625f74785f686173685f746f5f706f72745f6d617070696e67000000000000080003000300000008000400", @ANYRES32=r18, @ANYBLOB="080007000000000040000100240001007072696f72697479000000000000000000000000000000000000000000000000080003000e000000080004000700000008000600", @ANYRES32=r19, @ANYBLOB="08000100", @ANYRES32=r20, @ANYBLOB="3c00020038000100240001006c625f73746174735f726566726573685f696e74657276616c000000000000000800030003000000080004005475000008000100", @ANYRES32=r21, @ANYBLOB="e40102003800010024000100616374697665706f727400000000000000000000000000000000000000000000080003000300000008000400", @ANYRES32=r22, @ANYBLOB="400001002400010071756575655f69640000000000000000000000000000000000000000000000000800030003000000080004000300000008000600", @ANYRES32=r23, @ANYBLOB="3c00010024000100757365725f6c696e6b757000000000000000000000000000000000000000000008000300060000000400040008000600", @ANYRES32=r24, @ANYBLOB="40000100240001006c625f74785f686173685f746f5f706f72745f6d617070696e67000000000000080003000300000008000400", @ANYRES32=r25, @ANYBLOB="080007000000000040000100240001007072696f72697479000000000000000000000000000000000000000000000000080003000e000000080004004b00000008000600", @ANYRES32=r26, @ANYBLOB="38000100240001006e6f746966795f70656572735f636f756e740000000000000000000000000000080003000300000008000400730700003c00010024000100656e61626c65640000000000000000000000000000000000000000000000000008000300060000000400040008000600", @ANYRES32=r27, @ANYBLOB="38000100240001006d636173745f72656a6f696e5f696e74657276616c0000000000000000000000080003000300000008000400d09f0000"], 0x60c}}, 0x1) socket$netlink(0x10, 0x3, 0x800000000000016) [ 487.947195] binder: 551:559 BC_REQUEST_DEATH_NOTIFICATION invalid ref 459014144 [ 487.958026] binder: 551:577 Release 1 refcount change on invalid ref 0 ret -22 [ 487.985034] binder: 599:602 Acquire 1 refcount change on invalid ref 0 ret -22 18:20:20 executing program 5: socketpair(0x0, 0x4, 0x7, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) write$FUSE_NOTIFY_RETRIEVE(r0, &(0x7f0000000040)={0x30, 0x5, 0x0, {0x0, 0x0, 0x1f, 0x5}}, 0x30) setsockopt$ARPT_SO_SET_ADD_COUNTERS(r1, 0x0, 0x61, &(0x7f0000000080)={'filter\x00', 0x4}, 0x68) request_key(&(0x7f00000004c0)='user\x00', &(0x7f0000000380)={'syz'}, &(0x7f00000001c0)="3fcb00faffffff00", 0x0) [ 487.995015] binder: 599:602 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 488.007212] binder: 599:602 ioctl 40087602 20000180 returned -22 [ 488.015094] binder: 607:609 unknown command -284925178 [ 488.024864] SELinux: unrecognized netlink message: protocol=4 nlmsg_type=0 sclass=netlink_tcpdiag_socket 18:20:20 executing program 2: r0 = socket$netlink(0x10, 0x3, 0x4) r1 = add_key(&(0x7f0000000040)='ceph\x00', &(0x7f0000000080)={'syz', 0x1}, 0x0, 0x0, 0xfffffffffffffffb) r2 = request_key(&(0x7f0000000140)='cifs.idmap\x00', &(0x7f0000000180)={'syz', 0x2}, &(0x7f00000001c0)='wlan1user+keyringproc\x00', 0xffffffffffffffff) keyctl$search(0xa, r1, &(0x7f00000000c0)='rxrpc\x00', &(0x7f0000000100)={'syz', 0x0}, r2) writev(r0, &(0x7f0000000000)=[{&(0x7f0000000200)="580000001400192340834b80040d8c5602067fffffff81000000000000dca87086a5c000004f6400940005891550f4a8000000006700008000f0fffeffff09000080fff5dd00000010000100000c0900fcff0000040e05a5", 0x58}], 0x1) [ 488.042399] binder: 607:609 ioctl c0306201 200000c0 returned -22 [ 488.049348] binder: 599:602 Release 1 refcount change on invalid ref 0 ret -22 [ 488.064247] binder: 607:619 ioctl 400454ca 20000040 returned -22 [ 488.067569] binder: BINDER_SET_CONTEXT_MGR already set [ 488.067577] binder: 599:602 ioctl 40046207 0 returned -16 [ 488.071392] binder: 599:622 Acquire 1 refcount change on invalid ref 0 ret -22 [ 488.071512] binder: 599:602 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 18:20:20 executing program 4: r0 = syz_open_dev$binder(&(0x7f00000002c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = openat$null(0xffffffffffffff9c, &(0x7f0000000100)='/dev/null\x00', 0x6, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) getsockopt$packet_int(r1, 0x107, 0xb, &(0x7f0000000040), &(0x7f0000000080)=0x4) r2 = syz_open_dev$binder(&(0x7f0000000300)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, &(0x7f0000012fc7)}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, &(0x7f0000000f4d)}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000000c0)={0x8, 0x0, &(0x7f0000000140)=[@release], 0x0, 0x0, &(0x7f0000000340)}) 18:20:20 executing program 0: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) request_key(&(0x7f00000004c0)='user\x00', &(0x7f0000000380)={'syz'}, &(0x7f00000001c0)="3fcb00faffffff00", 0x0) r1 = openat$selinux_status(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/status\x00', 0x0, 0x0) ioctl$RTC_RD_TIME(r1, 0x80247009, &(0x7f0000000040)) [ 488.071551] binder: 599:622 ioctl 40087602 20000180 returned -22 [ 488.071616] binder: 599:602 Release 1 refcount change on invalid ref 0 ret -22 [ 488.075052] SELinux: unrecognized netlink message: protocol=4 nlmsg_type=0 sclass=netlink_tcpdiag_socket 18:20:20 executing program 3: socket$netlink(0x10, 0x3, 0x4004) 18:20:20 executing program 3: r0 = socket$netlink(0x10, 0x3, 0x4) writev(r0, &(0x7f0000000000)=[{&(0x7f0000000200)="580000001400192340834b80040d8c5602067fffffff81000000000000dca87086a5c000004f6400940005891550f4a8000000006700008000f0fffeffff09000080fff5dd00000010000100000c0900fcff0000040e05a5", 0x58}], 0x1) writev(r0, &(0x7f0000000740)=[{&(0x7f0000000040)="7b427271cf446e9c89f84d51184250cca44b8bf5d14d58eead9e474c12aca2b502817644dbea6089c308335d58b732e14ec795489bfbc93976304ab4c8d9598badf1a89fb67bc3f981a77eaa34188936f10658427559b81da065ae7bef26b406c6d50d7ff2df30bed184ca6fa0de3f727a37b28ec553e0071ef3b8c11ed31261dc28ecba31570540700d7da0aa6e1573af85557200b70249", 0xfffffffffffffddb}, {&(0x7f0000000100)="ef7de47222f5d951644426aa4c66fd41cace16fe0ac335bdfe031c83fad98853e7a6d24b30e0adfd8fd09f1bf923610e4e755342eb1a20ed32446cd5d1bd7a002e4832a28487d2eef854accdd4f092815b72486a757f3837abdd5723c99f9b0e9901fddb6c7ac65afa0c5fb4cec5111795f8549d6d4209300be5219b4138c6a4236a4564a2b3ced499e9770153f242026b43a3c2c57015f9739fd325eb5c7f6335defb28d5022bfc3d5d778ce42735f2334c0c00401048a433b4e19256a6f6b195cbf0ce13b6d86b5c84897dd4d09f15f6c4482780749af9c66cba45e24cafe2c1d545", 0xe3}, {&(0x7f0000000280)="f5d12ff392829e61fa2b7364f685b8bac935f516a3fe2a52a48b0b0e62155f51a0411558f013fa0162a02539912351f6a5d80dfce93af0c7afe0eda65a2c18e0bc01e4a95eca5125c01545d5232354ab612677bdadc782f4eb12d3150e1703e8381c337524f51dbde16ec07758518eacdcc9c96e8ac793898bd68caa7aecbde43b5d474811647f17bb07061e04fa2d54bcda43a4220ecda7b6a082419d4e091fb6113f5576e605c3e3196a6501ba8d6d09c66999f221916df551e5163e68b912f272a3b785603910aa28f5dd570d3e21e025930277d6916dbaf14743bba57b8283ba7377237e1b4ef447ca", 0xeb}, {&(0x7f0000000380)="725f42cd3da9dd772b7218eb28a367fe2902eaded5b0cc4308ea7f0c3a7908260caf813d6c2bbdccf9cfabaef44cbe8132a96268ec71da9d7fd2d04ebf2398980666aae3b76f110db35fafdd904ced98e9270324caec2ca70c75911f80cbe5cda650934ac6388966e845de813419e885007d981b57cec3ed388f728cbd422a82c6893dab1cea776d02b7a1d1eca5e97b4667fe410df019d72d91ca56a4a3a885aff2a23a6163cb0b3e076aa3add96a35dadb514cabe3c01c322fb505", 0xbc}, {&(0x7f0000000440)="8868290de955ac2a48a37fc311629c0786425f5b011a1667c61124ef50c42d80b3e7f24a9e50fbdb4f00d51e4429f3b8c388057bda31f2b7469ca28450e99be029e785b28f9f951365b7e1f318b10f3bbd704034dbb7b5ab306a6d75832fcc652d6e3ffb5e7ea8d6b89f884db4eb36a1dd2837acbe9be3b7a2f42ec1dffb014dfe927b", 0x83}, {&(0x7f0000000500)="ce0330437583661aaff1ab4fdfd2076740ede5de5375a6a2d8736e0c84", 0x1d}, {&(0x7f0000000540)="85310ef3bb5752f4c589ceb99c21c33e59ba28c7e27152e62a9ea03fc9b28d31fbcdee40dd1a7d9a1f578ad367ca53040dfe726e6558c70a7ec83b71ec3f0b3df72b0a9edd71b7fcffd0c1666bf387e3c02d1d31fe1daf78d1fdbfe13b01c90a59ab43101e41881b24ed8770a145405e79a1480685ee8489baee96331e28256fa5ddfa4f9cfa7bfb3f193d98234f91e662", 0x91}, {&(0x7f0000000600)="bcdc25622eede61844dfbe7f540184ed5343079186eae9489e96f2e5157b18289afb5d7db3c9c92b79069e75a9d63c9e5fbf5a996d351f4061b29e15040910c84ab143924343dffe085d3fc113ba490faf1f0922b7a6c8811635c10d414c1e7f38bd4d3d356c", 0x66}, {&(0x7f0000000680)="ad10b144b81858f63f9e4a09d79d70f763f57a5dc83af972c892ccfcec957e3bda8deefc25b3f87391669ea4abd14aa2329fff0c984cc0112cdaa132b85ef07e4a82c3151bb2d11e43e813f816b26274110af86a9e377f2ffcf283e2cd7611fab6babf6d261562107f51c96156fd3c79565898cd47e3d382aaffca45a7b411ae4d622bd6e7a300a756db29723534fe315f", 0x91}], 0x9) [ 488.150560] binder: 607:609 Acquire 1 refcount change on invalid ref 0 ret -22 [ 488.150593] binder: 607:619 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 488.154851] binder: 607:619 unknown command -284925178 [ 488.154859] binder: 607:619 ioctl c0306201 200000c0 returned -22 [ 488.154904] binder: 607:635 ioctl 400454ca 20000040 returned -22 [ 488.227268] binder: BINDER_SET_CONTEXT_MGR already set 18:20:20 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000300)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000005fd4)=ANY=[@ANYBLOB="8bcc54fd542d45d2"], 0x0, 0x0, &(0x7f0000012fc7)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x8, 0x0, &(0x7f0000000140)=[@release], 0x0, 0x0, &(0x7f0000000340)}) ioctl$FS_IOC_FSGETXATTR(r0, 0x801c581f, &(0x7f0000000000)={0x0, 0x2, 0x2, 0x5}) r1 = openat$ashmem(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ashmem\x00', 0x10000, 0x0) ioctl$ASHMEM_SET_SIZE(r1, 0x40087703, 0x80) 18:20:20 executing program 5: r0 = openat$selinux_avc_hash_stats(0xffffffffffffff9c, &(0x7f00000007c0)='/selinux/avc/hash_stats\x00', 0x0, 0x0) r1 = syz_genetlink_get_family_id$ipvs(&(0x7f00000004c0)='IPVS\x00') sendmsg$IPVS_CMD_NEW_SERVICE(r0, &(0x7f00000005c0)={&(0x7f0000000480)={0x10, 0x0, 0x0, 0x4008000}, 0xc, &(0x7f0000000580)={&(0x7f0000000500)=ANY=[@ANYBLOB='\b\x00\x00\x00', @ANYRES16=r1, @ANYBLOB="000225bd7000fcdbdf250100000020000100080004004e24000008000500020000000c00070002000000101a000008000400ff030000080006008b0000001c0002000800050007000000080004000101000008000400a80d0000"], 0x60}, 0x1, 0x0, 0x0, 0x4}, 0x4) removexattr(&(0x7f0000000440)='./file0\x00', &(0x7f0000000640)=@known='trusted.overlay.impure\x00') r2 = add_key$keyring(&(0x7f00000000c0)='keyring\x00', &(0x7f0000000100)={'syz', 0x3}, 0x0, 0x0, 0xfffffffffffffffe) request_key(&(0x7f0000000000)='rxrpc_s\x00', &(0x7f0000000040)={'syz', 0x3}, &(0x7f0000000080)="3fcb00faffffff00", r2) r3 = openat$cgroup(0xffffffffffffffff, &(0x7f0000000140)='syz1\x00', 0x200002, 0x0) fcntl$setsig(r3, 0xa, 0x40) r4 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000340)='/dev/rtc0\x00', 0x8000, 0x0) connect$unix(r4, &(0x7f00000003c0)=@abs={0x0, 0x0, 0x4e24}, 0x6e) r5 = fcntl$dupfd(r3, 0x0, r0) r6 = syz_open_procfs(0xffffffffffffffff, &(0x7f00000002c0)='attr/sockcreate\x00') getsockname$packet(r5, &(0x7f0000000780)={0x11, 0x0, 0x0}, &(0x7f0000000800)=0x14) setsockopt$inet6_IPV6_ADDRFORM(r4, 0x29, 0x1, &(0x7f0000000900), 0x4) sendmsg$nl_route_sched(r6, &(0x7f00000008c0)={&(0x7f0000000600)={0x10, 0x0, 0x0, 0x84001000}, 0xc, &(0x7f0000000880)={&(0x7f0000000840)=@gettclass={0x24, 0x2a, 0x420, 0x70bd28, 0x25dfdbfc, {0x0, r7, {0xb, 0xffe0}, {0x1f, 0xb}, {0x1, 0x8}}, ["", "", "", "", "", "", "", ""]}, 0x24}, 0x1, 0x0, 0x0, 0x4}, 0x4000000) r8 = perf_event_open$cgroup(&(0x7f0000000240)={0x5, 0x70, 0x1ff, 0x2d, 0xc597, 0xfffffffffffffffb, 0x0, 0x8, 0x10, 0x3, 0x36c3, 0x247, 0x100000001, 0xfffffffffffffff7, 0x1, 0x800, 0x9, 0x5, 0x9, 0xe54, 0x3, 0xfffffffffffff6a1, 0x8001, 0x8, 0x8, 0x2, 0xbeca, 0x0, 0x9, 0x800, 0x3, 0x1, 0x101, 0xbf, 0x9, 0x1, 0xffffffffffffffff, 0x40, 0x0, 0x0, 0x4, @perf_bp={&(0x7f00000001c0), 0x4}, 0x80, 0x2, 0x5, 0x7, 0x5, 0x3, 0x8}, r3, 0x2, r6, 0xf) r9 = ioctl$LOOP_CTL_GET_FREE(r5, 0x4c82) ioctl$LOOP_CTL_REMOVE(r4, 0x4c81, r9) perf_event_open$cgroup(&(0x7f0000000700)={0x7, 0x70, 0x8, 0xffff, 0x2, 0x2, 0x0, 0x8, 0x100, 0x4, 0x3, 0x8, 0x7fffffff, 0x4, 0xdb, 0x8fb, 0x7, 0x3, 0x1b38d035, 0x5, 0x2, 0x6, 0x4, 0x10000, 0x8, 0x36, 0xfffffffffffffff7, 0x200, 0x800, 0x40, 0x59f, 0x8, 0x80000000, 0x6, 0x2, 0x33, 0x8, 0x767ff526, 0x0, 0x401, 0x2, @perf_config_ext={0x1, 0x121e}, 0x9080, 0x5, 0x8, 0x4, 0x81, 0x9}, r0, 0xffffffffffff0000, 0xffffffffffffff9c, 0x4) request_key(&(0x7f00000006c0)="706b6373375f746573741f", &(0x7f0000000380)={'syz', 0x0}, &(0x7f0000000180)='rxrpc_s\x00', 0xfffffffffffffffd) ioctl$FITRIM(r8, 0xc0185879, &(0x7f0000000300)={0xc0000000000000, 0x4, 0x3}) ioctl$TIOCLINUX7(r4, 0x541c, &(0x7f0000000200)={0x7, 0x8}) write$P9_RLOCK(r0, &(0x7f0000000680)={0x8, 0x35, 0x1, 0x1}, 0x8) 18:20:20 executing program 0: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = openat$selinux_mls(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/mls\x00', 0x0, 0x0) getsockopt$IP_VS_SO_GET_TIMEOUT(r0, 0x0, 0x486, &(0x7f00000000c0), &(0x7f0000000100)=0xc) getsockopt$inet_udp_int(r2, 0x11, 0x66, &(0x7f0000000040), &(0x7f0000000080)=0x4) request_key(&(0x7f00000004c0)='user\x00', &(0x7f0000000380)={'syz'}, &(0x7f00000001c0)="3fcb00faffffff00", 0x0) 18:20:20 executing program 2: r0 = socket$netlink(0x10, 0x3, 0x4) write$FUSE_NOTIFY_DELETE(r0, &(0x7f0000000040)={0x29}, 0x29) writev(r0, &(0x7f0000000000)=[{&(0x7f0000000200)="580000001400192340834b80040d8c5602067fffffff81000000000000dca87086a5c000004f6400940005891550f4a8000000006700008000f0fffeffff09000080fff5dd00000010000100000c0900fcff0000040e05a5", 0x58}], 0x1) 18:20:20 executing program 4: r0 = syz_open_dev$binder(&(0x7f00000002c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = openat$selinux_avc_hash_stats(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/avc/hash_stats\x00', 0x0, 0x0) ioctl$RTC_WIE_ON(r1, 0x700f) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r2 = syz_open_dev$binder(&(0x7f0000000300)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, &(0x7f0000012fc7)}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, &(0x7f0000000f4d)}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000000c0)={0x8, 0x0, &(0x7f0000000140)=[@release], 0x0, 0x0, &(0x7f0000000340)}) 18:20:20 executing program 3: r0 = socket$netlink(0x10, 0x3, 0x1b) writev(r0, &(0x7f0000000000)=[{&(0x7f0000000040)="580000001400192340834b80040d8c5602ef7fffffff81000000000000dca87086a5c000004f6400945cbf041050f4a8000000006700008000f0fffeffff090000807ff5dd00000010000100000c0900fcff0000040e05a5", 0x58}], 0x1) r1 = openat$keychord(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/keychord\x00', 0x4c203, 0x0) ioctl$SNDRV_TIMER_IOCTL_PARAMS(r1, 0x40505412, &(0x7f0000000100)={0x1, 0x8, 0x19e9}) [ 488.258377] binder: 627:648 ioctl 40046207 0 returned -16 [ 488.271135] binder: 627:648 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 18:20:20 executing program 0: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) getsockopt$sock_buf(r0, 0x1, 0x3b, &(0x7f0000000000)=""/152, &(0x7f00000000c0)=0x98) r1 = open(&(0x7f0000000100)='./file0\x00', 0x200, 0x20) setsockopt$inet6_tcp_TCP_REPAIR_WINDOW(r1, 0x6, 0x1d, &(0x7f0000000140)={0x7fffffff, 0x6, 0xfffffffffffffffc, 0x4f48, 0x579}, 0x14) 18:20:20 executing program 4: r0 = syz_open_dev$binder(&(0x7f00000002c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000300)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0xfffffffffffffe85, 0x0, &(0x7f0000005fd4)=[@exit_looper], 0xd, 0x0, &(0x7f0000000000)="caea33ed51c18a645ced87046787a9e5f748f971a1c624b98a4649d91e440417a9d13b851867aa25f23a975b2594bad8"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, &(0x7f0000000f4d)}) socketpair$inet_icmp_raw(0x2, 0x3, 0x1, &(0x7f0000000040)) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000000c0)={0x8, 0x0, &(0x7f0000000140)=[@release], 0x0, 0x0, &(0x7f0000000340)}) [ 488.330063] SELinux: unrecognized netlink message: protocol=4 nlmsg_type=6 sclass=netlink_tcpdiag_socket [ 488.337059] binder: BINDER_SET_CONTEXT_MGR already set [ 488.337067] binder: 659:664 ioctl 40046207 0 returned -16 18:20:20 executing program 3: r0 = openat$selinux_avc_cache_threshold(0xffffffffffffff9c, &(0x7f0000000040)='/selinux/avc/cache_threshold\x00', 0x2, 0x0) ioctl$RTC_VL_READ(r0, 0x80047013, &(0x7f00000000c0)) r1 = socket$netlink(0x10, 0x3, 0x4) writev(r1, &(0x7f0000000000)=[{&(0x7f0000000200)="580000001400192340834b80040d8c5602067fffffff81000000000000dca87086a5c000004f6400940005891550f4a8000000006700008000f0fffeffff09000080fff5dd00000010000100000c0900fcff0000040e05a5", 0x58}], 0x1) getsockopt(r1, 0x3f, 0x0, &(0x7f0000000040), &(0x7f0000000080)) 18:20:20 executing program 5: request_key(&(0x7f0000000040)='ceph\x00', &(0x7f0000000380)={'syz'}, &(0x7f00000001c0)="a3576cbca80a31b7", 0x0) pipe2(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}, 0x800) r1 = openat$apparmor_task_current(0xffffffffffffff9c, &(0x7f0000001a40)='/proc/self/attr/current\x00', 0x2, 0x0) r2 = openat$selinux_attr(0xffffffffffffff9c, &(0x7f0000001a80)='/proc/thread-self/attr/fscreate\x00', 0x2, 0x0) r3 = accept$inet(0xffffffffffffff9c, &(0x7f0000001ac0)={0x2, 0x0, @broadcast}, &(0x7f0000001b00)=0x10) r4 = syz_open_dev$binder(&(0x7f0000001b40)='/dev/binder#\x00', 0x0, 0x800) r5 = openat$keychord(0xffffffffffffff9c, &(0x7f0000001b80)='/dev/keychord\x00', 0x400000, 0x0) r6 = memfd_create(&(0x7f0000001bc0)='ceph\x00', 0x7) r7 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000001c00)='/dev/loop-control\x00', 0x400, 0x0) socketpair$inet6_icmp_raw(0xa, 0x3, 0x3a, &(0x7f0000001c40)={0xffffffffffffffff}) pipe2(&(0x7f0000001c80)={0xffffffffffffffff, 0xffffffffffffffff}, 0x800) r10 = dup(0xffffffffffffffff) r11 = socket$inet_udplite(0x2, 0x2, 0x88) r12 = openat$apparmor_thread_exec(0xffffffffffffff9c, &(0x7f0000001cc0)='/proc/thread-self/attr/exec\x00', 0x2, 0x0) getpeername(0xffffffffffffffff, &(0x7f0000002100)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @broadcast}}}, &(0x7f0000002180)=0x80) r14 = syz_open_dev$rtc(&(0x7f0000002680)='/dev/rtc#\x00', 0x7a75, 0x200002) r15 = openat(0xffffffffffffffff, &(0x7f0000002200)='./file0\x00', 0x0, 0x88) r16 = memfd_create(&(0x7f0000002240)='syz', 0x4) socketpair(0x1, 0x7, 0x4, &(0x7f0000002280)={0xffffffffffffffff, 0xffffffffffffffff}) r18 = socket(0x15, 0xa, 0x8) r19 = socket$key(0xf, 0x3, 0x2) r20 = gettid() r21 = getuid() lstat(&(0x7f00000022c0)='./file0\x00', &(0x7f0000002300)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r23 = socket(0x4, 0x6, 0x9) socketpair$unix(0x1, 0x7, 0x0, &(0x7f0000002380)={0xffffffffffffffff}) r25 = openat$selinux_relabel(0xffffffffffffff9c, &(0x7f00000027c0)='/selinux/relabel\x00', 0x2, 0x0) r26 = socket$inet6_tcp(0xa, 0x1, 0x0) r27 = openat$selinux_avc_cache_stats(0xffffffffffffff9c, &(0x7f0000002840)='/selinux/avc/cache_stats\x00', 0x0, 0x0) r28 = openat$apparmor_task_current(0xffffffffffffff9c, &(0x7f0000003e80)='/proc/self/attr/current\x00', 0x2, 0x0) r29 = socket$inet6_tcp(0xa, 0x1, 0x0) sendmmsg$unix(r0, &(0x7f0000003f00)=[{&(0x7f0000000080)=@file={0x0, './file0\x00'}, 0x6e, &(0x7f0000000300)=[{&(0x7f0000000100)="4ce4fc75e61258c2a64b45ac54c30e8ac347a0b73708875381cdb7423e3b3213f36289cc9758282d1559d3d949b6b91d732b41774b805454cdd41a96d56c48d04472f80dab26211434babcd17880da972ca6f6ab51ba474d2bcf9f382673923f3c1fcab89bc50ff6386ba7fccd0ceb062c614595d542685d2d615f80596130d665594dd48841dd9ac600331d498ac5319563b52b5dcd6b171c85b0685234b67cc324ebb5db3033cf1fb382", 0xab}, {&(0x7f0000000200)="1364596146b72d624e3fcf6482a44b8180a903f4030c13e3c70341475626d8270bf5476b81fd5cc8c32aa73fd74137940243aacc5bbd367982c65b99e58ed382a73332359b021ed32d767f64df86a1981247c69cd7dad2fa615754803e7c4725b1ee4003924cdf50a40e59e4152a29f0ba88828a1a234e6c8569a163251deb986b1751f36e38344e94ea297bbe6fedf6ff5e44b4512c81a032d231", 0x9b}, {&(0x7f00000002c0)="8950fe68668bdba71af45aff3906969d2c2a88e85f45ca43eb65ebc969a534aae3ec60af3bd5bd07f8ef329f37bccd372dfecb", 0x33}], 0x3, 0x0, 0x0, 0x40}, {&(0x7f00000003c0)=@abs={0x0, 0x0, 0x4e22}, 0x6e, &(0x7f00000018c0)=[{&(0x7f0000000440)="9b3ec2734aeb1295cfe1c95894d683df02ec4ce65da8f313eda3560dcf77cd0f4fd821aa54b14324d8b625637f7fe3929302f8fe47e2f2e7eaa99a12efa5692e7e14720708ea99770678e3b332fdc0bf07d28c21ff4b7a837a99f062f6a4d2daf8720881950b8416a8b62ea89d9a0fa20cefbd1f4478446536f3657a20009f155db18f249b1be176b6921a975b33c21c696494cd4cee4d1dbdfe72ca559abe490e4450b5", 0xa4}, {&(0x7f0000000500)="ae2bc3a7d81cdcb78ada225f924d476e0bea7621b226d15b3ebd1f673996d188ef0f23b1fb4a4c6200c2b972b7004b7eb3eb603bb54b2ffffd024b73b86c9620e773e515ff5412c5a1555f211d48f90b9516eee61b3ed855e8d29584d135871e0b3cc6859272dc7e3750c15fd6a704a8e30d50bb61853acc2e30bd3399122d482b3960369649ee4285ab15e817e3bf593ff2e5a22b90e1c57868d56a552ca84173404cd9707749f33eb6bff20dcd081eb7c0913d144996b3eb1dd43ea33d84fbe2d6ae506c261b9088b629a6d7a1498e2c1943c99201fee0c7cf6e3dfdeea8fae9b0b8740f7d1503ab2940799266e372074edd9e10dfc7b4c0783227bf748cc68e545201b57422f57b8087c717109eeffd81ad6bdb0b5278baa8ae50d511b227f4ac83886978c3a83511b781bf8d1710053634d5a03c4ddfafdf135e8110e460a9dcdb1ac337d649234b6ed1dc59cfbb3ed20b502c514880fdd6a3f40b46c3b77a820ded455ff22a816972c7570388ea51948dc4edf8feb82551441b5f0fae9b451037d8a3c0ca05101995a8fc02b762f20e25c0e6d11fab497d9b47874fa08c906df0b04f3f0168d9a8e53e1d59a00f9baf027a44f6a1ee8e7c78323df9e09eed988ae9d1ebcc75b6d869bb9b4c3098e9862dbb1fe4f32bdf61d8d3fa88e46e66e33ea74812e49174c9c86c84dfe18fe5934bca64b5e74482c09b47817dff5a787f3291d10e9f87bc920553270aef0f402844b5f75a47fdeeee88095d2395b498b3b05508751bf484a966cd944d56175de812fda96917d806e7a0dc1dda6e8dc69751cc31d3fe69481374e0aa6f5d021ea74ea5705ef52058679b24d6e7c87de6027ae46d0808d25b2035354253b5cea2f1a4bf1416bb31e7a1d0ac5e298c78fa7446890f395afe7bdfc4fb1caa8e6186a54bed24d3c0c7075c8c4d1492239fd5d8232515f897c001a99eb88f815a35a37f530cef2895e93a6e2cb773a578ab4c613494ed2175d83e50dc4fda41a1c4ab3e54eb6e0cb8faa5730b03cdc9955bd149bdc3050e2678d6f549efb7b9e124614b856a3729d75cf949341d992d2154d0316dbc42ada825fb42b2a915899bb61b0abc47da68c18ba491d0a990ac06d1e6ee78b1db12eacfb3179460aba7b1c2cddb7d42560756e3c4f2e764bb3c4840c8155c227bbf6cc30146603342004c75dca43662abf888bee27b3b34553735ec5770a9041a925471a0df2fb33574d6c5ff946e55efc080c37a09700a47f47aaa7b257a0e38d7bff1439e238f39753991ae2f4ae6c55c180ade8e3d450c010a373d62c00f24fb1ce313762d69a7e44e6271e02950765d799596a49eaaff5338d5b8b06d996be1521753ad3584bbfc90c940d926218cebda9b29836b3b5f88dde7d4e316f8ac3911c8143b1c0806852b886af70aa39524ba6ff6723cd13f5746729152fbd4aa3991b005df875277393cbc04d2acb1b3e49b36a27375f0a2f527894fa5f38e32a6dd78630e4c6cf5c144ef5813a99795cf3eca318beb8fe98f1517a50c83c5543b98caad8c5f6c439dcc2dd314e0c0d86203ee849d8ee1b0425bc4f50e3607704a7f4450e7cf623e444775149c26a05e6190425f29e88cd6ca286e79afe976ca0bb4046ce1d605589d0bd8928e23247750afc5d8e47a406aa802002800fb7bb9c3c6611d536ee8b46a0429df8c07306d1a1b744baf9a04516f623564ebc496587f2fd5b5cbdae0fdb421dac75d7081b0271339b8245994ad47748a3e8662355be7ea557bee7f88e6ede9648d20d03bcb6c011924a188319b292400608d1c1f9c2ce4bb19942bcc53998de9f2e55eeafc3f23cc1f3296fbf7efe4891e396799d229bdd9867fc34f3143bad3c7a391629aeba183eb6e111a358b1c163915d7afa5bb4714bf7b7ba348cbb476622a77baef2c989214e1aaf89965f19d5f40d0236d8088ff303746a46b4cf977cfb155106f32d524d52190600f45162d648d4d01b348314359f48a9333878cf64af6f2407d21ee79f754459242a0ddd4eeefb19ee3e413b10c3817bd41b61edfa55f63a6744182a9dd5887c41fea575b9a889022c3c18bbc547a62cf78273562c9d241b456d942aade26d621d4785f9d00416ba9586f1857d8dbb49309e7d823b9886d289174f1c8e3b9338c8af12527c64d2ff536e84f1490520b2f15e98c96e18add927c16c17b5fb73f2a1f8b6f46995f7fcacc4e56767955b651f787b92563445bf384adc4e75df2ba22d70f2a8eb7de9b3d9bacb3b5be087717a06013860d43b96dd35f2b3e87fc4dbafb8e3e46c85efe21f481dd9d719b342231d521f6700bf2840709b72b73a527e89a93d5481cc23f88b74daa3932228d862154356e410e25e3d0f11262cf45837323499e3203cdbc477b16eb9b0656c0892f0fceb1e8ceaf8901e7d3984e9a1ac8ff9d7b13eddb66d3f1f486d291acbbc60866606bf7c029ee835404ebe53d07389aa196af12b2490cc00bddaf8cb52b2ebfe050f12b2466e3f90834f03b531c1e3c0ce70124b50426eb58d50e1b52a1e8f68e1a05b4ce7e9c0f525d9ac42a565c9f781ef181a6203611aceb77463a973ddf416636a40ae02ff1e0880f9bd2e964996b12f8abc679b6db6e023fd5dc7ba110c173b7af881a67a99dc5d85647391241c461741429635599b81b45d3b2c9a0548878302c2749fa61174dfccf08972b12165f3f2fd7a4c5adc4e33eaa36f5592c54669decad25da7358d196a8433dc2113e6a6e8418bdca9f1806d1dd4be8cc3fd8c0015c7a88ac7413a8ff7db04e59ee21ac2df1b9f11d098ae604cf953f8514f8144ac543ebd606c7185bf3220ccb0b1e94c5f945c2dd37b5975ddf70d03abf2798e1a505f3c72daf85d403d1476ece9db53ee0ddc34ac70db9402953105ed55aeb8c60875c78686d01b367a316c1d24de9b48d45f0425e9b0eb11526facf83d4dae7c4c35b770f5356c99d1c5c6bb53edf677810b3389f093860eb4f66f34b718fcc8118ee0a2acc37e5f90868059236e93a05de7d504ff9b2552a61764efbcd5a42fef2bbe06c5b337bfc12dde92bc4cf118fabf11649b78dc75186598eb3cb3bc2848acb297272ab40306559cd6857e31e7c87ebc186270e909e1f5bdd2325c477b23d86902aca568ece2a06e35a7e1e88605a9b7c2e51b1199bb1d3802f10181c38e43ef927c1b559a9f67ed919ea40310d05cba323b1004b7e81a82d1f408dd5d31e2892ce491767a263e4f4845e599bae624c6edd184a8b2bc35b777d9c4e9d0d9066c4319aa508db441c10fb506ed967c65b4d6cef40925f23691e2833b9e174b73474966286f4ee1c5f95711a83ec9a0dcf1b83ed02e27fc94b1b4c05300b8bdef3ad40d4fa73b3076ea2003372b381853fd96200db53389af05f93ad3b9d09837a8da2ad94768081bd15c61abedce81f29cd8c57d279b5944fbc2a92fa731c70dbe2f6d1c7299a3beaf2fac5c3e788fd40a69874b1801dac066a8edc0f92a696ef945e4cff64d7d7319ca18499d9a015931f484610294097ca5a6cd2ae4bb0a955fc937c4d802132dde5978e5047f4dca9ebbe0aff5f909f4faa2e80882ddf32df3ffbf547a88fbb43ba6b89af12ee90e9c7abd51bf5b28b2f23cc4460b515370fc0828618c83c7a1c4a9929ca4057ffae704f189e749d1aca3108109b331c539d6114854a34b46cee743dbdf8b22737946b292ec06664bf571fbc09fb29f18dd5fcca08c205b4c7371ab8014411e84e28babafa1524c7c46643fcebbfd23addfda84764b343f64e5cc3ac7d61c9e3f9c6d928b15fa99d7b5041eaa102829f43963820e2217096110004fb0af97384cfa97bec2e31b278002e3664899144ff76086b72cf5aaa8986b199a07717147124e73f8e11a129c64e262c6afbc697cb5cf6ff7b7cc10c3b1d80f61f3be43ef7a1bf9fb421439f077bc190b0d350d4d2bf061b5d694b30c4e96cb802119e05b4caf466660985e6c7ea9867df3000614f742114920163e91fb86e89a1ebcdc010b1b33d12339fb4790ffa4b5bb146022496f9d5310472486b1cf4e31b4941a838e8f6c11215d0c8b55c9a0db5cb93cbd150c963b5419563c948b4db7d15a4aa8c3efcb3151594edc9103eb4b7079f52a24e135a556002f169e3d461946bc52799952b6a9788f613665f6d85f7665fd680176e5c3bafa54ec5fc10c15c6d8e9c906f5e1a2623c5a03ae22c4c0a2b158552777ce94fe7a2e5bae7a32e69d63d13ca3f506b6c4e2392457ae54546db152098ecb18aec238722ab8464ed4728d8afb6f42982574ef576a18bdaab8919af00aed384b6707b4adddaf26ebc5674bad8d212659e8f0fea68dccb53fb9412a4449ba45f53b2656e5cbef8873aec780aa177e3946a5aa32ba480ea13da5c50377d6a66ae47ba5fb4c1e756f491d9abf93adfcd81b7e0306402e7bac72263a47620db1727f2b65abe5f84f917059664dd815cba187539d13648eef86c811fdecbbae19cff7f392dddd067e65ad8de8147f75250be6272f4d5a00b3314dd712f9ee27b36f640efe2bdaa7f55d4aa42ef19860d1583988afb15090d1d1ccdcb5897802a656b2923e8297a6771fce54e4f3dfdd47a3237e4650c69aa202ba01a29a977f1c8e798cf209119e0a23d91c2a8a5f81a5ec5d93b4bcc259efbc64e8e49ab77f24d2d4a6578be8c87a190d5b5828d33d0574e70e5a22ec3de0928d246e7b9ba4fda7ed86eeaba74ee8d64f473ab27156883e3ed64548f35aae525f135b310d6fe6de210e61bb067c200e13215418f2e1f2a056269fdffbc3da8e7a5642a80cbf9e5e9df212b6028ec5472c93302a92beacf7e8dfc3b41854a1c61f73697c62df67eceab779dba56005c820d6ded9fdb6c95d911b2d9e256df6231b58a24836c8d4b26f067e53c40bc00163027b3d8d6ca72f80955c0ab720719628976d5bbead6d77938d9205edf51c2f89ae2700323be2718813eb7d6f28aa626b3eceda1df4be7d58898e756754d7e82bf0bdf51430d1c337f20c633f8794d2734f8227f261088bb0089e0999222aebd22bc1de63be65168546d2a19f86eb4ee9a01ca08dfab4d419e588788e8ab813792a983fb83f99f46ea26917c00eed4d3aad088cbbf011a0dcf11eb773ab90ed26d1a0d62c6cb27f0395edc9151f29cab6a4cc5423d01a3e076deb4dbdaaeab653d191f0252de5e8479ef0b943cf3404f07dbd84745cf4a2230f36a98ff7ed2564d6f41393e108be8284ea2413b401436de5ea46a09421add9371679ac9add3f40b61845e62390f020720cbe824fb83227ad49dd3b3eef164ae6313202f6c1f1ff9ed535717a5ef4db2090f684cd7bd441878ad2ae5c0bea651af1c883ed8e57f043434e4f4300a4a487c6d8762a8615cf3efa9c2cc7a045d2262dd70b34d4df86a2411a98d3b932045fb9eeaa7af3e7b887b549d10a1527b8b3d96a4816a6b9a3cea3fc7dc5add85260364f13209d62252bc52fbec4ce137150ab8aa5da22b6696527581e61ec6f4481add1015367f5d61b6c6855414f97155b21d6919f2827261eddaf812955013c5190c77bae3d77eab24d3d9512d5d37f263a97f83ca5834c2b202edafc8b2378784829f42e4a4c48c00801737acf39bcf44fe0a033c22474c20edd38933487d46917123d77194795935e14f574823ee233381f4d4786e4d567c7ec9be836c7f60eaa4996a4ccd165691b4804e95739ac44fc46669a85acbb1051789967a9ad0592a917368a00a9a0a28b8a0723f57fab22db8ae4462bf9283a7c7808c", 0x1000}, {&(0x7f0000000340)="b3e30d5078cdb0d66f40dffc7f", 0xd}, {&(0x7f0000001500)="f9665a7e3c69a8d85ef87e785c38b9d3ba4313882f27901e86298c1e12c42f651d0d5ad93eb18b962d320d9508097f6158db3eb123abca605eb8d29b916edac77d29b37032c4f3a2197e9c026ca67c4dde7fcb16d7cde11d742bf5b9a360d7ef6c4da1f5233c1a69272f2057d3f173475e83dfa96d579d02044b7ec2efcad5824972fbbd5951b711df9a6247e25e9c2cfaabd54ffd9fe88c9411622bd52d14be5bfa6d4bd183d7d1927838342eb6cc9cdd2fc7bde814c775292ec3c39908a69d72cb82a4183da31b8697ca", 0xcb}, {&(0x7f0000001600)="7e9ce86791ffa67edf382a567020ccb1582e42c1c55a203c9416fc8e861bda81415e1b7d15dda9c8853966217a7b6e7ea32171c7033dbd97eca9c4c297f7a16fb168d509cea655faadc0500c2363381adf0b82d6cc516114a79452bb0e804f1d0e77e28b95bc81a00d7f85d6f4da0f0c67a2c3364cf1fe71a435846f615fd7258f20c31c145a20713f7c1d6d1bada3be21078a75244c8042681d07b3f2d11381e5fef3d03ed4fef95e6d257a2a0ca3b4288952162e3d4c99bd345579cc64e1b6be1e9c278311f3d9ae19c7a520b75bdbd0f1df1714ee42801249", 0xda}, {&(0x7f0000001700)="74c02541d9d76872272e", 0xa}, {&(0x7f0000001740)="f6655189618bedbfff87af4b8840498a282c1c738b4c402d22f56ac589bc012f1b06af029e84754de0e671943bc8c52b581729fa54142e9ebfb3e59dccb5b5ed4cdedede63fd7065919c72ea561815dcb6e4ea39fedbfe040b16616e8a8bad433a7843e68d140976b8996f374fafc65fc66896baded2eb3836144934f26cafb1bc0b", 0x82}, {&(0x7f0000001800)="a617c0a49b39d91f413291264d568119821a1a85d186c5beae471375636be1c48cf089861d9a50c4c8499e759ce578e65d92db4b9efe54741161ee4793d2059542e7030b4daa7c8589908b9f330f33162215816591c752e817f91cec27155ed3bb7d3b485097b6d5e77cc89764a78c5ed729af71aa2decbc239d86746e28aed49814ad26795e9563491228b116bd257bd5d34b42df311da326424dd5a7ee0c3d61ce89a01eb2c41741cee0ca7d4d91613bb16ff9b6366e3424555a3dbb42fe", 0xbf}], 0x8, 0x0, 0x0, 0x8000}, {&(0x7f0000001940)=@file={0x1, './file0\x00'}, 0x6e, &(0x7f0000001a00)=[{&(0x7f00000019c0)="9430994e94595a5afe1d8d3e0b", 0xd}], 0x1, &(0x7f0000001d00)=[@rights={0x28, 0x1, 0x1, [r1, r2, r3, r4, r5]}, @rights={0x30, 0x1, 0x1, [r6, r7, r8, r9, r10, r11, r12]}], 0x58, 0x80}, {&(0x7f0000001d80)=@file={0x1, './file0\x00'}, 0x6e, &(0x7f0000002080)=[{&(0x7f0000001e00)="ec8363dc40575cabb82815639a36b3124b4b7fdfb32496f7ae2f2441a53a67403b2fba96077d654d5c8fc1b638a3dc2360d9a45e2562711c7db6615a98c7a10cd0c2fb7f6bb0242fa59dc65a9685ea35a86d312c90870ea579ee466dcec9472f03246842aaf20b542d5f21257dadb80e749881ef99d544a5e29a48a8b66a27ed33cf83d29a653a", 0x87}, {&(0x7f0000001ec0)="ac5dc13a8a080959365991d84eddd5df7b5a4107df31de7699d5bfe1df993a1f2574ce891e218934726696cfb0a4cefbb781307d9cda", 0x36}, {&(0x7f0000001f00)="c1aea243f799cf0bef938519f3e72159ecad5f028c13a010d14f034152deef7efe9f29fb4be2cb17cd62bf06d6d3c83a645f64c879296d4f242e62b81427a15a974aaa3e7741750b9fc1e1f82f4b7974ec625ef2ad708171b3d8361b2bf8a8dd5b2b5122ea6bbf911388390c6cd57e17bda25528e1d3e61f4d566cb20f3983ef25c3b72ac30595b07d47c0dc00df8c3f37c8bb48da048c1a8ff2fb2d77938096e19e3ab4fb629d8ccde23cf1f5049c3916692450a0b777724ad7936add89496bcd327807614809dd967d5d59332a959e0d73b918fe6b85048d283f871b69450aa552480fbd12f934d697fc4add594649236eece096b9dda56dda539c2b", 0xfd}, {&(0x7f0000002000)}, {&(0x7f0000002040)}], 0x5, &(0x7f00000023c0)=[@rights={0x30, 0x1, 0x1, [r13, r14, r15, r16, r17, r18, r19]}, @cred={0x20, 0x1, 0x2, r20, r21, r22}, @rights={0x10}, @rights={0x18, 0x1, 0x1, [r23, r24]}], 0x78}, {&(0x7f0000002440)=@abs={0x0, 0x0, 0x4e21}, 0x6e, &(0x7f0000002600)=[{&(0x7f00000024c0)="32622b86de3207497c2d25bf334194ce71ad30792dabedb4b7cbb62da8912fa3958517a963765d1f692af6261509be97e8bd9c32", 0x34}, {&(0x7f0000002500)="127530899b719a2d61ed88ac5866039fde2c4e", 0x13}, {&(0x7f0000002540)="f41679400ef6db03231a926111c437a9669640940ba5eb943f60b49759f0a03fb4d4cb91a1f35023367954a0fa47e94c652318d4cdf8bd9ccb0866b86a1a57e9af8dd734d284e1dd1c4d2cc76f704b3b633c53beaba8d24f186673aaf21f12a5f389bdcb5251dfdc609c8ec22426d9ae1c9a8243368208b45a0fa0c314293cbbb01c098e234e6a54c7", 0x89}], 0x3, &(0x7f0000003ec0)=ANY=[@ANYBLOB="28000000000000000100000001000000", @ANYRES32=r25, @ANYRES32=r26, @ANYRES32=r27, @ANYRES32=r28, @ANYRES32=r29, @ANYBLOB="bd46a611"], 0x28, 0x10}], 0x5, 0x20000040) [ 488.385926] binder: 656:667 unknown command -44774261 [ 488.391889] binder: 674:678 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 488.405543] binder: 656:667 ioctl c0306201 20012000 returned -22 [ 488.425796] binder: 656:667 Release 1 refcount change on invalid ref 0 ret -22 18:20:20 executing program 3: r0 = socket$netlink(0x10, 0x3, 0x4) r1 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f00000001c0)='/selinux/enforce\x00', 0x40000, 0x0) ioctl$sock_SIOCOUTQNSD(r1, 0x894b, &(0x7f0000000240)) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000200)={'gre0\x00', 0x200}) ioctl$LOOP_CHANGE_FD(r1, 0x4c06, r0) ioctl$TIOCGLCKTRMIOS(r1, 0x5456, &(0x7f00000002c0)={0xbca, 0x10000, 0x9, 0x4, 0x163, 0x3f800000000, 0xfff, 0x3f, 0x9, 0x8, 0x3ff, 0x3}) ioctl$sock_SIOCSIFBR(r0, 0x8941, &(0x7f0000000280)=@generic={0x0, 0x57f, 0x800}) openat$uinput(0xffffffffffffff9c, &(0x7f0000000300)='/dev/uinput\x00', 0x802, 0x0) writev(r0, &(0x7f0000000000)=[{&(0x7f0000000040)="580000001400192340834b80040d8c5602067fffffff81000000000000dca87086a5c000004f6400940005891550f4a8000000006700008000f0fffeffff09000080fff5dd00000010000100000c0900fcff0000040e05a5", 0x58}], 0x1) mount(&(0x7f00000000c0)=ANY=[@ANYBLOB="a57c7c7a4dcbdb9b"], &(0x7f0000000100)='./file0\x00', &(0x7f0000000140)='omfs\x00', 0x40, &(0x7f0000000180)='em0\x00') 18:20:20 executing program 0: r0 = openat$selinux_status(0xffffffffffffff9c, &(0x7f0000000040)='/selinux/status\x00', 0x0, 0x0) write$FUSE_IOCTL(r0, &(0x7f0000000080)={0x20, 0x0, 0x4, {0x4, 0x0, 0xba83, 0x3}}, 0x20) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180)={0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x420200) request_key(&(0x7f0000000000)="701472b37dd6edd300", &(0x7f0000000380)={'syz'}, &(0x7f00000001c0)="3fcb00faffffff00", 0x0) [ 488.442764] SELinux: unrecognized netlink message: protocol=4 nlmsg_type=6 sclass=netlink_tcpdiag_socket [ 488.446816] binder: 674:685 Release 1 refcount change on invalid ref 0 ret -22 [ 488.449982] binder: BINDER_SET_CONTEXT_MGR already set [ 488.449990] binder: 674:678 ioctl 40046207 0 returned -16 [ 488.456047] binder: 674:689 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 488.456142] binder: 674:685 Release 1 refcount change on invalid ref 0 ret -22 [ 488.472819] binder: 656:692 ioctl 801c581f 20000000 returned -22 18:20:20 executing program 4: r0 = syz_open_dev$binder(&(0x7f00000002c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000300)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, &(0x7f0000012fc7)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, &(0x7f0000000f4d)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000000c0)={0x8, 0x0, &(0x7f0000000140)=[@release], 0x0, 0x0, &(0x7f0000000340)}) r2 = dup3(r0, r1, 0x80004) ioctl$EVIOCSKEYCODE_V2(r2, 0x40284504, &(0x7f0000000000)={0x8001, 0x5, 0x8, 0x80000000, "ec746c0be428e2c8a474c97ed9a216376b49747dcb03f8f53aecfda200f834cc"}) 18:20:20 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000300)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, &(0x7f0000012fc7)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0e413b45ff00000090eaf7d5e75e6b8546f77c09a3ecb301eb7d9095f029d015fa6dac4467f0c74f87877eb2f3c76ca8443d72d8bb1605a9b722af84b0000218e67985923391"], 0x0, 0x0, &(0x7f0000000f4d)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x8, 0x0, &(0x7f0000000240)=[@transaction_sg={0x40486311, {{0x4, 0x0, 0x2, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, &(0x7f00000001c0)=[@ptr={0x70742a85, 0x1, &(0x7f0000000080), 0x0, 0x4, 0x31}, @fd={0x66642a85, 0x0, r0, 0x0, 0x1}], &(0x7f0000000200)=[0x30, 0x28, 0x38, 0x38, 0x0, 0x38, 0x68]}, 0x81}}], 0x472, 0x0, &(0x7f0000000100)="2b8335c7662f7429a16d85a2d2b7bfbc2c073ff75141e22a927485683c78cbdf34277cf89ec407804907ab6fbd8893c74b1251fb0d21c52b0fe61a525cadab2df82b127dcb5779d12de26ee1476af4f95a6505fe5a218b21d293feb607500ce050d16647993e15ceaceebdd4e14b8db2e93ddd8fcfd9b51c267c2e4792cf9733926c40f656420151f9c7f584dc33e2b98ef0992c1924d87a94279638bda2258c7b0825b0027beac1d4b99f332bca5567cabf790d9c1827"}) [ 488.500360] binder: 656:667 unknown command -44774261 [ 488.506875] binder: 656:667 ioctl c0306201 20012000 returned -22 [ 488.513527] binder: 656:692 Release 1 refcount change on invalid ref 0 ret -22 [ 488.524297] binder: 656:667 ioctl 801c581f 20000000 returned -22 18:20:20 executing program 0: openat$selinux_mls(0xffffffffffffff9c, &(0x7f0000000080)='/selinux/mls\x00', 0x0, 0x0) r0 = openat$selinux_mls(0xffffffffffffff9c, &(0x7f0000000040)='/selinux/mls\x00', 0x0, 0x0) recvmmsg(0xffffffffffffff9c, &(0x7f0000006680)=[{{&(0x7f0000000280)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @rand_addr}}}, 0x80, &(0x7f0000001500)=[{&(0x7f0000000300)=""/94, 0x5e}, {&(0x7f00000003c0)=""/66, 0x42}, {&(0x7f0000000440)=""/119, 0x77}, {&(0x7f0000000500)=""/4096, 0x1000}], 0x4, &(0x7f0000001540)=""/19, 0x13, 0x3}}, {{0x0, 0x0, &(0x7f0000001840)=[{&(0x7f0000001580)=""/99, 0x63}, {&(0x7f0000001600)=""/92, 0x5c}, {&(0x7f0000001680)=""/108, 0x6c}, {&(0x7f0000001700)=""/207, 0xcf}, {&(0x7f0000001800)=""/22, 0x16}], 0x5, 0x0, 0x0, 0x3f}, 0x1}, {{&(0x7f00000018c0)=@xdp={0x2c, 0x0, 0x0}, 0x80, &(0x7f0000001dc0)=[{&(0x7f0000001940)=""/130, 0x82}, {&(0x7f0000001a00)=""/104, 0x68}, {&(0x7f0000001a80)=""/217, 0xd9}, {&(0x7f0000001b80)}, {&(0x7f0000001bc0)}, {&(0x7f0000001c00)=""/199, 0xc7}, {&(0x7f0000001d00)=""/161, 0xa1}], 0x7, &(0x7f0000001e40)=""/4096, 0x1000}}, {{&(0x7f0000002e40)=@nfc_llcp, 0x80, &(0x7f0000003400)=[{&(0x7f0000002ec0)=""/206, 0xce}, {&(0x7f0000002fc0)=""/74, 0x4a}, {&(0x7f0000003040)=""/181, 0xb5}, {&(0x7f0000003100)=""/35, 0x23}, {&(0x7f0000003140)=""/251, 0xfb}, {&(0x7f0000003240)=""/68, 0x44}, {&(0x7f00000032c0)=""/125, 0x7d}, {&(0x7f0000003340)}, {&(0x7f0000003380)=""/45, 0x2d}, {&(0x7f00000033c0)=""/60, 0x3c}], 0xa, &(0x7f00000034c0)=""/99, 0x63, 0x6}, 0x7}, {{&(0x7f0000003540)=@xdp, 0x80, &(0x7f0000004800)=[{&(0x7f00000035c0)=""/131, 0x83}, {&(0x7f0000003680)}, {&(0x7f00000036c0)=""/4096, 0x1000}, {&(0x7f00000046c0)=""/53, 0x35}, {&(0x7f0000004700)=""/34, 0x22}, {&(0x7f0000004740)=""/126, 0x7e}, {&(0x7f00000047c0)=""/38, 0x26}], 0x7, &(0x7f0000004880)=""/69, 0x45}, 0x1}, {{&(0x7f0000004900)=@ethernet, 0x80, &(0x7f0000004bc0)=[{&(0x7f0000004980)=""/91, 0x5b}, {&(0x7f0000004a00)=""/67, 0x43}, {&(0x7f0000004a80)=""/127, 0x7f}, {&(0x7f0000004b00)=""/188, 0xbc}], 0x4, &(0x7f0000004c00)=""/156, 0x9c, 0x4}, 0x9}, {{&(0x7f0000004cc0)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @rand_addr}}}, 0x80, &(0x7f0000004f80)=[{&(0x7f0000004d40)=""/42, 0x2a}, {&(0x7f0000004d80)=""/173, 