bcfa6459603edfa589450d4d6499737c3252cd540054be50df4aa7060e56b86cfab98c867b32aa35ab894a63406da17a6dd575304f6934489962ded57cd2300a6d077528854afb034d8b9ffd90d5451c3112a3bd278cb014395c293de733435d17128739e5bfa5aea7bfec133b2af7fe3a676578ba19bc26b2948880b9c7cba1af92ee980a3c1ded2817f647da729a4d3e72323f46f70b0842f2bd7932a95044b6d804bc42cf96dc0ca153b61e18b41d106b1ca94f1a1d7ec047a96b12415190d3c8fcd2365407777fdb7f5f970939dca2377f9b86d66eb9d3608650df8208bd94e3d1d079b58973d141d6241dd5c983d09d23002a1cdc7ad4ae2542e6b26d251ebdfd6ad1bf27716a0db563d8b21f1a73cd5781028a8900966442ed677ad48344fb8f133b58783d62fdb44b1d927650eb70f123eedbad3f9b6454edba08735413371c1430b9c4613e2275802a3e397c3e3d3884a3a60bb7b0f9a5a1660bd05be4a0295d5fe3083b209a832421b8b7c605a7c85378202c879634cab9e1326221f572e6dacc81097b5f333878a0cf773580f0438efff5487227fe32beee568538f9a5e17834afa66f6a7d4437fa6930778e2e3ac625e513f9a139f8111a3f108de5fd7cb069d01b5c5cf2a208f099444cf1e9539adfebe5d1ace02eeeeebefa831a65e319b2afefabd577c65ded4137591f3adf973b9548d0d98b473929b5dbee4ee356372517c662a78c92e8c4eff407c37e940587ad914f1a53b10d3a45a3a3c7d477abfba8a155f8cf19b6b76e2c2a59421fabac5c4de95ffaf043e8e8663fcba96ce1b77b47c3301a817b427284dd58cda1030338b604da914f3fa73322f676928698b3835b84fcbe371a3ae98812bea1f429b21e33e785c7a0818aea15b28f822e43962265d810e0980b1782acc0076aa3363400c9a2ee2e18b55ad0c9e44d0618d8d9eaf8860dc7ebd3843362b64b9d5308f4e4c3dfbb93ab3b7b3dc6578a05682075db83cbb98d4d334c023d4ae54b7626ca25f6cde0d5835bd0cc4ae3dfe0715dd6edc91df9a3380961790c28f54ca52a10bda8229e82f0f8f73d95ee2113e72266c26155722d315551ddd2fc595b9c9541329686ba50f7b53a1670d7d0b050ca599f25012a89a34816741255db377ffe825a6274b67f2ff948c01bc10e2b22995125c01f3b262f0e19a27c36cceeb9870e83e61c71555d782dbfa7a39b463872c23aaa10029ff527e1c65da6b3ce1389134c83e1f94fabae951f6ccd0e3db52f822a4ba6e53a02ce13f14af13370b61d1f3351f14c65de52138ad6c007137ee3eff87207d553ae32f3845cf811758abc7ed592a97fb36951df648f476664fab2ec0d2ff47a4ec7dce43303dbff5268d050925329f074372e65ae3422cddc1642a7d39145f1294e341b47f1dbd4136f61431f6ff10c3c52265fe6a1f5cee6b4d9d9c72d029fe2caeb6237a5140c6bda1d078acc028f7a4e5b84626bb8f9c60bf6755c8ee3896c59f85e7e5372b1245b20a64f70d1f14968820700f73cbbce51229e620637ec8cdd0d3a70192b0bddc25e2eaa06a9aa826f48c3f590bb1a2315deaec4f69da9144e225821c76b122f4bc0205389b463b39d2f6d9", 0x1000}, {&(0x7f00000039c0)="b2b7a1f31c4a27cb102f6530cb139c61f2de9518bc013ab91d57dfbb67a2106aa90526d886706821bcde110c498682f8da826821c95fd4c9914935576167ac38a980e4e4fca6a8f67b6dda43b57773df95a9eacc12ff4a", 0x57}], 0x7, &(0x7f0000003ac0)=[@init={0x18, 0x84, 0x0, {0x4, 0x0, 0x8, 0x7aef}}], 0x18, 0x20000000}], 0x6, 0x4008040) ioctl$sock_inet_SIOCSARP(r0, 0x8955, &(0x7f0000000600)={{0x2, 0x0, @local}, {0x0, @local}, 0x8, {0x2, 0x0, @rand_addr}, "0000000500000000723000"}) ioctl$sock_inet_SIOCSARP(r0, 0x8953, &(0x7f0000000180)={{0x2, 0x0, @local}, {0x0, @link_local}, 0x8, {0x2, 0x0, @remote}}) r7 = add_key$user(&(0x7f0000003d40)='user\x00', &(0x7f0000003d80)={'syz', 0x1}, &(0x7f0000003dc0)="5c43ac06e4a4ef3002920900f88d6ebd7c12696e1ea16a6b86711354bb0ee90d98838d8f9982b62f9a55f5564b44e170ba3938ffb454ceb29fc79943958ebd0fc3f13188237e131c74a874bef5ed1b0d3979e22a0fdf5642750f16e8377e779361ec07c3c0375b62ae8ccc6b60fdc8e4c751bc3bd3e91ae21218ac3bc63cf035562b39824857bbe8a10d71cd6d9dfcee8d44401fb28f4143ab53254b7b6d9d8ea92e987d2854f1c54f242b5795bd3124cd22d61ed4db46cb96b2eeef505212249ef5ae91a03527dd4dbc6ee9201176e17f2692d049e81824", 0xd8, 0xfffffffffffffffd) keyctl$assume_authority(0x10, r7) [ 607.619504] binder: 21974:21975 ioctl c0306201 20012000 returned -22 [ 607.686893] binder: 21974:21984 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 607.722158] binder: 21974:21975 unknown command 0 04:45:53 executing program 1: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000380)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f00000000c0)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000080)={0xffffffffffffffff}, 0x106}}, 0x20) syz_open_dev$mouse(&(0x7f0000000180)='/dev/input/mouse#\x00', 0x34a43f07, 0x240001) write$RDMA_USER_CM_CMD_MIGRATE_ID(r0, &(0x7f0000000100)={0x12, 0x10, 0xfa00, {&(0x7f0000000040), r1, r0}}, 0x18) syz_genetlink_get_family_id$fou(&(0x7f0000000140)='fou\x00') r2 = openat$null(0xffffffffffffff9c, &(0x7f0000000000)='/dev/null\x00', 0x10800, 0x0) ioctl$KVM_GET_XSAVE(r2, 0x9000aea4, &(0x7f00000003c0)) 04:45:53 executing program 3: r0 = syz_open_dev$sg(&(0x7f00000000c0)='/dev/sg#\x00', 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000000)={0x53, 0x0, 0x6, 0x0, @buffer={0x1c5, 0xb8, &(0x7f00000001c0)=""/184}, &(0x7f0000000540)="ad40657ed56c", &(0x7f0000000340)=""/128, 0x0, 0x0, 0x0, &(0x7f0000000040)}) [ 607.763172] binder: 21974:21975 ioctl c0306201 20000100 returned -22 04:45:54 executing program 5: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000480)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_GUEST_DEBUG(r3, 0x4048ae9b, &(0x7f0000000140)={0x1}) syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000100)=[@text32={0x20, &(0x7f0000000000)="6601669b0f35c4e1fe16846ba49e0000b9940200000f32c4c23dad78e0b9670900000f32660f38827f95b0040f01d10fc71a", 0x32}], 0x1, 0x0, &(0x7f0000000040), 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r3, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000400)=[@text32={0x20, &(0x7f0000000880)="b805000000b98b9400000f01c19a01000000b0000f43d1b8000000000f23d80f21f835800000900f23f80f060f2140b9800000c00f3235000800000f3066ba4300b8f1ffffffefb9800000c00f3235002000000f30c4c3295f4da400", 0x5c}], 0x26433e1, 0x0, &(0x7f0000000300), 0x10000000000000b6) ioctl$KVM_RUN(r3, 0x5450, 0x0) [ 607.832104] binder: BINDER_SET_CONTEXT_MGR already set [ 607.869996] binder: 21974:21992 unknown command 3845 [ 607.904840] binder: 21974:21975 ioctl 40046207 0 returned -16 [ 607.906956] binder: 21974:21992 ioctl c0306201 20012000 returned -22 [ 607.931602] binder: 21974:21984 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 04:45:54 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000000140)=ANY=[@ANYBLOB="8c7ffebd28433b4f4223a5aa4e22ffe36fa4348518d246cc234b416f04eca7ccfbe4afd7f66cd130f5e630a22e6bba2b9f788f5953c32001568e86c94c6f867834be946196610a723c6387c8b3137c30551735241a0a087554ca0e42d08e91280ad2defefacce39069fb533ca8b0fd78246ec53f08edc0e61870cbaf593d6539d46bdb3ad8e175272b5b505ff6fbf96628db3f26c98a756942b80f20304e848e931ac0539dd8232e8d4290c3a0767466647062826183b6b252f3d85b9e85"], 0x0, 0x0, &(0x7f0000012fc7)}) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, &(0x7f0000000f4d)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000100)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0xfffffffffffffc2b, 0x0, &(0x7f0000000680)}) 04:45:54 executing program 0: r0 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_inet_SIOCSARP(r0, 0x8955, &(0x7f0000000600)={{0x2, 0x0, @local}, {0x0, @local}, 0x8, {0x2, 0x0, @rand_addr}, "0000000500000000723000"}) fsetxattr$trusted_overlay_upper(r0, &(0x7f0000000000)='trusted.overlay.upper\x00', &(0x7f0000000040)={0x0, 0xfb, 0xdc, 0x3, 0x8001, "bb022ad2dc3a018d51d488927f69c5bb", "6839ff4d027660db69902b48abca703ae1dc85e7fcc25e5b8ee36bf3c338e15b39fe5e49df599d14109978d2eedcb110b42c615f80c3c9c359b9e3087d75e32b1764b3c468b29c369bdaa1a75d9386a0bbd52e62d307d66c5665223ed5e43b3550005e0eab868af5dba9f4e6518a5c94681b31c38d6c374caf9bf2b51b7502d759e61984ff202706667c2f8a83577e5b2baf935997e5cbbfec68536c227136df12a95fbcb845e2be7b0deec5ea062bc278137936cbfcfdf79259c25b6cd71ec3f64e626302d262"}, 0xdc, 0x0) ioctl$sock_inet_SIOCSARP(r0, 0x8953, &(0x7f0000000180)={{0x2, 0x0, @local}, {0x0, @link_local}, 0x8, {0x2, 0x0, @broadcast}}) 04:45:54 executing program 1: r0 = memfd_create(&(0x7f0000000100)="0b656d31c1f8a68d4ec0a35ce2cba2bae5f497ac232aff", 0x0) fsetxattr$security_ima(0xffffffffffffffff, &(0x7f00000002c0)='security.ima\x00', &(0x7f0000000300)=@md5={0x1, "01764a49ab55a43a4383526b872ba54b"}, 0x11, 0x0) write(r0, &(0x7f0000000040)="0600", 0x2) close(0xffffffffffffffff) write$FUSE_NOTIFY_STORE(r0, &(0x7f00000000c0)=ANY=[@ANYBLOB="2c00000003000000000000000000000000000000000000000000000000000000040000000000000000000000"], 0x2c) syz_open_dev$sndseq(&(0x7f0000000140)='/dev/snd/seq\x00', 0x0, 0x10000) sendfile(r0, r0, &(0x7f0000001000), 0xffff) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000080)={'bond_slave_1\x00'}) mmap(&(0x7f0000000000/0x7000)=nil, 0x7000, 0x80000000004, 0x11, r0, 0x0) openat$kvm(0xffffffffffffff9c, &(0x7f0000000200)='/dev/kvm\x00', 0x0, 0x0) ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f000001a000)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$SO_ATTACH_FILTER(r1, 0x1, 0x1a, &(0x7f000002eff0)={0x85c, &(0x7f0000000000)=[{}]}, 0x10) 04:45:54 executing program 3: r0 = syz_open_dev$sg(&(0x7f00000000c0)='/dev/sg#\x00', 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000000)={0x53, 0x0, 0x6, 0x0, @buffer={0xdb, 0xb8, &(0x7f00000001c0)=""/184}, &(0x7f0000000540)="ad40657ed56c", &(0x7f0000000340)=""/128, 0x0, 0x0, 0x0, &(0x7f0000000040)}) [ 608.132495] binder: 22013:22014 unknown command -1107394676 04:45:54 executing program 4: ioctl$KVM_IRQ_LINE(0xffffffffffffffff, 0x4008ae61, &(0x7f0000000500)) r0 = syz_open_dev$dspn(&(0x7f00000004c0)='/dev/dsp#\x00', 0x1, 0x0) openat$audio(0xffffffffffffff9c, &(0x7f0000000000)='/dev/audio\x00', 0x80, 0x0) ioctl$KVM_SET_FPU(0xffffffffffffffff, 0x41a0ae8d, &(0x7f0000000100)={[], 0x0, 0x5531fee, 0x0, 0x0, 0x9, 0xf000, 0x0, [], 0x5}) syz_open_dev$usb(&(0x7f0000000440)='/dev/bus/usb/00#/00#\x00', 0x9, 0x2) r1 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) lstat(&(0x7f0000000040)='./file0/file0\x00', &(0x7f0000000080)) ioctl$EXT4_IOC_MIGRATE(0xffffffffffffffff, 0x6609) sendmmsg$unix(0xffffffffffffffff, &(0x7f000000a000)=[{&(0x7f000000a000)=@abs, 0x6e, &(0x7f000000d000), 0x0, &(0x7f0000000600)=ANY=[]}], 0x1, 0x0) r2 = socket$inet6(0xa, 0x2, 0x0) gettid() r3 = getpgid(0x0) kcmp(0x0, r3, 0x0, 0xffffffffffffffff, 0xffffffffffffffff) connect$inet6(r2, &(0x7f0000002740)={0xa, 0x0, 0x0, @mcast2, 0x4}, 0x1c) sendmmsg(r2, &(0x7f0000007e00), 0x136a88c8311572c, 0x8dffffff00000000) setsockopt$inet6_udp_int(r2, 0x11, 0x0, &(0x7f0000000400), 0x4) openat$kvm(0xffffffffffffff9c, &(0x7f00000003c0)='/dev/kvm\x00', 0x0, 0x0) ioctl$VHOST_SET_VRING_CALL(0xffffffffffffff9c, 0x4008af21, &(0x7f00000002c0)={0x0, r1}) ioctl$SNDRV_TIMER_IOCTL_TREAD(r0, 0x40045402, &(0x7f0000000740)) inotify_rm_watch(0xffffffffffffffff, 0x0) ioctl$ifreq_SIOCGIFINDEX_team(0xffffffffffffffff, 0x8933, &(0x7f0000000480)={'team0\x00'}) 04:45:54 executing program 0: r0 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_inet_SIOCSARP(r0, 0x8955, &(0x7f0000000600)={{0x2, 0x0, @local}, {0x0, @local}, 0x8, {0x2, 0x0, @rand_addr}, "0000000500000000723000"}) ioctl$sock_inet_SIOCSARP(r0, 0x8953, &(0x7f0000000180)={{0x2, 0x0, @local}, {0x0, @link_local}, 0x8, {0x2, 0x0, @remote}}) r1 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vcs\x00', 0x151002, 0x0) ioctl$PIO_CMAP(r1, 0x4b71, &(0x7f0000000040)={0x3, 0x1, 0x80000000, 0x1, 0x8, 0xff}) [ 608.197442] binder: 22013:22014 ioctl c0306201 20012000 returned -22 04:45:54 executing program 5: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000480)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_GUEST_DEBUG(r3, 0x4048ae9b, &(0x7f0000000140)={0x1}) syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000100)=[@text32={0x20, &(0x7f0000000000)="6601669b0f35c4e1fe16846ba49e0000b9940200000f32c4c23dad78e0b9670900000f32660f38827f95b0040f01d10fc71a", 0x32}], 0x1, 0x0, &(0x7f0000000040), 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r3, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000400)=[@text32={0x20, &(0x7f0000000880)="b805000000b98b9400000f01c19a01000000b0000f43d1b8000000000f23d80f21f835800000900f23f80f060f2140b9800000c00f3235000800000f3066ba4300b8f1ffffffefb9800000c00f3235002000000f30c4c3295f4da400", 0x5c}], 0x26433e1, 0x0, &(0x7f0000000300), 0x10000000000000b6) ioctl$KVM_RUN(r3, 0x4004ae99, 0x0) [ 608.252911] binder: 22013:22018 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 04:45:54 executing program 0: r0 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_inet_SIOCSARP(r0, 0x8955, &(0x7f0000000600)={{0x2, 0x0, @local}, {0x0, @local}, 0x8, {0x2, 0x0, @rand_addr}, "0000000500000000723000"}) ioctl$sock_inet_SIOCSARP(r0, 0x8953, &(0x7f0000000180)={{0x2, 0x0, @local}, {0x0, @link_local}, 0x8, {0x2, 0x0, @remote}}) r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000000)='/dev/hwrng\x00', 0x2000, 0x0) write$UHID_CREATE2(r1, &(0x7f0000000200)={0xb, 'syz1\x00', 'syz1\x00', 'syz0\x00', 0x8f, 0x20, 0xdfa, 0xfff, 0x8001, 0x8, "471d972540b61a8facd65bdd4673a1002b12c66d5a0a0fac930cf1d412a05bb262383f836f72f862c4e6304896aa6154f857aaf9741d0499a2982f558c1ff630e09f0a78321afb0ce4cbad9ba2b67552d16585e6b384e4fde90bceb8386a5d6c72616e445ccf1fd4d6001517a1d6b57a2c1e801f1a2c2a5642d14bbf4e0d7879486e6dcc38c5b2399a8ca0c0f23f84"}, 0x1a7) 04:45:54 executing program 3: r0 = syz_open_dev$sg(&(0x7f00000000c0)='/dev/sg#\x00', 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000000)={0x53, 0x0, 0x6, 0x0, @buffer={0xd1, 0xb8, &(0x7f00000001c0)=""/184}, &(0x7f0000000540)="ad40657ed56c", &(0x7f0000000340)=""/128, 0x0, 0x0, 0x0, &(0x7f0000000040)}) 04:45:54 executing program 3: r0 = syz_open_dev$sg(&(0x7f00000000c0)='/dev/sg#\x00', 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000000)={0x53, 0x0, 0x6, 0x0, @buffer={0xdf, 0xb8, &(0x7f00000001c0)=""/184}, &(0x7f0000000540)="ad40657ed56c", &(0x7f0000000340)=""/128, 0x0, 0x0, 0x0, &(0x7f0000000040)}) 04:45:54 executing program 5: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000480)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_GUEST_DEBUG(r3, 0x4048ae9b, &(0x7f0000000140)={0x1}) syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000100)=[@text32={0x20, &(0x7f0000000000)="6601669b0f35c4e1fe16846ba49e0000b9940200000f32c4c23dad78e0b9670900000f32660f38827f95b0040f01d10fc71a", 0x32}], 0x1, 0x0, &(0x7f0000000040), 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r3, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000400)=[@text32={0x20, &(0x7f0000000880)="b805000000b98b9400000f01c19a01000000b0000f43d1b8000000000f23d80f21f835800000900f23f80f060f2140b9800000c00f3235000800000f3066ba4300b8f1ffffffefb9800000c00f3235002000000f30c4c3295f4da400", 0x5c}], 0x26433e1, 0x0, &(0x7f0000000300), 0x10000000000000b6) ioctl$KVM_RUN(r3, 0xae11, 0x0) 04:45:54 executing program 0: r0 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_inet_SIOCSARP(r0, 0x8955, &(0x7f0000000600)={{0x2, 0x0, @local}, {0x0, @local}, 0x8, {0x2, 0x0, @rand_addr}, "0000000500000000723000"}) ioctl$sock_inet_SIOCSARP(r0, 0x8953, &(0x7f0000000180)={{0x2, 0x0, @local}, {0x0, @link_local}, 0x8, {0x2, 0x0, @remote}}) ioctl$FS_IOC_RESVSP(r0, 0x40305828, &(0x7f0000000000)={0x0, 0x1, 0x7, 0x7ff}) connect$nfc_llcp(0xffffffffffffffff, &(0x7f0000000080)={0x27, 0x0, 0x1, 0x0, 0x3, 0x3, "922b8f5f4368f166180f3da008fcbd173ef0331511ee74a7432be590b57f79c0cdc5398f8eb984cab812d90bd287319e1cd1535c28e4ac9171f0735f42446b", 0x20}, 0x60) [ 608.922048] binder: 22013:22018 unknown command -1107394676 [ 608.930073] binder: 22013:22018 ioctl c0306201 20012000 returned -22 [ 608.957894] binder: 22013:22018 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 04:45:55 executing program 3: r0 = syz_open_dev$sg(&(0x7f00000000c0)='/dev/sg#\x00', 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000000)={0x53, 0x0, 0x6, 0x0, @buffer={0x76, 0xb8, &(0x7f00000001c0)=""/184}, &(0x7f0000000540)="ad40657ed56c", &(0x7f0000000340)=""/128, 0x0, 0x0, 0x0, &(0x7f0000000040)}) 04:45:55 executing program 0: r0 = socket$inet_tcp(0x2, 0x1, 0x0) getsockopt$EBT_SO_GET_INIT_ENTRIES(r0, 0x0, 0x83, &(0x7f00000000c0)={'broute\x00', 0x0, 0x3, 0x8, [], 0x8, &(0x7f0000000000)=[{}, {}, {}, {}, {}, {}, {}, {}], &(0x7f0000000080)=""/8}, &(0x7f0000000140)=0x78) ioctl$sock_inet_SIOCSARP(r0, 0x8955, &(0x7f0000000600)={{0x2, 0x0, @local}, {0x0, @local}, 0x8, {0x2, 0x0, @rand_addr}, "0000000500000000723000"}) ioctl$sock_inet_SIOCSARP(r0, 0x8953, &(0x7f0000000180)={{0x2, 0x0, @local}, {0x0, @link_local}, 0x8, {0x2, 0x0, @remote}}) 04:45:55 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000005fd4)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], 0x0, 0x0, &(0x7f0000012fc7)}) close(r1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, &(0x7f0000000f4d)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000100)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x8c, 0x0, &(0x7f0000000140)="43af8dfd73134cbb52ea47e0ce452cc86c2e8a506cf1909c249402d0e030fade30fe47bb74a1b86d7ef32fe3f8c484389ee3fc5b5bf05e416e10ab924bce7eecbad51304c68057825217b90d597ece4f13cfb3c063070d89237d4533db5aeda435831eadbd0098177faa34130e800d694f9ac5fa6ffc05b7f49fa472b8ab352cf29d77b181db190a905949e6"}) ioctl$sock_SIOCGPGRP(0xffffffffffffffff, 0x8904, &(0x7f0000000000)=0x0) sched_setaffinity(r2, 0x8, &(0x7f0000000040)=0x9) 04:45:55 executing program 4: ioctl$KVM_IRQ_LINE(0xffffffffffffffff, 0x4008ae61, &(0x7f0000000500)) r0 = syz_open_dev$dspn(&(0x7f00000004c0)='/dev/dsp#\x00', 0x1, 0x0) openat$audio(0xffffffffffffff9c, &(0x7f0000000000)='/dev/audio\x00', 0x80, 0x0) ioctl$KVM_SET_FPU(0xffffffffffffffff, 0x41a0ae8d, &(0x7f0000000100)={[], 0x0, 0x5531fee, 0x0, 0x0, 0x9, 0xf000, 0x0, [], 0x5}) syz_open_dev$usb(&(0x7f0000000440)='/dev/bus/usb/00#/00#\x00', 0x9, 0x2) r1 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) lstat(&(0x7f0000000040)='./file0/file0\x00', &(0x7f0000000080)) ioctl$EXT4_IOC_MIGRATE(0xffffffffffffffff, 0x6609) sendmmsg$unix(0xffffffffffffffff, &(0x7f000000a000)=[{&(0x7f000000a000)=@abs, 0x6e, &(0x7f000000d000), 0x0, &(0x7f0000000600)=ANY=[]}], 0x1, 0x0) r2 = socket$inet6(0xa, 0x2, 0x0) gettid() r3 = getpgid(0x0) kcmp(0x0, r3, 0x0, 0xffffffffffffffff, 0xffffffffffffffff) connect$inet6(r2, &(0x7f0000002740)={0xa, 0x0, 0x0, @mcast2, 0x4}, 0x1c) sendmmsg(r2, &(0x7f0000007e00), 0x136a88c8311572c, 0x5000000) setsockopt$inet6_udp_int(r2, 0x11, 0x0, &(0x7f0000000400), 0x4) openat$kvm(0xffffffffffffff9c, &(0x7f00000003c0)='/dev/kvm\x00', 0x0, 0x0) ioctl$VHOST_SET_VRING_CALL(0xffffffffffffff9c, 0x4008af21, &(0x7f00000002c0)={0x0, r1}) ioctl$SNDRV_TIMER_IOCTL_TREAD(r0, 0x40045402, &(0x7f0000000740)) inotify_rm_watch(0xffffffffffffffff, 0x0) ioctl$ifreq_SIOCGIFINDEX_team(0xffffffffffffffff, 0x8933, &(0x7f0000000480)={'team0\x00'}) 04:45:55 executing program 5: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000480)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_GUEST_DEBUG(r3, 0x4048ae9b, &(0x7f0000000140)={0x1}) syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000100)=[@text32={0x20, &(0x7f0000000000)="6601669b0f35c4e1fe16846ba49e0000b9940200000f32c4c23dad78e0b9670900000f32660f38827f95b0040f01d10fc71a", 0x32}], 0x1, 0x0, &(0x7f0000000040), 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r3, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000400)=[@text32={0x20, &(0x7f0000000880)="b805000000b98b9400000f01c19a01000000b0000f43d1b8000000000f23d80f21f835800000900f23f80f060f2140b9800000c00f3235000800000f3066ba4300b8f1ffffffefb9800000c00f3235002000000f30c4c3295f4da400", 0x5c}], 0x26433e1, 0x0, &(0x7f0000000300), 0x10000000000000b6) ioctl$KVM_RUN(r3, 0xaec1, 0x0) 04:45:55 executing program 1: r0 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_inet_SIOCSARP(r0, 0x8955, &(0x7f0000000600)={{0x2, 0x0, @local}, {0x0, @local}, 0x8, {0x2, 0x0, @rand_addr}, "0000000500000000723000"}) ioctl$sock_inet_SIOCSARP(r0, 0x8953, &(0x7f0000000180)={{0x2, 0x0, @local}, {0x0, @link_local}, 0x8, {0x2, 0x0, @remote}}) r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000000)='/dev/hwrng\x00', 0x2000, 0x0) write$UHID_CREATE2(r1, &(0x7f0000000200)={0xb, 'syz1\x00', 'syz1\x00', 'syz0\x00', 0x8f, 0x20, 0xdfa, 0xfff, 0x8001, 0x8, "471d972540b61a8facd65bdd4673a1002b12c66d5a0a0fac930cf1d412a05bb262383f836f72f862c4e6304896aa6154f857aaf9741d0499a2982f558c1ff630e09f0a78321afb0ce4cbad9ba2b67552d16585e6b384e4fde90bceb8386a5d6c72616e445ccf1fd4d6001517a1d6b57a2c1e801f1a2c2a5642d14bbf4e0d7879486e6dcc38c5b2399a8ca0c0f23f84"}, 0x1a7) 04:45:55 executing program 3: r0 = syz_open_dev$sg(&(0x7f00000000c0)='/dev/sg#\x00', 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000000)={0x53, 0x0, 0x6, 0x0, @buffer={0x69, 0xb8, &(0x7f00000001c0)=""/184}, &(0x7f0000000540)="ad40657ed56c", &(0x7f0000000340)=""/128, 0x0, 0x0, 0x0, &(0x7f0000000040)}) [ 609.100250] binder: 22062:22074 unknown command 0 04:45:55 executing program 1: ioctl$FS_IOC_FIEMAP(0xffffffffffffffff, 0xc020660b, &(0x7f0000000240)=ANY=[]) getsockopt$inet_sctp6_SCTP_RECONFIG_SUPPORTED(0xffffffffffffff9c, 0x84, 0x75, &(0x7f0000000400)={0x0}, &(0x7f0000000440)=0x8) r1 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$F_GET_FILE_RW_HINT(r1, 0x40d, &(0x7f0000000500)) r2 = socket$inet6(0xa, 0x400000000001, 0x0) close(r2) setsockopt$inet_sctp6_SCTP_DEFAULT_PRINFO(0xffffffffffffffff, 0x84, 0x72, &(0x7f0000000240), 0xc) r3 = openat$tun(0xffffffffffffff9c, &(0x7f00000006c0)='/dev/net/tun\x00', 0x2, 0x0) getsockopt$inet_sctp_SCTP_DISABLE_FRAGMENTS(0xffffffffffffffff, 0x84, 0x8, &(0x7f0000000340), &(0x7f0000000480)=0x4) r4 = openat$sequencer2(0xffffffffffffff9c, &(0x7f00000003c0)='/dev/sequencer2\x00', 0x10000, 0x0) fchmodat(r4, &(0x7f00000004c0)='./bus\x00', 0x140) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f0000000080)={"0000000000000000000000000200", 0x5002}) r5 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r5, &(0x7f0000000100)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0xfffffffffffffffe}, 0xc, &(0x7f0000000300)={&(0x7f00000002c0)=@newlink={0x28, 0x10, 0xc362e63b3f31ba5f, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x3}, [@IFLA_GROUP={0x8}]}, 0x28}}, 0x0) r6 = open(&(0x7f00000001c0)='./bus\x00', 0x141042, 0x0) ftruncate(r6, 0x2007fff) ioctl$TIOCSPGRP(r3, 0x5410, &(0x7f0000000000)) r7 = openat$zero(0xffffffffffffff9c, &(0x7f0000000540)='/dev/zero\x00', 0x200, 0x0) getsockopt$inet_sctp6_SCTP_PRIMARY_ADDR(r7, 0x84, 0x6, &(0x7f0000000600)={r0, @in6={{0xa, 0x4e20, 0x9, @loopback, 0x400000000}}}, &(0x7f0000000580)=0x84) write$P9_RXATTRCREATE(r6, &(0x7f0000000140)={0x7, 0x21, 0x2}, 0x7) write$P9_RSETATTR(r6, &(0x7f0000000040)={0x7}, 0x7) write$P9_RSETATTR(0xffffffffffffffff, &(0x7f00000005c0)={0x7, 0x1b, 0x2}, 0x7) getsockopt$llc_int(r6, 0x10c, 0x0, &(0x7f0000000280), &(0x7f0000000380)=0x4) sendfile(r2, r6, &(0x7f0000d83ff8), 0x800000000024) creat(&(0x7f0000000200)='./bus\x00', 0x0) bpf$BPF_GET_PROG_INFO(0xf, &(0x7f0000000180)={0xffffffffffffffff, 0x50, &(0x7f00000000c0)}, 0x10) 04:45:55 executing program 0: r0 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_inet_SIOCSARP(r0, 0x8955, &(0x7f0000000600)={{0x2, 0x0, @local}, {0x0, @local}, 0x8, {0x2, 0x0, @rand_addr}, "0000000500000000723000"}) ioctl$sock_inet_SIOCSARP(r0, 0x8953, &(0x7f0000000180)={{0x2, 0x0, @local}, {0x0, @link_local}, 0x8, {0x2, 0x0, @remote}}) syz_open_dev$dmmidi(&(0x7f0000000000)='/dev/dmmidi#\x00', 0x0, 0xa800) [ 609.143556] binder: 22062:22074 ioctl c0306201 20012000 returned -22 [ 609.231036] binder: BINDER_SET_CONTEXT_MGR already set 04:45:55 executing program 3: r0 = syz_open_dev$sg(&(0x7f00000000c0)='/dev/sg#\x00', 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000000)={0x53, 0x0, 0x6, 0x0, @buffer={0xd6, 0xb8, &(0x7f00000001c0)=""/184}, &(0x7f0000000540)="ad40657ed56c", &(0x7f0000000340)=""/128, 0x0, 0x0, 0x0, &(0x7f0000000040)}) [ 609.281436] binder: 22062:22077 unknown command 0 [ 609.352354] binder: 22062:22077 ioctl c0306201 20012000 returned -22 [ 609.389029] binder: 22062:22074 ioctl 40046207 0 returned -16 04:45:55 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, &(0x7f0000012fc7)}) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="410f42eb2086fe15591b554270c6e27d1f2d9b06f613fa47036947ac5dee459977580bf6270bc57b6e0606303ffca99d49f9cb3f770d5a5a5ffc951dab6fcac27e5081dd550cca07bf9c0caeb7f098b4cfa938022f80a5a24f"], 0x0, 0x0, &(0x7f0000000f4d)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000100)={0x4, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="01002140228dc3e9173e84f304000000"], 0xfffffffffffffc2b, 0x0, &(0x7f0000000680)}) 04:45:55 executing program 5: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000480)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_GUEST_DEBUG(r3, 0x4048ae9b, &(0x7f0000000140)={0x1}) syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000100)=[@text32={0x20, &(0x7f0000000000)="6601669b0f35c4e1fe16846ba49e0000b9940200000f32c4c23dad78e0b9670900000f32660f38827f95b0040f01d10fc71a", 0x32}], 0x1, 0x0, &(0x7f0000000040), 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r3, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000400)=[@text32={0x20, &(0x7f0000000880)="b805000000b98b9400000f01c19a01000000b0000f43d1b8000000000f23d80f21f835800000900f23f80f060f2140b9800000c00f3235000800000f3066ba4300b8f1ffffffefb9800000c00f3235002000000f30c4c3295f4da400", 0x5c}], 0x26433e1, 0x0, &(0x7f0000000300), 0x10000000000000b6) ioctl$KVM_RUN(r3, 0xaefe, 0x0) 04:45:55 executing program 4: ioctl$KVM_IRQ_LINE(0xffffffffffffffff, 0x4008ae61, &(0x7f0000000500)) r0 = syz_open_dev$dspn(&(0x7f00000004c0)='/dev/dsp#\x00', 0x1, 0x0) openat$audio(0xffffffffffffff9c, &(0x7f0000000000)='/dev/audio\x00', 0x80, 0x0) ioctl$KVM_SET_FPU(0xffffffffffffffff, 0x41a0ae8d, &(0x7f0000000100)={[], 0x0, 0x5531fee, 0x0, 0x0, 0x9, 0xf000, 0x0, [], 0x5}) syz_open_dev$usb(&(0x7f0000000440)='/dev/bus/usb/00#/00#\x00', 0x9, 0x2) r1 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) lstat(&(0x7f0000000040)='./file0/file0\x00', &(0x7f0000000080)) ioctl$EXT4_IOC_MIGRATE(0xffffffffffffffff, 0x6609) sendmmsg$unix(0xffffffffffffffff, &(0x7f000000a000)=[{&(0x7f000000a000)=@abs, 0x6e, &(0x7f000000d000), 0x0, &(0x7f0000000600)=ANY=[]}], 0x1, 0x0) r2 = socket$inet6(0xa, 0x2, 0x0) gettid() r3 = getpgid(0x0) kcmp(0x0, r3, 0x0, 0xffffffffffffffff, 0xffffffffffffffff) connect$inet6(r2, &(0x7f0000002740)={0xa, 0x0, 0x0, @mcast2, 0x4}, 0x1c) sendmmsg(r2, &(0x7f0000007e00), 0x136a88c8311572c, 0x8) setsockopt$inet6_udp_int(r2, 0x11, 0x0, &(0x7f0000000400), 0x4) openat$kvm(0xffffffffffffff9c, &(0x7f00000003c0)='/dev/kvm\x00', 0x0, 0x0) ioctl$VHOST_SET_VRING_CALL(0xffffffffffffff9c, 0x4008af21, &(0x7f00000002c0)={0x0, r1}) ioctl$SNDRV_TIMER_IOCTL_TREAD(r0, 0x40045402, &(0x7f0000000740)) inotify_rm_watch(0xffffffffffffffff, 0x0) ioctl$ifreq_SIOCGIFINDEX_team(0xffffffffffffffff, 0x8933, &(0x7f0000000480)={'team0\x00'}) 04:45:55 executing program 0: r0 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_inet_SIOCSARP(r0, 0x8955, &(0x7f0000000600)={{0x2, 0x0, @local}, {0x0, @local}, 0x8, {0x2, 0x0, @rand_addr}, "0000000500000000723000"}) ioctl$sock_inet_SIOCSARP(r0, 0x8953, &(0x7f0000000180)={{0x2, 0x0, @local}, {0x0, @link_local}, 0x8, {0x2, 0x0, @remote}}) setsockopt$IP_VS_SO_SET_FLUSH(r0, 0x0, 0x485, 0x0, 0x0) r1 = syz_open_dev$adsp(&(0x7f0000000000)='/dev/adsp#\x00', 0x7, 0x0) ioctl$LOOP_SET_CAPACITY(r1, 0x4c07) [ 609.458539] binder: 22096:22099 unknown command -347992255 04:45:55 executing program 3: r0 = syz_open_dev$sg(&(0x7f00000000c0)='/dev/sg#\x00', 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000000)={0x53, 0x0, 0x6, 0x0, @buffer={0x5c, 0xb8, &(0x7f00000001c0)=""/184}, &(0x7f0000000540)="ad40657ed56c", &(0x7f0000000340)=""/128, 0x0, 0x0, 0x0, &(0x7f0000000040)}) [ 609.549400] binder: 22096:22099 ioctl c0306201 20008fd0 returned -22 [ 609.577339] binder: 22096:22102 unknown command 1075904513 [ 609.605403] binder: 22096:22102 ioctl c0306201 20000100 returned -22 [ 609.622718] binder: 22096:22099 unknown command -347992255 [ 609.638291] binder: 22096:22099 ioctl c0306201 20008fd0 returned -22 04:45:55 executing program 3: r0 = syz_open_dev$sg(&(0x7f00000000c0)='/dev/sg#\x00', 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000000)={0x53, 0x0, 0x6, 0x0, @buffer={0x4e, 0xb8, &(0x7f00000001c0)=""/184}, &(0x7f0000000540)="ad40657ed56c", &(0x7f0000000340)=""/128, 0x0, 0x0, 0x0, &(0x7f0000000040)}) [ 609.659447] binder: 22096:22102 unknown command 1075904513 [ 609.672673] binder: 22096:22102 ioctl c0306201 20000100 returned -22 04:45:55 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, &(0x7f0000012fc7)}) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=ANY=[@ANYBLOB="0e630cc000000000"], 0x0, 0x0, &(0x7f0000000f4d)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000100)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0xfffffffffffffc2b, 0x0, &(0x7f0000000680)}) [ 609.752798] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready [ 609.792256] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready 04:45:55 executing program 3: r0 = syz_open_dev$sg(&(0x7f00000000c0)='/dev/sg#\x00', 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000000)={0x53, 0x0, 0x6, 0x0, @buffer={0x116, 0xb8, &(0x7f00000001c0)=""/184}, &(0x7f0000000540)="ad40657ed56c", &(0x7f0000000340)=""/128, 0x0, 0x0, 0x0, &(0x7f0000000040)}) [ 609.804739] binder: 22123:22124 unknown command -1072930034 [ 609.836568] binder: 22123:22124 ioctl c0306201 20008fd0 returned -22 [ 609.907214] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready 04:45:56 executing program 0: r0 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_inet_SIOCSARP(r0, 0x8955, &(0x7f0000000600)={{0x2, 0x0, @local}, {0x0, @local}, 0x8, {0x2, 0x0, @rand_addr}, "0000000500000000723000"}) kexec_load(0x7624, 0x2, &(0x7f0000000200)=[{&(0x7f0000000000)="2793760eb5879823ca2ba07ada20c66b0453285fd2de26c5ee5d3b44d6287ec2230ccead9a2cefe24958a8a5c500ce51e567483bf87e5b8216bd2d8043810d52ed2e9bef484383fd3d", 0x49, 0x1, 0x200}, {&(0x7f0000000080)="2597d7104a0ecc92d883198789efb9b120d7c2c1e28f1475721c8ce742407e9879f1489d09b1f5aceca91623316b5d286761fd8a11403f6288bc6a45f0d4061d20b21e6cbbde0649659007de7b0532cb4aaf43f5b29cb4a68d77245a0e15c20a540ffe5f6784c03ffd3ed7358f190943c5d8ba0c23f1428a9b2c1bcb054620586b45562443bac8c98d2559f90fbb49601c4cb1a60f9f929bdc7175fce2b8ccb2495a7693fc3260564d7b73075f9bd078741929bcb98bd316b532e4ca4aeb6186ec1d097daf8477c32c94233dbe85cb453f94094b2c5a19ac2994dac5", 0xdc, 0x6, 0x9}], 0x280000) ioctl$sock_inet_SIOCSARP(r0, 0x8953, &(0x7f0000000180)={{0x2, 0x0, @local}, {0x0, @link_local}, 0x8, {0x2, 0x0, @remote}}) r1 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000240)='/dev/sequencer2\x00', 0x20000, 0x0) setsockopt$bt_BT_VOICE(r1, 0x112, 0xb, &(0x7f0000000280)=0x3ff, 0x2) 04:45:56 executing program 1: r0 = syz_open_dev$sg(&(0x7f00000000c0)='/dev/sg#\x00', 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000000)={0x53, 0x0, 0x6, 0x0, @buffer={0x5c, 0xb8, &(0x7f00000001c0)=""/184}, &(0x7f0000000540)="ad40657ed56c", &(0x7f0000000340)=""/128, 0x0, 0x0, 0x0, &(0x7f0000000040)}) 04:45:56 executing program 3: r0 = syz_open_dev$sg(&(0x7f00000000c0)='/dev/sg#\x00', 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000000)={0x53, 0x0, 0x6, 0x0, @buffer={0x7a, 0xb8, &(0x7f00000001c0)=""/184}, &(0x7f0000000540)="ad40657ed56c", &(0x7f0000000340)=""/128, 0x0, 0x0, 0x0, &(0x7f0000000040)}) 04:45:56 executing program 5: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000480)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_GUEST_DEBUG(r3, 0x4048ae9b, &(0x7f0000000140)={0x1}) syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000100)=[@text32={0x20, &(0x7f0000000000)="6601669b0f35c4e1fe16846ba49e0000b9940200000f32c4c23dad78e0b9670900000f32660f38827f95b0040f01d10fc71a", 0x32}], 0x1, 0x0, &(0x7f0000000040), 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r3, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000400)=[@text32={0x20, &(0x7f0000000880)="b805000000b98b9400000f01c19a01000000b0000f43d1b8000000000f23d80f21f835800000900f23f80f060f2140b9800000c00f3235000800000f3066ba4300b8f1ffffffefb9800000c00f3235002000000f30c4c3295f4da400", 0x5c}], 0x26433e1, 0x0, &(0x7f0000000300), 0x10000000000000b6) ioctl$KVM_RUN(r3, 0xae12, 0x0) 04:45:56 executing program 0: r0 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_inet_SIOCSARP(r0, 0x8955, &(0x7f0000000600)={{0x2, 0x0, @local}, {0x0, @local}, 0x8, {0x2, 0x0, @rand_addr}, "0000000500000000723000"}) ioctl$sock_inet_SIOCSARP(r0, 0x8953, &(0x7f0000000180)={{0x2, 0x0, @local}, {0x0, @link_local}, 0x8, {0x2, 0x0, @remote}}) ioctl$sock_inet_SIOCADDRT(r0, 0x890b, &(0x7f0000000040)={0x100000000, {0x2, 0x4e20, @loopback}, {0x2, 0x4e20, @multicast2}, {0x2, 0x4e20, @local}, 0x60, 0x9, 0x45, 0x3f, 0x8, &(0x7f0000000000)='gre0\x00', 0x0, 0x7f, 0xf45b}) 04:45:56 executing program 3: r0 = syz_open_dev$sg(&(0x7f00000000c0)='/dev/sg#\x00', 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000000)={0x53, 0x0, 0x6, 0x0, @buffer={0x171, 0xb8, &(0x7f00000001c0)=""/184}, &(0x7f0000000540)="ad40657ed56c", &(0x7f0000000340)=""/128, 0x0, 0x0, 0x0, &(0x7f0000000040)}) 04:45:56 executing program 4: ioctl$KVM_IRQ_LINE(0xffffffffffffffff, 0x4008ae61, &(0x7f0000000500)) r0 = syz_open_dev$dspn(&(0x7f00000004c0)='/dev/dsp#\x00', 0x1, 0x0) openat$audio(0xffffffffffffff9c, &(0x7f0000000000)='/dev/audio\x00', 0x80, 0x0) ioctl$KVM_SET_FPU(0xffffffffffffffff, 0x41a0ae8d, &(0x7f0000000100)={[], 0x0, 0x5531fee, 0x0, 0x0, 0x9, 0xf000, 0x0, [], 0x5}) syz_open_dev$usb(&(0x7f0000000440)='/dev/bus/usb/00#/00#\x00', 0x9, 0x2) r1 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) lstat(&(0x7f0000000040)='./file0/file0\x00', &(0x7f0000000080)) ioctl$EXT4_IOC_MIGRATE(0xffffffffffffffff, 0x6609) sendmmsg$unix(0xffffffffffffffff, &(0x7f000000a000)=[{&(0x7f000000a000)=@abs, 0x6e, &(0x7f000000d000), 0x0, &(0x7f0000000600)=ANY=[]}], 0x1, 0x0) r2 = socket$inet6(0xa, 0x2, 0x0) gettid() r3 = getpgid(0x0) kcmp(0x0, r3, 0x0, 0xffffffffffffffff, 0xffffffffffffffff) connect$inet6(r2, &(0x7f0000002740)={0xa, 0x0, 0x0, @mcast2, 0x4}, 0x1c) sendmmsg(r2, &(0x7f0000007e00), 0x136a88c8311572c, 0x5b6) setsockopt$inet6_udp_int(r2, 0x11, 0x0, &(0x7f0000000400), 0x4) openat$kvm(0xffffffffffffff9c, &(0x7f00000003c0)='/dev/kvm\x00', 0x0, 0x0) ioctl$VHOST_SET_VRING_CALL(0xffffffffffffff9c, 0x4008af21, &(0x7f00000002c0)={0x0, r1}) ioctl$SNDRV_TIMER_IOCTL_TREAD(r0, 0x40045402, &(0x7f0000000740)) inotify_rm_watch(0xffffffffffffffff, 0x0) ioctl$ifreq_SIOCGIFINDEX_team(0xffffffffffffffff, 0x8933, &(0x7f0000000480)={'team0\x00'}) 04:45:56 executing program 1: r0 = creat(&(0x7f0000000000)='./file0\x00', 0x10) bind$inet(r0, &(0x7f0000000180)={0x2, 0x4e23, @rand_addr=0x9}, 0x10) r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r1, &(0x7f0000000080)={&(0x7f0000000480)={0x10, 0xbb7f}, 0xc, &(0x7f0000000440)={&(0x7f00000004c0)=ANY=[@ANYBLOB="1c00000022000166000001000000000004000000080009000a000000"], 0x1c}}, 0x0) r2 = msgget$private(0x0, 0x40) msgctl$IPC_INFO(r2, 0x3, &(0x7f00000005c0)=""/123) r3 = openat$qat_adf_ctl(0xffffffffffffff9c, &(0x7f0000000140)='/dev/qat_adf_ctl\x00', 0x240000, 0x0) r4 = openat$dsp(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/dsp\x00', 0x8040, 0x0) renameat(r3, &(0x7f0000000040)='./file0\x00', r4, &(0x7f0000000100)='./file0\x00') bpf$BPF_GET_BTF_INFO(0xf, &(0x7f0000000300)={r0, 0x10, &(0x7f00000002c0)={&(0x7f0000000200)=""/169, 0xa9, 0xffffffffffffffff}}, 0x10) bpf$BPF_GET_BTF_INFO(0xf, &(0x7f0000000380)={r3, 0x10, &(0x7f0000000340)={&(0x7f00000001c0), 0x0, r5}}, 0x10) getsockopt$inet_sctp_SCTP_GET_PEER_ADDR_INFO(r4, 0x84, 0xf, &(0x7f0000000500)={0x0, @in={{0x2, 0x4e23}}, 0x71, 0x7, 0x6, 0x1, 0x800}, &(0x7f00000001c0)=0x98) getsockopt$inet_sctp6_SCTP_PARTIAL_DELIVERY_POINT(r3, 0x84, 0x13, &(0x7f00000003c0)={r6, 0x80000001}, &(0x7f0000000400)=0x8) 04:45:56 executing program 3: r0 = syz_open_dev$sg(&(0x7f00000000c0)='/dev/sg#\x00', 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000000)={0x53, 0x0, 0x6, 0x0, @buffer={0x1eb, 0xb8, &(0x7f00000001c0)=""/184}, &(0x7f0000000540)="ad40657ed56c", &(0x7f0000000340)=""/128, 0x0, 0x0, 0x0, &(0x7f0000000040)}) 04:45:56 executing program 0: r0 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_inet_SIOCSARP(r0, 0x8955, &(0x7f0000000000)={{0x2, 0x0, @local}, {0x307, @local}, 0x8, {0x2, 0x0, @rand_addr}, "1000f000"}) ioctl$sock_inet_SIOCSARP(r0, 0x8953, &(0x7f0000000180)={{0x2, 0x0, @local}, {0x0, @link_local}, 0x8, {0x2, 0x0, @remote}}) 04:45:56 executing program 4: ioctl$KVM_IRQ_LINE(0xffffffffffffffff, 0x4008ae61, &(0x7f0000000500)) r0 = syz_open_dev$dspn(&(0x7f00000004c0)='/dev/dsp#\x00', 0x1, 0x0) openat$audio(0xffffffffffffff9c, &(0x7f0000000000)='/dev/audio\x00', 0x80, 0x0) ioctl$KVM_SET_FPU(0xffffffffffffffff, 0x41a0ae8d, &(0x7f0000000100)={[], 0x0, 0x5531fee, 0x0, 0x0, 0x9, 0xf000, 0x0, [], 0x5}) syz_open_dev$usb(&(0x7f0000000440)='/dev/bus/usb/00#/00#\x00', 0x9, 0x2) r1 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) lstat(&(0x7f0000000040)='./file0/file0\x00', &(0x7f0000000080)) ioctl$EXT4_IOC_MIGRATE(0xffffffffffffffff, 0x6609) sendmmsg$unix(0xffffffffffffffff, &(0x7f000000a000)=[{&(0x7f000000a000)=@abs, 0x6e, &(0x7f000000d000), 0x0, &(0x7f0000000600)=ANY=[]}], 0x1, 0x0) r2 = socket$inet6(0xa, 0x2, 0x0) gettid() r3 = getpgid(0x0) kcmp(0x0, r3, 0x0, 0xffffffffffffffff, 0xffffffffffffffff) connect$inet6(r2, &(0x7f0000002740)={0xa, 0x0, 0x0, @mcast2, 0x4}, 0x1c) sendmmsg(r2, &(0x7f0000007e00), 0x136a88c8311572c, 0x4000000000000) setsockopt$inet6_udp_int(r2, 0x11, 0x0, &(0x7f0000000400), 0x4) openat$kvm(0xffffffffffffff9c, &(0x7f00000003c0)='/dev/kvm\x00', 0x0, 0x0) ioctl$VHOST_SET_VRING_CALL(0xffffffffffffff9c, 0x4008af21, &(0x7f00000002c0)={0x0, r1}) ioctl$SNDRV_TIMER_IOCTL_TREAD(r0, 0x40045402, &(0x7f0000000740)) inotify_rm_watch(0xffffffffffffffff, 0x0) ioctl$ifreq_SIOCGIFINDEX_team(0xffffffffffffffff, 0x8933, &(0x7f0000000480)={'team0\x00'}) 04:45:56 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) fsetxattr$trusted_overlay_opaque(r0, &(0x7f0000000000)='trusted.overlay.opaque\x00', &(0x7f0000000040)='y\x00', 0x2, 0x3) r1 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, &(0x7f0000012fc7)}) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, &(0x7f0000000f4d)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000100)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0xfffffffffffffc2b, 0x0, &(0x7f0000000680)}) 04:45:56 executing program 3: r0 = syz_open_dev$sg(&(0x7f00000000c0)='/dev/sg#\x00', 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000000)={0x53, 0x0, 0x6, 0x0, @buffer={0x1c6, 0xb8, &(0x7f00000001c0)=""/184}, &(0x7f0000000540)="ad40657ed56c", &(0x7f0000000340)=""/128, 0x0, 0x0, 0x0, &(0x7f0000000040)}) 04:45:56 executing program 5: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000480)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_GUEST_DEBUG(r3, 0x4048ae9b, &(0x7f0000000140)={0x1}) syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000100)=[@text32={0x20, &(0x7f0000000000)="6601669b0f35c4e1fe16846ba49e0000b9940200000f32c4c23dad78e0b9670900000f32660f38827f95b0040f01d10fc71a", 0x32}], 0x1, 0x0, &(0x7f0000000040), 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r3, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000400)=[@text32={0x20, &(0x7f0000000880)="b805000000b98b9400000f01c19a01000000b0000f43d1b8000000000f23d80f21f835800000900f23f80f060f2140b9800000c00f3235000800000f3066ba4300b8f1ffffffefb9800000c00f3235002000000f30c4c3295f4da400", 0x5c}], 0x26433e1, 0x0, &(0x7f0000000300), 0x10000000000000b6) ioctl$KVM_RUN(r3, 0x8004ae98, 0x0) 04:45:56 executing program 0: pipe2(&(0x7f0000000140), 0x84800) r0 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rtc0\x00', 0x4000, 0x0) setsockopt$ARPT_SO_SET_ADD_COUNTERS(r0, 0x0, 0x61, &(0x7f0000000080)={'filter\x00', 0x4}, 0x68) ioctl$FS_IOC_RESVSP(r0, 0x40305828, &(0x7f0000000040)={0x0, 0x2, 0x4, 0x7b}) r1 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_inet_SIOCSARP(r1, 0x8955, &(0x7f0000000600)={{0x2, 0x0, @local}, {0x0, @local}, 0x8, {0x2, 0x0, @rand_addr}, "0000000500000000723000"}) setsockopt$inet_sctp_SCTP_I_WANT_MAPPED_V4_ADDR(r0, 0x84, 0xc, &(0x7f0000000100)=0xe0, 0x4) ioctl$sock_inet_SIOCSARP(r1, 0x8953, &(0x7f0000000180)={{0x2, 0x0, @local}, {0x0, @link_local}, 0x8, {0x2, 0x0, @remote}}) 04:45:56 executing program 1: r0 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000080)='/dev/rtc0\x00', 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x42, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sched_setattr(0x0, &(0x7f0000000000)={0x0, 0x6, 0x0, 0x0, 0x0, 0x9917, 0xffff}, 0x0) setsockopt$packet_tx_ring(r0, 0x107, 0xd, &(0x7f00000002c0)=@req3={0x2, 0x0, 0x4, 0x0, 0x0, 0x0, 0x9dbc}, 0x2) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x1000002, 0x800000000008032, 0xffffffffffffffff, 0x0) mremap(&(0x7f0000447000/0x3000)=nil, 0x3000, 0x3000, 0x0, &(0x7f0000997000/0x3000)=nil) getsockname$packet(r0, &(0x7f0000000540)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000580)=0x14) sendmsg$nl_route(r0, &(0x7f0000000680)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x200000}, 0xc, &(0x7f0000000640)={&(0x7f00000000c0)=ANY=[@ANYBLOB="509cec5fe19ef75a8474d61042bbb20aa7157f"], 0x1}}, 0x0) mbind(&(0x7f0000012000/0xc00000)=nil, 0xc00000, 0x0, &(0x7f0000000000), 0x2, 0x10000000002) [ 610.594152] binder: 22123:22172 unknown command -1072930034 [ 610.606247] binder: 22123:22172 ioctl c0306201 20008fd0 returned -22 04:45:57 executing program 0: r0 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_inet_SIOCSARP(r0, 0x8955, &(0x7f0000000600)={{0x2, 0x2, @local}, {0x0, @random="35f1c1b831db"}, 0x8, {0x2, 0x0, @rand_addr}, "0000000500000000723000"}) ioctl$sock_inet_SIOCSARP(r0, 0x8953, &(0x7f0000000180)={{0x2, 0x0, @local}, {0x0, @link_local}, 0x8, {0x2, 0x0, @remote}}) 04:45:57 executing program 3: r0 = syz_open_dev$sg(&(0x7f00000000c0)='/dev/sg#\x00', 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000000)={0x53, 0x0, 0x6, 0x0, @buffer={0xb5, 0xb8, &(0x7f00000001c0)=""/184}, &(0x7f0000000540)="ad40657ed56c", &(0x7f0000000340)=""/128, 0x0, 0x0, 0x0, &(0x7f0000000040)}) [ 610.873261] binder: 22188:22192 tried to acquire reference to desc 0, got 1 instead [ 611.001368] binder: 22188:22199 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 04:45:57 executing program 2: r0 = semget(0x1, 0x0, 0x2) semctl$IPC_RMID(r0, 0x0, 0x0) r1 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, &(0x7f0000012fc7)}) close(r1) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, &(0x7f0000000f4d)}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000100)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0xfffffffffffffc2b, 0x0, &(0x7f0000000680)}) 04:45:57 executing program 1: r0 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000080)='/dev/rtc0\x00', 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x42, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sched_setattr(0x0, &(0x7f0000000000)={0x0, 0x6, 0x0, 0x0, 0x0, 0x9917, 0xffff}, 0x0) setsockopt$packet_tx_ring(r0, 0x107, 0xd, &(0x7f00000002c0)=@req3={0x2, 0x0, 0x4, 0x0, 0x0, 0x0, 0x9dbc}, 0x2) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x1000002, 0x800000000008032, 0xffffffffffffffff, 0x0) mremap(&(0x7f0000447000/0x3000)=nil, 0x3000, 0x3000, 0x0, &(0x7f0000997000/0x3000)=nil) getsockname$packet(r0, &(0x7f0000000540)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000580)=0x14) sendmsg$nl_route(r0, &(0x7f0000000680)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x200000}, 0xc, &(0x7f0000000640)={&(0x7f00000000c0)=ANY=[@ANYBLOB="509cec5fe19ef75a8474d61042bbb20aa7157f"], 0x1}}, 0x0) mbind(&(0x7f0000012000/0xc00000)=nil, 0xc00000, 0x0, &(0x7f0000000000), 0x2, 0x10000000002) 04:45:57 executing program 0: r0 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_inet_SIOCSARP(r0, 0x8955, &(0x7f0000000600)={{0x2, 0x0, @local}, {0x0, @local}, 0x8, {0x2, 0x0, @rand_addr}, "0000000500000000723000"}) r1 = accept4(r0, &(0x7f0000000100), &(0x7f0000000000)=0x80, 0x80000) setsockopt$inet_sctp_SCTP_RECVNXTINFO(r1, 0x84, 0x21, &(0x7f0000000200)=0x8001, 0x4) r2 = openat$autofs(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/autofs\x00', 0x10f202, 0x0) setsockopt$inet_sctp_SCTP_SOCKOPT_CONNECTX(r2, 0x84, 0x6e, &(0x7f0000000040)=[@in6={0xa, 0x4e23, 0x0, @dev={0xfe, 0x80, [], 0x1f}, 0x7f}, @in={0x2, 0x4e23, @rand_addr}], 0x2c) ioctl$sock_inet_SIOCSARP(r0, 0x8953, &(0x7f0000000180)={{0x2, 0x0, @local}, {0x0, @link_local}, 0x8, {0x2, 0x0, @remote}}) ioctl$SNDRV_SEQ_IOCTL_CLIENT_ID(r2, 0x80045301, &(0x7f0000000240)) 04:45:57 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$vcsn(&(0x7f0000000000)='/dev/vcs#\x00', 0x3, 0x80) r3 = syz_genetlink_get_family_id$ipvs(&(0x7f00000000c0)='IPVS\x00') sendmsg$IPVS_CMD_NEW_DEST(r2, &(0x7f0000000200)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x20000}, 0xc, &(0x7f00000001c0)={&(0x7f0000000140)={0x70, r3, 0x804, 0x70bd2b, 0x25dfdbfc, {}, [@IPVS_CMD_ATTR_SERVICE={0x50, 0x1, [@IPVS_SVC_ATTR_TIMEOUT={0x8, 0x8, 0x100000001}, @IPVS_SVC_ATTR_NETMASK={0x8, 0x9, 0x2a}, @IPVS_SVC_ATTR_SCHED_NAME={0x8, 0x6, 'sed\x00'}, @IPVS_SVC_ATTR_PORT={0x8, 0x4, 0x4e20}, @IPVS_SVC_ATTR_PROTOCOL={0x8, 0x2, 0x3c}, @IPVS_SVC_ATTR_SCHED_NAME={0x8, 0x6, 'wlc\x00'}, @IPVS_SVC_ATTR_NETMASK={0x8, 0x9, 0x4c}, @IPVS_SVC_ATTR_FLAGS={0xc, 0x7, {0x25, 0x34}}, @IPVS_SVC_ATTR_NETMASK={0x8, 0x9, 0x5c}]}, @IPVS_CMD_ATTR_DEST={0xc, 0x2, [@IPVS_DEST_ATTR_ADDR_FAMILY={0x8, 0xb, 0xa}]}]}, 0x70}, 0x1, 0x0, 0x0, 0x800}, 0x8000) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, &(0x7f0000012fc7)}) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, &(0x7f0000000f4d)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000100)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0xfffffffffffffc2b, 0x0, &(0x7f0000000680)}) 04:45:57 executing program 4: ioctl$KVM_IRQ_LINE(0xffffffffffffffff, 0x4008ae61, &(0x7f0000000500)) r0 = syz_open_dev$dspn(&(0x7f00000004c0)='/dev/dsp#\x00', 0x1, 0x0) openat$audio(0xffffffffffffff9c, &(0x7f0000000000)='/dev/audio\x00', 0x80, 0x0) ioctl$KVM_SET_FPU(0xffffffffffffffff, 0x41a0ae8d, &(0x7f0000000100)={[], 0x0, 0x5531fee, 0x0, 0x0, 0x9, 0xf000, 0x0, [], 0x5}) syz_open_dev$usb(&(0x7f0000000440)='/dev/bus/usb/00#/00#\x00', 0x9, 0x2) r1 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) lstat(&(0x7f0000000040)='./file0/file0\x00', &(0x7f0000000080)) ioctl$EXT4_IOC_MIGRATE(0xffffffffffffffff, 0x6609) sendmmsg$unix(0xffffffffffffffff, &(0x7f000000a000)=[{&(0x7f000000a000)=@abs, 0x6e, &(0x7f000000d000), 0x0, &(0x7f0000000600)=ANY=[]}], 0x1, 0x0) r2 = socket$inet6(0xa, 0x2, 0x0) gettid() r3 = getpgid(0x0) kcmp(0x0, r3, 0x0, 0xffffffffffffffff, 0xffffffffffffffff) connect$inet6(r2, &(0x7f0000002740)={0xa, 0x0, 0x0, @mcast2, 0x4}, 0x1c) sendmmsg(r2, &(0x7f0000007e00), 0x136a88c8311572c, 0xa0010000) setsockopt$inet6_udp_int(r2, 0x11, 0x0, &(0x7f0000000400), 0x4) openat$kvm(0xffffffffffffff9c, &(0x7f00000003c0)='/dev/kvm\x00', 0x0, 0x0) ioctl$VHOST_SET_VRING_CALL(0xffffffffffffff9c, 0x4008af21, &(0x7f00000002c0)={0x0, r1}) ioctl$SNDRV_TIMER_IOCTL_TREAD(r0, 0x40045402, &(0x7f0000000740)) inotify_rm_watch(0xffffffffffffffff, 0x0) ioctl$ifreq_SIOCGIFINDEX_team(0xffffffffffffffff, 0x8933, &(0x7f0000000480)={'team0\x00'}) 04:45:57 executing program 3: r0 = syz_open_dev$sg(&(0x7f00000000c0)='/dev/sg#\x00', 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000000)={0x53, 0x0, 0x6, 0x0, @buffer={0xdc, 0xb8, &(0x7f00000001c0)=""/184}, &(0x7f0000000540)="ad40657ed56c", &(0x7f0000000340)=""/128, 0x0, 0x0, 0x0, &(0x7f0000000040)}) 04:45:57 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$sndpcmc(&(0x7f0000000040)='/dev/snd/pcmC#D#c\x00', 0x600000000000, 0x140) ioctl$UI_DEV_SETUP(r1, 0x405c5503, &(0x7f0000000140)={{0x66, 0x23ea0000000, 0x4, 0x7}, 'syz0\x00', 0x4e}) r2 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, &(0x7f0000012fc7)}) r3 = perf_event_open(&(0x7f0000000d40)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r4 = socket$inet(0xa, 0x801, 0x84) connect$inet(r4, &(0x7f0000000180)={0x2, 0x0, @remote={0xac, 0x14, 0xffffffffffffffff}}, 0x10) dup3(r3, r4, 0x0) close(r0) r5 = dup2(r0, r2) ioctl$TIOCLINUX6(r5, 0x541c, &(0x7f0000000000)={0x6, 0xffffffffffffffff}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, &(0x7f0000000f4d)}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000100)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0xfffffffffffffc2b, 0x0, &(0x7f0000000680)}) 04:45:57 executing program 5: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000480)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_GUEST_DEBUG(r3, 0x4048ae9b, &(0x7f0000000140)={0x1}) syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000100)=[@text32={0x20, &(0x7f0000000000)="6601669b0f35c4e1fe16846ba49e0000b9940200000f32c4c23dad78e0b9670900000f32660f38827f95b0040f01d10fc71a", 0x32}], 0x1, 0x0, &(0x7f0000000040), 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r3, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000400)=[@text32={0x20, &(0x7f0000000880)="b805000000b98b9400000f01c19a01000000b0000f43d1b8000000000f23d80f21f835800000900f23f80f060f2140b9800000c00f3235000800000f3066ba4300b8f1ffffffefb9800000c00f3235002000000f30c4c3295f4da400", 0x5c}], 0x26433e1, 0x0, &(0x7f0000000300), 0x10000000000000b6) ioctl$KVM_RUN(r3, 0x8090ae81, 0x0) [ 611.420757] binder: 22230:22231 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 04:45:57 executing program 3: r0 = syz_open_dev$sg(&(0x7f00000000c0)='/dev/sg#\x00', 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000000)={0x53, 0x0, 0x6, 0x0, @buffer={0x1b5, 0xb8, &(0x7f00000001c0)=""/184}, &(0x7f0000000540)="ad40657ed56c", &(0x7f0000000340)=""/128, 0x0, 0x0, 0x0, &(0x7f0000000040)}) 04:45:57 executing program 0: r0 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_inet_SIOCSARP(r0, 0x8955, &(0x7f0000000600)={{0x2, 0x0, @local}, {0x0, @local}, 0x8, {0x2, 0x0, @rand_addr}, "0000000500000000723000"}) ioctl$sock_inet_SIOCSARP(r0, 0x8953, &(0x7f0000000180)={{0x2, 0x0, @local}, {0x0, @link_local}, 0x8, {0x2, 0x0, @remote}}) r1 = memfd_create(&(0x7f0000000000)="0000000500000000723000", 0x1) r2 = openat$null(0xffffffffffffff9c, &(0x7f0000000100)='/dev/null\x00', 0x480, 0x0) ioctl$sock_kcm_SIOCKCMATTACH(r1, 0x89e0, &(0x7f0000000080)={r0, r2}) 04:45:57 executing program 5: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000480)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_GUEST_DEBUG(r3, 0x4048ae9b, &(0x7f0000000140)={0x1}) syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000100)=[@text32={0x20, &(0x7f0000000000)="6601669b0f35c4e1fe16846ba49e0000b9940200000f32c4c23dad78e0b9670900000f32660f38827f95b0040f01d10fc71a", 0x32}], 0x1, 0x0, &(0x7f0000000040), 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r3, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000400)=[@text32={0x20, &(0x7f0000000880)="b805000000b98b9400000f01c19a01000000b0000f43d1b8000000000f23d80f21f835800000900f23f80f060f2140b9800000c00f3235000800000f3066ba4300b8f1ffffffefb9800000c00f3235002000000f30c4c3295f4da400", 0x5c}], 0x26433e1, 0x0, &(0x7f0000000300), 0x10000000000000b6) ioctl$KVM_RUN(r3, 0xc018ae85, 0x0) 04:45:57 executing program 3: r0 = syz_open_dev$sg(&(0x7f00000000c0)='/dev/sg#\x00', 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000000)={0x53, 0x0, 0x6, 0x0, @buffer={0xee, 0xb8, &(0x7f00000001c0)=""/184}, &(0x7f0000000540)="ad40657ed56c", &(0x7f0000000340)=""/128, 0x0, 0x0, 0x0, &(0x7f0000000040)}) 04:45:57 executing program 5: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000480)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_GUEST_DEBUG(r3, 0x4048ae9b, &(0x7f0000000140)={0x1}) syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000100)=[@text32={0x20, &(0x7f0000000000)="6601669b0f35c4e1fe16846ba49e0000b9940200000f32c4c23dad78e0b9670900000f32660f38827f95b0040f01d10fc71a", 0x32}], 0x1, 0x0, &(0x7f0000000040), 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r3, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000400)=[@text32={0x20, &(0x7f0000000880)="b805000000b98b9400000f01c19a01000000b0000f43d1b8000000000f23d80f21f835800000900f23f80f060f2140b9800000c00f3235000800000f3066ba4300b8f1ffffffefb9800000c00f3235002000000f30c4c3295f4da400", 0x5c}], 0x26433e1, 0x0, &(0x7f0000000300), 0x10000000000000b6) ioctl$KVM_RUN(r3, 0xc020660b, 0x0) 04:45:57 executing program 1: perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.cpu\x00', 0x200002, 0x0) r1 = openat$cgroup_procs(r0, &(0x7f0000000500)='cgroup.procs\x00', 0x2, 0x0) sendfile(r1, r1, &(0x7f0000000040)=0x6c00, 0x10a000000) r2 = syz_open_dev$admmidi(&(0x7f00000000c0)='/dev/admmidi#\x00', 0x3, 0x40) ioctl$PPPIOCGL2TPSTATS(r2, 0x80487436, &(0x7f0000000100)="1b7791e8387a35461664c6084bd8cb05a1f4e8200efecf06c65ab9923670a867243fd3ce3c718948571a84551805d1de2421189d5159d9dc8801e05429ae1358de03a26ee5f4f6a8c3993cce494eec4251581d8a142b51a19d0c5cc573112b51abc53c2f4225c98004da0435d86f69ff754204c8b3bf57a9069186530506af0633cb1e1f31d96bfbbaaa0bc6c469339e9471b07507f708b9f9db62a93159") semctl$IPC_RMID(0x0, 0x0, 0x10) 04:45:57 executing program 4: ioctl$KVM_IRQ_LINE(0xffffffffffffffff, 0x4008ae61, &(0x7f0000000500)) r0 = syz_open_dev$dspn(&(0x7f00000004c0)='/dev/dsp#\x00', 0x1, 0x0) openat$audio(0xffffffffffffff9c, &(0x7f0000000000)='/dev/audio\x00', 0x80, 0x0) ioctl$KVM_SET_FPU(0xffffffffffffffff, 0x41a0ae8d, &(0x7f0000000100)={[], 0x0, 0x5531fee, 0x0, 0x0, 0x9, 0xf000, 0x0, [], 0x5}) syz_open_dev$usb(&(0x7f0000000440)='/dev/bus/usb/00#/00#\x00', 0x9, 0x2) r1 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) lstat(&(0x7f0000000040)='./file0/file0\x00', &(0x7f0000000080)) ioctl$EXT4_IOC_MIGRATE(0xffffffffffffffff, 0x6609) sendmmsg$unix(0xffffffffffffffff, &(0x7f000000a000)=[{&(0x7f000000a000)=@abs, 0x6e, &(0x7f000000d000), 0x0, &(0x7f0000000600)=ANY=[]}], 0x1, 0x0) r2 = socket$inet6(0xa, 0x2, 0x0) gettid() r3 = getpgid(0x0) kcmp(0x0, r3, 0x0, 0xffffffffffffffff, 0xffffffffffffffff) connect$inet6(r2, &(0x7f0000002740)={0xa, 0x0, 0x0, @mcast2, 0x4}, 0x1c) sendmmsg(r2, &(0x7f0000007e00), 0x136a88c8311572c, 0x11000000) setsockopt$inet6_udp_int(r2, 0x11, 0x0, &(0x7f0000000400), 0x4) openat$kvm(0xffffffffffffff9c, &(0x7f00000003c0)='/dev/kvm\x00', 0x0, 0x0) ioctl$VHOST_SET_VRING_CALL(0xffffffffffffff9c, 0x4008af21, &(0x7f00000002c0)={0x0, r1}) ioctl$SNDRV_TIMER_IOCTL_TREAD(r0, 0x40045402, &(0x7f0000000740)) inotify_rm_watch(0xffffffffffffffff, 0x0) ioctl$ifreq_SIOCGIFINDEX_team(0xffffffffffffffff, 0x8933, &(0x7f0000000480)={'team0\x00'}) 04:45:57 executing program 0: r0 = socket$inet_tcp(0x2, 0x1, 0x0) keyctl$session_to_parent(0x12) ioctl$sock_inet_SIOCSARP(r0, 0x8955, &(0x7f0000000600)={{0x2, 0x0, @local}, {0x0, @local}, 0x8, {0x2, 0x0, @rand_addr}, "0000000500000000723000"}) ioctl$sock_inet_SIOCSARP(r0, 0x8953, &(0x7f0000000000)={{0x2, 0x0, @local}, {0x0, @link_local}, 0x8, {0x2, 0x0, @multicast2}}) 04:45:58 executing program 3: r0 = syz_open_dev$sg(&(0x7f00000000c0)='/dev/sg#\x00', 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000000)={0x53, 0x0, 0x6, 0x0, @buffer={0x1a5, 0xb8, &(0x7f00000001c0)=""/184}, &(0x7f0000000540)="ad40657ed56c", &(0x7f0000000340)=""/128, 0x0, 0x0, 0x0, &(0x7f0000000040)}) 04:45:58 executing program 0: r0 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_inet_SIOCSARP(r0, 0x8955, &(0x7f0000000600)={{0x2, 0x0, @local}, {0x0, @local}, 0x8, {0x2, 0x0, @rand_addr}, "0000000500000000723000"}) ioctl$sock_inet_SIOCSARP(r0, 0x8953, &(0x7f0000000180)={{0x2, 0x0, @local}, {0x0, @link_local}, 0x8, {0x2, 0x0, @remote}}) ioctl$sock_inet_SIOCSARP(r0, 0x8955, &(0x7f0000000000)={{0x2, 0x4e23, @broadcast}, {0x306}, 0x8, {0x2, 0x4e20, @broadcast}, 'yam0\x00'}) 04:45:58 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, &(0x7f0000012fc7)}) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, &(0x7f0000000f4d)}) r2 = pkey_alloc(0x0, 0x0) pkey_mprotect(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x8, r2) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000100)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0xfffffffffffffc2b, 0x0, &(0x7f0000000680)}) 04:45:58 executing program 1: clone(0x802182001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000140), 0xffffffffffffffff) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x3, 0x24, &(0x7f0000001000)=ANY=[@ANYBLOB="61124c00000000006113500000000000bf2000000000000007000000080000003d030100000000009500000000000000712600000000000035060000ff000000bf25000000000000070500000e0000000f65000000000000bf5400000000000007040000040000003d4301000000000095000000000000006154000000000000bf250000000000000f65000000000000070500000e000000bf5400000000000007040000040000003d43010000000000950000000000000061540000000000006b25000000000000070500000e0000000f6500000000000007050000040000000f65000000000000bf5400000000000007040000040000003d3201000000000095000000000000004d54000000000000b7000000000000009500000000000000"], &(0x7f0000000100)='GPL\x00'}, 0x48) r0 = openat$audio(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/audio\x00', 0x281, 0x0) write$9p(r0, &(0x7f0000000200)="c72ce3cbc0f30a566e2f2156ab2036aee7a80e42b58479443727b216e178b7345506975f673ec208d437c507d01b5457e16715e679f2bf84e03e4e3948b229e468ba02ba8ba2217293d81d1368f76aa9982abd66ec4e0bea421d39135b3c8506c7f00738364e72fbd3e761ce347fd723110b54c65eb92c5d55f071", 0x7b) exit(0x0) ioctl$SNDRV_SEQ_IOCTL_GET_PORT_INFO(0xffffffffffffffff, 0xc0a85322, &(0x7f0000000380)) write$P9_ROPEN(0xffffffffffffffff, &(0x7f0000000080)={0x18, 0x71, 0x2, {{0x80, 0x2, 0x8}, 0x401}}, 0x18) 04:45:58 executing program 0: r0 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_inet_SIOCSARP(r0, 0x8955, &(0x7f0000000600)={{0x2, 0x0, @local}, {0x0, @local}, 0x8, {0x2, 0x0, @rand_addr}, "0000000500000000723000"}) ioctl$sock_inet_SIOCSARP(r0, 0x8953, &(0x7f0000000180)={{0x2, 0x0, @local}, {0x0, @link_local}, 0x8, {0x2, 0x0, @remote}}) 04:45:58 executing program 3: r0 = syz_open_dev$sg(&(0x7f00000000c0)='/dev/sg#\x00', 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000000)={0x53, 0x0, 0x6, 0x0, @buffer={0x18f, 0xb8, &(0x7f00000001c0)=""/184}, &(0x7f0000000540)="ad40657ed56c", &(0x7f0000000340)=""/128, 0x0, 0x0, 0x0, &(0x7f0000000040)}) 04:45:58 executing program 5: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000480)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_GUEST_DEBUG(r3, 0x4048ae9b, &(0x7f0000000140)={0x1}) syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000100)=[@text32={0x20, &(0x7f0000000000)="6601669b0f35c4e1fe16846ba49e0000b9940200000f32c4c23dad78e0b9670900000f32660f38827f95b0040f01d10fc71a", 0x32}], 0x1, 0x0, &(0x7f0000000040), 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r3, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000400)=[@text32={0x20, &(0x7f0000000880)="b805000000b98b9400000f01c19a01000000b0000f43d1b8000000000f23d80f21f835800000900f23f80f060f2140b9800000c00f3235000800000f3066ba4300b8f1ffffffefb9800000c00f3235002000000f30c4c3295f4da400", 0x5c}], 0x26433e1, 0x0, &(0x7f0000000300), 0x10000000000000b6) ioctl$KVM_RUN(r3, 0xc0045878, 0x0) [ 612.188134] binder: 22230:22277 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 04:45:58 executing program 3: r0 = syz_open_dev$sg(&(0x7f00000000c0)='/dev/sg#\x00', 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000000)={0x53, 0x0, 0x6, 0x0, @buffer={0x73, 0xb8, &(0x7f00000001c0)=""/184}, &(0x7f0000000540)="ad40657ed56c", &(0x7f0000000340)=""/128, 0x0, 0x0, 0x0, &(0x7f0000000040)}) 04:45:58 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x3) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, &(0x7f0000012fc7)}) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, &(0x7f0000000f4d)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000100)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0xfffffffffffffc2b, 0x0, &(0x7f0000000680)}) 04:45:58 executing program 0: r0 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_inet_SIOCSARP(r0, 0x8955, &(0x7f0000000600)={{0x2, 0x0, @local}, {0x0, @local}, 0x8, {0x2, 0x0, @rand_addr}, "0000000500000000723000"}) setsockopt$ARPT_SO_SET_REPLACE(r0, 0x0, 0x60, &(0x7f0000000680)={'filter\x00', 0x7, 0x4, 0x480, 0x398, 0x258, 0x258, 0x398, 0x398, 0x398, 0x4, &(0x7f0000000000), {[{{@arp={@broadcast, @multicast2, 0xffffffff, 0x0, @empty, {[0xff, 0x0, 0xff, 0xff, 0xff]}, @empty, {[0xff, 0xff, 0x0, 0xff, 0xff]}, 0x343a, 0x1, 0x100000001, 0x7, 0x4, 0x43cf0b1d, 'lo\x00', 'bridge_slave_1\x00', {}, {0xff}, 0x0, 0x2}, 0xf0, 0x118}, @unspec=@CONNSECMARK={0x28, 'CONNSECMARK\x00', 0x0, {0x2}}}, {{@uncond, 0xf0, 0x140}, @mangle={0x50, 'mangle\x00', 0x0, {@empty, @empty, @multicast2, @remote, 0x8, 0xffffffff}}}, {{@uncond, 0xf0, 0x140}, @mangle={0x50, 'mangle\x00', 0x0, {@empty, @empty, @local, @dev={0xac, 0x14, 0x14, 0x21}, 0x1, 0xffffffff}}}], {{[], 0xc0, 0xe8}, {0x28}}}}, 0x4d0) ioctl$sock_inet_SIOCSARP(r0, 0x8953, &(0x7f0000000180)={{0x2, 0x0, @local}, {0x0, @link_local}, 0x8, {0x2, 0x0, @remote}}) 04:45:58 executing program 4: ioctl$KVM_IRQ_LINE(0xffffffffffffffff, 0x4008ae61, &(0x7f0000000500)) r0 = syz_open_dev$dspn(&(0x7f00000004c0)='/dev/dsp#\x00', 0x1, 0x0) openat$audio(0xffffffffffffff9c, &(0x7f0000000000)='/dev/audio\x00', 0x80, 0x0) ioctl$KVM_SET_FPU(0xffffffffffffffff, 0x41a0ae8d, &(0x7f0000000100)={[], 0x0, 0x5531fee, 0x0, 0x0, 0x9, 0xf000, 0x0, [], 0x5}) syz_open_dev$usb(&(0x7f0000000440)='/dev/bus/usb/00#/00#\x00', 0x9, 0x2) r1 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) lstat(&(0x7f0000000040)='./file0/file0\x00', &(0x7f0000000080)) ioctl$EXT4_IOC_MIGRATE(0xffffffffffffffff, 0x6609) sendmmsg$unix(0xffffffffffffffff, &(0x7f000000a000)=[{&(0x7f000000a000)=@abs, 0x6e, &(0x7f000000d000), 0x0, &(0x7f0000000600)=ANY=[]}], 0x1, 0x0) r2 = socket$inet6(0xa, 0x2, 0x0) gettid() r3 = getpgid(0x0) kcmp(0x0, r3, 0x0, 0xffffffffffffffff, 0xffffffffffffffff) connect$inet6(r2, &(0x7f0000002740)={0xa, 0x0, 0x0, @mcast2, 0x4}, 0x1c) sendmmsg(r2, &(0x7f0000007e00), 0x136a88c8311572c, 0xb6050000) setsockopt$inet6_udp_int(r2, 0x11, 0x0, &(0x7f0000000400), 0x4) openat$kvm(0xffffffffffffff9c, &(0x7f00000003c0)='/dev/kvm\x00', 0x0, 0x0) ioctl$VHOST_SET_VRING_CALL(0xffffffffffffff9c, 0x4008af21, &(0x7f00000002c0)={0x0, r1}) ioctl$SNDRV_TIMER_IOCTL_TREAD(r0, 0x40045402, &(0x7f0000000740)) inotify_rm_watch(0xffffffffffffffff, 0x0) ioctl$ifreq_SIOCGIFINDEX_team(0xffffffffffffffff, 0x8933, &(0x7f0000000480)={'team0\x00'}) 04:45:58 executing program 3: r0 = syz_open_dev$sg(&(0x7f00000000c0)='/dev/sg#\x00', 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000000)={0x53, 0x0, 0x6, 0x0, @buffer={0x1ee, 0xb8, &(0x7f00000001c0)=""/184}, &(0x7f0000000540)="ad40657ed56c", &(0x7f0000000340)=""/128, 0x0, 0x0, 0x0, &(0x7f0000000040)}) 04:45:58 executing program 5: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000480)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_GUEST_DEBUG(r3, 0x4048ae9b, &(0x7f0000000140)={0x1}) syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000100)=[@text32={0x20, &(0x7f0000000000)="6601669b0f35c4e1fe16846ba49e0000b9940200000f32c4c23dad78e0b9670900000f32660f38827f95b0040f01d10fc71a", 0x32}], 0x1, 0x0, &(0x7f0000000040), 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r3, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000400)=[@text32={0x20, &(0x7f0000000880)="b805000000b98b9400000f01c19a01000000b0000f43d1b8000000000f23d80f21f835800000900f23f80f060f2140b9800000c00f3235000800000f3066ba4300b8f1ffffffefb9800000c00f3235002000000f30c4c3295f4da400", 0x5c}], 0x26433e1, 0x0, &(0x7f0000000300), 0x10000000000000b6) ioctl$KVM_RUN(r3, 0xc0189436, 0x0) 04:45:58 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) preadv(r0, &(0x7f00000000c0)=[{&(0x7f0000000340)=""/149, 0x95}, {&(0x7f0000000400)=""/69, 0x45}, {&(0x7f0000000480)=""/141, 0x8d}, {&(0x7f0000000040)=""/7, 0x7}], 0x4, 0x0) r2 = openat$vhci(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vhci\x00', 0x600000, 0x0) ioctl$LOOP_GET_STATUS64(r2, 0x4c05, &(0x7f0000000140)) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000005fd4)=ANY=[@ANYBLOB='\r\x00\x00\x00\x00\x00\x00\x00'], 0x0, 0x0, &(0x7f0000012fc7)}) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, &(0x7f0000000f4d)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000100)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0xfffffffffffffc2b, 0x0, &(0x7f0000000680)}) ioctl$KVM_X86_GET_MCE_CAP_SUPPORTED(r2, 0x8008ae9d, &(0x7f0000000240)=""/201) 04:45:58 executing program 0: r0 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$EXT4_IOC_GROUP_ADD(r0, 0x40286608, &(0x7f0000000000)={0xfffffffffffffff8, 0x9, 0x5, 0xffffffff, 0x2, 0x2fb3}) ioctl$sock_inet_SIOCSARP(r0, 0x8955, &(0x7f0000000600)={{0x2, 0x0, @local}, {0x0, @local}, 0x8, {0x2, 0x0, @rand_addr}, "0000000500000000723000"}) ioctl$sock_inet_SIOCSARP(r0, 0x8953, &(0x7f0000000180)={{0x2, 0x0, @local}, {0x0, @link_local}, 0x8, {0x2, 0x0, @remote}}) r1 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000040)='/dev/snapshot\x00', 0x2, 0x0) ioctl$PIO_UNIMAPCLR(r1, 0x4b68, &(0x7f0000000080)={0xfffffffffffffffd, 0x9, 0x3f}) 04:45:58 executing program 1: r0 = perf_event_open(&(0x7f000025c000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000001}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = dup3(r0, r0, 0x80000) ioctl$KVM_GET_NESTED_STATE(r1, 0xc080aebe, &(0x7f0000000100)={0x0, 0x0, 0x2080}) r2 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x11, r2, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r0, 0x2405, r2) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x1000004, 0x8031, 0xffffffffffffffff, 0x0) r3 = creat(&(0x7f00000000c0)='./file0\x00', 0x28) ioctl$RTC_PIE_OFF(r3, 0x7006) getsockopt$inet_sctp6_SCTP_NODELAY(0xffffffffffffffff, 0x84, 0x3, &(0x7f0000000080), &(0x7f0000000040)=0xffffffffffffff68) 04:45:58 executing program 3: r0 = syz_open_dev$sg(&(0x7f00000000c0)='/dev/sg#\x00', 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000000)={0x53, 0x0, 0x6, 0x0, @buffer={0x1c7, 0xb8, &(0x7f00000001c0)=""/184}, &(0x7f0000000540)="ad40657ed56c", &(0x7f0000000340)=""/128, 0x0, 0x0, 0x0, &(0x7f0000000040)}) [ 612.730666] binder: 22320:22325 unknown command 13 [ 612.764033] binder: 22320:22325 ioctl c0306201 20012000 returned -22 04:45:58 executing program 0: r0 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_inet_SIOCSARP(r0, 0x8955, &(0x7f0000000600)={{0x2, 0x0, @local}, {0x0, @local}, 0x8, {0x2, 0x0, @rand_addr}, "0000000500000000723000"}) r1 = syz_open_dev$sndpcmp(&(0x7f0000000000)='/dev/snd/pcmC#D#p\x00', 0x10000, 0x1) connect$vsock_stream(r1, &(0x7f0000000040)={0x28, 0x0, 0xffffffff, @host}, 0x10) ioctl$sock_inet_SIOCSARP(r0, 0x8953, &(0x7f0000000180)={{0x2, 0x100000, @local}, {0x0, @link_local}, 0x8, {0x2, 0x0, @remote}}) [ 612.805036] binder: 22320:22325 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 04:45:59 executing program 3: r0 = syz_open_dev$sg(&(0x7f00000000c0)='/dev/sg#\x00', 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000000)={0x53, 0x0, 0x6, 0x0, @buffer={0x28, 0xb8, &(0x7f00000001c0)=""/184}, &(0x7f0000000540)="ad40657ed56c", &(0x7f0000000340)=""/128, 0x0, 0x0, 0x0, &(0x7f0000000040)}) 04:45:59 executing program 5: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000480)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_GUEST_DEBUG(r3, 0x4048ae9b, &(0x7f0000000140)={0x1}) syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000100)=[@text32={0x20, &(0x7f0000000000)="6601669b0f35c4e1fe16846ba49e0000b9940200000f32c4c23dad78e0b9670900000f32660f38827f95b0040f01d10fc71a", 0x32}], 0x1, 0x0, &(0x7f0000000040), 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r3, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000400)=[@text32={0x20, &(0x7f0000000880)="b805000000b98b9400000f01c19a01000000b0000f43d1b8000000000f23d80f21f835800000900f23f80f060f2140b9800000c00f3235000800000f3066ba4300b8f1ffffffefb9800000c00f3235002000000f30c4c3295f4da400", 0x5c}], 0x26433e1, 0x0, &(0x7f0000000300), 0x10000000000000b6) ioctl$KVM_RUN(r3, 0x4138ae84, 0x0) 04:45:59 executing program 4: ioctl$KVM_IRQ_LINE(0xffffffffffffffff, 0x4008ae61, &(0x7f0000000500)) r0 = syz_open_dev$dspn(&(0x7f00000004c0)='/dev/dsp#\x00', 0x1, 0x0) openat$audio(0xffffffffffffff9c, &(0x7f0000000000)='/dev/audio\x00', 0x80, 0x0) ioctl$KVM_SET_FPU(0xffffffffffffffff, 0x41a0ae8d, &(0x7f0000000100)={[], 0x0, 0x5531fee, 0x0, 0x0, 0x9, 0xf000, 0x0, [], 0x5}) syz_open_dev$usb(&(0x7f0000000440)='/dev/bus/usb/00#/00#\x00', 0x9, 0x2) r1 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) lstat(&(0x7f0000000040)='./file0/file0\x00', &(0x7f0000000080)) ioctl$EXT4_IOC_MIGRATE(0xffffffffffffffff, 0x6609) sendmmsg$unix(0xffffffffffffffff, &(0x7f000000a000)=[{&(0x7f000000a000)=@abs, 0x6e, &(0x7f000000d000), 0x0, &(0x7f0000000600)=ANY=[]}], 0x1, 0x0) r2 = socket$inet6(0xa, 0x2, 0x0) gettid() r3 = getpgid(0x0) kcmp(0x0, r3, 0x0, 0xffffffffffffffff, 0xffffffffffffffff) connect$inet6(r2, &(0x7f0000002740)={0xa, 0x0, 0x0, @mcast2, 0x4}, 0x1c) sendmmsg(r2, &(0x7f0000007e00), 0x136a88c8311572c, 0x3000000000000000) setsockopt$inet6_udp_int(r2, 0x11, 0x0, &(0x7f0000000400), 0x4) openat$kvm(0xffffffffffffff9c, &(0x7f00000003c0)='/dev/kvm\x00', 0x0, 0x0) ioctl$VHOST_SET_VRING_CALL(0xffffffffffffff9c, 0x4008af21, &(0x7f00000002c0)={0x0, r1}) ioctl$SNDRV_TIMER_IOCTL_TREAD(r0, 0x40045402, &(0x7f0000000740)) inotify_rm_watch(0xffffffffffffffff, 0x0) ioctl$ifreq_SIOCGIFINDEX_team(0xffffffffffffffff, 0x8933, &(0x7f0000000480)={'team0\x00'}) 04:45:59 executing program 0: r0 = socket$inet_tcp(0x2, 0x1, 0x0) r1 = openat$zero(0xffffffffffffff9c, &(0x7f0000000000)='/dev/zero\x00', 0x101000, 0x0) write$P9_RLINK(r1, &(0x7f0000000080)={0x7, 0x47, 0x2}, 0x7) ioctl$SG_GET_ACCESS_COUNT(r1, 0x2289, &(0x7f0000000040)) ioctl$sock_inet_SIOCSARP(r0, 0x8955, &(0x7f0000000600)={{0x2, 0x0, @local}, {0x0, @local}, 0x8, {0x2, 0x0, @rand_addr}, "0000000500000000723000"}) 04:45:59 executing program 3: r0 = syz_open_dev$sg(&(0x7f00000000c0)='/dev/sg#\x00', 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000000)={0x53, 0x0, 0x6, 0x0, @buffer={0x133, 0xb8, &(0x7f00000001c0)=""/184}, &(0x7f0000000540)="ad40657ed56c", &(0x7f0000000340)=""/128, 0x0, 0x0, 0x0, &(0x7f0000000040)}) 04:45:59 executing program 0: r0 = syz_open_dev$sndpcmc(&(0x7f0000000280)='/dev/snd/pcmC#D#c\x00', 0x10000, 0x400000) write$FUSE_NOTIFY_INVAL_INODE(r0, &(0x7f00000002c0)={0x28, 0x2, 0x0, {0x0, 0xa903c35, 0x5}}, 0x28) r1 = syz_open_dev$dspn(&(0x7f00000000c0)='/dev/dsp#\x00', 0x9, 0x30040) getsockopt$inet_tcp_TCP_ZEROCOPY_RECEIVE(r1, 0x6, 0x23, &(0x7f0000000380)={&(0x7f0000ffd000/0x1000)=nil, 0x4000}, &(0x7f0000000140)=0x4ca) ioctl$EXT4_IOC_PRECACHE_EXTENTS(r1, 0x6612) r2 = request_key(&(0x7f0000000340)='trusted\x00', &(0x7f0000002080)={'syz', 0x0}, &(0x7f00000020c0)='\x00', 0xfffffffffffffffb) r3 = add_key$keyring(&(0x7f0000001ec0)='keyring\x00', &(0x7f0000001f00)={'syz', 0x2}, 0x0, 0x0, 0xfffffffffffffffc) keyctl$instantiate_iov(0x14, r2, &(0x7f0000001e40)=[{&(0x7f0000000d40)="6bfa6b7d301207c4e777bbe6a5820b01a6f0576619df2bfe4055d133d2292461381ee45362a58840921d0134b90f21151d9fc679a8edaee670399f00436244eb810caf0f5b687b5ef8906ac8cd016b5948dc7b535b7d80652027acc35c033653c1fe6771ddd1ec50401767433ad777f5197317bc277731c6294436d3fcd8eab4688b324730de47a01efde92bb91932352440d2ba4e03b892d98a5d818fd422d85ea783730895fe5f343582a34ed75334b489df4b2500aced0a84168dea7d8aa3bb4dcc1fbff62cc47d72197c4ff1c6664c4540d849409b3827ca7a8e51a7a38d5efff4d9e38949b91008e991aed0791c12a3557fc385eaa20635924f4620da040b30939299e07cedcf1d6121588394f2d4e0ba6491d4fb68dfac5d6e32bb7848477eb227897a8761bea25c9fad23e72635e863cdfb5b11ac7925e80075e205ab5a5ce652214fd3da1da3c8a18c601ac4d7f72e4cee992af0e5925ed7c8da2173601cd496e57ef4d4ef1e37e3f21cf8c2c4ede01ad88ec5b28313bd0aa8fcb0a197f35e9dc2b592d557a9f2f9631a974f4070e8078464fba24edb911c8d5613f921b0115772cfb9b5ac5820922236c0870724a557666263499dd898645148ab92395952f6cc61b8e53e6376568e3a307636a8e49e590c3a86511a6b354a8e449ce4266deb2e72114f731f76f2134d0205731fdd41d563a5f0330740638b65159679506e5c2af9d0d25ec7a771830c82dc600b46ff1d5ddfaf20131a02cb710ffa474a08828fe3eaf3b447c18f6f4fe8a8f6d6b19c2b07f2e180c70f07a7bb4c1e23a8a2cd9878d4f74397df7a18b0f2973b98487b5b5107465f3ae1d71aafe286be43755f5ff55d1267a0790459d3dbc763b882ed76117d3429c1520a0c177e30e0a94142bf60ce57d084477719c912cd415e6c078b709c030ef7a9365ba705185bef7f447000c3f333b8a35e1ef9b05cd59d046cd4f235dadc591c7c95588a82856e95822953b2a460051bd23bc83dc40550167a6efd28e22a7436722e78ef990168ef157da0ac58833b46254e7dc368ddb7e0bbeee604ebdad1a006c6362660acf692e6d6d4c3d925b5aa8e3bdf99ca1f589c935dd6e6db56755491ee0daf3e292c2a05f549225d223a906af392d75c3f882351c32a1c12be2fd5123713dc47a7ebaf942675c003e96959bed820d85fc278286653821bda2dd5e6259bf3b5fec8ce2be15bd73ed764c15b3a5baea1b76678a707345a5e3dbec50fabbfd21c224516e00c68fd723bd78661ff2df43eb41944773d9ed00d487cb985bc591e756c2928b08d575e4ab9a7d6993696766bdd108a3c6edd9bf0a986918f6c383f6c1178a933eaebc8c725f8143c0f998e1a4f7066896e11ee0535b81e0fc4cfeb6ad5b764eed82f00d3808c1c6e998cc6c72f09e97074797843fa341457d47c6276e519ef0f528ba79bb044fa63c33d87be2e85524ef9483a1d61b1be19fbd7e671d323724f68f515bc253ecdcbe2cc1f83e5e60ecb83122fcf74788e6fdbf8382ebc82ad7352c3d57990313521e96039185066852c85f8cb65f30a2acde523eeb751af31d5536023547aa2d4476a311dcf15090ecd483f3b875eeb7fc427ab6ba8e9026ffb36eb1f4e12847f557ffba87a13f9f6b30b135adff203e68d08bb7913615cbc110fb672c850e05b349d6d4cb6b00572a30bde5ea5aaf388aeb3e679fd292085e99b633aad5849ff96e8401406cfc9fb97aafb68fdf0e74b1e492717befbf8b1a948cfdf45d6baff95288ee1b9ac34246c7948cc03e2773652ca4092de231e892ee0743d6c76b3d87375cd2cbe4c821d5be345c181780a6176f91bc80a449d1bd5774cfadf7e66cd9154c415ab772339ecbd651ef8e69a7440fa5bbbb8854ed5234924bf8853afbfb3be58bca10c7363696138c7c05361d23ce820879ac547f96b035abba48ba9b4b908c4bcb8d7aa4bc5322a47feabeff7663678e15cf9423314c3916199aa987ce9b7b983c7e87125c0be6108310c4159928c92d8ef22fea98bd981d45ec95c5ca4662993d8d5da85226591d14cf526c781cf90224a7f7f3053ffe31c36096c4fc30961873064a2c78c1ef6c2776b1d59ab55bb5c374ce6a90800a76ea4d576484a4b3e65ccd83f6fee4719dc28c28f3fbbef47034de3d4e4b1c3d89385aab9106de941ac6fefae5af80b7c65e6f2084344abb5393d37f6b50747ac0ce77a8c4670108736177aaa268ae6655230979c759260402fea63db12111cbe399e8403080dcdc023eac26ebe4a9dc168b9bc6807933020cfa1bafb82b6f509d478044ec5957970deb5201795f2b43d771c564ac2b090ef3690db4af9b4ba48e66c3c78bbda3256fbc743070db726f261d611390857e2f0e83f4a96e5778393db9862426343f3c6ab2856a72b2e83a5e7c868f32a42c854e1e58806b0d88389e64befca6e31b3ed6038538d4d78923a6b7b228830776e740a7132d39efe783d44d5fceb73d8a7fe356f304399b51c5b8761a8bc045106c451c72894517ea4b9e12c091ec3dd293bfeb4535577ef90227d3d793367c453633ed68f7498f55b4629bd30f29e2b84c0bb0907328d6003afaafdcec6aa90972846320f2c536e59c6ab29eb96329e2042f9db1e87478c5ae8c11b16ba55d34e5f9f46094c9d9fbeda2ede6d94db7d605cdf1b23d75766fbb68b4c8266c5beb1417a22523bec0d3faf1cf68324db1675a59aadb41536b71ad841cd06b1b8b535ed0e8115192b56dce57ab486d0edc6b09e91f5b3adff46b04b542ff9357e4b637a6071704f132e883e4a72711dac3206840cb88fd4cbe302ca87923be630a4a99449597a86a1100af4d415139e72e831f13cf3e258935c5f806e5116567d006b7fee576ed9ce7237f0b950be04616a7a999d26a2aeb7b7107606d752d09f926e4c857d3383a877d3ad5887aac9f67025db93a2795701b6eb1ebe95db8a9df4e6e1f808efb13a8e0771547f741610f5cefdf41f717f1b9b8835ee6db82a5221e62390dcaf03390a65ed6e6cd427273f14facf8ef56344a81b23c120e7b0d987329a991611d9de9e13089d06d8c9d6d546e759f4cd78c5d27392dfb493f9b63c57a590fe88c62653755377c5d00fbe857658d8d1efd363c818449f361d8d631de77f404bf03664f55084c4597dbecaf7bc422f80880542c76b005ba0bc34ce3c223c15e8028988852ce936c40bf6c063faa55c8c61883ec8026ccbe54e1bf554d819318689c7d016f03a18d1937a9971c616a845ff990851181eb92143e84729bf5b7f252c52863a40f7c2f5a1c0015380cf84d80a81fc3bb13e287a10da4165e52f4cc675175579f330f3ba804e6244f31c50284b896656e98fd3fc3b786817ba1fc51db3c3fec0546961f78c7c087b5ce4d7e33127f3c92ce22be7a03beb7aa252d05e038d59a0ee45e1f21286dc5d47eea4a1499f39e14ebe056bcc82596efd8d19692120e71e981ebbcb4ac597d77e5080af85d053803b376e8d8026e20ce5159fe11d8d7321a346230ccbf80bc479c69a6423479d5fabdbd046bf427d7c39366481bc7513827688f6dfc5984a44e2bceac9fd3941a25e6db63d76c4acf651092671a58cde1aad7d2151b63be1a6f36a0ee534890e81624469110611c6fceb2787189412c7919062912a3ff01b4daecb140ef9f7368904c789fddcd265abe7c928fe5fac91073086533b1982c2725722222e1f0874b5fa62810a10fe4ecec4e173bf021afc9e47a3df92019de3e2b0574667cb6a7a0e365b41b4c82b0f77c7e2610b67da9ec677856ad5b196ac105536f449b6054345beacdabc7cb07ac33e3ff69452832d4153a23e7a82dd78286cf2ac8be83dbc6f53878c74f69de77efa0f2c30b2bfdab86ea9a342b4a865f607b4a3954561358e4565670abca4803d5e13ddac3d02e6b16848e1a9109617c463932b32fa82488614563c8ad87cd4a2e972bb7390248cb6f5d533864c344a224f29db16450854f75e4db43edf1a58c92534b6ff1c987e5e05269ee7d0d109823e1aa7101ed7d93392ec034d5e0d2d3d8ac3b41798817d62723b8c94f39d356051445689869d749473fb6ba2570fd79b8c89a8acf6f01f64ef12341484a96f15e46d2672580b6c14bc00c5237b48c6a23e2f7d72ba52a4ba06f951e274c97e8f464cbb6c8c631650049f007aaff2fc9240a2fd69610b7f3776b1675b0bdef46edf8f68421db9da17d0279f7af2eaf43347310f5f4fe7fd10d9b57f18f0fe194462d2f25e58a589079a9991437e9f230848d713a7229f0124d3265779919902c72c03b4264b77e434706eb4ae2c6a0415527dfc4c53e1a0e1a5cf218750705353f26a214143e3a5c8ee6363b4ad2e412f37ef0bf8a3b82af83e815a7f37eadfd290c098d947baf82a3ad66d5d294e4d42b8a39c6486315950bc89cbc8e6a9510ffa758cb150d924dcd029780359a093866a78b5fc1665b72211944d22de39b5ca059b6fdc35057181a959243b264ba65a3c6c85bb84209cfc764d2b04149696746e533e766af1dba9828ff62db4da7566596e4a1b181e6a46d658db19fd726453b462d11c72d5c0799af7bb775a5aadb94f524f6b5d195721bab0b9a017d6cda58b8d99dacacaf5346b1a694744ff76e027c4de5939f76c008c056f43da2ab0793f3c21c9ac66e5bfd0aee3d32a0c5c4107229706aa79b837d7aee8378ba4927107fe09e5890f50f4693243172437ee4e621f9bd4001e9b137291a6175c132448e3db84515ad9466f5da58c1624b7283ee66d6cd5db2d6c60731c807df34112b1d6e3d596e6cfb86da6f813a444ba4b3b81b6e81dd6dd9019b203b0c537a3c2e3b0458ffa056a5c1670c5d22c3d3702dafebc9a8c75b46477a74741f50c2fcde575e47da4935e532ee9799b8a1241d42137226ad7f8e8534ee40f24eacaea3ac6aab0f8d1b88db2de4242fa3228d40ef0dd5c0fc70c9139b08cce0c3f21ca6f912676c5a877c92d14227fd334e9dd780cd50800542d6e85fb2dbdfcde11c38fbc2ce2306bbd4f48709f8c801f35d7bcf01b3ca682d52c9e5b713809eeb21e7a3bd17065b4bf8491895f7728da227fd8daa3175e58cc871f2aaae84b33163d7c5121557df379892536ad04d524b7801b6c20f783a7f05cfd1a96b41f1daf267f54419a94b84dc062dcce27caace8f856652fd230287787b05e3dc8806314980e3ea5a3f72b007ba57e7d15b85df479d2fad3bb3e32b230639b97ca450a171c09929b9796e1466dde9e4e14a46a435a728688114804d6ecaf0fb7b54281346350cf96c4d4bbb01cc423775d127d8a5e71a43f60ac0e3670b0c4728f65d86bdd9f148b4c3945cc7e12e30ab009338bc825acfeac324ac813c6a4624d84e8cb7f51e65f147f6b450918078b24eab1b88729e82b77fd498928961ec97aa67d91992a7153ec59185796a538522caf63495fd8ca8e20dcc3cd17a64b3918183fb1ef2463683df22923c2bb8b4413308f338c1ea315ffafb6ebe689b23b1c47b04e67f95aa941c0300dd51ccec8798849290c688777d8a13e3105f73a8ab65f55517b695e6438b7ba37c87b1a9080e0a59b03e6715d4077f7499b8f1810232d157018c2b6d6570d980cf9a0c14024e16ac1405aef00076c710fb2ce51bace9298ab560c486a5ea72ed38e5a5608cb59873c809ed2857ee1aa984136762727234a204d4221eace5ab2799386218a45bca20f6db89ed026d8aff930f5b92a4ba5166258ad9a907c51c5a91c42af1efdd896299fa18909caeb7753", 0x1000}, {&(0x7f0000000400)="17b00eb59cf34ed4982449b6d63b06d861c3acce51a08a07ce62b465a9914631065f6cd12db9f1fe4153c8538cfb2bc9cb0d4c011d29fcfa6b69911f98a8bde94841f24252c2494b85466a6d063356283fbb3b7c870b5815974fc4965cab318d06d2683a68a44739f7dd8c60c3c28f56b1b29181d529550c75c391844157f32603dbb4f6e3175407c6db34f0816fd13c1ce647e5958c85e2ad59fefdf5091436756042919140949b8a95bfba31728e9d79857a7a9002bb3b1b9a871fb584ed981e892e6d1f4abe44757caae1263ebfb38cdf8417c4f34715dd28010de2dd2e1eebcf4fd4be1900533566081f1dd8cf43cecfb5e970d5de36acd88027", 0xfc}, {&(0x7f0000000500)="fa64607f0cfa796f374edd859c9417bdce5a2a2d99140d988d3445327f2787ff7968c69c18abf0b4165408a7", 0x2c}, {&(0x7f0000000540)="7450e20f92f7995365efab739e9167529f8d1650f517816e105c0eead4d728b0b0490d33f2abc97cab74c3838ff4959c521fa3e538cd16b27dab02f0671b2c02e383b9b536b299406ed65ad4a05a786a0ec96fc9f24271fa8cbe4a67ecb446fde3373a336ae88302ba6a0776921fd60a220d596396964d8fe72f246e890cd311d7dcb0fea96c9df9c70b732bd4f1bf29ac1954d9dbcbf5fa611f74d355bfe8319e7d19fe2ec97006bb1c84ec74f47db557d0d6baf4f53086a91d6d", 0xbb}, {&(0x7f0000001d40)="07829e6f43cc3a11141809015a", 0xd}, {&(0x7f0000001d80)="d1eb2a8a116068613f7d1d4994540753b60daf35c6bde7bc", 0x18}, {&(0x7f0000001dc0)="f5b52f881eddca8ee4f67e744ee6562e825b8ff7ac13aea889be2469ac86648f843d2cb7a1b2d9759f9c8825f54f46edf66cfc3947adaa02bd8befe61fb722f81926f962277180adc7f91ce9", 0x4c}], 0x7, r3) r4 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_inet_SIOCSARP(r4, 0x8955, &(0x7f0000000600)={{0x2, 0x0, @local}, {0x0, @local}, 0x8, {0x2, 0x0, @rand_addr}, "0000000500000000723000"}) ioctl$sock_inet_SIOCSARP(r4, 0x8953, &(0x7f0000000180)={{0x2, 0x0, @local}, {0x0, @link_local}, 0x8, {0x2, 0x0, @remote}}) request_key(&(0x7f0000001f40)='.dead\x00', &(0x7f0000001f80)={'syz', 0x1}, &(0x7f0000001fc0)='ppp1\x00', r2) ioctl$sock_bt_bnep_BNEPGETSUPPFEAT(r0, 0x800442d4, &(0x7f0000000300)=0x3) ioctl$sock_SIOCBRDELBR(r4, 0x89a1, &(0x7f0000000000)='syzkaller0\x00') r5 = syz_open_dev$dspn(&(0x7f0000000040)='/dev/dsp#\x00', 0x4, 0x2000) ioctl$RTC_EPOCH_READ(r5, 0x8008700d, &(0x7f0000000080)) write$binfmt_elf64(r0, &(0x7f0000000680)={{0x7f, 0x45, 0x4c, 0x46, 0x6, 0x5, 0xffffffffffff8410, 0x1ff, 0x40, 0x3, 0x3, 0x100, 0xfc, 0x40, 0x1d9, 0x2, 0x1, 0x38, 0x1, 0x3f, 0x0, 0x7fff}, [{0x6474e555, 0x6c, 0x7fffffff, 0x7fffffff, 0x1, 0xae, 0x1, 0x7}, {0x0, 0x1cf6, 0x40, 0xf11a, 0x9, 0x3c, 0x3, 0x5}], "75229ddf3dc274869ace6cff0d1f0707d4f71a922376548afe10372ec0f58c702be2b267b0f3c633d2a5a265c2d92aa2d9eb86058e1aa4907fadc28f1dbe648b085dd53d341c5badbc9333619dfac6eb8cd085b881b6fc1a7f9534a1a7eb642fc6fed4f359ce4a3ea463e2aef9d33e04a4c917803cb8395158f13f0050b3eb92ec97d23a4c435a8d9df91bcd3e53d67dda28aa5529d1b33af8ab7785fc5a61e6c0de4cfc801ba679f63879f9b6441d5d3dcb07aa354be7bcc171df34c562025cff156b8bc4ff333344fca0aa188b66547627c72b5216f74b671532001d2c2fae8f32e9047d775a1e096cab07", [[], [], [], [], []]}, 0x69c) symlink(&(0x7f0000000200)='./file0\x00', &(0x7f0000000240)='./file0\x00') 04:45:59 executing program 3: r0 = syz_open_dev$sg(&(0x7f00000000c0)='/dev/sg#\x00', 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000000)={0x53, 0x0, 0x6, 0x0, @buffer={0x1d5, 0xb8, &(0x7f00000001c0)=""/184}, &(0x7f0000000540)="ad40657ed56c", &(0x7f0000000340)=""/128, 0x0, 0x0, 0x0, &(0x7f0000000040)}) 04:45:59 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, &(0x7f0000012fc7)}) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, &(0x7f0000000f4d)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000100)={0x4, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0c63000032134ebcbfdbdc47083e960e"], 0xfffffffffffffc2b, 0x0, &(0x7f0000000680)}) 04:45:59 executing program 5: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000480)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_GUEST_DEBUG(r3, 0x4048ae9b, &(0x7f0000000140)={0x1}) syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000100)=[@text32={0x20, &(0x7f0000000000)="6601669b0f35c4e1fe16846ba49e0000b9940200000f32c4c23dad78e0b9670900000f32660f38827f95b0040f01d10fc71a", 0x32}], 0x1, 0x0, &(0x7f0000000040), 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r3, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000400)=[@text32={0x20, &(0x7f0000000880)="b805000000b98b9400000f01c19a01000000b0000f43d1b8000000000f23d80f21f835800000900f23f80f060f2140b9800000c00f3235000800000f3066ba4300b8f1ffffffefb9800000c00f3235002000000f30c4c3295f4da400", 0x5c}], 0x26433e1, 0x0, &(0x7f0000000300), 0x10000000000000b6) ioctl$KVM_RUN(r3, 0xae3a, 0x0) [ 613.500799] binder: 22320:22336 unknown command 13 [ 613.505798] binder: 22320:22336 ioctl c0306201 20012000 returned -22 [ 613.519677] binder: 22320:22375 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 04:45:59 executing program 1: r0 = perf_event_open(&(0x7f000025c000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000001}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = dup3(r0, r0, 0x80000) ioctl$KVM_GET_NESTED_STATE(r1, 0xc080aebe, &(0x7f0000000100)={0x0, 0x0, 0x2080}) r2 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x11, r2, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r0, 0x2405, r2) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x1000004, 0x8031, 0xffffffffffffffff, 0x0) r3 = creat(&(0x7f00000000c0)='./file0\x00', 0x28) ioctl$RTC_PIE_OFF(r3, 0x7006) getsockopt$inet_sctp6_SCTP_NODELAY(0xffffffffffffffff, 0x84, 0x3, &(0x7f0000000080), &(0x7f0000000040)=0xffffffffffffff68) 04:45:59 executing program 3: r0 = syz_open_dev$sg(&(0x7f00000000c0)='/dev/sg#\x00', 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000000)={0x53, 0x0, 0x6, 0x0, @buffer={0x177, 0xb8, &(0x7f00000001c0)=""/184}, &(0x7f0000000540)="ad40657ed56c", &(0x7f0000000340)=""/128, 0x0, 0x0, 0x0, &(0x7f0000000040)}) 04:45:59 executing program 4: ioctl$KVM_IRQ_LINE(0xffffffffffffffff, 0x4008ae61, &(0x7f0000000500)) r0 = syz_open_dev$dspn(&(0x7f00000004c0)='/dev/dsp#\x00', 0x1, 0x0) openat$audio(0xffffffffffffff9c, &(0x7f0000000000)='/dev/audio\x00', 0x80, 0x0) ioctl$KVM_SET_FPU(0xffffffffffffffff, 0x41a0ae8d, &(0x7f0000000100)={[], 0x0, 0x5531fee, 0x0, 0x0, 0x9, 0xf000, 0x0, [], 0x5}) syz_open_dev$usb(&(0x7f0000000440)='/dev/bus/usb/00#/00#\x00', 0x9, 0x2) r1 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) lstat(&(0x7f0000000040)='./file0/file0\x00', &(0x7f0000000080)) ioctl$EXT4_IOC_MIGRATE(0xffffffffffffffff, 0x6609) sendmmsg$unix(0xffffffffffffffff, &(0x7f000000a000)=[{&(0x7f000000a000)=@abs, 0x6e, &(0x7f000000d000), 0x0, &(0x7f0000000600)=ANY=[]}], 0x1, 0x0) r2 = socket$inet6(0xa, 0x2, 0x0) gettid() r3 = getpgid(0x0) kcmp(0x0, r3, 0x0, 0xffffffffffffffff, 0xffffffffffffffff) connect$inet6(r2, &(0x7f0000002740)={0xa, 0x0, 0x0, @mcast2, 0x4}, 0x1c) sendmmsg(r2, &(0x7f0000007e00), 0x136a88c8311572c, 0xeffdffff00000000) setsockopt$inet6_udp_int(r2, 0x11, 0x0, &(0x7f0000000400), 0x4) openat$kvm(0xffffffffffffff9c, &(0x7f00000003c0)='/dev/kvm\x00', 0x0, 0x0) ioctl$VHOST_SET_VRING_CALL(0xffffffffffffff9c, 0x4008af21, &(0x7f00000002c0)={0x0, r1}) ioctl$SNDRV_TIMER_IOCTL_TREAD(r0, 0x40045402, &(0x7f0000000740)) inotify_rm_watch(0xffffffffffffffff, 0x0) ioctl$ifreq_SIOCGIFINDEX_team(0xffffffffffffffff, 0x8933, &(0x7f0000000480)={'team0\x00'}) 04:45:59 executing program 0: io_setup(0x100, &(0x7f0000000000)=0x0) r1 = syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x0) r2 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000080)='/dev/dsp\x00', 0x10000, 0x0) r3 = ioctl$KVM_CREATE_VCPU(0xffffffffffffff9c, 0xae41, 0x2) r4 = openat$qat_adf_ctl(0xffffffffffffff9c, &(0x7f0000000100)='/dev/qat_adf_ctl\x00', 0x4000, 0x0) io_submit(r0, 0x2, &(0x7f00000002c0)=[&(0x7f00000000c0)={0x0, 0x0, 0x0, 0x8, 0x2, r1, &(0x7f0000000040)="82f7b9ddf5634ef173b61d9f8a82", 0xe, 0x6, 0x0, 0x2, r2}, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x8, 0x8, r3, &(0x7f0000000200)="cdbef42b07064bddc1715f11ae5d9d7d1bc47b9538422d6c0bab5c9dda8942cc94590ef827c586b7c4ea454bd479811c446f527196ca2e7d99cfec24eca0daa5661e0afbe099275946f6ac95f73f2e4e07f127b5fd9c36a58689cb8c61ee2f14dc7a80685f7b22b70e53b5373acd22c316f9751d20b7d17beb23c8b38e7ff6304a2accd44c7e7cca02e3fcb3af340d4ef4606bd73f3a564011c33f667834a44dd6460163f6", 0xa5, 0x0, 0x0, 0x0, r4}]) r5 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_inet_SIOCSARP(r5, 0x8955, &(0x7f0000000600)={{0x2, 0x0, @local}, {0x0, @local}, 0x8, {0x2, 0x0, @rand_addr}, "0000000500000000723000"}) ioctl$sock_inet_SIOCSARP(r5, 0x8953, &(0x7f0000000180)={{0x2, 0x0, @local}, {0x0, @link_local}, 0x8, {0x2, 0x0, @remote}}) 04:45:59 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, &(0x7f0000012fc7)}) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, &(0x7f0000000f4d)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000100)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0xfffffffffffffc2b, 0x0, &(0x7f0000000680)}) r2 = syz_open_dev$mouse(&(0x7f0000000000)='/dev/input/mouse#\x00', 0x8000, 0x0) ioctl$VHOST_SET_VRING_ADDR(r2, 0x4028af11, &(0x7f00000000c0)={0x3, 0x0, &(0x7f0000000140)=""/160, &(0x7f0000000200)=""/97, &(0x7f0000000040)=""/43, 0x100002}) 04:45:59 executing program 5: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000480)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_GUEST_DEBUG(r3, 0x4048ae9b, &(0x7f0000000140)={0x1}) syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000100)=[@text32={0x20, &(0x7f0000000000)="6601669b0f35c4e1fe16846ba49e0000b9940200000f32c4c23dad78e0b9670900000f32660f38827f95b0040f01d10fc71a", 0x32}], 0x1, 0x0, &(0x7f0000000040), 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r3, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000400)=[@text32={0x20, &(0x7f0000000880)="b805000000b98b9400000f01c19a01000000b0000f43d1b8000000000f23d80f21f835800000900f23f80f060f2140b9800000c00f3235000800000f3066ba4300b8f1ffffffefb9800000c00f3235002000000f30c4c3295f4da400", 0x5c}], 0x26433e1, 0x0, &(0x7f0000000300), 0x10000000000000b6) ioctl$KVM_RUN(r3, 0xae9e, 0x0) 04:45:59 executing program 3: r0 = syz_open_dev$sg(&(0x7f00000000c0)='/dev/sg#\x00', 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000000)={0x53, 0x0, 0x6, 0x0, @buffer={0x15a, 0xb8, &(0x7f00000001c0)=""/184}, &(0x7f0000000540)="ad40657ed56c", &(0x7f0000000340)=""/128, 0x0, 0x0, 0x0, &(0x7f0000000040)}) 04:45:59 executing program 2: r0 = syz_open_dev$usb(&(0x7f0000000000)='/dev/bus/usb/00#/00#\x00', 0x5, 0x80000) ioctl$sock_bt_bnep_BNEPGETSUPPFEAT(r0, 0x800442d4, &(0x7f0000000040)=0x3) r1 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, &(0x7f0000012fc7)}) close(r1) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, &(0x7f0000000f4d)}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000100)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0xfffffffffffffc2b, 0x0, &(0x7f0000000680)}) 04:46:00 executing program 0: r0 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_inet_SIOCSARP(r0, 0x8955, &(0x7f0000000600)={{0x2, 0x0, @local}, {0x0, @local}, 0x8, {0x2, 0x0, @rand_addr}, "0000000500000000723000"}) r1 = getpgrp(0xffffffffffffffff) r2 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000000)='/dev/sequencer\x00', 0x0, 0x0) write$FUSE_GETXATTR(r2, &(0x7f0000000040)={0x18, 0x4, 0x3, {0x40}}, 0xffffff74) setpriority(0x3, r1, 0x7) 04:46:00 executing program 3: r0 = syz_open_dev$sg(&(0x7f00000000c0)='/dev/sg#\x00', 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000000)={0x53, 0x0, 0x6, 0x0, @buffer={0xb, 0xb8, &(0x7f00000001c0)=""/184}, &(0x7f0000000540)="ad40657ed56c", &(0x7f0000000340)=""/128, 0x0, 0x0, 0x0, &(0x7f0000000040)}) 04:46:00 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, &(0x7f0000012fc7)}) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, &(0x7f0000000f4d)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000000), 0x0, 0x0, &(0x7f0000000680)}) 04:46:00 executing program 5: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000480)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_GUEST_DEBUG(r3, 0x4048ae9b, &(0x7f0000000140)={0x1}) syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000100)=[@text32={0x20, &(0x7f0000000000)="6601669b0f35c4e1fe16846ba49e0000b9940200000f32c4c23dad78e0b9670900000f32660f38827f95b0040f01d10fc71a", 0x32}], 0x1, 0x0, &(0x7f0000000040), 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r3, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000400)=[@text32={0x20, &(0x7f0000000880)="b805000000b98b9400000f01c19a01000000b0000f43d1b8000000000f23d80f21f835800000900f23f80f060f2140b9800000c00f3235000800000f3066ba4300b8f1ffffffefb9800000c00f3235002000000f30c4c3295f4da400", 0x5c}], 0x26433e1, 0x0, &(0x7f0000000300), 0x10000000000000b6) ioctl$KVM_RUN(r3, 0xae2c, 0x0) 04:46:00 executing program 1: r0 = perf_event_open(&(0x7f000025c000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000001}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = dup3(r0, r0, 0x80000) ioctl$KVM_GET_NESTED_STATE(r1, 0xc080aebe, &(0x7f0000000100)={0x0, 0x0, 0x2080}) r2 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x11, r2, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r0, 0x2405, r2) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x1000004, 0x8031, 0xffffffffffffffff, 0x0) r3 = creat(&(0x7f00000000c0)='./file0\x00', 0x28) ioctl$RTC_PIE_OFF(r3, 0x7006) getsockopt$inet_sctp6_SCTP_NODELAY(0xffffffffffffffff, 0x84, 0x3, &(0x7f0000000080), &(0x7f0000000040)=0xffffffffffffff68) 04:46:00 executing program 3: r0 = syz_open_dev$sg(&(0x7f00000000c0)='/dev/sg#\x00', 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000000)={0x53, 0x0, 0x6, 0x0, @buffer={0x3c, 0xb8, &(0x7f00000001c0)=""/184}, &(0x7f0000000540)="ad40657ed56c", &(0x7f0000000340)=""/128, 0x0, 0x0, 0x0, &(0x7f0000000040)}) 04:46:00 executing program 0: r0 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_inet_SIOCSARP(r0, 0x8955, &(0x7f0000000600)={{0x2, 0x0, @local}, {0x0, @local}, 0x8, {0x2, 0x0, @rand_addr}, "0000000500000000723000"}) ioctl$sock_inet_SIOCSARP(r0, 0x8953, &(0x7f0000000180)={{0x2, 0x0, @local}, {0x1, @link_local}, 0x8, {0x2, 0x0, @remote}, 'veth1_to_bridge\x00'}) r1 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000000)='/dev/sequencer\x00', 0x80001, 0x0) ioctl$UI_END_FF_ERASE(r1, 0x400c55cb, &(0x7f0000000100)={0x9, 0x9, 0x55}) pread64(r0, &(0x7f0000000040)=""/67, 0x43, 0x7) 04:46:00 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, &(0x7f0000012fc7)}) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, &(0x7f0000000f4d)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000040)={0x8, 0x0, &(0x7f0000000000)=[@release={0x40046306, 0x1}], 0x1d8, 0x0, &(0x7f0000000140)="fb4d2e63bc805c47ac27228fee53e4bc2e53314d9db22a9afa6ef6a0492222d818c6d1bacec1d0eaa5dae3f7316edb0f656b4758f5ee325200de29135a80bd6255904f589b5d361b7aabc14282cfd8f65cb1b3c2950150de9552671c43f7bfd54213ba1aa3142442bde86a679a5642d43f72d1d06101b1aec2904ea5ca42592d43da008b5f1357300e3ecabfc963fb"}) 04:46:00 executing program 4: ioctl$KVM_IRQ_LINE(0xffffffffffffffff, 0x4008ae61, &(0x7f0000000500)) r0 = syz_open_dev$dspn(&(0x7f00000004c0)='/dev/dsp#\x00', 0x1, 0x0) openat$audio(0xffffffffffffff9c, &(0x7f0000000000)='/dev/audio\x00', 0x80, 0x0) ioctl$KVM_SET_FPU(0xffffffffffffffff, 0x41a0ae8d, &(0x7f0000000100)={[], 0x0, 0x5531fee, 0x0, 0x0, 0x9, 0xf000, 0x0, [], 0x5}) syz_open_dev$usb(&(0x7f0000000440)='/dev/bus/usb/00#/00#\x00', 0x9, 0x2) r1 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) lstat(&(0x7f0000000040)='./file0/file0\x00', &(0x7f0000000080)) ioctl$EXT4_IOC_MIGRATE(0xffffffffffffffff, 0x6609) sendmmsg$unix(0xffffffffffffffff, &(0x7f000000a000)=[{&(0x7f000000a000)=@abs, 0x6e, &(0x7f000000d000), 0x0, &(0x7f0000000600)=ANY=[]}], 0x1, 0x0) r2 = socket$inet6(0xa, 0x2, 0x0) gettid() r3 = getpgid(0x0) kcmp(0x0, r3, 0x0, 0xffffffffffffffff, 0xffffffffffffffff) connect$inet6(r2, &(0x7f0000002740)={0xa, 0x0, 0x0, @mcast2, 0x4}, 0x1c) sendmmsg(r2, &(0x7f0000007e00), 0x136a88c8311572c, 0xff03000000000000) setsockopt$inet6_udp_int(r2, 0x11, 0x0, &(0x7f0000000400), 0x4) openat$kvm(0xffffffffffffff9c, &(0x7f00000003c0)='/dev/kvm\x00', 0x0, 0x0) ioctl$VHOST_SET_VRING_CALL(0xffffffffffffff9c, 0x4008af21, &(0x7f00000002c0)={0x0, r1}) ioctl$SNDRV_TIMER_IOCTL_TREAD(r0, 0x40045402, &(0x7f0000000740)) inotify_rm_watch(0xffffffffffffffff, 0x0) ioctl$ifreq_SIOCGIFINDEX_team(0xffffffffffffffff, 0x8933, &(0x7f0000000480)={'team0\x00'}) 04:46:00 executing program 5: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000480)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_GUEST_DEBUG(r3, 0x4048ae9b, &(0x7f0000000140)={0x1}) syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000100)=[@text32={0x20, &(0x7f0000000000)="6601669b0f35c4e1fe16846ba49e0000b9940200000f32c4c23dad78e0b9670900000f32660f38827f95b0040f01d10fc71a", 0x32}], 0x1, 0x0, &(0x7f0000000040), 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r3, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000400)=[@text32={0x20, &(0x7f0000000880)="b805000000b98b9400000f01c19a01000000b0000f43d1b8000000000f23d80f21f835800000900f23f80f060f2140b9800000c00f3235000800000f3066ba4300b8f1ffffffefb9800000c00f3235002000000f30c4c3295f4da400", 0x5c}], 0x26433e1, 0x0, &(0x7f0000000300), 0x10000000000000b6) ioctl$KVM_RUN(r3, 0x2, 0x0) [ 614.493266] binder: 22434:22436 Release 1 refcount change on invalid ref 1 ret -22 04:46:00 executing program 0: r0 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_inet_SIOCSARP(r0, 0x8955, &(0x7f0000000600)={{0x2, 0x0, @local}, {0x0, @local}, 0x8, {0x2, 0x0, @rand_addr}, "0000000500000000723000"}) r1 = syz_open_dev$vcsn(&(0x7f0000000000)='/dev/vcs#\x00', 0x3b9, 0x4040) ioctl$RTC_ALM_READ(r1, 0x80247008, &(0x7f0000000040)) ioctl$sock_inet_SIOCSARP(r0, 0x8953, &(0x7f0000000180)={{0x2, 0x0, @local}, {0x0, @link_local}, 0x8, {0x2, 0x0, @remote}}) 04:46:00 executing program 3: r0 = syz_open_dev$sg(&(0x7f00000000c0)='/dev/sg#\x00', 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000000)={0x53, 0x0, 0x6, 0x0, @buffer={0xe7, 0xb8, &(0x7f00000001c0)=""/184}, &(0x7f0000000540)="ad40657ed56c", &(0x7f0000000340)=""/128, 0x0, 0x0, 0x0, &(0x7f0000000040)}) 04:46:00 executing program 5: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000480)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_GUEST_DEBUG(r3, 0x4048ae9b, &(0x7f0000000140)={0x1}) syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000100)=[@text32={0x20, &(0x7f0000000000)="6601669b0f35c4e1fe16846ba49e0000b9940200000f32c4c23dad78e0b9670900000f32660f38827f95b0040f01d10fc71a", 0x32}], 0x1, 0x0, &(0x7f0000000040), 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r3, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000400)=[@text32={0x20, &(0x7f0000000880)="b805000000b98b9400000f01c19a01000000b0000f43d1b8000000000f23d80f21f835800000900f23f80f060f2140b9800000c00f3235000800000f3066ba4300b8f1ffffffefb9800000c00f3235002000000f30c4c3295f4da400", 0x5c}], 0x26433e1, 0x0, &(0x7f0000000300), 0x10000000000000b6) ioctl$KVM_RUN(r3, 0x41a0ae8d, 0x0) 04:46:00 executing program 3: r0 = syz_open_dev$sg(&(0x7f00000000c0)='/dev/sg#\x00', 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000000)={0x53, 0x0, 0x6, 0x0, @buffer={0x1fa, 0xb8, &(0x7f00000001c0)=""/184}, &(0x7f0000000540)="ad40657ed56c", &(0x7f0000000340)=""/128, 0x0, 0x0, 0x0, &(0x7f0000000040)}) 04:46:00 executing program 0: r0 = socket$inet_tcp(0x2, 0x1, 0x0) r1 = openat$vhci(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vhci\x00', 0x8400, 0x0) getsockopt$inet_sctp_SCTP_PR_STREAM_STATUS(r1, 0x84, 0x74, &(0x7f0000000040)=""/231, &(0x7f0000000140)=0xe7) ioctl$sock_inet_SIOCSARP(r0, 0x8953, &(0x7f0000000180)={{0x2, 0x0, @local}, {0x0, @link_local}, 0x8, {0x2, 0x0, @remote}}) 04:46:01 executing program 3: r0 = syz_open_dev$sg(&(0x7f00000000c0)='/dev/sg#\x00', 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000000)={0x53, 0x0, 0x6, 0x0, @buffer={0x49, 0xb8, &(0x7f00000001c0)=""/184}, &(0x7f0000000540)="ad40657ed56c", &(0x7f0000000340)=""/128, 0x0, 0x0, 0x0, &(0x7f0000000040)}) 04:46:01 executing program 1: r0 = perf_event_open(&(0x7f000025c000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000001}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = dup3(r0, r0, 0x80000) ioctl$KVM_GET_NESTED_STATE(r1, 0xc080aebe, &(0x7f0000000100)={0x0, 0x0, 0x2080}) r2 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x11, r2, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r0, 0x2405, r2) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x1000004, 0x8031, 0xffffffffffffffff, 0x0) r3 = creat(&(0x7f00000000c0)='./file0\x00', 0x28) ioctl$RTC_PIE_OFF(r3, 0x7006) getsockopt$inet_sctp6_SCTP_NODELAY(0xffffffffffffffff, 0x84, 0x3, &(0x7f0000000080), &(0x7f0000000040)=0xffffffffffffff68) 04:46:01 executing program 0: r0 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_inet_SIOCSARP(r0, 0x8955, &(0x7f0000000600)={{0x2, 0x0, @local}, {0x0, @local}, 0x8, {0x2, 0x0, @rand_addr}, "0000000500000000723000"}) ioctl$sock_inet_SIOCSARP(r0, 0x8953, &(0x7f0000000180)={{0x2, 0x0, @local}, {0x0, @link_local}, 0x8, {0x2, 0x0, @remote}}) ioctl$sock_kcm_SIOCKCMCLONE(0xffffffffffffff9c, 0x89e2, &(0x7f0000000080)={r0}) getsockopt$inet_sctp_SCTP_DEFAULT_SEND_PARAM(0xffffffffffffffff, 0x84, 0xa, &(0x7f00000000c0)={0x5, 0xebd, 0x4, 0x3, 0x2, 0x0, 0x800000000000, 0x101, 0x0}, &(0x7f0000000100)=0x20) getsockopt$inet_sctp6_SCTP_GET_LOCAL_ADDRS(r1, 0x84, 0x6d, &(0x7f0000000200)={r2, 0x62, "1f2cc2cde87e49481cba7fd017accc205c2e6193187e9f1dce5f500ccdd357a68e6f882d291140e9d6c01b9fb7c9bfd6645db35b01e1dc2a13e1fa0bf2757bce913a87dfcf6c308731b110b6349ce43e96d40c49b13bdee8d2c635f185b3c9be8c9e"}, &(0x7f0000000140)=0x6a) getpeername$netlink(r0, &(0x7f0000000000), &(0x7f00000002c0)=0xc) 04:46:01 executing program 3: r0 = syz_open_dev$sg(&(0x7f00000000c0)='/dev/sg#\x00', 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000000)={0x53, 0x0, 0x6, 0x0, @buffer={0xa6, 0xb8, &(0x7f00000001c0)=""/184}, &(0x7f0000000540)="ad40657ed56c", &(0x7f0000000340)=""/128, 0x0, 0x0, 0x0, &(0x7f0000000040)}) [ 615.280731] binder: 22434:22486 Release 1 refcount change on invalid ref 1 ret -22 04:46:01 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, &(0x7f0000012fc7)}) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, &(0x7f0000000f4d)}) r2 = openat$autofs(0xffffffffffffff9c, &(0x7f0000000000)='/dev/autofs\x00', 0x0, 0x0) ioctl$ASHMEM_SET_PROT_MASK(r2, 0x40087705, &(0x7f0000000040)={0x1, 0x3b69}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000100)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0xfffffffffffffc2b, 0x0, &(0x7f0000000680)}) 04:46:01 executing program 5: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000480)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_GUEST_DEBUG(r3, 0x4048ae9b, &(0x7f0000000140)={0x1}) syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000100)=[@text32={0x20, &(0x7f0000000000)="6601669b0f35c4e1fe16846ba49e0000b9940200000f32c4c23dad78e0b9670900000f32660f38827f95b0040f01d10fc71a", 0x32}], 0x1, 0x0, &(0x7f0000000040), 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r3, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000400)=[@text32={0x20, &(0x7f0000000880)="b805000000b98b9400000f01c19a01000000b0000f43d1b8000000000f23d80f21f835800000900f23f80f060f2140b9800000c00f3235000800000f3066ba4300b8f1ffffffefb9800000c00f3235002000000f30c4c3295f4da400", 0x5c}], 0x26433e1, 0x0, &(0x7f0000000300), 0x10000000000000b6) ioctl$KVM_RUN(r3, 0xaecd, 0x0) 04:46:01 executing program 3: r0 = syz_open_dev$sg(&(0x7f00000000c0)='/dev/sg#\x00', 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000000)={0x53, 0x0, 0x6, 0x0, @buffer={0x103, 0xb8, &(0x7f00000001c0)=""/184}, &(0x7f0000000540)="ad40657ed56c", &(0x7f0000000340)=""/128, 0x0, 0x0, 0x0, &(0x7f0000000040)}) 04:46:01 executing program 0: r0 = socket$inet_tcp(0x2, 0x1, 0x0) r1 = fcntl$getown(r0, 0x9) perf_event_open(&(0x7f0000000000)={0x5, 0x70, 0x39ea, 0x20, 0x7, 0xfff, 0x0, 0x20000000000, 0x2240, 0x9, 0x4, 0x3, 0x401, 0x1, 0x400, 0x1, 0x1, 0x1, 0x631d, 0x3, 0x10000, 0x5, 0x9, 0x9, 0x5ca, 0x3, 0xffffffffffffffff, 0x4, 0x8, 0x8, 0x7fff, 0x3, 0x2, 0x2ad5, 0xcc, 0x400, 0x1, 0x1, 0x0, 0x1, 0x4, @perf_config_ext={0xfffffffffffff2bb, 0x14}, 0x30108, 0x7, 0x7, 0x0, 0x10001, 0x1ff, 0x6}, r1, 0xe, 0xffffffffffffff9c, 0x0) ioctl$sock_inet_SIOCSARP(r0, 0x8955, &(0x7f0000000600)={{0x2, 0x0, @local}, {0x0, @local}, 0x8, {0x2, 0x0, @rand_addr}, "0000000500000000723000"}) ioctl$sock_inet_SIOCSARP(r0, 0x8953, &(0x7f0000000180)={{0x2, 0x0, @local}, {0x0, @link_local}, 0x8, {0x2, 0x0, @remote}}) r2 = syz_open_dev$usb(&(0x7f0000000080)='/dev/bus/usb/00#/00#\x00', 0x3f, 0x40080) setsockopt$inet6_tcp_TCP_MD5SIG(r2, 0x6, 0xe, &(0x7f0000000200)={@in={{0x2, 0x4e22, @remote}}, 0x3, 0x9, 0x9, "a45105a569f93880cff20ce147545e919bc485680029603028b21445c7de41c11c432e9fe852b43c7ad7847b72af7f3528db36f83b1c7351aed480dfe64a5678a01f04a4e013d89539bea58076146eb8"}, 0xd8) 04:46:01 executing program 4: ioctl$KVM_IRQ_LINE(0xffffffffffffffff, 0x4008ae61, &(0x7f0000000500)) r0 = syz_open_dev$dspn(&(0x7f00000004c0)='/dev/dsp#\x00', 0x1, 0x0) openat$audio(0xffffffffffffff9c, &(0x7f0000000000)='/dev/audio\x00', 0x80, 0x0) ioctl$KVM_SET_FPU(0xffffffffffffffff, 0x41a0ae8d, &(0x7f0000000100)={[], 0x0, 0x5531fee, 0x0, 0x0, 0x9, 0xf000, 0x0, [], 0x5}) syz_open_dev$usb(&(0x7f0000000440)='/dev/bus/usb/00#/00#\x00', 0x9, 0x2) r1 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) lstat(&(0x7f0000000040)='./file0/file0\x00', &(0x7f0000000080)) ioctl$EXT4_IOC_MIGRATE(0xffffffffffffffff, 0x6609) sendmmsg$unix(0xffffffffffffffff, &(0x7f000000a000)=[{&(0x7f000000a000)=@abs, 0x6e, &(0x7f000000d000), 0x0, &(0x7f0000000600)=ANY=[]}], 0x1, 0x0) r2 = socket$inet6(0xa, 0x2, 0x0) gettid() r3 = getpgid(0x0) kcmp(0x0, r3, 0x0, 0xffffffffffffffff, 0xffffffffffffffff) connect$inet6(r2, &(0x7f0000002740)={0xa, 0x0, 0x0, @mcast2, 0x4}, 0x1c) sendmmsg(r2, &(0x7f0000007e00), 0x136a88c8311572c, 0x4000000) setsockopt$inet6_udp_int(r2, 0x11, 0x0, &(0x7f0000000400), 0x4) openat$kvm(0xffffffffffffff9c, &(0x7f00000003c0)='/dev/kvm\x00', 0x0, 0x0) ioctl$VHOST_SET_VRING_CALL(0xffffffffffffff9c, 0x4008af21, &(0x7f00000002c0)={0x0, r1}) ioctl$SNDRV_TIMER_IOCTL_TREAD(r0, 0x40045402, &(0x7f0000000740)) inotify_rm_watch(0xffffffffffffffff, 0x0) ioctl$ifreq_SIOCGIFINDEX_team(0xffffffffffffffff, 0x8933, &(0x7f0000000480)={'team0\x00'}) [ 615.435667] binder: 22499:22500 Acquire 1 refcount change on invalid ref 0 ret -22 04:46:01 executing program 3: r0 = syz_open_dev$sg(&(0x7f00000000c0)='/dev/sg#\x00', 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000000)={0x53, 0x0, 0x6, 0x0, @buffer={0x1e8, 0xb8, &(0x7f00000001c0)=""/184}, &(0x7f0000000540)="ad40657ed56c", &(0x7f0000000340)=""/128, 0x0, 0x0, 0x0, &(0x7f0000000040)}) [ 615.494816] binder: 22499:22500 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 04:46:01 executing program 0: r0 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_inet_SIOCSARP(r0, 0x8955, &(0x7f0000000600)={{0x2, 0x0, @local}, {0x0, @local}, 0x8, {0x2, 0x0, @rand_addr}, "0000000500000000723000"}) ioctl$sock_inet_SIOCSARP(r0, 0x8953, &(0x7f0000000180)={{0x2, 0x0, @local}, {0x0, @link_local}, 0x8, {0x2, 0x0, @remote}}) setsockopt$inet_buf(r0, 0x0, 0x2b, &(0x7f0000000000)="02988689991c6407466c8cf64ab6b53ee99da3616cbd79c52c9066fbf7c7a719ebadbbbd4c35d498d4de507bf5e505a40533d2245c88e7d6deaaf6471ace6414814a0672bd41231cbbf7228122e9bc941aacd97d6e963d71258d002d65e21f19a95d", 0x62) 04:46:01 executing program 3: r0 = syz_open_dev$sg(&(0x7f00000000c0)='/dev/sg#\x00', 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000000)={0x53, 0x0, 0x6, 0x0, @buffer={0x1fe, 0xb8, &(0x7f00000001c0)=""/184}, &(0x7f0000000540)="ad40657ed56c", &(0x7f0000000340)=""/128, 0x0, 0x0, 0x0, &(0x7f0000000040)}) 04:46:01 executing program 5: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000480)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_GUEST_DEBUG(r3, 0x4048ae9b, &(0x7f0000000140)={0x1}) syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000100)=[@text32={0x20, &(0x7f0000000000)="6601669b0f35c4e1fe16846ba49e0000b9940200000f32c4c23dad78e0b9670900000f32660f38827f95b0040f01d10fc71a", 0x32}], 0x1, 0x0, &(0x7f0000000040), 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r3, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000400)=[@text32={0x20, &(0x7f0000000880)="b805000000b98b9400000f01c19a01000000b0000f43d1b8000000000f23d80f21f835800000900f23f80f060f2140b9800000c00f3235000800000f3066ba4300b8f1ffffffefb9800000c00f3235002000000f30c4c3295f4da400", 0x5c}], 0x26433e1, 0x0, &(0x7f0000000300), 0x10000000000000b6) ioctl$KVM_RUN(r3, 0x40049409, 0x0) 04:46:02 executing program 3: r0 = syz_open_dev$sg(&(0x7f00000000c0)='/dev/sg#\x00', 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000000)={0x53, 0x0, 0x6, 0x0, @buffer={0x6b, 0xb8, &(0x7f00000001c0)=""/184}, &(0x7f0000000540)="ad40657ed56c", &(0x7f0000000340)=""/128, 0x0, 0x0, 0x0, &(0x7f0000000040)}) 04:46:02 executing program 0: ioctl$sock_inet_SIOCSARP(0xffffffffffffffff, 0x8955, &(0x7f0000000600)={{0x2, 0x0, @local}, {0x0, @local}, 0x8, {0x2, 0x0, @rand_addr}, "0000000500000000723000"}) set_robust_list(&(0x7f0000000200)={&(0x7f0000000340)={&(0x7f0000000380)}, 0x5ed, &(0x7f0000000280)={&(0x7f0000000080)}}, 0x18) r0 = syz_open_dev$audion(&(0x7f0000000000)='/dev/audio#\x00', 0x79f, 0x208100) ioctl$DRM_IOCTL_AGP_ALLOC(0xffffffffffffff9c, 0xc0206434, &(0x7f0000000040)={0x8, 0x0, 0x10001, 0x80}) ioctl$DRM_IOCTL_AGP_ALLOC(r0, 0xc0206434, &(0x7f00000000c0)={0x3, r1, 0x10001, 0x8000}) ioctl$sock_inet_SIOCSARP(0xffffffffffffffff, 0x8953, &(0x7f0000000180)={{0x2, 0x0, @local}, {0x0, @link_local}, 0x8, {0x2, 0x0, @remote}}) 04:46:02 executing program 1: r0 = perf_event_open(&(0x7f000025c000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000001}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = dup3(r0, r0, 0x80000) ioctl$KVM_GET_NESTED_STATE(r1, 0xc080aebe, &(0x7f0000000100)={0x0, 0x0, 0x2080}) r2 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x11, r2, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r0, 0x2405, r2) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x1000004, 0x8031, 0xffffffffffffffff, 0x0) r3 = creat(&(0x7f00000000c0)='./file0\x00', 0x28) ioctl$RTC_PIE_OFF(r3, 0x7006) 04:46:02 executing program 4: ioctl$KVM_IRQ_LINE(0xffffffffffffffff, 0x4008ae61, &(0x7f0000000500)) r0 = syz_open_dev$dspn(&(0x7f00000004c0)='/dev/dsp#\x00', 0x1, 0x0) openat$audio(0xffffffffffffff9c, &(0x7f0000000000)='/dev/audio\x00', 0x80, 0x0) ioctl$KVM_SET_FPU(0xffffffffffffffff, 0x41a0ae8d, &(0x7f0000000100)={[], 0x0, 0x5531fee, 0x0, 0x0, 0x9, 0xf000, 0x0, [], 0x5}) syz_open_dev$usb(&(0x7f0000000440)='/dev/bus/usb/00#/00#\x00', 0x9, 0x2) r1 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) lstat(&(0x7f0000000040)='./file0/file0\x00', &(0x7f0000000080)) ioctl$EXT4_IOC_MIGRATE(0xffffffffffffffff, 0x6609) sendmmsg$unix(0xffffffffffffffff, &(0x7f000000a000)=[{&(0x7f000000a000)=@abs, 0x6e, &(0x7f000000d000), 0x0, &(0x7f0000000600)=ANY=[]}], 0x1, 0x0) r2 = socket$inet6(0xa, 0x2, 0x0) gettid() r3 = getpgid(0x0) kcmp(0x0, r3, 0x0, 0xffffffffffffffff, 0xffffffffffffffff) connect$inet6(r2, &(0x7f0000002740)={0xa, 0x0, 0x0, @mcast2, 0x4}, 0x1c) sendmmsg(r2, &(0x7f0000007e00), 0x136a88c8311572c, 0x8000000) setsockopt$inet6_udp_int(r2, 0x11, 0x0, &(0x7f0000000400), 0x4) openat$kvm(0xffffffffffffff9c, &(0x7f00000003c0)='/dev/kvm\x00', 0x0, 0x0) ioctl$VHOST_SET_VRING_CALL(0xffffffffffffff9c, 0x4008af21, &(0x7f00000002c0)={0x0, r1}) ioctl$SNDRV_TIMER_IOCTL_TREAD(r0, 0x40045402, &(0x7f0000000740)) inotify_rm_watch(0xffffffffffffffff, 0x0) ioctl$ifreq_SIOCGIFINDEX_team(0xffffffffffffffff, 0x8933, &(0x7f0000000480)={'team0\x00'}) 04:46:02 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) syz_open_dev$evdev(&(0x7f00000000c0)='/dev/input/event#\x00', 0x6, 0x26f38d3220831f22) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000005fd4)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], 0x0, 0x0, &(0x7f0000012fc7)}) r2 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000000)='/dev/snapshot\x00', 0x40000, 0x0) r3 = openat$rfkill(0xffffffffffffff9c, &(0x7f0000000040)='/dev/rfkill\x00', 0xa8ad8c6160be5534, 0x0) ioctl$NBD_SET_SOCK(r2, 0xab00, r3) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, &(0x7f0000000f4d)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000100)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0xfffffffffffffc2b, 0x0, &(0x7f0000000680)}) 04:46:02 executing program 5: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000480)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_GUEST_DEBUG(r3, 0x4048ae9b, &(0x7f0000000140)={0x1}) syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000100)=[@text32={0x20, &(0x7f0000000000)="6601669b0f35c4e1fe16846ba49e0000b9940200000f32c4c23dad78e0b9670900000f32660f38827f95b0040f01d10fc71a", 0x32}], 0x1, 0x0, &(0x7f0000000040), 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r3, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000400)=[@text32={0x20, &(0x7f0000000880)="b805000000b98b9400000f01c19a01000000b0000f43d1b8000000000f23d80f21f835800000900f23f80f060f2140b9800000c00f3235000800000f3066ba4300b8f1ffffffefb9800000c00f3235002000000f30c4c3295f4da400", 0x5c}], 0x26433e1, 0x0, &(0x7f0000000300), 0x10000000000000b6) ioctl$KVM_RUN(r3, 0x4004ae8b, 0x0) 04:46:02 executing program 0: r0 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_inet_SIOCSARP(r0, 0x8955, &(0x7f0000000600)={{0x2, 0x0, @local}, {0x0, @local}, 0x8, {}, "0000000500000000723000"}) ioctl$sock_inet_SIOCSARP(r0, 0x8953, &(0x7f0000000180)={{0x2, 0x0, @local}, {0x0, @link_local}, 0x8, {0x2, 0x0, @remote}}) getsockopt$IPT_SO_GET_INFO(r0, 0x0, 0x40, &(0x7f0000000000)={'security\x00'}, &(0x7f0000000080)=0x54) 04:46:02 executing program 3: r0 = syz_open_dev$sg(&(0x7f00000000c0)='/dev/sg#\x00', 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000000)={0x53, 0x0, 0x6, 0x0, @buffer={0x83, 0xb8, &(0x7f00000001c0)=""/184}, &(0x7f0000000540)="ad40657ed56c", &(0x7f0000000340)=""/128, 0x0, 0x0, 0x0, &(0x7f0000000040)}) [ 616.219250] binder: 22499:22504 Acquire 1 refcount change on invalid ref 0 ret -22 [ 616.228139] binder: 22499:22537 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 04:46:02 executing program 3: r0 = syz_open_dev$sg(&(0x7f00000000c0)='/dev/sg#\x00', 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000000)={0x53, 0x0, 0x6, 0x0, @buffer={0x11c, 0xb8, &(0x7f00000001c0)=""/184}, &(0x7f0000000540)="ad40657ed56c", &(0x7f0000000340)=""/128, 0x0, 0x0, 0x0, &(0x7f0000000040)}) [ 616.384587] binder: 22548:22551 unknown command 0 04:46:02 executing program 0: r0 = socket$inet_tcp(0x2, 0x1, 0x0) r1 = syz_open_dev$midi(&(0x7f0000000000)='/dev/midi#\x00', 0x1ff, 0x103200) getsockopt$inet_sctp6_SCTP_CONTEXT(0xffffffffffffff9c, 0x84, 0x11, &(0x7f0000000040)={0x0, 0x100000000}, &(0x7f0000000080)=0x8) getsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(r1, 0x84, 0x9, &(0x7f00000000c0)={r2, @in6={{0xa, 0x4e21, 0x5, @mcast1}}, 0xd4, 0x6, 0x200000000000, 0xffffffff, 0x8}, &(0x7f0000000200)=0x98) r3 = getpid() sched_setparam(r3, &(0x7f0000000240)=0x3f) fcntl$lock(r1, 0x7, &(0x7f0000000380)={0x3, 0x5, 0xfcbd, 0x0, r3}) ioctl$sock_inet_SIOCSARP(r0, 0x8953, &(0x7f0000000180)={{0x2, 0x0, @local}, {0x0, @link_local}, 0x8, {0x2, 0x0, @remote}}) stat(&(0x7f00000003c0)='.