0000000080)={'syz1', "80fa25cdc862d216160cfa92845a3916e38a409a159c03f1889971d3e5144a8d08de78c4b1fbee457437261d7668b1c0f582647ad4134a05358d4309a71a702002329e024cac95642e761bb842bc1056bd6bf12c47697a649a026bd8ee1f685089941469b1ddfeddf32b392f0ff07652a3bce0770bc3bb70862845a65054cecb191e80b825d740fe6b40450359757032425dfdee92aec36ce4b468d50adc745c522cc4af2ac6e7f6a95f0edd70b09caa95fcc7143cf46b74db8bc17fa7c89f"}, 0xc3) 14:03:49 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) r1 = socket$inet6(0xa, 0x3, 0x10000000007) creat(&(0x7f0000000700)='./bus\x00', 0x0) r2 = open(&(0x7f0000000780)='./bus\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x0, 0x4002012, r2, 0x0) bind$inet6(r1, &(0x7f0000000000)={0xa, 0x0, 0x0, @ipv4={[], [], @local}}, 0x1c) prctl$PR_GET_FPEMU(0x9, &(0x7f0000000080)) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f319bd070") exit_group(0x8) r3 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSWINSZ(r3, 0x5414, &(0x7f00000000c0)={0x6, 0x9, 0x8, 0x1}) getsockopt$inet6_tcp_TCP_ZEROCOPY_RECEIVE(r2, 0x6, 0x23, &(0x7f0000000100)={&(0x7f0000574000/0x4000)=nil, 0x4000}, &(0x7f0000000140)=0x10) ioctl$TCSETAF(r3, 0x5408, &(0x7f0000000040)) 14:03:49 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0563044000000000cb514be8abed253e11a475dd7fed9a"], 0x0, 0x0, 0x0}) mkdirat$cgroup(r1, &(0x7f0000000040)='syz0\x00', 0x1ff) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) 14:03:49 executing program 4: r0 = openat$selinux_avc_cache_threshold(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/avc/cache_threshold\x00', 0x2, 0x0) ioctl$TIOCCBRK(r0, 0x5428) r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(r1, 0x540b, 0x1) 14:03:49 executing program 1: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSPTLCK(r0, 0x40045431, &(0x7f0000000180)) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) socket(0x200000000000011, 0x4000000000080002, 0x0) bind$packet(0xffffffffffffffff, 0x0, 0x0) setsockopt$packet_int(0xffffffffffffffff, 0x107, 0x0, 0x0, 0x0) syz_open_procfs(0x0, 0x0) ioctl$LOOP_SET_BLOCK_SIZE(0xffffffffffffffff, 0x4c09, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$cgroup_int(0xffffffffffffffff, 0x0, 0x2, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='\x89\x00\x00\x00\x00Ew\x00\x00\x00\xef\xb4\xc8\xd0\xff\xda\xb1vents\xd9\xc5H\xd4\x91\xfdN_]\x16\xe4\xa9C\xd2\x86Qn\xefS\x80\x11J\xfb4\x14\x86 4\x95\x9e\xfc\xc1\a\xcb \x95N\xe9\xa4j\xd2\x1f^\xb0\xb2>\xa3\xc9\xb7$\x11`t\x03: \x8b\xa4\x05\xf2?E\xdb+{t\xb8\xf7\xab\x8b\x100#', 0x26e1, 0x0) ioctl$PERF_EVENT_IOC_PAUSE_OUTPUT(r1, 0x40086602, 0x400007) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000280)='./cgroup/syz0\x00', 0x1ff) openat$smack_thread_current(0xffffffffffffff9c, &(0x7f0000000240)='/proc/thread-self/attr/current\x00', 0x2, 0x0) write$cgroup_subtree(r1, &(0x7f0000000100)=ANY=[], 0xff4a) write$cgroup_subtree(r2, &(0x7f0000000000)=ANY=[], 0x20032600) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a0f, 0x1700) accept$inet(0xffffffffffffffff, &(0x7f0000000040)={0x2, 0x0, @local}, &(0x7f0000000080)=0x10) ioctl$TCSETAF(r0, 0x5408, &(0x7f0000000040)={0x2}) ioctl$EXT4_IOC_GROUP_ADD(r0, 0x40286608, &(0x7f0000000000)={0x3, 0x7000000, 0x400, 0x100000000, 0x0, 0x8}) r3 = fcntl$dupfd(r0, 0x406, r0) ioctl$EVIOCGVERSION(r3, 0x80044501, &(0x7f0000000200)=""/31) write$binfmt_misc(r0, &(0x7f0000000080)={'syz1', "80fa25cdc862d216160cfa92845a3916e38a409a159c03f1889971d3e5144a8d08de78c4b1fbee457437261d7668b1c0f582647ad4134a05358d4309a71a702002329e024cac95642e761bb842bc1056bd6bf12c47697a649a026bd8ee1f685089941469b1ddfeddf32b392f0ff07652a3bce0770bc3bb70862845a65054cecb191e80b825d740fe6b40450359757032425dfdee92aec36ce4b468d50adc745c522cc4af2ac6e7f6a95f0edd70b09caa95fcc7143cf46b74db8bc17fa7c89f"}, 0xc3) 14:03:49 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f319bd070") r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) fcntl$dupfd(r0, 0x406, r0) ioctl$TCSETAF(r1, 0x5408, &(0x7f0000000040)) 14:03:49 executing program 4: r0 = openat$selinux_avc_cache_threshold(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/avc/cache_threshold\x00', 0x2, 0x0) ioctl$TIOCCBRK(r0, 0x5428) ioctl$TCFLSH(0xffffffffffffffff, 0x540b, 0x1) 14:03:49 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0x0, 0x800) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB="0567044000000000"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) 14:03:49 executing program 4: r0 = openat$selinux_avc_cache_threshold(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/avc/cache_threshold\x00', 0x2, 0x0) ioctl$TIOCCBRK(r0, 0x5428) ioctl$TCFLSH(0xffffffffffffffff, 0x540b, 0x1) 14:03:49 executing program 5: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSPTLCK(r0, 0x40045431, &(0x7f0000000180)) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) socket(0x200000000000011, 0x4000000000080002, 0x0) bind$packet(0xffffffffffffffff, 0x0, 0x0) setsockopt$packet_int(0xffffffffffffffff, 0x107, 0x0, 0x0, 0x0) syz_open_procfs(0x0, 0x0) ioctl$LOOP_SET_BLOCK_SIZE(0xffffffffffffffff, 0x4c09, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$cgroup_int(0xffffffffffffffff, 0x0, 0x2, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='\x89\x00\x00\x00\x00Ew\x00\x00\x00\xef\xb4\xc8\xd0\xff\xda\xb1vents\xd9\xc5H\xd4\x91\xfdN_]\x16\xe4\xa9C\xd2\x86Qn\xefS\x80\x11J\xfb4\x14\x86 4\x95\x9e\xfc\xc1\a\xcb \x95N\xe9\xa4j\xd2\x1f^\xb0\xb2>\xa3\xc9\xb7$\x11`t\x03: \x8b\xa4\x05\xf2?E\xdb+{t\xb8\xf7\xab\x8b\x100#', 0x26e1, 0x0) ioctl$PERF_EVENT_IOC_PAUSE_OUTPUT(r1, 0x40086602, 0x400007) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000280)='./cgroup/syz0\x00', 0x1ff) openat$smack_thread_current(0xffffffffffffff9c, &(0x7f0000000240)='/proc/thread-self/attr/current\x00', 0x2, 0x0) write$cgroup_subtree(r1, &(0x7f0000000100)=ANY=[], 0xff4a) write$cgroup_subtree(r2, &(0x7f0000000000)=ANY=[], 0x20032600) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a0f, 0x1700) accept$inet(0xffffffffffffffff, &(0x7f0000000040)={0x2, 0x0, @local}, &(0x7f0000000080)=0x10) ioctl$TCSETAF(r0, 0x5408, &(0x7f0000000040)={0x2}) ioctl$EXT4_IOC_GROUP_ADD(r0, 0x40286608, &(0x7f0000000000)={0x3, 0x7000000, 0x400, 0x100000000, 0x0, 0x8}) r3 = fcntl$dupfd(r0, 0x406, r0) ioctl$EVIOCGVERSION(r3, 0x80044501, &(0x7f0000000200)=""/31) write$binfmt_misc(r0, &(0x7f0000000080)={'syz1', "80fa25cdc862d216160cfa92845a3916e38a409a159c03f1889971d3e5144a8d08de78c4b1fbee457437261d7668b1c0f582647ad4134a05358d4309a71a702002329e024cac95642e761bb842bc1056bd6bf12c47697a649a026bd8ee1f685089941469b1ddfeddf32b392f0ff07652a3bce0770bc3bb70862845a65054cecb191e80b825d740fe6b40450359757032425dfdee92aec36ce4b468d50adc745c522cc4af2ac6e7f6a95f0edd70b09caa95fcc7143cf46b74db8bc17fa7c89f"}, 0xc3) 14:03:49 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f319bd070") r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$EXT4_IOC_MOVE_EXT(r0, 0xc028660f, &(0x7f00000000c0)={0x0, r0, 0x7ff, 0x5, 0x7, 0x4}) r2 = timerfd_create(0x1, 0x80000) timerfd_gettime(r2, &(0x7f0000000080)) ioctl$TCSETAF(r1, 0x5408, &(0x7f0000000040)) [ 335.803088] binder: 10219:10224 unknown command 1074030341 [ 335.821896] binder: 10219:10224 ioctl c0306201 20012000 returned -22 14:03:49 executing program 4: r0 = openat$selinux_avc_cache_threshold(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/avc/cache_threshold\x00', 0x2, 0x0) ioctl$TIOCCBRK(r0, 0x5428) ioctl$TCFLSH(0xffffffffffffffff, 0x540b, 0x1) 14:03:49 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSPTLCK(r0, 0x40045431, &(0x7f0000000180)) socket(0x200000000000011, 0x4000000000080002, 0x0) bind$packet(0xffffffffffffffff, 0x0, 0x0) sendmmsg(0xffffffffffffffff, &(0x7f0000007880)=[{{&(0x7f00000001c0)=@l2={0x1f, 0xbf53, {0x9, 0x7, 0xfffffffffffffdd5, 0x1ff, 0x2, 0x4}, 0x0, 0x7}, 0x80, 0x0}}, {{0x0, 0x0, &(0x7f0000007780)}}], 0x2, 0x4048851) setsockopt$packet_int(0xffffffffffffffff, 0x107, 0x0, 0x0, 0x0) syz_open_procfs(0x0, 0x0) ioctl$LOOP_SET_BLOCK_SIZE(0xffffffffffffffff, 0x4c09, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$cgroup_int(0xffffffffffffffff, 0x0, 0x2, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='\x89\x00\x00\x00\x00Ew\x00\x00\x00\xef\xb4\xc8\xd0\xff\xda\xb1vents\xd9\xc5H\xd4\x91\xfdN_]\x16\xe4\xa9C\xd2\x86Qn\xefS\x80\x11J\xfb4\x14\x86 4\x95\x9e\xfc\xc1\a\xcb \x95N\xe9\xa4j\xd2\x1f^\xb0\xb2>\xa3\xc9\xb7$\x11`t\x03: \x8b\xa4\x05\xf2?E\xdb+{t\xb8\xf7\xab\x8b\x100#', 0x26e1, 0x0) ioctl$PERF_EVENT_IOC_PAUSE_OUTPUT(r1, 0x40086602, 0x400007) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000280)='./cgroup/syz0\x00', 0x1ff) openat$smack_thread_current(0xffffffffffffff9c, &(0x7f0000000240)='/proc/thread-self/attr/current\x00', 0x2, 0x0) write$cgroup_subtree(r1, &(0x7f0000000100)=ANY=[], 0xff4a) write$cgroup_subtree(r2, &(0x7f0000000000)=ANY=[], 0x20032600) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a0f, 0x1700) accept$inet(0xffffffffffffffff, &(0x7f0000000040)={0x2, 0x0, @local}, &(0x7f0000000080)=0x10) ioctl$TCSETAF(r0, 0x5408, &(0x7f0000000040)={0x2}) ioctl$EXT4_IOC_GROUP_ADD(r0, 0x40286608, &(0x7f0000000000)={0x3, 0x7000000, 0x400, 0x100000000, 0x0, 0x8}) r3 = fcntl$dupfd(r0, 0x406, r0) ioctl$EVIOCGVERSION(r3, 0x80044501, &(0x7f0000000200)=""/31) write$binfmt_misc(r0, &(0x7f0000000080)={'syz1', "80fa25cdc862d216160cfa92845a3916e38a409a159c03f1889971d3e5144a8d08de78c4b1fbee457437261d7668b1c0f582647ad4134a05358d4309a71a702002329e024cac95642e761bb842bc1056bd6bf12c47697a649a026bd8ee1f685089941469b1ddfeddf32b392f0ff07652a3bce0770bc3bb70862845a65054cecb191e80b825d740fe6b40450359757032425dfdee92aec36ce4b468d50adc745c522cc4af2ac6e7f6a95f0edd70b09caa95fcc7143cf46b74db8bc17fa7c89f"}, 0xc3) 14:03:49 executing program 4: openat$selinux_avc_cache_threshold(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/avc/cache_threshold\x00', 0x2, 0x0) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(r0, 0x540b, 0x1) 14:03:49 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f00000001c0)=[@acquire], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=ANY=[@ANYBLOB="0e630cbacdfeaf00"], 0x0, 0x0, 0x0}) 14:03:49 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f319bd070") write$binfmt_elf64(r0, &(0x7f0000000080)=ANY=[@ANYBLOB="7f454c460901ff074c0200000000000002003e0006000000140000000000000040000000000000003603000000000000010000800400380002000800000000000000006081000000810000000000000008000000000000000200000000000000030000000000000007000000000000001d8300000000000051e574640200000034fbffffffffffff0400000000000000f8ffffffffffffff00000000000000000700000000000000080000000000000054ad590a82de0dc64792b724ea3c2db1ca595d25331eb143296dc7774b4421c79a8e85cd65e5af031e3ebc8f7cafb21f8d2dba2cf972f9a7ce970ab37c287427b215e94d6cf8047835c00e072c14f0df108b27c49da52478a89e62c71b40e6b7a7d9139b51bdfe41eed8d628d56defe7e6fafaba6e40442853798c6ad67793da4906165846d50000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000a00"/2102], 0x836) r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETAF(r1, 0x5408, &(0x7f0000000040)) [ 335.855024] binder: 10219:10233 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 14:03:49 executing program 1: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSPTLCK(r0, 0x40045431, &(0x7f0000000180)) socket(0x200000000000011, 0x4000000000080002, 0x0) bind$packet(0xffffffffffffffff, 0x0, 0x0) sendmmsg(0xffffffffffffffff, &(0x7f0000007880)=[{{&(0x7f00000001c0)=@l2={0x1f, 0xbf53, {0x9, 0x7, 0xfffffffffffffdd5, 0x1ff, 0x2, 0x4}, 0x0, 0x7}, 0x80, 0x0}}, {{0x0, 0x0, &(0x7f0000007780)}}], 0x2, 0x4048851) setsockopt$packet_int(0xffffffffffffffff, 0x107, 0x0, 0x0, 0x0) syz_open_procfs(0x0, 0x0) ioctl$LOOP_SET_BLOCK_SIZE(0xffffffffffffffff, 0x4c09, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$cgroup_int(0xffffffffffffffff, 0x0, 0x2, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='\x89\x00\x00\x00\x00Ew\x00\x00\x00\xef\xb4\xc8\xd0\xff\xda\xb1vents\xd9\xc5H\xd4\x91\xfdN_]\x16\xe4\xa9C\xd2\x86Qn\xefS\x80\x11J\xfb4\x14\x86 4\x95\x9e\xfc\xc1\a\xcb \x95N\xe9\xa4j\xd2\x1f^\xb0\xb2>\xa3\xc9\xb7$\x11`t\x03: \x8b\xa4\x05\xf2?E\xdb+{t\xb8\xf7\xab\x8b\x100#', 0x26e1, 0x0) ioctl$PERF_EVENT_IOC_PAUSE_OUTPUT(r1, 0x40086602, 0x400007) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000280)='./cgroup/syz0\x00', 0x1ff) openat$smack_thread_current(0xffffffffffffff9c, &(0x7f0000000240)='/proc/thread-self/attr/current\x00', 0x2, 0x0) write$cgroup_subtree(r1, &(0x7f0000000100)=ANY=[], 0xff4a) write$cgroup_subtree(r2, &(0x7f0000000000)=ANY=[], 0x20032600) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a0f, 0x1700) accept$inet(0xffffffffffffffff, &(0x7f0000000040)={0x2, 0x0, @local}, &(0x7f0000000080)=0x10) ioctl$TCSETAF(r0, 0x5408, &(0x7f0000000040)={0x2}) ioctl$EXT4_IOC_GROUP_ADD(r0, 0x40286608, &(0x7f0000000000)={0x3, 0x7000000, 0x400, 0x100000000, 0x0, 0x8}) r3 = fcntl$dupfd(r0, 0x406, r0) ioctl$EVIOCGVERSION(r3, 0x80044501, &(0x7f0000000200)=""/31) write$binfmt_misc(r0, &(0x7f0000000080)={'syz1', "80fa25cdc862d216160cfa92845a3916e38a409a159c03f1889971d3e5144a8d08de78c4b1fbee457437261d7668b1c0f582647ad4134a05358d4309a71a702002329e024cac95642e761bb842bc1056bd6bf12c47697a649a026bd8ee1f685089941469b1ddfeddf32b392f0ff07652a3bce0770bc3bb70862845a65054cecb191e80b825d740fe6b40450359757032425dfdee92aec36ce4b468d50adc745c522cc4af2ac6e7f6a95f0edd70b09caa95fcc7143cf46b74db8bc17fa7c89f"}, 0xc3) 14:03:49 executing program 4: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(r0, 0x540b, 0x1) 14:03:49 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x2400, 0x1) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f319bd070") r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETAF(r1, 0x5408, &(0x7f0000000040)) 14:03:49 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x802) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = fcntl$getown(r0, 0x9) prctl$PR_SET_PTRACER(0x59616d61, r1) r2 = syz_open_dev$binder(0x0, 0x0, 0x2) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000012000)={0xff0e, 0x0, &(0x7f00000001c0)=[@acquire], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) [ 335.943167] binder: 10250:10252 unknown command -1173593330 [ 335.957166] binder: 10250:10252 ioctl c0306201 20008fd0 returned -22 14:03:49 executing program 5: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSPTLCK(r0, 0x40045431, &(0x7f0000000180)) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) socket(0x200000000000011, 0x4000000000080002, 0x0) bind$packet(0xffffffffffffffff, 0x0, 0x0) setsockopt$packet_int(0xffffffffffffffff, 0x107, 0x0, 0x0, 0x0) syz_open_procfs(0x0, 0x0) ioctl$LOOP_SET_BLOCK_SIZE(0xffffffffffffffff, 0x4c09, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$cgroup_int(0xffffffffffffffff, 0x0, 0x2, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='\x89\x00\x00\x00\x00Ew\x00\x00\x00\xef\xb4\xc8\xd0\xff\xda\xb1vents\xd9\xc5H\xd4\x91\xfdN_]\x16\xe4\xa9C\xd2\x86Qn\xefS\x80\x11J\xfb4\x14\x86 4\x95\x9e\xfc\xc1\a\xcb \x95N\xe9\xa4j\xd2\x1f^\xb0\xb2>\xa3\xc9\xb7$\x11`t\x03: \x8b\xa4\x05\xf2?E\xdb+{t\xb8\xf7\xab\x8b\x100#', 0x26e1, 0x0) ioctl$PERF_EVENT_IOC_PAUSE_OUTPUT(r1, 0x40086602, 0x400007) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000280)='./cgroup/syz0\x00', 0x1ff) openat$smack_thread_current(0xffffffffffffff9c, &(0x7f0000000240)='/proc/thread-self/attr/current\x00', 0x2, 0x0) write$cgroup_subtree(r1, &(0x7f0000000100)=ANY=[], 0xff4a) write$cgroup_subtree(r2, &(0x7f0000000000)=ANY=[], 0x20032600) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a0f, 0x1700) accept$inet(0xffffffffffffffff, &(0x7f0000000040)={0x2, 0x0, @local}, &(0x7f0000000080)=0x10) ioctl$TCSETAF(r0, 0x5408, &(0x7f0000000040)={0x2}) ioctl$EXT4_IOC_GROUP_ADD(r0, 0x40286608, &(0x7f0000000000)={0x3, 0x7000000, 0x400, 0x100000000, 0x0, 0x8}) r3 = fcntl$dupfd(r0, 0x406, r0) ioctl$EVIOCGVERSION(r3, 0x80044501, &(0x7f0000000200)=""/31) write$binfmt_misc(r0, &(0x7f0000000080)={'syz1', "80fa25cdc862d216160cfa92845a3916e38a409a159c03f1889971d3e5144a8d08de78c4b1fbee457437261d7668b1c0f582647ad4134a05358d4309a71a702002329e024cac95642e761bb842bc1056bd6bf12c47697a649a026bd8ee1f685089941469b1ddfeddf32b392f0ff07652a3bce0770bc3bb70862845a65054cecb191e80b825d740fe6b40450359757032425dfdee92aec36ce4b468d50adc745c522cc4af2ac6e7f6a95f0edd70b09caa95fcc7143cf46b74db8bc17fa7c89f"}, 0xc3) 14:03:49 executing program 4: r0 = openat$ptmx(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$TCFLSH(r0, 0x540b, 0x1) 14:03:49 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) r1 = syz_open_dev$mice(&(0x7f0000000080)='/dev/input/mice\x00', 0x0, 0x400003) r2 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000100)='TIPCv2\x00') sendmsg$TIPC_NL_MEDIA_GET(r1, &(0x7f0000000280)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x40000}, 0xc, &(0x7f0000000240)={&(0x7f00000002c0)=ANY=[@ANYBLOB="e00000005a3b6543b6d8056583010fd4a43e7fbbfdd7bfd1a4baf2", @ANYRES16=r2, @ANYBLOB="10002dbd7000fedbdf250b0000002000020008000200f7ffffff080002000200000008000200faffffff040004003400090008000100001000000800010007000000080001000700000008000200ff030000080001000700000008000100080000000c00010008000300060000000c00010008000300060000001400090008000100ff01000008000200020000000c0009000800020000000100140007000800020004000000080002000e7900002c0007000c000400f8ffffffffffffff08000200080000000c00030004000000000000000800010006000000"], 0xe0}}, 0x40000) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f319bd070") r3 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETAF(r3, 0x5408, &(0x7f0000000040)) [ 336.039216] binder: 10266:10270 unknown command 0 14:03:49 executing program 4: r0 = openat$ptmx(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$TCFLSH(r0, 0x540b, 0x1) 14:03:49 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/ptmx\x00', 0x0, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) socket(0x200000000000011, 0x4000000000080002, 0x0) bind$packet(0xffffffffffffffff, 0x0, 0x0) sendmmsg(0xffffffffffffffff, &(0x7f0000007880)=[{{&(0x7f00000001c0)=@l2={0x1f, 0xbf53, {0x9, 0x7, 0xfffffffffffffdd5, 0x1ff, 0x2, 0x4}, 0x0, 0x7}, 0x80, 0x0}}, {{0x0, 0x0, &(0x7f0000007780)}}], 0x2, 0x4048851) setsockopt$packet_int(0xffffffffffffffff, 0x107, 0x0, 0x0, 0x0) syz_open_procfs(0x0, 0x0) ioctl$LOOP_SET_BLOCK_SIZE(0xffffffffffffffff, 0x4c09, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$cgroup_int(0xffffffffffffffff, 0x0, 0x2, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='\x89\x00\x00\x00\x00Ew\x00\x00\x00\xef\xb4\xc8\xd0\xff\xda\xb1vents\xd9\xc5H\xd4\x91\xfdN_]\x16\xe4\xa9C\xd2\x86Qn\xefS\x80\x11J\xfb4\x14\x86 4\x95\x9e\xfc\xc1\a\xcb \x95N\xe9\xa4j\xd2\x1f^\xb0\xb2>\xa3\xc9\xb7$\x11`t\x03: \x8b\xa4\x05\xf2?E\xdb+{t\xb8\xf7\xab\x8b\x100#', 0x26e1, 0x0) ioctl$PERF_EVENT_IOC_PAUSE_OUTPUT(r1, 0x40086602, 0x400007) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000280)='./cgroup/syz0\x00', 0x1ff) openat$smack_thread_current(0xffffffffffffff9c, &(0x7f0000000240)='/proc/thread-self/attr/current\x00', 0x2, 0x0) write$cgroup_subtree(r1, &(0x7f0000000100)=ANY=[], 0xff4a) write$cgroup_subtree(r2, &(0x7f0000000000)=ANY=[], 0x20032600) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a0f, 0x1700) accept$inet(0xffffffffffffffff, &(0x7f0000000040)={0x2, 0x0, @local}, &(0x7f0000000080)=0x10) ioctl$TCSETAF(r0, 0x5408, &(0x7f0000000040)={0x2}) ioctl$EXT4_IOC_GROUP_ADD(r0, 0x40286608, &(0x7f0000000000)={0x3, 0x7000000, 0x400, 0x100000000, 0x0, 0x8}) r3 = fcntl$dupfd(r0, 0x406, r0) ioctl$EVIOCGVERSION(r3, 0x80044501, &(0x7f0000000200)=""/31) write$binfmt_misc(r0, &(0x7f0000000080)={'syz1', "80fa25cdc862d216160cfa92845a3916e38a409a159c03f1889971d3e5144a8d08de78c4b1fbee457437261d7668b1c0f582647ad4134a05358d4309a71a702002329e024cac95642e761bb842bc1056bd6bf12c47697a649a026bd8ee1f685089941469b1ddfeddf32b392f0ff07652a3bce0770bc3bb70862845a65054cecb191e80b825d740fe6b40450359757032425dfdee92aec36ce4b468d50adc745c522cc4af2ac6e7f6a95f0edd70b09caa95fcc7143cf46b74db8bc17fa7c89f"}, 0xc3) 14:03:49 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x8000000000000000) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f00000001c0)=[@acquire], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) geteuid() [ 336.060321] binder: 10266:10270 ioctl c0306201 20012000 returned -22 14:03:49 executing program 4: r0 = openat$ptmx(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$TCFLSH(r0, 0x540b, 0x1) 14:03:49 executing program 1: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSPTLCK(r0, 0x40045431, &(0x7f0000000180)) socket(0x200000000000011, 0x4000000000080002, 0x0) bind$packet(0xffffffffffffffff, 0x0, 0x0) sendmmsg(0xffffffffffffffff, &(0x7f0000007880)=[{{&(0x7f00000001c0)=@l2={0x1f, 0xbf53, {0x9, 0x7, 0xfffffffffffffdd5, 0x1ff, 0x2, 0x4}, 0x0, 0x7}, 0x80, 0x0}}, {{0x0, 0x0, &(0x7f0000007780)}}], 0x2, 0x4048851) setsockopt$packet_int(0xffffffffffffffff, 0x107, 0x0, 0x0, 0x0) syz_open_procfs(0x0, 0x0) ioctl$LOOP_SET_BLOCK_SIZE(0xffffffffffffffff, 0x4c09, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$cgroup_int(0xffffffffffffffff, 0x0, 0x2, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='\x89\x00\x00\x00\x00Ew\x00\x00\x00\xef\xb4\xc8\xd0\xff\xda\xb1vents\xd9\xc5H\xd4\x91\xfdN_]\x16\xe4\xa9C\xd2\x86Qn\xefS\x80\x11J\xfb4\x14\x86 4\x95\x9e\xfc\xc1\a\xcb \x95N\xe9\xa4j\xd2\x1f^\xb0\xb2>\xa3\xc9\xb7$\x11`t\x03: \x8b\xa4\x05\xf2?E\xdb+{t\xb8\xf7\xab\x8b\x100#', 0x26e1, 0x0) ioctl$PERF_EVENT_IOC_PAUSE_OUTPUT(r1, 0x40086602, 0x400007) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000280)='./cgroup/syz0\x00', 0x1ff) openat$smack_thread_current(0xffffffffffffff9c, &(0x7f0000000240)='/proc/thread-self/attr/current\x00', 0x2, 0x0) write$cgroup_subtree(r1, &(0x7f0000000100)=ANY=[], 0xff4a) write$cgroup_subtree(r2, &(0x7f0000000000)=ANY=[], 0x20032600) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a0f, 0x1700) accept$inet(0xffffffffffffffff, &(0x7f0000000040)={0x2, 0x0, @local}, &(0x7f0000000080)=0x10) ioctl$TCSETAF(r0, 0x5408, &(0x7f0000000040)={0x2}) ioctl$EXT4_IOC_GROUP_ADD(r0, 0x40286608, &(0x7f0000000000)={0x3, 0x7000000, 0x400, 0x100000000, 0x0, 0x8}) r3 = fcntl$dupfd(r0, 0x406, r0) ioctl$EVIOCGVERSION(r3, 0x80044501, &(0x7f0000000200)=""/31) write$binfmt_misc(r0, &(0x7f0000000080)={'syz1', "80fa25cdc862d216160cfa92845a3916e38a409a159c03f1889971d3e5144a8d08de78c4b1fbee457437261d7668b1c0f582647ad4134a05358d4309a71a702002329e024cac95642e761bb842bc1056bd6bf12c47697a649a026bd8ee1f685089941469b1ddfeddf32b392f0ff07652a3bce0770bc3bb70862845a65054cecb191e80b825d740fe6b40450359757032425dfdee92aec36ce4b468d50adc745c522cc4af2ac6e7f6a95f0edd70b09caa95fcc7143cf46b74db8bc17fa7c89f"}, 0xc3) 14:03:49 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f319bd070") write$binfmt_elf64(r0, &(0x7f0000000080)={{0x7f, 0x45, 0x4c, 0x46, 0x5, 0x7, 0x9, 0xf826, 0xfffffffffffffffc, 0x3, 0x6, 0x2, 0xbe, 0x40, 0x9, 0x2, 0x40, 0x38, 0x1, 0x1f, 0x3, 0xe09}, [{0x0, 0x7f, 0x1, 0x64e, 0x5, 0x3f, 0x6, 0x7}, {0x2, 0x40, 0x8, 0x7, 0x2, 0xaf7, 0x8, 0x6}], "4338e6d75adef864188c33379bd96ac2d9bbaf4ee0807a5dd2bd0872abad3101aaa5844cec4cfa7fb2eb21fcb32ee010042552e7bb61a946bf19eec4ffc3a7a36f6e5961540a5508a7542499f7f4bf658b24f2b0bc3ccd108118a295e2724ecd2f1a05b5848eec28d3387ac1a4d897df5aa8b3df85fce9faec84cc3e4521895ec9f0e42d3b8031e0357e9444f73b33006c271d853138cf49fb830a4d739d60d99d8f36b0bb51f0a9862c734b5a028c91ad77c42e9a056f9dc229db577dbc64c1076e3baea1404bc9c7f750b4e980c1b0ab21b2ea232d353bc19ef6bb6aa737facd9ac4286a1bfda246372a5ea65c22a2676ff15e3c4c2ee3b4b4c2c5", [[], [], [], [], [], []]}, 0x7ac) r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000840)='/dev/ptmx\x00', 0x408000, 0x0) ioctl$TCSETAF(r1, 0x5408, &(0x7f0000000040)) 14:03:49 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) r2 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000080)='TIPCv2\x00') sendmsg$TIPC_NL_BEARER_ADD(r1, &(0x7f00000002c0)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x90802000}, 0xc, &(0x7f0000000280)={&(0x7f00000000c0)={0x1b8, r2, 0x1, 0x70bd27, 0x25dfdbff, {}, [@TIPC_NLA_MEDIA={0x7c, 0x5, [@TIPC_NLA_MEDIA_PROP={0x2c, 0x2, [@TIPC_NLA_PROP_WIN={0x8, 0x3, 0x800}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x200}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x12}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0xe}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x4}]}, @TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'eth\x00'}, @TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'ib\x00'}, @TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'ib\x00'}, @TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'udp\x00'}, @TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'udp\x00'}, @TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'eth\x00'}, @TIPC_NLA_MEDIA_PROP={0xc, 0x2, [@TIPC_NLA_PROP_TOL={0x8, 0x2, 0x9}]}, @TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'ib\x00'}, @TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'eth\x00'}]}, @TIPC_NLA_SOCK={0x20, 0x2, [@TIPC_NLA_SOCK_HAS_PUBL={0x4}, @TIPC_NLA_SOCK_REF={0x8, 0x2, 0x3}, @TIPC_NLA_SOCK_HAS_PUBL={0x4}, @TIPC_NLA_SOCK_HAS_PUBL={0x4}, @TIPC_NLA_SOCK_REF={0x8, 0x2, 0xbc1c}]}, @TIPC_NLA_NET={0x30, 0x7, [@TIPC_NLA_NET_NODEID_W1={0xc, 0x4, 0x7}, @TIPC_NLA_NET_ID={0x8, 0x1, 0x81}, @TIPC_NLA_NET_NODEID={0xc, 0x3, 0x1}, @TIPC_NLA_NET_NODEID_W1={0xc, 0x4, 0x9}]}, @TIPC_NLA_NODE={0x10, 0x6, [@TIPC_NLA_NODE_ADDR={0x8, 0x1, 0xafe0}, @TIPC_NLA_NODE_UP={0x4}]}, @TIPC_NLA_BEARER={0x84, 0x1, [@TIPC_NLA_BEARER_PROP={0x24, 0x2, [@TIPC_NLA_PROP_WIN={0x8, 0x3, 0x7fff}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0xfffffffffffffffb}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x101}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x2}]}, @TIPC_NLA_BEARER_NAME={0x10, 0x1, @udp='udp:syz1\x00'}, @TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_PROP={0x44, 0x2, [@TIPC_NLA_PROP_TOL={0x8, 0x2, 0x800}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x1}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0xe}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x2}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x9}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x800}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x1f}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x7}]}]}, @TIPC_NLA_NET={0x14, 0x7, [@TIPC_NLA_NET_ID={0x8, 0x1, 0x4}, @TIPC_NLA_NET_ADDR={0x8, 0x2, 0x8}]}, @TIPC_NLA_SOCK={0x1c, 0x2, [@TIPC_NLA_SOCK_REF={0x8, 0x2, 0x1}, @TIPC_NLA_SOCK_ADDR={0x8}, @TIPC_NLA_SOCK_REF={0x8, 0x2, 0x2}]}, @TIPC_NLA_MON={0x14, 0x9, [@TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8, 0x1, 0x80000001}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8, 0x1, 0x1000}]}]}, 0x1b8}, 0x1, 0x0, 0x0, 0x24004041}, 0x0) r3 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0563044000ac171d6aaa9d4a282f000000"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) 14:03:49 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x540b, 0x1) 14:03:49 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f319bd070") ioctl$sock_SIOCDELDLCI(r0, 0x8981, &(0x7f00000000c0)={'nr0\x00', 0x9}) r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) setsockopt$IP_VS_SO_SET_ADDDEST(r0, 0x0, 0x487, &(0x7f0000000100)={{0x16, @dev={0xac, 0x14, 0x14, 0x10}, 0x4e20, 0x1, 'fo\x00', 0x2, 0x8af, 0x64}, {@multicast1, 0x4e20, 0x10007, 0x6da2c122, 0x5, 0x200}}, 0x44) ioctl$TCSETAF(r1, 0x5408, &(0x7f00000001c0)={0x10000000, 0x0, 0xffffffffffffffff, 0x0, 0x11, 0x0, 0x6}) ioctl$KDGKBLED(r1, 0x4b64, &(0x7f0000000080)) pwrite64(r1, &(0x7f0000000180)="f8689cc1164fdcc484ad143ff24fd1ec70f2100b68d8545fc51a3fba796fa06cb78090a43bb5136f5ea25a2ce53c57a96a8cdfb0421a7f1701bdef24", 0x3c, 0x0) 14:03:49 executing program 5: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSPTLCK(r0, 0x40045431, &(0x7f0000000180)) socket(0x200000000000011, 0x4000000000080002, 0x0) bind$packet(0xffffffffffffffff, 0x0, 0x0) sendmmsg(0xffffffffffffffff, &(0x7f0000007880)=[{{&(0x7f00000001c0)=@l2={0x1f, 0xbf53, {0x9, 0x7, 0xfffffffffffffdd5, 0x1ff, 0x2, 0x4}, 0x0, 0x7}, 0x80, 0x0}}, {{0x0, 0x0, &(0x7f0000007780)}}], 0x2, 0x4048851) setsockopt$packet_int(0xffffffffffffffff, 0x107, 0x0, 0x0, 0x0) syz_open_procfs(0x0, 0x0) ioctl$LOOP_SET_BLOCK_SIZE(0xffffffffffffffff, 0x4c09, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$cgroup_int(0xffffffffffffffff, 0x0, 0x2, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='\x89\x00\x00\x00\x00Ew\x00\x00\x00\xef\xb4\xc8\xd0\xff\xda\xb1vents\xd9\xc5H\xd4\x91\xfdN_]\x16\xe4\xa9C\xd2\x86Qn\xefS\x80\x11J\xfb4\x14\x86 4\x95\x9e\xfc\xc1\a\xcb \x95N\xe9\xa4j\xd2\x1f^\xb0\xb2>\xa3\xc9\xb7$\x11`t\x03: \x8b\xa4\x05\xf2?E\xdb+{t\xb8\xf7\xab\x8b\x100#', 0x26e1, 0x0) ioctl$PERF_EVENT_IOC_PAUSE_OUTPUT(r1, 0x40086602, 0x400007) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000280)='./cgroup/syz0\x00', 0x1ff) openat$smack_thread_current(0xffffffffffffff9c, &(0x7f0000000240)='/proc/thread-self/attr/current\x00', 0x2, 0x0) write$cgroup_subtree(r1, &(0x7f0000000100)=ANY=[], 0xff4a) write$cgroup_subtree(r2, &(0x7f0000000000)=ANY=[], 0x20032600) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a0f, 0x1700) accept$inet(0xffffffffffffffff, &(0x7f0000000040)={0x2, 0x0, @local}, &(0x7f0000000080)=0x10) ioctl$TCSETAF(r0, 0x5408, &(0x7f0000000040)={0x2}) ioctl$EXT4_IOC_GROUP_ADD(r0, 0x40286608, &(0x7f0000000000)={0x3, 0x7000000, 0x400, 0x100000000, 0x0, 0x8}) r3 = fcntl$dupfd(r0, 0x406, r0) ioctl$EVIOCGVERSION(r3, 0x80044501, &(0x7f0000000200)=""/31) write$binfmt_misc(r0, &(0x7f0000000080)={'syz1', "80fa25cdc862d216160cfa92845a3916e38a409a159c03f1889971d3e5144a8d08de78c4b1fbee457437261d7668b1c0f582647ad4134a05358d4309a71a702002329e024cac95642e761bb842bc1056bd6bf12c47697a649a026bd8ee1f685089941469b1ddfeddf32b392f0ff07652a3bce0770bc3bb70862845a65054cecb191e80b825d740fe6b40450359757032425dfdee92aec36ce4b468d50adc745c522cc4af2ac6e7f6a95f0edd70b09caa95fcc7143cf46b74db8bc17fa7c89f"}, 0xc3) 14:03:49 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x540b, 0x1) 14:03:49 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/ptmx\x00', 0x0, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) socket(0x200000000000011, 0x4000000000080002, 0x0) bind$packet(0xffffffffffffffff, 0x0, 0x0) sendmmsg(0xffffffffffffffff, &(0x7f0000007880)=[{{&(0x7f00000001c0)=@l2={0x1f, 0xbf53, {0x9, 0x7, 0xfffffffffffffdd5, 0x1ff, 0x2, 0x4}, 0x0, 0x7}, 0x80, 0x0}}, {{0x0, 0x0, &(0x7f0000007780)}}], 0x2, 0x4048851) setsockopt$packet_int(0xffffffffffffffff, 0x107, 0x0, 0x0, 0x0) syz_open_procfs(0x0, 0x0) ioctl$LOOP_SET_BLOCK_SIZE(0xffffffffffffffff, 0x4c09, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$cgroup_int(0xffffffffffffffff, 0x0, 0x2, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='\x89\x00\x00\x00\x00Ew\x00\x00\x00\xef\xb4\xc8\xd0\xff\xda\xb1vents\xd9\xc5H\xd4\x91\xfdN_]\x16\xe4\xa9C\xd2\x86Qn\xefS\x80\x11J\xfb4\x14\x86 4\x95\x9e\xfc\xc1\a\xcb \x95N\xe9\xa4j\xd2\x1f^\xb0\xb2>\xa3\xc9\xb7$\x11`t\x03: \x8b\xa4\x05\xf2?E\xdb+{t\xb8\xf7\xab\x8b\x100#', 0x26e1, 0x0) ioctl$PERF_EVENT_IOC_PAUSE_OUTPUT(r1, 0x40086602, 0x400007) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000280)='./cgroup/syz0\x00', 0x1ff) openat$smack_thread_current(0xffffffffffffff9c, &(0x7f0000000240)='/proc/thread-self/attr/current\x00', 0x2, 0x0) write$cgroup_subtree(r1, &(0x7f0000000100)=ANY=[], 0xff4a) write$cgroup_subtree(r2, &(0x7f0000000000)=ANY=[], 0x20032600) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a0f, 0x1700) accept$inet(0xffffffffffffffff, &(0x7f0000000040)={0x2, 0x0, @local}, &(0x7f0000000080)=0x10) ioctl$TCSETAF(r0, 0x5408, &(0x7f0000000040)={0x2}) ioctl$EXT4_IOC_GROUP_ADD(r0, 0x40286608, &(0x7f0000000000)={0x3, 0x7000000, 0x400, 0x100000000, 0x0, 0x8}) r3 = fcntl$dupfd(r0, 0x406, r0) ioctl$EVIOCGVERSION(r3, 0x80044501, &(0x7f0000000200)=""/31) write$binfmt_misc(r0, &(0x7f0000000080)={'syz1', "80fa25cdc862d216160cfa92845a3916e38a409a159c03f1889971d3e5144a8d08de78c4b1fbee457437261d7668b1c0f582647ad4134a05358d4309a71a702002329e024cac95642e761bb842bc1056bd6bf12c47697a649a026bd8ee1f685089941469b1ddfeddf32b392f0ff07652a3bce0770bc3bb70862845a65054cecb191e80b825d740fe6b40450359757032425dfdee92aec36ce4b468d50adc745c522cc4af2ac6e7f6a95f0edd70b09caa95fcc7143cf46b74db8bc17fa7c89f"}, 0xc3) [ 336.228354] binder: 10304:10308 Acquire 1 refcount change on invalid ref 488090624 ret -22 [ 336.238932] binder: 10304:10308 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 14:03:49 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x540b, 0x1) 14:03:49 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="e93f3f6a5a50220bfc9e85acd33e"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) 14:03:49 executing program 4: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(r0, 0x540b, 0x0) 14:03:49 executing program 0: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/ptmx\x00', 0x0, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) socket(0x200000000000011, 0x4000000000080002, 0x0) bind$packet(0xffffffffffffffff, 0x0, 0x0) sendmmsg(0xffffffffffffffff, &(0x7f0000007880)=[{{&(0x7f00000001c0)=@l2={0x1f, 0xbf53, {0x9, 0x7, 0xfffffffffffffdd5, 0x1ff, 0x2, 0x4}, 0x0, 0x7}, 0x80, 0x0}}, {{0x0, 0x0, &(0x7f0000007780)}}], 0x2, 0x4048851) setsockopt$packet_int(0xffffffffffffffff, 0x107, 0x0, 0x0, 0x0) syz_open_procfs(0x0, 0x0) ioctl$LOOP_SET_BLOCK_SIZE(0xffffffffffffffff, 0x4c09, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$cgroup_int(0xffffffffffffffff, 0x0, 0x2, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='\x89\x00\x00\x00\x00Ew\x00\x00\x00\xef\xb4\xc8\xd0\xff\xda\xb1vents\xd9\xc5H\xd4\x91\xfdN_]\x16\xe4\xa9C\xd2\x86Qn\xefS\x80\x11J\xfb4\x14\x86 4\x95\x9e\xfc\xc1\a\xcb \x95N\xe9\xa4j\xd2\x1f^\xb0\xb2>\xa3\xc9\xb7$\x11`t\x03: \x8b\xa4\x05\xf2?E\xdb+{t\xb8\xf7\xab\x8b\x100#', 0x26e1, 0x0) ioctl$PERF_EVENT_IOC_PAUSE_OUTPUT(r1, 0x40086602, 0x400007) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000280)='./cgroup/syz0\x00', 0x1ff) openat$smack_thread_current(0xffffffffffffff9c, &(0x7f0000000240)='/proc/thread-self/attr/current\x00', 0x2, 0x0) write$cgroup_subtree(r1, &(0x7f0000000100)=ANY=[], 0xff4a) write$cgroup_subtree(r2, &(0x7f0000000000)=ANY=[], 0x20032600) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a0f, 0x1700) accept$inet(0xffffffffffffffff, &(0x7f0000000040)={0x2, 0x0, @local}, &(0x7f0000000080)=0x10) ioctl$TCSETAF(r0, 0x5408, &(0x7f0000000040)={0x2}) ioctl$EXT4_IOC_GROUP_ADD(r0, 0x40286608, &(0x7f0000000000)={0x3, 0x7000000, 0x400, 0x100000000, 0x0, 0x8}) r3 = fcntl$dupfd(r0, 0x406, r0) ioctl$EVIOCGVERSION(r3, 0x80044501, &(0x7f0000000200)=""/31) write$binfmt_misc(r0, &(0x7f0000000080)={'syz1', "80fa25cdc862d216160cfa92845a3916e38a409a159c03f1889971d3e5144a8d08de78c4b1fbee457437261d7668b1c0f582647ad4134a05358d4309a71a702002329e024cac95642e761bb842bc1056bd6bf12c47697a649a026bd8ee1f685089941469b1ddfeddf32b392f0ff07652a3bce0770bc3bb70862845a65054cecb191e80b825d740fe6b40450359757032425dfdee92aec36ce4b468d50adc745c522cc4af2ac6e7f6a95f0edd70b09caa95fcc7143cf46b74db8bc17fa7c89f"}, 0xc3) 14:03:49 executing program 1: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSPTLCK(r0, 0x40045431, &(0x7f0000000180)) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) socket(0x200000000000011, 0x4000000000080002, 0x0) bind$packet(0xffffffffffffffff, 0x0, 0x0) sendmmsg(0xffffffffffffffff, &(0x7f0000007880)=[{{&(0x7f00000001c0)=@l2={0x1f, 0xbf53, {0x9, 0x7, 0xfffffffffffffdd5, 0x1ff, 0x2, 0x4}, 0x0, 0x7}, 0x80, 0x0}}, {{0x0, 0x0, &(0x7f0000007780)}}], 0x2, 0x4048851) syz_open_procfs(0x0, 0x0) ioctl$LOOP_SET_BLOCK_SIZE(0xffffffffffffffff, 0x4c09, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$cgroup_int(0xffffffffffffffff, 0x0, 0x2, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='\x89\x00\x00\x00\x00Ew\x00\x00\x00\xef\xb4\xc8\xd0\xff\xda\xb1vents\xd9\xc5H\xd4\x91\xfdN_]\x16\xe4\xa9C\xd2\x86Qn\xefS\x80\x11J\xfb4\x14\x86 4\x95\x9e\xfc\xc1\a\xcb \x95N\xe9\xa4j\xd2\x1f^\xb0\xb2>\xa3\xc9\xb7$\x11`t\x03: \x8b\xa4\x05\xf2?E\xdb+{t\xb8\xf7\xab\x8b\x100#', 0x26e1, 0x0) ioctl$PERF_EVENT_IOC_PAUSE_OUTPUT(r1, 0x40086602, 0x400007) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000280)='./cgroup/syz0\x00', 0x1ff) openat$smack_thread_current(0xffffffffffffff9c, &(0x7f0000000240)='/proc/thread-self/attr/current\x00', 0x2, 0x0) write$cgroup_subtree(r1, &(0x7f0000000100)=ANY=[], 0xff4a) write$cgroup_subtree(r2, &(0x7f0000000000)=ANY=[], 0x20032600) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a0f, 0x1700) accept$inet(0xffffffffffffffff, &(0x7f0000000040)={0x2, 0x0, @local}, &(0x7f0000000080)=0x10) ioctl$TCSETAF(r0, 0x5408, &(0x7f0000000040)={0x2}) ioctl$EXT4_IOC_GROUP_ADD(r0, 0x40286608, &(0x7f0000000000)={0x3, 0x7000000, 0x400, 0x100000000, 0x0, 0x8}) r3 = fcntl$dupfd(r0, 0x406, r0) ioctl$EVIOCGVERSION(r3, 0x80044501, &(0x7f0000000200)=""/31) write$binfmt_misc(r0, &(0x7f0000000080)={'syz1', "80fa25cdc862d216160cfa92845a3916e38a409a159c03f1889971d3e5144a8d08de78c4b1fbee457437261d7668b1c0f582647ad4134a05358d4309a71a702002329e024cac95642e761bb842bc1056bd6bf12c47697a649a026bd8ee1f685089941469b1ddfeddf32b392f0ff07652a3bce0770bc3bb70862845a65054cecb191e80b825d740fe6b40450359757032425dfdee92aec36ce4b468d50adc745c522cc4af2ac6e7f6a95f0edd70b09caa95fcc7143cf46b74db8bc17fa7c89f"}, 0xc3) [ 336.315038] binder: 10333:10335 unknown command 1782530025 [ 336.320878] binder: 10333:10335 ioctl c0306201 20012000 returned -22 14:03:49 executing program 4: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(r0, 0x540b, 0x0) 14:03:49 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)) openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x4080, 0x0) 14:03:49 executing program 4: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(r0, 0x540b, 0x0) [ 336.364173] binder: 10333:10335 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 14:03:49 executing program 5: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSPTLCK(r0, 0x40045431, &(0x7f0000000180)) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) socket(0x200000000000011, 0x4000000000080002, 0x0) bind$packet(0xffffffffffffffff, 0x0, 0x0) sendmmsg(0xffffffffffffffff, &(0x7f0000007880)=[{{&(0x7f00000001c0)=@l2={0x1f, 0xbf53, {0x9, 0x7, 0xfffffffffffffdd5, 0x1ff, 0x2, 0x4}, 0x0, 0x7}, 0x80, 0x0}}, {{0x0, 0x0, &(0x7f0000007780)}}], 0x2, 0x4048851) syz_open_procfs(0x0, 0x0) ioctl$LOOP_SET_BLOCK_SIZE(0xffffffffffffffff, 0x4c09, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$cgroup_int(0xffffffffffffffff, 0x0, 0x2, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='\x89\x00\x00\x00\x00Ew\x00\x00\x00\xef\xb4\xc8\xd0\xff\xda\xb1vents\xd9\xc5H\xd4\x91\xfdN_]\x16\xe4\xa9C\xd2\x86Qn\xefS\x80\x11J\xfb4\x14\x86 4\x95\x9e\xfc\xc1\a\xcb \x95N\xe9\xa4j\xd2\x1f^\xb0\xb2>\xa3\xc9\xb7$\x11`t\x03: \x8b\xa4\x05\xf2?E\xdb+{t\xb8\xf7\xab\x8b\x100#', 0x26e1, 0x0) ioctl$PERF_EVENT_IOC_PAUSE_OUTPUT(r1, 0x40086602, 0x400007) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000280)='./cgroup/syz0\x00', 0x1ff) openat$smack_thread_current(0xffffffffffffff9c, &(0x7f0000000240)='/proc/thread-self/attr/current\x00', 0x2, 0x0) write$cgroup_subtree(r1, &(0x7f0000000100)=ANY=[], 0xff4a) write$cgroup_subtree(r2, &(0x7f0000000000)=ANY=[], 0x20032600) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a0f, 0x1700) accept$inet(0xffffffffffffffff, &(0x7f0000000040)={0x2, 0x0, @local}, &(0x7f0000000080)=0x10) ioctl$TCSETAF(r0, 0x5408, &(0x7f0000000040)={0x2}) ioctl$EXT4_IOC_GROUP_ADD(r0, 0x40286608, &(0x7f0000000000)={0x3, 0x7000000, 0x400, 0x100000000, 0x0, 0x8}) r3 = fcntl$dupfd(r0, 0x406, r0) ioctl$EVIOCGVERSION(r3, 0x80044501, &(0x7f0000000200)=""/31) write$binfmt_misc(r0, &(0x7f0000000080)={'syz1', "80fa25cdc862d216160cfa92845a3916e38a409a159c03f1889971d3e5144a8d08de78c4b1fbee457437261d7668b1c0f582647ad4134a05358d4309a71a702002329e024cac95642e761bb842bc1056bd6bf12c47697a649a026bd8ee1f685089941469b1ddfeddf32b392f0ff07652a3bce0770bc3bb70862845a65054cecb191e80b825d740fe6b40450359757032425dfdee92aec36ce4b468d50adc745c522cc4af2ac6e7f6a95f0edd70b09caa95fcc7143cf46b74db8bc17fa7c89f"}, 0xc3) 14:03:49 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/ptmx\x00', 0x0, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) socket(0x200000000000011, 0x4000000000080002, 0x0) bind$packet(0xffffffffffffffff, 0x0, 0x0) sendmmsg(0xffffffffffffffff, &(0x7f0000007880)=[{{&(0x7f00000001c0)=@l2={0x1f, 0xbf53, {0x9, 0x7, 0xfffffffffffffdd5, 0x1ff, 0x2, 0x4}, 0x0, 0x7}, 0x80, 0x0}}, {{0x0, 0x0, &(0x7f0000007780)}}], 0x2, 0x4048851) setsockopt$packet_int(0xffffffffffffffff, 0x107, 0x0, 0x0, 0x0) syz_open_procfs(0x0, 0x0) ioctl$LOOP_SET_BLOCK_SIZE(0xffffffffffffffff, 0x4c09, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$cgroup_int(0xffffffffffffffff, 0x0, 0x2, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='\x89\x00\x00\x00\x00Ew\x00\x00\x00\xef\xb4\xc8\xd0\xff\xda\xb1vents\xd9\xc5H\xd4\x91\xfdN_]\x16\xe4\xa9C\xd2\x86Qn\xefS\x80\x11J\xfb4\x14\x86 4\x95\x9e\xfc\xc1\a\xcb \x95N\xe9\xa4j\xd2\x1f^\xb0\xb2>\xa3\xc9\xb7$\x11`t\x03: \x8b\xa4\x05\xf2?E\xdb+{t\xb8\xf7\xab\x8b\x100#', 0x26e1, 0x0) ioctl$PERF_EVENT_IOC_PAUSE_OUTPUT(r1, 0x40086602, 0x400007) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000280)='./cgroup/syz0\x00', 0x1ff) openat$smack_thread_current(0xffffffffffffff9c, &(0x7f0000000240)='/proc/thread-self/attr/current\x00', 0x2, 0x0) write$cgroup_subtree(r1, &(0x7f0000000100)=ANY=[], 0xff4a) write$cgroup_subtree(r2, &(0x7f0000000000)=ANY=[], 0x20032600) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a0f, 0x1700) accept$inet(0xffffffffffffffff, &(0x7f0000000040)={0x2, 0x0, @local}, &(0x7f0000000080)=0x10) ioctl$TCSETAF(r0, 0x5408, &(0x7f0000000040)={0x2}) ioctl$EXT4_IOC_GROUP_ADD(r0, 0x40286608, &(0x7f0000000000)={0x3, 0x7000000, 0x400, 0x100000000, 0x0, 0x8}) r3 = fcntl$dupfd(r0, 0x406, r0) ioctl$EVIOCGVERSION(r3, 0x80044501, &(0x7f0000000200)=""/31) write$binfmt_misc(r0, &(0x7f0000000080)={'syz1', "80fa25cdc862d216160cfa92845a3916e38a409a159c03f1889971d3e5144a8d08de78c4b1fbee457437261d7668b1c0f582647ad4134a05358d4309a71a702002329e024cac95642e761bb842bc1056bd6bf12c47697a649a026bd8ee1f685089941469b1ddfeddf32b392f0ff07652a3bce0770bc3bb70862845a65054cecb191e80b825d740fe6b40450359757032425dfdee92aec36ce4b468d50adc745c522cc4af2ac6e7f6a95f0edd70b09caa95fcc7143cf46b74db8bc17fa7c89f"}, 0xc3) 14:03:49 executing program 4: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/ptmx\x00', 0x0, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) socket(0x200000000000011, 0x4000000000080002, 0x0) bind$packet(0xffffffffffffffff, 0x0, 0x0) sendmmsg(0xffffffffffffffff, &(0x7f0000007880)=[{{&(0x7f00000001c0)=@l2={0x1f, 0xbf53, {0x9, 0x7, 0xfffffffffffffdd5, 0x1ff, 0x2, 0x4}, 0x0, 0x7}, 0x80, 0x0}}, {{0x0, 0x0, &(0x7f0000007780)}}], 0x2, 0x4048851) setsockopt$packet_int(0xffffffffffffffff, 0x107, 0x0, 0x0, 0x0) syz_open_procfs(0x0, 0x0) ioctl$LOOP_SET_BLOCK_SIZE(0xffffffffffffffff, 0x4c09, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$cgroup_int(0xffffffffffffffff, 0x0, 0x2, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='\x89\x00\x00\x00\x00Ew\x00\x00\x00\xef\xb4\xc8\xd0\xff\xda\xb1vents\xd9\xc5H\xd4\x91\xfdN_]\x16\xe4\xa9C\xd2\x86Qn\xefS\x80\x11J\xfb4\x14\x86 4\x95\x9e\xfc\xc1\a\xcb \x95N\xe9\xa4j\xd2\x1f^\xb0\xb2>\xa3\xc9\xb7$\x11`t\x03: \x8b\xa4\x05\xf2?E\xdb+{t\xb8\xf7\xab\x8b\x100#', 0x26e1, 0x0) ioctl$PERF_EVENT_IOC_PAUSE_OUTPUT(r1, 0x40086602, 0x400007) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000280)='./cgroup/syz0\x00', 0x1ff) openat$smack_thread_current(0xffffffffffffff9c, &(0x7f0000000240)='/proc/thread-self/attr/current\x00', 0x2, 0x0) write$cgroup_subtree(r1, &(0x7f0000000100)=ANY=[], 0xff4a) write$cgroup_subtree(r2, &(0x7f0000000000)=ANY=[], 0x20032600) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a0f, 0x1700) accept$inet(0xffffffffffffffff, &(0x7f0000000040)={0x2, 0x0, @local}, &(0x7f0000000080)=0x10) ioctl$TCSETAF(r0, 0x5408, &(0x7f0000000040)={0x2}) ioctl$EXT4_IOC_GROUP_ADD(r0, 0x40286608, &(0x7f0000000000)={0x3, 0x7000000, 0x400, 0x100000000, 0x0, 0x8}) r3 = fcntl$dupfd(r0, 0x406, r0) ioctl$EVIOCGVERSION(r3, 0x80044501, &(0x7f0000000200)=""/31) write$binfmt_misc(r0, &(0x7f0000000080)={'syz1', "80fa25cdc862d216160cfa92845a3916e38a409a159c03f1889971d3e5144a8d08de78c4b1fbee457437261d7668b1c0f582647ad4134a05358d4309a71a702002329e024cac95642e761bb842bc1056bd6bf12c47697a649a026bd8ee1f685089941469b1ddfeddf32b392f0ff07652a3bce0770bc3bb70862845a65054cecb191e80b825d740fe6b40450359757032425dfdee92aec36ce4b468d50adc745c522cc4af2ac6e7f6a95f0edd70b09caa95fcc7143cf46b74db8bc17fa7c89f"}, 0xc3) 14:03:49 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) memfd_create(&(0x7f0000000000)='/dev/binder#\x00', 0x1) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f00000001c0)=[@acquire], 0x0, 0x0, 0x0}) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) ioctl$sock_SIOCGPGRP(r2, 0x8904, &(0x7f0000000040)) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) 14:03:50 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) fcntl$addseals(r0, 0x409, 0x2) r1 = openat$pfkey(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/net/pfkey\x00', 0x20a81, 0x0) ioctl$SIOCGIFHWADDR(r1, 0x8927, &(0x7f0000000040)) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f00000001c0)=[@acquire], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) 14:03:50 executing program 1: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSPTLCK(r0, 0x40045431, &(0x7f0000000180)) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) socket(0x200000000000011, 0x4000000000080002, 0x0) bind$packet(0xffffffffffffffff, 0x0, 0x0) sendmmsg(0xffffffffffffffff, &(0x7f0000007880)=[{{&(0x7f00000001c0)=@l2={0x1f, 0xbf53, {0x9, 0x7, 0xfffffffffffffdd5, 0x1ff, 0x2, 0x4}, 0x0, 0x7}, 0x80, 0x0}}, {{0x0, 0x0, &(0x7f0000007780)}}], 0x2, 0x4048851) syz_open_procfs(0x0, 0x0) ioctl$LOOP_SET_BLOCK_SIZE(0xffffffffffffffff, 0x4c09, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$cgroup_int(0xffffffffffffffff, 0x0, 0x2, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='\x89\x00\x00\x00\x00Ew\x00\x00\x00\xef\xb4\xc8\xd0\xff\xda\xb1vents\xd9\xc5H\xd4\x91\xfdN_]\x16\xe4\xa9C\xd2\x86Qn\xefS\x80\x11J\xfb4\x14\x86 4\x95\x9e\xfc\xc1\a\xcb \x95N\xe9\xa4j\xd2\x1f^\xb0\xb2>\xa3\xc9\xb7$\x11`t\x03: \x8b\xa4\x05\xf2?E\xdb+{t\xb8\xf7\xab\x8b\x100#', 0x26e1, 0x0) ioctl$PERF_EVENT_IOC_PAUSE_OUTPUT(r1, 0x40086602, 0x400007) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000280)='./cgroup/syz0\x00', 0x1ff) openat$smack_thread_current(0xffffffffffffff9c, &(0x7f0000000240)='/proc/thread-self/attr/current\x00', 0x2, 0x0) write$cgroup_subtree(r1, &(0x7f0000000100)=ANY=[], 0xff4a) write$cgroup_subtree(r2, &(0x7f0000000000)=ANY=[], 0x20032600) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a0f, 0x1700) accept$inet(0xffffffffffffffff, &(0x7f0000000040)={0x2, 0x0, @local}, &(0x7f0000000080)=0x10) ioctl$TCSETAF(r0, 0x5408, &(0x7f0000000040)={0x2}) ioctl$EXT4_IOC_GROUP_ADD(r0, 0x40286608, &(0x7f0000000000)={0x3, 0x7000000, 0x400, 0x100000000, 0x0, 0x8}) r3 = fcntl$dupfd(r0, 0x406, r0) ioctl$EVIOCGVERSION(r3, 0x80044501, &(0x7f0000000200)=""/31) write$binfmt_misc(r0, &(0x7f0000000080)={'syz1', "80fa25cdc862d216160cfa92845a3916e38a409a159c03f1889971d3e5144a8d08de78c4b1fbee457437261d7668b1c0f582647ad4134a05358d4309a71a702002329e024cac95642e761bb842bc1056bd6bf12c47697a649a026bd8ee1f685089941469b1ddfeddf32b392f0ff07652a3bce0770bc3bb70862845a65054cecb191e80b825d740fe6b40450359757032425dfdee92aec36ce4b468d50adc745c522cc4af2ac6e7f6a95f0edd70b09caa95fcc7143cf46b74db8bc17fa7c89f"}, 0xc3) 14:03:50 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, 0x0) openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x4080, 0x0) 14:03:50 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = accept4$packet(0xffffffffffffff9c, 0x0, &(0x7f0000000040), 0x80000) getsockopt$packet_buf(r1, 0x107, 0x17, &(0x7f0000000080)=""/164, &(0x7f0000000140)=0xa4) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f00000001c0)=[@acquire], 0x0, 0x0, 0x0}) syz_genetlink_get_family_id$nbd(&(0x7f0000000000)='nbd\x00') ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) 14:03:50 executing program 2: ioctl$TIOCSPTLCK(0xffffffffffffffff, 0x40045431, &(0x7f0000000180)) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) socket(0x200000000000011, 0x4000000000080002, 0x0) bind$packet(0xffffffffffffffff, 0x0, 0x0) sendmmsg(0xffffffffffffffff, &(0x7f0000007880)=[{{&(0x7f00000001c0)=@l2={0x1f, 0xbf53, {0x9, 0x7, 0xfffffffffffffdd5, 0x1ff, 0x2, 0x4}, 0x0, 0x7}, 0x80, 0x0}}, {{0x0, 0x0, &(0x7f0000007780)}}], 0x2, 0x4048851) setsockopt$packet_int(0xffffffffffffffff, 0x107, 0x0, 0x0, 0x0) syz_open_procfs(0x0, 0x0) ioctl$LOOP_SET_BLOCK_SIZE(0xffffffffffffffff, 0x4c09, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$cgroup_int(0xffffffffffffffff, 0x0, 0x2, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='\x89\x00\x00\x00\x00Ew\x00\x00\x00\xef\xb4\xc8\xd0\xff\xda\xb1vents\xd9\xc5H\xd4\x91\xfdN_]\x16\xe4\xa9C\xd2\x86Qn\xefS\x80\x11J\xfb4\x14\x86 4\x95\x9e\xfc\xc1\a\xcb \x95N\xe9\xa4j\xd2\x1f^\xb0\xb2>\xa3\xc9\xb7$\x11`t\x03: \x8b\xa4\x05\xf2?E\xdb+{t\xb8\xf7\xab\x8b\x100#', 0x26e1, 0x0) ioctl$PERF_EVENT_IOC_PAUSE_OUTPUT(r0, 0x40086602, 0x400007) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000280)='./cgroup/syz0\x00', 0x1ff) openat$smack_thread_current(0xffffffffffffff9c, &(0x7f0000000240)='/proc/thread-self/attr/current\x00', 0x2, 0x0) write$cgroup_subtree(r0, &(0x7f0000000100)=ANY=[], 0xff4a) write$cgroup_subtree(r1, &(0x7f0000000000)=ANY=[], 0x20032600) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a0f, 0x1700) accept$inet(0xffffffffffffffff, &(0x7f0000000040)={0x2, 0x0, @local}, &(0x7f0000000080)=0x10) ioctl$TCSETAF(0xffffffffffffffff, 0x5408, &(0x7f0000000040)={0x2}) ioctl$EXT4_IOC_GROUP_ADD(0xffffffffffffffff, 0x40286608, &(0x7f0000000000)={0x3, 0x7000000, 0x400, 0x100000000, 0x0, 0x8}) r2 = fcntl$dupfd(0xffffffffffffffff, 0x406, 0xffffffffffffffff) ioctl$EVIOCGVERSION(r2, 0x80044501, &(0x7f0000000200)=""/31) write$binfmt_misc(0xffffffffffffffff, &(0x7f0000000080)={'syz1', "80fa25cdc862d216160cfa92845a3916e38a409a159c03f1889971d3e5144a8d08de78c4b1fbee457437261d7668b1c0f582647ad4134a05358d4309a71a702002329e024cac95642e761bb842bc1056bd6bf12c47697a649a026bd8ee1f685089941469b1ddfeddf32b392f0ff07652a3bce0770bc3bb70862845a65054cecb191e80b825d740fe6b40450359757032425dfdee92aec36ce4b468d50adc745c522cc4af2ac6e7f6a95f0edd70b09caa95fcc7143cf46b74db8bc17fa7c89f"}, 0xc3) 14:03:50 executing program 0: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/ptmx\x00', 0x0, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) socket(0x200000000000011, 0x4000000000080002, 0x0) bind$packet(0xffffffffffffffff, 0x0, 0x0) sendmmsg(0xffffffffffffffff, &(0x7f0000007880)=[{{&(0x7f00000001c0)=@l2={0x1f, 0xbf53, {0x9, 0x7, 0xfffffffffffffdd5, 0x1ff, 0x2, 0x4}, 0x0, 0x7}, 0x80, 0x0}}, {{0x0, 0x0, &(0x7f0000007780)}}], 0x2, 0x4048851) setsockopt$packet_int(0xffffffffffffffff, 0x107, 0x0, 0x0, 0x0) syz_open_procfs(0x0, 0x0) ioctl$LOOP_SET_BLOCK_SIZE(0xffffffffffffffff, 0x4c09, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$cgroup_int(0xffffffffffffffff, 0x0, 0x2, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='\x89\x00\x00\x00\x00Ew\x00\x00\x00\xef\xb4\xc8\xd0\xff\xda\xb1vents\xd9\xc5H\xd4\x91\xfdN_]\x16\xe4\xa9C\xd2\x86Qn\xefS\x80\x11J\xfb4\x14\x86 4\x95\x9e\xfc\xc1\a\xcb \x95N\xe9\xa4j\xd2\x1f^\xb0\xb2>\xa3\xc9\xb7$\x11`t\x03: \x8b\xa4\x05\xf2?E\xdb+{t\xb8\xf7\xab\x8b\x100#', 0x26e1, 0x0) ioctl$PERF_EVENT_IOC_PAUSE_OUTPUT(r1, 0x40086602, 0x400007) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000280)='./cgroup/syz0\x00', 0x1ff) openat$smack_thread_current(0xffffffffffffff9c, &(0x7f0000000240)='/proc/thread-self/attr/current\x00', 0x2, 0x0) write$cgroup_subtree(r1, &(0x7f0000000100)=ANY=[], 0xff4a) write$cgroup_subtree(r2, &(0x7f0000000000)=ANY=[], 0x20032600) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a0f, 0x1700) accept$inet(0xffffffffffffffff, &(0x7f0000000040)={0x2, 0x0, @local}, &(0x7f0000000080)=0x10) ioctl$TCSETAF(r0, 0x5408, &(0x7f0000000040)={0x2}) ioctl$EXT4_IOC_GROUP_ADD(r0, 0x40286608, &(0x7f0000000000)={0x3, 0x7000000, 0x400, 0x100000000, 0x0, 0x8}) r3 = fcntl$dupfd(r0, 0x406, r0) ioctl$EVIOCGVERSION(r3, 0x80044501, &(0x7f0000000200)=""/31) write$binfmt_misc(r0, &(0x7f0000000080)={'syz1', "80fa25cdc862d216160cfa92845a3916e38a409a159c03f1889971d3e5144a8d08de78c4b1fbee457437261d7668b1c0f582647ad4134a05358d4309a71a702002329e024cac95642e761bb842bc1056bd6bf12c47697a649a026bd8ee1f685089941469b1ddfeddf32b392f0ff07652a3bce0770bc3bb70862845a65054cecb191e80b825d740fe6b40450359757032425dfdee92aec36ce4b468d50adc745c522cc4af2ac6e7f6a95f0edd70b09caa95fcc7143cf46b74db8bc17fa7c89f"}, 0xc3) 14:03:50 executing program 5: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSPTLCK(r0, 0x40045431, &(0x7f0000000180)) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) socket(0x200000000000011, 0x4000000000080002, 0x0) bind$packet(0xffffffffffffffff, 0x0, 0x0) sendmmsg(0xffffffffffffffff, &(0x7f0000007880)=[{{&(0x7f00000001c0)=@l2={0x1f, 0xbf53, {0x9, 0x7, 0xfffffffffffffdd5, 0x1ff, 0x2, 0x4}, 0x0, 0x7}, 0x80, 0x0}}, {{0x0, 0x0, &(0x7f0000007780)}}], 0x2, 0x4048851) syz_open_procfs(0x0, 0x0) ioctl$LOOP_SET_BLOCK_SIZE(0xffffffffffffffff, 0x4c09, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$cgroup_int(0xffffffffffffffff, 0x0, 0x2, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='\x89\x00\x00\x00\x00Ew\x00\x00\x00\xef\xb4\xc8\xd0\xff\xda\xb1vents\xd9\xc5H\xd4\x91\xfdN_]\x16\xe4\xa9C\xd2\x86Qn\xefS\x80\x11J\xfb4\x14\x86 4\x95\x9e\xfc\xc1\a\xcb \x95N\xe9\xa4j\xd2\x1f^\xb0\xb2>\xa3\xc9\xb7$\x11`t\x03: \x8b\xa4\x05\xf2?E\xdb+{t\xb8\xf7\xab\x8b\x100#', 0x26e1, 0x0) ioctl$PERF_EVENT_IOC_PAUSE_OUTPUT(r1, 0x40086602, 0x400007) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000280)='./cgroup/syz0\x00', 0x1ff) openat$smack_thread_current(0xffffffffffffff9c, &(0x7f0000000240)='/proc/thread-self/attr/current\x00', 0x2, 0x0) write$cgroup_subtree(r1, &(0x7f0000000100)=ANY=[], 0xff4a) write$cgroup_subtree(r2, &(0x7f0000000000)=ANY=[], 0x20032600) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a0f, 0x1700) accept$inet(0xffffffffffffffff, &(0x7f0000000040)={0x2, 0x0, @local}, &(0x7f0000000080)=0x10) ioctl$TCSETAF(r0, 0x5408, &(0x7f0000000040)={0x2}) ioctl$EXT4_IOC_GROUP_ADD(r0, 0x40286608, &(0x7f0000000000)={0x3, 0x7000000, 0x400, 0x100000000, 0x0, 0x8}) r3 = fcntl$dupfd(r0, 0x406, r0) ioctl$EVIOCGVERSION(r3, 0x80044501, &(0x7f0000000200)=""/31) write$binfmt_misc(r0, &(0x7f0000000080)={'syz1', "80fa25cdc862d216160cfa92845a3916e38a409a159c03f1889971d3e5144a8d08de78c4b1fbee457437261d7668b1c0f582647ad4134a05358d4309a71a702002329e024cac95642e761bb842bc1056bd6bf12c47697a649a026bd8ee1f685089941469b1ddfeddf32b392f0ff07652a3bce0770bc3bb70862845a65054cecb191e80b825d740fe6b40450359757032425dfdee92aec36ce4b468d50adc745c522cc4af2ac6e7f6a95f0edd70b09caa95fcc7143cf46b74db8bc17fa7c89f"}, 0xc3) 14:03:50 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f00000001c0)=[@acquire], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$FITRIM(r1, 0xc0185879, &(0x7f0000000000)={0x860, 0x4, 0x7}) 14:03:50 executing program 4: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/ptmx\x00', 0x0, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) socket(0x200000000000011, 0x4000000000080002, 0x0) bind$packet(0xffffffffffffffff, 0x0, 0x0) sendmmsg(0xffffffffffffffff, &(0x7f0000007880)=[{{&(0x7f00000001c0)=@l2={0x1f, 0xbf53, {0x9, 0x7, 0xfffffffffffffdd5, 0x1ff, 0x2, 0x4}, 0x0, 0x7}, 0x80, 0x0}}, {{0x0, 0x0, &(0x7f0000007780)}}], 0x2, 0x4048851) setsockopt$packet_int(0xffffffffffffffff, 0x107, 0x0, 0x0, 0x0) syz_open_procfs(0x0, 0x0) ioctl$LOOP_SET_BLOCK_SIZE(0xffffffffffffffff, 0x4c09, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$cgroup_int(0xffffffffffffffff, 0x0, 0x2, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='\x89\x00\x00\x00\x00Ew\x00\x00\x00\xef\xb4\xc8\xd0\xff\xda\xb1vents\xd9\xc5H\xd4\x91\xfdN_]\x16\xe4\xa9C\xd2\x86Qn\xefS\x80\x11J\xfb4\x14\x86 4\x95\x9e\xfc\xc1\a\xcb \x95N\xe9\xa4j\xd2\x1f^\xb0\xb2>\xa3\xc9\xb7$\x11`t\x03: \x8b\xa4\x05\xf2?E\xdb+{t\xb8\xf7\xab\x8b\x100#', 0x26e1, 0x0) ioctl$PERF_EVENT_IOC_PAUSE_OUTPUT(r1, 0x40086602, 0x400007) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000280)='./cgroup/syz0\x00', 0x1ff) openat$smack_thread_current(0xffffffffffffff9c, &(0x7f0000000240)='/proc/thread-self/attr/current\x00', 0x2, 0x0) write$cgroup_subtree(r1, &(0x7f0000000100)=ANY=[], 0xff4a) write$cgroup_subtree(r2, &(0x7f0000000000)=ANY=[], 0x20032600) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a0f, 0x1700) accept$inet(0xffffffffffffffff, &(0x7f0000000040)={0x2, 0x0, @local}, &(0x7f0000000080)=0x10) ioctl$TCSETAF(r0, 0x5408, &(0x7f0000000040)={0x2}) ioctl$EXT4_IOC_GROUP_ADD(r0, 0x40286608, &(0x7f0000000000)={0x3, 0x7000000, 0x400, 0x100000000, 0x0, 0x8}) r3 = fcntl$dupfd(r0, 0x406, r0) ioctl$EVIOCGVERSION(r3, 0x80044501, &(0x7f0000000200)=""/31) write$binfmt_misc(r0, &(0x7f0000000080)={'syz1', "80fa25cdc862d216160cfa92845a3916e38a409a159c03f1889971d3e5144a8d08de78c4b1fbee457437261d7668b1c0f582647ad4134a05358d4309a71a702002329e024cac95642e761bb842bc1056bd6bf12c47697a649a026bd8ee1f685089941469b1ddfeddf32b392f0ff07652a3bce0770bc3bb70862845a65054cecb191e80b825d740fe6b40450359757032425dfdee92aec36ce4b468d50adc745c522cc4af2ac6e7f6a95f0edd70b09caa95fcc7143cf46b74db8bc17fa7c89f"}, 0xc3) 14:03:50 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f00000001c0)=[@acquire], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) 14:03:50 executing program 1: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSPTLCK(r0, 0x40045431, &(0x7f0000000180)) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) socket(0x200000000000011, 0x4000000000080002, 0x0) bind$packet(0xffffffffffffffff, 0x0, 0x0) sendmmsg(0xffffffffffffffff, &(0x7f0000007880)=[{{&(0x7f00000001c0)=@l2={0x1f, 0xbf53, {0x9, 0x7, 0xfffffffffffffdd5, 0x1ff, 0x2, 0x4}, 0x0, 0x7}, 0x80, 0x0}}, {{0x0, 0x0, &(0x7f0000007780)}}], 0x2, 0x4048851) syz_open_procfs(0x0, 0x0) ioctl$LOOP_SET_BLOCK_SIZE(0xffffffffffffffff, 0x4c09, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$cgroup_int(0xffffffffffffffff, 0x0, 0x2, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='\x89\x00\x00\x00\x00Ew\x00\x00\x00\xef\xb4\xc8\xd0\xff\xda\xb1vents\xd9\xc5H\xd4\x91\xfdN_]\x16\xe4\xa9C\xd2\x86Qn\xefS\x80\x11J\xfb4\x14\x86 4\x95\x9e\xfc\xc1\a\xcb \x95N\xe9\xa4j\xd2\x1f^\xb0\xb2>\xa3\xc9\xb7$\x11`t\x03: \x8b\xa4\x05\xf2?E\xdb+{t\xb8\xf7\xab\x8b\x100#', 0x26e1, 0x0) ioctl$PERF_EVENT_IOC_PAUSE_OUTPUT(r1, 0x40086602, 0x400007) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000280)='./cgroup/syz0\x00', 0x1ff) openat$smack_thread_current(0xffffffffffffff9c, &(0x7f0000000240)='/proc/thread-self/attr/current\x00', 0x2, 0x0) write$cgroup_subtree(r1, &(0x7f0000000100)=ANY=[], 0xff4a) write$cgroup_subtree(r2, &(0x7f0000000000)=ANY=[], 0x20032600) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a0f, 0x1700) accept$inet(0xffffffffffffffff, &(0x7f0000000040)={0x2, 0x0, @local}, &(0x7f0000000080)=0x10) ioctl$TCSETAF(r0, 0x5408, &(0x7f0000000040)={0x2}) ioctl$EXT4_IOC_GROUP_ADD(r0, 0x40286608, &(0x7f0000000000)={0x3, 0x7000000, 0x400, 0x100000000, 0x0, 0x8}) r3 = fcntl$dupfd(r0, 0x406, r0) ioctl$EVIOCGVERSION(r3, 0x80044501, &(0x7f0000000200)=""/31) write$binfmt_misc(r0, &(0x7f0000000080)={'syz1', "80fa25cdc862d216160cfa92845a3916e38a409a159c03f1889971d3e5144a8d08de78c4b1fbee457437261d7668b1c0f582647ad4134a05358d4309a71a702002329e024cac95642e761bb842bc1056bd6bf12c47697a649a026bd8ee1f685089941469b1ddfeddf32b392f0ff07652a3bce0770bc3bb70862845a65054cecb191e80b825d740fe6b40450359757032425dfdee92aec36ce4b468d50adc745c522cc4af2ac6e7f6a95f0edd70b09caa95fcc7143cf46b74db8bc17fa7c89f"}, 0xc3) [ 336.674239] binder: 10398:10399 ioctl c0185879 20000000 returned -22 14:03:50 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0xfffffffffffffd95, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="7a5442b0dd4e9a53cfd1603bb05d1601adfa28a2be18ceaf8645c1bb8023025004a5f6ce095bf1157aed7143295243ae170c02f6be4d989adfc1511198bf80af2d06553fea27878f7a7e7f618c26fe6aa8086a7998a3307eb8378df6d7290b1035c6bc338fadb84a47823b81cc64852c35763065aa29564c330b89a7a6f564e6d55e78dea74c19"], 0x0, 0x0, 0x0}) 14:03:50 executing program 0: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSPTLCK(r0, 0x40045431, &(0x7f0000000180)) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) socket(0x200000000000011, 0x4000000000080002, 0x0) bind$packet(0xffffffffffffffff, 0x0, 0x0) sendmmsg(0xffffffffffffffff, &(0x7f0000007880)=[{{&(0x7f00000001c0)=@l2={0x1f, 0xbf53, {0x9, 0x7, 0xfffffffffffffdd5, 0x1ff, 0x2, 0x4}, 0x0, 0x7}, 0x80, 0x0}}, {{0x0, 0x0, &(0x7f0000007780)}}], 0x2, 0x4048851) setsockopt$packet_int(0xffffffffffffffff, 0x107, 0x0, 0x0, 0x0) ioctl$LOOP_SET_BLOCK_SIZE(0xffffffffffffffff, 0x4c09, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$cgroup_int(0xffffffffffffffff, 0x0, 0x2, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='\x89\x00\x00\x00\x00Ew\x00\x00\x00\xef\xb4\xc8\xd0\xff\xda\xb1vents\xd9\xc5H\xd4\x91\xfdN_]\x16\xe4\xa9C\xd2\x86Qn\xefS\x80\x11J\xfb4\x14\x86 4\x95\x9e\xfc\xc1\a\xcb \x95N\xe9\xa4j\xd2\x1f^\xb0\xb2>\xa3\xc9\xb7$\x11`t\x03: \x8b\xa4\x05\xf2?E\xdb+{t\xb8\xf7\xab\x8b\x100#', 0x26e1, 0x0) ioctl$PERF_EVENT_IOC_PAUSE_OUTPUT(r1, 0x40086602, 0x400007) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000280)='./cgroup/syz0\x00', 0x1ff) openat$smack_thread_current(0xffffffffffffff9c, &(0x7f0000000240)='/proc/thread-self/attr/current\x00', 0x2, 0x0) write$cgroup_subtree(r1, &(0x7f0000000100)=ANY=[], 0xff4a) write$cgroup_subtree(r2, &(0x7f0000000000)=ANY=[], 0x20032600) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a0f, 0x1700) accept$inet(0xffffffffffffffff, &(0x7f0000000040)={0x2, 0x0, @local}, &(0x7f0000000080)=0x10) ioctl$TCSETAF(r0, 0x5408, &(0x7f0000000040)={0x2}) ioctl$EXT4_IOC_GROUP_ADD(r0, 0x40286608, &(0x7f0000000000)={0x3, 0x7000000, 0x400, 0x100000000, 0x0, 0x8}) r3 = fcntl$dupfd(r0, 0x406, r0) ioctl$EVIOCGVERSION(r3, 0x80044501, &(0x7f0000000200)=""/31) write$binfmt_misc(r0, &(0x7f0000000080)={'syz1', "80fa25cdc862d216160cfa92845a3916e38a409a159c03f1889971d3e5144a8d08de78c4b1fbee457437261d7668b1c0f582647ad4134a05358d4309a71a702002329e024cac95642e761bb842bc1056bd6bf12c47697a649a026bd8ee1f685089941469b1ddfeddf32b392f0ff07652a3bce0770bc3bb70862845a65054cecb191e80b825d740fe6b40450359757032425dfdee92aec36ce4b468d50adc745c522cc4af2ac6e7f6a95f0edd70b09caa95fcc7143cf46b74db8bc17fa7c89f"}, 0xc3) 14:03:50 executing program 5: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSPTLCK(r0, 0x40045431, &(0x7f0000000180)) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) socket(0x200000000000011, 0x4000000000080002, 0x0) bind$packet(0xffffffffffffffff, 0x0, 0x0) sendmmsg(0xffffffffffffffff, &(0x7f0000007880)=[{{&(0x7f00000001c0)=@l2={0x1f, 0xbf53, {0x9, 0x7, 0xfffffffffffffdd5, 0x1ff, 0x2, 0x4}, 0x0, 0x7}, 0x80, 0x0}}, {{0x0, 0x0, &(0x7f0000007780)}}], 0x2, 0x4048851) syz_open_procfs(0x0, 0x0) ioctl$LOOP_SET_BLOCK_SIZE(0xffffffffffffffff, 0x4c09, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$cgroup_int(0xffffffffffffffff, 0x0, 0x2, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='\x89\x00\x00\x00\x00Ew\x00\x00\x00\xef\xb4\xc8\xd0\xff\xda\xb1vents\xd9\xc5H\xd4\x91\xfdN_]\x16\xe4\xa9C\xd2\x86Qn\xefS\x80\x11J\xfb4\x14\x86 4\x95\x9e\xfc\xc1\a\xcb \x95N\xe9\xa4j\xd2\x1f^\xb0\xb2>\xa3\xc9\xb7$\x11`t\x03: \x8b\xa4\x05\xf2?E\xdb+{t\xb8\xf7\xab\x8b\x100#', 0x26e1, 0x0) ioctl$PERF_EVENT_IOC_PAUSE_OUTPUT(r1, 0x40086602, 0x400007) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000280)='./cgroup/syz0\x00', 0x1ff) openat$smack_thread_current(0xffffffffffffff9c, &(0x7f0000000240)='/proc/thread-self/attr/current\x00', 0x2, 0x0) write$cgroup_subtree(r1, &(0x7f0000000100)=ANY=[], 0xff4a) write$cgroup_subtree(r2, &(0x7f0000000000)=ANY=[], 0x20032600) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a0f, 0x1700) accept$inet(0xffffffffffffffff, &(0x7f0000000040)={0x2, 0x0, @local}, &(0x7f0000000080)=0x10) ioctl$TCSETAF(r0, 0x5408, &(0x7f0000000040)={0x2}) ioctl$EXT4_IOC_GROUP_ADD(r0, 0x40286608, &(0x7f0000000000)={0x3, 0x7000000, 0x400, 0x100000000, 0x0, 0x8}) r3 = fcntl$dupfd(r0, 0x406, r0) ioctl$EVIOCGVERSION(r3, 0x80044501, &(0x7f0000000200)=""/31) write$binfmt_misc(r0, &(0x7f0000000080)={'syz1', "80fa25cdc862d216160cfa92845a3916e38a409a159c03f1889971d3e5144a8d08de78c4b1fbee457437261d7668b1c0f582647ad4134a05358d4309a71a702002329e024cac95642e761bb842bc1056bd6bf12c47697a649a026bd8ee1f685089941469b1ddfeddf32b392f0ff07652a3bce0770bc3bb70862845a65054cecb191e80b825d740fe6b40450359757032425dfdee92aec36ce4b468d50adc745c522cc4af2ac6e7f6a95f0edd70b09caa95fcc7143cf46b74db8bc17fa7c89f"}, 0xc3) 14:03:50 executing program 2: ioctl$TIOCSPTLCK(0xffffffffffffffff, 0x40045431, &(0x7f0000000180)) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) socket(0x200000000000011, 0x4000000000080002, 0x0) bind$packet(0xffffffffffffffff, 0x0, 0x0) sendmmsg(0xffffffffffffffff, &(0x7f0000007880)=[{{&(0x7f00000001c0)=@l2={0x1f, 0xbf53, {0x9, 0x7, 0xfffffffffffffdd5, 0x1ff, 0x2, 0x4}, 0x0, 0x7}, 0x80, 0x0}}, {{0x0, 0x0, &(0x7f0000007780)}}], 0x2, 0x4048851) setsockopt$packet_int(0xffffffffffffffff, 0x107, 0x0, 0x0, 0x0) syz_open_procfs(0x0, 0x0) ioctl$LOOP_SET_BLOCK_SIZE(0xffffffffffffffff, 0x4c09, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$cgroup_int(0xffffffffffffffff, 0x0, 0x2, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='\x89\x00\x00\x00\x00Ew\x00\x00\x00\xef\xb4\xc8\xd0\xff\xda\xb1vents\xd9\xc5H\xd4\x91\xfdN_]\x16\xe4\xa9C\xd2\x86Qn\xefS\x80\x11J\xfb4\x14\x86 4\x95\x9e\xfc\xc1\a\xcb \x95N\xe9\xa4j\xd2\x1f^\xb0\xb2>\xa3\xc9\xb7$\x11`t\x03: \x8b\xa4\x05\xf2?E\xdb+{t\xb8\xf7\xab\x8b\x100#', 0x26e1, 0x0) ioctl$PERF_EVENT_IOC_PAUSE_OUTPUT(r0, 0x40086602, 0x400007) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000280)='./cgroup/syz0\x00', 0x1ff) openat$smack_thread_current(0xffffffffffffff9c, &(0x7f0000000240)='/proc/thread-self/attr/current\x00', 0x2, 0x0) write$cgroup_subtree(r0, &(0x7f0000000100)=ANY=[], 0xff4a) write$cgroup_subtree(r1, &(0x7f0000000000)=ANY=[], 0x20032600) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a0f, 0x1700) accept$inet(0xffffffffffffffff, &(0x7f0000000040)={0x2, 0x0, @local}, &(0x7f0000000080)=0x10) ioctl$TCSETAF(0xffffffffffffffff, 0x5408, &(0x7f0000000040)={0x2}) ioctl$EXT4_IOC_GROUP_ADD(0xffffffffffffffff, 0x40286608, &(0x7f0000000000)={0x3, 0x7000000, 0x400, 0x100000000, 0x0, 0x8}) r2 = fcntl$dupfd(0xffffffffffffffff, 0x406, 0xffffffffffffffff) ioctl$EVIOCGVERSION(r2, 0x80044501, &(0x7f0000000200)=""/31) write$binfmt_misc(0xffffffffffffffff, &(0x7f0000000080)={'syz1', "80fa25cdc862d216160cfa92845a3916e38a409a159c03f1889971d3e5144a8d08de78c4b1fbee457437261d7668b1c0f582647ad4134a05358d4309a71a702002329e024cac95642e761bb842bc1056bd6bf12c47697a649a026bd8ee1f685089941469b1ddfeddf32b392f0ff07652a3bce0770bc3bb70862845a65054cecb191e80b825d740fe6b40450359757032425dfdee92aec36ce4b468d50adc745c522cc4af2ac6e7f6a95f0edd70b09caa95fcc7143cf46b74db8bc17fa7c89f"}, 0xc3) 14:03:50 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f00000001c0)=[@acquire], 0x0, 0x0, 0x0}) r2 = socket$nl_xfrm(0x10, 0x3, 0x6) setsockopt$netlink_NETLINK_PKTINFO(r2, 0x10e, 0x3, &(0x7f0000000000), 0x4) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) 14:03:50 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f00000001c0)=[@acquire], 0x0, 0x0, 0x0}) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) getpeername(r2, &(0x7f0000000040)=@rc, &(0x7f00000000c0)=0x80) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) 14:03:50 executing program 4: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSPTLCK(r0, 0x40045431, &(0x7f0000000180)) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) socket(0x200000000000011, 0x4000000000080002, 0x0) bind$packet(0xffffffffffffffff, 0x0, 0x0) sendmmsg(0xffffffffffffffff, &(0x7f0000007880)=[{{&(0x7f00000001c0)=@l2={0x1f, 0xbf53, {0x9, 0x7, 0xfffffffffffffdd5, 0x1ff, 0x2, 0x4}, 0x0, 0x7}, 0x80, 0x0}}, {{0x0, 0x0, &(0x7f0000007780)}}], 0x2, 0x4048851) setsockopt$packet_int(0xffffffffffffffff, 0x107, 0x0, 0x0, 0x0) ioctl$LOOP_SET_BLOCK_SIZE(0xffffffffffffffff, 0x4c09, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$cgroup_int(0xffffffffffffffff, 0x0, 0x2, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='\x89\x00\x00\x00\x00Ew\x00\x00\x00\xef\xb4\xc8\xd0\xff\xda\xb1vents\xd9\xc5H\xd4\x91\xfdN_]\x16\xe4\xa9C\xd2\x86Qn\xefS\x80\x11J\xfb4\x14\x86 4\x95\x9e\xfc\xc1\a\xcb \x95N\xe9\xa4j\xd2\x1f^\xb0\xb2>\xa3\xc9\xb7$\x11`t\x03: \x8b\xa4\x05\xf2?E\xdb+{t\xb8\xf7\xab\x8b\x100#', 0x26e1, 0x0) ioctl$PERF_EVENT_IOC_PAUSE_OUTPUT(r1, 0x40086602, 0x400007) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000280)='./cgroup/syz0\x00', 0x1ff) openat$smack_thread_current(0xffffffffffffff9c, &(0x7f0000000240)='/proc/thread-self/attr/current\x00', 0x2, 0x0) write$cgroup_subtree(r1, &(0x7f0000000100)=ANY=[], 0xff4a) write$cgroup_subtree(r2, &(0x7f0000000000)=ANY=[], 0x20032600) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a0f, 0x1700) accept$inet(0xffffffffffffffff, &(0x7f0000000040)={0x2, 0x0, @local}, &(0x7f0000000080)=0x10) ioctl$TCSETAF(r0, 0x5408, &(0x7f0000000040)={0x2}) ioctl$EXT4_IOC_GROUP_ADD(r0, 0x40286608, &(0x7f0000000000)={0x3, 0x7000000, 0x400, 0x100000000, 0x0, 0x8}) r3 = fcntl$dupfd(r0, 0x406, r0) ioctl$EVIOCGVERSION(r3, 0x80044501, &(0x7f0000000200)=""/31) write$binfmt_misc(r0, &(0x7f0000000080)={'syz1', "80fa25cdc862d216160cfa92845a3916e38a409a159c03f1889971d3e5144a8d08de78c4b1fbee457437261d7668b1c0f582647ad4134a05358d4309a71a702002329e024cac95642e761bb842bc1056bd6bf12c47697a649a026bd8ee1f685089941469b1ddfeddf32b392f0ff07652a3bce0770bc3bb70862845a65054cecb191e80b825d740fe6b40450359757032425dfdee92aec36ce4b468d50adc745c522cc4af2ac6e7f6a95f0edd70b09caa95fcc7143cf46b74db8bc17fa7c89f"}, 0xc3) 14:03:50 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) fallocate(r0, 0x23, 0x4e7c80ee, 0x1) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f00000001c0)=[@acquire], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) 14:03:50 executing program 1: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSPTLCK(r0, 0x40045431, &(0x7f0000000180)) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) socket(0x200000000000011, 0x4000000000080002, 0x0) bind$packet(0xffffffffffffffff, 0x0, 0x0) sendmmsg(0xffffffffffffffff, &(0x7f0000007880)=[{{&(0x7f00000001c0)=@l2={0x1f, 0xbf53, {0x9, 0x7, 0xfffffffffffffdd5, 0x1ff, 0x2, 0x4}, 0x0, 0x7}, 0x80, 0x0}}, {{0x0, 0x0, &(0x7f0000007780)}}], 0x2, 0x4048851) syz_open_procfs(0x0, 0x0) ioctl$LOOP_SET_BLOCK_SIZE(0xffffffffffffffff, 0x4c09, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$cgroup_int(0xffffffffffffffff, 0x0, 0x2, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='\x89\x00\x00\x00\x00Ew\x00\x00\x00\xef\xb4\xc8\xd0\xff\xda\xb1vents\xd9\xc5H\xd4\x91\xfdN_]\x16\xe4\xa9C\xd2\x86Qn\xefS\x80\x11J\xfb4\x14\x86 4\x95\x9e\xfc\xc1\a\xcb \x95N\xe9\xa4j\xd2\x1f^\xb0\xb2>\xa3\xc9\xb7$\x11`t\x03: \x8b\xa4\x05\xf2?E\xdb+{t\xb8\xf7\xab\x8b\x100#', 0x26e1, 0x0) ioctl$PERF_EVENT_IOC_PAUSE_OUTPUT(r1, 0x40086602, 0x400007) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000280)='./cgroup/syz0\x00', 0x1ff) openat$smack_thread_current(0xffffffffffffff9c, &(0x7f0000000240)='/proc/thread-self/attr/current\x00', 0x2, 0x0) write$cgroup_subtree(r1, &(0x7f0000000100)=ANY=[], 0xff4a) write$cgroup_subtree(r2, &(0x7f0000000000)=ANY=[], 0x20032600) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a0f, 0x1700) accept$inet(0xffffffffffffffff, &(0x7f0000000040)={0x2, 0x0, @local}, &(0x7f0000000080)=0x10) ioctl$TCSETAF(r0, 0x5408, &(0x7f0000000040)={0x2}) ioctl$EXT4_IOC_GROUP_ADD(r0, 0x40286608, &(0x7f0000000000)={0x3, 0x7000000, 0x400, 0x100000000, 0x0, 0x8}) r3 = fcntl$dupfd(r0, 0x406, r0) ioctl$EVIOCGVERSION(r3, 0x80044501, &(0x7f0000000200)=""/31) 14:03:50 executing program 3: r0 = openat$apparmor_task_current(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/attr/current\x00', 0x2, 0x0) ioctl$EXT4_IOC_PRECACHE_EXTENTS(r0, 0x6612) r1 = dup2(r0, r0) ioctl$TIOCMBIS(r1, 0x5416, &(0x7f00000000c0)=0x5) r2 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) r3 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$FIBMAP(r0, 0x1, &(0x7f0000000100)) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f00000001c0)=[@acquire], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=ANY=[@ANYBLOB="0e630c4000000008"], 0x0, 0x0, 0x0}) pipe2(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}, 0x4000) write$P9_RLOCK(r4, &(0x7f0000000080)={0x8, 0x35, 0x2, 0x1}, 0x8) 14:03:50 executing program 2: ioctl$TIOCSPTLCK(0xffffffffffffffff, 0x40045431, &(0x7f0000000180)) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) socket(0x200000000000011, 0x4000000000080002, 0x0) bind$packet(0xffffffffffffffff, 0x0, 0x0) sendmmsg(0xffffffffffffffff, &(0x7f0000007880)=[{{&(0x7f00000001c0)=@l2={0x1f, 0xbf53, {0x9, 0x7, 0xfffffffffffffdd5, 0x1ff, 0x2, 0x4}, 0x0, 0x7}, 0x80, 0x0}}, {{0x0, 0x0, &(0x7f0000007780)}}], 0x2, 0x4048851) setsockopt$packet_int(0xffffffffffffffff, 0x107, 0x0, 0x0, 0x0) syz_open_procfs(0x0, 0x0) ioctl$LOOP_SET_BLOCK_SIZE(0xffffffffffffffff, 0x4c09, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$cgroup_int(0xffffffffffffffff, 0x0, 0x2, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='\x89\x00\x00\x00\x00Ew\x00\x00\x00\xef\xb4\xc8\xd0\xff\xda\xb1vents\xd9\xc5H\xd4\x91\xfdN_]\x16\xe4\xa9C\xd2\x86Qn\xefS\x80\x11J\xfb4\x14\x86 4\x95\x9e\xfc\xc1\a\xcb \x95N\xe9\xa4j\xd2\x1f^\xb0\xb2>\xa3\xc9\xb7$\x11`t\x03: \x8b\xa4\x05\xf2?E\xdb+{t\xb8\xf7\xab\x8b\x100#', 0x26e1, 0x0) ioctl$PERF_EVENT_IOC_PAUSE_OUTPUT(r0, 0x40086602, 0x400007) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000280)='./cgroup/syz0\x00', 0x1ff) openat$smack_thread_current(0xffffffffffffff9c, &(0x7f0000000240)='/proc/thread-self/attr/current\x00', 0x2, 0x0) write$cgroup_subtree(r0, &(0x7f0000000100)=ANY=[], 0xff4a) write$cgroup_subtree(r1, &(0x7f0000000000)=ANY=[], 0x20032600) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a0f, 0x1700) accept$inet(0xffffffffffffffff, &(0x7f0000000040)={0x2, 0x0, @local}, &(0x7f0000000080)=0x10) ioctl$TCSETAF(0xffffffffffffffff, 0x5408, &(0x7f0000000040)={0x2}) ioctl$EXT4_IOC_GROUP_ADD(0xffffffffffffffff, 0x40286608, &(0x7f0000000000)={0x3, 0x7000000, 0x400, 0x100000000, 0x0, 0x8}) r2 = fcntl$dupfd(0xffffffffffffffff, 0x406, 0xffffffffffffffff) ioctl$EVIOCGVERSION(r2, 0x80044501, &(0x7f0000000200)=""/31) write$binfmt_misc(0xffffffffffffffff, &(0x7f0000000080)={'syz1', "80fa25cdc862d216160cfa92845a3916e38a409a159c03f1889971d3e5144a8d08de78c4b1fbee457437261d7668b1c0f582647ad4134a05358d4309a71a702002329e024cac95642e761bb842bc1056bd6bf12c47697a649a026bd8ee1f685089941469b1ddfeddf32b392f0ff07652a3bce0770bc3bb70862845a65054cecb191e80b825d740fe6b40450359757032425dfdee92aec36ce4b468d50adc745c522cc4af2ac6e7f6a95f0edd70b09caa95fcc7143cf46b74db8bc17fa7c89f"}, 0xc3) 14:03:50 executing program 5: ioctl$TIOCSPTLCK(0xffffffffffffffff, 0x40045431, &(0x7f0000000180)) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) socket(0x200000000000011, 0x4000000000080002, 0x0) bind$packet(0xffffffffffffffff, 0x0, 0x0) sendmmsg(0xffffffffffffffff, &(0x7f0000007880)=[{{&(0x7f00000001c0)=@l2={0x1f, 0xbf53, {0x9, 0x7, 0xfffffffffffffdd5, 0x1ff, 0x2, 0x4}, 0x0, 0x7}, 0x80, 0x0}}, {{0x0, 0x0, &(0x7f0000007780)}}], 0x2, 0x4048851) setsockopt$packet_int(0xffffffffffffffff, 0x107, 0x0, 0x0, 0x0) syz_open_procfs(0x0, 0x0) ioctl$LOOP_SET_BLOCK_SIZE(0xffffffffffffffff, 0x4c09, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$cgroup_int(0xffffffffffffffff, 0x0, 0x2, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='\x89\x00\x00\x00\x00Ew\x00\x00\x00\xef\xb4\xc8\xd0\xff\xda\xb1vents\xd9\xc5H\xd4\x91\xfdN_]\x16\xe4\xa9C\xd2\x86Qn\xefS\x80\x11J\xfb4\x14\x86 4\x95\x9e\xfc\xc1\a\xcb \x95N\xe9\xa4j\xd2\x1f^\xb0\xb2>\xa3\xc9\xb7$\x11`t\x03: \x8b\xa4\x05\xf2?E\xdb+{t\xb8\xf7\xab\x8b\x100#', 0x26e1, 0x0) ioctl$PERF_EVENT_IOC_PAUSE_OUTPUT(r0, 0x40086602, 0x400007) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000280)='./cgroup/syz0\x00', 0x1ff) openat$smack_thread_current(0xffffffffffffff9c, &(0x7f0000000240)='/proc/thread-self/attr/current\x00', 0x2, 0x0) write$cgroup_subtree(r0, &(0x7f0000000100)=ANY=[], 0xff4a) write$cgroup_subtree(r1, &(0x7f0000000000)=ANY=[], 0x20032600) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a0f, 0x1700) accept$inet(0xffffffffffffffff, &(0x7f0000000040)={0x2, 0x0, @local}, &(0x7f0000000080)=0x10) ioctl$TCSETAF(0xffffffffffffffff, 0x5408, &(0x7f0000000040)={0x2}) ioctl$EXT4_IOC_GROUP_ADD(0xffffffffffffffff, 0x40286608, &(0x7f0000000000)={0x3, 0x7000000, 0x400, 0x100000000, 0x0, 0x8}) r2 = fcntl$dupfd(0xffffffffffffffff, 0x406, 0xffffffffffffffff) ioctl$EVIOCGVERSION(r2, 0x80044501, &(0x7f0000000200)=""/31) write$binfmt_misc(0xffffffffffffffff, &(0x7f0000000080)={'syz1', "80fa25cdc862d216160cfa92845a3916e38a409a159c03f1889971d3e5144a8d08de78c4b1fbee457437261d7668b1c0f582647ad4134a05358d4309a71a702002329e024cac95642e761bb842bc1056bd6bf12c47697a649a026bd8ee1f685089941469b1ddfeddf32b392f0ff07652a3bce0770bc3bb70862845a65054cecb191e80b825d740fe6b40450359757032425dfdee92aec36ce4b468d50adc745c522cc4af2ac6e7f6a95f0edd70b09caa95fcc7143cf46b74db8bc17fa7c89f"}, 0xc3) 14:03:50 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x0, &(0x7f0000000040)="0adc1f123c123f319bd070") openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x4080, 0x0) 14:03:50 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f00000001c0)=[@acquire], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) 14:03:50 executing program 0: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSPTLCK(r0, 0x40045431, &(0x7f0000000180)) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) socket(0x200000000000011, 0x4000000000080002, 0x0) bind$packet(0xffffffffffffffff, 0x0, 0x0) sendmmsg(0xffffffffffffffff, &(0x7f0000007880)=[{{&(0x7f00000001c0)=@l2={0x1f, 0xbf53, {0x9, 0x7, 0xfffffffffffffdd5, 0x1ff, 0x2, 0x4}, 0x0, 0x7}, 0x80, 0x0}}, {{0x0, 0x0, &(0x7f0000007780)}}], 0x2, 0x4048851) setsockopt$packet_int(0xffffffffffffffff, 0x107, 0x0, 0x0, 0x0) ioctl$LOOP_SET_BLOCK_SIZE(0xffffffffffffffff, 0x4c09, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$cgroup_int(0xffffffffffffffff, 0x0, 0x2, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='\x89\x00\x00\x00\x00Ew\x00\x00\x00\xef\xb4\xc8\xd0\xff\xda\xb1vents\xd9\xc5H\xd4\x91\xfdN_]\x16\xe4\xa9C\xd2\x86Qn\xefS\x80\x11J\xfb4\x14\x86 4\x95\x9e\xfc\xc1\a\xcb \x95N\xe9\xa4j\xd2\x1f^\xb0\xb2>\xa3\xc9\xb7$\x11`t\x03: \x8b\xa4\x05\xf2?E\xdb+{t\xb8\xf7\xab\x8b\x100#', 0x26e1, 0x0) ioctl$PERF_EVENT_IOC_PAUSE_OUTPUT(r1, 0x40086602, 0x400007) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000280)='./cgroup/syz0\x00', 0x1ff) openat$smack_thread_current(0xffffffffffffff9c, &(0x7f0000000240)='/proc/thread-self/attr/current\x00', 0x2, 0x0) write$cgroup_subtree(r1, &(0x7f0000000100)=ANY=[], 0xff4a) write$cgroup_subtree(r2, &(0x7f0000000000)=ANY=[], 0x20032600) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a0f, 0x1700) accept$inet(0xffffffffffffffff, &(0x7f0000000040)={0x2, 0x0, @local}, &(0x7f0000000080)=0x10) ioctl$TCSETAF(r0, 0x5408, &(0x7f0000000040)={0x2}) ioctl$EXT4_IOC_GROUP_ADD(r0, 0x40286608, &(0x7f0000000000)={0x3, 0x7000000, 0x400, 0x100000000, 0x0, 0x8}) r3 = fcntl$dupfd(r0, 0x406, r0) ioctl$EVIOCGVERSION(r3, 0x80044501, &(0x7f0000000200)=""/31) write$binfmt_misc(r0, &(0x7f0000000080)={'syz1', "80fa25cdc862d216160cfa92845a3916e38a409a159c03f1889971d3e5144a8d08de78c4b1fbee457437261d7668b1c0f582647ad4134a05358d4309a71a702002329e024cac95642e761bb842bc1056bd6bf12c47697a649a026bd8ee1f685089941469b1ddfeddf32b392f0ff07652a3bce0770bc3bb70862845a65054cecb191e80b825d740fe6b40450359757032425dfdee92aec36ce4b468d50adc745c522cc4af2ac6e7f6a95f0edd70b09caa95fcc7143cf46b74db8bc17fa7c89f"}, 0xc3) [ 337.005279] binder: 10445:10446 BC_REQUEST_DEATH_NOTIFICATION invalid ref 134217728 14:03:50 executing program 4: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSPTLCK(r0, 0x40045431, &(0x7f0000000180)) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) socket(0x200000000000011, 0x4000000000080002, 0x0) bind$packet(0xffffffffffffffff, 0x0, 0x0) sendmmsg(0xffffffffffffffff, &(0x7f0000007880)=[{{&(0x7f00000001c0)=@l2={0x1f, 0xbf53, {0x9, 0x7, 0xfffffffffffffdd5, 0x1ff, 0x2, 0x4}, 0x0, 0x7}, 0x80, 0x0}}, {{0x0, 0x0, &(0x7f0000007780)}}], 0x2, 0x4048851) setsockopt$packet_int(0xffffffffffffffff, 0x107, 0x0, 0x0, 0x0) ioctl$LOOP_SET_BLOCK_SIZE(0xffffffffffffffff, 0x4c09, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$cgroup_int(0xffffffffffffffff, 0x0, 0x2, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='\x89\x00\x00\x00\x00Ew\x00\x00\x00\xef\xb4\xc8\xd0\xff\xda\xb1vents\xd9\xc5H\xd4\x91\xfdN_]\x16\xe4\xa9C\xd2\x86Qn\xefS\x80\x11J\xfb4\x14\x86 4\x95\x9e\xfc\xc1\a\xcb \x95N\xe9\xa4j\xd2\x1f^\xb0\xb2>\xa3\xc9\xb7$\x11`t\x03: \x8b\xa4\x05\xf2?E\xdb+{t\xb8\xf7\xab\x8b\x100#', 0x26e1, 0x0) ioctl$PERF_EVENT_IOC_PAUSE_OUTPUT(r1, 0x40086602, 0x400007) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000280)='./cgroup/syz0\x00', 0x1ff) openat$smack_thread_current(0xffffffffffffff9c, &(0x7f0000000240)='/proc/thread-self/attr/current\x00', 0x2, 0x0) write$cgroup_subtree(r1, &(0x7f0000000100)=ANY=[], 0xff4a) write$cgroup_subtree(r2, &(0x7f0000000000)=ANY=[], 0x20032600) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a0f, 0x1700) accept$inet(0xffffffffffffffff, &(0x7f0000000040)={0x2, 0x0, @local}, &(0x7f0000000080)=0x10) ioctl$TCSETAF(r0, 0x5408, &(0x7f0000000040)={0x2}) ioctl$EXT4_IOC_GROUP_ADD(r0, 0x40286608, &(0x7f0000000000)={0x3, 0x7000000, 0x400, 0x100000000, 0x0, 0x8}) r3 = fcntl$dupfd(r0, 0x406, r0) ioctl$EVIOCGVERSION(r3, 0x80044501, &(0x7f0000000200)=""/31) write$binfmt_misc(r0, &(0x7f0000000080)={'syz1', "80fa25cdc862d216160cfa92845a3916e38a409a159c03f1889971d3e5144a8d08de78c4b1fbee457437261d7668b1c0f582647ad4134a05358d4309a71a702002329e024cac95642e761bb842bc1056bd6bf12c47697a649a026bd8ee1f685089941469b1ddfeddf32b392f0ff07652a3bce0770bc3bb70862845a65054cecb191e80b825d740fe6b40450359757032425dfdee92aec36ce4b468d50adc745c522cc4af2ac6e7f6a95f0edd70b09caa95fcc7143cf46b74db8bc17fa7c89f"}, 0xc3) 14:03:50 executing program 1: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSPTLCK(r0, 0x40045431, &(0x7f0000000180)) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) socket(0x200000000000011, 0x4000000000080002, 0x0) bind$packet(0xffffffffffffffff, 0x0, 0x0) sendmmsg(0xffffffffffffffff, &(0x7f0000007880)=[{{&(0x7f00000001c0)=@l2={0x1f, 0xbf53, {0x9, 0x7, 0xfffffffffffffdd5, 0x1ff, 0x2, 0x4}, 0x0, 0x7}, 0x80, 0x0}}, {{0x0, 0x0, &(0x7f0000007780)}}], 0x2, 0x4048851) syz_open_procfs(0x0, 0x0) ioctl$LOOP_SET_BLOCK_SIZE(0xffffffffffffffff, 0x4c09, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$cgroup_int(0xffffffffffffffff, 0x0, 0x2, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='\x89\x00\x00\x00\x00Ew\x00\x00\x00\xef\xb4\xc8\xd0\xff\xda\xb1vents\xd9\xc5H\xd4\x91\xfdN_]\x16\xe4\xa9C\xd2\x86Qn\xefS\x80\x11J\xfb4\x14\x86 4\x95\x9e\xfc\xc1\a\xcb \x95N\xe9\xa4j\xd2\x1f^\xb0\xb2>\xa3\xc9\xb7$\x11`t\x03: \x8b\xa4\x05\xf2?E\xdb+{t\xb8\xf7\xab\x8b\x100#', 0x26e1, 0x0) ioctl$PERF_EVENT_IOC_PAUSE_OUTPUT(r1, 0x40086602, 0x400007) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000280)='./cgroup/syz0\x00', 0x1ff) openat$smack_thread_current(0xffffffffffffff9c, &(0x7f0000000240)='/proc/thread-self/attr/current\x00', 0x2, 0x0) write$cgroup_subtree(r1, &(0x7f0000000100)=ANY=[], 0xff4a) write$cgroup_subtree(r2, &(0x7f0000000000)=ANY=[], 0x20032600) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a0f, 0x1700) accept$inet(0xffffffffffffffff, &(0x7f0000000040)={0x2, 0x0, @local}, &(0x7f0000000080)=0x10) ioctl$TCSETAF(r0, 0x5408, &(0x7f0000000040)={0x2}) ioctl$EXT4_IOC_GROUP_ADD(r0, 0x40286608, &(0x7f0000000000)={0x3, 0x7000000, 0x400, 0x100000000, 0x0, 0x8}) fcntl$dupfd(r0, 0x406, r0) 14:03:50 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0x0, 0x2) openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000040)='/dev/loop-control\x00', 0x10000, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="05630440000000007312c5cb3307ea332607e2edcc3040cb6155ac85e3a9b9fd624d5915476e861dd132ef880a8deb66"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=ANY=[@ANYBLOB="1b630c4000000000"], 0x0, 0x0, 0x0}) r2 = socket$inet(0x2, 0x0, 0x6) setsockopt$inet_tcp_TCP_CONGESTION(r2, 0x6, 0xd, &(0x7f0000000000)='cdg\x00', 0x4) r3 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000080)='pids.current\x00', 0x0, 0x0) write$ppp(r3, &(0x7f00000000c0)="380dc606c8076792b0e87fee97ec1cd290b867fb2a34c5aaf71a8c5e0704ac8086a315658bdb01be9d29ea4cbf576f17d62f1f063d37bdf07ddbf4d0e64c2d39", 0x40) [ 337.160290] binder: 10471:10473 unknown command 1074553627 [ 337.173265] binder: 10471:10473 ioctl c0306201 20008fd0 returned -22 14:03:50 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$TIOCSPTLCK(r0, 0x40045431, &(0x7f0000000180)) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) socket(0x200000000000011, 0x4000000000080002, 0x0) bind$packet(0xffffffffffffffff, 0x0, 0x0) sendmmsg(0xffffffffffffffff, &(0x7f0000007880)=[{{&(0x7f00000001c0)=@l2={0x1f, 0xbf53, {0x9, 0x7, 0xfffffffffffffdd5, 0x1ff, 0x2, 0x4}, 0x0, 0x7}, 0x80, 0x0}}, {{0x0, 0x0, &(0x7f0000007780)}}], 0x2, 0x4048851) setsockopt$packet_int(0xffffffffffffffff, 0x107, 0x0, 0x0, 0x0) syz_open_procfs(0x0, 0x0) ioctl$LOOP_SET_BLOCK_SIZE(0xffffffffffffffff, 0x4c09, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$cgroup_int(0xffffffffffffffff, 0x0, 0x2, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='\x89\x00\x00\x00\x00Ew\x00\x00\x00\xef\xb4\xc8\xd0\xff\xda\xb1vents\xd9\xc5H\xd4\x91\xfdN_]\x16\xe4\xa9C\xd2\x86Qn\xefS\x80\x11J\xfb4\x14\x86 4\x95\x9e\xfc\xc1\a\xcb \x95N\xe9\xa4j\xd2\x1f^\xb0\xb2>\xa3\xc9\xb7$\x11`t\x03: \x8b\xa4\x05\xf2?E\xdb+{t\xb8\xf7\xab\x8b\x100#', 0x26e1, 0x0) ioctl$PERF_EVENT_IOC_PAUSE_OUTPUT(r1, 0x40086602, 0x400007) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000280)='./cgroup/syz0\x00', 0x1ff) openat$smack_thread_current(0xffffffffffffff9c, &(0x7f0000000240)='/proc/thread-self/attr/current\x00', 0x2, 0x0) write$cgroup_subtree(r1, &(0x7f0000000100)=ANY=[], 0xff4a) write$cgroup_subtree(r2, &(0x7f0000000000)=ANY=[], 0x20032600) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a0f, 0x1700) accept$inet(0xffffffffffffffff, &(0x7f0000000040)={0x2, 0x0, @local}, &(0x7f0000000080)=0x10) ioctl$TCSETAF(r0, 0x5408, &(0x7f0000000040)={0x2}) ioctl$EXT4_IOC_GROUP_ADD(r0, 0x40286608, &(0x7f0000000000)={0x3, 0x7000000, 0x400, 0x100000000, 0x0, 0x8}) r3 = fcntl$dupfd(r0, 0x406, r0) ioctl$EVIOCGVERSION(r3, 0x80044501, &(0x7f0000000200)=""/31) write$binfmt_misc(r0, &(0x7f0000000080)={'syz1', "80fa25cdc862d216160cfa92845a3916e38a409a159c03f1889971d3e5144a8d08de78c4b1fbee457437261d7668b1c0f582647ad4134a05358d4309a71a702002329e024cac95642e761bb842bc1056bd6bf12c47697a649a026bd8ee1f685089941469b1ddfeddf32b392f0ff07652a3bce0770bc3bb70862845a65054cecb191e80b825d740fe6b40450359757032425dfdee92aec36ce4b468d50adc745c522cc4af2ac6e7f6a95f0edd70b09caa95fcc7143cf46b74db8bc17fa7c89f"}, 0xc3) 14:03:50 executing program 5: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSPTLCK(r0, 0x40045431, &(0x7f0000000180)) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) socket(0x200000000000011, 0x4000000000080002, 0x0) bind$packet(0xffffffffffffffff, 0x0, 0x0) sendmmsg(0xffffffffffffffff, &(0x7f0000007880)=[{{&(0x7f00000001c0)=@l2={0x1f, 0xbf53, {0x9, 0x7, 0xfffffffffffffdd5, 0x1ff, 0x2, 0x4}, 0x0, 0x7}, 0x80, 0x0}}, {{0x0, 0x0, &(0x7f0000007780)}}], 0x2, 0x4048851) setsockopt$packet_int(0xffffffffffffffff, 0x107, 0x0, 0x0, 0x0) ioctl$LOOP_SET_BLOCK_SIZE(0xffffffffffffffff, 0x4c09, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$cgroup_int(0xffffffffffffffff, 0x0, 0x2, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='\x89\x00\x00\x00\x00Ew\x00\x00\x00\xef\xb4\xc8\xd0\xff\xda\xb1vents\xd9\xc5H\xd4\x91\xfdN_]\x16\xe4\xa9C\xd2\x86Qn\xefS\x80\x11J\xfb4\x14\x86 4\x95\x9e\xfc\xc1\a\xcb \x95N\xe9\xa4j\xd2\x1f^\xb0\xb2>\xa3\xc9\xb7$\x11`t\x03: \x8b\xa4\x05\xf2?E\xdb+{t\xb8\xf7\xab\x8b\x100#', 0x26e1, 0x0) ioctl$PERF_EVENT_IOC_PAUSE_OUTPUT(r1, 0x40086602, 0x400007) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000280)='./cgroup/syz0\x00', 0x1ff) openat$smack_thread_current(0xffffffffffffff9c, &(0x7f0000000240)='/proc/thread-self/attr/current\x00', 0x2, 0x0) write$cgroup_subtree(r1, &(0x7f0000000100)=ANY=[], 0xff4a) write$cgroup_subtree(r2, &(0x7f0000000000)=ANY=[], 0x20032600) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a0f, 0x1700) accept$inet(0xffffffffffffffff, &(0x7f0000000040)={0x2, 0x0, @local}, &(0x7f0000000080)=0x10) ioctl$TCSETAF(r0, 0x5408, &(0x7f0000000040)={0x2}) ioctl$EXT4_IOC_GROUP_ADD(r0, 0x40286608, &(0x7f0000000000)={0x3, 0x7000000, 0x400, 0x100000000, 0x0, 0x8}) r3 = fcntl$dupfd(r0, 0x406, r0) ioctl$EVIOCGVERSION(r3, 0x80044501, &(0x7f0000000200)=""/31) write$binfmt_misc(r0, &(0x7f0000000080)={'syz1', "80fa25cdc862d216160cfa92845a3916e38a409a159c03f1889971d3e5144a8d08de78c4b1fbee457437261d7668b1c0f582647ad4134a05358d4309a71a702002329e024cac95642e761bb842bc1056bd6bf12c47697a649a026bd8ee1f685089941469b1ddfeddf32b392f0ff07652a3bce0770bc3bb70862845a65054cecb191e80b825d740fe6b40450359757032425dfdee92aec36ce4b468d50adc745c522cc4af2ac6e7f6a95f0edd70b09caa95fcc7143cf46b74db8bc17fa7c89f"}, 0xc3) 14:03:50 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0x0, 0x0) r2 = openat$pfkey(0xffffffffffffff9c, &(0x7f0000000100)='/proc/self/net/pfkey\x00', 0x8000, 0x0) write$P9_RLOPEN(r2, &(0x7f0000000580)={0x18, 0xd, 0x2, {{0xa}, 0x200000000000000}}, 0x18) ioctl$RTC_IRQP_READ(r2, 0x8008700b, &(0x7f0000000140)) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f00000001c0)=[@acquire], 0x0, 0x0, 0x0}) r3 = socket$key(0xf, 0x3, 0x2) getsockopt$sock_cred(r3, 0x1, 0x11, &(0x7f0000000600)={0x0, 0x0, 0x0}, &(0x7f0000000640)=0xc) ioctl$TUNSETGROUP(r2, 0x400454ce, r4) ioctl$BINDER_GET_NODE_DEBUG_INFO(r1, 0xc018620b, &(0x7f00000000c0)={0x0}) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, &(0x7f0000000040)={r5}) ioctl$BINDER_GET_NODE_DEBUG_INFO(r1, 0xc018620b, &(0x7f0000000080)={r6}) openat$random(0xffffffffffffff9c, &(0x7f0000000000)='/dev/urandom\x00', 0x0, 0x0) ioctl$EVIOCSREP(r2, 0x40084503, &(0x7f00000005c0)=[0x4]) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) vmsplice(r0, &(0x7f0000000500)=[{&(0x7f0000000180)="aee5bc1a", 0x4}, {&(0x7f0000000200)="5b153057608f4d58e3747914fc52e1b8204e32a32fede026515d4f9316d5b449d941fef823dcc8ffb034a9b65270850086813699691e6e57d1fb8fb7ce", 0x3d}, {&(0x7f0000000240)="71b4f351d961440a2cdba84a3bd62a8575041e261b5181209bfb47d065aada609460f90c540b9e73313ab725c6ba4d9aeefb71d69b2c337673fb0608a499721e7bf8b04929830a662cc88f60", 0x4c}, {&(0x7f00000002c0)="336534dec9e7c3f3ae6b7bc840ffa7619ddc914c7f0b0a93ed1cf48e665b679580829b1d22c21a5f9b8f0589762047da6fb473f6fe6fdc3ae213ea363fd9090c5cd0ee4fbfdb2b", 0x47}, {&(0x7f0000000340)="8e3ded", 0x3}, {&(0x7f0000000380)="d46cf1d8ca5c7ed6fd25f45a5597eb62e47d3fcfcdee2e3ee0a40c26d552582449ee083f8ebd2503af165bc4a25f927847fb79b10e12c9f7f996d942d01f23f0cae03fb99b4a7c8b25aff1dc1641aa07d777d9e7125e071f7d8ecdf5feae23d1945dcff9266820d6041e70494613bf10b3f3206e8d3b4c6f5a0b8d6e51ccb188db73a558949e8fa58e8a1c324084647ea8ba68d6784c8d186579f9421eb877a3cc8985e88da82be5", 0xa8}, {&(0x7f0000000440)="30ccb29bb3fe7c82fd5cc9af261fccb8a4911e8853317f258c4de0bef212b5a9b385307c82566dc2dd7ab9c204c9dae71f01782132c8886dce442aa4082cccd0d1eacbccccbe186d70594bc8f2815099070772c89217e9bc55e1baf424474d6e74007bd98d8198713f7c1aefaa2768424db7b89dd0d9b54ce4be0b993d358f8ad23d3449d1a720e272b9dd63c4ce721fc3721f82bab1e20ed5371354c1da", 0x9e}], 0x7, 0x0) 14:03:50 executing program 1: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSPTLCK(r0, 0x40045431, &(0x7f0000000180)) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) socket(0x200000000000011, 0x4000000000080002, 0x0) bind$packet(0xffffffffffffffff, 0x0, 0x0) sendmmsg(0xffffffffffffffff, &(0x7f0000007880)=[{{&(0x7f00000001c0)=@l2={0x1f, 0xbf53, {0x9, 0x7, 0xfffffffffffffdd5, 0x1ff, 0x2, 0x4}, 0x0, 0x7}, 0x80, 0x0}}, {{0x0, 0x0, &(0x7f0000007780)}}], 0x2, 0x4048851) syz_open_procfs(0x0, 0x0) ioctl$LOOP_SET_BLOCK_SIZE(0xffffffffffffffff, 0x4c09, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$cgroup_int(0xffffffffffffffff, 0x0, 0x2, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='\x89\x00\x00\x00\x00Ew\x00\x00\x00\xef\xb4\xc8\xd0\xff\xda\xb1vents\xd9\xc5H\xd4\x91\xfdN_]\x16\xe4\xa9C\xd2\x86Qn\xefS\x80\x11J\xfb4\x14\x86 4\x95\x9e\xfc\xc1\a\xcb \x95N\xe9\xa4j\xd2\x1f^\xb0\xb2>\xa3\xc9\xb7$\x11`t\x03: \x8b\xa4\x05\xf2?E\xdb+{t\xb8\xf7\xab\x8b\x100#', 0x26e1, 0x0) ioctl$PERF_EVENT_IOC_PAUSE_OUTPUT(r1, 0x40086602, 0x400007) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000280)='./cgroup/syz0\x00', 0x1ff) openat$smack_thread_current(0xffffffffffffff9c, &(0x7f0000000240)='/proc/thread-self/attr/current\x00', 0x2, 0x0) write$cgroup_subtree(r1, &(0x7f0000000100)=ANY=[], 0xff4a) write$cgroup_subtree(r2, &(0x7f0000000000)=ANY=[], 0x20032600) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a0f, 0x1700) accept$inet(0xffffffffffffffff, &(0x7f0000000040)={0x2, 0x0, @local}, &(0x7f0000000080)=0x10) ioctl$TCSETAF(r0, 0x5408, &(0x7f0000000040)={0x2}) ioctl$EXT4_IOC_GROUP_ADD(r0, 0x40286608, &(0x7f0000000000)={0x3, 0x7000000, 0x400, 0x100000000, 0x0, 0x8}) fcntl$dupfd(r0, 0x406, r0) 14:03:50 executing program 4: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSPTLCK(r0, 0x40045431, &(0x7f0000000180)) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) socket(0x200000000000011, 0x4000000000080002, 0x0) bind$packet(0xffffffffffffffff, 0x0, 0x0) sendmmsg(0xffffffffffffffff, &(0x7f0000007880)=[{{&(0x7f00000001c0)=@l2={0x1f, 0xbf53, {0x9, 0x7, 0xfffffffffffffdd5, 0x1ff, 0x2, 0x4}, 0x0, 0x7}, 0x80, 0x0}}, {{0x0, 0x0, &(0x7f0000007780)}}], 0x2, 0x4048851) setsockopt$packet_int(0xffffffffffffffff, 0x107, 0x0, 0x0, 0x0) syz_open_procfs(0x0, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$cgroup_int(0xffffffffffffffff, 0x0, 0x2, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='\x89\x00\x00\x00\x00Ew\x00\x00\x00\xef\xb4\xc8\xd0\xff\xda\xb1vents\xd9\xc5H\xd4\x91\xfdN_]\x16\xe4\xa9C\xd2\x86Qn\xefS\x80\x11J\xfb4\x14\x86 4\x95\x9e\xfc\xc1\a\xcb \x95N\xe9\xa4j\xd2\x1f^\xb0\xb2>\xa3\xc9\xb7$\x11`t\x03: \x8b\xa4\x05\xf2?E\xdb+{t\xb8\xf7\xab\x8b\x100#', 0x26e1, 0x0) ioctl$PERF_EVENT_IOC_PAUSE_OUTPUT(r1, 0x40086602, 0x400007) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000280)='./cgroup/syz0\x00', 0x1ff) openat$smack_thread_current(0xffffffffffffff9c, &(0x7f0000000240)='/proc/thread-self/attr/current\x00', 0x2, 0x0) write$cgroup_subtree(r1, &(0x7f0000000100)=ANY=[], 0xff4a) write$cgroup_subtree(r2, &(0x7f0000000000)=ANY=[], 0x20032600) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a0f, 0x1700) accept$inet(0xffffffffffffffff, &(0x7f0000000040)={0x2, 0x0, @local}, &(0x7f0000000080)=0x10) ioctl$TCSETAF(r0, 0x5408, &(0x7f0000000040)={0x2}) ioctl$EXT4_IOC_GROUP_ADD(r0, 0x40286608, &(0x7f0000000000)={0x3, 0x7000000, 0x400, 0x100000000, 0x0, 0x8}) r3 = fcntl$dupfd(r0, 0x406, r0) ioctl$EVIOCGVERSION(r3, 0x80044501, &(0x7f0000000200)=""/31) write$binfmt_misc(r0, &(0x7f0000000080)={'syz1', "80fa25cdc862d216160cfa92845a3916e38a409a159c03f1889971d3e5144a8d08de78c4b1fbee457437261d7668b1c0f582647ad4134a05358d4309a71a702002329e024cac95642e761bb842bc1056bd6bf12c47697a649a026bd8ee1f685089941469b1ddfeddf32b392f0ff07652a3bce0770bc3bb70862845a65054cecb191e80b825d740fe6b40450359757032425dfdee92aec36ce4b468d50adc745c522cc4af2ac6e7f6a95f0edd70b09caa95fcc7143cf46b74db8bc17fa7c89f"}, 0xc3) 14:03:50 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = dup2(r0, r0) ioctl$EVIOCGKEYCODE_V2(r1, 0x80284504, &(0x7f0000000000)=""/156) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f00000001c0)=[@acquire], 0x0, 0x0, 0x0}) syz_genetlink_get_family_id$net_dm(&(0x7f00000000c0)='NET_DM\x00') ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) [ 337.201531] binder: 10471:10478 unknown command 1074553627 [ 337.213693] binder: 10471:10478 ioctl c0306201 20008fd0 returned -22 14:03:50 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f00000001c0)=[@acquire], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) creat(&(0x7f0000000000)='./file0\x00', 0x80) 14:03:50 executing program 0: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSPTLCK(r0, 0x40045431, &(0x7f0000000180)) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) socket(0x200000000000011, 0x4000000000080002, 0x0) bind$packet(0xffffffffffffffff, 0x0, 0x0) sendmmsg(0xffffffffffffffff, &(0x7f0000007880)=[{{&(0x7f00000001c0)=@l2={0x1f, 0xbf53, {0x9, 0x7, 0xfffffffffffffdd5, 0x1ff, 0x2, 0x4}, 0x0, 0x7}, 0x80, 0x0}}, {{0x0, 0x0, &(0x7f0000007780)}}], 0x2, 0x4048851) setsockopt$packet_int(0xffffffffffffffff, 0x107, 0x0, 0x0, 0x0) syz_open_procfs(0x0, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$cgroup_int(0xffffffffffffffff, 0x0, 0x2, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='\x89\x00\x00\x00\x00Ew\x00\x00\x00\xef\xb4\xc8\xd0\xff\xda\xb1vents\xd9\xc5H\xd4\x91\xfdN_]\x16\xe4\xa9C\xd2\x86Qn\xefS\x80\x11J\xfb4\x14\x86 4\x95\x9e\xfc\xc1\a\xcb \x95N\xe9\xa4j\xd2\x1f^\xb0\xb2>\xa3\xc9\xb7$\x11`t\x03: \x8b\xa4\x05\xf2?E\xdb+{t\xb8\xf7\xab\x8b\x100#', 0x26e1, 0x0) ioctl$PERF_EVENT_IOC_PAUSE_OUTPUT(r1, 0x40086602, 0x400007) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000280)='./cgroup/syz0\x00', 0x1ff) openat$smack_thread_current(0xffffffffffffff9c, &(0x7f0000000240)='/proc/thread-self/attr/current\x00', 0x2, 0x0) write$cgroup_subtree(r1, &(0x7f0000000100)=ANY=[], 0xff4a) write$cgroup_subtree(r2, &(0x7f0000000000)=ANY=[], 0x20032600) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a0f, 0x1700) accept$inet(0xffffffffffffffff, &(0x7f0000000040)={0x2, 0x0, @local}, &(0x7f0000000080)=0x10) ioctl$TCSETAF(r0, 0x5408, &(0x7f0000000040)={0x2}) ioctl$EXT4_IOC_GROUP_ADD(r0, 0x40286608, &(0x7f0000000000)={0x3, 0x7000000, 0x400, 0x100000000, 0x0, 0x8}) r3 = fcntl$dupfd(r0, 0x406, r0) ioctl$EVIOCGVERSION(r3, 0x80044501, &(0x7f0000000200)=""/31) write$binfmt_misc(r0, &(0x7f0000000080)={'syz1', "80fa25cdc862d216160cfa92845a3916e38a409a159c03f1889971d3e5144a8d08de78c4b1fbee457437261d7668b1c0f582647ad4134a05358d4309a71a702002329e024cac95642e761bb842bc1056bd6bf12c47697a649a026bd8ee1f685089941469b1ddfeddf32b392f0ff07652a3bce0770bc3bb70862845a65054cecb191e80b825d740fe6b40450359757032425dfdee92aec36ce4b468d50adc745c522cc4af2ac6e7f6a95f0edd70b09caa95fcc7143cf46b74db8bc17fa7c89f"}, 0xc3) [ 337.290585] binder: 10491:10497 ioctl 80284504 20000000 returned -22 [ 337.313625] binder: BINDER_SET_CONTEXT_MGR already set [ 337.326256] binder: 10491:10497 ioctl 40046207 0 returned -16 14:03:50 executing program 3: ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f00000001c0)=[@acquire], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) 14:03:50 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x0, 0x0, &(0x7f00000001c0), 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) 14:03:50 executing program 4: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(r0, 0x540b, 0xfff) bpf$OBJ_GET_MAP(0x7, &(0x7f0000000040)={&(0x7f0000000000)='./file0\x00', 0x0, 0xf767a8cc27cf7293}, 0x10) 14:03:50 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$TIOCSPTLCK(r0, 0x40045431, &(0x7f0000000180)) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) socket(0x200000000000011, 0x4000000000080002, 0x0) bind$packet(0xffffffffffffffff, 0x0, 0x0) sendmmsg(0xffffffffffffffff, &(0x7f0000007880)=[{{&(0x7f00000001c0)=@l2={0x1f, 0xbf53, {0x9, 0x7, 0xfffffffffffffdd5, 0x1ff, 0x2, 0x4}, 0x0, 0x7}, 0x80, 0x0}}, {{0x0, 0x0, &(0x7f0000007780)}}], 0x2, 0x4048851) setsockopt$packet_int(0xffffffffffffffff, 0x107, 0x0, 0x0, 0x0) syz_open_procfs(0x0, 0x0) ioctl$LOOP_SET_BLOCK_SIZE(0xffffffffffffffff, 0x4c09, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$cgroup_int(0xffffffffffffffff, 0x0, 0x2, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='\x89\x00\x00\x00\x00Ew\x00\x00\x00\xef\xb4\xc8\xd0\xff\xda\xb1vents\xd9\xc5H\xd4\x91\xfdN_]\x16\xe4\xa9C\xd2\x86Qn\xefS\x80\x11J\xfb4\x14\x86 4\x95\x9e\xfc\xc1\a\xcb \x95N\xe9\xa4j\xd2\x1f^\xb0\xb2>\xa3\xc9\xb7$\x11`t\x03: \x8b\xa4\x05\xf2?E\xdb+{t\xb8\xf7\xab\x8b\x100#', 0x26e1, 0x0) ioctl$PERF_EVENT_IOC_PAUSE_OUTPUT(r1, 0x40086602, 0x400007) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000280)='./cgroup/syz0\x00', 0x1ff) openat$smack_thread_current(0xffffffffffffff9c, &(0x7f0000000240)='/proc/thread-self/attr/current\x00', 0x2, 0x0) write$cgroup_subtree(r1, &(0x7f0000000100)=ANY=[], 0xff4a) write$cgroup_subtree(r2, &(0x7f0000000000)=ANY=[], 0x20032600) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a0f, 0x1700) accept$inet(0xffffffffffffffff, &(0x7f0000000040)={0x2, 0x0, @local}, &(0x7f0000000080)=0x10) ioctl$TCSETAF(r0, 0x5408, &(0x7f0000000040)={0x2}) ioctl$EXT4_IOC_GROUP_ADD(r0, 0x40286608, &(0x7f0000000000)={0x3, 0x7000000, 0x400, 0x100000000, 0x0, 0x8}) r3 = fcntl$dupfd(r0, 0x406, r0) ioctl$EVIOCGVERSION(r3, 0x80044501, &(0x7f0000000200)=""/31) write$binfmt_misc(r0, &(0x7f0000000080)={'syz1', "80fa25cdc862d216160cfa92845a3916e38a409a159c03f1889971d3e5144a8d08de78c4b1fbee457437261d7668b1c0f582647ad4134a05358d4309a71a702002329e024cac95642e761bb842bc1056bd6bf12c47697a649a026bd8ee1f685089941469b1ddfeddf32b392f0ff07652a3bce0770bc3bb70862845a65054cecb191e80b825d740fe6b40450359757032425dfdee92aec36ce4b468d50adc745c522cc4af2ac6e7f6a95f0edd70b09caa95fcc7143cf46b74db8bc17fa7c89f"}, 0xc3) 14:03:50 executing program 5: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSPTLCK(r0, 0x40045431, &(0x7f0000000180)) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) socket(0x200000000000011, 0x4000000000080002, 0x0) bind$packet(0xffffffffffffffff, 0x0, 0x0) sendmmsg(0xffffffffffffffff, &(0x7f0000007880)=[{{&(0x7f00000001c0)=@l2={0x1f, 0xbf53, {0x9, 0x7, 0xfffffffffffffdd5, 0x1ff, 0x2, 0x4}, 0x0, 0x7}, 0x80, 0x0}}, {{0x0, 0x0, &(0x7f0000007780)}}], 0x2, 0x4048851) setsockopt$packet_int(0xffffffffffffffff, 0x107, 0x0, 0x0, 0x0) syz_open_procfs(0x0, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$cgroup_int(0xffffffffffffffff, 0x0, 0x2, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='\x89\x00\x00\x00\x00Ew\x00\x00\x00\xef\xb4\xc8\xd0\xff\xda\xb1vents\xd9\xc5H\xd4\x91\xfdN_]\x16\xe4\xa9C\xd2\x86Qn\xefS\x80\x11J\xfb4\x14\x86 4\x95\x9e\xfc\xc1\a\xcb \x95N\xe9\xa4j\xd2\x1f^\xb0\xb2>\xa3\xc9\xb7$\x11`t\x03: \x8b\xa4\x05\xf2?E\xdb+{t\xb8\xf7\xab\x8b\x100#', 0x26e1, 0x0) ioctl$PERF_EVENT_IOC_PAUSE_OUTPUT(r1, 0x40086602, 0x400007) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000280)='./cgroup/syz0\x00', 0x1ff) openat$smack_thread_current(0xffffffffffffff9c, &(0x7f0000000240)='/proc/thread-self/attr/current\x00', 0x2, 0x0) write$cgroup_subtree(r1, &(0x7f0000000100)=ANY=[], 0xff4a) write$cgroup_subtree(r2, &(0x7f0000000000)=ANY=[], 0x20032600) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a0f, 0x1700) accept$inet(0xffffffffffffffff, &(0x7f0000000040)={0x2, 0x0, @local}, &(0x7f0000000080)=0x10) ioctl$TCSETAF(r0, 0x5408, &(0x7f0000000040)={0x2}) ioctl$EXT4_IOC_GROUP_ADD(r0, 0x40286608, &(0x7f0000000000)={0x3, 0x7000000, 0x400, 0x100000000, 0x0, 0x8}) r3 = fcntl$dupfd(r0, 0x406, r0) ioctl$EVIOCGVERSION(r3, 0x80044501, &(0x7f0000000200)=""/31) write$binfmt_misc(r0, &(0x7f0000000080)={'syz1', "80fa25cdc862d216160cfa92845a3916e38a409a159c03f1889971d3e5144a8d08de78c4b1fbee457437261d7668b1c0f582647ad4134a05358d4309a71a702002329e024cac95642e761bb842bc1056bd6bf12c47697a649a026bd8ee1f685089941469b1ddfeddf32b392f0ff07652a3bce0770bc3bb70862845a65054cecb191e80b825d740fe6b40450359757032425dfdee92aec36ce4b468d50adc745c522cc4af2ac6e7f6a95f0edd70b09caa95fcc7143cf46b74db8bc17fa7c89f"}, 0xc3) 14:03:50 executing program 1: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSPTLCK(r0, 0x40045431, &(0x7f0000000180)) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) socket(0x200000000000011, 0x4000000000080002, 0x0) bind$packet(0xffffffffffffffff, 0x0, 0x0) sendmmsg(0xffffffffffffffff, &(0x7f0000007880)=[{{&(0x7f00000001c0)=@l2={0x1f, 0xbf53, {0x9, 0x7, 0xfffffffffffffdd5, 0x1ff, 0x2, 0x4}, 0x0, 0x7}, 0x80, 0x0}}, {{0x0, 0x0, &(0x7f0000007780)}}], 0x2, 0x4048851) syz_open_procfs(0x0, 0x0) ioctl$LOOP_SET_BLOCK_SIZE(0xffffffffffffffff, 0x4c09, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$cgroup_int(0xffffffffffffffff, 0x0, 0x2, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='\x89\x00\x00\x00\x00Ew\x00\x00\x00\xef\xb4\xc8\xd0\xff\xda\xb1vents\xd9\xc5H\xd4\x91\xfdN_]\x16\xe4\xa9C\xd2\x86Qn\xefS\x80\x11J\xfb4\x14\x86 4\x95\x9e\xfc\xc1\a\xcb \x95N\xe9\xa4j\xd2\x1f^\xb0\xb2>\xa3\xc9\xb7$\x11`t\x03: \x8b\xa4\x05\xf2?E\xdb+{t\xb8\xf7\xab\x8b\x100#', 0x26e1, 0x0) ioctl$PERF_EVENT_IOC_PAUSE_OUTPUT(r1, 0x40086602, 0x400007) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000280)='./cgroup/syz0\x00', 0x1ff) openat$smack_thread_current(0xffffffffffffff9c, &(0x7f0000000240)='/proc/thread-self/attr/current\x00', 0x2, 0x0) write$cgroup_subtree(r1, &(0x7f0000000100)=ANY=[], 0xff4a) write$cgroup_subtree(r2, &(0x7f0000000000)=ANY=[], 0x20032600) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a0f, 0x1700) accept$inet(0xffffffffffffffff, &(0x7f0000000040)={0x2, 0x0, @local}, &(0x7f0000000080)=0x10) ioctl$TCSETAF(r0, 0x5408, &(0x7f0000000040)={0x2}) ioctl$EXT4_IOC_GROUP_ADD(r0, 0x40286608, &(0x7f0000000000)={0x3, 0x7000000, 0x400, 0x100000000, 0x0, 0x8}) fcntl$dupfd(r0, 0x406, r0) 14:03:50 executing program 4: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSPTLCK(r0, 0x40045431, &(0x7f0000000180)) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) socket(0x200000000000011, 0x4000000000080002, 0x0) bind$packet(0xffffffffffffffff, 0x0, 0x0) sendmmsg(0xffffffffffffffff, &(0x7f0000007880)=[{{&(0x7f00000001c0)=@l2={0x1f, 0xbf53, {0x9, 0x7, 0xfffffffffffffdd5, 0x1ff, 0x2, 0x4}, 0x0, 0x7}, 0x80, 0x0}}, {{0x0, 0x0, &(0x7f0000007780)}}], 0x2, 0x4048851) syz_open_procfs(0x0, 0x0) ioctl$LOOP_SET_BLOCK_SIZE(0xffffffffffffffff, 0x4c09, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$cgroup_int(0xffffffffffffffff, 0x0, 0x2, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='\x89\x00\x00\x00\x00Ew\x00\x00\x00\xef\xb4\xc8\xd0\xff\xda\xb1vents\xd9\xc5H\xd4\x91\xfdN_]\x16\xe4\xa9C\xd2\x86Qn\xefS\x80\x11J\xfb4\x14\x86 4\x95\x9e\xfc\xc1\a\xcb \x95N\xe9\xa4j\xd2\x1f^\xb0\xb2>\xa3\xc9\xb7$\x11`t\x03: \x8b\xa4\x05\xf2?E\xdb+{t\xb8\xf7\xab\x8b\x100#', 0x26e1, 0x0) ioctl$PERF_EVENT_IOC_PAUSE_OUTPUT(r1, 0x40086602, 0x400007) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000280)='./cgroup/syz0\x00', 0x1ff) openat$smack_thread_current(0xffffffffffffff9c, &(0x7f0000000240)='/proc/thread-self/attr/current\x00', 0x2, 0x0) write$cgroup_subtree(r1, &(0x7f0000000100)=ANY=[], 0xff4a) write$cgroup_subtree(r2, &(0x7f0000000000)=ANY=[], 0x20032600) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a0f, 0x1700) accept$inet(0xffffffffffffffff, &(0x7f0000000040)={0x2, 0x0, @local}, &(0x7f0000000080)=0x10) ioctl$TCSETAF(r0, 0x5408, &(0x7f0000000040)={0x2}) ioctl$EXT4_IOC_GROUP_ADD(r0, 0x40286608, &(0x7f0000000000)={0x3, 0x7000000, 0x400, 0x100000000, 0x0, 0x8}) fcntl$dupfd(r0, 0x406, r0) 14:03:51 executing program 0: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSPTLCK(r0, 0x40045431, &(0x7f0000000180)) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) socket(0x200000000000011, 0x4000000000080002, 0x0) bind$packet(0xffffffffffffffff, 0x0, 0x0) sendmmsg(0xffffffffffffffff, &(0x7f0000007880)=[{{&(0x7f00000001c0)=@l2={0x1f, 0xbf53, {0x9, 0x7, 0xfffffffffffffdd5, 0x1ff, 0x2, 0x4}, 0x0, 0x7}, 0x80, 0x0}}, {{0x0, 0x0, &(0x7f0000007780)}}], 0x2, 0x4048851) setsockopt$packet_int(0xffffffffffffffff, 0x107, 0x0, 0x0, 0x0) syz_open_procfs(0x0, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$cgroup_int(0xffffffffffffffff, 0x0, 0x2, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='\x89\x00\x00\x00\x00Ew\x00\x00\x00\xef\xb4\xc8\xd0\xff\xda\xb1vents\xd9\xc5H\xd4\x91\xfdN_]\x16\xe4\xa9C\xd2\x86Qn\xefS\x80\x11J\xfb4\x14\x86 4\x95\x9e\xfc\xc1\a\xcb \x95N\xe9\xa4j\xd2\x1f^\xb0\xb2>\xa3\xc9\xb7$\x11`t\x03: \x8b\xa4\x05\xf2?E\xdb+{t\xb8\xf7\xab\x8b\x100#', 0x26e1, 0x0) ioctl$PERF_EVENT_IOC_PAUSE_OUTPUT(r1, 0x40086602, 0x400007) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000280)='./cgroup/syz0\x00', 0x1ff) openat$smack_thread_current(0xffffffffffffff9c, &(0x7f0000000240)='/proc/thread-self/attr/current\x00', 0x2, 0x0) write$cgroup_subtree(r1, &(0x7f0000000100)=ANY=[], 0xff4a) write$cgroup_subtree(r2, &(0x7f0000000000)=ANY=[], 0x20032600) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a0f, 0x1700) accept$inet(0xffffffffffffffff, &(0x7f0000000040)={0x2, 0x0, @local}, &(0x7f0000000080)=0x10) ioctl$TCSETAF(r0, 0x5408, &(0x7f0000000040)={0x2}) ioctl$EXT4_IOC_GROUP_ADD(r0, 0x40286608, &(0x7f0000000000)={0x3, 0x7000000, 0x400, 0x100000000, 0x0, 0x8}) r3 = fcntl$dupfd(r0, 0x406, r0) ioctl$EVIOCGVERSION(r3, 