0xad}, {&(0x7f0000004e40)=""/157, 0x9d}, {&(0x7f0000004f00)=""/122, 0x7a}], 0x4, 0x0, 0x0, 0x1000}, 0x401}, {{&(0x7f0000004fc0)=@in6={0xa, 0x0, 0x0, @remote}, 0x80, &(0x7f00000053c0)=[{&(0x7f0000005040)=""/21, 0x15}, {&(0x7f0000005080)=""/169, 0xa9}, {&(0x7f0000005140)=""/117, 0x75}, {&(0x7f00000051c0)=""/6, 0x6}, {&(0x7f0000005200)=""/20, 0x14}, {&(0x7f0000005240)=""/14, 0xe}, {&(0x7f0000005280)=""/96, 0x60}, {&(0x7f0000005300)=""/134, 0x86}], 0x8, &(0x7f0000005440)=""/4096, 0x1000, 0x2}, 0x1}, {{&(0x7f0000006440)=@un=@abs, 0x80, &(0x7f0000006580)=[{&(0x7f00000064c0)=""/150, 0x96}], 0x1, &(0x7f00000065c0)=""/153, 0x99, 0x9}, 0x200}], 0x9, 0x120, &(0x7f00000068c0)={0x77359400}) setsockopt$inet6_IPV6_PKTINFO(r0, 0x29, 0x32, &(0x7f00000000c0)={@dev={0xfe, 0x80, [], 0x1d}, r1}, 0x14) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) request_key(&(0x7f00000004c0)='user\x00', &(0x7f0000000380)={'syz'}, &(0x7f00000001c0)="3fcb00faffffff00", 0x0) rmdir(&(0x7f0000000000)='./file0\x00') [ 488.555298] binder: BINDER_SET_CONTEXT_MGR already set [ 488.572487] binder: 701:708 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 488.587027] binder: 701:703 ioctl 40046207 0 returned -16 [ 488.594069] binder: 707:711 Acquire 1 refcount change on invalid ref 0 ret -22 [ 488.613214] binder: 707:711 unknown command 1161511182 18:20:20 executing program 2: writev(0xffffffffffffffff, &(0x7f0000000000)=[{&(0x7f0000000200)="580000001400192340834b80040d8c5602067fffffff81000000000000dca87086a5c000004f6400940005891550f4a8000000006700008000f0fffeffff09000080fff5dd00000010000100000c0900fcff0000040e05a5", 0x58}], 0x1) 18:20:20 executing program 4: r0 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000040)='/dev/rtc0\x00', 0x101001, 0x0) getsockname$netlink(r0, &(0x7f0000000080), &(0x7f0000000100)=0xc) r1 = syz_open_dev$binder(&(0x7f00000002c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = syz_open_dev$binder(&(0x7f0000000300)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, &(0x7f0000012fc7)}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, &(0x7f0000000f4d)}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000000c0)={0x8, 0x0, &(0x7f0000000140)=[@release], 0x0, 0x0, &(0x7f0000000340)}) r3 = openat$pfkey(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/net/pfkey\x00', 0x20002, 0x0) syz_open_pts(r3, 0x8001) 18:20:20 executing program 0: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) request_key(&(0x7f00000004c0)='user\x00', &(0x7f0000000380)={'syz'}, &(0x7f00000001c0)="3fcb00faffffff00", 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x7704, 0x0) 18:20:20 executing program 3: r0 = socket$netlink(0x10, 0x3, 0x4) getpid() getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000000080), &(0x7f00000000c0)=0xc) fcntl$getownex(r0, 0x10, &(0x7f0000000100)) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000000140)={0x0}, &(0x7f0000000180)=0xc) r2 = getpgid(r1) syz_open_procfs(r2, &(0x7f0000000040)='stat\x00') writev(r0, &(0x7f0000000000)=[{&(0x7f0000000200)="580000001400192340834b80040d8c5602067fffffff81000000000000dca87086a5c000004f6400940005891550f4a8000000006700008000f0fffeffff09000080fff5dd00000010000100000c0900fcff0000040e05a5", 0x58}], 0x1) [ 488.642215] binder: 707:711 ioctl c0306201 20008fd0 returned -22 [ 488.657086] binder: 707:711 got transaction to invalid handle [ 488.675575] binder: 707:711 transaction failed 29201/-22, size 0-0 line 3014 18:20:20 executing program 5: request_key(&(0x7f0000000000)='asymmetric\x00', &(0x7f0000000380)={'syz'}, &(0x7f00000001c0)="3fcb00faffffff00", 0x0) 18:20:20 executing program 2: r0 = socket$netlink(0x10, 0x3, 0x4) writev(r0, &(0x7f0000000000)=[{&(0x7f0000000200)="580000001400192340834b80040d8c5602067fffffff81000000000000dca87086a5c000004f6400940005891550f4a8000000006700008000f0fffeffff09000080fff5dd00000010000100000c0900fcff0000040e05a5", 0x58}], 0x1) ioctl$sock_SIOCGIFCONF(r0, 0x8910, &(0x7f0000000140)=@buf={0xd6, &(0x7f0000000040)="b932292e585a77d186c4df4b4ae591ab33220c5ab14e48daab742adb420be520e9fdea14d0b34b98a8f52ec9b143aee175533e0a314f2ae08159197facc65c99fdcf555b125e022e93a1da1b370364b92747e4e6f78e333778961f7d6dfa4424aadb67ed690046400f652233ecd5af4ca72f221412add63a31d5210ffd6fd4137d6f2cbe251d2ebe241f1fed8790b612597f82b2235037e2c4fdea579045609abb45681cc406aa992b00e9ee59f1236803fe22d94ea4a9c2d17fc327f1e2480ac7c9cb81942a7a3eddb67b2d8ab779e48f036de52eff"}) [ 488.699923] binder: 707:711 Acquire 1 refcount change on invalid ref 0 ret -22 [ 488.712381] binder: 707:730 unknown command 1161511182 [ 488.726092] binder: BINDER_SET_CONTEXT_MGR already set [ 488.736581] binder: 707:730 ioctl c0306201 20008fd0 returned -22 [ 488.742033] binder: 724:736 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 18:20:20 executing program 0: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) flistxattr(r0, &(0x7f0000000000)=""/199, 0xc7) pipe2(&(0x7f0000000540)={0xffffffffffffffff}, 0x84800) r2 = syz_genetlink_get_family_id$fou(&(0x7f00000005c0)='fou\x00') sendmsg$FOU_CMD_ADD(r1, &(0x7f0000000680)={&(0x7f0000000580)={0x10, 0x0, 0x0, 0x4040000}, 0xc, &(0x7f0000000640)={&(0x7f0000000600)={0x24, r2, 0x200, 0x70bd27, 0x25dfdbfb, {}, [@FOU_ATTR_TYPE={0x8, 0x4, 0x3}, @FOU_ATTR_IPPROTO={0x8}]}, 0x24}, 0x1, 0x0, 0x0, 0x4800}, 0x20000040) request_key(&(0x7f00000004c0)='user\x00', &(0x7f0000000380)={'syz'}, &(0x7f00000001c0)="3fcb00faffffff00", 0x0) 18:20:20 executing program 5: r0 = request_key(&(0x7f00000004c0)='user\x00', &(0x7f0000000380)={'syz'}, &(0x7f00000001c0)="3fcb00faffffff00", 0x0) add_key$keyring(&(0x7f0000000000)='keyring\x00', &(0x7f0000000040)={'syz', 0x1}, 0x0, 0x0, r0) [ 488.754386] binder: 724:736 Release 1 refcount change on invalid ref 0 ret -22 [ 488.760907] binder: 724:728 ioctl 40046207 0 returned -16 18:20:20 executing program 3: r0 = socket$netlink(0x10, 0x3, 0x4) writev(r0, &(0x7f0000000000)=[{&(0x7f0000000200)="580000001400192340834b80040d8c5602067fffffff81000000000000dca87086a5c000004f6400940005891550f4a8000000006700008000f0fffeffff09000080fff5dd00000010000100000c0900fcff0000040e05a5", 0x58}], 0x1) r1 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000080)='IPVS\x00') sendmsg$IPVS_CMD_GET_SERVICE(r0, &(0x7f00000002c0)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x900040}, 0xc, &(0x7f0000000280)={&(0x7f00000001c0)={0x14, r1, 0x302, 0x70bd2d, 0x25dfdbff}, 0x14}, 0x1, 0x0, 0x0, 0x20000014}, 0xc001) sendmsg$IPVS_CMD_GET_SERVICE(r0, &(0x7f0000000140)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x200000}, 0xc, &(0x7f0000000100)={&(0x7f00000000c0)=ANY=[@ANYBLOB='<\x00\x00\x00', @ANYRES16=r1, @ANYBLOB="02002dbd090000000000000000002800030008000300030000001400020062726964676565736c6176655f300000080007004e200000"], 0x3c}, 0x1, 0x0, 0x0, 0x10}, 0x1) ioctl$EVIOCGSND(r0, 0x8040451a, &(0x7f0000000300)=""/251) 18:20:20 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000300)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, &(0x7f0000012fc7)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, &(0x7f0000000f4d)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x8, 0x0, &(0x7f0000000140)=[@release], 0x0, 0x0, &(0x7f0000000340)}) write$P9_RATTACH(r0, &(0x7f0000000000)={0x14, 0x69, 0x2, {0x8a, 0x3}}, 0x14) 18:20:20 executing program 4: r0 = syz_open_dev$binder(&(0x7f00000002c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000300)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, &(0x7f0000012fc7)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, &(0x7f0000000f4d)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000000c0)={0x8, 0x0, &(0x7f0000000140)=[@release], 0x0, 0x0, &(0x7f0000000340)}) ioctl$FS_IOC_GET_ENCRYPTION_PWSALT(r1, 0x40106614, &(0x7f0000000000)={0x0, @aes256}) 18:20:20 executing program 2: socket$netlink(0x10, 0x3, 0x4) 18:20:20 executing program 5: r0 = inotify_init() fchdir(r0) request_key(&(0x7f00000004c0)='user\x00', &(0x7f0000000380)={'syz'}, &(0x7f00000001c0)="3fcb00faffffff00", 0x0) 18:20:21 executing program 2: r0 = socket$netlink(0x10, 0x3, 0x4) writev(r0, &(0x7f0000000000)=[{&(0x7f0000000040)="580000001400192340834b80040d8c5602067fffffff81000000000000dca87086a5c000004f6400940005891550f4a8000000006700008000f0fffeffff09000080fff5dd00000010000100000c0900fcff0000040e05a5", 0x58}], 0x11f) [ 488.893004] binder: 753:764 Acquire 1 refcount change on invalid ref 0 ret -22 [ 488.898880] binder: 756:765 ioctl 40106614 20000000 returned -22 [ 488.900710] binder: BINDER_SET_CONTEXT_MGR already set [ 488.900718] binder: 756:765 ioctl 40046207 0 returned -16 [ 488.926139] binder: 756:770 ioctl 40106614 20000000 returned -22 18:20:21 executing program 0: r0 = getpgrp(0x0) capget(&(0x7f0000000000)={0x39980732, r0}, &(0x7f0000000040)={0x80, 0xfffffffffffffe01, 0x0, 0x7, 0x8, 0x5}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) request_key(&(0x7f00000004c0)='user\x00', &(0x7f0000000380)={'syz'}, &(0x7f00000001c0)="3fcb00faffffff00", 0x0) 18:20:21 executing program 5: r0 = add_key$keyring(&(0x7f0000000040)='keyring\x00', &(0x7f0000000080)={'syz', 0x0}, 0x0, 0x0, 0xfffffffffffffffa) keyctl$assume_authority(0x10, r0) r1 = request_key(&(0x7f00000004c0)='user\x00', &(0x7f0000000380)={'syz', 0x1}, &(0x7f00000001c0)="3fcb00faffffff00", r0) request_key(&(0x7f0000000000)='syzkaller\x00', &(0x7f0000000100)={'syz', 0x3}, &(0x7f00000000c0)=']systemf\x00', r1) r2 = dup3(0xffffffffffffff9c, 0xffffffffffffffff, 0x80000) ioctl$KDADDIO(r2, 0x4b34, 0x28) 18:20:21 executing program 4: r0 = syz_open_dev$binder(&(0x7f00000002c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000300)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0xffffffffffffff5c, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="0563044000000080"], 0x3e7, 0x0, &(0x7f00000001c0)="f6e7268fa220bad54315cd236213f2879230"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000040)={0x8, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0d630c4010000002"], 0x0, 0x0, &(0x7f0000000f4d)}) r2 = openat$selinux_policy(0xffffffffffffff9c, &(0x7f0000000080)='/selinux/policy\x00', 0x0, 0x0) setsockopt$IP_VS_SO_SET_STARTDAEMON(r2, 0x0, 0x48b, &(0x7f0000000100)={0x3, 'teql0\x00', 0x3}, 0x18) setsockopt$inet6_opts(r2, 0x29, 0x36, &(0x7f0000000140)=@dstopts={0x25b43b4755503629, 0x6, [], [@pad1, @enc_lim={0x4, 0x1, 0xfff}, @calipso={0x7, 0x20, {0x100000001, 0x6, 0x8, 0x6, [0x3ff, 0x80000001, 0xfffffffffffffffe]}}, @jumbo={0xc2, 0x4, 0x1}, @padn={0x1, 0x5, [0x0, 0x0, 0x0, 0x0, 0x0]}]}, 0x40) r3 = dup(r1) ioctl$FS_IOC_GET_ENCRYPTION_PWSALT(r3, 0x40106614, &(0x7f0000000180)={0x0, @aes256}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000000c0)={0x8, 0x0, &(0x7f0000000340)=ANY=[@ANYBLOB="090060350b310000985edaf2eff281fa94d91d41dd80877bf9abaabde4ef1752169945c931b6eea0f28da3d4eee59108ee3e6e1ff288aac479cda68d0ac1e1fed63b1f2c9153c365ba6dce4ca0127328257283e6ec02f5dee919cb1b4b84cbd849c7adcd3d8c150643558f1b9c46a2d84d9ab4d7bd9c919f5401b403acc11ec171d6b9a2e29baf745cc8c00de3dc8e22e15a157df8207c30fa9099f412f44ba5fb61e2caeaea0e716805721e0cf331e2cca1228b26a064bacd8f38ad106920"], 0x1a4, 0x0, &(0x7f0000000340)}) 18:20:21 executing program 3: r0 = socket$netlink(0x10, 0x3, 0x4) writev(r0, &(0x7f0000000000)=[{&(0x7f0000000200)="580000001400192340834b80040d8c5602067fffffff81000000000000dca87086a5c000004f6400940005891550f4a8000000006700008000f0fffeffff09000080fff5dd00000010000100000c0900fcff0000040e05a5", 0x58}], 0x1) write$cgroup_type(r0, &(0x7f0000000040)='threaded\x00', 0x9) io_setup(0xff, &(0x7f0000000080)=0x0) r2 = openat$selinux_mls(0xffffffffffffff9c, &(0x7f00000001c0)='/selinux/mls\x00', 0x0, 0x0) r3 = openat$selinux_status(0xffffffffffffff9c, &(0x7f0000000300)='/selinux/status\x00', 0x0, 0x0) r4 = openat$selinux_avc_cache_threshold(0xffffffffffffff9c, &(0x7f0000000480)='/selinux/avc/cache_threshold\x00', 0x2, 0x0) r5 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000580)='/dev/vga_arbiter\x00', 0x2, 0x0) r6 = eventfd(0x8) r7 = openat$full(0xffffffffffffff9c, &(0x7f0000000880)='/dev/full\x00', 0x201, 0x0) r8 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000001900)='cpuset.memory_pressure\x00', 0x0, 0x0) io_submit(r1, 0x9, &(0x7f0000001980)=[&(0x7f0000000280)={0x0, 0x0, 0x0, 0x0, 0xfffffffffffff001, r0, &(0x7f00000000c0)="525c336ca5d1cd92be7d83faa132c9b02dfdbce101a792a55c39b247c6414fc104ffd7325300b99b33e281da43c8096878259b0258fa57b16737bc202e64eeef2f6fd29c29065098926b9d4e226ab350be26df01436f7b160916c129b92c7030bcc9b86f59bb6330528f530f47b417a2edae6686e47148fc09d1c873c11033513556dfbf847e1720756285e26139320109c092da9258d4d860805e6be9cdd6a86282f379a9e3e0f2fb4486300613824cb13b48c0b9c7e36e3225b2f244044214198a9f9a8a30932bed04a2", 0xcb, 0x7, 0x0, 0x1, r2}, &(0x7f0000000340)={0x0, 0x0, 0x0, 0x1, 0x3ff, r0, &(0x7f00000002c0)="6673362c0a00a7084bb3f1b4be3c332825d3b9a816780544441ed75816993503f3ad96592c7f70b46eca5ebe52bc9524963d08", 0x33, 0x2, 0x0, 0x0, r3}, &(0x7f00000004c0)={0x0, 0x0, 0x0, 0x3, 0xbd80, r0, &(0x7f0000000380)="5a99f7644ec7e67d854284a2065a1cff311116728e294806e85e342c7e1f934b7e8ff08e9e86914eda62be6bf5749d44e6683c09a2d699c377eb5b413e1c100b285bafa2d3ba093fb7d9b5298ddcf254c5af472c3f78ab57b50d9a3eb675274748229a2e97ac740a10d431c6f26326511cc44c04b1b566688fd12b29d3e8ba41158d74eb8781b848ce785ae4a24bde0ca5baeb9b4b99ffe8f5fab7ca1e1739f1fcb62b2f650f70a0122f827a1aaa6a520238067e2cdb8b8a398d1c6b982452fd533a590214734ccf8aa55e597bd7b79d0d322ac3f24d1914da5582e64bb992", 0xdf, 0x101, 0x0, 0x2, r4}, &(0x7f00000005c0)={0x0, 0x0, 0x0, 0x7, 0x9, r0, &(0x7f0000000500)="7da156dff1c5d426a889466706ee36e3133091590138da64ce7bb7411f8b7674c2a574ca846e4adf33fa1699a7dcb8261f525dfcac8cac6f9f2e23f3369c70b2bbb6ec05ea67143cf6d6525eabcddd1c81e51a73a1", 0x55, 0x10001, 0x0, 0x1, r5}, &(0x7f0000000680)={0x0, 0x0, 0x0, 0x0, 0x1, r0, &(0x7f0000000600)="7930db1bf0201aebf2efac909782d88d05730a71c999e2617e381a9cd2e3033bda716cf30144d7492357645b125dda10cb5bcf1817086b5c3cac80506cf20576be09f868447873afe0", 0x49, 0x2, 0x0, 0x2, r6}, &(0x7f0000000700)={0x0, 0x0, 0x0, 0x0, 0x3, r0, &(0x7f00000006c0), 0x0, 0x200, 0x0, 0x2, 0xffffffffffffff9c}, &(0x7f0000000800)={0x0, 0x0, 0x0, 0x6, 0x400, r0, &(0x7f0000000740)="0fdf4411fc173839475bc4e7ecece5cb5eb86478db618b3e6f8187a1fde83d78c5da67c57a8f2bc2f08b29a8969e4557b1bde514ed4513390cceee25e57ef238a89d86b7acbd3d19c07cca31e94f3144a9b2bdbb1a94de8fe9bc8fe944ec1f86fc33823aee2ddcf60a25613fb36a05cf138ba839a374c117cd67ba72f25a67ac42126f675a2574f75720245f6a8895e700c129f652de85e0678df07700bfe230db0ccee8b5f4239f9b4826c52e92a50e957bab", 0xb3, 0x7ff, 0x0, 0x2, 0xffffffffffffff9c}, &(0x7f00000008c0)={0x0, 0x0, 0x0, 0xf, 0x40000000000, r0, &(0x7f0000000840), 0x0, 0x6, 0x0, 0x0, r7}, &(0x7f0000001940)={0x0, 0x0, 0x0, 0x8, 0xca, r0, &(0x7f0000000900)="cc81b39ec107635d6573a6f791783d0ced2fa5a280e4c3807f57417e9252e3b2adc71ff26b12a6e9429d06f8cd2363c27fdbdc57ea51eb11aaf26bd8e8a799a72936dbc06138a4cad1bf6a6f2b5ef29e89b44da4507aa092e39ae8857f373140ce9e60ff0d3df14309ebe0e6cd330c8b126fdb0ac1452f857ae940dd64bf0a3ab7bb41ec456a9d8e42ea592feb36da72db85f760a546e03d28080e36dd9a17a97d210bf63504872ee51d2cee4f389c1e79f66267d31f26b25f2c9383d23f2081629966afde4a3949dc9ccaeb6c4c92402bfd16dfbed0b8c30217159ddb36ed92af5f9fd80663e9866e2393059d294ed5a4d76d924cdb771f28d7319e2696c02729c3519e99626b177b5ae0f1bcf9d2b83c2a5cc4691cd67b746ede03333ef88d78e0351c608adc2bc5f8caf15f77555bf2a72cdbec63e76655bed2d99b69c29b98c9e053faac1f2641e8af36e9346874a1db5d978abeb522761286c495ff5b268d0006cb575f59e5a3e0b121bfc692f627bb8a45ca6bf655bce44d6b243db5942c105718838620964bf4796c9f544b33e34d598744f62882a22f306c68f704c998c103e9984de366f5d5c54c4f9e17e1da67703c3bdeb744ea00b10a7e39f52c07bee281edcf53a9ec4e5a707adc6582c016046c7ef1d5e28380118c0339b34db31e587e8c01e3272a5c3c8a95335712f119e735bf0625127cc10219e504b63e4da4974fc227e84508decc553ec2dfe6ec5756f6ad2edd16c25653e1c8bb448bdafdcf6313ad23fd4899118817e613c026076d692acb09dfa4dea20493a484aaf0f7ef94489bc226b69365307e26bfa3e9fb88d1521e27352fe98151a4455f34f555791f9fed1c1b951d09183cd20b495633a387b01ae0d83de55e4374a2783fbe47aef557715538f3c3dc1a8e8800346f0968426a6e98ca88b6cc621438fb746abe0ebabfe8c0f9410c9f5bcb5a968e7ee565536339dfc701dd5b458381dfe6803b677e7a2c22c030cae67f3e8ac4089be3c9a3c61d55cd932c2cbe3084171d3d020349d61c7f17cdddaffcc2ddac8ed2aa7efdc46c3e0c2f39921a25acddd533fc101c3947340a30a9b0515282223034af0b6b6ee9da48729c629e955f43418052063440e778b9b38d41bf2d5afc6f88f0dd8e34cb7025145e37edbf0478c21fc6df73cd1351770338e33f2de27928825d8a3b70bfbbeafee7328cc73f4de9663a992233bd36a38f0fda3d4a77fe9b5f5119e23c7669908974203d573560842a8b4f03128c46a5d007d6bebbcafe6be7ea239a583fd7abf6c59c7883512398fe505c62ef8a95d9b338edb6967cac9c4fc7569979750a370cc8d1355b2781248f85b1bdb3bc1f83a7b2ff1a0c157807a20a8031e97082dea57e350abcf31ef118f3fc4c2ae7b3a0c20c98cb137bb8fa6a9789473ffe9f2247fd4917f4c7a74450d694174aa8d333e1f585e2b83d8eb73da4384bfaf08c1e0ae2b42e8b47ae2aef1730f93bc293c697cd0cdc7bfbe1045884be852616cafb3ac41944f9e0a7b08de16e698f17f39b8151e9cc2017166adb06fb9f7af226ce390552c944e421c7cd1aad4d635905c3c9ca3d704ea6263940bd31475011d4f9f9e3f1a2f98e02d8992fb52d905f73b22a9bfc37236af5878b97f579cf1b6cea84730c6a624075ef63d67f6b361a668e3e5cf61b9e43f40d938721ae8117bfc4c3348991fbf5b0a2f2c9e6f5879591a05415e10d076670d757320c61d893955c6906f674bd8555374e5000d8a23fa876a18298c493bd288efa813666bbc2b13c568f6eac040ef022b97952482f00f8e02fe65915728a552529b62af7502a6fd4113c3b086498230ef3a422b2781db1bce9f061f2b84f4f4a0eb8bbf717909026f2c38c3c6192181f065bce95a1a62d98d8e9c0dc22a56f7a5a0cde33d6cd2323d4146b0e79fded4a66eb2235e6affd5778e957a44c67155676d9851c373da1785f2b69d2cf92e8a68c47f2722fc9cb87863ba31efdf6fe8bc976bde9f9018588106288bc3c9c2c144e6a0bc28d20936f2368b33a4ddb68f84cee12f02bf105647570e9bd5aeb2c5b472da9556bb7ba4fd49d72d308fa9110f30bac236bf0261a147553384368ea9a63a6361eee1e3966643fc4b23ebcf13d2172eb59177aea9f3c3efa1c15b65526de57e325f1509c647444450428b1ab40e91012cbbe3a3704a9001bb43cf3aee5abdb73deb470ae17871156471edd9fc51873d50b23fbfb573a1efb1ee6d740683d0a04e6dfca3052328b8e9fb8198c83b68fa20d9441c875962200b4a3c9e9bf51ef2329dba900041859f6244b07b52aee9f371d2672ce07392d17e3ecfa92046ea7d2c0deca0339456c08e4cdb196402b4acc1888f9c4054ca0809cfea5a68c6c37e04c00ec9c07d9fa2ea9d45306081b490985b4b3efcc757532f81f6ea33612f93b764930b4cf2fb2e0386381256d187875fa6640b1b433c5406c620bd22a3fa8383c82dfa251b511ac77a238ef7532591f053a5b09bdda70aa26f2b4ab5414a1dd21747d0828fb3259995f0ac3e9ad0005653cb0156099fed541fad9539d09d00599614fda8c1a8a0e231baccb0617b73d4b7249cd171e7e8514cc7414ee16194b784acb719dd9d3e28edb0e653bea7471bfa9900787e2a03792aea93b46fc08d8d20e8d21f75bef37723ff9ef12767ce674544b7d124154625bbc6f15a8ce1152af3ad72fb7f89b20d0323b45a0bd299fe9516ef0f6fcd2a86976e5d09c9bf9e06ebeb6919dee0d7ca2416e1f01994b6ab619240f711b4508a8a6c19d6df43e7ff035b20b68b5cd1a7e5f34c4190f971572b3eba914fa9985b0ca4c27b1b40aeba4c331c738f0d6e33d6260979ba1fc92313e0867b3b33ecde913cf4d3de03e1bad26cdca2c258dabf7025bacf742269108127ae27e99e5f0b3848c650b175755711cf700e9fd0cd2de3b8be947a9b5f37189876aee016ec3518b06472fac4ed62c69abaf3157e230c4d0bdb13560017263f3356aaddbd4eff84531354392cd99621045f57ccb27a5604359e925560ed4970c4592cbf877a47366eede9aeee95a9ae502620423979b81385b352e1ca41d75ab362f6ad5f4ba06a773a483abc20f7eb482c023818a7161820368872c3e0674af872b27bfeec1206c2a2e71f0bc75465f1a2928cb126954af5ceb8c0c2b5ba56203b94495cdb00679f13932c0e258f33db724ef80027d5261608c52fc8123739d883714d87073e2e209ed04d38248931edb0f41ade2e7a13c1ad86987e9c3d061159a40a25885ca65a591bff07e9cdb39c74911317a1d5435aaf97d848c52bcb2cdac33ae3e7834ea0eb629efe1f276502cd91fffaee5668a7b7b7988cc541087736989a2010923787b12c6d73d22e7e1fc5d66e0346d4f02091ae3439832d61325a58f7aa169a03a97f7f3f65ca835e6e7d2ac56069bc02031f4f6522b35cce4b21a8182a8ab68f54c494b47681d68411cd4083db78296140caf8ef71d82b80fbc09a2c4b91d1f0abe4a659004101501d17f8717f76101195c3da4edd731c991dd2c6a7c2d6e25c4c405ba9e5fdb967d92bab2e0b59de342be92f75c60cba9612dad20c1296bf43731fd284bdcf0e12a2f2525215512b551020b864f3e3962b72d4c2b86b68a8e62da87cca706d9f9826c7e4f0ebdd6e5fe2abfa05706f050c6e2db43aab62ae7a05c5cad886f3015ee79069c0a927bdb9581aa58258212307eb8df8c5dcd97f935d8b95cb7a3797ade529f8f174df80c7e257255ed68463561c37bf74bd0e8f2db6715313a990a4fce140fa39c4c80a52c24dea0a9e9cd32bd51d5d31b195726c66761a14429579f7894e47163b36c7b26a782a94cbacb119dabcaafdd2dafc8c74950415c917f92fe0538d5ca69196179f4e3a074649b1d5a939d77ffbc6bc7eff7f72c8e477217ccf4e2500118aea680f9f2215ebbd586ccacfc8fa69abb4457e7413db96cde802c22502fab338aeef8a0b9296652509f695657e514e3757fe07f73fc43c584997de056173ef00a39ea4e6793f702ab3cfc3cb1131cbec34fd7385d8082affa2d07ebd15b4628098b472daf582fabe3ce9e258ede0c7e755ee582857dda6e15300b8efa8c6f456ed4130d4140457b73da90789242e79d175eb210e463d38a437ffcaad5ac7168251d9cd4e599be8c55bc1d7b47bee115816ab4e24dcd829c601e5e9671d582007fe2a241e1e96d993adf12e21d86736dd6e5f7386d59e76fa1ad0dfb11abe44a7cb2d2e22d93da8f6893b8a495b377340a54f871e7d9fd1c9a82042d40f37d9a7c8bf9e4ed4a57c31456c9e77565f9ad80a4f3ca453a897c2316a3a1b53a472930d0510675395a3b25ee3d35c514e9c85394ac4205492d77675271e8de6fdc76e48fdb1e2360d3748e1576aa4ad245ac15cefeef0805f3d39928cfb6ee91c8b9a2060e692fb9e04e595c5bb50c9385b21d41bd4455fb351f8d0efdc34aaf341f33c660f108d5bb13d1cc5e58ba8143fad3d1af9ad9e8471f74f6460ec8a1ffbd82168971b03b6ac4da0a61d7ee80639b4fc67af9826e09eea24336231752515df016eb5e3b734f95cddfd73d23cea219fab4ba5b9e998de7131831b27135d46c79540a6a8d5ac22da4037188f25d7ccd3d571ae714672de4df36a7c7483100f7d93678d61190c3ca4e57d3da005c0cd5c142f35a853273af638deaad58d9186629a64b757492f4558dc0c16e519267f7f1f81aa147d2cadace23f3750b907e032acc8990e379aec994c2e60e5fdd2b473dd486d34ab2a8458b5b0a58fa4ceaf45396c8f11067c0c85a66d4cc45942b84fef9ed50a6e825bfcf857face5b7c60fa016e1776ebc4d86bff66455a95f92aa9e1345d4ed4b9a3fac4eadb470f9714e34bd20162ed1ebf25c7032f721e560c30d5a4ee6f233ea64f2e2f5333334a86c2797f32951b119ecbc4068c40224d0c6bbd69970dc15e265c6d96ed2ca931411ee0dc2fb9ce31501c1a490c4f458d2eccb2b65eecd61e405aca0ad463564c6a1ebda2cff80d2f482a0fdb2ef852a4681618d18c5a4942c24e9adee44b0825c8cb76384d444f2cbad8e756f0834cc47ef4b21dfb8cf5b0196029abcd31936dde3a9c3da47352262326e86c8882982c48957223e706ae096484b99ef2702dd77a8d337b8741da276bd9c554280bef3fa6b9846610d2b9ae3e4defe078a068dbd5b554fff638901244aad0cbb44c1ce8019a44d58e7c09b33b5d830de42c486d576397a316934c0c0295523f8f887b5a5861c32ad291c21a5841b2c272089ea9f02c91cc37da0d28244c04d9801c7b9e6c6ade5dc482487d1a7faba04b3733743038d1bc7a1469729b332243128530e8de7e39da89ce4e30389f708b25965f4165502549d15293825bf0f0e789cc698ff156766d3ae6e8ac196c5d721c942d68737984dec5439f329fa03c1eb1213529c574072bf226dd1d9dfc5bf28e03d0938c043558b6d139188a6997423af3195041a3bc3abefaf62064169154e11ba2a799ebfcff850012eabe4a01f74f0830fb338ebc6923da79051d94a86039b59d6592412e3bcd59f20ef71a5a06c581c6e84af5470f1473554dbf26ea182c6d53fd1aae62dde3c616f65c878bf3f3e1ff0ce134ac04d7c1bdd064c85607cf24571a9f91de523be90ddeaffebf0f86cb5b46f9dfcb76c6966c69251ca3ff97db98dc887dc8f5c4a04720d909d5f10ad1305e1e217d3efb4ede0d7d601dfd9a122c45cc1a503b4d66ecfd660fa2900d43ec5b824af513a8f4914", 0x1000, 0x9, 0x0, 0x1, r8}]) [ 488.954785] binder: 753:775 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 488.981949] binder: 753:775 Release 1 refcount change on invalid ref 0 ret -22 18:20:21 executing program 2: r0 = socket$netlink(0x10, 0x3, 0x4) r1 = openat$selinux_checkreqprot(0xffffffffffffff9c, &(0x7f0000000040)='/selinux/checkreqprot\x00', 0x500, 0x0) ioctl$VT_SETMODE(r1, 0x5602, &(0x7f0000000080)={0x7fffffff, 0xe0000000000, 0x20, 0x401, 0x80000000}) writev(r0, &(0x7f0000000000)=[{&(0x7f0000000200)="580000001400192340834b80040d8c5602067fffffff81000000000000dca87086a5c000004f6400940005891550f4a8000000006700008000f0fffeffff09000080fff5dd00000010000100000c0900fcff0000040e05a5", 0x58}], 0x1) 18:20:21 executing program 5: r0 = add_key$keyring(&(0x7f0000000040)='keyring\x00', &(0x7f0000000080)={'syz', 0x1}, 0x0, 0x0, 0xfffffffffffffff8) request_key(&(0x7f0000000180)="46d33b5892d1dc7c63cab24d684ad1fb1cb5d3a5a276e671034d2c71298f5be684679eed5401c2886dbf3cfd98fa9a87c45f635f4990e761944215d712a1", &(0x7f0000000000)={'syz'}, &(0x7f00000001c0)="3fcb00faffffff00", r0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x0, 0x0) ioctl$FIBMAP(r1, 0x1, &(0x7f0000000100)=0x9) 18:20:21 executing program 0: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000100)='pids.events\x00', 0x0, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x2400, 0x9968) request_key(&(0x7f00000004c0)='user\x00', &(0x7f0000000380)={'syz'}, &(0x7f0000000200)="3fcb00faffffff00", 0x0) fcntl$getflags(r0, 0x3) r2 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000000)='cpuacct.usage_percpu_user\x00', 0x0, 0x0) readv(r2, &(0x7f0000000800)=[{&(0x7f0000000140)=""/59, 0x3b}, {&(0x7f0000000240)=""/247, 0xf7}, {&(0x7f00000003c0)=""/148, 0x94}, {&(0x7f0000000500)=""/205, 0xcd}, {&(0x7f0000000600)=""/208, 0xd0}, {&(0x7f0000000700)=""/194, 0xc2}], 0x6) ioctl$sock_inet_SIOCRTMSG(r2, 0x890d, &(0x7f0000000080)={0xfe, {0x2, 0x4e20, @rand_addr=0x9}, {0x2, 0x4e21, @broadcast}, {0x2, 0x4e23, @multicast2}, 0x4, 0x1, 0x1f, 0xffffffff80000000, 0x5, &(0x7f0000000040)='bridge0\x00', 0x4, 0x6, 0xc8}) [ 489.037476] binder: 785:787 unknown command 1074553613 [ 489.049764] binder: 753:764 Acquire 1 refcount change on invalid ref 0 ret -22 [ 489.057656] binder: 753:775 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 489.097353] binder: 753:764 Release 1 refcount change on invalid ref 0 ret -22 [ 489.105154] binder: 785:787 ioctl c0306201 20000040 returned -22 [ 489.133199] binder: 785:796 ioctl 40106614 20000180 returned -22 18:20:21 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000300)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) fcntl$getownex(r0, 0x10, &(0x7f0000000080)={0x0, 0x0}) ptrace$peek(0xffffffffffffffff, r1, &(0x7f0000000100)) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, &(0x7f0000012fc7)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, &(0x7f0000000f4d)}) rt_sigreturn() ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x8, 0x0, &(0x7f0000000140)=[@release], 0x0, 0x0, &(0x7f0000000340)}) r2 = openat$selinux_avc_cache_stats(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/avc/cache_stats\x00', 0x0, 0x0) ioctl$sock_inet_SIOCDELRT(r2, 0x890c, &(0x7f0000000180)={0x5, {0x2, 0x4e24, @rand_addr=0x521}, {0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x16}}, {0x2, 0x4e23, @remote}, 0x65, 0x100000000, 0xfff, 0x1, 0xfff, &(0x7f0000000040)='team_slave_1\x00', 0x1, 0x100000000, 0x1}) 18:20:21 executing program 5: r0 = openat$selinux_mls(0xffffffffffffff9c, &(0x7f0000000040)='/selinux/mls\x00', 0x0, 0x0) ioctl$UI_DEV_DESTROY(r0, 0x5502) request_key(&(0x7f00000004c0)='user\x00', &(0x7f0000000380)={'syz'}, &(0x7f00000001c0)="3fcb00faffffff00", 0x0) openat$selinux_policy(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/policy\x00', 0x0, 0x0) 18:20:21 executing program 2: writev(0xffffffffffffffff, &(0x7f0000000000)=[{&(0x7f0000000200)="580000001400192340834b80040d8c5602067fffffff81000000000000dca87086a5c000004f6400940005891550f4a8000000006700008000f0fffeffff09000080fff5dd00000010000100000c0900fcff0000040e05a5", 0x58}], 0x1) r0 = accept4(0xffffffffffffffff, &(0x7f0000000040)=@ipx, &(0x7f00000000c0)=0x80, 0x800) ioctl$sock_inet6_udp_SIOCINQ(r0, 0x541b, &(0x7f0000000100)) 18:20:21 executing program 0: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = dup2(r0, r0) setsockopt$inet_tcp_int(r1, 0x6, 0x0, &(0x7f0000000000)=0xe4c, 0x4) request_key(&(0x7f00000004c0)='user\x00', &(0x7f0000000380)={'syz'}, &(0x7f00000001c0)="3fcb00faffffff00", 0x0) [ 489.147019] binder: 785:787 unknown command 895483913 18:20:21 executing program 3: r0 = socket$netlink(0x10, 0x3, 0x4) writev(r0, &(0x7f0000000000)=[{&(0x7f0000000040)="580000091400192340834b80040d8c5602067fffffec81a440551a000000000070a5c000000900000000057193b6a527648b64036d5b066700008000f0fffefffff2000080fff5dd00000045f19c8c30a1b6f20b6173868efa522e732eb7266997864979372aac489ac828cd249e481df7b7b16268e6421c9799a14a02356a1e919aa2a1c7e03ae63fdc413f7ef34f5874c1c8fdf27afefa7310c4edfc1af66a8a103f5e8584ba4c3aa76dd535761ce63828", 0xb2}], 0x1) [ 489.176159] binder: 785:787 ioctl c0306201 200000c0 returned -22 [ 489.203696] binder: BINDER_SET_CONTEXT_MGR already set [ 489.207430] binder: 785:821 unknown command 1074553613 [ 489.207453] binder: 785:821 ioctl c0306201 20000040 returned -22 18:20:21 executing program 3: r0 = socket$netlink(0x10, 0x3, 0x4) getgid() mprotect(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x8) fadvise64(r0, 0x0, 0x554e, 0x3) writev(r0, &(0x7f0000000000)=[{&(0x7f0000000200)="580000001400192340834b80040d8c5602067fffffff81000000000000dca87086a5c000004f6400940005891550f4a8000000006700008000f0fffeffff09000080fff5dd00000010000100000c0900fcff0000040e05a5", 0x58}], 0x1) r1 = syz_genetlink_get_family_id$fou(&(0x7f0000000280)='fou\x00') setsockopt$netlink_NETLINK_ADD_MEMBERSHIP(r0, 0x10e, 0x1, &(0x7f00000000c0)=0x5, 0x4) sendmsg$FOU_CMD_ADD(r0, &(0x7f0000000140)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f0000000100)={&(0x7f0000000480)=ANY=[@ANYBLOB="34000000a436afe9115065f7578abe6e91f4b6a643bfe381f1120c9f56c71632b6833aaa7e5fe547aac2374428192cce900d2855567da278771137dcdd5c9208a8095303a0779acc40a06109fbd05faf1db84750672f10a41c92148df21e1e67", @ANYRES16=r1, @ANYBLOB="00082dbd7000fbdbdf2501000000080002000a000000080001004e2200002000040002000000080001004e240000c502fcc6dcaac558017bfa8e8d76ec1dd200c1685e1710bdade2123fe1848eff3e2e7ac439addc35a1f41d238c5eb7c0962e3f114168d4a727152efd4e89c1e4386acf6aeda6bcab20f4b44bdde30e21156b07f4a40bedafca741548921908822e0b58ab856cb4f0f73abafae6ed76ba2c0112d81a83d45a47054576e6e196e9e9fcfbc7e933489fdb9b9cdf4ab7998b7ba5d6592495d4dc35a44eb23f292ea7b4ed8e972188239c538209f5b64be00b6d17170c649b84e4829d65608d6259cdc95e6ee735facc49ec02b370503951bb9fb7dccbdad7e5a9e0c1888433263bf1c8dcf0d991bfad9693ec05ade7d18ff7b60b8d95f4c346b2b238fc8ecf43fd62098b43d6595ea346c91115e3ea9c1d9c566eb1d25dae4201e6516768316eab10325c8389724ff367c053a347bfb1347ca9211904"], 0x34}}, 0x80) 18:20:21 executing program 0: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180)) pipe(&(0x7f0000000000)) pipe2(&(0x7f0000000040), 0x84000) r0 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ppp\x00', 0x80, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x4001fd) socket$inet(0x2, 0x3, 0x6) r1 = add_key$keyring(&(0x7f0000000100)='keyring\x00', &(0x7f0000000140)={'syz', 0x2}, 0x0, 0x0, 0xffffffffffffffff) request_key(&(0x7f00000000c0)='user\x00', &(0x7f0000000380)={'syz'}, &(0x7f0000000240)="3fcb00faffffff00", r1) [ 489.207744] binder: 785:796 ioctl 40106614 20000180 returned -22 [ 489.207767] binder: 785:821 unknown command 895483913 [ 489.207774] binder: 785:821 ioctl c0306201 200000c0 returned -22 [ 489.254123] binder: 785:787 ioctl 40046207 0 returned -16 18:20:21 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000300)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, &(0x7f0000012fc7)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, &(0x7f0000000f4d)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x8, 0x0, &(0x7f0000000140)=[@release], 0x0, 0x0, &(0x7f0000000340)}) readahead(r0, 0x9, 0x2) r1 = socket$unix(0x1, 0x5, 0x0) setsockopt$SO_BINDTODEVICE(r1, 0x1, 0x19, &(0x7f0000000000)='irlan0\x00', 0x10) 18:20:21 executing program 5: 18:20:21 executing program 4: r0 = syz_open_dev$binder(&(0x7f00000002c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000300)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="9ba85db89bed4a71488d37308b7581279f35e05a77ff81082fa8a128fa93229c8ce12bf899b538a69fc22e286c5023f97403bbee2a15237ec171f60261075d0b8288aeebd7c596fc89fcf8c65f60900207c13c4c69a8cd43597111c57b1a153dcf069d9f45f9d2083e4cb3910e7b33cc4b56f1bfc14fd9f30fe997bd62340c05b91b2886939ef4bd46b453d49e6729c9502d64"], 0x0, 0x0, &(0x7f0000012fc7)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000000c0)={0x8, 0x0, &(0x7f0000000140)=[@release], 0x0, 0x0, &(0x7f0000000340)}) 18:20:21 executing program 2: r0 = socket$netlink(0x10, 0x3, 0x100004) writev(r0, &(0x7f0000000000)=[{&(0x7f0000000200)="580000001400192340834b80040d8c5602067fffffff81000000000000dca87086a5c000004f6400940005891550f4a8000000006700008000f0fffeffff09000080fff5dd00000010000100000c0900fcff0000040e05a5", 0x58}], 0x1) getpeername$netlink(r0, &(0x7f0000000040), &(0x7f0000000080)=0xc) 18:20:21 executing program 0: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) getitimer(0x0, &(0x7f0000000300)) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) add_key(&(0x7f00000000c0)='pkcs7_test\x00', &(0x7f0000000100)={'syz', 0x3}, &(0x7f0000000140)="f3377317b3bf1271e0db0a20c9be36ac", 0x10, 0xfffffffffffffffe) r1 = add_key(&(0x7f0000000200)='user\x00', &(0x7f0000000240)={'syz', 0x3}, &(0x7f0000000280)="4e2eefcb8690f8", 0x7, 0x0) r2 = fcntl$dupfd(0xffffffffffffffff, 0x406, 0xffffffffffffffff) write$UHID_INPUT2(r2, &(0x7f0000000380)={0xc, 0xd7, "8167f6b995e4e95662830df2fe1645b29131e81a01aa9e7e4e8891ea2a1c9d55d7989d2006d93afb9282a0aee10ec50b5e89e4d6e692bed920e052bde287cc0a0624e21054fd3a0f1bd44bcc92376063ff5c609ba94a9651e25dc8c0e4d4db7205b6614299d88330e8ea52d656ddf404c132bfc0191ac7def3eeaf840597cf9821a80571c5eda66b0cd236b5973606eb8a59b4de7346b9c58cc7fb62ad5e4dbba46db14d4d204fcea3b1a30126ea489c52dc55c591f961dd0948969323e426e108d28188d4d88b1ec4dca65cbe8244b568407c9f8cde3a"}, 0xdd) pipe(&(0x7f0000000340)={0xffffffffffffffff, 0xffffffffffffffff}) write(r4, &(0x7f00000001c0), 0xfffffef3) read(r3, &(0x7f0000000200)=""/250, 0x50c7e3e3) r5 = socket$inet6(0xa, 0x2, 0x0) fadvise64(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x0) r6 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000001440)='cgroup.stat\x00', 0x0, 0x0) ioctl$TUNSETLINK(r6, 0x400454cd, 0x337) getsockopt$inet_int(r3, 0x0, 0xe, &(0x7f0000000180), &(0x7f00000001c0)=0x4) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000000)={'team_slave_1\x00'}) bind$packet(r4, &(0x7f0000000080), 0x14) write$UHID_DESTROY(0xffffffffffffffff, &(0x7f0000000140), 0x4) connect$inet6(r5, &(0x7f00000000c0)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c) ioctl$TUNSETLINK(0xffffffffffffffff, 0x400454cd, 0x0) sendmmsg(r5, &(0x7f00000092c0), 0x4ff, 0x0) pipe2(&(0x7f0000000100), 0x0) request_key(&(0x7f00000002c0)='user\x00', &(0x7f0000000380)={'syz'}, &(0x7f0000000180)="3fcb00faffffff00", r1) ioctl$sock_SIOCGSKNS(r0, 0x894c, &(0x7f0000000040)=0xffffffffffffffff) [ 489.357974] SELinux: unrecognized netlink message: protocol=4 nlmsg_type=13988 sclass=netlink_tcpdiag_socket [ 489.364010] binder: 839:844 unknown command -1201821541 [ 489.364019] binder: 839:844 ioctl c0306201 20012000 returned -22 [ 489.364089] binder: 839:844 Release 1 refcount change on invalid ref 0 ret -22 [ 489.364690] binder: BINDER_SET_CONTEXT_MGR already set [ 489.364698] binder: 839:844 ioctl 40046207 0 returned -16 [ 489.373248] binder: 839:844 unknown command -1201821541 18:20:21 executing program 4: r0 = syz_open_dev$binder(&(0x7f00000002c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000300)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, &(0x7f0000012fc7)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x4, 0x0, &(0x7f0000000040)=[@register_looper]}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000000c0)={0x8, 0x0, &(0x7f0000000140)=[@release], 0x0, 0x0, &(0x7f0000000340)}) 18:20:21 executing program 2: r0 = socket$netlink(0x10, 0x3, 0x15) writev(r0, &(0x7f0000000000)=[{&(0x7f0000000200)="580000001400192340834b80040d8c5602067fffffff81000000000000dca87086a5c000004f6400940005891550f4a8000000006700008000f0fffeffff09000080fff5dd00000010000100000c0900fcff0000040e05a5", 0x58}], 0x1) 18:20:21 executing program 5: request_key(&(0x7f00000004c0)='user\x00', &(0x7f0000000380)={'syz'}, &(0x7f00000001c0)="3fcb00faffffff00", 0x0) lgetxattr(&(0x7f0000000000)='./file0\x00', &(0x7f0000000040)=@known='system.sockprotoname\x00', &(0x7f0000000080)=""/51, 0x33) [ 489.373256] binder: 839:844 ioctl c0306201 20012000 returned -22 [ 489.373304] binder: 839:847 Release 1 refcount change on invalid ref 0 ret -22 [ 489.425232] binder: 850:852 ERROR: BC_REGISTER_LOOPER called without request 18:20:21 executing program 5: getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000080)={0x0}, &(0x7f00000000c0)=0xc) sched_getparam(r0, &(0x7f0000000100)) r1 = add_key$keyring(&(0x7f0000000000)='keyring\x00', &(0x7f0000000040)={'syz', 0x1}, 0x0, 0x0, 0xfffffffffffffffd) keyctl$set_timeout(0xf, r1, 0x6) request_key(&(0x7f00000004c0)='user\x00', &(0x7f0000000380)={'syz'}, &(0x7f00000001c0)="3fcb00faffffff00", 0x0) 18:20:21 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000300)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440000000e607d31e8a591a00"], 0x0, 0x0, &(0x7f0000012fc7)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=ANY=[@ANYBLOB], 0x0, 0x0, &(0x7f0000000f4d)}) r1 = dup3(r0, r0, 0x80000) setsockopt$ARPT_SO_SET_REPLACE(r1, 0x0, 0x60, &(0x7f0000000340)={'filter\x00', 0x7, 0x4, 0x480, 0x0, 0x0, 0x0, 0x398, 0x398, 0x398, 0x4, &(0x7f0000000000), {[{{@uncond, 0xf0, 0x140}, @mangle={0x50, 'mangle\x00', 0x0, {@empty, @mac=@local, @remote, @remote, 0xc, 0xffffffff}}}, {{@uncond, 0xf0, 0x140}, @mangle={0x50, 'mangle\x00', 0x0, {@empty, @empty, @multicast1, @multicast2, 0x1, 0xffffffff}}}, {{@uncond, 0xf0, 0x118}, @unspec=@NFQUEUE3={0x28, 'NFQUEUE\x00', 0x3, {0x1, 0x4, 0x2}}}], {{[], 0xc0, 0xe8}, {0x28}}}}, 0x4d0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x8, 0x0, &(0x7f0000000140)=[@release], 0x0, 0x0, &(0x7f0000000340)}) openat$cgroup_procs(r1, &(0x7f0000000080)='tasks\x00', 0x2, 0x0) ioctl$KDGKBMETA(r1, 0x4b62, &(0x7f0000000100)) [ 489.456846] binder: BINDER_SET_CONTEXT_MGR already set [ 489.469970] binder: 850:852 ioctl 40046207 0 returned -16 [ 489.474121] binder: 850:863 ERROR: BC_REGISTER_LOOPER called without request [ 489.512878] binder: 865:868 Acquire 1 refcount change on invalid ref -436207616 ret -22 [ 489.529104] binder: 865:868 unknown command 0 [ 489.539864] binder: 865:868 ioctl c0306201 20008fd0 returned -22 18:20:21 executing program 3: r0 = socket$netlink(0x10, 0x3, 0x17) writev(r0, &(0x7f0000000000)=[{&(0x7f0000000200)="580000001400192340834b80040d8c5602067fffffff81000000000000dca87086a5c000004f6400940005891550f4a8000000006700008000f0fffeffff09000080fff5dd00000010000100000c0900fcff0000040e05a5", 0x58}], 0x1) r1 = openat$selinux_checkreqprot(0xffffffffffffff9c, &(0x7f0000000040)='/selinux/checkreqprot\x00', 0x1, 0x0) setsockopt$netlink_NETLINK_LISTEN_ALL_NSID(r1, 0x10e, 0x8, &(0x7f0000000140)=0x40, 0x4) sendto$unix(r1, &(0x7f0000000080)="77addc227606", 0x6, 0x20000000, &(0x7f00000000c0)=@file={0x1, './file0\x00'}, 0x6e) 18:20:21 executing program 4: r0 = syz_open_dev$binder(&(0x7f00000002c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000300)='/dev/binder#\x00', 0x0, 0x2000000000000802) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="00000000000000005a93933621fd9cff3def97203ee78723b993420720ee2c57167b48ea98a792a276d1811c7ed2c6d4ef25fb0de290e1728f6f898e3dff"], 0x0, 0x0, &(0x7f0000012fc7)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, &(0x7f0000000f4d)}) ioctl$sock_SIOCGPGRP(0xffffffffffffffff, 