\x00', &(0x7f0000000400)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r6 = geteuid() write$FUSE_CREATE_OPEN(r1, &(0x7f0000000500)={0xa0, 0x0, 0x7, {{0x1, 0x1, 0x7, 0xffffffff, 0x804, 0x1f, {0x5, 0x7, 0x2dcc, 0x2a1b, 0x8, 0x8000, 0x1, 0x1, 0x4, 0x3, 0x3, r6, r5, 0x5}}, {0x0, 0x5}}}, 0xa0) sendmsg$nl_generic(r1, &(0x7f00000004c0)={&(0x7f0000000340), 0xc, &(0x7f0000000480)={&(0x7f0000000680)={0x1f0, 0x3f, 0x203, 0x70bd29, 0x25dfdbfd, {0x7}, [@typed={0x74, 0x8c, @binary="5d0e564e15c7d432d7bab4d6fa0901b4cd9442ac1f185622d17be880f4b21d37abfb1c34ce15d468460c4a1e2b8be93d3bdc8d05bbf4a68849c7826fc73f8a9e35f137504a95919d46612fa5b133ea20da565af91f3f8e695ad3fcbcfb6d2b4349641e2cb790859534bf6450442287ca"}, @typed={0x8, 0x38, @uid=r4}, @nested={0x158, 0x58, [@typed={0x8, 0xc, @u32=0x1000}, @generic="1d8f665408ea453ef5aaec987578924a2200f96d4ebc28d10a21eb335c203cb2b3d860699177c32c3dadcd5a900df9c270a16346cbc76184e261c1aacaa75a5f576468c26682079d11686e70552f8ab7e064e375167f4cf1821a2c67b848aa7866e716c308fef1de3f426a6e97d35cde7678e1ec26cc9f6187c8bbe26f6d19e0858a77727d0c39e80759246dd90a5a46ccfb94ed5f9290336e31bfd7c699ecd98d542e12c71f0f955fc763921b98b44641478c27a001fb9cd2e8335c706dc561", @typed={0x8, 0x44, @uid=r6}, @typed={0x8, 0x9, @u32=0x80d8}, @generic="4f05a1cd5d85f51aad6ef3751f25d65be3c12f6c4e70affab2d7e4c83b3e42ea94e96548b547464531d5e95493c55e993b1b51e93009710fbea44a4203dff6d9c524bae86910fe25885491da8272eab99b471c86551b66c34d739156a626135e35246de7fe3d6271945424e1cbac02106eac14b5a02c6120ae6f8912"]}, @typed={0x8, 0x26, @str='\x00'}]}, 0x1f0}, 0x1, 0x0, 0x0, 0x20004000}, 0x0) setxattr$security_selinux(&(0x7f0000000280)='./file0\x00', &(0x7f00000002c0)='security.selinux\x00', &(0x7f0000000300)='unconfined_u:system_r:insmod_t:s0-s0:c0.c1023\x00', 0x2e, 0x1) [ 616.431212] binder: 22548:22551 ioctl c0306201 20012000 returned -22 [ 616.447579] binder: 22548:22556 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 04:46:02 executing program 3: r0 = syz_open_dev$sg(&(0x7f00000000c0)='/dev/sg#\x00', 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000000)={0x53, 0x0, 0x6, 0x0, @buffer={0x18, 0xb8, &(0x7f00000001c0)=""/184}, &(0x7f0000000540)="ad40657ed56c", &(0x7f0000000340)=""/128, 0x0, 0x0, 0x0, &(0x7f0000000040)}) [ 616.533112] binder: 22548:22558 unknown command 0 04:46:02 executing program 5: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000480)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_GUEST_DEBUG(r3, 0x4048ae9b, &(0x7f0000000140)={0x1}) syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000100)=[@text32={0x20, &(0x7f0000000000)="6601669b0f35c4e1fe16846ba49e0000b9940200000f32c4c23dad78e0b9670900000f32660f38827f95b0040f01d10fc71a", 0x32}], 0x1, 0x0, &(0x7f0000000040), 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r3, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000400)=[@text32={0x20, &(0x7f0000000880)="b805000000b98b9400000f01c19a01000000b0000f43d1b8000000000f23d80f21f835800000900f23f80f060f2140b9800000c00f3235000800000f3066ba4300b8f1ffffffefb9800000c00f3235002000000f30c4c3295f4da400", 0x5c}], 0x26433e1, 0x0, &(0x7f0000000300), 0x10000000000000b6) ioctl$KVM_RUN(r3, 0x5460, 0x0) [ 616.559814] binder: 22548:22558 ioctl c0306201 20012000 returned -22 [ 616.579844] binder: 22548:22551 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 04:46:02 executing program 0: r0 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_inet_SIOCSARP(r0, 0x8955, &(0x7f0000000600)={{0x2, 0x0, @local}, {0x0, @local}, 0x8, {0x2, 0x0, @rand_addr}, "0000000500000000723000"}) ioctl$sock_inet_SIOCSARP(r0, 0x8953, &(0x7f0000000180)={{0x2, 0x0, @local}, {0x0, @link_local}, 0x8, {0x2, 0x0, @remote}}) r1 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000100)='/dev/dsp\x00', 0x80004, 0x0) ioctl$KVM_CHECK_EXTENSION_VM(r1, 0xae03, 0x4) ioctl$sock_inet_SIOCSARP(r0, 0x8955, &(0x7f0000000200)={{0x2, 0x4e22, @local}, {0x1, @random="02d3356f6e37"}, 0x5a, {0x2, 0x4e22, @remote}, 'teql0\x00'}) getsockopt$inet_mreqn(r1, 0x0, 0x24, &(0x7f0000000040)={@multicast2, @multicast2}, &(0x7f0000000080)=0xc) getsockopt$bt_BT_SNDMTU(r1, 0x112, 0xc, &(0x7f0000000000)=0x5d4, &(0x7f00000000c0)=0x2) 04:46:03 executing program 1: r0 = perf_event_open(&(0x7f000025c000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000001}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = dup3(r0, r0, 0x80000) ioctl$KVM_GET_NESTED_STATE(r1, 0xc080aebe, &(0x7f0000000100)={0x0, 0x0, 0x2080}) r2 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x11, r2, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r0, 0x2405, r2) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x1000004, 0x8031, 0xffffffffffffffff, 0x0) creat(&(0x7f00000000c0)='./file0\x00', 0x28) 04:46:03 executing program 3: r0 = syz_open_dev$sg(&(0x7f00000000c0)='/dev/sg#\x00', 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000000)={0x53, 0x0, 0x6, 0x0, @buffer={0x1b, 0xb8, &(0x7f00000001c0)=""/184}, &(0x7f0000000540)="ad40657ed56c", &(0x7f0000000340)=""/128, 0x0, 0x0, 0x0, &(0x7f0000000040)}) 04:46:03 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, &(0x7f0000012fc7)}) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, &(0x7f0000000f4d)}) r2 = openat$rfkill(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rfkill\x00', 0x80000, 0x0) write$FUSE_IOCTL(r2, &(0x7f0000000040)={0x20, 0x0, 0x7, {0x9, 0x0, 0x2, 0x1}}, 0x20) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000100)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0xfffffffffffffc2b, 0x0, &(0x7f0000000680)}) 04:46:03 executing program 5: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000480)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_GUEST_DEBUG(r3, 0x4048ae9b, &(0x7f0000000140)={0x1}) syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000100)=[@text32={0x20, &(0x7f0000000000)="6601669b0f35c4e1fe16846ba49e0000b9940200000f32c4c23dad78e0b9670900000f32660f38827f95b0040f01d10fc71a", 0x32}], 0x1, 0x0, &(0x7f0000000040), 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r3, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000400)=[@text32={0x20, &(0x7f0000000880)="b805000000b98b9400000f01c19a01000000b0000f43d1b8000000000f23d80f21f835800000900f23f80f060f2140b9800000c00f3235000800000f3066ba4300b8f1ffffffefb9800000c00f3235002000000f30c4c3295f4da400", 0x5c}], 0x26433e1, 0x0, &(0x7f0000000300), 0x10000000000000b6) ioctl$KVM_RUN(r3, 0xae34, 0x0) 04:46:03 executing program 0: r0 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f0000e5b000)={0x2, 0x10000004e20, @multicast1}, 0x10) r1 = socket$inet6(0xa, 0x7ff, 0x80000001) r2 = socket$inet6_udp(0xa, 0x2, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) getsockopt$inet_sctp_SCTP_RESET_STREAMS(0xffffffffffffffff, 0x84, 0x77, &(0x7f0000000180)={0x0, 0x0, 0x3, [0x8, 0x0, 0x0]}, &(0x7f00000002c0)=0xe) connect$inet6(r2, &(0x7f0000000000)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000040)={'bond_slave_0\x00', 0x0}) ioctl$sock_inet6_SIOCSIFADDR(r2, 0x8936, &(0x7f00000000c0)={@local={0xfe, 0x80, [0x264, 0x3ef, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x2, 0x8]}, 0x75, r3}) ioctl$sock_inet6_SIOCSIFDSTADDR(r2, 0x8918, &(0x7f0000000080)={@ipv4={[], [], @dev={0xac, 0x14, 0x14, 0x17}}, 0x1d, r3}) pipe(&(0x7f0000000580)={0xffffffffffffffff, 0xffffffffffffffff}) name_to_handle_at(r5, &(0x7f00000005c0)='./file0\x00', &(0x7f0000000480)=ANY=[@ANYBLOB="200000007f000000cc483303cf2cd5e54a2a20bd62fa42fffbffff3f3c2d4d3a133a6656d46bd5340a02a5a93c7d0834cfe69fef41d57f8a3584bc6f8dd6ba9b116a2e9a8052a81e6ea460f4f00e8c536051bd269b3a92dea3927c5a1b6376d849937f965cdc2cdd4a9a0157544189de879a8079a23fd3f39d84c7a775ef9f9be2fcc419ab22f4d959370a6cfc37c905b0d2d8ced613b585f159e5f02c1e57b8c253dbb52e6a0f25f669d587325c0993acd33ec791dd0739872a631349e6d58706d921b5b947f2cbfab2b92c2935c5e31e98dcf8bcbea95ef54e"], &(0x7f0000000640), 0x400) r6 = socket$l2tp(0x18, 0x1, 0x1) connect$l2tp(r6, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, r2, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) ioctl$sock_inet6_SIOCADDRT(r2, 0x89a1, &(0x7f0000000100)={@local, @empty, @loopback, 0x3, 0x0, 0x0, 0x0, 0x100000000, 0x1c0270, r3}) r7 = syz_open_dev$dspn(&(0x7f0000000240)='/dev/dsp#\x00', 0x0, 0x2) getsockopt$inet_sctp6_SCTP_GET_ASSOC_ID_LIST(r7, 0x84, 0x1d, &(0x7f0000000340)=ANY=[@ANYBLOB="6c80dee22064ecc2e1a0f2bc4df55a7f4ee9b0d78c9e3fb08476e7c97b207cc059cb1ff0c49f962332426fa0b1501af6d8dfeb908d5536ea067a5659b04086344f5d2f19", @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES32=0x0], &(0x7f0000000300)=0xb) r8 = semget(0x3, 0x0, 0x2e2) semtimedop(r8, &(0x7f00000001c0)=[{0x4, 0x80, 0x1000}, {0x3, 0x1, 0x800}, {0x7, 0x6, 0x1000}, {0x0, 0x80000000, 0x800}, {0x7, 0x100000001, 0x1000}, {0x1, 0xffffffffffffff00, 0x800}, {0x7, 0x845}, {0x6, 0x1, 0x1800}], 0x8, &(0x7f0000000200)) ioctl(r1, 0x8912, &(0x7f0000000040)="0a5cc80700315f85715070") r9 = syz_open_dev$sndseq(&(0x7f0000042000)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_CLIENT(r9, 0x80045300, &(0x7f0000000000)) setsockopt$inet_sctp_SCTP_MAX_BURST(r7, 0x84, 0x14, &(0x7f0000000440)=@int=0x8, 0x4) perf_event_open(&(0x7f00000003c0)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, 0x200, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x100, 0x0, 0x0, 0x1f, 0x2, 0x0, 0x0, 0x0, 0x0, 0x8000000, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x8, 0x3, 0x9}, 0x0, 0x0, r4, 0x1) write$nbd(r9, &(0x7f0000000680)=ANY=[@ANYBLOB="67446698010000000200030001000000780850bbf145962d6db8c3e44c8238f3186579c72d7fd4ece5444956c37bea26c85951d961fe7566784c032ec94e540de64778de8f860efc19b364401a081e0ebc6e64e53f9ebad5376c203529fe73edfb1573bf75e2a6fe8006cd12d2b9d0afd5557c830511691a7e1d4c72e25f2affba68ae94396997212f7df0d6e7e58eebdd5b2e8edacc143c6af38785a37349a35c7e21a24fe40a31dde617ced0ff9d982419c589ff0b6fbee57c97c553ab409b2d4586e7ca164174615536887f0155ee3557ece3c48c402d12afd2f2c733b1b99fc8d1074643c093af6378a8c5c4308e0138a1b846a340"], 0x1) ioctl$IOC_PR_PREEMPT_ABORT(0xffffffffffffffff, 0x401870cc, &(0x7f0000002c40)) syz_mount_image$xfs(&(0x7f0000000000)='xfs\x00', &(0x7f0000000040)='./file0\x00', 0x5ffc, 0x1, &(0x7f00000001c0)=[{&(0x7f0000000080)="c8c3822642625609b35166ff86bece4e45ba6e005099e00c82bdac3b201a408072834a9bbed1b4a4e84e0d066b072850e40603039b89d9074cb408aa9e52279ed93cbd8582417995a1ca953b93d0efcc01dc97feffed33aa51ab2919cf77737c30201fa2d8c34f498f8b3da940010c474919ca49da47085eb42c36ff67aa1c0c02cef0f5fafc1f6f59b35f0e59016ffcac91f68dae5fa3cc0248fc776124e52125c11bc7282eab83fd9dbc4763e52e94a2bc634e7f29e1c73d153af853d8", 0xbe, 0x8}], 0x20000, &(0x7f0000000200)=ANY=[]) connect$inet(r0, &(0x7f0000ccb000)={0x2, 0x4e20}, 0x10) r10 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000240)='/dev/vga_arbiter\x00', 0x111000, 0x0) setsockopt$inet_sctp6_SCTP_PARTIAL_DELIVERY_POINT(r10, 0x84, 0x13, &(0x7f0000000280)=0x5, 0x4) 04:46:03 executing program 4: ioctl$KVM_IRQ_LINE(0xffffffffffffffff, 0x4008ae61, &(0x7f0000000500)) r0 = syz_open_dev$dspn(&(0x7f00000004c0)='/dev/dsp#\x00', 0x1, 0x0) openat$audio(0xffffffffffffff9c, &(0x7f0000000000)='/dev/audio\x00', 0x80, 0x0) ioctl$KVM_SET_FPU(0xffffffffffffffff, 0x41a0ae8d, &(0x7f0000000100)={[], 0x0, 0x5531fee, 0x0, 0x0, 0x9, 0xf000, 0x0, [], 0x5}) syz_open_dev$usb(&(0x7f0000000440)='/dev/bus/usb/00#/00#\x00', 0x9, 0x2) r1 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) lstat(&(0x7f0000000040)='./file0/file0\x00', &(0x7f0000000080)) ioctl$EXT4_IOC_MIGRATE(0xffffffffffffffff, 0x6609) sendmmsg$unix(0xffffffffffffffff, &(0x7f000000a000)=[{&(0x7f000000a000)=@abs, 0x6e, &(0x7f000000d000), 0x0, &(0x7f0000000600)=ANY=[]}], 0x1, 0x0) r2 = socket$inet6(0xa, 0x2, 0x0) gettid() r3 = getpgid(0x0) kcmp(0x0, r3, 0x0, 0xffffffffffffffff, 0xffffffffffffffff) connect$inet6(r2, &(0x7f0000002740)={0xa, 0x0, 0x0, @mcast2, 0x4}, 0x1c) sendmmsg(r2, &(0x7f0000007e00), 0x136a88c8311572c, 0x5) setsockopt$inet6_udp_int(r2, 0x11, 0x0, &(0x7f0000000400), 0x4) openat$kvm(0xffffffffffffff9c, &(0x7f00000003c0)='/dev/kvm\x00', 0x0, 0x0) ioctl$VHOST_SET_VRING_CALL(0xffffffffffffff9c, 0x4008af21, &(0x7f00000002c0)={0x0, r1}) ioctl$SNDRV_TIMER_IOCTL_TREAD(r0, 0x40045402, &(0x7f0000000740)) inotify_rm_watch(0xffffffffffffffff, 0x0) ioctl$ifreq_SIOCGIFINDEX_team(0xffffffffffffffff, 0x8933, &(0x7f0000000480)={'team0\x00'}) 04:46:03 executing program 3: r0 = syz_open_dev$sg(&(0x7f00000000c0)='/dev/sg#\x00', 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000000)={0x53, 0x0, 0x6, 0x0, @buffer={0xa9, 0xb8, &(0x7f00000001c0)=""/184}, &(0x7f0000000540)="ad40657ed56c", &(0x7f0000000340)=""/128, 0x0, 0x0, 0x0, &(0x7f0000000040)}) [ 617.184861] nf_conntrack: default automatic helper assignment has been turned off for security reasons and CT-based firewall rule not found. Use the iptables CT target to attach helpers instead. 04:46:03 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$vcsa(&(0x7f0000000000)='/dev/vcsa#\x00', 0x100000001, 0x0) ioctl$KVM_ASSIGN_PCI_DEVICE(r2, 0x8040ae69, &(0x7f0000000040)={0x3, 0x4, 0x8, 0x6, 0x7fff}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000005fd4)=ANY=[@ANYBLOB="05014a3763044000"], 0x0, 0x0, &(0x7f0000012fc7)}) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, &(0x7f0000000f4d)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000100)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0xfffffffffffffc2b, 0x0, &(0x7f0000000680)}) write$binfmt_elf32(r2, &(0x7f0000000140)=ANY=[@ANYBLOB="7f454c4600060002018000000000000002003e00c50000004103000038000000560000000100000001002000010000000800010000000000060000000400000008000000810000000000ffff0400000003000000080000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000009da1614600000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000"], 0x258) 04:46:03 executing program 3: r0 = syz_open_dev$sg(&(0x7f00000000c0)='/dev/sg#\x00', 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000000)={0x53, 0x0, 0x6, 0x0, @buffer={0x30, 0xb8, &(0x7f00000001c0)=""/184}, &(0x7f0000000540)="ad40657ed56c", &(0x7f0000000340)=""/128, 0x0, 0x0, 0x0, &(0x7f0000000040)}) [ 617.351133] binder: 22605:22606 unknown command 927596805 [ 617.394788] binder: 22605:22606 ioctl c0306201 20012000 returned -22 [ 617.454834] binder: 22605:22606 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 04:46:03 executing program 5: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000480)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_GUEST_DEBUG(r3, 0x4048ae9b, &(0x7f0000000140)={0x1}) syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000100)=[@text32={0x20, &(0x7f0000000000)="6601669b0f35c4e1fe16846ba49e0000b9940200000f32c4c23dad78e0b9670900000f32660f38827f95b0040f01d10fc71a", 0x32}], 0x1, 0x0, &(0x7f0000000040), 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r3, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000400)=[@text32={0x20, &(0x7f0000000880)="b805000000b98b9400000f01c19a01000000b0000f43d1b8000000000f23d80f21f835800000900f23f80f060f2140b9800000c00f3235000800000f3066ba4300b8f1ffffffefb9800000c00f3235002000000f30c4c3295f4da400", 0x5c}], 0x26433e1, 0x0, &(0x7f0000000300), 0x10000000000000b6) ioctl$KVM_RUN(r3, 0xae17, 0x0) 04:46:03 executing program 3: r0 = syz_open_dev$sg(&(0x7f00000000c0)='/dev/sg#\x00', 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000000)={0x53, 0x0, 0x6, 0x0, @buffer={0x19, 0xb8, &(0x7f00000001c0)=""/184}, &(0x7f0000000540)="ad40657ed56c", &(0x7f0000000340)=""/128, 0x0, 0x0, 0x0, &(0x7f0000000040)}) 04:46:03 executing program 0: r0 = add_key$user(&(0x7f00000000c0)='user\x00', &(0x7f0000000000)={'syz'}, &(0x7f0000000380)="585ccbe4ed83b836c1a6474914dc55e72206297b6895b66147b3c7218a9169a85ea0bdc9e1587a050000000000000042e33089754c8107c3cd3923dd4a71c2ff06007b6b4816122d2550829eaa9435c99926022b8753a188748c569f435fb3bae96efb74b50ec93c152f5e8e198a29e5c0d0c60000ce0637ce0000b4ec24c53d3d661ff5ff70e48884ca000018cea71fcfacf40d32e4b58a8d2725561f6110fd7b06f90b5274cc5c1e298a16324fe27da2a9d5ba9ff3c009d308bd73f4772539", 0xc0, 0xfffffffffffffffe) r1 = add_key$user(&(0x7f0000000200)='user\x00', &(0x7f00000005c0)={'syz'}, &(0x7f0000000100)='\x00', 0x1, 0xfffffffffffffffd) keyctl$dh_compute(0x17, &(0x7f0000000040)={r1, r0, r1}, &(0x7f0000000440)=""/243, 0xf3, &(0x7f0000000240)={&(0x7f0000000140)={'wp512\x00'}, &(0x7f0000000540)="c296aa9357ba7c37fbfe606e941fa0f0bb9c103170d3d294f5ed07a32daaa14314926d4a070057bd7205a9d06b82b4936b8940733cda4846275a1062373c3f1925bb40ee30f1f773ade8cb14cc93ba2259a2b9e515f8d3a81371bfc3dd54b786975e2ead81b148811121d3c037", 0x6d}) r2 = dup2(0xffffffffffffffff, 0xffffffffffffff9c) ioctl$SIOCGIFHWADDR(r2, 0x8927, &(0x7f0000000080)) 04:46:04 executing program 1: r0 = perf_event_open(&(0x7f000025c000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000001}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = dup3(r0, r0, 0x80000) ioctl$KVM_GET_NESTED_STATE(r1, 0xc080aebe, &(0x7f0000000100)={0x0, 0x0, 0x2080}) r2 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x11, r2, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r0, 0x2405, r2) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x1000004, 0x8031, 0xffffffffffffffff, 0x0) 04:46:04 executing program 3: r0 = syz_open_dev$sg(&(0x7f00000000c0)='/dev/sg#\x00', 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000000)={0x53, 0x0, 0x6, 0x0, @buffer={0x19d, 0xb8, &(0x7f00000001c0)=""/184}, &(0x7f0000000540)="ad40657ed56c", &(0x7f0000000340)=""/128, 0x0, 0x0, 0x0, &(0x7f0000000040)}) 04:46:04 executing program 4: ioctl$KVM_IRQ_LINE(0xffffffffffffffff, 0x4008ae61, &(0x7f0000000500)) r0 = syz_open_dev$dspn(&(0x7f00000004c0)='/dev/dsp#\x00', 0x1, 0x0) openat$audio(0xffffffffffffff9c, &(0x7f0000000000)='/dev/audio\x00', 0x80, 0x0) ioctl$KVM_SET_FPU(0xffffffffffffffff, 0x41a0ae8d, &(0x7f0000000100)={[], 0x0, 0x5531fee, 0x0, 0x0, 0x9, 0xf000, 0x0, [], 0x5}) syz_open_dev$usb(&(0x7f0000000440)='/dev/bus/usb/00#/00#\x00', 0x9, 0x2) r1 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) lstat(&(0x7f0000000040)='./file0/file0\x00', &(0x7f0000000080)) ioctl$EXT4_IOC_MIGRATE(0xffffffffffffffff, 0x6609) sendmmsg$unix(0xffffffffffffffff, &(0x7f000000a000)=[{&(0x7f000000a000)=@abs, 0x6e, &(0x7f000000d000), 0x0, &(0x7f0000000600)=ANY=[]}], 0x1, 0x0) r2 = socket$inet6(0xa, 0x2, 0x0) gettid() r3 = getpgid(0x0) kcmp(0x0, r3, 0x0, 0xffffffffffffffff, 0xffffffffffffffff) connect$inet6(r2, &(0x7f0000002740)={0xa, 0x0, 0x0, @mcast2, 0x4}, 0x1c) sendmmsg(r2, &(0x7f0000007e00), 0x136a88c8311572c, 0xff030000) setsockopt$inet6_udp_int(r2, 0x11, 0x0, &(0x7f0000000400), 0x4) openat$kvm(0xffffffffffffff9c, &(0x7f00000003c0)='/dev/kvm\x00', 0x0, 0x0) ioctl$VHOST_SET_VRING_CALL(0xffffffffffffff9c, 0x4008af21, &(0x7f00000002c0)={0x0, r1}) ioctl$SNDRV_TIMER_IOCTL_TREAD(r0, 0x40045402, &(0x7f0000000740)) inotify_rm_watch(0xffffffffffffffff, 0x0) ioctl$ifreq_SIOCGIFINDEX_team(0xffffffffffffffff, 0x8933, &(0x7f0000000480)={'team0\x00'}) 04:46:04 executing program 5: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000480)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_GUEST_DEBUG(r3, 0x4048ae9b, &(0x7f0000000140)={0x1}) syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000100)=[@text32={0x20, &(0x7f0000000000)="6601669b0f35c4e1fe16846ba49e0000b9940200000f32c4c23dad78e0b9670900000f32660f38827f95b0040f01d10fc71a", 0x32}], 0x1, 0x0, &(0x7f0000000040), 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r3, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000400)=[@text32={0x20, &(0x7f0000000880)="b805000000b98b9400000f01c19a01000000b0000f43d1b8000000000f23d80f21f835800000900f23f80f060f2140b9800000c00f3235000800000f3066ba4300b8f1ffffffefb9800000c00f3235002000000f30c4c3295f4da400", 0x5c}], 0x26433e1, 0x0, &(0x7f0000000300), 0x10000000000000b6) ioctl$KVM_RUN(r3, 0xae1b, 0x0) 04:46:04 executing program 0: r0 = openat$fuse(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/fuse\x00', 0x2, 0x0) mknod$loop(&(0x7f0000000440)='./file0\x00', 0x1c4, 0x0) getsockopt$inet_IP_XFRM_POLICY(0xffffffffffffffff, 0x0, 0x11, &(0x7f0000000080)={{{@in=@multicast2, @in6=@loopback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6}, 0x0, @in=@local}}, &(0x7f0000000280)=0xe8) mount$fuse(0x0, &(0x7f0000000180)='./file0\x00', &(0x7f0000000000)='fuse\x00', 0x1001060, &(0x7f00000004c0)={{'fd', 0x3d, r0}, 0x2c, {'rootmode', 0x3d, 0x8000}, 0x2c, {'user_id', 0x3d, r1}, 0x2c, {'group_id'}}) mount(&(0x7f0000000200)=@nbd={'/dev/nbd'}, &(0x7f0000000240)='./file0\x00', &(0x7f0000000340)='tmpfs\x00', 0x180000, &(0x7f0000000380)='fuse\x00') write$FUSE_STATFS(r0, &(0x7f00000002c0)={0x60, 0xffffffffffffffff, 0x3, {{0x7, 0x81, 0x6, 0x9, 0x7, 0xbb, 0x9, 0xff}}}, 0x60) 04:46:04 executing program 0: r0 = socket$inet6(0xa, 0x80003, 0x800000000000006) ioctl(r0, 0x8912, &(0x7f0000000040)="153f6234488dd25d766070") bpf$MAP_CREATE(0x0, &(0x7f0000346fd4)={0x0, 0x0, 0x0, 0x8d4, 0x10}, 0x2c) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000ba000)={0xa, 0x5, &(0x7f0000346fc8)=@framed={{}, [@alu={0x8000000201a7f19, 0x0, 0x201a7fa6, 0x48, 0x1, 0x14}]}, &(0x7f0000000000)='GPL\x00', 0x0, 0xfb, &(0x7f00001a7f05)=""/251}, 0x14) getsockopt$inet_sctp_SCTP_DEFAULT_SEND_PARAM(0xffffffffffffffff, 0x84, 0xa, &(0x7f0000000080)={0x6, 0x7, 0x8000, 0xfffffffffffffc01, 0x200, 0x4, 0x1, 0xf6, 0x0}, &(0x7f00000000c0)=0x20) getsockopt$inet_sctp6_SCTP_MAXSEG(r1, 0x84, 0xd, &(0x7f0000000100)=@assoc_id=r2, &(0x7f0000000140)=0x4) 04:46:04 executing program 3: r0 = syz_open_dev$sg(&(0x7f00000000c0)='/dev/sg#\x00', 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000000)={0x53, 0x0, 0x6, 0x0, @buffer={0x14f, 0xb8, &(0x7f00000001c0)=""/184}, &(0x7f0000000540)="ad40657ed56c", &(0x7f0000000340)=""/128, 0x0, 0x0, 0x0, &(0x7f0000000040)}) [ 618.116913] binder: 22605:22612 unknown command 927596805 [ 618.138427] binder: 22605:22612 ioctl c0306201 20012000 returned -22 [ 618.140291] binder: 22605:22656 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 04:46:04 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, &(0x7f0000012fc7)}) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x66, 0x0, &(0x7f0000000040)="295b60b3858f72d527facae021156c1e10d70709999199dab423ed1b325da3eff7b2396093c7966a259ff8825f3ef2f791458dbb77d6b1c583ca1c466d099353625389891967fc873d56dcb410d12f13dfa240d54abd35b05a4c1a3198ddf480143ff4b3524d"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000100)={0x4, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0c621f3efc74c3c0b2cbe89bc4e0b34a3933cdebfcb601ecba66a72c76e9cd0f70ffa3447d6c657bccd4a75d53d4daad7182861704a8da367ad47523f1"], 0xfffffffffffffc2b, 0x0, &(0x7f0000000680)}) 04:46:04 executing program 4: ioctl$KVM_IRQ_LINE(0xffffffffffffffff, 0x4008ae61, &(0x7f0000000500)) r0 = syz_open_dev$dspn(&(0x7f00000004c0)='/dev/dsp#\x00', 0x1, 0x0) openat$audio(0xffffffffffffff9c, &(0x7f0000000000)='/dev/audio\x00', 0x80, 0x0) ioctl$KVM_SET_FPU(0xffffffffffffffff, 0x41a0ae8d, &(0x7f0000000100)={[], 0x0, 0x5531fee, 0x0, 0x0, 0x9, 0xf000, 0x0, [], 0x5}) syz_open_dev$usb(&(0x7f0000000440)='/dev/bus/usb/00#/00#\x00', 0x9, 0x2) r1 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) lstat(&(0x7f0000000040)='./file0/file0\x00', &(0x7f0000000080)) ioctl$EXT4_IOC_MIGRATE(0xffffffffffffffff, 0x6609) sendmmsg$unix(0xffffffffffffffff, &(0x7f000000a000)=[{&(0x7f000000a000)=@abs, 0x6e, &(0x7f000000d000), 0x0, &(0x7f0000000600)=ANY=[]}], 0x1, 0x0) r2 = socket$inet6(0xa, 0x2, 0x0) gettid() r3 = getpgid(0x0) kcmp(0x0, r3, 0x0, 0xffffffffffffffff, 0xffffffffffffffff) connect$inet6(r2, &(0x7f0000002740)={0xa, 0x0, 0x0, @mcast2, 0x4}, 0x1c) sendmmsg(r2, &(0x7f0000007e00), 0x136a88c8311572c, 0x400300) setsockopt$inet6_udp_int(r2, 0x11, 0x0, &(0x7f0000000400), 0x4) openat$kvm(0xffffffffffffff9c, &(0x7f00000003c0)='/dev/kvm\x00', 0x0, 0x0) ioctl$VHOST_SET_VRING_CALL(0xffffffffffffff9c, 0x4008af21, &(0x7f00000002c0)={0x0, r1}) ioctl$SNDRV_TIMER_IOCTL_TREAD(r0, 0x40045402, &(0x7f0000000740)) inotify_rm_watch(0xffffffffffffffff, 0x0) ioctl$ifreq_SIOCGIFINDEX_team(0xffffffffffffffff, 0x8933, &(0x7f0000000480)={'team0\x00'}) 04:46:04 executing program 3: r0 = syz_open_dev$sg(&(0x7f00000000c0)='/dev/sg#\x00', 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000000)={0x53, 0x0, 0x6, 0x0, @buffer={0x123, 0xb8, &(0x7f00000001c0)=""/184}, &(0x7f0000000540)="ad40657ed56c", &(0x7f0000000340)=""/128, 0x0, 0x0, 0x0, &(0x7f0000000040)}) 04:46:04 executing program 5: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000480)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_GUEST_DEBUG(r3, 0x4048ae9b, &(0x7f0000000140)={0x1}) syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000100)=[@text32={0x20, &(0x7f0000000000)="6601669b0f35c4e1fe16846ba49e0000b9940200000f32c4c23dad78e0b9670900000f32660f38827f95b0040f01d10fc71a", 0x32}], 0x1, 0x0, &(0x7f0000000040), 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r3, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000400)=[@text32={0x20, &(0x7f0000000880)="b805000000b98b9400000f01c19a01000000b0000f43d1b8000000000f23d80f21f835800000900f23f80f060f2140b9800000c00f3235000800000f3066ba4300b8f1ffffffefb9800000c00f3235002000000f30c4c3295f4da400", 0x5c}], 0x26433e1, 0x0, &(0x7f0000000300), 0x10000000000000b6) ioctl$KVM_RUN(r3, 0xae2a, 0x0) 04:46:04 executing program 0: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x1) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000001000/0x2000)=nil}) ioctl$KVM_SET_REGS(r2, 0x4090ae82, &(0x7f0000000000)={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6]}) write$binfmt_aout(0xffffffffffffffff, &(0x7f0000001380)=ANY=[@ANYBLOB="696b74d5"], 0x4) ioctl$KVM_NMI(r2, 0xae9a) ioctl$KVM_GET_VCPU_MMAP_SIZE(r0, 0xae04) write$binfmt_aout(0xffffffffffffffff, &(0x7f0000001380)=ANY=[@ANYBLOB="7f0000"], 0x3) ioctl$KVM_RUN(r2, 0xae80, 0x0) [ 618.431023] binder: 22671:22676 unknown command 1042244108 [ 618.488330] binder: 22671:22676 ioctl c0306201 20000100 returned -22 04:46:04 executing program 1: r0 = perf_event_open(&(0x7f000025c000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000001}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = dup3(r0, r0, 0x80000) ioctl$KVM_GET_NESTED_STATE(r1, 0xc080aebe, &(0x7f0000000100)={0x0, 0x0, 0x2080}) r2 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x11, r2, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x1000004, 0x8031, 0xffffffffffffffff, 0x0) 04:46:04 executing program 3: r0 = syz_open_dev$sg(&(0x7f00000000c0)='/dev/sg#\x00', 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000000)={0x53, 0x0, 0x6, 0x0, @buffer={0xfb, 0xb8, &(0x7f00000001c0)=""/184}, &(0x7f0000000540)="ad40657ed56c", &(0x7f0000000340)=""/128, 0x0, 0x0, 0x0, &(0x7f0000000040)}) 04:46:04 executing program 5: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000480)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_GUEST_DEBUG(r3, 0x4048ae9b, &(0x7f0000000140)={0x1}) syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000100)=[@text32={0x20, &(0x7f0000000000)="6601669b0f35c4e1fe16846ba49e0000b9940200000f32c4c23dad78e0b9670900000f32660f38827f95b0040f01d10fc71a", 0x32}], 0x1, 0x0, &(0x7f0000000040), 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r3, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000400)=[@text32={0x20, &(0x7f0000000880)="b805000000b98b9400000f01c19a01000000b0000f43d1b8000000000f23d80f21f835800000900f23f80f060f2140b9800000c00f3235000800000f3066ba4300b8f1ffffffefb9800000c00f3235002000000f30c4c3295f4da400", 0x5c}], 0x26433e1, 0x0, &(0x7f0000000300), 0x10000000000000b6) ioctl$KVM_RUN(r3, 0x4090ae82, 0x0) 04:46:04 executing program 0: r0 = socket$inet6(0xa, 0x3, 0x800000000000004) ioctl(r0, 0x8912, &(0x7f0000000280)="153f6234488dd25d5c6070") r1 = socket$inet6(0xa, 0x80803, 0x2) connect$inet6(r1, &(0x7f0000000080)={0xa, 0x0, 0x0, @loopback}, 0x1c) setsockopt$sock_int(r1, 0x1, 0x1d, &(0x7f0000000280)=0xdbc, 0x236) write$binfmt_elf32(r1, &(0x7f0000000240)=ANY=[], 0x0) recvfrom$inet6(r1, &(0x7f00000002c0)=""/227, 0xe3, 0x0, 0x0, 0xfffffffffffffe9f) socketpair$inet_sctp(0x2, 0x1, 0x84, &(0x7f0000000000)={0xffffffffffffffff}) ioctl$sock_inet_SIOCGARP(r2, 0x8954, &(0x7f00000000c0)={{0x2, 0x4e23, @loopback}, {0x100030a, @remote}, 0x8, {0x2, 0x4e22}, 'syzkaller0\x00'}) listen(r1, 0x8) 04:46:04 executing program 4: ioctl$KVM_IRQ_LINE(0xffffffffffffffff, 0x4008ae61, &(0x7f0000000500)) r0 = syz_open_dev$dspn(&(0x7f00000004c0)='/dev/dsp#\x00', 0x1, 0x0) openat$audio(0xffffffffffffff9c, &(0x7f0000000000)='/dev/audio\x00', 0x80, 0x0) ioctl$KVM_SET_FPU(0xffffffffffffffff, 0x41a0ae8d, &(0x7f0000000100)={[], 0x0, 0x5531fee, 0x0, 0x0, 0x9, 0xf000, 0x0, [], 0x5}) syz_open_dev$usb(&(0x7f0000000440)='/dev/bus/usb/00#/00#\x00', 0x9, 0x2) r1 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) lstat(&(0x7f0000000040)='./file0/file0\x00', &(0x7f0000000080)) ioctl$EXT4_IOC_MIGRATE(0xffffffffffffffff, 0x6609) sendmmsg$unix(0xffffffffffffffff, &(0x7f000000a000)=[{&(0x7f000000a000)=@abs, 0x6e, &(0x7f000000d000), 0x0, &(0x7f0000000600)=ANY=[]}], 0x1, 0x0) r2 = socket$inet6(0xa, 0x2, 0x0) gettid() r3 = getpgid(0x0) kcmp(0x0, r3, 0x0, 0xffffffffffffffff, 0xffffffffffffffff) connect$inet6(r2, &(0x7f0000002740)={0xa, 0x0, 0x0, @mcast2, 0x4}, 0x1c) sendmmsg(r2, &(0x7f0000007e00), 0x136a88c8311572c, 0x7000000) setsockopt$inet6_udp_int(r2, 0x11, 0x0, &(0x7f0000000400), 0x4) openat$kvm(0xffffffffffffff9c, &(0x7f00000003c0)='/dev/kvm\x00', 0x0, 0x0) ioctl$VHOST_SET_VRING_CALL(0xffffffffffffff9c, 0x4008af21, &(0x7f00000002c0)={0x0, r1}) ioctl$SNDRV_TIMER_IOCTL_TREAD(r0, 0x40045402, &(0x7f0000000740)) inotify_rm_watch(0xffffffffffffffff, 0x0) ioctl$ifreq_SIOCGIFINDEX_team(0xffffffffffffffff, 0x8933, &(0x7f0000000480)={'team0\x00'}) 04:46:05 executing program 3: r0 = syz_open_dev$sg(&(0x7f00000000c0)='/dev/sg#\x00', 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000000)={0x53, 0x0, 0x6, 0x0, @buffer={0x16, 0xb8, &(0x7f00000001c0)=""/184}, &(0x7f0000000540)="ad40657ed56c", &(0x7f0000000340)=""/128, 0x0, 0x0, 0x0, &(0x7f0000000040)}) 04:46:05 executing program 0: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070") r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r1, 0x6, 0x13, &(0x7f00000000c0)=0x100000001, 0x1d4) connect$inet6(r0, &(0x7f0000000000)={0xa, 0x4e23, 0x0, @mcast2, 0x4}, 0xffffffffffffffc0) setsockopt$inet6_tcp_TCP_ULP(r1, 0x6, 0x1f, &(0x7f0000006580)='tls\x00', 0x95d59845436eab44) close(r1) [ 619.167760] binder: 22671:22710 unknown command 1042244108 [ 619.179866] binder: 22671:22710 ioctl c0306201 20000100 returned -22 04:46:05 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x20000, 0x0) setsockopt$inet_int(r1, 0x0, 0x1e, &(0x7f0000000040)=0xffffffffffffffff, 0x4) r2 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, &(0x7f0000012fc7)}) close(r0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, &(0x7f0000000f4d)}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000100)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0xfffffffffffffc2b, 0x0, &(0x7f0000000680)}) 04:46:05 executing program 5: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000480)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_GUEST_DEBUG(r3, 0x4048ae9b, &(0x7f0000000140)={0x1}) syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000100)=[@text32={0x20, &(0x7f0000000000)="6601669b0f35c4e1fe16846ba49e0000b9940200000f32c4c23dad78e0b9670900000f32660f38827f95b0040f01d10fc71a", 0x32}], 0x1, 0x0, &(0x7f0000000040), 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r3, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000400)=[@text32={0x20, &(0x7f0000000880)="b805000000b98b9400000f01c19a01000000b0000f43d1b8000000000f23d80f21f835800000900f23f80f060f2140b9800000c00f3235000800000f3066ba4300b8f1ffffffefb9800000c00f3235002000000f30c4c3295f4da400", 0x5c}], 0x26433e1, 0x0, &(0x7f0000000300), 0x10000000000000b6) ioctl$KVM_RUN(r3, 0x5451, 0x0) 04:46:05 executing program 3: r0 = syz_open_dev$sg(&(0x7f00000000c0)='/dev/sg#\x00', 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000000)={0x53, 0x0, 0x6, 0x0, @buffer={0xbd, 0xb8, &(0x7f00000001c0)=""/184}, &(0x7f0000000540)="ad40657ed56c", &(0x7f0000000340)=""/128, 0x0, 0x0, 0x0, &(0x7f0000000040)}) 04:46:05 executing program 0: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x40000000000000) syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000080)=[@text16={0x10, &(0x7f0000000180)="2e65f32efe0a6766c7442400008000006766c7442402000000006766c744240600000000670f011c24b866000f00d066b88044a2b20f23c80f21f866350400d0000f23f80f0766b80500000066b9080000000f01c10f0766b8010000000f01c10f01dfb835008ee0", 0x68}], 0x1, 0x0, &(0x7f00000000c0), 0x0) setsockopt$inet_sctp_SCTP_PR_SUPPORTED(0xffffffffffffffff, 0x84, 0x71, &(0x7f00000000c0), 0x8) r3 = openat$null(0xffffffffffffff9c, &(0x7f0000000500)='/dev/null\x00', 0x0, 0x0) getsockopt$inet_sctp6_SCTP_RECVNXTINFO(r3, 0x84, 0x21, &(0x7f0000000540), &(0x7f0000000580)=0x4) ioctl$KVM_SET_VCPU_EVENTS(r2, 0x4040aea0, &(0x7f0000000100)={0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x167}) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$KVM_RUN(r2, 0xae80, 0x0) 04:46:05 executing program 4: ioctl$KVM_IRQ_LINE(0xffffffffffffffff, 0x4008ae61, &(0x7f0000000500)) r0 = syz_open_dev$dspn(&(0x7f00000004c0)='/dev/dsp#\x00', 0x1, 0x0) openat$audio(0xffffffffffffff9c, &(0x7f0000000000)='/dev/audio\x00', 0x80, 0x0) ioctl$KVM_SET_FPU(0xffffffffffffffff, 0x41a0ae8d, &(0x7f0000000100)={[], 0x0, 0x5531fee, 0x0, 0x0, 0x9, 0xf000, 0x0, [], 0x5}) syz_open_dev$usb(&(0x7f0000000440)='/dev/bus/usb/00#/00#\x00', 0x9, 0x2) r1 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) lstat(&(0x7f0000000040)='./file0/file0\x00', &(0x7f0000000080)) ioctl$EXT4_IOC_MIGRATE(0xffffffffffffffff, 0x6609) sendmmsg$unix(0xffffffffffffffff, &(0x7f000000a000)=[{&(0x7f000000a000)=@abs, 0x6e, &(0x7f000000d000), 0x0, &(0x7f0000000600)=ANY=[]}], 0x1, 0x0) r2 = socket$inet6(0xa, 0x2, 0x0) gettid() r3 = getpgid(0x0) kcmp(0x0, r3, 0x0, 0xffffffffffffffff, 0xffffffffffffffff) connect$inet6(r2, &(0x7f0000002740)={0xa, 0x0, 0x0, @mcast2, 0x4}, 0x1c) sendmmsg(r2, &(0x7f0000007e00), 0x136a88c8311572c, 0x500000000000000) setsockopt$inet6_udp_int(r2, 0x11, 0x0, &(0x7f0000000400), 0x4) openat$kvm(0xffffffffffffff9c, &(0x7f00000003c0)='/dev/kvm\x00', 0x0, 0x0) ioctl$VHOST_SET_VRING_CALL(0xffffffffffffff9c, 0x4008af21, &(0x7f00000002c0)={0x0, r1}) ioctl$SNDRV_TIMER_IOCTL_TREAD(r0, 0x40045402, &(0x7f0000000740)) inotify_rm_watch(0xffffffffffffffff, 0x0) ioctl$ifreq_SIOCGIFINDEX_team(0xffffffffffffffff, 0x8933, &(0x7f0000000480)={'team0\x00'}) 04:46:05 executing program 1: r0 = perf_event_open(&(0x7f000025c000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000001}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = dup3(r0, r0, 0x80000) ioctl$KVM_GET_NESTED_STATE(r1, 0xc080aebe, &(0x7f0000000100)={0x0, 0x0, 0x2080}) r2 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x11, r2, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x1000004, 0x8031, 0xffffffffffffffff, 0x0) 04:46:05 executing program 3: r0 = syz_open_dev$sg(&(0x7f00000000c0)='/dev/sg#\x00', 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000000)={0x53, 0x0, 0x6, 0x0, @buffer={0xbc, 0xb8, &(0x7f00000001c0)=""/184}, &(0x7f0000000540)="ad40657ed56c", &(0x7f0000000340)=""/128, 0x0, 0x0, 0x0, &(0x7f0000000040)}) 04:46:05 executing program 2: inotify_init1(0x80000) r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, &(0x7f0000012fc7)}) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, &(0x7f0000000f4d)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000100)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0xfffffffffffffc2b, 0x0, &(0x7f0000000680)}) 04:46:05 executing program 5: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000480)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_GUEST_DEBUG(r3, 0x4048ae9b, &(0x7f0000000140)={0x1}) syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000100)=[@text32={0x20, &(0x7f0000000000)="6601669b0f35c4e1fe16846ba49e0000b9940200000f32c4c23dad78e0b9670900000f32660f38827f95b0040f01d10fc71a", 0x32}], 0x1, 0x0, &(0x7f0000000040), 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r3, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000400)=[@text32={0x20, &(0x7f0000000880)="b805000000b98b9400000f01c19a01000000b0000f43d1b8000000000f23d80f21f835800000900f23f80f060f2140b9800000c00f3235000800000f3066ba4300b8f1ffffffefb9800000c00f3235002000000f30c4c3295f4da400", 0x5c}], 0x26433e1, 0x0, &(0x7f0000000300), 0x10000000000000b6) ioctl$KVM_RUN(r3, 0x5452, 0x0) 04:46:05 executing program 0: r0 = creat(&(0x7f0000000700)='./bus\x00', 0x0) mmap(&(0x7f000030b000/0x1000)=nil, 0x1000, 0x4, 0x10, r0, 0x0) ftruncate(r0, 0x208200) r1 = open(&(0x7f0000000780)='./bus\x00', 0x14103e, 0x0) mmap(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x7ffffe, 0x4002011, r1, 0x0) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000380), 0x0, &(0x7f00000007c0)}, 0x0) pipe(&(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}) write(r3, &(0x7f0000000340), 0x10000014c) perf_event_open(&(0x7f0000000040)={0x0, 0x70}, 0x0, 0x0, 0xffffffffffffffff, 0x0) socketpair$inet_icmp_raw(0x2, 0x3, 0x1, &(0x7f00000000c0)) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) open(&(0x7f0000000280)='./bus\x00', 0x400000, 0x43) getsockopt$inet_sctp_SCTP_LOCAL_AUTH_CHUNKS(0xffffffffffffffff, 0x84, 0x1b, &(0x7f00000007c0), &(0x7f0000000100)=0x8) r4 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r5 = ioctl$KVM_CREATE_VM(r4, 0xae01, 0x0) syz_kvm_setup_cpu$x86(r5, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, &(0x7f00000000c0)=[@textreal={0x8, &(0x7f0000000080)="baa100b000eef36cba2100ec66b9800000c00f326635001000000f30bad104ecc80080d267d9f8f30f1bb429000f20c06635200000000f22c067f3af", 0x3c}], 0x1, 0x0, &(0x7f0000000100), 0x0) ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60) r6 = openat$autofs(0xffffffffffffff9c, &(0x7f0000000000)='/dev/autofs\x00', 0x0, 0x0) ioctl$KVM_SET_IRQCHIP(r5, 0x8208ae63, &(0x7f0000000100)={0x0, 0x0, @pic={0x0, 0x4}}) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x100, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffc, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10000000000000, @perf_config_ext}, 0x0, 0x3, 0xffffffffffffffff, 0x0) mkdirat$cgroup(r6, &(0x7f0000000300), 0x1ff) r7 = creat(&(0x7f0000000240)='./bus\x00', 0x0) write$FUSE_DIRENT(r7, &(0x7f0000000440)={0xa8, 0x0, 0x3, [{0x3, 0x401, 0x18, 0x80, 'posix_acl_accessvboxnet1'}, {0x3, 0x83d1, 0xd, 0x3, "29757365725e5e70707030ca3a"}, {0x3, 0x5, 0x1, 0x7, '\x00'}, {0x1, 0x3, 0x1, 0x6e39, '\x00'}]}, 0xa8) syz_open_dev$usb(&(0x7f0000000340)='/dev/bus/usb/00#/00#\x00', 0x3f, 0x1) [ 619.829607] binder: 22734:22745 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 04:46:06 executing program 3: r0 = syz_open_dev$sg(&(0x7f00000000c0)='/dev/sg#\x00', 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000000)={0x53, 0x0, 0x6, 0x0, @buffer={0x1dc, 0xb8, &(0x7f00000001c0)=""/184}, &(0x7f0000000540)="ad40657ed56c", &(0x7f0000000340)=""/128, 0x0, 0x0, 0x0, &(0x7f0000000040)}) 04:46:06 executing program 4: ioctl$KVM_IRQ_LINE(0xffffffffffffffff, 0x4008ae61, &(0x7f0000000500)) r0 = syz_open_dev$dspn(&(0x7f00000004c0)='/dev/dsp#\x00', 0x1, 0x0) openat$audio(0xffffffffffffff9c, &(0x7f0000000000)='/dev/audio\x00', 0x80, 0x0) ioctl$KVM_SET_FPU(0xffffffffffffffff, 0x41a0ae8d, &(0x7f0000000100)={[], 0x0, 0x5531fee, 0x0, 0x0, 0x9, 0xf000, 0x0, [], 0x5}) syz_open_dev$usb(&(0x7f0000000440)='/dev/bus/usb/00#/00#\x00', 0x9, 0x2) r1 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) lstat(&(0x7f0000000040)='./file0/file0\x00', &(0x7f0000000080)) ioctl$EXT4_IOC_MIGRATE(0xffffffffffffffff, 0x6609) sendmmsg$unix(0xffffffffffffffff, &(0x7f000000a000)=[{&(0x7f000000a000)=@abs, 0x6e, &(0x7f000000d000), 0x0, &(0x7f0000000600)=ANY=[]}], 0x1, 0x0) r2 = socket$inet6(0xa, 0x2, 0x0) gettid() r3 = getpgid(0x0) kcmp(0x0, r3, 0x0, 0xffffffffffffffff, 0xffffffffffffffff) connect$inet6(r2, &(0x7f0000002740)={0xa, 0x0, 0x0, @mcast2, 0x4}, 0x1c) sendmmsg(r2, &(0x7f0000007e00), 0x136a88c8311572c, 0xffffffff00000000) setsockopt$inet6_udp_int(r2, 0x11, 0x0, &(0x7f0000000400), 0x4) openat$kvm(0xffffffffffffff9c, &(0x7f00000003c0)='/dev/kvm\x00', 0x0, 0x0) ioctl$VHOST_SET_VRING_CALL(0xffffffffffffff9c, 0x4008af21, &(0x7f00000002c0)={0x0, r1}) ioctl$SNDRV_TIMER_IOCTL_TREAD(r0, 0x40045402, &(0x7f0000000740)) inotify_rm_watch(0xffffffffffffffff, 0x0) ioctl$ifreq_SIOCGIFINDEX_team(0xffffffffffffffff, 0x8933, &(0x7f0000000480)={'team0\x00'}) 04:46:06 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = dup(r0) write$P9_RSETATTR(r1, &(0x7f0000000000)={0x7, 0x1b, 0x2}, 0x7) r2 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x800) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, &(0x7f0000012fc7)}) close(r0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, &(0x7f0000000f4d)}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000100)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0xfffffffffffffc2b, 0x0, &(0x7f0000000680)}) 04:46:06 executing program 3: r0 = syz_open_dev$sg(&(0x7f00000000c0)='/dev/sg#\x00', 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000000)={0x53, 0x0, 0x6, 0x0, @buffer={0x1ac, 0xb8, &(0x7f00000001c0)=""/184}, &(0x7f0000000540)="ad40657ed56c", &(0x7f0000000340)=""/128, 0x0, 0x0, 0x0, &(0x7f0000000040)}) 04:46:06 executing program 5: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000480)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_GUEST_DEBUG(r3, 0x4048ae9b, &(0x7f0000000140)={0x1}) syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000100)=[@text32={0x20, &(0x7f0000000000)="6601669b0f35c4e1fe16846ba49e0000b9940200000f32c4c23dad78e0b9670900000f32660f38827f95b0040f01d10fc71a", 0x32}], 0x1, 0x0, &(0x7f0000000040), 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r3, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000400)=[@text32={0x20, &(0x7f0000000880)="b805000000b98b9400000f01c19a01000000b0000f43d1b8000000000f23d80f21f835800000900f23f80f060f2140b9800000c00f3235000800000f3066ba4300b8f1ffffffefb9800000c00f3235002000000f30c4c3295f4da400", 0x5c}], 0x26433e1, 0x0, &(0x7f0000000300), 0x10000000000000b6) ioctl$KVM_RUN(r3, 0x81a0ae8c, 0x0) [ 620.103521] binder: 22761:22762 ioctl c0306201 20000100 returned -11 [ 620.140182] binder: BINDER_SET_CONTEXT_MGR already set [ 620.158167] binder: 22761:22762 ioctl 40046207 0 returned -16 04:46:06 executing program 3: r0 = syz_open_dev$sg(&(0x7f00000000c0)='/dev/sg#\x00', 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000000)={0x53, 0x0, 0x6, 0x0, @buffer={0x9a, 0xb8, &(0x7f00000001c0)=""/184}, &(0x7f0000000540)="ad40657ed56c", &(0x7f0000000340)=""/128, 0x0, 0x0, 0x0, &(0x7f0000000040)}) 04:46:06 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, &(0x7f0000012fc7)}) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, &(0x7f0000000f4d)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000100)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0xfffffffffffffc2b, 0x0, &(0x7f0000000680)}) clock_gettime(0x0, &(0x7f0000000040)={0x0, 0x0}) futex(&(0x7f0000000000)=0x1, 0x5, 0x0, &(0x7f00000000c0)={r2, r3+30000000}, &(0x7f0000000140)=0x2, 0x1) 04:46:06 executing program 1: r0 = perf_event_open(&(0x7f000025c000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000001}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = dup3(r0, r0, 0x80000) ioctl$KVM_GET_NESTED_STATE(r1, 0xc080aebe, &(0x7f0000000100)={0x0, 0x0, 0x2080}) r2 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r0, 0x2405, r2) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x1000004, 0x8031, 0xffffffffffffffff, 0x0) 04:46:06 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, &(0x7f0000012fc7)}) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, &(0x7f0000000f4d)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000100)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0xfffffffffffffc2b, 0x0, &(0x7f0000000680)}) r2 = memfd_create(&(0x7f0000000000)='/dev/binder#\x00', 0x4) ioctl$SCSI_IOCTL_GET_IDLUN(r2, 0x5382, &(0x7f0000000040)) 04:46:06 executing program 3: r0 = syz_open_dev$sg(&(0x7f00000000c0)='/dev/sg#\x00', 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000000)={0x53, 0x0, 0x6, 0x0, @buffer={0x107, 0xb8, &(0x7f00000001c0)=""/184}, &(0x7f0000000540)="ad40657ed56c", &(0x7f0000000340)=""/128, 0x0, 0x0, 0x0, &(0x7f0000000040)}) 04:46:06 executing program 5: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000480)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_GUEST_DEBUG(r3, 0x4048ae9b, &(0x7f0000000140)={0x1}) syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000100)=[@text32={0x20, &(0x7f0000000000)="6601669b0f35c4e1fe16846ba49e0000b9940200000f32c4c23dad78e0b9670900000f32660f38827f95b0040f01d10fc71a", 0x32}], 0x1, 0x0, &(0x7f0000000040), 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r3, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000400)=[@text32={0x20, &(0x7f0000000880)="b805000000b98b9400000f01c19a01000000b0000f43d1b8000000000f23d80f21f835800000900f23f80f060f2140b9800000c00f3235000800000f3066ba4300b8f1ffffffefb9800000c00f3235002000000f30c4c3295f4da400", 0x5c}], 0x26433e1, 0x0, &(0x7f0000000300), 0x10000000000000b6) ioctl$KVM_RUN(r3, 0x4048ae9b, 0x0) 04:46:07 executing program 0: bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0xf, 0x3, &(0x7f0000000100)=ANY=[@ANYBLOB="8f000057d487007d5e774444443a7c34b7000192e860d920a174ce5c9ec7cb00c40025000000001be68387904a29"], &(0x7f0000000000)="504c20004cf7d12af11ce92537b5e3191e66de5d4ec18e4c2df01484a86d77842f624946eae310794c8c96ff1466232e25951139bda5d2990e523f8ec3080ffc1224d8dc4c84a9c8e8ab31576806715523fa749e8615c61049b8b1be6aa7740702cc5add", 0x5, 0xc3, &(0x7f000000cf3d)=""/195}, 0x48) 04:46:07 executing program 4: ioctl$KVM_IRQ_LINE(0xffffffffffffffff, 0x4008ae61, &(0x7f0000000500)) r0 = syz_open_dev$dspn(&(0x7f00000004c0)='/dev/dsp#\x00', 0x1, 0x0) openat$audio(0xffffffffffffff9c, &(0x7f0000000000)='/dev/audio\x00', 0x80, 0x0) ioctl$KVM_SET_FPU(0xffffffffffffffff, 0x41a0ae8d, &(0x7f0000000100)={[], 0x0, 0x5531fee, 0x0, 0x0, 0x9, 0xf000, 0x0, [], 0x5}) syz_open_dev$usb(&(0x7f0000000440)='/dev/bus/usb/00#/00#\x00', 0x9, 0x2) r1 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) lstat(&(0x7f0000000040)='./file0/file0\x00', &(0x7f0000000080)) ioctl$EXT4_IOC_MIGRATE(0xffffffffffffffff, 0x6609) sendmmsg$unix(0xffffffffffffffff, &(0x7f000000a000)=[{&(0x7f000000a000)=@abs, 0x6e, &(0x7f000000d000), 0x0, &(0x7f0000000600)=ANY=[]}], 0x1, 0x0) r2 = socket$inet6(0xa, 0x2, 0x0) gettid() r3 = getpgid(0x0) kcmp(0x0, r3, 0x0, 0xffffffffffffffff, 0xffffffffffffffff) connect$inet6(r2, &(0x7f0000002740)={0xa, 0x0, 0x0, @mcast2, 0x4}, 0x1c) sendmmsg(r2, &(0x7f0000007e00), 0x136a88c8311572c, 0x1a0) setsockopt$inet6_udp_int(r2, 0x11, 0x0, &(0x7f0000000400), 0x4) openat$kvm(0xffffffffffffff9c, &(0x7f00000003c0)='/dev/kvm\x00', 0x0, 0x0) ioctl$VHOST_SET_VRING_CALL(0xffffffffffffff9c, 0x4008af21, &(0x7f00000002c0)={0x0, r1}) ioctl$SNDRV_TIMER_IOCTL_TREAD(r0, 0x40045402, &(0x7f0000000740)) inotify_rm_watch(0xffffffffffffffff, 0x0) ioctl$ifreq_SIOCGIFINDEX_team(0xffffffffffffffff, 0x8933, &(0x7f0000000480)={'team0\x00'}) 04:46:07 executing program 3: r0 = syz_open_dev$sg(&(0x7f00000000c0)='/dev/sg#\x00', 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000000)={0x53, 0x0, 0x6, 0x0, @buffer={0x6, 0xb8, &(0x7f00000001c0)=""/184}, &(0x7f0000000540)="ad40657ed56c", &(0x7f0000000340)=""/128, 0x0, 0x0, 0x0, &(0x7f0000000040)}) 04:46:07 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, &(0x7f0000000040)={0x0}) r2 = mmap$binder(&(0x7f0000ffc000/0x1000)=nil, 0x1000, 0x0, 0x10, r0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0xb0, 0x0, &(0x7f00000001c0)=[@transaction={0x40406300, {0x3, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x10, 0xfffffffffffffffd, &(0x7f0000000000)=[0x40, 0x60]}}, @free_buffer={0x40086303, r1}, @reply_sg={0x40486312, {{0x1, 0x0, 0x3, 0x0, 0x11, 0x0, 0x0, 0x0, 0x48, &(0x7f00000000c0), &(0x7f0000000140)=[0x0, 0x30, 0x78, 0x58, 0x30, 0x38, 0x30, 0x38, 0x78]}, 0x4}}, @increfs_done={0x40106308, r2, 0x1}], 0x2c, 0x0, &(0x7f0000000280)="54b05d90930e1c102ceee5a8b584605fc20225d1fcaab3d71b62c6d6e185e8ba3d176ae6dc657f218bada907"}) r3 = openat(0xffffffffffffffff, &(0x7f00000003c0)='./file0\x00', 0x8180, 0xc) ioctl$IOC_PR_RESERVE(r3, 0x401070c9, &(0x7f0000000400)={0x100000001, 0xe4f, 0x1}) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r4 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r5 = openat$hwrng(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/hwrng\x00', 0x8000, 0x0) getsockopt$inet_mreqsrc(r3, 0x0, 0x26, &(0x7f0000000440)={@empty, @loopback, @broadcast}, &(0x7f0000000480)=0xc) r6 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000300)='/dev/vga_arbiter\x00', 0x800, 0x0) ioctl$EVIOCSREP(r5, 0x40084503, &(0x7f00000004c0)=[0xe60, 0xfff]) write$binfmt_script(r3, &(0x7f0000000600)={'#! ', './file0', [{0x20, '/dev/binder#\x00'}], 0xa, "9837ad30d719a1d22eadfcb1860414ea5c6a203fcb8be4f1e220a06543f65bc88693447cdee0a576874ce6ddd39c2b10eac7a2ba8d9d39dfe21e646a1fd162bbf3c457f050dda476807fba46a6fc1cce742fd8bf7ff147f2a44a8999d22f0cb6ea77d0b9cdf98b85c3b82310eaaf169ba955d4e86f67eba889bca1190e4ade05b8f723c44f89fa73a27afbc6fc4250e93d442450fca6"}, 0xaf) r7 = syz_open_dev$vcsa(&(0x7f0000000340)='/dev/vcsa#\x00', 0x1eb, 0x105802) ioctl$KVM_IRQFD(r5, 0x4020ae76, &(0x7f0000000380)={r6, 0xcb2, 0x0, r7}) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000005fd4)=ANY=[@ANYBLOB="4e6175bc006a9551"], 0x0, 0x0, &(0x7f0000012fc7)}) close(r0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$sock_int(r8, 0x1, 0x7, &(0x7f0000ac5000), 0x4) sendmmsg$unix(r8, &(0x7f0000000600), 0x492492492492618, 0x0) r9 = memfd_create(&(0x7f0000000080)='dev ', 0x3) write(r9, &(0x7f0000000040)="16", 0x1) sendfile(r8, r9, &(0x7f0000000000), 0xffff) fcntl$addseals(r9, 0x409, 0xd) write(r9, &(0x7f0000000180), 0x0) write$P9_RFSYNC(r9, &(0x7f0000000100)={0x7}, 0x7) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, &(0x7f0000000f4d)}) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000100)={0x4, 0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="ca7bd881f6e8042518699f8dd850a3cb96db39c1791c145a7ba08be95113da7ef2c9e25eb165c75520ea7743656c0bf727dda4ac6bcf94b75f952d786de44a6301661670f7cad3ba8818044bf588e83fba236d19ab57fd04cb233c808d60a1d629c9439160b3b17e5d3194a059b26aae0d11064e6aa1e865f1e64e4c53c2a7d243acbc32baea3f0341c16e6105b2a98525bde69a1f73b32007301dcb3e968c4f57e44da95b2732a27a8d23e54d6ee5273833ee22b39400b720db6a8cf8a0b0d8d75160e5"], 0xfffffffffffffc2b, 0x0, &(0x7f0000000680)}) r10 = syz_open_dev$mouse(&(0x7f00000006c0)='/dev/input/mouse#\x00', 0x3b90, 0x40c001) getsockopt$inet_sctp_SCTP_GET_ASSOC_NUMBER(r10, 0x84, 0x1c, &(0x7f0000000700), &(0x7f0000000740)=0x4) 04:46:07 executing program 5: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000480)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_GUEST_DEBUG(r3, 0x4048ae9b, &(0x7f0000000140)={0x1}) syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000100)=[@text32={0x20, &(0x7f0000000000)="6601669b0f35c4e1fe16846ba49e0000b9940200000f32c4c23dad78e0b9670900000f32660f38827f95b0040f01d10fc71a", 0x32}], 0x1, 0x0, &(0x7f0000000040), 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r3, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000400)=[@text32={0x20, &(0x7f0000000880)="b805000000b98b9400000f01c19a01000000b0000f43d1b8000000000f23d80f21f835800000900f23f80f060f2140b9800000c00f3235000800000f3066ba4300b8f1ffffffefb9800000c00f3235002000000f30c4c3295f4da400", 0x5c}], 0x26433e1, 0x0, &(0x7f0000000300), 0x10000000000000b6) ioctl$KVM_RUN(r3, 0x5421, 0x0) [ 620.888231] binder: 22802:22803 got transaction to invalid handle [ 620.926569] binder: 22802:22803 transaction failed 29201/-22, size 0-16 line 2834 04:46:07 executing program 3: r0 = syz_open_dev$sg(&(0x7f00000000c0)='/dev/sg#\x00', 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000000)={0x53, 0x0, 0x6, 0x0, @buffer={0x19b, 0xb8, &(0x7f00000001c0)=""/184}, &(0x7f0000000540)="ad40657ed56c", &(0x7f0000000340)=""/128, 0x0, 0x0, 0x0, &(0x7f0000000040)}) [ 620.975580] binder: 22802:22803 unknown command -1133158066 [ 620.992978] binder: 22802:22803 ioctl c0306201 20012000 returned -22 [ 621.013346] binder: undelivered TRANSACTION_ERROR: 29201 04:46:07 executing program 0: perf_event_open(&(0x7f0000000180)={0x0, 0x70, 0x175, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp, 0x0, 0x0, 0x75, 0x0, 0x5}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x4000, 0x0) preadv(r0, &(0x7f0000000100), 0x1000000000000334, 0x0) r1 = syz_open_pts(0xffffffffffffff9c, 0x8000) ioctl$KDSKBSENT(r1, 0x4b49, &(0x7f0000000300)="fb90b21bfd30c5a360b79920d770e0e84f2ea823ba90c629b40c1df571e01108c29eccce095413caaab2b116acc3e7e5dc6b160fe2c5317472f3a96798357a022919243fa5b926af4bb4afddf9be2e4cc6498fb8c9dd0dcd09da843fc6e9ee8f6a929526db69788f13a42d133fbf58fe08112a399e3b1a1a64d05f0010079d716befeae1c4f4e57fb2dbe3ce5b083c396398c9353bcb4293ca795fabdefc57e208532bda80b1aa8cd0d9b2167d3b4e53361ae7ef2327c35ed7518626c808c2091e30e2190401ddfa596785cf5be37b7ef0d1e35405fc09573c3ba2414fd31a3d1e56f914c7e144ccdc234453e33ed12c7ddf49eea40bf1d500365a") 04:46:07 executing program 3: r0 = syz_open_dev$sg(&(0x7f00000000c0)='/dev/sg#\x00', 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000000)={0x53, 0x0, 0x6, 0x0, @buffer={0x1b2, 0xb8, &(0x7f00000001c0)=""/184}, &(0x7f0000000540)="ad40657ed56c", &(0x7f0000000340)=""/128, 0x0, 0x0, 0x0, &(0x7f0000000040)}) [ 621.024647] binder: 22802:22803 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 621.059774] binder: 22802:22803 unknown command -2116518966 [ 621.101842] binder: 22802:22803 ioctl c0306201 20000100 returned -22 [ 621.158096] binder: 22802:22813 got transaction to invalid handle [ 621.204544] binder: 22802:22813 transaction failed 29201/-22, size 0-16 line 2834 [ 621.256834] binder: 22802:22803 unknown command -1133158066 [ 621.289334] binder: 22802:22803 ioctl c0306201 20012000 returned -22 [ 621.315644] binder: undelivered TRANSACTION_ERROR: 29201 [ 621.344021] binder: 22802:22803 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 04:46:07 executing program 0: bpf$MAP_LOOKUP_ELEM(0x1, &(0x7f0000000100)={0xffffffffffffffff, &(0x7f00000002c0)="0091fe9af457bf310e4caff8df6c5ea31a8dbe033fda29909080ce8236b4034be54f6353a1ea86bce9019eb5056bed1eaa5afb68e6951941fa381febcde17bf673dcdb7913f73ff6fe3c920fb89dec8047279c1a031853571f8001f022b1ceb9b8ff4adc6c61238c0e565127abea4ab15e733f49b9cd5551fc6a580d541a3199b1e69f664e6d4968f39897c7808834b14c5c90fdd67f487c6bc7bf4cf6847f43e565ee4846777564d6cfeb95605fa42b5ff7b4cbb06cd99204692cb6457f54f43e036cefa0805fb30f57b58ecf47c937c493d3e8ed5eed4f70e98390ef0e7dcc6353aecfd9297359750caa3557bb283b2a99905726335ff68868d2adc01def5afbfebb718c641ba2e5a783296af7e528197b8d2b708ea2ee3642485beb8c3930887f79d5dcf4d97df272fc50f3e5f1d4379f1e1e16e19a53148bdc22b779f935511b566609b02e4aa371b73965d71fef95fa69cf6338af32c9117cc79226501e2401ee97163dec44f09ae4984b2ec721ea87679b56cb0f8ae3a59dbd55e820cef7234be935d4be5a574a1eb9d4d62264a03dc34cda8ffa24b4a068c91abdbe4f3c7db820117ebc95c78b63f0afcf8e04b918d9b64f9d001f8ff49453261acd5370a083fb99e21173af30442ca59fb1770f6e5e5d10b5a6121252e1e30ce5b4ce967988d5238af3f175e1673bcc826e53d874119ea82a9c2bb3102d24380b3384ea89827ebd7cb75c9d02ba1949c3356e52739aeecacbc13ee764d50a6ba410bc6820a9f18ceab1b30a1484733f43994c971a73b7c2e9cbb28874a18a3be3028fe46cf13af317a21bd7608e7b83c85d4fe3e6279c924e6078efb5370b6ec247208093955e262269bd7f790a5c33f1c96aabe2052d7140cd7cc5be1c1b4c4e79ac704ddb0886dc87f98c825aa2284206cb29f38b317e4f16b9937735ec9a4fcd96407bb6d7431985f96146b02167073d0677d997bc3964d6db15c87b85a27e89460404f5451873290f75e11c3f3d71cb2cc7b0e93dc8ee340ede073e9946d639625eafd5acca5a1e9aaaa91a616b4096012a27775e546b065fb9342d5dc04cc553b9c7bd57151d8e72fb9fa58d84dd37937b9f5433ea960ebbc5cab800999eb77472bf633a6e2a7fd0969df2a55234dbd44f3b0996507a39219d8ea47481bc0ffca045ea4ce1364241be32a9f945641e2c2974c3176d530d2b84a90d4e997322584d9f57b300aef1462073dea20354eb609b0ebe06edc911a0ffc7d4f5e96d2152ea24b8e1214bbdc0efc10f10003e23b04c8f6bf2e920309c8468a4121b217858e67f5a94e1ac99ba2a4bb19bc4ba3f6291aa4a1a0ff24c4f0ade0d4247b72562076570aef926a9c676f960c6b3699f74ce6ba04b1128fd0db4139e71275e40c34f12991e1287498c58fdc01270693ad99f21fbaf3cc47ed23a1373341f2a90d37ee24788dc1000cdea1c25dd2d4f517f6b927d0df4163c1e678ff2cca85231a733ff9bee16fc0abeec0af65ea04a16c7e3d01c74f0153c91227780fe8a0602724dd7112d21446baf0304ca71f6ef10e871b1e492767d61f652ec57e20579e809b6abf2819325afaa2d3ec25712cee275cce78d227ec1ecd9aaf57e49471411538144004bf09e7d1bb4843a133982b9b96c5ddc7bcaedfd4534904c4af303cd071d3dc95f098c3c07fc12e427db79715b3e0d1bece34225896f6256205d0bdabff62608713d79b0cbc9143a41331122d1450d92e1efc6a36e849214ad152d1610c1aa73262799218a8f0fb5c7b42d2969b7da44186d2840dd038de95b623d007b5556f93fc9c2bddf18ea35da3b5d3007ac169f81ecb2ec169665a1c85bb696558361d895811e25b2ff83cf303d747ef8581d3c64dd4a0ae9c62ba43d34d9ac7477b87de7ce0eafe63a3dd9ec3f20072c99c435659827a325e330628abebc43caaf2e09faaf05ef5d95f77adbbf3d0d64a90adfdd18a2e17475e63e5bf6c94354353022fc4cfd9282769d9ad07d22e8618f8ada50c52ac01aaa59f8bcd0497e59fe57a9beb10d2fbc78de8a92af122ff67ce05537b217b7c0b00a617d9afed1befa96c11c9ad58845fd4e045a75486b75cdb52df63a4e19af929e0a23ae55640df6fdeeb42cac87923093a215eb38de629f2d9c5d475735a5f23322d1e92c860fe9116e25c507e26b28b528ae16a1a091259f7109321512c8bd262d7c9260bf386c1cc598a795786210f62b5532fa2a65c023ace9bd7f2bdac59ef4f68e7d37cd0bf13c4eeb26d662e6873e14a76fb34c967268baac4ce0eafaad71f816d0f3860fe14d127699f58d41090d8fda0f3caf5d2c3cfd10ec2456ed88c4222df0e5416345f8f5d92261ce7f6b44dfa60c90262452a41211888eb5faf69c25d780943638a0b7fb9431d9c31f74cbeface131ef0be2e9203b130381a8cfc0900c971be5a26f62e95c61c2e5ff7362744b7c749ea688b83fdd87ae333b7b974b6e869cedbacd001e94b76ace34cdb144a5680ed16ad279b8a22af2bb237cde9518b93ffba0698da6ea835f32b8d65afe4a5a87c51d05fd5268ea9152cd7fd686b9f06197b82e11ae82e2e1dbddf767608eb4310445fffeb45f4a04fdf525a44083480bec0f344ad482df09baea7b66a824b7e7efa85009a9772c04daefd0e2a051a7ea08a38fb2327d6a2cf9d52f88ac5547d89f9dae6239c562b08bf3e3d269467064bf1035c2bd1c369f23d9bcb90196ace93d5e9fa9d53fe30c27f923a979b8538108dfa2397321c16fc9f2d3e3dc45dfac2efb6e0550233856bdf481ff89acefabe01e14dd99252b70997922aa7fcd19fbc5f0814d7a8b3ed637cc3ecf583d8fd0a9cfc984043d700a24d1d64b156e57e72b78951ec64854d214282c8a828d24c10d2814902ac5d1e66a9aad0f8da848afbcdcf5a03fbda2430f3c1a54f5fd1c19825bde219827f02f8ea0d2da4bce25662f4ce5244bfc9c927379e71b16b5f2c1270234b42a61e6dd3491973b8f7861abaa1aab92912cb884fbed0c4c50d4aac7d0001676ceb15a982c90187ef842f2380fa81498e4478f32ea1f02ac1a0d158045bc62470acf3ec5c0821e39046471d525e3bc1f803c471065c2cdb2477fce79f52f9aee95fc1646f2ae373750e96b9f177b475ce5bf02ac6a7663ccfaac3966bb0f48817bea19c597c70211da99e89e080d5a12ed8649815e223d45d870b25a5e0ae877269ded0c55a3111d7565ceb5f5fb73dc958dcc25041b6dfb2295038e20cc3091b3f72218f189f31b3664bf13ccf01134cc3ec9528e3a5a3e1b25c32e522b3fdefda17f8743829f8e9f7271babf0a131eff1fd5246a09381e49d26b1321fd4d03b803676bc6402b2bc07ec4c32cfa7bec565554a200b16f2d5348b85d4b14a7527c158bea3dd2480b96ab5c6fe4d5fd69deb942ac65ac669e38e9a389f03eb9c31bc7296b0fe287633bcf3e1ac544ba17a755d33bbbe5265fbc4c6f5ee5592e90a15f4502fbe02975d7ff66bd2145384465c200f036c291d889f7d37443a72d79da50ecfb8199fe10224184d90369728246de9aa5b97b996b584afda7ae3ed0172e24256d5b1adb3edb845aefb8feb3beb70aa91405784c8ad6c8e6d6949835e6fd57fd9517d8fe4a40024232898fd281b5eb4de00c73897dc8260f9f32e1cdab5af7ae63cbb1e5da0c3421881ed479b96a3c77b6538152f7cb2f421b89888f185b6f2af9f541554e8da0ba978bb61b134c0dd57b94f3caaeb9e440d1ec408ba6b2273bbf3caec0fdd59cf8753a41b4e70f1e589a2757263e08b2c4decbc3f79690cfe8d14d3886b16d5e50d3d6d66205c0b8599ce5f7fd9e182d91661cf9f9e5798d3208cd5320b6d81ef8197891ebc0bc59e441f0072c794a81c736bd38bb07f5c05a2d804e418a1a7b30e31c584012c16983d61b8446191d37c1ca9566b07d5285a45b27d7b49dcfca20238b6b5d505376358a3029cd23bda9fe501e53ec49bbcd519bc23cb09c744268fe51dcf51ba6ff03670c7ba5f8f67968fd41d2104e6bceb1e5a70e856316b0c518ad8df3bb31a4790d8509f6bd4abe8e8092074b9f575748cc59659fc75d9ae43817fd6425a527952e15633c78e4902fda63bb47ce0a6f25c705870f011278f80dc1fe7557e47c7acaf997ecdb2399ca4aa17920b2888fa69c1dc6e5c6b0796d84e9dee1f7b565f353db8556cf84d87171d023d91b08272320dd1123be1cdcf1bd6198e64f3acd3033b93c8074ff917c442d20e367d5474421143913c324a6f1ac0cbba19ac1386dbfd9e7ec7a73be052021d61b5bdaead593b9a2e781e85c51870e4f7e57d325c15f404e3770ea3e28057cb9fcffb09978306a599fa422246620965797520bbbbe875e5414399447b6aca57f56cf6b92fb84010a8bc73a7b526b67b454572c06736a604179ddae145874567da422df5611d4276047d142a5ae477e46c602aa006c4e45a6ef7590437179d04ce4627ca3bdad0713ad7d7a26c2b86a363cfcba574f313a8e05d72822182bee8fa9cf4f93df467cde71f80f4422e91e1a338beeff45fa1e6fbeb1f6f394f70d78f73d67df5fe99430d4e3703e6ffd28ec362629dea3b713a8c0dca35daedefeec3e9977768c6de1793a5611f706b685e207f3862ee26b783b771b75e984bc6f04513269aa09baf7609859d8c491dbf684dcdc143387ba8ab640ffaf79c36e810734f7e5052e8eb361040f8fe358a196677ab85894da683897d3e925ea5a2459525f8d1265e93fd5a0de2fb5c42bd304e5911738ee6916094724a9fffb45e8d21832a6dcd1619b4215de49a8ce37e3dfb4cef89815e142fdf483057b40f5cd9b6b8f81d0fc9c2f8bf54364b7f941c256c5688a627f0ac928ac0ca4f6e223048b7a84a8cb6b3df740c0f11c87ed3ac6b8e14ada73c8a0644f729cbcb79ec4b4f06aba8ae337cc9f5fbd371b4bdb2bac", &(0x7f00000000c0)=""/20}, 0x18) bpf$OBJ_GET_MAP(0x7, &(0x7f0000004900)={&(0x7f00000048c0)='./file0\x00'}, 0x10) perf_event_open(&(0x7f0000000000)={0x2, 0x70, 0x8df, 0x80000001, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) open$dir(&(0x7f0000001080)='./file0\x00', 0x100, 0x181) getpid() r0 = openat$tun(0xffffffffffffff9c, &(0x7f00000015c0)='/dev/net/tun\x00', 0x101000, 0x0) ioctl$TUNSETVNETHDRSZ(r0, 0x400454d8, &(0x7f0000001600)=0x7) r1 = openat$cgroup(0xffffffffffffffff, &(0x7f0000000140)='syz0\x00', 0x200002, 0x0) r2 = perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r3 = openat$cgroup_ro(r1, &(0x7f0000000200)="2f67726f75702e7374619fd474002b044a7b09ab0b02e10985a6fa15b35ba69421f204dec5668a06000000b90ff860e01f262bafac750a6d5ce259cb61ea0cd94458583eef2fc597ea93a7dec9b4168e468be0576d1d0ebf8bc4478f8ed85b547c6924880400000000000000901e428b98add1375f51e135848fea98c6e3574511e0c61ff22ff61f00", 0x2761, 0x0) ioctl$PERF_EVENT_IOC_MODIFY_ATTRIBUTES(r2, 0x4008240b, &(0x7f0000001480)={0x4, 0x70, 0x1, 0x3f, 0x73a, 0x1000, 0x0, 0x8a, 0x40100, 0xa, 0x7fff, 0x7, 0x100, 0x7f, 0x0, 0x0, 0x8, 0x0, 0x4, 0x1, 0x9, 0x5, 0xafa6, 0x100000000, 0x5, 0xfffffffffffffffe, 0x79a3, 0x8001, 0xfffffffffffffbff, 0xaaf, 0x0, 0x4, 0x0, 0x3, 0x100000000, 0xfffffffffffffffd, 0x2fdb, 0xb8, 0x0, 0x8000000, 0x4, @perf_bp={&(0x7f0000000080), 0x4}, 0x10000, 0x639, 0x0, 0x0, 0x800, 0x7, 0xfffffffffffffffd}) ioctl$PERF_EVENT_IOC_ID(r2, 0x80082407, &(0x7f0000001380)) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000024c0)=[{&(0x7f00000023c0)}], 0x1, &(0x7f0000001580)}, 0x0) ioctl$PERF_EVENT_IOC_PERIOD(r3, 0x4030582a, &(0x7f0000000000)) syz_open_dev$usbmon(&(0x7f00000010c0)='/dev/usbmon#\x00', 0xffffffffffffffff, 0x201) openat$cgroup_ro(r3, &(0x7f0000001580)='cpu.stat\x00', 0x0, 0x0) socket$kcm(0x29, 0x8000b, 0x0) 04:46:07 executing program 1: r0 = perf_event_open(&(0x7f000025c000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000001}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = dup3(r0, r0, 0x80000) ioctl$KVM_GET_NESTED_STATE(r1, 0xc080aebe, &(0x7f0000000100)={0x0, 0x0, 0x2080}) r2 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r0, 0x2405, r2) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x1000004, 0x8031, 0xffffffffffffffff, 0x0) 04:46:07 executing program 3: r0 = syz_open_dev$sg(&(0x7f00000000c0)='/dev/sg#\x00', 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000000)={0x53, 0x0, 0x6, 0x0, @buffer={0xe8, 0xb8, &(0x7f00000001c0)=""/184}, &(0x7f0000000540)="ad40657ed56c", &(0x7f0000000340)=""/128, 0x0, 0x0, 0x0, &(0x7f0000000040)}) 04:46:07 executing program 5: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000480)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_GUEST_DEBUG(r3, 0x4048ae9b, &(0x7f0000000140)={0x1}) syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000100)=[@text32={0x20, &(0x7f0000000000)="6601669b0f35c4e1fe16846ba49e0000b9940200000f32c4c23dad78e0b9670900000f32660f38827f95b0040f01d10fc71a", 0x32}], 0x1, 0x0, &(0x7f0000000040), 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r3, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000400)=[@text32={0x20, &(0x7f0000000880)="b805000000b98b9400000f01c19a01000000b0000f43d1b8000000000f23d80f21f835800000900f23f80f060f2140b9800000c00f3235000800000f3066ba4300b8f1ffffffefb9800000c00f3235002000000f30c4c3295f4da400", 0x5c}], 0x26433e1, 0x0, &(0x7f0000000300), 0x10000000000000b6) ioctl$KVM_RUN(r3, 0x4020940d, 0x0) 04:46:07 executing program 4: ioctl$KVM_IRQ_LINE(0xffffffffffffffff, 0x4008ae61, &(0x7f0000000500)) r0 = syz_open_dev$dspn(&(0x7f00000004c0)='/dev/dsp#\x00', 0x1, 0x0) openat$audio(0xffffffffffffff9c, &(0x7f0000000000)='/dev/audio\x00', 0x80, 0x0) ioctl$KVM_SET_FPU(0xffffffffffffffff, 0x41a0ae8d, &(0x7f0000000100)={[], 0x0, 0x5531fee, 0x0, 0x0, 0x9, 0xf000, 0x0, [], 0x5}) syz_open_dev$usb(&(0x7f0000000440)='/dev/bus/usb/00#/00#\x00', 0x9, 0x2) r1 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) lstat(&(0x7f0000000040)='./file0/file0\x00', &(0x7f0000000080)) ioctl$EXT4_IOC_MIGRATE(0xffffffffffffffff, 0x6609) sendmmsg$unix(0xffffffffffffffff, &(0x7f000000a000)=[{&(0x7f000000a000)=@abs, 0x6e, &(0x7f000000d000), 0x0, &(0x7f0000000600)=ANY=[]}], 0x1, 0x0) r2 = socket$inet6(0xa, 0x2, 0x0) gettid() r3 = getpgid(0x0) kcmp(0x0, r3, 0x0, 0xffffffffffffffff, 0xffffffffffffffff) connect$inet6(r2, &(0x7f0000002740)={0xa, 0x0, 0x0, @mcast2, 0x4}, 0x1c) sendmmsg(r2, &(0x7f0000007e00), 0x136a88c8311572c, 0xeffdffff) setsockopt$inet6_udp_int(r2, 0x11, 0x0, &(0x7f0000000400), 0x4) openat$kvm(0xffffffffffffff9c, &(0x7f00000003c0)='/dev/kvm\x00', 0x0, 0x0) ioctl$VHOST_SET_VRING_CALL(0xffffffffffffff9c, 0x4008af21, &(0x7f00000002c0)={0x0, r1}) ioctl$SNDRV_TIMER_IOCTL_TREAD(r0, 0x40045402, &(0x7f0000000740)) inotify_rm_watch(0xffffffffffffffff, 0x0) ioctl$ifreq_SIOCGIFINDEX_team(0xffffffffffffffff, 0x8933, &(0x7f0000000480)={'team0\x00'}) 04:46:07 executing program 2: r0 = syz_open_dev$mice(&(0x7f0000000000)='/dev/input/mice\x00', 0x0, 0x0) setsockopt$inet6_mtu(r0, 0x29, 0x17, &(0x7f0000000040)=0x1, 0x4) r1 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) fcntl$setsig(r0, 0xa, 0x8) write$apparmor_exec(r0, &(0x7f00000000c0)={'exec ', '*\x00'}, 0x7) r2 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, &(0x7f0000012fc7)}) close(r1) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, &(0x7f0000000f4d)}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000100)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0xfffffffffffffc2b, 0x0, &(0x7f0000000680)}) 04:46:07 executing program 3: r0 = syz_open_dev$sg(&(0x7f00000000c0)='/dev/sg#\x00', 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000000)={0x53, 0x0, 0x6, 0x0, @buffer={0x2, 0xb8, &(0x7f00000001c0)=""/184}, &(0x7f0000000540)="ad40657ed56c", &(0x7f0000000340)=""/128, 0x0, 0x0, 0x0, &(0x7f0000000040)}) 04:46:07 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) pipe2(&(0x7f00000001c0), 0x80000) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, &(0x7f0000012fc7)}) clock_gettime(0x0, &(0x7f0000000140)={0x0, 0x0}) select(0x40, &(0x7f0000000000)={0x2, 0x527d, 0x80000001, 0x6, 0xffffffffffffffff, 0x5, 0x100000000, 0x8000}, &(0x7f0000000040)={0xa000, 0x80000001, 0x7, 0xeb93, 0x2, 0x4, 0x9, 0x8}, &(0x7f00000000c0)={0x7, 0x8, 0x8, 0x800, 0x100000001, 0x6, 0x19e, 0x7}, &(0x7f0000000180)={r2, r3/1000+30000}) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=ANY=[@ANYBLOB="23b4003791000000"], 0x0, 0x0, &(0x7f0000000f4d)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000100)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0xfffffffffffffc2b, 0x0, &(0x7f0000000680)}) 04:46:07 executing program 4: ioctl$KVM_IRQ_LINE(0xffffffffffffffff, 0x4008ae61, &(0x7f0000000500)) r0 = syz_open_dev$dspn(&(0x7f00000004c0)='/dev/dsp#\x00', 0x1, 0x0) openat$audio(0xffffffffffffff9c, &(0x7f0000000000)='/dev/audio\x00', 0x80, 0x0) ioctl$KVM_SET_FPU(0xffffffffffffffff, 0x41a0ae8d, &(0x7f0000000100)={[], 0x0, 0x5531fee, 0x0, 0x0, 0x9, 0xf000, 0x0, [], 0x5}) syz_open_dev$usb(&(0x7f0000000440)='/dev/bus/usb/00#/00#\x00', 0x9, 0x2) r1 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) lstat(&(0x7f0000000040)='./file0/file0\x00', &(0x7f0000000080)) ioctl$EXT4_IOC_MIGRATE(0xffffffffffffffff, 0x6609) sendmmsg$unix(0xffffffffffffffff, &(0x7f000000a000)=[{&(0x7f000000a000)=@abs, 0x6e, &(0x7f000000d000), 0x0, &(0x7f0000000600)=ANY=[]}], 0x1, 0x0) r2 = socket$inet6(0xa, 0x2, 0x0) gettid() r3 = getpgid(0x0) kcmp(0x0, r3, 0x0, 0xffffffffffffffff, 0xffffffffffffffff) connect$inet6(r2, &(0x7f0000002740)={0xa, 0x0, 0x0, @mcast2, 0x4}, 0x1c) sendmmsg(r2, &(0x7f0000007e00), 0x136a88c8311572c, 0xf7ffff7f) setsockopt$inet6_udp_int(r2, 0x11, 0x0, &(0x7f0000000400), 0x4) openat$kvm(0xffffffffffffff9c, &(0x7f00000003c0)='/dev/kvm\x00', 0x0, 0x0) ioctl$VHOST_SET_VRING_CALL(0xffffffffffffff9c, 0x4008af21, &(0x7f00000002c0)={0x0, r1}) ioctl$SNDRV_TIMER_IOCTL_TREAD(r0, 0x40045402, &(0x7f0000000740)) inotify_rm_watch(0xffffffffffffffff, 0x0) ioctl$ifreq_SIOCGIFINDEX_team(0xffffffffffffffff, 0x8933, &(0x7f0000000480)={'team0\x00'}) 04:46:07 executing program 5: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000480)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_GUEST_DEBUG(r3, 0x4048ae9b, &(0x7f0000000140)={0x1}) syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000100)=[@text32={0x20, &(0x7f0000000000)="6601669b0f35c4e1fe16846ba49e0000b9940200000f32c4c23dad78e0b9670900000f32660f38827f95b0040f01d10fc71a", 0x32}], 0x1, 0x0, &(0x7f0000000040), 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r3, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000400)=[@text32={0x20, &(0x7f0000000880)="b805000000b98b9400000f01c19a01000000b0000f43d1b8000000000f23d80f21f835800000900f23f80f060f2140b9800000c00f3235000800000f3066ba4300b8f1ffffffefb9800000c00f3235002000000f30c4c3295f4da400", 0x5c}], 0x26433e1, 0x0, &(0x7f0000000300), 0x10000000000000b6) ioctl$KVM_RUN(r3, 0xae8b, 0x0) 04:46:08 executing program 3: r0 = syz_open_dev$sg(&(0x7f00000000c0)='/dev/sg#\x00', 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000000)={0x53, 0x0, 0x6, 0x0, @buffer={0x1f9, 0xb8, &(0x7f00000001c0)=""/184}, &(0x7f0000000540)="ad40657ed56c", &(0x7f0000000340)=""/128, 0x0, 0x0, 0x0, &(0x7f0000000040)}) [ 621.891725] binder: 22860:22866 unknown command 922792995 [ 621.925574] binder: 22860:22866 ioctl c0306201 20008fd0 returned -22 04:46:08 executing program 0: sendto$inet6(0xffffffffffffffff, &(0x7f0000000000)="5fb88c750196077aa3214bebc13f7d74ad4d9320611cf5a33f2a3f09e1c926359dcfe20001c781cb67f79cb0c6f5f4bf8ed60dce2176c22a20b22b9b24172b5569ec67906e7df93b05b19ba5360f2eab62812070fc181a2483366595113b240804d882a7dcd7ac4ba53e06d02558968b978122716d1823dcc7d40155c1bc1e8433f5ba15f5ee48c0ca941fce872e497d1377e2a5bde956f003caaf58c7520f82d7346c266e8ea70dab3bb7af6d78602a31ab8d232b07f6e3ef524b552ed88a1b1c02bc89f4f671855d40a2c1c173d4bb121bc86270c32d39c4c0d09a29b8983169914d8df86417a802b772bb638f72ccdcbb46267b5751816c77b6739f484292d5ca5e1bc4efee06f4e07e6a795faee2af27a8f212", 0x115, 0x0, &(0x7f0000001000)={0xa, 0x0, 0x0, @mcast2}, 0x1c) pipe(&(0x7f0000000200)={0xffffffffffffffff}) setsockopt$XDP_UMEM_COMPLETION_RING(r0, 0x11b, 0x6, &(0x7f0000000240)=0x1, 0x4) r1 = syz_init_net_socket$bt_l2cap(0x1f, 0x3, 0x3) ioctl$FS_IOC_GETFSLABEL(r1, 0x400452c8, &(0x7f0000000100)) bind$bt_sco(r0, &(0x7f0000000280)={0x1f, {0x3, 0x2, 0x670c6d7b, 0x5, 0xff, 0x1}}, 0x28b) [ 621.967064] binder: 22860:22870 unknown command 922792995 04:46:08 executing program 3: r0 = syz_open_dev$sg(&(0x7f00000000c0)='/dev/sg#\x00', 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000000)={0x53, 0x0, 0x6, 0x0, @buffer={0x1b8, 0xb8, &(0x7f00000001c0)=""/184}, &(0x7f0000000540)="ad40657ed56c", &(0x7f0000000340)=""/128, 0x0, 0x0, 0x0, &(0x7f0000000040)}) [ 622.040490] binder: 22860:22870 ioctl c0306201 20008fd0 returned -22 04:46:08 executing program 5: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000480)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_GUEST_DEBUG(r3, 0x4048ae9b, &(0x7f0000000140)={0x1}) syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000100)=[@text32={0x20, &(0x7f0000000000)="6601669b0f35c4e1fe16846ba49e0000b9940200000f32c4c23dad78e0b9670900000f32660f38827f95b0040f01d10fc71a", 0x32}], 0x1, 0x0, &(0x7f0000000040), 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r3, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000400)=[@text32={0x20, &(0x7f0000000880)="b805000000b98b9400000f01c19a01000000b0000f43d1b8000000000f23d80f21f835800000900f23f80f060f2140b9800000c00f3235000800000f3066ba4300b8f1ffffffefb9800000c00f3235002000000f30c4c3295f4da400", 0x5c}], 0x26433e1, 0x0, &(0x7f0000000300), 0x10000000000000b6) ioctl$KVM_RUN(r3, 0xae10, 0x0) 04:46:08 executing program 4: ioctl$KVM_IRQ_LINE(0xffffffffffffffff, 0x4008ae61, &(0x7f0000000500)) r0 = syz_open_dev$dspn(&(0x7f00000004c0)='/dev/dsp#\x00', 0x1, 0x0) openat$audio(0xffffffffffffff9c, &(0x7f0000000000)='/dev/audio\x00', 0x80, 0x0) ioctl$KVM_SET_FPU(0xffffffffffffffff, 0x41a0ae8d, &(0x7f0000000100)={[], 0x0, 0x5531fee, 0x0, 0x0, 0x9, 0xf000, 0x0, [], 0x5}) syz_open_dev$usb(&(0x7f0000000440)='/dev/bus/usb/00#/00#\x00', 0x9, 0x2) r1 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) lstat(&(0x7f0000000040)='./file0/file0\x00', &(0x7f0000000080)) ioctl$EXT4_IOC_MIGRATE(0xffffffffffffffff, 0x6609) sendmmsg$unix(0xffffffffffffffff, &(0x7f000000a000)=[{&(0x7f000000a000)=@abs, 0x6e, &(0x7f000000d000), 0x0, &(0x7f0000000600)=ANY=[]}], 0x1, 0x0) r2 = socket$inet6(0xa, 0x2, 0x0) gettid() r3 = getpgid(0x0) kcmp(0x0, r3, 0x0, 0xffffffffffffffff, 0xffffffffffffffff) connect$inet6(r2, &(0x7f0000002740)={0xa, 0x0, 0x0, @mcast2, 0x4}, 0x1c) sendmmsg(r2, &(0x7f0000007e00), 0x136a88c8311572c, 0x2000000) setsockopt$inet6_udp_int(r2, 0x11, 0x0, &(0x7f0000000400), 0x4) openat$kvm(0xffffffffffffff9c, &(0x7f00000003c0)='/dev/kvm\x00', 0x0, 0x0) ioctl$VHOST_SET_VRING_CALL(0xffffffffffffff9c, 0x4008af21, &(0x7f00000002c0)={0x0, r1}) ioctl$SNDRV_TIMER_IOCTL_TREAD(r0, 0x40045402, &(0x7f0000000740)) inotify_rm_watch(0xffffffffffffffff, 0x0) ioctl$ifreq_SIOCGIFINDEX_team(0xffffffffffffffff, 0x8933, &(0x7f0000000480)={'team0\x00'}) 04:46:08 executing program 1: r0 = perf_event_open(&(0x7f000025c000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000001}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = dup3(r0, r0, 0x80000) ioctl$KVM_GET_NESTED_STATE(r1, 0xc080aebe, &(0x7f0000000100)={0x0, 0x0, 0x2080}) r2 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r0, 0x2405, r2) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x1000004, 0x8031, 0xffffffffffffffff, 0x0) 04:46:08 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x800) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, &(0x7f0000012fc7)}) r2 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000080)='/dev/rtc0\x00', 0x200080, 0x0) ioctl$SNDRV_TIMER_IOCTL_START(r2, 0x54a0) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, &(0x7f0000000f4d)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)}) 04:46:08 executing program 3: r0 = syz_open_dev$sg(&(0x7f00000000c0)='/dev/sg#\x00', 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000000)={0x53, 0x0, 0x6, 0x0, @buffer={0x8e, 0xb8, &(0x7f00000001c0)=""/184}, &(0x7f0000000540)="ad40657ed56c", &(0x7f0000000340)=""/128, 0x0, 0x0, 0x0, &(0x7f0000000040)}) 04:46:08 executing program 0: setxattr$trusted_overlay_opaque(&(0x7f0000000000)='./file0\x00', &(0x7f0000000040)='trusted.overlay.opaque\x00', &(0x7f0000000080)='y\x00', 0x2, 0x3) syz_mount_image$erofs(&(0x7f00000000c0)='erofs\x00', &(0x7f0000000100)='./file0\x00', 0x400, 0x5, &(0x7f0000000380)=[{&(0x7f0000000140)="a96ef97d7de6d7cb71c9bea40c863d911809be237b75437c75b81b5ba0ee5905dd2e91497d2cd4bd5a447b49ef35e3ff6eed50dd576a6095d464cf67966d3408d6f555485d340a4994b4ad48918271ec11d1f7b39983f97dca94b04fe7ba92579e8d48e8830311fe485683c1df7b0d574bad2bdddc2d0c372eeb093447ec41685d181a17", 0x84, 0x9}, {&(0x7f0000000200)="7a35b82c08e403a867c7152ab31f432f27400111f87cd2a163c5e106488a0344b7b3c7e5", 0x24, 0x3}, {&(0x7f0000000240)="e79a5a8978cb97ad05bf3a085e48d8210dd17b8bbd9dda1ac3a457e8dba41c7c1f0ad97b4fbf8aebe6c7e877f1df02a6952d30828026e8e1ecde5eecc49f5d7aef9d75dab9fcca98c8ba7f1a62ad611bc6117f928995d13bd058c074b18d47f64582aa6d20a0ac60b21811c9b44bf4542759fab1066f92bad5492804f1f020ceb2fa86630785672018fc036fcb4a36bef030f0b7df4d576851890dd3ffad8499d74b9868cfea67e87b86b3f216", 0xad, 0x9}, {&(0x7f0000000300)="65dccdc70381fcaa7f", 0x9, 0x5}, {&(0x7f0000000340)="017560a46cc6f1c6178d96d1f5c877149eb1b9dd620c1e138e", 0x19}], 0x800004, &(0x7f0000000400)={[{@nouser_xattr='nouser_xattr'}, {@fault_injection={'fault_injection', 0x3d, 0x1a}}, {@noacl='noacl'}, {@fault_injection={'fault_injection', 0x3d, 0x9}}, {@acl='acl'}, {@acl='acl'}, {@noacl='noacl'}, {@fault_injection={'fault_injection', 0x3d, 0x40000}}, {@acl='acl'}], [{@subj_type={'subj_type', 0x3d, 'trusted.overlay.opaque\x00'}}, {@obj_role={'obj_role', 0x3d, 'y\x00'}}]}) r0 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f00000004c0)='cgroup.stat\x00', 0x0, 0x0) ioctl$sock_inet_udp_SIOCINQ(r0, 0x541b, &(0x7f0000000500)) getsockopt$inet_sctp_SCTP_LOCAL_AUTH_CHUNKS(r0, 0x84, 0x1b, &(0x7f0000000540)={0x0, 0xb6, "86ceeaab6e0b51f34676a2d639b1cf2e6f58c3f6a251cc5f989332b277c8c988b2ccb2b99d247c05c63e44b3bdd105831210c46e9b474b5a1af84a76066b2e1de3ed12c8308085b9c0775ca57f76a8f69535cd5066442bb798c985fd9b80bd33851711c2af6340db3e79311f0b2e7ae27a7c4c2583547aecfbf807517c935b654815560cdc71a57a938f71159139d3393d057d6405ca27cce0af8ef3fc4abd78b71d9762f1ab44a3dbb441a46ef8f666ca2d467b351f"}, &(0x7f0000000600)=0xbe) getsockopt$inet_sctp6_SCTP_PR_SUPPORTED(r0, 0x84, 0x71, &(0x7f0000000640)={r1, 0x1}, &(0x7f0000000680)=0x8) r3 = dup(r0) getsockopt$inet_sctp_SCTP_CONTEXT(r0, 0x84, 0x11, &(0x7f00000006c0)={r2, 0x1}, &(0x7f0000000700)=0x8) setsockopt$SO_VM_SOCKETS_BUFFER_SIZE(r3, 0x28, 0x0, &(0x7f0000000740)=0x200, 0x8) kexec_load(0x8000, 0x2, &(0x7f0000001880)=[{&(0x7f0000000780)="e0a84e90ec5583666e7f1bf597bea23e81e64b46a7a3bd2bba7aa42625a2d7182143756159359bd5c9fe12eb6f1c4a6f1818059b1bb717b8729c7aa96937d68d90fcb65625b064e33c457d504a2a3b40cf9c8c8bdfdfd6fe9dce6249b50aefb203d4ef92838b38f75e3cd2521b664da137683ba7260cd62717b5f33947310a15858d245b16705ba960d10e8d472bfa5b58dbdf8027f58b620d06e1f7be25d2ad6fa9949973d9de10b635f6b93c24bd8b5d44bd0ae6602d34ee0becf7c0a070f4e5a07f14cbfdb8fe1b251dca11c341a64b808cda2ce82657810c94d39d7077f30d0122e085fa9d25ce63f1a5a4dc185f50fcb98bbc451a58748d0a75366d8b73cf44eb41f465651f1fba34bb4baa688e81f835e462e21dfb7b0d31d4d3f9cac1520fd5938a77821721e459c5e672b6d55f863d49dbfac8192e51ad8a0af553cedecf1c809fd91952523a5e0eefd96a53fe44bcffa25e33dac9e9f0f98a2b940775fb6692ce02622d288f3ad818e9288abf9d18fa7a391107e10aaadda40facc4430ea2ed76547b2eea0d584505a7c99d483805ed249f22285b196e33094df2389f0b99b185ab079c277ca128421940cbf7e6b0ffc791bccb227e66773ff6e435e802c334b2dcf662013f72312277383a79e33c00d2ff83d010ddd4800aed02bad86a8cba540f63a3a3a78fe84e8a6b6ffa5e7eb53bea42b27cda3f624b1e70a8d1668df25ff6831fd5d993d59d024d3b02c34036ff6d1d83b682acdf00ef851cd025662ddbc8ac4b41f74250c2b933cc36aefbf8e517dd151e60a0b95892d09cca5a85ba17d265f047d6c01795801a189b370a250da2dfd211ace19baf8d934afb4dd4a95426c5a259e4de87b82c6a16edc1420d368b2d1ca7ccb65f7af00249cd35ff7130160fdb05f4f51afaee7ec5dc49aabda48d0deecb64b7c27cdb35599afe8e2b9e89825f6dd96ab95e448ec1d42b9779915caaa56a89c5563331cb439fe678338bff881b08f5d182dd8c971c9d24a9e94089030d18f478ba622c8dbdc89e3e53702ea8e3a11f6a1cab05485a96b8ebb3b0e07270a9849f4e0d2037db188ef7f18e19faf9e873947c8609aacded8e7074528c2a712bc2d053760df733db81d80c33b86c38a8d34dbea34195d19c5d009316011f2e58d5cbe0c13aac40cd588e81f2833dab781006449671f1219883e542ff312ada7d524cf68420f3ea5c8778ff8a73c1ff8d45682d45171c15423131368b722140af8ab9b28182eebc26c254cd85b8a34f0100929cd230c562d00a7edb6cf92f3e2db37e00104ebd5d94f9ca4a97bee05f282a72a69be62e349d56fd3189d2634c485dd3f4e4f34b03bd3bbe657bf389d234a561dd405bbb8be1b7e1f36c9d076a25b2d375918a50db2a3f11203ebcb7ee1b703a7d622ccad6f6ce8c63f2935604fd1053746a9e3de865306a715fb87c99ec4aade1684eeb2fc1c88ebf834be51d774fead3726b3e92d0b1c2235048ee2bb19df3f3cbaf4871171881aa0bb7887d167d5457aba5fc6e3b291855a379a5c3d6e7be196a2da9a79f4b0ec96c3536ba86b8735162071ac28826754438825100b31028e9f9d25cf6ad9dbd786ca8f778823a24681ccb34ec3ba95f0cff38bd6338f1db7c6bb54e246b22bb3ae462cec2afa1baea2ea2cd8fbc55c595add2e97714edca13802a6659949e1ed7ec7791f10c0ac622332f312a8172ff52574e74bd3127e58b214f0939c40048f5f0a80f319feb04dbcd42a489c0e12911097c780c5e1bcdcd64104f2c25d4fdb6ae4cab8352d332b659978564d484f92bed75f2c3de67cab1b8f85f1214fca9fbcd095de623b2a1e01334928b153afc19be0b67ed1348d1c85f0a87dbb6799b02ac5456072029585620596d1010556bf1d9b49a2a9c809aff5df4ff932627dcc83515ea4f477536cc3aa208c236963d9de3672e1e2d1a35fa5a0cd40750f99ac8d162f47cc284649ef7f005377786a9f130d8e1a04ccff8c8aab29cd14a3b3c760e1f66153803d19cb618f51c7cf9a4aebd220e47d2b6e5515c1fc46513a198c5c7d7ac67ca61e44e347415c3e00d9ea94bae771f3774370c3a5044745cb2a98bc5798f2348ebd9670d0f0c30fc19cdcdad94f811313287d70c92a474943fbc950a39baa5bfdd1cdd1b216de425ef1e95748eabd4aec579ce9d88cb23bad2b583fd51c13a21b15caea404fb1c4dd26224ee57dc928b858fe13ccfbf7342f62d69b6c5768da0e6bd6253b0e6b11bc799d9bf644272775aa7ba82ea2f63df9cb95d842fb8983beff4049e9adc65c390983b80b2afd79af4569f1a26d1ca8bc455c0e8c984a66d18eda865989fa4b8131ceb11c08da51ab577304d3f611d4ff930b4a8b855f71da027a36da621d8fa6290e0f0b4e23cfdf61c3cc960bf94688ac310e4f4dc94004507485876e24c8c89e6d04818d85f78f24add21906ac3609e850a514227f9595cdd54d76e3d801dbcbfa8c382ddc7152367451c5b337753b754b2307c56a8b2ec1cb679d92261ca5ad46a67f4b0cf938af09c08817b028343c60b0c0680b8de74e8adfdcfb24d95b9250dd1710ef262073c7dfdae3ec01c95c752cdfe887b7d90615d24e0597f556c0837e52fd2d4a96eb32273a2dc0b86197d47266ae89545aa110051074e04e7d8c7a6d277f3960005a1adfcfdadf0626d8c6645de99d3893bd56ad3acb1e60587de14cc50b798ee3ee04cb2ec74551e5416c94068c7aecf720c9789ba507172bbeb096843e3f278b8a084976d3a4700d72bc6f6da032ab134c356ded222f52ba528a77713120aae353f62552d7d33452651b7333c949ae4dc9041cd27c8e249098fb5e233e273c951248706744087bc5a32cec82a9815cbe6c01e5d1277b071f76612d43fc3285e983e79d63d3f3502631f9b42145b7a3077d925111d455c0f21ed11b98426b72d168122fd42430fff3f44ea87619557dd3c6f498c09df3adae96375e6c50fbaae05676df0c955edbe12021270a0d592b2c54bcf44e18702faa4aef2d6d23e975bbf78af881d2b08d79d5cc5f894b215485cb445b1f81afac2c4917abd21712558191d11399220f3dd33f095da42de577eaca134fd989e901db82dd52e83da3e08762d8e82b91d2f0e2c19703921db1ee16cbc3e1f73d2fed89813ab79a5b29d1e08d3dd7cb09dadba81661170fcb980229cdda4fbf4d2364662126377c1e2af505b0cde812f4418dc7abe376e382b0014f1f5912e274c3ae94d3a2282aa66960ce7238a7e1ca7df3b34074a06b1d3c36d66e196efb88acbbfe93367b31a74d36c7b54fab67ce1a5fa952b3f54e17d7f140a6a58913bc261cbbfe7086d6428aa7b45818ca5c08132f22f9c94f23d6ec2a6cbbbe147122a2047937c69062070681ca3625451bfe30a46c1b0bbf9578a1d0b436d757e3b6bc1c2fcab2e360686141c84dab1f4f0b937908a175e79469deeb6ba7642f292127660e56ad6c4ad1787c531cf14d7d9a424a99b005440171820e81a767f95d0bd0508d6d2ebe72cb8dc23831ab93ccc64356b65ff588a12793cd9f373a7892d96a334989632612794a8bf03e890916f4af08a5c2c52cb3e6fb1215cf39699d1a1b7d3c784277b512aa3b8b4758dff696f4c12141330fd85d518cacf3e025da112d28563dc7f5d19bb82f9adc936c36debcff110a066a348b558b0fdbd22217e5f2aaf8a4a0e72365447d1389270cdd1c27ebbfe8db032067af4913b64de9e1d70f229584170d3b565cd5ae444911f86482d83662fbf7e629ba1dff6c87371961cf32b33d3693f1f0eb7338d656bb7c24a6b0007e7328fcc5e64518ccd66bbd32a9321f400fe2489004bf41e28660b4780d18862f8da779a3fc94d110113f55edc9ec9588ed7267eae73e060c9fe9cc1d994a2649bca8099410038d7c9ccb156c727fafcdfbd7afb38d255f604ac3aa92174d6252e70753f7f12556137e5282fff68a9b8325bd5a67d78274eea754fb600afe3ec38bd48576f0c1075f39500d16748e525c08cd6b022f3219eadbbb2fa4ecc53ec744d7b1699de1ed652c42b95a332320374182786f705b4bcdc3e5166973ba46ec1b8469d366838c6cac1981a0caccbf6210f5b999c87dbb4c6e2fb45fdac2731a24721a779d3343b7b3349a9510816b7cee3d9f235081c34f07ef0533c17885772274bbd9f23c29de6f7a67a23162ae70f5497b876d9a9d21873273c051dc2bd88f23b934ba716af006f793668c86505ccfffbe7025c6caf6552d3d96823607914872eb09cbab74dd6473a07829c914d92d1d106ae5e841289bdbc6b8d57b1115b590317eaee8ccb39f63f4c20815a40fbf21d8dc7454424760fbfcd54a903a90c7272eec765929ecd80460cbc0985b6d81fea0033938f2a2e2f616507d2ade57e4a9f4fecfbe7944636e9499d8365ea1fd6740fbf59e20766e33376862e8f5e56405797381962a8537510f31d6a0328953d097140ef1dae53c92a08671ec0df261f9530b2675719b723840d18830f03b0ff60dd2a7280fd723ea035794319b71e722b8e4ae506d95612fd4f7deba1d365e55e9f04705b550eb3c868f9df15b798425a12ac08140eb1b791982f2f76042d5ca8a160a58c5a411ff6c263ec2f94c44a619688e2523523d7e8efcd945633e353a73d68cf471db88d0a857382a37880219e306bffeb52794591e7ffae4bb21080e20462de0cb432443ec01ea8e3521b728d5d57145745376c6d9c6b1d02918032f12062a7c65b9d6a411fa15e6d208158b92b006b6b58f6e085288c01ce8da3f846d72141f2ec4180e00abd74a9935a9415f42214ba1aed8f1333de2fe7c1ba2be7d40f60684d1da32c11a200573be6dd94797d51641043549b91504d44816cfccfb723d30604d5691ed2da6c6f84502b16fabc4849d3c19ed44468ac478dcf46f82394fea2e218a778948b215a638bab8295083d372616a7cdd514c5d536c7f3dbf69987bddaf0acfc8e445660184c4f04227494e1078d8bc948ca7aa3fd779e3c969ea51642b4142a240656ebc95b2e1146602b6d2d145e082d9b9d6ab3cc17d9140915d203c5a1819604c26cd4a44c132dab798e0c24ac7ba78883aeaf51165a8fb9c4c4bc970a45d6bfcb961619aee38ddb19f49ca3d772c3bb32acfff2525f678a857ef516b34b13803e132ae6a71030c6ae0d2be381cc008c17b5a4867822dc3a67383029ad5c68dce2d9f3332c1aae3aa1fe36ce64b0e81a28b6305bd0dec70d0d7b9340a5b9a363fe32c3cc0b4cbbb30b684c3bbeb2bb563f568e5ac53bd5539e50b0b6f4145b73f70b9dcd26dd303df7a6f557289a95ff8e4aefa0951dc38426eb8af041af34f3d5a4fb555c238d5ef0a174fe75b9151154591118ad2d2e95f59254462ec1438be331c16fa32c877ca47f6c55b263a810a82950aeb9ce16b6bc807be0dcc7010cb05502f52729861d1d2383ba5639b0c67ac699314ded74d337d3cf2c1b6fdf93b81873fab2ade3720bf9e89480fa136b16ff7a6ac0ec4b5c2236ad2aad5ce5455faa2d219082ca6776d7f83aa79a4ac2ccf023aac9ab730fd26340702141eba9706ad01713d579f191ad709c9749c885de745a26244d7d5601fd9ba1108451478749378915fcdf3278667274c6cd46a4328bd6bc13e36efda6f7aacc1bc97030ffd3b02370b95ee90db83d40ca28f38b5ab8c5c9b4fbec90a544c49983393d9657ca30cd340f9a14e9372fdf8cd2ff82385710f82414476164f577dd1c48948181d8a93d2ea7e977dfc853f21b7229efd3", 0x1000, 0xc2, 0x20}, {&(0x7f0000001780)="6a0bb5fc314ed653eee29722aeb1dbc6e2e71cf5d01ec30edaf8142fb7e57d06279312e9356f6109b43e615af563395936b68f1136494b88884eaefcbfa4016956e05ba87b064c76c94f4b0c32dbf883af127745fba58cdf39799d99bc3e9f0c2ea09470bdf656ec9ddf88edebc9ca6f5820bbe772a38e3db54e457ae26d08941cf58d0909b128964b9da17314d33f84f4873c8ae87d8665b16e7c25bfd94e84b85c727dcc43a91c0bd1da2c991c5688e5a45a29454cf4c5223de2ea9d3204d6644eebf1e363358e8fdc", 0xca, 0x4, 0x1}], 0x140000) r4 = getuid() stat(&(0x7f0000001940)='./file0\x00', &(0x7f0000001980)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) lstat(&(0x7f0000001a00)='./file0\x00', &(0x7f0000001a40)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) stat(&(0x7f0000001ac0)='./file0\x00', &(0x7f0000001b00)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) getresgid(&(0x7f0000001b80), &(0x7f0000001bc0), &(0x7f0000001c00)=0x0) lsetxattr$system_posix_acl(&(0x7f00000018c0)='./file0\x00', &(0x7f0000001900)='system.posix_acl_default\x00', &(0x7f0000001c40)={{}, {0x1, 0x1}, [{0x2, 0x6, r4}], {0x4, 0x4}, [{0x8, 0x5, r5}, {0x8, 0x3, r6}, {0x8, 0x4, r7}, {0x8, 0x0, r8}], {0x10, 0x1}, {0x20, 0x1}}, 0x4c, 0x1) r9 = getpgid(0xffffffffffffffff) perf_event_open(&(0x7f0000001d00)={0x1, 0x70, 0x8, 0x8000, 0x100000001, 0x42d4164a, 0x0, 0x4, 0x20000, 0x8, 0x20, 0x1, 0x2, 0x31b, 0x40d, 0x3f, 0x81, 0x3ff, 0x7fffffff, 0x6459, 0x6, 0x800, 0x401, 0x270, 0x100000001, 0x0, 0x9, 0x0, 0x3, 0x93, 0x0, 0x5, 0x53, 0xffffffff, 0x3, 0x234, 0x8, 0x7ff, 0x0, 0xffffffffffff40d2, 0x3, @perf_bp={&(0x7f0000001cc0), 0x3}, 0x8000, 0x5, 0x1, 0x1, 0xeb, 0x401, 0xed}, r9, 0x10, 0xffffffffffffffff, 0x2) ioctl$BLKTRACESETUP(r3, 0xc0481273, &(0x7f0000001d80)={[], 0x100000001, 0x8, 0xd4, 0x4, 0x1000, r9}) setsockopt$inet_sctp_SCTP_EVENTS(r0, 0x84, 0xb, &(0x7f0000001e00)={0x3, 0x7, 0x7, 0x4, 0x5, 0x9, 0x36, 0x6, 0x2, 0xe580, 0x5a}, 0xb) ioctl$SNDRV_TIMER_IOCTL_PARAMS(r0, 0x40505412, &(0x7f0000001e40)={0x0, 0x4, 0x61a, 0x0, 0x17}) ioctl$KDSKBSENT(r0, 0x4b49, &(0x7f0000001ec0)="d9d8c87ec167f704d42d9e91f6ed1fa763eb0ef9b883f0e0048a28b117f0638bc6fc08847aaacfe94025a116685488ed4302b178ef1d9c104622ef6c7c75d0658ec5b21d575860b8850f1af6ce4e5345256d46d3db785c993aac43f18ee1cf1ada2c981c4155b48991d95cbceb70512588dd79eedf6288a2739e360116e8652333cdb2e526fcb770f95661b9d4edcb46796093beb5374a2524be663ac27f6165a9cd6fc13739e63feb99a0d5b9d122d46559a5c86c5616d68752b0e23bf6b3ae8b5f491b0f7ed1e7938d46f9091f1ff0d78e03b66d") sendmsg(r3, &(0x7f0000002580)={0x0, 0x0, &(0x7f0000002180)=[{&(0x7f0000001fc0)}, {&(0x7f0000002000)="dbabd017d16779ea928ceba9f7fc0eeb5d68ab95f921bc7bea021c318428283491b67d82b1bf5c8e6c3826bdd3d0b2c5fd9c7d6f8b108c4ec80bb81cad9d802e8aacaee8bcb30ad868cd3831c4cd264f3582220f9b2e1b7ba30070b0372ea20fa3219b23d235591b2402d5f17e1090ece30232c791812903ca35a8435f0a0e6b9c2be9e5d0624a5aa5926399cf1fc4fffe0e245abdf3", 0x96}, {&(0x7f00000020c0)="bb80a2c5cd6bc8a743e7a6fc17283ee46cc1d5b74fa5b462a7b85ba6cd8b128ba040ee73bff47f947c1d110b275d69e1802efc22f61a8f6617ad7153074accdeda340cc9473a35c483f2b32764b842398bed431b526348879dfeed473a3ed4397b4e670353bd355285aa1a8928de034b23930308b4d1e6adc797aa67459326d044943d68327bdb0c246ab12b1db4f592c754d41162c6111a2a58e7f90fee5b7dac137affa0a84dde0296a83808da", 0xae}], 0x3, &(0x7f00000021c0)=[{0x20, 0x105, 0x2, "1047d37dc5e1b4926bb1f0bd83576eb0"}, {0x48, 0x119, 0x4, "2176c6b0dd8260cc0b32f3ec8197587615641a829329b4b0288ceed92f61c750ea12f6c4dd01d633ee1056ae17dd439f0904249f"}, {0x30, 0x13b, 0x1, "cc7db603968a182e18082ac47c9e86a9f913b080d1731c66d0592e2b"}, {0xe8, 0x1ff, 0x2, "80ab68c2d398e2a42dd2aa58c9146f51eaaed3fb85089b8d88eb10ec701340d2c35c9fe856d3db1380b734cc3a049e4e79e2f3b9c06d99ea8e87d0bbe5ca3ceef4bc804e9d507c8a19f880760c01947f08032dbd07a5a8dfcb3f55dce36353e2495a9e602461061800c6e98162818c4964c6191fdbc5bbab5e56f93b05d560fad897a2d9e5e277c0be0f52cd5d8967c0db1beb0204a909040a36054571b3ab6669b22d43338e41bc5a786b19aa55670b3c120197f11f3a41fff198a7f5dcfe477e74bea4ac99b4e00c56dd8fe0dcaa6aee3f8646aec0"}, {0xe8, 0x11f, 0x2, "87b9829a75e8a2b8d9870929be05eb2df6443008d3fcdde62914d226743bf65a15be3d0d3d35e7cbf9136b8f16d57fb98d1d908cf19edb8d2afa8fe1da1a92f1baa28120c3cc6c58d2c12863e58725045744fca067260c5875bbadc492ce0e5e10cbcb95f7546f07feb707c1567d5ad42dbff057c656f8d3b582d549ceb4cd861f702f0a602205ca421ffeb6b62bd1f79d4e6c9c45ed394138e866d44a7eb64bc43a64ee9aaeaa7a8d3e0d8a32e1865e3a834d270be78f53e70bc6bce39be83f55b32fc6befa9dfe591a8315717884dd852b2c"}, {0x28, 0x10b, 0xfffffffffffff68b, "80f52148d3ac1eba3f8743cfb5f46c31a6ed0a70"}, {0x18, 0x116, 0x37b, "cdeac582ef4fa0c0"}, {0x80, 0x10d, 0x0, "c020f9e03060ebb7158adc22108731ba37169471fb4e8c96e3d6560b981afa1fde1accd66d44993bc19bbaf1bf8d0628a11fbe4e9e79d002e3ebf0406c104ba2a2deedf6b417a6ddcb91227d1dc1fae6ccbbbea7d72feae9a46e0ade4202e61da7c6a195849901509cc9f22733"}, {0x68, 0x11e, 0x80000000, "5fd17913caba4e70297f1cfc22067c3d86b54d2c71700b31d34f7c227e655f587bfb7eef62d4fc8a00d74103680560e89f45c5e6c8a547fb5c0f92fd4f79e1bd6d665fcb17e402e731459ff60159880020f259d5733b"}], 0x390, 0xc0}, 0x1) getrandom(&(0x7f00000025c0)=""/246, 0xf6, 0x2) write$RDMA_USER_CM_CMD_CREATE_ID(r3, &(0x7f0000002700)={0x0, 0x18, 0xfa00, {0x4, &(0x7f00000026c0)={0xffffffffffffffff}, 0x106, 0x3}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f0000002740)={0x3, 0x40, 0xfa00, {{0xa, 0xaeb, 0xfff, @remote, 0x5}, {0xa, 0x4e23, 0xc3d, @mcast2, 0x7}, r10, 0x1000}}, 0x48) r11 = openat$snapshot(0xffffffffffffff9c, &(0x7f00000027c0)='/dev/snapshot\x00', 0x0, 0x0) setsockopt$SO_VM_SOCKETS_BUFFER_MAX_SIZE(r11, 0x28, 0x2, &(0x7f0000002800)=0x2d, 0x8) msgget$private(0x0, 0x200) prctl$setendian(0x14, 0x2) 04:46:08 executing program 3: r0 = syz_open_dev$sg(&(0x7f00000000c0)='/dev/sg#\x00', 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000000)={0x53, 0x0, 0x6, 0x0, @buffer={0xc4, 0xb8, &(0x7f00000001c0)=""/184}, &(0x7f0000000540)="ad40657ed56c", &(0x7f0000000340)=""/128, 0x0, 0x0, 0x0, &(0x7f0000000040)}) [ 622.377212] binder: 22893:22894 Acquire 1 refcount change on invalid ref 0 ret -22 [ 622.413191] binder: 22893:22894 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 622.444579] binder: 22893:22894 Acquire 1 refcount change on invalid ref 0 ret -22 [ 622.493949] erofs: read_super, device -> /dev/loop0 04:46:08 executing program 2: socketpair$inet6_icmp_raw(0xa, 0x3, 0x3a, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) flistxattr(r1, &(0x7f0000000140)=""/120, 0x78) r2 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r3 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000300)='/dev/sequencer2\x00', 0x8042, 0x0) ioctl$VHOST_RESET_OWNER(r3, 0xaf02, 0x0) r4 = syz_open_dev$usb(&(0x7f0000000280)='/dev/bus/usb/00#/00#\x00', 0x793e, 0x4000) ioctl$KVM_SET_MP_STATE(r4, 0x4004ae99, &(0x7f00000002c0)) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) r5 = socket$bt_rfcomm(0x1f, 0x0, 0x3) r6 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r6, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, &(0x7f0000012fc7)}) r7 = fcntl$dupfd(r1, 0x0, r0) getsockopt$inet_sctp_SCTP_INITMSG(r7, 0x84, 0x2, &(0x7f00000001c0), &(0x7f0000000200)=0x8) ioctl$TIOCLINUX2(r7, 0x541c, &(0x7f0000000240)={0x2, 0x4a, 0x70, 0xff, 0xf9, 0x8001}) ioctl$RTC_PLL_GET(r5, 0x80207011, &(0x7f00000000c0)) close(r2) ioctl$BINDER_WRITE_READ(r6, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, &(0x7f0000000f4d)}) ioctl$BINDER_WRITE_READ(r6, 0xc0306201, &(0x7f0000000100)={0x4, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="365cab21032f8073d093b814d5cabbc8093dea18e7cba675c6dd2da19b88f4debae882b0fe00e6592fd9b02db6918a543b32e157cfc0a5207a6f3e1156fde26bcab4d84e67931ad4a26c8096308e9a989a6aeb1520dd0701"], 0xfffffffffffffc2b, 0x0, &(0x7f0000000680)}) [ 622.546934] erofs: options -> nouser_xattr,fault_injection=0x000000000000001a,noacl,fault_injection=0x0000000000000009,acl,acl,noacl,fault_injection=0x0000000000040000,acl,subj_type=trusted.overlay.opaque 04:46:08 executing program 3: r0 = syz_open_dev$sg(&(0x7f00000000c0)='/dev/sg#\x00', 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000000)={0x53, 0x0, 0x6, 0x0, @buffer={0x5d, 0xb8, &(0x7f00000001c0)=""/184}, &(0x7f0000000540)="ad40657ed56c", &(0x7f0000000340)=""/128, 0x0, 0x0, 0x0, &(0x7f0000000040)}) 04:46:08 executing program 5: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000480)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_GUEST_DEBUG(r3, 0x4048ae9b, &(0x7f0000000140)={0x1}) syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000100)=[@text32={0x20, &(0x7f0000000000)="6601669b0f35c4e1fe16846ba49e0000b9940200000f32c4c23dad78e0b9670900000f32660f38827f95b0040f01d10fc71a", 0x32}], 0x1, 0x0, &(0x7f0000000040), 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r3, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000400)=[@text32={0x20, &(0x7f0000000880)="b805000000b98b9400000f01c19a01000000b0000f43d1b8000000000f23d80f21f835800000900f23f80f060f2140b9800000c00f3235000800000f3066ba4300b8f1ffffffefb9800000c00f3235002000000f30c4c3295f4da400", 0x5c}], 0x26433e1, 0x0, &(0x7f0000000300), 0x10000000000000b6) ioctl$KVM_RUN(r3, 0xae48, 0x0) [ 622.628378] erofs: cannot read erofs superblock [ 622.659787] binder: 22913:22914 unknown command 564878390 [ 622.731398] binder: 22913:22914 ioctl c0306201 20000100 returned -22 04:46:08 executing program 3: r0 = syz_open_dev$sg(&(0x7f00000000c0)='/dev/sg#\x00', 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000000)={0x53, 0x0, 0x6, 0x0, @buffer={0x96, 0xb8, &(0x7f00000001c0)=""/184}, &(0x7f0000000540)="ad40657ed56c", &(0x7f0000000340)=""/128, 0x0, 0x0, 0x0, &(0x7f0000000040)}) 04:46:08 executing program 0: perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e5}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_open_procfs(0xffffffffffffffff, &(0x7f0000000040)='syscall\x00') connect$pppoe(0xffffffffffffffff, &(0x7f00000000c0)={0x18, 0x0, {0x0, @dev, 'team_slave_0\x00'}}, 0x1e) mkdir(&(0x7f0000000200)='./file0\x00', 0x1) mount(&(0x7f00000002c0)=ANY=[], &(0x7f0000001540)='./file0\x00', &(0x7f0000000280)='tmpfs\x00', 0x0, &(0x7f0000000080)) r0 = open$dir(&(0x7f0000000180)='./file0\x00', 0x0, 0x0) mknodat(r0, &(0x7f0000000140)='./file0\x00', 0x0, 0x0) renameat2(r0, &(0x7f0000000080)='./file0\x00', r0, &(0x7f0000000100)='./file1\x00', 0x4) [ 622.783579] binder: 22913:22925 tried to acquire reference to desc 0, got 1 instead [ 622.844060] binder: 22913:22926 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 04:46:09 executing program 3: r0 = syz_open_dev$sg(&(0x7f00000000c0)='/dev/sg#\x00', 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000000)={0x53, 0x0, 0x6, 0x0, @buffer={0x89, 0xb8, &(0x7f00000001c0)=""/184}, &(0x7f0000000540)="ad40657ed56c", &(0x7f0000000340)=""/128, 0x0, 0x0, 0x0, &(0x7f0000000040)}) [ 622.899076] binder: 22913:22914 unknown command 564878390 [ 622.913413] binder: 22913:22914 ioctl c0306201 20000100 returned -22 [ 622.918296] tmpfs: No value for mount option './file0' 04:46:09 executing program 4: ioctl$KVM_IRQ_LINE(0xffffffffffffffff, 0x4008ae61, &(0x7f0000000500)) r0 = syz_open_dev$dspn(&(0x7f00000004c0)='/dev/dsp#\x00', 0x1, 0x0) openat$audio(0xffffffffffffff9c, &(0x7f0000000000)='/dev/audio\x00', 0x80, 0x0) ioctl$KVM_SET_FPU(0xffffffffffffffff, 0x41a0ae8d, &(0x7f0000000100)={[], 0x0, 0x5531fee, 0x0, 0x0, 0x9, 0xf000, 0x0, [], 0x5}) syz_open_dev$usb(&(0x7f0000000440)='/dev/bus/usb/00#/00#\x00', 0x9, 0x2) r1 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) lstat(&(0x7f0000000040)='./file0/file0\x00', &(0x7f0000000080)) ioctl$EXT4_IOC_MIGRATE(0xffffffffffffffff, 0x6609) sendmmsg$unix(0xffffffffffffffff, &(0x7f000000a000)=[{&(0x7f000000a000)=@abs, 0x6e, &(0x7f000000d000), 0x0, &(0x7f0000000600)=ANY=[]}], 0x1, 0x0) r2 = socket$inet6(0xa, 0x2, 0x0) gettid() r3 = getpgid(0x0) kcmp(0x0, r3, 0x0, 0xffffffffffffffff, 0xffffffffffffffff) connect$inet6(r2, &(0x7f0000002740)={0xa, 0x0, 0x0, @mcast2, 0x4}, 0x1c) sendmmsg(r2, &(0x7f0000007e00), 0x136a88c8311572c, 0x400000000000000) setsockopt$inet6_udp_int(r2, 0x11, 0x0, &(0x7f0000000400), 0x4) openat$kvm(0xffffffffffffff9c, &(0x7f00000003c0)='/dev/kvm\x00', 0x0, 0x0) ioctl$VHOST_SET_VRING_CALL(0xffffffffffffff9c, 0x4008af21, &(0x7f00000002c0)={0x0, r1}) ioctl$SNDRV_TIMER_IOCTL_TREAD(r0, 0x40045402, &(0x7f0000000740)) inotify_rm_watch(0xffffffffffffffff, 0x0) ioctl$ifreq_SIOCGIFINDEX_team(0xffffffffffffffff, 0x8933, &(0x7f0000000480)={'team0\x00'}) 04:46:09 executing program 1: r0 = perf_event_open(&(0x7f000025c000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000001}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = dup3(r0, r0, 0x80000) ioctl$KVM_GET_NESTED_STATE(r1, 0xc080aebe, &(0x7f0000000100)={0x0, 0x0, 0x2080}) mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x11, 0xffffffffffffffff, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r0, 0x2405, 0xffffffffffffffff) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x1000004, 0x8031, 0xffffffffffffffff, 0x0) 04:46:09 executing program 5: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000480)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_GUEST_DEBUG(r3, 0x4048ae9b, &(0x7f0000000140)={0x1}) syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000100)=[@text32={0x20, &(0x7f0000000000)="6601669b0f35c4e1fe16846ba49e0000b9940200000f32c4c23dad78e0b9670900000f32660f38827f95b0040f01d10fc71a", 0x32}], 0x1, 0x0, &(0x7f0000000040), 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r3, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000400)=[@text32={0x20, &(0x7f0000000880)="b805000000b98b9400000f01c19a01000000b0000f43d1b8000000000f23d80f21f835800000900f23f80f060f2140b9800000c00f3235000800000f3066ba4300b8f1ffffffefb9800000c00f3235002000000f30c4c3295f4da400", 0x5c}], 0x26433e1, 0x0, &(0x7f0000000300), 0x10000000000000b6) ioctl$KVM_RUN(r3, 0xae80, 0x18000000) 04:46:09 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, &(0x7f0000012fc7)}) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=ANY=[@ANYBLOB="e9630c4000000000"], 0x0, 0x0, &(0x7f0000000f4d)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000100)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0xfffffffffffffc2b, 0x0, &(0x7f0000000680)}) 04:46:09 executing program 0: perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e5}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_open_procfs(0xffffffffffffffff, &(0x7f0000000040)='syscall\x00') connect$pppoe(0xffffffffffffffff, &(0x7f00000000c0)={0x18, 0x0, {0x0, @dev, 'team_slave_0\x00'}}, 0x1e) mkdir(&(0x7f0000000200)='./file0\x00', 0x1) mount(&(0x7f00000002c0)=ANY=[], &(0x7f0000001540)='./file0\x00', &(0x7f0000000280)='tmpfs\x00', 0x0, &(0x7f0000000080)) r0 = open$dir(&(0x7f0000000180)='./file0\x00', 0x0, 0x0) mknodat(r0, &(0x7f0000000140)='./file0\x00', 0x0, 0x0) renameat2(r0, &(0x7f0000000080)='./file0\x00', r0, &(0x7f0000000100)='./file1\x00', 0x4) 04:46:09 executing program 3: r0 = syz_open_dev$sg(&(0x7f00000000c0)='/dev/sg#\x00', 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000000)={0x53, 0x0, 0x6, 0x0, @buffer={0xf0, 0xb8, &(0x7f00000001c0)=""/184}, &(0x7f0000000540)="ad40657ed56c", &(0x7f0000000340)=""/128, 0x0, 0x0, 0x0, &(0x7f0000000040)}) [ 623.336046] binder: 22952:22954 unknown command 1074553833 [ 623.368614] binder: 22952:22954 ioctl c0306201 20008fd0 returned -22 [ 623.430525] binder: 22952:22954 unknown command 1074553833 [ 623.436229] binder: 22952:22954 ioctl c0306201 20008fd0 returned -22 04:46:09 executing program 3: r0 = syz_open_dev$sg(&(0x7f00000000c0)='/dev/sg#\x00', 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000000)={0x53, 0x0, 0x6, 0x0, @buffer={0xa5, 0xb8, &(0x7f00000001c0)=""/184}, &(0x7f0000000540)="ad40657ed56c", &(0x7f0000000340)=""/128, 0x0, 0x0, 0x0, &(0x7f0000000040)}) 04:46:09 executing program 0: perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e5}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_open_procfs(0xffffffffffffffff, &(0x7f0000000040)='syscall\x00') connect$pppoe(0xffffffffffffffff, &(0x7f00000000c0)={0x18, 0x0, {0x0, @dev, 'team_slave_0\x00'}}, 0x1e) mkdir(&(0x7f0000000200)='./file0\x00', 0x1) mount(&(0x7f00000002c0)=ANY=[], &(0x7f0000001540)='./file0\x00', &(0x7f0000000280)='tmpfs\x00', 0x0, &(0x7f0000000080)) r0 = open$dir(&(0x7f0000000180)='./file0\x00', 0x0, 0x0) mknodat(r0, &(0x7f0000000140)='./file0\x00', 0x0, 0x0) renameat2(r0, &(0x7f0000000080)='./file0\x00', r0, &(0x7f0000000100)='./file1\x00', 0x4) 04:46:09 executing program 2: r0 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vhost-vsock\x00', 0x2, 0x0) r1 = open(&(0x7f0000000040)='./file0\x00', 0x80000, 0x20) setsockopt$IPT_SO_SET_ADD_COUNTERS(r1, 0x0, 0x41, &(0x7f0000000200)={'nat\x00', 0x2, [{}, {}]}, 0x48) ioctl$SNDRV_SEQ_IOCTL_GET_QUEUE_STATUS(r1, 0xc05c5340, &(0x7f0000000140)={0x7fffffff, 0x400, 0x8, {}, 0x1, 0xff}) fcntl$getflags(r0, 0x40b) r2 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) getpeername$packet(r0, &(0x7f00000000c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000001c0)=0x14) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) r3 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000005fd4)=ANY=[@ANYBLOB="0400000000000000"], 0x0, 0x0, &(0x7f0000012fc7)}) close(r2) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, &(0x7f0000000f4d)}) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000100)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0xfffffffffffffc2b, 0x0, &(0x7f0000000680)}) 04:46:09 executing program 4: ioctl$KVM_IRQ_LINE(0xffffffffffffffff, 0x4008ae61, &(0x7f0000000500)) r0 = syz_open_dev$dspn(&(0x7f00000004c0)='/dev/dsp#\x00', 0x1, 0x0) openat$audio(0xffffffffffffff9c, &(0x7f0000000000)='/dev/audio\x00', 0x80, 0x0) ioctl$KVM_SET_FPU(0xffffffffffffffff, 0x41a0ae8d, &(0x7f0000000100)={[], 0x0, 0x5531fee, 0x0, 0x0, 0x9, 0xf000, 0x0, [], 0x5}) syz_open_dev$usb(&(0x7f0000000440)='/dev/bus/usb/00#/00#\x00', 0x9, 0x2) r1 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) lstat(&(0x7f0000000040)='./file0/file0\x00', &(0x7f0000000080)) ioctl$EXT4_IOC_MIGRATE(0xffffffffffffffff, 0x6609) sendmmsg$unix(0xffffffffffffffff, &(0x7f000000a000)=[{&(0x7f000000a000)=@abs, 0x6e, &(0x7f000000d000), 0x0, &(0x7f0000000600)=ANY=[]}], 0x1, 0x0) r2 = socket$inet6(0xa, 0x2, 0x0) gettid() r3 = getpgid(0x0) kcmp(0x0, r3, 0x0, 0xffffffffffffffff, 0xffffffffffffffff) connect$inet6(r2, &(0x7f0000002740)={0xa, 0x0, 0x0, @mcast2, 0x4}, 0x1c) sendmmsg(r2, &(0x7f0000007e00), 0x136a88c8311572c, 0x800000000000000) setsockopt$inet6_udp_int(r2, 0x11, 0x0, &(0x7f0000000400), 0x4) openat$kvm(0xffffffffffffff9c, &(0x7f00000003c0)='/dev/kvm\x00', 0x0, 0x0) ioctl$VHOST_SET_VRING_CALL(0xffffffffffffff9c, 0x4008af21, &(0x7f00000002c0)={0x0, r1}) ioctl$SNDRV_TIMER_IOCTL_TREAD(r0, 0x40045402, &(0x7f0000000740)) inotify_rm_watch(0xffffffffffffffff, 0x0) ioctl$ifreq_SIOCGIFINDEX_team(0xffffffffffffffff, 0x8933, &(0x7f0000000480)={'team0\x00'}) 04:46:09 executing program 5: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000480)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_GUEST_DEBUG(r3, 0x4048ae9b, &(0x7f0000000140)={0x1}) syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000100)=[@text32={0x20, &(0x7f0000000000)="6601669b0f35c4e1fe16846ba49e0000b9940200000f32c4c23dad78e0b9670900000f32660f38827f95b0040f01d10fc71a", 0x32}], 0x1, 0x0, &(0x7f0000000040), 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r3, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000400)=[@text32={0x20, &(0x7f0000000880)="b805000000b98b9400000f01c19a01000000b0000f43d1b8000000000f23d80f21f835800000900f23f80f060f2140b9800000c00f3235000800000f3066ba4300b8f1ffffffefb9800000c00f3235002000000f30c4c3295f4da400", 0x5c}], 0x26433e1, 0x0, &(0x7f0000000300), 0x10000000000000b6) ioctl$KVM_RUN(r3, 0xae80, 0x7000000) 04:46:09 executing program 3: r0 = syz_open_dev$sg(&(0x7f00000000c0)='/dev/sg#\x00', 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000000)={0x53, 0x0, 0x6, 0x0, @buffer={0x1ea, 0xb8, &(0x7f00000001c0)=""/184}, &(0x7f0000000540)="ad40657ed56c", &(0x7f0000000340)=""/128, 0x0, 0x0, 0x0, &(0x7f0000000040)}) [ 623.720281] binder: 22976:22979 unknown command 4 [ 623.731113] binder: 22976:22979 ioctl c0306201 20012000 returned -22 04:46:09 executing program 3: r0 = syz_open_dev$sg(&(0x7f00000000c0)='/dev/sg#\x00', 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000000)={0x53, 0x0, 0x6, 0x0, @buffer={0x1c2, 0xb8, &(0x7f00000001c0)=""/184}, &(0x7f0000000540)="ad40657ed56c", &(0x7f0000000340)=""/128, 0x0, 0x0, 0x0, &(0x7f0000000040)}) [ 623.822893] binder: 22976:22979 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 04:46:10 executing program 1: r0 = perf_event_open(&(0x7f000025c000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000001}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = dup3(r0, r0, 0x80000) ioctl$KVM_GET_NESTED_STATE(r1, 0xc080aebe, &(0x7f0000000100)={0x0, 0x0, 0x2080}) mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x11, 0xffffffffffffffff, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r0, 0x2405, 0xffffffffffffffff) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x1000004, 0x8031, 0xffffffffffffffff, 0x0) 04:46:10 executing program 0: perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e5}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_open_procfs(0xffffffffffffffff, &(0x7f0000000040)='syscall\x00') connect$pppoe(0xffffffffffffffff, &(0x7f00000000c0)={0x18, 0x0, {0x0, @dev, 'team_slave_0\x00'}}, 0x1e) mkdir(&(0x7f0000000200)='./file0\x00', 0x1) mount(&(0x7f00000002c0)=ANY=[], &(0x7f0000001540)='./file0\x00', &(0x7f0000000280)='tmpfs\x00', 0x0, &(0x7f0000000080)) r0 = open$dir(&(0x7f0000000180)='./file0\x00', 0x0, 0x0) mknodat(r0, &(0x7f0000000140)='./file0\x00', 0x0, 0x0) renameat2(r0, &(0x7f0000000080)='./file0\x00', r0, &(0x7f0000000100)='./file1\x00', 0x4) 04:46:10 executing program 3: r0 = syz_open_dev$sg(&(0x7f00000000c0)='/dev/sg#\x00', 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000000)={0x53, 0x0, 0x6, 0x0, @buffer={0x181, 0xb8, &(0x7f00000001c0)=""/184}, &(0x7f0000000540)="ad40657ed56c", &(0x7f0000000340)=""/128, 0x0, 0x0, 0x0, &(0x7f0000000040)}) 04:46:10 executing program 5: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000480)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_GUEST_DEBUG(r3, 0x4048ae9b, &(0x7f0000000140)={0x1}) syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000100)=[@text32={0x20, &(0x7f0000000000)="6601669b0f35c4e1fe16846ba49e0000b9940200000f32c4c23dad78e0b9670900000f32660f38827f95b0040f01d10fc71a", 0x32}], 0x1, 0x0, &(0x7f0000000040), 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r3, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000400)=[@text32={0x20, &(0x7f0000000880)="b805000000b98b9400000f01c19a01000000b0000f43d1b8000000000f23d80f21f835800000900f23f80f060f2140b9800000c00f3235000800000f3066ba4300b8f1ffffffefb9800000c00f3235002000000f30c4c3295f4da400", 0x5c}], 0x26433e1, 0x0, &(0x7f0000000300), 0x10000000000000b6) ioctl$KVM_RUN(r3, 0xae80, 0x1a0) 04:46:10 executing program 4: ioctl$KVM_IRQ_LINE(0xffffffffffffffff, 0x4008ae61, &(0x7f0000000500)) r0 = syz_open_dev$dspn(&(0x7f00000004c0)='/dev/dsp#\x00', 0x1, 0x0) openat$audio(0xffffffffffffff9c, &(0x7f0000000000)='/dev/audio\x00', 0x80, 0x0) ioctl$KVM_SET_FPU(0xffffffffffffffff, 0x41a0ae8d, &(0x7f0000000100)={[], 0x0, 0x5531fee, 0x0, 0x0, 0x9, 0xf000, 0x0, [], 0x5}) syz_open_dev$usb(&(0x7f0000000440)='/dev/bus/usb/00#/00#\x00', 0x9, 0x2) r1 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) lstat(&(0x7f0000000040)='./file0/file0\x00', &(0x7f0000000080)) ioctl$EXT4_IOC_MIGRATE(0xffffffffffffffff, 0x6609) sendmmsg$unix(0xffffffffffffffff, &(0x7f000000a000)=[{&(0x7f000000a000)=@abs, 0x6e, &(0x7f000000d000), 0x0, &(0x7f0000000600)=ANY=[]}], 0x1, 0x0) r2 = socket$inet6(0xa, 0x2, 0x0) gettid() r3 = getpgid(0x0) kcmp(0x0, r3, 0x0, 0xffffffffffffffff, 0xffffffffffffffff) connect$inet6(r2, &(0x7f0000002740)={0xa, 0x0, 0x0, @mcast2, 0x4}, 0x1c) sendmmsg(r2, &(0x7f0000007e00), 0x136a88c8311572c, 0x900000000000000) setsockopt$inet6_udp_int(r2, 0x11, 0x0, &(0x7f0000000400), 0x4) openat$kvm(0xffffffffffffff9c, &(0x7f00000003c0)='/dev/kvm\x00', 0x0, 0x0) ioctl$VHOST_SET_VRING_CALL(0xffffffffffffff9c, 0x4008af21, &(0x7f00000002c0)={0x0, r1}) ioctl$SNDRV_TIMER_IOCTL_TREAD(r0, 0x40045402, &(0x7f0000000740)) inotify_rm_watch(0xffffffffffffffff, 0x0) ioctl$ifreq_SIOCGIFINDEX_team(0xffffffffffffffff, 0x8933, &(0x7f0000000480)={'team0\x00'}) 04:46:10 executing program 3: r0 = syz_open_dev$sg(&(0x7f00000000c0)='/dev/sg#\x00', 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000000)={0x53, 0x0, 0x6, 0x0, @buffer={0x14b, 0xb8, &(0x7f00000001c0)=""/184}, &(0x7f0000000540)="ad40657ed56c", &(0x7f0000000340)=""/128, 0x0, 0x0, 0x0, &(0x7f0000000040)}) 04:46:10 executing program 0: perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e5}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_open_procfs(0xffffffffffffffff, &(0x7f0000000040)='syscall\x00') connect$pppoe(0xffffffffffffffff, &(0x7f00000000c0)={0x18, 0x0, {0x0, @dev, 'team_slave_0\x00'}}, 0x1e) mkdir(&(0x7f0000000200)='./file0\x00', 0x1) mount(&(0x7f00000002c0)=ANY=[], &(0x7f0000001540)='./file0\x00', &(0x7f0000000280)='tmpfs\x00', 0x0, &(0x7f0000000080)) r0 = open$dir(&(0x7f0000000180)='./file0\x00', 0x0, 0x0) renameat2(r0, &(0x7f0000000080)='./file0\x00', r0, &(0x7f0000000100)='./file1\x00', 0x4) 04:46:10 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, &(0x7f0000012fc7)}) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, &(0x7f0000000f4d)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000100)={0x4, 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB="d7e9a8fa"], 0xfffffffffffffc2b, 0x0, &(0x7f0000000680)}) 04:46:10 executing program 3: r0 = syz_open_dev$sg(&(0x7f00000000c0)='/dev/sg#\x00', 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000000)={0x53, 0x0, 0x6, 0x0, @buffer={0x60, 0xb8, &(0x7f00000001c0)=""/184}, &(0x7f0000000540)="ad40657ed56c", &(0x7f0000000340)=""/128, 0x0, 0x0, 0x0, &(0x7f0000000040)}) 04:46:10 executing program 5: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000480)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_GUEST_DEBUG(r3, 0x4048ae9b, &(0x7f0000000140)={0x1}) syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000100)=[@text32={0x20, &(0x7f0000000000)="6601669b0f35c4e1fe16846ba49e0000b9940200000f32c4c23dad78e0b9670900000f32660f38827f95b0040f01d10fc71a", 0x32}], 0x1, 0x0, &(0x7f0000000040), 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r3, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000400)=[@text32={0x20, &(0x7f0000000880)="b805000000b98b9400000f01c19a01000000b0000f43d1b8000000000f23d80f21f835800000900f23f80f060f2140b9800000c00f3235000800000f3066ba4300b8f1ffffffefb9800000c00f3235002000000f30c4c3295f4da400", 0x5c}], 0x26433e1, 0x0, &(0x7f0000000300), 0x10000000000000b6) ioctl$KVM_RUN(r3, 0xae80, 0x7fbb75401700) [ 624.512874] binder: 22976:23015 unknown command 4 [ 624.518256] binder: 22976:23014 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 624.528164] binder: 22976:23015 ioctl c0306201 20012000 returned -22 04:46:10 executing program 0: perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e5}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_open_procfs(0xffffffffffffffff, &(0x7f0000000040)='syscall\x00') connect$pppoe(0xffffffffffffffff, &(0x7f00000000c0)={0x18, 0x0, {0x0, @dev, 'team_slave_0\x00'}}, 0x1e) mkdir(&(0x7f0000000200)='./file0\x00', 0x1) mount(&(0x7f00000002c0)=ANY=[], &(0x7f0000001540)='./file0\x00', &(0x7f0000000280)='tmpfs\x00', 0x0, &(0x7f0000000080)) mknodat(0xffffffffffffffff, &(0x7f0000000140)='./file0\x00', 0x0, 0x0) renameat2(0xffffffffffffffff, &(0x7f0000000080)='./file0\x00', 0xffffffffffffffff, &(0x7f0000000100)='./file1\x00', 0x4) 04:46:10 executing program 3: r0 = syz_open_dev$sg(&(0x7f00000000c0)='/dev/sg#\x00', 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000000)={0x53, 0x0, 0x6, 0x0, @buffer={0x18a, 0xb8, &(0x7f00000001c0)=""/184}, &(0x7f0000000540)="ad40657ed56c", &(0x7f0000000340)=""/128, 0x0, 0x0, 0x0, &(0x7f0000000040)}) [ 624.693150] binder: 23022:23024 unknown command -89593385 [ 624.727505] binder: 23022:23024 ioctl c0306201 20000100 returned -22 [ 624.779963] binder: 23022:23031 unknown command -89593385 [ 624.801344] binder: 23022:23031 ioctl c0306201 20000100 returned -22 04:46:11 executing program 1: r0 = perf_event_open(&(0x7f000025c000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000001}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = dup3(r0, r0, 0x80000) ioctl$KVM_GET_NESTED_STATE(r1, 0xc080aebe, &(0x7f0000000100)={0x0, 0x0, 0x2080}) mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x11, 0xffffffffffffffff, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r0, 0x2405, 0xffffffffffffffff) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x1000004, 0x8031, 0xffffffffffffffff, 0x0) 04:46:11 executing program 3: r0 = syz_open_dev$sg(&(0x7f00000000c0)='/dev/sg#\x00', 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000000)={0x53, 0x0, 0x6, 0x0, @buffer={0x3b, 0xb8, &(0x7f00000001c0)=""/184}, &(0x7f0000000540)="ad40657ed56c", &(0x7f0000000340)=""/128, 0x0, 0x0, 0x0, &(0x7f0000000040)}) 04:46:11 executing program 4: ioctl$KVM_IRQ_LINE(0xffffffffffffffff, 0x4008ae61, &(0x7f0000000500)) r0 = syz_open_dev$dspn(&(0x7f00000004c0)='/dev/dsp#\x00', 0x1, 0x0) openat$audio(0xffffffffffffff9c, &(0x7f0000000000)='/dev/audio\x00', 0x80, 0x0) ioctl$KVM_SET_FPU(0xffffffffffffffff, 0x41a0ae8d, &(0x7f0000000100)={[], 0x0, 0x5531fee, 0x0, 0x0, 0x9, 0xf000, 0x0, [], 0x5}) syz_open_dev$usb(&(0x7f0000000440)='/dev/bus/usb/00#/00#\x00', 0x9, 0x2) r1 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) lstat(&(0x7f0000000040)='./file0/file0\x00', &(0x7f0000000080)) ioctl$EXT4_IOC_MIGRATE(0xffffffffffffffff, 0x6609) sendmmsg$unix(0xffffffffffffffff, &(0x7f000000a000)=[{&(0x7f000000a000)=@abs, 0x6e, &(0x7f000000d000), 0x0, &(0x7f0000000600)=ANY=[]}], 0x1, 0x0) r2 = socket$inet6(0xa, 0x2, 0x0) gettid() r3 = getpgid(0x0) kcmp(0x0, r3, 0x0, 0xffffffffffffffff, 0xffffffffffffffff) connect$inet6(r2, &(0x7f0000002740)={0xa, 0x0, 0x0, @mcast2, 0x4}, 0x1c) sendmmsg(r2, &(0x7f0000007e00), 0x136a88c8311572c, 0xf401000000000000) setsockopt$inet6_udp_int(r2, 0x11, 0x0, &(0x7f0000000400), 0x4) openat$kvm(0xffffffffffffff9c, &(0x7f00000003c0)='/dev/kvm\x00', 0x0, 0x0) ioctl$VHOST_SET_VRING_CALL(0xffffffffffffff9c, 0x4008af21, &(0x7f00000002c0)={0x0, r1}) ioctl$SNDRV_TIMER_IOCTL_TREAD(r0, 0x40045402, &(0x7f0000000740)) inotify_rm_watch(0xffffffffffffffff, 0x0) ioctl$ifreq_SIOCGIFINDEX_team(0xffffffffffffffff, 0x8933, &(0x7f0000000480)={'team0\x00'}) 04:46:11 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000005fd4)=ANY=[@ANYBLOB="4bbac44836eacddb"], 0x0, 0x0, &(0x7f0000012fc7)}) r2 = accept$inet(0xffffffffffffffff, &(0x7f0000000180)={0x2, 0x0, @local}, &(0x7f00000001c0)=0x10) setsockopt$inet_sctp_SCTP_INITMSG(r2, 0x84, 0x2, &(0x7f0000000200)={0x51, 0x8001, 0xe71e, 0x1}, 0x8) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, &(0x7f0000000f4d)}) fcntl$setstatus(r2, 0x4, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000100)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0xfffffffffffffc2b, 0x0, &(0x7f0000000680)}) mount$9p_xen(&(0x7f0000000000)='/dev/binder#\x00', &(0x7f0000000040)='./file0\x00', &(0x7f00000000c0)='9p\x00', 0x21000, &(0x7f0000000140)=ANY=[@ANYBLOB='trans=xen,dont_hash,hash\x00']) 04:46:11 executing program 5: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000480)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_GUEST_DEBUG(r3, 0x4048ae9b, &(0x7f0000000140)={0x1}) syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000100)=[@text32={0x20, &(0x7f0000000000)="6601669b0f35c4e1fe16846ba49e0000b9940200000f32c4c23dad78e0b9670900000f32660f38827f95b0040f01d10fc71a", 0x32}], 0x1, 0x0, &(0x7f0000000040), 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r3, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000400)=[@text32={0x20, &(0x7f0000000880)="b805000000b98b9400000f01c19a01000000b0000f43d1b8000000000f23d80f21f835800000900f23f80f060f2140b9800000c00f3235000800000f3066ba4300b8f1ffffffefb9800000c00f3235002000000f30c4c3295f4da400", 0x5c}], 0x26433e1, 0x0, &(0x7f0000000300), 0x10000000000000b6) ioctl$KVM_RUN(r3, 0xae80, 0x500000000000000) 04:46:11 executing program 0: perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e5}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_open_procfs(0xffffffffffffffff, &(0x7f0000000040)='syscall\x00') connect$pppoe(0xffffffffffffffff, &(0x7f00000000c0)={0x18, 