0x80044501, &(0x7f0000000200)=""/31) write$binfmt_misc(r0, &(0x7f0000000080)={'syz1', "80fa25cdc862d216160cfa92845a3916e38a409a159c03f1889971d3e5144a8d08de78c4b1fbee457437261d7668b1c0f582647ad4134a05358d4309a71a702002329e024cac95642e761bb842bc1056bd6bf12c47697a649a026bd8ee1f685089941469b1ddfeddf32b392f0ff07652a3bce0770bc3bb70862845a65054cecb191e80b825d740fe6b40450359757032425dfdee92aec36ce4b468d50adc745c522cc4af2ac6e7f6a95f0edd70b09caa95fcc7143cf46b74db8bc17fa7c89f"}, 0xc3) 14:03:51 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) r2 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x80400, 0x0) ioctl$TIOCGLCKTRMIOS(r2, 0x5456, &(0x7f0000000040)={0x2, 0x4, 0x4, 0x3, 0x4, 0xfffffffffffffff8, 0x2, 0x0, 0x8, 0x6, 0x3, 0xc5e}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB="056304400000000086aeddc71bf6a8a81e4d1e5375d36fa7d96b35cc3b1801f2850fb8861a17e1e2951746d7b8a85f9d7c2cdf8b9f31ceb063d1b4c46862413f8ff6fd1f28953e333a7f1f6cd7fc1a1e1e68dfccad912ffc4b125cdab6dc2dbddbdb760f6f597a3b4044c5943677a78bf62d0df9e57a32899815823c2c1256c18e94784be8e34194040da366e8c8f0f2f31c112531d1ccbe0074931a968f215eb860d2d5f947e78672821ba127df4769bec40fdc4521fe0f232e69c6df69c6cf91f024816f8e32e93744f068ab403cff7caeb3977f8de01bc09ebeaf"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) [ 337.451078] binder: 10520:10522 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 14:03:51 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB='r\f\x00\x00\x00\x00\x00\x00'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x0, 0x0, &(0x7f0000000000)=ANY=[], 0x0, 0x0, 0x0}) 14:03:51 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$TIOCSPTLCK(r0, 0x40045431, &(0x7f0000000180)) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) socket(0x200000000000011, 0x4000000000080002, 0x0) bind$packet(0xffffffffffffffff, 0x0, 0x0) sendmmsg(0xffffffffffffffff, &(0x7f0000007880)=[{{&(0x7f00000001c0)=@l2={0x1f, 0xbf53, {0x9, 0x7, 0xfffffffffffffdd5, 0x1ff, 0x2, 0x4}, 0x0, 0x7}, 0x80, 0x0}}, {{0x0, 0x0, &(0x7f0000007780)}}], 0x2, 0x4048851) setsockopt$packet_int(0xffffffffffffffff, 0x107, 0x0, 0x0, 0x0) syz_open_procfs(0x0, 0x0) ioctl$LOOP_SET_BLOCK_SIZE(0xffffffffffffffff, 0x4c09, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$cgroup_int(0xffffffffffffffff, 0x0, 0x2, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='\x89\x00\x00\x00\x00Ew\x00\x00\x00\xef\xb4\xc8\xd0\xff\xda\xb1vents\xd9\xc5H\xd4\x91\xfdN_]\x16\xe4\xa9C\xd2\x86Qn\xefS\x80\x11J\xfb4\x14\x86 4\x95\x9e\xfc\xc1\a\xcb \x95N\xe9\xa4j\xd2\x1f^\xb0\xb2>\xa3\xc9\xb7$\x11`t\x03: \x8b\xa4\x05\xf2?E\xdb+{t\xb8\xf7\xab\x8b\x100#', 0x26e1, 0x0) ioctl$PERF_EVENT_IOC_PAUSE_OUTPUT(r1, 0x40086602, 0x400007) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000280)='./cgroup/syz0\x00', 0x1ff) openat$smack_thread_current(0xffffffffffffff9c, &(0x7f0000000240)='/proc/thread-self/attr/current\x00', 0x2, 0x0) write$cgroup_subtree(r1, &(0x7f0000000100)=ANY=[], 0xff4a) write$cgroup_subtree(r2, &(0x7f0000000000)=ANY=[], 0x20032600) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a0f, 0x1700) accept$inet(0xffffffffffffffff, &(0x7f0000000040)={0x2, 0x0, @local}, &(0x7f0000000080)=0x10) ioctl$TCSETAF(r0, 0x5408, &(0x7f0000000040)={0x2}) ioctl$EXT4_IOC_GROUP_ADD(r0, 0x40286608, &(0x7f0000000000)={0x3, 0x7000000, 0x400, 0x100000000, 0x0, 0x8}) r3 = fcntl$dupfd(r0, 0x406, r0) ioctl$EVIOCGVERSION(r3, 0x80044501, &(0x7f0000000200)=""/31) write$binfmt_misc(r0, &(0x7f0000000080)={'syz1', "80fa25cdc862d216160cfa92845a3916e38a409a159c03f1889971d3e5144a8d08de78c4b1fbee457437261d7668b1c0f582647ad4134a05358d4309a71a702002329e024cac95642e761bb842bc1056bd6bf12c47697a649a026bd8ee1f685089941469b1ddfeddf32b392f0ff07652a3bce0770bc3bb70862845a65054cecb191e80b825d740fe6b40450359757032425dfdee92aec36ce4b468d50adc745c522cc4af2ac6e7f6a95f0edd70b09caa95fcc7143cf46b74db8bc17fa7c89f"}, 0xc3) 14:03:51 executing program 5: r0 = openat$ptmx(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$TIOCSPTLCK(r0, 0x40045431, &(0x7f0000000180)) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) socket(0x200000000000011, 0x4000000000080002, 0x0) bind$packet(0xffffffffffffffff, 0x0, 0x0) sendmmsg(0xffffffffffffffff, &(0x7f0000007880)=[{{&(0x7f00000001c0)=@l2={0x1f, 0xbf53, {0x9, 0x7, 0xfffffffffffffdd5, 0x1ff, 0x2, 0x4}, 0x0, 0x7}, 0x80, 0x0}}, {{0x0, 0x0, &(0x7f0000007780)}}], 0x2, 0x4048851) setsockopt$packet_int(0xffffffffffffffff, 0x107, 0x0, 0x0, 0x0) syz_open_procfs(0x0, 0x0) ioctl$LOOP_SET_BLOCK_SIZE(0xffffffffffffffff, 0x4c09, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$cgroup_int(0xffffffffffffffff, 0x0, 0x2, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='\x89\x00\x00\x00\x00Ew\x00\x00\x00\xef\xb4\xc8\xd0\xff\xda\xb1vents\xd9\xc5H\xd4\x91\xfdN_]\x16\xe4\xa9C\xd2\x86Qn\xefS\x80\x11J\xfb4\x14\x86 4\x95\x9e\xfc\xc1\a\xcb \x95N\xe9\xa4j\xd2\x1f^\xb0\xb2>\xa3\xc9\xb7$\x11`t\x03: \x8b\xa4\x05\xf2?E\xdb+{t\xb8\xf7\xab\x8b\x100#', 0x26e1, 0x0) ioctl$PERF_EVENT_IOC_PAUSE_OUTPUT(r1, 0x40086602, 0x400007) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000280)='./cgroup/syz0\x00', 0x1ff) openat$smack_thread_current(0xffffffffffffff9c, &(0x7f0000000240)='/proc/thread-self/attr/current\x00', 0x2, 0x0) write$cgroup_subtree(r1, &(0x7f0000000100)=ANY=[], 0xff4a) write$cgroup_subtree(r2, &(0x7f0000000000)=ANY=[], 0x20032600) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a0f, 0x1700) accept$inet(0xffffffffffffffff, &(0x7f0000000040)={0x2, 0x0, @local}, &(0x7f0000000080)=0x10) ioctl$TCSETAF(r0, 0x5408, &(0x7f0000000040)={0x2}) ioctl$EXT4_IOC_GROUP_ADD(r0, 0x40286608, &(0x7f0000000000)={0x3, 0x7000000, 0x400, 0x100000000, 0x0, 0x8}) r3 = fcntl$dupfd(r0, 0x406, r0) ioctl$EVIOCGVERSION(r3, 0x80044501, &(0x7f0000000200)=""/31) write$binfmt_misc(r0, &(0x7f0000000080)={'syz1', "80fa25cdc862d216160cfa92845a3916e38a409a159c03f1889971d3e5144a8d08de78c4b1fbee457437261d7668b1c0f582647ad4134a05358d4309a71a702002329e024cac95642e761bb842bc1056bd6bf12c47697a649a026bd8ee1f685089941469b1ddfeddf32b392f0ff07652a3bce0770bc3bb70862845a65054cecb191e80b825d740fe6b40450359757032425dfdee92aec36ce4b468d50adc745c522cc4af2ac6e7f6a95f0edd70b09caa95fcc7143cf46b74db8bc17fa7c89f"}, 0xc3) 14:03:51 executing program 1: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSPTLCK(r0, 0x40045431, &(0x7f0000000180)) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) socket(0x200000000000011, 0x4000000000080002, 0x0) bind$packet(0xffffffffffffffff, 0x0, 0x0) sendmmsg(0xffffffffffffffff, &(0x7f0000007880)=[{{&(0x7f00000001c0)=@l2={0x1f, 0xbf53, {0x9, 0x7, 0xfffffffffffffdd5, 0x1ff, 0x2, 0x4}, 0x0, 0x7}, 0x80, 0x0}}, {{0x0, 0x0, &(0x7f0000007780)}}], 0x2, 0x4048851) syz_open_procfs(0x0, 0x0) ioctl$LOOP_SET_BLOCK_SIZE(0xffffffffffffffff, 0x4c09, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$cgroup_int(0xffffffffffffffff, 0x0, 0x2, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='\x89\x00\x00\x00\x00Ew\x00\x00\x00\xef\xb4\xc8\xd0\xff\xda\xb1vents\xd9\xc5H\xd4\x91\xfdN_]\x16\xe4\xa9C\xd2\x86Qn\xefS\x80\x11J\xfb4\x14\x86 4\x95\x9e\xfc\xc1\a\xcb \x95N\xe9\xa4j\xd2\x1f^\xb0\xb2>\xa3\xc9\xb7$\x11`t\x03: \x8b\xa4\x05\xf2?E\xdb+{t\xb8\xf7\xab\x8b\x100#', 0x26e1, 0x0) ioctl$PERF_EVENT_IOC_PAUSE_OUTPUT(r1, 0x40086602, 0x400007) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000280)='./cgroup/syz0\x00', 0x1ff) openat$smack_thread_current(0xffffffffffffff9c, &(0x7f0000000240)='/proc/thread-self/attr/current\x00', 0x2, 0x0) write$cgroup_subtree(r1, &(0x7f0000000100)=ANY=[], 0xff4a) write$cgroup_subtree(r2, &(0x7f0000000000)=ANY=[], 0x20032600) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a0f, 0x1700) accept$inet(0xffffffffffffffff, &(0x7f0000000040)={0x2, 0x0, @local}, &(0x7f0000000080)=0x10) ioctl$TCSETAF(r0, 0x5408, &(0x7f0000000040)={0x2}) ioctl$EXT4_IOC_GROUP_ADD(r0, 0x40286608, &(0x7f0000000000)={0x3, 0x7000000, 0x400, 0x100000000, 0x0, 0x8}) ioctl$EVIOCGVERSION(0xffffffffffffffff, 0x80044501, &(0x7f0000000200)=""/31) [ 337.620544] binder: 10540:10544 unknown command 3186 14:03:51 executing program 0: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSPTLCK(r0, 0x40045431, &(0x7f0000000180)) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) socket(0x200000000000011, 0x4000000000080002, 0x0) bind$packet(0xffffffffffffffff, 0x0, 0x0) sendmmsg(0xffffffffffffffff, &(0x7f0000007880)=[{{&(0x7f00000001c0)=@l2={0x1f, 0xbf53, {0x9, 0x7, 0xfffffffffffffdd5, 0x1ff, 0x2, 0x4}, 0x0, 0x7}, 0x80, 0x0}}, {{0x0, 0x0, &(0x7f0000007780)}}], 0x2, 0x4048851) syz_open_procfs(0x0, 0x0) ioctl$LOOP_SET_BLOCK_SIZE(0xffffffffffffffff, 0x4c09, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$cgroup_int(0xffffffffffffffff, 0x0, 0x2, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='\x89\x00\x00\x00\x00Ew\x00\x00\x00\xef\xb4\xc8\xd0\xff\xda\xb1vents\xd9\xc5H\xd4\x91\xfdN_]\x16\xe4\xa9C\xd2\x86Qn\xefS\x80\x11J\xfb4\x14\x86 4\x95\x9e\xfc\xc1\a\xcb \x95N\xe9\xa4j\xd2\x1f^\xb0\xb2>\xa3\xc9\xb7$\x11`t\x03: \x8b\xa4\x05\xf2?E\xdb+{t\xb8\xf7\xab\x8b\x100#', 0x26e1, 0x0) ioctl$PERF_EVENT_IOC_PAUSE_OUTPUT(r1, 0x40086602, 0x400007) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000280)='./cgroup/syz0\x00', 0x1ff) openat$smack_thread_current(0xffffffffffffff9c, &(0x7f0000000240)='/proc/thread-self/attr/current\x00', 0x2, 0x0) write$cgroup_subtree(r1, &(0x7f0000000100)=ANY=[], 0xff4a) write$cgroup_subtree(r2, &(0x7f0000000000)=ANY=[], 0x20032600) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a0f, 0x1700) accept$inet(0xffffffffffffffff, &(0x7f0000000040)={0x2, 0x0, @local}, &(0x7f0000000080)=0x10) ioctl$TCSETAF(r0, 0x5408, &(0x7f0000000040)={0x2}) ioctl$EXT4_IOC_GROUP_ADD(r0, 0x40286608, &(0x7f0000000000)={0x3, 0x7000000, 0x400, 0x100000000, 0x0, 0x8}) fcntl$dupfd(r0, 0x406, r0) 14:03:51 executing program 4: r0 = openat$ptmx(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$TIOCSPTLCK(r0, 0x40045431, &(0x7f0000000180)) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) socket(0x200000000000011, 0x4000000000080002, 0x0) bind$packet(0xffffffffffffffff, 0x0, 0x0) sendmmsg(0xffffffffffffffff, &(0x7f0000007880)=[{{&(0x7f00000001c0)=@l2={0x1f, 0xbf53, {0x9, 0x7, 0xfffffffffffffdd5, 0x1ff, 0x2, 0x4}, 0x0, 0x7}, 0x80, 0x0}}, {{0x0, 0x0, &(0x7f0000007780)}}], 0x2, 0x4048851) setsockopt$packet_int(0xffffffffffffffff, 0x107, 0x0, 0x0, 0x0) syz_open_procfs(0x0, 0x0) ioctl$LOOP_SET_BLOCK_SIZE(0xffffffffffffffff, 0x4c09, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$cgroup_int(0xffffffffffffffff, 0x0, 0x2, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='\x89\x00\x00\x00\x00Ew\x00\x00\x00\xef\xb4\xc8\xd0\xff\xda\xb1vents\xd9\xc5H\xd4\x91\xfdN_]\x16\xe4\xa9C\xd2\x86Qn\xefS\x80\x11J\xfb4\x14\x86 4\x95\x9e\xfc\xc1\a\xcb \x95N\xe9\xa4j\xd2\x1f^\xb0\xb2>\xa3\xc9\xb7$\x11`t\x03: \x8b\xa4\x05\xf2?E\xdb+{t\xb8\xf7\xab\x8b\x100#', 0x26e1, 0x0) ioctl$PERF_EVENT_IOC_PAUSE_OUTPUT(r1, 0x40086602, 0x400007) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000280)='./cgroup/syz0\x00', 0x1ff) openat$smack_thread_current(0xffffffffffffff9c, &(0x7f0000000240)='/proc/thread-self/attr/current\x00', 0x2, 0x0) write$cgroup_subtree(r1, &(0x7f0000000100)=ANY=[], 0xff4a) write$cgroup_subtree(r2, &(0x7f0000000000)=ANY=[], 0x20032600) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a0f, 0x1700) accept$inet(0xffffffffffffffff, &(0x7f0000000040)={0x2, 0x0, @local}, &(0x7f0000000080)=0x10) ioctl$TCSETAF(r0, 0x5408, &(0x7f0000000040)={0x2}) ioctl$EXT4_IOC_GROUP_ADD(r0, 0x40286608, &(0x7f0000000000)={0x3, 0x7000000, 0x400, 0x100000000, 0x0, 0x8}) r3 = fcntl$dupfd(r0, 0x406, r0) ioctl$EVIOCGVERSION(r3, 0x80044501, &(0x7f0000000200)=""/31) write$binfmt_misc(r0, &(0x7f0000000080)={'syz1', "80fa25cdc862d216160cfa92845a3916e38a409a159c03f1889971d3e5144a8d08de78c4b1fbee457437261d7668b1c0f582647ad4134a05358d4309a71a702002329e024cac95642e761bb842bc1056bd6bf12c47697a649a026bd8ee1f685089941469b1ddfeddf32b392f0ff07652a3bce0770bc3bb70862845a65054cecb191e80b825d740fe6b40450359757032425dfdee92aec36ce4b468d50adc745c522cc4af2ac6e7f6a95f0edd70b09caa95fcc7143cf46b74db8bc17fa7c89f"}, 0xc3) 14:03:51 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB="0900000800ae7800"], 0x0, 0x0, 0x0}) r2 = add_key(&(0x7f0000000000)='id_resolver\x00', &(0x7f0000000040)={'syz', 0x2}, &(0x7f0000000080)="891a6206ad8396f2e212579e051238b4faeac60eb1dfef07bbb245de5aefa78f5eafa3ea41cb36bebf9fe9b64bf0462b6efcf6ec428bd3873feea03a371e49720113d88bd8c6ebc17762279df15ccea65442fc2fbc31d800bcf01b98c880394c81d46a7dfc", 0x65, 0xfffffffffffffffc) keyctl$KEYCTL_RESTRICT_KEYRING(0x1d, r2, &(0x7f0000000100)='trusted\x00', 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0xf7, 0x0, &(0x7f000000dff8)=ANY=[@ANYBLOB="0e630c4000000001"], 0x0, 0x0, 0x0}) [ 337.641838] binder: 10540:10544 ioctl c0306201 20012000 returned -22 [ 337.719759] binder: 10559:10561 unknown command 134217737 [ 337.747405] binder: 10559:10561 ioctl c0306201 20012000 returned -22 14:03:51 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSPTLCK(0xffffffffffffffff, 0x40045431, &(0x7f0000000180)) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) socket(0x200000000000011, 0x4000000000080002, 0x0) bind$packet(0xffffffffffffffff, 0x0, 0x0) sendmmsg(0xffffffffffffffff, &(0x7f0000007880)=[{{&(0x7f00000001c0)=@l2={0x1f, 0xbf53, {0x9, 0x7, 0xfffffffffffffdd5, 0x1ff, 0x2, 0x4}, 0x0, 0x7}, 0x80, 0x0}}, {{0x0, 0x0, &(0x7f0000007780)}}], 0x2, 0x4048851) setsockopt$packet_int(0xffffffffffffffff, 0x107, 0x0, 0x0, 0x0) syz_open_procfs(0x0, 0x0) ioctl$LOOP_SET_BLOCK_SIZE(0xffffffffffffffff, 0x4c09, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$cgroup_int(0xffffffffffffffff, 0x0, 0x2, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='\x89\x00\x00\x00\x00Ew\x00\x00\x00\xef\xb4\xc8\xd0\xff\xda\xb1vents\xd9\xc5H\xd4\x91\xfdN_]\x16\xe4\xa9C\xd2\x86Qn\xefS\x80\x11J\xfb4\x14\x86 4\x95\x9e\xfc\xc1\a\xcb \x95N\xe9\xa4j\xd2\x1f^\xb0\xb2>\xa3\xc9\xb7$\x11`t\x03: \x8b\xa4\x05\xf2?E\xdb+{t\xb8\xf7\xab\x8b\x100#', 0x26e1, 0x0) ioctl$PERF_EVENT_IOC_PAUSE_OUTPUT(r1, 0x40086602, 0x400007) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000280)='./cgroup/syz0\x00', 0x1ff) openat$smack_thread_current(0xffffffffffffff9c, &(0x7f0000000240)='/proc/thread-self/attr/current\x00', 0x2, 0x0) write$cgroup_subtree(r1, &(0x7f0000000100)=ANY=[], 0xff4a) write$cgroup_subtree(r2, &(0x7f0000000000)=ANY=[], 0x20032600) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a0f, 0x1700) accept$inet(0xffffffffffffffff, &(0x7f0000000040)={0x2, 0x0, @local}, &(0x7f0000000080)=0x10) ioctl$TCSETAF(r0, 0x5408, &(0x7f0000000040)={0x2}) ioctl$EXT4_IOC_GROUP_ADD(r0, 0x40286608, &(0x7f0000000000)={0x3, 0x7000000, 0x400, 0x100000000, 0x0, 0x8}) r3 = fcntl$dupfd(r0, 0x406, r0) ioctl$EVIOCGVERSION(r3, 0x80044501, &(0x7f0000000200)=""/31) write$binfmt_misc(r0, &(0x7f0000000080)={'syz1', "80fa25cdc862d216160cfa92845a3916e38a409a159c03f1889971d3e5144a8d08de78c4b1fbee457437261d7668b1c0f582647ad4134a05358d4309a71a702002329e024cac95642e761bb842bc1056bd6bf12c47697a649a026bd8ee1f685089941469b1ddfeddf32b392f0ff07652a3bce0770bc3bb70862845a65054cecb191e80b825d740fe6b40450359757032425dfdee92aec36ce4b468d50adc745c522cc4af2ac6e7f6a95f0edd70b09caa95fcc7143cf46b74db8bc17fa7c89f"}, 0xc3) 14:03:51 executing program 5: r0 = openat$ptmx(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$TIOCSPTLCK(r0, 0x40045431, &(0x7f0000000180)) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) socket(0x200000000000011, 0x4000000000080002, 0x0) bind$packet(0xffffffffffffffff, 0x0, 0x0) sendmmsg(0xffffffffffffffff, &(0x7f0000007880)=[{{&(0x7f00000001c0)=@l2={0x1f, 0xbf53, {0x9, 0x7, 0xfffffffffffffdd5, 0x1ff, 0x2, 0x4}, 0x0, 0x7}, 0x80, 0x0}}, {{0x0, 0x0, &(0x7f0000007780)}}], 0x2, 0x4048851) setsockopt$packet_int(0xffffffffffffffff, 0x107, 0x0, 0x0, 0x0) syz_open_procfs(0x0, 0x0) ioctl$LOOP_SET_BLOCK_SIZE(0xffffffffffffffff, 0x4c09, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$cgroup_int(0xffffffffffffffff, 0x0, 0x2, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='\x89\x00\x00\x00\x00Ew\x00\x00\x00\xef\xb4\xc8\xd0\xff\xda\xb1vents\xd9\xc5H\xd4\x91\xfdN_]\x16\xe4\xa9C\xd2\x86Qn\xefS\x80\x11J\xfb4\x14\x86 4\x95\x9e\xfc\xc1\a\xcb \x95N\xe9\xa4j\xd2\x1f^\xb0\xb2>\xa3\xc9\xb7$\x11`t\x03: \x8b\xa4\x05\xf2?E\xdb+{t\xb8\xf7\xab\x8b\x100#', 0x26e1, 0x0) ioctl$PERF_EVENT_IOC_PAUSE_OUTPUT(r1, 0x40086602, 0x400007) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000280)='./cgroup/syz0\x00', 0x1ff) openat$smack_thread_current(0xffffffffffffff9c, &(0x7f0000000240)='/proc/thread-self/attr/current\x00', 0x2, 0x0) write$cgroup_subtree(r1, &(0x7f0000000100)=ANY=[], 0xff4a) write$cgroup_subtree(r2, &(0x7f0000000000)=ANY=[], 0x20032600) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a0f, 0x1700) accept$inet(0xffffffffffffffff, &(0x7f0000000040)={0x2, 0x0, @local}, &(0x7f0000000080)=0x10) ioctl$TCSETAF(r0, 0x5408, &(0x7f0000000040)={0x2}) ioctl$EXT4_IOC_GROUP_ADD(r0, 0x40286608, &(0x7f0000000000)={0x3, 0x7000000, 0x400, 0x100000000, 0x0, 0x8}) r3 = fcntl$dupfd(r0, 0x406, r0) ioctl$EVIOCGVERSION(r3, 0x80044501, &(0x7f0000000200)=""/31) write$binfmt_misc(r0, &(0x7f0000000080)={'syz1', "80fa25cdc862d216160cfa92845a3916e38a409a159c03f1889971d3e5144a8d08de78c4b1fbee457437261d7668b1c0f582647ad4134a05358d4309a71a702002329e024cac95642e761bb842bc1056bd6bf12c47697a649a026bd8ee1f685089941469b1ddfeddf32b392f0ff07652a3bce0770bc3bb70862845a65054cecb191e80b825d740fe6b40450359757032425dfdee92aec36ce4b468d50adc745c522cc4af2ac6e7f6a95f0edd70b09caa95fcc7143cf46b74db8bc17fa7c89f"}, 0xc3) 14:03:51 executing program 1: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSPTLCK(r0, 0x40045431, &(0x7f0000000180)) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) socket(0x200000000000011, 0x4000000000080002, 0x0) bind$packet(0xffffffffffffffff, 0x0, 0x0) sendmmsg(0xffffffffffffffff, &(0x7f0000007880)=[{{&(0x7f00000001c0)=@l2={0x1f, 0xbf53, {0x9, 0x7, 0xfffffffffffffdd5, 0x1ff, 0x2, 0x4}, 0x0, 0x7}, 0x80, 0x0}}, {{0x0, 0x0, &(0x7f0000007780)}}], 0x2, 0x4048851) syz_open_procfs(0x0, 0x0) ioctl$LOOP_SET_BLOCK_SIZE(0xffffffffffffffff, 0x4c09, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$cgroup_int(0xffffffffffffffff, 0x0, 0x2, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='\x89\x00\x00\x00\x00Ew\x00\x00\x00\xef\xb4\xc8\xd0\xff\xda\xb1vents\xd9\xc5H\xd4\x91\xfdN_]\x16\xe4\xa9C\xd2\x86Qn\xefS\x80\x11J\xfb4\x14\x86 4\x95\x9e\xfc\xc1\a\xcb \x95N\xe9\xa4j\xd2\x1f^\xb0\xb2>\xa3\xc9\xb7$\x11`t\x03: \x8b\xa4\x05\xf2?E\xdb+{t\xb8\xf7\xab\x8b\x100#', 0x26e1, 0x0) ioctl$PERF_EVENT_IOC_PAUSE_OUTPUT(r1, 0x40086602, 0x400007) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000280)='./cgroup/syz0\x00', 0x1ff) openat$smack_thread_current(0xffffffffffffff9c, &(0x7f0000000240)='/proc/thread-self/attr/current\x00', 0x2, 0x0) write$cgroup_subtree(r1, &(0x7f0000000100)=ANY=[], 0xff4a) write$cgroup_subtree(r2, &(0x7f0000000000)=ANY=[], 0x20032600) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a0f, 0x1700) accept$inet(0xffffffffffffffff, &(0x7f0000000040)={0x2, 0x0, @local}, &(0x7f0000000080)=0x10) ioctl$TCSETAF(r0, 0x5408, &(0x7f0000000040)={0x2}) ioctl$EVIOCGVERSION(0xffffffffffffffff, 0x80044501, &(0x7f0000000200)=""/31) 14:03:51 executing program 0: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSPTLCK(r0, 0x40045431, &(0x7f0000000180)) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) socket(0x200000000000011, 0x4000000000080002, 0x0) bind$packet(0xffffffffffffffff, 0x0, 0x0) sendmmsg(0xffffffffffffffff, &(0x7f0000007880)=[{{&(0x7f00000001c0)=@l2={0x1f, 0xbf53, {0x9, 0x7, 0xfffffffffffffdd5, 0x1ff, 0x2, 0x4}, 0x0, 0x7}, 0x80, 0x0}}, {{0x0, 0x0, &(0x7f0000007780)}}], 0x2, 0x4048851) syz_open_procfs(0x0, 0x0) ioctl$LOOP_SET_BLOCK_SIZE(0xffffffffffffffff, 0x4c09, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$cgroup_int(0xffffffffffffffff, 0x0, 0x2, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='\x89\x00\x00\x00\x00Ew\x00\x00\x00\xef\xb4\xc8\xd0\xff\xda\xb1vents\xd9\xc5H\xd4\x91\xfdN_]\x16\xe4\xa9C\xd2\x86Qn\xefS\x80\x11J\xfb4\x14\x86 4\x95\x9e\xfc\xc1\a\xcb \x95N\xe9\xa4j\xd2\x1f^\xb0\xb2>\xa3\xc9\xb7$\x11`t\x03: \x8b\xa4\x05\xf2?E\xdb+{t\xb8\xf7\xab\x8b\x100#', 0x26e1, 0x0) ioctl$PERF_EVENT_IOC_PAUSE_OUTPUT(r1, 0x40086602, 0x400007) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000280)='./cgroup/syz0\x00', 0x1ff) openat$smack_thread_current(0xffffffffffffff9c, &(0x7f0000000240)='/proc/thread-self/attr/current\x00', 0x2, 0x0) write$cgroup_subtree(r1, &(0x7f0000000100)=ANY=[], 0xff4a) write$cgroup_subtree(r2, &(0x7f0000000000)=ANY=[], 0x20032600) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a0f, 0x1700) accept$inet(0xffffffffffffffff, &(0x7f0000000040)={0x2, 0x0, @local}, &(0x7f0000000080)=0x10) ioctl$TCSETAF(r0, 0x5408, &(0x7f0000000040)={0x2}) ioctl$EXT4_IOC_GROUP_ADD(r0, 0x40286608, &(0x7f0000000000)={0x3, 0x7000000, 0x400, 0x100000000, 0x0, 0x8}) fcntl$dupfd(r0, 0x406, r0) 14:03:51 executing program 4: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSPTLCK(r0, 0x40045431, &(0x7f0000000180)) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) socket(0x200000000000011, 0x4000000000080002, 0x0) bind$packet(0xffffffffffffffff, 0x0, 0x0) sendmmsg(0xffffffffffffffff, &(0x7f0000007880)=[{{&(0x7f00000001c0)=@l2={0x1f, 0xbf53, {0x9, 0x7, 0xfffffffffffffdd5, 0x1ff, 0x2, 0x4}, 0x0, 0x7}, 0x80, 0x0}}, {{0x0, 0x0, &(0x7f0000007780)}}], 0x2, 0x4048851) syz_open_procfs(0x0, 0x0) ioctl$LOOP_SET_BLOCK_SIZE(0xffffffffffffffff, 0x4c09, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$cgroup_int(0xffffffffffffffff, 0x0, 0x2, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='\x89\x00\x00\x00\x00Ew\x00\x00\x00\xef\xb4\xc8\xd0\xff\xda\xb1vents\xd9\xc5H\xd4\x91\xfdN_]\x16\xe4\xa9C\xd2\x86Qn\xefS\x80\x11J\xfb4\x14\x86 4\x95\x9e\xfc\xc1\a\xcb \x95N\xe9\xa4j\xd2\x1f^\xb0\xb2>\xa3\xc9\xb7$\x11`t\x03: \x8b\xa4\x05\xf2?E\xdb+{t\xb8\xf7\xab\x8b\x100#', 0x26e1, 0x0) ioctl$PERF_EVENT_IOC_PAUSE_OUTPUT(r1, 0x40086602, 0x400007) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000280)='./cgroup/syz0\x00', 0x1ff) openat$smack_thread_current(0xffffffffffffff9c, &(0x7f0000000240)='/proc/thread-self/attr/current\x00', 0x2, 0x0) write$cgroup_subtree(r1, &(0x7f0000000100)=ANY=[], 0xff4a) write$cgroup_subtree(r2, &(0x7f0000000000)=ANY=[], 0x20032600) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a0f, 0x1700) accept$inet(0xffffffffffffffff, &(0x7f0000000040)={0x2, 0x0, @local}, &(0x7f0000000080)=0x10) ioctl$TCSETAF(r0, 0x5408, &(0x7f0000000040)={0x2}) ioctl$EXT4_IOC_GROUP_ADD(r0, 0x40286608, &(0x7f0000000000)={0x3, 0x7000000, 0x400, 0x100000000, 0x0, 0x8}) ioctl$EVIOCGVERSION(0xffffffffffffffff, 0x80044501, &(0x7f0000000200)=""/31) 14:03:51 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = openat$pfkey(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/net/pfkey\x00', 0x1, 0x0) setsockopt$ARPT_SO_SET_ADD_COUNTERS(r1, 0x0, 0x61, &(0x7f0000000040)={'filter\x00', 0x4}, 0x68) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f00000001c0)=[@acquire], 0x0, 0x0, 0x0}) ioctl$sock_inet_udp_SIOCOUTQ(r1, 0x5411, &(0x7f00000000c0)) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) fadvise64(r0, 0x0, 0x5, 0x6) [ 337.766487] binder: 10559:10564 BC_REQUEST_DEATH_NOTIFICATION invalid ref 16777216 [ 337.766497] binder: 10559:10564 unknown command 0 [ 337.766506] binder: 10559:10564 ioctl c0306201 20008fd0 returned -22 14:03:51 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f00000001c0)=[@acquire], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) 14:03:51 executing program 3: syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x4) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f00000001c0)=[@acquire], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) 14:03:51 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSPTLCK(0xffffffffffffffff, 0x40045431, &(0x7f0000000180)) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) socket(0x200000000000011, 0x4000000000080002, 0x0) bind$packet(0xffffffffffffffff, 0x0, 0x0) sendmmsg(0xffffffffffffffff, &(0x7f0000007880)=[{{&(0x7f00000001c0)=@l2={0x1f, 0xbf53, {0x9, 0x7, 0xfffffffffffffdd5, 0x1ff, 0x2, 0x4}, 0x0, 0x7}, 0x80, 0x0}}, {{0x0, 0x0, &(0x7f0000007780)}}], 0x2, 0x4048851) setsockopt$packet_int(0xffffffffffffffff, 0x107, 0x0, 0x0, 0x0) syz_open_procfs(0x0, 0x0) ioctl$LOOP_SET_BLOCK_SIZE(0xffffffffffffffff, 0x4c09, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$cgroup_int(0xffffffffffffffff, 0x0, 0x2, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='\x89\x00\x00\x00\x00Ew\x00\x00\x00\xef\xb4\xc8\xd0\xff\xda\xb1vents\xd9\xc5H\xd4\x91\xfdN_]\x16\xe4\xa9C\xd2\x86Qn\xefS\x80\x11J\xfb4\x14\x86 4\x95\x9e\xfc\xc1\a\xcb \x95N\xe9\xa4j\xd2\x1f^\xb0\xb2>\xa3\xc9\xb7$\x11`t\x03: \x8b\xa4\x05\xf2?E\xdb+{t\xb8\xf7\xab\x8b\x100#', 0x26e1, 0x0) ioctl$PERF_EVENT_IOC_PAUSE_OUTPUT(r1, 0x40086602, 0x400007) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000280)='./cgroup/syz0\x00', 0x1ff) openat$smack_thread_current(0xffffffffffffff9c, &(0x7f0000000240)='/proc/thread-self/attr/current\x00', 0x2, 0x0) write$cgroup_subtree(r1, &(0x7f0000000100)=ANY=[], 0xff4a) write$cgroup_subtree(r2, &(0x7f0000000000)=ANY=[], 0x20032600) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a0f, 0x1700) accept$inet(0xffffffffffffffff, &(0x7f0000000040)={0x2, 0x0, @local}, &(0x7f0000000080)=0x10) ioctl$TCSETAF(r0, 0x5408, &(0x7f0000000040)={0x2}) ioctl$EXT4_IOC_GROUP_ADD(r0, 0x40286608, &(0x7f0000000000)={0x3, 0x7000000, 0x400, 0x100000000, 0x0, 0x8}) r3 = fcntl$dupfd(r0, 0x406, r0) ioctl$EVIOCGVERSION(r3, 0x80044501, &(0x7f0000000200)=""/31) write$binfmt_misc(r0, &(0x7f0000000080)={'syz1', "80fa25cdc862d216160cfa92845a3916e38a409a159c03f1889971d3e5144a8d08de78c4b1fbee457437261d7668b1c0f582647ad4134a05358d4309a71a702002329e024cac95642e761bb842bc1056bd6bf12c47697a649a026bd8ee1f685089941469b1ddfeddf32b392f0ff07652a3bce0770bc3bb70862845a65054cecb191e80b825d740fe6b40450359757032425dfdee92aec36ce4b468d50adc745c522cc4af2ac6e7f6a95f0edd70b09caa95fcc7143cf46b74db8bc17fa7c89f"}, 0xc3) 14:03:51 executing program 4: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSPTLCK(0xffffffffffffffff, 0x40045431, &(0x7f0000000180)) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) socket(0x200000000000011, 0x4000000000080002, 0x0) bind$packet(0xffffffffffffffff, 0x0, 0x0) sendmmsg(0xffffffffffffffff, &(0x7f0000007880)=[{{&(0x7f00000001c0)=@l2={0x1f, 0xbf53, {0x9, 0x7, 0xfffffffffffffdd5, 0x1ff, 0x2, 0x4}, 0x0, 0x7}, 0x80, 0x0}}, {{0x0, 0x0, &(0x7f0000007780)}}], 0x2, 0x4048851) setsockopt$packet_int(0xffffffffffffffff, 0x107, 0x0, 0x0, 0x0) syz_open_procfs(0x0, 0x0) ioctl$LOOP_SET_BLOCK_SIZE(0xffffffffffffffff, 0x4c09, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$cgroup_int(0xffffffffffffffff, 0x0, 0x2, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='\x89\x00\x00\x00\x00Ew\x00\x00\x00\xef\xb4\xc8\xd0\xff\xda\xb1vents\xd9\xc5H\xd4\x91\xfdN_]\x16\xe4\xa9C\xd2\x86Qn\xefS\x80\x11J\xfb4\x14\x86 4\x95\x9e\xfc\xc1\a\xcb \x95N\xe9\xa4j\xd2\x1f^\xb0\xb2>\xa3\xc9\xb7$\x11`t\x03: \x8b\xa4\x05\xf2?E\xdb+{t\xb8\xf7\xab\x8b\x100#', 0x26e1, 0x0) ioctl$PERF_EVENT_IOC_PAUSE_OUTPUT(r1, 0x40086602, 0x400007) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000280)='./cgroup/syz0\x00', 0x1ff) openat$smack_thread_current(0xffffffffffffff9c, &(0x7f0000000240)='/proc/thread-self/attr/current\x00', 0x2, 0x0) write$cgroup_subtree(r1, &(0x7f0000000100)=ANY=[], 0xff4a) write$cgroup_subtree(r2, &(0x7f0000000000)=ANY=[], 0x20032600) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a0f, 0x1700) accept$inet(0xffffffffffffffff, &(0x7f0000000040)={0x2, 0x0, @local}, &(0x7f0000000080)=0x10) ioctl$TCSETAF(r0, 0x5408, &(0x7f0000000040)={0x2}) ioctl$EXT4_IOC_GROUP_ADD(r0, 0x40286608, &(0x7f0000000000)={0x3, 0x7000000, 0x400, 0x100000000, 0x0, 0x8}) r3 = fcntl$dupfd(r0, 0x406, r0) ioctl$EVIOCGVERSION(r3, 0x80044501, &(0x7f0000000200)=""/31) write$binfmt_misc(r0, &(0x7f0000000080)={'syz1', "80fa25cdc862d216160cfa92845a3916e38a409a159c03f1889971d3e5144a8d08de78c4b1fbee457437261d7668b1c0f582647ad4134a05358d4309a71a702002329e024cac95642e761bb842bc1056bd6bf12c47697a649a026bd8ee1f685089941469b1ddfeddf32b392f0ff07652a3bce0770bc3bb70862845a65054cecb191e80b825d740fe6b40450359757032425dfdee92aec36ce4b468d50adc745c522cc4af2ac6e7f6a95f0edd70b09caa95fcc7143cf46b74db8bc17fa7c89f"}, 0xc3) 14:03:51 executing program 5: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSPTLCK(0xffffffffffffffff, 0x40045431, &(0x7f0000000180)) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) socket(0x200000000000011, 0x4000000000080002, 0x0) bind$packet(0xffffffffffffffff, 0x0, 0x0) sendmmsg(0xffffffffffffffff, &(0x7f0000007880)=[{{&(0x7f00000001c0)=@l2={0x1f, 0xbf53, {0x9, 0x7, 0xfffffffffffffdd5, 0x1ff, 0x2, 0x4}, 0x0, 0x7}, 0x80, 0x0}}, {{0x0, 0x0, &(0x7f0000007780)}}], 0x2, 0x4048851) setsockopt$packet_int(0xffffffffffffffff, 0x107, 0x0, 0x0, 0x0) syz_open_procfs(0x0, 0x0) ioctl$LOOP_SET_BLOCK_SIZE(0xffffffffffffffff, 0x4c09, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$cgroup_int(0xffffffffffffffff, 0x0, 0x2, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='\x89\x00\x00\x00\x00Ew\x00\x00\x00\xef\xb4\xc8\xd0\xff\xda\xb1vents\xd9\xc5H\xd4\x91\xfdN_]\x16\xe4\xa9C\xd2\x86Qn\xefS\x80\x11J\xfb4\x14\x86 4\x95\x9e\xfc\xc1\a\xcb \x95N\xe9\xa4j\xd2\x1f^\xb0\xb2>\xa3\xc9\xb7$\x11`t\x03: \x8b\xa4\x05\xf2?E\xdb+{t\xb8\xf7\xab\x8b\x100#', 0x26e1, 0x0) ioctl$PERF_EVENT_IOC_PAUSE_OUTPUT(r1, 0x40086602, 0x400007) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000280)='./cgroup/syz0\x00', 0x1ff) openat$smack_thread_current(0xffffffffffffff9c, &(0x7f0000000240)='/proc/thread-self/attr/current\x00', 0x2, 0x0) write$cgroup_subtree(r1, &(0x7f0000000100)=ANY=[], 0xff4a) write$cgroup_subtree(r2, &(0x7f0000000000)=ANY=[], 0x20032600) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a0f, 0x1700) accept$inet(0xffffffffffffffff, &(0x7f0000000040)={0x2, 0x0, @local}, &(0x7f0000000080)=0x10) ioctl$TCSETAF(r0, 0x5408, &(0x7f0000000040)={0x2}) ioctl$EXT4_IOC_GROUP_ADD(r0, 0x40286608, &(0x7f0000000000)={0x3, 0x7000000, 0x400, 0x100000000, 0x0, 0x8}) r3 = fcntl$dupfd(r0, 0x406, r0) ioctl$EVIOCGVERSION(r3, 0x80044501, &(0x7f0000000200)=""/31) write$binfmt_misc(r0, &(0x7f0000000080)={'syz1', "80fa25cdc862d216160cfa92845a3916e38a409a159c03f1889971d3e5144a8d08de78c4b1fbee457437261d7668b1c0f582647ad4134a05358d4309a71a702002329e024cac95642e761bb842bc1056bd6bf12c47697a649a026bd8ee1f685089941469b1ddfeddf32b392f0ff07652a3bce0770bc3bb70862845a65054cecb191e80b825d740fe6b40450359757032425dfdee92aec36ce4b468d50adc745c522cc4af2ac6e7f6a95f0edd70b09caa95fcc7143cf46b74db8bc17fa7c89f"}, 0xc3) 14:03:51 executing program 0: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSPTLCK(r0, 0x40045431, &(0x7f0000000180)) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) socket(0x200000000000011, 0x4000000000080002, 0x0) bind$packet(0xffffffffffffffff, 0x0, 0x0) sendmmsg(0xffffffffffffffff, &(0x7f0000007880)=[{{&(0x7f00000001c0)=@l2={0x1f, 0xbf53, {0x9, 0x7, 0xfffffffffffffdd5, 0x1ff, 0x2, 0x4}, 0x0, 0x7}, 0x80, 0x0}}, {{0x0, 0x0, &(0x7f0000007780)}}], 0x2, 0x4048851) setsockopt$packet_int(0xffffffffffffffff, 0x107, 0x0, 0x0, 0x0) syz_open_procfs(0x0, 0x0) ioctl$LOOP_SET_BLOCK_SIZE(0xffffffffffffffff, 0x4c09, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='\x89\x00\x00\x00\x00Ew\x00\x00\x00\xef\xb4\xc8\xd0\xff\xda\xb1vents\xd9\xc5H\xd4\x91\xfdN_]\x16\xe4\xa9C\xd2\x86Qn\xefS\x80\x11J\xfb4\x14\x86 4\x95\x9e\xfc\xc1\a\xcb \x95N\xe9\xa4j\xd2\x1f^\xb0\xb2>\xa3\xc9\xb7$\x11`t\x03: \x8b\xa4\x05\xf2?E\xdb+{t\xb8\xf7\xab\x8b\x100#', 0x26e1, 0x0) ioctl$PERF_EVENT_IOC_PAUSE_OUTPUT(r1, 0x40086602, 0x400007) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000280)='./cgroup/syz0\x00', 0x1ff) openat$smack_thread_current(0xffffffffffffff9c, &(0x7f0000000240)='/proc/thread-self/attr/current\x00', 0x2, 0x0) write$cgroup_subtree(r1, &(0x7f0000000100)=ANY=[], 0xff4a) write$cgroup_subtree(r2, &(0x7f0000000000)=ANY=[], 0x20032600) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a0f, 0x1700) accept$inet(0xffffffffffffffff, &(0x7f0000000040)={0x2, 0x0, @local}, &(0x7f0000000080)=0x10) ioctl$TCSETAF(r0, 0x5408, &(0x7f0000000040)={0x2}) ioctl$EXT4_IOC_GROUP_ADD(r0, 0x40286608, &(0x7f0000000000)={0x3, 0x7000000, 0x400, 0x100000000, 0x0, 0x8}) r3 = fcntl$dupfd(r0, 0x406, r0) ioctl$EVIOCGVERSION(r3, 0x80044501, &(0x7f0000000200)=""/31) write$binfmt_misc(r0, &(0x7f0000000080)={'syz1', "80fa25cdc862d216160cfa92845a3916e38a409a159c03f1889971d3e5144a8d08de78c4b1fbee457437261d7668b1c0f582647ad4134a05358d4309a71a702002329e024cac95642e761bb842bc1056bd6bf12c47697a649a026bd8ee1f685089941469b1ddfeddf32b392f0ff07652a3bce0770bc3bb70862845a65054cecb191e80b825d740fe6b40450359757032425dfdee92aec36ce4b468d50adc745c522cc4af2ac6e7f6a95f0edd70b09caa95fcc7143cf46b74db8bc17fa7c89f"}, 0xc3) 14:03:51 executing program 1: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSPTLCK(r0, 0x40045431, &(0x7f0000000180)) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) socket(0x200000000000011, 0x4000000000080002, 0x0) bind$packet(0xffffffffffffffff, 0x0, 0x0) sendmmsg(0xffffffffffffffff, &(0x7f0000007880)=[{{&(0x7f00000001c0)=@l2={0x1f, 0xbf53, {0x9, 0x7, 0xfffffffffffffdd5, 0x1ff, 0x2, 0x4}, 0x0, 0x7}, 0x80, 0x0}}, {{0x0, 0x0, &(0x7f0000007780)}}], 0x2, 0x4048851) syz_open_procfs(0x0, 0x0) ioctl$LOOP_SET_BLOCK_SIZE(0xffffffffffffffff, 0x4c09, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$cgroup_int(0xffffffffffffffff, 0x0, 0x2, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='\x89\x00\x00\x00\x00Ew\x00\x00\x00\xef\xb4\xc8\xd0\xff\xda\xb1vents\xd9\xc5H\xd4\x91\xfdN_]\x16\xe4\xa9C\xd2\x86Qn\xefS\x80\x11J\xfb4\x14\x86 4\x95\x9e\xfc\xc1\a\xcb \x95N\xe9\xa4j\xd2\x1f^\xb0\xb2>\xa3\xc9\xb7$\x11`t\x03: \x8b\xa4\x05\xf2?E\xdb+{t\xb8\xf7\xab\x8b\x100#', 0x26e1, 0x0) ioctl$PERF_EVENT_IOC_PAUSE_OUTPUT(r1, 0x40086602, 0x400007) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000280)='./cgroup/syz0\x00', 0x1ff) openat$smack_thread_current(0xffffffffffffff9c, &(0x7f0000000240)='/proc/thread-self/attr/current\x00', 0x2, 0x0) write$cgroup_subtree(r1, &(0x7f0000000100)=ANY=[], 0xff4a) write$cgroup_subtree(r2, &(0x7f0000000000)=ANY=[], 0x20032600) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a0f, 0x1700) accept$inet(0xffffffffffffffff, &(0x7f0000000040)={0x2, 0x0, @local}, &(0x7f0000000080)=0x10) ioctl$TCSETAF(r0, 0x5408, &(0x7f0000000040)={0x2}) ioctl$EVIOCGVERSION(0xffffffffffffffff, 0x80044501, &(0x7f0000000200)=""/31) [ 337.966096] binder: 10591:10592 Acquire 1 refcount change on invalid ref 0 ret -22 [ 337.976483] binder: 10591:10592 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 14:03:51 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0x0, 0x2080003) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f00000001c0)=[@acquire], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) r2 = dup2(r0, r0) ioctl$UI_GET_VERSION(r2, 0x8004552d, &(0x7f0000000000)) [ 338.020846] binder: 10591:10596 Acquire 1 refcount change on invalid ref 0 ret -22 14:03:51 executing program 3: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSPTLCK(r0, 0x40045431, &(0x7f0000000180)) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) socket(0x200000000000011, 0x4000000000080002, 0x0) bind$packet(0xffffffffffffffff, 0x0, 0x0) sendmmsg(0xffffffffffffffff, &(0x7f0000007880)=[{{&(0x7f00000001c0)=@l2={0x1f, 0xbf53, {0x9, 0x7, 0xfffffffffffffdd5, 0x1ff, 0x2, 0x4}, 0x0, 0x7}, 0x80, 0x0}}, {{0x0, 0x0, &(0x7f0000007780)}}], 0x2, 0x4048851) syz_open_procfs(0x0, 0x0) ioctl$LOOP_SET_BLOCK_SIZE(0xffffffffffffffff, 0x4c09, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$cgroup_int(0xffffffffffffffff, 0x0, 0x2, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='\x89\x00\x00\x00\x00Ew\x00\x00\x00\xef\xb4\xc8\xd0\xff\xda\xb1vents\xd9\xc5H\xd4\x91\xfdN_]\x16\xe4\xa9C\xd2\x86Qn\xefS\x80\x11J\xfb4\x14\x86 4\x95\x9e\xfc\xc1\a\xcb \x95N\xe9\xa4j\xd2\x1f^\xb0\xb2>\xa3\xc9\xb7$\x11`t\x03: \x8b\xa4\x05\xf2?E\xdb+{t\xb8\xf7\xab\x8b\x100#', 0x26e1, 0x0) ioctl$PERF_EVENT_IOC_PAUSE_OUTPUT(r1, 0x40086602, 0x400007) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000280)='./cgroup/syz0\x00', 0x1ff) openat$smack_thread_current(0xffffffffffffff9c, &(0x7f0000000240)='/proc/thread-self/attr/current\x00', 0x2, 0x0) write$cgroup_subtree(r1, &(0x7f0000000100)=ANY=[], 0xff4a) write$cgroup_subtree(r2, &(0x7f0000000000)=ANY=[], 0x20032600) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a0f, 0x1700) accept$inet(0xffffffffffffffff, &(0x7f0000000040)={0x2, 0x0, @local}, &(0x7f0000000080)=0x10) ioctl$TCSETAF(r0, 0x5408, &(0x7f0000000040)={0x2}) ioctl$EVIOCGVERSION(0xffffffffffffffff, 0x80044501, &(0x7f0000000200)=""/31) [ 338.103894] binder: 10610:10611 ioctl 8004552d 20000000 returned -22 [ 338.138876] binder: 10610:10612 ioctl 8004552d 20000000 returned -22 14:03:51 executing program 5: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSPTLCK(r0, 0x40045431, &(0x7f0000000180)) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) socket(0x200000000000011, 0x4000000000080002, 0x0) bind$packet(0xffffffffffffffff, 0x0, 0x0) sendmmsg(0xffffffffffffffff, &(0x7f0000007880)=[{{&(0x7f00000001c0)=@l2={0x1f, 0xbf53, {0x9, 0x7, 0xfffffffffffffdd5, 0x1ff, 0x2, 0x4}, 0x0, 0x7}, 0x80, 0x0}}, {{0x0, 0x0, &(0x7f0000007780)}}], 0x2, 0x4048851) setsockopt$packet_int(0xffffffffffffffff, 0x107, 0x0, 0x0, 0x0) syz_open_procfs(0x0, 0x0) ioctl$LOOP_SET_BLOCK_SIZE(0xffffffffffffffff, 0x4c09, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='\x89\x00\x00\x00\x00Ew\x00\x00\x00\xef\xb4\xc8\xd0\xff\xda\xb1vents\xd9\xc5H\xd4\x91\xfdN_]\x16\xe4\xa9C\xd2\x86Qn\xefS\x80\x11J\xfb4\x14\x86 4\x95\x9e\xfc\xc1\a\xcb \x95N\xe9\xa4j\xd2\x1f^\xb0\xb2>\xa3\xc9\xb7$\x11`t\x03: \x8b\xa4\x05\xf2?E\xdb+{t\xb8\xf7\xab\x8b\x100#', 0x26e1, 0x0) ioctl$PERF_EVENT_IOC_PAUSE_OUTPUT(r1, 0x40086602, 0x400007) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000280)='./cgroup/syz0\x00', 0x1ff) openat$smack_thread_current(0xffffffffffffff9c, &(0x7f0000000240)='/proc/thread-self/attr/current\x00', 0x2, 0x0) write$cgroup_subtree(r1, &(0x7f0000000100)=ANY=[], 0xff4a) write$cgroup_subtree(r2, &(0x7f0000000000)=ANY=[], 0x20032600) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a0f, 0x1700) accept$inet(0xffffffffffffffff, &(0x7f0000000040)={0x2, 0x0, @local}, &(0x7f0000000080)=0x10) ioctl$TCSETAF(r0, 0x5408, &(0x7f0000000040)={0x2}) ioctl$EXT4_IOC_GROUP_ADD(r0, 0x40286608, &(0x7f0000000000)={0x3, 0x7000000, 0x400, 0x100000000, 0x0, 0x8}) r3 = fcntl$dupfd(r0, 0x406, r0) ioctl$EVIOCGVERSION(r3, 0x80044501, &(0x7f0000000200)=""/31) write$binfmt_misc(r0, &(0x7f0000000080)={'syz1', "80fa25cdc862d216160cfa92845a3916e38a409a159c03f1889971d3e5144a8d08de78c4b1fbee457437261d7668b1c0f582647ad4134a05358d4309a71a702002329e024cac95642e761bb842bc1056bd6bf12c47697a649a026bd8ee1f685089941469b1ddfeddf32b392f0ff07652a3bce0770bc3bb70862845a65054cecb191e80b825d740fe6b40450359757032425dfdee92aec36ce4b468d50adc745c522cc4af2ac6e7f6a95f0edd70b09caa95fcc7143cf46b74db8bc17fa7c89f"}, 0xc3) 14:03:51 executing program 0: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSWINSZ(r0, 0x5414, &(0x7f0000000000)={0x4, 0x3, 0xdb, 0x3}) ioctl$TCFLSH(r0, 0x540b, 0x2) 14:03:51 executing program 4: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSPTLCK(r0, 0x40045431, &(0x7f0000000180)) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) socket(0x200000000000011, 0x4000000000080002, 0x0) bind$packet(0xffffffffffffffff, 0x0, 0x0) sendmmsg(0xffffffffffffffff, &(0x7f0000007880)=[{{&(0x7f00000001c0)=@l2={0x1f, 0xbf53, {0x9, 0x7, 0xfffffffffffffdd5, 0x1ff, 0x2, 0x4}, 0x0, 0x7}, 0x80, 0x0}}, {{0x0, 0x0, &(0x7f0000007780)}}], 0x2, 0x4048851) setsockopt$packet_int(0xffffffffffffffff, 0x107, 0x0, 0x0, 0x0) syz_open_procfs(0x0, 0x0) ioctl$LOOP_SET_BLOCK_SIZE(0xffffffffffffffff, 0x4c09, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$cgroup_int(0xffffffffffffffff, 0x0, 0x2, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='\x89\x00\x00\x00\x00Ew\x00\x00\x00\xef\xb4\xc8\xd0\xff\xda\xb1vents\xd9\xc5H\xd4\x91\xfdN_]\x16\xe4\xa9C\xd2\x86Qn\xefS\x80\x11J\xfb4\x14\x86 4\x95\x9e\xfc\xc1\a\xcb \x95N\xe9\xa4j\xd2\x1f^\xb0\xb2>\xa3\xc9\xb7$\x11`t\x03: \x8b\xa4\x05\xf2?E\xdb+{t\xb8\xf7\xab\x8b\x100#', 0x26e1, 0x0) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000280)='./cgroup/syz0\x00', 0x1ff) openat$smack_thread_current(0xffffffffffffff9c, &(0x7f0000000240)='/proc/thread-self/attr/current\x00', 0x2, 0x0) write$cgroup_subtree(r1, &(0x7f0000000100)=ANY=[], 0xff4a) write$cgroup_subtree(r2, &(0x7f0000000000)=ANY=[], 0x20032600) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a0f, 0x1700) accept$inet(0xffffffffffffffff, &(0x7f0000000040)={0x2, 0x0, @local}, &(0x7f0000000080)=0x10) ioctl$TCSETAF(r0, 0x5408, &(0x7f0000000040)={0x2}) ioctl$EXT4_IOC_GROUP_ADD(r0, 0x40286608, &(0x7f0000000000)={0x3, 0x7000000, 0x400, 0x100000000, 0x0, 0x8}) r3 = fcntl$dupfd(r0, 0x406, r0) ioctl$EVIOCGVERSION(r3, 0x80044501, &(0x7f0000000200)=""/31) write$binfmt_misc(r0, &(0x7f0000000080)={'syz1', "80fa25cdc862d216160cfa92845a3916e38a409a159c03f1889971d3e5144a8d08de78c4b1fbee457437261d7668b1c0f582647ad4134a05358d4309a71a702002329e024cac95642e761bb842bc1056bd6bf12c47697a649a026bd8ee1f685089941469b1ddfeddf32b392f0ff07652a3bce0770bc3bb70862845a65054cecb191e80b825d740fe6b40450359757032425dfdee92aec36ce4b468d50adc745c522cc4af2ac6e7f6a95f0edd70b09caa95fcc7143cf46b74db8bc17fa7c89f"}, 0xc3) 14:03:51 executing program 1: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSPTLCK(r0, 0x40045431, &(0x7f0000000180)) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) socket(0x200000000000011, 0x4000000000080002, 0x0) bind$packet(0xffffffffffffffff, 0x0, 0x0) sendmmsg(0xffffffffffffffff, &(0x7f0000007880)=[{{&(0x7f00000001c0)=@l2={0x1f, 0xbf53, {0x9, 0x7, 0xfffffffffffffdd5, 0x1ff, 0x2, 0x4}, 0x0, 0x7}, 0x80, 0x0}}, {{0x0, 0x0, &(0x7f0000007780)}}], 0x2, 0x4048851) syz_open_procfs(0x0, 0x0) ioctl$LOOP_SET_BLOCK_SIZE(0xffffffffffffffff, 0x4c09, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$cgroup_int(0xffffffffffffffff, 0x0, 0x2, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='\x89\x00\x00\x00\x00Ew\x00\x00\x00\xef\xb4\xc8\xd0\xff\xda\xb1vents\xd9\xc5H\xd4\x91\xfdN_]\x16\xe4\xa9C\xd2\x86Qn\xefS\x80\x11J\xfb4\x14\x86 4\x95\x9e\xfc\xc1\a\xcb \x95N\xe9\xa4j\xd2\x1f^\xb0\xb2>\xa3\xc9\xb7$\x11`t\x03: \x8b\xa4\x05\xf2?E\xdb+{t\xb8\xf7\xab\x8b\x100#', 0x26e1, 0x0) ioctl$PERF_EVENT_IOC_PAUSE_OUTPUT(r1, 0x40086602, 0x400007) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000280)='./cgroup/syz0\x00', 0x1ff) openat$smack_thread_current(0xffffffffffffff9c, &(0x7f0000000240)='/proc/thread-self/attr/current\x00', 0x2, 0x0) write$cgroup_subtree(r1, &(0x7f0000000100)=ANY=[], 0xff4a) write$cgroup_subtree(r2, &(0x7f0000000000)=ANY=[], 0x20032600) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a0f, 0x1700) accept$inet(0xffffffffffffffff, &(0x7f0000000040)={0x2, 0x0, @local}, &(0x7f0000000080)=0x10) ioctl$TCSETAF(r0, 0x5408, &(0x7f0000000040)={0x2}) ioctl$EVIOCGVERSION(0xffffffffffffffff, 0x80044501, &(0x7f0000000200)=""/31) 14:03:51 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSPTLCK(0xffffffffffffffff, 0x40045431, &(0x7f0000000180)) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) socket(0x200000000000011, 0x4000000000080002, 0x0) bind$packet(0xffffffffffffffff, 0x0, 0x0) sendmmsg(0xffffffffffffffff, &(0x7f0000007880)=[{{&(0x7f00000001c0)=@l2={0x1f, 0xbf53, {0x9, 0x7, 0xfffffffffffffdd5, 0x1ff, 0x2, 0x4}, 0x0, 0x7}, 0x80, 0x0}}, {{0x0, 0x0, &(0x7f0000007780)}}], 0x2, 0x4048851) setsockopt$packet_int(0xffffffffffffffff, 0x107, 0x0, 0x0, 0x0) syz_open_procfs(0x0, 0x0) ioctl$LOOP_SET_BLOCK_SIZE(0xffffffffffffffff, 0x4c09, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$cgroup_int(0xffffffffffffffff, 0x0, 0x2, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='\x89\x00\x00\x00\x00Ew\x00\x00\x00\xef\xb4\xc8\xd0\xff\xda\xb1vents\xd9\xc5H\xd4\x91\xfdN_]\x16\xe4\xa9C\xd2\x86Qn\xefS\x80\x11J\xfb4\x14\x86 4\x95\x9e\xfc\xc1\a\xcb \x95N\xe9\xa4j\xd2\x1f^\xb0\xb2>\xa3\xc9\xb7$\x11`t\x03: \x8b\xa4\x05\xf2?E\xdb+{t\xb8\xf7\xab\x8b\x100#', 0x26e1, 0x0) ioctl$PERF_EVENT_IOC_PAUSE_OUTPUT(r1, 0x40086602, 0x400007) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000280)='./cgroup/syz0\x00', 0x1ff) openat$smack_thread_current(0xffffffffffffff9c, &(0x7f0000000240)='/proc/thread-self/attr/current\x00', 0x2, 0x0) write$cgroup_subtree(r1, &(0x7f0000000100)=ANY=[], 0xff4a) write$cgroup_subtree(r2, &(0x7f0000000000)=ANY=[], 0x20032600) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a0f, 0x1700) accept$inet(0xffffffffffffffff, &(0x7f0000000040)={0x2, 0x0, @local}, &(0x7f0000000080)=0x10) ioctl$TCSETAF(r0, 0x5408, &(0x7f0000000040)={0x2}) ioctl$EXT4_IOC_GROUP_ADD(r0, 0x40286608, &(0x7f0000000000)={0x3, 0x7000000, 0x400, 0x100000000, 0x0, 0x8}) r3 = fcntl$dupfd(r0, 0x406, r0) ioctl$EVIOCGVERSION(r3, 0x80044501, &(0x7f0000000200)=""/31) write$binfmt_misc(r0, &(0x7f0000000080)={'syz1', "80fa25cdc862d216160cfa92845a3916e38a409a159c03f1889971d3e5144a8d08de78c4b1fbee457437261d7668b1c0f582647ad4134a05358d4309a71a702002329e024cac95642e761bb842bc1056bd6bf12c47697a649a026bd8ee1f685089941469b1ddfeddf32b392f0ff07652a3bce0770bc3bb70862845a65054cecb191e80b825d740fe6b40450359757032425dfdee92aec36ce4b468d50adc745c522cc4af2ac6e7f6a95f0edd70b09caa95fcc7143cf46b74db8bc17fa7c89f"}, 0xc3) 14:03:51 executing program 3: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSPTLCK(0xffffffffffffffff, 0x40045431, &(0x7f0000000180)) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) socket(0x200000000000011, 0x4000000000080002, 0x0) bind$packet(0xffffffffffffffff, 0x0, 0x0) sendmmsg(0xffffffffffffffff, &(0x7f0000007880)=[{{&(0x7f00000001c0)=@l2={0x1f, 0xbf53, {0x9, 0x7, 0xfffffffffffffdd5, 0x1ff, 0x2, 0x4}, 0x0, 0x7}, 0x80, 0x0}}, {{0x0, 0x0, &(0x7f0000007780)}}], 0x2, 0x4048851) setsockopt$packet_int(0xffffffffffffffff, 0x107, 0x0, 0x0, 0x0) syz_open_procfs(0x0, 0x0) ioctl$LOOP_SET_BLOCK_SIZE(0xffffffffffffffff, 0x4c09, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$cgroup_int(0xffffffffffffffff, 0x0, 0x2, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='\x89\x00\x00\x00\x00Ew\x00\x00\x00\xef\xb4\xc8\xd0\xff\xda\xb1vents\xd9\xc5H\xd4\x91\xfdN_]\x16\xe4\xa9C\xd2\x86Qn\xefS\x80\x11J\xfb4\x14\x86 4\x95\x9e\xfc\xc1\a\xcb \x95N\xe9\xa4j\xd2\x1f^\xb0\xb2>\xa3\xc9\xb7$\x11`t\x03: \x8b\xa4\x05\xf2?E\xdb+{t\xb8\xf7\xab\x8b\x100#', 0x26e1, 0x0) ioctl$PERF_EVENT_IOC_PAUSE_OUTPUT(r1, 0x40086602, 0x400007) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000280)='./cgroup/syz0\x00', 0x1ff) openat$smack_thread_current(0xffffffffffffff9c, &(0x7f0000000240)='/proc/thread-self/attr/current\x00', 0x2, 0x0) write$cgroup_subtree(r1, &(0x7f0000000100)=ANY=[], 0xff4a) write$cgroup_subtree(r2, &(0x7f0000000000)=ANY=[], 0x20032600) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a0f, 0x1700) accept$inet(0xffffffffffffffff, &(0x7f0000000040)={0x2, 0x0, @local}, &(0x7f0000000080)=0x10) ioctl$TCSETAF(r0, 0x5408, &(0x7f0000000040)={0x2}) ioctl$EXT4_IOC_GROUP_ADD(r0, 0x40286608, &(0x7f0000000000)={0x3, 0x7000000, 0x400, 0x100000000, 0x0, 0x8}) r3 = fcntl$dupfd(r0, 0x406, r0) ioctl$EVIOCGVERSION(r3, 0x80044501, &(0x7f0000000200)=""/31) write$binfmt_misc(r0, &(0x7f0000000080)={'syz1', "80fa25cdc862d216160cfa92845a3916e38a409a159c03f1889971d3e5144a8d08de78c4b1fbee457437261d7668b1c0f582647ad4134a05358d4309a71a702002329e024cac95642e761bb842bc1056bd6bf12c47697a649a026bd8ee1f685089941469b1ddfeddf32b392f0ff07652a3bce0770bc3bb70862845a65054cecb191e80b825d740fe6b40450359757032425dfdee92aec36ce4b468d50adc745c522cc4af2ac6e7f6a95f0edd70b09caa95fcc7143cf46b74db8bc17fa7c89f"}, 0xc3) 14:03:51 executing program 0: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSPTLCK(0xffffffffffffffff, 0x40045431, &(0x7f0000000180)) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) socket(0x200000000000011, 0x4000000000080002, 0x0) bind$packet(0xffffffffffffffff, 0x0, 0x0) sendmmsg(0xffffffffffffffff, &(0x7f0000007880)=[{{&(0x7f00000001c0)=@l2={0x1f, 0xbf53, {0x9, 0x7, 0xfffffffffffffdd5, 0x1ff, 0x2, 0x4}, 0x0, 0x7}, 0x80, 0x0}}, {{0x0, 0x0, &(0x7f0000007780)}}], 0x2, 0x4048851) setsockopt$packet_int(0xffffffffffffffff, 0x107, 0x0, 0x0, 0x0) syz_open_procfs(0x0, 0x0) ioctl$LOOP_SET_BLOCK_SIZE(0xffffffffffffffff, 0x4c09, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$cgroup_int(0xffffffffffffffff, 0x0, 0x2, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='\x89\x00\x00\x00\x00Ew\x00\x00\x00\xef\xb4\xc8\xd0\xff\xda\xb1vents\xd9\xc5H\xd4\x91\xfdN_]\x16\xe4\xa9C\xd2\x86Qn\xefS\x80\x11J\xfb4\x14\x86 4\x95\x9e\xfc\xc1\a\xcb \x95N\xe9\xa4j\xd2\x1f^\xb0\xb2>\xa3\xc9\xb7$\x11`t\x03: \x8b\xa4\x05\xf2?E\xdb+{t\xb8\xf7\xab\x8b\x100#', 0x26e1, 0x0) ioctl$PERF_EVENT_IOC_PAUSE_OUTPUT(r1, 0x40086602, 0x400007) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000280)='./cgroup/syz0\x00', 0x1ff) openat$smack_thread_current(0xffffffffffffff9c, &(0x7f0000000240)='/proc/thread-self/attr/current\x00', 0x2, 0x0) write$cgroup_subtree(r1, &(0x7f0000000100)=ANY=[], 0xff4a) write$cgroup_subtree(r2, &(0x7f0000000000)=ANY=[], 0x20032600) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a0f, 0x1700) accept$inet(0xffffffffffffffff, &(0x7f0000000040)={0x2, 0x0, @local}, &(0x7f0000000080)=0x10) ioctl$TCSETAF(r0, 0x5408, &(0x7f0000000040)={0x2}) ioctl$EXT4_IOC_GROUP_ADD(r0, 0x40286608, &(0x7f0000000000)={0x3, 0x7000000, 0x400, 0x100000000, 0x0, 0x8}) r3 = fcntl$dupfd(r0, 0x406, r0) ioctl$EVIOCGVERSION(r3, 0x80044501, &(0x7f0000000200)=""/31) write$binfmt_misc(r0, &(0x7f0000000080)={'syz1', "80fa25cdc862d216160cfa92845a3916e38a409a159c03f1889971d3e5144a8d08de78c4b1fbee457437261d7668b1c0f582647ad4134a05358d4309a71a702002329e024cac95642e761bb842bc1056bd6bf12c47697a649a026bd8ee1f685089941469b1ddfeddf32b392f0ff07652a3bce0770bc3bb70862845a65054cecb191e80b825d740fe6b40450359757032425dfdee92aec36ce4b468d50adc745c522cc4af2ac6e7f6a95f0edd70b09caa95fcc7143cf46b74db8bc17fa7c89f"}, 0xc3) 14:03:51 executing program 4: getresuid(0x0, &(0x7f0000001c40), &(0x7f0000001c80)) getpgrp(0x0) getgroups(0x5, &(0x7f0000002480)=[0xee01, 0xee01, 0x0, 0x0, 0x0]) fcntl$getown(0xffffffffffffffff, 0x9) ioctl$TIOCGSID(0xffffffffffffffff, 0x5429, 0x0) getsockopt$inet_IP_IPSEC_POLICY(0xffffffffffffffff, 0x0, 0x10, 0x0, 0x0) getgid() perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x3, 0xfff, 0xfffffffffffffffc, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xac9f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) r0 = open(&(0x7f0000000140)='./file0\x00', 0x40c2, 0x0) r1 = open$dir(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) write$9p(r0, &(0x7f0000000800)="3b27a4b46ee92b4a59073c369a5e19f9db153c4fdbc76aa2a4bb9f3e5e1aa197a9e97d1016c01813792e50c2692c175aad715d110a892949ccc6e2e54c2d5c8f0b7932b69797f217168b0c1feb128ae34f0daf487a70b5c117acd43725fe17993634f1695dabd7f998cd55e9d5bd911e86aa7a4ad75a574bb9693dd6018b25d942a9544bca1ebb0e8d10c092cdcb85797673972099e4041aaf8d636f66cb1103ef2050ad28fabaed33d6927889d97f4b5ce0de71d3fd832980f4f088d0d824e20549b4bbd906ffa51ce9de54d779eb4de462faac20a3ab0ed9934373ca22cea5454f4c2a740cd461e39956bb5f98df2aebc60cf32623adbffbcc378fa7250b6a3fc863dadcf6d4f8b804bfe70f0796eee6218445dad2811dd6b540ff52efa2f167dd9c1b8b016268d37db430983fefc0645d20614c8df2eb0872c58e09664e672b0b6a9970fec199257e1c606ec3e364c66a0f4d258c74accd43b987c756d602fd8787fed3aa43fd8d84e9656d4a413fa9a423bc54b873583d6d497005e54712fafc71384988d80134fbf84f53fdd74b354848006b8b5b67e7cc5a472475d3ae545ca1fcf7628b873e31ba83a98a7ad5b0cfbe9711b517a9a1388ad0efa2a3b4e22152021d631b731e2e100a9831111db7acce948bb5deeea260463c140ac929e77c58402776caf85d4569a75dde2f64c4491508afb541ed9b2c81fc95c06706235f383e31cf662c95b1e49cfd94871e22720a41535756e419b271276941692bd023dd9ca8bec4f7db1e5c00d8b3be7b8e826a6aadd001edd0dfeb00f8048442b5c48456fd642e629dcb2ff55592665ff491cd832672ce4d999da186db2c3a1f8b6b1f7d3750d7cdb3097954e6e14fb2183ad662c63d4ce8b82dc2487f0fe2ea2827b53a7c6dcced878d2fb29c1d3ff583570e7bc172d1a5c716e0447cb08ce3c468ffdf975da372f3f3eb455aaf5822bc04a51b6cad24a2331369df81c123b009a2381b42e9aeb077f621608d81c12a5f5c6c295d74afd4dd5c051296be0b54c70bf899b347c36bff62f313079983409d7f9cf1242c917985c1b5d0736fe21f8514f63d0369a374c42da40bd5140bc3e602d00c3cb4f8e621863ab47422778d67d72de34753fd72cef80649a1548e4e8dcbcffe4054cc9d8a1f922623a75904cbdaacde768131e587269a4a99d82f7009c1b8ab79aa232a2fd45ad71b60fca627576ba979fa6a87525884b08d721a21400fb1f950b96ead82f408cc4388d3b78fb456616429a520656d5e5a876fd04748498902c86f58d45f4c1b3919eb846a00edf07e7a830bf723e4774f085f15534dd3b5246c0c0970b5ad7bb39b30b156a9430378c5b0aab1261c78d72ac301cd552d5e8dd4b642ec1dc0672745d593bb26d095b5b23576e3cfd6ab580f6e09419d0f0c64250fafaa3759aa1888da48d89c3f7c9454b0b3d0ab40445f5bed4493ef43ab08f31b1345ac4ffd94ad79c9eee53904ed6f572817153190d2e6863f2e39356bb99926419fd314341a536b7e76cae60bf7750a4c29e3f4c7f005530b1d4ee0e25b93b76fcc1108222f0b00de52cf4100e97adfd7b9db1370586ba27e1e183299be00d0df8439c380edf2f79deb441eac59b814b04accdff5e17f02046139f91f0332661676ff506e575f0cb2850bcc9f8666f6d1f69f8f4271cb804a79fccd7016f049d1a494c46a527c437fa0be6d51ec7543d9bd7a2f016194ebe3c99080a6c9b5119863dfe865f8e60cae29f50b67dbfaa0a3c9794d73034485ca1613344c572783db3dfab01b28089c51cda99cefa4c1c881a29e229f04c7e0fd04dc425ae8417852e6e31520c6207e9d4e35285feef2a2cb8a3bceb08a166fa4284a516362621e2c06731a442791f1db063a32cf1f005c914102c7273cb4d7ab1bf567d72f230783d2ea99c43a60e8729132441ee6c5362c33f9b613f84417c3c5549f4e3d9e73c6f83f16c8e57ae22fe5f54515e111fe43ad7c400d214281452bb6141cecad84b23a695f061988d906d03be5d89584634b9e9d9a9b072f8e7cbb47c47719318a2001cafa665dd2c82672d16877ea115bd023fc1975f7c59664bfb06f66a1a5e3f05cb283fb45ea67a2727ee6e10bf35b31fdd03d43ec67b753f6737e0d2f4a5275031595878cefc8f0ca", 0x600) sendfile(r0, r1, 0x0, 0x10000) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f319bd070") r3 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETAF(r3, 0x5408, &(0x7f0000000040)) 14:03:51 executing program 1: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSPTLCK(r0, 0x40045431, &(0x7f0000000180)) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) socket(0x200000000000011, 0x4000000000080002, 0x0) bind$packet(0xffffffffffffffff, 0x0, 0x0) sendmmsg(0xffffffffffffffff, &(0x7f0000007880)=[{{&(0x7f00000001c0)=@l2={0x1f, 0xbf53, {0x9, 0x7, 0xfffffffffffffdd5, 0x1ff, 0x2, 0x4}, 0x0, 0x7}, 0x80, 0x0}}, {{0x0, 0x0, &(0x7f0000007780)}}], 0x2, 0x4048851) syz_open_procfs(0x0, 0x0) ioctl$LOOP_SET_BLOCK_SIZE(0xffffffffffffffff, 0x4c09, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$cgroup_int(0xffffffffffffffff, 0x0, 0x2, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='\x89\x00\x00\x00\x00Ew\x00\x00\x00\xef\xb4\xc8\xd0\xff\xda\xb1vents\xd9\xc5H\xd4\x91\xfdN_]\x16\xe4\xa9C\xd2\x86Qn\xefS\x80\x11J\xfb4\x14\x86 4\x95\x9e\xfc\xc1\a\xcb \x95N\xe9\xa4j\xd2\x1f^\xb0\xb2>\xa3\xc9\xb7$\x11`t\x03: \x8b\xa4\x05\xf2?E\xdb+{t\xb8\xf7\xab\x8b\x100#', 0x26e1, 0x0) ioctl$PERF_EVENT_IOC_PAUSE_OUTPUT(r1, 0x40086602, 0x400007) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000280)='./cgroup/syz0\x00', 0x1ff) openat$smack_thread_current(0xffffffffffffff9c, &(0x7f0000000240)='/proc/thread-self/attr/current\x00', 0x2, 0x0) write$cgroup_subtree(r1, &(0x7f0000000100)=ANY=[], 0xff4a) write$cgroup_subtree(r2, &(0x7f0000000000)=ANY=[], 0x20032600) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a0f, 0x1700) accept$inet(0xffffffffffffffff, &(0x7f0000000040)={0x2, 0x0, @local}, &(0x7f0000000080)=0x10) ioctl$EXT4_IOC_GROUP_ADD(r0, 0x40286608, &(0x7f0000000000)={0x3, 0x7000000, 0x400, 0x100000000, 0x0, 0x8}) ioctl$EVIOCGVERSION(0xffffffffffffffff, 0x80044501, &(0x7f0000000200)=""/31) 14:03:51 executing program 5: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSPTLCK(r0, 0x40045431, &(0x7f0000000180)) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) socket(0x200000000000011, 0x4000000000080002, 0x0) bind$packet(0xffffffffffffffff, 0x0, 0x0) sendmmsg(0xffffffffffffffff, &(0x7f0000007880)=[{{&(0x7f00000001c0)=@l2={0x1f, 0xbf53, {0x9, 0x7, 0xfffffffffffffdd5, 0x1ff, 0x2, 0x4}, 0x0, 0x7}, 0x80, 0x0}}, {{0x0, 0x0, &(0x7f0000007780)}}], 0x2, 0x4048851) setsockopt$packet_int(0xffffffffffffffff, 0x107, 0x0, 0x0, 0x0) syz_open_procfs(0x0, 0x0) ioctl$LOOP_SET_BLOCK_SIZE(0xffffffffffffffff, 0x4c09, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='\x89\x00\x00\x00\x00Ew\x00\x00\x00\xef\xb4\xc8\xd0\xff\xda\xb1vents\xd9\xc5H\xd4\x91\xfdN_]\x16\xe4\xa9C\xd2\x86Qn\xefS\x80\x11J\xfb4\x14\x86 4\x95\x9e\xfc\xc1\a\xcb \x95N\xe9\xa4j\xd2\x1f^\xb0\xb2>\xa3\xc9\xb7$\x11`t\x03: \x8b\xa4\x05\xf2?E\xdb+{t\xb8\xf7\xab\x8b\x100#', 0x26e1, 0x0) ioctl$PERF_EVENT_IOC_PAUSE_OUTPUT(r1, 0x40086602, 0x400007) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000280)='./cgroup/syz0\x00', 0x1ff) openat$smack_thread_current(0xffffffffffffff9c, &(0x7f0000000240)='/proc/thread-self/attr/current\x00', 0x2, 0x0) write$cgroup_subtree(r1, &(0x7f0000000100)=ANY=[], 0xff4a) write$cgroup_subtree(r2, &(0x7f0000000000)=ANY=[], 0x20032600) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a0f, 0x1700) accept$inet(0xffffffffffffffff, &(0x7f0000000040)={0x2, 0x0, @local}, &(0x7f0000000080)=0x10) ioctl$TCSETAF(r0, 0x5408, &(0x7f0000000040)={0x2}) ioctl$EXT4_IOC_GROUP_ADD(r0, 0x40286608, &(0x7f0000000000)={0x3, 0x7000000, 0x400, 0x100000000, 0x0, 0x8}) r3 = fcntl$dupfd(r0, 0x406, r0) ioctl$EVIOCGVERSION(r3, 0x80044501, &(0x7f0000000200)=""/31) write$binfmt_misc(r0, &(0x7f0000000080)={'syz1', "80fa25cdc862d216160cfa92845a3916e38a409a159c03f1889971d3e5144a8d08de78c4b1fbee457437261d7668b1c0f582647ad4134a05358d4309a71a702002329e024cac95642e761bb842bc1056bd6bf12c47697a649a026bd8ee1f685089941469b1ddfeddf32b392f0ff07652a3bce0770bc3bb70862845a65054cecb191e80b825d740fe6b40450359757032425dfdee92aec36ce4b468d50adc745c522cc4af2ac6e7f6a95f0edd70b09caa95fcc7143cf46b74db8bc17fa7c89f"}, 0xc3) 14:03:51 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSPTLCK(r0, 0x40045431, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) socket(0x200000000000011, 0x4000000000080002, 0x0) bind$packet(0xffffffffffffffff, 0x0, 0x0) sendmmsg(0xffffffffffffffff, &(0x7f0000007880)=[{{&(0x7f00000001c0)=@l2={0x1f, 0xbf53, {0x9, 0x7, 0xfffffffffffffdd5, 0x1ff, 0x2, 0x4}, 0x0, 0x7}, 0x80, 0x0}}, {{0x0, 0x0, &(0x7f0000007780)}}], 0x2, 0x4048851) setsockopt$packet_int(0xffffffffffffffff, 0x107, 0x0, 0x0, 0x0) syz_open_procfs(0x0, 0x0) ioctl$LOOP_SET_BLOCK_SIZE(0xffffffffffffffff, 0x4c09, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$cgroup_int(0xffffffffffffffff, 0x0, 0x2, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='\x89\x00\x00\x00\x00Ew\x00\x00\x00\xef\xb4\xc8\xd0\xff\xda\xb1vents\xd9\xc5H\xd4\x91\xfdN_]\x16\xe4\xa9C\xd2\x86Qn\xefS\x80\x11J\xfb4\x14\x86 4\x95\x9e\xfc\xc1\a\xcb \x95N\xe9\xa4j\xd2\x1f^\xb0\xb2>\xa3\xc9\xb7$\x11`t\x03: \x8b\xa4\x05\xf2?E\xdb+{t\xb8\xf7\xab\x8b\x100#', 0x26e1, 0x0) ioctl$PERF_EVENT_IOC_PAUSE_OUTPUT(r1, 0x40086602, 0x400007) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000280)='./cgroup/syz0\x00', 0x1ff) openat$smack_thread_current(0xffffffffffffff9c, &(0x7f0000000240)='/proc/thread-self/attr/current\x00', 0x2, 0x0) write$cgroup_subtree(r1, &(0x7f0000000100)=ANY=[], 0xff4a) write$cgroup_subtree(r2, &(0x7f0000000000)=ANY=[], 0x20032600) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a0f, 0x1700) accept$inet(0xffffffffffffffff, &(0x7f0000000040)={0x2, 0x0, @local}, &(0x7f0000000080)=0x10) ioctl$TCSETAF(r0, 0x5408, &(0x7f0000000040)={0x2}) ioctl$EXT4_IOC_GROUP_ADD(r0, 0x40286608, &(0x7f0000000000)={0x3, 0x7000000, 0x400, 0x100000000, 0x0, 0x8}) r3 = fcntl$dupfd(r0, 0x406, r0) ioctl$EVIOCGVERSION(r3, 0x80044501, &(0x7f0000000200)=""/31) write$binfmt_misc(r0, &(0x7f0000000080)={'syz1', "80fa25cdc862d216160cfa92845a3916e38a409a159c03f1889971d3e5144a8d08de78c4b1fbee457437261d7668b1c0f582647ad4134a05358d4309a71a702002329e024cac95642e761bb842bc1056bd6bf12c47697a649a026bd8ee1f685089941469b1ddfeddf32b392f0ff07652a3bce0770bc3bb70862845a65054cecb191e80b825d740fe6b40450359757032425dfdee92aec36ce4b468d50adc745c522cc4af2ac6e7f6a95f0edd70b09caa95fcc7143cf46b74db8bc17fa7c89f"}, 0xc3) 14:03:51 executing program 3: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSPTLCK(0xffffffffffffffff, 0x40045431, &(0x7f0000000180)) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) socket(0x200000000000011, 0x4000000000080002, 0x0) bind$packet(0xffffffffffffffff, 0x0, 0x0) sendmmsg(0xffffffffffffffff, &(0x7f0000007880)=[{{&(0x7f00000001c0)=@l2={0x1f, 0xbf53, {0x9, 0x7, 0xfffffffffffffdd5, 0x1ff, 0x2, 0x4}, 0x0, 0x7}, 0x80, 0x0}}, {{0x0, 0x0, &(0x7f0000007780)}}], 0x2, 0x4048851) setsockopt$packet_int(0xffffffffffffffff, 0x107, 0x0, 0x0, 0x0) syz_open_procfs(0x0, 0x0) ioctl$LOOP_SET_BLOCK_SIZE(0xffffffffffffffff, 0x4c09, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$cgroup_int(0xffffffffffffffff, 0x0, 0x2, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='\x89\x00\x00\x00\x00Ew\x00\x00\x00\xef\xb4\xc8\xd0\xff\xda\xb1vents\xd9\xc5H\xd4\x91\xfdN_]\x16\xe4\xa9C\xd2\x86Qn\xefS\x80\x11J\xfb4\x14\x86 4\x95\x9e\xfc\xc1\a\xcb \x95N\xe9\xa4j\xd2\x1f^\xb0\xb2>\xa3\xc9\xb7$\x11`t\x03: \x8b\xa4\x05\xf2?E\xdb+{t\xb8\xf7\xab\x8b\x100#', 0x26e1, 0x0) ioctl$PERF_EVENT_IOC_PAUSE_OUTPUT(r1, 0x40086602, 0x400007) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000280)='./cgroup/syz0\x00', 0x1ff) openat$smack_thread_current(0xffffffffffffff9c, &(0x7f0000000240)='/proc/thread-self/attr/current\x00', 0x2, 0x0) write$cgroup_subtree(r1, &(0x7f0000000100)=ANY=[], 0xff4a) write$cgroup_subtree(r2, &(0x7f0000000000)=ANY=[], 0x20032600) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a0f, 0x1700) accept$inet(0xffffffffffffffff, &(0x7f0000000040)={0x2, 0x0, @local}, &(0x7f0000000080)=0x10) ioctl$TCSETAF(r0, 0x5408, &(0x7f0000000040)={0x2}) ioctl$EXT4_IOC_GROUP_ADD(r0, 0x40286608, &(0x7f0000000000)={0x3, 0x7000000, 0x400, 0x100000000, 0x0, 0x8}) r3 = fcntl$dupfd(r0, 0x406, r0) ioctl$EVIOCGVERSION(r3, 0x80044501, &(0x7f0000000200)=""/31) write$binfmt_misc(r0, &(0x7f0000000080)={'syz1', "80fa25cdc862d216160cfa92845a3916e38a409a159c03f1889971d3e5144a8d08de78c4b1fbee457437261d7668b1c0f582647ad4134a05358d4309a71a702002329e024cac95642e761bb842bc1056bd6bf12c47697a649a026bd8ee1f685089941469b1ddfeddf32b392f0ff07652a3bce0770bc3bb70862845a65054cecb191e80b825d740fe6b40450359757032425dfdee92aec36ce4b468d50adc745c522cc4af2ac6e7f6a95f0edd70b09caa95fcc7143cf46b74db8bc17fa7c89f"}, 0xc3) 14:03:51 executing program 0: getresuid(0x0, &(0x7f0000001c40), &(0x7f0000001c80)) getpgrp(0x0) getgroups(0x5, &(0x7f0000002480)=[0xee01, 0xee01, 0x0, 0x0, 0x0]) fcntl$getown(0xffffffffffffffff, 0x9) ioctl$TIOCGSID(0xffffffffffffffff, 0x5429, 0x0) getsockopt$inet_IP_IPSEC_POLICY(0xffffffffffffffff, 0x0, 0x10, 0x0, 0x0) getgid() perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x3, 0xfff, 0xfffffffffffffffc, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xac9f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) r0 = open(&(0x7f0000000140)='./file0\x00', 0x40c2, 0x0) r1 = open$dir(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) write$9p(r0, &(0x7f0000000800)="3b27a4b46ee92b4a59073c369a5e19f9db153c4fdbc76aa2a4bb9f3e5e1aa197a9e97d1016c01813792e50c2692c175aad715d110a892949ccc6e2e54c2d5c8f0b7932b69797f217168b0c1feb128ae34f0daf487a70b5c117acd43725fe17993634f1695dabd7f998cd55e9d5bd911e86aa7a4ad75a574bb9693dd6018b25d942a9544bca1ebb0e8d10c092cdcb85797673972099e4041aaf8d636f66cb1103ef2050ad28fabaed33d6927889d97f4b5ce0de71d3fd832980f4f088d0d824e20549b4bbd906ffa51ce9de54d779eb4de462faac20a3ab0ed9934373ca22cea5454f4c2a740cd461e39956bb5f98df2aebc60cf32623adbffbcc378fa7250b6a3fc863dadcf6d4f8b804bfe70f0796eee6218445dad2811dd6b540ff52efa2f167dd9c1b8b016268d37db430983fefc0645d20614c8df2eb0872c58e09664e672b0b6a9970fec199257e1c606ec3e364c66a0f4d258c74accd43b987c756d602fd8787fed3aa43fd8d84e9656d4a413fa9a423bc54b873583d6d497005e54712fafc71384988d80134fbf84f53fdd74b354848006b8b5b67e7cc5a472475d3ae545ca1fcf7628b873e31ba83a98a7ad5b0cfbe9711b517a9a1388ad0efa2a3b4e22152021d631b731e2e100a9831111db7acce948bb5deeea260463c140ac929e77c58402776caf85d4569a75dde2f64c4491508afb541ed9b2c81fc95c06706235f383e31cf662c95b1e49cfd94871e22720a41535756e419b271276941692bd023dd9ca8bec4f7db1e5c00d8b3be7b8e826a6aadd001edd0dfeb00f8048442b5c48456fd642e629dcb2ff55592665ff491cd832672ce4d999da186db2c3a1f8b6b1f7d3750d7cdb3097954e6e14fb2183ad662c63d4ce8b82dc2487f0fe2ea2827b53a7c6dcced878d2fb29c1d3ff583570e7bc172d1a5c716e0447cb08ce3c468ffdf975da372f3f3eb455aaf5822bc04a51b6cad24a2331369df81c123b009a2381b42e9aeb077f621608d81c12a5f5c6c295d74afd4dd5c051296be0b54c70bf899b347c36bff62f313079983409d7f9cf1242c917985c1b5d0736fe21f8514f63d0369a374c42da40bd5140bc3e602d00c3cb4f8e621863ab47422778d67d72de34753fd72cef80649a1548e4e8dcbcffe4054cc9d8a1f922623a75904cbdaacde768131e587269a4a99d82f7009c1b8ab79aa232a2fd45ad71b60fca627576ba979fa6a87525884b08d721a21400fb1f950b96ead82f408cc4388d3b78fb456616429a520656d5e5a876fd04748498902c86f58d45f4c1b3919eb846a00edf07e7a830bf723e4774f085f15534dd3b5246c0c0970b5ad7bb39b30b156a9430378c5b0aab1261c78d72ac301cd552d5e8dd4b642ec1dc0672745d593bb26d095b5b23576e3cfd6ab580f6e09419d0f0c64250fafaa3759aa1888da48d89c3f7c9454b0b3d0ab40445f5bed4493ef43ab08f31b1345ac4ffd94ad79c9eee53904ed6f572817153190d2e6863f2e39356bb99926419fd314341a536b7e76cae60bf7750a4c29e3f4c7f005530b1d4ee0e25b93b76fcc1108222f0b00de52cf4100e97adfd7b9db1370586ba27e1e183299be00d0df8439c380edf2f79deb441eac59b814b04accdff5e17f02046139f91f0332661676ff506e575f0cb2850bcc9f8666f6d1f69f8f4271cb804a79fccd7016f049d1a494c46a527c437fa0be6d51ec7543d9bd7a2f016194ebe3c99080a6c9b5119863dfe865f8e60cae29f50b67dbfaa0a3c9794d73034485ca1613344c572783db3dfab01b28089c51cda99cefa4c1c881a29e229f04c7e0fd04dc425ae8417852e6e31520c6207e9d4e35285feef2a2cb8a3bceb08a166fa4284a516362621e2c06731a442791f1db063a32cf1f005c914102c7273cb4d7ab1bf567d72f230783d2ea99c43a60e8729132441ee6c5362c33f9b613f84417c3c5549f4e3d9e73c6f83f16c8e57ae22fe5f54515e111fe43ad7c400d214281452bb6141cecad84b23a695f061988d906d03be5d89584634b9e9d9a9b072f8e7cbb47c47719318a2001cafa665dd2c82672d16877ea115bd023fc1975f7c59664bfb06f66a1a5e3f05cb283fb45ea67a2727ee6e10bf35b31fdd03d43ec67b753f6737e0d2f4a5275031595878cefc8f0ca", 0x600) sendfile(r0, r1, 0x0, 0x10000) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f319bd070") r3 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETAF(r3, 0x5408, &(0x7f0000000040)) 14:03:52 executing program 5: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSPTLCK(r0, 0x40045431, &(0x7f0000000180)) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) socket(0x200000000000011, 0x4000000000080002, 0x0) bind$packet(0xffffffffffffffff, 0x0, 0x0) sendmmsg(0xffffffffffffffff, &(0x7f0000007880)=[{{&(0x7f00000001c0)=@l2={0x1f, 0xbf53, {0x9, 0x7, 0xfffffffffffffdd5, 0x1ff, 0x2, 0x4}, 0x0, 0x7}, 0x80, 0x0}}, {{0x0, 0x0, &(0x7f0000007780)}}], 0x2, 0x4048851) setsockopt$packet_int(0xffffffffffffffff, 0x107, 0x0, 0x0, 0x0) syz_open_procfs(0x0, 0x0) ioctl$LOOP_SET_BLOCK_SIZE(0xffffffffffffffff, 0x4c09, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$cgroup_int(0xffffffffffffffff, 0x0, 0x2, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='\x89\x00\x00\x00\x00Ew\x00\x00\x00\xef\xb4\xc8\xd0\xff\xda\xb1vents\xd9\xc5H\xd4\x91\xfdN_]\x16\xe4\xa9C\xd2\x86Qn\xefS\x80\x11J\xfb4\x14\x86 4\x95\x9e\xfc\xc1\a\xcb \x95N\xe9\xa4j\xd2\x1f^\xb0\xb2>\xa3\xc9\xb7$\x11`t\x03: \x8b\xa4\x05\xf2?E\xdb+{t\xb8\xf7\xab\x8b\x100#', 0x26e1, 0x0) ioctl$PERF_EVENT_IOC_PAUSE_OUTPUT(r1, 0x40086602, 0x400007) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000280)='./cgroup/syz0\x00', 0x1ff) openat$smack_thread_current(0xffffffffffffff9c, &(0x7f0000000240)='/proc/thread-self/attr/current\x00', 0x2, 0x0) write$cgroup_subtree(r1, &(0x7f0000000100)=ANY=[], 0xff4a) write$cgroup_subtree(0xffffffffffffffff, &(0x7f0000000000)=ANY=[], 0x20032600) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a0f, 0x1700) accept$inet(0xffffffffffffffff, &(0x7f0000000040)={0x2, 0x0, @local}, &(0x7f0000000080)=0x10) ioctl$TCSETAF(r0, 0x5408, &(0x7f0000000040)={0x2}) ioctl$EXT4_IOC_GROUP_ADD(r0, 0x40286608, &(0x7f0000000000)={0x3, 0x7000000, 0x400, 0x100000000, 0x0, 0x8}) r2 = fcntl$dupfd(r0, 0x406, r0) ioctl$EVIOCGVERSION(r2, 0x80044501, &(0x7f0000000200)=""/31) write$binfmt_misc(r0, &(0x7f0000000080)={'syz1', "80fa25cdc862d216160cfa92845a3916e38a409a159c03f1889971d3e5144a8d08de78c4b1fbee457437261d7668b1c0f582647ad4134a05358d4309a71a702002329e024cac95642e761bb842bc1056bd6bf12c47697a649a026bd8ee1f685089941469b1ddfeddf32b392f0ff07652a3bce0770bc3bb70862845a65054cecb191e80b825d740fe6b40450359757032425dfdee92aec36ce4b468d50adc745c522cc4af2ac6e7f6a95f0edd70b09caa95fcc7143cf46b74db8bc17fa7c89f"}, 0xc3) 14:03:52 executing program 1: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSPTLCK(r0, 0x40045431, &(0x7f0000000180)) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) socket(0x200000000000011, 0x4000000000080002, 0x0) bind$packet(0xffffffffffffffff, 0x0, 0x0) sendmmsg(0xffffffffffffffff, &(0x7f0000007880)=[{{&(0x7f00000001c0)=@l2={0x1f, 0xbf53, {0x9, 0x7, 0xfffffffffffffdd5, 0x1ff, 0x2, 0x4}, 0x0, 0x7}, 0x80, 0x0}}, {{0x0, 0x0, &(0x7f0000007780)}}], 0x2, 0x4048851) syz_open_procfs(0x0, 0x0) ioctl$LOOP_SET_BLOCK_SIZE(0xffffffffffffffff, 0x4c09, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$cgroup_int(0xffffffffffffffff, 0x0, 0x2, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='\x89\x00\x00\x00\x00Ew\x00\x00\x00\xef\xb4\xc8\xd0\xff\xda\xb1vents\xd9\xc5H\xd4\x91\xfdN_]\x16\xe4\xa9C\xd2\x86Qn\xefS\x80\x11J\xfb4\x14\x86 4\x95\x9e\xfc\xc1\a\xcb \x95N\xe9\xa4j\xd2\x1f^\xb0\xb2>\xa3\xc9\xb7$\x11`t\x03: \x8b\xa4\x05\xf2?E\xdb+{t\xb8\xf7\xab\x8b\x100#', 0x26e1, 0x0) ioctl$PERF_EVENT_IOC_PAUSE_OUTPUT(r1, 0x40086602, 0x400007) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000280)='./cgroup/syz0\x00', 0x1ff) openat$smack_thread_current(0xffffffffffffff9c, &(0x7f0000000240)='/proc/thread-self/attr/current\x00', 0x2, 0x0) write$cgroup_subtree(r1, &(0x7f0000000100)=ANY=[], 0xff4a) write$cgroup_subtree(r2, &(0x7f0000000000)=ANY=[], 0x20032600) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a0f, 0x1700) accept$inet(0xffffffffffffffff, &(0x7f0000000040)={0x2, 0x0, @local}, &(0x7f0000000080)=0x10) ioctl$EXT4_IOC_GROUP_ADD(r0, 0x40286608, &(0x7f0000000000)={0x3, 0x7000000, 0x400, 0x100000000, 0x0, 0x8}) ioctl$EVIOCGVERSION(0xffffffffffffffff, 0x80044501, &(0x7f0000000200)=""/31) 14:03:52 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSPTLCK(r0, 0x40045431, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) socket(0x200000000000011, 0x4000000000080002, 0x0) bind$packet(0xffffffffffffffff, 0x0, 0x0) sendmmsg(0xffffffffffffffff, &(0x7f0000007880)=[{{&(0x7f00000001c0)=@l2={0x1f, 0xbf53, {0x9, 0x7, 0xfffffffffffffdd5, 0x1ff, 0x2, 0x4}, 0x0, 0x7}, 0x80, 0x0}}, {{0x0, 0x0, &(0x7f0000007780)}}], 0x2, 0x4048851) setsockopt$packet_int(0xffffffffffffffff, 0x107, 0x0, 0x0, 0x0) syz_open_procfs(0x0, 0x0) ioctl$LOOP_SET_BLOCK_SIZE(0xffffffffffffffff, 0x4c09, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$cgroup_int(0xffffffffffffffff, 0x0, 0x2, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='\x89\x00\x00\x00\x00Ew\x00\x00\x00\xef\xb4\xc8\xd0\xff\xda\xb1vents\xd9\xc5H\xd4\x91\xfdN_]\x16\xe4\xa9C\xd2\x86Qn\xefS\x80\x11J\xfb4\x14\x86 4\x95\x9e\xfc\xc1\a\xcb \x95N\xe9\xa4j\xd2\x1f^\xb0\xb2>\xa3\xc9\xb7$\x11`t\x03: \x8b\xa4\x05\xf2?E\xdb+{t\xb8\xf7\xab\x8b\x100#', 0x26e1, 0x0) ioctl$PERF_EVENT_IOC_PAUSE_OUTPUT(r1, 0x40086602, 0x400007) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000280)='./cgroup/syz0\x00', 0x1ff) openat$smack_thread_current(0xffffffffffffff9c, &(0x7f0000000240)='/proc/thread-self/attr/current\x00', 0x2, 0x0) write$cgroup_subtree(r1, &(0x7f0000000100)=ANY=[], 0xff4a) write$cgroup_subtree(r2, &(0x7f0000000000)=ANY=[], 0x20032600) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a0f, 0x1700) accept$inet(0xffffffffffffffff, &(0x7f0000000040)={0x2, 0x0, @local}, &(0x7f0000000080)=0x10) ioctl$TCSETAF(r0, 0x5408, &(0x7f0000000040)={0x2}) ioctl$EXT4_IOC_GROUP_ADD(r0, 0x40286608, &(0x7f0000000000)={0x3, 0x7000000, 0x400, 0x100000000, 0x0, 0x8}) r3 = fcntl$dupfd(r0, 0x406, r0) ioctl$EVIOCGVERSION(r3, 0x80044501, &(0x7f0000000200)=""/31) write$binfmt_misc(r0, &(0x7f0000000080)={'syz1', "80fa25cdc862d216160cfa92845a3916e38a409a159c03f1889971d3e5144a8d08de78c4b1fbee457437261d7668b1c0f582647ad4134a05358d4309a71a702002329e024cac95642e761bb842bc1056bd6bf12c47697a649a026bd8ee1f685089941469b1ddfeddf32b392f0ff07652a3bce0770bc3bb70862845a65054cecb191e80b825d740fe6b40450359757032425dfdee92aec36ce4b468d50adc745c522cc4af2ac6e7f6a95f0edd70b09caa95fcc7143cf46b74db8bc17fa7c89f"}, 0xc3) 14:03:52 executing program 3: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSPTLCK(r0, 0x40045431, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) socket(0x200000000000011, 0x4000000000080002, 0x0) bind$packet(0xffffffffffffffff, 0x0, 0x0) sendmmsg(0xffffffffffffffff, &(0x7f0000007880)=[{{&(0x7f00000001c0)=@l2={0x1f, 0xbf53, {0x9, 0x7, 0xfffffffffffffdd5, 0x1ff, 0x2, 0x4}, 0x0, 0x7}, 0x80, 0x0}}, {{0x0, 0x0, &(0x7f0000007780)}}], 0x2, 0x4048851) setsockopt$packet_int(0xffffffffffffffff, 0x107, 0x0, 0x0, 0x0) syz_open_procfs(0x0, 0x0) ioctl$LOOP_SET_BLOCK_SIZE(0xffffffffffffffff, 0x4c09, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$cgroup_int(0xffffffffffffffff, 0x0, 0x2, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='\x89\x00\x00\x00\x00Ew\x00\x00\x00\xef\xb4\xc8\xd0\xff\xda\xb1vents\xd9\xc5H\xd4\x91\xfdN_]\x16\xe4\xa9C\xd2\x86Qn\xefS\x80\x11J\xfb4\x14\x86 4\x95\x9e\xfc\xc1\a\xcb \x95N\xe9\xa4j\xd2\x1f^\xb0\xb2>\xa3\xc9\xb7$\x11`t\x03: \x8b\xa4\x05\xf2?E\xdb+{t\xb8\xf7\xab\x8b\x100#', 0x26e1, 0x0) ioctl$PERF_EVENT_IOC_PAUSE_OUTPUT(r1, 0x40086602, 0x400007) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000280)='./cgroup/syz0\x00', 0x1ff) openat$smack_thread_current(0xffffffffffffff9c, &(0x7f0000000240)='/proc/thread-self/attr/current\x00', 0x2, 0x0) write$cgroup_subtree(r1, &(0x7f0000000100)=ANY=[], 0xff4a) write$cgroup_subtree(r2, &(0x7f0000000000)=ANY=[], 0x20032600) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a0f, 0x1700) accept$inet(0xffffffffffffffff, &(0x7f0000000040)={0x2, 0x0, @local}, &(0x7f0000000080)=0x10) ioctl$TCSETAF(r0, 0x5408, &(0x7f0000000040)={0x2}) ioctl$EXT4_IOC_GROUP_ADD(r0, 0x40286608, &(0x7f0000000000)={0x3, 0x7000000, 0x400, 0x100000000, 0x0, 0x8}) r3 = fcntl$dupfd(r0, 0x406, r0) ioctl$EVIOCGVERSION(r3, 0x80044501, &(0x7f0000000200)=""/31) write$binfmt_misc(r0, &(0x7f0000000080)={'syz1', "80fa25cdc862d216160cfa92845a3916e38a409a159c03f1889971d3e5144a8d08de78c4b1fbee457437261d7668b1c0f582647ad4134a05358d4309a71a702002329e024cac95642e761bb842bc1056bd6bf12c47697a649a026bd8ee1f685089941469b1ddfeddf32b392f0ff07652a3bce0770bc3bb70862845a65054cecb191e80b825d740fe6b40450359757032425dfdee92aec36ce4b468d50adc745c522cc4af2ac6e7f6a95f0edd70b09caa95fcc7143cf46b74db8bc17fa7c89f"}, 0xc3) 14:03:52 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSPTLCK(r0, 0x40045431, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) socket(0x200000000000011, 0x4000000000080002, 0x0) bind$packet(0xffffffffffffffff, 0x0, 0x0) sendmmsg(0xffffffffffffffff, &(0x7f0000007880)=[{{&(0x7f00000001c0)=@l2={0x1f, 0xbf53, {0x9, 0x7, 0xfffffffffffffdd5, 0x1ff, 0x2, 0x4}, 0x0, 0x7}, 0x80, 0x0}}, {{0x0, 0x0, &(0x7f0000007780)}}], 0x2, 0x4048851) setsockopt$packet_int(0xffffffffffffffff, 0x107, 0x0, 0x0, 0x0) syz_open_procfs(0x0, 0x0) ioctl$LOOP_SET_BLOCK_SIZE(0xffffffffffffffff, 0x4c09, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$cgroup_int(0xffffffffffffffff, 0x0, 0x2, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='\x89\x00\x00\x00\x00Ew\x00\x00\x00\xef\xb4\xc8\xd0\xff\xda\xb1vents\xd9\xc5H\xd4\x91\xfdN_]\x16\xe4\xa9C\xd2\x86Qn\xefS\x80\x11J\xfb4\x14\x86 4\x95\x9e\xfc\xc1\a\xcb \x95N\xe9\xa4j\xd2\x1f^\xb0\xb2>\xa3\xc9\xb7$\x11`t\x03: \x8b\xa4\x05\xf2?E\xdb+{t\xb8\xf7\xab\x8b\x100#', 0x26e1, 0x0) ioctl$PERF_EVENT_IOC_PAUSE_OUTPUT(r1, 0x40086602, 0x400007) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000280)='./cgroup/syz0\x00', 0x1ff) openat$smack_thread_current(0xffffffffffffff9c, &(0x7f0000000240)='/proc/thread-self/attr/current\x00', 0x2, 0x0) write$cgroup_subtree(r1, &(0x7f0000000100)=ANY=[], 0xff4a) write$cgroup_subtree(r2, &(0x7f0000000000)=ANY=[], 0x20032600) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a0f, 0x1700) accept$inet(0xffffffffffffffff, &(0x7f0000000040)={0x2, 0x0, @local}, &(0x7f0000000080)=0x10) ioctl$TCSETAF(r0, 0x5408, &(0x7f0000000040)={0x2}) ioctl$EXT4_IOC_GROUP_ADD(r0, 0x40286608, &(0x7f0000000000)={0x3, 0x7000000, 0x400, 0x100000000, 0x0, 0x8}) r3 = fcntl$dupfd(r0, 0x406, r0) ioctl$EVIOCGVERSION(r3, 0x80044501, &(0x7f0000000200)=""/31) write$binfmt_misc(r0, &(0x7f0000000080)={'syz1', "80fa25cdc862d216160cfa92845a3916e38a409a159c03f1889971d3e5144a8d08de78c4b1fbee457437261d7668b1c0f582647ad4134a05358d4309a71a702002329e024cac95642e761bb842bc1056bd6bf12c47697a649a026bd8ee1f685089941469b1ddfeddf32b392f0ff07652a3bce0770bc3bb70862845a65054cecb191e80b825d740fe6b40450359757032425dfdee92aec36ce4b468d50adc745c522cc4af2ac6e7f6a95f0edd70b09caa95fcc7143cf46b74db8bc17fa7c89f"}, 0xc3) 14:03:52 executing program 1: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSPTLCK(r0, 0x40045431, &(0x7f0000000180)) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) socket(0x200000000000011, 0x4000000000080002, 0x0) bind$packet(0xffffffffffffffff, 0x0, 0x0) sendmmsg(0xffffffffffffffff, &(0x7f0000007880)=[{{&(0x7f00000001c0)=@l2={0x1f, 0xbf53, {0x9, 0x7, 0xfffffffffffffdd5, 0x1ff, 0x2, 0x4}, 0x0, 0x7}, 0x80, 0x0}}, {{0x0, 0x0, &(0x7f0000007780)}}], 0x2, 0x4048851) syz_open_procfs(0x0, 0x0) ioctl$LOOP_SET_BLOCK_SIZE(0xffffffffffffffff, 0x4c09, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$cgroup_int(0xffffffffffffffff, 0x0, 0x2, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='\x89\x00\x00\x00\x00Ew\x00\x00\x00\xef\xb4\xc8\xd0\xff\xda\xb1vents\xd9\xc5H\xd4\x91\xfdN_]\x16\xe4\xa9C\xd2\x86Qn\xefS\x80\x11J\xfb4\x14\x86 4\x95\x9e\xfc\xc1\a\xcb \x95N\xe9\xa4j\xd2\x1f^\xb0\xb2>\xa3\xc9\xb7$\x11`t\x03: \x8b\xa4\x05\xf2?E\xdb+{t\xb8\xf7\xab\x8b\x100#', 0x26e1, 0x0) ioctl$PERF_EVENT_IOC_PAUSE_OUTPUT(r1, 0x40086602, 0x400007) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000280)='./cgroup/syz0\x00', 0x1ff) openat$smack_thread_current(0xffffffffffffff9c, &(0x7f0000000240)='/proc/thread-self/attr/current\x00', 0x2, 0x0) write$cgroup_subtree(r1, &(0x7f0000000100)=ANY=[], 0xff4a) write$cgroup_subtree(r2, &(0x7f0000000000)=ANY=[], 0x20032600) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a0f, 0x1700) accept$inet(0xffffffffffffffff, &(0x7f0000000040)={0x2, 0x0, @local}, &(0x7f0000000080)=0x10) ioctl$EXT4_IOC_GROUP_ADD(r0, 0x40286608, &(0x7f0000000000)={0x3, 0x7000000, 0x400, 0x100000000, 0x0, 0x8}) ioctl$EVIOCGVERSION(0xffffffffffffffff, 0x80044501, &(0x7f0000000200)=""/31) 14:03:52 executing program 4: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSPTLCK(r0, 0x40045431, &(0x7f0000000180)) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) socket(0x200000000000011, 0x4000000000080002, 0x0) bind$packet(0xffffffffffffffff, 0x0, 0x0) sendmmsg(0xffffffffffffffff, &(0x7f0000007880)=[{{&(0x7f00000001c0)=@l2={0x1f, 0xbf53, {0x9, 0x7, 0xfffffffffffffdd5, 0x1ff, 0x2, 0x4}, 0x0, 0x7}, 0x80, 0x0}}, {{0x0, 0x0, &(0x7f0000007780)}}], 0x2, 0x4048851) syz_open_procfs(0x0, 0x0) ioctl$LOOP_SET_BLOCK_SIZE(0xffffffffffffffff, 0x4c09, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$cgroup_int(0xffffffffffffffff, 0x0, 0x2, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='\x89\x00\x00\x00\x00Ew\x00\x00\x00\xef\xb4\xc8\xd0\xff\xda\xb1vents\xd9\xc5H\xd4\x91\xfdN_]\x16\xe4\xa9C\xd2\x86Qn\xefS\x80\x11J\xfb4\x14\x86 4\x95\x9e\xfc\xc1\a\xcb \x95N\xe9\xa4j\xd2\x1f^\xb0\xb2>\xa3\xc9\xb7$\x11`t\x03: \x8b\xa4\x05\xf2?E\xdb+{t\xb8\xf7\xab\x8b\x100#', 0x26e1, 0x0) ioctl$PERF_EVENT_IOC_PAUSE_OUTPUT(r1, 0x40086602, 0x400007) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000280)='./cgroup/syz0\x00', 0x1ff) openat$smack_thread_current(0xffffffffffffff9c, &(0x7f0000000240)='/proc/thread-self/attr/current\x00', 0x2, 0x0) write$cgroup_subtree(r1, &(0x7f0000000100)=ANY=[], 0xff4a) write$cgroup_subtree(r2, &(0x7f0000000000)=ANY=[], 0x20032600) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a0f, 0x1700) accept$inet(0xffffffffffffffff, &(0x7f0000000040)={0x2, 0x0, @local}, &(0x7f0000000080)=0x10) ioctl$EXT4_IOC_GROUP_ADD(r0, 0x40286608, &(0x7f0000000000)={0x3, 0x7000000, 0x400, 0x100000000, 0x0, 0x8}) ioctl$EVIOCGVERSION(0xffffffffffffffff, 0x80044501, &(0x7f0000000200)=""/31) 14:03:52 executing program 5: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSPTLCK(r0, 0x40045431, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) socket(0x200000000000011, 0x4000000000080002, 0x0) bind$packet(0xffffffffffffffff, 0x0, 0x0) sendmmsg(0xffffffffffffffff, &(0x7f0000007880)=[{{&(0x7f00000001c0)=@l2={0x1f, 0xbf53, {0x9, 0x7, 0xfffffffffffffdd5, 0x1ff, 0x2, 0x4}, 0x0, 0x7}, 0x80, 0x0}}, {{0x0, 0x0, &(0x7f0000007780)}}], 0x2, 0x4048851) setsockopt$packet_int(0xffffffffffffffff, 0x107, 0x0, 0x0, 0x0) syz_open_procfs(0x0, 0x0) ioctl$LOOP_SET_BLOCK_SIZE(0xffffffffffffffff, 0x4c09, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$cgroup_int(0xffffffffffffffff, 0x0, 0x2, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='\x89\x00\x00\x00\x00Ew\x00\x00\x00\xef\xb4\xc8\xd0\xff\xda\xb1vents\xd9\xc5H\xd4\x91\xfdN_]\x16\xe4\xa9C\xd2\x86Qn\xefS\x80\x11J\xfb4\x14\x86 4\x95\x9e\xfc\xc1\a\xcb \x95N\xe9\xa4j\xd2\x1f^\xb0\xb2>\xa3\xc9\xb7$\x11`t\x03: \x8b\xa4\x05\xf2?E\xdb+{t\xb8\xf7\xab\x8b\x100#', 0x26e1, 0x0) ioctl$PERF_EVENT_IOC_PAUSE_OUTPUT(r1, 0x40086602, 0x400007) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000280)='./cgroup/syz0\x00', 0x1ff) openat$smack_thread_current(0xffffffffffffff9c, &(0x7f0000000240)='/proc/thread-self/attr/current\x00', 0x2, 0x0) write$cgroup_subtree(r1, &(0x7f0000000100)=ANY=[], 0xff4a) write$cgroup_subtree(r2, &(0x7f0000000000)=ANY=[], 0x20032600) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a0f, 0x1700) accept$inet(0xffffffffffffffff, &(0x7f0000000040)={0x2, 0x0, @local}, &(0x7f0000000080)=0x10) ioctl$TCSETAF(r0, 0x5408, &(0x7f0000000040)={0x2}) ioctl$EXT4_IOC_GROUP_ADD(r0, 0x40286608, &(0x7f0000000000)={0x3, 0x7000000, 0x400, 0x100000000, 0x0, 0x8}) r3 = fcntl$dupfd(r0, 0x406, r0) ioctl$EVIOCGVERSION(r3, 0x80044501, &(0x7f0000000200)=""/31) write$binfmt_misc(r0, &(0x7f0000000080)={'syz1', "80fa25cdc862d216160cfa92845a3916e38a409a159c03f1889971d3e5144a8d08de78c4b1fbee457437261d7668b1c0f582647ad4134a05358d4309a71a702002329e024cac95642e761bb842bc1056bd6bf12c47697a649a026bd8ee1f685089941469b1ddfeddf32b392f0ff07652a3bce0770bc3bb70862845a65054cecb191e80b825d740fe6b40450359757032425dfdee92aec36ce4b468d50adc745c522cc4af2ac6e7f6a95f0edd70b09caa95fcc7143cf46b74db8bc17fa7c89f"}, 0xc3) 14:03:52 executing program 3: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSPTLCK(r0, 0x40045431, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) socket(0x200000000000011, 0x4000000000080002, 0x0) bind$packet(0xffffffffffffffff, 0x0, 0x0) sendmmsg(0xffffffffffffffff, &(0x7f0000007880)=[{{&(0x7f00000001c0)=@l2={0x1f, 0xbf53, {0x9, 0x7, 0xfffffffffffffdd5, 0x1ff, 0x2, 0x4}, 0x0, 0x7}, 0x80, 0x0}}, {{0x0, 0x0, &(0x7f0000007780)}}], 0x2, 0x4048851) setsockopt$packet_int(0xffffffffffffffff, 0x107, 0x0, 0x0, 0x0) syz_open_procfs(0x0, 0x0) ioctl$LOOP_SET_BLOCK_SIZE(0xffffffffffffffff, 0x4c09, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$cgroup_int(0xffffffffffffffff, 0x0, 0x2, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='\x89\x00\x00\x00\x00Ew\x00\x00\x00\xef\xb4\xc8\xd0\xff\xda\xb1vents\xd9\xc5H\xd4\x91\xfdN_]\x16\xe4\xa9C\xd2\x86Qn\xefS\x80\x11J\xfb4\x14\x86 4\x95\x9e\xfc\xc1\a\xcb \x95N\xe9\xa4j\xd2\x1f^\xb0\xb2>\xa3\xc9\xb7$\x11`t\x03: \x8b\xa4\x05\xf2?E\xdb+{t\xb8\xf7\xab\x8b\x100#', 0x26e1, 0x0) ioctl$PERF_EVENT_IOC_PAUSE_OUTPUT(r1, 0x40086602, 0x400007) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000280)='./cgroup/syz0\x00', 0x1ff) openat$smack_thread_current(0xffffffffffffff9c, &(0x7f0000000240)='/proc/thread-self/attr/current\x00', 0x2, 0x0) write$cgroup_subtree(r1, &(0x7f0000000100)=ANY=[], 0xff4a) write$cgroup_subtree(r2, &(0x7f0000000000)=ANY=[], 0x20032600) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a0f, 0x1700) accept$inet(0xffffffffffffffff, &(0x7f0000000040)={0x2, 0x0, @local}, &(0x7f0000000080)=0x10) ioctl$TCSETAF(r0, 0x5408, &(0x7f0000000040)={0x2}) ioctl$EXT4_IOC_GROUP_ADD(r0, 0x40286608, &(0x7f0000000000)={0x3, 0x7000000, 0x400, 0x100000000, 0x0, 0x8}) r3 = fcntl$dupfd(r0, 0x406, r0) ioctl$EVIOCGVERSION(r3, 0x80044501, &(0x7f0000000200)=""/31) write$binfmt_misc(r0, &(0x7f0000000080)={'syz1', "80fa25cdc862d216160cfa92845a3916e38a409a159c03f1889971d3e5144a8d08de78c4b1fbee457437261d7668b1c0f582647ad4134a05358d4309a71a702002329e024cac95642e761bb842bc1056bd6bf12c47697a649a026bd8ee1f685089941469b1ddfeddf32b392f0ff07652a3bce0770bc3bb70862845a65054cecb191e80b825d740fe6b40450359757032425dfdee92aec36ce4b468d50adc745c522cc4af2ac6e7f6a95f0edd70b09caa95fcc7143cf46b74db8bc17fa7c89f"}, 0xc3) 14:03:52 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSPTLCK(r0, 0x40045431, &(0x7f0000000180)) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) socket(0x0, 0x4000000000080002, 0x0) bind$packet(0xffffffffffffffff, 0x0, 0x0) sendmmsg(0xffffffffffffffff, &(0x7f0000007880)=[{{&(0x7f00000001c0)=@l2={0x1f, 0xbf53, {0x9, 0x7, 0xfffffffffffffdd5, 0x1ff, 0x2, 0x4}, 0x0, 0x7}, 0x80, 0x0}}, {{0x0, 0x0, &(0x7f0000007780)}}], 0x2, 0x4048851) setsockopt$packet_int(0xffffffffffffffff, 0x107, 0x0, 0x0, 0x0) syz_open_procfs(0x0, 0x0) ioctl$LOOP_SET_BLOCK_SIZE(0xffffffffffffffff, 0x4c09, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$cgroup_int(0xffffffffffffffff, 0x0, 0x2, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='\x89\x00\x00\x00\x00Ew\x00\x00\x00\xef\xb4\xc8\xd0\xff\xda\xb1vents\xd9\xc5H\xd4\x91\xfdN_]\x16\xe4\xa9C\xd2\x86Qn\xefS\x80\x11J\xfb4\x14\x86 4\x95\x9e\xfc\xc1\a\xcb \x95N\xe9\xa4j\xd2\x1f^\xb0\xb2>\xa3\xc9\xb7$\x11`t\x03: \x8b\xa4\x05\xf2?E\xdb+{t\xb8\xf7\xab\x8b\x100#', 0x26e1, 0x0) ioctl$PERF_EVENT_IOC_PAUSE_OUTPUT(r1, 0x40086602, 0x400007) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000280)='./cgroup/syz0\x00', 0x1ff) openat$smack_thread_current(0xffffffffffffff9c, &(0x7f0000000240)='/proc/thread-self/attr/current\x00', 0x2, 0x0) write$cgroup_subtree(r1, &(0x7f0000000100)=ANY=[], 0xff4a) write$cgroup_subtree(r2, &(0x7f0000000000)=ANY=[], 0x20032600) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a0f, 0x1700) accept$inet(0xffffffffffffffff, &(0x7f0000000040)={0x2, 0x0, @local}, &(0x7f0000000080)=0x10) ioctl$TCSETAF(r0, 0x5408, &(0x7f0000000040)={0x2}) ioctl$EXT4_IOC_GROUP_ADD(r0, 0x40286608, &(0x7f0000000000)={0x3, 0x7000000, 0x400, 0x100000000, 0x0, 0x8}) r3 = fcntl$dupfd(r0, 0x406, r0) ioctl$EVIOCGVERSION(r3, 0x80044501, &(0x7f0000000200)=""/31) write$binfmt_misc(r0, &(0x7f0000000080)={'syz1', "80fa25cdc862d216160cfa92845a3916e38a409a159c03f1889971d3e5144a8d08de78c4b1fbee457437261d7668b1c0f582647ad4134a05358d4309a71a702002329e024cac95642e761bb842bc1056bd6bf12c47697a649a026bd8ee1f685089941469b1ddfeddf32b392f0ff07652a3bce0770bc3bb70862845a65054cecb191e80b825d740fe6b40450359757032425dfdee92aec36ce4b468d50adc745c522cc4af2ac6e7f6a95f0edd70b09caa95fcc7143cf46b74db8bc17fa7c89f"}, 0xc3) 14:03:52 executing program 1: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSPTLCK(r0, 0x40045431, &(0x7f0000000180)) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) socket(0x200000000000011, 0x4000000000080002, 0x0) bind$packet(0xffffffffffffffff, 0x0, 0x0) sendmmsg(0xffffffffffffffff, &(0x7f0000007880)=[{{&(0x7f00000001c0)=@l2={0x1f, 0xbf53, {0x9, 0x7, 0xfffffffffffffdd5, 0x1ff, 0x2, 0x4}, 0x0, 0x7}, 0x80, 0x0}}, {{0x0, 0x0, &(0x7f0000007780)}}], 0x2, 0x4048851) syz_open_procfs(0x0, 0x0) ioctl$LOOP_SET_BLOCK_SIZE(0xffffffffffffffff, 0x4c09, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$cgroup_int(0xffffffffffffffff, 0x0, 0x2, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='\x89\x00\x00\x00\x00Ew\x00\x00\x00\xef\xb4\xc8\xd0\xff\xda\xb1vents\xd9\xc5H\xd4\x91\xfdN_]\x16\xe4\xa9C\xd2\x86Qn\xefS\x80\x11J\xfb4\x14\x86 4\x95\x9e\xfc\xc1\a\xcb \x95N\xe9\xa4j\xd2\x1f^\xb0\xb2>\xa3\xc9\xb7$\x11`t\x03: \x8b\xa4\x05\xf2?E\xdb+{t\xb8\xf7\xab\x8b\x100#', 0x26e1, 0x0) ioctl$PERF_EVENT_IOC_PAUSE_OUTPUT(r1, 0x40086602, 0x400007) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000280)='./cgroup/syz0\x00', 0x1ff) openat$smack_thread_current(0xffffffffffffff9c, &(0x7f0000000240)='/proc/thread-self/attr/current\x00', 0x2, 0x0) write$cgroup_subtree(r1, &(0x7f0000000100)=ANY=[], 0xff4a) write$cgroup_subtree(r2, &(0x7f0000000000)=ANY=[], 0x20032600) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a0f, 0x1700) ioctl$TCSETAF(r0, 0x5408, &(0x7f0000000040)={0x2}) ioctl$EXT4_IOC_GROUP_ADD(r0, 0x40286608, &(0x7f0000000000)={0x3, 0x7000000, 0x400, 0x100000000, 0x0, 0x8}) ioctl$EVIOCGVERSION(0xffffffffffffffff, 0x80044501, &(0x7f0000000200)=""/31) 14:03:52 executing program 0: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSPTLCK(r0, 0x40045431, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) socket(0x200000000000011, 0x4000000000080002, 0x0) bind$packet(0xffffffffffffffff, 0x0, 0x0) sendmmsg(0xffffffffffffffff, &(0x7f0000007880)=[{{&(0x7f00000001c0)=@l2={0x1f, 0xbf53, {0x9, 0x7, 0xfffffffffffffdd5, 0x1ff, 0x2, 0x4}, 0x0, 0x7}, 0x80, 0x0}}, {{0x0, 0x0, &(0x7f0000007780)}}], 0x2, 0x4048851) setsockopt$packet_int(0xffffffffffffffff, 0x107, 0x0, 0x0, 0x0) syz_open_procfs(0x0, 0x0) ioctl$LOOP_SET_BLOCK_SIZE(0xffffffffffffffff, 0x4c09, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$cgroup_int(0xffffffffffffffff, 0x0, 0x2, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='\x89\x00\x00\x00\x00Ew\x00\x00\x00\xef\xb4\xc8\xd0\xff\xda\xb1vents\xd9\xc5H\xd4\x91\xfdN_]\x16\xe4\xa9C\xd2\x86Qn\xefS\x80\x11J\xfb4\x14\x86 4\x95\x9e\xfc\xc1\a\xcb \x95N\xe9\xa4j\xd2\x1f^\xb0\xb2>\xa3\xc9\xb7$\x11`t\x03: \x8b\xa4\x05\xf2?E\xdb+{t\xb8\xf7\xab\x8b\x100#', 0x26e1, 0x0) ioctl$PERF_EVENT_IOC_PAUSE_OUTPUT(r1, 0x40086602, 0x400007) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000280)='./cgroup/syz0\x00', 0x1ff) openat$smack_thread_current(0xffffffffffffff9c, &(0x7f0000000240)='/proc/thread-self/attr/current\x00', 0x2, 0x0) write$cgroup_subtree(r1, &(0x7f0000000100)=ANY=[], 0xff4a) write$cgroup_subtree(r2, &(0x7f0000000000)=ANY=[], 0x20032600) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a0f, 0x1700) accept$inet(0xffffffffffffffff, &(0x7f0000000040)={0x2, 0x0, @local}, &(0x7f0000000080)=0x10) ioctl$TCSETAF(r0, 0x5408, &(0x7f0000000040)={0x2}) ioctl$EXT4_IOC_GROUP_ADD(r0, 0x40286608, &(0x7f0000000000)={0x3, 0x7000000, 0x400, 0x100000000, 0x0, 0x8}) r3 = fcntl$dupfd(r0, 0x406, r0) ioctl$EVIOCGVERSION(r3, 0x80044501, &(0x7f0000000200)=""/31) write$binfmt_misc(r0, &(0x7f0000000080)={'syz1', "80fa25cdc862d216160cfa92845a3916e38a409a159c03f1889971d3e5144a8d08de78c4b1fbee457437261d7668b1c0f582647ad4134a05358d4309a71a702002329e024cac95642e761bb842bc1056bd6bf12c47697a649a026bd8ee1f685089941469b1ddfeddf32b392f0ff07652a3bce0770bc3bb70862845a65054cecb191e80b825d740fe6b40450359757032425dfdee92aec36ce4b468d50adc745c522cc4af2ac6e7f6a95f0edd70b09caa95fcc7143cf46b74db8bc17fa7c89f"}, 0xc3) 14:03:52 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSPTLCK(r0, 0x40045431, &(0x7f0000000180)) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) socket(0x0, 0x4000000000080002, 0x0) bind$packet(0xffffffffffffffff, 0x0, 0x0) sendmmsg(0xffffffffffffffff, &(0x7f0000007880)=[{{&(0x7f00000001c0)=@l2={0x1f, 0xbf53, {0x9, 0x7, 0xfffffffffffffdd5, 0x1ff, 0x2, 0x4}, 0x0, 0x7}, 0x80, 0x0}}, {{0x0, 0x0, &(0x7f0000007780)}}], 0x2, 0x4048851) setsockopt$packet_int(0xffffffffffffffff, 0x107, 0x0, 0x0, 0x0) syz_open_procfs(0x0, 0x0) ioctl$LOOP_SET_BLOCK_SIZE(0xffffffffffffffff, 0x4c09, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$cgroup_int(0xffffffffffffffff, 0x0, 0x2, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='\x89\x00\x00\x00\x00Ew\x00\x00\x00\xef\xb4\xc8\xd0\xff\xda\xb1vents\xd9\xc5H\xd4\x91\xfdN_]\x16\xe4\xa9C\xd2\x86Qn\xefS\x80\x11J\xfb4\x14\x86 4\x95\x9e\xfc\xc1\a\xcb \x95N\xe9\xa4j\xd2\x1f^\xb0\xb2>\xa3\xc9\xb7$\x11`t\x03: \x8b\xa4\x05\xf2?E\xdb+{t\xb8\xf7\xab\x8b\x100#', 0x26e1, 0x0) ioctl$PERF_EVENT_IOC_PAUSE_OUTPUT(r1, 0x40086602, 0x400007) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000280)='./cgroup/syz0\x00', 0x1ff) openat$smack_thread_current(0xffffffffffffff9c, &(0x7f0000000240)='/proc/thread-self/attr/current\x00', 0x2, 0x0) write$cgroup_subtree(r1, &(0x7f0000000100)=ANY=[], 0xff4a) write$cgroup_subtree(r2, &(0x7f0000000000)=ANY=[], 0x20032600) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a0f, 0x1700) accept$inet(0xffffffffffffffff, &(0x7f0000000040)={0x2, 0x0, @local}, &(0x7f0000000080)=0x10) ioctl$TCSETAF(r0, 0x5408, &(0x7f0000000040)={0x2}) ioctl$EXT4_IOC_GROUP_ADD(r0, 0x40286608, &(0x7f0000000000)={0x3, 0x7000000, 0x400, 0x100000000, 0x0, 0x8}) r3 = fcntl$dupfd(r0, 0x406, r0) ioctl$EVIOCGVERSION(r3, 0x80044501, &(0x7f0000000200)=""/31) write$binfmt_misc(r0, &(0x7f0000000080)={'syz1', "80fa25cdc862d216160cfa92845a3916e38a409a159c03f1889971d3e5144a8d08de78c4b1fbee457437261d7668b1c0f582647ad4134a05358d4309a71a702002329e024cac95642e761bb842bc1056bd6bf12c47697a649a026bd8ee1f685089941469b1ddfeddf32b392f0ff07652a3bce0770bc3bb70862845a65054cecb191e80b825d740fe6b40450359757032425dfdee92aec36ce4b468d50adc745c522cc4af2ac6e7f6a95f0edd70b09caa95fcc7143cf46b74db8bc17fa7c89f"}, 0xc3) 14:03:52 executing program 4: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSPTLCK(r0, 0x40045431, &(0x7f0000000180)) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) socket(0x200000000000011, 0x4000000000080002, 0x0) bind$packet(0xffffffffffffffff, 0x0, 0x0) sendmmsg(0xffffffffffffffff, &(0x7f0000007880)=[{{&(0x7f00000001c0)=@l2={0x1f, 0xbf53, {0x9, 0x7, 0xfffffffffffffdd5, 0x1ff, 0x2, 0x4}, 0x0, 0x7}, 0x80, 0x0}}, {{0x0, 0x0, &(0x7f0000007780)}}], 0x2, 0x4048851) syz_open_procfs(0x0, 0x0) ioctl$LOOP_SET_BLOCK_SIZE(0xffffffffffffffff, 0x4c09, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$cgroup_int(0xffffffffffffffff, 0x0, 0x2, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='\x89\x00\x00\x00\x00Ew\x00\x00\x00\xef\xb4\xc8\xd0\xff\xda\xb1vents\xd9\xc5H\xd4\x91\xfdN_]\x16\xe4\xa9C\xd2\x86Qn\xefS\x80\x11J\xfb4\x14\x86 4\x95\x9e\xfc\xc1\a\xcb \x95N\xe9\xa4j\xd2\x1f^\xb0\xb2>\xa3\xc9\xb7$\x11`t\x03: \x8b\xa4\x05\xf2?E\xdb+{t\xb8\xf7\xab\x8b\x100#', 0x26e1, 0x0) ioctl$PERF_EVENT_IOC_PAUSE_OUTPUT(r1, 0x40086602, 0x400007) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000280)='./cgroup/syz0\x00', 0x1ff) openat$smack_thread_current(0xffffffffffffff9c, &(0x7f0000000240)='/proc/thread-self/attr/current\x00', 0x2, 0x0) write$cgroup_subtree(r1, &(0x7f0000000100)=ANY=[], 0xff4a) write$cgroup_subtree(r2, &(0x7f0000000000)=ANY=[], 0x20032600) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a0f, 0x1700) accept$inet(0xffffffffffffffff, &(0x7f0000000040)={0x2, 0x0, @local}, &(0x7f0000000080)=0x10) ioctl$EXT4_IOC_GROUP_ADD(r0, 0x40286608, &(0x7f0000000000)={0x3, 0x7000000, 0x400, 0x100000000, 0x0, 0x8}) ioctl$EVIOCGVERSION(0xffffffffffffffff, 0x80044501, &(0x7f0000000200)=""/31) 14:03:52 executing program 5: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSPTLCK(r0, 0x40045431, &(0x7f0000000180)) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) socket(0x200000000000011, 0x4000000000080002, 0x0) bind$packet(0xffffffffffffffff, 0x0, 0x0) sendmmsg(0xffffffffffffffff, &(0x7f0000007880)=[{{&(0x7f00000001c0)=@l2={0x1f, 0xbf53, {0x9, 0x7, 0xfffffffffffffdd5, 0x1ff, 0x2, 0x4}, 0x0, 0x7}, 0x80, 0x0}}, {{0x0, 0x0, &(0x7f0000007780)}}], 0x2, 0x4048851) setsockopt$packet_int(0xffffffffffffffff, 0x107, 0x0, 0x0, 0x0) syz_open_procfs(0x0, 0x0) ioctl$LOOP_SET_BLOCK_SIZE(0xffffffffffffffff, 0x4c09, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$cgroup_int(0xffffffffffffffff, 0x0, 0x2, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='\x89\x00\x00\x00\x00Ew\x00\x00\x00\xef\xb4\xc8\xd0\xff\xda\xb1vents\xd9\xc5H\xd4\x91\xfdN_]\x16\xe4\xa9C\xd2\x86Qn\xefS\x80\x11J\xfb4\x14\x86 4\x95\x9e\xfc\xc1\a\xcb \x95N\xe9\xa4j\xd2\x1f^\xb0\xb2>\xa3\xc9\xb7$\x11`t\x03: \x8b\xa4\x05\xf2?E\xdb+{t\xb8\xf7\xab\x8b\x100#', 0x26e1, 0x0) ioctl$PERF_EVENT_IOC_PAUSE_OUTPUT(r1, 0x40086602, 0x400007) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000280)='./cgroup/syz0\x00', 0x1ff) openat$smack_thread_current(0xffffffffffffff9c, &(0x7f0000000240)='/proc/thread-self/attr/current\x00', 0x2, 0x0) write$cgroup_subtree(r1, &(0x7f0000000100)=ANY=[], 0xff4a) write$cgroup_subtree(0xffffffffffffffff, &(0x7f0000000000)=ANY=[], 0x20032600) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a0f, 0x1700) accept$inet(0xffffffffffffffff, &(0x7f0000000040)={0x2, 0x0, @local}, &(0x7f0000000080)=0x10) ioctl$TCSETAF(r0, 0x5408, &(0x7f0000000040)={0x2}) ioctl$EXT4_IOC_GROUP_ADD(r0, 0x40286608, &(0x7f0000000000)={0x3, 0x7000000, 0x400, 0x100000000, 0x0, 0x8}) r2 = fcntl$dupfd(r0, 0x406, r0) ioctl$EVIOCGVERSION(r2, 0x80044501, &(0x7f0000000200)=""/31) write$binfmt_misc(r0, &(0x7f0000000080)={'syz1', "80fa25cdc862d216160cfa92845a3916e38a409a159c03f1889971d3e5144a8d08de78c4b1fbee457437261d7668b1c0f582647ad4134a05358d4309a71a702002329e024cac95642e761bb842bc1056bd6bf12c47697a649a026bd8ee1f685089941469b1ddfeddf32b392f0ff07652a3bce0770bc3bb70862845a65054cecb191e80b825d740fe6b40450359757032425dfdee92aec36ce4b468d50adc745c522cc4af2ac6e7f6a95f0edd70b09caa95fcc7143cf46b74db8bc17fa7c89f"}, 0xc3) 14:03:52 executing program 1: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSPTLCK(r0, 0x40045431, &(0x7f0000000180)) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) socket(0x200000000000011, 0x4000000000080002, 0x0) bind$packet(0xffffffffffffffff, 0x0, 0x0) sendmmsg(0xffffffffffffffff, &(0x7f0000007880)=[{{&(0x7f00000001c0)=@l2={0x1f, 0xbf53, {0x9, 0x7, 0xfffffffffffffdd5, 0x1ff, 0x2, 0x4}, 0x0, 0x7}, 0x80, 0x0}}, {{0x0, 0x0, &(0x7f0000007780)}}], 0x2, 0x4048851) syz_open_procfs(0x0, 0x0) ioctl$LOOP_SET_BLOCK_SIZE(0xffffffffffffffff, 0x4c09, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$cgroup_int(0xffffffffffffffff, 0x0, 0x2, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='\x89\x00\x00\x00\x00Ew\x00\x00\x00\xef\xb4\xc8\xd0\xff\xda\xb1vents\xd9\xc5H\xd4\x91\xfdN_]\x16\xe4\xa9C\xd2\x86Qn\xefS\x80\x11J\xfb4\x14\x86 4\x95\x9e\xfc\xc1\a\xcb \x95N\xe9\xa4j\xd2\x1f^\xb0\xb2>\xa3\xc9\xb7$\x11`t\x03: \x8b\xa4\x05\xf2?E\xdb+{t\xb8\xf7\xab\x8b\x100#', 0x26e1, 0x0) ioctl$PERF_EVENT_IOC_PAUSE_OUTPUT(r1, 0x40086602, 0x400007) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000280)='./cgroup/syz0\x00', 0x1ff) openat$smack_thread_current(0xffffffffffffff9c, &(0x7f0000000240)='/proc/thread-self/attr/current\x00', 0x2, 0x0) write$cgroup_subtree(r1, &(0x7f0000000100)=ANY=[], 0xff4a) write$cgroup_subtree(r2, &(0x7f0000000000)=ANY=[], 0x20032600) ioctl$TCSETAF(r0, 0x5408, &(0x7f0000000040)={0x2}) ioctl$EXT4_IOC_GROUP_ADD(r0, 0x40286608, &(0x7f0000000000)={0x3, 0x7000000, 0x400, 0x100000000, 0x0, 0x8}) ioctl$EVIOCGVERSION(0xffffffffffffffff, 0x80044501, &(0x7f0000000200)=""/31) 14:03:52 executing program 3: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSPTLCK(r0, 0x40045431, &(0x7f0000000180)) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) socket(0x200000000000011, 0x4000000000080002, 0x0) bind$packet(0xffffffffffffffff, 0x0, 0x0) sendmmsg(0xffffffffffffffff, &(0x7f0000007880)=[{{&(0x7f00000001c0)=@l2={0x1f, 0xbf53, {0x9, 0x7, 0xfffffffffffffdd5, 0x1ff, 0x2, 0x4}, 0x0, 0x7}, 0x80, 0x0}}, {{0x0, 0x0, &(0x7f0000007780)}}], 0x2, 0x4048851) syz_open_procfs(0x0, 0x0) ioctl$LOOP_SET_BLOCK_SIZE(0xffffffffffffffff, 0x4c09, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$cgroup_int(0xffffffffffffffff, 0x0, 0x2, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='\x89\x00\x00\x00\x00Ew\x00\x00\x00\xef\xb4\xc8\xd0\xff\xda\xb1vents\xd9\xc5H\xd4\x91\xfdN_]\x16\xe4\xa9C\xd2\x86Qn\xefS\x80\x11J\xfb4\x14\x86 4\x95\x9e\xfc\xc1\a\xcb \x95N\xe9\xa4j\xd2\x1f^\xb0\xb2>\xa3\xc9\xb7$\x11`t\x03: \x8b\xa4\x05\xf2?E\xdb+{t\xb8\xf7\xab\x8b\x100#', 0x26e1, 0x0) ioctl$PERF_EVENT_IOC_PAUSE_OUTPUT(r1, 0x40086602, 0x400007) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000280)='./cgroup/syz0\x00', 0x1ff) openat$smack_thread_current(0xffffffffffffff9c, &(0x7f0000000240)='/proc/thread-self/attr/current\x00', 0x2, 0x0) write$cgroup_subtree(r1, &(0x7f0000000100)=ANY=[], 0xff4a) write$cgroup_subtree(r2, &(0x7f0000000000)=ANY=[], 0x20032600) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a0f, 0x1700) ioctl$TCSETAF(r0, 0x5408, &(0x7f0000000040)={0x2}) ioctl$EXT4_IOC_GROUP_ADD(r0, 0x40286608, &(0x7f0000000000)={0x3, 0x7000000, 0x400, 0x100000000, 0x0, 0x8}) ioctl$EVIOCGVERSION(0xffffffffffffffff, 0x80044501, &(0x7f0000000200)=""/31) 14:03:52 executing program 0: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSPTLCK(r0, 0x40045431, &(0x7f0000000180)) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) socket(0x200000000000011, 0x4000000000080002, 0x0) bind$packet(0xffffffffffffffff, 0x0, 0x0) sendmmsg(0xffffffffffffffff, &(0x7f0000007880)=[{{&(0x7f00000001c0)=@l2={0x1f, 0xbf53, {0x9, 0x7, 0xfffffffffffffdd5, 0x1ff, 0x2, 0x4}, 0x0, 0x7}, 0x80, 0x0}}, {{0x0, 0x0, &(0x7f0000007780)}}], 0x2, 0x4048851) setsockopt$packet_int(0xffffffffffffffff, 0x107, 0x0, 0x0, 0x0) syz_open_procfs(0x0, 0x0) ioctl$LOOP_SET_BLOCK_SIZE(0xffffffffffffffff, 0x4c09, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$cgroup_int(0xffffffffffffffff, 0x0, 0x2, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='\x89\x00\x00\x00\x00Ew\x00\x00\x00\xef\xb4\xc8\xd0\xff\xda\xb1vents\xd9\xc5H\xd4\x91\xfdN_]\x16\xe4\xa9C\xd2\x86Qn\xefS\x80\x11J\xfb4\x14\x86 4\x95\x9e\xfc\xc1\a\xcb \x95N\xe9\xa4j\xd2\x1f^\xb0\xb2>\xa3\xc9\xb7$\x11`t\x03: \x8b\xa4\x05\xf2?E\xdb+{t\xb8\xf7\xab\x8b\x100#', 0x26e1, 0x0) ioctl$PERF_EVENT_IOC_PAUSE_OUTPUT(r1, 0x40086602, 0x400007) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000280)='./cgroup/syz0\x00', 0x1ff) write$cgroup_subtree(r1, &(0x7f0000000100)=ANY=[], 0xff4a) write$cgroup_subtree(r2, &(0x7f0000000000)=ANY=[], 0x20032600) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a0f, 0x1700) accept$inet(0xffffffffffffffff, &(0x7f0000000040)={0x2, 0x0, @local}, &(0x7f0000000080)=0x10) ioctl$TCSETAF(r0, 0x5408, &(0x7f0000000040)={0x2}) ioctl$EXT4_IOC_GROUP_ADD(r0, 0x40286608, &(0x7f0000000000)={0x3, 0x7000000, 0x400, 0x100000000, 0x0, 0x8}) r3 = fcntl$dupfd(r0, 0x406, r0) ioctl$EVIOCGVERSION(r3, 0x80044501, &(0x7f0000000200)=""/31) write$binfmt_misc(r0, &(0x7f0000000080)={'syz1', "80fa25cdc862d216160cfa92845a3916e38a409a159c03f1889971d3e5144a8d08de78c4b1fbee457437261d7668b1c0f582647ad4134a05358d4309a71a702002329e024cac95642e761bb842bc1056bd6bf12c47697a649a026bd8ee1f685089941469b1ddfeddf32b392f0ff07652a3bce0770bc3bb70862845a65054cecb191e80b825d740fe6b40450359757032425dfdee92aec36ce4b468d50adc745c522cc4af2ac6e7f6a95f0edd70b09caa95fcc7143cf46b74db8bc17fa7c89f"}, 0xc3) 14:03:52 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) r2 = fcntl$dupfd(r1, 0x0, r1) write$P9_RRENAME(r2, &(0x7f0000000080)={0x7, 0x15, 0x2}, 0x7) getsockname$netlink(r1, &(0x7f0000000000), &(0x7f0000000040)=0xc) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f00000001c0)=[@acquire], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=ANY=[@ANYBLOB="0e630c408c0d0000"], 0x0, 0x0, 0x0}) 14:03:52 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSPTLCK(r0, 0x40045431, &(0x7f0000000180)) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) socket(0x0, 0x4000000000080002, 0x0) bind$packet(0xffffffffffffffff, 0x0, 0x0) sendmmsg(0xffffffffffffffff, &(0x7f0000007880)=[{{&(0x7f00000001c0)=@l2={0x1f, 0xbf53, {0x9, 0x7, 0xfffffffffffffdd5, 0x1ff, 0x2, 0x4}, 0x0, 0x7}, 0x80, 0x0}}, {{0x0, 0x0, &(0x7f0000007780)}}], 0x2, 0x4048851) setsockopt$packet_int(0xffffffffffffffff, 0x107, 0x0, 0x0, 0x0) syz_open_procfs(0x0, 0x0) ioctl$LOOP_SET_BLOCK_SIZE(0xffffffffffffffff, 0x4c09, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$cgroup_int(0xffffffffffffffff, 0x0, 0x2, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='\x89\x00\x00\x00\x00Ew\x00\x00\x00\xef\xb4\xc8\xd0\xff\xda\xb1vents\xd9\xc5H\xd4\x91\xfdN_]\x16\xe4\xa9C\xd2\x86Qn\xefS\x80\x11J\xfb4\x14\x86 4\x95\x9e\xfc\xc1\a\xcb \x95N\xe9\xa4j\xd2\x1f^\xb0\xb2>\xa3\xc9\xb7$\x11`t\x03: \x8b\xa4\x05\xf2?E\xdb+{t\xb8\xf7\xab\x8b\x100#', 0x26e1, 0x0) ioctl$PERF_EVENT_IOC_PAUSE_OUTPUT(r1, 0x40086602, 0x400007) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000280)='./cgroup/syz0\x00', 0x1ff) openat$smack_thread_current(0xffffffffffffff9c, &(0x7f0000000240)='/proc/thread-self/attr/current\x00', 0x2, 0x0) write$cgroup_subtree(r1, &(0x7f0000000100)=ANY=[], 0xff4a) write$cgroup_subtree(r2, &(0x7f0000000000)=ANY=[], 0x20032600) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a0f, 0x1700) accept$inet(0xffffffffffffffff, &(0x7f0000000040)={0x2, 0x0, @local}, &(0x7f0000000080)=0x10) ioctl$TCSETAF(r0, 0x5408, &(0x7f0000000040)={0x2}) ioctl$EXT4_IOC_GROUP_ADD(r0, 0x40286608, &(0x7f0000000000)={0x3, 0x7000000, 0x400, 0x100000000, 0x0, 0x8}) r3 = fcntl$dupfd(r0, 0x406, r0) ioctl$EVIOCGVERSION(r3, 0x80044501, &(0x7f0000000200)=""/31) write$binfmt_misc(r0, &(0x7f0000000080)={'syz1', "80fa25cdc862d216160cfa92845a3916e38a409a159c03f1889971d3e5144a8d08de78c4b1fbee457437261d7668b1c0f582647ad4134a05358d4309a71a702002329e024cac95642e761bb842bc1056bd6bf12c47697a649a026bd8ee1f685089941469b1ddfeddf32b392f0ff07652a3bce0770bc3bb70862845a65054cecb191e80b825d740fe6b40450359757032425dfdee92aec36ce4b468d50adc745c522cc4af2ac6e7f6a95f0edd70b09caa95fcc7143cf46b74db8bc17fa7c89f"}, 0xc3) 14:03:52 executing program 1: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSPTLCK(r0, 0x40045431, &(0x7f0000000180)) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) socket(0x200000000000011, 0x4000000000080002, 0x0) bind$packet(0xffffffffffffffff, 0x0, 0x0) sendmmsg(0xffffffffffffffff, &(0x7f0000007880)=[{{&(0x7f00000001c0)=@l2={0x1f, 0xbf53, {0x9, 0x7, 0xfffffffffffffdd5, 0x1ff, 0x2, 0x4}, 0x0, 0x7}, 0x80, 0x0}}, {{0x0, 0x0, &(0x7f0000007780)}}], 0x2, 0x4048851) syz_open_procfs(0x0, 0x0) ioctl$LOOP_SET_BLOCK_SIZE(0xffffffffffffffff, 0x4c09, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$cgroup_int(0xffffffffffffffff, 0x0, 0x2, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='\x89\x00\x00\x00\x00Ew\x00\x00\x00\xef\xb4\xc8\xd0\xff\xda\xb1vents\xd9\xc5H\xd4\x91\xfdN_]\x16\xe4\xa9C\xd2\x86Qn\xefS\x80\x11J\xfb4\x14\x86 4\x95\x9e\xfc\xc1\a\xcb \x95N\xe9\xa4j\xd2\x1f^\xb0\xb2>\xa3\xc9\xb7$\x11`t\x03: \x8b\xa4\x05\xf2?E\xdb+{t\xb8\xf7\xab\x8b\x100#', 0x26e1, 0x0) ioctl$PERF_EVENT_IOC_PAUSE_OUTPUT(r1, 0x40086602, 0x400007) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000280)='./cgroup/syz0\x00', 0x1ff) openat$smack_thread_current(0xffffffffffffff9c, &(0x7f0000000240)='/proc/thread-self/attr/current\x00', 0x2, 0x0) write$cgroup_subtree(r1, &(0x7f0000000100)=ANY=[], 0xff4a) write$cgroup_subtree(r2, &(0x7f0000000000)=ANY=[], 0x20032600) ioctl$TCSETAF(r0, 0x5408, &(0x7f0000000040)={0x2}) ioctl$EXT4_IOC_GROUP_ADD(r0, 0x40286608, &(0x7f0000000000)={0x3, 0x7000000, 0x400, 0x100000000, 0x0, 0x8}) ioctl$EVIOCGVERSION(0xffffffffffffffff, 0x80044501, &(0x7f0000000200)=""/31) 14:03:52 executing program 3: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSPTLCK(r0, 0x40045431, &(0x7f0000000180)) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) socket(0x0, 0x4000000000080002, 0x0) bind$packet(0xffffffffffffffff, 0x0, 0x0) sendmmsg(0xffffffffffffffff, &(0x7f0000007880)=[{{&(0x7f00000001c0)=@l2={0x1f, 0xbf53, {0x9, 0x7, 0xfffffffffffffdd5, 0x1ff, 0x2, 0x4}, 0x0, 0x7}, 0x80, 0x0}}, {{0x0, 0x0, &(0x7f0000007780)}}], 0x2, 0x4048851) setsockopt$packet_int(0xffffffffffffffff, 0x107, 0x0, 0x0, 0x0) syz_open_procfs(0x0, 0x0) ioctl$LOOP_SET_BLOCK_SIZE(0xffffffffffffffff, 0x4c09, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$cgroup_int(0xffffffffffffffff, 0x0, 0x2, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='\x89\x00\x00\x00\x00Ew\x00\x00\x00\xef\xb4\xc8\xd0\xff\xda\xb1vents\xd9\xc5H\xd4\x91\xfdN_]\x16\xe4\xa9C\xd2\x86Qn\xefS\x80\x11J\xfb4\x14\x86 4\x95\x9e\xfc\xc1\a\xcb \x95N\xe9\xa4j\xd2\x1f^\xb0\xb2>\xa3\xc9\xb7$\x11`t\x03: \x8b\xa4\x05\xf2?E\xdb+{t\xb8\xf7\xab\x8b\x100#', 0x26e1, 0x0) ioctl$PERF_EVENT_IOC_PAUSE_OUTPUT(r1, 0x40086602, 0x400007) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000280)='./cgroup/syz0\x00', 0x1ff) openat$smack_thread_current(0xffffffffffffff9c, &(0x7f0000000240)='/proc/thread-self/attr/current\x00', 0x2, 0x0) write$cgroup_subtree(r1, &(0x7f0000000100)=ANY=[], 0xff4a) write$cgroup_subtree(r2, &(0x7f0000000000)=ANY=[], 0x20032600) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a0f, 0x1700) accept$inet(0xffffffffffffffff, &(0x7f0000000040)={0x2, 0x0, @local}, &(0x7f0000000080)=0x10) ioctl$TCSETAF(r0, 0x5408, &(0x7f0000000040)={0x2}) ioctl$EXT4_IOC_GROUP_ADD(r0, 0x40286608, &(0x7f0000000000)={0x3, 0x7000000, 0x400, 0x100000000, 0x0, 0x8}) r3 = fcntl$dupfd(r0, 0x406, r0) ioctl$EVIOCGVERSION(r3, 