0x8904, &(0x7f0000000040)=0x0) r3 = fcntl$getown(r1, 0x9) rt_tgsigqueueinfo(r2, r3, 0x18, &(0x7f0000000080)={0x26, 0x8, 0x3, 0x3}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000000c0)={0x8, 0x0, &(0x7f0000000140)=[@release], 0x0, 0x0, &(0x7f0000000340)}) 18:20:21 executing program 2: r0 = socket$netlink(0x10, 0x3, 0x8) writev(r0, &(0x7f0000000000)=[{&(0x7f0000000200)="580000001400192340834b80040d8c5602067fffffff81000000000000dca87086a5c000004f6400940005891550f4a8000000006700008000f0fffeffff09000080fff5dd00000010000100000c0900fcff0000040e05a5", 0x58}], 0x1) setsockopt$netlink_NETLINK_DROP_MEMBERSHIP(r0, 0x10e, 0x2, &(0x7f0000000040)=0x10, 0x4) r1 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000100)='IPVS\x00') sendmsg$IPVS_CMD_GET_INFO(r0, &(0x7f0000000280)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f00000001c0)={&(0x7f0000000140)={0x48, r1, 0x0, 0x70bd2a, 0x25dfdbff, {}, [@IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5, 0x80}, @IPVS_CMD_ATTR_SERVICE={0x18, 0x1, [@IPVS_SVC_ATTR_ADDR={0x14, 0x3, @ipv4=@dev={0xac, 0x14, 0x14, 0x12}}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5, 0x2}, @IPVS_CMD_ATTR_DEST={0xc, 0x2, [@IPVS_DEST_ATTR_U_THRESH={0x8, 0x5, 0x9}]}]}, 0x48}, 0x1, 0x0, 0x0, 0x20000000}, 0xc0c0) setsockopt$netlink_NETLINK_NO_ENOBUFS(r0, 0x10e, 0x5, &(0x7f0000000080)=0x8, 0x4) 18:20:21 executing program 5: request_key(&(0x7f00000004c0)='user\x00', &(0x7f0000000380)={'syz'}, &(0x7f00000001c0)="3fcb00faffffff00", 0x0) r0 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$TIOCGPGRP(0xffffffffffffff9c, 0x540f, &(0x7f0000000000)=0x0) ioctl$sock_SIOCSPGRP(r0, 0x8902, &(0x7f0000000040)=r1) [ 489.591561] binder: 865:868 Release 1 refcount change on invalid ref 0 ret -22 [ 489.616687] binder: 865:879 unknown command 0 [ 489.617032] binder: 865:868 Acquire 1 refcount change on invalid ref -436207616 ret -22 18:20:21 executing program 5: request_key(&(0x7f00000004c0)='user\x00', &(0x7f0000000380)={'syz'}, &(0x7f00000001c0)="3fcb00faffffff00", 0x0) getsockopt$inet_IP_IPSEC_POLICY(0xffffffffffffff9c, 0x0, 0x10, &(0x7f0000000000)={{{@in6=@mcast1, @in6=@local, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@dev}, 0x0, @in=@multicast2}}, &(0x7f0000000100)=0xe8) r1 = getuid() setreuid(r0, r1) lstat(&(0x7f0000000180)='./file0\x00', &(0x7f0000000200)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) chown(&(0x7f0000000140)='./file0\x00', r0, r2) 18:20:21 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000300)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, &(0x7f0000012fc7)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, &(0x7f0000000f4d)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x8, 0x0, &(0x7f0000000140)=[@release], 0x0, 0x0, &(0x7f0000000340)}) r1 = gettid() fcntl$setownex(r0, 0xf, &(0x7f0000000000)={0x2, r1}) [ 489.657770] binder: 865:879 ioctl c0306201 20008fd0 returned -22 [ 489.667656] binder: 865:868 Release 1 refcount change on invalid ref 0 ret -22 [ 489.685937] binder: 884:889 unknown command 0 [ 489.734783] binder: 884:902 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 489.738755] binder: 884:889 ioctl c0306201 20012000 returned -22 [ 489.759527] binder: 884:889 Release 1 refcount change on invalid ref 0 ret -22 [ 489.774378] binder: 884:902 unknown command 0 [ 489.779103] binder: BINDER_SET_CONTEXT_MGR already set [ 489.790619] binder: 884:909 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 489.798906] binder: 884:902 ioctl c0306201 20012000 returned -22 [ 489.808979] binder: 884:889 ioctl 40046207 0 returned -16 [ 489.823089] binder: 884:909 Release 1 refcount change on invalid ref 0 ret -22 18:20:22 executing program 0: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = request_key(&(0x7f00000004c0)='user\x00', &(0x7f0000000380)={'syz'}, &(0x7f00000001c0)="3fcb00faffffff00", 0x0) request_key(&(0x7f0000000040)='pkcs7_test\x00', &(0x7f0000000080)={'syz', 0x1}, &(0x7f00000000c0)='{vboxnet0-keyringposix_acl_access\x00', r1) r2 = open(&(0x7f0000000100)='./file0\x00', 0x424402, 0x4) ioctl$BLKPBSZGET(r2, 0x127b, &(0x7f0000000140)) lookup_dcookie(0x3a, &(0x7f0000000000)=""/62, 0x3e) 18:20:22 executing program 5: r0 = request_key(&(0x7f00000000c0)='trusted\x00', &(0x7f0000000100)={'syz', 0x2}, &(0x7f0000000140)='\x00', 0xffffffffffffffff) request_key(&(0x7f0000000000)='encrypted\x00', &(0x7f0000000040)={'syz', 0x3}, &(0x7f0000000080)='bdev([cgroup(cpuset}$%em0vmnet0&$wlan1wlan1,vmnet1\x00', r0) request_key(&(0x7f00000004c0)='user\x00', &(0x7f0000000380)={'syz'}, &(0x7f00000001c0)="3fcb00faffffff00", 0x0) r1 = openat$selinux_policy(0xffffffffffffff9c, &(0x7f0000000180)='/selinux/policy\x00', 0x0, 0x0) ioctl$RTC_EPOCH_READ(r1, 0x8008700d, &(0x7f0000000200)) lgetxattr(&(0x7f0000000240)='./file0\x00', &(0x7f0000000280)=@random={'trusted.', '\\\x00'}, &(0x7f00000002c0)=""/40, 0x28) ioctl$sock_inet_SIOCSIFADDR(r1, 0x8916, &(0x7f0000000300)={'gretap0\x00', {0x2, 0x4e22}}) 18:20:22 executing program 3: r0 = socket$netlink(0x10, 0x3, 0x4001) writev(r0, &(0x7f0000000000)=[{&(0x7f0000000200)="580000001400192340834b80040d8c5602067fffffff81000000000000dca87086a5c000004f6400940005891550f4a8000000006700008000f0fffeffff09000080fff5dd00000010000100000c0900fcff0000040e05a5", 0x58}], 0x1) setsockopt$netlink_NETLINK_TX_RING(0xffffffffffffff9c, 0x10e, 0x7, &(0x7f0000000040)={0x4, 0x9, 0x7, 0x1}, 0x10) get_thread_area(&(0x7f0000000080)={0x3, 0x20101800, 0xffffffffffffffff, 0x9, 0x4, 0x3f, 0x0, 0xfffffffffffffc00, 0x1, 0x3}) 18:20:22 executing program 2: r0 = socket$netlink(0x10, 0x3, 0x4) pipe2(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}, 0x800) ioctl$EXT4_IOC_ALLOC_DA_BLKS(r1, 0x660c) ioctl$UI_SET_PHYS(r1, 0x4008556c, &(0x7f0000000080)="73797a3182") writev(r0, &(0x7f0000000000)=[{&(0x7f0000000200)="580000001400192340834b80040d8c5602067fffffff81000000000000dca87086a5c000004f6400940005891550f4a8000000006700008000f0fffeffff09000080fff5dd00000010000100000c0900fcff0000040e05a5", 0x58}], 0x1) ioctl$EVIOCGVERSION(r2, 0x80044501, &(0x7f00000000c0)=""/188) setsockopt$IP_VS_SO_SET_FLUSH(r2, 0x0, 0x485, 0x0, 0x0) socket$netlink(0x10, 0x3, 0xa) 18:20:22 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000300)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000005fd4)=ANY=[@ANYBLOB="05630440004b7f00"], 0x0, 0x0, &(0x7f0000012fc7)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, &(0x7f0000000f4d)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x8, 0x0, &(0x7f0000000140)=[@release], 0x0, 0x0, &(0x7f0000000340)}) 18:20:22 executing program 4: r0 = syz_open_dev$binder(&(0x7f00000002c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000300)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = openat$null(0xffffffffffffff9c, &(0x7f0000000000)='/dev/null\x00', 0x1, 0x0) ioctl$EVIOCSFF(r2, 0x40304580, &(0x7f0000000040)={0x51, 0x2, 0x5, {0x10001, 0x200}, {0x7ff, 0x9}, @ramp={0xfff, 0x0, {0xff, 0xfffffffffffffff7, 0x3, 0x1}}}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, &(0x7f0000012fc7)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, &(0x7f0000000f4d)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000000c0)={0x8, 0x0, &(0x7f0000000140)=[@release], 0x0, 0x0, &(0x7f0000000340)}) 18:20:22 executing program 3: r0 = socket$netlink(0x10, 0x3, 0x4) writev(r0, &(0x7f0000000000)=[{&(0x7f0000000200)="580000001400192340834b80040d8c5602067fffffff81000000000000dca87086a5c000004f6400940005891550f4a8000000006700008000f0fffeffff09000080fff5dd00000010000100000c0900fcff0000040e05a5", 0x58}], 0x1) r1 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ppp\x00', 0x50002, 0x0) getsockopt$IPT_SO_GET_INFO(r1, 0x0, 0x40, &(0x7f0000000080)={'raw\x00'}, &(0x7f0000000100)=0x54) [ 490.408760] binder: 924:932 Acquire 1 refcount change on invalid ref 8342272 ret -22 [ 490.428683] binder: BINDER_SET_CONTEXT_MGR already set [ 490.434410] binder: 927:939 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 18:20:22 executing program 0: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) request_key(&(0x7f0000000000)='user\x00', &(0x7f0000000380)={'syz'}, &(0x7f00000001c0)="ff00", 0x0) r1 = openat$selinux_mls(0xffffffffffffff9c, &(0x7f0000001980)='/selinux/mls\x00', 0x0, 0x0) getsockopt$inet_mreqn(0xffffffffffffff9c, 0x0, 0x20, &(0x7f00000019c0)={@multicast2, @multicast1, 0x0}, &(0x7f0000001a00)=0xc) setsockopt$inet6_mreq(r1, 0x29, 0x0, &(0x7f0000001a40)={@dev={0xfe, 0x80, [], 0x20}, r2}, 0x14) 18:20:22 executing program 2: r0 = socket$netlink(0x10, 0x3, 0x4) writev(r0, &(0x7f0000000000)=[{&(0x7f0000000200)="580000001400192340834b80040d8c5602067fffffff81000000000000dca87086a5c000004f6400940005891550f4a8000000006700008000f0fffeffff09000080fff5dd00000010000100000c0900fcff0000040e05a5", 0x58}], 0x1) r1 = openat$selinux_status(0xffffffffffffff9c, &(0x7f0000000040)='/selinux/status\x00', 0x0, 0x0) sendmsg$unix(r1, &(0x7f0000001440)={&(0x7f0000000080)=@abs={0x1, 0x0, 0x4e20}, 0x6e, &(0x7f0000001380)=[{&(0x7f0000000280)="3a35df08cc23c13a7369c8fad7e5fe2288a31e34b82854bd5f17efc7895476195cdaf1d360331ec62a9f6b098fea6b5d8afc59ccbfdde1486866f5c9be7bf37276362612aee9f9279466334debf197cf55cbf963a2a1ed31651df6281ab286aa491f068d6daf62ed125b9b2050560aeea1bb872ab3c7aa271b09830f8a0611023906a93f4f912bdf6954a28b038f507a1fcb861835d35b0b4b45084d785bd2e80bab4071bcd009e25495a37dd8ffe0ffd7db56a9e83ec647c1f694ac56968080b2e1874edaf0be9c699d94933a386ed6dd5584944c91120b6dbc5a6abbc926551d5474ff9eba14f0bb6819b652c7cbb471d7980707256ff8e7b2fd1946e346fd8c0f91244a60400c41acd91abb4020bf3033ec78ddb7a91759001c7d7d954443d29258c876983a2862be356e2b1715bb521b43faf720eb2ecfac0a3ee821cf7481092fe215e43e6a41c75b91fb9734cf38ff5583774f5f949a342bbb49e0e698136e4c1f53a6d9bd3c47afbc6bfc96ca7c9f123e670f2f26f12e8185456ed1a1243b8e8f5baf88e2fad0b6512cc24a71063db6236462a922e7f81b76f413c0fc5594e6975054dff980c23c6a9c40dff5044087a9730e271f155822f4dc2d759a9d13352d31a756d1a9f732f51396fe0666ca3f3632af914974730cf969767983e1c800a076734d54a6d406b65e0ff99c53749ef2575e0f7d8bb5d82e1183a0804f7f3d64e8c58c29ffd0380e69a9e47c8ab87477ab898c493fb369cfa94072127a47384ddf9478e7a0a1bc288d76252a4d60e859574923801f1478063cd87f8274b5b5ee0f00008d3cc24245c4144c5d73d35113af0dea14477831807e58516f05180821a7398ad2fd622f02a148036f3b32a20447a76339d52b0e3811e216f2a56d73727186d55ac65d381070b1cb5b9e7d074e6d3df8f148ef9a74cc1f34c0a72d4f650d5e893d891b4607688be315c74ff889383d86451776ea561d23eb28150acdf558d6fc397ab178724be71b1755253de9f5dccf72db2c06bcfb2498370d10098fc85e8efb9d17fe0f89b9f1984e67e13574d27f999aae217e1231f7054793e55ac2614164132f33b12ef282775ca62926a2af0d4e1f937c8fa4ea29975e11064e686a25f5e7d446a30818175068ffdb84dff1a0e6a4fb0b77f2b3cb437fc15f86136c3adee838cbcbcd078df1590cbcbc147ef8e73f3adc88280a11d86d05f89c74f0192cc02092edc19e1782a2f190e6d95050e3d21ae0ac98e68cd50294fa189c82d0c6f80b9a394f279d680de8686a925cb5a507d09b20323f264d65cd601d32aba839b9a381950c01ef6dbffdb1c7b46cf32372b4d690e74f24f683136e4b2f12fbc28cc6335653b3ee67c82748350488fced68fc36bee01c884052e4b599987dbec942917d327f46969f75c4336ef1718076f3b98ef22349b5472d35fe318954ccff5bd719bebff226fb46cf3d5868e98157bc352410dfa38c208b91d35acef880b64552889025a3f08f619d4838fdf9b39968f3cdaf1a829bf819689f52f82c4646baaab26987ec4f1fb71db4b7e423e9c694c067dd4f6d88dc719771a581a0a8f7b8784946320d879b90e17da425003a59df2aef3b2e33b192cadb3f707a5238f1858f426d23be11da35eaed5162bf03f0db7011d612cfa9111dc3d7776a93e9f26849165f357e9d9920b7e0102a1dbfefb1eb24ffed5e70f485c81f58003e3ef086a1b678d9eabe60282618b6f3934bd1ee9bff443869a593d53b99babcdae2c34ba00da66fac7826bd593222d7906f07b8dd064a52b4063dccc52940cd7baf0a913ac1f67e065e7d9625be376f0f9ae476462d36e1ab1b3c0514c5962e6423fc0835a76ff7fabae245c87bc8379d6a5ce24b0e84b5bedbfe9f6a2d10968cf551b0670357690c1bea60fa9d142578c6e0f5dc29c49a7ef197b29c7776182587fcf5c77296cfd2e5e4829abd13548feec88b3507ee305ba4e5ac972fe50e4af6212d25cef85345831991a5601e611b38dcec91073521ee01909c947101bd9c9eeb29a63cdede9fc0031ed97fecf6627b292c44d23e6a46570a9f195355004449800f44d8e59e05e113e616aef8a85122110a674e4f5f65bfc1f4233fb439c35a43dc88d54f6cd6d1b37c3ea62c16717fea94e7c13fe695f9ddf41e7665cd7fca28ab3972124b4121c63a7d8cddadc09f21be67caa846a2fce2910471ee496bd227abaa9c80ead012e3634e49ca1f2b528cf83ef3888b7f3b0cc6fa621346f566adee607d8eca4b5d50c2d3d81e821702e90a3e5a26a01e53481f5e2c2768f17821b70e9ae8b6c1793867f0f4e0609a7c443119d7513a5cf2707655f58b0bd545341a14c52d9121eb0583f5d02ddec1e45f15fbd5e87aef3e9c8131f7584ba861f3879efa8e21710eb9ae504c5524a76232ac91838c4c667c329a8f7e018d9e5a33a1758a054cf1e1e8ec1cbd78553a9e29aaff8006194f97abee2586294ae142a7a04dd5710e703ff5abe274a1743cb435b4ed5ee71e15e8ee7654b610bf0063e834aa47f6bd832f1a94d52ea1838d6e7c13cf386071bc36a68e59d68d1cecb025c375e0a49304022508a9bb6482953cc0c2aaefd5ea9063e81ffd0805a401ee9e2d05e5633404a6f866f91d39a4b5fc1f8af4aacf42d1882a15ec14a59a31219323cb35d82cff9ce96ede969c3703d5ef68e5457c93d1fd7f4c2c8623458396857ad989cf4cf53e3839f11e2c287631277f29987beb6c1f8a6fb00667bad31295c618523ef595d99e971f451dd1118957cfb062950c1308c05526c6657baca358fa1e27525e314bfecc57a2d3907c67e569a863ba60f0d78e7f1b01cbc34c5ccb4e78f7d34c9c6828504e43e84483be2e38a782f6600f01db891ce4323e1227dddcf1cc3d87df1807c8f641ad733b2a902c07e9b23d158ece33e82a2ee5cd0e7ec0ebb5d76552cf1dbd3d527fde3ffdbb8d11c4400953c5f748485df428dcd9184897fa5babbb43e027c62a1f7724ec8385ee44cbf92ee29a17dd5febb86edea758fd07f6116498c3a8a1cac1653953e0fbee747b7a29e22deedfcde008092a809904662f4ca6b561cd96f6a54e98108ec36e61144e870205339b0564228f241f87fdb763c649bce25d48cf887fbcbc1dd3203ff35d48def9fdc446ae0e493341666a991957854b70b14a0726fff8f1d572d27061ae51a2c154c2e3aea8d5b081f92fd5f4db4cf55a834f49df8da7ab71c7246172c38a39ea5a48a78e90a67645cd3335a3676ec9b02bd57208d9a145d46e5f7d18a40311b29747f8ce4bcd6fcb06b70c35a31efd7aeaf1607f6984f6b87d40f2ce26fdfdbe4243669d6020e79e086282d3b1494871dabde9d130dc128d06a77f197094aaba35ddd6ea20da0c202dcce5024e2848776f457fe27927ebf277915d78b2480b271d7f2ee7ad165e1655dc9208807c4eebd6aa444f7544caec2b88da50c0b08fd55fd59c9ba73d363d94a8d19619f58068ff50d5a91a1eaeaf1432cdfa344e73d1ce72ee69baa150e0e909f96cf3f9324cd894607eb1e4389b26ace62deb5504989c386e4caa957d6baffba1bc56ed89dbb272ef0b25dafd30aa92aac161fbd6650a89b603b39f3c728a1a6256079d29d00a9f6678a019fd45f62fc941b7702e1ed6f23aeeb57df93ff295b2db4aef02de0a3a1a884ab2b3d87469716d257bad7c96ebbc23ccc54f443175143e6b8f264e0d852baa201f4f20458a58e2e3b224d28dbeef28e458b9ee7ed2e506f8889b73b0768a4a254a6a3927167f2217ddf77c5f9a7464af87a5abde2d68c3cb8265c8646ffe0d26abd1eb271a1c9c5b46749633349e6c2c4e5d128425e3860c0391b69b89f513c093c1bc2cd874cac4fb9097465e3b8d18f9c607ac1c28df5ecc121c73983354a20d814bcf5d847395d527202ca5746987db65d1a08ddc33d3a1b6d22e93ddbde5ba2341d91110f04358f3bc77b7d7119b4afa852e61f5700a1ddd34aed91235c070bd1093c90ec09fe5962795504d75c1d35a63af8f4921c703e0e069dd193ae6a6526c1162f7612cecb056a1ede8c35efb34ad07495e4db91bd530ccdfcb49cb7837176893e7d8c9a5798097b414bc5096651c547b2ec050ac6250a800c7c9c9292c284dfceb890a0a3b32baa944d618941570f0334c22411457e26dc019dee8a54022ecd0fc8fc0c840a70bca0c5f2e0d49d94eaaedcde5a4b84e531d05cf493edc64ba033f541ab6bec693727315edccb4ee8911dac2f30d7200ddc540b4b403eb3d990a94db2869f42f9ba17fe16a0123d628616605f0e4c0feca70f5eaad51c8915a7ade9ce3637615a8ca2e85fb1cf8b7eaaba72ae5c3c1f20d4c61f23049f90eb8fb5b29bf7deeaba79c42ccd61051a6198c3501bad1326fbbf5cfff5afa6f810f96bc3476cc9b7c18d72ac4cf64120268b21f4e4eb6c863c990f80e9d5c2bde3fb10abf489081e0ba83e27fe907eac132cbeaee75f276831ffd2db4d54edb5b4c1dbde5307fca3943e3ee7c46c3681fbd00d735780de9456cd5318f89cc6c89da62a0719eee90edcd29e3e6a338ea7197010e671ee7174e2d37752d7e7d2e8f64a68cd0800977450c4345ea27022c5b379f0a38ddb62a6f3d1ebd995f5806db050834f19feb89d29a512af03c5aafc96a02ce605d8d31589f99afa68d3ced4bf144fdc24c647bf43269dd21390b644cb73e00ea9f7519129f9dddee19bcd824905e756c25765b085148da79ebf751a62ae0dbbaf6d19a6144dbf1e5d9585c20049e00cbd6e1f15e152f5e56dbc0cb0f0febc990d52d9eca10f694107ff3a6eb1379a362a642723f1aa0a2945897e25940352215dd25c42fb9cdb8a3f0a6187e8b408b89d40c190bd46d72ee8830b18bea953e84e8105f34165c1dd52299307a81b561042129638a325599908abd7974d339af5a8d731f5ccc9973af5edb5052057ed9d70d9867af0242f3c5c3e39a820b9266dd7ce35a1f46d30c0f13532a7a572229154218e9e51881f4d52d74c9f60f512b7506f7cdf692b42f13957c7c9b9966918f289e353d23acf9ddb4d6163bf5de12e26604b2cf113838265f15701f4ff6921ba15d3cac8412b2cbbbcdaa62356b21697a987638cd92fd8e7dd735eab1bfbc0323eb013503c4bc5be6fd2f84816aa4f0b097dfbcce0a190ca8a351268aed88adf34c4247943e7b8f2c77ab9096bba3892668357f8b7c93d3dd52a69a559c5fe192cbd16cccfc998fb3414d320ac142455a067bd501a36ccce8f7b2c122a7cab551838d780b4120ed39349b982da103b0bae98c2c1b2b6436edb69cb926def9f8ea0e53dae0af185db7489c831eef6d4eca831b87ac2ff7c8139f3fe6a0c878965c471c9d03344f53d27c73e87a2e57a2222c5d55ba49117da19afea458b0c3c96496e49b20769ad34c7fee149ca8ceb07640ec637498d9775ae2667be282af92ecdd4abf13572260298c70a7be5a2f6fd1cbcd79ca42ac1224c1a9b06a6a5cc154036a118af78239e82ca09fed7f2019915443a1cfb26b4998d34820c97f2cf0552c8b1226ac2c53180def09648bd727230c5ee1e4722d954b059b3bee0c27c8ff827086c865f67fca2ff8d17b315656b32d2d1647bde173e80f6151d10a8d18274c64910460fa478cb407c1adec38a0e2f04d9d6ea0519fe0df20af11d003aaf32d29a7cdbebfbccecf10dcee48f3d61eaf3e0da799520904cfc728c3a979425ae48ef0f51f1e80f9c52a2a7cdf4d60a7bc7b33fa200972ed02f6f49ddc3379cb86b68f", 0x1000}, {&(0x7f0000000100)="9c3b1b0ed1dd080a513d83f3b1349425f9ae9cd2f3937680db48ddefefa6675d9c5bf464710d495f2b7647fd9092206635b45406c8c9e76f7188bab0e5fbbf17d987edb8b80296e062b822fafdc6ba0b18b665c83a067f0e48b8c691674ec88f1f20af0e3effdc6293f407fc9c4a5ed28c68882c3f00f7a779855fb9e3f4973ee963f667d1a61076a16176ba3e18c6f47356ff1aa99137347941b56230db0319c8701794e3bc75fb3db00709339b1e6da3ebdeda91ae35992bec2537e2dcea2f7d178b70b76ab4592a1228acb52360929d0e746966794d2985a2", 0xda}, {&(0x7f0000001280)="094028064a5101d1e905", 0xa}, {&(0x7f00000012c0)="d6b98f9461ec0777ab874cd147949ee4343487751a0e43a7899b2495a18dee6357b2d2ba0f8ac752d7d434afd700f55f905dd3614df2dc414b20f0e301c44a5e64659c1f9d30713b", 0x48}, {&(0x7f0000001340)="3986e0bc73", 0x5}], 0x5, &(0x7f0000001400)=[@rights={0x18, 0x1, 0x1, [r0, r0]}], 0x18, 0x44040}, 0x4000000) 18:20:22 executing program 5: r0 = openat$selinux_mls(0xffffffffffffff9c, &(0x7f0000000100)='/selinux/mls\x00', 0x0, 0x0) fcntl$F_GET_FILE_RW_HINT(r0, 0x40d, &(0x7f0000000140)) r1 = creat(&(0x7f0000000040)='./file0\x00', 0x80) ioctl$KDGETKEYCODE(r0, 0x4b4c, &(0x7f0000000080)={0xffffffffffffff38, 0x3}) r2 = openat$selinux_avc_cache_stats(0xffffffffffffff9c, &(0x7f0000000180)='/selinux/avc/cache_stats\x00', 0x0, 0x0) setsockopt$sock_void(r0, 0x1, 0x1b, 0x0, 0x0) request_key(&(0x7f0000000000)='trusted\x00', &(0x7f0000000380)={'syz', 0x1}, &(0x7f0000000280)='\'$vboxnet1vboxnet0,-eth1*#selinux-em1mime_type#\',eth0\x00', 0xfffffffffffffff9) eventfd2(0x9, 0x80001) ioctl$TIOCOUTQ(r2, 0x5411, &(0x7f00000000c0)) ioctl$FS_IOC_RESVSP(r1, 0x40305828, &(0x7f0000000200)={0x0, 0x0, 0x9, 0x100000001}) [ 490.456256] binder: 927:933 ioctl 40046207 0 returned -16 [ 490.474029] binder: 924:942 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 18:20:22 executing program 3: r0 = socket$netlink(0x10, 0x3, 0x4) r1 = openat$selinux_status(0xffffffffffffff9c, &(0x7f0000000040)='/selinux/status\x00', 0x0, 0x0) ioctl$UI_SET_KEYBIT(r1, 0x40045565, 0x23) writev(r0, &(0x7f0000000000)=[{&(0x7f0000000200)="580000001400192340834b80040d8c5602067fffffff81000000000000dca87086a5c000004f6400940005891550f4a8000000006700008000f0fffeffff09000080fff5dd00000010000100000c0900fcff0000040e05a5", 0x58}], 0x1) sendmmsg(r0, &(0x7f00000001c0)=[{{&(0x7f0000000080)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x4e23, @broadcast}, 0x4, 0x4, 0x3}}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000100)="4c0f70f1ff29cf4a732501aa37ebaf1845c3526ab76f8477b03e1c1b9f6fb2a30cce7a9487dffda51f7b1870636da18d8ebe0c0f9f3bee18f7bd719858768ef27930e92fb607b6ba2f93717163ecbfbe82a22e6557f1b1fbc6058c4c613eab602345dc63", 0x64}, {&(0x7f0000000280)="1fd24d4d781da862812097d71f7a9615c70e6053108a9320a36f185a2a090ec3a8fc1d60efaf425500915efc35d8cd535983d3e5f593acccd980a63db5198402342f3e81e096d70ed67a3f49a51120fe1e86839af76a7e2986be18fdec089df06b5784b0b52b47154bb18bbe1d34e820ea8b70d768917f6fc5475f550343fad0c8db8d426320214632207e119807d3628d87bece40474549678067ca6945", 0x9e}, {&(0x7f0000000180)}, {&(0x7f0000000340)="edadfcd805ac0cc1a56da84be94e6d639cbf7da435d32413f2ed01e1a2358dcf758d16a925a27cbde0f950234ba2a371b1596ae54f69b0341207c8791de2c234bd4de08efc6e4d0c75a049b9448d9ab91bb7a78a5b572a8ccc9f45acdadacd76feb17b8895a34dfc5173f1496e174dfc6f3dc628ff77c52f1e69879f246e32a3800c6305cd5e9276b65b5789662333c653c8804d3e01f5a414cc50c0ff9ecaf0adba123a27cce79c5c6a050eb0a60cbf4af85f5f1932f4e28696445a", 0xbc}, {&(0x7f0000000400)="bf7bd8e4be9a2cfb93738e28767177c32afd55e1f968d9cf4c800cf3e70f4de29d24a709a647399e0af1d17c5cc55d81b6256f442b344375d492de488e0a509a7f6ca845802d3e317e9f7dbf6638f148457015f3007cf2394af2bacb9ec7fd704d30d387353446da05043672051686f56826aaaa533d991ce73ad4d505836ba0e9d0a959811baa28e5ebfb8480b78adc076f42af45da0bdf3f0c9e6f932d6a8e45f00667c0cf1eaa95443b23bd5c19f7e8156d631f95641de28431719768ea2fbd5fdddf53b7bd84d4ce5958a097e1dfcafbf79a557efe47c22dbd1212b8fa94a42940873fcfe12f5afc057d4b86052b1752", 0xf2}, {&(0x7f0000000500)="5d6da94a8e430825e0fdf385dcf35ae07fb00a145d1cac0b68e38e034a0ef8882eb287269c8152d1738ed8b2da3faae18ac7d505244e604c6ae333d831d074e327ed76542475d4b08c04df624dfd7d1ba5738d1ae5b3dc66148eea92eaead2cb3e453b1e863d6d2abdbda2fe71b82b3eb207b1", 0x73}], 0x6, 0x0, 0x0, 0x200000d4}, 0x101}], 0x1, 0x800) 18:20:22 executing program 4: r0 = syz_open_dev$binder(&(0x7f00000002c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000300)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, &(0x7f0000012fc7)}) r2 = openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/commit_pending_bools\x00', 0x1, 0x0) ioctl$TUNSETVNETLE(r2, 0x400454dc, &(0x7f0000000040)=0x1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, &(0x7f0000000f4d)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000000c0)={0x8, 0x0, &(0x7f0000000140)=[@release], 0x0, 0x0, &(0x7f0000000340)}) [ 490.500968] binder: 924:932 Release 1 refcount change on invalid ref 0 ret -22 [ 490.529728] binder: 924:942 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 18:20:22 executing program 0: unshare(0x400) r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f00005f5000)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f00001dcf48)={0x2, 0x400000000000003, 0x0, 0x0, 0x2}, 0x10}}, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) request_key(&(0x7f00000004c0)='user\x00', &(0x7f0000000380)={'syz'}, &(0x7f00000001c0)="3fcb00faffffff00", 0x0) pipe(&(0x7f0000000000)={0xffffffffffffffff}) setsockopt$inet_opts(r2, 0x0, 0x9, &(0x7f0000000040)="8660573f90fbe7ff03f7e0ee169a5ebcb164f9e2b1657e0176164e7694aba088d4ade0b72a3a750f004c48065951149334e551f59288056c24bb02665632f390920995f7886dd2dcfdddf3c799d58b2bd1958598cbae92bb3ad77972fd8fac9e0e75428064a173ca27b0919d0a9f95fa0040210ef42949f10cf0fa268a2af23137fd126094302a5cf94c1138447cffcfde48788697423c576f4a524a9cf75c08b6f20d06c8c7315783d656b01810e349121ce38725232d8bb623f16c27c56398632e0f85e93ffab6e84bc88c831b8ca236b76610afec2359b35553f84bbc589c9ee08b70d31544c3342805c6", 0xec) 18:20:22 executing program 2: r0 = socket$netlink(0x10, 0x3, 0x4) writev(r0, &(0x7f0000000000)=[{&(0x7f0000000200)="580000001400192340834b80040d8c5602067fffffff81000000000000dca87086a5c000004f6400940005891550f4a8000000006700008000f0fffeffff09000080fff5dd00000010000100000c0900fcff0000040e05a5", 0x58}], 0x1000000000000348) 18:20:22 executing program 5: request_key(&(0x7f00000004c0)='user\x00', &(0x7f0000000380)={'syz'}, &(0x7f00000001c0)="3fcb00faffffff00", 0x0) r0 = fcntl$dupfd(0xffffffffffffffff, 0x0, 0xffffffffffffff9c) getsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x11, &(0x7f0000000200)={{{@in6=@mcast1, @in=@multicast2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@loopback}, 0x0, @in6=@mcast1}}, &(0x7f0000000100)=0xe8) setsockopt$packet_drop_memb(r0, 0x107, 0x2, &(0x7f0000000140)={r1, 0x1, 0x6, @remote}, 0x10) setsockopt$inet_tcp_TLS_RX(r0, 0x6, 0x2, &(0x7f0000000000), 0x4) r2 = openat$selinux_avc_hash_stats(0xffffffffffffff9c, &(0x7f0000000040)='/selinux/avc/hash_stats\x00', 0x0, 0x0) ioctl$EVIOCGRAB(r2, 0x40044590, &(0x7f0000000080)=0xffff) [ 490.546455] binder: 924:932 Acquire 1 refcount change on invalid ref 8342272 ret -22 18:20:22 executing program 3: r0 = socket$netlink(0x10, 0x3, 0x4) r1 = openat$null(0xffffffffffffff9c, &(0x7f0000000040)='/dev/null\x00', 0x4000, 0x0) clock_gettime(0x0, &(0x7f0000000080)={0x0, 0x0}) fsetxattr$security_smack_transmute(r1, &(0x7f0000000100)='security.SMACK64TRANSMUTE\x00', &(0x7f0000000140)='TRUE', 0x4, 0x1) write$input_event(r1, &(0x7f00000000c0)={{r2, r3/1000+10000}, 0x0, 0x10000, 0x6}, 0x18) writev(r0, &(0x7f0000000000)=[{&(0x7f0000000200)="580000001400192340834b80040d8c5602067fffffff81000000000000dca87086a5c000004f6400940005891550f4a8000000006700008000f0fffeffff09000080fff5dd00000010000100000c0900fcff0000040e05a5", 0x58}], 0x1) 18:20:22 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000300)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000000000), 0x93, 0x0, &(0x7f0000000640)="d4f6f38bbd90e4a2d2104cc39606fc52039245653da67edf13a305ab23673b2fc35e836993e3bf7c53c563d344a7afc938e75d973b3a87a9729a86b90b8722e77ac70a23b9a3332d259d990a62f4f78beb76862b086167e875fde69b33110c7e3b897af29f6ed6607a6aa1e34b75a1ff71ef84abadad6a7515d970b66f06377d02bc15f9e6c0050c031b9f4b5629cd446feebcd59bf4fc360f8716"}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x0, 0x0, &(0x7f000000dff8), 0xef, 0x0, &(0x7f0000000700)="de916ed6452048f09f727b6af9c0a5addafe8fcd5b9ceec821170774624b0d249df98abe7b0cd0ee5bebd4957dfd2b6ee449980000000000400000a0122a3b0d4d642ae3eb32d5421e8f90eb3a5d78e580ab75f5ab9fe23978f3fa068bc848d8b158f9ef920fab123380606569c6670955ef7ec5fb1bd7ca645fe171b30c432788029c7c3f18218e1f2f332c7ab0194b233dc356bf766a1092939309385c42fc7fec1658dc5e4deb188338a534f8d8a51c023957d3f3bbfafcf9cea380639e109cacbb30dac373978027a04ed3ab19059f97f9fdf189283a8b405b638c1609d26a63b33c10747c05b737c989a89080"}) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x8, 0x0, &(0x7f0000000140)=ANY=[@ANYBLOB="0663f74000000000"], 0x0, 0x0, &(0x7f0000000340)}) pwritev(r0, &(0x7f00000005c0)=[{&(0x7f0000000180)="a8b6535e337271b8dd16bcf809f97c5412a32d9414252dc088a4b6a21a6c51a799bc3bdafc95b98d8c9def3c6a95181e0bbeb2e5f1b1f6ff10a0022996fbcb81c283fcb098dd45d196e481543126f8752798df1539ddfbdf6262dfcb1f236c089a360170efc5c1e762c46c01faf19c00256a6e5d3bcac63b6f7f6dba6e184327841ebcc44077e52e40812565f7008465566af05c917fd7bcaf1be11d564695257ec745b4924a5950ad0dfe80c53cd1329429093c2c40d6e450af0fed9ef35806c373e940a7fb8622dc53ba7aac6d2a38d8427f22db69d8cbda", 0xffffffffffffff88}, {&(0x7f0000000f80)="db0057443d4e403a5cec23c81473d576fc0de9b7b451b9d2c2a3ae7e802904763a5fc246df72b0f72bb6770e6dc59e61ba09fc34a84a24d7316d99205c793a7ee34c65a56a93f2eb2f91f192b249b477d325c73b4306c4c097e9199a31050c50a89f4eeb65848587072000cc4ae6137f16d806793f5218e447e66a36d5d99d7137d9e9f0c123da2acd48d412e69b49f112fb3fef18f3e65afe8a64c655fe9ff0ce7c414dca52aede309ca7699572b2d56256a6852931c2516d146ac62a4d6814d18b4c61d010d468dbae06cb7b7d3a2356e90ff91e4847e509e8c226e7c7a984977f6bbf974d7820017b32c5bc19f5571ccb0acb7e20c399d64eb489944d844f55cd8622507abcf950e0f6442846a333a3190599f8be4f3dd5fc9be89d2b2a9cb6e315bcd53eabd41148fb4627ae7c29c6bdbf3fe58f714c9c66426cc80a08fbe5e722140b03689a82b5a93cbac2ea17df02ba9c25e7df0022d8abd51e16a64c5c03825247163866196e8ce7434d40e8c931874ff051a0c92d346c1835bfadc20699b2af2f92b04c57b99f484c92d2a76bb32efc94eeb7ee4ffb095db79d3d635d63a2d9ac54cde2f0b717f063443a0986e79a4d0c7c38a090279bb809979c48d12ed8680826e15b2fb2e500ababa19a3aca0074f9af260e45d78e692d5b485a46c3f1a92f1fb936aacbcf24eb53c8a376347f902905aab3ebc7b6a1442ad3647060f28fea3ae50410bc7cf50bb9b37c50da32dc8c40d64d79289da5600a63f97a393f83603e72e1882e4d48f69cacefd98715a9e6df7bd714e72d4bf5369c1b1c1fc482b3ced0194823881fc08384b4691020fb568a2643045a808388a9e9c5173746f7eb65213ced45a1c049f38da25a46ba37a301e9fa09c7ec0d1148c37b488b7766c2a048cb80a443d9ded32168cc02ce5afa546ae2b9f1dafbc28611b6f3d159989086dae680418dbba66c141088259ee5df701465cc095249f57094e2a8d4d3ffd191033fc091f3e69e1d17b221d7a817bb210b294199e9bbd9491cd87324bbc197d4daf3571aea7404764c5b5586b30a9c167ab7c10e9224238a44961fb8824ae3d8e4da4f93314c14f6ff36ba16e51cc1ac8c52187b83a74373cd84079d3c03ed61a9b2fc80f419229b2dbae389325dcca7237cc94a55350f9f21446e4447acf75eff7c5347ace964eb8eb8e627ea42a37668a767fdad1d6d44d3da82f033707513847724fa9fa8ca2cdd8cdf1dd03fb53aa3f739882e3eec73904385700290754fd5fa43040d14bb8d718a3907cb5df533ede532c3110ce4e6cf074fee17d95e62eeec97632d94beac9df0b8ae6d7e7f6f87fcbe2b16abd24cb871140b78e6fc18d62ed359f1959636595e143024c351725b30742ca928a64bdf1d4cd387d7aa6b6e63e2e1e2354eacf0888ca1214fb04ec22aee6077a21141daaabef75f5f5e6af96b6fd9fff6685d93ca7db9058ec61b787501eb4b3be3b03fd165937fee42a307bb05fe7b2e52e50d084e081135b3136fee898ae921746bf5747ed433617d86dece47986f4088d7439778eed571b2a112eb4409e9f114384fff18d9b6d47c897b7863e4f2b8d620c023b4b4cdbfb14b60fea0c29fffb22e2557c51ea1307d281c2b2686d124db996369cb9b1ae86ff026e9e17050034b57a98ea9fd8a7e2cc64c3508bae2d190689b391770ea6e6484a5f24617e7b63ea772b528ffa559e4a1ac74425fec5f9f5fef13b7cf421be7e513e0f5c06602dd5ab2a2ea8c96e6649a3ddbd4b80687fcc7b3ac201a2e812b144d2854bddca5bc5f62e459e63ab1d58b35426b7c1c1e0e265263d05ddc3fd073cfc574c122f567fd403c9f51b9d61fc95a3907f5d1e958fa6260a80dab3a104dcc4955efba55786fbd812d0ac9a80a8e07c60973ffee98c1c64afb31ded078f83da0ddd9bd92cacc6e634ffb38b849977c627e7655fde8136f0a16fef5788008dc93f4e68b362ba4a4c7c0f0b8ba215afd5d7f94dbc29ae0e808e1f77c6dd8a1a4e6767bbbe0c4fcddd2ad124811476f6d7a318e5ab4eeda108fb5933f2df5946db432b6d8501663421d2a4be05f81e8fccaede6c0b1e21b3451d3f83e5b948798e5fd709ed8d32fa27484ba60b86abcdf56e503d522904ee4eba9b5e98c1a517f709fe6c4ea6ecccf039b38f38ce41a01e48b81519b515a501b92c765b9215c87f46e8228ee6bc798676f4843d858a7a1a31e6557b92cc05b546dc4140b497bfacf65b01d77343818af3430e455a67eb0af2a3724080169f74a224e597af7ccb8f62780151130736b85425b913d3a7163ad79dcd025f05e97eb1d5489fed3c20d7e4dc9b139ad27e4d49d95ed371b88c4e2926f15dd1b39acf3cfd1266bce904987e869b64f2d905467dd1459faf4b76fec7fe5bb44b8079456c08283fab3595ab2831a806eed3ed929686c67bcb7700dd098256eae70d787f7d2f70b92aae2e79c8c8de573df0773f9707429bb83b0b2bf6cce957a7136996d0f9ea2cfa891a6c1c63506207939dd8de8343416526687882a82b755530906e77385a65711890d48fc73379043c410781a3820495acdd1ca545ae1c74e5ada4f36b2642bbe6b87966484683413de6346e103aa79a58657cf876c381a3fe8e438c963b2106af4a6046c07dce167644d50305d002f052c0f2472439f233782d63ce21f9a62b00936d76e9cd23723319b373dd72ba8c82efb14731fb3093410888de148d0fd85e7d119d14cc48e4cd9badafe997a30f9d55652fae7574f11f4da4f98bce5d1f231574dc63c788611266be351f93bcd9230bcd928d91768825c48ef285ee4e8c5930401b7235b9a53159f47e88ab12ceca83f6631674f8053c81054f1ede2015d2896293a28af59774f08478057b0e93f160bd74f20eaf5fa8ac9932128622aaabf1bba3e03d2ceb89627303254e427400e54fa2ebc241aac7716e3705993b4d0f3b3cf3bf332b4f7f1ce5e0a976acfe79dc16d9a39a6f883f8c90dfccb90c5ca25f6f6b54c56a7e60feb7f71bdf0962b6bd93286bea32e3bb87fdf179516218c8d207da69b320aebcfea468526f8f20951ad553dc555fef87f8608fb51e27424c3fd61c59197e8414cbfbdbec69e767b3697fc50f654c6f74423dd28571471fdb2cb7ed310f887c27d791daa2afa1f4356dfd129966269e5a8128837daf80e8f9fae0aa2da13c4906630e6851595007089759670cc0176d300096f190ef67fbc362f27d0e7b77c10a72fee694be7d6b9cc14150ff66c67610ba5c9ca035263439ac88ff2d08ed734d4b432ff88e5199bb790b3dfadb242a53f8df9273de68f0a28aae087132f04221f7186589915176483b21f9dd06da4eb905fdefdac6613618e5e88a2a15a20326185b14131e1e32c52ad21786da1aab1ecf65e041714022038b3d5a5be4fe6f34b309a1737df71ef5d5775d788638064c51f21f8e951b65e91e811d9a5fa69dc5bc5670ca6ca88fb7b9285cdfeacd7d02685882170d6086b223a04032dd7bc2a4494543a28861a9e0cd73ec17234300a99b95b3d458caa29792e4d6efccd859a80e04f606383c13c8ab3222956e447d519f4112f55121be741a246e2355b4e4f8eda0708933ff05413882a0f2736c870ebf7c8ab4e1dda08101ada52877d7e8dcceef7c305d0e493ff73f169093810337cc3dc90e470aaac9fb947d73a47055844877684d969d2384a8fdb47d69382cd327362733a9b723ffbaded474c29e4f3f4d8df35ad96a62a6c66aea98c9655abfbf4a6daa35b8ca3470cec254b3b5940d81d28b2e83f55107433e291cad8fb5d092fa1f3abecb065a22d93680a3d5b71332429b863b8395420fe824b809e7e61a568c1339d6b95adf27147d124a593e6bba5f645110602744455c1c2a65c1274aa24acea514a12a7bf897dd9f37c1f00f4df3e82353895fcd7ce6b13c3fac6052088dba143d7a7843aec79b4c13e259394d6b3d7cecc8e517f3df33c37fb5292736b025e1d053ca220915c3b08aef945ea08a2f2a56e6030e7e24470b4f162279f5526d1bb136083420915cb7dcec977646348f126e4e03422352914d8b11a0561b3a0857a58260967725fc3ff53a32afc21dcae5b11543f5311bce3b4b48bef99bea2e38711d940f2fc587e3863ca295f2df32fbfbdf64433faeb99d78de199ced244669877497ebb54bbf5c1cefa1acf8f873b09c2513417c2ca63d5ae28ecd11122d61e7719c7b2a8a023a5a1d0dfe757aaf2148097e85b14eab572cf567fdd1aa90d5a13273b2819fb7f118d4f5ea5453ce4c9c33a70ff3461053c73e0e51f15d828d3ec9627e4e8a8110e2dd621ca8895816ccbd22216bfb97760980e4b191cf723aed637b18c83412114f4269727c7a52be537a348795e52ce7038b992fe4645e77f4f97d95f3550403e3a8ce207efb589557c50ea3765336cafc4a3e26c75929e0341cc22d769185f6f2700a9e068bc34c46bad3992928187f9c7c48f22c5cc2bcb351965592e634460324157de9081a7b36ba5d9b3e46662b7499747ec3bbdd8a06a6a95fd7bd126e0dce5262044561dcf6bb0940d979c9289449b2d8e3203c1d67b024ce10509178dbaa21dc4b046d06cc5a1862e61512dbafa4dcbd38e324d4ea123def4473935f1cc0f2e9d05cd924db0249b6e0aabc5580dea588d4639e7d07928dc9d929c6c4397e5140a49cd3ce00c40b625673329af8d8e7c8a8cbb32ed0279c5945e91de1cf37fcaf10f62092ab14b7b064d46e87d2668d1bbd4b1f776f8df62d2f737464b8f38ad723dc87b1f154c6ea8ca49143a043fad6be290f860fd018ad7b01af4aad55838b91f4d606a91924c60cba64f5ac2b97414e2c7da39010dcdcbeece8935f20cae97c4b872992b6601489d9f1835c359e1ad04613dba14efe8e3c9afe33180c1fbaa352ce3bd809f8ccb2790aad8fbe247dac1cad176f57417066d5a9be52d6e984e6ae05ed22bba555e9de9becb18aa3bdb6693cee14605948387df8a918523acf9c7bdf20a44e557d9e0e110c3d266de00e16c650a962edff029006c945227bae8148142aa22ad409e68f6721b6b83b6252c20ecb3fad4f35fc68ad8cb806c75d4347fd0b284ead4d97f1404ad73735ce59a1dbd1d51ec739401cd5875cc850d16f7b87bbab069df9634fd74ba2c7558c34b659b67b63c305751dc574111260a350064fcc43320184a91277b8db9217255b143fc37a2431ecfa1ecba438159e13bba0eac12dc4a872c1ebd3ec2ef850bf4ddab37c23105c53698ddde52c1a560d0638db7ba0bff274e16355fa8d5632d713dd430248aa376f6e38600d1d9a4c2af96f58e3c242f06aa88f45463aabc905e1b96ab94ec901484c1e14af00d7088cb5d0d473a871fb978eaea97d328cd10e8b6a05d5c74dae3d3ab07c2eda9f8862357ff3bd1ba2b3c768dbc89b02f7fb5ecebd657beac6e8e45a87f832dbd8948676bfc8cb155810354b1f445d3184b40030682cd71d663de1c12b405d1bda21062b22c6a6d41ec5a7d40c725656025125350df89f4e28d067233a0400c9f407fa1918746a8a76d62978b7a8ce4cf8eb097f13251fe3df9b476db6f446f0c841281b7ba6dad831d496c168a69e1ac5214b5edb185a4f13e1c7f646408cefa9df749bc58cb4c0ea0ae907fac18e2926e1043605ceeb4bb95d6d7680ae034010d1d4dbf9e3fc2b7d603419c33e1c28b4db9a576702f8f4af2faf578112a4770585455168e2fd7fbedd8b123da160d4aee1d8c2d9ac85b296f038228ce1b1894247846159a", 0x10aa}, {&(0x7f0000000340)="01a50a6355dfbecff0d247ed28753146d231aad128a2b71fc8ce20cc4aa9827802cd2b2e664b9bd7f964aefb3aded3b7e9058a343b85caf6c54508c1f98c12572e3cbffd2278d7379ba3f2ce1736019c21dd847eac5b778c1a0d27d59289aba2232c6f68a5bbac905665acc27d3b417c9acc292263460c514563e516c1e5d5e811d2338bdf1db8e36969ad9f75d8bf9af6b24b396eff3666ba690c6d686c350ed1d5517cd81e3443526043af58c081893ef7ff6dd7ee29099ca411a75d2022d4d3e067ffe39899567362ce91bcd5e105d6a6a52e5776621b6c8873b423820bd9d11e19b2b6d419cc7b4d32004d5061ddc024718f012cd8b2aabf811a", 0xfc}, {&(0x7f0000000440)="5a51bd19b88776f07cc296b51a45bfe88173f788916426b86391a0693d7b649a614d7cb99e258c4c55b026eab678df95138c868f0d7856580b5fc5c1bb427465f37062ef74cb0eae9806aefca81e5501ec3b01e8c6bf1022d0bdbefaf10ae9f12dd8986a41075d8bf74206f9fd2c50361a3168d4efebd27935d8bed1a94e2f90c280ef7e1d68375f5891496967e433bc39c72ee5e890b0da5af4cc1bda0ae21aacf574f2125ed45f5c790eb9ecf65c4ec2144308f1bde5be74c3f4f1caf50067efecd6837af9bbbdb8ba349544f85b5d1b894a", 0xd3}, {&(0x7f0000000540)="53a51e68f51a89fe6a59ff4f42bc2f973823b43022762539c8744af651827eba84ceb6c4c50a8bcc9a5e018b51a41da7e4be47c3ed20dd099910693028252498bc77fe99", 0x44}], 0x5, 0x0) 18:20:22 executing program 2: pipe(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$BLKROGET(r0, 0x125e, &(0x7f0000000080)) r1 = socket$netlink(0x10, 0x3, 0x4) writev(r1, &(0x7f0000000000)=[{&(0x7f0000000200)="580000001400192340834b80040d8c5602067fffffff81000000000000dca87086a5c000004f6400940005891550f4a8000000006700008000f0fffeffff09000080fff5dd00000010000100000c0900fcff0000040e05a5", 0x58}], 0x1) 18:20:22 executing program 5: rt_sigreturn() r0 = request_key(&(0x7f0000000040)='logon\x00', &(0x7f0000000080)={'syz', 0x0}, &(0x7f00000000c0)='user\x00', 0xfffffffffffffffd) request_key(&(0x7f0000000100)='user\x00', &(0x7f0000000380)={'syz', 0x2}, &(0x7f0000000000)="3fcb00faffffff00", r0) [ 490.596906] binder: BINDER_SET_CONTEXT_MGR already set [ 490.623499] binder: 959:961 ioctl 40046207 0 returned -16 18:20:22 executing program 4: r0 = syz_open_dev$binder(&(0x7f00000002c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x8000, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r1, 0xc018620b, &(0x7f00000001c0)={0x0}) r3 = mmap$binder(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x1, 0x60811, r0, 0x5) ioctl$BINDER_GET_NODE_DEBUG_INFO(r1, 0xc018620b, &(0x7f0000000440)={0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000680)={0xe8, 0x0, &(0x7f0000000480)=[@transaction_sg={0x40486311, {{0x4, 0x0, 0x1, 0x0, 0x11, 0x0, 0x0, 0x48, 0x18, &(0x7f0000000200)=[@fd={0x66642a85, 0x0, r0, 0x0, 0x3}, @flat={0x736a2a85, 0x100, r2, 0x4}, @flat={0x776a2a85, 0x100, r3, 0x4}], &(0x7f0000000280)=[0x78, 0x38, 0x38]}, 0x6}}, @request_death={0x400c630e, 0x0, 0x3}, @enter_looper, @enter_looper, @reply={0x40406301, {0x1, 0x0, 0x4, 0x0, 0x11, 0x0, 0x0, 0x60, 0x20, &(0x7f0000000380)=[@ptr={0x70742a85, 0x0, &(0x7f0000000340), 0x1, 0x1, 0x3b}, @fda={0x66646185, 0x1, 0x4, 0x1e}, @fd={0x66642a85, 0x0, r0}], &(0x7f0000000400)=[0x68, 0x38, 0x48, 0x18]}}, @request_death={0x400c630e, 0x0, 0x2}, @release, @release={0x40046306, 0x3}, @acquire_done={0x40106309, r4, 0x4}, @dead_binder_done={0x40086310, 0x1}], 0xd9, 0x0, &(0x7f0000000580)="88de8a272341b8c88de39da40290bc54e826dae19a54dfc9007d4ef3da99ae50721fa9d854804c7b196666f319d6f792e76c0a35b460c1bf567b68005effcaaf5ec088fe8ee7694ff933bd64d94d00921f4ae4a30e1475fbcd9f5165af7b00ce62a55fd9030a0289401ff30f54cdd1bb326d95b58c8ae70000aaa4e1f0b271508d34fa366e0c50a0a81c7cf51401fa6be19e58c3f75ebfaaf48fc0d6143df242a1926bbb6fa6f6453fed0b77e7d9c62a1f12b41d237626814026c60aac20c59150fccb50f2a67ba35ea2f2021267f6237ab351242301868ec1"}) ioctl$TIOCSLCKTRMIOS(r1, 0x5457, &(0x7f0000000040)) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) getsockopt$inet_tcp_TCP_REPAIR_WINDOW(r1, 0x6, 0x1d, &(0x7f0000000080), &(0x7f0000000100)=0x14) ioctl$int_in(r1, 0x0, &(0x7f0000000180)=0x1) r5 = syz_open_dev$binder(&(0x7f0000000300)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, &(0x7f0000012fc7)}) ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, &(0x7f0000000f4d)}) ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f00000000c0)={0x8, 0x0, &(0x7f0000000140)=[@release], 0x0, 0x0, &(0x7f0000000340)}) 18:20:22 executing program 0: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = add_key$keyring(&(0x7f0000000040)='keyring\x00', &(0x7f0000000080)={'syz', 0x2}, 0x0, 0x0, 0xfffffffffffffffe) request_key(&(0x7f0000000100)='keyring\x00', &(0x7f00000000c0)={'syz'}, &(0x7f0000000200)="3e923934c31eaee73d4e9a057cdd0cb9554f683cf7a031d65247a9a8101df9a6d1b3484ce53feadfd08b7566e9581f3539f101555eba6d544b195e0000dc72e823064133d1d41f48234b38e84357ddb09122afc0bdf9006f5a531c8e07a9d24bc8b941e514f57a43ec139579deee97e051686e70f8c9b732e906c0a820bfd1c6fbd69ce157ef3c0fb9cdd5c95c9de037162a3a6d71754f87f54a71e8a36b7a994a6349a1ccb912c1c6217c9988ec562a6cfcad2e6dd3c3f154df56b00952cf53cdd16de7f25f213fa3865ea48a633edda461647653822557fcd0492ec072c60d5f27e68dc35c212e5358bc69646c1095df6424ecfb9711c468e10864c282f2888319c74e5c553855643715efbd0500ec632c76655e07b55ba44867fd937e57e2d93aaaad3e1a1bb033994bc8c85c8d1a004916db3a4f35c0c42287310b9df1e998ea699c21be4ca57a55af8830dd93f3249f515b028cff81ef4427ae2c2ffb63ec6c2e16", r1) [ 490.677095] binder: 978:984 unknown command 0 18:20:22 executing program 2: r0 = socket$netlink(0x10, 0x3, 0x110) writev(r0, &(0x7f0000000000)=[{&(0x7f0000000200)="580000001400192340834b80040d8c5602067fffffff81000000000000dca87086a5c000004f6400940005891550f4a8000000006700008000f0fffeffff09000080fff5dd00000010000100000c0900fcff0000040e05a5", 0x58}], 0x1) r1 = openat$keychord(0xffffffffffffff9c, &(0x7f0000000040)='/dev/keychord\x00', 0x4040c0, 0x0) finit_module(r1, &(0x7f0000000100)='mime_type\x00', 0x1) ioctl$BLKSECDISCARD(r1, 0x127d, &(0x7f0000000140)=0xa2e7) openat$cgroup_subtree(r1, &(0x7f00000000c0)='cgroup.subtree_control\x00', 0x2, 0x0) pipe2(&(0x7f0000000080), 0x4800) 18:20:22 executing program 3: r0 = socket$netlink(0x10, 0x3, 0x4) writev(r0, &(0x7f0000000000)=[{&(0x7f0000000200)="580000001400192340834b80040d8c5602067fffffff81000000000000dca87086a5c000004f6400940005891550f4a8000000006700008000f0fffeffff09000080fff5dd00000010000100000c0900fcff0000040e05a5", 0x58}], 0x1) 18:20:22 executing program 5: r0 = syz_open_procfs(0x0, &(0x7f0000000000)='fdinfo\x00') ioctl$RNDADDENTROPY(r0, 0x40085203, &(0x7f0000000040)={0x3, 0x29, "29766fd127b7b6502307dbc8f623d4bdefd21a808affe301dc03863b305f39d4fc5b28f252cb238bf9"}) request_key(&(0x7f00000004c0)='user\x00', &(0x7f0000000380)={'syz'}, &(0x7f00000001c0)="3fcb00faffffff00", 0x0) [ 490.727007] binder: 978:984 ioctl c0306201 20012000 returned -22 [ 490.743286] binder: 978:994 unknown command 1089954566 [ 490.751903] binder: 992:995 got transaction to invalid handle 18:20:22 executing program 3: r0 = socket$netlink(0x10, 0x3, 0x4) r1 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000040)='/dev/loop-control\x00', 0x800, 0x0) fgetxattr(r1, &(0x7f0000000080)=@random={'system.', ',vmnet1&\x00'}, &(0x7f00000000c0)=""/24, 0x18) writev(r0, &(0x7f0000000000)=[{&(0x7f0000000200)="580000001400192340834b80040d8c5602067fffffff81000000000000dca87086a5c000004f6400940005891550f4a8000000006700008000f0fffeffff09000080fff5dd00000010000100000c0900fcff0000040e05a5", 0x58}], 0x1) 18:20:22 executing program 2: socket$netlink(0x10, 0x3, 0x4) r0 = openat$urandom(0xffffffffffffff9c, &(0x7f0000000040)='/dev/urandom\x00', 0x24002, 0x0) r1 = openat$null(0xffffffffffffff9c, &(0x7f0000000000)='/dev/null\x00', 0x2000, 0x0) getsockopt$inet6_IPV6_FLOWLABEL_MGR(r1, 0x29, 0x20, &(0x7f00000000c0)={@mcast2, 0x2, 0x0, 0x3, 0x1, 0xd4c, 0xffff, 0x7456}, &(0x7f0000000100)=0x20) ioctl$RNDADDENTROPY(r0, 0x40085203, &(0x7f0000000080)=ANY=[@ANYBLOB="070000000a000000e7768f32d2a327c6baee4b801b8dff809079cc589763b4c37da2ae1ea4265d74bcb456f6ab0973e39a5c"]) 18:20:22 executing program 0: socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = openat$zero(0xffffffffffffff9c, &(0x7f0000000080)='/dev/zero\x00', 0x600000, 0x0) ioctl$VT_GETMODE(r1, 0x5601, &(0x7f0000000100)) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) ioctl$TIOCLINUX2(r1, 0x541c, &(0x7f0000000140)={0x2, 0x3, 0x0, 0x2, 0x4, 0x4}) setsockopt$inet6_tcp_TCP_ULP(r1, 0x6, 0x1f, &(0x7f0000000180)='tls\x00', 0x4) request_key(&(0x7f0000000000)='rxrpc_s\x00', &(0x7f0000000040)={'syz'}, &(0x7f00000001c0)="3fcb00faffffff00", 0x0) fcntl$getown(r1, 0x9) openat$zero(0xffffffffffffff9c, &(0x7f0000000200)='/dev/zero\x00', 0x100, 0x0) [ 490.771457] binder: 978:994 ioctl c0306201 200000c0 returned -22 [ 490.786299] binder: 992:995 transaction failed 29201/-22, size 72-24 line 3014 [ 490.803159] binder: BINDER_SET_CONTEXT_MGR already set [ 490.809545] binder: 992:1007 ioctl 40046207 0 returned -16 [ 490.821038] binder: 978:984 unknown command 0 18:20:22 executing program 5: r0 = request_key(&(0x7f00000004c0)='user\x00', &(0x7f0000000380)={'syz'}, &(0x7f00000001c0)="3fcb00faffffff00", 0x0) r1 = request_key(&(0x7f0000000000)='keyring\x00', &(0x7f0000000040)={'syz', 0x1}, &(0x7f0000000080)='\x00', r0) keyctl$dh_compute(0x17, &(0x7f00000000c0)={r0, r1, r0}, &(0x7f0000000100)=""/69, 0x45, &(0x7f0000000200)={&(0x7f0000000180)={'sm4-generic\x00'}}) [ 490.825867] binder: BINDER_SET_CONTEXT_MGR already set [ 490.836940] binder: 978:984 ioctl c0306201 20012000 returned -22 [ 490.851747] binder: 978:994 ioctl 40046207 0 returned -16 [ 490.858008] binder: 978:1011 unknown command 1089954566 [ 490.864536] binder: 992:995 got transaction to invalid handle [ 490.871282] binder: BINDER_SET_CONTEXT_MGR already set 18:20:23 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000300)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) preadv(r0, &(0x7f0000000540)=[{&(0x7f0000000180)=""/202, 0xca}, {&(0x7f0000000100)=""/51, 0x33}, {&(0x7f0000000340)=""/249, 0xf9}, {&(0x7f0000000440)=""/228, 0xe4}, {&(0x7f0000000280)=""/27, 0x1b}], 0x5, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, &(0x7f0000012fc7)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, &(0x7f0000000f4d)}) write$binfmt_elf32(r0, &(0x7f00000005c0)={{0x7f, 0x45, 0x4c, 0x46, 0x7f, 0xfffffffffffffffe, 0x1, 0xe814, 0xfffffffffffffffb, 0x0, 0x3f, 0x0, 0x29c, 0x38, 0x368, 0x8, 0x3, 0x20, 0x1, 0x6fb, 0x4, 0x1}, [{0x1, 0xbab, 0x8, 0x2, 0x2, 0xfffffffffffffeff, 0x1, 0x8}], "a1e1b5f8266d63c6bd43cda448dbd7425b1ecb35b405a163699271d791740b525e81d2edf70b4b8a49c334a7b0d1e34693d917e3249f89909ef98fb106b160d1204ac54343abc887457fb02fd0cea5853be0a70bc240c1f175e196e06115d244fc1f1a132d5d7b0a1f3434f48d9405442918b73a6eb4e083ce3593c8f63843f148c99a690d6215768ace7ee267fc036a1f930d531cf77aa89034d08da1e8a18638a3d0f591e31cff534a6849e7ee07a3427ec805b0fccba6ceeda5c844209fcc8383bca31af7819042b234d2961789368d3edeee788704bd27", [[], [], []]}, 0x431) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x8, 0x0, &(0x7f0000000140)=[@release], 0x0, 0x0, &(0x7f0000000340)}) lsetxattr$security_capability(&(0x7f0000000000)='./file0\x00', &(0x7f0000000040)='security.capability\x00', &(0x7f0000000080)=@v1={0x1000000, [{0xfff, 0x8001}]}, 0xc, 0x3) 18:20:23 executing program 3: r0 = socket$netlink(0x10, 0x3, 0x4) pipe2(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80800) openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000100)='/selinux/commit_pending_bools\x00', 0x1, 0x0) accept4$inet(r1, &(0x7f0000000080)={0x2, 0x0, @multicast2}, &(0x7f00000000c0)=0x10, 0x80000) writev(r0, &(0x7f0000000000)=[{&(0x7f0000000200)="580000001400192340834b80040d8c5602067fffffff81000000000000dca87086a5c000004f6400940005891550f4a8000000006700008000f0fffeffff09000080fff5dd00000010000100000c0900fcff0000040e05a5", 0x58}], 0x1) 18:20:23 executing program 5: r0 = request_key(&(0x7f00000000c0)='rxrpc_s\x00', &(0x7f0000000100)={'syz', 0x2}, &(0x7f0000000140)="3fcb00faffffff00", 0xffffffffffffffff) r1 = openat$selinux_policy(0xffffffffffffff9c, &(0x7f0000000240)='/selinux/policy\x00', 0x0, 0x0) setsockopt$inet6_tcp_TLS_RX(r1, 0x6, 0x2, &(0x7f0000000280), 0x4) request_key(&(0x7f0000000180)='cifs.spnego\x00', &(0x7f0000000040)={'syz', 0x1}, &(0x7f0000000080)='syz', r0) request_key(&(0x7f00000004c0)='user\x00', &(0x7f0000000380)={'syz'}, &(0x7f00000001c0)="3fcb00faffffff00", 0x0) r2 = openat$selinux_mls(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/mls\x00', 0x0, 0x0) ioctl$TIOCLINUX3(r2, 0x541c, &(0x7f0000000200)) 18:20:23 executing program 4: ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x800) r1 = accept$inet(0xffffffffffffff9c, &(0x7f0000000040)={0x2, 0x0, @rand_addr}, &(0x7f0000000080)=0x10) setsockopt$IPT_SO_SET_ADD_COUNTERS(r1, 0x0, 0x41, &(0x7f0000000180)={'mangle\x00', 0x4, [{}, {}, {}, {}]}, 0x68) ioctl$FIBMAP(r1, 0x1, &(0x7f0000000100)=0x2) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, &(0x7f0000012fc7)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, &(0x7f0000000f4d)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x8, 0x0, &(0x7f0000000140)=[@release], 0x0, 0x0, &(0x7f0000000340)}) 18:20:23 executing program 0: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = openat$selinux_policy(0xffffffffffffff9c, &(0x7f0000000140)='/selinux/policy\x00', 0x0, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x2400, 0x6) r3 = request_key(&(0x7f00000004c0)='user\x00', &(0x7f0000000380)={'syz'}, &(0x7f00000001c0)="3fcb00faffffff00", 0x0) setxattr$trusted_overlay_redirect(&(0x7f0000000080)='./file0\x00', &(0x7f00000000c0)='trusted.overlay.redirect\x00', &(0x7f0000000100)='./file0\x00', 0x8, 0x3) add_key(&(0x7f0000000000)='.dead\x00', &(0x7f0000000040)={'syz', 0x1}, &(0x7f0000000080), 0x0, r3) ioctl$TIOCGPGRP(r2, 0x540f, &(0x7f0000000200)=0x0) ioctl$sock_FIOSETOWN(r0, 0x8901, &(0x7f0000000240)=r4) [ 490.878604] binder: 992:995 transaction failed 29201/-22, size 72-24 line 3014 [ 490.885094] binder: 992:1021 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 490.894598] binder: 992:1007 ioctl 40046207 0 returned -16 [ 490.895024] binder: 992:1019 Acquire 1 refcount change on invalid ref 0 ret -22 [ 490.908712] binder: 978:1011 ioctl c0306201 200000c0 returned -22 18:20:23 executing program 2: r0 = socket$netlink(0x10, 0x3, 0x4) writev(r0, &(0x7f0000000000)=[{&(0x7f0000000040)="580000001400192340834b80040d8c5602067fffffff81000000000000dca87086a5c000004f6400940005891550f4a8000000006700008000f0fffeffff09000080fff5dd00000010000100000c0900fcff0000040e05a5", 0x58}], 0x1000000000000076) 18:20:23 executing program 3: r0 = socket$netlink(0x10, 0x3, 0x4) writev(r0, &(0x7f0000000040), 0x10000000000002e2) [ 490.982888] binder: 1035:1038 Acquire 1 refcount change on invalid ref 0 ret -22 [ 491.007894] binder: 1036:1040 Acquire 1 refcount change on invalid ref 0 ret -22 [ 491.025074] binder: 1035:1038 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 18:20:23 executing program 0: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = openat$keychord(0xffffffffffffff9c, &(0x7f0000000000)='/dev/keychord\x00', 0x10000, 0x0) setsockopt$inet6_group_source_req(r1, 0x29, 0x2f, &(0x7f0000000040)={0x0, {{0xa, 0x4e22, 0x0, @ipv4={[], [], @remote}, 0x8001}}, {{0xa, 0x4e22, 0x10001, @ipv4={[], [], @local}, 0x1}}}, 0x108) request_key(&(0x7f00000004c0)='user\x00', &(0x7f0000000380)={'syz'}, &(0x7f00000001c0)="3fcb00faffffff00", 0x0) 18:20:23 executing program 2: socket$inet_udp(0x2, 0x2, 0x0) r0 = dup(0xffffffffffffffff) getsockname$unix(r0, &(0x7f0000000040)=@abs, &(0x7f00000000c0)=0x6e) r1 = socket$netlink(0x10, 0x3, 0x4) writev(r1, &(0x7f0000000100), 0x1) r2 = syz_genetlink_get_family_id$fou(&(0x7f0000000100)='fou\x00') sendmsg$FOU_CMD_DEL(r1, &(0x7f00000001c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x10000200}, 0xc, &(0x7f0000000180)={&(0x7f0000000140)={0x1c, r2, 0x200, 0x70bd2b, 0x25dfdbfc, {}, [@FOU_ATTR_AF={0x8, 0x2, 0xa}]}, 0x1c}, 0x1, 0x0, 0x0, 0x80}, 0x40000) 18:20:23 executing program 5: r0 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000100)='/dev/rtc0\x00', 0x10100, 0x0) ioctl$EVIOCGKEY(r0, 0x80404518, &(0x7f0000000140)=""/139) setrlimit(0xe, &(0x7f0000000040)={0x7fffffff, 0x100000001}) add_key$keyring(&(0x7f0000000080)='keyring\x00', &(0x7f00000000c0)={'syz', 0x1}, 0x0, 0x0, 0xfffffffffffffffe) add_key(&(0x7f0000000400)='blacklist\x00', &(0x7f0000000440)={'syz', 0x2}, &(0x7f0000000480)="8c115f1337d52cc76d", 0x9, 0xfffffffffffffff9) request_key(&(0x7f0000000300)="086e09f000", &(0x7f0000000000)={'syz', 0x2}, &(0x7f00000005c0)='syz', 0xfffffffffffffff8) pivot_root(&(0x7f0000000200)='./file0\x00', &(0x7f0000000240)='./file0\x00') [ 491.034778] binder: 1036:1040 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 491.070160] binder: 1035:1038 Release 1 refcount change on invalid ref 0 ret -22 18:20:23 executing program 3: r0 = socket$netlink(0x10, 0x3, 0x4) writev(r0, &(0x7f0000000000)=[{&(0x7f0000000200)="580000001400192340834b80040d8c5602067fffffff81000000000000dca87086a5c000004f6400940005891550f4a8000000006700008000f0fffeffff09000080fff5dd00000010000100000c0900fcff0000040e05a5", 0x58}], 0x1) r1 = getpgrp(0xffffffffffffffff) syz_open_procfs(r1, &(0x7f0000000040)="00000000001d000000") socket$inet6_udplite(0xa, 0x2, 0x88) [ 491.082455] binder: 1036:1052 Release 1 refcount change on invalid ref 0 ret -22 18:20:23 executing program 0: r0 = openat$zero(0xffffffffffffff9c, &(0x7f0000000000)='/dev/zero\x00', 0x200, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x2400, 0x8) ioctl$LOOP_SET_STATUS(r0, 0x4c02, &(0x7f0000000040)={0x0, 0x0, 0x0, 0x0, 0x1b, 0x6, 0x6, 0x14, "b5fdf11785a4019ff6f51f741918df1171ab47b27162234d78752a90b290e4deccbdc3cae2c51dcac67192094239c930ae424dcae97531826f0f4ecf83a07b82", "43a7cf1c4970a5eb9b683f24070839bfce9241e06fb8fd2b1db5b6aabc0e7219", [0x0, 0x8]}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) request_key(&(0x7f00000004c0)='user\x00', &(0x7f0000000380)={'syz'}, &(0x7f00000001c0)="3fcb00faffffff00", 0x0) [ 491.111748] binder: 1035:1059 Acquire 1 refcount change on invalid ref 0 ret -22 [ 491.122105] binder: 1036:1040 Acquire 1 refcount change on invalid ref 0 ret -22 [ 491.130311] binder: 1036:1052 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 491.159296] binder: 1035:1038 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 491.173533] binder: 1035:1067 Release 1 refcount change on invalid ref 0 ret -22 [ 491.181944] SELinux: unrecognized netlink message: protocol=4 nlmsg_type=0 sclass=netlink_tcpdiag_socket 18:20:23 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000300)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, &(0x7f0000012fc7)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, &(0x7f0000000f4d)}) lsetxattr$security_smack_entry(&(0x7f0000000040)='./file0\x00', &(0x7f0000000080)='security.SMACK64IPIN\x00', &(0x7f0000000100)='/dev/binder#\x00', 0xd, 0x3) r1 = dup2(r0, r0) ioctl$PIO_UNIMAPCLR(r1, 0x4b68, &(0x7f0000000000)={0x7, 0x2, 0x9}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x8, 0x0, &(0x7f0000000140)=[@release], 0x0, 0x0, &(0x7f0000000340)}) 18:20:23 executing program 5: r0 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ppp\x00', 0x8000, 0x0) ioctl$EVIOCGKEYCODE_V2(r0, 0x80284504, &(0x7f0000000100)=""/53) sendmsg$key(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000040)={0x2, 0x15, 0xff, 0x0, 0x8, 0x0, 0x70bd2a, 0x25dfdbfc, [@sadb_x_filter={0x5, 0x1a, @in=@rand_addr=0x100000000, @in=@rand_addr=0x5, 0x1, 0x4, 0x4}, @sadb_x_nat_t_port={0x1, 0x16, 0x4e23}]}, 0x40}}, 0x4) request_key(&(0x7f00000004c0)='user\x00', &(0x7f0000000380)={'syz'}, &(0x7f00000001c0)="3fcb00faffffff00", 0x0) 18:20:23 executing program 3: r0 = socket$netlink(0x10, 0x3, 0x17) writev(r0, &(0x7f0000000000)=[{&(0x7f0000000200)="580000001400192340834b80040d8c5602067fffffff81000000000000dca87086a5c000004f6400940005891550f4a8000000006700008000f0fffeffff09000080fff5dd00000010000100000c0900fcff0000040e05a5", 0x58}], 0x1) 18:20:23 executing program 4: r0 = syz_open_dev$binder(&(0x7f00000002c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000300)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, &(0x7f0000012fc7)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, &(0x7f0000000f4d)}) r2 = openat$selinux_policy(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/policy\x00', 0x0, 0x0) getsockname(r2, &(0x7f0000000040)=@hci, &(0x7f0000000100)=0x80) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000000c0)={0x8, 0x0, &(0x7f0000000140)=[@release], 0x0, 0x0, &(0x7f0000000340)}) 18:20:23 executing program 0: r0 = open(&(0x7f0000002d00)='./file0\x00', 0x80400, 0x20) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$FICLONE(r0, 0x40049409, r1) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) request_key(&(0x7f00000004c0)='user\x00', &(0x7f0000000380)={'syz'}, &(0x7f00000001c0)="3fcb00faffffff00", 0x0) r4 = memfd_create(&(0x7f0000002c40)='syz', 0x0) write$FUSE_INIT(r4, &(0x7f0000002c80)={0x50, 0x0, 0x1, {0x7, 0x1b, 0x101, 0x1000, 0x8, 0xc9, 0x5, 0x3f}}, 0x50) r5 = getpid() ioctl$sock_FIOGETOWN(r2, 0x8903, &(0x7f0000002bc0)=0x0) tgkill(r5, r6, 0x22) sched_getattr(r6, &(0x7f0000002c00), 0x30, 0x0) r7 = memfd_create(&(0x7f0000000000)='wlan0\x00', 0x2) recvmmsg(r3, &(0x7f0000002940)=[{{0x0, 0x0, &(0x7f00000000c0)=[{&(0x7f0000000040)=""/95, 0x5f}], 0x1, &(0x7f0000000100)=""/4, 0x4, 0x8}, 0x1}, {{&(0x7f0000000200)=@nfc_llcp, 0x80, &(0x7f0000000340)=[{&(0x7f0000000280)=""/132, 0x84}, {&(0x7f0000000140)=""/38, 0x26}], 0x2, &(0x7f00000003c0)=""/76, 0x4c, 0x9}, 0x480000000000}, {{&(0x7f0000000440)=@pppol2tpin6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @loopback}}}, 0x80, &(0x7f0000000780)=[{&(0x7f0000000500)=""/227, 0xe3}, {&(0x7f0000000600)=""/69, 0x45}, {&(0x7f0000000680)=""/248, 0xf8}], 0x3, &(0x7f00000007c0)=""/84, 0x54, 0x4}, 0x1}, {{0x0, 0x0, &(0x7f0000000940)=[{&(0x7f0000000840)=""/227, 0xe3}], 0x1, &(0x7f0000000980)=""/179, 0xb3, 0x2}, 0x9}, {{&(0x7f0000000a40)=@pptp={0x18, 0x2, {0x0, @multicast2}}, 0x80, &(0x7f0000000b40)=[{&(0x7f0000000ac0)=""/107, 0x6b}], 0x1, &(0x7f0000000b80)=""/156, 0x9c, 0x8}}, {{0x0, 0x0, &(0x7f0000000e00)=[{&(0x7f0000000c40)=""/12, 0xc}, {&(0x7f0000000c80)=""/78, 0x4e}, {&(0x7f0000000d00)=""/9, 0x9}, {&(0x7f0000000d40)=""/142, 0x8e}], 0x4, 0x0, 0x0, 0xa20e4a0}, 0x80}, {{&(0x7f0000000e40)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @link_local}, 0x80, &(0x7f00000021c0)=[{&(0x7f0000000ec0)=""/35, 0x23}, {&(0x7f0000000f00)=""/116, 0x74}, {&(0x7f0000000f80)=""/244, 0xf4}, {&(0x7f0000001080)=""/4096, 0x1000}, {&(0x7f0000002080)=""/180, 0xb4}, {&(0x7f0000002140)=""/88, 0x58}], 0x6, &(0x7f0000002240)=""/106, 0x6a}, 0x8ff}, {{0x0, 0x0, &(0x7f0000002800)=[{&(0x7f00000022c0)=""/243, 0xf3}, {&(0x7f00000023c0)=""/94, 0x5e}, {&(0x7f0000002440)=""/63, 0x3f}, {&(0x7f0000002480)=""/149, 0x95}, {&(0x7f0000002540)=""/248, 0xf8}, {&(0x7f0000002640)=""/169, 0xa9}, {&(0x7f0000002700)=""/97, 0x61}, {&(0x7f0000002780)=""/79, 0x4f}], 0x8, &(0x7f0000002880)=""/178, 0xb2, 0x1}, 0x4}], 0x8, 0x10000, &(0x7f0000002b40)={0x77359400}) ioctl$sock_inet6_SIOCSIFDSTADDR(r7, 0x8918, &(0x7f0000002b80)={@dev={0xfe, 0x80, [], 0x1b}, 0x80, r8}) 18:20:23 executing program 2: r0 = socket$netlink(0x10, 0x3, 0x4) dup3(r0, r0, 0x80000) r1 = openat$selinux_checkreqprot(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/checkreqprot\x00', 0x101000, 0x0) writev(r1, &(0x7f00000001c0)=[{&(0x7f0000000280)="7ce9bca74595d5beb3969f7826cbbcad753bf93011fdead7ccb27ceb18ffadca272fcb49d1fc4fa9b806471a69772d26c1b040a2749c87145b7b0f9fae0fdcc714b46d9dce0037ba6c31be1adb4d787a70943ca393549a8ea1991b5d9a3fd4446166e081f6efb6e2752f6fc7606026aabc3baf8c984b5abdcc157bb6bc83afb666ebcd3a5c67f48b9bb7e5a914ee991f75ccd04daf6cb43ec9b5169e3d4436f477549c5ef79ff019bcbe724006d9a957acf7613bed2d2dfceed9886d91186ae947e228b3944fdd6008f349ae291e0a375ac1cb4ee2e3703fd72ea1c88f6e20a2e26ab90cd3c784", 0xe7}, {&(0x7f0000000140)="34dda771e1563d5d3dc17fe3e113e561fdb584db1f15237193f9a6d14dec80b7d307a152395ea56c786520021542f3eca087efb5fe8e519d02b41e34c62283c14bc76b34", 0x44}, {&(0x7f0000000380)="b8a997a2685f046c35a9f5390e15cb2b2d64969920a5faf8f6d852bfddfd3021d0f28bc70667fb1350b9a5a1543c3e5992629204cffdb669ffc4b7b2b2944a00207089f9ca720d5290a3", 0x4a}], 0x3) socket$netlink(0x10, 0x3, 0xf) r2 = dup3(r0, r0, 0x0) fcntl$setstatus(r0, 0x4, 0x4000) socketpair$packet(0x11, 0x3, 0x300, &(0x7f0000000080)) ioctl$KDGKBMETA(r2, 0x4b62, &(0x7f0000000040)) [ 491.227199] SELinux: unrecognized netlink message: protocol=4 nlmsg_type=0 sclass=netlink_tcpdiag_socket 18:20:23 executing program 5: request_key(&(0x7f00000004c0)='user\x00', &(0x7f0000000380)={'syz'}, &(0x7f00000001c0)="3fcb00faffffff00", 0x0) r0 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$IP_VS_SO_SET_EDIT(r0, 0x0, 0x483, &(0x7f0000000000)={0x2b, @dev={0xac, 0x14, 0x14, 0x15}, 0x4e23, 0x8000000000003, 'dh\x00', 0x8, 0x7f, 0x1}, 0x2c) [ 491.284295] binder: 1080:1084 Acquire 1 refcount change on invalid ref 0 ret -22 [ 491.317364] binder: 1080:1084 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 491.326722] binder: BINDER_SET_CONTEXT_MGR already set 18:20:23 executing program 4: r0 = syz_open_dev$binder(&(0x7f00000002c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000300)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, &(0x7f0000000f4d)}) fsetxattr$security_smack_entry(r1, &(0x7f0000000000)='security.SMACK64\x00', &(0x7f0000000040)='/dev/binder#\x00', 0xd, 0x1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000000c0)={0x8, 0x0, &(0x7f0000000140)=[@release], 0x0, 0x0, &(0x7f0000000340)}) 18:20:23 executing program 3: r0 = socket$netlink(0x10, 0x3, 0x4) writev(r0, &(0x7f0000000000)=[{&(0x7f0000000200)="580000001400192340834b80040d8c5602067fffffff81000000000000dca87086a5c000004f6400940005891550f4a8000000006700008000f0fffeffff09000080fff5dd00000010000100000c0900fcff0000040e05a5", 0x58}], 0x1) ioctl$EXT4_IOC_PRECACHE_EXTENTS(r0, 0x6612) writev(r0, &(0x7f0000000100), 0x0) r1 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vga_arbiter\x00', 0x80001, 0x0) setsockopt$inet_tcp_int(r1, 0x6, 0xb, &(0x7f00000000c0)=0x3ff, 0x4) openat$cgroup_ro(r1, &(0x7f0000000080)='memory.swap.current\x00', 0x0, 0x0) [ 491.333414] binder: 1080:1084 ioctl 4b68 20000000 returned -22 [ 491.340013] binder: 1081:1091 ioctl 40046207 0 returned -16 [ 491.347617] binder: 1080:1084 Release 1 refcount change on invalid ref 0 ret -22 [ 491.363328] binder: 1080:1084 Acquire 1 refcount change on invalid ref 0 ret -22 [ 491.375051] binder: 1080:1104 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 18:20:23 executing program 5: r0 = request_key(&(0x7f00000004c0)='user\x00', &(0x7f0000000380)={'syz'}, &(0x7f00000001c0)="3fcb00faffffff00", 0x0) keyctl$clear(0x7, r0) 18:20:23 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000300)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) pipe(&(0x7f0000000000)={0xffffffffffffffff}) ioctl$BLKPBSZGET(r1, 0x127b, &(0x7f0000000040)) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000012000)={0x0, 0x0, &(0x7f0000005fd4), 0x0, 0x0, &(0x7f0000000080)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=ANY=[@ANYBLOB="0e63000000000000"], 0x0, 0x0, &(0x7f0000000f4d)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x8, 0x0, &(0x7f0000000140)=[@release], 0x0, 0x0, &(0x7f0000000340)}) [ 491.395555] binder: 1080:1084 ioctl 4b68 20000000 returned -22 [ 491.401677] binder: 1080:1104 Release 1 refcount change on invalid ref 0 ret -22 [ 491.418302] binder: 1106:1110 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 18:20:23 executing program 2: r0 = socket$netlink(0x10, 0x3, 0x4) r1 = syz_open_pts(0xffffffffffffff9c, 0x200000) ioctl$KDGKBSENT(r1, 0x4b48, &(0x7f0000000040)={0xfffffffffffffffa, 0x7ff, 0x7}) writev(r0, &(0x7f0000000000)=[{&(0x7f0000000200)="580000001400192340834b80040d8c5602067fffffff81000000000000dca87086a5c000004f6400940005891550f4a8000000006700008000f0fffeffff09000080fff5dd00000010000100000c0900fcff0000040e05a5", 0x58}], 0x1) 18:20:23 executing program 3: r0 = socket$netlink(0x10, 0x3, 0x4) writev(r0, &(0x7f0000000000)=[{&(0x7f0000000200)="580000001400192340834b80040d8c5602067fffffff81000000000000dca87086a5c000004f6400940005891550f4a8000000006700008000f0fffeffff09000080fff5dd00000010000100000c0900fcff0000040e05a5", 0x58}], 0x1) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='memory.stat\x00', 0x0, 0x0) unlinkat(r1, &(0x7f0000000080)='./file0\x00', 0x200) [ 491.451721] binder: 1106:1110 Release 1 refcount change on invalid ref 0 ret -22 [ 491.483919] binder: 1116:1118 unknown command 25358 18:20:23 executing program 5: r0 = add_key(&(0x7f0000000000)='.request_key_auth\x00', &(0x7f0000000040)={'syz', 0x3}, &(0x7f0000000080)="74953921b9297e23cde89da5e8cb285eb881dc2c2f88bf51693dd7f6c7edef25a7446409adef6b51d99051344c88", 0x2e, 0xfffffffffffffffe) r1 = syz_open_procfs(0x0, &(0x7f0000000180)='net/ipv6_route\x00') accept$packet(r1, &(0x7f0000000200), &(0x7f0000000240)=0x14) pipe2(&(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80000) r3 = accept$packet(0xffffffffffffff9c, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000140)=0x14) ioctl$LOOP_CHANGE_FD(r2, 0x4c06, r3) request_key(&(0x7f0000000500)='big_key\x00', &(0x7f0000000380)={'syz'}, &(0x7f00000001c0)="3fcb00faffffff00", r0) 18:20:23 executing program 2: r0 = socket$netlink(0x10, 0x3, 0x4) mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x1000008, 0x20010, r0, 0x0) writev(r0, &(0x7f0000000000)=[{&(0x7f0000000200)="580000001400192340834b80040d8c5602067fffffff81000000000000dca87086a5c000004f6400940005891550f4a8000000006700008000f0fffeffff09000080fff5dd00000010000100000c0900fcff0000040e05a5", 0x58}], 0x1) 18:20:23 executing program 3: r0 = socket$netlink(0x10, 0x3, 0x4) lsetxattr$trusted_overlay_redirect(&(0x7f0000000040)='./file0\x00', &(0x7f0000000080)='trusted.overlay.redirect\x00', &(0x7f00000000c0)='./file0\x00', 0x8, 0x2) writev(r0, &(0x7f0000000000)=[{&(0x7f0000000200)="580000001400192340834b80040d8c5602067fffffff81000000000000dca87086a5c000004f6400940005891550f4a8000000006700008000f0fffeffff09000080fff5dd00000010000100000c0900fcff0000040e05a5", 0x58}], 0x1) [ 491.500048] binder: BINDER_SET_CONTEXT_MGR already set [ 491.506372] binder: 1106:1125 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 491.519085] binder: 1116:1118 ioctl c0306201 20008fd0 returned -22 [ 491.538283] binder: 1116:1129 Release 1 refcount change on invalid ref 0 ret -22 [ 491.541041] binder: 1106:1110 ioctl 40046207 0 returned -16 [ 491.580876] binder: 1116:1129 unknown command 25358 [ 491.585961] binder: 1116:1129 ioctl c0306201 20008fd0 returned -22 18:20:24 executing program 0: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = request_key(&(0x7f00000004c0)='user\x00', &(0x7f0000000380)={'syz'}, &(0x7f00000001c0)="3fcb00faffffff00", 0x0) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000000040)={0x0, 0x0}, &(0x7f0000000080)=0xc) r4 = getegid() r5 = openat$pfkey(0xffffffffffffff9c, &(0x7f0000000280)='/proc/self/net/pfkey\x00', 0x40, 0x0) ioctl$PERF_EVENT_IOC_DISABLE(r5, 0x2401, 0x3a3) r6 = memfd_create(&(0x7f0000000200)='.request_key_auth\x00', 0x7) ioctl$BLKROTATIONAL(r6, 0x127e, &(0x7f0000000240)) r7 = request_key(&(0x7f00000000c0)='.request_key_auth\x00', &(0x7f0000000100)={'syz', 0x3}, &(0x7f0000000140)='user\x00', 0xfffffffffffffff9) chown(&(0x7f0000000000)='./file0\x00', r3, r4) keyctl$link(0x8, r7, r2) 18:20:24 executing program 5: request_key(&(0x7f00000004c0)='user\x00', &(0x7f0000000380)={'syz'}, &(0x7f0000000000)="3fcb00faffffff00", 0xfffffffffffffffe) 18:20:24 executing program 4: r0 = syz_open_dev$binder(&(0x7f00000002c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000300)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = socket$netlink(0x10, 0x3, 0x4) bind$netlink(r2, &(0x7f0000461000)={0x10, 0x0, 0x2}, 0xc) bind$netlink(r2, &(0x7f0000000100)={0x10, 0x0, 0x2}, 0xc) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, &(0x7f0000012fc7)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, &(0x7f0000000f4d)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000000c0)={0x8, 0x0, &(0x7f0000000140)=ANY=[@ANYBLOB="0660494000000000"], 0x0, 0x0, &(0x7f0000000340)}) 18:20:24 executing program 3: r0 = socket$netlink(0x10, 0x3, 0x4) times(&(0x7f00000000c0)) writev(r0, &(0x7f0000000000)=[{&(0x7f0000000200)="580000001400192340834b80040d8c5602067fffffff81000000000000dca87086a5c000004f6400940005891550f4a8000000006700008000f0fffeffff09000080fff5dd00000010000100000c0900fcff0000040e05a5", 0x58}], 0x1) r1 = creat(&(0x7f0000000040)='./file0\x00', 0x0) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r1, 0x6, 0x1d, &(0x7f0000000080)={0x7, 0xcfa, 0x6, 0x100000000, 0x200}, 0x292) 18:20:24 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000300)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, &(0x7f0000012fc7)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@decrefs={0x40046307, 0x3}], 0xfffffffffffffe64, 0x0, &(0x7f0000000000)="2841b0e85c7fe183d8d61131ad1e53c65c755c52b54fc7377ca93488d89f60a9a775f943b90816ecf48968616310f26733d1c57c0a6919928286b589d7a7cbcecab80aef0c752de1bd250b503a49530f2d454dbba9b253e7a74a84682e0e15b8481114ce9f3bdad177883994e8c7c1a3e9d8806c213bca4433510dfa8517c31d6f2afd4fde23544f4b"}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x8, 0x0, &(0x7f0000000140)=[@release], 0x0, 0x0, &(0x7f0000000340)}) 18:20:24 executing program 2: r0 = socket$netlink(0x10, 0x3, 0x4) bind$netlink(r0, &(0x7f0000000040)={0x10, 0x0, 0x25dfdbff, 0x4800}, 0xc) writev(r0, &(0x7f0000000000)=[{&(0x7f0000000200)="580000001400192340834b80040d8c5602067fffffff81000000000000dca87086a5c000004f6400940005891550f4a8000000006700008000f0fffeffff09000080fff5dd00000010000100000c0900fcff0000040e05a5", 0x58}], 0x1) 18:20:24 executing program 5: r0 = openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/commit_pending_bools\x00', 0x1, 0x0) r1 = add_key$keyring(&(0x7f00000000c0)='keyring\x00', &(0x7f0000000100)={'syz', 0x2}, 0x0, 0x0, 0xfffffffffffffffe) r2 = add_key(&(0x7f0000000140)='encrypted\x00', &(0x7f0000000180)={'syz', 0x0}, &(0x7f0000000200)="13f9dee65c4602304af08f53afa8b65e26a28a5340eac1d5abd924bb6caf1218fa1bd78f20964f9ca18bdb8e8a8132895a38c6220bae0ee21a9b1f12d4843f909f4cdc751cf0dd6c3d722473948add4c97cc6ef7644ef1d8d7fc2a80174385ec4a5422b2409a8f72978f16c6c450460e544af0a09b14e979c0f1a8fd46ec1effd42b19c835c0f791427e8552aeea318b3e64f30304122ee69fbeee503501310ba3cf1766b442da336999738ac680290d3082c00d7ffc1b4ea2a306c73d79e4e5919b", 0xc2, 0xfffffffffffffffb) unlink(&(0x7f0000000440)='./file0\x00') add_key(&(0x7f0000000480)='.dead\x00', &(0x7f0000000500)={'syz', 0x1}, &(0x7f0000000540)="22f33cae917213cf84c6cfd4021aa1914a3b2471589fc6ef9f475817be87b446be5d511dfe7eab2574ba3a75f6bbaeefb8905b7073", 0x35, r1) keyctl$reject(0x13, r1, 0x8, 0x8f, r2) ioctl$PERF_EVENT_IOC_MODIFY_ATTRIBUTES(r0, 0x4008240b, &(0x7f00000003c0)={0x3, 0x70, 0xffffffffffff890e, 0x9, 0x40, 0x5, 0x0, 0x1, 0x4101, 0x4, 0x4, 0x3, 0x20, 0x3, 0xc0, 0x0, 0xda, 0x10000, 0x1000, 0x9, 0xff, 0x2, 0x3, 0x1, 0x80, 0x0, 0x1000, 0xffffffffffffffa3, 0x5, 0x71aa, 0x3, 0x2, 0x400, 0x55, 0x10, 0x7, 0x7600, 0x3, 0x0, 0x1, 0x0, @perf_bp={&(0x7f0000000340), 0x5}, 0x80, 0x6, 0x5b3, 0x3, 0x2, 0x6, 0x401}) ioctl$PIO_UNIMAP(r0, 0x4b67, &(0x7f0000000080)={0x5, &(0x7f0000000040)=[{0x9, 0x8}, {0x1, 0x4}, {0x1000, 0x80000001}, {0x400, 0x100}, {0xa2, 0x9}]}) request_key(&(0x7f00000004c0)='user\x00', &(0x7f0000000380)={'syz'}, &(0x7f00000001c0)="3fcb00faffffff00", 0x0) ioctl$sock_inet_tcp_SIOCINQ(r0, 0x541b, &(0x7f0000000300)) socket$nl_xfrm(0x10, 0x3, 0x6) [ 492.095977] binder: 1150:1153 unknown command 1078550534 [ 492.104179] binder: 1154:1156 DecRefs 0 refcount change on invalid ref 3 ret -22 [ 492.118275] binder: 1150:1153 ioctl c0306201 200000c0 returned -22 [ 492.133822] binder: BINDER_SET_CONTEXT_MGR already set 18:20:24 executing program 2: r0 = creat(&(0x7f0000000040)='./file0\x00', 0x100) ioctl$ASHMEM_GET_SIZE(r0, 0x7704, 0x0) r1 = socket$netlink(0x10, 0x3, 0x4) writev(r1, &(0x7f0000000000)=[{&(0x7f0000000200)="580000001400192340834b80040d8c5602067fffffff81000000000000dca87086a5c000004f6400940005891550f4a8000000006700008000f0fffeffff09000080fff5dd00000010000100000c0900fcff0000040e05a5", 0x58}], 0x1) 18:20:24 executing program 3: writev(0xffffffffffffffff, &(0x7f0000000000)=[{&(0x7f0000000200)="580000001400192340834b80040d8c5602067fffffff81000000000000dca87086a5c000004f6400940005891550f4a8000000006700008000f0fffeffff09000080fff5dd00000010000100000c0900fcff0000040e05a5", 0x58}], 0x100000000000006a) 18:20:24 executing program 5: request_key(&(0x7f0000000080)='encrypted\x00', &(0x7f0000000100)={'syz', 0x3}, &(0x7f00000001c0)='syz', 0x0) 18:20:24 executing program 0: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) 18:20:24 executing program 3: r0 = socket$netlink(0x10, 0x3, 0xf) r1 = dup(r0) ioctl$EVIOCGABS0(r1, 0x80184540, &(0x7f0000000040)=""/93) ioctl$FS_IOC_FIEMAP(r0, 0xc020660b, &(0x7f0000000280)={0x100000000000, 0x9, 0x4, 0x3, 0xa, [{0xeb, 0x4, 0x10001}, {0x3ff, 0xfffffffffffffff8, 0x401, 0x0, 0x0, 0x1}, {0x5, 0x7a, 0x2eb, 0x0, 0x0, 0x104}, {0x8, 0x9, 0x2, 0x0, 0x0, 0x1308}, {0x9, 0x5d, 0x1, 0x0, 0x0, 0x400}, {0x8000, 0x10001, 0x1ff, 0x0, 0x0, 0x1900}, {0xfffffffffffffffb, 0x10001, 0x7, 0x0, 0x0, 0x800}, {0x1ff, 0x523, 0x4fa, 0x0, 0x0, 0x80}, {0x2, 0x0, 0x0, 0x0, 0x0, 0x2}, {0x4, 0x1ff, 0xc0000, 0x0, 0x0, 0x84}]}) writev(r0, &(0x7f0000000000)=[{&(0x7f0000000200)="580000001400192340834b80040d8c5602067fffffff81000000000000dca87086a5c000004f6400940005891550f4a8000000006700008000f0fffeffff09000080fff5dd00000010000100000c0900fcff0000040e05a5", 0xfffffffffffffe04}], 0x1) creat(&(0x7f00000000c0)='./file0\x00', 0x5) ioctl$RNDADDENTROPY(r1, 0x40085203, &(0x7f0000000500)=ANY=[@ANYBLOB="400000008d000000561fb5414493876baf08428930db4968a1d43d03d68d14de041a9c59132df5e9d7736ee2a9988ae705565de04c680d4cd74581ecd4e56c6ce545b7d715acd3b10bee6ce1d0e870e7ea47f2abaf1a052574d840e1495301a0618148b096a03dec8a159f37f77ed3ed823b0c26c23bd503031ee8e10a774c47c5491bed6c1c9fb77671006dff1a4112b1b6cab12a97"]) 18:20:24 executing program 5: r0 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$inet6_group_source_req(r0, 0x29, 0x2e, &(0x7f0000000000)={0x1, {{0xa, 0x0, 0x0, @mcast2}}, {{0xa, 0x0, 0x0, @local}}}, 0x108) preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f0000001200)=""/148, 0x94}], 0x0, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000040)='net/mcfilter6\x00') preadv(r1, &(0x7f0000000100), 0x100000000000019c, 0x0) request_key(&(0x7f00000004c0)='user\x00', &(0x7f0000000380)={'syz'}, &(0x7f00000001c0)="3fcb00faffffff00", 0x0) [ 492.152132] binder: 1150:1153 ioctl 40046207 0 returned -16 [ 492.191215] binder: 1150:1168 unknown command 1078550534 18:20:24 executing program 0: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = add_key(&(0x7f0000000000)='rxrpc\x00', &(0x7f0000000040)={'syz', 0x3}, &(0x7f0000000080)="6eb0a518962810138c697801e68d089646ba99ea0e8fb66fa478916b8a5fbbece955f7c02347bba6072d17790cf3f950a35a7e80b91a3496afe61dd706de28f70f4f9875587571b5836b220dadc1eafab0e206cdb364080eee4a2d500247ec6d58915544ba59daab4c7beb20ec3594940d6e6860919e35", 0x77, 0xffffffffffffffff) r2 = request_key(&(0x7f0000000100)='encrypted\x00', &(0x7f0000000140)={'syz', 0x2}, &(0x7f0000000200)='user\x00', 0xfffffffffffffff9) keyctl$link(0x8, r1, r2) request_key(&(0x7f00000004c0)='user\x00', &(0x7f0000000380)={'syz'}, &(0x7f00000001c0)="3fcb00faffffff00", 0x0) 18:20:24 executing program 4: r0 = syz_open_dev$binder(&(0x7f00000002c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/net/tun\x00', 0x2000, 0x0) ioctl$TUNSETPERSIST(r1, 0x400454cb, 0x1) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) pipe(&(0x7f0000000a00)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_inet_SIOCDELRT(r3, 0x890c, &(0x7f0000000a80)={0x80000001, {0x2, 0x4e23, @multicast1}, {0x2, 0x4e20, @multicast1}, {0x2, 0x4e24, @local}, 0x5, 0x9, 0x82, 0x2, 0x80, &(0x7f0000000a40)='veth1_to_bond\x00', 0x0, 0x4889, 0x3}) r4 = syz_open_dev$binder(&(0x7f0000000280)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f00000003c0)={0x4, 0x0, &(0x7f0000000180)=ANY=[@ANYRES32=r4], 0x38, 0x0, &(0x7f0000000380)="a4d7b2b8448845b3f3d303c107a8c97df8780092eb35c569c151f915960e98eae99d6cf197ce0799eb894fdb1bb3528f035652744d2df188"}) fcntl$getownex(r2, 0x10, &(0x7f0000000000)={0x0, 0x0}) sched_setparam(r5, &(0x7f0000000100)=0x2) write$P9_RREADLINK(r2, &(0x7f0000000200)={0x10, 0x17, 0x2, {0x7, './file0'}}, 0x10) r6 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000040)='/selinux/enforce\x00', 0x180, 0x0) ioctl$PERF_EVENT_IOC_REFRESH(r6, 0x2402, 0x4) ioctl$SNDRV_TIMER_IOCTL_STOP(r2, 0x54a1) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, &(0x7f0000000f4d)}) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f00000000c0)={0x8, 0x0, &(0x7f0000000140)=[@release], 0x0, 0x0, &(0x7f0000000340)}) getsockopt$sock_linger(r6, 0x1, 0xd, &(0x7f0000000240), &(0x7f0000000340)=0xfffffffffffffefb) ioctl$ASHMEM_SET_SIZE(0xffffffffffffffff, 0x40087703, 0x5) 18:20:24 executing program 2: r0 = socket$netlink(0x10, 0x3, 0x4) writev(r0, &(0x7f0000000000)=[{&(0x7f0000000200)="580000001400192340834b80040d8c5602067fffffff81000000000000dca87086a5c000004f6400940005891550f4a8000000006700008000f0fffeffff09000080fff5dd00000010000100000c0900fcff0000040e05a5", 0x58}], 0x1) r1 = openat$null(0xffffffffffffff9c, &(0x7f0000000040)='/dev/null\x00', 0x800, 0x0) writev(r1, &(0x7f0000000300)=[{&(0x7f00000000c0)="706929317edcd24548cebe7271c31f38e2ce7f57e18109deb5c4791add7838209dc41a92b2c9df715e02b27a52c2738feea6c968e6eadcb6607cbc7acc6a418549742a149aaa0dfd914e0f25dd0f49a550a1116dda47273c0be611f8f47217930df63b1e81f0b20d0725cdfdb648bac75a8f", 0x72}, {&(0x7f0000000140)="fa58f662b69bd5a83c8805462a79e632ed3a39f19e36ae5538d15f4bed62751e2ccc0725d5df425d7cb1f61680958c7deccdb5a2a1faaf6b35248cde2f8a413dac30e6e2a0d8a43af4f64be05e6fc623a3864165cf", 0x55}, {&(0x7f0000000280)="b35af825d9b96b746ebf5e040138021f3de896fc3084d19676b9a6e1f7d7dc2dd0ab8e6bb7705500264e457d2d5e7ff6ebc70e0adbba8bf9c2b781066a392b0eed5ba453844f8a2e3360ae655df230056b6af086ce4e372ae9235c18146ae69243993b35dfb807333ab8946fec534f7c07e0a755102a8bb4ad5510420dc774", 0x7f}, {&(0x7f00000001c0)="aae44de05fbe8fe41b135c7a3d", 0xd}], 0x4) ioctl$KDGKBTYPE(r1, 0x4b33, &(0x7f0000000080)) [ 492.229835] binder: 1150:1168 ioctl c0306201 200000c0 returned -22 [ 492.326490] binder: 1195:1198 unknown command 7 [ 492.346658] binder: 1195:1198 ioctl c0306201 200003c0 returned -22 [ 492.372890] binder: 1195:1198 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 492.381343] binder: 1195:1198 Release 1 refcount change on invalid ref 0 ret -22 [ 492.390462] binder: BINDER_SET_CONTEXT_MGR already set [ 492.394378] binder: 1195:1206 unknown command 13 [ 492.394386] binder: 1195:1206 ioctl c0306201 200003c0 returned -22 [ 492.394898] binder: 1195:1207 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 492.394980] binder: 1195:1206 Release 1 refcount change on invalid ref 0 ret -22 [ 492.422013] binder: 1195:1198 ioctl 40046207 0 returned -16 18:20:25 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000300)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, &(0x7f0000012fc7)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, &(0x7f0000000f4d)}) r1 