0x0, {0x0, @dev, 'team_slave_0\x00'}}, 0x1e) mkdir(&(0x7f0000000200)='./file0\x00', 0x1) r0 = open$dir(&(0x7f0000000180)='./file0\x00', 0x0, 0x0) mknodat(r0, &(0x7f0000000140)='./file0\x00', 0x0, 0x0) renameat2(r0, &(0x7f0000000080)='./file0\x00', r0, &(0x7f0000000100)='./file1\x00', 0x4) [ 625.079083] binder: 23045:23047 unknown command 1220852299 [ 625.096976] binder: 23045:23047 ioctl c0306201 20012000 returned -22 04:46:11 executing program 3: r0 = syz_open_dev$sg(&(0x7f00000000c0)='/dev/sg#\x00', 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000000)={0x53, 0x0, 0x6, 0x0, @buffer={0x46, 0xb8, &(0x7f00000001c0)=""/184}, &(0x7f0000000540)="ad40657ed56c", &(0x7f0000000340)=""/128, 0x0, 0x0, 0x0, &(0x7f0000000040)}) [ 625.133624] binder: 23045:23047 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 04:46:11 executing program 3: r0 = syz_open_dev$sg(&(0x7f00000000c0)='/dev/sg#\x00', 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000000)={0x53, 0x0, 0x6, 0x0, @buffer={0x13, 0xb8, &(0x7f00000001c0)=""/184}, &(0x7f0000000540)="ad40657ed56c", &(0x7f0000000340)=""/128, 0x0, 0x0, 0x0, &(0x7f0000000040)}) 04:46:11 executing program 3: r0 = syz_open_dev$sg(&(0x7f00000000c0)='/dev/sg#\x00', 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000000)={0x53, 0x0, 0x6, 0x0, @buffer={0x90, 0xb8, &(0x7f00000001c0)=""/184}, &(0x7f0000000540)="ad40657ed56c", &(0x7f0000000340)=""/128, 0x0, 0x0, 0x0, &(0x7f0000000040)}) 04:46:11 executing program 0: perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e5}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_open_procfs(0xffffffffffffffff, &(0x7f0000000040)='syscall\x00') connect$pppoe(0xffffffffffffffff, &(0x7f00000000c0)={0x18, 0x0, {0x0, @dev, 'team_slave_0\x00'}}, 0x1e) mkdir(&(0x7f0000000200)='./file0\x00', 0x1) r0 = open$dir(&(0x7f0000000180)='./file0\x00', 0x0, 0x0) mknodat(r0, &(0x7f0000000140)='./file0\x00', 0x0, 0x0) renameat2(r0, &(0x7f0000000080)='./file0\x00', r0, &(0x7f0000000100)='./file1\x00', 0x4) 04:46:11 executing program 5: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000480)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_GUEST_DEBUG(r3, 0x4048ae9b, &(0x7f0000000140)={0x1}) syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000100)=[@text32={0x20, &(0x7f0000000000)="6601669b0f35c4e1fe16846ba49e0000b9940200000f32c4c23dad78e0b9670900000f32660f38827f95b0040f01d10fc71a", 0x32}], 0x1, 0x0, &(0x7f0000000040), 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r3, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000400)=[@text32={0x20, &(0x7f0000000880)="b805000000b98b9400000f01c19a01000000b0000f43d1b8000000000f23d80f21f835800000900f23f80f060f2140b9800000c00f3235000800000f3066ba4300b8f1ffffffefb9800000c00f3235002000000f30c4c3295f4da400", 0x5c}], 0x26433e1, 0x0, &(0x7f0000000300), 0x10000000000000b6) ioctl$KVM_RUN(r3, 0xae80, 0xc0000) 04:46:11 executing program 0: perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e5}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_open_procfs(0xffffffffffffffff, &(0x7f0000000040)='syscall\x00') connect$pppoe(0xffffffffffffffff, &(0x7f00000000c0)={0x18, 0x0, {0x0, @dev, 'team_slave_0\x00'}}, 0x1e) mkdir(&(0x7f0000000200)='./file0\x00', 0x1) r0 = open$dir(&(0x7f0000000180)='./file0\x00', 0x0, 0x0) mknodat(r0, &(0x7f0000000140)='./file0\x00', 0x0, 0x0) renameat2(r0, &(0x7f0000000080)='./file0\x00', r0, &(0x7f0000000100)='./file1\x00', 0x4) 04:46:11 executing program 1: r0 = perf_event_open(&(0x7f000025c000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000001}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) dup3(r0, r0, 0x80000) r1 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x11, r1, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r0, 0x2405, r1) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x1000004, 0x8031, 0xffffffffffffffff, 0x0) 04:46:11 executing program 3: r0 = syz_open_dev$sg(&(0x7f00000000c0)='/dev/sg#\x00', 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000000)={0x53, 0x0, 0x6, 0x0, @buffer={0x1f6, 0xb8, &(0x7f00000001c0)=""/184}, &(0x7f0000000540)="ad40657ed56c", &(0x7f0000000340)=""/128, 0x0, 0x0, 0x0, &(0x7f0000000040)}) 04:46:11 executing program 0: perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e5}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_open_procfs(0xffffffffffffffff, &(0x7f0000000040)='syscall\x00') connect$pppoe(0xffffffffffffffff, &(0x7f00000000c0)={0x18, 0x0, {0x0, @dev, 'team_slave_0\x00'}}, 0x1e) mount(&(0x7f00000002c0)=ANY=[], &(0x7f0000001540)='./file0\x00', &(0x7f0000000280)='tmpfs\x00', 0x0, &(0x7f0000000080)) r0 = open$dir(&(0x7f0000000180)='./file0\x00', 0x0, 0x0) mknodat(r0, &(0x7f0000000140)='./file0\x00', 0x0, 0x0) renameat2(r0, &(0x7f0000000080)='./file0\x00', r0, &(0x7f0000000100)='./file1\x00', 0x4) [ 625.865782] binder: 23045:23053 unknown command 1220852299 [ 625.880045] binder: 23045:23053 ioctl c0306201 20012000 returned -22 [ 625.895242] binder: 23045:23084 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 04:46:12 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="b28c16b668fc99328de041ccbd777188fa00"], 0x0, 0x0, &(0x7f0000012fc7)}) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, &(0x7f0000000f4d)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000100)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0xfffffffffffffc2b, 0x0, &(0x7f0000000680)}) 04:46:12 executing program 4: ioctl$KVM_IRQ_LINE(0xffffffffffffffff, 0x4008ae61, &(0x7f0000000500)) r0 = syz_open_dev$dspn(&(0x7f00000004c0)='/dev/dsp#\x00', 0x1, 0x0) openat$audio(0xffffffffffffff9c, &(0x7f0000000000)='/dev/audio\x00', 0x80, 0x0) ioctl$KVM_SET_FPU(0xffffffffffffffff, 0x41a0ae8d, &(0x7f0000000100)={[], 0x0, 0x5531fee, 0x0, 0x0, 0x9, 0xf000, 0x0, [], 0x5}) syz_open_dev$usb(&(0x7f0000000440)='/dev/bus/usb/00#/00#\x00', 0x9, 0x2) r1 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) lstat(&(0x7f0000000040)='./file0/file0\x00', &(0x7f0000000080)) ioctl$EXT4_IOC_MIGRATE(0xffffffffffffffff, 0x6609) sendmmsg$unix(0xffffffffffffffff, &(0x7f000000a000)=[{&(0x7f000000a000)=@abs, 0x6e, &(0x7f000000d000), 0x0, &(0x7f0000000600)=ANY=[]}], 0x1, 0x0) r2 = socket$inet6(0xa, 0x2, 0x0) gettid() r3 = getpgid(0x0) kcmp(0x0, r3, 0x0, 0xffffffffffffffff, 0xffffffffffffffff) connect$inet6(r2, &(0x7f0000002740)={0xa, 0x0, 0x0, @mcast2, 0x4}, 0x1c) sendmmsg(r2, &(0x7f0000007e00), 0x136a88c8311572c, 0x100000000000000) setsockopt$inet6_udp_int(r2, 0x11, 0x0, &(0x7f0000000400), 0x4) openat$kvm(0xffffffffffffff9c, &(0x7f00000003c0)='/dev/kvm\x00', 0x0, 0x0) ioctl$VHOST_SET_VRING_CALL(0xffffffffffffff9c, 0x4008af21, &(0x7f00000002c0)={0x0, r1}) ioctl$SNDRV_TIMER_IOCTL_TREAD(r0, 0x40045402, &(0x7f0000000740)) inotify_rm_watch(0xffffffffffffffff, 0x0) ioctl$ifreq_SIOCGIFINDEX_team(0xffffffffffffffff, 0x8933, &(0x7f0000000480)={'team0\x00'}) 04:46:12 executing program 5: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000480)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_GUEST_DEBUG(r3, 0x4048ae9b, &(0x7f0000000140)={0x1}) syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000100)=[@text32={0x20, &(0x7f0000000000)="6601669b0f35c4e1fe16846ba49e0000b9940200000f32c4c23dad78e0b9670900000f32660f38827f95b0040f01d10fc71a", 0x32}], 0x1, 0x0, &(0x7f0000000040), 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r3, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000400)=[@text32={0x20, &(0x7f0000000880)="b805000000b98b9400000f01c19a01000000b0000f43d1b8000000000f23d80f21f835800000900f23f80f060f2140b9800000c00f3235000800000f3066ba4300b8f1ffffffefb9800000c00f3235002000000f30c4c3295f4da400", 0x5c}], 0x26433e1, 0x0, &(0x7f0000000300), 0x10000000000000b6) ioctl$KVM_RUN(r3, 0xae80, 0xe803) 04:46:12 executing program 3: r0 = syz_open_dev$sg(&(0x7f00000000c0)='/dev/sg#\x00', 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000000)={0x53, 0x0, 0x6, 0x0, @buffer={0x43, 0xb8, &(0x7f00000001c0)=""/184}, &(0x7f0000000540)="ad40657ed56c", &(0x7f0000000340)=""/128, 0x0, 0x0, 0x0, &(0x7f0000000040)}) 04:46:12 executing program 0: perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e5}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_open_procfs(0xffffffffffffffff, &(0x7f0000000040)='syscall\x00') mkdir(&(0x7f0000000200)='./file0\x00', 0x1) mount(&(0x7f00000002c0)=ANY=[], &(0x7f0000001540)='./file0\x00', &(0x7f0000000280)='tmpfs\x00', 0x0, &(0x7f0000000080)) r0 = open$dir(&(0x7f0000000180)='./file0\x00', 0x0, 0x0) mknodat(r0, &(0x7f0000000140)='./file0\x00', 0x0, 0x0) renameat2(r0, &(0x7f0000000080)='./file0\x00', r0, &(0x7f0000000100)='./file1\x00', 0x4) 04:46:12 executing program 3: r0 = syz_open_dev$sg(&(0x7f00000000c0)='/dev/sg#\x00', 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000000)={0x53, 0x0, 0x6, 0x0, @buffer={0x72, 0xb8, &(0x7f00000001c0)=""/184}, &(0x7f0000000540)="ad40657ed56c", &(0x7f0000000340)=""/128, 0x0, 0x0, 0x0, &(0x7f0000000040)}) [ 626.044870] binder: 23100:23101 unknown command -1240036174 [ 626.079442] binder: 23100:23101 ioctl c0306201 20012000 returned -22 04:46:12 executing program 0: perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e5}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mkdir(&(0x7f0000000200)='./file0\x00', 0x1) mount(&(0x7f00000002c0)=ANY=[], &(0x7f0000001540)='./file0\x00', &(0x7f0000000280)='tmpfs\x00', 0x0, &(0x7f0000000080)) r0 = open$dir(&(0x7f0000000180)='./file0\x00', 0x0, 0x0) mknodat(r0, &(0x7f0000000140)='./file0\x00', 0x0, 0x0) renameat2(r0, &(0x7f0000000080)='./file0\x00', r0, &(0x7f0000000100)='./file1\x00', 0x4) [ 626.124655] binder: 23100:23101 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 04:46:12 executing program 3: r0 = syz_open_dev$sg(&(0x7f00000000c0)='/dev/sg#\x00', 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000000)={0x53, 0x0, 0x6, 0x0, @buffer={0xd5, 0xb8, &(0x7f00000001c0)=""/184}, &(0x7f0000000540)="ad40657ed56c", &(0x7f0000000340)=""/128, 0x0, 0x0, 0x0, &(0x7f0000000040)}) [ 626.177506] binder: 23100:23104 unknown command -1240036174 [ 626.179296] binder: 23100:23109 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 04:46:12 executing program 5: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000480)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_GUEST_DEBUG(r3, 0x4048ae9b, &(0x7f0000000140)={0x1}) syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000100)=[@text32={0x20, &(0x7f0000000000)="6601669b0f35c4e1fe16846ba49e0000b9940200000f32c4c23dad78e0b9670900000f32660f38827f95b0040f01d10fc71a", 0x32}], 0x1, 0x0, &(0x7f0000000040), 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r3, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000400)=[@text32={0x20, &(0x7f0000000880)="b805000000b98b9400000f01c19a01000000b0000f43d1b8000000000f23d80f21f835800000900f23f80f060f2140b9800000c00f3235000800000f3066ba4300b8f1ffffffefb9800000c00f3235002000000f30c4c3295f4da400", 0x5c}], 0x26433e1, 0x0, &(0x7f0000000300), 0x10000000000000b6) ioctl$KVM_RUN(r3, 0xae80, 0x40000000000) [ 626.232749] binder: 23100:23104 ioctl c0306201 20012000 returned -22 04:46:12 executing program 1: r0 = perf_event_open(&(0x7f000025c000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000001}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x11, r1, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r0, 0x2405, r1) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x1000004, 0x8031, 0xffffffffffffffff, 0x0) 04:46:12 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, &(0x7f0000012fc7)}) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=ANY=[@ANYBLOB="0e00f2f7a8ffffdd"], 0x0, 0x0, &(0x7f0000000f4d)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000100)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0xfffffffffffffc2b, 0x0, &(0x7f0000000680)}) 04:46:12 executing program 0: mkdir(&(0x7f0000000200)='./file0\x00', 0x1) mount(&(0x7f00000002c0)=ANY=[], &(0x7f0000001540)='./file0\x00', &(0x7f0000000280)='tmpfs\x00', 0x0, &(0x7f0000000080)) r0 = open$dir(&(0x7f0000000180)='./file0\x00', 0x0, 0x0) mknodat(r0, &(0x7f0000000140)='./file0\x00', 0x0, 0x0) renameat2(r0, &(0x7f0000000080)='./file0\x00', r0, &(0x7f0000000100)='./file1\x00', 0x4) 04:46:12 executing program 3: r0 = syz_open_dev$sg(&(0x7f00000000c0)='/dev/sg#\x00', 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000000)={0x53, 0x0, 0x6, 0x0, @buffer={0x26, 0xb8, &(0x7f00000001c0)=""/184}, &(0x7f0000000540)="ad40657ed56c", &(0x7f0000000340)=""/128, 0x0, 0x0, 0x0, &(0x7f0000000040)}) 04:46:12 executing program 4: ioctl$KVM_IRQ_LINE(0xffffffffffffffff, 0x4008ae61, &(0x7f0000000500)) r0 = syz_open_dev$dspn(&(0x7f00000004c0)='/dev/dsp#\x00', 0x1, 0x0) openat$audio(0xffffffffffffff9c, &(0x7f0000000000)='/dev/audio\x00', 0x80, 0x0) ioctl$KVM_SET_FPU(0xffffffffffffffff, 0x41a0ae8d, &(0x7f0000000100)={[], 0x0, 0x5531fee, 0x0, 0x0, 0x9, 0xf000, 0x0, [], 0x5}) syz_open_dev$usb(&(0x7f0000000440)='/dev/bus/usb/00#/00#\x00', 0x9, 0x2) r1 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) lstat(&(0x7f0000000040)='./file0/file0\x00', &(0x7f0000000080)) ioctl$EXT4_IOC_MIGRATE(0xffffffffffffffff, 0x6609) sendmmsg$unix(0xffffffffffffffff, &(0x7f000000a000)=[{&(0x7f000000a000)=@abs, 0x6e, &(0x7f000000d000), 0x0, &(0x7f0000000600)=ANY=[]}], 0x1, 0x0) r2 = socket$inet6(0xa, 0x2, 0x0) gettid() r3 = getpgid(0x0) kcmp(0x0, r3, 0x0, 0xffffffffffffffff, 0xffffffffffffffff) connect$inet6(r2, &(0x7f0000002740)={0xa, 0x0, 0x0, @mcast2, 0x4}, 0x1c) sendmmsg(r2, &(0x7f0000007e00), 0x136a88c8311572c, 0x1a0ffffffff) setsockopt$inet6_udp_int(r2, 0x11, 0x0, &(0x7f0000000400), 0x4) openat$kvm(0xffffffffffffff9c, &(0x7f00000003c0)='/dev/kvm\x00', 0x0, 0x0) ioctl$VHOST_SET_VRING_CALL(0xffffffffffffff9c, 0x4008af21, &(0x7f00000002c0)={0x0, r1}) ioctl$SNDRV_TIMER_IOCTL_TREAD(r0, 0x40045402, &(0x7f0000000740)) inotify_rm_watch(0xffffffffffffffff, 0x0) ioctl$ifreq_SIOCGIFINDEX_team(0xffffffffffffffff, 0x8933, &(0x7f0000000480)={'team0\x00'}) 04:46:12 executing program 5: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000480)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_GUEST_DEBUG(r3, 0x4048ae9b, &(0x7f0000000140)={0x1}) syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000100)=[@text32={0x20, &(0x7f0000000000)="6601669b0f35c4e1fe16846ba49e0000b9940200000f32c4c23dad78e0b9670900000f32660f38827f95b0040f01d10fc71a", 0x32}], 0x1, 0x0, &(0x7f0000000040), 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r3, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000400)=[@text32={0x20, &(0x7f0000000880)="b805000000b98b9400000f01c19a01000000b0000f43d1b8000000000f23d80f21f835800000900f23f80f060f2140b9800000c00f3235000800000f3066ba4300b8f1ffffffefb9800000c00f3235002000000f30c4c3295f4da400", 0x5c}], 0x26433e1, 0x0, &(0x7f0000000300), 0x10000000000000b6) ioctl$KVM_RUN(r3, 0xae80, 0x400000000000000) [ 626.715800] binder: 23130:23131 unknown command -135135218 04:46:12 executing program 3: r0 = syz_open_dev$sg(&(0x7f00000000c0)='/dev/sg#\x00', 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000000)={0x53, 0x0, 0x6, 0x0, @buffer={0x143, 0xb8, &(0x7f00000001c0)=""/184}, &(0x7f0000000540)="ad40657ed56c", &(0x7f0000000340)=""/128, 0x0, 0x0, 0x0, &(0x7f0000000040)}) [ 626.759353] binder: 23130:23131 ioctl c0306201 20008fd0 returned -22 [ 626.785252] binder: 23130:23131 unknown command -135135218 [ 626.800003] binder: 23130:23131 ioctl c0306201 20008fd0 returned -22 04:46:13 executing program 0: mkdir(&(0x7f0000000200)='./file0\x00', 0x0) mount(&(0x7f00000002c0)=ANY=[], &(0x7f0000001540)='./file0\x00', &(0x7f0000000280)='tmpfs\x00', 0x0, &(0x7f0000000080)) r0 = open$dir(&(0x7f0000000180)='./file0\x00', 0x0, 0x0) mknodat(r0, &(0x7f0000000140)='./file0\x00', 0x0, 0x0) renameat2(r0, &(0x7f0000000080)='./file0\x00', r0, &(0x7f0000000100)='./file1\x00', 0x4) 04:46:13 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x10000000800002) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, &(0x7f0000012fc7)}) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, &(0x7f0000000f4d)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000100)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0xfffffffffffffc2b, 0x0, &(0x7f0000000680)}) 04:46:13 executing program 4: ioctl$KVM_IRQ_LINE(0xffffffffffffffff, 0x4008ae61, &(0x7f0000000500)) r0 = syz_open_dev$dspn(&(0x7f00000004c0)='/dev/dsp#\x00', 0x1, 0x0) openat$audio(0xffffffffffffff9c, &(0x7f0000000000)='/dev/audio\x00', 0x80, 0x0) ioctl$KVM_SET_FPU(0xffffffffffffffff, 0x41a0ae8d, &(0x7f0000000100)={[], 0x0, 0x5531fee, 0x0, 0x0, 0x9, 0xf000, 0x0, [], 0x5}) syz_open_dev$usb(&(0x7f0000000440)='/dev/bus/usb/00#/00#\x00', 0x9, 0x2) r1 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) lstat(&(0x7f0000000040)='./file0/file0\x00', &(0x7f0000000080)) ioctl$EXT4_IOC_MIGRATE(0xffffffffffffffff, 0x6609) sendmmsg$unix(0xffffffffffffffff, &(0x7f000000a000)=[{&(0x7f000000a000)=@abs, 0x6e, &(0x7f000000d000), 0x0, &(0x7f0000000600)=ANY=[]}], 0x1, 0x0) r2 = socket$inet6(0xa, 0x2, 0x0) gettid() r3 = getpgid(0x0) kcmp(0x0, r3, 0x0, 0xffffffffffffffff, 0xffffffffffffffff) connect$inet6(r2, &(0x7f0000002740)={0xa, 0x0, 0x0, @mcast2, 0x4}, 0x1c) sendmmsg(r2, &(0x7f0000007e00), 0x136a88c8311572c, 0x40000) setsockopt$inet6_udp_int(r2, 0x11, 0x0, &(0x7f0000000400), 0x4) openat$kvm(0xffffffffffffff9c, &(0x7f00000003c0)='/dev/kvm\x00', 0x0, 0x0) ioctl$VHOST_SET_VRING_CALL(0xffffffffffffff9c, 0x4008af21, &(0x7f00000002c0)={0x0, r1}) ioctl$SNDRV_TIMER_IOCTL_TREAD(r0, 0x40045402, &(0x7f0000000740)) inotify_rm_watch(0xffffffffffffffff, 0x0) ioctl$ifreq_SIOCGIFINDEX_team(0xffffffffffffffff, 0x8933, &(0x7f0000000480)={'team0\x00'}) 04:46:13 executing program 3: r0 = syz_open_dev$sg(&(0x7f00000000c0)='/dev/sg#\x00', 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000000)={0x53, 0x0, 0x6, 0x0, @buffer={0x167, 0xb8, &(0x7f00000001c0)=""/184}, &(0x7f0000000540)="ad40657ed56c", &(0x7f0000000340)=""/128, 0x0, 0x0, 0x0, &(0x7f0000000040)}) [ 626.919723] binder: 23151:23152 Acquire 1 refcount change on invalid ref 0 ret -22 04:46:13 executing program 5: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000480)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_GUEST_DEBUG(r3, 0x4048ae9b, &(0x7f0000000140)={0x1}) syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000100)=[@text32={0x20, &(0x7f0000000000)="6601669b0f35c4e1fe16846ba49e0000b9940200000f32c4c23dad78e0b9670900000f32660f38827f95b0040f01d10fc71a", 0x32}], 0x1, 0x0, &(0x7f0000000040), 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r3, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000400)=[@text32={0x20, &(0x7f0000000880)="b805000000b98b9400000f01c19a01000000b0000f43d1b8000000000f23d80f21f835800000900f23f80f060f2140b9800000c00f3235000800000f3066ba4300b8f1ffffffefb9800000c00f3235002000000f30c4c3295f4da400", 0x5c}], 0x26433e1, 0x0, &(0x7f0000000300), 0x10000000000000b6) ioctl$KVM_RUN(r3, 0xae80, 0x60182300) [ 627.003775] binder: 23151:23152 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 627.054977] binder: 23151:23162 Acquire 1 refcount change on invalid ref 0 ret -22 [ 627.056413] binder: 23151:23152 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 04:46:13 executing program 1: r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x11, r0, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(0xffffffffffffffff, 0x2405, r0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x1000004, 0x8031, 0xffffffffffffffff, 0x0) 04:46:13 executing program 0: mkdir(&(0x7f0000000200)='./file0\x00', 0x0) mount(&(0x7f00000002c0)=ANY=[], &(0x7f0000001540)='./file0\x00', &(0x7f0000000280)='tmpfs\x00', 0x0, &(0x7f0000000080)) r0 = open$dir(&(0x7f0000000180)='./file0\x00', 0x0, 0x0) mknodat(0xffffffffffffffff, &(0x7f0000000140)='./file0\x00', 0x0, 0x0) renameat2(r0, &(0x7f0000000080)='./file0\x00', r0, &(0x7f0000000100)='./file1\x00', 0x4) 04:46:13 executing program 3: r0 = syz_open_dev$sg(&(0x7f00000000c0)='/dev/sg#\x00', 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000000)={0x53, 0x0, 0x6, 0x0, @buffer={0x57, 0xb8, &(0x7f00000001c0)=""/184}, &(0x7f0000000540)="ad40657ed56c", &(0x7f0000000340)=""/128, 0x0, 0x0, 0x0, &(0x7f0000000040)}) 04:46:13 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, &(0x7f0000012fc7)}) close(r0) r2 = getuid() getsockopt$sock_cred(0xffffffffffffff9c, 0x1, 0x11, &(0x7f00000000c0)={0x0, 0x0, 0x0}, &(0x7f0000000140)=0xc) write$FUSE_ENTRY(r1, &(0x7f0000000180)={0x90, 0x0, 0x2, {0x6, 0x1, 0x8, 0xffffffffffffffff, 0x81, 0x55c, {0x6, 0x3, 0xda, 0x4e, 0x1, 0x8, 0x3, 0x279, 0x2, 0x89, 0x2, r2, r3, 0x1, 0x1}}}, 0x420) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, &(0x7f0000000f4d)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000100)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0xfffffffffffffc2b, 0x0, &(0x7f0000000680)}) socketpair$inet_tcp(0x2, 0x1, 0x0, &(0x7f0000000240)) getsockname$inet6(r0, &(0x7f0000000000), &(0x7f0000000040)=0x1c) socketpair$inet_smc(0x2b, 0x1, 0x0, &(0x7f0000000280)={0xffffffffffffffff}) setsockopt$EBT_SO_SET_COUNTERS(r4, 0x0, 0x81, &(0x7f0000000300)={'nat\x00', 0x0, 0x0, 0x0, [], 0x4, &(0x7f00000002c0), 0x0, [{}, {}, {}, {}]}, 0xb8) 04:46:13 executing program 5: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000480)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_GUEST_DEBUG(r3, 0x4048ae9b, &(0x7f0000000140)={0x1}) syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000100)=[@text32={0x20, &(0x7f0000000000)="6601669b0f35c4e1fe16846ba49e0000b9940200000f32c4c23dad78e0b9670900000f32660f38827f95b0040f01d10fc71a", 0x32}], 0x1, 0x0, &(0x7f0000000040), 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r3, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000400)=[@text32={0x20, &(0x7f0000000880)="b805000000b98b9400000f01c19a01000000b0000f43d1b8000000000f23d80f21f835800000900f23f80f060f2140b9800000c00f3235000800000f3066ba4300b8f1ffffffefb9800000c00f3235002000000f30c4c3295f4da400", 0x5c}], 0x26433e1, 0x0, &(0x7f0000000300), 0x10000000000000b6) ioctl$KVM_RUN(r3, 0xae80, 0x100000) 04:46:13 executing program 3: r0 = syz_open_dev$sg(&(0x7f00000000c0)='/dev/sg#\x00', 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000000)={0x53, 0x0, 0x6, 0x0, @buffer={0xa0, 0xb8, &(0x7f00000001c0)=""/184}, &(0x7f0000000540)="ad40657ed56c", &(0x7f0000000340)=""/128, 0x0, 0x0, 0x0, &(0x7f0000000040)}) 04:46:13 executing program 0: mkdir(&(0x7f0000000200)='./file0\x00', 0x0) mount(&(0x7f00000002c0)=ANY=[], &(0x7f0000001540)='./file0\x00', &(0x7f0000000280)='tmpfs\x00', 0x0, &(0x7f0000000080)) r0 = open$dir(&(0x7f0000000180)='./file0\x00', 0x0, 0x0) mknodat(r0, &(0x7f0000000140)='./file0\x00', 0x0, 0x0) renameat2(0xffffffffffffffff, &(0x7f0000000080)='./file0\x00', r0, &(0x7f0000000100)='./file1\x00', 0x4) 04:46:13 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, &(0x7f0000012fc7)}) socketpair(0x9, 0x0, 0x1, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$sock_int(r2, 0x1, 0x14, &(0x7f0000000280)=0xcdc, 0x4) r4 = syz_genetlink_get_family_id$ipvs(&(0x7f00000000c0)='IPVS\x00') sendmsg$IPVS_CMD_ZERO(r3, &(0x7f0000000240)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x400003}, 0xc, &(0x7f0000000200)={&(0x7f0000000140)={0x88, r4, 0x300, 0x70bd26, 0x25dfdbfc, {}, [@IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5, 0x80000001}, @IPVS_CMD_ATTR_DEST={0x24, 0x2, [@IPVS_DEST_ATTR_PORT={0x8, 0x2, 0x4e24}, @IPVS_DEST_ATTR_PERSIST_CONNS={0x8, 0x9, 0x1}, @IPVS_DEST_ATTR_ADDR_FAMILY={0x8, 0xb, 0xa}, @IPVS_DEST_ATTR_U_THRESH={0x8, 0x5, 0x6}]}, @IPVS_CMD_ATTR_SERVICE={0x48, 0x1, [@IPVS_SVC_ATTR_AF={0x8, 0x1, 0x2}, @IPVS_SVC_ATTR_TIMEOUT={0x8, 0x8, 0x4}, @IPVS_SVC_ATTR_NETMASK={0x8, 0x9, 0x47}, @IPVS_SVC_ATTR_AF={0x8, 0x1, 0xa}, @IPVS_SVC_ATTR_NETMASK={0x8, 0x9, 0x3d}, @IPVS_SVC_ATTR_ADDR={0x14, 0x3, @ipv4=@loopback}, @IPVS_SVC_ATTR_PE_NAME={0x8, 0xb, 'sip\x00'}]}]}, 0x88}, 0x1, 0x0, 0x0, 0x20000000}, 0x1) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f0000000380)=[@dead_binder_done], 0x3d, 0x0, &(0x7f00000003c0)="74fb5bbe8e22b51c6dea1b220a0878c2dca9a18001c88e8487725892c94ea3ed38ab605d5c212ebfae62753dbaf549480aaf"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000100)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0xfffffffffffffc2b, 0x0, &(0x7f0000000680)}) 04:46:13 executing program 4: ioctl$KVM_IRQ_LINE(0xffffffffffffffff, 0x4008ae61, &(0x7f0000000500)) r0 = syz_open_dev$dspn(&(0x7f00000004c0)='/dev/dsp#\x00', 0x1, 0x0) openat$audio(0xffffffffffffff9c, &(0x7f0000000000)='/dev/audio\x00', 0x80, 0x0) ioctl$KVM_SET_FPU(0xffffffffffffffff, 0x41a0ae8d, &(0x7f0000000100)={[], 0x0, 0x5531fee, 0x0, 0x0, 0x9, 0xf000, 0x0, [], 0x5}) syz_open_dev$usb(&(0x7f0000000440)='/dev/bus/usb/00#/00#\x00', 0x9, 0x2) r1 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) lstat(&(0x7f0000000040)='./file0/file0\x00', &(0x7f0000000080)) ioctl$EXT4_IOC_MIGRATE(0xffffffffffffffff, 0x6609) sendmmsg$unix(0xffffffffffffffff, &(0x7f000000a000)=[{&(0x7f000000a000)=@abs, 0x6e, &(0x7f000000d000), 0x0, &(0x7f0000000600)=ANY=[]}], 0x1, 0x0) r2 = socket$inet6(0xa, 0x2, 0x0) gettid() r3 = getpgid(0x0) kcmp(0x0, r3, 0x0, 0xffffffffffffffff, 0xffffffffffffffff) connect$inet6(r2, &(0x7f0000002740)={0xa, 0x0, 0x0, @mcast2, 0x4}, 0x1c) sendmmsg(r2, &(0x7f0000007e00), 0x136a88c8311572c, 0xffffff7f00000000) setsockopt$inet6_udp_int(r2, 0x11, 0x0, &(0x7f0000000400), 0x4) openat$kvm(0xffffffffffffff9c, &(0x7f00000003c0)='/dev/kvm\x00', 0x0, 0x0) ioctl$VHOST_SET_VRING_CALL(0xffffffffffffff9c, 0x4008af21, &(0x7f00000002c0)={0x0, r1}) ioctl$SNDRV_TIMER_IOCTL_TREAD(r0, 0x40045402, &(0x7f0000000740)) inotify_rm_watch(0xffffffffffffffff, 0x0) ioctl$ifreq_SIOCGIFINDEX_team(0xffffffffffffffff, 0x8933, &(0x7f0000000480)={'team0\x00'}) 04:46:13 executing program 3: r0 = syz_open_dev$sg(&(0x7f00000000c0)='/dev/sg#\x00', 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000000)={0x53, 0x0, 0x6, 0x0, @buffer={0x62, 0xb8, &(0x7f00000001c0)=""/184}, &(0x7f0000000540)="ad40657ed56c", &(0x7f0000000340)=""/128, 0x0, 0x0, 0x0, &(0x7f0000000040)}) 04:46:13 executing program 5: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000480)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_GUEST_DEBUG(r3, 0x4048ae9b, &(0x7f0000000140)={0x1}) syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000100)=[@text32={0x20, &(0x7f0000000000)="6601669b0f35c4e1fe16846ba49e0000b9940200000f32c4c23dad78e0b9670900000f32660f38827f95b0040f01d10fc71a", 0x32}], 0x1, 0x0, &(0x7f0000000040), 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r3, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000400)=[@text32={0x20, &(0x7f0000000880)="b805000000b98b9400000f01c19a01000000b0000f43d1b8000000000f23d80f21f835800000900f23f80f060f2140b9800000c00f3235000800000f3066ba4300b8f1ffffffefb9800000c00f3235002000000f30c4c3295f4da400", 0x5c}], 0x26433e1, 0x0, &(0x7f0000000300), 0x10000000000000b6) ioctl$KVM_RUN(r3, 0xae80, 0xe8030000) 04:46:13 executing program 0: mkdir(&(0x7f0000000200)='./file0\x00', 0x0) mount(&(0x7f00000002c0)=ANY=[], &(0x7f0000001540)='./file0\x00', &(0x7f0000000280)='tmpfs\x00', 0x0, &(0x7f0000000080)) r0 = open$dir(&(0x7f0000000180)='./file0\x00', 0x0, 0x0) mknodat(r0, &(0x7f0000000140)='./file0\x00', 0x0, 0x0) renameat2(r0, &(0x7f0000000080)='./file0\x00', 0xffffffffffffffff, &(0x7f0000000100)='./file1\x00', 0x4) [ 627.752778] binder: 23197:23198 BC_DEAD_BINDER_DONE 0000000000000000 not found 04:46:14 executing program 1: r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x11, r0, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(0xffffffffffffffff, 0x2405, r0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x1000004, 0x8031, 0xffffffffffffffff, 0x0) 04:46:14 executing program 3: r0 = syz_open_dev$sg(&(0x7f00000000c0)='/dev/sg#\x00', 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000000)={0x53, 0x0, 0x6, 0x0, @buffer={0x2d, 0xb8, &(0x7f00000001c0)=""/184}, &(0x7f0000000540)="ad40657ed56c", &(0x7f0000000340)=""/128, 0x0, 0x0, 0x0, &(0x7f0000000040)}) 04:46:14 executing program 0: mkdir(&(0x7f0000000200)='./file0\x00', 0x0) mount(&(0x7f00000002c0)=ANY=[], &(0x7f0000001540)='./file0\x00', &(0x7f0000000280)='tmpfs\x00', 0x0, &(0x7f0000000080)) r0 = open$dir(&(0x7f0000000180)='./file0\x00', 0x0, 0x0) mknodat(r0, &(0x7f0000000140)='./file0\x00', 0x0, 0x0) renameat2(r0, &(0x7f0000000080)='./file0\x00', r0, &(0x7f0000000100)='./file1\x00', 0x0) 04:46:14 executing program 5: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000480)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_GUEST_DEBUG(r3, 0x4048ae9b, &(0x7f0000000140)={0x1}) syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000100)=[@text32={0x20, &(0x7f0000000000)="6601669b0f35c4e1fe16846ba49e0000b9940200000f32c4c23dad78e0b9670900000f32660f38827f95b0040f01d10fc71a", 0x32}], 0x1, 0x0, &(0x7f0000000040), 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r3, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000400)=[@text32={0x20, &(0x7f0000000880)="b805000000b98b9400000f01c19a01000000b0000f43d1b8000000000f23d80f21f835800000900f23f80f060f2140b9800000c00f3235000800000f3066ba4300b8f1ffffffefb9800000c00f3235002000000f30c4c3295f4da400", 0x5c}], 0x26433e1, 0x0, &(0x7f0000000300), 0x10000000000000b6) ioctl$KVM_RUN(r3, 0xae80, 0x80ffff) 04:46:14 executing program 4: ioctl$KVM_IRQ_LINE(0xffffffffffffffff, 0x4008ae61, &(0x7f0000000500)) r0 = syz_open_dev$dspn(&(0x7f00000004c0)='/dev/dsp#\x00', 0x1, 0x0) openat$audio(0xffffffffffffff9c, &(0x7f0000000000)='/dev/audio\x00', 0x80, 0x0) ioctl$KVM_SET_FPU(0xffffffffffffffff, 0x41a0ae8d, &(0x7f0000000100)={[], 0x0, 0x5531fee, 0x0, 0x0, 0x9, 0xf000, 0x0, [], 0x5}) syz_open_dev$usb(&(0x7f0000000440)='/dev/bus/usb/00#/00#\x00', 0x9, 0x2) r1 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) lstat(&(0x7f0000000040)='./file0/file0\x00', &(0x7f0000000080)) ioctl$EXT4_IOC_MIGRATE(0xffffffffffffffff, 0x6609) sendmmsg$unix(0xffffffffffffffff, &(0x7f000000a000)=[{&(0x7f000000a000)=@abs, 0x6e, &(0x7f000000d000), 0x0, &(0x7f0000000600)=ANY=[]}], 0x1, 0x0) r2 = socket$inet6(0xa, 0x2, 0x0) gettid() r3 = getpgid(0x0) kcmp(0x0, r3, 0x0, 0xffffffffffffffff, 0xffffffffffffffff) connect$inet6(r2, &(0x7f0000002740)={0xa, 0x0, 0x0, @mcast2, 0x4}, 0x1c) sendmmsg(r2, &(0x7f0000007e00), 0x136a88c8311572c, 0xb605000000000000) setsockopt$inet6_udp_int(r2, 0x11, 0x0, &(0x7f0000000400), 0x4) openat$kvm(0xffffffffffffff9c, &(0x7f00000003c0)='/dev/kvm\x00', 0x0, 0x0) ioctl$VHOST_SET_VRING_CALL(0xffffffffffffff9c, 0x4008af21, &(0x7f00000002c0)={0x0, r1}) ioctl$SNDRV_TIMER_IOCTL_TREAD(r0, 0x40045402, &(0x7f0000000740)) inotify_rm_watch(0xffffffffffffffff, 0x0) ioctl$ifreq_SIOCGIFINDEX_team(0xffffffffffffffff, 0x8933, &(0x7f0000000480)={'team0\x00'}) 04:46:14 executing program 0: mkdir(&(0x7f0000000200)='./file0\x00', 0x0) mount(&(0x7f00000002c0)=ANY=[], &(0x7f0000001540)='./file0\x00', &(0x7f0000000280)='tmpfs\x00', 0x0, &(0x7f0000000080)) r0 = open$dir(&(0x7f0000000180)='./file0\x00', 0x0, 0x0) mknodat(r0, &(0x7f0000000140)='./file0\x00', 0x0, 0x0) renameat2(r0, &(0x7f0000000080)='./file0\x00', r0, &(0x7f0000000100)='./file1\x00', 0x0) 04:46:14 executing program 3: r0 = syz_open_dev$sg(&(0x7f00000000c0)='/dev/sg#\x00', 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000000)={0x53, 0x0, 0x6, 0x0, @buffer={0x15e, 0xb8, &(0x7f00000001c0)=""/184}, &(0x7f0000000540)="ad40657ed56c", &(0x7f0000000340)=""/128, 0x0, 0x0, 0x0, &(0x7f0000000040)}) [ 628.512583] binder: 23197:23242 BC_DEAD_BINDER_DONE 0000000000000000 not found 04:46:14 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, &(0x7f0000012fc7)}) sync_file_range(r0, 0x0, 0x8, 0x1) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, &(0x7f0000000f4d)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000100)={0x4, 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB], 0xfffffffffffffc2b, 0x0, &(0x7f0000000680)}) 04:46:14 executing program 3: r0 = syz_open_dev$sg(&(0x7f00000000c0)='/dev/sg#\x00', 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000000)={0x53, 0x0, 0x6, 0x0, @buffer={0x1d, 0xb8, &(0x7f00000001c0)=""/184}, &(0x7f0000000540)="ad40657ed56c", &(0x7f0000000340)=""/128, 0x0, 0x0, 0x0, &(0x7f0000000040)}) 04:46:14 executing program 5: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000480)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_GUEST_DEBUG(r3, 0x4048ae9b, &(0x7f0000000140)={0x1}) syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000100)=[@text32={0x20, &(0x7f0000000000)="6601669b0f35c4e1fe16846ba49e0000b9940200000f32c4c23dad78e0b9670900000f32660f38827f95b0040f01d10fc71a", 0x32}], 0x1, 0x0, &(0x7f0000000040), 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r3, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000400)=[@text32={0x20, &(0x7f0000000880)="b805000000b98b9400000f01c19a01000000b0000f43d1b8000000000f23d80f21f835800000900f23f80f060f2140b9800000c00f3235000800000f3066ba4300b8f1ffffffefb9800000c00f3235002000000f30c4c3295f4da400", 0x5c}], 0x26433e1, 0x0, &(0x7f0000000300), 0x10000000000000b6) ioctl$KVM_RUN(r3, 0xae80, 0x18) 04:46:14 executing program 0: mkdir(&(0x7f0000000200)='./file0\x00', 0x0) mount(&(0x7f00000002c0)=ANY=[], &(0x7f0000001540)='./file0\x00', &(0x7f0000000280)='tmpfs\x00', 0x0, &(0x7f0000000080)) r0 = open$dir(&(0x7f0000000180)='./file0\x00', 0x0, 0x0) mknodat(r0, &(0x7f0000000140)='./file0\x00', 0x0, 0x0) renameat2(r0, &(0x7f0000000080)='./file0\x00', r0, &(0x7f0000000100)='./file1\x00', 0x0) 04:46:14 executing program 0 (fault-call:4 fault-nth:0): mkdir(&(0x7f0000000200)='./file0\x00', 0x0) mount(&(0x7f00000002c0)=ANY=[], &(0x7f0000001540)='./file0\x00', &(0x7f0000000280)='tmpfs\x00', 0x0, &(0x7f0000000080)) r0 = open$dir(&(0x7f0000000180)='./file0\x00', 0x0, 0x0) mknodat(r0, &(0x7f0000000140)='./file0\x00', 0x0, 0x0) renameat2(r0, &(0x7f0000000080)='./file0\x00', r0, &(0x7f0000000100)='./file1\x00', 0x4) [ 628.795784] binder: 23256:23257 unknown command 0 [ 628.820200] binder: 23256:23257 ioctl c0306201 20000100 returned -22 [ 628.832550] binder: 23256:23257 unknown command 0 [ 628.841893] binder: 23256:23257 ioctl c0306201 20000100 returned -22 [ 628.910203] FAULT_INJECTION: forcing a failure. [ 628.910203] name failslab, interval 1, probability 0, space 0, times 0 [ 628.927775] CPU: 1 PID: 23265 Comm: syz-executor0 Not tainted 4.19.0-rc8-next-20181019+ #98 [ 628.936297] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 628.945673] Call Trace: [ 628.948301] dump_stack+0x244/0x39d [ 628.951978] ? dump_stack_print_info.cold.1+0x20/0x20 [ 628.957198] ? debug_smp_processor_id+0x1c/0x20 [ 628.961893] ? perf_trace_lock+0x14d/0x7a0 [ 628.966163] should_fail.cold.4+0xa/0x17 [ 628.970249] ? fault_create_debugfs_attr+0x1f0/0x1f0 [ 628.975377] ? lock_is_held_type+0x210/0x210 [ 628.979810] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 628.985369] ? check_preemption_disabled+0x48/0x280 [ 628.990402] ? _parse_integer+0x134/0x180 [ 628.994571] ? debug_smp_processor_id+0x1c/0x20 [ 628.999257] ? perf_trace_lock+0x14d/0x7a0 [ 629.003506] ? _kstrtoull+0x188/0x250 [ 629.007373] ? find_held_lock+0x36/0x1c0 [ 629.011473] ? __cast5_enc_blk16+0x558/0x4350 [ 629.016015] ? perf_trace_sched_process_exec+0x860/0x860 [ 629.021502] ? apparmor_capable+0x355/0x6c0 [ 629.025868] __should_failslab+0x124/0x180 [ 629.030132] should_failslab+0x9/0x14 [ 629.033979] kmem_cache_alloc+0x2be/0x730 [ 629.038148] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 629.043700] ? security_capable+0x99/0xc0 [ 629.047868] getname_flags+0xd0/0x590 [ 629.051675] ? ns_capable_common+0x13f/0x170 [ 629.051709] do_renameat2+0x319/0x1180 [ 629.051748] ? kasan_check_write+0x14/0x20 [ 629.051778] ? user_path_create+0x40/0x40 [ 629.068507] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 629.074069] ? __sb_end_write+0xd9/0x110 [ 629.078156] ? __sanitizer_cov_trace_const_cmp1+0x1a/0x20 [ 629.083707] ? fput+0x130/0x1a0 [ 629.087007] ? do_syscall_64+0x9a/0x820 [ 629.090991] ? do_syscall_64+0x9a/0x820 [ 629.095574] ? lockdep_hardirqs_on+0x3bb/0x5b0 [ 629.100224] ? trace_hardirqs_on+0xbd/0x310 [ 629.104561] ? __ia32_sys_read+0xb0/0xb0 04:46:15 executing program 1: r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x11, r0, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(0xffffffffffffffff, 0x2405, r0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x1000004, 0x8031, 0xffffffffffffffff, 0x0) 04:46:15 executing program 3: r0 = syz_open_dev$sg(&(0x7f00000000c0)='/dev/sg#\x00', 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000000)={0x53, 0x0, 0x6, 0x0, @buffer={0x209, 0xfffffff, &(0x7f00000001c0)=""/184}, &(0x7f0000000540)="ad40657ed56c", &(0x7f0000000340)=""/128, 0x0, 0x0, 0x0, &(0x7f0000000040)}) 04:46:15 executing program 4: ioctl$KVM_IRQ_LINE(0xffffffffffffffff, 0x4008ae61, &(0x7f0000000500)) r0 = syz_open_dev$dspn(&(0x7f00000004c0)='/dev/dsp#\x00', 0x1, 0x0) openat$audio(0xffffffffffffff9c, &(0x7f0000000000)='/dev/audio\x00', 0x80, 0x0) ioctl$KVM_SET_FPU(0xffffffffffffffff, 0x41a0ae8d, &(0x7f0000000100)={[], 0x0, 0x5531fee, 0x0, 0x0, 0x9, 0xf000, 0x0, [], 0x5}) syz_open_dev$usb(&(0x7f0000000440)='/dev/bus/usb/00#/00#\x00', 0x9, 0x2) r1 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) lstat(&(0x7f0000000040)='./file0/file0\x00', &(0x7f0000000080)) ioctl$EXT4_IOC_MIGRATE(0xffffffffffffffff, 0x6609) sendmmsg$unix(0xffffffffffffffff, &(0x7f000000a000)=[{&(0x7f000000a000)=@abs, 0x6e, &(0x7f000000d000), 0x0, &(0x7f0000000600)=ANY=[]}], 0x1, 0x0) r2 = socket$inet6(0xa, 0x2, 0x0) gettid() r3 = getpgid(0x0) kcmp(0x0, r3, 0x0, 0xffffffffffffffff, 0xffffffffffffffff) connect$inet6(r2, &(0x7f0000002740)={0xa, 0x0, 0x0, @mcast2, 0x4}, 0x1c) sendmmsg(r2, &(0x7f0000007e00), 0x136a88c8311572c, 0xf401) setsockopt$inet6_udp_int(r2, 0x11, 0x0, &(0x7f0000000400), 0x4) openat$kvm(0xffffffffffffff9c, &(0x7f00000003c0)='/dev/kvm\x00', 0x0, 0x0) ioctl$VHOST_SET_VRING_CALL(0xffffffffffffff9c, 0x4008af21, &(0x7f00000002c0)={0x0, r1}) ioctl$SNDRV_TIMER_IOCTL_TREAD(r0, 0x40045402, &(0x7f0000000740)) inotify_rm_watch(0xffffffffffffffff, 0x0) ioctl$ifreq_SIOCGIFINDEX_team(0xffffffffffffffff, 0x8933, &(0x7f0000000480)={'team0\x00'}) 04:46:15 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, &(0x7f0000012fc7)}) close(r0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r1, 0xc018620b, &(0x7f00000000c0)={0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000000)={0x14, 0x0, &(0x7f0000000140)=[@increfs_done={0x40106308, r2}], 0x0, 0x0, &(0x7f0000000f4d)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000100)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0xfffffffffffffc2b, 0x0, &(0x7f0000000680)}) [ 629.108639] ? entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 629.114020] ? trace_hardirqs_off_caller+0x300/0x300 [ 629.119144] __x64_sys_renameat2+0xbe/0x150 [ 629.123496] do_syscall_64+0x1b9/0x820 [ 629.127396] ? entry_SYSCALL_64_after_hwframe+0x3e/0xbe [ 629.132774] ? syscall_return_slowpath+0x5e0/0x5e0 [ 629.137723] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 629.142590] ? trace_hardirqs_on_caller+0x310/0x310 [ 629.147647] ? prepare_exit_to_usermode+0x3b0/0x3b0 [ 629.152681] ? prepare_exit_to_usermode+0x291/0x3b0 [ 629.157719] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 629.162588] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 629.167788] RIP: 0033:0x457569 [ 629.167808] Code: fd b3 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 cb b3 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 629.167818] RSP: 002b:00007f7002694c78 EFLAGS: 00000246 ORIG_RAX: 000000000000013c [ 629.167834] RAX: ffffffffffffffda RBX: 00007f7002694c90 RCX: 0000000000457569 04:46:15 executing program 5: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000480)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_GUEST_DEBUG(r3, 0x4048ae9b, &(0x7f0000000140)={0x1}) syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000100)=[@text32={0x20, &(0x7f0000000000)="6601669b0f35c4e1fe16846ba49e0000b9940200000f32c4c23dad78e0b9670900000f32660f38827f95b0040f01d10fc71a", 0x32}], 0x1, 0x0, &(0x7f0000000040), 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r3, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000400)=[@text32={0x20, &(0x7f0000000880)="b805000000b98b9400000f01c19a01000000b0000f43d1b8000000000f23d80f21f835800000900f23f80f060f2140b9800000c00f3235000800000f3066ba4300b8f1ffffffefb9800000c00f3235002000000f30c4c3295f4da400", 0x5c}], 0x26433e1, 0x0, &(0x7f0000000300), 0x10000000000000b6) ioctl$KVM_RUN(r3, 0xae80, 0x8000a0ffffffff) [ 629.167849] RDX: 0000000000000003 RSI: 0000000020000080 RDI: 0000000000000003 [ 629.190119] RBP: 000000000072bf00 R08: 0000000000000004 R09: 0000000000000000 [ 629.190130] R10: 0000000020000100 R11: 0000000000000246 R12: 00007f70026956d4 [ 629.190139] R13: 00000000004c3291 R14: 00000000004d4ea8 R15: 0000000000000004 [ 629.241006] binder: 23267:23270 BC_INCREFS_DONE u0000000000000000 no match 04:46:15 executing program 3: r0 = syz_open_dev$sg(&(0x7f00000000c0)='/dev/sg#\x00', 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000000)={0x53, 0x0, 0x6, 0x0, @buffer={0x209, 0x209, &(0x7f00000001c0)=""/184}, &(0x7f0000000540)="ad40657ed56c", &(0x7f0000000340)=""/128, 0x0, 0x0, 0x0, &(0x7f0000000040)}) 04:46:15 executing program 0 (fault-call:4 fault-nth:1): mkdir(&(0x7f0000000200)='./file0\x00', 0x0) mount(&(0x7f00000002c0)=ANY=[], &(0x7f0000001540)='./file0\x00', &(0x7f0000000280)='tmpfs\x00', 0x0, &(0x7f0000000080)) r0 = open$dir(&(0x7f0000000180)='./file0\x00', 0x0, 0x0) mknodat(r0, &(0x7f0000000140)='./file0\x00', 0x0, 0x0) renameat2(r0, &(0x7f0000000080)='./file0\x00', r0, &(0x7f0000000100)='./file1\x00', 0x4) 04:46:15 executing program 4: ioctl$KVM_IRQ_LINE(0xffffffffffffffff, 0x4008ae61, &(0x7f0000000500)) r0 = syz_open_dev$dspn(&(0x7f00000004c0)='/dev/dsp#\x00', 0x1, 0x0) openat$audio(0xffffffffffffff9c, &(0x7f0000000000)='/dev/audio\x00', 0x80, 0x0) ioctl$KVM_SET_FPU(0xffffffffffffffff, 0x41a0ae8d, &(0x7f0000000100)={[], 0x0, 0x5531fee, 0x0, 0x0, 0x9, 0xf000, 0x0, [], 0x5}) syz_open_dev$usb(&(0x7f0000000440)='/dev/bus/usb/00#/00#\x00', 0x9, 0x2) r1 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) lstat(&(0x7f0000000040)='./file0/file0\x00', &(0x7f0000000080)) ioctl$EXT4_IOC_MIGRATE(0xffffffffffffffff, 0x6609) sendmmsg$unix(0xffffffffffffffff, &(0x7f000000a000)=[{&(0x7f000000a000)=@abs, 0x6e, &(0x7f000000d000), 0x0, &(0x7f0000000600)=ANY=[]}], 0x1, 0x0) r2 = socket$inet6(0xa, 0x2, 0x0) gettid() r3 = getpgid(0x0) kcmp(0x0, r3, 0x0, 0xffffffffffffffff, 0xffffffffffffffff) connect$inet6(r2, &(0x7f0000002740)={0xa, 0x0, 0x0, @mcast2, 0x4}, 0x1c) sendmmsg(r2, &(0x7f0000007e00), 0x136a88c8311572c, 0xe803) setsockopt$inet6_udp_int(r2, 0x11, 0x0, &(0x7f0000000400), 0x4) openat$kvm(0xffffffffffffff9c, &(0x7f00000003c0)='/dev/kvm\x00', 0x0, 0x0) ioctl$VHOST_SET_VRING_CALL(0xffffffffffffff9c, 0x4008af21, &(0x7f00000002c0)={0x0, r1}) ioctl$SNDRV_TIMER_IOCTL_TREAD(r0, 0x40045402, &(0x7f0000000740)) inotify_rm_watch(0xffffffffffffffff, 0x0) ioctl$ifreq_SIOCGIFINDEX_team(0xffffffffffffffff, 0x8933, &(0x7f0000000480)={'team0\x00'}) 04:46:15 executing program 3: r0 = syz_open_dev$sg(&(0x7f00000000c0)='/dev/sg#\x00', 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000000)={0x53, 0x0, 0x6, 0x0, @buffer={0x209, 0xb8, &(0x7f00000001c0)=""/184}, &(0x7f0000000540)="00f0ffffff7f", &(0x7f0000000340)=""/128, 0x0, 0x0, 0x0, &(0x7f0000000040)}) 04:46:15 executing program 5: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000480)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_GUEST_DEBUG(r3, 0x4048ae9b, &(0x7f0000000140)={0x1}) syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000100)=[@text32={0x20, &(0x7f0000000000)="6601669b0f35c4e1fe16846ba49e0000b9940200000f32c4c23dad78e0b9670900000f32660f38827f95b0040f01d10fc71a", 0x32}], 0x1, 0x0, &(0x7f0000000040), 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r3, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000400)=[@text32={0x20, &(0x7f0000000880)="b805000000b98b9400000f01c19a01000000b0000f43d1b8000000000f23d80f21f835800000900f23f80f060f2140b9800000c00f3235000800000f3066ba4300b8f1ffffffefb9800000c00f3235002000000f30c4c3295f4da400", 0x5c}], 0x26433e1, 0x0, &(0x7f0000000300), 0x10000000000000b6) ioctl$KVM_RUN(r3, 0xae80, 0xc00) 04:46:15 executing program 3: r0 = syz_open_dev$sg(&(0x7f00000000c0)='/dev/sg#\x00', 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000000)={0x53, 0x0, 0x6, 0x0, @buffer={0x209, 0xb8, &(0x7f00000001c0)=""/184}, &(0x7f0000000540)="ad2f657ed56c", &(0x7f0000000340)=""/128, 0x0, 0x0, 0x0, &(0x7f0000000040)}) 04:46:15 executing program 4: ioctl$KVM_IRQ_LINE(0xffffffffffffffff, 0x4008ae61, &(0x7f0000000500)) r0 = syz_open_dev$dspn(&(0x7f00000004c0)='/dev/dsp#\x00', 0x1, 0x0) openat$audio(0xffffffffffffff9c, &(0x7f0000000000)='/dev/audio\x00', 0x80, 0x0) ioctl$KVM_SET_FPU(0xffffffffffffffff, 0x41a0ae8d, &(0x7f0000000100)={[], 0x0, 0x5531fee, 0x0, 0x0, 0x9, 0xf000, 0x0, [], 0x5}) syz_open_dev$usb(&(0x7f0000000440)='/dev/bus/usb/00#/00#\x00', 0x9, 0x2) r1 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) lstat(&(0x7f0000000040)='./file0/file0\x00', &(0x7f0000000080)) ioctl$EXT4_IOC_MIGRATE(0xffffffffffffffff, 0x6609) sendmmsg$unix(0xffffffffffffffff, &(0x7f000000a000)=[{&(0x7f000000a000)=@abs, 0x6e, &(0x7f000000d000), 0x0, &(0x7f0000000600)=ANY=[]}], 0x1, 0x0) r2 = socket$inet6(0xa, 0x2, 0x0) gettid() r3 = getpgid(0x0) kcmp(0x0, r3, 0x0, 0xffffffffffffffff, 0xffffffffffffffff) connect$inet6(r2, &(0x7f0000002740)={0xa, 0x0, 0x0, @mcast2, 0x4}, 0x1c) sendmmsg(r2, &(0x7f0000007e00), 0x136a88c8311572c, 0xf7ffff7f00000000) setsockopt$inet6_udp_int(r2, 0x11, 0x0, &(0x7f0000000400), 0x4) openat$kvm(0xffffffffffffff9c, &(0x7f00000003c0)='/dev/kvm\x00', 0x0, 0x0) ioctl$VHOST_SET_VRING_CALL(0xffffffffffffff9c, 0x4008af21, &(0x7f00000002c0)={0x0, r1}) ioctl$SNDRV_TIMER_IOCTL_TREAD(r0, 0x40045402, &(0x7f0000000740)) inotify_rm_watch(0xffffffffffffffff, 0x0) ioctl$ifreq_SIOCGIFINDEX_team(0xffffffffffffffff, 0x8933, &(0x7f0000000480)={'team0\x00'}) [ 629.733448] FAULT_INJECTION: forcing a failure. [ 629.733448] name fail_page_alloc, interval 1, probability 0, space 0, times 1 [ 629.745304] CPU: 0 PID: 23301 Comm: syz-executor0 Not tainted 4.19.0-rc8-next-20181019+ #98 [ 629.745316] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 629.745324] Call Trace: [ 629.745355] dump_stack+0x244/0x39d [ 629.745388] ? dump_stack_print_info.cold.1+0x20/0x20 [ 629.774849] ? __lock_acquire+0x62f/0x4c20 [ 629.774864] should_fail.cold.4+0xa/0x17 [ 629.774876] ? fault_create_debugfs_attr+0x1f0/0x1f0 [ 629.774884] ? mark_held_locks+0x130/0x130 [ 629.774898] ? check_preemption_disabled+0x48/0x280 [ 629.774912] ? mark_held_locks+0x130/0x130 [ 629.774926] ? mark_held_locks+0x130/0x130 [ 629.774940] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 629.774949] ? check_preemption_disabled+0x48/0x280 [ 629.774960] ? debug_smp_processor_id+0x1c/0x20 [ 629.774969] ? perf_trace_lock+0x14d/0x7a0 [ 629.774977] ? check_preemption_disabled+0x48/0x280 [ 629.774988] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 629.774995] ? should_fail+0x22d/0xd01 [ 629.775004] ? lock_is_held_type+0x210/0x210 [ 629.775014] ? fault_create_debugfs_attr+0x1f0/0x1f0 [ 629.775029] __alloc_pages_nodemask+0x34b/0xdd0 [ 629.775038] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 629.775047] ? check_preemption_disabled+0x48/0x280 [ 629.775058] ? __alloc_pages_slowpath+0x2dd0/0x2dd0 [ 629.775067] ? perf_trace_lock+0x14d/0x7a0 [ 629.775077] ? _kstrtoull+0x188/0x250 [ 629.775092] ? find_held_lock+0x36/0x1c0 [ 629.775144] ? trace_hardirqs_off+0xb8/0x310 [ 629.775169] cache_grow_begin+0xa5/0x8c0 [ 629.775189] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 629.859770] ? check_preemption_disabled+0x48/0x280 [ 629.859799] kmem_cache_alloc+0x66b/0x730 [ 629.859827] getname_flags+0xd0/0x590 [ 629.869852] ? ns_capable_common+0x13f/0x170 [ 629.869875] do_renameat2+0x319/0x1180 [ 629.869904] ? kasan_check_write+0x14/0x20 [ 629.869930] ? user_path_create+0x40/0x40 [ 629.869963] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 629.908974] ? __sb_end_write+0xd9/0x110 [ 629.909003] ? __sanitizer_cov_trace_const_cmp1+0x1a/0x20 [ 629.921625] ? fput+0x130/0x1a0 [ 629.921646] ? do_syscall_64+0x9a/0x820 [ 629.921662] ? do_syscall_64+0x9a/0x820 [ 629.921684] ? lockdep_hardirqs_on+0x3bb/0x5b0 [ 629.921704] ? trace_hardirqs_on+0xbd/0x310 [ 629.921717] ? __ia32_sys_read+0xb0/0xb0 [ 629.921733] ? entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 629.921750] ? trace_hardirqs_off_caller+0x300/0x300 [ 629.921773] __x64_sys_renameat2+0xbe/0x150 [ 629.921796] do_syscall_64+0x1b9/0x820 [ 629.983860] ? entry_SYSCALL_64_after_hwframe+0x3e/0xbe [ 629.989243] ? syscall_return_slowpath+0x5e0/0x5e0 [ 629.994184] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 629.999042] ? trace_hardirqs_on_caller+0x310/0x310 [ 630.004070] ? prepare_exit_to_usermode+0x3b0/0x3b0 [ 630.009099] ? prepare_exit_to_usermode+0x291/0x3b0 [ 630.014130] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 630.018991] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 630.024197] RIP: 0033:0x457569 [ 630.027414] Code: fd b3 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 cb b3 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 630.046322] RSP: 002b:00007f7002694c78 EFLAGS: 00000246 ORIG_RAX: 000000000000013c [ 630.054041] RAX: ffffffffffffffda RBX: 00007f7002694c90 RCX: 0000000000457569 [ 630.061344] RDX: 0000000000000003 RSI: 0000000020000080 RDI: 0000000000000003 [ 630.068627] RBP: 000000000072bf00 R08: 0000000000000004 R09: 0000000000000000 [ 630.075901] R10: 0000000020000100 R11: 0000000000000246 R12: 00007f70026956d4 04:46:16 executing program 1: r0 = perf_event_open(&(0x7f000025c000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000001}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x11, r1, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r0, 0x2405, r1) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x1000004, 0x8031, 0xffffffffffffffff, 0x0) 04:46:16 executing program 5: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000480)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_GUEST_DEBUG(r3, 0x4048ae9b, &(0x7f0000000140)={0x1}) syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000100)=[@text32={0x20, &(0x7f0000000000)="6601669b0f35c4e1fe16846ba49e0000b9940200000f32c4c23dad78e0b9670900000f32660f38827f95b0040f01d10fc71a", 0x32}], 0x1, 0x0, &(0x7f0000000040), 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r3, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000400)=[@text32={0x20, &(0x7f0000000880)="b805000000b98b9400000f01c19a01000000b0000f43d1b8000000000f23d80f21f835800000900f23f80f060f2140b9800000c00f3235000800000f3066ba4300b8f1ffffffefb9800000c00f3235002000000f30c4c3295f4da400", 0x5c}], 0x26433e1, 0x0, &(0x7f0000000300), 0x10000000000000b6) ioctl$KVM_RUN(r3, 0xae80, 0xe803000000000000) 04:46:16 executing program 3: r0 = syz_open_dev$sg(&(0x7f00000000c0)='/dev/sg#\x00', 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000000)={0x53, 0x0, 0x6, 0x0, @buffer={0x209, 0xb8, &(0x7f00000001c0)=""/184}, &(0x7f0000000540)="ad40657ed509", &(0x7f0000000340)=""/128, 0x0, 0x0, 0x0, &(0x7f0000000040)}) [ 630.083175] R13: 00000000004c3291 R14: 00000000004d4ea8 R15: 0000000000000004 [ 630.094622] binder: 23267:23312 BC_INCREFS_DONE u0000000000000000 no match 04:46:16 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, &(0x7f0000012fc7)}) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, &(0x7f0000000f4d)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000100)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0xfffffffffffffc2b, 0x0, &(0x7f0000000680)}) openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x1, 0x0) 04:46:16 executing program 0 (fault-call:4 fault-nth:2): mkdir(&(0x7f0000000200)='./file0\x00', 0x0) mount(&(0x7f00000002c0)=ANY=[], &(0x7f0000001540)='./file0\x00', &(0x7f0000000280)='tmpfs\x00', 0x0, &(0x7f0000000080)) r0 = open$dir(&(0x7f0000000180)='./file0\x00', 0x0, 0x0) mknodat(r0, &(0x7f0000000140)='./file0\x00', 0x0, 0x0) renameat2(r0, &(0x7f0000000080)='./file0\x00', r0, &(0x7f0000000100)='./file1\x00', 0x4) 04:46:16 executing program 3: r0 = syz_open_dev$sg(&(0x7f00000000c0)='/dev/sg#\x00', 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000000)={0x53, 0x0, 0x6, 0x0, @buffer={0x209, 0xb8, &(0x7f00000001c0)=""/184}, &(0x7f0000000540)="ad40657ed56c", &(0x7f0000000340)=""/128, 0x7ffff000, 0x0, 0x0, &(0x7f0000000040)}) 04:46:16 executing program 5: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000480)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_GUEST_DEBUG(r3, 0x4048ae9b, &(0x7f0000000140)={0x1}) syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000100)=[@text32={0x20, &(0x7f0000000000)="6601669b0f35c4e1fe16846ba49e0000b9940200000f32c4c23dad78e0b9670900000f32660f38827f95b0040f01d10fc71a", 0x32}], 0x1, 0x0, &(0x7f0000000040), 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r3, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000400)=[@text32={0x20, &(0x7f0000000880)="b805000000b98b9400000f01c19a01000000b0000f43d1b8000000000f23d80f21f835800000900f23f80f060f2140b9800000c00f3235000800000f3066ba4300b8f1ffffffefb9800000c00f3235002000000f30c4c3295f4da400", 0x5c}], 0x26433e1, 0x0, &(0x7f0000000300), 0x10000000000000b6) ioctl$KVM_RUN(r3, 0xae80, 0x300000000000000) [ 630.363555] FAULT_INJECTION: forcing a failure. [ 630.363555] name failslab, interval 1, probability 0, space 0, times 0 04:46:16 executing program 3: r0 = syz_open_dev$sg(&(0x7f00000000c0)='/dev/sg#\x00', 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000000)={0x53, 0x0, 0x6, 0x0, @buffer={0x209, 0xb8, &(0x7f00000001c0)=""/184}, &(0x7f0000000540)="ad40657ed56c", &(0x7f0000000340)=""/128, 0x100000000000000, 0x0, 0x0, &(0x7f0000000040)}) 04:46:16 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, &(0x7f0000012fc7)}) close(r0) munmap(&(0x7f0000bfd000/0x400000)=nil, 0x400000) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, &(0x7f0000000f4d)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000100)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0xfffffffffffffc2b, 0x0, &(0x7f0000000680)}) [ 630.499348] CPU: 0 PID: 23325 Comm: syz-executor0 Not tainted 4.19.0-rc8-next-20181019+ #98 [ 630.507899] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 630.517289] Call Trace: [ 630.517321] dump_stack+0x244/0x39d [ 630.517350] ? dump_stack_print_info.cold.1+0x20/0x20 [ 630.517373] ? debug_smp_processor_id+0x1c/0x20 [ 630.517395] ? perf_trace_lock+0x14d/0x7a0 [ 630.517420] should_fail.cold.4+0xa/0x17 [ 630.517443] ? fault_create_debugfs_attr+0x1f0/0x1f0 [ 630.546895] ? unlazy_walk+0x1b8/0x550 [ 630.550798] ? lock_downgrade+0x900/0x900 [ 630.554951] ? check_preemption_disabled+0x48/0x280 [ 630.559988] ? rcu_read_unlock_special+0x1c0/0x1c0 [ 630.564929] ? kasan_check_read+0x11/0x20 [ 630.569086] ? dput.part.25+0x26d/0x860 [ 630.573082] ? find_held_lock+0x36/0x1c0 [ 630.577178] ? perf_trace_sched_process_exec+0x860/0x860 [ 630.582638] ? rcu_lockdep_current_cpu_online+0x1a4/0x210 [ 630.588216] ? getname+0x20/0x20 [ 630.591604] __should_failslab+0x124/0x180 [ 630.595854] should_failslab+0x9/0x14 [ 630.599665] kmem_cache_alloc+0x2be/0x730 [ 630.603834] getname_flags+0xd0/0x590 [ 630.607648] do_renameat2+0x37d/0x1180 [ 630.611575] ? kasan_check_write+0x14/0x20 [ 630.615831] ? user_path_create+0x40/0x40 [ 630.620040] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 630.625599] ? __sb_end_write+0xd9/0x110 [ 630.629677] ? __sanitizer_cov_trace_const_cmp1+0x1a/0x20 [ 630.635247] ? fput+0x130/0x1a0 [ 630.638532] ? do_syscall_64+0x9a/0x820 [ 630.642521] ? lockdep_hardirqs_on+0x3bb/0x5b0 [ 630.647113] ? trace_hardirqs_on+0xbd/0x310 [ 630.651443] ? __ia32_sys_read+0xb0/0xb0 [ 630.655512] ? entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 630.660886] ? trace_hardirqs_off_caller+0x300/0x300 [ 630.666008] __x64_sys_renameat2+0xbe/0x150 [ 630.670883] do_syscall_64+0x1b9/0x820 [ 630.674778] ? entry_SYSCALL_64_after_hwframe+0x3e/0xbe [ 630.680335] ? syscall_return_slowpath+0x5e0/0x5e0 [ 630.685277] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 630.690142] ? trace_hardirqs_on_caller+0x310/0x310 [ 630.695174] ? prepare_exit_to_usermode+0x3b0/0x3b0 [ 630.700203] ? prepare_exit_to_usermode+0x291/0x3b0 [ 630.705252] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 630.710114] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 630.715318] RIP: 0033:0x457569 [ 630.718545] Code: fd b3 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 cb b3 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 630.737460] RSP: 002b:00007f7002694c78 EFLAGS: 00000246 ORIG_RAX: 000000000000013c [ 630.745176] RAX: ffffffffffffffda RBX: 00007f7002694c90 RCX: 0000000000457569 [ 630.752453] RDX: 0000000000000003 RSI: 0000000020000080 RDI: 0000000000000003 [ 630.759727] RBP: 000000000072bf00 R08: 0000000000000004 R09: 0000000000000000 [ 630.767001] R10: 0000000020000100 R11: 0000000000000246 R12: 00007f70026956d4 [ 630.774277] R13: 00000000004c3291 R14: 00000000004d4ea8 R15: 0000000000000004 04:46:17 executing program 2: r0 = syz_open_dev$dspn(&(0x7f0000000040)='/dev/dsp#\x00', 0x3, 0x80000) ioctl$TIOCLINUX7(r0, 0x541c, &(0x7f00000000c0)={0x7, 0x8f}) r1 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rtc0\x00', 0x0, 0x0) ioctl$KVM_CHECK_EXTENSION_VM(r1, 0xae03, 0x9) r2 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r3 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, &(0x7f0000012fc7)}) close(r2) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, &(0x7f0000000f4d)}) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000100)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0xfffffffffffffc2b, 0x0, &(0x7f0000000680)}) openat$vhci(0xffffffffffffff9c, &(0x7f0000000140)='/dev/vhci\x00', 0x20000, 0x0) 04:46:17 executing program 4: ioctl$KVM_IRQ_LINE(0xffffffffffffffff, 0x4008ae61, &(0x7f0000000500)) r0 = syz_open_dev$dspn(&(0x7f00000004c0)='/dev/dsp#\x00', 0x1, 0x0) openat$audio(0xffffffffffffff9c, &(0x7f0000000000)='/dev/audio\x00', 0x80, 0x0) ioctl$KVM_SET_FPU(0xffffffffffffffff, 0x41a0ae8d, &(0x7f0000000100)={[], 0x0, 0x5531fee, 0x0, 0x0, 0x9, 0xf000, 0x0, [], 0x5}) syz_open_dev$usb(&(0x7f0000000440)='/dev/bus/usb/00#/00#\x00', 0x9, 0x2) r1 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) lstat(&(0x7f0000000040)='./file0/file0\x00', &(0x7f0000000080)) ioctl$EXT4_IOC_MIGRATE(0xffffffffffffffff, 0x6609) sendmmsg$unix(0xffffffffffffffff, &(0x7f000000a000)=[{&(0x7f000000a000)=@abs, 0x6e, &(0x7f000000d000), 0x0, &(0x7f0000000600)=ANY=[]}], 0x1, 0x0) r2 = socket$inet6(0xa, 0x2, 0x0) gettid() r3 = getpgid(0x0) kcmp(0x0, r3, 0x0, 0xffffffffffffffff, 0xffffffffffffffff) connect$inet6(r2, &(0x7f0000002740)={0xa, 0x0, 0x0, @mcast2, 0x4}, 0x1c) sendmmsg(r2, &(0x7f0000007e00), 0x136a88c8311572c, 0x8000a0ffffffff) setsockopt$inet6_udp_int(r2, 0x11, 0x0, &(0x7f0000000400), 0x4) openat$kvm(0xffffffffffffff9c, &(0x7f00000003c0)='/dev/kvm\x00', 0x0, 0x0) ioctl$VHOST_SET_VRING_CALL(0xffffffffffffff9c, 0x4008af21, &(0x7f00000002c0)={0x0, r1}) ioctl$SNDRV_TIMER_IOCTL_TREAD(r0, 0x40045402, &(0x7f0000000740)) inotify_rm_watch(0xffffffffffffffff, 0x0) ioctl$ifreq_SIOCGIFINDEX_team(0xffffffffffffffff, 0x8933, &(0x7f0000000480)={'team0\x00'}) 04:46:17 executing program 3: r0 = syz_open_dev$sg(&(0x7f00000000c0)='/dev/sg#\x00', 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000000)={0x53, 0x0, 0x6, 0x0, @buffer={0x209, 0xb8, &(0x7f00000001c0)=""/184}, &(0x7f0000000540)="ad40657ed56c", &(0x7f0000000340)=""/128, 0xb800000000000000, 0x0, 0x0, &(0x7f0000000040)}) 04:46:17 executing program 1: r0 = perf_event_open(&(0x7f000025c000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000001}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x11, r1, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r0, 0x2405, r1) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x1000004, 0x8031, 0xffffffffffffffff, 0x0) 04:46:17 executing program 0 (fault-call:4 fault-nth:3): mkdir(&(0x7f0000000200)='./file0\x00', 0x0) mount(&(0x7f00000002c0)=ANY=[], &(0x7f0000001540)='./file0\x00', &(0x7f0000000280)='tmpfs\x00', 0x0, &(0x7f0000000080)) r0 = open$dir(&(0x7f0000000180)='./file0\x00', 0x0, 0x0) mknodat(r0, &(0x7f0000000140)='./file0\x00', 0x0, 0x0) renameat2(r0, &(0x7f0000000080)='./file0\x00', r0, &(0x7f0000000100)='./file1\x00', 0x4) [ 630.977945] binder: 23346:23348 Acquire 1 refcount change on invalid ref 0 ret -22 04:46:17 executing program 3: r0 = syz_open_dev$sg(&(0x7f00000000c0)='/dev/sg#\x00', 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000000)={0x53, 0x0, 0x6, 0x0, @buffer={0x209, 0xb8, &(0x7f00000001c0)=""/184}, &(0x7f0000000540)="ad40657ed56c", &(0x7f0000000340)=""/128, 0x2000000, 0x0, 0x0, &(0x7f0000000040)}) 04:46:17 executing program 5: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000480)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_GUEST_DEBUG(r3, 0x4048ae9b, &(0x7f0000000140)={0x1}) syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000100)=[@text32={0x20, &(0x7f0000000000)="6601669b0f35c4e1fe16846ba49e0000b9940200000f32c4c23dad78e0b9670900000f32660f38827f95b0040f01d10fc71a", 0x32}], 0x1, 0x0, &(0x7f0000000040), 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r3, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000400)=[@text32={0x20, &(0x7f0000000880)="b805000000b98b9400000f01c19a01000000b0000f43d1b8000000000f23d80f21f835800000900f23f80f060f2140b9800000c00f3235000800000f3066ba4300b8f1ffffffefb9800000c00f3235002000000f30c4c3295f4da400", 0x5c}], 0x26433e1, 0x0, &(0x7f0000000300), 0x10000000000000b6) ioctl$KVM_RUN(r3, 0xae80, 0x8000000) [ 631.021942] binder: 23346:23348 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 631.134929] FAULT_INJECTION: forcing a failure. [ 631.134929] name fail_page_alloc, interval 1, probability 0, space 0, times 0 [ 631.146811] CPU: 1 PID: 23364 Comm: syz-executor0 Not tainted 4.19.0-rc8-next-20181019+ #98 [ 631.155329] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 631.164688] Call Trace: [ 631.167301] dump_stack+0x244/0x39d [ 631.170965] ? dump_stack_print_info.cold.1+0x20/0x20 [ 631.176170] ? zap_class+0x640/0x640 [ 631.179906] should_fail.cold.4+0xa/0x17 [ 631.183984] ? fault_create_debugfs_attr+0x1f0/0x1f0 [ 631.189104] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 631.194653] ? check_preemption_disabled+0x48/0x280 [ 631.199686] ? find_held_lock+0x36/0x1c0 [ 631.203774] ? debug_smp_processor_id+0x1c/0x20 [ 631.208473] ? mark_held_locks+0x130/0x130 [ 631.212724] ? lock_is_held_type+0x210/0x210 [ 631.217168] ? zap_class+0x640/0x640 [ 631.220902] ? lockdep_hardirqs_on+0x3bb/0x5b0 [ 631.225496] ? trace_hardirqs_on+0xbd/0x310 [ 631.229829] ? rcu_dynticks_curr_cpu_in_eqs+0xa2/0x170 [ 631.235138] ? path_parentat.isra.41+0x20/0x160 [ 631.239823] ? zap_class+0x640/0x640 [ 631.243550] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 631.249103] ? check_preemption_disabled+0x48/0x280 [ 631.254137] ? debug_smp_processor_id+0x1c/0x20 [ 631.258813] ? perf_trace_lock+0x14d/0x7a0 [ 631.263066] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 631.268615] ? should_fail+0x22d/0xd01 [ 631.272524] ? lock_is_held_type+0x210/0x210 [ 631.276945] ? fault_create_debugfs_attr+0x1f0/0x1f0 [ 631.282072] __alloc_pages_nodemask+0x34b/0xdd0 [ 631.286758] ? check_preemption_disabled+0x48/0x280 [ 631.291792] ? __alloc_pages_slowpath+0x2dd0/0x2dd0 [ 631.296854] ? find_held_lock+0x36/0x1c0 [ 631.300961] ? trace_hardirqs_off+0xb8/0x310 [ 631.305414] cache_grow_begin+0xa5/0x8c0 [ 631.309499] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 631.315068] ? check_preemption_disabled+0x48/0x280 [ 631.320121] kmem_cache_alloc+0x66b/0x730 [ 631.324292] getname_flags+0xd0/0x590 [ 631.328119] do_renameat2+0x37d/0x1180 [ 631.332035] ? kasan_check_write+0x14/0x20 [ 631.336287] ? user_path_create+0x40/0x40 [ 631.340480] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 631.346036] ? __sb_end_write+0xd9/0x110 [ 631.350122] ? __sanitizer_cov_trace_const_cmp1+0x1a/0x20 [ 631.355676] ? fput+0x130/0x1a0 [ 631.358970] ? do_syscall_64+0x9a/0x820 [ 631.362961] ? lockdep_hardirqs_on+0x3bb/0x5b0 [ 631.367553] ? trace_hardirqs_on+0xbd/0x310 [ 631.371883] ? __ia32_sys_read+0xb0/0xb0 [ 631.375958] ? entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 631.381341] ? trace_hardirqs_off_caller+0x300/0x300 [ 631.387249] __x64_sys_renameat2+0xbe/0x150 [ 631.391598] do_syscall_64+0x1b9/0x820 [ 631.395497] ? entry_SYSCALL_64_after_hwframe+0x3e/0xbe [ 631.400871] ? syscall_return_slowpath+0x5e0/0x5e0 [ 631.405808] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 631.410669] ? trace_hardirqs_on_caller+0x310/0x310 [ 631.415701] ? prepare_exit_to_usermode+0x3b0/0x3b0 [ 631.420734] ? prepare_exit_to_usermode+0x291/0x3b0 [ 631.425766] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 631.430640] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 631.435835] RIP: 0033:0x457569 [ 631.439053] Code: fd b3 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 cb b3 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 631.457968] RSP: 002b:00007f7002694c78 EFLAGS: 00000246 ORIG_RAX: 000000000000013c [ 631.465700] RAX: ffffffffffffffda RBX: 00007f7002694c90 RCX: 0000000000457569 [ 631.472976] RDX: 0000000000000003 RSI: 0000000020000080 RDI: 0000000000000003 04:46:17 executing program 3: r0 = syz_open_dev$sg(&(0x7f00000000c0)='/dev/sg#\x00', 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000000)={0x53, 0x0, 0x6, 0x0, @buffer={0x209, 0xb8, &(0x7f00000001c0)=""/184}, &(0x7f0000000540)="ad40657ed56c", &(0x7f0000000340)=""/128, 0x7ffffffff000, 0x0, 0x0, &(0x7f0000000040)}) [ 631.480250] RBP: 000000000072bf00 R08: 0000000000000004 R09: 0000000000000000 [ 631.487700] R10: 0000000020000100 R11: 0000000000000246 R12: 00007f70026956d4 [ 631.494972] R13: 00000000004c3291 R14: 00000000004d4ea8 R15: 0000000000000004 04:46:17 executing program 5: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000480)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_GUEST_DEBUG(r3, 0x4048ae9b, &(0x7f0000000140)={0x1}) syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000100)=[@text32={0x20, &(0x7f0000000000)="6601669b0f35c4e1fe16846ba49e0000b9940200000f32c4c23dad78e0b9670900000f32660f38827f95b0040f01d10fc71a", 0x32}], 0x1, 0x0, &(0x7f0000000040), 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r3, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000400)=[@text32={0x20, &(0x7f0000000880)="b805000000b98b9400000f01c19a01000000b0000f43d1b8000000000f23d80f21f835800000900f23f80f060f2140b9800000c00f3235000800000f3066ba4300b8f1ffffffefb9800000c00f3235002000000f30c4c3295f4da400", 0x5c}], 0x26433e1, 0x0, &(0x7f0000000300), 0x10000000000000b6) ioctl$KVM_RUN(r3, 0xae80, 0x8000a0) 04:46:17 executing program 3: r0 = syz_open_dev$sg(&(0x7f00000000c0)='/dev/sg#\x00', 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000000)={0x53, 0x0, 0x6, 0x0, @buffer={0x209, 0xb8, &(0x7f00000001c0)=""/184}, &(0x7f0000000540)="ad40657ed56c", &(0x7f0000000340)=""/128, 0x6cd57e6540ad, 0x0, 0x0, &(0x7f0000000040)}) 04:46:17 executing program 4: ioctl$KVM_IRQ_LINE(0xffffffffffffffff, 0x4008ae61, &(0x7f0000000500)) r0 = syz_open_dev$dspn(&(0x7f00000004c0)='/dev/dsp#\x00', 0x1, 0x0) openat$audio(0xffffffffffffff9c, &(0x7f0000000000)='/dev/audio\x00', 0x80, 0x0) ioctl$KVM_SET_FPU(0xffffffffffffffff, 0x41a0ae8d, &(0x7f0000000100)={[], 0x0, 0x5531fee, 0x0, 0x0, 0x9, 0xf000, 0x0, [], 0x5}) syz_open_dev$usb(&(0x7f0000000440)='/dev/bus/usb/00#/00#\x00', 0x9, 0x2) r1 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) lstat(&(0x7f0000000040)='./file0/file0\x00', &(0x7f0000000080)) ioctl$EXT4_IOC_MIGRATE(0xffffffffffffffff, 0x6609) sendmmsg$unix(0xffffffffffffffff, &(0x7f000000a000)=[{&(0x7f000000a000)=@abs, 0x6e, &(0x7f000000d000), 0x0, &(0x7f0000000600)=ANY=[]}], 0x1, 0x0) r2 = socket$inet6(0xa, 0x2, 0x0) gettid() r3 = getpgid(0x0) kcmp(0x0, r3, 0x0, 0xffffffffffffffff, 0xffffffffffffffff) connect$inet6(r2, &(0x7f0000002740)={0xa, 0x0, 0x0, @mcast2, 0x4}, 0x1c) sendmmsg(r2, &(0x7f0000007e00), 0x136a88c8311572c, 0x700000000000000) setsockopt$inet6_udp_int(r2, 0x11, 0x0, &(0x7f0000000400), 0x4) openat$kvm(0xffffffffffffff9c, &(0x7f00000003c0)='/dev/kvm\x00', 0x0, 0x0) ioctl$VHOST_SET_VRING_CALL(0xffffffffffffff9c, 0x4008af21, &(0x7f00000002c0)={0x0, r1}) ioctl$SNDRV_TIMER_IOCTL_TREAD(r0, 0x40045402, &(0x7f0000000740)) inotify_rm_watch(0xffffffffffffffff, 0x0) ioctl$ifreq_SIOCGIFINDEX_team(0xffffffffffffffff, 0x8933, &(0x7f0000000480)={'team0\x00'}) 04:46:17 executing program 5: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000480)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_GUEST_DEBUG(r3, 0x4048ae9b, &(0x7f0000000140)={0x1}) syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000100)=[@text32={0x20, &(0x7f0000000000)="6601669b0f35c4e1fe16846ba49e0000b9940200000f32c4c23dad78e0b9670900000f32660f38827f95b0040f01d10fc71a", 0x32}], 0x1, 0x0, &(0x7f0000000040), 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r3, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000400)=[@text32={0x20, &(0x7f0000000880)="b805000000b98b9400000f01c19a01000000b0000f43d1b8000000000f23d80f21f835800000900f23f80f060f2140b9800000c00f3235000800000f3066ba4300b8f1ffffffefb9800000c00f3235002000000f30c4c3295f4da400", 0x5c}], 0x26433e1, 0x0, &(0x7f0000000300), 0x10000000000000b6) ioctl$KVM_RUN(r3, 0xae80, 0x1000000) [ 631.775088] binder: 23346:23367 Acquire 1 refcount change on invalid ref 0 ret -22 04:46:18 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = accept4$inet6(0xffffffffffffff9c, &(0x7f0000000000)={0xa, 0x0, 0x0, @loopback}, &(0x7f0000000040)=0x1c, 0x80000) ioctl$sock_inet6_udp_SIOCINQ(r2, 0x541b, &(0x7f00000000c0)) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000001c0)={0x11, 0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB="05630440000000001f4aceee753317b377de0c0de971a8b80796b6966a5596077c5099d315600f6f22d5652109fe1576a6b4f9415098a5f678ff41fa2ab4f97060a3593d087077190297759ad5a0408cedc309922941fad641adbafd41ebcade067ef8ef24d64609a797468b668695d760532f9e89eca5621cba194457e86dbbcad8e55f300dd4e1a1703795f407e8fca75f1b4aee3800000000"], 0x0, 0x0, &(0x7f0000012fc7)}) close(r0) syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0x0, 0x2) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="e800b9400900807d6a9f2138e0df56f7813e286ccb9abb06aed09354334e5c5142065468817efa378e24f4ad6e0c4801cfda9a7376ab15dc58453855a8b9bf121a5ced72038c76020947841a7b88e0b7d181190cafcd3f021403694aceef19902b01fa0eebfeda5c184eb6c5b59ba19c086b6f916a56aeebc4a6ccc4fe68f14117120e30b4a79e81f88bd66b1534e5940e20683920a3cca1f84c1822160c8aeecf39fa608f57a0e2f43b7a9afbe79d404dbac8bba0a3e4e770d76c57"], 0x0, 0x0, &(0x7f0000000f4d)}) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r2, 0x6, 0x16, &(0x7f0000000140)=[{0x0, 0x9}, {0xa, 0x5}, {0x3, 0x9}], 0x3) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000100)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0xfffffffffffffc2b, 0x0, &(0x7f0000000680)}) 04:46:18 executing program 3: r0 = syz_open_dev$sg(&(0x7f00000000c0)='/dev/sg#\x00', 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000000)={0x53, 0x0, 0x6, 0x0, @buffer={0x209, 0xb8, &(0x7f00000001c0)=""/184}, &(0x7f0000000540)="ad40657ed56c", &(0x7f0000000340)=""/128, 0xad40657ed56c0000, 0x0, 0x0, &(0x7f0000000040)}) 04:46:18 executing program 0 (fault-call:4 fault-nth:4): mkdir(&(0x7f0000000200)='./file0\x00', 0x0) mount(&(0x7f00000002c0)=ANY=[], &(0x7f0000001540)='./file0\x00', &(0x7f0000000280)='tmpfs\x00', 0x0, &(0x7f0000000080)) r0 = open$dir(&(0x7f0000000180)='./file0\x00', 0x0, 0x0) mknodat(r0, &(0x7f0000000140)='./file0\x00', 0x0, 0x0) renameat2(r0, &(0x7f0000000080)='./file0\x00', r0, &(0x7f0000000100)='./file1\x00', 0x4) [ 631.927932] binder: 23394:23395 unknown command -288470497 [ 631.943323] binder: 23394:23395 ioctl c0306201 200001c0 returned -22 04:46:18 executing program 1: r0 = perf_event_open(&(0x7f000025c000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000001}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x11, r1, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r0, 0x2405, r1) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x1000004, 0x8031, 0xffffffffffffffff, 0x0) 04:46:18 executing program 3: r0 = syz_open_dev$sg(&(0x7f00000000c0)='/dev/sg#\x00', 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000000)={0x53, 0x0, 0x6, 0x0, @buffer={0x209, 0xb8, &(0x7f00000001c0)=""/184}, &(0x7f0000000540)="ad40657ed56c", &(0x7f0000000340)=""/128, 0x902000000000000, 0x0, 0x0, &(0x7f0000000040)}) 04:46:18 executing program 5: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000480)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_GUEST_DEBUG(r3, 0x4048ae9b, &(0x7f0000000140)={0x1}) syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000100)=[@text32={0x20, &(0x7f0000000000)="6601669b0f35c4e1fe16846ba49e0000b9940200000f32c4c23dad78e0b9670900000f32660f38827f95b0040f01d10fc71a", 0x32}], 0x1, 0x0, &(0x7f0000000040), 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r3, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000400)=[@text32={0x20, &(0x7f0000000880)="b805000000b98b9400000f01c19a01000000b0000f43d1b8000000000f23d80f21f835800000900f23f80f060f2140b9800000c00f3235000800000f3066ba4300b8f1ffffffefb9800000c00f3235002000000f30c4c3295f4da400", 0x5c}], 0x26433e1, 0x0, &(0x7f0000000300), 0x10000000000000b6) ioctl$KVM_RUN(r3, 0xae80, 0xffffffffa0008000) [ 632.004193] binder: 23394:23395 unknown command 1085866216 [ 632.075658] FAULT_INJECTION: forcing a failure. [ 632.075658] name failslab, interval 1, probability 0, space 0, times 0 [ 632.091739] binder: 23394:23395 ioctl c0306201 20008fd0 returned -22 [ 632.111629] CPU: 0 PID: 23403 Comm: syz-executor0 Not tainted 4.19.0-rc8-next-20181019+ #98 [ 632.120161] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 632.129553] Call Trace: [ 632.132165] dump_stack+0x244/0x39d [ 632.135822] ? dump_stack_print_info.cold.1+0x20/0x20 [ 632.141030] ? debug_smp_processor_id+0x1c/0x20 [ 632.145708] ? perf_trace_lock+0x14d/0x7a0 [ 632.149958] should_fail.cold.4+0xa/0x17 [ 632.154030] ? fault_create_debugfs_attr+0x1f0/0x1f0 [ 632.159140] ? __lock_acquire+0x62f/0x4c20 [ 632.163394] ? save_stack+0xa9/0xd0 [ 632.167035] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 632.172590] ? check_preemption_disabled+0x48/0x280 [ 632.177623] ? zap_class+0x640/0x640 [ 632.181349] ? debug_smp_processor_id+0x1c/0x20 [ 632.186026] ? perf_trace_lock+0x14d/0x7a0 [ 632.190278] ? find_held_lock+0x36/0x1c0 [ 632.194375] ? __lock_is_held+0xb5/0x140 [ 632.198469] ? perf_trace_sched_process_exec+0x860/0x860 [ 632.203932] ? lock_is_held_type+0x210/0x210 [ 632.208367] __should_failslab+0x124/0x180 [ 632.212627] should_failslab+0x9/0x14 [ 632.216443] kmem_cache_alloc+0x2be/0x730 [ 632.220616] ? lock_downgrade+0x900/0x900 [ 632.224780] ? shmem_destroy_callback+0xc0/0xc0 [ 632.229466] shmem_alloc_inode+0x1b/0x40 [ 632.233538] alloc_inode+0x63/0x190 [ 632.237172] new_inode_pseudo+0x71/0x1a0 [ 632.241241] ? prune_icache_sb+0x1c0/0x1c0 [ 632.245501] new_inode+0x1c/0x40 [ 632.248877] shmem_get_inode+0xf1/0x920 [ 632.252866] ? shmem_encode_fh+0x340/0x340 [ 632.257127] ? _raw_spin_unlock+0x2c/0x50 [ 632.261308] ? d_alloc+0x290/0x380 [ 632.264863] ? __d_alloc+0xb90/0xb90 [ 632.268594] shmem_mknod+0x5a/0x1f0 [ 632.272232] shmem_rename2+0x364/0x780 [ 632.276129] vfs_rename+0x7fc/0x1a90 [ 632.279863] ? lookup_one_len+0x220/0x220 [ 632.284036] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 632.289603] ? security_path_rename+0x210/0x300 [ 632.294294] do_renameat2+0xea5/0x1180 [ 632.298213] ? user_path_create+0x40/0x40 [ 632.302390] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 632.307940] ? __sb_end_write+0xd9/0x110 [ 632.312013] ? __sanitizer_cov_trace_const_cmp1+0x1a/0x20 [ 632.317557] ? fput+0x130/0x1a0 [ 632.320851] ? do_syscall_64+0x9a/0x820 [ 632.324838] ? lockdep_hardirqs_on+0x3bb/0x5b0 [ 632.329433] ? trace_hardirqs_on+0xbd/0x310 [ 632.333763] ? entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 632.339131] ? trace_hardirqs_off_caller+0x300/0x300 [ 632.344257] __x64_sys_renameat2+0xbe/0x150 [ 632.348614] do_syscall_64+0x1b9/0x820 [ 632.352514] ? entry_SYSCALL_64_after_hwframe+0x3e/0xbe [ 632.357886] ? syscall_return_slowpath+0x5e0/0x5e0 [ 632.362821] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 632.367673] ? trace_hardirqs_on_caller+0x310/0x310 [ 632.372700] ? prepare_exit_to_usermode+0x3b0/0x3b0 [ 632.377723] ? prepare_exit_to_usermode+0x291/0x3b0 [ 632.382760] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 632.387627] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 632.392819] RIP: 0033:0x457569 [ 632.396019] Code: fd b3 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 cb b3 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 632.414926] RSP: 002b:00007f7002694c78 EFLAGS: 00000246 ORIG_RAX: 000000000000013c 04:46:18 executing program 3: r0 = syz_open_dev$sg(&(0x7f00000000c0)='/dev/sg#\x00', 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000000)={0x53, 0x0, 0x6, 0x0, @buffer={0x209, 0xb8, &(0x7f00000001c0)=""/184}, &(0x7f0000000540)="ad40657ed56c", &(0x7f0000000340)=""/128, 0xf0ff7f00000000, 0x0, 0x0, &(0x7f0000000040)}) [ 632.422663] RAX: ffffffffffffffda RBX: 00007f7002694c90 RCX: 0000000000457569 [ 632.429935] RDX: 0000000000000003 RSI: 0000000020000080 RDI: 0000000000000003 [ 632.437232] RBP: 000000000072bf00 R08: 0000000000000004 R09: 0000000000000000 [ 632.444512] R10: 0000000020000100 R11: 0000000000000246 R12: 00007f70026956d4 [ 632.451789] R13: 00000000004c3291 R14: 00000000004d4ea8 R15: 0000000000000004 [ 632.508673] binder: 23394:23395 unknown command -288470497 [ 632.509336] binder: 23394:23413 unknown command 1085866216 [ 632.522836] binder: 23394:23395 ioctl c0306201 200001c0 returned -22 04:46:18 executing program 3: r0 = syz_open_dev$sg(&(0x7f00000000c0)='/dev/sg#\x00', 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000000)={0x53, 0x0, 0x6, 0x0, @buffer={0x209, 0xb8, &(0x7f00000001c0)=""/184}, &(0x7f0000000540)="ad40657ed56c", &(0x7f0000000340)=""/128, 0xb8000000, 0x0, 0x0, &(0x7f0000000040)}) 04:46:18 executing program 0 (fault-call:4 fault-nth:5): mkdir(&(0x7f0000000200)='./file0\x00', 0x0) mount(&(0x7f00000002c0)=ANY=[], &(0x7f0000001540)='./file0\x00', &(0x7f0000000280)='tmpfs\x00', 0x0, &(0x7f0000000080)) r0 = open$dir(&(0x7f0000000180)='./file0\x00', 0x0, 0x0) mknodat(r0, &(0x7f0000000140)='./file0\x00', 0x0, 0x0) renameat2(r0, &(0x7f0000000080)='./file0\x00', r0, &(0x7f0000000100)='./file1\x00', 0x4) [ 632.589461] binder: 23394:23413 ioctl c0306201 20008fd0 returned -22 04:46:18 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, &(0x7f0000012fc7)}) close(r0) r2 = creat(&(0x7f0000000000)='./file0\x00', 0x8) write$FUSE_NOTIFY_INVAL_INODE(r2, &(0x7f0000000040)={0x28, 0x2, 0x0, {0x1, 0x60, 0x1}}, 0x28) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, &(0x7f0000000f4d)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000100)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0xfffffffffffffc2b, 0x0, &(0x7f0000000680)}) [ 632.764948] FAULT_INJECTION: forcing a failure. [ 632.764948] name failslab, interval 1, probability 0, space 0, times 0 [ 632.810357] CPU: 0 PID: 23423 Comm: syz-executor0 Not tainted 4.19.0-rc8-next-20181019+ #98 [ 632.819177] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 632.828545] Call Trace: [ 632.831168] dump_stack+0x244/0x39d [ 632.834830] ? dump_stack_print_info.cold.1+0x20/0x20 [ 632.840050] ? debug_smp_processor_id+0x1c/0x20 [ 632.844739] ? perf_trace_lock+0x14d/0x7a0 [ 632.849008] should_fail.cold.4+0xa/0x17 [ 632.853090] ? fault_create_debugfs_attr+0x1f0/0x1f0 [ 632.858233] ? zap_class+0x640/0x640 [ 632.861980] ? find_held_lock+0x36/0x1c0 [ 632.866067] ? __lock_is_held+0xb5/0x140 [ 632.870172] ? check_preemption_disabled+0x48/0x280 [ 632.875208] ? perf_trace_sched_process_exec+0x860/0x860 [ 632.880680] ? perf_trace_lock+0x14d/0x7a0 [ 632.884933] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 632.890504] __should_failslab+0x124/0x180 [ 632.894764] should_failslab+0x9/0x14 [ 632.898626] kmem_cache_alloc+0x2be/0x730 [ 632.902810] __d_alloc+0xc8/0xb90 [ 632.906289] ? shrink_dcache_for_umount+0x2b0/0x2b0 [ 632.911332] ? find_held_lock+0x36/0x1c0 [ 632.915422] ? simple_empty+0xdb/0x150 [ 632.919336] ? lock_downgrade+0x900/0x900 [ 632.923618] ? kasan_check_read+0x11/0x20 [ 632.927792] d_alloc+0x96/0x380 [ 632.931120] ? __d_alloc+0xb90/0xb90 [ 632.934850] ? _raw_spin_unlock+0x2c/0x50 [ 632.939030] shmem_rename2+0x33c/0x780 [ 632.942940] vfs_rename+0x7fc/0x1a90 [ 632.946682] ? lookup_one_len+0x220/0x220 [ 632.950854] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 632.956409] ? security_path_rename+0x210/0x300 [ 632.961112] do_renameat2+0xea5/0x1180 [ 632.965045] ? user_path_create+0x40/0x40 [ 632.969240] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 632.974807] ? __sb_end_write+0xd9/0x110 [ 632.978892] ? __sanitizer_cov_trace_const_cmp1+0x1a/0x20 [ 632.984450] ? fput+0x130/0x1a0 [ 632.987749] ? do_syscall_64+0x9a/0x820 [ 632.991746] ? lockdep_hardirqs_on+0x3bb/0x5b0 [ 632.996358] ? trace_hardirqs_on+0xbd/0x310 [ 633.000704] ? entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 633.006086] ? trace_hardirqs_off_caller+0x300/0x300 [ 633.011214] __x64_sys_renameat2+0xbe/0x150 [ 633.015562] do_syscall_64+0x1b9/0x820 [ 633.019508] ? entry_SYSCALL_64_after_hwframe+0x3e/0xbe [ 633.024905] ? syscall_return_slowpath+0x5e0/0x5e0 [ 633.029852] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 633.034729] ? trace_hardirqs_on_caller+0x310/0x310 [ 633.039764] ? prepare_exit_to_usermode+0x3b0/0x3b0 [ 633.044804] ? prepare_exit_to_usermode+0x291/0x3b0 [ 633.049852] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 633.053770] cgroup: fork rejected by pids controller in /syz4 [ 633.054721] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 633.054747] RIP: 0033:0x457569 [ 633.054768] Code: fd b3 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 cb b3 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 633.087942] RSP: 002b:00007f7002694c78 EFLAGS: 00000246 ORIG_RAX: 000000000000013c [ 633.095666] RAX: ffffffffffffffda RBX: 00007f7002694c90 RCX: 0000000000457569 [ 633.102951] RDX: 0000000000000003 RSI: 0000000020000080 RDI: 0000000000000003 04:46:19 executing program 4: ioctl$KVM_IRQ_LINE(0xffffffffffffffff, 0x4008ae61, &(0x7f0000000500)) r0 = syz_open_dev$dspn(&(0x7f00000004c0)='/dev/dsp#\x00', 0x1, 0x0) openat$audio(0xffffffffffffff9c, &(0x7f0000000000)='/dev/audio\x00', 0x80, 0x0) ioctl$KVM_SET_FPU(0xffffffffffffffff, 0x41a0ae8d, &(0x7f0000000100)={[], 0x0, 0x5531fee, 0x0, 0x0, 0x9, 0xf000, 0x0, [], 0x5}) syz_open_dev$usb(&(0x7f0000000440)='/dev/bus/usb/00#/00#\x00', 0x9, 0x2) r1 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) lstat(&(0x7f0000000040)='./file0/file0\x00', &(0x7f0000000080)) ioctl$EXT4_IOC_MIGRATE(0xffffffffffffffff, 0x6609) sendmmsg$unix(0xffffffffffffffff, &(0x7f000000a000)=[{&(0x7f000000a000)=@abs, 0x6e, &(0x7f000000d000), 0x0, &(0x7f0000000600)=ANY=[]}], 0x1, 0x0) r2 = socket$inet6(0xa, 0x2, 0x0) gettid() r3 = getpgid(0x0) kcmp(0x0, r3, 0x0, 0xffffffffffffffff, 0xffffffffffffffff) connect$inet6(r2, &(0x7f0000002740)={0xa, 0x0, 0x0, @mcast2, 0x4}, 0x1c) sendmmsg(r2, &(0x7f0000007e00), 0x136a88c8311572c, 0x500) setsockopt$inet6_udp_int(r2, 0x11, 0x0, &(0x7f0000000400), 0x4) openat$kvm(0xffffffffffffff9c, &(0x7f00000003c0)='/dev/kvm\x00', 0x0, 0x0) ioctl$VHOST_SET_VRING_CALL(0xffffffffffffff9c, 0x4008af21, &(0x7f00000002c0)={0x0, r1}) ioctl$SNDRV_TIMER_IOCTL_TREAD(r0, 0x40045402, &(0x7f0000000740)) inotify_rm_watch(0xffffffffffffffff, 0x0) ioctl$ifreq_SIOCGIFINDEX_team(0xffffffffffffffff, 0x8933, &(0x7f0000000480)={'team0\x00'}) 04:46:19 executing program 5: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000480)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_GUEST_DEBUG(r3, 0x4048ae9b, &(0x7f0000000140)={0x1}) syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000100)=[@text32={0x20, &(0x7f0000000000)="6601669b0f35c4e1fe16846ba49e0000b9940200000f32c4c23dad78e0b9670900000f32660f38827f95b0040f01d10fc71a", 0x32}], 0x1, 0x0, &(0x7f0000000040), 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r3, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000400)=[@text32={0x20, &(0x7f0000000880)="b805000000b98b9400000f01c19a01000000b0000f43d1b8000000000f23d80f21f835800000900f23f80f060f2140b9800000c00f3235000800000f3066ba4300b8f1ffffffefb9800000c00f3235002000000f30c4c3295f4da400", 0x5c}], 0x26433e1, 0x0, &(0x7f0000000300), 0x10000000000000b6) ioctl$KVM_RUN(r3, 0xae80, 0x11) 04:46:19 executing program 3: r0 = syz_open_dev$sg(&(0x7f00000000c0)='/dev/sg#\x00', 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000000)={0x53, 0x0, 0x6, 0x0, @buffer={0x209, 0xb8, &(0x7f00000001c0)=""/184}, &(0x7f0000000540)="ad40657ed56c", &(0x7f0000000340)=""/128, 0xf0ffffff7f0000, 0x0, 0x0, &(0x7f0000000040)}) [ 633.110245] RBP: 000000000072bf00 R08: 0000000000000004 R09: 0000000000000000 [ 633.117542] R10: 0000000020000100 R11: 0000000000000246 R12: 00007f70026956d4 [ 633.124830] R13: 00000000004c3291 R14: 00000000004d4ea8 R15: 0000000000000004 04:46:19 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, &(0x7f0000012fc7)}) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], 0x0, 0x0, &(0x7f0000000f4d)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000100)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0xfffffffffffffc2b, 0x0, &(0x7f0000000680)}) r2 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000000)='/dev/snapshot\x00', 0x40, 0x0) setsockopt$bt_hci_HCI_TIME_STAMP(r2, 0x0, 0x3, &(0x7f0000000040)=0x80000001, 0x4) ioctl$SG_GET_TIMEOUT(r2, 0x2202, 0x0) 04:46:19 executing program 1: r0 = perf_event_open(&(0x7f000025c000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000001}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x11, r1, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r0, 0x2405, r1) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x1000004, 0x8031, 0xffffffffffffffff, 0x0) 04:46:19 executing program 0 (fault-call:4 fault-nth:6): mkdir(&(0x7f0000000200)='./file0\x00', 0x0) mount(&(0x7f00000002c0)=ANY=[], &(0x7f0000001540)='./file0\x00', &(0x7f0000000280)='tmpfs\x00', 0x0, &(0x7f0000000080)) r0 = open$dir(&(0x7f0000000180)='./file0\x00', 0x0, 0x0) mknodat(r0, &(0x7f0000000140)='./file0\x00', 0x0, 0x0) renameat2(r0, &(0x7f0000000080)='./file0\x00', r0, &(0x7f0000000100)='./file1\x00', 0x4) 04:46:19 executing program 3: r0 = syz_open_dev$sg(&(0x7f00000000c0)='/dev/sg#\x00', 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000000)={0x53, 0x0, 0x6, 0x0, @buffer={0x209, 0xb8, &(0x7f00000001c0)=""/184}, &(0x7f0000000540)="ad40657ed56c", &(0x7f0000000340)=""/128, 0x9020000, 0x0, 0x0, &(0x7f0000000040)}) [ 633.299005] binder: 23440:23441 unknown command 0 [ 633.310348] binder: 23440:23441 ioctl c0306201 20008fd0 returned -22 [ 633.452726] FAULT_INJECTION: forcing a failure. [ 633.452726] name failslab, interval 1, probability 0, space 0, times 0 [ 633.494747] CPU: 1 PID: 23451 Comm: syz-executor0 Not tainted 4.19.0-rc8-next-20181019+ #98 [ 633.503291] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 633.512670] Call Trace: [ 633.515272] dump_stack+0x244/0x39d [ 633.518967] ? dump_stack_print_info.cold.1+0x20/0x20 [ 633.524179] ? debug_smp_processor_id+0x1c/0x20 [ 633.528858] ? perf_trace_lock+0x14d/0x7a0 [ 633.533112] should_fail.cold.4+0xa/0x17 [ 633.537186] ? fault_create_debugfs_attr+0x1f0/0x1f0 [ 633.542295] ? __lock_acquire+0x62f/0x4c20 [ 633.546558] ? save_stack+0xa9/0xd0 [ 633.550203] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 633.555766] ? check_preemption_disabled+0x48/0x280 [ 633.560793] ? zap_class+0x640/0x640 [ 633.564517] ? debug_smp_processor_id+0x1c/0x20 [ 633.569191] ? perf_trace_lock+0x14d/0x7a0 [ 633.573440] ? find_held_lock+0x36/0x1c0 [ 633.577512] ? __lock_is_held+0xb5/0x140 [ 633.581641] ? perf_trace_sched_process_exec+0x860/0x860 [ 633.587106] ? lock_is_held_type+0x210/0x210 [ 633.591532] __should_failslab+0x124/0x180 [ 633.595805] should_failslab+0x9/0x14 [ 633.599616] kmem_cache_alloc+0x2be/0x730 [ 633.603782] ? lock_downgrade+0x900/0x900 [ 633.607941] ? shmem_destroy_callback+0xc0/0xc0 [ 633.612651] shmem_alloc_inode+0x1b/0x40 [ 633.616724] alloc_inode+0x63/0x190 [ 633.620358] new_inode_pseudo+0x71/0x1a0 [ 633.624432] ? prune_icache_sb+0x1c0/0x1c0 [ 633.628686] new_inode+0x1c/0x40 [ 633.632062] shmem_get_inode+0xf1/0x920 [ 633.636051] ? shmem_encode_fh+0x340/0x340 [ 633.640318] ? _raw_spin_unlock+0x2c/0x50 [ 633.644472] ? d_alloc+0x290/0x380 [ 633.648034] ? __d_alloc+0xb90/0xb90 [ 633.651761] shmem_mknod+0x5a/0x1f0 [ 633.655398] shmem_rename2+0x364/0x780 [ 633.659296] vfs_rename+0x7fc/0x1a90 [ 633.663038] ? lookup_one_len+0x220/0x220 [ 633.667229] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 633.672778] ? security_path_rename+0x210/0x300 [ 633.677462] do_renameat2+0xea5/0x1180 [ 633.681376] ? user_path_create+0x40/0x40 [ 633.685546] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 633.691105] ? __sb_end_write+0xd9/0x110 [ 633.695178] ? __sanitizer_cov_trace_const_cmp1+0x1a/0x20 [ 633.700727] ? fput+0x130/0x1a0 [ 633.704011] ? do_syscall_64+0x9a/0x820 [ 633.707998] ? lockdep_hardirqs_on+0x3bb/0x5b0 [ 633.712591] ? trace_hardirqs_on+0xbd/0x310 [ 633.716924] ? entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 633.722298] ? trace_hardirqs_off_caller+0x300/0x300 [ 633.727418] __x64_sys_renameat2+0xbe/0x150 [ 633.731768] do_syscall_64+0x1b9/0x820 [ 633.735669] ? entry_SYSCALL_64_after_hwframe+0x3e/0xbe [ 633.741041] ? syscall_return_slowpath+0x5e0/0x5e0 [ 633.745977] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 633.750830] ? trace_hardirqs_on_caller+0x310/0x310 [ 633.755855] ? prepare_exit_to_usermode+0x3b0/0x3b0 [ 633.760881] ? prepare_exit_to_usermode+0x291/0x3b0 [ 633.765912] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 633.770773] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 633.776154] RIP: 0033:0x457569 04:46:20 executing program 4: ioctl$KVM_IRQ_LINE(0xffffffffffffffff, 0x4008ae61, &(0x7f0000000500)) r0 = syz_open_dev$dspn(&(0x7f00000004c0)='/dev/dsp#\x00', 0x1, 0x0) openat$audio(0xffffffffffffff9c, &(0x7f0000000000)='/dev/audio\x00', 0x80, 0x0) ioctl$KVM_SET_FPU(0xffffffffffffffff, 0x41a0ae8d, &(0x7f0000000100)={[], 0x0, 0x5531fee, 0x0, 0x0, 0x9, 0xf000, 0x0, [], 0x5}) syz_open_dev$usb(&(0x7f0000000440)='/dev/bus/usb/00#/00#\x00', 0x9, 0x2) r1 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) lstat(&(0x7f0000000040)='./file0/file0\x00', &(0x7f0000000080)) ioctl$EXT4_IOC_MIGRATE(0xffffffffffffffff, 0x6609) sendmmsg$unix(0xffffffffffffffff, &(0x7f000000a000)=[{&(0x7f000000a000)=@abs, 0x6e, &(0x7f000000d000), 0x0, &(0x7f0000000600)=ANY=[]}], 0x1, 0x0) r2 = socket$inet6(0xa, 0x2, 0x0) gettid() r3 = getpgid(0x0) kcmp(0x0, r3, 0x0, 0xffffffffffffffff, 0xffffffffffffffff) connect$inet6(r2, &(0x7f0000002740)={0xa, 0x0, 0x0, @mcast2, 0x4}, 0x1c) sendmmsg(r2, &(0x7f0000007e00), 0x136a88c8311572c, 0x700) setsockopt$inet6_udp_int(r2, 0x11, 0x0, &(0x7f0000000400), 0x4) openat$kvm(0xffffffffffffff9c, &(0x7f00000003c0)='/dev/kvm\x00', 0x0, 0x0) ioctl$VHOST_SET_VRING_CALL(0xffffffffffffff9c, 0x4008af21, &(0x7f00000002c0)={0x0, r1}) ioctl$SNDRV_TIMER_IOCTL_TREAD(r0, 0x40045402, &(0x7f0000000740)) inotify_rm_watch(0xffffffffffffffff, 0x0) ioctl$ifreq_SIOCGIFINDEX_team(0xffffffffffffffff, 0x8933, &(0x7f0000000480)={'team0\x00'}) 04:46:20 executing program 3: r0 = syz_open_dev$sg(&(0x7f00000000c0)='/dev/sg#\x00', 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000000)={0x53, 0x0, 0x6, 0x0, @buffer={0x209, 0xb8, &(0x7f00000001c0)=""/184}, &(0x7f0000000540)="ad40657ed56c", &(0x7f0000000340)=""/128, 0x6000000, 0x0, 0x0, &(0x7f0000000040)}) [ 633.779364] Code: fd b3 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 cb b3 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 633.798269] RSP: 002b:00007f7002694c78 EFLAGS: 00000246 ORIG_RAX: 000000000000013c [ 633.806009] RAX: ffffffffffffffda RBX: 00007f7002694c90 RCX: 0000000000457569 [ 633.813282] RDX: 0000000000000003 RSI: 0000000020000080 RDI: 0000000000000003 [ 633.820559] RBP: 000000000072bf00 R08: 0000000000000004 R09: 0000000000000000 [ 633.827838] R10: 0000000020000100 R11: 0000000000000246 R12: 00007f70026956d4 [ 633.835117] R13: 00000000004c3291 R14: 00000000004d4ea8 R15: 0000000000000004 04:46:20 executing program 5: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000480)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_GUEST_DEBUG(r3, 0x4048ae9b, &(0x7f0000000140)={0x1}) syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000100)=[@text32={0x20, &(0x7f0000000000)="6601669b0f35c4e1fe16846ba49e0000b9940200000f32c4c23dad78e0b9670900000f32660f38827f95b0040f01d10fc71a", 0x32}], 0x1, 0x0, &(0x7f0000000040), 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r3, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000400)=[@text32={0x20, &(0x7f0000000880)="b805000000b98b9400000f01c19a01000000b0000f43d1b8000000000f23d80f21f835800000900f23f80f060f2140b9800000c00f3235000800000f3066ba4300b8f1ffffffefb9800000c00f3235002000000f30c4c3295f4da400", 0x5c}], 0x26433e1, 0x0, &(0x7f0000000300), 0x10000000000000b6) ioctl$KVM_RUN(r3, 0xae80, 0x3000000) 04:46:20 executing program 3: r0 = syz_open_dev$sg(&(0x7f00000000c0)='/dev/sg#\x00', 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000000)={0x53, 0x0, 0x6, 0x0, @buffer={0x209, 0xb8, &(0x7f00000001c0)=""/184}, &(0x7f0000000540)="ad40657ed56c", &(0x7f0000000340)=""/128, 0xf0ff7f, 0x0, 0x0, &(0x7f0000000040)}) 04:46:20 executing program 3: r0 = syz_open_dev$sg(&(0x7f00000000c0)='/dev/sg#\x00', 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000000)={0x53, 0x0, 0x6, 0x0, @buffer={0x209, 0xb8, &(0x7f00000001c0)=""/184}, &(0x7f0000000540)="ad40657ed56c", &(0x7f0000000340)=""/128, 0xb800, 0x0, 0x0, &(0x7f0000000040)}) [ 634.093469] binder: 23440:23449 unknown command 0 [ 634.098384] binder: 23440:23449 ioctl c0306201 20008fd0 returned -22 04:46:20 executing program 0 (fault-call:4 fault-nth:7): mkdir(&(0x7f0000000200)='./file0\x00', 0x0) mount(&(0x7f00000002c0)=ANY=[], &(0x7f0000001540)='./file0\x00', &(0x7f0000000280)='tmpfs\x00', 0x0, &(0x7f0000000080)) r0 = open$dir(&(0x7f0000000180)='./file0\x00', 0x0, 0x0) mknodat(r0, &(0x7f0000000140)='./file0\x00', 0x0, 0x0) renameat2(r0, &(0x7f0000000080)='./file0\x00', r0, &(0x7f0000000100)='./file1\x00', 0x4) 04:46:20 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0x0, 0x400000000000000) fcntl$getflags(r1, 0x40a) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000005fd4)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], 0x0, 0x0, &(0x7f0000012fc7)}) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0xffffffffffffff33, 0x0, &(0x7f0000000040)}) r2 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) getsockopt$inet_sctp_SCTP_AUTO_ASCONF(r2, 0x84, 0x1e, &(0x7f0000000040), &(0x7f00000000c0)=0x4) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000100)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0xfffffffffffffc2b, 0x0, &(0x7f0000000680)}) 04:46:20 executing program 5: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000480)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_GUEST_DEBUG(r3, 0x4048ae9b, &(0x7f0000000140)={0x1}) syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000100)=[@text32={0x20, &(0x7f0000000000)="6601669b0f35c4e1fe16846ba49e0000b9940200000f32c4c23dad78e0b9670900000f32660f38827f95b0040f01d10fc71a", 0x32}], 0x1, 0x0, &(0x7f0000000040), 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r3, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000400)=[@text32={0x20, &(0x7f0000000880)="b805000000b98b9400000f01c19a01000000b0000f43d1b8000000000f23d80f21f835800000900f23f80f060f2140b9800000c00f3235000800000f3066ba4300b8f1ffffffefb9800000c00f3235002000000f30c4c3295f4da400", 0x5c}], 0x26433e1, 0x0, &(0x7f0000000300), 0x10000000000000b6) ioctl$KVM_RUN(r3, 0xae80, 0xa0010000) 04:46:20 executing program 3: r0 = syz_open_dev$sg(&(0x7f00000000c0)='/dev/sg#\x00', 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000000)={0x53, 0x0, 0x6, 0x0, @buffer={0x209, 0xb8, &(0x7f00000001c0)=""/184}, &(0x7f0000000540)="ad40657ed56c", &(0x7f0000000340)=""/128, 0x600, 0x0, 0x0, &(0x7f0000000040)}) 04:46:20 executing program 1: r0 = perf_event_open(&(0x7f000025c000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x11, r1, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r0, 0x2405, r1) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x1000004, 0x8031, 0xffffffffffffffff, 0x0) [ 634.391007] binder: 23479:23484 unknown command 0 [ 634.409430] binder: 23479:23484 ioctl c0306201 20012000 returned -22 04:46:20 executing program 3: r0 = syz_open_dev$sg(&(0x7f00000000c0)='/dev/sg#\x00', 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000000)={0x53, 0x0, 0x6, 0x0, @buffer={0x209, 0xb8, &(0x7f00000001c0)=""/184}, &(0x7f0000000540)="ad40657ed56c", &(0x7f0000000340)=""/128, 0xffffffff00000000, 0x0, 0x0, &(0x7f0000000040)}) 04:46:20 executing program 4: ioctl$KVM_IRQ_LINE(0xffffffffffffffff, 0x4008ae61, &(0x7f0000000500)) r0 = syz_open_dev$dspn(&(0x7f00000004c0)='/dev/dsp#\x00', 0x1, 0x0) openat$audio(0xffffffffffffff9c, &(0x7f0000000000)='/dev/audio\x00', 0x80, 0x0) ioctl$KVM_SET_FPU(0xffffffffffffffff, 0x41a0ae8d, &(0x7f0000000100)={[], 0x0, 0x5531fee, 0x0, 0x0, 0x9, 0xf000, 0x0, [], 0x5}) syz_open_dev$usb(&(0x7f0000000440)='/dev/bus/usb/00#/00#\x00', 0x9, 0x2) r1 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) lstat(&(0x7f0000000040)='./file0/file0\x00', &(0x7f0000000080)) ioctl$EXT4_IOC_MIGRATE(0xffffffffffffffff, 0x6609) sendmmsg$unix(0xffffffffffffffff, &(0x7f000000a000)=[{&(0x7f000000a000)=@abs, 0x6e, &(0x7f000000d000), 0x0, &(0x7f0000000600)=ANY=[]}], 0x1, 0x0) r2 = socket$inet6(0xa, 0x2, 0x0) gettid() r3 = getpgid(0x0) kcmp(0x0, r3, 0x0, 0xffffffffffffffff, 0xffffffffffffffff) connect$inet6(r2, &(0x7f0000002740)={0xa, 0x0, 0x0, @mcast2, 0x4}, 0x1c) sendmmsg(r2, &(0x7f0000007e00), 0x136a88c8311572c, 0x1100) setsockopt$inet6_udp_int(r2, 0x11, 0x0, &(0x7f0000000400), 0x4) openat$kvm(0xffffffffffffff9c, &(0x7f00000003c0)='/dev/kvm\x00', 0x0, 0x0) ioctl$VHOST_SET_VRING_CALL(0xffffffffffffff9c, 0x4008af21, &(0x7f00000002c0)={0x0, r1}) ioctl$SNDRV_TIMER_IOCTL_TREAD(r0, 0x40045402, &(0x7f0000000740)) inotify_rm_watch(0xffffffffffffffff, 0x0) ioctl$ifreq_SIOCGIFINDEX_team(0xffffffffffffffff, 0x8933, &(0x7f0000000480)={'team0\x00'}) 04:46:20 executing program 5: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000480)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_GUEST_DEBUG(r3, 0x4048ae9b, &(0x7f0000000140)={0x1}) syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000100)=[@text32={0x20, &(0x7f0000000000)="6601669b0f35c4e1fe16846ba49e0000b9940200000f32c4c23dad78e0b9670900000f32660f38827f95b0040f01d10fc71a", 0x32}], 0x1, 0x0, &(0x7f0000000040), 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r3, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000400)=[@text32={0x20, &(0x7f0000000880)="b805000000b98b9400000f01c19a01000000b0000f43d1b8000000000f23d80f21f835800000900f23f80f060f2140b9800000c00f3235000800000f3066ba4300b8f1ffffffefb9800000c00f3235002000000f30c4c3295f4da400", 0x5c}], 0x26433e1, 0x0, &(0x7f0000000300), 0x10000000000000b6) ioctl$KVM_RUN(r3, 0xae80, 0x5000000) 04:46:20 executing program 3: r0 = syz_open_dev$sg(&(0x7f00000000c0)='/dev/sg#\x00', 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000000)={0x53, 0x0, 0x6, 0x0, @buffer={0x209, 0xb8, &(0x7f00000001c0)=""/184}, &(0x7f0000000540)="ad40657ed56c", &(0x7f0000000340)=""/128, 0xf6ffffff00000000, 0x0, 0x0, &(0x7f0000000040)}) 04:46:20 executing program 0: mkdir(&(0x7f0000000200)='./file0\x00', 0x0) mount(&(0x7f00000002c0)=ANY=[], &(0x7f0000001540)='./file0\x00', &(0x7f0000000280)='tmpfs\x00', 0x0, &(0x7f0000000080)) r0 = open$dir(&(0x7f0000000180)='./file0\x00', 0x0, 0x0) mknodat(r0, &(0x7f0000000140)='./file0\x00', 0x0, 0x0) renameat2(r0, &(0x7f0000000080)='./file0\x00', r0, &(0x7f0000000100)='./file1\x00', 0x4) 04:46:20 executing program 3: r0 = syz_open_dev$sg(&(0x7f00000000c0)='/dev/sg#\x00', 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000000)={0x53, 0x0, 0x6, 0x0, @buffer={0x209, 0xb8, &(0x7f00000001c0)=""/184}, &(0x7f0000000540)="ad40657ed56c", &(0x7f0000000340)=""/128, 0x1000000, 0x0, 0x0, &(0x7f0000000040)}) 04:46:21 executing program 3: r0 = syz_open_dev$sg(&(0x7f00000000c0)='/dev/sg#\x00', 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000000)={0x53, 0x0, 0x6, 0x0, @buffer={0x209, 0xb8, &(0x7f00000001c0)=""/184}, &(0x7f0000000540)="ad40657ed56c", &(0x7f0000000340)=""/128, 0x8000a0, 0x0, 0x0, &(0x7f0000000040)}) 04:46:21 executing program 0: mkdir(&(0x7f0000000200)='./file0\x00', 0x0) socketpair$inet_udp(0x2, 0x2, 0x0, &(0x7f00000001c0)={0xffffffffffffffff}) accept4$inet(r0, &(0x7f0000000240)={0x2, 0x0, @dev}, &(0x7f00000006c0)=0x10, 0x800) mount(&(0x7f00000002c0)=ANY=[], &(0x7f0000001540)='./file0\x00', &(0x7f0000000280)='tmpfs\x00', 0x0, &(0x7f0000000080)) r1 = open$dir(&(0x7f0000000180)='./file0\x00', 0x0, 0x0) mknodat(r1, &(0x7f0000000140)='./file0\x00', 0x0, 0x0) renameat2(r1, &(0x7f0000000080)='./file0\x00', r1, &(0x7f0000000100)='./file1\x00', 0x4) [ 635.054664] tmpfs: No value for mount option './file0' [ 635.186093] binder: 23479:23526 unknown command 0 [ 635.191290] binder: 23479:23526 ioctl c0306201 20012000 returned -22 04:46:21 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000005fd4)=ANY=[@ANYBLOB="0563044000000200"], 0x0, 0x0, &(0x7f0000012fc7)}) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, &(0x7f0000000f4d)}) r2 = openat$null(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/null\x00', 0x1, 0x0) setsockopt$bt_rfcomm_RFCOMM_LM(r2, 0x12, 0x3, &(0x7f0000000140)=0x12, 0x4) openat$zero(0xffffffffffffff9c, &(0x7f0000000180)='/dev/zero\x00', 0x80, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000100)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0xfffffffffffffc2b, 0x0, &(0x7f0000000680)}) r3 = openat(0xffffffffffffffff, &(0x7f0000000000)='./file0\x00', 0x208200, 0x20) write$P9_RWSTAT(r3, &(0x7f0000000040)={0x7, 0x7f, 0x1}, 0x7) 04:46:21 executing program 5: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000480)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_GUEST_DEBUG(r3, 0x4048ae9b, &(0x7f0000000140)={0x1}) syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000100)=[@text32={0x20, &(0x7f0000000000)="6601669b0f35c4e1fe16846ba49e0000b9940200000f32c4c23dad78e0b9670900000f32660f38827f95b0040f01d10fc71a", 0x32}], 0x1, 0x0, &(0x7f0000000040), 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r3, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000400)=[@text32={0x20, &(0x7f0000000880)="b805000000b98b9400000f01c19a01000000b0000f43d1b8000000000f23d80f21f835800000900f23f80f060f2140b9800000c00f3235000800000f3066ba4300b8f1ffffffefb9800000c00f3235002000000f30c4c3295f4da400", 0x5c}], 0x26433e1, 0x0, &(0x7f0000000300), 0x10000000000000b6) ioctl$KVM_RUN(r3, 0xae80, 0xec0f00) 04:46:21 executing program 3: r0 = syz_open_dev$sg(&(0x7f00000000c0)='/dev/sg#\x00', 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000000)={0x53, 0x0, 0x6, 0x0, @buffer={0x209, 0xb8, &(0x7f00000001c0)=""/184}, &(0x7f0000000540)="ad40657ed56c", &(0x7f0000000340)=""/128, 0xb8, 0x0, 0x0, &(0x7f0000000040)}) 04:46:21 executing program 0: mkdir(&(0x7f0000000200)='./file0\x00', 0x0) mount(&(0x7f00000002c0)=ANY=[], &(0x7f0000001540)='./file0\x00', &(0x7f0000000280)='tmpfs\x00', 0x0, &(0x7f0000000080)) r0 = open$dir(&(0x7f0000000180)='./file0\x00', 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000023c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) syz_mount_image$ext4(&(0x7f00000000c0)='ext4\x00', &(0x7f0000000200)='./file0\x00', 0x0, 0x1, &(0x7f0000000300)=[{&(0x7f0000000180)="400000000200000019000000dc0100002c000000010000000200000000000000002000000020000040000000000000003d5cbe5a0000ffff53ef", 0x3a, 0x400}], 0x0, &(0x7f0000000940)=ANY=[]) mknodat(r0, &(0x7f0000000140)='./file0\x00', 0x0, 0x0) renameat2(r0, &(0x7f0000000080)='./file0\x00', r0, &(0x7f0000000100)='./file1\x00', 0x4) 04:46:21 executing program 4: ioctl$KVM_IRQ_LINE(0xffffffffffffffff, 0x4008ae61, &(0x7f0000000500)) r0 = syz_open_dev$dspn(&(0x7f00000004c0)='/dev/dsp#\x00', 0x1, 0x0) openat$audio(0xffffffffffffff9c, &(0x7f0000000000)='/dev/audio\x00', 0x80, 0x0) ioctl$KVM_SET_FPU(0xffffffffffffffff, 0x41a0ae8d, &(0x7f0000000100)={[], 0x0, 0x5531fee, 0x0, 0x0, 0x9, 0xf000, 0x0, [], 0x5}) syz_open_dev$usb(&(0x7f0000000440)='/dev/bus/usb/00#/00#\x00', 0x9, 0x2) r1 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) lstat(&(0x7f0000000040)='./file0/file0\x00', &(0x7f0000000080)) ioctl$EXT4_IOC_MIGRATE(0xffffffffffffffff, 0x6609) sendmmsg$unix(0xffffffffffffffff, &(0x7f000000a000)=[{&(0x7f000000a000)=@abs, 0x6e, &(0x7f000000d000), 0x0, &(0x7f0000000600)=ANY=[]}], 0x1, 0x0) r2 = socket$inet6(0xa, 0x2, 0x0) gettid() r3 = getpgid(0x0) kcmp(0x0, r3, 0x0, 0xffffffffffffffff, 0xffffffffffffffff) connect$inet6(r2, &(0x7f0000002740)={0xa, 0x0, 0x0, @mcast2, 0x4}, 0x1c) sendmmsg(r2, &(0x7f0000007e00), 0x136a88c8311572c, 0x30) setsockopt$inet6_udp_int(r2, 0x11, 0x0, &(0x7f0000000400), 0x4) openat$kvm(0xffffffffffffff9c, &(0x7f00000003c0)='/dev/kvm\x00', 0x0, 0x0) ioctl$VHOST_SET_VRING_CALL(0xffffffffffffff9c, 0x4008af21, &(0x7f00000002c0)={0x0, r1}) ioctl$SNDRV_TIMER_IOCTL_TREAD(r0, 0x40045402, &(0x7f0000000740)) inotify_rm_watch(0xffffffffffffffff, 0x0) ioctl$ifreq_SIOCGIFINDEX_team(0xffffffffffffffff, 0x8933, &(0x7f0000000480)={'team0\x00'}) 04:46:21 executing program 1: r0 = perf_event_open(&(0x7f000025c000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x11, r1, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r0, 0x2405, r1) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x1000004, 0x8031, 0xffffffffffffffff, 0x0) [ 635.283711] EXT4-fs (loop0): Can't read superblock on 2nd try 04:46:21 executing program 3: r0 = syz_open_dev$sg(&(0x7f00000000c0)='/dev/sg#\x00', 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000000)={0x53, 0x0, 0x6, 0x0, @buffer={0x209, 0xb8, &(0x7f00000001c0)=""/184}, &(0x7f0000000540)="ad40657ed56c", &(0x7f0000000340)=""/128, 0x2f00000000000000, 0x0, 0x0, &(0x7f0000000040)}) [ 635.333839] tmpfs: No value for mount option './file0' [ 635.369697] binder: 23543:23545 Acquire 1 refcount change on invalid ref 131072 ret -22 04:46:21 executing program 5: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000480)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_GUEST_DEBUG(r3, 0x4048ae9b, &(0x7f0000000140)={0x1}) syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000100)=[@text32={0x20, &(0x7f0000000000)="6601669b0f35c4e1fe16846ba49e0000b9940200000f32c4c23dad78e0b9670900000f32660f38827f95b0040f01d10fc71a", 0x32}], 0x1, 0x0, &(0x7f0000000040), 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r3, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000400)=[@text32={0x20, &(0x7f0000000880)="b805000000b98b9400000f01c19a01000000b0000f43d1b8000000000f23d80f21f835800000900f23f80f060f2140b9800000c00f3235000800000f3066ba4300b8f1ffffffefb9800000c00f3235002000000f30c4c3295f4da400", 0x5c}], 0x26433e1, 0x0, &(0x7f0000000300), 0x10000000000000b6) ioctl$KVM_RUN(r3, 0xae80, 0x8000000000) [ 635.440891] binder: 23543:23545 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 04:46:21 executing program 0: mkdir(&(0x7f0000000200)='./file0\x00', 0x0) mount(&(0x7f00000002c0)=ANY=[], &(0x7f0000001540)='./file0\x00', &(0x7f0000000280)='tmpfs\x00', 0x0, &(0x7f0000000080)) r0 = open$dir(&(0x7f0000000180)='./file0\x00', 0x0, 0x0) mknodat(r0, &(0x7f0000000140)='./file0\x00', 0x0, 0x0) renameat2(r0, &(0x7f0000000080)='./file0\x00', r0, &(0x7f0000000100)='./file1\x00', 0x4) r1 = openat$mixer(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/mixer\x00', 0x4040, 0x0) ioctl$RTC_UIE_OFF(r1, 0x7004) socketpair$packet(0x11, 0x2, 0x300, &(0x7f0000000000)={0xffffffffffffffff}) ioctl$ifreq_SIOCGIFINDEX_team(r2, 0x8933, &(0x7f0000000040)={'team0\x00'}) 04:46:21 executing program 4: ioctl$KVM_IRQ_LINE(0xffffffffffffffff, 0x4008ae61, &(0x7f0000000500)) r0 = syz_open_dev$dspn(&(0x7f00000004c0)='/dev/dsp#\x00', 0x1, 0x0) openat$audio(0xffffffffffffff9c, &(0x7f0000000000)='/dev/audio\x00', 0x80, 0x0) ioctl$KVM_SET_FPU(0xffffffffffffffff, 0x41a0ae8d, &(0x7f0000000100)={[], 0x0, 0x5531fee, 0x0, 0x0, 0x9, 0xf000, 0x0, [], 0x5}) syz_open_dev$usb(&(0x7f0000000440)='/dev/bus/usb/00#/00#\x00', 0x9, 0x2) r1 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) lstat(&(0x7f0000000040)='./file0/file0\x00', &(0x7f0000000080)) ioctl$EXT4_IOC_MIGRATE(0xffffffffffffffff, 0x6609) sendmmsg$unix(0xffffffffffffffff, &(0x7f000000a000)=[{&(0x7f000000a000)=@abs, 0x6e, &(0x7f000000d000), 0x0, &(0x7f0000000600)=ANY=[]}], 0x1, 0x0) r2 = socket$inet6(0xa, 0x2, 0x0) gettid() r3 = getpgid(0x0) kcmp(0x0, r3, 0x0, 0xffffffffffffffff, 0xffffffffffffffff) connect$inet6(r2, &(0x7f0000002740)={0xa, 0x0, 0x0, @mcast2, 0x4}, 0x1c) sendmmsg(r2, &(0x7f0000007e00), 0x136a88c8311572c, 0x4) setsockopt$inet6_udp_int(r2, 0x11, 0x0, &(0x7f0000000400), 0x4) openat$kvm(0xffffffffffffff9c, &(0x7f00000003c0)='/dev/kvm\x00', 0x0, 0x0) ioctl$VHOST_SET_VRING_CALL(0xffffffffffffff9c, 0x4008af21, &(0x7f00000002c0)={0x0, r1}) ioctl$SNDRV_TIMER_IOCTL_TREAD(r0, 0x40045402, &(0x7f0000000740)) inotify_rm_watch(0xffffffffffffffff, 0x0) ioctl$ifreq_SIOCGIFINDEX_team(0xffffffffffffffff, 0x8933, &(0x7f0000000480)={'team0\x00'}) 04:46:21 executing program 3: r0 = syz_open_dev$sg(&(0x7f00000000c0)='/dev/sg#\x00', 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000000)={0x53, 0x0, 0x6, 0x0, @buffer={0x209, 0xb8, &(0x7f00000001c0)=""/184}, &(0x7f0000000540)="ad40657ed56c", &(0x7f0000000340)=""/128, 0xfcffffff, 0x0, 0x0, &(0x7f0000000040)}) 04:46:21 executing program 5: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000480)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_GUEST_DEBUG(r3, 0x4048ae9b, &(0x7f0000000140)={0x1}) syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000100)=[@text32={0x20, &(0x7f0000000000)="6601669b0f35c4e1fe16846ba49e0000b9940200000f32c4c23dad78e0b9670900000f32660f38827f95b0040f01d10fc71a", 0x32}], 0x1, 0x0, &(0x7f0000000040), 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r3, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000400)=[@text32={0x20, &(0x7f0000000880)="b805000000b98b9400000f01c19a01000000b0000f43d1b8000000000f23d80f21f835800000900f23f80f060f2140b9800000c00f3235000800000f3066ba4300b8f1ffffffefb9800000c00f3235002000000f30c4c3295f4da400", 0x5c}], 0x26433e1, 0x0, &(0x7f0000000300), 0x10000000000000b6) ioctl$KVM_RUN(r3, 0xae80, 0xffffffff00000000) [ 635.770484] tmpfs: No value for mount option './file0' 04:46:22 executing program 2: r0 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vcs\x00', 0x600580, 0x0) ioctl$sock_inet6_udp_SIOCINQ(r0, 0x541b, &(0x7f0000000040)) r1 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, &(0x7f0000012fc7)}) close(r1) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, &(0x7f0000000f4d)}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000100)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0xfffffffffffffc2b, 0x0, &(0x7f0000000680)}) 04:46:22 executing program 3: r0 = syz_open_dev$sg(&(0x7f00000000c0)='/dev/sg#\x00', 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000000)={0x53, 0x0, 0x6, 0x0, @buffer={0x209, 0xb8, &(0x7f00000001c0)=""/184}, &(0x7f0000000540)="ad40657ed56c", &(0x7f0000000340)=""/128, 0x2f000000, 0x0, 0x0, &(0x7f0000000040)}) 04:46:22 executing program 5: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000480)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_GUEST_DEBUG(r3, 0x4048ae9b, &(0x7f0000000140)={0x1}) syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000100)=[@text32={0x20, &(0x7f0000000000)="6601669b0f35c4e1fe16846ba49e0000b9940200000f32c4c23dad78e0b9670900000f32660f38827f95b0040f01d10fc71a", 0x32}], 0x1, 0x0, &(0x7f0000000040), 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r3, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000400)=[@text32={0x20, &(0x7f0000000880)="b805000000b98b9400000f01c19a01000000b0000f43d1b8000000000f23d80f21f835800000900f23f80f060f2140b9800000c00f3235000800000f3066ba4300b8f1ffffffefb9800000c00f3235002000000f30c4c3295f4da400", 0x5c}], 0x26433e1, 0x0, &(0x7f0000000300), 0x10000000000000b6) ioctl$KVM_RUN(r3, 0xae80, 0x800000000000000) 04:46:22 executing program 0: mkdir(&(0x7f0000000200)='./file0\x00', 0x0) mount(&(0x7f00000002c0)=ANY=[], &(0x7f0000001540)='./file0\x00', &(0x7f0000000280)='tmpfs\x00', 0x0, &(0x7f0000000080)) ioctl$sock_kcm_SIOCKCMCLONE(0xffffffffffffffff, 0x89e2, &(0x7f0000000040)={0xffffffffffffff9c}) r1 = openat$uhid(0xffffffffffffff9c, &(0x7f0000000100)='/dev/uhid\x00', 0x2, 0x0) write$UHID_SET_REPORT_REPLY(r1, &(0x7f00000002c0)={0xe, 0xa, 0x7, 0x40, 0x6c, "53d264c5fe62dfb31622df49145acec1c81eebce53263a7bc54a6955ddb9531b963caee19a8e070fc0d7cd9ce8c7051c6b5a47ee10612adae749590288f0a3a32556a440ba00ec41c5a84c062029e3a81eda7e42583dfa7f9efa8dd4ceeb28455cd460f76b56368267602f89"}, 0x78) connect$bt_rfcomm(r0, &(0x7f00000000c0)={0x1f, {0x9, 0x3, 0x4ce, 0x5, 0x0, 0x5082ec0f}}, 0xa) r2 = open$dir(&(0x7f0000000180)='./file0\x00', 0x0, 0x0) mknodat(r2, &(0x7f0000000140)='./file0\x00', 0x0, 0x0) renameat2(r2, &(0x7f0000000080)='./file0\x00', r2, &(0x7f0000000000)='./file0\x00', 0x400000004) 04:46:22 executing program 1: r0 = perf_event_open(&(0x7f000025c000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x11, r1, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r0, 0x2405, r1) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x1000004, 0x8031, 0xffffffffffffffff, 0x0) 04:46:22 executing program 4: ioctl$KVM_IRQ_LINE(0xffffffffffffffff, 0x4008ae61, &(0x7f0000000500)) r0 = syz_open_dev$dspn(&(0x7f00000004c0)='/dev/dsp#\x00', 0x1, 0x0) openat$audio(0xffffffffffffff9c, &(0x7f0000000000)='/dev/audio\x00', 0x80, 0x0) ioctl$KVM_SET_FPU(0xffffffffffffffff, 0x41a0ae8d, &(0x7f0000000100)={[], 0x0, 0x5531fee, 0x0, 0x0, 0x9, 0xf000, 0x0, [], 0x5}) syz_open_dev$usb(&(0x7f0000000440)='/dev/bus/usb/00#/00#\x00', 0x9, 0x2) r1 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) lstat(&(0x7f0000000040)='./file0/file0\x00', &(0x7f0000000080)) ioctl$EXT4_IOC_MIGRATE(0xffffffffffffffff, 0x6609) sendmmsg$unix(0xffffffffffffffff, &(0x7f000000a000)=[{&(0x7f000000a000)=@abs, 0x6e, &(0x7f000000d000), 0x0, &(0x7f0000000600)=ANY=[]}], 0x1, 0x0) r2 = socket$inet6(0xa, 0x2, 0x0) gettid() r3 = getpgid(0x0) kcmp(0x0, r3, 0x0, 0xffffffffffffffff, 0xffffffffffffffff) connect$inet6(r2, &(0x7f0000002740)={0xa, 0x0, 0x0, @mcast2, 0x4}, 0x1c) sendmmsg(r2, &(0x7f0000007e00), 0x136a88c8311572c, 0xffffffffa0010000) setsockopt$inet6_udp_int(r2, 0x11, 0x0, &(0x7f0000000400), 0x4) openat$kvm(0xffffffffffffff9c, &(0x7f00000003c0)='/dev/kvm\x00', 0x0, 0x0) ioctl$VHOST_SET_VRING_CALL(0xffffffffffffff9c, 0x4008af21, &(0x7f00000002c0)={0x0, r1}) ioctl$SNDRV_TIMER_IOCTL_TREAD(r0, 0x40045402, &(0x7f0000000740)) inotify_rm_watch(0xffffffffffffffff, 0x0) ioctl$ifreq_SIOCGIFINDEX_team(0xffffffffffffffff, 0x8933, &(0x7f0000000480)={'team0\x00'}) [ 636.161083] binder: 23543:23550 Acquire 1 refcount change on invalid ref 131072 ret -22 [ 636.161795] binder: 23543:23582 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 04:46:22 executing program 3: r0 = syz_open_dev$sg(&(0x7f00000000c0)='/dev/sg#\x00', 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000000)={0x53, 0x0, 0x6, 0x0, @buffer={0x209, 0xb8, &(0x7f00000001c0)=""/184}, &(0x7f0000000540)="ad40657ed56c", &(0x7f0000000340)=""/128, 0x6, 0x0, 0x0, &(0x7f0000000040)}) [ 636.258602] tmpfs: No value for mount option './file0' 04:46:22 executing program 0: mkdir(&(0x7f0000000200)='./file0\x00', 0x0) r0 = memfd_create(&(0x7f00000001c0)='\x00', 0x6) accept4$bt_l2cap(r0, &(0x7f0000000240), &(0x7f00000002c0)=0xe, 0x800) mount(&(0x7f00000002c0)=ANY=[], &(0x7f0000001540)='./file0\x00', &(0x7f0000000280)='tmpfs\x00', 0x0, &(0x7f0000000080)) r1 = open$dir(&(0x7f0000000180)='./file0\x00', 0x0, 0x0) mknodat(r1, &(0x7f0000000140)='./file0\x00', 0x0, 