0x80044501, &(0x7f0000000200)=""/31) write$binfmt_misc(r0, &(0x7f0000000080)={'syz1', "80fa25cdc862d216160cfa92845a3916e38a409a159c03f1889971d3e5144a8d08de78c4b1fbee457437261d7668b1c0f582647ad4134a05358d4309a71a702002329e024cac95642e761bb842bc1056bd6bf12c47697a649a026bd8ee1f685089941469b1ddfeddf32b392f0ff07652a3bce0770bc3bb70862845a65054cecb191e80b825d740fe6b40450359757032425dfdee92aec36ce4b468d50adc745c522cc4af2ac6e7f6a95f0edd70b09caa95fcc7143cf46b74db8bc17fa7c89f"}, 0xc3) 14:03:52 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) r2 = fcntl$dupfd(r1, 0x0, r1) write$P9_RRENAME(r2, &(0x7f0000000080)={0x7, 0x15, 0x2}, 0x7) getsockname$netlink(r1, &(0x7f0000000000), &(0x7f0000000040)=0xc) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f00000001c0)=[@acquire], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=ANY=[@ANYBLOB="0e630c408c0d0000"], 0x0, 0x0, 0x0}) 14:03:52 executing program 5: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSPTLCK(r0, 0x40045431, &(0x7f0000000180)) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) socket(0x200000000000011, 0x4000000000080002, 0x0) bind$packet(0xffffffffffffffff, 0x0, 0x0) sendmmsg(0xffffffffffffffff, &(0x7f0000007880)=[{{&(0x7f00000001c0)=@l2={0x1f, 0xbf53, {0x9, 0x7, 0xfffffffffffffdd5, 0x1ff, 0x2, 0x4}, 0x0, 0x7}, 0x80, 0x0}}, {{0x0, 0x0, &(0x7f0000007780)}}], 0x2, 0x4048851) setsockopt$packet_int(0xffffffffffffffff, 0x107, 0x0, 0x0, 0x0) syz_open_procfs(0x0, 0x0) ioctl$LOOP_SET_BLOCK_SIZE(0xffffffffffffffff, 0x4c09, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$cgroup_int(0xffffffffffffffff, 0x0, 0x2, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='\x89\x00\x00\x00\x00Ew\x00\x00\x00\xef\xb4\xc8\xd0\xff\xda\xb1vents\xd9\xc5H\xd4\x91\xfdN_]\x16\xe4\xa9C\xd2\x86Qn\xefS\x80\x11J\xfb4\x14\x86 4\x95\x9e\xfc\xc1\a\xcb \x95N\xe9\xa4j\xd2\x1f^\xb0\xb2>\xa3\xc9\xb7$\x11`t\x03: \x8b\xa4\x05\xf2?E\xdb+{t\xb8\xf7\xab\x8b\x100#', 0x26e1, 0x0) ioctl$PERF_EVENT_IOC_PAUSE_OUTPUT(r1, 0x40086602, 0x400007) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000280)='./cgroup/syz0\x00', 0x1ff) openat$smack_thread_current(0xffffffffffffff9c, &(0x7f0000000240)='/proc/thread-self/attr/current\x00', 0x2, 0x0) write$cgroup_subtree(r2, &(0x7f0000000000)=ANY=[], 0x20032600) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a0f, 0x1700) accept$inet(0xffffffffffffffff, &(0x7f0000000040)={0x2, 0x0, @local}, &(0x7f0000000080)=0x10) ioctl$TCSETAF(r0, 0x5408, &(0x7f0000000040)={0x2}) ioctl$EXT4_IOC_GROUP_ADD(r0, 0x40286608, &(0x7f0000000000)={0x3, 0x7000000, 0x400, 0x100000000, 0x0, 0x8}) r3 = fcntl$dupfd(r0, 0x406, r0) ioctl$EVIOCGVERSION(r3, 0x80044501, &(0x7f0000000200)=""/31) write$binfmt_misc(r0, &(0x7f0000000080)={'syz1', "80fa25cdc862d216160cfa92845a3916e38a409a159c03f1889971d3e5144a8d08de78c4b1fbee457437261d7668b1c0f582647ad4134a05358d4309a71a702002329e024cac95642e761bb842bc1056bd6bf12c47697a649a026bd8ee1f685089941469b1ddfeddf32b392f0ff07652a3bce0770bc3bb70862845a65054cecb191e80b825d740fe6b40450359757032425dfdee92aec36ce4b468d50adc745c522cc4af2ac6e7f6a95f0edd70b09caa95fcc7143cf46b74db8bc17fa7c89f"}, 0xc3) [ 339.320970] binder: 10718:10719 BC_REQUEST_DEATH_NOTIFICATION invalid ref 3468 14:03:52 executing program 0: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSPTLCK(r0, 0x40045431, &(0x7f0000000180)) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) socket(0x200000000000011, 0x4000000000080002, 0x0) bind$packet(0xffffffffffffffff, 0x0, 0x0) sendmmsg(0xffffffffffffffff, &(0x7f0000007880)=[{{&(0x7f00000001c0)=@l2={0x1f, 0xbf53, {0x9, 0x7, 0xfffffffffffffdd5, 0x1ff, 0x2, 0x4}, 0x0, 0x7}, 0x80, 0x0}}, {{0x0, 0x0, &(0x7f0000007780)}}], 0x2, 0x4048851) setsockopt$packet_int(0xffffffffffffffff, 0x107, 0x0, 0x0, 0x0) syz_open_procfs(0x0, 0x0) ioctl$LOOP_SET_BLOCK_SIZE(0xffffffffffffffff, 0x4c09, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$cgroup_int(0xffffffffffffffff, 0x0, 0x2, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='\x89\x00\x00\x00\x00Ew\x00\x00\x00\xef\xb4\xc8\xd0\xff\xda\xb1vents\xd9\xc5H\xd4\x91\xfdN_]\x16\xe4\xa9C\xd2\x86Qn\xefS\x80\x11J\xfb4\x14\x86 4\x95\x9e\xfc\xc1\a\xcb \x95N\xe9\xa4j\xd2\x1f^\xb0\xb2>\xa3\xc9\xb7$\x11`t\x03: \x8b\xa4\x05\xf2?E\xdb+{t\xb8\xf7\xab\x8b\x100#', 0x26e1, 0x0) ioctl$PERF_EVENT_IOC_PAUSE_OUTPUT(r1, 0x40086602, 0x400007) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000280)='./cgroup/syz0\x00', 0x1ff) openat$smack_thread_current(0xffffffffffffff9c, &(0x7f0000000240)='/proc/thread-self/attr/current\x00', 0x2, 0x0) write$cgroup_subtree(r2, &(0x7f0000000000)=ANY=[], 0x20032600) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a0f, 0x1700) accept$inet(0xffffffffffffffff, &(0x7f0000000040)={0x2, 0x0, @local}, &(0x7f0000000080)=0x10) ioctl$TCSETAF(r0, 0x5408, &(0x7f0000000040)={0x2}) ioctl$EXT4_IOC_GROUP_ADD(r0, 0x40286608, &(0x7f0000000000)={0x3, 0x7000000, 0x400, 0x100000000, 0x0, 0x8}) r3 = fcntl$dupfd(r0, 0x406, r0) ioctl$EVIOCGVERSION(r3, 0x80044501, &(0x7f0000000200)=""/31) write$binfmt_misc(r0, &(0x7f0000000080)={'syz1', "80fa25cdc862d216160cfa92845a3916e38a409a159c03f1889971d3e5144a8d08de78c4b1fbee457437261d7668b1c0f582647ad4134a05358d4309a71a702002329e024cac95642e761bb842bc1056bd6bf12c47697a649a026bd8ee1f685089941469b1ddfeddf32b392f0ff07652a3bce0770bc3bb70862845a65054cecb191e80b825d740fe6b40450359757032425dfdee92aec36ce4b468d50adc745c522cc4af2ac6e7f6a95f0edd70b09caa95fcc7143cf46b74db8bc17fa7c89f"}, 0xc3) [ 339.368746] binder: 10730:10732 BC_REQUEST_DEATH_NOTIFICATION invalid ref 3468 14:03:52 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) r2 = fcntl$dupfd(r1, 0x0, r1) write$P9_RRENAME(r2, &(0x7f0000000080)={0x7, 0x15, 0x2}, 0x7) getsockname$netlink(r1, &(0x7f0000000000), &(0x7f0000000040)=0xc) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f00000001c0)=[@acquire], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=ANY=[@ANYBLOB="0e630c408c0d0000"], 0x0, 0x0, 0x0}) 14:03:53 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSPTLCK(r0, 0x40045431, &(0x7f0000000180)) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) socket(0x200000000000011, 0x0, 0x0) bind$packet(0xffffffffffffffff, 0x0, 0x0) sendmmsg(0xffffffffffffffff, &(0x7f0000007880)=[{{&(0x7f00000001c0)=@l2={0x1f, 0xbf53, {0x9, 0x7, 0xfffffffffffffdd5, 0x1ff, 0x2, 0x4}, 0x0, 0x7}, 0x80, 0x0}}, {{0x0, 0x0, &(0x7f0000007780)}}], 0x2, 0x4048851) setsockopt$packet_int(0xffffffffffffffff, 0x107, 0x0, 0x0, 0x0) syz_open_procfs(0x0, 0x0) ioctl$LOOP_SET_BLOCK_SIZE(0xffffffffffffffff, 0x4c09, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$cgroup_int(0xffffffffffffffff, 0x0, 0x2, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='\x89\x00\x00\x00\x00Ew\x00\x00\x00\xef\xb4\xc8\xd0\xff\xda\xb1vents\xd9\xc5H\xd4\x91\xfdN_]\x16\xe4\xa9C\xd2\x86Qn\xefS\x80\x11J\xfb4\x14\x86 4\x95\x9e\xfc\xc1\a\xcb \x95N\xe9\xa4j\xd2\x1f^\xb0\xb2>\xa3\xc9\xb7$\x11`t\x03: \x8b\xa4\x05\xf2?E\xdb+{t\xb8\xf7\xab\x8b\x100#', 0x26e1, 0x0) ioctl$PERF_EVENT_IOC_PAUSE_OUTPUT(r1, 0x40086602, 0x400007) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000280)='./cgroup/syz0\x00', 0x1ff) openat$smack_thread_current(0xffffffffffffff9c, &(0x7f0000000240)='/proc/thread-self/attr/current\x00', 0x2, 0x0) write$cgroup_subtree(r1, &(0x7f0000000100)=ANY=[], 0xff4a) write$cgroup_subtree(r2, &(0x7f0000000000)=ANY=[], 0x20032600) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a0f, 0x1700) accept$inet(0xffffffffffffffff, &(0x7f0000000040)={0x2, 0x0, @local}, &(0x7f0000000080)=0x10) ioctl$TCSETAF(r0, 0x5408, &(0x7f0000000040)={0x2}) ioctl$EXT4_IOC_GROUP_ADD(r0, 0x40286608, &(0x7f0000000000)={0x3, 0x7000000, 0x400, 0x100000000, 0x0, 0x8}) r3 = fcntl$dupfd(r0, 0x406, r0) ioctl$EVIOCGVERSION(r3, 0x80044501, &(0x7f0000000200)=""/31) write$binfmt_misc(r0, &(0x7f0000000080)={'syz1', "80fa25cdc862d216160cfa92845a3916e38a409a159c03f1889971d3e5144a8d08de78c4b1fbee457437261d7668b1c0f582647ad4134a05358d4309a71a702002329e024cac95642e761bb842bc1056bd6bf12c47697a649a026bd8ee1f685089941469b1ddfeddf32b392f0ff07652a3bce0770bc3bb70862845a65054cecb191e80b825d740fe6b40450359757032425dfdee92aec36ce4b468d50adc745c522cc4af2ac6e7f6a95f0edd70b09caa95fcc7143cf46b74db8bc17fa7c89f"}, 0xc3) 14:03:53 executing program 3: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSPTLCK(r0, 0x40045431, &(0x7f0000000180)) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) socket(0x0, 0x4000000000080002, 0x0) bind$packet(0xffffffffffffffff, 0x0, 0x0) sendmmsg(0xffffffffffffffff, &(0x7f0000007880)=[{{&(0x7f00000001c0)=@l2={0x1f, 0xbf53, {0x9, 0x7, 0xfffffffffffffdd5, 0x1ff, 0x2, 0x4}, 0x0, 0x7}, 0x80, 0x0}}, {{0x0, 0x0, &(0x7f0000007780)}}], 0x2, 0x4048851) setsockopt$packet_int(0xffffffffffffffff, 0x107, 0x0, 0x0, 0x0) syz_open_procfs(0x0, 0x0) ioctl$LOOP_SET_BLOCK_SIZE(0xffffffffffffffff, 0x4c09, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$cgroup_int(0xffffffffffffffff, 0x0, 0x2, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='\x89\x00\x00\x00\x00Ew\x00\x00\x00\xef\xb4\xc8\xd0\xff\xda\xb1vents\xd9\xc5H\xd4\x91\xfdN_]\x16\xe4\xa9C\xd2\x86Qn\xefS\x80\x11J\xfb4\x14\x86 4\x95\x9e\xfc\xc1\a\xcb \x95N\xe9\xa4j\xd2\x1f^\xb0\xb2>\xa3\xc9\xb7$\x11`t\x03: \x8b\xa4\x05\xf2?E\xdb+{t\xb8\xf7\xab\x8b\x100#', 0x26e1, 0x0) ioctl$PERF_EVENT_IOC_PAUSE_OUTPUT(r1, 0x40086602, 0x400007) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000280)='./cgroup/syz0\x00', 0x1ff) openat$smack_thread_current(0xffffffffffffff9c, &(0x7f0000000240)='/proc/thread-self/attr/current\x00', 0x2, 0x0) write$cgroup_subtree(r1, &(0x7f0000000100)=ANY=[], 0xff4a) write$cgroup_subtree(r2, &(0x7f0000000000)=ANY=[], 0x20032600) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a0f, 0x1700) accept$inet(0xffffffffffffffff, &(0x7f0000000040)={0x2, 0x0, @local}, &(0x7f0000000080)=0x10) ioctl$TCSETAF(r0, 0x5408, &(0x7f0000000040)={0x2}) ioctl$EXT4_IOC_GROUP_ADD(r0, 0x40286608, &(0x7f0000000000)={0x3, 0x7000000, 0x400, 0x100000000, 0x0, 0x8}) r3 = fcntl$dupfd(r0, 0x406, r0) ioctl$EVIOCGVERSION(r3, 0x80044501, &(0x7f0000000200)=""/31) write$binfmt_misc(r0, &(0x7f0000000080)={'syz1', "80fa25cdc862d216160cfa92845a3916e38a409a159c03f1889971d3e5144a8d08de78c4b1fbee457437261d7668b1c0f582647ad4134a05358d4309a71a702002329e024cac95642e761bb842bc1056bd6bf12c47697a649a026bd8ee1f685089941469b1ddfeddf32b392f0ff07652a3bce0770bc3bb70862845a65054cecb191e80b825d740fe6b40450359757032425dfdee92aec36ce4b468d50adc745c522cc4af2ac6e7f6a95f0edd70b09caa95fcc7143cf46b74db8bc17fa7c89f"}, 0xc3) 14:03:53 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) r2 = fcntl$dupfd(r1, 0x0, r1) write$P9_RRENAME(r2, &(0x7f0000000080)={0x7, 0x15, 0x2}, 0x7) getsockname$netlink(r1, &(0x7f0000000000), &(0x7f0000000040)=0xc) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=ANY=[@ANYBLOB="0e630c408c0d0000"], 0x0, 0x0, 0x0}) 14:03:53 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f319bd070") r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETAF(r1, 0x5408, &(0x7f0000000040)) restart_syscall() r2 = getpid() ioctl$KDGETLED(r1, 0x4b31, &(0x7f0000000080)) r3 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r3, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") r4 = perf_event_open(&(0x7f0000940000)={0x2, 0x70, 0xfffffffffffffffe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x3, 0x88011, r4, 0x0) futex(&(0x7f0000001ac0), 0x3, 0x0, 0x0, &(0x7f0000001c40), 0x0) r5 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/vga_arbiter\x00', 0x10000, 0x0) setsockopt$inet6_MCAST_MSFILTER(r5, 0x29, 0x30, &(0x7f0000000100)={0x3f, {{0xa, 0x4e22, 0xffff, @initdev={0xfe, 0x88, [], 0x0, 0x0}, 0x5a73105b}}, 0x2d261109a375eaad, 0x8, [{{0xa, 0x4e22, 0x4, @initdev={0xfe, 0x88, [], 0x1, 0x0}, 0x3}}, {{0xa, 0x4e21, 0x1, @local, 0x2}}, {{0xa, 0x4e20, 0x4, @initdev={0xfe, 0x88, [], 0x0, 0x0}, 0x97e}}, {{0xa, 0x4e23, 0x100000001, @ipv4={[], [], @initdev={0xac, 0x1e, 0x1, 0x0}}, 0xac}}, {{0xa, 0x4e21, 0x1ff, @dev={0xfe, 0x80, [], 0x17}, 0x1}}, {{0xa, 0x4e23, 0x1c000000000000, @empty, 0x20}}, {{0xa, 0x4e20, 0x1ff, @initdev={0xfe, 0x88, [], 0x1, 0x0}, 0x3}}, {{0xa, 0x4e23, 0xda, @empty, 0x6}}]}, 0x490) setpriority(0x1, r2, 0xffff) 14:03:53 executing program 1: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSPTLCK(r0, 0x40045431, &(0x7f0000000180)) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) socket(0x200000000000011, 0x4000000000080002, 0x0) bind$packet(0xffffffffffffffff, 0x0, 0x0) sendmmsg(0xffffffffffffffff, &(0x7f0000007880)=[{{&(0x7f00000001c0)=@l2={0x1f, 0xbf53, {0x9, 0x7, 0xfffffffffffffdd5, 0x1ff, 0x2, 0x4}, 0x0, 0x7}, 0x80, 0x0}}, {{0x0, 0x0, &(0x7f0000007780)}}], 0x2, 0x4048851) syz_open_procfs(0x0, 0x0) ioctl$LOOP_SET_BLOCK_SIZE(0xffffffffffffffff, 0x4c09, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$cgroup_int(0xffffffffffffffff, 0x0, 0x2, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='\x89\x00\x00\x00\x00Ew\x00\x00\x00\xef\xb4\xc8\xd0\xff\xda\xb1vents\xd9\xc5H\xd4\x91\xfdN_]\x16\xe4\xa9C\xd2\x86Qn\xefS\x80\x11J\xfb4\x14\x86 4\x95\x9e\xfc\xc1\a\xcb \x95N\xe9\xa4j\xd2\x1f^\xb0\xb2>\xa3\xc9\xb7$\x11`t\x03: \x8b\xa4\x05\xf2?E\xdb+{t\xb8\xf7\xab\x8b\x100#', 0x26e1, 0x0) ioctl$PERF_EVENT_IOC_PAUSE_OUTPUT(r1, 0x40086602, 0x400007) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000280)='./cgroup/syz0\x00', 0x1ff) openat$smack_thread_current(0xffffffffffffff9c, &(0x7f0000000240)='/proc/thread-self/attr/current\x00', 0x2, 0x0) write$cgroup_subtree(r1, &(0x7f0000000100)=ANY=[], 0xff4a) ioctl$TCSETAF(r0, 0x5408, &(0x7f0000000040)={0x2}) ioctl$EXT4_IOC_GROUP_ADD(r0, 0x40286608, &(0x7f0000000000)={0x3, 0x7000000, 0x400, 0x100000000, 0x0, 0x8}) ioctl$EVIOCGVERSION(0xffffffffffffffff, 0x80044501, &(0x7f0000000200)=""/31) 14:03:53 executing program 0: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSPTLCK(r0, 0x40045431, &(0x7f0000000180)) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) socket(0x200000000000011, 0x4000000000080002, 0x0) bind$packet(0xffffffffffffffff, 0x0, 0x0) sendmmsg(0xffffffffffffffff, &(0x7f0000007880)=[{{&(0x7f00000001c0)=@l2={0x1f, 0xbf53, {0x9, 0x7, 0xfffffffffffffdd5, 0x1ff, 0x2, 0x4}, 0x0, 0x7}, 0x80, 0x0}}, {{0x0, 0x0, &(0x7f0000007780)}}], 0x2, 0x4048851) setsockopt$packet_int(0xffffffffffffffff, 0x107, 0x0, 0x0, 0x0) syz_open_procfs(0x0, 0x0) ioctl$LOOP_SET_BLOCK_SIZE(0xffffffffffffffff, 0x4c09, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$cgroup_int(0xffffffffffffffff, 0x0, 0x2, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='\x89\x00\x00\x00\x00Ew\x00\x00\x00\xef\xb4\xc8\xd0\xff\xda\xb1vents\xd9\xc5H\xd4\x91\xfdN_]\x16\xe4\xa9C\xd2\x86Qn\xefS\x80\x11J\xfb4\x14\x86 4\x95\x9e\xfc\xc1\a\xcb \x95N\xe9\xa4j\xd2\x1f^\xb0\xb2>\xa3\xc9\xb7$\x11`t\x03: \x8b\xa4\x05\xf2?E\xdb+{t\xb8\xf7\xab\x8b\x100#', 0x26e1, 0x0) ioctl$PERF_EVENT_IOC_PAUSE_OUTPUT(r1, 0x40086602, 0x400007) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000280)='./cgroup/syz0\x00', 0x1ff) openat$smack_thread_current(0xffffffffffffff9c, &(0x7f0000000240)='/proc/thread-self/attr/current\x00', 0x2, 0x0) write$cgroup_subtree(r2, &(0x7f0000000000)=ANY=[], 0x20032600) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a0f, 0x1700) accept$inet(0xffffffffffffffff, &(0x7f0000000040)={0x2, 0x0, @local}, &(0x7f0000000080)=0x10) ioctl$TCSETAF(r0, 0x5408, &(0x7f0000000040)={0x2}) ioctl$EXT4_IOC_GROUP_ADD(r0, 0x40286608, &(0x7f0000000000)={0x3, 0x7000000, 0x400, 0x100000000, 0x0, 0x8}) r3 = fcntl$dupfd(r0, 0x406, r0) ioctl$EVIOCGVERSION(r3, 0x80044501, &(0x7f0000000200)=""/31) write$binfmt_misc(r0, &(0x7f0000000080)={'syz1', "80fa25cdc862d216160cfa92845a3916e38a409a159c03f1889971d3e5144a8d08de78c4b1fbee457437261d7668b1c0f582647ad4134a05358d4309a71a702002329e024cac95642e761bb842bc1056bd6bf12c47697a649a026bd8ee1f685089941469b1ddfeddf32b392f0ff07652a3bce0770bc3bb70862845a65054cecb191e80b825d740fe6b40450359757032425dfdee92aec36ce4b468d50adc745c522cc4af2ac6e7f6a95f0edd70b09caa95fcc7143cf46b74db8bc17fa7c89f"}, 0xc3) [ 339.494496] binder: 10741:10743 BC_REQUEST_DEATH_NOTIFICATION invalid ref 3468 14:03:53 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) r2 = fcntl$dupfd(r1, 0x0, r1) write$P9_RRENAME(r2, &(0x7f0000000080)={0x7, 0x15, 0x2}, 0x7) getsockname$netlink(r1, &(0x7f0000000000), &(0x7f0000000040)=0xc) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=ANY=[@ANYBLOB="0e630c408c0d0000"], 0x0, 0x0, 0x0}) [ 339.548985] binder: 10752:10753 BC_REQUEST_DEATH_NOTIFICATION invalid ref 3468 14:03:53 executing program 3: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSPTLCK(r0, 0x40045431, &(0x7f0000000180)) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) socket(0x200000000000011, 0x4000000000080002, 0x0) bind$packet(0xffffffffffffffff, 0x0, 0x0) sendmmsg(0xffffffffffffffff, &(0x7f0000007880)=[{{&(0x7f00000001c0)=@l2={0x1f, 0xbf53, {0x9, 0x7, 0xfffffffffffffdd5, 0x1ff, 0x2, 0x4}, 0x0, 0x7}, 0x80, 0x0}}, {{0x0, 0x0, &(0x7f0000007780)}}], 0x2, 0x4048851) setsockopt$packet_int(0xffffffffffffffff, 0x107, 0x0, 0x0, 0x0) syz_open_procfs(0x0, 0x0) ioctl$LOOP_SET_BLOCK_SIZE(0xffffffffffffffff, 0x4c09, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$cgroup_int(0xffffffffffffffff, 0x0, 0x2, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='\x89\x00\x00\x00\x00Ew\x00\x00\x00\xef\xb4\xc8\xd0\xff\xda\xb1vents\xd9\xc5H\xd4\x91\xfdN_]\x16\xe4\xa9C\xd2\x86Qn\xefS\x80\x11J\xfb4\x14\x86 4\x95\x9e\xfc\xc1\a\xcb \x95N\xe9\xa4j\xd2\x1f^\xb0\xb2>\xa3\xc9\xb7$\x11`t\x03: \x8b\xa4\x05\xf2?E\xdb+{t\xb8\xf7\xab\x8b\x100#', 0x26e1, 0x0) ioctl$PERF_EVENT_IOC_PAUSE_OUTPUT(r1, 0x40086602, 0x400007) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000280)='./cgroup/syz0\x00', 0x1ff) openat$smack_thread_current(0xffffffffffffff9c, &(0x7f0000000240)='/proc/thread-self/attr/current\x00', 0x2, 0x0) write$cgroup_subtree(r1, &(0x7f0000000100)=ANY=[], 0xff4a) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a0f, 0x1700) accept$inet(0xffffffffffffffff, &(0x7f0000000040)={0x2, 0x0, @local}, &(0x7f0000000080)=0x10) ioctl$TCSETAF(r0, 0x5408, &(0x7f0000000040)={0x2}) ioctl$EXT4_IOC_GROUP_ADD(r0, 0x40286608, &(0x7f0000000000)={0x3, 0x7000000, 0x400, 0x100000000, 0x0, 0x8}) r2 = fcntl$dupfd(r0, 0x406, r0) ioctl$EVIOCGVERSION(r2, 0x80044501, &(0x7f0000000200)=""/31) write$binfmt_misc(r0, &(0x7f0000000080)={'syz1', "80fa25cdc862d216160cfa92845a3916e38a409a159c03f1889971d3e5144a8d08de78c4b1fbee457437261d7668b1c0f582647ad4134a05358d4309a71a702002329e024cac95642e761bb842bc1056bd6bf12c47697a649a026bd8ee1f685089941469b1ddfeddf32b392f0ff07652a3bce0770bc3bb70862845a65054cecb191e80b825d740fe6b40450359757032425dfdee92aec36ce4b468d50adc745c522cc4af2ac6e7f6a95f0edd70b09caa95fcc7143cf46b74db8bc17fa7c89f"}, 0xc3) 14:03:53 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSPTLCK(r0, 0x40045431, &(0x7f0000000180)) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) socket(0x200000000000011, 0x0, 0x0) bind$packet(0xffffffffffffffff, 0x0, 0x0) sendmmsg(0xffffffffffffffff, &(0x7f0000007880)=[{{&(0x7f00000001c0)=@l2={0x1f, 0xbf53, {0x9, 0x7, 0xfffffffffffffdd5, 0x1ff, 0x2, 0x4}, 0x0, 0x7}, 0x80, 0x0}}, {{0x0, 0x0, &(0x7f0000007780)}}], 0x2, 0x4048851) setsockopt$packet_int(0xffffffffffffffff, 0x107, 0x0, 0x0, 0x0) syz_open_procfs(0x0, 0x0) ioctl$LOOP_SET_BLOCK_SIZE(0xffffffffffffffff, 0x4c09, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$cgroup_int(0xffffffffffffffff, 0x0, 0x2, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='\x89\x00\x00\x00\x00Ew\x00\x00\x00\xef\xb4\xc8\xd0\xff\xda\xb1vents\xd9\xc5H\xd4\x91\xfdN_]\x16\xe4\xa9C\xd2\x86Qn\xefS\x80\x11J\xfb4\x14\x86 4\x95\x9e\xfc\xc1\a\xcb \x95N\xe9\xa4j\xd2\x1f^\xb0\xb2>\xa3\xc9\xb7$\x11`t\x03: \x8b\xa4\x05\xf2?E\xdb+{t\xb8\xf7\xab\x8b\x100#', 0x26e1, 0x0) ioctl$PERF_EVENT_IOC_PAUSE_OUTPUT(r1, 0x40086602, 0x400007) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000280)='./cgroup/syz0\x00', 0x1ff) openat$smack_thread_current(0xffffffffffffff9c, &(0x7f0000000240)='/proc/thread-self/attr/current\x00', 0x2, 0x0) write$cgroup_subtree(r1, &(0x7f0000000100)=ANY=[], 0xff4a) write$cgroup_subtree(r2, &(0x7f0000000000)=ANY=[], 0x20032600) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a0f, 0x1700) accept$inet(0xffffffffffffffff, &(0x7f0000000040)={0x2, 0x0, @local}, &(0x7f0000000080)=0x10) ioctl$TCSETAF(r0, 0x5408, &(0x7f0000000040)={0x2}) ioctl$EXT4_IOC_GROUP_ADD(r0, 0x40286608, &(0x7f0000000000)={0x3, 0x7000000, 0x400, 0x100000000, 0x0, 0x8}) r3 = fcntl$dupfd(r0, 0x406, r0) ioctl$EVIOCGVERSION(r3, 0x80044501, &(0x7f0000000200)=""/31) write$binfmt_misc(r0, &(0x7f0000000080)={'syz1', "80fa25cdc862d216160cfa92845a3916e38a409a159c03f1889971d3e5144a8d08de78c4b1fbee457437261d7668b1c0f582647ad4134a05358d4309a71a702002329e024cac95642e761bb842bc1056bd6bf12c47697a649a026bd8ee1f685089941469b1ddfeddf32b392f0ff07652a3bce0770bc3bb70862845a65054cecb191e80b825d740fe6b40450359757032425dfdee92aec36ce4b468d50adc745c522cc4af2ac6e7f6a95f0edd70b09caa95fcc7143cf46b74db8bc17fa7c89f"}, 0xc3) 14:03:53 executing program 0: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSPTLCK(r0, 0x40045431, &(0x7f0000000180)) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) socket(0x200000000000011, 0x0, 0x0) bind$packet(0xffffffffffffffff, 0x0, 0x0) sendmmsg(0xffffffffffffffff, &(0x7f0000007880)=[{{&(0x7f00000001c0)=@l2={0x1f, 0xbf53, {0x9, 0x7, 0xfffffffffffffdd5, 0x1ff, 0x2, 0x4}, 0x0, 0x7}, 0x80, 0x0}}, {{0x0, 0x0, &(0x7f0000007780)}}], 0x2, 0x4048851) setsockopt$packet_int(0xffffffffffffffff, 0x107, 0x0, 0x0, 0x0) syz_open_procfs(0x0, 0x0) ioctl$LOOP_SET_BLOCK_SIZE(0xffffffffffffffff, 0x4c09, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$cgroup_int(0xffffffffffffffff, 0x0, 0x2, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='\x89\x00\x00\x00\x00Ew\x00\x00\x00\xef\xb4\xc8\xd0\xff\xda\xb1vents\xd9\xc5H\xd4\x91\xfdN_]\x16\xe4\xa9C\xd2\x86Qn\xefS\x80\x11J\xfb4\x14\x86 4\x95\x9e\xfc\xc1\a\xcb \x95N\xe9\xa4j\xd2\x1f^\xb0\xb2>\xa3\xc9\xb7$\x11`t\x03: \x8b\xa4\x05\xf2?E\xdb+{t\xb8\xf7\xab\x8b\x100#', 0x26e1, 0x0) ioctl$PERF_EVENT_IOC_PAUSE_OUTPUT(r1, 0x40086602, 0x400007) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000280)='./cgroup/syz0\x00', 0x1ff) openat$smack_thread_current(0xffffffffffffff9c, &(0x7f0000000240)='/proc/thread-self/attr/current\x00', 0x2, 0x0) write$cgroup_subtree(r1, &(0x7f0000000100)=ANY=[], 0xff4a) write$cgroup_subtree(r2, &(0x7f0000000000)=ANY=[], 0x20032600) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a0f, 0x1700) accept$inet(0xffffffffffffffff, &(0x7f0000000040)={0x2, 0x0, @local}, &(0x7f0000000080)=0x10) ioctl$TCSETAF(r0, 0x5408, &(0x7f0000000040)={0x2}) ioctl$EXT4_IOC_GROUP_ADD(r0, 0x40286608, &(0x7f0000000000)={0x3, 0x7000000, 0x400, 0x100000000, 0x0, 0x8}) r3 = fcntl$dupfd(r0, 0x406, r0) ioctl$EVIOCGVERSION(r3, 0x80044501, &(0x7f0000000200)=""/31) write$binfmt_misc(r0, &(0x7f0000000080)={'syz1', "80fa25cdc862d216160cfa92845a3916e38a409a159c03f1889971d3e5144a8d08de78c4b1fbee457437261d7668b1c0f582647ad4134a05358d4309a71a702002329e024cac95642e761bb842bc1056bd6bf12c47697a649a026bd8ee1f685089941469b1ddfeddf32b392f0ff07652a3bce0770bc3bb70862845a65054cecb191e80b825d740fe6b40450359757032425dfdee92aec36ce4b468d50adc745c522cc4af2ac6e7f6a95f0edd70b09caa95fcc7143cf46b74db8bc17fa7c89f"}, 0xc3) 14:03:53 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) r2 = fcntl$dupfd(r1, 0x0, r1) write$P9_RRENAME(r2, &(0x7f0000000080)={0x7, 0x15, 0x2}, 0x7) getsockname$netlink(r1, &(0x7f0000000000), &(0x7f0000000040)=0xc) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=ANY=[@ANYBLOB="0e630c408c0d0000"], 0x0, 0x0, 0x0}) [ 339.641133] binder: 10765:10768 BC_REQUEST_DEATH_NOTIFICATION invalid ref 3468 14:03:53 executing program 1: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSPTLCK(r0, 0x40045431, &(0x7f0000000180)) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) socket(0x200000000000011, 0x4000000000080002, 0x0) bind$packet(0xffffffffffffffff, 0x0, 0x0) sendmmsg(0xffffffffffffffff, &(0x7f0000007880)=[{{&(0x7f00000001c0)=@l2={0x1f, 0xbf53, {0x9, 0x7, 0xfffffffffffffdd5, 0x1ff, 0x2, 0x4}, 0x0, 0x7}, 0x80, 0x0}}, {{0x0, 0x0, &(0x7f0000007780)}}], 0x2, 0x4048851) syz_open_procfs(0x0, 0x0) ioctl$LOOP_SET_BLOCK_SIZE(0xffffffffffffffff, 0x4c09, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$cgroup_int(0xffffffffffffffff, 0x0, 0x2, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='\x89\x00\x00\x00\x00Ew\x00\x00\x00\xef\xb4\xc8\xd0\xff\xda\xb1vents\xd9\xc5H\xd4\x91\xfdN_]\x16\xe4\xa9C\xd2\x86Qn\xefS\x80\x11J\xfb4\x14\x86 4\x95\x9e\xfc\xc1\a\xcb \x95N\xe9\xa4j\xd2\x1f^\xb0\xb2>\xa3\xc9\xb7$\x11`t\x03: \x8b\xa4\x05\xf2?E\xdb+{t\xb8\xf7\xab\x8b\x100#', 0x26e1, 0x0) ioctl$PERF_EVENT_IOC_PAUSE_OUTPUT(r1, 0x40086602, 0x400007) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000280)='./cgroup/syz0\x00', 0x1ff) openat$smack_thread_current(0xffffffffffffff9c, &(0x7f0000000240)='/proc/thread-self/attr/current\x00', 0x2, 0x0) write$cgroup_subtree(r1, &(0x7f0000000100)=ANY=[], 0xff4a) ioctl$TCSETAF(r0, 0x5408, &(0x7f0000000040)={0x2}) ioctl$EXT4_IOC_GROUP_ADD(r0, 0x40286608, &(0x7f0000000000)={0x3, 0x7000000, 0x400, 0x100000000, 0x0, 0x8}) ioctl$EVIOCGVERSION(0xffffffffffffffff, 0x80044501, &(0x7f0000000200)=""/31) 14:03:53 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) r2 = fcntl$dupfd(r1, 0x0, r1) write$P9_RRENAME(r2, &(0x7f0000000080)={0x7, 0x15, 0x2}, 0x7) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f00000001c0)=[@acquire], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=ANY=[@ANYBLOB="0e630c408c0d0000"], 0x0, 0x0, 0x0}) [ 339.701363] binder: 10774:10777 BC_REQUEST_DEATH_NOTIFICATION invalid ref 3468 14:03:53 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSPTLCK(r0, 0x40045431, &(0x7f0000000180)) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) socket(0x200000000000011, 0x0, 0x0) bind$packet(0xffffffffffffffff, 0x0, 0x0) sendmmsg(0xffffffffffffffff, &(0x7f0000007880)=[{{&(0x7f00000001c0)=@l2={0x1f, 0xbf53, {0x9, 0x7, 0xfffffffffffffdd5, 0x1ff, 0x2, 0x4}, 0x0, 0x7}, 0x80, 0x0}}, {{0x0, 0x0, &(0x7f0000007780)}}], 0x2, 0x4048851) setsockopt$packet_int(0xffffffffffffffff, 0x107, 0x0, 0x0, 0x0) syz_open_procfs(0x0, 0x0) ioctl$LOOP_SET_BLOCK_SIZE(0xffffffffffffffff, 0x4c09, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$cgroup_int(0xffffffffffffffff, 0x0, 0x2, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='\x89\x00\x00\x00\x00Ew\x00\x00\x00\xef\xb4\xc8\xd0\xff\xda\xb1vents\xd9\xc5H\xd4\x91\xfdN_]\x16\xe4\xa9C\xd2\x86Qn\xefS\x80\x11J\xfb4\x14\x86 4\x95\x9e\xfc\xc1\a\xcb \x95N\xe9\xa4j\xd2\x1f^\xb0\xb2>\xa3\xc9\xb7$\x11`t\x03: \x8b\xa4\x05\xf2?E\xdb+{t\xb8\xf7\xab\x8b\x100#', 0x26e1, 0x0) ioctl$PERF_EVENT_IOC_PAUSE_OUTPUT(r1, 0x40086602, 0x400007) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000280)='./cgroup/syz0\x00', 0x1ff) openat$smack_thread_current(0xffffffffffffff9c, &(0x7f0000000240)='/proc/thread-self/attr/current\x00', 0x2, 0x0) write$cgroup_subtree(r1, &(0x7f0000000100)=ANY=[], 0xff4a) write$cgroup_subtree(r2, &(0x7f0000000000)=ANY=[], 0x20032600) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a0f, 0x1700) accept$inet(0xffffffffffffffff, &(0x7f0000000040)={0x2, 0x0, @local}, &(0x7f0000000080)=0x10) ioctl$TCSETAF(r0, 0x5408, &(0x7f0000000040)={0x2}) ioctl$EXT4_IOC_GROUP_ADD(r0, 0x40286608, &(0x7f0000000000)={0x3, 0x7000000, 0x400, 0x100000000, 0x0, 0x8}) r3 = fcntl$dupfd(r0, 0x406, r0) ioctl$EVIOCGVERSION(r3, 0x80044501, &(0x7f0000000200)=""/31) write$binfmt_misc(r0, &(0x7f0000000080)={'syz1', "80fa25cdc862d216160cfa92845a3916e38a409a159c03f1889971d3e5144a8d08de78c4b1fbee457437261d7668b1c0f582647ad4134a05358d4309a71a702002329e024cac95642e761bb842bc1056bd6bf12c47697a649a026bd8ee1f685089941469b1ddfeddf32b392f0ff07652a3bce0770bc3bb70862845a65054cecb191e80b825d740fe6b40450359757032425dfdee92aec36ce4b468d50adc745c522cc4af2ac6e7f6a95f0edd70b09caa95fcc7143cf46b74db8bc17fa7c89f"}, 0xc3) 14:03:53 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) fcntl$dupfd(r1, 0x0, r1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f00000001c0)=[@acquire], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=ANY=[@ANYBLOB="0e630c408c0d0000"], 0x0, 0x0, 0x0}) [ 339.768385] binder: 10782:10784 BC_REQUEST_DEATH_NOTIFICATION invalid ref 3468 14:03:53 executing program 3: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSPTLCK(r0, 0x40045431, &(0x7f0000000180)) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) socket(0x200000000000011, 0x4000000000080002, 0x0) bind$packet(0xffffffffffffffff, 0x0, 0x0) sendmmsg(0xffffffffffffffff, &(0x7f0000007880)=[{{&(0x7f00000001c0)=@l2={0x1f, 0xbf53, {0x9, 0x7, 0xfffffffffffffdd5, 0x1ff, 0x2, 0x4}, 0x0, 0x7}, 0x80, 0x0}}, {{0x0, 0x0, &(0x7f0000007780)}}], 0x2, 0x4048851) setsockopt$packet_int(0xffffffffffffffff, 0x107, 0x0, 0x0, 0x0) syz_open_procfs(0x0, 0x0) ioctl$LOOP_SET_BLOCK_SIZE(0xffffffffffffffff, 0x4c09, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$cgroup_int(0xffffffffffffffff, 0x0, 0x2, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='\x89\x00\x00\x00\x00Ew\x00\x00\x00\xef\xb4\xc8\xd0\xff\xda\xb1vents\xd9\xc5H\xd4\x91\xfdN_]\x16\xe4\xa9C\xd2\x86Qn\xefS\x80\x11J\xfb4\x14\x86 4\x95\x9e\xfc\xc1\a\xcb \x95N\xe9\xa4j\xd2\x1f^\xb0\xb2>\xa3\xc9\xb7$\x11`t\x03: \x8b\xa4\x05\xf2?E\xdb+{t\xb8\xf7\xab\x8b\x100#', 0x26e1, 0x0) ioctl$PERF_EVENT_IOC_PAUSE_OUTPUT(r1, 0x40086602, 0x400007) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000280)='./cgroup/syz0\x00', 0x1ff) openat$smack_thread_current(0xffffffffffffff9c, &(0x7f0000000240)='/proc/thread-self/attr/current\x00', 0x2, 0x0) write$cgroup_subtree(r1, &(0x7f0000000100)=ANY=[], 0xff4a) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a0f, 0x1700) accept$inet(0xffffffffffffffff, &(0x7f0000000040)={0x2, 0x0, @local}, &(0x7f0000000080)=0x10) ioctl$TCSETAF(r0, 0x5408, &(0x7f0000000040)={0x2}) ioctl$EXT4_IOC_GROUP_ADD(r0, 0x40286608, &(0x7f0000000000)={0x3, 0x7000000, 0x400, 0x100000000, 0x0, 0x8}) r2 = fcntl$dupfd(r0, 0x406, r0) ioctl$EVIOCGVERSION(r2, 0x80044501, &(0x7f0000000200)=""/31) write$binfmt_misc(r0, &(0x7f0000000080)={'syz1', "80fa25cdc862d216160cfa92845a3916e38a409a159c03f1889971d3e5144a8d08de78c4b1fbee457437261d7668b1c0f582647ad4134a05358d4309a71a702002329e024cac95642e761bb842bc1056bd6bf12c47697a649a026bd8ee1f685089941469b1ddfeddf32b392f0ff07652a3bce0770bc3bb70862845a65054cecb191e80b825d740fe6b40450359757032425dfdee92aec36ce4b468d50adc745c522cc4af2ac6e7f6a95f0edd70b09caa95fcc7143cf46b74db8bc17fa7c89f"}, 0xc3) 14:03:53 executing program 0: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSPTLCK(r0, 0x40045431, &(0x7f0000000180)) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) socket(0x200000000000011, 0x4000000000080002, 0x0) bind$packet(0xffffffffffffffff, 0x0, 0x0) sendmmsg(0xffffffffffffffff, &(0x7f0000007880)=[{{&(0x7f00000001c0)=@l2={0x1f, 0xbf53, {0x9, 0x7, 0xfffffffffffffdd5, 0x1ff, 0x2, 0x4}, 0x0, 0x7}, 0x80, 0x0}}, {{0x0, 0x0, &(0x7f0000007780)}}], 0x2, 0x4048851) syz_open_procfs(0x0, 0x0) ioctl$LOOP_SET_BLOCK_SIZE(0xffffffffffffffff, 0x4c09, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$cgroup_int(0xffffffffffffffff, 0x0, 0x2, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='\x89\x00\x00\x00\x00Ew\x00\x00\x00\xef\xb4\xc8\xd0\xff\xda\xb1vents\xd9\xc5H\xd4\x91\xfdN_]\x16\xe4\xa9C\xd2\x86Qn\xefS\x80\x11J\xfb4\x14\x86 4\x95\x9e\xfc\xc1\a\xcb \x95N\xe9\xa4j\xd2\x1f^\xb0\xb2>\xa3\xc9\xb7$\x11`t\x03: \x8b\xa4\x05\xf2?E\xdb+{t\xb8\xf7\xab\x8b\x100#', 0x26e1, 0x0) ioctl$PERF_EVENT_IOC_PAUSE_OUTPUT(r1, 0x40086602, 0x400007) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000280)='./cgroup/syz0\x00', 0x1ff) openat$smack_thread_current(0xffffffffffffff9c, &(0x7f0000000240)='/proc/thread-self/attr/current\x00', 0x2, 0x0) write$cgroup_subtree(r1, &(0x7f0000000100)=ANY=[], 0xff4a) ioctl$TCSETAF(r0, 0x5408, &(0x7f0000000040)={0x2}) ioctl$EXT4_IOC_GROUP_ADD(r0, 0x40286608, &(0x7f0000000000)={0x3, 0x7000000, 0x400, 0x100000000, 0x0, 0x8}) ioctl$EVIOCGVERSION(0xffffffffffffffff, 0x80044501, &(0x7f0000000200)=""/31) 14:03:53 executing program 1: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSPTLCK(r0, 0x40045431, &(0x7f0000000180)) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) socket(0x200000000000011, 0x4000000000080002, 0x0) bind$packet(0xffffffffffffffff, 0x0, 0x0) sendmmsg(0xffffffffffffffff, &(0x7f0000007880)=[{{&(0x7f00000001c0)=@l2={0x1f, 0xbf53, {0x9, 0x7, 0xfffffffffffffdd5, 0x1ff, 0x2, 0x4}, 0x0, 0x7}, 0x80, 0x0}}, {{0x0, 0x0, &(0x7f0000007780)}}], 0x2, 0x4048851) syz_open_procfs(0x0, 0x0) ioctl$LOOP_SET_BLOCK_SIZE(0xffffffffffffffff, 0x4c09, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$cgroup_int(0xffffffffffffffff, 0x0, 0x2, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='\x89\x00\x00\x00\x00Ew\x00\x00\x00\xef\xb4\xc8\xd0\xff\xda\xb1vents\xd9\xc5H\xd4\x91\xfdN_]\x16\xe4\xa9C\xd2\x86Qn\xefS\x80\x11J\xfb4\x14\x86 4\x95\x9e\xfc\xc1\a\xcb \x95N\xe9\xa4j\xd2\x1f^\xb0\xb2>\xa3\xc9\xb7$\x11`t\x03: \x8b\xa4\x05\xf2?E\xdb+{t\xb8\xf7\xab\x8b\x100#', 0x26e1, 0x0) ioctl$PERF_EVENT_IOC_PAUSE_OUTPUT(r1, 0x40086602, 0x400007) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000280)='./cgroup/syz0\x00', 0x1ff) openat$smack_thread_current(0xffffffffffffff9c, &(0x7f0000000240)='/proc/thread-self/attr/current\x00', 0x2, 0x0) write$cgroup_subtree(r1, &(0x7f0000000100)=ANY=[], 0xff4a) ioctl$TCSETAF(r0, 0x5408, &(0x7f0000000040)={0x2}) ioctl$EXT4_IOC_GROUP_ADD(r0, 0x40286608, &(0x7f0000000000)={0x3, 0x7000000, 0x400, 0x100000000, 0x0, 0x8}) ioctl$EVIOCGVERSION(0xffffffffffffffff, 0x80044501, &(0x7f0000000200)=""/31) 14:03:53 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSPTLCK(r0, 0x40045431, &(0x7f0000000180)) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) socket(0x200000000000011, 0x4000000000080002, 0x0) bind$packet(0xffffffffffffffff, 0x0, 0x0) sendmmsg(0xffffffffffffffff, 0x0, 0x0, 0x4048851) setsockopt$packet_int(0xffffffffffffffff, 0x107, 0x0, 0x0, 0x0) syz_open_procfs(0x0, 0x0) ioctl$LOOP_SET_BLOCK_SIZE(0xffffffffffffffff, 0x4c09, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$cgroup_int(0xffffffffffffffff, 0x0, 0x2, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='\x89\x00\x00\x00\x00Ew\x00\x00\x00\xef\xb4\xc8\xd0\xff\xda\xb1vents\xd9\xc5H\xd4\x91\xfdN_]\x16\xe4\xa9C\xd2\x86Qn\xefS\x80\x11J\xfb4\x14\x86 4\x95\x9e\xfc\xc1\a\xcb \x95N\xe9\xa4j\xd2\x1f^\xb0\xb2>\xa3\xc9\xb7$\x11`t\x03: \x8b\xa4\x05\xf2?E\xdb+{t\xb8\xf7\xab\x8b\x100#', 0x26e1, 0x0) ioctl$PERF_EVENT_IOC_PAUSE_OUTPUT(r1, 0x40086602, 0x400007) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000280)='./cgroup/syz0\x00', 0x1ff) openat$smack_thread_current(0xffffffffffffff9c, &(0x7f0000000240)='/proc/thread-self/attr/current\x00', 0x2, 0x0) write$cgroup_subtree(r1, &(0x7f0000000100)=ANY=[], 0xff4a) write$cgroup_subtree(r2, &(0x7f0000000000)=ANY=[], 0x20032600) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a0f, 0x1700) accept$inet(0xffffffffffffffff, &(0x7f0000000040)={0x2, 0x0, @local}, &(0x7f0000000080)=0x10) ioctl$TCSETAF(r0, 0x5408, &(0x7f0000000040)={0x2}) ioctl$EXT4_IOC_GROUP_ADD(r0, 0x40286608, &(0x7f0000000000)={0x3, 0x7000000, 0x400, 0x100000000, 0x0, 0x8}) r3 = fcntl$dupfd(r0, 0x406, r0) ioctl$EVIOCGVERSION(r3, 0x80044501, &(0x7f0000000200)=""/31) write$binfmt_misc(r0, &(0x7f0000000080)={'syz1', "80fa25cdc862d216160cfa92845a3916e38a409a159c03f1889971d3e5144a8d08de78c4b1fbee457437261d7668b1c0f582647ad4134a05358d4309a71a702002329e024cac95642e761bb842bc1056bd6bf12c47697a649a026bd8ee1f685089941469b1ddfeddf32b392f0ff07652a3bce0770bc3bb70862845a65054cecb191e80b825d740fe6b40450359757032425dfdee92aec36ce4b468d50adc745c522cc4af2ac6e7f6a95f0edd70b09caa95fcc7143cf46b74db8bc17fa7c89f"}, 0xc3) 14:03:53 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f319bd070") r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETAF(r1, 0x5408, &(0x7f0000000040)) restart_syscall() r2 = getpid() ioctl$KDGETLED(r1, 0x4b31, &(0x7f0000000080)) r3 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r3, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") r4 = perf_event_open(&(0x7f0000940000)={0x2, 0x70, 0xfffffffffffffffe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x3, 0x88011, r4, 0x0) futex(&(0x7f0000001ac0), 0x3, 0x0, 0x0, &(0x7f0000001c40), 0x0) r5 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/vga_arbiter\x00', 0x10000, 0x0) setsockopt$inet6_MCAST_MSFILTER(r5, 0x29, 0x30, &(0x7f0000000100)={0x3f, {{0xa, 0x4e22, 0xffff, @initdev={0xfe, 0x88, [], 0x0, 0x0}, 0x5a73105b}}, 0x2d261109a375eaad, 0x8, [{{0xa, 0x4e22, 0x4, @initdev={0xfe, 0x88, [], 0x1, 0x0}, 0x3}}, {{0xa, 0x4e21, 0x1, @local, 0x2}}, {{0xa, 0x4e20, 0x4, @initdev={0xfe, 0x88, [], 0x0, 0x0}, 0x97e}}, {{0xa, 0x4e23, 0x100000001, @ipv4={[], [], @initdev={0xac, 0x1e, 0x1, 0x0}}, 0xac}}, {{0xa, 0x4e21, 0x1ff, @dev={0xfe, 0x80, [], 0x17}, 0x1}}, {{0xa, 0x4e23, 0x1c000000000000, @empty, 0x20}}, {{0xa, 0x4e20, 0x1ff, @initdev={0xfe, 0x88, [], 0x1, 0x0}, 0x3}}, {{0xa, 0x4e23, 0xda, @empty, 0x6}}]}, 0x490) setpriority(0x1, r2, 0xffff) [ 339.816755] binder: 10789:10791 BC_REQUEST_DEATH_NOTIFICATION invalid ref 3468 14:03:53 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f00000001c0)=[@acquire], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=ANY=[@ANYBLOB="0e630c408c0d0000"], 0x0, 0x0, 0x0}) 14:03:53 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f00000001c0)=[@acquire], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=ANY=[@ANYBLOB="0e630c408c0d0000"], 0x0, 0x0, 0x0}) 14:03:53 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f00000001c0)=[@acquire], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=ANY=[@ANYBLOB="0e630c408c0d0000"], 0x0, 0x0, 0x0}) [ 339.916484] binder: 10805:10809 BC_REQUEST_DEATH_NOTIFICATION invalid ref 3468 14:03:53 executing program 5: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSPTLCK(r0, 0x40045431, &(0x7f0000000180)) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) socket(0x200000000000011, 0x4000000000080002, 0x0) bind$packet(0xffffffffffffffff, 0x0, 0x0) sendmmsg(0xffffffffffffffff, &(0x7f0000007880)=[{{&(0x7f00000001c0)=@l2={0x1f, 0xbf53, {0x9, 0x7, 0xfffffffffffffdd5, 0x1ff, 0x2, 0x4}, 0x0, 0x7}, 0x80, 0x0}}, {{0x0, 0x0, &(0x7f0000007780)}}], 0x2, 0x4048851) setsockopt$packet_int(0xffffffffffffffff, 0x107, 0x0, 0x0, 0x0) syz_open_procfs(0x0, 0x0) ioctl$LOOP_SET_BLOCK_SIZE(0xffffffffffffffff, 0x4c09, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$cgroup_int(0xffffffffffffffff, 0x0, 0x2, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='\x89\x00\x00\x00\x00Ew\x00\x00\x00\xef\xb4\xc8\xd0\xff\xda\xb1vents\xd9\xc5H\xd4\x91\xfdN_]\x16\xe4\xa9C\xd2\x86Qn\xefS\x80\x11J\xfb4\x14\x86 4\x95\x9e\xfc\xc1\a\xcb \x95N\xe9\xa4j\xd2\x1f^\xb0\xb2>\xa3\xc9\xb7$\x11`t\x03: \x8b\xa4\x05\xf2?E\xdb+{t\xb8\xf7\xab\x8b\x100#', 0x26e1, 0x0) ioctl$PERF_EVENT_IOC_PAUSE_OUTPUT(r1, 0x40086602, 0x400007) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000280)='./cgroup/syz0\x00', 0x1ff) openat$smack_thread_current(0xffffffffffffff9c, &(0x7f0000000240)='/proc/thread-self/attr/current\x00', 0x2, 0x0) write$cgroup_subtree(r1, &(0x7f0000000100)=ANY=[], 0xff4a) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a0f, 0x1700) accept$inet(0xffffffffffffffff, &(0x7f0000000040)={0x2, 0x0, @local}, &(0x7f0000000080)=0x10) ioctl$TCSETAF(r0, 0x5408, &(0x7f0000000040)={0x2}) ioctl$EXT4_IOC_GROUP_ADD(r0, 0x40286608, &(0x7f0000000000)={0x3, 0x7000000, 0x400, 0x100000000, 0x0, 0x8}) r2 = fcntl$dupfd(r0, 0x406, r0) ioctl$EVIOCGVERSION(r2, 0x80044501, &(0x7f0000000200)=""/31) write$binfmt_misc(r0, &(0x7f0000000080)={'syz1', "80fa25cdc862d216160cfa92845a3916e38a409a159c03f1889971d3e5144a8d08de78c4b1fbee457437261d7668b1c0f582647ad4134a05358d4309a71a702002329e024cac95642e761bb842bc1056bd6bf12c47697a649a026bd8ee1f685089941469b1ddfeddf32b392f0ff07652a3bce0770bc3bb70862845a65054cecb191e80b825d740fe6b40450359757032425dfdee92aec36ce4b468d50adc745c522cc4af2ac6e7f6a95f0edd70b09caa95fcc7143cf46b74db8bc17fa7c89f"}, 0xc3) 14:03:53 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f00000001c0)=[@acquire], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=ANY=[@ANYBLOB="0e630c408c0d0000"], 0x0, 0x0, 0x0}) 14:03:53 executing program 3: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSPTLCK(r0, 0x40045431, &(0x7f0000000180)) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) socket(0x200000000000011, 0x4000000000080002, 0x0) bind$packet(0xffffffffffffffff, 0x0, 0x0) sendmmsg(0xffffffffffffffff, &(0x7f0000007880)=[{{&(0x7f00000001c0)=@l2={0x1f, 0xbf53, {0x9, 0x7, 0xfffffffffffffdd5, 0x1ff, 0x2, 0x4}, 0x0, 0x7}, 0x80, 0x0}}, {{0x0, 0x0, &(0x7f0000007780)}}], 0x2, 0x4048851) setsockopt$packet_int(0xffffffffffffffff, 0x107, 0x0, 0x0, 0x0) syz_open_procfs(0x0, 0x0) ioctl$LOOP_SET_BLOCK_SIZE(0xffffffffffffffff, 0x4c09, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$cgroup_int(0xffffffffffffffff, 0x0, 0x2, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='\x89\x00\x00\x00\x00Ew\x00\x00\x00\xef\xb4\xc8\xd0\xff\xda\xb1vents\xd9\xc5H\xd4\x91\xfdN_]\x16\xe4\xa9C\xd2\x86Qn\xefS\x80\x11J\xfb4\x14\x86 4\x95\x9e\xfc\xc1\a\xcb \x95N\xe9\xa4j\xd2\x1f^\xb0\xb2>\xa3\xc9\xb7$\x11`t\x03: \x8b\xa4\x05\xf2?E\xdb+{t\xb8\xf7\xab\x8b\x100#', 0x26e1, 0x0) ioctl$PERF_EVENT_IOC_PAUSE_OUTPUT(r1, 0x40086602, 0x400007) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000280)='./cgroup/syz0\x00', 0x1ff) openat$smack_thread_current(0xffffffffffffff9c, &(0x7f0000000240)='/proc/thread-self/attr/current\x00', 0x2, 0x0) write$cgroup_subtree(r1, &(0x7f0000000100)=ANY=[], 0xff4a) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a0f, 0x1700) accept$inet(0xffffffffffffffff, &(0x7f0000000040)={0x2, 0x0, @local}, &(0x7f0000000080)=0x10) ioctl$TCSETAF(r0, 0x5408, &(0x7f0000000040)={0x2}) ioctl$EXT4_IOC_GROUP_ADD(r0, 0x40286608, &(0x7f0000000000)={0x3, 0x7000000, 0x400, 0x100000000, 0x0, 0x8}) r2 = fcntl$dupfd(r0, 0x406, r0) ioctl$EVIOCGVERSION(r2, 0x80044501, &(0x7f0000000200)=""/31) write$binfmt_misc(r0, &(0x7f0000000080)={'syz1', "80fa25cdc862d216160cfa92845a3916e38a409a159c03f1889971d3e5144a8d08de78c4b1fbee457437261d7668b1c0f582647ad4134a05358d4309a71a702002329e024cac95642e761bb842bc1056bd6bf12c47697a649a026bd8ee1f685089941469b1ddfeddf32b392f0ff07652a3bce0770bc3bb70862845a65054cecb191e80b825d740fe6b40450359757032425dfdee92aec36ce4b468d50adc745c522cc4af2ac6e7f6a95f0edd70b09caa95fcc7143cf46b74db8bc17fa7c89f"}, 0xc3) 14:03:53 executing program 4: syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f00000001c0)=[@acquire], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=ANY=[@ANYBLOB="0e630c408c0d0000"], 0x0, 0x0, 0x0}) 14:03:53 executing program 1: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSPTLCK(r0, 0x40045431, &(0x7f0000000180)) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) socket(0x200000000000011, 0x4000000000080002, 0x0) bind$packet(0xffffffffffffffff, 0x0, 0x0) sendmmsg(0xffffffffffffffff, &(0x7f0000007880)=[{{&(0x7f00000001c0)=@l2={0x1f, 0xbf53, {0x9, 0x7, 0xfffffffffffffdd5, 0x1ff, 0x2, 0x4}, 0x0, 0x7}, 0x80, 0x0}}, {{0x0, 0x0, &(0x7f0000007780)}}], 0x2, 0x4048851) syz_open_procfs(0x0, 0x0) ioctl$LOOP_SET_BLOCK_SIZE(0xffffffffffffffff, 0x4c09, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$cgroup_int(0xffffffffffffffff, 0x0, 0x2, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='\x89\x00\x00\x00\x00Ew\x00\x00\x00\xef\xb4\xc8\xd0\xff\xda\xb1vents\xd9\xc5H\xd4\x91\xfdN_]\x16\xe4\xa9C\xd2\x86Qn\xefS\x80\x11J\xfb4\x14\x86 4\x95\x9e\xfc\xc1\a\xcb \x95N\xe9\xa4j\xd2\x1f^\xb0\xb2>\xa3\xc9\xb7$\x11`t\x03: \x8b\xa4\x05\xf2?E\xdb+{t\xb8\xf7\xab\x8b\x100#', 0x26e1, 0x0) ioctl$PERF_EVENT_IOC_PAUSE_OUTPUT(r1, 0x40086602, 0x400007) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000280)='./cgroup/syz0\x00', 0x1ff) openat$smack_thread_current(0xffffffffffffff9c, &(0x7f0000000240)='/proc/thread-self/attr/current\x00', 0x2, 0x0) write$cgroup_subtree(r2, &(0x7f0000000000)=ANY=[], 0x20032600) ioctl$TCSETAF(r0, 0x5408, &(0x7f0000000040)={0x2}) ioctl$EXT4_IOC_GROUP_ADD(r0, 0x40286608, &(0x7f0000000000)={0x3, 0x7000000, 0x400, 0x100000000, 0x0, 0x8}) ioctl$EVIOCGVERSION(0xffffffffffffffff, 0x80044501, &(0x7f0000000200)=""/31) 14:03:53 executing program 0: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSPTLCK(r0, 0x40045431, &(0x7f0000000180)) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) socket(0x200000000000011, 0x4000000000080002, 0x0) bind$packet(0xffffffffffffffff, 0x0, 0x0) sendmmsg(0xffffffffffffffff, &(0x7f0000007880)=[{{&(0x7f00000001c0)=@l2={0x1f, 0xbf53, {0x9, 0x7, 0xfffffffffffffdd5, 0x1ff, 0x2, 0x4}, 0x0, 0x7}, 0x80, 0x0}}, {{0x0, 0x0, &(0x7f0000007780)}}], 0x2, 0x4048851) syz_open_procfs(0x0, 0x0) ioctl$LOOP_SET_BLOCK_SIZE(0xffffffffffffffff, 0x4c09, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$cgroup_int(0xffffffffffffffff, 0x0, 0x2, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='\x89\x00\x00\x00\x00Ew\x00\x00\x00\xef\xb4\xc8\xd0\xff\xda\xb1vents\xd9\xc5H\xd4\x91\xfdN_]\x16\xe4\xa9C\xd2\x86Qn\xefS\x80\x11J\xfb4\x14\x86 4\x95\x9e\xfc\xc1\a\xcb \x95N\xe9\xa4j\xd2\x1f^\xb0\xb2>\xa3\xc9\xb7$\x11`t\x03: \x8b\xa4\x05\xf2?E\xdb+{t\xb8\xf7\xab\x8b\x100#', 0x26e1, 0x0) ioctl$PERF_EVENT_IOC_PAUSE_OUTPUT(r1, 0x40086602, 0x400007) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000280)='./cgroup/syz0\x00', 0x1ff) openat$smack_thread_current(0xffffffffffffff9c, &(0x7f0000000240)='/proc/thread-self/attr/current\x00', 0x2, 0x0) write$cgroup_subtree(r1, &(0x7f0000000100)=ANY=[], 0xff4a) ioctl$TCSETAF(r0, 0x5408, &(0x7f0000000040)={0x2}) ioctl$EXT4_IOC_GROUP_ADD(r0, 0x40286608, &(0x7f0000000000)={0x3, 0x7000000, 0x400, 0x100000000, 0x0, 0x8}) ioctl$EVIOCGVERSION(0xffffffffffffffff, 0x80044501, &(0x7f0000000200)=""/31) 14:03:53 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSPTLCK(r0, 0x40045431, &(0x7f0000000180)) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) socket(0x200000000000011, 0x4000000000080002, 0x0) bind$packet(0xffffffffffffffff, 0x0, 0x0) sendmmsg(0xffffffffffffffff, 0x0, 0x0, 0x4048851) setsockopt$packet_int(0xffffffffffffffff, 0x107, 0x0, 0x0, 0x0) syz_open_procfs(0x0, 0x0) ioctl$LOOP_SET_BLOCK_SIZE(0xffffffffffffffff, 0x4c09, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$cgroup_int(0xffffffffffffffff, 0x0, 0x2, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='\x89\x00\x00\x00\x00Ew\x00\x00\x00\xef\xb4\xc8\xd0\xff\xda\xb1vents\xd9\xc5H\xd4\x91\xfdN_]\x16\xe4\xa9C\xd2\x86Qn\xefS\x80\x11J\xfb4\x14\x86 4\x95\x9e\xfc\xc1\a\xcb \x95N\xe9\xa4j\xd2\x1f^\xb0\xb2>\xa3\xc9\xb7$\x11`t\x03: \x8b\xa4\x05\xf2?E\xdb+{t\xb8\xf7\xab\x8b\x100#', 0x26e1, 0x0) ioctl$PERF_EVENT_IOC_PAUSE_OUTPUT(r1, 0x40086602, 0x400007) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000280)='./cgroup/syz0\x00', 0x1ff) openat$smack_thread_current(0xffffffffffffff9c, &(0x7f0000000240)='/proc/thread-self/attr/current\x00', 0x2, 0x0) write$cgroup_subtree(r1, &(0x7f0000000100)=ANY=[], 0xff4a) write$cgroup_subtree(r2, &(0x7f0000000000)=ANY=[], 0x20032600) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a0f, 0x1700) accept$inet(0xffffffffffffffff, &(0x7f0000000040)={0x2, 0x0, @local}, &(0x7f0000000080)=0x10) ioctl$TCSETAF(r0, 0x5408, &(0x7f0000000040)={0x2}) ioctl$EXT4_IOC_GROUP_ADD(r0, 0x40286608, &(0x7f0000000000)={0x3, 0x7000000, 0x400, 0x100000000, 0x0, 0x8}) r3 = fcntl$dupfd(r0, 0x406, r0) ioctl$EVIOCGVERSION(r3, 0x80044501, &(0x7f0000000200)=""/31) write$binfmt_misc(r0, &(0x7f0000000080)={'syz1', "80fa25cdc862d216160cfa92845a3916e38a409a159c03f1889971d3e5144a8d08de78c4b1fbee457437261d7668b1c0f582647ad4134a05358d4309a71a702002329e024cac95642e761bb842bc1056bd6bf12c47697a649a026bd8ee1f685089941469b1ddfeddf32b392f0ff07652a3bce0770bc3bb70862845a65054cecb191e80b825d740fe6b40450359757032425dfdee92aec36ce4b468d50adc745c522cc4af2ac6e7f6a95f0edd70b09caa95fcc7143cf46b74db8bc17fa7c89f"}, 0xc3) 14:03:53 executing program 4: syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f00000001c0)=[@acquire], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=ANY=[@ANYBLOB="0e630c408c0d0000"], 0x0, 0x0, 0x0}) 14:03:53 executing program 5: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSPTLCK(r0, 0x40045431, &(0x7f0000000180)) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) socket(0x200000000000011, 0x4000000000080002, 0x0) bind$packet(0xffffffffffffffff, 0x0, 0x0) sendmmsg(0xffffffffffffffff, 0x0, 0x0, 0x4048851) setsockopt$packet_int(0xffffffffffffffff, 0x107, 0x0, 0x0, 0x0) syz_open_procfs(0x0, 0x0) ioctl$LOOP_SET_BLOCK_SIZE(0xffffffffffffffff, 0x4c09, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$cgroup_int(0xffffffffffffffff, 0x0, 0x2, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='\x89\x00\x00\x00\x00Ew\x00\x00\x00\xef\xb4\xc8\xd0\xff\xda\xb1vents\xd9\xc5H\xd4\x91\xfdN_]\x16\xe4\xa9C\xd2\x86Qn\xefS\x80\x11J\xfb4\x14\x86 4\x95\x9e\xfc\xc1\a\xcb \x95N\xe9\xa4j\xd2\x1f^\xb0\xb2>\xa3\xc9\xb7$\x11`t\x03: \x8b\xa4\x05\xf2?E\xdb+{t\xb8\xf7\xab\x8b\x100#', 0x26e1, 0x0) ioctl$PERF_EVENT_IOC_PAUSE_OUTPUT(r1, 0x40086602, 0x400007) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000280)='./cgroup/syz0\x00', 0x1ff) openat$smack_thread_current(0xffffffffffffff9c, &(0x7f0000000240)='/proc/thread-self/attr/current\x00', 0x2, 0x0) write$cgroup_subtree(r1, &(0x7f0000000100)=ANY=[], 0xff4a) write$cgroup_subtree(r2, &(0x7f0000000000)=ANY=[], 0x20032600) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a0f, 0x1700) accept$inet(0xffffffffffffffff, &(0x7f0000000040)={0x2, 0x0, @local}, &(0x7f0000000080)=0x10) ioctl$TCSETAF(r0, 0x5408, &(0x7f0000000040)={0x2}) ioctl$EXT4_IOC_GROUP_ADD(r0, 0x40286608, &(0x7f0000000000)={0x3, 0x7000000, 0x400, 0x100000000, 0x0, 0x8}) r3 = fcntl$dupfd(r0, 0x406, r0) ioctl$EVIOCGVERSION(r3, 0x80044501, &(0x7f0000000200)=""/31) write$binfmt_misc(r0, &(0x7f0000000080)={'syz1', "80fa25cdc862d216160cfa92845a3916e38a409a159c03f1889971d3e5144a8d08de78c4b1fbee457437261d7668b1c0f582647ad4134a05358d4309a71a702002329e024cac95642e761bb842bc1056bd6bf12c47697a649a026bd8ee1f685089941469b1ddfeddf32b392f0ff07652a3bce0770bc3bb70862845a65054cecb191e80b825d740fe6b40450359757032425dfdee92aec36ce4b468d50adc745c522cc4af2ac6e7f6a95f0edd70b09caa95fcc7143cf46b74db8bc17fa7c89f"}, 0xc3) [ 340.070900] binder: 10824:10826 Acquire 1 refcount change on invalid ref 0 ret -22 [ 340.104940] binder: 10824:10826 BC_REQUEST_DEATH_NOTIFICATION invalid ref 3468 14:03:53 executing program 3: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSPTLCK(r0, 0x40045431, &(0x7f0000000180)) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) socket(0x200000000000011, 0x4000000000080002, 0x0) bind$packet(0xffffffffffffffff, 0x0, 0x0) sendmmsg(0xffffffffffffffff, &(0x7f0000007880)=[{{&(0x7f00000001c0)=@l2={0x1f, 0xbf53, {0x9, 0x7, 0xfffffffffffffdd5, 0x1ff, 0x2, 0x4}, 0x0, 0x7}, 0x80, 0x0}}, {{0x0, 0x0, &(0x7f0000007780)}}], 0x2, 0x4048851) setsockopt$packet_int(0xffffffffffffffff, 0x107, 0x0, 0x0, 0x0) syz_open_procfs(0x0, 0x0) ioctl$LOOP_SET_BLOCK_SIZE(0xffffffffffffffff, 0x4c09, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$cgroup_int(0xffffffffffffffff, 0x0, 0x2, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='\x89\x00\x00\x00\x00Ew\x00\x00\x00\xef\xb4\xc8\xd0\xff\xda\xb1vents\xd9\xc5H\xd4\x91\xfdN_]\x16\xe4\xa9C\xd2\x86Qn\xefS\x80\x11J\xfb4\x14\x86 4\x95\x9e\xfc\xc1\a\xcb \x95N\xe9\xa4j\xd2\x1f^\xb0\xb2>\xa3\xc9\xb7$\x11`t\x03: \x8b\xa4\x05\xf2?E\xdb+{t\xb8\xf7\xab\x8b\x100#', 0x26e1, 0x0) ioctl$PERF_EVENT_IOC_PAUSE_OUTPUT(r1, 0x40086602, 0x400007) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000280)='./cgroup/syz0\x00', 0x1ff) openat$smack_thread_current(0xffffffffffffff9c, &(0x7f0000000240)='/proc/thread-self/attr/current\x00', 0x2, 0x0) write$cgroup_subtree(r1, &(0x7f0000000100)=ANY=[], 0xff4a) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a0f, 0x1700) accept$inet(0xffffffffffffffff, &(0x7f0000000040)={0x2, 0x0, @local}, &(0x7f0000000080)=0x10) ioctl$TCSETAF(r0, 0x5408, &(0x7f0000000040)={0x2}) ioctl$EXT4_IOC_GROUP_ADD(r0, 0x40286608, &(0x7f0000000000)={0x3, 0x7000000, 0x400, 0x100000000, 0x0, 0x8}) r2 = fcntl$dupfd(r0, 0x406, r0) ioctl$EVIOCGVERSION(r2, 0x80044501, &(0x7f0000000200)=""/31) write$binfmt_misc(r0, &(0x7f0000000080)={'syz1', "80fa25cdc862d216160cfa92845a3916e38a409a159c03f1889971d3e5144a8d08de78c4b1fbee457437261d7668b1c0f582647ad4134a05358d4309a71a702002329e024cac95642e761bb842bc1056bd6bf12c47697a649a026bd8ee1f685089941469b1ddfeddf32b392f0ff07652a3bce0770bc3bb70862845a65054cecb191e80b825d740fe6b40450359757032425dfdee92aec36ce4b468d50adc745c522cc4af2ac6e7f6a95f0edd70b09caa95fcc7143cf46b74db8bc17fa7c89f"}, 0xc3) 14:03:53 executing program 1: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSPTLCK(r0, 0x40045431, &(0x7f0000000180)) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) socket(0x200000000000011, 0x4000000000080002, 0x0) bind$packet(0xffffffffffffffff, 0x0, 0x0) sendmmsg(0xffffffffffffffff, &(0x7f0000007880)=[{{&(0x7f00000001c0)=@l2={0x1f, 0xbf53, {0x9, 0x7, 0xfffffffffffffdd5, 0x1ff, 0x2, 0x4}, 0x0, 0x7}, 0x80, 0x0}}, {{0x0, 0x0, &(0x7f0000007780)}}], 0x2, 0x4048851) syz_open_procfs(0x0, 0x0) ioctl$LOOP_SET_BLOCK_SIZE(0xffffffffffffffff, 0x4c09, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$cgroup_int(0xffffffffffffffff, 0x0, 0x2, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='\x89\x00\x00\x00\x00Ew\x00\x00\x00\xef\xb4\xc8\xd0\xff\xda\xb1vents\xd9\xc5H\xd4\x91\xfdN_]\x16\xe4\xa9C\xd2\x86Qn\xefS\x80\x11J\xfb4\x14\x86 4\x95\x9e\xfc\xc1\a\xcb \x95N\xe9\xa4j\xd2\x1f^\xb0\xb2>\xa3\xc9\xb7$\x11`t\x03: \x8b\xa4\x05\xf2?E\xdb+{t\xb8\xf7\xab\x8b\x100#', 0x26e1, 0x0) ioctl$PERF_EVENT_IOC_PAUSE_OUTPUT(r1, 0x40086602, 0x400007) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) openat$smack_thread_current(0xffffffffffffff9c, &(0x7f0000000240)='/proc/thread-self/attr/current\x00', 0x2, 0x0) write$cgroup_subtree(r2, &(0x7f0000000000)=ANY=[], 0x20032600) ioctl$TCSETAF(r0, 0x5408, &(0x7f0000000040)={0x2}) ioctl$EXT4_IOC_GROUP_ADD(r0, 0x40286608, &(0x7f0000000000)={0x3, 0x7000000, 0x400, 0x100000000, 0x0, 0x8}) ioctl$EVIOCGVERSION(0xffffffffffffffff, 0x80044501, &(0x7f0000000200)=""/31) 14:03:53 executing program 4: syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f00000001c0)=[@acquire], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=ANY=[@ANYBLOB="0e630c408c0d0000"], 0x0, 0x0, 0x0}) 14:03:53 executing program 0: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSPTLCK(r0, 0x40045431, &(0x7f0000000180)) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) socket(0x200000000000011, 0x4000000000080002, 0x0) bind$packet(0xffffffffffffffff, 0x0, 0x0) sendmmsg(0xffffffffffffffff, &(0x7f0000007880)=[{{&(0x7f00000001c0)=@l2={0x1f, 0xbf53, {0x9, 0x7, 0xfffffffffffffdd5, 0x1ff, 0x2, 0x4}, 0x0, 0x7}, 0x80, 0x0}}, {{0x0, 0x0, &(0x7f0000007780)}}], 0x2, 0x4048851) syz_open_procfs(0x0, 0x0) ioctl$LOOP_SET_BLOCK_SIZE(0xffffffffffffffff, 0x4c09, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$cgroup_int(0xffffffffffffffff, 0x0, 0x2, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='\x89\x00\x00\x00\x00Ew\x00\x00\x00\xef\xb4\xc8\xd0\xff\xda\xb1vents\xd9\xc5H\xd4\x91\xfdN_]\x16\xe4\xa9C\xd2\x86Qn\xefS\x80\x11J\xfb4\x14\x86 4\x95\x9e\xfc\xc1\a\xcb \x95N\xe9\xa4j\xd2\x1f^\xb0\xb2>\xa3\xc9\xb7$\x11`t\x03: \x8b\xa4\x05\xf2?E\xdb+{t\xb8\xf7\xab\x8b\x100#', 0x26e1, 0x0) ioctl$PERF_EVENT_IOC_PAUSE_OUTPUT(r1, 0x40086602, 0x400007) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000280)='./cgroup/syz0\x00', 0x1ff) openat$smack_thread_current(0xffffffffffffff9c, &(0x7f0000000240)='/proc/thread-self/attr/current\x00', 0x2, 0x0) write$cgroup_subtree(r1, &(0x7f0000000100)=ANY=[], 0xff4a) ioctl$TCSETAF(r0, 0x5408, &(0x7f0000000040)={0x2}) ioctl$EXT4_IOC_GROUP_ADD(r0, 0x40286608, &(0x7f0000000000)={0x3, 0x7000000, 0x400, 0x100000000, 0x0, 0x8}) ioctl$EVIOCGVERSION(0xffffffffffffffff, 0x80044501, &(0x7f0000000200)=""/31) [ 340.171871] binder: 10840:10842 Acquire 1 refcount change on invalid ref 0 ret -22 [ 340.183925] binder: 10840:10842 BC_REQUEST_DEATH_NOTIFICATION invalid ref 3468 14:03:53 executing program 4: ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f00000001c0)=[@acquire], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=ANY=[@ANYBLOB="0e630c408c0d0000"], 0x0, 0x0, 0x0}) 14:03:53 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSPTLCK(r0, 0x40045431, &(0x7f0000000180)) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) socket(0x200000000000011, 0x4000000000080002, 0x0) bind$packet(0xffffffffffffffff, 0x0, 0x0) sendmmsg(0xffffffffffffffff, 0x0, 0x0, 0x4048851) setsockopt$packet_int(0xffffffffffffffff, 0x107, 0x0, 0x0, 0x0) syz_open_procfs(0x0, 0x0) ioctl$LOOP_SET_BLOCK_SIZE(0xffffffffffffffff, 0x4c09, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$cgroup_int(0xffffffffffffffff, 0x0, 0x2, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='\x89\x00\x00\x00\x00Ew\x00\x00\x00\xef\xb4\xc8\xd0\xff\xda\xb1vents\xd9\xc5H\xd4\x91\xfdN_]\x16\xe4\xa9C\xd2\x86Qn\xefS\x80\x11J\xfb4\x14\x86 4\x95\x9e\xfc\xc1\a\xcb \x95N\xe9\xa4j\xd2\x1f^\xb0\xb2>\xa3\xc9\xb7$\x11`t\x03: \x8b\xa4\x05\xf2?E\xdb+{t\xb8\xf7\xab\x8b\x100#', 0x26e1, 0x0) ioctl$PERF_EVENT_IOC_PAUSE_OUTPUT(r1, 0x40086602, 0x400007) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000280)='./cgroup/syz0\x00', 0x1ff) openat$smack_thread_current(0xffffffffffffff9c, &(0x7f0000000240)='/proc/thread-self/attr/current\x00', 0x2, 0x0) write$cgroup_subtree(r1, &(0x7f0000000100)=ANY=[], 0xff4a) write$cgroup_subtree(r2, &(0x7f0000000000)=ANY=[], 0x20032600) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a0f, 0x1700) accept$inet(0xffffffffffffffff, &(0x7f0000000040)={0x2, 0x0, @local}, &(0x7f0000000080)=0x10) ioctl$TCSETAF(r0, 0x5408, &(0x7f0000000040)={0x2}) ioctl$EXT4_IOC_GROUP_ADD(r0, 0x40286608, &(0x7f0000000000)={0x3, 0x7000000, 0x400, 0x100000000, 0x0, 0x8}) r3 = fcntl$dupfd(r0, 0x406, r0) ioctl$EVIOCGVERSION(r3, 0x80044501, &(0x7f0000000200)=""/31) write$binfmt_misc(r0, &(0x7f0000000080)={'syz1', "80fa25cdc862d216160cfa92845a3916e38a409a159c03f1889971d3e5144a8d08de78c4b1fbee457437261d7668b1c0f582647ad4134a05358d4309a71a702002329e024cac95642e761bb842bc1056bd6bf12c47697a649a026bd8ee1f685089941469b1ddfeddf32b392f0ff07652a3bce0770bc3bb70862845a65054cecb191e80b825d740fe6b40450359757032425dfdee92aec36ce4b468d50adc745c522cc4af2ac6e7f6a95f0edd70b09caa95fcc7143cf46b74db8bc17fa7c89f"}, 0xc3) 14:03:53 executing program 5: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSPTLCK(r0, 0x40045431, &(0x7f0000000180)) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) socket(0x200000000000011, 0x4000000000080002, 0x0) bind$packet(0xffffffffffffffff, 0x0, 0x0) sendmmsg(0xffffffffffffffff, 0x0, 0x0, 0x4048851) setsockopt$packet_int(0xffffffffffffffff, 0x107, 0x0, 0x0, 0x0) syz_open_procfs(0x0, 0x0) ioctl$LOOP_SET_BLOCK_SIZE(0xffffffffffffffff, 0x4c09, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$cgroup_int(0xffffffffffffffff, 0x0, 0x2, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='\x89\x00\x00\x00\x00Ew\x00\x00\x00\xef\xb4\xc8\xd0\xff\xda\xb1vents\xd9\xc5H\xd4\x91\xfdN_]\x16\xe4\xa9C\xd2\x86Qn\xefS\x80\x11J\xfb4\x14\x86 4\x95\x9e\xfc\xc1\a\xcb \x95N\xe9\xa4j\xd2\x1f^\xb0\xb2>\xa3\xc9\xb7$\x11`t\x03: \x8b\xa4\x05\xf2?E\xdb+{t\xb8\xf7\xab\x8b\x100#', 0x26e1, 0x0) ioctl$PERF_EVENT_IOC_PAUSE_OUTPUT(r1, 0x40086602, 0x400007) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000280)='./cgroup/syz0\x00', 0x1ff) openat$smack_thread_current(0xffffffffffffff9c, &(0x7f0000000240)='/proc/thread-self/attr/current\x00', 0x2, 0x0) write$cgroup_subtree(r1, &(0x7f0000000100)=ANY=[], 0xff4a) write$cgroup_subtree(r2, &(0x7f0000000000)=ANY=[], 0x20032600) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a0f, 0x1700) accept$inet(0xffffffffffffffff, &(0x7f0000000040)={0x2, 0x0, @local}, &(0x7f0000000080)=0x10) ioctl$TCSETAF(r0, 0x5408, &(0x7f0000000040)={0x2}) ioctl$EXT4_IOC_GROUP_ADD(r0, 0x40286608, &(0x7f0000000000)={0x3, 0x7000000, 0x400, 0x100000000, 0x0, 0x8}) r3 = fcntl$dupfd(r0, 0x406, r0) ioctl$EVIOCGVERSION(r3, 0x80044501, &(0x7f0000000200)=""/31) write$binfmt_misc(r0, &(0x7f0000000080)={'syz1', "80fa25cdc862d216160cfa92845a3916e38a409a159c03f1889971d3e5144a8d08de78c4b1fbee457437261d7668b1c0f582647ad4134a05358d4309a71a702002329e024cac95642e761bb842bc1056bd6bf12c47697a649a026bd8ee1f685089941469b1ddfeddf32b392f0ff07652a3bce0770bc3bb70862845a65054cecb191e80b825d740fe6b40450359757032425dfdee92aec36ce4b468d50adc745c522cc4af2ac6e7f6a95f0edd70b09caa95fcc7143cf46b74db8bc17fa7c89f"}, 0xc3) 14:03:53 executing program 1: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSPTLCK(r0, 0x40045431, &(0x7f0000000180)) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) socket(0x200000000000011, 0x4000000000080002, 0x0) bind$packet(0xffffffffffffffff, 0x0, 0x0) sendmmsg(0xffffffffffffffff, &(0x7f0000007880)=[{{&(0x7f00000001c0)=@l2={0x1f, 0xbf53, {0x9, 0x7, 0xfffffffffffffdd5, 0x1ff, 0x2, 0x4}, 0x0, 0x7}, 0x80, 0x0}}, {{0x0, 0x0, &(0x7f0000007780)}}], 0x2, 0x4048851) syz_open_procfs(0x0, 0x0) ioctl$LOOP_SET_BLOCK_SIZE(0xffffffffffffffff, 0x4c09, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$cgroup_int(0xffffffffffffffff, 0x0, 0x2, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='\x89\x00\x00\x00\x00Ew\x00\x00\x00\xef\xb4\xc8\xd0\xff\xda\xb1vents\xd9\xc5H\xd4\x91\xfdN_]\x16\xe4\xa9C\xd2\x86Qn\xefS\x80\x11J\xfb4\x14\x86 4\x95\x9e\xfc\xc1\a\xcb \x95N\xe9\xa4j\xd2\x1f^\xb0\xb2>\xa3\xc9\xb7$\x11`t\x03: \x8b\xa4\x05\xf2?E\xdb+{t\xb8\xf7\xab\x8b\x100#', 0x26e1, 0x0) ioctl$PERF_EVENT_IOC_PAUSE_OUTPUT(r1, 0x40086602, 0x400007) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) openat$smack_thread_current(0xffffffffffffff9c, &(0x7f0000000240)='/proc/thread-self/attr/current\x00', 0x2, 0x0) write$cgroup_subtree(r2, &(0x7f0000000000)=ANY=[], 0x20032600) ioctl$TCSETAF(r0, 0x5408, &(0x7f0000000040)={0x2}) ioctl$EXT4_IOC_GROUP_ADD(r0, 0x40286608, &(0x7f0000000000)={0x3, 0x7000000, 0x400, 0x100000000, 0x0, 0x8}) ioctl$EVIOCGVERSION(0xffffffffffffffff, 0x80044501, &(0x7f0000000200)=""/31) [ 340.254412] binder: 10848:10853 Acquire 1 refcount change on invalid ref 0 ret -22 [ 340.278481] binder: 10848:10853 BC_REQUEST_DEATH_NOTIFICATION invalid ref 3468 14:03:53 executing program 4: ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f00000001c0)=[@acquire], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=ANY=[@ANYBLOB="0e630c408c0d0000"], 0x0, 0x0, 0x0}) 14:03:53 executing program 3: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSPTLCK(r0, 0x40045431, &(0x7f0000000180)) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) socket(0x200000000000011, 0x4000000000080002, 0x0) bind$packet(0xffffffffffffffff, 0x0, 0x0) sendmmsg(0xffffffffffffffff, &(0x7f0000007880)=[{{&(0x7f00000001c0)=@l2={0x1f, 0xbf53, {0x9, 0x7, 0xfffffffffffffdd5, 0x1ff, 0x2, 0x4}, 0x0, 0x7}, 0x80, 0x0}}, {{0x0, 0x0, &(0x7f0000007780)}}], 0x2, 0x4048851) syz_open_procfs(0x0, 0x0) ioctl$LOOP_SET_BLOCK_SIZE(0xffffffffffffffff, 0x4c09, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$cgroup_int(0xffffffffffffffff, 0x0, 0x2, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='\x89\x00\x00\x00\x00Ew\x00\x00\x00\xef\xb4\xc8\xd0\xff\xda\xb1vents\xd9\xc5H\xd4\x91\xfdN_]\x16\xe4\xa9C\xd2\x86Qn\xefS\x80\x11J\xfb4\x14\x86 4\x95\x9e\xfc\xc1\a\xcb \x95N\xe9\xa4j\xd2\x1f^\xb0\xb2>\xa3\xc9\xb7$\x11`t\x03: \x8b\xa4\x05\xf2?E\xdb+{t\xb8\xf7\xab\x8b\x100#', 0x26e1, 0x0) ioctl$PERF_EVENT_IOC_PAUSE_OUTPUT(r1, 0x40086602, 0x400007) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) openat$smack_thread_current(0xffffffffffffff9c, &(0x7f0000000240)='/proc/thread-self/attr/current\x00', 0x2, 0x0) write$cgroup_subtree(r2, &(0x7f0000000000)=ANY=[], 0x20032600) ioctl$TCSETAF(r0, 0x5408, &(0x7f0000000040)={0x2}) ioctl$EXT4_IOC_GROUP_ADD(r0, 0x40286608, &(0x7f0000000000)={0x3, 0x7000000, 0x400, 0x100000000, 0x0, 0x8}) ioctl$EVIOCGVERSION(0xffffffffffffffff, 0x80044501, &(0x7f0000000200)=""/31) 14:03:53 executing program 0: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSPTLCK(r0, 0x40045431, &(0x7f0000000180)) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) socket(0x200000000000011, 0x4000000000080002, 0x0) bind$packet(0xffffffffffffffff, 0x0, 0x0) sendmmsg(0xffffffffffffffff, 0x0, 0x0, 0x4048851) setsockopt$packet_int(0xffffffffffffffff, 0x107, 0x0, 0x0, 0x0) syz_open_procfs(0x0, 0x0) ioctl$LOOP_SET_BLOCK_SIZE(0xffffffffffffffff, 0x4c09, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$cgroup_int(0xffffffffffffffff, 0x0, 0x2, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='\x89\x00\x00\x00\x00Ew\x00\x00\x00\xef\xb4\xc8\xd0\xff\xda\xb1vents\xd9\xc5H\xd4\x91\xfdN_]\x16\xe4\xa9C\xd2\x86Qn\xefS\x80\x11J\xfb4\x14\x86 4\x95\x9e\xfc\xc1\a\xcb \x95N\xe9\xa4j\xd2\x1f^\xb0\xb2>\xa3\xc9\xb7$\x11`t\x03: \x8b\xa4\x05\xf2?E\xdb+{t\xb8\xf7\xab\x8b\x100#', 0x26e1, 0x0) ioctl$PERF_EVENT_IOC_PAUSE_OUTPUT(r1, 0x40086602, 0x400007) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000280)='./cgroup/syz0\x00', 0x1ff) openat$smack_thread_current(0xffffffffffffff9c, &(0x7f0000000240)='/proc/thread-self/attr/current\x00', 0x2, 0x0) write$cgroup_subtree(r1, &(0x7f0000000100)=ANY=[], 0xff4a) write$cgroup_subtree(r2, &(0x7f0000000000)=ANY=[], 0x20032600) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a0f, 0x1700) accept$inet(0xffffffffffffffff, &(0x7f0000000040)={0x2, 0x0, @local}, &(0x7f0000000080)=0x10) ioctl$TCSETAF(r0, 0x5408, &(0x7f0000000040)={0x2}) ioctl$EXT4_IOC_GROUP_ADD(r0, 0x40286608, &(0x7f0000000000)={0x3, 0x7000000, 0x400, 0x100000000, 0x0, 0x8}) r3 = fcntl$dupfd(r0, 0x406, r0) ioctl$EVIOCGVERSION(r3, 0x80044501, &(0x7f0000000200)=""/31) write$binfmt_misc(r0, &(0x7f0000000080)={'syz1', "80fa25cdc862d216160cfa92845a3916e38a409a159c03f1889971d3e5144a8d08de78c4b1fbee457437261d7668b1c0f582647ad4134a05358d4309a71a702002329e024cac95642e761bb842bc1056bd6bf12c47697a649a026bd8ee1f685089941469b1ddfeddf32b392f0ff07652a3bce0770bc3bb70862845a65054cecb191e80b825d740fe6b40450359757032425dfdee92aec36ce4b468d50adc745c522cc4af2ac6e7f6a95f0edd70b09caa95fcc7143cf46b74db8bc17fa7c89f"}, 0xc3) 14:03:53 executing program 4: ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f00000001c0)=[@acquire], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=ANY=[@ANYBLOB="0e630c408c0d0000"], 0x0, 0x0, 0x0}) 14:03:54 executing program 1: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSPTLCK(r0, 0x40045431, &(0x7f0000000180)) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) socket(0x200000000000011, 0x4000000000080002, 0x0) bind$packet(0xffffffffffffffff, 0x0, 0x0) sendmmsg(0xffffffffffffffff, &(0x7f0000007880)=[{{&(0x7f00000001c0)=@l2={0x1f, 0xbf53, {0x9, 0x7, 0xfffffffffffffdd5, 0x1ff, 0x2, 0x4}, 0x0, 0x7}, 0x80, 0x0}}, {{0x0, 0x0, &(0x7f0000007780)}}], 0x2, 0x4048851) syz_open_procfs(0x0, 0x0) ioctl$LOOP_SET_BLOCK_SIZE(0xffffffffffffffff, 0x4c09, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$cgroup_int(0xffffffffffffffff, 0x0, 0x2, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='\x89\x00\x00\x00\x00Ew\x00\x00\x00\xef\xb4\xc8\xd0\xff\xda\xb1vents\xd9\xc5H\xd4\x91\xfdN_]\x16\xe4\xa9C\xd2\x86Qn\xefS\x80\x11J\xfb4\x14\x86 4\x95\x9e\xfc\xc1\a\xcb \x95N\xe9\xa4j\xd2\x1f^\xb0\xb2>\xa3\xc9\xb7$\x11`t\x03: \x8b\xa4\x05\xf2?E\xdb+{t\xb8\xf7\xab\x8b\x100#', 0x26e1, 0x0) ioctl$PERF_EVENT_IOC_PAUSE_OUTPUT(r1, 0x40086602, 0x400007) openat$smack_thread_current(0xffffffffffffff9c, &(0x7f0000000240)='/proc/thread-self/attr/current\x00', 0x2, 0x0) write$cgroup_subtree(0xffffffffffffffff, &(0x7f0000000000)=ANY=[], 0x20032600) ioctl$TCSETAF(r0, 0x5408, &(0x7f0000000040)={0x2}) ioctl$EXT4_IOC_GROUP_ADD(r0, 0x40286608, &(0x7f0000000000)={0x3, 0x7000000, 0x400, 0x100000000, 0x0, 0x8}) ioctl$EVIOCGVERSION(0xffffffffffffffff, 0x80044501, &(0x7f0000000200)=""/31) 14:03:54 executing program 4: r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f00000001c0)=[@acquire], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=ANY=[@ANYBLOB="0e630c408c0d0000"], 0x0, 0x0, 0x0}) 14:03:54 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSPTLCK(r0, 0x40045431, &(0x7f0000000180)) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) socket(0x200000000000011, 0x4000000000080002, 0x0) bind$packet(0xffffffffffffffff, 0x0, 0x0) sendmmsg(0xffffffffffffffff, &(0x7f0000007880)=[{{&(0x7f00000001c0)=@l2={0x1f, 0xbf53, {0x9, 0x7, 0xfffffffffffffdd5, 0x1ff, 0x2, 0x4}, 0x0, 0x7}, 0x80, 0x0}}], 0x1, 0x4048851) setsockopt$packet_int(0xffffffffffffffff, 0x107, 0x0, 0x0, 0x0) syz_open_procfs(0x0, 0x0) ioctl$LOOP_SET_BLOCK_SIZE(0xffffffffffffffff, 0x4c09, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$cgroup_int(0xffffffffffffffff, 0x0, 0x2, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='\x89\x00\x00\x00\x00Ew\x00\x00\x00\xef\xb4\xc8\xd0\xff\xda\xb1vents\xd9\xc5H\xd4\x91\xfdN_]\x16\xe4\xa9C\xd2\x86Qn\xefS\x80\x11J\xfb4\x14\x86 4\x95\x9e\xfc\xc1\a\xcb \x95N\xe9\xa4j\xd2\x1f^\xb0\xb2>\xa3\xc9\xb7$\x11`t\x03: \x8b\xa4\x05\xf2?E\xdb+{t\xb8\xf7\xab\x8b\x100#', 0x26e1, 0x0) ioctl$PERF_EVENT_IOC_PAUSE_OUTPUT(r1, 0x40086602, 0x400007) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000280)='./cgroup/syz0\x00', 0x1ff) openat$smack_thread_current(0xffffffffffffff9c, &(0x7f0000000240)='/proc/thread-self/attr/current\x00', 0x2, 0x0) write$cgroup_subtree(r1, &(0x7f0000000100)=ANY=[], 0xff4a) write$cgroup_subtree(r2, &(0x7f0000000000)=ANY=[], 0x20032600) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a0f, 0x1700) accept$inet(0xffffffffffffffff, &(0x7f0000000040)={0x2, 0x0, @local}, &(0x7f0000000080)=0x10) ioctl$TCSETAF(r0, 0x5408, &(0x7f0000000040)={0x2}) ioctl$EXT4_IOC_GROUP_ADD(r0, 0x40286608, &(0x7f0000000000)={0x3, 0x7000000, 0x400, 0x100000000, 0x0, 0x8}) r3 = fcntl$dupfd(r0, 0x406, r0) ioctl$EVIOCGVERSION(r3, 0x80044501, &(0x7f0000000200)=""/31) write$binfmt_misc(r0, &(0x7f0000000080)={'syz1', "80fa25cdc862d216160cfa92845a3916e38a409a159c03f1889971d3e5144a8d08de78c4b1fbee457437261d7668b1c0f582647ad4134a05358d4309a71a702002329e024cac95642e761bb842bc1056bd6bf12c47697a649a026bd8ee1f685089941469b1ddfeddf32b392f0ff07652a3bce0770bc3bb70862845a65054cecb191e80b825d740fe6b40450359757032425dfdee92aec36ce4b468d50adc745c522cc4af2ac6e7f6a95f0edd70b09caa95fcc7143cf46b74db8bc17fa7c89f"}, 0xc3) 14:03:54 executing program 3: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSPTLCK(r0, 0x40045431, &(0x7f0000000180)) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) socket(0x200000000000011, 0x4000000000080002, 0x0) bind$packet(0xffffffffffffffff, 0x0, 0x0) sendmmsg(0xffffffffffffffff, 0x0, 0x0, 0x4048851) setsockopt$packet_int(0xffffffffffffffff, 0x107, 0x0, 0x0, 0x0) syz_open_procfs(0x0, 0x0) ioctl$LOOP_SET_BLOCK_SIZE(0xffffffffffffffff, 0x4c09, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$cgroup_int(0xffffffffffffffff, 0x0, 0x2, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='\x89\x00\x00\x00\x00Ew\x00\x00\x00\xef\xb4\xc8\xd0\xff\xda\xb1vents\xd9\xc5H\xd4\x91\xfdN_]\x16\xe4\xa9C\xd2\x86Qn\xefS\x80\x11J\xfb4\x14\x86 4\x95\x9e\xfc\xc1\a\xcb \x95N\xe9\xa4j\xd2\x1f^\xb0\xb2>\xa3\xc9\xb7$\x11`t\x03: \x8b\xa4\x05\xf2?E\xdb+{t\xb8\xf7\xab\x8b\x100#', 0x26e1, 0x0) ioctl$PERF_EVENT_IOC_PAUSE_OUTPUT(r1, 0x40086602, 0x400007) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000280)='./cgroup/syz0\x00', 0x1ff) openat$smack_thread_current(0xffffffffffffff9c, &(0x7f0000000240)='/proc/thread-self/attr/current\x00', 0x2, 0x0) write$cgroup_subtree(r1, &(0x7f0000000100)=ANY=[], 0xff4a) write$cgroup_subtree(r2, &(0x7f0000000000)=ANY=[], 0x20032600) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a0f, 0x1700) accept$inet(0xffffffffffffffff, &(0x7f0000000040)={0x2, 0x0, @local}, &(0x7f0000000080)=0x10) ioctl$TCSETAF(r0, 0x5408, &(0x7f0000000040)={0x2}) ioctl$EXT4_IOC_GROUP_ADD(r0, 0x40286608, &(0x7f0000000000)={0x3, 0x7000000, 0x400, 0x100000000, 0x0, 0x8}) r3 = fcntl$dupfd(r0, 0x406, r0) ioctl$EVIOCGVERSION(r3, 0x80044501, &(0x7f0000000200)=""/31) write$binfmt_misc(r0, &(0x7f0000000080)={'syz1', "80fa25cdc862d216160cfa92845a3916e38a409a159c03f1889971d3e5144a8d08de78c4b1fbee457437261d7668b1c0f582647ad4134a05358d4309a71a702002329e024cac95642e761bb842bc1056bd6bf12c47697a649a026bd8ee1f685089941469b1ddfeddf32b392f0ff07652a3bce0770bc3bb70862845a65054cecb191e80b825d740fe6b40450359757032425dfdee92aec36ce4b468d50adc745c522cc4af2ac6e7f6a95f0edd70b09caa95fcc7143cf46b74db8bc17fa7c89f"}, 0xc3) 14:03:54 executing program 4: r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f00000001c0)=[@acquire], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=ANY=[@ANYBLOB="0e630c408c0d0000"], 0x0, 0x0, 0x0}) 14:03:54 executing program 5: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSPTLCK(r0, 0x40045431, &(0x7f0000000180)) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) socket(0x200000000000011, 0x4000000000080002, 0x0) bind$packet(0xffffffffffffffff, 0x0, 0x0) sendmmsg(0xffffffffffffffff, &(0x7f0000007880)=[{{&(0x7f00000001c0)=@l2={0x1f, 0xbf53, {0x9, 0x7, 0xfffffffffffffdd5, 0x1ff, 0x2, 0x4}, 0x0, 0x7}, 0x80, 0x0}}, {{0x0, 0x0, &(0x7f0000007780)}}], 0x2, 0x4048851) syz_open_procfs(0x0, 0x0) ioctl$LOOP_SET_BLOCK_SIZE(0xffffffffffffffff, 0x4c09, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$cgroup_int(0xffffffffffffffff, 0x0, 0x2, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='\x89\x00\x00\x00\x00Ew\x00\x00\x00\xef\xb4\xc8\xd0\xff\xda\xb1vents\xd9\xc5H\xd4\x91\xfdN_]\x16\xe4\xa9C\xd2\x86Qn\xefS\x80\x11J\xfb4\x14\x86 4\x95\x9e\xfc\xc1\a\xcb \x95N\xe9\xa4j\xd2\x1f^\xb0\xb2>\xa3\xc9\xb7$\x11`t\x03: \x8b\xa4\x05\xf2?E\xdb+{t\xb8\xf7\xab\x8b\x100#', 0x26e1, 0x0) ioctl$PERF_EVENT_IOC_PAUSE_OUTPUT(r1, 0x40086602, 0x400007) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) openat$smack_thread_current(0xffffffffffffff9c, &(0x7f0000000240)='/proc/thread-self/attr/current\x00', 0x2, 0x0) write$cgroup_subtree(r2, &(0x7f0000000000)=ANY=[], 0x20032600) ioctl$TCSETAF(r0, 0x5408, &(0x7f0000000040)={0x2}) ioctl$EXT4_IOC_GROUP_ADD(r0, 0x40286608, &(0x7f0000000000)={0x3, 0x7000000, 0x400, 0x100000000, 0x0, 0x8}) ioctl$EVIOCGVERSION(0xffffffffffffffff, 0x80044501, &(0x7f0000000200)=""/31) 14:03:54 executing program 4: r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f00000001c0)=[@acquire], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=ANY=[@ANYBLOB="0e630c408c0d0000"], 0x0, 0x0, 0x0}) 14:03:54 executing program 4: syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f00000001c0)=[@acquire], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=ANY=[@ANYBLOB="0e630c408c0d0000"], 0x0, 0x0, 0x0}) 14:03:54 executing program 0: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSPTLCK(r0, 0x40045431, &(0x7f0000000180)) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) socket(0x200000000000011, 0x4000000000080002, 0x0) bind$packet(0xffffffffffffffff, 0x0, 0x0) sendmmsg(0xffffffffffffffff, &(0x7f0000007880)=[{{&(0x7f00000001c0)=@l2={0x1f, 0xbf53, {0x9, 0x7, 0xfffffffffffffdd5, 0x1ff, 0x2, 0x4}, 0x0, 0x7}, 0x80, 0x0}}, {{0x0, 0x0, &(0x7f0000007780)}}], 0x2, 0x4048851) syz_open_procfs(0x0, 0x0) ioctl$LOOP_SET_BLOCK_SIZE(0xffffffffffffffff, 0x4c09, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$cgroup_int(0xffffffffffffffff, 0x0, 0x2, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='\x89\x00\x00\x00\x00Ew\x00\x00\x00\xef\xb4\xc8\xd0\xff\xda\xb1vents\xd9\xc5H\xd4\x91\xfdN_]\x16\xe4\xa9C\xd2\x86Qn\xefS\x80\x11J\xfb4\x14\x86 4\x95\x9e\xfc\xc1\a\xcb \x95N\xe9\xa4j\xd2\x1f^\xb0\xb2>\xa3\xc9\xb7$\x11`t\x03: \x8b\xa4\x05\xf2?E\xdb+{t\xb8\xf7\xab\x8b\x100#', 0x26e1, 0x0) ioctl$PERF_EVENT_IOC_PAUSE_OUTPUT(r1, 0x40086602, 0x400007) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000280)='./cgroup/syz0\x00', 0x1ff) openat$smack_thread_current(0xffffffffffffff9c, &(0x7f0000000240)='/proc/thread-self/attr/current\x00', 0x2, 0x0) write$cgroup_subtree(r2, &(0x7f0000000000)=ANY=[], 0x20032600) ioctl$TCSETAF(r0, 0x5408, &(0x7f0000000040)={0x2}) ioctl$EXT4_IOC_GROUP_ADD(r0, 0x40286608, &(0x7f0000000000)={0x3, 0x7000000, 0x400, 0x100000000, 0x0, 0x8}) ioctl$EVIOCGVERSION(0xffffffffffffffff, 0x80044501, &(0x7f0000000200)=""/31) 14:03:54 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSPTLCK(r0, 0x40045431, &(0x7f0000000180)) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) socket(0x200000000000011, 0x4000000000080002, 0x0) bind$packet(0xffffffffffffffff, 0x0, 0x0) sendmmsg(0xffffffffffffffff, &(0x7f0000007880)=[{{&(0x7f00000001c0)=@l2={0x1f, 0xbf53, {0x9, 0x7, 0xfffffffffffffdd5, 0x1ff, 0x2, 0x4}, 0x0, 0x7}, 0x80, 0x0}}], 0x1, 0x4048851) setsockopt$packet_int(0xffffffffffffffff, 0x107, 0x0, 0x0, 0x0) syz_open_procfs(0x0, 0x0) ioctl$LOOP_SET_BLOCK_SIZE(0xffffffffffffffff, 0x4c09, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$cgroup_int(0xffffffffffffffff, 0x0, 0x2, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='\x89\x00\x00\x00\x00Ew\x00\x00\x00\xef\xb4\xc8\xd0\xff\xda\xb1vents\xd9\xc5H\xd4\x91\xfdN_]\x16\xe4\xa9C\xd2\x86Qn\xefS\x80\x11J\xfb4\x14\x86 4\x95\x9e\xfc\xc1\a\xcb \x95N\xe9\xa4j\xd2\x1f^\xb0\xb2>\xa3\xc9\xb7$\x11`t\x03: \x8b\xa4\x05\xf2?E\xdb+{t\xb8\xf7\xab\x8b\x100#', 0x26e1, 0x0) ioctl$PERF_EVENT_IOC_PAUSE_OUTPUT(r1, 0x40086602, 0x400007) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000280)='./cgroup/syz0\x00', 0x1ff) openat$smack_thread_current(0xffffffffffffff9c, &(0x7f0000000240)='/proc/thread-self/attr/current\x00', 0x2, 0x0) write$cgroup_subtree(r1, &(0x7f0000000100)=ANY=[], 0xff4a) write$cgroup_subtree(r2, &(0x7f0000000000)=ANY=[], 0x20032600) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a0f, 0x1700) accept$inet(0xffffffffffffffff, &(0x7f0000000040)={0x2, 0x0, @local}, &(0x7f0000000080)=0x10) ioctl$TCSETAF(r0, 0x5408, &(0x7f0000000040)={0x2}) ioctl$EXT4_IOC_GROUP_ADD(r0, 0x40286608, &(0x7f0000000000)={0x3, 0x7000000, 0x400, 0x100000000, 0x0, 0x8}) r3 = fcntl$dupfd(r0, 0x406, r0) ioctl$EVIOCGVERSION(r3, 0x80044501, &(0x7f0000000200)=""/31) write$binfmt_misc(r0, &(0x7f0000000080)={'syz1', "80fa25cdc862d216160cfa92845a3916e38a409a159c03f1889971d3e5144a8d08de78c4b1fbee457437261d7668b1c0f582647ad4134a05358d4309a71a702002329e024cac95642e761bb842bc1056bd6bf12c47697a649a026bd8ee1f685089941469b1ddfeddf32b392f0ff07652a3bce0770bc3bb70862845a65054cecb191e80b825d740fe6b40450359757032425dfdee92aec36ce4b468d50adc745c522cc4af2ac6e7f6a95f0edd70b09caa95fcc7143cf46b74db8bc17fa7c89f"}, 0xc3) 14:03:54 executing program 1: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSPTLCK(r0, 0x40045431, &(0x7f0000000180)) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) socket(0x200000000000011, 0x4000000000080002, 0x0) bind$packet(0xffffffffffffffff, 0x0, 0x0) sendmmsg(0xffffffffffffffff, &(0x7f0000007880)=[{{&(0x7f00000001c0)=@l2={0x1f, 0xbf53, {0x9, 0x7, 0xfffffffffffffdd5, 0x1ff, 0x2, 0x4}, 0x0, 0x7}, 0x80, 0x0}}, {{0x0, 0x0, &(0x7f0000007780)}}], 0x2, 0x4048851) syz_open_procfs(0x0, 0x0) ioctl$LOOP_SET_BLOCK_SIZE(0xffffffffffffffff, 0x4c09, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$cgroup_int(0xffffffffffffffff, 0x0, 0x2, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='\x89\x00\x00\x00\x00Ew\x00\x00\x00\xef\xb4\xc8\xd0\xff\xda\xb1vents\xd9\xc5H\xd4\x91\xfdN_]\x16\xe4\xa9C\xd2\x86Qn\xefS\x80\x11J\xfb4\x14\x86 4\x95\x9e\xfc\xc1\a\xcb \x95N\xe9\xa4j\xd2\x1f^\xb0\xb2>\xa3\xc9\xb7$\x11`t\x03: \x8b\xa4\x05\xf2?E\xdb+{t\xb8\xf7\xab\x8b\x100#', 0x26e1, 0x0) ioctl$PERF_EVENT_IOC_PAUSE_OUTPUT(r1, 0x40086602, 0x400007) openat$smack_thread_current(0xffffffffffffff9c, &(0x7f0000000240)='/proc/thread-self/attr/current\x00', 0x2, 0x0) write$cgroup_subtree(0xffffffffffffffff, &(0x7f0000000000)=ANY=[], 0x20032600) ioctl$TCSETAF(r0, 0x5408, &(0x7f0000000040)={0x2}) ioctl$EXT4_IOC_GROUP_ADD(r0, 0x40286608, &(0x7f0000000000)={0x3, 0x7000000, 0x400, 0x100000000, 0x0, 0x8}) ioctl$EVIOCGVERSION(0xffffffffffffffff, 0x80044501, &(0x7f0000000200)=""/31) 14:03:54 executing program 5: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSPTLCK(r0, 0x40045431, &(0x7f0000000180)) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) socket(0x200000000000011, 0x4000000000080002, 0x0) bind$packet(0xffffffffffffffff, 0x0, 0x0) sendmmsg(0xffffffffffffffff, &(0x7f0000007880)=[{{&(0x7f00000001c0)=@l2={0x1f, 0xbf53, {0x9, 0x7, 0xfffffffffffffdd5, 0x1ff, 0x2, 0x4}, 0x0, 0x7}, 0x80, 0x0}}, {{0x0, 0x0, &(0x7f0000007780)}}], 0x2, 0x4048851) setsockopt$packet_int(0xffffffffffffffff, 0x107, 0x0, 0x0, 0x0) syz_open_procfs(0x0, 0x0) ioctl$LOOP_SET_BLOCK_SIZE(0xffffffffffffffff, 0x4c09, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$cgroup_int(0xffffffffffffffff, 0x0, 0x2, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='\x89\x00\x00\x00\x00Ew\x00\x00\x00\xef\xb4\xc8\xd0\xff\xda\xb1vents\xd9\xc5H\xd4\x91\xfdN_]\x16\xe4\xa9C\xd2\x86Qn\xefS\x80\x11J\xfb4\x14\x86 4\x95\x9e\xfc\xc1\a\xcb \x95N\xe9\xa4j\xd2\x1f^\xb0\xb2>\xa3\xc9\xb7$\x11`t\x03: \x8b\xa4\x05\xf2?E\xdb+{t\xb8\xf7\xab\x8b\x100#', 0x26e1, 0x0) ioctl$PERF_EVENT_IOC_PAUSE_OUTPUT(r1, 0x40086602, 0x400007) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000280)='./cgroup/syz0\x00', 0x1ff) openat$smack_thread_current(0xffffffffffffff9c, &(0x7f0000000240)='/proc/thread-self/attr/current\x00', 0x2, 0x0) write$cgroup_subtree(r1, &(0x7f0000000100)=ANY=[], 0xff4a) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a0f, 0x1700) accept$inet(0xffffffffffffffff, &(0x7f0000000040)={0x2, 0x0, @local}, &(0x7f0000000080)=0x10) ioctl$TCSETAF(r0, 0x5408, &(0x7f0000000040)={0x2}) ioctl$EXT4_IOC_GROUP_ADD(r0, 0x40286608, &(0x7f0000000000)={0x3, 0x7000000, 0x400, 0x100000000, 0x0, 0x8}) r2 = fcntl$dupfd(r0, 0x406, r0) ioctl$EVIOCGVERSION(r2, 0x80044501, &(0x7f0000000200)=""/31) write$binfmt_misc(r0, &(0x7f0000000080)={'syz1', "80fa25cdc862d216160cfa92845a3916e38a409a159c03f1889971d3e5144a8d08de78c4b1fbee457437261d7668b1c0f582647ad4134a05358d4309a71a702002329e024cac95642e761bb842bc1056bd6bf12c47697a649a026bd8ee1f685089941469b1ddfeddf32b392f0ff07652a3bce0770bc3bb70862845a65054cecb191e80b825d740fe6b40450359757032425dfdee92aec36ce4b468d50adc745c522cc4af2ac6e7f6a95f0edd70b09caa95fcc7143cf46b74db8bc17fa7c89f"}, 0xc3) 14:03:54 executing program 4: syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f00000001c0)=[@acquire], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=ANY=[@ANYBLOB="0e630c408c0d0000"], 0x0, 0x0, 0x0}) [ 340.620494] binder: 10902:10903 Acquire 1 refcount change on invalid ref 0 ret -22 [ 340.640103] binder: 10902:10903 BC_REQUEST_DEATH_NOTIFICATION invalid ref 3468 14:03:54 executing program 3: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSPTLCK(r0, 0x40045431, &(0x7f0000000180)) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) socket(0x200000000000011, 0x4000000000080002, 0x0) bind$packet(0xffffffffffffffff, 0x0, 0x0) sendmmsg(0xffffffffffffffff, &(0x7f0000007880)=[{{&(0x7f00000001c0)=@l2={0x1f, 0xbf53, {0x9, 0x7, 0xfffffffffffffdd5, 0x1ff, 0x2, 0x4}, 0x0, 0x7}, 0x80, 0x0}}, {{0x0, 0x0, &(0x7f0000007780)}}], 0x2, 0x4048851) setsockopt$packet_int(0xffffffffffffffff, 0x107, 0x0, 0x0, 0x0) syz_open_procfs(0x0, 0x0) ioctl$LOOP_SET_BLOCK_SIZE(0xffffffffffffffff, 0x4c09, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$cgroup_int(0xffffffffffffffff, 0x0, 0x2, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='\x89\x00\x00\x00\x00Ew\x00\x00\x00\xef\xb4\xc8\xd0\xff\xda\xb1vents\xd9\xc5H\xd4\x91\xfdN_]\x16\xe4\xa9C\xd2\x86Qn\xefS\x80\x11J\xfb4\x14\x86 4\x95\x9e\xfc\xc1\a\xcb \x95N\xe9\xa4j\xd2\x1f^\xb0\xb2>\xa3\xc9\xb7$\x11`t\x03: \x8b\xa4\x05\xf2?E\xdb+{t\xb8\xf7\xab\x8b\x100#', 0x26e1, 0x0) ioctl$PERF_EVENT_IOC_PAUSE_OUTPUT(r1, 0x40086602, 0x400007) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000280)='./cgroup/syz0\x00', 0x1ff) openat$smack_thread_current(0xffffffffffffff9c, &(0x7f0000000240)='/proc/thread-self/attr/current\x00', 0x2, 0x0) write$cgroup_subtree(r1, &(0x7f0000000100)=ANY=[], 0xff4a) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a0f, 0x1700) accept$inet(0xffffffffffffffff, &(0x7f0000000040)={0x2, 0x0, @local}, &(0x7f0000000080)=0x10) ioctl$TCSETAF(r0, 0x5408, &(0x7f0000000040)={0x2}) ioctl$EXT4_IOC_GROUP_ADD(r0, 0x40286608, &(0x7f0000000000)={0x3, 0x7000000, 0x400, 0x100000000, 0x0, 0x8}) r2 = fcntl$dupfd(r0, 0x406, r0) ioctl$EVIOCGVERSION(r2, 0x80044501, &(0x7f0000000200)=""/31) write$binfmt_misc(r0, &(0x7f0000000080)={'syz1', "80fa25cdc862d216160cfa92845a3916e38a409a159c03f1889971d3e5144a8d08de78c4b1fbee457437261d7668b1c0f582647ad4134a05358d4309a71a702002329e024cac95642e761bb842bc1056bd6bf12c47697a649a026bd8ee1f685089941469b1ddfeddf32b392f0ff07652a3bce0770bc3bb70862845a65054cecb191e80b825d740fe6b40450359757032425dfdee92aec36ce4b468d50adc745c522cc4af2ac6e7f6a95f0edd70b09caa95fcc7143cf46b74db8bc17fa7c89f"}, 0xc3) [ 340.710662] binder: 10917:10919 Acquire 1 refcount change on invalid ref 0 ret -22 14:03:54 executing program 4: syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f00000001c0)=[@acquire], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=ANY=[@ANYBLOB="0e630c408c0d0000"], 0x0, 0x0, 0x0}) 14:03:54 executing program 1: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSPTLCK(r0, 0x40045431, &(0x7f0000000180)) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) socket(0x200000000000011, 0x4000000000080002, 0x0) bind$packet(0xffffffffffffffff, 0x0, 0x0) sendmmsg(0xffffffffffffffff, &(0x7f0000007880)=[{{&(0x7f00000001c0)=@l2={0x1f, 0xbf53, {0x9, 0x7, 0xfffffffffffffdd5, 0x1ff, 0x2, 0x4}, 0x0, 0x7}, 0x80, 0x0}}, {{0x0, 0x0, &(0x7f0000007780)}}], 0x2, 0x4048851) syz_open_procfs(0x0, 0x0) ioctl$LOOP_SET_BLOCK_SIZE(0xffffffffffffffff, 0x4c09, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$cgroup_int(0xffffffffffffffff, 0x0, 0x2, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='\x89\x00\x00\x00\x00Ew\x00\x00\x00\xef\xb4\xc8\xd0\xff\xda\xb1vents\xd9\xc5H\xd4\x91\xfdN_]\x16\xe4\xa9C\xd2\x86Qn\xefS\x80\x11J\xfb4\x14\x86 4\x95\x9e\xfc\xc1\a\xcb \x95N\xe9\xa4j\xd2\x1f^\xb0\xb2>\xa3\xc9\xb7$\x11`t\x03: \x8b\xa4\x05\xf2?E\xdb+{t\xb8\xf7\xab\x8b\x100#', 0x26e1, 0x0) ioctl$PERF_EVENT_IOC_PAUSE_OUTPUT(r1, 0x40086602, 0x400007) openat$smack_thread_current(0xffffffffffffff9c, &(0x7f0000000240)='/proc/thread-self/attr/current\x00', 0x2, 0x0) write$cgroup_subtree(0xffffffffffffffff, &(0x7f0000000000)=ANY=[], 0x20032600) ioctl$TCSETAF(r0, 0x5408, &(0x7f0000000040)={0x2}) ioctl$EXT4_IOC_GROUP_ADD(r0, 0x40286608, &(0x7f0000000000)={0x3, 0x7000000, 0x400, 0x100000000, 0x0, 0x8}) ioctl$EVIOCGVERSION(0xffffffffffffffff, 0x80044501, &(0x7f0000000200)=""/31) 14:03:54 executing program 0: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSPTLCK(r0, 0x40045431, &(0x7f0000000180)) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) socket(0x200000000000011, 0x4000000000080002, 0x0) bind$packet(0xffffffffffffffff, 0x0, 0x0) sendmmsg(0xffffffffffffffff, &(0x7f0000007880)=[{{&(0x7f00000001c0)=@l2={0x1f, 0xbf53, {0x9, 0x7, 0xfffffffffffffdd5, 0x1ff, 0x2, 0x4}, 0x0, 0x7}, 0x80, 0x0}}, {{0x0, 0x0, &(0x7f0000007780)}}], 0x2, 0x4048851) syz_open_procfs(0x0, 0x0) ioctl$LOOP_SET_BLOCK_SIZE(0xffffffffffffffff, 0x4c09, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$cgroup_int(0xffffffffffffffff, 0x0, 0x2, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='\x89\x00\x00\x00\x00Ew\x00\x00\x00\xef\xb4\xc8\xd0\xff\xda\xb1vents\xd9\xc5H\xd4\x91\xfdN_]\x16\xe4\xa9C\xd2\x86Qn\xefS\x80\x11J\xfb4\x14\x86 4\x95\x9e\xfc\xc1\a\xcb \x95N\xe9\xa4j\xd2\x1f^\xb0\xb2>\xa3\xc9\xb7$\x11`t\x03: \x8b\xa4\x05\xf2?E\xdb+{t\xb8\xf7\xab\x8b\x100#', 0x26e1, 0x0) ioctl$PERF_EVENT_IOC_PAUSE_OUTPUT(r1, 0x40086602, 0x400007) openat$smack_thread_current(0xffffffffffffff9c, &(0x7f0000000240)='/proc/thread-self/attr/current\x00', 0x2, 0x0) write$cgroup_subtree(0xffffffffffffffff, &(0x7f0000000000)=ANY=[], 0x20032600) ioctl$TCSETAF(r0, 0x5408, &(0x7f0000000040)={0x2}) ioctl$EXT4_IOC_GROUP_ADD(r0, 0x40286608, &(0x7f0000000000)={0x3, 0x7000000, 0x400, 0x100000000, 0x0, 0x8}) ioctl$EVIOCGVERSION(0xffffffffffffffff, 0x80044501, &(0x7f0000000200)=""/31) [ 340.753601] binder: 10917:10919 BC_REQUEST_DEATH_NOTIFICATION invalid ref 3468 14:03:54 executing program 5: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSPTLCK(r0, 0x40045431, &(0x7f0000000180)) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) socket(0x200000000000011, 0x4000000000080002, 0x0) bind$packet(0xffffffffffffffff, 0x0, 0x0) sendmmsg(0xffffffffffffffff, &(0x7f0000007880)=[{{&(0x7f00000001c0)=@l2={0x1f, 0xbf53, {0x9, 0x7, 0xfffffffffffffdd5, 0x1ff, 0x2, 0x4}, 0x0, 0x7}, 0x80, 0x0}}, {{0x0, 0x0, &(0x7f0000007780)}}], 0x2, 0x4048851) setsockopt$packet_int(0xffffffffffffffff, 0x107, 0x0, 0x0, 0x0) syz_open_procfs(0x0, 0x0) ioctl$LOOP_SET_BLOCK_SIZE(0xffffffffffffffff, 0x4c09, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$cgroup_int(0xffffffffffffffff, 0x0, 0x2, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='\x89\x00\x00\x00\x00Ew\x00\x00\x00\xef\xb4\xc8\xd0\xff\xda\xb1vents\xd9\xc5H\xd4\x91\xfdN_]\x16\xe4\xa9C\xd2\x86Qn\xefS\x80\x11J\xfb4\x14\x86 4\x95\x9e\xfc\xc1\a\xcb \x95N\xe9\xa4j\xd2\x1f^\xb0\xb2>\xa3\xc9\xb7$\x11`t\x03: \x8b\xa4\x05\xf2?E\xdb+{t\xb8\xf7\xab\x8b\x100#', 0x26e1, 0x0) ioctl$PERF_EVENT_IOC_PAUSE_OUTPUT(r1, 0x40086602, 0x400007) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000280)='./cgroup/syz0\x00', 0x1ff) openat$smack_thread_current(0xffffffffffffff9c, &(0x7f0000000240)='/proc/thread-self/attr/current\x00', 0x2, 0x0) write$cgroup_subtree(r1, &(0x7f0000000100)=ANY=[], 0xff4a) write$cgroup_subtree(r2, &(0x7f0000000000)=ANY=[], 0x20032600) accept$inet(0xffffffffffffffff, &(0x7f0000000040)={0x2, 0x0, @local}, &(0x7f0000000080)=0x10) ioctl$TCSETAF(r0, 0x5408, &(0x7f0000000040)={0x2}) ioctl$EXT4_IOC_GROUP_ADD(r0, 0x40286608, &(0x7f0000000000)={0x3, 0x7000000, 0x400, 0x100000000, 0x0, 0x8}) r3 = fcntl$dupfd(r0, 0x406, r0) ioctl$EVIOCGVERSION(r3, 0x80044501, &(0x7f0000000200)=""/31) write$binfmt_misc(r0, &(0x7f0000000080)={'syz1', "80fa25cdc862d216160cfa92845a3916e38a409a159c03f1889971d3e5144a8d08de78c4b1fbee457437261d7668b1c0f582647ad4134a05358d4309a71a702002329e024cac95642e761bb842bc1056bd6bf12c47697a649a026bd8ee1f685089941469b1ddfeddf32b392f0ff07652a3bce0770bc3bb70862845a65054cecb191e80b825d740fe6b40450359757032425dfdee92aec36ce4b468d50adc745c522cc4af2ac6e7f6a95f0edd70b09caa95fcc7143cf46b74db8bc17fa7c89f"}, 0xc3) 14:03:54 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f00000001c0)=[@acquire], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=ANY=[@ANYBLOB="0e630c408c0d0000"], 0x0, 0x0, 0x0}) 14:03:54 executing program 3: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSPTLCK(r0, 0x40045431, &(0x7f0000000180)) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) socket(0x200000000000011, 0x4000000000080002, 0x0) bind$packet(0xffffffffffffffff, 0x0, 0x0) sendmmsg(0xffffffffffffffff, &(0x7f0000007880)=[{{&(0x7f00000001c0)=@l2={0x1f, 0xbf53, {0x9, 0x7, 0xfffffffffffffdd5, 0x1ff, 0x2, 0x4}, 0x0, 0x7}, 0x80, 0x0}}, {{0x0, 0x0, &(0x7f0000007780)}}], 0x2, 0x4048851) setsockopt$packet_int(0xffffffffffffffff, 0x107, 0x0, 0x0, 0x0) syz_open_procfs(0x0, 0x0) ioctl$LOOP_SET_BLOCK_SIZE(0xffffffffffffffff, 0x4c09, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$cgroup_int(0xffffffffffffffff, 0x0, 0x2, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='\x89\x00\x00\x00\x00Ew\x00\x00\x00\xef\xb4\xc8\xd0\xff\xda\xb1vents\xd9\xc5H\xd4\x91\xfdN_]\x16\xe4\xa9C\xd2\x86Qn\xefS\x80\x11J\xfb4\x14\x86 4\x95\x9e\xfc\xc1\a\xcb \x95N\xe9\xa4j\xd2\x1f^\xb0\xb2>\xa3\xc9\xb7$\x11`t\x03: \x8b\xa4\x05\xf2?E\xdb+{t\xb8\xf7\xab\x8b\x100#', 0x26e1, 0x0) ioctl$PERF_EVENT_IOC_PAUSE_OUTPUT(r1, 0x40086602, 0x400007) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000280)='./cgroup/syz0\x00', 0x1ff) openat$smack_thread_current(0xffffffffffffff9c, &(0x7f0000000240)='/proc/thread-self/attr/current\x00', 0x2, 0x0) write$cgroup_subtree(r1, &(0x7f0000000100)=ANY=[], 0xff4a) write$cgroup_subtree(r2, &(0x7f0000000000)=ANY=[], 0x20032600) accept$inet(0xffffffffffffffff, &(0x7f0000000040)={0x2, 0x0, @local}, &(0x7f0000000080)=0x10) ioctl$TCSETAF(r0, 0x5408, &(0x7f0000000040)={0x2}) ioctl$EXT4_IOC_GROUP_ADD(r0, 0x40286608, &(0x7f0000000000)={0x3, 0x7000000, 0x400, 0x100000000, 0x0, 0x8}) r3 = fcntl$dupfd(r0, 0x406, r0) ioctl$EVIOCGVERSION(r3, 0x80044501, &(0x7f0000000200)=""/31) write$binfmt_misc(r0, &(0x7f0000000080)={'syz1', "80fa25cdc862d216160cfa92845a3916e38a409a159c03f1889971d3e5144a8d08de78c4b1fbee457437261d7668b1c0f582647ad4134a05358d4309a71a702002329e024cac95642e761bb842bc1056bd6bf12c47697a649a026bd8ee1f685089941469b1ddfeddf32b392f0ff07652a3bce0770bc3bb70862845a65054cecb191e80b825d740fe6b40450359757032425dfdee92aec36ce4b468d50adc745c522cc4af2ac6e7f6a95f0edd70b09caa95fcc7143cf46b74db8bc17fa7c89f"}, 0xc3) 14:03:54 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSPTLCK(r0, 0x40045431, &(0x7f0000000180)) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) socket(0x200000000000011, 0x4000000000080002, 0x0) bind$packet(0xffffffffffffffff, 0x0, 0x0) sendmmsg(0xffffffffffffffff, &(0x7f0000007880)=[{{&(0x7f00000001c0)=@l2={0x1f, 0xbf53, {0x9, 0x7, 0xfffffffffffffdd5, 0x1ff, 0x2, 0x4}, 0x0, 0x7}, 0x80, 0x0}}], 0x1, 0x4048851) setsockopt$packet_int(0xffffffffffffffff, 0x107, 0x0, 0x0, 0x0) syz_open_procfs(0x0, 0x0) ioctl$LOOP_SET_BLOCK_SIZE(0xffffffffffffffff, 0x4c09, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$cgroup_int(0xffffffffffffffff, 0x0, 0x2, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='\x89\x00\x00\x00\x00Ew\x00\x00\x00\xef\xb4\xc8\xd0\xff\xda\xb1vents\xd9\xc5H\xd4\x91\xfdN_]\x16\xe4\xa9C\xd2\x86Qn\xefS\x80\x11J\xfb4\x14\x86 4\x95\x9e\xfc\xc1\a\xcb \x95N\xe9\xa4j\xd2\x1f^\xb0\xb2>\xa3\xc9\xb7$\x11`t\x03: \x8b\xa4\x05\xf2?E\xdb+{t\xb8\xf7\xab\x8b\x100#', 0x26e1, 0x0) ioctl$PERF_EVENT_IOC_PAUSE_OUTPUT(r1, 0x40086602, 0x400007) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000280)='./cgroup/syz0\x00', 0x1ff) openat$smack_thread_current(0xffffffffffffff9c, &(0x7f0000000240)='/proc/thread-self/attr/current\x00', 0x2, 0x0) write$cgroup_subtree(r1, &(0x7f0000000100)=ANY=[], 0xff4a) write$cgroup_subtree(r2, &(0x7f0000000000)=ANY=[], 0x20032600) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a0f, 0x1700) accept$inet(0xffffffffffffffff, &(0x7f0000000040)={0x2, 0x0, @local}, &(0x7f0000000080)=0x10) ioctl$TCSETAF(r0, 0x5408, &(0x7f0000000040)={0x2}) ioctl$EXT4_IOC_GROUP_ADD(r0, 0x40286608, &(0x7f0000000000)={0x3, 0x7000000, 0x400, 0x100000000, 0x0, 0x8}) r3 = fcntl$dupfd(r0, 0x406, r0) ioctl$EVIOCGVERSION(r3, 0x80044501, &(0x7f0000000200)=""/31) write$binfmt_misc(r0, &(0x7f0000000080)={'syz1', "80fa25cdc862d216160cfa92845a3916e38a409a159c03f1889971d3e5144a8d08de78c4b1fbee457437261d7668b1c0f582647ad4134a05358d4309a71a702002329e024cac95642e761bb842bc1056bd6bf12c47697a649a026bd8ee1f685089941469b1ddfeddf32b392f0ff07652a3bce0770bc3bb70862845a65054cecb191e80b825d740fe6b40450359757032425dfdee92aec36ce4b468d50adc745c522cc4af2ac6e7f6a95f0edd70b09caa95fcc7143cf46b74db8bc17fa7c89f"}, 0xc3) [ 340.839607] binder: 10928:10934 Acquire 1 refcount change on invalid ref 0 ret -22 [ 340.852990] binder: 10928:10934 BC_REQUEST_DEATH_NOTIFICATION invalid ref 3468 14:03:54 executing program 1: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSPTLCK(r0, 0x40045431, &(0x7f0000000180)) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) socket(0x200000000000011, 0x4000000000080002, 0x0) bind$packet(0xffffffffffffffff, 0x0, 0x0) sendmmsg(0xffffffffffffffff, &(0x7f0000007880)=[{{&(0x7f00000001c0)=@l2={0x1f, 0xbf53, {0x9, 0x7, 0xfffffffffffffdd5, 0x1ff, 0x2, 0x4}, 0x0, 0x7}, 0x80, 0x0}}, {{0x0, 0x0, &(0x7f0000007780)}}], 0x2, 0x4048851) syz_open_procfs(0x0, 0x0) ioctl$LOOP_SET_BLOCK_SIZE(0xffffffffffffffff, 0x4c09, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$cgroup_int(0xffffffffffffffff, 0x0, 0x2, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='\x89\x00\x00\x00\x00Ew\x00\x00\x00\xef\xb4\xc8\xd0\xff\xda\xb1vents\xd9\xc5H\xd4\x91\xfdN_]\x16\xe4\xa9C\xd2\x86Qn\xefS\x80\x11J\xfb4\x14\x86 4\x95\x9e\xfc\xc1\a\xcb \x95N\xe9\xa4j\xd2\x1f^\xb0\xb2>\xa3\xc9\xb7$\x11`t\x03: \x8b\xa4\x05\xf2?E\xdb+{t\xb8\xf7\xab\x8b\x100#', 0x26e1, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) openat$smack_thread_current(0xffffffffffffff9c, &(0x7f0000000240)='/proc/thread-self/attr/current\x00', 0x2, 0x0) write$cgroup_subtree(r1, &(0x7f0000000000)=ANY=[], 0x20032600) ioctl$TCSETAF(r0, 0x5408, &(0x7f0000000040)={0x2}) ioctl$EXT4_IOC_GROUP_ADD(r0, 0x40286608, &(0x7f0000000000)={0x3, 0x7000000, 0x400, 0x100000000, 0x0, 0x8}) ioctl$EVIOCGVERSION(0xffffffffffffffff, 0x80044501, &(0x7f0000000200)=""/31) 14:03:54 executing program 0: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSPTLCK(r0, 0x40045431, &(0x7f0000000180)) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) socket(0x200000000000011, 0x4000000000080002, 0x0) bind$packet(0xffffffffffffffff, 0x0, 0x0) sendmmsg(0xffffffffffffffff, &(0x7f0000007880)=[{{&(0x7f00000001c0)=@l2={0x1f, 0xbf53, {0x9, 0x7, 0xfffffffffffffdd5, 0x1ff, 0x2, 0x4}, 0x0, 0x7}, 0x80, 0x0}}, {{0x0, 0x0, &(0x7f0000007780)}}], 0x2, 0x4048851) syz_open_procfs(0x0, 0x0) ioctl$LOOP_SET_BLOCK_SIZE(0xffffffffffffffff, 0x4c09, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$cgroup_int(0xffffffffffffffff, 0x0, 0x2, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='\x89\x00\x00\x00\x00Ew\x00\x00\x00\xef\xb4\xc8\xd0\xff\xda\xb1vents\xd9\xc5H\xd4\x91\xfdN_]\x16\xe4\xa9C\xd2\x86Qn\xefS\x80\x11J\xfb4\x14\x86 4\x95\x9e\xfc\xc1\a\xcb \x95N\xe9\xa4j\xd2\x1f^\xb0\xb2>\xa3\xc9\xb7$\x11`t\x03: \x8b\xa4\x05\xf2?E\xdb+{t\xb8\xf7\xab\x8b\x100#', 0x26e1, 0x0) ioctl$PERF_EVENT_IOC_PAUSE_OUTPUT(r1, 0x40086602, 0x400007) openat$smack_thread_current(0xffffffffffffff9c, &(0x7f0000000240)='/proc/thread-self/attr/current\x00', 0x2, 0x0) write$cgroup_subtree(0xffffffffffffffff, &(0x7f0000000000)=ANY=[], 0x20032600) ioctl$TCSETAF(r0, 0x5408, &(0x7f0000000040)={0x2}) ioctl$EXT4_IOC_GROUP_ADD(r0, 0x40286608, &(0x7f0000000000)={0x3, 0x7000000, 0x400, 0x100000000, 0x0, 0x8}) ioctl$EVIOCGVERSION(0xffffffffffffffff, 0x80044501, &(0x7f0000000200)=""/31) 14:03:54 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f00000001c0)=[@acquire], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=ANY=[@ANYBLOB="0e630c408c0d0000"], 0x0, 0x0, 0x0}) [ 340.910373] binder: 10940:10943 BC_REQUEST_DEATH_NOTIFICATION invalid ref 3468 14:03:54 executing program 5: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSPTLCK(r0, 0x40045431, &(0x7f0000000180)) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) socket(0x200000000000011, 0x4000000000080002, 0x0) bind$packet(0xffffffffffffffff, 0x0, 0x0) sendmmsg(0xffffffffffffffff, &(0x7f0000007880)=[{{&(0x7f00000001c0)=@l2={0x1f, 0xbf53, {0x9, 0x7, 0xfffffffffffffdd5, 0x1ff, 0x2, 0x4}, 0x0, 0x7}, 0x80, 0x0}}, {{0x0, 0x0, &(0x7f0000007780)}}], 0x2, 0x4048851) setsockopt$packet_int(0xffffffffffffffff, 0x107, 0x0, 0x0, 0x0) syz_open_procfs(0x0, 0x0) ioctl$LOOP_SET_BLOCK_SIZE(0xffffffffffffffff, 0x4c09, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$cgroup_int(0xffffffffffffffff, 0x0, 0x2, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='\x89\x00\x00\x00\x00Ew\x00\x00\x00\xef\xb4\xc8\xd0\xff\xda\xb1vents\xd9\xc5H\xd4\x91\xfdN_]\x16\xe4\xa9C\xd2\x86Qn\xefS\x80\x11J\xfb4\x14\x86 4\x95\x9e\xfc\xc1\a\xcb \x95N\xe9\xa4j\xd2\x1f^\xb0\xb2>\xa3\xc9\xb7$\x11`t\x03: \x8b\xa4\x05\xf2?E\xdb+{t\xb8\xf7\xab\x8b\x100#', 0x26e1, 0x0) ioctl$PERF_EVENT_IOC_PAUSE_OUTPUT(r1, 0x40086602, 0x400007) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000280)='./cgroup/syz0\x00', 0x1ff) openat$smack_thread_current(0xffffffffffffff9c, &(0x7f0000000240)='/proc/thread-self/attr/current\x00', 0x2, 0x0) write$cgroup_subtree(r1, &(0x7f0000000100)=ANY=[], 0xff4a) write$cgroup_subtree(r2, &(0x7f0000000000)=ANY=[], 0x20032600) accept$inet(0xffffffffffffffff, &(0x7f0000000040)={0x2, 0x0, @local}, &(0x7f0000000080)=0x10) ioctl$TCSETAF(r0, 0x5408, &(0x7f0000000040)={0x2}) ioctl$EXT4_IOC_GROUP_ADD(r0, 0x40286608, &(0x7f0000000000)={0x3, 0x7000000, 0x400, 0x100000000, 0x0, 0x8}) r3 = fcntl$dupfd(r0, 0x406, r0) ioctl$EVIOCGVERSION(r3, 0x80044501, &(0x7f0000000200)=""/31) write$binfmt_misc(r0, &(0x7f0000000080)={'syz1', "80fa25cdc862d216160cfa92845a3916e38a409a159c03f1889971d3e5144a8d08de78c4b1fbee457437261d7668b1c0f582647ad4134a05358d4309a71a702002329e024cac95642e761bb842bc1056bd6bf12c47697a649a026bd8ee1f685089941469b1ddfeddf32b392f0ff07652a3bce0770bc3bb70862845a65054cecb191e80b825d740fe6b40450359757032425dfdee92aec36ce4b468d50adc745c522cc4af2ac6e7f6a95f0edd70b09caa95fcc7143cf46b74db8bc17fa7c89f"}, 0xc3) 14:03:54 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f00000001c0)=[@acquire], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=ANY=[@ANYBLOB="0e630c408c0d0000"], 0x0, 0x0, 0x0}) 14:03:54 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSPTLCK(r0, 0x40045431, &(0x7f0000000180)) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) socket(0x200000000000011, 0x4000000000080002, 0x0) bind$packet(0xffffffffffffffff, 0x0, 0x0) sendmmsg(0xffffffffffffffff, &(0x7f0000007880)=[{{&(0x7f00000001c0)=@l2={0x1f, 0xbf53, {0x9, 0x7, 0xfffffffffffffdd5, 0x1ff, 0x2, 0x4}, 0x0, 0x7}, 0x80, 0x0}}, {{0x0, 0x0, 0x0}}], 0x2, 0x4048851) setsockopt$packet_int(0xffffffffffffffff, 0x107, 0x0, 0x0, 0x0) syz_open_procfs(0x0, 0x0) ioctl$LOOP_SET_BLOCK_SIZE(0xffffffffffffffff, 0x4c09, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$cgroup_int(0xffffffffffffffff, 0x0, 0x2, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='\x89\x00\x00\x00\x00Ew\x00\x00\x00\xef\xb4\xc8\xd0\xff\xda\xb1vents\xd9\xc5H\xd4\x91\xfdN_]\x16\xe4\xa9C\xd2\x86Qn\xefS\x80\x11J\xfb4\x14\x86 4\x95\x9e\xfc\xc1\a\xcb \x95N\xe9\xa4j\xd2\x1f^\xb0\xb2>\xa3\xc9\xb7$\x11`t\x03: \x8b\xa4\x05\xf2?E\xdb+{t\xb8\xf7\xab\x8b\x100#', 0x26e1, 0x0) ioctl$PERF_EVENT_IOC_PAUSE_OUTPUT(r1, 0x40086602, 0x400007) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000280)='./cgroup/syz0\x00', 0x1ff) openat$smack_thread_current(0xffffffffffffff9c, &(0x7f0000000240)='/proc/thread-self/attr/current\x00', 0x2, 0x0) write$cgroup_subtree(r1, &(0x7f0000000100)=ANY=[], 0xff4a) write$cgroup_subtree(r2, &(0x7f0000000000)=ANY=[], 0x20032600) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a0f, 0x1700) accept$inet(0xffffffffffffffff, &(0x7f0000000040)={0x2, 0x0, @local}, &(0x7f0000000080)=0x10) ioctl$TCSETAF(r0, 0x5408, &(0x7f0000000040)={0x2}) ioctl$EXT4_IOC_GROUP_ADD(r0, 0x40286608, &(0x7f0000000000)={0x3, 0x7000000, 0x400, 0x100000000, 0x0, 0x8}) r3 = fcntl$dupfd(r0, 0x406, r0) ioctl$EVIOCGVERSION(r3, 0x80044501, &(0x7f0000000200)=""/31) write$binfmt_misc(r0, &(0x7f0000000080)={'syz1', "80fa25cdc862d216160cfa92845a3916e38a409a159c03f1889971d3e5144a8d08de78c4b1fbee457437261d7668b1c0f582647ad4134a05358d4309a71a702002329e024cac95642e761bb842bc1056bd6bf12c47697a649a026bd8ee1f685089941469b1ddfeddf32b392f0ff07652a3bce0770bc3bb70862845a65054cecb191e80b825d740fe6b40450359757032425dfdee92aec36ce4b468d50adc745c522cc4af2ac6e7f6a95f0edd70b09caa95fcc7143cf46b74db8bc17fa7c89f"}, 0xc3) [ 340.987696] binder: 10951:10955 BC_REQUEST_DEATH_NOTIFICATION invalid ref 3468 14:03:54 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=ANY=[@ANYBLOB="0e630c408c0d0000"], 0x0, 0x0, 0x0}) [ 341.035536] binder: 10960:10961 BC_REQUEST_DEATH_NOTIFICATION invalid ref 3468 14:03:54 executing program 0: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSPTLCK(r0, 0x40045431, &(0x7f0000000180)) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) socket(0x200000000000011, 0x4000000000080002, 0x0) bind$packet(0xffffffffffffffff, 0x0, 0x0) sendmmsg(0xffffffffffffffff, &(0x7f0000007880)=[{{&(0x7f00000001c0)=@l2={0x1f, 0xbf53, {0x9, 0x7, 0xfffffffffffffdd5, 0x1ff, 0x2, 0x4}, 0x0, 0x7}, 0x80, 0x0}}], 0x1, 0x4048851) setsockopt$packet_int(0xffffffffffffffff, 0x107, 0x0, 0x0, 0x0) syz_open_procfs(0x0, 0x0) ioctl$LOOP_SET_BLOCK_SIZE(0xffffffffffffffff, 0x4c09, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$cgroup_int(0xffffffffffffffff, 0x0, 0x2, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='\x89\x00\x00\x00\x00Ew\x00\x00\x00\xef\xb4\xc8\xd0\xff\xda\xb1vents\xd9\xc5H\xd4\x91\xfdN_]\x16\xe4\xa9C\xd2\x86Qn\xefS\x80\x11J\xfb4\x14\x86 4\x95\x9e\xfc\xc1\a\xcb \x95N\xe9\xa4j\xd2\x1f^\xb0\xb2>\xa3\xc9\xb7$\x11`t\x03: \x8b\xa4\x05\xf2?E\xdb+{t\xb8\xf7\xab\x8b\x100#', 0x26e1, 0x0) ioctl$PERF_EVENT_IOC_PAUSE_OUTPUT(r1, 0x40086602, 0x400007) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000280)='./cgroup/syz0\x00', 0x1ff) openat$smack_thread_current(0xffffffffffffff9c, &(0x7f0000000240)='/proc/thread-self/attr/current\x00', 0x2, 0x0) write$cgroup_subtree(r1, &(0x7f0000000100)=ANY=[], 0xff4a) write$cgroup_subtree(r2, &(0x7f0000000000)=ANY=[], 0x20032600) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a0f, 0x1700) accept$inet(0xffffffffffffffff, &(0x7f0000000040)={0x2, 0x0, @local}, &(0x7f0000000080)=0x10) ioctl$TCSETAF(r0, 0x5408, &(0x7f0000000040)={0x2}) ioctl$EXT4_IOC_GROUP_ADD(r0, 0x40286608, &(0x7f0000000000)={0x3, 0x7000000, 0x400, 0x100000000, 0x0, 0x8}) r3 = fcntl$dupfd(r0, 0x406, r0) ioctl$EVIOCGVERSION(r3, 0x80044501, &(0x7f0000000200)=""/31) write$binfmt_misc(r0, &(0x7f0000000080)={'syz1', "80fa25cdc862d216160cfa92845a3916e38a409a159c03f1889971d3e5144a8d08de78c4b1fbee457437261d7668b1c0f582647ad4134a05358d4309a71a702002329e024cac95642e761bb842bc1056bd6bf12c47697a649a026bd8ee1f685089941469b1ddfeddf32b392f0ff07652a3bce0770bc3bb70862845a65054cecb191e80b825d740fe6b40450359757032425dfdee92aec36ce4b468d50adc745c522cc4af2ac6e7f6a95f0edd70b09caa95fcc7143cf46b74db8bc17fa7c89f"}, 0xc3) 14:03:54 executing program 1: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSPTLCK(r0, 0x40045431, &(0x7f0000000180)) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) socket(0x200000000000011, 0x4000000000080002, 0x0) bind$packet(0xffffffffffffffff, 0x0, 0x0) sendmmsg(0xffffffffffffffff, &(0x7f0000007880)=[{{&(0x7f00000001c0)=@l2={0x1f, 0xbf53, {0x9, 0x7, 0xfffffffffffffdd5, 0x1ff, 0x2, 0x4}, 0x0, 0x7}, 0x80, 0x0}}, {{0x0, 0x0, &(0x7f0000007780)}}], 0x2, 0x4048851) syz_open_procfs(0x0, 0x0) ioctl$LOOP_SET_BLOCK_SIZE(0xffffffffffffffff, 0x4c09, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$cgroup_int(0xffffffffffffffff, 0x0, 0x2, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) openat$smack_thread_current(0xffffffffffffff9c, &(0x7f0000000240)='/proc/thread-self/attr/current\x00', 0x2, 0x0) write$cgroup_subtree(r1, &(0x7f0000000000)=ANY=[], 0x20032600) ioctl$TCSETAF(r0, 0x5408, &(0x7f0000000040)={0x2}) ioctl$EXT4_IOC_GROUP_ADD(r0, 0x40286608, &(0x7f0000000000)={0x3, 0x7000000, 0x400, 0x100000000, 0x0, 0x8}) ioctl$EVIOCGVERSION(0xffffffffffffffff, 0x80044501, &(0x7f0000000200)=""/31) 14:03:54 executing program 3: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSPTLCK(r0, 0x40045431, &(0x7f0000000180)) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) socket(0x200000000000011, 0x4000000000080002, 0x0) bind$packet(0xffffffffffffffff, 0x0, 0x0) sendmmsg(0xffffffffffffffff, &(0x7f0000007880)=[{{&(0x7f00000001c0)=@l2={0x1f, 0xbf53, {0x9, 0x7, 0xfffffffffffffdd5, 0x1ff, 0x2, 0x4}, 0x0, 0x7}, 0x80, 0x0}}, {{0x0, 0x0, &(0x7f0000007780)}}], 0x2, 0x4048851) setsockopt$packet_int(0xffffffffffffffff, 0x107, 0x0, 0x0, 0x0) syz_open_procfs(0x0, 0x0) ioctl$LOOP_SET_BLOCK_SIZE(0xffffffffffffffff, 0x4c09, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$cgroup_int(0xffffffffffffffff, 0x0, 0x2, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='\x89\x00\x00\x00\x00Ew\x00\x00\x00\xef\xb4\xc8\xd0\xff\xda\xb1vents\xd9\xc5H\xd4\x91\xfdN_]\x16\xe4\xa9C\xd2\x86Qn\xefS\x80\x11J\xfb4\x14\x86 4\x95\x9e\xfc\xc1\a\xcb \x95N\xe9\xa4j\xd2\x1f^\xb0\xb2>\xa3\xc9\xb7$\x11`t\x03: \x8b\xa4\x05\xf2?E\xdb+{t\xb8\xf7\xab\x8b\x100#', 0x26e1, 0x0) ioctl$PERF_EVENT_IOC_PAUSE_OUTPUT(r1, 0x40086602, 0x400007) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000280)='./cgroup/syz0\x00', 0x1ff) openat$smack_thread_current(0xffffffffffffff9c, &(0x7f0000000240)='/proc/thread-self/attr/current\x00', 0x2, 0x0) write$cgroup_subtree(r1, &(0x7f0000000100)=ANY=[], 0xff4a) write$cgroup_subtree(r2, &(0x7f0000000000)=ANY=[], 0x20032600) accept$inet(0xffffffffffffffff, &(0x7f0000000040)={0x2, 0x0, @local}, &(0x7f0000000080)=0x10) ioctl$TCSETAF(r0, 0x5408, &(0x7f0000000040)={0x2}) ioctl$EXT4_IOC_GROUP_ADD(r0, 0x40286608, &(0x7f0000000000)={0x3, 0x7000000, 0x400, 0x100000000, 0x0, 0x8}) r3 = fcntl$dupfd(r0, 0x406, r0) ioctl$EVIOCGVERSION(r3, 0x80044501, &(0x7f0000000200)=""/31) write$binfmt_misc(r0, &(0x7f0000000080)={'syz1', "80fa25cdc862d216160cfa92845a3916e38a409a159c03f1889971d3e5144a8d08de78c4b1fbee457437261d7668b1c0f582647ad4134a05358d4309a71a702002329e024cac95642e761bb842bc1056bd6bf12c47697a649a026bd8ee1f685089941469b1ddfeddf32b392f0ff07652a3bce0770bc3bb70862845a65054cecb191e80b825d740fe6b40450359757032425dfdee92aec36ce4b468d50adc745c522cc4af2ac6e7f6a95f0edd70b09caa95fcc7143cf46b74db8bc17fa7c89f"}, 0xc3) 14:03:54 executing program 5: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSPTLCK(r0, 0x40045431, &(0x7f0000000180)) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) socket(0x200000000000011, 0x4000000000080002, 0x0) bind$packet(0xffffffffffffffff, 0x0, 0x0) sendmmsg(0xffffffffffffffff, &(0x7f0000007880)=[{{&(0x7f00000001c0)=@l2={0x1f, 0xbf53, {0x9, 0x7, 0xfffffffffffffdd5, 0x1ff, 0x2, 0x4}, 0x0, 0x7}, 0x80, 0x0}}, {{0x0, 0x0, &(0x7f0000007780)}}], 0x2, 0x4048851) syz_open_procfs(0x0, 0x0) ioctl$LOOP_SET_BLOCK_SIZE(0xffffffffffffffff, 