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rtc0\x00', 0x48100, 0x0) r2 = fcntl$getown(r0, 0x9) getresuid(&(0x7f0000000080)=0x0, &(0x7f0000000100), &(0x7f0000000180)) getresuid(&(0x7f00000001c0), &(0x7f0000000200)=0x0, &(0x7f0000000240)) ioctl$TIOCGPGRP(0xffffffffffffff9c, 0x540f, &(0x7f00000002c0)=0x0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000500)={0x0, 0x0}, &(0x7f0000000540)=0xc) fstat(r0, &(0x7f0000000580)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r8 = getpgrp(0x0) r9 = geteuid() r10 = getgid() ioctl$TIOCGPGRP(0xffffffffffffff9c, 0x540f, &(0x7f0000000600)=0x0) getsockopt$inet_IP_IPSEC_POLICY(0xffffffffffffff9c, 0x0, 0x10, &(0x7f0000000640)={{{@in6=@loopback, @in6=@loopback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@multicast1}, 0x0, @in6=@remote}}, &(0x7f0000000740)=0xe8) stat(&(0x7f0000000780)='./file0\x00', &(0x7f00000007c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r14 = getpgrp(0xffffffffffffffff) lstat(&(0x7f0000000840)='./file0\x00', &(0x7f0000000880)={0x0, 0x0, 0x0, 0x0, 0x0}) r16 = getgid() sendmsg$netlink(r1, &(0x7f0000000a40)={&(0x7f0000000040)=@proc={0x10, 0x0, 0x25dfdbff, 0x4aa5af9e43b5d800}, 0xc, &(0x7f0000000280)=[{&(0x7f0000000340)={0x1a4, 0x12, 0x131, 0x70bd2c, 0x25dfdbfe, "", [@typed={0x8, 0x15, @fd=r0}, @typed={0x8, 0x75, @pid=r2}, @typed={0xc, 0x7d, @u64=0x1}, @nested={0x178, 0x39, [@typed={0x8, 0x27, @uid=r3}, @typed={0x14, 0x96, @ipv6=@local}, @typed={0x1c, 0x79, @str="257b73797374656d87242f6d696d655f7479706500"}, @generic="1f00a6d26dfad5a800724d424aadd5a51912c853920be53c1918b6fc556bdf10c35e690464ad41b4237010e64200d62700bafeb762a36721d196270cf9dadcea514cfc497ce013cb2e76286a5369c975610b6c7b08ce2d219314", @typed={0x4, 0x1}, @generic, @generic="9eb57c67f15bd5443a7d6fd56ec1e458c34d45ae94f0b23c3d53b8bb9de9d8ea40feef60b7de4486a4b910a31dff17d417acae02f0cf60c566c2a5c917a33955b686a22698474a225783e289db77a6f63d24399cbf28e9531ac717c2e748a2c6d66e11186ffee673db4c31b7189bca2b9640b4cf339ffbb111a5cedc7754bcde038f28d2129ee9d1870e19970f957d63ec4ebdad83e32f56cb2eabfdb014eb957688604de1106fc7dd4e162e5d809fd3f7eac0a6185f2128b4481b7347a02a0a1e2f27315c1b2c78fc87eb63cb8bca3bdeb0fb", @typed={0x8, 0x0, @uid=r4}]}]}, 0x1a4}, {&(0x7f0000000f80)={0x12a8, 0x21, 0x8, 0x70bd27, 0x25dfdbfc, "", [@generic="37aac44ab937665833e19c743837f10ddf7ab7d07f2a9385a7c6c306990da4fe4ff67457965e28bf3ac9327208c30a228549c8e1dc845021ddd811eb6ad1362ab6", @generic, @generic="eeba44aca98fbaff875f75c54e42e9a3b46a9fb00bda7322553eaaad0a5b614dfa844ba74882c53dea3cd46af2bd56f8983b7f8ed833734fa0d7a471ad20532af7daa4bfbe753d3b41119c05c45b8d0cdd90c1bc1fb6c0825fbeda35ae9bcd0485bb87b1452a9d5914764ab58623406102c2cbae70a2036748430783a2ab03568561446539a2348c3669a957aa46df57d34d1ee1dca9f1b7db4b83bc3a7cccbccbf4ed7cfa0c46d428c99947983ad70cddc66f65ee477ed78e880b98abdcf07748d8cd21dabf572bab21476d23b4be9c1499e7050c841e7af2e3067b71ce378c37ecc997592da6067eda3a47c054dfda08d206f7a9", @typed={0x5c, 0x73, @binary="8d1e4ffe6c2587c2306082e00b0fb29468c991a964207d2e6f7cee51d09b937c661389d96095639dc16803d29a604698b406b622347f32c2c42d4bf3b3af78610f093b587ea6ac4a20fda2c774d2728716d0c1f148f813"}, @generic="67a9e350e7b211ee666b386215f3e5bbfb7e021e02b6951b47a3cf530b010b6a2de5489cf9ff8c92bada67789c39431c1876a77e54bda82561d9982117a5c3b5097c48407ccdee716b5cb35e3f953f7489ce67eb9048fa67c9a501688f83ce3475aba9b65f1825230c23f005c23f689734a16abad4913893bc206d4be5dd8752dc7d63999bb14588776573cf4763cf76fea93af159adac14e6a525b24365e045a673ce4c6037d0a26e4eff33367b267cf2850e47b98b4a1e261108c8fbc603670a472bc54718ec9bab2d1e9c586f3b4ff6a52150c527020eda4cdffaa3089b115e782a30be6e58eed0e9953d423ce5497613d58f33c883ede24d44e878e275d78a4557e4586775d0146d9bd7b213b223532df826398b667b8d177613d638492365a9885d8050b01a66eeeb511948ec473e97d706f3f297c71149b29aecebd91bc18a23c7d27eb483ca21970d5f53e7d5510f41a3ce88ab7e33277c6a1fc2f4fe4ebe7d02b995cdb6ee7bea2c05e897457f2b31cdf6c11be8efba9393082987ac9fb84416bd2b169ad72159107f7114f1fc3427a979f28592a658411cc1ff3f1af9bae3b6bd1579a002639f31f8178da9deed0c09236c159611d33d47b20d0aae888a30ea3730d423ec48ebc71f277225af776be084e32c8683b03aa2bad3611f557117f087525eefd771a60da0aa87764ba5387f1099772af5c79330b059b1d14321e723e7c1e7d2eb4e72cbaba843f8b796550a78c0310679788e1805228fa17524c88ba3a09ef055eeaddab198a04cf6000acff63456663d9b6e1e14dd75373af246506802fbd3208ff05fe50de97ce3355c954ee84e75741219ab3924324f7f34602856df7612e96c89915d047df07d51dd7fb84eb11559becef62e1053c42ac7c82bcd8253d6c3563330cc4c46a022463798d366507874704371b643261e6d4574a3776864f0ef5ab781b10173c8e960a674ffb87c434604cb2eb5c74b035488a46c21499021ba02d9ff861ba53f50f244047b70c490435993d0a5a77a4ea212110691ca6ca4ebf68082068a4960c88f62709e33664494fc23e97380ef2dea1af298b6e03be579f5fbc9acd6d6a3565268a0ae32df0de4f4166e92af104d40e25c9c22655bdc349714e7874171854796748eb2a5af783d35e850e34da9fec42131c83d4e232650d2d8b05bf927ec4b10817a19ebf0dd20647868425ae474c13a1ab4fdc4b863e310eacbbeec47857c775a9ab3bd5b042a607f60caa728e39a05ae5dcf696918044510e73e1b58925c01cebb1d6449651f75f11f1ba667072a460e091787e91a990c7ea3c59e19782eafe8422c22e697176bc4d643a6ffc28666635f09cc6e6bbe3031d1174c0cca2e86569b2d3d317fdc4d95e1280ec744f795080230910a9bb29d6a1342ba987683cabb8bf9165d12fd2d12418145a4431aac46208518d469a7332e1c01012ace1bf6241505cc774db9b63cadd7b6855e2e873ca0d18355cb55d0bb369504d4c0c5abc2e0804febde8c6e3acfbbe961c6f75e86fbe1119486eae34288fa6ac3f5a4fda04161b57918eee303880a0ccb6b0e3233683c00bedb2c932f241185539b0a164493752ecb32db7228efed4e8dbda94503fd3a52adb0f2d73b30f86af41ee3a4d4a59126d0a6b3726324c5b4529384a35236be193869f410d5d62c05234a3d86db5cf166fc5e2db2b7b7c7f7ed98ad8ed83e22a234d003a1fd22dbc1977c1364e61baebae1c82a8d265fe26b113792f7b1231d8113f4d5107e622e6faee98a2e2edc68800a7f0cf50f215769d806bbf86d32f35d064c6cb4aec442f40d8ea3c02045d8025b1a6d7362e3e44c047f57bf62465e95ee314f92b5c3c87df5d551738cb81095139925e9a061dd0f5377d2d7b154abecf4d6d50df0405904492a5659ce252f485528830ecdb609ea97ae10969656229d9af20de9adaf5fe0b021bd77d3e19a1c0ea2cf4301c1d321d3937e67b367f8d00a00caf059af315fd4d4531dd4b6a3e9cbebe5da281e7da169b83f146d12f4b44c20798b22be1eeca19ea3061d6b22aef658ce6d7917311079e485573bd921aac9df6e177e76a40f7d6a1008288bfb7da75e318201c8c903a43182c2c1b58517d2e50d3a75657a3afd6d3960b2cf8867e6336ac73099089577d92f99384563519ba38b8a98d5bf71e206b5a43b9a55daf51eb8318bf26a42b694f507202912466d1a4b9e447930f1173306ad5b90839014ca7fe474ded190c1ed6b5975bc491b31c53790fde31b7686d6418e62ab6b08fff103e74e7186fe4863d69d7a543d03b1fd5cb22bceb734b8b3a534ac9b2399ea54a94a978466e43fdfa8f917a465f0e864728b7a96c6a8e1993e404833b7e3af976f04bf14999226cb33da19b5c73770b6ce2863238841970eb6df55cfc76ecd3a037c142dcbe958afd1d66f5a6be18a23ecfe918a9d84ac84fbcaeab007eddca45296076cc432cc26b0140663dea92d99366cb3f933bd2187d6566853dc55be8558715f3a1acdcd82108b9771e8c0d1db43409d5c9e2be0b45f0bf529ac60afc855424160ccac098f948de35d3c89aaf8bfb65367b301bfcaf8db23cfe3f40e97a872fe27e44228aa2ab8d079119685eadbfd46a24d7f794c1c9935de3c549a3dbb46b1554df47c41ceafc1550972556ca6b2ac9166938cec24f6e35256981d1e71be960f1bbbb40f73077a0b3011ca39e75e0d60015cba905335b12839798a0d4e13ed58a6191fb470f095f320acb985a460451919e2bc7c2501ff48fe1d60f3c49bde6d0d20f0a7a44c36786c6261da24b02c730e7b0b1526a4b80a767a835a67edbf65ac71182aebae32e28112eda795ab4638cb9807204484cba94daa9413745e8a319a9c76619b43695c08287537117b2f7d27bb6c71882ef6b91fdf199f48bd57ce6d1810660c9be417d475401edfd4b9e66f4a171a97bd19dedae4e8dc7bc07f1c6a5833418dba91a8e7b5da1cd21dd77961e2af620bdc8759e0f7caefb10b964f38c458a9e554df992fd7f725c7541c70c62ffb31e60949162ffe900e9d32a416d41d2881f3441ff699c4b368bdb538c70133eebabdce98fe9b45dc491e5b3cdef0c34925e9c9f1fb436a3ec19e4cf709ce2cef6143d39b00fb1f9dbd6cf3d2cc176146931a9f563c4caf1bbda6ef6995a2c6d395dc51e85a1157b60a24bb3592584d5bb30e3e481dfa5edef6e6e184860e8e0b576b33e2eac631aa5dab54c0e0cbf1643afa5e3a92e1bd60633bd882137332aa2c41f11330cbd56379b326a8fb677f6b3d47f788629baa02059dda47f5531a9c0b30f74bec05b01a92b5e6407e183b70c72f9d20f788087d1e482eb9b2d98cdf0a98f50d6dfda53b328d3157f2472f64c0eda34e7019b2d20e2f4f68357b1879b8b5db7e8bf9dfa04d6809b4e91dd0be8fbfc96686a0daf64fc5f099581893e8205d161303eaa75b5bdabbdd1d092add19728d47a9952130b74764fe8a5e6a1065bf1fa72e4fdea7fa084fa144fd4a6ebd100428a572518c436f18853860a44e6a89fef1acd569ce8c7b3cff855056d6469d575c196bdc909d68311c37ef12ddaee8c0668296846c2c0ad3392a9f2e437c47002702967fb64fbdf16dd9c2886e893cfaa738b041b124ff1945903363d94f79786a7f932cb08829e099b677729592e10001fedc1e0469f35d3ff4676b4487ba63d9cdfff358af3dfc1f0b161f5bb54cfa476da21d1bf17dd360544e50ed7b4d0151159673dc4dadbdaf7faeb3a1edefe35d6d4f33521bcb871ed64d8c7e85549af3520139fe802121ef233334eb564dd8a8416a89b67110440d03b04cd575daeebefab9c5c42e78b2353fffb98ce9f6fae628a15f10e2c2deb4374fb713f6ba9fb9d70547046f4e24c06873f87c54c75a1b58a3025f2975142f5956882541afa8f48a7189d28c42b40301b83f1093153555f85e4826aff9a5100cfa3838c777dabca9ecd5460a7901dd07578e8f864fe3002322333c23428fbe853b091b88289237f3e8cbfe571469afe75707f8b6a161d27cd74936d5445e73f203d226a4d02a1dfc5dba15ea4b77e44e8272c2afbb9c4d9fffa9500404fddceafd7a595613878c282b028157ca00e7d387f97d2f6d61321debfaec907356b816ff19f0e8e47846f8175239f0f5127d71f0ea97af7ca086f8031bcbb366629f075fa4fb1af46dd03049e7a8ffa0caf6e79090566d6ae85cbca0f4f7515fd0a47c6f6479798c446a00da746d40312b132f4fc870c9d2382ab2b6a6946d78020ddd3932883b1d2ee0bc339952241a0e6c48ec3ea98358c3acdf32cde4ad481fd20d2b955882215cdfeb198fff6d13f82f6e770b9ef8e71e080c8894d04e5a1a46da51c54ca08b78887274ae77ab3cc7c81e298973a487193f0c5cb7577a9413ee003e2d4e960dfd7b3e5868e79f0760956204e0800f6436acb481c9e71fbe84a2837cc5ee0ab0e39ee41fb5f80df572d79f726b049550bac03c6adc27807010901b376049f6a7d7e0c5499b8215700d0c2f8994acd2e8e67722171cbc2c4e3506e5dd35725213566d86eb5bca09af856db626ba5948143bdb724e65d926d3011f45377d0ca36fbcfdf22f7d41a50e0f4f532f1051695de9b2ba342d8f38c8500161bbce4ec463c68a2cecb426b68e672641112489d613c56f4a46ea0b626827121d94c1b3847116be65a4f6fb5d607d5ed2c6b87f4e7d0884804a2a71c24cc82f7f258a015897a0f50e538c031e731a83bad3ce1a14faa7d02b75d3d8edbf6b211ea64fcb234d7ba4b0962f43992f9815a63f4ec163cb63f6d9867f17e145176d909b3da8f7e921e0998ac7d360219b8bf9120b4c3eedb006c1185cd83b9cb3f713a88ef42c2887aea80869343bea20f7e7223017ea587953b70f8070c774e4ff1001af387cfd06e2d4dd2c0607a432838957a0e42eee61f66c2f3b5fcf078b706a3180116dcfa0640674cfbca326bbd5a63eb4ad7a04a2d9e8ec1b0db5fbc6254f6c20f836e1a3e2c90d6d1d854b46c2f14b537ecb64eabe8e47b8688d182e6f85e50d3e7d44e3f6b932eeeaab2d5f0ea2aeea2f1e6cced35e5a9c485a2e05f9cd3640310b93e8095ff5b86ba3ed5ff77f479554d491c253acb4e8f97c2180f7bcec5c093742da6304c5c7f8f2fc2cb30d5c4fd223e6f95ad77d7bdd8bb801a5403c98d1e3bfaa4e106986ed2bd97585e49b3a358f15f12d682e5a162e7b6776ddbf5eabd7b676237a6f8f08140365d1219c1c327b4667940b5f5fe4c94fd820361570c624e8d3b8ac20f72078270a4603f181be9cb3aabb649dc44cc48c46b5ff4f46aa94118d45162228495541df2ae3d6351661288fddcee39b4f2db3b7d60c0788ab5451e56823846f317ec208f5aee319f3e11d58c5f9e6ca9a6cba522b9f26bda69122d270aae912c1171386e596403e5552b91f56441e0c15bdad4ca44620ba8d9fdb69c003db9c41566a7e5828dd88a98ff545a23d8d84f134f3efc1b34e9659b79a1bee3f61db9e88e347c109e175321cfdb125aaeed02a611a0e4a47cf10d3443aa45fffce79d93d0817d36bf8bbe74eeb442b993bda4939f308f4ab6f9d93cc2f0bff80f531788948ff2149abd973a57e87a2994e487dc88024837870673f80f7eb182b3aa3f81361647f6084d7d39188dfad3e2b37d8658f959ae2409979a8be9443452b71256d5f1840c70b9b849845184f5e72fa64e60939f2d371ca623ee9d638e63818d73a4dab9ff83d1e7203cea59d77a3f537a662c118f75e1b95f0", @nested={0x104, 0x6f, [@generic="0beb94f3183ea0e648e1c9a383f1171651ac25f31d26ca13dbb03b7982f2e3facd349241b452ad1ee9513d1c8fcdc549d6bf8a33d70fb0abab093d7ab5e00d07", @generic="a159a935f7c968b7b753cca6171ff37700f46b5799d87c57c028b1f931ff2f40120d02b99b16d4074201e40aab2ac77a36f4a42051a67d3699eb873c41c372248f82b7b468eeae9a0940bc0ea6b511b580e28b6861473a79f43432e0c8428b257a51c296a6172eb11507a5bcf955ba933cd6ef16c41962b1db1579361c76288e99ebfd719f419fa0d5d5f6ff26b6733b0f6992bfee7a0f674bdb5a8eefa346a8a67ee197451ce126126ee1b56903435bd78651bd6ec36d5fb0a9c509791c"]}]}, 0x12a8}], 0x2, &(0x7f0000000900)=[@cred={0x20, 0x1, 0x2, r5, r6, r7}, @cred={0x20, 0x1, 0x2, r8, r9, r10}, @rights={0x28, 0x1, 0x1, [r0, r0, r0, r0, r0]}, @rights={0x28, 0x1, 0x1, [r0, r0, r0, r0, r0, r0]}, @cred={0x20, 0x1, 0x2, r11, r12, r13}, @rights={0x20, 0x1, 0x1, [r0, r0, r0]}, @cred={0x20, 0x1, 0x2, r14, r15, r16}, @rights={0x38, 0x1, 0x1, [r0, r0, r0, r0, r0, r0, r0, r0, r0]}], 0x128, 0x810}, 0x800) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x8, 0x0, &(0x7f0000000140)=[@release], 0x0, 0x0, &(0x7f0000000340)}) 18:20:25 executing program 3: r0 = openat$zero(0xffffffffffffff9c, &(0x7f0000000140)='/dev/zero\x00', 0x200000, 0x0) ioctl$KDGKBDIACR(r0, 0x4b4a, &(0x7f0000000180)=""/29) writev(0xffffffffffffffff, &(0x7f0000000000)=[{&(0x7f0000000200)="580000001400192340834b80040d8c5602067fffffff81000000000000dca87086a5c000004f6400940005891550f4a8000000006700008000f0fffeffff09000080fff5dd00000010000100000c0900fcff0000040e05a5", 0x58}], 0x1) r1 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vga_arbiter\x00', 0x2000, 0x0) fstatfs(r1, &(0x7f0000000080)=""/157) 18:20:25 executing program 0: socketpair$unix(0x1, 0xfffffffffffffffd, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) request_key(&(0x7f00000004c0)='user\x00', &(0x7f0000000380)={'syz'}, &(0x7f00000001c0)="3fcb00faffffff00", 0x0) 18:20:25 executing program 5: socketpair$inet6_udp(0xa, 0x2, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_inet_SIOCSIFADDR(r0, 0x8916, &(0x7f0000000100)={'dummy0\x00', {0x2, 0x4e23, @multicast1}}) request_key(&(0x7f00000004c0)='user\x00', &(0x7f0000000380)={'syz'}, &(0x7f00000001c0)="3fcb00faffffff00", 0x0) 18:20:25 executing program 2: r0 = socket$netlink(0x10, 0x3, 0x19) writev(r0, &(0x7f0000000000)=[{&(0x7f0000000200)="580000001400192340834b80040d8c5602067fffffff81000000000000dca87086a5c000004f6400940005891550f4a8000000006700008000f0fffeffff09000080fff5dd00000010000100000c0900fcff0000040e05a5", 0x58}], 0x1) 18:20:25 executing program 4: r0 = syz_open_dev$binder(&(0x7f00000002c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000005fd4)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], 0x0, 0x0, &(0x7f0000012fc7)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, &(0x7f0000000f4d)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000000c0)={0x8, 0x0, &(0x7f0000000140)=[@release], 0x0, 0x0, &(0x7f0000000340)}) ioctl$BINDER_SET_MAX_THREADS(r0, 0x40046205, 0x846) [ 492.896193] binder: 1154:1170 Acquire 1 refcount change on invalid ref 0 ret -22 [ 492.896465] binder: 1154:1209 DecRefs 0 refcount change on invalid ref 3 ret -22 18:20:25 executing program 0: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = perf_event_open$cgroup(&(0x7f00000001c0)={0x0, 0x70, 0x9, 0x6, 0x98a0, 0x3, 0x0, 0x2, 0x1000, 0x8, 0x100, 0x3, 0x9, 0x8001, 0x1000, 0x1, 0x2c, 0x100000000, 0xd12f, 0xa72b, 0x6000000000000, 0x3, 0x9e01000000000000, 0x1000, 0x8, 0xa6, 0x1000, 0x7fffffff, 0x40, 0x80000000, 0x9, 0x0, 0x900000000000, 0x7ff, 0x9, 0x6, 0x200, 0x1, 0x0, 0x3, 0x2, @perf_bp={&(0x7f00000000c0), 0xa}, 0x1000, 0x0, 0x3, 0x7, 0x0, 0x10000, 0x3}, 0xffffffffffffff9c, 0x9, 0xffffffffffffffff, 0x8) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x2400, 0x37b7) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) add_key$keyring(&(0x7f0000000040)='keyring\x00', &(0x7f0000000080)={'syz', 0x2}, 0x0, 0x0, 0xfffffffffffffffc) request_key(&(0x7f0000000100)="88380000000a00352f71fe", &(0x7f0000000380)={'syz'}, &(0x7f0000000000)="3fcb00faffffff00", 0xfffffffffffffffb) 18:20:25 executing program 5: request_key(&(0x7f00000004c0)='user\x00', &(0x7f0000000380)={'syz'}, &(0x7f00000001c0)="3fcb00faffffff00", 0x0) r0 = openat$selinux_mls(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/mls\x00', 0x0, 0x0) ioctl$BLKPBSZGET(r0, 0x127b, &(0x7f0000000100)) r1 = accept$inet(0xffffffffffffffff, &(0x7f0000000000)={0x2, 0x0, @rand_addr}, &(0x7f0000000040)=0x10) setsockopt$IP_VS_SO_SET_ZERO(r1, 0x0, 0x48f, &(0x7f0000000080)={0xc, @rand_addr=0x8, 0x4e24, 0x3, 'wlc\x00', 0x8, 0x7, 0x57}, 0x2c) [ 492.941702] binder: 1215:1220 unknown command 0 18:20:25 executing program 3: r0 = socket$netlink(0x10, 0x3, 0x4) r1 = getpgrp(0x0) fcntl$lock(r0, 0x3, &(0x7f0000000040)={0x2, 0x3, 0xec78, 0xfff, r1}) writev(r0, &(0x7f0000000000)=[{&(0x7f0000000200)="580000001400192340834b80040d8c5602067fffffff81000000000000dca87086a5c000004f6400940005891550f4a8000000006700008000f0fffeffff09000080fff5dd00000010000100000c0900fcff0000040e05a5", 0x58}], 0x1) 18:20:25 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000300)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, &(0x7f0000012fc7)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x112, 0x0, &(0x7f0000000f4d)}) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, &(0x7f0000000040)={0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0xc, 0x0, &(0x7f0000000240)=[@release={0x40046306, 0x4}, @register_looper], 0x92, 0x0, &(0x7f0000000340)="66af502cc94b006579e94bcfd44f45c19e0ec155810f848a64b7fa75710d6208683c5941ad2d41be847b05b4dc75740dfaee265305f56177bb2cfd8d105c3f2f690b5818863e83322cb002cb8442f48f71563b1fff5aa01b06cb2eaf946a1f0f98e0b3cf767286b25805b1fbf048ce91b0da51b11fff48217c2dc49dbbcbed8f2c358c15cd2632c23c37a923e021907eee80"}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x64, 0x0, &(0x7f0000000180)=[@transaction={0x40406300, {0x3, 0x0, 0x1, 0x0, 0x11, 0x0, 0x0, 0x40, 0x30, &(0x7f0000000080)=[@ptr={0x70742a85, 0x0, &(0x7f0000000000), 0x1, 0x4, 0x13}, @flat={0x77622a85, 0x0, r1, 0x3}], &(0x7f0000000100)=[0x58, 0x0, 0x48, 0x0, 0x58bc959c8bb60626, 0x48]}}, @increfs={0x40046304, 0x1}, @clear_death={0x400c630f, 0x1}, @release={0x40046306, 0x4}], 0x1000, 0x0, &(0x7f0000000f80)="b6026c289513b742519dceb1eadc298283ff2eb4ff5e929165cabd214c6514ea0fac96476a9fe952dfbefc802fc7a71a89ce525f739952dfed95ce89ddddae7f55260668a5a235591c65eab3b9e1f7be2ee4ae7261bc7750d203d2fd2651b5e3687d3938ad011fdb99d2cd93eca7e3869638adf31ec83f5bdb9b7c88c1d16e44eb40410c02ac47d4d2da514ed4e151b2d4295b04c657ea4edcd44e19632841e437c4beaf1b0d81549e8f55554f3369ef454a304ec7bc47d0d2a1299b899657f804126e82a87ccb815e61da5088d1dc2db4e76cc443003a89934fa830841b6b956182b729907bd758121a8c84fd410363b0c4f147b1d05a3981767ed3903e39b3a774996683b984bcc84441da046893ab080b4097f180b3b4648acc2f7a1a7a4c2b5165f5022d11674636b6c788b06e78dd5e3b8fb210c16fcb8996d49e802fba5f9c0c023db0522fc3e766c40422f5720ffa7b0e335201b9e92d697dfb73c273fccccebb58ce2e24e7293c5c61d4e7df87ccec0bec6d9f2a866ce3abe9c914220b316370867383fd1bb4cdaf2d03acdf6a46df17df9d2753144f9c69dddc58e3939f74f9899f29fab68261c752efd0966c7640c19fb794471e78e0e665cf889fb72ebdcec6a861eea83a11548c97e9acb2d4d3575758bf231bf8cdccf3a19cc4cdab060e9edc5c2c4c45518a37f05efc2130d68120bea015ebd1c4a8bf3b7146ee429358d4ee662673053bfbc8d76836a8f3009f09757efa99a62ed1179047a421ce27895e400499cad6216d8ba83021a9c5f23d87b199ad1233eedbe9c54ec5886fa607a790bab29be1ab11a0f377f98fbca7a9ceb1def30cd3835ca651a6ab757b231021eb945356b8df535924f546722a80ce19ea6093efa44b89c276bef68b1d1357aad5c07fe982ed137290e49ef05d91d709d9537192e93eab8cdb83020571af84ba14f643b9fe02564bd59b87c84212d5b500f0fcfd887f871908d23913a6afeec2bf932e1aeb0bcd8e49551fd86521db9706033c8925c2d226fadbd5edf3e0d5049e2c91fe6c46a2ae455370ee29b0cd66882b39019a5fb4b279d495c0e0dff18fa2133fa4412713dc282ab6911e915b151cbe38c79da0c59220d06c491675a81cd4f6dc5c74f6b6a2f3befc8c8e936a8999c998e87207a689f73d92a460ef82b95f09abc89fb8eb1ced29fe8a7ab757d702ca3b2919b53c50daa61e6d29232a63526ea6384dae87c439fcafb7b5131591d49ff9de22e75a6dd4712198d82083fb2b51a6caa56cd33931ee9b55c6adc6676c458b097f578c93a14a433afd60cf875c081758f8ad43cd814e93fd8080e2d7bccddf71237cfec90e48975396fd6aa3e425d7263ae5e15c00e85a0500b19b5c62e9199bfd97f597a26b61503bd5a84f1a031ff057d4efd6d3d9461bcc0bbf722cf240e09bd6237e0628e7106222396c8f82e1bb6261b2a3830f410c01a17fa924e932b785288de365c8e2e54eec5703760a6772d9f22c5c7ccc82401c6ecc01dbf811d42a40ea573fb88ca7939d3147e6c516dd3afc3f96e7f35fc37ae20f415a74f57d8c4877268e3418411ed28c453d283d4164157e13b8104e116ec92ca0e14d084c661fc5180cde1e7ddf3f7255956e69d0ff8f73029ef61ae78a16a83594d963dab981569988f7770bfbce5457211ee16db491f77f0a9bda00e2a62e80654f15eadb555394742dc30e2090a1ce6c0f23975076d522bf54bac2d46417540477147c72c3a8571af7747819575c711ce2d29c881109857b415cbfe212df81a38b95092f0261ca59d5deb8cb51c6d4686fab3fe3f122f9198ef0292338d8395d8c806a3aea7bbb76bc23e7bbf0643f3d53031dc352b6d73884a147062a835d07b2938c34ab18273851ba7621f2726b2d6cf67e1bcdef2fabb0a6b5576003ba731fc6b03deeafb96b7db43fa26c71b254991936a5a024a05145c536d279e8a80475efdae129a89ee3255a658716e50197bea97c431dc2b9d6086aad1049c90b1f2e57dcd8a6196a40309a7ad60dcf083f3fa20292a49e43c28682f1c353a556215d47fb22f1e2d125290903230c0a80ef0c886399631a8d9123e578223522766d66ed467fabe4aa94e0ec92e2575f43a6ab42bae845fdd945b54c3b26dfbfc9b6a8eb52f314a4abd0be7c591fb19a3b8abae38eb772d0e219edd25f38ae2882a148e1cebbe1bb3041b1e287278ddbbc5f35b2ba4f1b467ba3d1c22398564cc62956ee01b5b8e959439ad5dc1cae799e6027a3eb612481eb007e6d8681e1649e5d6e4d91553e4cf65793c109d890cd923d55da2912ef9233c8ac89b5e12216969b86519e5f32848a69332a13232a7d5eb26be8c8cc0e85246b666676d35418c1f9a993d4bd2d75017162b0fd4a4191afd0350b91d9173c015e9ff3155de64e2a7d34bd2f4a09cb2c77dac8a0c44f99e37e5e9eac10a0059be2743b77cd50acebcdf859ee825e7b266bb0a0c4b7948ab8e4d736edd6f2ae83a0afc777a88b8cf41c0985fc3b3edf85d1bcc147097a37e0e79715a0e4eb93af46aabf5e004d31008b9fa5bfe30b074410dcfbf2efd97c9491c5df314591047a84fc73b6ec3fe2e03473b1247ef7726173174adb7bf5c869a8fcf37613be3e659a9f59b7effc301d29f630d2edc2efdbc1df3738d747b5cd0e09ad31827737668448bce441b0ca2a1fbdc015148daa09f0ec9345a5456153e99fa414f1160abd0e0a7b303da788851046f81d74e536bd7525dc876946bf452ef027aea1ac5d20b11818075d4dfc05cf96e5487f88d1a87e12df9682cf98a2c3966b63d06faa1d713d119b19acf79d586e397fd6b93fe8c03cd9c28eb35243a977749c0b4417522fd65db10e809fa9e63bb40e93ef5deeb33b2a9e847893cc34be0c17a0da82a10c53ae849baed1583d2f923791c6bdb9d94faee26a0ace210c13023e22fd989968f5541e28124feafa7f0b5fdd2a3b995b718f560e4b82888b762d9a6a7cd1b817bf5270bb3abe7e11944fe78bb86a0e2416f979688a37bad70d85e745bea508c8933e6fe600ca5716efd868133ea7791766d0e4711d6c295fd1780f305b094edbb2102c9cf20c8baad8a159cdda6f4d57e4e798dfb746e9acb4315941f6d1373ce3ac5e69cde41db37b817cededa2b5b37221f0982ae0395ba9c0f83812bb9a5408c7c0b9986534291435ca9554f913519c5035c6970aaa084137068e5bddaa4f27b3ac16a6744cec3d4b32ca804589b5dfd3a7f39f306fdff1cc8d26d0f0bb8ea7508785d2a21000f1ed57216c07f97cd5f373d3349150b7dcdca3d896619f2d14c67c3317f69c196502859c9d24044908b90cb2b3ca34c2316ce1528baddb4823e838e19b3f9f91107369d84902a275d8075cebf21ba615273433d21f67b0b9e374f9c79a8ac3597ccc68f24c02b5e4c4862e4962945b1df6211df917b82c758a1dbc2453fda09c11f6f707a3bc7c65258e8b21645bb5879d4fb4180c400aecb19cd7940fd46fe0dc861f1b30d19216731b83a61f9bf32661ad04f4255327fd705662a06255fff71bbed486e21cab86e84d6d061aec4fd4ce2926e0a011081ecccc8edd4e1c1bf1005eacecc41953d02baf1cf2d6eba23c14ebeddf27a1f7a1cde631f5efa5ff06c53a4c16f7786fcd6d3ed3561e7566a66c54bdc7cc8979378d700d1fcbd1eabff15bb25c187f22dc07d7552f855ba0138e020dc9b4f053daa7bac78d515db070764000d1b07a611772c16cb07467735d9e2813445aeb0ef6245ca20abd4b59d5a75ec6fa8fd9410068c6df0495bb97d75cbaef668ae66aab39e2af40994c8fda2955fe4735b1149d04e02b08a7dc8917caab6173d95bd33bb89549c6dfe26d49d684da6c821b6421e52a0561cccaac7d65c3ccddc0389a2655e302837077b2e2fec9c0429b9e6b8ece55c8800d8bb5d16f2bef2f8f30f75e9614ea5f13a697277628f70150ed68ed0564ac452337c9cf225aa0a2bdfc56377c8918ead7f39f1ebd91d9da82dc546ac2bd7e5cd52800a9c6bd725ed191cd78952ef76cbb529f7adb36ea11c1dfda1587c336a42a76da2bf7f7ea0d3ac2ce4a90b3eefba3d148dd5fc0cd8e0f3da532ae4fad67bdc13ca13c0367d1c16b080867f9473e538468654bf54a804b5467e3e99730d69c0d0236b14b375c5b2f0655c7e4f9f7fa32d5fcd9e1578d8a8e2f73654595620bcd0fc1470ba78af410f937863cc2c747466e9a8a3484aa757cd1ac4315813ce285f8947e0a57fad433d44896dff19feb9023294aceb518e0761d5fad842c6418cc94a8041cc3d8fbc814f5ab8a791c7dad28c6c7663392eb0c961cec22364ebbc82e34762b4003415ada1989dcf9bc1a9318a6564275d0735013c95200303786cb1a00cbc185fe2ea9dac5c1255ee1b1d51f1b679a44557b7d18b5c6023512580b276da402178a23cafea7e216a084c14667db8aa3e4af278e93faf9ada6c5e7460d5cc94c9ff42f07de7219df449c0dbdc701dc891a5e49313976473b4f65b4b92bd4ba08bd160ac48bf554f7b7fba887cdf39164a74fdc7e0c0d2d1c147e529a4663ffe7ab0c7dde69d72e2dd3e6bfbb3d850148dc580456276cf9f2ed362ebba40cc29e78df968472f508e5203e873c5ba0f34404e6d315343d0e75e3875b826780e4393440fe4b2256415cc5c5b1a8a6befd0364f8890f6618d6d79220f806c5f27128da0ceebf484fb236e91630291105b95198c31ea67cbf448f3ec586c6107d69222036090e7668ac5484a0af38ae19ca8c04219c9938a81a89a56b6c66a68f4657c9d38572dcaecab06248b8f0339e959b0367788bb7030c8e5bc4bc8b168a352a45a1ab7dc50f8412977eb98764cbeea22722d18471a130983c1ac50d668dbf4ee8ebf016a9cfa43ea70bb85334070aa41a7ef6e5d913b98a9ce17182b3c4eb7c72e212abc89cc11b18b84f9b77a523cc75bb4a22111726db9591a7fb5d7a8968199ec30c5e8f66403141bb9621ef020d1fc333fe685c8c39bcbc4b8a720deb2ba16015da6bfb22076cdeb9317f40623cc6bfcf2ebf889cd7bed093c06aeec9a58d59098347ec55999eda6666a04f26f5d34f89bf6b8b643372cc9c28bd8f0f114c6cf7f3ee129f352f2955aaf05b4b1f3b00ad266d24edd9b99d6c43e0b2368d64ffe9b18fe33394a62319952d6df579eab5e01c8fc8d000fe1e10e624aac9d69e44c252a541e0054b7657d5316cccabfbb9f2be471810b44a1e49d388308d73a056cbac4932c78f79edefe428ce2803a3636909cc6fd2d9510017dfc0d809222f3d48f48cbb295a0f5e28d95d3e68cf2c9970a5a5c14968e0fffe5df841f2c3c1a5c229952af76b78a24e6efd3903a3c762d0fd83a6cbb5a6e5fbe66adbf8bf242987bff3bc5443346444197d0471927a7dde21e899173686bf78ff947f270d48449e3905edb56fbd7d8cd1466b36a6fd91af31ef40de43cfcd960b7363ee9ed46ad4fcb474718472fa08f7c8b1d413f71f822b30fd8883bd8aacbd2ad49580603a4cd07caf80b39e6b461301deb59a86ee0e4fca66bbc5b49f2ade889e96d086d874286b42ffba162f4822ebdefc6199bdeb3f11e9d01ecbd23d68529b8fede105c86827f46c9455f956f7ed52bc91943df0045564bc6cfae65496746f25f1d729d546b7961f342109f04a7e56730c8aa7c900f8984a851ecce93e639268ae71d81736b529d4e1e699876328e6e319e6922934cac5c233863db0b4fcbc88eb8fb87979cc28e473c15e382fed7580123d1b0e61d3ad46f0"}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000a00)={0x68, 0x0, &(0x7f0000000880)=[@increfs_done={0x40106308, r1, 0x1}, @transaction={0x40406300, {0x3, 0x0, 0x3, 0x0, 0x10, 0x0, 0x0, 0x48, 0x50, &(0x7f0000000780)=[@flat={0x77682a85, 0x10a, r1}, @fd={0x66642a85, 0x0, r0, 0x0, 0x3}, @flat={0x776a2a85, 0x100, r1, 0x3}], &(0x7f0000000800)=[0x20, 0x20, 0x0, 0x40, 0x28, 0x20, 0x18, 0x78, 0x0, 0x38]}}, @clear_death={0x400c630f, 0x0, 0x4}], 0xe1, 0x0, &(0x7f0000000900)="8df5538ed07e4272d76db0e09d1cd1858f639ef8100031b8bd4f9b894e0173272756307a17037b8e546e5088c8e2d1fc7f9bc453381214035c0c1df369afd65bea289cc6e51193992114dfe0271815d99e93a27686f4f3d68afb1672792a4bcf73a5c426b756dcc255f9c1e067991095ebf808bcb3fba2b0d8a117ea64f69ed29e679562fcb4840305f0a7026702330446d77cac1b9eb58c3bce0295660fc3401f66cb5a81132536609a3999281213e3e41a7df38b261ceaefd62444c721bf68836fca97cc01d06b553cb4de3fc64aaf085ca22f45107d1c7656b7e38c233bb624"}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x8, 0x0, &(0x7f0000000140)=[@release], 0x0, 0x0, &(0x7f0000000340)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000740)={0xc8, 0x0, &(0x7f0000000580)=[@reply_sg={0x40486312, {{0x4, 0x0, 0x4, 0x0, 0x11, 0x0, 0x0, 0x28, 0x48, &(0x7f0000000400)=[@ptr={0x70742a85, 0x1, &(0x7f00000002c0), 0x1, 0x2, 0x4}], &(0x7f0000000440)=[0x78, 0x20, 0x0, 0x78, 0x48, 0x28, 0x48, 0x48, 0x38]}, 0x100}}, @dead_binder_done={0x40086310, 0x4}, @reply_sg={0x40486312, {{0x1, 0x0, 0x4, 0x0, 0x1, 0x0, 0x0, 0x50, 0x40, &(0x7f00000004c0)=[@flat={0x73682a85, 0xa, r1, 0x1}, @fda={0x66646185, 0xa, 0x3, 0x40}, @flat={0x73622a85, 0x10a, r1, 0x2}], &(0x7f0000000540)=[0x38, 0x68, 0x18, 0x38, 0x28, 0x30, 0x0, 0x68]}, 0x4}}, @release, @release={0x40046306, 0x3}, @exit_looper, @request_death={0x400c630e, 0x4, 0x1}], 0xa3, 0x0, &(0x7f0000000680)="4ead01bbf204209b3a6fe81cdfb1a70e42ad4d9b54dcf4f0a9c6cf3c8c0b5812f7686739def3b63b1c1f6a30ccbf53ba5b331757265a625146efc160b694d823fe4f22760c9648a8169755243f79dc09d3233f6422bc4f7c0321561986083366832522388de2d69ef4a986941be9f73deaf82fb6515b3915b1629f6cc086c19c7c1d7f9d03d033aa3b02542c908b4999ffcd862dae5f44130473b1454b9b093f9daa88"}) 18:20:25 executing program 5: r0 = request_key(&(0x7f00000004c0)='user\x00', &(0x7f0000000380)={'syz'}, &(0x7f00000001c0)="3fcb00faffffff00", 0x0) keyctl$describe(0x6, r0, &(0x7f0000000080)=""/60, 0x3c) r1 = socket$inet_udplite(0x2, 0x2, 0x88) fchmod(r1, 0x1) open(&(0x7f0000000100)='./file0\x00', 0x0, 0x20) getsockopt$IP_VS_SO_GET_VERSION(r1, 0x0, 0x480, &(0x7f0000000000), &(0x7f00000000c0)=0xffffffffffffffe2) r2 = creat(&(0x7f0000000040)='./file0\x00', 0x2) ioctl$TIOCSBRK(r2, 0x5427) 18:20:25 executing program 0: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) pipe2(&(0x7f0000000000)={0xffffffffffffffff}, 0x4000) setsockopt$EBT_SO_SET_COUNTERS(r1, 0x0, 0x81, &(0x7f0000000200)=ANY=[@ANYBLOB="66696c7465720000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000600000000000000", @ANYPTR=&(0x7f0000000040)=ANY=[@ANYBLOB="00000000000000000000000000000000000000000000000000000000000000000000000000f100ffff00000000000000000000000000000000000000000000000000000000000000000000000000000000390000000000001f6df300000000000000000000000000000000000000000000000000000000000000000000000000"], @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00'], 0xd8) request_key(&(0x7f00000004c0)='user\x00', &(0x7f0000000380)={'syz'}, &(0x7f00000001c0)="3fcb00faffffff00", 0x0) 18:20:25 executing program 2: r0 = socket$netlink(0x10, 0x3, 0x4) writev(r0, &(0x7f0000000000)=[{&(0x7f0000000200)="580000001400192340834b80040d8c5602067fffffff81000000000000dca87086a5c000004f6400940005891550f4a8000000006700008000f0fffeffff09000080fff5dd00000010000100000c0900fcff0000040e05a5", 0x58}], 0x1) fcntl$notify(r0, 0x402, 0x30) r1 = openat$selinux_status(0xffffffffffffff9c, &(0x7f0000000040)='/selinux/status\x00', 0x0, 0x0) pipe2(&(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}, 0x800) ioctl$FUSE_DEV_IOC_CLONE(r1, 0x8004e500, &(0x7f00000000c0)=r2) ioctl$RTC_PLL_GET(r2, 0x80207011, &(0x7f0000000100)) [ 492.991474] binder: 1215:1220 ioctl c0306201 20012000 returned -22 [ 493.002850] binder: 1215:1233 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 493.027895] binder: 1215:1220 Release 1 refcount change on invalid ref 0 ret -22 18:20:25 executing program 3: r0 = socket$netlink(0x10, 0x3, 0x4) r1 = dup3(r0, r0, 0x80000) ioctl$EVIOCGUNIQ(r1, 0x80404508, &(0x7f0000000140)=""/81) ioctl$EVIOCGVERSION(r1, 0x80044501, &(0x7f0000000040)=""/238) ioctl$LOOP_SET_DIRECT_IO(r1, 0x4c08, 0x5) writev(r0, &(0x7f0000000000)=[{&(0x7f0000000200)="580000001400192340834b80040d8c5602067fffffff81000000000000dca87086a5c000004f6400940005891550f4a8000000006700008000f0fffeffff09000080fff5dd00000010000100000c0900fcff0000040e05a5", 0x58}], 0x1) 18:20:25 executing program 0: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) request_key(&(0x7f00000004c0)='user\x00', &(0x7f0000000380)={'syz'}, &(0x7f00000001c0)="3fcb00faffffff00", 0x0) r1 = openat$zero(0xffffffffffffff9c, &(0x7f0000000000)='/dev/zero\x00', 0x40, 0x0) setsockopt$ARPT_SO_SET_ADD_COUNTERS(r1, 0x0, 0x61, &(0x7f0000000040)={'filter\x00', 0x4}, 0x68) ioctl$FS_IOC_GET_ENCRYPTION_POLICY(r1, 0x400c6615, &(0x7f00000000c0)) 18:20:25 executing program 5: request_key(&(0x7f00000004c0)='user\x00', &(0x7f0000000380)={'syz'}, &(0x7f00000001c0)="3fcb00faffffff00", 0x0) socketpair$inet6_tcp(0xa, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff}) r1 = openat$cgroup_type(0xffffffffffffff9c, &(0x7f0000000040)='cgroup.type\x00', 0x2, 0x0) r2 = inotify_init1(0x80000) r3 = openat$selinux_user(0xffffffffffffff9c, &(0x7f0000000080)='/selinux/user\x00', 0x2, 0x0) r4 = openat$selinux_member(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/member\x00', 0x2, 0x0) r5 = socket$inet(0x2, 0xb, 0xc6) poll(&(0x7f0000000100)=[{r0, 0x40a}, {r1, 0x4004}, {r2, 0x408}, {r3, 0x20}, {r4, 0x1000}, {r5, 0x80}], 0x6, 0x81) [ 493.067968] binder: 1215:1220 ioctl 40046205 846 returned -22 [ 493.087366] binder: 1215:1233 unknown command 0 [ 493.094822] binder: 1215:1233 ioctl c0306201 20012000 returned -22 [ 493.103754] binder: BINDER_SET_CONTEXT_MGR already set [ 493.110781] binder: 1215:1251 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 18:20:25 executing program 2: r0 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) fchdir(r0) r1 = getpgrp(0x0) ioctl$sock_SIOCSPGRP(r0, 0x8902, &(0x7f0000000000)=r1) socket$netlink(0x10, 0x3, 0x4) [ 493.159663] binder: 1215:1220 ioctl 40046207 0 returned -16 [ 493.159675] binder: BINDER_SET_CONTEXT_MGR already set [ 493.159683] binder: 1242:1262 ioctl 40046207 0 returned -16 [ 493.159826] binder: 1242:1262 Release 1 refcount change on invalid ref 4 ret -22 [ 493.159832] binder: 1242:1262 ERROR: BC_REGISTER_LOOPER called without request [ 493.193803] binder: 1242:1262 got transaction to invalid handle 18:20:25 executing program 4: r0 = syz_open_dev$binder(&(0x7f00000002c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000300)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, &(0x7f0000012fc7)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, &(0x7f0000000f4d)}) ioctl$FS_IOC_SETVERSION(r1, 0x40087602, &(0x7f0000000040)=0x80000000) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000000c0)={0x8, 0x0, &(0x7f0000000140)=[@release], 0x0, 0x0, &(0x7f0000000340)}) 18:20:25 executing program 3: r0 = socket$netlink(0x10, 0x3, 0x1e) writev(r0, &(0x7f0000000000)=[{&(0x7f0000000200)="580000001400192340834b80040d8c5602067fffffff81000000000000dca87086a5c000004f6400940005891550f4a8000000006700008000f0fffeffff09000080fff5dd00000010000100000c0900fcff0000040e05a5", 0x58}], 0x1) 18:20:25 executing program 0: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000080)='/selinux/commit_pending_bools\x00', 0x1, 0x0) ioctl$TIOCGPTPEER(r1, 0x5441, 0x3) ioctl$TCSBRKP(r1, 0x5425, 0xfffffffffffffffe) ioctl$PERF_EVENT_IOC_MODIFY_ATTRIBUTES(r1, 0x4008240b, &(0x7f00000000c0)={0x7, 0x70, 0x0, 0x5, 0x6, 0x7, 0x0, 0x3, 0xa2200, 0xe, 0x20, 0x6f6f, 0x7fffffff, 0x4, 0x6, 0x5, 0x1ff, 0x9, 0x80, 0x6d06ebcb, 0x4ff5de8e, 0x4, 0x3ef, 0xe167, 0x3, 0x0, 0x400, 0x2, 0x4, 0x401, 0x6, 0x6, 0x3, 0x5f, 0x8000, 0x9, 0x7, 0x100000001, 0x0, 0xfee, 0x5, @perf_config_ext={0x8, 0xffffffffffff8001}, 0x8000, 0x6f80000000000, 0x9, 0x1, 0x6, 0xffff, 0x401}) timer_create(0x7, &(0x7f0000000000)={0x0, 0x30, 0x4}, &(0x7f0000000040)=0x0) timer_delete(r2) setsockopt$inet6_MRT6_DEL_MFC_PROXY(r1, 0x29, 0xd3, &(0x7f0000000200)={{0xa, 0x4e24, 0x800, @remote, 0x1}, {0xa, 0x4e20, 0x6, @dev={0xfe, 0x80, [], 0xb}, 0x7}, 0x1, [0x200, 0x5, 0x1000000000, 0xc2, 0x1, 0xffff, 0x3, 0x100000000]}, 0x5c) ioctl$TUNGETSNDBUF(r1, 0x800454d3, &(0x7f0000000140)) request_key(&(0x7f00000004c0)='user\x00', &(0x7f0000000380)={'syz'}, &(0x7f00000001c0)="3fcb00faffffff00", 0x0) 18:20:25 executing program 2: r0 = socket$netlink(0x10, 0x3, 0x4) writev(r0, &(0x7f0000000000)=[{&(0x7f0000000200)="580000001400192340834b80040d8c5602067fffffff81000000000000dca87086a5c000004f6400940005891550f4a8000000006700008000f0fffeffff09000080fff5dd00000010000100000c0900fcff0000040e05a5", 0x58}], 0x1) r1 = socket$netlink(0x10, 0x3, 0x13) prctl$setendian(0x14, 0x0) getsockopt$sock_cred(r1, 0x1, 0x11, &(0x7f0000000080)={0x0, 0x0}, &(0x7f00000000c0)=0xc) r3 = geteuid() fstat(r0, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, 0x0}) getsockopt$inet_IP_IPSEC_POLICY(0xffffffffffffff9c, 0x0, 0x10, &(0x7f0000000280)={{{@in6=@dev, @in6=@dev, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@remote}, 0x0, @in=@local}}, &(0x7f0000000180)=0xe8) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f00000001c0)={0x0, 0x0}, &(0x7f0000000380)=0xc) r7 = getuid() getsockopt$inet_IP_XFRM_POLICY(0xffffffffffffffff, 0x0, 0x11, &(0x7f00000003c0)={{{@in6=@dev, @in6=@dev, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@multicast1}}}, &(0x7f00000004c0)=0xe8) r9 = geteuid() fstat(r0, &(0x7f0000000500)={0x0, 0x0, 0x0, 0x0, 0x0}) fstat(r1, &(0x7f0000000580)={0x0, 0x0, 0x0, 0x0, 0x0}) getgroups(0x7, &(0x7f0000000600)=[0xee00, 0xee01, 0x0, 0xee00, 0xee00, 0xee00, 0xee01]) lstat(&(0x7f0000000640)='./file0\x00', &(0x7f0000000680)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r14 = getegid() fstat(r1, &(0x7f0000000700)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r16 = getgid() fsetxattr$system_posix_acl(r0, &(0x7f0000000040)='system.posix_acl_access\x00', &(0x7f0000000780)={{}, {0x1, 0x6}, [{0x2, 0x1, r2}, {0x2, 0x2, r3}, {0x2, 0x6, r4}, {0x2, 0x6, r5}, {0x2, 0x1, r6}, {0x2, 0x2, r7}, {0x2, 0x5, r8}, {0x2, 0x4, r9}, {0x2, 0x0, r10}, {0x2, 0x7, r11}], {0x4, 0x2}, [{0x8, 0x3, r12}, {0x8, 0x3, r13}, {0x8, 0x4, r14}, {0x8, 0x1, r15}, {0x8, 0x2, r16}], {0x10, 0x4}, {0x20, 0x2}}, 0x9c, 0x1) [ 493.207298] binder: 1242:1262 transaction failed 29201/-22, size 64-48 line 3014 [ 493.229520] binder: 1242:1262 BC_INCREFS_DONE u0000000000000000 no match [ 493.236481] binder: 1242:1262 got transaction to invalid handle [ 493.243976] binder: 1242:1262 transaction failed 29201/-22, size 72-80 line 3014 [ 493.265891] binder: 1242:1262 got reply transaction with no transaction stack [ 493.279840] binder: 1282:1285 ioctl 40087602 20000040 returned -22 [ 493.293378] binder: BINDER_SET_CONTEXT_MGR already set [ 493.298774] binder: 1242:1262 transaction failed 29201/-71, size 40-72 line 2922 [ 493.309248] binder: 1282:1285 ioctl 40046207 0 returned -16 [ 493.322174] binder: 1282:1290 ioctl 40087602 20000040 returned -22 [ 493.839678] binder: 1242:1262 Acquire 1 refcount change on invalid ref 0 ret -22 [ 493.841138] binder: 1242:1303 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 493.841577] binder: 1242:1303 Release 1 refcount change on invalid ref 4 ret -22 [ 493.841584] binder: 1242:1303 ERROR: BC_REGISTER_LOOPER called without request [ 493.841609] binder: 1242:1304 got transaction to invalid handle [ 493.841619] binder: 1242:1304 transaction failed 29201/-22, size 64-48 line 3014 18:20:26 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000300)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap$binder(&(0x7f0000ffb000/0x3000)=nil, 0x3000, 0x2000000, 0x6013, r0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, &(0x7f0000000f4d)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x8, 0x0, &(0x7f0000000140)=[@release], 0x0, 0x0, &(0x7f0000000340)}) pipe2$9p(&(0x7f0000000000), 0x84000) 18:20:26 executing program 0: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) request_key(&(0x7f00000004c0)='user\x00', &(0x7f0000000380)={'syz'}, &(0x7f00000001c0)="3fcb00faffffff00", 0x0) pipe2(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}, 0x84800) setsockopt$inet6_tcp_TCP_MD5SIG(r1, 0x6, 0xe, &(0x7f0000000040)={@in={{0x2, 0x4e20, @remote}}, 0x100000001, 0x1, 0x4, "44b00374c96af426122527afc5628c21668b33649151ece597829cc0ec947cbc79da83b0f201cde2f3153eef19ee0fd212d5a3c4cb8bc21623e9819d3f3020638712381912ecb436498546a206e62a01"}, 0xd8) 18:20:26 executing program 4: openat$zero(0xffffffffffffff9c, &(0x7f0000000000)='/dev/zero\x00', 0x40040, 0x0) r0 = syz_open_dev$binder(&(0x7f00000002c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, &(0x7f0000012fc7)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, &(0x7f0000000f4d)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000000c0)={0x8, 0x0, &(0x7f0000000140)=[@release], 0x0, 0x0, &(0x7f0000000340)}) 18:20:26 executing program 2: r0 = socket$netlink(0x10, 0x3, 0x4) getsockopt$sock_linger(r0, 0x1, 0xd, &(0x7f0000000100), &(0x7f0000000140)=0x8) writev(r0, &(0x7f0000000040)=[{&(0x7f0000000200)="580000001400192340834b80040d8c5602067fffffff81000000000000dca87086a5c000004f6400940005891550f4a8000000006700008000f0fffeffff09000080fff5dd00000010000100000c0900fcff0000040e05a5", 0x58}], 0x1) fadvise64(r0, 0x0, 0x8, 0x1) ioctl$FS_IOC_SETVERSION(r0, 0x40087602, &(0x7f0000000000)=0x10001) pipe(&(0x7f0000000080)={0xffffffffffffffff}) setsockopt$inet6_tcp_TCP_FASTOPEN_KEY(r1, 0x6, 0x21, &(0x7f00000000c0)="566b9a32598601cc65acac24d13399e8", 0x10) 18:20:26 executing program 3: writev(0xffffffffffffffff, &(0x7f0000000000)=[{&(0x7f0000000200)="580000001400192340834b80040d8c5602067fffffff81000000000000dca87086a5c000004f6400940005891550f4a8000000006700008000f0fffeffff09000080fff5dd00000010000100000c0900fcff0000040e05a5", 0xfffffffffffffeed}], 0x1) socketpair$inet6(0xa, 0x4, 0x5000000000, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) flistxattr(r0, &(0x7f0000000080)=""/154, 0x9a) r2 = openat$full(0xffffffffffffff9c, &(0x7f0000000180)='/dev/full\x00', 0x100, 0x0) setsockopt$netlink_NETLINK_NO_ENOBUFS(r2, 0x10e, 0x5, &(0x7f00000001c0)=0x6, 0x4) getsockopt$inet_IP_IPSEC_POLICY(r1, 0x0, 0x10, &(0x7f0000000280)={{{@in=@loopback, @in6=@ipv4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@mcast1}, 0x0, @in6=@remote}}, &(0x7f0000000140)=0xe8) r4 = getgid() mount$fuseblk(0xffffffffffffffff, &(0x7f0000000380)='./file0\x00', &(0x7f00000003c0)='fuseblk\x00', 0x40, &(0x7f0000000400)={{'fd', 0x3d, r2}, 0x2c, {'rootmode', 0x3d, 0x6000}, 0x2c, {'user_id', 0x3d, r3}, 0x2c, {'group_id', 0x3d, r4}, 0x2c, {[{@max_read={'max_read'}}, {@blksize={'blksize', 0x3d, 0x200}}, {@max_read={'max_read', 0x3d, 0x5}}, {@allow_other='allow_other'}, {@allow_other='allow_other'}, {@default_permissions='default_permissions'}], [{@fscontext={'fscontext', 0x3d, 'staff_u'}}, {@context={'context', 0x3d, 'root'}}, {@obj_type={'obj_type', 0x3d, "2dca637075736574"}}, {@context={'context', 0x3d, 'unconfined_u'}}, {@pcr={'pcr', 0x3d, 0x37}}, {@dont_hash='dont_hash'}, {@smackfshat={'smackfshat', 0x3d, '/dev/full\x00'}}]}}) 18:20:26 executing program 5: r0 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./file0\x00', 0x20000, 0x40) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000180)=0x4) r1 = openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/commit_pending_bools\x00', 0x1, 0x0) accept$unix(r1, &(0x7f0000000040)=@abs, &(0x7f00000000c0)=0x6e) ioctl$BLKSECDISCARD(r1, 0x127d, &(0x7f0000000100)=0x5) request_key(&(0x7f00000004c0)='user\x00', &(0x7f0000000380)={'syz'}, &(0x7f00000001c0)="3fcb00faffffff00", 0x0) [ 493.841974] binder: 1242:1304 BC_INCREFS_DONE u0000000000000000 node 1672 cookie mismatch 0000000000000001 != 0000000000000000 [ 493.841982] binder: 1242:1304 got transaction to invalid handle [ 493.841991] binder: 1242:1304 transaction failed 29201/-22, size 72-80 line 3014 [ 493.842075] binder: 1242:1305 Release 1 refcount change on invalid ref 0 ret -22 18:20:26 executing program 0: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) ioctl$FIGETBSZ(r0, 0x2, &(0x7f0000000000)) 18:20:26 executing program 2: r0 = socket$netlink(0x10, 0x3, 0x4) writev(r0, &(0x7f0000000000)=[{&(0x7f0000000040)="580000001400192340834b80040d8c5602067fffffff81000000000000dca87086a5c000004f6400940005891550f4a8000000006700008000f0fffeffff09000080fff5dd00000010000100000c0900fcff0000040e05a5", 0x58}], 0x1) [ 493.941537] binder: 1308:1311 Acquire 1 refcount change on invalid ref 0 ret -22 [ 493.956007] binder: 1308:1311 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 493.970549] binder: 1308:1311 Release 1 refcount change on invalid ref 0 ret -22 18:20:26 executing program 5: r0 = dup3(0xffffffffffffffff, 0xffffffffffffff9c, 0x80000) timerfd_gettime(r0, &(0x7f0000000000)) rt_sigreturn() request_key(&(0x7f00000004c0)='user\x00', &(0x7f0000000380)={'syz'}, &(0x7f00000001c0)="3fcb00faffffff00", 0x0) 18:20:26 executing program 5: r0 = request_key(&(0x7f00000004c0)='user\x00', &(0x7f0000000380)={'syz', 0x1}, &(0x7f0000000000)="3fcb00faffffff00", 0x0) r1 = accept4(0xffffffffffffffff, &(0x7f00000003c0)=@llc={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @broadcast}, &(0x7f0000000340)=0x80, 0x800) ioctl$sock_inet_SIOCADDRT(r1, 0x890b, &(0x7f0000000440)={0x6, {0x2, 0x4e23, @local}, {0x2, 0x4e20, @local}, {0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x200, 0x9, 0x0, 0x81, 0x7, 0x0, 0xfffffffffffff000, 0x1, 0x4176}) r2 = accept4(0xffffffffffffff9c, &(0x7f0000000040)=@in6={0xa, 0x0, 0x0, @mcast2}, &(0x7f00000000c0)=0x80, 0x800) setsockopt$inet6_tcp_buf(r2, 0x6, 0x16, &(0x7f0000000100)="271fff43ad4999ace60c7effff0c6ab4ad1d2ab38dd0e83d56e0ae345290e8dd3f8cf1d2705ddd8d49fc7c5522fd3dfdbf91d101ee33df9954ae1fc6037b7095b2a3baf503dcda49e042dcba46c684065d708aabaf8898a547b4b1c05f934b0f390a1db01128e26f8680e6547c46f5c4db01e54f9a969e524cf89fa069c9b8485edae8969e7dab7ec803327048dbd05a7315354ec66cfd2a47a8b3a90036162462c351ba3d864511f84337d20b43caaf97af6434b2a43ffbe7b8d3c17c0d46ba547b2712fb0d27d44200eb52712443c7a240eec15fc3d7e0c4e3522ab28c6095d54b9c4e8ecff995b7f27b32f6503736502f", 0xf2) ioctl$sock_inet_SIOCADDRT(r2, 0x890b, &(0x7f0000000540)={0xea81, {0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0xb}}, {0x2, 0x4e24, @rand_addr=0x1}, {0x2, 0x4e20, @local}, 0x40, 0x80, 0x6, 0x6, 0x6b, &(0x7f0000000500)='rose0\x00', 0x8001, 0x400, 0x10000}) request_key(&(0x7f0000000280)='dns_resolver\x00', &(0x7f00000002c0)={'syz', 0x0}, &(0x7f0000000300)='\x00', r0) r3 = openat$keychord(0xffffffffffffff9c, &(0x7f0000000200)='/dev/keychord\x00', 0x0, 0x0) ioctl$BLKALIGNOFF(r3, 0x127a, &(0x7f0000000240)) 18:20:26 executing program 4: r0 = syz_open_dev$binder(&(0x7f00000002c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000300)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="0563044000000000139e0ae4b6b9cd289fe62dae702f8fb03cefdaf73ff33c7c90204a0a8a04cd9fb2cbaccd21a29f6e13d6b0717eb08706ffd984d573b08473d8fe84dbbedf452f2f694a032af231d63e160cbbf65db8ddc3eb6e902b59f7109315dce8531097f9c86fed6334ae852928f8353d2dc2af272d51b78112cf6bf5493a95b26f76e02921080725fe680d2e70c62e72e2022067295a96bd19323fa5125937f0d6655576b8a676430a7c3db5"], 0x0, 0x0, &(0x7f0000012fc7)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], 0x277, 0x0, &(0x7f0000000f4d)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000080)={0x4, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB='\x00'], 0xffffffffffffffe2, 0x0, &(0x7f0000000340)="b241292762754372b323c1fa1af0c2bf7f6e01d0924e5e7a4854fc1e2f34c012f5ea9355dbef56e4986b61cbfc6c7a746b970796033fa60a4d5e296a157b359e0c52cd26d0f3a0113db27463623f51b28b835c5fd19aa7fa41d822b3cbbcf5d0725b086d3d808311b5064744ba0870cbba7be05ab374cc629381692c473e8b33a4e9b847461fbac4d4a76edb7c2de9952f8dba3abc6cfcb3ce57dce2113bdee6d40241"}) [ 494.000545] binder: BINDER_SET_CONTEXT_MGR already set [ 494.017594] binder: 1315:1321 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 494.023236] binder: 1308:1330 ioctl 40046207 0 returned -16 [ 494.023492] binder: 1308:1330 Acquire 1 refcount change on invalid ref 0 ret -22 [ 494.023603] binder: 1308:1311 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 18:20:26 executing program 0: socketpair$unix(0x1, 0x8, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) request_key(&(0x7f00000004c0)='user\x00', &(0x7f0000000380)={'syz'}, &(0x7f00000001c0)="3fcb00faffffff00", 0x0) [ 494.023662] binder: 1308:1330 Release 1 refcount change on invalid ref 0 ret -22 [ 494.063747] binder: 1315:1332 Release 1 refcount change on invalid ref 0 ret -22 [ 494.101385] binder: 1315:1332 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 494.110179] binder: 1339:1341 unknown command 0 [ 494.122941] binder: 1315:1321 Release 1 refcount change on invalid ref 0 ret -22 [ 494.123104] binder: 1339:1341 ioctl c0306201 20008fd0 returned -22 [ 494.123471] binder: 1339:1341 unknown command 0 [ 494.123479] binder: 1339:1341 ioctl c0306201 20000080 returned -22 18:20:26 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000300)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000000000)=[@acquire], 0xfffffffffffffee7, 0x0, &(0x7f0000012fc7)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, &(0x7f0000000f4d)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x8, 0x0, &(0x7f0000000140)=[@release], 0x0, 0x0, &(0x7f0000000340)}) 18:20:26 executing program 2: r0 = socket$netlink(0x10, 0x3, 0x4) writev(r0, &(0x7f0000000000)=[{&(0x7f0000000200)="580000001400192340834b80040d8c5602067fffffff81000000000000dca87086a5c000004f6400940005891550f4a8000000006700008000f0fffeffff09000080fff5dd00000010000100000c0900fcff0000040e05a5", 0x58}], 0x1) r1 = open(&(0x7f0000000040)='./file0\x00', 0x80, 0x4) ioctl$EVIOCGNAME(r1, 0x80404506, &(0x7f0000000080)) 18:20:26 executing program 5: request_key(&(0x7f0000000140)='user\x00', &(0x7f0000000380)={'syz'}, &(0x7f0000000100)="3fcb00faffffff00", 0x0) timerfd_create(0x2, 0x80800) socket$nl_xfrm(0x10, 0x3, 0x6) r0 = openat$selinux_policy(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/policy\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000080)={'yam0\x00', 0x1000}) write$tun(r0, &(0x7f0000000040)={@void, @void, @x25={0x0, 0x5, 0xf1, "e84f57d549bbc1693d70fec41c61d4752a69e3c4"}}, 0x17) 18:20:26 executing program 0: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = add_key(&(0x7f0000000000)='rxrpc_s\x00', &(0x7f0000000040)={'syz', 0x3}, &(0x7f0000000080)="825e397552a22d1e9fab50c0d4ccd58abc02", 0x12, 0xfffffffffffffffe) request_key(&(0x7f00000004c0)='user\x00', &(0x7f0000000380)={'syz', 0x0}, &(0x7f00000001c0)="f61dd51f714f3fcb", r2) r3 = dup2(r1, r0) fremovexattr(r0, &(0x7f00000000c0)=@random={'user.', 'mime_typecpusetvmnet1eth0.trusteduservboxnet0\x00'}) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x2400, 0x2800000000000) 18:20:26 executing program 3: r0 = socket$netlink(0x10, 0x3, 0x4) fcntl$setsig(r0, 0xa, 0x3b) writev(r0, &(0x7f0000000400)=[{&(0x7f0000000040)="176e9c30e0da039e6db7cff16fab48641dd6c0fdd8af03b7040b8a811f14915a1e24900129faa3441a9f7dc7d12ec89259262d17ceed0db2d0f4e8b4f38a2c08bb5b4d9a4065571003d0ccf76012d50287135c9b46a0480f5b4e57f4577daa8775787135edddf6d6e457d429fb77cdd6e82a67097cc9a3d9f4ad8e459112552caf5cfb985ec6c01a", 0x88}, {&(0x7f0000000100)="c29fe45c4badaa40506a37755e6899bdf0c6acdeda097257dcd814d59baffb490a8c0f99e268a110063606af8317976297d64d80b96e5b14736b05177fa946d57aaf29873a92864c97159cda80a29e6e3e74fd4451c4cfbd19a972729b1f17f496d6b013c3ae0e31201d32abfcc4f541130d54279b09934b1519fd74fc79779da503b61e3427bee32c081262f72fd18d02fb92ad7c66b333047ecfa156a54c3cc1b23a6de1810bcc92f7d5ceaa55945cd5c83e572aa972fb64d95f37a598f2de2220", 0xc2}, {&(0x7f0000000280)="9fc6c84f5efe89badf55def6f715990bca06181f1bc2972dd7a1986882945bee0cff542314e8dca7e78f894b7b1cd08504e5b7426577cfe596126f51c8ebaa26b89ad47b7f6c8cf512d0e8ef9f647fe592a8ba21c4976da027fc4e4a8779aa44da7ba9be4bdbe643b56a40a3d9abcaf916c43e404e699a612534bd6941217209", 0x80}, {&(0x7f0000000300)="e98f0a4478e5be0fa7567f5db83a8f1894bee324ae72b1501e86904e9c45581f394a6475677559bc4f2b3e35355dc884c5bbfdcd10e199a2c5116525a6000f10149794d0050d135d25a205db443ba2afc05eb683edc24d49413a1f5309c4963f7a20733475532c1f54fd39b3a77e1007c16c32048f97d37bff7281839638933cdb8908d25025f0fbb3a37e580aee3cf6a92a619cf671ae474da13f7ab6e18a04f1cf1f799c386222b87c13ee79129c007d1db82df64665565b7943af29ab31fc85307329a0d97fc662dbf4f46582053514e0d67d90c6dec84901746607f9ef4401c20da6c9ef7ef0a6c8320020bc4bb1969b41b2ca", 0xf5}], 0x4) writev(r0, &(0x7f0000000000)=[{&(0x7f0000000200)="580000001400192340834b80040d8c5602067fffffff81000000000000dca87086a5c000004f6400940005891550f4a8000000006700008000f0fffeffff09000080fff5dd00000010000100000c0900fcff0000040e05a5", 0x58}], 0x1) [ 494.123925] binder: BINDER_SET_CONTEXT_MGR already set [ 494.123932] binder: 1339:1341 ioctl 40046207 0 returned -16 [ 494.169733] binder: 1339:1350 unknown command 0 [ 494.177533] binder: 1339:1350 ioctl c0306201 20008fd0 returned -22 18:20:26 executing program 4: r0 = syz_open_dev$binder(&(0x7f00000002c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000300)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, &(0x7f0000012fc7)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000100), 0x82, 0x0, &(0x7f0000000180)="b5426558b3d3b6333cfafb3a21c20d885099b42879abf2cbfaed53a133be42be1971435f47617a14003ce8eba7a160535945c064292ab4bf8aebc570cba331e70206fb64d1c5a91c4c7dbfd5ad770a6091ffbc885462044814e468c0cac77a59df102bfb74d5996aa1a88fcae2037c9e835b606c3a7a08c3c534c2d24bec5976a054"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, &(0x7f0000000f4d)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000000c0)={0x8, 0x0, &(0x7f0000000140)=[@release], 0x0, 0x0, &(0x7f0000000340)}) r2 = memfd_create(&(0x7f0000000000)='$\x00', 0x1) fcntl$getownex(r0, 0x10, &(0x7f0000000040)={0x0, 0x0}) write$P9_RGETLOCK(r2, &(0x7f0000000080)={0x1f, 0x37, 0x2, {0x2, 0x9, 0x8001, r3, 0x1, '\\'}}, 0x1f) 18:20:26 executing program 2: r0 = socket$netlink(0x10, 0x3, 0x4) writev(r0, &(0x7f00000001c0)=[{&(0x7f0000000040)="c17e6bed8bf9edee1d93c81c41681b331a6a61ad74dacace6377490e796c410712cf1ee6d1060ed33fbec6539509286a010a2d31f9e8e5b73402750f6928dd4bf66977a391c0812fd1262ef8c44bdbec9af20d34013810641ba9060313a757", 0x5f}, {&(0x7f00000000c0)="528ec47aad2e0a5fbc740f159b0a7d5f8f8d57ccdca655aa2c0953de22174b725632b8c1100cbb84666d7062f0b6f61aa2a6c5fadf0f0ff8e13c6481c5f8", 0x3e}, {&(0x7f0000000100)="e24832314f819f835bf8d5c5c6e4f91072b551235f14ddbfde588622e0a50697759cc97e268f8558471f482568043533f4b1e3db8e505d8c088f8fff667deacb2168b4f261d7af17f8420d2fbeb247a94d073fb77cc49c9c1017d4c038e76d173d16b940cb16e474f8c051737236a39408a9e0b085df278e88ed633bf46e4bf9db8d8c6b8ddbeabf6f92a0f3f887d97286fe859dc5b7f154526b47d52bbb0131d7c44bff6d1d0617d8618f", 0xab}], 0x3) 18:20:26 executing program 0: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = openat$selinux_avc_cache_stats(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/avc/cache_stats\x00', 0x0, 0x0) ioctl$VT_SETMODE(r1, 0x5602, &(0x7f0000000040)={0x8971, 0x4, 0x40, 0x2077, 0x3f}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) request_key(&(0x7f00000004c0)='user\x00', &(0x7f0000000380)={'syz'}, &(0x7f00000001c0)="3fcb00faffffff00", 0x0) [ 494.211640] binder: 1355:1360 Acquire 1 refcount change on invalid ref 0 ret -22 [ 494.230262] SELinux: unrecognized netlink message: protocol=4 nlmsg_type=56032 sclass=netlink_tcpdiag_socket [ 494.246914] binder: 1355:1360 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 18:20:26 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000300)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, &(0x7f0000012fc7)}) r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x80000, 0x0) ioctl$PIO_UNIMAPCLR(r1, 0x4b68, &(0x7f0000000040)={0x1, 0x1, 0x1000}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, &(0x7f0000000f4d)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x8, 0x0, &(0x7f0000000140)=[@release], 0x0, 0x0, &(0x7f0000000340)}) 18:20:26 executing program 3: r0 = socket$netlink(0x10, 0x3, 0x4) writev(r0, &(0x7f0000000000)=[{&(0x7f0000000040)="580000001400192340834b807b974e2165462f53af4f258c04ceba0af2420d8c5602067fffffff81000000000000dca87086a5c000004f6400940005891550f4a8000000006700008000f0fffeffff09000080fff5dd00000010000100000c0900fcff0000040e05", 0x65}], 0x1) 18:20:26 executing program 2: r0 = socket$netlink(0x10, 0x3, 0x4) writev(r0, &(0x7f0000000000)=[{&(0x7f0000000200)="580000001400192340834b80040d8c5602067fffffff81000000000000dca87086a5c000004f6400940005891550f4a8000000006700008000f0fffeffff09000080fff5dd00000010000100000c0900fcff0000040e05a5", 0x58}], 0x1) r1 = openat$selinux_avc_cache_stats(0xffffffffffffff9c, &(0x7f0000000040)='/selinux/avc/cache_stats\x00', 0x0, 0x0) getpeername$packet(r1, &(0x7f0000000080)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @remote}, &(0x7f00000000c0)=0x14) setsockopt$inet_mreqn(r1, 0x0, 0x23, &(0x7f0000000100)={@remote, @empty, r2}, 0xc) ioctl$ifreq_SIOCGIFINDEX_team(r0, 0x8933, &(0x7f0000000400)={'team0\x00', 0x0}) ioctl$sock_inet6_SIOCADDRT(r1, 0x890b, &(0x7f0000000440)={@loopback, @local, @mcast2, 0x0, 0x1, 0x0, 0x400, 0x4, 0x800002, r3}) [ 494.270479] binder: 1355:1360 Release 1 refcount change on invalid ref 0 ret -22 [ 494.285992] SELinux: unrecognized netlink message: protocol=4 nlmsg_type=56032 sclass=netlink_tcpdiag_socket [ 494.296713] SELinux: unrecognized netlink message: protocol=4 nlmsg_type=63883 sclass=netlink_tcpdiag_socket 18:20:26 executing program 0: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) rmdir(&(0x7f00000000c0)='./file0\x00') request_key(&(0x7f00000004c0)='user\x00', &(0x7f0000000380)={'syz'}, &(0x7f00000001c0)="3fcb00faffffff00", 0x0) r1 = openat$null(0xffffffffffffff9c, &(0x7f0000000040)='/dev/null\x00', 0x402001, 0x0) ioctl$sock_SIOCBRDELBR(r1, 0x89a1, &(0x7f0000000080)='sit0\x00') ioctl$KDMKTONE(r1, 0x4b30, 0x3ff) 18:20:26 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000300)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000005fd4), 0xd1a82a6, 0x0, &(0x7f0000012fc7)}) socket(0x5, 0x4, 0x487) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, &(0x7f0000000f4d)}) r1 = mmap$binder(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x4, 0x10, r0, 0x0) r2 = mmap$binder(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x1, 0x8010, r0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000400)={0x100, 0x0, &(0x7f0000000200)=[@transaction_sg={0x40486311, {{0x4, 0x0, 0x3, 0x0, 0x11, 0x0, 0x0, 0x0, 0x8, &(0x7f0000000000), &(0x7f0000000040)=[0x18]}, 0x1f}}, @free_buffer={0x40086303, r1}, @transaction={0x40406300, {0x1, 0x0, 0x3, 0x0, 0x1, 0x0, 0x0, 0x20, 0x18, &(0x7f0000000080)=[@fda={0x66646185, 0x4, 0x1, 0x2e}], &(0x7f0000000100)=[0x48, 0x0, 0x0]}}, @acquire_done={0x40106309, r2}, @transaction_sg={0x40486311, {{0x4, 0x0, 0x1, 0x0, 0x10, 0x0, 0x0, 0x0, 0x10, &(0x7f0000000180), &(0x7f00000001c0)=[0x78, 0x38]}, 0x7}}, @register_looper], 0x82, 0x0, &(0x7f0000000340)="368a73cc817a576d92a9864c6eb2fd9cb774194b2f013d5a79e7f5350870d62e9f5ef4369b24c6c925fd5e3071ad0766aad4eb709027c2d404627e6f495fe56d88db0a9424968bc74bc7b0a6036f35ee8529d2ede0b7d77740e749d118563408f7717b234591e706498d5acb8e4b64ba45cd5f74b41a5c484658e8f9687c64637d38"}) openat$selinux_access(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/access\x00', 0x2, 0x0) lsetxattr(&(0x7f0000000540)='./file0\x00', &(0x7f0000000580)=@known='system.posix_acl_access\x00', &(0x7f00000005c0)='\x00', 0x1, 0x2) ioctl$TIOCLINUX4(r0, 0x541c, &(0x7f0000000180)) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x8, 0x0, &(0x7f0000000140)=[@release], 0x0, 0x0, &(0x7f0000000340)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000480)={0x20, 0x0, &(0x7f00000004c0)=ANY=[@ANYBLOB="b6c03d5fad9d1f83584f9047010c6a4d33f0fe8b166aec2d096bb1f83b63f05d6f58f0acba9e06a9293d2f736c319c530eb32da14b1e5c307b6290a78211f91ad5a88efd9b", @ANYRES64=r1, @ANYBLOB="0e630c400100000003000000000000000c630000"], 0x33, 0x0, &(0x7f0000000440)="2ddbc3d93130a74bbac2700c0f9643d45ab00409c6f50a225c3fd831855f1a904d5fca13ee87275bb59ade5aff0be900db7870"}) 18:20:26 executing program 5: r0 = request_key(&(0x7f00000004c0)='user\x00', &(0x7f0000000380)={'syz'}, &(0x7f00000001c0)="3fcb00faffffff00", 0x0) r1 = add_key(&(0x7f0000000000)='cifs.idmap\x00', &(0x7f0000000040)={'syz', 0x3}, &(0x7f0000000080)="b56e2e250be951ec58a9ea9a31ef10e7aa1193e3f1d2b94e34563792aece6abe69b218bb5cbd8ba371222e5d553ce5891da1059b467878d9c2ff95dd1970917406d94c", 0x43, r0) add_key(&(0x7f0000000100)='asymmetric\x00', &(0x7f0000000140)={'syz', 0x3}, &(0x7f0000000180)="3a41d69d1479aa32ae9a76d57fc13d07da543efc3325e96596addf66793aa02fcbb2b5f928b5a1f4d66eb1c5ab752f7f2a1ad53055270b50f22f4e925a68d4", 0x3f, r1) 18:20:26 executing program 3: r0 = socket$netlink(0x10, 0x3, 0x4004) writev(r0, &(0x7f00000000c0), 0x0) 18:20:26 executing program 0: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) request_key(&(0x7f00000004c0)='user\x00', &(0x7f0000000380)={'syz'}, &(0x7f00000001c0)="3fcb00faffffff00", 0x0) fchmod(r0, 0x1) 18:20:26 executing program 2: r0 = socket$netlink(0x10, 0x3, 0x20000000002) setxattr$trusted_overlay_opaque(&(0x7f0000000000)='./file0\x00', &(0x7f00000001c0)='trusted.overlay.opaque\x00', &(0x7f0000000200)='y\x00', 0x2, 0x3) writev(r0, &(0x7f0000000100)=[{&(0x7f0000000280)="580008001400192340834b80040d8c5602067fffffff810024b9b9e8b50000000000dca87086a5c000004f6400940005891550f4a8000000006700008000f0fffeffff09000080fff5dd000000100001009bd0ffd315f2f1390638000c0900fcff0000040e05a5799ee56e3f5a6b40f3190a7b65ecf0e7180de0e944d349ec3eb1d8a0edfd8dbd85d9c4c666b623baa512091bfa0e93f6397bba79d52694568174ada51d4f90f71d28699c61c884a41a2ec0e00e2732ee8cde18c7f69256dcf45f798b49a1e6dff7eb9ffcae0dbdf1f3734a81df9856ec797d5501d8d6f01a95a25475e64b68e3ba99282748710d6a48de2718cbf1d395dd31044d2975f99beb495d916e25475372bc9bf7f613d1548e11caae8bfa9abaa8f3051385ff4137cd33eff58edbfe6945f66083792d341c1ea15c95092475293f77bd42af8f3836055c2ed8a7cbda93990bb572ec225c4e082384fe3011efa4b561abb65d24228888d7be06ef29a9ea9eb3f82761941ff8f0d3772cd125074fe56103b690e289", 0xfd0b}], 0x1208) r1 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000180)='net/icmp\x00') r2 = dup3(r0, r0, 0x80000) r3 = openat(r2, &(0x7f0000000140)='./file0\x00', 0x400000, 0x24) socket$inet_udp(0x2, 0x2, 0x0) ioctl$GIO_UNISCRNMAP(r1, 0x4b69, &(0x7f0000000240)=""/52) getsockopt$inet_pktinfo(0xffffffffffffffff, 0x0, 0x8, &(0x7f0000000040)={0x0, @broadcast, @broadcast}, &(0x7f0000000080)=0xc) openat$uhid(0xffffffffffffff9c, &(0x7f0000000400)='/dev/uhid\x00', 0x802, 0x0) ioctl$TUNSETIFINDEX(r3, 0x400454da, &(0x7f00000000c0)=r4) [ 494.416560] binder: 1393:1396 unknown command 0 [ 494.434100] binder: 1393:1396 ioctl c0306201 20012000 returned -22 [ 494.506781] binder: 1393:1396 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 494.525713] binder: 1393:1396 got transaction to invalid handle [ 494.547499] binder: 1393:1396 transaction failed 29201/-22, size 0-8 line 3014 [ 494.572354] binder: 1393:1396 ioctl 541c 20000180 returned -22 [ 494.579222] binder: 1393:1396 Release 1 refcount change on invalid ref 0 ret -22 [ 494.587094] binder: 1393:1396 unknown command 1597882550 [ 494.593260] binder: 1393:1396 ioctl c0306201 20000480 returned -22 [ 494.600574] binder: 1393:1396 unknown command 0 [ 494.605284] binder: 1393:1396 ioctl c0306201 20012000 returned -22 [ 494.610014] binder: 1393:1405 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 494.613536] binder: 1393:1422 got transaction to invalid handle [ 494.613545] binder: 1393:1422 transaction failed 29201/-22, size 0-8 line 3014 [ 494.613839] binder: 1393:1422 Release 1 refcount change on invalid ref 0 ret -22 [ 494.613874] binder: 1393:1405 ioctl 541c 20000180 returned -22 18:20:27 executing program 4: r0 = syz_open_dev$binder(&(0x7f00000002c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000300)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, &(0x7f0000012fc7)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, &(0x7f0000000f4d)}) r2 = request_key(&(0x7f0000000100)='logon\x00', &(0x7f0000000180)={'syz', 0x0}, &(0x7f00000001c0)='/dev/binder#\x00', 0xfffffffffffffffc) request_key(&(0x7f0000000000)='rxrpc_s\x00', &(0x7f0000000040)={'syz', 0x0}, &(0x7f0000000080)='^(eth1\x00', r2) r3 = accept(0xffffffffffffff9c, 0x0, &(0x7f0000000200)) setsockopt$inet6_int(r3, 0x29, 0x39, &(0x7f0000000240)=0xffffffffffffffff, 0x4) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000000c0)={0x8, 0x0, &(0x7f0000000140)=[@release], 0x0, 0x0, &(0x7f0000000340)}) 18:20:27 executing program 5: request_key(&(0x7f00000004c0)='user\x00', &(0x7f0000000380)={'syz'}, &(0x7f00000001c0)="3fcb00faffffff00", 0x0) r0 = openat$selinux_status(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/status\x00', 0x0, 0x0) write$P9_RLOCK(r0, &(0x7f0000000040)={0x8, 0x35, 0x1, 0x3}, 0x8) dup3(0xffffffffffffff9c, 0xffffffffffffff9c, 0x80000) 18:20:27 executing program 3: writev(0xffffffffffffffff, &(0x7f0000000000)=[{&(0x7f0000000200)="580000001400192340834b80040d8c5602067fffffff81000000000000dca87086a5c000004f6400940005891550f4a8000000006700008000f0fffeffff09000080fff5dd00000010000100000c0900fcff0000040e05a5", 0x58}], 0x1) r0 = openat$selinux_checkreqprot(0xffffffffffffff9c, &(0x7f0000000040)='/selinux/checkreqprot\x00', 0x20000, 0x0) epoll_ctl$EPOLL_CTL_DEL(r0, 0x2, 0xffffffffffffffff) socket(0x4, 0x80005, 0xbfb) 18:20:27 executing program 0: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) request_key(&(0x7f00000004c0)='user\x00', &(0x7f0000000380)={'syz'}, &(0x7f00000001c0)="3fcb00faffffff00", 0x0) r1 = openat$selinux_avc_hash_stats(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/avc/hash_stats\x00', 0x0, 0x0) ioctl$PIO_CMAP(r1, 0x4b71, &(0x7f0000000040)={0x80, 0x69271fd3, 0xfffffffffffffffd, 0x7, 0x3, 0x1000}) 18:20:27 executing program 2: r0 = socket$netlink(0x10, 0x3, 0x4) writev(r0, &(0x7f0000000000)=[{&(0x7f0000000200)="580000001400192340834b80040d8c5602067fffffff81000000000000dca87086a5c000004f6400940005891550f4a8000000006700008000f0fffeffff09000080fff5dd00000010000100000c0900fcff0000040e05a5", 0x58}], 0x1) r1 = openat$selinux_avc_cache_stats(0xffffffffffffff9c, &(0x7f0000000040)='/selinux/avc/cache_stats\x00', 0x0, 0x0) ioctl$KDSKBSENT(r1, 0x4b49, &(0x7f0000000080)="430ea3a3215c009134") 18:20:27 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000300)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, &(0x7f0000000240)) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x8, 0x0, &(0x7f00000005c0)=[@acquire, @transaction={0x40406300, {0x0, 0x0, 0x3, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000540)=[@ptr={0x70742a85, 0x1, &(0x7f0000000500), 0x0, 0x2, 0x3c}], &(0x7f0000000580)=[0x38]}}, @decrefs={0x40046307, 0x1}, @increfs={0x40046304, 0x1}], 0x380, 0x0, &(0x7f0000012fc7)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, &(0x7f0000000f4d)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x8, 0x0, &(0x7f0000000140)=[@release], 0x0, 0x0, &(0x7f0000000340)}) r1 = openat$selinux_status(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/status\x00', 0x0, 0x0) write$input_event(r1, &(0x7f0000000040)={{0x77359400}, 0x16, 0x8}, 0x18) fstat(r0, &(0x7f0000000180)) 18:20:27 executing program 0: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = openat$selinux_status(0xffffffffffffff9c, &(0x7f0000000100)='/selinux/status\x00', 0x0, 0x0) ioctl$KDGETKEYCODE(r2, 0x4b4c, &(0x7f0000000240)={0x401}) accept$inet6(r2, &(0x7f0000000140)={0xa, 0x0, 0x0, @ipv4={[], [], @dev}}, &(0x7f0000000200)=0x1c) request_key(&(0x7f00000004c0)='user\x00', &(0x7f0000000380)={'syz'}, &(0x7f00000001c0)="3fcb00faffffff00", 0x0) r3 = dup2(r0, r1) write$UHID_INPUT2(r3, &(0x7f0000000000)={0xc, 0xd8, "d928cc1a97bfaf3c9aeef5f23c8c0dede3e82149e2ad245a719c18dfe045ab1d8b813b665cd89cb85a0cf5c6599d2204a3490625eae39fa325f24254f0768218ac54c95b801732dba669f17ba846343b606c98d72b999de35f9361c4c58983f290965c3412e23a228691f563c9ec4a0f263128913e97f1c4d384816125d771d51d601800c1e9ca72a016d8aa10832a8e7d4fa22edc8307fda9c55535b92ec2b1f053c8421ee06aa37c378962618c342778c5bc8fe9641fa40fe83072e7fe0d31deaa70269c46ec55eb24696eaf3b84bea097502d3d540393"}, 0xde) 18:20:27 executing program 5: r0 = accept4$inet6(0xffffffffffffffff, &(0x7f0000000000)={0xa, 0x0, 0x0, @mcast1}, &(0x7f0000000040)=0x1c, 0x800) setsockopt$sock_timeval(r0, 0x1, 0x15, &(0x7f0000000080)={0x0, 0x7530}, 0x10) request_key(&(0x7f0000000140)='id_legacy\x00', &(0x7f0000000180)={'syz'}, &(0x7f00000000c0)="81000000000000006b7721713cd38761c1908e84cde097f3140100010000ce8caaacbde67d", 0x0) [ 495.028631] binder: BINDER_SET_CONTEXT_MGR already set [ 495.029648] binder: 1364:1425 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 495.029740] binder: 1364:1426 Release 1 refcount change on invalid ref 0 ret -22 [ 495.048510] binder: 1364:1378 ioctl 40046207 0 returned -16 18:20:27 executing program 2: r0 = socket$netlink(0x10, 0x3, 0x4) writev(r0, &(0x7f0000000000), 0x1183) ioctl$sock_inet_SIOCSIFPFLAGS(r0, 0x8934, &(0x7f0000000080)={'veth1_to_bridge\x00', 0xfff}) openat$full(0xffffffffffffff9c, &(0x7f0000000040)='/dev/full\x00', 0x0, 0x0) setsockopt$netlink_NETLINK_LISTEN_ALL_NSID(r0, 0x10e, 0x8, &(0x7f0000000000)=0x5, 0x4) [ 495.108793] binder: 1434:1440 Acquire 1 refcount change on invalid ref 0 ret -22 [ 495.132222] binder: BINDER_SET_CONTEXT_MGR already set [ 495.144777] binder: 1439:1453 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 18:20:27 executing program 2: r0 = socket$netlink(0x10, 0x3, 0x2) writev(r0, &(0x7f0000000000)=[{&(0x7f0000000200)="580000001400192340834b80040d8c5602067fffffff81000000000000dca87086a5c000004f6400940005891550f4a8000000006700008000f0fffeffff09000080fff5dd00000010000100000c0900fcff0000040e05a5", 0x58}], 0x1) 18:20:27 executing program 5: request_key(&(0x7f00000004c0)='user\x00', &(0x7f0000000380)={'syz'}, &(0x7f00000001c0)="3fcb00faffffff00", 0x0) socket$inet6(0xa, 0x3, 0x7fff) 18:20:27 executing program 4: r0 = syz_open_dev$binder(&(0x7f00000002c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000300)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = gettid() ioprio_set$pid(0x3, r2, 0xf17) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, &(0x7f0000012fc7)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, &(0x7f0000000f4d)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000000c0)={0x8, 0x0, &(0x7f0000000140)=[@release], 0x0, 0x0, &(0x7f0000000340)}) 18:20:27 executing program 0: lgetxattr(&(0x7f0000000080)='./file0\x00', &(0x7f00000000c0)=@random={'user.', 'em0*-$\x00'}, &(0x7f0000000200)=""/233, 0xe9) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) request_key(&(0x7f00000004c0)='user\x00', &(0x7f0000000380)={'syz'}, &(0x7f00000001c0)="3fcb00faffffff00", 0x0) r1 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ppp\x00', 0x20800, 0x0) ioctl$TCSETA(r1, 0x5406, &(0x7f0000000040)={0x8b0, 0xfffffffffffffff8, 0x0, 0x7fff, 0xff, 0xff, 0xec, 0x3, 0x40, 0x80000001}) 18:20:27 executing program 3: r0 = socket$netlink(0x10, 0x3, 0x4) writev(r0, &(0x7f0000000000)=[{&(0x7f0000000200)="580000001400192340834b80040d8c5602067fffffff81000000000000dca87086a5c000004f6400940005891550f4a8000000006700008000f0fffeffff09000080fff5dd00000010000100000c0900fcff0000040e05a5", 0x58}], 0x1) r1 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ppp\x00', 0x143000, 0x0) ioctl$BLKROGET(r1, 0x125e, &(0x7f0000000080)) 18:20:27 executing program 5: request_key(&(0x7f0000000040)='\x00\x00\x00\x00\x00\x00', &(0x7f0000000080)={'syz', 0x3}, &(0x7f0000000140)='user\x00', 0xffffffffffffffff) [ 495.160056] binder: 1434:1458 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 495.160918] binder: 1439:1445 ioctl 40046207 0 returned -16 18:20:27 executing program 0: socketpair$packet(0x11, 0x2, 0x300, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) request_key(&(0x7f00000004c0)='user\x00', &(0x7f0000000380)={'syz'}, &(0x7f00000001c0)="3fcb00faffffff00", 0x0) r2 = open(&(0x7f00000000c0)='./file0\x00', 0x103000, 0x20) setsockopt$inet_msfilter(r2, 0x0, 0x29, &(0x7f0000000200)=ANY=[@ANYBLOB="e0000002ac1414bb0000000006001000e0000054e0000001ac1414aa7f00000100e6ff00ac1414aa9b7c9f452276adf3c24a6a66f0cbb60340c34e19f25c8627f8b328458068615b3a8a176241d1fe003ddefd601c6774b0f7a17d5ba50f92e0fed245b021ef1270460c81a9d0fcb4f454c1f1c2615c5fd85b5e9cf00af85710252efea715e4e1a583f2bb6e350d2760879808321e42ddca86e89ffdf756f3236bb287f09f607ec91bee520ce0dc246f1ccf43c6a49380a609335ac40cd3208a70d4f3d9"], 0x28) pipe(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) shutdown(r0, 0x0) ioctl$VT_RESIZEX(r3, 0x560a, &(0x7f0000000080)={0x8, 0x5, 0x7fffffff, 0x5, 0x7, 0x2}) 18:20:27 executing program 5: request_key(&(0x7f00000004c0)='\x00\a\x00\x00\x00', &(0x7f0000000380)={'syz'}, &(0x7f00000001c0)="3fcb00faffffff00", 0x0) r0 = dup2(0xffffffffffffffff, 0xffffffffffffff9c) ioctl$EVIOCSREP(r0, 0x40084503, &(0x7f0000000000)=[0x7, 0x10]) [ 495.214311] binder: 1434:1458 Release 1 refcount change on invalid ref 0 ret -22 [ 495.254318] binder: BINDER_SET_CONTEXT_MGR already set [ 495.289328] binder: 1470:1474 ioctl 40046207 0 returned -16 18:20:28 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000300)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, &(0x7f0000012fc7)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, &(0x7f0000000f4d)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x8, 0x0, &(0x7f0000000140)=[@release], 0x0, 0x0, &(0x7f0000000340)}) dup(r0) 18:20:28 executing program 2: r0 = socket$netlink(0x10, 0x3, 0x4) writev(r0, &(0x7f0000000000)=[{&(0x7f0000000200)="580000001400192340834b80040d8c5602067fffffff81000000000000dca87086a5c000004f6400940005891550f4a8000000006700008000f0fffeffff09000080fff5dd00000010000100000c0900fcff0000040e05a5", 0x58}], 0x1) r1 = creat(&(0x7f0000000040)='./file0\x00', 0x24) write$P9_RSYMLINK(r1, &(0x7f0000000080)={0x14, 0x11, 0x1, {0x18, 0x1, 0x6}}, 0x14) 18:20:28 executing program 4: r0 = syz_open_dev$binder(&(0x7f00000002c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x802) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, &(0x7f0000012fc7)}) ioctl$FITRIM(r1, 0xc0185879, &(0x7f0000000000)={0xfff, 0x1f, 0x3}) r2 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0x0, 0x800) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, &(0x7f0000000f4d)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000000c0)={0x8, 0x0, &(0x7f0000000140)=[@release], 0x0, 0x0, &(0x7f0000000340)}) 18:20:28 executing program 3: r0 = socket$netlink(0x10, 0x3, 0x4) fsetxattr$security_selinux(r0, &(0x7f0000000140)='security.selinux\x00', &(0x7f0000000180)='system_u:object_r:qemu_device_t:s0\x00', 0x23, 0x2) fstatfs(r0, &(0x7f0000000040)=""/227) writev(r0, &(0x7f0000000000)=[{&(0x7f0000000200)="580000001400192340834b80040d8c5602067fffffff81000000000000dca87086a5c000004f6400940005891550f4a8000000006700008000f0fffeffff09000080fff5dd00000010000100000c0900fcff0000040e05a5", 0x58}], 0x1) r1 = openat(0xffffffffffffffff, &(0x7f00000001c0)='./file0\x00', 0x2001, 0x10) ioctl$SNDRV_TIMER_IOCTL_GINFO(r1, 0xc0f85403, &(0x7f0000000280)={{0xffffffffffffffff, 0x3, 0x10001, 0x1, 0x6}, 0x1ff, 0x6, 'id0\x00', 'timer0\x00', 0x0, 0x6, 0x11e0, 0x3, 0x7}) 18:20:28 executing program 5: r0 = accept4(0xffffffffffffff9c, 0x0, &(0x7f0000000000), 0x800) ioctl$sock_ifreq(r0, 0x8919, &(0x7f0000000040)={'sit0\x00', @ifru_addrs=@sco={0x1f, {0xff, 0x0, 0x7f, 0xffffffffa77a2b93, 0x7fff, 0x59}}}) setsockopt$inet_MCAST_LEAVE_GROUP(r0, 0x0, 0x2d, &(0x7f0000000080)={0x4, {{0x2, 0x4e24, @multicast1}}}, 0x88) rt_sigprocmask(0x2, &(0x7f0000000140)={0x5}, &(0x7f0000000180), 0x8) prctl$setendian(0x14, 0x0) munlockall() request_key(&(0x7f00000004c0)='user\x00', &(0x7f0000000380)={'syz'}, &(0x7f00000001c0)="3fcb00faffffff00", 0x0) 18:20:28 executing program 0: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) request_key(&(0x7f00000004c0)='user\x00', &(0x7f0000000380)={'syz', 0x3}, &(0x7f0000000000)="3fcb00faffffff0010f670a7347a911fd594bc57baffadbd577c2b37e0e49b2c7e7693391f211def44e16403e05170f9d4299f2ba41195ac592779817e4bfa0381226e7ec971d2a37454", 0x0) [ 495.880946] binder: 1434:1478 Acquire 1 refcount change on invalid ref 0 ret -22 [ 495.888724] binder: 1434:1458 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 495.895649] binder: 1434:1478 Release 1 refcount change on invalid ref 0 ret -22 18:20:28 executing program 5: request_key(&(0x7f00000004c0)='user\x00', &(0x7f0000000380)={'syz'}, &(0x7f0000000000)="3fcb62fafffeff004723cec0f9981c0a1e55caec2b778850c2cd588ec004c9a34db22f21675348aa86dc1faa57acc9c8a91faa895266ec293410769fc1f71049c95299c47d6c80b0adc16e9a80f9a5326837b2df8db49edd3f71bcfa7e85ec8de58d46", 0x0) 18:20:28 executing program 0: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) request_key(&(0x7f00000004c0)='user\x00', &(0x7f0000000380)={'syz'}, &(0x7f00000001c0)="3fcb00faffffff00", 0x0) r1 = openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/commit_pending_bools\x00', 0x1, 0x0) r2 = syz_genetlink_get_family_id$nbd(&(0x7f0000000080)='nbd\x00') r3 = openat$selinux_policy(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/policy\x00', 0x0, 0x0) r4 = openat$null(0xffffffffffffff9c, &(0x7f0000000100)='/dev/null\x00', 0x6000, 0x0) r5 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000140)='/dev/rtc0\x00', 0x200101, 0x0) sendmsg$NBD_CMD_CONNECT(r1, &(0x7f00000002c0)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f0000000280)={&(0x7f0000000200)={0x60, r2, 0x100, 0x70bd29, 0x25dfdbfe, {}, [@NBD_ATTR_SOCKETS={0x1c, 0x7, [{0x8, 0x1, r3}, {0x8, 0x1, r4}, {0x8, 0x1, r5}]}, @NBD_ATTR_SERVER_FLAGS={0xc, 0x5, 0x100}, @NBD_ATTR_SERVER_FLAGS={0xc, 0x5, 0x20}, @NBD_ATTR_DEAD_CONN_TIMEOUT={0xc, 0x8, 0x5}, @NBD_ATTR_SERVER_FLAGS={0xc, 0x5, 0x20}]}, 0x60}, 0x1, 0x0, 0x0, 0x20040000}, 0x804) [ 495.925605] audit: type=1400 audit(1539627628.013:52): avc: denied { relabelto } for pid=1498 comm="syz-executor3" name="NETLINK" dev="sockfs" ino=135601 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=system_u:object_r:qemu_device_t:s0 tclass=netlink_tcpdiag_socket permissive=1 18:20:28 executing program 3: r0 = socket$inet6_udp(0xa, 0x2, 0x0) r1 = getpid() getsockopt$inet_IP_XFRM_POLICY(0xffffffffffffff9c, 0x0, 0x11, &(0x7f0000000040)={{{@in6=@mcast1, @in=@rand_addr, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6}, 0x0, @in=@multicast1}}, &(0x7f0000000140)=0xe8) stat(&(0x7f0000000180)='./file0\x00', &(0x7f0000000280)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) writev(r0, &(0x7f0000000440)=[{&(0x7f0000000500)="dd48cbc3d6180622f663a6e9818f1a0b062f1bc702d7ef876a953a43a8d0071d3a316605fa8bb935bfaae8b02470dadeef1bb0b274423af3db85ff75e8703986674e88036d4afd0fffd29ad53db5a0881095da7fe37b116f18a5dda4625d8684766835a63ad722af5f1ffa8c3272a003af48d6068cc97adbda2108a26389427cebb50820640d5e", 0x87}], 0x1) setsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f00000001c0)={r1, r3, r4}, 0xc) socket$inet_udplite(0x2, 0x2, 0x88) r5 = openat$selinux_avc_hash_stats(0xffffffffffffff9c, &(0x7f00000003c0)='/selinux/avc/hash_stats\x00', 0x0, 0x0) write$P9_RLERROR(r5, &(0x7f0000000400)={0x1b, 0x7, 0x1, {0x12, 'ppp1cpusetsecurity'}}, 0x1b) socket$netlink(0x10, 0x3, 0x15) syz_genetlink_get_family_id$ipvs(&(0x7f0000000300)='IPVS\x00') setxattr$trusted_overlay_upper(&(0x7f0000000340)='./file0\x00', &(0x7f0000000380)='trusted.overlay.upper\x00', &(0x7f00000004c0)=ANY=[@ANYRES32=r2], 0x1, 0x1) writev(r0, &(0x7f0000000480)=[{&(0x7f0000000200)="580000001400192340834b80040d8c5602067fffffff81000000000000dca87086a5c000004f6400940005891550f4a8000000006700008000f0fffeffff09000080fff5dd00000010000100000c0900fcff0000040e05a5", 0x3b4}], 0x0) 18:20:28 executing program 2: r0 = socket$netlink(0x10, 0x3, 