0x0) renameat2(r1, &(0x7f0000000040)='./file1\x00', r1, &(0x7f0000000000)='./file1\x00', 0x1) 04:46:22 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) fsetxattr$trusted_overlay_upper(r0, &(0x7f0000000080)='trusted.overlay.upper\x00', &(0x7f00000000c0)={0x0, 0xfb, 0x9f, 0x2, 0xff, "934b9affed067b610964368c06d34442", "6573aa6e834fdb70781117e2270b18b8ebb9cf9a9155835db4b5a80ffe0a9c3a89e512e3a368004c8e6b76501787079d96967fa68f8ce21407ddb9221057f10e5f4b94ddb3f932b221d5294e500dabb21dbd497a5b96c03a253ff27cf90cef853126c211aefb92934d9f374daab21daf930f4d4f0fae26d7f19b9b89cd095e60bfb698bb9095ebebf049"}, 0x9f, 0x1) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) bpf$OBJ_GET_PROG(0x7, &(0x7f0000000040)={&(0x7f0000000000)='./file0\x00', 0x0, 0x10}, 0x10) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, &(0x7f0000012fc7)}) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, &(0x7f0000000f4d)}) 04:46:22 executing program 4: ioctl$KVM_IRQ_LINE(0xffffffffffffffff, 0x4008ae61, &(0x7f0000000500)) r0 = syz_open_dev$dspn(&(0x7f00000004c0)='/dev/dsp#\x00', 0x1, 0x0) openat$audio(0xffffffffffffff9c, &(0x7f0000000000)='/dev/audio\x00', 0x80, 0x0) ioctl$KVM_SET_FPU(0xffffffffffffffff, 0x41a0ae8d, &(0x7f0000000100)={[], 0x0, 0x5531fee, 0x0, 0x0, 0x9, 0xf000, 0x0, [], 0x5}) syz_open_dev$usb(&(0x7f0000000440)='/dev/bus/usb/00#/00#\x00', 0x9, 0x2) r1 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) lstat(&(0x7f0000000040)='./file0/file0\x00', &(0x7f0000000080)) ioctl$EXT4_IOC_MIGRATE(0xffffffffffffffff, 0x6609) sendmmsg$unix(0xffffffffffffffff, &(0x7f000000a000)=[{&(0x7f000000a000)=@abs, 0x6e, &(0x7f000000d000), 0x0, &(0x7f0000000600)=ANY=[]}], 0x1, 0x0) r2 = socket$inet6(0xa, 0x2, 0x0) gettid() r3 = getpgid(0x0) kcmp(0x0, r3, 0x0, 0xffffffffffffffff, 0xffffffffffffffff) connect$inet6(r2, &(0x7f0000002740)={0xa, 0x0, 0x0, @mcast2, 0x4}, 0x1c) sendmmsg(r2, &(0x7f0000007e00), 0x136a88c8311572c, 0xf4010000) setsockopt$inet6_udp_int(r2, 0x11, 0x0, &(0x7f0000000400), 0x4) openat$kvm(0xffffffffffffff9c, &(0x7f00000003c0)='/dev/kvm\x00', 0x0, 0x0) ioctl$VHOST_SET_VRING_CALL(0xffffffffffffff9c, 0x4008af21, &(0x7f00000002c0)={0x0, r1}) ioctl$SNDRV_TIMER_IOCTL_TREAD(r0, 0x40045402, &(0x7f0000000740)) inotify_rm_watch(0xffffffffffffffff, 0x0) ioctl$ifreq_SIOCGIFINDEX_team(0xffffffffffffffff, 0x8933, &(0x7f0000000480)={'team0\x00'}) 04:46:22 executing program 5: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000480)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_GUEST_DEBUG(r3, 0x4048ae9b, &(0x7f0000000140)={0x1}) syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000100)=[@text32={0x20, &(0x7f0000000000)="6601669b0f35c4e1fe16846ba49e0000b9940200000f32c4c23dad78e0b9670900000f32660f38827f95b0040f01d10fc71a", 0x32}], 0x1, 0x0, &(0x7f0000000040), 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r3, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000400)=[@text32={0x20, &(0x7f0000000880)="b805000000b98b9400000f01c19a01000000b0000f43d1b8000000000f23d80f21f835800000900f23f80f060f2140b9800000c00f3235000800000f3066ba4300b8f1ffffffefb9800000c00f3235002000000f30c4c3295f4da400", 0x5c}], 0x26433e1, 0x0, &(0x7f0000000300), 0x10000000000000b6) ioctl$KVM_RUN(r3, 0xae80, 0x600) 04:46:22 executing program 3: r0 = syz_open_dev$sg(&(0x7f00000000c0)='/dev/sg#\x00', 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000000)={0x53, 0x0, 0x6, 0x0, @buffer={0x209, 0xb8, &(0x7f00000001c0)=""/184}, &(0x7f0000000540)="ad40657ed56c", &(0x7f0000000340)=""/128, 0x2, 0x0, 0x0, &(0x7f0000000040)}) 04:46:22 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, &(0x7f0000012fc7)}) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, &(0x7f0000000f4d)}) pipe2(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}, 0x84800) ioctl$KVM_PPC_GET_SMMU_INFO(r3, 0x8250aea6, &(0x7f0000001040)=""/4096) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000100)={0x4, 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB='\x00\x00\x00\x00'], 0xfffffffffffffc2b, 0x0, &(0x7f0000000680)}) ioctl$TIOCGSID(r3, 0x5429, &(0x7f0000000040)=0x0) fcntl$setownex(r2, 0xf, &(0x7f00000000c0)={0x3, r4}) 04:46:22 executing program 0: mkdir(&(0x7f0000000200)='./file0\x00', 0x0) mount(&(0x7f00000007c0)=ANY=[@ANYPTR=&(0x7f00000004c0)=ANY=[@ANYRESDEC, @ANYRES32, @ANYPTR64=&(0x7f0000000480)=ANY=[@ANYRES64, @ANYRESOCT], @ANYRES64, @ANYRESDEC, @ANYRESHEX], @ANYRESHEX, @ANYPTR=&(0x7f0000000700)=ANY=[@ANYRESDEC, @ANYRESHEX, @ANYPTR=&(0x7f00000006c0)=ANY=[@ANYRES32, @ANYRESHEX=0x0, @ANYRES16, @ANYPTR64, @ANYPTR64, @ANYPTR, @ANYPTR64], @ANYRES64, @ANYBLOB="d8bb77a8907f210fbe7fd2f3e64a067cd998457a4e084f76459c13328fe935ca45e484c376d5a105fb7f6fe0fc50eeffd4792bf4d9751fc6015f48d0a3efb2bd9ad70871f75721269eed5f53ac60", @ANYPTR64, @ANYRES16, @ANYRESOCT], @ANYBLOB="cd0fd588b069ddf1d69109f784cf1b1cf10bacdd8709c18b5ec0f06a12b06eb6c91e8759c0c103ae49140fc6ac1e03af97c45f3660a0e55f89ad28700d59d1532d42e156059b60cc2e5770d3f40851b6ba30b2e2c9bc5368c7edfef83de0db0c9a91ffb0794cb4cc4574c5d911fc9640afd1af7c8b1339c25f97551365cd06097509096f"], &(0x7f0000001540)='./file0\x00', &(0x7f0000000280)='tmpfs\x00', 0x0, &(0x7f0000000600)="4009a2cb2ce08b37a8182d5c944bdc2c6f0637716238db5cd65ad7bb67152ff6214ea0c8f6292901e40f4e0bfe1a6967720721d436eb8798c259bbe2f6fd0f366ea7d2d7e3b74c7e70653a0eec6399b164c8d75a1d0f574e8623fd3ba95dbde99f4050f16ab71a26ae5e30f3452994f3976583d3543efbc9a8f700e8c9b337a8dea8ade12b0445598f5226ebf521dd292878e4d1b99208b2279b082b891ab432170a617361cef195286342b8d4648eb00954f242608c4cd74019") syz_mount_image$gfs2(&(0x7f0000000000)='gfs2\x00', &(0x7f0000000040)='./file1/../file0\x00', 0x61f0, 0x4, &(0x7f0000000400)=[{&(0x7f00000002c0)="efdbcb92a9d5debdb813581af35c8edb3406695f9aff06964488f1c6ba10693e1426c4967a5a336e878738b9a7c1481e36b1f04e9051d76dfc16d752e2d21e7cef0609fbf15629a5f61b24dfbd1a93391b72f607e3f2624d64c23624f1b0f9177686cb9d3b14156eddefb03a659da7b36ed4", 0x72, 0x5}, {&(0x7f0000000340)="d5d0351b5e11287b038c750452e87d94e6278ce6ad3558a71bf9bfe17a6132f68ee76207f65c5df570d1dee849fa1f90d432a3a9c9b5c8875bd59f9247a02a5ac3c7055af2bd98af693b67a23e098b4f7ee95c35ee93c9c8eda1df78e1297e2463bd052f1447b3e27eb4ab79bda9001979e49989ab7c531322472df9d46f0e999f4c82301523d1bcd90afe5cdcb3db9bf9a6c1f7500a56ab291cba671446efdff088ae6589dfbfc13c759d0701868347616c689ff3ad23d3f4edf3", 0xbb, 0xffffffffffffd6b2}, {&(0x7f00000000c0)="5b62fcab9a9c8066be88bd69315ec0a0c0818fec80d99c000db313ace62dd5697d5cd94f1727558a15794e9162eecb6473129ed32825c354f4b65f7528440129", 0x40, 0x5}, {&(0x7f00000001c0)="191ece6ccda97a3a22f8e81df7e258244d4393490640fdcf", 0x18, 0x100}], 0x80800, &(0x7f0000000240)={[{@lockproto_dlm='lockproto=dlm'}, {@lockproto_dlm='lockproto=dlm'}], [{@defcontext={'defcontext', 0x3d, 'user_u'}}, {@permit_directio='permit_directio'}]}) r0 = open$dir(&(0x7f0000000180)='./file0\x00', 0x0, 0x0) mknodat(r0, &(0x7f0000000540)='./file0\x00', 0x0, 0x0) renameat2(r0, &(0x7f0000000080)='./file0\x00', r0, &(0x7f0000000100)='./file1\x00', 0x4) 04:46:22 executing program 3: r0 = syz_open_dev$sg(&(0x7f00000000c0)='/dev/sg#\x00', 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000000)={0x53, 0x0, 0x6, 0x0, @buffer={0x209, 0xb8, &(0x7f00000001c0)=""/184}, &(0x7f0000000540)="ad40657ed56c", &(0x7f0000000340)=""/128, 0xfcffffff00000000, 0x0, 0x0, &(0x7f0000000040)}) 04:46:22 executing program 4: ioctl$KVM_IRQ_LINE(0xffffffffffffffff, 0x4008ae61, &(0x7f0000000500)) r0 = syz_open_dev$dspn(&(0x7f00000004c0)='/dev/dsp#\x00', 0x1, 0x0) openat$audio(0xffffffffffffff9c, &(0x7f0000000000)='/dev/audio\x00', 0x80, 0x0) ioctl$KVM_SET_FPU(0xffffffffffffffff, 0x41a0ae8d, &(0x7f0000000100)={[], 0x0, 0x5531fee, 0x0, 0x0, 0x9, 0xf000, 0x0, [], 0x5}) syz_open_dev$usb(&(0x7f0000000440)='/dev/bus/usb/00#/00#\x00', 0x9, 0x2) r1 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) lstat(&(0x7f0000000040)='./file0/file0\x00', &(0x7f0000000080)) ioctl$EXT4_IOC_MIGRATE(0xffffffffffffffff, 0x6609) sendmmsg$unix(0xffffffffffffffff, &(0x7f000000a000)=[{&(0x7f000000a000)=@abs, 0x6e, &(0x7f000000d000), 0x0, &(0x7f0000000600)=ANY=[]}], 0x1, 0x0) r2 = socket$inet6(0xa, 0x2, 0x0) gettid() r3 = getpgid(0x0) kcmp(0x0, r3, 0x0, 0xffffffffffffffff, 0xffffffffffffffff) connect$inet6(r2, &(0x7f0000002740)={0xa, 0x0, 0x0, @mcast2, 0x4}, 0x1c) sendmmsg(r2, &(0x7f0000007e00), 0x136a88c8311572c, 0x7ffffff7) setsockopt$inet6_udp_int(r2, 0x11, 0x0, &(0x7f0000000400), 0x4) openat$kvm(0xffffffffffffff9c, &(0x7f00000003c0)='/dev/kvm\x00', 0x0, 0x0) ioctl$VHOST_SET_VRING_CALL(0xffffffffffffff9c, 0x4008af21, &(0x7f00000002c0)={0x0, r1}) ioctl$SNDRV_TIMER_IOCTL_TREAD(r0, 0x40045402, &(0x7f0000000740)) inotify_rm_watch(0xffffffffffffffff, 0x0) ioctl$ifreq_SIOCGIFINDEX_team(0xffffffffffffffff, 0x8933, &(0x7f0000000480)={'team0\x00'}) [ 636.624190] binder: 23628:23629 unknown command 0 [ 636.629113] binder: 23628:23629 ioctl c0306201 20000100 returned -22 [ 636.704964] binder: 23628:23632 unknown command 0 [ 636.749774] binder: 23628:23632 ioctl c0306201 20000100 returned -22 [ 636.766079] tmpfs: No value for mount option '@ ¢Ë' [ 636.902298] tmpfs: No value for mount option '@ ¢Ë' 04:46:23 executing program 1: r0 = perf_event_open(&(0x7f000025c000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x11, r1, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r0, 0x2405, r1) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x1000004, 0x8031, 0xffffffffffffffff, 0x0) 04:46:23 executing program 5: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000480)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_GUEST_DEBUG(r3, 0x4048ae9b, &(0x7f0000000140)={0x1}) syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000100)=[@text32={0x20, &(0x7f0000000000)="6601669b0f35c4e1fe16846ba49e0000b9940200000f32c4c23dad78e0b9670900000f32660f38827f95b0040f01d10fc71a", 0x32}], 0x1, 0x0, &(0x7f0000000040), 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r3, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000400)=[@text32={0x20, &(0x7f0000000880)="b805000000b98b9400000f01c19a01000000b0000f43d1b8000000000f23d80f21f835800000900f23f80f060f2140b9800000c00f3235000800000f3066ba4300b8f1ffffffefb9800000c00f3235002000000f30c4c3295f4da400", 0x5c}], 0x26433e1, 0x0, &(0x7f0000000300), 0x10000000000000b6) ioctl$KVM_RUN(r3, 0xae80, 0xf000000) 04:46:23 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap$binder(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x8, 0x150, r1, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x3d2, 0x0, &(0x7f0000000500)}) close(r0) r2 = syz_open_dev$mouse(&(0x7f0000000000)='/dev/input/mouse#\x00', 0x7, 0x0) ioctl$KVM_SET_XCRS(r2, 0x4188aea7, &(0x7f0000000040)={0x3, 0x9, [{0x0, 0x0, 0x4}, {0x3, 0x0, 0x20}, {0x0, 0x0, 0x3abd9731}]}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, &(0x7f0000000f4d)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000100)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0xfffffffffffffc2b, 0x0, &(0x7f0000000680)}) 04:46:23 executing program 3: r0 = syz_open_dev$sg(&(0x7f00000000c0)='/dev/sg#\x00', 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000000)={0x53, 0x0, 0x6, 0x0, @buffer={0x209, 0xb8, &(0x7f00000001c0)=""/184}, &(0x7f0000000540)="ad40657ed56c", &(0x7f0000000340)=""/128, 0x400000000000000, 0x0, 0x0, &(0x7f0000000040)}) 04:46:23 executing program 4: ioctl$KVM_IRQ_LINE(0xffffffffffffffff, 0x4008ae61, &(0x7f0000000500)) r0 = syz_open_dev$dspn(&(0x7f00000004c0)='/dev/dsp#\x00', 0x1, 0x0) openat$audio(0xffffffffffffff9c, &(0x7f0000000000)='/dev/audio\x00', 0x80, 0x0) ioctl$KVM_SET_FPU(0xffffffffffffffff, 0x41a0ae8d, &(0x7f0000000100)={[], 0x0, 0x5531fee, 0x0, 0x0, 0x9, 0xf000, 0x0, [], 0x5}) syz_open_dev$usb(&(0x7f0000000440)='/dev/bus/usb/00#/00#\x00', 0x9, 0x2) r1 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) lstat(&(0x7f0000000040)='./file0/file0\x00', &(0x7f0000000080)) ioctl$EXT4_IOC_MIGRATE(0xffffffffffffffff, 0x6609) sendmmsg$unix(0xffffffffffffffff, &(0x7f000000a000)=[{&(0x7f000000a000)=@abs, 0x6e, &(0x7f000000d000), 0x0, &(0x7f0000000600)=ANY=[]}], 0x1, 0x0) r2 = socket$inet6(0xa, 0x2, 0x0) gettid() r3 = getpgid(0x0) kcmp(0x0, r3, 0x0, 0xffffffffffffffff, 0xffffffffffffffff) connect$inet6(r2, &(0x7f0000002740)={0xa, 0x0, 0x0, @mcast2, 0x4}, 0x1c) sendmmsg(r2, &(0x7f0000007e00), 0x136a88c8311572c, 0x8000000000000000) setsockopt$inet6_udp_int(r2, 0x11, 0x0, &(0x7f0000000400), 0x4) openat$kvm(0xffffffffffffff9c, &(0x7f00000003c0)='/dev/kvm\x00', 0x0, 0x0) ioctl$VHOST_SET_VRING_CALL(0xffffffffffffff9c, 0x4008af21, &(0x7f00000002c0)={0x0, r1}) ioctl$SNDRV_TIMER_IOCTL_TREAD(r0, 0x40045402, &(0x7f0000000740)) inotify_rm_watch(0xffffffffffffffff, 0x0) ioctl$ifreq_SIOCGIFINDEX_team(0xffffffffffffffff, 0x8933, &(0x7f0000000480)={'team0\x00'}) 04:46:23 executing program 0: mkdir(&(0x7f0000000a40)='./file0\x00', 0x0) mount(&(0x7f00000002c0)=ANY=[], &(0x7f0000001540)='./file0\x00', &(0x7f0000000280)='tmpfs\x00', 0x0, &(0x7f0000000080)) getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffff9c, 0x29, 0x22, &(0x7f0000000440)={{{@in6=@ipv4={[], [], @remote}, @in6=@ipv4={[], [], @loopback}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@dev}, 0x0, @in6=@loopback}}, &(0x7f0000000240)=0xe8) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000000540)={{{@in=@dev, @in6=@loopback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@rand_addr}, 0x0, @in6=@local}}, &(0x7f0000000640)=0xe8) stat(&(0x7f0000000680)='./file1\x00', &(0x7f00000006c0)={0x0, 0x0, 0x0, 0x0, 0x0}) getsockopt$inet_IP_IPSEC_POLICY(0xffffffffffffffff, 0x0, 0x10, &(0x7f0000000740)={{{@in6=@dev, @in6=@mcast1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@dev}, 0x0, @in6=@remote}}, &(0x7f0000000840)=0xe8) stat(&(0x7f0000000880)='./file0\x00', &(0x7f00000008c0)={0x0, 0x0, 0x0, 0x0, 0x0}) syz_mount_image$f2fs(&(0x7f0000000000)='f2fs\x00', &(0x7f0000000040)='./file0\x00', 0x1, 0x3, &(0x7f00000003c0)=[{&(0x7f00000000c0)="8d0cd983899621d36a1e1655c72c29b749ba8b13629f381e90b6544088bddefad76253e8f6f9", 0x26, 0x4}, {&(0x7f00000002c0)="feedcabc75eea7ded86f7f88d1ac95f64c4063dbe285551e032a8de499aa14a285da24f74c9c8bfc064a73332bd766a16f0d85a75089223076635cc7b08331c84d2de59756f57068d5c9e8a3ebaf7f26f5b9d3aa8307dfebcbdeeb8214e8c8409a4db475db0fb7c50f99be26f2a58fe8bbdd83818aaaaa3cdd7a7ea404fb31c0839e6e6760d1ca8cd0e14551f2cd4575fa04d0269a2c02d1c990cc94bcc7731803e23b546a35ee6337e78bd4b66b1cfb379a839f027d10e542bef2b1c47f3f20719b821ece3e00ac9b04", 0xca, 0x5}, {&(0x7f00000001c0)="b7676b9cc17ec88f72037ff51f48400d89fe5d", 0x13, 0x401}], 0x80000, &(0x7f0000000940)={[{@noacl='noacl'}, {@jqfmt_vfsold='jqfmt=vfsold'}], [{@euid_gt={'euid>', r0}}, {@euid_lt={'euid<', r1}}, {@smackfsfloor={'smackfsfloor', 0x3d, '-em1GPL'}}, {@uid_gt={'uid>', r2}}, {@seclabel='seclabel'}, {@euid_lt={'euid<', r3}}, {@uid_lt={'uid<', r4}}]}) r5 = open$dir(&(0x7f0000000180)='./file0\x00', 0x0, 0x0) mknodat(r5, &(0x7f0000000140)='./file0\x00', 0x0, 0x0) renameat2(r5, &(0x7f0000000080)='./file0\x00', r5, &(0x7f0000000100)='./file1\x00', 0x4) [ 637.124691] binder: 23662:23665 unknown command 0 [ 637.140546] binder: 23662:23665 ioctl c0306201 20012000 returned -22 04:46:23 executing program 3: r0 = syz_open_dev$sg(&(0x7f00000000c0)='/dev/sg#\x00', 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000000)={0x53, 0x0, 0x6, 0x0, @buffer={0x209, 0xb8, &(0x7f00000001c0)=""/184}, &(0x7f0000000540)="ad40657ed56c", &(0x7f0000000340)=""/128, 0x200000000000000, 0x0, 0x0, &(0x7f0000000040)}) [ 637.175966] binder: 23662:23665 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 637.194249] tmpfs: No value for mount option './file0' 04:46:23 executing program 5: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000480)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_GUEST_DEBUG(r3, 0x4048ae9b, &(0x7f0000000140)={0x1}) syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000100)=[@text32={0x20, &(0x7f0000000000)="6601669b0f35c4e1fe16846ba49e0000b9940200000f32c4c23dad78e0b9670900000f32660f38827f95b0040f01d10fc71a", 0x32}], 0x1, 0x0, &(0x7f0000000040), 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r3, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000400)=[@text32={0x20, &(0x7f0000000880)="b805000000b98b9400000f01c19a01000000b0000f43d1b8000000000f23d80f21f835800000900f23f80f060f2140b9800000c00f3235000800000f3066ba4300b8f1ffffffefb9800000c00f3235002000000f30c4c3295f4da400", 0x5c}], 0x26433e1, 0x0, &(0x7f0000000300), 0x10000000000000b6) ioctl$KVM_RUN(r3, 0xae80, 0xc) 04:46:23 executing program 0: mkdir(&(0x7f0000000200)='./file0\x00', 0x0) mount(&(0x7f00000002c0)=ANY=[], &(0x7f0000001540)='./file0\x00', &(0x7f0000000280)='tmpfs\x00', 0x0, &(0x7f0000000080)) setxattr$trusted_overlay_opaque(&(0x7f0000000000)='./file1\x00', &(0x7f0000000040)='trusted.overlay.opaque\x00', &(0x7f00000000c0)='y\x00', 0x2, 0x2) r0 = open$dir(&(0x7f0000000180)='./file0\x00', 0x0, 0x0) mknodat(r0, &(0x7f0000000140)='./file0\x00', 0x0, 0x0) renameat2(r0, &(0x7f0000000080)='./file0\x00', r0, &(0x7f0000000100)='./file1\x00', 0x4) 04:46:23 executing program 3: r0 = syz_open_dev$sg(&(0x7f00000000c0)='/dev/sg#\x00', 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000000)={0x53, 0x0, 0x6, 0x0, @buffer={0x209, 0xb8, &(0x7f00000001c0)=""/184}, &(0x7f0000000540)="ad40657ed56c", &(0x7f0000000340)=""/128, 0x8000a0ffffffff, 0x0, 0x0, &(0x7f0000000040)}) 04:46:23 executing program 3: r0 = syz_open_dev$sg(&(0x7f00000000c0)='/dev/sg#\x00', 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000000)={0x53, 0x0, 0x6, 0x0, @buffer={0x209, 0xb8, &(0x7f00000001c0)=""/184}, &(0x7f0000000540)="ad40657ed56c", &(0x7f0000000340)=""/128, 0xf6ffffff, 0x0, 0x0, &(0x7f0000000040)}) [ 637.550560] tmpfs: No value for mount option './file0' 04:46:23 executing program 0: mkdir(&(0x7f0000000200)='./file0\x00', 0x0) mount(&(0x7f00000002c0)=ANY=[], &(0x7f0000001540)='./file0\x00', &(0x7f0000000280)='tmpfs\x00', 0x0, &(0x7f0000000080)) r0 = open$dir(&(0x7f0000000180)='./file0\x00', 0x0, 0x0) mknodat(r0, &(0x7f0000000140)='./file0\x00', 0x0, 0x0) r1 = syz_open_dev$admmidi(&(0x7f0000000040)='/dev/admmidi#\x00', 0xbf2, 0x10040) truncate(&(0x7f00000001c0)='./file2\x00', 0x6) ioctl$BLKSECTGET(r1, 0x1267, &(0x7f00000000c0)) open(&(0x7f0000000000)='./file2\x00', 0x100, 0x4) renameat2(r0, &(0x7f0000000080)='./file2\x00', r0, &(0x7f0000000100)='./file1\x00', 0x4) [ 637.805905] tmpfs: No value for mount option './file2' 04:46:24 executing program 1: r0 = perf_event_open(&(0x7f000025c000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = perf_event_open(&(0x7f000001d000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x11, r1, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r0, 0x2405, r1) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x1000004, 0x8031, 0xffffffffffffffff, 0x0) 04:46:24 executing program 4: ioctl$KVM_IRQ_LINE(0xffffffffffffffff, 0x4008ae61, &(0x7f0000000500)) r0 = syz_open_dev$dspn(&(0x7f00000004c0)='/dev/dsp#\x00', 0x1, 0x0) openat$audio(0xffffffffffffff9c, &(0x7f0000000000)='/dev/audio\x00', 0x80, 0x0) ioctl$KVM_SET_FPU(0xffffffffffffffff, 0x41a0ae8d, &(0x7f0000000100)={[], 0x0, 0x5531fee, 0x0, 0x0, 0x9, 0xf000, 0x0, [], 0x5}) syz_open_dev$usb(&(0x7f0000000440)='/dev/bus/usb/00#/00#\x00', 0x9, 0x2) r1 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) lstat(&(0x7f0000000040)='./file0/file0\x00', &(0x7f0000000080)) ioctl$EXT4_IOC_MIGRATE(0xffffffffffffffff, 0x6609) sendmmsg$unix(0xffffffffffffffff, &(0x7f000000a000)=[{&(0x7f000000a000)=@abs, 0x6e, &(0x7f000000d000), 0x0, &(0x7f0000000600)=ANY=[]}], 0x1, 0x0) r2 = socket$inet6(0xa, 0x2, 0x0) gettid() r3 = getpgid(0x0) kcmp(0x0, r3, 0x0, 0xffffffffffffffff, 0xffffffffffffffff) connect$inet6(r2, &(0x7f0000002740)={0xa, 0x0, 0x0, @mcast2, 0x4}, 0x1c) sendmmsg(r2, &(0x7f0000007e00), 0x136a88c8311572c, 0x8000a0) setsockopt$inet6_udp_int(r2, 0x11, 0x0, &(0x7f0000000400), 0x4) openat$kvm(0xffffffffffffff9c, &(0x7f00000003c0)='/dev/kvm\x00', 0x0, 0x0) ioctl$VHOST_SET_VRING_CALL(0xffffffffffffff9c, 0x4008af21, &(0x7f00000002c0)={0x0, r1}) ioctl$SNDRV_TIMER_IOCTL_TREAD(r0, 0x40045402, &(0x7f0000000740)) inotify_rm_watch(0xffffffffffffffff, 0x0) ioctl$ifreq_SIOCGIFINDEX_team(0xffffffffffffffff, 0x8933, &(0x7f0000000480)={'team0\x00'}) [ 637.901605] binder: 23662:23712 unknown command 0 [ 637.906558] binder: 23662:23712 ioctl c0306201 20012000 returned -22 [ 637.925411] binder: 23662:23713 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 04:46:24 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) socketpair(0x5, 0x3, 0x6, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) write$UHID_CREATE(r1, &(0x7f00000001c0)={0x0, 'syz1\x00', 'syz1\x00', 'syz0\x00', &(0x7f0000000380)=""/121, 0x79, 0x4b, 0x5, 0x100000000, 0x6, 0x6}, 0x120) ioctl$KVM_REGISTER_COALESCED_MMIO(r2, 0x4010ae67, &(0x7f0000000300)={0x3003, 0x4000}) r3 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) gettid() ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, &(0x7f0000012fc7)}) fchmod(r1, 0x40) fcntl$F_SET_FILE_RW_HINT(r1, 0x40e, &(0x7f0000000180)=0x1) ioctl$DRM_IOCTL_SET_VERSION(r2, 0xc0106407, &(0x7f0000000340)={0x15d6, 0xff, 0x6, 0x5}) ioctl$KDGETKEYCODE(r1, 0x4b4c, &(0x7f0000000140)={0x1, 0x8}) fsetxattr(r0, &(0x7f0000000000)=@known='trusted.overlay.nlink\x00', &(0x7f0000000040)='-\\\x00', 0x3, 0x1) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000008fd0)={0xffffffffffffffa1, 0x0, &(0x7f000000dff8)=ANY=[@ANYBLOB="b516cb3920444679"], 0x0, 0x0, &(0x7f0000000400)}) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000100)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0xfffffffffffffc2b, 0x0, &(0x7f0000000680)}) 04:46:24 executing program 5: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000480)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_GUEST_DEBUG(r3, 0x4048ae9b, &(0x7f0000000140)={0x1}) syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000100)=[@text32={0x20, &(0x7f0000000000)="6601669b0f35c4e1fe16846ba49e0000b9940200000f32c4c23dad78e0b9670900000f32660f38827f95b0040f01d10fc71a", 0x32}], 0x1, 0x0, &(0x7f0000000040), 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r3, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000400)=[@text32={0x20, &(0x7f0000000880)="b805000000b98b9400000f01c19a01000000b0000f43d1b8000000000f23d80f21f835800000900f23f80f060f2140b9800000c00f3235000800000f3066ba4300b8f1ffffffefb9800000c00f3235002000000f30c4c3295f4da400", 0x5c}], 0x26433e1, 0x0, &(0x7f0000000300), 0x10000000000000b6) ioctl$KVM_RUN(r3, 0xae80, 0x100000000000000) 04:46:24 executing program 3: r0 = syz_open_dev$sg(&(0x7f00000000c0)='/dev/sg#\x00', 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000000)={0x53, 0x0, 0x6, 0x0, @buffer={0x209, 0xb8, &(0x7f00000001c0)=""/184}, &(0x7f0000000540)="ad40657ed56c", &(0x7f0000000340)=""/128, 0x902, 0x0, 0x0, &(0x7f0000000040)}) 04:46:24 executing program 0: mkdir(&(0x7f0000000200)='./file0\x00', 0x0) mount(&(0x7f00000002c0)=ANY=[], &(0x7f0000001540)='./file0\x00', &(0x7f0000000280)='tmpfs\x00', 0x0, &(0x7f0000000080)) r0 = open$dir(&(0x7f0000000000)='./file0\x00', 0x0, 0x0) pkey_alloc(0x0, 0x2) mknodat(r0, &(0x7f0000000140)='./file0\x00', 0x0, 0x0) renameat2(r0, &(0x7f0000000080)='./file0\x00', r0, &(0x7f0000000100)='./file1\x00', 0x4) 04:46:24 executing program 3: r0 = syz_open_dev$sg(&(0x7f00000000c0)='/dev/sg#\x00', 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000000)={0x53, 0x0, 0x6, 0x0, @buffer={0x209, 0xb8, &(0x7f00000001c0)=""/184}, &(0x7f0000000540)="ad40657ed56c", &(0x7f0000000340)=""/128, 0xfffffff6, 0x0, 0x0, &(0x7f0000000040)}) [ 638.068718] tmpfs: No value for mount option './file0' 04:46:24 executing program 0: mkdir(&(0x7f0000000200)='./file0\x00', 0x0) mount(&(0x7f00000002c0)=ANY=[], &(0x7f0000001540)='./file0\x00', &(0x7f0000000280)='tmpfs\x00', 0x0, &(0x7f0000000080)) r0 = open$dir(&(0x7f0000000180)='./file0\x00', 0x0, 0x0) r1 = syz_open_dev$usb(&(0x7f0000000000)='/dev/bus/usb/00#/00#\x00', 0x3, 0x101000) lstat(&(0x7f00000000c0)='./file1\x00', &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x0, 0x0}) fcntl$getownex(r0, 0x10, &(0x7f00000001c0)={0x0, 0x0}) ioctl$TIOCGPGRP(0xffffffffffffffff, 0x540f, &(0x7f0000000240)=0x0) r5 = getpgrp(0xffffffffffffffff) getsockopt$inet6_IPV6_XFRM_POLICY(r0, 0x29, 0x23, &(0x7f0000000700)={{{@in=@dev, @in=@multicast2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@remote}, 0x0, @in=@loopback}}, &(0x7f0000000800)=0xe8) r7 = geteuid() r8 = fcntl$getown(r0, 0x9) getsockopt$inet_IP_XFRM_POLICY(0xffffffffffffff9c, 0x0, 0x11, &(0x7f0000000a00)={{{@in6=@local, @in6=@ipv4={[], [], @multicast1}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{}, 0x0, @in=@remote}}, &(0x7f0000000b00)=0xe8) getsockopt$inet_sctp6_SCTP_SOCKOPT_PEELOFF(r1, 0x84, 0x66, &(0x7f0000000f40)={0x0, 0x7d}, &(0x7f0000000f80)=0x8) getsockopt$inet_sctp_SCTP_DEFAULT_PRINFO(r1, 0x84, 0x72, &(0x7f0000000fc0)={r10, 0x81, 0xcd3a7b491f86b01a}, &(0x7f0000001000)=0xc) getresgid(&(0x7f0000000b40), &(0x7f0000000b80)=0x0, &(0x7f0000000bc0)) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000c40)={0x0, 0xffffffffffffffff, 0x0, 0x1, &(0x7f0000000c00)='\x00', 0xffffffffffffffff}, 0x30) getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffff9c, 0x29, 0x22, &(0x7f0000000c80)={{{@in6=@mcast1, @in6=@loopback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@multicast1}, 0x0, @in6=@mcast1}}, &(0x7f0000000d80)=0xe8) ioctl$RTC_WIE_OFF(r1, 0x7010) accept4$nfc_llcp(r0, &(0x7f0000001040), &(0x7f00000010c0)=0x60, 0x80000) getgroups(0x3, &(0x7f0000000dc0)=[0xffffffffffffffff, 0x0, 0xffffffffffffffff]) sendmsg$netlink(r1, &(0x7f0000000ec0)={&(0x7f0000000040)=@proc={0x10, 0x0, 0x25dfdbfe}, 0xc, &(0x7f0000000980)=[{&(0x7f0000000340)={0x8c, 0x41, 0x400, 0x70bd2b, 0x25dfdbfe, "", [@typed={0x8, 0x32, @uid=r2}, @generic="b8892bce40f46ca1740a34fb436ed500fc19f3", @generic="5ff967fabed88fddd45c639bc1908b48fcf6e54435553ce84c81205fd32541ededbc24d81c9cb2f9143dd15c9d122bd7139ec240875696a9a5b17439e4f3cd6a28d84568", @typed={0x4, 0x90}, @typed={0xc, 0x5b, @u64=0xc}, @typed={0xc, 0x49, @str='tmpfs\x00'}]}, 0x8c}, {&(0x7f0000001100)=ANY=[@ANYBLOB="f4020000220000032bbd7000fbdbdf25e402030008006a00060000008be30d4e23a5682de92cdbaac4d73b156393c0c395df1e43e364f5bda3a2c95fab1ee704aeaf96c831d8a82357591295e98aa5af908d09f9b7c40a35dbebb9983fe1e32ed87f003cacb2252c3f83251770984beb1bf2ccf9c882739b7f08002700", @ANYRES32=r3, @ANYBLOB="2b7e5bd855938c2a46a3ead97ca52715bc1cfbfb84abcb5280cea5ed2e14d17ec92860b5f755a693cdac710c925c051a5c989c72909ad940fd7f9c26e726c60516cdb6ce94be00c74545c166a7fe45286c301190b5c3e3a396511ab9ae586f20313030dbf1f9deb0459bb626220d18e4f5ca5dddb548cb0058fbea7450044c8c5af6f7415a4808a8c2104a7fee6ed9fc285b1e3a39db57803ec8429d03da0196594b2901bab6f5788aac20062f9a5b01331223dc176d5afabeedf25fa7ac9db3dd325628bec2a61b85b6a6ba2a5b625826092bd3b1fa3a5b6df166ac0cd9fa48c124ed644adc020bc779f1afd14d5f77bfed639e976be5239753faf0152fd061550489d5a637ef98d9bd72bc21a2a415a936ce3699cd10e113144d5696f46bff5bb28049f4794f0db901e79efc4d0a1ccd576c5fda8e111b470c8e75f9f89dddfb6bf89498198d5d71834ac28795a216b2c47a03361d822e0ee7c85d184ead1dfe4cd99c003f494a2ff680b50d325c07437ab33a6606db445bd89646fcd7c23485b5fab1442a76686c733720fa3b09b91d2293953ec7ca6017a6f1a981004d7f228a683ffa5d723c6d3e4c408e85deed88ded69ce5f0416b35ee6110e8a59efa2e92b3bd780b743cf27517da5f9363a996203fb0a2d49dfceb3c80fc7b0d0a0c3c135dcae48efeb0c337f0e7486c668c6d4d77b7accf9fb50613650e220d9f0ca682fb61a2c6391d5a9b3317d410059a51077fdf13cd33d007a5ab4853a63740c8ed5ed746bcffcee59577d79ad8dab2bcf6a79e7c4c3d27fe0f9599f537bf2466275d01ac9bcfc2c8f2711d4bbe10d4097f85d738e6e01e1dee05f17b6b4551a549d9085baab30e08007e0024a0ee36163f6d7ab6209ff7617921f4f514934530f82572", @ANYRES32=r4, @ANYBLOB='\x00\x00\x00'], 0x2f4}, {&(0x7f0000001580)={0x11b8, 0x2f, 0x400, 0x70bd2b, 0x25dfdbfe, "", [@nested={0x11a8, 0x5d, [@typed={0x8, 0x53, @pid=r5}, @generic="b5e15c9e6e7d1c7f7ebd9ecd798dc208fd59502ab8beed9dee69fb868e9e31c90fc0c84d6b0f1bbadc6b525830892f914377f913989e37b5e8618c7adba068e868ff461c831ae903225b05a5fa98bddc6afab6392688eb3a7bfa07656feec04a73d6d038ce8a3f93d2abb5d6bd26993d2896292daffe3a0ed10af1c228ba453723acdbbf8fc099bec63ffd98f8b265f53dedf84c6e0d58e39b5ebbd10d80990095bfd7f8c3d3734f47", @generic="6efcb1f6589c3fc0921b9bb2397ceb735abb1c70f809a4d28534a45b23f30da56cdc9e3960e2c44c895160696bf8fbd5182dc0f4652dd7a940726fa0beb42754", @typed={0x1004, 0x2c, @binary="fd409fe59663e3ae2327d731f40086106031620325b2ef2a6aee8ffa76c09633b923a5a9bee99b9f445527eded44a3989fae25fdf60aa50030baaf1a464b2573fa8de5ee6f51faf15b1deabc199e84350aecf5b9d6fdda24d53e935d129fc7f1aa3adc41e089fe479fe818490e2e8934a98cba22e8f93487664ce8122d1ea33c69cbf48660fb373a13d2a92a2b0c441b0d1e4f8d0d4844e8e6e4cba6d82cff4ae18d754fa58204aa43005e5a911af7f042e0b632b047d31def5b0b0f97e378e999edfa2081c9e4c76042eb09e5c1d2f2026a494ba0771b3edd9f1caa1f0c7f0ee0eab443e828dc605ff259e57e89208dd12058d7c5c98fb62d2049c78b318074c733ad2b7408193fb843c7c4554995b0904719a7414117f28b3d5c20da97aa9f3c7dff473a9ef6b629e923220c755ab77ac0361d9195a17850e7ea9b22b36432d34d72ed9b469ddf3e67824cb5b6452ff55ef63bea5616097adff4ecf65063b458c3c778b280b2bc8074ac1079911e848f78b46904e8865897caa1d737ac1cf230301a5954b108f450b4b8f82de8fb0f8fc2fc7eb6f13eaf33276a4861e0f4a6a888faeff6f5b0432e0267e58fdb4e5b5086880d0d81ecff617d26e745cb96f1f7a750a5f3fbbaaaee2729964f2ab6239f70ab20babff27af08df1ea43f493dde4c5930390d89ac7199c2edc43ddd2bf0c78e266a9de65c959ab60663e62247f48a32dd871c55e4f8e25e31c3adb7866ef08a2aadd6b61b57e78d6e3600783119b03a1d4c3b13920965dc291c536bb9eace2e9dbe573fed97a7672758375e153b250d964de86face50fa285d0bc371195a27899426bce1f3a11140619c14a1436f94438c9ecd043a315111e9ed7d61c3e5bac6ed2aa1aa1daa106e23d110c4d7a8342272529f87cbaebfb88f1cda45bba1552e1063fab239afffcefe43525bf59d74b06bcfb0e399cc1ee484e6e615ff939e41d0ecd0198681c25f798456ccf9952cc868960cc98ce87ac63515ce00407db2ca389e278221f6d63a57b4f26720ef94f70c1cf1f9064d99b81cf68810a1fb3352a04cd4c081abe54307094228b34d81c888e9ae89a9cab705f28135536660ffd6de1f44e34eaa9a357a00b3c41254e9282473c132c1f76982bba432f9867ce54e424cdfef16c0b307e29d45459b886025d204c1d35ecbd45cf1fea403b2730a289e2d6e3d28ee99c1b38e8b37394d0853fd9c3ffb993669d695aa31c5328a893c84cdb5bf90788d72eb80981d9d40e501018c2058d407cd337b992bc73f98de52b307f318d7b2985bda42810c18091443c95601d9f0a0324c84b58982515493af9ac1e6ba5d79c10adbd44a9a6dc35b16f4519f8d9afa2ed2d90ba3db5c724996cc501d6461568951fee231c13071980c1eeaa71cd3d5aece673fb002f6e2eb12adfd5aa12d2db8e119fdea2fb829f5234896fc18ee8413cad2e3589e793ad58ed609d6adea26f19e4bbd18274a0eb0a4c9d9daeed176d43084a5b7d66382ff0ae2e4663c224ee953c5b03810de4b0fe8df1ae7a609b3ef904bc0700451146bc7ceb0698b2c092b3a9a5423234b56a1e399648cbdcc4ed1b6fc8f06f22641efb23068fdf579120d4c369d2e4361352c5e003607d656ee3a1e37223b36c97f2ac1e7758bf9d34a7943b6f17a7e798f7242303a01c268d1daf5669eb49a674092a8698538f47a01e193e99957ccf2e6971f4e68c620ebaf8aaaf858360d80278a484095fcbd37aa6852a4e9d07b839094bce96bd7e813200f186dd827ed62869fa86f189de0ccd3a4ad12ba9ba69f6b9357e25ee1f46d4b113cc8ff12eac2566bc60f19af829ab1e48d4f29b05233a6023d25e3d3629564ed26b419be58a5fdd8e943f15cfbe5a7b02be5770dd7c6f8790b26d4de6c8abc06064a4dc0d90b129daf34b4da6852eef6f69a8de92451d2ddf3b07d391355e40f1dbcd0a789834a2c7f02dd47da6866834cb6af53194710691425f29bbeede394c8f16997b4bf46846eabdf261e960af61dbc7c67d7bf2aa5fcc5a948e9c4a7a66b415af42df284b711709e772ab002938e84f2d5ede76f949044a880d12be4d8773e1a5e89567b221ced032757987921762a9076d34e66298bd561edd0c405dde4ebcfb00f1362e248c3dd83af9bab7cea5beee540f676ca68ff71f28d80fe1f29639b3decfa321b2d19c9193f6d2f56ec11129a7fad1d6d5f17afa64a7cc984bd98f2040cc47d3cce8e424834b91fb6eb09e6dbefc93d09f6d4ea0e2fd19476186b957904b9b10b270981750b99429e2003357d78030135e64631ccc9ec66b9c9d9f22c625f2760b3fd872a243946835adbd4f8f29834eff659ddcc18503c9608f26e86b79b461b4cf88b2fbd0dd6375a79297975ffce2f638892862fd1859a41dd2d81b8eb2bf174ad2f3575f2f0e241bf647e3f8494675175fc5c437881b88f1d8be5fc2ed721c5f9429dfae438300e146c5dc0bf82da2352f4da7e45d398599866c73f5378271100605bc01b3e4894d5664e2a9f86a41383c59fec8175a1e3880f894c80891f33ed37656d8f629208c2bb672fd392526a95dfea04eef8d94e4547201ba73766adf5146cdef5e51b28a7696d889c5939263a652b5b55c83823c330d33e7668e6790f71cbda02764189d3073b19704c08ed86ea75e357aa7e6720151f3fcf6ec745fff5b4677ad0f308f28a445f0861648696d1eac089276d37749a2d9df0701d32e8b5d8b1c000687c80ff454caf14524120d6f7b97a14dd81a8390284879d7e641862fbd91ec87c34cfc652d38bc81fa2f1e6428a59020e9e1167ee018ab0146a2ebcd6c5aafbce6f3f71a42c0d98eb46b794018add78012177ab211d0643f08502791271883bf155d6003d8669f975edbb49492068c2a98aefc99441ae579715b2faef50ee140425d55dfc71bb151963dc6e09915167d9d0232045beaaf5ae3f6ebd36837e106e04dfbb1b6e82d1c33b0fe2e530e4d2c907f8587881ea7fa2fd03bd14c606d1b29312a870cab540d1e6ea01ff4cd9219fa52410f4364b8c7a21b69f29e312ae97907abb95cc5c3ccedff4a6403030fe8e8cfaf69609dd4530f2c9de05a3df3f13761e508af6dbfa67f11df6e4aa453719d411fa04fffdba3c5cc396e291fb1835e1b625b20685bd83c495e52ce83fd7915627fb29b1faec7c1c291b0b7cd1dc5dea73095986357aa76d47fbd527024104c0ddc5283f7328e4e4d2e6520e6115d37a4bf12021eb36a7791888a9e4f6227dce8257b929b15b6d231cf0be3c114a0369ef6d0918d515a80c110e3e68d2a6a421b0ba5a2b48dcda12a67a68edca8176ed3d81e1044085190134483b7c561669076ba6fb6fe7aae3c49b6ba3006e2c679e6e468218078f9225c3a3aa953ca8b43aa29cf5f153d474bf1e506e8fae6b2a61608c3fc7c89df61001a0a418dbecfcdcd89ad73c04c2eac3f3618435164c2735f5687f3362176c6a58f4395b6c1763d6a7f28e005fc1737663e9d1e62187c0ecdb4d13754c06a8c247397a393b7a8056f7d56481744d0283ba494ca7b933df84e06b5b32135e7212ee13dc94a33f14d285a0a749f753ac8f221fac95286bbd84c02211d854c66a05bacaa0cc233f977bb34e75a8be6a9abfdc1462c7ac72574c95d52a44f1d0fe5e0a5e7b183f1fe915d0de6f94c9e97fd6c9e8d4e863a015e39254e767c3342392a6a7054666cba3ee985e9ee748310a1b7a46b9c3b7476c4008a82c65685d979e0de58c0bc318b757680288316f9fa44520b3f398aa40ce8a989f0db0066d38502d27e2bff7873b4e82a64aeabd76dd64ce372322284af0db98f309590ec7fdfaa6d8926808e0531f8d6ee969b204146f286dbb402d1fab767f18bc444130a85e786235aa08c02de4fccf835f01c7275f62711c8ce7d30afa118ca2c0be432cf729fa7a7ca548c0da7b7774387743513bf1f3b7bcd3b6b533220f9782435e44ca8507caf2cc413fce7fc5220f9390222d9b9d5b9be558204da06554fb65422f30a408fda29f3ec97e47be8624306ded287a15db4df59c0a5c1f2a65a50e7156c6d29e0fd6296860f2a8bb945a90a718f679f8b6665c3a45efdfb97f8a1ef0ab23a4232ab0e63516ef97c1d2dec0d680b38fcc229d56c782a6c5711b5d4717abb5535e1bc53f4e627f45f3ca558ce07fdeca9615ac416d7579cf63aa8b6fd67811ac09b47a3992525b829362f104f18c99654ad901956f7ec1661087f1f8452ad813d203f7e9e25a4d1274091018b5efc6afe6f1e41533228d713c974bfdf7d728000689f878e4afe295e9c9a783a8062059ad2f91c8cd7db642faaad74fe3ada9302b4f24d4368d5d25b110f644b7d4a8b357edeb7a8d2d1b1c923a6f153c53696615d7971565ae172304e7c84968c5e97af1afb6d57fc2a9eaa3f09983a380db3b57a97e8c0a6e8ffcc7745cf8bb0079e67f333741e6ed2115ba93e821faadd2c019c5d9a5f3b5f93d55613ef4b8b0873706ebd7233e81abc4c205c3afbf348a120be462bd3fdc53843405e546c7ee749e27477e655432f5d42d5a8e89b0722686cfdd7c77e55c0dd86d4bf3bd79f1f35866cd6cc2a5d25a04aff8cb4e9b8f997ff2569c194cc7e7c4ee41f6909c8a4a8b066bad38b76cf3ed1f25107d51051dee91a6e86b5181a534bb2654c2da5ca5602429b24369c048d69e43d76f81a3adf9eb1637711cec0b242c635ddb6453d616eb6c7c437fac0d75e2f55127ed164c0ae901f6aca7722aeb9ff13b363d9bb5db83a2be6b2060c0a3c6c5a60c7560eee4f56e55fe95593d205edb68ddd4de72cff3137d35423d909f9449b8ba3d858680b071007881b56ce638ca2779432849701cb4aa31c641555f9151c78023e9558f34a88a15ecbdc96a4be636319ce7af9fed58dafec89bfc7de9d914569c8ec012adfe71e7c647dab16887eb36a2a6ec1e3c3639b6bdd43bc658f769e4689c96178316b4a1d9946a1bd68db9a1cf4f1f66a28fac639cf28c59df4b880d3b52dea8a6ccaafc9b37b2e6b875b1f1fd30d0b3043de856e0cb5009df47962a3bec08af149f634595c442db399047c8fb1a09f7d3ecaba7f0dd521bac1d5ba3063c67a81ae3555f9ecdbf827ff20e0716b3c633fccd1629ce35e36782ebef330e659cbc657c1ba31a02f5aa6c6d484e1296b99c148636227c4c9c37cb362b4c8a7e0e9d1e17e7b4c39f6242af8a8e708fe539dd6e9cec8da69cd1fe20a7df63ccad8f5f47b4ca10e0dd655a475a9a2f450d63463feb7e0ad895a76c5be56ad9b2782306496ce5e46d5798c3f145d2cf5715743f46e53f58d4e85d954451a8e5e3756705e315dc2d6cb611912896ec2294efd49d025a39f32385592c219a3d78d659612b4a044deb40ef77c15fc5914ffcb0f006f02532ff2e910bdf4146ff626323b6a09081b4cdb3eea3bd55d204101c2e446f7d81620818efc8f1d404dee258949afb4d7006f86fd7a2415da2adf82d50c86d14c71c0dcc91badea790705f0d34a257d9e53968ab74699e8ed7adc98fb4c6c0e617bf846462d994ed44ddc9f1bf8fa4b34cf7530f8871c99b281290a06195fa099b5b6761d015443700b27b86dcef22de644893ffd18871f05cdd1cfe82881201061fea70a1802c1fed66108f34f159b495e9146415b60648c4c23fb82448161ac6a22721fef62c0daa000f55dd9625b1465dc00d40ce95606ccaec0e2ce584ba8e47a26fc116a3e3ef17100be97f08468d7025b0ecefa41358ccda5f85f94f84250215873c6c619b731b2e"}, @typed={0x8, 0xc, @uid=r6}, @typed={0x14, 0x90, @ipv6=@remote}, @typed={0x8, 0x92, @ipv4}, @typed={0x88, 0x2e, @binary="8de5b0e94a0cf96e3abec3b7447e77735458816e8fdde7a694c23c1a33fb7e48e62402e8b69863db5f495d5548a73e1224350cd8e4fbb762915ef3e83062a41de6f6cb18cd070aafdd5efaf934205295374508c82f4c0fecf0f58e17c9e3380b5cdf8feb829a3fee8e1da93aed664bed9a683c79a649d105e0ebb86660004d813c74"}]}]}, 0x11b8}, {&(0x7f0000002740)={0x13ac, 0x28, 0x400, 0x70bd25, 0x25dfdbfb, "", [@nested={0x1e0, 0x85, [@generic="9e2880d41c5dfd7d1f5d1d6f30bff3c49848bb57594a897e327e52828c43bc6909706c20005ea76d43724452fc098344b9e1e1a49f87c51012601670552607b4f8a429b380de91a2e14b5c81504822bf2545c0f6b02c3abc067c0793a34640d8e5149162bc90471f35ac993b12e9946cbef2484f5eb8b954bbe591457e7827498fef08d6", @typed={0xe8, 0xd, @binary="5cc1517544119912160318656d7ff604d2975762bfd3a301bf94eef96895751e77f96cc78beffffa25a8a515fdd1a4e9d1295e3a8b3282c7e20aa91f9f495b25054ea10e9dc6fa393177322e3936ee8451d73ec7eed1c9e8aa4e04b1ae53c1cb028a69dc36ddc877a76917a06ce4b29a690a31d4d6e551304c1a5dcd1a23af8d32596f0fc900013c4b648daf910ec9e554ddd9fc5e725ea20f4cbdeaa29a99a60a5f912b6e634d0d08a77d9950da78ae4fe105c721b03afff38ffd208cfcf40fb44f5767663f5763cea9b2ed35db8a97d692e5d632af9bc4850696660201e3276b"}, @typed={0x8, 0x43, @uid=r7}, @generic="05fb8ac3c5e536f5c435d43755435fbc31debed16f92d157e1d25dc38d147ffdeff950b118a0bdb04add68bb81fea639425ef05530e66f7d39056104b0dd3bb1b04502625353a61634f2e47739ab0d4391350a7a68ebe4f360b70324bb6f63a3eab5dcd91f6e"]}, @typed={0x8, 0x47, @fd=r0}, @typed={0x8, 0x87, @binary="9f2a"}, @nested={0xbc, 0x7, [@typed={0x8, 0x49, @u32=0x3}, @typed={0xb0, 0x84, @binary="dc945c7515ee9ba487dd34f86314a9d00c443afdacf39a161f997bb16401c8a885c559afae0904a9233772280cdf3a4c24e563a661a0773fc22797bd18282e935377d73c829d55e1ed06cf5d659a7e5c6edba12e8bfa2442b784e9e98e449f9074b35a8d515d6bc547d5926565655d5b048147aa9a1188d6f7960c348afa3f093b03e5e55e9c6311741db36222a6e54d3ac4bde6a97cebd5a739b8dd80aefc59e4bbcba51b809c4f1c1b17"}]}, @generic="981c9b2df9ffa4bb1ca70e8ba87a715d9f833bfd4b68efdd95521f030a5bbfe5817cc1d9e7fc4eeff02286a3bd961ff56c163aa87f42cd94ae44ce6ece672ed6799896c40f8dfc8398a9", @generic="189265a2cbee32ad2d39d6d3b8b9fba629c380178c4cea31236f4f2012d7b5166be6e765810fd3330bc7959ee81bd1", @generic="2f04521161fc377826b06ec1c4a357daa648447ef8bc49f791ec919c8f41bb6da65b87036341d83dbee8b96f9d98de264aef5b356a3a138c2e0970ffa1268482354efe22a021beda5f651243e0266cdd14b53e61cba3f8e4990418d31723092999af8f60a369243cc26a0cc362528fecba7c78", @typed={0x1004, 0x64, @binary="3bb9c1a7194047510dc9697384ff9d2f84744f2f953983a02884c369a0539dd2c17cb2c6a1fe3f6ddb0a3a5e7067aa00d5681e4cf9007ab0d237ad678fadd3d1802551a0f413507d066f97fd7b1ec20774306cdeb4b549460a12f04fd63fbf97b61490cb11b00e7f68b7a7a2c1b7ac19b2a94e7eef7a2f369f0dfd8fbe5f62eede070466caaa407ffdc6fb7774134fed8a00d1125902d6af5e86aa79e360a008b11f287c36416678b0cb3aa5a1c8987cf89cccab51381b5fd857c6d8636f97a395fbf2cf1bfba06f67e6072644290a7b538a864bddd3c37b4fd0c8df088949b508324c1860da24c47204985bd9c63f6ad43c32572d030638dfecc291a3581393bfb72a6b16eb53d43e8268a6afb97555f7cafe60388ef4a2df5e26d439cbd52f94eadaac8b99baca4ac3954c3f98e9aa064b77f2d0dc0224523aa69e70e4855d63f80e039a34c537967bb4983c37e68bae00d44efad8ce1b2222f0344d973ad97d8c7a04fb4fe24346aece0cf7e5cb681128722f4e4cad5ae857953df5e0bab675718fcffbb0531733eefcedb145032084fefc707d0553c0c1ca5aa9bc42821e55b9d74babefc7e53c5a0943224624d0214484cb48247314a6eaa10d5e5ac33ea5bc1ce3379e224d8348a6e7eb3a25ae0e7ce258502acfd47b2f7ca50f5ffb5149c6ba8b9def35c0b2c8f6794dc94ded0ce2d8955cded2e00d6a9584ed7656812541e38ddf306647101caaaa4b13f5ab71e60219c74b568ee8cab07217af5a9cda7aff4c5f5a2f1560b9bd8ce77cabfb9c72fe8feaec645ec32f5d9a6413af0db330e5278131806c488efc10aa3346d7ed50b28a7bcd44bca517e9b68aa94522456fa8ee8e422adbe58b957433ebc6be4dccbc0f3d7ef00bc709186f6095b78ce5c3ee132e8dba896422b605a59fe1901e93be89d07561264fe0558c9a84168445d69ff083cd82593059c8d6c77e4af74ec1988b00f535d1f82daae083e2dddbe4b10f967c57a4dccb4e8c62c50a7475e8f43a0b5e67d5c25b80d764464e2803b513e2ad0391a9cc9a76a6f0b95e4c85521bd9138d739e93465d41dad9eed2ff0c355f0fd6c35783ab4710364c85f24f1df2ed34c5fa903e9ed7f50e1ae2b78ba664b51d1567bbbe75eff1f59c212aae2760c5dd2023d57ee62899c6153132b32de88a5f690eb1d7625b8a3661a47e8449e588122a87695f580a20a069bdc7068f17bbc876cfa2833f0dbe997000fe3dec43d0e07c82e4093a0b60ce3f081b5aa9287848a9f8493bce5d5658074a40bed85cb5bff030b10cc30bc026ea2afd45882d9758bd95adf7a2047992c48110c5841a2499c952e9a47b208d166d0158c784c8c593dae2387b80c639a2c64e4aef0356e15de32ab28c33618b81437fc1eae777c436bcb27e08b0586e88aa4a6eac02b2835fb256526b97f52062323c7ca23e296684025459dbee4fa06320fdbef3439101a8334ad7fd6d4c546e9110c3980b3ad624d3e848148745bee0483f90c50789bc0648e43b37edf195005497737475e1eb63cc56e38846dca2e690621e3e96067ee73d3ceebe41f8df78acb826a3c52c73674390cf7a7b03b56bb45e6938ec91318214cc5e8a4def80d549cb9cd9b8eb90303aac9844c3f897474beb04b7cda7b762350d560c6a2cf7bb6bb657f4eebd8336f1709dfa9bc01c6b5a3102ea953ab813260151530f8bbb033b0aa355352d08b3dbf32ece301195c10134c0a69340d80312cbeeff8599359a387ddb30b3f26a0feb9db317afe9663121250fe07ea50094ac1dd8cee906e4080dc0ceb482a1a2072d35b082c55fcbe8e17d33cb63d6b466793826520898302345fed8a3a552287dffd826a34bf9af19780685ab8c4646348ba8aaa3945eaa052e704346d9ea36bf98f2b1d6ad93e14e5ea11cc58f4ef478d66bea29e588b77bd462612b74f61554aa95bf9a05512e2cfd9f074496b3613962d4cf6d517011d04e6be90f9da2af46eacf8ad37a3ee51cf67479c3397ec9b053102a7f6d5cbead797d9f31a057062171e6e4b868f563585fe93aa1da76d0aebe5bcff505bc6185292137910151032ee3c8849061cd242b0339488f98050d8536c0fd68d991e0d5c91c8f6ace0c8882fb5c06bc5ddcf13de4783bb38d69b15a409ca976227010505c1e6a980d15febd2a5a157ad26298a98a1d8653cea73a6c5916da2ca3537539ea3944b793296a8f49b1b4a718423bf77290eddbf986b00ba7b1655a04d77bf3993af16c23507c02e60ab05bfb03e7544f9c1d46f85c4ae916ea5d48cbcef6148adb435beef6d2f7cd3046d87985ebd8799256a4bc759e499f82932de75abfc03cc137127e6cd73421aae856b30f515a10df31f19859a9f82b250677c50f3f39b369e8eea524e195063798715b0f434e0f97bc36381e3e445e60a426b1486d1010868d00cd4ede133f8dd54bf9bb2715e3925a242332d317fa4153d280e1a26df6a013007b28354731cf04c06171d92bc0cdd45c12866fbd90516970e954975cf33b6d2a7011a0a3cbdd9745373edc6b825e0800d2c52924bf7cad25058d66d3b32d72bb80d65a165f87e50a3d3814776daadfd8f86c2c7d5a37b139404edc73744dc0a1cd64969ba95ac814446b099c19a91a6f1223e52820bed89961e00bf4151d519fe79b64771ec66d23a897b6d791bea6a732a35c4b2ff4824f71aaa931d65235fbf6e5f29e21c626de26967438c7c26dc458c4a063ddcc4e7db55d1580cb54250adbce1942eadcfcb40ba65e9ddbd02e783c999db801f0607df9138b17b171c2302c4e73e8d91efaaa77df746baf18ca23b32f8740e70efb27bc0b8b7680cca2f7c6d379bde78515cd1165fd99e170644c7e44d989575b4e721d1f1e52a95fff75b318a8e0a4740ad2654cadf6462edc48a041bf5efe9bd39c0198c4058cb9f00a51d6f30ced440d0ef32ab86a0dfbbd0bc08d5b90d65cf0be9c1e0dde94fc14aee480ee27da61f40e16318cc0ecb0014e0a7fbed73853d1eb8554bc65bb8341288410e10f833639aafcf98995119b701f472107bd8ef9f210761ed1a011d6753ad09d32a6fde39c9b92aca11bc2c42d2f82a7f09a4f86202bb6a28a0e73b82f9115d5c7876e8e2849809db1651de89a1e6625b82f2d4825c88202bbe9791f2b1d6e0f906be848c9da03e5eb04aa07157fa6cb97136b6d4be10537a0b12de72a49908b63a8ebcf65ae370e659b55b1bd3a5170cba4e3eefddadd509fb003ca5e09715fdae0c0f0cdaa82606e2ee965953894f15d0641499bbb1ad35cbe7dd32faa967e54feecd4e6cd5729ada798e7de143d24edee4e41168df09698af0a20fc3934f6d58c5fdb1d5130754acdac69592634533e7e7944d1dd63ad8e7ffc5ada725faa228ab5cf98082a61bf3ec4c38314edae35a18b305b3f3862cc3dc38456f0f5a1386645730430488a963e4bf1ae6da7fc1b8ddeaf1ddcea6e2016698365fb94194299f5189b6497bf3fa3b78d2741b5fafee846462889298b92c6826e8881b9ca9cd7f59a6bce5f39da4da720c65ec0cb5ac0606b973a84ad16c256e0020c649869b8d9914b7278797067739bab830d31ef4075394d1b0b4c8e30ef7bbb99096ab2b681dfa309813cee7b8031429ba20f17dbd0216ec7bd0d781f9fac96c28608da37253cf3129b8e3e0cd647f7e3d91dbf3c0de7fba3d8e39f2d743adfa5e8b6e2d573630e27f3ed2f7a1f6e6c7b7d0d802de8ad4d3a714fc7f32dabde0c3fdc34e2f38416372a11a4d5aed9a27bb31e082125886c9aa1ee664cf8b5ced5eae1ba23e5993f4f69f0cdda39808f167e50320fc33632a04e56692a3b5f9f93ee9624f5eed2be330e762f0cc66ad1707b53f07aedc70420b95325fa27f8b5ac52960a811e7ff12483b321a362f38dcfa3c1882ad0e8abe2ec31d9eb231d5a97fbf37158a3fc0729e726c9d986841085b35533b93ffabd02140387e320a22cc158d5b85dcf9d83cdb8bdb1ab19899922bec199dffea6a7260b3c25679aac4fb1aa337b00239afb72aca8122327b52c3c8d1d1b45a4701ef9493c406cf30190876f3dc6aa0c739632b13d7ef5df32753015b45bc5c4713dec77939e32447e78dedb58ed401db657d09bdf7db159c2e472fd9de3752c8e40300b86cf21a8de8338fa071df5f50b55c4c34e95ff33d6ca0cf9d8d00964fb262fe502a0d8fa35b9c30d53dd92eae0876215982315939486d3e62d159e3ac0b021e09df62c67a0dc301a9edda54a85cf2e817892eabeab0da35a873896b27abf298750f0e428b8e48271db28ce9ed418f46c836f24ddd28b029417804f07c0d9f298073c335cec80a59ef6ef28d2db5e54c254a73f7048e4e1bb56bdfea4f727ac594a843419a10a53ed5b998f7a6975075fe589cd87610b107c05f3db6cbbd4801fc36b69042ac290d5f6d6f5d7f0e39773b9a4b3079f859eb85e7e3ce4598ea27e3f6e6e709acb7e9ac86adca4677abe28650e1f64871a1bedf234be628c7d15de14ff1d5def846a7ad8d508b120a1dcbf4a92a669a0c25d56b9432adcf1af2ea7637c0a3a127bb3c3dbad436c73231a1d147cbf4667b037d18d81c53f381bf8b1dd8c50c172a0c6b01b10082350f8da328572a505091c8f4e23c0022eb61f701ce8c58aa08d80f78415ab1d2ff1c9291a542a2965b7cf63d3a3eaeb04d075674ad6adab847d657a98b90d6e22c5f4e869c814029d2d5cfcf88e71dcf0d6fc17a8e84ece3826f43678c6d8dc7e961baa607aeee628a671ad1475866978254b623838d1adebe2f90703ee5d97d874e5bba6e99cf2ee15af76e608b016ef95f3f79afa9dc4563360dd7471bc4dd96726475f30eb87f70abc8a4034a868834c8d85fb4ecda9ccb439c44e69f357585dfe2abef03727d38a2c1188961d7979cf19eb1900b685a8f927319b1d64509d7323606b25585b3caf4391671ea171b5aa5f9badbb47c03ebf458b90bfce9f7c9708b6d82f8fe513a5e59e6494903c976481036002a61b84894216976c18b60e847be3bfb2e8f9616a9979cf541e0f195621af2bbb2c255f1f7bdcb6b035d5cc8b328b006deb41400b514ca7ad57472ed2e7d5855ff47ba37a5d779bd534bb61bf047d903ad20d7945ca4fbdb05c8a573dc0a3fb505f169e0c29e2893c43243e9119b8e5a85caf7f76e58d1e833e6558b1667dc3e21cf9de6eba4d6cd53182f14de9b54c413a0d0d3a141c34326f614400147f92e3640429025da9e6d9c422d2f853ed6b841b550bd7c4b6ca424460132dde1eee295a3c51951a01085e8bf56a5c668ca5bdb3bd252d98e08f195948a92c15a2a0da93c9f5082dde59d2fb46d92f698801bcdbac4858da337ec47d302bf9ade6cad84dedd5970f5f76399c425c3940414df3a90fbb46e798cfdb96f5a7bdb222463bbc220cdd1d5c557d988b833c703fc4a77b738c10574c6a3876750de784e4688cbeacb3e0d20168b7b67b9826ad1a5af805fa84bf0aac9a5bd762728130216656c5729afa3c4e6569cd8c7c2166dbf8267ac5ce6e6ffc86742848f4b3f8638f9253e12ce5f17d462bf2612a4c9acf46d7e5ba263b6bb2dcdeb12158ed65919d9a10723401708de20d0eeef760ab74fa81c98dab9bb0711f6c433d481e5b8c253d32063804dec7a428d91dd4f8e984088b1b4851010b000ab9757a8a5d54018742820af0850b0c514c6732b0d07375d38b628bd3b2936d13013b7e9267b564d6ce66a760811d289c721cd68e2a246bd70200207701a997f694b316127525594103795109e37782"}]}, 0x13ac}, {&(0x7f0000000840)={0x12c, 0x1f, 0x330, 0x70bd26, 0x25dfdbfd, "", [@typed={0x14, 0x1c, @str='#security/\'+\x00'}, @generic="4e4f26dc34730ca38378e6e29dd09196244bd9e5494a26adbc49f4d3273ef8d17ad493ec7d32982b9e73213312211f2f3b52883584b30687119913e15d6bf6cb70a88ab8fe512e3d3f97662bb803a7c55a976899d47e39ae639182ce62d7403482ecb17d1d92fc4be38d31cf3a76ac672484f9b60c4f78d63c3b67c87413a043c1508f4505a1403ec1adab33c44f065837908c8e315b7947d8230d77e65420e9f223717e2437e76be1d22f046c481294313e51b69103b2f6818a1d737902ca17f5c19e7ea1c3079b0e7dd5607e6dbef8dc698c", @generic="c757763dc87d9f6bd9dad5b8b0110d041bac896902ecbafc693662e5476861f8f670323b50881f5a7701c610cf", @typed={0x8, 0x66, @fd=r0}]}, 0x12c}], 0x5, &(0x7f0000000e00)=[@cred={0x20, 0x1, 0x2, r8, r9, r11}, @rights={0x28, 0x1, 0x1, [r0, r0, r0, r0, r0, r0]}, @cred={0x20, 0x1, 0x2, r12, r13, r14}, @rights={0x28, 0x1, 0x1, [r0, r0, r0, r0, r0]}], 0x90, 0x20000000}, 0x4040000) mknodat(r0, &(0x7f0000000140)='./file0\x00', 0x0, 0x0) renameat2(r0, &(0x7f0000000080)='./file0\x00', r0, &(0x7f0000000100)='./file1\x00', 0x4) ioctl$TIOCMBIS(r1, 0x5416, &(0x7f0000000f00)=0xff) 04:46:24 executing program 3: r0 = syz_open_dev$sg(&(0x7f00000000c0)='/dev/sg#\x00', 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000000)={0x53, 0x0, 0x6, 0x0, @buffer={0x209, 0xb8, &(0x7f00000001c0)=""/184}, &(0x7f0000000540)="ad40657ed56c", &(0x7f0000000340)=""/128, 0xffffffffa0008000, 0x0, 0x0, &(0x7f0000000040)}) 04:46:24 executing program 5: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000480)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_GUEST_DEBUG(r3, 0x4048ae9b, &(0x7f0000000140)={0x1}) syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000100)=[@text32={0x20, &(0x7f0000000000)="6601669b0f35c4e1fe16846ba49e0000b9940200000f32c4c23dad78e0b9670900000f32660f38827f95b0040f01d10fc71a", 0x32}], 0x1, 0x0, &(0x7f0000000040), 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r3, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000400)=[@text32={0x20, &(0x7f0000000880)="b805000000b98b9400000f01c19a01000000b0000f43d1b8000000000f23d80f21f835800000900f23f80f060f2140b9800000c00f3235000800000f3066ba4300b8f1ffffffefb9800000c00f3235002000000f30c4c3295f4da400", 0x5c}], 0x26433e1, 0x0, &(0x7f0000000300), 0x10000000000000b6) ioctl$KVM_RUN(r3, 0xae80, 0xf) [ 638.353451] tmpfs: No value for mount option './file0' 04:46:24 executing program 0: mkdir(&(0x7f0000000200)='./file0\x00', 0x0) r0 = syz_open_procfs(0xffffffffffffffff, &(0x7f00000001c0)='net\x00') setsockopt$inet6_tcp_TLS_RX(r0, 0x6, 0x2, &(0x7f0000000240), 0x4) mount(&(0x7f00000002c0)=ANY=[], &(0x7f0000001540)='./file0\x00', &(0x7f0000000280)='tmpfs\x00', 0x0, &(0x7f0000000080)) setxattr$security_smack_entry(&(0x7f0000000000)='./file1\x00', &(0x7f0000000040)='security.SMACK64IPIN\x00', &(0x7f00000000c0)='tmpfs\x00', 0x6, 0x1) r1 = open$dir(&(0x7f0000000180)='./file0\x00', 0x0, 0x0) mknodat(r1, &(0x7f0000000140)='./file0\x00', 0x0, 0x0) renameat2(r1, &(0x7f0000000080)='./file0\x00', r0, &(0x7f00000002c0)='./file0\x00', 0x4) 04:46:24 executing program 3: r0 = syz_open_dev$sg(&(0x7f00000000c0)='/dev/sg#\x00', 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000000)={0x53, 0x0, 0x6, 0x0, @buffer={0x209, 0xb8, &(0x7f00000001c0)=""/184}, &(0x7f0000000540)="ad40657ed56c", &(0x7f0000000340)=""/128, 0xfffffffe, 0x0, 0x0, &(0x7f0000000040)}) [ 638.556698] tmpfs: No value for mount option './file0' 04:46:24 executing program 1: r0 = perf_event_open(&(0x7f000025c000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = perf_event_open(&(0x7f000001d000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x11, r1, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r0, 0x2405, r1) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x1000004, 0x8031, 0xffffffffffffffff, 0x0) 04:46:24 executing program 4: ioctl$KVM_IRQ_LINE(0xffffffffffffffff, 0x4008ae61, &(0x7f0000000500)) r0 = syz_open_dev$dspn(&(0x7f00000004c0)='/dev/dsp#\x00', 0x1, 0x0) openat$audio(0xffffffffffffff9c, &(0x7f0000000000)='/dev/audio\x00', 0x80, 0x0) ioctl$KVM_SET_FPU(0xffffffffffffffff, 0x41a0ae8d, &(0x7f0000000100)={[], 0x0, 0x5531fee, 0x0, 0x0, 0x9, 0xf000, 0x0, [], 0x5}) syz_open_dev$usb(&(0x7f0000000440)='/dev/bus/usb/00#/00#\x00', 0x9, 0x2) r1 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) lstat(&(0x7f0000000040)='./file0/file0\x00', &(0x7f0000000080)) ioctl$EXT4_IOC_MIGRATE(0xffffffffffffffff, 0x6609) sendmmsg$unix(0xffffffffffffffff, &(0x7f000000a000)=[{&(0x7f000000a000)=@abs, 0x6e, &(0x7f000000d000), 0x0, &(0x7f0000000600)=ANY=[]}], 0x1, 0x0) r2 = socket$inet6(0xa, 0x2, 0x0) gettid() r3 = getpgid(0x0) kcmp(0x0, r3, 0x0, 0xffffffffffffffff, 0xffffffffffffffff) connect$inet6(r2, &(0x7f0000002740)={0xa, 0x0, 0x0, @mcast2, 0x4}, 0x1c) sendmmsg(r2, &(0x7f0000007e00), 0x136a88c8311572c, 0xfffffdef) setsockopt$inet6_udp_int(r2, 0x11, 0x0, &(0x7f0000000400), 0x4) openat$kvm(0xffffffffffffff9c, &(0x7f00000003c0)='/dev/kvm\x00', 0x0, 0x0) ioctl$VHOST_SET_VRING_CALL(0xffffffffffffff9c, 0x4008af21, &(0x7f00000002c0)={0x0, r1}) ioctl$SNDRV_TIMER_IOCTL_TREAD(r0, 0x40045402, &(0x7f0000000740)) inotify_rm_watch(0xffffffffffffffff, 0x0) ioctl$ifreq_SIOCGIFINDEX_team(0xffffffffffffffff, 0x8933, &(0x7f0000000480)={'team0\x00'}) [ 638.837551] binder: BINDER_SET_CONTEXT_MGR already set [ 638.843374] binder: 23722:23765 ioctl 40046207 0 returned -16 04:46:25 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000005fd4)=ANY=[@ANYBLOB="0563043fec000000"], 0x0, 0x0, &(0x7f0000012fc7)}) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000040)={0x8, 0x0, &(0x7f000000dff8)=[@increfs]}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000100)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0xfffffffffffffc2b, 0x0, &(0x7f0000000680)}) 04:46:25 executing program 5: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000480)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_GUEST_DEBUG(r3, 0x4048ae9b, &(0x7f0000000140)={0x1}) syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000100)=[@text32={0x20, &(0x7f0000000000)="6601669b0f35c4e1fe16846ba49e0000b9940200000f32c4c23dad78e0b9670900000f32660f38827f95b0040f01d10fc71a", 0x32}], 0x1, 0x0, &(0x7f0000000040), 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r3, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000400)=[@text32={0x20, &(0x7f0000000880)="b805000000b98b9400000f01c19a01000000b0000f43d1b8000000000f23d80f21f835800000900f23f80f060f2140b9800000c00f3235000800000f3066ba4300b8f1ffffffefb9800000c00f3235002000000f30c4c3295f4da400", 0x5c}], 0x26433e1, 0x0, &(0x7f0000000300), 0x10000000000000b6) ioctl$KVM_RUN(r3, 0xae80, 0xc00000000000000) 04:46:25 executing program 3: r0 = syz_open_dev$sg(&(0x7f00000000c0)='/dev/sg#\x00', 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000000)={0x53, 0x0, 0x6, 0x0, @buffer={0x209, 0xb8, &(0x7f00000001c0)=""/184}, &(0x7f0000000540)="ad40657ed56c", &(0x7f0000000340)=""/128, 0x2f, 0x0, 0x0, &(0x7f0000000040)}) 04:46:25 executing program 0: mkdir(&(0x7f0000000200)='./file0\x00', 0x0) mount(&(0x7f00000002c0)=ANY=[], &(0x7f0000001540)='./file0\x00', &(0x7f0000000280)='tmpfs\x00', 0x0, &(0x7f0000000080)) r0 = open$dir(&(0x7f0000000180)='./file0\x00', 0x0, 0x0) r1 = socket$inet6_dccp(0xa, 0x6, 0x0) setsockopt$inet6_MCAST_JOIN_GROUP(r1, 0x29, 0x2a, &(0x7f00000002c0)={0x5, {{0xa, 0x4e23, 0x9, @mcast1, 0x8}}}, 0x88) mknodat(r0, &(0x7f0000000140)='./file0\x00', 0x0, 0x0) renameat2(r0, &(0x7f0000000080)='./file0\x00', r0, &(0x7f0000000100)='./file1\x00', 0x4) 04:46:25 executing program 4: ioctl$KVM_IRQ_LINE(0xffffffffffffffff, 0x4008ae61, &(0x7f0000000500)) r0 = syz_open_dev$dspn(&(0x7f00000004c0)='/dev/dsp#\x00', 0x1, 0x0) openat$audio(0xffffffffffffff9c, &(0x7f0000000000)='/dev/audio\x00', 0x80, 0x0) ioctl$KVM_SET_FPU(0xffffffffffffffff, 0x41a0ae8d, &(0x7f0000000100)={[], 0x0, 0x5531fee, 0x0, 0x0, 0x9, 0xf000, 0x0, [], 0x5}) syz_open_dev$usb(&(0x7f0000000440)='/dev/bus/usb/00#/00#\x00', 0x9, 0x2) r1 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) lstat(&(0x7f0000000040)='./file0/file0\x00', &(0x7f0000000080)) ioctl$EXT4_IOC_MIGRATE(0xffffffffffffffff, 0x6609) sendmmsg$unix(0xffffffffffffffff, &(0x7f000000a000)=[{&(0x7f000000a000)=@abs, 0x6e, &(0x7f000000d000), 0x0, &(0x7f0000000600)=ANY=[]}], 0x1, 0x0) r2 = socket$inet6(0xa, 0x2, 0x0) gettid() r3 = getpgid(0x0) kcmp(0x0, r3, 0x0, 0xffffffffffffffff, 0xffffffffffffffff) connect$inet6(r2, &(0x7f0000002740)={0xa, 0x0, 0x0, @mcast2, 0x4}, 0x1c) sendmmsg(r2, &(0x7f0000007e00), 0x136a88c8311572c, 0xffffff8d) setsockopt$inet6_udp_int(r2, 0x11, 0x0, &(0x7f0000000400), 0x4) openat$kvm(0xffffffffffffff9c, &(0x7f00000003c0)='/dev/kvm\x00', 0x0, 0x0) ioctl$VHOST_SET_VRING_CALL(0xffffffffffffff9c, 0x4008af21, &(0x7f00000002c0)={0x0, r1}) ioctl$SNDRV_TIMER_IOCTL_TREAD(r0, 0x40045402, &(0x7f0000000740)) inotify_rm_watch(0xffffffffffffffff, 0x0) ioctl$ifreq_SIOCGIFINDEX_team(0xffffffffffffffff, 0x8933, &(0x7f0000000480)={'team0\x00'}) 04:46:25 executing program 3: r0 = syz_open_dev$sg(&(0x7f00000000c0)='/dev/sg#\x00', 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000000)={0x53, 0x0, 0x6, 0x0, @buffer={0x209, 0xb8, &(0x7f00000001c0)=""/184}, &(0x7f0000000540)="ad40657ed56c", &(0x7f0000000340)=""/128, 0xfeffffff00000000, 0x0, 0x0, &(0x7f0000000040)}) [ 638.980902] tmpfs: No value for mount option './file0' 04:46:25 executing program 0: mkdir(&(0x7f0000000200)='./file0\x00', 0x0) mount(&(0x7f00000002c0)=ANY=[], &(0x7f0000001540)='./file0\x00', &(0x7f0000000280)='tmpfs\x00', 0x0, &(0x7f0000000080)) r0 = open$dir(&(0x7f0000000180)='./file0\x00', 0x0, 0x0) mknodat(r0, &(0x7f0000000140)='./file0\x00', 0x0, 0x0) renameat2(r0, &(0x7f0000000080)='./file0\x00', r0, &(0x7f0000000100)='./file1\x00', 0x4) r1 = syz_open_pts(0xffffffffffffff9c, 0xe965cbfccdd2378) ioctl$KDSETLED(r1, 0x4b32, 0x7fffffff) [ 639.049684] binder: 23780:23783 unknown command 1057252101 [ 639.080777] binder: 23780:23783 ioctl c0306201 20012000 returned -22 04:46:25 executing program 3: r0 = syz_open_dev$sg(&(0x7f00000000c0)='/dev/sg#\x00', 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000000)={0x53, 0x0, 0x6, 0x0, @buffer={0x209, 0xb8, &(0x7f00000001c0)=""/184}, &(0x7f0000000540)="ad40657ed56c", &(0x7f0000000340)=""/128, 0x600000000000000, 0x0, 0x0, &(0x7f0000000040)}) [ 639.108669] binder: 23780:23783 IncRefs 0 refcount change on invalid ref 0 ret -22 04:46:25 executing program 4: ioctl$KVM_IRQ_LINE(0xffffffffffffffff, 0x4008ae61, &(0x7f0000000500)) r0 = syz_open_dev$dspn(&(0x7f00000004c0)='/dev/dsp#\x00', 0x1, 0x0) openat$audio(0xffffffffffffff9c, &(0x7f0000000000)='/dev/audio\x00', 0x80, 0x0) ioctl$KVM_SET_FPU(0xffffffffffffffff, 0x41a0ae8d, &(0x7f0000000100)={[], 0x0, 0x5531fee, 0x0, 0x0, 0x9, 0xf000, 0x0, [], 0x5}) syz_open_dev$usb(&(0x7f0000000440)='/dev/bus/usb/00#/00#\x00', 0x9, 0x2) r1 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) lstat(&(0x7f0000000040)='./file0/file0\x00', &(0x7f0000000080)) ioctl$EXT4_IOC_MIGRATE(0xffffffffffffffff, 0x6609) sendmmsg$unix(0xffffffffffffffff, &(0x7f000000a000)=[{&(0x7f000000a000)=@abs, 0x6e, &(0x7f000000d000), 0x0, &(0x7f0000000600)=ANY=[]}], 0x1, 0x0) r2 = socket$inet6(0xa, 0x2, 0x0) gettid() r3 = getpgid(0x0) kcmp(0x0, r3, 0x0, 0xffffffffffffffff, 0xffffffffffffffff) connect$inet6(r2, &(0x7f0000002740)={0xa, 0x0, 0x0, @mcast2, 0x4}, 0x1c) sendmmsg(r2, &(0x7f0000007e00), 0x136a88c8311572c, 0xffffffffa0008000) setsockopt$inet6_udp_int(r2, 0x11, 0x0, &(0x7f0000000400), 0x4) openat$kvm(0xffffffffffffff9c, &(0x7f00000003c0)='/dev/kvm\x00', 0x0, 0x0) ioctl$VHOST_SET_VRING_CALL(0xffffffffffffff9c, 0x4008af21, &(0x7f00000002c0)={0x0, r1}) ioctl$SNDRV_TIMER_IOCTL_TREAD(r0, 0x40045402, &(0x7f0000000740)) inotify_rm_watch(0xffffffffffffffff, 0x0) ioctl$ifreq_SIOCGIFINDEX_team(0xffffffffffffffff, 0x8933, &(0x7f0000000480)={'team0\x00'}) 04:46:25 executing program 3: r0 = syz_open_dev$sg(&(0x7f00000000c0)='/dev/sg#\x00', 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000000)={0x53, 0x0, 0x6, 0x0, @buffer={0x209, 0xb8, &(0x7f00000001c0)=""/184}, &(0x7f0000000540)="ad40657ed56c", &(0x7f0000000340)=""/128, 0xa0008000, 0x0, 0x0, &(0x7f0000000040)}) 04:46:25 executing program 1: r0 = perf_event_open(&(0x7f000025c000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = perf_event_open(&(0x7f000001d000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x11, r1, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r0, 0x2405, r1) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x1000004, 0x8031, 0xffffffffffffffff, 0x0) 04:46:25 executing program 5: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000480)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_GUEST_DEBUG(r3, 0x4048ae9b, &(0x7f0000000140)={0x1}) syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000100)=[@text32={0x20, &(0x7f0000000000)="6601669b0f35c4e1fe16846ba49e0000b9940200000f32c4c23dad78e0b9670900000f32660f38827f95b0040f01d10fc71a", 0x32}], 0x1, 0x0, &(0x7f0000000040), 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r3, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000400)=[@text32={0x20, &(0x7f0000000880)="b805000000b98b9400000f01c19a01000000b0000f43d1b8000000000f23d80f21f835800000900f23f80f060f2140b9800000c00f3235000800000f3066ba4300b8f1ffffffefb9800000c00f3235002000000f30c4c3295f4da400", 0x5c}], 0x26433e1, 0x0, &(0x7f0000000300), 0x10000000000000b6) ioctl$KVM_RUN(r3, 0xae80, 0x200000000000000) [ 639.233373] tmpfs: No value for mount option './file0' 04:46:26 executing program 3: r0 = syz_open_dev$sg(&(0x7f00000000c0)='/dev/sg#\x00', 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000000)={0x53, 0x0, 0x6, 0x0, @buffer={0x209, 0xb8, &(0x7f00000001c0)=""/184}, &(0x7f0000000540)="ad40657ed56c", &(0x7f0000000340)=""/128, 0xfeffffff, 0x0, 0x0, &(0x7f0000000040)}) 04:46:26 executing program 0: mkdir(&(0x7f0000000200)='./file0\x00', 0x0) mount(&(0x7f00000002c0)=ANY=[], &(0x7f0000001540)='./file0\x00', &(0x7f0000000280)='tmpfs\x00', 0x0, &(0x7f0000000080)) r0 = open$dir(&(0x7f0000000180)='./file0\x00', 0x0, 0x0) mknodat(r0, &(0x7f0000000140)='./file0\x00', 0x0, 0x0) renameat2(r0, &(0x7f0000000080)='./file0\x00', r0, &(0x7f0000000100)='./file1\x00', 0x4) r1 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ppp\x00', 0x20000, 0x0) bpf$OBJ_PIN_PROG(0x6, &(0x7f00000000c0)={&(0x7f0000000000)='./file0\x00', r1}, 0x10) name_to_handle_at(r1, &(0x7f00000001c0)='./file0/file0\x00', &(0x7f0000000300)=ANY=[@ANYBLOB="7fb035b44f8b40d83ad683fe4108e34ad44bad5853dcd8aea0d02a573803f969e3ec83843fca60f9a82be8f40aa52fe2922d490c15018eed5d3bb8f0024244d68ea3f24ea7d7ba1c45270830900e146458a891a6a8592dad1e54623689a6b1fc2f536f927162032661e1d1997ddb8ff83b6df00a553dc5846267e2aa262800000000"], &(0x7f00000002c0), 0x400) 04:46:26 executing program 4: ioctl$KVM_IRQ_LINE(0xffffffffffffffff, 0x4008ae61, &(0x7f0000000500)) r0 = syz_open_dev$dspn(&(0x7f00000004c0)='/dev/dsp#\x00', 0x1, 0x0) openat$audio(0xffffffffffffff9c, &(0x7f0000000000)='/dev/audio\x00', 0x80, 0x0) ioctl$KVM_SET_FPU(0xffffffffffffffff, 0x41a0ae8d, &(0x7f0000000100)={[], 0x0, 0x5531fee, 0x0, 0x0, 0x9, 0xf000, 0x0, [], 0x5}) syz_open_dev$usb(&(0x7f0000000440)='/dev/bus/usb/00#/00#\x00', 0x9, 0x2) r1 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) lstat(&(0x7f0000000040)='./file0/file0\x00', &(0x7f0000000080)) ioctl$EXT4_IOC_MIGRATE(0xffffffffffffffff, 0x6609) sendmmsg$unix(0xffffffffffffffff, &(0x7f000000a000)=[{&(0x7f000000a000)=@abs, 0x6e, &(0x7f000000d000), 0x0, &(0x7f0000000600)=ANY=[]}], 0x1, 0x0) r2 = socket$inet6(0xa, 0x2, 0x0) gettid() r3 = getpgid(0x0) kcmp(0x0, r3, 0x0, 0xffffffffffffffff, 0xffffffffffffffff) connect$inet6(r2, &(0x7f0000002740)={0xa, 0x0, 0x0, @mcast2, 0x4}, 0x1c) sendmmsg(r2, &(0x7f0000007e00), 0x136a88c8311572c, 0x40030000000000) setsockopt$inet6_udp_int(r2, 0x11, 0x0, &(0x7f0000000400), 0x4) openat$kvm(0xffffffffffffff9c, &(0x7f00000003c0)='/dev/kvm\x00', 0x0, 0x0) ioctl$VHOST_SET_VRING_CALL(0xffffffffffffff9c, 0x4008af21, &(0x7f00000002c0)={0x0, r1}) ioctl$SNDRV_TIMER_IOCTL_TREAD(r0, 0x40045402, &(0x7f0000000740)) inotify_rm_watch(0xffffffffffffffff, 0x0) ioctl$ifreq_SIOCGIFINDEX_team(0xffffffffffffffff, 0x8933, &(0x7f0000000480)={'team0\x00'}) 04:46:26 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, &(0x7f0000012fc7)}) r2 = syz_open_dev$sndpcmc(&(0x7f0000000000)='/dev/snd/pcmC#D#c\x00', 0x9, 0x80) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffff9c, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x1, &(0x7f0000000040)={0xffffffffffffffff}}}, 0x20) write$RDMA_USER_CM_CMD_CONNECT(r2, &(0x7f0000000280)={0x6, 0x118, 0xfa00, {{0x1f, 0x7, "3677bcb1a383ba9911ea8351a37abb249eae46f041b3b09db113e5e8d5c2897a31742234088d4983ae6ff6b801d296bfe8d3568aac3306a11011164df8e609bbf739daf308d952e1d1473c7aa3cbdf3f1b108f37f264875752f242a8b4c6463fa86273e9ae0d90524236a901fd2a4ad8fbe777523d9e0e980249cedd4527d63694d3485b53e84686f0047fe465d552e7081c0510ed963206d06c8e08ec3f9634e7eec2462ffe4bfb2eb331c7b89e0aa047957abe7d4249a2e93d31af61d7062891416d926c75c7fd3ef5aeb7ac846bc72fac52f145e5c469bc4633a869c7f38ebb50fb26f78623d15b8db686a04b1f949e0117a0a9882599b88bacca3b82a7c6", 0xe5, 0xeb38, 0x8, 0x1a6e, 0xfffffffffffffffd, 0x2, 0x0, 0x1}, r3}}, 0x120) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, &(0x7f0000000f4d)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x4c, 0x0, &(0x7f0000000200)=[@transaction_sg={0x40486311, {{0x3, 0x0, 0x1, 0x0, 0x11, 0x0, 0x0, 0x0, 0x50, &(0x7f0000000140), &(0x7f0000000180)=[0x30, 0x0, 0x38, 0x48, 0x58, 0x70, 0x30, 0x38, 0x48, 0x48]}, 0x7}}], 0x0, 0x0, &(0x7f00000000c0)}) 04:46:26 executing program 5: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000480)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_GUEST_DEBUG(r3, 0x4048ae9b, &(0x7f0000000140)={0x1}) syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000100)=[@text32={0x20, &(0x7f0000000000)="6601669b0f35c4e1fe16846ba49e0000b9940200000f32c4c23dad78e0b9670900000f32660f38827f95b0040f01d10fc71a", 0x32}], 0x1, 0x0, &(0x7f0000000040), 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r3, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000400)=[@text32={0x20, &(0x7f0000000880)="b805000000b98b9400000f01c19a01000000b0000f43d1b8000000000f23d80f21f835800000900f23f80f060f2140b9800000c00f3235000800000f3066ba4300b8f1ffffffefb9800000c00f3235002000000f30c4c3295f4da400", 0x5c}], 0x26433e1, 0x0, &(0x7f0000000300), 0x10000000000000b6) ioctl$KVM_RUN(r3, 0xae80, 0x4000000000000) 04:46:26 executing program 1: r0 = perf_event_open(&(0x7f000025c000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x11, r1, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r0, 0x2405, r1) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x1000004, 0x8031, 0xffffffffffffffff, 0x0) [ 639.804154] binder: 23780:23789 unknown command 1057252101 [ 639.805013] binder: 23780:23821 IncRefs 0 refcount change on invalid ref 0 ret -22 [ 639.809953] binder: 23780:23789 ioctl c0306201 20012000 returned -22 [ 639.903726] tmpfs: No value for mount option './file0' 04:46:26 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, &(0x7f0000012fc7)}) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f0000000140)=ANY=[@ANYBLOB="0e630c40000000d786159cdf16b62f7cc30431fd5a9fe3ef6909b5caae2ca5ebca99e03e7c817ae4773676a1a5bc649bbd46dc71599e27579eab37ddf3069548548b0e120be5e99b48186b090b46102c6422785b8198b89ad223e4d815b181f2616918ec3f234035f7c9a99263f46d29fea2f5bd125407dbd3030000000000000033912ad45e508522e09ebbd59bed227d7edc2383eddc90fa6500fc8475a78e5e73ba3f86f18920354281c40573547cf27924877936c9f01480"], 0x0, 0x0, &(0x7f0000000f4d)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000100)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0xfffffffffffffc2b, 0x0, &(0x7f0000000680)}) 04:46:26 executing program 0: mkdir(&(0x7f0000000200)='./file0\x00', 0x0) mount(&(0x7f00000002c0)=ANY=[], &(0x7f0000001540)='./file0\x00', &(0x7f0000000280)='tmpfs\x00', 0x0, &(0x7f0000000080)) r0 = open$dir(&(0x7f0000000180)='./file0\x00', 0x0, 0x0) r1 = creat(&(0x7f0000000000)='./file1\x00', 0x24) getsockopt$inet_sctp6_SCTP_PR_SUPPORTED(r1, 0x84, 0x71, &(0x7f00000001c0)={0x0, 0x1000}, &(0x7f0000000240)=0x8) getsockopt$inet_sctp_SCTP_GET_ASSOC_STATS(0xffffffffffffff9c, 0x84, 0x70, &(0x7f00000002c0)={r2, @in6={{0xa, 0x4e22, 0x8, @remote, 0x10000}}, [0x1ff, 0xdd21, 0xffff, 0x9, 0x2, 0xffffffffffff0000, 0x0, 0x8, 0x7, 0x7a, 0x2, 0x7, 0x9, 0x40, 0x9]}, &(0x7f0000000040)=0x100) setsockopt$inet_sctp6_SCTP_RECONFIG_SUPPORTED(r1, 0x84, 0x75, &(0x7f00000000c0)={r3, 0xb6ac}, 0x8) openat$loop_ctrl(0xffffffffffffff9c, &(0x7f00000003c0)='/dev/loop-control\x00', 0x8000, 0x0) mknodat(r0, &(0x7f0000000140)='./file0\x00', 0x0, 0x0) renameat2(r0, &(0x7f0000000080)='./file0\x00', r0, &(0x7f0000000100)='./file1\x00', 0x4) 04:46:26 executing program 3: r0 = syz_open_dev$sg(&(0x7f00000000c0)='/dev/sg#\x00', 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000000)={0x53, 0x0, 0x6, 0x0, @buffer={0x209, 0xb8, &(0x7f00000001c0)=""/184}, &(0x7f0000000540)="ad40657ed56c", &(0x7f0000000340)=""/128, 0x4000000, 0x0, 0x0, &(0x7f0000000040)}) [ 640.065713] binder: 23843:23848 BC_REQUEST_DEATH_NOTIFICATION invalid ref -687865856 [ 640.137705] tmpfs: No value for mount option './file0' 04:46:26 executing program 3: r0 = syz_open_dev$sg(&(0x7f00000000c0)='/dev/sg#\x00', 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000000)={0x53, 0x0, 0x6, 0x0, @buffer={0x209, 0xb8, &(0x7f00000001c0)=""/184}, &(0x7f0000000540)="ad40657ed56c", &(0x7f0000000340)=""/128, 0x2f00, 0x0, 0x0, &(0x7f0000000040)}) 04:46:26 executing program 0: mkdir(&(0x7f0000000200)='./file0\x00', 0x0) r0 = dup(0xffffffffffffffff) r1 = syz_open_dev$audion(&(0x7f0000000000)='/dev/audio#\x00', 0x9, 0x8000) r2 = openat$rfkill(0xffffffffffffff9c, &(0x7f0000000040)='/dev/rfkill\x00', 0x44000, 0x0) ioctl$sock_kcm_SIOCKCMATTACH(r0, 0x89e0, &(0x7f00000000c0)={r1, r2}) mount(&(0x7f0000000900)=ANY=[], &(0x7f0000001540)='./file0\x00', &(0x7f0000000280)='tmpfs\x00', 0x42, &(0x7f00000008c0)=':cgroupposix_acl_accesscgroup\x00') r3 = open$dir(&(0x7f0000000180)='./file0\x00', 0x0, 0x0) mknodat(r3, &(0x7f0000000140)='./file0\x00', 0x0, 0x0) r4 = getgid() getsockopt$inet6_IPV6_IPSEC_POLICY(r2, 0x29, 0x22, &(0x7f0000000600)={{{@in6=@dev, @in6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@remote}, 0x0, @in=@loopback}}, &(0x7f0000000700)=0xe8) syz_mount_image$hfs(&(0x7f00000001c0)='hfs\x00', &(0x7f0000000240)='./file0\x00', 0x4, 0x4, &(0x7f0000000580)=[{&(0x7f00000002c0)="3daa94911a2a6e56cb348397616b1ef309acb76b2c4c8e49aff72feed95a1cd57c1f93c02552f47b68ffc77aa10a818be92ce817606087ef6b669ee01b0dfced6203c9dc29e580fa9c25b4ad62f46b4b1127d153cefafbd7a3a032b16106c45c4ee8beebae3ce512aed77c35e9a5d72f31b44bedff9de255d6a601e95463a33ada7619f1cfaaa2f3935f282f6032f009e683f58ed5c0473e26aeef23afd18e91edb4db38d942f9ab3ecfd4a1c57a8ccb4de326dd23ada283bd6124239d34f6882149a0285d99a641f8157a691098", 0xce, 0x8}, {&(0x7f00000003c0)="14e652e35c4828370f1dfdbd2b25057a5e407c525d6c6f696fc63491a24b05375125c8ba0e480296a6e028d30102cf86a44603d77ca51b6ef01d9be33e3981ef56e35f580d795a26055e6c9be166d4b05355bedabe0b944782ebc37ed517af619380a29abc61fe0448bb7eba3d9b7b88c363ae504d37385ef79cf429d0f4d43266ab045c04085fd38b7f698ebcbc3d39fc5a5d3c8ab41433d70a1a5085d319095490b4f101334ac6da4e135724438b91111dc510d2f14b008eea49f530a1", 0xbe, 0x909}, {&(0x7f0000000480)="9e6049d627abf340deed6e677ed7354b955195b23f0aa1fa43c1358639502fd222e7b8", 0x23, 0x94}, {&(0x7f00000004c0)="dccab1c5299a7aac39ccd3f06a3697ce19c2936c79114eb6fc59c3624b3f58d7ef6b9756d0996d62d14b62549d6421042f3275e6f200e391f734676ba278cc768f225aa0a0839ad77dae66c178101aa506b6ba9e72a8ac87f5b1a00fee5c68f9e0735e1febbf9028bc6e4190eddcd7105ec1348ce55b758f991d58472ec068eed7f30d350133c775e4935c2f95de264baa30f90cecc5d99fbd610fffa0bc7639e09c6acaf27f88164628e88ac8460a556c788e6f50ad863ae345f96cfed0f9", 0xbf, 0x6}], 0x900b, &(0x7f0000000740)={[{@file_umask={'file_umask', 0x3d, 0x2}}, {@type={'type', 0x3d, "3ed33884"}}, {@gid={'gid', 0x3d, r4}}, {@uid={'uid', 0x3d, r5}}], [{@fsname={'fsname', 0x3d, 'tmpfs\x00'}}, {@obj_user={'obj_user', 0x3d, 'nodev-*wlan0ð1'}}, {@smackfstransmute={'smackfstransmute', 0x3d, "5dab"}}, {@dont_measure='dont_measure'}]}) renameat2(r3, &(0x7f0000000080)='./file0\x00', r3, &(0x7f0000000100)='./file1\x00', 0x4) 04:46:26 executing program 5: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000480)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_GUEST_DEBUG(r3, 0x4048ae9b, &(0x7f0000000140)={0x1}) syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000100)=[@text32={0x20, &(0x7f0000000000)="6601669b0f35c4e1fe16846ba49e0000b9940200000f32c4c23dad78e0b9670900000f32660f38827f95b0040f01d10fc71a", 0x32}], 0x1, 0x0, &(0x7f0000000040), 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r3, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000400)=[@text32={0x20, &(0x7f0000000880)="b805000000b98b9400000f01c19a01000000b0000f43d1b8000000000f23d80f21f835800000900f23f80f060f2140b9800000c00f3235000800000f3066ba4300b8f1ffffffefb9800000c00f3235002000000f30c4c3295f4da400", 0x5c}], 0x26433e1, 0x0, &(0x7f0000000300), 0x10000000000000b6) ioctl$KVM_RUN(r3, 0xae80, 0x174075bb7f0000) [ 640.197704] binder: 23843:23848 BC_REQUEST_DEATH_NOTIFICATION invalid ref -687865856 04:46:26 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, &(0x7f0000012fc7)}) close(r0) r2 = syz_open_dev$mice(&(0x7f0000000000)='/dev/input/mice\x00', 0x0, 0x0) setsockopt$inet_buf(r2, 0x0, 0x2e, &(0x7f0000000140)="a40ace25ea880eab9cf606874847fc43d4882602793abdeaf42abfac54fd403aec264e42c63f63d1504066472944030f3fb60292213f0d4f80a17c889ea070b5201c3ebc14470acbfe93e62d2ea377522483919c661e8ca4c968b0c184d6da0f50408e65021be537ca6d8f54e5add725504874b2b04ee62010edc5658d8cdcf8c09ac4dc019a4cb47e782e72ab8f8e3e4525e51a47fab0629fde1c70e8951d10f863a27609f81cd8b0c462cf6987b5f1a3ddb8f2326b150e2953596b99e6a597316b6469d48e72063bb5a4bbe8ede08b654d09ce3b6fbb6d296273fb9f765866ac1922", 0xe3) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, &(0x7f0000000f4d)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000100)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0xfffffffffffffc2b, 0x0, &(0x7f0000000680)}) 04:46:26 executing program 3: r0 = syz_open_dev$sg(&(0x7f00000000c0)='/dev/sg#\x00', 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000000)={0x53, 0x0, 0x6, 0x0, @buffer={0x209, 0xb8, &(0x7f00000001c0)=""/184}, &(0x7f0000000540)="ad40657ed56c", &(0x7f0000000340)=""/128, 0xfffffffc, 0x0, 0x0, &(0x7f0000000040)}) [ 640.398356] tmpfs: No value for mount option ':cgroupposix_acl_accesscgroup' [ 640.524386] tmpfs: No value for mount option ':cgroupposix_acl_accesscgroup' 04:46:26 executing program 4: ioctl$KVM_IRQ_LINE(0xffffffffffffffff, 0x4008ae61, &(0x7f0000000500)) r0 = syz_open_dev$dspn(&(0x7f00000004c0)='/dev/dsp#\x00', 0x1, 0x0) openat$audio(0xffffffffffffff9c, &(0x7f0000000000)='/dev/audio\x00', 0x80, 0x0) ioctl$KVM_SET_FPU(0xffffffffffffffff, 0x41a0ae8d, &(0x7f0000000100)={[], 0x0, 0x5531fee, 0x0, 0x0, 0x9, 0xf000, 0x0, [], 0x5}) syz_open_dev$usb(&(0x7f0000000440)='/dev/bus/usb/00#/00#\x00', 0x9, 0x2) r1 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) lstat(&(0x7f0000000040)='./file0/file0\x00', &(0x7f0000000080)) ioctl$EXT4_IOC_MIGRATE(0xffffffffffffffff, 0x6609) sendmmsg$unix(0xffffffffffffffff, &(0x7f000000a000)=[{&(0x7f000000a000)=@abs, 0x6e, &(0x7f000000d000), 0x0, &(0x7f0000000600)=ANY=[]}], 0x1, 0x0) r2 = socket$inet6(0xa, 0x2, 0x0) gettid() r3 = getpgid(0x0) kcmp(0x0, r3, 0x0, 0xffffffffffffffff, 0xffffffffffffffff) connect$inet6(r2, &(0x7f0000002740)={0xa, 0x0, 0x0, @mcast2, 0x4}, 0x1c) sendmmsg(r2, &(0x7f0000007e00), 0x136a88c8311572c, 0xe803000000000000) setsockopt$inet6_udp_int(r2, 0x11, 0x0, &(0x7f0000000400), 0x4) openat$kvm(0xffffffffffffff9c, &(0x7f00000003c0)='/dev/kvm\x00', 0x0, 0x0) ioctl$VHOST_SET_VRING_CALL(0xffffffffffffff9c, 0x4008af21, &(0x7f00000002c0)={0x0, r1}) ioctl$SNDRV_TIMER_IOCTL_TREAD(r0, 0x40045402, &(0x7f0000000740)) inotify_rm_watch(0xffffffffffffffff, 0x0) ioctl$ifreq_SIOCGIFINDEX_team(0xffffffffffffffff, 0x8933, &(0x7f0000000480)={'team0\x00'}) 04:46:26 executing program 5: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000480)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_GUEST_DEBUG(r3, 0x4048ae9b, &(0x7f0000000140)={0x1}) syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000100)=[@text32={0x20, &(0x7f0000000000)="6601669b0f35c4e1fe16846ba49e0000b9940200000f32c4c23dad78e0b9670900000f32660f38827f95b0040f01d10fc71a", 0x32}], 0x1, 0x0, &(0x7f0000000040), 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r3, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000400)=[@text32={0x20, &(0x7f0000000880)="b805000000b98b9400000f01c19a01000000b0000f43d1b8000000000f23d80f21f835800000900f23f80f060f2140b9800000c00f3235000800000f3066ba4300b8f1ffffffefb9800000c00f3235002000000f30c4c3295f4da400", 0x5c}], 0x26433e1, 0x0, &(0x7f0000000300), 0x10000000000000b6) ioctl$KVM_RUN(r3, 0xae80, 0x700000000000000) 04:46:26 executing program 3: r0 = syz_open_dev$sg(&(0x7f00000000c0)='/dev/sg#\x00', 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000000)={0x53, 0x0, 0x6, 0x0, @buffer={0x209, 0xb8, &(0x7f00000001c0)=""/184}, &(0x7f0000000540)="ad40657ed56c", &(0x7f0000000340)=""/128, 0x209, 0x0, 0x0, &(0x7f0000000040)}) 04:46:27 executing program 1: r0 = perf_event_open(&(0x7f000025c000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x10, r1, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r0, 0x2405, r1) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x1000004, 0x8031, 0xffffffffffffffff, 0x0) 04:46:27 executing program 3: r0 = syz_open_dev$sg(&(0x7f00000000c0)='/dev/sg#\x00', 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000000)={0x53, 0x0, 0x6, 0x0, @buffer={0x209, 0xb8, &(0x7f00000001c0)=""/184}, &(0x7f0000000540)="ad40657ed56c", &(0x7f0000000340)=""/128, 0x4, 0x0, 0x0, &(0x7f0000000040)}) 04:46:27 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0x0, 0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, &(0x7f0000012fc7)}) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, &(0x7f0000000f4d)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000100)={0x4, 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB="f9630000"], 0xfffffffffffffc2b, 0x0, &(0x7f0000000680)}) 04:46:27 executing program 0: mkdir(&(0x7f0000000200)='./file0\x00', 0x0) mount(&(0x7f00000002c0)=ANY=[], &(0x7f0000001540)='./file0\x00', &(0x7f0000000280)='tmpfs\x00', 0x0, &(0x7f0000000080)) r0 = open$dir(&(0x7f0000000180)='./file0\x00', 0x0, 0x0) mknodat(r0, &(0x7f0000000140)='./file0\x00', 0x0, 0x0) renameat2(r0, &(0x7f0000000080)='./file0\x00', r0, &(0x7f0000000100)='./file1\x00', 0x4) r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000000)='/dev/hwrng\x00', 0x200000, 0x0) ioctl$UI_SET_KEYBIT(r1, 0x40045565, 0x11a) 04:46:27 executing program 5: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000480)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_GUEST_DEBUG(r3, 0x4048ae9b, &(0x7f0000000140)={0x1}) syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000100)=[@text32={0x20, &(0x7f0000000000)="6601669b0f35c4e1fe16846ba49e0000b9940200000f32c4c23dad78e0b9670900000f32660f38827f95b0040f01d10fc71a", 0x32}], 0x1, 0x0, &(0x7f0000000040), 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r3, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000400)=[@text32={0x20, &(0x7f0000000880)="b805000000b98b9400000f01c19a01000000b0000f43d1b8000000000f23d80f21f835800000900f23f80f060f2140b9800000c00f3235000800000f3066ba4300b8f1ffffffefb9800000c00f3235002000000f30c4c3295f4da400", 0x5c}], 0x26433e1, 0x0, &(0x7f0000000300), 0x10000000000000b6) ioctl$KVM_RUN(r3, 0xae80, 0xffffffffffffffff) 04:46:27 executing program 3: r0 = syz_open_dev$sg(&(0x7f00000000c0)='/dev/sg#\x00', 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000000)={0x53, 0x0, 0x6, 0x0, @buffer={0x209, 0xb8, &(0x7f00000001c0)=""/184}, &(0x7f0000000540)="ad40657ed56c", &(0x7f0000000340)=""/128, 0x0, 0x2, 0x0, &(0x7f0000000040)}) [ 641.060929] tmpfs: No value for mount option './file0' 04:46:27 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$mouse(&(0x7f0000000000)='/dev/input/mouse#\x00', 0x8001, 0x4000) clock_gettime(0x0, &(0x7f0000000140)={0x0, 0x0}) ppoll(&(0x7f00000000c0)=[{r0, 0x40}, {r1, 0x4000}, {r0, 0x4}, {r0, 0x4}], 0x4, &(0x7f0000000180)={r2, r3+10000000}, &(0x7f00000001c0)={0x100000001}, 0x8) setsockopt$packet_tx_ring(r1, 0x107, 0xd, &(0x7f0000000040)=@req={0xba, 0x81, 0x1000, 0x3}, 0x10) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) fcntl$getownex(r0, 0x10, &(0x7f0000000200)={0x0, 0x0}) ioctl$TIOCSPGRP(r1, 0x5410, &(0x7f0000000240)=r4) r5 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, &(0x7f0000012fc7)}) close(r0) ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, &(0x7f0000000f4d)}) ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f0000000100)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0xfffffffffffffc2b, 0x0, &(0x7f0000000680)}) 04:46:27 executing program 0: mkdir(&(0x7f0000000040)='./file0\x00', 0x0) mount(&(0x7f00000002c0)=ANY=[], &(0x7f0000001540)='./file0\x00', &(0x7f0000000280)='tmpfs\x00', 0x0, &(0x7f0000000080)) r0 = socket$inet(0x2, 0x5, 0x200) bind$inet(r0, &(0x7f0000000380)={0x2, 0x4e21, @loopback}, 0x10) r1 = open$dir(&(0x7f0000000180)='./file0\x00', 0x0, 0x0) mknodat(r1, &(0x7f0000000140)='./file0\x00', 0x0, 0x0) renameat2(r1, &(0x7f0000000080)='./file0\x00', r1, &(0x7f0000000100)='./file1\x00', 0x4) r2 = openat$vcs(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/vcs\x00', 0x20000, 0x0) getsockopt$inet_sctp6_SCTP_STATUS(0xffffffffffffff9c, 0x84, 0xe, &(0x7f00000001c0)={0x0, 0xff, 0xffffffffffffffe0, 0x11, 0x6, 0x7, 0x4, 0x2, {0x0, @in={{0x2, 0x4e24, @multicast2}}, 0x0, 0x4, 0x1, 0x8, 0x3f}}, &(0x7f00000002c0)=0xb0) getsockopt$inet_sctp6_SCTP_DELAYED_SACK(r2, 0x84, 0x10, &(0x7f0000000300)=@assoc_value={r3, 0xff}, &(0x7f0000000340)=0x8) r4 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000480)='/dev/mixer\x00', 0x505006, 0x0) shutdown(r4, 0x1) futimesat(r1, &(0x7f00000003c0)='./file0\x00', &(0x7f0000000400)) 04:46:27 executing program 3: r0 = syz_open_dev$sg(&(0x7f00000000c0)='/dev/sg#\x00', 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000000)={0x53, 0x0, 0x6, 0x0, @buffer={0x209, 0xb8, &(0x7f00000001c0)=""/184}, &(0x7f0000000540)="ad40657ed56c", &(0x7f0000000340)=""/128, 0x0, 0x200000000000000, 0x0, &(0x7f0000000040)}) 04:46:27 executing program 4: ioctl$KVM_IRQ_LINE(0xffffffffffffffff, 0x4008ae61, &(0x7f0000000500)) r0 = syz_open_dev$dspn(&(0x7f00000004c0)='/dev/dsp#\x00', 0x1, 0x0) openat$audio(0xffffffffffffff9c, &(0x7f0000000000)='/dev/audio\x00', 0x80, 0x0) ioctl$KVM_SET_FPU(0xffffffffffffffff, 0x41a0ae8d, &(0x7f0000000100)={[], 0x0, 0x5531fee, 0x0, 0x0, 0x9, 0xf000, 0x0, [], 0x5}) syz_open_dev$usb(&(0x7f0000000440)='/dev/bus/usb/00#/00#\x00', 0x9, 0x2) r1 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) lstat(&(0x7f0000000040)='./file0/file0\x00', &(0x7f0000000080)) ioctl$EXT4_IOC_MIGRATE(0xffffffffffffffff, 0x6609) sendmmsg$unix(0xffffffffffffffff, &(0x7f000000a000)=[{&(0x7f000000a000)=@abs, 0x6e, &(0x7f000000d000), 0x0, &(0x7f0000000600)=ANY=[]}], 0x1, 0x0) r2 = socket$inet6(0xa, 0x2, 0x0) gettid() r3 = getpgid(0x0) kcmp(0x0, r3, 0x0, 0xffffffffffffffff, 0xffffffffffffffff) connect$inet6(r2, &(0x7f0000002740)={0xa, 0x0, 0x0, @mcast2, 0x4}, 0x1c) sendmmsg(r2, &(0x7f0000007e00), 0x136a88c8311572c, 0x1000000) setsockopt$inet6_udp_int(r2, 0x11, 0x0, &(0x7f0000000400), 0x4) openat$kvm(0xffffffffffffff9c, &(0x7f00000003c0)='/dev/kvm\x00', 0x0, 0x0) ioctl$VHOST_SET_VRING_CALL(0xffffffffffffff9c, 0x4008af21, &(0x7f00000002c0)={0x0, r1}) ioctl$SNDRV_TIMER_IOCTL_TREAD(r0, 0x40045402, &(0x7f0000000740)) inotify_rm_watch(0xffffffffffffffff, 0x0) ioctl$ifreq_SIOCGIFINDEX_team(0xffffffffffffffff, 0x8933, &(0x7f0000000480)={'team0\x00'}) 04:46:27 executing program 5: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000480)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_GUEST_DEBUG(r3, 0x4048ae9b, &(0x7f0000000140)={0x1}) syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000100)=[@text32={0x20, &(0x7f0000000000)="6601669b0f35c4e1fe16846ba49e0000b9940200000f32c4c23dad78e0b9670900000f32660f38827f95b0040f01d10fc71a", 0x32}], 0x1, 0x0, &(0x7f0000000040), 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r3, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000400)=[@text32={0x20, &(0x7f0000000880)="b805000000b98b9400000f01c19a01000000b0000f43d1b8000000000f23d80f21f835800000900f23f80f060f2140b9800000c00f3235000800000f3066ba4300b8f1ffffffefb9800000c00f3235002000000f30c4c3295f4da400", 0x5c}], 0x26433e1, 0x0, &(0x7f0000000300), 0x10000000000000b6) ioctl$KVM_RUN(r3, 0xae80, 0x60) [ 641.320481] tmpfs: No value for mount option './file0' 04:46:27 executing program 3: r0 = syz_open_dev$sg(&(0x7f00000000c0)='/dev/sg#\x00', 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000000)={0x53, 0x0, 0x6, 0x0, @buffer={0x209, 0xb8, &(0x7f00000001c0)=""/184}, &(0x7f0000000540)="ad40657ed56c", &(0x7f0000000340)=""/128, 0x0, 0xb8000000, 0x0, &(0x7f0000000040)}) 04:46:27 executing program 1: r0 = perf_event_open(&(0x7f000025c000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x10, r1, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r0, 0x2405, r1) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x1000004, 0x8031, 0xffffffffffffffff, 0x0) 04:46:27 executing program 0: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount(&(0x7f00000002c0)=ANY=[], &(0x7f0000001540)='./file0\x00', &(0x7f0000000280)='tmpfs\x00', 0x0, &(0x7f0000000080)) r0 = open$dir(&(0x7f0000000180)='./file0\x00', 0x0, 0x0) mknodat(r0, &(0x7f0000000140)='./file0\x00', 0x0, 0x0) renameat2(r0, &(0x7f0000000080)='./file0\x00', r0, &(0x7f0000000100)='./file1\x00', 0x4) 04:46:27 executing program 3: r0 = syz_open_dev$sg(&(0x7f00000000c0)='/dev/sg#\x00', 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000000)={0x53, 0x0, 0x6, 0x0, @buffer={0x209, 0xb8, &(0x7f00000001c0)=""/184}, &(0x7f0000000540)="ad40657ed56c", &(0x7f0000000340)=""/128, 0x0, 0x1000000, 0x0, &(0x7f0000000040)}) 04:46:27 executing program 5: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000480)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_GUEST_DEBUG(r3, 0x4048ae9b, &(0x7f0000000140)={0x1}) syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000100)=[@text32={0x20, &(0x7f0000000000)="6601669b0f35c4e1fe16846ba49e0000b9940200000f32c4c23dad78e0b9670900000f32660f38827f95b0040f01d10fc71a", 0x32}], 0x1, 0x0, &(0x7f0000000040), 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r3, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000400)=[@text32={0x20, &(0x7f0000000880)="b805000000b98b9400000f01c19a01000000b0000f43d1b8000000000f23d80f21f835800000900f23f80f060f2140b9800000c00f3235000800000f3066ba4300b8f1ffffffefb9800000c00f3235002000000f30c4c3295f4da400", 0x5c}], 0x26433e1, 0x0, &(0x7f0000000300), 0x10000000000000b6) ioctl$KVM_RUN(r3, 0xae80, 0xf00) 04:46:28 executing program 3: r0 = syz_open_dev$sg(&(0x7f00000000c0)='/dev/sg#\x00', 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000000)={0x53, 0x0, 0x6, 0x0, @buffer={0x209, 0xb8, &(0x7f00000001c0)=""/184}, &(0x7f0000000540)="ad40657ed56c", &(0x7f0000000340)=""/128, 0x0, 0x2f00, 0x0, &(0x7f0000000040)}) [ 641.825180] tmpfs: No value for mount option './file0' 04:46:28 executing program 4: ioctl$KVM_IRQ_LINE(0xffffffffffffffff, 0x4008ae61, &(0x7f0000000500)) r0 = syz_open_dev$dspn(&(0x7f00000004c0)='/dev/dsp#\x00', 0x1, 0x0) openat$audio(0xffffffffffffff9c, &(0x7f0000000000)='/dev/audio\x00', 0x80, 0x0) ioctl$KVM_SET_FPU(0xffffffffffffffff, 0x41a0ae8d, &(0x7f0000000100)={[], 0x0, 0x5531fee, 0x0, 0x0, 0x9, 0xf000, 0x0, [], 0x5}) syz_open_dev$usb(&(0x7f0000000440)='/dev/bus/usb/00#/00#\x00', 0x9, 0x2) r1 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) lstat(&(0x7f0000000040)='./file0/file0\x00', &(0x7f0000000080)) ioctl$EXT4_IOC_MIGRATE(0xffffffffffffffff, 0x6609) sendmmsg$unix(0xffffffffffffffff, &(0x7f000000a000)=[{&(0x7f000000a000)=@abs, 0x6e, &(0x7f000000d000), 0x0, &(0x7f0000000600)=ANY=[]}], 0x1, 0x0) r2 = socket$inet6(0xa, 0x2, 0x0) gettid() r3 = getpgid(0x0) kcmp(0x0, r3, 0x0, 0xffffffffffffffff, 0xffffffffffffffff) connect$inet6(r2, &(0x7f0000002740)={0xa, 0x0, 0x0, @mcast2, 0x4}, 0x1c) sendmmsg(r2, &(0x7f0000007e00), 0x136a88c8311572c, 0x11) setsockopt$inet6_udp_int(r2, 0x11, 0x0, &(0x7f0000000400), 0x4) openat$kvm(0xffffffffffffff9c, &(0x7f00000003c0)='/dev/kvm\x00', 0x0, 0x0) ioctl$VHOST_SET_VRING_CALL(0xffffffffffffff9c, 0x4008af21, &(0x7f00000002c0)={0x0, r1}) ioctl$SNDRV_TIMER_IOCTL_TREAD(r0, 0x40045402, &(0x7f0000000740)) inotify_rm_watch(0xffffffffffffffff, 0x0) ioctl$ifreq_SIOCGIFINDEX_team(0xffffffffffffffff, 0x8933, &(0x7f0000000480)={'team0\x00'}) [ 641.979105] binder: BINDER_SET_CONTEXT_MGR already set [ 641.981715] binder: 23914:23965 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 642.011537] binder: 23914:23963 ioctl 40046207 0 returned -16 04:46:28 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) madvise(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0xd) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, &(0x7f0000012fc7)}) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="175c0c40009c00008f13b932c7c2598315312cb5eed01867f429fb8c015774e52208014a15fa64ee2a66658372b582eee1b88a0742c6e18f779740cb6dc321c8306cdbaf98e255c6561374cb24afe14c3732804b6897f89b8451a8f8ba"], 0x0, 0x0, &(0x7f0000000f4d)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000100)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0xfffffffffffffc2b, 0x0, &(0x7f0000000680)}) 04:46:28 executing program 3: r0 = syz_open_dev$sg(&(0x7f00000000c0)='/dev/sg#\x00', 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000000)={0x53, 0x0, 0x6, 0x0, @buffer={0x209, 0xb8, &(0x7f00000001c0)=""/184}, &(0x7f0000000540)="ad40657ed56c", &(0x7f0000000340)=""/128, 0x0, 0xffffffffa0008000, 0x0, &(0x7f0000000040)}) 04:46:28 executing program 0: mkdir(&(0x7f0000000200)='./file0\x00', 0x0) r0 = syz_open_dev$sndpcmc(&(0x7f0000000140)='/dev/snd/pcmC#D#c\x00', 0x8000, 0x6440) ioctl$BLKTRACESTOP(r0, 0x1275, 0x0) mount(&(0x7f00000002c0)=ANY=[], &(0x7f0000001540)='./file0\x00', &(0x7f0000000280)='tmpfs\x00', 0x0, &(0x7f0000000080)) r1 = open$dir(&(0x7f0000000000)='./file0\x00', 0x0, 0x0) mknodat(r1, &(0x7f00000005c0)='./file0\x00', 0x0, 0x0) renameat2(r1, &(0x7f0000000080)='./file0\x00', r1, &(0x7f0000000100)='./file1\x00', 0x4) r2 = openat(r1, &(0x7f0000003100)='./file1\x00', 0x0, 0x44) ioctl$SNDRV_SEQ_IOCTL_DELETE_QUEUE(r2, 0x408c5333, &(0x7f0000000600)={0xe5b, 0x0, 0x0, 'queue1\x00', 0x7}) getsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER_VALUE(r2, 0x84, 0x7c, &(0x7f0000000040)={0x0, 0x9, 0x7c}, &(0x7f00000000c0)=0x8) pwritev(r2, &(0x7f0000000540)=[{&(0x7f00000002c0)="e6bee4bdd690d24c7add4e6df1981add0f477c4b69d6a5d91660df4e9d039c094ac929d4fff57f6b157938c25c4019f1a704e8455955e0434b4144de90cc89582c5664cfa7e2472f60e227dbf2fc63b9a457191c586609bd59201153dd92792a83dddc4b1abf5e2a20fe84c9fcf5cd7a392d4580020f3bfda3809897ab74d599c15e7b3147ec124db539e1bf58e77d65cf5347ccc8ccc61b33d602ab58a1b2b8233860f2fb1804c2a6451e8575e66aa0ceb574df02e5c3afe7bf0a99f8a48bd930514e03dd1a4f5f536178c7e929b6b811d7e4d3481e5cb86e32b34299d1d7a53dbd9a308793974aab3a59b4cc6740abf0", 0xf1}, {&(0x7f00000001c0)="a6730d2f4e9a1bf425c743e5506dd4a0b61deb3978287e9ae47f4a1126f52d790447d020818f000c", 0x28}, {&(0x7f00000003c0)="7a2d447b860050feb2a0c35f91a84296bc86232f7435905db5d7d79fde1b7cbdb7bdb47501373d33dda2fcfbbff357f96a5d94bde79f842250d37cba532111e794f04cacb8016c5e5535", 0x4a}, {&(0x7f0000000240)="29bb42c5c0fa12dbd33db112066062f238626d4eb9f5219499323f145c1f8842e3fa7b", 0x23}, {&(0x7f0000000440)="626c9fa5540401d3de186b3c33bf70c775803ad36657955d0fb1acdd19902eb549f031b772af27b8d8f59514b0e4ef0e77bfd9f7ddd40a95edc321cf7d4a83f76906995ca5e5edf9", 0x48}, {&(0x7f00000004c0)="afa46093e6243a638ac87fa4f0838b7d9edb0e9096030f43839af33ea90527452ee5903dd07caa391b975d1089785603e31f5954cd2a278e14b13d572ce64bff0aea950859d396c00535e5c3fe085c0900a89fc5967a38bb64ea341763ecaa8fc0f3f41bd7351a9c4d97", 0x6a}], 0x6, 0x0) setsockopt$inet_sctp_SCTP_RESET_STREAMS(r2, 0x84, 0x77, &(0x7f0000000180)={r3, 0x4, 0x3, [0xfffffffffffff800, 0xbb, 0x1]}, 0xe) setsockopt$XDP_UMEM_COMPLETION_RING(r2, 0x11b, 0x6, &(0x7f0000003140)=0x4, 0x4) 04:46:28 executing program 5: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000480)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_GUEST_DEBUG(r3, 0x4048ae9b, &(0x7f0000000140)={0x1}) syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000100)=[@text32={0x20, &(0x7f0000000000)="6601669b0f35c4e1fe16846ba49e0000b9940200000f32c4c23dad78e0b9670900000f32660f38827f95b0040f01d10fc71a", 0x32}], 0x1, 0x0, &(0x7f0000000040), 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r3, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000400)=[@text32={0x20, &(0x7f0000000880)="b805000000b98b9400000f01c19a01000000b0000f43d1b8000000000f23d80f21f835800000900f23f80f060f2140b9800000c00f3235000800000f3066ba4300b8f1ffffffefb9800000c00f3235002000000f30c4c3295f4da400", 0x5c}], 0x26433e1, 0x0, &(0x7f0000000300), 0x10000000000000b6) ioctl$KVM_RUN(r3, 0xae80, 0x700) 04:46:28 executing program 3: r0 = syz_open_dev$sg(&(0x7f00000000c0)='/dev/sg#\x00', 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000000)={0x53, 0x0, 0x6, 0x0, @buffer={0x209, 0xb8, &(0x7f00000001c0)=""/184}, &(0x7f0000000540)="ad40657ed56c", &(0x7f0000000340)=""/128, 0x0, 0xad40657ed56c0000, 0x0, &(0x7f0000000040)}) 04:46:28 executing program 4: ioctl$KVM_IRQ_LINE(0xffffffffffffffff, 0x4008ae61, &(0x7f0000000500)) r0 = syz_open_dev$dspn(&(0x7f00000004c0)='/dev/dsp#\x00', 0x1, 0x0) openat$audio(0xffffffffffffff9c, &(0x7f0000000000)='/dev/audio\x00', 0x80, 0x0) ioctl$KVM_SET_FPU(0xffffffffffffffff, 0x41a0ae8d, &(0x7f0000000100)={[], 0x0, 0x5531fee, 0x0, 0x0, 0x9, 0xf000, 0x0, [], 0x5}) syz_open_dev$usb(&(0x7f0000000440)='/dev/bus/usb/00#/00#\x00', 0x9, 0x2) r1 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) lstat(&(0x7f0000000040)='./file0/file0\x00', &(0x7f0000000080)) ioctl$EXT4_IOC_MIGRATE(0xffffffffffffffff, 0x6609) sendmmsg$unix(0xffffffffffffffff, &(0x7f000000a000)=[{&(0x7f000000a000)=@abs, 0x6e, &(0x7f000000d000), 0x0, &(0x7f0000000600)=ANY=[]}], 0x1, 0x0) r2 = socket$inet6(0xa, 0x2, 0x0) gettid() r3 = getpgid(0x0) kcmp(0x0, r3, 0x0, 0xffffffffffffffff, 0xffffffffffffffff) connect$inet6(r2, &(0x7f0000002740)={0xa, 0x0, 0x0, @mcast2, 0x4}, 0x1c) sendmmsg(r2, &(0x7f0000007e00), 0x136a88c8311572c, 0x1100000000000000) setsockopt$inet6_udp_int(r2, 0x11, 0x0, &(0x7f0000000400), 0x4) openat$kvm(0xffffffffffffff9c, &(0x7f00000003c0)='/dev/kvm\x00', 0x0, 0x0) ioctl$VHOST_SET_VRING_CALL(0xffffffffffffff9c, 0x4008af21, &(0x7f00000002c0)={0x0, r1}) ioctl$SNDRV_TIMER_IOCTL_TREAD(r0, 0x40045402, &(0x7f0000000740)) inotify_rm_watch(0xffffffffffffffff, 0x0) ioctl$ifreq_SIOCGIFINDEX_team(0xffffffffffffffff, 0x8933, &(0x7f0000000480)={'team0\x00'}) [ 642.153754] binder: 23978:23979 unknown command 1074551831 [ 642.165996] tmpfs: No value for mount option './file0' [ 642.173939] binder: 23978:23979 ioctl c0306201 20008fd0 returned -22 [ 642.219419] binder: 23978:23982 unknown command 1074551831 [ 642.267537] binder: 23978:23982 ioctl c0306201 20008fd0 returned -22 04:46:28 executing program 1: r0 = perf_event_open(&(0x7f000025c000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x10, r1, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r0, 0x2405, r1) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x1000004, 0x8031, 0xffffffffffffffff, 0x0) 04:46:28 executing program 0: mkdir(&(0x7f0000000200)='./file0\x00', 0x0) mount(&(0x7f00000002c0)=ANY=[], &(0x7f0000001540)='./file0\x00', &(0x7f0000000280)='tmpfs\x00', 0x0, &(0x7f0000000080)) mount$9p_xen(&(0x7f0000000000)='\x00', &(0x7f0000000040)='./file2\x00', &(0x7f00000000c0)='9p\x00', 0x5, &(0x7f00000002c0)={'trans=xen,', {[{@cache_mmap='cache=mmap'}, {@privport='privport'}, {@msize={'msize', 0x3d, 0x6f}}], [{@hash='hash'}, {@fsmagic={'fsmagic', 0x3d, 0x1}}]}}) r0 = open$dir(&(0x7f0000000180)='./file0\x00', 0x0, 0x0) lstat(&(0x7f00000001c0)='./file1\x00', &(0x7f0000000340)) mknodat(r0, &(0x7f0000000140)='./file0\x00', 0x0, 0x0) renameat2(r0, &(0x7f0000000080)='./file0\x00', r0, &(0x7f0000000100)='./file1\x00', 0x4) 04:46:28 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) pipe2(&(0x7f0000000000)={0xffffffffffffffff}, 0x80000) ioctl$SNDRV_SEQ_IOCTL_GET_QUEUE_CLIENT(r2, 0xc04c5349, &(0x7f0000000140)={0x4, 0x10000, 0xffffffff}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, &(0x7f0000012fc7)}) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, &(0x7f0000000f4d)}) bind$netlink(r2, &(0x7f0000000040)={0x10, 0x0, 0x25dfdbfd, 0x201000}, 0xc) ioctl$FS_IOC_GETVERSION(r0, 0x80087601, &(0x7f00000000c0)) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000100)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0xfffffffffffffc2b, 0x0, &(0x7f0000000680)}) 04:46:28 executing program 3: r0 = syz_open_dev$sg(&(0x7f00000000c0)='/dev/sg#\x00', 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000000)={0x53, 0x0, 0x6, 0x0, @buffer={0x209, 0xb8, &(0x7f00000001c0)=""/184}, &(0x7f0000000540)="ad40657ed56c", &(0x7f0000000340)=""/128, 0x0, 0xfeffffff, 0x0, &(0x7f0000000040)}) 04:46:28 executing program 5: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000480)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_GUEST_DEBUG(r3, 0x4048ae9b, &(0x7f0000000140)={0x1}) syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000100)=[@text32={0x20, &(0x7f0000000000)="6601669b0f35c4e1fe16846ba49e0000b9940200000f32c4c23dad78e0b9670900000f32660f38827f95b0040f01d10fc71a", 0x32}], 0x1, 0x0, &(0x7f0000000040), 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r3, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000400)=[@text32={0x20, &(0x7f0000000880)="b805000000b98b9400000f01c19a01000000b0000f43d1b8000000000f23d80f21f835800000900f23f80f060f2140b9800000c00f3235000800000f3066ba4300b8f1ffffffefb9800000c00f3235002000000f30c4c3295f4da400", 0x5c}], 0x26433e1, 0x0, &(0x7f0000000300), 0x10000000000000b6) ioctl$KVM_RUN(r3, 0xae80, 0x1100) [ 642.664606] tmpfs: No value for mount option './file0' 04:46:28 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, &(0x7f0000012fc7)}) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, &(0x7f0000000f4d)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000100)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0xfffffffffffffc2b, 0x0, &(0x7f0000000680)}) r2 = syz_open_dev$audion(&(0x7f0000000000)='/dev/audio#\x00', 0x3f08, 0x400) sendmmsg$nfc_llcp(r2, &(0x7f00000061c0)=[{&(0x7f0000000340)={0x27, 0x1, 0x0, 0x7, 0x4, 0x0, "2832bd7785ecf5ac39202c760ac6ad1aa12f70228ac091f116765d3c55590eea318ad750d0be40fbabd1a655767db3c7d32fe59ca809c0bd922306a12cfb4b", 0x2e}, 0x60, &(0x7f0000000480)=[{&(0x7f0000001040)="fff2e0eab03690aa529afa6e195745ecde0ae50d8c19b36ba77ad4fa4b346b993d608d411069d59f0f40ca9683afd99c4765fca2dcbd5088446c08dbd3bf0e91663d059fbd53805fa882f15f71447138e693e7a89a446bf448c90930c9017cd6487f667cfcfc43a341040fabbf0202e3d937aab5280732af41a74020f07e77ede9600166a8153e58c5d9171090d22822a19b873b4e890cee6354e2258219adf472874c68700ae553fc1e2e8da17bda3a6be1fa4ee1a24e85a33d8555933075e83f36c67ef1240582adbfd1090127d8ee0efc8e71bad7152d30c7966fe399f3618b57a14483744fb5fd8cd2bfa0f81c740213302616951d9a86f810742d6f9fdf5b38227763e3838c37198623decd829a323611bc46bbc098ed187c8ae5b1981059a2fbbf45b34e8d326d9ef6f55878f0a6335d637162967e15adeb78ff545b0f2e5c0bef622321c4deda208636f2194589640db0cb1a9c4c1fa7e0db7afbaf807d7dc79ab0ecc8f63872db5767da6ac02c15133e9548ec589a923bfe2a5a2f27eeb8507a39e81460f502e39781aa1d26ca21c67e6ec4b2db849139273c723609b8c66b289cfd0b85c7935759cc835d91a8c95bce71fdfb1b6d1988d677c3d0f510da56db97e848cab43eef9ff444a77c2480664aed440807983d09355815ecebd02b701e2bd284a256983d96fad00aa46d2628e042ff1b439e715c39e54c1ecd91172ce3faffbfe8138c5a6b60620c479120f77fba8b154004bd067bd017eeaf103cfcbed6e7ea30ba77d90e7cfc27f54daffb0aaa763e26dd032cdef2a12a1f451db1102b44927b1bbeb7ab36927762b15b57577954d6eaa10afe450accc51837694fbee65cc5efe71a16fa33bfe88d8a628a54b3645770710c6d278bd373a720ba5623a86be8fb986529bfad03f6778deb5b2c37897058cdfdddb756903b8464d0c184d1ef245a5e75f1aa6cadab1d9d9f6e056c07f2534ed0c4205a495aa6100e4558cab5a03c1f7cc447d87aa7aa2cbb8f7fe2ca988972f45fdf1e6c3191dc26e60e602c9ccee0af4d990781378d875766bea837c0e8f738bec0b0a8c47d2cba8e98eb27521861ccfffeb5c08789ae8b660e854984632598e1ed9cd64a4c7d589fe9a3c00dc3ffd6c607a3a805fcab9faeb796ec141bf851e7bda76f5eb34deef37f7ffa2b3bb2afc2cdd70e152c327643c7a548de18742b32e41bd672d29ad3d2ba3afde10e04272ddc138d66f74e48269579a6f4b30863a4fbaccbd042308622d00702f28ade0f03637f04c419da7d1dc7863ee9fea983dd2813091325d399dabd50594d4f32ed8314a96fd5c5e871808c9f6e3c44013f516ba61b2e289b653a1ff134fe2ac62a272cfac40987bb244ddba1b70e3bce5a7befa107a196627d35c868f62a8e8b558be18a3b92fcb3a3a455d3120820601ad78a0c3d8bef53f27f03bbb3bd877c4e928b440e396c4688880095e643bf31e9a276c285b597640467fef7cd1439a21438d63244526ecce3a38c2dacc7a500090b1f1d8f94d6281cbed9891a8f6bb336e8e18db214cbd975cf367e9b3dc9ac0fe9a819f5dca6445f5a3ec76531f1a4ce979246281d04f392528c45503de6cb0aa3fdf4013c77344b07fd7d63d7af2ae17221f8d3c11ef12b91cc464528cf8d0aedf504a9240a368b8e480c18b905bc602f14bb8a6bc4802af054112743ef5930338ee06e880d2f372f67e8645d245e173a842b8ea9b88b26b9ed8449a46f363351b3ff6d6c2a411248f54689b3a6a0f71a29f2987f2f81bda96d52d84ff78b690ce271c6c0f7cd74287644f76d669651c54438b75b288fc2f8ec0bae070b58406fecd49eb44a7b8ce053b63622623cf6317af1692fe253f38449c89057862d01f4564264d52f94b3f203b8ca7aa8554ea212a1551d1b2e8eda66114a0387a471f6998a512f4086680eba5dd0b39f96ab0e9e68a17f8a32aa6ee0874cc9568a86bc336891749b5c927cf64d53143dbc921246a6fafee817e2029dea927ecf01129e1a9056860e0de5ab10c67281db7f50d8c40419d656817a533491eb302d30ee454aeb2d5d069853e52b51f2354816870d471b4766d75656cda80ddd1765880313e650fcd1da3eadf6c1f076d4837e3a96d1b7c48747a85fdace3330885c2a7e202d3306be52c85c7bf9c79f2881e50f7db552478ba8684e00c7e4813b6fa6e7bd6b5f66e0f68ec9e2e92109d8cd367f6c69b1de26706ec867810ac571f1bdb8e5d3829300925f89bcec40f21ee3dcb9e27e92d56088d33908c516c0eadac22dd8ae502c44710eae92961aced280d536fc3aa7c3be75c80f69a3a0a090e5893922d0231e39e48f99a865ae9b856b6bc25cee77bb00417fff1faaa315f91546c8b22fd63ad02604d6bc8cb879fd3205e9f42ccca5226083dc1b29ab043c2eeb69f8f1bae0c01ab6dbb81a99c2dcd5fcc8818c7209315099ebe02b7c8fd90152b984014858be9b225d534a0ce58d4247fa240cb9111ac305d0793d071845618d6c309a7adccebed336a8e7e7ed3544bd5993dcb89ecb3e7db8b08c210b8e82b2189d5e24da54bbe097b5e92c42a59a87e06ce8fa091e6b1c47b76633c6790f0087336cd71e086782b7bdad0bbd6b12e9d7e2d86b01c2814f09f60ec58feaa94de99c544452cc2efcfbaf4dbd8427802c88711066ab54d434069a9e4422da2ac04422d1d95b0e3901a86220dac303cddcbbb3143a53018cd713e370f50522b36d5f199e524dea95f47103d8741ebe4e63e9da5384f456ffb5df3dcdd7bc00a1a4fc827e7efbe5a9c8919779f95fa3d2d9f90761933a6bf2c524bb40666319675bb8fbe91ee6a48ee315e22d7e91cc959364002bfb4740d67d24fb3ddc8ab48e54e614b562402027a8b1e040af88f4c5b1663034b451324f38266a39d2181b663302a37e0a16a5639262e4027f5653a509c05fb9a58bb2aa11ad40c3c644a82d9d9bc6bce5cbe35d191308a7dc0749f74a9758ea305e65b1c65d86f1dd931a96900a0515df2a548adecb03beaeed11cfb9ca9fee9bd0fb347dfdc294cef9f4cd68e9f4d07746a2e39e17f0bba81def10aa2daed4b0ffcb7d01692a6de54bb4c185c28e36a73ae5601594ff246314e9ff6d50ddac73b3d5bdcefd3619995ef9817b3c982b7fc96565ad4775579ca93cd6d7a13729423c71adb83235371a8a442d0bfcca2b7fcc1efa8c6d8a6adceccf842ab7a773a51e28238d02bf854278a6135d4594d665cc6d45ac3ab1b4b7d9bcba784912e05a85a1a404c4da8c44ebb6df2eaa58eb15746be92bf04104fcafed182eb48f16873c663e4f728d61915857a55f8ec1a8126426d40864f84ca85486ef27c2a780ceff8ee92d93500fbf2269d6637a31d3c6ff1d38e76e446ddf13d7d8ef23e6bdb4aa69d1438f5724c93d70c4e75729c4c9ef8bdbcc32e6efd774937badd5d2eeda95b2bf2a557d2481212df098dd9985f2b9674e34bf16362b515e9e99689afa3869bc34690ca2c4b34dbd36e809a521ff3fe1d2b87e4af39ec0df2509ed4cfed6d49e9a6c47e6ba7976d4fd1bfa721184507573561b520ffb1e5720e8bf11047e8058f60e70de7f6ffe9f3de34355f9c08fb31d9590da33a301c609fc389818cbbccb2324e9088871b77b61b7fac790dc3f2e69369b3ed4ece8be90d8350beb268167300ee730a868151648d1299eadfd2cca4953319f0cf25deeeb0a5fb9bcef523aa4f904a2d5d65de2dbd63c770ac1ee27379a0ed30098b4e81b3d94afe625f94e555f52a81685fa790ada93a2f1d3590efb342891d77b1ce279844610ce4f7b9a9c890cf6ad337fa230167491b7babdf3cbd233fc5a2cca187787f0c8cae4586a2dabbbb1f4c946e7eea89e7d7a248cf49b006dca51b2c51c770187f840f1fa745ecf7b1219ec928e480efdbec44579b73cb15c038ed869867e2ac9cf221050cd77dc8189385bb0e0dde376f5b83f63e16e8a0d94419459fd0c8dc1efc8ad954c821acbaa73929c824245956318e23022786b9a41a432ad8e5202ee2409cd4dede79c6bd3595e3115c98da2618bb7457bf49e98510c94379a40ff789c43cb2550574b13b7e28498714c319e361f895d98e7deaab859ae93175b25e91cd19062922bfc749b17ec4e9316c59580c55a90e37a45a057a5c67213a7bf6aa92a2d3a985d6dc2892230d3c2410846ee23337550a20182589e01ba6fc9f2bef55fb749a7215e2343bc7d95a17cf1b9c48fc90191529cf0289008a11ed7128f5c32248d5e382a5891938e228a03ce2a4bc22f7dd64091b56aea8e800d3b1de1ec985af738e2912f8185af05591e5bc34fc1db789e0237f3b7b489b94e79457d712e22fb984b7a2dd2488e5290e61632e3ee088e68050065bf483372c28b3092943aec80cb8ec05155bb1a06aba94d7400a95a43c14402ee7bce77b652fd899ea7df0c103b89647c18c10b33747d8455715dd27f42e5e826465be34ba26e84cab701dc5480bdd1e6332a112af4cf55ec7af811beccc8c63a498800aade6c4cd180a646c2c1f1617648bfbbdcbbe4d05d17a757f784eb8f0cce7b801ebecca1c202de756d1949a7a4572ffbe49645056ac8b74ede8141303224db7065b1de11a19fe9891857f0a44507ae8b81acf96ab580308c33889360bb2f0cb0709c0e4adff99b3dca1a604d87629e6930b024b0af98a6564dc30b158e89ad4fc87ce10f238d341a46a549bde9e881fb70a8f718c3f896ba179798b8447e840dabc9926e0e73d5e97ced3781137facdac1bad188ee56d9b4a4bd7cebc4df2d24a085d5731c9710f927bb9dc58b26d77e579435747e57e643ee7ec697f8beac1b0940023f741e1ef31f015cb19299d9f8658ee803e8e29932fecceb57128a65d89f7df6bd7af64746ffa668349a94a8b915736c0ead5c37ecc1b65f8ab383dcf7551cbb5c6da0e3cca74fd0ff46ef5313f26aef6ad8e18c3c0e55f8f460fe06c3133fbb2e223c5819e1097db6cc4a1029037b77739266fa7a6c929c90fceacd219e286b6314dfae6a2491f655e9de60df72b2a45439022c108e6c1be2a6266358d8faa3e3a60f4ff0fd6f222f584b0742f1456e9ad4b25636ab984239e57af0221947bb8675f51d23194fc1f04ad70da797af97bdbad1a352bfbd7fedecfd0d2ce8fdd8b27486b1d1ec864fab6c498e327ebee099c2de73899729f2917d40b091cdd1d9b3e6ad7ae2dc39f8f469404dfeabf05635226326ad5b2501c271dbcc4bbaf1be7a9723cf1afd8d8d3caccda46b8349ca6bbd23508a0744a857b0690b5e0b13fd0ab68d6947274b1adca3748e106cd3a110ceca73620f8d38f645a1d29eb660efba21dabee0bccb26de278a0f30b8e295a8a81b4d17e6aad0b800544aba0870c848f338acbc3c5ef413d9bba5a9dc82f9c97abb37a6ef0f200224645e7e9e3e54665718789a2ad714c039d52148ef1d000eab5d5d2d713fa0545433bb6cf4cf560f3abd3c6f8d9b3d8841940571cf12b27007a58150acacaf7c2057877e43a6f976b6550e6d6c1f0a074f8a663edd0dae874a1bdcfe94f89bdd35199956af5fce0427f7f8b92ee0e6dc7afe3b2039c4ea9dab7c68917975f23c73ee4ef8c73d5e65a9f74ca39b92a615411db68e058b7aacd171d773d87a78511bd9f245f058bce602ce1c7845a509347e87e763f340887b619cd157c6eee3139a4f8f97506f12152eedbd93636b3ecb8f1f99382d9e63d89cbb0cbcada82339698c62afadafa00f9fef624dbe4fde6b4ca80d602e747e76a52b256e739be9", 0x1000}, {&(0x7f00000003c0)="b2fbc697df666a5d88def5bf0f67f2777850e98ea92c48e35486f022cb74be3f993587aa4c224a04773f37eff56c9e645dbfe86b43e8763438a8012a2c39720eb5a49a3b75c750b510a5e1a302985a8037fa31e7fb3379e3669dda8801b12db3e33f3881f054969a0bda6eb627f3283c5c8a9b1efaa2b77d2da451711acc566a215568f44a5f93c8a081e03a653d148095e6a75ffa19364c490c611b7f92124f4a9f8cdd3def338242c3f92726e59baa0c7004d1f1", 0xb5}], 0x2, &(0x7f0000002040)={0x1010, 0x112, 0x100000000, "f36e29db7fad91bee24d54e74e3b87a6a53478559b18b8652eb0a65c6a542aeb19fbfb6cd60a4a3ae5d0070ef8e5f8781a5e32ef7a699167a78ed4580718732b7f34040f734db98d788c1c25c51fce67a8ad31ddc0976b2eb65508c5162eb1d948ca0606c411521601f3fece7051181d53f43e981c5ee908a8f6c1e81f662fb0b4372122f17407f63d05f418b892279304f082875c00b502a626fdb9ffd538854e534bf17e9074ee483b864ffcd25d388f9cb2f4c77d190e0a7b27e4a9505af22e3460f3edba3f8ef95b605bdcf0671a65520515194d2e8fb786949cfed98da1d6b16f45b9b52b6c22cf1d798d28ac3b65880a1081d7bc94045cfe3400bbcfd2d61876be2e86948814b185b04f52791f6a9eea916df82284fb553ba2e01678e60c4e2bc4f836ab5e7a6fcd5deb70dfa498ea6dd2dfae85c28c00aaf954e83db55f1d2d4f68c00f9b9b2516bcbcfa59fba7e1d1d566393b9ca113dcacbd168ee07cd69aee702403aaf94674a2fe43cc15b1e58513c371b975506b7f607d1d00b92cf2e4a0e5dbadc773f59ece484edaae265a6246906410f09dd4bba7137e2a06f96f4e0a6651c0c569989e750ae964e2b29737a0786eb34062067a2084837da95bdaa12933ff6c0f7ba9e085a491bc9ddaa469989ceee46cc76c691600762bdde1b50815bbfbf031281106cb962fc188d54f94d5e2943e2d1d4f8300b8c6a99d90fb2216eaf08ee4882d985bbe9cdac9748d96a36280f8ae546b1ca606b747c37efd678a124d3388c110d6d188877673ff429a75d05a512af18dbe18fd784e1d93cb6daf96d8d5aba828abb66958ba2f342493850309f9462211542f71f1c74c69d0bd5083f7f81ee9f5fb2ae745bd3315f52b35072989315aa0a3def6282fe510ad515c1d0dac9e46577a774576951b185fe25f0a76425456484da5e7bc7a5ae32b69d6934af2897cbaf980c7e1e6d2b42b4c0ea1d180761a725db4a4bbc3adacb99dfbb1ca85b53360d5ea719da0d09e9972be871c0814053c9100ebd34270d4fcc65a0da3e42271bc8421a8270a30ce643c641571fd965825cb06a1cfb50fdc2141126657828668a49e7fd315ff393942efea9304ff9960b01141ac188e08fed481835da20ff20ab5c7f8976dd2ac16831380d741ddea0e56acd4aa16294c246e87542bfcc673fa0e064c40aab3b3a59edbef87526dda07a75cab72382b9048aae2c20c97920ef8a8c2a381ea1031eb53622a48a67bf3742597db41602bc98141b9246cb28704a028fe8f4ed6ccc7d07d80310aa2d0399ff050ce60832cf43845af4a1f1912de7a6d040aa041b7223bb400cf10cfe7939c5866b79755c263a84f19bd32a57c79bd8e145bf870d0759232cc616c6a40d520b3c152087256cdc2823a579935e47b0aa40bda4ec68269ca374257be1d9382f72c6497a0d22e039f1c6fa2b6d536662ef69bd5ef05b167a613c1b9811998e48de3c4230251bf5a13db6c22ea00137a424035b5d368b669ac676d1d72420ed75e74cbc76fc34bb3621e99ce7bc77206fc152143046b9efe9cb9446ae8692ae3c37d0fbf12e94743aec8b4c6df1637f607a0021b484c029f1edf4d45420546e679144fc85ac9ae8f2f53de74787c2f3d044af72063b7d32b0c1cb68a7ebedd79915f40fb079df35f933e2d1609df4e78614aa6b9261ab36019cccbb253186034efce9c75fb678e21f3f90584c708edd18897834dfc5488d858d48421e6bcd6d71a606c0b832856e122e48eea6f1909862c9a2a07c99e8e6e2da4e144cedb8a3ac35849f296c9206594330ed6a1b0a6103cf1ad2b7987a4e32eec2b1174364c50d88cab3f90b3b25e20440e728306cecb4562ce36c0a3225df48599f43ff21519b6d440208915d98b6572c27ac157657f93e39674ef79f419189f82af3f795dca2cc71bc312ba7b7b20ddcbaac16bf0928761fce3d5112381859eb248cadeaf97a619e2af33d65401749f63abe751f7509c400ce6362c75c41343d3b5b656663e93b01fa1368d04f79a9470e2874431d88898ac80a5ba5099fe6f2db56977ba5620bef619f252abfb0afc8ed749e62758ddb2711d5f0c99797555234e2a43fc61f62073c5ad281d0a1912f9f1d46ec0770018efbbe150ef265ea215998d4052a8767c688a8af593c6b4dcef015ee0ba04a7c862ea334deb5c1a95031ea588444269a2a844813cea4d3248aa5eb6f1b009deede7a3b060284590eda67bddc4dcef7f06b5d7a91671e5df2fdd3329236e1fbdc1ae8fe60b7ea4c3a8c9809755da5cabf87b36461e7d93368742388476df8cc1c79c0bc9c421228ee1964dc459507d764c84ff35946c365cf2c19d49de59f2d7dccfb517ea3f0069e1bdd5eef52855c567087caa81e0d7e2ac114f7d295c6353b5f3230dd58ba1b0defe594bb128f5559857bf6aecfeff61b3350dcba06dc1f622d93e65f5f1c9da5841d1dd8fcca06c2c7acce70e9cc9cc53ca9cca5a8000abee41d67d81532a26d09d78afb1e752d74013f758d4b083658cb91f78dbb9b3f31d368fa53e56ac937f8e4219be15a9d2443d5e51c16fde551f19cb27935accdaedf0a49909144322b66a911b8cc9ca6a4bf86bcb07414a291fd81694e64a0889a90d7f7537849e8ac173ab0eb35e317707b44458077113d8d17e6b313e65164d5924f4bdeb01ac806198b76fd1c6b8186c072dbe7c2242679d541a53932595df458245a357f161bbf6e6008f5ef710c618fc58cbf175a5732b5c7e2d5375bc395bdbf8f59e9af877655b51c8dbf4882a6f7906dd8851ac7e7c89c0c43b44af56527b2cd08d6e839e14fbffec7b3714dbd8d10d15baf666693d032823d4e069e17913b0f95cd2af0ca00980f2319814b1ca9078638178eebe97b324bce18970ea83c1b8b1a96eaef2924222963332d971e93628e1503960a82157d7294117f35b44629d6bea3be434796d440e23f551ed4db39eccb7142e551ba83e00db03c9e25907d9bcbb2da0ec3fb86556e78fc185f234987408fd397a79c2d28cc9b706f9d9f1e89244638ba8dcf024f47581cfb9f69da531a83933f52ac04ea81fdaa5a60010b78de6c2b3300d1931de2f82a49c951c2b5b143cd09099291024fd7db4d274a8e3644a96384d3dabf4d407b021b5b49222167332d07fb99ee0c7a867b550c77b42cbffabdf8d15c94d1a15b9bbfbdb52b0c13dc4cb755fb144de466d0ff0aa8ee9f755ba5f482613f11e4c2aa5d0e9f5bd31d934b55c1df087aa4f94ebc9a5ee9d4def2329cdbcf0fed6e5d6df0842422ca5afa8d06128a00dc304f528fc4b289c1dd31914b8eaf23467f6e1831fd61049ab07b30838fe15389e8f24a03f2e24301f20e13afff39357efe72dda0af55060ae6c3f932da55e31410f9a83debc82dad6cab590b808bcdc90a2728a4a373842aa0123b9abc1a717b84e425bbca99a36af45eb5bea5fbbdbda71e945f09e6cdcbecf31ecd30823ae1829380b4eaa149162e0b3c692034438c3822ff4bb86b901ebd65d6e0acca8dd32391dfe7ad9a9500d181fb23217700db18e617f2257f439beee42127de1301de03faa98007e21f508b29e80c25c6041a3d5563328ed0359db6cfa2e8aa4a5414593086300ace1eb5cccd1ab1ab86fb9629ed7bf5b42accc269e9ba1a5567db53a1b952d32846f13ba133346e55d278d88fb19d001cd583d56143a8352bc121509485fc2fd338609a57db7c0a9427f086936a3d56bcfa687b2980f9fd1b21850387958185dcbad02091c1b31256fc8f56473e90c6d15e4642a102b5db210e0e51da895ceceacd4a32de6e657321906b53bad9f2fa96f4767edc3744176929dbbb7de3bcb9ef7782898ec6f1e2b8c6e7a95a8ebbefe8342899a60192d3f54d5d1017b8829cead6f4b454f61054afaf19d52b409d7f4187fdaf8464b14dcf265192c8c330780330f822080a1721f97130f4d63e4472e1ca97c0a44832e19eb6c843e218a28a7d0d168a371a5476b36997948f5b4be1793cef85e8e9c5165b8983662c9542786d68477cbd17e29b76fa497caf3d69109843430507edfa9a697a205d3f60b0a7b8fb74f93117383a966ae316133ed2facf3f1b8e2da3214dd9ac92957fd226c7a5a6cf477d5c1dc5cc2b0ee350f59605aa0f853b2b2ed7c59c67d8cfa599ce55795b202384425e447a44447dbfe2cb5a5dff580abe1ef1f564851a4445f4ede5ecda06788cffe733409ea8ca3e5b845c0ef572695d77f9dc38abdaf8a302bc97a805d19534ff1d236fb3066747406d26006f01a4d69080dc7f111a9eb9410c6808f4f2e1fe4a2367398ce408b16d123a6ec0fce51516d757b43452c38866f32f142ad0c5dbd0b15325d2430076d1645af61d1bd3e01dfaf141413cbb366f42f98c0e3dc107e40cf69d5c54ac5c349777f7b1043650ee3fc0be78d85d6758cd60f2a7a3de3effea10506d845db292933f77fe892bc8d40fe284fa7f3c46a97eedc8ede4d84b4864dcc4d532bc82ebc7dae2726939312776733d978eb0aca3c8be4cab4b267e5f8d2d981530687132a9db3afd3091772c878a05aba4d8f3ac129e92be89bfe62a19861d550bbdbe735b9ae045552ff976ed0254d5a2306fbfd16106ef26143b009a50c8c7f2223733c98df5fe5882a7fada3e216e14d0f0a43d57f35aa1d0034c13b26cea74c578bc3b935c8f63df2942518c81053851ec6e1701b1f15a8bbc16f9801e9bddad423446db534cb476c77eb4a6a082f25ac8f96e4f31fac170ca0072aa905b16580bc3de847179adb235c921dc2cfeff2d7f8cbc9aa8efd30c4078103941ef6dbe8bbbcbaf2b9a78481661d178d728b16666552d104c9e78c0362d5ab35c1c9f0e97929ae81aa873ddc2106eb056584b5f51c564353339ef264123c2ed7d77042dee05b460f19fa0430468f9f697c8727fc921da52c6aff661a8af572de4e8b1c817d6a6e1cdae3cb7530767f332affa8b8fd54b0141af9cc28c073cb92d63c8f325f5c58b709c1a413302d636c8a187a7cbf59942e91621dcd4f63f448275ebc4c3bc0e8b474b555fff05317847872ebaca5692187d62f7f0cf0075a22b29df76ad70ba2607346aa803a5e3322bf99470b00edbfee134e1f975e4a21469a6ea49ab362f7ebe339fa8115adce1cbbaf9dfa9082bd789746babfc59206b5900f7a09a91c71b6ba5c4f82317cfc46d94b2f6257edaefda0c505428c7c4f75b1a392847cab0132d586258de311e9c0488d7c56dda9c16f658798bb1cf06fc1cbb049793e93d5be63770400470f4715645d47b86bb66b708956def42fe795a641c1635026c6152514fdbcf45b891ec186415087186c46fdfb286880fc7e43cc8655c7d6757a03d73aad8ddf9f27a7a40bc2465a6fea40226bbb288a0c0307e5c091a08da65c0c44029a798f95c7034f0375eef60e64a9149d0fb3b8a088b5edd5334dd3e15f1726dc282e167bc02da77cd5a4f368ed1c1153d5895a8ae06bc0a2e1bcbb4799cd1ed39b789e44012d3827e87eaedd88e12c95003a2f4251d49dc3080628be4ab8866fd4384fe5de5b1709152e40ea1a3891cb621710f2ca7de604b42052a6c5a3e3c8e8327d2dd7e657a5d74f221b619e20dfed92c6950ebbef72ae0d3993c6f1d90a40abf44e39b23eb0be874144083e63bc943c0b814ba3660c4046027525a924170ed74411467407325827c8a2f7cade0ca1011ec907bedf8a762bcab0c7edf18438048986e783a8503c4be32db9ce37752c12a01bcdff7e154ea026b6b5fa591d70ec6f1aab6c"}, 0x1010, 0x4800}, {&(0x7f00000004c0)={0x27, 0x0, 0x2, 0x7, 0x8000, 0x4, "3220a950ef8a465304e30c08044fc0a425d3f8e8ba88ed4df5d91c5e7b14dbc75e81f068c801394a5596e334b96ec53c56e2eb002a835ad54c0fafb4ab92df", 0x18}, 