0x4c09, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$cgroup_int(0xffffffffffffffff, 0x0, 0x2, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='\x89\x00\x00\x00\x00Ew\x00\x00\x00\xef\xb4\xc8\xd0\xff\xda\xb1vents\xd9\xc5H\xd4\x91\xfdN_]\x16\xe4\xa9C\xd2\x86Qn\xefS\x80\x11J\xfb4\x14\x86 4\x95\x9e\xfc\xc1\a\xcb \x95N\xe9\xa4j\xd2\x1f^\xb0\xb2>\xa3\xc9\xb7$\x11`t\x03: \x8b\xa4\x05\xf2?E\xdb+{t\xb8\xf7\xab\x8b\x100#', 0x26e1, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) openat$smack_thread_current(0xffffffffffffff9c, &(0x7f0000000240)='/proc/thread-self/attr/current\x00', 0x2, 0x0) write$cgroup_subtree(r1, &(0x7f0000000000)=ANY=[], 0x20032600) ioctl$TCSETAF(r0, 0x5408, &(0x7f0000000040)={0x2}) ioctl$EXT4_IOC_GROUP_ADD(r0, 0x40286608, &(0x7f0000000000)={0x3, 0x7000000, 0x400, 0x100000000, 0x0, 0x8}) ioctl$EVIOCGVERSION(0xffffffffffffffff, 0x80044501, &(0x7f0000000200)=""/31) 14:03:54 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=ANY=[@ANYBLOB="0e630c408c0d0000"], 0x0, 0x0, 0x0}) 14:03:54 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSPTLCK(r0, 0x40045431, &(0x7f0000000180)) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) socket(0x200000000000011, 0x4000000000080002, 0x0) bind$packet(0xffffffffffffffff, 0x0, 0x0) sendmmsg(0xffffffffffffffff, &(0x7f0000007880)=[{{&(0x7f00000001c0)=@l2={0x1f, 0xbf53, {0x9, 0x7, 0xfffffffffffffdd5, 0x1ff, 0x2, 0x4}, 0x0, 0x7}, 0x80, 0x0}}, {{0x0, 0x0, 0x0}}], 0x2, 0x4048851) setsockopt$packet_int(0xffffffffffffffff, 0x107, 0x0, 0x0, 0x0) syz_open_procfs(0x0, 0x0) ioctl$LOOP_SET_BLOCK_SIZE(0xffffffffffffffff, 0x4c09, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$cgroup_int(0xffffffffffffffff, 0x0, 0x2, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='\x89\x00\x00\x00\x00Ew\x00\x00\x00\xef\xb4\xc8\xd0\xff\xda\xb1vents\xd9\xc5H\xd4\x91\xfdN_]\x16\xe4\xa9C\xd2\x86Qn\xefS\x80\x11J\xfb4\x14\x86 4\x95\x9e\xfc\xc1\a\xcb \x95N\xe9\xa4j\xd2\x1f^\xb0\xb2>\xa3\xc9\xb7$\x11`t\x03: \x8b\xa4\x05\xf2?E\xdb+{t\xb8\xf7\xab\x8b\x100#', 0x26e1, 0x0) ioctl$PERF_EVENT_IOC_PAUSE_OUTPUT(r1, 0x40086602, 0x400007) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000280)='./cgroup/syz0\x00', 0x1ff) openat$smack_thread_current(0xffffffffffffff9c, &(0x7f0000000240)='/proc/thread-self/attr/current\x00', 0x2, 0x0) write$cgroup_subtree(r1, &(0x7f0000000100)=ANY=[], 0xff4a) write$cgroup_subtree(r2, &(0x7f0000000000)=ANY=[], 0x20032600) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a0f, 0x1700) accept$inet(0xffffffffffffffff, &(0x7f0000000040)={0x2, 0x0, @local}, &(0x7f0000000080)=0x10) ioctl$TCSETAF(r0, 0x5408, &(0x7f0000000040)={0x2}) ioctl$EXT4_IOC_GROUP_ADD(r0, 0x40286608, &(0x7f0000000000)={0x3, 0x7000000, 0x400, 0x100000000, 0x0, 0x8}) r3 = fcntl$dupfd(r0, 0x406, r0) ioctl$EVIOCGVERSION(r3, 0x80044501, &(0x7f0000000200)=""/31) write$binfmt_misc(r0, &(0x7f0000000080)={'syz1', "80fa25cdc862d216160cfa92845a3916e38a409a159c03f1889971d3e5144a8d08de78c4b1fbee457437261d7668b1c0f582647ad4134a05358d4309a71a702002329e024cac95642e761bb842bc1056bd6bf12c47697a649a026bd8ee1f685089941469b1ddfeddf32b392f0ff07652a3bce0770bc3bb70862845a65054cecb191e80b825d740fe6b40450359757032425dfdee92aec36ce4b468d50adc745c522cc4af2ac6e7f6a95f0edd70b09caa95fcc7143cf46b74db8bc17fa7c89f"}, 0xc3) [ 341.111995] binder: 10968:10970 ioctl c0306201 0 returned -14 [ 341.151428] binder: 10968:10970 BC_REQUEST_DEATH_NOTIFICATION invalid ref 3468 14:03:54 executing program 1: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSPTLCK(r0, 0x40045431, &(0x7f0000000180)) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) socket(0x200000000000011, 0x4000000000080002, 0x0) bind$packet(0xffffffffffffffff, 0x0, 0x0) sendmmsg(0xffffffffffffffff, &(0x7f0000007880)=[{{&(0x7f00000001c0)=@l2={0x1f, 0xbf53, {0x9, 0x7, 0xfffffffffffffdd5, 0x1ff, 0x2, 0x4}, 0x0, 0x7}, 0x80, 0x0}}, {{0x0, 0x0, &(0x7f0000007780)}}], 0x2, 0x4048851) syz_open_procfs(0x0, 0x0) ioctl$LOOP_SET_BLOCK_SIZE(0xffffffffffffffff, 0x4c09, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) openat$smack_thread_current(0xffffffffffffff9c, &(0x7f0000000240)='/proc/thread-self/attr/current\x00', 0x2, 0x0) write$cgroup_subtree(r1, &(0x7f0000000000)=ANY=[], 0x20032600) ioctl$TCSETAF(r0, 0x5408, &(0x7f0000000040)={0x2}) ioctl$EXT4_IOC_GROUP_ADD(r0, 0x40286608, &(0x7f0000000000)={0x3, 0x7000000, 0x400, 0x100000000, 0x0, 0x8}) ioctl$EVIOCGVERSION(0xffffffffffffffff, 0x80044501, &(0x7f0000000200)=""/31) 14:03:54 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=ANY=[@ANYBLOB="0e630c408c0d0000"], 0x0, 0x0, 0x0}) [ 341.216863] binder: 10983:10989 ioctl c0306201 0 returned -14 [ 341.246074] binder: 10983:10989 BC_REQUEST_DEATH_NOTIFICATION invalid ref 3468 14:03:54 executing program 5: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSPTLCK(r0, 0x40045431, &(0x7f0000000180)) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) socket(0x200000000000011, 0x4000000000080002, 0x0) bind$packet(0xffffffffffffffff, 0x0, 0x0) sendmmsg(0xffffffffffffffff, &(0x7f0000007880)=[{{&(0x7f00000001c0)=@l2={0x1f, 0xbf53, {0x9, 0x7, 0xfffffffffffffdd5, 0x1ff, 0x2, 0x4}, 0x0, 0x7}, 0x80, 0x0}}, {{0x0, 0x0, &(0x7f0000007780)}}], 0x2, 0x4048851) syz_open_procfs(0x0, 0x0) ioctl$LOOP_SET_BLOCK_SIZE(0xffffffffffffffff, 0x4c09, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$cgroup_int(0xffffffffffffffff, 0x0, 0x2, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) openat$smack_thread_current(0xffffffffffffff9c, &(0x7f0000000240)='/proc/thread-self/attr/current\x00', 0x2, 0x0) write$cgroup_subtree(r1, &(0x7f0000000000)=ANY=[], 0x20032600) ioctl$TCSETAF(r0, 0x5408, &(0x7f0000000040)={0x2}) ioctl$EXT4_IOC_GROUP_ADD(r0, 0x40286608, &(0x7f0000000000)={0x3, 0x7000000, 0x400, 0x100000000, 0x0, 0x8}) ioctl$EVIOCGVERSION(0xffffffffffffffff, 0x80044501, &(0x7f0000000200)=""/31) 14:03:54 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=ANY=[@ANYBLOB="0e630c408c0d0000"], 0x0, 0x0, 0x0}) 14:03:54 executing program 1: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSPTLCK(r0, 0x40045431, &(0x7f0000000180)) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) socket(0x200000000000011, 0x4000000000080002, 0x0) bind$packet(0xffffffffffffffff, 0x0, 0x0) sendmmsg(0xffffffffffffffff, &(0x7f0000007880)=[{{&(0x7f00000001c0)=@l2={0x1f, 0xbf53, {0x9, 0x7, 0xfffffffffffffdd5, 0x1ff, 0x2, 0x4}, 0x0, 0x7}, 0x80, 0x0}}, {{0x0, 0x0, &(0x7f0000007780)}}], 0x2, 0x4048851) syz_open_procfs(0x0, 0x0) ioctl$LOOP_SET_BLOCK_SIZE(0xffffffffffffffff, 0x4c09, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) openat$smack_thread_current(0xffffffffffffff9c, &(0x7f0000000240)='/proc/thread-self/attr/current\x00', 0x2, 0x0) write$cgroup_subtree(r1, &(0x7f0000000000)=ANY=[], 0x20032600) ioctl$TCSETAF(r0, 0x5408, &(0x7f0000000040)={0x2}) ioctl$EXT4_IOC_GROUP_ADD(r0, 0x40286608, &(0x7f0000000000)={0x3, 0x7000000, 0x400, 0x100000000, 0x0, 0x8}) ioctl$EVIOCGVERSION(0xffffffffffffffff, 0x80044501, &(0x7f0000000200)=""/31) 14:03:54 executing program 3: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSPTLCK(r0, 0x40045431, &(0x7f0000000180)) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) socket(0x200000000000011, 0x4000000000080002, 0x0) bind$packet(0xffffffffffffffff, 0x0, 0x0) sendmmsg(0xffffffffffffffff, &(0x7f0000007880)=[{{&(0x7f00000001c0)=@l2={0x1f, 0xbf53, {0x9, 0x7, 0xfffffffffffffdd5, 0x1ff, 0x2, 0x4}, 0x0, 0x7}, 0x80, 0x0}}, {{0x0, 0x0, &(0x7f0000007780)}}], 0x2, 0x4048851) setsockopt$packet_int(0xffffffffffffffff, 0x107, 0x0, 0x0, 0x0) syz_open_procfs(0x0, 0x0) ioctl$LOOP_SET_BLOCK_SIZE(0xffffffffffffffff, 0x4c09, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$cgroup_int(0xffffffffffffffff, 0x0, 0x2, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='\x89\x00\x00\x00\x00Ew\x00\x00\x00\xef\xb4\xc8\xd0\xff\xda\xb1vents\xd9\xc5H\xd4\x91\xfdN_]\x16\xe4\xa9C\xd2\x86Qn\xefS\x80\x11J\xfb4\x14\x86 4\x95\x9e\xfc\xc1\a\xcb \x95N\xe9\xa4j\xd2\x1f^\xb0\xb2>\xa3\xc9\xb7$\x11`t\x03: \x8b\xa4\x05\xf2?E\xdb+{t\xb8\xf7\xab\x8b\x100#', 0x26e1, 0x0) ioctl$PERF_EVENT_IOC_PAUSE_OUTPUT(r1, 0x40086602, 0x400007) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000280)='./cgroup/syz0\x00', 0x1ff) openat$smack_thread_current(0xffffffffffffff9c, &(0x7f0000000240)='/proc/thread-self/attr/current\x00', 0x2, 0x0) write$cgroup_subtree(r1, &(0x7f0000000100)=ANY=[], 0xff4a) write$cgroup_subtree(r2, &(0x7f0000000000)=ANY=[], 0x20032600) accept$inet(0xffffffffffffffff, &(0x7f0000000040)={0x2, 0x0, @local}, &(0x7f0000000080)=0x10) ioctl$TCSETAF(r0, 0x5408, &(0x7f0000000040)={0x2}) ioctl$EXT4_IOC_GROUP_ADD(r0, 0x40286608, &(0x7f0000000000)={0x3, 0x7000000, 0x400, 0x100000000, 0x0, 0x8}) r3 = fcntl$dupfd(r0, 0x406, r0) ioctl$EVIOCGVERSION(r3, 0x80044501, &(0x7f0000000200)=""/31) write$binfmt_misc(r0, &(0x7f0000000080)={'syz1', "80fa25cdc862d216160cfa92845a3916e38a409a159c03f1889971d3e5144a8d08de78c4b1fbee457437261d7668b1c0f582647ad4134a05358d4309a71a702002329e024cac95642e761bb842bc1056bd6bf12c47697a649a026bd8ee1f685089941469b1ddfeddf32b392f0ff07652a3bce0770bc3bb70862845a65054cecb191e80b825d740fe6b40450359757032425dfdee92aec36ce4b468d50adc745c522cc4af2ac6e7f6a95f0edd70b09caa95fcc7143cf46b74db8bc17fa7c89f"}, 0xc3) 14:03:54 executing program 0: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSPTLCK(r0, 0x40045431, &(0x7f0000000180)) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) socket(0x200000000000011, 0x4000000000080002, 0x0) bind$packet(0xffffffffffffffff, 0x0, 0x0) sendmmsg(0xffffffffffffffff, &(0x7f0000007880)=[{{&(0x7f00000001c0)=@l2={0x1f, 0xbf53, {0x9, 0x7, 0xfffffffffffffdd5, 0x1ff, 0x2, 0x4}, 0x0, 0x7}, 0x80, 0x0}}, {{0x0, 0x0, 0x0}}], 0x2, 0x4048851) setsockopt$packet_int(0xffffffffffffffff, 0x107, 0x0, 0x0, 0x0) syz_open_procfs(0x0, 0x0) ioctl$LOOP_SET_BLOCK_SIZE(0xffffffffffffffff, 0x4c09, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$cgroup_int(0xffffffffffffffff, 0x0, 0x2, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='\x89\x00\x00\x00\x00Ew\x00\x00\x00\xef\xb4\xc8\xd0\xff\xda\xb1vents\xd9\xc5H\xd4\x91\xfdN_]\x16\xe4\xa9C\xd2\x86Qn\xefS\x80\x11J\xfb4\x14\x86 4\x95\x9e\xfc\xc1\a\xcb \x95N\xe9\xa4j\xd2\x1f^\xb0\xb2>\xa3\xc9\xb7$\x11`t\x03: \x8b\xa4\x05\xf2?E\xdb+{t\xb8\xf7\xab\x8b\x100#', 0x26e1, 0x0) ioctl$PERF_EVENT_IOC_PAUSE_OUTPUT(r1, 0x40086602, 0x400007) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000280)='./cgroup/syz0\x00', 0x1ff) openat$smack_thread_current(0xffffffffffffff9c, &(0x7f0000000240)='/proc/thread-self/attr/current\x00', 0x2, 0x0) write$cgroup_subtree(r1, &(0x7f0000000100)=ANY=[], 0xff4a) write$cgroup_subtree(r2, &(0x7f0000000000)=ANY=[], 0x20032600) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a0f, 0x1700) accept$inet(0xffffffffffffffff, &(0x7f0000000040)={0x2, 0x0, @local}, &(0x7f0000000080)=0x10) ioctl$TCSETAF(r0, 0x5408, &(0x7f0000000040)={0x2}) ioctl$EXT4_IOC_GROUP_ADD(r0, 0x40286608, &(0x7f0000000000)={0x3, 0x7000000, 0x400, 0x100000000, 0x0, 0x8}) r3 = fcntl$dupfd(r0, 0x406, r0) ioctl$EVIOCGVERSION(r3, 0x80044501, &(0x7f0000000200)=""/31) write$binfmt_misc(r0, &(0x7f0000000080)={'syz1', "80fa25cdc862d216160cfa92845a3916e38a409a159c03f1889971d3e5144a8d08de78c4b1fbee457437261d7668b1c0f582647ad4134a05358d4309a71a702002329e024cac95642e761bb842bc1056bd6bf12c47697a649a026bd8ee1f685089941469b1ddfeddf32b392f0ff07652a3bce0770bc3bb70862845a65054cecb191e80b825d740fe6b40450359757032425dfdee92aec36ce4b468d50adc745c522cc4af2ac6e7f6a95f0edd70b09caa95fcc7143cf46b74db8bc17fa7c89f"}, 0xc3) [ 341.272118] binder: 10995:10997 ioctl c0306201 0 returned -14 [ 341.279657] binder: 10995:10997 BC_REQUEST_DEATH_NOTIFICATION invalid ref 3468 14:03:54 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSPTLCK(r0, 0x40045431, &(0x7f0000000180)) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) socket(0x200000000000011, 0x4000000000080002, 0x0) bind$packet(0xffffffffffffffff, 0x0, 0x0) sendmmsg(0xffffffffffffffff, &(0x7f0000007880)=[{{&(0x7f00000001c0)=@l2={0x1f, 0xbf53, {0x9, 0x7, 0xfffffffffffffdd5, 0x1ff, 0x2, 0x4}, 0x0, 0x7}, 0x80, 0x0}}, {{0x0, 0x0, 0x0}}], 0x2, 0x4048851) setsockopt$packet_int(0xffffffffffffffff, 0x107, 0x0, 0x0, 0x0) syz_open_procfs(0x0, 0x0) ioctl$LOOP_SET_BLOCK_SIZE(0xffffffffffffffff, 0x4c09, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$cgroup_int(0xffffffffffffffff, 0x0, 0x2, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='\x89\x00\x00\x00\x00Ew\x00\x00\x00\xef\xb4\xc8\xd0\xff\xda\xb1vents\xd9\xc5H\xd4\x91\xfdN_]\x16\xe4\xa9C\xd2\x86Qn\xefS\x80\x11J\xfb4\x14\x86 4\x95\x9e\xfc\xc1\a\xcb \x95N\xe9\xa4j\xd2\x1f^\xb0\xb2>\xa3\xc9\xb7$\x11`t\x03: \x8b\xa4\x05\xf2?E\xdb+{t\xb8\xf7\xab\x8b\x100#', 0x26e1, 0x0) ioctl$PERF_EVENT_IOC_PAUSE_OUTPUT(r1, 0x40086602, 0x400007) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000280)='./cgroup/syz0\x00', 0x1ff) openat$smack_thread_current(0xffffffffffffff9c, &(0x7f0000000240)='/proc/thread-self/attr/current\x00', 0x2, 0x0) write$cgroup_subtree(r1, &(0x7f0000000100)=ANY=[], 0xff4a) write$cgroup_subtree(r2, &(0x7f0000000000)=ANY=[], 0x20032600) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a0f, 0x1700) accept$inet(0xffffffffffffffff, &(0x7f0000000040)={0x2, 0x0, @local}, &(0x7f0000000080)=0x10) ioctl$TCSETAF(r0, 0x5408, &(0x7f0000000040)={0x2}) ioctl$EXT4_IOC_GROUP_ADD(r0, 0x40286608, &(0x7f0000000000)={0x3, 0x7000000, 0x400, 0x100000000, 0x0, 0x8}) r3 = fcntl$dupfd(r0, 0x406, r0) ioctl$EVIOCGVERSION(r3, 0x80044501, &(0x7f0000000200)=""/31) write$binfmt_misc(r0, &(0x7f0000000080)={'syz1', "80fa25cdc862d216160cfa92845a3916e38a409a159c03f1889971d3e5144a8d08de78c4b1fbee457437261d7668b1c0f582647ad4134a05358d4309a71a702002329e024cac95642e761bb842bc1056bd6bf12c47697a649a026bd8ee1f685089941469b1ddfeddf32b392f0ff07652a3bce0770bc3bb70862845a65054cecb191e80b825d740fe6b40450359757032425dfdee92aec36ce4b468d50adc745c522cc4af2ac6e7f6a95f0edd70b09caa95fcc7143cf46b74db8bc17fa7c89f"}, 0xc3) 14:03:54 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=ANY=[@ANYBLOB="0e630c408c0d0000"], 0x0, 0x0, 0x0}) [ 341.340776] binder: 11000:11006 BC_REQUEST_DEATH_NOTIFICATION invalid ref 3468 14:03:54 executing program 5: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSPTLCK(r0, 0x40045431, &(0x7f0000000180)) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) socket(0x200000000000011, 0x4000000000080002, 0x0) bind$packet(0xffffffffffffffff, 0x0, 0x0) sendmmsg(0xffffffffffffffff, &(0x7f0000007880)=[{{&(0x7f00000001c0)=@l2={0x1f, 0xbf53, {0x9, 0x7, 0xfffffffffffffdd5, 0x1ff, 0x2, 0x4}, 0x0, 0x7}, 0x80, 0x0}}, {{0x0, 0x0, 0x0}}], 0x2, 0x4048851) setsockopt$packet_int(0xffffffffffffffff, 0x107, 0x0, 0x0, 0x0) syz_open_procfs(0x0, 0x0) ioctl$LOOP_SET_BLOCK_SIZE(0xffffffffffffffff, 0x4c09, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$cgroup_int(0xffffffffffffffff, 0x0, 0x2, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='\x89\x00\x00\x00\x00Ew\x00\x00\x00\xef\xb4\xc8\xd0\xff\xda\xb1vents\xd9\xc5H\xd4\x91\xfdN_]\x16\xe4\xa9C\xd2\x86Qn\xefS\x80\x11J\xfb4\x14\x86 4\x95\x9e\xfc\xc1\a\xcb \x95N\xe9\xa4j\xd2\x1f^\xb0\xb2>\xa3\xc9\xb7$\x11`t\x03: \x8b\xa4\x05\xf2?E\xdb+{t\xb8\xf7\xab\x8b\x100#', 0x26e1, 0x0) ioctl$PERF_EVENT_IOC_PAUSE_OUTPUT(r1, 0x40086602, 0x400007) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000280)='./cgroup/syz0\x00', 0x1ff) openat$smack_thread_current(0xffffffffffffff9c, &(0x7f0000000240)='/proc/thread-self/attr/current\x00', 0x2, 0x0) write$cgroup_subtree(r1, &(0x7f0000000100)=ANY=[], 0xff4a) write$cgroup_subtree(r2, &(0x7f0000000000)=ANY=[], 0x20032600) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a0f, 0x1700) accept$inet(0xffffffffffffffff, &(0x7f0000000040)={0x2, 0x0, @local}, &(0x7f0000000080)=0x10) ioctl$TCSETAF(r0, 0x5408, &(0x7f0000000040)={0x2}) ioctl$EXT4_IOC_GROUP_ADD(r0, 0x40286608, &(0x7f0000000000)={0x3, 0x7000000, 0x400, 0x100000000, 0x0, 0x8}) r3 = fcntl$dupfd(r0, 0x406, r0) ioctl$EVIOCGVERSION(r3, 0x80044501, &(0x7f0000000200)=""/31) write$binfmt_misc(r0, &(0x7f0000000080)={'syz1', "80fa25cdc862d216160cfa92845a3916e38a409a159c03f1889971d3e5144a8d08de78c4b1fbee457437261d7668b1c0f582647ad4134a05358d4309a71a702002329e024cac95642e761bb842bc1056bd6bf12c47697a649a026bd8ee1f685089941469b1ddfeddf32b392f0ff07652a3bce0770bc3bb70862845a65054cecb191e80b825d740fe6b40450359757032425dfdee92aec36ce4b468d50adc745c522cc4af2ac6e7f6a95f0edd70b09caa95fcc7143cf46b74db8bc17fa7c89f"}, 0xc3) 14:03:54 executing program 1: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSPTLCK(r0, 0x40045431, &(0x7f0000000180)) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) socket(0x200000000000011, 0x4000000000080002, 0x0) bind$packet(0xffffffffffffffff, 0x0, 0x0) sendmmsg(0xffffffffffffffff, &(0x7f0000007880)=[{{&(0x7f00000001c0)=@l2={0x1f, 0xbf53, {0x9, 0x7, 0xfffffffffffffdd5, 0x1ff, 0x2, 0x4}, 0x0, 0x7}, 0x80, 0x0}}, {{0x0, 0x0, &(0x7f0000007780)}}], 0x2, 0x4048851) syz_open_procfs(0x0, 0x0) ioctl$LOOP_SET_BLOCK_SIZE(0xffffffffffffffff, 0x4c09, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) openat$smack_thread_current(0xffffffffffffff9c, &(0x7f0000000240)='/proc/thread-self/attr/current\x00', 0x2, 0x0) write$cgroup_subtree(r1, &(0x7f0000000000)=ANY=[], 0x20032600) ioctl$TCSETAF(r0, 0x5408, &(0x7f0000000040)={0x2}) ioctl$EXT4_IOC_GROUP_ADD(r0, 0x40286608, &(0x7f0000000000)={0x3, 0x7000000, 0x400, 0x100000000, 0x0, 0x8}) ioctl$EVIOCGVERSION(0xffffffffffffffff, 0x80044501, &(0x7f0000000200)=""/31) 14:03:55 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=ANY=[@ANYBLOB="0e630c408c0d0000"], 0x0, 0x0, 0x0}) [ 341.436153] binder: 11017:11018 BC_REQUEST_DEATH_NOTIFICATION invalid ref 3468 14:03:55 executing program 3: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSPTLCK(r0, 0x40045431, &(0x7f0000000180)) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) socket(0x200000000000011, 0x4000000000080002, 0x0) bind$packet(0xffffffffffffffff, 0x0, 0x0) sendmmsg(0xffffffffffffffff, &(0x7f0000007880)=[{{&(0x7f00000001c0)=@l2={0x1f, 0xbf53, {0x9, 0x7, 0xfffffffffffffdd5, 0x1ff, 0x2, 0x4}, 0x0, 0x7}, 0x80, 0x0}}, {{0x0, 0x0, &(0x7f0000007780)}}], 0x2, 0x4048851) syz_open_procfs(0x0, 0x0) ioctl$LOOP_SET_BLOCK_SIZE(0xffffffffffffffff, 0x4c09, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$cgroup_int(0xffffffffffffffff, 0x0, 0x2, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='\x89\x00\x00\x00\x00Ew\x00\x00\x00\xef\xb4\xc8\xd0\xff\xda\xb1vents\xd9\xc5H\xd4\x91\xfdN_]\x16\xe4\xa9C\xd2\x86Qn\xefS\x80\x11J\xfb4\x14\x86 4\x95\x9e\xfc\xc1\a\xcb \x95N\xe9\xa4j\xd2\x1f^\xb0\xb2>\xa3\xc9\xb7$\x11`t\x03: \x8b\xa4\x05\xf2?E\xdb+{t\xb8\xf7\xab\x8b\x100#', 0x26e1, 0x0) ioctl$PERF_EVENT_IOC_PAUSE_OUTPUT(r1, 0x40086602, 0x400007) openat$smack_thread_current(0xffffffffffffff9c, &(0x7f0000000240)='/proc/thread-self/attr/current\x00', 0x2, 0x0) write$cgroup_subtree(0xffffffffffffffff, &(0x7f0000000000)=ANY=[], 0x20032600) ioctl$TCSETAF(r0, 0x5408, &(0x7f0000000040)={0x2}) ioctl$EXT4_IOC_GROUP_ADD(r0, 0x40286608, &(0x7f0000000000)={0x3, 0x7000000, 0x400, 0x100000000, 0x0, 0x8}) ioctl$EVIOCGVERSION(0xffffffffffffffff, 0x80044501, &(0x7f0000000200)=""/31) 14:03:55 executing program 0: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSPTLCK(r0, 0x40045431, &(0x7f0000000180)) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) socket(0x200000000000011, 0x4000000000080002, 0x0) bind$packet(0xffffffffffffffff, 0x0, 0x0) sendmmsg(0xffffffffffffffff, &(0x7f0000007880)=[{{&(0x7f00000001c0)=@l2={0x1f, 0xbf53, {0x9, 0x7, 0xfffffffffffffdd5, 0x1ff, 0x2, 0x4}, 0x0, 0x7}, 0x80, 0x0}}, {{0x0, 0x0, &(0x7f0000007780)}}], 0x2, 0x4048851) setsockopt$packet_int(0xffffffffffffffff, 0x107, 0x0, 0x0, 0x0) syz_open_procfs(0x0, 0x0) ioctl$LOOP_SET_BLOCK_SIZE(0xffffffffffffffff, 0x4c09, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$cgroup_int(0xffffffffffffffff, 0x0, 0x2, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='\x89\x00\x00\x00\x00Ew\x00\x00\x00\xef\xb4\xc8\xd0\xff\xda\xb1vents\xd9\xc5H\xd4\x91\xfdN_]\x16\xe4\xa9C\xd2\x86Qn\xefS\x80\x11J\xfb4\x14\x86 4\x95\x9e\xfc\xc1\a\xcb \x95N\xe9\xa4j\xd2\x1f^\xb0\xb2>\xa3\xc9\xb7$\x11`t\x03: \x8b\xa4\x05\xf2?E\xdb+{t\xb8\xf7\xab\x8b\x100#', 0x26e1, 0x0) ioctl$PERF_EVENT_IOC_PAUSE_OUTPUT(r1, 0x40086602, 0x400007) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000280)='./cgroup/syz0\x00', 0x1ff) openat$smack_thread_current(0xffffffffffffff9c, &(0x7f0000000240)='/proc/thread-self/attr/current\x00', 0x2, 0x0) write$cgroup_subtree(r1, &(0x7f0000000100)=ANY=[], 0xff4a) write$cgroup_subtree(r2, &(0x7f0000000000)=ANY=[], 0x20032600) accept$inet(0xffffffffffffffff, &(0x7f0000000040)={0x2, 0x0, @local}, &(0x7f0000000080)=0x10) ioctl$TCSETAF(r0, 0x5408, &(0x7f0000000040)={0x2}) ioctl$EXT4_IOC_GROUP_ADD(r0, 0x40286608, &(0x7f0000000000)={0x3, 0x7000000, 0x400, 0x100000000, 0x0, 0x8}) r3 = fcntl$dupfd(r0, 0x406, r0) ioctl$EVIOCGVERSION(r3, 0x80044501, &(0x7f0000000200)=""/31) write$binfmt_misc(r0, &(0x7f0000000080)={'syz1', "80fa25cdc862d216160cfa92845a3916e38a409a159c03f1889971d3e5144a8d08de78c4b1fbee457437261d7668b1c0f582647ad4134a05358d4309a71a702002329e024cac95642e761bb842bc1056bd6bf12c47697a649a026bd8ee1f685089941469b1ddfeddf32b392f0ff07652a3bce0770bc3bb70862845a65054cecb191e80b825d740fe6b40450359757032425dfdee92aec36ce4b468d50adc745c522cc4af2ac6e7f6a95f0edd70b09caa95fcc7143cf46b74db8bc17fa7c89f"}, 0xc3) 14:03:55 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSPTLCK(r0, 0x40045431, &(0x7f0000000180)) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) socket(0x200000000000011, 0x4000000000080002, 0x0) bind$packet(0xffffffffffffffff, 0x0, 0x0) sendmmsg(0xffffffffffffffff, &(0x7f0000007880)=[{{0x0, 0x0, &(0x7f0000007780)}}], 0x1, 0x4048851) setsockopt$packet_int(0xffffffffffffffff, 0x107, 0x0, 0x0, 0x0) syz_open_procfs(0x0, 0x0) ioctl$LOOP_SET_BLOCK_SIZE(0xffffffffffffffff, 0x4c09, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$cgroup_int(0xffffffffffffffff, 0x0, 0x2, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='\x89\x00\x00\x00\x00Ew\x00\x00\x00\xef\xb4\xc8\xd0\xff\xda\xb1vents\xd9\xc5H\xd4\x91\xfdN_]\x16\xe4\xa9C\xd2\x86Qn\xefS\x80\x11J\xfb4\x14\x86 4\x95\x9e\xfc\xc1\a\xcb \x95N\xe9\xa4j\xd2\x1f^\xb0\xb2>\xa3\xc9\xb7$\x11`t\x03: \x8b\xa4\x05\xf2?E\xdb+{t\xb8\xf7\xab\x8b\x100#', 0x26e1, 0x0) ioctl$PERF_EVENT_IOC_PAUSE_OUTPUT(r1, 0x40086602, 0x400007) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000280)='./cgroup/syz0\x00', 0x1ff) openat$smack_thread_current(0xffffffffffffff9c, &(0x7f0000000240)='/proc/thread-self/attr/current\x00', 0x2, 0x0) write$cgroup_subtree(r1, &(0x7f0000000100)=ANY=[], 0xff4a) write$cgroup_subtree(r2, &(0x7f0000000000)=ANY=[], 0x20032600) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a0f, 0x1700) accept$inet(0xffffffffffffffff, &(0x7f0000000040)={0x2, 0x0, @local}, &(0x7f0000000080)=0x10) ioctl$TCSETAF(r0, 0x5408, &(0x7f0000000040)={0x2}) ioctl$EXT4_IOC_GROUP_ADD(r0, 0x40286608, &(0x7f0000000000)={0x3, 0x7000000, 0x400, 0x100000000, 0x0, 0x8}) r3 = fcntl$dupfd(r0, 0x406, r0) ioctl$EVIOCGVERSION(r3, 0x80044501, &(0x7f0000000200)=""/31) write$binfmt_misc(r0, &(0x7f0000000080)={'syz1', "80fa25cdc862d216160cfa92845a3916e38a409a159c03f1889971d3e5144a8d08de78c4b1fbee457437261d7668b1c0f582647ad4134a05358d4309a71a702002329e024cac95642e761bb842bc1056bd6bf12c47697a649a026bd8ee1f685089941469b1ddfeddf32b392f0ff07652a3bce0770bc3bb70862845a65054cecb191e80b825d740fe6b40450359757032425dfdee92aec36ce4b468d50adc745c522cc4af2ac6e7f6a95f0edd70b09caa95fcc7143cf46b74db8bc17fa7c89f"}, 0xc3) 14:03:55 executing program 1: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSPTLCK(r0, 0x40045431, &(0x7f0000000180)) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) socket(0x200000000000011, 0x4000000000080002, 0x0) bind$packet(0xffffffffffffffff, 0x0, 0x0) sendmmsg(0xffffffffffffffff, &(0x7f0000007880)=[{{&(0x7f00000001c0)=@l2={0x1f, 0xbf53, {0x9, 0x7, 0xfffffffffffffdd5, 0x1ff, 0x2, 0x4}, 0x0, 0x7}, 0x80, 0x0}}, {{0x0, 0x0, &(0x7f0000007780)}}], 0x2, 0x4048851) syz_open_procfs(0x0, 0x0) ioctl$LOOP_SET_BLOCK_SIZE(0xffffffffffffffff, 0x4c09, 0x0) openat$cgroup_int(0xffffffffffffffff, 0x0, 0x2, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) openat$smack_thread_current(0xffffffffffffff9c, &(0x7f0000000240)='/proc/thread-self/attr/current\x00', 0x2, 0x0) write$cgroup_subtree(r1, &(0x7f0000000000)=ANY=[], 0x20032600) ioctl$TCSETAF(r0, 0x5408, &(0x7f0000000040)={0x2}) ioctl$EXT4_IOC_GROUP_ADD(r0, 0x40286608, &(0x7f0000000000)={0x3, 0x7000000, 0x400, 0x100000000, 0x0, 0x8}) ioctl$EVIOCGVERSION(0xffffffffffffffff, 0x80044501, &(0x7f0000000200)=""/31) [ 341.493367] binder: 11025:11027 BC_REQUEST_DEATH_NOTIFICATION invalid ref 3468 14:03:55 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x0, 0x0, &(0x7f00000001c0), 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=ANY=[@ANYBLOB="0e630c408c0d0000"], 0x0, 0x0, 0x0}) 14:03:55 executing program 5: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSPTLCK(r0, 0x40045431, &(0x7f0000000180)) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) socket(0x200000000000011, 0x4000000000080002, 0x0) bind$packet(0xffffffffffffffff, 0x0, 0x0) sendmmsg(0xffffffffffffffff, &(0x7f0000007880)=[{{&(0x7f00000001c0)=@l2={0x1f, 0xbf53, {0x9, 0x7, 0xfffffffffffffdd5, 0x1ff, 0x2, 0x4}, 0x0, 0x7}, 0x80, 0x0}}, {{0x0, 0x0, &(0x7f0000007780)}}], 0x2, 0x4048851) setsockopt$packet_int(0xffffffffffffffff, 0x107, 0x0, 0x0, 0x0) syz_open_procfs(0x0, 0x0) ioctl$LOOP_SET_BLOCK_SIZE(0xffffffffffffffff, 0x4c09, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$cgroup_int(0xffffffffffffffff, 0x0, 0x2, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='\x89\x00\x00\x00\x00Ew\x00\x00\x00\xef\xb4\xc8\xd0\xff\xda\xb1vents\xd9\xc5H\xd4\x91\xfdN_]\x16\xe4\xa9C\xd2\x86Qn\xefS\x80\x11J\xfb4\x14\x86 4\x95\x9e\xfc\xc1\a\xcb \x95N\xe9\xa4j\xd2\x1f^\xb0\xb2>\xa3\xc9\xb7$\x11`t\x03: \x8b\xa4\x05\xf2?E\xdb+{t\xb8\xf7\xab\x8b\x100#', 0x26e1, 0x0) ioctl$PERF_EVENT_IOC_PAUSE_OUTPUT(r1, 0x40086602, 0x400007) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000280)='./cgroup/syz0\x00', 0x1ff) openat$smack_thread_current(0xffffffffffffff9c, &(0x7f0000000240)='/proc/thread-self/attr/current\x00', 0x2, 0x0) write$cgroup_subtree(r1, &(0x7f0000000100)=ANY=[], 0xff4a) write$cgroup_subtree(r2, &(0x7f0000000000)=ANY=[], 0x20032600) accept$inet(0xffffffffffffffff, &(0x7f0000000040)={0x2, 0x0, @local}, &(0x7f0000000080)=0x10) ioctl$TCSETAF(r0, 0x5408, &(0x7f0000000040)={0x2}) ioctl$EXT4_IOC_GROUP_ADD(r0, 0x40286608, &(0x7f0000000000)={0x3, 0x7000000, 0x400, 0x100000000, 0x0, 0x8}) r3 = fcntl$dupfd(r0, 0x406, r0) ioctl$EVIOCGVERSION(r3, 0x80044501, &(0x7f0000000200)=""/31) write$binfmt_misc(r0, &(0x7f0000000080)={'syz1', "80fa25cdc862d216160cfa92845a3916e38a409a159c03f1889971d3e5144a8d08de78c4b1fbee457437261d7668b1c0f582647ad4134a05358d4309a71a702002329e024cac95642e761bb842bc1056bd6bf12c47697a649a026bd8ee1f685089941469b1ddfeddf32b392f0ff07652a3bce0770bc3bb70862845a65054cecb191e80b825d740fe6b40450359757032425dfdee92aec36ce4b468d50adc745c522cc4af2ac6e7f6a95f0edd70b09caa95fcc7143cf46b74db8bc17fa7c89f"}, 0xc3) 14:03:55 executing program 1: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSPTLCK(r0, 0x40045431, &(0x7f0000000180)) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) socket(0x200000000000011, 0x4000000000080002, 0x0) bind$packet(0xffffffffffffffff, 0x0, 0x0) sendmmsg(0xffffffffffffffff, &(0x7f0000007880)=[{{&(0x7f00000001c0)=@l2={0x1f, 0xbf53, {0x9, 0x7, 0xfffffffffffffdd5, 0x1ff, 0x2, 0x4}, 0x0, 0x7}, 0x80, 0x0}}, {{0x0, 0x0, &(0x7f0000007780)}}], 0x2, 0x4048851) syz_open_procfs(0x0, 0x0) ioctl$LOOP_SET_BLOCK_SIZE(0xffffffffffffffff, 0x4c09, 0x0) openat$cgroup_int(0xffffffffffffffff, 0x0, 0x2, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) openat$smack_thread_current(0xffffffffffffff9c, &(0x7f0000000240)='/proc/thread-self/attr/current\x00', 0x2, 0x0) write$cgroup_subtree(r1, &(0x7f0000000000)=ANY=[], 0x20032600) ioctl$TCSETAF(r0, 0x5408, &(0x7f0000000040)={0x2}) ioctl$EXT4_IOC_GROUP_ADD(r0, 0x40286608, &(0x7f0000000000)={0x3, 0x7000000, 0x400, 0x100000000, 0x0, 0x8}) ioctl$EVIOCGVERSION(0xffffffffffffffff, 0x80044501, &(0x7f0000000200)=""/31) 14:03:55 executing program 3: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSPTLCK(r0, 0x40045431, &(0x7f0000000180)) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) socket(0x200000000000011, 0x4000000000080002, 0x0) bind$packet(0xffffffffffffffff, 0x0, 0x0) sendmmsg(0xffffffffffffffff, &(0x7f0000007880)=[{{&(0x7f00000001c0)=@l2={0x1f, 0xbf53, {0x9, 0x7, 0xfffffffffffffdd5, 0x1ff, 0x2, 0x4}, 0x0, 0x7}, 0x80, 0x0}}, {{0x0, 0x0, &(0x7f0000007780)}}], 0x2, 0x4048851) setsockopt$packet_int(0xffffffffffffffff, 0x107, 0x0, 0x0, 0x0) syz_open_procfs(0x0, 0x0) ioctl$LOOP_SET_BLOCK_SIZE(0xffffffffffffffff, 0x4c09, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$cgroup_int(0xffffffffffffffff, 0x0, 0x2, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='\x89\x00\x00\x00\x00Ew\x00\x00\x00\xef\xb4\xc8\xd0\xff\xda\xb1vents\xd9\xc5H\xd4\x91\xfdN_]\x16\xe4\xa9C\xd2\x86Qn\xefS\x80\x11J\xfb4\x14\x86 4\x95\x9e\xfc\xc1\a\xcb \x95N\xe9\xa4j\xd2\x1f^\xb0\xb2>\xa3\xc9\xb7$\x11`t\x03: \x8b\xa4\x05\xf2?E\xdb+{t\xb8\xf7\xab\x8b\x100#', 0x26e1, 0x0) ioctl$PERF_EVENT_IOC_PAUSE_OUTPUT(r1, 0x40086602, 0x400007) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000280)='./cgroup/syz0\x00', 0x1ff) openat$smack_thread_current(0xffffffffffffff9c, &(0x7f0000000240)='/proc/thread-self/attr/current\x00', 0x2, 0x0) write$cgroup_subtree(r1, &(0x7f0000000100)=ANY=[], 0xff4a) write$cgroup_subtree(r2, &(0x7f0000000000)=ANY=[], 0x20032600) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a0f, 0x1700) ioctl$TCSETAF(r0, 0x5408, &(0x7f0000000040)={0x2}) ioctl$EXT4_IOC_GROUP_ADD(r0, 0x40286608, &(0x7f0000000000)={0x3, 0x7000000, 0x400, 0x100000000, 0x0, 0x8}) r3 = fcntl$dupfd(r0, 0x406, r0) ioctl$EVIOCGVERSION(r3, 0x80044501, &(0x7f0000000200)=""/31) write$binfmt_misc(r0, &(0x7f0000000080)={'syz1', "80fa25cdc862d216160cfa92845a3916e38a409a159c03f1889971d3e5144a8d08de78c4b1fbee457437261d7668b1c0f582647ad4134a05358d4309a71a702002329e024cac95642e761bb842bc1056bd6bf12c47697a649a026bd8ee1f685089941469b1ddfeddf32b392f0ff07652a3bce0770bc3bb70862845a65054cecb191e80b825d740fe6b40450359757032425dfdee92aec36ce4b468d50adc745c522cc4af2ac6e7f6a95f0edd70b09caa95fcc7143cf46b74db8bc17fa7c89f"}, 0xc3) [ 341.592847] binder: 11040:11042 BC_REQUEST_DEATH_NOTIFICATION invalid ref 3468 14:03:55 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x0, 0x0, &(0x7f00000001c0), 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=ANY=[@ANYBLOB="0e630c408c0d0000"], 0x0, 0x0, 0x0}) 14:03:55 executing program 1: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSPTLCK(r0, 0x40045431, &(0x7f0000000180)) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) socket(0x200000000000011, 0x4000000000080002, 0x0) bind$packet(0xffffffffffffffff, 0x0, 0x0) sendmmsg(0xffffffffffffffff, &(0x7f0000007880)=[{{&(0x7f00000001c0)=@l2={0x1f, 0xbf53, {0x9, 0x7, 0xfffffffffffffdd5, 0x1ff, 0x2, 0x4}, 0x0, 0x7}, 0x80, 0x0}}, {{0x0, 0x0, &(0x7f0000007780)}}], 0x2, 0x4048851) syz_open_procfs(0x0, 0x0) ioctl$LOOP_SET_BLOCK_SIZE(0xffffffffffffffff, 0x4c09, 0x0) openat$cgroup_int(0xffffffffffffffff, 0x0, 0x2, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) openat$smack_thread_current(0xffffffffffffff9c, &(0x7f0000000240)='/proc/thread-self/attr/current\x00', 0x2, 0x0) write$cgroup_subtree(r1, &(0x7f0000000000)=ANY=[], 0x20032600) ioctl$TCSETAF(r0, 0x5408, &(0x7f0000000040)={0x2}) ioctl$EXT4_IOC_GROUP_ADD(r0, 0x40286608, &(0x7f0000000000)={0x3, 0x7000000, 0x400, 0x100000000, 0x0, 0x8}) ioctl$EVIOCGVERSION(0xffffffffffffffff, 0x80044501, &(0x7f0000000200)=""/31) 14:03:55 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSPTLCK(r0, 0x40045431, &(0x7f0000000180)) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) socket(0x200000000000011, 0x4000000000080002, 0x0) bind$packet(0xffffffffffffffff, 0x0, 0x0) sendmmsg(0xffffffffffffffff, &(0x7f0000007880)=[{{0x0, 0x0, &(0x7f0000007780)}}], 0x1, 0x4048851) setsockopt$packet_int(0xffffffffffffffff, 0x107, 0x0, 0x0, 0x0) syz_open_procfs(0x0, 0x0) ioctl$LOOP_SET_BLOCK_SIZE(0xffffffffffffffff, 0x4c09, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$cgroup_int(0xffffffffffffffff, 0x0, 0x2, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='\x89\x00\x00\x00\x00Ew\x00\x00\x00\xef\xb4\xc8\xd0\xff\xda\xb1vents\xd9\xc5H\xd4\x91\xfdN_]\x16\xe4\xa9C\xd2\x86Qn\xefS\x80\x11J\xfb4\x14\x86 4\x95\x9e\xfc\xc1\a\xcb \x95N\xe9\xa4j\xd2\x1f^\xb0\xb2>\xa3\xc9\xb7$\x11`t\x03: \x8b\xa4\x05\xf2?E\xdb+{t\xb8\xf7\xab\x8b\x100#', 0x26e1, 0x0) ioctl$PERF_EVENT_IOC_PAUSE_OUTPUT(r1, 0x40086602, 0x400007) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000280)='./cgroup/syz0\x00', 0x1ff) openat$smack_thread_current(0xffffffffffffff9c, &(0x7f0000000240)='/proc/thread-self/attr/current\x00', 0x2, 0x0) write$cgroup_subtree(r1, &(0x7f0000000100)=ANY=[], 0xff4a) write$cgroup_subtree(r2, &(0x7f0000000000)=ANY=[], 0x20032600) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a0f, 0x1700) accept$inet(0xffffffffffffffff, &(0x7f0000000040)={0x2, 0x0, @local}, &(0x7f0000000080)=0x10) ioctl$TCSETAF(r0, 0x5408, &(0x7f0000000040)={0x2}) ioctl$EXT4_IOC_GROUP_ADD(r0, 0x40286608, &(0x7f0000000000)={0x3, 0x7000000, 0x400, 0x100000000, 0x0, 0x8}) r3 = fcntl$dupfd(r0, 0x406, r0) ioctl$EVIOCGVERSION(r3, 0x80044501, &(0x7f0000000200)=""/31) write$binfmt_misc(r0, &(0x7f0000000080)={'syz1', "80fa25cdc862d216160cfa92845a3916e38a409a159c03f1889971d3e5144a8d08de78c4b1fbee457437261d7668b1c0f582647ad4134a05358d4309a71a702002329e024cac95642e761bb842bc1056bd6bf12c47697a649a026bd8ee1f685089941469b1ddfeddf32b392f0ff07652a3bce0770bc3bb70862845a65054cecb191e80b825d740fe6b40450359757032425dfdee92aec36ce4b468d50adc745c522cc4af2ac6e7f6a95f0edd70b09caa95fcc7143cf46b74db8bc17fa7c89f"}, 0xc3) 14:03:55 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x0, 0x0, &(0x7f00000001c0), 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=ANY=[@ANYBLOB="0e630c408c0d0000"], 0x0, 0x0, 0x0}) 14:03:55 executing program 0: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSPTLCK(r0, 0x40045431, &(0x7f0000000180)) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) socket(0x200000000000011, 0x4000000000080002, 0x0) bind$packet(0xffffffffffffffff, 0x0, 0x0) sendmmsg(0xffffffffffffffff, &(0x7f0000007880)=[{{&(0x7f00000001c0)=@l2={0x1f, 0xbf53, {0x9, 0x7, 0xfffffffffffffdd5, 0x1ff, 0x2, 0x4}, 0x0, 0x7}, 0x80, 0x0}}, {{0x0, 0x0, &(0x7f0000007780)}}], 0x2, 0x4048851) setsockopt$packet_int(0xffffffffffffffff, 0x107, 0x0, 0x0, 0x0) syz_open_procfs(0x0, 0x0) ioctl$LOOP_SET_BLOCK_SIZE(0xffffffffffffffff, 0x4c09, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$cgroup_int(0xffffffffffffffff, 0x0, 0x2, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='\x89\x00\x00\x00\x00Ew\x00\x00\x00\xef\xb4\xc8\xd0\xff\xda\xb1vents\xd9\xc5H\xd4\x91\xfdN_]\x16\xe4\xa9C\xd2\x86Qn\xefS\x80\x11J\xfb4\x14\x86 4\x95\x9e\xfc\xc1\a\xcb \x95N\xe9\xa4j\xd2\x1f^\xb0\xb2>\xa3\xc9\xb7$\x11`t\x03: \x8b\xa4\x05\xf2?E\xdb+{t\xb8\xf7\xab\x8b\x100#', 0x26e1, 0x0) ioctl$PERF_EVENT_IOC_PAUSE_OUTPUT(r1, 0x40086602, 0x400007) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000280)='./cgroup/syz0\x00', 0x1ff) openat$smack_thread_current(0xffffffffffffff9c, &(0x7f0000000240)='/proc/thread-self/attr/current\x00', 0x2, 0x0) write$cgroup_subtree(r1, &(0x7f0000000100)=ANY=[], 0xff4a) write$cgroup_subtree(r2, &(0x7f0000000000)=ANY=[], 0x20032600) accept$inet(0xffffffffffffffff, &(0x7f0000000040)={0x2, 0x0, @local}, &(0x7f0000000080)=0x10) ioctl$TCSETAF(r0, 0x5408, &(0x7f0000000040)={0x2}) ioctl$EXT4_IOC_GROUP_ADD(r0, 0x40286608, &(0x7f0000000000)={0x3, 0x7000000, 0x400, 0x100000000, 0x0, 0x8}) r3 = fcntl$dupfd(r0, 0x406, r0) ioctl$EVIOCGVERSION(r3, 0x80044501, &(0x7f0000000200)=""/31) write$binfmt_misc(r0, &(0x7f0000000080)={'syz1', "80fa25cdc862d216160cfa92845a3916e38a409a159c03f1889971d3e5144a8d08de78c4b1fbee457437261d7668b1c0f582647ad4134a05358d4309a71a702002329e024cac95642e761bb842bc1056bd6bf12c47697a649a026bd8ee1f685089941469b1ddfeddf32b392f0ff07652a3bce0770bc3bb70862845a65054cecb191e80b825d740fe6b40450359757032425dfdee92aec36ce4b468d50adc745c522cc4af2ac6e7f6a95f0edd70b09caa95fcc7143cf46b74db8bc17fa7c89f"}, 0xc3) [ 341.675888] binder: 11054:11055 BC_REQUEST_DEATH_NOTIFICATION invalid ref 3468 14:03:55 executing program 1: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSPTLCK(r0, 0x40045431, &(0x7f0000000180)) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) socket(0x200000000000011, 0x4000000000080002, 0x0) bind$packet(0xffffffffffffffff, 0x0, 0x0) sendmmsg(0xffffffffffffffff, &(0x7f0000007880)=[{{&(0x7f00000001c0)=@l2={0x1f, 0xbf53, {0x9, 0x7, 0xfffffffffffffdd5, 0x1ff, 0x2, 0x4}, 0x0, 0x7}, 0x80, 0x0}}, {{0x0, 0x0, &(0x7f0000007780)}}], 0x2, 0x4048851) syz_open_procfs(0x0, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$cgroup_int(0xffffffffffffffff, 0x0, 0x2, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) openat$smack_thread_current(0xffffffffffffff9c, &(0x7f0000000240)='/proc/thread-self/attr/current\x00', 0x2, 0x0) write$cgroup_subtree(r1, &(0x7f0000000000)=ANY=[], 0x20032600) ioctl$TCSETAF(r0, 0x5408, &(0x7f0000000040)={0x2}) ioctl$EXT4_IOC_GROUP_ADD(r0, 0x40286608, &(0x7f0000000000)={0x3, 0x7000000, 0x400, 0x100000000, 0x0, 0x8}) ioctl$EVIOCGVERSION(0xffffffffffffffff, 0x80044501, &(0x7f0000000200)=""/31) 14:03:55 executing program 3: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSPTLCK(r0, 0x40045431, &(0x7f0000000180)) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) socket(0x200000000000011, 0x4000000000080002, 0x0) bind$packet(0xffffffffffffffff, 0x0, 0x0) sendmmsg(0xffffffffffffffff, &(0x7f0000007880)=[{{0x0, 0x0, &(0x7f0000007780)}}], 0x1, 0x4048851) setsockopt$packet_int(0xffffffffffffffff, 0x107, 0x0, 0x0, 0x0) syz_open_procfs(0x0, 0x0) ioctl$LOOP_SET_BLOCK_SIZE(0xffffffffffffffff, 0x4c09, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$cgroup_int(0xffffffffffffffff, 0x0, 0x2, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='\x89\x00\x00\x00\x00Ew\x00\x00\x00\xef\xb4\xc8\xd0\xff\xda\xb1vents\xd9\xc5H\xd4\x91\xfdN_]\x16\xe4\xa9C\xd2\x86Qn\xefS\x80\x11J\xfb4\x14\x86 4\x95\x9e\xfc\xc1\a\xcb \x95N\xe9\xa4j\xd2\x1f^\xb0\xb2>\xa3\xc9\xb7$\x11`t\x03: \x8b\xa4\x05\xf2?E\xdb+{t\xb8\xf7\xab\x8b\x100#', 0x26e1, 0x0) ioctl$PERF_EVENT_IOC_PAUSE_OUTPUT(r1, 0x40086602, 0x400007) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000280)='./cgroup/syz0\x00', 0x1ff) openat$smack_thread_current(0xffffffffffffff9c, &(0x7f0000000240)='/proc/thread-self/attr/current\x00', 0x2, 0x0) write$cgroup_subtree(r1, &(0x7f0000000100)=ANY=[], 0xff4a) write$cgroup_subtree(r2, &(0x7f0000000000)=ANY=[], 0x20032600) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a0f, 0x1700) accept$inet(0xffffffffffffffff, &(0x7f0000000040)={0x2, 0x0, @local}, &(0x7f0000000080)=0x10) ioctl$TCSETAF(r0, 0x5408, &(0x7f0000000040)={0x2}) ioctl$EXT4_IOC_GROUP_ADD(r0, 0x40286608, &(0x7f0000000000)={0x3, 0x7000000, 0x400, 0x100000000, 0x0, 0x8}) r3 = fcntl$dupfd(r0, 0x406, r0) ioctl$EVIOCGVERSION(r3, 0x80044501, &(0x7f0000000200)=""/31) write$binfmt_misc(r0, &(0x7f0000000080)={'syz1', "80fa25cdc862d216160cfa92845a3916e38a409a159c03f1889971d3e5144a8d08de78c4b1fbee457437261d7668b1c0f582647ad4134a05358d4309a71a702002329e024cac95642e761bb842bc1056bd6bf12c47697a649a026bd8ee1f685089941469b1ddfeddf32b392f0ff07652a3bce0770bc3bb70862845a65054cecb191e80b825d740fe6b40450359757032425dfdee92aec36ce4b468d50adc745c522cc4af2ac6e7f6a95f0edd70b09caa95fcc7143cf46b74db8bc17fa7c89f"}, 0xc3) 14:03:55 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f00000001c0)=[@acquire], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=ANY=[@ANYBLOB="0e630c408c0d0000"], 0x0, 0x0, 0x0}) [ 341.748560] binder: 11066:11068 BC_REQUEST_DEATH_NOTIFICATION invalid ref 3468 14:03:55 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f00000001c0)=[@acquire], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0xfffffd57, 0x0, &(0x7f0000000280)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, &(0x7f0000000000)={0x0}) r3 = mmap$binder(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x200000b, 0x8010, r1, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x64, 0x0, &(0x7f0000000100)=[@enter_looper, @increfs_done={0x40106308, r2, 0x2}, @acquire={0x40046305, 0x4}, @transaction={0x40406300, {0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x58, 0x38, &(0x7f0000000040)=[@flat={0x77622a85, 0x100, r3, 0x4}, @fda={0x66646185, 0x7, 0x4, 0x25}, @fda={0x66646185, 0x6, 0x3, 0x30}], &(0x7f00000000c0)=[0x0, 0x20, 0x48, 0x48, 0x18, 0x78, 0x78]}}], 0x55, 0x0, &(0x7f0000000200)="6b411be6932e5d8bcb83de4e46bb6ad9211a075cfba0209eff15bc65c8ac746b9930da5174f8ef667b5b883508c67ce27c62e929a7cc622b281a93bf66aef8e27dc2ef39a4f502ae0d699a27d0a7e254d6cf678802"}) 14:03:55 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f00000001c0)=[@acquire], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=ANY=[@ANYBLOB="0e630c408c0d0000"], 0x0, 0x0, 0x0}) 14:03:55 executing program 1: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSPTLCK(r0, 0x40045431, &(0x7f0000000180)) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) socket(0x200000000000011, 0x4000000000080002, 0x0) bind$packet(0xffffffffffffffff, 0x0, 0x0) sendmmsg(0xffffffffffffffff, &(0x7f0000007880)=[{{&(0x7f00000001c0)=@l2={0x1f, 0xbf53, {0x9, 0x7, 0xfffffffffffffdd5, 0x1ff, 0x2, 0x4}, 0x0, 0x7}, 0x80, 0x0}}, {{0x0, 0x0, &(0x7f0000007780)}}], 0x2, 0x4048851) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$cgroup_int(0xffffffffffffffff, 0x0, 0x2, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) openat$smack_thread_current(0xffffffffffffff9c, &(0x7f0000000240)='/proc/thread-self/attr/current\x00', 0x2, 0x0) write$cgroup_subtree(r1, &(0x7f0000000000)=ANY=[], 0x20032600) ioctl$TCSETAF(r0, 0x5408, &(0x7f0000000040)={0x2}) ioctl$EXT4_IOC_GROUP_ADD(r0, 0x40286608, &(0x7f0000000000)={0x3, 0x7000000, 0x400, 0x100000000, 0x0, 0x8}) ioctl$EVIOCGVERSION(0xffffffffffffffff, 0x80044501, &(0x7f0000000200)=""/31) 14:03:55 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSPTLCK(r0, 0x40045431, &(0x7f0000000180)) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) socket(0x200000000000011, 0x4000000000080002, 0x0) bind$packet(0xffffffffffffffff, 0x0, 0x0) sendmmsg(0xffffffffffffffff, &(0x7f0000007880)=[{{0x0, 0x0, &(0x7f0000007780)}}], 0x1, 0x4048851) setsockopt$packet_int(0xffffffffffffffff, 0x107, 0x0, 0x0, 0x0) syz_open_procfs(0x0, 0x0) ioctl$LOOP_SET_BLOCK_SIZE(0xffffffffffffffff, 0x4c09, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$cgroup_int(0xffffffffffffffff, 0x0, 0x2, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='\x89\x00\x00\x00\x00Ew\x00\x00\x00\xef\xb4\xc8\xd0\xff\xda\xb1vents\xd9\xc5H\xd4\x91\xfdN_]\x16\xe4\xa9C\xd2\x86Qn\xefS\x80\x11J\xfb4\x14\x86 4\x95\x9e\xfc\xc1\a\xcb \x95N\xe9\xa4j\xd2\x1f^\xb0\xb2>\xa3\xc9\xb7$\x11`t\x03: \x8b\xa4\x05\xf2?E\xdb+{t\xb8\xf7\xab\x8b\x100#', 0x26e1, 0x0) ioctl$PERF_EVENT_IOC_PAUSE_OUTPUT(r1, 0x40086602, 0x400007) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000280)='./cgroup/syz0\x00', 0x1ff) openat$smack_thread_current(0xffffffffffffff9c, &(0x7f0000000240)='/proc/thread-self/attr/current\x00', 0x2, 0x0) write$cgroup_subtree(r1, &(0x7f0000000100)=ANY=[], 0xff4a) write$cgroup_subtree(r2, &(0x7f0000000000)=ANY=[], 0x20032600) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a0f, 0x1700) accept$inet(0xffffffffffffffff, &(0x7f0000000040)={0x2, 0x0, @local}, &(0x7f0000000080)=0x10) ioctl$TCSETAF(r0, 0x5408, &(0x7f0000000040)={0x2}) ioctl$EXT4_IOC_GROUP_ADD(r0, 0x40286608, &(0x7f0000000000)={0x3, 0x7000000, 0x400, 0x100000000, 0x0, 0x8}) r3 = fcntl$dupfd(r0, 0x406, r0) ioctl$EVIOCGVERSION(r3, 0x80044501, &(0x7f0000000200)=""/31) write$binfmt_misc(r0, &(0x7f0000000080)={'syz1', "80fa25cdc862d216160cfa92845a3916e38a409a159c03f1889971d3e5144a8d08de78c4b1fbee457437261d7668b1c0f582647ad4134a05358d4309a71a702002329e024cac95642e761bb842bc1056bd6bf12c47697a649a026bd8ee1f685089941469b1ddfeddf32b392f0ff07652a3bce0770bc3bb70862845a65054cecb191e80b825d740fe6b40450359757032425dfdee92aec36ce4b468d50adc745c522cc4af2ac6e7f6a95f0edd70b09caa95fcc7143cf46b74db8bc17fa7c89f"}, 0xc3) 14:03:55 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f00000001c0)=[@acquire], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=ANY=[@ANYBLOB="0e630c408c0d0000"], 0x0, 0x0, 0x0}) [ 341.851153] binder: 11078:11080 unknown command 0 14:03:55 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f00000001c0)=[@acquire], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=ANY=[@ANYBLOB="0e630c408c0d0000"], 0x0, 0x0, 0x0}) 14:03:55 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f00000001c0)=[@acquire], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) [ 341.872138] binder: BINDER_SET_CONTEXT_MGR already set [ 341.872145] binder: 11082:11083 ioctl 40046207 0 returned -16 14:03:55 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f00000001c0)=[@acquire], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=ANY=[@ANYBLOB="0e630c408c0d0000"], 0x0, 0x0, 0x0}) 14:03:55 executing program 0: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSPTLCK(r0, 0x40045431, &(0x7f0000000180)) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) socket(0x200000000000011, 0x4000000000080002, 0x0) bind$packet(0xffffffffffffffff, 0x0, 0x0) sendmmsg(0xffffffffffffffff, &(0x7f0000007880)=[{{0x0, 0x0, &(0x7f0000007780)}}], 0x1, 0x4048851) setsockopt$packet_int(0xffffffffffffffff, 0x107, 0x0, 0x0, 0x0) syz_open_procfs(0x0, 0x0) ioctl$LOOP_SET_BLOCK_SIZE(0xffffffffffffffff, 0x4c09, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$cgroup_int(0xffffffffffffffff, 0x0, 0x2, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='\x89\x00\x00\x00\x00Ew\x00\x00\x00\xef\xb4\xc8\xd0\xff\xda\xb1vents\xd9\xc5H\xd4\x91\xfdN_]\x16\xe4\xa9C\xd2\x86Qn\xefS\x80\x11J\xfb4\x14\x86 4\x95\x9e\xfc\xc1\a\xcb \x95N\xe9\xa4j\xd2\x1f^\xb0\xb2>\xa3\xc9\xb7$\x11`t\x03: \x8b\xa4\x05\xf2?E\xdb+{t\xb8\xf7\xab\x8b\x100#', 0x26e1, 0x0) ioctl$PERF_EVENT_IOC_PAUSE_OUTPUT(r1, 0x40086602, 0x400007) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000280)='./cgroup/syz0\x00', 0x1ff) openat$smack_thread_current(0xffffffffffffff9c, &(0x7f0000000240)='/proc/thread-self/attr/current\x00', 0x2, 0x0) write$cgroup_subtree(r1, &(0x7f0000000100)=ANY=[], 0xff4a) write$cgroup_subtree(r2, &(0x7f0000000000)=ANY=[], 0x20032600) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a0f, 0x1700) accept$inet(0xffffffffffffffff, &(0x7f0000000040)={0x2, 0x0, @local}, &(0x7f0000000080)=0x10) ioctl$TCSETAF(r0, 0x5408, &(0x7f0000000040)={0x2}) ioctl$EXT4_IOC_GROUP_ADD(r0, 0x40286608, &(0x7f0000000000)={0x3, 0x7000000, 0x400, 0x100000000, 0x0, 0x8}) r3 = fcntl$dupfd(r0, 0x406, r0) ioctl$EVIOCGVERSION(r3, 0x80044501, &(0x7f0000000200)=""/31) write$binfmt_misc(r0, &(0x7f0000000080)={'syz1', "80fa25cdc862d216160cfa92845a3916e38a409a159c03f1889971d3e5144a8d08de78c4b1fbee457437261d7668b1c0f582647ad4134a05358d4309a71a702002329e024cac95642e761bb842bc1056bd6bf12c47697a649a026bd8ee1f685089941469b1ddfeddf32b392f0ff07652a3bce0770bc3bb70862845a65054cecb191e80b825d740fe6b40450359757032425dfdee92aec36ce4b468d50adc745c522cc4af2ac6e7f6a95f0edd70b09caa95fcc7143cf46b74db8bc17fa7c89f"}, 0xc3) 14:03:55 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f00000001c0)=[@acquire], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) 14:03:55 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f00000001c0)=[@acquire], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=ANY=[@ANYBLOB="0e630c408c0d0000"], 0x0, 0x0, 0x0}) 14:03:55 executing program 1: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSPTLCK(r0, 0x40045431, &(0x7f0000000180)) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) socket(0x200000000000011, 0x4000000000080002, 0x0) bind$packet(0xffffffffffffffff, 0x0, 0x0) sendmmsg(0xffffffffffffffff, &(0x7f0000007880)=[{{&(0x7f00000001c0)=@l2={0x1f, 0xbf53, {0x9, 0x7, 0xfffffffffffffdd5, 0x1ff, 0x2, 0x4}, 0x0, 0x7}, 0x80, 0x0}}, {{0x0, 0x0, &(0x7f0000007780)}}], 0x2, 0x4048851) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$cgroup_int(0xffffffffffffffff, 0x0, 0x2, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) openat$smack_thread_current(0xffffffffffffff9c, &(0x7f0000000240)='/proc/thread-self/attr/current\x00', 0x2, 0x0) write$cgroup_subtree(r1, &(0x7f0000000000)=ANY=[], 0x20032600) ioctl$TCSETAF(r0, 0x5408, &(0x7f0000000040)={0x2}) ioctl$EXT4_IOC_GROUP_ADD(r0, 0x40286608, &(0x7f0000000000)={0x3, 0x7000000, 0x400, 0x100000000, 0x0, 0x8}) ioctl$EVIOCGVERSION(0xffffffffffffffff, 0x80044501, &(0x7f0000000200)=""/31) [ 341.908157] binder: BINDER_SET_CONTEXT_MGR already set [ 341.908166] binder: 11089:11093 ioctl 40046207 0 returned -16 [ 341.946987] binder: BINDER_SET_CONTEXT_MGR already set [ 341.946995] binder: 11096:11097 ioctl 40046207 0 returned -16 [ 341.963704] binder: BINDER_SET_CONTEXT_MGR already set [ 341.963713] binder: 11098:11100 ioctl 40046207 0 returned -16 [ 341.973197] binder: 11098:11100 ioctl c0306201 0 returned -14 [ 341.995792] binder: BINDER_SET_CONTEXT_MGR already set [ 341.995800] binder: 11103:11107 ioctl 40046207 0 returned -16 [ 341.998936] binder: BINDER_SET_CONTEXT_MGR already set [ 341.998944] binder: 11106:11110 ioctl 40046207 0 returned -16 [ 341.999245] binder: 11106:11110 ioctl c0306201 0 returned -14 [ 342.047651] binder: BINDER_SET_CONTEXT_MGR already set [ 342.047660] binder: 11114:11116 ioctl 40046207 0 returned -16 14:03:55 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f00000001c0)=[@acquire], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0xfffffd57, 0x0, &(0x7f0000000280)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, &(0x7f0000000000)={0x0}) r3 = mmap$binder(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x200000b, 0x8010, r1, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x64, 0x0, &(0x7f0000000100)=[@enter_looper, @increfs_done={0x40106308, r2, 0x2}, @acquire={0x40046305, 0x4}, @transaction={0x40406300, {0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x58, 0x38, &(0x7f0000000040)=[@flat={0x77622a85, 0x100, r3, 0x4}, @fda={0x66646185, 0x7, 0x4, 0x25}, @fda={0x66646185, 0x6, 0x3, 0x30}], &(0x7f00000000c0)=[0x0, 0x20, 0x48, 0x48, 0x18, 0x78, 0x78]}}], 0x55, 0x0, &(0x7f0000000200)="6b411be6932e5d8bcb83de4e46bb6ad9211a075cfba0209eff15bc65c8ac746b9930da5174f8ef667b5b883508c67ce27c62e929a7cc622b281a93bf66aef8e27dc2ef39a4f502ae0d699a27d0a7e254d6cf678802"}) 14:03:55 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f00000001c0)=[@acquire], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) 14:03:55 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSPTLCK(r0, 0x40045431, &(0x7f0000000180)) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) socket(0x200000000000011, 0x4000000000080002, 0x0) bind$packet(0xffffffffffffffff, 0x0, 0x0) sendmmsg(0xffffffffffffffff, &(0x7f0000007880)=[{{0x0, 0x0, 0x0}}, {{0x0, 0x0, &(0x7f0000007780)}}], 0x2, 0x4048851) setsockopt$packet_int(0xffffffffffffffff, 0x107, 0x0, 0x0, 0x0) syz_open_procfs(0x0, 0x0) ioctl$LOOP_SET_BLOCK_SIZE(0xffffffffffffffff, 0x4c09, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$cgroup_int(0xffffffffffffffff, 0x0, 0x2, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='\x89\x00\x00\x00\x00Ew\x00\x00\x00\xef\xb4\xc8\xd0\xff\xda\xb1vents\xd9\xc5H\xd4\x91\xfdN_]\x16\xe4\xa9C\xd2\x86Qn\xefS\x80\x11J\xfb4\x14\x86 4\x95\x9e\xfc\xc1\a\xcb \x95N\xe9\xa4j\xd2\x1f^\xb0\xb2>\xa3\xc9\xb7$\x11`t\x03: \x8b\xa4\x05\xf2?E\xdb+{t\xb8\xf7\xab\x8b\x100#', 0x26e1, 0x0) ioctl$PERF_EVENT_IOC_PAUSE_OUTPUT(r1, 0x40086602, 0x400007) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000280)='./cgroup/syz0\x00', 0x1ff) openat$smack_thread_current(0xffffffffffffff9c, &(0x7f0000000240)='/proc/thread-self/attr/current\x00', 0x2, 0x0) write$cgroup_subtree(r1, &(0x7f0000000100)=ANY=[], 0xff4a) write$cgroup_subtree(r2, &(0x7f0000000000)=ANY=[], 0x20032600) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a0f, 0x1700) accept$inet(0xffffffffffffffff, &(0x7f0000000040)={0x2, 0x0, @local}, &(0x7f0000000080)=0x10) ioctl$TCSETAF(r0, 0x5408, &(0x7f0000000040)={0x2}) ioctl$EXT4_IOC_GROUP_ADD(r0, 0x40286608, &(0x7f0000000000)={0x3, 0x7000000, 0x400, 0x100000000, 0x0, 0x8}) r3 = fcntl$dupfd(r0, 0x406, r0) ioctl$EVIOCGVERSION(r3, 0x80044501, &(0x7f0000000200)=""/31) write$binfmt_misc(r0, &(0x7f0000000080)={'syz1', "80fa25cdc862d216160cfa92845a3916e38a409a159c03f1889971d3e5144a8d08de78c4b1fbee457437261d7668b1c0f582647ad4134a05358d4309a71a702002329e024cac95642e761bb842bc1056bd6bf12c47697a649a026bd8ee1f685089941469b1ddfeddf32b392f0ff07652a3bce0770bc3bb70862845a65054cecb191e80b825d740fe6b40450359757032425dfdee92aec36ce4b468d50adc745c522cc4af2ac6e7f6a95f0edd70b09caa95fcc7143cf46b74db8bc17fa7c89f"}, 0xc3) 14:03:55 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f00000001c0)=[@acquire], 0x0, 0x0, 0x0}) 14:03:55 executing program 1: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSPTLCK(r0, 0x40045431, &(0x7f0000000180)) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) socket(0x200000000000011, 0x4000000000080002, 0x0) bind$packet(0xffffffffffffffff, 0x0, 0x0) sendmmsg(0xffffffffffffffff, &(0x7f0000007880)=[{{&(0x7f00000001c0)=@l2={0x1f, 0xbf53, {0x9, 0x7, 0xfffffffffffffdd5, 0x1ff, 0x2, 0x4}, 0x0, 0x7}, 0x80, 0x0}}, {{0x0, 0x0, &(0x7f0000007780)}}], 0x2, 0x4048851) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$cgroup_int(0xffffffffffffffff, 0x0, 0x2, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) openat$smack_thread_current(0xffffffffffffff9c, &(0x7f0000000240)='/proc/thread-self/attr/current\x00', 0x2, 0x0) write$cgroup_subtree(r1, &(0x7f0000000000)=ANY=[], 0x20032600) ioctl$TCSETAF(r0, 0x5408, &(0x7f0000000040)={0x2}) ioctl$EXT4_IOC_GROUP_ADD(r0, 0x40286608, &(0x7f0000000000)={0x3, 0x7000000, 0x400, 0x100000000, 0x0, 0x8}) ioctl$EVIOCGVERSION(0xffffffffffffffff, 0x80044501, &(0x7f0000000200)=""/31) 14:03:55 executing program 0: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSPTLCK(r0, 0x40045431, &(0x7f0000000180)) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) socket(0x200000000000011, 0x4000000000080002, 0x0) bind$packet(0xffffffffffffffff, 0x0, 0x0) sendmmsg(0xffffffffffffffff, &(0x7f0000007880)=[{{&(0x7f00000001c0)=@l2={0x1f, 0xbf53, {0x9, 0x7, 0xfffffffffffffdd5, 0x1ff, 0x2, 0x4}, 0x0, 0x7}, 0x80, 0x0}}, {{0x0, 0x0, &(0x7f0000007780)}}], 0x2, 0x4048851) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$cgroup_int(0xffffffffffffffff, 0x0, 0x2, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) openat$smack_thread_current(0xffffffffffffff9c, &(0x7f0000000240)='/proc/thread-self/attr/current\x00', 0x2, 0x0) write$cgroup_subtree(r1, &(0x7f0000000000)=ANY=[], 0x20032600) ioctl$TCSETAF(r0, 0x5408, &(0x7f0000000040)={0x2}) ioctl$EXT4_IOC_GROUP_ADD(r0, 0x40286608, &(0x7f0000000000)={0x3, 0x7000000, 0x400, 0x100000000, 0x0, 0x8}) ioctl$EVIOCGVERSION(0xffffffffffffffff, 0x80044501, &(0x7f0000000200)=""/31) 14:03:55 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f00000001c0)=[@acquire], 0x0, 0x0, 0x0}) [ 342.127971] binder: 11078:11080 ioctl c0306201 20008fd0 returned -22 14:03:55 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f00000001c0)=[@acquire], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) 14:03:55 executing program 1: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSPTLCK(r0, 0x40045431, &(0x7f0000000180)) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) socket(0x200000000000011, 0x4000000000080002, 0x0) bind$packet(0xffffffffffffffff, 0x0, 0x0) syz_open_procfs(0x0, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$cgroup_int(0xffffffffffffffff, 0x0, 0x2, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) openat$smack_thread_current(0xffffffffffffff9c, &(0x7f0000000240)='/proc/thread-self/attr/current\x00', 0x2, 0x0) write$cgroup_subtree(r1, &(0x7f0000000000)=ANY=[], 0x20032600) ioctl$TCSETAF(r0, 0x5408, &(0x7f0000000040)={0x2}) ioctl$EXT4_IOC_GROUP_ADD(r0, 0x40286608, &(0x7f0000000000)={0x3, 0x7000000, 0x400, 0x100000000, 0x0, 0x8}) ioctl$EVIOCGVERSION(0xffffffffffffffff, 0x80044501, &(0x7f0000000200)=""/31) 14:03:55 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f00000001c0)=[@acquire], 0x0, 0x0, 0x0}) 14:03:55 executing program 0: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSPTLCK(r0, 0x40045431, &(0x7f0000000180)) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) socket(0x200000000000011, 0x4000000000080002, 0x0) bind$packet(0xffffffffffffffff, 0x0, 0x0) sendmmsg(0xffffffffffffffff, &(0x7f0000007880)=[{{&(0x7f00000001c0)=@l2={0x1f, 0xbf53, {0x9, 0x7, 0xfffffffffffffdd5, 0x1ff, 0x2, 0x4}, 0x0, 0x7}, 0x80, 0x0}}, {{0x0, 0x0, &(0x7f0000007780)}}], 0x2, 0x4048851) syz_open_procfs(0x0, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$cgroup_int(0xffffffffffffffff, 0x0, 0x2, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) openat$smack_thread_current(0xffffffffffffff9c, &(0x7f0000000240)='/proc/thread-self/attr/current\x00', 0x2, 0x0) write$cgroup_subtree(r1, &(0x7f0000000000)=ANY=[], 0x20032600) ioctl$TCSETAF(r0, 0x5408, &(0x7f0000000040)={0x2}) ioctl$EXT4_IOC_GROUP_ADD(r0, 0x40286608, &(0x7f0000000000)={0x3, 0x7000000, 0x400, 0x100000000, 0x0, 0x8}) ioctl$EVIOCGVERSION(0xffffffffffffffff, 0x80044501, &(0x7f0000000200)=""/31) [ 342.173039] binder: 11125:11133 unknown command 0 [ 342.173276] binder: BINDER_SET_CONTEXT_MGR already set [ 342.173283] binder: 11123:11134 ioctl 40046207 0 returned -16 14:03:55 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f00000001c0)=[@acquire], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) [ 342.175298] binder: 11123:11134 ioctl c0306201 0 returned -14 [ 342.197037] binder: BINDER_SET_CONTEXT_MGR already set [ 342.197047] binder: 11136:11137 ioctl 40046207 0 returned -16 [ 342.234307] binder: BINDER_SET_CONTEXT_MGR already set [ 342.234315] binder: 11139:11141 ioctl 40046207 0 returned -16 [ 342.245660] binder: BINDER_SET_CONTEXT_MGR already set [ 342.245669] binder: 11147:11149 ioctl 40046207 0 returned -16 [ 342.283216] binder: BINDER_SET_CONTEXT_MGR already set 14:03:55 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f00000001c0)=[@acquire], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0xfffffd57, 0x0, &(0x7f0000000280)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, &(0x7f0000000000)={0x0}) r3 = mmap$binder(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x200000b, 0x8010, r1, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x64, 0x0, &(0x7f0000000100)=[@enter_looper, @increfs_done={0x40106308, r2, 0x2}, @acquire={0x40046305, 0x4}, @transaction={0x40406300, {0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x58, 0x38, &(0x7f0000000040)=[@flat={0x77622a85, 0x100, r3, 0x4}, @fda={0x66646185, 0x7, 0x4, 0x25}, @fda={0x66646185, 0x6, 0x3, 0x30}], &(0x7f00000000c0)=[0x0, 0x20, 0x48, 0x48, 0x18, 0x78, 0x78]}}], 0x55, 0x0, &(0x7f0000000200)="6b411be6932e5d8bcb83de4e46bb6ad9211a075cfba0209eff15bc65c8ac746b9930da5174f8ef667b5b883508c67ce27c62e929a7cc622b281a93bf66aef8e27dc2ef39a4f502ae0d699a27d0a7e254d6cf678802"}) 14:03:55 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f00000001c0)=[@acquire], 0x0, 0x0, 0x0}) 14:03:55 executing program 1: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSPTLCK(r0, 0x40045431, &(0x7f0000000180)) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) socket(0x200000000000011, 0x4000000000080002, 0x0) syz_open_procfs(0x0, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$cgroup_int(0xffffffffffffffff, 0x0, 0x2, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) openat$smack_thread_current(0xffffffffffffff9c, &(0x7f0000000240)='/proc/thread-self/attr/current\x00', 0x2, 0x0) write$cgroup_subtree(r1, &(0x7f0000000000)=ANY=[], 0x20032600) ioctl$TCSETAF(r0, 0x5408, &(0x7f0000000040)={0x2}) ioctl$EXT4_IOC_GROUP_ADD(r0, 0x40286608, &(0x7f0000000000)={0x3, 0x7000000, 0x400, 0x100000000, 0x0, 0x8}) ioctl$EVIOCGVERSION(0xffffffffffffffff, 0x80044501, &(0x7f0000000200)=""/31) 14:03:55 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f00000001c0)=[@acquire], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) 14:03:55 executing program 0: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(r0, 0x540b, 0x1) ioctl$TIOCMBIS(r0, 0x5416, &(0x7f0000000000)=0x400) 14:03:55 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSPTLCK(r0, 0x40045431, &(0x7f0000000180)) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) socket(0x200000000000011, 0x4000000000080002, 0x0) bind$packet(0xffffffffffffffff, 0x0, 0x0) sendmmsg(0xffffffffffffffff, &(0x7f0000007880)=[{{0x0, 0x0, 0x0}}, {{0x0, 0x0, &(0x7f0000007780)}}], 0x2, 0x4048851) setsockopt$packet_int(0xffffffffffffffff, 0x107, 0x0, 0x0, 0x0) syz_open_procfs(0x0, 0x0) ioctl$LOOP_SET_BLOCK_SIZE(0xffffffffffffffff, 0x4c09, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$cgroup_int(0xffffffffffffffff, 0x0, 0x2, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='\x89\x00\x00\x00\x00Ew\x00\x00\x00\xef\xb4\xc8\xd0\xff\xda\xb1vents\xd9\xc5H\xd4\x91\xfdN_]\x16\xe4\xa9C\xd2\x86Qn\xefS\x80\x11J\xfb4\x14\x86 4\x95\x9e\xfc\xc1\a\xcb \x95N\xe9\xa4j\xd2\x1f^\xb0\xb2>\xa3\xc9\xb7$\x11`t\x03: \x8b\xa4\x05\xf2?E\xdb+{t\xb8\xf7\xab\x8b\x100#', 0x26e1, 0x0) ioctl$PERF_EVENT_IOC_PAUSE_OUTPUT(r1, 0x40086602, 0x400007) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000280)='./cgroup/syz0\x00', 0x1ff) openat$smack_thread_current(0xffffffffffffff9c, &(0x7f0000000240)='/proc/thread-self/attr/current\x00', 0x2, 0x0) write$cgroup_subtree(r1, &(0x7f0000000100)=ANY=[], 0xff4a) write$cgroup_subtree(r2, &(0x7f0000000000)=ANY=[], 0x20032600) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a0f, 0x1700) accept$inet(0xffffffffffffffff, &(0x7f0000000040)={0x2, 0x0, @local}, &(0x7f0000000080)=0x10) ioctl$TCSETAF(r0, 0x5408, &(0x7f0000000040)={0x2}) ioctl$EXT4_IOC_GROUP_ADD(r0, 0x40286608, &(0x7f0000000000)={0x3, 0x7000000, 0x400, 0x100000000, 0x0, 0x8}) r3 = fcntl$dupfd(r0, 0x406, r0) ioctl$EVIOCGVERSION(r3, 0x80044501, &(0x7f0000000200)=""/31) write$binfmt_misc(r0, &(0x7f0000000080)={'syz1', "80fa25cdc862d216160cfa92845a3916e38a409a159c03f1889971d3e5144a8d08de78c4b1fbee457437261d7668b1c0f582647ad4134a05358d4309a71a702002329e024cac95642e761bb842bc1056bd6bf12c47697a649a026bd8ee1f685089941469b1ddfeddf32b392f0ff07652a3bce0770bc3bb70862845a65054cecb191e80b825d740fe6b40450359757032425dfdee92aec36ce4b468d50adc745c522cc4af2ac6e7f6a95f0edd70b09caa95fcc7143cf46b74db8bc17fa7c89f"}, 0xc3) 14:03:55 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f00000001c0)=[@acquire], 0x0, 0x0, 0x0}) 14:03:55 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f00000001c0)=[@acquire], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x0, 0x0, &(0x7f000000dff8)=ANY=[], 0x0, 0x0, 0x0}) [ 342.283222] binder: 11152:11154 ioctl 40046207 0 returned -16 [ 342.332198] binder: 11125:11133 ioctl c0306201 20008fd0 returned -22 14:03:55 executing program 0: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSPTLCK(r0, 0x40045431, &(0x7f0000000000)=0x1) ioctl$TCFLSH(r0, 0x540b, 0x1) [ 342.390316] binder: 11160:11172 unknown command 0 14:03:55 executing program 3: syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f00000001c0)=[@acquire], 0x0, 0x0, 0x0}) 14:03:55 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f00000001c0)=[@acquire], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x0, 0x0, &(0x7f000000dff8)=ANY=[], 0x0, 0x0, 0x0}) 14:03:55 executing program 1: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSPTLCK(r0, 0x40045431, &(0x7f0000000180)) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_open_procfs(0x0, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$cgroup_int(0xffffffffffffffff, 0x0, 0x2, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) openat$smack_thread_current(0xffffffffffffff9c, &(0x7f0000000240)='/proc/thread-self/attr/current\x00', 0x2, 0x0) write$cgroup_subtree(r1, &(0x7f0000000000)=ANY=[], 0x20032600) ioctl$TCSETAF(r0, 0x5408, &(0x7f0000000040)={0x2}) ioctl$EXT4_IOC_GROUP_ADD(r0, 0x40286608, &(0x7f0000000000)={0x3, 0x7000000, 0x400, 0x100000000, 0x0, 0x8}) ioctl$EVIOCGVERSION(0xffffffffffffffff, 0x80044501, &(0x7f0000000200)=""/31) [ 342.407255] binder: BINDER_SET_CONTEXT_MGR already set [ 342.407263] binder: 11176:11177 ioctl 40046207 0 returned -16 [ 342.425722] binder: BINDER_SET_CONTEXT_MGR already set [ 342.425730] binder: 11175:11180 ioctl 40046207 0 returned -16 14:03:56 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f00000001c0)=[@acquire], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0xfffffd57, 0x0, &(0x7f0000000280)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, &(0x7f0000000000)) mmap$binder(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x200000b, 0x8010, r1, 0x0) 14:03:56 executing program 0: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$EXT4_IOC_SWAP_BOOT(r0, 0x6611) ioctl$TCFLSH(r0, 0x540b, 0x1f000008) r1 = openat(0xffffffffffffffff, &(0x7f0000000040)='./file0\x00', 0x0, 0x1) ioctl$PPPIOCGDEBUG(r1, 0x80047441, &(0x7f0000000180)) ioctl$FS_IOC_SETFLAGS(r0, 0x40086602, &(0x7f0000000000)=0x7fffffff) r2 = creat(&(0x7f0000000240)='./file0\x00', 0x100000180) setsockopt$EBT_SO_SET_COUNTERS(r2, 0x0, 0x81, &(0x7f0000000080)=ANY=[@ANYBLOB="66696c74bc89681b74df14fde3f865720000000000000000000000000000000000000000000000000000000000f500000000000000000000000000000000f1ffffff000000000000008000000000000000000000000000000000000000000000000000000000000000000500000000000000", @ANYPTR=&(0x7f0000000280)=ANY=[@ANYBLOB="0000000000000000000000000000000000000000000000000000000000004deb2ae2d19c37e1cf6a580000471aaf8f12fac7c870cc6f29e0c39b73bb7f05423798bc6b691066eb61352149c5876120fef5a025f686e73ce719dc29270b21c900400ba52ce2959461524163b97a3ea550669c5721e03402670df6d40bd0ae"], @ANYBLOB='\x00'/88], 0xc8) 14:03:56 executing program 3: r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f00000001c0)=[@acquire], 0x0, 0x0, 0x0}) 14:03:56 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f00000001c0)=[@acquire], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x0, 0x0, &(0x7f000000dff8)=ANY=[], 0x0, 0x0, 0x0}) 14:03:56 executing program 1: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSPTLCK(r0, 0x40045431, &(0x7f0000000180)) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_open_procfs(0x0, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$cgroup_int(0xffffffffffffffff, 0x0, 0x2, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) openat$smack_thread_current(0xffffffffffffff9c, &(0x7f0000000240)='/proc/thread-self/attr/current\x00', 0x2, 0x0) write$cgroup_subtree(r1, &(0x7f0000000000)=ANY=[], 0x20032600) ioctl$TCSETAF(r0, 0x5408, &(0x7f0000000040)={0x2}) ioctl$EXT4_IOC_GROUP_ADD(r0, 0x40286608, &(0x7f0000000000)={0x3, 0x7000000, 0x400, 0x100000000, 0x0, 0x8}) ioctl$EVIOCGVERSION(0xffffffffffffffff, 0x80044501, &(0x7f0000000200)=""/31) 14:03:56 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSPTLCK(r0, 0x40045431, &(0x7f0000000180)) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) socket(0x200000000000011, 0x4000000000080002, 0x0) bind$packet(0xffffffffffffffff, 0x0, 0x0) sendmmsg(0xffffffffffffffff, &(0x7f0000007880)=[{{0x0, 0x0, 0x0}}, {{0x0, 0x0, &(0x7f0000007780)}}], 0x2, 0x4048851) setsockopt$packet_int(0xffffffffffffffff, 0x107, 0x0, 0x0, 0x0) syz_open_procfs(0x0, 0x0) ioctl$LOOP_SET_BLOCK_SIZE(0xffffffffffffffff, 0x4c09, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$cgroup_int(0xffffffffffffffff, 0x0, 0x2, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='\x89\x00\x00\x00\x00Ew\x00\x00\x00\xef\xb4\xc8\xd0\xff\xda\xb1vents\xd9\xc5H\xd4\x91\xfdN_]\x16\xe4\xa9C\xd2\x86Qn\xefS\x80\x11J\xfb4\x14\x86 4\x95\x9e\xfc\xc1\a\xcb \x95N\xe9\xa4j\xd2\x1f^\xb0\xb2>\xa3\xc9\xb7$\x11`t\x03: \x8b\xa4\x05\xf2?E\xdb+{t\xb8\xf7\xab\x8b\x100#', 0x26e1, 0x0) ioctl$PERF_EVENT_IOC_PAUSE_OUTPUT(r1, 0x40086602, 0x400007) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000280)='./cgroup/syz0\x00', 0x1ff) openat$smack_thread_current(0xffffffffffffff9c, &(0x7f0000000240)='/proc/thread-self/attr/current\x00', 0x2, 0x0) write$cgroup_subtree(r1, &(0x7f0000000100)=ANY=[], 0xff4a) write$cgroup_subtree(r2, &(0x7f0000000000)=ANY=[], 0x20032600) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a0f, 0x1700) accept$inet(0xffffffffffffffff, &(0x7f0000000040)={0x2, 0x0, @local}, &(0x7f0000000080)=0x10) ioctl$TCSETAF(r0, 0x5408, &(0x7f0000000040)={0x2}) ioctl$EXT4_IOC_GROUP_ADD(r0, 0x40286608, &(0x7f0000000000)={0x3, 0x7000000, 0x400, 0x100000000, 0x0, 0x8}) r3 = fcntl$dupfd(r0, 0x406, r0) ioctl$EVIOCGVERSION(r3, 0x80044501, &(0x7f0000000200)=""/31) write$binfmt_misc(r0, &(0x7f0000000080)={'syz1', "80fa25cdc862d216160cfa92845a3916e38a409a159c03f1889971d3e5144a8d08de78c4b1fbee457437261d7668b1c0f582647ad4134a05358d4309a71a702002329e024cac95642e761bb842bc1056bd6bf12c47697a649a026bd8ee1f685089941469b1ddfeddf32b392f0ff07652a3bce0770bc3bb70862845a65054cecb191e80b825d740fe6b40450359757032425dfdee92aec36ce4b468d50adc745c522cc4af2ac6e7f6a95f0edd70b09caa95fcc7143cf46b74db8bc17fa7c89f"}, 0xc3) 14:03:56 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f00000001c0)=[@acquire], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x0, 0x0, &(0x7f000000dff8)=ANY=[@ANYBLOB], 0x0, 0x0, 0x0}) [ 342.485002] binder: BINDER_SET_CONTEXT_MGR already set [ 342.485012] binder: 11190:11194 ioctl 40046207 0 returned -16 [ 342.516777] binder: 11160:11172 ioctl c0306201 20008fd0 returned -22 14:03:56 executing program 3: r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f00000001c0)=[@acquire], 0x0, 0x0, 0x0}) 14:03:56 executing program 0: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/ptmx\x00', 0x0, 0x0) r1 = dup3(r0, r0, 0x80000) ioctl$PPPIOCGNPMODE(r1, 0xc008744c, &(0x7f0000000100)={0x29, 0x1}) ioctl$TCFLSH(r0, 0x540b, 0x6) r2 = add_key(&(0x7f0000000000)='cifs.idmap\x00', &(0x7f0000000040)={'syz', 0x2}, &(0x7f0000000080)="21d2382f16321cee00decd5a6daf03d936080322a9fcbba63bf4c68019044d03a7301a428b3dc1fcffbeb27fe35a52321657285c92d870c703101ff8d28ba39457e63171d6ae7af5fae80ba2ddfe28842c36e72a507405fd8d0d6b0c273c59bb0180f78eb16ab2207ee50e67d2978d5294f06cf213947aca", 0x78, 0xfffffffffffffffd) keyctl$get_keyring_id(0x0, r2, 0x19) [ 342.565981] binder: 11208:11212 unknown command 0 14:03:56 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f00000001c0)=[@acquire], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x0, 0x0, &(0x7f000000dff8)=ANY=[@ANYBLOB], 0x0, 0x0, 0x0}) 14:03:56 executing program 1: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSPTLCK(r0, 0x40045431, &(0x7f0000000180)) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_open_procfs(0x0, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$cgroup_int(0xffffffffffffffff, 0x0, 0x2, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) openat$smack_thread_current(0xffffffffffffff9c, &(0x7f0000000240)='/proc/thread-self/attr/current\x00', 0x2, 0x0) write$cgroup_subtree(r1, &(0x7f0000000000)=ANY=[], 0x20032600) ioctl$TCSETAF(r0, 0x5408, &(0x7f0000000040)={0x2}) ioctl$EXT4_IOC_GROUP_ADD(r0, 0x40286608, &(0x7f0000000000)={0x3, 0x7000000, 0x400, 0x100000000, 0x0, 0x8}) ioctl$EVIOCGVERSION(0xffffffffffffffff, 0x80044501, &(0x7f0000000200)=""/31) [ 342.594446] binder: BINDER_SET_CONTEXT_MGR already set 14:03:56 executing program 3: r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f00000001c0)=[@acquire], 0x0, 0x0, 0x0}) [ 342.594454] binder: 11214:11218 ioctl 40046207 0 returned -16 [ 342.647310] binder: BINDER_SET_CONTEXT_MGR already set 14:03:56 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f00000001c0)=[@acquire], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0xfffffd57, 0x0, &(0x7f0000000280)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, &(0x7f0000000000)) 14:03:56 executing program 0: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/ptmx\x00', 0x4000, 0x0) ioctl$TCFLSH(r0, 0x540b, 0x1) r1 = openat$selinux_avc_cache_stats(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/avc/cache_stats\x00', 0x0, 0x0) ioctl$LOOP_SET_FD(r1, 0x4c00, r0) 14:03:56 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f00000001c0)=[@acquire], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x0, 0x0, &(0x7f000000dff8)=ANY=[@ANYBLOB], 0x0, 0x0, 0x0}) 14:03:56 executing program 3: syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f00000001c0)=[@acquire], 0x0, 0x0, 0x0}) 14:03:56 executing program 1: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSPTLCK(r0, 0x40045431, &(0x7f0000000180)) socket(0x200000000000011, 0x4000000000080002, 0x0) syz_open_procfs(0x0, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$cgroup_int(0xffffffffffffffff, 0x0, 0x2, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) openat$smack_thread_current(0xffffffffffffff9c, &(0x7f0000000240)='/proc/thread-self/attr/current\x00', 0x2, 0x0) write$cgroup_subtree(r1, &(0x7f0000000000)=ANY=[], 0x20032600) ioctl$TCSETAF(r0, 0x5408, &(0x7f0000000040)={0x2}) ioctl$EXT4_IOC_GROUP_ADD(r0, 0x40286608, &(0x7f0000000000)={0x3, 0x7000000, 0x400, 0x100000000, 0x0, 0x8}) ioctl$EVIOCGVERSION(0xffffffffffffffff, 0x80044501, &(0x7f0000000200)=""/31) 14:03:56 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSPTLCK(r0, 0x40045431, &(0x7f0000000180)) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) socket(0x200000000000011, 0x4000000000080002, 0x0) bind$packet(0xffffffffffffffff, 0x0, 0x0) sendmmsg(0xffffffffffffffff, &(0x7f0000007880)=[{{&(0x7f00000001c0)=@l2={0x1f, 0x0, {0x9, 0x7, 0xfffffffffffffdd5, 0x1ff, 0x2, 0x4}, 0x0, 0x7}, 0x80, 0x0}}, {{0x0, 0x0, &(0x7f0000007780)}}], 0x2, 0x4048851) setsockopt$packet_int(0xffffffffffffffff, 0x107, 0x0, 0x0, 0x0) syz_open_procfs(0x0, 0x0) ioctl$LOOP_SET_BLOCK_SIZE(0xffffffffffffffff, 0x4c09, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$cgroup_int(0xffffffffffffffff, 0x0, 0x2, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='\x89\x00\x00\x00\x00Ew\x00\x00\x00\xef\xb4\xc8\xd0\xff\xda\xb1vents\xd9\xc5H\xd4\x91\xfdN_]\x16\xe4\xa9C\xd2\x86Qn\xefS\x80\x11J\xfb4\x14\x86 4\x95\x9e\xfc\xc1\a\xcb \x95N\xe9\xa4j\xd2\x1f^\xb0\xb2>\xa3\xc9\xb7$\x11`t\x03: \x8b\xa4\x05\xf2?E\xdb+{t\xb8\xf7\xab\x8b\x100#', 0x26e1, 0x0) ioctl$PERF_EVENT_IOC_PAUSE_OUTPUT(r1, 0x40086602, 0x400007) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000280)='./cgroup/syz0\x00', 0x1ff) openat$smack_thread_current(0xffffffffffffff9c, &(0x7f0000000240)='/proc/thread-self/attr/current\x00', 0x2, 0x0) write$cgroup_subtree(r1, &(0x7f0000000100)=ANY=[], 0xff4a) write$cgroup_subtree(r2, &(0x7f0000000000)=ANY=[], 0x20032600) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a0f, 0x1700) accept$inet(0xffffffffffffffff, &(0x7f0000000040)={0x2, 0x0, @local}, &(0x7f0000000080)=0x10) ioctl$TCSETAF(r0, 0x5408, &(0x7f0000000040)={0x2}) ioctl$EXT4_IOC_GROUP_ADD(r0, 0x40286608, &(0x7f0000000000)={0x3, 0x7000000, 0x400, 0x100000000, 0x0, 0x8}) r3 = fcntl$dupfd(r0, 0x406, r0) ioctl$EVIOCGVERSION(r3, 0x80044501, &(0x7f0000000200)=""/31) write$binfmt_misc(r0, &(0x7f0000000080)={'syz1', "80fa25cdc862d216160cfa92845a3916e38a409a159c03f1889971d3e5144a8d08de78c4b1fbee457437261d7668b1c0f582647ad4134a05358d4309a71a702002329e024cac95642e761bb842bc1056bd6bf12c47697a649a026bd8ee1f685089941469b1ddfeddf32b392f0ff07652a3bce0770bc3bb70862845a65054cecb191e80b825d740fe6b40450359757032425dfdee92aec36ce4b468d50adc745c522cc4af2ac6e7f6a95f0edd70b09caa95fcc7143cf46b74db8bc17fa7c89f"}, 0xc3) [ 342.647320] binder: 11224:11231 ioctl 40046207 0 returned -16 [ 342.695323] binder: 11208:11212 ioctl c0306201 20008fd0 returned -22 14:03:56 executing program 3: syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f00000001c0)=[@acquire], 0x0, 0x0, 0x0}) 14:03:56 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f00000001c0)=[@acquire], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x4, 0x0, &(0x7f000000dff8)=ANY=[@ANYBLOB="0e630c40"], 0x0, 0x0, 0x0}) [ 342.736757] binder: BINDER_SET_CONTEXT_MGR already set 14:03:56 executing program 0: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(r0, 0x540b, 0x1) ioctl$KDSKBMODE(r0, 0x4b45, &(0x7f0000000000)) r1 = dup2(r0, r0) ioctl$ASHMEM_GET_NAME(r1, 0x81007702, &(0x7f0000000040)=""/254) 14:03:56 executing program 1: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSPTLCK(r0, 0x40045431, &(0x7f0000000180)) socket(0x200000000000011, 0x4000000000080002, 0x0) syz_open_procfs(0x0, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$cgroup_int(0xffffffffffffffff, 0x0, 0x2, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) openat$smack_thread_current(0xffffffffffffff9c, &(0x7f0000000240)='/proc/thread-self/attr/current\x00', 0x2, 0x0) write$cgroup_subtree(r1, &(0x7f0000000000)=ANY=[], 0x20032600) ioctl$TCSETAF(r0, 0x5408, &(0x7f0000000040)={0x2}) ioctl$EXT4_IOC_GROUP_ADD(r0, 0x40286608, &(0x7f0000000000)={0x3, 0x7000000, 0x400, 0x100000000, 0x0, 0x8}) ioctl$EVIOCGVERSION(0xffffffffffffffff, 0x80044501, &(0x7f0000000200)=""/31) 14:03:56 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f00000001c0)=[@acquire], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x4, 0x0, &(0x7f000000dff8)=ANY=[@ANYBLOB="0e630c40"], 0x0, 0x0, 0x0}) 14:03:56 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f00000001c0)=[@acquire], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0xfffffd57, 0x0, &(0x7f0000000280)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, &(0x7f0000000000)) 14:03:56 executing program 3: syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f00000001c0)=[@acquire], 0x0, 0x0, 0x0}) [ 342.761187] binder: 11238:11248 ioctl 40046207 0 returned -16 14:03:56 executing program 0: write(0xffffffffffffffff, &(0x7f0000000000)="b30d4a771e2d3a6c03a29866818c2880c42b35fbccfc580277837d3ba61f9102622f1a963a1a956772ea47d151dd3cfa379b3d356ab65267ae0370f6a765047e519975f9265a40f7e11248ecd29fc6df847c8f20a12ade155654dc08d49a09c52c5dc126a496b4e2c3bec5627891d75416", 0x71) init_module(&(0x7f0000000080)='(*-\x00', 0x4, &(0x7f00000000c0)='vboxnet0^-mime_type+\x00') ioctl$TCFLSH(0xffffffffffffffff, 0x540b, 0x1) r0 = socket$netlink(0x10, 0x3, 0x1d) fcntl$addseals(r0, 0x409, 0x8) 14:03:56 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f00000001c0)=[@acquire], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x4, 0x0, &(0x7f000000dff8)=ANY=[@ANYBLOB="0e630c40"], 0x0, 0x0, 0x0}) 14:03:56 executing program 3: syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f00000001c0)=[@acquire], 0x0, 0x0, 0x0}) [ 342.841887] binder: 11269:11275 unknown command 0 14:03:56 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f00000001c0)=[@acquire], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x6, 0x0, &(0x7f000000dff8)=ANY=[@ANYBLOB="0e630c408c0d"], 0x0, 0x0, 0x0}) [ 342.876901] binder: 11269:11275 ioctl c0306201 20008fd0 returned -22 [ 342.879461] binder: BINDER_SET_CONTEXT_MGR already set 14:03:56 executing program 3: syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f00000001c0)=[@acquire], 0x0, 0x0, 0x0}) 14:03:56 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSPTLCK(r0, 0x40045431, &(0x7f0000000180)) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) socket(0x200000000000011, 0x4000000000080002, 0x0) bind$packet(0xffffffffffffffff, 0x0, 0x0) sendmmsg(0xffffffffffffffff, &(0x7f0000007880)=[{{&(0x7f00000001c0)=@l2={0x1f, 0x0, {0x9, 0x7, 0xfffffffffffffdd5, 0x1ff, 0x2, 0x4}, 0x0, 0x7}, 0x80, 0x0}}, {{0x0, 0x0, &(0x7f0000007780)}}], 0x2, 0x4048851) setsockopt$packet_int(0xffffffffffffffff, 0x107, 0x0, 0x0, 0x0) syz_open_procfs(0x0, 0x0) ioctl$LOOP_SET_BLOCK_SIZE(0xffffffffffffffff, 0x4c09, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$cgroup_int(0xffffffffffffffff, 0x0, 0x2, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='\x89\x00\x00\x00\x00Ew\x00\x00\x00\xef\xb4\xc8\xd0\xff\xda\xb1vents\xd9\xc5H\xd4\x91\xfdN_]\x16\xe4\xa9C\xd2\x86Qn\xefS\x80\x11J\xfb4\x14\x86 4\x95\x9e\xfc\xc1\a\xcb \x95N\xe9\xa4j\xd2\x1f^\xb0\xb2>\xa3\xc9\xb7$\x11`t\x03: \x8b\xa4\x05\xf2?E\xdb+{t\xb8\xf7\xab\x8b\x100#', 0x26e1, 0x0) ioctl$PERF_EVENT_IOC_PAUSE_OUTPUT(r1, 0x40086602, 0x400007) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000280)='./cgroup/syz0\x00', 0x1ff) openat$smack_thread_current(0xffffffffffffff9c, &(0x7f0000000240)='/proc/thread-self/attr/current\x00', 0x2, 0x0) write$cgroup_subtree(r1, &(0x7f0000000100)=ANY=[], 0xff4a) write$cgroup_subtree(r2, &(0x7f0000000000)=ANY=[], 0x20032600) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a0f, 0x1700) accept$inet(0xffffffffffffffff, &(0x7f0000000040)={0x2, 0x0, @local}, &(0x7f0000000080)=0x10) ioctl$TCSETAF(r0, 0x5408, &(0x7f0000000040)={0x2}) ioctl$EXT4_IOC_GROUP_ADD(r0, 0x40286608, &(0x7f0000000000)={0x3, 0x7000000, 0x400, 0x100000000, 0x0, 0x8}) r3 = fcntl$dupfd(r0, 0x406, r0) ioctl$EVIOCGVERSION(r3, 0x80044501, &(0x7f0000000200)=""/31) write$binfmt_misc(r0, &(0x7f0000000080)={'syz1', "80fa25cdc862d216160cfa92845a3916e38a409a159c03f1889971d3e5144a8d08de78c4b1fbee457437261d7668b1c0f582647ad4134a05358d4309a71a702002329e024cac95642e761bb842bc1056bd6bf12c47697a649a026bd8ee1f685089941469b1ddfeddf32b392f0ff07652a3bce0770bc3bb70862845a65054cecb191e80b825d740fe6b40450359757032425dfdee92aec36ce4b468d50adc745c522cc4af2ac6e7f6a95f0edd70b09caa95fcc7143cf46b74db8bc17fa7c89f"}, 0xc3) 14:03:56 executing program 1: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSPTLCK(r0, 0x40045431, &(0x7f0000000180)) socket(0x200000000000011, 0x4000000000080002, 0x0) syz_open_procfs(0x0, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$cgroup_int(0xffffffffffffffff, 0x0, 0x2, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) openat$smack_thread_current(0xffffffffffffff9c, &(0x7f0000000240)='/proc/thread-self/attr/current\x00', 0x2, 0x0) write$cgroup_subtree(r1, &(0x7f0000000000)=ANY=[], 0x20032600) ioctl$TCSETAF(r0, 0x5408, &(0x7f0000000040)={0x2}) ioctl$EXT4_IOC_GROUP_ADD(r0, 0x40286608, &(0x7f0000000000)={0x3, 0x7000000, 0x400, 0x100000000, 0x0, 0x8}) ioctl$EVIOCGVERSION(0xffffffffffffffff, 0x80044501, &(0x7f0000000200)=""/31) 14:03:56 executing program 0: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/ptmx\x00', 0x0, 0x0) write$binfmt_misc(r0, &(0x7f0000000000)=ANY=[@ANYBLOB="73797a31065e29cd8aa8517910aa410f6a062c7726a76c5b95ba5046b53f06247f9b8be9f9157c20c3927d4de92194142ce3140e8e25296f08d94283b2ee5b770e819030e8ee122de828394874ff576bb41abcd18c9048f4c116b7ef581a30fa020453b58335c0ab040841f5fce5eb7df7b4087fa1c37204da50b487f296e5103cd40ad1db06520e47630051318c8b9be0d6769a1c97cebb4bd9fe7f7da024d2a51059772ef7c0dfa35a82a2a0168c80b2ca9de684514b1a5c21d8e80d6d5c7704b1e257b1e282704445d2e3096a6ee30df82477d87b84b1083d11f1d5dd3bdc2f2480e1ab36535158c92cee64"], 0xed) ioctl$TCFLSH(r0, 0x540b, 0x1) 14:03:56 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f00000001c0)=[@acquire], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x4, 0x0, &(0x7f000000dff8)=ANY=[@ANYBLOB="0e630c40"], 0x0, 0x0, 0x0}) 14:03:56 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f00000001c0)=[@acquire], 0x0, 0x0, 0x0}) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, &(0x7f0000000000)) 14:03:56 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, &(0x7f0000000000)) 14:03:56 executing program 0: openat$ptmx(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/ptmx\x00', 0x0, 0x0) r0 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000000)='hugetlb.2MB.usage_in_bytes\x00', 0x0, 0x0) write$UHID_DESTROY(r0, &(0x7f0000000080), 0x2812188e) [ 342.879468] binder: 11280:11281 ioctl 40046207 0 returned -16 [ 342.926469] binder: BINDER_SET_CONTEXT_MGR already set [ 342.926478] binder: 11289:11292 ioctl 40046207 0 returned -16 [ 342.936936] binder: 11289:11292 BC_REQUEST_DEATH_NOTIFICATION invalid ref 3468 14:03:56 executing program 3: syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f00000001c0)=[@acquire], 0x0, 0x0, 0x0}) 14:03:56 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f00000001c0)=[@acquire], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x4, 0x0, &(0x7f000000dff8)=ANY=[@ANYBLOB="0e630c40"], 0x0, 0x0, 0x0}) 14:03:56 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, &(0x7f0000000000)) 14:03:56 executing program 0: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(r0, 0x540b, 0x1) preadv(r0, &(0x7f0000000080)=[{&(0x7f0000000200)=""/4096, 0x1000}], 0x1, 0x0) r1 = openat$selinux_avc_hash_stats(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/avc/hash_stats\x00', 0x0, 0x0) openat$cgroup_ro(r1, &(0x7f0000000040)='cpuset.memory_pressure\x00', 0x0, 0x0) getgid() 14:03:56 executing program 3: syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) [ 343.103257] binder: 11331:11332 ioctl c0306201 0 returned -14 14:03:56 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSPTLCK(r0, 0x40045431, &(0x7f0000000180)) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) socket(0x200000000000011, 0x4000000000080002, 0x0) bind$packet(0xffffffffffffffff, 0x0, 0x0) sendmmsg(0xffffffffffffffff, &(0x7f0000007880)=[{{&(0x7f00000001c0)=@l2={0x1f, 0x0, {0x9, 0x7, 0xfffffffffffffdd5, 0x1ff, 0x2, 0x4}, 0x0, 0x7}, 0x80, 0x0}}, {{0x0, 0x0, &(0x7f0000007780)}}], 0x2, 0x4048851) setsockopt$packet_int(0xffffffffffffffff, 0x107, 0x0, 0x0, 0x0) syz_open_procfs(0x0, 0x0) ioctl$LOOP_SET_BLOCK_SIZE(0xffffffffffffffff, 0x4c09, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$cgroup_int(0xffffffffffffffff, 0x0, 0x2, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='\x89\x00\x00\x00\x00Ew\x00\x00\x00\xef\xb4\xc8\xd0\xff\xda\xb1vents\xd9\xc5H\xd4\x91\xfdN_]\x16\xe4\xa9C\xd2\x86Qn\xefS\x80\x11J\xfb4\x14\x86 4\x95\x9e\xfc\xc1\a\xcb \x95N\xe9\xa4j\xd2\x1f^\xb0\xb2>\xa3\xc9\xb7$\x11`t\x03: \x8b\xa4\x05\xf2?E\xdb+{t\xb8\xf7\xab\x8b\x100#', 0x26e1, 0x0) ioctl$PERF_EVENT_IOC_PAUSE_OUTPUT(r1, 0x40086602, 0x400007) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000280)='./cgroup/syz0\x00', 0x1ff) openat$smack_thread_current(0xffffffffffffff9c, &(0x7f0000000240)='/proc/thread-self/attr/current\x00', 0x2, 0x0) write$cgroup_subtree(r1, &(0x7f0000000100)=ANY=[], 0xff4a) write$cgroup_subtree(r2, &(0x7f0000000000)=ANY=[], 0x20032600) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a0f, 0x1700) accept$inet(0xffffffffffffffff, &(0x7f0000000040)={0x2, 0x0, @local}, &(0x7f0000000080)=0x10) ioctl$TCSETAF(r0, 0x5408, &(0x7f0000000040)={0x2}) ioctl$EXT4_IOC_GROUP_ADD(r0, 0x40286608, &(0x7f0000000000)={0x3, 0x7000000, 0x400, 0x100000000, 0x0, 0x8}) r3 = fcntl$dupfd(r0, 0x406, r0) ioctl$EVIOCGVERSION(r3, 0x80044501, &(0x7f0000000200)=""/31) write$binfmt_misc(r0, &(0x7f0000000080)={'syz1', "80fa25cdc862d216160cfa92845a3916e38a409a159c03f1889971d3e5144a8d08de78c4b1fbee457437261d7668b1c0f582647ad4134a05358d4309a71a702002329e024cac95642e761bb842bc1056bd6bf12c47697a649a026bd8ee1f685089941469b1ddfeddf32b392f0ff07652a3bce0770bc3bb70862845a65054cecb191e80b825d740fe6b40450359757032425dfdee92aec36ce4b468d50adc745c522cc4af2ac6e7f6a95f0edd70b09caa95fcc7143cf46b74db8bc17fa7c89f"}, 0xc3) 14:03:56 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f00000001c0)=[@acquire], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x4, 0x0, &(0x7f000000dff8)=ANY=[@ANYBLOB="0e630c40"], 0x0, 0x0, 0x0}) 14:03:56 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, &(0x7f0000000000)) 14:03:56 executing program 0: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/ptmx\x00', 0x0, 0x0) mkdir(&(0x7f00000002c0)='./file0\x00', 0x0) r1 = geteuid() syz_mount_image$vfat(&(0x7f0000000140)='vfat\x00', &(0x7f00000001c0)='./file0/file0\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f0000000500)=ANY=[@ANYBLOB='iocharset=utf8,utf8=1,nonumtail=0,nonumtail=0,uni_xlate=0,uni_xlate=0,shortname=mixed,shortname=lower,uid=', @ANYRESHEX=r1]) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") ioctl$TCFLSH(r0, 0x540b, 0x1) 14:03:56 executing program 3: syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) 14:03:56 executing program 1: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/ptmx\x00', 0x0, 0x0) socket(0x200000000000011, 0x4000000000080002, 0x0) syz_open_procfs(0x0, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$cgroup_int(0xffffffffffffffff, 0x0, 0x2, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) openat$smack_thread_current(0xffffffffffffff9c, &(0x7f0000000240)='/proc/thread-self/attr/current\x00', 0x2, 0x0) write$cgroup_subtree(r1, &(0x7f0000000000)=ANY=[], 0x20032600) ioctl$TCSETAF(r0, 0x5408, &(0x7f0000000040)={0x2}) ioctl$EXT4_IOC_GROUP_ADD(r0, 0x40286608, &(0x7f0000000000)={0x3, 0x7000000, 0x400, 0x100000000, 0x0, 0x8}) ioctl$EVIOCGVERSION(0xffffffffffffffff, 0x80044501, &(0x7f0000000200)=""/31) 14:03:56 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, &(0x7f0000000000)) 14:03:56 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f00000001c0)=[@acquire], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x5, 0x0, &(0x7f000000dff8)=ANY=[@ANYBLOB="0e630c408c"], 0x0, 0x0, 0x0}) 14:03:56 executing program 3: syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) [ 343.212093] binder: 11342:11351 ioctl c0306201 0 returned -14 [ 343.236265] FAT-fs (loop0): utf8 is not a recommended IO charset for FAT filesystems, filesystem will be case sensitive! 14:03:56 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f00000001c0)=[@acquire], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x4, 0x0, &(0x7f000000dff8)=ANY=[@ANYBLOB="0e630c40"], 0x0, 0x0, 0x0}) 14:03:56 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, &(0x7f0000000000)) 14:03:56 executing program 3: syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000012000)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) [ 343.258676] binder: 11358:11361 BC_REQUEST_DEATH_NOTIFICATION invalid ref 140 [ 343.283736] binder: 11362:11363 ioctl c0306201 0 returned -14 14:03:56 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSPTLCK(r0, 0x40045431, &(0x7f0000000180)) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) socket(0x200000000000011, 0x4000000000080002, 0x0) bind$packet(0xffffffffffffffff, 0x0, 0x0) sendmmsg(0xffffffffffffffff, &(0x7f0000007880)=[{{&(0x7f00000001c0)=@l2={0x1f, 0xbf53, {0x0, 0x7, 0xfffffffffffffdd5, 0x1ff, 0x2, 0x4}, 0x0, 0x7}, 0x80, 0x0}}, {{0x0, 0x0, &(0x7f0000007780)}}], 0x2, 0x4048851) setsockopt$packet_int(0xffffffffffffffff, 0x107, 0x0, 0x0, 0x0) syz_open_procfs(0x0, 0x0) ioctl$LOOP_SET_BLOCK_SIZE(0xffffffffffffffff, 0x4c09, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$cgroup_int(0xffffffffffffffff, 0x0, 0x2, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='\x89\x00\x00\x00\x00Ew\x00\x00\x00\xef\xb4\xc8\xd0\xff\xda\xb1vents\xd9\xc5H\xd4\x91\xfdN_]\x16\xe4\xa9C\xd2\x86Qn\xefS\x80\x11J\xfb4\x14\x86 4\x95\x9e\xfc\xc1\a\xcb \x95N\xe9\xa4j\xd2\x1f^\xb0\xb2>\xa3\xc9\xb7$\x11`t\x03: \x8b\xa4\x05\xf2?E\xdb+{t\xb8\xf7\xab\x8b\x100#', 0x26e1, 0x0) ioctl$PERF_EVENT_IOC_PAUSE_OUTPUT(r1, 0x40086602, 0x400007) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000280)='./cgroup/syz0\x00', 0x1ff) openat$smack_thread_current(0xffffffffffffff9c, &(0x7f0000000240)='/proc/thread-self/attr/current\x00', 0x2, 0x0) write$cgroup_subtree(r1, &(0x7f0000000100)=ANY=[], 0xff4a) write$cgroup_subtree(r2, &(0x7f0000000000)=ANY=[], 0x20032600) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a0f, 0x1700) accept$inet(0xffffffffffffffff, &(0x7f0000000040)={0x2, 0x0, @local}, &(0x7f0000000080)=0x10) ioctl$TCSETAF(r0, 0x5408, &(0x7f0000000040)={0x2}) ioctl$EXT4_IOC_GROUP_ADD(r0, 0x40286608, &(0x7f0000000000)={0x3, 0x7000000, 0x400, 0x100000000, 0x0, 0x8}) r3 = fcntl$dupfd(r0, 0x406, r0) ioctl$EVIOCGVERSION(r3, 0x80044501, &(0x7f0000000200)=""/31) write$binfmt_misc(r0, &(0x7f0000000080)={'syz1', "80fa25cdc862d216160cfa92845a3916e38a409a159c03f1889971d3e5144a8d08de78c4b1fbee457437261d7668b1c0f582647ad4134a05358d4309a71a702002329e024cac95642e761bb842bc1056bd6bf12c47697a649a026bd8ee1f685089941469b1ddfeddf32b392f0ff07652a3bce0770bc3bb70862845a65054cecb191e80b825d740fe6b40450359757032425dfdee92aec36ce4b468d50adc745c522cc4af2ac6e7f6a95f0edd70b09caa95fcc7143cf46b74db8bc17fa7c89f"}, 0xc3) 14:03:56 executing program 5: ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(0xffffffffffffffff, 0xc018620b, &(0x7f0000000000)) 14:03:56 executing program 1: socket(0x200000000000011, 0x4000000000080002, 0x0) syz_open_procfs(0x0, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$cgroup_int(0xffffffffffffffff, 0x0, 0x2, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) openat$smack_thread_current(0xffffffffffffff9c, &(0x7f0000000240)='/proc/thread-self/attr/current\x00', 0x2, 0x0) write$cgroup_subtree(r0, &(0x7f0000000000)=ANY=[], 0x20032600) ioctl$TCSETAF(0xffffffffffffffff, 0x5408, &(0x7f0000000040)={0x2}) ioctl$EXT4_IOC_GROUP_ADD(0xffffffffffffffff, 0x40286608, &(0x7f0000000000)={0x3, 0x7000000, 0x400, 0x100000000, 0x0, 0x8}) ioctl$EVIOCGVERSION(0xffffffffffffffff, 0x80044501, &(0x7f0000000200)=""/31) [ 343.319172] FAT-fs (loop0): bogus number of reserved sectors [ 343.331023] FAT-fs (loop0): Can't find a valid FAT filesystem 14:03:56 executing program 3: syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000012000)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) 14:03:56 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f00000001c0)=[@acquire], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x4, 0x0, &(0x7f000000dff8)=ANY=[@ANYBLOB="0e630c40"], 0x0, 0x0, 0x0}) 14:03:56 executing program 5: ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(0xffffffffffffffff, 0xc018620b, &(0x7f0000000000)) [ 343.380429] FAT-fs (loop0): utf8 is not a recommended IO charset for FAT filesystems, filesystem will be case sensitive! [ 343.402071] FAT-fs (loop0): bogus number of reserved sectors [ 343.409637] FAT-fs (loop0): Can't find a valid FAT filesystem 14:03:56 executing program 0: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(r0, 0x540b, 0x1) r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_inet_SIOCSIFFLAGS(r1, 0x8914, &(0x7f0000000040)={'hsr0\x00', 0x1900}) r2 = syz_open_procfs(0x0, &(0x7f0000000000)='net/icmp6\x00') ioctl$RTC_WIE_OFF(r2, 0x7010) 14:03:56 executing program 1: socket(0x200000000000011, 0x4000000000080002, 0x0) syz_open_procfs(0x0, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$cgroup_int(0xffffffffffffffff, 0x0, 0x2, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) openat$smack_thread_current(0xffffffffffffff9c, &(0x7f0000000240)='/proc/thread-self/attr/current\x00', 0x2, 0x0) write$cgroup_subtree(r0, &(0x7f0000000000)=ANY=[], 0x20032600) ioctl$TCSETAF(0xffffffffffffffff, 0x5408, &(0x7f0000000040)={0x2}) ioctl$EXT4_IOC_GROUP_ADD(0xffffffffffffffff, 0x40286608, &(0x7f0000000000)={0x3, 0x7000000, 0x400, 0x100000000, 0x0, 0x8}) ioctl$EVIOCGVERSION(0xffffffffffffffff, 0x80044501, &(0x7f0000000200)=""/31) 14:03:56 executing program 5: ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(0xffffffffffffffff, 0xc018620b, &(0x7f0000000000)) 14:03:57 executing program 3: syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000012000)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) 14:03:57 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSPTLCK(r0, 0x40045431, &(0x7f0000000180)) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) socket(0x200000000000011, 0x4000000000080002, 0x0) bind$packet(0xffffffffffffffff, 0x0, 0x0) sendmmsg(0xffffffffffffffff, &(0x7f0000007880)=[{{&(0x7f00000001c0)=@l2={0x1f, 0xbf53, {0x0, 0x7, 0xfffffffffffffdd5, 0x1ff, 0x2, 0x4}, 0x0, 0x7}, 0x80, 0x0}}, {{0x0, 0x0, &(0x7f0000007780)}}], 0x2, 0x4048851) setsockopt$packet_int(0xffffffffffffffff, 0x107, 0x0, 0x0, 0x0) syz_open_procfs(0x0, 0x0) ioctl$LOOP_SET_BLOCK_SIZE(0xffffffffffffffff, 0x4c09, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$cgroup_int(0xffffffffffffffff, 0x0, 0x2, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='\x89\x00\x00\x00\x00Ew\x00\x00\x00\xef\xb4\xc8\xd0\xff\xda\xb1vents\xd9\xc5H\xd4\x91\xfdN_]\x16\xe4\xa9C\xd2\x86Qn\xefS\x80\x11J\xfb4\x14\x86 4\x95\x9e\xfc\xc1\a\xcb \x95N\xe9\xa4j\xd2\x1f^\xb0\xb2>\xa3\xc9\xb7$\x11`t\x03: \x8b\xa4\x05\xf2?E\xdb+{t\xb8\xf7\xab\x8b\x100#', 0x26e1, 0x0) ioctl$PERF_EVENT_IOC_PAUSE_OUTPUT(r1, 0x40086602, 0x400007) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000280)='./cgroup/syz0\x00', 0x1ff) openat$smack_thread_current(0xffffffffffffff9c, &(0x7f0000000240)='/proc/thread-self/attr/current\x00', 0x2, 0x0) write$cgroup_subtree(r1, &(0x7f0000000100)=ANY=[], 0xff4a) write$cgroup_subtree(r2, &(0x7f0000000000)=ANY=[], 0x20032600) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a0f, 0x1700) accept$inet(0xffffffffffffffff, &(0x7f0000000040)={0x2, 0x0, @local}, &(0x7f0000000080)=0x10) ioctl$TCSETAF(r0, 0x5408, &(0x7f0000000040)={0x2}) ioctl$EXT4_IOC_GROUP_ADD(r0, 0x40286608, &(0x7f0000000000)={0x3, 0x7000000, 0x400, 0x100000000, 0x0, 0x8}) r3 = fcntl$dupfd(r0, 0x406, r0) ioctl$EVIOCGVERSION(r3, 0x80044501, &(0x7f0000000200)=""/31) write$binfmt_misc(r0, &(0x7f0000000080)={'syz1', "80fa25cdc862d216160cfa92845a3916e38a409a159c03f1889971d3e5144a8d08de78c4b1fbee457437261d7668b1c0f582647ad4134a05358d4309a71a702002329e024cac95642e761bb842bc1056bd6bf12c47697a649a026bd8ee1f685089941469b1ddfeddf32b392f0ff07652a3bce0770bc3bb70862845a65054cecb191e80b825d740fe6b40450359757032425dfdee92aec36ce4b468d50adc745c522cc4af2ac6e7f6a95f0edd70b09caa95fcc7143cf46b74db8bc17fa7c89f"}, 0xc3) 14:03:57 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f00000001c0)=[@acquire], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x4, 0x0, &(0x7f000000dff8)=ANY=[@ANYBLOB="0e630c40"], 0x0, 0x0, 0x0}) 14:03:57 executing program 1: socket(0x0, 0x4000000000080002, 0x0) syz_open_procfs(0x0, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$cgroup_int(0xffffffffffffffff, 0x0, 0x2, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) openat$smack_thread_current(0xffffffffffffff9c, &(0x7f0000000240)='/proc/thread-self/attr/current\x00', 0x2, 0x0) write$cgroup_subtree(r0, &(0x7f0000000000)=ANY=[], 0x20032600) ioctl$TCSETAF(0xffffffffffffffff, 0x5408, &(0x7f0000000040)={0x2}) ioctl$EXT4_IOC_GROUP_ADD(0xffffffffffffffff, 0x40286608, &(0x7f0000000000)={0x3, 0x7000000, 0x400, 0x100000000, 0x0, 0x8}) ioctl$EVIOCGVERSION(0xffffffffffffffff, 0x80044501, &(0x7f0000000200)=""/31) 14:03:57 executing program 4: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSPTLCK(r0, 0x40045431, &(0x7f0000000180)) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) socket(0x200000000000011, 0x4000000000080002, 0x0) bind$packet(0xffffffffffffffff, 0x0, 0x0) sendmmsg(0xffffffffffffffff, &(0x7f0000007880)=[{{&(0x7f00000001c0)=@l2={0x1f, 0x0, {0x9, 0x7, 0xfffffffffffffdd5, 0x1ff, 0x2, 0x4}, 0x0, 0x7}, 0x80, 0x0}}, {{0x0, 0x0, &(0x7f0000007780)}}], 0x2, 0x4048851) setsockopt$packet_int(0xffffffffffffffff, 0x107, 0x0, 0x0, 0x0) syz_open_procfs(0x0, 0x0) ioctl$LOOP_SET_BLOCK_SIZE(0xffffffffffffffff, 0x4c09, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$cgroup_int(0xffffffffffffffff, 0x0, 0x2, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='\x89\x00\x00\x00\x00Ew\x00\x00\x00\xef\xb4\xc8\xd0\xff\xda\xb1vents\xd9\xc5H\xd4\x91\xfdN_]\x16\xe4\xa9C\xd2\x86Qn\xefS\x80\x11J\xfb4\x14\x86 4\x95\x9e\xfc\xc1\a\xcb \x95N\xe9\xa4j\xd2\x1f^\xb0\xb2>\xa3\xc9\xb7$\x11`t\x03: \x8b\xa4\x05\xf2?E\xdb+{t\xb8\xf7\xab\x8b\x100#', 0x26e1, 0x0) ioctl$PERF_EVENT_IOC_PAUSE_OUTPUT(r1, 0x40086602, 0x400007) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000280)='./cgroup/syz0\x00', 0x1ff) openat$smack_thread_current(0xffffffffffffff9c, &(0x7f0000000240)='/proc/thread-self/attr/current\x00', 0x2, 0x0) write$cgroup_subtree(r1, &(0x7f0000000100)=ANY=[], 0xff4a) write$cgroup_subtree(r2, &(0x7f0000000000)=ANY=[], 0x20032600) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a0f, 0x1700) accept$inet(0xffffffffffffffff, &(0x7f0000000040)={0x2, 0x0, @local}, &(0x7f0000000080)=0x10) ioctl$TCSETAF(r0, 0x5408, &(0x7f0000000040)={0x2}) ioctl$EXT4_IOC_GROUP_ADD(r0, 0x40286608, &(0x7f0000000000)={0x3, 0x7000000, 0x400, 0x100000000, 0x0, 0x8}) r3 = fcntl$dupfd(r0, 0x406, r0) ioctl$EVIOCGVERSION(r3, 0x80044501, &(0x7f0000000200)=""/31) write$binfmt_misc(r0, &(0x7f0000000080)={'syz1', "80fa25cdc862d216160cfa92845a3916e38a409a159c03f1889971d3e5144a8d08de78c4b1fbee457437261d7668b1c0f582647ad4134a05358d4309a71a702002329e024cac95642e761bb842bc1056bd6bf12c47697a649a026bd8ee1f685089941469b1ddfeddf32b392f0ff07652a3bce0770bc3bb70862845a65054cecb191e80b825d740fe6b40450359757032425dfdee92aec36ce4b468d50adc745c522cc4af2ac6e7f6a95f0edd70b09caa95fcc7143cf46b74db8bc17fa7c89f"}, 0xc3) 14:03:57 executing program 5: r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, &(0x7f0000000000)) 14:03:57 executing program 3: syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000012000)={0x0, 0x0, &(0x7f00000001c0), 0x0, 0x0, 0x0}) 14:03:57 executing program 0: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCVHANGUP(r0, 0x5437, 0x0) ioctl$TCFLSH(r0, 0x540b, 0x1) r1 = fcntl$getown(r0, 0x9) ptrace$pokeuser(0x6, r1, 0xac0, 0x7) 14:03:57 executing program 1: socket(0x0, 0x0, 0x0) syz_open_procfs(0x0, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$cgroup_int(0xffffffffffffffff, 0x0, 0x2, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) openat$smack_thread_current(0xffffffffffffff9c, &(0x7f0000000240)='/proc/thread-self/attr/current\x00', 0x2, 0x0) write$cgroup_subtree(r0, &(0x7f0000000000)=ANY=[], 0x20032600) ioctl$TCSETAF(0xffffffffffffffff, 0x5408, &(0x7f0000000040)={0x2}) ioctl$EXT4_IOC_GROUP_ADD(0xffffffffffffffff, 0x40286608, &(0x7f0000000000)={0x3, 0x7000000, 0x400, 0x100000000, 0x0, 0x8}) ioctl$EVIOCGVERSION(0xffffffffffffffff, 0x80044501, &(0x7f0000000200)=""/31) 14:03:57 executing program 5: r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, &(0x7f0000000000)) 14:03:57 executing program 3: syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000012000)={0x0, 0x0, &(0x7f00000001c0), 0x0, 0x0, 0x0}) 14:03:57 executing program 0: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(r0, 0x540b, 0x1) r1 = creat(&(0x7f0000000000)='./file0\x00', 0x81) ioctl$BLKROGET(r1, 0x125e, &(0x7f00000000c0)) removexattr(&(0x7f0000000140)='./file0\x00', &(0x7f0000000240)=@random={'system.', '\x00'}) prctl$PR_CAPBSET_DROP(0x18, 0xc) syz_open_dev$sndtimer(&(0x7f0000000080)='/dev/snd/timer\x00', 0x0, 0x10000) 14:03:57 executing program 3: syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000012000)={0x0, 0x0, &(0x7f00000001c0), 0x0, 0x0, 0x0}) 14:03:57 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSPTLCK(r0, 0x40045431, &(0x7f0000000180)) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) socket(0x200000000000011, 0x4000000000080002, 0x0) bind$packet(0xffffffffffffffff, 0x0, 0x0) sendmmsg(0xffffffffffffffff, &(0x7f0000007880)=[{{&(0x7f00000001c0)=@l2={0x1f, 0xbf53, {0x0, 0x7, 0xfffffffffffffdd5, 0x1ff, 0x2, 0x4}, 0x0, 0x7}, 0x80, 0x0}}, {{0x0, 0x0, &(0x7f0000007780)}}], 0x2, 0x4048851) setsockopt$packet_int(0xffffffffffffffff, 0x107, 0x0, 0x0, 0x0) syz_open_procfs(0x0, 0x0) ioctl$LOOP_SET_BLOCK_SIZE(0xffffffffffffffff, 0x4c09, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$cgroup_int(0xffffffffffffffff, 0x0, 0x2, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='\x89\x00\x00\x00\x00Ew\x00\x00\x00\xef\xb4\xc8\xd0\xff\xda\xb1vents\xd9\xc5H\xd4\x91\xfdN_]\x16\xe4\xa9C\xd2\x86Qn\xefS\x80\x11J\xfb4\x14\x86 4\x95\x9e\xfc\xc1\a\xcb \x95N\xe9\xa4j\xd2\x1f^\xb0\xb2>\xa3\xc9\xb7$\x11`t\x03: \x8b\xa4\x05\xf2?E\xdb+{t\xb8\xf7\xab\x8b\x100#', 0x26e1, 0x0) ioctl$PERF_EVENT_IOC_PAUSE_OUTPUT(r1, 0x40086602, 0x400007) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000280)='./cgroup/syz0\x00', 0x1ff) openat$smack_thread_current(0xffffffffffffff9c, &(0x7f0000000240)='/proc/thread-self/attr/current\x00', 0x2, 0x0) write$cgroup_subtree(r1, &(0x7f0000000100)=ANY=[], 0xff4a) write$cgroup_subtree(r2, &(0x7f0000000000)=ANY=[], 0x20032600) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a0f, 0x1700) accept$inet(0xffffffffffffffff, &(0x7f0000000040)={0x2, 0x0, @local}, &(0x7f0000000080)=0x10) ioctl$TCSETAF(r0, 0x5408, &(0x7f0000000040)={0x2}) ioctl$EXT4_IOC_GROUP_ADD(r0, 0x40286608, &(0x7f0000000000)={0x3, 0x7000000, 0x400, 0x100000000, 0x0, 0x8}) r3 = fcntl$dupfd(r0, 0x406, r0) ioctl$EVIOCGVERSION(r3, 0x80044501, &(0x7f0000000200)=""/31) write$binfmt_misc(r0, &(0x7f0000000080)={'syz1', "80fa25cdc862d216160cfa92845a3916e38a409a159c03f1889971d3e5144a8d08de78c4b1fbee457437261d7668b1c0f582647ad4134a05358d4309a71a702002329e024cac95642e761bb842bc1056bd6bf12c47697a649a026bd8ee1f685089941469b1ddfeddf32b392f0ff07652a3bce0770bc3bb70862845a65054cecb191e80b825d740fe6b40450359757032425dfdee92aec36ce4b468d50adc745c522cc4af2ac6e7f6a95f0edd70b09caa95fcc7143cf46b74db8bc17fa7c89f"}, 0xc3) 14:03:57 executing program 5: r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, &(0x7f0000000000)) 14:03:57 executing program 3: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSPTLCK(r0, 0x40045431, &(0x7f0000000180)) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) socket(0x200000000000011, 0x4000000000080002, 0x0) bind$packet(0xffffffffffffffff, 0x0, 0x0) sendmmsg(0xffffffffffffffff, &(0x7f0000007880)=[{{&(0x7f00000001c0)=@l2={0x1f, 0x0, {0x9, 0x7, 0xfffffffffffffdd5, 0x1ff, 0x2, 0x4}, 0x0, 0x7}, 0x80, 0x0}}, {{0x0, 0x0, &(0x7f0000007780)}}], 0x2, 0x4048851) setsockopt$packet_int(0xffffffffffffffff, 0x107, 0x0, 0x0, 0x0) syz_open_procfs(0x0, 0x0) ioctl$LOOP_SET_BLOCK_SIZE(0xffffffffffffffff, 0x4c09, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$cgroup_int(0xffffffffffffffff, 0x0, 0x2, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='\x89\x00\x00\x00\x00Ew\x00\x00\x00\xef\xb4\xc8\xd0\xff\xda\xb1vents\xd9\xc5H\xd4\x91\xfdN_]\x16\xe4\xa9C\xd2\x86Qn\xefS\x80\x11J\xfb4\x14\x86 4\x95\x9e\xfc\xc1\a\xcb \x95N\xe9\xa4j\xd2\x1f^\xb0\xb2>\xa3\xc9\xb7$\x11`t\x03: \x8b\xa4\x05\xf2?E\xdb+{t\xb8\xf7\xab\x8b\x100#', 0x26e1, 0x0) ioctl$PERF_EVENT_IOC_PAUSE_OUTPUT(r1, 0x40086602, 0x400007) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000280)='./cgroup/syz0\x00', 0x1ff) openat$smack_thread_current(0xffffffffffffff9c, &(0x7f0000000240)='/proc/thread-self/attr/current\x00', 0x2, 0x0) write$cgroup_subtree(r1, &(0x7f0000000100)=ANY=[], 0xff4a) write$cgroup_subtree(r2, &(0x7f0000000000)=ANY=[], 0x20032600) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a0f, 0x1700) accept$inet(0xffffffffffffffff, &(0x7f0000000040)={0x2, 0x0, @local}, &(0x7f0000000080)=0x10) ioctl$TCSETAF(r0, 0x5408, &(0x7f0000000040)={0x2}) ioctl$EXT4_IOC_GROUP_ADD(r0, 0x40286608, &(0x7f0000000000)={0x3, 0x7000000, 0x400, 0x100000000, 0x0, 0x8}) r3 = fcntl$dupfd(r0, 0x406, r0) ioctl$EVIOCGVERSION(r3, 0x80044501, &(0x7f0000000200)=""/31) write$binfmt_misc(r0, &(0x7f0000000080)={'syz1', "80fa25cdc862d216160cfa92845a3916e38a409a159c03f1889971d3e5144a8d08de78c4b1fbee457437261d7668b1c0f582647ad4134a05358d4309a71a702002329e024cac95642e761bb842bc1056bd6bf12c47697a649a026bd8ee1f685089941469b1ddfeddf32b392f0ff07652a3bce0770bc3bb70862845a65054cecb191e80b825d740fe6b40450359757032425dfdee92aec36ce4b468d50adc745c522cc4af2ac6e7f6a95f0edd70b09caa95fcc7143cf46b74db8bc17fa7c89f"}, 0xc3) 14:03:57 executing program 4: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSPTLCK(r0, 0x40045431, &(0x7f0000000180)) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) socket(0x200000000000011, 0x4000000000080002, 0x0) bind$packet(0xffffffffffffffff, 0x0, 0x0) sendmmsg(0xffffffffffffffff, &(0x7f0000007880)=[{{&(0x7f00000001c0)=@l2={0x1f, 0xbf53, {0x0, 0x7, 0xfffffffffffffdd5, 0x1ff, 0x2, 0x4}, 0x0, 0x7}, 0x80, 0x0}}, {{0x0, 0x0, &(0x7f0000007780)}}], 0x2, 0x4048851) setsockopt$packet_int(0xffffffffffffffff, 0x107, 0x0, 0x0, 0x0) syz_open_procfs(0x0, 0x0) ioctl$LOOP_SET_BLOCK_SIZE(0xffffffffffffffff, 0x4c09, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$cgroup_int(0xffffffffffffffff, 0x0, 0x2, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='\x89\x00\x00\x00\x00Ew\x00\x00\x00\xef\xb4\xc8\xd0\xff\xda\xb1vents\xd9\xc5H\xd4\x91\xfdN_]\x16\xe4\xa9C\xd2\x86Qn\xefS\x80\x11J\xfb4\x14\x86 4\x95\x9e\xfc\xc1\a\xcb \x95N\xe9\xa4j\xd2\x1f^\xb0\xb2>\xa3\xc9\xb7$\x11`t\x03: \x8b\xa4\x05\xf2?E\xdb+{t\xb8\xf7\xab\x8b\x100#', 0x26e1, 0x0) ioctl$PERF_EVENT_IOC_PAUSE_OUTPUT(r1, 0x40086602, 0x400007) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000280)='./cgroup/syz0\x00', 0x1ff) openat$smack_thread_current(0xffffffffffffff9c, &(0x7f0000000240)='/proc/thread-self/attr/current\x00', 0x2, 0x0) write$cgroup_subtree(r1, &(0x7f0000000100)=ANY=[], 0xff4a) write$cgroup_subtree(r2, &(0x7f0000000000)=ANY=[], 0x20032600) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a0f, 0x1700) accept$inet(0xffffffffffffffff, &(0x7f0000000040)={0x2, 0x0, @local}, &(0x7f0000000080)=0x10) ioctl$TCSETAF(r0, 0x5408, &(0x7f0000000040)={0x2}) ioctl$EXT4_IOC_GROUP_ADD(r0, 0x40286608, &(0x7f0000000000)={0x3, 0x7000000, 0x400, 0x100000000, 0x0, 0x8}) r3 = fcntl$dupfd(r0, 0x406, r0) ioctl$EVIOCGVERSION(r3, 0x80044501, &(0x7f0000000200)=""/31) write$binfmt_misc(r0, &(0x7f0000000080)={'syz1', "80fa25cdc862d216160cfa92845a3916e38a409a159c03f1889971d3e5144a8d08de78c4b1fbee457437261d7668b1c0f582647ad4134a05358d4309a71a702002329e024cac95642e761bb842bc1056bd6bf12c47697a649a026bd8ee1f685089941469b1ddfeddf32b392f0ff07652a3bce0770bc3bb70862845a65054cecb191e80b825d740fe6b40450359757032425dfdee92aec36ce4b468d50adc745c522cc4af2ac6e7f6a95f0edd70b09caa95fcc7143cf46b74db8bc17fa7c89f"}, 