0x4) writev(r0, &(0x7f0000000000)=[{&(0x7f0000000200)="580000001400192340834b80040d8c5602067fffffff81000000000000dca87086a5c000004f6400940005891550f4a8000000006700008000f0fffeffff09000080fff5dd00000010000100000c0900fcff0000040e05a5", 0xfffffffffffffcfa}], 0x1) 18:20:28 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000300)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, &(0x7f0000012fc7)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, &(0x7f0000000f4d)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x8, 0x0, &(0x7f0000000140)=[@release], 0x0, 0x0, &(0x7f0000000340)}) write$binfmt_elf32(r0, &(0x7f0000000340)={{0x7f, 0x45, 0x4c, 0x46, 0x8000, 0x100000001, 0x7, 0x80000000, 0x4, 0x3, 0x3e, 0x5, 0x231, 0x38, 0x3ce, 0x6, 0x0, 0x20, 0x1, 0x100000001, 0x8, 0x7}, [{0x0, 0x0, 0x4, 0x2, 0x6, 0x401, 0x6, 0xfffffffffffffff7}], "d1cd3ae93e6911c076b1ff9fe282223d985d231e352642176b639df187d48f8c9896eec21021751206ab7f2c8440754f1dea92835b87ac20b0f44c170cc266e2775d80605f4cb4af42b9d9115eb90f0e2e34d331ddc557c84eac49d94f85dba71653e751bfb185aa3085c529bf89c34b9e66bd95b8b91d06b0beec2a33646d33a4f7ad14fd16abdaeb7061cd9b3aa09cad8fd0b15f62", [[], [], []]}, 0x3ee) 18:20:28 executing program 5: request_key(&(0x7f00000004c0)='user\x00', &(0x7f0000000380)={'syz'}, &(0x7f00000001c0)="3fcb00faffffff00", 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) r0 = creat(&(0x7f0000000000)='./file0\x00', 0x8e) renameat(r0, &(0x7f0000000040)='./file0\x00', r0, &(0x7f0000000080)='./file0\x00') ioctl$UI_SET_MSCBIT(r0, 0x40045568, 0x34) [ 495.971744] binder: 1497:1505 Acquire 1 refcount change on invalid ref 0 ret -22 [ 495.978961] audit: type=1400 audit(1539627628.073:53): avc: denied { write } for pid=1498 comm="syz-executor3" path="socket:[135601]" dev="sockfs" ino=135601 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=system_u:object_r:qemu_device_t:s0 tclass=sock_file permissive=1 [ 496.018066] binder: 1497:1520 ioctl c0185879 20000000 returned -22 18:20:28 executing program 2: r0 = socket$netlink(0x10, 0x3, 0x5) writev(r0, &(0x7f0000000000)=[{&(0x7f0000000200)="580000001400192340834b80040d8c5602067fffffff81000000000000dca87086a5c000004f6400940005891550f4a8000000006700008000f0fffeffff09000080fff5dd00000010000100000c0900fcff0000040e05a5", 0x58}], 0x1) setsockopt$netlink_NETLINK_CAP_ACK(r0, 0x10e, 0xa, &(0x7f0000000040)=0x100, 0x4) 18:20:28 executing program 5: request_key(&(0x7f0000000040)='cifs.idmap\x00', &(0x7f0000000000)={'syz', 0x0}, &(0x7f00000002c0)="3fcb00faffffff003f65cf034a39b5c6875a02b35fbc9bdcaed921759a841936ad21ecab04a18ed84e4ac3999eac5ba136d0c1bbe696dc667430cac2c4a3bb3e847c168b4f89402df8a568f8eb4347412593003cd46df0643837f462bc254b6256be9d7701bf67b5171114e9e4fc70c43f881d60082b509ae411b3fbc1cd471e0e0ad3cdd253ce01000000610a1af6b8adee66a9cc2b940421faa009eff869779a34604db9dd767bdf7a1f63b28db5133e17c41c9e883c628fdbb19c2705404b78bed5477bcc79d1a4a0894488d82d19dd311ced615dafba00005e65027f6c91b7c0777e1559735995cc3de5081b053b7900c59b37c1fdf1cda3a194bf000000009e67f13ae63664b101d9ec0a371e4849d919e1afda7a6aaddd1c7750694b6ca64d69d3cd22f648222f91383de148217b6132b1e7c83ac466bc87cdaca17a47923a5c86e78e4b038b4284810972930277955db89b05e9ef73c10164e7fcf089e3034de573a37ad1ae9aad36d1397e40f3e99e268eca000000000000000000", 0xffffffffffffffff) [ 496.068565] binder: 1497:1520 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 496.097697] binder: 1497:1520 Release 1 refcount change on invalid ref 0 ret -22 [ 496.162566] binder: BINDER_SET_CONTEXT_MGR already set [ 496.175062] binder: 1497:1547 ioctl c0185879 20000000 returned -22 [ 496.190452] binder: 1497:1505 ioctl 40046207 0 returned -16 [ 496.206503] binder: BINDER_SET_CONTEXT_MGR already set 18:20:28 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000300)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, &(0x7f0000012fc7)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, &(0x7f0000000f4d)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000000c0)={0x8, 0x0, &(0x7f0000000140)=[@release], 0x0, 0x0, &(0x7f0000000340)}) 18:20:28 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000300)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, &(0x7f0000012fc7)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, &(0x7f0000000f4d)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x8, 0x0, &(0x7f0000000340)=ANY=[@ANYBLOB="e4e4762d0d9880e0044c7ee83af36d4dfb45662272bdfb8508a16477da463b396ec0d4ed33b5c143549f194dac310f856e1fcf2d5f0ef39d84f018dae5b38d7cd99148838af06ee5b4ddf3f07c1139d9dffaa4157b9c07199049370f07fefc692ac4d1435c7d9faacceec73a302efa3a269e38853ce205d2f22eec83cb5a2fb00c7ebda8f5471dd367f91725f3ad9d0ddff19e5af9f97dffdea27d53049871d7dd886b63120532184f17886cac73f5b7966e0efa690b30dfedcf570af64203e7ad00000000000000000000000000"], 0x0, 0x0, &(0x7f0000000340)}) 18:20:28 executing program 5: add_key$keyring(&(0x7f0000000040)='keyring\x00', &(0x7f0000000080)={'syz', 0x0}, 0x0, 0x0, 0xfffffffffffffffb) r0 = request_key(&(0x7f00000000c0)='logon\x00', &(0x7f0000000100)={'syz', 0x1}, &(0x7f0000000140)='syz', 0xfffffffffffffff8) request_key(&(0x7f00000004c0)='user\x00', &(0x7f0000000180)={'syz'}, &(0x7f00000001c0)="3fcb00faffffff00", r0) 18:20:28 executing program 0: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) pipe(&(0x7f0000000000)={0xffffffffffffffff}) ioctl$BLKRESETZONE(r1, 0x40101283, &(0x7f0000000040)={0x1, 0x4df741de}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) request_key(&(0x7f00000004c0)='user\x00', &(0x7f0000000380)={'syz'}, &(0x7f00000001c0)="3fcb00faffffff00", 0x0) 18:20:28 executing program 3: r0 = socket$netlink(0x10, 0x3, 0x4) socket$nl_generic(0x10, 0x3, 0x10) writev(r0, &(0x7f0000000000)=[{&(0x7f0000000200)="580000001400192340834b80040d8c5602067fffffff81000000000000dca87086a5c000004f6400940005891550f4a8000000006700008000f0fffeffff09000080fff5dd00000010000100000c0900fcff0000040e05a5", 0x58}], 0x1) 18:20:28 executing program 2: r0 = socket$netlink(0x10, 0x3, 0x4) r1 = getpid() timer_create(0x1, &(0x7f00000000c0)={0x0, 0xb, 0x4, @tid=r1}, &(0x7f0000000100)) writev(r0, &(0x7f0000000000)=[{&(0x7f0000000200)="580000001400192340834b80040d8c5602067fffffff81000000000000dca87086a5c000004f6400940005891550f4a8000000006700008000f0fffeffff09000080fff5dd00000010000100000c0900fcff0000040e05a5", 0x58}], 0x1) ioctl$FS_IOC_FSSETXATTR(r0, 0x401c5820, &(0x7f00000001c0)={0x0, 0x6, 0x2, 0x2, 0x1}) timer_create(0x6, &(0x7f0000000040)={0x0, 0x3a, 0x7, @tid=0xffffffffffffffff}, &(0x7f0000000080)=0x0) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x0, 0x0) write$smack_current(r3, &(0x7f0000000180)='\x00', 0x1) timer_getoverrun(r2) [ 496.215633] binder: 1497:1547 ioctl 40046207 0 returned -16 18:20:28 executing program 0: r0 = openat$cgroup_type(0xffffffffffffffff, &(0x7f0000000000)='cgroup.type\x00', 0x2, 0x0) fcntl$F_GET_RW_HINT(r0, 0x40b, &(0x7f0000000040)) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$EXT4_IOC_SETFLAGS(r0, 0x40086602, &(0x7f0000000080)=0x4000) request_key(&(0x7f00000004c0)='user\x00', &(0x7f0000000380)={'syz'}, &(0x7f00000001c0)="3fcb00faffffff00", 0x0) [ 496.283558] binder: BINDER_SET_CONTEXT_MGR already set [ 496.283742] binder: 1558:1566 unknown command 762766564 [ 496.283751] binder: 1558:1566 ioctl c0306201 200000c0 returned -22 [ 496.298617] binder: 1557:1574 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 496.312933] binder: 1558:1573 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 18:20:28 executing program 3: r0 = socket$netlink(0x10, 0x3, 0x4) writev(r0, &(0x7f0000000000)=[{&(0x7f0000000200)="580000001400192340834b80040d8c5602067fffffff81000000000000dca87086a5c000004f6400940005891550f4a8000000006700008000f0fffeffff09000080fff5dd00000010000100000c0900fcff0000040e05a5", 0x58}], 0x1) set_tid_address(&(0x7f0000000040)) 18:20:28 executing program 5: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) ioctl$sock_SIOCADDDLCI(r0, 0x8980, &(0x7f0000000000)={'team0\x00', 0x1}) request_key(&(0x7f00000004c0)='user\x00', &(0x7f0000000380)={'syz'}, &(0x7f00000001c0)="3fcb00faffffff00", 0x0) 18:20:28 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000300)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, &(0x7f0000012fc7)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, &(0x7f0000000f4d)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x8, 0x0, &(0x7f0000000140)=[@release], 0x0, 0x0, &(0x7f0000000340)}) r1 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x201, 0x0) epoll_ctl$EPOLL_CTL_MOD(r1, 0x3, r0, &(0x7f0000000040)={0x10}) 18:20:28 executing program 2: r0 = socket$netlink(0x10, 0x3, 0x4) writev(r0, &(0x7f0000000280)=[{&(0x7f0000000180)="580000001400192340834b80040d8c5602067fffffff81000000000040dca870e69f82fd86a5c000004f1550f4a80000000067000080e81a0000000000000080fff5dd00000010e60100000c090000ff0000040e05a5ded0560b767f2206448ab19337", 0x58}], 0x0) [ 496.333284] binder: 1557:1567 ioctl 40046207 0 returned -16 18:20:28 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000300)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, &(0x7f0000012fc7)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, &(0x7f0000000f4d)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000000c0)={0x8, 0x0, &(0x7f0000000140)=[@release], 0x0, 0x0, &(0x7f0000000340)}) 18:20:28 executing program 0: socketpair$unix(0x1, 0x6, 0x0, &(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}) openat$keychord(0xffffffffffffff9c, &(0x7f0000000180)='/dev/keychord\x00', 0x80, 0x0) r1 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000300)='/dev/vga_arbiter\x00', 0x6bc042, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400203) r2 = syz_open_dev$mice(&(0x7f0000000000)='/dev/input/mice\x00', 0x0, 0xc200) r3 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000080)='IPVS\x00') sendmsg$IPVS_CMD_SET_SERVICE(r2, &(0x7f0000000200)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x8441}, 0xc, &(0x7f0000000140)={&(0x7f00000000c0)={0x74, r3, 0x8, 0x70bd29, 0x25dfdbfe, {}, [@IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5, 0x5}, @IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0x2}, @IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0x80000000}, @IPVS_CMD_ATTR_DAEMON={0x48, 0x3, [@IPVS_DAEMON_ATTR_MCAST_GROUP6={0x14, 0x6, @mcast1}, @IPVS_DAEMON_ATTR_SYNC_ID={0x8, 0x3, 0x1}, @IPVS_DAEMON_ATTR_SYNC_ID={0x8}, @IPVS_DAEMON_ATTR_STATE={0x8, 0x1, 0x2}, @IPVS_DAEMON_ATTR_MCAST_TTL={0x8, 0x8, 0x8}, @IPVS_DAEMON_ATTR_STATE={0x8, 0x1, 0x3}, @IPVS_DAEMON_ATTR_SYNC_ID={0x8, 0x3, 0x1}]}]}, 0x74}, 0x1, 0x0, 0x0, 0x8000}, 0x80) fsetxattr$trusted_overlay_redirect(r0, &(0x7f0000000240)='trusted.overlay.redirect\x00', &(0x7f0000000280)='./file0\x00', 0x8, 0x2) request_key(&(0x7f00000004c0)='user\x00', &(0x7f0000000380)={'syz'}, &(0x7f00000001c0)="3fcb00faffffff00", 0x0) 18:20:28 executing program 3: r0 = socket$netlink(0x10, 0x3, 0x4) setsockopt$netlink_NETLINK_BROADCAST_ERROR(r0, 0x10e, 0x4, &(0x7f0000000040)=0xffff, 0x4) writev(r0, &(0x7f0000000000)=[{&(0x7f0000000200)="580000001400192340834b80040d8c5602067fffffff81000000000000dca87086a5c000004f6400940005891550f4a8000000006700008000f0fffeffff09000080fff5dd00000010000100000c0900fcff0000040e05a5", 0x58}], 0x1) [ 496.394618] binder: 1586:1591 Acquire 1 refcount change on invalid ref 0 ret -22 18:20:28 executing program 4: add_key$keyring(&(0x7f0000000040)='keyring\x00', &(0x7f0000000080)={'syz', 0x0}, 0x0, 0x0, 0xfffffffffffffffb) r0 = request_key(&(0x7f00000000c0)='logon\x00', &(0x7f0000000100)={'syz', 0x1}, &(0x7f0000000140)='syz', 0xfffffffffffffff8) request_key(&(0x7f00000004c0)='user\x00', &(0x7f0000000180)={'syz'}, &(0x7f00000001c0)="3fcb00faffffff00", r0) 18:20:28 executing program 2: socketpair$inet(0x2, 0x7, 0x7f, &(0x7f0000000040)) r0 = socket$netlink(0x10, 0x3, 0x4) pipe2(&(0x7f0000000140)={0xffffffffffffffff}, 0x84800) epoll_wait(r1, &(0x7f0000000180)=[{}, {}, {}, {}], 0x4, 0xd8a3) writev(r0, &(0x7f0000000380)=[{&(0x7f0000000280)="82622055bf5a58df6809e81b64711ca687219b88fc44739cc9d8918dce8a2a072195fc68e61ae0137b665a143ff50ce9733766de2c5b6f787d091b5bd0"}, {&(0x7f00000002c0)="a9d50b607b1453b1b5e387c0ffd2d69f7e79cecaa3dba01717ff38cf07bf37"}, {&(0x7f0000000300)="f84fc27b752b2dabc6001b10711a1d43c2384217a112375f455b55a951f4628c7bfa9744f08cc80f4cf0d02662871b4e46d176a8ea48d10f60b9da0d9298598dc1"}], 0x1) openat$pfkey(0xffffffffffffff9c, &(0x7f0000000080)='/proc/self/net/pfkey\x00', 0x100, 0x0) socketpair(0x3, 0x6, 0x2, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) openat$zero(0xffffffffffffff9c, &(0x7f0000000100)='/dev/zero\x00', 0x400, 0x0) ioctl$KDSIGACCEPT(r2, 0x4b4e, 0x21) 18:20:28 executing program 5: r0 = add_key$keyring(&(0x7f0000000040)='keyring\x00', &(0x7f0000000080)={'syz', 0x2}, 0x0, 0x0, 0x0) request_key(&(0x7f0000000100)='user\x00', &(0x7f00000000c0)={'syz'}, &(0x7f0000000000)="3fcb00faffffff00", r0) [ 496.455822] binder: 1586:1601 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 496.492118] binder: 1586:1591 Release 1 refcount change on invalid ref 0 ret -22 18:20:28 executing program 4: add_key$keyring(&(0x7f0000000040)='keyring\x00', &(0x7f0000000080)={'syz', 0x0}, 0x0, 0x0, 0xfffffffffffffffb) r0 = request_key(&(0x7f00000000c0)='logon\x00', &(0x7f0000000100)={'syz', 0x1}, &(0x7f0000000140)='syz', 0xfffffffffffffff8) request_key(&(0x7f00000004c0)='user\x00', &(0x7f0000000180)={'syz'}, &(0x7f00000001c0)="3fcb00faffffff00", r0) 18:20:28 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000300)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000012000)={0xfffffffffffffde6, 0x0, &(0x7f0000005fd4)=ANY=[@ANYBLOB="057e040000004b46"], 0x0, 0x0, &(0x7f0000012fc7)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, &(0x7f0000000f4d)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x8, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0663044000477b01fef1f8633607000000"], 0x0, 0x0, &(0x7f0000000340)}) lgetxattr(&(0x7f0000000080)='./file0\x00', &(0x7f0000000100)=@known='trusted.overlay.origin\x00', &(0x7f0000000140)=""/166, 0xa6) openat$selinux_avc_hash_stats(0xffffffffffffff9c, &(0x7f0000000040)='/selinux/avc/hash_stats\x00', 0x0, 0x0) 18:20:28 executing program 3: r0 = socket$netlink(0x10, 0x3, 0x4) writev(r0, &(0x7f0000000000)=[{&(0x7f0000000200)="580000001400192340834b80040d8c5602067fffffff81000000000000dca87086a5c000004f6400940005891550f4a8000000006700008000f0fffeffff09000080fff5dd00000010000100000c0900fcff0000040e05a5", 0x58}], 0x1) ppoll(&(0x7f0000000040)=[{r0, 0x2}, {r0, 0x20}, {r0, 0x8000}, {r0, 0x1400}, {r0, 0x300}], 0x5, &(0x7f0000000080), &(0x7f00000000c0)={0x6}, 0x8) 18:20:28 executing program 5: request_key(&(0x7f00000004c0)='user\x00', &(0x7f0000000380)={'syz'}, &(0x7f00000001c0)="3fcb00faffffff00", 0x0) r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ion\x00', 0x202, 0x0) ioctl$int_in(r0, 0x5452, &(0x7f0000000040)=0x100000000) 18:20:28 executing program 4: r0 = syz_open_dev$binder(&(0x7f00000002c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000300)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, &(0x7f0000012fc7)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000100), 0x82, 0x0, &(0x7f0000000180)="b5426558b3d3b6333cfafb3a21c20d885099b42879abf2cbfaed53a133be42be1971435f47617a14003ce8eba7a160535945c064292ab4bf8aebc570cba331e70206fb64d1c5a91c4c7dbfd5ad770a6091ffbc885462044814e468c0cac77a59df102bfb74d5996aa1a88fcae2037c9e835b606c3a7a08c3c534c2d24bec5976a054"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, &(0x7f0000000f4d)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000000c0)={0x8, 0x0, &(0x7f0000000140)=[@release], 0x0, 0x0, &(0x7f0000000340)}) r2 = memfd_create(&(0x7f0000000000)='$\x00', 0x1) fcntl$getownex(r0, 0x10, &(0x7f0000000040)={0x0, 0x0}) write$P9_RGETLOCK(r2, &(0x7f0000000080)={0x1f, 0x37, 0x2, {0x2, 0x9, 0x8001, r3, 0x1, '\\'}}, 0x1f) [ 496.519576] binder: 1586:1601 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 496.526793] binder: 1586:1591 Acquire 1 refcount change on invalid ref 0 ret -22 [ 496.541819] binder: 1586:1601 Release 1 refcount change on invalid ref 0 ret -22 18:20:28 executing program 0: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = openat$keychord(0xffffffffffffff9c, &(0x7f0000002f40)='/dev/keychord\x00', 0x40, 0x0) setsockopt$IP_VS_SO_SET_EDITDEST(r1, 0x0, 0x489, &(0x7f0000002f80)={{0x0, @multicast2, 0x4e22, 0x1, 'wlc\x00', 0x5, 0x8, 0x33}, {@rand_addr=0x5, 0x4e23, 0x0, 0xb3e, 0xfffffffffffffffc, 0x6}}, 0x44) r2 = request_key(&(0x7f00000000c0)='user\x00', &(0x7f0000000100)={'syz', 0x0}, &(0x7f0000000140)='syz', 0xfffffffffffffff8) add_key(&(0x7f0000000000)='id_legacy\x00', &(0x7f0000000040)={'syz', 0x3}, &(0x7f0000000080)="e88d5d1d78d54ae1076f80065535f3a8360214fc6f3a367e", 0x18, r2) unshare(0x200) r3 = syz_open_procfs$namespace(0x0, &(0x7f00000003c0)='ns/mnt\x00') pipe2(&(0x7f0000000480)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) removexattr(&(0x7f0000000f00)='./file0\x00', &(0x7f0000000f40)=@known='com.apple.system.Security\x00') mkdir(&(0x7f0000fd5ff8)='./file0\x00', 0x0) mount(&(0x7f0000000e80)=ANY=[@ANYBLOB="b1e03faec6008163b97eac7044ec838e0efd8eb7531a0a242d957b53b90d71fe5a1077b5898ea104f8892d52af3e89c4c5838c89faa2e0f94ab812af9b8f293114d9282a16477eeb28b01cbf76a5100422545e3c8cb166318fc59b38b44a45f9a271b3999baed01ad47d2adf491862a3a43996915112aa09140fa5"], &(0x7f0000026ff8)='./file0\x00', &(0x7f000000c000)='ramfs\x00', 0x0, &(0x7f00000003c0)) mount(&(0x7f00000003c0)=ANY=[], &(0x7f0000000200)='./file0\x00', &(0x7f00000001c0)="18765468f7c38d", 0x0, &(0x7f0000000400)) setns(r3, 0x0) clone(0x70024000, &(0x7f0000000180), &(0x7f0000000100), &(0x7f0000000040), &(0x7f0000000180)) lstat(&(0x7f0000000400)='./file0\x00', &(0x7f00000007c0)) r6 = getpgid(0xffffffffffffffff) r7 = syz_open_procfs(r6, &(0x7f0000000780)='net/fib_trie\x00') execve(&(0x7f0000000000)='./file0\x00', &(0x7f0000000340)=[&(0x7f0000000140)='eth1{\x00', &(0x7f0000000180)='ns/mnt\x00', &(0x7f0000000240)='\x00', &(0x7f0000000280)='vfat\x00', &(0x7f00000002c0)='\x00', &(0x7f0000000300)="18765468f7c38d"], &(0x7f0000000580)=[&(0x7f0000000380)='\\wlan1em1-cgroupselinuxnodev\x00', &(0x7f0000000440)='}\x00', &(0x7f00000004c0)='-em0em0vboxnet1']) mkdirat(r7, &(0x7f00000006c0)='./file0\x00', 0x0) setxattr$security_smack_entry(&(0x7f0000000dc0)='./file0\x00', &(0x7f0000000e00)='security.SMACK64EXEC\x00', &(0x7f0000000e40)='\x00', 0x1, 0x3) pivot_root(&(0x7f0000000a00)='./file0\x00', &(0x7f0000000d40)='./file0\x00') lgetxattr(&(0x7f0000000c00)='./file0\x00', &(0x7f0000000c40)=@known='trusted.syz\x00', &(0x7f0000000c80)=""/181, 0xb5) mount(&(0x7f0000000640)=ANY=[@ANYBLOB="c24a000000002e2f8679880e86055de5f9a7381427f0019dfc1e24f70a11e166ad49d536"], &(0x7f00000009c0)='./file0\x00', &(0x7f0000000840)="6d7175657565009503fdf8950e06825107b95a46a54219e682ecccf2c3a8f88cb143dd0231986277e4d19488d781dc41ea7e2fcbd1d12b7214e7d1ff72d4d878f99f0a0e1e554c8d61dace9f3146a3c865a17c76a033cc7392870ff9d34ad3370eb10735581e3c63648b471ac979b4f3236d9bac0113e7c0dff73d164e62eed58f31bafcf750f2f587f73da01eb39ae2678566c6bbb7ccb095616ed50c7795d875ef4477e976a3149a024b302ab003eb8d79134d6630821f8d2fa9b9e117a35c6bb864fe83b6352f8828dae85a824b07d95447ead8bb78fba9c16d0a45b57769e2e0e3c18d333917a7488ffd13cdb4b42757348feb17a94f4f3dd8765024f73e4efdf3d8ffe392af095d35c2347c326767708368a4ee9d4b50ca51e4d6d4f059b64b928b590682222547c0e46a60d03bdda3", 0x7ffffffffffffff, &(0x7f0000000980)='*/\x00') setsockopt$IP_VS_SO_SET_STOPDAEMON(r5, 0x0, 0x48c, &(0x7f0000000500)={0x2, 'irlan0\x00'}, 0x18) ioctl$TIOCSSOFTCAR(r5, 0x541a, &(0x7f0000000680)=0x2) r8 = openat$keychord(0xffffffffffffff9c, &(0x7f0000000600)='/dev/keychord\x00', 0x800, 0x0) ioctl$BINDER_THREAD_EXIT(r8, 0x40046208, 0x0) ioctl$PERF_EVENT_IOC_DISABLE(r4, 0x2401, 0x9) setsockopt$netlink_NETLINK_ADD_MEMBERSHIP(r7, 0x10e, 0x1, &(0x7f0000000540)=0x19, 0x4) [ 496.607424] binder: 1630:1635 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 18:20:28 executing program 5: add_key$keyring(&(0x7f0000000080)='keyring\x00', &(0x7f0000000280)={'syz', 0x1}, 0x0, 0x0, 0x0) r0 = add_key(&(0x7f00000002c0)='dns_resolver\x00', &(0x7f0000000300)={'syz', 0x2}, &(0x7f0000000500)="6c3a44516ca5b8de2f06cbbc3ef1df185b569026786b1e51f2756eb6e861918268c13e6671bde81d867dc84c65b847b3a280155e25899236e50d87886e06a21613fc08402ffce6fe5f06bb2942bc85e4a1ad4c9fbc0f99517d97260c681cd31be95d216d3138fdcea25cec8d3c65135bb2b927227aabc09c16af241c0c6cd265b1ba5c786084d03c994b215c133180ac91c486408d869c3a41585c00a874bec69ae2d47c632d238d35c9", 0xaa, 0xfffffffffffffff9) pipe2(&(0x7f0000000340)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80800) ioctl$BLKFLSBUF(r1, 0x1261, &(0x7f00000003c0)=0x3f1) request_key(&(0x7f00000004c0)="847f657200", &(0x7f0000000380)={'syz'}, &(0x7f00000001c0)="3fcb00faffffff00", r0) r2 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x200001, 0x0) r3 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000440)='IPVS\x00') write$P9_RSTAT(r2, &(0x7f00000005c0)={0x61, 0x7d, 0x1, {0x0, 0x5a, 0x8, 0x2, {0x4, 0x1}, 0x4000000, 0x3, 0x4, 0x3, 0x5, "847f657200", 0xd, 'dns_resolver\x00', 0x8, 'keyring\x00', 0xd, 'dns_resolver\x00'}}, 0x61) sendmsg$IPVS_CMD_GET_CONFIG(r2, &(0x7f0000000240)={&(0x7f0000000040), 0xc, &(0x7f0000000200)={&(0x7f00000000c0)=ANY=[@ANYBLOB="cc004000", @ANYRES16=r3, @ANYBLOB="100226bd7000ffdbdf250d00000054000300080007004e21000014000600fe8000000000000000000000000000bb08000400ae0000000800010001000000080003000100000014000600fe8000000000000000000000000000bb0800030001000000400001000c0007000100000020000000080001000a00000008000200000000000c000700300000002100000014000300ff02000000000000000000000000000124000200080006002c0a00000800060001800000080004000400000008000900a30d0000"], 0xcc}, 0x1, 0x0, 0x0, 0x40000}, 0x10) 18:20:28 executing program 3: r0 = openat$selinux_avc_cache_threshold(0xffffffffffffff9c, &(0x7f0000000040)='/selinux/avc/cache_threshold\x00', 0x2, 0x0) ioctl$FS_IOC_GETFLAGS(r0, 0x80086601, &(0x7f0000000080)) r1 = socket$netlink(0x10, 0x3, 0x4) writev(r1, &(0x7f0000000000)=[{&(0x7f0000000200)="580000001400192340834b80040d8c5602067fffffff81000000000000dca87086a5c000004f6400940005891550f4a8000000006700008000f0fffeffff09000080fff5dd00000010000100000c0900fcff0000040e05a5", 0x58}], 0x1) [ 496.655026] binder: 1630:1643 Release 1 refcount change on invalid ref 24856320 ret -22 [ 496.687422] binder: 1630:1643 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 18:20:28 executing program 3: r0 = socket$netlink(0x10, 0x3, 0x4) writev(r0, &(0x7f0000000000)=[{&(0x7f0000000200)="580000001400192340834b80040d8c5602067fffffff81000000000000dca87086a5c000004f6400940005891550f4a8000000006700008000f0fffeffff09000080fff5dd00000010000100000c0900fcff0000040e05a5", 0x58}], 0x1) pipe(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$LOOP_CLR_FD(r1, 0x4c01) getsockname$unix(r1, &(0x7f0000000080), &(0x7f0000000100)=0x6e) ioctl$sock_SIOCBRDELBR(r1, 0x89a1, &(0x7f0000000140)='tunl0\x00') 18:20:28 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000300)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, &(0x7f0000012fc7)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, &(0x7f0000000f4d)}) ioctl$FITRIM(r0, 0xc0185879, &(0x7f0000000140)={0xfffffffffffffe01, 0xc18, 0x5}) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, &(0x7f00000002c0)={0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x8, 0x0, &(0x7f0000000340)=[@acquire_done={0x40106309, r1, 0x4}], 0xfffffffffffffdc3, 0x0, &(0x7f0000000340)}) ioctl$TIOCGPGRP(0xffffffffffffff9c, 0x540f, &(0x7f00000003c0)=0x0) timer_create(0x200005, &(0x7f0000000440)={0x0, 0x3c, 0x7, @tid=r2}, &(0x7f0000000280)) 18:20:28 executing program 2: r0 = socket$netlink(0x10, 0x3, 0x4) writev(r0, &(0x7f0000000000)=[{&(0x7f0000000140)="58001c00d3a00ee300001400192340834b000000000000dca87086a5c000004f6400940005891550f4a8000000006700008000f0fffeffff09000080fff5dd00000010000100000c0900fcff0000040e05a57eb3b8ce9a2777f4e94c30b4000000000000000000000000", 0x96}], 0x1) [ 496.702960] binder: 1630:1635 Release 1 refcount change on invalid ref 24856320 ret -22 18:20:28 executing program 5: request_key(&(0x7f00000004c0)='user\x00', &(0x7f0000000380)={'syz'}, &(0x7f00000001c0)="3fcb00faffffff00", 0x0) socket$inet6(0xa, 0x80000, 0x8) r0 = dup(0xffffffffffffffff) setsockopt$netlink_NETLINK_TX_RING(r0, 0x10e, 0x7, &(0x7f0000000000)={0x10000, 0x0, 0x1, 0x80000001}, 0x10) 18:20:28 executing program 3: r0 = socket$netlink(0x10, 0x3, 0x4) r1 = openat$full(0xffffffffffffff9c, &(0x7f0000000300)='/dev/full\x00', 0x10802, 0x0) setsockopt$inet_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000340)='dctcp\x00', 0x6) writev(r0, &(0x7f0000000000)=[{&(0x7f00000000c0)="580000001400192340834b80040d8c5602067fffffff81000000000000dca87086a5c000004f6400940005891550f4a8000000006700008000f0fffeffff09000080fff5dd00000010000100000c0900fcff0000040e05a5", 0x58}], 0x1000000000000076) 18:20:28 executing program 2: socketpair$inet6_tcp(0xa, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff}) fsetxattr$trusted_overlay_origin(r0, &(0x7f0000000080)='trusted.overlay.origin\x00', &(0x7f00000000c0)='y\x00', 0x2, 0x2) r1 = socket$netlink(0x10, 0x3, 0x4) writev(r1, &(0x7f0000000000)=[{&(0x7f0000000200)="580000001400192340834b80040d8c5602067fffffff81000000000000dca87086a5c000004f6400940005891550f4a8000000006700008000f0fffeffff09000080fff5dd00000010000100000c0900fcff0000040e05a5", 0x58}], 0x1) 18:20:28 executing program 5: r0 = request_key(&(0x7f0000000000)='syzkaller\x00', &(0x7f0000000040)={'syz', 0x0}, &(0x7f0000000080)="3fcb00faffffff00", 0xfffffffffffffffd) request_key(&(0x7f00000000c0)='user\x00', &(0x7f0000000380)={'syz'}, &(0x7f00000001c0)="3fcb00faffffff00", r0) [ 496.800039] binder: 1667:1671 ioctl c0185879 20000140 returned -22 [ 496.819873] binder: 1667:1671 BC_ACQUIRE_DONE u0000000000000000 no match [ 496.820831] SELinux: unrecognized netlink message: protocol=4 nlmsg_type=41171 sclass=netlink_tcpdiag_socket 18:20:28 executing program 3: r0 = socket$netlink(0x10, 0x3, 0x4) writev(r0, &(0x7f0000000000)=[{&(0x7f0000000200)="580000001400192340834b80040d8c5602067fffffff81000000000000dca87086a5c000004f6400940005891550f4a8000000006700008000f0fffeffff09000080fff5dd00000010000100000c0900fcff0000040e05a5", 0x58}], 0x1) writev(r0, &(0x7f00000023c0)=[{&(0x7f0000000040)="cd808f47235cc080ee3a26c122eee904aaa9d3ad5cd7bd834aa42c6b037366bbce7d19038f524fefbbe4959360ddea27a4e36662e63746038244596360b967ac2380931109fe7cfa7ab1ddfc8f8dfe13906c939d56721a8848fd6d17b5d003c210bb3759042ad97bd612435fa19e8fca39ceaea5d3ecd4ba98ce04ee46129b9e812317e0c15555494d", 0x89}, {&(0x7f0000000100)="8b84df02b7307d996d57dabe281418c6a6468d801bc2b9dfbf1bff59e206b703439bbf86de11851f6b24990328917d910fe04028eb5a8f6d54f125d3982a0e78f877da5e7918f8677aba1a85cee317a6a96d369a0204dd1a20f70edab70d2de255bbce65ae266435e99db6c64fd3dc460dd1d41e773523d35e0a1d80455271a7f2ae5623be8c2b78f748cd9b5ede55d6", 0x90}, {&(0x7f00000001c0)="23f7852fd3234448f609b2f2b46e71be63cbcd4fb4d9cc07f078cc796f124359fc96bd8844074894cd88f8ac8e099b90", 0x30}, {&(0x7f0000000280)="a08d9d3c711dfd29fab3031b5778ee6a8d9b40bafb5c0434b2763719dd61cfaa5239944439f857de109ae8ba2cd880ebc9873da4596cf159d266713948dcc3475e29e556536770d263f4c0306a2a3d3272ba798e8dd9b8805583c7d66e0a1f1a670dc8ea2a213807324b87232eaafb3aac99d5028eb19db2440cac8b6011a803c843400c1ffbca47066d93beb209c412e2ffb9196ea3656213441c8264af94acc1f3e043b59b57811e9564cc82e68f2212b60f098189932c50689fc4d4987203ed5ddc221ebfd3948ec9a174ebe626675de660759e497e84f02339babfcb7eeb34f2638e7478db2044d76acefded645ace6bda8510d59da311496c4133248a2fd8ea917f6fac0dcae55f5974245d0aebcac3ea5ebd605724ea1ca2ec1f0122c218e973fd3d4601309fb6e99dd5acdee9aee18ce334f5dcec717077d2e1d0bce74eafbe83a7dbb04bbd331fd9e56b5d565868276251cd194ecff281be44fa96d1d0c92c9316d6d726970a53ca987fc657736b38a16500347b66d4e917ee6879aae07f85a9bc2680a2a08b1f4729e235bfe48a9995566ccf7dd791f272c0693941ac4f5794d896b77e29b98ba9037f724e8b800fdf9c98a20e856130245360f814417ddaa80da91a11bd5f48dfecbff20171414e02f6b6eae20d87417cd365fe1ecfd8a07bfb6d2d952b99906f54c1cf5c0554ea71692b8608039a923934ab14c990b709914b5fa879e91e1a405fab59ae0237f5ae00b5fe7f71d80eaf98e3ea3663c10cb7f91b3eacfb5eb3d310178752953c2dbcf447f8f4e40e27a801a07a2e9d88ae93d4acc1565c83b4d1cf788e442b55f7525030d45dd9c6ceb06341eefee4f5a5997f4ff71302d20ed9373265236c108428f01a0a899ccf24312c6829189108b0729abdde44154e8e16f06e5442311d23df16ad80520812c46824ed2993e9cae1ecfdc73f327197c25c9cfe9cacfb25dee46e90160d01f08ff9b4229ad95b546a3901d59fd55a0c855fce4e9ba4ae167f685aab5b5f1d6aeba9f194c3bb44b24e6dfdc1fdf150a145f3859777e01d89f20e1e61d040da471bf51fe96d9150e5979f0dc1ada49e67671420c4ce267f9fc18a1adf8bf8e289e3efd9d1af460bdf59136ed3498c49124cf995be4b481cc437ab0177a02ecf3418729f8f03bc45f8caa234d0673dcb4fdd249665fb4899780dbe69714fd39fc9c4e8f55aa8662fbcd567fe5efababd333bf30e6e2cb8c2cf5362f9d673e22fa5bf2eda5af47e0cdf0ec26ff24baa40866cf9dd0a51d8fa1eebe46877aa50b48d2170e6ac55a3f2f0a1cbbbc7f83d8628ecaad4824382fc112d32ba16150e25f356065633cf6c7628b9f4bb45b6ae1855bb28797a7a0e4594f5d03a355005a9442474c847f87b2334c03c8fda4dfcea3db1148c2654a846dd47a4dacc3ed5834213065cbfd82430741dcaa4d6dff9fa65f01e759138f9115fc53438afd03206cf8bba7518d90fa45a47ce3435f049582a69cfafccd320885ae150ca59b657148a8f1f5f94dc1a20bd3f33182e0dcbc860a46d346eec08112f6a34cebad86ad85e8912d0aa2f8bffa309591e11eb39f2ba0a24934e09ab9d246bd51dfdde6c92cbe3d3d6f9a4907ace864c7e37836f40e378d04662ac8aba3a9c020967e62fb9672e6e9a5738ef60a9b1bf902acd07d3695ef1e975f181f9ea42f2fc8f24d20455d950ebc2802877a1aaac81b12a18e133cc8d39bc563c7cfb50aa0fc5cf527d3c87e790a3930c16f5068f8d19796653385a14e21c8a2a994613d6e9102d560fafa5d601b6b93e7327ca456c1affb06c469eb005f86cd3490e598b5bbbe3e1e98a5fa4410f6b944d7c99c60ad7842a3f8c2f5a0810bc872624c3a27990940eb343d35a64738817d3d6c8df12c84a06f85a7d14b6d674faa413cb5d94e86fe713e455c357a2003ceea9cf77f57b5f77d23f73a9d69ed1ae2bc02e2439aa0acdc3d5a9e3f64394148af738d9a9678a287fdfc579912241c154b27988c41e6653a35956175f491ff18285dcd0d270a5b27f978bc5d496a0d2676e681b31e0fd6cd09851534c91db203dce524151f74ae1063f49e7be187b43f7cb03a383f5945abda162a7e72d3a631c8abdbf9c5a700fd8ea3664f2e27b8e2a02d96e0637692ef375a941c037bf7c1a3b12cf9ee24db37efb5979584538b64fa059855c812825a3c24df5e3d565e2fb030214d01169fb36a5b3d81fbc1db028434cd4fb5add2d6f6300f7a1018ce0bce760537cc78c7f4b65576080b91bcef51a7ba2ac519dce480c60dad38ffba46ec1dd703374e16a4c0303ca558f9b129cb3dd0726c5ae65465ef9e9c2b0ae7509738f625929f362f72ca559afc9641c6e6c4802325fbe9eb20eff240d6e3d627e94e591b7d1ea2eb347c78b864b513021edb9aa8babdb7e1108a95b6f03219f7671c7862c1c1af026dabde5a1553c7945a9a46f3f3063dcace91320e063a9f6117e1882db0664d43e3671a80a94b7f59db88dc627838a29760758d0bc2bd1db37dcc26a98d43e3d98516692b6b2b8b8675d2d0e5ec2b45209584b453cd96daf57f94cdb37869a0a596f5086b13a11e1dd4cad11da9f64e637be8c437bb3c934a62ed2d9ee75c13166c978e2132c2b2527cfbe4a63aa1d9b2ff13b59163af78ef6bf60e8bcab010a15e7bd66d2406344b2c84d382b1655cbf4aca844dac023e98e3579e8dfabefeef275b802fa7f37d599cc1509f2ee38a6a6cb8709cc37e137f3364b5aca7d66b7f83022b6fb8168e17549f17a7a27b9fd13080b1e2d868840d9f064ae26ea22aebd84b280fa40b24c60a495013037eaddc5d0beb3283669c7707d824ed6c958e2bc7262a5422224fea88b06dda04159072e944dd0f129863a7a7a896037cd3509c001cc2c665cfd3949a0f7f34b96400fd5e9a4b22492d2f687b99f7f05a8a4ba92523f0a5db81c657b5b9dd0d0cbe158abbb1738b4ec9d2e6c9a0c4a6c4aae3dd16e227e25f741f337809dd91158a4b4a60f0b391ad3a84560399f5c2cb15e9c97886b939f4ef0462f4f44bd69e5d1a5cd62dca03b38235e48b5dd1d4a95128c70a785c801f8714b2cdb0a7542bcd85e52f26c5a03865ff4bcf92091d07f6e830bfe2c07c2e806d6526fd9f7ab684caec3590af645f626d7a353ba24ee5b91060116d360aec89824f3b7f78b73d550680cb76d7430a8b5bbbff006ee2a249ae2096a296e7d8c52d833b980b5ad95680bf1bb9670137f84a2928e1dbeae8b700d4ff520d31c435aa7273325140c124b46126a5d3c2f88fc74aa11262410658667ea93ce4607610b179f2c29deaf688551a4a572206d07ae2ee393dd78d6349f1f8e1c6321cd6ce13be6fa6134cdf6742544293fdfa9f7d279d0f9eb35ae50953c060ca2c1ebd38c10a28e47fd1fe10467f4e2cea86c0cfe48407b2b7c4404f02a151de88eda4d1a00abf6c6b7bdae7c4a4afceb017bca2c177affb4f8eb04ee3e28cad580862fac87c37a44833cee1b9d7546574241ba77fc96b25796a3ad72619680bfdd37a83bd89ff08ce53b432686b2aa5aad20d1b2275a6d9fd73663c342dec5ba67f3687d4f88d5f9f9dd62cb40ae9074f6a65ec3460f7f134b33134c613b147291f27c60faec830897e5678983165b144d5aa48333978ce24cff2ec109cbc4ea577de2d55d183f12575cfa424b38a847f77c71297c95227affa7084b42c3074ab442910557baea717eba303bceb4dbed544a53a65cb56f5b980103ff35271156a63ca7301c19c8ed36ccee5f6b26abbfc753bdc913c9410e4da6c39c96ba34ed2c60897279a4dd4bfb47255c9be52c569d7a787b869bb74032026ceb4db86d7b11f8bcbe639817d9c65090b9944e3303ef532f740dc063d770359a8bb226e0daf7913200a64cdb6fc17b74523fc37221fb155a07838d7c0ed77a4ed0972e37725ca5921dde0265e2e2930fc215354b20bdee535c3a49a867c9794be6d73eda9837dfac3515b6e877bfb37fc20fba450bb7871853034ea6a8f6f3776e8b99e9bbc216f2c976eb8f1856215097cec139391b00339d954d1e2e3d7cf6dc4cb66216c483cf495d3515d8279510133cfe59785e34c73497e5d7a81f0a2a3e8bc4d4af0a98a5fbce90db8467ab4d4a129f844e852e381bdb2e40ecfe9b52564afef5f1c7295fd56940f320bdb52c14403c2c555a330fb7550d8255222fe744eab8484d23095cb36181fdeb0e2977913076f74c2508cb368e5d834d8716e6ccbfa1f0f5eec3e03f179b0861f65139028095f48946048f7a40227757b3c66b9f675dac01fc482f5ab2795434cc85f7981a941938ed26d1a998ddb75dcee7824eebdf0acba7ec9ada20b48d2ca3b894e95c1d961cdaf156a9cbc80d7e1a6c25e158907a224260c3f1f3f4db8ce43a1afd2035f496dc94c81924e48b664eb9e49276937ba02d837e82266a47180ca047368bdd2a58bc23471558dc49610b3be1714e5070eb6ada94c2211bed6f8e8793ae54e6d82109af1bd8935a722784966c5616d68adccb670496331b419848f9de9d8ef245ec6e3852db6a8cbaf3c7c6016fd84887e198ec386672407e000f536bb5f8c6a69d9877afb869d1dc95ed1228acb842cc9d88cd39e74f564aba19767651f26b61b749ac8df40959aa5507b9eecfbcb58220ead076091e1d6d729ed822078494b34a7c74c4b5f66aba873638714450870f2b30aae53542b0b67dae5ea0179d1ee3fa1fd761a79b838cfd613d44470f3df88dad0cf2fdf5a637cffa8fbf64a5cbb176379c67467e7003b207320ab12b57a7513c6eb1a61c89c66efa5e7cf9c8c1b4398f80dfb8cbcfd1119158861e756576613769595ccb415308148bfef12c935b2773822e9811c8c4e46205f61f473da29a38fc7892c42372c849d42d3a174f10a5ddfe059ae3524a7f143fd62b54f0090a6f3d82af118065e188d8d93e6d32c0e5156021d04c49e89e0b3a91f779cd75b1353d727e49455543403a5d3a4c3d9052ccc1e81416904349566cccc050e85c28e1a881f734fc79670b34ce2f0be80add53f988cb17a07390a2851d0dc0cde1d653d8272537f356c9b0adcaa2bb48d43533fce07392c5fd3e94942a5fb98d14d2bdff177843a3e4824f9a40c4dd03c63f913d87321f6cfeeb95662f26c152cdadbf66f71ac0d3a4cf38feca2545459095770e184a84d3e795557dad67d9d28c5b26295b006d58fb75c92641e33c0c8150538e122424d9bf6e753a6c5781a6b69d883673218ded54a81f7c0216543cd47e2e00169c764f8ac1822d67a3ce93f03d285b812c042b6a561f5b7661097e48c62eb753da8c5ae1711d6949288fdd1d2ac0aa2342ec39b977269fe8e5dd52ee7e60511605d8bb6cd9daac907311d6195bbad1571c3058288b42340a5ab396d4cb603384ec84eeef412e0ca3a67793caa2c98c60fa0c96a182e30e3b16d3676a7a4d039191f7138943dcd95a82e488e65c026de330cadd8017b40be61dca1a455d7e4af321d2edf8ec3c3e6afc796024b00f0846a6508ddf9cc4b86db3ba759c4921831ced857b5bdb07aa421bac5571c1405d435afa3b5195f3f5944a86bccdab3387d1f683f9565db30d6d5020349a2f5d458b08cb5ca9b9fe349f1123321ded3af07df291909f5bda292e2e6efc8d10ede0a732263dbe8520ff272f6482cc7fbd08134cfbd63cfcaea679ebc67fe0802f87131f1bdf63f6fd1b5a75bcea0591adee42340ab01e1b7c1cbe2f237fec277ad8e3db294b84b6ae07e7a8c2217bf65ac06b3b6f", 0x1000}, {&(0x7f0000001280)="cb18605e4abca04408e2e3956de9d07819074a10d83778df02eb5dac43f535adbc7505b5e34818a0b8bf81dbd64c57c97e3914a6bf75dab21eeb82fa", 0x3c}, {&(0x7f00000012c0)="d68380cc3605274226050041271d4b5503200a6d76e5833d77aa97d45d47c31d8222e1c52e81", 