0x60, &(0x7f00000007c0)=[{&(0x7f0000003080)="0080054c8d7bacd776e3526e26ed3c7f4cbf204066b3b631e87f90c74f1d81c649710284124c815ada6fa873632a779f0fa99dbc513f881fc500708655ef424e2ac7315db6bef8c00b176e877d917db13ba29ef023234ae91d5064c161bc25abc4dda474a42aa065322fe430b3c7076c07cc0973713753781cf42179f6a94f5899b58977027831ae792d59af62e264dc5d060bdd222683affc641b56af52ae44d038b4f9c1719d73005d108da3c82d932ca70fd8a7797cab60e9816372ed4235b45462c52a69aee0ae88ef1731ea5ec6296777ee8fe310e1fc82f4bd8fd30d8679aa05d72020caf9fa80fd9004884eca85da421e18d9d96696a3a1b33848aa805d83960baa06aeb7e4055ce984e77ce35af3e8f3699fce8161d16d33d9e78f1e3b0707b90d858752aa86c492f487456944f84e8b663fe2829409b2f94800ee7fa53767e875d8ae5d5814e64fe26cf8587d6bb24b95478a5bd81b0a3805639531d18e49639407eb321c9a7d3ba8b861fdfbe6f80512c50a8ef8f8c4f3eca339b6794160d0644b41932310425b2b35590ee0dbfa92b56634c6eb85aea453c8eea422607b3187463e9187417562cbb784076c99dbabc3a07e3e741f27184c8353a3bef657d6c698fdb4b0e96f69e61a3d7f8097811b9361dfdaf24ea3bd16b000ac67501d2de9e90180cd6b9ca02a1241f414ac555160976333affe06053756646ec2f13bbe9f9bd142eb7bd2c16f1835276ca8ab287edd275708d48fa23d88cb89ec5e43a8988f72c6691b595b80cfc0ac7cb71be3816c0678ba7288fddc4a1e299dfe6714c7bc22cd82bf8c0cce94109e3451ca47b9048e9d3e826b254ff022f9d882b840c6411e003e2a8a312642e3e1f1f2ceaf174b39d3b2ac61cc59297faa6efd6b0b51941fe4fda06c281e6342495f17feb10fed6b07949497974a6e8484d51138b050ae2740de5a0d2c36d07a2a47c0509f54d1305be2ec02d71ef16248e4100d7fd66405b06e5950dbdf54ef5b70c86ac90e19101aa8d16266123673d7340a0f8494c51059074cfe069f7a8c5db3732d3f536c99fde4e9c24cf2d956122dc8a617c3fd0b6491c08caacd64ea9015d1c9e2381b47312b6dde45aeb24de97ccf6ed5922dbdd5dff8ebc18d9c4ff4f0644dd38ca8706e495dd9e82e8d563956818e3c034c6600f8b8038d862b15a303e01c7feea122b8712372c55579156e21ca5d744e67bb72a29a6bef0dccd47cecc07621df94c380d1ab5e6418b5601ee9f9abdc349e9de35a763e56549f92c4a3bd89d14b3416b3eeaf99b4290ce3e881c7ff7389bd4ac31c7ae3790442c701ef885ccef8db09ff5ce8931290cc024bb89024e5a740044cf56028aa907fee5d2fdd152044e0f2fda9324d3c7e190a699dd098ce144fad342beb2c8e9b6c4453b22f9cc5eac98cfcdeb6f151cf8e1eafbd2fa5b48691fe213e5a4b8e0376e0c3ab08746ab7423c7f83b8d8d82d2107a9866ca8907a36d0f71b9bd7c560ec31ce81fdeb01377107af2483b501718d49b6450d9136bc8d283edae6fe04fa6f826ae6acd3efd3677f15feffbd3ae3ea99d7953e9fbb1bc0e30e3444e5e1dd8ba18116ccf3dc5175bfc447313ca978d855c0db30690eb0515b2c9c2b07de33d861ddd505dc2d493b165856e2741ba072c830c20ad2508e6d0299727bbc68483aab173a4b0eb977185a884587a0336a273b9f84a7c8231017dc482ae61ab95473aef33d87403b30e014b7f8572c82d40f2a5d5b9be867b464c4ef9d155b6ba0c1626a819b82a7bc805741c9c28376fd1ff01a65ebdfed7311096a56ebe2272149b9656f0ecef986b7ece00d4131697f66bfc4d3b9874bcebcf2aad9d393b72c1d7d7771f136b6a98b5078c87e01eafbd3c366d991817fc748ca0ffc228a557bfeebfc2a724de4a3558b0d279c32f0dd5181af338cc397ecdecb10d58aa98b9ece7baea95f21d7d662f20f7c128993932b741d5185a285090f4b9ebc32f2c945c7cd46242803f5b621c0a58a7613356c8912b75e6441e079af3b0f11596ffa46b516cb11de89c1f2b02673bde54011e25ea8cce298c05c21338afd22b177ad003ea42860fac9a7b8d397aef4884a326eb59297ece96375dacdc36f2d37ad812167d4cd1ae46d349ccb17b29e37c9847883aae331800f0c65064373bcad3c88b9c420dfa2c1b9d8c97d116553e9fd73f4239571f693f3753a8a03e24035ebc1e96ec3efa1e9d9cc2bc0b99bdd261012d137861a4709bf4b0656bf7b64f40d9d564027759575566c485344a8c5ed7359e49aada92bcf27d475a177ca67722a3667bd142db7a8f67ad9295e4ec9ae63d7ada577011b51ef9b0ea65a0daa53d8ea7fc5faf61b3c87daf710bf6f22713364578f7e1253b55ebf83df5f9a8b887a0ea5eff4f86432531547f9c43a0ece9353e5df8dab0ab099a481d6bf5bb8a2c61d9c84dfbf99d57412d2e0f7d22e5f5bef8655fe7f58c90879f9130033d9fb677e0bd092679dc917acb0f1261a51a2524ef3e99796d7ec35fba29e658a2d5aa012be239ae52e3f3a8624c08f89fa5ce0a6aff564a5876ae5caefa5c53b4c6da352e6a217d2f836cf24564e41fc396db7c0d113cb1f8a8a518e30f0af57b13891b0d433a107b6cab17ccb5e97893ee76b0abd465a8c607563ca7e52bd9b94a81594a39d001db8fac8ae8b6281840b98dcaa9c2682e8e63ff3c536cbd438225d6690f52a1de8f3510898265e1f228bac3dd3bd432bd3879cbb4e23c120bb91acc6af62428ba885a19a01150fec8637be785860279f288527c940f4120a9ac5b85a3121608e360a2b88700773e53b6d42365a4811a231443c5b7d211d7fb3042129a1b7539b23a75cbfbf9bb9b88aa9ed31d4081d88f1ccdfa9915ceb013773c19c99040ab5a97561ad27acc812226f6e6c827066f07d7dee9c5bbaafbdb23b710ae1e4531dc49f50129d9e8653bac397a01108783a03bc5cabaaf11abd6f33e7eed927a5e1e603f7beed5a48a24e8f7abd09337f16d288c5d617830ed154367a7025cede26fd4e1a4d2c478fb81085921b09b7380ef6b0ac7003388e44c2baf75ac519601624d1c00c1e85f067b25f327037c77b4565f2b29c0feee6d9841798499314e5b9c049dd0804a1676ae6a90406aa4a0fecb777ad750fa38cd953f962f5e015745457d07ca2a26a5361d349289008d79862aa88f9c796176181908e452cb51f4307bd6dcb16538ee08ca125388580303665efd8061b439efa54441223fbd6c3fd16ec2320f4f08a21260f050714817891b5bf590f062ffe6b23cac4368b090650268a53f1016e3cb181ec1196619037e3d2768ea7ca0bb19eba2db52b16abe19be0d8cdd3085c9b17340f118635e2c2bf3bb9d338f3608cbfd3d0a92f8c7b2dce644512c34cfad71298ccb017211f1a3383ae6734e53cd10dca047e28e501accf0b062d80d0c6527a8b7d2f72b72bd8e57fa0ae224e3d0e354818eaf0e2446a6883fc2fa42f676d866f186b83a306da6f721a35aca787565f03fe8ebe99a9484a2ca4b2405b00722511e4ecd50d9106985c3b97c441d96d3e8c8331afb88533f58155fb9091eef436840d3dcc19eaf94a168f59291a3915ae9c1d4dece7e8c3bbdeeb91720831528a818b038b7c5cfe63259b14ec61e90394bbebc8603936e107c7c0ebe27f0da3e4a7910dfa91d41aa8816ac6ae6e228bbb65850e3b3819e3d3067ad24e6765c56a28631ae7ff1ec96a8dadb7766564479c4ea8d0ae1f3aec7768b01a8160a0299ee1423e15b1fde21d4be134af1e06a995c4d43ebaf8067338f722ff79d184c325c78d9c1e3aed7ae7d2c862d92ac2e110e9bf641e4bded0bacb83986d0fa885b184d793a8fa16c4803b0cc205bbb2763fdaa692dca872e5006cc13582d8ef160f708890aac850e25641dd502344938fb6e7ccdb469a26f21dbc2efba3e3c7cad5f0ebb6a1e68001785a740898a080d4ceba9ba687602ecfb20b5f6d622ebba17f954522549731f7af7356980782abbe2bdd7aeef86b91d052baf618b68fcb3d65680514596811cf44b150b9b378966f257436d739b0b0172265ef36dd02fd03185d8bbd93bb684f49c2de81ee91056019ae3b8716bec31cdf56b1cdac67ef856dac54afe52f98cca237c2c021b05f0b4d69a679ca1eb84d08a79fd3351d5bb82a81d66b9f4b2fe946ae86cac98583227d527db9b2c91c895bbfa09b6b35c6da151ffb459a010e9d0c739fbc8cce9b6858822d07202428e528c54ecf0e0093c40f0b8bbdb4fbc2a568afd4f51abfaafce014eeb176ab751fed5d6e5e20ea960e1b33173e9372730b71bd6a504ae1f1fd12eedbdc99e650e88575891837000e0744e6261f4a8e3a9d42cc410c14e9851ba57e2304bbfddf7c24532697f308f4d0cf10ca50fb8a72292d8e51bb598ffd09c9e999b4cdde9b065099ade14ba16dcdf332b202f123aafb2eb2bf18501717ac9f36aa77a57b7e242e3454518920e48fe1a5b2c70372bc26417b6b9e2e956a84415975b5e91c119f946223a43f2f5443b3df76a10a9f3961cf736d4d4257a9161db08f11a3b92e02efc181d4312f4aed4be06c65b8d192861608771600d07d6329bdf0a964d5ed8506bd8e201c2cf83a499bc142b91d0645310af9fdee14a92889e44946b6ba6ffa9d8aae4ec79e82cfc46eb00deb63265cf2b5c04789e2cba6f8da98358a71432ed7f556d860f366a381ea8183d6afaad12492378fd4e9774de1ea7903c7bc733b0a0301c4e50400948c2e0fcdcc0ce036bd01a349db8797abb79bec11eb227c8fe65b89f49e2159d2fab49f3b9a4de01460c4a14681cc753c888ed939621ff35c078d1f22460cb99741e558fe0ed7732e9785cc5bd434de106d5c93aa3395430ee03893212dfad2d0ed476dce1efaeb5651e41cd61cd69e79b8e9b6af52bbb75cc7bea94b4f3f5ac273a86d23cd0b0878c5ce427065368f649c876883237bed72ddc8d6237ef056eb0f7e6dd6d9fda18fbdc87dafd17c3846a4f0148c61716b0fedd0dd2e1a49ccd4aa604fe991e6a3b6a9235577d34ac10022422762d707ed811c93512c7d4fbce0c6f31f3336980f4fa176b1e2a6fc5bbf26aef1a1a7fe95d3977261458f67ae87586da82efe8a61dbeadef91c838f00e0a87bdf8579412ccd932b60c4337295b2decfda7f835f2eee4d50acd4d58f1e6cc1d6903821eb35658aeaddd9468fd3ba23afae23c79dbd3529489a340ccb275e1565e914fcee539781bd1cc063c905ad2037ac8f34a6bf709d31f3edb12a039bb987fb3aadb9003ceffec567778aa491ac6aeca7d3fcb6e50e87d6f96267ecfaf81e20139f4c2f36ac1920cb904ac671094e4e6bf5dfa22fee486605b8e8759844853356f2eb9c35f2e06cbdde25bfeb251a911f2b9bd23a825b1e2086c460ea843a72f2a2bfe893772bf786a71d370de18fa7e034698d048a93a952fcfab2e59eb69d8408241e150d2f97ce0e9f37a55be7f1aabfae44c7dd916f505a3990386ba2b35fe86e85ff66982cc0bb065fc54f5888cae9a09e1f835473e9a6fe188d8d770464f1c68d05e3a4290dc73c339f57425a66e8ccbd5af7c17ab1c3beddb5a59db275df3ad8c7392b0c7f380c5fb38d2533b520dc2410992506f847fb74bd490d4897b1b036a5cc2726910e0bfdfe4f58c296878dce610091444633edc62c2085a34ec7c659be732ea91d051bfe2ddf511d2fea137ac7bc7975f5006e5a33cd9df8820138ee8267816993ff8ab862dfb1545151de41ee190eb6", 0x1000}, {&(0x7f0000000540)="9f77d4dbcae4dae2f79af82ca66e5fe186d493f25e3ffeaa38ae62b99b5dbd3681d4944912ca5b21dc6acc60b6274353e5c2630b8d7781a9b4dcde8adf684a46e5db957073531c2bbe3197bbc08a99270d3b99ba8b44458c242e22bb10ff0a7c06820776bb5fd2d622bbb2d580f03963dfde81acaa3bfd01162e7c94", 0x7c}, {&(0x7f00000005c0)="23fc594e48e402657e9f", 0xa}, {&(0x7f0000000600)="070919714536224dcbb1004115c3a53247900f39ec082f6cabacf74caab83cf9e93a6adcae538c238cccf6df9f83f679fbfc212c77bed4df91e481bdf3584cde6a8bd607a7e9dccea96aec84fc83060d62b6e82d7a1392c965", 0x59}, {&(0x7f0000000680)="aafc85d839d9be051c7b6b7a2c2c28c0a98bb45b6f1bbe032672e9dbec010b521a31ecdf762e13380e4be1c0839de091c70621cf2609d54bdc7ff2b405fd", 0x3e}, {&(0x7f00000006c0)="e4c882852ba884a88b22e3b507aafd50cab332666f10b8ec2a48976280631edfa6bd4a48be8e09320af5278f9eeeef65408cb6db464efa1192760bad2e042d1f9b591a42b71d4289e811af56efc95fdbac4f5c287debec497d951f31b25f1c17235e1362956f41c858403ff3a4b0aa457ce63ba96143a9aab1d9d5acb32085417c5bd1f303976fff3b60b737944d966c2e0cafe39038836a3bcb91887d9383e482271f86c33954ccce002e467ab03f17eb1ac68f2d49b4bc4c868f4488a4c54b35ae138c9ac248e10739c57f86f7424e44218cd181d533c36588b411dddd5e6575", 0xe1}], 0x6, &(0x7f0000000840)={0x88, 0x0, 0x1, "748fdab31bc23126a91bda652ed1840f4a633a4f3a34cbec2c25d379bcd010e3f01106f59d5e3d77859902b875281b65b6409880b84c1dc565fac91bcbdc9ce9b35ea40cf9b473d4db3b2e8106e6c00b6a81e6895e6d33243b28d4cea584d44babd93cdb8155f478ffee9f161e31237ab2"}, 0x88, 0x10}, {&(0x7f0000000900)={0x27, 0x1, 0x2, 0x8dcc73f53010b815, 0xffffffff00000001, 0x287, "c5438950e4436c6419f24044b363376cd1fe7f9ef107b21c17096b6f511e048ca01cf31761ece875cc867fa9b26116aeef91e736ae1b17e530acf84f93e444", 0x29}, 0x60, &(0x7f0000000a00)=[{&(0x7f0000000980)="caba88f068f6a49cd4af501074e47277d3a1fa8a3e0ac63b5e84874f89148008bd7ce25beeadd70faa9e79d6555c90f3328233fff92dbcfcb1c2c341fc7aeffcce5fbd56", 0x44}, {&(0x7f0000004080)="d5599fe70c85362a012ebc027a769817368bb67d23ef54488d76e9233514bb388468203b05a6c89df50578d6f9d82ba2e713497962c76a5decfc49ecab2e933cfa870454c1598ad2d8d9ba21a404da202084962b3901e72b24b061707dd973759524bcfbf744eba3f9d23cbab63ff6fc0ab60e5e1385585381ff34af689313ed143d9be25a4f19931e1f60e00d7e7923ee41098603b6090be069461ca07a2c098b083c95f70b1a282ba396cd107479435ed3b08eef5b0b89e1573dcc791fee8313524a41c4b4470560c90b36e4c25bf93b0bd3ebb1c8ab79c00d3fd0063a229affbec8bf52e01292138ca2ff097a75711163776d7a049cd641324a6d4dc6895a06b16d0f4ad0410393c11a956b6ad531431d3ba721d204bc21447d0024064719ec6a4f1b06d8013225ecdc5fd61001395e3f6a9606b2183c2ccfb993992afed4bdc178774be7d7b4c1264b8421761bbf61ce00c024d13d7be3decf587fe17c60ba223c0c5354679d6cbc3119bc9a9fd96f5e4088d7932d9f019ede356f2913d23738371545d391c3d46789931c9bb74f15e80c40672f9bc56c5afbe23502f679128e5728b82630bb1c8633ee29a6fe99da5cb7ea1e1aa2cd853f9c8b7c4ef0261fb2f00e57a3ee1b5850331a0520e5310c64378dad28ce3946a57d6f6e50935a79d9fdda9dcddfb4e52f5f5dd493da3e8e1720b5a8c8ac9911bd3e0315b8690758471292855f3549ce90c62eb26e9732fa959c4ca99c1185ce4e4a0afd620e7106f26d4c1b05457b8fc33f083f2ecd837770f19ea51b590aefa2ce374e84e810e4fdb840ec63420b6faf02b98cc6e6fb858085ba74c5d6d38321e4a2ccb8f7f01901b60c455afc3faa9fe149cf18f8b3ec70a060fca89cf41455e0662e77d323428f9a462f9f3122a57975d70d9accfbe680b29adcaf307ebf1d5434c1b0d8b2d61a3ccd9af201739f277b9fe6102216fda8b9912a9f52556c7ef6b1c79d1b93be9757ae2e09bd9c9fc1f952cb734afbdd2e110394b0f66f1b8dff9bad180ef96fa74792ddc7bbec59a6858aede774829b82600091a7d9c01d2c4b00d7019d6546cbac17c0c3f0d83ca78b4f778ffcc8da08d501ee90e917a00c5d404ea0f2aa8544d76000f0a2714fda852ecd595b4a7cd9de1e15c77f0589ce93464361c9cc424030447fb7ad6c9691a1d8b2c3f5f9745c6a33458939833eb91d4f7f1621edacf38fd08ab5c96a959eb6500ca1ea3a0e55a8d7de4a171e8328a006501731e51d3b8ca638fddbc2e0f1b5b6762fb13263ac26a1f847dc5ef25e0c0e020c6f89bd5ff7fd81b464f2a40ba175aadd703980d6db619fd86de5526e80fb816371dd3939b50de5913cbe119d98b24c67778af2fe202e425ca8be3b7ef6687cde458234154356d72673cad7a4211c37656824e27be8aec2788c28475488bb8ce3608611f3ab1827c162f647511a75a6d69a77c1fdb5ca3263917517d833079e68b61b7bca172ca4dcac4167d326626034d2fe0fbdd28489cf2ae817cc49f37f60b4d42379b47cecf57b6434e82b68d91d9f57e362f5d90c2c50bf2ad595b7901cca4e4086efef937ad2081404e7d0be16481b83493f396d9c3b97b9dfa8b4b21b12f02d7ca2c4dd23c6a6e2c330e0341d9ba9560fda31c19108cb64ae28033a5e40952f1cec13043b534b0ef41799d4e807f50943196cc35787e81389ad6e2da1cd8a3a36e320bc9c17178434b84f147a165d4dd99ab1b581865114f103c62a1f8bb91a8d444fce737f4e38b056040348da2c02e7af200607a432e82bd8e3cd0f183e3e1f4982a0c3eb2c4fc3f46fccaffa5e2eca84d5b77916ce743d02e213c26a580f18ace3d4efff3137112bfe7ae864934a8cceabdc9b4cc7cf666fd47b6e2d42a6564faf4b45bb838f9c5737dbf3e34f5783794523c5b5999080e803697683e6228f7ab69cfc058d67b5250c468ce4a5561588dd807c91721472453570b1c1cd5f5aa9402a0f0e8a713e0d760e0e658fca0b9ab78b5c294f7576097341fee9ddea865359e96ffe9f5d0687dbc62f58b4f19a4f319c3ebf92042b4497aff5d6b4e89913a4218dc21c86c9d9ba0f17dcdbdfe30ec26bd3bb9b3f253a0867455f3399d980d2af91436642c9a87af5dc51ee65412f3d97aad171ac44be581072d1978bfae530d46afa493d8aa082c03d4999141981e85a0ea93e9bcfbe75d23d8c3398e4d76966f438286c0cf04f498a4d5c572f47ee407dad3aaf2d7aa7ddc06a99a88de3a5d15065236bf083a73ae39210bd8e051128d86d03d71758e41a3c79f443029ca10785bbfceaabf68fda04ee45e4d859ac192e721d669abcc375fca8606f6e422cb92cbef9463bd4a66943b0d08b31de320f54f82557bb328dd6c2e289097e8787ac06c15d38a1dee391e155cd40e05f5f86392f2875f2bd17f8917e983be089e2ac6e46d397ecfb03aef81159fd28d281405d247bfc2f7d8cd62207095782a7ece5317a9d5e70056f2602efb542730b4264b75ca8156bcce2d93671810a52543378eaf6df66c4de93411767dbdba566a9885b530dd2ebf8ce238dc783d0f83a3d8572252e72531ed2f0e89bda0d32958debec454d1a70d21b6ed54468ea9c7e1562bfcbe5ea06317df0b7ec6d8157ade9ad75824e4e43d350b75321d1300711a6d51404bcc6cc872594159aa8bec7d7531a1e54303aec8d0a52445dfe5e90bc2d9b195fa92e919837acda90f2ec3e1a1ec705f38d5fb610501597855627dae12978cbd787c2aef20d80b9123a0d83c3aa4c629f52de21a5485a14c8785cba97fc5b8bc796dd9aff04a4dc36d5adc3be0a5e3ee15b46dc226cb46fc670b3a768fc904fe796b90aa58b9a3bb1d215f23933490e81f01468e4476d10dfda3c95cdf4b26257b9ae9c47931231ea631b5984f172377cfb0bab5b8e8917cb5075ee4988364a78d9d6aca607e60069a767debaa611400d6553ad5c8618501c35b48e04441e2f538817c2eac8f7c0c3a9aa19d915bf3431772aa95e41efc14f786766888154a7bfc0d8efc6938e00ec36ebb1ef6bb47e529f8b854259622048328c96313d475346c03d2b3bd7959fa1b42da57ffcab49530fd6a93975f817743880d0e3eb6e2d295f7ee35d4b33a8a843e42dec0902e5ceaf9f1b930c49f9ad553ca924cb30085f8afed5b07f4d485aac50b667b12acea82d319a5d74014c3ca643eff077361c3728961a828cb0644051a291da785089743f51eb977c4e7dc5bb509d7ae6390a6cb991f34b7529c3dd20ba9cf4542ee18bccab6cb43f2590c92644a53c3060b80b14e707ae09869a70c978476f8ae55bc5740954387c2aee09c1290ecaa0d78cde6cd5591c828808065ea8bfd168fc7bd768f4e3a5c4fe6942cefbfe4d5200b613983b093ca059579d2a1dce1010dda7b491acd0beea215584bc2f25ef74dedaacc5f3aa583242fefb556422241d2a8da061310f46aaadd9088b50acbae1bc762f3e150826292de584f5902dba9161f17c77a25133149e5579d84af6d3c11d06a1957b26402721e3a26c1c14fc3fe9853999778ce003c4aa46b83d0de403ca8a77d7becad20a4f913f29e45d0eb87d2aaa97dea76b972336bb682c83bb5244281137ed43f8173560b7d33e1448c648d95d4bda373ca58af13c39da519950dff5786866aa70581c5c6577ea02af9a6f421351f00a7363794d0a2470e14400d9cdf17f7eaee0d3b8dcc01fb4634113af597cf2d4baa0899268e242f476b483cb533486053b77b8f6e9cd5d277ff0bf897db11f439797c6b825a712196757465b56818b3e52d8a4ea8bfdeb9ae9cb01b5ec4000724f3070825e33afe46967434c7d15b7241cd83e6b7083b2a42ac17a15eded5ae8744a16eb7d5dec5b18af0e3821b2546769e5c2158a8c648a3a6288406fa62d1abd7fa3486a162f034e514492304676c5b26475a3655f745dbd098f4d1e994e80f740cb21c3c9bff9c8497de6a689287b3cf29e40cc799f95188dbd3713d7b05281504111e3b5f37c62df78cfa7645b218bb689eee49e8df04202c31e8823aa03c41f71a55802a967da7ae6b7a76aaa6c739623c8ba9eadb54a5a948a4e0c426a162a2e507e9710bc2e497b1e1b130ee6202fca4d70889cdfe9cae365561fe0f2ba7a9d48bf0f120363b0507894919926f2a11e6028ee205a89f13da121cb8adf77cf0392f34d27fa6589a38d935916598ed2b97989bddc6fb5d263be24e6099bc9e0d7a8ad3e7fb1f17cc230298629642514a46d88a77bba6c298cb6edb25e25255307189947bb8a79af4063ed3499d772f0c2a143c07a51276b7bd1339277860c5d114fabf0b020189ec5057d5dae57a7206db0a5b85aedb459ab6e621e2c7aae5091f4b9a4c49669daaac4d9a853d692a87225b350d20779a1c9fd0941dbe7018e7a34349cdc9ad445cc4d955fe274d6ce6f03e482e7067593f811613e4951d70bba5a8322ca31719d9ebd9b85fa86632d608e0851d52504f591557c67ed4522c5babb89a963ee7839aad9debf868b631296f9ae37fa14b3fe20928ce682a49a561a6c6b4d5f019e8acb0a93a04a38c04a88df5213018a3b7938fd0a862dd0fa1865215bcbb15324399db7f3abeb441381d6c0750b66fea1b00640e248c9c0fcebccc9159bc1e211b284e33778f0b1fec93d931585e1a4567a642ca3eda6e908e37320d5f3a4e4b86ab8f8e7eab6935e4ac882d25d95dae292b4b3f3d74522a1bd0beb0e9114729cc291cc21b685955f71661b811e2efff8f11a1a6a06c2105635f0dd3be2542059bd34fa437f068e4b7631e093a9fa99a36492ebe7e4e0d9b4a1ef32cda47caf50f3799f9a89b98544764b86d323b7e3be2fd4b1944bd77bd7a53e4444fbcd38057dc539b9d78879fcabb39e5a169aa5f13c5832fc88c34aabd4b8effb589ed58f99b5c7fd3652f53abe1ed50a1803a95b33141916d50b6063ee9b067663cf2fd4b7975410196c4e00c465d5aaf8ab9a1d079ef3d7d49da6bfb0ca96d0870fcaaff1289bd17c6fbc611b4bf5b835f54ad44e54a5aec1576881015c31e03d7f472ef908f885ba4635bcc15cfcdeb2635ab61b29dcdef086807335f276c0510f8657a4c3dd391c3c6b36452b94938a4c809b28787e7f80dcabe96789ff633ca8a8ae3855084f04de350118d7349db6347b8cd58f678cbb0512eb5dc5ddd043c91338696a0f48953b87fa225295eb27913008fb62dbbec70368d5d56a052b98b920bd69f3ae5ae7216a2449caf295160347d9ce7bce7a94bf890877dfe83b36b16eeabd8aee92defd99191ad79c71e25f146888aa170646882a01f518a2f7d54a7446faf0af9e115c6e8dc37da3574c88d424650d14bcfe5f8f13ba7fef7f0ee723d4c8e07db35d5f00b955a979cdca9cc2c9cf84b581542009127c87b642173794d59f59e745f8f918b209e0ae44e1c7bbc066f6137fb38a414d22e3b8c88f05879353d31c87ca359a024af668812750b0375de4a62603dd3857030f4130546c5e33200caff77031da7426fa9e8545e1ff231265f8f5f6eee7187439ad28429aece644ce7652424e635db4df983b651eaba5ed1d5de78eb7dc45060d612700992df39ac88392445d63d93cf1ec235a97b112d8835eb51cf878a0152606d5e9375d040ec8bf4d81220b003a57739136d055d37da971d272b8b13b094da441ee92af07e22745a1bfcbcca04c7cebc5afb908a41bac85fb768c3314cc08c19f24848e51ea9fc6ec44775c3ac759da0619b3d85f2cfadd0576a80bd57144a5d16c9f", 0x1000}], 0x2, &(0x7f0000000a40)={0xd0, 0x11f, 0x61d, "92c7e9b870bd51585c064e0f571214119b7258bb062ceb028a05b3f78eb0732a238f3247aaf12571f54bcce0c6ef90f200a160f8b62396bf3e53a2f8c776259f40ad87c5ba704fd8b3dcd057dbdb048c0ff82b0bebb23c2baaa8747017608b9c50081021ad67d9c3c299502aa0e94aec754f69cb577a24faee22709ba0eb748135566b1947036fef46cb623c5428cc0245ea67e0d2629351fa907749c4bc0a65c4339475557a52940e68c61728b65b4909bf3d8df1060dfab2d48e9e39cbd21e"}, 0xd0, 0x4001}, {&(0x7f0000000b40)={0x27, 0x1, 0x0, 0x7, 0x0, 0x36b, "889e96e91a8dbb0210c226ad0eb688308008b407969dc774fe4a50dfd2496819ba078cb89956811ac0e62084f266a39be836017f6c77058c7b164485a3779c", 0x30}, 0x60, &(0x7f0000000e80)=[{&(0x7f0000000bc0)="46ae918c53bbcf2515790a43a0d1bbdb593adeadba74df076f0bb36a678bbcbd7f9bbda3bf4d76ef3e8a9f3d7d79cc8c2d38a765132fa4db2da8789d73c50c90b8acc73afa23d23410f15b575c51f131b1cbf558d2b455621b10b7354a646cc501c1990acb25584f60d6c8517a6a6eca25720656f64b08010ac798c8b6f1c2485e528ed506eff6dc9a7580beea3fb9e1efc53a65ff113573ed502a6a0802dd93f775011b31e350f5f67e23659580c6a3e595871001706c258b059b7eb7ceba2b8e42cbe10c5b1c3f5aec0074b44ccb74524fa41adf88eadc4c375d93409e97cccb98f921225e22383d94cc0e4dd4b32946918b27", 0xf4}, {&(0x7f0000000cc0)="a04658bc7ce8b5dd9e5fa9915070f62be64db571b15cfb9b8f9a171a31b8af3a", 0x20}, {&(0x7f0000000d00)='N', 0x1}, {&(0x7f0000000d40)="020d6d29809f40815d98772d5d0cc76dd9cc1491afce3f32a532f66b76a1c8832cc41bdeacd289a361ec861ecee992be92ec57a83dba3a9c84cbea33881b96b0f4eaf928f19498803c1b1c8b5f8fe82635c4a1ddc5251ac451643b1312f4fb23dedfe185fda2a7", 0x67}, {&(0x7f0000000dc0)="af71a05b8a5042ede8489d7a4a5559c13414997aad0daf5482da3abb9b557d4ebaf0bf19b1d36519e720", 0x2a}, {&(0x7f0000000e00)="1b4b31c85912745f26f81067a29fecd53404e17b0658308c2094d253459d14ebcb99a93161fafa2788da69ae1e21c3b58af2a8c25adc8534e2a9e9745017ca9994f5ec3faab1adbfcab373c61e35f7858607d8baa2048afdbcd08e3271611aef06", 0x61}], 0x6, 0x0, 0x0, 0x840}, {&(0x7f0000000f80)={0x27, 0x1, 0x0, 0x3eaaa6d51a640b30, 0x1ff, 0x200, "33b82d980540b212a9fbf7f1b70d08d03bb77642d1741411e78f6ff413dcb3d89ae83590760ac29945f57628ec518b4d25d7d6ab087887ac27d0f6c61aa4e3", 0x26}, 0x60, &(0x7f0000005540)=[{&(0x7f0000005080)="6dc7b00c1889eb11d24bda89d2270f142097e0fa9ab082979e1d8a69b3906bf5cb9f3f611f77320d70f0b8985f71250a7d1e9966da812a0e2aba6bab0790aa8ddfcef01e826ef99638de350fa913ce0e214f68f225e11aa304e2a8331eb11fe53ae06ac92fe88321d5eafedff9ecc5e5881276a15f756c48ade989ec6b6210472d866e99084d2f3668f2ab92de5620bc", 0x90}, {&(0x7f0000005140)="5fd0fe526e760b453a33747d6cce3ef7fbf9eb3d2723244903086101b6ea36bc136d50f76598c906778bbb0894f1a611385dbedf56d226e1f96b6678e0a794ab687acd08e639fd5b62c65941ccf0af6c4eefb51aed40b070699b93491590ef5ff977a576162d6610ffd984dcbd34f471f8460f2dc0b818c3abfb657b18139a8ccbeac45b74b5343860a7a010a1d2b28437a3d86abc3422e8749c3bab02a6bf89388a100bcb8dac0cd424be010e30b3e23a44a0a744d37b1fa6be1a84a5b1beadd2a38011a0949408e4804a6e595f643d503ac25c65f95da3dd48b72cccf2ea35eda369a31e7753", 0xe7}, {&(0x7f0000005240)="b90676b9ed2c5dc1a17ace64f81a51457dd7706d2696d63ca83a056a6cd326993686acdded8a3ba46d133e3a0fb5779c2e6fa4f5a8a8a5191baef2b215cc0c5de4e7369894203063851a90f98eb545223c69c85fa519d85792b665dcd9ff9c9b70f0759c7823ddd9dbe7f7ec1844cf6b7edbb44f9959b2703750545bf68174d710dfe805d7c4b6cfbae01de4675dfff820a2cfa526c0a4b074a732016b2b6da6f35632251c6ac78360072de9c9451ff01695247e868a1f20d869e0c6f6bc2d6a13649753320dae1060bc1443155933a4", 0xd0}, {&(0x7f0000000f00)="b314684298c5261ad5880b0d800faaf26d61cac55b8f92e3ec6f1ddb", 0x1c}, {&(0x7f0000005340)="8ef13f5fd700bd5afa8283c6576db4adf86b314b5465d676130f2feb982af6c38494525407deebb0a488cfa422e2ef0bb63e5e441944353e72e3a07c7c396745a8fc45e0af1dbf111720e343d329bb13aa856072d88d9d3d84ddb1f5c6f9", 0x5e}, {&(0x7f00000053c0)="480e367fa6d0cdc87a837a21a73284974ecd3f222686c81e57886cddf3bb2c492d84d7f3dc2c4a5d0232537744e9eaaaf34794539dae5f7378a5f98ad6d9c6ca1fc1eb3107c61f78e6eadfe8bb00b49375b65e1d6290ca7959e36496d31fd3fec7d184e4958b46402b442b0c7931e3", 0x6f}, {&(0x7f0000005440)="d47ad43ac6a991375f58c0b329f486b32b84548677e97a541532b881d7ba10240caf51c685df3298330773fb28be8cf92db48ab703471824d0c47b1c313141757702af6b798e1d6af8639318b654b8f56ad66571a104c01b040f572c04f337778d99a8852f8420a775623c6795bc74eb30e89a55d5d306eb85fdc7a8c1a50c39961a7179240a74c4c08b8b55880594ba4d154130bcb4d71669c57f0099835d756cf721209e32c194d4bf9f7ea2f1bde5a37bcb608c338b2bae051479680936b7bf7c61ef6a846db8a9efa6b48ee0539cecae6f4ca0128945b1576fbd105f5f3ff14fb6225719079c2f01", 0xea}], 0x7, &(0x7f00000055c0)={0x90, 0x111, 0x1, "ff06c3957076eaaf5ec07c8332596f14978a55e6321e2d9d45b2248e219f13ac3768a09c2ecc4b69fb3f34a35b50d7530d525a507ce1d0c8bc23f9f8864a5e05dafaca2e4edaf7c1b01491e4ec105e43c0db1141afb7cb9497db184c4084da986277f7b00a87c6a47a362185e51a194fa92add48b7079fb9265ecea0050c2c"}, 0x90, 0x40000}, {&(0x7f0000005680)={0x27, 0x1, 0x2, 0x7, 0x1, 0x8, "2e40394ef437e00fb2ecb844cbe4c3af94bc42842ed5b17c4be3d2c5270165b7b7afaa35e15002fee8b00ad26fd307a8e86d5a22644f1667dd3b72068b68b0", 0x23}, 0x60, &(0x7f0000005c80)=[{&(0x7f0000005700)="c47e0bab7a392c596e95bf981f84ead19c82bdd734a9bb17e179b2b43c78374d2ebf3673ba330cc2f44edd8b8a0ada8664ace7598075ffd979b3803bf3129807c6999d82112f6abcf0b77c71c15ead8a452fc00e0e07eec6333fee2b4ced73526aaef4d9f9cdc8f51f5fdc563c5ad110313b6abdf1be96149a8c4669d1", 0x7d}, {&(0x7f0000005780)="77e4325816a0eb37bdb24af801ad0b00392f4b082a019759dc144e0bece3aed29d3f3328f29aa5e6fb4bf23b447a7351e613e942aebe5777285b6ec102515a9211879fae47f68d06eaa1b675238dbd04e7e8d306c0c136bba5634a24d11356e6ce77c7f31e4466a9cd81ea983d86ded95b59046f902eff2e9ee631d9565f7d7b4f293c172734bef2ce8edbb6ab0760a9942d448aab14bc89cedb8ce1b8bdb6ac6671415c56d79a78fc85f47d15c8abc378ddc44bec233c437ab4cb3f7af58f473e0d9c8d0e0f5652766661ef889325214d78f10c3f218fc9fbe2063393", 0xdd}, {&(0x7f0000005880)="267531e533d81b2855c1f59d444294c6abe9adfb9c8e3e3fdfcebd9cd3bf8d2a7f46d3f512d7f1b54138d1f88d60c362f0241c9bf8b3cfb78227ae8a2da5085cd88d3d9e627b7e782aa4d07104e56af830a3192ef320e880ddbdfb07cc296784af2ad3c454ef6e0e43bcf349da4e92df6ca9ea16a5f80014cc8e1cec97a973d71e3792fde409793d5b5f89a9f371186212846d3adb784684e77e0d61c5764821fd22eb9195c7e1e49aaf7d09a5cb060cb66a577c51", 0xb5}, {&(0x7f0000005940)="d3de41c76eefd3456c43c201cd2f42923b4a2770b37ee4b8111d29f1078bb8eb7afb6da588e8387fcb20c631a60f878c59e29106b18080f7f7cae048466c239618eae0ad9c5911e9a058236b456c7bfe5ebb7a26b87eea1537e44d658eeeeffda1087632167c8fc286e15c682ea951338ebd5947a7ad46f2d766a0546b11b16b68c273c40a25688afb8ea72ecb636fbf6fff986fe8db2f4e8b989c4ca65141b1b819cf1d5e7737d4a7257d12fcbb1508dfba1438619e3999c01ae7c583ea04099a8925c4eb9c2c09c49f0101b69130bec717871d9aa2a9ad06693fbcff7b635551a96a758ca144b6a146ad60d4815e42cfdaba51dc39", 0xf6}, {&(0x7f0000005a40)="e7659950ec3f09400871805b005d179355199f72df7c1397895364552cf4ba2d3f4a83c203ebe8f5866ef8830965b330d9114735", 0x34}, {&(0x7f0000005a80)="6c6594aa2c66c193d9cf905760a63e26728bbbe8662ffcd02033e1087d055ff225f3a08cb5fd02a517e5e3cf7f01f649d9eb9c33e36f2a51877941a43d2967ec8395868bfbc23f07a04a2d498b6beccce759fdd33d37f5840074f4ae63c16427d1cab2fc582f47b503ec9ae7505a2c6ba176332b89619056c4bd7dcf24c2799773aeb71360", 0x85}, {&(0x7f0000005b40)="be542019a13afbf5d69c56e7f8eec8b8df9310f99c759f45416c81b325affe1d2ee03bfab48549b2e576a1b4c2a2fe813a4308a2377df48ef9221b6e5af79a7559ba74a080bd013cffcbe1877a43bd775a07abb989befa82c633524bcfeddfc9c07d6cbe9773f449a2b475eb0ec80312f1bf3c2e8d3b4146477e2f616a9b6b78389e13ecbf7bf21c0479c659217587bfb6c461251e428ad8d5f09461b36c3bb33b78b0327ea6fb32d166ba0f7c88426fe8d9e6b0fec2943193005b4fb1c8273b6fb06a482ff514e2e8f03b0e7333410a28667cd35913f746ae795fae54be2fed4ee0", 0xe2}, {&(0x7f0000005c40)="87577c12b2784e556918e70d2658e053cb588b261b9ceba97476", 0x1a}], 0x8, 0x0, 0x0, 0x48000}, {&(0x7f0000005d00)={0x27, 0x0, 0x1, 0x7, 0x3, 0x3, "e00808b5308cd98e3afaabd50e065d2345b8b27de68a90f1f18a1ad68faef3792fada7c8407ae692cc419bd6cd715c96c5e1f614034325b3dc7e9242cc2fa4", 0x32}, 0x60, &(0x7f0000005f80)=[{&(0x7f0000005d80)="7e2250c731bc6129d10f8eb775097c317c3caaf19093efb2f3bc02af510dbee5fee86e1ebec2f7bfcba293e8a4bba61b5db2115d4bcbe14670f0611183ce0854182212fbba93bb25ca103c704270ae325da8b3eaaa89b802f9de59167c581480f89fb6647b80477d9b677535c71adab8bedd7997396ad16a62c6de508e502130e83a407a7a7c70b33e2d4b580f30ccf1f6d8e249143277c34e805bd4c5fe407bb66036250043b12574dc8fcff7560ef16548bab0bf55e2b00322368bc3e114132e4b", 0xc2}, {&(0x7f0000005e80)="b1d3bab189bc20433de746bc5e608a8ee62ee5a86fec2048b64897a6b3716d10a25b5edca06d24748a96bbf06fab578b9c7d4dfbfc32ed6cbc11a23b69a444d309028e9f1eeee6182584a4bc33a8997a163203de93b28c39b04d84d3b4b99f808ab50b204eb39d24abc833867ea56f5abe8ed94646", 0x75}, {&(0x7f0000005f00)="fec352d5e6700ce012fe34923fdd41db434c7413af9606455c473110d9d83f833430eb61eae4f430f207e763647ac48eb4f6286db81ba98180fa0ed7bcdcfcf47dde3bdddc1f04700f5a66cc16321904c9c9d16366e13cac4ce22ac3bbb58ec7", 0x60}, {&(0x7f0000006000)="a1f49a767ba733d3120048820f34aeaac4e5564a07e833ec34e810d1d91fbd8bc5be5bb2f76ecf425f58e0667812c1d14e49d394ec88634c0906f2d50851643f270f29b915b502cbd152e362e882c86ba464c73188af8b3c2c6c9022e839a6530bb46219e13fcc624c913b138d8b3cf91d47b7844cdbbe321a78ac28e0c4fb92aa1956ed522d94188e6e85a4175387dc33c72de84c2753f68506e180debf8295a4e3146b5051d2921c6bfac3cef24090827974", 0xb3}], 0x4, &(0x7f00000060c0)={0xe0, 0x108, 0x4, "976377c7c2a68619419e904e49ff65ac270bdc748720a4fba36613cbd24d9af410dbd6d96c783fc6b06aa581b89b993cedef3a6bcf5156cb562d27b6e80c1de1f475619bd06871ad3aff2bf8fe762a675b55df44ff33aa2cb16b17c4db24b5a64a7a4ad1cb4f65cf53a91dd7ebb3d87b693f55951cc8d932093da96fb69942a90b8ec34e115c3ba279555f0105d5425a1709593eeb8c78514b2c26a86128fe7ecbda8ac77439d50019bb3b8779f62b0b9cc565226ec4f0d084821cfef4a29f6a455ab72d3620966fbcd799"}, 0xe0, 0x800}], 0x7, 0x0) pwrite64(r2, &(0x7f00000063c0)="68e8c2fe3ffdf2def4a964acf42bcaff96843861e1aa5cfe3d2bc54a570338769a812172b54b3198fa51850d96ba06807ced6f235efb1b7ece85e80a346f02f9358131918a7ca6f8189a8286133eae2c2e618b5140490f37071b0d912c30a579d14c225e6524cb51c65d3c8b30a61255caefb6588844c6a4762fa6483b57ad387f6aa60feccb709af487fe5d2fe327f90f88e34fb280d5e51e5f8b5194af36dd0fd3c264212592b0a82609e8298c15a73682f0caf8775c913e074f2965e89410b573eeb318eea4b69a6da076afaca140ca0732c71bc5b99ad64ce58f6add775023ca909257d6bded16e5b39c2715128fb1c7862767691cdfd431", 0xfa, 0x44) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffff9c, &(0x7f00000000c0)={0x0, 0x18, 0xfa00, {0x3, &(0x7f0000000040)={0xffffffffffffffff}, 0x106, 0x8}}, 0x20) bind$bt_rfcomm(r2, &(0x7f0000006380)={0x1f, {0x0, 0x7, 0x0, 0x81, 0x4, 0x800}, 0x5}, 0xa) write$RDMA_USER_CM_CMD_INIT_QP_ATTR(r2, &(0x7f0000000200)={0xb, 0x10, 0xfa00, {&(0x7f0000000140), r3, 0x1f}}, 0x18) r4 = add_key$keyring(&(0x7f0000000240)='keyring\x00', &(0x7f0000000280)={'syz', 0x3}, 0x0, 0x0, 0xfffffffffffffffb) r5 = add_key$keyring(&(0x7f00000002c0)='keyring\x00', &(0x7f0000000300)={'syz', 0x1}, 0x0, 0x0, 0xfffffffffffffffe) keyctl$unlink(0x9, r4, r5) 04:46:28 executing program 0: mkdir(&(0x7f0000000200)='./file0\x00', 0x0) r0 = openat$null(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/null\x00', 0x0, 0x0) r1 = syz_open_dev$sndpcmp(&(0x7f0000000240)='/dev/snd/pcmC#D#p\x00', 0x4, 0x80000) linkat(r0, &(0x7f00000001c0)='./file1\x00', r1, &(0x7f0000000340)='./file0\x00', 0x400) mount(&(0x7f00000002c0)=ANY=[], &(0x7f0000001540)='./file0\x00', &(0x7f0000000280)='tmpfs\x00', 0x0, &(0x7f0000000080)) r2 = open$dir(&(0x7f0000000180)='./file0\x00', 0x0, 0x0) mlock2(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1) mknodat(r2, &(0x7f0000000140)='./file0\x00', 0x0, 0x0) r3 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000000)='/dev/hwrng\x00', 0x12000, 0x0) accept4$unix(r3, &(0x7f00000002c0)=@abs, &(0x7f0000000040)=0x6e, 0x80000) renameat2(r2, &(0x7f0000000080)='./file0\x00', r2, &(0x7f0000000100)='./file1\x00', 0x4) 04:46:28 executing program 4: ioctl$KVM_IRQ_LINE(0xffffffffffffffff, 0x4008ae61, &(0x7f0000000500)) r0 = syz_open_dev$dspn(&(0x7f00000004c0)='/dev/dsp#\x00', 0x1, 0x0) openat$audio(0xffffffffffffff9c, &(0x7f0000000000)='/dev/audio\x00', 0x80, 0x0) ioctl$KVM_SET_FPU(0xffffffffffffffff, 0x41a0ae8d, &(0x7f0000000100)={[], 0x0, 0x5531fee, 0x0, 0x0, 0x9, 0xf000, 0x0, [], 0x5}) syz_open_dev$usb(&(0x7f0000000440)='/dev/bus/usb/00#/00#\x00', 0x9, 0x2) r1 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) lstat(&(0x7f0000000040)='./file0/file0\x00', &(0x7f0000000080)) ioctl$EXT4_IOC_MIGRATE(0xffffffffffffffff, 0x6609) sendmmsg$unix(0xffffffffffffffff, &(0x7f000000a000)=[{&(0x7f000000a000)=@abs, 0x6e, &(0x7f000000d000), 0x0, &(0x7f0000000600)=ANY=[]}], 0x1, 0x0) r2 = socket$inet6(0xa, 0x2, 0x0) gettid() r3 = getpgid(0x0) kcmp(0x0, r3, 0x0, 0xffffffffffffffff, 0xffffffffffffffff) connect$inet6(r2, &(0x7f0000002740)={0xa, 0x0, 0x0, @mcast2, 0x4}, 0x1c) sendmmsg(r2, &(0x7f0000007e00), 0x136a88c8311572c, 0x200000000000000) setsockopt$inet6_udp_int(r2, 0x11, 0x0, &(0x7f0000000400), 0x4) openat$kvm(0xffffffffffffff9c, &(0x7f00000003c0)='/dev/kvm\x00', 0x0, 0x0) ioctl$VHOST_SET_VRING_CALL(0xffffffffffffff9c, 0x4008af21, &(0x7f00000002c0)={0x0, r1}) ioctl$SNDRV_TIMER_IOCTL_TREAD(r0, 0x40045402, &(0x7f0000000740)) inotify_rm_watch(0xffffffffffffffff, 0x0) ioctl$ifreq_SIOCGIFINDEX_team(0xffffffffffffffff, 0x8933, &(0x7f0000000480)={'team0\x00'}) 04:46:28 executing program 3: r0 = syz_open_dev$sg(&(0x7f00000000c0)='/dev/sg#\x00', 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000000)={0x53, 0x0, 0x6, 0x0, @buffer={0x209, 0xb8, &(0x7f00000001c0)=""/184}, &(0x7f0000000540)="ad40657ed56c", &(0x7f0000000340)=""/128, 0x0, 0x2f000000, 0x0, &(0x7f0000000040)}) [ 642.885279] tmpfs: No value for mount option './file0' 04:46:29 executing program 3: r0 = syz_open_dev$sg(&(0x7f00000000c0)='/dev/sg#\x00', 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000000)={0x53, 0x0, 0x6, 0x0, @buffer={0x209, 0xb8, &(0x7f00000001c0)=""/184}, &(0x7f0000000540)="ad40657ed56c", &(0x7f0000000340)=""/128, 0x0, 0x600, 0x0, &(0x7f0000000040)}) 04:46:29 executing program 0: mount(&(0x7f0000000000)=@nullb='/dev/nullb0\x00', &(0x7f0000000040)='./file1\x00', &(0x7f00000000c0)='debugfs\x00', 0x110c0, &(0x7f00000001c0)='\x00\x00') mkdir(&(0x7f0000000200)='./file0\x00', 0x0) mount(&(0x7f00000002c0)=ANY=[], &(0x7f0000001540)='./file0\x00', &(0x7f0000000280)='tmpfs\x00', 0x0, &(0x7f0000000080)) r0 = open$dir(&(0x7f0000000180)='./file0\x00', 0x0, 0x0) mknodat(r0, &(0x7f0000000140)='./file0\x00', 0x0, 0x0) renameat2(r0, &(0x7f00000002c0)='./file0\x00', r0, &(0x7f0000000100)='./file1\x00', 0x4) 04:46:29 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rtc0\x00', 0x4000, 0x0) ioctl$EVIOCGABS0(r1, 0x80184540, &(0x7f0000001040)=""/4096) ioctl$BINDER_THREAD_EXIT(r1, 0x40046208, 0x0) r2 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000005fd4)=ANY=[@ANYBLOB="0d23044000000000"], 0x0, 0x0, &(0x7f0000012fc7)}) close(r0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="000000fb0000000087219c836a8c6ef0085a89f9c10c70e897979d077c02f313c55dc5e86245095347ff00199409523e4d7e31db21176287ae"], 0x0, 0x0, &(0x7f0000000f4d)}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000100)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0xfffffffffffffc2b, 0x0, &(0x7f0000000680)}) [ 643.066844] binder: 24036:24038 unknown command 1074012941 [ 643.096417] binder: 24036:24038 ioctl c0306201 20012000 returned -22 [ 643.158717] binder: 24036:24038 unknown command -83886080 [ 643.185358] binder: 24036:24038 ioctl c0306201 20008fd0 returned -22 04:46:29 executing program 1: r0 = perf_event_open(&(0x7f000025c000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x11, 0xffffffffffffffff, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r0, 0x2405, r1) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x1000004, 0x8031, 0xffffffffffffffff, 0x0) 04:46:29 executing program 5: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000480)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_GUEST_DEBUG(r3, 0x4048ae9b, &(0x7f0000000140)={0x1}) syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000100)=[@text32={0x20, &(0x7f0000000000)="6601669b0f35c4e1fe16846ba49e0000b9940200000f32c4c23dad78e0b9670900000f32660f38827f95b0040f01d10fc71a", 0x32}], 0x1, 0x0, &(0x7f0000000040), 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r3, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000400)=[@text32={0x20, &(0x7f0000000880)="b805000000b98b9400000f01c19a01000000b0000f43d1b8000000000f23d80f21f835800000900f23f80f060f2140b9800000c00f3235000800000f3066ba4300b8f1ffffffefb9800000c00f3235002000000f30c4c3295f4da400", 0x5c}], 0x26433e1, 0x0, &(0x7f0000000300), 0x10000000000000b6) ioctl$KVM_RUN(r3, 0xae80, 0x3f00000000000000) 04:46:29 executing program 3: r0 = syz_open_dev$sg(&(0x7f00000000c0)='/dev/sg#\x00', 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000000)={0x53, 0x0, 0x6, 0x0, @buffer={0x209, 0xb8, &(0x7f00000001c0)=""/184}, &(0x7f0000000540)="ad40657ed56c", &(0x7f0000000340)=""/128, 0x0, 0x7ffff000, 0x0, &(0x7f0000000040)}) 04:46:29 executing program 0: mkdir(&(0x7f0000000200)='./file0\x00', 0x0) mount(&(0x7f00000002c0)=ANY=[], &(0x7f0000001540)='./file0\x00', &(0x7f0000000280)='tmpfs\x00', 0x0, &(0x7f0000000080)) setxattr$trusted_overlay_origin(&(0x7f0000000000)='./file1\x00', &(0x7f0000000040)='trusted.overlay.origin\x00', &(0x7f00000000c0)='y\x00', 0x2, 0x0) r0 = open$dir(&(0x7f0000000180)='./file0\x00', 0x0, 0x0) mknodat(r0, &(0x7f0000000140)='./file0\x00', 0x0, 0x0) renameat2(r0, &(0x7f0000000080)='./file1\x00', r0, &(0x7f0000000240)='./file1\x00', 0x4) socket$unix(0x1, 0x5, 0x0) mkdir(&(0x7f00000001c0)='./file1\x00', 0x101) 04:46:29 executing program 4: ioctl$KVM_IRQ_LINE(0xffffffffffffffff, 0x4008ae61, &(0x7f0000000500)) r0 = syz_open_dev$dspn(&(0x7f00000004c0)='/dev/dsp#\x00', 0x1, 0x0) openat$audio(0xffffffffffffff9c, &(0x7f0000000000)='/dev/audio\x00', 0x80, 0x0) ioctl$KVM_SET_FPU(0xffffffffffffffff, 0x41a0ae8d, &(0x7f0000000100)={[], 0x0, 0x5531fee, 0x0, 0x0, 0x9, 0xf000, 0x0, [], 0x5}) syz_open_dev$usb(&(0x7f0000000440)='/dev/bus/usb/00#/00#\x00', 0x9, 0x2) r1 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) lstat(&(0x7f0000000040)='./file0/file0\x00', &(0x7f0000000080)) ioctl$EXT4_IOC_MIGRATE(0xffffffffffffffff, 0x6609) sendmmsg$unix(0xffffffffffffffff, &(0x7f000000a000)=[{&(0x7f000000a000)=@abs, 0x6e, &(0x7f000000d000), 0x0, &(0x7f0000000600)=ANY=[]}], 0x1, 0x0) r2 = socket$inet6(0xa, 0x2, 0x0) gettid() r3 = getpgid(0x0) kcmp(0x0, r3, 0x0, 0xffffffffffffffff, 0xffffffffffffffff) connect$inet6(r2, &(0x7f0000002740)={0xa, 0x0, 0x0, @mcast2, 0x4}, 0x1c) sendmmsg(r2, &(0x7f0000007e00), 0x136a88c8311572c, 0x2000000000000000) setsockopt$inet6_udp_int(r2, 0x11, 0x0, &(0x7f0000000400), 0x4) openat$kvm(0xffffffffffffff9c, &(0x7f00000003c0)='/dev/kvm\x00', 0x0, 0x0) ioctl$VHOST_SET_VRING_CALL(0xffffffffffffff9c, 0x4008af21, &(0x7f00000002c0)={0x0, r1}) ioctl$SNDRV_TIMER_IOCTL_TREAD(r0, 0x40045402, &(0x7f0000000740)) inotify_rm_watch(0xffffffffffffffff, 0x0) ioctl$ifreq_SIOCGIFINDEX_team(0xffffffffffffffff, 0x8933, &(0x7f0000000480)={'team0\x00'}) 04:46:29 executing program 0: mkdir(&(0x7f0000000200)='./file0\x00', 0x0) mount(&(0x7f00000002c0)=ANY=[], &(0x7f0000001540)='./file0\x00', &(0x7f0000000280)='tmpfs\x00', 0x0, &(0x7f0000000080)) r0 = open$dir(&(0x7f0000000180)='./file0\x00', 0x0, 0x0) mknodat(r0, &(0x7f0000000140)='./file0\x00', 0x0, 0x0) renameat2(r0, &(0x7f0000000080)='./file0\x00', r0, &(0x7f0000000000)='./file1\x00', 0x4) [ 643.430677] tmpfs: No value for mount option './file1' 04:46:29 executing program 3: r0 = syz_open_dev$sg(&(0x7f00000000c0)='/dev/sg#\x00', 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000000)={0x53, 0x0, 0x6, 0x0, @buffer={0x209, 0xb8, &(0x7f00000001c0)=""/184}, &(0x7f0000000540)="ad40657ed56c", &(0x7f0000000340)=""/128, 0x0, 0xf0ffffff7f0000, 0x0, &(0x7f0000000040)}) [ 643.569134] tmpfs: No value for mount option './file0' 04:46:29 executing program 3: r0 = syz_open_dev$sg(&(0x7f00000000c0)='/dev/sg#\x00', 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000000)={0x53, 0x0, 0x6, 0x0, @buffer={0x209, 0xb8, &(0x7f00000001c0)=""/184}, &(0x7f0000000540)="ad40657ed56c", &(0x7f0000000340)=""/128, 0x0, 0xf6ffffff, 0x0, &(0x7f0000000040)}) 04:46:29 executing program 5: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000480)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_GUEST_DEBUG(r3, 0x4048ae9b, &(0x7f0000000140)={0x1}) syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000100)=[@text32={0x20, &(0x7f0000000000)="6601669b0f35c4e1fe16846ba49e0000b9940200000f32c4c23dad78e0b9670900000f32660f38827f95b0040f01d10fc71a", 0x32}], 0x1, 0x0, &(0x7f0000000040), 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r3, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000400)=[@text32={0x20, &(0x7f0000000880)="b805000000b98b9400000f01c19a01000000b0000f43d1b8000000000f23d80f21f835800000900f23f80f060f2140b9800000c00f3235000800000f3066ba4300b8f1ffffffefb9800000c00f3235002000000f30c4c3295f4da400", 0x5c}], 0x26433e1, 0x0, &(0x7f0000000300), 0x10000000000000b6) ioctl$KVM_RUN(r3, 0xae80, 0x6000) 04:46:29 executing program 0: mkdir(&(0x7f0000000200)='./file0\x00', 0x0) r0 = openat$autofs(0xffffffffffffff9c, &(0x7f0000000000)='/dev/autofs\x00', 0x404280, 0x0) ioctl$KVM_UNREGISTER_COALESCED_MMIO(r0, 0x4010ae68, &(0x7f0000000040)={0x5002, 0x8000}) mount(&(0x7f00000002c0)=ANY=[], &(0x7f0000001540)='./file0\x00', &(0x7f0000000280)='tmpfs\x00', 0x0, &(0x7f0000000080)) r1 = open$dir(&(0x7f0000000180)='./file0\x00', 0x0, 0x0) mknodat(r1, &(0x7f0000000140)='./file0\x00', 0x0, 0x0) renameat2(r1, &(0x7f0000000080)='./file0\x00', r1, &(0x7f0000000100)='./file1\x00', 0x4) 04:46:29 executing program 3: r0 = syz_open_dev$sg(&(0x7f00000000c0)='/dev/sg#\x00', 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000000)={0x53, 0x0, 0x6, 0x0, @buffer={0x209, 0xb8, &(0x7f00000001c0)=""/184}, &(0x7f0000000540)="ad40657ed56c", &(0x7f0000000340)=""/128, 0x0, 0x9020000, 0x0, &(0x7f0000000040)}) [ 643.855859] binder: 24036:24041 unknown command 1074012941 [ 643.861841] binder: 24036:24041 ioctl c0306201 20012000 returned -22 [ 643.879698] binder: 24036:24079 unknown command -83886080 [ 643.906536] binder: 24036:24079 ioctl c0306201 20008fd0 returned -22 [ 643.917560] tmpfs: No value for mount option './file0' 04:46:30 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = creat(&(0x7f00000001c0)='./file0\x00', 0x8) ioctl$UI_GET_SYSNAME(r2, 0x8040552c, &(0x7f0000000200)) socketpair$inet6_tcp(0xa, 0x1, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) getsockopt$sock_timeval(r3, 0x1, 0x15, &(0x7f0000000140), &(0x7f0000000180)=0x10) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, &(0x7f0000012fc7)}) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=ANY=[@ANYBLOB="0e04004000000000"], 0x0, 0x0, &(0x7f0000000f4d)}) fsetxattr$trusted_overlay_opaque(r0, &(0x7f0000000000)='trusted.overlay.opaque\x00', &(0x7f0000000040)='y\x00', 0x2, 0x3) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000100)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0xfffffffffffffc2b, 0x0, &(0x7f0000000680)}) [ 644.080920] binder: 24087:24088 unknown command 1073742862 [ 644.094456] binder: 24087:24088 ioctl c0306201 20008fd0 returned -22 04:46:30 executing program 0: mkdir(&(0x7f0000000200)='./file0\x00', 0x0) r0 = syz_open_dev$midi(&(0x7f0000000000)='/dev/midi#\x00', 0xfffffffffffffff8, 0x200) rename(&(0x7f0000000040)='./file1\x00', &(0x7f00000000c0)='./file0\x00') ioctl$KVM_GET_IRQCHIP(r0, 0xc208ae62, &(0x7f00000002c0)) mount(&(0x7f00000002c0)=ANY=[], &(0x7f0000001540)='./file0\x00', &(0x7f0000000280)='tmpfs\x00', 0x0, &(0x7f0000000080)) r1 = open$dir(&(0x7f0000000180)='./file0\x00', 0x0, 0x0) mknodat(r1, &(0x7f0000000140)='./file0\x00', 0x1, 0x0) renameat2(r1, &(0x7f0000000080)='./file0\x00', r1, &(0x7f0000000100)='./file1\x00', 0x4) 04:46:30 executing program 3: r0 = syz_open_dev$sg(&(0x7f00000000c0)='/dev/sg#\x00', 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000000)={0x53, 0x0, 0x6, 0x0, @buffer={0x209, 0xb8, &(0x7f00000001c0)=""/184}, &(0x7f0000000540)="ad40657ed56c", &(0x7f0000000340)=""/128, 0x0, 0x8000a0ffffffff, 0x0, &(0x7f0000000040)}) 04:46:30 executing program 5: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000480)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_GUEST_DEBUG(r3, 0x4048ae9b, &(0x7f0000000140)={0x1}) syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000100)=[@text32={0x20, &(0x7f0000000000)="6601669b0f35c4e1fe16846ba49e0000b9940200000f32c4c23dad78e0b9670900000f32660f38827f95b0040f01d10fc71a", 0x32}], 0x1, 0x0, &(0x7f0000000040), 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r3, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000400)=[@text32={0x20, &(0x7f0000000880)="b805000000b98b9400000f01c19a01000000b0000f43d1b8000000000f23d80f21f835800000900f23f80f060f2140b9800000c00f3235000800000f3066ba4300b8f1ffffffefb9800000c00f3235002000000f30c4c3295f4da400", 0x5c}], 0x26433e1, 0x0, &(0x7f0000000300), 0x10000000000000b6) ioctl$KVM_RUN(r3, 0xae80, 0x1800000000000000) 04:46:30 executing program 1: r0 = perf_event_open(&(0x7f000025c000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x11, 0xffffffffffffffff, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r0, 0x2405, r1) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x1000004, 0x8031, 0xffffffffffffffff, 0x0) 04:46:30 executing program 4: ioctl$KVM_IRQ_LINE(0xffffffffffffffff, 0x4008ae61, &(0x7f0000000500)) r0 = syz_open_dev$dspn(&(0x7f00000004c0)='/dev/dsp#\x00', 0x1, 0x0) openat$audio(0xffffffffffffff9c, &(0x7f0000000000)='/dev/audio\x00', 0x80, 0x0) ioctl$KVM_SET_FPU(0xffffffffffffffff, 0x41a0ae8d, &(0x7f0000000100)={[], 0x0, 0x5531fee, 0x0, 0x0, 0x9, 0xf000, 0x0, [], 0x5}) syz_open_dev$usb(&(0x7f0000000440)='/dev/bus/usb/00#/00#\x00', 0x9, 0x2) r1 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) lstat(&(0x7f0000000040)='./file0/file0\x00', &(0x7f0000000080)) ioctl$EXT4_IOC_MIGRATE(0xffffffffffffffff, 0x6609) sendmmsg$unix(0xffffffffffffffff, &(0x7f000000a000)=[{&(0x7f000000a000)=@abs, 0x6e, &(0x7f000000d000), 0x0, &(0x7f0000000600)=ANY=[]}], 0x1, 0x0) r2 = socket$inet6(0xa, 0x2, 0x0) gettid() r3 = getpgid(0x0) kcmp(0x0, r3, 0x0, 0xffffffffffffffff, 0xffffffffffffffff) connect$inet6(r2, &(0x7f0000002740)={0xa, 0x0, 0x0, @mcast2, 0x4}, 0x1c) sendmmsg(r2, &(0x7f0000007e00), 0x136a88c8311572c, 0x9000000) setsockopt$inet6_udp_int(r2, 0x11, 0x0, &(0x7f0000000400), 0x4) openat$kvm(0xffffffffffffff9c, &(0x7f00000003c0)='/dev/kvm\x00', 0x0, 0x0) ioctl$VHOST_SET_VRING_CALL(0xffffffffffffff9c, 0x4008af21, &(0x7f00000002c0)={0x0, r1}) ioctl$SNDRV_TIMER_IOCTL_TREAD(r0, 0x40045402, &(0x7f0000000740)) inotify_rm_watch(0xffffffffffffffff, 0x0) ioctl$ifreq_SIOCGIFINDEX_team(0xffffffffffffffff, 0x8933, &(0x7f0000000480)={'team0\x00'}) [ 644.268646] tmpfs: No value for mount option './file0' 04:46:30 executing program 3: r0 = syz_open_dev$sg(&(0x7f00000000c0)='/dev/sg#\x00', 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000000)={0x53, 0x0, 0x6, 0x0, @buffer={0x209, 0xb8, &(0x7f00000001c0)=""/184}, &(0x7f0000000540)="ad40657ed56c", &(0x7f0000000340)=""/128, 0x0, 0xfcffffff00000000, 0x0, &(0x7f0000000040)}) 04:46:30 executing program 0: mkdir(&(0x7f0000000200)='./file0\x00', 0x0) mknod$loop(&(0x7f0000000000)='./file1\x00', 0xa0, 0x1) mount(&(0x7f00000002c0)=ANY=[], &(0x7f0000001540)='./file0\x00', &(0x7f0000000280)='tmpfs\x00', 0x0, &(0x7f0000000080)) r0 = open$dir(&(0x7f0000000180)='./file0\x00', 0x0, 0x0) mknodat(r0, &(0x7f0000000140)='./file0\x00', 0x0, 0x0) renameat2(r0, &(0x7f0000000080)='./file0\x00', r0, &(0x7f0000000100)='./file1\x00', 0x4) recvmmsg(0xffffffffffffff9c, &(0x7f00000001c0)=[{{&(0x7f00000002c0)=@pppol2tpv3in6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @local}}}, 0x80, &(0x7f0000000040)=[{&(0x7f0000000340)=""/106, 0x6a}, {&(0x7f00000003c0)=""/195, 0xc3}], 0x2, &(0x7f00000000c0)=""/23, 0x17}, 0x6}], 0x1, 0x10002, 0x0) getsockopt$inet_IP_XFRM_POLICY(0xffffffffffffff9c, 0x0, 0x11, &(0x7f00000004c0)={{{@in6=@mcast1, @in=@remote, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@remote}, 0x0, @in=@multicast1}}, &(0x7f0000000240)=0xe8) ioctl$sock_inet6_SIOCDIFADDR(r1, 0x8936, &(0x7f00000005c0)={@mcast1, 0x48, r2}) 04:46:30 executing program 3: r0 = syz_open_dev$sg(&(0x7f00000000c0)='/dev/sg#\x00', 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000000)={0x53, 0x0, 0x6, 0x0, @buffer={0x209, 0xb8, &(0x7f00000001c0)=""/184}, &(0x7f0000000540)="ad40657ed56c", &(0x7f0000000340)=""/128, 0x0, 0x600000000000000, 0x0, &(0x7f0000000040)}) 04:46:30 executing program 5: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000480)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_GUEST_DEBUG(r3, 0x4048ae9b, &(0x7f0000000140)={0x1}) syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000100)=[@text32={0x20, &(0x7f0000000000)="6601669b0f35c4e1fe16846ba49e0000b9940200000f32c4c23dad78e0b9670900000f32660f38827f95b0040f01d10fc71a", 0x32}], 0x1, 0x0, &(0x7f0000000040), 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r3, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000400)=[@text32={0x20, &(0x7f0000000880)="b805000000b98b9400000f01c19a01000000b0000f43d1b8000000000f23d80f21f835800000900f23f80f060f2140b9800000c00f3235000800000f3066ba4300b8f1ffffffefb9800000c00f3235002000000f30c4c3295f4da400", 0x5c}], 0x26433e1, 0x0, &(0x7f0000000300), 0x10000000000000b6) ioctl$KVM_RUN(r3, 0xae80, 0x600000000000000) [ 644.596608] tmpfs: No value for mount option './file0' 04:46:30 executing program 3: r0 = syz_open_dev$sg(&(0x7f00000000c0)='/dev/sg#\x00', 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000000)={0x53, 0x0, 0x6, 0x0, @buffer={0x209, 0xb8, &(0x7f00000001c0)=""/184}, &(0x7f0000000540)="ad40657ed56c", &(0x7f0000000340)=""/128, 0x0, 0xa0008000, 0x0, &(0x7f0000000040)}) 04:46:30 executing program 4: ioctl$KVM_IRQ_LINE(0xffffffffffffffff, 0x4008ae61, &(0x7f0000000500)) r0 = syz_open_dev$dspn(&(0x7f00000004c0)='/dev/dsp#\x00', 0x1, 0x0) r1 = openat$audio(0xffffffffffffff9c, &(0x7f0000000000)='/dev/audio\x00', 0x80, 0x0) ioctl$KVM_SET_FPU(0xffffffffffffffff, 0x41a0ae8d, &(0x7f0000000100)={[], 0x0, 0x5531fee, 0x0, 0x0, 0x9, 0xf000, 0x0, [], 0x5}) syz_open_dev$usb(&(0x7f0000000440)='/dev/bus/usb/00#/00#\x00', 0x9, 0x2) r2 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) lstat(&(0x7f0000000040)='./file0/file0\x00', &(0x7f0000000080)) ioctl$EXT4_IOC_MIGRATE(0xffffffffffffffff, 0x6609) sendmmsg$unix(0xffffffffffffffff, &(0x7f000000a000)=[{&(0x7f000000a000)=@abs, 0x6e, &(0x7f000000d000), 0x0, &(0x7f0000000600)=ANY=[]}], 0x1, 0x0) r3 = socket$inet6(0xa, 0x2, 0x0) gettid() r4 = getpgid(0x0) kcmp(0x0, r4, 0x0, 0xffffffffffffffff, 0xffffffffffffffff) ioctl$DRM_IOCTL_RM_MAP(r1, 0x4028641b, &(0x7f0000000300)={&(0x7f0000ffd000/0x1000)=nil, 0x3ff, 0x7, 0x18, &(0x7f0000ffb000/0x3000)=nil, 0x2}) connect$inet6(r3, &(0x7f0000002740)={0xa, 0x0, 0x0, @mcast2, 0x4}, 0x1c) sendmmsg(r3, &(0x7f0000007e00), 0x136a88c8311572c, 0x0) setsockopt$inet6_udp_int(r3, 0x11, 0x0, &(0x7f0000000400), 0x4) openat$kvm(0xffffffffffffff9c, &(0x7f00000003c0)='/dev/kvm\x00', 0x0, 0x0) ioctl$VHOST_SET_VRING_CALL(0xffffffffffffff9c, 0x4008af21, &(0x7f00000002c0)={0x0, r2}) ioctl$SNDRV_TIMER_IOCTL_TREAD(r0, 0x40045402, &(0x7f0000000740)) inotify_rm_watch(0xffffffffffffffff, 0x0) ioctl$ifreq_SIOCGIFINDEX_team(0xffffffffffffffff, 0x8933, &(0x7f0000000480)={'team0\x00'}) [ 644.880759] binder: 24087:24132 unknown command 1073742862 [ 644.896700] binder: 24087:24132 ioctl c0306201 20008fd0 returned -22 04:46:31 executing program 2: r0 = accept4$inet(0xffffffffffffffff, &(0x7f0000000000)={0x2, 0x0, @broadcast}, &(0x7f0000000040)=0x10, 0x800) getsockopt$inet_sctp_SCTP_GET_ASSOC_STATS(0xffffffffffffffff, 0x84, 0x70, &(0x7f0000000140)={0x0, @in={{0x2, 0x4e21, @dev={0xac, 0x14, 0x14, 0x18}}}, [0xfff, 0x8, 0xa30, 0x8001, 0x0, 0x0, 0x8, 0x8, 0xffffffff, 0x42, 0x1, 0xfffffffffffffffe, 0x3, 0xa760, 0x80000001]}, &(0x7f00000000c0)=0x100) getsockopt$inet_sctp_SCTP_PARTIAL_DELIVERY_POINT(r0, 0x84, 0x13, &(0x7f0000000240)={r1, 0x800}, &(0x7f0000000280)=0x8) r2 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) r3 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, &(0x7f0000012fc7)}) close(r2) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, &(0x7f0000000f4d)}) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000100)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0xfffffffffffffc2b, 0x0, &(0x7f0000000680)}) 04:46:31 executing program 0: mkdir(&(0x7f0000000200)='./file0\x00', 0x0) mount(&(0x7f00000002c0)=ANY=[], &(0x7f0000001540)='./file0\x00', &(0x7f0000000280)='tmpfs\x00', 0x0, &(0x7f0000000080)) r0 = open$dir(&(0x7f0000000180)='./file0\x00', 0x0, 0x0) mknodat(r0, &(0x7f0000000140)='./file0\x00', 0x0, 0x0) r1 = memfd_create(&(0x7f0000000380)='tmpfs\x00', 0x4) ioctl$KDSKBLED(r1, 0x4b65, 0x6fb) mknodat(r1, &(0x7f0000000400)='./file0\x00', 0xc000, 0x40) llistxattr(&(0x7f00000001c0)='./file1\x00', &(0x7f0000000240)=""/54, 0x36) r2 = openat(r0, &(0x7f0000000000)='./file1\x00', 0x2, 0x0) ioctl$TIOCGWINSZ(r2, 0x5413, &(0x7f0000000040)) renameat2(r0, &(0x7f0000000080)='./file0\x00', r0, &(0x7f0000000100)='./file1\x00', 0x4) llistxattr(&(0x7f00000000c0)='./file0\x00', &(0x7f0000000500)=""/130, 0x82) ioctl$TCSETAW(r1, 0x5407, &(0x7f00000003c0)={0x4, 0x20, 0x4, 0x251, 0x2, 0x4, 0xa, 0x6, 0xff, 0x7f}) 04:46:31 executing program 5: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000480)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_GUEST_DEBUG(r3, 0x4048ae9b, &(0x7f0000000140)={0x1}) syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000100)=[@text32={0x20, &(0x7f0000000000)="6601669b0f35c4e1fe16846ba49e0000b9940200000f32c4c23dad78e0b9670900000f32660f38827f95b0040f01d10fc71a", 0x32}], 0x1, 0x0, &(0x7f0000000040), 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r3, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000400)=[@text32={0x20, &(0x7f0000000880)="b805000000b98b9400000f01c19a01000000b0000f43d1b8000000000f23d80f21f835800000900f23f80f060f2140b9800000c00f3235000800000f3066ba4300b8f1ffffffefb9800000c00f3235002000000f30c4c3295f4da400", 0x5c}], 0x26433e1, 0x0, &(0x7f0000000300), 0x10000000000000b6) ioctl$KVM_RUN(r3, 0xae80, 0x1800) 04:46:31 executing program 3: r0 = syz_open_dev$sg(&(0x7f00000000c0)='/dev/sg#\x00', 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000000)={0x53, 0x0, 0x6, 0x0, @buffer={0x209, 0xb8, &(0x7f00000001c0)=""/184}, &(0x7f0000000540)="ad40657ed56c", &(0x7f0000000340)=""/128, 0x0, 0x6000000, 0x0, &(0x7f0000000040)}) [ 645.074752] tmpfs: No value for mount option './file0' [ 645.102513] binder: 24145:24146 Acquire 1 refcount change on invalid ref 0 ret -22 [ 645.167464] binder: 24145:24146 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 04:46:31 executing program 1: perf_event_open(&(0x7f000025c000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x11, r0, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(0xffffffffffffffff, 0x2405, r0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x1000004, 0x8031, 0xffffffffffffffff, 0x0) 04:46:31 executing program 3: r0 = syz_open_dev$sg(&(0x7f00000000c0)='/dev/sg#\x00', 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000000)={0x53, 0x0, 0x6, 0x0, @buffer={0x209, 0xb8, &(0x7f00000001c0)=""/184}, &(0x7f0000000540)="ad40657ed56c", &(0x7f0000000340)=""/128, 0x0, 0xf0ff7f, 0x0, &(0x7f0000000040)}) 04:46:31 executing program 0: r0 = pkey_alloc(0x0, 0x2) pkey_mprotect(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x1, r0) unshare(0x10000400) mkdir(&(0x7f0000000200)='./file0\x00', 0x0) mount(&(0x7f00000002c0)=ANY=[], &(0x7f0000001540)='./file0\x00', &(0x7f0000000280)='tmpfs\x00', 0x0, &(0x7f0000000080)) r1 = open$dir(&(0x7f0000000180)='./file0\x00', 0x0, 0x0) mknodat(r1, &(0x7f0000000140)='./file0\x00', 0x0, 0x0) renameat2(r1, &(0x7f0000000080)='./file0\x00', r1, &(0x7f0000000100)='./file1\x00', 0x4) 04:46:31 executing program 5: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000480)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_GUEST_DEBUG(r3, 0x4048ae9b, &(0x7f0000000140)={0x1}) syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000100)=[@text32={0x20, &(0x7f0000000000)="6601669b0f35c4e1fe16846ba49e0000b9940200000f32c4c23dad78e0b9670900000f32660f38827f95b0040f01d10fc71a", 0x32}], 0x1, 0x0, &(0x7f0000000040), 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r3, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000400)=[@text32={0x20, &(0x7f0000000880)="b805000000b98b9400000f01c19a01000000b0000f43d1b8000000000f23d80f21f835800000900f23f80f060f2140b9800000c00f3235000800000f3066ba4300b8f1ffffffefb9800000c00f3235002000000f30c4c3295f4da400", 0x5c}], 0x26433e1, 0x0, &(0x7f0000000300), 0x10000000000000b6) ioctl$KVM_RUN(r3, 0xae80, 0x40000) 04:46:31 executing program 3: r0 = syz_open_dev$sg(&(0x7f00000000c0)='/dev/sg#\x00', 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000000)={0x53, 0x0, 0x6, 0x0, @buffer={0x209, 0xb8, &(0x7f00000001c0)=""/184}, &(0x7f0000000540)="ad40657ed56c", &(0x7f0000000340)=""/128, 0x0, 0xfffffff6, 0x0, &(0x7f0000000040)}) [ 645.386731] tmpfs: No value for mount option './file0' 04:46:31 executing program 3: r0 = syz_open_dev$sg(&(0x7f00000000c0)='/dev/sg#\x00', 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000000)={0x53, 0x0, 0x6, 0x0, @buffer={0x209, 0xb8, &(0x7f00000001c0)=""/184}, &(0x7f0000000540)="ad40657ed56c", &(0x7f0000000340)=""/128, 0x0, 0x6, 0x0, &(0x7f0000000040)}) 04:46:31 executing program 0: mkdir(&(0x7f0000000200)='./file0\x00', 0x0) mount(&(0x7f00000002c0)=ANY=[], &(0x7f0000001540)='./file0\x00', &(0x7f0000000280)='tmpfs\x00', 0x0, &(0x7f0000000080)) r0 = open$dir(&(0x7f0000000180)='./file0\x00', 0x0, 0x0) mknodat(r0, &(0x7f0000000140)='./file0\x00', 0x0, 0x0) renameat2(r0, &(0x7f0000000080)='./file1\x00', r0, &(0x7f0000000000)='./file0/file0\x00', 0x5) 04:46:31 executing program 4: ioctl$KVM_IRQ_LINE(0xffffffffffffffff, 0x4008ae61, &(0x7f0000000500)) r0 = syz_open_dev$dspn(&(0x7f00000004c0)='/dev/dsp#\x00', 0x80000000, 0x48001) r1 = openat$audio(0xffffffffffffff9c, &(0x7f0000000000)='/dev/audio\x00', 0x80, 0x0) ioctl$KVM_SET_FPU(0xffffffffffffffff, 0x41a0ae8d, &(0x7f0000000100)={[], 0x0, 0x5531fee, 0x0, 0x0, 0x9, 0xf000, 0x0, [], 0x5}) syz_open_dev$usb(&(0x7f0000000440)='/dev/bus/usb/00#/00#\x00', 0x9, 0x2) r2 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) lstat(&(0x7f0000000040)='./file0/file0\x00', &(0x7f0000000080)) ioctl$EXT4_IOC_MIGRATE(0xffffffffffffffff, 0x6609) ioctl$KVM_S390_UCAS_UNMAP(r0, 0x4018ae51, &(0x7f0000000540)={0x8, 0x1, 0x5}) sendmmsg$unix(0xffffffffffffffff, &(0x7f000000a000)=[{&(0x7f000000a000)=@abs, 0x6e, &(0x7f000000d000), 0x0, &(0x7f0000000600)=ANY=[]}], 0x1, 0x0) r3 = socket$inet6(0xa, 0x2, 0x0) lremovexattr(&(0x7f0000000300)='./file0\x00', &(0x7f0000000580)=ANY=[@ANYBLOB="62d37ccc69ba4b13ea10d5431a475baa4959a74ed7152de41467cc7216f36c873e9d102f094f28e4c1daeff917bc1fff6fcacc3c6c316f755830a6230880e46e14924101c91fba4566c1d307dc2048135fd7ac92ea7cba866c5a7294e3fb3bfc840e6f57351927bc26e05cd47e7b2827f7335d4475242b8d3e4e886e9ea406dab6517e42f7a81921e5866e8f611f34a82893bec3a19560cf5e0153c7718fba34733d79133a0b9d017dea2ac761b82251bc772fe62a2527179df806404c61"]) gettid() r4 = getpgid(0x0) kcmp(0x0, r4, 0x0, 0xffffffffffffffff, 0xffffffffffffffff) connect$inet6(r3, &(0x7f0000002740)={0xa, 0x0, 0x0, @mcast2, 0x4}, 0x1c) mount(&(0x7f0000000340)=@md0='/dev/md0\x00', &(0x7f0000000640)='./file0/file0\x00', &(0x7f0000000680)='bfs\x00', 0x20000, 0x0) sendmmsg(r3, &(0x7f0000007e00), 0x136a88c8311572c, 0x0) setsockopt$inet6_udp_int(r3, 0x11, 0x0, &(0x7f0000000400), 0x4) openat$kvm(0xffffffffffffff9c, &(0x7f00000003c0)='/dev/kvm\x00', 0x0, 0x0) ioctl$VHOST_SET_VRING_CALL(0xffffffffffffff9c, 0x4008af21, &(0x7f00000002c0)={0x0, r2}) ioctl$SNDRV_TIMER_IOCTL_TREAD(r0, 0x40045402, &(0x7f0000000740)) ioctl$SNDRV_TIMER_IOCTL_CONTINUE(r0, 0x54a2) getsockopt$inet_sctp_SCTP_PR_STREAM_STATUS(r1, 0x84, 0x74, &(0x7f0000000780)=""/4096, &(0x7f0000000380)=0x1000) inotify_rm_watch(0xffffffffffffffff, 0x0) ioctl$ifreq_SIOCGIFINDEX_team(0xffffffffffffffff, 0x8933, &(0x7f0000000480)={'team0\x00'}) [ 645.637058] tmpfs: No value for mount option './file1' 04:46:32 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000000)='net/unix\x00') getsockopt$kcm_KCM_RECV_DISABLE(r1, 0x119, 0x1, &(0x7f0000000040), 0x4) r2 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, &(0x7f0000012fc7)}) close(r0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, &(0x7f0000000f4d)}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000100)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0xfffffffffffffc2b, 0x0, &(0x7f0000000680)}) 04:46:32 executing program 3: r0 = syz_open_dev$sg(&(0x7f00000000c0)='/dev/sg#\x00', 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000000)={0x53, 0x0, 0x6, 0x0, @buffer={0x209, 0xb8, &(0x7f00000001c0)=""/184}, &(0x7f0000000540)="ad40657ed56c", &(0x7f0000000340)=""/128, 0x0, 0x2f, 0x0, &(0x7f0000000040)}) 04:46:32 executing program 0: mkdir(&(0x7f0000000200)='./file0\x00', 0x0) mount(&(0x7f00000002c0)=ANY=[], &(0x7f0000001540)='./file0\x00', &(0x7f0000000280)='tmpfs\x00', 0x0, &(0x7f0000000080)) open$dir(&(0x7f0000000040)='./file0\x00', 0x88480, 0xb1) openat$userio(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/userio\x00', 0x0, 0x0) r0 = open$dir(&(0x7f0000000000)='./file1\x00', 0x0, 0x2) open(&(0x7f00000001c0)='./file1\x00', 0x60000, 0x115) mknodat(r0, &(0x7f0000000140)='./file0\x00', 0x0, 0x0) renameat2(r0, &(0x7f0000000080)='./file0\x00', r0, &(0x7f0000000100)='./file1\x00', 0x4) 04:46:32 executing program 5: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000480)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_GUEST_DEBUG(r3, 0x4048ae9b, &(0x7f0000000140)={0x1}) syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000100)=[@text32={0x20, &(0x7f0000000000)="6601669b0f35c4e1fe16846ba49e0000b9940200000f32c4c23dad78e0b9670900000f32660f38827f95b0040f01d10fc71a", 0x32}], 0x1, 0x0, &(0x7f0000000040), 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r3, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000400)=[@text32={0x20, &(0x7f0000000880)="b805000000b98b9400000f01c19a01000000b0000f43d1b8000000000f23d80f21f835800000900f23f80f060f2140b9800000c00f3235000800000f3066ba4300b8f1ffffffefb9800000c00f3235002000000f30c4c3295f4da400", 0x5c}], 0x26433e1, 0x0, &(0x7f0000000300), 0x10000000000000b6) ioctl$KVM_RUN(r3, 0xae80, 0x500) [ 645.885577] binder: 24145:24150 Acquire 1 refcount change on invalid ref 0 ret -22 [ 645.902548] binder: 24145:24186 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 04:46:32 executing program 1: perf_event_open(&(0x7f000025c000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x11, r0, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(0xffffffffffffffff, 0x2405, r0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x1000004, 0x8031, 0xffffffffffffffff, 0x0) 04:46:32 executing program 4: ioctl$KVM_IRQ_LINE(0xffffffffffffffff, 0x4008ae61, &(0x7f0000000500)) r0 = syz_open_dev$dspn(&(0x7f00000004c0)='/dev/dsp#\x00', 0x1, 0x0) openat$audio(0xffffffffffffff9c, &(0x7f0000000000)='/dev/audio\x00', 0x80, 0x0) ioctl$KVM_SET_FPU(0xffffffffffffffff, 0x41a0ae8d, &(0x7f0000000100)={[], 0x0, 0x5531fee, 0x0, 0x0, 0x9, 0xf000, 0x0, [], 0x5}) syz_open_dev$usb(&(0x7f0000000440)='/dev/bus/usb/00#/00#\x00', 0x9, 0x2) r1 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) lstat(&(0x7f0000000040)='./file0/file0\x00', &(0x7f0000000080)) ioctl$EXT4_IOC_MIGRATE(0xffffffffffffffff, 0x6609) sendmmsg$unix(0xffffffffffffffff, &(0x7f000000a000)=[{&(0x7f000000a000)=@abs, 0x6e, &(0x7f000000d000), 0x0, &(0x7f0000000600)=ANY=[]}], 0x1, 0x0) r2 = socket$inet6(0xa, 0x2, 0x0) r3 = msgget(0x3, 0x20) msgrcv(r3, &(0x7f0000000640)={0x0, ""/216}, 0xe0, 0x2, 0x2000) gettid() r4 = getpgid(0x0) kcmp(0x0, r4, 0x0, 0xffffffffffffffff, 0xffffffffffffffff) connect$inet6(r2, &(0x7f0000002740)={0xa, 0x0, 0x0, @mcast2, 0x4}, 0x1c) sendmmsg(r2, &(0x7f0000007e00), 0x136a88c8311572c, 0x0) setsockopt$inet6_udp_int(r2, 0x11, 0x0, &(0x7f0000000400), 0x4) openat$kvm(0xffffffffffffff9c, &(0x7f00000003c0)='/dev/kvm\x00', 0x0, 0x0) ioctl$VHOST_SET_VRING_CALL(0xffffffffffffff9c, 0x4008af21, &(0x7f00000002c0)={0x0, r1}) ioctl$SNDRV_TIMER_IOCTL_TREAD(r0, 0x40045402, &(0x7f0000000740)) inotify_rm_watch(0xffffffffffffffff, 0x0) ioctl$ifreq_SIOCGIFINDEX_team(0xffffffffffffffff, 0x8933, &(0x7f0000000480)={'team0\x00'}) 04:46:32 executing program 3: r0 = syz_open_dev$sg(&(0x7f00000000c0)='/dev/sg#\x00', 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000000)={0x53, 0x0, 0x6, 0x0, @buffer={0x209, 0xb8, &(0x7f00000001c0)=""/184}, &(0x7f0000000540)="ad40657ed56c", &(0x7f0000000340)=""/128, 0x0, 0xf0ff7f00000000, 0x0, &(0x7f0000000040)}) [ 646.045028] tmpfs: No value for mount option './file0' 04:46:32 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, &(0x7f0000012fc7)}) socketpair$inet_smc(0x2b, 0x1, 0x0, &(0x7f0000000000)) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, &(0x7f0000000f4d)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000100)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0xfffffffffffffc2b, 0x0, &(0x7f0000000680)}) 04:46:32 executing program 0: mkdir(&(0x7f0000000200)='./file0\x00', 0x0) mount(&(0x7f00000002c0)=ANY=[], &(0x7f0000001540)='./file0\x00', &(0x7f0000000280)='tmpfs\x00', 0x0, &(0x7f0000000080)) r0 = open$dir(&(0x7f0000000180)='./file0\x00', 0x0, 0x0) mknodat(r0, &(0x7f0000000140)='./file0\x00', 0x0, 0x0) renameat2(r0, &(0x7f0000000040)='./file1/file0\x00', r0, &(0x7f0000000000)='./file1\x00', 0x5) 04:46:32 executing program 3: r0 = syz_open_dev$sg(&(0x7f00000000c0)='/dev/sg#\x00', 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000000)={0x53, 0x0, 0x6, 0x0, @buffer={0x209, 0xb8, &(0x7f00000001c0)=""/184}, &(0x7f0000000540)="ad40657ed56c", &(0x7f0000000340)=""/128, 0x0, 0xf6ffffff00000000, 0x0, &(0x7f0000000040)}) 04:46:32 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, &(0x7f0000012fc7)}) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, &(0x7f0000000f4d)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000100)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0xfffffffffffffc2b, 0x0, &(0x7f0000000680)}) r2 = dup3(r1, r0, 0x80000) ioctl$KVM_SET_CPUID2(r2, 0x4008ae90, &(0x7f0000000140)={0x8, 0x0, [{0x8000000f, 0x8001, 0x1, 0x71, 0x7eb, 0x81, 0x7fff}, {0x1, 0x29a, 0x1, 0x7fffffff, 0x3, 0x98, 0x100000001}, {0xa, 0x9, 0x5, 0x3ff, 0xbd, 0x4c45, 0x5}, {0x80000001, 0x8, 0x4, 0x2, 0x0, 0x40, 0x3}, {0x0, 0xffff, 0x5, 0x1, 0x8, 0x2, 0x8}, {0x80000007, 0x5, 0x4, 0x401, 0x0, 0xfff, 0x10001}, {0x0, 0x240000000, 0x2, 0x7, 0xffffffffffffff98, 0x5, 0x2}, {0xc0000008, 0xfffffffffffffffc, 0x0, 0x8, 0x4, 0x2, 0x6}]}) r3 = syz_open_dev$sndpcmc(&(0x7f0000000000)='/dev/snd/pcmC#D#c\x00', 0xfffffffffffffffe, 0x22000) ioctl$SCSI_IOCTL_DOORLOCK(r3, 0x5380) 04:46:32 executing program 0: mkdir(&(0x7f0000000200)='./file0\x00', 0x0) mount(&(0x7f00000004c0)=ANY=[@ANYRES64, @ANYRES16=0x0, @ANYBLOB="b9c03f8eab371be3c8ba6fdf16dcf3abec18c9f18c823e9b3a88d35862783378b01ebdc708c01832483ba2929b327f65a1747065cbeef20c0998ba2e87d85b04348bb550a16fb96894194a5f3b47a87075a79e97a8846c1f357b48e2d05019c108dee5954b833fc2499a25a67bbdc4ca670eb633115eba8aad5c8f2db31c3585cb03e480383eb389ef654229401ae81302701c321da97540a1e528f6528f2156ae1924b8c6ee61c3ddac100dbc6fae571eecb959b160696270760f59c1703839d43ee2432eb4e31c19a937868b43a7fede51a287701d06e847ae2cf951d11e2513ecdfa466e647e061904bae12d04be7ab27e8e8cdb38fc7326adeaa00e7f65cdfaf73bc990bb05eee551f78d7599e0d4769c29e0b8d5cfa2f11fdd29d1503bcb7ca24163d86c8aa774902f1838c3bfe3ed93315d63eb9982884795b013fb1ca3e04ebf7e2d40c6acae4939622ca7a770e681bb0b0967c2fd10523c07a40a4ee1aa9f66a27fe6b6828a8b5603be089fab80ae42ae3c259cf2ee19348d44bc512a91b1a9e84f9ff7552390ff7f7be2bf096c6016e76b28b8fa8b638b91ba50c1c31c8aae6e53bf34514", @ANYRESDEC], &(0x7f0000001540)='./file0\x00', &(0x7f0000000280)='tmpfs\x00', 0x0, &(0x7f0000000080)) readlink(&(0x7f00000000c0)='./file1\x00', &(0x7f0000000180)=""/73, 0x49) r0 = open$dir(&(0x7f0000000000)='./file0/file0\x00', 0x400000, 0x0) acct(&(0x7f0000000040)='./file0/file0\x00') mknodat(r0, &(0x7f0000000140)='./file0\x00', 0x0, 0x0) write$binfmt_aout(r0, &(0x7f00000006c0)={{0x10b, 0x8001, 0x0, 0xf8, 0x3ce, 0x3, 0x2cf, 0x60000000000}, "410b1701bb604d26b4bc0713364893cd1c0e9be3f85f0a29", [[], [], [], [], [], [], [], [], [], []]}, 0xa38) renameat2(r0, &(0x7f0000000080)='./file0\x00', r0, &(0x7f0000000100)='./file1\x00', 0x4) 04:46:32 executing program 3: r0 = syz_open_dev$sg(&(0x7f00000000c0)='/dev/sg#\x00', 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000000)={0x53, 0x0, 0x6, 0x0, @buffer={0x209, 0xb8, &(0x7f00000001c0)=""/184}, &(0x7f0000000540)="ad40657ed56c", &(0x7f0000000340)=""/128, 0x0, 0xfeffffff00000000, 0x0, &(0x7f0000000040)}) 04:46:32 executing program 5: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000480)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_GUEST_DEBUG(r3, 0x4048ae9b, &(0x7f0000000140)={0x1}) syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000100)=[@text32={0x20, &(0x7f0000000000)="6601669b0f35c4e1fe16846ba49e0000b9940200000f32c4c23dad78e0b9670900000f32660f38827f95b0040f01d10fc71a", 0x32}], 0x1, 0x0, &(0x7f0000000040), 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r3, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000400)=[@text32={0x20, &(0x7f0000000880)="b805000000b98b9400000f01c19a01000000b0000f43d1b8000000000f23d80f21f835800000900f23f80f060f2140b9800000c00f3235000800000f3066ba4300b8f1ffffffefb9800000c00f3235002000000f30c4c3295f4da400", 0x5c}], 0x26433e1, 0x0, &(0x7f0000000300), 0x10000000000000b6) ioctl$KVM_RUN(r3, 0xae80, 0x4) 04:46:32 executing program 3: r0 = syz_open_dev$sg(&(0x7f00000000c0)='/dev/sg#\x00', 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000000)={0x53, 0x0, 0x6, 0x0, @buffer={0x209, 0xb8, &(0x7f00000001c0)=""/184}, &(0x7f0000000540)="ad40657ed56c", &(0x7f0000000340)=""/128, 0x0, 0x2f00000000000000, 0x0, &(0x7f0000000040)}) [ 646.450543] binder: 24228:24230 ioctl 4008ae90 20000140 returned -22 [ 646.485144] binder: 24228:24234 ioctl 4008ae90 20000140 returned -22 [ 646.520645] tmpfs: No value for mount option './file0' 04:46:32 executing program 3: r0 = syz_open_dev$sg(&(0x7f00000000c0)='/dev/sg#\x00', 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000000)={0x53, 0x0, 0x6, 0x0, @buffer={0x209, 0xb8, &(0x7f00000001c0)=""/184}, &(0x7f0000000540)="ad40657ed56c", &(0x7f0000000340)=""/128, 0x0, 0xb8, 0x0, &(0x7f0000000040)}) 04:46:33 executing program 1: perf_event_open(&(0x7f000025c000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x11, r0, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(0xffffffffffffffff, 0x2405, r0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x1000004, 0x8031, 0xffffffffffffffff, 0x0) 04:46:33 executing program 4: ioctl$KVM_IRQ_LINE(0xffffffffffffffff, 0x4008ae61, &(0x7f0000000500)) r0 = syz_open_dev$dspn(&(0x7f00000004c0)='/dev/dsp#\x00', 0x1, 0x0) ioctl$EVIOCGNAME(r0, 0x80404506, &(0x7f0000000300)=""/64) openat$audio(0xffffffffffffff9c, &(0x7f0000000000)='/dev/audio\x00', 0x80, 0x0) ioctl$KVM_SET_FPU(0xffffffffffffffff, 0x41a0ae8d, &(0x7f0000000100)={[], 0x0, 0x5531fee, 0x0, 0x0, 0x9, 0xf000, 0x0, [], 0x5}) syz_open_dev$usb(&(0x7f0000000440)='/dev/bus/usb/00#/00#\x00', 0x9, 0x2) r1 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) lstat(&(0x7f0000000040)='./file0/file0\x00', &(0x7f0000000080)) ioctl$EXT4_IOC_MIGRATE(0xffffffffffffffff, 0x6609) sendmmsg$unix(0xffffffffffffffff, &(0x7f000000a000)=[{&(0x7f000000a000)=@abs, 0x6e, &(0x7f000000d000), 0x0, &(0x7f0000000600)=ANY=[]}], 0x1, 0x0) r2 = socket$inet6(0xa, 0x2, 0x0) gettid() r3 = getpgid(0x0) kcmp(0x0, r3, 0x0, 0xffffffffffffffff, 0xffffffffffffffff) connect$inet6(r2, &(0x7f0000002740)={0xa, 0x0, 0x0, @mcast2, 0x4}, 0x1c) sendmmsg(r2, &(0x7f0000007e00), 0x136a88c8311572c, 0x0) setsockopt$inet6_udp_int(r2, 0x11, 0x0, &(0x7f0000000400), 0x4) openat$kvm(0xffffffffffffff9c, &(0x7f00000003c0)='/dev/kvm\x00', 0x0, 0x0) ioctl$VHOST_SET_VRING_CALL(0xffffffffffffff9c, 0x4008af21, &(0x7f00000002c0)={0x0, r1}) ioctl$SNDRV_TIMER_IOCTL_TREAD(r0, 0x40045402, &(0x7f0000000740)) inotify_rm_watch(0xffffffffffffffff, 0x0) ioctl$ifreq_SIOCGIFINDEX_team(0xffffffffffffffff, 0x8933, &(0x7f0000000480)={'team0\x00'}) 04:46:33 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000005fd4)=ANY=[@ANYBLOB='\x00\x00\x00'], 0x0, 0x0, &(0x7f0000012fc7)}) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, &(0x7f0000000f4d)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000100)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0xfffffffffffffc2b, 0x0, &(0x7f0000000680)}) 04:46:33 executing program 0: mkdir(&(0x7f0000000200)='./file0\x00', 0x0) mount(&(0x7f00000002c0)=ANY=[], &(0x7f0000001540)='./file0\x00', &(0x7f0000000280)='tmpfs\x00', 0x0, &(0x7f0000000080)) r0 = open$dir(&(0x7f0000000180)='./file0\x00', 0x0, 0x0) renameat2(r0, &(0x7f0000000080)='./file0\x00', r0, &(0x7f0000000100)='./file1\x00', 0x4) 04:46:33 executing program 5: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000480)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_GUEST_DEBUG(r3, 0x4048ae9b, &(0x7f0000000140)={0x1}) syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000100)=[@text32={0x20, &(0x7f0000000000)="6601669b0f35c4e1fe16846ba49e0000b9940200000f32c4c23dad78e0b9670900000f32660f38827f95b0040f01d10fc71a", 0x32}], 0x1, 0x0, &(0x7f0000000040), 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r3, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000400)=[@text32={0x20, &(0x7f0000000880)="b805000000b98b9400000f01c19a01000000b0000f43d1b8000000000f23d80f21f835800000900f23f80f060f2140b9800000c00f3235000800000f3066ba4300b8f1ffffffefb9800000c00f3235002000000f30c4c3295f4da400", 0x5c}], 0x26433e1, 0x0, &(0x7f0000000300), 0x10000000000000b6) ioctl$KVM_RUN(r3, 0xae80, 0x6000000000000000) 04:46:33 executing program 3: r0 = syz_open_dev$sg(&(0x7f00000000c0)='/dev/sg#\x00', 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000000)={0x53, 0x0, 0x6, 0x0, @buffer={0x209, 0xb8, &(0x7f00000001c0)=""/184}, &(0x7f0000000540)="ad40657ed56c", &(0x7f0000000340)=""/128, 0x0, 0xfffffffe, 0x0, &(0x7f0000000040)}) [ 647.013923] tmpfs: No value for mount option './file0' [ 647.020333] binder: 24256:24260 unknown command 0 [ 647.033621] binder: 24256:24260 ioctl c0306201 20012000 returned -22 04:46:33 executing program 3: r0 = syz_open_dev$sg(&(0x7f00000000c0)='/dev/sg#\x00', 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000000)={0x53, 0x0, 0x6, 0x0, @buffer={0x209, 0xb8, &(0x7f00000001c0)=""/184}, &(0x7f0000000540)="ad40657ed56c", &(0x7f0000000340)=""/128, 0x0, 0x400000000000000, 0x0, &(0x7f0000000040)}) [ 647.064666] binder: 24256:24260 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 04:46:33 executing program 0: mkdir(&(0x7f0000000200)='./file0\x00', 0x0) mount(&(0x7f00000002c0)=ANY=[], &(0x7f0000001540)='./file0\x00', &(0x7f0000000280)='tmpfs\x00', 0x0, &(0x7f0000000080)) r0 = open$dir(&(0x7f0000000180)='./file0\x00', 0x0, 0x0) mknodat(r0, &(0x7f0000000140)='./file0\x00', 0x0, 0x0) renameat2(r0, &(0x7f0000000000)='./file1\x00', r0, &(0x7f0000000100)='./file1\x00', 0x7) 04:46:33 executing program 3: r0 = syz_open_dev$sg(&(0x7f00000000c0)='/dev/sg#\x00', 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000000)={0x53, 0x0, 0x6, 0x0, @buffer={0x209, 0xb8, &(0x7f00000001c0)=""/184}, &(0x7f0000000540)="ad40657ed56c", &(0x7f0000000340)=""/128, 0x0, 0x7ffffffff000, 0x0, &(0x7f0000000040)}) 04:46:33 executing program 5: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000480)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_GUEST_DEBUG(r3, 0x4048ae9b, &(0x7f0000000140)={0x1}) syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000100)=[@text32={0x20, &(0x7f0000000000)="6601669b0f35c4e1fe16846ba49e0000b9940200000f32c4c23dad78e0b9670900000f32660f38827f95b0040f01d10fc71a", 0x32}], 0x1, 0x0, &(0x7f0000000040), 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r3, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000400)=[@text32={0x20, &(0x7f0000000880)="b805000000b98b9400000f01c19a01000000b0000f43d1b8000000000f23d80f21f835800000900f23f80f060f2140b9800000c00f3235000800000f3066ba4300b8f1ffffffefb9800000c00f3235002000000f30c4c3295f4da400", 0x5c}], 0x26433e1, 0x0, &(0x7f0000000300), 0x10000000000000b6) ioctl$KVM_RUN(r3, 0xae80, 0xc000000000000) 04:46:33 executing program 3: r0 = syz_open_dev$sg(&(0x7f00000000c0)='/dev/sg#\x00', 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000000)={0x53, 0x0, 0x6, 0x0, @buffer={0x209, 0xb8, &(0x7f00000001c0)=""/184}, &(0x7f0000000540)="ad40657ed56c", &(0x7f0000000340)=""/128, 0x0, 0xfffffffc, 0x0, &(0x7f0000000040)}) 04:46:33 executing program 0: mkdir(&(0x7f0000000200)='./file0\x00', 0x0) mount(&(0x7f00000002c0)=ANY=[], &(0x7f0000001540)='./file0\x00', &(0x7f0000000280)='tmpfs\x00', 0x0, &(0x7f0000000080)) r0 = open$dir(&(0x7f0000000180)='./file0\x00', 0x0, 0x0) mknodat(r0, &(0x7f0000000140)='./file0\x00', 0x0, 0x0) open$dir(&(0x7f0000000000)='./file2\x00', 0x20000, 0x160) renameat2(r0, &(0x7f0000000080)='./file0\x00', r0, &(0x7f0000000100)='./file1\x00', 0x4) 04:46:33 executing program 1: r0 = perf_event_open(&(0x7f000025c000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x11, r1, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r0, 0x2405, 0xffffffffffffffff) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x1000004, 0x8031, 0xffffffffffffffff, 0x0) 04:46:33 executing program 4: ioctl$KVM_IRQ_LINE(0xffffffffffffffff, 0x4008ae61, &(0x7f0000000500)) r0 = syz_open_dev$dspn(&(0x7f00000004c0)='/dev/dsp#\x00', 0x1, 0x0) openat$audio(0xffffffffffffff9c, &(0x7f0000000000)='/dev/audio\x00', 0x80, 0x0) ioctl$KVM_SET_FPU(0xffffffffffffffff, 0x41a0ae8d, &(0x7f0000000100)={[], 0x0, 0x5531fee, 0x0, 0x0, 0x9, 0xf000, 0x0, [], 0x5}) syz_open_dev$usb(&(0x7f0000000440)='/dev/bus/usb/00#/00#\x00', 0x9, 0x2) r1 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) lstat(&(0x7f0000000040)='./file0/file0\x00', &(0x7f0000000080)) ioctl$EXT4_IOC_MIGRATE(0xffffffffffffffff, 0x6609) sendmmsg$unix(0xffffffffffffffff, &(0x7f000000a000)=[{&(0x7f000000a000)=@abs, 0x6e, &(0x7f000000d000), 0x0, &(0x7f0000000600)=ANY=[]}], 0x1, 0x0) r2 = socket$inet6(0xa, 0x2, 0x0) gettid() r3 = getpgid(0x0) kcmp(0x0, r3, 0x0, 0xffffffffffffffff, 0xffffffffffffffff) connect$inet6(r2, &(0x7f0000002740)={0xa, 0x0, 0x0, @mcast2, 0x4}, 0x1c) sendmmsg(r2, &(0x7f0000007e00), 0x136a88c8311572c, 0x0) setsockopt$inet6_udp_int(r2, 0x11, 0x0, &(0x7f0000000400), 0x4) openat$kvm(0xffffffffffffff9c, &(0x7f00000003c0)='/dev/kvm\x00', 0x0, 0x0) ioctl$RTC_EPOCH_SET(r0, 0x4008700e, 0xf44f) ioctl$VHOST_SET_VRING_CALL(0xffffffffffffff9c, 0x4008af21, &(0x7f00000002c0)={0x0, r1}) ioctl$SNDRV_TIMER_IOCTL_TREAD(r0, 0x40045402, &(0x7f0000000740)) inotify_rm_watch(0xffffffffffffffff, 0x0) ioctl$ifreq_SIOCGIFINDEX_team(0xffffffffffffffff, 0x8933, &(0x7f0000000480)={'team0\x00'}) [ 647.634492] tmpfs: No value for mount option './file0' [ 647.789943] binder: 24256:24306 unknown command 0 [ 647.798459] binder: 24256:24307 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 647.800159] binder: 24256:24306 ioctl c0306201 20012000 returned -22 04:46:34 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, &(0x7f0000012fc7)}) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, &(0x7f0000000f4d)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000100)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0xfffffffffffffc2b, 0x0, &(0x7f0000000680)}) r2 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x90002, 0x0) getsockname$inet6(r2, &(0x7f0000000040)={0xa, 0x0, 0x0, @local}, &(0x7f00000000c0)=0x1c) 04:46:34 executing program 3: r0 = syz_open_dev$sg(&(0x7f00000000c0)='/dev/sg#\x00', 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000000)={0x53, 0x0, 0x6, 0x0, @buffer={0x209, 0xb8, &(0x7f00000001c0)=""/184}, &(0x7f0000000540)="ad40657ed56c", &(0x7f0000000340)=""/128, 0x0, 0xffffffff00000000, 0x0, &(0x7f0000000040)}) 04:46:34 executing program 5: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000480)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_GUEST_DEBUG(r3, 0x4048ae9b, &(0x7f0000000140)={0x1}) syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000100)=[@text32={0x20, &(0x7f0000000000)="6601669b0f35c4e1fe16846ba49e0000b9940200000f32c4c23dad78e0b9670900000f32660f38827f95b0040f01d10fc71a", 0x32}], 0x1, 0x0, &(0x7f0000000040), 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r3, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000400)=[@text32={0x20, &(0x7f0000000880)="b805000000b98b9400000f01c19a01000000b0000f43d1b8000000000f23d80f21f835800000900f23f80f060f2140b9800000c00f3235000800000f3066ba4300b8f1ffffffefb9800000c00f3235002000000f30c4c3295f4da400", 0x5c}], 0x26433e1, 0x0, &(0x7f0000000300), 0x10000000000000b6) ioctl$KVM_RUN(r3, 0xae80, 0x3f00) 04:46:34 executing program 0: mkdir(&(0x7f0000000200)='./file0\x00', 0x0) mount(&(0x7f00000002c0)=ANY=[], &(0x7f00000000c0)='./file0\x00', &(0x7f0000000280)='\x00\x00\x00\x00\x00\x00', 0x0, &(0x7f0000000240)=':nodevsystemeth1wlan0@\x00') r0 = open$dir(&(0x7f0000000180)='./file0\x00', 0x0, 0x0) mknodat(r0, &(0x7f0000000140)='./file0\x00', 0x0, 0x0) renameat2(r0, &(0x7f0000000080)='./file0\x00', r0, &(0x7f0000000100)='./file1\x00', 0x4) 04:46:34 executing program 0: r0 = syz_open_dev$dmmidi(&(0x7f0000000000)='/dev/dmmidi#\x00', 0xbd5, 0x4140) ioctl$TIOCNOTTY(r0, 0x5422) mkdir(&(0x7f0000000200)='./file0\x00', 0x0) mount(&(0x7f00000002c0)=ANY=[], &(0x7f0000001540)='./file0\x00', &(0x7f0000000280)='tmpfs\x00', 0x0, &(0x7f0000000080)) r1 = open$dir(&(0x7f0000000180)='./file0\x00', 0x0, 0x0) mknodat(r1, &(0x7f0000000140)='./file0\x00', 0x0, 0x0) renameat2(r1, &(0x7f0000000080)='./file0\x00', r1, &(0x7f0000000100)='./file1\x00', 0x4) pivot_root(&(0x7f0000000040)='./file1\x00', &(0x7f00000000c0)='./file0\x00') 04:46:34 executing program 3: r0 = syz_open_dev$sg(&(0x7f00000000c0)='/dev/sg#\x00', 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000000)={0x53, 0x0, 0x6, 0x0, @buffer={0x209, 0xb8, &(0x7f00000001c0)=""/184}, &(0x7f0000000540)="ad40657ed56c", &(0x7f0000000340)=""/128, 0x0, 0x902000000000000, 0x0, &(0x7f0000000040)}) 04:46:34 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, &(0x7f0000012fc7)}) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, &(0x7f0000000f4d)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000100)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0xfffffffffffffc2b, 0x0, &(0x7f0000000680)}) 04:46:34 executing program 5: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000480)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_GUEST_DEBUG(r3, 0x4048ae9b, &(0x7f0000000140)={0x1}) syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000100)=[@text32={0x20, &(0x7f0000000000)="6601669b0f35c4e1fe16846ba49e0000b9940200000f32c4c23dad78e0b9670900000f32660f38827f95b0040f01d10fc71a", 0x32}], 0x1, 0x0, &(0x7f0000000040), 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r3, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000400)=[@text32={0x20, &(0x7f0000000880)="b805000000b98b9400000f01c19a01000000b0000f43d1b8000000000f23d80f21f835800000900f23f80f060f2140b9800000c00f3235000800000f3066ba4300b8f1ffffffefb9800000c00f3235002000000f30c4c3295f4da400", 0x5c}], 0x26433e1, 0x0, &(0x7f0000000300), 0x10000000000000b6) ioctl$KVM_RUN(r3, 0xae80, 0x3) [ 648.267397] tmpfs: No value for mount option './file0' 04:46:34 executing program 3: r0 = syz_open_dev$sg(&(0x7f00000000c0)='/dev/sg#\x00', 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000000)={0x53, 0x0, 0x6, 0x0, @buffer={0x209, 0xb8, &(0x7f00000001c0)=""/184}, &(0x7f0000000540)="ad40657ed56c", &(0x7f0000000340)=""/128, 0x0, 0x8000a0, 0x0, &(0x7f0000000040)}) 04:46:34 executing program 0: perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socketpair(0x1e, 0x1, 0x0, &(0x7f0000000140)={0x0, 0x0}) bpf$BPF_PROG_ATTACH(0x8, &(0x7f0000000580)={r1}, 0x3ac) recvmsg$kcm(0xffffffffffffffff, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000380)=[{&(0x7f00000000c0)=""/49, 0x31}], 0x10000023, &(0x7f00000002c0)=""/77, 0x4d}, 0x0) recvmsg$kcm(r0, &(0x7f0000000200)={&(0x7f0000000040)=@ax25, 0x2, &(0x7f0000000000)=[{&(0x7f0000000080)=""/151, 0xffffff77}], 0x1, &(0x7f00000001c0)=""/17, 0xffda}, 0x3f00) setsockopt$inet_sctp6_SCTP_MAXSEG(r0, 0x84, 0xd, &(0x7f0000000340), 0x4) sendmsg(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000100), 0x47, &(0x7f0000000000)}, 0x0) bpf$BPF_PROG_DETACH(0x9, &(0x7f0000000040)={0x0, 0xffffffffffffffff, 0x7}, 0x11) mkdir(&(0x7f0000000200)='./file0\x00', 0x0) mount(&(0x7f00000002c0)=ANY=[], &(0x7f0000001540)='./file0\x00', &(0x7f0000000280)='tmpfs\x00', 0x0, &(0x7f0000000080)) r2 = open$dir(&(0x7f0000000180)='./file0\x00', 0x0, 0x0) mknodat(r2, &(0x7f0000000140)='./file0\x00', 0x0, 0x0) renameat2(r2, &(0x7f0000000080)='./file0\x00', r2, &(0x7f0000000100)='./file1\x00', 0x4) 04:46:34 executing program 1: r0 = perf_event_open(&(0x7f000025c000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x11, r1, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r0, 0x2405, 0xffffffffffffffff) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x1000004, 0x8031, 0xffffffffffffffff, 0x0) 04:46:34 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, &(0x7f0000012fc7)}) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, &(0x7f0000000f4d)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000100)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0xfffffffffffffc2b, 0x0, &(0x7f0000000680)}) 04:46:34 executing program 4: ioctl$KVM_IRQ_LINE(0xffffffffffffffff, 0x4008ae61, &(0x7f0000000500)) r0 = syz_open_dev$dspn(&(0x7f00000004c0)='/dev/dsp#\x00', 0x1, 0x0) openat$audio(0xffffffffffffff9c, &(0x7f0000000000)='/dev/audio\x00', 0x80, 0x0) ioctl$KVM_SET_FPU(0xffffffffffffffff, 0x41a0ae8d, &(0x7f0000000100)={[], 0x0, 0x5531fee, 0x0, 0x0, 0x9, 0xf000, 0x0, [], 0x5}) r1 = syz_open_dev$usb(&(0x7f0000000440)='/dev/bus/usb/00#/00#\x00', 0x9, 0x2) r2 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) lstat(&(0x7f0000000040)='./file0/file0\x00', &(0x7f0000000080)) ioctl$EXT4_IOC_MIGRATE(0xffffffffffffffff, 0x6609) sendmmsg$unix(0xffffffffffffffff, &(0x7f000000a000)=[{&(0x7f000000a000)=@abs, 0x6e, &(0x7f000000d000), 0x0, &(0x7f0000000600)=ANY=[]}], 0x1, 0x0) r3 = socket$inet6(0xa, 0x2, 0x0) gettid() r4 = getpgid(0x0) kcmp(0x0, r4, 0x0, 0xffffffffffffffff, 0xffffffffffffffff) connect$inet6(r3, &(0x7f0000002740)={0xa, 0x0, 0x0, @mcast2, 0x4}, 0x1c) sendmmsg(r3, &(0x7f0000007e00), 0x136a88c8311572c, 0x0) setsockopt$inet6_udp_int(r3, 0x11, 0x0, &(0x7f0000000400), 0x4) openat$kvm(0xffffffffffffff9c, &(0x7f00000003c0)='/dev/kvm\x00', 0x0, 0x0) ioctl$VHOST_SET_VRING_CALL(0xffffffffffffff9c, 0x4008af21, &(0x7f00000002c0)={0x0, r2}) ioctl$SNDRV_TIMER_IOCTL_TREAD(r0, 0x40045402, &(0x7f0000000740)) r5 = inotify_add_watch(r1, &(0x7f0000000300)='./file0\x00', 0x20000002) inotify_rm_watch(0xffffffffffffffff, r5) ioctl$ifreq_SIOCGIFINDEX_team(0xffffffffffffffff, 0x8933, &(0x7f0000000480)={'team0\x00'}) 04:46:34 executing program 3: r0 = syz_open_dev$sg(&(0x7f00000000c0)='/dev/sg#\x00', 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000000)={0x53, 0x0, 0x6, 0x0, @buffer={0x209, 0xb8, &(0x7f00000001c0)=""/184}, &(0x7f0000000540)="ad40657ed56c", &(0x7f0000000340)=""/128, 0x0, 0xfcffffff, 0x0, &(0x7f0000000040)}) 04:46:34 executing program 5: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000480)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_GUEST_DEBUG(r3, 0x4048ae9b, &(0x7f0000000140)={0x1}) syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000100)=[@text32={0x20, &(0x7f0000000000)="6601669b0f35c4e1fe16846ba49e0000b9940200000f32c4c23dad78e0b9670900000f32660f38827f95b0040f01d10fc71a", 0x32}], 0x1, 0x0, &(0x7f0000000040), 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r3, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000400)=[@text32={0x20, &(0x7f0000000880)="b805000000b98b9400000f01c19a01000000b0000f43d1b8000000000f23d80f21f835800000900f23f80f060f2140b9800000c00f3235000800000f3066ba4300b8f1ffffffefb9800000c00f3235002000000f30c4c3295f4da400", 0x5c}], 0x26433e1, 0x0, &(0x7f0000000300), 0x10000000000000b6) ioctl$KVM_RUN(r3, 0xae80, 0x6) [ 648.548255] binder: 24353:24354 Acquire 1 refcount change on invalid ref 0 ret -22 [ 648.653160] binder: 24353:24354 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 04:46:34 executing program 3: r0 = syz_open_dev$sg(&(0x7f00000000c0)='/dev/sg#\x00', 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000000)={0x53, 0x0, 0x6, 0x0, @buffer={0x209, 0xb8, &(0x7f00000001c0)=""/184}, &(0x7f0000000540)="ad40657ed56c", &(0x7f0000000340)=""/128, 0x0, 0x4000000, 0x0, &(0x7f0000000040)}) [ 648.722789] binder: 24353:24365 Acquire 1 refcount change on invalid ref 0 ret -22 [ 648.751430] binder: 24353:24354 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 04:46:35 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, &(0x7f0000012fc7)}) r2 = socket$inet6_dccp(0xa, 0x6, 0x0) shutdown(r2, 0x1) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, &(0x7f0000000f4d)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000100)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0xfffffffffffffc2b, 0x0, &(0x7f0000000680)}) 04:46:35 executing program 3: r0 = syz_open_dev$sg(&(0x7f00000000c0)='/dev/sg#\x00', 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000000)={0x53, 0x0, 0x6, 0x0, @buffer={0x209, 0xb8, &(0x7f00000001c0)=""/184}, &(0x7f0000000540)="ad40657ed56c", &(0x7f0000000340)=""/128, 0x0, 0x6cd57e6540ad, 0x0, &(0x7f0000000040)}) 04:46:35 executing program 3: r0 = syz_open_dev$sg(&(0x7f00000000c0)='/dev/sg#\x00', 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000000)={0x53, 0x0, 0x6, 0x0, @buffer={0x209, 0xb8, &(0x7f00000001c0)=""/184}, &(0x7f0000000540)="ad40657ed56c", &(0x7f0000000340)=""/128, 0x0, 0x209, 0x0, &(0x7f0000000040)}) 04:46:35 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_pts(0xffffffffffffff9c, 0x82000) ioctl$KDGKBENT(r1, 0x4b46, &(0x7f0000000300)={0x4, 0x9}) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r2 = memfd_create(&(0x7f00000003c0)='+-\x00', 0x5) setsockopt$inet_sctp_SCTP_MAX_BURST(r2, 0x84, 0x14, &(0x7f0000000400)=@int=0x8001, 0x4) r3 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0x0, 0x2) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, &(0x7f0000012fc7)}) r4 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000100)='/dev/snapshot\x00', 0x200, 0x0) ioctl$EVIOCREVOKE(r4, 0x40044591, &(0x7f0000000380)=0x7) close(r0) syz_mount_image$nfs4(&(0x7f0000000000)='nfs4\x00', &(0x7f0000000040)='./file0\x00', 0x2, 0x3, &(0x7f0000000240)=[{&(0x7f0000000140)="040564797dea7e82822df6a24613cb4f82471f27b83bd7a2517a15ad75baf5bd634f7e9823dbba4dac84e44dd30fd6a7a6621e8e87b15053d3e11a105d320a9d9447009989d719870eaf64facfb049d3021177e65e500b7b32c05112d955bf31eea2eda0ae80370b83ef092cc753e9ad75aeadf76c095ce3c31efc239ae218b128f289808c63caabd7f98a5ea3c7761a5918fdb0997c54ede0f25a6c8e9361a575d27c4adb6b9b0e9a94289b299b78ea72dfaff87597339bbf21", 0xba, 0x100000001}, {&(0x7f00000000c0)="e0f7c3256df7f5bef158a7ef391812b030f139cf376c42d91e81b6700d7feb4f8c1b", 0x22, 0x1f}, {&(0x7f0000000200)="d726dae8463a9ff0ab77539628bc9e8dc8dc52034e", 0x15, 0x46}], 0x9400, &(0x7f00000002c0)='-\x00') ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, &(0x7f0000000f4d)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000340)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x0, 0x0, &(0x7f0000000680)}) 04:46:35 executing program 5: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000480)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_GUEST_DEBUG(r3, 0x4048ae9b, &(0x7f0000000140)={0x1}) syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000100)=[@text32={0x20, &(0x7f0000000000)="6601669b0f35c4e1fe16846ba49e0000b9940200000f32c4c23dad78e0b9670900000f32660f38827f95b0040f01d10fc71a", 0x32}], 0x1, 0x0, &(0x7f0000000040), 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r3, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000400)=[@text32={0x20, &(0x7f0000000880)="b805000000b98b9400000f01c19a01000000b0000f43d1b8000000000f23d80f21f835800000900f23f80f060f2140b9800000c00f3235000800000f3066ba4300b8f1ffffffefb9800000c00f3235002000000f30c4c3295f4da400", 0x5c}], 0x26433e1, 0x0, &(0x7f0000000300), 0x10000000000000b6) ioctl$KVM_RUN(r3, 0xae80, 0x1a0ffffffff) [ 649.178363] binder: 24386:24387 Acquire 1 refcount change on invalid ref 0 ret -22 [ 649.233472] binder: 24386:24387 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 649.258442] binder: 24386:24387 Acquire 1 refcount change on invalid ref 0 ret -22 [ 649.325228] binder: 24386:24392 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 649.382329] tmpfs: No value for mount option './file0' 04:46:35 executing program 0: mkdir(&(0x7f0000000200)='./file0\x00', 0x0) mount(&(0x7f00000002c0)=ANY=[], &(0x7f0000001540)='./file0\x00', &(0x7f0000000280)='tmpfs\x00', 0x0, &(0x7f0000000080)) io_setup(0x3, &(0x7f0000000040)=0x0) r1 = syz_open_dev$dmmidi(&(0x7f00000000c0)='/dev/dmmidi#\x00', 0x7fff, 0x400) r2 = epoll_create1(0x80000) r3 = syz_open_dev$mice(&(0x7f0000000240)='/dev/input/mice\x00', 0x0, 0x0) r4 = syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x0) r5 = syz_open_dev$usb(&(0x7f00000004c0)='/dev/bus/usb/00#/00#\x00', 0x7, 0x100) r6 = socket$bt_bnep(0x1f, 0x3, 0x4) r7 = syz_open_dev$vcsa(&(0x7f0000000580)='/dev/vcsa#\x00', 0x1f, 0x2) r8 = openat$smack_task_current(0xffffffffffffff9c, &(0x7f0000000600)='/proc/self/attr/current\x00', 0x2, 0x0) r9 = openat$sequencer(0xffffffffffffff9c, &(0x7f00000006c0)='/dev/sequencer\x00', 0x0, 0x0) r10 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000740)='/dev/snapshot\x00', 0x0, 0x0) r11 = openat$mixer(0xffffffffffffff9c, &(0x7f00000007c0)='/dev/mixer\x00', 0x40000, 0x0) io_submit(r0, 0x6, &(0x7f0000000840)=[&(0x7f00000001c0)={0x0, 0x0, 0x0, 0x2, 0x6, r1, &(0x7f00000002c0)="a5548e6eb57f317b3ee128aeb74cce18bd58219fb3e2f5c21a658ba07ccb959497b74db74e0d5e16c1bbd255b338a911dbb72b9b9a3c69105636a9965a8a429cc6b52dc021288ce3b0dceadd417a01af14650573af3016257cb0183369e338abac4a2ae8d885d6cf7ffcc2a6b7c0730b9d2cd5571fb495b458aa113f9800b7cf26", 0x81, 0x7f, 0x0, 0x2}, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x3, 0x9, r2, &(0x7f0000000380)="9b2059916bb323136092a8e4374972e9b10d7d2e8fd798363a34a3c37a88f6a53132ed420e205eb78a9e6703b296d6046b9921c7ac8b9bb52ef3821a2fd021a3146d314a2fcd1949697ada2d9dddc9c4a0", 0x51, 0x9, 0x0, 0x2, r3}, &(0x7f0000000500)={0x0, 0x0, 0x0, 0xf, 0x2, r4, &(0x7f0000000440)="eb5305f40145f558becffa32530ff3f4d82625f2e2ca110b457f06fc2f5d2212094b6a99e78e81cb44beeaf37f9cbd346596d673cb4db3c8718d0d48dd48eac41232700f96104af75e657dd9b95f54f79c3287e5892e97c410cf0d1a07af5fa6fb1733aff2f3b1ad836bc151b92ad57fe79599ed", 0x74, 0x1ff, 0x0, 0x3, r5}, &(0x7f00000005c0)={0x0, 0x0, 0x0, 0x7, 0x40, r6, &(0x7f0000000540)="2521a7d7", 0x4, 0xb6e6, 0x0, 0x2, r7}, &(0x7f0000000700)={0x0, 0x0, 0x0, 0x7, 0x3, r8, &(0x7f0000000640)="240c5e3af1baa2015b10bab9110f604295717e98b99a259de072091c31f23529a4e35cb5d83d9974b8301cfcd613d335974444b82cee264326cbf0660e4cc49d50cbbea818b3369aa0b86e2e08407013342ed6b560ac1483b2a2ae32467a6a56f54ef470a24236270d3ec31b2a1372c97f3e2754696c96114872", 0x7a, 0x3, 0x0, 0x0, r9}, &(0x7f0000000800)={0x0, 0x0, 0x0, 0x5, 0x7, r10, &(0x7f0000000780)="db8adef6305659061cc393145d4e652dabeb84ba67a2458ead291522dea4eb", 0x1f, 0x3ff, 0x0, 0x0, r11}]) r12 = open$dir(&(0x7f0000000180)='./file0\x00', 0x0, 0x0) mknodat(r12, &(0x7f0000000140)='./file0\x00', 0x0, 0x0) syz_extract_tcp_res$synack(&(0x7f0000000000), 0x1, 0x0) renameat2(r12, &(0x7f0000000080)='./file0\x00', r12, &(0x7f0000000100)='./file1\x00', 0x4) 04:46:35 executing program 1: r0 = perf_event_open(&(0x7f000025c000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x11, r1, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r0, 0x2405, r1) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x0, 0x8031, 0xffffffffffffffff, 0x0) 04:46:35 executing program 5: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000480)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_GUEST_DEBUG(r3, 0x4048ae9b, &(0x7f0000000140)={0x1}) syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000100)=[@text32={0x20, &(0x7f0000000000)="6601669b0f35c4e1fe16846ba49e0000b9940200000f32c4c23dad78e0b9670900000f32660f38827f95b0040f01d10fc71a", 0x32}], 0x1, 0x0, &(0x7f0000000040), 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r3, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000400)=[@text32={0x20, &(0x7f0000000880)="b805000000b98b9400000f01c19a01000000b0000f43d1b8000000000f23d80f21f835800000900f23f80f060f2140b9800000c00f3235000800000f3066ba4300b8f1ffffffefb9800000c00f3235002000000f30c4c3295f4da400", 0x5c}], 0x26433e1, 0x0, &(0x7f0000000300), 0x10000000000000b6) ioctl$KVM_RUN(r3, 0xae80, 0xa0008000) 04:46:35 executing program 3: r0 = syz_open_dev$sg(&(0x7f00000000c0)='/dev/sg#\x00', 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000000)={0x53, 0x0, 0x6, 0x0, @buffer={0x209, 0xb8, &(0x7f00000001c0)=""/184}, &(0x7f0000000540)="ad40657ed56c", &(0x7f0000000340)=""/128, 0x0, 0xb800000000000000, 0x0, &(0x7f0000000040)}) 04:46:35 executing program 4: ioctl$KVM_IRQ_LINE(0xffffffffffffffff, 0x4008ae61, &(0x7f0000000500)) r0 = syz_open_dev$dspn(&(0x7f00000004c0)='/dev/dsp#\x00', 0x1, 0x0) r1 = openat$audio(0xffffffffffffff9c, &(0x7f0000000000)='/dev/audio\x00', 0x80, 0x0) ioctl$KVM_SET_FPU(0xffffffffffffffff, 0x41a0ae8d, &(0x7f0000000100)={[], 0x0, 0x5531fee, 0x0, 0x0, 0x9, 0xf000, 0x0, [], 0x5}) r2 = syz_open_dev$usb(&(0x7f0000000440)='/dev/bus/usb/00#/00#\x00', 0x9, 0x2) openat$hwrng(0xffffffffffffff9c, &(0x7f0000000300)='/dev/hwrng\x00', 0x100, 0x0) setsockopt$l2tp_PPPOL2TP_SO_REORDERTO(r1, 0x111, 0x5, 0xffff, 0x4) r3 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) lstat(&(0x7f0000000040)='./file0/file0\x00', &(0x7f0000000080)) ioctl$EXT4_IOC_MIGRATE(0xffffffffffffffff, 0x6609) sendmmsg$unix(0xffffffffffffffff, &(0x7f000000a000)=[{&(0x7f000000a000)=@abs, 0x6e, &(0x7f000000d000), 0x0, &(0x7f0000000600)=ANY=[]}], 0x1, 0x0) r4 = socket$inet6(0xa, 0x2, 0x0) gettid() r5 = getpgid(0x0) kcmp(0x0, r5, 0x0, 0xffffffffffffffff, 0xffffffffffffffff) connect$inet6(r4, &(0x7f0000002740)={0xa, 0x0, 0x0, @mcast2, 0x4}, 0x1c) sendmmsg(r4, &(0x7f0000007e00), 0x136a88c8311572c, 0x0) setsockopt$inet6_udp_int(r4, 0x11, 0x0, &(0x7f0000000400), 0x4) openat$kvm(0xffffffffffffff9c, &(0x7f00000003c0)='/dev/kvm\x00', 0x0, 0x0) ioctl$VHOST_SET_VRING_CALL(0xffffffffffffff9c, 0x4008af21, &(0x7f00000002c0)={0x0, r3}) ioctl$SNDRV_TIMER_IOCTL_TREAD(r0, 0x40045402, &(0x7f0000000740)) inotify_rm_watch(0xffffffffffffffff, 0x0) ioctl$ifreq_SIOCGIFINDEX_team(0xffffffffffffffff, 0x8933, &(0x7f0000000480)={'team0\x00'}) sendto(r2, &(0x7f0000000540)="653ffb79d4fdf1e29f416875af3a0b4b5f9177072e2d4c0300c879c2a3141b71aaa74f9de105d871fcbb798801ddc0801828175d7b227ddc3c1e433c2a34498e9e8f1072a8138860d649de2074c7068606cd5d776c22220f7fb9754e5c30578ca4e0e6414da8892a7fa810ed4b5aeb76f03d29bbf7d240cd2864cd703113dcf99b9f368edf7e6659b9e6671bcd520016c56fb037dc8ba70012d36570da4756666911e95a68aab72e7b4c32624e8ba72760123d7bc43b84ed412b0e3faa34d63adafab150c571b99b59b81364f874482c09104af57a4259269dc5ac05d3a8e08c18f60ccb949665352163721d8a1619a43f181ef2be1ea9d6210b10510e", 0xfd, 0x8011, &(0x7f0000000340)=@pppol2tp={0x18, 0x1, {0x0, r0, {0x2, 0x4e23, @broadcast}, 0x4, 0x2, 0x2, 0x4}}, 0x80) 04:46:35 executing program 2: r0 = syz_open_dev$binder(&(0x7f00000003c0)='/dev/binder#\x00', 0x0, 0x2) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, &(0x7f0000012fc7)}) ioctl$BINDER_GET_NODE_DEBUG_INFO(r1, 0xc018620b, &(0x7f0000000000)={0x0}) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, &(0x7f0000000300)={r2}) ioctl$BINDER_GET_NODE_DEBUG_INFO(r1, 0xc018620b, &(0x7f00000002c0)={r3}) r5 = mmap$binder(&(0x7f0000ffc000/0x1000)=nil, 0x1000, 0x1000000, 0x9113, r1, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, &(0x7f0000000040)={0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000280)={0x78, 0x0, &(0x7f00000001c0)=[@increfs_done={0x40106308, r4}, @enter_looper, @request_death={0x400c630e, 0x0, 0x1}, @reply_sg={0x40486312, {{0x0, 0x0, 0x2, 0x0, 0x1, 0x0, 0x0, 0x50, 0x10, &(0x7f0000000140)=[@fda={0x66646185, 0x8, 0x2, 0x1e}, @flat={0x776a2a85, 0x100, r5, 0x2}, @flat={0x776a2a85, 0x100, r6, 0x1}], &(0x7f00000000c0)=[0x38, 0x68]}, 0x7}}, @register_looper], 0x3d, 0x0, &(0x7f0000000240)="6d0130a4aa4968f7ddd377df049ca3ad82d7b2518c85c6a90dc4fe3e932ac5543d6a2dfd51b240087a5cd746d3226ca61eb669b2106958bc4065631c6c"}) close(r0) r7 = syz_open_dev$dmmidi(&(0x7f0000000340)='/dev/dmmidi#\x00', 0x3ff, 0x0) setsockopt$netlink_NETLINK_ADD_MEMBERSHIP(r7, 0x10e, 0x1, &(0x7f0000000380)=0x19, 0x4) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, &(0x7f0000000f4d)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000100)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0xfffffffffffffc2b, 0x0, &(0x7f0000000680)}) [ 649.544068] binder: 24405:24407 Acquire 1 refcount change on invalid ref 0 ret -22 04:46:35 executing program 3: r0 = syz_open_dev$sg(&(0x7f00000000c0)='/dev/sg#\x00', 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000000)={0x53, 0x0, 0x6, 0x0, @buffer={0x209, 0xb8, &(0x7f00000001c0)=""/184}, &(0x7f0000000540)="ad40657ed56c", &(0x7f0000000340)=""/128, 0x0, 0x100000000000000, 0x0, &(0x7f0000000040)}) [ 649.620700] binder: 24405:24407 BC_INCREFS_DONE u0000000000000000 no match [ 649.657903] tmpfs: No value for mount option './file0' 04:46:35 executing program 1: r0 = perf_event_open(&(0x7f000025c000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x11, r1, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r0, 0x2405, r1) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x0, 0x8031, 0xffffffffffffffff, 0x0) [ 649.682887] binder: 24405:24407 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 649.690381] binder: 24405:24415 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 649.722188] binder: 24405:24407 got reply transaction with no transaction stack [ 649.777491] binder: 24405:24407 transaction failed 29201/-71, size 80-16 line 2741 04:46:36 executing program 3: r0 = syz_open_dev$sg(&(0x7f00000000c0)='/dev/sg#\x00', 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000000)={0x53, 0x0, 0x6, 0x0, @buffer={0x209, 0xb8, &(0x7f00000001c0)=""/184}, &(0x7f0000000540)="ad40657ed56c", &(0x7f0000000340)=""/128, 0x0, 0x2000000, 0x0, &(0x7f0000000040)}) [ 649.843928] binder: 24405:24407 Acquire 1 refcount change on invalid ref 0 ret -22 04:46:36 executing program 0: mkdir(&(0x7f0000000200)='./file0\x00', 0x0) mount(&(0x7f00000002c0)=ANY=[], &(0x7f0000001540)='./file0\x00', &(0x7f0000000280)='tmpfs\x00', 0x0, &(0x7f0000000080)) r0 = open$dir(&(0x7f0000000180)='./file0\x00', 0x0, 0x0) mknodat(r0, &(0x7f0000000140)='./file0\x00', 0x0, 0x0) renameat2(r0, &(0x7f0000000080)='./file0\x00', r0, &(0x7f0000000100)='./file1\x00', 0x4) lstat(&(0x7f0000000000)='./file1\x00', &(0x7f00000002c0)) 04:46:36 executing program 1: r0 = perf_event_open(&(0x7f000025c000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x11, r1, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r0, 0x2405, r1) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x0, 0x8031, 0xffffffffffffffff, 0x0) [ 649.921047] binder: 24405:24415 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 649.928509] binder: 24405:24407 BC_INCREFS_DONE u0000000000000000 no match [ 649.945721] binder: 24405:24407 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 04:46:36 executing program 3: r0 = syz_open_dev$sg(&(0x7f00000000c0)='/dev/sg#\x00', 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000000)={0x53, 0x0, 0x6, 0x0, @buffer={0x209, 0xb8, &(0x7f00000001c0)=""/184}, &(0x7f0000000540)="ad40657ed56c", &(0x7f0000000340)=""/128, 0x0, 0xb800, 0x0, &(0x7f0000000040)}) 04:46:36 executing program 5: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000480)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_GUEST_DEBUG(r3, 0x4048ae9b, &(0x7f0000000140)={0x1}) syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000100)=[@text32={0x20, &(0x7f0000000000)="6601669b0f35c4e1fe16846ba49e0000b9940200000f32c4c23dad78e0b9670900000f32660f38827f95b0040f01d10fc71a", 0x32}], 0x1, 0x0, &(0x7f0000000040), 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r3, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000400)=[@text32={0x20, &(0x7f0000000880)="b805000000b98b9400000f01c19a01000000b0000f43d1b8000000000f23d80f21f835800000900f23f80f060f2140b9800000c00f3235000800000f3066ba4300b8f1ffffffefb9800000c00f3235002000000f30c4c3295f4da400", 0x5c}], 0x26433e1, 0x0, &(0x7f0000000300), 0x10000000000000b6) ioctl$KVM_RUN(r3, 0xae80, 0x6000000) [ 649.989858] binder: 24405:24407 got reply transaction with no transaction stack [ 649.997857] binder: 24405:24407 transaction failed 29201/-71, size 80-16 line 2741 [ 650.037606] binder: undelivered TRANSACTION_ERROR: 29201 04:46:36 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0x0, 0x2) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, &(0x7f0000012fc7)}) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, &(0x7f0000000f4d)}) r2 = accept4$alg(0xffffffffffffff9c, 0x0, 0x0, 0x80000) sendmsg$alg(r2, &(0x7f00000006c0)={0x0, 0x0, &(0x7f0000000640)=[{&(0x7f0000000140)="afa95b50736546e0a6a756530bdd0003a20ae4c87760945d373458dc3bd9c61dba26db386c2dac8a8cb081f6c890bf550d41b4c0fed3da648168e8585ab1f3613f5cb266e51ffa8a2d809cb8224e8931988d09772fbb6fab64504bd6f6e0c7999c516fa8ee710c367158ab343fe28762d7c1bc1c0ecef5efdda9465a5fd305f6c470e3a4f57fc0b6eeea561a64c144", 0x8f}, {&(0x7f0000000200)="eb0620be6ddff7c80a3a355fe611f4787aded58713b5f46c39e21fed0c51b2437a97d946f31327d44678445fa9d53c11040080f0c575eaee0ada467bac3a59cdae4ab39baae200d1acaea0b35bad7f2166fa5656aa772a6359bd65a35176c97311c63eae9346737f17e36814b2ba951625c59cbc5e70fec641fea90dad9964519923cf9096e77f388c1f5411c71c587a942c7ab4dcfcddf091b8720a17", 0x9d}, {&(0x7f00000002c0)="2188bf6393245f7008eebb740cb42299cf26c0dcf138cbb9916f77d7b16ccb5600e03f84eb8460c91b6c393aa006fafda2d2cc496081072bb4fec22b53b3d4e4122600e2d40119da5860a091a13a74b499087d91637cd41a17478b037e4e5fbb4eb71cd5845c599c6d2dcdb64dc9febdaab0055f5197a44c06746832b09852fcf2d7b61c5a35229a8aef4cd2fd76a96e83dffbf6b3a8f80c9475994ca92764ecaaac1b347741c0a18487b8de9e7838040154a37ab3f077cb6d0a610ac33685d45d9ecfec7707d14a76997fec2005dc5003cc1f7e4edb6968507310492a013003f03e72c2", 0xe4}, {&(0x7f0000000000)="cd77ac57cb1a97add270dcd92ea022f6ac5dd28ecaea2e8287bdba82c5868000874467027bb804344ca54ed0057c23f8c821fadb8028ac8ae5e88205b7afce868b99aa30ae6660", 0x47}, {&(0x7f00000003c0)="74468565912cb61c264a393e4310dfc61a3260a697b66008f0d889490ed9af1c7f53ad6c61b19ad021f05fe7af7b287498dc58f5e4e4bc7371f97e65bdab112133d6175fb2dcf6548f7c56e7e6560834da6b750ab6e7ef22fd542fcc4de9c1a5e148c352cb8ecdcec9d2d335d538668b91aef1e590523f67f3499e426d974791a02cdbea652c16bbe848fc16b215230a2213105aabb98106a26a471cb7aeffb23325e3a26b73", 0xa6}, {&(0x7f0000000480)="868c3dd24956e8dd13129276b0b0e095d2b91f66133504702e3737a95751a7be27040574655b1d24788310a1f4a35afe86e9776a4fe98213112c3db0e45945aa0b53f181784613e4fd644cefa210ab8a0f8d3bbdc2afab843f6427ad94c88a43b7dd48cbb1af4a7505dd6de4cab8d67138125596bda50b40ce0e5d848847187bfaef0a43f2fa37dce2e7d1cbd2ba898c95fd1409484a", 0x96}, {&(0x7f0000000540)="ce90c19e752cea48aaeb3013acf161b7c29bbf7bf8638eca1d5de1e3f9da0124cbf712e29ceee528a8e3a131fce7a6c31dc46ca6e72e6f5b740da989d26f0922126dbaab6986f3f7c7eda128e6fead76b13844029944889e96c6146fc0d4108265a8fef7c0f56fd51be06eb4a1d6684f8019c406", 0x74}, {&(0x7f00000005c0)="698402e741cc36e4d3c6bb8a82452679e17be08353bee21fa5a678f74adbd85f9cc67c3e7867b0c09e2b74876c61aebc09491ffd3ead87510089340efb5af2c5972c59ced27b1232624c3fb658f283bbd4398f6cc0b2ee1d47fecd6e7b0b74e10fd274f59d228b24a3a5ff6490278b643b2340d81e7a608e", 0x78}], 0x8, &(0x7f00000000c0)=[@assoc={0x18, 0x117, 0x4, 0x7ff}], 0x18, 0x4000000}, 0x10) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000100)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0xfffffffffffffc2b, 0x0, &(0x7f0000000680)}) 04:46:36 executing program 3: r0 = syz_open_dev$sg(&(0x7f00000000c0)='/dev/sg#\x00', 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000000)={0x53, 0x0, 0x6, 0x0, @buffer={0x209, 0xb8, &(0x7f00000001c0)=""/184}, &(0x7f0000000540)="ad40657ed56c", &(0x7f0000000340)=""/128, 0x0, 0x902, 0x0, &(0x7f0000000040)}) [ 650.128199] tmpfs: No value for mount option './file0' 04:46:36 executing program 1: r0 = perf_event_open(&(0x7f000025c000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x11, r1, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r0, 0x2405, r1) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x1000004, 0x10, 0xffffffffffffffff, 0x0) 04:46:36 executing program 4: ioctl$KVM_IRQ_LINE(0xffffffffffffffff, 0x4008ae61, &(0x7f0000000500)) r0 = syz_open_dev$dspn(&(0x7f00000004c0)='/dev/dsp#\x00', 0x1, 0x0) r1 = openat$audio(0xffffffffffffff9c, &(0x7f0000000000)='/dev/audio\x00', 0x80, 0x0) ioctl$KVM_SET_FPU(0xffffffffffffffff, 0x41a0ae8d, &(0x7f0000000100)={[], 0x0, 0x5531fee, 0x0, 0x0, 0x9, 0xf000, 0x0, [], 0x5}) syz_open_dev$usb(&(0x7f0000000440)='/dev/bus/usb/00#/00#\x00', 0x9, 0x2) r2 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) lstat(&(0x7f0000000040)='./file0/file0\x00', &(0x7f0000000080)) ioctl$EXT4_IOC_MIGRATE(0xffffffffffffffff, 0x6609) sendmmsg$unix(0xffffffffffffffff, &(0x7f000000a000)=[{&(0x7f000000a000)=@abs, 0x6e, &(0x7f0000000700)=[{&(0x7f0000000600)="52ff52acf308f9632a77c8ba5748f6db64c2b4ff9d4236f1dc1fcfcd18be3c13e09d1d1d9b14b8c3d24877d7013b01e579b0866ff5fa842dea089038b0db7a062c896b8defadb7cc50233bf490ef5d75e9b5aace6e7b523caf4fe791424cf967864eb789b1d146fbf63e7a6e23f946f534", 0x71}, {&(0x7f0000000680)="8b044c7b2253e8728859a448717dd2e7fa214ea7d67b23335ed5d21679d524bb6467831a7539f6fa2216abe5d0c77906468b4487bdf22cbde1679a4505fa85a65400deab84891dbe88c03f5d9ec53ee701903dc6c56fe92d2fcb95921530eb1ad28f554df5b8450f42fb7783486dd0c21c49", 0x72}, {&(0x7f0000000780)="c35a10cb1b126ba8e7749ad4772135966116a0d5b309be438c1f97760b28ec1141d6423caa48f64f127f6ad40a667486a75404d89b85210fad51528eaeb4df04647fa617f7deb1dae62324eaf98c25e5f458f690778a5e16d03c2b4fdb3cd1d573320fe0c0c9c66118ff5ccb1968af9f91f163595d608f89c6af456da40a31ba16a8a078a967c6ba87657df9620922869e3f8d418969203d8a24ab84745fb425d98163be", 0xa4}], 0x3, &(0x7f0000000600)=ANY=[]}], 0x1, 0x0) r3 = socket$inet6(0xa, 0x2, 0x0) gettid() r4 = getpgid(0x0) kcmp(0x0, r4, 0x0, 0xffffffffffffffff, 0xffffffffffffffff) getsockopt$inet6_mreq(r0, 0x29, 0x1f, &(0x7f0000000540)={@mcast1}, &(0x7f0000000580)=0x14) ioctl$KDSKBSENT(r0, 0x4b49, &(0x7f0000000840)="50b2357ba35918f383169081bfca1619ca828d6d6dede6869d9d61cb7342eabf3e21fadeca74b76a7e001f83fbe46e460a39401ca43a21633ba15b3f09bf92bbc11f5dcd6c9a8c4079bb45c10f600e0fb044ef7e1ee98738f80cce585020ea8e75741ba8f4894fdbef86937ff15a5667d0ae95c8d7d2e3247ec5f5cadd118eaa9ed158fef6f46c8a9eb4bf54875776ef3344d365badb152a223ff162a1398601933daba6fb0b039ff8b65ae7a5361bf563cfd5321cc5b3c4f264c47c9227684c48ac5038c4513dc54d88a496e6518ae3c15eb5bd4864d7a40091b126db6bfe7541c8436ee3d0c3fa1aa608a149bcb511323f39c2e97c3fa795dfb203ed361d4ff855bce2fe33f41e7d7a0852679872c1179cab9d01f111a2a5555d8c77fe44853dc3c883a12b2f5811a2e9dcedc62a5c4898c6435048469e64a04ec75a7708a1a4e00b56967a5fdcc7a32475b442b68cddd8ca429d3314938604ffcd7e028dcbf117df3484186e2d8df8eb79dcda3da81736b47946bac837dc80c35944604483969b4428dd07befdf60d1a42c096569eec9a49db4663c42fa6e78fc4f84ab287ba4e573e0da150afff996027f9034f26d6464669ea872b9b1504df46f9e60c5e310d17cb812f441e99fdca38023a7b6c25e332714872a28f53fb3d839a4bd131fbb83d67972f87fc8ffa1dd70cd0c3f505b852a184b40def49f6e3da77bdefc5f2f2080023017c9b72ae4861a37f2781a856b54b6bc4e33a8b22843a0c7e411339c104725789578e9b085e8013163dd2c6c62ce9c02c50dadd86029d02c7488d1b0354b91769ee79999b3d61a9b4df6dff11f588a0e5895e93dd5b6e01e418073f13536e9cb62797a91785bf97941b574d7f854c216a9e0ccbeec45ebcc69a7cca11147eedfe244737fc03bf3eb3a64fbcd7b8e862ff6bfa9e524d2302525118bd4a67b575d3a43deaeca89f25065a62cca9cd752795d949bbcdf1b148e492c59bf2ef3bf339631a21a984d0a14f4edd0dc7d5ef9e6453c3e38ec8a84990e5193e7de22865b5fc4044124fc4da113a0476cf1ef742ac59aa3b815dbf1092d25632b15e4dad885306a5a4dd881193b25294c72424c5d7c56f00362adb880bcb702ef88f7a9ca88930c230b86b8b97620272ef7e4cd62f2e581f4d2e3aeb118b7e9a0a3410ba84266b81e5284b5ab8d97acd55c53e36571083594b9f2b97c704d8c2bbf4f3bc950307d99b2fc30674a530a3eab05560ad58cced07a3fdbddc19581a1602277850c3b0afb4cbb224e623e215905564c6349d89e786c35d3746544b2fc82d4e62c1dc339dc3c80266b9df2ff0888c05e98a662b42eab927a1b2d14b7aabde518e96c36742a747ce8c868da9fb4f6b36f6bb71409be503c931e5d3e57851efb3f65c614ad1fed0883fa02ed2b48758298c29e4a328d3d7480f8d98f453cd0e2b98925c59449ca857c260b8a89d791a49d5d823690b85ead66f1df1e35fac93a5530af65e6dcb6f2c150378f153606ad8ec3e38dd2cffb352b65cc95dbbb056167c5e2bbd523d253a0aaf079137edabb9c4c873706164c09f094a7dcb6cd555e93fb2f38231a1ad43aabf49ad2f77065fb89fd08f295dd53c414788dff1a75d08dfb73bf4d54b87b613fbaee01e47ffc353c92ba037b152cd796d743ee6694a6dceb4ad362425e76d1216b4545d2551ce34ec206f10f931c9e67fc01e4244f728bb10221043c7a951bcbc091fcbfff700bc2da38e5506050395270357ba10ce59341a02a93c9ea5427cd8358fbc313a52b26257009c1e22d3db91b8ec1c1c3dcefc3167cf90d172fc4e69ef649e214336c172db1826364df13b5425539b8db50d8239f344138f558c26bdfbffab359b320aa7cdd9ed3574b8bdfb1db66e3589d08de97f7cf07bc48e63f0613f2dd9a799c3d608673eb0fc35ccdc063a42963b584118ce19143fedd132bb9c129391fa1ac10422f3b95c7c354e762f77a6bef2a30741cf92bfe1c961d4a34afacf70f434370d0f5b42038573c89f7949ea5357b9477934ad865ffdad8652e74193aca780c4de380682c4507f3416ef761051180d6437f3f90a40bd383e8caf6409f39958d514dd0f17e6c5662dd6152335cd276f517fde534221b82aeab80918e81075948dd1a3ea3000fbdc88d1236457ea7f9d148e95f5c46420898cbac0a974a8222659635daab94af814af20b5690f7c72d1cc84d91dbf6e04da77c8fd21a306c3abc9f4798e2916588772f9a374509be8928f6cf19ed8bebdb359eccdd23ec75f16fa728da750c7c4d31bfce5b50c3b05402c1f2f4d03e707bf958485a4b35ddf11316482d99eff165cef249ffcbf26374e24b7638fbf28899239c66783d81097dee2401efb9273347fbd9d0105aa2686709263ca6298673d9022d031b136960c1c81bae9951146fe06f7031e5417e895e733b7616aa82f07fb3e7ec31fee16b0d1ac34c71d57e07dff80c66ba00b66fb780f1109b25a9e9dd961dcb6336b35907a387c20150595ef32975ff7f082327d43493b08c80f176d0ef33d258089a9b8b38934fda6eef62e07084dd803ed6bd1dd367b73a072639bb4d1b8408169067c2fff70122f24c4729a017a1fb8327160f7c5cb9eb62dce58d55fa7895fa58aed9bf4e66d8dbdfb91994412d8e9ee7b955b4761421d79c3c4133d0b6083d65071c6b30737568351d84213bbd82031686b624a25a89668f48b3c1aea234a325b5841f6f29150c433e1468d577dd6b961e024c861bc0f775702986f1fdd2ede52bf49469bca0812959c096c290a744771ee4d3550d4fed5fe1731c29416b1e5120357ec56ab1bc6256555726df669dde0bab8127cc787ff204152a3cac03a11009a33851f6c4bb5e0116678db25a187c2eed8f46d2aa674024275857ea18a9c2ab2422282418a8c6097a224e2b436d1a2b61deb7d2e08e7ac2e6c93b7b1e1f787c4a6f2148a8b8737cac98be6dc764f9176ceafddc35551ddef5c520b9308c9a706edc969b5ceb629abe1a6820ce04a242801298adb31f2de841e5305bb4d9110a1efbfa50cfb6771d77333f375700049213e4b8d25f6c4882b500b11dc7b27f4143456c4b4d2acc17bfd36bd5e74e51aede7aee791690e82e63b335a29bb9d1877da9755090dd63b2b1d9455d4ea69e492eb6975e8cdf01954328ef2cdbdd1268320b1b82973fdeb5b06566191d6d71c60280e4fe56a434fb79f1cd9f0ce7975bf9cf8317859fb339ffff0a4cf6b6197702d96508205b2f3713436aa8c5b3793df7093de033bec73093a79a3d2b8733211e6fa84eceaba935bd520e701a24d81736351b39b85e964acae32ff58bd48f3ffd3b8fbc6e52925102ca5411a47abe00baf4acff2c8eb400f86bc49fb153a46eb5028d232c5e624379e1ecc02968a03d8b2362730ca2820e58d6b2c09a9b962eed76a32467e5f0326a82c7474de767d7820ae5dbc49bb36222dcb2bc90fed87ecdafff57be1a10596daa5bf1d04ffd3b5e2cd1b754e64a01b2b4d0b4318363373bf3cd97282d09b4f6929f5d8aa3adaaa45f3a0cb6c1ec85c67ed6713fe263c88cd465a4e9267882875f179acc331305e561aa0a0aa9d259645f69aafa92f5a9a87feb540f0b1fdcc0f1fcdd3aebd20e1b7c86059959a4ffdde5d401ed3cd26e014c067dcd83a04a4cbce9055b7cb7689fd3ca59fb20f1fe9cd431651df83073a86df183a9aa52ab64f79f33a6abde32685f324477cc63b8b8907cae3a10a9ab8001c757666cb2eb695055dd4973fed890dd26a5cbe257dc65b80d202d4394020c43064301776578d79441d0e00307d09e1ebf5becdb529ccb18e08eac470ed4b28fd72b30e26aa9375385e3392b6f375b643b5c3320b4ce63c5cb1a0672927d5df6da94d672ce9be6f300959d529d822336548d5daf4a70e835c9e65d8f35c18f6d2199790f44a196778cae33af33a71df92fa2dfa54e2865e3250ee91dd1f170c3eab09af2d8460c9a020554dc1a73431dd08c2172cdc1b6064f3b73d92500c4a2cb12d49aeee818bd02afef0fa504792cdeadadac3950bfb2d60662dd42c9e984d2210e302c7be06a734e5cb5443a432b8587236ce452aa6f4485f9b012e11bcd6762af96f3770c23494261b35ea0a4bdf20b063dad4682f39d71648ca50d38391be5516528053e64382754f55ada37177cbe9197c2206c0799dda57f33051c2ddb2dae8f3c65571f3a95095a47b9d96f7f03b9e4e363150bf34746ed9a1439e88757ba95642ea05095f482a6a01d90b079d73758812762a9b39b2123818af8c66abc634dd1b4f3bf7d17ddc566c7dc7538f6253c71777e59242d9d0c2df1471d40ddccfffeabd2b1d4f54ed659302e527b3fa6e5049afadd5e4388c803567710b508b92b37b4544563d9ef2183d9600ebf81d4b120b556ff3e329252d831e8ded1b7d4262ec0afc75d923975d3282b938eeccae08980db5a057de1425eecba2e8f94823339a544974c7f71dbce3e5da1c2f0bc4486c15cd035368f34115ffcbb3bcf8eb677fa037bf8e8fe2be534e1029317164363c4e97fd9562f9579034838ab2658f4433727fb4b307983a19b545e6242ea1237e505c3bd64b5b2f5c7cba0b6e5706cc05cc36ae94ccb35b62af1508e534a0271c9e6bd80b33816a8ac50a7037b5eacd158cbb47aa3ae39041f99b8224787c5ea9ccde44e195edc9a1947b39079e89fe5b8db043c6d490c337965826983fe71ce6271addbdb67d153a726f8e751b26580eb8e0b72eba6264a369ccb9e12a7f39c2fea2e2bb16924e31336819838912962b73ce39d61e1c609e62b0881b15d125e94a3c4d636b01b6753ec165429ef9326962add6f6a4a0bc5a20a8aaaa1174004ffbb93d2c058a6dc82e128b4978bab2caf8e6f80243624388a8ccb58e96bc80737acd9726bb630e5dec9c323914732cf542f6cbe260b73cfbc2ecdbfde833d46fda66c8134f09c64bd58bbb101d9ed8944185f161f280453aa85cdabcd131db3535050dc4dc96042fe541d45dfb87217a03e2ee4e5b892e0efc3dd55a51320cd3d5055921012d13e103d64e5c0c6b43b31bc08894773a6967378c6b75a5edc02fab4ce4b734ae3107d51ecea242952a06ec317925e7207fef46790d02eba339ce3954196a41f27a142fcf778016089a89fdf5745f976cfecbf887f87cd650290d10051012a6e0fc750f37be64ea15bce214678ca151d094b85a66755fb1ee43e21737920f8224d624cc2cf8363cc4f0459351f6db1e1dc803c9190ba9958bc50839ebca212770e6621695e732d0f8a88b70efa6babd18969116248affe81d0c39abe24daaf786a6089daae523201cce29b84e2ec0300bedab25f2bbc6d5660bee6245d85955339644055b18d3a739b07b6cf5939da69aea523f0f7346c232c3701101785047b219629186ef3be996667e5389b960b93b47c926eafa7dfd30ea94105797d3f0a796e52142fac27b72f28c6559e0b16b8f10e11dde03034269b2c972c53dada752aa45f9b6b1c3ecb8b8c58a80fe544dd13474b0b1f3f0fd74b2676841d70a4c610d9346328e9606d4abb7be54cbe5a26a1892cd36d0fd4c06fce4fcf225421e660a0728e9db908509fdfbc2ce664c71e7c73ff0860d23b57686eee8750d0d6d6c4efc6ce29c94bb2cb738d672c1e83e880f48129eb1fd04f5e1f3c8bd5312bc748dd5527c6628f91b866ee781d8f14ab4e1c6b04855f798216bc9e2f57a334a9dd41bbeb13c3481873003d55a471bbc99bc3e11bae9ae9028ad2a49041b4e01b4") socket$bt_bnep(0x1f, 0x3, 0x4) connect$inet6(r3, &(0x7f0000002740)={0xa, 0x0, 0x0, @mcast2, 0x4}, 0x1c) sendmmsg(r3, &(0x7f0000007e00), 0x136a88c8311572c, 0x0) setsockopt$inet6_udp_int(r3, 0x11, 0x0, &(0x7f0000000400), 0x4) openat$kvm(0xffffffffffffff9c, &(0x7f00000003c0)='/dev/kvm\x00', 0x0, 0x0) ioctl$VHOST_SET_VRING_CALL(0xffffffffffffff9c, 0x4008af21, &(0x7f00000002c0)={0x0, r2}) ioctl$SNDRV_TIMER_IOCTL_TREAD(r0, 