0xc3) 14:03:57 executing program 1: socket(0x0, 0x0, 0x0) syz_open_procfs(0x0, 0x0) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$cgroup_int(0xffffffffffffffff, 0x0, 0x2, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) openat$smack_thread_current(0xffffffffffffff9c, &(0x7f0000000240)='/proc/thread-self/attr/current\x00', 0x2, 0x0) write$cgroup_subtree(r0, &(0x7f0000000000)=ANY=[], 0x20032600) ioctl$TCSETAF(0xffffffffffffffff, 0x5408, &(0x7f0000000040)={0x2}) ioctl$EXT4_IOC_GROUP_ADD(0xffffffffffffffff, 0x40286608, &(0x7f0000000000)={0x3, 0x7000000, 0x400, 0x100000000, 0x0, 0x8}) ioctl$EVIOCGVERSION(0xffffffffffffffff, 0x80044501, &(0x7f0000000200)=""/31) 14:03:57 executing program 0: r0 = openat$selinux_checkreqprot(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/checkreqprot\x00', 0x200000, 0x0) recvfrom$inet6(r0, &(0x7f00000000c0)=""/8, 0x8, 0x2062, &(0x7f0000000100)={0xa, 0x4e20, 0x400, @mcast2, 0x20}, 0x1c) ioctl$KDGKBTYPE(r0, 0x4b33, &(0x7f0000000040)) ioctl$TIOCGWINSZ(r0, 0x5413, &(0x7f0000000080)) r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(r1, 0x540b, 0xc22d) ioctl$TCFLSH(r1, 0x540b, 0x1) 14:03:57 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, &(0x7f0000000000)) 14:03:57 executing program 1: socket(0x0, 0x0, 0x0) syz_open_procfs(0x0, 0x0) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$cgroup_int(0xffffffffffffffff, 0x0, 0x2, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) openat$smack_thread_current(0xffffffffffffff9c, &(0x7f0000000240)='/proc/thread-self/attr/current\x00', 0x2, 0x0) write$cgroup_subtree(r0, &(0x7f0000000000)=ANY=[], 0x20032600) ioctl$TCSETAF(0xffffffffffffffff, 0x5408, &(0x7f0000000040)={0x2}) ioctl$EXT4_IOC_GROUP_ADD(0xffffffffffffffff, 0x40286608, &(0x7f0000000000)={0x3, 0x7000000, 0x400, 0x100000000, 0x0, 0x8}) ioctl$EVIOCGVERSION(0xffffffffffffffff, 0x80044501, &(0x7f0000000200)=""/31) 14:03:57 executing program 0: r0 = accept4$packet(0xffffffffffffffff, &(0x7f0000000000)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @remote}, &(0x7f0000000040)=0x14, 0x80000) getsockopt$IP_VS_SO_GET_SERVICES(r0, 0x0, 0x482, &(0x7f0000000080)=""/113, &(0x7f0000000100)=0x71) r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(r1, 0x540b, 0x1) 14:03:57 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, &(0x7f0000000000)) 14:03:57 executing program 0: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/ptmx\x00', 0x1, 0x0) ioctl$TCFLSH(r0, 0x540b, 0x7fffffff) ioctl$TCGETS(r0, 0x5401, &(0x7f0000000000)) 14:03:57 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, &(0x7f0000000000)) 14:03:57 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSPTLCK(r0, 0x40045431, &(0x7f0000000180)) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) socket(0x200000000000011, 0x4000000000080002, 0x0) bind$packet(0xffffffffffffffff, 0x0, 0x0) sendmmsg(0xffffffffffffffff, &(0x7f0000007880)=[{{&(0x7f00000001c0)=@l2={0x1f, 0xbf53, {0x9, 0x0, 0xfffffffffffffdd5, 0x1ff, 0x2, 0x4}, 0x0, 0x7}, 0x80, 0x0}}, {{0x0, 0x0, &(0x7f0000007780)}}], 0x2, 0x4048851) setsockopt$packet_int(0xffffffffffffffff, 0x107, 0x0, 0x0, 0x0) syz_open_procfs(0x0, 0x0) ioctl$LOOP_SET_BLOCK_SIZE(0xffffffffffffffff, 0x4c09, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$cgroup_int(0xffffffffffffffff, 0x0, 0x2, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='\x89\x00\x00\x00\x00Ew\x00\x00\x00\xef\xb4\xc8\xd0\xff\xda\xb1vents\xd9\xc5H\xd4\x91\xfdN_]\x16\xe4\xa9C\xd2\x86Qn\xefS\x80\x11J\xfb4\x14\x86 4\x95\x9e\xfc\xc1\a\xcb \x95N\xe9\xa4j\xd2\x1f^\xb0\xb2>\xa3\xc9\xb7$\x11`t\x03: \x8b\xa4\x05\xf2?E\xdb+{t\xb8\xf7\xab\x8b\x100#', 0x26e1, 0x0) ioctl$PERF_EVENT_IOC_PAUSE_OUTPUT(r1, 0x40086602, 0x400007) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000280)='./cgroup/syz0\x00', 0x1ff) openat$smack_thread_current(0xffffffffffffff9c, &(0x7f0000000240)='/proc/thread-self/attr/current\x00', 0x2, 0x0) write$cgroup_subtree(r1, &(0x7f0000000100)=ANY=[], 0xff4a) write$cgroup_subtree(r2, &(0x7f0000000000)=ANY=[], 0x20032600) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a0f, 0x1700) accept$inet(0xffffffffffffffff, &(0x7f0000000040)={0x2, 0x0, @local}, &(0x7f0000000080)=0x10) ioctl$TCSETAF(r0, 0x5408, &(0x7f0000000040)={0x2}) ioctl$EXT4_IOC_GROUP_ADD(r0, 0x40286608, &(0x7f0000000000)={0x3, 0x7000000, 0x400, 0x100000000, 0x0, 0x8}) r3 = fcntl$dupfd(r0, 0x406, r0) ioctl$EVIOCGVERSION(r3, 0x80044501, &(0x7f0000000200)=""/31) write$binfmt_misc(r0, &(0x7f0000000080)={'syz1', "80fa25cdc862d216160cfa92845a3916e38a409a159c03f1889971d3e5144a8d08de78c4b1fbee457437261d7668b1c0f582647ad4134a05358d4309a71a702002329e024cac95642e761bb842bc1056bd6bf12c47697a649a026bd8ee1f685089941469b1ddfeddf32b392f0ff07652a3bce0770bc3bb70862845a65054cecb191e80b825d740fe6b40450359757032425dfdee92aec36ce4b468d50adc745c522cc4af2ac6e7f6a95f0edd70b09caa95fcc7143cf46b74db8bc17fa7c89f"}, 0xc3) 14:03:57 executing program 3: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSPTLCK(r0, 0x40045431, &(0x7f0000000180)) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) socket(0x200000000000011, 0x4000000000080002, 0x0) bind$packet(0xffffffffffffffff, 0x0, 0x0) sendmmsg(0xffffffffffffffff, &(0x7f0000007880)=[{{&(0x7f00000001c0)=@l2={0x1f, 0xbf53, {0x0, 0x7, 0xfffffffffffffdd5, 0x1ff, 0x2, 0x4}, 0x0, 0x7}, 0x80, 0x0}}, {{0x0, 0x0, &(0x7f0000007780)}}], 0x2, 0x4048851) setsockopt$packet_int(0xffffffffffffffff, 0x107, 0x0, 0x0, 0x0) syz_open_procfs(0x0, 0x0) ioctl$LOOP_SET_BLOCK_SIZE(0xffffffffffffffff, 0x4c09, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$cgroup_int(0xffffffffffffffff, 0x0, 0x2, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='\x89\x00\x00\x00\x00Ew\x00\x00\x00\xef\xb4\xc8\xd0\xff\xda\xb1vents\xd9\xc5H\xd4\x91\xfdN_]\x16\xe4\xa9C\xd2\x86Qn\xefS\x80\x11J\xfb4\x14\x86 4\x95\x9e\xfc\xc1\a\xcb \x95N\xe9\xa4j\xd2\x1f^\xb0\xb2>\xa3\xc9\xb7$\x11`t\x03: \x8b\xa4\x05\xf2?E\xdb+{t\xb8\xf7\xab\x8b\x100#', 0x26e1, 0x0) ioctl$PERF_EVENT_IOC_PAUSE_OUTPUT(r1, 0x40086602, 0x400007) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000280)='./cgroup/syz0\x00', 0x1ff) openat$smack_thread_current(0xffffffffffffff9c, &(0x7f0000000240)='/proc/thread-self/attr/current\x00', 0x2, 0x0) write$cgroup_subtree(r1, &(0x7f0000000100)=ANY=[], 0xff4a) write$cgroup_subtree(r2, &(0x7f0000000000)=ANY=[], 0x20032600) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a0f, 0x1700) accept$inet(0xffffffffffffffff, &(0x7f0000000040)={0x2, 0x0, @local}, &(0x7f0000000080)=0x10) ioctl$TCSETAF(r0, 0x5408, &(0x7f0000000040)={0x2}) ioctl$EXT4_IOC_GROUP_ADD(r0, 0x40286608, &(0x7f0000000000)={0x3, 0x7000000, 0x400, 0x100000000, 0x0, 0x8}) r3 = fcntl$dupfd(r0, 0x406, r0) ioctl$EVIOCGVERSION(r3, 0x80044501, &(0x7f0000000200)=""/31) write$binfmt_misc(r0, &(0x7f0000000080)={'syz1', "80fa25cdc862d216160cfa92845a3916e38a409a159c03f1889971d3e5144a8d08de78c4b1fbee457437261d7668b1c0f582647ad4134a05358d4309a71a702002329e024cac95642e761bb842bc1056bd6bf12c47697a649a026bd8ee1f685089941469b1ddfeddf32b392f0ff07652a3bce0770bc3bb70862845a65054cecb191e80b825d740fe6b40450359757032425dfdee92aec36ce4b468d50adc745c522cc4af2ac6e7f6a95f0edd70b09caa95fcc7143cf46b74db8bc17fa7c89f"}, 0xc3) 14:03:57 executing program 1: socket(0x0, 0x0, 0x0) syz_open_procfs(0x0, 0x0) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$cgroup_int(0xffffffffffffffff, 0x0, 0x2, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) openat$smack_thread_current(0xffffffffffffff9c, &(0x7f0000000240)='/proc/thread-self/attr/current\x00', 0x2, 0x0) write$cgroup_subtree(r0, &(0x7f0000000000)=ANY=[], 0x20032600) ioctl$TCSETAF(0xffffffffffffffff, 0x5408, &(0x7f0000000040)={0x2}) ioctl$EXT4_IOC_GROUP_ADD(0xffffffffffffffff, 0x40286608, &(0x7f0000000000)={0x3, 0x7000000, 0x400, 0x100000000, 0x0, 0x8}) ioctl$EVIOCGVERSION(0xffffffffffffffff, 0x80044501, &(0x7f0000000200)=""/31) 14:03:57 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(0xffffffffffffffff, 0xc018620b, &(0x7f0000000000)) 14:03:57 executing program 0: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/ptmx\x00', 0x0, 0x0) r1 = openat$selinux_checkreqprot(0xffffffffffffff9c, &(0x7f0000000040)='/selinux/checkreqprot\x00', 0x8000, 0x0) getsockopt$IP6T_SO_GET_REVISION_TARGET(r1, 0x29, 0x45, &(0x7f0000000080)={'ipvs\x00'}, &(0x7f00000000c0)=0x1e) ioctl$TCFLSH(r0, 0x540b, 0x1) ioctl$TIOCGPGRP(r0, 0x540f, &(0x7f0000000000)) 14:03:57 executing program 4: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSPTLCK(r0, 0x40045431, &(0x7f0000000180)) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) socket(0x200000000000011, 0x4000000000080002, 0x0) bind$packet(0xffffffffffffffff, 0x0, 0x0) sendmmsg(0xffffffffffffffff, &(0x7f0000007880)=[{{&(0x7f00000001c0)=@l2={0x1f, 0x0, {0x9, 0x7, 0xfffffffffffffdd5, 0x1ff, 0x2, 0x4}, 0x0, 0x7}, 0x80, 0x0}}, {{0x0, 0x0, &(0x7f0000007780)}}], 0x2, 0x4048851) setsockopt$packet_int(0xffffffffffffffff, 0x107, 0x0, 0x0, 0x0) syz_open_procfs(0x0, 0x0) ioctl$LOOP_SET_BLOCK_SIZE(0xffffffffffffffff, 0x4c09, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$cgroup_int(0xffffffffffffffff, 0x0, 0x2, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='\x89\x00\x00\x00\x00Ew\x00\x00\x00\xef\xb4\xc8\xd0\xff\xda\xb1vents\xd9\xc5H\xd4\x91\xfdN_]\x16\xe4\xa9C\xd2\x86Qn\xefS\x80\x11J\xfb4\x14\x86 4\x95\x9e\xfc\xc1\a\xcb \x95N\xe9\xa4j\xd2\x1f^\xb0\xb2>\xa3\xc9\xb7$\x11`t\x03: \x8b\xa4\x05\xf2?E\xdb+{t\xb8\xf7\xab\x8b\x100#', 0x26e1, 0x0) ioctl$PERF_EVENT_IOC_PAUSE_OUTPUT(r1, 0x40086602, 0x400007) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000280)='./cgroup/syz0\x00', 0x1ff) openat$smack_thread_current(0xffffffffffffff9c, &(0x7f0000000240)='/proc/thread-self/attr/current\x00', 0x2, 0x0) write$cgroup_subtree(r1, &(0x7f0000000100)=ANY=[], 0xff4a) write$cgroup_subtree(r2, &(0x7f0000000000)=ANY=[], 0x20032600) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a0f, 0x1700) accept$inet(0xffffffffffffffff, &(0x7f0000000040)={0x2, 0x0, @local}, &(0x7f0000000080)=0x10) ioctl$TCSETAF(r0, 0x5408, &(0x7f0000000040)={0x2}) ioctl$EXT4_IOC_GROUP_ADD(r0, 0x40286608, &(0x7f0000000000)={0x3, 0x7000000, 0x400, 0x100000000, 0x0, 0x8}) r3 = fcntl$dupfd(r0, 0x406, r0) ioctl$EVIOCGVERSION(r3, 0x80044501, &(0x7f0000000200)=""/31) write$binfmt_misc(r0, &(0x7f0000000080)={'syz1', "80fa25cdc862d216160cfa92845a3916e38a409a159c03f1889971d3e5144a8d08de78c4b1fbee457437261d7668b1c0f582647ad4134a05358d4309a71a702002329e024cac95642e761bb842bc1056bd6bf12c47697a649a026bd8ee1f685089941469b1ddfeddf32b392f0ff07652a3bce0770bc3bb70862845a65054cecb191e80b825d740fe6b40450359757032425dfdee92aec36ce4b468d50adc745c522cc4af2ac6e7f6a95f0edd70b09caa95fcc7143cf46b74db8bc17fa7c89f"}, 0xc3) 14:03:57 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(0xffffffffffffffff, 0xc018620b, &(0x7f0000000000)) 14:03:57 executing program 1: socket(0x0, 0x0, 0x0) syz_open_procfs(0x0, 0x0) perf_event_open(&(0x7f0000000180)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$cgroup_int(0xffffffffffffffff, 0x0, 0x2, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) openat$smack_thread_current(0xffffffffffffff9c, &(0x7f0000000240)='/proc/thread-self/attr/current\x00', 0x2, 0x0) write$cgroup_subtree(r0, &(0x7f0000000000)=ANY=[], 0x20032600) ioctl$TCSETAF(0xffffffffffffffff, 0x5408, &(0x7f0000000040)={0x2}) ioctl$EXT4_IOC_GROUP_ADD(0xffffffffffffffff, 0x40286608, &(0x7f0000000000)={0x3, 0x7000000, 0x400, 0x100000000, 0x0, 0x8}) ioctl$EVIOCGVERSION(0xffffffffffffffff, 0x80044501, &(0x7f0000000200)=""/31) 14:03:57 executing program 0: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x82000, 0x0) r1 = socket(0xa, 0x4008000000807, 0x80000000000) setsockopt$sock_int(r1, 0x1, 0x10, &(0x7f00000000c0)=0x81a, 0x4) bpf$OBJ_GET_MAP(0x7, &(0x7f0000000080)={&(0x7f0000000040)='./file0\x00', 0x0, 0x18}, 0x10) sendto(r1, &(0x7f0000cfefee)="120000001200e7ef007b00000000000000a1", 0x12, 0x0, 0x0, 0x0) syz_open_pts(r0, 0x4240) recvmmsg(r1, &(0x7f0000000440)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f0000000280)=""/231, 0xffffffffffffff84}}], 0x12e, 0x0, 0x0) r2 = openat$selinux_mls(0xffffffffffffff9c, &(0x7f0000000100)='/selinux/mls\x00', 0x0, 0x0) ioctl$ASHMEM_SET_NAME(r2, 0x41007701, &(0x7f0000000140)='/dev/ptmx\x00') r3 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(r3, 0x540b, 0x4000000000000004) 14:03:57 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(0xffffffffffffffff, 0xc018620b, &(0x7f0000000000)) 14:03:57 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSPTLCK(r0, 0x40045431, &(0x7f0000000180)) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) socket(0x200000000000011, 0x4000000000080002, 0x0) bind$packet(0xffffffffffffffff, 0x0, 0x0) sendmmsg(0xffffffffffffffff, &(0x7f0000007880)=[{{&(0x7f00000001c0)=@l2={0x1f, 0xbf53, {0x9, 0x0, 0xfffffffffffffdd5, 0x1ff, 0x2, 0x4}, 0x0, 0x7}, 0x80, 0x0}}, {{0x0, 0x0, &(0x7f0000007780)}}], 0x2, 0x4048851) setsockopt$packet_int(0xffffffffffffffff, 0x107, 0x0, 0x0, 0x0) syz_open_procfs(0x0, 0x0) ioctl$LOOP_SET_BLOCK_SIZE(0xffffffffffffffff, 0x4c09, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$cgroup_int(0xffffffffffffffff, 0x0, 0x2, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='\x89\x00\x00\x00\x00Ew\x00\x00\x00\xef\xb4\xc8\xd0\xff\xda\xb1vents\xd9\xc5H\xd4\x91\xfdN_]\x16\xe4\xa9C\xd2\x86Qn\xefS\x80\x11J\xfb4\x14\x86 4\x95\x9e\xfc\xc1\a\xcb \x95N\xe9\xa4j\xd2\x1f^\xb0\xb2>\xa3\xc9\xb7$\x11`t\x03: \x8b\xa4\x05\xf2?E\xdb+{t\xb8\xf7\xab\x8b\x100#', 0x26e1, 0x0) ioctl$PERF_EVENT_IOC_PAUSE_OUTPUT(r1, 0x40086602, 0x400007) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000280)='./cgroup/syz0\x00', 0x1ff) openat$smack_thread_current(0xffffffffffffff9c, &(0x7f0000000240)='/proc/thread-self/attr/current\x00', 0x2, 0x0) write$cgroup_subtree(r1, &(0x7f0000000100)=ANY=[], 0xff4a) write$cgroup_subtree(r2, &(0x7f0000000000)=ANY=[], 0x20032600) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a0f, 0x1700) accept$inet(0xffffffffffffffff, &(0x7f0000000040)={0x2, 0x0, @local}, &(0x7f0000000080)=0x10) ioctl$TCSETAF(r0, 0x5408, &(0x7f0000000040)={0x2}) ioctl$EXT4_IOC_GROUP_ADD(r0, 0x40286608, &(0x7f0000000000)={0x3, 0x7000000, 0x400, 0x100000000, 0x0, 0x8}) r3 = fcntl$dupfd(r0, 0x406, r0) ioctl$EVIOCGVERSION(r3, 0x80044501, &(0x7f0000000200)=""/31) write$binfmt_misc(r0, &(0x7f0000000080)={'syz1', "80fa25cdc862d216160cfa92845a3916e38a409a159c03f1889971d3e5144a8d08de78c4b1fbee457437261d7668b1c0f582647ad4134a05358d4309a71a702002329e024cac95642e761bb842bc1056bd6bf12c47697a649a026bd8ee1f685089941469b1ddfeddf32b392f0ff07652a3bce0770bc3bb70862845a65054cecb191e80b825d740fe6b40450359757032425dfdee92aec36ce4b468d50adc745c522cc4af2ac6e7f6a95f0edd70b09caa95fcc7143cf46b74db8bc17fa7c89f"}, 0xc3) 14:03:57 executing program 1: socket(0x0, 0x0, 0x0) syz_open_procfs(0x0, 0x0) perf_event_open(&(0x7f0000000180)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$cgroup_int(0xffffffffffffffff, 0x0, 0x2, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) openat$smack_thread_current(0xffffffffffffff9c, &(0x7f0000000240)='/proc/thread-self/attr/current\x00', 0x2, 0x0) write$cgroup_subtree(r0, &(0x7f0000000000)=ANY=[], 0x20032600) ioctl$TCSETAF(0xffffffffffffffff, 0x5408, &(0x7f0000000040)={0x2}) ioctl$EXT4_IOC_GROUP_ADD(0xffffffffffffffff, 0x40286608, &(0x7f0000000000)={0x3, 0x7000000, 0x400, 0x100000000, 0x0, 0x8}) ioctl$EVIOCGVERSION(0xffffffffffffffff, 0x80044501, &(0x7f0000000200)=""/31) 14:03:57 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) 14:03:57 executing program 3: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/ptmx\x00', 0x0, 0x0) socket(0x200000000000011, 0x4000000000080002, 0x0) syz_open_procfs(0x0, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$cgroup_int(0xffffffffffffffff, 0x0, 0x2, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) openat$smack_thread_current(0xffffffffffffff9c, &(0x7f0000000240)='/proc/thread-self/attr/current\x00', 0x2, 0x0) write$cgroup_subtree(r1, &(0x7f0000000000)=ANY=[], 0x20032600) ioctl$TCSETAF(r0, 0x5408, &(0x7f0000000040)={0x2}) ioctl$EXT4_IOC_GROUP_ADD(r0, 0x40286608, &(0x7f0000000000)={0x3, 0x7000000, 0x400, 0x100000000, 0x0, 0x8}) ioctl$EVIOCGVERSION(0xffffffffffffffff, 0x80044501, &(0x7f0000000200)=""/31) 14:03:57 executing program 0: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$KDGKBDIACR(r0, 0x4b4a, &(0x7f0000000000)=""/143) ioctl$TCFLSH(r0, 0x540b, 0x1) 14:03:57 executing program 1: socket(0x0, 0x0, 0x0) syz_open_procfs(0x0, 0x0) perf_event_open(&(0x7f0000000180)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$cgroup_int(0xffffffffffffffff, 0x0, 0x2, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) openat$smack_thread_current(0xffffffffffffff9c, &(0x7f0000000240)='/proc/thread-self/attr/current\x00', 0x2, 0x0) write$cgroup_subtree(r0, &(0x7f0000000000)=ANY=[], 0x20032600) ioctl$TCSETAF(0xffffffffffffffff, 0x5408, &(0x7f0000000040)={0x2}) ioctl$EXT4_IOC_GROUP_ADD(0xffffffffffffffff, 0x40286608, &(0x7f0000000000)={0x3, 0x7000000, 0x400, 0x100000000, 0x0, 0x8}) ioctl$EVIOCGVERSION(0xffffffffffffffff, 0x80044501, &(0x7f0000000200)=""/31) 14:03:57 executing program 4: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSPTLCK(r0, 0x40045431, &(0x7f0000000180)) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) socket(0x200000000000011, 0x4000000000080002, 0x0) bind$packet(0xffffffffffffffff, 0x0, 0x0) sendmmsg(0xffffffffffffffff, &(0x7f0000007880)=[{{&(0x7f00000001c0)=@l2={0x1f, 0x0, {0x9, 0x7, 0xfffffffffffffdd5, 0x1ff, 0x2, 0x4}, 0x0, 0x7}, 0x80, 0x0}}, {{0x0, 0x0, &(0x7f0000007780)}}], 0x2, 0x4048851) setsockopt$packet_int(0xffffffffffffffff, 0x107, 0x0, 0x0, 0x0) syz_open_procfs(0x0, 0x0) ioctl$LOOP_SET_BLOCK_SIZE(0xffffffffffffffff, 0x4c09, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$cgroup_int(0xffffffffffffffff, 0x0, 0x2, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='\x89\x00\x00\x00\x00Ew\x00\x00\x00\xef\xb4\xc8\xd0\xff\xda\xb1vents\xd9\xc5H\xd4\x91\xfdN_]\x16\xe4\xa9C\xd2\x86Qn\xefS\x80\x11J\xfb4\x14\x86 4\x95\x9e\xfc\xc1\a\xcb \x95N\xe9\xa4j\xd2\x1f^\xb0\xb2>\xa3\xc9\xb7$\x11`t\x03: \x8b\xa4\x05\xf2?E\xdb+{t\xb8\xf7\xab\x8b\x100#', 0x26e1, 0x0) ioctl$PERF_EVENT_IOC_PAUSE_OUTPUT(r1, 0x40086602, 0x400007) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000280)='./cgroup/syz0\x00', 0x1ff) openat$smack_thread_current(0xffffffffffffff9c, &(0x7f0000000240)='/proc/thread-self/attr/current\x00', 0x2, 0x0) write$cgroup_subtree(r1, &(0x7f0000000100)=ANY=[], 0xff4a) write$cgroup_subtree(r2, &(0x7f0000000000)=ANY=[], 0x20032600) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a0f, 0x1700) accept$inet(0xffffffffffffffff, &(0x7f0000000040)={0x2, 0x0, @local}, &(0x7f0000000080)=0x10) ioctl$TCSETAF(r0, 0x5408, &(0x7f0000000040)={0x2}) ioctl$EXT4_IOC_GROUP_ADD(r0, 0x40286608, &(0x7f0000000000)={0x3, 0x7000000, 0x400, 0x100000000, 0x0, 0x8}) r3 = fcntl$dupfd(r0, 0x406, r0) ioctl$EVIOCGVERSION(r3, 0x80044501, &(0x7f0000000200)=""/31) write$binfmt_misc(r0, &(0x7f0000000080)={'syz1', "80fa25cdc862d216160cfa92845a3916e38a409a159c03f1889971d3e5144a8d08de78c4b1fbee457437261d7668b1c0f582647ad4134a05358d4309a71a702002329e024cac95642e761bb842bc1056bd6bf12c47697a649a026bd8ee1f685089941469b1ddfeddf32b392f0ff07652a3bce0770bc3bb70862845a65054cecb191e80b825d740fe6b40450359757032425dfdee92aec36ce4b468d50adc745c522cc4af2ac6e7f6a95f0edd70b09caa95fcc7143cf46b74db8bc17fa7c89f"}, 0xc3) 14:03:57 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) [ 344.170036] binder: 11536:11543 ioctl c018620b 0 returned -14 14:03:57 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSPTLCK(r0, 0x40045431, &(0x7f0000000180)) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) socket(0x200000000000011, 0x4000000000080002, 0x0) bind$packet(0xffffffffffffffff, 0x0, 0x0) sendmmsg(0xffffffffffffffff, &(0x7f0000007880)=[{{&(0x7f00000001c0)=@l2={0x1f, 0xbf53, {0x9, 0x0, 0xfffffffffffffdd5, 0x1ff, 0x2, 0x4}, 0x0, 0x7}, 0x80, 0x0}}, {{0x0, 0x0, &(0x7f0000007780)}}], 0x2, 0x4048851) setsockopt$packet_int(0xffffffffffffffff, 0x107, 0x0, 0x0, 0x0) syz_open_procfs(0x0, 0x0) ioctl$LOOP_SET_BLOCK_SIZE(0xffffffffffffffff, 0x4c09, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$cgroup_int(0xffffffffffffffff, 0x0, 0x2, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='\x89\x00\x00\x00\x00Ew\x00\x00\x00\xef\xb4\xc8\xd0\xff\xda\xb1vents\xd9\xc5H\xd4\x91\xfdN_]\x16\xe4\xa9C\xd2\x86Qn\xefS\x80\x11J\xfb4\x14\x86 4\x95\x9e\xfc\xc1\a\xcb \x95N\xe9\xa4j\xd2\x1f^\xb0\xb2>\xa3\xc9\xb7$\x11`t\x03: \x8b\xa4\x05\xf2?E\xdb+{t\xb8\xf7\xab\x8b\x100#', 0x26e1, 0x0) ioctl$PERF_EVENT_IOC_PAUSE_OUTPUT(r1, 0x40086602, 0x400007) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000280)='./cgroup/syz0\x00', 0x1ff) openat$smack_thread_current(0xffffffffffffff9c, &(0x7f0000000240)='/proc/thread-self/attr/current\x00', 0x2, 0x0) write$cgroup_subtree(r1, &(0x7f0000000100)=ANY=[], 0xff4a) write$cgroup_subtree(r2, &(0x7f0000000000)=ANY=[], 0x20032600) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a0f, 0x1700) accept$inet(0xffffffffffffffff, &(0x7f0000000040)={0x2, 0x0, @local}, &(0x7f0000000080)=0x10) ioctl$TCSETAF(r0, 0x5408, &(0x7f0000000040)={0x2}) ioctl$EXT4_IOC_GROUP_ADD(r0, 0x40286608, &(0x7f0000000000)={0x3, 0x7000000, 0x400, 0x100000000, 0x0, 0x8}) r3 = fcntl$dupfd(r0, 0x406, r0) ioctl$EVIOCGVERSION(r3, 0x80044501, &(0x7f0000000200)=""/31) write$binfmt_misc(r0, &(0x7f0000000080)={'syz1', "80fa25cdc862d216160cfa92845a3916e38a409a159c03f1889971d3e5144a8d08de78c4b1fbee457437261d7668b1c0f582647ad4134a05358d4309a71a702002329e024cac95642e761bb842bc1056bd6bf12c47697a649a026bd8ee1f685089941469b1ddfeddf32b392f0ff07652a3bce0770bc3bb70862845a65054cecb191e80b825d740fe6b40450359757032425dfdee92aec36ce4b468d50adc745c522cc4af2ac6e7f6a95f0edd70b09caa95fcc7143cf46b74db8bc17fa7c89f"}, 0xc3) 14:03:57 executing program 1: socket(0x0, 0x0, 0x0) syz_open_procfs(0x0, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$cgroup_int(0xffffffffffffffff, 0x0, 0x2, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) openat$smack_thread_current(0xffffffffffffff9c, &(0x7f0000000240)='/proc/thread-self/attr/current\x00', 0x2, 0x0) write$cgroup_subtree(r0, &(0x7f0000000000)=ANY=[], 0x20032600) ioctl$TCSETAF(0xffffffffffffffff, 0x5408, &(0x7f0000000040)={0x2}) ioctl$EXT4_IOC_GROUP_ADD(0xffffffffffffffff, 0x40286608, &(0x7f0000000000)={0x3, 0x7000000, 0x400, 0x100000000, 0x0, 0x8}) ioctl$EVIOCGVERSION(0xffffffffffffffff, 0x80044501, &(0x7f0000000200)=""/31) 14:03:57 executing program 0: pipe(&(0x7f0000000000)) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(r0, 0x540b, 0x1) 14:03:57 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) 14:03:57 executing program 3: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSPTLCK(r0, 0x40045431, &(0x7f0000000180)) socket(0x200000000000011, 0x4000000000080002, 0x0) syz_open_procfs(0x0, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$cgroup_int(0xffffffffffffffff, 0x0, 0x2, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) openat$smack_thread_current(0xffffffffffffff9c, &(0x7f0000000240)='/proc/thread-self/attr/current\x00', 0x2, 0x0) write$cgroup_subtree(r1, &(0x7f0000000000)=ANY=[], 0x20032600) ioctl$TCSETAF(r0, 0x5408, &(0x7f0000000040)={0x2}) ioctl$EXT4_IOC_GROUP_ADD(r0, 0x40286608, &(0x7f0000000000)={0x3, 0x7000000, 0x400, 0x100000000, 0x0, 0x8}) ioctl$EVIOCGVERSION(0xffffffffffffffff, 0x80044501, &(0x7f0000000200)=""/31) [ 344.256909] binder: 11559:11563 ioctl c018620b 0 returned -14 14:03:57 executing program 0: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ptmx\x00', 0x8c02, 0x0) ioctl$TCSETSW(r0, 0x5403, &(0x7f0000000000)={0x4, 0x32, 0x4, 0x7fff, 0x7, 0xc1, 0x4, 0x1, 0x5, 0x3ff, 0xe2c, 0xb2}) ioctl$TCFLSH(r0, 0x540b, 0x1) 14:03:57 executing program 1: socket(0x0, 0x0, 0x0) syz_open_procfs(0x0, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$cgroup_int(0xffffffffffffffff, 0x0, 0x2, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) openat$smack_thread_current(0xffffffffffffff9c, &(0x7f0000000240)='/proc/thread-self/attr/current\x00', 0x2, 0x0) write$cgroup_subtree(r0, &(0x7f0000000000)=ANY=[], 0x20032600) ioctl$TCSETAF(0xffffffffffffffff, 0x5408, &(0x7f0000000040)={0x2}) ioctl$EXT4_IOC_GROUP_ADD(0xffffffffffffffff, 0x40286608, &(0x7f0000000000)={0x3, 0x7000000, 0x400, 0x100000000, 0x0, 0x8}) ioctl$EVIOCGVERSION(0xffffffffffffffff, 0x80044501, &(0x7f0000000200)=""/31) 14:03:57 executing program 4: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSPTLCK(r0, 0x40045431, &(0x7f0000000180)) socket(0x200000000000011, 0x4000000000080002, 0x0) syz_open_procfs(0x0, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$cgroup_int(0xffffffffffffffff, 0x0, 0x2, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) openat$smack_thread_current(0xffffffffffffff9c, &(0x7f0000000240)='/proc/thread-self/attr/current\x00', 0x2, 0x0) write$cgroup_subtree(r1, &(0x7f0000000000)=ANY=[], 0x20032600) ioctl$TCSETAF(r0, 0x5408, &(0x7f0000000040)={0x2}) ioctl$EXT4_IOC_GROUP_ADD(r0, 0x40286608, &(0x7f0000000000)={0x3, 0x7000000, 0x400, 0x100000000, 0x0, 0x8}) ioctl$EVIOCGVERSION(0xffffffffffffffff, 0x80044501, &(0x7f0000000200)=""/31) 14:03:57 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f00000001c0)=[@acquire], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x4, 0x0, &(0x7f000000dff8)=ANY=[@ANYBLOB="0e630c40"], 0x0, 0x0, 0x0}) [ 344.320202] binder: 11572:11577 ioctl c018620b 0 returned -14 14:03:57 executing program 3: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSPTLCK(r0, 0x40045431, &(0x7f0000000180)) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) socket(0x200000000000011, 0x4000000000080002, 0x0) bind$packet(0xffffffffffffffff, 0x0, 0x0) sendmmsg(0xffffffffffffffff, &(0x7f0000007880)=[{{&(0x7f00000001c0)=@l2={0x1f, 0x0, {0x9, 0x7, 0xfffffffffffffdd5, 0x1ff, 0x2, 0x4}, 0x0, 0x7}, 0x80, 0x0}}, {{0x0, 0x0, &(0x7f0000007780)}}], 0x2, 0x4048851) setsockopt$packet_int(0xffffffffffffffff, 0x107, 0x0, 0x0, 0x0) syz_open_procfs(0x0, 0x0) ioctl$LOOP_SET_BLOCK_SIZE(0xffffffffffffffff, 0x4c09, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$cgroup_int(0xffffffffffffffff, 0x0, 0x2, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='\x89\x00\x00\x00\x00Ew\x00\x00\x00\xef\xb4\xc8\xd0\xff\xda\xb1vents\xd9\xc5H\xd4\x91\xfdN_]\x16\xe4\xa9C\xd2\x86Qn\xefS\x80\x11J\xfb4\x14\x86 4\x95\x9e\xfc\xc1\a\xcb \x95N\xe9\xa4j\xd2\x1f^\xb0\xb2>\xa3\xc9\xb7$\x11`t\x03: \x8b\xa4\x05\xf2?E\xdb+{t\xb8\xf7\xab\x8b\x100#', 0x26e1, 0x0) ioctl$PERF_EVENT_IOC_PAUSE_OUTPUT(r1, 0x40086602, 0x400007) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000280)='./cgroup/syz0\x00', 0x1ff) openat$smack_thread_current(0xffffffffffffff9c, &(0x7f0000000240)='/proc/thread-self/attr/current\x00', 0x2, 0x0) write$cgroup_subtree(r1, &(0x7f0000000100)=ANY=[], 0xff4a) write$cgroup_subtree(r2, &(0x7f0000000000)=ANY=[], 0x20032600) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a0f, 0x1700) accept$inet(0xffffffffffffffff, &(0x7f0000000040)={0x2, 0x0, @local}, &(0x7f0000000080)=0x10) ioctl$TCSETAF(r0, 0x5408, &(0x7f0000000040)={0x2}) ioctl$EXT4_IOC_GROUP_ADD(r0, 0x40286608, &(0x7f0000000000)={0x3, 0x7000000, 0x400, 0x100000000, 0x0, 0x8}) r3 = fcntl$dupfd(r0, 0x406, r0) ioctl$EVIOCGVERSION(r3, 0x80044501, &(0x7f0000000200)=""/31) write$binfmt_misc(r0, &(0x7f0000000080)={'syz1', "80fa25cdc862d216160cfa92845a3916e38a409a159c03f1889971d3e5144a8d08de78c4b1fbee457437261d7668b1c0f582647ad4134a05358d4309a71a702002329e024cac95642e761bb842bc1056bd6bf12c47697a649a026bd8ee1f685089941469b1ddfeddf32b392f0ff07652a3bce0770bc3bb70862845a65054cecb191e80b825d740fe6b40450359757032425dfdee92aec36ce4b468d50adc745c522cc4af2ac6e7f6a95f0edd70b09caa95fcc7143cf46b74db8bc17fa7c89f"}, 0xc3) 14:03:57 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSPTLCK(r0, 0x40045431, &(0x7f0000000180)) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) socket(0x200000000000011, 0x4000000000080002, 0x0) bind$packet(0xffffffffffffffff, 0x0, 0x0) sendmmsg(0xffffffffffffffff, &(0x7f0000007880)=[{{&(0x7f00000001c0)=@l2={0x1f, 0xbf53, {0x9, 0x7, 0x0, 0x1ff, 0x2, 0x4}, 0x0, 0x7}, 0x80, 0x0}}, {{0x0, 0x0, &(0x7f0000007780)}}], 0x2, 0x4048851) setsockopt$packet_int(0xffffffffffffffff, 0x107, 0x0, 0x0, 0x0) syz_open_procfs(0x0, 0x0) ioctl$LOOP_SET_BLOCK_SIZE(0xffffffffffffffff, 0x4c09, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$cgroup_int(0xffffffffffffffff, 0x0, 0x2, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='\x89\x00\x00\x00\x00Ew\x00\x00\x00\xef\xb4\xc8\xd0\xff\xda\xb1vents\xd9\xc5H\xd4\x91\xfdN_]\x16\xe4\xa9C\xd2\x86Qn\xefS\x80\x11J\xfb4\x14\x86 4\x95\x9e\xfc\xc1\a\xcb \x95N\xe9\xa4j\xd2\x1f^\xb0\xb2>\xa3\xc9\xb7$\x11`t\x03: \x8b\xa4\x05\xf2?E\xdb+{t\xb8\xf7\xab\x8b\x100#', 0x26e1, 0x0) ioctl$PERF_EVENT_IOC_PAUSE_OUTPUT(r1, 0x40086602, 0x400007) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000280)='./cgroup/syz0\x00', 0x1ff) openat$smack_thread_current(0xffffffffffffff9c, &(0x7f0000000240)='/proc/thread-self/attr/current\x00', 0x2, 0x0) write$cgroup_subtree(r1, &(0x7f0000000100)=ANY=[], 0xff4a) write$cgroup_subtree(r2, &(0x7f0000000000)=ANY=[], 0x20032600) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a0f, 0x1700) accept$inet(0xffffffffffffffff, &(0x7f0000000040)={0x2, 0x0, @local}, &(0x7f0000000080)=0x10) ioctl$TCSETAF(r0, 0x5408, &(0x7f0000000040)={0x2}) ioctl$EXT4_IOC_GROUP_ADD(r0, 0x40286608, &(0x7f0000000000)={0x3, 0x7000000, 0x400, 0x100000000, 0x0, 0x8}) r3 = fcntl$dupfd(r0, 0x406, r0) ioctl$EVIOCGVERSION(r3, 0x80044501, &(0x7f0000000200)=""/31) write$binfmt_misc(r0, &(0x7f0000000080)={'syz1', "80fa25cdc862d216160cfa92845a3916e38a409a159c03f1889971d3e5144a8d08de78c4b1fbee457437261d7668b1c0f582647ad4134a05358d4309a71a702002329e024cac95642e761bb842bc1056bd6bf12c47697a649a026bd8ee1f685089941469b1ddfeddf32b392f0ff07652a3bce0770bc3bb70862845a65054cecb191e80b825d740fe6b40450359757032425dfdee92aec36ce4b468d50adc745c522cc4af2ac6e7f6a95f0edd70b09caa95fcc7143cf46b74db8bc17fa7c89f"}, 0xc3) 14:03:57 executing program 0: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/ptmx\x00', 0x2000, 0x0) ioctl$TCFLSH(r0, 0x540b, 0x400000000001) 14:03:57 executing program 1: socket(0x0, 0x0, 0x0) syz_open_procfs(0x0, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$cgroup_int(0xffffffffffffffff, 0x0, 0x2, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) openat$smack_thread_current(0xffffffffffffff9c, &(0x7f0000000240)='/proc/thread-self/attr/current\x00', 0x2, 0x0) write$cgroup_subtree(r0, &(0x7f0000000000)=ANY=[], 0x20032600) ioctl$TCSETAF(0xffffffffffffffff, 0x5408, &(0x7f0000000040)={0x2}) ioctl$EXT4_IOC_GROUP_ADD(0xffffffffffffffff, 0x40286608, &(0x7f0000000000)={0x3, 0x7000000, 0x400, 0x100000000, 0x0, 0x8}) ioctl$EVIOCGVERSION(0xffffffffffffffff, 0x80044501, &(0x7f0000000200)=""/31) 14:03:57 executing program 5: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSPTLCK(r0, 0x40045431, &(0x7f0000000180)) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) socket(0x200000000000011, 0x4000000000080002, 0x0) bind$packet(0xffffffffffffffff, 0x0, 0x0) sendmmsg(0xffffffffffffffff, &(0x7f0000007880)=[{{&(0x7f00000001c0)=@l2={0x1f, 0xbf53, {0x9, 0x0, 0xfffffffffffffdd5, 0x1ff, 0x2, 0x4}, 0x0, 0x7}, 0x80, 0x0}}, {{0x0, 0x0, &(0x7f0000007780)}}], 0x2, 0x4048851) setsockopt$packet_int(0xffffffffffffffff, 0x107, 0x0, 0x0, 0x0) syz_open_procfs(0x0, 0x0) ioctl$LOOP_SET_BLOCK_SIZE(0xffffffffffffffff, 0x4c09, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$cgroup_int(0xffffffffffffffff, 0x0, 0x2, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='\x89\x00\x00\x00\x00Ew\x00\x00\x00\xef\xb4\xc8\xd0\xff\xda\xb1vents\xd9\xc5H\xd4\x91\xfdN_]\x16\xe4\xa9C\xd2\x86Qn\xefS\x80\x11J\xfb4\x14\x86 4\x95\x9e\xfc\xc1\a\xcb \x95N\xe9\xa4j\xd2\x1f^\xb0\xb2>\xa3\xc9\xb7$\x11`t\x03: \x8b\xa4\x05\xf2?E\xdb+{t\xb8\xf7\xab\x8b\x100#', 0x26e1, 0x0) ioctl$PERF_EVENT_IOC_PAUSE_OUTPUT(r1, 0x40086602, 0x400007) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000280)='./cgroup/syz0\x00', 0x1ff) openat$smack_thread_current(0xffffffffffffff9c, &(0x7f0000000240)='/proc/thread-self/attr/current\x00', 0x2, 0x0) write$cgroup_subtree(r1, &(0x7f0000000100)=ANY=[], 0xff4a) write$cgroup_subtree(r2, &(0x7f0000000000)=ANY=[], 0x20032600) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a0f, 0x1700) accept$inet(0xffffffffffffffff, &(0x7f0000000040)={0x2, 0x0, @local}, &(0x7f0000000080)=0x10) ioctl$TCSETAF(r0, 0x5408, &(0x7f0000000040)={0x2}) ioctl$EXT4_IOC_GROUP_ADD(r0, 0x40286608, &(0x7f0000000000)={0x3, 0x7000000, 0x400, 0x100000000, 0x0, 0x8}) r3 = fcntl$dupfd(r0, 0x406, r0) ioctl$EVIOCGVERSION(r3, 0x80044501, &(0x7f0000000200)=""/31) write$binfmt_misc(r0, &(0x7f0000000080)={'syz1', "80fa25cdc862d216160cfa92845a3916e38a409a159c03f1889971d3e5144a8d08de78c4b1fbee457437261d7668b1c0f582647ad4134a05358d4309a71a702002329e024cac95642e761bb842bc1056bd6bf12c47697a649a026bd8ee1f685089941469b1ddfeddf32b392f0ff07652a3bce0770bc3bb70862845a65054cecb191e80b825d740fe6b40450359757032425dfdee92aec36ce4b468d50adc745c522cc4af2ac6e7f6a95f0edd70b09caa95fcc7143cf46b74db8bc17fa7c89f"}, 0xc3) 14:03:58 executing program 0: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(r0, 0x540b, 0x4000000001) ioctl$TIOCSLCKTRMIOS(r0, 0x5457, &(0x7f0000000080)) r1 = openat$selinux_mls(0xffffffffffffff9c, &(0x7f0000000140)='/selinux/mls\x00', 0x0, 0x0) setsockopt$inet_udp_encap(r1, 0x11, 0x64, &(0x7f0000000180)=0x2, 0x4) 14:03:58 executing program 4: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSPTLCK(r0, 0x40045431, &(0x7f0000000180)) socket(0x200000000000011, 0x4000000000080002, 0x0) syz_open_procfs(0x0, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$cgroup_int(0xffffffffffffffff, 0x0, 0x2, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) openat$smack_thread_current(0xffffffffffffff9c, &(0x7f0000000240)='/proc/thread-self/attr/current\x00', 0x2, 0x0) write$cgroup_subtree(r1, &(0x7f0000000000)=ANY=[], 0x20032600) ioctl$TCSETAF(r0, 0x5408, &(0x7f0000000040)={0x2}) ioctl$EXT4_IOC_GROUP_ADD(r0, 0x40286608, &(0x7f0000000000)={0x3, 0x7000000, 0x400, 0x100000000, 0x0, 0x8}) ioctl$EVIOCGVERSION(0xffffffffffffffff, 0x80044501, &(0x7f0000000200)=""/31) 14:03:58 executing program 1: socket(0x0, 0x0, 0x0) syz_open_procfs(0x0, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) openat$cgroup_int(0xffffffffffffffff, 0x0, 0x2, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) openat$smack_thread_current(0xffffffffffffff9c, &(0x7f0000000240)='/proc/thread-self/attr/current\x00', 0x2, 0x0) write$cgroup_subtree(r0, &(0x7f0000000000)=ANY=[], 0x20032600) ioctl$TCSETAF(0xffffffffffffffff, 0x5408, &(0x7f0000000040)={0x2}) ioctl$EXT4_IOC_GROUP_ADD(0xffffffffffffffff, 0x40286608, &(0x7f0000000000)={0x3, 0x7000000, 0x400, 0x100000000, 0x0, 0x8}) ioctl$EVIOCGVERSION(0xffffffffffffffff, 0x80044501, &(0x7f0000000200)=""/31) 14:03:58 executing program 0: sched_setattr(0x0, &(0x7f0000000000)={0x0, 0x6, 0x0, 0x0, 0x0, 0x9917, 0xffff}, 0x0) nanosleep(&(0x7f0000000100)={0x0, 0x1c9c380}, 0x0) r0 = openat$zero(0xffffffffffffff9c, &(0x7f0000000240)='/dev/zero\x00', 0x40, 0x0) ioctl$sock_inet6_tcp_SIOCATMARK(r0, 0x8905, &(0x7f0000000280)) r1 = openat$pfkey(0xffffffffffffff9c, &(0x7f0000000200)='/proc/self/net/pfkey\x00', 0x801, 0x0) perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x10001, 0x1f, 0x441eb4aa, 0xc10, 0x0, 0x800080000, 0x2000, 0x2, 0x0, 0x9, 0x6, 0x81, 0x3, 0x4, 0x1ff, 0x5, 0x8, 0x1f, 0x6e, 0x7fff, 0x18, 0x2, 0x0, 0x3, 0xd90, 0x9, 0x6, 0x7ff, 0x2, 0x9, 0x8, 0x5, 0x97b6, 0x3, 0xad8, 0x2, 0x0, 0xffff, 0x2, @perf_bp={&(0x7f00000000c0), 0x8}, 0x1, 0x7, 0x9, 0xd, 0x6, 0xbf, 0x8}, 0xffffffffffffffff, 0xffffffffffffffff, r1, 0x2) r2 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(r2, 0x540b, 0x1000) init_module(&(0x7f0000000040)='md5sumppp1#G\xff]securityselinuxmd5sum{\x00', 0x25, &(0x7f0000000080)='\\proc\\!\x00') 14:03:58 executing program 1: socket(0x0, 0x0, 0x0) syz_open_procfs(0x0, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) openat$cgroup_int(0xffffffffffffffff, 0x0, 0x2, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) openat$smack_thread_current(0xffffffffffffff9c, &(0x7f0000000240)='/proc/thread-self/attr/current\x00', 0x2, 0x0) write$cgroup_subtree(r0, &(0x7f0000000000)=ANY=[], 0x20032600) ioctl$TCSETAF(0xffffffffffffffff, 0x5408, &(0x7f0000000040)={0x2}) ioctl$EXT4_IOC_GROUP_ADD(0xffffffffffffffff, 0x40286608, &(0x7f0000000000)={0x3, 0x7000000, 0x400, 0x100000000, 0x0, 0x8}) ioctl$EVIOCGVERSION(0xffffffffffffffff, 0x80044501, &(0x7f0000000200)=""/31) 14:03:58 executing program 3: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSPTLCK(r0, 0x40045431, &(0x7f0000000180)) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) socket(0x200000000000011, 0x4000000000080002, 0x0) bind$packet(0xffffffffffffffff, 0x0, 0x0) sendmmsg(0xffffffffffffffff, &(0x7f0000007880)=[{{&(0x7f00000001c0)=@l2={0x1f, 0x0, {0x9, 0x7, 0xfffffffffffffdd5, 0x1ff, 0x2, 0x4}, 0x0, 0x7}, 0x80, 0x0}}, {{0x0, 0x0, &(0x7f0000007780)}}], 0x2, 0x4048851) setsockopt$packet_int(0xffffffffffffffff, 0x107, 0x0, 0x0, 0x0) syz_open_procfs(0x0, 0x0) ioctl$LOOP_SET_BLOCK_SIZE(0xffffffffffffffff, 0x4c09, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$cgroup_int(0xffffffffffffffff, 0x0, 0x2, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='\x89\x00\x00\x00\x00Ew\x00\x00\x00\xef\xb4\xc8\xd0\xff\xda\xb1vents\xd9\xc5H\xd4\x91\xfdN_]\x16\xe4\xa9C\xd2\x86Qn\xefS\x80\x11J\xfb4\x14\x86 4\x95\x9e\xfc\xc1\a\xcb \x95N\xe9\xa4j\xd2\x1f^\xb0\xb2>\xa3\xc9\xb7$\x11`t\x03: \x8b\xa4\x05\xf2?E\xdb+{t\xb8\xf7\xab\x8b\x100#', 0x26e1, 0x0) ioctl$PERF_EVENT_IOC_PAUSE_OUTPUT(r1, 0x40086602, 0x400007) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000280)='./cgroup/syz0\x00', 0x1ff) openat$smack_thread_current(0xffffffffffffff9c, &(0x7f0000000240)='/proc/thread-self/attr/current\x00', 0x2, 0x0) write$cgroup_subtree(r1, &(0x7f0000000100)=ANY=[], 0xff4a) write$cgroup_subtree(r2, &(0x7f0000000000)=ANY=[], 0x20032600) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a0f, 0x1700) accept$inet(0xffffffffffffffff, &(0x7f0000000040)={0x2, 0x0, @local}, &(0x7f0000000080)=0x10) ioctl$TCSETAF(r0, 0x5408, &(0x7f0000000040)={0x2}) ioctl$EXT4_IOC_GROUP_ADD(r0, 0x40286608, &(0x7f0000000000)={0x3, 0x7000000, 0x400, 0x100000000, 0x0, 0x8}) r3 = fcntl$dupfd(r0, 0x406, r0) ioctl$EVIOCGVERSION(r3, 0x80044501, &(0x7f0000000200)=""/31) write$binfmt_misc(r0, &(0x7f0000000080)={'syz1', "80fa25cdc862d216160cfa92845a3916e38a409a159c03f1889971d3e5144a8d08de78c4b1fbee457437261d7668b1c0f582647ad4134a05358d4309a71a702002329e024cac95642e761bb842bc1056bd6bf12c47697a649a026bd8ee1f685089941469b1ddfeddf32b392f0ff07652a3bce0770bc3bb70862845a65054cecb191e80b825d740fe6b40450359757032425dfdee92aec36ce4b468d50adc745c522cc4af2ac6e7f6a95f0edd70b09caa95fcc7143cf46b74db8bc17fa7c89f"}, 0xc3) 14:03:58 executing program 1: socket(0x0, 0x0, 0x0) syz_open_procfs(0x0, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) openat$cgroup_int(0xffffffffffffffff, 0x0, 0x2, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) openat$smack_thread_current(0xffffffffffffff9c, &(0x7f0000000240)='/proc/thread-self/attr/current\x00', 0x2, 0x0) write$cgroup_subtree(r0, &(0x7f0000000000)=ANY=[], 0x20032600) ioctl$TCSETAF(0xffffffffffffffff, 0x5408, &(0x7f0000000040)={0x2}) ioctl$EXT4_IOC_GROUP_ADD(0xffffffffffffffff, 0x40286608, &(0x7f0000000000)={0x3, 0x7000000, 0x400, 0x100000000, 0x0, 0x8}) ioctl$EVIOCGVERSION(0xffffffffffffffff, 0x80044501, &(0x7f0000000200)=""/31) [ 344.603069] sched: DL replenish lagged too much 14:03:58 executing program 5: socket(0x0, 0x0, 0x0) syz_open_procfs(0x0, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) openat$cgroup_int(0xffffffffffffffff, 0x0, 0x2, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) openat$smack_thread_current(0xffffffffffffff9c, &(0x7f0000000240)='/proc/thread-self/attr/current\x00', 0x2, 0x0) write$cgroup_subtree(r0, &(0x7f0000000000)=ANY=[], 0x20032600) ioctl$TCSETAF(0xffffffffffffffff, 0x5408, &(0x7f0000000040)={0x2}) ioctl$EXT4_IOC_GROUP_ADD(0xffffffffffffffff, 0x40286608, &(0x7f0000000000)={0x3, 0x7000000, 0x400, 0x100000000, 0x0, 0x8}) ioctl$EVIOCGVERSION(0xffffffffffffffff, 0x80044501, &(0x7f0000000200)=""/31) 14:03:58 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSPTLCK(r0, 0x40045431, &(0x7f0000000180)) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) socket(0x200000000000011, 0x4000000000080002, 0x0) bind$packet(0xffffffffffffffff, 0x0, 0x0) sendmmsg(0xffffffffffffffff, &(0x7f0000007880)=[{{&(0x7f00000001c0)=@l2={0x1f, 0xbf53, {0x9, 0x7, 0x0, 0x1ff, 0x2, 0x4}, 0x0, 0x7}, 0x80, 0x0}}, {{0x0, 0x0, &(0x7f0000007780)}}], 0x2, 0x4048851) setsockopt$packet_int(0xffffffffffffffff, 0x107, 0x0, 0x0, 0x0) syz_open_procfs(0x0, 0x0) ioctl$LOOP_SET_BLOCK_SIZE(0xffffffffffffffff, 0x4c09, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$cgroup_int(0xffffffffffffffff, 0x0, 0x2, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='\x89\x00\x00\x00\x00Ew\x00\x00\x00\xef\xb4\xc8\xd0\xff\xda\xb1vents\xd9\xc5H\xd4\x91\xfdN_]\x16\xe4\xa9C\xd2\x86Qn\xefS\x80\x11J\xfb4\x14\x86 4\x95\x9e\xfc\xc1\a\xcb \x95N\xe9\xa4j\xd2\x1f^\xb0\xb2>\xa3\xc9\xb7$\x11`t\x03: \x8b\xa4\x05\xf2?E\xdb+{t\xb8\xf7\xab\x8b\x100#', 0x26e1, 0x0) ioctl$PERF_EVENT_IOC_PAUSE_OUTPUT(r1, 0x40086602, 0x400007) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000280)='./cgroup/syz0\x00', 0x1ff) openat$smack_thread_current(0xffffffffffffff9c, &(0x7f0000000240)='/proc/thread-self/attr/current\x00', 0x2, 0x0) write$cgroup_subtree(r1, &(0x7f0000000100)=ANY=[], 0xff4a) write$cgroup_subtree(r2, &(0x7f0000000000)=ANY=[], 0x20032600) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a0f, 0x1700) accept$inet(0xffffffffffffffff, &(0x7f0000000040)={0x2, 0x0, @local}, &(0x7f0000000080)=0x10) ioctl$TCSETAF(r0, 0x5408, &(0x7f0000000040)={0x2}) ioctl$EXT4_IOC_GROUP_ADD(r0, 0x40286608, &(0x7f0000000000)={0x3, 0x7000000, 0x400, 0x100000000, 0x0, 0x8}) r3 = fcntl$dupfd(r0, 0x406, r0) ioctl$EVIOCGVERSION(r3, 0x80044501, &(0x7f0000000200)=""/31) write$binfmt_misc(r0, &(0x7f0000000080)={'syz1', "80fa25cdc862d216160cfa92845a3916e38a409a159c03f1889971d3e5144a8d08de78c4b1fbee457437261d7668b1c0f582647ad4134a05358d4309a71a702002329e024cac95642e761bb842bc1056bd6bf12c47697a649a026bd8ee1f685089941469b1ddfeddf32b392f0ff07652a3bce0770bc3bb70862845a65054cecb191e80b825d740fe6b40450359757032425dfdee92aec36ce4b468d50adc745c522cc4af2ac6e7f6a95f0edd70b09caa95fcc7143cf46b74db8bc17fa7c89f"}, 0xc3) 14:03:58 executing program 4: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSPTLCK(r0, 0x40045431, &(0x7f0000000180)) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) socket(0x200000000000011, 0x4000000000080002, 0x0) bind$packet(0xffffffffffffffff, 0x0, 0x0) sendmmsg(0xffffffffffffffff, &(0x7f0000007880)=[{{&(0x7f00000001c0)=@l2={0x1f, 0xbf53, {0x9, 0x0, 0xfffffffffffffdd5, 0x1ff, 0x2, 0x4}, 0x0, 0x7}, 0x80, 0x0}}, {{0x0, 0x0, &(0x7f0000007780)}}], 0x2, 0x4048851) setsockopt$packet_int(0xffffffffffffffff, 0x107, 0x0, 0x0, 0x0) syz_open_procfs(0x0, 0x0) ioctl$LOOP_SET_BLOCK_SIZE(0xffffffffffffffff, 0x4c09, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$cgroup_int(0xffffffffffffffff, 0x0, 0x2, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='\x89\x00\x00\x00\x00Ew\x00\x00\x00\xef\xb4\xc8\xd0\xff\xda\xb1vents\xd9\xc5H\xd4\x91\xfdN_]\x16\xe4\xa9C\xd2\x86Qn\xefS\x80\x11J\xfb4\x14\x86 4\x95\x9e\xfc\xc1\a\xcb \x95N\xe9\xa4j\xd2\x1f^\xb0\xb2>\xa3\xc9\xb7$\x11`t\x03: \x8b\xa4\x05\xf2?E\xdb+{t\xb8\xf7\xab\x8b\x100#', 0x26e1, 0x0) ioctl$PERF_EVENT_IOC_PAUSE_OUTPUT(r1, 0x40086602, 0x400007) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000280)='./cgroup/syz0\x00', 0x1ff) openat$smack_thread_current(0xffffffffffffff9c, &(0x7f0000000240)='/proc/thread-self/attr/current\x00', 0x2, 0x0) write$cgroup_subtree(r1, &(0x7f0000000100)=ANY=[], 0xff4a) write$cgroup_subtree(r2, &(0x7f0000000000)=ANY=[], 0x20032600) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a0f, 0x1700) accept$inet(0xffffffffffffffff, &(0x7f0000000040)={0x2, 0x0, @local}, &(0x7f0000000080)=0x10) ioctl$TCSETAF(r0, 0x5408, &(0x7f0000000040)={0x2}) ioctl$EXT4_IOC_GROUP_ADD(r0, 0x40286608, &(0x7f0000000000)={0x3, 0x7000000, 0x400, 0x100000000, 0x0, 0x8}) r3 = fcntl$dupfd(r0, 0x406, r0) ioctl$EVIOCGVERSION(r3, 0x80044501, &(0x7f0000000200)=""/31) write$binfmt_misc(r0, &(0x7f0000000080)={'syz1', "80fa25cdc862d216160cfa92845a3916e38a409a159c03f1889971d3e5144a8d08de78c4b1fbee457437261d7668b1c0f582647ad4134a05358d4309a71a702002329e024cac95642e761bb842bc1056bd6bf12c47697a649a026bd8ee1f685089941469b1ddfeddf32b392f0ff07652a3bce0770bc3bb70862845a65054cecb191e80b825d740fe6b40450359757032425dfdee92aec36ce4b468d50adc745c522cc4af2ac6e7f6a95f0edd70b09caa95fcc7143cf46b74db8bc17fa7c89f"}, 0xc3) 14:03:58 executing program 0: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(r0, 0x540b, 0xffffffffffffffe1) r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x200000, 0x0) r2 = dup3(r1, r0, 0x80000) getsockopt$EBT_SO_GET_INFO(r2, 0x0, 0x80, &(0x7f0000000180)={'filter\x00'}, &(0x7f0000000100)=0x78) openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ptmx\x00', 0x2000, 0x0) pipe(&(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TIOCSLCKTRMIOS(r3, 0x5457, &(0x7f0000000140)) 14:03:58 executing program 3: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSPTLCK(r0, 0x40045431, &(0x7f0000000180)) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) socket(0x200000000000011, 0x4000000000080002, 0x0) bind$packet(0xffffffffffffffff, 0x0, 0x0) sendmmsg(0xffffffffffffffff, &(0x7f0000007880)=[{{&(0x7f00000001c0)=@l2={0x1f, 0xbf53, {0x9, 0x7, 0x0, 0x1ff, 0x2, 0x4}, 0x0, 0x7}, 0x80, 0x0}}, {{0x0, 0x0, &(0x7f0000007780)}}], 0x2, 0x4048851) setsockopt$packet_int(0xffffffffffffffff, 0x107, 0x0, 0x0, 0x0) syz_open_procfs(0x0, 0x0) ioctl$LOOP_SET_BLOCK_SIZE(0xffffffffffffffff, 0x4c09, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$cgroup_int(0xffffffffffffffff, 0x0, 0x2, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='\x89\x00\x00\x00\x00Ew\x00\x00\x00\xef\xb4\xc8\xd0\xff\xda\xb1vents\xd9\xc5H\xd4\x91\xfdN_]\x16\xe4\xa9C\xd2\x86Qn\xefS\x80\x11J\xfb4\x14\x86 4\x95\x9e\xfc\xc1\a\xcb \x95N\xe9\xa4j\xd2\x1f^\xb0\xb2>\xa3\xc9\xb7$\x11`t\x03: \x8b\xa4\x05\xf2?E\xdb+{t\xb8\xf7\xab\x8b\x100#', 0x26e1, 0x0) ioctl$PERF_EVENT_IOC_PAUSE_OUTPUT(r1, 0x40086602, 0x400007) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000280)='./cgroup/syz0\x00', 0x1ff) openat$smack_thread_current(0xffffffffffffff9c, &(0x7f0000000240)='/proc/thread-self/attr/current\x00', 0x2, 0x0) write$cgroup_subtree(r1, &(0x7f0000000100)=ANY=[], 0xff4a) write$cgroup_subtree(r2, &(0x7f0000000000)=ANY=[], 0x20032600) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a0f, 0x1700) accept$inet(0xffffffffffffffff, &(0x7f0000000040)={0x2, 0x0, @local}, &(0x7f0000000080)=0x10) ioctl$TCSETAF(r0, 0x5408, &(0x7f0000000040)={0x2}) ioctl$EXT4_IOC_GROUP_ADD(r0, 0x40286608, &(0x7f0000000000)={0x3, 0x7000000, 0x400, 0x100000000, 0x0, 0x8}) r3 = fcntl$dupfd(r0, 0x406, r0) ioctl$EVIOCGVERSION(r3, 0x80044501, &(0x7f0000000200)=""/31) write$binfmt_misc(r0, &(0x7f0000000080)={'syz1', "80fa25cdc862d216160cfa92845a3916e38a409a159c03f1889971d3e5144a8d08de78c4b1fbee457437261d7668b1c0f582647ad4134a05358d4309a71a702002329e024cac95642e761bb842bc1056bd6bf12c47697a649a026bd8ee1f685089941469b1ddfeddf32b392f0ff07652a3bce0770bc3bb70862845a65054cecb191e80b825d740fe6b40450359757032425dfdee92aec36ce4b468d50adc745c522cc4af2ac6e7f6a95f0edd70b09caa95fcc7143cf46b74db8bc17fa7c89f"}, 0xc3) 14:03:58 executing program 1: socket(0x0, 0x0, 0x0) syz_open_procfs(0x0, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$cgroup_int(0xffffffffffffffff, 0x0, 0x2, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x7a05, 0x1700) openat$smack_thread_current(0xffffffffffffff9c, &(0x7f0000000240)='/proc/thread-self/attr/current\x00', 0x2, 0x0) write$cgroup_subtree(r0, &(0x7f0000000000)=ANY=[], 0x20032600) ioctl$TCSETAF(0xffffffffffffffff, 0x5408, &(0x7f0000000040)={0x2}) ioctl$EXT4_IOC_GROUP_ADD(0xffffffffffffffff, 0x40286608, &(0x7f0000000000)={0x3, 0x7000000, 0x400, 0x100000000, 0x0, 0x8}) ioctl$EVIOCGVERSION(0xffffffffffffffff, 0x80044501, &(0x7f0000000200)=""/31) 14:03:58 executing program 5: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSPTLCK(r0, 0x40045431, &(0x7f0000000180)) socket(0x200000000000011, 0x4000000000080002, 0x0) syz_open_procfs(0x0, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$cgroup_int(0xffffffffffffffff, 0x0, 0x2, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) openat$smack_thread_current(0xffffffffffffff9c, &(0x7f0000000240)='/proc/thread-self/attr/current\x00', 0x2, 0x0) write$cgroup_subtree(r1, &(0x7f0000000000)=ANY=[], 0x20032600) ioctl$TCSETAF(r0, 0x5408, &(0x7f0000000040)={0x2}) ioctl$EXT4_IOC_GROUP_ADD(r0, 0x40286608, &(0x7f0000000000)={0x3, 0x7000000, 0x400, 0x100000000, 0x0, 0x8}) ioctl$EVIOCGVERSION(0xffffffffffffffff, 0x80044501, &(0x7f0000000200)=""/31) 14:03:58 executing program 0: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ptmx\x00', 0x143100, 0x0) r1 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$GIO_UNIMAP(r0, 0x4b66, &(0x7f0000000280)={0x5, &(0x7f00000001c0)=[{}, {}, {}, {}, {}]}) setsockopt$inet_tcp_int(r1, 0x6, 0x10000000013, &(0x7f0000d06000)=0x1, 0x4) connect$inet(r1, &(0x7f0000000200)={0x2, 0x0, @empty}, 0x10) setsockopt$inet_tcp_int(r1, 0x6, 0x4000000000014, &(0x7f0000000180)=0x80000000002, 0x4) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$tipc(0x0) setsockopt$inet6_tcp_int(r1, 0x6, 0x4, &(0x7f00000004c0)=0xa9, 0x4) sendmsg$TIPC_CMD_GET_MAX_PORTS(r2, &(0x7f0000000140)={&(0x7f0000000040), 0xc, &(0x7f0000000100)={&(0x7f00000000c0)={0x1c, r3, 0x61b, 0x70bd2a, 0x25dfdbfb}, 0x1c}, 0x1, 0x0, 0x0, 0x4}, 0x40000) r4 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000580)='TIPCv2\x00') sendmsg$TIPC_NL_SOCK_GET(r2, &(0x7f0000000700)={&(0x7f0000000540)={0x10, 0x0, 0x0, 0x1000000}, 0xc, &(0x7f00000006c0)={&(0x7f00000005c0)={0xf4, r4, 0x100, 0x70bd27, 0x25dfdbfc, {}, [@TIPC_NLA_LINK={0xe0, 0x4, [@TIPC_NLA_LINK_PROP={0x14, 0x7, [@TIPC_NLA_PROP_WIN={0x8, 0x3, 0xdec1}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x16}]}, @TIPC_NLA_LINK_PROP={0x34, 0x7, [@TIPC_NLA_PROP_WIN={0x8, 0x3, 0x10001}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0xa1}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x6}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x7ff}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x10001}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x18}]}, @TIPC_NLA_LINK_PROP={0xc, 0x7, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0x2}]}, @TIPC_NLA_LINK_PROP={0x3c, 0x7, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x1c}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x1a}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0xa}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x8}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0xcb6f}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x9}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x7}]}, @TIPC_NLA_LINK_NAME={0x14, 0x1, 'broadcast-link\x00'}, @TIPC_NLA_LINK_PROP={0x2c, 0x7, [@TIPC_NLA_PROP_TOL={0x8, 0x2, 0x3}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x7}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x13}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x4}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x17}]}, @TIPC_NLA_LINK_PROP={0xc, 0x7, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x1f}]}]}]}, 0xf4}, 0x1, 0x0, 0x0, 0xc040}, 0x800) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000500)=0x14) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r1, 0x6, 0x1d, &(0x7f0000000240)={0x0, 0x0, 0x5}, 0x14) stat(&(0x7f0000000400)='./file0\x00', &(0x7f0000000440)={0x0, 0x0, 0x0, 0x0, 0x0}) ioprio_get$uid(0x3, r5) setsockopt$inet_tcp_int(r1, 0x6, 0x8000000000019, &(0x7f0000000000)=0x5, 0x4) writev(r2, &(0x7f00000003c0)=[{&(0x7f00000002c0)="c6ce1c22ad24f302292c50a5749ea758a2d77c4370b92c3e2b8b240d1023a34f31b09aec4599895af1b20897b1cac9327f991a93a22cee6243ca4f1f51488034dc0fc364fca7c32e6d74fa75e3e2bfa977c7e2c57a9c3ee9517ba01fac8ed7fd1a2a1b8203c09a0e3eecec984d10bb1e2a064ab649819be84a003b0a63c74dd9c2e075d042aeedccf3c25df354d01cb52d25d8c0ca39f041aac9d3611303cce41b73f2c834abd5e38a038b654d15886fd27e83ac504267f81a2f906fc6c42dfa113d34eb93200d34eb79e4", 0xcb}], 0x1) sendto$inet(r1, &(0x7f0000000080), 0xa103209d483eb54c, 0x0, 0x0, 0xfffffffffffffdb8) ioctl$TCFLSH(r0, 0x540b, 0x1) 14:03:58 executing program 1: socket(0x0, 0x0, 0x0) syz_open_procfs(0x0, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$cgroup_int(0xffffffffffffffff, 0x0, 0x2, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x7a05, 0x1700) openat$smack_thread_current(0xffffffffffffff9c, 0x0, 0x2, 0x0) write$cgroup_subtree(r0, &(0x7f0000000000)=ANY=[], 0x20032600) ioctl$TCSETAF(0xffffffffffffffff, 0x5408, &(0x7f0000000040)={0x2}) ioctl$EXT4_IOC_GROUP_ADD(0xffffffffffffffff, 0x40286608, &(0x7f0000000000)={0x3, 0x7000000, 0x400, 0x100000000, 0x0, 0x8}) ioctl$EVIOCGVERSION(0xffffffffffffffff, 0x80044501, &(0x7f0000000200)=""/31) 14:03:58 executing program 5: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSPTLCK(r0, 0x40045431, &(0x7f0000000180)) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) socket(0x200000000000011, 0x4000000000080002, 0x0) bind$packet(0xffffffffffffffff, 0x0, 0x0) sendmmsg(0xffffffffffffffff, &(0x7f0000007880)=[{{0x0, 0x0, 0x0}}, {{0x0, 0x0, &(0x7f0000007780)}}], 0x2, 0x4048851) setsockopt$packet_int(0xffffffffffffffff, 0x107, 0x0, 0x0, 0x0) syz_open_procfs(0x0, 0x0) ioctl$LOOP_SET_BLOCK_SIZE(0xffffffffffffffff, 0x4c09, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$cgroup_int(0xffffffffffffffff, 0x0, 0x2, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='\x89\x00\x00\x00\x00Ew\x00\x00\x00\xef\xb4\xc8\xd0\xff\xda\xb1vents\xd9\xc5H\xd4\x91\xfdN_]\x16\xe4\xa9C\xd2\x86Qn\xefS\x80\x11J\xfb4\x14\x86 4\x95\x9e\xfc\xc1\a\xcb \x95N\xe9\xa4j\xd2\x1f^\xb0\xb2>\xa3\xc9\xb7$\x11`t\x03: \x8b\xa4\x05\xf2?E\xdb+{t\xb8\xf7\xab\x8b\x100#', 0x26e1, 0x0) ioctl$PERF_EVENT_IOC_PAUSE_OUTPUT(r1, 0x40086602, 0x400007) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000280)='./cgroup/syz0\x00', 0x1ff) openat$smack_thread_current(0xffffffffffffff9c, &(0x7f0000000240)='/proc/thread-self/attr/current\x00', 0x2, 0x0) write$cgroup_subtree(r1, &(0x7f0000000100)=ANY=[], 0xff4a) write$cgroup_subtree(r2, &(0x7f0000000000)=ANY=[], 0x20032600) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a0f, 0x1700) accept$inet(0xffffffffffffffff, &(0x7f0000000040)={0x2, 0x0, @local}, &(0x7f0000000080)=0x10) ioctl$TCSETAF(r0, 0x5408, &(0x7f0000000040)={0x2}) ioctl$EXT4_IOC_GROUP_ADD(r0, 0x40286608, &(0x7f0000000000)={0x3, 0x7000000, 0x400, 0x100000000, 0x0, 0x8}) r3 = fcntl$dupfd(r0, 0x406, r0) ioctl$EVIOCGVERSION(r3, 0x80044501, &(0x7f0000000200)=""/31) write$binfmt_misc(r0, &(0x7f0000000080)={'syz1', "80fa25cdc862d216160cfa92845a3916e38a409a159c03f1889971d3e5144a8d08de78c4b1fbee457437261d7668b1c0f582647ad4134a05358d4309a71a702002329e024cac95642e761bb842bc1056bd6bf12c47697a649a026bd8ee1f685089941469b1ddfeddf32b392f0ff07652a3bce0770bc3bb70862845a65054cecb191e80b825d740fe6b40450359757032425dfdee92aec36ce4b468d50adc745c522cc4af2ac6e7f6a95f0edd70b09caa95fcc7143cf46b74db8bc17fa7c89f"}, 0xc3) 14:03:58 executing program 0: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x400a01, 0x0) ioctl$TCFLSH(r0, 0x540b, 0x1) 14:03:58 executing program 1: socket(0x0, 0x0, 0x0) syz_open_procfs(0x0, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$cgroup_int(0xffffffffffffffff, 0x0, 0x2, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x7a05, 0x1700) openat$smack_thread_current(0xffffffffffffff9c, 0x0, 0x2, 0x0) write$cgroup_subtree(r0, &(0x7f0000000000)=ANY=[], 0x20032600) ioctl$TCSETAF(0xffffffffffffffff, 0x5408, &(0x7f0000000040)={0x2}) ioctl$EXT4_IOC_GROUP_ADD(0xffffffffffffffff, 0x40286608, &(0x7f0000000000)={0x3, 0x7000000, 0x400, 0x100000000, 0x0, 0x8}) ioctl$EVIOCGVERSION(0xffffffffffffffff, 0x80044501, &(0x7f0000000200)=""/31) 14:03:58 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSPTLCK(r0, 0x40045431, &(0x7f0000000180)) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) socket(0x200000000000011, 0x4000000000080002, 0x0) bind$packet(0xffffffffffffffff, 0x0, 0x0) sendmmsg(0xffffffffffffffff, &(0x7f0000007880)=[{{&(0x7f00000001c0)=@l2={0x1f, 0xbf53, {0x9, 0x7, 0x0, 0x1ff, 0x2, 0x4}, 0x0, 0x7}, 0x80, 0x0}}, {{0x0, 0x0, &(0x7f0000007780)}}], 0x2, 0x4048851) setsockopt$packet_int(0xffffffffffffffff, 0x107, 0x0, 0x0, 0x0) syz_open_procfs(0x0, 0x0) ioctl$LOOP_SET_BLOCK_SIZE(0xffffffffffffffff, 0x4c09, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$cgroup_int(0xffffffffffffffff, 0x0, 0x2, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='\x89\x00\x00\x00\x00Ew\x00\x00\x00\xef\xb4\xc8\xd0\xff\xda\xb1vents\xd9\xc5H\xd4\x91\xfdN_]\x16\xe4\xa9C\xd2\x86Qn\xefS\x80\x11J\xfb4\x14\x86 4\x95\x9e\xfc\xc1\a\xcb \x95N\xe9\xa4j\xd2\x1f^\xb0\xb2>\xa3\xc9\xb7$\x11`t\x03: \x8b\xa4\x05\xf2?E\xdb+{t\xb8\xf7\xab\x8b\x100#', 0x26e1, 0x0) ioctl$PERF_EVENT_IOC_PAUSE_OUTPUT(r1, 0x40086602, 0x400007) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000280)='./cgroup/syz0\x00', 0x1ff) openat$smack_thread_current(0xffffffffffffff9c, &(0x7f0000000240)='/proc/thread-self/attr/current\x00', 0x2, 0x0) write$cgroup_subtree(r1, &(0x7f0000000100)=ANY=[], 0xff4a) write$cgroup_subtree(r2, &(0x7f0000000000)=ANY=[], 0x20032600) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a0f, 0x1700) accept$inet(0xffffffffffffffff, &(0x7f0000000040)={0x2, 0x0, @local}, &(0x7f0000000080)=0x10) ioctl$TCSETAF(r0, 0x5408, &(0x7f0000000040)={0x2}) ioctl$EXT4_IOC_GROUP_ADD(r0, 0x40286608, &(0x7f0000000000)={0x3, 0x7000000, 0x400, 0x100000000, 0x0, 0x8}) r3 = fcntl$dupfd(r0, 0x406, r0) ioctl$EVIOCGVERSION(r3, 0x80044501, &(0x7f0000000200)=""/31) write$binfmt_misc(r0, &(0x7f0000000080)={'syz1', "80fa25cdc862d216160cfa92845a3916e38a409a159c03f1889971d3e5144a8d08de78c4b1fbee457437261d7668b1c0f582647ad4134a05358d4309a71a702002329e024cac95642e761bb842bc1056bd6bf12c47697a649a026bd8ee1f685089941469b1ddfeddf32b392f0ff07652a3bce0770bc3bb70862845a65054cecb191e80b825d740fe6b40450359757032425dfdee92aec36ce4b468d50adc745c522cc4af2ac6e7f6a95f0edd70b09caa95fcc7143cf46b74db8bc17fa7c89f"}, 0xc3) 14:03:58 executing program 0: r0 = openat(0xffffffffffffffff, &(0x7f0000000000)='./file0\x00', 0x84000, 0x84) ioctl$TCSETS(r0, 0x5402, &(0x7f0000000040)={0x1, 0x4, 0x7, 0xc2aa, 0x3, 0x3, 0x80000001, 0x101, 0x58ee, 0x80000001, 0x6, 0x9}) openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0xfffffffffffffffd, 0x0) 14:03:58 executing program 4: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSPTLCK(r0, 0x40045431, &(0x7f0000000180)) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) socket(0x200000000000011, 0x4000000000080002, 0x0) bind$packet(0xffffffffffffffff, 0x0, 0x0) sendmmsg(0xffffffffffffffff, &(0x7f0000007880)=[{{0x0, 0x0, 0x0}}, {{0x0, 0x0, &(0x7f0000007780)}}], 0x2, 0x4048851) setsockopt$packet_int(0xffffffffffffffff, 0x107, 0x0, 0x0, 0x0) syz_open_procfs(0x0, 0x0) ioctl$LOOP_SET_BLOCK_SIZE(0xffffffffffffffff, 0x4c09, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$cgroup_int(0xffffffffffffffff, 0x0, 0x2, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='\x89\x00\x00\x00\x00Ew\x00\x00\x00\xef\xb4\xc8\xd0\xff\xda\xb1vents\xd9\xc5H\xd4\x91\xfdN_]\x16\xe4\xa9C\xd2\x86Qn\xefS\x80\x11J\xfb4\x14\x86 4\x95\x9e\xfc\xc1\a\xcb \x95N\xe9\xa4j\xd2\x1f^\xb0\xb2>\xa3\xc9\xb7$\x11`t\x03: \x8b\xa4\x05\xf2?E\xdb+{t\xb8\xf7\xab\x8b\x100#', 0x26e1, 0x0) ioctl$PERF_EVENT_IOC_PAUSE_OUTPUT(r1, 0x40086602, 0x400007) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000280)='./cgroup/syz0\x00', 0x1ff) openat$smack_thread_current(0xffffffffffffff9c, &(0x7f0000000240)='/proc/thread-self/attr/current\x00', 0x2, 0x0) write$cgroup_subtree(r1, &(0x7f0000000100)=ANY=[], 0xff4a) write$cgroup_subtree(r2, &(0x7f0000000000)=ANY=[], 0x20032600) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a0f, 0x1700) accept$inet(0xffffffffffffffff, &(0x7f0000000040)={0x2, 0x0, @local}, &(0x7f0000000080)=0x10) ioctl$TCSETAF(r0, 0x5408, &(0x7f0000000040)={0x2}) ioctl$EXT4_IOC_GROUP_ADD(r0, 0x40286608, &(0x7f0000000000)={0x3, 0x7000000, 0x400, 0x100000000, 0x0, 0x8}) r3 = fcntl$dupfd(r0, 0x406, r0) ioctl$EVIOCGVERSION(r3, 0x80044501, &(0x7f0000000200)=""/31) write$binfmt_misc(r0, &(0x7f0000000080)={'syz1', "80fa25cdc862d216160cfa92845a3916e38a409a159c03f1889971d3e5144a8d08de78c4b1fbee457437261d7668b1c0f582647ad4134a05358d4309a71a702002329e024cac95642e761bb842bc1056bd6bf12c47697a649a026bd8ee1f685089941469b1ddfeddf32b392f0ff07652a3bce0770bc3bb70862845a65054cecb191e80b825d740fe6b40450359757032425dfdee92aec36ce4b468d50adc745c522cc4af2ac6e7f6a95f0edd70b09caa95fcc7143cf46b74db8bc17fa7c89f"}, 0xc3) 14:03:58 executing program 3: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSPTLCK(r0, 0x40045431, &(0x7f0000000180)) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) socket(0x200000000000011, 0x4000000000080002, 0x0) bind$packet(0xffffffffffffffff, 0x0, 0x0) sendmmsg(0xffffffffffffffff, &(0x7f0000007880)=[{{&(0x7f00000001c0)=@l2={0x1f, 0xbf53, {0x9, 0x7, 0x0, 0x1ff, 0x2, 0x4}, 0x0, 0x7}, 0x80, 0x0}}, {{0x0, 0x0, &(0x7f0000007780)}}], 0x2, 0x4048851) setsockopt$packet_int(0xffffffffffffffff, 0x107, 0x0, 0x0, 0x0) syz_open_procfs(0x0, 0x0) ioctl$LOOP_SET_BLOCK_SIZE(0xffffffffffffffff, 0x4c09, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$cgroup_int(0xffffffffffffffff, 0x0, 0x2, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='\x89\x00\x00\x00\x00Ew\x00\x00\x00\xef\xb4\xc8\xd0\xff\xda\xb1vents\xd9\xc5H\xd4\x91\xfdN_]\x16\xe4\xa9C\xd2\x86Qn\xefS\x80\x11J\xfb4\x14\x86 4\x95\x9e\xfc\xc1\a\xcb \x95N\xe9\xa4j\xd2\x1f^\xb0\xb2>\xa3\xc9\xb7$\x11`t\x03: \x8b\xa4\x05\xf2?E\xdb+{t\xb8\xf7\xab\x8b\x100#', 0x26e1, 0x0) ioctl$PERF_EVENT_IOC_PAUSE_OUTPUT(r1, 0x40086602, 0x400007) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000280)='./cgroup/syz0\x00', 0x1ff) openat$smack_thread_current(0xffffffffffffff9c, &(0x7f0000000240)='/proc/thread-self/attr/current\x00', 0x2, 0x0) write$cgroup_subtree(r1, &(0x7f0000000100)=ANY=[], 0xff4a) write$cgroup_subtree(r2, &(0x7f0000000000)=ANY=[], 0x20032600) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a0f, 0x1700) accept$inet(0xffffffffffffffff, &(0x7f0000000040)={0x2, 0x0, @local}, &(0x7f0000000080)=0x10) ioctl$TCSETAF(r0, 0x5408, &(0x7f0000000040)={0x2}) ioctl$EXT4_IOC_GROUP_ADD(r0, 0x40286608, &(0x7f0000000000)={0x3, 0x7000000, 0x400, 0x100000000, 0x0, 0x8}) r3 = fcntl$dupfd(r0, 0x406, r0) ioctl$EVIOCGVERSION(r3, 0x80044501, &(0x7f0000000200)=""/31) write$binfmt_misc(r0, &(0x7f0000000080)={'syz1', "80fa25cdc862d216160cfa92845a3916e38a409a159c03f1889971d3e5144a8d08de78c4b1fbee457437261d7668b1c0f582647ad4134a05358d4309a71a702002329e024cac95642e761bb842bc1056bd6bf12c47697a649a026bd8ee1f685089941469b1ddfeddf32b392f0ff07652a3bce0770bc3bb70862845a65054cecb191e80b825d740fe6b40450359757032425dfdee92aec36ce4b468d50adc745c522cc4af2ac6e7f6a95f0edd70b09caa95fcc7143cf46b74db8bc17fa7c89f"}, 0xc3) 14:03:58 executing program 1: socket(0x0, 0x0, 0x0) syz_open_procfs(0x0, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$cgroup_int(0xffffffffffffffff, 0x0, 0x2, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x7a05, 0x1700) openat$smack_thread_current(0xffffffffffffff9c, 0x0, 0x2, 0x0) write$cgroup_subtree(r0, &(0x7f0000000000)=ANY=[], 0x20032600) ioctl$TCSETAF(0xffffffffffffffff, 0x5408, &(0x7f0000000040)={0x2}) ioctl$EXT4_IOC_GROUP_ADD(0xffffffffffffffff, 0x40286608, &(0x7f0000000000)={0x3, 0x7000000, 0x400, 0x100000000, 0x0, 0x8}) ioctl$EVIOCGVERSION(0xffffffffffffffff, 0x80044501, &(0x7f0000000200)=""/31) 14:03:58 executing program 0: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) r1 = accept$inet6(0xffffffffffffff9c, &(0x7f0000000340)={0xa, 0x0, 0x0, @local}, &(0x7f0000000280)=0xd) getsockopt$SO_COOKIE(r1, 0x1, 0x39, &(0x7f00000001c0), &(0x7f0000000200)=0x8) ioctl$TIOCSISO7816(r0, 0xc0285443, &(0x7f0000000040)={0x7ff, 0x0, 0xa6, 0xffffffffffffffff, 0x100000000}) ioctl$FS_IOC_SET_ENCRYPTION_POLICY(r0, 0x800c6613, &(0x7f0000000080)={0x0, @aes256, 0x0, "e9260d1e9e8ea1dd"}) ioctl$TIOCMGET(r0, 0x5415, &(0x7f0000000100)) ioctl$VT_GETMODE(r0, 0x5601, &(0x7f0000000000)) ioctl$TCFLSH(r0, 0x540b, 0x1) 14:03:58 executing program 0: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(r0, 0x540b, 0x1) ioctl$FS_IOC_FIEMAP(r0, 0xc020660b, &(0x7f0000000000)={0x47, 0x10000, 0x4, 0x400, 0x4, [{0x100, 0x35c8, 0x0, 0x0, 0x0, 0x800}, {0x8, 0x2, 0x81, 0x0, 0x0, 0x1000}, {0xfff, 0x3, 0x5, 0x0, 0x0, 0x2000}, {0x80000001, 0x1, 0xe4, 0x0, 0x0, 0x1000}]}) 14:03:58 executing program 5: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSPTLCK(r0, 0x40045431, &(0x7f0000000180)) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) socket(0x200000000000011, 0x4000000000080002, 0x0) syz_open_procfs(0x0, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$cgroup_int(0xffffffffffffffff, 0x0, 0x2, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) openat$smack_thread_current(0xffffffffffffff9c, &(0x7f0000000240)='/proc/thread-self/attr/current\x00', 0x2, 0x0) write$cgroup_subtree(r1, &(0x7f0000000000)=ANY=[], 0x20032600) ioctl$TCSETAF(r0, 0x5408, &(0x7f0000000040)={0x2}) ioctl$EXT4_IOC_GROUP_ADD(r0, 0x40286608, &(0x7f0000000000)={0x3, 0x7000000, 0x400, 0x100000000, 0x0, 0x8}) ioctl$EVIOCGVERSION(0xffffffffffffffff, 0x80044501, &(0x7f0000000200)=""/31) 14:03:58 executing program 1: socket(0x0, 0x0, 0x0) syz_open_procfs(0x0, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$cgroup_int(0xffffffffffffffff, 0x0, 0x2, 0x0) openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x7a05, 0x1700) openat$smack_thread_current(0xffffffffffffff9c, &(0x7f0000000240)='/proc/thread-self/attr/current\x00', 0x2, 0x0) write$cgroup_subtree(0xffffffffffffffff, &(0x7f0000000000)=ANY=[], 0x20032600) ioctl$TCSETAF(0xffffffffffffffff, 0x5408, &(0x7f0000000040)={0x2}) ioctl$EXT4_IOC_GROUP_ADD(0xffffffffffffffff, 0x40286608, &(0x7f0000000000)={0x3, 0x7000000, 0x400, 0x100000000, 0x0, 0x8}) ioctl$EVIOCGVERSION(0xffffffffffffffff, 0x80044501, &(0x7f0000000200)=""/31) 14:03:58 executing program 0: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(r0, 0x540b, 0x7c6caf31) fsetxattr(r0, &(0x7f0000000000)=@known='trusted.overlay.impure\x00', &(0x7f0000000040)='^i\\vmnet0cgroup@\x00', 0x11, 0x3) ioctl$KDGKBLED(r0, 0x4b64, &(0x7f0000000080)) 14:03:58 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSPTLCK(r0, 0x40045431, &(0x7f0000000180)) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) socket(0x200000000000011, 0x4000000000080002, 0x0) bind$packet(0xffffffffffffffff, 0x0, 0x0) sendmmsg(0xffffffffffffffff, &(0x7f0000007880)=[{{&(0x7f00000001c0)=@l2={0x1f, 0xbf53, {0x9, 0x7, 0xfffffffffffffdd5, 0x0, 0x2, 0x4}, 0x0, 0x7}, 0x80, 0x0}}, {{0x0, 0x0, &(0x7f0000007780)}}], 0x2, 0x4048851) setsockopt$packet_int(0xffffffffffffffff, 0x107, 0x0, 0x0, 0x0) syz_open_procfs(0x0, 0x0) ioctl$LOOP_SET_BLOCK_SIZE(0xffffffffffffffff, 0x4c09, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$cgroup_int(0xffffffffffffffff, 0x0, 0x2, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='\x89\x00\x00\x00\x00Ew\x00\x00\x00\xef\xb4\xc8\xd0\xff\xda\xb1vents\xd9\xc5H\xd4\x91\xfdN_]\x16\xe4\xa9C\xd2\x86Qn\xefS\x80\x11J\xfb4\x14\x86 4\x95\x9e\xfc\xc1\a\xcb \x95N\xe9\xa4j\xd2\x1f^\xb0\xb2>\xa3\xc9\xb7$\x11`t\x03: \x8b\xa4\x05\xf2?E\xdb+{t\xb8\xf7\xab\x8b\x100#', 0x26e1, 0x0) ioctl$PERF_EVENT_IOC_PAUSE_OUTPUT(r1, 0x40086602, 0x400007) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000280)='./cgroup/syz0\x00', 0x1ff) openat$smack_thread_current(0xffffffffffffff9c, &(0x7f0000000240)='/proc/thread-self/attr/current\x00', 0x2, 0x0) write$cgroup_subtree(r1, &(0x7f0000000100)=ANY=[], 0xff4a) write$cgroup_subtree(r2, &(0x7f0000000000)=ANY=[], 0x20032600) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a0f, 0x1700) accept$inet(0xffffffffffffffff, &(0x7f0000000040)={0x2, 0x0, @local}, &(0x7f0000000080)=0x10) ioctl$TCSETAF(r0, 0x5408, &(0x7f0000000040)={0x2}) ioctl$EXT4_IOC_GROUP_ADD(r0, 0x40286608, &(0x7f0000000000)={0x3, 0x7000000, 0x400, 0x100000000, 0x0, 0x8}) r3 = fcntl$dupfd(r0, 0x406, r0) ioctl$EVIOCGVERSION(r3, 0x80044501, &(0x7f0000000200)=""/31) write$binfmt_misc(r0, &(0x7f0000000080)={'syz1', "80fa25cdc862d216160cfa92845a3916e38a409a159c03f1889971d3e5144a8d08de78c4b1fbee457437261d7668b1c0f582647ad4134a05358d4309a71a702002329e024cac95642e761bb842bc1056bd6bf12c47697a649a026bd8ee1f685089941469b1ddfeddf32b392f0ff07652a3bce0770bc3bb70862845a65054cecb191e80b825d740fe6b40450359757032425dfdee92aec36ce4b468d50adc745c522cc4af2ac6e7f6a95f0edd70b09caa95fcc7143cf46b74db8bc17fa7c89f"}, 0xc3) 14:03:58 executing program 4: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSPTLCK(r0, 0x40045431, &(0x7f0000000180)) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) socket(0x200000000000011, 0x4000000000080002, 0x0) bind$packet(0xffffffffffffffff, 0x0, 0x0) sendmmsg(0xffffffffffffffff, &(0x7f0000007880)=[{{0x0, 0x0, 0x0}}, {{0x0, 0x0, &(0x7f0000007780)}}], 0x2, 0x4048851) setsockopt$packet_int(0xffffffffffffffff, 0x107, 0x0, 0x0, 0x0) syz_open_procfs(0x0, 0x0) ioctl$LOOP_SET_BLOCK_SIZE(0xffffffffffffffff, 0x4c09, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$cgroup_int(0xffffffffffffffff, 0x0, 0x2, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='\x89\x00\x00\x00\x00Ew\x00\x00\x00\xef\xb4\xc8\xd0\xff\xda\xb1vents\xd9\xc5H\xd4\x91\xfdN_]\x16\xe4\xa9C\xd2\x86Qn\xefS\x80\x11J\xfb4\x14\x86 4\x95\x9e\xfc\xc1\a\xcb \x95N\xe9\xa4j\xd2\x1f^\xb0\xb2>\xa3\xc9\xb7$\x11`t\x03: \x8b\xa4\x05\xf2?E\xdb+{t\xb8\xf7\xab\x8b\x100#', 0x26e1, 0x0) ioctl$PERF_EVENT_IOC_PAUSE_OUTPUT(r1, 0x40086602, 0x400007) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000280)='./cgroup/syz0\x00', 0x1ff) openat$smack_thread_current(0xffffffffffffff9c, &(0x7f0000000240)='/proc/thread-self/attr/current\x00', 0x2, 0x0) write$cgroup_subtree(r1, &(0x7f0000000100)=ANY=[], 0xff4a) write$cgroup_subtree(r2, &(0x7f0000000000)=ANY=[], 0x20032600) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a0f, 0x1700) accept$inet(0xffffffffffffffff, &(0x7f0000000040)={0x2, 0x0, @local}, &(0x7f0000000080)=0x10) ioctl$TCSETAF(r0, 0x5408, &(0x7f0000000040)={0x2}) ioctl$EXT4_IOC_GROUP_ADD(r0, 0x40286608, &(0x7f0000000000)={0x3, 0x7000000, 0x400, 0x100000000, 0x0, 0x8}) r3 = fcntl$dupfd(r0, 0x406, r0) ioctl$EVIOCGVERSION(r3, 0x80044501, &(0x7f0000000200)=""/31) write$binfmt_misc(r0, &(0x7f0000000080)={'syz1', "80fa25cdc862d216160cfa92845a3916e38a409a159c03f1889971d3e5144a8d08de78c4b1fbee457437261d7668b1c0f582647ad4134a05358d4309a71a702002329e024cac95642e761bb842bc1056bd6bf12c47697a649a026bd8ee1f685089941469b1ddfeddf32b392f0ff07652a3bce0770bc3bb70862845a65054cecb191e80b825d740fe6b40450359757032425dfdee92aec36ce4b468d50adc745c522cc4af2ac6e7f6a95f0edd70b09caa95fcc7143cf46b74db8bc17fa7c89f"}, 0xc3) 14:03:58 executing program 3: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSPTLCK(r0, 0x40045431, &(0x7f0000000180)) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) socket(0x200000000000011, 0x4000000000080002, 0x0) bind$packet(0xffffffffffffffff, 0x0, 0x0) sendmmsg(0xffffffffffffffff, &(0x7f0000007880)=[{{&(0x7f00000001c0)=@l2={0x1f, 0xbf53, {0x9, 0x7, 0x0, 0x1ff, 0x2, 0x4}, 0x0, 0x7}, 0x80, 0x0}}, {{0x0, 0x0, &(0x7f0000007780)}}], 0x2, 0x4048851) setsockopt$packet_int(0xffffffffffffffff, 0x107, 0x0, 0x0, 0x0) syz_open_procfs(0x0, 0x0) ioctl$LOOP_SET_BLOCK_SIZE(0xffffffffffffffff, 0x4c09, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$cgroup_int(0xffffffffffffffff, 0x0, 0x2, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='\x89\x00\x00\x00\x00Ew\x00\x00\x00\xef\xb4\xc8\xd0\xff\xda\xb1vents\xd9\xc5H\xd4\x91\xfdN_]\x16\xe4\xa9C\xd2\x86Qn\xefS\x80\x11J\xfb4\x14\x86 4\x95\x9e\xfc\xc1\a\xcb \x95N\xe9\xa4j\xd2\x1f^\xb0\xb2>\xa3\xc9\xb7$\x11`t\x03: \x8b\xa4\x05\xf2?E\xdb+{t\xb8\xf7\xab\x8b\x100#', 0x26e1, 0x0) ioctl$PERF_EVENT_IOC_PAUSE_OUTPUT(r1, 0x40086602, 0x400007) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000280)='./cgroup/syz0\x00', 0x1ff) openat$smack_thread_current(0xffffffffffffff9c, &(0x7f0000000240)='/proc/thread-self/attr/current\x00', 0x2, 0x0) write$cgroup_subtree(r1, &(0x7f0000000100)=ANY=[], 0xff4a) write$cgroup_subtree(r2, &(0x7f0000000000)=ANY=[], 0x20032600) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a0f, 0x1700) accept$inet(0xffffffffffffffff, &(0x7f0000000040)={0x2, 0x0, @local}, &(0x7f0000000080)=0x10) ioctl$TCSETAF(r0, 0x5408, &(0x7f0000000040)={0x2}) ioctl$EXT4_IOC_GROUP_ADD(r0, 0x40286608, &(0x7f0000000000)={0x3, 0x7000000, 0x400, 0x100000000, 0x0, 0x8}) r3 = fcntl$dupfd(r0, 0x406, r0) ioctl$EVIOCGVERSION(r3, 0x80044501, &(0x7f0000000200)=""/31) write$binfmt_misc(r0, &(0x7f0000000080)={'syz1', "80fa25cdc862d216160cfa92845a3916e38a409a159c03f1889971d3e5144a8d08de78c4b1fbee457437261d7668b1c0f582647ad4134a05358d4309a71a702002329e024cac95642e761bb842bc1056bd6bf12c47697a649a026bd8ee1f685089941469b1ddfeddf32b392f0ff07652a3bce0770bc3bb70862845a65054cecb191e80b825d740fe6b40450359757032425dfdee92aec36ce4b468d50adc745c522cc4af2ac6e7f6a95f0edd70b09caa95fcc7143cf46b74db8bc17fa7c89f"}, 0xc3) 14:03:58 executing program 0: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(r0, 0x540b, 0x1) r1 = request_key(&(0x7f0000000040)='id_legacy\x00', &(0x7f0000000080)={'syz', 0x3}, &(0x7f00000000c0)='/dev/ptmx\x00', 0xfffffffffffffffe) getsockopt$inet_IP_IPSEC_POLICY(0xffffffffffffff9c, 0x0, 0x10, &(0x7f0000000200)={{{@in6=@local, @in=@remote, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@mcast2}, 0x0, @in=@multicast1}}, &(0x7f0000000100)=0xe8) r3 = getgid() keyctl$chown(0x4, r1, r2, r3) pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r5 = getegid() ioctl$TUNSETGROUP(r4, 0x400454ce, r5) 14:03:58 executing program 5: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSPTLCK(r0, 0x40045431, &(0x7f0000000180)) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) socket(0x200000000000011, 0x4000000000080002, 0x0) syz_open_procfs(0x0, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$cgroup_int(0xffffffffffffffff, 0x0, 0x2, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) openat$smack_thread_current(0xffffffffffffff9c, &(0x7f0000000240)='/proc/thread-self/attr/current\x00', 0x2, 0x0) write$cgroup_subtree(r1, &(0x7f0000000000)=ANY=[], 0x20032600) ioctl$TCSETAF(r0, 0x5408, &(0x7f0000000040)={0x2}) ioctl$EXT4_IOC_GROUP_ADD(r0, 0x40286608, &(0x7f0000000000)={0x3, 0x7000000, 0x400, 0x100000000, 0x0, 0x8}) ioctl$EVIOCGVERSION(0xffffffffffffffff, 0x80044501, &(0x7f0000000200)=""/31) 14:03:58 executing program 1: socket(0x0, 0x0, 0x0) syz_open_procfs(0x0, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$cgroup_int(0xffffffffffffffff, 0x0, 0x2, 0x0) openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x7a05, 0x1700) openat$smack_thread_current(0xffffffffffffff9c, &(0x7f0000000240)='/proc/thread-self/attr/current\x00', 0x2, 0x0) write$cgroup_subtree(0xffffffffffffffff, &(0x7f0000000000)=ANY=[], 0x20032600) ioctl$TCSETAF(0xffffffffffffffff, 0x5408, &(0x7f0000000040)={0x2}) ioctl$EXT4_IOC_GROUP_ADD(0xffffffffffffffff, 0x40286608, &(0x7f0000000000)={0x3, 0x7000000, 0x400, 0x100000000, 0x0, 0x8}) ioctl$EVIOCGVERSION(0xffffffffffffffff, 0x80044501, &(0x7f0000000200)=""/31) 14:03:58 executing program 0: r0 = accept(0xffffffffffffffff, &(0x7f0000000040), &(0x7f00000000c0)=0x80) getsockopt$inet6_opts(r0, 0x29, 0x39, &(0x7f0000000200)=""/199, &(0x7f0000000100)=0xc7) r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(r1, 0x540b, 0x1) ioctl$VT_GETMODE(r1, 0x5601, &(0x7f0000000000)) 14:03:58 executing program 0: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(r0, 0x540b, 0x1) openat$selinux_context(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/context\x00', 0x2, 0x0) 14:03:58 executing program 1: socket(0x0, 0x0, 0x0) syz_open_procfs(0x0, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$cgroup_int(0xffffffffffffffff, 0x0, 0x2, 0x0) openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x7a05, 0x1700) openat$smack_thread_current(0xffffffffffffff9c, &(0x7f0000000240)='/proc/thread-self/attr/current\x00', 0x2, 0x0) write$cgroup_subtree(0xffffffffffffffff, &(0x7f0000000000)=ANY=[], 0x20032600) ioctl$TCSETAF(0xffffffffffffffff, 0x5408, &(0x7f0000000040)={0x2}) ioctl$EXT4_IOC_GROUP_ADD(0xffffffffffffffff, 0x40286608, &(0x7f0000000000)={0x3, 0x7000000, 0x400, 0x100000000, 0x0, 0x8}) ioctl$EVIOCGVERSION(0xffffffffffffffff, 0x80044501, &(0x7f0000000200)=""/31) 14:03:58 executing program 0: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cpuacct.usage_percpu_sys\x00', 0x0, 0x0) ioctl$PIO_FONTX(r0, 0x4b6c, &(0x7f0000000180)="277dc4daa9490e5f93190df7ec1d486be320a7601262d341c4c7623eeec0") socketpair(0xa, 0x6, 0x7fffffff, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = accept(r1, 0x0, &(0x7f0000000040)=0xfee5) getpeername$inet(r2, &(0x7f0000000100)={0x2, 0x0, @multicast2}, &(0x7f0000000140)=0x10) r3 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000200)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(r3, 0x540b, 0x1) ioctl$TIOCLINUX3(r3, 0x541c, &(0x7f0000000000)) 14:03:58 executing program 5: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSPTLCK(r0, 0x40045431, &(0x7f0000000180)) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) socket(0x200000000000011, 0x4000000000080002, 0x0) syz_open_procfs(0x0, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$cgroup_int(0xffffffffffffffff, 0x0, 0x2, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) openat$smack_thread_current(0xffffffffffffff9c, &(0x7f0000000240)='/proc/thread-self/attr/current\x00', 0x2, 0x0) write$cgroup_subtree(r1, &(0x7f0000000000)=ANY=[], 0x20032600) ioctl$TCSETAF(r0, 0x5408, &(0x7f0000000040)={0x2}) ioctl$EXT4_IOC_GROUP_ADD(r0, 0x40286608, &(0x7f0000000000)={0x3, 0x7000000, 0x400, 0x100000000, 0x0, 0x8}) ioctl$EVIOCGVERSION(0xffffffffffffffff, 0x80044501, &(0x7f0000000200)=""/31) 14:03:58 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSPTLCK(r0, 0x40045431, &(0x7f0000000180)) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) socket(0x200000000000011, 0x4000000000080002, 0x0) bind$packet(0xffffffffffffffff, 0x0, 0x0) sendmmsg(0xffffffffffffffff, &(0x7f0000007880)=[{{&(0x7f00000001c0)=@l2={0x1f, 0xbf53, {0x9, 0x7, 0xfffffffffffffdd5, 0x0, 0x2, 0x4}, 0x0, 0x7}, 0x80, 0x0}}, {{0x0, 0x0, &(0x7f0000007780)}}], 0x2, 0x4048851) setsockopt$packet_int(0xffffffffffffffff, 0x107, 0x0, 0x0, 0x0) syz_open_procfs(0x0, 0x0) ioctl$LOOP_SET_BLOCK_SIZE(0xffffffffffffffff, 0x4c09, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$cgroup_int(0xffffffffffffffff, 0x0, 0x2, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='\x89\x00\x00\x00\x00Ew\x00\x00\x00\xef\xb4\xc8\xd0\xff\xda\xb1vents\xd9\xc5H\xd4\x91\xfdN_]\x16\xe4\xa9C\xd2\x86Qn\xefS\x80\x11J\xfb4\x14\x86 4\x95\x9e\xfc\xc1\a\xcb \x95N\xe9\xa4j\xd2\x1f^\xb0\xb2>\xa3\xc9\xb7$\x11`t\x03: \x8b\xa4\x05\xf2?E\xdb+{t\xb8\xf7\xab\x8b\x100#', 0x26e1, 0x0) ioctl$PERF_EVENT_IOC_PAUSE_OUTPUT(r1, 0x40086602, 0x400007) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000280)='./cgroup/syz0\x00', 0x1ff) openat$smack_thread_current(0xffffffffffffff9c, &(0x7f0000000240)='/proc/thread-self/attr/current\x00', 0x2, 0x0) write$cgroup_subtree(r1, &(0x7f0000000100)=ANY=[], 0xff4a) write$cgroup_subtree(r2, &(0x7f0000000000)=ANY=[], 0x20032600) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a0f, 0x1700) accept$inet(0xffffffffffffffff, &(0x7f0000000040)={0x2, 0x0, @local}, &(0x7f0000000080)=0x10) ioctl$TCSETAF(r0, 0x5408, &(0x7f0000000040)={0x2}) ioctl$EXT4_IOC_GROUP_ADD(r0, 0x40286608, &(0x7f0000000000)={0x3, 0x7000000, 0x400, 0x100000000, 0x0, 0x8}) r3 = fcntl$dupfd(r0, 0x406, r0) ioctl$EVIOCGVERSION(r3, 0x80044501, &(0x7f0000000200)=""/31) write$binfmt_misc(r0, &(0x7f0000000080)={'syz1', "80fa25cdc862d216160cfa92845a3916e38a409a159c03f1889971d3e5144a8d08de78c4b1fbee457437261d7668b1c0f582647ad4134a05358d4309a71a702002329e024cac95642e761bb842bc1056bd6bf12c47697a649a026bd8ee1f685089941469b1ddfeddf32b392f0ff07652a3bce0770bc3bb70862845a65054cecb191e80b825d740fe6b40450359757032425dfdee92aec36ce4b468d50adc745c522cc4af2ac6e7f6a95f0edd70b09caa95fcc7143cf46b74db8bc17fa7c89f"}, 0xc3) 14:03:58 executing program 3: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSPTLCK(r0, 0x40045431, &(0x7f0000000180)) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) socket(0x200000000000011, 0x4000000000080002, 0x0) bind$packet(0xffffffffffffffff, 0x0, 0x0) sendmmsg(0xffffffffffffffff, &(0x7f0000007880)=[{{&(0x7f00000001c0)=@l2={0x1f, 0xbf53, {0x9, 0x7, 0xfffffffffffffdd5, 0x0, 0x2, 0x4}, 0x0, 0x7}, 0x80, 0x0}}, {{0x0, 0x0, &(0x7f0000007780)}}], 0x2, 0x4048851) setsockopt$packet_int(0xffffffffffffffff, 0x107, 0x0, 0x0, 0x0) syz_open_procfs(0x0, 0x0) ioctl$LOOP_SET_BLOCK_SIZE(0xffffffffffffffff, 0x4c09, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$cgroup_int(0xffffffffffffffff, 0x0, 0x2, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='\x89\x00\x00\x00\x00Ew\x00\x00\x00\xef\xb4\xc8\xd0\xff\xda\xb1vents\xd9\xc5H\xd4\x91\xfdN_]\x16\xe4\xa9C\xd2\x86Qn\xefS\x80\x11J\xfb4\x14\x86 4\x95\x9e\xfc\xc1\a\xcb \x95N\xe9\xa4j\xd2\x1f^\xb0\xb2>\xa3\xc9\xb7$\x11`t\x03: \x8b\xa4\x05\xf2?E\xdb+{t\xb8\xf7\xab\x8b\x100#', 0x26e1, 0x0) ioctl$PERF_EVENT_IOC_PAUSE_OUTPUT(r1, 0x40086602, 0x400007) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000280)='./cgroup/syz0\x00', 0x1ff) openat$smack_thread_current(0xffffffffffffff9c, &(0x7f0000000240)='/proc/thread-self/attr/current\x00', 0x2, 0x0) write$cgroup_subtree(r1, &(0x7f0000000100)=ANY=[], 0xff4a) write$cgroup_subtree(r2, &(0x7f0000000000)=ANY=[], 0x20032600) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a0f, 0x1700) accept$inet(0xffffffffffffffff, &(0x7f0000000040)={0x2, 0x0, @local}, &(0x7f0000000080)=0x10) ioctl$TCSETAF(r0, 0x5408, &(0x7f0000000040)={0x2}) ioctl$EXT4_IOC_GROUP_ADD(r0, 0x40286608, &(0x7f0000000000)={0x3, 0x7000000, 0x400, 0x100000000, 0x0, 0x8}) r3 = fcntl$dupfd(r0, 0x406, r0) ioctl$EVIOCGVERSION(r3, 0x80044501, &(0x7f0000000200)=""/31) write$binfmt_misc(r0, &(0x7f0000000080)={'syz1', "80fa25cdc862d216160cfa92845a3916e38a409a159c03f1889971d3e5144a8d08de78c4b1fbee457437261d7668b1c0f582647ad4134a05358d4309a71a702002329e024cac95642e761bb842bc1056bd6bf12c47697a649a026bd8ee1f685089941469b1ddfeddf32b392f0ff07652a3bce0770bc3bb70862845a65054cecb191e80b825d740fe6b40450359757032425dfdee92aec36ce4b468d50adc745c522cc4af2ac6e7f6a95f0edd70b09caa95fcc7143cf46b74db8bc17fa7c89f"}, 0xc3) 14:03:58 executing program 4: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSPTLCK(r0, 0x40045431, &(0x7f0000000180)) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) socket(0x200000000000011, 0x4000000000080002, 0x0) bind$packet(0xffffffffffffffff, 0x0, 0x0) sendmmsg(0xffffffffffffffff, &(0x7f0000007880)=[{{0x0, 0x0, 0x0}}, {{0x0, 0x0, &(0x7f0000007780)}}], 0x2, 0x4048851) setsockopt$packet_int(0xffffffffffffffff, 0x107, 0x0, 0x0, 0x0) syz_open_procfs(0x0, 0x0) ioctl$LOOP_SET_BLOCK_SIZE(0xffffffffffffffff, 0x4c09, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$cgroup_int(0xffffffffffffffff, 0x0, 0x2, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='\x89\x00\x00\x00\x00Ew\x00\x00\x00\xef\xb4\xc8\xd0\xff\xda\xb1vents\xd9\xc5H\xd4\x91\xfdN_]\x16\xe4\xa9C\xd2\x86Qn\xefS\x80\x11J\xfb4\x14\x86 4\x95\x9e\xfc\xc1\a\xcb \x95N\xe9\xa4j\xd2\x1f^\xb0\xb2>\xa3\xc9\xb7$\x11`t\x03: \x8b\xa4\x05\xf2?E\xdb+{t\xb8\xf7\xab\x8b\x100#', 0x26e1, 0x0) ioctl$PERF_EVENT_IOC_PAUSE_OUTPUT(r1, 0x40086602, 0x400007) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000280)='./cgroup/syz0\x00', 0x1ff) openat$smack_thread_current(0xffffffffffffff9c, &(0x7f0000000240)='/proc/thread-self/attr/current\x00', 0x2, 0x0) write$cgroup_subtree(r1, &(0x7f0000000100)=ANY=[], 0xff4a) write$cgroup_subtree(r2, &(0x7f0000000000)=ANY=[], 0x20032600) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a0f, 0x1700) accept$inet(0xffffffffffffffff, &(0x7f0000000040)={0x2, 0x0, @local}, &(0x7f0000000080)=0x10) ioctl$TCSETAF(r0, 0x5408, &(0x7f0000000040)={0x2}) ioctl$EXT4_IOC_GROUP_ADD(r0, 0x40286608, &(0x7f0000000000)={0x3, 0x7000000, 0x400, 0x100000000, 0x0, 0x8}) r3 = fcntl$dupfd(r0, 0x406, r0) ioctl$EVIOCGVERSION(r3, 0x80044501, &(0x7f0000000200)=""/31) write$binfmt_misc(r0, &(0x7f0000000080)={'syz1', "80fa25cdc862d216160cfa92845a3916e38a409a159c03f1889971d3e5144a8d08de78c4b1fbee457437261d7668b1c0f582647ad4134a05358d4309a71a702002329e024cac95642e761bb842bc1056bd6bf12c47697a649a026bd8ee1f685089941469b1ddfeddf32b392f0ff07652a3bce0770bc3bb70862845a65054cecb191e80b825d740fe6b40450359757032425dfdee92aec36ce4b468d50adc745c522cc4af2ac6e7f6a95f0edd70b09caa95fcc7143cf46b74db8bc17fa7c89f"}, 0xc3) 14:03:58 executing program 1: socket(0x0, 0x0, 0x0) syz_open_procfs(0x0, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$cgroup_int(0xffffffffffffffff, 0x0, 0x2, 0x0) openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x7a05, 0x1700) openat$smack_thread_current(0xffffffffffffff9c, &(0x7f0000000240)='/proc/thread-self/attr/current\x00', 0x2, 0x0) write$cgroup_subtree(0xffffffffffffffff, 0x0, 0x0) ioctl$TCSETAF(0xffffffffffffffff, 0x5408, &(0x7f0000000040)={0x2}) ioctl$EXT4_IOC_GROUP_ADD(0xffffffffffffffff, 0x40286608, &(0x7f0000000000)={0x3, 0x7000000, 0x400, 0x100000000, 0x0, 0x8}) ioctl$EVIOCGVERSION(0xffffffffffffffff, 0x80044501, &(0x7f0000000200)=""/31) 14:03:58 executing program 0: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ptmx\x00', 0x400000, 0x0) ioctl$TCFLSH(r0, 0x540b, 0x1) 14:03:58 executing program 5: r0 = dup2(0xffffffffffffff9c, 0xffffffffffffffff) r1 = syz_genetlink_get_family_id$tipc(&(0x7f0000000100)='TIPC\x00') sendmsg$TIPC_CMD_RESET_LINK_STATS(r0, &(0x7f00000001c0)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x10108}, 0xc, &(0x7f0000000180)={&(0x7f0000000140)={0x28, r1, 0x202, 0x70bd29, 0x25dfdbfd, {{}, 0x0, 0x410c, 0x0, {0xc, 0x14, 'syz1\x00'}}, ["", "", "", "", "", "", "", "", ""]}, 0x28}, 0x1, 0x0, 0x0, 0x8000}, 0x80) r2 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) r3 = socket$nl_generic(0x10, 0x3, 0x10) getsockopt$sock_linger(r3, 0x1, 0xd, &(0x7f0000000040), &(0x7f0000000080)=0x8) ioctl$BINDER_THREAD_EXIT(r2, 0x40046208, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r2, 0xc018620b, &(0x7f0000000000)) 14:03:58 executing program 1: socket(0x0, 0x0, 0x0) syz_open_procfs(0x0, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$cgroup_int(0xffffffffffffffff, 0x0, 0x2, 0x0) openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x7a05, 0x1700) openat$smack_thread_current(0xffffffffffffff9c, &(0x7f0000000240)='/proc/thread-self/attr/current\x00', 0x2, 0x0) write$cgroup_subtree(0xffffffffffffffff, 0x0, 0x0) ioctl$TCSETAF(0xffffffffffffffff, 0x5408, 0x0) ioctl$EXT4_IOC_GROUP_ADD(0xffffffffffffffff, 0x40286608, &(0x7f0000000000)={0x3, 0x7000000, 0x400, 0x100000000, 0x0, 0x8}) ioctl$EVIOCGVERSION(0xffffffffffffffff, 0x80044501, &(0x7f0000000200)=""/31) 14:03:58 executing program 0: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$PIO_UNIMAP(r0, 0x4b67, &(0x7f0000000040)={0x9, &(0x7f0000000080)=[{0x4, 0x8}, {0x5, 0x4}, {}, {0x5, 0xfffffffffffffff8}, {0x7, 0x6}, {0x100000001, 0x6}, {0xf5, 0x2}, {0x9, 0x5}, {0x8021, 0x302}]}) ioctl$TIOCNXCL(r0, 0x540d) ioctl$TCFLSH(r0, 0x540b, 0x1) 14:03:59 executing program 0: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCGSID(r0, 0x5429, &(0x7f0000000000)=0x0) ioctl$TIOCEXCL(r0, 0x540c) r2 = open(&(0x7f0000000040)='./file0\x00', 0x101000, 0x19) bpf$BPF_GET_PROG_INFO(0xf, &(0x7f0000000300)={0xffffffffffffffff, 0xc0, &(0x7f0000000240)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, ""/16, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f00000000c0)=0x7, 0x0, 0x0, 0x0, &(0x7f0000000100)={0x350, 0x4}, 0x0, 0x0, &(0x7f0000000140)={0x0, 0x3e651274, 0x90000000, 0x6}, &(0x7f0000000180)=0x400, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000200)=0x4}}, 0x10) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000340)={r1, r2, 0x0, 0xa, &(0x7f0000000080)='/dev/ptmx\x00', r3}, 0x30) ioctl$TCFLSH(r0, 0x540b, 0x1) 14:03:59 executing program 1: socket(0x0, 0x0, 0x0) syz_open_procfs(0x0, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$cgroup_int(0xffffffffffffffff, 0x0, 0x2, 0x0) openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x7a05, 0x1700) openat$smack_thread_current(0xffffffffffffff9c, &(0x7f0000000240)='/proc/thread-self/attr/current\x00', 0x2, 0x0) write$cgroup_subtree(0xffffffffffffffff, 0x0, 0x0) ioctl$TCSETAF(0xffffffffffffffff, 0x5408, 0x0) ioctl$EXT4_IOC_GROUP_ADD(0xffffffffffffffff, 0x40286608, &(0x7f0000000000)={0x3, 0x7000000, 0x400, 0x100000000, 0x0, 0x8}) ioctl$EVIOCGVERSION(0xffffffffffffffff, 0x80044501, &(0x7f0000000200)=""/31) 14:03:59 executing program 0: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/ptmx\x00', 0x0, 0x0) r1 = openat$selinux_avc_cache_stats(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/avc/cache_stats\x00', 0x0, 0x0) setsockopt$inet6_opts(r1, 0x29, 0x3f, &(0x7f0000000040)=ANY=[@ANYBLOB="8906000000000000040101fb2535f79920000000000000001a4941383f26cdfea118e8731720fe0380963141e396467c744c050204e600010000000000000000"], 0x40) ioctl$TCSETAF(r0, 0x5408, &(0x7f0000000080)={0xb5e, 0x1, 0x3ff, 0x2, 0x7, 0xffffffffffffffff, 0x9, 0x6, 0x87, 0x9}) ioctl$TCFLSH(r0, 0x540b, 0x4c84) [ 345.460306] audit: type=1400 audit(1555509838.968:25): avc: denied { getopt } for pid=11777 comm="syz-executor.5" scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=netlink_generic_socket permissive=1 14:03:59 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSPTLCK(r0, 0x40045431, &(0x7f0000000180)) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) socket(0x200000000000011, 0x4000000000080002, 0x0) bind$packet(0xffffffffffffffff, 0x0, 0x0) sendmmsg(0xffffffffffffffff, &(0x7f0000007880)=[{{&(0x7f00000001c0)=@l2={0x1f, 0xbf53, {0x9, 0x7, 0xfffffffffffffdd5, 0x0, 0x2, 0x4}, 0x0, 0x7}, 0x80, 0x0}}, {{0x0, 0x0, &(0x7f0000007780)}}], 0x2, 0x4048851) setsockopt$packet_int(0xffffffffffffffff, 0x107, 0x0, 0x0, 0x0) syz_open_procfs(0x0, 0x0) ioctl$LOOP_SET_BLOCK_SIZE(0xffffffffffffffff, 0x4c09, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$cgroup_int(0xffffffffffffffff, 0x0, 0x2, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='\x89\x00\x00\x00\x00Ew\x00\x00\x00\xef\xb4\xc8\xd0\xff\xda\xb1vents\xd9\xc5H\xd4\x91\xfdN_]\x16\xe4\xa9C\xd2\x86Qn\xefS\x80\x11J\xfb4\x14\x86 4\x95\x9e\xfc\xc1\a\xcb \x95N\xe9\xa4j\xd2\x1f^\xb0\xb2>\xa3\xc9\xb7$\x11`t\x03: \x8b\xa4\x05\xf2?E\xdb+{t\xb8\xf7\xab\x8b\x100#', 0x26e1, 0x0) ioctl$PERF_EVENT_IOC_PAUSE_OUTPUT(r1, 0x40086602, 0x400007) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000280)='./cgroup/syz0\x00', 0x1ff) openat$smack_thread_current(0xffffffffffffff9c, &(0x7f0000000240)='/proc/thread-self/attr/current\x00', 0x2, 0x0) write$cgroup_subtree(r1, &(0x7f0000000100)=ANY=[], 0xff4a) write$cgroup_subtree(r2, &(0x7f0000000000)=ANY=[], 0x20032600) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a0f, 0x1700) accept$inet(0xffffffffffffffff, &(0x7f0000000040)={0x2, 0x0, @local}, &(0x7f0000000080)=0x10) ioctl$TCSETAF(r0, 0x5408, &(0x7f0000000040)={0x2}) ioctl$EXT4_IOC_GROUP_ADD(r0, 0x40286608, &(0x7f0000000000)={0x3, 0x7000000, 0x400, 0x100000000, 0x0, 0x8}) r3 = fcntl$dupfd(r0, 0x406, r0) ioctl$EVIOCGVERSION(r3, 0x80044501, &(0x7f0000000200)=""/31) write$binfmt_misc(r0, &(0x7f0000000080)={'syz1', "80fa25cdc862d216160cfa92845a3916e38a409a159c03f1889971d3e5144a8d08de78c4b1fbee457437261d7668b1c0f582647ad4134a05358d4309a71a702002329e024cac95642e761bb842bc1056bd6bf12c47697a649a026bd8ee1f685089941469b1ddfeddf32b392f0ff07652a3bce0770bc3bb70862845a65054cecb191e80b825d740fe6b40450359757032425dfdee92aec36ce4b468d50adc745c522cc4af2ac6e7f6a95f0edd70b09caa95fcc7143cf46b74db8bc17fa7c89f"}, 0xc3) 14:03:59 executing program 3: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSPTLCK(r0, 0x40045431, &(0x7f0000000180)) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) socket(0x200000000000011, 0x4000000000080002, 0x0) bind$packet(0xffffffffffffffff, 0x0, 0x0) sendmmsg(0xffffffffffffffff, &(0x7f0000007880)=[{{&(0x7f00000001c0)=@l2={0x1f, 0xbf53, {0x9, 0x7, 0xfffffffffffffdd5, 0x0, 0x2, 0x4}, 0x0, 0x7}, 0x80, 0x0}}, {{0x0, 0x0, &(0x7f0000007780)}}], 0x2, 0x4048851) setsockopt$packet_int(0xffffffffffffffff, 0x107, 0x0, 0x0, 0x0) syz_open_procfs(0x0, 0x0) ioctl$LOOP_SET_BLOCK_SIZE(0xffffffffffffffff, 0x4c09, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$cgroup_int(0xffffffffffffffff, 0x0, 0x2, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='\x89\x00\x00\x00\x00Ew\x00\x00\x00\xef\xb4\xc8\xd0\xff\xda\xb1vents\xd9\xc5H\xd4\x91\xfdN_]\x16\xe4\xa9C\xd2\x86Qn\xefS\x80\x11J\xfb4\x14\x86 4\x95\x9e\xfc\xc1\a\xcb \x95N\xe9\xa4j\xd2\x1f^\xb0\xb2>\xa3\xc9\xb7$\x11`t\x03: \x8b\xa4\x05\xf2?E\xdb+{t\xb8\xf7\xab\x8b\x100#', 0x26e1, 0x0) ioctl$PERF_EVENT_IOC_PAUSE_OUTPUT(r1, 0x40086602, 0x400007) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000280)='./cgroup/syz0\x00', 0x1ff) openat$smack_thread_current(0xffffffffffffff9c, &(0x7f0000000240)='/proc/thread-self/attr/current\x00', 0x2, 0x0) write$cgroup_subtree(r1, &(0x7f0000000100)=ANY=[], 0xff4a) write$cgroup_subtree(r2, &(0x7f0000000000)=ANY=[], 0x20032600) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a0f, 0x1700) accept$inet(0xffffffffffffffff, &(0x7f0000000040)={0x2, 0x0, @local}, &(0x7f0000000080)=0x10) ioctl$TCSETAF(r0, 0x5408, &(0x7f0000000040)={0x2}) ioctl$EXT4_IOC_GROUP_ADD(r0, 0x40286608, &(0x7f0000000000)={0x3, 0x7000000, 0x400, 0x100000000, 0x0, 0x8}) r3 = fcntl$dupfd(r0, 0x406, r0) ioctl$EVIOCGVERSION(r3, 0x80044501, &(0x7f0000000200)=""/31) write$binfmt_misc(r0, &(0x7f0000000080)={'syz1', "80fa25cdc862d216160cfa92845a3916e38a409a159c03f1889971d3e5144a8d08de78c4b1fbee457437261d7668b1c0f582647ad4134a05358d4309a71a702002329e024cac95642e761bb842bc1056bd6bf12c47697a649a026bd8ee1f685089941469b1ddfeddf32b392f0ff07652a3bce0770bc3bb70862845a65054cecb191e80b825d740fe6b40450359757032425dfdee92aec36ce4b468d50adc745c522cc4af2ac6e7f6a95f0edd70b09caa95fcc7143cf46b74db8bc17fa7c89f"}, 0xc3) 14:03:59 executing program 4: socket(0x0, 0x0, 0x0) syz_open_procfs(0x0, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$cgroup_int(0xffffffffffffffff, 0x0, 0x2, 0x0) openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x7a05, 0x1700) openat$smack_thread_current(0xffffffffffffff9c, &(0x7f0000000240)='/proc/thread-self/attr/current\x00', 0x2, 0x0) write$cgroup_subtree(0xffffffffffffffff, 0x0, 0x0) ioctl$TCSETAF(0xffffffffffffffff, 0x5408, &(0x7f0000000040)={0x2}) ioctl$EXT4_IOC_GROUP_ADD(0xffffffffffffffff, 0x40286608, &(0x7f0000000000)={0x3, 0x7000000, 0x400, 0x100000000, 0x0, 0x8}) ioctl$EVIOCGVERSION(0xffffffffffffffff, 0x80044501, &(0x7f0000000200)=""/31) 14:03:59 executing program 1: socket(0x0, 0x0, 0x0) syz_open_procfs(0x0, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$cgroup_int(0xffffffffffffffff, 0x0, 0x2, 0x0) openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x7a05, 0x1700) openat$smack_thread_current(0xffffffffffffff9c, &(0x7f0000000240)='/proc/thread-self/attr/current\x00', 0x2, 0x0) write$cgroup_subtree(0xffffffffffffffff, 0x0, 0x0) ioctl$TCSETAF(0xffffffffffffffff, 0x5408, 0x0) ioctl$EXT4_IOC_GROUP_ADD(0xffffffffffffffff, 0x40286608, &(0x7f0000000000)={0x3, 0x7000000, 0x400, 0x100000000, 0x0, 0x8}) ioctl$EVIOCGVERSION(0xffffffffffffffff, 0x80044501, &(0x7f0000000200)=""/31) 14:03:59 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0x0, 0x10000000000) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, &(0x7f0000000080)) 14:03:59 executing program 0: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(r0, 0x540b, 0x5) 14:03:59 executing program 1: socket(0x0, 0x0, 0x0) syz_open_procfs(0x0, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$cgroup_int(0xffffffffffffffff, 0x0, 0x2, 0x0) openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x7a05, 0x1700) openat$smack_thread_current(0xffffffffffffff9c, &(0x7f0000000240)='/proc/thread-self/attr/current\x00', 0x2, 0x0) write$cgroup_subtree(0xffffffffffffffff, 0x0, 0x0) ioctl$TCSETAF(0xffffffffffffffff, 0x5408, &(0x7f0000000040)) ioctl$EXT4_IOC_GROUP_ADD(0xffffffffffffffff, 0x40286608, &(0x7f0000000000)={0x3, 0x7000000, 0x400, 0x100000000, 0x0, 0x8}) ioctl$EVIOCGVERSION(0xffffffffffffffff, 0x80044501, &(0x7f0000000200)=""/31) 14:03:59 executing program 4: socket(0x0, 0x0, 0x0) syz_open_procfs(0x0, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$cgroup_int(0xffffffffffffffff, 0x0, 0x2, 0x0) openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x7a05, 0x1700) openat$smack_thread_current(0xffffffffffffff9c, &(0x7f0000000240)='/proc/thread-self/attr/current\x00', 0x2, 0x0) write$cgroup_subtree(0xffffffffffffffff, 0x0, 0x0) ioctl$TCSETAF(0xffffffffffffffff, 0x5408, &(0x7f0000000040)={0x2}) ioctl$EXT4_IOC_GROUP_ADD(0xffffffffffffffff, 0x40286608, &(0x7f0000000000)={0x3, 0x7000000, 0x400, 0x100000000, 0x0, 0x8}) ioctl$EVIOCGVERSION(0xffffffffffffffff, 0x80044501, &(0x7f0000000200)=""/31) 14:03:59 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, &(0x7f0000000000)={0x0}) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, &(0x7f00000000c0)={r1}) write$P9_RRENAME(0xffffffffffffffff, &(0x7f0000000080)={0x7, 0x15, 0x1}, 0x7) 14:03:59 executing program 0: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$KDENABIO(r0, 0x4b36) ioctl$TCFLSH(r0, 0x540b, 0x1) 14:03:59 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, &(0x7f0000000040)={0x0}) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, &(0x7f0000000080)={r1}) syz_genetlink_get_family_id$fou(&(0x7f0000000000)='fou\x00') 14:03:59 executing program 1: socket(0x0, 0x0, 0x0) syz_open_procfs(0x0, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$cgroup_int(0xffffffffffffffff, 0x0, 0x2, 0x0) openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x7a05, 0x1700) openat$smack_thread_current(0xffffffffffffff9c, &(0x7f0000000240)='/proc/thread-self/attr/current\x00', 0x2, 0x0) write$cgroup_subtree(0xffffffffffffffff, 0x0, 0x0) ioctl$TCSETAF(0xffffffffffffffff, 0x5408, &(0x7f0000000040)) ioctl$EXT4_IOC_GROUP_ADD(0xffffffffffffffff, 0x40286608, &(0x7f0000000000)={0x3, 0x7000000, 0x400, 0x100000000, 0x0, 0x8}) ioctl$EVIOCGVERSION(0xffffffffffffffff, 0x80044501, &(0x7f0000000200)=""/31) 14:03:59 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSPTLCK(r0, 0x40045431, &(0x7f0000000180)) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) socket(0x200000000000011, 0x4000000000080002, 0x0) bind$packet(0xffffffffffffffff, 0x0, 0x0) sendmmsg(0xffffffffffffffff, &(0x7f0000007880)=[{{&(0x7f00000001c0)=@l2={0x1f, 0xbf53, {0x9, 0x7, 0xfffffffffffffdd5, 0x1ff, 0x0, 0x4}, 0x0, 0x7}, 0x80, 0x0}}, {{0x0, 0x0, &(0x7f0000007780)}}], 0x2, 0x4048851) setsockopt$packet_int(0xffffffffffffffff, 0x107, 0x0, 0x0, 0x0) syz_open_procfs(0x0, 0x0) ioctl$LOOP_SET_BLOCK_SIZE(0xffffffffffffffff, 0x4c09, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$cgroup_int(0xffffffffffffffff, 0x0, 0x2, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='\x89\x00\x00\x00\x00Ew\x00\x00\x00\xef\xb4\xc8\xd0\xff\xda\xb1vents\xd9\xc5H\xd4\x91\xfdN_]\x16\xe4\xa9C\xd2\x86Qn\xefS\x80\x11J\xfb4\x14\x86 4\x95\x9e\xfc\xc1\a\xcb \x95N\xe9\xa4j\xd2\x1f^\xb0\xb2>\xa3\xc9\xb7$\x11`t\x03: \x8b\xa4\x05\xf2?E\xdb+{t\xb8\xf7\xab\x8b\x100#', 0x26e1, 0x0) ioctl$PERF_EVENT_IOC_PAUSE_OUTPUT(r1, 0x40086602, 0x400007) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000280)='./cgroup/syz0\x00', 0x1ff) openat$smack_thread_current(0xffffffffffffff9c, &(0x7f0000000240)='/proc/thread-self/attr/current\x00', 0x2, 0x0) write$cgroup_subtree(r1, &(0x7f0000000100)=ANY=[], 0xff4a) write$cgroup_subtree(r2, &(0x7f0000000000)=ANY=[], 0x20032600) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a0f, 0x1700) accept$inet(0xffffffffffffffff, &(0x7f0000000040)={0x2, 0x0, @local}, &(0x7f0000000080)=0x10) ioctl$TCSETAF(r0, 0x5408, &(0x7f0000000040)={0x2}) ioctl$EXT4_IOC_GROUP_ADD(r0, 0x40286608, &(0x7f0000000000)={0x3, 0x7000000, 0x400, 0x100000000, 0x0, 0x8}) r3 = fcntl$dupfd(r0, 0x406, r0) ioctl$EVIOCGVERSION(r3, 0x80044501, &(0x7f0000000200)=""/31) write$binfmt_misc(r0, &(0x7f0000000080)={'syz1', "80fa25cdc862d216160cfa92845a3916e38a409a159c03f1889971d3e5144a8d08de78c4b1fbee457437261d7668b1c0f582647ad4134a05358d4309a71a702002329e024cac95642e761bb842bc1056bd6bf12c47697a649a026bd8ee1f685089941469b1ddfeddf32b392f0ff07652a3bce0770bc3bb70862845a65054cecb191e80b825d740fe6b40450359757032425dfdee92aec36ce4b468d50adc745c522cc4af2ac6e7f6a95f0edd70b09caa95fcc7143cf46b74db8bc17fa7c89f"}, 0xc3) 14:03:59 executing program 3: syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x2) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f00000001c0)=[@acquire], 0x0, 0x0, 0x0}) 14:03:59 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) splice(r0, &(0x7f0000000040), r0, &(0x7f0000000080), 0xdc, 0x1) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, &(0x7f0000000000)) creat(&(0x7f00000000c0)='./file0\x00', 0x34) 14:03:59 executing program 4: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSPTLCK(r0, 0x40045431, &(0x7f0000000180)) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) socket(0x200000000000011, 0x4000000000080002, 0x0) bind$packet(0xffffffffffffffff, 0x0, 0x0) sendmmsg(0xffffffffffffffff, &(0x7f0000007880)=[{{&(0x7f00000001c0)=@l2={0x1f, 0xbf53, {0x9, 0x7, 0xfffffffffffffdd5, 0x0, 0x2, 0x4}, 0x0, 0x7}, 0x80, 0x0}}, {{0x0, 0x0, &(0x7f0000007780)}}], 0x2, 0x4048851) setsockopt$packet_int(0xffffffffffffffff, 0x107, 0x0, 0x0, 0x0) syz_open_procfs(0x0, 0x0) ioctl$LOOP_SET_BLOCK_SIZE(0xffffffffffffffff, 0x4c09, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$cgroup_int(0xffffffffffffffff, 0x0, 0x2, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='\x89\x00\x00\x00\x00Ew\x00\x00\x00\xef\xb4\xc8\xd0\xff\xda\xb1vents\xd9\xc5H\xd4\x91\xfdN_]\x16\xe4\xa9C\xd2\x86Qn\xefS\x80\x11J\xfb4\x14\x86 4\x95\x9e\xfc\xc1\a\xcb \x95N\xe9\xa4j\xd2\x1f^\xb0\xb2>\xa3\xc9\xb7$\x11`t\x03: \x8b\xa4\x05\xf2?E\xdb+{t\xb8\xf7\xab\x8b\x100#', 0x26e1, 0x0) ioctl$PERF_EVENT_IOC_PAUSE_OUTPUT(r1, 0x40086602, 0x400007) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000280)='./cgroup/syz0\x00', 0x1ff) openat$smack_thread_current(0xffffffffffffff9c, &(0x7f0000000240)='/proc/thread-self/attr/current\x00', 0x2, 0x0) write$cgroup_subtree(r1, &(0x7f0000000100)=ANY=[], 0xff4a) write$cgroup_subtree(r2, &(0x7f0000000000)=ANY=[], 0x20032600) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a0f, 0x1700) accept$inet(0xffffffffffffffff, &(0x7f0000000040)={0x2, 0x0, @local}, &(0x7f0000000080)=0x10) ioctl$TCSETAF(r0, 0x5408, &(0x7f0000000040)={0x2}) ioctl$EXT4_IOC_GROUP_ADD(r0, 0x40286608, &(0x7f0000000000)={0x3, 0x7000000, 0x400, 0x100000000, 0x0, 0x8}) r3 = fcntl$dupfd(r0, 0x406, r0) ioctl$EVIOCGVERSION(r3, 0x80044501, &(0x7f0000000200)=""/31) write$binfmt_misc(r0, &(0x7f0000000080)={'syz1', "80fa25cdc862d216160cfa92845a3916e38a409a159c03f1889971d3e5144a8d08de78c4b1fbee457437261d7668b1c0f582647ad4134a05358d4309a71a702002329e024cac95642e761bb842bc1056bd6bf12c47697a649a026bd8ee1f685089941469b1ddfeddf32b392f0ff07652a3bce0770bc3bb70862845a65054cecb191e80b825d740fe6b40450359757032425dfdee92aec36ce4b468d50adc745c522cc4af2ac6e7f6a95f0edd70b09caa95fcc7143cf46b74db8bc17fa7c89f"}, 0xc3) 14:03:59 executing program 0: r0 = openat$selinux_status(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/status\x00', 0x0, 0x0) ioctl$VT_RESIZEX(r0, 0x560a, &(0x7f0000000040)={0x55eb0cc, 0x3, 0x4, 0x7, 0x3, 0x4}) r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(r1, 0x540b, 0x1) 14:03:59 executing program 1: socket(0x0, 0x0, 0x0) syz_open_procfs(0x0, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$cgroup_int(0xffffffffffffffff, 0x0, 0x2, 0x0) openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x7a05, 0x1700) openat$smack_thread_current(0xffffffffffffff9c, &(0x7f0000000240)='/proc/thread-self/attr/current\x00', 0x2, 0x0) write$cgroup_subtree(0xffffffffffffffff, 0x0, 0x0) ioctl$TCSETAF(0xffffffffffffffff, 0x5408, &(0x7f0000000040)) ioctl$EXT4_IOC_GROUP_ADD(0xffffffffffffffff, 0x40286608, &(0x7f0000000000)={0x3, 0x7000000, 0x400, 0x100000000, 0x0, 0x8}) ioctl$EVIOCGVERSION(0xffffffffffffffff, 0x80044501, &(0x7f0000000200)=""/31) 14:03:59 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000300)='/dev/binder#\x00', 0x0, 0x802) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = openat$selinux_avc_hash_stats(0xffffffffffffff9c, &(0x7f0000000200)='/selinux/avc/hash_stats\x00', 0x0, 0x0) r2 = ioctl$LOOP_CTL_GET_FREE(0xffffffffffffffff, 0x4c82) ioctl$LOOP_CTL_ADD(r1, 0x4c80, r2) r3 = dup3(r0, r0, 0x80000) setsockopt$inet6_IPV6_ADDRFORM(r3, 0x29, 0x1, &(0x7f0000000240), 0x3) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, &(0x7f0000000000)) r4 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000040)='pagemap\x00') ioctl$VT_RELDISP(r4, 0x5605) getsockopt$inet_IP_XFRM_POLICY(r4, 0x0, 0x11, &(0x7f0000000080)={{{@in6=@local, @in=@multicast1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@multicast1}, 0x0, @in6=@ipv4={[], [], @initdev}}}, &(0x7f0000000180)=0xe8) bind$packet(r4, &(0x7f00000001c0)={0x11, 0x1f, r5, 0x1, 0x5, 0x6, @local}, 0x14) 14:03:59 executing program 0: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(r0, 0x540b, 0x1) r1 = openat$selinux_policy(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/policy\x00', 0x0, 0x0) setsockopt$SO_BINDTODEVICE(r1, 0x1, 0x19, &(0x7f0000000040)='bond_slave_0\x00', 0x10) 14:03:59 executing program 1: socket(0x0, 0x0, 0x0) syz_open_procfs(0x0, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$cgroup_int(0xffffffffffffffff, 0x0, 0x2, 0x0) openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x7a05, 0x1700) openat$smack_thread_current(0xffffffffffffff9c, &(0x7f0000000240)='/proc/thread-self/attr/current\x00', 0x2, 0x0) write$cgroup_subtree(0xffffffffffffffff, 0x0, 0x0) ioctl$TCSETAF(0xffffffffffffffff, 0x5408, &(0x7f0000000040)) ioctl$EXT4_IOC_GROUP_ADD(0xffffffffffffffff, 0x40286608, 0x0) ioctl$EVIOCGVERSION(0xffffffffffffffff, 0x80044501, &(0x7f0000000200)=""/31) 14:03:59 executing program 3: syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = openat$full(0xffffffffffffff9c, &(0x7f0000000000)='/dev/full\x00', 0x200000, 0x0) r1 = syz_genetlink_get_family_id$tipc(&(0x7f0000000080)='TIPC\x00') sendmsg$TIPC_CMD_SET_NETID(r0, &(0x7f0000000140)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0xa0040010}, 0xc, &(0x7f0000000100)={&(0x7f00000000c0)={0x24, r1, 0x304, 0x70bd2c, 0x25dfdbfb, {{}, 0x0, 0x800b, 0x0, {0x8, 0x2, 0x3}}, ["", "", "", "", "", "", "", "", ""]}, 0x24}, 0x1, 0x0, 0x0, 0x80}, 0x8000) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f00000001c0)=[@acquire], 0x0, 0x0, 0x0}) [ 345.786746] binder: 11853:11869 Acquire 1 refcount change on invalid ref 0 ret -22 14:03:59 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, &(0x7f0000000000)) r1 = openat$full(0xffffffffffffff9c, &(0x7f0000000040)='/dev/full\x00', 0x24000, 0x0) setsockopt$inet_udp_encap(r1, 0x11, 0x64, &(0x7f0000000080)=0x3, 0x4) lsetxattr$security_ima(&(0x7f00000000c0)='./file0\x00', &(0x7f0000000100)='security.ima\x00', &(0x7f0000000140)=@md5={0x1, "de49d6fdaf5ffc27c07eb6bd8d308496"}, 0x11, 0x3) 14:03:59 executing program 1: socket(0x0, 0x0, 0x0) syz_open_procfs(0x0, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$cgroup_int(0xffffffffffffffff, 0x0, 0x2, 0x0) openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x7a05, 0x1700) openat$smack_thread_current(0xffffffffffffff9c, &(0x7f0000000240)='/proc/thread-self/attr/current\x00', 0x2, 0x0) write$cgroup_subtree(0xffffffffffffffff, 0x0, 0x0) ioctl$TCSETAF(0xffffffffffffffff, 0x5408, &(0x7f0000000040)) ioctl$EXT4_IOC_GROUP_ADD(0xffffffffffffffff, 0x40286608, 0x0) ioctl$EVIOCGVERSION(0xffffffffffffffff, 0x80044501, &(0x7f0000000200)=""/31) 14:03:59 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSPTLCK(r0, 0x40045431, &(0x7f0000000180)) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) socket(0x200000000000011, 0x4000000000080002, 0x0) bind$packet(0xffffffffffffffff, 0x0, 0x0) sendmmsg(0xffffffffffffffff, &(0x7f0000007880)=[{{&(0x7f00000001c0)=@l2={0x1f, 0xbf53, {0x9, 0x7, 0xfffffffffffffdd5, 0x1ff, 0x0, 0x4}, 0x0, 0x7}, 0x80, 0x0}}, {{0x0, 0x0, &(0x7f0000007780)}}], 0x2, 0x4048851) setsockopt$packet_int(0xffffffffffffffff, 0x107, 0x0, 0x0, 0x0) syz_open_procfs(0x0, 0x0) ioctl$LOOP_SET_BLOCK_SIZE(0xffffffffffffffff, 0x4c09, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$cgroup_int(0xffffffffffffffff, 0x0, 0x2, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='\x89\x00\x00\x00\x00Ew\x00\x00\x00\xef\xb4\xc8\xd0\xff\xda\xb1vents\xd9\xc5H\xd4\x91\xfdN_]\x16\xe4\xa9C\xd2\x86Qn\xefS\x80\x11J\xfb4\x14\x86 4\x95\x9e\xfc\xc1\a\xcb \x95N\xe9\xa4j\xd2\x1f^\xb0\xb2>\xa3\xc9\xb7$\x11`t\x03: \x8b\xa4\x05\xf2?E\xdb+{t\xb8\xf7\xab\x8b\x100#', 0x26e1, 0x0) ioctl$PERF_EVENT_IOC_PAUSE_OUTPUT(r1, 0x40086602, 0x400007) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000280)='./cgroup/syz0\x00', 