0x26}, {&(0x7f0000001300)="2249a854e1dc440b89d14dfe63808aa5bd21d0d620f879e52a1e544dd89a8e8aab4a001499687ba6f8f3d24b54e6732b6ce477ab74ca483f1f2d5b6164f0dfdc54310b3dc6365fd85aa54e7374ff92051e052a2c050dd21302cd660002f1def2a9190980a5f74b0522f089b5f848cf330f42ac38f8db4ed9306973db1c72888dc7210fd0215f593d987f33126cf7fe1b2790755a2bb30d07e315abb53cb25ea452dbec6f66dad0f698417969dd9382cefb5cbd6ff04f5aede16230d9eef6623989252d4ae6fd6c5c4ca55be307d2c778f1cfc55a97432631760fac267cd9d195837607b252e999690b8eda7fccdaf2a35a8aedc5160d8d8310c4b1e409af2607040b91e0f3e94601905ef89996eb1799f3b4daa0676b2020e5e45432864add8c12a1519ab4a0102df1113b1f671ef70cd59f6bd2029254b8e462ef4bab78978334b38bc83854660cf78de116d60039015f711f90b9211267839dc0fbc8e6c0d2626260256756a3c5089618ecbccf9d117a7a0f8d7afc54fe139040a9ea92772d789b4a7895a2954c0ecf7b960d3960c27d4514a160c1bb3467c6aea10ff908ebfccfc39c97e9382d060a44103808321cad6628e746a2d67f9d112d3fe9bd14b2550f7bd94f544657093cd7ecc4f3871027cc5a38fb0419e8790bd47e63f4f94251d5aaeea51cf9d4395eb86e47f8d02b55efb1772c2a2664816bec253c6d1efb853e1f5aafe685a68b5ad58a1c828f28f362b8d5d5289603779613dbe2ae8bcf58748fb0ecbf359e5afa8a14a761fcfb77949b12a8db7694aebd484146aa45fd0d17c6891e579575c352d8d5cfe9f0421a0810d28c56d689eebdbc62b321f05b4a08c5016cfe2d9b39d09b247b528b7ef33239801de13ccee45de3f0874b5a485c7a8ea9f5f6a34cf2e5db94905dbee411f046bf42dde1b5796930df86ed15b5f48882dad7c09a15d9b53a23a0a1fe27f127fbc9a96afc3afb6d0b460117fbdb36b7e7cede92a8f96f26c72587b8f124f5024874b49d2d76c17c17f45f4d804f31379c7c975442b168ac1e4176610f21d3c72fd5a2b323dce9e513f421a69d2207415f1851fc21bea5fad5c9b9bf3b195743ad10aa0ad36709bb34c3807fbb194e20ac9ed24184e3a8d2791aaea9277d9f1ece26f313f1acad062007ed78f680717f46eefb41448122883d141b394d9f87fadddc97acdba63a7437e285f5f1f44dace804bbd35867e7e657524ecabae30f25a82d6c8c1f137f8e02216e59df9d1f44cded212d0f2edf207c4b0f7e582fe7c74d903c4aae87aee230870d28e0f2979db97f14a9e9d9425b8006e0bfee752613193cfce9281db39ab1020961736189514c63204d3004d01459c8169f297555464461ca3391bb89b0d0b1b7ffe669c03f7add1649e93b463d13252dbf10fe9446d8fd3d5288a978164e2d3a7f4d0cf09663c7bedae12ae72ef54cfd53c34a882f29a5bb287cbed0d23abe87ce729129d21cfc64f062dda3e1a8f9b6088fe3e5a959a8a3eb2afdee7d51dc0fa7ec7852490d7442ece82a0a667568ffbda44b6f23f6731821a6c5ed0eae7a823a35d3dea7558cc31d5266000fff5364141ee4570581be2d52d6cffdfbc23901da9a13579ed595eda12b790d0aa2a9826b555732bb5775c897c1bdec2761c3f5547c6547ae516ce8d1bf71d987b70071fd6afbfaa86f45d5ea32d896ffbd3328d01b397dec14853a298561ed4ebe2d5594df6793c2d169445c1b1462b405e11370e785f0e4ef39576d7f83a06445610f75e3f75a06ffbcbbf7ff63a5761d9913437504871720b0bed868625eb33aefcf39a63e33ec5f0d31bb14dd97f275f763f92ef9026ffd07386321ebe497f7c27778f267947146d1999167235abbd507463758c11a8225f0fce59d93aa0dbec83e1ec8bf40811faf2866c9d20f1e5a960f9de0ab8dce3b477039df4bc0c2d7673abe548c168bb8ff9796845c2235d380d3202d6d0504a454ffb2357fa2771670e32857393226c5c9a9de4dd97f2d118f2279ecc7d679aa52b70c19e4462a3c7dfc43f40460248be818c377fae611693cf562f2b8a7e3ad2b182e521abeed510bfee3b32b5e251a8012593c05eff0702d863532ffac61b0f297548bfb34deff145f6ca0cf4d3e742b8305f52e65d1ec5289f0677b9513861365a4d042be257dfd5902b89b17a0531d99e6f51bfc10b54350429a30907f4f7f5b62c0e5f1f1bb8b968c6e843f46d1c83ac91faa9bb549afc15de1b2a60e4f5c1b83cdad616de103c75736ec07f2806343858f16a9f83af9488c2ab956a349de8a0990b000056a58ead2e869dbb674f76fecf8af1efa815e35ac507d5f32881cf0f974283dcb2e8a88620313165eac483f2ab024fdf4542518cfa1a983409b07b59108583ff495114dc7c45ceaccecc2735dd207f2f4a4beb83116d2acb5b14e066b2a7809e564ce50144749be29a1da7deffd4f16802753e599f70bca34bb07223ed2490f919af399db8c64ba03d7788a5911772296a2f568dcd1e77e9eab5dfd4377cfb51dd15d4ff3eb622304585cfe987c67417b59a6cd753c35882b268e461f48e36abb3d0bd830aa2ef361e994dc7777229af6d2cefc7e125f682f7f2836ba4dc00ee0165924a5553cb9a6ca0a541ae672247e07f5463c5bbd0428a33e3babe8eec9e4e80932eecb5da5b5b17b999fe628a376fcce5118ccead9d9beac5a90d7dc4716bdf8d72813e4efa50422ae571dcee413d375c1e0241d953b4fa92edcbd5b31bbbc9344e08fe12ba2efc36d7f6318769a8ba4ae2d73522a26145cfc53a992caca5cdf7d0cbe2c5d64b548e58ac74caedd6638ee7e814d4e637da18db36fa0c72cf10a7b3cd329328ffd64e56f1752772021bc6c85a362de64568e85a43d57a15f149e385ce1320c0987c320753d5de01f59c7c041ac9345d130718a50b23b559387588a81a09a5ba2ac39e7832437d3dae9c3400a2f5690a35480e86772ab019a0b323a9c4e5f9edc5b032e2be8b291fb329f498b20ea4f3fb930af255ca598a27c61f7fed8735e58453d2431c7e5fe7f27384ccd1f5bddf5350cdd5984d8195e02935bc09c0c30aaa1f976793b739291c57e56b8dabaf23e021fa57b057e3cc6169accf7cd2c10169e932fbdf267536cb4041f6f9ae58574807accfe2f641de1f2757796974e099f1d8349f503c88d4b29928bcd8a1d5fe681a64259b30518dc67ee9bf19198acfaabbccb3ed86c941b5109da1de65769cd97b3f5eec856470d326e8431e18d2eca27caec58ab304c461eccd04e2e8de8bd588d2f4aee474345edaadc088b6abde7abae6188a0c8bc7ce66cf2818c6acf17aace77bacc33c96dce829fcc6fe95a671cdfdafadf9542a38f730f0c83ccfe49395947a5fb9ecf6358829335ed44efa89cb7c82c8c9d20f24849d73334619e84e68c5c6c1431a13b8aff69f7fb12bdc6891283547c1ecfec2dfe116e1f053cb0d3d7b3c3394a54a8ebe924abf49460bd4857398cee29fd44bb5cd728b5d254b354da3e17abbc4b3b76e7f3ebcd3f9b37ef1a19b326d3da1aaf438e44807027c74c781420d14bde4a4400ba9fb179c363082ffd5f289819eb5128cfbf0f27d4fca4da9989990a2851ae96ea69fe11f95991053259073ef1d2b1e09cf7840cb44327241d95eb75faa9269bd98f7b8cf29e063d18f7979c24a97ddc285e55d9cd3a893962d12967f5ad8662a9c5abbefacd7b8f3e8e0c4454eb2a3b07422f4d4eb0f6a183185281f45642c8d0f03f90d6860c5acf8403dcbe292b18c33fc933151f1a27087a67e131a84bd2ca77ce90044bbdce0f80a4e80c8affcb0a984d8bb511477279f6007db8da1f689a5fcdbde197b401039c75cb4587483575459644d419edf77c953187cb79a6b35bb09b132a9af0780b06fda93b7374c3b41246aa35d044cd749d8b4031dcad0b032b50b11bc9c1c2f2509464dda4c99ab9955aa4b8c683aeab03dd655e2f861e209ceb203d728fd3978cf0ed77dd56ce05844f84867ad45d0362bd241fe347297733458dabd2c77019215d78c1243bb16863acdb7373444897ccfcb0788b9819cebaf601d479f755773a3dbd8346b7617f901c158b9180717e06e554518659ae6de9d05e17767ae3fa2f489fc813231317ff7d274e2e143ca5bdcc4721abd308204faa861bc1cd7bafa843235e17153d5457e29ea7ae193588dcb46e56da0c9f987982a8f3d1f0226d598b4221484e2e741e2ccc071bf1fba6fe3b452f9d09db6a638985ec70d1b5230933527a14c27de78f113a9810264de420379ee5c672debab0250370bfe3c721f0bc5a2d5edbbe7923308d61eea074852c9ae90cc88eee46ae29ba62011dbc3a9a2cdaaa198c5e46d66e40d3914dceeb43483c29eec44ab9d2c4eabb7594ed112a35983ecf27d66df8a46d54f74adb91eb6d3cc30625f6511add703f7ba342a7c064159bcab467d8dde1cbfd785391de1045660f32dca1cb7ea1166f1d96b3ca8544d6260367f6a5f1f584a13f9a9878e5a54348eeaefca2928c70c5546c2c333c59f0f19f88fc67762877c0a4fb2f4cd81038d1e57abe02ff15dc6b223e57c395200859801514e1c7c6d158ea73743abfda809963101e1eb4af02531476c080aadbf96f5bb6cd1b34979fa50697d9308beb65fac5e78df5b61f168555de36cd89084328e4917d77083bda15b8315dbe226e75344cc6761e47e1122515efa311fbf8df7054fd0333dcf2fdd44ff99a526b22f85350cde70ee1ea99dac40a58d4e8ed84af9db1795dff7cf9bbff42088b9c6b6675ecdb2a01bea9bf3615ba3c2c264f4ae08da0de8babbf9536c2294e458525c34521e8d504c4fd1f3d8d4ceb1dcffebc436500e2261a022790437a9a1688aa64b96e2cde29eb7ea15768afb3b9d65e666883a0175f4f6effe30a9d03f92fecd27c89b856b65e78fcf0b8f9726a8a96937f8846f94e1f14a16eec94bc5ea9e9728fb32f82fdb226de47d3cd6da3835ea393bc76271e9cdbfd3167501b7d4cf1fca54263d61dc5bab2607382478274af497c0f023be4d754c6c49f8b671282f75e1d35832af6f9b02fac06da9eb649658fbd837b3b954b14e82d161196a24c41277d7a306867bc62df6ea6051da386bd9c0d16cdb477201b82a90111ef780b86d24a227c6c298203edb99ec764f947f798c550aa544e314b0aaed78a3f69c60f5c126f7be78db5662196537f64e97260cfddd17f2eac7304d1b18b5b372f660b27aa07afb9b4ea05bd9d25308cc54b20e834e1449ad6ce59d399a144419f2613226c8d7af1313cbfae7b864c45c45d45889d31f19134982976754449d783aff0a5c55c2a1177f03683be059f5e42a27f0f75f6a9d574f337c71de16b455249c7a69141b919baaa0ca1519d948358d73de29c2d3fca4c453d7b565ca2cf2092ac812ff7ce053afab4c0e903f64ffc338b51df334a65f2bdca0919207a145e91cafef3cea299ef444e67fca3d691417d45b08333484b9cfe5c07e6067f36a88febb861f4a4c26a9636a1d88837df78814fafb7db9ff375645d18a5eafb858668bd2ce58bc6c99c304370209e7a9b3a61a580b01072afc47fb33b718feed2cf0b6ab320aab98e10960ddf96bbe32f201ceabac55c810cb930e4c0bcdf2ebb2830b295d40f0c45587f8d8fe953de7067ef71f4af0d6b059df1d2f671a5d592caea218baa8606f65532b86603c12f67a6826c340bc63e502b7918c7c6399fb6e6ec07397ea1d4d3c0f2948e30cd95241cb0b02f2a3259186828aaf0", 0x1000}, {&(0x7f0000002300)="8db345aaba6c5583f528c5422e344fcf0d5ab7262c0975f01d254f9c23ac7dc055f8e6a51a040eb64817189b12dce68d1e98bc345dbb6af5c036cb417fce4dbf54de337aeaf3e60a651157b0bd7a684e01aa58d968c7642f899abf5dfb4063ef4a6170e06de53b0696ec2694091f7f89b2cfebf87baf60c75b15b019718631341de87c8822fae178da6b265f21e176ac92588da877caed5f30ae2c18b6e0a7ab5c", 0xa1}], 0x8) r1 = syz_open_procfs(0x0, &(0x7f0000002440)='net/psched\x00') ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x2400, 0x7) [ 496.931198] SELinux: unrecognized netlink message: protocol=4 nlmsg_type=23587 sclass=netlink_tcpdiag_socket [ 496.966096] SELinux: unrecognized netlink message: protocol=4 nlmsg_type=23587 sclass=netlink_tcpdiag_socket 18:20:29 executing program 4: r0 = socket$netlink(0x10, 0x3, 0x4) writev(r0, &(0x7f0000000000)=[{&(0x7f0000000200)="580000001400192340834b80040d8c5602067fffffff81000000000000dca87086a5c000004f6400940005891550f4a8000000006700008000f0fffeffff09000080fff5dd00000010000100000c0900fcff0000040e05a5", 0x58}], 0x1) r1 = openat$selinux_avc_cache_stats(0xffffffffffffff9c, &(0x7f0000000040)='/selinux/avc/cache_stats\x00', 0x0, 0x0) getpeername$packet(r1, &(0x7f0000000080)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @remote}, &(0x7f00000000c0)=0x14) setsockopt$inet_mreqn(r1, 0x0, 0x23, &(0x7f0000000100)={@remote, @empty, r2}, 0xc) ioctl$ifreq_SIOCGIFINDEX_team(r0, 0x8933, &(0x7f0000000400)={'team0\x00', 0x0}) ioctl$sock_inet6_SIOCADDRT(r1, 0x890b, &(0x7f0000000440)={@loopback, @local, @mcast2, 0x0, 0x1, 0x0, 0x400, 0x4, 0x800002, r3}) 18:20:29 executing program 2: r0 = socket$netlink(0x10, 0x3, 0x4) writev(r0, &(0x7f0000000000)=[{&(0x7f0000000200)="580000001400192340834b80040d8c5602067fffffff81000000000000dca87086a5c000004f6400940005891550f4a8000000006700008000f0fffeffff09000080fff5dd00000010000100000c0900fcff0000040e05a5", 0x58}], 0x1) pipe(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$getflags(r2, 0x1) ioctl$KDGKBMODE(r1, 0x4b44, &(0x7f0000000080)) fsetxattr$security_capability(r1, &(0x7f00000000c0)='security.capability\x00', &(0x7f0000000100)=@v1={0x1000000, [{0x4, 0x1}]}, 0xc, 0x2) 18:20:29 executing program 5: r0 = socket$netlink(0x10, 0x3, 0x8000000004) r1 = fcntl$dupfd(r0, 0x0, r0) getsockopt$inet6_mreq(0xffffffffffffff9c, 0x29, 0x15, &(0x7f0000000100)={@ipv4={[], [], @multicast1}, 0x0}, &(0x7f0000000140)=0x14) ioctl$UI_SET_SNDBIT(r1, 0x4004556a, 0x3) recvfrom$packet(r1, &(0x7f0000000000)=""/202, 0xca, 0x0, &(0x7f0000000200)={0x11, 0x0, r2, 0x1, 0x0, 0x6, @link_local}, 0x14) r3 = socket$inet6(0xa, 0x1000000000002, 0x0) getsockopt$inet_mreqsrc(r1, 0x0, 0x28, &(0x7f0000000480)={@loopback, @local}, &(0x7f0000000980)=0xc) write$uinput_user_dev(r1, &(0x7f0000000a00)={'syz0\x00', {0x10001, 0x10001, 0x83, 0x1}, 0x52, [0x2, 0x5, 0x9, 0x20000, 0x400, 0x7, 0xce, 0x1, 0x1, 0x3000000000, 0x6, 0x1f, 0x6, 0x7, 0x5, 0x8, 0x3, 0xc14, 0x8, 0x7, 0xfff, 0x5, 0x4, 0x6, 0x7, 0x9, 0x2, 0x401, 0x5, 0x2, 0x80000000, 0x7, 0x8, 0x3e4, 0x1, 0x4, 0x7, 0x2, 0x0, 0x20, 0xffffffffffffffff, 0x100, 0xfffffffffffffffa, 0x4, 0x8, 0x1, 0x0, 0xffff, 0x0, 0x3ff, 0xcf9c, 0x6, 0x8, 0x1, 0x7, 0x400, 0x8, 0xfff, 0x7, 0x7, 0x8, 0x101, 0x2, 0x9], [0x7ff, 0x9, 0xfffffffffffffffc, 0x6, 0x400, 0x47e, 0x6, 0xb1c6, 0x7, 0x6, 0x80000000, 0x3f, 0x100, 0x9, 0x8, 0x1000, 0x4000000, 0x0, 0x3ff, 0x9, 0x80000000, 0x7f, 0x7, 0xfc000000000, 0x7, 0x7, 0x4, 0x6, 0x9, 0x2043, 0x3ff, 0x3, 0xc2, 0x8, 0x0, 0x1, 0x400, 0xffffffff, 0x25f2, 0xa000, 0x401, 0x7c, 0xe337, 0x8, 0x1000, 0x7, 0x80, 0x49e4, 0x6, 0x4e, 0xeef2, 0x400, 0x3ff, 0x0, 0x3, 0x0, 0x3, 0x4, 0x5, 0x1f, 0x4, 0xfff, 0x7f, 0x1], [0x100000000, 0x3, 0x4, 0x23ce, 0x7, 0x5a81, 0x3, 0x2, 0x3, 0x7fffffff, 0x1, 0x200, 0x6, 0xffffffff, 0x66, 0x7fff, 0x1ff, 0x1ff, 0xffff, 0x0, 0xfffffffffffffc01, 0x8001, 0x800, 0x0, 0x93b, 0x9, 0x3, 0x574354d2, 0x3ff, 0x2, 0x0, 0x20, 0x0, 0x1, 0xc8b, 0x7, 0x74ff, 0xd06, 0x14, 0x9, 0xffffffff, 0x9, 0x11, 0x4, 0x4, 0x1, 0x400, 0x40656d67, 0x400, 0x100, 0x4, 0x7fffffff, 0x7, 0x8000, 0x3, 0x9, 0x7, 0x101, 0x1, 0x8, 0x5, 0x6, 0x6c4, 0x2], [0xfffffffeffffffff, 0x81, 0x10000, 0x5, 0x5, 0x8000, 0x10000, 0xbd, 0x5, 0x6, 0xffffffff80000000, 0x1, 0x7fffffff, 0x1, 0x9, 0x7fff, 0x1, 0x4, 0x7, 0x10001, 0x1, 0x3, 0x8, 0xfffffffffffffc01, 0x331, 0x3, 0x80000001, 0x7, 0x5, 0x3, 0x1, 0x3, 0x6, 0x10000, 0xaf, 0xffffffff, 0x9a12, 0x2, 0x9, 0x21c, 0x8, 0x1, 0xcac6, 0xffffffff80000001, 0xffffffff, 0x3f, 0x8ec, 0x9, 0x101, 0x4, 0x8, 0x7f, 0x4, 0x6, 0xb8c, 0x200, 0x2, 0x1000000000000000, 0x3, 0x9, 0x3f, 0x3, 0x4, 0x20]}, 0x45c) r4 = openat$selinux_status(0xffffffffffffff9c, &(0x7f0000000180)='/selinux/status\x00', 0x0, 0x0) openat$dir(0xffffffffffffff9c, &(0x7f0000000240)='./file0\x00', 0x400000, 0x20) write$uinput_user_dev(r1, &(0x7f0000000500)={'syz1\x00', {0x2, 0x8, 0x100000000, 0x7f}, 0x4a, [0x1f, 0x2, 0xc, 0x1, 0x7, 0x4, 0x1, 0x1, 0x1, 0xa4b, 0x0, 0x401, 0x1, 0x400, 0x200, 0x100, 0x0, 0x100000001, 0x3, 0x9, 0x10001, 0x3, 0x400, 0xa32, 0x3, 0x9, 0x72ee, 0x8, 0x4, 0x5, 0x3, 0xffffffffffffff9e, 0xa7b7, 0x6, 0x4, 0x5, 0x9, 0x20, 0x2e, 0x3, 0x3, 0x5, 0x8, 0xb889, 0x2, 0x9, 0xffffffff80000001, 0x7, 0x100, 0x7, 0xfffffffffffffffe, 0x3, 0x7, 0x3, 0x81ba, 0x1, 0x100000001, 0x5, 0x3, 0x2, 0x3, 0x20, 0x1, 0x6], [0x81, 0x9, 0x0, 0x200, 0x2, 0x7fff, 0x1, 0x3a19, 0xc1, 0x5, 0x7, 0x8, 0x0, 0xed69, 0x3, 0x3de, 0x9, 0x2, 0x63cdd5fb, 0x8000, 0x6, 0x4, 0x3032, 0x41, 0x2234, 0x3, 0x8, 0x101, 0x890, 0x1, 0x100, 0x8, 0x0, 0x4, 0x97c7, 0x19, 0xfffffffffffffffa, 0x9, 0x1f, 0x3ff, 0x5, 0x9, 0x7, 0xffffffff, 0xd80, 0x6, 0x400, 0x400, 0x2, 0x81, 0x5, 0x7, 0xd363, 0x100000000, 0xce2, 0x1, 0x3, 0x8001, 0x0, 0x7, 0x5, 0x8, 0x400, 0x2], [0x100000000, 0xffff, 0x9, 0xd2, 0xab4a, 0xfffffffffffffff8, 0x101, 0x1, 0x9, 0xfff, 0xd6, 0x7, 0x5c, 0x1, 0x1, 0x1, 0x8, 0x0, 0x5, 0x0, 0x800, 0x3, 0x1ff, 0x0, 0xaa, 0x3, 0xb08, 0x10001, 0xbe, 0x7, 0x1000, 0x8, 0x8001, 0x5, 0x4, 0xfffffffffffffffa, 0x5, 0xffff, 0x9, 0x0, 0x70b2, 0x1, 0xcf, 0x3, 0x10001, 0x9, 0x10001, 0x3, 0x2, 0x1, 0x7f, 0xffffffff, 0x8, 0xfffffffffffffbff, 0x7, 0x1d, 0x400, 0x5, 0x3, 0x1000, 0x4, 0xffffffff80000000, 0x4], [0x200, 0x6, 0x4, 0x56, 0xffffffff, 0x80000000, 0xfee3, 0x3f, 0x7a, 0x3ff, 0x2, 0x1000, 0x69f2, 0x7, 0x6, 0x0, 0x2, 0x3ff, 0x7, 0xfffffffffffffffa, 0x100, 0x3, 0x0, 0x100000000, 0x80000001, 0x9, 0x10001, 0x80000001, 0x8, 0x7, 0x2b07, 0x3, 0x10000, 0x4, 0xff, 0x10000, 0x400, 0x44, 0xb90, 0x4, 0x1, 0x100000000, 0x991, 0x2, 0x2, 0x3, 0x7f, 0x80, 0x0, 0x0, 0x8, 0x5, 0x7fff, 0x401, 0x2, 0x3, 0x5, 0x1, 0x7, 0x10001, 0x7, 0x100000001, 0x7f, 0xec]}, 0x45c) ioctl(r3, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070") chmod(&(0x7f00000009c0)='./file0\x00', 0x5) writev(r0, &(0x7f0000000340)=[{&(0x7f00000002c0)="580000001200ad2d6de3d4eb656942d427323b470c458c5603067fffffff81004e220000000058000b4824ca945f64009400050028925aa80000000000000080000eff01000000000000fff5dd000000108a2585ae5a4ae4", 0x58}], 0x1) request_key(&(0x7f00000004c0)='user\x00', &(0x7f0000000380)={'syz'}, &(0x7f00000001c0)="3fcb00faffffff00", 0x0) getsockopt$IP6T_SO_GET_INFO(r4, 0x29, 0x40, &(0x7f00000003c0)={'filter\x00'}, &(0x7f0000000440)=0x54) 18:20:29 executing program 3: r0 = socket$netlink(0x10, 0x3, 0x2000000000020015) writev(r0, &(0x7f0000000000)=[{&(0x7f0000000200)="580000001400192340834b80040d8c5602067fffffff81000000000000dca87086a5c000004f6400940005891550f4a8000000006700008000f0fffeffff09000080fff5dd00000010000100000c0900fcff0000040e05a5", 0x58}], 0x1) r1 = openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000040)='/selinux/commit_pending_bools\x00', 0x1, 0x0) ioctl$sock_SIOCGPGRP(r0, 0x8904, &(0x7f00000003c0)=0x0) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000000400)={{{@in6=@loopback, @in=@loopback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@loopback}, 0x0, @in=@broadcast}}, &(0x7f0000000500)=0xe8) fstat(r0, &(0x7f0000000540)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) accept4$unix(r1, &(0x7f0000000640), &(0x7f00000006c0)=0x6e, 0x800) sendmmsg$unix(r1, &(0x7f0000000600)=[{&(0x7f0000000080)=@file={0x0, './file0\x00'}, 0x6e, &(0x7f0000000380)=[{&(0x7f0000000100)="5ef95ecdb2a9173cbb80f23a3037b5edf7c5650107d53c1ac23baba11ac62d2f750e354b2fd21dbca4238b5528d72576f93465ebf9cd48eb5ee6b88e513bb8727d2753bd4b5deb883386680e5bd35b284cdc02f778f51a11ade32b3b4fe0b9f3472ce0685f63c69f7483b06b436d931d63d0172c1c15171832b157ab4ed307191d386f9457d9085f96696a834e7f46fe37b2ec7decc1bfa02fa0f853b72fad2a9a93e84499eaeb4951fab6a0631816155dc3769b2d2c0b56432d15d8c82e452861ad552144450a6c6eb0cac7e5cdf03f178723de8a56a7107c343e0fecd6c3885b09ca90c04cae03ac49008aba14abdae10f", 0xf2}, {&(0x7f0000000280)="f7fc94d6dab9786e3e83f938c2d8c96fdedaa816b8c54977399a25d58e197bb86c6e74bdc73a231ff1f4951bb2ee95b49caa4b2607942b2fa9af810ee57624bd23822b28aac17c281e48ca4c8bff500c8477cef2543cea46b83e79a2e4ced5297f68b2c784b2e226239a94c802c3eeffb173bce681a41dcfdd1087896c4891188e8ef8f88debd915331982bef1835cd6d6826c9c28da1cee7c0757e82b9226ba84e37d50b38eba20722bc4be8caad22307c5ce5777b810efca0c93b7b82ca578f6a5553f113082e1e3e663d4b1a2a9161820f260a93e6d8985a9ae76", 0xdc}], 0x2, &(0x7f00000005c0)=[@cred={0x20, 0x1, 0x2, r2, r3, r4}], 0x20, 0x4000000}], 0x1, 0x1) 18:20:29 executing program 0: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) add_key(&(0x7f0000000000)='blacklist\x00', &(0x7f0000000040)={'syz', 0x2}, 0x0, 0x0, 0xfffffffffffffffb) request_key(&(0x7f0000000080)='.dead\x00', &(0x7f00000000c0)={'syz', 0x2}, &(0x7f0000000100)='cpuset[\x00', 0xfffffffffffffffb) r1 = add_key(&(0x7f0000000140)='pkcs7_test\x00', &(0x7f0000000200)={'syz', 0x0}, &(0x7f0000000240), 0x0, 0xfffffffffffffffc) request_key(&(0x7f00000004c0)='user\x00', &(0x7f0000000380)={'syz'}, &(0x7f00000001c0)="3fcb00faffffff00", r1) [ 497.519459] SELinux: unrecognized netlink message: protocol=4 nlmsg_type=0 sclass=netlink_tcpdiag_socket [ 497.549168] SELinux: unrecognized netlink message: protocol=4 nlmsg_type=0 sclass=netlink_tcpdiag_socket [ 497.593970] binder: 1667:1684 Acquire 1 refcount change on invalid ref 0 ret -22 [ 497.602717] binder: 1667:1727 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 497.610278] binder: 1667:1684 ioctl c0185879 20000140 returned -22 [ 497.617388] SELinux: unrecognized netlink message: protocol=4 nlmsg_type=0 sclass=netlink_tcpdiag_socket [ 497.628157] binder: 1667:1727 BC_ACQUIRE_DONE u0000000000000000 no match 18:20:29 executing program 2: r0 = syz_open_procfs(0x0, &(0x7f0000000100)="2f65786500000000000409004bddd9f191be10eebf000ee9ff0700000000000054fa07424adee916d2da75afe70b35a0fd6a1f0200f5ab26d7a071fb35331ce39c5a65686410721ee2db6a74e3332653") fcntl$setstatus(r0, 0x4, 0x5ffe) r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000100)='./cgroup.cpu\x00', 0x200002, 0x0) fchdir(r1) r2 = creat(&(0x7f0000000700)='./bus\x00', 0x0) write(r2, &(0x7f0000000180)="dcdc9d365953970baa7355b127d82989f21c81fc14673f16c6759d35c55e80b2718faa654504691a855694e30ed1d9383ef2809e63afd07b", 0x38) fcntl$setstatus(r2, 0x4, 0x6100) ftruncate(r2, 0x48204) r3 = open(&(0x7f000000fffa)='./bus\x00', 0x141042, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x800002, 0x11, r3, 0x0) r4 = open(&(0x7f0000000000)='./bus\x00', 0x0, 0x0) sendfile(r2, r4, &(0x7f0000d83ff8), 0x8000fffffffe) pread64(r0, &(0x7f0000002000)=""/4096, 0xfffffd80, 0x0) writev(0xffffffffffffffff, &(0x7f0000000000)=[{&(0x7f0000000200)="580000001400192340834b80040d8c5602067fffffff81000000000000dca87086a5c000004f6400940005891550f4a8000000006700008000f0fffeffff09000080fff5dd00000010000100000c0900fcff0000040e05a5", 0x58}], 0x1) 18:20:29 executing program 0: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = fcntl$dupfd(r0, 0x406, r1) write$selinux_user(r2, &(0x7f0000000000)={'system_u:object_r:var_lock_t:s0', 0x20, 'sysadm_u\x00'}, 0x29) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) request_key(&(0x7f00000004c0)='user\x00', &(0x7f0000000380)={'syz'}, &(0x7f00000001c0)="3fcb00faffffff00", 0x0) 18:20:29 executing program 3: r0 = socket$netlink(0x10, 0x3, 0x4) writev(r0, &(0x7f0000000000)=[{&(0x7f0000000200)="580000001400192340834b80040d8c5602067fffffff81000000000000dca87086a5c000004f6400940005891550f4a8000000006700008000f0fffeffff09000080fff5dd00000010000100000c0900fcff0000040e05a5", 0x58}], 0x1) ioctl$FS_IOC_GET_ENCRYPTION_PWSALT(r0, 0x40106614, &(0x7f0000000040)={0x0, @speck128}) 18:20:29 executing program 4: r0 = syz_open_dev$binder(&(0x7f00000002c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000300)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0xffffffffffffff5c, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="0563044000000080"], 0x3e7, 0x0, &(0x7f00000001c0)="f6e7268fa220bad54315cd236213f2879230"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000040)={0x8, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0d630c4010000002"], 0x0, 0x0, &(0x7f0000000f4d)}) r2 = openat$selinux_policy(0xffffffffffffff9c, &(0x7f0000000080)='/selinux/policy\x00', 0x0, 0x0) setsockopt$IP_VS_SO_SET_STARTDAEMON(r2, 0x0, 0x48b, &(0x7f0000000100)={0x3, 'teql0\x00', 0x3}, 0x18) setsockopt$inet6_opts(r2, 0x29, 0x36, &(0x7f0000000140)=@dstopts={0x25b43b4755503629, 0x6, [], [@pad1, @enc_lim={0x4, 0x1, 0xfff}, @calipso={0x7, 0x20, {0x100000001, 0x6, 0x8, 0x6, [0x3ff, 0x80000001, 0xfffffffffffffffe]}}, @jumbo={0xc2, 0x4, 0x1}, @padn={0x1, 0x5, [0x0, 0x0, 0x0, 0x0, 0x0]}]}, 0x40) r3 = dup(r1) ioctl$FS_IOC_GET_ENCRYPTION_PWSALT(r3, 0x40106614, &(0x7f0000000180)={0x0, @aes256}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000000c0)={0x8, 0x0, &(0x7f0000000340)=ANY=[@ANYBLOB="090060350b310000985edaf2eff281fa94d91d41dd80877bf9abaabde4ef1752169945c931b6eea0f28da3d4eee59108ee3e6e1ff288aac479cda68d0ac1e1fed63b1f2c9153c365ba6dce4ca0127328257283e6ec02f5dee919cb1b4b84cbd849c7adcd3d8c150643558f1b9c46a2d84d9ab4d7bd9c919f5401b403acc11ec171d6b9a2e29baf745cc8c00de3dc8e22e15a157df8207c30fa9099f412f44ba5fb61e2caeaea0e716805721e0cf331e2cca1228b26a064bacd8f38ad106920"], 0x1a4, 0x0, &(0x7f0000000340)}) 18:20:29 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000300)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, &(0x7f0000012fc7)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, &(0x7f0000000f4d)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x8, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="504104408146dba044a9c2671404ab38cab75fbfb88cea9be003d97db414a752899342d7d235364bbce55babfce898c6b069c35013b1"], 0x0, 0x0, &(0x7f0000000340)}) 18:20:29 executing program 5: r0 = request_key(&(0x7f0000000080)='id_resolver\x00', &(0x7f00000000c0)={'syz', 0x1}, &(0x7f0000000100)='trusted*@\x00', 0xfffffffffffffff9) request_key(&(0x7f0000000040)='ceph\x00', &(0x7f0000000000)={'syz', 0x2}, &(0x7f00000001c0)="3fcb00faffffff00", r0) r1 = socket(0x11, 0xf, 0x8) ioctl$sock_inet_SIOCRTMSG(r1, 0x890d, &(0x7f0000000200)={0x2, {0x2, 0x4e21, @broadcast}, {0x2, 0x4e23, @multicast2}, {0x2, 0x4e24, @dev={0xac, 0x14, 0x14, 0x18}}, 0x84, 0x3f, 0x4, 0x4, 0xffff, &(0x7f0000000140)='ifb0\x00', 0x3, 0x8, 0x6}) [ 497.638415] SELinux: unrecognized netlink message: protocol=4 nlmsg_type=0 sclass=netlink_tcpdiag_socket 18:20:29 executing program 0: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) close(r0) request_key(&(0x7f00000004c0)='user\x00', &(0x7f0000000380)={'syz'}, &(0x7f00000001c0)="3fcb00faffffff00", 0x0) 18:20:29 executing program 3: r0 = socket$netlink(0x10, 0x3, 0x4) r1 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ppp\x00', 0x0, 0x0) ioctl$RNDADDTOENTCNT(r1, 0x40045201, &(0x7f00000000c0)=0x4) ioctl$sock_ifreq(r0, 0x8925, &(0x7f0000000040)={'veth0_to_team\x00', @ifru_ivalue=0x8}) writev(r0, &(0x7f0000000000)=[{&(0x7f0000000200)="580000001400192340834b80040d8c5602067fffffff81000000000000dca87086a5c000004f6400940005891550f4a8000000006700008000f0fffeffff09000080fff5dd00000010000100000c0900fcff0000040e05a5", 0x58}], 0x1) [ 497.674948] binder: 1735:1737 unknown command 1074553613 [ 497.700378] binder: 1736:1743 unknown command 1074020688 [ 497.704194] binder: 1735:1737 ioctl c0306201 20000040 returned -22 18:20:29 executing program 5: request_key(&(0x7f0000000080)='user\x00', &(0x7f0000000040)={'syz'}, &(0x7f0000000000)="3fcb00faffffff00", 0x0) [ 497.757519] binder: 1736:1743 ioctl c0306201 200000c0 returned -22 18:20:29 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000300)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, &(0x7f0000012fc7)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, &(0x7f0000000f4d)}) clock_gettime(0x0, &(0x7f0000000040)={0x0, 0x0}) ppoll(&(0x7f0000000000)=[{r0, 0x1000}, {r0, 0x2040}], 0x2, &(0x7f0000000080)={r1, r2+30000000}, &(0x7f0000000100)={0xfffffffffffffffe}, 0x8) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x8, 0x0, &(0x7f0000000140)=[@release], 0x0, 0x0, &(0x7f0000000340)}) close(r0) 18:20:29 executing program 0: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) request_key(&(0x7f00000004c0)='user\x00', &(0x7f0000000380)={'syz', 0x0}, &(0x7f00000001c0)="3fcb00faffffff00", 0x0) r1 = creat(&(0x7f0000000000)='./file0\x00', 0x8) write$smack_current(r1, &(0x7f0000000040)='syz', 0x3) 18:20:29 executing program 3: r0 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x2000, 0x0) fcntl$setlease(r0, 0x400, 0x0) r1 = socket$netlink(0x10, 0x3, 0x4) writev(r1, &(0x7f0000000080)=[{&(0x7f00000000c0)="580000001400192340834b80040d8c5602067fffffff81000000000000dca87086a5c000004f6400940005891550f4a8000000006700008000f0fffeffff09000080fff5dd00000010000100000c0900fcff0000040e05a5", 0x58}], 0x1) 18:20:30 executing program 2: openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000040)='/dev/loop-control\x00', 0x100, 0x0) r0 = socket$netlink(0x10, 0x3, 0x4) r1 = syz_open_dev$evdev(&(0x7f0000000080)='/dev/input/event#\x00', 0x7, 0x80000) ioctl$EVIOCSCLOCKID(r1, 0x400445a0, &(0x7f00000000c0)=0x5) writev(r0, &(0x7f0000000000)=[{&(0x7f0000000200)="580000001400192340834b80040d8c5602067fffffff81000000000000dca87086a5c000004f6400940005891550f4a8000000006700008000f0fffeffff09000080fff5dd00000010000100000c0900fcff0000040e05a5", 0x58}], 0x1) r2 = openat$full(0xffffffffffffff9c, &(0x7f0000000100)='/dev/full\x00', 0x24040, 0x0) r3 = getpid() ioctl$BLKTRACESETUP(r2, 0xc0481273, &(0x7f0000000140)={[], 0xcb1, 0x3127, 0x3, 0x0, 0x5, r3}) 18:20:30 executing program 5: request_key(&(0x7f0000000140)='user\x00', &(0x7f0000000080)={'syz', 0x1}, &(0x7f00000000c0)="3fcb00faffffff00e6815b7575d0569ffac642404afd8a56c4992ae56710be74f271a582bce6c1a8b430acad12f86a39e028eb65b9f02f0f91f80d1895", 0x0) 18:20:30 executing program 3: r0 = socket$netlink(0x10, 0x3, 0xf) writev(r0, &(0x7f0000000000)=[{&(0x7f0000000200)="580000001400192340834b80040d8c5602067fffffff81000000000000dca87086a5c000004f6400940005891550f4a8000000006700008000f0fffeffff09000080fff5dd00000010000100000c0900fcff0000040e05a5", 0x58}], 0x1) [ 497.844589] binder: 1735:1737 ioctl 40106614 20000180 returned -22 [ 497.867973] binder: 1735:1737 unknown command 895483913 [ 497.885854] binder: 1735:1737 ioctl c0306201 200000c0 returned -22 [ 497.932807] ------------[ cut here ]------------ [ 497.937594] kernel BUG at fs/ext4/inode.c:1907! [ 497.942252] invalid opcode: 0000 [#1] PREEMPT SMP KASAN [ 497.948143] Modules linked in: [ 497.951483] CPU: 0 PID: 352 Comm: jbd2/sda1-8 Not tainted 4.4.161+ #110 [ 497.958227] task: ffff8800b960af80 task.stack: ffff8800b9648000 [ 497.964276] RIP: 0010:[] [] ext4_writepage+0x105e/0x16c0 [ 497.973090] RSP: 0018:ffff8800b964f4c8 EFLAGS: 00010293 [ 497.978531] RAX: ffff8800b960af80 RBX: 0000000000048204 RCX: ffffea0006f09200 [ 497.985802] RDX: 0000000000000000 RSI: ffffffff8165225e RDI: ffff8800b848d1f0 [ 497.993066] RBP: ffff8800b964f5c8 R08: 0000000000022628 R09: 0000000000000000 [ 498.000352] R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000000 [ 498.007619] R13: ffffffff831a2278 R14: ffffea0006f09200 R15: ffff8800b964f708 [ 498.014889] FS: 0000000000000000(0000) GS:ffff8801db600000(0000) knlGS:0000000000000000 [ 498.023107] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 498.028975] CR2: 00000000004cc688 CR3: 0000000002e0a000 CR4: 00000000001606b0 [ 498.036222] Stack: [ 498.038352] ffff8800b964f5b8 ffffffff813b5443 ffffea0006f09210 ffffea0006f09208 [ 498.046355] 1ffff100172c9ea4 ffff8800b964fb50 ffff8800b848d1a0 ffff8800b964f6b8 [ 498.054378] 0000100000000000 ffffea0006f09200 ffff8800b960b840 0000000041b58ab3 [ 498.062376] Call Trace: [ 498.064942] [] ? find_get_pages_range_tag+0x3b3/0x6c0 [ 498.071765] [] ? ext4_writepages+0x2c20/0x2c20 [ 498.077975] [] ? check_preemption_disabled+0x3b/0x170 [ 498.084791] [] __writepage+0x64/0xc0 [ 498.090135] [] write_cache_pages+0x545/0xd90 [ 498.096175] [] ? mapping_tagged+0x30/0x30 [ 498.101949] [] ? clear_page_dirty_for_io+0x3e0/0x3e0 [ 498.108683] [] ? debug_lockdep_rcu_enabled+0x77/0x90 [ 498.115411] [] ? debug_lockdep_rcu_enabled+0x77/0x90 [ 498.122141] [] generic_writepages+0xda/0x150 [ 498.128178] [] ? balance_dirty_pages_ratelimited+0x24e0/0x24e0 [ 498.135792] [] jbd2_journal_commit_transaction+0xeeb/0x6b40 [ 498.143134] [] ? journal_submit_commit_record.isra.4+0xb50/0xb50 [ 498.150907] [] ? debug_lockdep_rcu_enabled+0x77/0x90 [ 498.157640] [] ? debug_object_deactivate+0xf7/0x340 [ 498.164298] [] ? debug_object_deactivate+0x214/0x340 [ 498.171032] [] ? _raw_spin_unlock_irqrestore+0x45/0x70 [ 498.177940] [] ? debug_object_deactivate+0x214/0x340 [ 498.184676] [] ? debug_lockdep_rcu_enabled+0x77/0x90 [ 498.191411] [] ? _raw_spin_unlock_irqrestore+0x5a/0x70 [ 498.198322] [] ? trace_hardirqs_on_caller+0x38b/0x590 [ 498.205155] [] ? _raw_spin_unlock_irqrestore+0x45/0x70 [ 498.212060] [] ? detach_if_pending.part.0+0x5a0/0x5a0 [ 498.218889] [] ? del_timer_sync+0x11c/0x140 [ 498.224839] [] kjournald2+0x22a/0x830 [ 498.230285] [] ? finish_task_switch+0x1e7/0x650 [ 498.236584] [] ? commit_timeout+0x20/0x20 [ 498.242377] [] ? autoremove_wake_function.part.1+0x130/0x130 [ 498.249806] [] ? __kthread_parkme+0x167/0x240 [ 498.255941] [] kthread+0x268/0x300 [ 498.261116] [] ? commit_timeout+0x20/0x20 [ 498.266892] [] ? kthread_create_on_node+0x4d0/0x4d0 [ 498.273825] [] ? __schedule+0x7ad/0x1e40 [ 498.279527] [] ? kthread_create_on_node+0x4d0/0x4d0 [ 498.286173] [] ret_from_fork+0x55/0x80 [ 498.291690] [] ? kthread_create_on_node+0x4d0/0x4d0 [ 498.298333] Code: 00 00 00 00 fc ff df 48 c1 eb 03 80 3c 03 00 0f 84 e8 f0 ff ff 48 c7 c7 80 5e 83 82 e8 bc d5 e2 ff e9 d7 f0 ff ff e8 a2 4c cb ff <0f> 0b e8 9b 4c cb ff 48 c7 c2 00 ea 8b 82 be 12 02 00 00 48 c7 [ 498.325560] RIP [] ext4_writepage+0x105e/0x16c0 18:20:30 executing program 4: openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000040)='/dev/loop-control\x00', 0x100, 0x0) r0 = socket$netlink(0x10, 0x3, 0x4) r1 = syz_open_dev$evdev(&(0x7f0000000080)='/dev/input/event#\x00', 0x7, 0x80000) ioctl$EVIOCSCLOCKID(r1, 0x400445a0, &(0x7f00000000c0)=0x5) writev(r0, &(0x7f0000000000)=[{&(0x7f0000000200)="580000001400192340834b80040d8c5602067fffffff81000000000000dca87086a5c000004f6400940005891550f4a8000000006700008000f0fffeffff09000080fff5dd00000010000100000c0900fcff0000040e05a5", 0x58}], 0x1) r2 = openat$full(0xffffffffffffff9c, &(0x7f0000000100)='/dev/full\x00', 0x24040, 0x0) r3 = getpid() ioctl$BLKTRACESETUP(r2, 0xc0481273, &(0x7f0000000140)={[], 0xcb1, 0x3127, 0x3, 0x0, 0x5, r3}) 18:20:30 executing program 0: socketpair$unix(0x1, 0x2000007, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000000040)={0x0, 0x0}, &(0x7f0000000080)=0xc) r2 = add_key(&(0x7f00000000c0)='cifs.idmap\x00', &(0x7f0000000100)={'syz', 0x2}, &(0x7f0000000500)="ee91740984c4718c649c133567dbfb20388b5536469c5d9adce678f8778be173fe5dd8c1bdb91f0dcfbab759c8ed5779f893790d408f033a548e2ca6218a0ed17972c0ad02dc45dc6a315fbac86f80f680df7cef3e9d624693909e2cdb0004e33f6ea85490c5607844e54458fc18663f28dfa92ae50d7519f25aa49aa5a961194b78625e6dace4eab4d775dcb1689aef0bd569c85e1005ee386da78f8fd6449d37bd956201c774b9836466aac1862da72b0e39ed2a6e01b23d430317e831c9e6b8f576f5e5da334a9fd1e8d2eb2b5b7e82b75b499be11a4cee669a988c024cc5dd177821b23164853a58ef52d96dfc15457d7cbf57e1703c20be675d71244aa78d1f6f9ff257d4bf98bec194afbf214f526595923445dd004b686cf934295c24246615d5a8251b61fa1ebb67dfd678bb70696ff2208546b4ca2a93c839b14c9dc080aad4a4c2731f5f4faf47f618a355647b860318390bee47699526b9796dd5cd82a141759177e273b1fea4c3515e4fd516e48935adf11b4310cd829e4e9e37174e2d5d171f76adf3ae6d105d21f0fb94a1b0bf7dd142b6db31d409db0d493f7d0e2932b2a6f77bf45b8b6e8cd53e83b1715b57bf1c1707a65d906d92897010c76ea74dcc6d557cac50cd280d9604424d4be3a43dae2336f668db99dac29e46a7dfc9afd2ad825cf4b409b251102a8f00f5c67bd37e7b27e8be81484b8be94dde34c3134962d847f2ef73f9cb8813f11d676297d992c445ce77b0920e42f897e959ec88faa9b816b07b6c3660d975d0635b84ebad4c82ad45f88f9d5c5054e615c0aa5f1b153fa4709601ed91eb49664b81e124bc0b5dcf159c325ec1648992e6d9850bc78ac5708b5a9efc02b499a66023b8e8ded22c53c8eca97630a4c55cadaed8a14354bac0d5fb69966ff5c797cb905b6dec1b5acb3c1f558f9a6cf2696d554fb29cc3adade73beb9c785b03c91ef9fd68d014ed8a0b9388676f90b97df15ac6eb1d20945cecebb68c85f8c898ef70988d5a418747d750eb72d26eb050bab0aa51502299d70e6c458c0174b2aa1b11a828c0d89bbbc99b44988896ae624c9658c8434738ff8b4f6943ce7833145b1721ee824a14158bf6075b2b956fcbe7945c48710ddc6317b6499bbe6ac07b4f45a3886a15f5a77d4b14f938ac9f53e7dc7c361d12d1bd05344a680b59659963927f02418b526062d7f47311dc93d785ba20d37b91cbf58dd730e11de2b4dbf87c6bb951a48b10d8f754d3255ed9be0d75f9610df93326718454884ca86036c51ca1f8278a0985eb69c4a248bc9387177665002f5f3aba1aec674ba83ec157e5f45867eba7b1f5167d61a415e631d04bc03b72f948f7613c0a384bb9cde08e94d6e3fb980e3cd86cba6e55db2330e0e71cceb0add1ef7af644614893c26a45f16b70272293d87408e27520994ab32fb945435acfb7539017550ad06ec71a60d4a8ed18e45b4fde5d1bbcfbcc3f88fb820364ed5cd7c7c165581e14f22fd7bd17cb389af69443d2ccf250245e5db1685b19f47535ed71ea5c86fd6509633c9f48ae5850b49939ba7b877c96f4f4a643cd27a5c86419d34550d5d1c0fc24cdb13ee852fa6640d6996d3e6a3f23167a9d35e50566630abb3b8c452db4ad9b2f3c199161a6ad90a7781f0122b0d9a18f75f6707cbc0e662e791cec57558e9122de09f99a210c8d2f4f564c4a28af31d1a7306a001ff2b0183c4fb5796359af8c91f403a81945259bc04de58069ef7e298d3d6d77274f53cf12d3d550de4aa2bafc71428abacb079c2c9a4bd4fbb4862cd89a411d0cead040c0aff47eee7c9c14d229b7ae146fbc425f239fbc796127450cba9a930a3878b73cca13a841f495d8786b1a91bf2fe31f9e1250caf083a280926ec21c89bc906c513e117f52991007cd790341b44ed0a83a86a01f86fcb7c68936a1769b98ed98c409e4cb4b0e2709015bef152813782e5e3b5731fd556bf0b5459a31c40742a3ed50b7d928a9e491cae2d96e6f7b59b23987a03e66614cee171995c77eb87f4eadad6a692d093f3bf2077572bd4860c69051105f69312268a89929cd16b3d783bd27872e680b640dca239c2452c47dc1f033a4889fc2326d9907ed65b613794c0d44a16ecc114fb4efa9de669fb159d8ba7b9778989ade29d272d643ba1a05c2b71802977c3a76de11cdf2a809b49cc5563d119894d4ad6d5f92642aa75c661d7e695cea754641b6dae29e952c18745123f6386983642576bf943acb3e901f5e16e373995eb3eee771fddee93f1c95057434b431199d4d40c012bd5e116ca161c08f90718d4d16179a3123b95af7e7ccf5dfc5e0988a96228b05c0dd7100da3a94b65a6c232c2c2908807e3527584b156fe0a0db38865a4cede3d74ea35ced430ebf840648c99dec36c571e67c17f139ca3429005d22af820919ad3dd6d61ba6166622d05c8dffd3a691ec2433568970f0fb91c7517e850143af2802875c80b94d356158363af16f862b68931347bbf26b0f6651476ea0c5aa5f259a7405dfd2f4a7d3ed0629bdbd32cb0cf84f4749551804632b47ae0b1d0e7cce129bbaccd9150cb675f243613e62633b7e6fcdf8266a64e9c5daf470cff4475ac5e580e88624f84616b3251f21e8021ff496462c4bf962b76f4de4e0c682b31bead40f5c55b468b2a3adb5b11f6977c0d1cecdaf00845f4c0ad3b59322d234c42ef1d3ae2396098706d52e620e8ea6967f0c551f784ce5814aefc5acbf97ca9c07f2b8c49c548160f275498d27c6f1258c9d740528caafdf0b0200902622d83c0d7e69b0b542ae00750e852bb1def82fd6504f0479e16e971f26c77eb41941c2b02b75f977c1a7d4b97136104fe41c1d987ee10eb940ed74c7ba822808881cf3e74b9295689fd578945b87a993cd1fd2e3e2d5cc702305073c1e299265565c9822ab26ca077ca032cb36abbcd541aba020d7187bbd0db994563824b0fb454fc8f191e819066b0bd2b6d72aa86079d2adf9763e59a202bc70deb1924ff293bf45d90f9c08e463fbf934a9c3c3f194745b249e71d5b392c60147775b2310b2cea1682e35ea2e69e14ac250146b6d0570caf1476524d119ce720b6bfaa422a3c872d50f2bb3365bc07edffedead1ebc75b4db2387bd39d108b2798fc2894e3a835036f93ed6c5b85b206c5918182a57459197056535a595088f98ffa5a8b7b79ed5a1d62a8999303cdabb4c52f187349777ea09778a695861830d3fcc82fd33bc6bc1f56c251d79c5f3bc91576e5fcefa026fff3dcc5f9dc9d5d6b60b09b2ad7b5da8b9fe7ce3d746d663ca1dfc39f74280cb783597ba020d678349bcadff846aae287d58d2c9f26e12ca9029933726aee2db384cda8515d25d1a2478ef53c09e6d22ff56114e4ad5a977086e4f81be9fb7952059f221e8c72640e3b4e1d26d6287f7df6b4aeabf493cf38ad9998573ee4c1135275c559253a625b6c1e360b45f35b0712fec49ca5fe526308a1b8d24c2bd081b3c77ad98132fccc4dea52fd1d86089eb80dd72a283ab602f41e2f3c5fb551e03a93f5b250465f321ec3bea5f1c73826ab389ccae1d0e64c662b3375e4e1de2f6f6a3d67eb186ca80f9118851d09f6aa2ce14deeab854f856cdf448ef58480836fa94efcc58d1f6bc217e91370a0881d9aff20f0e9d3ee45ce2bde7abdc51aef7be775d516f66fc2b48d1157ab9f2ac4172ad5862d7c7d9ba5a0b911ca2032c098c1113b66635cc4db9321c531a952e6ecdb57a5a8e66b8a1cd0bbd73928250f8cbc734535111c7a09ad3a6de57c163bcea606fc21a925dec9f8a237d0e835f0f5b2858a3539f74173bd5dfd53cdfdef94f2dc76065097d4f5e225c326258acefcad2ee053b3e96b87f7daf4c699bcda52420daa89147d88f87d039a42dfdfefbc0337038a3cb23bc525195c167648454eed7a93c6fc7b6088d59405a2a0dbae88f85a39a2128795f6b845700d0232d0eaa2cfe96fc9085a82e18cefd06acc2f25f07e5e79d31e4badf1b2fcc3f8f42470cc04c4aedc52a0fd44cd5d7c8a10de70f5488179d363e8905997486807d28d88157a89a2c2ab34f1cd006adf2a3fc23ccdb06bae5e407a53c573f4e8764f8992ea98bd9aa23c623bc180117568a946b3b2d524330651cc4ab80b838d03b3b4e75af9e7b29b5dbe59dd3cae95f233a9954a5627c299edc19999f0e8e2b3600b7e2241bc6b51e2f9dab73fb8db817182bd4d44399be802df63fb2e2fba085570300181cc4afb2460408013b4e03ffbc26974508a1cfd22a8d71593e9c2c24dc6a46aaf2b9749756fd55d8c5830e789aabb0436afce2957d77eced0e9f90da7fead5d84f03804759047af8a91abed93f6a8557c511c5c855634e5eeaa65d8f9742cfd2a96993fe60259dd3e12b215d93eb8667e551afe0e7174abfabf24b4b0cc170db03a52602fca13d3df8c3a363741f7c57d55920f7abad61a421d74c5c46ca38aac6be0fdd3ad49985479897909af32d1e75e4aaa0e0e8a14d500c1fd763445e4b3bf08214c1ff81932b958a7e32fac6d3000de226e024b7b34e84dc0c64ac47ac073a44035836252bbcb19158408cc9f5db82fc816ce9d0c7c61623e686e6e04e2fd1007722fb01fd25747df07e23ca356c6ed57753e0d8aee0921067bba686060723342cbeca1795d64c1f8b3437929e4e4658e9af91d235ad0163ec72e9d978a4d00660e4dc99492071f83dc949bcc3de8a411600d881294413b68b7e638a600057599e58dc34870218a35c8a58763f0a4d34b6bab3773295498fa5b281c230a3551865e975718b19d50006349b46137625cea0616826943dc9e6d1721e4c7aeed2eaa6a0d9c52fa227830f4ea6d11d9164f0f4981af0c9528627d9d7a7b4796862a9d5b0b534772419ad2dbe7399e762d926c09dc699f61aac13b257b4516e6d2d389575fdf4bd604028d83030874d67ec1e4ca8958e647944168af16f3554ce85a5c3a52901d1df1da0b852c21332915f361c3bce7bba35f5afb93ef3d269b09623b15cf1b4a2973fb54a000f4ce98331c11046586a262302821f43175cad65046588875a05cdc365197b1747be1c1162503457248e7c45c1f75040c962d8888d3d871b08dabc78481272b216a89302cf2a842bc93672232f3d80c6d00368f97fe48ab3108b3cb6a3c2295162c52d2d86ea95ddd562802aaaaf7ff009749516f76d27a4dc60cfaffca2253bf775118cb39a3f0aee38b0d600b71b521d787b862463501a35edd2f473e4bac55e0f99cb184390ecfa74df6a7065baee2e4f9d8c89db2362db0491b9bd0f87d2d30b27c78e24e342d6a21695ad9d6ea268db4e0b77ca5921421ad5fc10d4b07e1e8dab38792686ab477652defef404fcb10d4e231474f81cbc62a750bf74e2b305c6d37692bc04d614a40327734b19f647bc5323c7341a476b8326d7b55ac3ab0c0d372f6186d2715722cbe4e64ca061f895edee11d973305821b3f1c3b176730bfece475e059068f3b7ba4e89afcd19391cb0b737fce94f425e0dbe43bb72b8596f51af5168931c8545393e199035132ada6afd33e7cf71771e83f223e779c9accd531f580d6d002606a4e265882188c6587669e552f31c3e763ac97a5d4274c85d83c8badb1d049168831b8319963c878eb2efe37e2c055d858eb56a7699563442c6c25a293c8b8870415a9f8e81a51e4efafab234c4bd0806443e18bceb1574856db2fc6b6373110c6c5b24e9ac583298f50ee24ed63bdfbf9b6b8b2cb2779598702749d412bfb5b27c5363", 0x1000, 0xfffffffffffffffa) keyctl$get_persistent(0x16, r1, r2) request_key(&(0x7f00000004c0)='user\x00', &(0x7f0000000380)={'syz'}, &(0x7f00000001c0)="3fcb00faffffff00", 0x0) 18:20:30 executing program 3: r0 = openat$selinux_policy(0xffffffffffffff9c, &(0x7f0000000040)='/selinux/policy\x00', 0x0, 0x0) ioctl$SNDRV_TIMER_IOCTL_STOP(r0, 0x54a1) getsockopt$inet_buf(r0, 0x0, 0x2f, &(0x7f0000000080)=""/235, &(0x7f0000000180)=0xeb) signalfd4(r0, &(0x7f00000001c0)={0xfffffffffffffffb}, 0x8, 0x80000) r1 = socket$netlink(0x10, 0x3, 0x4) writev(r1, &(0x7f0000000000)=[{&(0x7f0000000200)="580000001400192340834b80040d8c5602067fffffff81000000000000dca87086a5c000004f6400940005891550f4a8000000006700008000f0fffeffff09000080fff5dd00000010000100000c0900fcff0000040e05a5", 0x58}], 0x1) 18:20:30 executing program 5: request_key(&(0x7f00000004c0)='user\x00', &(0x7f0000000380)={'syz'}, &(0x7f0000000000)="3fcb00faffffff00", 0x0) 18:20:30 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0x0, 0x4) r1 = add_key(&(0x7f0000000080)='id_resolver\x00', &(0x7f0000000100)={'syz', 0x0}, &(0x7f00000001c0)="79bf8b7abe6626cbdfab6bd380734042625b138691f3e27043def21bacbf1a63a169ab26d7e824674e1efad9b6c026c369bb7d69d5ac111ecf4aac53629ce7f3b730677e260d5d34823c172252d35e9571e5df747263fab35a834f958ea4fb8fe1344a40b000addfc2b506743bd1", 0x6e, 0xfffffffffffffffa) keyctl$setperm(0x5, r1, 0x10050001) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, &(0x7f0000012fc7)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=ANY=[@ANYBLOB="0000000000000300"], 0x0, 0x0, &(0x7f0000000f4d)}) r2 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000000)='/dev/fuse\x00', 0x2, 0x0) write$FUSE_NOTIFY_INVAL_INODE(r2, &(0x7f0000000040)={0x28, 0x2, 0x0, {0x0, 0x7}}, 0x28) r3 = socket$unix(0x1, 0x1, 0x0) recvfrom(r3, &(0x7f0000000240)=""/177, 0xb1, 0x20, 0x0, 0x0) mlock2(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x8, 0x0, &(0x7f0000000140)=[@release], 0x0, 0x0, &(0x7f0000000340)}) 18:20:30 executing program 2: r0 = socket$netlink(0x10, 0x3, 0x4) r1 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000040)='/dev/rtc0\x00', 0x40040, 0x0) ioctl$KDGETMODE(r1, 0x4b3b, &(0x7f0000000080)) writev(r0, &(0x7f0000000000)=[{&(0x7f0000000200)="580000001400192340834b80040d8c5602067fffffff81000000000000dca87086a5c000004f6400940005891550f4a8000000006700008000f0fffeffff09000080fff5dd00000010000100000c0900fcff0000040e05a5", 0x58}], 0x1) fallocate(r1, 0x20, 0x3, 0x7) [ 498.332005] RSP [ 498.343924] ---[ end trace c3fc694b4b0a79ec ]--- [ 498.349054] Kernel panic - not syncing: Fatal exception [ 498.354736] Kernel Offset: disabled [ 498.358354] Rebooting in 86400 seconds..