0x40045402, &(0x7f0000000740)) ioctl$EVIOCGKEY(r1, 0x80404518, &(0x7f0000000300)=""/138) inotify_rm_watch(0xffffffffffffffff, 0x0) ioctl$ifreq_SIOCGIFINDEX_team(0xffffffffffffffff, 0x8933, &(0x7f0000000480)={'team0\x00'}) [ 650.215233] binder: 24451:24452 Acquire 1 refcount change on invalid ref 0 ret -22 04:46:36 executing program 0: mkdir(&(0x7f0000000200)='./file0\x00', 0x0) mount(&(0x7f00000002c0)=ANY=[], &(0x7f0000001540)='./file0\x00', &(0x7f0000000280)='tmpfs\x00', 0x0, &(0x7f0000000080)) r0 = open$dir(&(0x7f0000000180)='./file0\x00', 0x0, 0x0) mknodat(r0, &(0x7f0000000140)='./file0\x00', 0x0, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f00001fefe4)={0xa, 0x4e22}, 0x1c) listen(r1, 0x10001) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) sendto$inet6(r2, &(0x7f0000000280), 0xa5, 0x20000004, &(0x7f000031e000)={0xa, 0x4e22}, 0x1c) r3 = socket$netlink(0x10, 0x3, 0x4) bind$netlink(r3, &(0x7f0000514ff4)={0x10, 0x0, 0x0, 0x2ffffffff}, 0xc) r4 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000040)='/dev/dsp\x00', 0x441, 0x0) setsockopt$inet6_udp_int(r4, 0x11, 0x6e, &(0x7f00000000c0)=0x100000000, 0x4) ioctl$TCXONC(r4, 0x540a, 0x1000) r5 = socket$inet6_tcp(0xa, 0x1, 0x0) sendto$inet6(r5, &(0x7f0000000040), 0x113, 0x20000004, &(0x7f000031e000)={0xa, 0x4e22}, 0x1c) setsockopt$inet6_tcp_int(r2, 0x6, 0x17, &(0x7f0000000000)=0x2, 0x4) close(r1) renameat2(r0, &(0x7f0000000080)='./file0\x00', r0, &(0x7f0000000100)='./file1\x00', 0x4) 04:46:36 executing program 3: r0 = syz_open_dev$sg(&(0x7f00000000c0)='/dev/sg#\x00', 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000000)={0x53, 0x0, 0x6, 0x0, @buffer={0x209, 0xb8, &(0x7f00000001c0)=""/184}, &(0x7f0000000540)="ad40657ed56c", &(0x7f0000000340)=""/128, 0x0, 0x4, 0x0, &(0x7f0000000040)}) 04:46:36 executing program 5: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000480)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_GUEST_DEBUG(r3, 0x4048ae9b, &(0x7f0000000140)={0x1}) syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000100)=[@text32={0x20, &(0x7f0000000000)="6601669b0f35c4e1fe16846ba49e0000b9940200000f32c4c23dad78e0b9670900000f32660f38827f95b0040f01d10fc71a", 0x32}], 0x1, 0x0, &(0x7f0000000040), 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r3, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000400)=[@text32={0x20, &(0x7f0000000880)="b805000000b98b9400000f01c19a01000000b0000f43d1b8000000000f23d80f21f835800000900f23f80f060f2140b9800000c00f3235000800000f3066ba4300b8f1ffffffefb9800000c00f3235002000000f30c4c3295f4da400", 0x5c}], 0x26433e1, 0x0, &(0x7f0000000300), 0x10000000000000b6) ioctl$KVM_RUN(r3, 0xae80, 0x3f000000) 04:46:36 executing program 3: r0 = syz_open_dev$sg(&(0x7f00000000c0)='/dev/sg#\x00', 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000000)={0x53, 0x0, 0x6, 0x0, @buffer={0x209, 0xb8, &(0x7f00000001c0)=""/184}, &(0x7f0000000540)="ad40657ed56c", &(0x7f0000000340)=""/128, 0x0, 0x0, 0x2, &(0x7f0000000040)}) [ 650.444376] tmpfs: No value for mount option './file0' 04:46:36 executing program 1: ioctl$KVM_IRQ_LINE(0xffffffffffffffff, 0x4008ae61, &(0x7f0000000500)) r0 = syz_open_dev$dspn(&(0x7f00000004c0)='/dev/dsp#\x00', 0x1, 0x0) openat$audio(0xffffffffffffff9c, &(0x7f0000000000)='/dev/audio\x00', 0x80, 0x0) ioctl$KVM_SET_FPU(0xffffffffffffffff, 0x41a0ae8d, &(0x7f0000000100)={[], 0x0, 0x5531fee, 0x0, 0x0, 0x9, 0xf000, 0x0, [], 0x5}) syz_open_dev$usb(&(0x7f0000000440)='/dev/bus/usb/00#/00#\x00', 0x9, 0x2) r1 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) lstat(&(0x7f0000000040)='./file0/file0\x00', &(0x7f0000000080)) ioctl$EXT4_IOC_MIGRATE(0xffffffffffffffff, 0x6609) sendmmsg$unix(0xffffffffffffffff, &(0x7f000000a000)=[{&(0x7f000000a000)=@abs, 0x6e, &(0x7f000000d000), 0x0, &(0x7f0000000600)=ANY=[]}], 0x1, 0x0) r2 = socket$inet6(0xa, 0x2, 0x0) gettid() r3 = getpgid(0x0) kcmp(0x0, r3, 0x0, 0xffffffffffffffff, 0xffffffffffffffff) connect$inet6(r2, &(0x7f0000002740)={0xa, 0x0, 0x0, @mcast2, 0x4}, 0x1c) sendmmsg(r2, &(0x7f0000007e00), 0x136a88c8311572c, 0x1100) setsockopt$inet6_udp_int(r2, 0x11, 0x0, &(0x7f0000000400), 0x4) openat$kvm(0xffffffffffffff9c, &(0x7f00000003c0)='/dev/kvm\x00', 0x0, 0x0) ioctl$VHOST_SET_VRING_CALL(0xffffffffffffff9c, 0x4008af21, &(0x7f00000002c0)={0x0, r1}) ioctl$SNDRV_TIMER_IOCTL_TREAD(r0, 0x40045402, &(0x7f0000000740)) inotify_rm_watch(0xffffffffffffffff, 0x0) ioctl$ifreq_SIOCGIFINDEX_team(0xffffffffffffffff, 0x8933, &(0x7f0000000480)={'team0\x00'}) 04:46:36 executing program 0: mkdir(&(0x7f0000000200)='./file0\x00', 0x0) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) sendmsg(r0, &(0x7f0000001500)={&(0x7f0000000000)=@pppoe={0x18, 0x0, {0x3, @empty, 'lo\x00'}}, 0x80, &(0x7f0000001680)=[{&(0x7f0000000300)="386b4299ef9b331027c72044c715ecb5ea293ea667be63a2e365ae57278fbe74c4bc357c18cd1f1e470d7d0cbf102bd127626404639b367687b34109e0738ff8f8c54c7c6eac1664", 0x48}, {&(0x7f0000000380)="fdb34eaf53363c69783ae434302d127452193fe59034b6d6866bf9045394544d621761b74aab77db1341e5c56587ad9a4cd638e9cc959584d95c25f23f5db7ec3449aaddeca4e2d7e619f25a583c981a2288baaf75b72e9e844239002611af65d399cdb70e51d8315a32eb20ae7af1010d5e264f99c02bb67f205fa831d56b11b68f646af327455464e188d175d8debd25c500c0c0974fb31fe85f805ce8d0e6fd634bfebc0339b00ad26b615c340190db8c3b5688ca88003f63c6053aca3bd1944b87b2941feecbeeae724dd5bf590e9aaf1d0b3baa5acb81dd8ecba265ff8fc1caf10efc9b1826a213291592b91bd25ca3d80e494c49484981c278a2a7501e730590c46cb8c66f29c48c5341c623800d14f66d8bdd153299ce94eb51f4c127d1a07f6d917bb8703d29b087b27da9772b0603ffeb16ebcaa63d9d65c948ea92f5a81e3ebb676481c52e6f7fe7f7db83a64bafc8d95286e4de8a693c34591e8fa55ddd7e11e90f0339f29234e2ae04440d91c4e5274824961bf2848fe5af1136f2989b8a26b39c9537115a973e7632e79d4ee54d319793201d1f65dd3c8649fda1add12ed03c16cc37e81d8a677f87e7ede15825aa6f7a3c0bc713f8f1a3ff953c061a9d474d8f055f8d84e1b73a716af469cd305f2fe9aab6dfb1420f61f1eae5b68c58a4168baab648095a9fb24f8ea52743af8f80b8c54edea46db11448e3706260e4ee31d87575ad041f846cfa2b93f16bd8fcd8fb5f5ec5f79c7b09e768482201ab58b41cbc9a573236ceb7a2184e615ef4314eb135890a48cfcfc0fab5363c32d5264d7af02d427413ed7d8af4736938173781b3e0ef7145d4920786d937f4fb02ff16bbfe1fc3bf9a6947cd70a8e5426db2c8bf966f32f7e6c837fb665c6e490f919e2337d801b7ea1693495d0c2b826720bb3776f15d0499f4f6636731472cd2f1146e7a3a0f79bd19d5a06c865b5d46e6fedb9a0f71e8439b17e55b81ba99667783a0d46ff6e7c173e2a40df36255b35e73040e25be35b6b6234b27f959d3c058a5844e8c3eb1271bed1f16afe5774cf0f4c9aa9216c9654270994cf1f125ffb2c830c398ba3f01a1b3a42370abb9e8ae763118d93cb23feabf3e8e761aa300f8eaa4e90ed113cd5cd4188118652d3c55b3809d992823d49ccd4664e33f705b8f4a745348b220db88ea9357590f4a7c216f96c471f0ba17ba3d9cfef9032da5cffef0dca57bc5879bb58893ee2d6287e0154855cdb3ae118f2a6e9e112852d4e96a38fdbf1fb9aa6372ae276d5f6e34257c69ca757566813200253f062b6a3ece843cfda561dceb91d07a09b3e110052578f94d04a44cae17376446c963da6f2ff502148da1a5cbf29f5cf2ec45a0c0af9b1abbc7f486cc71841897a58eed7c67fa083b208055742de90be976dea60557ecc5a16df21ceead64ebc1c48014478906c10093afa030e4ca57862e4917cf6e2c053b8aabb230a4a148e12a8b4901363d7c90a55d1d6a795b2a32f7434b0230e2955ac9bf13222f4ebefd38a4bed253e15d37e6a383c387ec5cec8b26efffdc4810c331ed20d1efd1ce03bab9f339adfae50b72750f3f83b5692fef64dc297dca5e4fa19d184091821ed0b6efd9bb3bfdd2e2adffe97dc83143bd006f1c84229aa0c10808ee896a5e28e563a0359482a06d960ce98854ffbcf499a93e42a1bf81652c6eea366ef217aab2feafe3101ce1771810c43eb6f5e4a80d2c0cd18c37ef8b714684876e02ed06b8613654315fd2d3f2bd7fde9c5fbbe125c227f50d379f71fa9924194a6a90503c31a2b19819c66600b1e7b036c44ed0711d22c6fa4664a0d0727bf33c48c926d941c7b08e520e017432716d261249ae3b43803fa7753a4ca14fdb14d48dc583238bcb04a4a8b43022997be62f0f4e656ee2b0f1aec71c8cf04daf08c63321384edeb126a2c80c0ba87d71eec28494f53fae74a2a1afde12be4724b4faffc143df4a9265d41422b46c21b46a7515a9043636e42c2f6ebc9a6c0bd1d4864a0f9527fc70cbaccf96eee87428e37773fdb681f5ae1c56041865de87c60043929bbaee9cd6e412a0b05e0ba83472d1247bab98df6136c426643644cbbed5cee16483b9357ee1baf770ec4b91002febe0b1157418cf6a7aaec89d48672300109c85fbe7512c65c392749c165c7610ab1ae599041e41a8d61012136ba4fd95c76e28959ad5f791f6f048782e721747e5dca4bc131fe2875f296ccac969b83ddeaa2be054c930fca6a17e766c22a54f41bd98aef90232d15c906d569e14b56a9493fb0f2aeff6f77ab4881d1f9feee0ec908ba86797f58195cfce48955330a29363cc751fcaf776d8df2b6fb81c658f2e5529f43b23969595b6aa7c7e2b35d79ac3d4a63cdbf4b67f11cbf4810f8e945c72a7fc214eec70a7f4df591fd595f9d3494201713be8e7c950e924d754970683f8fbcbaa52780061ddfeff00a8c1740353434b6188b91c72c1f847e443b53b9eff24218329520303559731f55380899949089779154d64ec1b1b5fa931f078ffcd911ea42694ce2545f8a00b0192e503c3c59797b30252c4b8872b2330e3b48bab1636c1a7a683c8e67bb9bfb2fa864ad3e35d1e497313e732fc5f874847559d998b51a37cbf3e3445127910903befbad10ed5e09bb3caea22f76d0886c5eb2ee3646c2d4cb6f13ddf55598f9b932b29b6b764e92e4884d4a4d0437b06c056b4dc1207b99f099feb132bcdbf9330391cf4d84c8007273a3d4ae7cc16fa1264e7e9284289eccca37d9b9dbb42311755c87dabf5dbd2748e38b4ff88d791c4577e683e82b0e5dd8a97a863a76cfc099105453cdb163db74d1584926a20b513368aad58798145b4e98a2e5c6453b5183b86ad954c1ef3f4fed299437fa61d36f8fd97008a8c2732a4680580f9e67031330a9b887fbb7a0ba76ed5a403493f7363097e6e5e77f8e9c67929eeccf6e206b195ef2fd06c4088617a38d3c74bbfe1e566fce85876edb3eec1afcf44c6ab4958f2229573a2cfe283d1a8e129d586a0e70a9f6b12f322448adbfd366312051b8d595778ff4124deace1855883cba7e27908ce73ca84ccb6a7ad416e9aac34449f01e0bc66d1ea9bb0406a8a98ef64e372f7b5a3d14eb2d883cbaba086e1cb64a6f8e2f852327fe4465806b9bd5b301204e65426128dd053095d07fd95db083357ba4add5d4da85bb669c2181bc3d18b38e62e3a78feacd34d04bf001095558cadf95e53945476fc33fa5623de74e24a74ae2daab79a0a639cf2b2f363553b160a41409971c5750ffbf55229574e7d76b52c066732d2347b6d846cd5a5ab0ab477b74cc9cfe630155b887170d310ac1da4b1ba11b2f9be448bb7116ac81acb497b2f6f94626dc352a00adc0e7975b62448258341399a379e07c8c949ed2a686ba3aacf3703c5f674084263285a94f5b9a639708e3aa6e8a7a7935d3f1736c52d2d4deb2c9113f8df9dd9a9a0f6e2f389e2398d315fe39029cff553e39a282b549e43058b836d027cc3a6c319a80ca6b7938a5c4e269fe8702126ae5f4958ef5c3bbb9db91040d55427ad2e4a799b9c5fe833cd5297fd564747ca958fd7aef40ba82cbf7bba7f26e61197ec8b170ba8ba749622a1dc8120197acf9812650f8b3713f25923858a0e999c51f23acbf4199295727fc24956a3ffa7a458f99553570f7cfb69e17d6f8a8190f116d7f65abe403f240fc64b159a1a9f8ae4d6c48828e8a45247062fa6eebc1625fa9011e551c346132ff9208a9f68baa68bd6f5eaa7ea2ee4ae03fcb4a5de0ddd6dcc922c9ecc7522182daefcafbced31312f1f3c9aa64f966840fa7b2e4a21df66248ad718aa94293643a27fc7e6a14da9ee66a22b4b7c04ce00d32fc513fa78d77db920c9125e3eaf177ea5b18c58c0dd262bae283311eb025c904a7d9452a77e322af03b68640a2e683ddcf67d02681cc8f6aee03b60c8f0342482990688b1542d7f3c9266025dcf91c96c58a9b2bc38736ce2704fb2568f74d35c6567718088556d9521901d67186bb156dd18f6a34e8716d428704ddf50dd0ff2b25a6869bd74bd67df8ff6ab35e2e02942d7864ff1276d4ce76c3a9e78a41ac111cd14f6adc34ba6d39d96d2fdfea03a098bafc9195ee64dfc5b0486ada1bf96999b5d0ccfe22473615d17344be0d5312f13627ab212789de11584c1ebe814df110b455fa2043fcc5a3f5709a71a3ab8bfba01334a2e3f562094da04bd98b165d168f17d5c22641dc67471ff46079b0aceccdcc4c1c4a7218b6dbc2e75b2dd7419bacfbbe937ba2068cf6d81793d0278f12428afe79668f01e68b54f36bf7c35bb9456ac0913abe938c275edf94f17b5ab69fcdb94ee56aa9030aa08e952ffcce91b5075d6e17f139a04d90fa5b513bccd878e1fe0d1ae5df25d4bbb2028ac86aa05c625eec823b23310a41a32e7db6639f924fef99423b17387bcb526ef620610536f73db093315065b025c3f54263bda8c9dad0812d2d6dde690eff58288afd3a6dca103e453ffdf91ce8449f6f86295403fb60665367c82dd588016c95060b2c0047951a86d37de203a938736fdaef9b1962a36668d68b4fe929e0fd7c02875d6dffcc45c14901967a80afede2250ce8b0e7c54510c0b07f5581f0343bb41e9dbaa4a9154f145ed008fd55c23af8d3107ec00eb097455c7b765d5c174b830c313048ed3726d819bb392ec93d83e431c5ce1ff9a6fb5d635b4c743eecd7fdcc8a6e1d3584d0f20bcee6e592067f8b05841dc2d9c018fa847abefdb6b35ff90501f2f0c510bc2e9c5566779235e04a203ad6ee2ede47603ee94d9944e5669746dc1ab792b78d1b51776e58c47f05cbaafc210a7e648eba364b8b292d113b18ba24c0d250276a8f467fb4da85ba7d866c8ca4a2b291ab97b702d711e6259e9aabcfeaafd2ac3cd150c78888e63f6f293373910f6a1bef455a319beb238a2f80f7c0ea743ed810d60064ad08f9db012cab4249ff85aaaa911ec1eee55abbd74bcec2c98de5f79c46e691f2aa400d974eb544b565c5d09f2d25b71c27bbd7002c09877678f052bd5ce941fc00deffc2c77eac4464fbd12c88d1575b74f84443e10ac0dda3d22fe8c7c4aa7b40e4a8ad84da8a56aa398006f9a8d791de30cfddc126b28fdc6645722f877b42c69186daef1b578cf17a2bafbe1527ba59e399f93c0375a5977f698ceaec66381d3e4650b15de699d3f68812261e6c27ecedf46bc46d5ff38e688665c85a73dc85747e4cf7f13306cedf7b0d39a52b2b66ed1072d836c8eef38f34cccec8c1448a3063dbf22a4e1fca3914d75409dc92eae7ec5fc03e7a6acebffd4d3fbb0a675fe075eddd29c19bbb056c058ea46963ac6112560e67190c6a3ddada989a3baa3374ca31f0afd2be29e4495f6474bc19f406e513927ab59c5a705ca40d0f395054ab2bb1ffb722ea19ef592938acd26bed0e5b025a24dcac10babd2a3e2f4bd7fb52ea6950c9bbb892f8f2f0a9471a3c6b75106cbc12953f0fbf88a465c9b1d4e7a07bb8b0e195728e8cfd8aceab0dd89eeddd19e7105b907a289103b9794e467397678e3af1d185af3e7ac6f04638da770a16341d4bbbf3df68d77a1df50541b9e36d7f71487b12cd4e8180ea3319719338c4775209e423dbef9ba9a99f1b92bd9ccd6aa3130da71dd1d6a50bb8166a896fa70b22ce44f5b281c63038db78255759fda7facc5f74e9233eb7838b463394612b9ea801fa93fbe26ffb4bfe5943f966dea8b28b1bbbcefbd962919b614d80590354edc", 0x1000}, {&(0x7f00000000c0)="0d6211ab02c0d44f033660e47060bb4f6766fa1fe4e9b2483eecaacb9b0919728e2002f39ad59db65b", 0x29}, {&(0x7f0000001380)="d9c6ecc21bb554e39000e2122b72a36381383499e8a8539d73b39b48c790c5f1200d80af4d04ea5da1ce5e980bea097c238581e72e13a5a7410971eb79ea0a4889364c08c5b5529d510d4c34ec7db5888fbdf7567df27428baab179bf2fa7ab1ea7a2563d6f7fc122f586e38289c13e9623c8577912b0b118658", 0x7a}, {&(0x7f0000000280)="a13a392a996d59e079f59bec15975865786096e18c89526876eb19161f03398cfc05859096818fc3a93fc4e94f355134bb5b", 0x32}, {&(0x7f0000001400)="fdded7f98f711f767cba812be238fdb18b97376ff99a06729c02109d9b6df7b7a0f4af3b8a83b52efeb8df435057f2be054bbb5bd85248ccef83cec83363cb170da64e3c3af5d08b5fb0509cca7d67b5c5c9c94e78ed3a300f64c781e0deeb698d8fa0c95fdd864aa31a5fce92ad60ad1bd2dd7e9e9be93553dbb618c9ed9d79d328b51745bb5037d4a84bc70a05ee52271fdcc0a7307467c841d0290fac9554f757b3975934920e8c016292", 0xac}, {&(0x7f00000014c0)="4a4727e5acfd089a5d72ceedf8c63cdb3d6a215c603d59ad4da6e83fe4272203ba656d47", 0x24}, {&(0x7f0000001580)="c163e24bdd0340ac3ee4a110e3f0b48c2fd07cd0cedd5b0fb3fae77d3914e5f07ca4c673dbf03eda4150d4781d3a4b1e153e6bd4880bb270a806d9d2c7f00733a2b78faf46c8a003d640ee4a90f109938bc09e75cfe647cd9dd2297e11198b45041bd695b24ff57d3b42192e681e5e6509cb216422a847df29c366a0da39b472a933c4a6c309874b9c11f583f0c90338d3ce6fa5d1b10c098fa7267c4d36f279939a23a9ab941c6fb608d62835ef2aa15bbd85561217fd3a4e58c93b8eaf372aa402801295f592a60f08c4b540dfb44105121d23c1c8a4e8738217130c077ae9357521b87406f694fa58e430cf394971bc35a6395f", 0xf5}], 0x8, &(0x7f0000001700)=[{0xe8, 0x85, 0x101, "49614ba784a19381ed1219ff324e5c36e84bc9e28aec66c6368e06997b05684e8365ebcdab506470ad3c9f9b9340b86e55a1295467b4aa6f1a4d7b76837793719bf415ad2d7e6afed3018d8cffb7c2518102cb9d449acfc3868cf6a8221803ee2f7d2959272591f4fd33a26407556292b7d48514bdd2ddd8a7e248b43f1d55207dc99c8c27a23d996aaad4e826ee46d1a64185fc28a82cf2ea640aaa6fd180436d1f04c0309cd5b8d7baa7a7925202ecfbec0f2dbc5391830d41736d4a40531f457bc8525bff1777c8a507b603b3d0af6072"}, {0x28, 0x0, 0x10001, "77e5a4a1a790520012b7dc6be50033d990808607b3"}], 0x110, 0x24000001}, 0x80c0) mount(&(0x7f0000000240)=ANY=[@ANYRESDEC], &(0x7f0000001540)='./file0\x00', &(0x7f00000001c0)='tmpfs\x00', 0x0, &(0x7f00000002c0)="8c8f46cb93ab2a8d62f1c4c47d5e4d03cfc18c3290d61cdc3a99211ab2ffa62e22d495a9ad9a") r1 = open$dir(&(0x7f0000000180)='./file0\x00', 0x0, 0x0) mknodat(r1, &(0x7f0000000140)='./file0\x00', 0x0, 0x0) renameat2(r1, &(0x7f0000000080)='./file0\x00', r1, &(0x7f0000000100)='./file1\x00', 0x4) r2 = syz_open_dev$sndpcmc(&(0x7f0000001840)='/dev/snd/pcmC#D#c\x00', 0x7, 0xa0003) r3 = syz_genetlink_get_family_id$ipvs(&(0x7f00000018c0)='IPVS\x00') sendmsg$IPVS_CMD_NEW_SERVICE(r2, &(0x7f0000001a80)={&(0x7f0000001880)={0x10, 0x0, 0x0, 0x8840a020}, 0xc, &(0x7f0000001a40)={&(0x7f0000001900)={0x134, r3, 0x210, 0x70bd2a, 0x25dfdbfc, {}, [@IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0x8}, @IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0xc4}, @IPVS_CMD_ATTR_DAEMON={0x30, 0x3, [@IPVS_DAEMON_ATTR_MCAST_GROUP6={0x14, 0x6, @ipv4={[], [], @rand_addr=0xc65d}}, @IPVS_DAEMON_ATTR_MCAST_PORT={0x8, 0x7, 0x4e22}, @IPVS_DAEMON_ATTR_STATE={0x8, 0x1, 0x3}, @IPVS_DAEMON_ATTR_MCAST_TTL={0x8, 0x8, 0x46a}]}, @IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0x9}, @IPVS_CMD_ATTR_SERVICE={0x28, 0x1, [@IPVS_SVC_ATTR_PROTOCOL={0x8, 0x2, 0x2b}, @IPVS_SVC_ATTR_PROTOCOL={0x8, 0x2, 0x3b}, @IPVS_SVC_ATTR_SCHED_NAME={0xc, 0x6, 'lblcr\x00'}, @IPVS_SVC_ATTR_FWMARK={0x8, 0x5, 0x2}]}, @IPVS_CMD_ATTR_DEST={0x4c, 0x2, [@IPVS_DEST_ATTR_FWD_METHOD={0x8, 0x3, 0x7920839b997b7d6}, @IPVS_DEST_ATTR_PERSIST_CONNS={0x8, 0x9, 0xa4}, @IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8, 0x6}, @IPVS_DEST_ATTR_ADDR_FAMILY={0x8, 0xb, 0x2}, @IPVS_DEST_ATTR_U_THRESH={0x8, 0x5, 0x7}, @IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8, 0x8}, @IPVS_DEST_ATTR_WEIGHT={0x8, 0x4, 0x5}, @IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8, 0xe4}, @IPVS_DEST_ATTR_INACT_CONNS={0x8}]}, @IPVS_CMD_ATTR_SERVICE={0x5c, 0x1, [@IPVS_SVC_ATTR_PROTOCOL={0x8, 0x2, 0x7f}, @IPVS_SVC_ATTR_TIMEOUT={0x8, 0x8, 0x9}, @IPVS_SVC_ATTR_FWMARK={0x8}, @IPVS_SVC_ATTR_ADDR={0x14, 0x3, @ipv4=@local}, @IPVS_SVC_ATTR_FWMARK={0x8}, @IPVS_SVC_ATTR_FLAGS={0xc, 0x7, {0x22}}, @IPVS_SVC_ATTR_TIMEOUT={0x8}, @IPVS_SVC_ATTR_SCHED_NAME={0x8, 0x6, 'lc\x00'}, @IPVS_SVC_ATTR_AF={0x8, 0x1, 0xa}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x7}]}, 0x134}, 0x1, 0x0, 0x0, 0x4000000}, 0x40) 04:46:36 executing program 3: r0 = syz_open_dev$sg(&(0x7f00000000c0)='/dev/sg#\x00', 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000000)={0x53, 0x0, 0x6, 0x0, @buffer={0x209, 0xb8, &(0x7f00000001c0)=""/184}, &(0x7f0000000540)="ad40657ed56c", &(0x7f0000000340)=""/128, 0x0, 0x0, 0x6cd57e6540ad, &(0x7f0000000040)}) [ 650.778871] tmpfs: No value for mount option 'ŒFË“«*bñÄÄ}^MÏÁŒ2ÖÜ:™!²ÿ¦."Ô•©­š' 04:46:37 executing program 5: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000480)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_GUEST_DEBUG(r3, 0x4048ae9b, &(0x7f0000000140)={0x1}) syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000100)=[@text32={0x20, &(0x7f0000000000)="6601669b0f35c4e1fe16846ba49e0000b9940200000f32c4c23dad78e0b9670900000f32660f38827f95b0040f01d10fc71a", 0x32}], 0x1, 0x0, &(0x7f0000000040), 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r3, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000400)=[@text32={0x20, &(0x7f0000000880)="b805000000b98b9400000f01c19a01000000b0000f43d1b8000000000f23d80f21f835800000900f23f80f060f2140b9800000c00f3235000800000f3066ba4300b8f1ffffffefb9800000c00f3235002000000f30c4c3295f4da400", 0x5c}], 0x26433e1, 0x0, &(0x7f0000000300), 0x10000000000000b6) ioctl$KVM_RUN(r3, 0xae80, 0x4000) [ 650.822659] tmpfs: No value for mount option 'ŒFË“«*bñÄÄ}^MÏÁŒ2ÖÜ:™!²ÿ¦."Ô•©­š' [ 651.001516] binder: 24451:24498 Acquire 1 refcount change on invalid ref 0 ret -22 04:46:37 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = getpid() perf_event_open(&(0x7f0000000080)={0x4, 0x70, 0x4, 0x8001, 0x1, 0x7, 0x0, 0x4, 0x104, 0x0, 0x7ff, 0x8, 0x80000000, 0x7, 0x20, 0x5, 0x3, 0x5081, 0x1, 0x2, 0x4, 0x3, 0x306, 0x29, 0x10001, 0x280, 0x0, 0x10000, 0x6df, 0x7, 0xffffffff, 0x7, 0x8, 0x1, 0x4602, 0x2, 0x6, 0x6, 0x0, 0x3, 0x2, @perf_bp={&(0x7f0000000040), 0x4}, 0x2100, 0x7, 0x4, 0x4, 0x4, 0x9, 0x9}, r1, 0x5, 0xffffffffffffffff, 0x8) r2 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) close(r0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, &(0x7f0000000f4d)}) r3 = mmap$binder(&(0x7f0000ffe000/0x1000)=nil, 0x1000, 0x2, 0x40010, r0, 0xffffffffffffffbc) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000100)={0xc, 0x0, &(0x7f0000000000)=[@free_buffer={0x40086303, r3}], 0x0, 0x0, &(0x7f0000000680)}) 04:46:37 executing program 3: r0 = syz_open_dev$sg(&(0x7f00000000c0)='/dev/sg#\x00', 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000000)={0x53, 0x0, 0x6, 0x0, @buffer={0x209, 0xb8, &(0x7f00000001c0)=""/184}, &(0x7f0000000540)="ad40657ed56c", &(0x7f0000000340)=""/128, 0x0, 0x0, 0x600000000000000, &(0x7f0000000040)}) 04:46:37 executing program 0: mkdir(&(0x7f0000000200)='./file0\x00', 0x0) mount(&(0x7f00000002c0)=ANY=[], &(0x7f0000001540)='./file0\x00', &(0x7f0000000280)='tmpfs\x00', 0x0, &(0x7f0000000080)) r0 = open$dir(&(0x7f0000000180)='./file0\x00', 0x0, 0x0) mknodat(r0, &(0x7f0000000140)='./file0\x00', 0x0, 0x0) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000000)='/dev/sequencer\x00', 0x800, 0x0) renameat2(r0, &(0x7f0000000080)='./file0\x00', r0, &(0x7f0000000100)='./file1\x00', 0x4) 04:46:37 executing program 4: ioctl$KVM_IRQ_LINE(0xffffffffffffffff, 0x4008ae61, &(0x7f0000000500)) r0 = syz_open_dev$dspn(&(0x7f0000000380)='/dev/dsp#\x00', 0x7, 0x0) openat$audio(0xffffffffffffff9c, &(0x7f0000000000)='/dev/audio\x00', 0x80, 0x0) ioctl$KVM_SET_FPU(0xffffffffffffffff, 0x41a0ae8d, &(0x7f0000000100)={[], 0x0, 0x5531fee, 0x0, 0x0, 0x9, 0xf000, 0x0, [], 0x5}) r1 = syz_open_dev$usb(&(0x7f0000000440)='/dev/bus/usb/00#/00#\x00', 0x9, 0x2) r2 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) lstat(&(0x7f0000000040)='./file0/file0\x00', &(0x7f0000000080)) ioctl$EXT4_IOC_MIGRATE(0xffffffffffffffff, 0x6609) sendmmsg$unix(0xffffffffffffffff, &(0x7f000000a000)=[{&(0x7f000000a000)=@abs, 0x6e, &(0x7f000000d000), 0x0, &(0x7f0000000600)=ANY=[]}], 0x1, 0x0) r3 = socket$inet6(0xa, 0x2, 0x101) gettid() r4 = getpgid(0x0) ioctl$KVM_S390_UCAS_MAP(r1, 0x4018ae50, &(0x7f00000004c0)={0x100, 0xb92c, 0x7fe000000}) kcmp(0x0, r4, 0x0, 0xffffffffffffffff, 0xffffffffffffffff) connect$inet6(r3, &(0x7f0000002740)={0xa, 0x0, 0x0, @mcast2, 0x4}, 0x1c) sendmmsg(r3, &(0x7f0000007e00), 0x136a88c8311572c, 0x0) setsockopt$inet6_udp_int(r3, 0x11, 0x0, &(0x7f0000000400), 0x4) openat$kvm(0xffffffffffffff9c, &(0x7f00000003c0)='/dev/kvm\x00', 0x0, 0x0) ioctl$VHOST_SET_VRING_CALL(0xffffffffffffff9c, 0x4008af21, &(0x7f00000002c0)={0x0, r2}) ioctl$SNDRV_TIMER_IOCTL_TREAD(r0, 0x40045402, &(0x7f0000000740)) inotify_rm_watch(0xffffffffffffffff, 0x0) keyctl$join(0x1, 0x0) getsockopt$IPT_SO_GET_REVISION_TARGET(r0, 0x0, 0x43, &(0x7f0000000300)={'IDLETIMER\x00'}, &(0x7f0000000340)=0x1e) ioctl$ifreq_SIOCGIFINDEX_team(0xffffffffffffffff, 0x8933, &(0x7f0000000480)={'team0\x00'}) 04:46:37 executing program 3: r0 = syz_open_dev$sg(&(0x7f00000000c0)='/dev/sg#\x00', 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000000)={0x53, 0x0, 0x6, 0x0, @buffer={0x209, 0xb8, &(0x7f00000001c0)=""/184}, &(0x7f0000000540)="ad40657ed56c", &(0x7f0000000340)=""/128, 0x0, 0x0, 0x6000000, &(0x7f0000000040)}) 04:46:37 executing program 5: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000480)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_GUEST_DEBUG(r3, 0x4048ae9b, &(0x7f0000000140)={0x1}) syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000100)=[@text32={0x20, &(0x7f0000000000)="6601669b0f35c4e1fe16846ba49e0000b9940200000f32c4c23dad78e0b9670900000f32660f38827f95b0040f01d10fc71a", 0x32}], 0x1, 0x0, &(0x7f0000000040), 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r3, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000400)=[@text32={0x20, &(0x7f0000000880)="b805000000b98b9400000f01c19a01000000b0000f43d1b8000000000f23d80f21f835800000900f23f80f060f2140b9800000c00f3235000800000f3066ba4300b8f1ffffffefb9800000c00f3235002000000f30c4c3295f4da400", 0x5c}], 0x26433e1, 0x0, &(0x7f0000000300), 0x10000000000000b6) ioctl$KVM_RUN(r3, 0xae80, 0xffffffffa0010000) [ 651.158120] tmpfs: No value for mount option './file0' 04:46:37 executing program 0: mkdir(&(0x7f0000000200)='./file0\x00', 0x0) mount(&(0x7f00000002c0)=ANY=[], &(0x7f0000001540)='./file0\x00', &(0x7f0000000280)='tmpfs\x00', 0x0, &(0x7f0000000080)) r0 = open$dir(&(0x7f0000000180)='./file0\x00', 0x41, 0x0) mknodat(r0, &(0x7f0000000140)='./file0\x00', 0x0, 0x0) readlinkat(r0, &(0x7f0000000000)='./file1\x00', &(0x7f00000002c0)=""/238, 0xee) renameat2(r0, &(0x7f0000000080)='./file0\x00', r0, &(0x7f0000000100)='./file1\x00', 0x4) 04:46:37 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0x0, 0x2) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, &(0x7f0000012fc7)}) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, &(0x7f0000000f4d)}) r2 = accept4$alg(0xffffffffffffff9c, 0x0, 0x0, 0x80000) sendmsg$alg(r2, &(0x7f00000006c0)={0x0, 0x0, &(0x7f0000000640)=[{&(0x7f0000000140)="afa95b50736546e0a6a756530bdd0003a20ae4c87760945d373458dc3bd9c61dba26db386c2dac8a8cb081f6c890bf550d41b4c0fed3da648168e8585ab1f3613f5cb266e51ffa8a2d809cb8224e8931988d09772fbb6fab64504bd6f6e0c7999c516fa8ee710c367158ab343fe28762d7c1bc1c0ecef5efdda9465a5fd305f6c470e3a4f57fc0b6eeea561a64c144", 0x8f}, {&(0x7f0000000200)="eb0620be6ddff7c80a3a355fe611f4787aded58713b5f46c39e21fed0c51b2437a97d946f31327d44678445fa9d53c11040080f0c575eaee0ada467bac3a59cdae4ab39baae200d1acaea0b35bad7f2166fa5656aa772a6359bd65a35176c97311c63eae9346737f17e36814b2ba951625c59cbc5e70fec641fea90dad9964519923cf9096e77f388c1f5411c71c587a942c7ab4dcfcddf091b8720a17", 0x9d}, {&(0x7f00000002c0)="2188bf6393245f7008eebb740cb42299cf26c0dcf138cbb9916f77d7b16ccb5600e03f84eb8460c91b6c393aa006fafda2d2cc496081072bb4fec22b53b3d4e4122600e2d40119da5860a091a13a74b499087d91637cd41a17478b037e4e5fbb4eb71cd5845c599c6d2dcdb64dc9febdaab0055f5197a44c06746832b09852fcf2d7b61c5a35229a8aef4cd2fd76a96e83dffbf6b3a8f80c9475994ca92764ecaaac1b347741c0a18487b8de9e7838040154a37ab3f077cb6d0a610ac33685d45d9ecfec7707d14a76997fec2005dc5003cc1f7e4edb6968507310492a013003f03e72c2", 0xe4}, {&(0x7f0000000000)="cd77ac57cb1a97add270dcd92ea022f6ac5dd28ecaea2e8287bdba82c5868000874467027bb804344ca54ed0057c23f8c821fadb8028ac8ae5e88205b7afce868b99aa30ae6660", 0x47}, {&(0x7f00000003c0)="74468565912cb61c264a393e4310dfc61a3260a697b66008f0d889490ed9af1c7f53ad6c61b19ad021f05fe7af7b287498dc58f5e4e4bc7371f97e65bdab112133d6175fb2dcf6548f7c56e7e6560834da6b750ab6e7ef22fd542fcc4de9c1a5e148c352cb8ecdcec9d2d335d538668b91aef1e590523f67f3499e426d974791a02cdbea652c16bbe848fc16b215230a2213105aabb98106a26a471cb7aeffb23325e3a26b73", 0xa6}, {&(0x7f0000000480)="868c3dd24956e8dd13129276b0b0e095d2b91f66133504702e3737a95751a7be27040574655b1d24788310a1f4a35afe86e9776a4fe98213112c3db0e45945aa0b53f181784613e4fd644cefa210ab8a0f8d3bbdc2afab843f6427ad94c88a43b7dd48cbb1af4a7505dd6de4cab8d67138125596bda50b40ce0e5d848847187bfaef0a43f2fa37dce2e7d1cbd2ba898c95fd1409484a", 0x96}, {&(0x7f0000000540)="ce90c19e752cea48aaeb3013acf161b7c29bbf7bf8638eca1d5de1e3f9da0124cbf712e29ceee528a8e3a131fce7a6c31dc46ca6e72e6f5b740da989d26f0922126dbaab6986f3f7c7eda128e6fead76b13844029944889e96c6146fc0d4108265a8fef7c0f56fd51be06eb4a1d6684f8019c406", 0x74}, {&(0x7f00000005c0)="698402e741cc36e4d3c6bb8a82452679e17be08353bee21fa5a678f74adbd85f9cc67c3e7867b0c09e2b74876c61aebc09491ffd3ead87510089340efb5af2c5972c59ced27b1232624c3fb658f283bbd4398f6cc0b2ee1d47fecd6e7b0b74e10fd274f59d228b24a3a5ff6490278b643b2340d81e7a608e", 0x78}], 0x8, &(0x7f00000000c0)=[@assoc={0x18, 0x117, 0x4, 0x7ff}], 0x18, 0x4000000}, 0x10) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000100)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0xfffffffffffffc2b, 0x0, &(0x7f0000000680)}) [ 651.219862] binder: 24511:24513 BC_FREE_BUFFER u0000000000000000 no match [ 651.254706] binder: 24511:24522 BC_FREE_BUFFER u0000000000000000 no match 04:46:37 executing program 4: ioctl$KVM_IRQ_LINE(0xffffffffffffffff, 0x4008ae61, &(0x7f0000000500)) r0 = syz_open_dev$dspn(&(0x7f00000004c0)='/dev/dsp#\x00', 0x1, 0x0) r1 = openat$audio(0xffffffffffffff9c, &(0x7f0000000000)='/dev/audio\x00', 0x80, 0x0) ioctl$KVM_SET_FPU(0xffffffffffffffff, 0x41a0ae8d, &(0x7f0000000100)={[], 0x0, 0x5531fee, 0x0, 0x0, 0x9, 0xf000, 0x0, [], 0x5}) r2 = syz_open_dev$usb(&(0x7f0000000440)='/dev/bus/usb/00#/00#\x00', 0x9, 0x2) r3 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) lstat(&(0x7f0000000040)='./file0/file0\x00', &(0x7f0000000080)) ioctl$EXT4_IOC_MIGRATE(0xffffffffffffffff, 0x6609) sendmmsg$unix(0xffffffffffffffff, &(0x7f000000a000)=[{&(0x7f000000a000)=@abs, 0x6e, &(0x7f000000d000), 0x0, &(0x7f0000000600)=ANY=[]}], 0x1, 0x0) r4 = socket$inet6(0xa, 0x2, 0x0) gettid() r5 = getpgid(0x0) ioctl$TIOCSETD(r2, 0x5423, &(0x7f0000000380)=0x7fff) kcmp(0x0, r5, 0x0, 0xffffffffffffffff, 0xffffffffffffffff) ioctl$KVM_ENABLE_CAP_CPU(r1, 0x4068aea3, &(0x7f0000000300)={0x7b, 0x0, [0xfffffffffffffff8, 0x81, 0x7fffffff, 0x4]}) connect$inet6(r4, &(0x7f0000002740)={0xa, 0x0, 0x0, @mcast2, 0x4}, 0x1c) sendmmsg(r4, &(0x7f0000007e00), 0x136a88c8311572c, 0x0) setsockopt$inet6_udp_int(r4, 0x11, 0x0, &(0x7f0000000400), 0x4) openat$kvm(0xffffffffffffff9c, &(0x7f00000003c0)='/dev/kvm\x00', 0x0, 0x0) ioctl$VHOST_SET_VRING_CALL(0xffffffffffffff9c, 0x4008af21, &(0x7f00000002c0)={0x0, r3}) ioctl$SNDRV_TIMER_IOCTL_TREAD(r0, 0x40045402, &(0x7f0000000740)) timerfd_create(0x1, 0x80000) inotify_rm_watch(0xffffffffffffffff, 0x0) ioctl$ifreq_SIOCGIFINDEX_team(0xffffffffffffffff, 0x8933, &(0x7f0000000480)={'team0\x00'}) 04:46:37 executing program 3: r0 = syz_open_dev$sg(&(0x7f00000000c0)='/dev/sg#\x00', 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000000)={0x53, 0x0, 0x6, 0x0, @buffer={0x209, 0xb8, &(0x7f00000001c0)=""/184}, &(0x7f0000000540)="ad40657ed56c", &(0x7f0000000340)=""/128, 0x0, 0x0, 0x400000000000000, &(0x7f0000000040)}) 04:46:37 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x800) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, &(0x7f0000012fc7)}) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, &(0x7f0000000f4d)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000100)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0xfffffffffffffc2b, 0x0, &(0x7f0000000680)}) [ 651.410538] binder: 24529:24530 Acquire 1 refcount change on invalid ref 0 ret -22 04:46:37 executing program 3: r0 = syz_open_dev$sg(&(0x7f00000000c0)='/dev/sg#\x00', 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000000)={0x53, 0x0, 0x6, 0x0, @buffer={0x209, 0xb8, &(0x7f00000001c0)=""/184}, &(0x7f0000000540)="ad40657ed56c", &(0x7f0000000340)=""/128, 0x0, 0x0, 0x8000a0ffffffff, &(0x7f0000000040)}) [ 651.474611] tmpfs: No value for mount option './file0' 04:46:37 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl(r0, 0x9, &(0x7f0000000000)="e34c6cd42134df1af1da95c8a309232b5d8e9844a5acd1966195df0d") r1 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) openat$null(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/null\x00', 0x0, 0x0) getsockopt$inet_sctp_SCTP_DELAYED_SACK(0xffffffffffffffff, 0x84, 0x10, &(0x7f0000000140)=@assoc_value={0x0, 0x1}, &(0x7f0000000180)=0x8) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, &(0x7f0000012fc7)}) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, &(0x7f0000000f4d)}) openat$md(0xffffffffffffff9c, &(0x7f0000000200)='/dev/md0\x00', 0x20000, 0x0) openat$autofs(0xffffffffffffff9c, &(0x7f0000000040)='/dev/autofs\x00', 0x101400, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000100)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0xfffffffffffffc2b, 0x0, &(0x7f0000000680)}) 04:46:37 executing program 0: mkdir(&(0x7f0000000200)='./file0\x00', 0x0) msgget$private(0x0, 0x100) mount(&(0x7f00000002c0)=ANY=[], &(0x7f0000001540)='./file0\x00', &(0x7f0000000280)='tmpfs\x00', 0x0, &(0x7f0000000080)) r0 = open$dir(&(0x7f0000000180)='./file1\x00', 0x0, 0x0) setitimer(0x0, &(0x7f0000000000)={{0x0, 0x2710}, {0x0, 0x2710}}, &(0x7f00000000c0)) mknodat(r0, &(0x7f0000000140)='./file0\x00', 0x0, 0x0) renameat2(r0, &(0x7f0000000080)='./file0\x00', r0, &(0x7f0000000100)='./file1\x00', 0x4) r1 = openat$vsock(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vsock\x00', 0x200, 0x0) getsockopt$inet_sctp6_SCTP_SOCKOPT_PEELOFF(r0, 0x84, 0x66, &(0x7f00000001c0)={0x0, 0x714b5c8e}, &(0x7f0000000240)=0x8) setsockopt$inet_sctp6_SCTP_ENABLE_STREAM_RESET(r1, 0x84, 0x76, &(0x7f00000002c0)={r2, 0x9973}, 0x8) 04:46:37 executing program 5: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000480)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_GUEST_DEBUG(r3, 0x4048ae9b, &(0x7f0000000140)={0x1}) syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000100)=[@text32={0x20, &(0x7f0000000000)="6601669b0f35c4e1fe16846ba49e0000b9940200000f32c4c23dad78e0b9670900000f32660f38827f95b0040f01d10fc71a", 0x32}], 0x1, 0x0, &(0x7f0000000040), 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r3, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000400)=[@text32={0x20, &(0x7f0000000880)="b805000000b98b9400000f01c19a01000000b0000f43d1b8000000000f23d80f21f835800000900f23f80f060f2140b9800000c00f3235000800000f3066ba4300b8f1ffffffefb9800000c00f3235002000000f30c4c3295f4da400", 0x5c}], 0x26433e1, 0x0, &(0x7f0000000300), 0x10000000000000b6) ioctl$KVM_RUN(r3, 0xae80, 0xf00000000000000) 04:46:37 executing program 3: r0 = syz_open_dev$sg(&(0x7f00000000c0)='/dev/sg#\x00', 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000000)={0x53, 0x0, 0x6, 0x0, @buffer={0x209, 0xb8, &(0x7f00000001c0)=""/184}, &(0x7f0000000540)="ad40657ed56c", &(0x7f0000000340)=""/128, 0x0, 0x0, 0xf6ffffff00000000, &(0x7f0000000040)}) [ 651.634569] binder: 24550:24551 ioctl 9 20000000 returned -22 [ 651.723975] binder: 24550:24554 ioctl 9 20000000 returned -22 04:46:38 executing program 4: ioctl$KVM_IRQ_LINE(0xffffffffffffffff, 0x4008ae61, &(0x7f0000000500)) r0 = syz_open_dev$dspn(&(0x7f00000004c0)='/dev/dsp#\x00', 0x1, 0x0) r1 = openat$audio(0xffffffffffffff9c, &(0x7f0000000000)='/dev/audio\x00', 0x80, 0x0) ioctl$KVM_SET_FPU(0xffffffffffffffff, 0x41a0ae8d, &(0x7f0000000100)={[], 0x0, 0x5531fee, 0x0, 0x0, 0x9, 0xf000, 0x0, [], 0x5}) syz_open_dev$usb(&(0x7f0000000440)='/dev/bus/usb/00#/00#\x00', 0x9, 0x10000) r2 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) lstat(&(0x7f0000000040)='./file0/file0\x00', &(0x7f0000000080)) ioctl$EXT4_IOC_MIGRATE(0xffffffffffffffff, 0x6609) sendmmsg$unix(0xffffffffffffffff, &(0x7f000000a000)=[{&(0x7f000000a000)=@abs, 0x6e, &(0x7f000000d000), 0x0, &(0x7f0000000600)=ANY=[]}], 0x1, 0x0) r3 = socket$inet6(0xa, 0x2, 0x0) r4 = gettid() r5 = getpgid(0x0) kcmp(0x0, r5, 0x0, 0xffffffffffffffff, 0xffffffffffffffff) connect$inet6(r3, &(0x7f0000002740)={0xa, 0x0, 0x0, @mcast2, 0x4}, 0x1c) sendmmsg(r3, &(0x7f0000007e00), 0x136a88c8311572c, 0x0) setsockopt$inet6_udp_int(r3, 0x11, 0x0, &(0x7f0000000400), 0x4) openat$kvm(0xffffffffffffff9c, &(0x7f00000003c0)='/dev/kvm\x00', 0x0, 0x0) getpeername$inet6(r0, &(0x7f0000000300)={0xa, 0x0, 0x0, @mcast1}, &(0x7f0000000340)=0x1c) perf_event_open(&(0x7f0000000540)={0x3, 0x70, 0x4, 0x0, 0x9, 0xaed, 0x0, 0x7fff, 0x400, 0x1, 0x8, 0x7fff, 0x3ff, 0x1, 0xffffffffffff5dbe, 0xfce4, 0x800, 0x7fff, 0xfffffffffffffff9, 0x1, 0x62a7, 0x5, 0x7, 0x8, 0x4321, 0x9, 0xc0, 0x10000, 0x20745944, 0xffffffffffffffff, 0x9, 0x1, 0x2, 0x9, 0x8000, 0x1, 0x401, 0x8001, 0x0, 0x989c, 0x0, @perf_config_ext={0x3, 0x9b}, 0x20300, 0x4, 0x400, 0x3, 0x2, 0x8, 0x6}, r4, 0xf, r1, 0x2) ioctl$VHOST_SET_VRING_CALL(0xffffffffffffff9c, 0x4008af21, &(0x7f00000002c0)={0x0, r2}) ioctl$SNDRV_TIMER_IOCTL_TREAD(r0, 0x40045402, &(0x7f0000000740)) inotify_rm_watch(0xffffffffffffffff, 0x0) ioctl$ifreq_SIOCGIFINDEX_team(0xffffffffffffffff, 0x8933, &(0x7f0000000480)={'team0\x00'}) 04:46:38 executing program 0: r0 = socket(0x1e, 0x4, 0x0) setsockopt$packet_tx_ring(r0, 0x10f, 0x87, &(0x7f0000265000)=@req={0x3fc}, 0x10) r1 = socket(0x1e, 0x4, 0x0) setsockopt$packet_tx_ring(r1, 0x10f, 0x87, &(0x7f0000265000)=@req={0x3fc}, 0x10) sendmsg$netlink(r1, &(0x7f00003aefc8)={0x0, 0xffffffffffffff73, &(0x7f0000847000), 0x1f2, &(0x7f000048a000)}, 0x0) close(r1) close(r1) r2 = syz_open_dev$vcsn(&(0x7f00000000c0)='/dev/vcs#\x00', 0xde4, 0x107000) ioctl$DRM_IOCTL_GEM_FLINK(r0, 0xc008640a, &(0x7f00000001c0)={0x0, 0x0}) ioctl$DRM_IOCTL_GEM_OPEN(r2, 0xc010640b, &(0x7f0000000240)={r3, 0x0, 0x7}) mkdir(&(0x7f0000000200)='./file0\x00', 0x0) mount(&(0x7f00000002c0)=ANY=[], &(0x7f0000001540)='./file0\x00', &(0x7f0000000280)='tmpfs\x00', 0x0, &(0x7f0000000080)) r4 = open$dir(&(0x7f0000000180)='./file0\x00', 0x0, 0x0) ioctl$TCGETS(r2, 0x5401, &(0x7f00000002c0)) mkdirat(r4, &(0x7f0000000000)='./file0\x00', 0x8) ioctl$KDGKBTYPE(r4, 0x4b33, &(0x7f0000000040)) mknodat(r4, &(0x7f0000000140)='./file0\x00', 0x0, 0x0) renameat2(r4, &(0x7f0000000080)='./file0\x00', r4, &(0x7f0000000100)='./file1\x00', 0x4) 04:46:38 executing program 3: r0 = syz_open_dev$sg(&(0x7f00000000c0)='/dev/sg#\x00', 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000000)={0x53, 0x0, 0x6, 0x0, @buffer={0x209, 0xb8, &(0x7f00000001c0)=""/184}, &(0x7f0000000540)="ad40657ed56c", &(0x7f0000000340)=""/128, 0x0, 0x0, 0x2f000000, &(0x7f0000000040)}) [ 652.030931] tmpfs: No value for mount option './file0' 04:46:38 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0x0, 0x2) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, &(0x7f0000012fc7)}) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, &(0x7f0000000f4d)}) r2 = accept4$alg(0xffffffffffffff9c, 0x0, 0x0, 0x80000) sendmsg$alg(r2, &(0x7f00000006c0)={0x0, 0x0, &(0x7f0000000640)=[{&(0x7f0000000140)="afa95b50736546e0a6a756530bdd0003a20ae4c87760945d373458dc3bd9c61dba26db386c2dac8a8cb081f6c890bf550d41b4c0fed3da648168e8585ab1f3613f5cb266e51ffa8a2d809cb8224e8931988d09772fbb6fab64504bd6f6e0c7999c516fa8ee710c367158ab343fe28762d7c1bc1c0ecef5efdda9465a5fd305f6c470e3a4f57fc0b6eeea561a64c144", 0x8f}, {&(0x7f0000000200)="eb0620be6ddff7c80a3a355fe611f4787aded58713b5f46c39e21fed0c51b2437a97d946f31327d44678445fa9d53c11040080f0c575eaee0ada467bac3a59cdae4ab39baae200d1acaea0b35bad7f2166fa5656aa772a6359bd65a35176c97311c63eae9346737f17e36814b2ba951625c59cbc5e70fec641fea90dad9964519923cf9096e77f388c1f5411c71c587a942c7ab4dcfcddf091b8720a17", 0x9d}, {&(0x7f00000002c0)="2188bf6393245f7008eebb740cb42299cf26c0dcf138cbb9916f77d7b16ccb5600e03f84eb8460c91b6c393aa006fafda2d2cc496081072bb4fec22b53b3d4e4122600e2d40119da5860a091a13a74b499087d91637cd41a17478b037e4e5fbb4eb71cd5845c599c6d2dcdb64dc9febdaab0055f5197a44c06746832b09852fcf2d7b61c5a35229a8aef4cd2fd76a96e83dffbf6b3a8f80c9475994ca92764ecaaac1b347741c0a18487b8de9e7838040154a37ab3f077cb6d0a610ac33685d45d9ecfec7707d14a76997fec2005dc5003cc1f7e4edb6968507310492a013003f03e72c2", 0xe4}, {&(0x7f0000000000)="cd77ac57cb1a97add270dcd92ea022f6ac5dd28ecaea2e8287bdba82c5868000874467027bb804344ca54ed0057c23f8c821fadb8028ac8ae5e88205b7afce868b99aa30ae6660", 0x47}, {&(0x7f00000003c0)="74468565912cb61c264a393e4310dfc61a3260a697b66008f0d889490ed9af1c7f53ad6c61b19ad021f05fe7af7b287498dc58f5e4e4bc7371f97e65bdab112133d6175fb2dcf6548f7c56e7e6560834da6b750ab6e7ef22fd542fcc4de9c1a5e148c352cb8ecdcec9d2d335d538668b91aef1e590523f67f3499e426d974791a02cdbea652c16bbe848fc16b215230a2213105aabb98106a26a471cb7aeffb23325e3a26b73", 0xa6}, {&(0x7f0000000480)="868c3dd24956e8dd13129276b0b0e095d2b91f66133504702e3737a95751a7be27040574655b1d24788310a1f4a35afe86e9776a4fe98213112c3db0e45945aa0b53f181784613e4fd644cefa210ab8a0f8d3bbdc2afab843f6427ad94c88a43b7dd48cbb1af4a7505dd6de4cab8d67138125596bda50b40ce0e5d848847187bfaef0a43f2fa37dce2e7d1cbd2ba898c95fd1409484a", 0x96}, {&(0x7f0000000540)="ce90c19e752cea48aaeb3013acf161b7c29bbf7bf8638eca1d5de1e3f9da0124cbf712e29ceee528a8e3a131fce7a6c31dc46ca6e72e6f5b740da989d26f0922126dbaab6986f3f7c7eda128e6fead76b13844029944889e96c6146fc0d4108265a8fef7c0f56fd51be06eb4a1d6684f8019c406", 0x74}, {&(0x7f00000005c0)="698402e741cc36e4d3c6bb8a82452679e17be08353bee21fa5a678f74adbd85f9cc67c3e7867b0c09e2b74876c61aebc09491ffd3ead87510089340efb5af2c5972c59ced27b1232624c3fb658f283bbd4398f6cc0b2ee1d47fecd6e7b0b74e10fd274f59d228b24a3a5ff6490278b643b2340d81e7a608e", 0x78}], 0x8, &(0x7f00000000c0)=[@assoc={0x18, 0x117, 0x4, 0x7ff}], 0x18, 0x4000000}, 0x10) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000100)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0xfffffffffffffc2b, 0x0, &(0x7f0000000680)}) 04:46:38 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, &(0x7f0000012fc7)}) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, &(0x7f0000000f4d)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000100)={0x4, 0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="0000000098d6de93ace4a79f5dfb52fc82b33b1e3db7fd0b87834d3c53b98aaaaed718df3cc6d3cb14b992450cb2457b00f6bd98735aef37aa1c5bb9a4"], 0xfffffffffffffc2b, 0x0, &(0x7f0000000680)}) r2 = syz_open_dev$sndpcmc(&(0x7f0000000000)='/dev/snd/pcmC#D#c\x00', 0x5, 0x0) ioctl$KDSKBMODE(r2, 0x4b45, &(0x7f0000000040)=0x2) 04:46:38 executing program 5: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000480)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_GUEST_DEBUG(r3, 0x4048ae9b, &(0x7f0000000140)={0x1}) syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000100)=[@text32={0x20, &(0x7f0000000000)="6601669b0f35c4e1fe16846ba49e0000b9940200000f32c4c23dad78e0b9670900000f32660f38827f95b0040f01d10fc71a", 0x32}], 0x1, 0x0, &(0x7f0000000040), 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r3, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000400)=[@text32={0x20, &(0x7f0000000880)="b805000000b98b9400000f01c19a01000000b0000f43d1b8000000000f23d80f21f835800000900f23f80f060f2140b9800000c00f3235000800000f3066ba4300b8f1ffffffefb9800000c00f3235002000000f30c4c3295f4da400", 0x5c}], 0x26433e1, 0x0, &(0x7f0000000300), 0x10000000000000b6) ioctl$KVM_RUN(r3, 0xae80, 0x4000000) 04:46:38 executing program 3: r0 = syz_open_dev$sg(&(0x7f00000000c0)='/dev/sg#\x00', 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000000)={0x53, 0x0, 0x6, 0x0, @buffer={0x209, 0xb8, &(0x7f00000001c0)=""/184}, &(0x7f0000000540)="ad40657ed56c", &(0x7f0000000340)=""/128, 0x0, 0x0, 0x4000000, &(0x7f0000000040)}) 04:46:38 executing program 0: mkdir(&(0x7f0000000200)='./file0\x00', 0x0) mount(&(0x7f00000002c0)=ANY=[], &(0x7f0000001540)='./file0\x00', &(0x7f0000000280)='tmpfs\x00', 0x0, &(0x7f0000000080)) r0 = open$dir(&(0x7f0000000180)='./file0\x00', 0x0, 0xb) mknodat(r0, &(0x7f0000000140)='./file0\x00', 0x0, 0x0) getsockopt$inet_IP_IPSEC_POLICY(0xffffffffffffff9c, 0x0, 0x10, &(0x7f00000002c0)={{{@in=@multicast2, @in=@local, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@dev}, 0x0, @in6=@mcast1}}, &(0x7f00000000c0)=0xe8) r2 = getgid() fchownat(r0, &(0x7f0000000040)='./file2\x00', r1, r2, 0x400) renameat2(r0, &(0x7f0000000080)='./file0\x00', r0, &(0x7f0000000100)='./file1\x00', 0x4) openat$md(0xffffffffffffff9c, &(0x7f0000000000)='/dev/md0\x00', 0x40, 0x0) [ 652.222618] binder: 24581:24586 Acquire 1 refcount change on invalid ref 0 ret -22 [ 652.254538] binder_thread_write: 5 callbacks suppressed [ 652.254551] binder: 24581:24586 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 04:46:38 executing program 3: r0 = syz_open_dev$sg(&(0x7f00000000c0)='/dev/sg#\x00', 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000000)={0x53, 0x0, 0x6, 0x0, @buffer={0x209, 0xb8, &(0x7f00000001c0)=""/184}, &(0x7f0000000540)="ad40657ed56c", &(0x7f0000000340)=""/128, 0x0, 0x0, 0x8000a0, &(0x7f0000000040)}) [ 652.278843] binder: 24588:24591 Acquire 1 refcount change on invalid ref 0 ret -22 [ 652.285838] binder: 24581:24586 unknown command 0 [ 652.288338] tmpfs: No value for mount option './file0' [ 652.297040] binder: 24581:24586 ioctl c0306201 20000100 returned -22 04:46:38 executing program 0: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount(&(0x7f00000002c0)=ANY=[], &(0x7f0000001540)='./file0\x00', &(0x7f0000000280)='tmpfs\x00', 0x0, &(0x7f0000000080)) r0 = open$dir(&(0x7f0000000180)='./file0\x00', 0x0, 0x0) r1 = gettid() syz_open_procfs$namespace(r1, &(0x7f0000000040)='ns/pid_for_children\x00') mknodat(r0, &(0x7f0000000140)='./file0\x00', 0x0, 0x0) renameat2(r0, &(0x7f0000000080)='./file0\x00', r0, &(0x7f0000000100)='./file1\x00', 0x4) [ 652.335633] binder: 24581:24595 Acquire 1 refcount change on invalid ref 0 ret -22 [ 652.364667] binder: 24588:24591 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 652.372480] binder: 24581:24595 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 652.393206] binder: 24581:24586 unknown command 0 04:46:38 executing program 4: ioctl$KVM_IRQ_LINE(0xffffffffffffffff, 0x4008ae61, &(0x7f0000000500)) r0 = syz_open_dev$dspn(&(0x7f00000004c0)='/dev/dsp#\x00', 0x1, 0x0) r1 = openat$audio(0xffffffffffffff9c, &(0x7f0000000000)='/dev/audio\x00', 0x80, 0x0) ioctl$KVM_SET_FPU(0xffffffffffffffff, 0x41a0ae8d, &(0x7f0000000100)={[], 0x0, 0x5531fee, 0x0, 0x0, 0x9, 0xf000, 0x0, [], 0x5}) syz_open_dev$usb(&(0x7f0000000440)='/dev/bus/usb/00#/00#\x00', 0x9, 0x2) r2 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) lstat(&(0x7f0000000040)='./file0/file0\x00', &(0x7f0000000080)) ioctl$EXT4_IOC_MIGRATE(0xffffffffffffffff, 0x6609) sendmmsg$unix(0xffffffffffffffff, &(0x7f000000a000)=[{&(0x7f000000a000)=@abs, 0x6e, &(0x7f000000d000), 0x0, &(0x7f0000000600)=ANY=[]}], 0x1, 0x0) r3 = socket$inet6(0xa, 0x2, 0x0) gettid() r4 = getpgid(0x0) kcmp(0x0, r4, 0x0, 0xffffffffffffffff, 0xffffffffffffffff) connect$inet6(r3, &(0x7f0000002740)={0xa, 0x0, 0x0, @mcast2, 0x4}, 0x1c) sendmmsg(r3, &(0x7f0000007e00), 0x136a88c8311572c, 0x0) ioctl$sock_SIOCDELDLCI(r1, 0x8981, &(0x7f0000000340)={'\x00', 0x80}) setsockopt$inet6_udp_int(r3, 0x11, 0x0, &(0x7f0000000400), 0x4) openat$kvm(0xffffffffffffff9c, &(0x7f00000003c0)='/dev/kvm\x00', 0x0, 0x0) ioctl$VHOST_SET_VRING_CALL(0xffffffffffffff9c, 0x4008af21, &(0x7f00000002c0)={0x0, r2}) ioctl$SNDRV_TIMER_IOCTL_TREAD(r0, 0x40045402, &(0x7f0000000300)) inotify_rm_watch(0xffffffffffffffff, 0x0) ioctl$ifreq_SIOCGIFINDEX_team(0xffffffffffffffff, 0x8933, &(0x7f0000000480)={'team0\x00'}) [ 652.422774] binder: 24581:24586 ioctl c0306201 20000100 returned -22 04:46:38 executing program 5: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000480)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_GUEST_DEBUG(r3, 0x4048ae9b, &(0x7f0000000140)={0x1}) syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000100)=[@text32={0x20, &(0x7f0000000000)="6601669b0f35c4e1fe16846ba49e0000b9940200000f32c4c23dad78e0b9670900000f32660f38827f95b0040f01d10fc71a", 0x32}], 0x1, 0x0, &(0x7f0000000040), 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r3, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000400)=[@text32={0x20, &(0x7f0000000880)="b805000000b98b9400000f01c19a01000000b0000f43d1b8000000000f23d80f21f835800000900f23f80f060f2140b9800000c00f3235000800000f3066ba4300b8f1ffffffefb9800000c00f3235002000000f30c4c3295f4da400", 0x5c}], 0x26433e1, 0x0, &(0x7f0000000300), 0x10000000000000b6) ioctl$KVM_RUN(r3, 0xae80, 0xec0f0000000000) 04:46:38 executing program 3: r0 = syz_open_dev$sg(&(0x7f00000000c0)='/dev/sg#\x00', 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000000)={0x53, 0x0, 0x6, 0x0, @buffer={0x209, 0xb8, &(0x7f00000001c0)=""/184}, &(0x7f0000000540)="ad40657ed56c", &(0x7f0000000340)=""/128, 0x0, 0x0, 0x902, &(0x7f0000000040)}) [ 652.489689] tmpfs: No value for mount option './file0' 04:46:38 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$KVM_DIRTY_TLB(r2, 0x4010aeaa, &(0x7f0000000040)={0x3bd080, 0x40000000ffffffff}) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) getsockopt$inet_sctp6_SCTP_GET_PEER_ADDRS(r2, 0x84, 0x6c, &(0x7f0000000140)={0x0, 0xd6, "88297301e2c249ead5d7eec8d5d637450a340390e812ab80174e247798eb3d7dca1a21bca227db37626dab1c539bd3d8939185c7bc8f86d9e3091dd9f2a6aedcf06e5103f2afc929500b6f8ac4c55f77269c796ea9d5cd0250b6df058240ec7ec44046defa77fed7c09cdbaa1fb37a24cb15a46a0b11510f8d50bab6b822233bb8d36ae65d65d34a4d555606a2814eb50bc8ff0bc058f4324fe344c8e43614c547ab7e03a25291f9b01f5fa36402517a9b7d90c17aed6d59b1385bda339b51468dcf48330b02a649fa9b3920e14c7c83f8f7582f5578"}, &(0x7f0000000080)=0xde) getsockopt$inet_sctp6_SCTP_PEER_ADDR_THLDS(r1, 0x84, 0x1f, &(0x7f00000003c0)={r3, @in6={{0xa, 0x4e24, 0xfffffffffffffffb, @mcast2, 0x5}}, 0x8, 0x200}, &(0x7f00000000c0)=0x90) r4 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, &(0x7f0000012fc7)}) close(r0) ioctl$TCSBRK(r2, 0x5409, 0x1) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=ANY=[@ANYBLOB="0e630c4008000000"], 0x0, 0x0, &(0x7f0000000f4d)}) r5 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000480)='IPVS\x00') sendmsg$IPVS_CMD_NEW_SERVICE(r2, &(0x7f0000000540)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x8000}, 0xc, &(0x7f0000000500)={&(0x7f00000004c0)={0x38, r5, 0x800, 0x70bd2d, 0x25dfdbfd, {}, [@IPVS_CMD_ATTR_DEST={0x24, 0x2, [@IPVS_DEST_ATTR_PORT={0x8, 0x2, 0x4e23}, @IPVS_DEST_ATTR_FWD_METHOD={0x8, 0x3, 0x6}, @IPVS_DEST_ATTR_L_THRESH={0x8, 0x6, 0x9}, @IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8, 0x3}]}]}, 0x38}, 0x1, 0x0, 0x0, 0x40005}, 0x10) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000100)={0x4, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="0c6300009044105bc6823b9da2762003b60827cde8ffa3d3365ee55265dc93eeea290c782c4badfb3eaa280a2a03088a6f2b13e8baa26e57a83f94e842535276bb939a69cbde136563e219e378093899ee95ea2151d14f8ebb9e795c799e57aa23480f6468126de93540e48bee75199945095852776c6aff09e3c30ff1f285d379f6f9d06ddeecf8588f0b0ece4075e6440d492f6ffccb8dbbce42d7c092de57ce7284f9c5bade1adaf6b442cbc44ede07ee6d0000ceac555c3cadbd1ef670163fe9bd48fe3a0cdac7d0c2a7e758d632d2d653af2f35d5e6e7ff49c038856df30e87818bf1e8ef08a95982840bca9a5cbef4da5b209f4e4358e80c50f71e13a17677720c96a56d35fbf7b1d0b73b1757242a00000000"], 0xfffffffffffffc2b, 0x0, &(0x7f0000000680)}) 04:46:38 executing program 3: r0 = syz_open_dev$sg(&(0x7f00000000c0)='/dev/sg#\x00', 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000000)={0x53, 0x0, 0x6, 0x0, @buffer={0x209, 0xb8, &(0x7f00000001c0)=""/184}, &(0x7f0000000540)="ad40657ed56c", &(0x7f0000000340)=""/128, 0x0, 0x0, 0x209, &(0x7f0000000040)}) [ 652.628727] binder: 24616:24618 BC_REQUEST_DEATH_NOTIFICATION invalid ref 8 04:46:39 executing program 0: mkdir(&(0x7f0000000200)='./file0\x00', 0x0) mount(&(0x7f00000002c0)=ANY=[], &(0x7f0000001540)='./file0\x00', &(0x7f0000000280)='tmpfs\x00', 0x0, &(0x7f0000000080)) r0 = open$dir(&(0x7f0000000180)='./file0\x00', 0x0, 0x0) r1 = semget$private(0x0, 0x4, 0x100) semctl$GETZCNT(r1, 0x4, 0xf, &(0x7f00000002c0)=""/173) mknodat(r0, &(0x7f0000000140)='./file0\x00', 0x0, 0x0) renameat2(r0, &(0x7f0000000080)='./file0\x00', r0, &(0x7f0000000100)='./file1\x00', 0x4) 04:46:39 executing program 3: r0 = syz_open_dev$sg(&(0x7f00000000c0)='/dev/sg#\x00', 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000000)={0x53, 0x0, 0x6, 0x0, @buffer={0x209, 0xb8, &(0x7f00000001c0)=""/184}, &(0x7f0000000540)="ad40657ed56c", &(0x7f0000000340)=""/128, 0x0, 0x0, 0x7ffff000, &(0x7f0000000040)}) 04:46:39 executing program 5: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000480)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_GUEST_DEBUG(r3, 0x4048ae9b, &(0x7f0000000140)={0x1}) syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000100)=[@text32={0x20, &(0x7f0000000000)="6601669b0f35c4e1fe16846ba49e0000b9940200000f32c4c23dad78e0b9670900000f32660f38827f95b0040f01d10fc71a", 0x32}], 0x1, 0x0, &(0x7f0000000040), 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r3, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000400)=[@text32={0x20, &(0x7f0000000880)="b805000000b98b9400000f01c19a01000000b0000f43d1b8000000000f23d80f21f835800000900f23f80f060f2140b9800000c00f3235000800000f3066ba4300b8f1ffffffefb9800000c00f3235002000000f30c4c3295f4da400", 0x5c}], 0x26433e1, 0x0, &(0x7f0000000300), 0x10000000000000b6) ioctl$KVM_RUN(r3, 0xae80, 0x11000000) 04:46:39 executing program 1: ioctl$KVM_IRQ_LINE(0xffffffffffffffff, 0x4008ae61, &(0x7f0000000500)) r0 = syz_open_dev$dspn(&(0x7f00000004c0)='/dev/dsp#\x00', 0x1, 0x0) openat$audio(0xffffffffffffff9c, &(0x7f0000000000)='/dev/audio\x00', 0x80, 0x0) ioctl$KVM_SET_FPU(0xffffffffffffffff, 0x41a0ae8d, &(0x7f0000000100)={[], 0x0, 0x5531fee, 0x0, 0x0, 0x9, 0xf000, 0x0, [], 0x5}) syz_open_dev$usb(&(0x7f0000000440)='/dev/bus/usb/00#/00#\x00', 0x9, 0x2) r1 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) lstat(&(0x7f0000000040)='./file0/file0\x00', &(0x7f0000000080)) ioctl$EXT4_IOC_MIGRATE(0xffffffffffffffff, 0x6609) sendmmsg$unix(0xffffffffffffffff, &(0x7f000000a000)=[{&(0x7f000000a000)=@abs, 0x6e, &(0x7f000000d000), 0x0, &(0x7f0000000600)=ANY=[]}], 0x1, 0x0) r2 = socket$inet6(0xa, 0x2, 0x0) gettid() r3 = getpgid(0x0) kcmp(0x0, r3, 0x0, 0xffffffffffffffff, 0xffffffffffffffff) connect$inet6(r2, &(0x7f0000002740)={0xa, 0x0, 0x0, @mcast2, 0x4}, 0x1c) sendmmsg(r2, &(0x7f0000007e00), 0x136a88c8311572c, 0xb605000000000000) setsockopt$inet6_udp_int(r2, 0x11, 0x0, &(0x7f0000000400), 0x4) openat$kvm(0xffffffffffffff9c, &(0x7f00000003c0)='/dev/kvm\x00', 0x0, 0x0) ioctl$VHOST_SET_VRING_CALL(0xffffffffffffff9c, 0x4008af21, &(0x7f00000002c0)={0x0, r1}) ioctl$SNDRV_TIMER_IOCTL_TREAD(r0, 0x40045402, &(0x7f0000000740)) inotify_rm_watch(0xffffffffffffffff, 0x0) ioctl$ifreq_SIOCGIFINDEX_team(0xffffffffffffffff, 0x8933, &(0x7f0000000480)={'team0\x00'}) 04:46:39 executing program 4: ioctl$KVM_IRQ_LINE(0xffffffffffffffff, 0x4008ae61, &(0x7f0000000500)) r0 = syz_open_dev$dspn(&(0x7f00000004c0)='/dev/dsp#\x00', 0x1, 0x0) openat$audio(0xffffffffffffff9c, &(0x7f0000000000)='/dev/audio\x00', 0x80, 0x0) ioctl$KVM_SET_FPU(0xffffffffffffffff, 0x41a0ae8d, &(0x7f0000000100)={[], 0x0, 0x5531fec, 0x0, 0x0, 0x5, 0xf000, 0x0, [], 0x3}) r1 = syz_open_dev$usb(&(0x7f0000000440)='/dev/bus/usb/00#/00#\x00', 0x9, 0x2) r2 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) lstat(&(0x7f0000000040)='./file0/file0\x00', &(0x7f0000000080)) ioctl$EXT4_IOC_MIGRATE(0xffffffffffffffff, 0x6609) sendmmsg$unix(0xffffffffffffffff, &(0x7f000000a000)=[{&(0x7f000000a000)=@abs, 0x6e, &(0x7f000000d000), 0x0, &(0x7f0000000600)=ANY=[]}], 0x1, 0x0) r3 = socket$inet6(0xa, 0x5, 0x10000cd) gettid() r4 = getpgid(0x0) kcmp(0x0, r4, 0x0, 0xffffffffffffffff, 0xffffffffffffffff) ioctl$sock_SIOCSIFBR(r1, 0x8941, &(0x7f0000000300)=@get={0x1, &(0x7f0000000780)=""/4096, 0x6}) connect$inet6(r3, &(0x7f0000002740)={0xa, 0x0, 0x0, @mcast2, 0x4}, 0x1c) sendmmsg(r3, &(0x7f0000007e00), 0x136a88c8311572c, 0x0) setsockopt$inet6_udp_int(r3, 0x11, 0x0, &(0x7f0000000400), 0x4) openat$kvm(0xffffffffffffff9c, &(0x7f00000003c0)='/dev/kvm\x00', 0x0, 0x0) ioctl$VHOST_SET_VRING_CALL(0xffffffffffffff9c, 0x4008af21, &(0x7f00000002c0)={0x0, r2}) ioctl$SNDRV_TIMER_IOCTL_TREAD(r0, 0x40045402, &(0x7f0000000740)) inotify_rm_watch(0xffffffffffffffff, 0x0) ioctl$ifreq_SIOCGIFINDEX_team(0xffffffffffffffff, 0x8933, &(0x7f0000000480)={'team0\x00'}) 04:46:39 executing program 3: r0 = syz_open_dev$sg(&(0x7f00000000c0)='/dev/sg#\x00', 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000000)={0x53, 0x0, 0x6, 0x0, @buffer={0x209, 0xb8, &(0x7f00000001c0)=""/184}, &(0x7f0000000540)="ad40657ed56c", &(0x7f0000000340)=""/128, 0x0, 0x0, 0xfeffffff00000000, &(0x7f0000000040)}) [ 653.164544] tmpfs: No value for mount option './file0' 04:46:39 executing program 4: ioctl$KVM_IRQ_LINE(0xffffffffffffffff, 0x4008ae61, &(0x7f0000000500)) r0 = syz_open_dev$dspn(&(0x7f00000004c0)='/dev/dsp#\x00', 0x1, 0x0) openat$audio(0xffffffffffffff9c, &(0x7f0000000000)='/dev/audio\x00', 0x80, 0x0) ioctl$KVM_SET_FPU(0xffffffffffffffff, 0x41a0ae8d, &(0x7f0000000100)={[], 0x0, 0x5531fee, 0x0, 0x0, 0x9, 0xf000, 0x0, [], 0x5}) r1 = syz_open_dev$usb(&(0x7f0000000440)='/dev/bus/usb/00#/00#\x00', 0x9, 0x2) r2 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) lstat(&(0x7f0000000040)='./file0/file0\x00', &(0x7f0000000080)) ioctl$EXT4_IOC_MIGRATE(0xffffffffffffffff, 0x6609) sendmmsg$unix(0xffffffffffffffff, &(0x7f000000a000)=[{&(0x7f000000a000)=@abs, 0x6e, &(0x7f000000d000), 0x0, &(0x7f0000000600)=ANY=[]}], 0x1, 0x0) ioctl$KVM_GET_DEBUGREGS(r1, 0x8080aea1, &(0x7f0000000340)) r3 = socket$inet6(0xa, 0x2, 0x0) gettid() r4 = getpgid(0x0) openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000300)='/dev/loop-control\x00', 0x800, 0x0) kcmp(0x0, r4, 0x0, 0xffffffffffffffff, 0xffffffffffffffff) connect$inet6(r3, &(0x7f0000002740)={0xa, 0x0, 0x0, @mcast2, 0x4}, 0x1c) sendmmsg(r3, &(0x7f0000007e00), 0x136a88c8311572c, 0x0) setsockopt$inet6_udp_int(r3, 0x11, 0x0, &(0x7f0000000400), 0x4) openat$kvm(0xffffffffffffff9c, &(0x7f00000003c0)='/dev/kvm\x00', 0x0, 0x0) ioctl$VHOST_SET_VRING_CALL(0xffffffffffffff9c, 0x4008af21, &(0x7f00000002c0)={0x0, r2}) ioctl$SNDRV_TIMER_IOCTL_TREAD(r0, 0x40045402, &(0x7f0000000740)) inotify_rm_watch(0xffffffffffffffff, 0x0) ioctl$ifreq_SIOCGIFINDEX_team(0xffffffffffffffff, 0x8933, &(0x7f0000000480)={'team0\x00'}) 04:46:39 executing program 0: mkdir(&(0x7f0000000200)='./file0\x00', 0x0) mount(&(0x7f00000002c0)=ANY=[], &(0x7f0000001540)='./file0\x00', &(0x7f0000000280)='tmpfs\x00', 0x0, &(0x7f0000000080)) r0 = open$dir(&(0x7f0000000180)='./file0\x00', 0x0, 0x0) r1 = openat$null(0xffffffffffffff9c, &(0x7f0000000000)='/dev/null\x00', 0x680000, 0x0) inotify_add_watch(r1, &(0x7f0000000040)='./file0\x00', 0x2000000) mknodat(r0, &(0x7f0000000140)='./file0\x00', 0x0, 0x0) renameat2(r0, &(0x7f0000000080)='./file0\x00', r0, &(0x7f0000000100)='./file1\x00', 0x4) 04:46:39 executing program 3: r0 = syz_open_dev$sg(&(0x7f00000000c0)='/dev/sg#\x00', 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000000)={0x53, 0x0, 0x6, 0x0, @buffer={0x209, 0xb8, &(0x7f00000001c0)=""/184}, &(0x7f0000000540)="ad40657ed56c", &(0x7f0000000340)=""/128, 0x0, 0x0, 0xb800000000000000, &(0x7f0000000040)}) [ 653.411298] binder: 24616:24659 BC_REQUEST_DEATH_NOTIFICATION invalid ref 8 [ 653.470075] tmpfs: No value for mount option './file0' 04:46:39 executing program 3: r0 = syz_open_dev$sg(&(0x7f00000000c0)='/dev/sg#\x00', 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000000)={0x53, 0x0, 0x6, 0x0, @buffer={0x209, 0xb8, &(0x7f00000001c0)=""/184}, &(0x7f0000000540)="ad40657ed56c", &(0x7f0000000340)=""/128, 0x0, 0x0, 0x1000000, &(0x7f0000000040)}) 04:46:39 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, &(0x7f0000012fc7)}) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000040)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x89, 0x0, &(0x7f0000000140)="242d4ad63a3f96dc6f31486a94a2d83c5a418f611092699acc6e63fc912a2a58725a6e853af98abcdd680f6300bad40bc2089b79b61c18651483e6b8e444255df0ef1ae13b4e41ae596c7e2cd3142282d567f44cc3c108e16d30c11b9a9a06c6549526198928d4ec8429288ba5fe0703c1f38b136d948ffd01134be3ed7b34bd41f4333d71335aa5d9"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000100)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0xfffffffffffffc2b, 0x0, &(0x7f0000000680)}) 04:46:39 executing program 5: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000480)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_GUEST_DEBUG(r3, 0x4048ae9b, &(0x7f0000000140)={0x1}) syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000100)=[@text32={0x20, &(0x7f0000000000)="6601669b0f35c4e1fe16846ba49e0000b9940200000f32c4c23dad78e0b9670900000f32660f38827f95b0040f01d10fc71a", 0x32}], 0x1, 0x0, &(0x7f0000000040), 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r3, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000400)=[@text32={0x20, &(0x7f0000000880)="b805000000b98b9400000f01c19a01000000b0000f43d1b8000000000f23d80f21f835800000900f23f80f060f2140b9800000c00f3235000800000f3066ba4300b8f1ffffffefb9800000c00f3235002000000f30c4c3295f4da400", 0x5c}], 0x26433e1, 0x0, &(0x7f0000000300), 0x10000000000000b6) ioctl$KVM_RUN(r3, 0xae80, 0x3e8) 04:46:39 executing program 0: mkdir(&(0x7f0000000200)='./file0\x00', 0x0) mount(&(0x7f00000002c0)=ANY=[], &(0x7f0000001540)='./file0\x00', &(0x7f0000000280)='tmpfs\x00', 0x0, &(0x7f0000000080)) r0 = openat$full(0xffffffffffffff9c, &(0x7f0000000040)='/dev/full\x00', 0xc080, 0x0) ioctl$TIOCNOTTY(r0, 0x5422) ioctl$ASHMEM_SET_PROT_MASK(r0, 0x40087705, &(0x7f00000001c0)={0x100, 0x3f}) r1 = open$dir(&(0x7f0000000180)='./file0\x00', 0x0, 0x0) mknodat(r1, &(0x7f0000000140)='./file0\x00', 0x0, 0x0) renameat2(r1, &(0x7f0000000080)='./file0\x00', r1, &(0x7f0000000100)='./file1\x00', 0x4) r2 = syz_open_dev$vcsa(&(0x7f0000000000)='/dev/vcsa#\x00', 0x7, 0x28100) setsockopt$bt_BT_SNDMTU(r2, 0x112, 0xc, &(0x7f00000000c0)=0xff, 0x2) 04:46:39 executing program 1 (fault-call:4 fault-nth:0): r0 = perf_event_open(&(0x7f000025c000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x11, r1, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r0, 0x2405, r1) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x1000004, 0x8031, 0xffffffffffffffff, 0x0) 04:46:39 executing program 3: r0 = syz_open_dev$sg(&(0x7f00000000c0)='/dev/sg#\x00', 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000000)={0x53, 0x0, 0x6, 0x0, @buffer={0x209, 0xb8, &(0x7f00000001c0)=""/184}, &(0x7f0000000540)="ad40657ed56c", &(0x7f0000000340)=""/128, 0x0, 0x0, 0xfcffffff, &(0x7f0000000040)}) [ 653.757353] tmpfs: No value for mount option './file0' [ 653.791380] FAULT_INJECTION: forcing a failure. [ 653.791380] name failslab, interval 1, probability 0, space 0, times 0 [ 653.842333] CPU: 1 PID: 24679 Comm: syz-executor1 Not tainted 4.19.0-rc8-next-20181019+ #98 [ 653.850871] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 653.860239] Call Trace: [ 653.862858] dump_stack+0x244/0x39d [ 653.866520] ? dump_stack_print_info.cold.1+0x20/0x20 [ 653.871739] ? debug_smp_processor_id+0x1c/0x20 [ 653.876435] ? perf_trace_lock+0x14d/0x7a0 [ 653.880700] should_fail.cold.4+0xa/0x17 [ 653.884977] ? fault_create_debugfs_attr+0x1f0/0x1f0 [ 653.890343] ? __lock_acquire+0x62f/0x4c20 [ 653.894602] ? zap_class+0x640/0x640 [ 653.898348] ? zap_class+0x640/0x640 [ 653.902101] ? find_held_lock+0x36/0x1c0 [ 653.906408] ? __lock_is_held+0xb5/0x140 [ 653.910515] ? perf_trace_sched_process_exec+0x860/0x860 [ 653.916000] ? check_preemption_disabled+0x48/0x280 [ 653.921035] ? print_usage_bug+0xc0/0xc0 [ 653.925132] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 653.930700] __should_failslab+0x124/0x180 [ 653.934979] should_failslab+0x9/0x14 [ 653.938813] kmem_cache_alloc+0x2be/0x730 [ 653.942979] ? __lock_acquire+0x62f/0x4c20 [ 653.947236] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 653.952795] ? may_expand_vm+0x1e3/0x810 [ 653.956878] vm_area_dup+0x7a/0x230 [ 653.960516] ? vm_area_alloc+0x1d0/0x1d0 [ 653.964596] ? memset+0x31/0x40 [ 653.967895] ? __sanitizer_cov_trace_cmp8+0x18/0x20 [ 653.972937] __split_vma+0xae/0x570 [ 653.976584] ? find_vma+0x34/0x190 [ 653.980141] __do_munmap+0xd14/0xf80 [ 653.983972] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 653.989528] ? check_preemption_disabled+0x48/0x280 [ 653.989556] mmap_region+0x6a7/0x1cd0 [ 653.989588] ? __x64_sys_brk+0x8b0/0x8b0 [ 653.989606] ? find_held_lock+0x36/0x1c0 [ 653.989630] ? mpx_unmapped_area_check+0xd8/0x108 [ 653.989656] ? arch_get_unmapped_area_topdown+0xc2/0x940 [ 653.989683] ? arch_get_unmapped_area+0x750/0x750 [ 654.021725] ? __sanitizer_cov_trace_cmp8+0x18/0x20 [ 654.026763] ? cap_mmap_addr+0x52/0x130 [ 654.030744] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 654.036287] ? security_mmap_addr+0x80/0xa0 [ 654.040649] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 654.046196] ? get_unmapped_area+0x292/0x3b0 [ 654.050625] do_mmap+0xa22/0x1230 [ 654.054105] ? mmap_region+0x1cd0/0x1cd0 [ 654.058178] ? vm_mmap_pgoff+0x1b5/0x2c0 [ 654.062264] ? down_read_killable+0x150/0x150 [ 654.066770] ? security_mmap_file+0x174/0x1b0 [ 654.071282] vm_mmap_pgoff+0x213/0x2c0 [ 654.075204] ? vma_is_stack_for_current+0xd0/0xd0 [ 654.080055] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 654.085606] ? check_preemption_disabled+0x48/0x280 [ 654.090641] ? __sb_end_write+0xd9/0x110 [ 654.094718] ksys_mmap_pgoff+0xf1/0x660 [ 654.098701] ? do_syscall_64+0x9a/0x820 [ 654.102698] ? find_mergeable_anon_vma+0xd0/0xd0 [ 654.107463] ? trace_hardirqs_on+0xbd/0x310 [ 654.111796] ? __ia32_sys_read+0xb0/0xb0 [ 654.115867] ? entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 654.121238] ? trace_hardirqs_off_caller+0x300/0x300 [ 654.126357] __x64_sys_mmap+0xe9/0x1b0 [ 654.130274] do_syscall_64+0x1b9/0x820 [ 654.134175] ? entry_SYSCALL_64_after_hwframe+0x3e/0xbe [ 654.139548] ? syscall_return_slowpath+0x5e0/0x5e0 [ 654.144499] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 654.149351] ? trace_hardirqs_on_caller+0x310/0x310 [ 654.154381] ? prepare_exit_to_usermode+0x3b0/0x3b0 [ 654.159411] ? prepare_exit_to_usermode+0x291/0x3b0 [ 654.164447] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 654.169331] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 654.174528] RIP: 0033:0x457569 04:46:40 executing program 0: mkdir(&(0x7f0000000200)='./file0\x00', 0x0) mount(&(0x7f00000002c0)=ANY=[], &(0x7f0000001540)='./file0\x00', &(0x7f0000000280)='tmpfs\x00', 0x0, &(0x7f0000000080)) r0 = open$dir(&(0x7f0000000180)='./file0\x00', 0x0, 0x0) mknodat(r0, &(0x7f0000000140)='./file0\x00', 0x0, 0x0) r1 = dup(r0) ioctl$BLKROSET(r1, 0x125d, &(0x7f0000000000)=0x6efb) renameat2(r0, &(0x7f0000000080)='./file0\x00', r0, &(0x7f0000000100)='./file1\x00', 0x4) 04:46:40 executing program 5: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000480)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_GUEST_DEBUG(r3, 0x4048ae9b, &(0x7f0000000140)={0x1}) syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000100)=[@text32={0x20, &(0x7f0000000000)="6601669b0f35c4e1fe16846ba49e0000b9940200000f32c4c23dad78e0b9670900000f32660f38827f95b0040f01d10fc71a", 0x32}], 0x1, 0x0, &(0x7f0000000040), 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r3, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000400)=[@text32={0x20, &(0x7f0000000880)="b805000000b98b9400000f01c19a01000000b0000f43d1b8000000000f23d80f21f835800000900f23f80f060f2140b9800000c00f3235000800000f3066ba4300b8f1ffffffefb9800000c00f3235002000000f30c4c3295f4da400", 0x5c}], 0x26433e1, 0x0, &(0x7f0000000300), 0x10000000000000b6) ioctl$KVM_RUN(r3, 0xae80, 0x2000000) [ 654.177731] Code: fd b3 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 cb b3 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 654.196854] RSP: 002b:00007f7e72c2ec78 EFLAGS: 00000246 ORIG_RAX: 0000000000000009 [ 654.204575] RAX: ffffffffffffffda RBX: 00007f7e72c2ec90 RCX: 0000000000457569 [ 654.211848] RDX: 0000000001000004 RSI: 0000000000b36000 RDI: 0000000020000000 [ 654.219348] RBP: 000000000072bf00 R08: ffffffffffffffff R09: 0000000000000000 [ 654.226740] R10: 0000000000008031 R11: 0000000000000246 R12: 00007f7e72c2f6d4 [ 654.234011] R13: 00000000004c2836 R14: 00000000004d3bd0 R15: 0000000000000005 04:46:40 executing program 3: r0 = syz_open_dev$sg(&(0x7f00000000c0)='/dev/sg#\x00', 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000000)={0x53, 0x0, 0x6, 0x0, @buffer={0x209, 0xb8, &(0x7f00000001c0)=""/184}, &(0x7f0000000540)="ad40657ed56c", &(0x7f0000000340)=""/128, 0x0, 0x0, 0x2f00, &(0x7f0000000040)}) 04:46:40 executing program 4: ioctl$KVM_IRQ_LINE(0xffffffffffffffff, 0x4008ae61, &(0x7f0000000500)) r0 = syz_open_dev$dspn(&(0x7f00000004c0)='/dev/dsp#\x00', 0x1, 0x0) openat$audio(0xffffffffffffff9c, &(0x7f0000000580)='/dev/audio\x00', 0x305000, 0x0) ioctl$KVM_SET_FPU(0xffffffffffffffff, 0x41a0ae8d, &(0x7f0000000100)={[], 0x0, 0x5531fee, 0x0, 0x0, 0x2000009, 0xf000, 0x0, [], 0x5}) r1 = syz_open_dev$usb(&(0x7f0000000440)='/dev/bus/usb/00#/00#\x00', 0x9, 0x2) r2 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) lstat(&(0x7f0000000040)='./file0/file0\x00', &(0x7f0000000080)) ioctl$EXT4_IOC_MIGRATE(0xffffffffffffffff, 0x6609) sendmmsg$unix(0xffffffffffffffff, &(0x7f000000a000)=[{&(0x7f000000a000)=@abs, 0x6e, &(0x7f000000d000), 0x0, &(0x7f0000000600)=ANY=[]}], 0x1, 0x0) r3 = socket$inet6(0xa, 0x2, 0x0) gettid() r4 = getpgid(0x0) kcmp(0x0, r4, 0x0, 0xffffffffffffffff, 0xffffffffffffffff) connect$inet6(r3, &(0x7f0000002740)={0xa, 0x0, 0x0, @mcast2, 0x4}, 0x1c) sendmmsg(r3, &(0x7f0000007e00), 0x136a88c8311572c, 0x0) setsockopt$inet6_udp_int(r3, 0x11, 0x0, &(0x7f0000000400), 0x4) openat$kvm(0xffffffffffffff9c, &(0x7f00000003c0)='/dev/kvm\x00', 0x0, 0x0) ioctl$VHOST_SET_VRING_CALL(0xffffffffffffff9c, 0x4008af21, &(0x7f00000002c0)={0x0, r2}) setsockopt$inet6_udp_int(r1, 0x11, 0x6f, &(0x7f0000000300)=0x7, 0x4) ioctl$SNDRV_TIMER_IOCTL_TREAD(r0, 0x40045402, &(0x7f0000000740)) inotify_rm_watch(0xffffffffffffffff, 0x0) ioctl$ifreq_SIOCGIFINDEX_team(0xffffffffffffffff, 0x8933, &(0x7f0000000480)={'team0\x00'}) syz_mount_image$ceph(&(0x7f0000000000)='ceph\x00', &(0x7f0000000340)='./file0/file0\x00', 0x6, 0x9, &(0x7f0000000a80)=[{&(0x7f00000005c0)="cc79dda95f6679baa74acadc89e31cbbf467ee67e6136ee7b12c5d22a384a2983a0c85a8b3b81e0371e81a1839fd279abba24cfc848f3db09882d0e90cd810dbaac05f022be380c4b9162c3aed5a755c686b43b5bdee573eb6a05b2b71d8819f060870f68f64f0dcbda71ae5e195eb060176bdb337b52ced0b4d63b90bed93f9cdaa4ea06fb909e7775356b210931c35adceb1e3d72714ce4a49eb92d28ab68b7c1004ceef27c431fd1cf7cf9f1e61008772ba543ba345eff580b49785f0a19a04b4d39d340749dfa9082fa60c70c0ec08feae470d83965e78a45d01d6cd2b2c774cec8071", 0xe5, 0x30000000000}, {&(0x7f0000000380), 0x0, 0x9}, {&(0x7f0000000780)="6e448dd299305bc81a8ceb32c3bf11bdaec4c219585d690768b61cd225ceafc1b7c79bcedf0a37e94ee5609a54302267b2477729287cd24a8ac3a8394a1a057b10cf1c7af14ef7c9c1b81e36a7b0bd827a81ed39c5feab560f535dd01858eb63ce4eccf0ef257ffb922d049ddda8d892e9171d9dbd6a0f35b8ffed8779f3cf42d48f488ce7429b9eefae92802a025f373f14fba0da697cf180000d49d45bc0ef8eacf740ca8d29", 0xa7, 0x3}, {&(0x7f0000000540), 0x0, 0x7}, {&(0x7f0000000840)="a6e7475e39924f628fc0ee4dbea725710c31ace8365cd7a04fa0da220bbf3e92669065268c88e9a08d54a7ea31c93fa5f41068f7cc55acbe63cb604371676af4f3a35b2580125823f798387241857a801bcc2521bf42a4b3cbea84efed71d8b939cc84d27a892f0242274020118c711213a9699462d27c1100596da044e8961966a6dd9d53d2a070c4615d8aaacb80ef84281b18ea6ee421de8de4c052cb54b8af9b5be212ae12f2139032a3843576b94ccfe468f420d6aec1b852dd88f517bbccae63184e216c8b458eeb00d1c949fae00e93d85139fa0c22a68760d70030a6007b98c68969", 0xe6, 0xfffffffffffffff8}, {&(0x7f00000006c0), 0x0, 0x4}, {&(0x7f0000000940)="aacda9d687a36f52660d6d057a84c368b667729114ffed5f566ec81218bfc9fe3f9bbf581e25de2a7c4f3f57edc797ef38d3955486550710160da24c727ef92059323741fd0eb0d1a81c965804a3842d7a245ea13bf37412bbb055", 0x5b, 0x8}, {&(0x7f0000000700)="5cf2e7bffda43fa2714fbbea872147b55e07068ec9dee2f28c50bfbc256d7f3d039f", 0x22, 0x6}, {&(0x7f00000009c0)="b920192a806bd02a590ddc03ffbc8cf31a3d7409cacb1f8cf035ec9d457f08f3799b3c87edd1199f8385fb294e2464851377b5e7cd4471d203d03ff7659d8ed32253379b84c745a55e8270197956d421f3b5fd4978e8769caeac413278faf1c6cd2b9956808b8314129db6577c52f27f9ec93d51e4bf10e689a901706229737b1c1a86a95e2cc225943a56f23c435632ec010db1c806930f4a23fe160afc14d9", 0xa0, 0x7fffffff}], 0x800, &(0x7f0000000b80)='/dev/audio\x00') 04:46:40 executing program 1 (fault-call:4 fault-nth:1): r0 = perf_event_open(&(0x7f000025c000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x11, r1, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r0, 0x2405, r1) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x1000004, 0x8031, 0xffffffffffffffff, 0x0) [ 654.378975] tmpfs: No value for mount option './file0' 04:46:40 executing program 3: r0 = syz_open_dev$sg(&(0x7f00000000c0)='/dev/sg#\x00', 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000000)={0x53, 0x0, 0x6, 0x0, @buffer={0x209, 0xb8, &(0x7f00000001c0)=""/184}, &(0x7f0000000540)="ad40657ed56c", &(0x7f0000000340)=""/128, 0x0, 0x0, 0xb800, &(0x7f0000000040)}) 04:46:40 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, &(0x7f0000012fc7)}) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=ANY=[@ANYBLOB="2e630c4000000001"], 0x0, 0x0, &(0x7f0000000f4d)}) syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x800) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000100)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0xfffffffffffffc2b, 0x0, &(0x7f0000000680)}) 04:46:40 executing program 0: mkdir(&(0x7f0000000200)='./file0\x00', 0x0) mount(&(0x7f00000002c0)=ANY=[], &(0x7f0000001540)='./file0\x00', &(0x7f0000000280)='tmpfs\x00', 0x0, &(0x7f0000000080)) r0 = open$dir(&(0x7f0000000180)='./file0\x00', 0x0, 0x0) mknodat(r0, &(0x7f00000000c0)='./file1/file0\x00', 0x5, 0x478f) renameat2(r0, &(0x7f0000000080)='./file0\x00', r0, &(0x7f0000000100)='./file1\x00', 0x4) utime(&(0x7f0000000000)='./file0\x00', &(0x7f0000000040)={0x9, 0x473}) 04:46:40 executing program 5: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000480)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_GUEST_DEBUG(r3, 0x4048ae9b, &(0x7f0000000140)={0x1}) syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000100)=[@text32={0x20, &(0x7f0000000000)="6601669b0f35c4e1fe16846ba49e0000b9940200000f32c4c23dad78e0b9670900000f32660f38827f95b0040f01d10fc71a", 0x32}], 0x1, 0x0, &(0x7f0000000040), 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r3, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000400)=[@text32={0x20, &(0x7f0000000880)="b805000000b98b9400000f01c19a01000000b0000f43d1b8000000000f23d80f21f835800000900f23f80f060f2140b9800000c00f3235000800000f3066ba4300b8f1ffffffefb9800000c00f3235002000000f30c4c3295f4da400", 0x5c}], 0x26433e1, 0x0, &(0x7f0000000300), 0x10000000000000b6) ioctl$KVM_RUN(r3, 0xae80, 0x60000000) [ 654.548891] binder: 24711:24712 unknown command 1074553646 [ 654.555189] binder: 24711:24712 ioctl c0306201 20008fd0 returned -22 04:46:40 executing program 3: r0 = syz_open_dev$sg(&(0x7f00000000c0)='/dev/sg#\x00', 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000000)={0x53, 0x0, 0x6, 0x0, @buffer={0x209, 0xb8, &(0x7f00000001c0)=""/184}, &(0x7f0000000540)="ad40657ed56c", &(0x7f0000000340)=""/128, 0x0, 0x0, 0xb8, &(0x7f0000000040)}) [ 654.603991] FAULT_INJECTION: forcing a failure. [ 654.603991] name failslab, interval 1, probability 0, space 0, times 0 [ 654.701121] CPU: 0 PID: 24717 Comm: syz-executor1 Not tainted 4.19.0-rc8-next-20181019+ #98 [ 654.709680] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 654.719040] Call Trace: [ 654.721651] dump_stack+0x244/0x39d [ 654.725316] ? dump_stack_print_info.cold.1+0x20/0x20 [ 654.730532] ? is_bpf_text_address+0xd3/0x170 [ 654.735046] should_fail.cold.4+0xa/0x17 [ 654.739118] ? fault_create_debugfs_attr+0x1f0/0x1f0 [ 654.744245] ? save_stack+0xa9/0xd0 [ 654.747906] ? save_stack+0x43/0xd0 [ 654.751547] ? kasan_kmalloc+0xc7/0xe0 [ 654.755528] ? kasan_slab_alloc+0x12/0x20 [ 654.759680] ? kmem_cache_alloc+0x12e/0x730 [ 654.764009] ? vm_area_dup+0x7a/0x230 [ 654.767816] ? __split_vma+0xae/0x570 [ 654.771617] ? __do_munmap+0xd14/0xf80 [ 654.775510] ? mmap_region+0x6a7/0x1cd0 [ 654.779489] ? do_mmap+0xa22/0x1230 [ 654.783124] ? vm_mmap_pgoff+0x213/0x2c0 [ 654.787185] ? ksys_mmap_pgoff+0xf1/0x660 [ 654.791352] ? __x64_sys_mmap+0xe9/0x1b0 [ 654.795419] ? do_syscall_64+0x1b9/0x820 [ 654.799485] ? entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 654.804865] ? percpu_ref_put_many+0x11c/0x260 [ 654.809460] ? lock_downgrade+0x900/0x900 [ 654.813617] ? check_preemption_disabled+0x48/0x280 [ 654.818651] ? kasan_check_read+0x11/0x20 [ 654.822813] ? zap_class+0x640/0x640 [ 654.826536] ? rcu_softirq_qs+0x20/0x20 [ 654.830536] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 654.836115] ? check_preemption_disabled+0x48/0x280 [ 654.841151] __should_failslab+0x124/0x180 [ 654.845419] should_failslab+0x9/0x14 [ 654.849243] kmem_cache_alloc+0x47/0x730 [ 654.853328] ? rcu_read_lock_sched_held+0x14f/0x180 [ 654.858358] anon_vma_clone+0x140/0x710 [ 654.862353] ? unlink_anon_vmas+0xa60/0xa60 [ 654.866683] ? memset+0x31/0x40 [ 654.869972] ? __sanitizer_cov_trace_cmp8+0x18/0x20 [ 654.874998] __split_vma+0x183/0x570 [ 654.878718] ? find_vma+0x34/0x190 [ 654.882275] __do_munmap+0xd14/0xf80 [ 654.886012] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 654.891563] ? check_preemption_disabled+0x48/0x280 [ 654.896604] mmap_region+0x6a7/0x1cd0 [ 654.900427] ? __x64_sys_brk+0x8b0/0x8b0 [ 654.904497] ? find_held_lock+0x36/0x1c0 [ 654.908572] ? mpx_unmapped_area_check+0xd8/0x108 [ 654.913436] ? arch_get_unmapped_area_topdown+0xc2/0x940 [ 654.918904] ? arch_get_unmapped_area+0x750/0x750 [ 654.923776] ? __sanitizer_cov_trace_cmp8+0x18/0x20 [ 654.928798] ? cap_mmap_addr+0x52/0x130 [ 654.932781] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 654.938340] ? security_mmap_addr+0x80/0xa0 [ 654.942678] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 654.948218] ? get_unmapped_area+0x292/0x3b0 [ 654.952639] do_mmap+0xa22/0x1230 [ 654.956108] ? mmap_region+0x1cd0/0x1cd0 [ 654.960179] ? vm_mmap_pgoff+0x1b5/0x2c0 [ 654.964252] ? down_read_killable+0x150/0x150 [ 654.968758] ? security_mmap_file+0x174/0x1b0 [ 654.973308] vm_mmap_pgoff+0x213/0x2c0 [ 654.977220] ? vma_is_stack_for_current+0xd0/0xd0 [ 654.982068] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 654.987616] ? check_preemption_disabled+0x48/0x280 [ 654.992651] ? __sb_end_write+0xd9/0x110 [ 654.996724] ksys_mmap_pgoff+0xf1/0x660 [ 655.000711] ? do_syscall_64+0x9a/0x820 [ 655.004703] ? find_mergeable_anon_vma+0xd0/0xd0 [ 655.009469] ? trace_hardirqs_on+0xbd/0x310 [ 655.013799] ? __ia32_sys_read+0xb0/0xb0 [ 655.017872] ? entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 655.023251] ? trace_hardirqs_off_caller+0x300/0x300 [ 655.028737] __x64_sys_mmap+0xe9/0x1b0 [ 655.032647] do_syscall_64+0x1b9/0x820 [ 655.036540] ? entry_SYSCALL_64_after_hwframe+0x3e/0xbe [ 655.041916] ? syscall_return_slowpath+0x5e0/0x5e0 [ 655.046848] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 655.051709] ? trace_hardirqs_on_caller+0x310/0x310 [ 655.056746] ? prepare_exit_to_usermode+0x3b0/0x3b0 [ 655.061778] ? prepare_exit_to_usermode+0x291/0x3b0 [ 655.066812] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 655.071672] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 655.076863] RIP: 0033:0x457569 [ 655.080068] Code: fd b3 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 cb b3 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 655.098996] RSP: 002b:00007f7e72c2ec78 EFLAGS: 00000246 ORIG_RAX: 0000000000000009 [ 655.106718] RAX: ffffffffffffffda RBX: 00007f7e72c2ec90 RCX: 0000000000457569 [ 655.113993] RDX: 0000000001000004 RSI: 0000000000b36000 RDI: 0000000020000000 [ 655.121282] RBP: 000000000072bf00 R08: ffffffffffffffff R09: 0000000000000000 [ 655.128559] R10: 0000000000008031 R11: 0000000000000246 R12: 00007f7e72c2f6d4 [ 655.135842] R13: 00000000004c2836 R14: 00000000004d3bd0 R15: 0000000000000005 [ 655.158843] tmpfs: No value for mount option './file0' 04:46:41 executing program 0: mkdir(&(0x7f0000000200)='./file0\x00', 0x0) mount(&(0x7f00000002c0)=ANY=[], &(0x7f0000001540)='./file0\x00', &(0x7f0000000280)='tmpfs\x00', 0x0, &(0x7f0000000080)) r0 = open$dir(&(0x7f0000000180)='./file0\x00', 0x0, 0x0) r1 = creat(&(0x7f0000000100)='./file0\x00', 0x1) r2 = socket$nl_generic(0x10, 0x3, 0x10) close(r2) r3 = dup(r2) r4 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x4) sched_setaffinity(0x0, 0x7, &(0x7f00000000c0)=0x9) r5 = perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r6 = socket$unix(0x1, 0x1, 0x0) r7 = socket$unix(0x1, 0x400040000000001, 0x0) bind$unix(r7, &(0x7f0000003000)=@abs={0x1}, 0x8) listen(r7, 0x0) connect(r6, &(0x7f0000985ff8)=@un=@abs={0x1}, 0x8) write$cgroup_int(r3, &(0x7f00000001c0)=0x1, 0x12) r8 = syz_open_procfs(0x0, &(0x7f0000000180)='net/unix\x00') sendfile(r6, r8, &(0x7f0000000000), 0x800000bf) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000080), 0xffffffffffffffff) memfd_create(&(0x7f0000000e40)="0000000000007225f78380807dde5053601841a0d0f82b74374852b01f125997622dc4a5e71d2ce5ac32ff90824fa25e59073487cf36ad576e32926b04894da740f7e9c0ffb42c356a1f285bfc8f0b8c6f72ef151dab4c5c2a5a751f04bfc69ac5c3b5168a6d13d826b1ed0c7527d58f54adc12fca1f25c8fc2586ea4d90f84dabcdec291fb780a39a117d12b0893b182098dceed33b222a1d413709ae355d4d297fe42c5d4e9d8bbd9d0c709cae47e88f8aa22a505b3e995b501f0d3753cd3510e87436612b401305f316177f6d4d4c70fd9d2621c3707ad88da7852596d89a59cb74505e675ac6ebc03faa3ee99889176b571135031afc973c52c5f6437b8143002b30d8fb92011c4994cc024e40497b2daeb06ad5308af486d0178a418f6bdb6940f07dc6e5cf1a3c852b401e3ecec45d22fd687928411b83f68bf7be4b21fdf0033cf949b8a76aa65d68ad885967c2cc3c2d60ec74fcf5de162c94ffe3e15775c1a1cfd9818d4c17a2f8d0a7302538f079e7b128ef123c8bb909000000000000003814c2aea86c35fbf4244a64635d32ff12e4dcb3df56e5d5d3882a9984993f8a7fef72d875d21c1e3bb2bc3e6e79a2b6d322f710f0378abc2095d32139e39f3223db9961309295e4c3c8e1b0001dd757aa000000000000000000000000000008eca80c7b0c", 0x0) fcntl$getownex(r4, 0x10, &(0x7f0000000240)) setsockopt$l2tp_PPPOL2TP_SO_DEBUG(r1, 0x111, 0x1, 0x8, 0x4) ioctl$sock_SIOCGPGRP(r7, 0x8904, &(0x7f00000002c0)) write$binfmt_elf64(0xffffffffffffffff, &(0x7f0000000340)={{0x7f, 0x45, 0x4c, 0x46, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x40}, [{}]}, 0x78) execveat(0xffffffffffffffff, &(0x7f0000000000)='\x00', &(0x7f00000001c0), &(0x7f00000001c0), 0x0) mknodat(r0, &(0x7f0000000140)='./file0\x00', 0x0, 0x0) r9 = creat(&(0x7f0000000000)='./file0/../file0\x00', 0x10) ioctl$BLKIOMIN(r9, 0x1278, &(0x7f0000000040)) ioctl$FS_IOC_FIEMAP(r5, 0xc020660b, &(0x7f00000003c0)={0x7fff, 0x200, 0x4, 0x3eb, 0xa, [{0x2, 0x80000001, 0xffffffffffff9b92, 0x0, 0x0, 0x1000}, {0xaa2, 0x4, 0xfffffffffffffffd, 0x0, 0x0, 0x802}, {0x80000000, 0x0, 0x10000, 0x0, 0x0, 0x2}, {0x9, 0x10001, 0x0, 0x0, 0x0, 0x180}, {0x6, 0xffffffff, 0x5, 0x0, 0x0, 0x100}, {0x1f, 0x80000000, 0x8, 0x0, 0x0, 0x2184}, {0x3f, 0x9, 0x800, 0x0, 0x0, 0x1}, {0x6, 0x8, 0x80000001, 0x0, 0x0, 0x80}, {0x80000001, 0xfff, 0x200, 0x0, 0x0, 0x1000}, {0x4b, 0x1, 0x3, 0x0, 0x0, 0x1}]}) renameat2(r0, &(0x7f0000000080)='./file0\x00', r0, &(0x7f0000000100)='./file1\x00', 0x4) 04:46:41 executing program 3: r0 = syz_open_dev$sg(&(0x7f00000000c0)='/dev/sg#\x00', 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000000)={0x53, 0x0, 0x6, 0x0, @buffer={0x209, 0xb8, &(0x7f00000001c0)=""/184}, &(0x7f0000000540)="ad40657ed56c", &(0x7f0000000340)=""/128, 0x0, 0x0, 0x7ffffffff000, &(0x7f0000000040)}) 04:46:41 executing program 5: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000480)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_GUEST_DEBUG(r3, 0x4048ae9b, &(0x7f0000000140)={0x1}) syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000100)=[@text32={0x20, &(0x7f0000000000)="6601669b0f35c4e1fe16846ba49e0000b9940200000f32c4c23dad78e0b9670900000f32660f38827f95b0040f01d10fc71a", 0x32}], 0x1, 0x0, &(0x7f0000000040), 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r3, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000400)=[@text32={0x20, &(0x7f0000000880)="b805000000b98b9400000f01c19a01000000b0000f43d1b8000000000f23d80f21f835800000900f23f80f060f2140b9800000c00f3235000800000f3066ba4300b8f1ffffffefb9800000c00f3235002000000f30c4c3295f4da400", 0x5c}], 0x26433e1, 0x0, &(0x7f0000000300), 0x10000000000000b6) ioctl$KVM_RUN(r3, 0xae80, 0x40000000) [ 655.342813] binder: 24711:24735 unknown command 1074553646 [ 655.367770] binder: 24711:24735 ioctl c0306201 20008fd0 returned -22 04:46:41 executing program 3: r0 = syz_open_dev$sg(&(0x7f00000000c0)='/dev/sg#\x00', 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000000)={0x53, 0x0, 0x6, 0x0, @buffer={0x209, 0xb8, &(0x7f00000001c0)=""/184}, &(0x7f0000000540)="ad40657ed56c", &(0x7f0000000340)=""/128, 0x0, 0x0, 0x100000000000000, &(0x7f0000000040)}) 04:46:41 executing program 4: ioctl$KVM_IRQ_LINE(0xffffffffffffffff, 0x4008ae61, &(0x7f0000000500)) r0 = syz_open_dev$dspn(&(0x7f00000004c0)='/dev/dsp#\x00', 0x1, 0x0) openat$audio(0xffffffffffffff9c, &(0x7f0000000000)='/dev/audio\x00', 0x80, 0x0) ioctl$KVM_SET_FPU(0xffffffffffffffff, 0x41a0ae8d, &(0x7f0000000100)={[], 0x0, 0x5531fee, 0x0, 0x0, 0x9, 0xf000, 0x0, [], 0x5}) setsockopt$packet_int(r0, 0x107, 0x1f, &(0x7f0000000300)=0xcbc, 0x4) syz_open_dev$usb(&(0x7f0000000440)='/dev/bus/usb/00#/00#\x00', 0x9, 0x2) r1 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) lstat(&(0x7f0000000040)='./file0/file0\x00', &(0x7f0000000080)) ioctl$EXT4_IOC_MIGRATE(0xffffffffffffffff, 0x6609) sendmmsg$unix(0xffffffffffffffff, &(0x7f000000a000)=[{&(0x7f000000a000)=@abs, 0x6e, &(0x7f000000d000), 0x0, &(0x7f0000000600)=ANY=[]}], 0x1, 0x0) r2 = socket$inet6(0xa, 0x2, 0x0) gettid() r3 = getpgid(0x0) kcmp(0x0, r3, 0x0, 0xffffffffffffffff, 0xffffffffffffffff) connect$inet6(r2, &(0x7f0000002740)={0xa, 0x0, 0x0, @mcast2, 0x4}, 0x1c) sendmmsg(r2, &(0x7f0000007e00), 0x136a88c8311572c, 0x0) setsockopt$inet6_udp_int(r2, 0x11, 0x0, &(0x7f0000000400), 0x4) openat$kvm(0xffffffffffffff9c, &(0x7f00000003c0)='/dev/kvm\x00', 0x0, 0x0) ioctl$VHOST_SET_VRING_CALL(0xffffffffffffff9c, 0x4008af21, &(0x7f00000002c0)={0x0, r1}) ioctl$SNDRV_TIMER_IOCTL_TREAD(r0, 0x40045402, &(0x7f0000000740)) inotify_rm_watch(0xffffffffffffffff, 0x0) ioctl$ifreq_SIOCGIFINDEX_team(0xffffffffffffffff, 0x8933, &(0x7f0000000480)={'team0\x00'}) 04:46:41 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0x0, 0x802) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, &(0x7f0000012fc7)}) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, &(0x7f0000000f4d)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000100)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0xfffffffffffffc2b, 0x0, &(0x7f0000000680)}) [ 655.503841] tmpfs: No value for mount option './file0' 04:46:41 executing program 1: r0 = perf_event_open(&(0x7f000025c000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x11, r1, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r0, 0x2405, r1) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x1000004, 0x8031, 0xffffffffffffffff, 0x0) [ 655.577688] binder: 24756:24757 Acquire 1 refcount change on invalid ref 0 ret -22 04:46:41 executing program 3: r0 = syz_open_dev$sg(&(0x7f00000000c0)='/dev/sg#\x00', 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000000)={0x53, 0x0, 0x6, 0x0, @buffer={0x209, 0xb8, &(0x7f00000001c0)=""/184}, &(0x7f0000000540)="ad40657ed56c", &(0x7f0000000340)=""/128, 0x0, 0x0, 0xb8000000, &(0x7f0000000040)}) 04:46:41 executing program 0: mkdir(&(0x7f0000000200)='./file0\x00', 0x0) mount(&(0x7f00000002c0)=ANY=[], &(0x7f0000001540)='./file0\x00', &(0x7f0000000280)='tmpfs\x00', 0x0, &(0x7f0000000080)) r0 = open$dir(&(0x7f0000000180)='./file0\x00', 0x0, 0x0) mknodat(r0, &(0x7f0000000140)='./file0\x00', 0x0, 0x0) r1 = syz_open_dev$sg(&(0x7f0000000000)='/dev/sg#\x00', 0x4000000000000, 0x2000) ioctl$BLKTRACESTOP(r1, 0x1275, 0x0) renameat2(r0, &(0x7f0000000080)='./file0\x00', r0, &(0x7f0000000100)='./file1\x00', 0x4) r2 = getpgrp(0xffffffffffffffff) ptrace$PTRACE_SECCOMP_GET_FILTER(0x420c, r2, 0x3, &(0x7f00000002c0)=""/155) [ 655.701357] binder: 24756:24757 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 655.716596] binder: 24756:24757 ioctl c0306201 20000100 returned -11 [ 655.753537] binder: 24756:24766 Acquire 1 refcount change on invalid ref 0 ret -22 04:46:42 executing program 3: r0 = syz_open_dev$sg(&(0x7f00000000c0)='/dev/sg#\x00', 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000000)={0x53, 0x0, 0x6, 0x0, @buffer={0x209, 0xb8, &(0x7f00000001c0)=""/184}, &(0x7f0000000540)="ad40657ed56c", &(0x7f0000000340)=""/128, 0x0, 0x0, 0x6, &(0x7f0000000040)}) 04:46:42 executing program 5: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000480)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_GUEST_DEBUG(r3, 0x4048ae9b, &(0x7f0000000140)={0x1}) syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000100)=[@text32={0x20, &(0x7f0000000000)="6601669b0f35c4e1fe16846ba49e0000b9940200000f32c4c23dad78e0b9670900000f32660f38827f95b0040f01d10fc71a", 0x32}], 0x1, 0x0, &(0x7f0000000040), 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r3, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000400)=[@text32={0x20, &(0x7f0000000880)="b805000000b98b9400000f01c19a01000000b0000f43d1b8000000000f23d80f21f835800000900f23f80f060f2140b9800000c00f3235000800000f3066ba4300b8f1ffffffefb9800000c00f3235002000000f30c4c3295f4da400", 0x5c}], 0x26433e1, 0x0, &(0x7f0000000300), 0x10000000000000b6) ioctl$KVM_RUN(r3, 0xae80, 0x7) [ 655.856739] tmpfs: No value for mount option './file0' 04:46:42 executing program 0: mkdir(&(0x7f0000000200)='./file0\x00', 0x0) mount(&(0x7f00000002c0)=ANY=[], &(0x7f0000001540)='./file0\x00', &(0x7f0000000280)='tmpfs\x00', 0x0, &(0x7f0000000080)) r0 = open$dir(&(0x7f0000000180)='./file0\x00', 0x0, 0x0) mknodat(r0, &(0x7f0000000140)='./file0\x00', 0x0, 0x0) clock_gettime(0x0, &(0x7f0000000080)={0x0, 0x0}) utimensat(r0, &(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)={{r1, r2/1000+30000}, {0x77359400}}, 0x0) renameat2(r0, &(0x7f0000000040)='./file0\x00', r0, &(0x7f0000000100)='./file0\x00', 0x1) 04:46:42 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, &(0x7f0000012fc7)}) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, &(0x7f0000000f4d)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000100)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0xfffffffffffffc2b, 0x0, &(0x7f0000000680)}) r2 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000000)='/dev/hwrng\x00', 0x10000, 0x0) getsockopt$inet_sctp_SCTP_SOCKOPT_PEELOFF(0xffffffffffffff9c, 0x84, 0x66, &(0x7f0000000040)={0x0, 0xffff}, &(0x7f00000000c0)=0x8) setsockopt$inet_sctp6_SCTP_ADD_STREAMS(r2, 0x84, 0x79, &(0x7f0000000140)={r3, 0x10001, 0x8}, 0x8) 04:46:42 executing program 3: r0 = syz_open_dev$sg(&(0x7f00000000c0)='/dev/sg#\x00', 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000000)={0x53, 0x0, 0x6, 0x0, @buffer={0x209, 0xb8, &(0x7f00000001c0)=""/184}, &(0x7f0000000540)="ad40657ed56c", &(0x7f0000000340)=""/128, 0x0, 0x0, 0x902000000000000, &(0x7f0000000040)}) [ 656.089828] tmpfs: No value for mount option '2?Õ[' 04:46:42 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, &(0x7f0000012fc7)}) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, &(0x7f0000000f4d)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000100)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0xfffffffffffffc2b, 0x0, &(0x7f0000000680)}) r2 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000000)='/dev/hwrng\x00', 0x40000, 0x0) ioctl$BLKBSZGET(r2, 0x80081270, &(0x7f0000000040)) 04:46:42 executing program 0: mkdir(&(0x7f0000000200)='./file0\x00', 0x0) mount(&(0x7f00000002c0)=ANY=[], &(0x7f0000001540)='./file0\x00', &(0x7f0000000280)='tmpfs\x00', 0x0, &(0x7f0000000080)) r0 = open$dir(&(0x7f0000000180)='./file0\x00', 0x0, 0x0) mknodat(r0, &(0x7f0000000140)='./file0\x00', 0x0, 0x0) renameat2(r0, &(0x7f0000000080)='./file0\x00', r0, &(0x7f0000000100)='./file1\x00', 0x4) socketpair$inet6(0xa, 0x80000, 0x1, &(0x7f0000000000)) 04:46:42 executing program 4: ioctl$KVM_IRQ_LINE(0xffffffffffffffff, 0x4008ae61, &(0x7f0000000500)) r0 = syz_open_dev$dspn(&(0x7f00000004c0)='/dev/dsp#\x00', 0x1, 0x0) r1 = openat$audio(0xffffffffffffff9c, &(0x7f0000000000)='/dev/audio\x00', 0x80, 0x0) ioctl$KVM_SET_FPU(0xffffffffffffffff, 0x41a0ae8d, &(0x7f0000000100)={[], 0x0, 0x5531fee, 0x0, 0x0, 0x9, 0xf000, 0x0, [], 0x5}) r2 = syz_open_dev$usb(&(0x7f0000000440)='/dev/bus/usb/00#/00#\x00', 0x9, 0x2) r3 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) lstat(&(0x7f0000000040)='./file0/file0\x00', &(0x7f0000000080)) ioctl$EXT4_IOC_MIGRATE(0xffffffffffffffff, 0x6609) ioctl$sock_bt_hidp_HIDPCONNADD(r2, 0x400448c8, &(0x7f0000002780)={r2, r1, 0x3, 0x6, &(0x7f0000000780)="5eb21de0347ea5c9b1aea2fba421e4f8e704fee2299a881d74591db6e649ad561fcb5746615f53405f89b12117e6802d2934f6b9514e6b69b080977562f41b22ef162529a82e23bfff23bf9fbcfbca9184e58a0774e89b26de9e51984a3070fd46b3f943f15083d7b0a17d8ce79a6d00d945ffcc23b4020f703bc8d052511b18583afe0c37ebfef8e976eee84383c565ac62a1f75e0922d00aa11af9ab4ffff7b12476bc4c85a6d8e3bf4b00827ac935db84dee617dee853fe22e150195cd33491d89e3524cfdf54f7f5e76b2022f7b092db3516fbcab5585d630d73bc66df5f3b895be300b6178021b4ed743f4e29d41304159ba0de21b47f772443687aa7e7cde7906e24bceaaf47b46ffc9624a73fc0b7d042bf5ffaf408089c69939359b78e3c8b53ea39b096bfc1cc9caf06a2e08e60c965f632086fd6b78d55a54560a48ccb70e92e64091bbf3747c58713f03e7fe1fee5264c6dc5304edfaa26de427fef8cec19d053ca8db32f5e0ebdb8afae00e62a28cef10b187869c197b768063e2b3253dbd022718e038a783cda1c1c3ba54970eba97c6b06eb63112a703055de052fe79c21ac2e87551e19d0e0789470c9b5f5b5b3b22334ac0613829c06410fdb39074e009035bd75f2d8de9992444ad14085df689ccad11ac42081c1a1ae7bc5a579ec6d771ca7d7fc2c4bc4a126ef45c5325d5462df8bfc3dce731d9e7becfaa83e6b8ddd2177e76c7932f530803bf7180b8f842fb8ff881efc40ba4da960ce4e52c3f7e6155e86e3ff79dfbd02bb8c82c751beedeaa10ddfffbe1ab670d06e859155209d457b19955d9f4626a0b720fb03cc7d6fe3ab72fc056c2c2b144ef09cc23263cb161e73d34a83cb0bd72a84ee6e15b359703fe6d1e544576b0ecf7a572c8b8721316ba1298bd97e37962f7322eca5293b8b220f9a00db30f53f0b52ca721919cc3c6a2aab03ce263ac1dac390375c85bcd30c26a7b764015176da23c3f9e606378ad4d52a93fb1c09071b55da062a02029fa5f83dc32a2fb5ab9d84cf4cbccb6795b44808ad630586065add679dd7f590482749f2f6d89ac398d814bb817ee2fa3bc34a473d51eee7d45670d88f564a7531209ac8bd928ec9651214954e2f5e6483b0f470891c63b2fd3c3c04654e8eac3e73c19456bbdfbe1d3e44e866c707d56e0b56fb543f0d438a84d4842132344152c4f33dd9c619ee0d6e9eb0692889671f2a60e2f89c90d36bd406c1de81915ec01e27103dde1624c265671042584f64ef3001b26d954bfa4c9c3044bd22be909107232f7e311edfdb22fbe30c1a0a33564b59565f87ef2033beed50af986686926db90a552aac69bab167b0a907b04f4a873c85b6741cb10076c14eebc7d8124f023d96c24a642248324da9b5d64d7491a23071799d474cf050e6f5baf639366e811859331d945a650c89c504be8324189e4662c3d6512e34628d0a713531062ee8c95ecada5730f6af90782790e68032a61272a75625d21336529975b6cc29369d7514f24bbe112dc3e2b5f0d3c5ab541670eedf1b5c06ae62037645ba2ae7606b48256f72de8930842d13f0af0f55b939306c70cff7992a0486aa3fee574166a8495c23b2e93a3439235984d568a7bc460226891c9c19e04fe82e6100463906fd0f0071884cbccaba22c19addc0030baa9d80cec557be96fb1dffb08989eddfc9475fc38cb3046f245aaf8313647ca40641048d203584943ea0d5c55d61218f305922c90de02a807bcdedda73e9097df12bc9704081fa52bb55394fdf11d996a03d314daa928658431b580ed3c275a1982c1b275a585635299cc122897a57313f46fdc7c428c709582587f0786cbbda04135d59e7e35f4b4c8996a22a9386262be3d59dd70cd07098059f56411e62de7fa62277f7d2c46c0b2a7f8ce6640ed29d0866c67adff5dec21e85f528b466ababb286765d59b2e0a05dbd693b2540755401eefefe985cab3e9ad4da9e53dbf25b19d3798664e777703d88a71382a71b7ddb59e169dab95724374ef669d6b4445df864407fccd7419f3e43f4ce1f13c8fee87747e8b3642d35ac862839f0a9183fac3ffb545f1ed876e539311571249acb167ee2a445f7e9fb4ee22e15c2515190e3c6b814072cc7b1bf8b1098037a11a121a9fa8e1f5d1c4e9e615359126824f0f79cb93dcac6454693cbf1745955e35aa28145d4c312079cd946c8d3d9c4de6dc4fc72e375293dcaa6114ec98abcbd189bd5a7bd0a2c9299f53f6df09e2529569d5d72e523fd21568dc0958f778ce3f6d8da400b5237d1f6d12f3e100a7dad1900cc3d17a913576ccc8fba272fe34f750a7d60ce8e50627118844e50bb58e687c7a84423d1ac92fed8108ba6c88a79676f0b1f379892aa5a252e5c6cbed7bd8b6cba743d6f881b5a9b7c082151371f8d8267d61e08fc5c6eb22ff20323d94cf96a58463e81de69b3dfec75807b5752619ccff1e48f9357fbcf6a0f99bd2d6b9df1a09b7fbe2546d22ab0e3754ec84e6191554f04d1d2e7e9735a69d19c0f25af22f06f514db5593a4e4feadd46f1326b4fba296c413aeba0f617df55f1fd5b245f30a27a595850a8729fa42af468f5378f8e0a530ef6a50bb8808438d308aee9e10b1529b85ce7e7d3441f7ec934c66688eb07056c7c403daf9c935805182510110034986287616db7f4b8b8673bbdf316c79065deb26b7df3bd0826e20ae762d26464442dd99cec07bbaee2d6e183ca5c647f51f44244989d2e51a908a6091f89e702f1fc049ed5dab214c17b9174c6f1323453324d4b3ae091a5bd88fce3d214f8c52fd1e99cb92c1c6a1744982d4ee76957df9a2d1c0388b98ac85b6db26c35165656cc06049584767d9240d8ab46f6d209753815497e20201ab929932546c5d1d41bdb1271262d672889e4640d0d2669d822b57aea05c17688db875e31deaa4b0f888a1ab0d0da272c50798cc972a242d5e77242539f8ba1b4667b45f9d9fe47a31180d6a76596c81988b2e5a9cf93dc993486d4ab8648279d31e6ed25bd034128d1ccb1c2d408a011ecade873c79256d5f8aa69233bb47fc7917d46a981ef89ab068f1c7d128e428792e3a023833779226e70bf73912b74ac4c0700382127cf49a34e1598d25832bec836ec9ce1facaf35529cdfa6f0418c21f3e28aa75922e4add668aba17ca9ab8d4a1d771ed5075c6537f335ab53d7a6c256f2b20f4f72b8c298b2d2bf51314605352d4d42278544eeee9766129c4e0e33b69fe6417006a1078fe5470e5fa29426bf04921a8ae9befdd1737812455206a4b62305d78666ca759001f2ec9f236f60332dac0cead9c2f9e1ce2157f3ae9c1e97ee429ba123dc1930cb8157d506e16032fc9a78a2e4d4b74e467bf1abfff9ab597d794ccbf022de6eae00ef9d53205e423195874782cad6a0cb752b8ebe8f602ea080cd2f834d12e50fb1296da58a9bbfa737e3810f9dcbafd34273593137a5a9b9189058e4da3dacb58a747d64bf37581cd66c10c2ed4b6208e52486fec8bc4e15bfcaee22e6255dc8b3bb164bcd12a5bfb1cc03d22942990d207add5d2c19adf883a4351b4b9f32d1c1f6171ec5d4307f3f57d59777d806bcfc6c92465be69f95cf45e097b464af3874c3bdbd8a25eccdec4554a35be43c6498e5076a0e6ca68d31c35a073cbc1c6b4f1ad41c037afe4907e44e1be4b42871d22b6837cff5271e546f6e404f2fca5207899f6b77c02c2292b1f8d1bb3faa85636359e6a27409755106d5c03692786558ded82e7887e1aa5e5ba359724e360d4e5cf705e0e8d4255f703bf88b53884bc872ce018386f8eb37baf14cd1b4371a49b9d378fbf2501f44d7d80b30b5c90a599befeac9b2d3f45611ce127822aaf77dfef6e737cda63a68b69023400a067e2635be880d838ac54238e05b7270dbf00c6ef312b4e4e71047d0b49e82923450ee496f05c65a43b020b71bd73232ab3a0ae4bd61d38644340141d4ca31acb9604a21ffce32df455963eee29fcd07018eef750539df8e08776535684941325ce806159eb2e7587a2dac16caa66c64bf420692e28ade6a7da048575706ee7d770b31336cbe3d052264607bf4b33f2db72064a3c7ad9f3e50026402b8a9e94b14e193b315ee1d6188ab8fdbe094ce1805f0779e30dec32ebaf771d4b26ddf125028e9ed806666241670323a59fef26d11a993cc216a101b654b86e8dedd66028fc8622eb0b4e93eeeea87f7bcbcc27efc350c058bd99623204d311211e0e0e6c0abd70b4227457a0f3bb1b0496b09f0c58ba9b4e43de83c341b9271bc2d6e67709d196a148dbe649c2ef3c8d0525a226586c4478a96ab70036c4079abf614dee835ae78496ca92ba32aa01204b20593a5ae84c110b87a70f4f5144201d8b51acfb539f5b0d24c853dca337907918bda4f7d52e372bacc95410dc1e1221645af3671482db1b85f1ed9bd081dfecedef53a7367c379b894cc9ae1ba5113a917ee663bf4225151c38c0c3c47c8a6148e25afbdd6ab2d245ab3eeca6ee9d31d40da83450b5bba3459b177b2ebcfe0a722079432545215505b8d326aefa08a992eccbf29333337a92a4c4e07fd7fca9a0d0097f33bbc055338f2b44fe16db7f34f3ae45513d423f46177cd7e98e47b843f26f41f08de11330019af6eabfdb8c4be923c9e0e67b677c4e1277bc693be9de1a571ca46ece300700e83d0f6cbc41118233cbf12a43244497f74597e1e8c2418bfd65624a56f813a4f560bd1404554cc1c11dbd443592e4bf536373e04ad8459910adc143d1865c73395759af8179a23c03b2dc6c1e93905104561c4edc86448f0d94166059f954ea352eafedce8207b985574955791ac97da260ec09ce0d0a0296d45a1095c30dfdc036171a001f756db0db5c3655e047cd4d18ad139904f82002c99e7fdd6989ec761c01a42c6cf149902c565b10052557df1a2e6d453b9c6e5ed23ccfae0c6e78a4ea20ab619a3d521e23ba651aa22b4c19e341bc1f2761b552b5bf354b2f7232c7f4f535b525aa69f4fedfc894487571699e1a905ecbb31d04bd06a2fc1d6833a3cae64956114a0717dd3e8f7a1dc4f5ef91bd8b3888680045838c4ae8dc87779cca57b9fff7d0ad95bad6176cca50b498b17cc2aab5f559197bb80c871315a8010d8b8ea221bebda2e243638bad6da6362894e7b4a71cc99470f65415884b9188c95db60d3dd43313677b9af7248c0e1cdf30d039efdb42136ea35a6101c1d8cdf3a50d27595fb6fdea74b61dba8b61d9636ea89319dd19648609936202aa9bdd2937c034fe5eec88164c7a9a635a7787469ee0911a5c44f0c7a98ef69a52ef06fabf3fa7d7ba83d11e1462e5cb452e3c6966ab0da97c984dfc8d6c37604d6a38c0d2dfeef43409e9a36a7ad890ca8aaef5b0f33f274523ad1943011d9a0049981798233af1b77f1097f1391d8fc12d1323a1e2f2f7e254864a99ffe5aeacef39eda7980b6c7c174697c1ce8a2ff3044f86599e7143e93fee8548b72a9dcbebab8371574ef69e1822f96134730462271fbd76c678813b15d94651129492ad55e445955128c5294f95859b39795a2042d620aa46784ec8d19975b1d2930bc9816fdaf3352685b09d5fd1b2d8ed45c1153c40d3efe56cf37063bf2e453d7a2dc5b83312ef213655e0cb41f22827f253aff2fa781346788d6b809e77a673ee4d90a637346c6298d4e19c3a1d23a9bf18f44ff2048d4db1d950572c2eaa25f3c90564538367ca82172c74aa33e34d7f2d9b83e6d36be3e61536d2882248e3", 0xffffffff, 0x40, 0x10001, 0x4, 0x2, 0x5, 0x1, "34ce037c3049017741b0b4a111fac5d37baac6bf6c21cfcc05cc0cfdfd61bbf844bb0ec31cacde3dce4dddff9f0f3589c513cf220113a3d6299c5e51dc3705f20507cdd8c38953f317d5cb2f58889ce6a1d1cdda91c66fd221d0841500d1bc0d2ed9aa3d49fc5e8c708d1e9ce3bf6133eb9c9eeb1bdeca1818de3aec02edc223c7cf7610a4299552a723b9f2aa2063ee4d1bc7963dffe950c29507b17283dc784fb085501baca0d3fc396ecafffc696fd6076d5b3edbe8503f957e246b98e6e7f4002ce7ac68d73bcbe24c64b154a268d2fb1780a79b7bb27d3e95e5f81b0ac5baa6076941d29d4d1e03bcab3eda048844902af8bc76629df9926bef5931f8da22062db51959313466ae4c6b8bb943cf7edfdbadf9c897fd05aee814ef7b3285a55a98bbf4760b72377fa59cc8870fb0a938fb3508405af781cf6a7700e8a74d22e84dc1d980233ac863b9ed130a4a2893e8fac4bb170f9e8c16bb79db48c28a8e39dc3a56a80c0694ef5ab30904214266cc4bed2688ebe3d527b7bb68ce6be4a442ea948a3401c47a4c523e4f2a0d7f9a8e48f84cb903dba4bab74ca00004a9839e438dbf8c946febfb0e62d1b55afc239529d419ec451685cecc7993816c43630c2ef30cdc3ab9021882c4e581d426bbe4e599da1ccc9769111fc691760dd67bc11d4ed58866bca5a6658839a70d043dcded80f7ad533cc4c576abf9ce803cbcb0f3c3cc9e129cba1d3c2b074d81eadfb053df8e6ab15d6210d44034901d9653e6a95ec4253c4131e8fb67418aff1958113e7fd02b4894957f630819092dbf4986982da7de915e6cd6d6ad69e14c6fd2ff482420efd270a168a944f479227ef797642a0ebc8f514e40b8cc74a11b3d3455f9495c267512d3a0ed5715c4fd65fe7490679a04c6b931b22757cb9d5830f87465eca82d0b2b61d89d2e76541c138767670b819fad1ab16fea0fd43de7a67a5178d5532e5fb53f70110f338dc288d5cdd372d07778b5a3a36aaf39f5b557e001f749d2d7f453983d0585b1a7a49bf632f589c2706f74ba2304cae7f5645bf143585a4dbfd82852ad57d80b15205db5c31d082c98804f75338f75a8623d57432a0c319eb4ef52323841a7c3ed3576ea0b98004766a57d40ae748695d7f9f0926a6651f940d8ba7fc6cef3824c50b9bf607b80526e796797512ba1e31e91724f747f55a3097b8bf0d8c52fde61bc6e7500b4617e5224381feed434fd3748a05ed3445ef3a5ba94ff3655a748a626c198cc10eebf6798ac92793db5de2475a69efaaa99a8f4fc47899c29284073ea7a1946363f6dcc67d38e1ac6b038c17db0fb822c2222913d3a316ce9c55796c776df578ccf7e6035f4a599231a1455d0285520bbf9fbbc5b4edd5b5fd37ea4da5a9aca96817dd49b6e9fea7b54b0bf273f2a3e2a4143c64b132e7170a5cbec9ee8f935d017e7e12fc424610f288d661243f3df9737f572af061d41ac23f614a6a164721e190dd96ef16bb5fd26299814f15ad0a4731d14fd0f8f5f7506fca2ae74b2afb83cd960fd7e60e54e079b90518e86ade0722da5aa3e2c0dfd246f635a4e2342384cf4b5a635a82d04cc7d5f4b9b1fc9df43cb2faf8749f42f09c51bce9b870831098330e7eb7dfa9e963247bf7fd2d64ce11908fb2d2cf58256bf0be3bf2d372751773953691d604992098ce2bd7a616b562f3f3d093c375fba2a5a3f754860ac3adfb2e28c7bea395e6773d4fbcbd9a0e8f5f372099492f038df11bbce9de58856fec1768c0005b22b70d6d5d3ceffb73eae88fffc473c19f2a9cdd2aea7914aace1f1e0fc83188144e2b292193a720a244647976e34357143b64fefe711c65267ae6e2752aa87f1e518ac6b86a25bbbf0f0022c062e703aafcdce340a234f5a67e38c88b733932a5cfb61fd9fb80a0a06fcb2894f2bb7bd5a1dbced0651a4b60d0baef51f71bc83a587adbb9e782f74d700e308d96ee9d4c8bab2d536a7b7ca27a970adef35bd7ac4e1be0c6106ed592a495ceb66b14cee21e282007fdf4d569e4f936f927f58966575507d3233ac8cca5bf3c44342e29027f3c5fb58bd2fc2e9a853785cf8106c5df272fb9e488dbea0e09946e1c3d09181048e346cc8dbc75f4f8ea00482d247cf5d54b859c8477e314bfa090028292ef39e5b50ee19043e250b165c8d170ded52b3277ecd30d3b46c3d1f2b12696dded9dba9287270c74188847b3b3c085850859886784408cdbf4d2409bc05ad0a5a6f8af206055139dd39c58c71ccf1aac5ea6ef40d5e494e919e2d2ea0b729a338f5489a4af7d48822f2e82b77adb13ae04bc02fffe0e6e8dcac7fbab412611ddf7ab92d4e1f10964982b16fd5738e6b0ffe60cea330074b2ae73ba7803c4fabc377678f33bf10bf2a338b46da4b4b00548ab13311872dc0c08344f9d19ca07c7c06c9cf9fa0756cf8818002286c7146af0d873f611a229c728e1958dac150271a3179c00e83a67a9642d0c784c4dc6166c3c8c40d064214bde1674bbccdfa052906db4013e590ef99f66a9e64276071bc377f8018ca50845b6d64482098c576c817adf29cc62ddd0d931e1faba6fca3cb464cb0a4f44b10af377bf785d0cef9903097535515299123be0f9a96bd0a6035cb455fc5d40509788cc2c489b9090a9c6eb840a3b4f093fa728f0e2b24cfabe81aa7dab3856adfad68397f99ace3227e969bb01711a638508a1aa70d5f9a5203f72624b4f17bcc873984de7604e4c81adccc95d9c68061b30e74c45fb3cf7907bfd9652febc91bc526e614950603095a71469e3a622ce3cdcc3239184259232203b3856d17d0e943f96588db9755460e69bf5d7608d2ecc31cffc748107fcbecfbef85211470ffa5df9ebb2d3610cb824946c944ed5499b30c74d7de3b25906a9e57597347921dbaf4e92fe2a60af199b0fd7ad8d6fa136e04c1dda418a831d3ba8aa990e553ec7eee2c65016e768e24d0d4811c6dd01270ffc51cfc08a216c8ed844fad1e5da8c26fb9199abee73853d327964edfd9432e83a21e52a1c6f75c4f95360ed488a4003792bb219591ae84c4c4d04c244cac6732e374bba20433a7161d13f420de66867494d7acba69f5c18eea2c2a052a58054cc6f6aa67afa9b389d1d9f423151100e13c157b8857086e5059235c0374ec0dae515dc24740e4551ba1467e204b088f4d86e74c795f389edb3101a47eae196bf4683afb690365446f38638d7d54fcd4ffc37f0398bb4342538a234532d49b333025790779366455337c585171ad151df80545747eb8a196336df6fae8b48b9e3af6129c53ecb9fe20ef5f95fb736ca1885d9b9ff540c2624d7a982c375fea2e4fb5b02addd0dd52ed95e1885f828df3d74a81e9f60dcb1da42e98343d0ef69e2d0d1d40fb30a370d25340619f6435b193ccc3b718178f0e094232fd3cb295371f573d611e385df4d17469c49735fbe3e32968448a9c95643f6a73291eb10224960f2a94b61b9ec107eeaf012f0ea3e4c8114fafb3714c176bca758ee4b70f8490ef68394b334023162a0da9c6e32154472deb09a569bf7bf0cbb95724599b93aaf49446e6cc6330c400e5f3204a3553f0d2de3edf311e421005122a0ddf070a48c32233d311c3021bb8ba0e0f4e9ac11945bb7f0b8390d69bd1b6ba7e557be14f321e87cda2daa54ab8db0ecad2f78403c2d2a9f299fb23be7e656767e73788a04fa6ac1ec12cbe52d29cad9c3704c9cd0be3e63aa8522698b7d9ceddf8369967af28bd0e87776974fda2e0c75ac8eb875df0c34aecc9536e4d2c165bb2d33a727071db6049eb4999b2d31751283084648558acd8ac5d2dc85291d694aaa5faa9ff2670e7a06582e88e179187c77471ddafa9e87bee6e71e89e3c8fdb733c2787e764f176aace9bada2d84a1689b847164b11fdcbfab804e7e77731f5724a5338bbe88e0dd911d59804c0d9358be0102781a04fafdc8df11af02aea1e794f8219e67c46ee89e5a714e9f9353f1fe0e9475e3eab8adb80135c3f14be83fb5b4813760702c0f0d8ab77e250d70687e5c968367e98e70540b5d74c5d59bce43debed3ebe3bad57dd6b5c220be3bb64bc364c20523e6761037f497617cf81386a35ee46125c1d9efd86a3f1084b7cf2152e9fad23a776b01eabd76bf78b9452f902e299f944b004ebea43cde32789c8545b970d0f661c22ac38c431de0a773b577f3915af367cb5fe4ac2aadbf158219e7d452be91c7eb2bd09b181c355a07d65a27ffaefa4191f5f41c52800dcf31024cff34a9e7c0805b9d8dee09f14fdacc1d89f54ac2f3628ee897951ab0f66f1562e7da000732aa23d50400b2ddf8b38af761f5116576a4d9d95dfcaf25af9c15e1894699530b73aa151718978dded4ea470d9b0978adecbff973e69e8dba1a44fa275fe80ad6c7f6bc87730397531a11a8fbdfc7c64644a3604b6bc3f7ea3f2372dbecc7c9e6dcb99ee706e4c19c3c36f05fa6e5326502b631f380384261d1cf9847aaac61ee0ad7599575aab87a1f8d36560bd34f14a50566864b279c25d8cd7fcc5b443ebdeac27a969a9344a0fc051f4ab3db92d2849e1ff0b60df7b427c04248a1cfceadecfdc97029c79b8e98ebb062d6ee9f7a3f51c320653628aaf6869edff70be3a91e372cd8ff13e5b8fc64b97406426fec6f44e528ab2f7f13d2d30255df80185dc9355b7dc0a2740ba0cecff2da311e7138f2526de589db5a6ffa98d26c93a9146d8be85331c59cdce36e8e5fff85a0bda86d54ff34ad48e66a596bbbbeaae628497cfe77eb59bde4eebf8875e5e8c8e877d5503cd370a6f0011b242115e4b2b40f23b50f5e1a75ef7f37451133b126b275273add86aa48b38a3acb7633819de01d03ec05f4dc1082178650cfb82ac860eb859ec7ca831b20e86c13c9bde561bf68b062db5c20b36a69a78c43a83eff143bc1784cb748cf0aeccf79d14fe7b218f2bc92a75232f61b4acb1f36b9d791989dc557f880ae7f6aaffbd5ab350165fa8c2a1f39efedff7dca96b4c87f9b46e3e7cceb69a7219c824e322e2a44fcb4221732d128469bd6f2c94ad693a0d2e7e3bdbde1862b7fb8061588a312b16bf8f9ad198d7a8a1ad3d330ba22888156e54b0a51a83ad34f84ddef205dc309d756310945eb42f935fd13a277d350f681ae48a7320483829c501cfa41975285fd1b631c5ce960ffa1795a7af87d19327b5b679dd871a1be83ba11f560b08bba96bcaa5c8a4e437504891dadc138567fac3f8a901677d29472862ac711bda0b7b3018057981d11db51d635328167f381843ba652d90bceaf441ae28dec83691b7215dbcddaa88f2188d4fb31ed1f10b6824cb4cf34b012dfa4a4d7dad302c9e31bc59c6fe76add9349188ee7e641d18e74160affe2a06a518c03c83b3a53000cae5921b6625375fcebc298975d8ce205e7df38c0272397363e5ffeb31b8388536f70d4e1772e0b4db6fe50e1d5eb79f140e6385b6049f2b0b2c5da69cf9a2984650ff372372a975ec8f871429894540569b3c585fe6e86626849cff6a4ddb2d11edf678e02bfc535f6a7f0ebba447183947e54657ebaceeadb0bd95513dad9bceb9fb8e3763bb3775b609d7083b0a0115b446507b17972f0cdeaf377097ce70155d478f79e8e633c425774da4f87a399709b7965b7d4e0927251d74066a27dd844484ada17d859d925239a19d30dc71a32249af308b82f397a3c6f260d5342a2546269c8bb3aa4eef026bc6e2ba2caf4ab7ca1220ebf2560be69f0fb0ba00fc6e0338ebb52cdfc9b04e67d7"}) sendmmsg$unix(0xffffffffffffffff, &(0x7f000000a000)=[{&(0x7f000000a000)=@abs, 0x6e, &(0x7f000000d000), 0x0, &(0x7f0000000600)=ANY=[]}], 0x1, 0x0) r4 = socket$inet6(0xa, 0x2, 0x0) gettid() r5 = getpgid(0x0) kcmp(0x0, r5, 0x0, 0xffffffffffffffff, 0xffffffffffffffff) connect$inet6(r4, &(0x7f0000002740)={0xa, 0x0, 0x0, @mcast2, 0x4}, 0x1c) sendmmsg(r4, &(0x7f0000007e00), 0x136a88c8311572c, 0x0) setsockopt$inet6_udp_int(r4, 0x11, 0x0, &(0x7f0000000400), 0x4) openat$kvm(0xffffffffffffff9c, &(0x7f00000003c0)='/dev/kvm\x00', 0x0, 0x0) ioctl$VHOST_SET_VRING_CALL(0xffffffffffffff9c, 0x4008af21, &(0x7f00000002c0)={0x0, r3}) ioctl$SNDRV_TIMER_IOCTL_TREAD(r0, 0x40045402, &(0x7f0000000740)) inotify_rm_watch(0xffffffffffffffff, 0x0) ioctl$ifreq_SIOCGIFINDEX_team(0xffffffffffffffff, 0x8933, &(0x7f0000000480)={'team0\x00'}) 04:46:42 executing program 3: r0 = syz_open_dev$sg(&(0x7f00000000c0)='/dev/sg#\x00', 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000000)={0x53, 0x0, 0x6, 0x0, @buffer={0x209, 0xb8, &(0x7f00000001c0)=""/184}, &(0x7f0000000540)="ad40657ed56c", &(0x7f0000000340)=""/128, 0x0, 0x0, 0x9020000, &(0x7f0000000040)}) [ 656.512298] tmpfs: No value for mount option './file0' 04:46:42 executing program 1: r0 = perf_event_open(&(0x7f000025c000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x11, r1, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r0, 0x2405, r1) mmap(&(0x7f0000000000/0xb36000)=nil, 0x18000, 0x1000004, 0x8031, 0xffffffffffffffff, 0x0) 04:46:42 executing program 5: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000480)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_GUEST_DEBUG(r3, 0x4048ae9b, &(0x7f0000000140)={0x1}) syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000100)=[@text32={0x20, &(0x7f0000000000)="6601669b0f35c4e1fe16846ba49e0000b9940200000f32c4c23dad78e0b9670900000f32660f38827f95b0040f01d10fc71a", 0x32}], 0x1, 0x0, &(0x7f0000000040), 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r3, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000400)=[@text32={0x20, &(0x7f0000000880)="b805000000b98b9400000f01c19a01000000b0000f43d1b8000000000f23d80f21f835800000900f23f80f060f2140b9800000c00f3235000800000f3066ba4300b8f1ffffffefb9800000c00f3235002000000f30c4c3295f4da400", 0x5c}], 0x26433e1, 0x0, &(0x7f0000000300), 0x10000000000000b6) ioctl$KVM_RUN(r3, 0xae80, 0x231860) 04:46:42 executing program 3: r0 = syz_open_dev$sg(&(0x7f00000000c0)='/dev/sg#\x00', 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000000)={0x53, 0x0, 0x6, 0x0, @buffer={0x209, 0xb8, &(0x7f00000001c0)=""/184}, &(0x7f0000000540)="ad40657ed56c", &(0x7f0000000340)=""/128, 0x0, 0x0, 0xf0ff7f, &(0x7f0000000040)}) 04:46:42 executing program 0: mkdir(&(0x7f0000000200)='./file0\x00', 0x0) mount(&(0x7f00000002c0)=ANY=[], &(0x7f0000001540)='./file0\x00', &(0x7f0000000280)='tmpfs\x00', 0x0, &(0x7f0000000080)) r0 = open$dir(&(0x7f00000005c0)='./file2\x00', 0x24000, 0x24) mknodat(r0, &(0x7f0000000140)='./file0\x00', 0x0, 0x0) renameat2(r0, &(0x7f0000000080)='./file0\x00', r0, &(0x7f0000000100)='./file1\x00', 0x4) getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffff9c, 0x29, 0x22, &(0x7f00000002c0)={{{@in=@remote, @in=@multicast1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{}, 0x0, @in=@loopback}}, &(0x7f00000000c0)=0xe8) mount$overlay(0x0, &(0x7f0000000000)='./file2\x00', &(0x7f0000000040)='overlay\x00', 0x0, &(0x7f00000003c0)={[{@redirect_dir={'redirect_dir', 0x3d, './file0'}}, {@workdir={'workdir', 0x3d, './file0'}}, {@index_off='index=off'}, {@nfs_export_on='nfs_export=on'}, {@workdir={'workdir', 0x3d, './file0'}}, {@metacopy_off='metacopy=off'}, {@metacopy_on='metacopy=on'}, {@index_off='index=off'}], [{@fowner_eq={'fowner', 0x3d, r1}}]}) fstat(r0, &(0x7f00000004c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) mount$9p_virtio(&(0x7f00000001c0)='nfs_export=on', &(0x7f0000000240)='./file0\x00', &(0x7f0000000480)='9p\x00', 0x2000, &(0x7f0000000540)={'trans=virtio,', {[{@dfltgid={'dfltgid', 0x3d, r2}}, {@fscache='fscache'}, {@cache_mmap='cache=mmap'}, {@cache_none='cache=none'}, {@posixacl='posixacl'}, {@access_user='access=user'}], [{@smackfsroot={'smackfsroot', 0x3d, 'metacopy=off'}}]}}) 04:46:42 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, &(0x7f0000012fc7)}) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, &(0x7f0000000f4d)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000100)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0xfffffffffffffc2b, 0x0, &(0x7f0000000680)}) r2 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000000)='/dev/snapshot\x00', 0x100, 0x0) ioctl$KDENABIO(r2, 0x4b36) 04:46:42 executing program 3: r0 = syz_open_dev$sg(&(0x7f00000000c0)='/dev/sg#\x00', 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000000)={0x53, 0x0, 0x6, 0x0, @buffer={0x209, 0xb8, &(0x7f00000001c0)=""/184}, &(0x7f0000000540)="ad40657ed56c", &(0x7f0000000340)=""/128, 0x0, 0x0, 0xffffffff00000000, &(0x7f0000000040)}) 04:46:42 executing program 2: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0x0, 0x80000008000) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) fsetxattr$security_ima(r0, &(0x7f0000000000)='security.ima\x00', &(0x7f0000000040)=@ng={0x4, 0x4, "9e29"}, 0x4, 0x3) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, &(0x7f0000000f4d)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000100)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0xfffffffffffffc2b, 0x0, &(0x7f0000000680)}) [ 656.701096] tmpfs: No value for mount option './file0' 04:46:43 executing program 1: r0 = perf_event_open(&(0x7f000025c000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x11, r1, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r0, 0x2405, r1) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb3600f, 0x1000004, 0x8031, 0xffffffffffffffff, 0x0) 04:46:43 executing program 0: r0 = syz_open_dev$sg(&(0x7f0000000000)='/dev/sg#\x00', 0x4, 0x200) open_by_handle_at(r0, &(0x7f00000002c0)={0x51, 0x7, "4010976a45fd35c7bebce95aef41607d364e872cd428ae506440e941dc77f0705cb07ee63ce62e2118e16a608a54157040439c739bbb859f1112fd78e79334179abd34a76c758805e9"}, 0x400000) mkdir(&(0x7f0000000200)='./file0\x00', 0x0) mount(&(0x7f00000002c0)=ANY=[], &(0x7f0000001540)='./file0\x00', &(0x7f0000000280)='tmpfs\x00', 0x0, &(0x7f0000000080)) r1 = open$dir(&(0x7f0000000180)='./file0\x00', 0x0, 0x0) r2 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040)='/dev/hwrng\x00', 0x10800, 0x0) setsockopt$ARPT_SO_SET_REPLACE(r2, 0x0, 0x60, &(0x7f0000000340)={'filter\x00', 0x7, 0x4, 0x480, 0x140, 0x140, 0x0, 0x398, 0x398, 0x398, 0x4, &(0x7f00000000c0), {[{{@uncond, 0xf0, 0x140}, @mangle={0x50, 'mangle\x00', 0x0, {@mac=@dev={[], 0x12}, @empty, @multicast2, @empty, 0xf, 0xffffffff}}}, {{@uncond, 0xf0, 0x140}, @mangle={0x50, 'mangle\x00', 0x0, {@mac, @mac=@random="d0fd65a13e3c", @loopback, @rand_addr=0x8, 0x5, 0xffffffff}}}, {{@uncond, 0xf0, 0x118}, @unspec=@STANDARD={0x28, '\x00', 0x0, 0xffffffffffffffff}}], {{[], 0xc0, 0xe8}, {0x28}}}}, 0x4d0) mknodat(r1, &(0x7f0000000140)='./file0\x00', 0x0, 0x0) setsockopt$inet6_mtu(r2, 0x29, 0x17, &(0x7f0000000240)=0x5, 0x4) ioctl$BLKRAGET(r2, 0x1263, &(0x7f00000001c0)) renameat2(r1, &(0x7f0000000080)='./file0\x00', r1, &(0x7f0000000100)='./file1\x00', 0x4) [ 656.836570] binder: 24837:24839 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 04:46:43 executing program 3: r0 = syz_open_dev$sg(&(0x7f00000000c0)='/dev/sg#\x00', 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000000)={0x53, 0x0, 0x6, 0x0, @buffer={0x209, 0xb8, &(0x7f00000001c0)=""/184}, &(0x7f0000000540)="ad40657ed56c", &(0x7f0000000340)=""/128, 0x0, 0x0, 0x2000000, &(0x7f0000000040)}) [ 656.889617] binder: 24837:24839 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 04:46:43 executing program 4: ioctl$KVM_IRQ_LINE(0xffffffffffffffff, 0x4008ae61, &(0x7f0000000500)) r0 = syz_open_dev$dspn(&(0x7f00000004c0)='/dev/dsp#\x00', 0x1, 0x0) openat$audio(0xffffffffffffff9c, &(0x7f0000000000)='/dev/audio\x00', 0x80, 0x0) ioctl$KVM_SET_FPU(0xffffffffffffffff, 0x41a0ae8d, &(0x7f0000000100)={[], 0x0, 0x5531fee, 0x8000, 0x0, 0x9, 0xf000, 0x0, [], 0x5}) syz_open_dev$usb(&(0x7f0000000440)='/dev/bus/usb/00#/00#\x00', 0x9, 0x2) r1 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) lstat(&(0x7f0000000040)='./file0/file0\x00', &(0x7f0000000080)) ioctl$EXT4_IOC_MIGRATE(0xffffffffffffffff, 0x6609) sendmmsg$unix(0xffffffffffffffff, &(0x7f000000a000)=[{&(0x7f000000a000)=@abs, 0x6e, &(0x7f000000d000), 0x0, &(0x7f0000000600)=ANY=[]}], 0x1, 0x0) r2 = socket$inet6(0xa, 0x2, 0x0) gettid() r3 = getpgid(0x0) kcmp(0x0, r3, 0x0, 0xffffffffffffffff, 0xffffffffffffffff) connect$inet6(r2, &(0x7f0000002740)={0xa, 0x0, 0x0, @mcast2, 0x4}, 0x1c) setsockopt$inet6_udp_int(r2, 0x11, 0x0, &(0x7f0000000400), 0x4) openat$kvm(0xffffffffffffff9c, &(0x7f00000003c0)='/dev/kvm\x00', 0x0, 0x0) ioctl$VHOST_SET_VRING_CALL(0xffffffffffffff9c, 0x4008af21, &(0x7f00000002c0)={0x0, r1}) ioctl$SNDRV_TIMER_IOCTL_TREAD(r0, 0x40045402, &(0x7f0000000740)) inotify_rm_watch(0xffffffffffffffff, 0x0) ioctl$ifreq_SIOCGIFINDEX_team(0xffffffffffffffff, 0x8933, &(0x7f0000000480)={'team0\x00'}) 04:46:43 executing program 