0x1ff) openat$smack_thread_current(0xffffffffffffff9c, &(0x7f0000000240)='/proc/thread-self/attr/current\x00', 0x2, 0x0) write$cgroup_subtree(r1, &(0x7f0000000100)=ANY=[], 0xff4a) write$cgroup_subtree(r2, &(0x7f0000000000)=ANY=[], 0x20032600) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a0f, 0x1700) accept$inet(0xffffffffffffffff, &(0x7f0000000040)={0x2, 0x0, @local}, &(0x7f0000000080)=0x10) ioctl$TCSETAF(r0, 0x5408, &(0x7f0000000040)={0x2}) ioctl$EXT4_IOC_GROUP_ADD(r0, 0x40286608, &(0x7f0000000000)={0x3, 0x7000000, 0x400, 0x100000000, 0x0, 0x8}) r3 = fcntl$dupfd(r0, 0x406, r0) ioctl$EVIOCGVERSION(r3, 0x80044501, &(0x7f0000000200)=""/31) write$binfmt_misc(r0, &(0x7f0000000080)={'syz1', "80fa25cdc862d216160cfa92845a3916e38a409a159c03f1889971d3e5144a8d08de78c4b1fbee457437261d7668b1c0f582647ad4134a05358d4309a71a702002329e024cac95642e761bb842bc1056bd6bf12c47697a649a026bd8ee1f685089941469b1ddfeddf32b392f0ff07652a3bce0770bc3bb70862845a65054cecb191e80b825d740fe6b40450359757032425dfdee92aec36ce4b468d50adc745c522cc4af2ac6e7f6a95f0edd70b09caa95fcc7143cf46b74db8bc17fa7c89f"}, 0xc3) 14:03:59 executing program 4: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSPTLCK(r0, 0x40045431, &(0x7f0000000180)) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) socket(0x200000000000011, 0x4000000000080002, 0x0) bind$packet(0xffffffffffffffff, 0x0, 0x0) sendmmsg(0xffffffffffffffff, &(0x7f0000007880)=[{{&(0x7f00000001c0)=@l2={0x1f, 0xbf53, {0x9, 0x7, 0xfffffffffffffdd5, 0x1ff, 0x0, 0x4}, 0x0, 0x7}, 0x80, 0x0}}, {{0x0, 0x0, &(0x7f0000007780)}}], 0x2, 0x4048851) setsockopt$packet_int(0xffffffffffffffff, 0x107, 0x0, 0x0, 0x0) syz_open_procfs(0x0, 0x0) ioctl$LOOP_SET_BLOCK_SIZE(0xffffffffffffffff, 0x4c09, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$cgroup_int(0xffffffffffffffff, 0x0, 0x2, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='\x89\x00\x00\x00\x00Ew\x00\x00\x00\xef\xb4\xc8\xd0\xff\xda\xb1vents\xd9\xc5H\xd4\x91\xfdN_]\x16\xe4\xa9C\xd2\x86Qn\xefS\x80\x11J\xfb4\x14\x86 4\x95\x9e\xfc\xc1\a\xcb \x95N\xe9\xa4j\xd2\x1f^\xb0\xb2>\xa3\xc9\xb7$\x11`t\x03: \x8b\xa4\x05\xf2?E\xdb+{t\xb8\xf7\xab\x8b\x100#', 0x26e1, 0x0) ioctl$PERF_EVENT_IOC_PAUSE_OUTPUT(r1, 0x40086602, 0x400007) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000280)='./cgroup/syz0\x00', 0x1ff) openat$smack_thread_current(0xffffffffffffff9c, &(0x7f0000000240)='/proc/thread-self/attr/current\x00', 0x2, 0x0) write$cgroup_subtree(r1, &(0x7f0000000100)=ANY=[], 0xff4a) write$cgroup_subtree(r2, &(0x7f0000000000)=ANY=[], 0x20032600) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a0f, 0x1700) accept$inet(0xffffffffffffffff, &(0x7f0000000040)={0x2, 0x0, @local}, &(0x7f0000000080)=0x10) ioctl$TCSETAF(r0, 0x5408, &(0x7f0000000040)={0x2}) ioctl$EXT4_IOC_GROUP_ADD(r0, 0x40286608, &(0x7f0000000000)={0x3, 0x7000000, 0x400, 0x100000000, 0x0, 0x8}) r3 = fcntl$dupfd(r0, 0x406, r0) ioctl$EVIOCGVERSION(r3, 0x80044501, &(0x7f0000000200)=""/31) write$binfmt_misc(r0, &(0x7f0000000080)={'syz1', "80fa25cdc862d216160cfa92845a3916e38a409a159c03f1889971d3e5144a8d08de78c4b1fbee457437261d7668b1c0f582647ad4134a05358d4309a71a702002329e024cac95642e761bb842bc1056bd6bf12c47697a649a026bd8ee1f685089941469b1ddfeddf32b392f0ff07652a3bce0770bc3bb70862845a65054cecb191e80b825d740fe6b40450359757032425dfdee92aec36ce4b468d50adc745c522cc4af2ac6e7f6a95f0edd70b09caa95fcc7143cf46b74db8bc17fa7c89f"}, 0xc3) [ 345.888590] binder: 11879:11882 Acquire 1 refcount change on invalid ref 0 ret -22 14:03:59 executing program 3: pipe(&(0x7f0000001d40)={0xffffffffffffffff, 0xffffffffffffffff}) getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffff9c, 0x29, 0x22, &(0x7f0000000080)={{{@in6=@local, @in=@empty, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@dev}, 0x0, @in=@remote}}, &(0x7f0000000180)=0xe8) r3 = getpgid(0x0) getresuid(&(0x7f00000001c0), &(0x7f0000000200), &(0x7f0000007840)=0x0) r5 = getpgid(r3) ioctl$RTC_EPOCH_SET(r0, 0x4008700e, 0x10000000000) r6 = accept4$packet(0xffffffffffffff9c, &(0x7f0000001d80)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000001dc0)=0x14, 0x80800) r7 = getuid() ioctl$TUNDETACHFILTER(r1, 0x401054d6, 0x0) r8 = inotify_init1(0x80800) sendmmsg(r1, &(0x7f0000007780)=[{{0x0, 0x0, &(0x7f0000006300)=[{&(0x7f0000006140)="89e5d4995f3f8b4d203bd687049b97174bfc611513eb381c65292a5649d1966b39d231b0e0aa97909520bf22b69c2440f81224b2ca044f", 0x37}, {&(0x7f0000006180)="795ea49ab0b4b484907a3143c0dd2ffd36fabd0371d3902e801e6a5a26e882489ffd4a8263217ffd94259df69f74e8d8e1e870cd16d0ae93957259c6578d101a96429efb4f4eeaac68c2d390cad631", 0x4f}, {&(0x7f0000006200)="c926b5bd99b16b48ef65a0b4ead5ea45fbd8b5c6df413a9c4aafa2b7cb0043126a001595785e18fb27feaa94e8d71a254001a9896165d307a61f46305a3c79b1694c340faf51af0c5353ce6943f86bc05a3055bef6465e161073bfa4b3379d72b0069e43736ed427ee71172c0b27bfdd60b6d2069b4e3c56ccbb56245b963d7f39adc8e381d8dfade25ad5cbf0c581c483b1c809e2ff74876eb4", 0x9a}, {&(0x7f00000062c0)="79f8aa4789ad044a62dcfca76ba26bf6748c6786a8882260b2e85a0745e9f62e30bcc250dcc1df8399947c4c25c82ea9d520796029de5b6c89ca3df25056abd2", 0x40}], 0x4, &(0x7f0000006340)=[{0x58, 0x117, 0x6, "7ba80eb6af69c8bff2582b155cbbc078deb5fba08d1eb4cc92a1ab777d119e355c73d632a922049d3b11830280956422ac39aa4e2d10ac9e7df909e914990f1e28ecb8"}, {0xc0, 0x11f, 0xfffffffffffffffc, "c7141a1439a1bff58cb9ea023803a02000bd80f0e0c9180441378ca973e720973db47c1db2cc4287c3b812e534fc15bd6d9ad20eb5e57148ae74de51fa5a999d952441700a8bfa0e4e19c0265a9e9a6fc4e08a53d60513b058c836796b913543404a07cef5c4fb578cca9dc26aed5273b0a2893f1112da8272b1a84f47c6a4ad48631194d317ac2e26c74e7e9817e7add19b134ac45733f3bbd773e86a805c2514f7402a57ce9ede292b6dbb"}, {0xe0, 0x84, 0x7ff, "a6b0ecc1d99b68306d4c8d08b8057cdee0610b59cf2d2e594428cf6880173126a8c0d17c6459aad0f0ac93d72d6992a16cdabc4da4f5d9a899b073ce1e7b8e2e870b39840601cda1441ce55a953be7e5cb7df8f8f550d872bca7176304c1a164928557901bd8919d6a46b67b1aa14c120769e2ec777e5e2d1c6ff27b5c5fed688c36666fdee5780e80be832f4a6ccde098465808c7281580da9e3faea2d6de93a02d94491a63d44f04bcf8f03aa58512660427317a72d65290739608fe1554da0ccb4b6f50fa0760037a4ee5fdaee6"}, {0xb8, 0x108, 0x6, "05641a69ace20f6d79ea7debaa14d597205a997e9523a405154d91a363aeeb45e0d7dd01232acc550c922d01ae34cda74c317ffbd2a3214a76125258b74d28cfb715d5af696beed7e5254a018800e9f1aa21e9afeb1aabad72ce8900263a7a2330198bef44b733d094bd30671f5354d908b6b7e6eb3d429483b74fb42d15b87d0a0cdcd8b2c15144a18bf5d7adf0f065917073a904b0381f7531bbb303f10a3ac06ee3f1"}, {0x1010, 0x0, 0x5ce3, "c90e7075664902029c558e5b96b9c7de0aa52b81bdde8481032b8e4af747c247efb853e74396d41f5a1897811e04f44fc23de9d003bd8a539e91d1a562926e8f45f0b4bbca57db9ec4dd31a34c10c4ce9d4c5c9be2202ee93dd2dbd80d11a43a2aa58b7338dc1ebc92aba44648af455b01e5ec559a37545edd840a0ef5e42e862adfabf7e72524e2d72ff06b9b874157eebbbe0ce57da3bc28baa29f7ef2d6181a26698380171dfdad74c89aa0e797c245343473434d9f694a41726aa6969f382759b546125611fabf2bec3d1c57fdabff3ef82b390de9447078284f954525ca971594de2fa032a5ace4c504dc4a358d60d9f4c136d6e1e046ad200daec1fbe65346115a1f3f11a664b93083ffcb663cb1982cec0394d00d3b205c902937fee3c4643b6769a3a9017afb21de236a04695f52bd1489a8295a76ea336f12bb6f3a063d578b1c16c5f3358a0850038fafdd82c14d14a833e3120433bb171b5b918251cd97c868c2b97541469903ed8eeb4379d8476152cc7c4c50dbc6081a97b40153f11f92daad9e58850ffe7ce54775a11c32ddc14bc231ef2d4780eb73fc8bbba5d3b86df21f469846066d19a622f83a3383d34b93ee90077b991edc703708f15bc4ca58174963edfaeda42156ec777715297ddf136763a428c1d9200ac4a32f2bfa109b4c8383fb96c830767865fd3a9f477e00cc068558efae6dc5eecdf4567710c50e6ce449af6947d45a87d2f21471438ac98ef0d3ced7ccd984d8d9d41cf397836a2e9718885def4d7148a6410ac09c17fdb8ad4434f651a911cf88fb75dd09566d4da81d5a152aee257a4d7cdd1ef7caf42fe9be317fc4b02b1d8fcd79ecf236b35dab357f68938f52d0e23a9b287c4f54a6ec44bca0d091914bafd5dbfbcdbf8bf726ebd764e75ce40c0ee7763e3cc1224f64003ce956b4600f53d7ba92d1eea8182760f6cd5feaccfc37ca2808026e9b8d2109836b21de7b2a4b5d22dfbef70b27b1aa22b31fe0668cb59209d64819658f6ca7417105fc9a058472a156c120640537493bd4192d75a84b1c91eae907f518f040acb53968ae684e7d176108caff17e90433ccb7490dad85903a8bac83095b0c4d93f0dcb17bf1270a1a6e278a9c209feb93f9c309f6dbd584d35becc2bc7717db8900853fe3b76e70d920557b469dea52f119bc56855c04165c4ed2ca8d442e88640835379ce77534cf243052ea33409022ebb048aff684cb7e1119de39482eb971a0c523b889cec6fe0064e4b8f750eebeb7c1afb4fb4f19352db9e24833208062c198576fa07b49edb496c7de39145836c6f2a7b8f0bf31597bdfe597dbfc3a6529897606288dba1cf69fcad75e46964aca0525cc09168ed6fb271f4ad7a4fdfafe7927fafd40b7e6fbf6daf3122dc52d506f82e1e17a268fd433826c27372677825404a0713307c265a357f9155e8887b223520fd16188b09b34535deda8f180ccea94b944b677ebfe55049b52bff9488195fd0767689e2043eb079d0483431354d3e413ba7f04afce6b880e40fb12725130fbb848b4a810209f55474d234242a086814453515b8d6c14e036718eddf1abdc90bf6ed98aa513aef9e0da070f67eec5352088caa1bf1695830dd161b61661ee376c5fcbd9869b17619c663c84e41061d37e3df6c4f73e84272ff0507b958cb0bdd1bd1c5967e57f8bf7c8f746d8fb761ec447bd381d4bb2924342117ba2f8b9db46e86228e29945f471c4a202361b5c96707cdff189a4bab31770c37b61e25a5e3409e5b7f623bd192a581369ae8405d09234b835b860c2dc9b93882df4d76c2101d73c5c0fc4d43ee41b1ee2f3a8919e7d5a2e83686e92407b0e97cba49fac51206ed6c04e3418bb9408fa006b4e7d2f038cda0af4e164500dd44ebe182c81488d5fd710ef99d561a0fe81a7c8abbadf6406c5cc0918ea9e6c3152560ff9e9932ecae38be63af01d3c42bf21cece5d5881e679f4f9cd9d4b197fc59a082af7bc10f50d9efcacd852fa24aceab79ca1d1eedad0a4fadb165dfe87b82d9ea066e63083535312c908116b5d78b583cbc44ca446f1ec7d983769bf375819328943261549133c4a372aecdb71fb831c681b726515af6028477dfeecc2b261baf8ca1191bf96141f438603e637f1253dfa39cafeaf53d26c8ceb9b523fb04a30a12bbdc0516612b1984659b897cded577d4d72498e925853af8fab9d2bb169adf8ce5ea894e8057e908edc18200c92c91ec6a74e6026bcbb440f0ccdc2cd2750dad05e117eb369de2864d07844fbc6406c3121bac066997693f0cf77ff87085aebfec9b0c58f76673e6c488b1522d223fa8da3d7e541cf8a3c3e8b70fb3c07a363cc64c0e9849937e5d53a509dc3d9efdb0f0b778ffabd6c6734e793f5371e3ce7985919a383e0c599315daa21cafbce2422aa3a81dee1bf27aa3e83fa3b6a60605b83bb7ed097ff2c921744c646bf08f8be64aedfead253dfba37bd3c2712e40a9f88d230ef36fb3fa81964284697711ccc494e88848e52a46ab6f437b387b2edb70a871b09bbb7eb17e26349858945a7bff0057e8a835e632a899cca1370e61058945bacb775f199a401703f2ee885098f3fda878572a93943a54ddb9b6e75247cfab134181cdf785d3964e02c7cab56ab6393cab36bcaa105ff630172ef9dad8e32f9f61d755d4ad2d5ea96e27bb1ec8a7c23de49f8e4fa7ee85723e0c671d04bae11aea59004a2f7d3946afba7562093cff19af4797b9b36e20f9e5bdb0671249c6a4ea0ea5742c9d5e6149dffcaf6c7fd5fdf708df9b0379e8efc78d9f4b7b851751e0dc51caf44e681421b0939bdb9dd693572c9649c78ac970a614feaffb4ce5abc7ee77e2b31b55c6927dfaf85db8e62a2d5e912129da6a11d56e438d702fdcca2db96585ab6d6136dec3652763a5c5179078753ee54d619bb63b81289cdd43918bbd4ba884f06fa984d2fd80283beaa0b0ce0bc6e9790c322a0e9e14f1a21ff719ba5b5303d2add3e01d968aeef7baa040684a8ca14af78152b5c1ed7146bb5f9dc650310fbbd9631eec96dea20d8c18b4f7025ecf66f009b008f73804a32100be4c88873d6960863b5a9e538779a0f386b60d413afc59561924c82267ea44ea404d2a2df6cae260b659c483793de5dd0e7167d471140d56d1df8eac8c077c3ef55d7cb65f8c3b3b1ce9bd3825a8f36b6ed97025a3bb5e2be4abf6c052279c7eeceaaaf3ad7c8495ae3512bfa0b2b5e5479eb4fb313c4ab938863c747dff531e6839b83436f48c86b1825095a823d7eab849bbe029939d04fd84d97aefaf5da221007b4e506999d607b6bb0d0ed7cb424eb0eb475c00c4322aa313a778a55ef994108206488fcb909ba1205ad9969a983ffee4a1fe6316290c5b4c61fb97696b4bfbe6fc0ad78f9fe9e7104ddc719ea3f7d3ac92e999887a9a2d5dac67e7c8478004009c9ed66ae2e83859903bf25b9967d8d02cb182372a4d12ace613329ce27544bd8314c13a5c1de3ea32d8a126e0210ce74a7dfd0af99fa024ad76a8cd47b4645614f1dfcd7b7e9cfe47544e3560ce73ad14a4d4fe79478406b1f316c3edb46f13af92ecf20de66a0df00d51314bb684a46e51ce667a536e9c24f967579ff3ed12d1888f9d94893525a8e443fd5a2737c4bbbe1fe4441450ddcc1acf75b8b71a04b03e91b7cec58110a508c642a4dec75a42c919da3feaf666a649f4738330c6a3ae62a1c766a0159b71606edf7c483531abd0b2a1a10eef3e908aa650c851a574800f6fa9e4fc7182b007c0bf09e3c13adc496c6345cb6b0fad1b20132a51338c318359430d4d97bd75d8429879158bdafa15ab0894f1765d5b424bf96553b33bd3ff6f661747d3ad9bddcde2dd4acfd16ece1c428d11efc15b7993f0b4b6714de706476019e6268ed6aaf2b1824eb6c3258bf1d97d7465c4f2fa755ef3bd56fada8e055b39d3d5d78e3b940a5a93b1b04e9bfc331b22ae8c75ea423b8188e0a2ab29343f1cc417f21552df4466115bc193f595d67f6417d1b1a06072e2a7a3fe1437f95b013dd19903751e2ae482373fb87b8cbd9c6abc5162cca5353f9f89baf7bf4daf7864fda60758ffe9cb21e5b1d4daad5b0fecec8a1970b38d37a6007978a05d4953235f84e6c4529119021d85ae23ac649769c5fc725f6572d00a5f0f9b35d3327afc76681e84e67261db3c8ad832578b7db0613f361b273c2c89a7921389d14ba44611d126e1dce4296448553a37158862728445a93347392ed931cbdc365dac2c74222daddd1847e898530437808ec20a4733d2e6ce633a41964f5361fbf6d4c1b5ce0600f5561eb6cc8d83bc6cc53fa85c80cbeac0c8768f9f5144d51fc658510f0cd1651701325c8e602b2098343dceccf8b568be2026f8da6770c363b301450c626f35ffe5d1416654b892f93662928544938c1a48fbef53a5d6d2956d8a940668ac5ec40de0fbb433f80cb625b802e70122af6eb08fddb834c74a647841e43502857e5d6e1da47f7abc279894a15db4012b9fa63a0b582306cdb43feb6b3a188a6b0538a21a519764a1c8a500032d61532ca2030879a3288edaed7a09be2b935be29f94faa38461cb4362d62b724a9374b25bdd429535cee8d86499e0fa74e3f5445d69e2411cf0140e0548a993678773cf48cde032992c14949780d38c0f91f4b9ab2956dc4fdd6149790d048bd6480329484ceecb727a0861731bc2dc777bfa1c99b8a3a5c14f70b012e152536a30c0685b0907c5f8cddc572178085e13f54bcf505b7fb265bf9d8cfcb54d3085bad15559ab5ed98ea8512f46a8546036785cd2cf2024939fa113f472cec888bd4282de96a0ff8f69dc66ef2130f5428c1ae926858ea326a13979c8ccd04af7b5fc16c435ded050b5486d9ef410e395ef2f5d14a0bdd12e9d8f52cf3930fd77c5e679ed37aa6dd1b9db425c61165488782b175a85a1ecc3ab98ea63b59ad509ab082d65535312224984db43f3c01f8ea59a185b76ae7e5b97535486fc010e78643ad067a3b2dcb25b7bffaf43d87b148fddff92542f40521dd5b6ecd6ef0c513c70d12ac4d2558365e76f84d35a48b8d1f8193a0b1521182fbadf329898a4255f0bb1935fd0f1d28ef30b4ce6609d8ed78c6e6e356340f05e5bd203e7b03a029557c8329dc395b158b5130f88e39a1ef643c0d25abfba05960c2c1d8c0bd7fcbcc73447939796a432e0e5e90449171987ca23f7e597d34c1dda079777556eb40f74d041d4a5a59bf108aa3d3c8fe19ff4185b4cb41ba011b71a0100882a83761b23b2e92ef9a9b08243662554a6cb817e2e92c8a1358b5995fdc34f1286de577f894db6c93631ba8be05024c82ddcb94ebd9d9bc2c160b6a1c43102dc98617d42b6c5b801b0b9c67eae1108b6d77c3890eea5d59045dd2e59b01dc84443eba875e2faa1a55c98e37aaca09466d0ad37e4885360cfcf75e9f5213ac25afedc935c46aa75174dba56d7088333cc8983291944500f0d42120ec2930110858ff405164b5ba73c25a5ea2c72e06984bb3c39a49a01735be49fd59eba0e8c0c9d7f6057096d091f497b2c8f9e6daf394ee85f78a6d3ce00474d57e3a390f8da669c715a58228ef0fd6dcc19ea21390f7fa382b95b3430ad54681b5b9e95a6f279b0674ad57db4e812e52eba183947a8ec8ac9ee78068209439d49519637d8e42d3f78d400fd2969a0c4f5360cdce48007c96a7258afc3357c5cd2e3f5b92d05031582b55571d37a931225ff0f532523b02e50ac9fcb6665d2ef5755c16d5a4"}, {0xb0, 0x10d, 0x101, "c1c8eeea8dc63c39d4d70438220348c5500662f4bea583011fdb6c3d1e1cf6ed0753e927a8d723d64a22123859951ba2b8f8f44daf1f763e9bbf3c1e9f47d8ac23244f9009483d305edafc68c77c3bfd36fb758910c78ba75c4d645b17805ccfe4ed1d6555651687033782e40519ae75ed10637dd74376b2a4a339ef229cc5afef0876967f573fdb8c667e241edcc17fbee18e9398238da719"}, {0xa0, 0x19b, 0x2, "6bb1bb7c874a2188b3ae625c54380d9478112cf9a299ff7c03a478f4c11fb36c74307f8e2c14cfcd2cf3d944449fecbd8df429a8478eb185ddb9e32e5ace69319ab109235ef2aa4d930000fdb5fb72649746f78fa501f83619abbf6c2010535dd60c1c38d130b67bd74dcdb3f05bd004bed114416b6754cac14ec89c8840bf52905ddbdb07824889383afd"}], 0x1410}, 0x3}], 0x1, 0x84) getsockopt$inet_IP_XFRM_POLICY(0xffffffffffffffff, 0x0, 0x11, &(0x7f00000047c0)={{{@in6=@empty, @in6=@remote, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@initdev}, 0x0, @in6=@empty}}, &(0x7f00000048c0)=0xe8) fstat(0xffffffffffffff9c, &(0x7f0000004900)={0x0, 0x0, 0x0, 0x0, 0x0}) r11 = socket$unix(0x1, 0x7, 0x0) ioctl$TIOCGPGRP(0xffffffffffffff9c, 0x540f, &(0x7f0000005dc0)=0x0) r13 = getuid() syz_open_procfs(r3, &(0x7f00000077c0)='net/mcfilter6\x00') fstat(0xffffffffffffff9c, &(0x7f0000005e00)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) sendmsg$netlink(r1, &(0x7f0000005ec0)={&(0x7f0000000040)=@proc={0x10, 0x0, 0x25dfdbfb, 0x40000000}, 0xc, &(0x7f0000005d40)=[{&(0x7f0000000280)={0x1328, 0x2d, 0x0, 0x70bd2d, 0x25dfdbfc, "", [@generic="5351b3c14134cb73b27bdc2cc12480b95bfd77789824378002fb7f22860c3dcdf28e07333bf23f8f27281eff6e2f077c4e8a91e4fe7536b68474355e119e309552356d8db65b127df25cdd5516bf0f5d66edf61a4809a16026cab5f1d2c2f982765e4103c49b3799d918569451a77e9b398d3013eeea092dbdd2057825e320c2940bfb462ca4ca2b0640d1520365b2528093a0283bbef91ed7775dbdd9bec80ddafefbcdca6c66c16cfb8b14e86212ed6188b0d108d149cfd65d02f14677933316b7ada0245b62d63176c601b9a63594842e98e3ec36803bb7a0fd634730ec19c6d1a13a85549f5dd2dc855bf55eec7d81e96dc7e78d1b38e803c5a3bd72a66743549dc3e8b7b599f78be85afc0776c3f307df7fab1075b5c0ad9ec22f04e6fd03171e2d611f95122007a90719ee6afca268108f3fe48cc529d34d6c8247d5e9f3ba3d7270607bc64652a6ed9358b70bad3586772645e29cf97410765d176cd1dcbebbc93c224b58c8ae04df979e187c86dddae17583cfd547acdcfe033684487c4d259706dc27884e933e1b8fb80279cc65a93ae01406bef70233abbbd81d7b94c720bb8707cc32838eb3977070d09d347bbcea81cc549c06a9ae2e804be8a533ae68e9fb4587602209a48b22617c407fb8fa109f1aa2e30899c4e0c3c5fb5a39b77d15523786b7a9d43f840d0b98e902ba0f35d95bff2387bf28f710141921eb56c283dfde63bc49beb175b6b73cdc407afbfc8c70c2734944dda053b44948d284bbeaf94876352bedc38147f1f7d8c2fe999e42dcebad9848f9eee609e2e3131669a44e87f4f0ffe801bcbc791c51b8dc3f6bd9e73e9e2eeb86d43c88f80b5d60f6c8acf2b99517d5a0d29bddd0c7ce543753ed73a34e5447d08bebd56b0a0b8d1115d3b513f6fd65ac4b2d0ab2d2d30d31240c3d92acfc83f24fbac04d55ae3af35f96f291f81bd5584a6bca3684688ae169c42967f3fd387f865a69f247fc757f8185b9662db45c3d00d5fee6223364c257d3057244332881c96f4224114c7afe27b46946a924daebc74676177beed9e0b8d44b555e2f06921843d61973e8fd88daa2401c6c1f13d4115a23017baa9b27ca5429ad391a4baff8ec49ea5293ed1a2058ef47f3ea0f4597478949cd776a67a82079832dd528500ab1330abea963381ef2e13abe8a1ea4ee4cd28764cd81dd513169bfddf3c58cbe2e63e15fa556a028238f80352a164682dbb34ceb133cdfa2d821a77942b597d0d682dad4dfec8298728385c356fe4fea7956d20d731c1c50fa5f7a3dca4bd12e9202f3a68c1080a2848703d8fea27086a871ccfa8b35b21aa4788f8a6d2c4cb661d79b134223531d8c108230a20218172572e67824d656f405548eadda915b40365a47626f59fbc933fa8dc1d87143118272bcf177f5b4df3bbb283eab5786a6a063f1ac420e9567bfa17ed8ece39e028913734defa5e809a7f6dc2215ce41545d42c9352a12842310dc8ad043bfd7d25a698a6a0b8efdba3afbd34f8caef0095d42e38284f47fb9dfa7302d0215ad5e164a1d0c78b9981279f104c17eb315b50366f472ba8f04bd2f9425099ba53a43766a3f21d9a1522c99e502c97908b7993624fb1e70ce27d8eb4e57d3660637dec1ce5a9cd2788ac4755e301e0c4fec35f45c39e523ddc06ad7ee507926cb078ea8af53ac83cc7c5989c22632c48476ad0fa07d295b82fd5e0c5e0ea6600efee893329f69687a7740912f5ed678738d03ed907df10635ec2aa9194b8c1286dc884be82d1a70a17d0706c5a78a45cac1fdd1cfc76a2b6a544ad1cdb4431304a1f171d7e85a3624785a9127947b116c6af86c7b5a6fc26e266dc30d24917f52ce17534465fc99ed6958288321bdf8c48846147e7bd6e409b5b22381a4f8297776367f75bed15c65ac540534056034952df0342fbd050a00933b52965e24d552c46fd804e19e0ee15a59e7ddce40554b9d278d61bcd30ff4c2ab1ce0d8edd9bf9ffe237ff17388d77647526e7c2dfbb711e912cc8c04ff0b977da5af1cbb3db13e39087cc00767012ef1d497cc443eb38a35f2890ef90223f59fe90af851480a0752615b8c90663a24d680b3d7515cf7dfd46a6e077e56ea12e9c317f3b4d5c75d0659bf9ef00e2386e68a245615d8e4b56f8b3e8fb92bf043018f0a9ea52db6516a6f9eca53a0dd84f9c36158216f60ba03c90ceb2b7d8a42046a1357377d29848f6a53f37f4619632bc252baff23da9304719aa6d45594b69d52b644f92f3cd60ab8d16ff2cc99e9f06e4cbf504faf1e179a712101e0f1cd6cf5840df243d297b604a77cacaaf20a3b312fb973f216a722b2a1390cb092056b3671ae11ff2c1df79017cbc7610daefca6f02f649cc9c8fd4007027667089156ef829c7f42a91527332fd905be981e116faa719a6e5366419ffcef7a966cbf5e86f9a067e978f600a031abe89a55508e84ecd47259ffa43d765d79fc5f8d130f25d7863e5793d6a0a3c50adaf7e1ae8847f4350003c1fd526393a4c2cdce8e5dd5da9d7ce1df725d1edfeb1286a74acdc4b63c622aa464600bedc725d59e3b9157d207b8306d484e36687653a5f4cbd333c9e9cfaa0b2d711fe745fab532430d450edfcc86ff63deed9fb51676d29cbd63fa4189c4f139a7da803c9a5c20e4babe2290d354f1a18fee83cb5825594c5e938aff1e5eadca04325f173f1ad060ce4856c138c6c02efa66179ed3f91aeb2eee572fa6d6877232760ceeafd117bfd27e4ae859dc13004872ffd85edb145c978af5e3d1146f994956f034e40652d371a7cdce46ec33c33e45819bfd5cf1c6a63c5439f6b287a083615d05badd5c006c6e5dd9ad31f9fec7bd68d002d4d6d5657ea20482f6697ce86d30c90ae58e5f543764b073b142fa06ce239a0cc4fcc062f5a11fdc2f6b1564e72dd9ee357b4733d8bc07856d31f6c5bb977d2d60f974bc452f2364b00f42b3bc3de7cd3eb8de8fea267dbe9708128630bed8531d3b19ce319b24b7b13b6eef1d7c58e007b9d42cc8019f6e3f155ba946a4d3dc78e11aa81b1644ff330ff46a9cd9ae49e2685eb671ebc17d48e33d355726de5e587dfc23200255e41359c5a0950decf467b0b83ee532505fe2ac922b03e5feba49ba082d1e3d9b3709fa2a9bb99400b950a881521b98e727a3ac269df1d29cded7108d05a16141c05d945575e07f8d4c90615cfc17ea663922d07f309b2c2567c78c59a75d9ec27677f9f63ecebfdf380a662cc4e81b21462b0b90b017463588a3049fcefea9fe1ec617839902bd9d3178835a465b96090855266cb59692167444850acc1fac2e6085126f6c223594ddbb74099a93cc6d7bf886b0e678c717deaeec40268320278180945a751ad581a622ab99eea8ce18059724998dcf098edf88518798e20464ca12a47667960dc9a87ab473727a23cf746d7c5d2ad3122d543ead3b91805bbb6c8875545d1c9c2094919c8b4131ffcfdbe47638b23f4b2462c7046e1b3826bc15501c546dab3f7f5bdb2d75c650ae10f029ab89191f84ec26139c0715dc1bb746d56eb158fc0911b7af37dfd55b629907818b8fbc8d7f5287677b904a5347903cc19502f53d8adcf77e865ed8f245f89e897842683ea71ebb4d67fdb7b9ccec36b6c555e7a04c2a3cda7675479bcdf0eb528956c81b9ebafa233e29969b958cbc90f5aacd139c4cf3d145f27829f95a5f5983d92dd4f23769b390da873d974f64e5756f1d1642d2fd6c0d41788a3393d8c37b9a2998b5e145a2e20d8f90c7ab4771ac8980baa8f7c45bcf845f55e98ad2fc086931fe143b29a2ef70b8a19e887f83b02f1967bbdf6b0c1c3c26b8fd1a52749afc851bf5f03dd0aa6abcdd56b780175266552f982b2b1c9c30361cd894fc2bacc59a127f1bf73df6d691dd94ae44ff1d1626f2cdcdce8e715278009d98ff2912a4087edb676a35ac5bffd8b147ad61462b24c97a73ba381fb9757da4a673e854c005db3b4526b286b47d158d7d0299b314fbfc3e616e64ceb91850a1f390e3dd6346ba3c2b014d677c16a8dd8e4d80a8ff3748a9ea4b5c7f3a418002cfae8c102646fa3804137f2bec4f17eb6fd2594fc2a8ecb42b42cfe054c2a25ede7b6f752587634cca75010cdc402289525aef46159de635e75ac8fc29692599d0006edd621f12d01c3c49659ba40c84490fe46b748b6793f1f69eab8a03850f1980063397a8e17f998e584d43c047df7f9ae7cf0f175a9d9b12e96999138bf55b4ea4b1df355fbe77b37ca435133a81a2a6a0a1135ca8db2896abb06850b5ac081cc05d48e93920210c7cc903d2d3bc0a21757e6fc1a59f70f807c0ee8dffa78d2b239af86a6feddd3bbfa63af19b3ab9f78f3cc16c455b962054284d052c267da6ad22cc3380e964740a6be3953407e7c8ff9436604fcbf4db392c3dd77941e40fd90f648db69b3051c6ecca8d88113e90448e0663d0d72f829ade03de940f8af84b9cb800500a6f78aacc980e8f8e959440c45cc5d38e88a5ec7753780d1275a5e3450f303ba1300a98f293c5ffb15561f518ab75bc5fc3ee813bdec49d66e3a392bd98497e9efca5877832c79ad473fef57551aeebb37d069c99c5cef4dab7431582f8a8cd3ce23df5f6f829db363dcdfa2d319ade5782d38201048afcc4539eae09d21270e305ca861b6909ef3e2c8ccdf077b0a4188b2e28b8f0bbd0ed0f7fbc72038bb695dc40a2717ccbe3b628a57e8aef28039b18fad7f0dc57c93036e4a355d6d3ec6052d4162ab92a99da6b7dc4c349bf014db7f2e65de3e433cc0711daa39db53bb6362987942c1589c1ee465505332d072a5669707f6148322f8427e40594e19e16fde1094f5b196c121123ab5f97b43eb178d34663e5e8af821f7871a30b1702ff90d50c688efb559b60f54de27d58d925ec8c8ad33314c7ce60e1711b5ea6aec07343196e8af5b00c393df2546685fda9e1cb85dc3ad526794fe3741bfcb5fab6287e1379d9e8574734a78a2b1fdfdeb496ab3a1e601ec3ab36abaa5d4d446afa93cc381da5100e46d4370a23953aa662daa375101fef1908be32c06499582f3ea7e47c6c79379b5088f64ecc895d2852a8c5aa3c8408c13e04cc565ebf4fe67a4f959e0c0317d86cd6d785b7b17faf14f7fe847f7b6fd7a2f72cda0cad82df235a34bce930b7a03eee7c8f4a644354abaf3de976212bbc17ed12e04e70a31be465150fab71fd82eb261364a572d93c353651095654873feab8be467893179ea326833e2af919ef974b1e0da7035be2f6dac9024a40083d3aab3a04b26f33f30a76b2785461bb25065ea46f777e2f7ddd430d211c4d1f043a0484d9aa54b6906c228b981eeaca64bb0d90a8d1e0d043835b14f666f1e7facdec18ed9a5b5b800ebe2f9dcee45fcf180d2cc455d30aa42ee9150717e24277f2e966f5a36d14d8a207621ba8d7bac48c07b4a81112840bac45447d423a6d1253949e794774569a0a8f9dbca365603ffe0bfffa88f89da6694ed297a397ffdc2c0b85e158ca2263b5df7d1aee886aad042ec41d51bc519b6b5182edada501a4b0bdaaee93d51ad831ec52af664104e2e5bc6b9cd076733f34df3d05ec023b2db9cfca683b795e398f094d7cc381ee62aa677c828f37946555950de0220e2de6f6a926c1aa5c3f12191f615e2e5fc9c92c80003f38e0775e4a73e732da9c93eaaa2d42aa04581c457bbf4c5d7d35b931165db0e4715f9368094069ee7e069a4c83347f34b3e8e3cfd459687d846246835bc23afb6af235816d9a48", @typed={0x8, 0x26, @uid=r2}, @generic="6e8d3e567dfd33146f7ccfa4c60d3b332b58bd572a92b447fb1ec99827520b30b5cabc1cc1290c76aab65c48cc6298393586f03cb3a545b06315a9769270843d59548d3adda1736c36ef28b6a9ec90424fcdef66e441512da70b7678f0fd6c81f7968e346f0243e7b112ca5c1f5dee8ec97d490903dba7049055811aba2873318e8ecdf733589059d741892f1117b7bf8a52f610d9af6bd473387025edb1ebc15609d7805a1ce1b63f614fafdcfb5cc45f8392a4d71f7e11bd92", @typed={0x8, 0x45, @pid=r3}, @typed={0x14, 0x3c, @ipv6=@loopback}, @typed={0x8, 0x85, @uid=r4}, @nested={0x154, 0x61, [@generic="8c08b28cd56af5c552795e0e25931ed0b211cd54350a861012b9d7e04507ab2820e2b940a4184eb0740a90964821beaf3f245fa15fe8b925f4a860c9605399a07c914119a26e0c2f527190814e3d9dd27f2a982f1759b9168a6b138ba075fd65f4a22e7a", @generic, @typed={0x8, 0x49, @ipv4=@empty}, @generic="53eace8b07fc1eb339f494ae014fe6ac9ac2fac5c63c606120e008df07b28971", @typed={0x4, 0x75}, @typed={0xc, 0x6d, @u64=0x3}, @generic="7e61cc453fc6e2d713067019853c019d22dc31c5231b303b01656f95df05d84edb26cd617a17245c", @generic="24a066200b675733600cee53cc9c6ca1a2157feddabe63ec847721e5f90bfc89128756cd012fd400cde2fc30b3df52ed3af777b2e0cf7f6e4ee298f51e5b83105489e3272a04197be6a47bc218493486b2c36d65edc0d8cb379344dee9ffc6a621f6c27f22dc5a53ac5a7515fb1263237c4daac13c97e99108b01d880284d2cfaa65cfdbc80bd3b5e2814825"]}, @generic="cb7b6227b69ef7f083c74876e9c42d45243abc883e900594b97b3cd9bbbdc7dbd0fa1da024ab0643f4672593fffbc3509dd4864e906bc833e740bdc05b37a73be35bf7d44d93ae46aa3d3211efd1d731dde4dd63ab0734f4dabc42ac47d96ea13adf1cc924b3b0ec39502311a9f9b94a6e7370860968a35d40878aee48b2ea9740bf7d30c0f74df0864478c4aedd1f927d7b52815360132e88d93562e23c03e37de32f680d0d627e84dcc93ec0903672f7c55976887072b79b4be33514c2e7fe3515c92dcdfcce2e9104e4da0a4e97dd1d1ea8f405072fe710db026ded7c"]}, 0x1328}, {&(0x7f00000015c0)={0x220, 0x36, 0x82c, 0x70bd2a, 0x25dfdbfc, "", [@typed={0xc, 0x1f, @u64=0x3}, @nested={0x1ec, 0x65, [@generic="45a1f8d1d90d31e6ecf4635e1c2a9e79beb9ad239da31c10607c4c8b5fb9c619127346d9b6144e3861231dff1e7ea8c4814972abd04cfbaca4a1d7fd264f6e72af81e6f2cbe6779ee75bb1db7249772788dfa9474aa8668da796ce8d1d190a5f4baf3316e94e0a5ada2b7753783993d951a97da46840f65b68eda1a0daefddebe03607f1facdf0551f2e8ef9b1aad2c2df73c8a0183af64273fc0220300630e99444a7f7f979c1f6a607d6ca31c563973f1916620791", @generic="23d57ce9383453018e9ef338a7a7bb387f339e95cfc36a1b6b88fce867f879cec40b898f7820e9ea96a7eec34c4d89fbeabf2737df051614dc917c772e8731a6f72c65e25d282b4e7988435d71729f0f77ca5ac3092833827d343cb0c20cf88c0dea26de3f06f8cc6a14223998b67f34dcc9f6", @typed={0xbc, 0x1d, @binary="9820080b88ecdbe6897b7964cabbd05265d9781f03feb3c4465ef676c95cdb9014bcc321173a19024e0be0031c82030870415da2b36eb2c81f4e53b3d4c616e5115af8aeb1c6e3e301c6c191663d009fe7323ec3e575ee6e9e24951e6918e0cca52232030bf1a5b9dec79c9cb674e8f1a8987c5219cb44e4b61d22e567b9a1f3320c6419775dd49969c1d7c7a304aab97c764c33a0063ce18525d9460762a116c73a38b4d1b4f1f6e3f2f3f5a1ebdf246adcf6b2f374979c"}]}, @typed={0x8, 0x72, @str='\x00'}, @typed={0x8, 0x64, @str='\x00'}, @typed={0x8, 0x83, @pid=r5}]}, 0x220}, {&(0x7f0000001800)={0x4b8, 0x3b, 0x1, 0x70bd28, 0x25dfdbff, "", [@generic="e461c82de441de5f8f9d338f104f3bc289c6bb10ecb91c5f41ff24e43bdb2ae0657d1f670e7b8cffef48a2690d7700b127803464b77b0cc58e26ba261f18d1bda92d122878e232", @nested={0x35c, 0x83, [@generic="d0448ca78310343d3689fb4c8bd315c00bc55ce04da57b1034ff586b8c7ee4de7d3b1ce066a645e4011d4e7e502e4ae037e54f4302cc56fb5107ac4d0c38dc6cef966873bb6a556c0b45a114e463eed47af61acc665be0370230926be669c6ad835ec4b8c366bc95b925d566ddd8f9d2247ac88670e314bf585e704a29c6568b75fb143e91d6c9c2c7586f4588a93c38aa9268312ee55b46960af56741ceefccb58e2436547ccc5a670923a6d682", @typed={0x8, 0xc, @ipv4=@empty}, @generic="ddf8a251060c98a833fa56bbf10b14621741f532efefa81939170895e7845c9556daeaa1aac041298f41fe09342cf9657605040d9b4d5e736bb04877dab15f53dd9f4dae87a07bae79298d4de5feed437484257d070389b7cd0720e7dbef0d88efd5c4abd71474d00bbbd7c46fd8ebc513142fae961ef8808928c16ac3c8e8098e90dcf2e1b99200049d97b5a01c1136180746baeaa250d3982f354cd1936cab2cd452a74864c2e9943e6284c4f918cfd5b49ee974b8523c3d8b54601c307dabce6ee22ff2c5170831e5a9554bce614b917daf423eb3600f65d516587acd6d80d4e592bc4a42748b188d0b74ecbde7acd12fa0f5a0a3beab7216", @typed={0x8c, 0xf, @binary="76fce1fcb6d649dbc54b5b167e9d7863953dbd40faf0acb67bb89c4e779da7b1f3482287468fd45bf34ad2099ea59719c16a200c629f865b89d756266d3481c4ddfd64529d3b6e06758741cefa44e6310f50cd5ff058881dea198efe92af47af44c3137570ea6762e7ffd3496419b62929f77b824c98bbc60d1242f93c13c5562fca83b0fc96ee4f"}, @generic="08225f4e8520f4e10be2365f32412bf776548b855d68bae6dc7a1c406a89071c68f7b8a7686854291fcae2e3de95f9f9703a623282c8f2f36e1da4329a451d4ecc2a1f9c2d0f29aa664c33b100519cd50d999db68bae2e4ac98320406bc486120e95b9498090c4388f587fe9ebabefee7918b79967a323028264367ce5ded7dd0ff251d8965b9b76a98226ba5e9a1daacc61a763cfef0a38d17f8cc7757942110b94ff46e3ea9edb8ab974752fa18955c870df7486e676f84542b61c52b6f1e17acc44b7090e3cd89c2eb1a1d4b337821fc79c96ec3ea8f8015a46137928ff7ba53f88e2369feddc4c8c797f4fe644", @generic="4fba60e96a200ac44aa2f0f30677b9fe412161a48e3def60440ec800f0d0cca76f0dd526", @typed={0x8, 0x4d, @ipv4=@initdev={0xac, 0x1e, 0x0, 0x0}}]}, @nested={0xc0, 0x8c, [@generic="637f7cdc2435daa1a752b681bf0c846911c8a1c0727d96de0ef5622d26dd5c06127ee6a229ae04e4e8521c63d3ed14e058a02eff01e2f9b86d11ff31313fe2e86192e453adcccdba04aee5c3bec32eb6a10d1ff65f3f0eb89699165c82ac7ed581ca5b72a3a88f2c7c052cfc693b4a10eaa282501a9ea795e54143e6c3e5f126bb90265f29f317c4e862ed893527f810d5142aa4226b5b6c00390af07d547969cc2e05f0388e73788d66200f4d00bc3f002b29fbe9f3f106fd8e32c4"]}, @generic="e73ad57fc17423dc61d57299b84d32cfbb687bca0a7783aa4aa52bc7492ce5ee8005fe5e08e0db2acf4b835041bfca118da11d25f4fb92b3bc8d6e5ebf2d011b4229"]}, 0x4b8}, {&(0x7f0000001e00)={0x18, 0x17, 0x400, 0x70bd28, 0x25dfdbfc, "", [@typed={0x8, 0x2, @fd=r6}]}, 0x18}, {&(0x7f0000001e40)={0x304, 0x1e, 0x0, 0x70bd26, 0x25dfdbfe, "", [@generic="7de34153dbb76528accc1a0291f406d8f0dc402ccda2010903d9009c98d0cc199dbee701aac756f5589f3ba74c555eee817300b09451db034edf917779382c2786a1d852df11e80070a6520027c97c9abbb52ed62884cbdbaea8200ef03662cc6880b97c76", @typed={0xc, 0x45, @u64}, @nested={0x15c, 0x5e, [@generic="c34fba3ac69c5b1da8c4f929a589143b37a50e8ccba4febad2618667a77adfc51ef555d9c736b66eda656c8afe78c83a2cc1f45b1e9ae42faf570543e054d0f7960223ba6f865bbaddb2793d41ab64ced014d2b3224d2d8e431eddb84980b2ce1523e17d69a84859ed80d4a181269eb3cbc9bf1802547c8ea928d6e65b09cca70b424d1956044f1a67ebb8623729da2a7391fc5bf136b609dd4285b3de98e9331eb4dcd4c593493075ef1de331a0cb98d2af13562bf800dbf996d84000cd8b9f032bbb3c77af95580f9e3104809f976f986c353f3872683b93947e45271d5c9a6d2429e731330324ed0626bf92c291405001", @generic="fac05c9429c209ae19f1839d4e63f280b37d00311779cfe8586cf3152fab263a00a74b9bfd3e63f6d48f0574c619871a32c50d07d31ec567d2a4daaf12e75cd655687abccda753c4d3f78aaf509e553090349d7ce226c0ac5c1fda6f1aad6d609b4da5e7c2"]}, @generic="400a6daeac3fa1fea69d6f4e0d2f6b5966a5a7c9a7d69e0ad7070787ef9c16cace76131bad680b16ee6faa6f9e4dc9cce880c3067b10e4820a694894640b022277bc", @generic="a5818890a9083f267f303f100ab1e12b9a40ebef115e099c68b821f3fae0734eae4c7922111c74228d6291cbb398127bda6cd41057748b08c5923dea9fabd4155076921329ce6440609848b81162725d006a14ffd6052df1e0265b2b935e5aedbf5b000fc21752ecc8fdb0fb6f4f711fc164a2140458047ff60a476290991a9bd1847819118f4c0ba390631e9e0b9f2f7b475d42b690e9b67b3ed4570807a71792a0d84c26ab4b9fbf301fe94852d6dde7efe6a78c241e3bf46a02fb4ee32a2954740abcb9f669e0ec4683577c4112bd380a46fd616fd1d475d6e5392cc49c1f819d"]}, 0x304}, {&(0x7f0000002180)={0x21e4, 0x33, 0x100, 0x70bd2b, 0x25dfdbfc, "", [@typed={0x4, 0x2}, @typed={0x8, 0x65, @uid=r7}, @generic="03e93349fedede3de9debfa7c5aa3366b1a1f5b0bb444a08e86c5d72bedb5f953170232bbe5f446bfcbb1715123cd07041ad491c0710e9f33e3131ec30174f32c5fe5d2f4bf44bd412c626c3650d6d43eb5401eabbad2a2dc9ca3c9a727a2d5c3913386c14f7358477a9ded1290550da09f6e155a524ca51cbadc0b80b30c917ad7b6166a4970f750d01659859081b16f89b99a9bbd40ea96e4a106de5a139d068a363a8be3b970addc36fee6312d64f8e74b10854f3a743e31a125cf0072c44533c0b0b6943ef9adca98a13dbd6837b57f33d3b02af14473e6e871db9f372653917d9979a0028348e893d774f317397971bb883ac099b07e48eb8f4f4395310946f6b266dfa568838305699a9c8ab61b2dbf03bd0ee7bf408b855d2c273123e7c9f109f1f599214d5d0ec20783aeb43173bd96cbf236b478d747817b1f5e251f9d257515b2d9019334f3be2cd5cb1901eb50fbb39e85d03f505c10737b4bcbabc0d651d5ede3a8dbe947ed5adee5599304a6aacf81cbcc8c162498aa63e55c76d1c20afb9e585629a83bf222b6930342cac516694957736d13894c3f247c87716085db0fba89d0c5a69b95fde05639e727ca8bcac3e32a2513f540809ffe35ac8a8864054609738a601b91efc208373a295f39bf41fbe2e6e34b291bbf3692454a41ae987a26f456627b6d9f397db624ce1a3feb5d5f5933789d820a27885e7a153d4aeed8cf5e18b3b0af907b1725e5691d0daf842702d6d715c1a36c84948367321d3a8c36715839bc2f9a7d27c99e477bc2ea1933bc03272b003e6a2716baef5012066cdc4b8f514ba052c1f8bab1fb0f14478780c59ca262e5cb79004b57952fe0e9a172546e2b5ac87b16a1b6d5bb2be2062a9e723fa1c063db00d83860a5475290c3c87b983d9775cc776ae9775b63927c0a3d9c493cb70f03a7a9cf6328adc9d5be06a89fdf8fcfad1608ab3cb17f3195d26d566d796042cda0c619cb1aae9bcb4e1c2a94c30117d0e5ad9ed51a9fd2b641eb162e566bac54ec53831ee03fc97320495cc2fd4cd0b9ad70961bfed4dd5be954bdd9077949c7a2d674305af8962394ddfd356a6783c3378c8145b525b29a295cfd8fc9d98fb0133f5c59a629c391ee7dc4cd6f88538f0ba43a03c74ae2382bd0ba6840ab97bec1a38b6b1be0e562ec9c8ca4970e90035593908866678ad2902d5a946ad09ae3f7f2f1f1a8ad65f3fcf00458920c0d72462f2b7906a8dcefc160c2eff38876ffbc4a9980c6b52de7af5bdbcf3e73d7f789b519ac2e3c0344c7783152dfcf02951a9c8a76acd08955550bd0d13cfae3d4ceb0bbaab42461685b8e45f8fbfff33ae8d1a47c1303552f798b494fb556bb11a30a592e61c57e1d971aa830c95bab7bb642147097159b711ea814ce6a589e52f7efa64dd406a902daa3b6605c498c052624e1f6a1d9e497d5ba1a54749d673a2deccd9c0ae6c35a06bef3112abaf813b17d291bce193b0893acd76dab5bc941c84a7975b8efd9159dd154b818989402b5ade9844575d36c5f10272ce3be4ad13c77c849754bcc42c245c005422908b79ba40da5c5b15653a1ee360e451a7105fb2dd86b1ea65cea1affc6eb6e63af6a06dab282ab13d3592642c8fc9c2312f42775e8d0fc899f372b5b5f02ea4ea2421e906ff8fc40427021130792ae7021c49dc55e8575b11800d62a98734422b65cd50a1840caa50e02dabffc6143c46b19ec9fb75fa805198fbdebbaeb002921cbe9db7b0e65b46641e612a2d5d84f1812e6afb97fd4398195bebae15175695c360cb752defbaddc6719734385e01be6a20dd161a375d36fc7053c2783c4b76b17f047a7d84a96a201762153b612428bddb1504243bba0df8ce3b9cb3dc947b0a5a54b5959b57253096eea9451f4f94231835bc9e85922d1bcb11cf92e963d75fdb7a0b823421b6f5110cf7b2a7cc5ec40442cf9c2db884b8fb0af7e0fe7d4ca843557778e84e2484b67efcd3673c1e2bb1e30de89cd9d5bff29e0ab09a833e1d497a2d0f4b1d1fc8bc3b80ff6018a5207e5af28d6607712d29d8ba77263396419c78fc6f732ebb514f0ea733a8f41a50c8c00731ee9a784df739d9fffe9cab4175476107e14c5ecc8db99baf95ee810bb70f387994a69093dca277582a4dad422bf612666405d8ee6918f9c1e4c694e1af6b86216f35d0627f55f6c3f75e356df73b24d84a6cb02e9424e8bdcea8fd90e22596619adc8b4491c1e621d11cdbe421fd5c0e9594721ee2508783586679aa8954b993d606e853dbd154af0ab80fe786675526bc24dbab766db616dcc0d6793da754cb30a1565761013d0a5e564e9adbd6d38b7ec0680df2c880d196ba11682ceaedd206e6df7d61ccc97e5cf07d4a868f7b523ff90f9bb1f510d9eb7f3151e5c6ffc56407e14ced193bd421f1a41edabe354ee87c6dac4b0d389fc8cd44f5f37affad5ad9fd5d014c7d5e19e3ebbabd73e832e32cd00bb123c9a3c12fccedb9d3d470d07b40d18242a9ca548012a3f4be0fc73d98cd93a40c1ba1402c6af61f80de6ac17686e65013a02d04102b623250f093cbbf16fe0e7f1b0b003e0fd337f2b11e589c04ac0c50d399c061c4bb2d99d57cbce141aaa5bcef43a5c29d094e1d945a512eadcd0a90659fd9ee2ada75fe81a84db3cc59ea0f09b2b0c82230c59c818c84f2204cfe38e6f3625272567eb825d9749bc16eb9763d9f2e86132ab0e0fb0f468cb937498f7b5d6511c46bbde280882a2c17756b0a11e9cdf1149580422e01e46c14dbac8088fa3cc3de0ccbf14934e61bfdf358e4cbe2a080b5a961a95b63066d3468b642ed371c1575874b6bf3e7fb7f5db3dbfe20e49a370e9c9dcb5b850bb9ecc2a9bcd46426ff4d1668e7e3208ef044fc0c024109e3faa190fde64b75cfafc5f76b5f8342d5d66e066f1bf052987dc7d6f5f74648221e60f4223a82df2d440d0d37e77e1aa8ac7f841a98fa926bb7689265a7006987416c7bcb65126a234d741d4c1c141a915305c9006183f860291c17e503524a656ecfd946fc20f1dd1e164cafe1d30111e6361a6bea74ccf93421b570e7f6b49b5fe3547c1419c0b6ffe05330a0980ebb096b34270dee90a3b8aa9b87d012d4c3dfbb4ec07675578e127ff246bfb91ba1ddd99afcd568eb25c0178b48639765bb133d1cb320bc79d53d725ef495ef2a38ef1b917f3535da236f7a2631361484f22d7da272383efacedafcbe7fa57c7dd51882942c191d9b7e1b549db8ba95c0e3585033dc68ac4728703c311547d663fb87197b4f333534f13d5c1004a4fe4b0f19cb62816ec84b2b96dac9237256602b0dd81e670a6c660bfe4fbe30018a404a749a3858ef09ca0dab88ead40f7255ea99e4603ada2d5002f1e0192968be5446fb49244adfcb456ee7106c2b8530565b91d0022a368fecb1f31c24cbcaecd33f20b96d0c1c09cc68fee02d064480b6155f1a11ed5291d5a1f7aa850f20e33ed15913ba52bc6740bf5085b52bec6fecc2edba314d421fc30b5b6c6a0150726ae4c30d9e377d61edde460c16c42e56f9b72d69bbd4d9f9311597ac2cd532351db04c19cb727b447c66dca6c4b5ad937995b7993b84f3c06826e55068c8918e4a6feaad02d75b1b010793f6001e40b4d183c2641c24259d926225639516e12a77e3b0307a25aa963ba126a51253f2db1b6185a116ce7456c4ca8849b5c74357f1973aaa76e9c38f781ff7c0f87b0466b13f988a02203b0f98ba52a895ec1619554f8b29e2478550fc00c7e84b79adaa932bb502b9403b3164c236be056471ce5274bb85f23cad15bd31be00540c4ae59580bea4d30607af7484d19046d506ad08f882dbe67700bcb5231614f6a2243b7491d722131bd5b5c86adc686bb87d37d55a92c7002d6d33fce121a71b4bd55184511add7889ab495b21fffb7dfdbbe2f2589b82e6d0ed99af31f5eaddcc6d41f0271c8141d8610be73411782e95c8815759510559b1fa4a4f7ba6d7972882ac30274885aad73f4640c21f1f3e63b5a56fe4c1de183ce19f72d0d584582a050b6366fe42b0af5b84baab1b4dd6496776cd49de28144f0c6e249ec746c95a43c12d091acfd790065e0e93749579b210c44a0990cb676bcc823708f783beddc37914dc680778167cb942395cd8ecef78f9baadf718832809865cfa9cffe178bbd1f9604ddaedfda81320bb807c3155968a2f091af7fdc20fd1bd200dbc6556475c97a1dde215c0a451bea6032f3e5f60798270dbfc6cf2e61a24b07a4993f0e8d492662b94f136bd5ae4f0fd4673e638a990a40a88ea959278b259022c01c17e72f85273ac6f3861c33aa7db7bfafeafab12493ad6d3fe40a1cb38bac6a31b05b444451382529cd1bd55aae710d9e79bed91f335e7bc28392c2486ce35e36dbaaf5d9d4e7cb2f13612b4097c01598b6023bcaf80c9b42bf4d7eb9752e00384dce10c84e219ad070f75950aef300f5ae98e3018b71ca633ab0866a28a74b4ba67e2480c6eadf08c085fe55c6c8c9a9f073a5dc50de32c23acb85a68df6e2cdecb935a404f0de6f77ecd51e44452c625d0ac69340bc4c3b08d2133187c79f836bc48cac7941d1738d2a78c0fc8a2a97b6f9cab23cbbf2a9b10a151868e4fa9eb09f4a43772943ca7244add5a6e7fad05be3b484eeb1dd19e4b7a8ba2f15153bdcbcd294f49de8ef14506fd83ea4902086e876a7a2e592370f516e651bbd11e1e39243de96b4ef1a8b3080ba7a0257e2152da0ed60c14b0c0cfce9f7752025cae381f3eabd1ae706872944e23824b339f50ad07f91f354d9f8be643aaf45acdc7cc504ad830c1a11537db0cfc0f8075cb05343b5d8a3ccba7525ff03ce18658910719b6789d61f4e679ecca85c1c8d86a60d7c709eb87ead12c7b30bae1c5b7a0ab6aa15b07be9388a8666376b6b6b8945598dd3868635cf266a36c192a0dad0ae6feb58403e354c90e9cb5a7aef62c08fa06525a93fb88e4bb09b08493867f6cf58479142a44d5a65452dbae5f7b3f21e4c4a29b4ff6bd452e80457a594ff869d7b89c9628d81b79b26c360c1f22a7ea47fbd7434646a19dc302270a3f4f9f49640628475d441ac8c1b4bde981f9317f98bb9418e6d841d7c3d7b886f0341667f5e4403a6bfd4a6d1ab4be9cbec5e99457c8c34934bc4303e024ee5150840cb21148ff7ba58f6dae63c58d1f26ee587c72df9985af04bfe1b60314c6c2b29b7a7f4a794fe0dcd89d65a70ad74cba6df47f980deb605a8a2e139e7399baa5369319be7416869e7820e4e085acbb3a5017c3681a2125bbea875f93fdb556b93a9475611dc052156b6c67fbad5b493967969816166ca0aa16ffd2753e3f1c62b093ea4313c00884889143a1661d102e2687a7524987f75767825fafbbbb1d8b590ab43e04f2a935ee3b137f6489cd2074c81541eca85aeb89a99be685b3851758643211c36c605e7f73455011eface8cb0fe6102af40787df2a69133a4b392ae43a733cf207ad227f6522a03127069e3ad5a33e322c573c9c96e8a656b0ee1182b46181170d27c2ae8809dda8d89a528d7b397bc32dd5c90063c5491749f1440d91a0b0c905d3a0ad73eac2aab5eb41d4ed558e218563909da86b041f5cdaa969a613be44df9ad1c2fcc262c2f5e4ee44864021b7944bd33d0307288b790688011d670e414be2c7d022636b900c35cc8440c9b1bfa7fc1ebcbdcb58378fe2a2cb6fb04f8fb4ce959090ec9dfa0008f5cc106ab24cfe47f256b40c735b47e3c8ced2f248ad50458adf10e8c225", @generic="1faea391776c55062854df7f998f967a2a5bc6cac5f08baeb59845508e33a9b120536a846c5668e9423a7cf6d4a5752b55c09360255438dc2e337d45c19ac7784bc9fe16d842fe6a68aee5681b8b76fe07118d40d45a0573b64f021fb276d296fbcab039c45e53c85f728b31e8e8283a9cf28262c32172ef91c1178233984322c3a64c35c9afdd1478704aa3489bea01a9c9d196c88c83aefeb75c29a1dd22c33dc06fd707789bded4a321b1b3127af1a055cf409c5d24b982a1c99547b1685e0574fc0194f04fa2a98625773253bfd147048a4200", @generic="bb2265d530844950964b07bd3bef0e58c3a42f5f36b5a63e88e5cedfc8d39cc0133a959120178234df923a0c69d30b30123fa3e6787c2aac6a9510c052ca81c17390508ddbe2c9fe11c371dc37669aa2ae870d848faa955a450b977d4574dbf07a86dce213e5d39cb3fc13dce71dac9f5e8de33800de252082000703088177eca67b2e4af1e8acebc61c537ae82f458f1c513687d2378e2bfa2edb73a524bdd33ba5c29d2094d1f4498302ac56caa8511afbd552ce6cc2275c37e23e3c77d15d799b117cca4e3924d64d0704c220c92044e65db3d9", @generic="789f4187e42e3a4967de81c98a4e65076ddad1936e7226241c47eae1de38f576f0a625c6066891fc159349cf2d1d9493be9c93abc86430217e262685320a2db2f6a9094b9cd5c0d1548606f1551ba3ebc4c907867413a7dac41a63210b279f835147a17c574c9adb5275ab34f3ae49afed3346cf684ee93e7f3ee8881cbd84956dc212019105fb2b329a25078597a0626ab0bde47c8d6631a586fa372af7ada16ea544c12c2da88bb0475008a972b345cf25927f6f5e88a04186fbc7da8862d7478ce7186a73ddfb2761a2c4bb7ce9af7f64b247ca0d0dff0eb89b974296c027b4dce328018ea6d785974196ec95e40df15b4dbb803ae13a0b5f032c08414c4035648ddc5ec89480704705102aac26ea6e28d806e538f79abbf20f69b2b28801f9ef3c94b4e061b8e633ca1d79215ab81c3cdbee75e37c0a6d6037916a171f3e5d90335c384c122ed9da50c86254ce6b73658110c438b394757537b904cf0c4441940aa3e398cc297b8eb0aad27486a5f84e48356da7ee436277ecdd87b38090b47776476fed24a461e414180c650d1be0757f4ef09f5ebecf62fa5bbd2bd62948399085b7194e796c3b181b4eac2b8c34a9b1ad94385ebacb532ec985d31f1edae0e6e44af120fb309113d6a9a387749bb8691f7e05168c8335e6316f51d62fba16e2f8bca5fe8886ea9baf7c16327323c8b8cb45ad2e056568cf417511b6670ef95e563cf82788b539a9f415b52d135d89de750ba457b0d1a6cfd847b9d820184a9c7e2ba20c333f7e8f2ffe84a6d184fc9c925e5d317cb3bb8698893b49b7efff7b18654741f6a57fdd02e0a43bf68b6594f57d016c5714378e2a5851f9470bb5ed663ffe821a73f73fc10869d6791e1227781609bce971666f8ee3c8eb764b1e144e9dfea404d7ab471afb1c463e2d47233eab9f0ea3cb876947233a1804c5eac11c23b171b344d6534f7660179af34fc004995ef41294cf5c2443ee307cd3d52609fa2e13b02f76872178ce820c5121af4f3333309f3a19192f942e39f536adbafa2579304927a83c6bc90fb341df77fa5f8622d7a30f8121c5a629b8a1186789e5f9ee38de4cb57178b42956868da078ceb5c599680fb100837d778c749f45a149e9e99f7f12736a8a5431685785cb92668b39a21aebdb15d2c5bfab5bad68249d210534b613f452722e6e493a133dbafc5347814c56a8ace6432de5715b1841f3be1181dd9e1a47b8d77e3c6870e4bcd29f36983e0c8261f274906ad0695ba6db5978c1a21c3c83e8b03d8107b3260c89321a0812650e3db2311b5aa4cf60a45c8abecee87e1c50cc9bf2a68c6a46fa8555d646e6287c8f571f83a5582ffdf3a39c658870a1447a2f99c99429cb1c0a93b1e97276281c530fd4f85e3684c8691f3c58d891834e322695a2491a6ab6fcaa9a833800ab2204f9979f38fb7b70fdb179d49c43df289d7071d1b6ec4aca151d1d57a803327a7ff64cd34731667384c2bfd5c0c9fa2287aa2704ec272d0964204eff7623b4f8a5dadb2b61226d68c44e0c89c12904878b91e8f832ce2366336a4a500a991fe336c784e4d657347293f7f57ad03786ff9dc19b714042fa3a8e4d9716c153836ef28f71af9f55b20c62e775ab69d8bc9cb15f761b61efcc05ed05388af4755da3d50d24faf571072e3f71d07311ae9242101e566c12e6096356215df715e31f0c47a81e9439b14257ad3983d7f0b9de683e97c1f6fdc46b567509ac594efad611d35df88440df47df6ba89256ed492270364f2b1b378c7ea80615bf4bfba419ed955661aea60e042bd31f5c0b367dd6ff717b5aae3a2b4b3b7496106de731133c4ce05fa24e8ac171d40f4c3108d87aba9cf7c4cfe0995316c3b7f6f074fae314521bd960fa22d5e704899a7f489dcbf1636ee98f6d419a68c84a71e32dd0aa264d32bba19a4b36ac4c2c58832e574f905cebf1db6a63f7ac4049bc8ee3dfe887831b3927e5e0879b8377363795d4c7eef847c0d90624204473ee2018c555b4d26e771f21760f57f1a20f0a6d41076aaf15037c6d3508aec22a92b952c067573f29544b3cde6dfe4b561432dfd4b4fd66c51e265afcaa95ff2a4c6f1c16fd3b3f5ab2282cc6661f1232cf816efb6b3659f9849b798cf30653699dc29b6853575f22686a86bf06ec220491d38d3379c069ba3148073b1155ffb028f5a3f25ff9665790fe000769293ede11fc99dd88758d6ce6aaf3cb19a6cc0486f9bea731f5cdc970ef23066561bc35ff0fce81f849153be7be227a64d8d1929e0cd27ff3bfcfebfa0e228be8b19719411e0d270cf84796bf04718de5164cca6a84018761d1cf86a8bf380dd1d77c6f001e7d57de016f31ab20254e13eaebbcd277ad5a49cc6dc8d47221fc748de5937f77e241cadc3f64577051ef9a768b5cec5f140661eaa1779ae752c5697a42b91f0c89894767f400c4c58c7ed8a78d98ee2af4335822eff536cdc5afafb6f8e6a0f8d9f5d399ed9fd0cd891b926c0d176b5a75e4590e0b671e7e90ea932245c53911d349fb96687e79d57c6cc96a43446189e87052850712d8c582b87d6802383400e65cd0c837fe1886fcc472c09f488b6b4a93b39949eb646aead312f9117497dce607c9a12c1cf58c26b0850d68d1f44a0b729be6de6b9c9564317f90abf0eeaa434f56f2314b45a9484ed624262e2aaf053e3a484528f66152fb4f56eb5c169b8cd9011c6dc64b789fd260e79a3465f092773bf3548b0a0c1a4824fbee755651bf4b263a2fdcb164e06296dc552f0463a5b3ecf029721ff80a9d2647c2b7b5708e6b56f1468c687652b6bd16ba8b76aef06871ceeb0f3aebaa6d06742b04cf25c0c8fb461b37b610d4ead0f329e607b9be2ea9a50865bef2449972840e1c21d89c7d4f09240ee38cb39899564cd77e8bd23aa03abfbcc9b5b3e96b14c15777415e9c6eb94a253833c22c4e7d934fa85116e3981022ea26444d62e384f36ec9fa67b6ca0d93cd86def7ded96662af3732453a5f29c494877b4c2d9da811faa4827e843305a010b3a3d176867e40d4e6929ca249bc49c24945b0b1771503382ac48c8eb4c8b52bd2ea2c6ca11c5a7155d443becfcfe6deb66f7f04331c1d9a4434728ac0502e3b492d867e21f58d8c8128d1b30bf6262aead4efc8142ef6974e128bb1ac3487e8769086efb472112c3cb6f7f03d2578ef4ba183238e3985bba9f405ce6ae100962f603abe57f230fd7b7c7f0a95680ef0a9d70d4878b587a95eeafa880be90960d510e1df0ffde0fb7c36dffd68f081bff636521c12db106ce408151aa2953a838156348b91f8acaf826c75b6bf5eae81f3fee372e3476334488246ea7d85b0f3b8b05fe0cef09b5ec83fdec0c5d574b24b16c88b001e2b9cc00a7c40d1c7a73e6903e81597e0ec73838df3d10a3a1778d6365c4edf89b775d4ccee6d6a80bb6249450a2272165d8fa375574027fdb31996bdbd3f65b390f14e3cdc0d5ffbebdb6bdd2004119ced12e54fa60e709fbccad1ae5e060fcde67c37c47827a63c416cd43222c5ed3a5d21465350c5faf25c7d4ac98cd645a0ce28c8c990f80cabebc468eb74e30b286debac3c6b41c1be6d0ba24aa95eb94567864e3bc7a644c544c0548a3aa325cde58b0d039de778345b2959dfae0826d1b5966b0ba235eeaf7dea3549ec0f33cd67861ad57087e98da5756f2cc33a00bcfc7cd5433570fcda956492c7e9b4650c2d6bed06b0ef8f85eb6ee6fc49d264dd0dbd3664bc2ecaeae4583effae61e14df6aa2893451c7a908371f41ced5329593763b5e12a618a55604fac9862aacb72d95fc6ebb0877e8d6ae1a696a8eda6658427890a2b214dbbcb39f78d9b96a5c862c72493763b37238f7357b70abdac2396929463d3d91311af706da224e58450a1cc0ed467c1e4efff8bb284e499daf07287e5d2e2058eaf1d2f6777352df2a01124fd0b875fc7f28aa233e7f0a7ff28c2b21f1ec72c91f0fab73929c8ca5447d2e9af20eed29c6bef2e9443534fd21b65339d98b5491c001dd1b9dfcf627a38fdf24c63fbdf5a679fc98bb86c7b49b988107a20a3db68ea23d5d6a9ea1b2d30b978f8554dcad80bca3f3c9f106169edb68b55e88fbbd899e6c07fc8dc58d045d88af41661251e4ba9db8e901cc13df1b9dab23dade7b2b51405c728a87f4bd609bad02a98e9bf38d7534e8f0a45f22fa621e20cd52d0d2e812391067777de42c34d6668cbf1f7c26d1750c0189bb5d16423d2a0d44703df62f8773fcca29d9996191f8734de142a8a85a6caf1036f3bc57699fd42d2429f5249d0bca756b0387f15fd3d130a0342c9b4ec25b69be183926060da19e75bb3cdf57f54ec0243ed3aa701c62c38cc4dbacb65982fd8973ac30aae2848940fddd7c461b70940892f3dab87ee5eaf3c797e679a45b615024961c6bbdd5b078b462b07b4ff9b77a3b7a4344de661659ad6f5c61f7f08a46194b708b3c0fb928f1dcc1fc97743352f4f78c38ef3cf08f033c23fa02dd0022986db4495964b50d49b35df247b9f4f8ea478d4af23c49774572a83318b63a83b4853defd059a95c4549c691b384370521f9b942892fc65b3f89d671fdad8db54ecfffab1239695dbdb1aac16fe22fae8ab7b8cb717bd4ed8875056156492f6fbd5fd4bfb4ae9be33747a361e0975bd76489b8b614984c05fad81f8e079aa4ebc355f0920295e60c5ce7bc04287bb5b64434bb6f4d716500aea2724ac8a119825da80cf0bd59f3f497cbd286e8a7eb3283807d2de16ea2c840e6889494551e431fbb7227e69f3ec5f59a8e5ded073a8b5146d5ed1433d23f915e95feea5a79ba06669c4531413f355948d2fefe8495deb347e6728a29397fd7f4b60621cc615519482155c433dec080e057c1f6f8f4a3b277828a79076a6b77365c19791f6e90817b5f3f453ff2d81972d012d1ca690d9f5c14b334bcf73a08e93d9082b99ad5d09abf17cb74ed4ff99b81c2ffc33a8212d76f3101348b5e185b6a83c32bf5feba2862ec965ff6f03ec8c187ebde4decd048fcd759333a8f60ac8c8c6294e67ed1d6a7d98377791eee1d012fe57f089917f82c571eb1a562233e5cb815b23702cc8671d56c81e192f6de39e64792dae31bcf3a0573fb3b369d30164f25f8eedefedafa0cf20e82cccd6573945f09c011cb011b45f9173f62e280e950b956c542b4774cd38eb2a98d7c70b69b3daa7eb89da0e6a8b804cdf401060f3c71fc0e197af3e2c8f7036a275d443ac176c5c4f458e3f0904baf3796586769fc2d58492949ced3406039701ede27a19c133099aa0ad4c02d956b99904775e4c8036c1082590fd740c2fdd5f906cae5c504b60c9fcd6cd39e44bbf3f08c1d95949ffff5d2efc720b8a5c631d501764db24dc824e04637636518efc73c72e70bea4e1661f2620e38dd21029f7fc9373e3000a9aa18688b19310949c2b898b48f0edd7324575917a34e90881f5313ddffbcaa3550c1ba8541e351316f7a180c3f903f66f29832e07efea40fee628e30a206d671c04368a7910ea54e048da4dce37b2ef3f58367cb931ddbef239c5aae9501dc6f0d09877fd69a44e3c3583feecb7f3c473cdc509a9193f2ac0965bfe38ce7e45d2e81a9f811c42799dbbb1dd5d8cf268518d4bfcb0be73f7a753d30e6c5570357e3aa701fbbf7743279117d74169bf69cfa9000972a017ed490f2e92a64d35ca93ac3ca3f726179fc6dadedccd10791661b15d7fec297d2238c84d0d3ef8c8d94a3a84a7251a9c00031b90b5d9fc6c1ac58b66", @typed={0x14, 0x32, @ipv6=@remote}, @typed={0x8, 0x0, @u32=0x1000}]}, 0x21e4}, {&(0x7f0000004380)={0x434, 0x3e, 0x0, 0x70bd2d, 0x25dfdbff, "", [@typed={0x24, 0x87, @str='vboxnet0em0wlan0]&em1em0^$!!\x00'}, @generic="79d0d8b9422b1df714146daa766aab40371d98ff945431c3686ba2679c50302172a589b9aa0059f3de2a6a5d622a2e0c33c2d6c93f513c2ba66a910917a37d8e6a6d3e5db0104fe7eed67ce1a377eadc8aaa811ccf34aaa1dcfe582240f544665458830f73fd2164cc8a1f8f866e6cf5ab2b5b7ad086964d413caf2289e57dd566a63f9d88f0e4719c9d4ec3ad00ce4d6cded772db2b1e3302f1fd0bcf9a2f75b56638", @typed={0xc, 0x86, @u64=0x7ff}, @generic="5c7846b501143634edbdc86f63b4ce786b5e79", @nested={0x250, 0x7d, [@typed={0x4, 0x15}, @generic="d907a526d827ac7fa84a4954ec3d231d07fb5c11a0ce8eac15e58865d4addae45d5492d23418a6e48d6f5b729b4da4c2e9ee6152ed2b339eed46514da6410e014d53c6ed1eca6848bb09ec65609f47a04af5d490a9944157da070e747dd0924a11694c4fd92aa51d7380b86041c993bce6a1eaf88f8ece4120b3816532c03edbad23217f857483e7d660fc45da34b9b8331a622d29b328e1fa2889585e04b33fdec5cadd9613003408f31a0daf7b4ece63", @generic="5bfce78bc46facbb181e364c8813e0d332536f45c51ac83f748e04fe1eb66fab53d31d0c5319529bb7767a68498f3bc73973170c90e0f1034566d42921c133baa1e981b1d3eb809c9664cbc226025676009410ebc6dfc353db3024bf3c3fc0fc92627868fdb33e79f3c888965c1ce2c828797012769b75f5e1e34892dc08860b007f77107f52b103ea886e24165cdbe6de355df101682e3769d5cc1142fcf59c0ba1feeb639f3785a717861bdc7808d00e2db2294ccbf8bb44c78c6054320b5461218c8bec9d2c182dd06d0c8cbe5a2c24ac85e2568e5df8d0de0175f94622b5d4b638eb5379c799950b552b5dbdd40c", @generic="060b6485ec838c11e701b48f0a2ed33fa69e9afc31b02c0ab83ca2105400aae3d56240514f3203fac1f6092fb007ddf44b431d3d0934b9f55857a2c5e3a87437ea9773a9d809236c2594a5090c4dd0c159493f027ae8c23c3bd0605ebcaa855b1d4f21ae2d9d64b237a1fe7531a11ec813ddc4ea93ee0aa6d92575f27c2c54a66329f21d7f29c865db2e2b2f3f416e2f7227acd062b2aa53ac46ab80f26a798a1582ddf04cf5"]}, @generic="d36742d3f5c6e0acff7c47f3426286a518e722cdc4b821a635acf424c2cb348e163989a99e9cd9c70fd430cd681eabe9b5e6053f6c070519fa480fc866d29256fbee114757584b7328a8db0439dfe04ec8bf33417f3cfff3f53fde2838dcaba021314e7da16fda800e1ad903bc15d722514d036834d4f0b22756fb3dfb44e9f059269b9fe2ceec0489e3a6841070dea8e41789b4248ac4cbab4063173dee712973b9d0ee97d055321220cc07ddbd634aeb5e83a0204e04ca4c634cb1f63690a0ee7350bab992111f8cfbdcc74bd3b13a4a82d1a78410638d2da6045f22f209c5909420464f4a60f97d7b8d"]}, 0x434}, {&(0x7f0000004980)={0x13b8, 0x17, 0x108, 0x70bd2a, 0x25dfdbff, "", [@nested={0x1b4, 0x24, [@typed={0x8, 0x88, @fd=r8}, @generic="4a6190aaf902b1220fae506384ca12b1b1b187f23cf205bfe417856cac4cfa50d4f6a8b3d7d4f07db5494ddb57e044d905f0224bbe5c3fe27e2762922cc4863fbff888182a015caa5399264c06d51dca48752b555ca2648ac15fdd4f536f290d685175afb452bf4c68b14292e7dc776212e6d7ee06cd5d6b5d76174473d9f823931acfe747c5fe713ed76196980c4f94eea464fe7a69b2735ff4a3654894fdde00efcd42fec851659c687460de4b0fca4694a7447a33d885795ca7ab6aaf3819184b60675578c8ba8634f86d265496f762c9c5557477403974b2c4ff559398d805c2a4d5cc3710a837087a7f", @typed={0xc, 0x5e, @u64=0x20e}, @generic="4737d7551009d5a14a1177f44fb0522590bcda3843205281d5fc33e77cbd045df732732e5c7f4af99a635cf9415dc5bfc910f5aac9b65e6148c9234a22a75fab", @generic="8b20f804255d0e87518651744d0ec2a2d3a0f9841ba8fb7dd43e3c76322b125a9c0f6c90db59255f1bd5fba0bf4c63c1fca91798dbd9eb6deb15564361af9722474d9a6a506c57239b12d5cf333b0035c5676e4cbee57c709bc8646b10f5b202e39e8663121cfa60869041c7f1"]}, @generic="9eaa1f51a0f15806625b80a9ef79bfcd2f5763494507e70e82ed278a42bf1937440f9910b84718392e31545aacb524d814978f3d3eff274c0789ce68a5b0182686f0a3ba5695765c767cea9c9d434a6a0be090c4be46366fd679b0378fd0db581da45b69cf1ec69f4beaf3e10190faaf43eb9c9b12d4eeab49b0049179ca7298950a48aba7f99ddce2aa028360aef3ee3713cf6905ee0b99466e89c92290e1ee22bb5e1a247fd2346e3dd1b205f808c454f6afa7d47e2dc59085efedfd246704605cf38415470671596caaf248722338b1795f60e5b731cbb2c41b4765", @nested={0x1114, 0x13, [@typed={0xc, 0x3e, @u64=0x7f}, @typed={0x8, 0x79, @uid=r9}, @generic="347ec56e6680de808d2b9ab5da618a7bc107a68041592906df36b64d71714fe02588c220f8bfab2f8d8a87f783e0a348bc49e58abe36e8afe077ec8d0b2eb774c16b41c37f44e1bd7d439059ec6b6ab1e5a8ef92fc97f7265420d82b90623c451a36424cbda7560471f07c5f4f5f112a814421b6c6364e97a9a93d42512527a9cef3ce0dfb4bf9114e6e9844e8f9716562577439ca105a6736ff2b91ff6436f6c6841f90f742c2d341087448317dd1b215424d8a4ce530989661e0a6ec1e78a3ffb3b73269bc5968ce0268d7c1a8aedb7ced5a24c64f7019f8145b2ff11fdb6aeaa2fa4f1fdc1aef39a28af4d6b06d88c08fcadc4305a8c0ee64d3fe3a3f66c18b3f8533b8dfa162f9efb482eeaa7fa1c449d508cf151801c8dbc5050546b8ae16d3dc75b47d5a5ecc47a4020c56edc07beeed2d30ee71ad132b10eb09a0da03ce4c8bad7b0729c64d8b963d2dfd86bed71debeab3f803afedd5a6da9ff4527933d2cf7ad4bbb12e6b63bae8e4d77a75734c8a9df872cb2f19097fba9e4e875e310b128a5c774e741e9a4cf799e69c83204bde6aab3e96641c2efe5c032e2fe13cdb08acc89aecb285db5b95601d2bd541b0780092883d72172da4105a066b7cfbc646de031757c92da1a98b4ee6bc5586a9b53b9217af47a0e2d1d1ddafb44722eb76234756315f3cb473755470f210d92874ad5518e4df43305132c955de3218457eb8da686dad214a5757138245d71bf8e9777c2b03d913724e1568a6db4a5389651c6e7b820b64f2a787d2e9e0d457f2a4a9cd01e35cf03c01ac7417433f4ee2ffc7c49640c614818bf62b6b10448d62451fea1c046f63389e67d261d7ba3c9c8b516b917891da888a813c296f1380da5311d4fdc2916521b02b5a34b7a0fd366c835ca3a259b9a001039a429644a81795d1c044262feb0a275826505a5eef610f5dae8cfc14a7ad87ebc86ddf158a2c6d0544bfc140d35d07ebf79d62460b84fc35a7e88daf62938cf46f6c30edc11d7c0c1452ae01726be3fab175908b4954b7b0878c29fdb53826bacb4e15169f97244034a1be685f674572da8a66b895f8b86bf017eb26e8b87882b09a07f37466d0cb9e0b00030e01f144768c25448ad22a5333d693d2db7b4a0fbe16825838aeae2b6cdf957b20bf2298a7ae54ca765241c485e8f01dfe7a31d75de2a003ce19bf43cd6d572f2ae87fc635912d9c831295fefe8b7efe5f18bb8d1151029b0411a55a678393406ca08d90c8f4d786e75d4f078e2e5c8fd80923bd8248f4338eeb649d71ce51b685ca8b0aa47545649033c411d8ea0b74bb82485556ac0e317bda4bc256b23be9e94e8727df1be713e759a642c0f6ee2ca38d46ebc37212d6929621f5a87318a6b9e24d2b42f7ca62f8d3a7d88463c6cd9bbf637ce14df9b0d727be62ef1df0462bb49529e8fa3051f2a843ecdb20534443bafca690055fa8680df94af32e8902538dc8d3891c1703babb44d3e2f6d42ea4b78d3f2a33e2acee400ebd6be21d33b4ad4c27bf725ea443afd1f5829d3fd1309334760999be2ef2ea0097dc6ac8334d4fadfb2d3c15b9494dd299ac3a1a797a824093487b6948946c89122902659271ae2d2334ed9c5625692d14d6e98ff7331427607aa8c82f788c061d08718a4ccbdab698d5c58743168eb22834b295663710c0b776b4b9d3c6d653af2ddd596fac59e91ab62d674ace072cb654ce44167274d0c3504f2f67ed3a6b7a3f8387534d54b9a0207a12100cff197e994bcdd147bae6e86dd83b72798da5671dab93b2d7c3188acc3cabe811e6856deeeb3298f3b39f5d97c80fba7d60ad87ac9d6127a14aa6f344f34b6b2c6543a13380ddec96e081383fb909d82036c8592691f7479a87b23eb4babe2b00a5f0954a94e0d36cda671776d488fd3b67ef069740069f3876060e006f515327ab56f1aec890b1ebc5d25e9534308a1f191870a5ad3d297a6bc6b61f6ec0f31bbfbfbde8bcd5400dbbbdeb3ab645d404d3949af46b65afb656adcf0ece733f82ba508c06f98e88c7fdb2147b75c9565cd5d280968ce1c04eb7d7f649a3503de55cd4523bacdbb88768e6fa6bb8c96b5c7462933ae70fb1b6000598b828d616c43d42f9a89c12605d71123be815aea1fb709c8b4dea01529bd2c48a5eb33dcca63e9f7d51291f4e341f186e37da6d27c25da9db202ad51be67bda7f787edcf71424a26d7d9bc905b4e736696556c9de024e5beb154b2696cfe40bc32f091b02acc80f4cbdec5e9307fe04938cad6b9553bf07e0b33bda0b8701045012a6267ba57f54cb26eb844959341c96146017ba6020f6491f37cbe33eb3985b7aad38ea4564edfb667adbe2e008aaf1ea011aae33297d2aa006f089ed5ae37d5e985a8983d6c91737333c9543ebcdb668cdfc662a82512df6cf2cdbd874f8df50902e12a42e6e7ebab1055c438e4a1f71b2ece5a96f6ffd54a03e4c66b58b1ae8070feed58a88387dc9de42c5de607f4181574ea2cb5b4b6a33e8de3a1409e7017058c42fae99d13ee35039635c8a3b3f188604a2f9edcc5aab98cca71e39ce9c9e253c2fef14fdaa64404790b63e2bcfa7e6ca327f9ee2f105ef175a6e8856e37867d6dd1bcdf437e21d6d50b5cd789c6b7b959051302df7509f36561f88d0cf38967c7cd92cf6cce5d3cdbf265f9b192260a3dc5307016888122694ff28608a5fcc4420a3c229cafd2461c3bfebd815848659210dbe138c5ec1766a92465faca92d1a5324bec7bf80d95c6455725951e79696f173dc60573dd2750b49f9ce25ba202311807400f5868018a1abd38e14801a4e2cbc9f142bf8da7fc709456a8d31a607a5692d58ba2ae04c0824a1c6d02edc13c26a247ca4e279959972ad6e4eb4c1d909f2576244f9bbafdbed28845ccac6b499012e305d20a39ff13a52d4df90556c61774b2979356420348e19a587650a82b191834ee4b915f747954ff753a5beab087478477e03664c886ca9706b921963477aa71ade3834b94015402b2cda3722d32fcf8256169fd4556e8ebfab3d5f59d925b54c20a201ba4899a6d81af51974c77ec0849c318dc70eca698db7533dce927b8fd775f193f346ce831be130863221315a7b00eaf2c9756e26d30d173f81d95b057203998b615e69a5840077623c15463e034cdc872ca927e00d2e3d75814407ca9338c16abecc3a074d3c4c6a60b219b8058e07daba8872fb306ca8dfda302294cd5eabb3cea6eba1ff5e2bb75fe98b815cb0e177bd806628163c4b1aeb5c5b204e3171d59424d4cc78158bdd6ae30880e8e1627ce62e3b5ac486cb75ffdcd075a0c9b882cbd5c0a901ad9654df0c39ca0018c3fcdbd5a8159078aaf4607663c0e37a67e1a0609253abe1c3574911e04be5fe2f729715cb508043b3ded91bc1fc292deee347f28f3d2a5ed1798f48ed225fb161e9917187c4758000c04bf46661b18a8b48e73596214d051e2a1bea6070c6ba925ee4a813471f865dc51684515e51cc9f2148e9fd3ff50ba393bb5a0651d158d6674b88bd05bfa7601b3e8f1c47a68b5e021b2cd2886a6dfb829625073194905c232d7eb7121cd1c2a68c6e702c4464507d454dcfd1a7d999c233ffefea534d380718241845f3e6f5c1a8d3c6ecd89a8356820679344ed05c6f2c6cd15b16d4b289773ff762e0f930da0927821cabe1bbe243f073a6e7f52dd21b6809292fcaaa048aef77867a2f89aa164931b66ee29158964d821763453984fd53cec505dd3616bc8e8917b075a778f04b3f10a806a2cf63d2689f30109920405066ea755f910e17d60b35c59068532a20cb3c0719c6583127c07f171a3eabc8c06caee0b5f0d8d153df078ddf1f827195927b4effef4c9ffae93e74fabd7f994553d4b5686b7376b777bdeb326bfc6de00f5371735991b0e42e961fb4c0d5e3bd50a1e4d8182611e6955f40beabc91511b5dfa786244f69fc01d3f44d58f5c8bdc8ec2d2f5619f2b373a2dfbf181a9c8e0461edecd99a6582ca9d456b4931d7ee11c938b521af00aae787638c46deb334376493d73f7155b146459f2d64908d22df87abb2bc766ab6eca3128fd507023dfcd688da7e78ab769176e5a6e7e994a2cb8d674f594ed8fc769853ae5f25e159731cf776b2ca3b915a022c3c52125bf9cb28f20b8289fd9f2c2c25fb8698fc11c506b32ee25de4d77f0ce25be4486064ebcc54cb16a12dda3d51f7c20e9e222b8150294896913963a68ae85136689352e178797e7286626a4b698227d9979a5a417d01a44bb26606f5a21bbcacfa455b036f04d25deb0338a9a31620750cc94a1f022c7021ff5ba708e2655fe8c6b375817c9939e409f87c44215951126f791a1c1ab8cc509f02f0f369ae8353d475a2dfd5b9c454242223878944a68687c0f336b85497b73ddcd23251f45e0fdc04bb65ccf5effa6cef0dc4631761d4f0fffd4f24ecfb3001c33988937dab520906f2284f24c0e2969dc4bb855dda6790bc5a8ea427eaa5dc555231c569b01e8c92b2b489f1a9002a0a32f43bfb5c165c3add167609adedc6797145142253cda100053af5d15d326c4d5c5efa3c6c06fa92911b59aee523adefaff1a19631470cf1f0f1862d5f5e531fc27a570090c927b3d2638a7e1b4ed659ca0a7b7a1b4719e80145b7dd93b36388713bba328310d71b11970b89ca2b8f13c3b7c1be55cc3dcd36f800b71c48f2533baf95c284e15a5c45f0d07b88868403e1bbb81c17d0acb4cdeed1832440c75679adde9b1980c0b485f651491355050950baa73e057b694510951a916dbdc9247232730fa02824eeb99a0c521a3e6469f1e0b8b06f569cadc7ea7c53421423b537dc675295c6ef970b54163cfd5b4819676100f0a60b3e7fce24c759499aa6863cd99452af8fd1c0c9174761301a55dc517893695feda37e1965c129c623577c651557a4f75ad0dffddcc2d04fd6dee2ded243a023569a9d5d1f82a90834fca96648454ff6572965650de8fddf2a9ae47ac5a79353a325217efb559500a44b7585f7307600b3442aae08f9e5bff0973b087e1e1617cb713b06ddebd6a06c58695015af84cdf3ee694f8621484eae8256f9c698e6f9ed74ad3dbd694fee0fe8ef4e4b3de0f5af6b07f64aef75cfd6a6ce4c1cc99b4814c51cb8f5fa24a6fe583db2f3d1c7b31245b46412c18ab36c19702c5598d2f866db9970353446372437e0ad133a0ac3decfb6c9e2a249a4e11613a8a08aeaa6693b9277e00eda91217d6ca0f0a6a7772ecc32b587785e11877678b98dcef3618c938d25950d375b9c0963a0b58ff43d4feca1cd3e51bc59c7e79104f99203f60161c2074d0083b3e673a29e64301d07b413f52b01476c4fe4894edb2cb2f56d82e9dc1aeefe92fd0a35cdd8b6c004a9afdd0237f5050382c71ebdbb99198344a1b44965a4d957182b3df39902ba8b1c125e0257608bd1fa4d5c085bf1ace0ccd9e5df5bd6b381a7a1cd45d150c628b020a14711c73c849dc469b3f9c9c659280f976d4cad278328325f180a064f4dab1f30d6b3c47ec54f36121cf474b12694f1e07bac65caded3a5bf5420c1171db353c3218941b1bdcdbb27199c662f52db6f939da49a65c6896b3890c1873ca46a661ec188c92a2130962acd26472eac22e174dcc7d018e51cdaabe8ab2c9d6e1b857a4d2732e72776bf06fb445965fe4bdafdb48b4a9194d17c7c1e6e6c4c28c9e6986c161d8afddefbffda049f54d7294633e119f35a9006f56ac628707e62843f42b2f3624f2eac53e686456c201ff14c2ef7", @generic="cb26da4383d2133d11de1480b1262874282df60e1cc6dca2dee1b7afbb22", @typed={0x8, 0x26, @uid=r10}, @generic="93ab4186480a78e31acbd5412043665d3c29e93aeeab2940c60c6c3945754693e773c06d6896281c66191d5b36b39f9a1f32a79f6232a3f87e1a835a2f01cead188c55fcb91ab8a8100a280000dff3909fccb5ab7664d9472401467689e89410349d303984ad8b2284b93082d7b682edd02089d4ddc1f70fe2be6895d8ef895bcc52354bd83e43ff96d5f71feb835c791e4bada0b30e7e6329dd1b90c6962e933676e89025bff857f2920578104d24f81b1f5b67a0cbaa46cc05f579e86992526c187d6e2453f663e0ee18cd68470199abcab6"]}]}, 0x13b8}], 0x8, &(0x7f0000005e80)=[@rights={0x18, 0x1, 0x1, [r11]}, @cred={0x20, 0x1, 0x2, r12, r13, r14}], 0x38}, 0x44) sendmsg$nl_netfilter(r1, &(0x7f0000001d00)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x400}, 0xc, &(0x7f0000001cc0)={&(0x7f0000005f00)={0x230, 0x0, 0xf, 0x8, 0x70bd26, 0x25dfdbfe, {0x7, 0x0, 0x6}, [@nested={0x38, 0x53, [@generic="6f3398b3c3370f173866fd48448bfcd8cea3e906369b35473d0632a6c851731da3d39ee3413db9672f71128a6b9a5560b3e9"]}, @nested={0xe4, 0x18, [@generic="d13e9870b83461fbf51ca2af7852acfc9dc259b0c700d9784628b24a298ee7fa5668ad79d141b982786e46c4661950f1657f666966f49b2e290f6bd1b1", @generic="d3ab386c937946c64f87f50f2cdab4ca8de01aabaceea689248a230e7c9c4bd6ce23f1c6d6c7cf18fa4d4de3556c426e651bef68d2c5bc89188224836753cb1eea6edaf8a04072341490ba47cb7809c6d68b98e972dcc75e77cba121ce7ae30d3095f02932428b9fd3758b6352019b9581bcb9984a4ffad948fb9540a2a545eefcac2d72cbb3782558a0189e2414ce80f13fdc6dde2909caf78bf8d465de6ca763"]}, @generic="1fbad536547ae4a695d86c49f237262ecee50febd1f3856ecca52342666bdbea99f99bbdd4e6fb84e92b166162d2850ffaa0c87130934ddc3426ddce8057f2dc887d82c74866b18627eb86f7dc15d14252c1ca144ecba4919ca45d50873a778554e951144c74bc0c84bf7943cab0c6c83329a8d9fdc56f8635ecd30bbc1fe692bcfa139ea543e68bae474792a2d4186baf405a218412cabc08a963a64f5333bcd01ac65534e339da0aa3282c7c5a4cc8f4d5fb28ada79e268f48dd20fae9cb707171027386856c3ace4f72ddb8c38a9e04efacd2f84c04d03642043145a7dc8bf2833ad0aae5dca49fa170c17bc65605ece1fce2055ce8be93acd97b055a"]}, 0x230}, 0x1, 0x0, 0x0, 0x400c1}, 0x40) 14:03:59 executing program 0: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/ptmx\x00', 0x0, 0x0) r1 = add_key$keyring(&(0x7f0000000040)='keyring\x00', &(0x7f0000000080)={'syz', 0x1}, 0x0, 0x0, 0x0) keyctl$KEYCTL_PKEY_SIGN(0x1b, &(0x7f00000000c0)={r1, 0x1, 0x75a9}, &(0x7f0000000100)={'enc=', 'raw', ' hash=', {'sha512-avx\x00'}}, &(0x7f0000000200)="e9be40a5d70bffdad90d068d41da321c7d7d7896b863e69bdf1cfcfb785e47783dac35617fcaa451f381fe5584eac85608846199b9c5d01fea9ee00e71033902d3bf9a58a2046959c50f387ccc2a63fe51e962a3bd62f1efd1d0312c44b1fc83cf089d61c5e4cb0222b8c8addbab7f6804c78dbaaf14dce1465290b35f", &(0x7f0000000280)=""/106) ioctl$TCSETAF(r0, 0x5408, &(0x7f0000000180)={0x3, 0x80000001, 0xf4, 0x100000000, 0x19, 0x400, 0x6, 0x7, 0xfffffffeffffffff, 0x2}) ioctl$TCFLSH(r0, 0x540b, 0x1) 14:03:59 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, &(0x7f0000000000)) r1 = socket$unix(0x1, 0x5, 0x0) sendto$unix(r1, &(0x7f0000000040)="bf8382636585ad619d4d38cddd28922483d4c0604597ddbf686dccf830f8a011e92053630212a6abcdcebbc120587ae6d0088e8c3c8cdabec16376029b5d247e045a0245eb", 0x45, 0x8001, &(0x7f00000000c0)=@file={0x0, './file0\x00'}, 0x6e) 14:03:59 executing program 1: socket(0x0, 0x0, 0x0) syz_open_procfs(0x0, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$cgroup_int(0xffffffffffffffff, 0x0, 0x2, 0x0) openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x7a05, 0x1700) openat$smack_thread_current(0xffffffffffffff9c, &(0x7f0000000240)='/proc/thread-self/attr/current\x00', 0x2, 0x0) write$cgroup_subtree(0xffffffffffffffff, 0x0, 0x0) ioctl$TCSETAF(0xffffffffffffffff, 0x5408, &(0x7f0000000040)) ioctl$EXT4_IOC_GROUP_ADD(0xffffffffffffffff, 0x40286608, 0x0) ioctl$EVIOCGVERSION(0xffffffffffffffff, 0x80044501, 0x0) 14:03:59 executing program 3: r0 = openat$full(0xffffffffffffff9c, &(0x7f0000000180)='/dev/full\x00', 0x42000, 0x0) ioctl$RTC_PIE_OFF(r0, 0x7006) syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_THREAD_EXIT(r1, 0x40046208, 0x0) openat$urandom(0xffffffffffffff9c, &(0x7f0000000000)='/dev/urandom\x00', 0x200, 0x0) ioctl$sock_inet6_udp_SIOCINQ(r0, 0x541b, &(0x7f0000000040)) ioctl$RNDADDTOENTCNT(r0, 0x40045201, &(0x7f00000002c0)) r2 = openat$zero(0xffffffffffffff9c, &(0x7f0000000140)='/dev/zero\x00', 0x400200, 0x0) ioctl$TIOCMIWAIT(r2, 0x545c, 0x0) lsetxattr$security_smack_entry(&(0x7f0000000200)='./file0\x00', &(0x7f00000000c0)='security.SMACK64IPOUT\x00', &(0x7f00000001c0)='/dev/urandom\x00', 0xd, 0x1) 14:03:59 executing program 5: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0x0, 0x2) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, &(0x7f0000000000)) 14:03:59 executing program 0: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(r0, 0x540b, 0x1) r1 = syz_open_procfs(0x0, &(0x7f0000000000)='net/icmp\x00') ioctl$KDGKBMETA(r0, 0x4b62, &(0x7f00000000c0)) write$FUSE_STATFS(r1, &(0x7f0000000040)={0x60, 0x0, 0x1, {{0x1, 0x40, 0x2, 0x3df3, 0x1f, 0x2, 0x6, 0x100000001}}}, 0x60) 14:03:59 executing program 1: socket(0x0, 0x0, 0x0) syz_open_procfs(0x0, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$cgroup_int(0xffffffffffffffff, 0x0, 0x2, 0x0) openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x7a05, 0x1700) openat$smack_thread_current(0xffffffffffffff9c, &(0x7f0000000240)='/proc/thread-self/attr/current\x00', 0x2, 0x0) write$cgroup_subtree(0xffffffffffffffff, 0x0, 0x0) ioctl$TCSETAF(0xffffffffffffffff, 0x5408, &(0x7f0000000040)) ioctl$EXT4_IOC_GROUP_ADD(0xffffffffffffffff, 0x40286608, 0x0) ioctl$EVIOCGVERSION(0xffffffffffffffff, 0x80044501, 0x0) 14:03:59 executing program 4: socket(0x0, 0x0, 0x0) syz_open_procfs(0x0, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$cgroup_int(0xffffffffffffffff, 0x0, 0x2, 0x0) openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x7a05, 0x1700) openat$smack_thread_current(0xffffffffffffff9c, &(0x7f0000000240)='/proc/thread-self/attr/current\x00', 0x2, 0x0) write$cgroup_subtree(0xffffffffffffffff, 0x0, 0x0) ioctl$TCSETAF(0xffffffffffffffff, 0x5408, &(0x7f0000000040)) ioctl$EXT4_IOC_GROUP_ADD(0xffffffffffffffff, 0x40286608, 0x0) ioctl$EVIOCGVERSION(0xffffffffffffffff, 0x80044501, &(0x7f0000000200)=""/31) 14:03:59 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x800) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) mmap$binder(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x13, r0, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, &(0x7f0000000040)) r1 = mmap$binder(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x7, 0x84030, r0, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, &(0x7f0000000000)={r1}) 14:03:59 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSPTLCK(r0, 0x40045431, &(0x7f0000000180)) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) socket(0x200000000000011, 0x4000000000080002, 0x0) bind$packet(0xffffffffffffffff, 0x0, 0x0) sendmmsg(0xffffffffffffffff, &(0x7f0000007880)=[{{&(0x7f00000001c0)=@l2={0x1f, 0xbf53, {0x9, 0x7, 0xfffffffffffffdd5, 0x1ff, 0x0, 0x4}, 0x0, 0x7}, 0x80, 0x0}}, {{0x0, 0x0, &(0x7f0000007780)}}], 0x2, 0x4048851) setsockopt$packet_int(0xffffffffffffffff, 0x107, 0x0, 0x0, 0x0) syz_open_procfs(0x0, 0x0) ioctl$LOOP_SET_BLOCK_SIZE(0xffffffffffffffff, 0x4c09, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$cgroup_int(0xffffffffffffffff, 0x0, 0x2, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='\x89\x00\x00\x00\x00Ew\x00\x00\x00\xef\xb4\xc8\xd0\xff\xda\xb1vents\xd9\xc5H\xd4\x91\xfdN_]\x16\xe4\xa9C\xd2\x86Qn\xefS\x80\x11J\xfb4\x14\x86 4\x95\x9e\xfc\xc1\a\xcb \x95N\xe9\xa4j\xd2\x1f^\xb0\xb2>\xa3\xc9\xb7$\x11`t\x03: \x8b\xa4\x05\xf2?E\xdb+{t\xb8\xf7\xab\x8b\x100#', 0x26e1, 0x0) ioctl$PERF_EVENT_IOC_PAUSE_OUTPUT(r1, 0x40086602, 0x400007) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000280)='./cgroup/syz0\x00', 0x1ff) openat$smack_thread_current(0xffffffffffffff9c, &(0x7f0000000240)='/proc/thread-self/attr/current\x00', 0x2, 0x0) write$cgroup_subtree(r1, &(0x7f0000000100)=ANY=[], 0xff4a) write$cgroup_subtree(r2, &(0x7f0000000000)=ANY=[], 0x20032600) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a0f, 0x1700) accept$inet(0xffffffffffffffff, &(0x7f0000000040)={0x2, 0x0, @local}, &(0x7f0000000080)=0x10) ioctl$TCSETAF(r0, 0x5408, &(0x7f0000000040)={0x2}) ioctl$EXT4_IOC_GROUP_ADD(r0, 0x40286608, &(0x7f0000000000)={0x3, 0x7000000, 0x400, 0x100000000, 0x0, 0x8}) r3 = fcntl$dupfd(r0, 0x406, r0) ioctl$EVIOCGVERSION(r3, 0x80044501, &(0x7f0000000200)=""/31) write$binfmt_misc(r0, &(0x7f0000000080)={'syz1', "80fa25cdc862d216160cfa92845a3916e38a409a159c03f1889971d3e5144a8d08de78c4b1fbee457437261d7668b1c0f582647ad4134a05358d4309a71a702002329e024cac95642e761bb842bc1056bd6bf12c47697a649a026bd8ee1f685089941469b1ddfeddf32b392f0ff07652a3bce0770bc3bb70862845a65054cecb191e80b825d740fe6b40450359757032425dfdee92aec36ce4b468d50adc745c522cc4af2ac6e7f6a95f0edd70b09caa95fcc7143cf46b74db8bc17fa7c89f"}, 0xc3) 14:03:59 executing program 3: syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f00000001c0)=[@acquire], 0x0, 0x0, 0x0}) ioctl$TIOCGSID(0xffffffffffffffff, 0x5429, &(0x7f0000000180)=0x0) r2 = syz_open_procfs(r1, &(0x7f0000000000)='net/route\x00') r3 = syz_genetlink_get_family_id$tipc(&(0x7f0000000080)='TIPC\x00') sendmsg$TIPC_CMD_GET_BEARER_NAMES(r2, &(0x7f0000000140)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x400}, 0xc, &(0x7f0000000100)={&(0x7f00000000c0)={0x1c, r3, 0xf20, 0x70bd2a, 0x25dfdbfc, {}, ["", ""]}, 0x1c}, 0x1, 0x0, 0x0, 0x4084}, 0x80) 14:03:59 executing program 0: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$VT_WAITACTIVE(r0, 0x5607) ioctl$TCFLSH(r0, 0x540b, 0x1) 14:03:59 executing program 4: socket(0x0, 0x0, 0x0) syz_open_procfs(0x0, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$cgroup_int(0xffffffffffffffff, 0x0, 0x2, 0x0) openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x7a05, 0x1700) openat$smack_thread_current(0xffffffffffffff9c, &(0x7f0000000240)='/proc/thread-self/attr/current\x00', 0x2, 0x0) write$cgroup_subtree(0xffffffffffffffff, 0x0, 0x0) ioctl$TCSETAF(0xffffffffffffffff, 0x5408, &(0x7f0000000040)) ioctl$EXT4_IOC_GROUP_ADD(0xffffffffffffffff, 0x40286608, 0x0) ioctl$EVIOCGVERSION(0xffffffffffffffff, 0x80044501, &(0x7f0000000200)=""/31) 14:03:59 executing program 5: r0 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000040)='/selinux/enforce\x00', 0x542, 0x0) write$apparmor_current(r0, &(0x7f0000000080)=@hat={'permhat ', 0x3, 0x5e, ['\x00', '/dev/binder#\x00', '/dev/binder#\x00', '/dev/binder#\x00']}, 0x43) r1 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) fsetxattr$trusted_overlay_upper(r0, &(0x7f0000000100)='trusted.overlay.upper\x00', &(0x7f0000000140)={0x0, 0xfb, 0x10f, 0x1, 0x9, "9c6324bce3fcdbb8b63f9744ab762646", "e7703ba1da14cfd982e0115d3da8023efd33651ad0af97ebc15a3239babf292329e12a51336f19116ab6ad4a5fee5f50988f92a6e3410bb3074868abff7ae41260578a14a699f74aee3b18d23f2d3ba936a271cc50fd64bf10b9f506b0890a4dabf19861866d827023b3df8666546c65c43196a81e3b45365a961b262b101540599c72d4f6f6a5208020e2f4fbcf87702129113619a9b690066441bbb5687a8a3deecc02a03bc58fe2b294af404007ab886b25ed3abebd721c176f15562e1ec0d6ba34886e30e226adbf42ea818b3a819e05af7f7be20179f5c2c090c37b35739b8f4526ff68dbe8a424764298e46d61ea9a11ce7fb3a68602dc"}, 0x10f, 0xccba356b1b66dac9) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r1, 0xc018620b, &(0x7f0000000000)) 14:03:59 executing program 1: socket(0x0, 0x0, 0x0) syz_open_procfs(0x0, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$cgroup_int(0xffffffffffffffff, 0x0, 0x2, 0x0) openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x7a05, 0x1700) openat$smack_thread_current(0xffffffffffffff9c, &(0x7f0000000240)='/proc/thread-self/attr/current\x00', 0x2, 0x0) write$cgroup_subtree(0xffffffffffffffff, 0x0, 0x0) ioctl$TCSETAF(0xffffffffffffffff, 0x5408, &(0x7f0000000040)) ioctl$EXT4_IOC_GROUP_ADD(0xffffffffffffffff, 0x40286608, 0x0) ioctl$EVIOCGVERSION(0xffffffffffffffff, 0x80044501, 0x0) 14:03:59 executing program 0: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(r0, 0x540b, 0x1) r1 = fcntl$dupfd(r0, 0x406, r0) write$UHID_INPUT2(r1, &(0x7f0000000200)={0xc, 0x1000, "4744829de8e48e508bf6361c02897ada04fe7add1b1a36ca3e4d73c76518549b53a849dc27ac81ac3c623da47c081234fafc5ef095c8e00234805c41b8c805b1e0b0508c503c8259617d3535d0f71f2516f815a2858a5f9198d6fbc2a811c8d4eb4f552ef34692407b84b6c0c8c695b09a0ae9345196f4fa76519110a933c94348578b1ad658920e1b8cd844a622961f944fe42ff1dd67e66189c952e883112c08c98600a6dd0da9f814f349fb343a2bd8e179e9a0321f84baf4ee398c3ef27ed2df02f1108026ce35a466e9787d58b26e68abdf41a6e4cab809bf26e7ca5bea8a3c83a8388d4d6de552c7b7d982025fefd2cc1dbecdb948e9eef45648a57386de7eeb8aab48913c50c8f5864a045701c2bb7e5d7945789dd0b14cb2c065b7a175a7fc2ea5a6b7fe479acd1bb2e42fd5f9f8bb47dee7dc4871d8efee557512af755cf9fd68e3b7ec528ee97d833f28d61d5d9a0eccf5148d583c56433c5d38f9583375931a1b42c27834b518bfa38a271b638d026355c55ce5cd7838bf1e4b7f78f0126d96eb4fbacb953b2ff0b8a4cd7c4a2a4bb42ffb97787551e77d22eec18293a1cd91949ac9d8515b998315c8c2298c988e9e07a2f175fb37ac11a910e6aa41e641765ae134619c3a41c9409ddd373d16ab391a5a28ef3c82b6b1fd137a54714a6ff5aa217e5c25ca46d56884106e160e5118f3989f35f597c2f8a00a615fc1851f6426c78fd4ae0f1fb3abe7775be9f32d7287f63094202d5e25c0f4a5f47c7e7689f28bcb883ddf8ac8c8c593920a4fa48a39c4bc13079884d71a3d5e86995d63ed078ef8955caa73380dff950950524a5ff97ae730e10e1f9d66e0701a9ffb82f35b46a0838f5858cdb7373cf7d21191ad51e58010ecfb1b30133fddd06440b4aee50102be2272f440d153467cd7e1a83676ed843b27d7f3f7f669857dccd77a8837885c14adaa22df9c4704b998352757f02633a0d41403ab4ce9b3127fba8cd530481e752bbb0072a759aaf0937537d76b555885f2ace4749383e635c357ed04cb2875b4c88128d8481ca8ca38a03b4c5d9183072577b2cae6958dd9f417b52e259c91b4283f93f632cbe342d9aa255184ab8184c3e89c5ea52aba575eda03ad99552cd4fa0aa5dc7d72620ea05bc01d6dbd44d54763c65424b24fd015b38732d8a6a90fdabf7107d97a2d3053b71c30a64f78e689b2f218ac93de14f5dbfd92f036cbaf26685824f568a32b99fc75c86bf81751cf4219be8459ade4f401b63765502d1bdd07ae005fe938d58cab1e9c8b2d73daad10c7695281c8a276d5498bee623f1225a45b3320cc86e218dba4709cc4e1996af1e77f1896a0382f2b4f429ab39e6756ecd3a7357404179f811ee19a8c2debed637a1ebe27d29b03010c23272620eec1219c9c1960ff315f0f0c1dff62a1eb06affe4ac7099f3b6b0631d0e7276ad563bffbc892a9be1a7282b6bdd116118debd5513c07187524281b218033b80c1dbe04b1dcfc8362f86e09141e08c1456857b1bba3f0f8c7d3580f516b3eeb19699f8e382fd9342065de66cb7aca77dc9fa79cb711123adaeeb6721b43f7362426f5a9659e0023efc707234e848920caecdd848d19189a5c1faa0f856753378154315a0ae28317ebb833998ceffc226334b361dfc93dbe70d233ef98262a83c2cf842149d569e88b18f5c0344305d59321214442c21490e726de9aceffb73c4870f2c3be9eb7558e7249c0d9a1281bc38b63711de7e613446958543003e39c4b4f5de2a34c7104a3a97cab378210ab6147c5b51993069edecc08d99743a55c774e96288f9b92ccc23770925e21f61ac73ee9666a47b145bb3dd4fe57e605ef8c3d48eb48f895b209089a60f28dd58b3dfecaa378445fe2b8254f5b0ee0477e760dea7f8a03c099c20073935caefdc2f33ee152581fc4660e157d9495f1175c2c05df3a93eadcf57db498dbc4a0ee79bae70e91070ac8bb7a4da20bd1e7dab5f5c4f683610b8c7aa9fd7a6b2cf224980cc9b7f8ae2e95d2e7006bbbcb6496a6323df32569b8446aefc3894f203f75a2694c827739f56847fc81f4f2532479d085b9897a68372ab7bc8022536239f8ce8e18b20c8243f765398273fff83ef15536a09311727dd01ee8d01476f0bb305677f960254bf6ce3aa7197ec53626e550be86ec21e8395f8d81f6a8ad4a330887f6e1407da8a7313204f163c0d5f8d495821e2abc0da0bbb65d5bbef3e0f27333da79a0c20a061f684d0c09a68319b3f579fe20674091a55f1317355b790e43e8697dbde9ca510c60d42d07a56343d6679756fedc1beac8828180983352660828e917da30769a03511aa5cfba5cf758fa9779ebc06d038d2bb3e857b629d9a91f1d4c75b1265103544e010cccd66bde3e02ac57f0278762b638c667373696dc7246d9daab367bf31e59a535a592187699c95ef5e7153a19580f03a44277dd4543bd623e179380d287d66790a8bbb6707a22bf72bcee065ae21d6d1cffeff461548aea0272dbaf3b40f01bc0ad9c1a3ff326fc1aa9fab5df59529cdab2093bfb7972dfcb2ee3fcca47b3609176ad017050f7e8a5fe1c60fcc0a44db13c61fd149720e58f48a4f3b3ff1fb5afeff6c48fbf83385b440f7c0ac211c9b7412994c4153d3fb43afa4630832c1cf1cc9f1f6aba37ffa54c845c1ecf9745c065c65a5e9da580bc6923cc3084bf557fef1a57559466320222280c4c0c5ab505c247328395f9611c6405cde54651024465967057202c08ccffb5e7eac654c295687ad42dd17de3ffb00febee70cbb55bfd294ef3087725136d95137170d3f181fa4581923081d7f0fcf2def594a5b10f752a51923a08b3e59f2320fb7c8451d2bd9ae04f7d43d9b821eb83d842e38828e764869b93927d0f6b2b1f1a2a047a6be0ed12bda83fa873549f63fcdbda468f2ed7820c8032fc5934660eb486c7d6b3f3b0a5cfff69aaf5274213c53642184da97b52534a38b3f701c574129cd0342ca0ab271b07b9e35da73bddb6b2dc908eed680ee5839c29609c7459d3b179d4ca3bffa7a6609b777d4ef4b68e22c0fa06955e9befe0bbd03dca09df828ddf7e4860e28d8b300e06f40c2947759918645b89dbfa28fd9419c85cf5aa2df95d865ebe73d958c09deaf19651c247bff35c67f9ac503bc4287bbf1a9ad86d6ff163e8ad633177dc1f51558a0898658b16a3acddf19d7b29aa6c985e008009a87dfc68384ed371b0877d650cf126744a7d911da928791e51299ac9dfa94d3911094bc05f7e41f8e16c6c2846e71e3e73d03a1ffef963ac86073490898eb8bb0bdf7f89070b1cc6c9e37113edb538958aed577e6faa2120f2bfdb66e32d9cf6e3a35f183c9edca7dd353a26d2b101b502b790e1c9bbea1a4103d38d585c1a37094eb743972963885862675744993ea187110a4a773d70f89d49417699aef176337072366793723310c64b19e1bdbddfa2438f6d3f24714d0e686a4b0489330a8763cfa6851da010653c4854c3a3262d59164f52fedddd938fc0433676f36f91df05b4c12e530beee145e5e4e3e6cb5c2dc571530205b9c6dd0e22747e9755a4c0401b65f3107533758bc6d09e2be6c65aabc161fea9a6f39eb8547d1af4dcecc90c13f9987d564a9b35284ad9cb98be05c76448e9ad7149700780dabe59588f12655134657f8b942d5ef8318367834c61bdeef5b3589e57ce7dc811360eb1b41adcbf15194ffa9e63cb77fc526706dfd96bcc467dc23a70395b44a551f2cc2cba7c2370cedb789259ea77282cbc59f61150dee61b1a36e4ba54bc9cbd524dc4685dc5fefb1d0d6f61473e68b8ac7427b94cbd1cb2bae6bd6bc4bd4ddf56cf5aafd66f301866407906f2c61186e13fe6e718f1bd0e940323ac8e9de5c81d77d7a72de08b52a5833e2f073d912b2d829251d90b4920ca43ebaab282afeec369583cab0ed1359090ead4e3032f9dc60defbd249ca541ee3872c88e5423c64958df24e00980d5d801679188aaeacfdc3b9ce025740da6e9b91b7216f543e5b13807b069af12ab1b244d69c25c0be356bfe3a5b5112f2603fbb53e9af7563204712cc95d25274387ca4edf4ce2d5035d83fb32abf9693d926d4cc8fe9556a69fa118e9252c2cc5bebb1bdca5838b8c703040fcf49c21693287ff9a8e7b01b6e57865d691d9e5f238e000c72c68aa51f6e8d8b2c0dc34a91c3dff2e3dae229655a357ca1865faba8e61c4f2a5ea90ffe00cd21240b738eb0280827cda801f6ea11848349f5b89e7711c5b8613e6e17f06befee9b17857c8c29d2188707dd6401ca4b602c41072dc92fd54b2f6cb636daca30b9ccb184df6a7dd9f533e2f07b8d1d094528dca21c2e2fe9eaf11e217c7ed77b2f67433075db36b9127d4bf20de3f6e1ba194e7a360b1d89a6057fbd92ab00d65cd21bcb21765e1015c8c36daa338fb7f24c11b053f9b367040056b958218cbcbd78bbf23d0ea7a680633cafcc9df4a4c0846a592e694dc0981f1496e223e5ea6df4e6d15d936082b235d8041e5e5ff43a64d2802a1f5c6b55d92c0fe693a32d922c5868d3e908faf7d903d9eb802ab03b572d5f584a3bba0caa53a00899c357dc3975fe3bdf4fe9a1f374b3c82cb0cc64f35b186136495da6cf402addcc8972a98138677a41d56d7af42afa434cdcb265cafb07374d532ff69c6d93583b4435d02c0e0c32dc35069186f43aaba3d0653e20bfb31b43720e4921950b5e9f7b7b8ac444ad8b5c606aa2c4cf6aa343ec51edfd6ff85ade1f29b986566ea4d60d1c0f5acde086da49d824de307ea9c93094a11dcf3f243a84fb6e560bbd4a0b027b9a3c0665df3780efeff952832dedbf8f0ace10b95fbd2510cf0b11e99d9057c2b727c534b7b9faf4f1f76342e205b460f0f8f601930fe8471ee7f696398a4c9a5f8b77c4e059caa044f54e9f203da66fc3747ecca1408de6ffb5f6540fc3bfedeaeaedb1387f1ef849e60fce0a02bb41ea2efc324a17910db40a3c2d8acb30c08baec571bb89b633069e7f6b992542d6ebb71f878af851d1e0317ec019b1da67de738e45990b1d4613c18e86f8a260c0e7668bb9b528e87420f0300428bc60f18939a43e73435b99dbe1239bf570140ec5808ce314ad2218cbe132e76b1f23daed0582dc7484b037a0b163ca606f116d484051fbb9b6af94f7818477496409fa515292aea9a2147a2f5146873a671457a466ee2293ff116bd0fe2acf01f568dee64dfe96948676479e0afd1fcd847201dc05a20b4fd533a10a71b505edf2dc11331cc41777f1200e1fd255a0d9b9424ed6614bdbcea3b0cea09bbea6c0bcea63e88f76bbdb48e71e5a2c65c2f20478806245441c1a764fa7176e8ce1e1effd1936c0f059d5ba9a53339c0e5a8bdacf7b256e2eef8107f51c1c32ae65ff4c42e503342fe36083f349aae40b6a50446205befbd2e68fc4c519f067619720bc0a3cfa5d64b78905129a67a5a3f830e978c5f4e4420574bc9102592c1bf1587ee2cd8ffde7f724fa0a9d1cf6eb763437c19995e80cca19d7a4a6c40e44bc05b494f199464c84d7eebd412bfbcc301b19d9381b1115bde21ba05d9bc46ca516b5d2af1be914798ef469c420a068de12ee4746dc46365964b3a03fddf469a1f5caa0715ca9e628d599ad688f3ae05edf2e978d2ef24bf8520cec9e541b9f9fbbec34dc8aecd71b034f83a0c8032edc84703be531f948c6790069b6197c06035349c72fb8378a0bd6157b41ae7ab16ee79640ee122cd29369bdf1b93b3a3247d4c8751ef6ad3"}, 0x1006) 14:03:59 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, &(0x7f0000000000)) r1 = gettid() r2 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/enforce\x00', 0x8000, 0x0) ioctl$IOC_PR_RESERVE(r2, 0x401070c9, &(0x7f0000000100)={0x1, 0x4}) getpeername$packet(0xffffffffffffffff, &(0x7f00000001c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000200)=0x14) ioctl$TUNSETIFINDEX(r2, 0x400454da, &(0x7f0000000240)=r3) perf_event_open(&(0x7f0000000040)={0x0, 0x70, 0x8, 0x3, 0x3, 0x8, 0x0, 0x9, 0x0, 0x0, 0x4, 0x1, 0x8, 0x7, 0x0, 0x1ff, 0x401, 0x1, 0x8, 0x602cc819, 0x4, 0x97, 0x7, 0x7fffffff, 0x85, 0x7, 0xff, 0x7, 0xd, 0x6, 0x1, 0xfffffffffffffe00, 0xfffffffffffffffd, 0xd6, 0x80000001, 0x8, 0x0, 0x7, 0x0, 0x914, 0x2, @perf_config_ext={0x400, 0x6c4}, 0x10, 0x101, 0x10001, 0x6, 0x1, 0x1, 0x3}, r1, 0xffffffffffffffff, r0, 0x0) [ 346.157981] binder: 11948:11952 Acquire 1 refcount change on invalid ref 0 ret -22 14:03:59 executing program 3: syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x800) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x401000000801, 0x0) close(r0) r1 = syz_open_procfs(0x0, &(0x7f0000000000)='comm\x00') r2 = open(&(0x7f0000000100)='./bus\x00', 0x4c8001, 0xfffffffffffff7ff) ftruncate(r2, 0x2007fff) sendfile(r1, r1, 0x0, 0x8000fffffffe) r3 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f00000001c0)=[@acquire], 0x0, 0x0, 0x0}) r4 = openat$selinux_mls(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/mls\x00', 0x0, 0x0) open(&(0x7f0000000140)='./bus\x00', 0x410000, 0x4) ioctl$PERF_EVENT_IOC_QUERY_BPF(r4, 0xc008240a, &(0x7f0000000040)={0x6, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}) r5 = pkey_alloc(0x0, 0x1) pkey_free(r5) 14:03:59 executing program 4: socket(0x0, 0x0, 0x0) syz_open_procfs(0x0, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$cgroup_int(0xffffffffffffffff, 0x0, 0x2, 0x0) openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x7a05, 0x1700) openat$smack_thread_current(0xffffffffffffff9c, &(0x7f0000000240)='/proc/thread-self/attr/current\x00', 0x2, 0x0) write$cgroup_subtree(0xffffffffffffffff, 0x0, 0x0) ioctl$TCSETAF(0xffffffffffffffff, 0x5408, &(0x7f0000000040)) ioctl$EXT4_IOC_GROUP_ADD(0xffffffffffffffff, 0x40286608, 0x0) ioctl$EVIOCGVERSION(0xffffffffffffffff, 0x80044501, &(0x7f0000000200)=""/31) 14:03:59 executing program 1: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSPTLCK(r0, 0x40045431, &(0x7f0000000180)) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) socket(0x200000000000011, 0x4000000000080002, 0x0) bind$packet(0xffffffffffffffff, 0x0, 0x0) sendmmsg(0xffffffffffffffff, &(0x7f0000007880)=[{{&(0x7f00000001c0)=@l2={0x1f, 0xbf53, {0x9, 0x7, 0xfffffffffffffdd5, 0x1ff, 0x0, 0x4}, 0x0, 0x7}, 0x80, 0x0}}, {{0x0, 0x0, &(0x7f0000007780)}}], 0x2, 0x4048851) setsockopt$packet_int(0xffffffffffffffff, 0x107, 0x0, 0x0, 0x0) syz_open_procfs(0x0, 0x0) ioctl$LOOP_SET_BLOCK_SIZE(0xffffffffffffffff, 0x4c09, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$cgroup_int(0xffffffffffffffff, 0x0, 0x2, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='\x89\x00\x00\x00\x00Ew\x00\x00\x00\xef\xb4\xc8\xd0\xff\xda\xb1vents\xd9\xc5H\xd4\x91\xfdN_]\x16\xe4\xa9C\xd2\x86Qn\xefS\x80\x11J\xfb4\x14\x86 4\x95\x9e\xfc\xc1\a\xcb \x95N\xe9\xa4j\xd2\x1f^\xb0\xb2>\xa3\xc9\xb7$\x11`t\x03: \x8b\xa4\x05\xf2?E\xdb+{t\xb8\xf7\xab\x8b\x100#', 0x26e1, 0x0) ioctl$PERF_EVENT_IOC_PAUSE_OUTPUT(r1, 0x40086602, 0x400007) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000280)='./cgroup/syz0\x00', 0x1ff) openat$smack_thread_current(0xffffffffffffff9c, &(0x7f0000000240)='/proc/thread-self/attr/current\x00', 0x2, 0x0) write$cgroup_subtree(r1, &(0x7f0000000100)=ANY=[], 0xff4a) write$cgroup_subtree(r2, &(0x7f0000000000)=ANY=[], 0x20032600) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a0f, 0x1700) accept$inet(0xffffffffffffffff, &(0x7f0000000040)={0x2, 0x0, @local}, &(0x7f0000000080)=0x10) ioctl$TCSETAF(r0, 0x5408, &(0x7f0000000040)={0x2}) ioctl$EXT4_IOC_GROUP_ADD(r0, 0x40286608, &(0x7f0000000000)={0x3, 0x7000000, 0x400, 0x100000000, 0x0, 0x8}) r3 = fcntl$dupfd(r0, 0x406, r0) ioctl$EVIOCGVERSION(r3, 0x80044501, &(0x7f0000000200)=""/31) write$binfmt_misc(r0, &(0x7f0000000080)={'syz1', "80fa25cdc862d216160cfa92845a3916e38a409a159c03f1889971d3e5144a8d08de78c4b1fbee457437261d7668b1c0f582647ad4134a05358d4309a71a702002329e024cac95642e761bb842bc1056bd6bf12c47697a649a026bd8ee1f685089941469b1ddfeddf32b392f0ff07652a3bce0770bc3bb70862845a65054cecb191e80b825d740fe6b40450359757032425dfdee92aec36ce4b468d50adc745c522cc4af2ac6e7f6a95f0edd70b09caa95fcc7143cf46b74db8bc17fa7c89f"}, 0xc3) 14:03:59 executing program 0: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/ptmx\x00', 0x0, 0x0) r1 = dup2(r0, r0) r2 = syz_genetlink_get_family_id$tipc(&(0x7f0000000200)='TIPC\x00') sendmsg$TIPC_CMD_SHOW_PORTS(r1, &(0x7f00000002c0)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x8000}, 0xc, &(0x7f0000000280)={&(0x7f0000000240)={0x1c, r2, 0x1, 0x70bd2c, 0x25dfdbfc, {}, ["", "", ""]}, 0x1c}, 0x1, 0x0, 0x0, 0x4004000}, 0xc005) r3 = socket(0x2, 0x80001, 0xffffffff) r4 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000080)='IPVS\x00') sendmsg$IPVS_CMD_GET_DAEMON(r3, &(0x7f0000000140)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x2080010}, 0xc, &(0x7f0000000100)={&(0x7f00000000c0)={0x2c, r4, 0x420, 0x70bd27, 0x25dfdbfc, {}, [@IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0x1}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5, 0x6}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x8}]}, 0x2c}, 0x1, 0x0, 0x0, 0xc805}, 0x5e3c8eff06ca8336) ioctl$KDSETKEYCODE(r0, 0x4b4d, &(0x7f0000000000)={0x7f, 0x100}) ioctl$TCFLSH(r0, 0x540b, 0x1) 14:03:59 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSPTLCK(r0, 0x40045431, &(0x7f0000000180)) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) socket(0x200000000000011, 0x4000000000080002, 0x0) bind$packet(0xffffffffffffffff, 0x0, 0x0) sendmmsg(0xffffffffffffffff, &(0x7f0000007880)=[{{&(0x7f00000001c0)=@l2={0x1f, 0xbf53, {0x9, 0x7, 0xfffffffffffffdd5, 0x1ff, 0x2}, 0x0, 0x7}, 0x80, 0x0}}, {{0x0, 0x0, &(0x7f0000007780)}}], 0x2, 0x4048851) setsockopt$packet_int(0xffffffffffffffff, 0x107, 0x0, 0x0, 0x0) syz_open_procfs(0x0, 0x0) ioctl$LOOP_SET_BLOCK_SIZE(0xffffffffffffffff, 0x4c09, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$cgroup_int(0xffffffffffffffff, 0x0, 0x2, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='\x89\x00\x00\x00\x00Ew\x00\x00\x00\xef\xb4\xc8\xd0\xff\xda\xb1vents\xd9\xc5H\xd4\x91\xfdN_]\x16\xe4\xa9C\xd2\x86Qn\xefS\x80\x11J\xfb4\x14\x86 4\x95\x9e\xfc\xc1\a\xcb \x95N\xe9\xa4j\xd2\x1f^\xb0\xb2>\xa3\xc9\xb7$\x11`t\x03: \x8b\xa4\x05\xf2?E\xdb+{t\xb8\xf7\xab\x8b\x100#', 0x26e1, 0x0) ioctl$PERF_EVENT_IOC_PAUSE_OUTPUT(r1, 0x40086602, 0x400007) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000280)='./cgroup/syz0\x00', 0x1ff) openat$smack_thread_current(0xffffffffffffff9c, &(0x7f0000000240)='/proc/thread-self/attr/current\x00', 0x2, 0x0) write$cgroup_subtree(r1, &(0x7f0000000100)=ANY=[], 0xff4a) write$cgroup_subtree(r2, &(0x7f0000000000)=ANY=[], 0x20032600) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a0f, 0x1700) accept$inet(0xffffffffffffffff, &(0x7f0000000040)={0x2, 0x0, @local}, &(0x7f0000000080)=0x10) ioctl$TCSETAF(r0, 0x5408, &(0x7f0000000040)={0x2}) ioctl$EXT4_IOC_GROUP_ADD(r0, 0x40286608, &(0x7f0000000000)={0x3, 0x7000000, 0x400, 0x100000000, 0x0, 0x8}) r3 = fcntl$dupfd(r0, 0x406, r0) ioctl$EVIOCGVERSION(r3, 0x80044501, &(0x7f0000000200)=""/31) write$binfmt_misc(r0, &(0x7f0000000080)={'syz1', "80fa25cdc862d216160cfa92845a3916e38a409a159c03f1889971d3e5144a8d08de78c4b1fbee457437261d7668b1c0f582647ad4134a05358d4309a71a702002329e024cac95642e761bb842bc1056bd6bf12c47697a649a026bd8ee1f685089941469b1ddfeddf32b392f0ff07652a3bce0770bc3bb70862845a65054cecb191e80b825d740fe6b40450359757032425dfdee92aec36ce4b468d50adc745c522cc4af2ac6e7f6a95f0edd70b09caa95fcc7143cf46b74db8bc17fa7c89f"}, 0xc3) 14:03:59 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = getpgid(0xffffffffffffffff) fcntl$lock(r0, 0x6, &(0x7f0000000040)={0x0, 0x0, 0x5, 0x9, r1}) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, &(0x7f0000000000)) 14:03:59 executing program 4: socket(0x0, 0x0, 0x0) syz_open_procfs(0x0, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$cgroup_int(0xffffffffffffffff, 0x0, 0x2, 0x0) openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x7a05, 0x1700) openat$smack_thread_current(0xffffffffffffff9c, &(0x7f0000000240)='/proc/thread-self/attr/current\x00', 0x2, 0x0) write$cgroup_subtree(0xffffffffffffffff, 0x0, 0x0) ioctl$TCSETAF(0xffffffffffffffff, 0x5408, &(0x7f0000000040)) ioctl$EXT4_IOC_GROUP_ADD(0xffffffffffffffff, 0x40286608, 0x0) 14:03:59 executing program 0: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(r0, 0x540b, 0x1) 14:03:59 executing program 1: socket(0x0, 0x0, 0x0) r0 = syz_open_procfs(0x0, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$cgroup_int(0xffffffffffffffff, 0x0, 0x2, 0x0) openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x7a05, 0x1700) openat$smack_thread_current(0xffffffffffffff9c, &(0x7f0000000240)='/proc/thread-self/attr/current\x00', 0x2, 0x0) write$cgroup_subtree(0xffffffffffffffff, 0x0, 0x0) setsockopt$packet_tx_ring(r0, 0x107, 0xd, &(0x7f0000000000)=@req3={0x3, 0x3, 0x1, 0x9, 0x3, 0x3, 0x338}, 0x1c) ioctl$TCSETAF(0xffffffffffffffff, 0x5408, &(0x7f0000000040)) ioctl$EXT4_IOC_GROUP_ADD(0xffffffffffffffff, 0x40286608, 0x0) ioctl$EVIOCGVERSION(0xffffffffffffffff, 0x80044501, 0x0) [ 346.337454] binder: 11977:11981 Acquire 1 refcount change on invalid ref 0 ret -22 14:03:59 executing program 3: syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0x0, 0x2) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f00000001c0)=[@acquire], 0x0, 0x0, 0x0}) 14:03:59 executing program 5: pipe2(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}, 0x84000) ioctl$PERF_EVENT_IOC_PERIOD(r0, 0x40082404, &(0x7f0000000080)=0x3) r1 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) prctl$PR_SVE_GET_VL(0x33, 0x4000000112f2) ioctl$BINDER_GET_NODE_DEBUG_INFO(r1, 0xc018620b, &(0x7f0000000000)) 14:03:59 executing program 0: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$KDGKBLED(r0, 0x4b64, &(0x7f0000000040)) r1 = dup2(r0, r0) setsockopt$inet6_udp_int(r1, 0x11, 0x67, &(0x7f0000000080)=0x9, 0x4) r2 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(r2, 0x540b, 0x1) 14:03:59 executing program 4: socket(0x0, 0x0, 0x0) syz_open_procfs(0x0, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$cgroup_int(0xffffffffffffffff, 0x0, 0x2, 0x0) openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x7a05, 0x1700) openat$smack_thread_current(0xffffffffffffff9c, &(0x7f0000000240)='/proc/thread-self/attr/current\x00', 0x2, 0x0) write$cgroup_subtree(0xffffffffffffffff, 0x0, 0x0) ioctl$TCSETAF(0xffffffffffffffff, 0x5408, &(0x7f0000000040)) 14:03:59 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) pipe2(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80800) ioctl$PPPIOCSACTIVE(r1, 0x40107446, &(0x7f00000000c0)={0x3, &(0x7f0000000080)=[{0x6, 0xffffffffffffff40, 0x9, 0x6}, {0xffffffffffffffff, 0x1, 0x3, 0x1a3}, {0x0, 0x1f, 0x2, 0x7}]}) ioctl$VT_RESIZE(r1, 0x5609, &(0x7f0000000100)={0x0, 0x8000, 0x2}) openat$smack_thread_current(0xffffffffffffff9c, &(0x7f0000000140)='/proc/thread-self/attr/current\x00', 0x2, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, &(0x7f0000000000)) [ 346.448261] binder: 12016:12022 Acquire 1 refcount change on invalid ref 0 ret -22 14:04:00 executing program 0: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(r0, 0x540b, 0xfffffffffffffff8) r1 = dup(r0) ioctl$TCGETS(r1, 0x5401, &(0x7f0000000180)) getsockopt$inet_mreqn(r1, 0x0, 0x24, &(0x7f0000000080)={@multicast2, @rand_addr, 0x0}, &(0x7f00000000c0)=0xc) ioctl$sock_inet6_SIOCSIFADDR(r1, 0x8916, &(0x7f0000000100)={@initdev={0xfe, 0x88, [], 0x0, 0x0}, 0x49, r2}) setsockopt$inet6_opts(r1, 0x29, 0x37, &(0x7f0000000540)=ANY=[@ANYBLOB="2c0a0405c070ffff0000000000000000ec00000000000000e76f1798069029492e5f6d2b076deca0000000000000000000000000000000000000000000000000000000000000000100aad6a9a511e2fc9e9b5f968a36fd9c"], 0x58) 14:04:00 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, &(0x7f0000000000)) syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0x0, 0x0) [ 346.490307] binder: 12016:12035 Acquire 1 refcount change on invalid ref 0 ret -22 14:04:00 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSPTLCK(r0, 0x40045431, &(0x7f0000000180)) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) socket(0x200000000000011, 0x4000000000080002, 0x0) bind$packet(0xffffffffffffffff, 0x0, 0x0) sendmmsg(0xffffffffffffffff, &(0x7f0000007880)=[{{&(0x7f00000001c0)=@l2={0x1f, 0xbf53, {0x9, 0x7, 0xfffffffffffffdd5, 0x1ff, 0x2}, 0x0, 0x7}, 0x80, 0x0}}, {{0x0, 0x0, &(0x7f0000007780)}}], 0x2, 0x4048851) setsockopt$packet_int(0xffffffffffffffff, 0x107, 0x0, 0x0, 0x0) syz_open_procfs(0x0, 0x0) ioctl$LOOP_SET_BLOCK_SIZE(0xffffffffffffffff, 0x4c09, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$cgroup_int(0xffffffffffffffff, 0x0, 0x2, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='\x89\x00\x00\x00\x00Ew\x00\x00\x00\xef\xb4\xc8\xd0\xff\xda\xb1vents\xd9\xc5H\xd4\x91\xfdN_]\x16\xe4\xa9C\xd2\x86Qn\xefS\x80\x11J\xfb4\x14\x86 4\x95\x9e\xfc\xc1\a\xcb \x95N\xe9\xa4j\xd2\x1f^\xb0\xb2>\xa3\xc9\xb7$\x11`t\x03: \x8b\xa4\x05\xf2?E\xdb+{t\xb8\xf7\xab\x8b\x100#', 0x26e1, 0x0) ioctl$PERF_EVENT_IOC_PAUSE_OUTPUT(r1, 0x40086602, 0x400007) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000280)='./cgroup/syz0\x00', 0x1ff) openat$smack_thread_current(0xffffffffffffff9c, &(0x7f0000000240)='/proc/thread-self/attr/current\x00', 0x2, 0x0) write$cgroup_subtree(r1, &(0x7f0000000100)=ANY=[], 0xff4a) write$cgroup_subtree(r2, &(0x7f0000000000)=ANY=[], 0x20032600) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a0f, 0x1700) accept$inet(0xffffffffffffffff, &(0x7f0000000040)={0x2, 0x0, @local}, &(0x7f0000000080)=0x10) ioctl$TCSETAF(r0, 0x5408, &(0x7f0000000040)={0x2}) ioctl$EXT4_IOC_GROUP_ADD(r0, 0x40286608, &(0x7f0000000000)={0x3, 0x7000000, 0x400, 0x100000000, 0x0, 0x8}) r3 = fcntl$dupfd(r0, 0x406, r0) ioctl$EVIOCGVERSION(r3, 0x80044501, &(0x7f0000000200)=""/31) write$binfmt_misc(r0, &(0x7f0000000080)={'syz1', "80fa25cdc862d216160cfa92845a3916e38a409a159c03f1889971d3e5144a8d08de78c4b1fbee457437261d7668b1c0f582647ad4134a05358d4309a71a702002329e024cac95642e761bb842bc1056bd6bf12c47697a649a026bd8ee1f685089941469b1ddfeddf32b392f0ff07652a3bce0770bc3bb70862845a65054cecb191e80b825d740fe6b40450359757032425dfdee92aec36ce4b468d50adc745c522cc4af2ac6e7f6a95f0edd70b09caa95fcc7143cf46b74db8bc17fa7c89f"}, 0xc3) 14:04:00 executing program 0: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x82000, 0x0) ioctl$TCFLSH(r0, 0x540b, 0x1) ioctl$TIOCGSID(r0, 0x5429, &(0x7f0000000040)) 14:04:00 executing program 4: socket(0x0, 0x0, 0x0) syz_open_procfs(0x0, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$cgroup_int(0xffffffffffffffff, 0x0, 0x2, 0x0) openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x7a05, 0x1700) openat$smack_thread_current(0xffffffffffffff9c, &(0x7f0000000240)='/proc/thread-self/attr/current\x00', 0x2, 0x0) write$cgroup_subtree(0xffffffffffffffff, 0x0, 0x0) 14:04:00 executing program 3: r0 = bpf$OBJ_GET_PROG(0x7, &(0x7f0000000040)={&(0x7f0000000000)='./file0\x00', 0x0, 0x10}, 0x10) pread64(r0, &(0x7f0000000200)=""/220, 0xdc, 0x0) syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) openat$selinux_policy(0xffffffffffffff9c, &(0x7f0000000100)='/selinux/policy\x00', 0x0, 0x0) r1 = syz_open_dev$binder(0x0, 0x0, 0x800) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f00000001c0)=[@acquire], 0x0, 0x0, 0x0}) 14:04:00 executing program 1: socket(0x0, 0x0, 0x0) r0 = syz_open_procfs(0x0, 0x0) clock_gettime(0x0, &(0x7f0000000080)={0x0, 0x0}) futimesat(r0, &(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)={{r1, r2/1000+30000}}) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$cgroup_int(0xffffffffffffffff, 0x0, 0x2, 0x0) openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x7a05, 0x1700) openat$smack_thread_current(0xffffffffffffff9c, &(0x7f0000000240)='/proc/thread-self/attr/current\x00', 0x2, 0x0) write$cgroup_subtree(0xffffffffffffffff, 0x0, 0x0) ioctl$TCSETAF(0xffffffffffffffff, 0x5408, &(0x7f0000000040)) ioctl$EXT4_IOC_GROUP_ADD(0xffffffffffffffff, 0x40286608, 0x0) ioctl$EVIOCGVERSION(0xffffffffffffffff, 0x80044501, 0x0) 14:04:00 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, &(0x7f0000000000)) 14:04:00 executing program 4: socket(0x0, 0x0, 0x0) syz_open_procfs(0x0, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$cgroup_int(0xffffffffffffffff, 0x0, 0x2, 0x0) openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x7a05, 0x1700) openat$smack_thread_current(0xffffffffffffff9c, &(0x7f0000000240)='/proc/thread-self/attr/current\x00', 0x2, 0x0) write$cgroup_subtree(0xffffffffffffffff, 0x0, 0x0) 14:04:00 executing program 1: socket(0x0, 0x0, 0x0) syz_open_procfs(0x0, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$cgroup_int(0xffffffffffffffff, 0x0, 0x2, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x7a05, 0x1700) openat$smack_thread_current(0xffffffffffffff9c, &(0x7f0000000240)='/proc/thread-self/attr/current\x00', 0x2, 0x0) write$cgroup_subtree(0xffffffffffffffff, 0x0, 0x0) ioctl$EXT4_IOC_GROUP_ADD(0xffffffffffffffff, 0x40286608, 0x0) inotify_init() write$smack_current(r0, &(0x7f0000000040)='$vmnet1\x00', 0x8) ioctl$EVIOCGVERSION(0xffffffffffffffff, 0x80044501, 0x0) 14:04:00 executing program 0: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x10000000, 0x0) ioctl$TCSETAW(r0, 0x5407, &(0x7f0000000000)={0x9, 0x2, 0x6, 0x3977, 0x8, 0x7, 0x80000001, 0x5, 0x3f}) ioctl$TCFLSH(r0, 0x540b, 0x1) 14:04:00 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, &(0x7f0000000000)) r1 = geteuid() getsockopt$inet_IP_XFRM_POLICY(0xffffffffffffffff, 0x0, 0x11, &(0x7f00000000c0)={{{@in=@initdev, @in6=@dev, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6}, 0x0, @in=@broadcast}}, &(0x7f00000001c0)=0xe8) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000200)={0x0, 0x0, 0x0}, &(0x7f0000000240)=0xc) getgroups(0x7, &(0x7f0000000280)=[0xee00, 0x0, 0xee01, 0xee00, 0xee00, 0xee01, 0xee01]) lstat(&(0x7f00000002c0)='./file0\x00', &(0x7f0000000300)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) lsetxattr$system_posix_acl(&(0x7f0000000040)='./file0\x00', &(0x7f0000000080)='system.posix_acl_access\x00', &(0x7f0000000380)={{}, {0x1, 0x5}, [{0x2, 0x6, r1}, {0x2, 0x0, r2}], {0x4, 0x2}, [{0x8, 0x2, r3}, {0x8, 0x2, r4}, {0x8, 0x2, r5}], {0x10, 0x7}, {0x20, 0x2}}, 0x4c, 0x2) 14:04:00 executing program 0: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/ptmx\x00', 0x0, 0x0) mmap(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x8, 0x12, r0, 0x0) ioctl$TCFLSH(r0, 0x540b, 0x1) 14:04:00 executing program 4: socket(0x0, 0x0, 0x0) syz_open_procfs(0x0, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$cgroup_int(0xffffffffffffffff, 0x0, 0x2, 0x0) openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x7a05, 0x1700) openat$smack_thread_current(0xffffffffffffff9c, &(0x7f0000000240)='/proc/thread-self/attr/current\x00', 0x2, 0x0) write$cgroup_subtree(0xffffffffffffffff, 0x0, 0x0) 14:04:00 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSPTLCK(r0, 0x40045431, &(0x7f0000000180)) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) socket(0x200000000000011, 0x4000000000080002, 0x0) bind$packet(0xffffffffffffffff, 0x0, 0x0) sendmmsg(0xffffffffffffffff, &(0x7f0000007880)=[{{&(0x7f00000001c0)=@l2={0x1f, 0xbf53, {0x9, 0x7, 0xfffffffffffffdd5, 0x1ff, 0x2}, 0x0, 0x7}, 0x80, 0x0}}, {{0x0, 0x0, &(0x7f0000007780)}}], 0x2, 0x4048851) setsockopt$packet_int(0xffffffffffffffff, 0x107, 0x0, 0x0, 0x0) syz_open_procfs(0x0, 0x0) ioctl$LOOP_SET_BLOCK_SIZE(0xffffffffffffffff, 0x4c09, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$cgroup_int(0xffffffffffffffff, 0x0, 0x2, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='\x89\x00\x00\x00\x00Ew\x00\x00\x00\xef\xb4\xc8\xd0\xff\xda\xb1vents\xd9\xc5H\xd4\x91\xfdN_]\x16\xe4\xa9C\xd2\x86Qn\xefS\x80\x11J\xfb4\x14\x86 4\x95\x9e\xfc\xc1\a\xcb \x95N\xe9\xa4j\xd2\x1f^\xb0\xb2>\xa3\xc9\xb7$\x11`t\x03: \x8b\xa4\x05\xf2?E\xdb+{t\xb8\xf7\xab\x8b\x100#', 0x26e1, 0x0) ioctl$PERF_EVENT_IOC_PAUSE_OUTPUT(r1, 0x40086602, 0x400007) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000280)='./cgroup/syz0\x00', 0x1ff) openat$smack_thread_current(0xffffffffffffff9c, &(0x7f0000000240)='/proc/thread-self/attr/current\x00', 0x2, 0x0) write$cgroup_subtree(r1, &(0x7f0000000100)=ANY=[], 0xff4a) write$cgroup_subtree(r2, &(0x7f0000000000)=ANY=[], 0x20032600) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a0f, 0x1700) accept$inet(0xffffffffffffffff, &(0x7f0000000040)={0x2, 0x0, @local}, &(0x7f0000000080)=0x10) ioctl$TCSETAF(r0, 0x5408, &(0x7f0000000040)={0x2}) ioctl$EXT4_IOC_GROUP_ADD(r0, 0x40286608, &(0x7f0000000000)={0x3, 0x7000000, 0x400, 0x100000000, 0x0, 0x8}) r3 = fcntl$dupfd(r0, 0x406, r0) ioctl$EVIOCGVERSION(r3, 0x80044501, &(0x7f0000000200)=""/31) write$binfmt_misc(r0, &(0x7f0000000080)={'syz1', "80fa25cdc862d216160cfa92845a3916e38a409a159c03f1889971d3e5144a8d08de78c4b1fbee457437261d7668b1c0f582647ad4134a05358d4309a71a702002329e024cac95642e761bb842bc1056bd6bf12c47697a649a026bd8ee1f685089941469b1ddfeddf32b392f0ff07652a3bce0770bc3bb70862845a65054cecb191e80b825d740fe6b40450359757032425dfdee92aec36ce4b468d50adc745c522cc4af2ac6e7f6a95f0edd70b09caa95fcc7143cf46b74db8bc17fa7c89f"}, 0xc3) 14:04:00 executing program 3: syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f00000001c0)=[@acquire], 0x0, 0x0, 0x0}) r1 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/enforce\x00', 0x40, 0x0) getsockopt$inet_tcp_buf(r1, 0x6, 0x0, &(0x7f0000000040)=""/226, &(0x7f0000000140)=0xff26) 14:04:00 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, &(0x7f0000000000)) 14:04:00 executing program 1: socket(0x0, 0x0, 0x0) syz_open_procfs(0x0, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = openat$cgroup_int(0xffffffffffffffff, 0x0, 0x2, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x7a05, 0x1700) openat$smack_thread_current(0xffffffffffffff9c, &(0x7f0000000240)='/proc/thread-self/attr/current\x00', 0x2, 0x0) write$cgroup_subtree(0xffffffffffffffff, 0x0, 0x0) ioctl$TCSETAF(0xffffffffffffffff, 0x5408, &(0x7f0000000040)) ioctl$EVIOCGBITSW(r1, 0x80404525, &(0x7f0000000080)=""/158) ioctl$EXT4_IOC_GROUP_ADD(r0, 0x40286608, 0x0) ioctl$EVIOCGVERSION(0xffffffffffffffff, 0x80044501, 0x0) 14:04:00 executing program 4: socket(0x0, 0x0, 0x0) syz_open_procfs(0x0, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$cgroup_int(0xffffffffffffffff, 0x0, 0x2, 0x0) openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x7a05, 0x1700) openat$smack_thread_current(0xffffffffffffff9c, &(0x7f0000000240)='/proc/thread-self/attr/current\x00', 0x2, 0x0) ioctl$TCSETAF(0xffffffffffffffff, 0x5408, &(0x7f0000000040)) 14:04:00 executing program 0: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(r0, 0x540b, 0x6) 14:04:00 executing program 0: r0 = creat(&(0x7f0000000000)='./file0\x00', 0x140) ioctl$TCSBRKP(r0, 0x5425, 0x6c) r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/ptmx\x00', 0x0, 0x0) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") mknod$loop(&(0x7f0000000100)='./file0\x00', 0x400002200006008, 0x0) r3 = creat(&(0x7f00000001c0)='./file0\x00', 0x0) mmap(&(0x7f0000000000/0xfda000)=nil, 0xfda000, 0x2, 0x31, 0xffffffffffffffff, 0x0) r4 = syz_genetlink_get_family_id$tipc(&(0x7f00000002c0)='TIPC\x00') sendmsg$TIPC_CMD_GET_LINKS(r0, &(0x7f0000000380)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x5408400}, 0xc, &(0x7f0000000340)={&(0x7f0000000300)={0x24, r4, 0x4, 0x70bd25, 0x25dfdbfc, {{}, 0x0, 0x4, 0x0, {0x8, 0x11, 0xffffffffffffe959}}, [""]}, 0x24}, 0x1, 0x0, 0x0, 0x50}, 0x4) r5 = syz_genetlink_get_family_id$nbd(&(0x7f0000000080)='nbd\x00') sendmsg$NBD_CMD_DISCONNECT(r0, &(0x7f0000000140)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x20008012}, 0xc, &(0x7f00000000c0)={&(0x7f0000000200)={0xbc, r5, 0x112, 0x70bd25, 0x25dfdbfb, {}, [@NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x1000}, @NBD_ATTR_SERVER_FLAGS={0xc, 0x5, 0x8}, @NBD_ATTR_BLOCK_SIZE_BYTES={0xc, 0x3, 0x30000000}, @NBD_ATTR_SOCKETS={0x2c, 0x7, [{0x8, 0x1, r0}, {0x8, 0x1, r0}, {0x8, 0x1, r0}, {0x8, 0x1, r0}, {0x8, 0x1, r3}]}, @NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x7}, @NBD_ATTR_SERVER_FLAGS={0xc}, @NBD_ATTR_BLOCK_SIZE_BYTES={0xc, 0x3, 0x9}, @NBD_ATTR_SERVER_FLAGS={0xc, 0x5, 0x7}, @NBD_ATTR_SOCKETS={0xc, 0x7, [{0x8, 0x1, r0}]}, @NBD_ATTR_SOCKETS={0x1c, 0x7, [{0x8, 0x1, r0}, {0x8, 0x1, r3}, {0x8, 0x1, r3}]}]}, 0xbc}, 0x1, 0x0, 0x0, 0x8000}, 0x40) ioctl$TIOCSPTLCK(r1, 0x40045431, &(0x7f00000003c0)) ioctl$BLKALIGNOFF(r3, 0x127b, &(0x7f0000000000)) getsockopt$inet6_buf(r0, 0x29, 0x2d, &(0x7f0000000400)=""/221, &(0x7f0000000500)=0xdd) ioctl$TCFLSH(r1, 0x540b, 0x1) 14:04:00 executing program 5: fsetxattr$trusted_overlay_upper(0xffffffffffffffff, &(0x7f0000000000)='trusted.overlay.upper\x00', &(0x7f0000000140)={0x0, 0xfb, 0xea, 0xfffffffffffffffd, 0x23, "d26950947d2b55d9ca07fc5a9ebc9c99", "28af9d037de408f410865ec66e0581ac26086a574c6c1a8b049ba91ce53144a3aa45b1a486d000fc13bcd572f3b283692f9a0b2313c56ff0353d92fc86e3b6b2b6f9c7a7937b8af8d84f629e840324dd185de16bd498d08ba370bc7a83ef6ec9dc4d430051087dc61dc072a9a8a79a832d440a2894a9bdf2e1889d1c6ab8552995ed1ba159214df1ffcbd7ec1e4f0a94c188fb12054888b52b2840b7632da0fef4c59b5215ee6823377518c52fe7d45b68a123aba62d9971060bae2b1ea0a372b9b3961c571100"/213}, 0xea, 0xffffffffffffffff) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$EXT4_IOC_SWAP_BOOT(0xffffffffffffffff, 0x6611) ioctl$sock_SIOCGPGRP(0xffffffffffffffff, 0x8904, &(0x7f0000000400)=0x0) getpriority(0x3, r0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x240100, 0x120) ioctl$UI_SET_EVBIT(r1, 0x40045564, 0x11) ioctl$KDSKBMETA(r1, 0x4b63, &(0x7f0000000440)=0x4) accept4$unix(r1, &(0x7f0000000380), &(0x7f00000000c0)=0x6e, 0x80000) setsockopt$inet6_group_source_req(r1, 0x29, 0x2f, &(0x7f0000000240)={0x13bd4fd7, {{0xa, 0x4e21, 0x8000, @ipv4={[], [], @initdev={0xac, 0x1e, 0x0, 0x0}}, 0xfffffffffffffffb}}, {{0xa, 0x4e21, 0x81, @remote, 0x8}}}, 0x108) ioctl$BINDER_GET_NODE_DEBUG_INFO(0xffffffffffffffff, 0xc018620b, &(0x7f0000000100)) 14:04:00 executing program 4: socket(0x0, 0x0, 0x0) syz_open_procfs(0x0, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$cgroup_int(0xffffffffffffffff, 0x0, 0x2, 0x0) openat$smack_thread_current(0xffffffffffffff9c, &(0x7f0000000240)='/proc/thread-self/attr/current\x00', 0x2, 0x0) ioctl$TCSETAF(0xffffffffffffffff, 0x5408, &(0x7f0000000040)) [ 346.783700] binder: 12098:12108 Acquire 1 refcount change on invalid ref 0 ret -22 14:04:00 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, &(0x7f0000000000)) r1 = openat$selinux_avc_cache_threshold(0xffffffffffffff9c, &(0x7f0000000040)='/selinux/avc/cache_threshold\x00', 0x2, 0x0) getsockname(0xffffffffffffffff, &(0x7f00000000c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000140)=0x80) sendmsg$nl_route(r1, &(0x7f0000000200)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0xc00}, 0xc, &(0x7f00000001c0)={&(0x7f0000000180)=@ipv4_getnetconf={0x1c, 0x52, 0x120, 0x70bd2a, 0x25dfdbfb, {}, [@NETCONFA_IFINDEX={0x8, 0x1, r2}]}, 0x1c}, 0x1, 0x0, 0x0, 0x4000}, 0x8001) r3 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000280)='TIPCv2\x00') sendmsg$TIPC_NL_LINK_GET(r1, &(0x7f0000000400)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x20000}, 