5: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000480)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_GUEST_DEBUG(r3, 0x4048ae9b, &(0x7f0000000140)={0x1}) syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000100)=[@text32={0x20, &(0x7f0000000000)="6601669b0f35c4e1fe16846ba49e0000b9940200000f32c4c23dad78e0b9670900000f32660f38827f95b0040f01d10fc71a", 0x32}], 0x1, 0x0, &(0x7f0000000040), 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r3, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000400)=[@text32={0x20, &(0x7f0000000880)="b805000000b98b9400000f01c19a01000000b0000f43d1b8000000000f23d80f21f835800000900f23f80f060f2140b9800000c00f3235000800000f3066ba4300b8f1ffffffefb9800000c00f3235002000000f30c4c3295f4da400", 0x5c}], 0x26433e1, 0x0, &(0x7f0000000300), 0x10000000000000b6) ioctl$KVM_RUN(r3, 0xae80, 0x80ffff00000000) 04:46:43 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, &(0x7f0000012fc7)}) close(r0) r2 = dup2(r0, r0) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r2, 0x6, 0x16, &(0x7f0000000040)=[{0x7, 0x8001}], 0x211c) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, &(0x7f0000000f4d)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000100)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0xfffffffffffffc2b, 0x0, &(0x7f0000000680)}) [ 657.060281] tmpfs: No value for mount option './file0' 04:46:43 executing program 3: r0 = syz_open_dev$sg(&(0x7f00000000c0)='/dev/sg#\x00', 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000000)={0x53, 0x0, 0x6, 0x0, @buffer={0x209, 0xb8, &(0x7f00000001c0)=""/184}, &(0x7f0000000540)="ad40657ed56c", &(0x7f0000000340)=""/128, 0x0, 0x0, 0xfeffffff, &(0x7f0000000040)}) 04:46:43 executing program 0: mkdir(&(0x7f0000000200)='./file0\x00', 0x0) mount(&(0x7f00000002c0)=ANY=[], &(0x7f0000001540)='./file0\x00', &(0x7f0000000280)='tmpfs\x00', 0x0, &(0x7f0000000080)) r0 = open$dir(&(0x7f0000000180)='./file0\x00', 0x0, 0x0) mknodat(r0, &(0x7f0000000000)='./file0\x00', 0x80, 0x1ff) renameat2(r0, &(0x7f0000000080)='./file0\x00', r0, &(0x7f0000000100)='./file1\x00', 0x4) 04:46:43 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$midi(&(0x7f0000000000)='/dev/midi#\x00', 0x8, 0x10001) getsockname$packet(r1, &(0x7f0000000040)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000000c0)=0x14) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r2 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f00000001c0)={0xffffffffffffffff, r1, 0x0, 0xd, &(0x7f0000000180)='em0@security\x00'}, 0x30) ioctl$BLKTRACESETUP(r1, 0xc0481273, &(0x7f0000000200)={[], 0x6, 0x8001, 0xff, 0xffffffffffff32f8, 0x1, r3}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, &(0x7f0000012fc7)}) close(r0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f0000000140)=ANY=[@ANYBLOB="0e63abd300000000"], 0x0, 0x0, &(0x7f0000000f4d)}) setsockopt$IP_VS_SO_SET_DEL(r1, 0x0, 0x484, &(0x7f0000000280)={0xef, @broadcast, 0x4e24, 0x2, 'none\x00', 0x8, 0x4, 0xf}, 0x2c) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000100)={0x4, 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB="13000000"], 0xfffffffffffffc2b, 0x0, &(0x7f0000000680)}) 04:46:43 executing program 3: r0 = syz_open_dev$sg(&(0x7f00000000c0)='/dev/sg#\x00', 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000000)={0x53, 0x0, 0x6, 0x0, @buffer={0x209, 0xb8, &(0x7f00000001c0)=""/184}, &(0x7f0000000540)="ad40657ed56c", &(0x7f0000000340)=""/128, 0x0, 0x0, 0x2f, &(0x7f0000000040)}) 04:46:43 executing program 4: ioctl$KVM_IRQ_LINE(0xffffffffffffffff, 0x4008ae61, &(0x7f0000000500)) r0 = syz_open_dev$dspn(&(0x7f00000004c0)='/dev/dsp#\x00', 0x1, 0x0) r1 = openat$audio(0xffffffffffffff9c, &(0x7f0000000000)='/dev/audio\x00', 0x80, 0x0) ioctl$KVM_SET_FPU(0xffffffffffffffff, 0x41a0ae8d, &(0x7f0000000100)={[], 0x0, 0x5531fee, 0x0, 0x0, 0x9, 0xf000, 0x0, [], 0x5}) syz_open_dev$usb(&(0x7f0000000440)='/dev/bus/usb/00#/00#\x00', 0x9, 0x2) r2 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) lstat(&(0x7f0000000040)='./file0/file0\x00', &(0x7f0000000080)) ioctl$EXT4_IOC_MIGRATE(0xffffffffffffffff, 0x6609) sendmmsg$unix(0xffffffffffffffff, &(0x7f000000a000)=[{&(0x7f000000a000)=@abs, 0x6e, &(0x7f000000d000), 0x0, &(0x7f0000000600)=ANY=[]}], 0x1, 0x0) r3 = socket$inet6(0xa, 0x2, 0x0) gettid() ioctl$EVIOCGKEYCODE_V2(r0, 0x80284504, &(0x7f0000000380)=""/27) r4 = getpgid(0x0) connect(r1, &(0x7f0000000300)=@nfc={0x27, 0x0, 0x1, 0x6}, 0x80) kcmp(0x0, r4, 0x0, 0xffffffffffffffff, 0xffffffffffffffff) connect$inet6(r3, &(0x7f0000002740)={0xa, 0x0, 0x0, @mcast2, 0x4}, 0x1c) sendmmsg(r3, &(0x7f0000007e00), 0x136a88c8311572c, 0x0) setsockopt$inet6_udp_int(r3, 0x11, 0x0, &(0x7f0000000400), 0x4) openat$kvm(0xffffffffffffff9c, &(0x7f00000003c0)='/dev/kvm\x00', 0x0, 0x0) ioctl$VHOST_SET_VRING_CALL(0xffffffffffffff9c, 0x4008af21, &(0x7f00000002c0)={0x0, r2}) ioctl$SNDRV_TIMER_IOCTL_TREAD(r0, 0x40045402, &(0x7f0000000740)) inotify_rm_watch(0xffffffffffffffff, 0x0) ioctl$ifreq_SIOCGIFINDEX_team(0xffffffffffffffff, 0x8933, &(0x7f0000000480)={'team0\x00'}) 04:46:43 executing program 5: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000480)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_GUEST_DEBUG(r3, 0x4048ae9b, &(0x7f0000000140)={0x1}) syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000100)=[@text32={0x20, &(0x7f0000000000)="6601669b0f35c4e1fe16846ba49e0000b9940200000f32c4c23dad78e0b9670900000f32660f38827f95b0040f01d10fc71a", 0x32}], 0x1, 0x0, &(0x7f0000000040), 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r3, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000400)=[@text32={0x20, &(0x7f0000000880)="b805000000b98b9400000f01c19a01000000b0000f43d1b8000000000f23d80f21f835800000900f23f80f060f2140b9800000c00f3235000800000f3066ba4300b8f1ffffffefb9800000c00f3235002000000f30c4c3295f4da400", 0x5c}], 0x26433e1, 0x0, &(0x7f0000000300), 0x10000000000000b6) ioctl$KVM_RUN(r3, 0xae80, 0xc000000) [ 657.295897] binder: 24875:24876 unknown command -743742706 [ 657.309567] binder: 24875:24876 ioctl c0306201 20008fd0 returned -22 [ 657.333628] tmpfs: No value for mount option './file0' [ 657.381292] binder: 24875:24876 unknown command 19 [ 657.415082] binder: 24875:24876 ioctl c0306201 20000100 returned -22 [ 657.485297] binder: 24875:24876 unknown command -743742706 [ 657.485417] binder: 24875:24882 unknown command 19 [ 657.502355] binder: 24875:24876 ioctl c0306201 20008fd0 returned -22 [ 657.532465] binder: 24875:24882 ioctl c0306201 20000100 returned -22 04:46:44 executing program 0: r0 = openat$ipvs(0xffffffffffffff9c, &(0x7f00000001c0)='/proc/sys/net/ipv4/vs/ignore_tunneled\x00', 0x2, 0x0) write$P9_RREADLINK(r0, &(0x7f0000000300)={0x10, 0x17, 0x0, {0xffffffffffffff2d, './file1'}}, 0xc) mkdir(&(0x7f0000000240)='./file0\x00', 0x4a) mount(&(0x7f00000002c0)=ANY=[], &(0x7f0000001540)='./file0\x00', &(0x7f0000000280)='tmpfs\x00', 0x0, &(0x7f0000000080)) r1 = socket$vsock_dgram(0x28, 0x2, 0x0) accept4(r1, &(0x7f0000000000)=@xdp, &(0x7f00000000c0)=0x80, 0x80000) r2 = open$dir(&(0x7f0000000180)='./file0\x00', 0x80000000000000, 0xfffffffffffffffa) mknodat(r2, &(0x7f0000000140)='./file0\x00', 0x0, 0x0) mount(&(0x7f00000003c0)=ANY=[@ANYBLOB="2f6465762f6e62f5f5626bca250021b2938336643000"], &(0x7f00000002c0)='./file0\x00', &(0x7f0000000340)='minix\x00', 0x80, &(0x7f0000000380)='/\x00') renameat2(r2, &(0x7f0000000080)='./file0\x00', r2, &(0x7f0000000100)='./file1\x00', 0x4) 04:46:44 executing program 3: r0 = syz_open_dev$sg(&(0x7f00000000c0)='/dev/sg#\x00', 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000000)={0x53, 0x0, 0x6, 0x0, @buffer={0x209, 0xb8, &(0x7f00000001c0)=""/184}, &(0x7f0000000540)="ad40657ed56c", &(0x7f0000000340)=""/128, 0x0, 0x0, 0xfffffffe, &(0x7f0000000040)}) 04:46:44 executing program 1: r0 = perf_event_open(&(0x7f000025c000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x11, r1, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r0, 0x2405, r1) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36003, 0x1000004, 0x8031, 0xffffffffffffffff, 0x0) 04:46:44 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, &(0x7f0000012fc7)}) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, &(0x7f0000000f4d)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000100)={0x4, 0x0, &(0x7f0000000140)=ANY=[@ANYBLOB="e771f53be444c295094975aa7fb9321e2de51f2ea0444fdf17342bc95c6ba286609721667619d84f06420b6e42823f808bc834cd0c415c3af527685c940c9ab1dfb1968f11bf12f2abd5bc61d43f888742f9b85fa5180dc2580e3bc8ef5960c3525d47c041e92af120eba6c83403b067cf9671401fb9c2ae5d210837668a8a3dbd82de227b208b979a9dc3387990afbf25fa11186b5c220e7a9b199091703c82e402000000bf70eeacce3d0591d01c"], 0xfffffffffffffc2b, 0x0, &(0x7f0000000680)}) 04:46:44 executing program 5: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000480)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_GUEST_DEBUG(r3, 0x4048ae9b, &(0x7f0000000140)={0x1}) syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000100)=[@text32={0x20, &(0x7f0000000000)="6601669b0f35c4e1fe16846ba49e0000b9940200000f32c4c23dad78e0b9670900000f32660f38827f95b0040f01d10fc71a", 0x32}], 0x1, 0x0, &(0x7f0000000040), 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r3, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000400)=[@text32={0x20, &(0x7f0000000880)="b805000000b98b9400000f01c19a01000000b0000f43d1b8000000000f23d80f21f835800000900f23f80f060f2140b9800000c00f3235000800000f3066ba4300b8f1ffffffefb9800000c00f3235002000000f30c4c3295f4da400", 0x5c}], 0x26433e1, 0x0, &(0x7f0000000300), 0x10000000000000b6) ioctl$KVM_RUN(r3, 0xae80, 0x300) 04:46:44 executing program 4: ioctl$KVM_IRQ_LINE(0xffffffffffffffff, 0x4008ae61, &(0x7f0000000500)) r0 = syz_open_dev$dspn(&(0x7f00000004c0)='/dev/dsp#\x00', 0x1, 0x0) openat$audio(0xffffffffffffff9c, &(0x7f0000000000)='/dev/audio\x00', 0x80, 0x0) ioctl$KVM_SET_FPU(0xffffffffffffffff, 0x41a0ae8d, &(0x7f0000000100)={[], 0x0, 0x5531fee, 0x0, 0x0, 0x9, 0xf000, 0x0, [], 0x5}) syz_open_dev$usb(&(0x7f0000000440)='/dev/bus/usb/00#/00#\x00', 0x9, 0x2) r1 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) lstat(&(0x7f0000000040)='./file0/file0\x00', &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$EXT4_IOC_MIGRATE(0xffffffffffffffff, 0x6609) sendmmsg$unix(0xffffffffffffffff, &(0x7f000000a000)=[{&(0x7f000000a000)=@abs, 0x6e, &(0x7f000000d000), 0x0, &(0x7f0000000600)=ANY=[]}], 0x1, 0x0) r3 = socket$inet6(0xa, 0x2, 0x0) gettid() r4 = getpgid(0x0) kcmp(0x0, r4, 0x0, 0xffffffffffffffff, 0xffffffffffffffff) connect$inet6(r3, &(0x7f0000002740)={0xa, 0x0, 0x0, @mcast2, 0x4}, 0x1c) sendmmsg(r3, &(0x7f0000007e00), 0x136a88c8311572c, 0x0) setsockopt$inet6_udp_int(r3, 0x11, 0x0, &(0x7f0000000400), 0x4) openat$kvm(0xffffffffffffff9c, &(0x7f00000003c0)='/dev/kvm\x00', 0x0, 0x0) ioctl$VHOST_SET_VRING_CALL(0xffffffffffffff9c, 0x4008af21, &(0x7f00000002c0)={0x0, r1}) ioctl$SNDRV_TIMER_IOCTL_TREAD(r0, 0x40045402, &(0x7f0000000740)) setsockopt$ARPT_SO_SET_REPLACE(r0, 0x0, 0x60, &(0x7f0000000d00)=ANY=[@ANYBLOB="66696c746572000000000000000000000000000000000000000000000000000007000000040000008004000040010000400100008002000098030000980300009803000004000000", @ANYPTR=&(0x7f0000000300)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00'], @ANYBLOB="ac14141de0000002000000ffffffffff000000000000000000000000000000000000000000000000ff00ffff00000000000000000000000000000000000000000000000000000000000000000000000000000000ffff00000000000000000000ffff00023000fffd00201000766c616e3000000000000000000000006c6f000000000000000000000000000000000000000000000000ff000000000000000000000000000000000000000000ff0000000000000000000000000000000000800000000000000000000000f0004001000000000000000000000000000000000000000000000000000050006d616e676c650000000000000000000000000000000000000000000000007b7217d40a5e0000000000000000000000000000000000000000000000000000ffffffffe000000104000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000010000000000012000000000000000000000000000000000000000000ce000000000000000000000000000000000000000000000000f0004001000000000000000000000000000000000000000000000000000050006d616e676c65000000000000000000000000000000000000000000000000721e55f167cd000000000000000000000000000000000000000000000000000000000000ac1414120c0000000000000000000000000000000000000000000000000000000000000000000000000000f9180000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f000180100000000000000000000000000000000000000000000000000002800434c41535349465900000000000000000000000000000000000000000000ba45000000000000000000000000000000000000000000000000000000000000000000000000000000ea5fef3ad556528c35ad690fea3ba1170000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000c000e8000000000000000000000000000000000000000000000000002800000000000000000000000000000000000000000000000000000000000000feffffff00000000f4a13c39dbd8b83e2943052c8d12fe25bf22bee5ce382381e3eae55abee069de404437ac692334eee9374f8ce46c3b4f98bb7d5a9f7bfa9180c2d9120c1408598e135230fd7fb7d7be862224c243b3d124c097966db02add842412774bf98173c8e5ad15807a78d5b0c0ae325a21f094926811df3af9dd52"], 0x4d0) inotify_rm_watch(0xffffffffffffffff, 0x0) ioctl$ifreq_SIOCGIFINDEX_team(0xffffffffffffffff, 0x8933, &(0x7f0000000480)={'team0\x00'}) setgid(r2) [ 657.929084] binder: 24903:24910 unknown command 1005941223 [ 657.946759] binder: 24903:24910 ioctl c0306201 20000100 returned -22 [ 657.961478] tmpfs: No value for mount option './file0' 04:46:44 executing program 3: r0 = syz_open_dev$sg(&(0x7f00000000c0)='/dev/sg#\x00', 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000000)={0x53, 0x0, 0x6, 0x0, @buffer={0x209, 0xb8, &(0x7f00000001c0)=""/184}, &(0x7f0000000540)="ad40657ed56c", &(0x7f0000000340)=""/128, 0x0, 0x0, 0xfcffffff00000000, &(0x7f0000000040)}) [ 657.989805] binder: 24903:24917 unknown command 1005941223 [ 657.995693] binder: 24903:24917 ioctl c0306201 20000100 returned -22 04:46:44 executing program 0: mkdir(&(0x7f0000000200)='./file0\x00', 0x0) mount(&(0x7f00000002c0)=ANY=[], &(0x7f0000001540)='./file0\x00', &(0x7f0000000280)='tmpfs\x00', 0x0, &(0x7f0000000080)) r0 = open$dir(&(0x7f0000000180)='./file0\x00', 0x0, 0x0) mknodat(r0, &(0x7f0000000140)='./file0\x00', 0x20, 0x0) r1 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vcs\x00', 0x10000, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x18, 0xfa00, {0x2, &(0x7f0000000040)={0xffffffffffffffff}, 0x13f, 0xb}}, 0x20) write$RDMA_USER_CM_CMD_QUERY(r1, &(0x7f00000001c0)={0x13, 0x10, 0xfa00, {&(0x7f00000002c0), r2, 0x2}}, 0x18) ioctl$sock_inet_SIOCSIFFLAGS(r1, 0x8914, &(0x7f0000000240)={'bridge_slave_1\x00', 0x1100}) renameat2(r0, &(0x7f0000000080)='./file0\x00', r0, &(0x7f0000000100)='./file1\x00', 0x4) 04:46:44 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = openat$rfkill(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rfkill\x00', 0x10000, 0x0) ioctl$EVIOCSKEYCODE_V2(r2, 0x40284504, &(0x7f0000000040)={0x7ff, 0x11, 0x2, 0xfd3, "22a3ab5d833dec18b6c6262aa96c14bb2d5c897796139ac69283b25731a795cb"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="0063000e155007ed7e469f7c7e83a5a9c5d04dcfe14acab46d1040897a3814fe387b7e29975fa857a925930c3588946867a81391195e1bb5edd3c7577480a689802b3cdbbbba51f1cfbac6c5ce4b7e475aa2654041f13e0fd7c62036e0ab0ae2a507523aa851175bffe5c8d69a529db85348d5bafdd22e32bdd4168f7a1589ca2bcd12d795b755fea91864e760ed4bcf4ff86ab64e1cd6f5e4797b53b007c2f27cb31b3e65202879b211ef253371c11ed1feacacd3d353c2a94ccd936db6c7a75f52d22083e9e759f4a7dc9b87cad1885bb85e0000000000000000000000"], 0x0, 0x0, &(0x7f0000012fc7)}) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, &(0x7f0000000f4d)}) r3 = openat$pfkey(0xffffffffffffff9c, &(0x7f0000000140)='/proc/self/net/pfkey\x00', 0x81, 0x0) ioctl$KVM_SET_NR_MMU_PAGES(r3, 0xae44, 0x2) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000100)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0xfffffffffffffc2b, 0x0, &(0x7f0000000680)}) 04:46:44 executing program 3: r0 = syz_open_dev$sg(&(0x7f00000000c0)='/dev/sg#\x00', 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000000)={0x53, 0x0, 0x6, 0x0, @buffer={0x209, 0xb8, &(0x7f00000001c0)=""/184}, &(0x7f0000000540)="ad40657ed56c", &(0x7f0000000340)=""/128, 0x0, 0x0, 0x2f00000000000000, &(0x7f0000000040)}) 04:46:44 executing program 5: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000480)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_GUEST_DEBUG(r3, 0x4048ae9b, &(0x7f0000000140)={0x1}) syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000100)=[@text32={0x20, &(0x7f0000000000)="6601669b0f35c4e1fe16846ba49e0000b9940200000f32c4c23dad78e0b9670900000f32660f38827f95b0040f01d10fc71a", 0x32}], 0x1, 0x0, &(0x7f0000000040), 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r3, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000400)=[@text32={0x20, &(0x7f0000000880)="b805000000b98b9400000f01c19a01000000b0000f43d1b8000000000f23d80f21f835800000900f23f80f060f2140b9800000c00f3235000800000f3066ba4300b8f1ffffffefb9800000c00f3235002000000f30c4c3295f4da400", 0x5c}], 0x26433e1, 0x0, &(0x7f0000000300), 0x10000000000000b6) ioctl$KVM_RUN(r3, 0xae80, 0xffff8000) [ 658.210955] binder: 24926:24929 unknown command 234906368 [ 658.257774] tmpfs: No value for mount option './file0' [ 658.275143] binder: 24926:24929 ioctl c0306201 20012000 returned -22 04:46:44 executing program 3: r0 = syz_open_dev$sg(&(0x7f00000000c0)='/dev/sg#\x00', 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000000)={0x53, 0x0, 0x6, 0x0, @buffer={0x209, 0xb8, &(0x7f00000001c0)=""/184}, &(0x7f0000000540)="ad40657ed56c", &(0x7f0000000340)=""/128, 0x0, 0x0, 0xa0008000, &(0x7f0000000040)}) [ 658.302925] binder: 24926:24937 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 04:46:44 executing program 0: mkdir(&(0x7f0000000200)='./file0\x00', 0x0) mount(&(0x7f0000000000)=ANY=[], &(0x7f0000001540)='./file0\x00', &(0x7f0000000280)='tmpfs\x00', 0x0, &(0x7f0000000080)) r0 = open$dir(&(0x7f0000000180)='./file0\x00', 0x0, 0x0) mknodat(r0, &(0x7f0000000140)='./file0\x00', 0x0, 0x0) renameat2(r0, &(0x7f0000000080)='./file0\x00', r0, &(0x7f0000000100)='./file1\x00', 0x4) [ 658.564773] tmpfs: No value for mount option './file0' 04:46:44 executing program 1: r0 = perf_event_open(&(0x7f000025c000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x11, r1, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r0, 0x2405, r1) mmap(&(0x7f0000000000/0xb36000)=nil, 0x2f000, 0x1000004, 0x8031, 0xffffffffffffffff, 0x0) 04:46:44 executing program 3: r0 = syz_open_dev$sg(&(0x7f00000000c0)='/dev/sg#\x00', 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000000)={0x53, 0x0, 0x6, 0x0, @buffer={0x209, 0xb8, &(0x7f00000001c0)=""/184}, &(0x7f0000000540)="ad40657ed56c", &(0x7f0000000340)=""/128, 0x0, 0x0, 0xf6ffffff, &(0x7f0000000040)}) 04:46:44 executing program 4: ioctl$KVM_IRQ_LINE(0xffffffffffffffff, 0x4008ae61, &(0x7f0000000500)) r0 = syz_open_dev$dspn(&(0x7f00000004c0)='/dev/dsp#\x00', 0x1, 0x0) openat$audio(0xffffffffffffff9c, &(0x7f0000000000)='/dev/audio\x00', 0x80, 0x0) ioctl$KVM_SET_FPU(0xffffffffffffffff, 0x41a0ae8d, &(0x7f0000000100)={[], 0x0, 0x5531fee, 0x0, 0x0, 0x9, 0xf000, 0x0, [], 0x5}) syz_open_dev$usb(&(0x7f0000000440)='/dev/bus/usb/00#/00#\x00', 0x9, 0x2) r1 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) lstat(&(0x7f0000000040)='./file0/file0\x00', &(0x7f0000000080)) ioctl$EXT4_IOC_MIGRATE(0xffffffffffffffff, 0x6609) sendmmsg$unix(0xffffffffffffffff, &(0x7f000000a000)=[{&(0x7f000000a000)=@abs, 0x6e, &(0x7f000000d000), 0x0, &(0x7f0000000600)=ANY=[]}], 0x1, 0x0) r2 = socket$inet6(0xa, 0x2, 0x0) r3 = gettid() r4 = getpgid(r3) kcmp(0x0, r4, 0x0, 0xffffffffffffffff, 0xffffffffffffffff) connect$inet6(r2, &(0x7f0000002740)={0xa, 0x0, 0x0, @mcast2, 0x4}, 0x1c) sendmmsg(r2, &(0x7f0000007e00), 0x136a88c8311572c, 0x0) write$FUSE_NOTIFY_INVAL_ENTRY(r0, &(0x7f0000000300)={0x2a, 0x3, 0x0, {0x4, 0x9, 0x0, 'em0system'}}, 0x2a) setsockopt$inet6_udp_int(r2, 0x11, 0x0, &(0x7f0000000400), 0x4) openat$kvm(0xffffffffffffff9c, &(0x7f00000003c0)='/dev/kvm\x00', 0x0, 0x0) ioctl$VHOST_SET_VRING_CALL(0xffffffffffffff9c, 0x4008af21, &(0x7f00000002c0)={0x0, r1}) ioctl$SNDRV_TIMER_IOCTL_TREAD(r0, 0x40045402, &(0x7f0000000740)) inotify_rm_watch(0xffffffffffffffff, 0x0) ioctl$ifreq_SIOCGIFINDEX_team(0xffffffffffffffff, 0x8933, &(0x7f0000000480)={'team0\x00'}) 04:46:44 executing program 0: mkdir(&(0x7f0000000200)='./file1\x00', 0x1f) mount(&(0x7f00000002c0)=ANY=[@ANYRES64, @ANYBLOB="dc32c868ebc3ca51e4a0e904747ed4a55813b59ac5f8edcfbf9a7e76333db5e07cbc22428b77c3ae153bb30548f5662b6460c61ca11fabdc4129f7187f4e97f633896971a1add7ea569cd1477255c1b83fadbe501674263b6474570822d2cae97390f75e781d452bab10463bb48fdbf64b096add3d4187e52846f58fc617077b48478578ab7949d1881dd0ee90237a14d670d3911deb0f5afd02c6d8d85741dcb5d639e469fa82ff40e2389288948c3d90625f74282bd26022b53d8ad1db9057548e79e8d6d623ee3e3274136d35a757d09fc1f50399e525996015ed285b7f01f8d1551566eeca28033dd7d28c5f156d66bf9bd9fb09923f08313117ecf83a328fc3176a9bb8abc5a309d26a08fafbf1fd8febc64a5a147541c5149d28df38106b44731f69e5eb445e620bf60dab7eab5970515c3a2216265ff2bf7b0658155e5620e8ecd64040f44247f7815e68b4f08642364aaa96b9be6453ac9edf4c", @ANYRES32], &(0x7f0000001540)='./file0\x00', &(0x7f0000000280)='tmpfs\x00', 0x0, &(0x7f0000000080)) r0 = open$dir(&(0x7f0000000180)='./file0\x00', 0x0, 0x0) mknodat(r0, &(0x7f0000000140)='./file0\x00', 0x0, 0x0) renameat2(r0, &(0x7f0000000080)='./file0\x00', r0, &(0x7f0000000100)='./file1\x00', 0x4) 04:46:44 executing program 5: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000480)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_GUEST_DEBUG(r3, 0x4048ae9b, &(0x7f0000000140)={0x1}) syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000100)=[@text32={0x20, &(0x7f0000000000)="6601669b0f35c4e1fe16846ba49e0000b9940200000f32c4c23dad78e0b9670900000f32660f38827f95b0040f01d10fc71a", 0x32}], 0x1, 0x0, &(0x7f0000000040), 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r3, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000400)=[@text32={0x20, &(0x7f0000000880)="b805000000b98b9400000f01c19a01000000b0000f43d1b8000000000f23d80f21f835800000900f23f80f060f2140b9800000c00f3235000800000f3066ba4300b8f1ffffffefb9800000c00f3235002000000f30c4c3295f4da400", 0x5c}], 0x26433e1, 0x0, &(0x7f0000000300), 0x10000000000000b6) ioctl$KVM_RUN(r3, 0xae80, 0x6018230000000000) 04:46:45 executing program 3: r0 = syz_open_dev$sg(&(0x7f00000000c0)='/dev/sg#\x00', 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000000)={0x53, 0x0, 0x6, 0x0, @buffer={0x209, 0xb8, &(0x7f00000001c0)=""/184}, &(0x7f0000000540)="ad40657ed56c", &(0x7f0000000340)=""/128, 0x0, 0x0, 0x600, &(0x7f0000000040)}) 04:46:45 executing program 0: r0 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000000)='io.stat\x00', 0x0, 0x0) ioctl$BLKROSET(r0, 0x125d, &(0x7f0000000040)=0x5) mkdir(&(0x7f0000000200)='./file0\x00', 0x0) mount(&(0x7f00000002c0)=ANY=[], &(0x7f0000001540)='./file0\x00', &(0x7f0000000280)='tmpfs\x00', 0x0, &(0x7f0000000080)) r1 = open$dir(&(0x7f0000000180)='./file0\x00', 0x0, 0x0) mknodat(r1, &(0x7f0000000140)='./file0\x00', 0x0, 0x0) setxattr$security_capability(&(0x7f00000000c0)='./file0\x00', &(0x7f00000001c0)='security.capability\x00', &(0x7f0000000240)=@v1={0x1000000, [{0x74, 0x400}]}, 0xc, 0x2) renameat2(r1, &(0x7f0000000080)='./file0\x00', r1, &(0x7f0000000100)='./file1\x00', 0x4) [ 658.994964] binder: 24926:24933 unknown command 234906368 [ 659.010991] binder: 24926:24933 ioctl c0306201 20012000 returned -22 [ 659.051816] binder: 24926:24933 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 659.118646] tmpfs: No value for mount option './file0' 04:46:45 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) lsetxattr$trusted_overlay_redirect(&(0x7f0000000000)='./file0\x00', &(0x7f0000000040)='trusted.overlay.redirect\x00', &(0x7f00000000c0)='./file0\x00', 0x8, 0x1) r1 = dup2(r0, r0) ioctl$KVM_HAS_DEVICE_ATTR(r1, 0x4018aee3, &(0x7f0000000280)={0x0, 0x1, 0x7, &(0x7f0000000240)=0x3ff}) r2 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000012000)={0x7, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, &(0x7f0000012fc7)}) close(r0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f0000000140)=ANY=[@ANYBLOB="0e630c4086dcbc50d89e4f765e20b0bf37818bd72eb3c5b6664b6b7cff09300803e690223aed05a8f2c3cbb65bc98d1619d2fc7863ea8b6d6e3b1f46e9ad51510000000000000000007764b99e110c2486727daec41757b85436d6b94d0e29ac3f2af73847c815d0204487b4b82ac112245b5e1ee3d6d7d41a268cbdfbfedb54dcb6e8d7533ffaef9559fc7a971819a2edb3f226f496d65478fb7dfa65a07c98ab40476c43c1ff90e6525e2873ff882fd82a6e4fa6b8b738cada55f50d81cb22952d6c9b2a0d458619a76a1be8f439697c59a2163c40b53b192005b99ef0711181"], 0x0, 0x0, &(0x7f0000000f4d)}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000100)={0xfffffffffffffd60, 0x0, &(0x7f0000000080)=[@enter_looper], 0xfffffffffffffc2b, 0x0, &(0x7f0000000680)}) 04:46:45 executing program 3: r0 = syz_open_dev$sg(&(0x7f00000000c0)='/dev/sg#\x00', 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000000)={0x53, 0x0, 0x6, 0x0, @buffer={0x209, 0xb8, &(0x7f00000001c0)=""/184}, &(0x7f0000000540)="ad40657ed56c", &(0x7f0000000340)=""/128, 0x0, 0x0, 0xfffffff6, &(0x7f0000000040)}) 04:46:45 executing program 0: mkdir(&(0x7f0000000200)='./file0\x00', 0x0) mount(&(0x7f00000002c0)=ANY=[], &(0x7f0000001540)='./file0\x00', &(0x7f0000000280)='tmpfs\x00', 0x0, &(0x7f0000000080)) r0 = open$dir(&(0x7f00000000c0)='./file0\x00', 0x2, 0x150) mknodat(r0, &(0x7f0000000140)='./file0\x00', 0x7a30b804ba910a4f, 0xff) unlink(&(0x7f0000000000)='./file0\x00') renameat2(r0, &(0x7f0000000080)='./file0\x00', r0, &(0x7f0000000100)='./file1\x00', 0x4) 04:46:45 executing program 5: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000480)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_GUEST_DEBUG(r3, 0x4048ae9b, &(0x7f0000000140)={0x1}) syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000100)=[@text32={0x20, &(0x7f0000000000)="6601669b0f35c4e1fe16846ba49e0000b9940200000f32c4c23dad78e0b9670900000f32660f38827f95b0040f01d10fc71a", 0x32}], 0x1, 0x0, &(0x7f0000000040), 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r3, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000400)=[@text32={0x20, &(0x7f0000000880)="b805000000b98b9400000f01c19a01000000b0000f43d1b8000000000f23d80f21f835800000900f23f80f060f2140b9800000c00f3235000800000f3066ba4300b8f1ffffffefb9800000c00f3235002000000f30c4c3295f4da400", 0x5c}], 0x26433e1, 0x0, &(0x7f0000000300), 0x10000000000000b6) ioctl$KVM_RUN(r3, 0xae80, 0x8) 04:46:45 executing program 1: r0 = perf_event_open(&(0x7f000025c000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x11, r1, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r0, 0x2405, r1) mmap(&(0x7f0000000000/0xb36000)=nil, 0x9000, 0x1000004, 0x8031, 0xffffffffffffffff, 0x0) [ 659.341493] tmpfs: No value for mount option './file0' [ 659.353826] binder: 24995:24997 ioctl 4018aee3 20000280 returned -22 04:46:45 executing program 3: r0 = syz_open_dev$sg(&(0x7f00000000c0)='/dev/sg#\x00', 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000000)={0x53, 0x0, 0x6, 0x0, @buffer={0x209, 0xb8, &(0x7f00000001c0)=""/184}, &(0x7f0000000540)="ad40657ed56c", &(0x7f0000000340)=""/128, 0x0, 0x0, 0xfffffffc, &(0x7f0000000040)}) 04:46:45 executing program 4: ioctl$KVM_IRQ_LINE(0xffffffffffffffff, 0x4008ae61, &(0x7f0000000500)) r0 = syz_open_dev$dspn(&(0x7f00000004c0)='/dev/dsp#\x00', 0x1, 0x0) r1 = openat$audio(0xffffffffffffff9c, &(0x7f0000000000)='/dev/audio\x00', 0x80, 0x0) ioctl$KVM_SET_FPU(0xffffffffffffffff, 0x41a0ae8d, &(0x7f0000000100)={[], 0x0, 0x5531fee, 0x0, 0x0, 0x9, 0xf000, 0x0, [], 0x5}) syz_open_dev$usb(&(0x7f0000000440)='/dev/bus/usb/00#/00#\x00', 0x9, 0x2) r2 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) lstat(&(0x7f0000000040)='./file0/file0\x00', &(0x7f0000000080)) ioctl$EXT4_IOC_MIGRATE(0xffffffffffffffff, 0x6609) sendmmsg$unix(0xffffffffffffffff, &(0x7f000000a000)=[{&(0x7f000000a000)=@abs, 0x6e, &(0x7f000000d000), 0x0, &(0x7f0000000600)=ANY=[]}], 0x1, 0x0) r3 = socket$inet6(0xa, 0x2, 0x0) gettid() r4 = getpgid(0x0) ioctl$VHOST_SET_VRING_ERR(r1, 0x4008af22, &(0x7f0000000300)={0x3, r1}) kcmp(0x0, r4, 0x0, 0xffffffffffffffff, 0xffffffffffffffff) connect$inet6(r3, &(0x7f0000002740)={0xa, 0x0, 0x0, @mcast2, 0x4}, 0x1c) sendmmsg(r3, &(0x7f0000007e00), 0x136a88c8311572c, 0x0) setsockopt$inet6_udp_int(r3, 0x11, 0x0, &(0x7f0000000400), 0x4) openat$kvm(0xffffffffffffff9c, &(0x7f00000003c0)='/dev/kvm\x00', 0x0, 0x0) ioctl$VHOST_SET_VRING_CALL(0xffffffffffffff9c, 0x4008af21, &(0x7f00000002c0)={0x0, r2}) ioctl$SNDRV_TIMER_IOCTL_TREAD(r0, 0x40045402, &(0x7f0000000740)) inotify_rm_watch(0xffffffffffffffff, 0x0) ioctl$ifreq_SIOCGIFINDEX_team(0xffffffffffffffff, 0x8933, &(0x7f0000000480)={'team0\x00'}) [ 659.400969] binder: 24995:24997 BC_REQUEST_DEATH_NOTIFICATION invalid ref 1354554502 04:46:45 executing program 0: mkdir(&(0x7f0000000200)='./file0\x00', 0x0) mount(&(0x7f00000002c0)=ANY=[], &(0x7f0000001540)='./file0\x00', &(0x7f0000000280)='tmpfs\x00', 0x0, &(0x7f0000000080)) r0 = open$dir(&(0x7f0000000180)='./file0\x00', 0x0, 0x0) mknodat(r0, &(0x7f0000000140)='./file0\x00', 0x0, 0x0) renameat2(r0, &(0x7f0000000080)='./file0\x00', r0, &(0x7f0000000100)='./file1\x00', 0x4) r1 = getpgid(0x0) ptrace(0x11, r1) 04:46:45 executing program 5: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000480)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_GUEST_DEBUG(r3, 0x4048ae9b, &(0x7f0000000140)={0x1}) syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000100)=[@text32={0x20, &(0x7f0000000000)="6601669b0f35c4e1fe16846ba49e0000b9940200000f32c4c23dad78e0b9670900000f32660f38827f95b0040f01d10fc71a", 0x32}], 0x1, 0x0, &(0x7f0000000040), 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r3, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000400)=[@text32={0x20, &(0x7f0000000880)="b805000000b98b9400000f01c19a01000000b0000f43d1b8000000000f23d80f21f835800000900f23f80f060f2140b9800000c00f3235000800000f3066ba4300b8f1ffffffefb9800000c00f3235002000000f30c4c3295f4da400", 0x5c}], 0x26433e1, 0x0, &(0x7f0000000300), 0x10000000000000b6) ioctl$KVM_RUN(r3, 0xae80, 0xfec00) 04:46:45 executing program 1: r0 = perf_event_open(&(0x7f000025c000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x11, r1, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r0, 0x2405, r1) mmap(&(0x7f0000000000/0xb36000)=nil, 0x1d000, 0x1000004, 0x8031, 0xffffffffffffffff, 0x0) [ 659.597238] tmpfs: No value for mount option './file0' 04:46:45 executing program 3: r0 = syz_open_dev$sg(&(0x7f00000000c0)='/dev/sg#\x00', 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000000)={0x53, 0x0, 0x6, 0x0, @buffer={0x209, 0xb8, &(0x7f00000001c0)=""/184}, &(0x7f0000000540)="ad40657ed56c", &(0x7f0000000340)=""/128, 0x0, 0x0, 0xad40657ed56c0000, &(0x7f0000000040)}) 04:46:45 executing program 1: r0 = perf_event_open(&(0x7f000025c000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x11, r1, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r0, 0x2405, r1) mmap(&(0x7f0000000000/0xb36000)=nil, 0x30000, 0x1000004, 0x8031, 0xffffffffffffffff, 0x0) 04:46:46 executing program 0: socket$inet_dccp(0x2, 0x6, 0x0) socketpair(0x1b, 0x2, 0x100, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) getsockopt$inet_sctp6_SCTP_MAXSEG(0xffffffffffffff9c, 0x84, 0xd, &(0x7f0000000240)=@assoc_value={0x0, 0x8001}, &(0x7f00000002c0)=0x8) lsetxattr$security_smack_transmute(&(0x7f0000000000)='./file1\x00', &(0x7f0000000140)='security.SMACK64TRANSMUTE\x00', &(0x7f0000000340)='TRUE', 0x4, 0x1) setsockopt$inet_sctp_SCTP_PR_SUPPORTED(r0, 0x84, 0x71, &(0x7f0000000300)={r2, 0x7}, 0x8) mkdir(&(0x7f0000000200)='./file0\x00', 0x0) mount(&(0x7f00000002c0)=ANY=[], &(0x7f0000001540)='./file0\x00', &(0x7f0000000280)='tmpfs\x00', 0x0, &(0x7f0000000080)) getsockopt$inet6_mreq(0xffffffffffffffff, 0x29, 0x14, &(0x7f0000000040)={@mcast1}, &(0x7f00000000c0)=0x14) r3 = open$dir(&(0x7f0000000180)='./file0\x00', 0x0, 0x0) mknodat(r1, &(0x7f0000000380)='./file1\x00', 0xfffffffffffffffd, 0x0) renameat2(r3, &(0x7f0000000080)='./file0\x00', r3, &(0x7f0000000100)='./file1\x00', 0x4) 04:46:46 executing program 5: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000480)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_GUEST_DEBUG(r3, 0x4048ae9b, &(0x7f0000000140)={0x1}) syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000100)=[@text32={0x20, &(0x7f0000000000)="6601669b0f35c4e1fe16846ba49e0000b9940200000f32c4c23dad78e0b9670900000f32660f38827f95b0040f01d10fc71a", 0x32}], 0x1, 0x0, &(0x7f0000000040), 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r3, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000400)=[@text32={0x20, &(0x7f0000000880)="b805000000b98b9400000f01c19a01000000b0000f43d1b8000000000f23d80f21f835800000900f23f80f060f2140b9800000c00f3235000800000f3066ba4300b8f1ffffffefb9800000c00f3235002000000f30c4c3295f4da400", 0x5c}], 0x26433e1, 0x0, &(0x7f0000000300), 0x10000000000000b6) ioctl$KVM_RUN(r3, 0xae80, 0x10000000000000) 04:46:46 executing program 3: r0 = syz_open_dev$sg(&(0x7f00000000c0)='/dev/sg#\x00', 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000000)={0x53, 0x0, 0x6, 0x0, @buffer={0x209, 0xb8, &(0x7f00000001c0)=""/184}, &(0x7f0000000540)="ad40657ed56c", &(0x7f0000000340)=""/128, 0x0, 0x0, 0x200000000000000, &(0x7f0000000040)}) 04:46:46 executing program 1: r0 = perf_event_open(&(0x7f000025c000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x11, r1, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r0, 0x2405, r1) mmap(&(0x7f0000000000/0xb36000)=nil, 0x28000, 0x1000004, 0x8031, 0xffffffffffffffff, 0x0) 04:46:46 executing program 2: r0 = add_key$user(&(0x7f0000000000)='user\x00', &(0x7f0000000040)={'syz', 0x3}, &(0x7f0000000140)="e771d1f4a5eb05f80b431e3d4900422ccf9f93d11e7e22815501a8b087ed801c35471e8f360700ef92965d31144dccad757ae3bca0aab5792a764f46b00ed988170a1113107f106e8645c3e62c7a836a47259daf443bd8e8c8cab498e64efa5c1d61283a7be39759201aefb2a36e3e4a97c959c9a65efe4b1613de7f5f8f4cf514fb7cdf6609028fc31090d0d4f1462a2b72f59e2027a34a235148396dbe2e1fb0cd21367d37ee093f1b59ec88b5c0be1156aaa708e40796c23380ada6f144fa1b16", 0xc2, 0xfffffffffffffff8) r1 = add_key(&(0x7f0000000280)='rxrpc\x00', &(0x7f00000002c0)={'syz', 0x2}, &(0x7f0000000300)="afc6100bda652f2ceed01b13b78a1c808fbd34f86f02524b1cac95a9fd30da56a4f934f6ee1865e8240659c8d7afe910098abb602d97fb0c57e39730093d18c234acd0f98588b47c4136ffa897b7aea05c6f5aa99a7453a4dbe6c25e3861c68064da1d04cc6d3394", 0x68, 0xfffffffffffffff8) keyctl$search(0xa, r0, &(0x7f00000000c0)='.request_key_auth\x00', &(0x7f0000000240)={'syz', 0x1}, r1) r2 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) r3 = syz_open_dev$binder(&(0x7f0000000380)='/dev/binder#\x00', 0x0, 0x3) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000005fd4)=ANY=[@ANYBLOB="05630440000000f0"], 0x0, 0x0, &(0x7f0000012fc7)}) close(r2) ioctl$sock_kcm_SIOCKCMCLONE(0xffffffffffffff9c, 0x89e2, &(0x7f0000000480)={0xffffffffffffffff}) setsockopt$inet_sctp_SCTP_SOCKOPT_CONNECTX_OLD(r4, 0x84, 0x6b, &(0x7f00000004c0)=[@in={0x2, 0x4e23}], 0x10) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000008fd0)={0x31d, 0x0, &(0x7f0000000680), 0xffffff82, 0x0, &(0x7f0000000440)}) add_key$user(&(0x7f00000003c0)='user\x00', &(0x7f0000000400)={'syz', 0x0}, &(0x7f0000000440), 0x0, r1) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000100)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0xfffffffffffffc2b, 0x0, &(0x7f0000000680)}) 04:46:46 executing program 4: ioctl$KVM_IRQ_LINE(0xffffffffffffffff, 0x4008ae61, &(0x7f0000000500)) r0 = syz_open_dev$dspn(&(0x7f00000004c0)='/dev/dsp#\x00', 0x1, 0x0) r1 = openat$audio(0xffffffffffffff9c, &(0x7f0000000000)='/dev/audio\x00', 0x80, 0x0) ioctl$KVM_SET_FPU(0xffffffffffffffff, 0x41a0ae8d, &(0x7f0000000100)={[], 0x0, 0x5531fee, 0x3ff, 0x0, 0x9, 0xf000, 0xfffffffffffffffc, [], 0x5}) r2 = syz_open_dev$usb(&(0x7f0000000440)='/dev/bus/usb/00#/00#\x00', 0x9, 0x2) r3 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) lstat(&(0x7f0000000040)='./file0/file0\x00', &(0x7f0000000080)) ioctl$EXT4_IOC_MIGRATE(0xffffffffffffffff, 0x6609) sendmmsg$unix(0xffffffffffffffff, &(0x7f000000a000)=[{&(0x7f000000a000)=@abs, 0x6e, &(0x7f000000d000), 0x0, &(0x7f0000000600)=ANY=[]}], 0x1, 0x0) ioctl$KVM_GET_CPUID2(r1, 0xc008ae91, &(0x7f0000000540)=ANY=[@ANYBLOB="070000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002994809f000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffffffffffed0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000"]) ioctl$SNDRV_CTL_IOCTL_HWDEP_INFO(r2, 0x80dc5521, &(0x7f0000000300)=""/72) r4 = socket$inet6(0xa, 0x2, 0x0) gettid() r5 = getpgid(0x0) ioctl$KVM_SET_MP_STATE(r2, 0x4004ae99, &(0x7f0000000380)=0x7) kcmp(0x0, r5, 0x0, 0xffffffffffffffff, 0xffffffffffffffff) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) connect$inet6(r4, &(0x7f0000002740)={0xa, 0x0, 0x0, @mcast2, 0x4}, 0x1c) sendmmsg(r4, &(0x7f0000007e00), 0x136a88c8311572c, 0x0) setsockopt$inet6_udp_int(r4, 0x11, 0x0, &(0x7f0000000400), 0x4) openat$kvm(0xffffffffffffff9c, &(0x7f00000003c0)='/dev/kvm\x00', 0x0, 0x0) ioctl$VHOST_SET_VRING_CALL(0xffffffffffffff9c, 0x4008af21, &(0x7f00000002c0)={0x0, r3}) ioctl$SNDRV_TIMER_IOCTL_TREAD(r0, 0x40045402, &(0x7f0000000740)) inotify_rm_watch(0xffffffffffffffff, 0x0) ioctl$ifreq_SIOCGIFINDEX_team(0xffffffffffffffff, 0x8933, &(0x7f0000000480)={'team0\x00'}) [ 660.131435] binder: 24995:25042 ioctl 4018aee3 20000280 returned -22 [ 660.138172] binder: 24995:25042 tried to acquire reference to desc 0, got 1 instead [ 660.146213] binder: 24995:25042 BC_REQUEST_DEATH_NOTIFICATION invalid ref 1354554502 04:46:46 executing program 3: r0 = syz_open_dev$sg(&(0x7f00000000c0)='/dev/sg#\x00', 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000000)={0x53, 0x0, 0x6, 0x0, @buffer={0x209, 0xb8, &(0x7f00000001c0)=""/184}, &(0x7f0000000540)="ad40657ed56c", &(0x7f0000000340)=""/128, 0x0, 0x0, 0x4, &(0x7f0000000040)}) [ 660.272489] tmpfs: No value for mount option './file0' [ 660.309817] binder: 25060:25061 Acquire 1 refcount change on invalid ref -268435456 ret -22 [ 660.354861] binder: 25060:25061 unknown command 0 04:46:46 executing program 1: r0 = perf_event_open(&(0x7f000025c000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x11, r1, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r0, 0x2405, r1) mmap(&(0x7f0000000000/0xb36000)=nil, 0x3000, 0x1000004, 0x8031, 0xffffffffffffffff, 0x0) 04:46:46 executing program 0: mkdir(&(0x7f0000000200)='./file0\x00', 0x0) mount(&(0x7f00000002c0)=ANY=[], &(0x7f0000001540)='./file0\x00', &(0x7f0000000280)='tmpfs\x00', 0x0, &(0x7f0000000080)) r0 = dup(0xffffffffffffffff) ioctl$VHOST_GET_FEATURES(r0, 0x8008af00, &(0x7f0000000000)) r1 = open$dir(&(0x7f0000000180)='./file0\x00', 0x0, 0x0) mknodat(r1, &(0x7f0000000140)='./file0\x00', 0x0, 0x0) renameat2(r1, &(0x7f0000000080)='./file0\x00', r1, &(0x7f0000000100)='./file1\x00', 0x4) [ 660.394331] binder: 25060:25061 ioctl c0306201 20008fd0 returned -22 04:46:46 executing program 3: r0 = syz_open_dev$sg(&(0x7f00000000c0)='/dev/sg#\x00', 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000000)={0x53, 0x0, 0x6, 0x0, @buffer={0x209, 0xb8, &(0x7f00000001c0)=""/184}, &(0x7f0000000540)="ad40657ed56c", &(0x7f0000000340)=""/128, 0x0, 0x0, 0xffffffffa0008000, &(0x7f0000000040)}) 04:46:46 executing program 5: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000480)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_GUEST_DEBUG(r3, 0x4048ae9b, &(0x7f0000000140)={0x1}) syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000100)=[@text32={0x20, &(0x7f0000000000)="6601669b0f35c4e1fe16846ba49e0000b9940200000f32c4c23dad78e0b9670900000f32660f38827f95b0040f01d10fc71a", 0x32}], 0x1, 0x0, &(0x7f0000000040), 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r3, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000400)=[@text32={0x20, &(0x7f0000000880)="b805000000b98b9400000f01c19a01000000b0000f43d1b8000000000f23d80f21f835800000900f23f80f060f2140b9800000c00f3235000800000f3066ba4300b8f1ffffffefb9800000c00f3235002000000f30c4c3295f4da400", 0x5c}], 0x26433e1, 0x0, &(0x7f0000000300), 0x10000000000000b6) ioctl$KVM_RUN(r3, 0xae80, 0x1100000000000000) 04:46:46 executing program 3: r0 = syz_open_dev$sg(&(0x7f00000000c0)='/dev/sg#\x00', 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000000)={0x53, 0x0, 0x6, 0x0, @buffer={0x209, 0xb8, &(0x7f00000001c0)=""/184}, &(0x7f0000000540)="ad40657ed56c", &(0x7f0000000340)=""/128, 0x0, 0x0, 0xf0ff7f00000000, &(0x7f0000000040)}) 04:46:46 executing program 1: r0 = perf_event_open(&(0x7f000025c000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x11, r1, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r0, 0x2405, r1) mmap(&(0x7f0000000000/0xb36000)=nil, 0x6000, 0x1000004, 0x8031, 0xffffffffffffffff, 0x0) [ 660.632350] tmpfs: No value for mount option './file0' 04:46:46 executing program 3: r0 = syz_open_dev$sg(&(0x7f00000000c0)='/dev/sg#\x00', 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000000)={0x53, 0x0, 0x6, 0x0, @buffer={0x209, 0xb8, &(0x7f00000001c0)=""/184}, &(0x7f0000000540)="ad40657ed56c", &(0x7f0000000340)=""/128, 0x0, 0x0, 0xf0ffffff7f0000, &(0x7f0000000040)}) 04:46:46 executing program 0: mkdir(&(0x7f0000000200)='./file0\x00', 0x1) mount(&(0x7f00000002c0)=ANY=[], &(0x7f0000001540)='./file0\x00', &(0x7f0000000280)='tmpfs\x00', 0x0, &(0x7f0000000080)) r0 = open$dir(&(0x7f0000000180)='./file0\x00', 0x0, 0x0) mknodat(r0, &(0x7f0000000140)='./file0\x00', 0x0, 0x0) renameat2(r0, &(0x7f0000000080)='./file0\x00', r0, &(0x7f0000000100)='./file1\x00', 0x4) 04:46:47 executing program 5: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000480)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_GUEST_DEBUG(r3, 0x4048ae9b, &(0x7f0000000140)={0x1}) syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000100)=[@text32={0x20, &(0x7f0000000000)="6601669b0f35c4e1fe16846ba49e0000b9940200000f32c4c23dad78e0b9670900000f32660f38827f95b0040f01d10fc71a", 0x32}], 0x1, 0x0, &(0x7f0000000040), 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r3, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000400)=[@text32={0x20, &(0x7f0000000880)="b805000000b98b9400000f01c19a01000000b0000f43d1b8000000000f23d80f21f835800000900f23f80f060f2140b9800000c00f3235000800000f3066ba4300b8f1ffffffefb9800000c00f3235002000000f30c4c3295f4da400", 0x5c}], 0x26433e1, 0x0, &(0x7f0000000300), 0x10000000000000b6) ioctl$KVM_RUN(r3, 0xae80, 0x4000000000000000) [ 660.889036] tmpfs: No value for mount option './file0' 04:46:47 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000080)='/dev/dsp\x00', 0x0, 0x0) setsockopt$IP_VS_SO_SET_TIMEOUT(r2, 0x0, 0x48a, &(0x7f00000000c0)={0xab, 0x5, 0x3f}, 0xc) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, &(0x7f0000012fc7)}) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, &(0x7f0000000f4d)}) ioctl$FICLONERANGE(r0, 0x4020940d, &(0x7f0000000000)={r1, 0x0, 0x1, 0xfffffffffffff001, 0x401}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000100)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="fcc7f334143dd9fbd67380bf88000000cce909b5f575060000006ba652df2d00"], 0xfffffffffffffc2b, 0x0, &(0x7f0000000680)}) ioctl$FS_IOC_SETFSLABEL(r1, 0x41009432, &(0x7f0000000140)="3eb03d8d73136cbb72bae91ed7c1083e2e8e8faa81ef0d2bd59be8aecbc6d1c3309ad426fd6893de88744f582d7b7ac275ad005baefee26f7df04fa4ac41d7122b40d899471432965b9f41359e8f2f596706ec852e8cc2eac255ad41f32b91bc718d85ef046d69645cb430e00b23fb8bac4895b429b7316bf146f703fdbcd9bf93b541702f500f83c35e3390c972dba107c2eb1f0dca9c2f99775c49b08665d5c4df4efce2e77496f0eedb8ad1bc736e93cab43d46b7eb3999ea7e807697d4b6ae406b75ec27fe7f25f96ae527652438b4557f772f621d09ee4392049772816851d5feb022cff00eb779b53307d2757c8d5e1c71ac7f9c389233f1a73515bc94") fcntl$notify(r0, 0x402, 0x0) 04:46:47 executing program 4: ioctl$KVM_IRQ_LINE(0xffffffffffffffff, 0x4008ae61, &(0x7f0000000500)) r0 = syz_open_dev$dspn(&(0x7f00000004c0)='/dev/dsp#\x00', 0x1, 0x0) r1 = openat$audio(0xffffffffffffff9c, &(0x7f0000000000)='/dev/audio\x00', 0x80, 0x0) ioctl$KVM_SET_FPU(0xffffffffffffffff, 0x41a0ae8d, &(0x7f0000000100)={[], 0x0, 0x5531fee, 0x0, 0x0, 0x9, 0xf000, 0x0, [], 0x5}) r2 = syz_open_dev$usb(&(0x7f00000003c0)='/dev/bus/usb/00#/00#\x00', 0x1000, 0x2000000002) setxattr$security_ima(&(0x7f0000000340)='./file0/file0\x00', &(0x7f0000000380)='security.ima\x00', &(0x7f0000000440)=@sha1={0x1, "25cd2880b128bfbc9d22610dcd75315a85c330db"}, 0x15, 0x862a4446815b2008) r3 = perf_event_open(&(0x7f000001d000)={0xfffffffffffffffe, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) lstat(&(0x7f0000000040)='./file0/file0\x00', &(0x7f0000000080)) ioctl$EXT4_IOC_MIGRATE(0xffffffffffffffff, 0x6609) sendmmsg$unix(0xffffffffffffffff, &(0x7f000000a000)=[{&(0x7f000000a000)=@abs, 0x6e, &(0x7f000000d000), 0x0, &(0x7f0000000600)=ANY=[]}], 0x1, 0x0) getsockopt$inet_sctp6_SCTP_ENABLE_STREAM_RESET(r0, 0x84, 0x76, &(0x7f0000000480)={0x0, 0xffffffffffff7fff}, &(0x7f00000007c0)=0x8) setsockopt$inet_sctp_SCTP_ENABLE_STREAM_RESET(r2, 0x84, 0x76, &(0x7f0000000800)={r4, 0x100000001}, 0x8) r5 = socket$inet6(0xa, 0x2, 0x0) gettid() r6 = getpgid(0x0) kcmp(0x0, r6, 0x0, 0xffffffffffffffff, 0xffffffffffffffff) connect$inet6(r5, &(0x7f0000002740)={0xa, 0x0, 0x0, @mcast2, 0x4}, 0x1c) sendmmsg(r5, &(0x7f0000007e00), 0x136a88c8311572c, 0x0) setsockopt$inet6_udp_int(r5, 0x11, 0x0, &(0x7f0000000400), 0x4) read(r5, &(0x7f0000000640)=""/234, 0xfffffffffffffd3c) openat$uhid(0xffffffffffffff9c, &(0x7f0000000780)='/dev/uhid\x00', 0x2, 0x0) fgetxattr(r0, &(0x7f0000000300)=@known='trusted.overlay.impure\x00', &(0x7f0000000540)=""/220, 0xdc) ioctl$VHOST_SET_VRING_CALL(0xffffffffffffff9c, 0x4008af21, &(0x7f00000002c0)={0x0, r3}) ioctl$SNDRV_TIMER_IOCTL_TREAD(r0, 0x40045402, &(0x7f0000000740)) inotify_rm_watch(0xffffffffffffffff, 0x0) getpeername$packet(r1, &(0x7f0000000900)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000940)=0x14) ioctl$ifreq_SIOCGIFINDEX_team(0xffffffffffffffff, 0x8933, &(0x7f0000000980)={'team0\x00', r7}) 04:46:47 executing program 3: r0 = syz_open_dev$sg(&(0x7f00000000c0)='/dev/sg#\x00', 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000000)={0x53, 0x0, 0x6, 0x0, @buffer={0x209, 0xb8, &(0x7f00000001c0)=""/184}, &(0x7f0000000540)="ad40657ed56c", &(0x7f0000000340)=""/128, 0x0, 0x0, 0x0, &(0x7f0000000040), 0x2f}) 04:46:47 executing program 1: r0 = perf_event_open(&(0x7f000025c000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x11, r1, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r0, 0x2405, r1) mmap(&(0x7f0000000000/0xb36000)=nil, 0x19000, 0x1000004, 0x8031, 0xffffffffffffffff, 0x0) 04:46:47 executing program 0: mkdir(&(0x7f0000000200)='./file0\x00', 0x0) mount(&(0x7f00000002c0)=ANY=[], &(0x7f0000001540)='./file0\x00', &(0x7f0000000280)='tmpfs\x00', 0x0, &(0x7f0000000080)) r0 = open$dir(&(0x7f0000000180)='./file0\x00', 0x0, 0x0) r1 = creat(&(0x7f0000000000)='./file0\x00', 0x18) mknodat(r0, &(0x7f0000000140)='./file0\x00', 0x0, 0x0) lsetxattr$security_smack_entry(&(0x7f00000001c0)='./file2/file0\x00', &(0x7f0000000240)='security.SMACK64\x00', &(0x7f00000002c0)='%vmnet0GPLproc-\x00', 0x10, 0x3) setsockopt$inet_sctp_SCTP_INITMSG(r1, 0x84, 0x2, &(0x7f0000000040)={0x8, 0x0, 0x100000000000100, 0x6}, 0x9c) socket$pptp(0x18, 0x1, 0x2) renameat2(r0, &(0x7f0000000080)='./file0\x00', r0, &(0x7f0000000100)='./file1\x00', 0x4) openat(r1, &(0x7f00000000c0)='./file2\x00', 0x40, 0x0) 04:46:47 executing program 5: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000480)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_GUEST_DEBUG(r3, 0x4048ae9b, &(0x7f0000000140)={0x1}) syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000100)=[@text32={0x20, &(0x7f0000000000)="6601669b0f35c4e1fe16846ba49e0000b9940200000f32c4c23dad78e0b9670900000f32660f38827f95b0040f01d10fc71a", 0x32}], 0x1, 0x0, &(0x7f0000000040), 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r3, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000400)=[@text32={0x20, &(0x7f0000000880)="b805000000b98b9400000f01c19a01000000b0000f43d1b8000000000f23d80f21f835800000900f23f80f060f2140b9800000c00f3235000800000f3066ba4300b8f1ffffffefb9800000c00f3235002000000f30c4c3295f4da400", 0x5c}], 0x26433e1, 0x0, &(0x7f0000000300), 0x10000000000000b6) ioctl$KVM_RUN(r3, 0xae80, 0x10) [ 661.096696] binder: 25060:25114 Acquire 1 refcount change on invalid ref -268435456 ret -22 [ 661.105746] binder: 25060:25114 unknown command 29196 [ 661.111052] binder: 25060:25114 ioctl c0306201 20008fd0 returned -22 04:46:47 executing program 3: r0 = syz_open_dev$sg(&(0x7f00000000c0)='/dev/sg#\x00', 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000000)={0x53, 0x0, 0x6, 0x0, @buffer={0x209, 0xb8, &(0x7f00000001c0)=""/184}, &(0x7f0000000540)="ad40657ed56c", &(0x7f0000000340)=""/128, 0x0, 0x0, 0x0, &(0x7f0000000040), 0x2}) [ 661.194779] tmpfs: No value for mount option './file0' [ 661.243569] binder: 25127:25128 unknown command 888391676 [ 661.274442] binder: 25127:25128 ioctl c0306201 20000100 returned -22 04:46:47 executing program 1: r0 = perf_event_open(&(0x7f000025c000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x11, r1, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r0, 0x2405, r1) mmap(&(0x7f0000000000/0xb36000)=nil, 0x1f000, 0x1000004, 0x8031, 0xffffffffffffffff, 0x0) [ 661.311977] binder: 25127:25137 ioctl 41009432 20000140 returned -22 04:46:47 executing program 0: mkdir(&(0x7f0000000200)='./file0\x00', 0x0) mount(&(0x7f00000002c0)=ANY=[], &(0x7f0000001540)='./file0\x00', &(0x7f0000000280)='tmpfs\x00', 0x0, &(0x7f0000000080)) socketpair$inet_icmp_raw(0x2, 0x3, 0x1, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$FS_IOC_FIEMAP(r0, 0xc020660b, &(0x7f00000006c0)={0x9, 0x9, 0x2, 0x5e3, 0x1, [{0x800, 0x0, 0x7, 0x0, 0x0, 0x2802}]}) pipe2(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}, 0x800) bind$pptp(r1, &(0x7f0000000040)={0x18, 0x2, {0x3, @local}}, 0x1e) r2 = open$dir(&(0x7f0000000180)='./file0\x00', 0x0, 0x0) ioctl$KVM_SET_LAPIC(r1, 0x4400ae8f, &(0x7f00000002c0)={"4780d4f931973ce5dac6ef6af042cb4edb34270712a5bc59b776b3be8484e7caf7ab3045c445b09144c355a5a0297b6ababd99d83243e0b53f06bdd4e5d3a2922f3c78c74c98dff6c1bd47ff0cb2167e306fb250a4c920bf7d6a2f8e985ddc8f83bf74ee558fde7d6510f3bc98c9316aceed029447bc1e441261793d37e1b8d532fdf0ee9fefd99bf2133339eeee7e7519629ddf93c947f5e1a6c810590fd73df933480b56656d7936bca21188ae75fca7468607537388a9eb06a45e3af70b45fea84d765079c1c50de350ec758bb644d48ea63e29f5e292122fea79ba2489a4400d8a7b79bc146cd6d8dfb475b6a4a31e2a1a1a25488ac8567e4ae4d90a79ea79f75909b0a7fda99409a00488c8dd4bc9bbdb637d9b0e503fc800549bb52d2522d20c0d3847da6174043eeb9f272922f0a70ca6242c0ddc172cba11416bbb269ff05922869789d35a83c95da0f8be3cfee1680c48e1a73e4de45b2e67e60f8e0432f832ae1ee85e15519917a41be232fe104433708879b2607cbd86a75285b5a2a6bb9136c32b4a2b8ef9eaa2e148df374e5bd182f429bef316766fe0a48396d292737208f10349546237e8deff7ebd6daf267533c1a361fe82ae872f8d35c65aa86cd0fc76e32b0a0670d4c5e7f1154edbf1434dcddbf9512c593bb4eca031385c235939fde1c915e63ae0f8424ea09647e7f128e1ba4c5f71b3d778d552c978167eb7fefef97dda0637e3d55ff832792f80d1a9d6bec7df9affe995ed7bc609351322365f67915ba562b96326ec6add2febfc1bc86ed08297aa1c81d7eab74beb97ad1046dacd88fc7d65be6378841d7fbcb06a984e7c63de1222c64cbe06bcd2da9aa385c682043d4e4b713234ebc22c390bd76b779fd4c80f1e9b8be6dade2e5609792119be76b6225eaf23bd3f733c7feed517796b50e963debd4574781caf16a86962ebea7c3a168321f723b30585e3183c29b181b483f1d046bb8e027ce29d7b05123f0971f23f465160f703b35d3cb38c1abbf68d8443a8b57ebc24133eca90322769ce0c8565482a3361b994d63cb62381f3c36fddf794f0cf8048d3de523e56965af00802833c85eed1fa0ffe1dd12b87a7e5847e6571dae1a5f7dac6a5d14a6b9bccab308674754c325055b0743d1819f27ac1461f1cddedca2d7868ab64b82f3444a8614b20d3267a08e16506bdf69b0e304bd2e1566f384df27b76886c576842e28604e39beba39888c198355736b2d5054a0591ea019e5857bdcf3a7152b2cceca413b3af45c4aed682ebd47a3587fd31ea30c863c96a4a5d2fcc5f05855fead3ee194703d77b81725984bb5e8911a039cfd7697d69318528e6feb792362487c6d24d9a95ec28ed8c12c1150e037fc5a0852f78e799d6169aaa6fee7376b865e785876ee68afe5ef3736e104c855be55de483f446ecadc934"}) mknodat(r2, &(0x7f0000000140)='./file0\x00', 0x0, 0x0) renameat2(r2, &(0x7f0000000080)='./file0\x00', r2, &(0x7f0000000100)='./file1\x00', 0x4) 04:46:47 executing program 3: r0 = syz_open_dev$sg(&(0x7f00000000c0)='/dev/sg#\x00', 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000000)={0x53, 0x0, 0x6, 0x0, @buffer={0x209, 0xb8, &(0x7f00000001c0)=""/184}, &(0x7f0000000540)="ad40657ed56c", &(0x7f0000000340)=""/128, 0x0, 0x0, 0x0, &(0x7f0000000040), 0x4}) 04:46:47 executing program 5: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000480)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_GUEST_DEBUG(r3, 0x4048ae9b, &(0x7f0000000140)={0x1}) syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000100)=[@text32={0x20, &(0x7f0000000000)="6601669b0f35c4e1fe16846ba49e0000b9940200000f32c4c23dad78e0b9670900000f32660f38827f95b0040f01d10fc71a", 0x32}], 0x1, 0x0, &(0x7f0000000040), 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r3, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000400)=[@text32={0x20, &(0x7f0000000880)="b805000000b98b9400000f01c19a01000000b0000f43d1b8000000000f23d80f21f835800000900f23f80f060f2140b9800000c00f3235000800000f3066ba4300b8f1ffffffefb9800000c00f3235002000000f30c4c3295f4da400", 0x5c}], 0x26433e1, 0x0, &(0x7f0000000300), 0x10000000000000b6) ioctl$KVM_RUN(r3, 0xae80, 0x2) [ 661.361011] binder: 25127:25137 ioctl 41009432 20000140 returned -22 [ 661.364065] binder: 25127:25128 unknown command 888391676 [ 661.421523] binder: 25127:25128 ioctl c0306201 20000100 returned -22 04:46:47 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x4, 0x0, &(0x7f0000005fd4)=[@enter_looper], 0x0, 0x0, &(0x7f0000012fc7)}) close(r0) r2 = openat$null(0xffffffffffffff9c, &(0x7f0000000000)='/dev/null\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, &(0x7f0000000f4d)}) ioctl$DRM_IOCTL_MODESET_CTL(r2, 0x40086408, &(0x7f0000000040)={0x7, 0x6}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000100)={0x4, 0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="2368cdc8c64c8dd38704ce2bc074f1c9eef77798408faa6dc1d27087712b132bc1d9552fc2f9dc9c94418c2dfe0052ea7624411cf41b8ae7f5fd51fe94358c6aa15a43695ca3916727019f65e6a712fd436cf3cdb7798fddaf33e109d28cb87751bf59d79a784c040bddc490f3dbd415311a1f319e8ed785018d858540d89f2cd66652ba47545ac37a02626900fbd39f8cded349f7a68eb60fbf5d67fab0baddbf6b43e5baa9e79b06001519ccca168df3f18e727e208462b700e3aa7fffbc6df104383e55bbc611ca3f5e0dc19ef755123be46b"], 0xfffffffffffffc2b, 0x0, &(0x7f0000000680)}) [ 661.494494] tmpfs: No value for mount option './file0' 04:46:47 executing program 4: ioctl$KVM_IRQ_LINE(0xffffffffffffffff, 0x4008ae61, &(0x7f0000000500)) r0 = syz_open_dev$dspn(&(0x7f00000004c0)='/dev/dsp#\x00', 0x1, 0x0) openat$audio(0xffffffffffffff9c, &(0x7f0000000000)='/dev/audio\x00', 0x80, 0x0) ioctl$KVM_SET_FPU(0xffffffffffffffff, 0x41a0ae8d, &(0x7f0000000100)={[], 0x0, 0x80, 0x0, 0x0, 0x9, 0xf000, 0x0, [], 0x7}) syz_open_dev$usb(&(0x7f0000000440)='/dev/bus/usb/00#/00#\x00', 0x9, 0x2) r1 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) lstat(&(0x7f0000000040)='./file0/file0\x00', &(0x7f0000000080)) ioctl$EXT4_IOC_MIGRATE(0xffffffffffffffff, 0x6609) sendmmsg$unix(0xffffffffffffffff, &(0x7f000000a000)=[{&(0x7f000000a000)=@abs, 0x6e, &(0x7f000000d000), 0x0, &(0x7f0000000600)=ANY=[]}], 0x1, 0x0) r2 = socket$inet6(0xa, 0x2, 0x0) gettid() r3 = getpgid(0x0) kcmp(0x0, r3, 0x0, 0xffffffffffffffff, 0xffffffffffffffff) connect$inet6(r2, &(0x7f0000002740)={0xa, 0x0, 0x0, @mcast2, 0x4}, 0x1c) sendmmsg(r2, &(0x7f0000007e00), 0x136a88c8311572c, 0x0) setsockopt$inet6_udp_int(r2, 0x11, 0x0, &(0x7f0000000400), 0x4) openat$kvm(0xffffffffffffff9c, &(0x7f00000003c0)='/dev/kvm\x00', 0x0, 0x0) ioctl$VHOST_SET_VRING_CALL(0xffffffffffffff9c, 0x4008af21, &(0x7f00000002c0)={0x0, r1}) ioctl$SNDRV_TIMER_IOCTL_TREAD(r0, 0x40045402, &(0x7f0000000740)) inotify_rm_watch(0xffffffffffffffff, 0x0) ioctl$ifreq_SIOCGIFINDEX_team(0xffffffffffffffff, 0x8933, &(0x7f0000000480)={'team0\x00'}) 04:46:47 executing program 3: r0 = syz_open_dev$sg(&(0x7f00000000c0)='/dev/sg#\x00', 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000000)={0x53, 0x0, 0x6, 0x0, @buffer={0x209, 0xb8, &(0x7f00000001c0)=""/184}, &(0x7f0000000540)="ad40657ed56c", &(0x7f0000000340)=""/128, 0x0, 0x0, 0x0, &(0x7f0000000040), 0x7ffff000}) 04:46:47 executing program 0: mkdir(&(0x7f0000000200)='./file0\x00', 0x0) mount(&(0x7f00000002c0)=ANY=[], &(0x7f0000001540)='./file0\x00', &(0x7f0000000280)='tmpfs\x00', 0x0, &(0x7f0000000080)) r0 = syz_open_dev$midi(&(0x7f0000000300)='/dev/midi#\x00', 0x8, 0x200080) ioctl$FS_IOC_SETFSLABEL(r0, 0x41009432, &(0x7f0000000340)="3587a8cc5539c0824f834f3035862f7cf9c21999e4c01054862e689587c642ee67ddec7cc99ed4dc4eb2013c0d4f96813e45331f5fe45093a5761d23daaf9e1d48541f098efdaec35c8fe26b3620d203ccbb69cb8f2f1d3d3b57a88d280a571689d6295dc48bef24b5d1e8652c2bfe767aa38a177aaf70466298fb07153d0f60cfb92f1f846e59a87fcb17780c91227109d095755a993f03684bb3fddb13c1be6788df2f5b3403053f372f9c09a915f00a329d5c3b1a09f371725e4d956ec3cf1141e92f2c2f2dbe52e6579017e7df74603fc79eaf6aa06484973898beb3c61ffef13c31488b63d59d679cf48f985b5f468dc6ce929ddee3dc5203fa63c5bbb6") pipe2(&(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80000) ioctl$EVIOCSCLOCKID(r1, 0x400445a0, &(0x7f00000002c0)=0x1) r2 = open$dir(&(0x7f0000000180)='./file0\x00', 0x0, 0x0) r3 = memfd_create(&(0x7f0000000000)='tmpfs\x00', 0x4) getsockopt$inet_tcp_int(r3, 0x6, 0x14, &(0x7f0000000040), &(0x7f00000000c0)=0x4) mknodat(r2, &(0x7f0000000140)='./file0\x00', 0x0, 0x0) setsockopt$inet_sctp6_SCTP_I_WANT_MAPPED_V4_ADDR(r0, 0x84, 0xc, &(0x7f0000000440)=0x1, 0x4) renameat2(r2, &(0x7f0000000080)='./file0\x00', r2, &(0x7f0000000100)='./file1\x00', 0x4) ioctl$KVM_REGISTER_COALESCED_MMIO(r3, 0x4010ae67, &(0x7f00000001c0)={0x1000, 0x2000}) 04:46:47 executing program 1: r0 = perf_event_open(&(0x7f000025c000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x11, r1, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r0, 0x2405, r1) mmap(&(0x7f0000000000/0xb36000)=nil, 0x1fffff, 0x1000004, 0x8031, 0xffffffffffffffff, 0x0) [ 661.637024] binder: 25159:25160 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 661.654317] binder: 25159:25160 unknown command -926062557 [ 661.675476] binder: 25159:25160 ioctl c0306201 20000100 returned -22 [ 661.740985] tmpfs: No value for mount option './file0' 04:46:47 executing program 3: r0 = syz_open_dev$sg(&(0x7f00000000c0)='/dev/sg#\x00', 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000000)={0x53, 0x0, 0x6, 0x0, @buffer={0x209, 0xb8, &(0x7f00000001c0)=""/184}, &(0x7f0000000540)="ad40657ed56c", &(0x7f0000000340)=""/128, 0x0, 0x0, 0x0, &(0x7f0000000040), 0xb8}) [ 661.768997] binder: 25159:25174 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 04:46:47 executing program 0: mkdir(&(0x7f0000000200)='./file0\x00', 0x8000000) r0 = shmget(0x3, 0x1000, 0x1, &(0x7f0000ffe000/0x1000)=nil) shmctl$IPC_RMID(r0, 0x0) mount(&(0x7f00000002c0)=ANY=[], &(0x7f0000001540)='./file0\x00', &(0x7f0000000280)='tmpfs\x00', 0x0, &(0x7f0000000080)) r1 = open$dir(&(0x7f0000000180)='./file0\x00', 0x0, 0x0) mknodat(r1, &(0x7f0000000040)='./file0/file0\x00', 0x0, 0x9) renameat2(r1, &(0x7f0000000080)='./file0\x00', r1, &(0x7f0000000100)='./file1\x00', 0x4) 04:46:48 executing program 5: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000480)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_GUEST_DEBUG(r3, 0x4048ae9b, &(0x7f0000000140)={0x1}) syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000100)=[@text32={0x20, &(0x7f0000000000)="6601669b0f35c4e1fe16846ba49e0000b9940200000f32c4c23dad78e0b9670900000f32660f38827f95b0040f01d10fc71a", 0x32}], 0x1, 0x0, &(0x7f0000000040), 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r3, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000400)=[@text32={0x20, &(0x7f0000000880)="b805000000b98b9400000f01c19a01000000b0000f43d1b8000000000f23d80f21f835800000900f23f80f060f2140b9800000c00f3235000800000f3066ba4300b8f1ffffffefb9800000c00f3235002000000f30c4c3295f4da400", 0x5c}], 0x26433e1, 0x0, &(0x7f0000000300), 0x10000000000000b6) ioctl$KVM_RUN(r3, 0xae80, 0x5) [ 661.814808] binder: 25159:25177 unknown command -926062557 [ 661.823228] binder: 25159:25177 ioctl c0306201 20000100 returned -22 04:46:48 executing program 2: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r3, &(0x7f0000fe5000/0x18000)=nil, &(0x7f0000000100)=[@text64={0x40, &(0x7f0000000040)="440f3248b800000000008000000f23d80f21f835000000800f23f848b86d980000000000000f23d80f21f835000000600f23f848b80e000000000000000f23d80f21f835000000000f23f80f0f6a3190c744240088a42236c7442402a19a83b3c7442406000000000f011424450fc76a218f6890a26d13ae0f3566baf80cb8e2e5bd81ef66bafc0c66ed", 0x8a}], 0x1, 0x0, &(0x7f0000000140), 0x0) r4 = dup(r3) ioctl$KVM_ENABLE_CAP_CPU(r4, 0xc008ae88, &(0x7f0000000340)={0x79, 0x0, [0x491]}) 04:46:48 executing program 3: r0 = syz_open_dev$sg(&(0x7f00000000c0)='/dev/sg#\x00', 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000000)={0x53, 0x0, 0x6, 0x0, @buffer={0x209, 0xb8, &(0x7f00000001c0)=""/184}, &(0x7f0000000540)="ad40657ed56c", &(0x7f0000000340)=""/128, 0x0, 0x0, 0x0, &(0x7f0000000040), 0xfeffffff}) 04:46:48 executing program 1: r0 = perf_event_open(&(0x7f000025c000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x11, r1, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r0, 0x2405, r1) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb3601e, 0x1000004, 0x8031, 0xffffffffffffffff, 0x0) [ 662.004470] tmpfs: No value for mount option './file0' 04:46:48 executing program 0: mkdir(&(0x7f0000000200)='./file0\x00', 0x0) mount(&(0x7f00000002c0)=ANY=[], &(0x7f0000001540)='./file0\x00', &(0x7f0000000280)='tmpfs\x00', 0x0, &(0x7f0000000080)) r0 = open$dir(&(0x7f0000000180)='./file0\x00', 0x0, 0x0) mknodat(r0, &(0x7f0000000140)='./file0\x00', 0x0, 0x0) renameat2(r0, &(0x7f0000000080)='./file0\x00', r0, &(0x7f0000000100)='./file1\x00', 0x4) r1 = add_key$keyring(&(0x7f0000000000)='keyring\x00', &(0x7f0000000040)={'syz', 0x3}, 0x0, 0x0, 0xfffffffffffffffd) keyctl$restrict_keyring(0x1d, r1, &(0x7f00000000c0)='encrypted\x00', &(0x7f00000001c0)='tmpfs\x00') 04:46:48 executing program 3: r0 = syz_open_dev$sg(&(0x7f00000000c0)='/dev/sg#\x00', 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000000)={0x53, 0x0, 0x6, 0x0, @buffer={0x209, 0xb8, &(0x7f00000001c0)=""/184}, &(0x7f0000000540)="ad40657ed56c", &(0x7f0000000340)=""/128, 0x0, 0x0, 0x0, &(0x7f0000000040), 0x9020000}) 04:46:48 executing program 4: ioctl$KVM_IRQ_LINE(0xffffffffffffffff, 0x4008ae61, &(0x7f0000000500)) r0 = syz_open_dev$dspn(&(0x7f00000004c0)='/dev/dsp#\x00', 0x1, 0x0) r1 = openat$audio(0xffffffffffffff9c, &(0x7f0000000000)='/dev/audio\x00', 0x80, 0x0) ioctl$KVM_SET_FPU(0xffffffffffffffff, 0x41a0ae8d, &(0x7f0000000100)={[], 0x0, 0x5531fee, 0x0, 0x0, 0x9, 0xf000, 0x0, [], 0x5}) r2 = syz_open_dev$usb(&(0x7f0000000440)='/dev/bus/usb/00#/00#\x00', 0x9, 0x2) r3 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$bt_rfcomm(0x1f, 0x1, 0x3) lstat(&(0x7f0000000040)='./file0/file0\x00', &(0x7f0000000080)) ioctl$EXT4_IOC_MIGRATE(0xffffffffffffffff, 0x6609) sendmmsg$unix(0xffffffffffffffff, &(0x7f000000a000)=[{&(0x7f000000a000)=@abs, 0x6e, &(0x7f000000d000), 0x0, &(0x7f0000000600)=ANY=[]}], 0x1, 0x0) r4 = socket$inet6(0xa, 0x2, 0x0) gettid() r5 = getpgid(0x0) kcmp(0x0, r5, 0x0, 0xffffffffffffffff, 0xffffffffffffffff) connect$inet6(r4, &(0x7f0000002740)={0xa, 0x802, 0x100000003, @dev={0xfe, 0x80, [], 0x11}}, 0xfffffffffffffe79) sendmmsg(r4, &(0x7f0000007e00), 0x136a88c8311572c, 0x0) setsockopt$inet6_udp_int(r4, 0x11, 0x0, &(0x7f0000000400), 0x4) openat$kvm(0xffffffffffffff9c, &(0x7f00000003c0)='/dev/kvm\x00', 0x0, 0x0) ioctl$VHOST_SET_VRING_CALL(r2, 0x4008af21, &(0x7f00000002c0)={0xfffffffffffffffe, r3}) ioctl$SNDRV_TIMER_IOCTL_TREAD(r0, 0x40045402, &(0x7f0000000740)) inotify_rm_watch(r1, 0x0) ioctl$ifreq_SIOCGIFINDEX_team(0xffffffffffffffff, 0x8933, &(0x7f0000000480)={'team0\x00'}) 04:46:48 executing program 5: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000480)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = openat$autofs(0xffffffffffffff9c, &(0x7f0000000040)='/dev/autofs\x00', 0x200000, 0x0) getpeername$inet6(r3, &(0x7f00000000c0)={0xa, 0x0, 0x0, @ipv4={[], [], @loopback}}, &(0x7f00000001c0)=0x1c) r4 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_GUEST_DEBUG(r4, 0x4048ae9b, &(0x7f0000000140)={0x1}) syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000100)=[@text32={0x20, &(0x7f0000000000)="6601669b0f35c4e1fe16846ba49e0000b9940200000f32c4c23dad78e0b9670900000f32660f38827f95b0040f01d10fc71a", 0x32}], 0x1, 0x0, &(0x7f0000000040), 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r4, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000400)=[@text32={0x20, &(0x7f0000000880)="b805000000b98b9400000f01c19a01000000b0000f43d1b8000000000f23d80f21f835800000900f23f80f060f2140b9800000c00f3235000800000f3066ba4300b8f1ffffffefb9800000c00f3235002000000f30c4c3295f4da400", 0x5c}], 0x26433e1, 0x0, &(0x7f0000000300), 0x10000000000000b6) ioctl$KVM_RUN(r4, 0xae80, 0x0) 04:46:48 executing program 2: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r3, &(0x7f0000fe5000/0x18000)=nil, &(0x7f0000000100)=[@text64={0x40, &(0x7f0000000040)="440f3248b800000000008000000f23d80f21f835000000800f23f848b86d980000000000000f23d80f21f835000000600f23f848b80e000000000000000f23d80f21f835000000000f23f80f0f6a3190c744240088a42236c7442402a19a83b3c7442406000000000f011424450fc76a218f6890a26d13ae0f3566baf80cb8e2e5bd81ef66bafc0c66ed", 0x8a}], 0x1, 0x0, &(0x7f0000000140), 0x0) r4 = dup(r3) ioctl$KVM_ENABLE_CAP_CPU(r4, 0xc008ae88, &(0x7f0000000340)={0x79, 0x0, [0x491]}) 04:46:48 executing program 3: r0 = syz_open_dev$sg(&(0x7f00000000c0)='/dev/sg#\x00', 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000000)={0x53, 0x0, 0x6, 0x0, @buffer={0x209, 0xb8, &(0x7f00000001c0)=""/184}, &(0x7f0000000540)="ad40657ed56c", &(0x7f0000000340)=""/128, 0x0, 0x0, 0x0, &(0x7f0000000040), 0x6}) [ 662.333324] tmpfs: No value for mount option './file0' 04:46:48 executing program 0: mkdir(&(0x7f0000000200)='./file0\x00', 0x0) mount(&(0x7f00000002c0)=ANY=[], &(0x7f0000001540)='./file0\x00', &(0x7f0000000280)='tmpfs\x00', 0x0, &(0x7f0000000080)) r0 = open$dir(&(0x7f0000000180)='./file1\x00', 0x0, 0xfffffffffffffffe) mknodat(r0, &(0x7f0000000140)='./file0\x00', 0x0, 0x0) renameat2(r0, &(0x7f0000000080)='./file0\x00', r0, &(0x7f0000000100)='./file1\x00', 0x4) 04:46:48 executing program 2: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r3, &(0x7f0000fe5000/0x18000)=nil, &(0x7f0000000100)=[@text64={0x40, &(0x7f0000000040)="440f3248b800000000008000000f23d80f21f835000000800f23f848b86d980000000000000f23d80f21f835000000600f23f848b80e000000000000000f23d80f21f835000000000f23f80f0f6a3190c744240088a42236c7442402a19a83b3c7442406000000000f011424450fc76a218f6890a26d13ae0f3566baf80cb8e2e5bd81ef66bafc0c66ed", 0x8a}], 0x1, 0x0, &(0x7f0000000140), 0x0) r4 = dup(r3) ioctl$KVM_ENABLE_CAP_CPU(r4, 0xc008ae88, &(0x7f0000000340)={0x79, 0x0, [0x491]}) 04:46:48 executing program 3: r0 = syz_open_dev$sg(&(0x7f00000000c0)='/dev/sg#\x00', 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000000)={0x53, 0x0, 0x6, 0x0, @buffer={0x209, 0xb8, &(0x7f00000001c0)=""/184}, &(0x7f0000000540)="ad40657ed56c", &(0x7f0000000340)=""/128, 0x0, 0x0, 0x0, &(0x7f0000000040), 0xf6ffffff00000000}) [ 662.607070] tmpfs: No value for mount option './file0' 04:46:48 executing program 4: ioctl$KVM_IRQ_LINE(0xffffffffffffffff, 0x4008ae61, &(0x7f0000000500)) r0 = syz_open_dev$dspn(&(0x7f00000004c0)='/dev/dsp#\x00', 0x1, 0x0) r1 = openat$audio(0xffffffffffffff9c, &(0x7f0000000000)='/dev/audio\x00', 0x80, 0x0) ioctl$KVM_SET_FPU(0xffffffffffffffff, 0x41a0ae8d, &(0x7f0000000100)={[], 0x0, 0x5531fee, 0x0, 0x0, 0x9, 0xf000, 0x0, [], 0x5}) r2 = syz_open_dev$usb(&(0x7f0000000440)='/dev/bus/usb/00#/00#\x00', 0x9, 0x2) r3 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) lstat(&(0x7f0000000040)='./file0/file0\x00', &(0x7f0000000080)) ioctl$EXT4_IOC_MIGRATE(0xffffffffffffffff, 0x6609) sendmmsg$unix(0xffffffffffffffff, &(0x7f000000a000)=[{&(0x7f000000a000)=@abs, 0x6e, &(0x7f000000d000), 0x0, &(0x7f0000000600)=ANY=[]}], 0x1, 0x0) r4 = socket$inet6(0xa, 0x2, 0x0) gettid() r5 = getpgid(0x0) kcmp(0x0, r5, 0x0, 0xffffffffffffffff, 0xffffffffffffffff) connect$inet6(r4, &(0x7f0000002740)={0xa, 0x0, 0x0, @mcast2, 0x4}, 0x1c) getsockopt$inet_pktinfo(r2, 0x0, 0x8, &(0x7f0000002180)={0x0, @multicast2, @multicast2}, &(0x7f00000021c0)=0xc) sendmmsg(r4, &(0x7f0000004440)=[{{&(0x7f0000000340)=@ethernet={0x6, @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}}, 0x80, &(0x7f0000001780)=[{&(0x7f0000000540)="dcc00c803f5e785ac5abda0b9e250aa96b6133a08794fcb6431bc1b553a436a3bbe9edc4e3295914a8921d99e47db489fd486ca510bafcab595cc2ac755a9ab33f79cf65ae029fcb5038f708ee1b5befc0c3dddd5c4eaccd75d3c481dd3ba14539cc54d4d0cb9611b0c016ef3b2cae6d207eeed09a2a154156ba2cdbcf4f04caecb20b3f91620aabaa4a444b71dc110a3847f0437ec5170c4de33cda06631f77e796f359cd76c5c599c99c5800ad193e9462a3922a65c3cadbe166bc4c3a4d1a87be0198acd8a3fd0b7013b118a709db9eb4e69deda04a8961b360ab54155397573357a729a3589ce2f4", 0xea}, {&(0x7f0000000640)="2b0ad4cdf27cf381600e5a8e1ab87abfa09ca07dab46c525129918ae8114b4c648765a8f6cd8852c699f26401839d24b31bd30450d5c7a1879f261c93c5e8de4d464bcb938e30fa2686f9f845cfd77330b094b8c6a24f13f5eea846882d13cf3e8f5fda55b16aadc655e072ffb14798d371e9cb5a0983eb805c613d6facb685429605f4942ab1cd25a1b7cb61a5b4651fa698478612f627dd8e7e0f7f80b83ce0fcd8039d53c3138d21b73343648eb78eeecfe06f2d3851064dbb471b046777edf297ab4e9baf42ecb92a4cfa8b7531710a368313194c19d654e88c0b404c8adb81db1fbab61c944786abba5b72ed49c1719", 0xf2}, {&(0x7f0000000780)="5711e24b33ccc3ba9e41987a3e963cc564a2cab983850eb0933c82275fdc7144824ec7b359280ff1f52826dbfde7a6fa6dcd83c97dc3c7397255d7239c313b2bfcf9c3f71514611e44ce74bbc833eacad5f305402a8cf6aefdaf7731d0104ceb3f7004500dbdf4af69773320b46d22b1213bb5f3687b557cee9ed99bd3d2beb1db560954bf24b30a07b29f98e189fee84120d3b4bb0a2f98af1f0c8bcc1b4936068e462b6fc40ed4b340c3058466cce5073f1d7a83403cbaa480de69c30df9093bea33d79e6bab2c3f3706d4ddacc1e4d030d3bd325088353124b31f24624709be8bc0c4dc4264e597f280c57dc4e71f022fecb2a6a443ec90d417b182096407ebf32c4f241506e903a0b1ae21511c4c3dd5d7f95781b0ff95a5a4b7f1252d2f1f3219907f1d4eaa0894e99c65f43e14d7adb38b7d350a76ae416373f684a5a8921aa526c78933dbeb8afde0ff3ae621c9e9990e8076c8c2c999e4c8531f674272fe965ddd0d811156efda81069d03c9dfc0d112aa9cd7ac2a2817cfc031186876474d4e0b16fc6930b5e74ff6633f973608bfa87b003cecdc52e35cc926975b635a99c61585468d2594f4714786542d46a9f7b5cbf3200b4ce74bcd5110d1f1d6469e08feebc30df69869d467686910b3175092dfcd67bfa6cd6e2471924d5a22883599d0094b549e864d137e6da5f32590e6db40935cc02ce9ede949f62616827f07d3939d9d4e705ee3e531bcdfa03824c547c2594b4fd47c8e9dac2844f0d14d3ab2adc831f6771384ce32a60fe7234dfdab344fc506fe1fa48d059725d3d6741202133ee90f3e5bf98025f2300771d7930fe26c4062b087a216b55b343d33ab34cdda443067036213225e8fe5cbe43db81ae3ebbe154dd8173a5e78e28617a6732b3bba8dccd5500415b6672b8635f911cb12d3506fbf07d88381328f3b90fa00d4bddc1e81ba500eab90b4f16d4e689ac4530c33433c9dc6c5819472939d4af90573c0a389837f07ff3b73c2f32c8b3a06835367b2acd0333da725194566bc6c0fb692d86e7145654fae6f7b8e7af63cf1a4ffa1fa73aa121a2fc7a4ac816bbb559f4e671000efee725016db2d56a0fa8a14cf5741ce4fc8a7f32bc51a8b6bfc63b36d858a86db506c4a6e0d1420a50a6c0336fe631b2b32a8317ab0cd72e311d9ee99345df87ee52252ecb72802c227b9a6562a79e3560c7c8a89f91bfa9e26b724e85544036136c368d2a871120ba48c4f8a44c50ca81a05488bbf04fdfdcd37373195c7a936757c2e9c8cb933cb32f16045303b0e39c4fa995c0fbea0da1fd85446af3bf9bce8d8be675458242a08814a859fe81a9e1961caf7f6646ce5c577d1d41d8933171fcc63855d51546e5da4a14b6dcdb29a4ec73053dc383b7ada461d80bd986794202aa0e6bd504d2565e80ff37fb4c155a12e7645cadfe913bc5277ea8dc78f681b5aa183f4ea5579218748c05ab3f74bbc3f822207b274f4a8f876d7dd4ed938232f0f5c3b7832dbfddb311b2d2c57f5ffc2ff97c8309c563fda754e8a9cea683eb116d66dd55d58bf526c4a596146e6682f1878033aa80995ba5643a59ad8c63c3e386a293140c0e6e91170372ac092fee2ecacc37abe4dbe52558181bcd990764dac5873e351faa90286fd3794e64ec47a145470622d46cd452f49546f9608b9e9ecca63819533ea024495a85fc39cd39e33f2a4870359f8e2c67beda24a2ec177f0afc3daa124ffa96290ea6a624a527d44450b74f8c799985e2e18421db6af052e5cda11324d46ed196def7ca04018a15c30214d4a4efa22c42e743905cf0032e268b3194783d80f5faa2eca64552d9dee131792354f7e9447eb4ade32fe4af7b34416343daefa2b4bdd898a1f0d75cb5529a2a2359feab46e0a8a9f71bd44ae327a264226d948e3da1749fd47fc836e79ba83ef4119ae5fa1d45b5a503558b946f3a559daa294a989ae8574e9a06e2f69fd85b49d3c24995797fbbd0511fe4951f9c0e41fc9b9c18853e49ce70c39a8c75c25e6c763d4979bbb5b3012cc701666cc7d722555ff749c59c337c6a3844472e6e65d1fbceb0eea9adaacc1f95f3b71db64b693a8e6476d0a41f94a65340a03afb4c0d86f5c37daf85794a1d7c7801ad1fe3f3f2ab9fade8f6a267be1b049613e1a7bec52259b33c9a8e9388918d608b088467853cf44a864168fd81e31cb29d9cc1ffe0dfbaae47c3461e1842290234b646b0192f320dfb4b9fc7881c67b4b8f7d52af18f417ac0876f11e3f3716b1127aefc89a87faa7edbe4bf413ecbbf3fd590f56e22cbfce67ded866625624f26ea5d86863a0f61ffb8753a50d75dbdc4da5194d839a0a8166fd5fac0dd07e8ca576b7909b1755b584c353b205d4fde01a295d3a5ea42f0f12f0cf0526bd4f7f3532833e86b541e2f41ca1167bfc888e6a06257bba0f56b841f49bfe02e1bdaf9c17261d06a5fd7f21c49b3ec0db4ce83455230351fb3bc8efc71a8ac1b2e162769206bb8171e335128c3ee26551dbd58a342b850d70e84432fe012f35cb9d14c4bfafafd7546931dc286b850c284bc9ac378ca0703695bf950661be9a96217becb46e43feb65d3acfe797ac340166d52ebf5c339a2b524ff8f7d7b22886f5d826a1b09ff6050e849b85163136e09346d360c53ec2bd4c281c27c41bf545ce23a616a1932ff28b6afd31432e930045370900da28e7f8e8e269d9ba52f0042820f282e3c848afe6e80af11c6c22d825a72e48ab577a4f86603f233410f7b30678075d503682427e47591037cb8894370a0224749cede657153d4e6dd76e35427c34c4e1c8106499043db5dd3c6d324bbb3451b56241a0fc947adecaac3c092d45a81974ecbd12848fad8bae26c3697a3e885c596a8f180c9f90439f0a527cb8a852fd598085810c42076ac4a5b37a3d83fa22df6c9be63e040b88e964e54899272e62ca3586b7a3a0008e51c6f3a599d130ad8cdda03591569163886f73b51c38d36eff87ec9509e1b91e72b86372e833f2a18e02c49139d72d84be9f4a0de843cf1ad8180d0665b03fab00e34cc16fa8f0c614ae8ed9d7079e5e13c7502323909b75026d1b07d89c9b66523c186c50b79d4532fcbc5f5bef5efc0f5ba4388938221e1046de75f7741f8a1848fcb2a703d216b333624211e52531769a22ac87a5afdb8dd73de306529d90f47a4c49118f224e1264631ae600019c61eb0cebbff131ece1507a97558157cd91cf813ae9476f0553d390ed2296807c91d5e313e8af700b9be020d1fb01bc325a1b06db0b23ae78791490db394e36a369c786712ada9b2140e511986560c8a6c6aa403130ce7c51661c30c28093671b191279d408106436680e4f836aa4e2d046eec14f8aa76cfff30cf8d5d93cdfbb4da8840087adf3a25065572ec21500980acac796d7947b5cba484fa3c6fab6a0699a7a6e3d5b5c5f091265ec13a6ef360b47c9b7f95250f8a89c996d57d09373187bc30d4476594ee42802cae4f674752d463b387f5d99e75cd2032a9e139be3a60d8ecbd64e1a73a9e225eeac0e16695f0a9b67e391a68a0375cf25c66f2c58e2e57f7469041205165a134a03f0f11d0983c33293ed39dd435c9f01f794a58cde888387b2f0a4bf3cd6160e347ba7b748196a1a1debd3e4a888c677e638502909c85048583fe78f40897829df770314dfd6f9d22c5e2b518381860e2cdf3f935303b36d77d8e7f13d242eb4512d1f1541dc7bf312906cbea0f8275b22fbe782da996a7af7dda4c580798d0417e0a7a4600123c18481cfd30eeb4b9632cd9deafdef1261bd05f746914000f343c78908675d40133f6d09e93caa48f642a50977a57efce6efccc04f809432a24e10ee062b7beeab413718e751a9b93ba1117b33157853237c4e7771006ad969dbddbf9cc7f3cffd73c7142f2238bcfcf64b6c2931b02ebef87f06a8f81f7da7c262d67f94fb51cf2c07494402d2ba6e3961ec0079aebc4d6bb50c4a2422d19775161fbdd4db3b2a8b840758f29f1827f35aad1e526bc6f1c0cdc661bce66cccca84c944a3561262d87a8ef9f4a4a45e29e1146500ecc2b8c35e4b0ca1fe19db9083add062d43d9cb5e6de3bc5cd11504bd2aab0eb25f064a3839c089ec0c9225dde2d419de174769da5561dd91054c7524e84116be7724d9c20a210b92083b0f6fb7464943d2042303a565e62c2028086aae2a31ae1314824a4a371f78b2db39a25764f6667cd878d5bccb45c78690bdf2ecc3cafb07c755935d9684ca8d77c51a2aa85fddd0e2bb8f8ab31ba4f0d9f64927e293741620c59d0261e428724d0a2e5817771fb6727104878ae45918cd47755d5eefb5709964685552e6c049d9e65aed61a46b4e63bab049c691c284d70aa11fac5cb62a71278a6f7b13b188ec5350ac40d28edd3a9826657cad68b0b323cf6dcab2923cb7c67eb7fa55307eea74f1aff1de8c41f55a6fd3b8f6841ff116f350f8c58e65cef8d59a61b12dbdc46ccf38af3c955400e50766745906537af5aad08370aee2accb6853597a65239333e566364e865ba9eabc77126923f2fb090358ec76747ab971b172c9382917754aea5c0237f96d543d9906244691fe750ae82a750e8d1e1c46531214c2de97d81ec87d32d3dd27201f72908e854973f0a4aef8ca8740f3ecc30af3e3c72bb425067ee9ae6867755a27962b963c88a7d6676ac5d27f66de156f4d197f9437734dbe5665c0169e9034acd5e6ca7d726403fb0e0e1eb929ad8638a22769dd3f691284d69adc1b99a601bda8dd519e9f7148410a234f5bd57accb29880f4fe95332cd95127671a77bf2f784b12f81780e7627093c1a78cca5118a0ab34760b13ad875288ef3e4679310e87495b199bb2b02d0a17911dc5e8f4600db16d7232bfd32013424f2ac8d1d500346447e293b4ab1621552bb6451aa1e7efdf7d31324ab1ac0333e05f19ca5e4607ef953f16194e2c3275955ab4870fa78c7769901053341442fdcc344325d477f6abb4efb5d81b0d0d070983e15b01f0e219a39c109d8483506be5321e695526e06870da1ff753bc8fb4991b4c8b7c079461dd4b0eff63e188becfbc38fc3f56eb2c085f371ad82130ab1a20bb1e65f5c80a7c7b94fafa291e15b66dfc9a1c5905b355431ece096f6bbcc92e4031ba7b9eb00ab17a10dc7b769921aa5f1247ebc13a13754e17628aa236b0172c8b011397ddadf9c8615acdcd6df57612cb3e0bd8fa71c6488ffaa82862254bf470fa6898e6c46edb149f038da65873aca3239c96733e0aeaf37306ff810d01bcf5899b7eec6ead23129f2017d1470a4287000c47b38863c5424bc89f543cb5ed7f99572ba241565cc3ddbaeb7b14c1f00887e4bef2ebc29673de29cf23714ce335d2afd04a052f54e96b5ef2634d481a4cf4fcbd593c0cb003988d96b9586bb68912c6d86321a903377caea6dbb6d114a9dfb9a0aa8623ecfd746ed9a333ce49470885a9fd40db2ddee2e6e9bdddfe0de23e7568588901c518fbaed806e03dbee076df6409a71c6ec2e31fde455b3185c58bd201ca46473a21f743d63c7ba1013d27b738eab9a7acb15510d10806c6b5cccfbde97ea81b7c2c6545dbcb8cbeafc05166adf0544ef5a1a28f7ec34e40e59a72a8016638630e4c6cd01da0e5b449176fd63517683ca02e205c5826f817796c1501e691d4862e0a751fb3e988c3c493afa0a77c39838762d99e418e92733f2e8e109076cbdd090cf0d7c28c88dabaf47895a61c652e826993f17c0e4e3a1eb8360714283c98e3f", 0x1000}], 0x3, 0x0, 0x0, 0x44000}}, {{&(0x7f00000017c0)=@ipx={0x4, 0xfffffffffffffffb, 0x0, "f2aa67da237c", 0x2}, 0x80, &(0x7f0000001840), 0x0, 0x0, 0x0, 0xc0}, 0xdd4}, {{&(0x7f0000001880)=@in6={0xa, 0x4e20, 0x8, @mcast1, 0x5}, 0x80, &(0x7f0000001ac0)=[{&(0x7f0000001900)="f0be4999f49ac4c0ab", 0x9}, {&(0x7f0000001940)="704176737d4e3c713c28f62c46760a7bcf1cd2033df0555369e037ff295f8a49d408412e34139f0c274e295cbfb38c1e51bb287b855fa4d166655736b82397948bc296719f343731d0f010e3c47e18e72900611581c27b273dac7d3793f4b34c691033110488ca64402a8c293084e14a27a8facef848b9cf788d8328db95f9b9ef2af78ab29327213720b020076da86f4298716f754e596f198007e8e1b00357dde910f08d4275011f570938279000b2fa853b4e372c55fab7320177dfb186c0962c86c98549e5fb0933a4eeffe3cf5e1bf5bfadcf7c3ff0ba00c4f1a28fe2683e009005f1cdcd10a4", 0xe9}, {&(0x7f0000001a40)="aede2daacc6cdaf49369e31e01e9", 0xe}, {&(0x7f0000001a80)="b3b5c0c4e0c8079cb1894ad27d7330553290f87b9daefda698de6fe8061364e8b3875519cbb6dcac9f2e252ab0ced23266441fba", 0x34}], 0x4, &(0x7f0000002780)=[{0xa8, 0x115, 0xc2, "6a423912ad03157bf5602052d8a4bcfe869cf8b8d60b11fb235f01eef53978977440e7217dbae5361d46b1eae1fe4d05c71fe584c1bd9f03967992379da99def3d16228692b979ff7c95ccea40e0a77ff6be0594d690f783823b60189c54eb7b02176c1988d3fc7e3e35e781e2f63df495cdda4c6266110d77e3251c8ca7a90796744ba4a46c808f36a2082d3f0f6bedcffa9037"}, {0x1010, 0x1, 0xb94, "c246fdffc7198d4cd0c0c87cedba303b92afc75af2cc43b5f4aae46b6ef29180192e2cdd1c775cf7231efbb4bec7ccd9e183122d8bb043960064cc3a8ba1dc54f0456e4715d7ca15038423f856275069099b2f8dc77f55079f3746269831aad686fbaa507acfd3acfa0bba569cf8569326677442026c4daf708f25e1feac34a66ec7136c35244783374c562e356b43f4679112eb5f6e1039a0fe7db113418997d9d06014b8d45cac2ae4a2eef65136bb40f93e9d0cf15d4b66e1ed03a364783b0bb85477340bc72853724c43dd1b6cd3a50378829a4b4f23bceab31e15d6aa8a5ea600ec51eb30754da1704e4d1089f42f3f6f1a9ced264f07c3263008d40925ddf9f21bea92b43fb97cd9c3202b8097585ab86d751673fc6650c8b05e9dbe87187bc0b7e8354145d54bb41c93fff2447b9e6a7b1549cd57af551f7293704d8d6f0e09dbb2d4963fa03409bb3a6e713a70e6051c179217bacf0349149be60ab8a8092c357f944d66acf3e555d4775e55a2f2d59fe4e3b3f2ade489a08a4fad165707307bdfb4f69782ee025536303c2c220b761112ce02b66b3e5fba16e9f3980d3248ef97ff9c356350cd50e47a85a85137334217fa9adaa881a1662795e6a0fd790beca1226d52ab8734c5a75f62ffd804702b824606eb875561427c55b2e1148c24f63d7f816d696ed4951d63dc71a9442ac1a9f1eec7efdfd80ef8eaffc70b52c502d316eda2e5d3ae6611af54ffe4e38ec9abe115367b199475170ba682aec57441407195b1324dd2aaa79b925455f3c7221df942b828fa6841c43d0789b9c6420fe796d804f9b8825f81ff5e1c8800460868d156f268434cc793628433806de5cd35a4dfe77b977f36cfcb219d686f641e01c24a4111905e534766f77784cfd0f21641dbd610a998486756288f996934bc2c224af6fc4e288ef712852d7291538ce9dce3063b8f37b6e26653fc333dc00f6fed063c6caa7765818f500ba4fc87ae11eba695e562d73d5f7d280c0871bc0e59eed2dde1d0693272db06d1c7ec70a64fcac93d37de8396adc0491973267783654db8216ce71fe8d6a6fbb6410a58e396069d19ab92cdcf5f2ea640c04aefd2f430615483d2d652cb8aeb5fb8385ac3d4720a69a9c75d719184df4c8527470e8c9094519ce56be8815225f0fa56df190e4e6f905a9949b5514e3136c829e0dffc0de5dfc820e98a348b243b167a1b309a1c10106f41076df213f9dc8e38da5ae4a9a145384348ded38e53391828264c5442071f8cc6adf2533aab7216ee4be53be4988a2b301b2cb8b4e4989ea345e791c362ea2b060962fc684df51478ad6b1e0097b20984a3d29ced1ffb065f723fa4bc54b33051ff4bdde0e5f3fe7a9b6c92c4dd54796f02618d0c94801339ed9bc24f8554cbe426a063af0828dd3dfd83745281357c97989a80a059564cbb150f8201821c72393804635c4f4ced754c70dd31e0459a4df8f56445cea4bacc3691f461820ddbb8987eb12d89c4632864dd09da5d92be0a09dac74366f3d8aa1e848d0dfdfebf707b884b5dc4cf352518880afc155e6f32a741a051163c888e2bb4f6eaafcab37786fa3a888a081ea543c612b0528c2904b71e799996a7a1027a1bcc795bd3920beef07965e2a82ce04b444697fb301af407722f5ac3643959fe327b14e99243ae8f9d2b16d16c98e4acadb8e7b5ca2e78cd9dc4819ccd63fa46e310fee7134a89ba739dbd8a876a6a7e7302effd65448ea547b2d45869c3ce6cb2ad6d9beefd12b769b8b69c2ee948f519be0d4682a3f3721db3e8dd7bb931cae6605858bcc4b34d7b00d39d8c940dca84fc893eefc7e99fb993b368f34975235e5b83c7c6a8728b57728d52d71676db907fc63e64dd45ea0a5ab8ff51b0d4cfb3a7d318957042a1b79a105dd91a502d83d1462f69e5df59522f461405d98e08ae8fa716c1f03d0206704792d78678601fe4573e339d8ac9518525e84341796817391c1afb54877648a358e51ccfe91106ab60caf7b9fef36f429f56ddfe0cfa5992b52755c963aa59c060908c8e1a39fb4061f4b1b22c39c3285051e8e6b41447c9c9f7250b35e5c0b0bd5d2b063d552a8cb143205693678e01f0f7a3af91b7d3b60a0f8a2bf281f8815d476e580eb4a89746f8c61e193f6f1e9c4e3ad22f2f87dd20f77188ac566f8600def1f3669ce9e7f80a62416885ea6920cea3ec064d6f41503d6e41c7357c9a78a7666ee4e1b62238d84135aad41964070d651003129ddf051b094804e54db962e0dc8eae5844062809942d09dc2158f367aa942f5fb0845463a1a31ee4bcae7e93017b25fee5e06fedb00fe932664c3feb4da3bd0a558166641aec35097b7f0ee94b6ba55672f197aed9065d613d8c094cbec6ed6e9e13a95e8a6834873fcd066e8b0217950455a714968870a54baad79d191ab9ce2fe5f02ca7283927734cb358708d2a7a26f81c552129c2545e594765ff2e805921a3e784d62b4483e0f3e4992484fbd5fe6ab23a297f3364b05245c281c8564130bd80d83b75aeb66b85f008e71f7fdce86f92ea26e955491af022ce41eb3949ace7cf0b55ebfcdc22a7f3a7380d6b7a4f5e3eb581fde60ee751f2e26b35da978e23be26d553ec148cd00136f7ad061dd0aa2587befdbb21983697dd9a0d5994b89c5fe5cd487a84ddf4f580fbb75fb45b3ac3442a8a42d777701772dd769f835a69a73695239a41a5f49e1601c37e4d8a1cbfca425fd63f63337f5f9a203b59fd460a2d1e1ba715fc4deae2660ef4703fe54312446ac286b686e10c47190bc624ac6c6904d38b7715923dae24927bd9b2862424c932f28bac9934f69ae9f541b4431217a9a89f0bf7b63e6435e93f8704816edf3ed51fb4c57f49c197307e5467b39108048d2a8c2510e3d1519b01518292b1328b68ae72dfbbd7d8ef9b34c6a6b167b7f65bce15fad84e4ed47f4063d65d2bef62e8528add139f9757c9c53e305a6ec9e1737edf904598603b7aea832ed41c8545ef935c33291f3c0826dd8dfaf1a296106b532ba7981488d100aa427cb1a7c12736cd64edfdc2986d0204cff5ac783185f1bfbf72f0187ee0c15855a69341e86b40f7b4a6ac01042605d61c2d8f37c913464524f9c6135bee48788060264f9e5a28f8c96defb59477966ea5f59448e4b6624e7e35351ae3876d18f1a694991c78ee06f2c4547e8a51e19cd15a19eb3e10ff3b6d0bba828062403f68334bf1eb1e0709dc970003fd2a2257de9aade0f947725c5e82cbeed5c4afc583aa0fc8289175337537fcaefdec0b6a303772be595bc58f21be9314476519165abec20788e1b8af2c6f423e4e7c55d86106bee2011ba76c337ec2acc31c529fc3a8e395974814d82e31d508192891bc1b40aead58faf4a5fee22332065b8803c5fd8ddbc98065b46e1bca6655730a4a562a4bbcfdac2312f00ce1a4fba6d87c542e3461f92f6cffa71064d383b3bb59e67964ba173c58558484a7e3f9b22d22a6c75217f5c6cf68dd5a90a4ad6948dd311dbf0b1de7d5add5bd6370b04cd74bcae0b8d8726ef83ac6ef4ca7f75a27f0725b4eca2f40122fabe6636b804ed02f26ed1ae42e9ee73f9fa08a1a1da09e9a3dae3d781007c51d062a81e3690b1f9297c3ddc0256309f913e564d835eecf75ea2f1678cdfc1cec480874abd28f68e41db75b97888b4d503bbaf38aae315b5bca9dd1dab03180c3a6e3ada67337bbdcdde3759d20d63a5c31b3c78344f49aa707773aeb992572a1fd3f15a759b52ae33eadf2e139c1a86685b9b9fb22a28f4ea9776445d2244e7baf4669183bd4b36e21b4553a1fe6ffadf004ac79fcc56c17adae9cfd436dad4b90eda8c50efe9e3e87bb96eaff06cfb589ada3e3ec208fba1d9869e9276019fa10756f1975ae138a59e2c4813253b53a9bd380fcdeb350a6407658ea5e642eb8adb707ca87b9b27d97059d36367038c7d558e867918524ec5cb625e3f875e30b3965b4e60965181efa63fedcd338ff8f8af6df165b007ac5882b0bc27688b2882f48004860a207c01b7ec933f0bb020eb09d86fffcb32c393f36a399a788c6ba5cf63d73ecef70c48e168fbdf8b83b5c5ba7e7aad1968e99778bc36ee5933399defda19d47f3ba1e52163f627c0e58e7d8faed1294641f5a1ab16c4b3cfe50ca2518cd01613bb8ea0d6c7eed268ad47beaf185b79491ad1575df975756c652322cb2b070954e6430c0914334455845dc7d65f6c2eda0bab97f3669efe4f3accd97ace0a93f742355b7aa7433698d158815dbdcc48c80f96ab5a59fc22d5666a5477c787ca3b730a5d475d75219ca64d6c8118b8b7e421298f7fcbfb4738fc5bc4b7c3be219bfa8cbb4aece1ba9c7dec066ca0a614f5143493bba6f1cc3a8e6d54dee669062324b44a640047e316fc379777ceff7a28793791b6949f97403eaaef51408064dcde35327591bd2388fc7665ae6105a138b89ae72cc8fa0c5bed54187dc8b50b6f129265c554be9d2ef8d477f43d5d68c1768a44e688f0c5f98fba1ef4da5c0a2fc493d127548f5d6894f8b8518a27c32bc978388df462f1ea64e7b5f9897f9ee506e8af8ea7db72e902284e5f335f46430f66ba7fa7cdc59b8f9431b920d4f771883f8667217a2b08d5a328650a8024ccfc2cdcc1cf04657b809c5ce7ff4179940ef1b1f0adfbea82d0457aaf3f574410fcedd5370721bbfc715f4c471d699891c819a548ee6bebb42444e6aee602702a97ac5631e98f67cc3c2ee36d5e3801063dc9c2b003ba27078e381a8cdea4543b3d88cbafe2b62e35f2870317e4677b154052b7eb8a07f69accac006dd7b9a8c71ba3f094c3d13471c9a00cc0ecc1ac02ba9841171a862d8c44d603766f2e65130b6b1526817c2728578bd8f7f8b357993d78423179c80c862a7ac3e764ca274cf368974b50ff07d9d43ab82c38c8f6ba3802599189c3fe75a03a9234643698f7de9e515bc59634b612a018187917de81e4e4882e75df9ebb2a0d23e09a5a1b497729ea9d3bd54a100577f4b5451093e04bad03a4a0916d02c33f3b6543789a8465564fab6613684fb5f30095a638bc3a6408f6f97a4b87305a3935aba33c43943d601d0be7dcab26810dbfb4a98a09b26fe3270d7510184914bd8c9129a6f000ace9141cbc269f8d61e2afe204a8efc7458ac019250442d4736f081bc0ac5bac4edfc273e6d140e2e68163d41bf9559343d6eeed867e7db25dd01cad6701c6b0375e53e818d6c0bbe9a9a4e9ef755199c745cf256e7483235feef397f762dbd0d0cf3ee6c101084b3109cc0467d997057225de28f87487f44039e91921d9f1af551f3f228b861febc9b8a86ae97f95ab8a3463b61a52b53d8a9a944575e1d9450c39cb112f4bc92e753901fe4ca489efed48414f2c893ddf08cdd98eed184c5d58843af807928bc1fa7928b4e4d25d916d04d4f786d90c6a77f45243f4fc8bbb911e789eb74fe716d49bf25670aabdcbd3b3c73e8612e580d9b972ca34ce46f5ef3ca4e601da9b98d571a57be2a33b0ef25ed9c21896b96fc2dc81ef4958c9ecb51ac1d74ad100b433bfa62585693e23b5e418a0efc2957537dd2049e68c23ed3f9a08c86cee3aa9e1413d7ad56807f47a0a1e57a23fde5ee40426839e33b08f1282f5b1db9caa85aa6306e80f72881c2388bac8fec79bd4e7316793ce0090b2a962caa20a3cf641a44cfad5eaddecbc47963649b8b91264c1dd3f07895e82a106af6ae532318b1cb953828d08cd8b06cd4e7b34e92bc1e399391066b863e18d4"}, {0xb0, 0x118, 0x9, "0ea0247e3d2746fb215b4cc06182c0c8cad9cfb8dda3c2fce60aa8dcb9f2f1a801cdb5bd37e7090294cee7e45fb0113f87c9cb09be424f5be50f303c022eaf8ce6ec7eac8ae9292e2e155776eed5ed810d6f8e47d37a055420a3fe570e66f62c3723827f5832de5ac143c22d2116afd695b4951c8fd6b83c2eff08d9af92672f791d9d3e04e83c056978de875375f676de26711d578b4ed9e16ca8e3"}, {0x78, 0x10f, 0x7, "9e2ac1ac61e611df4b28ec7845b1ec6ebf60c91aa3fba82564b15739d13a3d4899840411077ff4411c0ea61d7a18e140a9b8e4f2079650c0e76b71e8ceae849f6d5c4c969c564db0bacfb89ffe4ae5bd60c354c45f166f2fd654d88304f6953a32"}, {0xd0, 0x105, 0x8, "c498327839ed4a13adbf1e1e4a4e7970c9129547083847b0d42f929b9aed582bd25188aba5b3a6c3a3774704a15e6b9314a7bd17d470d8d7c419f3bb8d25d5bd02725f716ddeaf8f7f330e7c7f0d5cbcb420e94b53a398118e1eb5e53c5076724b3a1144c5e4acb7c09e8e5f6efbfdbf41f94d12f4b016603631bc2dff5b1c6982ae62dc0753ca968741e0cc11ce9c50a5cd46b03b7503f5147a1701cc3732f83f66ab010dbc9e6ebc6d294dd9ad80420b27ec4ab04a6ec644fa4e26f869"}], 0x12b0, 0x4000010}, 0x2}, {{&(0x7f0000001b00)=@pppol2tpv3in6={0x18, 0x1, {0x0, r1, 0x4, 0x2, 0x4, 0x2, {0xa, 0x20, 0x1, @local, 0xfffffffffffffffb}}}, 0x80, &(0x7f0000001fc0)=[{&(0x7f0000001b80)="ce046d8c4e9c8f5dacdc9e88d5a5d40b3bf13bc70f58f423003db78b6bc885fa28d4c3bee50383bd5c925902387fc2b0db96a8caf2d12c7c44600e93bb1df53b8fca2d4a53fa2ab95b93c82a6ff002f3d64759dc149a58e3e6315e4b74cb800f5de7090534a9324314d894cb911771afcee737c7067e8348a9f704e053", 0x7d}, {&(0x7f0000001c00)="4914ebdac9f46bd8910a1cab40855c2e61da805de3231fd29ad0df735b037a704439efb9b250714406c2517ecb90d31cffe38e429dd2e2df2978b0524775d6627e9f15078ec4e34c13a1610493266ba894e77b64d95329473a644e381622c3f09dcf66036d35d2373fd79075dbec7224fc1bcda19461b3eecb7e1127f53ce741ca959d8962f3ca57bbb16cee91fb851299ddab8a06677ed00765c090906bf594f2a7632395bedd93915c8a4d27c11636b5f78c62bc2fe8401e20e61e614feff1862f6e2ccfe96667aeae38d0001da62afbbd6ceb0eec2da3f348dedcd82e0e203d", 0xe1}, {&(0x7f0000001d00)="a52630a0ec1e790e1fa45d1baa4b3f34d88531dde9c77e586f085e75512d53cadbad3b9b1c19cfdca56c56206e6ee9a8dc3c54dd456fb9ab2b7493d9ae6e373d12030d6a263d68f1017ab960ac94af6104ec62b60aea6e083f691f328afbe04d849620f4d4d98f118878320361d9bc7f893c26c054666bf78bd40738ba6383cc09a69ad983af67434d903ac5bcd5015e42d3e1d345fb75fe324816c0fda99c0fadbc4dfd9f16ecd86bf08b0d3a34e45d8572010140e1bc40e444198e688c99a72900c800b19798c780", 0xc9}, {&(0x7f0000001e00)="97424cb8466c5f8a625ad590ae6c720a16de463c293c3b06892a72275d7db4d337d6c027b8de0b93ce8b39b560d19a752f684abb889d49da7f91d1b381ac3a4a1279edd022994a30dea3aae4d7a59e85ef6d0924375b438e7043c9b7d731b93a0bf9f7459b07297ffb2bad8bf99aa8e6eb9bb83ca307f5af700d9a299c2e676a21074a4bd7", 0x85}, {&(0x7f0000001ec0)="9c8489ddbc828a1647b59ae40a3730768e9fb50020b019ed19c2c2e7cb08dfc9ecd9bae274ee597c174db38574f414b7ca7012ac7ce80369133ac167f0297934a96323c347c8017ffeab8eb4afb417e8959679418e056515a38cec39e28f9b77764f68334e415209ad4f3b732169bf14a2a1e64f6750edae76e3f173fb52480264ffd0afe9436c8d55fe46b9ee18a49e62f2cfb07c21906f26e380db9ddd2b07849b52686344bf7f68d460221b8336c6443b79cbb0e6e33452daf35022076d513f3f22611f77412df1759c828fff2ddb8c68f1d1a6eddb537d7ccfc553209b61ae56612a07c72340697a25c62f026ed82e34fbad", 0xf4}], 0x5, &(0x7f0000002040)=[{0x88, 0x18f, 0x6, "57aa4ea58fe2d0f072070bd3131593a9821a9d346287ea72693c151a3e0df724087f266a1b6d8c9e9506a3fce3bcb55f4fcb0fc7eb01f590c2c8d15a27831c3e2010c1b2d74a78d36bfe94a0721255253d0028ad13ae0c93a0126a22d2049fb9aaad37f01184d970d0028370510660f1ac80"}, {0x40, 0x108, 0x7, "137b0d9972246e88a712fab0fb1a952cccb2cc431d3f24092862565d898dd0ebe99ad7f101f992e18e"}, {0x48, 0x1ff, 0x0, "e5951c8477a8017b5e0fca754bc0ec821c50eb071fe8d806a3dd0ffdd9703e2ee2efee8a903561f8a03e19f7f231c3b9f9"}, {0x28, 0x11d, 0x8001, "2aa2dea53b963d6367e95c7e4316f50cee12106472aa2a"}], 0x138}, 0xfffffffffffffff7}, {{&(0x7f0000002200)=@hci={0x1f, r6}, 0x80, &(0x7f00000022c0)=[{&(0x7f0000002280)="6412b328a5be869f279047affaf7b1fa63a43d9897b7774268c1acb86c877ae3b922964f3e52f33025fcf012a7c7177063ae", 0x32}], 0x1, &(0x7f0000002300)=[{0xe8, 0x18c, 0x8000, "6ca578afcc6f490be9d4df06fc5d0196ef43b8c400f3848eba165a28d79be2d361a12494cad62fd68f8be541a307d4f10b0c3da5b88180131880065ea8851a04fcd6bc3263521986a4c1ffabf7ff49eec0534e543127198f51e2aefc79eb2fb25f7d6f98ee6c1fb987f0e74a9d52d8b6f71dfb938cec82041275c2cf881dd6b19e57d72d97abc0de89e003673b022f774dbe61dc01da78dc329a42627768cf003e3517d2c4ea699d2a22e361bfe6d5ba0042f3b698c352688fa1572a741d0a723100436a0e79dbbf33cb967a0223ad8ad9e22b14"}, {0x68, 0x110, 0x7fffffff, "ea6b666942a06f9152340463ba2d0ac58a1208574a250646b8a5722c45fb79f84e21fc54e0ebc706b8ad0d40912fb6bf3e7201ac1babaf2bff6b38a0eecde85ef726b10b8a1e2877a1ccda261cdaafe65a"}], 0x150, 0x4080}, 0x7fff}, {{0x0, 0x0, &(0x7f0000003b00)=[{&(0x7f0000002480)="ab1fa8c78b8520cdc32e3e4eb90af474ccd940a3b4587a7751424560da6918b26f9c7868ac35b301755136a38be5e0ad79129c64a03862d6c715f07300a9353f85ede77d26c474050b08a45da0dfc9df3543b2f7b51c339ce1cf5560ee4f605de2dbe654aadbf43b4265b7ae3855511d8f201ff1acc270400832e03b2f24049def307d47cd", 0x85}, {&(0x7f0000002540)="cdba4e1da5e0c36b33", 0x9}, {&(0x7f0000002580)="9b9a597ddb8730d5194e4f687f1dc151fa1cbd7fbc3366b5a84464facfd9136d1b3994be5397581b4c87797d9cc58e349dc34022f493ccd29ee5a471efa91f6548cfcb8704cff9c393c9726717c032bad24073ae663051e9318c9c90be6983cd86e924593862a1ff93d17caae61f92e85939da96a393a37f526647f8507ca8a188148ae03788ca90008e7699ec7ba6", 0x8f}, {&(0x7f0000002640)="414f57573fa26271585c6b349d6bed3aefc95b9e29d2865f4681d10ddc729477c8edbb08b8f747f1b4427d2aa668fd3addf50c6ab12a78a5dca09c68a604113bc1f59c8dc755aadd0fb4ac370c0d6e392cd6e93edea3deeab4cf8c280f8b106549612852cf3213e61c219882bd6ac9d238c0cb9d436bf3577f1a426127164f7a233a8143c33304919b0dca5c1f9ccad74f57c11fabcf85a8839912a19dfdd7b963b7a2b5563ff10688bc70535e52870652e1791f07e9dc1017a4b45ab8994107", 0xc0}, {&(0x7f0000002700)="7ed21d711da355932c57e88ef57e62ff26cca83a1cf702f9010af35fd9", 0x1d}, {&(0x7f0000003a40)="f38facc51ee485013045982f11df4cc3e88f1d77a187434d31686fa840c29720c8b7814f3f007745082756dceb2b7aef4625270159980a68f652c5e38e07c9f07778d8b9e10613218942195c19729479caf770ad28775f6126f132ee1e07a1244ab86a346c19a879dc0b5a5d8bb31337e2eda2bec2907f5024a0b942213ba22820e26a88be972ee1298cafc4733c107618c5cfdb4826a10e80ffe42f3ed844c970fae44bbd37b55ef558dd338317050ad6a4b18365ee7ee8b0b0ca77be", 0xbd}], 0x6, &(0x7f0000003b80)=[{0x58, 0x11f, 0x1, "fa6be982f08663f5a477ecee9a2b78d20f209cc83dadcaa07c4b341ee953339b85de1e4e54eb6cc1862273547d51044b753b9666dc75ec9f16c7dc0d6e252cf39771c0160edb34"}, {0xd0, 0x1ff, 0x42a, "2e021c1277ed6c97b03f73c7c6671a8c4b4ac1a7183778c3fa964f9a92ab412f56b39dea5773ebc3d9ae07e83f2b92770caa358bec33b3729c5236af16281c494ad6f421c8dc09c8794778fe3f29eedab9f9ab0506241f8df71a9fdb0b6a77844f13171ffbb3ed908df332ea964051f368c9cf3f693cbe9b21268c60f8182f100cc1908aa4cbb5e8fd1e0c34e4ae7a9a7389275dd31d04fa6a19f578b492d12b4e8f92199bb6f5be1e04a494fbd09b1cabced9a6523ac9bca3b009"}, {0x70, 0x11d, 0x2, "64feb093dbbde03430054abbbeac5c3539ce57d50622e181587d07ce517e93f0472854a3365b4135611e6f382868790b45df90aa3926175500e2bcfa0dd4a9e3ece8af52adf3e879983e1ac0c7d1a505d9b84209e5453938fd"}, {0xd0, 0xff, 0xf658, "77e96a72aba0e3587ddf22b2cc31a533bb3e3c2a8fba8d1d784ca2ae328372feb839c1eb5d386ef9447870ba09101f07e16f29f9f9234b0e4b766ae34619ca518f9e85a9ab2187f206b2731bfbfbdb0eb92aac49d0e360f37fd7f73a9921dac20f9fbd3539f0ebcabde8d71b26ae582f67e5cedfa2d0d7b0295e58f6cc08b0968073ea111f126abf56ae013f3f47bd1cb205a5696608887bc7798116ec191f3b8388914b922125bdf98e88a3d6f55c4bb8c47fed3cff19b405"}, {0xd0, 0x105, 0x7fff, "6b86b7022f5d68053be65fb028255a38e482f35afcc3cb8dd9fb93bc179db8f58733e7fb6fd55cbef8cfee7631954438ba65f5e6bbf939743e2128339925a4beef10898fc2e0659d6551480095ecd50989727cf1c7a30c164a3df1bc4297737ac610051e825ba912e2066302b9e63cddfed525da91f5b8e481d0783a932cbaeba0115bc3d1460cb97ed9c40c81e6522393029472b6e0617b043a276d85c5d4e2d5bc1614651b2a2eeaaf4af60c5975b25601ccf593372f501a65d7460a20"}, {0x88, 0x11f, 0xfff, "271bcf8701301bc6584fe3a2332ad6870f0f1bcf74a9cf454617e8a00d77e5324e4b904a21d637eddba6f7ad95d7bba3d7e52b4da74b0f1c1daf6f525d359aefb109142297d7063cadc04e620d9a37b6facdd4f333df36bcbc16a074d436fcb94c711a09380cc42d9154d3d30d52d38dceaa"}, {0x108, 0x101, 0x8, "c8904a444309b4f2a2ac8d408f1c800909ba409cac8935f70b4542b2dbf5fc0d829cc183640811427a2f75d3e5ae026f43586490fa4b7c5125579ec5a7cbe06aadfbee6615b2739095a801db56ea242336226c18923cf5eb58fdc3775b1252d9922dacaa6ee3abc1f0639c63da8f6107c95cb15cae0330cd45d3eac4fb116e04f138603a6db9b6331ad79d30b8406da704c0119c2a02c6a0783223b70ecc0ac2ff9d2f05e44139bc659f570ac2c41e0f223a2f51a742ed08c58311c201aac37d12d3432fea0abcb40bf07723c0457c07661f66e6307024f32642a942c6925bc28ea15458536900723e593c67b2843598b660ee56"}], 0x4c8, 0x4008000}, 0x100000001}, {{&(0x7f0000004080)=@ll={0x11, 0x1c, r6, 0x1, 0x7f, 0x6, @random="b9b00e324543"}, 0x80, &(0x7f0000004340)=[{&(0x7f0000004100)="9f4cd5ae8f30efc7350cd7b9c89b5c9855407ba5ca3701635ccf54835e2e3b2852062be1c08adfbd94ab62c519deeb1c169aafd7174f85b88b6a18ca89c09b74b4182729cbf5e16f3f6822b55eefdc6b9e66b07b1f3cb774a2825dea0a1aac62145f68ea6daa43a8109f8c0726e87308d87400e6701ebae9f8f489867a618399d6a8abe819c30c34b72ac4ac6c3e03d857736a060d9e3b5c6e1f28e0483d0ce9", 0xa0}, {&(0x7f00000041c0)="9c63ba1b84deb795e1f2cd2d391b75f42b9a2ef0996c1afd66f6fe37f8d80d4b3fabf5565e709a1576fef6b877dc676285d0e6e72981adca6cd6a52e4521a482cd1f243dd3470d271ecd724e65a5860471e0d19ae6a92add87dfe2e647dddb2b1fc05088156ff2030ddcf6aa7b579a1aa9a2c30f2584f123772d9dd15952a2b196af0244c591ee2428576c800fb521b08c7b4e7d58cfe6c6578daa283060204ea17ac4dcc648a7ea22d4440037203e4e1f3410", 0xb3}, {&(0x7f0000004280)="35653038fab160cfa677f2f54eb18b595184cc2e627e3c5c60dbba0fc548094fdc7ff6b522d6da1e8be7917c1820953fe319adbd9dcd9c2b139d974117878390ca7d9d3f9aebad463b1e2c", 0x4b}, {&(0x7f0000004300)="9e36fd8030a9a5ef69987d7981e136a5df80f02699d32b2e67a6d42b284572cc2151ac88a56bb610d322dbd4ecb8de180e6c3ca5d8759b25be5c", 0x3a}], 0x4, &(0x7f0000004380)=[{0xa0, 0x109, 0x6, "10d580ed63928b92a335ffd5f2d1a531a1b57d50b042b97cd048bea6efa6e4eefe48cc784d001f4502facadb024ec69b7e4a02cfc19b8ce7fc0076d80827bb2e8e8b28918f77b4fc4c5d7647b90e019f016e2f2efbb4dadb53db8a86e7724b083b9852536bbd085189f721090722d33118e4a084f5edde4f23d86ca022ee2ecb959307a04b4c422af7b20e5badd5e3"}], 0xa0}, 0x7}], 0x7, 0x4) inotify_add_watch(r1, &(0x7f0000001840)='./file0/file0\x00', 0x10000000) setsockopt$inet6_udp_int(r4, 0x11, 0x0, &(0x7f0000000400), 0x4) openat$kvm(0xffffffffffffff9c, &(0x7f00000003c0)='/dev/kvm\x00', 0x0, 0x0) ioctl$VHOST_SET_VRING_CALL(0xffffffffffffff9c, 0x4008af21, &(0x7f00000002c0)={0x0, r3}) ioctl$SNDRV_TIMER_IOCTL_TREAD(r0, 0x40045402, &(0x7f0000000740)) inotify_rm_watch(0xffffffffffffffff, 0x0) ioctl$ifreq_SIOCGIFINDEX_team(0xffffffffffffffff, 0x8933, &(0x7f0000000480)={'team0\x00'}) syz_genetlink_get_family_id$nbd(&(0x7f0000000300)='nbd\x00') 04:46:48 executing program 2: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r3, &(0x7f0000fe5000/0x18000)=nil, &(0x7f0000000100)=[@text64={0x40, &(0x7f0000000040)="440f3248b800000000008000000f23d80f21f835000000800f23f848b86d980000000000000f23d80f21f835000000600f23f848b80e000000000000000f23d80f21f835000000000f23f80f0f6a3190c744240088a42236c7442402a19a83b3c7442406000000000f011424450fc76a218f6890a26d13ae0f3566baf80cb8e2e5bd81ef66bafc0c66ed", 0x8a}], 0x1, 0x0, &(0x7f0000000140), 0x0) r4 = dup(r3) ioctl$KVM_ENABLE_CAP_CPU(r4, 0xc008ae88, &(0x7f0000000340)={0x79, 0x0, [0x491]}) 04:46:49 executing program 1: r0 = perf_event_open(&(0x7f000025c000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x11, r1, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r0, 0x2405, r1) mmap(&(0x7f0000000000/0xb36000)=nil, 0x11000, 0x1000004, 0x8031, 0xffffffffffffffff, 0x0) 04:46:49 executing program 0: mount$9p_rdma(&(0x7f0000000000)='127.0.0.1\x00', &(0x7f0000000040)='./file1\x00', &(0x7f00000000c0)='9p\x00', 0x80, &(0x7f00000002c0)={'trans=rdma,', {'port', 0x3d, 0x4e20}, 0x2c, {[{@sq={'sq', 0x3d, 0xe00000}}], [{@smackfsroot={'smackfsroot', 0x3d, 'selfppp1nodevcgroup'}}, {@subj_role={'subj_role', 0x3d, '&}em1]bdev'}}, {@obj_type={'obj_type', 0x3d, 'tmpfs\x00'}}, {@pcr={'pcr', 0x3d, 0x7}}]}}) mkdir(&(0x7f0000000200)='./file0\x00', 0x0) mount(&(0x7f00000002c0)=ANY=[], &(0x7f0000001540)='./file0\x00', &(0x7f0000000280)='tmpfs\x00', 0x0, &(0x7f0000000080)) r0 = open$dir(&(0x7f0000000180)='./file0\x00', 0x0, 0x0) mknodat(r0, &(0x7f0000000140)='./file0\x00', 0x0, 0x0) renameat2(r0, &(0x7f0000000080)='./file0\x00', r0, &(0x7f0000000100)='./file1\x00', 0x4) 04:46:49 executing program 3: r0 = syz_open_dev$sg(&(0x7f00000000c0)='/dev/sg#\x00', 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000000)={0x53, 0x0, 0x6, 0x0, @buffer={0x209, 0xb8, &(0x7f00000001c0)=""/184}, &(0x7f0000000540)="ad40657ed56c", &(0x7f0000000340)=""/128, 0x0, 0x0, 0x0, &(0x7f0000000040), 0xf0ff7f}) 04:46:49 executing program 2: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r3, &(0x7f0000fe5000/0x18000)=nil, &(0x7f0000000100)=[@text64={0x40, &(0x7f0000000040)="440f3248b800000000008000000f23d80f21f835000000800f23f848b86d980000000000000f23d80f21f835000000600f23f848b80e000000000000000f23d80f21f835000000000f23f80f0f6a3190c744240088a42236c7442402a19a83b3c7442406000000000f011424450fc76a218f6890a26d13ae0f3566baf80cb8e2e5bd81ef66bafc0c66ed", 0x8a}], 0x1, 0x0, &(0x7f0000000140), 0x0) ioctl$KVM_ENABLE_CAP_CPU(0xffffffffffffffff, 0xc008ae88, &(0x7f0000000340)={0x79, 0x0, [0x491]}) 04:46:49 executing program 4: r0 = syz_open_dev$adsp(&(0x7f0000000300)='/dev/adsp#\x00', 0x20, 0x20000) r1 = syz_init_net_socket$llc(0x1a, 0x2, 0x0) ioctl$sock_kcm_SIOCKCMUNATTACH(r0, 0x89e1, &(0x7f0000000340)={r1}) ioctl$KVM_IRQ_LINE(0xffffffffffffffff, 0x4008ae61, &(0x7f0000000500)) r2 = syz_open_dev$dspn(&(0x7f00000004c0)='/dev/dsp#\x00', 0x1, 0x0) r3 = openat$audio(0xffffffffffffff9c, &(0x7f0000000000)='/dev/audio\x00', 0x80, 0x0) ioctl$KVM_SET_FPU(0xffffffffffffffff, 0x41a0ae8d, &(0x7f0000000100)={[], 0x0, 0x5531fee, 0x0, 0x0, 0x9, 0xf000, 0x0, [], 0x5}) syz_open_dev$usb(&(0x7f0000000440)='/dev/bus/usb/00#/00#\x00', 0x9, 0x2) r4 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) lstat(&(0x7f0000000040)='./file0/file0\x00', &(0x7f0000000080)) ioctl$EXT4_IOC_MIGRATE(0xffffffffffffffff, 0x6609) sendmmsg$unix(0xffffffffffffffff, &(0x7f000000a000)=[{&(0x7f000000a000)=@abs, 0x6e, &(0x7f000000d000), 0x0, &(0x7f0000000600)=ANY=[]}], 0x1, 0x0) r5 = socket$inet6(0xa, 0x2, 0x0) gettid() r6 = getpgid(0x0) kcmp(0x0, r6, 0x0, 0xffffffffffffffff, 0xffffffffffffffff) connect$inet6(r5, &(0x7f0000002740)={0xa, 0x0, 0x0, @mcast2, 0x4}, 0x1c) sendmmsg(r5, &(0x7f0000007e00), 0x136a88c8311572c, 0x0) setsockopt$inet6_udp_int(r5, 0x11, 0x0, &(0x7f0000000400), 0x4) ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) ioctl$KVM_GET_PIT2(r0, 0x8070ae9f, &(0x7f0000000540)) openat$kvm(0xffffffffffffff9c, &(0x7f00000003c0)='/dev/kvm\x00', 0x0, 0x0) ioctl$VHOST_SET_VRING_CALL(0xffffffffffffff9c, 0x4008af21, &(0x7f00000002c0)={0x0, r4}) ioctl$SNDRV_TIMER_IOCTL_TREAD(r2, 0x40045402, &(0x7f0000000740)) accept$packet(r0, &(0x7f00000005c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @local}, &(0x7f0000000600)=0x14) ioctl$sock_inet6_SIOCADDRT(r5, 0x890b, &(0x7f0000000640)={@mcast2, @mcast1, @ipv4={[], [], @loopback}, 0xfffff00000000000, 0x3, 0x7fffffff, 0x500, 0x7, 0x4000000, r7}) inotify_rm_watch(0xffffffffffffffff, 0x0) ioctl$ifreq_SIOCGIFINDEX_team(0xffffffffffffffff, 0x8933, &(0x7f0000000480)={'team0\x00'}) 04:46:49 executing program 3: r0 = syz_open_dev$sg(&(0x7f00000000c0)='/dev/sg#\x00', 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000000)={0x53, 0x0, 0x6, 0x0, @buffer={0x209, 0xb8, &(0x7f00000001c0)=""/184}, &(0x7f0000000540)="ad40657ed56c", &(0x7f0000000340)=""/128, 0x0, 0x0, 0x0, &(0x7f0000000040), 0x2f00}) 04:46:49 executing program 5: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x3007d, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000340)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$KVM_GET_PIT(r1, 0xc048ae65, &(0x7f0000000200)) r4 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_GUEST_DEBUG(r4, 0x4048ae9b, &(0x7f0000000140)={0x1}) getresgid(&(0x7f0000000040), &(0x7f00000000c0), &(0x7f00000001c0)) acct(&(0x7f00000003c0)='./file0\x00') syz_kvm_setup_cpu$x86(0xffffffffffffffff, r4, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000400)=[@text32={0x20, &(0x7f0000000880)="b805000000b98b9400000f01c19a01000000b0000f43d1b8000000000f23d80f21f835800000900f23f80f060f2140b9800000c00f3235000800000f3066ba4300b8f1ffffffefb9800000c00f3235002000000f30c4c3295f4da400", 0x5c}], 0x26433e1, 0x0, &(0x7f0000000300), 0x10000000000000b6) r5 = syz_open_dev$vcsa(&(0x7f0000000280)='/dev/vcsa#\x00', 0x8, 0x4000) recvmsg(r2, &(0x7f0000000100)={&(0x7f0000000440)=@xdp, 0x80, &(0x7f0000001bc0)=[{&(0x7f00000004c0)=""/164, 0xa4}, {&(0x7f0000000580)=""/157, 0x9d}, {&(0x7f0000000640)=""/84, 0x54}, {&(0x7f0000000900)=""/4096, 0x1000}, {&(0x7f00000006c0)=""/112, 0x70}, {&(0x7f0000000000)=""/25, 0x19}, {&(0x7f0000000740)=""/208, 0xd0}, {&(0x7f0000001900)=""/232, 0xe8}, {&(0x7f0000001a00)=""/206, 0xce}, {&(0x7f0000001b00)=""/175, 0xaf}], 0xa, 0x0, 0x0, 0xff}, 0x40000000) getsockopt$inet_sctp_SCTP_PARTIAL_DELIVERY_POINT(0xffffffffffffffff, 0x84, 0x13, &(0x7f00000002c0)={0x0, 0x6}, &(0x7f0000000300)=0x8) setsockopt$inet_sctp6_SCTP_DEFAULT_SEND_PARAM(r5, 0x84, 0xa, &(0x7f0000000380)={0x14, 0x6, 0x8, 0x5a3, 0xfffffffffffffff9, 0xf5, 0x8, 0x2, r6}, 0x20) ioctl$KVM_RUN(r4, 0xae80, 0x0) [ 663.235136] tmpfs: No value for mount option './file0' 04:46:49 executing program 0: mkdir(&(0x7f0000000200)='./file0\x00', 0x0) mount(&(0x7f00000002c0)=ANY=[], &(0x7f0000001540)='./file0\x00', &(0x7f0000000280)='tmpfs\x00', 0x0, &(0x7f0000000080)) r0 = open$dir(&(0x7f0000000180)='./file0\x00', 0x0, 0x0) sync() mknodat(r0, &(0x7f0000000a80)='./file0\x00', 0x4, 0x4) r1 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x400000, 0x0) r2 = syz_open_dev$usb(&(0x7f0000000240)='/dev/bus/usb/00#/00#\x00', 0x1, 0x8000) ioctl$SCSI_IOCTL_SEND_COMMAND(r2, 0x1, &(0x7f0000000980)=ANY=[@ANYBLOB="e60000000600000003000000ca1f57fe96ddd648b366aa7993f177c8f6e345cc8481967a01fcb73a82eca32192f3dc44af1c70e94675c8cc9e72ffd2e45c32804c8f079e5d679a360e9fed10cc05bf1313279c227eef170b01aba6fb64c6c2954c1dc9fcaf6ded2518c8124af5a7ddc72c88485f989c02c447e8becd7bf26abe4b71e3fdd637b4e6b0f3a2fefc0fa557647740eac496fb3d88a471e962ccf829f1489de712a47077a65283da4a3c6c0f11b11a87c486ad9f483af49d5bb72c3bbb2030e4bd5ceab96a6f048fe080cbab90881238fc9032956eac93ead719f7725c4f032a5e60abdcd033d1a3f2bdbb9dbc42"]) setsockopt$inet6_opts(r1, 0x29, 0x3f, &(0x7f0000000ac0)=@srh={0xde, 0x10, 0x4, 0x8, 0x6, 0x10, 0x2, [@empty, @mcast2, @mcast2, @loopback, @empty, @empty, @dev={0xfe, 0x80, [], 0x21}, @loopback]}, 0x88) setsockopt$inet_sctp6_SCTP_INITMSG(r1, 0x84, 0x2, &(0x7f0000000040)={0x9, 0x1, 0x2, 0xa810}, 0x8) renameat2(r0, &(0x7f0000000080)='./file0\x00', r0, &(0x7f0000000100)='./file1\x00', 0x4) sendmsg$kcm(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000580)=[{&(0x7f00000002c0)="703c8fe1f70653f8ff02ba87e99364294af357be7ccc927f99b878230ec5756d2adb556725989beb620333e8400f268d1a89dc1793e743f256eb028b6afd1812823d7c83e3e4cb1cc4191eb79f7818e077c86b9e5074a4116bb37d9002a6d29981bb9132d3ffceb7ffc476140b263bd329ebb6031ebecdf01ff520335ddc280f640b8c66d7ffbf046c52af5d379bce37384b69ed9775d396169a373025eca4eec8b43292343bde96384fbc732cd240257d81acee90bc9952dd62fed3fb7de349a306b14b390f9c31", 0xc8}, {&(0x7f00000000c0)="fc72b9be45f87e9e01cfeee6deacc9448a39fcfe2438cf7ba2aa1c8b7e5d7d4df02ec371624c9981d06fd3d376ac733f3a2e53ad1f4855684c6687107a8dba99", 0x40}, {&(0x7f00000003c0)="ca093cd17c567fa770f35c8499f320a8462b4949e594f0c458f555362014179e5dd0cd71691c35b8357ace3e5537e3a4d5e244d9db0e2a676ced0a5c63cd5406e0f42d03dbaf9168683921efc9ed26a3d41818d6273475e0f474530b0c8c4f0766e6cdec99f78ba731af6e62160cb132d723f26cc3318e73d08747fda1283b825530043f231bf73241899fd4c2f2efe8969ce1bd02f9d1988b01e53e06563c7c7ff9a20f0a68c2175f53594b1ed45e6a7aed964d800b", 0xb6}, {&(0x7f0000000480)="e9fcf39cff4c6cc4a681ead4220d8fb793517646a6a9d7ef3df47c4a84a448c845be35610825d0ae2980a1a6f2f550312569e844f30555cb786bb112c4ba506ad3dd8568a6e06896", 0x48}, {&(0x7f0000000500)="6ef27a3ddb0bf071b446fdb53d3fd6a82c11a41d51d1ed34bfbadf8222ae1d0bc4a6eb6a1c970a16c8dbdc64faed1f008301d6a3703746aa2013763f1d1909a71136ef7636d4a0825d02b07dce5131bce4d2b5e461683bdb76b3808bcc1f0c7094a301075f", 0x65}], 0x5, &(0x7f0000000600)=[{0xa0, 0x114, 0x80000000, "279394b3a14a571cd8c0f2adce845618d166277249890b265494d76d81c306ffc24f05a3bd8b616b08c80e654d5c536d76aaf6b462cf09fc0e1501b53441de6791ce5f17d05f29fb9a3ea4d84c509fcaa42268df1c26f9db747b29b20d51ab22cd9324e500d47e42770f27895e69e1f978dfdedff56687f5c9be77ddb334da2ed3e66974255b71c6457b49fa179fa3"}, {0xc8, 0x11, 0x1, "39ecc9b0a701176fd685306d2700bbfb36bd74a9fc008bfbfe9b32bff8b7dda75a7e98ae6ec376e879155806f79f4dc64786a1d0f2d4aa1a1cab85e54e66245f666e71f377be00f1c38f3952efb97a860b22ae13647925d8bdecd5cf965bc7b61569f10585675afcb5c34ee047b8b09442022c3f8a77c5a161d308d92dfbf2ba04cc88ddaebd85bf7083d616dd120649c2db4930546f67fc70f46daab2044021e1e48c81d13362eafd02c0ef1e1162f5e2ee"}, {0xe8, 0x11f, 0x4, "bd30109b7edf129b2c69668045627b31a48068d52848de635732f8a7f3c466d914f0e58c573b7a8579c51de64ba30374c36186e71cf7f28e2740b492f9badb403211967b2377d4c93ca03bd2dba5d0e96a3324c1ebbe37b9aac04dcbd717feeff9efb208f94e45c8d0ba33fd3ae4c9650728fc248ba3bff49c5161594b0b4d6ac631f899658a433f7ef7a1132cc5b7fd0976cbdd646eb5990be134447f4fa4f7b95db34fbfb782cbf7c5f2ac8fae197d76d3212e98f0f083f107cb8b29bdabb39db442852d152de7fde80bf31b506d190bc4ab"}, {0x68, 0x100, 0xff40000000000000, "7a7ec01ce538d1d0374c6b202b3dd1602d52792f82d993ef18c932db41e286f3b705420dbcf4192ef3de0c86f9e91cc56afe95f297b178c29eb2ef8c6bb6100912012cdc280b2d68faf084095ecc2fe8793d42dfc5b124"}, {0xa8, 0x113, 0x8000, "c8c68488c0ed3f1014bcf55419e40b5ee71aed1cf6321cbd62ccb7194c121d41756c0e8ccade8fc021491a8e0d17824e1ceaf2c724a7afaf9a842fad87dce4dc31ffba76a65d1177bccb1150c8b3c049973ce7dee788b4d2fa7751896936f6407c84668524709012a26b7f0a9f2d77d25c4bc0427ec993f8b1a5468cc1d8f46ccf9c5b67d9fc065fd183c80a72fa2455127802bf4704"}], 0x360}, 0x4000) 04:46:49 executing program 1: r0 = perf_event_open(&(0x7f000025c000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x11, r1, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r0, 0x2405, r1) mmap(&(0x7f0000000000/0xb36000)=nil, 0x17000, 0x1000004, 0x8031, 0xffffffffffffffff, 0x0) 04:46:49 executing program 3: r0 = syz_open_dev$sg(&(0x7f00000000c0)='/dev/sg#\x00', 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000000)={0x53, 0x0, 0x6, 0x0, @buffer={0x209, 0xb8, &(0x7f00000001c0)=""/184}, &(0x7f0000000540)="ad40657ed56c", &(0x7f0000000340)=""/128, 0x0, 0x0, 0x0, &(0x7f0000000040), 0xf0ff7f00000000}) 04:46:49 executing program 5: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000480)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_GUEST_DEBUG(r3, 0x4048ae9b, &(0x7f0000000140)={0x1}) syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000100)=[@text32={0x20, &(0x7f0000000000)="6601669b0f35c4e1fe16846ba49e0000b9940200000f32c4c23dad78e0b9670900000f32660f38827f95b0040f01d10fc71a", 0x32}], 0x1, 0x0, &(0x7f0000000040), 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r3, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000400)=[@text32={0x20, &(0x7f0000000880)="b805000000b98b9400000f01c19a01000000b0000f43d1b8000000000f23d80f21f835800000900f23f80f060f2140b9800000c00f3235000800000f3066ba4300b8f1ffffffefb9800000c00f3235002000000f30c4c3295f4da400", 0x5c}], 0x26433e1, 0x0, &(0x7f0000000300), 0x10000000000000b6) ioctl$KVM_RUN(r3, 0xae80, 0x0) 04:46:49 executing program 2: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) r4 = dup(r3) ioctl$KVM_ENABLE_CAP_CPU(r4, 0xc008ae88, &(0x7f0000000340)={0x79, 0x0, [0x491]}) 04:46:49 executing program 3: r0 = syz_open_dev$sg(&(0x7f00000000c0)='/dev/sg#\x00', 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000000)={0x53, 0x0, 0x6, 0x0, @buffer={0x209, 0xb8, &(0x7f00000001c0)=""/184}, &(0x7f0000000540)="ad40657ed56c", &(0x7f0000000340)=""/128, 0x0, 0x0, 0x0, &(0x7f0000000040), 0xad40657ed56c0000}) [ 663.620924] tmpfs: No value for mount option './file0' 04:46:49 executing program 1: r0 = perf_event_open(&(0x7f000025c000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x11, r1, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r0, 0x2405, r1) mmap(&(0x7f0000000000/0xb36000)=nil, 0x1a000, 0x1000004, 0x8031, 0xffffffffffffffff, 0x0) 04:46:49 executing program 2: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) r4 = dup(r3) ioctl$KVM_ENABLE_CAP_CPU(r4, 0xc008ae88, &(0x7f0000000340)={0x79, 0x0, [0x491]}) 04:46:50 executing program 3: r0 = syz_open_dev$sg(&(0x7f00000000c0)='/dev/sg#\x00', 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000000)={0x53, 0x0, 0x6, 0x0, @buffer={0x209, 0xb8, &(0x7f00000001c0)=""/184}, &(0x7f0000000540)="ad40657ed56c", &(0x7f0000000340)=""/128, 0x0, 0x0, 0x0, &(0x7f0000000040), 0x400000000000000}) 04:46:50 executing program 4: ioctl$KVM_IRQ_LINE(0xffffffffffffffff, 0x4008ae61, &(0x7f0000000500)) r0 = syz_open_dev$dspn(&(0x7f00000004c0)='/dev/dsp#\x00', 0x1, 0x0) openat$audio(0xffffffffffffff9c, &(0x7f0000000000)='/dev/audio\x00', 0x80, 0x0) ioctl$KVM_SET_FPU(0xffffffffffffffff, 0x41a0ae8d, &(0x7f0000000100)={[], 0x0, 0x5531fee, 0x0, 0x0, 0x9, 0xf000, 0x0, [], 0x5}) syz_open_dev$usb(&(0x7f0000000440)='/dev/bus/usb/00#/00#\x00', 0x9, 0x2) r1 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) lstat(&(0x7f0000000040)='./file0/file0\x00', &(0x7f0000000080)) ioctl$EXT4_IOC_MIGRATE(0xffffffffffffffff, 0x6609) sendmmsg$unix(0xffffffffffffffff, &(0x7f000000a000)=[{&(0x7f000000a000)=@abs, 0x6e, &(0x7f000000d000), 0x0, &(0x7f0000000600)=ANY=[]}], 0x1, 0x0) openat$vnet(0xffffffffffffff9c, &(0x7f0000000340)='/dev/vhost-net\x00', 0x2, 0x0) r2 = socket$inet6(0xa, 0x2, 0x0) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$nl_netfilter(r3, &(0x7f0000dddfc8)={&(0x7f0000000080), 0xc, &(0x7f00008a7000)={&(0x7f0000000040)=ANY=[@ANYBLOB="2c00000000070501ff0080fffdffff2e0a0000000c000100010000007d0a00010c000200000022ff02f10000"], 0x2c}}, 0x0) gettid() r4 = getpgid(0x0) kcmp(0x0, r4, 0x0, 0xffffffffffffffff, 0xffffffffffffffff) connect$inet6(r2, &(0x7f0000002740)={0xa, 0x0, 0x0, @mcast2, 0x4}, 0x1c) sendmmsg(r2, &(0x7f0000007e00), 0x136a88c8311572c, 0x0) setsockopt$inet6_udp_int(r2, 0x11, 0x0, &(0x7f0000000400), 0x4) setsockopt$SO_TIMESTAMPING(r0, 0x1, 0x25, &(0x7f0000000300)=0x40, 0x4) openat$kvm(0xffffffffffffff9c, &(0x7f00000003c0)='/dev/kvm\x00', 0x0, 0x0) ioctl$VHOST_SET_VRING_CALL(0xffffffffffffff9c, 0x4008af21, &(0x7f00000002c0)={0x0, r1}) ioctl$SNDRV_TIMER_IOCTL_TREAD(r0, 0x40045402, &(0x7f0000000740)) inotify_rm_watch(0xffffffffffffffff, 0x0) ioctl$ifreq_SIOCGIFINDEX_team(0xffffffffffffffff, 0x8933, &(0x7f0000000480)={'team0\x00'}) 04:46:50 executing program 0: mkdir(&(0x7f0000000200)='./file0\x00', 0x0) mount(&(0x7f00000002c0)=ANY=[], &(0x7f0000001540)='./file0\x00', &(0x7f0000000280)='tmpfs\x00', 0x0, &(0x7f0000000080)) r0 = open$dir(&(0x7f0000000180)='./file0\x00', 0x0, 0x0) mknodat(r0, &(0x7f0000000140)='./file0\x00', 0x0, 0x0) renameat2(r0, &(0x7f0000000080)='./file0\x00', r0, &(0x7f0000000100)='./file1\x00', 0x4) setxattr$trusted_overlay_redirect(&(0x7f0000000000)='./file2\x00', &(0x7f0000000040)='trusted.overlay.redirect\x00', &(0x7f00000000c0)='./file0\x00', 0x8, 0x2) mount$bpf(0x0, &(0x7f00000001c0)='./file1/file0\x00', &(0x7f0000000240)='bpf\x00', 0x9c040, &(0x7f00000003c0)=ANY=[@ANYBLOB="6d6f64653d30303030303030303030303030303030303030303030352c6d6f64653d303030303030303030303030af0000008d3915363131312c6d6f64653d30303030303030303030303030303030303030303532372c6d6f64653d30303030303030303030303030303030303030373737372c6d6f64653d3000003030303030303030303030300157baf3266824b02c7063723d3030303030303030303030303030307dadc52024580ae16e746578743d730618b1e902ad15a1797361646d5f752c636f6e746578743d757365725f752c7065726d69745f646972656374696f2c00"]) 04:46:50 executing program 3: r0 = syz_open_dev$sg(&(0x7f00000000c0)='/dev/sg#\x00', 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000000)={0x53, 0x0, 0x6, 0x0, @buffer={0x209, 0xb8, &(0x7f00000001c0)=""/184}, &(0x7f0000000540)="ad40657ed56c", &(0x7f0000000340)=""/128, 0x0, 0x0, 0x0, &(0x7f0000000040), 0x902000000000000}) 04:46:50 executing program 2: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) r4 = dup(r3) ioctl$KVM_ENABLE_CAP_CPU(r4, 0xc008ae88, &(0x7f0000000340)={0x79, 0x0, [0x491]}) 04:46:50 executing program 1: r0 = perf_event_open(&(0x7f000025c000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x11, r1, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r0, 0x2405, r1) mmap(&(0x7f0000000000/0xb36000)=nil, 0x33000, 0x1000004, 0x8031, 0xffffffffffffffff, 0x0) [ 664.007157] tmpfs: No value for mount option './file0' 04:46:50 executing program 0: mkdir(&(0x7f0000000200)='./file0\x00', 0x0) mount(&(0x7f00000002c0)=ANY=[], &(0x7f0000001540)='./file0\x00', &(0x7f0000000280)='tmpfs\x00', 0x0, &(0x7f0000000080)) r0 = open$dir(&(0x7f0000000180)='./file0\x00', 0x0, 0x0) mknodat(r0, &(0x7f0000000140)='./file0\x00', 0x0, 0x0) r1 = syz_open_dev$amidi(&(0x7f0000000000)='/dev/amidi#\x00', 0x3, 0x1a200) ioctl$sock_SIOCBRADDBR(r1, 0x89a0, &(0x7f00000000c0)='ip6gre0\x00') ioctl$TIOCGWINSZ(r1, 0x5413, &(0x7f0000000040)) renameat2(r0, &(0x7f0000000080)='./file0\x00', r0, &(0x7f0000000100)='./file1\x00', 0x4) [ 664.303048] tmpfs: No value for mount option './file0' 04:46:50 executing program 5: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000480)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_GUEST_DEBUG(r3, 0x4048ae9b, &(0x7f0000000140)={0x1}) syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000100)=[@text32={0x20, &(0x7f0000000000)="6601669b0f35c4e1fe16846ba49e0000b9940200000f32c4c23dad78e0b9670900000f32660f38827f95b0040f01d10fc71a", 0x32}], 0x1, 0x0, &(0x7f0000000040), 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r3, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000400)=[@text32={0x20, &(0x7f0000000880)="b805000000b98b9400000f01c19a01000000b0000f43d1b8000000000f23d80f21f835800000900f23f80f060f2140b9800000c00f3235000800000f3066ba4300b8f1ffffffefb9800000c00f3235002000000f30c4c3295f4da400", 0x5c}], 0x26433e1, 0x0, &(0x7f0000000300), 0x10000000000002b5) ioctl$KVM_RUN(r3, 0xae80, 0x0) 04:46:50 executing program 3: r0 = syz_open_dev$sg(&(0x7f00000000c0)='/dev/sg#\x00', 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000000)={0x53, 0x0, 0x6, 0x0, @buffer={0x209, 0xb8, &(0x7f00000001c0)=""/184}, &(0x7f0000000540)="ad40657ed56c", &(0x7f0000000340)=""/128, 0x0, 0x0, 0x0, &(0x7f0000000040), 0x2f00000000000000}) 04:46:50 executing program 2: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000)='/dev/kvm\x00', 0x0, 0x0) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000fe5000/0x18000)=nil, &(0x7f0000000100)=[@text64={0x40, &(0x7f0000000040)="440f3248b800000000008000000f23d80f21f835000000800f23f848b86d980000000000000f23d80f21f835000000600f23f848b80e000000000000000f23d80f21f835000000000f23f80f0f6a3190c744240088a42236c7442402a19a83b3c7442406000000000f011424450fc76a218f6890a26d13ae0f3566baf80cb8e2e5bd81ef66bafc0c66ed", 0x8a}], 0x1, 0x0, &(0x7f0000000140), 0x0) r2 = dup(0xffffffffffffffff) ioctl$KVM_ENABLE_CAP_CPU(r2, 0xc008ae88, &(0x7f0000000340)={0x79, 0x0, [0x491]}) 04:46:50 executing program 0: mkdir(&(0x7f0000000200)='./file0\x00', 0x8) mount(&(0x7f00000002c0)=ANY=[], &(0x7f0000000240)='./file0/file0\x00', &(0x7f0000000280)='tmpfs\x00', 0x0, &(0x7f0000000080)) getpeername(0xffffffffffffffff, &(0x7f00000002c0)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @dev}}}, &(0x7f0000000340)=0x80) r1 = syz_genetlink_get_family_id$ipvs(&(0x7f00000003c0)='IPVS\x00') sendmsg$IPVS_CMD_SET_SERVICE(r0, &(0x7f0000000480)={&(0x7f0000000380)={0x10, 0x0, 0x0, 0x9000}, 0xc, &(0x7f0000000440)={&(0x7f0000000400)={0x1c, r1, 0x315, 0x70bd27, 0x25dfdbfe, {}, [@IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5, 0xffff}]}, 0x1c}}, 0x0) r2 = open$dir(&(0x7f0000000180)='./file0\x00', 0x0, 0x0) r3 = openat$ipvs(0xffffffffffffff9c, &(0x7f00000000c0)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) setsockopt$inet_tcp_TCP_ULP(r3, 0x6, 0x1f, &(0x7f0000001500)='tls\x00', 0x4) recvmmsg(r3, &(0x7f0000001440)=[{{&(0x7f0000000f80)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f00000011c0)=[{&(0x7f0000001000)=""/203, 0xcb}, {&(0x7f0000001100)=""/145, 0x91}, {&(0x7f0000004540)=""/4096, 0x1000}], 0x3, &(0x7f0000001200)=""/106, 0x6a, 0x8000}}, {{&(0x7f0000001280)=@llc={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @dev}, 0x80, &(0x7f0000001400)=[{&(0x7f0000001300)=""/5, 0x5}, {&(0x7f0000001340)=""/187, 0xbb}, {&(0x7f0000005540)=""/4096, 0x1000}], 0x3, &(0x7f0000006540)=""/169, 0xa9, 0x8}, 0x81}], 0x2, 0x2, &(0x7f0000006600)={0x0, 0x989680}) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000006640)={{{@in6=@remote, @in6=@remote, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@multicast2}, 0x0, @in6=@mcast1}}, &(0x7f0000006740)=0xe8) setsockopt$inet6_IPV6_XFRM_POLICY(r3, 0x29, 0x23, &(0x7f0000006780)={{{@in=@multicast1, @in=@dev={0xac, 0x14, 0x14, 0x1f}, 0x4e22, 0x10000, 0x4e20, 0x3ff, 0x2, 0x80, 0x80, 0x62, r4, r5}, {0x9, 0x8000, 0x5, 0x1, 0x5, 0x401, 0x7, 0x1}, {0x0, 0x5, 0x3f, 0x8}, 0x7, 0x6e6bb2, 0x1, 0x1, 0x3, 0x3}, {{@in6=@local, 0x4d4, 0x6c}, 0x2, @in6=@dev={0xfe, 0x80, [], 0x21}, 0x34ff, 0x5, 0x3, 0x4, 0xfa9, 0x80000000, 0x4}}, 0xe8) mknodat(r2, &(0x7f0000000140)='./file0\x00', 0x0, 0x0) pipe2(&(0x7f0000000000)={0xffffffffffffffff}, 0x4800) unlinkat(r3, &(0x7f00000004c0)='./file1\x00', 0x200) ioctl$KDGKBMETA(r6, 0x4b62, &(0x7f0000000040)) epoll_ctl$EPOLL_CTL_DEL(r3, 0x2, r0) renameat2(r2, &(0x7f0000000080)='./file0\x00', r2, &(0x7f0000000100)='./file1\x00', 0x4) openat$dir(0xffffffffffffff9c, &(0x7f00000001c0)='./file0\x00', 0x2402, 0x181) write$FUSE_NOTIFY_INVAL_INODE(r0, &(0x7f0000000500)={0x28, 0x2, 0x0, {0x0, 0x8, 0x2}}, 0x28) 04:46:50 executing program 1: r0 = perf_event_open(&(0x7f000025c000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x11, r1, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r0, 0x2405, r1) mmap(&(0x7f0000000000/0xb36000)=nil, 0x7ffffffff000, 0x1000004, 0x8031, 0xffffffffffffffff, 0x0) 04:46:50 executing program 4: ioctl$KVM_IRQ_LINE(0xffffffffffffffff, 0x4008ae61, &(0x7f0000000500)) r0 = syz_open_dev$dspn(&(0x7f00000004c0)='/dev/dsp#\x00', 0x1, 0x0) r1 = openat$audio(0xffffffffffffff9c, &(0x7f0000000000)='/dev/audio\x00', 0x80, 0x0) ioctl$KVM_SET_FPU(0xffffffffffffffff, 0x41a0ae8d, &(0x7f0000000100)={[], 0x0, 0x5531fee, 0x0, 0x0, 0x9, 0xf000, 0x0, [], 0x5}) syz_open_dev$usb(&(0x7f0000000440)='/dev/bus/usb/00#/00#\x00', 0x9, 0x2) r2 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) lstat(&(0x7f0000000040)='./file0/file0\x00', &(0x7f0000000080)) ioctl$EXT4_IOC_MIGRATE(0xffffffffffffffff, 0x6609) sendmmsg$unix(0xffffffffffffffff, &(0x7f000000a000)=[{&(0x7f000000a000)=@abs, 0x6e, &(0x7f000000d000), 0x0, &(0x7f0000000600)=ANY=[]}], 0x1, 0x0) r3 = socket$inet6(0xa, 0x2, 0x0) gettid() r4 = getpgid(0x0) kcmp(0x0, r4, 0x0, 0xffffffffffffffff, 0xffffffffffffffff) connect$inet6(r3, &(0x7f0000002740)={0xa, 0x0, 0x0, @mcast2, 0x4}, 0x1c) sendmmsg(r3, &(0x7f0000007e00), 0x136a88c8311572c, 0x0) ioctl$BLKZEROOUT(r1, 0x127f, &(0x7f0000000300)={0x2b0, 0xfffffffffffffffe}) setsockopt$inet6_udp_int(r3, 0x11, 0x0, &(0x7f0000000400), 0x4) openat$kvm(0xffffffffffffff9c, &(0x7f00000003c0)='/dev/kvm\x00', 0x0, 0x0) ioctl$VHOST_SET_VRING_CALL(0xffffffffffffff9c, 0x4008af21, &(0x7f00000002c0)={0x0, r2}) ioctl$SNDRV_TIMER_IOCTL_TREAD(r0, 0x40045402, &(0x7f0000000740)) inotify_rm_watch(0xffffffffffffffff, 0x0) ioctl$ifreq_SIOCGIFINDEX_team(0xffffffffffffffff, 0x8933, &(0x7f0000000480)={'team0\x00'}) [ 664.628686] tmpfs: No value for mount option './file0' 04:46:50 executing program 3: r0 = syz_open_dev$sg(&(0x7f00000000c0)='/dev/sg#\x00', 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000000)={0x53, 0x0, 0x6, 0x0, @buffer={0x209, 0xb8, &(0x7f00000001c0)=""/184}, &(0x7f0000000540)="ad40657ed56c", &(0x7f0000000340)=""/128, 0x0, 0x0, 0x0, &(0x7f0000000040), 0x200000000000000}) 04:46:50 executing program 1: r0 = perf_event_open(&(0x7f000025c000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x11, r1, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r0, 0x2405, r1) mmap(&(0x7f0000000000/0xb36000)=nil, 0x24000, 0x1000004, 0x8031, 0xffffffffffffffff, 0x0) 04:46:50 executing program 2: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000)='/dev/kvm\x00', 0x0, 0x0) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000fe5000/0x18000)=nil, &(0x7f0000000100)=[@text64={0x40, &(0x7f0000000040)="440f3248b800000000008000000f23d80f21f835000000800f23f848b86d980000000000000f23d80f21f835000000600f23f848b80e000000000000000f23d80f21f835000000000f23f80f0f6a3190c744240088a42236c7442402a19a83b3c7442406000000000f011424450fc76a218f6890a26d13ae0f3566baf80cb8e2e5bd81ef66bafc0c66ed", 0x8a}], 0x1, 0x0, &(0x7f0000000140), 0x0) r2 = dup(0xffffffffffffffff) ioctl$KVM_ENABLE_CAP_CPU(r2, 0xc008ae88, &(0x7f0000000340)={0x79, 0x0, [0x491]}) 04:46:50 executing program 0: mkdir(&(0x7f0000000200)='./file0\x00', 0x0) mount(&(0x7f00000001c0)=ANY=[], &(0x7f0000001540)='./file1\x00', &(0x7f00000003c0)='devtmpfs\x00', 0x10400, &(0x7f0000000380)="73656c6673656c696e1608a78911c79706f00a269e9234757865678f5f8db3331afd4d34b66c61") ioctl$sock_kcm_SIOCKCMCLONE(0xffffffffffffff9c, 0x89e2, &(0x7f0000000000)={0xffffffffffffffff}) recvfrom$unix(r0, &(0x7f0000000040)=""/43, 0x2b, 0x10000, &(0x7f00000002c0)=@abs={0x1, 0x0, 0x4e24}, 0x6e) r1 = open$dir(&(0x7f0000000180)='./file0\x00', 0x0, 0x0) pipe2(&(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r2, 0x2405, r0) mknodat(r1, &(0x7f0000000140)='./file0\x00', 0x0, 0x0) renameat2(r1, &(0x7f0000000080)='./file0\x00', r1, &(0x7f0000000100)='./file1\x00', 0x4) ioctl$VHOST_SET_MEM_TABLE(r3, 0x4008af03, &(0x7f0000000840)={0x7, 0x0, [{0x103000, 0xd4, &(0x7f0000000400)=""/212}, {0x117001, 0xc4, &(0x7f0000000500)=""/196}, {0x1f000, 0xb6, &(0x7f0000000600)=""/182}, {0xd000, 0x2c, &(0x7f00000001c0)=""/44}, {0x6000, 0x92, &(0x7f00000006c0)=""/146}, {0xd000, 0x59, &(0x7f0000000240)=""/89}, {0x100000, 0xa7, &(0x7f0000000780)=""/167}]}) 04:46:51 executing program 3: r0 = syz_open_dev$sg(&(0x7f00000000c0)='/dev/sg#\x00', 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000000)={0x53, 0x0, 0x6, 0x0, @buffer={0x209, 0xb8, &(0x7f00000001c0)=""/184}, &(0x7f0000000540)="ad40657ed56c", &(0x7f0000000340)=""/128, 0x0, 0x0, 0x0, &(0x7f0000000040), 0x4000000}) 04:46:51 executing program 2: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000)='/dev/kvm\x00', 0x0, 0x0) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000fe5000/0x18000)=nil, &(0x7f0000000100)=[@text64={0x40, &(0x7f0000000040)="440f3248b800000000008000000f23d80f21f835000000800f23f848b86d980000000000000f23d80f21f835000000600f23f848b80e000000000000000f23d80f21f835000000000f23f80f0f6a3190c744240088a42236c7442402a19a83b3c7442406000000000f011424450fc76a218f6890a26d13ae0f3566baf80cb8e2e5bd81ef66bafc0c66ed", 0x8a}], 0x1, 0x0, &(0x7f0000000140), 0x0) r2 = dup(0xffffffffffffffff) ioctl$KVM_ENABLE_CAP_CPU(r2, 0xc008ae88, &(0x7f0000000340)={0x79, 0x0, [0x491]}) 04:46:51 executing program 1: r0 = perf_event_open(&(0x7f000025c000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x11, r1, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r0, 0x2405, r1) mmap(&(0x7f0000000000/0xb36000)=nil, 0xd000, 0x1000004, 0x8031, 0xffffffffffffffff, 0x0) 04:46:51 executing program 0: mkdir(&(0x7f0000000200)='./file0\x00', 0x0) mount(&(0x7f0000000040)=ANY=[], &(0x7f0000001540)='./file1\x00', &(0x7f0000000280)='tmpfs\x00', 0x0, &(0x7f00000002c0)="56051dc0b99b2082c4fee04c08c9371c8b6999ee668e78f1a40fe676c6ebd4025c7b57cd3de978aba8b522a7528ddbca22c4ba367f1ed83285787315258b67243c7a2e8303576f998bff894cd8682c6a0add5ec3049e8b743b5b8001c9ac2a1926704aba5f21c6959c1d4031c820564648bf20bf73ba15fe709eaffc6995f0c462050b84854a1f9b871135b3363def43b2d9e49b65ec34cf45f5a9e0b6c5458a794c8e3bae26eef85bc1316dfad3") r0 = open$dir(&(0x7f0000000180)='./file0\x00', 0x0, 0x0) mknodat(r0, &(0x7f0000000140)='./file0\x00', 0x0, 0x0) renameat2(r0, &(0x7f0000000080)='./file0\x00', r0, &(0x7f0000000100)='./file1\x00', 0x4) 04:46:51 executing program 3: r0 = syz_open_dev$sg(&(0x7f00000000c0)='/dev/sg#\x00', 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000000)={0x53, 0x0, 0x6, 0x0, @buffer={0x209, 0xb8, &(0x7f00000001c0)=""/184}, &(0x7f0000000540)="ad40657ed56c", &(0x7f0000000340)=""/128, 0x0, 0x0, 0x0, &(0x7f0000000040), 0x6000000}) 04:46:51 executing program 4: ioctl$KVM_IRQ_LINE(0xffffffffffffffff, 0x4008ae61, &(0x7f0000000500)) r0 = syz_open_dev$dspn(&(0x7f00000004c0)='/dev/dsp#\x00', 0x1, 0x0) r1 = openat$audio(0xffffffffffffff9c, &(0x7f0000000000)='/dev/audio\x00', 0x80, 0x0) getsockopt$inet_sctp_SCTP_STREAM_SCHEDULER(r0, 0x84, 0x7b, &(0x7f0000000300)={0x0, 0x8}, &(0x7f0000000340)=0x8) setsockopt$inet_sctp_SCTP_PEER_ADDR_THLDS(r1, 0x84, 0x1f, &(0x7f0000000540)={r2, @in={{0x2, 0x4e22, @remote}}, 0x4, 0x59}, 0x90) ioctl$KVM_SET_FPU(0xffffffffffffffff, 0x41a0ae8d, &(0x7f0000000100)={[], 0x0, 0x5531fee, 0x0, 0x0, 0x9, 0xf000, 0x0, [], 0x5}) r3 = syz_open_dev$usb(&(0x7f0000000440)='/dev/bus/usb/00#/00#\x00', 0x9, 0x2) r4 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) lstat(&(0x7f0000000040)='./file0/file0\x00', &(0x7f0000000080)) recvfrom$unix(r1, &(0x7f0000000380)=""/56, 0x38, 0x1, &(0x7f0000000600)=@abs={0x0, 0x0, 0x4e20}, 0x6e) ioctl$EXT4_IOC_MIGRATE(0xffffffffffffffff, 0x6609) sendmmsg$unix(0xffffffffffffffff, &(0x7f000000a000)=[{&(0x7f000000a000)=@abs, 0x6e, &(0x7f000000d000), 0x0, &(0x7f0000000600)=ANY=[]}], 0x1, 0x0) r5 = socket$inet6(0xa, 0x2, 0x0) gettid() r6 = getpgid(0x0) kcmp(0x0, r6, 0x0, 0xffffffffffffffff, 0xffffffffffffffff) syz_open_dev$usbmon(&(0x7f00000003c0)='/dev/usbmon#\x00', 0xffff, 0x200) connect$inet6(r5, &(0x7f0000002740)={0xa, 0x0, 0x0, @mcast2, 0x4}, 0x1c) sendmmsg(r5, &(0x7f0000007e00), 0x136a88c8311572c, 0x0) setsockopt$inet6_udp_int(r5, 0x11, 0x0, &(0x7f0000000400), 0x4) fchmodat(r3, &(0x7f0000000680)='./file0/file0\x00', 0xa2) openat$kvm(0xffffffffffffff9c, &(0x7f0000000780)='/dev/kvm\x00', 0x400000001, 0x0) ioctl$VHOST_SET_VRING_CALL(0xffffffffffffff9c, 0x4008af21, &(0x7f00000002c0)={0x0, r4}) ioctl$SNDRV_TIMER_IOCTL_TREAD(r0, 0x40045402, &(0x7f0000000740)) inotify_rm_watch(0xffffffffffffffff, 0x0) ioctl$ifreq_SIOCGIFINDEX_team(0xffffffffffffffff, 0x8933, &(0x7f0000000480)={'team0\x00'}) 04:46:51 executing program 5: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x4003c, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000480)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) openat$ipvs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) ioctl$FIBMAP(r2, 0x1, &(0x7f00000000c0)=0x40) r3 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x4000000000000000) ioctl$KVM_SET_GUEST_DEBUG(r3, 0x4048ae9b, &(0x7f0000000140)={0x1}) syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000100)=[@text32={0x20, &(0x7f0000000000)="6601669b0f35c4e1fe16846ba49e0000b9940200000f32c4c23dad78e0b9670900000f32660f38827f95b0040f01d10fc71a", 0x32}], 0x1, 0x0, &(0x7f0000000040), 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r3, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000400)=[@text32={0x20, &(0x7f0000000880)="b805000000b98b9400000f01c19a01000000b0000f43d1b8000000000f23d80f21f835800000900f23f80f060f2140b9800000c00f3235000800000f3066ba4300b8f1ffffffefb9800000c00f3235002000000f30c4c3295f4da400", 0x5c}], 0x26433e1, 0x0, &(0x7f0000000300), 0x10000000000000b6) ioctl$KVM_RUN(r3, 0xae80, 0x0) 04:46:51 executing program 2: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000000)) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r2, &(0x7f0000fe5000/0x18000)=nil, &(0x7f0000000100)=[@text64={0x40, &(0x7f0000000040)="440f3248b800000000008000000f23d80f21f835000000800f23f848b86d980000000000000f23d80f21f835000000600f23f848b80e000000000000000f23d80f21f835000000000f23f80f0f6a3190c744240088a42236c7442402a19a83b3c7442406000000000f011424450fc76a218f6890a26d13ae0f3566baf80cb8e2e5bd81ef66bafc0c66ed", 0x8a}], 0x1, 0x0, &(0x7f0000000140), 0x0) r3 = dup(r2) ioctl$KVM_ENABLE_CAP_CPU(r3, 0xc008ae88, &(0x7f0000000340)={0x79, 0x0, [0x491]}) 04:46:51 executing program 0: mkdir(&(0x7f0000000200)='./file0\x00', 0x0) mount(&(0x7f00000002c0)=ANY=[], &(0x7f0000001540)='./file0\x00', &(0x7f0000000280)='tmpfs\x00', 0x0, &(0x7f0000000080)) r0 = open$dir(&(0x7f0000000180)='./file0\x00', 0x0, 0x0) mknodat(r0, &(0x7f0000000140)='./file0\x00', 0x0, 0x0) r1 = open(&(0x7f0000000000)='./file0\x00', 0x1, 0x8b) getsockopt$inet_sctp_SCTP_GET_PEER_ADDR_INFO(r1, 0x84, 0xf, &(0x7f0000006640)={0x0, @in6={{0xa, 0x4e24, 0x2, @mcast1}}, 0x3ab, 0x8, 0x1000, 0x1, 0x8000}, &(0x7f0000000040)=0x98) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r1, 0x84, 0x6f, &(0x7f00000000c0)={r2, 0x80, &(0x7f0000006700)=[@in={0x2, 0x4e22, @broadcast}, @in6={0xa, 0x4e23, 0x401}, @in6={0xa, 0x4e22, 0x5, @dev={0xfe, 0x80, [], 0xd}, 0x1}, @in6={0xa, 0x4e20, 0xd3, @dev={0xfe, 0x80, [], 0x11}, 0x9}, @in6={0xa, 0x4e24, 0x80000000, @empty, 0x101}]}, &(0x7f00000001c0)=0x10) ioctl$SNDRV_CTL_IOCTL_ELEM_LIST(r1, 0xc0505510, &(0x7f00000065c0)={0x2, 0x6, 0x7, 0xe0000000000, &(0x7f0000006440)=[{}, {}, {}, {}, {}, {}]}) recvmmsg(0xffffffffffffffff, &(0x7f00000061c0)=[{{&(0x7f00000002c0)=@pptp, 0x80, &(0x7f0000000680)=[{&(0x7f00000001c0)}, {&(0x7f0000000340)=""/220, 0xdc}, {&(0x7f0000000440)=""/230, 0xe6}, {&(0x7f0000000540)=""/123, 0x7b}, {&(0x7f00000005c0)=""/169, 0xa9}], 0x5, &(0x7f0000000700)=""/119, 0x77}, 0x2}, {{&(0x7f0000000780)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @broadcast}}}, 0x80, &(0x7f0000000e00)=[{&(0x7f0000000800)=""/192, 0xc0}, {&(0x7f00000008c0)=""/135, 0x87}, {&(0x7f0000000980)=""/200, 0xc8}, {&(0x7f0000000a80)=""/115, 0x73}, {&(0x7f0000000b00)=""/102, 0x66}, {&(0x7f0000000b80)=""/84, 0x54}, {&(0x7f0000000240)=""/58, 0x3a}, {&(0x7f0000000c00)=""/245, 0xf5}, {&(0x7f0000000d00)=""/25, 0x19}, {&(0x7f0000000d40)=""/161, 0xa1}], 0xa, 0x0, 0x0, 0x1}, 0xffffffffffffffff}, {{&(0x7f0000000ec0)=@xdp, 0x80, &(0x7f0000001580)=[{&(0x7f0000000f40)=""/185, 0xb9}, {&(0x7f0000001000)=""/28, 0x1c}, {&(0x7f0000001040)=""/95, 0x5f}, {&(0x7f00000010c0)=""/69, 0x45}, {&(0x7f0000001140)=""/125, 0x7d}, {&(0x7f00000011c0)}, {&(0x7f0000001200)=""/221, 0xdd}, {&(0x7f0000001300)=""/176, 0xb0}, {&(0x7f00000013c0)=""/137, 0x89}, {&(0x7f0000001480)=""/42, 0x2a}], 0xa, &(0x7f00000014c0)=""/48, 0x30, 0x9}, 0x1ff}, {{&(0x7f0000001640)=@pppol2tpv3in6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @dev}}}, 0x80, &(0x7f0000001b80)=[{&(0x7f0000001500)=""/58, 0x3a}, {&(0x7f00000016c0)=""/55, 0x37}, {&(0x7f0000001700)=""/236, 0xec}, {&(0x7f0000001800)=""/219, 0xdb}, {&(0x7f0000001900)=""/120, 0x78}, {&(0x7f0000001980)=""/159, 0x9f}, {&(0x7f0000001a40)=""/2, 0x2}, {&(0x7f0000001a80)=""/204, 0xcc}], 0x8, 0x0, 0x0, 0x10000}, 0xffffffffffffff96}, {{&(0x7f0000001c00)=@sco, 0x80, &(0x7f0000003280)=[{&(0x7f0000001c80)=""/106, 0x6a}, {&(0x7f0000001d00)=""/4096, 0x1000}, {&(0x7f0000002d00)=""/108, 0x6c}, {&(0x7f0000002d80)=""/148, 0x94}, {&(0x7f0000002e40)=""/12, 0xc}, {&(0x7f0000002e80)=""/208, 0xd0}, {&(0x7f0000002f80)=""/227, 0xe3}, {&(0x7f0000003080)=""/216, 0xd8}, {&(0x7f0000003180)=""/239, 0xef}], 0x9, &(0x7f0000003340)=""/4096, 0x1000, 0x80}, 0x3}, {{&(0x7f0000004340)=@pppol2tpin6={0x18, 0x1, {0x0, 0xffffffffffffffff}}, 0x80, &(0x7f0000004640)=[{&(0x7f00000043c0)=""/156, 0x9c}, {&(0x7f0000004480)=""/142, 0x8e}, {&(0x7f0000004540)=""/29, 0x1d}, {&(0x7f0000004580)=""/175, 0xaf}], 0x4, &(0x7f0000004680)=""/4096, 0x1000, 0xffffffffffff85d0}, 0x7fff}, {{0x0, 0x0, &(0x7f0000005c40)=[{&(0x7f0000005680)=""/102, 0x66}, {&(0x7f0000005700)=""/171, 0xab}, {&(0x7f00000057c0)=""/11, 0xb}, {&(0x7f0000005800)=""/68, 0x44}, {&(0x7f0000005880)=""/85, 0x55}, {&(0x7f0000005900)=""/189, 0xbd}, {&(0x7f00000059c0)=""/45, 0x2d}, {&(0x7f0000005a00)=""/100, 0x64}, {&(0x7f0000005a80)=""/239, 0xef}, {&(0x7f0000005b80)=""/156, 0x9c}], 0xa, &(0x7f0000005d00)=""/63, 0x3f, 0x6}, 0xb14}, {{&(0x7f0000005d40)=@pppoe={0x18, 0x0, {0x0, @dev}}, 0x80, &(0x7f0000005f00)=[{&(0x7f0000005dc0)=""/182, 0xb6}, {&(0x7f0000005e80)=""/110, 0x6e}], 0x2}, 0x10001}, {{0x0, 0x0, &(0x7f0000006100)=[{&(0x7f0000005f40)=""/156, 0x9c}, {&(0x7f0000006000)=""/247, 0xf7}], 0x2, &(0x7f0000006140)=""/82, 0x52, 0x1}, 0x8000}], 0x9, 0x2000, &(0x7f0000006400)) mmap$xdp(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x3000002, 0x10, r3, 0x17fffffff) renameat2(r0, &(0x7f0000000080)='./file0\x00', r0, &(0x7f0000000100)='./file1\x00', 0x4) 04:46:51 executing program 3: r0 = syz_open_dev$sg(&(0x7f00000000c0)='/dev/sg#\x00', 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000000)={0x53, 0x0, 0x6, 0x0, @buffer={0x209, 0xb8, &(0x7f00000001c0)=""/184}, &(0x7f0000000540)="ad40657ed56c", &(0x7f0000000340)=""/128, 0x0, 0x0, 0x0, &(0x7f0000000040), 0xfffffffc}) 04:46:51 executing program 1: r0 = perf_event_open(&(0x7f000025c000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x11, r1, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r0, 0x2405, r1) mmap(&(0x7f0000000000/0xb36000)=nil, 0x2a000, 0x1000004, 0x8031, 0xffffffffffffffff, 0x0) 04:46:51 executing program 2: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000000)) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r2, &(0x7f0000fe5000/0x18000)=nil, &(0x7f0000000100)=[@text64={0x40, &(0x7f0000000040)="440f3248b800000000008000000f23d80f21f835000000800f23f848b86d980000000000000f23d80f21f835000000600f23f848b80e000000000000000f23d80f21f835000000000f23f80f0f6a3190c744240088a42236c7442402a19a83b3c7442406000000000f011424450fc76a218f6890a26d13ae0f3566baf80cb8e2e5bd81ef66bafc0c66ed", 0x8a}], 0x1, 0x0, &(0x7f0000000140), 0x0) r3 = dup(r2) ioctl$KVM_ENABLE_CAP_CPU(r3, 0xc008ae88, &(0x7f0000000340)={0x79, 0x0, [0x491]}) 04:46:51 executing program 3: r0 = syz_open_dev$sg(&(0x7f00000000c0)='/dev/sg#\x00', 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000000)={0x53, 0x0, 0x6, 0x0, @buffer={0x209, 0xb8, &(0x7f00000001c0)=""/184}, &(0x7f0000000540)="ad40657ed56c", &(0x7f0000000340)=""/128, 0x0, 0x0, 0x0, &(0x7f0000000040), 0x6cd57e6540ad}) [ 665.713470] tmpfs: No value for mount option './file0' 04:46:52 executing program 2: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000000)) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r2, &(0x7f0000fe5000/0x18000)=nil, &(0x7f0000000100)=[@text64={0x40, &(0x7f0000000040)="440f3248b800000000008000000f23d80f21f835000000800f23f848b86d980000000000000f23d80f21f835000000600f23f848b80e000000000000000f23d80f21f835000000000f23f80f0f6a3190c744240088a42236c7442402a19a83b3c7442406000000000f011424450fc76a218f6890a26d13ae0f3566baf80cb8e2e5bd81ef66bafc0c66ed", 0x8a}], 0x1, 0x0, &(0x7f0000000140), 0x0) r3 = dup(r2) ioctl$KVM_ENABLE_CAP_CPU(r3, 0xc008ae88, &(0x7f0000000340)={0x79, 0x0, [0x491]}) 04:46:52 executing program 0: mkdir(&(0x7f0000000200)='./file0\x00', 0x0) lsetxattr$security_smack_transmute(&(0x7f0000000240)='./file0\x00', &(0x7f0000000340)='security.SMACK64TRANSMUTE\x00', &(0x7f0000000380)='TRUE', 0x4, 0x3) ioctl$sock_FIOGETOWN(0xffffffffffffff9c, 0x8903, &(0x7f00000000c0)=0x0) r1 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/vga_arbiter\x00', 0x4000, 0x0) perf_event_open(&(0x7f00000002c0)={0x0, 0x70, 0x0, 0x76d4, 0x7fffffff, 0x8001, 0x0, 0x3, 0x10000, 0xf, 0x7, 0x1, 0xae6, 0x8000, 0x20, 0x8, 0x5, 0x7613ad0e, 0x65d5, 0x6, 0x2, 0x1000, 0x0, 0xffffffff, 0x9, 0x0, 0x4, 0x5, 0x6, 0x100000000, 0x1ff, 0x9, 0x4, 0xa664, 0x4, 0x0, 0x1000, 0x26cc, 0x0, 0xdb0, 0x0, @perf_bp={&(0x7f0000000040), 0xb}, 0x0, 0x3, 0x1, 0x7, 0x2, 0x7, 0x8}, r0, 0xe, r1, 0x8) mount(&(0x7f00000002c0)=ANY=[], &(0x7f0000001540)='./file0\x00', &(0x7f0000000280)='tmpfs\x00', 0x0, &(0x7f0000000080)) r2 = open$dir(&(0x7f0000000180)='./file0\x00', 0x0, 0x0) mknodat(r2, &(0x7f0000000140)='./file0\x00', 0x0, 0x0) socketpair$inet_tcp(0x2, 0x1, 0x0, &(0x7f0000000000)) renameat2(r2, &(0x7f0000000080)='./file0\x00', r2, &(0x7f0000000100)='./file1\x00', 0x4) 04:46:52 executing program 1: r0 = perf_event_open(&(0x7f000025c000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x11, r1, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r0, 0x2405, r1) mmap(&(0x7f0000000000/0xb36000)=nil, 0x1e000, 0x1000004, 0x8031, 0xffffffffffffffff, 0x0) 04:46:52 executing program 3: r0 = syz_open_dev$sg(&(0x7f00000000c0)='/dev/sg#\x00', 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000000)={0x53, 0x0, 0x6, 0x0, @buffer={0x209, 0xb8, &(0x7f00000001c0)=""/184}, &(0x7f0000000540)="ad40657ed56c", &(0x7f0000000340)=""/128, 0x0, 0x0, 0x0, &(0x7f0000000040), 0xfffffff6}) [ 666.050988] tmpfs: No value for mount option './file0' 04:46:52 executing program 4: openat$vsock(0xffffffffffffff9c, &(0x7f0000000380)='/dev/vsock\x00', 0x100, 0x0) r0 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000540)='hugetlb.2MB.usage_in_bytes\x00', 0x0, 0x0) ioctl$KVM_IRQ_LINE(r0, 0x4008ae61, &(0x7f0000000500)={0x0, 0x2000000000}) r1 = syz_open_dev$dspn(&(0x7f00000004c0)='/dev/dsp#\x00', 0x1, 0x0) openat$audio(0xffffffffffffff9c, &(0x7f0000000000)='/dev/audio\x00', 0x80, 0x0) ioctl$KVM_SET_FPU(0xffffffffffffffff, 0x41a0ae8d, &(0x7f0000000100)={[], 0x0, 0x5531fee, 0x0, 0x0, 0x9, 0xf000, 0x0, [], 0x5}) r2 = syz_open_dev$usb(&(0x7f0000000580)='/dev/bus/usb/00#/00#\x00', 0x1, 0x2) r3 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) lstat(&(0x7f0000000040)='./file0/file0\x00', &(0x7f0000000080)) ioctl$EXT4_IOC_MIGRATE(0xffffffffffffffff, 0x6609) sendmmsg$unix(0xffffffffffffffff, &(0x7f000000a000)=[{&(0x7f000000a000)=@abs, 0x6e, &(0x7f000000d000), 0x0, &(0x7f0000000600)=ANY=[]}], 0x1, 0x0) r4 = socket$inet6(0xa, 0x2, 0x0) gettid() openat$audio(0xffffffffffffff9c, &(0x7f0000000340)='/dev/audio\x00', 0x101000, 0x0) r5 = getpgid(0x0) kcmp(0x0, r5, 0x0, 0xffffffffffffffff, 0xffffffffffffffff) connect$inet6(r4, &(0x7f0000002740)={0xa, 0x0, 0x0, @mcast2, 0x4}, 0x1c) sendmmsg(r4, &(0x7f0000007e00), 0x136a88c8311572c, 0x0) dup3(r4, r3, 0x80000) setsockopt$inet6_udp_int(r4, 0x11, 0x0, &(0x7f0000000400), 0x4) openat$kvm(0xffffffffffffff9c, &(0x7f00000003c0)='/dev/kvm\x00', 0x0, 0x0) ioctl$VHOST_SET_VRING_CALL(r4, 0x4008af21, &(0x7f00000002c0)={0x0, r3}) ioctl$SNDRV_TIMER_IOCTL_TREAD(r1, 0x40045402, &(0x7f0000000740)) inotify_rm_watch(0xffffffffffffffff, 0x0) ioctl$ifreq_SIOCGIFINDEX_team(0xffffffffffffffff, 0x8933, &(0x7f0000000480)={'team0\x00'}) sched_setaffinity(r5, 0x8, &(0x7f0000000300)=0x5) finit_module(r2, &(0x7f0000000440)='/dev/kvm\x00', 0x2) 04:46:52 executing program 5: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000480)) ioctl$DRM_IOCTL_GET_UNIQUE(r1, 0xc0106401, &(0x7f00000000c0)={0x0, &(0x7f0000000040)}) r2 = openat$autofs(0xffffffffffffff9c, &(0x7f0000000040)='/dev/autofs\x00', 0x400, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x6) r3 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_GUEST_DEBUG(r3, 0x4048ae9b, &(0x7f0000000140)={0x1}) syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000100)=[@text32={0x20, &(0x7f0000000000)="6601669b0f35c4e1fe16846ba49e0000b9940200000f32c4c23dad78e0b9670900000f32660f38827f95b0040f01d10fc71a", 0x32}], 0x1, 0x0, &(0x7f0000000040), 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r3, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000400)=[@text32={0x20, &(0x7f0000000880)="b805000000b98b9400000f01c19a01000000b0000f43d1b8000000000f23d80f21f835800000900f23f80f060f2140b9800000c00f3235000800000f3066ba4300b8f1ffffffefb9800000c00f3235002000000f30c4c3295f4da400", 0x5c}], 0x26433e1, 0x0, &(0x7f0000000300), 0x10000000000000b6) ioctl$KVM_SET_TSS_ADDR(r1, 0xae47, 0xd000) ioctl$KVM_RUN(r3, 0xae80, 0x0) 04:46:52 executing program 2: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r2, &(0x7f0000fe5000/0x18000)=nil, &(0x7f0000000100)=[@text64={0x40, &(0x7f0000000040)="440f3248b800000000008000000f23d80f21f835000000800f23f848b86d980000000000000f23d80f21f835000000600f23f848b80e000000000000000f23d80f21f835000000000f23f80f0f6a3190c744240088a42236c7442402a19a83b3c7442406000000000f011424450fc76a218f6890a26d13ae0f3566baf80cb8e2e5bd81ef66bafc0c66ed", 0x8a}], 0x1, 0x0, &(0x7f0000000140), 0x0) r3 = dup(r2) ioctl$KVM_ENABLE_CAP_CPU(r3, 0xc008ae88, &(0x7f0000000340)={0x79, 0x0, [0x491]}) 04:46:52 executing program 3: r0 = syz_open_dev$sg(&(0x7f00000000c0)='/dev/sg#\x00', 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000000)={0x53, 0x0, 0x6, 0x0, @buffer={0x209, 0xb8, &(0x7f00000001c0)=""/184}, &(0x7f0000000540)="ad40657ed56c", &(0x7f0000000340)=""/128, 0x0, 0x0, 0x0, &(0x7f0000000040), 0xffffffffa0008000}) 04:46:52 executing program 1: r0 = perf_event_open(&(0x7f000025c000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x11, r1, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r0, 0x2405, r1) mmap(&(0x7f0000000000/0xb36000)=nil, 0x2e000, 0x1000004, 0x8031, 0xffffffffffffffff, 0x0) 04:46:52 executing program 0: mkdir(&(0x7f0000000200)='./file0\x00', 0x0) mount(&(0x7f00000002c0)=ANY=[], &(0x7f0000001540)='./file0\x00', &(0x7f0000000280)='tmpfs\x00', 0x0, &(0x7f0000000080)) r0 = open$dir(&(0x7f0000000180)='./file0\x00', 0x0, 0x0) mknodat(r0, &(0x7f0000000140)='./file0\x00', 0x0, 0x0) renameat2(r0, &(0x7f0000000080)='./file0\x00', r0, &(0x7f0000000100)='./file1\x00', 0x4) r1 = syz_open_dev$audion(&(0x7f0000000000)='/dev/audio#\x00', 0x8001, 0x40) getsockopt$inet_sctp6_SCTP_PRIMARY_ADDR(0xffffffffffffffff, 0x84, 0x6, &(0x7f00000002c0)={0x0, @in={{0x2, 0x4e22, @local}}}, &(0x7f0000000040)=0x84) setsockopt$inet_sctp6_SCTP_MAX_BURST(r1, 0x84, 0x14, &(0x7f00000000c0)=@assoc_value={r2, 0x9}, 0x8) 04:46:52 executing program 4: ioctl$KVM_IRQ_LINE(0xffffffffffffffff, 0x4008ae61, &(0x7f0000000500)) r0 = syz_open_dev$dspn(&(0x7f00000004c0)='/dev/dsp#\x00', 0x1, 0x0) openat$audio(0xffffffffffffff9c, &(0x7f0000000000)='/dev/audio\x00', 0x80, 0x0) ioctl$KVM_SET_FPU(0xffffffffffffffff, 0x41a0ae8d, &(0x7f0000000100)={[], 0x0, 0x5531fee, 0x0, 0x0, 0x9, 0xf000, 0x0, [], 0x5}) syz_open_dev$usb(&(0x7f0000000440)='/dev/bus/usb/00#/00#\x00', 0x9, 0x2) r1 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) lstat(&(0x7f0000000040)='./file0/file0\x00', &(0x7f0000000080)) ioctl$EXT4_IOC_MIGRATE(0xffffffffffffffff, 0x6609) sendmmsg$unix(0xffffffffffffffff, &(0x7f000000a000)=[{&(0x7f000000a000)=@abs, 0x6e, &(0x7f000000d000), 0x0, &(0x7f0000000600)=ANY=[]}], 0x1, 0x0) r2 = socket$inet6(0xa, 0x2, 0x0) gettid() r3 = getpgid(0x0) kcmp(0x0, r3, 0x0, 0xffffffffffffffff, 0xffffffffffffffff) connect$inet6(r2, &(0x7f0000002740)={0xa, 0x0, 0x0, @mcast2, 0x4}, 0x1c) sendmmsg(r2, &(0x7f0000007e00), 0x136a88c8311572c, 0x0) setsockopt$inet6_dccp_int(r2, 0x21, 0xb, &(0x7f0000000300)=0xffff, 0x4) setsockopt$inet6_udp_int(r2, 0x11, 0x0, &(0x7f0000000400), 0x4) openat$kvm(0xffffffffffffff9c, &(0x7f00000003c0)='/dev/kvm\x00', 0x0, 0x0) ioctl$VHOST_SET_VRING_CALL(0xffffffffffffff9c, 0x4008af21, &(0x7f00000002c0)={0x0, r1}) ioctl$SNDRV_TIMER_IOCTL_TREAD(r0, 0x40045402, &(0x7f0000000740)) inotify_rm_watch(0xffffffffffffffff, 0x0) ioctl$ifreq_SIOCGIFINDEX_team(0xffffffffffffffff, 0x8933, &(0x7f0000000480)={'team0\x00'}) 04:46:52 executing program 3: r0 = syz_open_dev$sg(&(0x7f00000000c0)='/dev/sg#\x00', 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000000)={0x53, 0x0, 0x6, 0x0, @buffer={0x209, 0xb8, &(0x7f00000001c0)=""/184}, &(0x7f0000000540)="ad40657ed56c", &(0x7f0000000340)=""/128, 0x0, 0x0, 0x0, &(0x7f0000000040), 0xb800000000000000}) [ 666.470831] tmpfs: No value for mount option './file0' 04:46:52 executing program 0: lstat(&(0x7f0000000000)='./file0\x00', &(0x7f00000002c0)) mkdir(&(0x7f0000000200)='./file0\x00', 0x0) mount(&(0x7f00000002c0)=ANY=[], &(0x7f0000001540)='./file0\x00', &(0x7f0000000280)='tmpfs\x00', 0x0, &(0x7f0000000080)) r0 = open$dir(&(0x7f0000000180)='./file0\x00', 0x0, 0x0) mknodat(r0, &(0x7f0000000140)='./file0\x00', 0x0, 0x0) renameat2(r0, &(0x7f0000000080)='./file0\x00', r0, &(0x7f0000000100)='./file1\x00', 0x4) close(r0) 04:46:52 executing program 1: r0 = perf_event_open(&(0x7f000025c000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x11, r1, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r0, 0x2405, r1) mmap(&(0x7f0000000000/0xb36000)=nil, 0x15000, 0x1000004, 0x8031, 0xffffffffffffffff, 0x0) 04:46:52 executing program 2: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r2, &(0x7f0000fe5000/0x18000)=nil, &(0x7f0000000100)=[@text64={0x40, &(0x7f0000000040)="440f3248b800000000008000000f23d80f21f835000000800f23f848b86d980000000000000f23d80f21f835000000600f23f848b80e000000000000000f23d80f21f835000000000f23f80f0f6a3190c744240088a42236c7442402a19a83b3c7442406000000000f011424450fc76a218f6890a26d13ae0f3566baf80cb8e2e5bd81ef66bafc0c66ed", 0x8a}], 0x1, 0x0, &(0x7f0000000140), 0x0) r3 = dup(r2) ioctl$KVM_ENABLE_CAP_CPU(r3, 0xc008ae88, &(0x7f0000000340)={0x79, 0x0, [0x491]}) 04:46:52 executing program 3: r0 = syz_open_dev$sg(&(0x7f00000000c0)='/dev/sg#\x00', 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000000)={0x53, 0x0, 0x6, 0x0, @buffer={0x209, 0xb8, &(0x7f00000001c0)=""/184}, &(0x7f0000000540)="ad40657ed56c", &(0x7f0000000340)=""/128, 0x0, 0x0, 0x0, &(0x7f0000000040), 0x100000000000000}) [ 666.794370] tmpfs: No value for mount option './file0' 04:46:53 executing program 1: r0 = perf_event_open(&(0x7f000025c000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x11, r1, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r0, 0x2405, r1) mmap(&(0x7f0000000000/0xb36000)=nil, 0xe000, 0x1000004, 0x8031, 0xffffffffffffffff, 0x0) 04:46:53 executing program 3: r0 = syz_open_dev$sg(&(0x7f00000000c0)='/dev/sg#\x00', 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000000)={0x53, 0x0, 0x6, 0x0, @buffer={0x209, 0xb8, &(0x7f00000001c0)=""/184}, &(0x7f0000000540)="ad40657ed56c", &(0x7f0000000340)=""/128, 0x0, 0x0, 0x0, &(0x7f0000000040), 0xfcffffff}) 04:46:53 executing program 2: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r2, &(0x7f0000fe5000/0x18000)=nil, &(0x7f0000000100)=[@text64={0x40, &(0x7f0000000040)="440f3248b800000000008000000f23d80f21f835000000800f23f848b86d980000000000000f23d80f21f835000000600f23f848b80e000000000000000f23d80f21f835000000000f23f80f0f6a3190c744240088a42236c7442402a19a83b3c7442406000000000f011424450fc76a218f6890a26d13ae0f3566baf80cb8e2e5bd81ef66bafc0c66ed", 0x8a}], 0x1, 0x0, &(0x7f0000000140), 0x0) r3 = dup(r2) ioctl$KVM_ENABLE_CAP_CPU(r3, 0xc008ae88, &(0x7f0000000340)={0x79, 0x0, [0x491]}) 04:46:53 executing program 0: mkdir(&(0x7f0000000200)='./file0\x00', 0x0) r0 = syz_open_dev$adsp(&(0x7f0000000000)='/dev/adsp#\x00', 0x3, 0x2000) getdents64(r0, &(0x7f00000002c0)=""/4096, 0x1000) mount(&(0x7f00000002c0)=ANY=[], &(0x7f0000001540)='./file0\x00', &(0x7f0000000280)='tmpfs\x00', 0x0, &(0x7f0000000080)) r1 = open$dir(&(0x7f0000000180)='./file0\x00', 0x0, 0x0) mknodat(r1, &(0x7f0000000140)='./file0\x00', 0x0, 0x0) renameat2(r1, &(0x7f0000000080)='./file0\x00', r1, &(0x7f0000000100)='./file1\x00', 0x4) 04:46:53 executing program 1: r0 = perf_event_open(&(0x7f000025c000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x11, r1, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r0, 0x2405, r1) mmap(&(0x7f0000000000/0xb36000)=nil, 0xf000, 0x1000004, 0x8031, 0xffffffffffffffff, 0x0) 04:46:53 executing program 5: prctl$setmm(0x23, 0x7, &(0x7f0000ffa000/0x3000)=nil) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_GET_VCPU_MMAP_SIZE(r0, 0xae04) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000480)) r2 = memfd_create(&(0x7f00000002c0)='/dev/kvm\x00', 0x2) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x12) r3 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x2) ioctl$KVM_SET_GUEST_DEBUG(r3, 0x4048ae9b, &(0x7f0000000140)={0x1}) syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000100)=[@text32={0x20, &(0x7f0000000000)="6601669b0f35c4e1fe16846ba49e0000b9940200000f32c4c23dad78e0b9670900000f32660f38827f95b0040f01d10fc71a", 0x32}], 0x1, 0x0, &(0x7f0000000040), 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r3, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000400)=[@text32={0x20, &(0x7f0000000880)="b805000000b98b9400000f01c19a01000000b0000f43d1b8000000000f23d80f21f835800000900f23f80f060f2140b9800000c00f3235000800000f3066ba4300b8f1ffffffefb9800000c00f3235002000000f30c4c3295f4da400", 0x5c}], 0x26433e1, 0x0, &(0x7f0000000300), 0x10000000000000b6) getsockopt$inet_sctp6_SCTP_FRAGMENT_INTERLEAVE(r1, 0x84, 0x12, &(0x7f0000000340), &(0x7f00000000c0)=0x4) ioctl$KVM_CHECK_EXTENSION_VM(r1, 0xae03, 0xc00000000) ioctl$KVM_RUN(r3, 0xae80, 0x0) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r4 = accept4$inet6(r0, &(0x7f00000001c0)={0xa, 0x0, 0x0, @ipv4}, &(0x7f0000000200)=0x1c, 0x800) getsockopt$inet_sctp6_SCTP_DISABLE_FRAGMENTS(r4, 0x84, 0x8, &(0x7f0000000240), &(0x7f0000000280)=0x4) setsockopt$inet6_udp_encap(r4, 0x11, 0x64, &(0x7f0000000300)=0x3, 0x4) 04:46:53 executing program 4: ioctl$KVM_IRQ_LINE(0xffffffffffffffff, 0x4008ae61, &(0x7f0000000500)) r0 = syz_open_dev$dspn(&(0x7f00000004c0)='/dev/dsp#\x00', 0x1, 0x0) r1 = openat$audio(0xffffffffffffff9c, &(0x7f0000000000)='/dev/audio\x00', 0x80, 0x0) ioctl$KVM_SET_FPU(0xffffffffffffffff, 0x41a0ae8d, &(0x7f0000000100)={[], 0x0, 0x5531fee, 0x0, 0x0, 0x9, 0xf000, 0x0, [], 0x5}) syz_open_dev$usb(&(0x7f0000000440)='/dev/bus/usb/00#/00#\x00', 0x9, 0x2) r2 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) getresuid(&(0x7f0000000300), &(0x7f0000000340)=0x0, &(0x7f0000000380)) r4 = getgid() write$FUSE_ATTR(r1, &(0x7f0000000540)={0x78, 0x0, 0x7, {0x7, 0x1, 0x0, {0x3, 0x9, 0x4, 0xdc7, 0x716f, 0x3, 0x5, 0x0, 0x8, 0x7, 0x4, r3, r4, 0x1, 0xca}}}, 0x78) lstat(&(0x7f0000000040)='./file0/file0\x00', &(0x7f0000000080)) ioctl$EXT4_IOC_MIGRATE(0xffffffffffffffff, 0x6609) sendmmsg$unix(0xffffffffffffffff, &(0x7f000000a000)=[{&(0x7f000000a000)=@abs, 0x6e, &(0x7f000000d000), 0x0, &(0x7f0000000600)=ANY=[]}], 0x1, 0x0) r5 = socket$inet6(0xa, 0x2, 0x0) gettid() r6 = getpgid(0x0) kcmp(0x0, r6, 0x0, 0xffffffffffffffff, 0xffffffffffffffff) connect$inet6(r5, &(0x7f0000002740)={0xa, 0x0, 0x1, @dev={0xfe, 0x80, [], 0x1d}, 0x3}, 0x1c) sendmmsg(r5, &(0x7f0000007e00), 0x136a88c8311572c, 0x0) setsockopt$inet6_udp_int(r5, 0x11, 0x0, &(0x7f0000000400), 0x4) openat$kvm(0xffffffffffffff9c, &(0x7f00000003c0)='/dev/kvm\x00', 0x0, 0x0) ioctl$VHOST_SET_VRING_CALL(0xffffffffffffff9c, 0x4008af21, &(0x7f00000002c0)={0x0, r2}) ioctl$SNDRV_TIMER_IOCTL_TREAD(r0, 0x40045402, &(0x7f0000000740)) inotify_rm_watch(0xffffffffffffffff, 0x0) ioctl$ifreq_SIOCGIFINDEX_team(0xffffffffffffffff, 0x8933, &(0x7f0000000480)={'team0\x00'}) 04:46:53 executing program 3: r0 = syz_open_dev$sg(&(0x7f00000000c0)='/dev/sg#\x00', 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000000)={0x53, 0x0, 0x6, 0x0, @buffer={0x209, 0xb8, &(0x7f00000001c0)=""/184}, &(0x7f0000000540)="ad40657ed56c", &(0x7f0000000340)=""/128, 0x0, 0x0, 0x0, &(0x7f0000000040), 0x2000000}) [ 667.372504] tmpfs: No value for mount option './file0' 04:46:53 executing program 1: r0 = perf_event_open(&(0x7f000025c000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x11, r1, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r0, 0x2405, r1) mmap(&(0x7f0000000000/0xb36000)=nil, 0x25000, 0x1000004, 0x8031, 0xffffffffffffffff, 0x0) 04:46:53 executing program 2: openat$kvm(0xffffffffffffff9c, &(0x7f0000000000)='/dev/kvm\x00', 0x0, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r1, &(0x7f0000fe5000/0x18000)=nil, &(0x7f0000000100)=[@text64={0x40, &(0x7f0000000040)="440f3248b800000000008000000f23d80f21f835000000800f23f848b86d980000000000000f23d80f21f835000000600f23f848b80e000000000000000f23d80f21f835000000000f23f80f0f6a3190c744240088a42236c7442402a19a83b3c7442406000000000f011424450fc76a218f6890a26d13ae0f3566baf80cb8e2e5bd81ef66bafc0c66ed", 0x8a}], 0x1, 0x0, &(0x7f0000000140), 0x0) r2 = dup(r1) ioctl$KVM_ENABLE_CAP_CPU(r2, 0xc008ae88, &(0x7f0000000340)={0x79, 0x0, [0x491]}) 04:46:53 executing program 4: ioctl$KVM_IRQ_LINE(0xffffffffffffffff, 0x4008ae61, &(0x7f0000000500)) r0 = syz_open_dev$dspn(&(0x7f00000004c0)='/dev/dsp#\x00', 0x1, 0x0) openat$audio(0xffffffffffffff9c, &(0x7f0000000000)='/dev/audio\x00', 0x80, 0x0) ioctl$TIOCGPGRP(r0, 0x540f, &(0x7f0000000300)=0x0) capset(&(0x7f0000000340)={0x20080522, r1}, &(0x7f0000000380)={0x2, 0x7, 0x5, 0x480000000, 0x2, 0x7}) ioctl$KVM_SET_FPU(0xffffffffffffffff, 0x41a0ae8d, &(0x7f0000000100)={[], 0x0, 0x5531fee, 0x0, 0x0, 0x9, 0xf000, 0x0, [], 0x5}) r2 = syz_open_dev$usb(&(0x7f0000000440)='/dev/bus/usb/00#/00#\x00', 0x9, 0x2) r3 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) lstat(&(0x7f0000000040)='./file0/file0\x00', &(0x7f0000000080)) ioctl$EXT4_IOC_MIGRATE(0xffffffffffffffff, 0x6609) r4 = socket$inet6(0xa, 0x2, 0x0) gettid() r5 = getpgid(0x0) kcmp(0x0, r5, 0x0, 0xffffffffffffffff, 0xffffffffffffffff) connect$inet6(r4, &(0x7f0000002740)={0xa, 0x0, 0x0, @remote, 0x4}, 0x1c) sendmmsg(r4, &(0x7f0000007e00), 0x136a88c8311572c, 0x0) r6 = openat$qat_adf_ctl(0xffffffffffffff9c, &(0x7f0000000580)='/dev/qat_adf_ctl\x00', 0x10000, 0x0) setsockopt$inet6_udp_int(r4, 0x11, 0x0, &(0x7f0000000400), 0x4) openat$kvm(0xffffffffffffff9c, &(0x7f00000003c0)='/dev/kvm\x00', 0x0, 0x0) ioctl$VHOST_SET_VRING_CALL(0xffffffffffffff9c, 0x4008af21, &(0x7f00000002c0)={0x0, r3}) getsockopt$sock_timeval(r4, 0x1, 0x14, &(0x7f0000000540), &(0x7f00000005c0)=0x10) ioctl$SNDRV_TIMER_IOCTL_TREAD(r0, 0x40045402, &(0x7f0000000740)) r7 = inotify_add_watch(r6, &(0x7f0000000600)='./file0/file0\x00', 0x0) inotify_rm_watch(r2, r7) ioctl$ifreq_SIOCGIFINDEX_team(0xffffffffffffffff, 0x8933, &(0x7f0000000480)={'team0\x00'}) 04:46:53 executing program 0: mkdir(&(0x7f0000000200)='./file0\x00', 0x0) mount(&(0x7f00000002c0)=ANY=[], &(0x7f0000001540)='./file0\x00', &(0x7f0000000280)='tmpfs\x00', 0x0, &(0x7f0000000080)) r0 = open$dir(&(0x7f0000000180)='./file0\x00', 0x0, 0x0) r1 = geteuid() mount$9p_unix(&(0x7f0000000000)='./file0\x00', &(0x7f0000000040)='./file1\x00', &(0x7f00000000c0)='9p\x00', 0x0, &(0x7f00000002c0)={'trans=unix,', {[{@cache_fscache='cache=fscache'}, {@version_9p2000='version=9p2000'}, {@version_u='version=9p2000.u'}, {@cachetag={'cachetag', 0x3d, 'tmpfs\x00'}}, {@cachetag={'cachetag', 0x3d, '$'}}, {@uname={'uname', 0x3d, ')keyring\\'}}, {@cache_mmap='cache=mmap'}, {@aname={'aname', 0x3d, 'tmpfs\x00'}}, {@cachetag={'cachetag', 0x3d, 'vmnet0'}}], [{@fowner_lt={'fowner<', r1}}, {@smackfshat={'smackfshat', 0x3d, 'tmpfs\x00'}}, {@obj_type={'obj_type', 0x3d, '#posix_acl_accessselinuxem1+md5sumppp0'}}]}}) mknodat(r0, &(0x7f0000000140)='./file0\x00', 0x0, 0x0) r2 = semget(0x0, 0x6, 0x0) semctl$GETNCNT(r2, 0x3, 0xe, &(0x7f00000003c0)=""/204) renameat2(r0, &(0x7f0000000080)='./file0\x00', r0, &(0x7f0000000100)='./file1\x00', 0x4) 04:46:53 executing program 3: r0 = syz_open_dev$sg(&(0x7f00000000c0)='/dev/sg#\x00', 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000000)={0x53, 0x0, 0x6, 0x0, @buffer={0x209, 0xb8, &(0x7f00000001c0)=""/184}, &(0x7f0000000540)="ad40657ed56c", &(0x7f0000000340)=""/128, 0x0, 0x0, 0x0, &(0x7f0000000040), 0x902}) [ 667.640902] tmpfs: No value for mount option './file0' 04:46:53 executing program 3: r0 = syz_open_dev$sg(&(0x7f00000000c0)='/dev/sg#\x00', 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000000)={0x53, 0x0, 0x6, 0x0, @buffer={0x209, 0xb8, &(0x7f00000001c0)=""/184}, &(0x7f0000000540)="ad40657ed56c", &(0x7f0000000340)=""/128, 0x0, 0x0, 0x0, &(0x7f0000000040), 0xfffffffe}) 04:46:53 executing program 0: mkdir(&(0x7f0000000200)='./file0\x00', 0x0) mount(&(0x7f00000002c0)=ANY=[], &(0x7f0000001540)='./file0\x00', &(0x7f0000000280)='tmpfs\x00', 0x0, &(0x7f0000000080)) r0 = open$dir(&(0x7f0000000180)='./file0\x00', 0x0, 0x0) socketpair(0x9, 0x2, 0x2, &(0x7f0000000400)={0xffffffffffffffff}) accept4$bt_l2cap(r1, 0x0, &(0x7f0000000440), 0x80800) stat(&(0x7f00000000c0)='./file1\x00', &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x0, 0x0}) mount$overlay(0x0, &(0x7f0000000000)='./file1\x00', &(0x7f0000000040)='overlay\x00', 0x20004, &(0x7f0000000340)={[{@default_permissions='default_permissions'}, {@default_permissions='default_permissions'}, {@metacopy_on='metacopy=on'}], [{@obj_user={'obj_user', 0x3d, 'tmpfs\x00'}}, {@appraise_type='appraise_type=imasig'}, {@smackfshat={'smackfshat', 0x3d, '&^'}}, {@subj_user={'subj_user', 0x3d, '{'}}, {@fowner_eq={'fowner', 0x3d, r2}}, {@smackfstransmute={'smackfstransmute', 0x3d, 'tmpfs\x00'}}, {@smackfsroot={'smackfsroot'}}]}) mknodat(r0, &(0x7f0000000140)='./file0\x00', 0x0, 0x0) renameat2(r0, &(0x7f0000000080)='./file0\x00', r0, &(0x7f0000000100)='./file1\x00', 0x4) rename(&(0x7f00000001c0)='./file1\x00', &(0x7f0000000240)='./file0\x00') 04:46:53 executing program 2: openat$kvm(0xffffffffffffff9c, &(0x7f0000000000)='/dev/kvm\x00', 0x0, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r1, &(0x7f0000fe5000/0x18000)=nil, &(0x7f0000000100)=[@text64={0x40, &(0x7f0000000040)="440f3248b800000000008000000f23d80f21f835000000800f23f848b86d980000000000000f23d80f21f835000000600f23f848b80e000000000000000f23d80f21f835000000000f23f80f0f6a3190c744240088a42236c7442402a19a83b3c7442406000000000f011424450fc76a218f6890a26d13ae0f3566baf80cb8e2e5bd81ef66bafc0c66ed", 0x8a}], 0x1, 0x0, &(0x7f0000000140), 0x0) r2 = dup(r1) ioctl$KVM_ENABLE_CAP_CPU(r2, 0xc008ae88, &(0x7f0000000340)={0x79, 0x0, [0x491]}) 04:46:53 executing program 1: r0 = perf_event_open(&(0x7f000025c000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x11, r1, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r0, 0x2405, r1) mmap(&(0x7f0000000000/0xb36000)=nil, 0x7000, 0x1000004, 0x8031, 0xffffffffffffffff, 0x0) [ 667.875983] tmpfs: No value for mount option './file0' 04:46:54 executing program 5: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = openat$dsp(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/dsp\x00', 0x40a000, 0x0) ioctl$DRM_IOCTL_SET_UNIQUE(r2, 0x40106410, &(0x7f0000000500)={0xba, &(0x7f00000001c0)="c29220b45d68649c990992794db5321f60dd6b91d020e38416cccd92c9da65849eef17040f19555dcfb38815db9fb5e169ec128629201278046c9d09c5afb0cdd599371e0e70dae364ac716db9b1bbe403a3e474b1c1d1a909fea50b9bb60de738e88b4b03d56b055cf69f5ceb083daa7e9d9efdbb1ab012eed1576e8f61bfe20a72d132824517dcb1475cbfe55503c346fd1f35c2eee6bcbeb1380af7b9ba51acd896f9c31aae2f59a6f8d9c19536201b5de3f14331124bfc13"}) uselib(&(0x7f0000000040)='./file0\x00') socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000480)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) getsockopt$inet6_IPV6_IPSEC_POLICY(r2, 0x29, 0x22, &(0x7f0000000300)={{{@in6=@mcast2, @in6=@ipv4={[], [], @broadcast}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@dev}, 0x0, @in6=@ipv4={[], [], @loopback}}}, &(0x7f0000000440)=0xe8) bind$packet(r2, &(0x7f00000004c0)={0x11, 0xff, r5, 0x1, 0x7fff, 0x6, @broadcast}, 0x14) ioctl$PPPIOCSMRU(r3, 0x40047452, &(0x7f00000002c0)=0xfffffffffffffff9) r6 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_GUEST_DEBUG(r6, 0x4048ae9b, &(0x7f0000000140)={0x1}) syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000100)=[@text32={0x20, &(0x7f0000000000)="6601669b0f35c4e1fe16846ba49e0000b9940200000f32c4c23dad78e0b9670900000f32660f38827f95b0040f01d10fc71a", 0x32}], 0x1, 0x0, &(0x7f0000000040), 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r6, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000400)=[@text32={0x20, &(0x7f0000000880)="b805000000b98b9400000f01c19a01000000b0000f43d1b8000000000f23d80f21f835800000900f23f80f060f2140b9800000c00f3235000800000f3066ba4300b8f1ffffffefb9800000c00f3235002000000f30c4c3295f4da400", 0x5c}], 0x26433e1, 0x0, &(0x7f0000000300), 0x10000000000000b6) ioctl$KVM_RUN(r6, 0xae80, 0x0) 04:46:54 executing program 2: openat$kvm(0xffffffffffffff9c, &(0x7f0000000000)='/dev/kvm\x00', 0x0, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r1, &(0x7f0000fe5000/0x18000)=nil, &(0x7f0000000100)=[@text64={0x40, &(0x7f0000000040)="440f3248b800000000008000000f23d80f21f835000000800f23f848b86d980000000000000f23d80f21f835000000600f23f848b80e000000000000000f23d80f21f835000000000f23f80f0f6a3190c744240088a42236c7442402a19a83b3c7442406000000000f011424450fc76a218f6890a26d13ae0f3566baf80cb8e2e5bd81ef66bafc0c66ed", 0x8a}], 0x1, 0x0, &(0x7f0000000140), 0x0) r2 = dup(r1) ioctl$KVM_ENABLE_CAP_CPU(r2, 0xc008ae88, &(0x7f0000000340)={0x79, 0x0, [0x491]}) 04:46:54 executing program 3: r0 = syz_open_dev$sg(&(0x7f00000000c0)='/dev/sg#\x00', 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000000)={0x53, 0x0, 0x6, 0x0, @buffer={0x209, 0xb8, &(0x7f00000001c0)=""/184}, &(0x7f0000000540)="ad40657ed56c", &(0x7f0000000340)=""/128, 0x0, 0x0, 0x0, &(0x7f0000000040), 0x7ffffffff000}) 04:46:54 executing program 1: r0 = perf_event_open(&(0x7f000025c000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x11, r1, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r0, 0x2405, r1) mmap(&(0x7f0000000000/0xb36000)=nil, 0x2c000, 0x1000004, 0x8031, 0xffffffffffffffff, 0x0) 04:46:54 executing program 0: lsetxattr$security_capability(&(0x7f0000000000)='./file0\x00', &(0x7f0000000040)='security.capability\x00', &(0x7f00000000c0)=@v2={0x2000000, [{0x8e3, 0x800000000000}, {0xf5, 0x3}]}, 0x14, 0x1) mkdir(&(0x7f0000000200)='./file0\x00', 0x0) mount(&(0x7f00000002c0)=ANY=[], &(0x7f0000001540)='./file0\x00', &(0x7f0000000280)='tmpfs\x00', 0x0, &(0x7f0000000080)) r0 = open$dir(&(0x7f0000000180)='./file0\x00', 0x0, 0x0) mknodat(r0, &(0x7f0000000140)='./file0\x00', 0x0, 0x0) renameat2(r0, &(0x7f00000001c0)='./file0\x00', r0, &(0x7f0000000100)='./file1\x00', 0x0) lsetxattr$security_ima(&(0x7f0000000080)='./file2\x00', &(0x7f0000000240)='security.ima\x00', &(0x7f00000002c0)=@ng={0x4, 0x6, "5b629473ab7d93ea1f343ed48ad67c7d64"}, 0x13, 0x2) 04:46:54 executing program 4: ioctl$KVM_IRQ_LINE(0xffffffffffffffff, 0x4008ae61, &(0x7f0000000500)) r0 = syz_open_dev$dspn(&(0x7f00000004c0)='/dev/dsp#\x00', 0x1, 0x0) r1 = openat$audio(0xffffffffffffff9c, &(0x7f0000000000)='/dev/audio\x00', 0x80, 0x0) ioctl$KVM_SET_FPU(0xffffffffffffffff, 0x41a0ae8d, &(0x7f0000000100)={[], 0x0, 0x5531fee, 0x0, 0x0, 0x9, 0xf000, 0x0, [], 0x5}) syz_open_dev$usb(&(0x7f0000000440)='/dev/bus/usb/00#/00#\x00', 0x9, 0x2) r2 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x200, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x40000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$apparmor_task_exec(0xffffffffffffff9c, &(0x7f0000000380)='/proc/self/attr/exec\x00', 0x2, 0x0) lstat(&(0x7f0000000040)='./file0/file0\x00', &(0x7f0000000080)) ioctl$EXT4_IOC_MIGRATE(0xffffffffffffffff, 0x6609) sendmmsg$unix(r1, &(0x7f0000000340)=[{&(0x7f000000a000)=@abs, 0x6e, &(0x7f000000d000), 0x0, &(0x7f0000000540)=ANY=[]}], 0x1, 0xffffffffffffffff) r3 = socket$inet6(0xa, 0x2, 0x0) r4 = gettid() r5 = getpgid(0x0) kcmp(0x0, r5, 0x0, 0xffffffffffffffff, 0xffffffffffffffff) connect$inet6(r3, &(0x7f0000002740)={0xa, 0x0, 0x0, @mcast2, 0x4}, 0x1c) sendmmsg(r3, &(0x7f0000007e00), 0x136a88c8311572c, 0x0) setsockopt$inet6_udp_int(r3, 0x11, 0x0, &(0x7f0000000400), 0x4) openat$kvm(0xffffffffffffff9c, &(0x7f00000003c0)='/dev/kvm\x00', 0x0, 0x0) ioctl$VHOST_SET_VRING_CALL(0xffffffffffffff9c, 0x4008af21, &(0x7f00000002c0)={0x0, r2}) sched_setaffinity(r4, 0x8, &(0x7f0000000300)=0xfffffffffffffffb) ioctl$SNDRV_TIMER_IOCTL_TREAD(r0, 0x40045402, &(0x7f0000000740)) inotify_rm_watch(0xffffffffffffffff, 0x0) ioctl$ifreq_SIOCGIFINDEX_team(0xffffffffffffffff, 0x8933, &(0x7f0000000480)={'team0\x00'}) 04:46:54 executing program 2: r0 = ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = ioctl$KVM_CREATE_VCPU(r0, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r2, &(0x7f0000fe5000/0x18000)=nil, &(0x7f0000000100)=[@text64={0x40, &(0x7f0000000040)="440f3248b800000000008000000f23d80f21f835000000800f23f848b86d980000000000000f23d80f21f835000000600f23f848b80e000000000000000f23d80f21f835000000000f23f80f0f6a3190c744240088a42236c7442402a19a83b3c7442406000000000f011424450fc76a218f6890a26d13ae0f3566baf80cb8e2e5bd81ef66bafc0c66ed", 0x8a}], 0x1, 0x0, &(0x7f0000000140), 0x0) r3 = dup(r2) ioctl$KVM_ENABLE_CAP_CPU(r3, 0xc008ae88, &(0x7f0000000340)={0x79, 0x0, [0x491]}) [ 668.332759] tmpfs: No value for mount option './file2' 04:46:54 executing program 3: r0 = syz_open_dev$sg(&(0x7f00000000c0)='/dev/sg#\x00', 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000000)={0x53, 0x0, 0x6, 0x0, @buffer={0x209, 0xb8, &(0x7f00000001c0)=""/184}, &(0x7f0000000540)="ad40657ed56c", &(0x7f0000000340)=""/128, 0x0, 0x0, 0x0, &(0x7f0000000040), 0xa0008000}) 04:46:54 executing program 0: mkdir(&(0x7f0000000040)='./file2\x00', 0xa1) r0 = socket(0x0, 0x5, 0x5) setsockopt$inet6_MCAST_MSFILTER(r0, 0x29, 0x30, &(0x7f00000002c0)={0x0, {{0xa, 0x4e22, 0x6, @dev={0xfe, 0x80, [], 0xf}, 0x5}}, 0x1, 0x2, [{{0xa, 0x4e20, 0x6, @loopback, 0x800}}, {{0xa, 0x4e24, 0x64b, @loopback, 0x8000}}]}, 0x190) mount(&(0x7f00000002c0)=ANY=[], &(0x7f0000001540)='./file0\x00', &(0x7f0000000280)='tmpfs\x00', 0x0, &(0x7f0000000000)) r1 = open$dir(&(0x7f0000000180)='./file0\x00', 0x0, 0x0) r2 = syz_open_dev$midi(&(0x7f0000000240)='/dev/midi#\x00', 0x4, 0x101200) epoll_ctl$EPOLL_CTL_DEL(r2, 0x2, r0) mknodat(r1, &(0x7f0000000140)='./file0\x00', 0x0, 0x0) renameat2(r1, &(0x7f0000000080)='./file0\x00', r1, &(0x7f0000000100)='./file1\x00', 0x4) getsockopt$inet_sctp_SCTP_PR_SUPPORTED(r0, 0x84, 0x71, &(0x7f0000000000)={0x0, 0x8001}, &(0x7f00000000c0)=0x8) getsockopt$inet_sctp6_SCTP_DEFAULT_SNDINFO(r0, 0x84, 0x22, &(0x7f00000001c0)={0x3, 0x800f, 0x10001, 0x10000, r3}, &(0x7f0000000200)=0x10) 04:46:54 executing program 1: r0 = perf_event_open(&(0x7f000025c000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x11, r1, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r0, 0x2405, r1) mmap(&(0x7f0000000000/0xb36000)=nil, 0x27000, 0x1000004, 0x8031, 0xffffffffffffffff, 0x0) 04:46:54 executing program 2: r0 = ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = ioctl$KVM_CREATE_VCPU(r0, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r2, &(0x7f0000fe5000/0x18000)=nil, &(0x7f0000000100)=[@text64={0x40, &(0x7f0000000040)="440f3248b800000000008000000f23d80f21f835000000800f23f848b86d980000000000000f23d80f21f835000000600f23f848b80e000000000000000f23d80f21f835000000000f23f80f0f6a3190c744240088a42236c7442402a19a83b3c7442406000000000f011424450fc76a218f6890a26d13ae0f3566baf80cb8e2e5bd81ef66bafc0c66ed", 0x8a}], 0x1, 0x0, &(0x7f0000000140), 0x0) r3 = dup(r2) ioctl$KVM_ENABLE_CAP_CPU(r3, 0xc008ae88, &(0x7f0000000340)={0x79, 0x0, [0x491]}) 04:46:54 executing program 3: r0 = syz_open_dev$sg(&(0x7f00000000c0)='/dev/sg#\x00', 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000000)={0x53, 0x0, 0x6, 0x0, @buffer={0x209, 0xb8, &(0x7f00000001c0)=""/184}, &(0x7f0000000540)="ad40657ed56c", &(0x7f0000000340)=""/128, 0x0, 0x0, 0x0, &(0x7f0000000040), 0xf6ffffff}) 04:46:55 executing program 5: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000480)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_GUEST_DEBUG(r3, 0x4048ae9b, &(0x7f0000000140)={0x1}) syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000100)=[@text32={0x20, &(0x7f0000000000)="6601669b0f35c4e1fe16846ba49e0000b9940200000f32c4c23dad78e0b9670900000f32660f38827f95b0040f01d10fc71a", 0x32}], 0x1, 0x0, &(0x7f0000000040), 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r3, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000400)=[@text32={0x20, &(0x7f0000000880)="b805000000b98b9400000f01c19a01000000b0000f43d1b8000000000f23d80f21f835800000900f23f80f060f2140b9800000c00f3235000800000f3066ba4300b8f1ffffffefb9800000c00f3235002000000f30c4c3295f4da400", 0x5c}], 0x26433e1, 0x0, &(0x7f0000000300), 0x10000000000000b6) ioctl$KVM_RUN(r3, 0xae80, 0x0) 04:46:55 executing program 2: r0 = ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = ioctl$KVM_CREATE_VCPU(r0, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r2, &(0x7f0000fe5000/0x18000)=nil, &(0x7f0000000100)=[@text64={0x40, &(0x7f0000000040)="440f3248b800000000008000000f23d80f21f835000000800f23f848b86d980000000000000f23d80f21f835000000600f23f848b80e000000000000000f23d80f21f835000000000f23f80f0f6a3190c744240088a42236c7442402a19a83b3c7442406000000000f011424450fc76a218f6890a26d13ae0f3566baf80cb8e2e5bd81ef66bafc0c66ed", 0x8a}], 0x1, 0x0, &(0x7f0000000140), 0x0) r3 = dup(r2) ioctl$KVM_ENABLE_CAP_CPU(r3, 0xc008ae88, &(0x7f0000000340)={0x79, 0x0, [0x491]}) 04:46:55 executing program 0: r0 = open$dir(&(0x7f0000000000)='./file1\x00', 0x2, 0x101) mkdir(&(0x7f0000000200)='./file0\x00', 0x0) r1 = open$dir(&(0x7f0000000180)='./file0\x00', 0x2, 0x110) renameat2(r0, &(0x7f0000000040)='./file1\x00', r0, &(0x7f00000000c0)='./file1\x00', 0x7) mknodat(r1, &(0x7f0000000140)='./file0\x00', 0x0, 0x0) renameat2(r1, &(0x7f0000000080)='./file0\x00', r1, &(0x7f0000000100)='./file1\x00', 0x4) 04:46:55 executing program 3: r0 = syz_open_dev$sg(&(0x7f00000000c0)='/dev/sg#\x00', 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000000)={0x53, 0x0, 0x6, 0x0, @buffer={0x209, 0xb8, &(0x7f00000001c0)=""/184}, &(0x7f0000000540)="ad40657ed56c", &(0x7f0000000340)=""/128, 0x0, 0x0, 0x0, &(0x7f0000000040), 0x8000a0}) 04:46:55 executing program 1: r0 = perf_event_open(&(0x7f000025c000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x11, r1, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r0, 0x2405, r1) mmap(&(0x7f0000000000/0xb36000)=nil, 0x32000, 0x1000004, 0x8031, 0xffffffffffffffff, 0x0) 04:46:55 executing program 4: ioctl$KVM_IRQ_LINE(0xffffffffffffffff, 0x4008ae61, &(0x7f0000000500)) r0 = syz_open_dev$dspn(&(0x7f00000004c0)='/dev/dsp#\x00', 0x1, 0x0) r1 = openat$audio(0xffffffffffffff9c, &(0x7f0000000000)='/dev/audio\x00', 0x80, 0x0) ioctl$KVM_SET_FPU(0xffffffffffffffff, 0x41a0ae8d, &(0x7f0000000100)={[], 0x0, 0x5531fee, 0x0, 0x0, 0x9, 0xf000, 0x0, [], 0x5}) syz_open_dev$usb(&(0x7f0000000440)='/dev/bus/usb/00#/00#\x00', 0x9, 0x2) r2 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) lstat(&(0x7f0000000040)='./file0/file0\x00', &(0x7f0000000080)) ioctl$EXT4_IOC_MIGRATE(0xffffffffffffffff, 0x6609) sendmmsg$unix(0xffffffffffffffff, &(0x7f000000a000)=[{&(0x7f000000a000)=@abs, 0x6e, &(0x7f000000d000), 0x0, &(0x7f0000000600)=ANY=[]}], 0x1, 0x0) r3 = socket$inet6(0xa, 0x2, 0x0) gettid() r4 = getpgid(0x0) kcmp(0x0, r4, 0x0, 0xffffffffffffffff, 0xffffffffffffffff) connect$inet6(r3, &(0x7f0000002740)={0xa, 0x0, 0x0, @mcast2, 0x4}, 0x1c) sendmmsg(r3, &(0x7f0000007e00), 0x136a88c8311572c, 0x0) setsockopt$inet6_udp_int(r3, 0x11, 0x0, &(0x7f0000000400), 0x4) openat$kvm(0xffffffffffffff9c, &(0x7f00000003c0)='/dev/kvm\x00', 0x0, 0x0) ioctl$VHOST_SET_VRING_CALL(0xffffffffffffff9c, 0x4008af21, &(0x7f00000002c0)={0x0, r2}) ioctl$SNDRV_TIMER_IOCTL_TREAD(r0, 0x40045402, &(0x7f0000000740)) ioctl$NBD_DO_IT(r1, 0xab03) inotify_rm_watch(0xffffffffffffffff, 0x0) r5 = openat$audio(0xffffffffffffff9c, &(0x7f0000000300)='/dev/audio\x00', 0x10000, 0x0) r6 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r6, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070") socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000000)={0xffffffffffffffff}) ioctl$BLKZEROOUT(r5, 0x127f, &(0x7f0000000340)={0x7, 0x200}) getsockopt$sock_int(r7, 0x1, 0x2d, &(0x7f000059dffc), &(0x7f0000d8cffc)=0x4) ioctl$ifreq_SIOCGIFINDEX_team(0xffffffffffffffff, 0x8933, &(0x7f0000000480)={'team0\x00'}) 04:46:55 executing program 2: openat$kvm(0xffffffffffffff9c, &(0x7f0000000000)='/dev/kvm\x00', 0x0, 0x0) r0 = ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = ioctl$KVM_CREATE_VCPU(r0, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r2, &(0x7f0000fe5000/0x18000)=nil, &(0x7f0000000100)=[@text64={0x40, &(0x7f0000000040)="440f3248b800000000008000000f23d80f21f835000000800f23f848b86d980000000000000f23d80f21f835000000600f23f848b80e000000000000000f23d80f21f835000000000f23f80f0f6a3190c744240088a42236c7442402a19a83b3c7442406000000000f011424450fc76a218f6890a26d13ae0f3566baf80cb8e2e5bd81ef66bafc0c66ed", 0x8a}], 0x1, 0x0, &(0x7f0000000140), 0x0) r3 = dup(r2) ioctl$KVM_ENABLE_CAP_CPU(r3, 0xc008ae88, &(0x7f0000000340)={0x79, 0x0, [0x491]}) 04:46:55 executing program 0: mkdir(&(0x7f0000000200)='./file0\x00', 0x0) r0 = open$dir(&(0x7f0000000180)='./file0\x00', 0x0, 0x0) mknodat(r0, &(0x7f0000000140)='./file0\x00', 0x0, 0x0) renameat2(r0, &(0x7f0000000080)='./file0\x00', r0, &(0x7f0000000100)='./file1\x00', 0x4) mknod$loop(&(0x7f0000000000)='./file1\x00', 0x24, 0x1) 04:46:55 executing program 3: r0 = syz_open_dev$sg(&(0x7f00000000c0)='/dev/sg#\x00', 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000000)={0x53, 0x0, 0x6, 0x0, @buffer={0x209, 0xb8, &(0x7f00000001c0)=""/184}, &(0x7f0000000540)="ad40657ed56c", &(0x7f0000000340)=""/128, 0x0, 0x0, 0x0, &(0x7f0000000040), 0xb8000000}) 04:46:55 executing program 1: r0 = perf_event_open(&(0x7f000025c000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x11, r1, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r0, 0x2405, r1) mmap(&(0x7f0000000000/0xb36000)=nil, 0x23000, 0x1000004, 0x8031, 0xffffffffffffffff, 0x0) 04:46:55 executing program 2: openat$kvm(0xffffffffffffff9c, &(0x7f0000000000)='/dev/kvm\x00', 0x0, 0x0) r0 = ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = ioctl$KVM_CREATE_VCPU(r0, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r2, &(0x7f0000fe5000/0x18000)=nil, &(0x7f0000000100)=[@text64={0x40, &(0x7f0000000040)="440f3248b800000000008000000f23d80f21f835000000800f23f848b86d980000000000000f23d80f21f835000000600f23f848b80e000000000000000f23d80f21f835000000000f23f80f0f6a3190c744240088a42236c7442402a19a83b3c7442406000000000f011424450fc76a218f6890a26d13ae0f3566baf80cb8e2e5bd81ef66bafc0c66ed", 0x8a}], 0x1, 0x0, &(0x7f0000000140), 0x0) r3 = dup(r2) ioctl$KVM_ENABLE_CAP_CPU(r3, 0xc008ae88, &(0x7f0000000340)={0x79, 0x0, [0x491]}) 04:46:55 executing program 0: mkdir(&(0x7f0000000200)='./file0\x00', 0x0) mount(&(0x7f00000002c0)=ANY=[], &(0x7f0000001540)='./file0\x00', &(0x7f0000000280)='tmpfs\x00', 0x0, &(0x7f0000000080)) r0 = open$dir(&(0x7f0000000180)='./file0\x00', 0x0, 0x0) socketpair(0x4, 0x800, 0xd7d, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) getsockopt$inet_mreqn(0xffffffffffffffff, 0x0, 0x20, &(0x7f00000000c0)={@multicast2, @multicast2, 0x0}, &(0x7f00000001c0)=0xc) setsockopt$inet6_mreq(r1, 0x29, 0x1d, &(0x7f0000000240)={@ipv4={[], [], @local}, r2}, 0x14) mknodat(r0, &(0x7f0000000140)='./file0\x00', 0x0, 0x0) renameat2(r0, &(0x7f0000000080)='./file0\x00', r0, &(0x7f0000000100)='./file1\x00', 0x4) r3 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/sys/net/ipv4/vs/expire_quiescent_template\x00', 0x2, 0x0) ioctl$EVIOCGREP(r3, 0x80084503, &(0x7f00000002c0)=""/4096) [ 669.936376] tmpfs: No value for mount option './file0' 04:46:56 executing program 1: r0 = perf_event_open(&(0x7f000025c000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x11, r1, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r0, 0x2405, r1) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb000, 0x1000004, 0x8031, 0xffffffffffffffff, 0x0) 04:46:56 executing program 3: r0 = syz_open_dev$sg(&(0x7f00000000c0)='/dev/sg#\x00', 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000000)={0x53, 0x0, 0x6, 0x0, @buffer={0x209, 0xb8, &(0x7f00000001c0)=""/184}, &(0x7f0000000540)="ad40657ed56c", &(0x7f0000000340)=""/128, 0x0, 0x0, 0x0, &(0x7f0000000040), 0xb800}) 04:46:56 executing program 2: openat$kvm(0xffffffffffffff9c, &(0x7f0000000000)='/dev/kvm\x00', 0x0, 0x0) r0 = ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = ioctl$KVM_CREATE_VCPU(r0, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r2, &(0x7f0000fe5000/0x18000)=nil, &(0x7f0000000100)=[@text64={0x40, &(0x7f0000000040)="440f3248b800000000008000000f23d80f21f835000000800f23f848b86d980000000000000f23d80f21f835000000600f23f848b80e000000000000000f23d80f21f835000000000f23f80f0f6a3190c744240088a42236c7442402a19a83b3c7442406000000000f011424450fc76a218f6890a26d13ae0f3566baf80cb8e2e5bd81ef66bafc0c66ed", 0x8a}], 0x1, 0x0, &(0x7f0000000140), 0x0) r3 = dup(r2) ioctl$KVM_ENABLE_CAP_CPU(r3, 0xc008ae88, &(0x7f0000000340)={0x79, 0x0, [0x491]}) 04:46:56 executing program 0: mkdir(&(0x7f0000000200)='./file0\x00', 0x4) mount(&(0x7f00000002c0)=ANY=[], &(0x7f0000001540)='./file0\x00', &(0x7f0000000280)='tmpfs\x00', 0x0, &(0x7f0000000080)) r0 = openat$pfkey(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/net/pfkey\x00', 0x48a802, 0x0) r1 = open$dir(&(0x7f0000000180)='./file0\x00', 0x0, 0x0) r2 = syz_open_dev$sndseq(&(0x7f00000000c0)='/dev/snd/seq\x00', 0x0, 0x400) ioctl$sock_FIOGETOWN(r0, 0x8903, &(0x7f00000001c0)=0x0) stat(&(0x7f0000000240)='./file1\x00', &(0x7f00000008c0)={0x0, 0x0, 0x0, 0x0, 0x0}) getresgid(&(0x7f0000000940)=0x0, &(0x7f0000000980), &(0x7f00000009c0)) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000000a00)={0x0}, &(0x7f0000000a40)=0xc) stat(&(0x7f0000000a80)='./file1\x00', &(0x7f0000000ac0)={0x0, 0x0, 0x0, 0x0, 0x0}) stat(&(0x7f0000000b40)='./file0\x00', &(0x7f0000000b80)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) sendmsg$unix(r0, &(0x7f0000000cc0)={&(0x7f00000002c0)=@abs={0x1, 0x0, 0x4e20}, 0x6e, &(0x7f0000000840)=[{&(0x7f0000000340)="c7de3e7f8e211aed20c52bd4ac2560191153a9beb228e4252bbb5dd0fdd6335b6a32b8aafddbbc40c7afe380c4539499b6a2cc95ad658a2197212a00fa38722f200103520174038887adce57c06b73d65a6fda4d82a354b80c9aa940e2206481cd622eb300d54505d1af42dd5efaa824b0c08233c8bbb9d29b74ac928f", 0x7d}, {&(0x7f00000003c0)="e3a990efe936c6daeb2424be60ef514c361a606195033bfb8b770e2693d0bf1f0c59750803abdeb628e9748f0614fae7216ad1ceddb33a37a668349418ee8892380ab937130b7fe130014a224ec285362ebb58aa19c8becadebbd3f63e1f1b3a162d67bca02777ec55f1bbdf0f778b4d168d2d6c7adff2502a890b3011db455281ef3787a52551ba03ad30d01ef3ccf35e2a3f5ac268b126672f40dd95197d9ca40312ff5a5c", 0xa6}, {&(0x7f0000000480)="76fd6eab92c660d0fd490a7bf428f22269965814781b050251ac108c0d8e6d746175214b07f50079b302e1927da524fe9ab91e62a665083604c65d391978b66485bbead54c04d58989ba942898bc148368", 0x51}, {&(0x7f0000000500)="afddbee4827ebcfbe9fb372f60a4d8914975db6bedbdbd19606640f810a6a2d308dc072355318c09fd7096a391610990e0a1cdaa9bd132be12212b64919cf2a43fa6852c", 0x44}, {&(0x7f0000000580)="0b32ebf794acb4ea111272391dc7d934d4e5c5e73d003f368073560a68acf815f4858ecf1e32b5785eeb1a21c49798f84688b499cbb28cba2b891d9e84cb8ddcf49fbb815abfe5c566e68448672891d00a0a90a95f0c7dc920621717470caa1490d4a3f51582ce199ebd29fb346cdbee5e24d0fef79ae5101cbd0e8b5f3cb39eef8b5a99a9a9639b420d3fc4e22483029dd02d739b853bea82fe84bcdfb8329102ac6ac6e9296e6543c2bf775bdfc278851d3ea472c1", 0xb6}, {&(0x7f0000000640)="08a76e084134b86fe4d883c367e9a028d9499460b0172c22860a925959619f11047996dd6e40bf321de8eeeec767670d46df3677fda3b4305eb67c304dd2442af5626f2fd94fd2070318f2dba76efaed4d635646aeb36f71c404866c413f44ee5fb855e3adb7c36b9bc0b10c61be9f26d1bf8d25c80d8e182f8019472c5948491d0b277b39a09ca3243fdc833f4192cf25703e08569a6b902fd761ea8f54fdb4ee79bc52215fa5dc89ecc0aaa92fcc8ba69846d39fb6c4dd4e9e82b1e8790d39ba", 0xc1}, {&(0x7f0000000040)="9c287b16d61026f0b37af488a80b24198ca92e7ee2dc8423b5d974768760c0b319ac2928ef8a3120cc", 0x29}, {&(0x7f0000000740)="4ff2e3e71f13f5fab3d3d1f62a06047fc15f647b6dde1dd4670b8f1b7030004b8768786c524cb0ad98d6fbed5abffe1843de4ce50dc1a43ab0f37ff4ce7aaca60705f24ae050d23cd841e788a8e6ca0d734e153b3e5bdccda9151a02ec37a7902ecbebf9ea6e776bc3179b5bb77cb3aaca0b48d8c46baf596dfc33e7111ad18e643b2443a06bd023d1dcb9c2b20491a803d9e2e25755178b89c624aaa935ea29ebebb6c24d6c5eaec450a36e1f32e5d275ab9cbfb00da59d7b266c0e9e796510262896842c56348ba1712ac0eae0af3fe2b100f2ccb5aa496b1ebcb46761", 0xde}], 0x8, &(0x7f0000000c00)=[@rights={0x30, 0x1, 0x1, [r0, r1, r1, r1, r0, r1, r1, r2]}, @rights={0x18, 0x1, 0x1, [r0]}, @cred={0x20, 0x1, 0x2, r3, r4, r5}, @rights={0x20, 0x1, 0x1, [r0, r0, r1, r0]}, @cred={0x20, 0x1, 0x2, r6, r7, r8}], 0xa8, 0x4005}, 0x4000040) mknodat(r1, &(0x7f0000000140)='./file0\x00', 0x0, 0x0) renameat2(r1, &(0x7f0000000080)='./file0\x00', r1, &(0x7f0000000100)='./file1\x00', 0x4) 04:46:56 executing program 4: ioctl$KVM_IRQ_LINE(0xffffffffffffffff, 0x4008ae61, &(0x7f0000000500)) r0 = syz_open_dev$dspn(&(0x7f00000004c0)='/dev/dsp#\x00', 0x1, 0x0) openat$audio(0xffffffffffffff9c, &(0x7f0000000000)='/dev/audio\x00', 0x80, 0x0) ioctl$KVM_SET_FPU(0xffffffffffffffff, 0x41a0ae8d, &(0x7f0000000100)={[], 0x0, 0x5531fee, 0x0, 0x0, 0x9, 0xf000, 0x0, [], 0x5}) syz_open_dev$usb(&(0x7f0000000440)='/dev/bus/usb/00#/00#\x00', 0x9, 0x2) r1 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) lstat(&(0x7f0000000300)='./file0/file0\x00', &(0x7f0000000080)) ioctl$EXT4_IOC_MIGRATE(0xffffffffffffffff, 0x6609) sendmmsg$unix(0xffffffffffffffff, &(0x7f000000a000)=[{&(0x7f000000a000)=@abs, 0x6e, &(0x7f000000d000), 0x0, &(0x7f0000000600)=ANY=[]}], 0x1, 0x0) r2 = socket$inet6(0xa, 0x2, 0x0) gettid() r3 = getpgid(0x0) kcmp(0x0, r3, 0x0, 0xffffffffffffffff, 0xffffffffffffffff) connect$inet6(r2, &(0x7f0000002740)={0xa, 0x0, 0x0, @mcast2, 0x4}, 0x1c) sendmmsg(r2, &(0x7f0000007e00), 0x136a88c8311572c, 0x0) setsockopt$inet6_udp_int(r2, 0x11, 0x0, &(0x7f0000000400), 0x4) openat$kvm(0xffffffffffffff9c, &(0x7f00000003c0)='/dev/kvm\x00', 0x0, 0x0) ioctl$VHOST_SET_VRING_CALL(0xffffffffffffff9c, 0x4008af21, &(0x7f00000002c0)={0x0, r1}) ioctl$SNDRV_TIMER_IOCTL_TREAD(r0, 0x40045402, &(0x7f0000000740)) inotify_rm_watch(0xffffffffffffffff, 0x0) ioctl$ifreq_SIOCGIFINDEX_team(0xffffffffffffffff, 0x8933, &(0x7f0000000480)={'team0\x00'}) 04:46:56 executing program 5: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000480)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) r4 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) setsockopt$IP_VS_SO_SET_STOPDAEMON(r1, 0x0, 0x48c, &(0x7f0000000040)={0x1, 'bond_slave_0\x00', 0x3}, 0x18) ioctl$KVM_SET_GUEST_DEBUG(r4, 0x4048ae9b, &(0x7f0000000140)={0x1}) sendmsg(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@pppol2tpin6={0x18, 0x1, {0x0, r2, 0x0, 0x4, 0x0, 0x4, {0xa, 0x4e20, 0x4, @loopback, 0x7}}}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000240)="96a6b6cba52a7c865af73c8f0d6f00bc9b44985e287ed7cfbfe682914dd593ee57a245f43a238128358c08b0cd06bc2f74a62ecba0764db9b5691909f77e1c633c3a6ba8d4be4c3b36aa87b712e5391a31bf10cbd6b7deb7b67296118af699ecf640c2b7325adbed54de4d0871b21a0b852b8d4c297bc236b434adff6b156ce7f9d8c6dede", 0x85}, {&(0x7f00000000c0)="25dce49522113c4b4c6bfd1c285d7651f24b180768ae818050bf377b7fae4773ae9e0eb6d777f0e92ae53ecab4e766830a16962a02f0", 0x36}, {&(0x7f0000000300)="63d5ea01abdd1e246f67cc547865ec0fbf6069bd33ae16c42a1e9730044b7bee4d0a8694489252f7f0f75ee81d7bd31024c391301f268106dd5eefe725d7efee732065b51b284e22356c083ec990f446674fbfca4b35183c67df747798ba0491064af455c8dbc3d7fc91002fecd34f0808b533c59291", 0x76}, {0xffffffffffffffff}, {&(0x7f0000000380)="229f393f748c82df12fc36320eb92c600716b4", 0x13}, {&(0x7f00000003c0)="f72a5a0dc944f5f0fb3390a9dffc35dfef6971cf91a04cec93b26e6de7dc1d088cbf", 0x22}, {&(0x7f00000004c0)="dc96754133794e9b3bf726f4c3ad70146cbd7f4d75f08873dd1b0d999996d66725d21e82cd5961533e93c1b520ebc87e042b6103fef5ab6421d274dcbc854b991971e20fd48ead32b86e943019e18676cfe85c103cc670911946ab7847e23f0cc92b87db1b67296baf3e1755f9698681937009a61b5374719efa1d604e01add84f395f9d2267320cb54c3608844879509f5d6d4d2eb60032d6273e6a3ac8868965958dad7add5bb86c", 0xa9}], 0x7, &(0x7f0000000900)=[{0xe0, 0x103, 0x1, "bce46db3b048e60a71cc1f15d9ccf89cf5d8dde69995cc375081e9bea2a3425bcc031cd27c76942b9aa76cb0bb1354117d499b4a8507ee9d54d793233b318009a390657a41cd3e18e7499e5086cf7ee088025c3f7f62fdc6e24c15df689f250f39357e10e125f1943afb29cad5d78944f40debaf1886b56d58e3129ecf5ad694b2927c84fea38c8bd7c97f3476c2728ef48f975a61952c0f176038edf8beea8086a9b8b7e3fbe05a95a3bc2a03965c7b5132578bf20d8a57645b7631a50f1cfd2da475b81b3c347d57dfd8"}, {0xf0, 0x101, 0x200, "fc482186ed48157599571c379a8b01bc6caefd5ab6f4984f1f3177a93afd296be6a5a5aed4fd5901f34248c72c300216e8882cf925d1cdd8d0085f5b01bace7b53031f1606d02be0ba70acee0a5d27fd567703f09c01932a81a3f30a459ddb4947c3f58fe6281c93db0e3ee2b2d5c6b8e88aefd08b1aa5f7a25e95f7818cc293e0c30c754d18d0aecd5c5164473496c258735d9fd4d6b348ae7375f29c63050490702e38830237905aa8ec3dd20fb1107a2128078fcb8d673d928fb164ed0cfe5a686acb210974e1fbdc6cb563ed54f7fcc03ccf6339f263cf22e5b0ded7be8e"}, {0x18, 0x113, 0x9, "c51072"}, {0xf0, 0x0, 0x400, "765e80e30879d05c1f46d5e304d4e28706ba2ef6c7363bee1d2b95619268fc1da422cb0f8acbcba5e242e27de6b7c6305ebfb14abe55b2450cabf26fd035b019c12b5ff287df82296b9d6a1c9c02cbed214d41a75a796108d0282b535976a4f29213c625f82412e16f77a616605ee930492ab37a1a49b0d7a3d0d0298b1c93a2f9ee947b0e7b0c8aa1cf1c85a20633e662dc101145406897345f00d9e64245b4c586aa42ebf9136ce6444231ff431732804bcb45f168318f9facfd21e94cd814b5d9f6f37144c0ac06e70e4563380fd431f8a30dd17ea205f448f9b9"}, {0x1010, 0x0, 0x3f, "b43643129fa56f88492b994d32c6d5d06bf88af474e6503395005aef7528f94ef9ff05406a50a326bd8f08db05e1ac065b34e9c5095ac647707c965289585c634a057d64835a51527da34eda83f286ac263a86fe0d817d13428291173c3cccdf0aa967212315e052ad4666a0170dc31300804a76ddfb2613dab7f64203058d1141041849b140a18c198cea30fdc08425cf4d1d7501cd55f6394f7ba25db418731bbd49757ffd887695963c375ba73f7d227329fb15ab74d40cb66a3c6c12ff0fe3ea387f16dfb76e266e3633984d482011c25d4732cd01d641b3233ed68b8e447bd663a28c0711686befc318d8a6470b799590d7dfd07ede07778f8d9b8e5d4135e5b8556e06096b4eb85936bc6220ad230da9a0b1737c22d1f79f0e40cf2adbd4fc69b82df7e988c3f0a8462c4738ab5e74202d48f91b318dfb22978c69cfb804b69d53912b643b286c580207ed46b15a47c5ba33e79343b64dc6338a61c9443af0e49777b7d289604548a18ad5c873003875e86a743dbdc80cc749a991de203346562e7ab2dead1a95e5ec0939407b2f6d9a7adc1a3dbe303b58f9bbc98c290811309a5cb9938554f900c560b2675d7fc6b0b846b4aea238c0f52ebe3b2969e9c0dd4698187762f559f81296e57407df0b168bd88c83aa013a355b2bbd5f2a90896974a891b731206c679e591f3b66e84ca78c2da99bb4615a833e2754b2d1ac48b1167ae6046541e387a0d2dbf6f57595e6913bb14cbd30d5639c21b6768c94674fdba0f48bafa21cc2e500a901ba7a81f98aa279d0fd3d9de69cb87108e5b1458265918108f062869e2f680b0bd4ad4daf57442ccb4f380cc474ee1f4dfae79e59655fa36fdc6f509af9fa6032353dc4e5587ec7ea6889ba35bdc98324c2720579df380e9afa4dd1e7cd2b559739541c0c608940f94f29b0e76f45669d8b81add11ed42d6dbb627f16dbec4175b2638e0f3d1cd9cdd508e6103d022c917106e6e8d4cd27075ce89e610c3c824f2ae93336ba41be2c5219ec9cfb1723f6b60cf855c7cc79199c36eb6a321cb0e22e78adfe6a42fd87f0819b0ec4527192572431c1278ab620304b9d92dfe667d1d545d644c7c2eebb111cac1ff3b3d1ebd9dfad14fc70f21f732c6608fce96ad7884ff2ae82a8a2cbcc62c65b98708fed7d91de238691b4e13bed00b6bf43ff7d827a421c6236105f0f67f1133abdc64c41ba65a21e5d4d971908924280d70fcc7107913e0ad8dcc540d40e5fdbc9243b0631a77d12506750ae5832016105012e82369333c1d8543f28f66f687336fa0e9cf0f2709d8bee7b22bb82b3ee5c8b17f7d2466805056870240828b3a13db686b0a3482687f4ee622d1b50879a12cba092aa7bcf53480be4cf68b0e70a9e1aa282704062b06d1f6c47e7ffd9a535589f2623a67231e20a3849d88ee526fba8d9ea40a8485a23d583dce981616f77bacf121ed4ea08db385858f040cc511a10d0bb95221cdde03950b06b14beb6d827d9cae4f539ec89f39c21ad61c234b949946711b86756135fd3eb39ca64b5b8acf5d5c9386a51302c694396703fdd13f5d12acb2c5996483b75a0f3ef92e515b4bbc2d6a0f6ddcfaa0bc7ee6b2f64364e9c61d8566cdffe638b685d97f46084cbdfb6882b311f8b20648d4b3fceb9d30ee7e0c8b9f9c442e144a1ae959fd17f42cebce9a049b4c9563db42f80f7a10daa85ff952cabc8a87545e075a322ad026febc47588a1a44fdf56ebe8510d511e378d1398235b0761e20632a0507d12603554f79e7ca0ebf1676e96f8ce6e1e0cd2e320d4f5c5475f50c59bc9ee6ad167715a3d794fe56433f0ab8bc2fabe649c092bd5f906a8b82fe39441f7524d09d3693abaeecbdd5e9b0c8c6a9d0710d5dacfdee5c23abd0566a290d20d1793dee49c770c140f23a9549a505487488fb7274b031a078b5ff507505db4e128502544e5cb16000ff41b85034c924c12e245b7018d9b70eb9d67cfef1d372ef76718cf0dd6eb5487d91481c930ee2fb92f65ef71487095abb1c3d36d5c528e02ff11b950906122e51b2fd4a2f1ac93c2cf5d98cb8389228bbea702607046477200ceb0da1b8d90d43684a46eb619efd47eebd23e761c6bf29bf10b9f8eaf1de9b313534dbac3a6cbe5345ca00bfca109c4b40d6ed145ea0e192bd96c8a2a18abbdcaa924cab6673cfacaafd074cec47c90a887ee21fd859fd6da52951ec7db4995d12f3c9bd651c859f0c314b2fdf2de5ceb2476ecaafa517c4a7d0853746977ac452e79f5018b356ba00f9fec6861f23d8f87bd87b7b55c6a477fd77639d6e9b70671f65e21eef1943b2e60a94df5ae796b3514a060381decd455d6b4b7a70bc8bb6d90cb7290a9d8265b6b11ca98f02b20616374e7a4bbdeec7455b569b8936fe811e54712a900fce1ef3db0f2c2cddf12078a7a5b8d7c7c646b4a43e49b25a7e511538e5a2918688e510d285fb176d7371c4d3cf3e4fcb435e82fd613b0e33502b6b1f4fe489c122612702cdaefeca386213a2d827c9f8f2815a042ba9141db43f7db2abbe533c3e3821721b9aa0f4ccb742f2360e21304a33ff5b0e972e62a921873b39686264425b9a9810719e99ab308bc4f34faadd0bbd3ca46534e70f1bc21786e8a279a3c6db2ec9e4b43d795b918119ac9f7507dcbf0d53ab557ccc4a500e1fa00079ac09d382b623934954d540f9dcc572897a9c31fc3a2a09f43b74dd56fcf8f2c167b88e1e14052beb7e0a28b4b758eac4eae3fc9eb3e1ee22ccf0fbdd97089f7c7643287c4a93db2484b973415ff4e9e09f504324cf1911b13f224f8d2a17b6b82970268b7dc90f67e6b5fe69eeffe45c680387e6f455656188ea645f238907bbd1136ff191d05cde0482474ff2189aaf95fe6946fc2badceefe5cd7b19b506898cf64ca064dd57c619e730f7a644c46a4dbc643f25d682cabdefda58fbcb3341998a811f50e9fbef0d2fcd08e901e8921184fc547599ff1ccfcee00c37ff6ffdfe12c5cdec6e85d1225ff2bf2be589941c616da3c17b7f700a23fdde2c70106f11b2c9b64a4fe32e7744c9422df80a0de74133357f23e83c9677c91ab731e1f81876dd7d1c1947ffc2fdbc4c11ac9e0a961f9913455aac96bfc0e1c804d01c418eebedeb6549f1020bb56cd449126e6610fe409fefd7f26694ebc8e9236ee4032442464db9ae640957e27399833da995756ecd81d6f839bbe3ad8efb2107fa71deddba38f3add468139ef0abadadd4b59a9858bb583d5993cc9590abc12ca89a6db4f2345618588bc0105e7520c29cce4fd3aae0eeae8fb2446afc79dd58e65af322dd46b510fde03e3fa4be183a0b0e94e81d7e809bf82f3f388aec58dd8bb9b482bbff121488c94521d282e45fc968f08f6cd9e99582938561cda56aea38c5c24482efcf6c2c744cb176e0142aa150a955a224b4e16e55c7a8cbf47b866a7e4042ebdb55e0b271d7d6f39e1e06dcbf03c5b371e250f0571b95054324b41641c1713e62f8098825f241520b64a445241e3df93196cac6cd5c6bc38c84498c0a7ff470f6b37321473be5e595ae95e85eaf664e7077b3a29f7e3549708275ff014e038ce196f2d3a7b61c5246540bdce565cb7c7e2ad1d091591f6c87b44d1a4b08b304934f2351ee4d4fd6e0a0ab1d47fab0d9c14d77d987ae0f9d888ce77ac63e665f28a9ee16766832c4eb69b1a55e6e7b09c19c1a7286daa29ed8372ff5dc11f4e9af4eed7a0cb186888d04f37d21b82dc9a82acfe378af12acfc47eae9565f4d3fd1a7415b9c8ab65973fa3f4476722673a8c64226ea54171a72bb577c3adb3a75030eb0c07b7584a1b4f654187c034c97616554fd8240c7d33b8d7e04dac1c993afe0682222a70e543128be5832a33f250fde67799249e02f7e8b851366d6e7e4337189e94e0215ade1749e57735ba339e01a9bafb7bf04f0acc7909e00d57cd35a89bfa3758d3a715b1d20709510d716d24c33999378a7d46716605d5bd143b6d1c82be3dc56c5f3b59a12a33b494952f47b4199f6da06290a5f84ae318a30fe837fb171317a21a910b6267cf0350bf83610e39a0a23f73de5f36423842c18b40d7f70829615db4e3c861bd580747aa031dca8713692422249a9bd9dead6ba522fc0734ba388fd87cdcee4b92929fa2e1e8036f3a007773036ccd09a37a95f7d38b9b432651a08d522acb6560112e8a9059f06e00fb40070fa82821ddd0ebf4bb975fe1e42a4234ac78b56d6f56a3e937d35730ba78464a3bf1b61741a77261ee46c0adbb643b0d033992cd5bcbc890ca924efdfa0e6ce0a1977df0ca7b6378e9fc0dd1d879eb2930ea3a44fa1d688feb5bb7a06cf0a928d961f336242065f3a1edbd4598be4cab3391b6b846b89ca854d9c9ee930482a4277ff262d133fba3006679c98d5dcbfabc79047e34d97d8a166472250ef66b3922b96a537bb03b1fd9f38f48b5016763d81f1c049995fa896deef4011ebb58262f279a066ee43890dff553e96ce867932d2f4c6f5889bb08baf979a0af9a3168614a549aaf79f8922d7fc96ad5be2cc6299e8722ef8b2a31109533c3b0d07a8d10c42a29277f60c97f7e3090391863c9d75ee0fa3d5fad85766895966bd55511f82b264ad36429a004ace911f866dedd8adfe6fd7f640facee53692e53fdd6e238b8b1557b0e7318c1b59f55b55358873007d905b1fe45d98e3e4ce6f6e4f71ee208ca87f116b6a28ef2dddacbdcd6ec3b644676605812b5f18765576a36c04493ebe2ec25b537e0e06c785dceb55e60bc71656a978c679aa5aa2075457dacd6c73683e48b8ca7b233b25fa97de29d80ebf5c173a58922a8449c2c28803f7eadd53e24f2c2add068a6efac32c68a1a9380d151cdba027967d7930ff2560d4af73925792f88fc99a33fb5108cb751b5c273c3b1239d00397bf33bb9690d15310b2560e1bf65b1166b08079e5d250e855e55728282306e2963e64a0644fa5e3b88647237bfa8a805cf817e9c50cefbaed1ede776b9dd73070b88071c231170dae14958e88977145ce23889968f80f38a290d031d1167aa990372b2239f50f55a68305928b6d59cf20071ed1f30103818a39798753ade9400ee75e5229852112711ddf17c881ed2ba00fbb23521bba544c37e25b93eb8ee4501722e6a726b3b95fff839612fe5fa045097b37cf9ee31a7ddc1017b7d02f31c930eeb53cb9a260a77e2de2be6940a7dc39601e2c4e6ccebb23f8bf76bab5e5524426fdd4036482f421372332301b5a67acd515d9c4f220707713ea3ae090587b008b1da1e82238bd87cde172cd4d81f126e82846e6a7478092b42657a54603b8359fd09bc197d34b585ef78f16768fe09593933732c61f168b7b0e1904863b0bfc8fb1e4ceaff630f1b41812533d505348b5172f1e23e36047fd17bd715a2466c786c4d4760fb819bed372c4590c7731981a3425cb8b4be31c6115365168222686807848b06654911cebee2489f0735049a5ef61aff31efb1f0c3effbed2d7fa85465e0891f92887c7c2f7b344c2b0607b712831fc5c4c3c607d13f132d2bd4928fe39972dde5508ae58c896c94b895aa85ecc51ea7701345db28558c3ea6bf6e4bfc594cfba7107e9e21771c20e23f3591baccacf594a9ebb379dccaaf68504c25eec7a319fcf8cf3df4222e3bb1b8ba62675b580120a476cd3d52bcb5f68164ae9bab04aee9224d485034272824c8e173062fcf473311b486d7bd32f4e0d0d69d682c8a8077582b8e31df698ce107f075d888d69d9fc2d6d3cd651f"}], 0x12e8}, 0x4000) syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000100)=[@text32={0x20, &(0x7f0000000000)="6601669b0f35c4e1fe16846ba49e0000b9940200000f32c4c23dad78e0b9670900000f32660f38827f95b0040f01d10fc71a", 0x32}], 0x1, 0x0, &(0x7f0000000040), 0x0) r5 = pkey_alloc(0x0, 0x3) pkey_free(r5) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r4, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000400)=[@text32={0x20, &(0x7f0000000880)="b805000000b98b9400000f01c19a01000000b0000f43d1b8000000000f23d80f21f835800000900f23f80f060f2140b9800000c00f3235000800000f3066ba4300b8f1ffffffefb9800000c00f3235002000000f30c4c3295f4da400", 0x5c}], 0x26433e1, 0x0, &(0x7f0000000300), 0x10000000000000b6) ioctl$KVM_RUN(r4, 0xae80, 0x0) ioctl$KVM_IRQ_LINE(r1, 0x4008ae61, &(0x7f0000000600)={0x1781a523, 0x8000}) 04:46:56 executing program 3: r0 = syz_open_dev$sg(&(0x7f00000000c0)='/dev/sg#\x00', 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000000)={0x53, 0x0, 0x6, 0x0, @buffer={0x209, 0xb8, &(0x7f00000001c0)=""/184}, &(0x7f0000000540)="ad40657ed56c", &(0x7f0000000340)=""/128, 0x0, 0x0, 0x0, &(0x7f0000000040), 0xf0ffffff7f0000}) 04:46:56 executing program 2: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) socketpair$unix(0x1, 0x0, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r3, &(0x7f0000fe5000/0x18000)=nil, &(0x7f0000000100)=[@text64={0x40, &(0x7f0000000040)="440f3248b800000000008000000f23d80f21f835000000800f23f848b86d980000000000000f23d80f21f835000000600f23f848b80e000000000000000f23d80f21f835000000000f23f80f0f6a3190c744240088a42236c7442402a19a83b3c7442406000000000f011424450fc76a218f6890a26d13ae0f3566baf80cb8e2e5bd81ef66bafc0c66ed", 0x8a}], 0x1, 0x0, &(0x7f0000000140), 0x0) r4 = dup(r3) ioctl$KVM_ENABLE_CAP_CPU(r4, 0xc008ae88, &(0x7f0000000340)={0x79, 0x0, [0x491]}) [ 670.290489] tmpfs: No value for mount option './file0' 04:46:56 executing program 1: r0 = perf_event_open(&(0x7f000025c000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x11, r1, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r0, 0x2405, r1) mmap(&(0x7f0000000000/0xb36000)=nil, 0xc000, 0x1000004, 0x8031, 0xffffffffffffffff, 0x0) 04:46:56 executing program 0: mkdir(&(0x7f0000000200)='./file0\x00', 0x0) mount(&(0x7f00000002c0)=ANY=[], &(0x7f0000000040)='./file0\x00', &(0x7f0000000000)='tmpfs\x00', 0x0, &(0x7f0000000240)='\x00') r0 = open$dir(&(0x7f0000000180)='./file0\x00', 0x0, 0x0) mknodat(r0, &(0x7f0000000140)='./file0\x00', 0x0, 0x0) renameat2(r0, &(0x7f00000002c0)='./file0\x00', r0, &(0x7f0000000280)='./file1\x00', 0x4) [ 670.380991] *** Guest State *** [ 670.384339] CR0: actual=0x0000000000040037, shadow=0x0000000020040037, gh_mask=fffffffffffffff7 [ 670.514531] CR4: actual=0x0000000000172c4a, shadow=0x0000000000170c0a, gh_mask=ffffffffffffe871 [ 670.525667] CR3 = 0x0000000000000000 [ 670.530789] RSP = 0x0000000000000f80 RIP = 0x0000000000000000 [ 670.536998] RFLAGS=0x00000002 DR7 = 0x0000000000000400 [ 670.546740] Sysenter RSP=0000000000000f80 CS:RIP=0030:0000000000002810 [ 670.554004] CS: sel=0x0030, attr=0x0409b, limit=0x000fffff, base=0x0000000000000000 [ 670.569485] DS: sel=0x0038, attr=0x04093, limit=0x000fffff, base=0x0000000000000000 [ 670.592053] SS: sel=0x0038, attr=0x04093, limit=0x000fffff, base=0x0000000000000000 [ 670.601134] ES: sel=0x0038, attr=0x04093, limit=0x000fffff, base=0x0000000000000000 [ 670.609391] FS: sel=0x0038, attr=0x04093, limit=0x000fffff, base=0x0000000000000000 04:46:56 executing program 3: r0 = syz_open_dev$sg(&(0x7f00000000c0)='/dev/sg#\x00', 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000000)={0x53, 0x0, 0x6, 0x0, @buffer={0x209, 0xb8, &(0x7f00000001c0)=""/184}, &(0x7f0000000540)="ad40657ed56c", &(0x7f0000000340)=""/128, 0x0, 0x0, 0x0, &(0x7f0000000040), 0x8000a0ffffffff}) [ 670.639523] GS: sel=0x0038, attr=0x04093, limit=0x000fffff, base=0x0000000000000000 [ 670.668731] GDTR: limit=0x000007ff, base=0x0000000000001000 04:46:56 executing program 1: r0 = perf_event_open(&(0x7f000025c000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x11, r1, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r0, 0x2405, r1) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36006, 0x1000004, 0x8031, 0xffffffffffffffff, 0x0) [ 670.688879] LDTR: sel=0x0008, attr=0x04082, limit=0x000007ff, base=0x0000000000001800 [ 670.717338] IDTR: limit=0x000001ff, base=0x0000000000003800 [ 670.811873] TR: sel=0x0000, attr=0x0008b, limit=0x0000ffff, base=0x0000000000000000 [ 670.838831] EFER = 0x0000000000000001 PAT = 0x0007040600070406 [ 670.848325] DebugCtl = 0x0000000000000000 DebugExceptions = 0x0000000000000000 [ 670.855981] Interruptibility = 00000000 ActivityState = 00000000 [ 670.862591] *** Host State *** [ 670.865907] RIP = 0xffffffff8120269c RSP = 0xffff88018127f390 [ 670.872628] CS=0010 SS=0018 DS=0000 ES=0000 FS=0000 GS=0000 TR=0040 [ 670.879221] FSBase=00007fbb753e0700 GSBase=ffff8801daf00000 TRBase=fffffe0000033000 [ 670.887996] GDTBase=fffffe0000031000 IDTBase=fffffe0000000000 [ 670.894088] CR0=0000000080050033 CR3=00000001b0410000 CR4=00000000001426e0 [ 670.901279] Sysenter RSP=fffffe0000032200 CS:RIP=0010:ffffffff87c01360 [ 670.908062] EFER = 0x0000000000000d01 PAT = 0x0407050600070106 [ 670.914411] *** Control State *** [ 670.917989] PinBased=0000003f CPUBased=b5986dfa SecondaryExec=000000ca [ 670.924845] EntryControls=0000d1ff ExitControls=002fefff [ 670.930551] ExceptionBitmap=00060042 PFECmask=00000000 PFECmatch=00000000 [ 670.937600] VMEntry: intr_info=00000000 errcode=00000000 ilen=00000000 [ 670.944453] VMExit: intr_info=00000000 errcode=00000000 ilen=00000000 [ 670.951215] reason=80000021 qualification=0000000000000000 [ 670.957641] IDTVectoring: info=00000000 errcode=00000000 [ 670.963276] TSC Offset = 0xfffffe96c1ead483 [ 670.967718] EPT pointer = 0x00000001c489301e [ 670.996337] *** Guest State *** [ 671.000057] CR0: actual=0x0000000000040037, shadow=0x0000000020040037, gh_mask=fffffffffffffff7 [ 671.009220] CR4: actual=0x0000000000172c4a, shadow=0x0000000000170c0a, gh_mask=ffffffffffffe871 [ 671.018290] CR3 = 0x0000000000000000 [ 671.022332] RSP = 0x0000000000000f80 RIP = 0x0000000000000000 [ 671.028542] RFLAGS=0x00000002 DR7 = 0x0000000000000400 [ 671.034798] Sysenter RSP=0000000000000f80 CS:RIP=0030:0000000000002810 [ 671.041829] CS: sel=0x0030, attr=0x0409b, limit=0x000fffff, base=0x0000000000000000 [ 671.041856] DS: sel=0x0038, attr=0x04093, limit=0x000fffff, base=0x0000000000000000 [ 671.058030] SS: sel=0x0038, attr=0x04093, limit=0x000fffff, base=0x0000000000000000 [ 671.066272] ES: sel=0x0038, attr=0x04093, limit=0x000fffff, base=0x0000000000000000 [ 671.074513] FS: sel=0x0038, attr=0x04093, limit=0x000fffff, base=0x0000000000000000 [ 671.082778] GS: sel=0x0038, attr=0x04093, limit=0x000fffff, base=0x0000000000000000 [ 671.097208] GDTR: limit=0x000007ff, base=0x0000000000001000 [ 671.105755] LDTR: sel=0x0008, attr=0x04082, limit=0x000007ff, base=0x0000000000001800 [ 671.114608] IDTR: limit=0x000001ff, base=0x0000000000003800 [ 671.122873] TR: sel=0x0000, attr=0x0008b, limit=0x0000ffff, base=0x0000000000000000 [ 671.131123] EFER = 0x0000000000000001 PAT = 0x0007040600070406 [ 671.137816] DebugCtl = 0x0000000000000000 DebugExceptions = 0x0000000000000000 [ 671.145684] Interruptibility = 00000000 ActivityState = 00000000 [ 671.152010] *** Host State *** [ 671.155236] RIP = 0xffffffff8120269c RSP = 0xffff88018127f390 [ 671.161424] CS=0010 SS=0018 DS=0000 ES=0000 FS=0000 GS=0000 TR=0040 [ 671.167851] FSBase=00007fbb753e0700 GSBase=ffff8801daf00000 TRBase=fffffe0000033000 [ 671.175732] GDTBase=fffffe0000031000 IDTBase=fffffe0000000000 [ 671.181691] CR0=0000000080050033 CR3=00000001b0410000 CR4=00000000001426e0 [ 671.188700] Sysenter RSP=fffffe0000032200 CS:RIP=0010:ffffffff87c01360 [ 671.195692] EFER = 0x0000000000000d01 PAT = 0x0407050600070106 [ 671.202020] *** Control State *** [ 671.205649] PinBased=0000003f CPUBased=b5986dfa SecondaryExec=000000ca 04:46:57 executing program 5: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000480)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_GUEST_DEBUG(r3, 0x4048ae9b, &(0x7f0000000140)={0x1}) syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000100)=[@text32={0x20, &(0x7f0000000000)="6601669b0f35c4e1fe16846ba49e0000b9940200000f32c4c23dad78e0b9670900000f32660f38827f95b0040f01d10fc71a", 0x32}], 0x1, 0x0, &(0x7f0000000040), 0x0) setsockopt$inet_MCAST_JOIN_GROUP(r3, 0x0, 0x2a, &(0x7f00000001c0)={0x5, {{0x2, 0x4e20, @loopback}}}, 0x88) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r3, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000400)=[@text32={0x20, &(0x7f0000000880)="b805000000b98b9400000f01c19a01000000b0000f43d1b8000000000f23d80f21f835800000900f23f80f060f2140b9800000c00f3235000800000f3066ba4300b8f1ffffffefb9800000c00f3235002000000f30c4c3295f4da400", 0x5c}], 0x26433e1, 0x0, &(0x7f0000000300), 0x10000000000000b6) ioctl$KVM_RUN(r3, 0xae80, 0x0) ioctl$KVM_TPR_ACCESS_REPORTING(r3, 0xc028ae92, &(0x7f0000000040)={0xffffffffffffffc0, 0x3}) 04:46:57 executing program 0: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) r4 = dup(r3) ioctl$KVM_ENABLE_CAP_CPU(r4, 0xc008ae88, &(0x7f0000000340)={0x79, 0x0, [0x4d0]}) 04:46:57 executing program 2: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) socketpair$unix(0x1, 0x0, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r3, &(0x7f0000fe5000/0x18000)=nil, &(0x7f0000000100)=[@text64={0x40, &(0x7f0000000040)="440f3248b800000000008000000f23d80f21f835000000800f23f848b86d980000000000000f23d80f21f835000000600f23f848b80e000000000000000f23d80f21f835000000000f23f80f0f6a3190c744240088a42236c7442402a19a83b3c7442406000000000f011424450fc76a218f6890a26d13ae0f3566baf80cb8e2e5bd81ef66bafc0c66ed", 0x8a}], 0x1, 0x0, &(0x7f0000000140), 0x0) r4 = dup(r3) ioctl$KVM_ENABLE_CAP_CPU(r4, 0xc008ae88, &(0x7f0000000340)={0x79, 0x0, [0x491]}) 04:46:57 executing program 4: ioctl$KVM_IRQ_LINE(0xffffffffffffffff, 0x4008ae61, &(0x7f0000000500)) r0 = syz_open_dev$dspn(&(0x7f00000004c0)='/dev/dsp#\x00', 0x1, 0x0) r1 = openat$audio(0xffffffffffffff9c, &(0x7f0000000000)='/dev/audio\x00', 0x80, 0x0) ioctl$KVM_SET_FPU(0xffffffffffffffff, 0x41a0ae8d, &(0x7f0000000100)={[], 0x0, 0x3, 0x0, 0x0, 0x9, 0xf000, 0x0, [], 0x5}) r2 = syz_open_dev$usb(&(0x7f0000000440)='/dev/bus/usb/00#/00#\x00', 0x9, 0x2) mknod$loop(&(0x7f0000000300)='./file0/file0\x00', 0x8040, 0x0) sendto$inet6(r1, &(0x7f0000000540)="72407e3bf086c3eb6670fb8b8c273e975ab17ac2228d886ec948146cb17fc324d543150a534bbcb5237d10ad3ad6ba1a24a2ee73ccb7c26bd80b797480be011c657d50a558526adb2a9e1b2a845962e95ed42d447188773651ee3c59ecffc48383de8342521e4dc3d82aba17c304bfadba51e13a154ca228681a0e050dba41a6b8e4ea85b4f65b6c77ebe1adecd7c386effc8a397311232b116a2cc7e3e4f39cda1d9aed423a14fd23b502fdee9a0ee9c9a078bb42", 0xb5, 0x10, &(0x7f0000000600)={0xa, 0x4e24, 0xf7f, @mcast2, 0x5}, 0x1c) r3 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) lstat(&(0x7f0000000040)='./file0/file0\x00', &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$EXT4_IOC_MIGRATE(r1, 0x6609) sendmmsg$unix(0xffffffffffffffff, &(0x7f000000a000)=[{&(0x7f000000a000)=@abs, 0x6e, &(0x7f000000d000), 0x0, &(0x7f0000000600)=ANY=[]}], 0x1, 0x0) r6 = socket$inet6(0xa, 0x5, 0x1) r7 = gettid() setsockopt$sock_cred(r6, 0x1, 0x11, &(0x7f0000000340)={r7, r4, r5}, 0xffffffffffffffc4) getpgid(0x0) connect$inet6(r6, &(0x7f0000002740)={0xa, 0x0, 0x0, @mcast2, 0x4}, 0x1c) sendmmsg(r6, &(0x7f0000007e00), 0x136a88c8311572c, 0x0) setsockopt$inet6_udp_int(r6, 0x11, 0x0, &(0x7f0000000400), 0x4) ioctl$ifreq_SIOCGIFINDEX_team(r2, 0x8933, &(0x7f00000008c0)={'team0\x00', 0x0}) ioctl$sock_inet6_SIOCDELRT(r1, 0x890c, &(0x7f0000000900)={@empty, @mcast1, @mcast2, 0x3, 0x5f86, 0x7, 0x100, 0x80000001, 0x80040002, r8}) openat$kvm(0xffffffffffffff9c, &(0x7f00000003c0)='/dev/kvm\x00', 0x0, 0x0) setsockopt$bt_hci_HCI_TIME_STAMP(r0, 0x0, 0x3, &(0x7f0000000380)=0x4, 0x4) ioctl$VHOST_SET_VRING_CALL(0xffffffffffffff9c, 0x4008af21, &(0x7f00000002c0)={0x0, r3}) ioctl$SNDRV_TIMER_IOCTL_TREAD(r2, 0x40045402, &(0x7f0000000740)) inotify_rm_watch(0xffffffffffffffff, 0x0) ioctl$ifreq_SIOCGIFINDEX_team(0xffffffffffffffff, 0x8933, &(0x7f0000000480)={'team0\x00'}) 04:46:57 executing program 3: r0 = syz_open_dev$sg(&(0x7f00000000c0)='/dev/sg#\x00', 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000000)={0x53, 0x0, 0x6, 0x0, @buffer={0x209, 0xb8, &(0x7f00000001c0)=""/184}, &(0x7f0000000540)="ad40657ed56c", &(0x7f0000000340)=""/128, 0x0, 0x0, 0x0, &(0x7f0000000040), 0x600000000000000}) [ 671.212379] EntryControls=0000d1ff ExitControls=002fefff [ 671.218128] ExceptionBitmap=00060042 PFECmask=00000000 PFECmatch=00000000 [ 671.225219] VMEntry: intr_info=00000000 errcode=00000000 ilen=00000000 [ 671.232064] VMExit: intr_info=00000000 errcode=00000000 ilen=00000000 [ 671.239313] reason=80000021 qualification=0000000000000000 [ 671.246022] IDTVectoring: info=00000000 errcode=00000000 [ 671.251527] TSC Offset = 0xfffffe96c1ead483 [ 671.255888] EPT pointer = 0x00000001c489301e 04:46:57 executing program 3: r0 = syz_open_dev$sg(&(0x7f00000000c0)='/dev/sg#\x00', 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000000)={0x53, 0x0, 0x6, 0x0, @buffer={0x209, 0xb8, &(0x7f00000001c0)=""/184}, &(0x7f0000000540)="ad40657ed56c", &(0x7f0000000340)=""/128, 0x0, 0x0, 0x0, &(0x7f0000000040), 0x1000000}) 04:46:57 executing program 2: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) socketpair$unix(0x1, 0x0, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r3, &(0x7f0000fe5000/0x18000)=nil, &(0x7f0000000100)=[@text64={0x40, &(0x7f0000000040)="440f3248b800000000008000000f23d80f21f835000000800f23f848b86d980000000000000f23d80f21f835000000600f23f848b80e000000000000000f23d80f21f835000000000f23f80f0f6a3190c744240088a42236c7442402a19a83b3c7442406000000000f011424450fc76a218f6890a26d13ae0f3566baf80cb8e2e5bd81ef66bafc0c66ed", 0x8a}], 0x1, 0x0, &(0x7f0000000140), 0x0) r4 = dup(r3) ioctl$KVM_ENABLE_CAP_CPU(r4, 0xc008ae88, &(0x7f0000000340)={0x79, 0x0, [0x491]}) 04:46:57 executing program 0: socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000023c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) recvmsg$kcm(0xffffffffffffffff, &(0x7f0000002100)={&(0x7f0000001d40)=@xdp, 0x80, &(0x7f0000002080)=[{&(0x7f0000001dc0)=""/116, 0x74}, {&(0x7f0000001e40)=""/164, 0xa4}, {&(0x7f0000001f80)=""/199, 0xc7}], 0x3, &(0x7f00000020c0)=""/10, 0xa}, 0x20) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000640)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETLINK(r1, 0x400454cd, 0x1) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000007c0)={0xffffffffffffffff, 0x0, 0x1, 0x1000, &(0x7f0000000000)='?', &(0x7f0000004800)=""/4096}, 0x28) close(0xffffffffffffffff) socket$kcm(0x2, 0x0, 0x2) socketpair$unix(0x1, 0x0, 0x0, &(0x7f0000000080)) r2 = bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0xc, 0xe, &(0x7f0000000380)=ANY=[@ANYBLOB="b702000004000000bfa30000000000000703000000feffff7a0af0fff8ffffff79a4f0ff00000000b7060000ffffffff2d6405000000000065040400010000000404000001007d60b7030000000000006a0a00fe00000000850000000d000000b7000000000000009500000000000000"], &(0x7f0000000340)='syzkaller\x00'}, 0x48) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000140)={r2, 0x1800000000000060, 0xe, 0x29, &(0x7f0000000000)="b90703e6680d698cb89e40f02cea", &(0x7f00000000c0)=""/41, 0x100}, 0x28) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000400)={r2, 0x0, 0x17, 0x33, &(0x7f0000000740)="b46f6e46830d3904488d8fac5d9b043cb80a24c219a20c", &(0x7f0000000280)=""/51, 0x7cd}, 0x28) close(0xffffffffffffffff) ioctl$PERF_EVENT_IOC_PERIOD(0xffffffffffffffff, 0x8955, &(0x7f0000000000)) close(r1) 04:46:57 executing program 3: r0 = syz_open_dev$sg(&(0x7f00000000c0)='/dev/sg#\x00', 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000000)={0x53, 0x0, 0x6, 0x0, @buffer={0x209, 0xb8, &(0x7f00000001c0)=""/184}, &(0x7f0000000540)="ad40657ed56c", &(0x7f0000000340)=""/128, 0x0, 0x0, 0x0, &(0x7f0000000040), 0x600}) 04:46:57 executing program 4: ioctl$KVM_IRQ_LINE(0xffffffffffffffff, 0x4008ae61, &(0x7f0000000500)) r0 = syz_open_dev$dspn(&(0x7f00000004c0)='/dev/dsp#\x00', 0x1, 0x0) r1 = openat$audio(0xffffffffffffff9c, &(0x7f0000000000)='/dev/audio\x00', 0x80, 0x0) ioctl$KVM_SET_FPU(0xffffffffffffffff, 0x41a0ae8d, &(0x7f0000000100)={[], 0x0, 0x5531fee, 0x0, 0x0, 0x9, 0xf000, 0x0, [], 0x5}) syz_open_dev$usb(&(0x7f0000000440)='/dev/bus/usb/00#/00#\x00', 0x9, 0x2) lstat(&(0x7f0000000040)='./file0/file0\x00', &(0x7f0000000080)) ioctl$EXT4_IOC_MIGRATE(0xffffffffffffffff, 0x6609) sendmmsg$unix(0xffffffffffffffff, &(0x7f000000a000)=[{&(0x7f000000a000)=@abs, 0x6e, &(0x7f000000d000), 0x0, &(0x7f0000000600)=ANY=[]}], 0x1, 0x0) r2 = socket$inet6(0xa, 0x2, 0x0) r3 = gettid() r4 = getpgid(0x0) kcmp(0x0, r4, 0x0, 0xffffffffffffffff, 0xffffffffffffffff) connect$inet6(r2, &(0x7f0000002740)={0xa, 0x0, 0x0, @mcast2, 0x4}, 0x1c) ioctl$UI_DEV_DESTROY(r1, 0x5502) sendmmsg(r2, &(0x7f0000007e00), 0x136a88c8311572c, 0x0) getsockopt$inet6_mreq(r0, 0x29, 0x1f, &(0x7f0000000340)={@dev, 0x0}, &(0x7f0000000380)=0x14) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000540)={'team_slave_1\x00', r5}) setsockopt$inet6_udp_int(r2, 0x11, 0x0, &(0x7f0000000400), 0x4) openat$kvm(0xffffffffffffff9c, &(0x7f00000003c0)='/dev/kvm\x00', 0x0, 0x0) ioctl$VHOST_SET_VRING_CALL(0xffffffffffffff9c, 0x4008af21, &(0x7f00000002c0)) getpgid(r4) ioctl$SNDRV_TIMER_IOCTL_TREAD(r0, 0x40045402, &(0x7f0000000740)) inotify_rm_watch(r1, 0x0) ioctl$ifreq_SIOCGIFINDEX_team(0xffffffffffffffff, 0x8933, &(0x7f0000000480)={'team0\x00'}) syz_open_procfs(r3, &(0x7f0000000300)='attr/current\x00') 04:46:57 executing program 1: r0 = perf_event_open(&(0x7f000025c000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x11, r1, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r0, 0x2405, r1) mmap(&(0x7f0000000000/0xb36000)=nil, 0x34000, 0x1000004, 0x8031, 0xffffffffffffffff, 0x0) [ 671.720365] ODEBUG: object 00000000d27bc348 is on stack 000000008b46aaa9, but NOT annotated. [ 671.724021] ODEBUG: object 00000000aa801e32 is on stack 00000000520c0359, but NOT annotated. [ 671.732065] WARNING: CPU: 0 PID: 25743 at lib/debugobjects.c:369 __debug_object_init.cold.14+0x51/0xdf [ 671.740603] WARNING: CPU: 1 PID: 25748 at lib/debugobjects.c:369 __debug_object_init.cold.14+0x51/0xdf [ 671.749674] Kernel panic - not syncing: panic_on_warn set ... [ 671.759110] Modules linked in: [ 671.764994] CPU: 0 PID: 25743 Comm: syz-executor0 Not tainted 4.19.0-rc8-next-20181019+ #98 [ 671.768176] CPU: 1 PID: 25748 Comm: syz-executor0 Not tainted 4.19.0-rc8-next-20181019+ #98 [ 671.776828] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 671.776839] Call Trace: [ 671.785340] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 671.794706] dump_stack+0x244/0x39d [ 671.797274] RIP: 0010:__debug_object_init.cold.14+0x51/0xdf [ 671.806617] ? dump_stack_print_info.cold.1+0x20/0x20 [ 671.810233] Code: ea 03 80 3c 02 00 75 7c 49 8b 54 24 18 48 89 de 48 c7 c7 c0 f1 40 88 4c 89 85 d0 fd ff ff e8 09 8c d1 fd 4c 8b 85 d0 fd ff ff <0f> 0b e9 09 d6 ff ff 41 83 c4 01 b8 ff ff 37 00 44 89 25 b7 4e 66 [ 671.815944] panic+0x2ad/0x55c [ 671.821114] RSP: 0018:ffff8801b8e8f308 EFLAGS: 00010086 [ 671.840026] ? add_taint.cold.5+0x16/0x16 [ 671.843211] RAX: 0000000000000050 RBX: ffff8801b8e8faf8 RCX: ffffc90002264000 [ 671.848566] ? __warn.cold.8+0x5/0x45 [ 671.852701] RDX: 0000000000000000 RSI: ffffffff816585a5 RDI: 0000000000000005 [ 671.859988] ? __debug_object_init.cold.14+0x51/0xdf [ 671.863773] RBP: ffff8801b8e8f560 R08: ffff8801c1ae2128 R09: ffffed003b5e5008 [ 671.871045] __warn.cold.8+0x20/0x45 [ 671.876134] R10: ffffed003b5e5008 R11: ffff8801daf28047 R12: ffff88017e6bc600 [ 671.883402] ? __debug_object_init.cold.14+0x51/0xdf [ 671.887111] R13: 000000000007c4c0 R14: ffff88017e6bc600 R15: ffff8801c1ae2118 [ 671.894382] report_bug+0x254/0x2d0 [ 671.899491] FS: 00007f7002653700(0000) GS:ffff8801daf00000(0000) knlGS:0000000000000000 [ 671.906763] do_error_trap+0x11b/0x200 [ 671.910381] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 671.918604] do_invalid_op+0x36/0x40 [ 671.922482] CR2: 00007f7002652db8 CR3: 00000001bc4a5000 CR4: 00000000001426e0 [ 671.928364] ? __debug_object_init.cold.14+0x51/0xdf [ 671.932057] Call Trace: [ 671.939336] invalid_op+0x14/0x20 [ 671.944445] ? debug_object_free+0x690/0x690 [ 671.947017] RIP: 0010:__debug_object_init.cold.14+0x51/0xdf [ 671.950460] ? check_preemption_disabled+0x48/0x280 [ 671.954863] Code: ea 03 80 3c 02 00 75 7c 49 8b 54 24 18 48 89 de 48 c7 c7 c0 f1 40 88 4c 89 85 d0 fd ff ff e8 09 8c d1 fd 4c 8b 85 d0 fd ff ff <0f> 0b e9 09 d6 ff ff 41 83 c4 01 b8 ff ff 37 00 44 89 25 b7 4e 66 [ 671.960572] ? debug_smp_processor_id+0x1c/0x20 [ 671.965586] RSP: 0018:ffff880184c87308 EFLAGS: 00010086 [ 671.984497] ? perf_trace_lock+0x14d/0x7a0 [ 671.989153] RAX: 0000000000000050 RBX: ffff880184c87af8 RCX: ffffc90002063000 [ 671.994514] ? lock_is_held_type+0x210/0x210 [ 671.998732] RDX: 0000000000000000 RSI: ffffffff816585a5 RDI: 0000000000000005 [ 672.006004] ? save_stack+0xa9/0xd0 [ 672.010395] RBP: ffff880184c87560 R08: ffff8801be901c50 R09: ffffed003b5c5008 [ 672.017671] ? save_stack+0x43/0xd0 [ 672.021282] R10: ffffed003b5c5008 R11: ffff8801dae28047 R12: ffff8801bd3f0200 [ 672.028558] ? kasan_kmalloc+0xc7/0xe0 [ 672.032193] R13: 0000000000028940 R14: ffff8801bd3f0200 R15: ffff8801be901c40 [ 672.032221] ? vprintk_func+0x85/0x181 [ 672.039483] ? bpf_test_init.isra.10+0x98/0x100 [ 672.043363] ? __debug_object_init.cold.14+0x4a/0xdf [ 672.050624] ? bpf_prog_test_run_skb+0x184/0xc40 [ 672.054519] ? lockdep_hardirqs_on+0x3bb/0x5b0 [ 672.059181] ? bpf_prog_test_run+0x130/0x1a0 [ 672.064276] ? debug_object_free+0x690/0x690 [ 672.069020] ? __x64_sys_bpf+0x3d8/0x510 [ 672.073603] ? check_preemption_disabled+0x48/0x280 [ 672.078003] ? do_syscall_64+0x1b9/0x820 [ 672.082400] ? debug_smp_processor_id+0x1c/0x20 [ 672.086542] ? entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 672.091549] ? perf_trace_lock+0x14d/0x7a0 [ 672.095605] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 672.100264] ? _raw_spin_unlock_irqrestore+0x6d/0xd0 [ 672.105619] ? check_preemption_disabled+0x48/0x280 [ 672.109849] ? lock_is_held_type+0x210/0x210 [ 672.115375] ? check_preemption_disabled+0x48/0x280 [ 672.120475] ? save_stack+0xa9/0xd0 [ 672.125479] ? debug_smp_processor_id+0x1c/0x20 [ 672.129878] ? save_stack+0x43/0xd0 [ 672.134887] ? perf_trace_lock+0x14d/0x7a0 [ 672.138498] ? kasan_kmalloc+0xc7/0xe0 [ 672.143158] debug_object_init+0x16/0x20 [ 672.146780] ? bpf_test_init.isra.10+0x98/0x100 [ 672.151009] init_timer_key+0xa9/0x480 [ 672.154894] ? zap_class+0x640/0x640 [ 672.158951] ? init_timer_on_stack_key+0xe0/0xe0 [ 672.163614] ? do_syscall_64+0x1b9/0x820 [ 672.167499] ? __might_fault+0x12b/0x1e0 [ 672.171241] ? entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 672.175999] ? __lockdep_init_map+0x105/0x590 [ 672.180059] ? find_held_lock+0x36/0x1c0 [ 672.184105] ? __lockdep_init_map+0x105/0x590 [ 672.189463] debug_object_init+0x16/0x20 [ 672.193951] ? lockdep_init_map+0x9/0x10 [ 672.198006] init_timer_key+0xa9/0x480 [ 672.202494] sock_init_data+0xe1/0xdc0 [ 672.206551] ? init_timer_on_stack_key+0xe0/0xe0 [ 672.210609] ? sk_stop_timer+0x50/0x50 [ 672.214494] ? __might_fault+0x12b/0x1e0 [ 672.218376] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 672.223121] ? __lockdep_init_map+0x105/0x590 [ 672.227004] ? _copy_from_user+0xdf/0x150 [ 672.231052] ? __lockdep_init_map+0x105/0x590 [ 672.236581] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 672.241070] ? lockdep_init_map+0x9/0x10 [ 672.245219] ? bpf_test_init.isra.10+0x70/0x100 [ 672.249698] sock_init_data+0xe1/0xdc0 [ 672.255230] bpf_prog_test_run_skb+0x255/0xc40 [ 672.259283] ? sk_stop_timer+0x50/0x50 [ 672.263958] ? finish_task_switch+0x1f4/0x920 [ 672.267840] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 672.272413] ? bpf_test_finish.isra.9+0x1f0/0x1f0 [ 672.276293] ? _copy_from_user+0xdf/0x150 [ 672.280788] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 672.286332] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 672.291278] ? fput+0x130/0x1a0 [ 672.295323] ? bpf_test_init.isra.10+0x70/0x100 [ 672.300847] ? __bpf_prog_get+0x9b/0x290 [ 672.306374] bpf_prog_test_run_skb+0x255/0xc40 [ 672.309645] ? bpf_test_finish.isra.9+0x1f0/0x1f0 [ 672.314316] ? __lock_acquire+0x62f/0x4c20 [ 672.318370] bpf_prog_test_run+0x130/0x1a0 [ 672.322941] ? bpf_test_finish.isra.9+0x1f0/0x1f0 [ 672.322960] ? __lock_acquire+0x62f/0x4c20 [ 672.323081] ? fput+0x130/0x1a0 [ 672.328257] __x64_sys_bpf+0x3d8/0x510 [ 672.332482] ? __bpf_prog_get+0x9b/0x290 [ 672.336708] ? bpf_prog_get+0x20/0x20 [ 672.341544] ? bpf_test_finish.isra.9+0x1f0/0x1f0 [ 672.345781] do_syscall_64+0x1b9/0x820 [ 672.349036] bpf_prog_test_run+0x130/0x1a0 [ 672.352921] ? entry_SYSCALL_64_after_hwframe+0x3e/0xbe [ 672.356970] __x64_sys_bpf+0x3d8/0x510 [ 672.360775] ? syscall_return_slowpath+0x5e0/0x5e0 [ 672.365614] ? bpf_prog_get+0x20/0x20 [ 672.369497] ? trace_hardirqs_on_caller+0x310/0x310 [ 672.373730] do_syscall_64+0x1b9/0x820 [ 672.379083] ? prepare_exit_to_usermode+0x3b0/0x3b0 [ 672.382960] ? entry_SYSCALL_64_after_hwframe+0x3e/0xbe [ 672.387885] ? post_copy_siginfo_from_user.isra.25.part.26+0x250/0x250 [ 672.391674] ? syscall_return_slowpath+0x5e0/0x5e0 [ 672.396681] ? __switch_to_asm+0x40/0x70 [ 672.400561] ? trace_hardirqs_on_caller+0x310/0x310 [ 672.405581] ? __switch_to_asm+0x34/0x70 [ 672.410946] ? prepare_exit_to_usermode+0x3b0/0x3b0 [ 672.417603] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 672.422525] ? post_copy_siginfo_from_user.isra.25.part.26+0x250/0x250 [ 672.426576] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 672.431609] ? __switch_to_asm+0x40/0x70 [ 672.435663] RIP: 0033:0x457569 [ 672.440679] ? __switch_to_asm+0x34/0x70 [ 672.445512] Code: fd b3 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 cb b3 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 672.452171] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 672.457345] RSP: 002b:00007f7002652c78 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 672.461410] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 672.464587] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000000457569 [ 672.464603] RDX: 0000000000000028 RSI: 0000000020000400 RDI: 000000000000000a [ 672.468662] RIP: 0033:0x457569 [ 672.487563] RBP: 000000000072c040 R08: 0000000000000000 R09: 0000000000000000 [ 672.492413] Code: fd b3 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 cb b3 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 672.500130] R10: 0000000000000000 R11: 0000000000000246 R12: 00007f70026536d4 [ 672.505331] RSP: 002b:00007f7002673c78 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 672.512608] R13: 00000000004bd892 R14: 00000000004cc208 R15: 00000000ffffffff [ 672.519879] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000000457569 [ 672.523084] irq event stamp: 0 [ 672.530334] RDX: 0000000000000028 RSI: 0000000020000140 RDI: 000000000000000a [ 672.549429] hardirqs last enabled at (0): [<0000000000000000>] (null) [ 672.549460] hardirqs last disabled at (0): [] copy_process+0x21e7/0x8770 [ 672.556723] RBP: 000000000072bfa0 R08: 0000000000000000 R09: 0000000000000000 [ 672.564442] softirqs last enabled at (0): [] copy_process+0x22a1/0x8770 [ 672.571695] R10: 0000000000000000 R11: 0000000000000246 R12: 00007f70026746d4 [ 672.578965] softirqs last disabled at (0): [<0000000000000000>] (null) [ 672.582154] R13: 00000000004bd892 R14: 00000000004cc208 R15: 00000000ffffffff [ 672.589420] ---[ end trace 574f2bcb3e4d55e6 ]--- [ 672.596968] [ 672.596975] ====================================================== [ 672.596982] WARNING: possible circular locking dependency detected [ 672.596988] 4.19.0-rc8-next-20181019+ #98 Not tainted [ 672.596994] ------------------------------------------------------ [ 672.597001] syz-executor0/25743 is trying to acquire lock: [ 672.597005] 000000001124a442 ((console_sem).lock){-.-.}, at: down_trylock+0x13/0x70 [ 672.597022] [ 672.597028] but task is already holding lock: [ 672.597031] 00000000cb564b2c (&obj_hash[i].lock){-.-.}, at: __debug_object_init+0x127/0x1290 [ 672.597049] [ 672.597055] which lock already depends on the new lock. [ 672.597058] [ 672.597061] [ 672.597067] the existing dependency chain (in reverse order) is: [ 672.597070] [ 672.597073] -> #3 (&obj_hash[i].lock){-.-.}: [ 672.597091] _raw_spin_lock_irqsave+0x99/0xd0 [ 672.597096] __debug_object_init+0x127/0x1290 [ 672.597101] debug_object_init+0x16/0x20 [ 672.597106] hrtimer_init+0x97/0x490 [ 672.597111] init_dl_task_timer+0x1b/0x50 [ 672.597116] __sched_fork+0x2ae/0x590 [ 672.597121] init_idle+0x75/0x740 [ 672.597125] sched_init+0xb33/0xc02 [ 672.597130] start_kernel+0x4be/0xa2b [ 672.597136] x86_64_start_reservations+0x2e/0x30 [ 672.597141] x86_64_start_kernel+0x76/0x79 [ 672.597147] secondary_startup_64+0xa4/0xb0 [ 672.597150] [ 672.597152] -> #2 (&rq->lock){-.-.}: [ 672.597168] _raw_spin_lock+0x2d/0x40 [ 672.597173] task_fork_fair+0xb0/0x6d0 [ 672.597178] sched_fork+0x443/0xba0 [ 672.597183] copy_process+0x2585/0x8770 [ 672.597187] _do_fork+0x1cb/0x11c0 [ 672.597192] kernel_thread+0x34/0x40 [ 672.597197] rest_init+0x28/0x372 [ 672.597202] arch_call_rest_init+0xe/0x1b [ 672.597207] start_kernel+0x9f0/0xa2b [ 672.597212] x86_64_start_reservations+0x2e/0x30 [ 672.597217] x86_64_start_kernel+0x76/0x79 [ 672.597223] secondary_startup_64+0xa4/0xb0 [ 672.597225] [ 672.597228] -> #1 (&p->pi_lock){-.-.}: [ 672.597245] _raw_spin_lock_irqsave+0x99/0xd0 [ 672.597250] try_to_wake_up+0xd2/0x12e0 [ 672.597255] wake_up_process+0x10/0x20 [ 672.597259] __up.isra.1+0x1c0/0x2a0 [ 672.597264] up+0x13c/0x1c0 [ 672.597269] __up_console_sem+0xbe/0x1b0 [ 672.597273] console_unlock+0x80c/0x1190 [ 672.597278] vprintk_emit+0x391/0x990 [ 672.597283] vprintk_default+0x28/0x30 [ 672.597288] vprintk_func+0x7e/0x181 [ 672.597292] printk+0xa7/0xcf [ 672.597307] do_exit.cold.18+0x57/0x16f [ 672.597312] do_group_exit+0x177/0x440 [ 672.597317] __x64_sys_exit_group+0x3e/0x50 [ 672.597322] do_syscall_64+0x1b9/0x820 [ 672.597328] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 672.597331] [ 672.597334] -> #0 ((console_sem).lock){-.-.}: [ 672.597351] lock_acquire+0x1ed/0x520 [ 672.597357] _raw_spin_lock_irqsave+0x99/0xd0 [ 672.597361] down_trylock+0x13/0x70 [ 672.597367] __down_trylock_console_sem+0xae/0x1f0 [ 672.597372] console_trylock+0x15/0xa0 [ 672.597377] vprintk_emit+0x372/0x990 [ 672.597382] vprintk_default+0x28/0x30 [ 672.597386] vprintk_func+0x7e/0x181 [ 672.597391] printk+0xa7/0xcf [ 672.597396] __debug_object_init.cold.14+0x4a/0xdf [ 672.597402] debug_object_init+0x16/0x20 [ 672.597406] init_timer_key+0xa9/0x480 [ 672.597411] sock_init_data+0xe1/0xdc0 [ 672.597417] bpf_prog_test_run_skb+0x255/0xc40 [ 672.597422] bpf_prog_test_run+0x130/0x1a0 [ 672.597427] __x64_sys_bpf+0x3d8/0x510 [ 672.597431] do_syscall_64+0x1b9/0x820 [ 672.597437] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 672.597440] [ 672.597446] other info that might help us debug this: [ 672.597448] [ 672.597452] Chain exists of: [ 672.597455] (console_sem).lock --> &rq->lock --> &obj_hash[i].lock [ 672.597477] [ 672.597482] Possible unsafe locking scenario: [ 672.597484] [ 672.597490] CPU0 CPU1 [ 672.597495] ---- ---- [ 672.597498] lock(&obj_hash[i].lock); [ 672.597508] lock(&rq->lock); [ 672.597519] lock(&obj_hash[i].lock); [ 672.597528] lock((console_sem).lock); [ 672.597538] [ 672.597542] *** DEADLOCK *** [ 672.597544] [ 672.597549] 1 lock held by syz-executor0/25743: [ 672.597552] #0: 00000000cb564b2c (&obj_hash[i].lock){-.-.}, at: __debug_object_init+0x127/0x1290 [ 672.597579] [ 672.597584] stack backtrace: [ 672.597591] CPU: 0 PID: 25743 Comm: syz-executor0 Not tainted 4.19.0-rc8-next-20181019+ #98 [ 672.597600] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 672.597604] Call Trace: [ 672.597609] dump_stack+0x244/0x39d [ 672.597615] ? dump_stack_print_info.cold.1+0x20/0x20 [ 672.597620] ? vprintk_func+0x85/0x181 [ 672.597626] print_circular_bug.isra.35.cold.54+0x1bd/0x27d [ 672.597631] ? save_trace+0xe0/0x290 [ 672.597636] __lock_acquire+0x3399/0x4c20 [ 672.597641] ? mark_held_locks+0x130/0x130 [ 672.597645] ? put_dec+0xf0/0xf0 [ 672.597651] ? mark_held_locks+0x130/0x130 [ 672.597656] ? pointer_string+0x14e/0x1b0 [ 672.597662] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 672.597667] ? check_preemption_disabled+0x48/0x280 [ 672.597673] ? debug_smp_processor_id+0x1c/0x20 [ 672.597678] ? perf_trace_lock+0x14d/0x7a0 [ 672.597682] ? ptr_to_id+0xd0/0x1d0 [ 672.597687] ? lock_is_held_type+0x210/0x210 [ 672.597693] ? lock_is_held_type+0x210/0x210 [ 672.597697] ? zap_class+0x640/0x640 [ 672.597707] ? __sanitizer_cov_trace_const_cmp1+0x1a/0x20 [ 672.597718] lock_acquire+0x1ed/0x520 [ 672.597723] ? down_trylock+0x13/0x70 [ 672.597731] ? lock_release+0xa10/0xa10 [ 672.597736] ? trace_hardirqs_off+0xb8/0x310 [ 672.597741] ? vprintk_emit+0x1de/0x990 [ 672.597746] ? trace_hardirqs_on+0x310/0x310 [ 672.597751] ? trace_hardirqs_off+0xb8/0x310 [ 672.597756] ? log_store+0x344/0x4c0 [ 672.597761] ? vprintk_emit+0x372/0x990 [ 672.597766] _raw_spin_lock_irqsave+0x99/0xd0 [ 672.597771] ? down_trylock+0x13/0x70 [ 672.597775] down_trylock+0x13/0x70 [ 672.597781] __down_trylock_console_sem+0xae/0x1f0 [ 672.597786] console_trylock+0x15/0xa0 [ 672.597790] vprintk_emit+0x372/0x990 [ 672.597795] ? wake_up_klogd+0x180/0x180 [ 672.597800] ? perf_trace_lock+0x14d/0x7a0 [ 672.597805] ? zap_class+0x640/0x640 [ 672.597810] ? print_usage_bug+0xc0/0xc0 [ 672.597815] ? lock_is_held_type+0x210/0x210 [ 672.597820] ? find_held_lock+0x36/0x1c0 [ 672.597825] vprintk_default+0x28/0x30 [ 672.597829] vprintk_func+0x7e/0x181 [ 672.597834] printk+0xa7/0xcf [ 672.597839] ? kmsg_dump_rewind_nolock+0xe4/0xe4 [ 672.597845] __debug_object_init.cold.14+0x4a/0xdf [ 672.597850] ? lockdep_hardirqs_on+0x3bb/0x5b0 [ 672.597855] ? debug_object_free+0x690/0x690 [ 672.597861] ? check_preemption_disabled+0x48/0x280 [ 672.597866] ? debug_smp_processor_id+0x1c/0x20 [ 672.597871] ? perf_trace_lock+0x14d/0x7a0 [ 672.597877] ? _raw_spin_unlock_irqrestore+0x6d/0xd0 [ 672.597882] ? lock_is_held_type+0x210/0x210 [ 672.597887] ? save_stack+0xa9/0xd0 [ 672.597892] ? save_stack+0x43/0xd0 [ 672.597896] ? kasan_kmalloc+0xc7/0xe0 [ 672.597902] ? bpf_test_init.isra.10+0x98/0x100 [ 672.597906] ? zap_class+0x640/0x640 [ 672.597911] ? do_syscall_64+0x1b9/0x820 [ 672.597917] ? entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 672.597922] ? find_held_lock+0x36/0x1c0 [ 672.597927] debug_object_init+0x16/0x20 [ 672.597932] init_timer_key+0xa9/0x480 [ 672.597937] ? init_timer_on_stack_key+0xe0/0xe0 [ 672.597942] ? __might_fault+0x12b/0x1e0 [ 672.597947] ? __lockdep_init_map+0x105/0x590 [ 672.597952] ? __lockdep_init_map+0x105/0x590 [ 672.597958] ? lockdep_init_map+0x9/0x10 [ 672.597962] sock_init_data+0xe1/0xdc0 [ 672.597967] ? sk_stop_timer+0x50/0x50 [ 672.597974] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 672.597979] ? _copy_from_user+0xdf/0x150 [ 672.597985] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 672.597990] ? bpf_test_init.isra.10+0x70/0x100 [ 672.597995] bpf_prog_test_run_skb+0x255/0xc40 [ 672.598001] ? __lock_acquire+0x62f/0x4c20 [ 672.598006] ? bpf_test_finish.isra.9+0x1f0/0x1f0 [ 672.598011] ? __lock_acquire+0x62f/0x4c20 [ 672.598016] ? fput+0x130/0x1a0 [ 672.598021] ? __bpf_prog_get+0x9b/0x290 [ 672.598026] ? bpf_test_finish.isra.9+0x1f0/0x1f0 [ 672.598031] bpf_prog_test_run+0x130/0x1a0 [ 672.598036] __x64_sys_bpf+0x3d8/0x510 [ 672.598040] ? bpf_prog_get+0x20/0x20 [ 672.598045] do_syscall_64+0x1b9/0x820 [ 672.598051] ? entry_SYSCALL_64_after_hwframe+0x3e/0xbe [ 672.598057] ? syscall_return_slowpath+0x5e0/0x5e0 [ 672.598063] ? trace_hardirqs_on_caller+0x310/0x310 [ 672.598068] ? prepare_exit_to_usermode+0x3b0/0x3b0 [ 672.598075] ? post_copy_siginfo_from_user.isra.25.part.26+0x250/0x250 [ 672.598080] ? __switch_to_asm+0x40/0x70 [ 672.598085] ? __switch_to_asm+0x34/0x70 [ 672.598090] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 672.598096] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 672.598100] RIP: 0033:0x457569 [ 672.598116] Code: fd b3 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 cb b3 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 672.598121] RSP: 002b:00007f7002673c78 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 672.598133] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000000457569 [ 672.598141] RDX: 0000000000000028 RSI: 0000000020000140 RDI: 000000000000000a [ 672.598148] RBP: 000000000072bfa0 R08: 0000000000000000 R09: 0000000000000000 [ 672.598155] R10: 0000000000000000 R11: 0000000000000246 R12: 00007f70026746d4 [ 672.598162] R13: 00000000004bd892 R14: 00000000004cc208 R15: 00000000ffffffff [ 673.578238] Kernel Offset: disabled [ 673.581875] Rebooting in 86400 seconds..