0xc, &(0x7f00000003c0)={&(0x7f00000002c0)=ANY=[@ANYBLOB="c4004000", @ANYRES16=r3, @ANYBLOB="220328bd7000fcdbdf2508000000a4000100380004001400010002004e20000000000000000000000000200002000a004e2300000009ff0100000000000000000000000000017d273c6a2c0004001400010002004e23e000000100000000000000001400020002004e220000000000000000000000003c00020008000400010000000800040007000000080001001a00000008000300390000000800040004000000080004000000000008000400000000000c0005000800010065746800"], 0xc4}, 0x1, 0x0, 0x0, 0x40000}, 0x800) 14:04:00 executing program 3: syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0x0, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f00000001c0)=[@acquire], 0x0, 0x0, 0x0}) 14:04:00 executing program 4: socket(0x0, 0x0, 0x0) syz_open_procfs(0x0, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$smack_thread_current(0xffffffffffffff9c, &(0x7f0000000240)='/proc/thread-self/attr/current\x00', 0x2, 0x0) ioctl$TCSETAF(0xffffffffffffffff, 0x5408, &(0x7f0000000040)) [ 346.903221] binder: 12131:12134 Acquire 1 refcount change on invalid ref 0 ret -22 14:04:00 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSPTLCK(r0, 0x40045431, &(0x7f0000000180)) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) socket(0x200000000000011, 0x4000000000080002, 0x0) bind$packet(0xffffffffffffffff, 0x0, 0x0) sendmmsg(0xffffffffffffffff, &(0x7f0000007880)=[{{&(0x7f00000001c0)=@l2={0x1f, 0xbf53, {0x9, 0x7, 0xfffffffffffffdd5, 0x1ff, 0x2, 0x4}}, 0x80, 0x0}}, {{0x0, 0x0, &(0x7f0000007780)}}], 0x2, 0x4048851) setsockopt$packet_int(0xffffffffffffffff, 0x107, 0x0, 0x0, 0x0) syz_open_procfs(0x0, 0x0) ioctl$LOOP_SET_BLOCK_SIZE(0xffffffffffffffff, 0x4c09, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$cgroup_int(0xffffffffffffffff, 0x0, 0x2, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='\x89\x00\x00\x00\x00Ew\x00\x00\x00\xef\xb4\xc8\xd0\xff\xda\xb1vents\xd9\xc5H\xd4\x91\xfdN_]\x16\xe4\xa9C\xd2\x86Qn\xefS\x80\x11J\xfb4\x14\x86 4\x95\x9e\xfc\xc1\a\xcb \x95N\xe9\xa4j\xd2\x1f^\xb0\xb2>\xa3\xc9\xb7$\x11`t\x03: \x8b\xa4\x05\xf2?E\xdb+{t\xb8\xf7\xab\x8b\x100#', 0x26e1, 0x0) ioctl$PERF_EVENT_IOC_PAUSE_OUTPUT(r1, 0x40086602, 0x400007) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000280)='./cgroup/syz0\x00', 0x1ff) openat$smack_thread_current(0xffffffffffffff9c, &(0x7f0000000240)='/proc/thread-self/attr/current\x00', 0x2, 0x0) write$cgroup_subtree(r1, &(0x7f0000000100)=ANY=[], 0xff4a) write$cgroup_subtree(r2, &(0x7f0000000000)=ANY=[], 0x20032600) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a0f, 0x1700) accept$inet(0xffffffffffffffff, &(0x7f0000000040)={0x2, 0x0, @local}, &(0x7f0000000080)=0x10) ioctl$TCSETAF(r0, 0x5408, &(0x7f0000000040)={0x2}) ioctl$EXT4_IOC_GROUP_ADD(r0, 0x40286608, &(0x7f0000000000)={0x3, 0x7000000, 0x400, 0x100000000, 0x0, 0x8}) r3 = fcntl$dupfd(r0, 0x406, r0) ioctl$EVIOCGVERSION(r3, 0x80044501, &(0x7f0000000200)=""/31) write$binfmt_misc(r0, &(0x7f0000000080)={'syz1', "80fa25cdc862d216160cfa92845a3916e38a409a159c03f1889971d3e5144a8d08de78c4b1fbee457437261d7668b1c0f582647ad4134a05358d4309a71a702002329e024cac95642e761bb842bc1056bd6bf12c47697a649a026bd8ee1f685089941469b1ddfeddf32b392f0ff07652a3bce0770bc3bb70862845a65054cecb191e80b825d740fe6b40450359757032425dfdee92aec36ce4b468d50adc745c522cc4af2ac6e7f6a95f0edd70b09caa95fcc7143cf46b74db8bc17fa7c89f"}, 0xc3) 14:04:00 executing program 1: r0 = socket(0x0, 0x0, 0x0) ioctl$sock_FIOGETOWN(r0, 0x8903, &(0x7f0000000000)) getpgrp(0xffffffffffffffff) r1 = gettid() r2 = syz_open_procfs(r1, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$cgroup_int(0xffffffffffffffff, 0x0, 0x2, 0x0) r3 = openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x7a05, 0x1700) openat$smack_thread_current(0xffffffffffffff9c, &(0x7f0000000240)='/proc/thread-self/attr/current\x00', 0x2, 0x0) write$cgroup_subtree(r2, 0x0, 0x0) ioctl$TCSETAF(0xffffffffffffffff, 0x5408, &(0x7f0000000040)) ioctl$EXT4_IOC_GROUP_ADD(r3, 0x40286608, 0x0) ioctl$EVIOCGVERSION(0xffffffffffffffff, 0x80044501, 0x0) 14:04:00 executing program 5: ioctl$sock_FIOGETOWN(0xffffffffffffff9c, 0x8903, &(0x7f0000000100)=0x0) ptrace$peek(0x3, r0, &(0x7f0000000140)) r1 = openat$selinux_status(0xffffffffffffff9c, &(0x7f0000000180)='/selinux/status\x00', 0x0, 0x0) write$UHID_INPUT(r1, &(0x7f0000001040)={0x8, "30f6f389dc5a7de495f8702bae6cb4a83f88cb503a58d17ad92f8aceae8253ffb29a08d614f1fa189849821e943a81d54bef12384cab24c121f55b45dd5a66ec120d904edae2cb2898f9709dcf0fd9a467edcb10e16732e112ce60432bc10430a5ae9541f07e0ce878b803a2bf15a4e645af7c9aa12455ca0c0a4cb19fe4cb6da3da74d504e898875c0cfe212b443bba1b2c1bff438c0d619350c046cf3df273a49ecfa7cd46a4abb1691b177a22e333dd341cbaf2ea8173566108b872e2607a3a70cad150bf1e6900acb7dee2b9e38d2d02c0eee9022bfa30664e8870f693cad060285bd389be1ebee3b2822d89b7f6d696e3713ba76c258afc20b0518d01a4ec1c16470b1acfaf7efa272e64030737cacd0cd82b651ce1ce552d2df0f15b252c912eca4573585acb0d32abf8cda774d075a837a08b3e45558e555c24702bc2762102bfea120cf83e4be8019cefc85b62ae4cd19d50edce559736798565ba36f5b25bed3658515f9bc0db8492192439b258e6bd1e112c73253a2f3fc57d289cb5848bf07fd338fad91c252c23e13186dbf147e160877c69f45bcf1acaa8a071c8333698f9318c21b175f6424df3472f0ff043fbb51a2891195f048ec99cd6e05a34479f26617c8e38a83866ca7f5175f6e4c32f36df8708b44908ff8338e35293a61aa0f2a045e1799127ad7af402204979279a1a1909c2a19422024c5c86fe0f52b44e31276f28168f21792cd379c44838870f561fdbb8cf9def08e4ffee10f95fba865cc5970a84f9284187e3ed91d879517005761d0710b43f6fba1d938b1eb0cfeb3812fb599814ba86abaf56ef7c0fcf97ec2b280b055fa77b890afdf8515538282b1b3583c6c6c3e4e5390df9bec003954608d32b8e268f8a07e519d7d4ba2efaaf192ac5bda859c47a4753748bc7bdd89ba3945aef3462038689ce44936b4022c32caf146264f89f2aa34d075f934318ff2c129fef11b821035124eddda532337ac102a14a1c02c4a36d821b90d6cfe9c37b2c88988459d74a96edf44f6bbac818cf67e415b36b3344bef3fe7fafa55d2d0002d83239d8f6ea6d67a6bf1820f4e0bfc4bb2bbcab9c252f9064332c0ca638b29bc68a1e47945c8c4db335130ad7cf7589dc65877bd1c2c88d1c12b94ea48888c0c871d28199381aadbef201d424f9c495dbebc3366cf87114692102220b93a4388555b8c40b13ad53420c9256dbb1bcdba6062d8e0c7f9042c7c55d2e648e48fc03d8f4f3b3d6415e398bec8a48099e639e39c1d18757af59e94c7df2cf86ee5e7f5312057d34a60ac9958d87a7eba79cd3a5d836fef24fe531f3df3cde72b1fa05ac98dd7d04e4da42babb817a71518bae60ca964b3a278bd646c3635045a63528dc795cc842cc0938a01bc64ebcfb7606a4bdb07cb97c1dc9e6974c1b4f95385b3fe4cd35dce530bb32b5479f8eba22b34e287b25ea329c77970214d50f0950dd1a2f4a7539fc10eb987bcb3208b441d36ec2841214ae024498f94340b7577e3e256d87ff09a61a21c22c5a4145cd6a395a9880fc8e3b3af737199bef3e028636700dc682c97e7024bcd550533303cc4e147732f1de8d719c7b93a2adfb8c74aa43f535720c6da13b2780e48a29255381fc01367b97c3d237b2dc5d90bf27a5735378308ba5eb3a789a1c692ae28147f6940d99b02c8b9687d8652573d313b3a2324d54bf09ef4736872b0867f9a834c1cb707dc3b711de9803bd51c782447c1ad4ef559e3054ff609174be13696f6bf2d0353dd70f954095005df462f15156653b06c0370688c0b03426b91047feaa9ac03783f7d929ec904f75ce47cba15a11c507497e760f1f7a1dc9368f9712aa9bfa1df4eee2bc17a0c267648fae353cd958c89acfa902a252b053c15b0f1e3b93f291a1cbbdfca59ad0688a884247a69c72328f6a69f5e2fa10570e7bae02bdb1f21caaebb25ae2a450c97c8906cec9576d5c0b8f7d2c41a7af866b72238468da32bfc7f83a998ab4f575256c13e9eec4547e9a6e954581c439870156545503903789e529fdb9555b7abc28fdce1a079daf5919ac5d80cda2192f40d730afbab9cfc059d3504bb70d94b58f96b0f6ab0db6bf235305164b69858e065a66e5e3b5dca677ad4d8a3e4cdd83444401c8efbf05d6b2727d195fd6238805e00a8e24fb3e7105b387ebbab49071042cc1420356339db587dbb36ca64bd0f03f985750badc5c5284a602e5653d801a7b35cc3a861457e536baecf4b8bc88b6218b243ce1970844544cc6cb89e9fc6e10f1477a7a78bfc67db0eeb8d7501707194364faf4c5ee577a9d056d79fc252d1d84ffe0d8e13d91e3e8c3457b1f1cfc853d48a13819f26f203d8071d9a0f3c622c9a2c38e47b9bed09e55ba4ce050b66a3a7d23485dd47a28a9d03cb9ddd4773f59da8b739efd0cafa76edd1131ca105b009b691c14e14af839cf1d4936bcdc3c64a459feaf05326541f187de8e7840b9bc0377a80eec3abb17d74efd45e21fc6820b59362e0d321c988702d86846ad26c649bf83cd9e86dffd14a0373b48fbd9f4bd30564892300ea2ce2241df98d9fed4f604cfc7b1616d98b94c6f649c987283157224aa31fa82d8a66276dafc9484eaa1bf0bbc522ef4ccfb82f516b1eba873e18a77e858404bdd0d76ffb0a30db50f9be23ab2fbb79fa79d7e074d1e5fd3ba9d75c0fb0f6dce89bc808b4333b4c4302f9adbf6d52b749fff6408e383acaabb7a21f900b4c21822e0d2212c614fd6410435b51fe8847ccd43ef8bb46bd9f8b1e11a967aec3fe41e8cca4d11ec502542178c7e8f48e9bf098a122edaae53172acaf2d7792070c7257b76cdcfa12effc1cd7f8cbd76fd6dffcba57c53b3e553a2aac7cc27a95ad000999c87854739731b859c90bf133630d6eee37c9590437c41cde66edce64ae460cbb6ba667c202b88ae77ff17a26581595adcb6f66e2e89f48003ba8fea046684e323d2fe6af7fe5866ca4ecb21de480c16f23ffa1e40954dda60c4e16ec5ac0e2bd2a57d1b91f53697ddc8e8ed0cc73797c10771b5cfcff712f216d7688292531344c9d73d5df72a0a57521c4d9414d06e21bd0b5eaeea916ab6af32db0ce66194b7209099a537cff75cb90245080edfed69bc1e9b72401ebb7eae75e666356a851a3fa3bc841c5cacd5df84d167dcea8c05c7723e09d52523f06dbb212bd1824f05324ad734915fcc020cc9e840ae48965517c096c4f7a1845bc7457b479cc2ba1786cd0a1e20d0c6f325a1a2d204a03d537a5cfc87924ea6f93a8dccc2de9eb3001547a6ec4417abeafb4f26df84b47d15ed7743b884d0e2ac27054908a672e0386a2e3627eb8c6c2812a6caa61c3ed2e169b41d317a0ab19df95bfd3e77cf0fef5a86a74507de0c5d2e62684ec3c0af630dee79f585b366ee255b19fbae9659d8a09f4ab3a4c6fce2b9c739d51b4c9f83a86670afe10d9c2f028417d06dba32e5fbb99fe2998c5076720261d0d9e1e389ced27b4118195a6e44124390e61b55ed1a5f2c5081dc01f531a92c860dd2e98d675d028f3fb9d26dd1eff29ff0996a1749fa27033905bffee642e695cbd0e657e9b5f781ef0c81c602c08c00628e1ab782780f6d05fcd73a7bb0caf815dfb246ccf2a602cf01eb5c6e11e186f0906b8a6466ad22c9a9db258983768bcc68b1e2dbc39bbd160f0a82631bc0ee04ff2a4be58ea5437951506e699d02b70872185d8c1e148aca96543850bc019aa6b6da5a67b0ed914cffa7425d0c922d1465b38b85ebca2487d5c57a3a14ac4dae8e776ac98a0ea47e332a6605c8c09a55087310cf0fced3a724cab671a4cca05aff6f7181135e6e0848d8ebfb23625fdd84ac72df1afa353073ed1458e1c70edf04b38806ea637177b0f62357311e0bc87ddc5d5ecf2ffb4893cf18cd992cbfda2116b365a4bbfaba4a1125891f8407705fba2823a7a81194a4bb6e31c24fccf75f8807e8825b2f51e6683bc948c99adf4ff8d7d61deb4f8bc17b85af6216ff639bfaf1e98876c35f7cd6cbe13f78bd707d9633fda2708247ed9948e0aaae470e1c6ee32cb2f72d1de312164c4b5c6e369a55420b7b539de5feac17b3e5e59e79c2899f2a963c345a908979daf28e053be30954b6643780e0f3f9e2d029cf70ccc866c9d32bd80e3c32bfc0ca61f331012ca464e10d43927560e0526b4fd0670d3541de3f0537b960144ddc5d3b4be9de2ce1d8269f44d879bae5d146f962da2fec7407f9876001143cd11b76c12f8acf8f67c1777fdfe924de9f1c7e702dcda222567dfca982d4c1447689e0066f470b79a5be1ad5549c07577a13a9a1eff1c1a344b6e2c38a429de51b2d70939328aedae956da64c47348ac54ac4d0cd8afb5353d1237026d6c2c8db6ac2fdbe924d14c28624feb17b67d32e9a8bad3df6956db94df2e24a6aa8806ec808bc7407a18f57457992434e7399ea915d6d84cbffd5152d7ba1ae85999bd3828c77ddefa7e2c095591d1990c3546edf78bbb787f96a76d6dbb6386012abb18826546b49cd97eaa418c6ee9ee1e46b523dc8b50f8312c7789f38650bde3c6cf4aef6d06d8d92693cdfc5390014fb44c9d995ed6f19fb8864889143091d820fc42ded827763fe378f9f3c3ace7d6d9b60b30230ede1946f9314c85245d1d4f44a5e43f0b82d61532258cca7c2af98bfbe72eada6c9477beb27d278445de5df4275370b01cc756e1624d0dcf8bab58af9740f38a1722d6263ef403ed53b243fcfabde6c17a12d92939be166fdb600fba584455b9bc346e8008d070ae5d2018e5773c73eda4fc81103b787d7353b4e43751d42da9437d9a1fd5cdaf45385cda1da725da0732c0ff52828f4a56a741a1443e88ade7d4195781df2dd0894f9880c11ce370479e9fc2cda6a102be6ceeec303f82d148ec3b94762d7f3849b06d1305c016f39fa8792866e8304472436bb90dd832fd50c809b63c6bd633987eb92d82d268f276412d5a80d3dacc0941084d102cd6cae49f33fa6ac4b24cbd2e8199699816d23540f0bbdabda3f8f179abefda1b0f4b4a719b817f3722bc384dd3e46685823799685f6285412c61650bd17cab0896e9ae630b9e9760fab31de0cf686a570353ec370019523da6e2027fa1ac35c4d1c0b3abac3830f8f44643bbffa7685858bb4a2a63deba71a635ba7ed2a7ba20114b6309cf30dc7e57b1119d3206a71e6b1d5034212c2f8d7c19e689b32224d287e365029624c075f2a62129701d1c172c473024e8ebeda6ddef5bf112b72b4cba1166dcfc5900c088fb6d56ed4db448ec06d8ea7b82d9ffbfb276bd4a57b4633dabbf8f7d8e45d289eeda0bef3f4b9a5010ecf8baca4b9578ffd45bd317fd0b9e208a6fab94316c8a133c2becc9c546814204a2272e9e739ba0dbaf02ecfb9760cbd1c863b83469f61904dfb608e47911efb8d813f4be4f0c5bbc5d3928be401b6f96a363d7c70dd26f7a728dd140d8f629611261431e269d25818b5e6ad92d594431dddb7fac7705f937e44495e68408d288d10cff6a89b5ac18e344bf65db332317eea2228127992a7b98dcd6df1da0d1683a50a093198c273ccce5e1ade801e524831a575b2391597da8ddb01ce2b9496d77dbbf5e8e9c628181293a65506cd5f3748378e4ce278c4c8c0a083e57b0a7c6635e1c84893dfc4f224b24af9866954a56849b58a79f04ead39767feda3d34de807ed010d52ce0962bbd336dd44837e4f6503ca96966024f6cec9424e07bd5bf2a22793ae26f48801b182cf95817ca2e4036ad4c1dabe", 0x1000}, 0x1006) r2 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0x0, 0x400000000000) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) r3 = openat$pfkey(0xffffffffffffff9c, &(0x7f00000001c0)='/proc/self/net/pfkey\x00', 0x141000, 0x0) ioctl$EVIOCGUNIQ(r3, 0x80404508, &(0x7f0000000080)=""/106) dup3(r2, r3, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r2, 0xc018620b, &(0x7f0000000040)) 14:04:00 executing program 0: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ptmx\x00', 0x2, 0x0) ioctl$TCFLSH(r0, 0x540b, 0x1) r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) r2 = add_key(&(0x7f0000000040)='blacklist\x00', &(0x7f0000000080)={'syz', 0x3}, &(0x7f00000000c0)="52bad46559f836fb1976016ba8039ef53ccc432ad3021113a3afc2607aa4da3d0e16d440a6984e0e67bc17eddd621eba9b8b06176032477c7ad41ffe5f23cf0d56a97ad056e7738e387e717161759901ae9336e0a2fac66ee4b96c6dc6c29f55bdf99d959f29911edc102998371d89c781f5288b4fe4150b351cfe460efcc03b2f7a7daae53d4dbb0e0ccd5aa42dd7a0c765b55f9ca5a1daf9ecd8a6b40c25027d8d09e8d3fddac5c72c481e", 0xac, 0xfffffffffffffff9) r3 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$EXT4_IOC_MOVE_EXT(r1, 0xc028660f, &(0x7f0000001340)={0x0, r3, 0x7, 0xffff, 0x6, 0x8}) ioctl$sock_proto_private(r3, 0x89ed, &(0x7f0000001280)="2b537c1d470ae1371b33a49cddd905495f08f453474b3aee0b455bc83dbcbcbeb70fcc6be2b345767df2e2f9c834cff8481cce6023c4f692a0c869e98ba294324c36b5aa72fded737e9d0e6a8a3bbf73fa759fd2e2a7290eada2c5cadd9142603b58d6923cd5c94a9c3c024696104ae53ab60421a86fc2ecd035a1b7c8e259f34437a111192465ecb32361c4b2414d26a0009213138c494f782cc76b728ab422b200560d7294c3686b8eb8e7030772d6d56c") keyctl$update(0x2, r2, &(0x7f0000000200)="03de7c39ed0de7adc775dc60327e89e11ac00223bb3441513b8fe33813235ccc0138f3c7421fdca55b94e8b1048881a45f11284022f3229c1e84c0d291ce18c9f6d7a5da643399d234107e793366a7cc9c53b73b29bf9aab3e8925b4705e93d91c9b1da8792327daf16abce1b5a5b6364eded79801fad3e35b46", 0x7a) ioctl$GIO_SCRNMAP(r1, 0x4b40, &(0x7f0000000280)=""/4096) r4 = openat$selinux_mls(0xffffffffffffff9c, &(0x7f00000001c0)='/selinux/mls\x00', 0x0, 0x0) socket$key(0xf, 0x3, 0x2) ioctl$ASHMEM_SET_SIZE(r4, 0x40087703, 0x3f) 14:04:00 executing program 4: socket(0x0, 0x0, 0x0) syz_open_procfs(0x0, 0x0) openat$smack_thread_current(0xffffffffffffff9c, &(0x7f0000000240)='/proc/thread-self/attr/current\x00', 0x2, 0x0) ioctl$TCSETAF(0xffffffffffffffff, 0x5408, &(0x7f0000000040)) 14:04:00 executing program 3: syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB="0a00dd0000000000"], 0x0, 0x0, 0x0}) [ 346.944625] binder: 12131:12145 Acquire 1 refcount change on invalid ref 0 ret -22 14:04:00 executing program 5: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0x0, 0x804) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) openat$selinux_checkreqprot(0xffffffffffffff9c, &(0x7f0000000040)='/selinux/checkreqprot\x00', 0x10400, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, &(0x7f0000000000)) 14:04:00 executing program 4: socket(0x0, 0x0, 0x0) syz_open_procfs(0x0, 0x0) openat$smack_thread_current(0xffffffffffffff9c, &(0x7f0000000240)='/proc/thread-self/attr/current\x00', 0x2, 0x0) ioctl$TCSETAF(0xffffffffffffffff, 0x5408, &(0x7f0000000040)) [ 346.999408] binder: 12155:12159 unknown command 14483466 [ 347.010205] binder: 12155:12159 ioctl c0306201 20012000 returned -22 [ 347.022361] binder: 12155:12167 unknown command 14483466 14:04:00 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = mmap$binder(&(0x7f0000ffb000/0x3000)=nil, 0x3000, 0x1000000, 0x13, r0, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, &(0x7f0000000080)={r1}) fcntl$F_GET_RW_HINT(r0, 0x40b, &(0x7f0000000040)) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, &(0x7f0000000000)) 14:04:00 executing program 1: socket(0x0, 0x0, 0x0) r0 = syz_open_procfs(0x0, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) getsockopt$inet_IP_IPSEC_POLICY(r0, 0x0, 0x10, &(0x7f0000000080)={{{@in=@broadcast, @in=@multicast1}}, {{@in=@broadcast}, 0x0, @in=@broadcast}}, &(0x7f0000000000)=0xe8) openat$cgroup_int(0xffffffffffffffff, 0x0, 0x2, 0x0) openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x7a05, 0x1700) openat$smack_thread_current(0xffffffffffffff9c, &(0x7f0000000240)='/proc/thread-self/attr/current\x00', 0x2, 0x0) write$cgroup_subtree(0xffffffffffffffff, 0x0, 0x0) socketpair(0xa, 0x5, 0x7, &(0x7f0000000200)) ioctl$TCSETAF(0xffffffffffffffff, 0x5408, &(0x7f0000000040)) ioctl$EXT4_IOC_GROUP_ADD(0xffffffffffffffff, 0x40286608, 0x0) ioctl$EVIOCGVERSION(0xffffffffffffffff, 0x80044501, 0x0) ioctl$EVIOCGMTSLOTS(r0, 0x8040450a, &(0x7f0000000280)=""/41) 14:04:00 executing program 3: syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="754f3df6b7a0f3f3cf043e55b3cb70aff3a91e2bb1e57013a81c20f9e5cd24b6ff8fca020a01c4db255b272855e27c8926a76e25004f421b239ef17dfe29b908e4272c664d0b1884f5e96143fe29105f88ec58e971ace508742066416abdea23a4b85de89c04ba2865ba2479f15cc6e1c8bc43dac6e1ec5360ff0512a7110b034f219eb3f1d12ec77da2"], 0xfffffffffffffeac, 0x0, 0x0}) [ 347.049122] binder: 12155:12167 ioctl c0306201 20012000 returned -22 14:04:00 executing program 4: socket(0x0, 0x0, 0x0) syz_open_procfs(0x0, 0x0) openat$smack_thread_current(0xffffffffffffff9c, &(0x7f0000000240)='/proc/thread-self/attr/current\x00', 0x2, 0x0) ioctl$TCSETAF(0xffffffffffffffff, 0x5408, &(0x7f0000000040)) 14:04:00 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSPTLCK(r0, 0x40045431, &(0x7f0000000180)) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) socket(0x200000000000011, 0x4000000000080002, 0x0) bind$packet(0xffffffffffffffff, 0x0, 0x0) sendmmsg(0xffffffffffffffff, &(0x7f0000007880)=[{{&(0x7f00000001c0)=@l2={0x1f, 0xbf53, {0x9, 0x7, 0xfffffffffffffdd5, 0x1ff, 0x2, 0x4}}, 0x80, 0x0}}, {{0x0, 0x0, &(0x7f0000007780)}}], 0x2, 0x4048851) setsockopt$packet_int(0xffffffffffffffff, 0x107, 0x0, 0x0, 0x0) syz_open_procfs(0x0, 0x0) ioctl$LOOP_SET_BLOCK_SIZE(0xffffffffffffffff, 0x4c09, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$cgroup_int(0xffffffffffffffff, 0x0, 0x2, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='\x89\x00\x00\x00\x00Ew\x00\x00\x00\xef\xb4\xc8\xd0\xff\xda\xb1vents\xd9\xc5H\xd4\x91\xfdN_]\x16\xe4\xa9C\xd2\x86Qn\xefS\x80\x11J\xfb4\x14\x86 4\x95\x9e\xfc\xc1\a\xcb \x95N\xe9\xa4j\xd2\x1f^\xb0\xb2>\xa3\xc9\xb7$\x11`t\x03: \x8b\xa4\x05\xf2?E\xdb+{t\xb8\xf7\xab\x8b\x100#', 0x26e1, 0x0) ioctl$PERF_EVENT_IOC_PAUSE_OUTPUT(r1, 0x40086602, 0x400007) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000280)='./cgroup/syz0\x00', 0x1ff) openat$smack_thread_current(0xffffffffffffff9c, &(0x7f0000000240)='/proc/thread-self/attr/current\x00', 0x2, 0x0) write$cgroup_subtree(r1, &(0x7f0000000100)=ANY=[], 0xff4a) write$cgroup_subtree(r2, &(0x7f0000000000)=ANY=[], 0x20032600) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a0f, 0x1700) accept$inet(0xffffffffffffffff, &(0x7f0000000040)={0x2, 0x0, @local}, &(0x7f0000000080)=0x10) ioctl$TCSETAF(r0, 0x5408, &(0x7f0000000040)={0x2}) ioctl$EXT4_IOC_GROUP_ADD(r0, 0x40286608, &(0x7f0000000000)={0x3, 0x7000000, 0x400, 0x100000000, 0x0, 0x8}) r3 = fcntl$dupfd(r0, 0x406, r0) ioctl$EVIOCGVERSION(r3, 0x80044501, &(0x7f0000000200)=""/31) write$binfmt_misc(r0, &(0x7f0000000080)={'syz1', "80fa25cdc862d216160cfa92845a3916e38a409a159c03f1889971d3e5144a8d08de78c4b1fbee457437261d7668b1c0f582647ad4134a05358d4309a71a702002329e024cac95642e761bb842bc1056bd6bf12c47697a649a026bd8ee1f685089941469b1ddfeddf32b392f0ff07652a3bce0770bc3bb70862845a65054cecb191e80b825d740fe6b40450359757032425dfdee92aec36ce4b468d50adc745c522cc4af2ac6e7f6a95f0edd70b09caa95fcc7143cf46b74db8bc17fa7c89f"}, 0xc3) 14:04:00 executing program 5: r0 = openat$selinux_checkreqprot(0xffffffffffffff9c, &(0x7f0000000200)='/selinux/checkreqprot\x00', 0x181000, 0x0) ioctl$SNDRV_TIMER_IOCTL_STATUS(r0, 0x80605414, &(0x7f0000000080)=""/60) r1 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$SNDRV_TIMER_IOCTL_TREAD(r0, 0x40045402, &(0x7f0000000040)=0x1) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r1, 0xc018620b, &(0x7f0000000000)) openat$cgroup(r0, &(0x7f00000000c0)='syz1\x00', 0x200002, 0x0) connect$unix(r0, &(0x7f0000000100)=@file={0x0, './file0\x00'}, 0x6e) 14:04:00 executing program 0: prctl$PR_SET_TIMERSLACK(0x1d, 0x8) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(r0, 0x540b, 0x1) 14:04:00 executing program 5: r0 = openat$selinux_policy(0xffffffffffffff9c, &(0x7f0000000600)='/selinux/policy\x00', 0x0, 0x0) ioctl$BLKRAGET(r0, 0x1263, &(0x7f0000000640)) r1 = openat$selinux_status(0xffffffffffffff9c, &(0x7f0000000140)='/selinux/status\x00', 0x0, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r1, 0x29, 0x40, &(0x7f00000001c0)=@raw={'raw\x00', 0x9, 0x3, 0x3d0, 0x158, 0x0, 0x158, 0x158, 0x158, 0x300, 0x300, 0x300, 0x300, 0x300, 0x3, &(0x7f0000000180), {[{{@uncond, 0x0, 0x138, 0x158, 0x0, {}, [@common=@dst={0x48, 'dst\x00', 0x0, {0x9, 0x0, 0x1, [0x81, 0x800, 0x1, 0x8, 0x1, 0x1, 0xffff, 0xfde8, 0x7e73, 0x80000000, 0x0, 0x2, 0x81, 0x7, 0x3ff, 0x200], 0x7}}, @inet=@rpfilter={0x28, 'rpfilter\x00', 0x0, {0x1}}]}, @unspec=@NOTRACK={0x20, 'NOTRACK\x00'}}, {{@uncond, 0x0, 0x180, 0x1a8, 0x0, {}, [@inet=@rpfilter={0x28, 'rpfilter\x00', 0x0, {0xe}}, @common=@srh1={0x90, 'srh\x00', 0x1, {0x11, 0x8, 0x9, 0x0, 0x4, @mcast2, @dev={0xfe, 0x80, [], 0x2a}, @rand_addr="dc363309e7cc5e12395a289d47583b57", [0xff000000, 0xffffff00, 0xff, 0xffffffff], [0xffffff00, 0x0, 0x0, 0xffffffff], [0xffffffff, 0xffffffff, 0xffffffff, 0xffffff00], 0x2000, 0x900}}]}, @common=@inet=@SET1={0x28, 'SET\x00', 0x1, {{0x7, 0x0, 0x2}, {0x1000, 0x7f, 0x9}}}}], {{[], 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x430) r2 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) getresgid(&(0x7f0000000040), &(0x7f0000000080)=0x0, &(0x7f00000000c0)) setfsgid(r3) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r2, 0xc018620b, &(0x7f0000000000)) 14:04:00 executing program 4: socket(0x0, 0x0, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$smack_thread_current(0xffffffffffffff9c, &(0x7f0000000240)='/proc/thread-self/attr/current\x00', 0x2, 0x0) ioctl$TCSETAF(0xffffffffffffffff, 0x5408, &(0x7f0000000040)) [ 347.101886] binder: 12182:12188 unknown command -163754123 [ 347.122389] binder: 12182:12188 ioctl c0306201 20000080 returned -22 14:04:00 executing program 0: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(r0, 0x540b, 0x1) r1 = dup3(r0, r0, 0x80000) getsockopt$inet6_tcp_TCP_ZEROCOPY_RECEIVE(r1, 0x6, 0x23, &(0x7f0000000000)={&(0x7f0000ffb000/0x3000)=nil, 0x3000}, &(0x7f0000000040)=0x10) 14:04:00 executing program 3: syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) r1 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000180)='fd/4\x00') setsockopt$inet_group_source_req(r1, 0x0, 0x2f, &(0x7f0000000700)={0x8, {{0x2, 0x4e24, @multicast1}}, {{0x2, 0x4e22, @local}}}, 0x108) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000006c0)={0x44, 0x0, &(0x7f0000000600)=[@transaction={0x40406300, {0x3, 0x0, 0x3, 0x0, 0x10, 0x0, 0x0, 0x0, 0x8, &(0x7f0000000580), &(0x7f00000005c0)=[0x30]}}], 0x0, 0x0, 0x0}) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000500)={&(0x7f0000ffa000/0x3000)=nil, &(0x7f0000ffa000/0x3000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffa000/0x4000)=nil, &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffa000/0x4000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000140)="224fabe96994970f06630ee91c38e0d530f327f2ab3aeb67cada98351c1290e55205c446d9ac7c", 0x27, r0}, 0x68) r2 = syz_open_dev$mice(&(0x7f0000000000)='/dev/input/mice\x00', 0x0, 0x200000) r3 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000080)='TIPCv2\x00') sendmsg$TIPC_NL_LINK_RESET_STATS(r2, &(0x7f0000000100)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f00000000c0)={&(0x7f0000000200)={0x2c4, r3, 0x8, 0x70bd28, 0x25dfdbfd, {}, [@TIPC_NLA_SOCK={0x3c, 0x2, [@TIPC_NLA_SOCK_HAS_PUBL={0x4}, @TIPC_NLA_SOCK_ADDR={0x8, 0x1, 0x400}, @TIPC_NLA_SOCK_REF={0x8, 0x2, 0x7f}, @TIPC_NLA_SOCK_REF={0x8, 0x2, 0x9}, @TIPC_NLA_SOCK_REF={0x8, 0x2, 0x1ff}, @TIPC_NLA_SOCK_HAS_PUBL={0x4}, @TIPC_NLA_SOCK_HAS_PUBL={0x4}, @TIPC_NLA_SOCK_ADDR={0x8, 0x1, 0x3}, @TIPC_NLA_SOCK_HAS_PUBL={0x4}]}, @TIPC_NLA_SOCK={0x10, 0x2, [@TIPC_NLA_SOCK_REF={0x8}, @TIPC_NLA_SOCK_HAS_PUBL={0x4}]}, @TIPC_NLA_NODE={0x10, 0x6, [@TIPC_NLA_NODE_ADDR={0x8, 0x1, 0x6}, @TIPC_NLA_NODE_UP={0x4}]}, @TIPC_NLA_LINK={0x144, 0x4, [@TIPC_NLA_LINK_PROP={0xc, 0x7, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x3}]}, @TIPC_NLA_LINK_PROP={0x1c, 0x7, [@TIPC_NLA_PROP_WIN={0x8, 0x3, 0x8fef}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x3}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x4}]}, @TIPC_NLA_LINK_PROP={0x44, 0x7, [@TIPC_NLA_PROP_TOL={0x8, 0x2, 0x100000001}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x6}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x200}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x9f8a}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x8d}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x15}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x19}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0xfffffffeffffffff}]}, @TIPC_NLA_LINK_NAME={0xc, 0x1, 'syz1\x00'}, @TIPC_NLA_LINK_NAME={0x14, 0x1, 'broadcast-link\x00'}, @TIPC_NLA_LINK_NAME={0xc, 0x1, 'syz0\x00'}, @TIPC_NLA_LINK_PROP={0x2c, 0x7, [@TIPC_NLA_PROP_WIN={0x8, 0x3, 0x94}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x3}, @TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x13}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x357b}]}, @TIPC_NLA_LINK_NAME={0xc, 0x1, 'syz0\x00'}, @TIPC_NLA_LINK_PROP={0x3c, 0x7, [@TIPC_NLA_PROP_WIN={0x8, 0x3, 0x7}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0xb}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x9}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x1}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x724}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x100}, @TIPC_NLA_PROP_PRIO={0x8}]}, @TIPC_NLA_LINK_PROP={0x34, 0x7, [@TIPC_NLA_PROP_TOL={0x8, 0x2, 0x4}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x7fff}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x3}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x8000}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0xb}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x12}]}]}, @TIPC_NLA_BEARER={0xa8, 0x1, [@TIPC_NLA_BEARER_DOMAIN={0x8, 0x3, 0xa63}, @TIPC_NLA_BEARER_PROP={0x3c, 0x2, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0xffffffff}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x7}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x4}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0xffff}, @TIPC_NLA_PROP_WIN={0x8}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x7af}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0xffffffff}]}, @TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_PROP={0x14, 0x2, [@TIPC_NLA_PROP_WIN={0x8, 0x3, 0x9}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x7}]}, @TIPC_NLA_BEARER_UDP_OPTS={0x38, 0x4, {{0x14, 0x1, @in={0x2, 0x4e20, @multicast2}}, {0x20, 0x2, @in6={0xa, 0x4e21, 0x3, @rand_addr="c00a177da98afa51639b5fddcff45c7f", 0x80}}}}, @TIPC_NLA_BEARER_PROP={0x4}, @TIPC_NLA_BEARER_DOMAIN={0x8, 0x3, 0x1}]}, @TIPC_NLA_LINK={0x68, 0x4, [@TIPC_NLA_LINK_NAME={0xc, 0x1, 'syz0\x00'}, @TIPC_NLA_LINK_NAME={0xc, 0x1, 'syz1\x00'}, @TIPC_NLA_LINK_PROP={0x2c, 0x7, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0xff000}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x5}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x1b}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x800}]}, @TIPC_NLA_LINK_NAME={0xc, 0x1, 'syz1\x00'}, @TIPC_NLA_LINK_NAME={0x14, 0x1, 'broadcast-link\x00'}]}]}, 0x2c4}, 0x1, 0x0, 0x0, 0x4000800}, 0x8000) 14:04:00 executing program 4: socket(0x0, 0x0, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$smack_thread_current(0xffffffffffffff9c, &(0x7f0000000240)='/proc/thread-self/attr/current\x00', 0x2, 0x0) ioctl$TCSETAF(0xffffffffffffffff, 0x5408, &(0x7f0000000040)) [ 347.180559] binder: 12182:12207 unknown command -163754123 [ 347.203559] binder: 12182:12207 ioctl c0306201 20000080 returned -22 14:04:00 executing program 0: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x8040000000, 0x0) ioctl$TCFLSH(r0, 0x540b, 0x1) [ 347.252764] binder: 12220:12223 got transaction to invalid handle [ 347.288851] binder: 12220:12223 transaction failed 29201/-22, size 0-8 line 3119 14:04:00 executing program 1: socket(0x0, 0x0, 0x0) syz_open_procfs(0x0, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$cgroup_int(0xffffffffffffffff, 0x0, 0x2, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x7a05, 0x1700) openat$smack_thread_current(0xffffffffffffff9c, &(0x7f0000000240)='/proc/thread-self/attr/current\x00', 0x2, 0x0) write$cgroup_subtree(0xffffffffffffffff, 0x0, 0x0) ioctl$TCSETAF(0xffffffffffffffff, 0x5408, &(0x7f0000000040)) setsockopt$netlink_NETLINK_RX_RING(r0, 0x10e, 0x6, &(0x7f0000000000)={0x6, 0x1, 0x5, 0x80000000}, 0x10) ioctl$EXT4_IOC_GROUP_ADD(0xffffffffffffffff, 0x40286608, 0x0) ioctl$EVIOCGVERSION(0xffffffffffffffff, 0x80044501, 0x0) 14:04:00 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) pipe2(&(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}, 0x4800) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, &(0x7f0000000100)={0x0}) stat(&(0x7f0000000000)='./file0\x00', &(0x7f0000000140)={0x0, 0x0, 0x0, 0x0, 0x0}) fstat(r1, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) dup2(r0, r1) linkat(r2, &(0x7f0000000240)='./file0\x00', r2, &(0x7f0000000280)='./file0\x00', 0x1400) write$selinux_user(r1, &(0x7f0000000040)=ANY=[@ANYBLOB='syitem_u:object_r:pam_var_run_t:s0 sysadm_u\x00'], 0x2c) getsockopt$packet_int(r1, 0x107, 0xb, &(0x7f0000000340), &(0x7f0000000380)=0x4) fchown(r2, r4, r5) ioctl$EVIOCGPHYS(r2, 0x80404507, &(0x7f00000002c0)=""/123) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, &(0x7f00000000c0)={r3}) 14:04:00 executing program 4: perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$smack_thread_current(0xffffffffffffff9c, &(0x7f0000000240)='/proc/thread-self/attr/current\x00', 0x2, 0x0) ioctl$TCSETAF(0xffffffffffffffff, 0x5408, &(0x7f0000000040)) 14:04:00 executing program 0: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x40000, 0x0) r1 = dup3(r0, r0, 0x80000) ioctl$PPPIOCGNPMODE(r1, 0xc008744c, &(0x7f0000000040)={0x3d}) ioctl$TCFLSH(r0, 0x540b, 0x1) 14:04:00 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSPTLCK(r0, 0x40045431, &(0x7f0000000180)) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) socket(0x200000000000011, 0x4000000000080002, 0x0) bind$packet(0xffffffffffffffff, 0x0, 0x0) sendmmsg(0xffffffffffffffff, &(0x7f0000007880)=[{{&(0x7f00000001c0)=@l2={0x1f, 0xbf53, {0x9, 0x7, 0xfffffffffffffdd5, 0x1ff, 0x2, 0x4}}, 0x80, 0x0}}, {{0x0, 0x0, &(0x7f0000007780)}}], 0x2, 0x4048851) setsockopt$packet_int(0xffffffffffffffff, 0x107, 0x0, 0x0, 0x0) syz_open_procfs(0x0, 0x0) ioctl$LOOP_SET_BLOCK_SIZE(0xffffffffffffffff, 0x4c09, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$cgroup_int(0xffffffffffffffff, 0x0, 0x2, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='\x89\x00\x00\x00\x00Ew\x00\x00\x00\xef\xb4\xc8\xd0\xff\xda\xb1vents\xd9\xc5H\xd4\x91\xfdN_]\x16\xe4\xa9C\xd2\x86Qn\xefS\x80\x11J\xfb4\x14\x86 4\x95\x9e\xfc\xc1\a\xcb \x95N\xe9\xa4j\xd2\x1f^\xb0\xb2>\xa3\xc9\xb7$\x11`t\x03: \x8b\xa4\x05\xf2?E\xdb+{t\xb8\xf7\xab\x8b\x100#', 0x26e1, 0x0) ioctl$PERF_EVENT_IOC_PAUSE_OUTPUT(r1, 0x40086602, 0x400007) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000280)='./cgroup/syz0\x00', 0x1ff) openat$smack_thread_current(0xffffffffffffff9c, &(0x7f0000000240)='/proc/thread-self/attr/current\x00', 0x2, 0x0) write$cgroup_subtree(r1, &(0x7f0000000100)=ANY=[], 0xff4a) write$cgroup_subtree(r2, &(0x7f0000000000)=ANY=[], 0x20032600) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a0f, 0x1700) accept$inet(0xffffffffffffffff, &(0x7f0000000040)={0x2, 0x0, @local}, &(0x7f0000000080)=0x10) ioctl$TCSETAF(r0, 0x5408, &(0x7f0000000040)={0x2}) ioctl$EXT4_IOC_GROUP_ADD(r0, 0x40286608, &(0x7f0000000000)={0x3, 0x7000000, 0x400, 0x100000000, 0x0, 0x8}) r3 = fcntl$dupfd(r0, 0x406, r0) ioctl$EVIOCGVERSION(r3, 0x80044501, &(0x7f0000000200)=""/31) write$binfmt_misc(r0, &(0x7f0000000080)={'syz1', "80fa25cdc862d216160cfa92845a3916e38a409a159c03f1889971d3e5144a8d08de78c4b1fbee457437261d7668b1c0f582647ad4134a05358d4309a71a702002329e024cac95642e761bb842bc1056bd6bf12c47697a649a026bd8ee1f685089941469b1ddfeddf32b392f0ff07652a3bce0770bc3bb70862845a65054cecb191e80b825d740fe6b40450359757032425dfdee92aec36ce4b468d50adc745c522cc4af2ac6e7f6a95f0edd70b09caa95fcc7143cf46b74db8bc17fa7c89f"}, 0xc3) 14:04:00 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0x0, 0x802) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f00000001c0)=[@acquire], 0x0, 0x0, 0x0}) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x2000004, 0x4010, r0, 0x0) [ 347.317069] binder: undelivered TRANSACTION_ERROR: 29201 [ 347.323921] binder: 12220:12235 got transaction to invalid handle [ 347.323929] binder: 12220:12235 transaction failed 29201/-22, size 0-8 line 3119 14:04:00 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = openat$zero(0xffffffffffffff9c, &(0x7f0000000040)='/dev/zero\x00', 0x349000, 0x0) getsockopt$EBT_SO_GET_INFO(r1, 0x0, 0x80, &(0x7f0000000100)={'filter\x00'}, &(0x7f0000000180)=0x78) ioctl$SIOCGSTAMP(r1, 0x8906, &(0x7f0000000080)) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) epoll_ctl$EPOLL_CTL_MOD(r1, 0x3, r0, &(0x7f00000000c0)={0x2018}) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, &(0x7f0000000000)) [ 347.366245] binder: undelivered TRANSACTION_ERROR: 29201 14:04:00 executing program 4: perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$smack_thread_current(0xffffffffffffff9c, &(0x7f0000000240)='/proc/thread-self/attr/current\x00', 0x2, 0x0) ioctl$TCSETAF(0xffffffffffffffff, 0x5408, &(0x7f0000000040)) 14:04:00 executing program 3: syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="0563044000203e56dcb7a3fb075100008dfe1b7586c2afb99ef6d7967fbf67a39bbccc417d9eb92f31bde7a2c5766902bd0229b8"], 0x0, 0x0, 0x0}) r1 = openat$full(0xffffffffffffff9c, &(0x7f0000000000)='/dev/full\x00', 0x40100, 0x0) setsockopt$IP_VS_SO_SET_DELDEST(r1, 0x0, 0x488, &(0x7f0000000040)={{0x3b, @empty, 0x4e24, 0x3, 'lc\x00', 0x29, 0x81, 0x33}, {@empty, 0x4e22, 0x0, 0x10000, 0xffffffffffffffff, 0x100000001}}, 0x44) 14:04:00 executing program 0: r0 = syz_open_procfs$namespace(0x0, &(0x7f0000000000)='ns/user\x00') preadv(r0, &(0x7f0000000140)=[{&(0x7f0000000040)=""/216, 0xd8}, {&(0x7f0000000200)=""/194, 0xc2}, {&(0x7f0000000300)=""/250, 0xfa}, {&(0x7f0000000400)=""/222, 0xde}, {&(0x7f0000000500)=""/225, 0xe1}], 0x5, 0x0) r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000d80)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(r1, 0x540b, 0x1) r2 = open(&(0x7f0000000dc0)='./file0/file0\x00', 0x0, 0x43) setsockopt$ARPT_SO_SET_REPLACE(r2, 0x0, 0x60, &(0x7f0000000e40)={'filter\x00', 0x7, 0x4, 0x470, 0x270, 0x130, 0x130, 0x388, 0x388, 0x388, 0x4, &(0x7f0000000e00), {[{{@arp={@multicast1, @initdev={0xac, 0x1e, 0x1, 0x0}, 0xffffffff, 0xff, @mac=@remote, {[0xff, 0x0, 0xff, 0xff, 0xff]}, @empty, {[0xff, 0xff, 0xff, 0x0, 0xff, 0xff]}, 0x6, 0x400, 0x2, 0x1, 0x2, 0x94b3, 'irlan0\x00', 'ipddp0\x00', {}, {}, 0x0, 0x22c}, 0xf0, 0x130}, @unspec=@RATEEST={0x40, 'RATEEST\x00', 0x0, {'syz1\x00', 0x7f, 0x8, 0x100000000}}}, {{@arp={@remote, @remote, 0xffffffff, 0xff, @mac=@broadcast, {[0x0, 0xff, 0xff, 0x0, 0xff]}, @mac=@remote, {[0xff, 0xff, 0x0, 0xff, 0xff]}, 0xfffffffffffeffff, 0x1, 0x5, 0xa907, 0x102000000000000, 0x7, 'dummy0\x00', 'syzkaller0\x00', {0xff}, {}, 0x0, 0x60}, 0xf0, 0x140}, @mangle={0x50, 'mangle\x00', 0x0, {@empty, @mac=@remote, @dev={0xac, 0x14, 0x14, 0xd}, @initdev={0xac, 0x1e, 0x0, 0x0}, 0x1, 0xffffffff}}}, {{@arp={@rand_addr=0x7ff, @multicast2, 0xff000000, 0xffffff00, @empty, {[0xff, 0xff, 0xff, 0xff, 0xff, 0xff]}, @empty, {[0xff, 0xff, 0xff]}, 0x2, 0x6, 0x5, 0x3, 0x7fff, 0x1, 'syzkaller1\x00', 'ifb0\x00', {0xff}, {}, 0x0, 0x14}, 0xf0, 0x118}, @unspec=@NFQUEUE3={0x28, 'NFQUEUE\x00', 0x3, {0x0, 0x81, 0x3}}}], {{[], 0xc0, 0xe8}, {0x28}}}}, 0x4c0) ioctl$sock_SIOCGPGRP(0xffffffffffffff9c, 0x8904, &(0x7f00000008c0)=0x0) getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffff9c, 0x29, 0x22, &(0x7f0000000900)={{{@in6=@mcast1, @in6=@empty, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@multicast1}}}, &(0x7f0000000a00)=0xe8) r5 = getgid() r6 = getpgrp(0xffffffffffffffff) getsockopt$inet_IP_IPSEC_POLICY(r0, 0x0, 0x10, &(0x7f0000000a40)={{{@in=@loopback, @in=@loopback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@dev}, 0x0, @in=@local}}, &(0x7f0000000b40)=0xe8) r8 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f00000001c0)='/selinux/enforce\x00', 0x101000, 0x0) setsockopt$IP_VS_SO_SET_TIMEOUT(r8, 0x0, 0x48a, &(0x7f0000000d40)={0x100000000, 0x20d, 0x1}, 0xc) stat(&(0x7f0000000b80)='./file0\x00', &(0x7f0000000bc0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) sendmsg$unix(r0, &(0x7f0000000d00)={&(0x7f0000000640)=@abs={0x0, 0x0, 0x4e20}, 0x6e, &(0x7f0000000880)=[{&(0x7f00000006c0)="a19fdac00a0f8b271ead591f8a742ed48e6c0bac6d19a7026dec35d55d220fab888baa8b6b5d4397ef23db5eee19f3980ca79b2470906bc5250a1686d3669bec0e4f83f541f9dacf4971717edb2254c5d59f6fd24bee33a8e0fe21eca127df5e9ccacc10b527929453817b2641c0cb7cd6ffcb0200c8af943e355344d9d8d9a24014cb4f585226361262c5c146645705eb2cf509188694de1db8684512d799408ea7841c01b36861298013f9dacd6704793741774fe83099e686f67240bb09dcda89d9c1c99d374074ea7076eb73e917f8fc36245096e7b6e19788a37e3769b6b7f0bc2584ec4fe2407728cd6f9f3f374ff85d088ff10fbc", 0xf8}, {&(0x7f00000007c0)="b51868d2000e0d651b81ec8c6acfa7f6f6589519026c203ce92a954a4b9b1922f8f16d1c57e33c0fd0774aaae962a9440b6899f7d9f524c7acd2026e8d7d2adadf7f9688b584dddc3cdb3972c5b86941b898ed8a01d9c272e5b9f33a28f6ea720491efaf9e154ecc363ebe78e7ca92fe77fa14bba2c6085985f7b92e056b29eef0bac7a432f5064dbf50412d", 0x8c}], 0x2, &(0x7f0000000c40)=[@rights={0x18, 0x1, 0x1, [r0, r0]}, @cred={0x20, 0x1, 0x2, r3, r4, r5}, @cred={0x20, 0x1, 0x2, r6, r7, r9}, @rights={0x18, 0x1, 0x1, [r0, r0]}, @rights={0x20, 0x1, 0x1, [r1, r0, r1]}], 0x90, 0x4}, 0x91) r10 = eventfd(0x6c22) write$eventfd(r10, &(0x7f0000000600)=0x47, 0x8) 14:04:00 executing program 5: openat$selinux_avc_cache_threshold(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/avc/cache_threshold\x00', 0x2, 0x0) r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, &(0x7f0000000000)) socketpair(0x5, 0x3, 0x4, &(0x7f0000000040)={0xffffffffffffffff}) setsockopt$inet_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000080)='nv\x00', 0x3) 14:04:00 executing program 4: perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$smack_thread_current(0xffffffffffffff9c, &(0x7f0000000240)='/proc/thread-self/attr/current\x00', 0x2, 0x0) ioctl$TCSETAF(0xffffffffffffffff, 0x5408, &(0x7f0000000040)) [ 347.375158] binder: 12250:12255 Acquire 1 refcount change on invalid ref 0 ret -22 [ 347.385865] binder: 12250:12258 Acquire 1 refcount change on invalid ref 0 ret -22 14:04:01 executing program 1: r0 = socket(0x0, 0x0, 0x0) syz_open_procfs(0x0, 0x0) ioctl$sock_SIOCGPGRP(r0, 0x8904, &(0x7f0000000080)=0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x1ff, 0x0, 0x4000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, r1, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$cgroup_int(0xffffffffffffffff, 0x0, 0x2, 0x0) r2 = openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x7a05, 0x1700) openat$smack_thread_current(0xffffffffffffff9c, &(0x7f0000000340)='/proc/thread-self/attr/current\x00', 0x2, 0x0) write$cgroup_subtree(0xffffffffffffffff, 0x0, 0x0) setxattr$security_smack_entry(&(0x7f0000000100)='./file0\x00', &(0x7f0000000140)='security.SMACK64IPOUT\x00', &(0x7f0000000200)='/proc/thread-self/attr/current\x00', 0x1f, 0x2) ioctl$TCSETAF(0xffffffffffffffff, 0x5408, &(0x7f0000000040)) ioctl$EXT4_IOC_GROUP_ADD(0xffffffffffffffff, 0x40286608, 0x0) ioctl$EVIOCGVERSION(r2, 0x80044501, 0x0) ioctl$RTC_PLL_SET(r2, 0x40207012, &(0x7f00000000c0)={0x7, 0x101, 0x8001, 0x41, 0xfffffffffffff001, 0x9, 0x2}) ioctl$BLKIOOPT(r2, 0x1279, &(0x7f0000000000)) [ 347.436121] binder: BINDER_SET_CONTEXT_MGR already set 14:04:01 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) r2 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000000)='net/route\x00') setns(r2, 0x2000000) mmap(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x8, 0x13, r0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\a'], 0x0, 0x0, 0x0}) ioctl$PPPIOCNEWUNIT(r2, 0xc004743e, &(0x7f00000000c0)=0x4) utimensat(r2, &(0x7f0000000040)='./file0\x00', &(0x7f0000000080), 0x46716311eee74688) fchdir(r0) 14:04:01 executing program 0: r0 = creat(&(0x7f0000000000)='./file0\x00', 0x80) ioctl$TIOCGSOFTCAR(r0, 0x5419, &(0x7f0000000040)) r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(r1, 0x540b, 0x1) 14:04:01 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSPTLCK(r0, 0x40045431, &(0x7f0000000180)) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) socket(0x200000000000011, 0x4000000000080002, 0x0) bind$packet(0xffffffffffffffff, 0x0, 0x0) sendmmsg(0xffffffffffffffff, &(0x7f0000007880)=[{{&(0x7f00000001c0)=@l2={0x1f, 0xbf53, {0x9, 0x7, 0xfffffffffffffdd5, 0x1ff, 0x2, 0x4}, 0x0, 0x7}, 0x80, 0x0}}, {{0x0, 0x0, &(0x7f0000007780)}}], 0x2, 0x0) setsockopt$packet_int(0xffffffffffffffff, 0x107, 0x0, 0x0, 0x0) syz_open_procfs(0x0, 0x0) ioctl$LOOP_SET_BLOCK_SIZE(0xffffffffffffffff, 0x4c09, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$cgroup_int(0xffffffffffffffff, 0x0, 0x2, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='\x89\x00\x00\x00\x00Ew\x00\x00\x00\xef\xb4\xc8\xd0\xff\xda\xb1vents\xd9\xc5H\xd4\x91\xfdN_]\x16\xe4\xa9C\xd2\x86Qn\xefS\x80\x11J\xfb4\x14\x86 4\x95\x9e\xfc\xc1\a\xcb \x95N\xe9\xa4j\xd2\x1f^\xb0\xb2>\xa3\xc9\xb7$\x11`t\x03: \x8b\xa4\x05\xf2?E\xdb+{t\xb8\xf7\xab\x8b\x100#', 0x26e1, 0x0) ioctl$PERF_EVENT_IOC_PAUSE_OUTPUT(r1, 0x40086602, 0x400007) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000280)='./cgroup/syz0\x00', 0x1ff) openat$smack_thread_current(0xffffffffffffff9c, &(0x7f0000000240)='/proc/thread-self/attr/current\x00', 0x2, 0x0) write$cgroup_subtree(r1, &(0x7f0000000100)=ANY=[], 0xff4a) write$cgroup_subtree(r2, &(0x7f0000000000)=ANY=[], 0x20032600) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a0f, 0x1700) accept$inet(0xffffffffffffffff, &(0x7f0000000040)={0x2, 0x0, @local}, &(0x7f0000000080)=0x10) ioctl$TCSETAF(r0, 0x5408, &(0x7f0000000040)={0x2}) ioctl$EXT4_IOC_GROUP_ADD(r0, 0x40286608, &(0x7f0000000000)={0x3, 0x7000000, 0x400, 0x100000000, 0x0, 0x8}) r3 = fcntl$dupfd(r0, 0x406, r0) ioctl$EVIOCGVERSION(r3, 0x80044501, &(0x7f0000000200)=""/31) write$binfmt_misc(r0, &(0x7f0000000080)={'syz1', "80fa25cdc862d216160cfa92845a3916e38a409a159c03f1889971d3e5144a8d08de78c4b1fbee457437261d7668b1c0f582647ad4134a05358d4309a71a702002329e024cac95642e761bb842bc1056bd6bf12c47697a649a026bd8ee1f685089941469b1ddfeddf32b392f0ff07652a3bce0770bc3bb70862845a65054cecb191e80b825d740fe6b40450359757032425dfdee92aec36ce4b468d50adc745c522cc4af2ac6e7f6a95f0edd70b09caa95fcc7143cf46b74db8bc17fa7c89f"}, 0xc3) 14:04:01 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) prctl$PR_SET_FPEMU(0xa, 0x2) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, &(0x7f0000000000)) 14:04:01 executing program 4: perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$smack_thread_current(0xffffffffffffff9c, &(0x7f0000000240)='/proc/thread-self/attr/current\x00', 0x2, 0x0) ioctl$TCSETAF(0xffffffffffffffff, 0x5408, &(0x7f0000000040)) 14:04:01 executing program 3: syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], 0x0, 0x0, 0x0}) setxattr(&(0x7f0000000240)='./file0\x00', &(0x7f0000000280)=@random={'btrfs.', '[em0procvmnet1$lo\xe4+)eth1%$vboxnet1\x00'}, &(0x7f00000002c0)='team_slave_1\x00', 0xd, 0x3) r1 = fcntl$dupfd(r0, 0x406, r0) r2 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000040)='IPVS\x00') sendmsg$IPVS_CMD_GET_DEST(r1, &(0x7f0000000200)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x100004}, 0xc, &(0x7f0000000180)={&(0x7f0000000080)={0x100, r2, 0x80a, 0x70bd2c, 0x25dfdbfe, {}, [@IPVS_CMD_ATTR_DAEMON={0xc, 0x3, [@IPVS_DAEMON_ATTR_SYNC_ID={0x8, 0x3, 0x4}]}, @IPVS_CMD_ATTR_DAEMON={0x64, 0x3, [@IPVS_DAEMON_ATTR_STATE={0x8}, @IPVS_DAEMON_ATTR_MCAST_PORT={0x8, 0x7, 0x4e21}, @IPVS_DAEMON_ATTR_MCAST_GROUP={0x8, 0x5, @multicast1}, @IPVS_DAEMON_ATTR_STATE={0x8}, @IPVS_DAEMON_ATTR_MCAST_GROUP6={0x14, 0x6, @dev={0xfe, 0x80, [], 0xc}}, @IPVS_DAEMON_ATTR_MCAST_GROUP={0x8, 0x5, @rand_addr=0x1}, @IPVS_DAEMON_ATTR_SYNC_ID={0x8, 0x3, 0x4}, @IPVS_DAEMON_ATTR_STATE={0x8}, @IPVS_DAEMON_ATTR_MCAST_IFN={0x14, 0x2, 'team_slave_1\x00'}]}, @IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0x625f}, @IPVS_CMD_ATTR_TIMEOUT_UDP={0x8}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x81}, @IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0x6}, @IPVS_CMD_ATTR_DAEMON={0x38, 0x3, [@IPVS_DAEMON_ATTR_MCAST_GROUP6={0x14, 0x6, @mcast2}, @IPVS_DAEMON_ATTR_STATE={0x8}, @IPVS_DAEMON_ATTR_MCAST_TTL={0x8, 0x8, 0x7ff}, @IPVS_DAEMON_ATTR_MCAST_PORT={0x8, 0x7, 0x4e20}, @IPVS_DAEMON_ATTR_SYNC_MAXLEN={0x8, 0x4, 0x10000}]}, @IPVS_CMD_ATTR_DAEMON={0x14, 0x3, [@IPVS_DAEMON_ATTR_STATE={0x8, 0x1, 0x1}, @IPVS_DAEMON_ATTR_MCAST_TTL={0x8, 0x8, 0x200}]}, @IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0x8}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x5}]}, 0x100}, 0x1, 0x0, 0x0, 0x80}, 0x4000000) restart_syscall() ioctl$TIOCLINUX3(r1, 0x541c, &(0x7f00000004c0)) write$P9_RREADDIR(r0, &(0x7f0000000440)=ANY=[@ANYBLOB="6800000029020022760000020400000000000000000000000900000000000000ff07002e2f66696c65300c020000000500000000000000ab8b0000000001000407002e2f66696c65304001000000040000000000000003000000000000000407002e2f66696c6530"], 0x68) ioctl$UI_SET_SNDBIT(r1, 0x4004556a, 0x1) ioctl$TIOCGPGRP(r1, 0x540f, &(0x7f0000000300)=0x0) wait4(r3, &(0x7f0000000340), 0x60000005, &(0x7f0000000380)) 14:04:01 executing program 1: socket(0x0, 0x0, 0x0) r0 = syz_open_procfs(0x0, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) timer_create(0x1, &(0x7f00000000c0)={0x0, 0xc, 0x4}, &(0x7f0000000100)=0x0) timer_getoverrun(r1) getsockopt$inet6_IPV6_IPSEC_POLICY(r0, 0x29, 0x22, &(0x7f0000001500)={{{@in=@multicast1, @in=@remote, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@loopback}, 0x0, @in6=@loopback}}, &(0x7f0000001600)=0xe8) getsockopt$inet6_IPV6_XFRM_POLICY(r0, 0x29, 0x23, &(0x7f0000001640)={{{@in6=@mcast2, @in=@empty, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{}, 0x0, @in=@multicast1}}, &(0x7f0000001740)=0xe8) setsockopt$inet6_IPV6_XFRM_POLICY(r0, 0x29, 0x23, &(0x7f0000001780)={{{@in=@rand_addr=0x3, @in6=@rand_addr="6b963f9d5a77dfed62d788a440856224", 0x4e22, 0x2, 0x4e20, 0x3, 0xa, 0x80, 0x20, 0x33, r2, r3}, {0x5, 0x8000, 0x3, 0x23, 0x5, 0x3ff, 0x8, 0x400}, {0x1, 0x8000, 0x7, 0xb1e4}, 0xffffffff, 0x6e6bbc, 0x3, 0x1, 0x1, 0x3}, {{@in6=@dev={0xfe, 0x80, [], 0x1e}, 0x4d3, 0x32}, 0xa, @in6=@empty, 0x3501, 0x3, 0xc538a90d0cd7817c, 0x10001, 0x6, 0x1, 0x100000001}}, 0xe8) openat$cgroup_int(0xffffffffffffffff, 0x0, 0x2, 0x0) r4 = openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x7a05, 0x1700) openat$smack_thread_current(0xffffffffffffff9c, &(0x7f0000000240)='/proc/thread-self/attr/current\x00', 0x2, 0x0) write$cgroup_subtree(0xffffffffffffffff, 0x0, 0x0) ioctl$TCSETAF(0xffffffffffffffff, 0x5408, &(0x7f0000000040)) ioctl$EXT4_IOC_GROUP_ADD(0xffffffffffffffff, 0x40286608, 0x0) ioctl$TIOCGETD(r4, 0x5424, &(0x7f0000000080)) setsockopt$inet6_tcp_TCP_ULP(r0, 0x6, 0x1f, &(0x7f0000000000)='tls\x00', 0x4) ioctl$EVIOCGVERSION(0xffffffffffffffff, 0x80044501, 0x0) [ 347.436130] binder: 12261:12263 ioctl 40046207 0 returned -16 [ 347.439913] binder: BINDER_SET_CONTEXT_MGR already set 14:04:01 executing program 0: openat$ptmx(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/ptmx\x00', 0x0, 0x0) r0 = openat$selinux_mls(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/mls\x00', 0x0, 0x0) ioctl$TCFLSH(r0, 0x540b, 0x1) 14:04:01 executing program 3: socket$inet6_icmp_raw(0xa, 0x3, 0x3a) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="056704400000001fc50a0ef6417d0307cdb1268d96db692d69c56ad9f9369f78b23f689d746626ed1a1e45ab9a69adf61d84fcfecf40cebad27631c77549cad60eb79dad07"], 0x0, 0x0, 0x0}) fsetxattr$security_ima(0xffffffffffffffff, &(0x7f0000000080)='security.ima\x00', &(0x7f00000000c0)=@md5={0x1, "dd67e0f0ba36cfaa94985ffd34e0cb82"}, 0x11, 0x3) [ 347.439921] binder: 12261:12268 ioctl 40046207 0 returned -16 [ 347.451224] binder: 12265:12271 Acquire 1 refcount change on invalid ref 1446912000 ret -22 14:04:01 executing program 5: r0 = syz_open_dev$mice(&(0x7f0000000040)='/dev/input/mice\x00', 0x0, 0x200000) ioctl$BINDER_GET_NODE_DEBUG_INFO(0xffffffffffffffff, 0xc018620b, &(0x7f0000000080)={0x0}) r2 = mmap$binder(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x2000000, 0x4010, 0xffffffffffffff9c, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x28, 0x0, &(0x7f00000000c0)=[@acquire_done={0x40106309, r1, 0x4}, @acquire_done={0x40106309, r2}], 0xbf, 0x0, &(0x7f0000000100)="020f9d5de39126be9ff0f23af12128ffad6b09b1841a9eb361e38f6787ef6a1fa703d3d8d841ef3a32f43e2cb2ac5f5039f1750e28ebeb73de4a63a75907607ceb641994d48f422f004a3b5177f67e68a74939bc32e434a94217f8a178de3b900fe971a02b4ed47d787a4f80ea8c02bb71e8551f649657a15a40bea9383f768109b0460f7c30bc65203159da1016bec904a74e408228c126a822377170c8bf84492211ca5d5342766d78c563c33f455a1f7a2b4a76e0fe2b3df8a3ab0402b2"}) r3 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r3, 0x40046207, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r3, 0xc018620b, &(0x7f0000000000)) 14:04:01 executing program 4: perf_event_open(&(0x7f0000000180)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$smack_thread_current(0xffffffffffffff9c, &(0x7f0000000240)='/proc/thread-self/attr/current\x00', 0x2, 0x0) ioctl$TCSETAF(0xffffffffffffffff, 0x5408, &(0x7f0000000040)) 14:04:01 executing program 3: syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB="0563214000000000"], 0x0, 0x0, 0x0}) 14:04:01 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, &(0x7f0000000000)) [ 347.477708] binder: 12265:12276 Acquire 1 refcount change on invalid ref 1446912000 ret -22 [ 347.493314] binder: BINDER_SET_CONTEXT_MGR already set 14:04:01 executing program 4: perf_event_open(&(0x7f0000000180)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$smack_thread_current(0xffffffffffffff9c, &(0x7f0000000240)='/proc/thread-self/attr/current\x00', 0x2, 0x0) ioctl$TCSETAF(0xffffffffffffffff, 0x5408, &(0x7f0000000040)) 14:04:01 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSPTLCK(r0, 0x40045431, &(0x7f0000000180)) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) socket(0x200000000000011, 0x4000000000080002, 0x0) bind$packet(0xffffffffffffffff, 0x0, 0x0) sendmmsg(0xffffffffffffffff, &(0x7f0000007880)=[{{&(0x7f00000001c0)=@l2={0x1f, 0xbf53, {0x9, 0x7, 0xfffffffffffffdd5, 0x1ff, 0x2, 0x4}, 0x0, 0x7}, 0x80, 0x0}}, {{0x0, 0x0, &(0x7f0000007780)}}], 0x2, 0x0) setsockopt$packet_int(0xffffffffffffffff, 0x107, 0x0, 0x0, 0x0) syz_open_procfs(0x0, 0x0) ioctl$LOOP_SET_BLOCK_SIZE(0xffffffffffffffff, 0x4c09, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$cgroup_int(0xffffffffffffffff, 0x0, 0x2, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='\x89\x00\x00\x00\x00Ew\x00\x00\x00\xef\xb4\xc8\xd0\xff\xda\xb1vents\xd9\xc5H\xd4\x91\xfdN_]\x16\xe4\xa9C\xd2\x86Qn\xefS\x80\x11J\xfb4\x14\x86 4\x95\x9e\xfc\xc1\a\xcb \x95N\xe9\xa4j\xd2\x1f^\xb0\xb2>\xa3\xc9\xb7$\x11`t\x03: \x8b\xa4\x05\xf2?E\xdb+{t\xb8\xf7\xab\x8b\x100#', 0x26e1, 0x0) ioctl$PERF_EVENT_IOC_PAUSE_OUTPUT(r1, 0x40086602, 0x400007) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000280)='./cgroup/syz0\x00', 0x1ff) openat$smack_thread_current(0xffffffffffffff9c, &(0x7f0000000240)='/proc/thread-self/attr/current\x00', 0x2, 0x0) write$cgroup_subtree(r1, &(0x7f0000000100)=ANY=[], 0xff4a) write$cgroup_subtree(r2, &(0x7f0000000000)=ANY=[], 0x20032600) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a0f, 0x1700) accept$inet(0xffffffffffffffff, &(0x7f0000000040)={0x2, 0x0, @local}, &(0x7f0000000080)=0x10) ioctl$TCSETAF(r0, 0x5408, &(0x7f0000000040)={0x2}) ioctl$EXT4_IOC_GROUP_ADD(r0, 0x40286608, &(0x7f0000000000)={0x3, 0x7000000, 0x400, 0x100000000, 0x0, 0x8}) r3 = fcntl$dupfd(r0, 0x406, r0) ioctl$EVIOCGVERSION(r3, 0x80044501, &(0x7f0000000200)=""/31) write$binfmt_misc(r0, &(0x7f0000000080)={'syz1', "80fa25cdc862d216160cfa92845a3916e38a409a159c03f1889971d3e5144a8d08de78c4b1fbee457437261d7668b1c0f582647ad4134a05358d4309a71a702002329e024cac95642e761bb842bc1056bd6bf12c47697a649a026bd8ee1f685089941469b1ddfeddf32b392f0ff07652a3bce0770bc3bb70862845a65054cecb191e80b825d740fe6b40450359757032425dfdee92aec36ce4b468d50adc745c522cc4af2ac6e7f6a95f0edd70b09caa95fcc7143cf46b74db8bc17fa7c89f"}, 0xc3) 14:04:01 executing program 5: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='memory.swap.current\x00', 0x0, 0x0) mkdirat$cgroup(r0, &(0x7f0000000080)='\x06\x00\x00\xbc\x00', 0x1ff) r1 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r1, 0xc018620b, &(0x7f0000000000)) 14:04:01 executing program 0: r0 = creat(&(0x7f0000000000)='./file0\x00', 0x44) getsockopt$inet_tcp_TCP_ZEROCOPY_RECEIVE(r0, 0x6, 0x23, &(0x7f0000000040)={&(0x7f0000ffe000/0x2000)=nil, 0x2000}, &(0x7f0000000080)=0x10) r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(r1, 0x540b, 0x1) 14:04:01 executing program 3: syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="ecf57b1ee85a020005630467ffa8ce0c2d4000000000"], 0x0, 0x0, 0x0}) r1 = syz_open_dev$mice(&(0x7f0000000000)='/dev/input/mice\x00', 0x0, 0x600) ioctl$VT_GETSTATE(r1, 0x5603, &(0x7f00000001c0)={0x0, 0x1, 0x81}) r2 = accept(0xffffffffffffff9c, &(0x7f0000000040)=@nl, &(0x7f00000000c0)=0x80) getsockopt$inet6_buf(r2, 0x29, 0x35, &(0x7f0000000100)=""/18, &(0x7f0000000140)=0x12) [ 347.493323] binder: 12275:12280 ioctl 40046207 0 returned -16 [ 347.527713] binder: 12286:12291 unknown command 0 [ 347.527722] binder: 12286:12291 ioctl c0306201 20012000 returned -22 14:04:01 executing program 1: socket(0x0, 0x0, 0x0) r0 = syz_open_procfs(0x0, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) setsockopt$inet_tcp_TCP_REPAIR_OPTIONS(r0, 0x6, 0x16, &(0x7f0000000000)=[@timestamp, @timestamp, @mss={0x2, 0x9}, @window={0x3, 0x9}, @sack_perm, @mss={0x2, 0x1}, @sack_perm, @mss={0x2, 0x2}], 0x8) openat$cgroup_int(0xffffffffffffffff, 0x0, 0x2, 0x0) openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x7a05, 0x1700) openat$smack_thread_current(0xffffffffffffff9c, &(0x7f0000000240)='/proc/thread-self/attr/current\x00', 0x2, 0x0) write$cgroup_subtree(0xffffffffffffffff, 0x0, 0x0) ioctl$TCSETAF(0xffffffffffffffff, 0x5408, &(0x7f0000000040)) ioctl$EXT4_IOC_GROUP_ADD(0xffffffffffffffff, 0x40286608, 0x0) ioctl$EVIOCGVERSION(0xffffffffffffffff, 0x80044501, 0x0) pread64(r0, &(0x7f0000000080)=""/66, 0x42, 0x0) 14:04:01 executing program 4: perf_event_open(&(0x7f0000000180)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$smack_thread_current(0xffffffffffffff9c, &(0x7f0000000240)='/proc/thread-self/attr/current\x00', 0x2, 0x0) ioctl$TCSETAF(0xffffffffffffffff, 0x5408, &(0x7f0000000040)) 14:04:01 executing program 0: pipe2(&(0x7f0000000040), 0x84000) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) r1 = dup(r0) ioctl$TIOCGWINSZ(r1, 0x5413, &(0x7f0000000000)) r2 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(r2, 0x540b, 0x1) 14:04:01 executing program 5: pipe(&(0x7f0000000100)={0xffffffffffffffff}) ioctl$BINDER_GET_NODE_DEBUG_INFO(0xffffffffffffff9c, 0xc018620b, &(0x7f0000000280)={0x0}) ioctl$BINDER_GET_NODE_DEBUG_INFO(0xffffffffffffff9c, 0xc018620b, &(0x7f00000002c0)={0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x80, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x4, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x48, 0x10, &(0x7f00000001c0)=[@fda={0x66646185, 0x8, 0x4, 0x1a}, @ptr={0x70742a85, 0x1, &(0x7f0000000180), 0x1, 0x3, 0x30}], &(0x7f0000000240)=[0x18, 0x0]}}, @free_buffer={0x40086303, r1}, @dead_binder_done, @register_looper, @acquire_done={0x40106309, r2, 0x2}, @register_looper, @release={0x40046306, 0x1}], 0x39, 0x0, &(0x7f0000000380)="0da02fe0edafd73ff3401199406905c22b4dbcac1bab322ab3b8c4d853528134ee76b47f8f2fc5268c81021ce670edc01ee11ab5e3228d9058"}) r3 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r3, 0x40046207, 0x0) r4 = mmap$binder(&(0x7f0000ffc000/0x2000)=nil, 0x2000, 0x0, 0x80010, r3, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r3, 0xc018620b, &(0x7f0000000140)={r4}) r5 = openat$selinux_avc_cache_stats(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/avc/cache_stats\x00', 0x0, 0x0) ioctl$PPPIOCNEWUNIT(r5, 0xc004743e, &(0x7f00000000c0)=0x1) r6 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x20) setsockopt$netlink_NETLINK_BROADCAST_ERROR(r6, 0x10e, 0x4, &(0x7f0000000580)=0xa, 0x54c) [ 347.539923] binder: 12286:12291 unknown command 0 [ 347.539934] binder: 12286:12291 ioctl c0306201 20012000 returned -22 [ 347.588713] binder: 12302:12307 unknown command 0 14:04:01 executing program 4: perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$smack_thread_current(0xffffffffffffff9c, &(0x7f0000000240)='/proc/thread-self/attr/current\x00', 0x2, 0x0) ioctl$TCSETAF(0xffffffffffffffff, 0x5408, &(0x7f0000000040)) 14:04:01 executing program 0: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(r0, 0x540b, 0x1) tee(r0, r0, 0x9, 0x2) [ 347.588721] binder: 12302:12307 ioctl c0306201 20012000 returned -22 [ 347.589930] binder: BINDER_SET_CONTEXT_MGR already set 14:04:01 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, &(0x7f0000000040)) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, &(0x7f0000000080)={0x0}) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, &(0x7f0000000000)={r1}) 14:04:01 executing program 3: syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0563044000000000dcaaf4b9973ba7a2e2910eabdfc74da621991716a0791b03ad254fb47e8db33aa0797b75ba9543776e045ef0b16b98d96702ca30c3906b8f58f73247303887a56a5d62491239098a4bc679dfee103677278216913946327c5f94c9fec0f24d3604e4cac5dcf5ee59062a09b7dd903f22daa7c6ad250e5a4eb8cf9076dad90e4296eea0e972d6847e4cecace8cc5564be2907be1f5d376304046aa6158c7a2242ac8852decb61b35f78563e55441bab4ffd88e048ae897c71fc650e18202be21ddc7c0735b25a7a139f2f02949ec3ff08214b9ab57f928edfcd44a7b70c54e0d5bf411bf4cfde"], 0x0, 0x0, 0x0}) 14:04:01 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSPTLCK(r0, 0x40045431, &(0x7f0000000180)) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) socket(0x200000000000011, 0x4000000000080002, 0x0) bind$packet(0xffffffffffffffff, 0x0, 0x0) sendmmsg(0xffffffffffffffff, &(0x7f0000007880)=[{{&(0x7f00000001c0)=@l2={0x1f, 0xbf53, {0x9, 0x7, 0xfffffffffffffdd5, 0x1ff, 0x2, 0x4}, 0x0, 0x7}, 0x80, 0x0}}, {{0x0, 0x0, &(0x7f0000007780)}}], 0x2, 0x0) setsockopt$packet_int(0xffffffffffffffff, 0x107, 0x0, 0x0, 0x0) syz_open_procfs(0x0, 0x0) ioctl$LOOP_SET_BLOCK_SIZE(0xffffffffffffffff, 0x4c09, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$cgroup_int(0xffffffffffffffff, 0x0, 0x2, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='\x89\x00\x00\x00\x00Ew\x00\x00\x00\xef\xb4\xc8\xd0\xff\xda\xb1vents\xd9\xc5H\xd4\x91\xfdN_]\x16\xe4\xa9C\xd2\x86Qn\xefS\x80\x11J\xfb4\x14\x86 4\x95\x9e\xfc\xc1\a\xcb \x95N\xe9\xa4j\xd2\x1f^\xb0\xb2>\xa3\xc9\xb7$\x11`t\x03: \x8b\xa4\x05\xf2?E\xdb+{t\xb8\xf7\xab\x8b\x100#', 0x26e1, 0x0) ioctl$PERF_EVENT_IOC_PAUSE_OUTPUT(r1, 0x40086602, 0x400007) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000280)='./cgroup/syz0\x00', 0x1ff) openat$smack_thread_current(0xffffffffffffff9c, &(0x7f0000000240)='/proc/thread-self/attr/current\x00', 0x2, 0x0) write$cgroup_subtree(r1, &(0x7f0000000100)=ANY=[], 0xff4a) write$cgroup_subtree(r2, &(0x7f0000000000)=ANY=[], 0x20032600) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a0f, 0x1700) accept$inet(0xffffffffffffffff, &(0x7f0000000040)={0x2, 0x0, @local}, &(0x7f0000000080)=0x10) ioctl$TCSETAF(r0, 0x5408, &(0x7f0000000040)={0x2}) ioctl$EXT4_IOC_GROUP_ADD(r0, 0x40286608, &(0x7f0000000000)={0x3, 0x7000000, 0x400, 0x100000000, 0x0, 0x8}) r3 = fcntl$dupfd(r0, 0x406, r0) ioctl$EVIOCGVERSION(r3, 0x80044501, &(0x7f0000000200)=""/31) write$binfmt_misc(r0, &(0x7f0000000080)={'syz1', "80fa25cdc862d216160cfa92845a3916e38a409a159c03f1889971d3e5144a8d08de78c4b1fbee457437261d7668b1c0f582647ad4134a05358d4309a71a702002329e024cac95642e761bb842bc1056bd6bf12c47697a649a026bd8ee1f685089941469b1ddfeddf32b392f0ff07652a3bce0770bc3bb70862845a65054cecb191e80b825d740fe6b40450359757032425dfdee92aec36ce4b468d50adc745c522cc4af2ac6e7f6a95f0edd70b09caa95fcc7143cf46b74db8bc17fa7c89f"}, 0xc3) 14:04:01 executing program 4: perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$smack_thread_current(0xffffffffffffff9c, &(0x7f0000000240)='/proc/thread-self/attr/current\x00', 0x2, 0x0) ioctl$TCSETAF(0xffffffffffffffff, 0x5408, &(0x7f0000000040)) 14:04:01 executing program 4: perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$smack_thread_current(0xffffffffffffff9c, &(0x7f0000000240)='/proc/thread-self/attr/current\x00', 0x2, 0x0) ioctl$TCSETAF(0xffffffffffffffff, 0x5408, &(0x7f0000000040)) 14:04:01 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x802) fsetxattr$security_smack_entry(r0, &(0x7f0000000000)='security.SMACK64IPIN\x00', &(0x7f0000000040)='usercgroup($.G\x00', 0xf, 0x2) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB="052dc9de230024c7f9d3c3ef094d87a9fa8eb4900e42928e08cee98eb307ec97"], 0x0, 0x0, 0x0}) [ 347.589938] binder: 12295:12300 ioctl 40046207 0 returned -16 [ 347.592145] binder: BINDER_SET_CONTEXT_MGR already set [ 347.592154] binder: 12295:12300 ioctl 40046207 0 returned -16 14:04:01 executing program 1: r0 = socket(0x0, 0x0, 0x0) r1 = syz_open_procfs(0x0, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$TCSETX(r1, 0x5433, &(0x7f0000000080)={0x5, 0x7ff, [0xc4e, 0x100, 0x2, 0x800, 0xfff], 0x7}) openat$cgroup_int(0xffffffffffffffff, 0x0, 0x2, 0x0) openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x7a05, 0x1700) openat$smack_thread_current(0xffffffffffffff9c, &(0x7f0000000240)='/proc/thread-self/attr/current\x00', 0x2, 0x0) write$cgroup_subtree(0xffffffffffffffff, 0x0, 0x0) ioctl$TCSETAF(0xffffffffffffffff, 0x5408, &(0x7f0000000040)) ioctl$EXT4_IOC_GROUP_ADD(0xffffffffffffffff, 0x40286608, 0x0) ioctl$EVIOCGVERSION(0xffffffffffffffff, 0x80044501, 0x0) ioctl$EXT4_IOC_GROUP_EXTEND(r0, 0x40086607, &(0x7f0000000000)=0x8) ioctl$PIO_FONTRESET(r1, 0x4b6d, 0x0) 14:04:01 executing program 4: perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) openat$smack_thread_current(0xffffffffffffff9c, &(0x7f0000000240)='/proc/thread-self/attr/current\x00', 0x2, 0x0) ioctl$TCSETAF(0xffffffffffffffff, 0x5408, &(0x7f0000000040)) 14:04:01 executing program 0: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/ptmx\x00', 0x0, 0x0) r1 = openat$pfkey(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/net/pfkey\x00', 0x20000, 0x0) timerfd_gettime(r1, &(0x7f0000000040)) ioctl$TCFLSH(r0, 0x540b, 0x4001) 14:04:01 executing program 5: r0 = add_key$keyring(&(0x7f0000000040)='keyring\x00', &(0x7f0000000080)={'syz', 0x0}, 0x0, 0x0, 0xfffffffffffffff9) keyctl$read(0xb, r0, &(0x7f00000000c0)=""/202, 0xca) r1 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r1, 0xc018620b, &(0x7f0000000000)) 14:04:01 executing program 3: syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0x0, 0x802) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000012000)={0xfffffffffffffd87, 0x0, &(0x7f00000001c0)=[@acquire], 0x0, 0x0, 0x0}) ioctl$TIOCSPTLCK(r0, 0x40045431, &(0x7f0000000000)=0x1) [ 347.605320] binder: 12302:12307 ioctl 541c 200004c0 returned -22 [ 347.605406] binder: 12302:12307 ioctl 4004556a 1 returned -22 14:04:01 executing program 0: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(r0, 0x540b, 0x1) ioctl$TCFLSH(r0, 0x540b, 0xfc00000000000000) 14:04:01 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0xffffffffffffffff) getxattr(&(0x7f0000000180)='./file0\x00', &(0x7f00000001c0)=@random={'osx.', 'em0)\x00'}, &(0x7f0000000200)=""/75, 0x4b) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, &(0x7f0000000000)) syz_read_part_table(0x7, 0x1, &(0x7f0000000140)=[{&(0x7f0000000040)="4ab423681c9e3443ad8295145489f6f6c5be8e2ae1dccad08901fe7e25c0d3ec25a75cb0043335f4ba30eb05e35add4f8874370cbb3af14a255e50c7b03dc49782c640a2c083be8599d00e43b421a74efebf038c6740323e4d2b5eeec1aa41da8b4361c08010bc6d49aec97164a5147ca857c0047d1d1c0ee75b2730a36a26ccc556de3bc26760d7630d86e58c1cedf72c5602440681c45d0b3ebbba3877c092e3c8473610d2a25e08839a0a2c2feaa346624f26fa8fe56ae9816d75a9f5fd0dacc805fbe92d86376cff07e5d92d0c967826848e970b69440f9e0dd2be2dca60bd2ee3eb914bf88a502675edb53c", 0xee, 0x1}]) 14:04:01 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSPTLCK(r0, 0x40045431, &(0x7f0000000180)) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) socket(0x200000000000011, 0x4000000000080002, 0x0) bind$packet(0xffffffffffffffff, 0x0, 0x0) sendmmsg(0xffffffffffffffff, &(0x7f0000007880)=[{{&(0x7f00000001c0)=@l2={0x1f, 0xbf53, {0x9, 0x7, 0xfffffffffffffdd5, 0x1ff, 0x2, 0x4}, 0x0, 0x7}, 0x80, 0x0}}, {{0x0, 0x0, &(0x7f0000007780)}}], 0x2, 0x4048851) setsockopt$packet_int(0xffffffffffffffff, 0x107, 0x0, 0x0, 0x0) syz_open_procfs(0x0, 0x0) ioctl$LOOP_SET_BLOCK_SIZE(0xffffffffffffffff, 0x4c09, 0x0) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$cgroup_int(0xffffffffffffffff, 0x0, 0x2, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='\x89\x00\x00\x00\x00Ew\x00\x00\x00\xef\xb4\xc8\xd0\xff\xda\xb1vents\xd9\xc5H\xd4\x91\xfdN_]\x16\xe4\xa9C\xd2\x86Qn\xefS\x80\x11J\xfb4\x14\x86 4\x95\x9e\xfc\xc1\a\xcb \x95N\xe9\xa4j\xd2\x1f^\xb0\xb2>\xa3\xc9\xb7$\x11`t\x03: \x8b\xa4\x05\xf2?E\xdb+{t\xb8\xf7\xab\x8b\x100#', 0x26e1, 0x0) ioctl$PERF_EVENT_IOC_PAUSE_OUTPUT(r1, 0x40086602, 0x400007) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000280)='./cgroup/syz0\x00', 0x1ff) openat$smack_thread_current(0xffffffffffffff9c, &(0x7f0000000240)='/proc/thread-self/attr/current\x00', 0x2, 0x0) write$cgroup_subtree(r1, &(0x7f0000000100)=ANY=[], 0xff4a) write$cgroup_subtree(r2, &(0x7f0000000000)=ANY=[], 0x20032600) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a0f, 0x1700) accept$inet(0xffffffffffffffff, &(0x7f0000000040)={0x2, 0x0, @local}, &(0x7f0000000080)=0x10) ioctl$TCSETAF(r0, 0x5408, &(0x7f0000000040)={0x2}) ioctl$EXT4_IOC_GROUP_ADD(r0, 0x40286608, &(0x7f0000000000)={0x3, 0x7000000, 0x400, 0x100000000, 0x0, 0x8}) r3 = fcntl$dupfd(r0, 0x406, r0) ioctl$EVIOCGVERSION(r3, 0x80044501, &(0x7f0000000200)=""/31) write$binfmt_misc(r0, &(0x7f0000000080)={'syz1', "80fa25cdc862d216160cfa92845a3916e38a409a159c03f1889971d3e5144a8d08de78c4b1fbee457437261d7668b1c0f582647ad4134a05358d4309a71a702002329e024cac95642e761bb842bc1056bd6bf12c47697a649a026bd8ee1f685089941469b1ddfeddf32b392f0ff07652a3bce0770bc3bb70862845a65054cecb191e80b825d740fe6b40450359757032425dfdee92aec36ce4b468d50adc745c522cc4af2ac6e7f6a95f0edd70b09caa95fcc7143cf46b74db8bc17fa7c89f"}, 0xc3) [ 347.605452] binder: 12302:12307 ioctl 540f 20000300 returned -22 [ 347.690776] binder: BINDER_SET_CONTEXT_MGR already set 14:04:01 executing program 4: perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) openat$smack_thread_current(0xffffffffffffff9c, &(0x7f0000000240)='/proc/thread-self/attr/current\x00', 0x2, 0x0) ioctl$TCSETAF(0xffffffffffffffff, 0x5408, &(0x7f0000000040)) 14:04:01 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0xfffffffffffffcca, 0x0, &(0x7f0000000000)=[@increfs={0x40046304, 0x4}], 0x163, 0x0, 0x0}) dup(r0) 14:04:01 executing program 0: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(r0, 0x540b, 0x1) ioctl$TCSETS(r0, 0x5402, &(0x7f0000000000)={0x1c, 0x9, 0x4, 0x9, 0x1b, 0x4, 0x3c, 0xffffffffffffff81, 0xe21, 0x3f, 0x7, 0x8001}) 14:04:01 executing program 1: r0 = socket(0x0, 0x0, 0x0) syz_open_procfs(0x0, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$cgroup_int(0xffffffffffffffff, 0x0, 0x2, 0x0) openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x7a05, 0x1700) openat$smack_thread_current(0xffffffffffffff9c, &(0x7f0000000240)='/proc/thread-self/attr/current\x00', 0x2, 0x0) write$cgroup_subtree(0xffffffffffffffff, 0x0, 0x0) accept$inet(r0, &(0x7f0000000000)={0x2, 0x0, @broadcast}, &(0x7f0000000080)=0x10) ioctl$TCSETAF(0xffffffffffffffff, 0x5408, &(0x7f0000000040)) ioctl$EXT4_IOC_GROUP_ADD(0xffffffffffffffff, 0x40286608, 0x0) ioctl$EVIOCGVERSION(0xffffffffffffffff, 0x80044501, 0x0) [ 347.690786] binder: 12328:12331 ioctl 40046207 0 returned -16 [ 347.691395] binder: BINDER_SET_CONTEXT_MGR already set 14:04:01 executing program 4: perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) openat$smack_thread_current(0xffffffffffffff9c, &(0x7f0000000240)='/proc/thread-self/attr/current\x00', 0x2, 0x0) ioctl$TCSETAF(0xffffffffffffffff, 0x5408, &(0x7f0000000040)) 14:04:01 executing program 3: syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = open(&(0x7f0000000000)='./file0\x00', 0x800, 0x80) getpeername$packet(r0, &(0x7f0000000040)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @link_local}, &(0x7f0000000080)=0x14) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f00000001c0)=[@acquire], 0x0, 0x0, 0x0}) 14:04:01 executing program 0: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(r0, 0x540b, 0x3ff) 14:04:01 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSPTLCK(r0, 0x40045431, &(0x7f0000000180)) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) socket(0x200000000000011, 0x4000000000080002, 0x0) bind$packet(0xffffffffffffffff, 0x0, 0x0) sendmmsg(0xffffffffffffffff, &(0x7f0000007880)=[{{&(0x7f00000001c0)=@l2={0x1f, 0xbf53, {0x9, 0x7, 0xfffffffffffffdd5, 0x1ff, 0x2, 0x4}, 0x0, 0x7}, 0x80, 0x0}}, {{0x0, 0x0, &(0x7f0000007780)}}], 0x2, 0x4048851) setsockopt$packet_int(0xffffffffffffffff, 0x107, 0x0, 0x0, 0x0) syz_open_procfs(0x0, 0x0) ioctl$LOOP_SET_BLOCK_SIZE(0xffffffffffffffff, 0x4c09, 0x0) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$cgroup_int(0xffffffffffffffff, 0x0, 0x2, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='\x89\x00\x00\x00\x00Ew\x00\x00\x00\xef\xb4\xc8\xd0\xff\xda\xb1vents\xd9\xc5H\xd4\x91\xfdN_]\x16\xe4\xa9C\xd2\x86Qn\xefS\x80\x11J\xfb4\x14\x86 4\x95\x9e\xfc\xc1\a\xcb \x95N\xe9\xa4j\xd2\x1f^\xb0\xb2>\xa3\xc9\xb7$\x11`t\x03: \x8b\xa4\x05\xf2?E\xdb+{t\xb8\xf7\xab\x8b\x100#', 0x26e1, 0x0) ioctl$PERF_EVENT_IOC_PAUSE_OUTPUT(r1, 0x40086602, 0x400007) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000280)='./cgroup/syz0\x00', 0x1ff) openat$smack_thread_current(0xffffffffffffff9c, &(0x7f0000000240)='/proc/thread-self/attr/current\x00', 0x2, 0x0) write$cgroup_subtree(r1, &(0x7f0000000100)=ANY=[], 0xff4a) write$cgroup_subtree(r2, &(0x7f0000000000)=ANY=[], 0x20032600) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a0f, 0x1700) accept$inet(0xffffffffffffffff, &(0x7f0000000040)={0x2, 0x0, @local}, &(0x7f0000000080)=0x10) ioctl$TCSETAF(r0, 0x5408, &(0x7f0000000040)={0x2}) ioctl$EXT4_IOC_GROUP_ADD(r0, 0x40286608, &(0x7f0000000000)={0x3, 0x7000000, 0x400, 0x100000000, 0x0, 0x8}) r3 = fcntl$dupfd(r0, 0x406, r0) ioctl$EVIOCGVERSION(r3, 0x80044501, &(0x7f0000000200)=""/31) write$binfmt_misc(r0, &(0x7f0000000080)={'syz1', "80fa25cdc862d216160cfa92845a3916e38a409a159c03f1889971d3e5144a8d08de78c4b1fbee457437261d7668b1c0f582647ad4134a05358d4309a71a702002329e024cac95642e761bb842bc1056bd6bf12c47697a649a026bd8ee1f685089941469b1ddfeddf32b392f0ff07652a3bce0770bc3bb70862845a65054cecb191e80b825d740fe6b40450359757032425dfdee92aec36ce4b468d50adc745c522cc4af2ac6e7f6a95f0edd70b09caa95fcc7143cf46b74db8bc17fa7c89f"}, 0xc3) [ 347.691403] binder: 12328:12331 ioctl 40046207 0 returned -16 [ 347.699370] binder: 12326:12329 unknown command 1075929861 [ 347.699379] binder: 12326:12329 ioctl c0306201 20012000 returned -22 [ 347.708120] binder: 12326:12335 unknown command 1075929861 [ 347.708130] binder: 12326:12335 ioctl c0306201 20012000 returned -22 [ 347.769915] binder: 12343:12347 unknown command 511440364 [ 347.769924] binder: 12343:12347 ioctl c0306201 20012000 returned -22 [ 347.777401] binder: BINDER_SET_CONTEXT_MGR already set 14:04:01 executing program 1: r0 = openat$selinux_mls(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/mls\x00', 0x0, 0x0) openat$cgroup_type(r0, &(0x7f0000000080)='cgroup.type\x00', 0x2, 0x0) socket(0x0, 0x0, 0x0) syz_open_procfs(0x0, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$cgroup_int(0xffffffffffffffff, 0x0, 0x2, 0x0) openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x7a05, 0x1700) openat$smack_thread_current(0xffffffffffffff9c, &(0x7f00000000c0)='/proc/thread-self/attr/current\x00', 0x2, 0x0) write$cgroup_subtree(0xffffffffffffffff, 0x0, 0x0) ioctl$TCSETAF(0xffffffffffffffff, 0x5408, &(0x7f0000000040)) ioctl$EXT4_IOC_GROUP_ADD(0xffffffffffffffff, 0x40286608, 0x0) ioctl$EVIOCGVERSION(0xffffffffffffffff, 0x80044501, 0x0) [ 347.777408] binder: 12340:12346 ioctl 40046207 0 returned -16 [ 347.788233] binder: BINDER_SET_CONTEXT_MGR already set [ 347.788242] binder: 12340:12346 ioctl 40046207 0 returned -16 [ 347.813904] binder: 12343:12355 unknown command 511440364 [ 347.813913] binder: 12343:12355 ioctl c0306201 20012000 returned -22 [ 347.927462] binder: BINDER_SET_CONTEXT_MGR already set [ 347.927474] binder: 12378:12384 ioctl 40046207 0 returned -16 [ 347.978777] binder: 12391:12393 unknown command -557241083 14:04:01 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$FS_IOC_RESVSP(r0, 0x40305828, &(0x7f0000000000)={0x0, 0x2, 0x7fffffff, 0x200}) r1 = mmap$binder(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x1000001, 0x100010, r0, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, &(0x7f0000000080)={r1}) [ 347.978788] binder: 12391:12393 ioctl c0306201 20012000 returned -22 [ 348.012261] binder: BINDER_SET_CONTEXT_MGR already set [ 348.012269] binder: 12402:12404 ioctl 40046207 0 returned -16 [ 348.015532] binder: BINDER_SET_CONTEXT_MGR already set [ 348.015541] binder: 12402:12404 ioctl 40046207 0 returned -16 [ 348.023906] binder: 12407:12410 ioctl 40045431 20000000 returned -22 [ 348.094517] binder: 12427:12430 ioctl c0306201 20012000 returned -14 14:04:01 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSPTLCK(r0, 0x40045431, &(0x7f0000000180)) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) socket(0x200000000000011, 0x4000000000080002, 0x0) bind$packet(0xffffffffffffffff, 0x0, 0x0) sendmmsg(0xffffffffffffffff, &(0x7f0000007880)=[{{&(0x7f00000001c0)=@l2={0x1f, 0xbf53, {0x9, 0x7, 0xfffffffffffffdd5, 0x1ff, 0x2, 0x4}, 0x0, 0x7}, 0x80, 0x0}}, {{0x0, 0x0, &(0x7f0000007780)}}], 0x2, 0x4048851) setsockopt$packet_int(0xffffffffffffffff, 0x107, 0x0, 0x0, 0x0) syz_open_procfs(0x0, 0x0) ioctl$LOOP_SET_BLOCK_SIZE(0xffffffffffffffff, 0x4c09, 0x0) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$cgroup_int(0xffffffffffffffff, 0x0, 0x2, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='\x89\x00\x00\x00\x00Ew\x00\x00\x00\xef\xb4\xc8\xd0\xff\xda\xb1vents\xd9\xc5H\xd4\x91\xfdN_]\x16\xe4\xa9C\xd2\x86Qn\xefS\x80\x11J\xfb4\x14\x86 4\x95\x9e\xfc\xc1\a\xcb \x95N\xe9\xa4j\xd2\x1f^\xb0\xb2>\xa3\xc9\xb7$\x11`t\x03: \x8b\xa4\x05\xf2?E\xdb+{t\xb8\xf7\xab\x8b\x100#', 0x26e1, 0x0) ioctl$PERF_EVENT_IOC_PAUSE_OUTPUT(r1, 0x40086602, 0x400007) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000280)='./cgroup/syz0\x00', 0x1ff) openat$smack_thread_current(0xffffffffffffff9c, &(0x7f0000000240)='/proc/thread-self/attr/current\x00', 0x2, 0x0) write$cgroup_subtree(r1, &(0x7f0000000100)=ANY=[], 0xff4a) write$cgroup_subtree(r2, &(0x7f0000000000)=ANY=[], 0x20032600) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a0f, 0x1700) accept$inet(0xffffffffffffffff, &(0x7f0000000040)={0x2, 0x0, @local}, &(0x7f0000000080)=0x10) ioctl$TCSETAF(r0, 0x5408, &(0x7f0000000040)={0x2}) ioctl$EXT4_IOC_GROUP_ADD(r0, 0x40286608, &(0x7f0000000000)={0x3, 0x7000000, 0x400, 0x100000000, 0x0, 0x8}) r3 = fcntl$dupfd(r0, 0x406, r0) ioctl$EVIOCGVERSION(r3, 0x80044501, &(0x7f0000000200)=""/31) write$binfmt_misc(r0, &(0x7f0000000080)={'syz1', "80fa25cdc862d216160cfa92845a3916e38a409a159c03f1889971d3e5144a8d08de78c4b1fbee457437261d7668b1c0f582647ad4134a05358d4309a71a702002329e024cac95642e761bb842bc1056bd6bf12c47697a649a026bd8ee1f685089941469b1ddfeddf32b392f0ff07652a3bce0770bc3bb70862845a65054cecb191e80b825d740fe6b40450359757032425dfdee92aec36ce4b468d50adc745c522cc4af2ac6e7f6a95f0edd70b09caa95fcc7143cf46b74db8bc17fa7c89f"}, 0xc3) 14:04:01 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) open(&(0x7f00000002c0)='./file0\x00', 0x100, 0xc4) openat$full(0xffffffffffffff9c, &(0x7f0000000300)='/dev/full\x00', 0x14140, 0x0) dup(r0) r1 = openat$pfkey(0xffffffffffffff9c, &(0x7f0000000380)='/proc/self/net/pfkey\x00', 0x20800, 0x0) r2 = openat$cgroup_ro(r1, &(0x7f0000000340)='memory.stat\x00', 0x0, 0x0) ioctl$TCFLSH(r2, 0x540b, 0x2) r3 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f00000001c0)=[@acquire], 0x0, 0x0, 0x0}) getsockopt$EBT_SO_GET_ENTRIES(r2, 0x0, 0x81, &(0x7f0000000200)={'filter\x00', 0x0, 0x3, 0xb5, [], 0x1, &(0x7f0000000080)=[{}], &(0x7f00000000c0)=""/181}, &(0x7f0000000180)=0x78) ioctl$TIOCGPKT(r2, 0x80045438, &(0x7f0000000040)) ioctl$RNDZAPENTCNT(r2, 0x5204, &(0x7f0000000280)=0x20000000) [ 348.095804] binder: 12427:12430 ioctl c0306201 20012000 returned -14 14:04:01 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000500)={0xb8, 0x0, &(0x7f0000000340)=[@transaction_sg={0x40486311, {{0x0, 0x0, 0x4, 0x0, 0x11, 0x0, 0x0, 0x0, 0x18, &(0x7f00000001c0), &(0x7f0000000200)=[0x30, 0x38, 0x0]}, 0x4}}, @clear_death, @register_looper, @transaction_sg={0x40486311, {{0x4, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x60, 0x8, &(0x7f0000000280)=[@ptr={0x70742a85, 0x0, &(0x7f0000000240), 0x1, 0x2, 0x5}, @fda={0x66646185, 0x4, 0x0, 0x1f}, @fd={0x66642a85, 0x0, r0, 0x0, 0x3}], &(0x7f0000000300)=[0x30]}, 0xffffffffffff27b9}}, @dead_binder_done={0x40086310, 0x3}], 0xd6, 0x0, &(0x7f0000000400)="70602ea627f3f733248660b67770dc63c1e7a792bf6f8eb2e8c4a8197b9c398e156fa26604d527aab47ff903b210f1099614a3816b4f03a3ba81d642f2bcafe9176ce10ef3ae599d6fb9e5ebf8bb528857d7fa1db8a770d2f7da6949c2c478b355178aa6950bd7ce6ff998a6be20cf4354206c67b3586aa6e79f556ddb4bb7ebd31885add23fcbdfd800c0e4bf6b74e8b0389681ff1258cc8487590c33d68e369cddf6945e7001f8f85050c84ac112e7e9d42d2ca26b8b718d0316646661928b2b449a9fd5da49f3e00ae1dc1c1bba78b68db274f76e"}) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, &(0x7f0000000040)) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x800, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendmsg$key(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000000)={0x0}}, 0x0) prctl$PR_CAP_AMBIENT(0x2f, 0x4, 0x24) sendmsg$key(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000200)=ANY=[@ANYBLOB="020700001000000000000000000000000800120000000100000000000000000006000000000000000000000000000200e00040e0ff00000000000000000000000000ada8008004000000200000000000030006000000000002000080ac14ffbbf00000000000000003000500000000000200423b1d632bd7b8200000000000c7"], 0x80}}, 0x0) r1 = socket$key(0xf, 0x3, 0x2) sendmmsg(r1, &(0x7f0000000180), 0x32bc45944b084a6, 0x0) r2 = gettid() ioctl$sock_SIOCGPGRP(0xffffffffffffffff, 0x8904, &(0x7f0000000180)=0x0) tgkill(r2, r3, 0x3) mmap$binder(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x2, 0xc0010, r0, 0x0) r4 = mmap$binder(&(0x7f0000ffb000/0x1000)=nil, 0x1000, 0x1000004, 0x104030, r0, 0x0) llistxattr(&(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)=""/186, 0xba) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, &(0x7f0000000080)={r4}) prctl$PR_SET_TSC(0x1a, 0x1) 14:04:01 executing program 0: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSSERIAL(r0, 0x541f, &(0x7f00000000c0)={0x8, 0x6, 0x3, 0x9, 0x1, 0x7, 0xc1, 0x401, 0x4, 0x7, 0x10001, 0x9, 0x3, 0x67c, &(0x7f0000000000)=""/136, 0x4, 0x800}) ioctl$TCFLSH(r0, 0x540b, 0x1) 14:04:01 executing program 3: syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000012000)={0x10, 0x0, &(0x7f0000000040)=[@request_death={0x400c630e, 0x2, 0x1}], 0x0, 0x0, 0x0}) 14:04:01 executing program 4: perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$smack_thread_current(0xffffffffffffff9c, 0x0, 0x2, 0x0) ioctl$TCSETAF(0xffffffffffffffff, 0x5408, &(0x7f0000000040)) [ 348.292258] binder: BINDER_SET_CONTEXT_MGR already set [ 348.292267] binder: 12450:12457 ioctl 40046207 0 returned -16 [ 348.292360] binder: 12450:12457 ioctl 40305828 20000000 returned -22 14:04:01 executing program 4: perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$smack_thread_current(0xffffffffffffff9c, 0x0, 0x2, 0x0) ioctl$TCSETAF(0xffffffffffffffff, 0x5408, &(0x7f0000000040)) 14:04:01 executing program 1: r0 = socket(0x0, 0x0, 0x0) syz_open_procfs(0x0, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x100, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$cgroup_int(0xffffffffffffffff, 0x0, 0x2, 0x0) openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x7a05, 0x1700) openat$smack_thread_current(0xffffffffffffff9c, &(0x7f0000000240)='/proc/thread-self/attr/current\x00', 0x2, 0x0) write$cgroup_subtree(0xffffffffffffffff, 0x0, 0x0) ioctl$TCSETAF(0xffffffffffffffff, 0x5408, &(0x7f0000000040)) ioctl$EXT4_IOC_GROUP_ADD(r0, 0x40286608, 0x0) ioctl$EVIOCGVERSION(0xffffffffffffffff, 0x80044501, 0x0) 14:04:01 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSPTLCK(r0, 0x40045431, &(0x7f0000000180)) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) socket(0x200000000000011, 0x4000000000080002, 0x0) bind$packet(0xffffffffffffffff, 0x0, 0x0) sendmmsg(0xffffffffffffffff, &(0x7f0000007880)=[{{&(0x7f00000001c0)=@l2={0x1f, 0xbf53, {0x9, 0x7, 0xfffffffffffffdd5, 0x1ff, 0x2, 0x4}, 0x0, 0x7}, 0x80, 0x0}}, {{0x0, 0x0, &(0x7f0000007780)}}], 0x2, 0x4048851) setsockopt$packet_int(0xffffffffffffffff, 0x107, 0x0, 0x0, 0x0) syz_open_procfs(0x0, 0x0) ioctl$LOOP_SET_BLOCK_SIZE(0xffffffffffffffff, 0x4c09, 0x0) perf_event_open(&(0x7f0000000180)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$cgroup_int(0xffffffffffffffff, 0x0, 0x2, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='\x89\x00\x00\x00\x00Ew\x00\x00\x00\xef\xb4\xc8\xd0\xff\xda\xb1vents\xd9\xc5H\xd4\x91\xfdN_]\x16\xe4\xa9C\xd2\x86Qn\xefS\x80\x11J\xfb4\x14\x86 4\x95\x9e\xfc\xc1\a\xcb \x95N\xe9\xa4j\xd2\x1f^\xb0\xb2>\xa3\xc9\xb7$\x11`t\x03: \x8b\xa4\x05\xf2?E\xdb+{t\xb8\xf7\xab\x8b\x100#', 0x26e1, 0x0) ioctl$PERF_EVENT_IOC_PAUSE_OUTPUT(r1, 0x40086602, 0x400007) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000280)='./cgroup/syz0\x00', 0x1ff) openat$smack_thread_current(0xffffffffffffff9c, &(0x7f0000000240)='/proc/thread-self/attr/current\x00', 0x2, 0x0) write$cgroup_subtree(r1, &(0x7f0000000100)=ANY=[], 0xff4a) write$cgroup_subtree(r2, &(0x7f0000000000)=ANY=[], 0x20032600) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a0f, 0x1700) accept$inet(0xffffffffffffffff, &(0x7f0000000040)={0x2, 0x0, @local}, &(0x7f0000000080)=0x10) ioctl$TCSETAF(r0, 0x5408, &(0x7f0000000040)={0x2}) ioctl$EXT4_IOC_GROUP_ADD(r0, 0x40286608, &(0x7f0000000000)={0x3, 0x7000000, 0x400, 0x100000000, 0x0, 0x8}) r3 = fcntl$dupfd(r0, 0x406, r0) ioctl$EVIOCGVERSION(r3, 0x80044501, &(0x7f0000000200)=""/31) write$binfmt_misc(r0, &(0x7f0000000080)={'syz1', "80fa25cdc862d216160cfa92845a3916e38a409a159c03f1889971d3e5144a8d08de78c4b1fbee457437261d7668b1c0f582647ad4134a05358d4309a71a702002329e024cac95642e761bb842bc1056bd6bf12c47697a649a026bd8ee1f685089941469b1ddfeddf32b392f0ff07652a3bce0770bc3bb70862845a65054cecb191e80b825d740fe6b40450359757032425dfdee92aec36ce4b468d50adc745c522cc4af2ac6e7f6a95f0edd70b09caa95fcc7143cf46b74db8bc17fa7c89f"}, 0xc3) 14:04:01 executing program 0: r0 = openat$selinux_status(0xffffffffffffff9c, &(0x7f0000000040)='/selinux/status\x00', 0x0, 0x0) ioctl$TCSBRKP(r0, 0x5425, 0xf141) r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSWINSZ(r1, 0x5414, &(0x7f0000000000)={0x2, 0x40, 0x95, 0xffff}) ioctl$TCFLSH(r1, 0x540b, 0x1) [ 348.292947] binder: BINDER_SET_CONTEXT_MGR already set [ 348.292953] binder: 12450:12457 ioctl 40046207 0 returned -16 [ 348.308169] binder: 12450:12461 ioctl 40305828 20000000 returned -22 14:04:01 executing program 3: syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f00000001c0)=[@acquire], 0x0, 0x0, 0x0}) openat$pfkey(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/net/pfkey\x00', 0x200000, 0x0) 14:04:01 executing program 5: rt_sigaction(0x21, &(0x7f0000000140)={&(0x7f0000000080)="420f33f30faa2e46d0aee53e000000c0c4014c572a45defbc4e3e54812c8f2460f2c64f528660fdff6c4c379634c856b55", {0xf}, 0x0, &(0x7f00000000c0)="c463fd7a44e10272c401465d6e65c4413dd0bdd6359611c44155dadec4037d7b5d00f0c4a17c283a66f0458034a5bfd7000009420f525438258fa968017787c44259afdd"}, 0x0, 0x8, &(0x7f0000000180)) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) r0 = creat(&(0x7f0000000040)='./file0\x00', 0x18) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, &(0x7f0000000000)) 14:04:01 executing program 4: perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$smack_thread_current(0xffffffffffffff9c, 0x0, 0x2, 0x0) ioctl$TCSETAF(0xffffffffffffffff, 0x5408, &(0x7f0000000040)) [ 348.327551] audit: type=1400 audit(1555509841.838:26): avc: denied { call } for pid=12465 comm="syz-executor.5" scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=binder permissive=1 14:04:02 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) write$binfmt_misc(r0, &(0x7f0000000000)={'syz0', "c20d9caf85222d22c03f474fa031221784a15881fc680756ec534131c3b8bdc40532bf635ee410022a0a147b5a9f4eef5a59de250f28ed5da3bd94aa0bf26f21dfec3735cb287d43336973358a73761768a50953bc2f2495e30091eedcad7547ec164d063383ef1b078ab6614e57816889af325ecd0f7a981e433722f7b2c6b702cb5ea47439ffc00d53d2d2d534f1456a4d5fcab7cdd0bed8ac68083a7d26a9754c49522d8da8d67bf0f79cdcc40808f1a52c6f731f34f025329fe2467801b0c81c1cdd663675d01ab0fe7dd3b9998c7804d37540e9f6c516ab11e0b3fc19cae29a4f712f7d6a0e52ba29d0621f09013925019c69d01dfc"}, 0xfc) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f00000001c0)=[@acquire], 0x0, 0x0, 0x0}) ioctl$FS_IOC_SET_ENCRYPTION_POLICY(r0, 0x800c6613, &(0x7f0000000100)={0x0, @aes256, 0x2, "56e1a4a95dd45150"}) 14:04:02 executing program 0: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff}) r1 = socket(0x9, 0xa, 0x6) bind(r0, &(0x7f0000000140)=@pppol2tpv3={0x18, 0x1, {0x0, r1, {0x2, 0x4e24, @dev={0xac, 0x14, 0x14, 0x1a}}, 0x0, 0x3, 0x3, 0x3}}, 0x80) r2 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(r2, 0x540b, 0x1) ioctl$TIOCCBRK(r2, 0x5428) r3 = openat$full(0xffffffffffffff9c, &(0x7f0000000240)='/dev/full\x00', 0x8002, 0x0) r4 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000080)='/dev/vga_arbiter\x00', 0x2000, 0x0) linkat(r3, &(0x7f0000000040)='./file0\x00', r4, &(0x7f00000000c0)='./file0\x00', 0x1400) 14:04:02 executing program 4: perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$smack_thread_current(0xffffffffffffff9c, &(0x7f0000000240)='/proc/thread-self/attr/current\x00', 0x2, 0x0) ioctl$TCSETAF(0xffffffffffffffff, 0x5408, 0x0) 14:04:02 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSPTLCK(r0, 0x40045431, &(0x7f0000000180)) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) socket(0x200000000000011, 0x4000000000080002, 0x0) bind$packet(0xffffffffffffffff, 0x0, 0x0) sendmmsg(0xffffffffffffffff, &(0x7f0000007880)=[{{&(0x7f00000001c0)=@l2={0x1f, 0xbf53, {0x9, 0x7, 0xfffffffffffffdd5, 0x1ff, 0x2, 0x4}, 0x0, 0x7}, 0x80, 0x0}}, {{0x0, 0x0, &(0x7f0000007780)}}], 0x2, 0x4048851) setsockopt$packet_int(0xffffffffffffffff, 0x107, 0x0, 0x0, 0x0) syz_open_procfs(0x0, 0x0) ioctl$LOOP_SET_BLOCK_SIZE(0xffffffffffffffff, 0x4c09, 0x0) perf_event_open(&(0x7f0000000180)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$cgroup_int(0xffffffffffffffff, 0x0, 0x2, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='\x89\x00\x00\x00\x00Ew\x00\x00\x00\xef\xb4\xc8\xd0\xff\xda\xb1vents\xd9\xc5H\xd4\x91\xfdN_]\x16\xe4\xa9C\xd2\x86Qn\xefS\x80\x11J\xfb4\x14\x86 4\x95\x9e\xfc\xc1\a\xcb \x95N\xe9\xa4j\xd2\x1f^\xb0\xb2>\xa3\xc9\xb7$\x11`t\x03: \x8b\xa4\x05\xf2?E\xdb+{t\xb8\xf7\xab\x8b\x100#', 0x26e1, 0x0) ioctl$PERF_EVENT_IOC_PAUSE_OUTPUT(r1, 0x40086602, 0x400007) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000280)='./cgroup/syz0\x00', 0x1ff) openat$smack_thread_current(0xffffffffffffff9c, &(0x7f0000000240)='/proc/thread-self/attr/current\x00', 0x2, 0x0) write$cgroup_subtree(r1, &(0x7f0000000100)=ANY=[], 0xff4a) write$cgroup_subtree(r2, &(0x7f0000000000)=ANY=[], 0x20032600) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a0f, 0x1700) accept$inet(0xffffffffffffffff, &(0x7f0000000040)={0x2, 0x0, @local}, &(0x7f0000000080)=0x10) ioctl$TCSETAF(r0, 0x5408, &(0x7f0000000040)={0x2}) ioctl$EXT4_IOC_GROUP_ADD(r0, 0x40286608, &(0x7f0000000000)={0x3, 0x7000000, 0x400, 0x100000000, 0x0, 0x8}) r3 = fcntl$dupfd(r0, 0x406, r0) ioctl$EVIOCGVERSION(r3, 0x80044501, &(0x7f0000000200)=""/31) write$binfmt_misc(r0, &(0x7f0000000080)={'syz1', "80fa25cdc862d216160cfa92845a3916e38a409a159c03f1889971d3e5144a8d08de78c4b1fbee457437261d7668b1c0f582647ad4134a05358d4309a71a702002329e024cac95642e761bb842bc1056bd6bf12c47697a649a026bd8ee1f685089941469b1ddfeddf32b392f0ff07652a3bce0770bc3bb70862845a65054cecb191e80b825d740fe6b40450359757032425dfdee92aec36ce4b468d50adc745c522cc4af2ac6e7f6a95f0edd70b09caa95fcc7143cf46b74db8bc17fa7c89f"}, 0xc3) 14:04:02 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, &(0x7f0000000000)={0x0}) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, &(0x7f0000000080)={r1}) r2 = dup(r0) setsockopt$inet_group_source_req(r2, 0x0, 0x2f, &(0x7f00000000c0)={0x20, {{0x2, 0x4e20, @rand_addr=0x4}}, {{0x2, 0x4e22, @loopback}}}, 0x108) 14:04:02 executing program 0: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/ptmx\x00', 0x0, 0x0) socket$inet6(0xa, 0xa, 0x20) ioctl$TCFLSH(r0, 0x540b, 0x1) [ 348.327583] binder_alloc: 12244: binder_alloc_buf, no vma 14:04:02 executing program 1: r0 = socket(0x0, 0x0, 0x0) r1 = openat$selinux_mls(0xffffffffffffff9c, &(0x7f00000004c0)='/selinux/mls\x00', 0x0, 0x0) ioctl$TUNSETNOCSUM(r1, 0x400454c8, 0x0) r2 = syz_open_procfs(0x0, 0x0) getresuid(&(0x7f0000000100), &(0x7f0000000140), &(0x7f0000000200)=0x0) getsockopt$inet_IP_IPSEC_POLICY(r2, 0x0, 0x10, &(0x7f0000000280)={{{@in6=@initdev, @in=@remote, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@multicast2}, 0x0, @in=@loopback}}, &(0x7f0000000380)=0xe8) read(r0, &(0x7f0000000540)=""/4096, 0x1000) getresuid(&(0x7f00000003c0)=0x0, &(0x7f0000000400), &(0x7f0000000440)) setresuid(r3, r4, r5) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$cgroup_int(0xffffffffffffffff, 0x0, 0x2, 0x0) r6 = openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x7a05, 0x1700) openat$smack_thread_current(0xffffffffffffff9c, &(0x7f0000000500)='/proc/thread-self/attr/current\x00', 0x2, 0x0) openat$cgroup_ro(r1, &(0x7f0000000080)='cpuacct.usage_all\x00', 0x0, 0x0) listen(r0, 0x80) write$UHID_DESTROY(r2, &(0x7f0000000000), 0x4) write$cgroup_subtree(0xffffffffffffffff, 0x0, 0x0) ioctl$TCSETAF(0xffffffffffffffff, 0x5408, &(0x7f0000000040)) ioctl$BLKTRACETEARDOWN(r6, 0x1276, 0x0) ioctl$EXT4_IOC_GROUP_ADD(0xffffffffffffffff, 0x40286608, 0x0) ioctl$BLKBSZSET(r6, 0x40081271, &(0x7f00000000c0)=0x9) ioctl$EVIOCGVERSION(0xffffffffffffffff, 0x80044501, 0x0) 14:04:02 executing program 3: syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mkdir(&(0x7f0000000040)='./file0\x00', 0x0) mount$bpf(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f00000019c0)='bpf\x00', 0x0, 0x0) mount$bpf(0x0, &(0x7f00000002c0)='./file0\x00', 0x0, 0x100000, 0x0) socket$nl_route(0x10, 0x3, 0x0) mount$bpf(0x20000000, &(0x7f0000000140)='./file0\x00', 0x0, 0x2000, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f00000001c0)=[@acquire], 0x0, 0x0, 0x0}) 14:04:02 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x301000, 0x0) r2 = openat$full(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/full\x00', 0x400800, 0x0) linkat(r1, &(0x7f0000000080)='./file0\x00', r2, &(0x7f0000000100)='./file0\x00', 0x1400) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, &(0x7f0000000000)) 14:04:02 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000500)={0xb8, 0x0, &(0x7f0000000340)=[@transaction_sg={0x40486311, {{0x0, 0x0, 0x4, 0x0, 0x11, 0x0, 0x0, 0x0, 0x18, &(0x7f00000001c0), &(0x7f0000000200)=[0x30, 0x38, 0x0]}, 0x4}}, @clear_death, @register_looper, @transaction_sg={0x40486311, {{0x4, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x60, 0x8, &(0x7f0000000280)=[@ptr={0x70742a85, 0x0, &(0x7f0000000240), 0x1, 0x2, 0x5}, @fda={0x66646185, 0x4, 0x0, 0x1f}, @fd={0x66642a85, 0x0, r0, 0x0, 0x3}], &(0x7f0000000300)=[0x30]}, 0xffffffffffff27b9}}, @dead_binder_done={0x40086310, 0x3}], 0xd6, 0x0, &(0x7f0000000400)="70602ea627f3f733248660b67770dc63c1e7a792bf6f8eb2e8c4a8197b9c398e156fa26604d527aab47ff903b210f1099614a3816b4f03a3ba81d642f2bcafe9176ce10ef3ae599d6fb9e5ebf8bb528857d7fa1db8a770d2f7da6949c2c478b355178aa6950bd7ce6ff998a6be20cf4354206c67b3586aa6e79f556ddb4bb7ebd31885add23fcbdfd800c0e4bf6b74e8b0389681ff1258cc8487590c33d68e369cddf6945e7001f8f85050c84ac112e7e9d42d2ca26b8b718d0316646661928b2b449a9fd5da49f3e00ae1dc1c1bba78b68db274f76e"}) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, &(0x7f0000000040)) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x800, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendmsg$key(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000000)={0x0}}, 0x0) prctl$PR_CAP_AMBIENT(0x2f, 0x4, 0x24) sendmsg$key(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000200)=ANY=[@ANYBLOB="020700001000000000000000000000000800120000000100000000000000000006000000000000000000000000000200e00040e0ff00000000000000000000000000ada8008004000000200000000000030006000000000002000080ac14ffbbf00000000000000003000500000000000200423b1d632bd7b8200000000000c7"], 0x80}}, 0x0) r1 = socket$key(0xf, 0x3, 0x2) sendmmsg(r1, &(0x7f0000000180), 0x32bc45944b084a6, 0x0) r2 = gettid() ioctl$sock_SIOCGPGRP(0xffffffffffffffff, 0x8904, &(0x7f0000000180)=0x0) tgkill(r2, r3, 0x3) mmap$binder(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x2, 0xc0010, r0, 0x0) r4 = mmap$binder(&(0x7f0000ffb000/0x1000)=nil, 0x1000, 0x1000004, 0x104030, r0, 0x0) llistxattr(&(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)=""/186, 0xba) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, &(0x7f0000000080)={r4}) prctl$PR_SET_TSC(0x1a, 0x1) 14:04:02 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSPTLCK(r0, 0x40045431, &(0x7f0000000180)) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) socket(0x200000000000011, 0x4000000000080002, 0x0) bind$packet(0xffffffffffffffff, 0x0, 0x0) sendmmsg(0xffffffffffffffff, &(0x7f0000007880)=[{{&(0x7f00000001c0)=@l2={0x1f, 0xbf53, {0x9, 0x7, 0xfffffffffffffdd5, 0x1ff, 0x2, 0x4}, 0x0, 0x7}, 0x80, 0x0}}, {{0x0, 0x0, &(0x7f0000007780)}}], 0x2, 0x4048851) setsockopt$packet_int(0xffffffffffffffff, 0x107, 0x0, 0x0, 0x0) syz_open_procfs(0x0, 0x0) ioctl$LOOP_SET_BLOCK_SIZE(0xffffffffffffffff, 0x4c09, 0x0) perf_event_open(&(0x7f0000000180)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$cgroup_int(0xffffffffffffffff, 0x0, 0x2, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='\x89\x00\x00\x00\x00Ew\x00\x00\x00\xef\xb4\xc8\xd0\xff\xda\xb1vents\xd9\xc5H\xd4\x91\xfdN_]\x16\xe4\xa9C\xd2\x86Qn\xefS\x80\x11J\xfb4\x14\x86 4\x95\x9e\xfc\xc1\a\xcb \x95N\xe9\xa4j\xd2\x1f^\xb0\xb2>\xa3\xc9\xb7$\x11`t\x03: \x8b\xa4\x05\xf2?E\xdb+{t\xb8\xf7\xab\x8b\x100#', 0x26e1, 0x0) ioctl$PERF_EVENT_IOC_PAUSE_OUTPUT(r1, 0x40086602, 0x400007) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000280)='./cgroup/syz0\x00', 0x1ff) openat$smack_thread_current(0xffffffffffffff9c, &(0x7f0000000240)='/proc/thread-self/attr/current\x00', 0x2, 0x0) write$cgroup_subtree(r1, &(0x7f0000000100)=ANY=[], 0xff4a) write$cgroup_subtree(r2, &(0x7f0000000000)=ANY=[], 0x20032600) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a0f, 0x1700) accept$inet(0xffffffffffffffff, &(0x7f0000000040)={0x2, 0x0, @local}, &(0x7f0000000080)=0x10) ioctl$TCSETAF(r0, 0x5408, &(0x7f0000000040)={0x2}) ioctl$EXT4_IOC_GROUP_ADD(r0, 0x40286608, &(0x7f0000000000)={0x3, 0x7000000, 0x400, 0x100000000, 0x0, 0x8}) r3 = fcntl$dupfd(r0, 0x406, r0) ioctl$EVIOCGVERSION(r3, 0x80044501, &(0x7f0000000200)=""/31) write$binfmt_misc(r0, &(0x7f0000000080)={'syz1', "80fa25cdc862d216160cfa92845a3916e38a409a159c03f1889971d3e5144a8d08de78c4b1fbee457437261d7668b1c0f582647ad4134a05358d4309a71a702002329e024cac95642e761bb842bc1056bd6bf12c47697a649a026bd8ee1f685089941469b1ddfeddf32b392f0ff07652a3bce0770bc3bb70862845a65054cecb191e80b825d740fe6b40450359757032425dfdee92aec36ce4b468d50adc745c522cc4af2ac6e7f6a95f0edd70b09caa95fcc7143cf46b74db8bc17fa7c89f"}, 0xc3) 14:04:02 executing program 0: r0 = openat$pfkey(0xffffffffffffff9c, &(0x7f00000000c0)='/proc/self/net/pfkey\x00', 0x20000200900, 0x0) r1 = syz_open_pts(r0, 0xc00) ioctl$TCSETXF(r1, 0x5434, &(0x7f0000000000)={0x6, 0x1000, [0x13e, 0x80000001, 0x7fff, 0x9d1, 0x200040000000000], 0x6}) r2 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/ptmx\x00', 0x200000, 0x0) ioctl$sock_netdev_private(r0, 0x89f7, &(0x7f0000000040)="fa4bf5607effb3cfe6768aadfe1d35be") ioctl$TCFLSH(r2, 0x540b, 0x8) [ 348.327604] binder: 12465:12466 transaction failed 29189/-3, size 0-24 line 3256 [ 348.328012] binder: BINDER_SET_CONTEXT_MGR already set [ 348.328018] binder: 12465:12466 ioctl 40046207 0 returned -16 14:04:02 executing program 0: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCGPGRP(r0, 0x540f, &(0x7f0000000000)) ioctl$TCFLSH(r0, 0x540b, 0x1) 14:04:02 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) r2 = dup3(r1, r0, 0x80000) write$FUSE_NOTIFY_STORE(r2, &(0x7f0000000000)={0x32, 0x4, 0x0, {0x6, 0x4, 0xa, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}}, 0x32) linkat(r2, &(0x7f0000000040)='./file0\x00', r2, &(0x7f0000000080)='./file0\x00', 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f00000001c0)=[@acquire], 0x0, 0x0, 0x0}) 14:04:02 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, &(0x7f0000000040)={0x0}) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, &(0x7f0000000080)={r1}) 14:04:02 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSPTLCK(r0, 0x40045431, &(0x7f0000000180)) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) socket(0x200000000000011, 0x4000000000080002, 0x0) bind$packet(0xffffffffffffffff, 0x0, 0x0) sendmmsg(0xffffffffffffffff, &(0x7f0000007880)=[{{&(0x7f00000001c0)=@l2={0x1f, 0xbf53, {0x9, 0x7, 0xfffffffffffffdd5, 0x1ff, 0x2, 0x4}, 0x0, 0x7}, 0x80, 0x0}}, {{0x0, 0x0, &(0x7f0000007780)}}], 0x2, 0x4048851) setsockopt$packet_int(0xffffffffffffffff, 0x107, 0x0, 0x0, 0x0) syz_open_procfs(0x0, 0x0) ioctl$LOOP_SET_BLOCK_SIZE(0xffffffffffffffff, 0x4c09, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$cgroup_int(0xffffffffffffffff, 0x0, 0x2, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='\x89\x00\x00\x00\x00Ew\x00\x00\x00\xef\xb4\xc8\xd0\xff\xda\xb1vents\xd9\xc5H\xd4\x91\xfdN_]\x16\xe4\xa9C\xd2\x86Qn\xefS\x80\x11J\xfb4\x14\x86 4\x95\x9e\xfc\xc1\a\xcb \x95N\xe9\xa4j\xd2\x1f^\xb0\xb2>\xa3\xc9\xb7$\x11`t\x03: \x8b\xa4\x05\xf2?E\xdb+{t\xb8\xf7\xab\x8b\x100#', 0x26e1, 0x0) ioctl$PERF_EVENT_IOC_PAUSE_OUTPUT(r1, 0x40086602, 0x400007) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000280)='./cgroup/syz0\x00', 0x1ff) openat$smack_thread_current(0xffffffffffffff9c, &(0x7f0000000240)='/proc/thread-self/attr/current\x00', 0x2, 0x0) write$cgroup_subtree(r1, &(0x7f0000000100)=ANY=[], 0xff4a) write$cgroup_subtree(r2, &(0x7f0000000000)=ANY=[], 0x20032600) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a0f, 0x1700) accept$inet(0xffffffffffffffff, &(0x7f0000000040)={0x2, 0x0, @local}, &(0x7f0000000080)=0x10) ioctl$TCSETAF(r0, 0x5408, &(0x7f0000000040)={0x2}) ioctl$EXT4_IOC_GROUP_ADD(r0, 0x40286608, &(0x7f0000000000)={0x3, 0x7000000, 0x400, 0x100000000, 0x0, 0x8}) r3 = fcntl$dupfd(r0, 0x406, r0) ioctl$EVIOCGVERSION(r3, 0x80044501, &(0x7f0000000200)=""/31) write$binfmt_misc(r0, &(0x7f0000000080)={'syz1', "80fa25cdc862d216160cfa92845a3916e38a409a159c03f1889971d3e5144a8d08de78c4b1fbee457437261d7668b1c0f582647ad4134a05358d4309a71a702002329e024cac95642e761bb842bc1056bd6bf12c47697a649a026bd8ee1f685089941469b1ddfeddf32b392f0ff07652a3bce0770bc3bb70862845a65054cecb191e80b825d740fe6b40450359757032425dfdee92aec36ce4b468d50adc745c522cc4af2ac6e7f6a95f0edd70b09caa95fcc7143cf46b74db8bc17fa7c89f"}, 0xc3) 14:04:02 executing program 1: r0 = socket(0x0, 0x0, 0x0) r1 = syz_open_procfs(0x0, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$cgroup_int(0xffffffffffffffff, 0x0, 0x2, 0x0) r2 = openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x7a05, 0x1700) openat$smack_thread_current(0xffffffffffffff9c, &(0x7f0000000240)='/proc/thread-self/attr/current\x00', 0x2, 0x0) write$cgroup_subtree(0xffffffffffffffff, 0x0, 0x0) ioctl$TCSETAF(0xffffffffffffffff, 0x5408, &(0x7f0000000040)) ioctl$EXT4_IOC_GROUP_ADD(0xffffffffffffffff, 0x40286608, 0x0) r3 = syz_genetlink_get_family_id$team(&(0x7f0000000080)='team\x00') ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f00000036c0)={'veth0\x00', 0x0}) getsockopt$inet_pktinfo(r0, 0x0, 0x8, &(0x7f0000003980)={0x0, @multicast1, @loopback}, &(0x7f00000039c0)=0xc) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000003b80)={'erspan0\x00', 0x0}) getsockopt$inet_pktinfo(r1, 0x0, 0x8, &(0x7f0000003bc0)={0x0, @empty, @multicast1}, &(0x7f0000003c00)=0xc) getpeername$packet(r2, &(0x7f0000003d80)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000003dc0)=0x14) getpeername$packet(r2, &(0x7f0000003e00)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000003e40)=0x14) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000003e80)={'syzkaller1\x00', 0x0}) accept4$packet(r1, &(0x7f0000004540)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @link_local}, &(0x7f0000004580)=0x14, 0x800) getsockopt$inet6_IPV6_XFRM_POLICY(r1, 0x29, 0x23, &(0x7f00000045c0)={{{@in=@multicast1, @in=@dev, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@dev}, 0x0, @in6=@dev}}, &(0x7f00000046c0)=0xe8) getsockname$packet(r2, &(0x7f0000004700)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000004740)=0x14) getsockname$packet(r2, &(0x7f0000004780)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @remote}, &(0x7f00000047c0)=0x14) getpeername$packet(r1, &(0x7f0000004800)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000004840)=0x14) getsockopt$inet_pktinfo(r2, 0x0, 0x8, &(0x7f0000004880)={0x0, @broadcast, @loopback}, &(0x7f00000048c0)=0xc) getpeername$packet(r2, &(0x7f0000004900)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @random}, &(0x7f0000004940)=0x14) getsockopt$inet_pktinfo(r0, 0x0, 0x8, &(0x7f0000004980)={0x0, @empty, @multicast2}, &(0x7f00000049c0)=0xc) sendmsg$TEAM_CMD_OPTIONS_SET(r0, &(0x7f0000004f40)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x4004800}, 0xc, &(0x7f0000004f00)={&(0x7f0000004a00)={0x500, r3, 0x200, 0x70bd2d, 0x25dfdbfd, {}, [{{0x8, 0x1, r4}, {0x1c4, 0x2, [{0x44, 0x1, @name={{0x24, 0x1, 'mode\x00'}, {0x8}, {0x14, 0x4, 'activebackup\x00'}}}, {0x38, 0x1, @mcast_rejoin_count={{0x24, 0x1, 'mcast_rejoin_count\x00'}, {0x8}, {0x8, 0x4, 0x2614}}}, {0x40, 0x1, @lb_tx_hash_to_port_mapping={{{0x24, 0x1, 'lb_tx_hash_to_port_mapping\x00'}, {0x8}, {0x8, 0x4, r5}}, {0x8}}}, {0x40, 0x1, @lb_port_stats={{{0x24, 0x1, 'lb_port_stats\x00'}, {0x8}, {0x8, 0x4, 0x1d}}, {0x8, 0x6, r6}}}, {0x40, 0x1, @lb_tx_hash_to_port_mapping={{{0x24, 0x1, 'lb_tx_hash_to_port_mapping\x00'}, {0x8}, {0x8, 0x4, r7}}, {0x8}}}, {0x38, 0x1, @notify_peers_count={{0x24, 0x1, 'notify_peers_count\x00'}, {0x8}, {0x8, 0x4, 0x5}}}, {0x4c, 0x1, @lb_tx_method={{0x24, 0x1, 'lb_tx_method\x00'}, {0x8}, {0x1c, 0x4, 'hash_to_port_mapping\x00'}}}]}}, {{0x8, 0x1, r8}, {0xdc, 0x2, [{0x3c, 0x1, @enabled={{{0x24, 0x1, 'enabled\x00'}, {0x8}, {0x4}}, {0x8, 0x6, r9}}}, {0x38, 0x1, @activeport={{0x24, 0x1, 'activeport\x00'}, {0x8}, {0x8, 0x4, r10}}}, {0x64, 0x1, @bpf_hash_func={{0x24, 0x1, 'bpf_hash_func\x00'}, {0x8}, {0x34, 0x4, [{0x8, 0x9, 0x7f, 0x81}, {0x8, 0x7, 0x5, 0x7}, {0x4, 0x100, 0x5, 0x2}, {0x9, 0x2, 0x2, 0x1f}, {0x4, 0x800000000000000, 0x1}, {0x100000000, 0x4, 0x0, 0x4}]}}}]}}, {{0x8, 0x1, r11}, {0x50, 0x2, [{0x4c, 0x1, @lb_tx_method={{0x24, 0x1, 'lb_tx_method\x00'}, {0x8}, {0x1c, 0x4, 'hash_to_port_mapping\x00'}}}]}}, {{0x8, 0x1, r12}, {0x9c, 0x2, [{0x3c, 0x1, @user_linkup={{{0x24, 0x1, 'user_linkup\x00'}, {0x8}, {0x4}}, {0x8, 0x6, r13}}}, {0x5c, 0x1, @bpf_hash_func={{0x24, 0x1, 'bpf_hash_func\x00'}, {0x8}, {0x2c, 0x4, [{0x100, 0x3cd, 0x9, 0xbef4}, {0x8, 0xffffffff9fba7e11, 0x80000001, 0xd9}, {0x7, 0x8, 0x5, 0x9}, {0x9, 0x9, 0x8, 0x8001}, {0x63, 0x81, 0xf1, 0x80000001}]}}}]}}, {{0x8, 0x1, r14}, {0x12c, 0x2, [{0x38, 0x1, @mcast_rejoin_count={{0x24, 0x1, 'mcast_rejoin_count\x00'}, {0x8}, {0x8, 0x4, 0x100000001}}}, {0x38, 0x1, @mcast_rejoin_interval={{0x24, 0x1, 'mcast_rejoin_interval\x00'}, {0x8}, {0x8, 0x4, 0x3}}}, {0x3c, 0x1, @user_linkup_enabled={{{0x24, 0x1, 'user_linkup_enabled\x00'}, {0x8}, {0x4}}, {0x8, 0x6, r15}}}, {0x40, 0x1, @lb_tx_hash_to_port_mapping={{{0x24, 0x1, 'lb_tx_hash_to_port_mapping\x00'}, {0x8}, {0x8, 0x4, r16}}, {0x8}}}, {0x3c, 0x1, @user_linkup_enabled={{{0x24, 0x1, 'user_linkup_enabled\x00'}, {0x8}, {0x4}}, {0x8, 0x6, r17}}}]}}, {{0x8, 0x1, r18}, {0x4}}]}, 0x500}, 0x1, 0x0, 0x0, 0x8000}, 0x48881) ioctl$EVIOCGVERSION(0xffffffffffffffff, 0x80044501, 0x0) [ 348.406377] binder: 12472:12485 BC_REQUEST_DEATH_NOTIFICATION invalid ref 2 [ 348.419691] binder: 12472:12530 BC_REQUEST_DEATH_NOTIFICATION invalid ref 2 [ 348.590075] binder: 12574:12584 ioctl 800c6613 20000100 returned -22 14:04:02 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000500)={0xb8, 0x0, &(0x7f0000000340)=[@transaction_sg={0x40486311, {{0x0, 0x0, 0x4, 0x0, 0x11, 0x0, 0x0, 0x0, 0x18, &(0x7f00000001c0), &(0x7f0000000200)=[0x30, 0x38, 0x0]}, 0x4}}, @clear_death, @register_looper, @transaction_sg={0x40486311, {{0x4, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x60, 0x8, &(0x7f0000000280)=[@ptr={0x70742a85, 0x0, &(0x7f0000000240), 0x1, 0x2, 0x5}, @fda={0x66646185, 0x4, 0x0, 0x1f}, @fd={0x66642a85, 0x0, r0, 0x0, 0x3}], &(0x7f0000000300)=[0x30]}, 0xffffffffffff27b9}}, @dead_binder_done={0x40086310, 0x3}], 0xd6, 0x0, &(0x7f0000000400)="70602ea627f3f733248660b67770dc63c1e7a792bf6f8eb2e8c4a8197b9c398e156fa26604d527aab47ff903b210f1099614a3816b4f03a3ba81d642f2bcafe9176ce10ef3ae599d6fb9e5ebf8bb528857d7fa1db8a770d2f7da6949c2c478b355178aa6950bd7ce6ff998a6be20cf4354206c67b3586aa6e79f556ddb4bb7ebd31885add23fcbdfd800c0e4bf6b74e8b0389681ff1258cc8487590c33d68e369cddf6945e7001f8f85050c84ac112e7e9d42d2ca26b8b718d0316646661928b2b449a9fd5da49f3e00ae1dc1c1bba78b68db274f76e"}) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, &(0x7f0000000040)) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x800, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendmsg$key(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000000)={0x0}}, 0x0) prctl$PR_CAP_AMBIENT(0x2f, 0x4, 0x24) sendmsg$key(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000200)=ANY=[@ANYBLOB="020700001000000000000000000000000800120000000100000000000000000006000000000000000000000000000200e00040e0ff00000000000000000000000000ada8008004000000200000000000030006000000000002000080ac14ffbbf00000000000000003000500000000000200423b1d632bd7b8200000000000c7"], 0x80}}, 0x0) r1 = socket$key(0xf, 0x3, 0x2) sendmmsg(r1, &(0x7f0000000180), 0x32bc45944b084a6, 0x0) r2 = gettid() ioctl$sock_SIOCGPGRP(0xffffffffffffffff, 0x8904, &(0x7f0000000180)=0x0) tgkill(r2, r3, 0x3) mmap$binder(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x2, 0xc0010, r0, 0x0) r4 = mmap$binder(&(0x7f0000ffb000/0x1000)=nil, 0x1000, 0x1000004, 0x104030, r0, 0x0) llistxattr(&(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)=""/186, 0xba) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, &(0x7f0000000080)={r4}) prctl$PR_SET_TSC(0x1a, 0x1) [ 348.591628] binder: BINDER_SET_CONTEXT_MGR already set 14:04:02 executing program 0: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(r0, 0x540b, 0x1) 14:04:02 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSPTLCK(r0, 0x40045431, &(0x7f0000000180)) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) socket(0x200000000000011, 0x4000000000080002, 0x0) bind$packet(0xffffffffffffffff, 0x0, 0x0) sendmmsg(0xffffffffffffffff, &(0x7f0000007880)=[{{&(0x7f00000001c0)=@l2={0x1f, 0xbf53, {0x9, 0x7, 0xfffffffffffffdd5, 0x1ff, 0x2, 0x4}, 0x0, 0x7}, 0x80, 0x0}}, {{0x0, 0x0, &(0x7f0000007780)}}], 0x2, 0x4048851) setsockopt$packet_int(0xffffffffffffffff, 0x107, 0x0, 0x0, 0x0) syz_open_procfs(0x0, 0x0) ioctl$LOOP_SET_BLOCK_SIZE(0xffffffffffffffff, 0x4c09, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$cgroup_int(0xffffffffffffffff, 0x0, 0x2, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='\x89\x00\x00\x00\x00Ew\x00\x00\x00\xef\xb4\xc8\xd0\xff\xda\xb1vents\xd9\xc5H\xd4\x91\xfdN_]\x16\xe4\xa9C\xd2\x86Qn\xefS\x80\x11J\xfb4\x14\x86 4\x95\x9e\xfc\xc1\a\xcb \x95N\xe9\xa4j\xd2\x1f^\xb0\xb2>\xa3\xc9\xb7$\x11`t\x03: \x8b\xa4\x05\xf2?E\xdb+{t\xb8\xf7\xab\x8b\x100#', 0x26e1, 0x0) ioctl$PERF_EVENT_IOC_PAUSE_OUTPUT(r1, 0x40086602, 0x400007) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000280)='./cgroup/syz0\x00', 0x1ff) openat$smack_thread_current(0xffffffffffffff9c, &(0x7f0000000240)='/proc/thread-self/attr/current\x00', 0x2, 0x0) write$cgroup_subtree(r1, &(0x7f0000000100)=ANY=[], 0xff4a) write$cgroup_subtree(r2, &(0x7f0000000000)=ANY=[], 0x20032600) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a0f, 0x1700) accept$inet(0xffffffffffffffff, &(0x7f0000000040)={0x2, 0x0, @local}, &(0x7f0000000080)=0x10) ioctl$TCSETAF(r0, 0x5408, &(0x7f0000000040)={0x2}) ioctl$EXT4_IOC_GROUP_ADD(r0, 0x40286608, &(0x7f0000000000)={0x3, 0x7000000, 0x400, 0x100000000, 0x0, 0x8}) r3 = fcntl$dupfd(r0, 0x406, r0) ioctl$EVIOCGVERSION(r3, 0x80044501, &(0x7f0000000200)=""/31) write$binfmt_misc(r0, &(0x7f0000000080)={'syz1', "80fa25cdc862d216160cfa92845a3916e38a409a159c03f1889971d3e5144a8d08de78c4b1fbee457437261d7668b1c0f582647ad4134a05358d4309a71a702002329e024cac95642e761bb842bc1056bd6bf12c47697a649a026bd8ee1f685089941469b1ddfeddf32b392f0ff07652a3bce0770bc3bb70862845a65054cecb191e80b825d740fe6b40450359757032425dfdee92aec36ce4b468d50adc745c522cc4af2ac6e7f6a95f0edd70b09caa95fcc7143cf46b74db8bc17fa7c89f"}, 0xc3) 14:04:02 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, &(0x7f0000000000)) [ 348.591638] binder: 12578:12592 ioctl 40046207 0 returned -16 14:04:02 executing program 3: syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) pipe2(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80800) ioctl$GIO_FONT(r0, 0x4b60, &(0x7f0000000040)) syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) 14:04:02 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000500)={0xb8, 0x0, &(0x7f0000000340)=[@transaction_sg={0x40486311, {{0x0, 0x0, 0x4, 0x0, 0x11, 0x0, 0x0, 0x0, 0x18, &(0x7f00000001c0), &(0x7f0000000200)=[0x30, 0x38, 0x0]}, 0x4}}, @clear_death, @register_looper, @transaction_sg={0x40486311, {{0x4, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x60, 0x8, &(0x7f0000000280)=[@ptr={0x70742a85, 0x0, &(0x7f0000000240), 0x1, 0x2, 0x5}, @fda={0x66646185, 0x4, 0x0, 0x1f}, @fd={0x66642a85, 0x0, r0, 0x0, 0x3}], &(0x7f0000000300)=[0x30]}, 0xffffffffffff27b9}}, @dead_binder_done={0x40086310, 0x3}], 0xd6, 0x0, &(0x7f0000000400)="70602ea627f3f733248660b67770dc63c1e7a792bf6f8eb2e8c4a8197b9c398e156fa26604d527aab47ff903b210f1099614a3816b4f03a3ba81d642f2bcafe9176ce10ef3ae599d6fb9e5ebf8bb528857d7fa1db8a770d2f7da6949c2c478b355178aa6950bd7ce6ff998a6be20cf4354206c67b3586aa6e79f556ddb4bb7ebd31885add23fcbdfd800c0e4bf6b74e8b0389681ff1258cc8487590c33d68e369cddf6945e7001f8f85050c84ac112e7e9d42d2ca26b8b718d0316646661928b2b449a9fd5da49f3e00ae1dc1c1bba78b68db274f76e"}) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, &(0x7f0000000040)) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x800, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendmsg$key(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000000)={0x0}}, 0x0) prctl$PR_CAP_AMBIENT(0x2f, 0x4, 0x24) sendmsg$key(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000200)=ANY=[@ANYBLOB="020700001000000000000000000000000800120000000100000000000000000006000000000000000000000000000200e00040e0ff00000000000000000000000000ada8008004000000200000000000030006000000000002000080ac14ffbbf00000000000000003000500000000000200423b1d632bd7b8200000000000c7"], 0x80}}, 0x0) r1 = socket$key(0xf, 0x3, 0x2) sendmmsg(r1, &(0x7f0000000180), 0x32bc45944b084a6, 0x0) r2 = gettid() ioctl$sock_SIOCGPGRP(0xffffffffffffffff, 0x8904, &(0x7f0000000180)=0x0) tgkill(r2, r3, 0x3) mmap$binder(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x2, 0xc0010, r0, 0x0) r4 = mmap$binder(&(0x7f0000ffb000/0x1000)=nil, 0x1000, 0x1000004, 0x104030, r0, 0x0) llistxattr(&(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)=""/186, 0xba) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, &(0x7f0000000080)={r4}) prctl$PR_SET_TSC(0x1a, 0x1) 14:04:02 executing program 0: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x80000000000, 0x0) ioctl$TCFLSH(r0, 0x540b, 0x1) 14:04:02 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) lsetxattr$trusted_overlay_origin(&(0x7f0000000040)='./file0\x00', &(0x7f0000000080)='trusted.overlay.origin\x00', &(0x7f00000000c0)='y\x00', 0x2, 0x2) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, &(0x7f0000000000)) 14:04:02 executing program 3: syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) r0 = socket$inet(0x2, 0x1, 0x0) r1 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r1, &(0x7f0000000140)={0x2, 0x4e20, @dev}, 0x10) listen(r1, 0x0) setsockopt$sock_int(r0, 0x1, 0x2, &(0x7f0000356ffc)=0xffffffffffffff40, 0x4) setsockopt$sock_int(r1, 0x1, 0x2, &(0x7f0000000080)=0x2d8c, 0x4) bind$inet(r0, &(0x7f00000001c0)={0x2, 0x4e20, @remote}, 0x10) r2 = syz_open_dev$binder(0x0, 0x0, 0xffffffffffffffff) openat$zero(0xffffffffffffff9c, &(0x7f0000000000)='/dev/zero\x00', 0x400000, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB="7244fa936c0e02de"], 0x0, 0x0, 0x0}) [ 348.603094] binder: 12574:12595 ioctl 800c6613 20000100 returned -22 14:04:02 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSPTLCK(r0, 0x40045431, &(0x7f0000000180)) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) socket(0x200000000000011, 0x4000000000080002, 0x0) bind$packet(0xffffffffffffffff, 0x0, 0x0) sendmmsg(0xffffffffffffffff, &(0x7f0000007880)=[{{&(0x7f00000001c0)=@l2={0x1f, 0xbf53, {0x9, 0x7, 0xfffffffffffffdd5, 0x1ff, 0x2, 0x4}, 0x0, 0x7}, 0x80, 0x0}}, {{0x0, 0x0, &(0x7f0000007780)}}], 0x2, 0x4048851) setsockopt$packet_int(0xffffffffffffffff, 0x107, 0x0, 0x0, 0x0) syz_open_procfs(0x0, 0x0) ioctl$LOOP_SET_BLOCK_SIZE(0xffffffffffffffff, 0x4c09, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$cgroup_int(0xffffffffffffffff, 0x0, 0x2, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='\x89\x00\x00\x00\x00Ew\x00\x00\x00\xef\xb4\xc8\xd0\xff\xda\xb1vents\xd9\xc5H\xd4\x91\xfdN_]\x16\xe4\xa9C\xd2\x86Qn\xefS\x80\x11J\xfb4\x14\x86 4\x95\x9e\xfc\xc1\a\xcb \x95N\xe9\xa4j\xd2\x1f^\xb0\xb2>\xa3\xc9\xb7$\x11`t\x03: \x8b\xa4\x05\xf2?E\xdb+{t\xb8\xf7\xab\x8b\x100#', 0x26e1, 0x0) ioctl$PERF_EVENT_IOC_PAUSE_OUTPUT(r1, 0x40086602, 0x400007) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000280)='./cgroup/syz0\x00', 0x1ff) openat$smack_thread_current(0xffffffffffffff9c, &(0x7f0000000240)='/proc/thread-self/attr/current\x00', 0x2, 0x0) write$cgroup_subtree(r1, &(0x7f0000000100)=ANY=[], 0xff4a) write$cgroup_subtree(r2, &(0x7f0000000000)=ANY=[], 0x20032600) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a0f, 0x1700) accept$inet(0xffffffffffffffff, &(0x7f0000000040)={0x2, 0x0, @local}, &(0x7f0000000080)=0x10) ioctl$TCSETAF(r0, 0x5408, &(0x7f0000000040)={0x2}) ioctl$EXT4_IOC_GROUP_ADD(r0, 0x40286608, &(0x7f0000000000)={0x3, 0x7000000, 0x400, 0x100000000, 0x0, 0x8}) r3 = fcntl$dupfd(r0, 0x406, r0) ioctl$EVIOCGVERSION(r3, 0x80044501, &(0x7f0000000200)=""/31) write$binfmt_misc(r0, &(0x7f0000000080)={'syz1', "80fa25cdc862d216160cfa92845a3916e38a409a159c03f1889971d3e5144a8d08de78c4b1fbee457437261d7668b1c0f582647ad4134a05358d4309a71a702002329e024cac95642e761bb842bc1056bd6bf12c47697a649a026bd8ee1f685089941469b1ddfeddf32b392f0ff07652a3bce0770bc3bb70862845a65054cecb191e80b825d740fe6b40450359757032425dfdee92aec36ce4b468d50adc745c522cc4af2ac6e7f6a95f0edd70b09caa95fcc7143cf46b74db8bc17fa7c89f"}, 0xc3) 14:04:02 executing program 0: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(r0, 0x540b, 0x1) [ 348.805073] binder_alloc: 12244: binder_alloc_buf, no vma 14:04:03 executing program 1: socket(0x0, 0x0, 0x0) syz_open_procfs(0x0, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$cgroup_int(0xffffffffffffffff, 0x0, 0x2, 0x0) openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x7a05, 0x1700) openat$smack_thread_current(0xffffffffffffff9c, &(0x7f0000000240)='/proc/thread-self/attr/current\x00', 0x2, 0x0) write$cgroup_subtree(0xffffffffffffffff, 0x0, 0x0) ioctl$TCSETAF(0xffffffffffffffff, 0x5408, &(0x7f0000000040)) ioctl$EXT4_IOC_GROUP_ADD(0xffffffffffffffff, 0x40286608, 0x0) ioctl$EVIOCGVERSION(0xffffffffffffffff, 0x80044501, 0x0) 14:04:03 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = openat$zero(0xffffffffffffff9c, &(0x7f0000000040)='/dev/zero\x00', 0x80, 0x0) ioctl$BLKFLSBUF(r1, 0x1261, &(0x7f0000000080)) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, &(0x7f0000000000)) 14:04:03 executing program 3: syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0x0, 0x0) syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f00000001c0)=[@acquire], 0x0, 0x0, 0x0}) 14:04:03 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSPTLCK(r0, 0x40045431, &(0x7f0000000180)) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) socket(0x200000000000011, 0x4000000000080002, 0x0) bind$packet(0xffffffffffffffff, 0x0, 0x0) sendmmsg(0xffffffffffffffff, &(0x7f0000007880)=[{{&(0x7f00000001c0)=@l2={0x1f, 0xbf53, {0x9, 0x7, 0xfffffffffffffdd5, 0x1ff, 0x2, 0x4}, 0x0, 0x7}, 0x80, 0x0}}, {{0x0, 0x0, &(0x7f0000007780)}}], 0x2, 0x4048851) setsockopt$packet_int(0xffffffffffffffff, 0x107, 0x0, 0x0, 0x0) syz_open_procfs(0x0, 0x0) ioctl$LOOP_SET_BLOCK_SIZE(0xffffffffffffffff, 0x4c09, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) openat$cgroup_int(0xffffffffffffffff, 0x0, 0x2, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='\x89\x00\x00\x00\x00Ew\x00\x00\x00\xef\xb4\xc8\xd0\xff\xda\xb1vents\xd9\xc5H\xd4\x91\xfdN_]\x16\xe4\xa9C\xd2\x86Qn\xefS\x80\x11J\xfb4\x14\x86 4\x95\x9e\xfc\xc1\a\xcb \x95N\xe9\xa4j\xd2\x1f^\xb0\xb2>\xa3\xc9\xb7$\x11`t\x03: \x8b\xa4\x05\xf2?E\xdb+{t\xb8\xf7\xab\x8b\x100#', 0x26e1, 0x0) ioctl$PERF_EVENT_IOC_PAUSE_OUTPUT(r1, 0x40086602, 0x400007) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000280)='./cgroup/syz0\x00', 0x1ff) openat$smack_thread_current(0xffffffffffffff9c, &(0x7f0000000240)='/proc/thread-self/attr/current\x00', 0x2, 0x0) write$cgroup_subtree(r1, &(0x7f0000000100)=ANY=[], 0xff4a) write$cgroup_subtree(r2, &(0x7f0000000000)=ANY=[], 0x20032600) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a0f, 0x1700) accept$inet(0xffffffffffffffff, &(0x7f0000000040)={0x2, 0x0, @local}, &(0x7f0000000080)=0x10) ioctl$TCSETAF(r0, 0x5408, &(0x7f0000000040)={0x2}) ioctl$EXT4_IOC_GROUP_ADD(r0, 0x40286608, &(0x7f0000000000)={0x3, 0x7000000, 0x400, 0x100000000, 0x0, 0x8}) r3 = fcntl$dupfd(r0, 0x406, r0) ioctl$EVIOCGVERSION(r3, 0x80044501, &(0x7f0000000200)=""/31) write$binfmt_misc(r0, &(0x7f0000000080)={'syz1', "80fa25cdc862d216160cfa92845a3916e38a409a159c03f1889971d3e5144a8d08de78c4b1fbee457437261d7668b1c0f582647ad4134a05358d4309a71a702002329e024cac95642e761bb842bc1056bd6bf12c47697a649a026bd8ee1f685089941469b1ddfeddf32b392f0ff07652a3bce0770bc3bb70862845a65054cecb191e80b825d740fe6b40450359757032425dfdee92aec36ce4b468d50adc745c522cc4af2ac6e7f6a95f0edd70b09caa95fcc7143cf46b74db8bc17fa7c89f"}, 0xc3) 14:04:03 executing program 0: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(r0, 0x540b, 0x24000000) 14:04:03 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000500)={0xb8, 0x0, &(0x7f0000000340)=[@transaction_sg={0x40486311, {{0x0, 0x0, 0x4, 0x0, 0x11, 0x0, 0x0, 0x0, 0x18, &(0x7f00000001c0), &(0x7f0000000200)=[0x30, 0x38, 0x0]}, 0x4}}, @clear_death, @register_looper, @transaction_sg={0x40486311, {{0x4, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x60, 0x8, &(0x7f0000000280)=[@ptr={0x70742a85, 0x0, &(0x7f0000000240), 0x1, 0x2, 0x5}, @fda={0x66646185, 0x4, 0x0, 0x1f}, @fd={0x66642a85, 0x0, r0, 0x0, 0x3}], &(0x7f0000000300)=[0x30]}, 0xffffffffffff27b9}}, @dead_binder_done={0x40086310, 0x3}], 0xd6, 0x0, &(0x7f0000000400)="70602ea627f3f733248660b67770dc63c1e7a792bf6f8eb2e8c4a8197b9c398e156fa26604d527aab47ff903b210f1099614a3816b4f03a3ba81d642f2bcafe9176ce10ef3ae599d6fb9e5ebf8bb528857d7fa1db8a770d2f7da6949c2c478b355178aa6950bd7ce6ff998a6be20cf4354206c67b3586aa6e79f556ddb4bb7ebd31885add23fcbdfd800c0e4bf6b74e8b0389681ff1258cc8487590c33d68e369cddf6945e7001f8f85050c84ac112e7e9d42d2ca26b8b718d0316646661928b2b449a9fd5da49f3e00ae1dc1c1bba78b68db274f76e"}) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, &(0x7f0000000040)) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x800, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendmsg$key(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000000)={0x0}}, 0x0) prctl$PR_CAP_AMBIENT(0x2f, 0x4, 0x24) sendmsg$key(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000200)=ANY=[@ANYBLOB="020700001000000000000000000000000800120000000100000000000000000006000000000000000000000000000200e00040e0ff00000000000000000000000000ada8008004000000200000000000030006000000000002000080ac14ffbbf00000000000000003000500000000000200423b1d632bd7b8200000000000c7"], 0x80}}, 0x0) r1 = socket$key(0xf, 0x3, 0x2) sendmmsg(r1, &(0x7f0000000180), 0x32bc45944b084a6, 0x0) r2 = gettid() ioctl$sock_SIOCGPGRP(0xffffffffffffffff, 0x8904, &(0x7f0000000180)=0x0) tgkill(r2, r3, 0x3) mmap$binder(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x2, 0xc0010, r0, 0x0) r4 = mmap$binder(&(0x7f0000ffb000/0x1000)=nil, 0x1000, 0x1000004, 0x104030, r0, 0x0) llistxattr(&(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)=""/186, 0xba) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, &(0x7f0000000080)={r4}) [ 348.805104] binder: 12661:12667 transaction failed 29189/-3, size 0-24 line 3256 [ 348.805276] binder: BINDER_SET_CONTEXT_MGR already set [ 348.805283] binder: 12661:12667 ioctl 40046207 0 returned -16 14:04:03 executing program 3: syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) setxattr$trusted_overlay_redirect(&(0x7f0000000000)='./file0\x00', &(0x7f0000000040)='trusted.overlay.redirect\x00', &(0x7f0000000080)='./file0\x00', 0x8, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f00000001c0)=[@acquire], 0x0, 0x0, 0x0}) 14:04:03 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000080)={0x0, 0xffffffffffffffff, 0x0, 0x1, &(0x7f0000000040)='\x00', 0xffffffffffffffff}, 0x30) getpgrp(r1) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, &(0x7f0000000000)) syz_genetlink_get_family_id$tipc2(&(0x7f00000000c0)='TIPCv2\x00') [ 348.806596] binder: BINDER_SET_CONTEXT_MGR already set [ 348.806602] binder: 12659:12666 ioctl 40046207 0 returned -16 [ 348.807409] binder: BINDER_SET_CONTEXT_MGR already set 14:04:03 executing program 0: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(r0, 0x540b, 0x0) 14:04:03 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='cpuset.effective_cpus\x00', 0x0, 0x0) syncfs(r0) utimes(&(0x7f00000001c0)='./file0\x00', &(0x7f0000000200)={{0x77359400}, {0x0, 0x7530}}) ioctl$BLKROSET(r2, 0x125d, &(0x7f0000000180)=0xff) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="00000000964068e9f29cd69c4a324360a166264f41c7fc04b17c5e33189854c0a5beb54810180208c4abfec6d2c978d98f3a345c5c051c947459810d09f8b4ba668df10b1296ef6ed468374529fad45ffa98abb2f699ba5b4629882a72d12f4c3b2b3bd64615a5c4c26c90c811ceeff0dcfdc3fa7e7b66d36dd37cff0358b569e34facc34f88c1eaec43ee928f97cb7b67e2a67003841d790bf2fa5d6f57fd311ae5e7c8dbf1fac36520985aac0000000416f513a7bc89e3334ae051b760a172c08af9c1c44a828d70157bc94696f295d88870763b6473237faa935da4a7bcbbf948a881bda327b1c551701dda1b7eed2a4e5a4870db98c9460f6a663386d4050939b130169fa80d792df64ef3ee79d1119fd2be0fafb9506fb7a875a764e2b2b5c27b1515a3bc956b2b259443ef2be7344c24"], 0x0, 0x0, 0x0}) [ 348.807416] binder: 12659:12666 ioctl 40046207 0 returned -16 [ 348.929785] binder_alloc: 12244: binder_alloc_buf, no vma 14:04:03 executing program 5: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0x0, 0x802) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = openat$selinux_avc_cache_threshold(0xffffffffffffff9c, &(0x7f0000000040)='/selinux/avc/cache_threshold\x00', 0x2, 0x0) getpeername$packet(0xffffffffffffff9c, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000140)=0x14) sendmsg$nl_route_sched(r1, &(0x7f0000000240)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x280004}, 0xc, &(0x7f0000000200)={&(0x7f0000000180)=@newtfilter={0x5c, 0x2c, 0x100, 0x70bd2b, 0x25dfdbfd, {0x0, r2, {0xffff, 0xfff7}, {0x4, 0xf}, {0x8, 0xfff7}}, [@TCA_CHAIN={0x8, 0xb, 0x6}, @TCA_CHAIN={0x8, 0xb, 0x5}, @TCA_CHAIN={0x8, 0xb, 0x5}, @TCA_CHAIN={0x8, 0xb, 0x62}, @TCA_CHAIN={0x8, 0xb, 0x3c2}, @TCA_RATE={0x8, 0x5, {0x8, 0x10001}}, @TCA_CHAIN={0x8, 0xb, 0x7}]}, 0x5c}, 0x1, 0x0, 0x0, 0x880}, 0xc000) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, &(0x7f0000000000)) 14:04:03 executing program 1: r0 = socket(0x0, 0x0, 0x0) gettid() getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000000000)={0x0}, &(0x7f0000000080)=0xc) syz_open_procfs(r1, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$cgroup_int(0xffffffffffffffff, 0x0, 0x2, 0x0) r2 = openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x7a05, 0x1700) openat$smack_thread_current(0xffffffffffffff9c, &(0x7f0000000240)='/proc/thread-self/attr/current\x00', 0x2, 0x0) write$cgroup_subtree(0xffffffffffffffff, 0x0, 0x0) ioctl$TCSETAF(0xffffffffffffffff, 0x5408, &(0x7f0000000040)) ioctl$EXT4_IOC_GROUP_ADD(0xffffffffffffffff, 0x40286608, 0x0) write$binfmt_elf32(r2, &(0x7f0000000280)=ANY=[@ANYBLOB="7f454c4605e40080070000000000000003003f0003000000a4000000380000000503000000000000000020000200000000001a000000000000000060c50a000000000000ffff0000030000000500000008000000010000003e049f25a0cb21ce73f5878d21a1567fda00d97c50983ec4cadb65b9eb19d555f5e525ca6db36b97cc92492d2aadccc96979b857e988b0feacf306da51a70d1d4195e130a6bea64be584c73a8b9fb7becbabb0772a8254aa8a2a1486b98c03a32ca35fe9e33fe20000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000e4ffffffffffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000080000000000000000000000000000bc3581d30503000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000100"/959], 0x3bf) ioctl$EVIOCGVERSION(0xffffffffffffffff, 0x80044501, 0x0) r3 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000100)='TIPCv2\x00') sendmsg$TIPC_NL_MEDIA_SET(r0, &(0x7f0000000640)={&(0x7f00000000c0), 0xc, &(0x7f0000000200)={&(0x7f0000000140)={0x24, r3, 0x804, 0x70bd27, 0x25dfdbfc, {}, [@TIPC_NLA_NET={0x10, 0x7, [@TIPC_NLA_NET_NODEID_W1={0xc, 0x4, 0x4}]}]}, 0x24}, 0x1, 0x0, 0x0, 0x4040054}, 0x0) [ 348.929806] binder: 12741:12750 transaction failed 29189/-3, size 0-24 line 3256 14:04:03 executing program 0: dup3(0xffffffffffffff9c, 0xffffffffffffff9c, 0x80000) openat$selinux_checkreqprot(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/checkreqprot\x00', 0x80, 0x0) open(&(0x7f0000000040)='./file0\x00', 0x80, 0x8) r0 = openat$selinux_checkreqprot(0xffffffffffffff9c, &(0x7f0000000080)='/selinux/checkreqprot\x00', 0x200200, 0x0) ioctl$TCFLSH(r0, 0x540b, 0xc2) 14:04:03 executing program 3: syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="44011211c6f628a022d8bcd09981674fc4317d17d9fe83b1d6343a508fbfb0653508b766aa071cc4caccdcf9ba9eb514d34fd119abe338ebeb4e8a1657d2d19923654c7af803d7ffc2aa6158a58e361f6d666ec5944408eacc5053692510fef569f79a95917b3df94113cabdd79a102a155ba876e64f6b9be8662f5c7b4f01489fd62b3071d98ce98bf0a83404a202b8f3b20779f385bcccc21fc92dd33d8ada0620d7dd0afaf275362610c47dff96596b087657d7a491910d838eec6741dca9b5fa1bd85a7ba419f38f3c6cc071c511a4af67597b313aea9d278f17ad2d442bf762a3606c94a5b062c399f03077421f6dbaf6890cf4802d4de80d0cce64014533c540a152aa3a1ce5d33b4bff54d52240dd36708f68660182f88ad951aa9ca8239b47fd768284a6713cdf7ed817c106cdac4171a81552d0d2166508519637b9bcbff8ba8504db15b8be08152e7269694eb8252636b7c975c640"], 0x0, 0x0, 0x0}) [ 348.930576] binder: BINDER_SET_CONTEXT_MGR already set 14:04:03 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, &(0x7f0000000040)) mmap$binder(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x2000000, 0x10, r0, 0x0) r1 = mmap$binder(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x2, 0x8010, r0, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, &(0x7f0000000100)={r1}) pipe(&(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$RTC_RD_TIME(r2, 0x80247009, &(0x7f0000000280)) r3 = openat$selinux_checkreqprot(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/checkreqprot\x00', 0x50040, 0x0) r4 = syz_genetlink_get_family_id$ipvs(&(0x7f00000000c0)='IPVS\x00') sendmsg$IPVS_CMD_DEL_DEST(r3, &(0x7f0000000200)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x20002000}, 0xc, &(0x7f00000001c0)={&(0x7f0000000140)={0x6c, r4, 0x310, 0x70bd26, 0x25dfdbfe, {}, [@IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x3f}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x3}, @IPVS_CMD_ATTR_DEST={0x48, 0x2, [@IPVS_DEST_ATTR_PERSIST_CONNS={0x8, 0x9, 0xffff}, @IPVS_DEST_ATTR_PERSIST_CONNS={0x8, 0x9, 0xef6c}, @IPVS_DEST_ATTR_U_THRESH={0x8, 0x5, 0x6}, @IPVS_DEST_ATTR_ADDR={0x14, 0x1, @ipv4=@multicast1}, @IPVS_DEST_ATTR_WEIGHT={0x8, 0x4, 0xffffffffffffff01}, @IPVS_DEST_ATTR_U_THRESH={0x8, 0x5, 0x6}, @IPVS_DEST_ATTR_ADDR_FAMILY={0x8, 0xb, 0xa}]}]}, 0x6c}, 0x1, 0x0, 0x0, 0x20000001}, 0x90) [ 348.930583] binder: 12741:12750 ioctl 40046207 0 returned -16 14:04:03 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSPTLCK(r0, 0x40045431, &(0x7f0000000180)) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) socket(0x200000000000011, 0x4000000000080002, 0x0) bind$packet(0xffffffffffffffff, 0x0, 0x0) sendmmsg(0xffffffffffffffff, &(0x7f0000007880)=[{{&(0x7f00000001c0)=@l2={0x1f, 0xbf53, {0x9, 0x7, 0xfffffffffffffdd5, 0x1ff, 0x2, 0x4}, 0x0, 0x7}, 0x80, 0x0}}, {{0x0, 0x0, &(0x7f0000007780)}}], 0x2, 0x4048851) setsockopt$packet_int(0xffffffffffffffff, 0x107, 0x0, 0x0, 0x0) syz_open_procfs(0x0, 0x0) ioctl$LOOP_SET_BLOCK_SIZE(0xffffffffffffffff, 0x4c09, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) openat$cgroup_int(0xffffffffffffffff, 0x0, 0x2, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='\x89\x00\x00\x00\x00Ew\x00\x00\x00\xef\xb4\xc8\xd0\xff\xda\xb1vents\xd9\xc5H\xd4\x91\xfdN_]\x16\xe4\xa9C\xd2\x86Qn\xefS\x80\x11J\xfb4\x14\x86 4\x95\x9e\xfc\xc1\a\xcb \x95N\xe9\xa4j\xd2\x1f^\xb0\xb2>\xa3\xc9\xb7$\x11`t\x03: \x8b\xa4\x05\xf2?E\xdb+{t\xb8\xf7\xab\x8b\x100#', 0x26e1, 0x0) ioctl$PERF_EVENT_IOC_PAUSE_OUTPUT(r1, 0x40086602, 0x400007) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000280)='./cgroup/syz0\x00', 0x1ff) openat$smack_thread_current(0xffffffffffffff9c, &(0x7f0000000240)='/proc/thread-self/attr/current\x00', 0x2, 0x0) write$cgroup_subtree(r1, &(0x7f0000000100)=ANY=[], 0xff4a) write$cgroup_subtree(r2, &(0x7f0000000000)=ANY=[], 0x20032600) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a0f, 0x1700) accept$inet(0xffffffffffffffff, &(0x7f0000000040)={0x2, 0x0, @local}, &(0x7f0000000080)=0x10) ioctl$TCSETAF(r0, 0x5408, &(0x7f0000000040)={0x2}) ioctl$EXT4_IOC_GROUP_ADD(r0, 0x40286608, &(0x7f0000000000)={0x3, 0x7000000, 0x400, 0x100000000, 0x0, 0x8}) r3 = fcntl$dupfd(r0, 0x406, r0) ioctl$EVIOCGVERSION(r3, 0x80044501, &(0x7f0000000200)=""/31) write$binfmt_misc(r0, &(0x7f0000000080)={'syz1', "80fa25cdc862d216160cfa92845a3916e38a409a159c03f1889971d3e5144a8d08de78c4b1fbee457437261d7668b1c0f582647ad4134a05358d4309a71a702002329e024cac95642e761bb842bc1056bd6bf12c47697a649a026bd8ee1f685089941469b1ddfeddf32b392f0ff07652a3bce0770bc3bb70862845a65054cecb191e80b825d740fe6b40450359757032425dfdee92aec36ce4b468d50adc745c522cc4af2ac6e7f6a95f0edd70b09caa95fcc7143cf46b74db8bc17fa7c89f"}, 0xc3) 14:04:03 executing program 0: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000280)='/dev/ptmx\x00', 0x8004, 0x0) ioctl$TCFLSH(r0, 0x540b, 0x1) ioctl$FS_IOC_ENABLE_VERITY(r0, 0x6685) r1 = accept4$packet(0xffffffffffffff9c, &(0x7f0000000240)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f00000002c0)=0x14, 0x80000) setsockopt$packet_rx_ring(r1, 0x107, 0x5, &(0x7f0000005fc0)=@req={0x4, 0xbbbb, 0x1e1, 0x4}, 0x10) r2 = openat$selinux_avc_cache_threshold(0xffffffffffffff9c, &(0x7f00000001c0)='/selinux/avc/cache_threshold\x00', 0x2, 0x0) ioctl$RNDCLEARPOOL(r2, 0x5206, &(0x7f0000000200)=0x20) getsockopt$inet6_IPV6_IPSEC_POLICY(r2, 0x29, 0x22, &(0x7f00000060c0)={{{@in6=@empty, @in=@broadcast, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@loopback}, 0x0, @in6}}, &(0x7f0000005f80)=0x2e4) sendmmsg(r2, &(0x7f0000005ec0)=[{{&(0x7f0000000140)=@xdp={0x2c, 0x5, r3, 0x3a}, 0x80, &(0x7f0000001440)=[{&(0x7f0000000300)="e6b110c48f9c7c1eeaaba05218e831c0ec06d0f5ce7cc256f10c2b4d4a69664a", 0x20}, {&(0x7f0000000340)="9aa44ce26c42cfcceaf2911b27e777c1683ad0f5a52f800f3c771cb42082471a5fd945df66b9ac4ae14a7ca91652d00ac9edc64df8866e95a125dc4e6a734bbb79296d8782a452f6ac71506a17f28152358feba0ee94e321b8f66139cddb955ce2ec2796f205762eb59cfed8f675d8f40e6b7c40774804cf6f2b4bac431f9009eb64ce9d38b45bb047786916c799442960a1aaf394fb7f4424d8241cc134c1f7d1665852a06a0169f98c29182b591ed6e173c4ea8ea58d21eb441d9cf5dacf7bc6681ec015c9a328ce20c5e4e4dbca70f0e17f57f5b98c651cfb46ac8077cc3d978cc781f360488cd4a2840d97bbbc3af1b07d148393b7ff45badf150928ec05310fbc5160f6abda171033e1b129b9abcef3803089a0047b85407d1660b31fb6373b9c6887bfddcf43e370173654612ee1310c2429281a557033b3355818d3c6972a68caa03dc2bdb3110faab6213e0892d1e7b2391ad010cbb0a658e567d0345a012dd9fc528fc7940d9882ae67f531c35aa042abd913b500dc0690e902fb32f93d1b2e3c03ac052277d95792f900ea3b99059515c0d751657e668e970282aeb95d810b36487b221fba59ca12894997be2c189071fe3cf566f30c2f5481c33db56f2fdbddccc95960bbe81936a5401340a8994f7153c5a6155cee9b41ec4aa873d104ffe139c77a5533ca565755a84b99b6dafe8f7e443f7b96ddfda7f980ba3da734396ea9eb48fcbcfa694e6e880e1cfe22d05ea02ebbf8202836ee56ade756c77d79952821bbe1e242f0ec5c8eca3ba34a939f14f5b0189aad91fee86526bd7ead2a0ed4c96c6d596573215ee9c89514edbebbad690f081c785af61d8dd8addeb453f508e7ba035ccbcd3f5c29396e2af6d2097d61cb3fb0c1b805f681540a083a06fb5724f5007d861ce2b90dc520bf8b14b4aa994d2bfec643caddb57913a821873a67b783c2b6e87e801855b73ea4fe6fa01969331880f327a5a7e62c84e6c20a96e82df29265cc02a42c76d2a831afa723e29c3984ac672c38c7ae2c770f45d104cc030c1e7f73b5358515ab4a1ec598fa607eeb537a4f8c8a184d79b2f1087b6990e83ecba5ae0856c5d0612e0192c3dffbcad78d1959ef441dea4e773bbf389901c8fcdcbe040d11b8c79dc9d61f7232228e3db7288ec267b99a255602253df4e8a1c9539ca7454dbb2356d63b9230bdc6d30f274d6f6e9c0e631ad751664db5678780203bfe2983b0c95bcb2d0f3df3f9836cfb80732c805e1260740a927e91e64ca4afafc8f80c66246386162d632f15ac9428b3b3de35b580a4f0888a2c5176684c5f3aa97c6508e6474afb5b5aa10a788234690ecde5514cafb96b7efac22fe1fe41b002a28e9bd9a98724286ee3aa9d2dce98f5b505a05f6f10c45febabcfe8beb05e03f92639b2eac67ca45b92db1d698a840d0ab8b734ce08cb29fbe176839da5ad446116d4b00ca5ca817979a6854f32d8d4038a1a0385d05edd708fa9552a9276338f9484312bf7118b308c5fa8de59cb5a46f95c603a6fcdd501abf99de371827ee6180f0433db3001b4bc38271d5f309a4f3ecd7561fe0a7500daa90fd0cb21b6bddd241d8019fa22c4eee42380a04871ec7f3098202349a6a46615b5654e3d7060880f294e04bf9e32938697643f5d41c6e1728de2e233413c37f8821aed8d26d43c1e7e15b9dd4745daba867068d7959f9af2e19326fe4e506389c57cdfff374e2a0e8abad9b03d877824fb20af0369089810efe3b2c12b23c5089f9dab55b4d86f12657f2f9bd91395441d13bd77a1ced7dbb2c592e704dec2495fdf2073028e230d6f7273063bca144aaa9b1e99d4ea09fd0135f268d41862a69817b4fedb783000ecacb7800501522be2dad7faa26b5743b1a93a3de38ffc8f6bc75dcc808fcc0f07ab583466d0622ae5f15dc10e09ff6689b624e4ab6b44a477f3c20e39f0150f2ea46290cd54fca5809ce92411fadac87395bbd833bcc6b6e0ff3fa55583a546ce61f643bbd9c7f4536d8ddd00d81922347f5029fc931a3550ea01e7a28e8204c8631d7464ff020b08a9685cfcc3e3a03856671f2bfdad613ba6ac6700194f634eadc1353c424ae6f5c0fc532bb8ad3c6fffc56c2ecf6ec5c8abcf77fb756ebd7476f9e0245a39729cc8515e33e98ef0b75608b9c82b8afe917c4e66f306d7be23fdc1ee42a6e93bcc93492e41e8df70bd28ddf201fefaf549eb4c203c6285e2a688591bd6b8c2ffd467b0aab4e0198f70fc70166cb0d03aea9338daf3c9a4092d7726de98756b1af9f64b6ad7394700de0f77822f4747e5c78a9ea22225deaf722e80a55e2512caf3a9cc9711c30a1894ff0240005dfe52d013131db4a57f0bf36aa64708bf1b6f943aca9aeb4fdf06803e2fcc4567d364d8c4ef0cc418e81e5510b052deb9cb4252af1b9b36e05cf765c76e93753ea812dbd3cb1e19d9e8012151508ae419e1d0e2dbef1d53804ae78471f667daa257ff4c44fe6db4b4c7d68a73be649ec25605290808113edce8fc9f56a93b1c5c53bb8d8a56783370070c06703350ffa2e6116efa54e4068ef9b85149fb0f3ea52faeb7ac93807d6bf7692a96d91a797922f615f9eeb528d47275c6594a853f9cc0619d7fbc648224f37f0f9f984a2a01f5ee4ea70ad9a8cba457cfc05f2abd5bbfcafa196a4ef8fa46b6725115b24d4492f181e524728c2c22e0e4659755bec0cbaae2a7a8a71041c4f7c44c8007415388e02ca70db6880be830b42da889d6054f8736f2064b29b85ee6b1d972959da791b8553685fe16c37e71d479f55bbd235d423515be548c4bef8b9cc8583ce771e429afc5f7dc19f4a25b96dd298446abd0c2cf228145a1f8c619497ab5b241a197aa6dd921fe45cdd6fc56db9dbaf7b9f7a6f02befaa9fc0e1b05fbdca0e3a1f685b65f5e7523b171040636e905f4dac0421b71a6155fd55f24765137f3852888c246fb400bf382aa86668f00208eae83eeba1e571ea2b9791e6ebbf396fdf780e5d2aeedef04e1115aad517586175b5ff866b9d0dfee07f89c75490aea2d1a6978b5e4348ab37d86a03df504317b1473adcddce0660d5110fc9683e816e0e80c09f1292515c8829d034f33563ecb8128e72736481017f2d1416a8da0c40ff4120497d815cdd8570b83cf6285ba2dde48d5943f3d8a824f573f1a0551f5380cfee51ec01accf189764848a9e085899e5c3b43cc2e2ab82990095c63c243243621a65fc9abc6d9481fe47577946fa1a1405706f5de6e5172deb2c0d062e7b74c3fb4a560bc7258afbb84678ce50404de232442f3114012c24183292b4f874782e7ce7fca738b4d6473d76b95c7b59dbaa88d9696d21b473ff0133da2655a1ca40ee68f3a9f6afc71494313d95fa56cb33349be780671160551d1b1b086858035bc66e80bf81138cda38da1150a0ec4801554e38f1c3c5162e41959ab86abd90d33d50d5cc842f354886d522b3c4c00acfe25e1fcff7d4817ba8e0d38c7f8deead00dc1a7e3e2acc2385e3d60705ca9cbe0c1a62e7d055d7cb272b8e0cdba8e76fd60f3e676664d446d5585737abdd144c7ad0f994a9bd11dc8e28d00ba64aac22c6f05b4a786bb76bcab5c36fc6fa3893e9505702e6e625f268af21ca0ee4a2accc5ba6f45cfca9969fc0a60262ec9fd106315f146053717a87540ed00a38b2310ce109270e2ef5ce80ae0fbc383f1f49f04c0a7eecd9ad9c6087f06f0ebcfa7355f6b28b6c67824afb580f77e14c5ac2e6de94e2539670a8c5f3ee07a33575338f9a90ced3a22971968189ab67b504087d7d89e2157e697e219eee9088f275d426c40338b1fbf0be94aa869dc054a5cfbede3646b7b0c7c72e72955c22a339182c0c4cfdc045e596257df72cedf542ee346b79287c1faa55ebd97384aad771334a6a5dab93072d42cf077bd2238cf0214bb4de45c83b76e40f3e96d8a5b95ed4eb8d634bf131e6e210825e33f75e5c3a943a54dc4bf799cb817390cfafc53c58dc66d2b4e06c57dd2f5ed87d6cecc830050f4f7f9d80f11c883f16c656e3bc8d23f2330ce478ebd5ff11f31729a31e76e548a4ecd291c7f56447eb33ee7ca13aafede7c6eb805babe4b800376a29d000e3c453987184956d76085e3df3560f550c3dea5b08de9229ef3dc23f48f018a777becba4d000c641a328358220e0e481ef7a25c196ebc6a7f4dbfa69ea649dfead8f3225ec24fbf2f26ed1db3e8b959438b2872df67fc45bf86c0790b2eed76db4148db40f209b03b241865f84f151095cb52afb3c08f9e230fc2a1371f2d8c682825c2171a9356fd76ac0e68fb35f2e7220806274fd83fcb932f15a98af8840320a5d5a2072ac8fc2e40edec1e50c5c16afb89307171b1eae577a959a4c8448723e4ea30ab8377f08bd6ab325545b9e404477b5e372c6c674df76c1a36b2f365d1c86dcc9f6547afed01d9961d5c5e46640921c588afc92aa27b6b12e270f8a8a07efcead1073c35b05820f1b0cd59d5c8ab9af951a1a352e1c0bc029922715876c524aaf7a59197efd0dcc77fa21248981e5dad2c5cf47efb3e56dc13f2ad5cefaf8119b4488272ee54b0925e5d7f2f5601a9e8c6e6ef64a01e6b327994d7b72cc95dbc36628894fe774aac52821660845e36056389131843becee1589f9ce87e5974079a5861b801e8db206e7c6fe8b85ba0d1c6168ca195d07813b35831e0da86738133cc5b26e4e8e13fed2c8b44c7f081da00509d20dba10fcd304d440c790d734b2b16d06f822dc256c0b7fceb3d0eae1aa37fa0786848f8d3f1676a7531e893ff15956d6040bb71c7a01401bc4c168770db0d865fd5c0314f8bd0f5a1ebb1dde14f1557d053af766776b7febf15dbbd03a04eda3213382effbe43ddaacab09572f8636a27444e361a4e51f4b08ba7937c39a4f582b711436709570076d2d6eb86b9abb338edae7d4e96279d9c2b6c0e392f6f06ddf2f1cb532f6e6bab748f98b2222dce5ffa93ed90937ee5ab95d279db9569017c61126bc9bddcf9924d3eab3611d79355ab9bd0ccff90be948aca72e2b404d7bf67a877717a4e6748dbdaaa73218545a39eb39450cd0c9bbd095d65db7d897bd1e76de4101d6407dc9d933173e3b09bb13931a95ed240d30f6f28c133dab939d0322364d1744d2015010f15b8be0a7d271476a1f419f44e8c8d481fe3d75560f09f5664fcc03427326221c88e9ba409b490c3ac5fa04192609d64e24f52f1004d580d091b2fbb3f1294000c5887283f6618ce7a84357837d1f2461edc9f64cab82eb0686cdd31c7d688e96432d17154e28480a750c357ad6470049c642672c665a448c15fbf8ed04e1b2856ef306ba4b73613e38c20793424471f88ea53d570b020a69686c314d75c70ba7d71712700e15d4dd9eb6bd02591b0aaebc78306469e83f277f4cf9cfdae340bd4272b4677c604184ad5cee97dbd5a75b3716a00e9f5c209e60de5a4c3c8765709ac3df61e6a59321a369233c48c2ac3a8a4fcf6d8ef600822f1fe7f394168d3205b9c3c613bc90d53c35de435d860b1e0ebdf4abc13079c8a555c4be51912f0c943a0228c55e9709652295b88ef32e3fbc8ef38c4d555a080ec9ce45e1b7e10b01d563350826b2a53d9d31ca67c11422abfd837a0a7af11927bfbafed69ba86452471fcd51b6390880880defe13ed005a4f3067d12ab2c5d02331b90989165de5eb897e531a152aa03817ae3df619c82c072e1a9db7ff651391cffe240ed4ec82714dcdfcc50e56c0d4e8b7c553040426a72676a9c7f290b4d", 0x1000}, {&(0x7f0000001340)="6f868ac219573463f244cf1411e2c6d39191a4245039622146ab7df7b6a342a84e23ce337e5af3860e489af9a798cdb50599af0329f053f728f7cb4fbc8139bd611cac5f9ba8c805c747b40d51292bd13b41bebb5e46063fbd8e4407ece01b52d01a31b25026114fe5ac69bed5761e808fe6678cc46cd2c0473b3cd90b3b6212816827467df897aea0e16ff0f633d7ff3bd343f448ac6901382a5cffbc826f331a77b36fae8ca456ec51e5105bc603a2c7aa1da7a2c89e2fd6471d89d484cb8015035b58", 0xc4}], 0x3, &(0x7f0000001480)=[{0xf0, 0x10e, 0xffffffff80000001, "89d48dc89cbbb172e35cff346c0d1f62620b32f6d80a68679e9590a07c01644f3c911e618762b7566c39e16a09e4e4c683708287b693e58a9f1783aefc0c70d0500581849abe37d0e50f09cfcab44316121756f3ae94a8eab6b9be3685edc01b5dd9bbb1fe8818b20366d9e6437c1141871b3c61620cfdd56a057a8392d96cca69d8cc0d32ed076f33594af805b57cfe002e12ad839fff13f164da78f628787668c8f135b0ab054aca9d2fc25b08f5570150a4ceb866da5ce0422e78aad42da3b1954d6525a5a0639f0fdd266c16c90649ad0c737dbdc90099349ac5ccba2695"}, {0x30, 0x6, 0x10001, "855534f6b7b1e2a5f0638d6e5182ab6a3c5a73444317e7e2ea82f72027f4bb27"}, {0xd8, 0x109, 0x3, "d1c26d57af808ec99b2e22410d608fad0052fb828e5e4f8f7618aac9a283b1ebb33e9bbfd7f546d14b48b5e96a7776ff9a61c0428dd33314478e724f2e099d66b63b10e1d4668aedae2c51c6d685f900cf2e8afa23d2b8a076723c884371b59b7d4f6d85c051f1553b73bc54acf983a7fde13608239e2b3ff218632fe3c00c2f0076bd1c8016201e8a9759a04f399133f42e1df6c994a683c61af6abf4c2bc7743f946fef2626be5c8f4b7f880f2a49bf6b0322919617cecd9c6808d3f5a5e522d6d5a"}, {0x78, 0x108, 0xfffffffffffffff9, "8fb44b310b01d0ec7a50ed95e7ebd8e6e73ef11c12f024ef0184a0143c9c837b1eb465389fc9475cbe0d7cbdc39a8ac1107e918a6366101d27932688013b70c38ec838fcfc1e6d1331efc1e413e191ef9904e59952380cdd5562f2562135516b6a21e0c1"}, {0x60, 0x113, 0x2, "a30ed9c8ab18c6b847b29a942074aeb66ffb23bbd2392268adf43ed39bf6fbce8eb4d2097bd10a3795298fb47235a1dbc2781a62d33dfd35a5d9bfa1bcfb3a203a3fc42e81393ae26cd620a64c284b"}, {0xb8, 0x1ff, 0x7fffffff, "2d40c79d18d3af88cb2b7187365384af74baff5cab4964cb48af61da353f14bd5306a8f4869c2e93e40ec54690ea660b67904035dc8e07ffc24163deacd5b3773d37eb301ff334c7f246150e5d53a1d71cee9d215cbac21ec4e0a809939ed31fed6dcc12fcaa8a8a36b751eb664c200e75a4372bc70620fa4eff3d5108841ecf0145f6c5fcb8a2aef7bc7b0aa8a2bd92d06a6cfe6cc372fddab8264dd8e734105b856e2f4b"}, {0xf8, 0x0, 0x276d0000000000, "df3c6ec2e24e6d2a31505b5b7fa4fb8fbf5d74cc9d37241d109c1461b77c2406b92487de44e94d4ca464fccc4d867c98f47dce05720844ef09a4b63b2e1b9afa25f9a953ba93b6bdb217bdd2cbfbe3ff181a0ab5789417249484f1b1a5fc6e51973ca66828429ead107ac53a4bf2096de16b9b562184231d2ee138976451e8defca93a5ad2d727287574aa723b6706fe515ca4281e4cd8bd7ffb0e44aa32660827e888db4ab9610cb952165d4e60e7e3204f1d2d038dd46002149077bbe41efe3c160b0676107ed278a6a67e61a31192d97bcf5ba9b0ad11d66d14d31b3251f895e932f29b8ca3"}, {0x10, 0x11f, 0xfff}, {0x90, 0xe16612e8a6c33b87, 0x1000, "55ddd4b653cb734d3e9176f7fc6301e86a4fa99af5de23947ba01afdd28f648e814a06afff35184650cf5c139779e9d09a0a829e10ce1eac0f80d8bd88d88ecc5957e7fde36d6253f4d4e2acc08ec9c7694a26b9d5d3900bee6391f357eea6ac7362a6d8668e6d83b033047b26f1199dca1d60252adc99784827"}], 0x520}, 0x3}, {{&(0x7f00000019c0)=@tipc=@id={0x1e, 0x3, 0x1, {0x4e23}}, 0x80, &(0x7f0000004b80)=[{&(0x7f0000001a40)="2a9e4da17de78a13f11b852937a03c8572cf7fdbd7705307bb4097603e028b184ebc932d851b66dd65670a9f16d1e47e63d8a49a6baaf0143b560fbcdeb20d0ea2d8ee20e17b929c0d8e59e68ae4510a066370ebcab02439b19b01ba8566a7ea200fd916e47a8ad746f88861a373f35642a621e20132d395cb404420d66241178569587c18f7b10126bc572eb9c4e0698a409dd29f8186210a8cf3a86c920683b34f3b20859453a1f7e8e26ad2202aa31a3fccb68d8770a80685eaa3f29f208f62dbb41e1a82701735937c7615315234077d22ee67248bddd1917243ecc845eaa7b6ed2802053502ea16c2c422f6291ff4e11c2c15a67f5f964bae03132f3fd56b99594d5e6f0a1a39dced27997ca5eafd29b768ac335f1e2b16af0a1be94638f4c467bb823f9995a669501226794d7d22bc9efec8dc3deb018296ecd8ae36366642d44ed5c57dc73c64cb836651ee7515a02a4bc40999df75ca0e54f5cf8f83710e8b5973a6fbdd9abe5553d1e2b507d204302933127e18aca6fa9df21b2fd77440e338ee07a9e3139eb9eac655c4e4291742d44c74a162ae3893c5428cdf13bb83d68704911c13c4716f82336815f4ff0f7197e67d324196bab83670bb96bec953b674536b01c586da3c3e6f66ed5f21d9d3b1821c6bdb67de2e715539c5cdd4227af57dccb20d28d7407278050f95ba04ca84a2ecd5d00d6db5d29340a338a0cc9ea505a473d9b77e489170768234aa4e4619db283773645f96c2fa2987934d8e1c0f5652dfd381d2ee1698896cf66bf93f8eac9bdc63b3068f7beebff195a5d1023e0b1f2f99905fdf89fd927fd56abaf7f19e5b489b024c40755d566b18146342a7324e1c8afafaf445f531540253f0ea62cac6adb71d321e93565cfb04c46531b5459af0e37fb746116ed79993af18db4ee2de1ce539225a979cd46467bd1737234fde11aef1071f1da99497e5762b6ea13828cbceaec62cf4e9db533603d9255611715579391e1c5ca96311d965eb35b7a62600cd05cafb13a1b17e72c87955eca8341d9197bf0de73535a2500e72f51a7603edbc991c80ad047f89c2e4f5255019f58dcdb8efd787f3bde4be776c832c2c754d795ea1223b319106e50f5e6d619c4c3f6d07e0d6abf44c5d8f11707c8433e22fb064f415dbdedd7413ad59224293e29ec67a75cbb17217dfe677c1fd18e58a7fc5e43e62f3b83c68eb6ec3075661a8768178ef74d9f103416841cccbefdb916d47a1aa05102e3b6a48c6bbac6da1635c54206e44440da3da1dc06264f9928285f16516a41ebfa50d00d58467b0145fa6584905a6c1e98b4a7a08e862fc2de9be8679ff5c15ec391808f40185e2473306668c031afdd79ee3253b340259688f89022034bb0e78d93a851a482323be5009146bbeb5c1686696a78a0b4da2604a96ccca2b84507415485ed3e4f9f9ab9316b22d089fb3151a7388d1568d0ccd4c372488712648438a7bad112ee1d7972e3ad3549adf91a11ef027bee30fef7d0727a74c35512be4ba1a32b18c65fa50e5ef5888a5678de1ee732e1877ddc42e69b2ab3430485ff116507fb3166702bc586437442cd0d3693b711239b5dde37e991cdae10fb26e0379968ff75edb2241bb64ef198fc09d9a9a32d641064959087dc70f5ab0e93304fe397feec3a16f19c11b155145a0a1b13e7a77bacd75050c5cfba9a4897b031755a35edd4b90944b4974b8816e445247413b6bf9df644fa9f5eb2399aa97705ad2a3a78b6ce947f4587209b967452ae6126cea9ef5970501da354336c6565296cdcd54bfc22f9d8172f987d4e9482ee40bfbbf89428631227761c4785afc888e68517762f7ac9e7d23c57142a4cdd0ab5463e19846e587fd98fc409d4fad81432091b9a014cfb8239b99bf66591d8760870b28a4a6a6dbfd3da2887408526b0d6ab058243dc8f7b9bc376a9b0cb83c1dd5d4c8ec3642937809d1c2d8666802656f218070a6167930be0623bbb7baa7bb6108a8ff74e20e05716cc9e32e6b9f7b0eaee02f6348dd3ba644428526615c4ae3e4b041ecdb86fa9987ff54b43959de1929e93bc223d7ad82dd739818636d0659bee52ba93a6b26b9911562867f738eb1890226a64d05b305490c92ddefa41334ef630aef667cca794ad81f5d8505cff312416e05a5ab65a8337f49dd8740dde047d53c22bf5c863ff8738630fe3567fc14f0c10f25ce6529ddeec89257d427718e8cab6451152d0625e6a5feb345a9e6d97d29bb6aa4d807ac68ff531116e7d9c81cc4eeb63002ba6763eaeba9929ca9e5de0d9ea0526f14f0d09113bb688681f381aeb14a9643f0e0bfdbc154fbc69982e6f6cd0edac2b3dc265db8f70a215597e0647f969481576552590de29f61d693ba34656e33f4f4c9f46e4abc4d8dee3dc7580d277747ed527972ce8653729b6397c6a8ef98df5ed0cb2c2487a3944f2b639e19a6a270c95dbe824b8767e79de9b54306cb7c268aa8aba52323190ec087cb0970ff55837a15a4bc7c10f4a34db4dd26ab5f7f3ee58f9c1ebfff37444a6bcc0fe40ab1076051d709c4e19e95803f2420ccb70aa6faf879e1cb824577a3680ed0255ecec4504c76995f03b2a6ca1919f895ac456ea00fdf4deb299a5815d07872c0c16c7f0d4be22e56a5a7e3b42d87def48b38a2fb413b4c33198e9d98686f2193cfc3c9d1d9682a8e9b4ad1d7f955795b50c7b909622364a992ff4f2a7a1b2ddc550c72bef37a750b393b2ab20f37f43438b92f1b16ccab779442276cfe3860da416c71977d3efcc1b6cab83d4762052004e1337e58ed852a0aa32947644fce093c67a1b021a8319527ed13b6d09c09b593d66176ed19753df243c8f045e9292615d0ee92538cda10c29f28bda1b72f514d3bfcc8bd9acb1ed85bd888fdf5ca02325918c5e5e3505718dd516d33a78f33bbb834e4d4eaf06d32e8f853656acd5b37ddc3380f5a00613e10f601a58fb51d2a11d40e5cde54880417e6952d23095e1276bfb9782e3cd3f1f88e6a573f7d186b2614b28d94c0b59682872b8a69aa9d5012779b6ec86c4b68808ab288297e466234eca6bfa1fb8262c3bc5f64a5baca717ecddff0072218ef3be529a7a3d697812d131e27f3ce87222114f2ced326ab653a73967e01b7550931eb0d4b0cd6012db08061680e51b8293d4babbff6144fb648d2143d34aed926d03cac2e5b1ddce3fe1a7ed77e61299f4842aa96351c9f49142ec7c8472657dd54195caa7a4e975909c5b886c2d6975e508e6684f9c457c994294e41306851714bf73b20c49eb99a11b7e8901208d8faad2d7cd1d2c135d52c8291a3573578d41985e108a97099d85e686ce3b47d247b4dd17eccaeffb573ae8ce9b3185a657da8649b7354cf68de505c4e5596ee3c0a3543f937662388c97387658a9659a1542b02c750ab3661a8f70d6f155093ee90e023f3c1584edd152684391c5801ff34088dd5795d3a6610df1eddbe3df34bb24751b6a11a649804003b5f015649732e06d5427aadc8b2e30736b5d2cb34d0e3a7c9547d6c9fa6c4f68159c9939ced02fa1544013851641670523438a2dd41d975fab6c75b3772e855bd0ef94d8a9b64c9fa52e28a6954597830459374bebb9a05c018940b558f03caa142f683838d61168ed5c88a1ac938fd12813bc65a72f49b935b8beecddb213cc2d891c2a72fc50d63fe19db87540c37a36faa199528bb9d09cbca32cf866ac6f0bcf8bdc540c3a30a7235fb004df06f7649837e3733c0553062903d5701c1f7164231a5ee061a5ba376a1c699df40fe575b4f7a048b894d7f68311e076e3e6c2f1cca15b1d2ff87e1c982767679efe934e11870e106161b9dbbf982bb4ddccf98970bfb11e44440b1a8f51f33d0be18b3c8f3c10bdff5b63160ac254a18c45aa3a57d3e169d516e5a527dfcb301dab19c41fbc515feb0be5a79e9bb03c3e2e44f423c5abacd7cbe9ea25a9ef3b99ffc74e501c7d4acbc79bcc9250835ce8ecd0fae464bc9c8ed86120b246b0c8240842b0950483badcaacc24ecbddd9d0110b1150b6eaa080433147c1b7a8cbb1da3cba9957f3eb467708b7f933357ad1693afe6bb6d170727cd5f9b34519c9288f2f7e777ecf542491510a8f6cfa53c9e119beb779ecd0a87fb89150262ff7f11279e0a754397de8b447d8744862fc6f0cc28ffbb385f3d8a40e2e8812a2b7dfcca7d812d148392d1fd006ad77822be9277bd2e7f973d55eae7ab6110fc8eb9a9d381dee2dfa371c19873ae90f19a7fc43457d3d5f4c62600bf87d810be286f310d1cab8f6112da77d75611babccd9c8275feab999fdc44a063e94d3d6242113a200c10d8030a66d14cd7540bcbe36f7b9da5b763b4a3a03b292bb3777edba19d6c582e17a7a1cad6fb7da8f78c411d179c2def59cec363da7dff1c3871d41f040643f4af3942b79f63de70f1cef1bb407974ab3e7e18e5010725a99849c89d44a997f92e0758c0b773ced8ebe9ba8cdf3307174fa025cb63b2027d31986c38bc7f49bf97ed45fc54412141c3ff40a192dd4527169fc6942f61745f24fd0b609a7af323a1448adae76addaf9bae12822a5bd63d0d09788fdd02a433ba978cf1c599dc5566530a696b4dfdd474f67c9ac91b47b4e931c005177bdfddbb0a9f8e8fb9ba1cdb863d8ecad8b61afa01250c55f3fee94cda8e32c2f5e3ee4912145c9b15c40022a7a03da65a4f98e569272fee23b98cd089114eaaec6766a5fef8ff50f6ca34f38472a30b9e4f2685cc2067f74796a002090186e1cc909588b2cc6ec821504d9bab1eae7fc0259db7f8ae024d490a67ca4ae61a83895e041ad0fa8bab17b7d4c7bbb8e4bc9cd3c80a2ba6b18a25948c6ddaa3d79928a4812facb1de9511e3ac1bd35af2763fd6ef3b0f257d596d84552e41e55a2f68bd3cbc40ba5e455e86ea9655543e04bae117927caa12043a51ae90b85ba29846f612012830ab8512335e2a025bc1a4edbb9af35fc42b13517553f4236d9264e452f03764758dc26715bd0881104b5995031463eac1904ab8a965452ab3b7cfbdc13735158f11d6c3752c0dc07d503fd350cb667bd0a6c4484433a76ffd9b2551cb50956412c0f37ff2ac5c740ad2e71e8af858307ecd33b8daa029c9aa736283766fe4ae2b516513e3261124d3895e37de5b42465f5ee4b6dcf9dd77ffcf02591d62f00a09d8325969d26ac4a1b7676add59c00e40762950df2b896b5be40de8504b36d5dd342dd243bc240fa57ac306d19c1d60b9d96ac2f14d6adf373570654c1f510f2e39839d62338e610984ce0de9af0bae0c0ac7ca09b558bf4a55453a5489516b19febb9c338fb5e9790326672fe20bbbb51fee9c2982fe4fcdbf73a76aed335f88809a6d111d314a1fb1d3863616ff8816086b178e3c4ccf154fbccdf428117f5b6c0b3dec4aa9cff5ab12ad5d5cd547a7a97dacf0822586504a62e4070b62f36d963090adaa96b1c968d913263057020eebec4b24ebde1c89225eb6fc45f2f7cf0e76edc5a6265748755c189e606119ba7145640d3ff09f57967f4226277d6692ea64a8c70f918db5961951f1f2cc2729e80bfbd63a5b8c135c93cec18358c90d916cf395c2a00c1e57824d0ed617574dd47bc48255c525968737639c5a5ee9cf820acb009cf8898da705960304080f116b728e053c7e647b8d0e1c02048ff629b7128f9ec1611193f6f218f25ea4f81c94145028916a59b1122bcaf84f8ecd8a5a21d2384556594243ef4a9695fc58cce1fe2eb23f5f26944f2a90b2e267b9d", 0x1000}, {&(0x7f0000002a40)="2021481910d29fa9de586a4bb815f965cec7cf305729de218cf5e7515f32cbba0fb2a94714805381e7efa6b271e80f7b5e491ddf4542e5d2c136da4cc9fd142f1f82d7cfe67d2b761db6020c48819b720531ad0ea1f18232d5fc385e03b9144ca801af07def9769c00d9c934e1d5732b8dc7e6f9f18daf7d4b28766def82d580e9832be665f0a7b2ec729c3d796314a3793bf9c5a7f70eaf8acf38442b8b2f85eea937a98bee4cf15ceeea0be38b438d7c4ee04e848900012f9031e01d753b4ec506001202bd2e7eb75d212c06c4307e1ab283cccf591df42643934823c4a76681c4ca10fd48418fd6715b04896f51d231f93148d9eb2b93b59e7a51a92507f605240a058bb624d043fbe9063b4ae2560a75ac3cbf642545f2736e1beaa4cfbd9eca2667c08a905020acb0a3a25d1b8e523f96a5230bbac92fba259f3b7b8ee18c325ebedb637b4834302e5cad4fae8c13e34fc824e24a0bb89ecdf8c208357937b0cead68531c5708a251b2d89a94e355ca59150b8427b70db608000d45df7d05373203907f1ee1e15099975cae4688cea765f3788adc17764ca1182d61d2f1fedca06e4cfdb9979691e1d4eb40e16f58eeb22d23f2e36f54d3c453398ad5d0fd7566bba8e61e1f215c52a37f9d34f9b16bbec147cbfa1b96edeab1051d936adb44b244b2487eeee187b907256b80f08bdd17237971bf7b557b5ff8fca91c02db0081ca2349458bc4f51e6c67604de749cd0b51be5b97e4f08bfb4ba1ad72dc422186c57c2e85b46adcc3f0e42be9d147b470c178e34640d519988948457a3e12a8a52aca62ff63338f80b26d5a5d7a058125c803cd0c87765aabcbc263becead5bfd5f9bc38c286323ea860dbc6e044107e026d74675a84df0f4b0e5a455a495fe126d955e050fa7b4697ae81dc03ec7221778457552e018bc9d639470de650aa6774b71a300f9cd7958ea9ac9d4d723abea425fce308e94cfefe48d008c897008f59127998ee4481e07a629adb56397e36f58485763694898c94226551d1e7cdd5124b2ef7ee68d322b64151ac10da5d40a5a3cc0f809be19cbe49354f06e99c386a212c5631b6a3f86428340369850bb4e0653234b741bf5d63ce1a3af13ee49df0d0fedda4f4111b70210d22c8d8fc6ee561f9a22abf7fd24e7b48c916a9512c46d0aba731cb1301e21f99a17ab3844f07e16f5f5b502ade029d77551639e0f87b07e279e50835f61e716a4b9c8445a98bdc4c0087e9cd23ed42add7a0cce676ea1b067979555fe93970e0132a8e32ca436794f2835c9cc53a5f576fe4c7026e1f2dbc1bd861146184ab242fcf149596f9b2ebbafb9989b711bf3cf420b88f25952957c263831e582c87f21e3e154ca1d00154e519c9b501e15eb082bba9acae6ffd7673945bae22f26f06cddecc6e1d0c9ae8e06f4322f4b58c6e70cbfe946435658f5588e9a9fedb72475c4495c4cf0a994f634b8ee2f92c0cc5811340eb776f7ec71426dd06e9955da169c607ead0b27d90908703c2bc3bd20a43c07d2410aa09f9e880433b0054952347c1d47ac353ddfc935c89810281bcb159cf2acb90e13c85b80baab2119488a255c9a30a960460c160b8fdc7eab02948881fceacb2015eb4975735a60c3230013afc1c13e28e784f6a76cafed87dbdc883f455089576e9879b35bc44a7fc10053f003ce95eee4c0e84834e0bd12daad7111aa4d47b80a5ebae413dc82217fd862d38412681830990a2473282596676cd4c579e06738b35e1b5ef85005ca0632ab46f2ddb1432c752a4751025845c396ced2e7933d2d426daf88d36e8b19e5219abf2f6bd488a2258884ec5e89847bb7b1fe355251dd184323da7dd6f6d5bc6d81bca8177d10bf4e50db8a059ab0bfaaf834183dd0d1be1657f096a3688fd8d7e1b2e2dcdc9c476197a7471dfe95999e43a316e0ce4f480342e5a0081f53ab5c01adedaefbbf613713d09caf815efbec39384be410b77033e6654ca19481bcd5c01610c3d82140af0ef56c707f4777af927e45d385ac33a1f813589ccd0f8075f434778a40076e638e2eb608a574573651b68f1255466c0b5f39cb9442a4287f673a5504e6057cca673880e51b574c5d526fa2eb810ac89730a07a71bbbda4689f7ca9a6849db102865028c4a4aac07d31f7b718bea41eed32b059981aa2f80692c01c4002d85bfe1c69216fdfa70db564a64821c4271e1f4bc0b5d2e052039c9b9353ff7052f36794bf75cef40cc0c4983c5673fe7de8278895966d35c0a12c88e5fbfa0e9a7f4d1c4c22c6efc055c0e3a19c281f32f53db92541e60bb5b90e628d0062d177e33e38fad3cf9be01f046d36bba525f2acd37981a10a49d63911899ab6f8f03791793c57a2786451a16111c8e852cd79c0de3813291d76c99aac2cafc6f209c38bfdd7c1ac69c5e9db9512e7e1319854d0c9e448d9d822edff7c93ece639739c528217ee154a404438b10164242025fbf1c63fda93e1a93f58600c1430e114688ebf3f9d5067f9969a2da8e5cc32fef2352bb6e215724465aa136d34c54d07a3640736679116abf55069173c0d64f90c3715e22f46a4905f7f6f89e8b9b03af5c02844bfe8db6848bed7621573ba3723b10ec58c107a99fb3f6b0b8b1908b62bf2126fda97eeb2f95770ff6f78382751082fd5f0baaee0d5e2ef80130d70b1c2587dc1a584cb6a866d6b0d97df5140e9bb0619b6d1caa4574ea1c0154e39b5e441fcaf04863cbb09813146a1d887c9ae4ee969d3fb0a073d298214f4a4c5ef15da58867f3127b30f67dd504290944152c7cee277c9cbbc7045dc43ff95dcf1fa8ce39980f85b371dda38b4ded0f7f0e3d038e7638faacbfd1af9c81227fd4265aaffbcac4b122820efeade51e8b58d470a86d3983a1d777a0c8e62206f0d396c56c3596deabae79b9bfcc9fd461b9373aec34001fbd3bad475b8a36d41f36976d69e4d631561fbddbcd1de2bd33abb028cf1c9be30a4980db15e530bbbf757e926385fed51b42459787063c2a4d8acd51925c2c873b290aaffe9301cb07a10824f2598f75f9a55ed8a4796c834d297cfe1a33e7778641d6e2308fe609750a433504fc68e84c5d6651ce6de17894cb69d0cca924571bbfc5d360a16419ce72149fb6a358c99eacb5cfe0d24b01cc4f8e452937dc8663cdd6d1eca6a50a4610b249100c9b54664abdc75b213ffa5bacf9dce05643b8a4131702e63d36bd6c12e825d0d908adcf4fc6d5e2cc1b064f5760344e213e5c9c2dbc2cd1b9aa443f2791944e1487f01ff0752101e764352086209353a0b33460ca8e6172fe8b036bab8e6f5c5b2564c3c18f385771dc88d67ee5a3d1579e044bea0533dc9e60e0de8a349c2cc8f19262a3b323a5943203dbaea8d14dd1a74609519cf6ce6a52910ab7b11dc4f8c53de1ea8e11317263d80aa8647973255de9bf0fad45c14304f796ec758f826622653e0acdc45851e711bce73554215dbd7091dc116d12872f71f3f78a9b07ba42a3324b453cd35798f79c3382a78d15bf03b79bfad4c7f203120ce87506114390193d0c34bd82b614aa2e54bc62baab69b80ebbcf97e35c861385a9f109a7d0aeb77464ab3a27505acf39f6f7d6bc6e08b94e33225f072206676530a505bca61440d7dd243a01d5d2a38844540e82658114bbe704c2f531e0b1f4303eeedcfba038e7d2a821ecc0db9a7279d881edd294100183932ec4d8944c5d0cc995afac1c5f36ddf8f3e1b1bcec49b2fadd09664c9379da447c19c7ab32d772640506e4b042f4731b5cb36e3ec45a31f2ad51d51882799f21e99b7846831e9205ce6e5966b4097cdb7a63b40048a3471544ac1e493cbebee5e3b9990d96873b89a8da1032d8b2e77398635eb17d0cc1491ce724318dcc4ceb43dfd512a098a45884f10c8ba8b90664af4e3475503b89d69f39f8bb166b13fe653d68cf89b46189b16f2393a605750d8e05c4d51aeeff8abda2cc27ca773a380bdb9b6a19315e86be7a0537a755f40303314233d2b6e385de4d992c880ebeaf00d0a6d028c44a9d640b2dc9f75f69ae5fe4252c3c6eee1d1f4520a4545c0ee59e5f238e37ad6a9fa95ae670536fc85985eaefeed3a3cd3117c6ddf8b87cf30adabd9c05ec13eb4748f181566c83ef0b46637e0ccbb90815c7a5ca29111d72d48e4b4e719a6fd8914f087739dc53f8d7895b68012cf1f435e7260c5db29e1eb0a808d4a4dec2e7e3420d9da0abd061e28b87eb9cd935200cd77a71563c2a5fde3202b5efbc24bddf1e15bc6223685a5e2cb643ad2d490d2ddbba4ef64ab8565c35e2532c1c4ca11958f56c6de92138e846c7147a7c70e9b5ab1f2c94258226d210053536c902698a8277f56f6a05bc770b637483064cc3f613d43918ef3350d8daf5446430bb2be99711ddb26994436c21b6f550fe7d70bd581f64d5d8a32f0181bc7a48a1e66ff7b4efe3d818c8f7490ceea9e2b83ea5414c1763afce96822760a7e147441458c2fdbddb1ed085912d0ca0804f9e3067f9d9ae72a6024388b20078543ff10be7e6e2b3460310f3b5a4c15f26e8f404386a8f219c974b6fe7179c61efb45e29cb99e583425b848097029269b5b0fe81bdc4fca84a311a8624edfc53232e745ba93513cc2ac44abf35ac91a0317a49ee275b30e33e4edbc28a33e9950cc6cbbf5ecb8c2510f2ffb783c0cff9e29bdf5361e5b5774ea92ca8071c91efc4bb01a80a928fcb51f5470cf5bf456eb6a2439a5b8661b6a9733ba6e0f056e086152bba9558e7206fd1c1f5a7f0270f7a949fca81bb239fccf41d8d82b8a98a768f055007322c7ba31aeb4db0ad174681852791712daa8117ae4f52f103249858c32406c563cb515f0af5c2a98558a2dbb3fe379a270086ea532d8f24a20db380a903e8cddc04f7787a057be1e89635a480aeef19072c1367aa6f2fd95403e4dd5e866e93e1b575a1fff703b96d028c50c3581b6ad350b38bfad8779b61b02e6fa1d4d9d906b68e0ea6b509916b517a5feed77c6160daedf54be1cd93c3f7e011dbea228f6653a82d1a92d49a138f51a629b8bff535f18882c3910e683bd9949eb15eb746a3f35317ea898e8a92a48d8cadf031b4e20d01119e2fa6eb37b1fb5e72d6f169699c2e28dceb86051db69a9da36e28d861033616aa9a1841ede27a3b86e140d3eab0900db6155665d97fbe04e2ffff15b241490fd89d021fd0b24c8d5a87812bf395afe081b40bda0c66991b6f0fe7fcd937f46a3e3e569b748a9d171c6f2a113138ee4943e760eb565903148f1684a625eb79dd412d247d6395107e56771ed6ddf71ffb80635668d632add7859d3bafe00919156096793b2a14e3d3a4d7b0ee58913bd25c8079a4a812406e0dd23cd3a2a5392400ea4dbb91e3a5ba50facf63542420f1063fa76255231ec905d0228d1e97f04f687a79ec26757f05f4438459dab933e4075438110a959f559d431c7c335c4d843270ae7c86e5c7abf0f99966c8ae37c56c4d55438cd7f375a860fe4caa5cca6cf49f75c9eeb2b3515952ccf46496143906621de911d7c5061aea43369951ff392a5e1c7307b93479069b0a81957d933e56e582b1654f78fec0e4d3178dba4f132c28950c20ececbe3719a530e40997d62c33e646c283f531a6e6f0d544c105d266c17a1984d0df8219ef2db6c2919e84b88eddd194ba269595f7e83c815f1ece4ae364698d6e9b70fb9c529f6b3158141b33300e93dcf0a7c1dc71e7feef7b9effebb51bb25b92e971e6a008d8aa2da3298cdc2651c7882659400", 0x1000}, {&(0x7f0000003a40)="78bcb502608fb6649f07d5f747404428439f0367c33e6feb2c6326e1fbe57aa9e452ecc8eef99d13905312a771c1332b15af4494c0219ce0145b6837d6b0a31b69373a729d1294b6cf9cf5fcae064a05279e4ffc92989593058dd1a195802e5fd18d7ca14ca59b2a6768664c220f729ec79e9c2b8e8bf179535e279384fec9e968f215dfdc0ba7360adebd5b25e4ca3abd31c0eb22db2c2cb8a902c5fe216441a1042604475c4393ccf8c12f7badb95d4debbf7bd37438942d5c28218f4d0080ba17721baaebe83e137712d2713ebc2214f907246bd60d02679fa70e3893bd75fab965261ceb49930e40d06fbfda310dd38bf8660c70", 0xf6}, {&(0x7f0000003b40)="0220ff68cc5f442776ec04e0a4fcb6235ee9d6826e1cd9f631c3eb69edf2e1411860a8b14641d5ba9aa86bfa75dfbd2866b1a1f0e16e8d66091bf363387bc11971313674abec86be56bee86f7a3fd63bba6a152d0bf2e62a7a9a34e9c364c6a260faf82480efca091e25f79b55ffec8464d209e6332cc19d1203bf225c4ef420c03c9714e64537770ac5a71257f94df3126ec129f189ac66bfb7eb3415d9276d6465cd40ef8997e18d7bb747c1c65762cd3e2e95446ac584326a48e3d97ac0e42da76663e543d851df91a14203efccdcbec5d8c9a8a4dab4a085ca47c03fe0cd00856003ea19601446bb91752ee5dcce4b10426246d357f25d7ca48b891389e629ae407d1327426bf9f80f07a5bdc44479a012dbd4f6782d72ffdae2f9ef9e1f7dbd685a4a830dc5dadff93101c3db9851d126d2a7fa5657fb4ddc6be4b2aec7a58378bf6fd065475607d6451e5e34f0b18f9c3602368e61f0ee8babd596b859a14e6b5195026ba3df7cfac3a02704cd7857423868a833690c85e8350a402b4faa46ceef61dc101489daf1b9bf6fdf483367ad5848125ae6bb9e86c8ae370ea95c4a4471cd0cf3e3a03255fec9cba9c3636013d38bf4b135308a0d4fdc55cbe5336ed4afc3a33b5301d3b6ed7e04e1284a7aca76d5830a76ed0b1f2c337c422a03514ad693920dccca7f62d6eff649bf8a5cab44ce25d692d431de6ca15b9d85d0110f63c688745c1861c401ce1cdf81a8582aed3670752e2a74cb83403aeb216c9a2f5fdb55b08f9f8ea9c5cb37031631502ea6166c9806cdff4bd03e042b7b405f0ab9901cf410bd2169c7b477c0ef98144253f17da3f13fbc1446fc6ab63710b1f86995465d044ef5ce2fa88bba164378d0d96e6ff89c66cae6e8b681691d2e200888793e62cd1277805e15c86892004c37af5def4319307d3e2a348189507969db5944ced0b1a4a40e00088473c81471775063b3366d7ed51b18638f6e09be5b8493c355fdcf5b2726634ec8d92fb83d5507db85414d56c1f6133c7324a165e18fb0bb0cfb153c941d762681705599c47b3b603ff8cd84b5b477b01664ae24589d9bce6606630d8b799f32f9bd6bc4ffa654cd8c0da7c660449d7b8e010c280fbb0f300fc255bfcbb7cf730d16a9e64564d804b50950146ad56a05ab05049c925319bf7781dec25e7479b61ad2768c82c2518ce70f518c61adf2da3e5eea9ed891567b34e89ce94ec4ba04c1ae2fd7228ccd5f0e74d00328d7c81f46ab37d4abd21a5d7b35d37b60fce7ac921abbef54f3b083d0955e1aeee36410c3900d15790ca67fc336992106c25d8969713ae0159fdd8fd230c1a02f4fe397c0de14167fc30d52ce5616ea7898bb40675de6610094ed3cf6bf0a54435d31a37a188476872cb6e4eb9acb28487ab5821bbc5709133ad7c316f3b6b3c35dccae342acda0dd364848532399ffd9b47d4259dac80e382b288f7f9b36ee1bda55f5fddff1da98ae6af809e00f7a7d4ec3a15db74b86f28591933b86af60dff7ea4cb6381afb311cf76a1182d3d07740c5614f6b906047d6223e960a5510a0ca16d454a0a2889be588d9014328b350627b0fbabf0642c8c6c7c6f0621211b5d205f4f0e21bc9068267220f9e135eadeea2ff235ddd880351e887f58102d2c7303aecd70d5a1bf90e84cd77e0538084b698dbd1b3292158cdfe2423b47556354dbfc73fa081ecd97e3524edd77eb66e5ff76f51d7218ce758317c4b6bbce1d0614f3daa858b076a890e2b9fc4d182d4a272f90c0c19d1ad368aa52805ca486773af370c6c35c0e56d7fa593c7975ac2c3655121fd3f3e172e99fb7fc0a16e1af1170db163982493ccef7e8d4ef75e147e291ecf2d982e2fa089ef395736d071908a37c6ff1c2d15a3409e8e50c2447e561d6cbc0cd1df766c7c3663df068984eef1dbc6fd8fe8fde2a48844fa18e18940fc1092bf64a22ef0b314e7a80a89f8eede0a10c6e816fed8f7d6894522ddc88445120b99c9602edf861d2b60b37e3418f44e0527f96fdc1c106008d444614741e655be4e9adddd4b9a6cdcc86db52d7790d63abc5102b3ae49320cbf9ec41af05181766e77a478a6de4498bddaa78e377f3e1a89accc5e01b6adb21ee71cddb80de1576574e0fb1a0cdfc1fddec06539b3368a1a2293dd54b64ddbc226d00bc4fc19a8474d4b60c3fc51d55467c7aaa65a262f3514be022481685195aa1a06d6327f6a98c499b98008e63d97a23bbc4522a33753a31f5be685748904807f4b2713a6f31e083068ec665691450485a14a04519789acaf15beb5cf5afcdedf3d02314ab58f0bc814267224247be833bbdf36f9ef8399fc5098e8bcf4f62388d7bb903bc25c4ddb9b906b335c39a601d5b3d0fb4a2694fa7c254a989fff302abff97a43b995884046fe5aa76a5ee4e42b5d153af561d635c265249caf057bbe17a9874a9641fe1ac97a7539941fd154961fe5416491387e27e0c9eee2ac1b88953137a29bf811af1d4789ab2fb5f1ae4d17a4e4efb2806eee7fe784c0147d6376fe1585e9b33b7b60db79d90251185c1ecb8b3bb92a3326ca96e7e929540bd626a215acfe50c2fb1734a1ccd40e767b7b5513dc05f69f2e23c7aca8aa0e1a77dd2e3e2eaf50255156e58bad7a544de7f2fb5e201229deed9de792f91d28a0c649079b264fd6c8c3ddafb9348ffb6af8d1550fe2ae4eb49f9403a4ff721bdafcb2e4fe052788b1c99dd98821142bc7941961f3563ade8a637edb2efa831f7d2458f2208d071c060b67f85cad77a588b518b0d44041497d8623eb879fa1823f6e25286ea8fa59030425767a0c45ba8e73acf6b398117e57fdf2c151fe7fb7fd99d9dc31f0db2df2675eadfdf54e952a4fa08a7f3cca9467edcb2ea89280731638ef346d6233898f5db989ebc44c2dcaaada07d54f413ab5ee29a90e8599a115334c6f4c02aa31cfaccda8da80a603fb990da5e02f35aa1c21fdcde153ebbb2b543388376b4179d79a492fa76da689cf80b19064c948d2e303a60c32676fa02559abef14066760753fb09939684e85ef4a6ca42dca5c6394cbe75e180bca3a1571cf03d57a7a72e76d1f9de9e29715569642d4883559cba70caf224e112694ab12bc2c07e775420ef250e532c04087a51f6e5d44b717b3cb1cc91cc7b6aa5585c6b849fb8ad04d1191ac960fab1a89b6fb4e5b225e2b9456539d0d336f036942652f3d3175f45f59f28d5ef4ad3726b8d24daad87c1770286e8da8469cf47fbfea481acd39d152d5adeb25d513f064584296056f62c309bf52c3de259bc9c8ebe15461526b9040547e699fe3a2a56af5ac5231b1b094e3b0f68c9696bc2dc28c91ca44487c2846593a6986791009dc6a796bd86d261dc2e7c61930b4678223ec457ec6154d7c844d44de1fe535b888fd4324372acd319b863fd5988362bd595b16ed82502c1b1e5eacff882aed1a41b691c7e2e0da7119a10a35cc4694f0b18d33c5810338867e1cfdf23bcfc866737b9e0d1a4d1a115330acd9e3df50e9e04eee270a83938ee077a8cb835157b2154e571cc72ca9d884eca695519681c7f58668df4c6049e6dd5df42d252f479bcafe5bc723936b547ec2d8cebc5977ccb54a11c56d38e0981d7b8f67e956be427d34d89a1d5b0e824fd9f99973c4769530d37d6a04ad69bcc60ee5c93dea6b55573c97d807f963eae73d473fba9d635aa203cf8984228dde864a0ea4898be55258112d1b4a8012118f3424681119f9841f155aadd93aa0b0ad20a04f05f500944ccec64c53155688327377eeeda57ed6cebb49b27139d5ff004753e8af192a66b8f268bcceb286d638405b7ae1dc16a94595e919fe4e225448b4ea3adc39ec1dbf323ec4294a4b0a6981c30a24a23f698bcd268d2221b47a8693e146124b2dd5d82bbb9355d5dff723ab5f06e48f1b92c7861e5bf242a61bc0f10c447e332d971d8bc83c6882b9148ee90c167c3755db46ddba88ce0b08ae637112bd007c99ff72d5b96e0a254f93643945ac2fa00114c844ed2295a82b5b94e1858fa81edf004c2b22d88d63d9fd131aacf2fcacedd498bd6cd4097deec243dacba63368d5891375517961013afd06f5d7b7ea267f6412425a48e9835265e63d204a3d24095edc62ab5f1c3cfeaa6f00e37f75a0bec97f2e22289ebfa597ddb0dc16d2904ae9cc7b0d7b6422cdb8aff6d3ea7e6c47edf249bdad054adacd3072a9e2f3f2e5f313be01c287256be43c0fce1bee44bc0f0905b004da77c6d058ae60e3f05a5bc766cef15db8ef524f01c66879c975098730ef183de481f0fe55cfaae731d1a95c48584d013bcdb4c0bdca26d88a1324df2451504940a00838318cdb47e6459dc956e4ebd4d5e91c5cde0f4af59c5166794d61fcc3f29eb32f0b0c05c8fd875216631f60b44e3e80b0483b76d7252ae6d487b40a6f39d649b65b0748d2224347b7d2f3848f6875d16d851ba888ffab348ad4243abfb2419a5879965dc10ea868fd99eadc78a3f706a13ee0d6930eb4ba393259cdb00d86f8c5b954c92169e0f6160517062a2202a98cd424f097b335eaeded9c04929ef1015403be9a5d7564be9fff1f65072e175b690154dabbfbed7605086d6cdafc28d51904dd5ed311efd808ded05104193100f843cf9c4d896f312a82b08163968dee539655ae1893f4dbc17a99abe6ef6a58283eb1498cc4477aeef132724c4f5d21fd75a80503117630e41163167a948bab72b9f59600ea25ae28967d710df58a63a2efc0555d41c9263ea408f45199d195d6db6a12ea5718191a9c817b53f7f45a40a15480f50b53c1036050f173f1f3ebd89f681dc409781f8e958c7c539a712335de97d9a90598aaa7608d9345e401d5fe91be428c620fbd3041860c7220cf539b83c46f7fb2eeb5076454325a13e6840be06647c5ce57b48ed371ec0fa710c5ed66a0ca24ff89bffd633e166693d8ef0749db768583f5c8d0e259674e8b807d42a7219e17df054b5267b3cd8916fbd34419e85cd474cfb8583701f8f0c4bfc8dda920e56eddd358fda5902be58564469e4a6a3f2d84dae1cd0b3746b031c937889ae7943d7ea93a8eadf2f4fa71ba425d0c43c3f347cd8639eac267f0f25a5b03201ad8875b45ed15f788da29fc48da6468583a1fd24a51572ebd45d8d389cfeba5865244bc01746273ea82b620abb5170bc82c0a083033e655b19a3113f92c1c647bb00309a74176728060513cb6ce0245298d75fa6b12f7085c5185e39731e00a97873f14b4262050a13b5ab1a17f9bd6f99c95a998c23cbc6fc36c305d9ce01328386909160f868258015585797e4a090f28c9d0341493219efdc8a72d31689da79c842eecf261babfd20b469122bc227eb5adcc9a3f7dac3464da0f0fc18c99e209c5b56ae6be703d2b1af36d4b9c029ab799a4c7c1459aaa23cad786b84a5de5c7b491427ae1ed703f74c88d3338dc75a2902af4af42fc1acdf12246d4473a6b17d5e320d665093bc78121f2539fd2bd6861f68c7070c578eb71b7eb9c70ba1770cd14ad0ccbf1daa434432bb20d9cef12168b37f06695e536d11441a82ac010cc3e813815454a6b2b2ebdbf6be511fb7c9a29b8d0d8f3e48d56dc9f59bec29b87cf3f21aab700fcaeea56786d0c4a1d81df572dcfc2a1cbf4324f0be221f056eea8e96b9c228cade3b4601b363c4830ec41e128a4a413feab9cc7a8af5de2e2b82d627adb7421b4e3e1ca7c2cc227df33fe94eb1c33e8c731f2db992ca58092fd679b81a2a4d2df8f78c0941aa1f2e0", 0x1000}, {&(0x7f0000004b40)="69f8ba305c4dd32bb85ab23dccbfb72263c52483b010b7a3c68e0225", 0x1c}], 0x5, &(0x7f0000004c00)=ANY=[@ANYBLOB="08010000000000000a0100000800000046cfdb5a7b8d8295754716f6c9a3e3edf58bed2f973f8ba49b780d67022c8b40e9cffdc0b82c45354e891500f15e70d6fd8ae6dbf944f4a7f67b1702388bd5fe7ab34df5302c90c0c6c59d5889dfa78c579fb46e8304140b0872ff07b15c1e8819c28c00ea82d7e016cdc760ce0d8a9fb604c217fcba5a1a9078d87445d58174266313929d613de0cb9042ad238215de0523edea1c61f7d81c51f1d326dff6ae8c389ab7f834f6e8239e17247350e75396abf4867057b3987472e3d17239c679fb5d365aaf1f47b3ba0b6dd52322e2935a35039e1d28a6ff5ebe5e14954cbfd55c742ec92b4ab0ed2cf07b1231b2d24da90263c26500000010000000000000009d0100000101000010000000000000001f010000000000007000000000000000bf01000008000000f4f68b5ae84b931c1ff88c86d2977851d10df79323c024bb35f78f48e7cba3aed63622d7688841ad536231b390c297c156856f09c1b8257b02ee609eda208659e734e26e7b3bce337d10dcb9954a684b79635086923f4b3fc5753b270000000010100000000000008801000003000000ac2633ff02a5b3ed74d0322528e3f497568730e3feb65ae22fed619c5dff559db61a724a9634935daeb8fb92fbb1ca2c87ad546e8f0e3f97d4422b72e07f5c903ee708a854db8f7675827dac38ca5671ee757c25598dc511129b814a0bf74aacdb0b99bd5eb66c2cd992d0037abdce797bfd06e5457b93f90ac7ab189ba66242341197560cddc0ec8453d0a4944cff3b9e88bd83855677c4dabf7ac5d3dad364470d4f75067711795eef458a45986648d8533ec49e572f7434d21c17d4d0db5efc85916dbb36ee5830497e12be470ca29a320c0d0b4f1a56cccc86008a5b0968f77a4dce715f12fe83adefd57d67597467e0d9794d77ae81c7ed6687839dbc15c3002102b81f7c72c5833e5ea13dee7893607429302f3573b33a6e8aaf088b81eef63b9e6702ca66eba2ec694eb91dddb679a77234190b74737c805c60093b69e38c6f6b6a4a6859284d1ba0b8b601d1b6a1fa9b45b5196f4205c42ad0bbdf347712636641bb859d2d638d5571ebeef83814a651b593ac555077a9f477caa5210f26f18d559d2e2b6e7dab7c8ad56cdc3e9247f1062b2573a790c1a5c7b62f9396d48b5ca0adfd7623981d8e5badac4085b74bef4b17c36b1e7edcd61f9aa9c1bc3b19a05028ffa54e6a57bcf86bb4f1dab6002935e61bab2cb9de984c88c0332bb23b2f13cf25f5ec16991f1e4c68ba9c24661d34a8372cc0c0d25b2e0efc177a9f1d08ce540889dd963a689a875200eeb271f19e48bb785b1126ab3fd3b4a40be8eda566f5b2949decc6a04e9151aa46f036c0f286bae3bdfb26b02a0a79e18dd05b25c0eafe48591d273781372eba700ef1da80926fc5fa0fbfa79fceb1a40a4a49f33419718083b7cdb933cfaef7eaa1fd40f9a28e40742bed0ec55236bba7f5611c9c9db58b8f00ea54c688a413aa5e3d8549f05b0e4b0aa4a641f72cce6494819c9435036e9aef8cfce765aac3463a9bcd95a19bf6253dfa701e281d0913f9e5ea66bf0f12a4e32985a5cb76b55a799acf0d7d01917652e4148a71e6b2f8c0fc7cbd2ff1e256445584fb8fbcd2ca82be19f0005479c590aae61f5aeaf07720a9bd94f983f6a68694ad2f92560a66efa5941947b2f8ce68dbd3cfe25fa53fb251c821137d8e9472e5f7879ecf3a3678a32493bf26fc12afaa0eacf12b83b753fc86da4953876abd8682ba9302f42e5b41bb37be6dab382e9b8f91f59f0e93e95c698801595c2c81935d64b591b1c60d03696fa7dff4bee2580ba8ab620e6c13d22c756d56c8afffdaf59946402cf7465d64e602895778f84ea472a43f1dba1c925691be64d88ea76aade1aadbb83ed0ffcc05ee5d51893aa842feb81c4cbde27f51e705e3a1bb4f0db54f539f306d793ba06f04ec73a0fa5514749e048a5cab2f2d7b62cd793a6ac9afbaab810da486159aaae89d6e8ed3cf2af1d7cd4f1abb88e93f63a8e43a6b586115b3f1bf7cd3c157ba0b1d1c1334e1b448d95312457f90f6bc18ed01622624d43e84d43a5c40dc87af3dbea948730b327f48d1faec72a8b7f4b8b41212abcfc95a14abc8a81d71302f127513483c19b491b6ab7c944b630f0f40484b4273963616e4f68dc105dbfbb24479b56e532dd23018599c9ab4b2695e223b7de18582a79dfa56a8ffa2d4c4b3305013c4d6af05ff1327cefc536b1e4fe54be2759f30cfdba15faf2cacf713e800835ee74e4f097b924fe50388c334e6766ee10857f4db11acb007edbb2279f4754558cca85ed207850f4726cf95d83e248f7c738a4f1c9d18b1aee99930791ed7711883df100aa7e67ae6a22523aacfae57375e1ad0b6909b9b1489b6891e8ada5acd2134db778a33bc04b961bd2716ca1dc2003dba8780be8ead8ce04f9d73beaa6453473baf452536cdfa58bc99b6a11f14ee9df807c13c1a9b7daa8c98b848317aa3bd92ee24440523e952da052ab2081c99dce94847e7c1126c3ae07d57c23816b31e4665187689354013cefd0e30d30e28534ab470005290153dd84629851e4d2c8c932f98c87d0dfcfb28af0d06b7bad14b586a990207562a3e0fa3ddbd918311102ec1c57ab0f29989158014425db0df7aabb3be0c4415f206f133dbc56b2dc361629d8774bb1c1bc0e898e64b3ef557a79df71948b1068d83337cdac77c0774c22fc1c1dc366bca7cf0c13782afffc0ed8cf2b5829fb8b6a2f228982dffe072065cce6fade759f6090770236e7c151d2fe92bca2963297df5022d2c033ebdbc55512e258449eb58bb0eca004037e4cf1df7f55bc732da540ff36682530faee8bdc8e9df8e8b34570593cbfc602d6ce6fc1ea8a1150381f6aaa9951047cf1c507b9131229afa0792fd309c9545c49b3cd8f285e9edb0e5751d9a7e3accda1b813386cafc41fb3f03bdf5ccffdd9831f9fc56ed444491262a6d2c57c18319fff7ea00e921447f9ba28d4e1fe32508d3f7a84645a5bb0871f87484c8c48ef8cb030c4cdccc18a8dec9a570505616424cb24608ff97dd1cbabfef849bc9365f03cb07ad9d0a40bc09f2533cbaba06aaf1a7a4910a63208c6318c28fd9c1bbe1964d10f708850468a3407ad6d89e070f073866e26e7a20b4d5141882fce569c649be7b01f1b1d97189f913cd4052bb7fb2480b72ef47d732328489342da27159bbc4e0289edbd5add50077b9c215d98a6ec8b87458857aa215eae0231da6562d4fa0c273a8db5e1abde3b4d2c05f2e09d0590b0211f0b04886e7e19aa45a3fa917e2778738aa20bbaa3e31b7501f5ae1c8b87a3b470716dd78e98f55ad1531583bee8beb7a3249677b780573560aca9fb3dce13347d1e256ecd6820ba5e11c3cbcf13d0e5fbb2ff04985c67292f8979c201f4ec1bddd1fa9bd1ca1eb99d574646fd94675a1c815eb19b5e89f92a180f1304e247146a0129741ec699c7f40f4a9bc01d6665785131326ec2d42a31c1f6bc110f9c4b614ca1a5aaa31aeb29d0934d2689a0369e2353ccf96fcb16847245e1ef05c721a3a62e0fe0d2c90a808cec3f47477cd33cc7e43fdae744b6bb051701aa850d2dd217b8d6477f29f52f014bafd752586e3066cd3981ef150478c226c4b7e8aed3dd23f8898b2e5e2fec39eebc625ab3a28963a9ba141f6ac9ae592247835d96de2ffddfa0fba31983aa42f08ca8580631ad5934b347d7c5b520d429d3e380d348d9036cb5e26229a839edae6ef2e6d1355e1cbe9e8e9061fa1eba5b77994e3c3f84d6b1566671f44ac5fd2b31e54a518beffd85eac7b116eea776da65e6c2f34b9e65a3b1586e1406015ba80e91b4e0d938a1fae39ce3a8880a548c7a064481b0c138e850b9b71f5073114ea6ece5dd690cebda9e3ff1a8104c9e056e719719a9b47fff0fcbf1a977a9fa6272a259df97d5b51113af7b0b0f3cdb3bf6a980682305458e15bbf3e4e0c2691e8be2a9f5958e2891ecedf4dca3e59ff1bf26357930103ba42e7b1a1ee36b0536b2ac6807c9e1743c981ab7f2634ba425034d1989a81ffc86c202a75234e0c3f4de8585d7849b7adb2fa8674f4ad142f9dd082fad9e89478a83515a19a01a83b923e00abb610ebaaf3af13f8e2fab2a8aa40fb307e04062951d1c984ab7ae094bd9af11c1b6e18081653981e706306419a6b988fec20d4dd50483cd1bf831bd0a994e957aa66034dd5b41afa384b2ab46d5dcb4f96df75e10b84bcdae06a9de105b9de72a7d73b03d80ad10d04ee9fce3409bd8f1bb3b0787bc585ebb457792e50302e8e1363b03218a5e45ead39fb91d6764e97e49a8ff392fda4942ff0e7776fc141ff5d0843677ece8902e16a2b9252f9b7ef556e22fce4c8ff8d0068478ed2848d67c17637408ad8e46309355b0f715c86399bb601f742d7ae3c272e027e36c4ac9ecc660043c61b9575e1d3a07c5af6392b3b99c4451129ed26c6e4c2ce2c12f609dddf556811c72766e92624148610c8eee9894f7442a594f5f7a5989e6ed0ec3559143ea2ca93c7761f900c050df3735eff1b4b1217d084315915930e0b20ebfba9c2b32011cec49723ccc6b90ee1a21de53a9dceacfcd6b57ed62511a49bcadea477aa5fcaf58bdc7bcb10545b999da16af443506a3f2916b963c052ec88afd54d1a8b0f24f7d7f3d62bc41f8cbc5f6248f9beeb489f8724bec2f37c72f2c55c2a6fb93d2d61382d14d538ae17d3095c0b7096c8721a3f7f09137e160121578e80242ccbe0e4e38191ca489e75ebf528020975273d49f37cdea8db823996fa80b6f70712313a875e2ff5e1c2e8cfcb2e4f20bfe19e8659e3820864893b849692831e22e213f077b76420e3dec1906a8a0be19a9850c368159d9a7a903f4d91458d00cd19f5ee24bb2ab2e8e9d23f6886b758ddaac2f509eac42bd05aee6651eba7b7c8fe0d9e4579df6d4430df8e1ac5e43e3a5b5527705f99cb0858f70f8d592dd1e5907dbff5b8af307ed052a0cc49e2aba1fc30947936565c60ceee4cb6b80f83fd59a4025e9a7abfa45bbd85179cf522f7db5760c89777f1fb6eb4761409c94c47949f6399bf6fe97761d945415b3ba050c5c2e93b1898b1b73d68f646b13446746ed24427436da8e2b320beb07241309ca79165cf97d80af899cea47a088bb23c8ecc21a8a0b5da3ab2f9882ede1a46ea9910d6ceb74e166c518429ce293712873eb027883b4eae9ab782f274ec00a51b07ab137e781facaeb5624ef82c00422224703426714af8a9ebedc5862cfb8ef70ff1a42b4ce92c301fae7ede35edb79ba4c6586beabe65a82a5128918c856bfcda27fac50b5da13c7143d598f8a439a64c227d8d5986bee08e69c0fe77e27d45283612b5ec5e47ceeda03ed5255e204d6c90f70a99c763616ec162aab5d45b96152a2934b7af0dceb07ca980c15ea94209a91bf8eb633eaa0a505693f944661af3907518179695fb1cfda324e5d3e6ff1aba4dc6b6e3a80612d70598b1a67797dfaefc5be0a72efacf3bcf94fe8dcc3fc19f6959a5c29d2984552e06c202499e852d54466763a956b4a4bee4594dd38417fa4803e38d87c584248d86d999cddbfa58efa7914fccc49bd8da80f4112c71fbeb8e940f42684b24a15876fa3576695f6e64b1051a267be382e7453d2302a1294979025a41cbef19ee79adae55ac993a2a203cedf322eee3afe7ba15aba84e10cb9fb22a2b417ffd01ae5fa3d93ed1f60f8b932af3004e1fdcfa058b78af973b165bcddf9f4631a12d09c48c7e3ccb106299e2cfc497be50d4124e526c9d59a3b46fa21325f43ead3e976e65ff990498311a7b91b76b97a21adeafc1ca29f798b3852ec84715654dbccaed069174e22faf34841c124476f55e8ebea734a3d13be20c97d5a04c89b854536b892185a896226700d197bd0bddfa6937cf0e49dd3ee8c613b651db0a30fae51a1ff99d99460135609b9444c52d7b6b3fbb200e3cae3f7f33143a317fe559894cc224aed40360ba256d193a0119c81b6102ad72043680160566df54d8746bb0c560840d9cb10018315171ae1c7343bda2e4c1ddeb4962b25b8a9c8dda71d623d4bbbac6affa234917d2d7daf7e24cf9da60e5fb63422b35fcde239deb3ce56227001a70bf89df42a7b70ccf65df200c3eb2441ae09268cd84a0346cc10f78669fd4bd6977819e797b00b461658283d68f139ea6e52716be73014f97fa00621855923f0f512dab68728c101602068c91ef4b27dee17227b9cd4c8074b2385809439203cab8fc6416c446e36efc0661d414ca33648e52b21a52640f42c85c338e627c36293c6eb301dda94c4cf708d31ecbed05f9b85394c7ec44449b569d33131ce532b7eeebab0001000000000000840000000600000088d98f646f736cba60e80b43be5748cede634c4cf7318ac77e680f35097c334f0a1234082497fa04fbbed937324101ca973cb29cd843380944ab5655ae2672943c3cc6b49bc5a282db84db6129b34b5717e5e82cc19a89b859593a22fe983ac3f410d64e5ad1a6dc3a17049e806d232ba04a03bb9a0902e29de882fbe85458cdba945fdd550ab2a5ba77c3225070f7337b4a7c0c79432051a3a741345f6730e3796951709cf4b2a9e967019eb7d6fb67a4cd42d74b6888794711d341b72f0f511e6e88f3ef430c098892e33ec5864aa65bb02f5c6e6c6c0729ea3b211c3b9dd039"], 0x12a8}, 0x9}], 0x2, 0x4) r4 = fcntl$getown(r0, 0x9) r5 = openat$selinux_checkreqprot(0xffffffffffffff9c, &(0x7f0000000080)='/selinux/checkreqprot\x00', 0x40000, 0x0) openat$selinux_attr(0xffffffffffffff9c, &(0x7f00000000c0)='/proc/thread-self/attr/current\x00', 0x2, 0x0) inotify_add_watch(r2, &(0x7f0000005f40)='./file0\x00', 0x200) fcntl$getown(r0, 0x9) mknodat(r2, &(0x7f0000000100)='./file0\x00', 0x890, 0x9) perf_event_open(&(0x7f0000000000)={0x4, 0x70, 0x3, 0x81, 0x5, 0x1, 0x0, 0x100000000, 0x4000, 0xa, 0xddd, 0x26e, 0x2, 0x9, 0x401, 0x8, 0x6, 0xe29, 0x0, 0xff, 0x9, 0x800, 0x100, 0x79d5, 0x7, 0x6, 0x8, 0x5, 0x619, 0x3, 0xfffffffffffffee4, 0xcd, 0x3, 0x3, 0x9, 0x36, 0x1f, 0x9, 0x0, 0x9, 0x4, @perf_config_ext={0xffff, 0x5}, 0x18000, 0x8000, 0x4, 0x7, 0x40, 0x4cc3, 0xffffffffffffff01}, r4, 0x2, r5, 0x1) [ 348.967488] binder: BINDER_SET_CONTEXT_MGR already set [ 348.967500] binder: 12740:12746 ioctl 40046207 0 returned -16 [ 349.101081] binder: BINDER_SET_CONTEXT_MGR already set [ 349.101090] binder: 12795:12852 ioctl 40046207 0 returned -16 [ 349.101681] binder: BINDER_SET_CONTEXT_MGR already set [ 349.101689] binder: 12795:12852 ioctl 40046207 0 returned -16 [ 349.157324] binder_alloc: 12244: binder_alloc_buf, no vma [ 349.157344] binder: 12867:12877 transaction failed 29189/-3, size 0-24 line 3256 [ 349.157644] binder: BINDER_SET_CONTEXT_MGR already set [ 349.157652] binder: 12867:12877 ioctl 40046207 0 returned -16 [ 349.241979] binder: BINDER_SET_CONTEXT_MGR already set [ 349.241990] binder: 12893:12920 ioctl 40046207 0 returned -16 [ 349.253758] binder: BINDER_SET_CONTEXT_MGR already set [ 349.253767] binder: 12893:12920 ioctl 40046207 0 returned -16 [ 349.618585] binder: BINDER_SET_CONTEXT_MGR already set [ 349.618593] binder: 13099:13104 ioctl 40046207 0 returned -16 [ 349.620640] binder: BINDER_SET_CONTEXT_MGR already set [ 349.620648] binder: 13099:13104 ioctl 40046207 0 returned -16 [ 349.644840] binder_alloc: 12244: binder_alloc_buf, no vma 14:04:03 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000500)={0xb8, 0x0, &(0x7f0000000340)=[@transaction_sg={0x40486311, {{0x0, 0x0, 0x4, 0x0, 0x11, 0x0, 0x0, 0x0, 0x18, &(0x7f00000001c0), &(0x7f0000000200)=[0x30, 0x38, 0x0]}, 0x4}}, @clear_death, @register_looper, @transaction_sg={0x40486311, {{0x4, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x60, 0x8, &(0x7f0000000280)=[@ptr={0x70742a85, 0x0, &(0x7f0000000240), 0x1, 0x2, 0x5}, @fda={0x66646185, 0x4, 0x0, 0x1f}, @fd={0x66642a85, 0x0, r0, 0x0, 0x3}], &(0x7f0000000300)=[0x30]}, 0xffffffffffff27b9}}, @dead_binder_done={0x40086310, 0x3}], 0xd6, 0x0, &(0x7f0000000400)="70602ea627f3f733248660b67770dc63c1e7a792bf6f8eb2e8c4a8197b9c398e156fa26604d527aab47ff903b210f1099614a3816b4f03a3ba81d642f2bcafe9176ce10ef3ae599d6fb9e5ebf8bb528857d7fa1db8a770d2f7da6949c2c478b355178aa6950bd7ce6ff998a6be20cf4354206c67b3586aa6e79f556ddb4bb7ebd31885add23fcbdfd800c0e4bf6b74e8b0389681ff1258cc8487590c33d68e369cddf6945e7001f8f85050c84ac112e7e9d42d2ca26b8b718d0316646661928b2b449a9fd5da49f3e00ae1dc1c1bba78b68db274f76e"}) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, &(0x7f0000000040)) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x800, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendmsg$key(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000000)={0x0}}, 0x0) prctl$PR_CAP_AMBIENT(0x2f, 0x4, 0x24) sendmsg$key(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000200)=ANY=[@ANYBLOB="020700001000000000000000000000000800120000000100000000000000000006000000000000000000000000000200e00040e0ff00000000000000000000000000ada8008004000000200000000000030006000000000002000080ac14ffbbf00000000000000003000500000000000200423b1d632bd7b8200000000000c7"], 0x80}}, 0x0) r1 = socket$key(0xf, 0x3, 0x2) sendmmsg(r1, &(0x7f0000000180), 0x32bc45944b084a6, 0x0) r2 = gettid() ioctl$sock_SIOCGPGRP(0xffffffffffffffff, 0x8904, &(0x7f0000000180)=0x0) tgkill(r2, r3, 0x3) mmap$binder(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x2, 0xc0010, r0, 0x0) mmap$binder(&(0x7f0000ffb000/0x1000)=nil, 0x1000, 0x1000004, 0x104030, r0, 0x0) llistxattr(&(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)=""/186, 0xba) 14:04:03 executing program 3: syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="02ec1c6dcfa0d37be6ad62753790421687e0d969ba88bb6872ae91e1b1d289e50b09536370c66b76b303edda2e22b117e0bd0b2a6d97171848b5150fa942f1946904a26fe552a5bf520b687e3ea69bfe5b48"], 0x0, 0x0, 0x0}) 14:04:03 executing program 1: socket(0x1, 0x800, 0x6) syz_open_procfs(0x0, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$cgroup_int(0xffffffffffffffff, 0x0, 0x2, 0x0) openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x7a05, 0x1700) openat$smack_thread_current(0xffffffffffffff9c, &(0x7f0000000240)='/proc/thread-self/attr/current\x00', 0x2, 0x0) write$cgroup_subtree(0xffffffffffffffff, 0x0, 0x0) ioctl$TCSETAF(0xffffffffffffffff, 0x5408, &(0x7f0000000040)) ioctl$EXT4_IOC_GROUP_ADD(0xffffffffffffffff, 0x40286608, 0x0) ioctl$EVIOCGVERSION(0xffffffffffffffff, 0x80044501, 0x0) 14:04:03 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$EXT4_IOC_PRECACHE_EXTENTS(r0, 0x6612) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, &(0x7f0000000000)) r1 = fcntl$dupfd(r0, 0x406, r0) ioctl$UI_DEV_DESTROY(r1, 0x5502) getsockopt$inet6_udp_int(r1, 0x11, 0x65, &(0x7f00000001c0), &(0x7f0000000200)=0x4) getsockopt$inet6_IPV6_IPSEC_POLICY(r1, 0x29, 0x22, &(0x7f0000000040)={{{@in=@dev, @in=@local, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@mcast1}, 0x0, @in6=@ipv4={[], [], @multicast1}}}, &(0x7f0000000140)=0xe8) setsockopt$packet_add_memb(r1, 0x107, 0x1, &(0x7f0000000240)={r2, 0x1, 0x6}, 0xfffffe90) 14:04:03 executing program 0: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$PIO_CMAP(r0, 0x4b71, &(0x7f0000000000)={0x9, 0xffffffffffff51b8, 0x7, 0x9, 0x2, 0x5}) ioctl$TCFLSH(r0, 0x540b, 0x1) 14:04:03 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSPTLCK(r0, 0x40045431, &(0x7f0000000180)) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) socket(0x200000000000011, 0x4000000000080002, 0x0) bind$packet(0xffffffffffffffff, 0x0, 0x0) sendmmsg(0xffffffffffffffff, &(0x7f0000007880)=[{{&(0x7f00000001c0)=@l2={0x1f, 0xbf53, {0x9, 0x7, 0xfffffffffffffdd5, 0x1ff, 0x2, 0x4}, 0x0, 0x7}, 0x80, 0x0}}, {{0x0, 0x0, &(0x7f0000007780)}}], 0x2, 0x4048851) setsockopt$packet_int(0xffffffffffffffff, 0x107, 0x0, 0x0, 0x0) syz_open_procfs(0x0, 0x0) ioctl$LOOP_SET_BLOCK_SIZE(0xffffffffffffffff, 0x4c09, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) openat$cgroup_int(0xffffffffffffffff, 0x0, 0x2, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='\x89\x00\x00\x00\x00Ew\x00\x00\x00\xef\xb4\xc8\xd0\xff\xda\xb1vents\xd9\xc5H\xd4\x91\xfdN_]\x16\xe4\xa9C\xd2\x86Qn\xefS\x80\x11J\xfb4\x14\x86 4\x95\x9e\xfc\xc1\a\xcb \x95N\xe9\xa4j\xd2\x1f^\xb0\xb2>\xa3\xc9\xb7$\x11`t\x03: \x8b\xa4\x05\xf2?E\xdb+{t\xb8\xf7\xab\x8b\x100#', 0x26e1, 0x0) ioctl$PERF_EVENT_IOC_PAUSE_OUTPUT(r1, 0x40086602, 0x400007) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000280)='./cgroup/syz0\x00', 0x1ff) openat$smack_thread_current(0xffffffffffffff9c, &(0x7f0000000240)='/proc/thread-self/attr/current\x00', 0x2, 0x0) write$cgroup_subtree(r1, &(0x7f0000000100)=ANY=[], 0xff4a) write$cgroup_subtree(r2, &(0x7f0000000000)=ANY=[], 0x20032600) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a0f, 0x1700) accept$inet(0xffffffffffffffff, &(0x7f0000000040)={0x2, 0x0, @local}, &(0x7f0000000080)=0x10) ioctl$TCSETAF(r0, 0x5408, &(0x7f0000000040)={0x2}) ioctl$EXT4_IOC_GROUP_ADD(r0, 0x40286608, &(0x7f0000000000)={0x3, 0x7000000, 0x400, 0x100000000, 0x0, 0x8}) r3 = fcntl$dupfd(r0, 0x406, r0) ioctl$EVIOCGVERSION(r3, 0x80044501, &(0x7f0000000200)=""/31) write$binfmt_misc(r0, &(0x7f0000000080)={'syz1', "80fa25cdc862d216160cfa92845a3916e38a409a159c03f1889971d3e5144a8d08de78c4b1fbee457437261d7668b1c0f582647ad4134a05358d4309a71a702002329e024cac95642e761bb842bc1056bd6bf12c47697a649a026bd8ee1f685089941469b1ddfeddf32b392f0ff07652a3bce0770bc3bb70862845a65054cecb191e80b825d740fe6b40450359757032425dfdee92aec36ce4b468d50adc745c522cc4af2ac6e7f6a95f0edd70b09caa95fcc7143cf46b74db8bc17fa7c89f"}, 0xc3) [ 349.644858] binder: 13100:13108 transaction failed 29189/-3, size 0-24 line 3256 [ 349.645103] binder: BINDER_SET_CONTEXT_MGR already set [ 349.645112] binder: 13100:13108 ioctl 40046207 0 returned -16 [ 349.695298] binder: BINDER_SET_CONTEXT_MGR already set [ 349.695307] binder: 13118:13123 ioctl 40046207 0 returned -16 [ 349.715254] binder: 13125:13128 unknown command 0 [ 349.715262] binder: 13125:13128 ioctl c0306201 20012000 returned -22 14:04:03 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) fgetxattr(r0, &(0x7f0000000040)=@known='system.posix_acl_access\x00', &(0x7f00000000c0)=""/194, 0xc2) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, &(0x7f0000000000)) r1 = dup(r0) ioctl$LOOP_SET_BLOCK_SIZE(r1, 0x4c09, 0x3) ioctl$FS_IOC_SET_ENCRYPTION_POLICY(r0, 0x800c6613, &(0x7f00000001c0)={0x0, @speck128, 0x3, "5ff6eec00abc0703"}) ioctl$TIOCGSID(0xffffffffffffff9c, 0x5429, &(0x7f0000000200)=0x0) waitid(0x1, r2, &(0x7f00000002c0), 0x1, 0x0) 14:04:03 executing program 0: r0 = socket$packet(0x11, 0x40000000000005, 0x300) ioctl(r0, 0x8, &(0x7f00000005c0)="08b47022f9de089671fc8163ff7245360437e8175c0159cb47f6f51ee4af019d6dee") r1 = openat$selinux_status(0xffffffffffffff9c, &(0x7f0000000400)='/selinux/status\x00', 0x0, 0x0) r2 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000480)='TIPCv2\x00') sendmsg$TIPC_NL_SOCK_GET(r1, &(0x7f0000000580)={&(0x7f0000000440)={0x10, 0x0, 0x0, 0x8080}, 0xc, &(0x7f0000000540)={&(0x7f00000004c0)={0x54, r2, 0x0, 0x70bd27, 0x25dfdbfc, {}, [@TIPC_NLA_SOCK={0x18, 0x2, [@TIPC_NLA_SOCK_ADDR={0x8, 0x1, 0xcd}, @TIPC_NLA_SOCK_REF={0x8, 0x2, 0x1f}, @TIPC_NLA_SOCK_HAS_PUBL={0x4}]}, @TIPC_NLA_NODE={0x28, 0x6, [@TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_ADDR={0x8, 0x1, 0x80000000}, @TIPC_NLA_NODE_ADDR={0x8, 0x1, 0x1ff}, @TIPC_NLA_NODE_ADDR={0x8, 0x1, 0x9}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}]}]}, 0x54}, 0x1, 0x0, 0x0, 0x800}, 0x4044011) read(r0, &(0x7f0000000000)=""/181, 0xb5) syz_read_part_table(0x10000, 0x4, &(0x7f0000000380)=[{&(0x7f00000000c0)="df7dabb0d862d2c69056e6915d9d80d1516f561b1aadbf8659a565c78bab855bfdc8da6d6c79d80b630d4718b34fc98d78a5f5e26240dd7337fdcb076ddf4f1645716834f72693ebfe5e8a8f4912aa08d4", 0x51, 0x1}, {&(0x7f0000000140)="12bc6847319959a1a2af9f5eb767885fe2e79f77421bf3f0c7776430953f2b87675aa9e748a339c23d8f191eb41a89ad6d5f0fa6c3758c5d701e63384fe2", 0x3e, 0x7}, {&(0x7f0000000200)="411e51ad379851a101d9d98b20abfb067bb6f0f4fa478a9d5c26d1a9fdd1b9289fbb0e67897b19aebc6209d23822256c2ea031a01ce86ed0e19c940c0968ad3d48d60c54043380ab3c795a04ac2136596cb579bc94ab2cac8d7da303c23eacf5acab778db07b608253636152cbdf80965cfeb08e7697e8439591f51b3e7d59269ada4686ed35f99ef6329b6f05e87f3368be727ae654fec50ce7722d974256af53be", 0xa2, 0x8}, {&(0x7f00000002c0)="679531462c220c0b7375aa10609e45232d30793681051082295669e0c7eafbe9fc1f69c143754c1f73f6dbc5175d9cb9c7b3091218f3587a3bca2c167bc7b8fdc48398f70466e6eef177af270a33385cf896945466eef264192c6f9d013cf299421d2cd70c53d86de8654c3dad288e985b4831f18f8636c733dc36b60893c6e1b777f2ff63352d6492a4ccd60e3934efbdbbef8fc176948f01ee5bc408937bbe6b4a413adb03e6acbb2a547701", 0xad, 0x3dd7dcfa}]) r3 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(r3, 0x540b, 0x1) open(&(0x7f0000000180)='./file0\x00', 0x0, 0x0) 14:04:03 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) accept4(0xffffffffffffff9c, &(0x7f0000000140)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @loopback}}}, &(0x7f00000001c0)=0x80, 0x80800) r2 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000240)='TIPCv2\x00') sendmsg$TIPC_NL_MEDIA_SET(r1, &(0x7f0000000380)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x2100000}, 0xc, &(0x7f0000000340)={&(0x7f0000000280)=ANY=[@ANYBLOB="b0000000", @ANYRES16=r2, @ANYBLOB="000326bd7000fddbdf250c0000001c000900080001003ba2000008000200659b0000080001000700000010000600080001000800000004000200740001002c00020008000400018000000800040009000000080001001e00000008000300233d0000080001000700000008000300050000002c0004001400010002004e227f00000100000000000000001400020002004e21ffffffff0000000000000000080003000400000008000300ff070000"], 0xb4}, 0x1, 0x0, 0x0, 0x800}, 0x4000041) ioctl$TIOCGPGRP(0xffffffffffffff9c, 0x540f, &(0x7f0000000040)=0x0) ptrace$getregs(0xe, r3, 0x8001, &(0x7f0000000080)=""/16) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, &(0x7f0000000000)) r4 = openat$null(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/null\x00', 0x2000, 0x0) ioctl$TIOCGSID(r4, 0x5429, &(0x7f0000000100)) openat$null(0xffffffffffffff9c, &(0x7f00000003c0)='/dev/null\x00', 0x10100, 0x0) [ 349.755559] binder: 13125:13132 unknown command 0 [ 349.755569] binder: 13125:13132 ioctl c0306201 20012000 returned -22 [ 349.801235] binder: 13159:13163 unknown command 286392644 14:04:03 executing program 3: syz_open_dev$binder(&(0x7f0000000280)='/dev/binder#\x00', 0xffffffffffffffff, 0x8000000000000) r0 = openat$selinux_mls(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/mls\x00', 0x0, 0x0) ioctl$IOC_PR_PREEMPT(r0, 0x401870cb, &(0x7f0000000040)={0x7, 0x100000001, 0x100, 0xfffffffffffffffd}) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) r2 = add_key$keyring(&(0x7f0000000080)='keyring\x00', &(0x7f00000000c0)={'syz', 0x3}, 0x0, 0x0, 0xfffffffffffffffa) keyctl$KEYCTL_PKEY_DECRYPT(0x1a, &(0x7f0000000100)={r2, 0x81, 0x20000000000000}, 0x0, &(0x7f0000000140)="2a3a34e98f21b218a426b3d28857897d7d369ae7659124aae88efeb017d0ff614ee5fdd1078786538bac9672682953224006b4bcd4c441f7e153bc2ec26901f3e8db98447b28", &(0x7f0000000200)=""/23) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f00000001c0)=[@acquire], 0x0, 0x0, 0x0}) 14:04:03 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x40000000000802) flock(r0, 0xf) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, &(0x7f0000000000)) 14:04:03 executing program 1: socket(0x0, 0x0, 0x0) syz_open_procfs(0x0, 0x0) r0 = perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$cgroup_int(0xffffffffffffffff, 0x0, 0x2, 0x0) openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x7a05, 0x1700) openat$smack_thread_current(0xffffffffffffff9c, &(0x7f0000000240)='/proc/thread-self/attr/current\x00', 0x2, 0x0) write$cgroup_subtree(0xffffffffffffffff, 0x0, 0x0) ioctl$TCSETAF(0xffffffffffffffff, 0x5408, &(0x7f0000000040)) ioctl$LOOP_SET_DIRECT_IO(r0, 0x4c08, 0x7) ioctl$EXT4_IOC_GROUP_ADD(0xffffffffffffffff, 0x40286608, 0x0) ioctl$EVIOCGVERSION(0xffffffffffffffff, 0x80044501, 0x0) [ 349.801243] binder: 13159:13163 ioctl c0306201 20012000 returned -22 [ 349.819070] binder: 13159:13174 unknown command 286392644 14:04:03 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000500)={0xb8, 0x0, &(0x7f0000000340)=[@transaction_sg={0x40486311, {{0x0, 0x0, 0x4, 0x0, 0x11, 0x0, 0x0, 0x0, 0x18, &(0x7f00000001c0), &(0x7f0000000200)=[0x30, 0x38, 0x0]}, 0x4}}, @clear_death, @register_looper, @transaction_sg={0x40486311, {{0x4, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x60, 0x8, &(0x7f0000000280)=[@ptr={0x70742a85, 0x0, &(0x7f0000000240), 0x1, 0x2, 0x5}, @fda={0x66646185, 0x4, 0x0, 0x1f}, @fd={0x66642a85, 0x0, r0, 0x0, 0x3}], &(0x7f0000000300)=[0x30]}, 0xffffffffffff27b9}}, @dead_binder_done={0x40086310, 0x3}], 0xd6, 0x0, &(0x7f0000000400)="70602ea627f3f733248660b67770dc63c1e7a792bf6f8eb2e8c4a8197b9c398e156fa26604d527aab47ff903b210f1099614a3816b4f03a3ba81d642f2bcafe9176ce10ef3ae599d6fb9e5ebf8bb528857d7fa1db8a770d2f7da6949c2c478b355178aa6950bd7ce6ff998a6be20cf4354206c67b3586aa6e79f556ddb4bb7ebd31885add23fcbdfd800c0e4bf6b74e8b0389681ff1258cc8487590c33d68e369cddf6945e7001f8f85050c84ac112e7e9d42d2ca26b8b718d0316646661928b2b449a9fd5da49f3e00ae1dc1c1bba78b68db274f76e"}) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, &(0x7f0000000040)) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x800, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendmsg$key(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000000)={0x0}}, 0x0) prctl$PR_CAP_AMBIENT(0x2f, 0x4, 0x24) sendmsg$key(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000200)=ANY=[@ANYBLOB="020700001000000000000000000000000800120000000100000000000000000006000000000000000000000000000200e00040e0ff00000000000000000000000000ada8008004000000200000000000030006000000000002000080ac14ffbbf00000000000000003000500000000000200423b1d632bd7b8200000000000c7"], 0x80}}, 0x0) r1 = socket$key(0xf, 0x3, 0x2) sendmmsg(r1, &(0x7f0000000180), 0x32bc45944b084a6, 0x0) r2 = gettid() ioctl$sock_SIOCGPGRP(0xffffffffffffffff, 0x8904, &(0x7f0000000180)=0x0) tgkill(r2, r3, 0x3) mmap$binder(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x2, 0xc0010, r0, 0x0) mmap$binder(&(0x7f0000ffb000/0x1000)=nil, 0x1000, 0x1000004, 0x104030, r0, 0x0) 14:04:03 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSPTLCK(r0, 0x40045431, &(0x7f0000000180)) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) socket(0x200000000000011, 0x4000000000080002, 0x0) bind$packet(0xffffffffffffffff, 0x0, 0x0) sendmmsg(0xffffffffffffffff, &(0x7f0000007880)=[{{&(0x7f00000001c0)=@l2={0x1f, 0xbf53, {0x9, 0x7, 0xfffffffffffffdd5, 0x1ff, 0x2, 0x4}, 0x0, 0x7}, 0x80, 0x0}}, {{0x0, 0x0, &(0x7f0000007780)}}], 0x2, 0x4048851) setsockopt$packet_int(0xffffffffffffffff, 0x107, 0x0, 0x0, 0x0) syz_open_procfs(0x0, 0x0) ioctl$LOOP_SET_BLOCK_SIZE(0xffffffffffffffff, 0x4c09, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$cgroup_int(0xffffffffffffffff, 0x0, 0x2, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x26e1, 0x0) ioctl$PERF_EVENT_IOC_PAUSE_OUTPUT(r1, 0x40086602, 0x400007) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000280)='./cgroup/syz0\x00', 0x1ff) openat$smack_thread_current(0xffffffffffffff9c, &(0x7f0000000240)='/proc/thread-self/attr/current\x00', 0x2, 0x0) write$cgroup_subtree(r1, &(0x7f0000000100)=ANY=[], 0xff4a) write$cgroup_subtree(r2, &(0x7f0000000000)=ANY=[], 0x20032600) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a0f, 0x1700) accept$inet(0xffffffffffffffff, &(0x7f0000000040)={0x2, 0x0, @local}, &(0x7f0000000080)=0x10) ioctl$TCSETAF(r0, 0x5408, &(0x7f0000000040)={0x2}) ioctl$EXT4_IOC_GROUP_ADD(r0, 0x40286608, &(0x7f0000000000)={0x3, 0x7000000, 0x400, 0x100000000, 0x0, 0x8}) r3 = fcntl$dupfd(r0, 0x406, r0) ioctl$EVIOCGVERSION(r3, 0x80044501, &(0x7f0000000200)=""/31) write$binfmt_misc(r0, &(0x7f0000000080)={'syz1', "80fa25cdc862d216160cfa92845a3916e38a409a159c03f1889971d3e5144a8d08de78c4b1fbee457437261d7668b1c0f582647ad4134a05358d4309a71a702002329e024cac95642e761bb842bc1056bd6bf12c47697a649a026bd8ee1f685089941469b1ddfeddf32b392f0ff07652a3bce0770bc3bb70862845a65054cecb191e80b825d740fe6b40450359757032425dfdee92aec36ce4b468d50adc745c522cc4af2ac6e7f6a95f0edd70b09caa95fcc7143cf46b74db8bc17fa7c89f"}, 0xc3) 14:04:03 executing program 3: syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f00000001c0)=[@acquire], 0x0, 0x0, 0x0}) r1 = openat$selinux_avc_cache_threshold(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/avc/cache_threshold\x00', 0x2, 0x0) ioctl$PPPIOCATTACH(r1, 0x4004743d, &(0x7f0000000040)=0x4) 14:04:03 executing program 5: r0 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000040)='/selinux/enforce\x00', 0x402, 0x0) mmap$binder(&(0x7f0000ffc000/0x1000)=nil, 0x1000, 0xa, 0x810, r0, 0x0) r1 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0x0, 0x0) pwritev(r1, &(0x7f0000000540)=[{&(0x7f0000000080)="606882cc9c77cec95b023f894ae6005abb5dad8cf69ede609e8e9abd3b63c5655bcf3e685a6dc07c909555ff52ccd33e9693d519831eea82e9e7b2a34fef60d2d840e037a0564a7f9ece9ccaa0bac3da88420878420426191e344f9eca94e09f6d520e1be83e2f260ce794f3640f6370257cf61de956e6b1677c10dbcf", 0x7d}, {&(0x7f0000000100)="9a15aad4ac952d66aca3afdec666e99eed56ec9115ab9649dd72d79f9e3cd517d02ccfb9f6c3eee0538115ddb32b9ee57c4ce44268f01e751f41616fadf952a95d9a996a4473f0ca96f930ea3bd7c4ac0cc387a30c421088048ca0492b69784edce96d0f512e35bb401d34afc600d147975c0a52cab06ecdc5c08fabd3b67a476db2355f026b9fbc271a248067d5d16a2fab4374e547dd32e1cb46a9287fd2fea6eaa1625820ab7258ca03636354f1b804ec448d76ac39521bdf9394746fabe62fe4252726a094c156a8ff9b447e52728689f95310b84268cb75d7b1131b765390b3d08364ac9dfb283c215d3405e98c", 0xf0}, {&(0x7f0000000200)="6e1ccad93c1a463ec93ddea4a06f4dd2e9a7b7bebe45ca57483e12f9689047a2a4202918fd7b921f027d6eebb2e5ff680cea3d11a04f917e8acd4401e0749fb455cb581476a137da8b683b24950eb371bf4a96a24b94d9f4e7eab127317c16a000d971ad07", 0x65}, {&(0x7f0000000280)="e227642ce0b0c611503e8a134ef1e3c7", 0x10}, {&(0x7f00000002c0)="18a9d7ef7717fd1798910812a55b04daecd44d6cee9a79520fa5732d6975607c0a043b4319cecc5d5d0bfbfbf046042f6928a06660527394399d7100fbd9c281b1671e15e5facc90baf0bc6fef001e9be4d1938f3ac5dffea67d4630593f683ba572f4bea23347d2af98bcb59864d95cfbb3da085695cbdf819d6b0bff2197147632b03d40c622420c3c89c3f95dc1f96a445b44a7c0dbdd4769d170469095111d3b3444675508913aa8a5f86da7379ee4d2a9717f43fb6aa8b7cc185cc0bc404874f4ee78aa1010572fd49f30491fade46f32", 0xd3}, {&(0x7f00000003c0)="93fa7f205d362b3e9accac491105d15a1630480ac7a4b5c3b388a2c14727ea4d9507d75aaa0144d649110319369c5727fcd5d3f1c1c88265b432eae8d6a7a96edbebf7ec131ef05887a3bf682132ae568b97c82ee7d59c176eb326679fd5ae5d41bc28f3052ce52c1dc8dc76eb28096d94841d3e2a124927423ad08e508b253629014cfb0df11eb601efe37c2d9de105754ecc6b3dd5dc2df6e3821325", 0x9d}, {&(0x7f0000000480)="9fe78fd6b3e036ff3aabc62b5e1e7d3bdca9116368b1b428a069121c1c52a099e7ceb564068c275cb1b3b26f319fd21d6c153062496504ba0040f74c1f5a6c8ef69c539050a493b1268a116b5ba2c58ffb3dd2742da4c970db3293d828c572dc56ad0b7f6bf6fc644e0939e9ad98f1d7676d3799679bff691d3f6c1c97e4ee7812d4ee8ed41fedf4d6acf13209e9cb0a76ae0452ecca03c14535c4e9199fa942650d752283", 0xa5}], 0x7, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) getsockopt$inet6_IPV6_XFRM_POLICY(r0, 0x29, 0x23, &(0x7f0000000640)={{{@in6=@initdev, @in6=@ipv4={[], [], @remote}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@empty}, 0x0, @in=@initdev}}, &(0x7f0000000740)=0xe8) lsetxattr$security_capability(&(0x7f00000005c0)='./file0\x00', &(0x7f0000000600)='security.capability\x00', &(0x7f0000000780)=@v3={0x3000000, [{0x7, 0x2}, {0x9, 0x3}], r2}, 0x18, 0x2) ioctl$BINDER_GET_NODE_DEBUG_INFO(r1, 0xc018620b, &(0x7f0000000000)) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, &(0x7f00000007c0)={0x401, 0x5, 0x1}) [ 349.819079] binder: 13159:13174 ioctl c0306201 20012000 returned -22 [ 349.841104] binder: BINDER_SET_CONTEXT_MGR already set [ 349.841112] binder: 13165:13175 ioctl 40046207 0 returned -16 14:04:04 executing program 1: socket(0x0, 0x0, 0x0) r0 = syz_open_procfs(0x0, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$cgroup_int(0xffffffffffffffff, 0x0, 0x2, 0x0) openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x7a05, 0x1700) openat$smack_thread_current(0xffffffffffffff9c, &(0x7f0000000240)='/proc/thread-self/attr/current\x00', 0x2, 0x0) write$cgroup_subtree(0xffffffffffffffff, 0x0, 0x0) ioctl$TCSETAF(0xffffffffffffffff, 0x5408, &(0x7f0000000040)) ioctl$EXT4_IOC_GROUP_ADD(0xffffffffffffffff, 0x40286608, 0x0) ioctl$EVIOCGVERSION(0xffffffffffffffff, 0x80044501, 0x0) r1 = syz_genetlink_get_family_id$tipc(&(0x7f0000000080)='TIPC\x00') sendmsg$TIPC_CMD_DISABLE_BEARER(r0, &(0x7f0000000140)={&(0x7f0000000000), 0xc, &(0x7f0000000100)={&(0x7f00000000c0)={0x28, r1, 0x402, 0x70bd2b, 0x25dfdbfb, {{}, 0x0, 0x4102, 0x0, {0xc, 0x13, @l2={'eth', 0x3a, 'nr0\x00'}}}, ["", "", "", "", ""]}, 0x28}, 0x1, 0x0, 0x0, 0x40}, 0x8004) write$P9_RRENAMEAT(r0, &(0x7f0000000200)={0x7, 0x4b, 0x1}, 0x7) 14:04:04 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSPTLCK(r0, 0x40045431, &(0x7f0000000180)) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) socket(0x200000000000011, 0x4000000000080002, 0x0) bind$packet(0xffffffffffffffff, 0x0, 0x0) sendmmsg(0xffffffffffffffff, &(0x7f0000007880)=[{{&(0x7f00000001c0)=@l2={0x1f, 0xbf53, {0x9, 0x7, 0xfffffffffffffdd5, 0x1ff, 0x2, 0x4}, 0x0, 0x7}, 0x80, 0x0}}, {{0x0, 0x0, &(0x7f0000007780)}}], 0x2, 0x4048851) setsockopt$packet_int(0xffffffffffffffff, 0x107, 0x0, 0x0, 0x0) syz_open_procfs(0x0, 0x0) ioctl$LOOP_SET_BLOCK_SIZE(0xffffffffffffffff, 0x4c09, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$cgroup_int(0xffffffffffffffff, 0x0, 0x2, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x26e1, 0x0) ioctl$PERF_EVENT_IOC_PAUSE_OUTPUT(r1, 0x40086602, 0x400007) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000280)='./cgroup/syz0\x00', 0x1ff) openat$smack_thread_current(0xffffffffffffff9c, &(0x7f0000000240)='/proc/thread-self/attr/current\x00', 0x2, 0x0) write$cgroup_subtree(r1, &(0x7f0000000100)=ANY=[], 0xff4a) write$cgroup_subtree(r2, &(0x7f0000000000)=ANY=[], 0x20032600) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a0f, 0x1700) accept$inet(0xffffffffffffffff, &(0x7f0000000040)={0x2, 0x0, @local}, &(0x7f0000000080)=0x10) ioctl$TCSETAF(r0, 0x5408, &(0x7f0000000040)={0x2}) ioctl$EXT4_IOC_GROUP_ADD(r0, 0x40286608, &(0x7f0000000000)={0x3, 0x7000000, 0x400, 0x100000000, 0x0, 0x8}) r3 = fcntl$dupfd(r0, 0x406, r0) ioctl$EVIOCGVERSION(r3, 0x80044501, &(0x7f0000000200)=""/31) write$binfmt_misc(r0, &(0x7f0000000080)={'syz1', "80fa25cdc862d216160cfa92845a3916e38a409a159c03f1889971d3e5144a8d08de78c4b1fbee457437261d7668b1c0f582647ad4134a05358d4309a71a702002329e024cac95642e761bb842bc1056bd6bf12c47697a649a026bd8ee1f685089941469b1ddfeddf32b392f0ff07652a3bce0770bc3bb70862845a65054cecb191e80b825d740fe6b40450359757032425dfdee92aec36ce4b468d50adc745c522cc4af2ac6e7f6a95f0edd70b09caa95fcc7143cf46b74db8bc17fa7c89f"}, 0xc3) [ 350.160498] binder_alloc: 12244: binder_alloc_buf, no vma [ 350.160515] binder: 13281:13283 transaction failed 29189/-3, size 0-24 line 3256 [ 350.160709] binder: BINDER_SET_CONTEXT_MGR already set [ 350.160716] binder: 13281:13283 ioctl 40046207 0 returned -16 [ 350.160934] binder: BINDER_SET_CONTEXT_MGR already set [ 350.160940] binder: 13277:13282 ioctl 40046207 0 returned -16 [ 350.161007] binder: 13277:13282 ioctl 6612 0 returned -22 [ 350.161141] binder: 13277:13282 ioctl 5502 0 returned -22 [ 350.178587] binder: 13275:13285 unknown command 1830611970 [ 350.178595] binder: 13275:13285 ioctl c0306201 20012000 returned -22 [ 350.184974] binder: 13275:13289 unknown command 1830611970 [ 350.184984] binder: 13275:13289 ioctl c0306201 20012000 returned -22 [ 350.185307] binder: BINDER_SET_CONTEXT_MGR already set [ 350.185314] binder: 13286:13290 ioctl 40046207 0 returned -16 [ 350.185581] binder: 13286:13290 ioctl 4c09 3 returned -22 [ 350.185645] binder: 13286:13290 ioctl 800c6613 200001c0 returned -22 [ 350.373757] binder: BINDER_SET_CONTEXT_MGR already set [ 350.373767] binder: 13392:13414 ioctl 40046207 0 returned -16 [ 350.377605] binder: BINDER_SET_CONTEXT_MGR already set [ 350.377614] binder: 13392:13428 ioctl 40046207 0 returned -16 [ 350.426056] binder_alloc: 12244: binder_alloc_buf, no vma [ 350.426074] binder: 13403:13429 transaction failed 29189/-3, size 0-24 line 3256 [ 350.426168] binder: BINDER_SET_CONTEXT_MGR already set 14:04:04 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000500)={0xb8, 0x0, &(0x7f0000000340)=[@transaction_sg={0x40486311, {{0x0, 0x0, 0x4, 0x0, 0x11, 0x0, 0x0, 0x0, 0x18, &(0x7f00000001c0), &(0x7f0000000200)=[0x30, 0x38, 0x0]}, 0x4}}, @clear_death, @register_looper, @transaction_sg={0x40486311, {{0x4, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x60, 0x8, &(0x7f0000000280)=[@ptr={0x70742a85, 0x0, &(0x7f0000000240), 0x1, 0x2, 0x5}, @fda={0x66646185, 0x4, 0x0, 0x1f}, @fd={0x66642a85, 0x0, r0, 0x0, 0x3}], &(0x7f0000000300)=[0x30]}, 0xffffffffffff27b9}}, @dead_binder_done={0x40086310, 0x3}], 0xd6, 0x0, &(0x7f0000000400)="70602ea627f3f733248660b67770dc63c1e7a792bf6f8eb2e8c4a8197b9c398e156fa26604d527aab47ff903b210f1099614a3816b4f03a3ba81d642f2bcafe9176ce10ef3ae599d6fb9e5ebf8bb528857d7fa1db8a770d2f7da6949c2c478b355178aa6950bd7ce6ff998a6be20cf4354206c67b3586aa6e79f556ddb4bb7ebd31885add23fcbdfd800c0e4bf6b74e8b0389681ff1258cc8487590c33d68e369cddf6945e7001f8f85050c84ac112e7e9d42d2ca26b8b718d0316646661928b2b449a9fd5da49f3e00ae1dc1c1bba78b68db274f76e"}) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, &(0x7f0000000040)) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x800, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendmsg$key(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000000)={0x0}}, 0x0) prctl$PR_CAP_AMBIENT(0x2f, 0x4, 0x24) sendmsg$key(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000200)=ANY=[@ANYBLOB="020700001000000000000000000000000800120000000100000000000000000006000000000000000000000000000200e00040e0ff00000000000000000000000000ada8008004000000200000000000030006000000000002000080ac14ffbbf00000000000000003000500000000000200423b1d632bd7b8200000000000c7"], 0x80}}, 0x0) r1 = socket$key(0xf, 0x3, 0x2) sendmmsg(r1, &(0x7f0000000180), 0x32bc45944b084a6, 0x0) r2 = gettid() ioctl$sock_SIOCGPGRP(0xffffffffffffffff, 0x8904, &(0x7f0000000180)=0x0) tgkill(r2, r3, 0x3) mmap$binder(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x2, 0xc0010, r0, 0x0) [ 350.426174] binder: 13403:13429 ioctl 40046207 0 returned -16 [ 350.806417] binder: 13536:13551 Acquire 1 refcount change on invalid ref 0 ret -22 [ 350.825005] binder: 13536:13555 Acquire 1 refcount change on invalid ref 0 ret -22 INIT: Id "1" respawning too fast: disabled for 5 minutes INIT: Id "2" respawning too fast: disabled for 5 minutes INIT: Id "5" respawning too fast: disabled for 5 minutes INIT: Id "4" respawning too fast: disabled for 5 minutes INIT: Id "6" respawning too fast: disabled for 5 minutes INIT: Id "3" respawning too fast: disabled for 5 minutes [ 572.772771] INFO: task syz-executor.4:2114 blocked for more than 140 seconds. [ 572.780105] Not tainted 4.9.169+ #41 [ 572.784468] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. [ 572.793143] syz-executor.4 D25528 2114 1 0x00000004 [ 572.798979] ffff8801d0f84740 ffff8801cf7e3c80 ffff8801db721000 ffff8801c78f8000 [ 572.807273] ffff8801db721018 ffff8801ac2d7a28 ffffffff8280152e ffffffff82e2ba28 [ 572.815549] ffffffff81208040 006c6f844776f1c8 ffff8801db7218f0 1ffff1003585af34 [ 572.824558] Call Trace: [ 572.827403] [<00000000453ef4b6>] ? __schedule+0x6ce/0x1f10 [ 572.833194] [<00000000f2fbc360>] ? trace_hardirqs_on+0x10/0x10 [ 572.839384] [<00000000aca26a36>] ? io_schedule_timeout+0x390/0x390 [ 572.845922] [<00000000582be416>] ? mark_held_locks+0xb1/0x100 [ 572.851906] [<000000005c8c3a78>] schedule+0x92/0x1c0 [ 572.857187] [<0000000052fa5abb>] schedule_preempt_disabled+0x13/0x20 [ 572.863955] [<00000000b5e0cb26>] mutex_lock_nested+0x38d/0x920 [ 572.870268] [<00000000380b416e>] ? lo_ioctl+0x85/0x1a10 [ 572.876298] [<000000007b92134a>] ? mutex_trylock+0x3f0/0x3f0 [ 572.882294] [<000000004a66690b>] ? avc_has_extended_perms+0xe5/0xd30 [ 572.888951] [<00000000380b416e>] lo_ioctl+0x85/0x1a10 [ 572.894753] [<000000008e1769ed>] ? do_syscall_64+0x1ad/0x570 [ 572.900691] [<000000001cce0e41>] ? entry_SYSCALL_64_after_swapgs+0x5d/0xdb [ 572.908096] [<000000006495aa7b>] ? debug_lockdep_rcu_enabled+0x71/0xa0 [ 572.914969] [<00000000e34d605f>] ? loop_add+0x7b0/0x7b0 [ 572.920528] [<000000004721621a>] blkdev_ioctl+0xe14/0x19e0 [ 572.926997] [<000000006c899f9a>] ? blkpg_ioctl+0x920/0x920 [ 572.932964] [<000000006bff956d>] ? trace_hardirqs_on_caller+0x385/0x5a0 [ 572.939944] [<00000000972b126c>] block_ioctl+0xde/0x120 [ 572.945603] [<000000008beb548c>] ? blkdev_fallocate+0x430/0x430 [ 572.952089] [<0000000071635741>] do_vfs_ioctl+0xb87/0x11d0 [ 572.958246] [<0000000051f75271>] ? selinux_file_ioctl+0x103/0x550 [ 572.965144] [<000000002b4a82d5>] ? ioctl_preallocate+0x210/0x210 [ 572.971656] [<000000001827dc47>] ? selinux_parse_skb.constprop.0+0x16b0/0x16b0 [ 572.979508] [<00000000b1ab0f86>] ? do_sys_open+0x27c/0x610 [ 572.985425] [<00000000f25e3ec9>] ? filp_open+0x70/0x70 [ 572.990986] [<000000006f90a05c>] ? SyS_mkdirat+0x164/0x250 [ 572.996780] [<000000002099809e>] ? security_file_ioctl+0x8f/0xc0 [ 573.003202] [<00000000d0e38b3f>] SyS_ioctl+0x8f/0xc0 [ 573.008508] [<00000000bdedcf90>] ? do_vfs_ioctl+0x11d0/0x11d0 [ 573.014577] [<000000008e1769ed>] do_syscall_64+0x1ad/0x570 [ 573.020303] [<000000001cce0e41>] entry_SYSCALL_64_after_swapgs+0x5d/0xdb [ 573.027308] [ 573.027308] Showing all locks held in the system: [ 573.033821] 2 locks held by khungtaskd/24: [ 573.038305] #0: (rcu_read_lock){......}, at: [<0000000063af1c22>] watchdog+0x13c/0xae0 [ 573.047569] #1: (tasklist_lock){.+.+..}, at: [<00000000dfcb207a>] debug_show_all_locks+0x7f/0x21f [ 573.057752] 2 locks held by getty/2023: [ 573.061849] #0: (&tty->ldisc_sem){++++++}, at: [<0000000060cec0c8>] ldsem_down_read+0x33/0x40 [ 573.071432] #1: (&ldata->atomic_read_lock){+.+...}, at: [<000000006af52ce2>] n_tty_read+0x1fe/0x1820 [ 573.081798] 1 lock held by syz-executor.4/2114: [ 573.086580] #0: (loop_ctl_mutex/1){+.+.+.}, at: [<00000000380b416e>] lo_ioctl+0x85/0x1a10 [ 573.096021] 2 locks held by syz-executor.2/2120: [ 573.100829] #0: (&bdev->bd_mutex){+.+.+.}, at: [<000000005e644eb9>] __blkdev_get+0x10e/0xeb0 [ 573.110532] #1: (loop_index_mutex){+.+.+.}, at: [<00000000b13b2cc2>] lo_open+0x1d/0xb0 [ 573.119554] 2 locks held by syz-executor.5/2124: [ 573.124395] #0: (&bdev->bd_mutex){+.+.+.}, at: [<000000005e644eb9>] __blkdev_get+0x10e/0xeb0 [ 573.134074] #1: (loop_index_mutex){+.+.+.}, at: [<00000000b13b2cc2>] lo_open+0x1d/0xb0 [ 573.143646] 1 lock held by syz-executor.3/2138: [ 573.148318] #0: (&bdev->bd_mutex){+.+.+.}, at: [<000000005e644eb9>] __blkdev_get+0x10e/0xeb0 [ 573.157875] 2 locks held by syz-executor.1/2141: [ 573.162860] #0: (&bdev->bd_mutex){+.+.+.}, at: [<000000005e644eb9>] __blkdev_get+0x10e/0xeb0 [ 573.172352] #1: (loop_index_mutex){+.+.+.}, at: [<00000000b13b2cc2>] lo_open+0x1d/0xb0 [ 573.181328] 2 locks held by syz-executor.0/13424: [ 573.186277] #0: (loop_ctl_mutex/1){+.+.+.}, at: [<00000000380b416e>] lo_ioctl+0x85/0x1a10 [ 573.196224] #1: (&bdev->bd_mutex){+.+.+.}, at: [<000000000145474e>] blkdev_reread_part+0x1f/0x40 [ 573.205938] 3 locks held by blkid/13537: [ 573.210001] #0: (&bdev->bd_mutex){+.+.+.}, at: [<00000000edcf936d>] __blkdev_put+0xbb/0x840 [ 573.219547] #1: (loop_index_mutex){+.+.+.}, at: [<0000000045473635>] lo_release+0x1e/0x1b0 [ 573.229019] #2: (loop_ctl_mutex#2){+.+.+.}, at: [<0000000050393a1c>] lo_release+0x84/0x1b0 [ 573.238521] 1 lock held by blkid/13544: [ 573.242636] #0: (loop_ctl_mutex/1){+.+.+.}, at: [<00000000380b416e>] lo_ioctl+0x85/0x1a10 [ 573.252129] 1 lock held by blkid/13546: [ 573.256153] #0: (loop_ctl_mutex/1){+.+.+.}, at: [<00000000380b416e>] lo_ioctl+0x85/0x1a10 [ 573.265591] 2 locks held by blkid/13547: [ 573.269763] #0: (&bdev->bd_mutex){+.+.+.}, at: [<000000005e644eb9>] __blkdev_get+0x10e/0xeb0 [ 573.279289] #1: (loop_index_mutex){+.+.+.}, at: [<00000000b13b2cc2>] lo_open+0x1d/0xb0 [ 573.288928] [ 573.291038] ============================================= [ 573.291038] [ 573.298615] NMI backtrace for cpu 0 [ 573.302395] CPU: 0 PID: 24 Comm: khungtaskd Not tainted 4.9.169+ #41 [ 573.309068] ffff8801d98d7cc8 ffffffff81b4f7f1 0000000000000000 0000000000000000 [ 573.317239] 0000000000000000 ffffffff81097401 dffffc0000000000 ffff8801d98d7d00 [ 573.325398] ffffffff81b5aa8c 0000000000000000 0000000000000000 0000000000000000 [ 573.333510] Call Trace: [ 573.336087] [<0000000086106f6f>] dump_stack+0xc1/0x120 [ 573.341493] [<000000005fe873d1>] ? irq_force_complete_move+0x281/0x300 [ 573.348346] [<0000000089363824>] nmi_cpu_backtrace.cold+0x47/0x87 [ 573.354834] [<00000000d4c2797d>] ? irq_force_complete_move+0x300/0x300 [ 573.362058] [<00000000dbf640c5>] nmi_trigger_cpumask_backtrace+0x124/0x155 [ 573.369164] [<000000008b847ef0>] arch_trigger_cpumask_backtrace+0x14/0x20 [ 573.376434] [<00000000327ad2f1>] watchdog+0x661/0xae0 [ 573.381854] [<0000000063af1c22>] ? watchdog+0x13c/0xae0 [ 573.387573] [<000000006bff956d>] ? trace_hardirqs_on_caller+0x385/0x5a0 [ 573.394921] [<00000000a727a841>] ? reset_hung_task_detector+0x20/0x20 [ 573.401584] [<00000000065762fe>] kthread+0x278/0x310 [ 573.406988] [<00000000fcbe0d57>] ? kthread_park+0xa0/0xa0 [ 573.412699] [<000000006495aa7b>] ? debug_lockdep_rcu_enabled+0x71/0xa0 [ 573.419523] [<00000000ed7bc0fc>] ? _raw_spin_unlock_irq+0x39/0x60 [ 573.426282] [<000000006b5f9240>] ? finish_task_switch+0x1e5/0x660 [ 573.433737] [<00000000922a4255>] ? finish_task_switch+0x1b7/0x660 [ 573.440344] [<00000000718b07a8>] ? __switch_to_asm+0x34/0x70 [ 573.446228] [<00000000c12d9998>] ? __switch_to_asm+0x40/0x70 [ 573.452112] [<00000000718b07a8>] ? __switch_to_asm+0x34/0x70 [ 573.458619] [<00000000fcbe0d57>] ? kthread_park+0xa0/0xa0 [ 573.464263] [<00000000fcbe0d57>] ? kthread_park+0xa0/0xa0 [ 573.469892] [<00000000bb98a1f7>] ret_from_fork+0x5c/0x70 [ 573.475665] Sending NMI from CPU 0 to CPUs 1: [ 573.480476] NMI backtrace for cpu 1 skipped: idling at pc 0xffffffff828105a2 [ 573.487737] Kernel panic - not syncing: hung_task: blocked tasks [ 573.494044] CPU: 0 PID: 24 Comm: khungtaskd Not tainted 4.9.169+ #41 [ 573.500535] ffff8801d98d7c60 ffffffff81b4f7f1 ffff8801d0f84700 ffffffff82a79d00 [ 573.508576] 00000000ffffffff 0000000000000000 dffffc0000000000 ffff8801d98d7d40 [ 573.516778] ffffffff813f95aa 0000000041b58ab3 ffffffff82e2ede2 ffffffff813f93d1 [ 573.524825] Call Trace: [ 573.527407] [<0000000086106f6f>] dump_stack+0xc1/0x120 [ 573.532818] [<00000000b8e9c68c>] panic+0x1d9/0x3bd [ 573.537824] [<00000000212c5605>] ? add_taint.cold+0x16/0x16 [ 573.543621] [<0000000087a52f65>] ? find_next_bit+0x44/0x50 [ 573.549450] [<000000008dd84b46>] ? printk_nmi_flush+0xae/0xd0 [ 573.555537] [<00000000d4c2797d>] ? irq_force_complete_move+0x300/0x300 [ 573.562392] [<00000000ba769a00>] ? nmi_trigger_cpumask_backtrace+0xfc/0x155 [ 573.569747] [<000000003d546491>] watchdog+0x672/0xae0 [ 573.575035] [<0000000063af1c22>] ? watchdog+0x13c/0xae0 [ 573.580494] [<000000006bff956d>] ? trace_hardirqs_on_caller+0x385/0x5a0 [ 573.587331] [<00000000a727a841>] ? reset_hung_task_detector+0x20/0x20 [ 573.594003] [<00000000065762fe>] kthread+0x278/0x310 [ 573.599259] [<00000000fcbe0d57>] ? kthread_park+0xa0/0xa0 [ 573.605180] [<000000006495aa7b>] ? debug_lockdep_rcu_enabled+0x71/0xa0 [ 573.612028] [<00000000ed7bc0fc>] ? _raw_spin_unlock_irq+0x39/0x60 [ 573.618364] [<000000006b5f9240>] ? finish_task_switch+0x1e5/0x660 [ 573.624667] [<00000000922a4255>] ? finish_task_switch+0x1b7/0x660 [ 573.631208] [<00000000718b07a8>] ? __switch_to_asm+0x34/0x70 [ 573.637305] [<00000000c12d9998>] ? __switch_to_asm+0x40/0x70 [ 573.643201] [<00000000718b07a8>] ? __switch_to_asm+0x34/0x70 [ 573.649444] [<00000000fcbe0d57>] ? kthread_park+0xa0/0xa0 [ 573.655078] [<00000000fcbe0d57>] ? kthread_park+0xa0/0xa0 [ 573.660700] [<00000000bb98a1f7>] ret_from_fork+0x5c/0x70 [ 573.666934] Kernel Offset: disabled [ 573.670645] Rebooting in 86400 seconds..